Golang程序
|
794行
|
24.69 KB
// Copyright 2017 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
package ifuzz
import (
"math/rand"
)
func initPseudo() {
Insns = append(Insns, &Insn{
Name: "PSEUDO_RDMSR",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
msr := msrs[r.Intn(len(msrs))]
gen.mov32(regECX, msr)
gen.byte(0x0f, 0x32) // rdmsr
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_WRMSR",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
msr := msrs[r.Intn(len(msrs))]
v := generateInt(cfg, r, 8)
gen.mov32(regECX, msr)
gen.mov32(regEAX, uint32(v>>0))
gen.mov32(regEDX, uint32(v>>32))
gen.byte(0x0f, 0x30) // wrmsr
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_PCI_READ",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
addr, port, size := pciAddrPort(r)
gen.out32(0xcf8, addr)
gen.in(port, size)
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_PCI_WRITE",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
addr, port, size := pciAddrPort(r)
val := generateInt(cfg, r, 4)
gen.out32(0xcf8, addr)
gen.out(port, uint32(val), size)
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_PORT_READ",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
port := ports[r.Intn(len(ports))]
gen.in(port, r.Intn(3))
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_PORT_WRITE",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
port := ports[r.Intn(len(ports))]
val := generateInt(cfg, r, 4)
gen.out(port, uint32(val), r.Intn(3))
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_XOR_CR",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
cr := controlRegisters[r.Intn(len(controlRegisters))]
var v uint32
if cr == 8 {
v = uint32(r.Intn(15) + 1)
} else {
bit := controlRegistersBits[cr][r.Intn(len(controlRegistersBits[cr]))]
v = 1 << bit
}
gen.readCR(cr)
gen.xor32(regEAX, v)
gen.writeCR(cr)
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_XOR_EFER",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
gen.mov32(regECX, eferMSR)
gen.byte(0x0f, 0x32) // rdmsr
bit := eferBits[r.Intn(len(eferBits))]
gen.xor32(regEAX, 1<<bit)
gen.byte(0x0f, 0x30) // wrmsr
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_SET_BREAK",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
br := uint8(r.Intn(4))
loc := uint32(r.Intn(4))
typ := uint32(r.Intn(16))
addr := generateInt(cfg, r, 8)
if cfg.Mode == ModeLong64 {
gen.mov64(regRAX, addr)
} else {
gen.mov32(regEAX, uint32(addr))
}
gen.writeDR(br)
gen.readDR(7)
gen.xor32(regEAX, loc<<(br*2)|typ<<(16+br*4))
gen.writeDR(7)
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_LOAD_SEG",
Mode: 1<<ModeLast - 1,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
sel := randSelector(r)
if cfg.Mode == ModeReal16 {
sel = uint16(generateInt(cfg, r, 8)) >> 4
}
reg := uint8(r.Intn(6))
gen.mov16(regAX, sel)
gen.byte(0x8e, 0xc0|(reg<<3)) // mov %ax, %seg
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_FAR_JMP",
Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
sel := randSelector(r)
off := generateInt(cfg, r, 4)
if cfg.Mode == ModeLong64 {
gen.mov32toSPaddr(uint32(sel), 0)
gen.mov32toSPaddr(uint32(off), 2)
if r.Intn(2) == 0 {
gen.byte(0xff, 0x2c, 0x24) // ljmp (%rsp)
} else {
gen.byte(0xff, 0x1c, 0x24) // lcall (%rsp)
}
} else {
if r.Intn(2) == 0 {
gen.byte(0xea) // ljmp $imm16, $imm16/32
} else {
gen.byte(0x9a) // lcall $imm16, $imm16/32
}
if cfg.Mode == ModeProt16 {
gen.imm16(uint16(off))
} else {
gen.imm32(uint32(off))
}
gen.imm16(sel)
}
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_LTR_LLDT",
Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
sel := randSelector(r)
gen.mov16(regAX, sel)
if r.Intn(2) == 0 {
gen.byte(0x0f, 0x00, 0xd8) // ltr %ax
} else {
gen.byte(0x0f, 0x00, 0xd0) // lldt %ax
}
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_LGIDT",
Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
limit := uint32(generateInt(cfg, r, 2))
base := uint32(generateInt(cfg, r, 4))
gen.mov32toSPaddr(limit, 0)
gen.mov32toSPaddr(base, 2)
gen.mov32toSPaddr(0, 6)
gen.addr32()
if r.Intn(2) == 0 {
gen.byte(0x0f, 0x01, 0x14, 0x24) // lgdt (%rsp)
} else {
gen.byte(0x0f, 0x01, 0x1c, 0x24) // lidt (%rsp)
}
return gen.text
},
})
Insns = append(Insns, &Insn{
Name: "PSEUDO_HYPERCALL",
Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16,
Priv: true,
Pseudo: true,
generator: func(cfg *Config, r *rand.Rand) []byte {
gen := makeGen(cfg, r)
switch r.Intn(2) {
case 0:
gen.mov32(regEAX, 1) // KVM_HC_VAPIC_POLL_IRQ
case 1:
gen.mov32(regEAX, 5) // KVM_HC_KICK_CPU
gen.mov32(regECX, uint32(generateInt(cfg, r, 4))) // APIC ID
default:
panic("bad")
}
if r.Intn(2) == 0 {
gen.byte(0x0f, 0x01, 0xd9) // vmmcall
} else {
gen.byte(0x0f, 0x01, 0xc1) // vmcall
}
return gen.text
},
})
}
const (
regAL = iota
regAX
regEAX
regRAX
regCL
regCX
regECX
regRCX
regDL
regDX
regEDX
regRDX
)
type generator struct {
mode int
r *rand.Rand
text []byte
}
func makeGen(cfg *Config, r *rand.Rand) *generator {
return &generator{
mode: cfg.Mode,
r: r,
}
}
func (gen *generator) byte(v ...uint8) {
gen.text = append(gen.text, v...)
}
func (gen *generator) imm16(v uint16) {
gen.byte(byte(v>>0), byte(v>>8))
}
func (gen *generator) imm32(v uint32) {
gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24))
}
func (gen *generator) imm64(v uint64) {
gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24),
byte(v>>32), byte(v>>40), byte(v>>48), byte(v>>56))
}
func (gen *generator) operand16() {
switch gen.mode {
case ModeLong64, ModeProt32:
gen.byte(0x66)
case ModeProt16, ModeReal16:
default:
panic("bad mode")
}
}
func (gen *generator) operand32() {
switch gen.mode {
case ModeLong64, ModeProt32:
case ModeProt16, ModeReal16:
gen.byte(0x66)
default:
panic("bad mode")
}
}
func (gen *generator) addr32() {
switch gen.mode {
case ModeLong64, ModeProt32:
case ModeProt16, ModeReal16:
gen.byte(0x67)
default:
panic("bad mode")
}
}
func (gen *generator) mov8(reg int, v uint8) {
switch reg {
case regAL:
gen.byte(0xb0)
case regCL:
gen.byte(0xb1)
case regDL:
gen.byte(0xb2)
default:
panic("unknown register")
}
gen.byte(v)
}
func (gen *generator) mov16(reg int, v uint16) {
gen.operand16()
switch reg {
case regAX:
gen.byte(0xb8)
case regCX:
gen.byte(0xb9)
case regDX:
gen.byte(0xba)
default:
panic("unknown register")
}
gen.imm16(v)
}
func (gen *generator) mov32(reg int, v uint32) {
gen.operand32()
switch reg {
case regEAX:
gen.byte(0xb8)
case regECX:
gen.byte(0xb9)
case regEDX:
gen.byte(0xba)
default:
panic("unknown register")
}
gen.imm32(v)
}
func (gen *generator) mov64(reg int, v uint64) {
if gen.mode != ModeLong64 {
panic("bad mode")
}
gen.byte(0x48)
switch reg {
case regRAX:
gen.byte(0xb8)
case regRCX:
gen.byte(0xb9)
case regRDX:
gen.byte(0xba)
default:
panic("unknown register")
}
gen.imm64(v)
}
// movl $v, off(%rsp)
func (gen *generator) mov32toSPaddr(v uint32, off uint8) {
gen.addr32()
gen.operand32()
gen.byte(0xc7, 0x44, 0x24, off)
gen.imm32(v)
}
func (gen *generator) xor32(reg int, v uint32) {
gen.operand32()
switch reg {
case regEAX:
gen.byte(0x35)
default:
panic("unknown register")
}
gen.imm32(v)
}
func (gen *generator) readCR(cr uint8) {
if cr < 8 {
// mov %crN, %eax/%rax
gen.byte(0x0f, 0x20, 0xc0|cr<<3)
} else if cr < 16 {
// mov %crN, %eax/%rax
gen.byte(0x44, 0x0f, 0x20, 0xc0|(cr-8)<<3)
} else {
panic("bad cr")
}
}
func (gen *generator) writeCR(cr uint8) {
if cr < 8 {
// mov %eax/%rax, %crN
gen.byte(0x0f, 0x22, 0xc0|cr<<3)
} else if cr < 16 {
// mov %eax/%rax, %crN
gen.byte(0x44, 0x0f, 0x22, 0xc0|(cr-8)<<3)
} else {
panic("bad cr")
}
}
func (gen *generator) readDR(dr uint8) {
if dr >= 8 {
panic("bad dr")
}
// mov %drN, %eax/%rax
gen.byte(0x0f, 0x21, 0xc0|dr<<3)
}
func (gen *generator) writeDR(dr uint8) {
if dr >= 8 {
panic("bad dr")
}
// mov %eax/%rax, %drN
gen.byte(0x0f, 0x23, 0xc0|dr<<3)
}
func (gen *generator) in8(port uint16) {
gen.mov16(regDX, port)
gen.byte(0xec) // in %al, %dx
}
func (gen *generator) in16(port uint16) {
gen.mov16(regDX, port)
gen.operand16()
gen.byte(0xed) // in %ax, %dx
}
func (gen *generator) in32(port uint16) {
gen.mov16(regDX, port)
gen.operand32()
gen.byte(0xed) // in %eax, %dx
}
func (gen *generator) in(port uint16, size int) {
switch size {
case 0:
gen.in8(port)
case 1:
gen.in16(port)
case 2:
gen.in32(port)
default:
panic("bad size")
}
}
func (gen *generator) out8(port uint16, v uint8) {
gen.mov16(regDX, port)
gen.mov8(regAL, v)
gen.byte(0xee) // out %dx, %al
}
func (gen *generator) out16(port uint16, v uint16) {
gen.mov16(regDX, port)
gen.mov16(regAX, v)
gen.operand16()
gen.byte(0xef) // out %dx, %ax
}
func (gen *generator) out32(port uint16, v uint32) {
gen.mov16(regDX, port)
gen.mov32(regEAX, v)
gen.operand32()
gen.byte(0xef) // out %dx, %eax
}
func (gen *generator) out(port uint16, v uint32, size int) {
switch size {
case 0:
gen.out8(port, uint8(v))
case 1:
gen.out16(port, uint16(v))
case 2:
gen.out32(port, v)
default:
panic("bad size")
}
}
func randSelector(r *rand.Rand) uint16 {
seg := uint16(r.Intn(40))
dpl := uint16(r.Intn(4))
ldt := uint16(r.Intn(2))
return seg<<3 | ldt<<2 | dpl
}
func pciAddrPort(r *rand.Rand) (addr uint32, port uint16, size int) {
bus := uint32(r.Intn(256))
dev := uint32(r.Intn(32))
fn := uint32(r.Intn(8))
reghi := uint32(r.Intn(16))
reglo := uint32(r.Intn(64)) << 2
port = 0xcfc
switch size = r.Intn(3); size {
case 0:
port += uint16(reglo & 3)
reglo += uint32(r.Intn(4))
case 1:
port += uint16(reglo & 2)
reglo += uint32(r.Intn(2) * 2)
case 2:
}
addr = 0x80000000 | reghi<<24 | bus<<16 | dev<<11 | fn<<8 | reglo
return
}
var controlRegisters = []uint8{0, 3, 4, 8}
var controlRegistersBits = map[uint8][]uint8{
0: {0, 1, 2, 3, 4, 5, 16, 18, 29, 30, 31},
3: {3, 5},
4: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 13, 14, 16, 17, 18, 20, 21, 22},
}
const eferMSR = 0xC0000080
var eferBits = []uint8{0, 8, 10, 11, 12, 13, 14, 15}
var ports = []uint16{
0x40, 0x41, 0x42, 0x43, // PIT
0x61, // speaker
0x20, 0x21, 0xa0, 0xa1, 0x4d0, 0x4d1, // 8259
}
// sys/kvm.txt also knows this list
var msrs = []uint32{
0x0, 0x1, 0x10, 0x11, 0x12, 0x13, 0x17, 0x1b,
0x20, 0x21, 0x28, 0x29, 0x2a, 0x2c, 0x33, 0x34,
0x3a, 0x3b, 0x40, 0x60, 0x79, 0x88, 0x89, 0x8a,
0x8b, 0x9b, 0x9e, 0xc1, 0xc2, 0xcd, 0xce, 0xe2,
0xe7, 0xe8, 0xfe, 0x116, 0x118, 0x119, 0x11a, 0x11b,
0x11e, 0x174, 0x175, 0x176, 0x179, 0x17a, 0x17b, 0x180,
0x181, 0x182, 0x183, 0x184, 0x185, 0x186, 0x187, 0x188,
0x189, 0x18a, 0x198, 0x199, 0x19a, 0x19b, 0x19c, 0x19d,
0x1a0, 0x1a2, 0x1a6, 0x1a7, 0x1aa, 0x1ad, 0x1ae, 0x1af,
0x1b0, 0x1b1, 0x1b2, 0x1c8, 0x1c9, 0x1d9, 0x1db, 0x1dc,
0x1dd, 0x1de, 0x1e0, 0x1fc, 0x200, 0x201, 0x202, 0x203,
0x204, 0x205, 0x206, 0x207, 0x208, 0x209, 0x20a, 0x20b,
0x20c, 0x20d, 0x20e, 0x20f, 0x210, 0x211, 0x212, 0x213,
0x214, 0x215, 0x216, 0x217, 0x218, 0x219, 0x21a, 0x21b,
0x21c, 0x21d, 0x21e, 0x21f, 0x220, 0x221, 0x222, 0x223,
0x224, 0x225, 0x226, 0x227, 0x228, 0x229, 0x22a, 0x22b,
0x22c, 0x22d, 0x22e, 0x22f, 0x230, 0x231, 0x232, 0x233,
0x234, 0x235, 0x236, 0x237, 0x238, 0x239, 0x23a, 0x23b,
0x23c, 0x23d, 0x23e, 0x23f, 0x240, 0x241, 0x242, 0x243,
0x244, 0x245, 0x246, 0x247, 0x248, 0x249, 0x24a, 0x24b,
0x24c, 0x24d, 0x24e, 0x24f, 0x250, 0x251, 0x252, 0x253,
0x254, 0x255, 0x256, 0x257, 0x258, 0x259, 0x25a, 0x25b,
0x25c, 0x25d, 0x25e, 0x25f, 0x260, 0x261, 0x262, 0x263,
0x264, 0x265, 0x266, 0x267, 0x268, 0x269, 0x26a, 0x26b,
0x26c, 0x26d, 0x26e, 0x26f, 0x270, 0x271, 0x272, 0x273,
0x274, 0x275, 0x276, 0x277, 0x278, 0x279, 0x27a, 0x27b,
0x27c, 0x27d, 0x27e, 0x27f, 0x280, 0x281, 0x282, 0x283,
0x284, 0x285, 0x286, 0x287, 0x288, 0x289, 0x28a, 0x28b,
0x28c, 0x28d, 0x28e, 0x28f, 0x290, 0x291, 0x292, 0x293,
0x294, 0x295, 0x296, 0x297, 0x298, 0x299, 0x29a, 0x29b,
0x29c, 0x29d, 0x29e, 0x29f, 0x2a0, 0x2a1, 0x2a2, 0x2a3,
0x2a4, 0x2a5, 0x2a6, 0x2a7, 0x2a8, 0x2a9, 0x2aa, 0x2ab,
0x2ac, 0x2ad, 0x2ae, 0x2af, 0x2b0, 0x2b1, 0x2b2, 0x2b3,
0x2b4, 0x2b5, 0x2b6, 0x2b7, 0x2b8, 0x2b9, 0x2ba, 0x2bb,
0x2bc, 0x2bd, 0x2be, 0x2bf, 0x2c0, 0x2c1, 0x2c2, 0x2c3,
0x2c4, 0x2c5, 0x2c6, 0x2c7, 0x2c8, 0x2c9, 0x2ca, 0x2cb,
0x2cc, 0x2cd, 0x2ce, 0x2cf, 0x2d0, 0x2d1, 0x2d2, 0x2d3,
0x2d4, 0x2d5, 0x2d6, 0x2d7, 0x2d8, 0x2d9, 0x2da, 0x2db,
0x2dc, 0x2dd, 0x2de, 0x2df, 0x2e0, 0x2e1, 0x2e2, 0x2e3,
0x2e4, 0x2e5, 0x2e6, 0x2e7, 0x2e8, 0x2e9, 0x2ea, 0x2eb,
0x2ec, 0x2ed, 0x2ee, 0x2ef, 0x2f0, 0x2f1, 0x2f2, 0x2f3,
0x2f4, 0x2f5, 0x2f6, 0x2f7, 0x2f8, 0x2f9, 0x2fa, 0x2fb,
0x2fc, 0x2fd, 0x2fe, 0x2ff, 0x300, 0x301, 0x302, 0x303,
0x304, 0x305, 0x306, 0x307, 0x308, 0x309, 0x30a, 0x30b,
0x30c, 0x30d, 0x30e, 0x30f, 0x310, 0x311, 0x312, 0x313,
0x314, 0x315, 0x316, 0x317, 0x318, 0x319, 0x31a, 0x31b,
0x31c, 0x31d, 0x31e, 0x31f, 0x320, 0x321, 0x322, 0x323,
0x324, 0x325, 0x326, 0x327, 0x328, 0x329, 0x32a, 0x32b,
0x32c, 0x32d, 0x32e, 0x32f, 0x330, 0x331, 0x332, 0x333,
0x334, 0x335, 0x336, 0x337, 0x338, 0x339, 0x33a, 0x33b,
0x33c, 0x33d, 0x33e, 0x33f, 0x340, 0x341, 0x342, 0x343,
0x344, 0x345, 0x346, 0x347, 0x348, 0x349, 0x34a, 0x34b,
0x34c, 0x34d, 0x34e, 0x34f, 0x350, 0x351, 0x352, 0x353,
0x354, 0x355, 0x356, 0x357, 0x358, 0x359, 0x35a, 0x35b,
0x35c, 0x35d, 0x35e, 0x35f, 0x360, 0x361, 0x362, 0x363,
0x364, 0x365, 0x366, 0x367, 0x368, 0x369, 0x36a, 0x36b,
0x36c, 0x36d, 0x36e, 0x36f, 0x370, 0x371, 0x372, 0x373,
0x374, 0x375, 0x376, 0x377, 0x378, 0x379, 0x37a, 0x37b,
0x37c, 0x37d, 0x37e, 0x37f, 0x380, 0x381, 0x382, 0x383,
0x384, 0x385, 0x386, 0x387, 0x388, 0x389, 0x38a, 0x38b,
0x38c, 0x38d, 0x38e, 0x38f, 0x390, 0x391, 0x392, 0x393,
0x394, 0x395, 0x396, 0x397, 0x398, 0x399, 0x39a, 0x39b,
0x39c, 0x39d, 0x39e, 0x39f, 0x3a0, 0x3a1, 0x3a2, 0x3a3,
0x3a4, 0x3a5, 0x3a6, 0x3a7, 0x3a8, 0x3a9, 0x3aa, 0x3ab,
0x3ac, 0x3ad, 0x3ae, 0x3af, 0x3b0, 0x3b1, 0x3b2, 0x3b3,
0x3b4, 0x3b5, 0x3b6, 0x3b7, 0x3b8, 0x3b9, 0x3ba, 0x3bb,
0x3bc, 0x3bd, 0x3be, 0x3bf, 0x3c2, 0x3c3, 0x3c4, 0x3c5,
0x3f1, 0x3f2, 0x3f6, 0x3f7, 0x3f8, 0x3f9, 0x3fa, 0x3fc,
0x3fd, 0x3fe, 0x3ff, 0x400, 0x401, 0x402, 0x403, 0x404,
0x405, 0x406, 0x407, 0x408, 0x409, 0x40a, 0x40b, 0x40c,
0x40d, 0x40e, 0x40f, 0x410, 0x411, 0x412, 0x413, 0x480,
0x481, 0x482, 0x483, 0x484, 0x485, 0x486, 0x487, 0x488,
0x489, 0x48a, 0x48b, 0x48c, 0x48d, 0x48e, 0x48f, 0x490,
0x491, 0x4c1, 0x4d0, 0x560, 0x561, 0x570, 0x571, 0x572,
0x580, 0x581, 0x582, 0x583, 0x584, 0x585, 0x586, 0x587,
0x600, 0x606, 0x60a, 0x60b, 0x60c, 0x60d, 0x610, 0x611,
0x613, 0x614, 0x618, 0x619, 0x61b, 0x61c, 0x630, 0x631,
0x632, 0x633, 0x634, 0x635, 0x638, 0x639, 0x63a, 0x63b,
0x640, 0x641, 0x642, 0x648, 0x649, 0x64a, 0x64b, 0x64c,
0x64d, 0x64e, 0x64f, 0x658, 0x659, 0x65a, 0x65b, 0x660,
0x668, 0x669, 0x680, 0x690, 0x6b0, 0x6b1, 0x6c0, 0x6e0,
0x770, 0x771, 0x772, 0x773, 0x774, 0x777, 0x800, 0x801,
0x802, 0x803, 0x804, 0x805, 0x806, 0x807, 0x808, 0x809,
0x80a, 0x80b, 0x80c, 0x80d, 0x80e, 0x80f, 0x810, 0x811,
0x812, 0x813, 0x814, 0x815, 0x816, 0x817, 0x818, 0x819,
0x81a, 0x81b, 0x81c, 0x81d, 0x81e, 0x81f, 0x820, 0x821,
0x822, 0x823, 0x824, 0x825, 0x826, 0x827, 0x828, 0x829,
0x82a, 0x82b, 0x82c, 0x82d, 0x82e, 0x82f, 0x830, 0x831,
0x832, 0x833, 0x834, 0x835, 0x836, 0x837, 0x838, 0x839,
0x83a, 0x83b, 0x83c, 0x83d, 0x83e, 0x83f, 0x840, 0x841,
0x842, 0x843, 0x844, 0x845, 0x846, 0x847, 0x848, 0x849,
0x84a, 0x84b, 0x84c, 0x84d, 0x84e, 0x84f, 0x850, 0x851,
0x852, 0x853, 0x854, 0x855, 0x856, 0x857, 0x858, 0x859,
0x85a, 0x85b, 0x85c, 0x85d, 0x85e, 0x85f, 0x860, 0x861,
0x862, 0x863, 0x864, 0x865, 0x866, 0x867, 0x868, 0x869,
0x86a, 0x86b, 0x86c, 0x86d, 0x86e, 0x86f, 0x870, 0x871,
0x872, 0x873, 0x874, 0x875, 0x876, 0x877, 0x878, 0x879,
0x87a, 0x87b, 0x87c, 0x87d, 0x87e, 0x87f, 0x880, 0x881,
0x882, 0x883, 0x884, 0x885, 0x886, 0x887, 0x888, 0x889,
0x88a, 0x88b, 0x88c, 0x88d, 0x88e, 0x88f, 0x890, 0x891,
0x892, 0x893, 0x894, 0x895, 0x896, 0x897, 0x898, 0x899,
0x89a, 0x89b, 0x89c, 0x89d, 0x89e, 0x89f, 0x8a0, 0x8a1,
0x8a2, 0x8a3, 0x8a4, 0x8a5, 0x8a6, 0x8a7, 0x8a8, 0x8a9,
0x8aa, 0x8ab, 0x8ac, 0x8ad, 0x8ae, 0x8af, 0x8b0, 0x8b1,
0x8b2, 0x8b3, 0x8b4, 0x8b5, 0x8b6, 0x8b7, 0x8b8, 0x8b9,
0x8ba, 0x8bb, 0x8bc, 0x8bd, 0x8be, 0x8bf, 0x8c0, 0x8c1,
0x8c2, 0x8c3, 0x8c4, 0x8c5, 0x8c6, 0x8c7, 0x8c8, 0x8c9,
0x8ca, 0x8cb, 0x8cc, 0x8cd, 0x8ce, 0x8cf, 0x8d0, 0x8d1,
0x8d2, 0x8d3, 0x8d4, 0x8d5, 0x8d6, 0x8d7, 0x8d8, 0x8d9,
0x8da, 0x8db, 0x8dc, 0x8dd, 0x8de, 0x8df, 0x8e0, 0x8e1,
0x8e2, 0x8e3, 0x8e4, 0x8e5, 0x8e6, 0x8e7, 0x8e8, 0x8e9,
0x8ea, 0x8eb, 0x8ec, 0x8ed, 0x8ee, 0x8ef, 0x8f0, 0x8f1,
0x8f2, 0x8f3, 0x8f4, 0x8f5, 0x8f6, 0x8f7, 0x8f8, 0x8f9,
0x8fa, 0x8fb, 0x8fc, 0x8fd, 0x8fe, 0x8ff, 0x900, 0x901,
0x902, 0x903, 0x904, 0x905, 0x906, 0x907, 0x908, 0x909,
0x90a, 0x90b, 0x90c, 0x90d, 0x90e, 0x90f, 0x910, 0x911,
0x912, 0x913, 0x914, 0x915, 0x916, 0x917, 0x918, 0x919,
0x91a, 0x91b, 0x91c, 0x91d, 0x91e, 0x91f, 0x920, 0x921,
0x922, 0x923, 0x924, 0x925, 0x926, 0x927, 0x928, 0x929,
0x92a, 0x92b, 0x92c, 0x92d, 0x92e, 0x92f, 0x930, 0x931,
0x932, 0x933, 0x934, 0x935, 0x936, 0x937, 0x938, 0x939,
0x93a, 0x93b, 0x93c, 0x93d, 0x93e, 0x93f, 0x940, 0x941,
0x942, 0x943, 0x944, 0x945, 0x946, 0x947, 0x948, 0x949,
0x94a, 0x94b, 0x94c, 0x94d, 0x94e, 0x94f, 0x950, 0x951,
0x952, 0x953, 0x954, 0x955, 0x956, 0x957, 0x958, 0x959,
0x95a, 0x95b, 0x95c, 0x95d, 0x95e, 0x95f, 0x960, 0x961,
0x962, 0x963, 0x964, 0x965, 0x966, 0x967, 0x968, 0x969,
0x96a, 0x96b, 0x96c, 0x96d, 0x96e, 0x96f, 0x970, 0x971,
0x972, 0x973, 0x974, 0x975, 0x976, 0x977, 0x978, 0x979,
0x97a, 0x97b, 0x97c, 0x97d, 0x97e, 0x97f, 0x980, 0x981,
0x982, 0x983, 0x984, 0x985, 0x986, 0x987, 0x988, 0x989,
0x98a, 0x98b, 0x98c, 0x98d, 0x98e, 0x98f, 0x990, 0x991,
0x992, 0x993, 0x994, 0x995, 0x996, 0x997, 0x998, 0x999,
0x99a, 0x99b, 0x99c, 0x99d, 0x99e, 0x99f, 0x9a0, 0x9a1,
0x9a2, 0x9a3, 0x9a4, 0x9a5, 0x9a6, 0x9a7, 0x9a8, 0x9a9,
0x9aa, 0x9ab, 0x9ac, 0x9ad, 0x9ae, 0x9af, 0x9b0, 0x9b1,
0x9b2, 0x9b3, 0x9b4, 0x9b5, 0x9b6, 0x9b7, 0x9b8, 0x9b9,
0x9ba, 0x9bb, 0x9bc, 0x9bd, 0x9be, 0x9bf, 0x9c0, 0x9c1,
0x9c2, 0x9c3, 0x9c4, 0x9c5, 0x9c6, 0x9c7, 0x9c8, 0x9c9,
0x9ca, 0x9cb, 0x9cc, 0x9cd, 0x9ce, 0x9cf, 0x9d0, 0x9d1,
0x9d2, 0x9d3, 0x9d4, 0x9d5, 0x9d6, 0x9d7, 0x9d8, 0x9d9,
0x9da, 0x9db, 0x9dc, 0x9dd, 0x9de, 0x9df, 0x9e0, 0x9e1,
0x9e2, 0x9e3, 0x9e4, 0x9e5, 0x9e6, 0x9e7, 0x9e8, 0x9e9,
0x9ea, 0x9eb, 0x9ec, 0x9ed, 0x9ee, 0x9ef, 0x9f0, 0x9f1,
0x9f2, 0x9f3, 0x9f4, 0x9f5, 0x9f6, 0x9f7, 0x9f8, 0x9f9,
0x9fa, 0x9fb, 0x9fc, 0x9fd, 0x9fe, 0x9ff, 0xa00, 0xa01,
0xa02, 0xa03, 0xa04, 0xa05, 0xa06, 0xa07, 0xa08, 0xa09,
0xa0a, 0xa0b, 0xa0c, 0xa0d, 0xa0e, 0xa0f, 0xa10, 0xa11,
0xa12, 0xa13, 0xa14, 0xa15, 0xa16, 0xa17, 0xa18, 0xa19,
0xa1a, 0xa1b, 0xa1c, 0xa1d, 0xa1e, 0xa1f, 0xa20, 0xa21,
0xa22, 0xa23, 0xa24, 0xa25, 0xa26, 0xa27, 0xa28, 0xa29,
0xa2a, 0xa2b, 0xa2c, 0xa2d, 0xa2e, 0xa2f, 0xa30, 0xa31,
0xa32, 0xa33, 0xa34, 0xa35, 0xa36, 0xa37, 0xa38, 0xa39,
0xa3a, 0xa3b, 0xa3c, 0xa3d, 0xa3e, 0xa3f, 0xa40, 0xa41,
0xa42, 0xa43, 0xa44, 0xa45, 0xa46, 0xa47, 0xa48, 0xa49,
0xa4a, 0xa4b, 0xa4c, 0xa4d, 0xa4e, 0xa4f, 0xa50, 0xa51,
0xa52, 0xa53, 0xa54, 0xa55, 0xa56, 0xa57, 0xa58, 0xa59,
0xa5a, 0xa5b, 0xa5c, 0xa5d, 0xa5e, 0xa5f, 0xa60, 0xa61,
0xa62, 0xa63, 0xa64, 0xa65, 0xa66, 0xa67, 0xa68, 0xa69,
0xa6a, 0xa6b, 0xa6c, 0xa6d, 0xa6e, 0xa6f, 0xa70, 0xa71,
0xa72, 0xa73, 0xa74, 0xa75, 0xa76, 0xa77, 0xa78, 0xa79,
0xa7a, 0xa7b, 0xa7c, 0xa7d, 0xa7e, 0xa7f, 0xa80, 0xa81,
0xa82, 0xa83, 0xa84, 0xa85, 0xa86, 0xa87, 0xa88, 0xa89,
0xa8a, 0xa8b, 0xa8c, 0xa8d, 0xa8e, 0xa8f, 0xa90, 0xa91,
0xa92, 0xa93, 0xa94, 0xa95, 0xa96, 0xa97, 0xa98, 0xa99,
0xa9a, 0xa9b, 0xa9c, 0xa9d, 0xa9e, 0xa9f, 0xaa0, 0xaa1,
0xaa2, 0xaa3, 0xaa4, 0xaa5, 0xaa6, 0xaa7, 0xaa8, 0xaa9,
0xaaa, 0xaab, 0xaac, 0xaad, 0xaae, 0xaaf, 0xab0, 0xab1,
0xab2, 0xab3, 0xab4, 0xab5, 0xab6, 0xab7, 0xab8, 0xab9,
0xaba, 0xabb, 0xabc, 0xabd, 0xabe, 0xabf, 0xac0, 0xac1,
0xac2, 0xac3, 0xac4, 0xac5, 0xac6, 0xac7, 0xac8, 0xac9,
0xaca, 0xacb, 0xacc, 0xacd, 0xace, 0xacf, 0xad0, 0xad1,
0xad2, 0xad3, 0xad4, 0xad5, 0xad6, 0xad7, 0xad8, 0xad9,
0xada, 0xadb, 0xadc, 0xadd, 0xade, 0xadf, 0xae0, 0xae1,
0xae2, 0xae3, 0xae4, 0xae5, 0xae6, 0xae7, 0xae8, 0xae9,
0xaea, 0xaeb, 0xaec, 0xaed, 0xaee, 0xaef, 0xaf0, 0xaf1,
0xaf2, 0xaf3, 0xaf4, 0xaf5, 0xaf6, 0xaf7, 0xaf8, 0xaf9,
0xafa, 0xafb, 0xafc, 0xafd, 0xafe, 0xaff, 0xb00, 0xb01,
0xb02, 0xb03, 0xb04, 0xb05, 0xb06, 0xb07, 0xb08, 0xb09,
0xb0a, 0xb0b, 0xb0c, 0xb0d, 0xb0e, 0xb0f, 0xb10, 0xb11,
0xb12, 0xb13, 0xb14, 0xb15, 0xb16, 0xb17, 0xb18, 0xb19,
0xb1a, 0xb1b, 0xb1c, 0xb1d, 0xb1e, 0xb1f, 0xb20, 0xb21,
0xb22, 0xb23, 0xb24, 0xb25, 0xb26, 0xb27, 0xb28, 0xb29,
0xb2a, 0xb2b, 0xb2c, 0xb2d, 0xb2e, 0xb2f, 0xb30, 0xb31,
0xb32, 0xb33, 0xb34, 0xb35, 0xb36, 0xb37, 0xb38, 0xb39,
0xb3a, 0xb3b, 0xb3c, 0xb3d, 0xb3e, 0xb3f, 0xb40, 0xb41,
0xb42, 0xb43, 0xb44, 0xb45, 0xb46, 0xb47, 0xb48, 0xb49,
0xb4a, 0xb4b, 0xb4c, 0xb4d, 0xb4e, 0xb4f, 0xb50, 0xb51,
0xb52, 0xb53, 0xb54, 0xb55, 0xb56, 0xb57, 0xb58, 0xb59,
0xb5a, 0xb5b, 0xb5c, 0xb5d, 0xb5e, 0xb5f, 0xb60, 0xb61,
0xb62, 0xb63, 0xb64, 0xb65, 0xb66, 0xb67, 0xb68, 0xb69,
0xb6a, 0xb6b, 0xb6c, 0xb6d, 0xb6e, 0xb6f, 0xb70, 0xb71,
0xb72, 0xb73, 0xb74, 0xb75, 0xb76, 0xb77, 0xb78, 0xb79,
0xb7a, 0xb7b, 0xb7c, 0xb7d, 0xb7e, 0xb7f, 0xb80, 0xb81,
0xb82, 0xb83, 0xb84, 0xb85, 0xb86, 0xb87, 0xb88, 0xb89,
0xb8a, 0xb8b, 0xb8c, 0xb8d, 0xb8e, 0xb8f, 0xb90, 0xb91,
0xb92, 0xb93, 0xb94, 0xb95, 0xb96, 0xb97, 0xb98, 0xb99,
0xb9a, 0xb9b, 0xb9c, 0xb9d, 0xb9e, 0xb9f, 0xba0, 0xba1,
0xba2, 0xba3, 0xba4, 0xba5, 0xba6, 0xba7, 0xba8, 0xba9,
0xbaa, 0xbab, 0xbac, 0xbad, 0xbae, 0xbaf, 0xbb0, 0xbb1,
0xbb2, 0xbb3, 0xbb4, 0xbb5, 0xbb6, 0xbb7, 0xbb8, 0xbb9,
0xbba, 0xbbb, 0xbbc, 0xbbd, 0xbbe, 0xbbf, 0xbc0, 0xbc1,
0xbc2, 0xbc3, 0xbc4, 0xbc5, 0xbc6, 0xbc7, 0xbc8, 0xbc9,
0xbca, 0xbcb, 0xbcc, 0xbcd, 0xbce, 0xbcf, 0xbd0, 0xbd1,
0xbd2, 0xbd3, 0xbd4, 0xbd5, 0xbd6, 0xbd7, 0xbd8, 0xbd9,
0xbda, 0xbdb, 0xbdc, 0xbdd, 0xbde, 0xbdf, 0xbe0, 0xbe1,
0xbe2, 0xbe3, 0xbe4, 0xbe5, 0xbe6, 0xbe7, 0xbe8, 0xbe9,
0xbea, 0xbeb, 0xbec, 0xbed, 0xbee, 0xbef, 0xbf0, 0xbf1,
0xbf2, 0xbf3, 0xbf4, 0xbf5, 0xbf6, 0xbf7, 0xbf8, 0xbf9,
0xbfa, 0xbfb, 0xbfc, 0xbfd, 0xbfe, 0xbff, 0xd90, 0xda0,
0xdc0, 0xdc1, 0xdc2, 0xdc3, 0xdc4, 0xdc5, 0xdc6, 0xdc7,
0x40000000, 0x40000001, 0x40000002, 0x40000003, 0x40000010, 0x40000020, 0x40000022, 0x40000023,
0x40000070, 0x40000071, 0x40000072, 0x40000073, 0x40000080, 0x40000081, 0x40000082, 0x40000083,
0x40000084, 0x40000090, 0x40000091, 0x40000092, 0x40000093, 0x40000094, 0x40000095, 0x40000096,
0x40000097, 0x40000098, 0x40000099, 0x4000009a, 0x4000009b, 0x4000009c, 0x4000009d, 0x4000009e,
0x4000009f, 0x400000b0, 0x400000b1, 0x400000b2, 0x400000b3, 0x400000b4, 0x400000b5, 0x400000b6,
0x400000b7, 0x40000100, 0x40000101, 0x40000102, 0x40000103, 0x40000104, 0x40000105, 0x4b564d00,
0x4b564d01, 0x4b564d02, 0x4b564d03, 0x4b564d04, 0xc0000080, 0xc0000081, 0xc0000082, 0xc0000083,
0xc0000084, 0xc0000100, 0xc0000101, 0xc0000102, 0xc0000103, 0xc0000104, 0xc001001f, 0xc0010020,
0xc0010044, 0xc0010062, 0xc0010063, 0xc0010064, 0xc0010114, 0xc0010115, 0xc0010117, 0xc0010140,
0xc0010141, 0xc0011020, 0xc0011022, 0xc001102a, 0xc0011030, 0xc0011031, 0xc0011032, 0xc0011033,
0xc0011034, 0xc0011035, 0xc0011036, 0xc0011037, 0xc0011038, 0xc0011039, 0xc001103a, 0xc001103b,
0xc001103d,
}