pax_global_header00006660000000000000000000000064145566111370014523gustar00rootroot0000000000000052 comment=3c4163e30896c9a22e996815d5e0f7876b3fc64f readpe-0.84/000077500000000000000000000000001455661113700127165ustar00rootroot00000000000000readpe-0.84/.github/000077500000000000000000000000001455661113700142565ustar00rootroot00000000000000readpe-0.84/.github/ISSUE_TEMPLATE/000077500000000000000000000000001455661113700164415ustar00rootroot00000000000000readpe-0.84/.github/ISSUE_TEMPLATE/bug_report.md000066400000000000000000000011051455661113700211300ustar00rootroot00000000000000--- name: Bug report about: Create a report to help us improve title: '' labels: '' assignees: '' --- **Describe the bug** A clear and concise description of what the bug is. **To Reproduce** Please provide us with: - pev version - OS version - The file(s) you've analysed with pev - The command you've used with the files, with all the flags **Expected behavior** A clear and concise description of what you expected to happen. **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here. readpe-0.84/.github/workflows/000077500000000000000000000000001455661113700163135ustar00rootroot00000000000000readpe-0.84/.github/workflows/multi-os-build.yml000066400000000000000000000033011455661113700217010ustar00rootroot00000000000000name: multi-os-build on: push: branches: [ master ] pull_request: branches: [ master ] jobs: build-linux: runs-on: ubuntu-latest steps: - name: Install packages uses: delgurth/get-package@v6 with: # Space-separated list of packages to install using apt-get. Will only run if on ubuntu. apt-get: libssl-dev - name: Checkout with submodules uses: actions/checkout@v3 with: submodules: 'true' - name: Compile run: make build-osx: runs-on: macos-latest steps: - name: Install packages uses: delgurth/get-package@v6 with: # Space-separated list of packages to install using brew install. Will only run if on OSX. brew: openssl - name: Checkout with submodules uses: actions/checkout@v3 with: submodules: 'true' - name: Compile run: CFLAGS="-I/usr/local/opt/openssl/include/" LDFLAGS="-L/usr/local/opt/openssl/lib/" make build-win64: runs-on: windows-latest steps: - name: Install Cygwin # You may pin to the exact commit or the version. # uses: egor-tensin/setup-cygwin@4f96f9fecb8c952fa32ff791b0a77d93d5191bb4 uses: egor-tensin/setup-cygwin@v3 with: platform: x64 # optional, default is x64 install-dir: c:\tools\cygwin # optional, default is C:\tools\cygwin packages: gcc-core binutils make zip libssl-devel # optional - name: Checkout with submodules uses: actions/checkout@v3 with: submodules: 'true' - name: Compile run: make - name: Compile Windows-only tools and create a ZIP package run: make zip readpe-0.84/.gitignore000066400000000000000000000006041455661113700147060ustar00rootroot00000000000000pev.cbp bin obj pev pev.project Debug .cproject .project *.swp *~ *.so* *.dylib *.dll *.o *.dSYM *.log .settings src/ofs2rva src/output src/pedis src/pehash src/pepack src/pescan src/pesec src/pestr src/readpe src/rva2ofs src/peres src/plugins/build/ tests/samples/* !tests/samples/helloworld.exe tests/*.exe tests/*.bin tests/*.log tests/running_report */build/* .DS_Store ._* .vscode/* readpe-0.84/LICENSE000066400000000000000000000432541455661113700137330ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. readpe-0.84/LICENSE.OpenSSL000066400000000000000000000137531455661113700152160ustar00rootroot00000000000000 LICENSE ISSUES ============== The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. OpenSSL License --------------- /* ==================================================================== * Copyright (c) 1998-2016 The OpenSSL Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * 3. All advertising materials mentioning features or use of this * software must display the following acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit. (http://www.openssl.org/)" * * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to * endorse or promote products derived from this software without * prior written permission. For written permission, please contact * openssl-core@openssl.org. * * 5. Products derived from this software may not be called "OpenSSL" * nor may "OpenSSL" appear in their names without prior written * permission of the OpenSSL Project. * * 6. Redistributions of any form whatsoever must retain the following * acknowledgment: * "This product includes software developed by the OpenSSL Project * for use in the OpenSSL Toolkit (http://www.openssl.org/)" * * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED * OF THE POSSIBILITY OF SUCH DAMAGE. * ==================================================================== * * This product includes cryptographic software written by Eric Young * (eay@cryptsoft.com). This product includes software written by Tim * Hudson (tjh@cryptsoft.com). * */ Original SSLeay License ----------------------- /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * * This package is an SSL implementation written * by Eric Young (eay@cryptsoft.com). * The implementation was written so as to conform with Netscapes SSL. * * This library is free for commercial and non-commercial use as long as * the following conditions are aheared to. The following conditions * apply to all code found in this distribution, be it the RC4, RSA, * lhash, DES, etc., code; not just the SSL code. The SSL documentation * included with this distribution is covered by the same copyright terms * except that the holder is Tim Hudson (tjh@cryptsoft.com). * * Copyright remains Eric Young's, and as such any Copyright notices in * the code are not to be removed. * If this package is used in a product, Eric Young should be given attribution * as the author of the parts of the library used. * This can be in the form of a textual message at program startup or * in documentation (online or textual) provided with the package. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * "This product includes cryptographic software written by * Eric Young (eay@cryptsoft.com)" * The word 'cryptographic' can be left out if the rouines from the library * being used are not cryptographic related :-). * 4. If you include any Windows specific code (or a derivative thereof) from * the apps directory (application code) you must include an acknowledgement: * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" * * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * The licence and distribution terms for any publically available version or * derivative of this code cannot be changed. i.e. this code cannot simply be * copied and put under another distribution licence * [including the GNU Public Licence.] */readpe-0.84/Makefile000066400000000000000000000012651455661113700143620ustar00rootroot00000000000000LIBPE_DIR = lib/libpe PEV_DIR = src VERSION = 0.84 ZIPDIR = pev-$(VERSION)-win ZIPFILE = $(ZIPDIR).zip all: %: cd $(LIBPE_DIR) && $(MAKE) $@ cd $(PEV_DIR) && $(MAKE) $@ # Cygwin only zip: cd $(PEV_DIR)/windows && $(MAKE) mkdir -p $(ZIPDIR)/plugins cp src/build/plugins/*.dll $(ZIPDIR)/plugins/ echo -ne "plugins_dir=plugins\r\n" > $(ZIPDIR)/pev.conf cp $(PEV_DIR)/userdb.txt $(ZIPDIR) cp lib/libpe/libpe.dll $(ZIPDIR)/ cp /usr/bin/cygwin1.dll $(ZIPDIR)/ cp /usr/bin/cygcrypto-1*.dll $(ZIPDIR)/ cp /usr/bin/cygz.dll $(ZIPDIR)/ cp README.md $(ZIPDIR)/ cp $(PEV_DIR)/build/*.exe $(ZIPDIR)/ cp $(PEV_DIR)/windows/run.bat $(ZIPDIR)/ zip -r $(ZIPFILE) $(ZIPDIR)/* rm -rf $(ZIPDIR) readpe-0.84/README.md000066400000000000000000000050101455661113700141710ustar00rootroot00000000000000# readpe - PE Utils Open source, full-featured, multiplatform command line toolkit to work with and analyze PE (Portable Executables) binaries. ## How to get the source code git clone https://github.com/mentebinaria/readpe.git ## How to build on Linux cd readpe make **NOTE**: You may need to install OpenSSL using your package manager. Examples: apt install libssl-dev yum install openssl-devel ## How to install on Linux cd readpe sudo make install echo "/usr/local/lib" | sudo tee /etc/ld.so.conf.d/libpe.conf sudo ldconfig ## How to build on macOS cd readpe CFLAGS="-I/usr/local/opt/openssl/include/" LDFLAGS="-L/usr/local/opt/openssl/lib/" make **NOTE**: You may need to install OpenSSL and PCRE via [Homebrew](https://brew.sh): brew update brew install openssl ## How to build on Windows (via [Cygwin](https://cygwin.com)) cd readpe make make zip **NOTE**: The following packages must be installed along with your Cygwin: - gcc-core - binutils - make - zip - openssl-devel - git (just to clone the repository and make things easier) ## FAQ ### Is this pev? / What happened to pev? This repository used to be pev. We just moved the repository from a user account to an organization account. We also renamed the repository as the original name `pev` stood for PE Version and does not reflect the current state of this application. We felt that readpe was a good name as it is the most prominent tool. ### Where did libpe go? Libpe has been absorbed into this repository since the two repositories are tightly coupled and version controling them together made the most logical sense. ### I get a `fatal error: 'openssl/evp.h' file not found`. How can I fix that? Please install OpenSSL for your system. Use a package manager to make things easier. If you're compiling pev in macOS, make sure you've set both CFLAGS and LDFLAGS environment variables according. Please check the [online documentation](https://pev.sourceforge.io/doc/manual/en_us/) for more details. ### I get an `error while loading shared libraries: libpe.so.1: cannot open shared object file: No such file or directory`. How can I fix that? Please refer to ['How to install on Linux'](#how-to-install-on-linux). ## License This project is licensed under the GNU General Public License version 2 with the exception of the contents of lib/libpe which are licensed under the GNU Lesser General Public License version 3. A copy of these licenses can be found respectively in the project root and lib/libpe. readpe-0.84/completion/000077500000000000000000000000001455661113700150675ustar00rootroot00000000000000readpe-0.84/completion/bash/000077500000000000000000000000001455661113700160045ustar00rootroot00000000000000readpe-0.84/completion/bash/readpe000066400000000000000000000004141455661113700171660ustar00rootroot00000000000000#!/usr/bin/env bash complete -F _longopt readpe complete -F _longopt pedis complete -F _longopt pehash complete -F _longopt peldd complete -F _longopt pepack complete -F _longopt peres complete -F _longopt pescan complete -F _longopt pesec complete -F _longopt pestr readpe-0.84/completion/zsh/000077500000000000000000000000001455661113700156735ustar00rootroot00000000000000readpe-0.84/completion/zsh/_readpe000066400000000000000000000004551455661113700172210ustar00rootroot00000000000000#compdef readpe # # Completion script for swaylock # compdef _gnu_generic readpe compdef _gnu_generic pedis compdef _gnu_generic pehash compdef _gnu_generic peldd compdef _gnu_generic pepack compdef _gnu_generic peres compdef _gnu_generic pescan compdef _gnu_generic pesec compdef _gnu_generic pestr readpe-0.84/doc/000077500000000000000000000000001455661113700134635ustar00rootroot00000000000000readpe-0.84/doc/.gitignore000066400000000000000000000000111455661113700154430ustar00rootroot00000000000000**/html/ readpe-0.84/doc/fdl-1.3.xml000066400000000000000000000700321455661113700152530ustar00rootroot00000000000000 GNU Free Documentation License Version 1.3, 3 November 2008 Copyright © 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. 0. PREAMBLE The purpose of this License is to make a manual, textbook, or other functional and useful document “free” in the sense of freedom: to assure everyone the effective freedom to copy and redistribute it, with or without modifying it, either commercially or noncommercially. Secondarily, this License preserves for the author and publisher a way to get credit for their work, while not being considered responsible for modifications made by others. This License is a kind of “copyleft”, which means that derivative works of the document must themselves be free in the same sense. It complements the GNU General Public License, which is a copyleft license designed for free software. We have designed this License in order to use it for manuals for free software, because free software needs free documentation: a free program should come with manuals providing the same freedoms that the software does. But this License is not limited to software manuals; it can be used for any textual work, regardless of subject matter or whether it is published as a printed book. We recommend this License principally for works whose purpose is instruction or reference. 1. APPLICABILITY AND DEFINITIONS This License applies to any manual or other work, in any medium, that contains a notice placed by the copyright holder saying it can be distributed under the terms of this License. Such a notice grants a world-wide, royalty-free license, unlimited in duration, to use that work under the conditions stated herein. The “Document”, below, refers to any such manual or work. Any member of the public is a licensee, and is addressed as “you”. You accept the license if you copy, modify or distribute the work in a way requiring permission under copyright law. A “Modified Version” of the Document means any work containing the Document or a portion of it, either copied verbatim, or with modifications and/or translated into another language. A “Secondary Section” is a named appendix or a front-matter section of the Document that deals exclusively with the relationship of the publishers or authors of the Document to the Document’s overall subject (or to related matters) and contains nothing that could fall directly within that overall subject. (Thus, if the Document is in part a textbook of mathematics, a Secondary Section may not explain any mathematics.) The relationship could be a matter of historical connection with the subject or with related matters, or of legal, commercial, philosophical, ethical or political position regarding them. The “Invariant Sections” are certain Secondary Sections whose titles are designated, as being those of Invariant Sections, in the notice that says that the Document is released under this License. If a section does not fit the above definition of Secondary then it is not allowed to be designated as Invariant. The Document may contain zero Invariant Sections. If the Document does not identify any Invariant Sections then there are none. The “Cover Texts” are certain short passages of text that are listed, as Front-Cover Texts or Back-Cover Texts, in the notice that says that the Document is released under this License. A Front-Cover Text may be at most 5 words, and a Back-Cover Text may be at most 25 words. A “Transparent” copy of the Document means a machine-readable copy, represented in a format whose specification is available to the general public, that is suitable for revising the document straightforwardly with generic text editors or (for images composed of pixels) generic paint programs or (for drawings) some widely available drawing editor, and that is suitable for input to text formatters or for automatic translation to a variety of formats suitable for input to text formatters. A copy made in an otherwise Transparent file format whose markup, or absence of markup, has been arranged to thwart or discourage subsequent modification by readers is not Transparent. An image format is not Transparent if used for any substantial amount of text. A copy that is not “Transparent” is called “Opaque”. Examples of suitable formats for Transparent copies include plain ASCII without markup, Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD, and standard-conforming simple HTML, PostScript or PDF designed for human modification. Examples of transparent image formats include PNG, XCF and JPG. Opaque formats include proprietary formats that can be read and edited only by proprietary word processors, SGML or XML for which the DTD and/or processing tools are not generally available, and the machine-generated HTML, PostScript or PDF produced by some word processors for output purposes only. The “Title Page” means, for a printed book, the title page itself, plus such following pages as are needed to hold, legibly, the material this License requires to appear in the title page. For works in formats which do not have any title page as such, “Title Page” means the text near the most prominent appearance of the work’s title, preceding the beginning of the body of the text. The “publisher” means any person or entity that distributes copies of the Document to the public. A section “Entitled XYZ” means a named subunit of the Document whose title either is precisely XYZ or contains XYZ in parentheses following text that translates XYZ in another language. (Here XYZ stands for a specific section name mentioned below, such as “Acknowledgements”, “Dedications”, “Endorsements”, or “History”.) To “Preserve the Title” of such a section when you modify the Document means that it remains a section “Entitled XYZ” according to this definition. The Document may include Warranty Disclaimers next to the notice which states that this License applies to the Document. These Warranty Disclaimers are considered to be included by reference in this License, but only as regards disclaiming warranties: any other implication that these Warranty Disclaimers may have is void and has no effect on the meaning of this License. 2. VERBATIM COPYING You may copy and distribute the Document in any medium, either commercially or noncommercially, provided that this License, the copyright notices, and the license notice saying this License applies to the Document are reproduced in all copies, and that you add no other conditions whatsoever to those of this License. You may not use technical measures to obstruct or control the reading or further copying of the copies you make or distribute. However, you may accept compensation in exchange for copies. If you distribute a large enough number of copies you must also follow the conditions in section 3. You may also lend copies, under the same conditions stated above, and you may publicly display copies. 3. COPYING IN QUANTITY If you publish printed copies (or copies in media that commonly have printed covers) of the Document, numbering more than 100, and the Document’s license notice requires Cover Texts, you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts: Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers must also clearly and legibly identify you as the publisher of these copies. The front cover must present the full title with all words of the title equally prominent and visible. You may add other material on the covers in addition. Copying with changes limited to the covers, as long as they preserve the title of the Document and satisfy these conditions, can be treated as verbatim copying in other respects. If the required texts for either cover are too voluminous to fit legibly, you should put the first ones listed (as many as fit reasonably) on the actual cover, and continue the rest onto adjacent pages. If you publish or distribute Opaque copies of the Document numbering more than 100, you must either include a machine-readable Transparent copy along with each Opaque copy, or state in or with each Opaque copy a computer-network location from which the general network-using public has access to download using public-standard network protocols a complete Transparent copy of the Document, free of added material. If you use the latter option, you must take reasonably prudent steps, when you begin distribution of Opaque copies in quantity, to ensure that this Transparent copy will remain thus accessible at the stated location until at least one year after the last time you distribute an Opaque copy (directly or through your agents or retailers) of that edition to the public. It is requested, but not required, that you contact the authors of the Document well before redistributing any large number of copies, to give them a chance to provide you with an updated version of the Document. 4. MODIFICATIONS You may copy and distribute a Modified Version of the Document under the conditions of sections 2 and 3 above, provided that you release the Modified Version under precisely this License, with the Modified Version filling the role of the Document, thus licensing distribution and modification of the Modified Version to whoever possesses a copy of it. In addition, you must do these things in the Modified Version: Use in the Title Page (and on the covers, if any) a title distinct from that of the Document, and from those of previous versions (which should, if there were any, be listed in the History section of the Document). You may use the same title as a previous version if the original publisher of that version gives permission. List on the Title Page, as authors, one or more persons or entities responsible for authorship of the modifications in the Modified Version, together with at least five of the principal authors of the Document (all of its principal authors, if it has fewer than five), unless they release you from this requirement. State on the Title page the name of the publisher of the Modified Version, as the publisher. Preserve all the copyright notices of the Document. Add an appropriate copyright notice for your modifications adjacent to the other copyright notices. Include, immediately after the copyright notices, a license notice giving the public permission to use the Modified Version under the terms of this License, in the form shown in the Addendum below. Preserve in that license notice the full lists of Invariant Sections and required Cover Texts given in the Document’s license notice. Include an unaltered copy of this License. Preserve the section Entitled “History”, Preserve its Title, and add to it an item stating at least the title, year, new authors, and publisher of the Modified Version as given on the Title Page. If there is no section Entitled “History” in the Document, create one stating the title, year, authors, and publisher of the Document as given on its Title Page, then add an item describing the Modified Version as stated in the previous sentence. Preserve the network location, if any, given in the Document for public access to a Transparent copy of the Document, and likewise the network locations given in the Document for previous versions it was based on. These may be placed in the “History” section. You may omit a network location for a work that was published at least four years before the Document itself, or if the original publisher of the version it refers to gives permission. For any section Entitled “Acknowledgements” or “Dedications”, Preserve the Title of the section, and preserve in the section all the substance and tone of each of the contributor acknowledgements and/or dedications given therein. Preserve all the Invariant Sections of the Document, unaltered in their text and in their titles. Section numbers or the equivalent are not considered part of the section titles. Delete any section Entitled “Endorsements”. Such a section may not be included in the Modified Version. Do not retitle any existing section to be Entitled “Endorsements” or to conflict in title with any Invariant Section. Preserve any Warranty Disclaimers. If the Modified Version includes new front-matter sections or appendices that qualify as Secondary Sections and contain no material copied from the Document, you may at your option designate some or all of these sections as invariant. To do this, add their titles to the list of Invariant Sections in the Modified Version’s license notice. These titles must be distinct from any other section titles. You may add a section Entitled “Endorsements”, provided it contains nothing but endorsements of your Modified Version by various parties — for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard. You may add a passage of up to five words as a Front-Cover Text, and a passage of up to 25 words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through arrangements made by) any one entity. If the Document already includes a cover text for the same cover, previously added by you or by arrangement made by the same entity you are acting on behalf of, you may not add another; but you may replace the old one, on explicit permission from the previous publisher that added the old one. The author(s) and publisher(s) of the Document do not by this License give permission to use their names for publicity for or to assert or imply endorsement of any Modified Version. 5. COMBINING DOCUMENTS You may combine the Document with other documents released under this License, under the terms defined in section 4 above for modified versions, provided that you include in the combination all of the Invariant Sections of all of the original documents, unmodified, and list them all as Invariant Sections of your combined work in its license notice, and that you preserve all their Warranty Disclaimers. The combined work need only contain one copy of this License, and multiple identical Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections with the same name but different contents, make the title of each such section unique by adding at the end of it, in parentheses, the name of the original author or publisher of that section if known, or else a unique number. Make the same adjustment to the section titles in the list of Invariant Sections in the license notice of the combined work. In the combination, you must combine any sections Entitled “History” in the various original documents, forming one section Entitled “History”; likewise combine any sections Entitled “Acknowledgements”, and any sections Entitled “Dedications”. You must delete all sections Entitled “Endorsements”. 6. COLLECTIONS OF DOCUMENTS You may make a collection consisting of the Document and other documents released under this License, and replace the individual copies of this License in the various documents with a single copy that is included in the collection, provided that you follow the rules of this License for verbatim copying of each of the documents in all other respects. You may extract a single document from such a collection, and distribute it individually under this License, provided you insert a copy of this License into the extracted document, and follow this License in all other respects regarding verbatim copying of that document. 7. AGGREGATION WITH INDEPENDENT WORKS A compilation of the Document or its derivatives with other separate and independent documents or works, in or on a volume of a storage or distribution medium, is called an “aggregate” if the copyright resulting from the compilation is not used to limit the legal rights of the compilation’s users beyond what the individual works permit. When the Document is included in an aggregate, this License does not apply to the other works in the aggregate which are not themselves derivative works of the Document. If the Cover Text requirement of section 3 is applicable to these copies of the Document, then if the Document is less than one half of the entire aggregate, the Document’s Cover Texts may be placed on covers that bracket the Document within the aggregate, or the electronic equivalent of covers if the Document is in electronic form. Otherwise they must appear on printed covers that bracket the whole aggregate. 8. TRANSLATION Translation is considered a kind of modification, so you may distribute translations of the Document under the terms of section 4. Replacing Invariant Sections with translations requires special permission from their copyright holders, but you may include translations of some or all Invariant Sections in addition to the original versions of these Invariant Sections. You may include a translation of this License, and all the license notices in the Document, and any Warranty Disclaimers, provided that you also include the original English version of this License and the original versions of those notices and disclaimers. In case of a disagreement between the translation and the original version of this License or a notice or disclaimer, the original version will prevail. If a section in the Document is Entitled “Acknowledgements”, “Dedications”, or “History”, the requirement (section 4) to Preserve its Title (section 1) will typically require changing the actual title. 9. TERMINATION You may not copy, modify, sublicense, or distribute the Document except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, or distribute it is void, and will automatically terminate your rights under this License. However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation. Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice. Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, receipt of a copy of some or all of the same material does not give you any rights to use it. 10. FUTURE REVISIONS OF THIS LICENSE The Free Software Foundation may publish new, revised versions of the GNU Free Documentation License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. See Copyleft. Each version of the License is given a distinguishing version number. If the Document specifies that a particular numbered version of this License “or any later version” applies to it, you have the option of following the terms and conditions either of that specified version or of any later version that has been published (not as a draft) by the Free Software Foundation. If the Document does not specify a version number of this License, you may choose any version ever published (not as a draft) by the Free Software Foundation. If the Document specifies that a proxy can decide which future versions of this License can be used, that proxy’s public statement of acceptance of a version permanently authorizes you to choose that version for the Document. 11. RELICENSING “Massive Multiauthor Collaboration Site” (or “MMC Site”) means any World Wide Web server that publishes copyrightable works and also provides prominent facilities for anybody to edit those works. A public wiki that anybody can edit is an example of such a server. A “Massive Multiauthor Collaboration” (or “MMC”) contained in the site means any set of copyrightable works thus published on the MMC site. “CC-BY-SA” means the Creative Commons Attribution-Share Alike 3.0 license published by Creative Commons Corporation, a not-for-profit corporation with a principal place of business in San Francisco, California, as well as future copyleft versions of that license published by that same organization. “Incorporate” means to publish or republish a Document, in whole or in part, as part of another Document. An MMC is “eligible for relicensing” if it is licensed under this License, and if all works that were first published under this License somewhere other than this MMC, and subsequently incorporated in whole or in part into the MMC, (1) had no cover texts or invariant sections, and (2) were thus incorporated prior to November 1, 2008. The operator of an MMC Site may republish an MMC contained in the site under CC-BY-SA on the same site at any time before August 1, 2009, provided the MMC is eligible for relicensing. ADDENDUM: How to use this License for your documents To use this License in a document you have written, include a copy of the License in the document and put the following copyright and license notices just after the title page: Copyright © YEAR YOUR NAME Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”. If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts, replace the “with… Texts.” line with this: with the Invariant Sections being LIST THEIR TITLES, with the Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST. If you have Invariant Sections without Cover Texts, or some other combination of the three, merge those two alternatives to suit the situation. If your document contains nontrivial examples of program code, we recommend releasing these examples in parallel under your choice of free software license, such as the GNU General Public License, to permit their use in free software. readpe-0.84/doc/manpages/000077500000000000000000000000001455661113700152565ustar00rootroot00000000000000readpe-0.84/doc/manpages/ofs2rva.1000066400000000000000000000023121455661113700167200ustar00rootroot00000000000000.TH OFS2RVA 1 .SH NAME ofs2rva - converts a PE raw file offset to relative virtual address .SH SYNOPSIS .B ofs2rva .IR offset .IR pefile .SH DESCRIPTION ofs2rva converts a raw file offset to RVA (Relative Virtual Address), if it's valid. It's part of pev, the PE file analysis toolkit. .PP \&\fIoffset\fR is a valid PE file offset in decimal or hexadecimal (prefixed with 0x). .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show this help. .SH EXAMPLES Get RVA of 0x1b9b8 offset of \fBcalc.exe\fP: .IP $ ofs2rva 0x1b9b8 calc.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. .SH SEE ALSO rva2ofs(1) readpe-0.84/doc/manpages/pedis.1000066400000000000000000000041221455661113700164430ustar00rootroot00000000000000.TH PEDIS 1 .SH NAME pedis - disassemble PE sections and functions .SH SYNOPSIS .B pedis [OPTIONS]... .IR pefile .SH DESCRIPTION pedis is a PE disassembler relyng on udis86 library. It can disassembly entire sections, functions or any file position you want. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-\-att Set AT&T assembly syntax (default: Intel). .TP .BR \-e ", " \-\-entrypoint Disassemble the entire entrypoint function. .TP .BR \-f ", " \-\-format\ Change output format (default: text). .TP .BR \-m ", " \-\-mode\ <16|32|64> Disassembly mode (default: auto). .TP .BR \-i\ Number of instructions to disassemble. .TP .BR \-n\ Number of bytes to disassemble. .TP .BR \-o ", " \-\-offset\ Disassemble at specified offset, either in decimal or hexadecimal format (prefixed with 0x). .TP .BR \-r ", " \-\-rva\ Disassemble at specified RVA, either in decimal or hexadecimal format (prefixed with 0x). .TP .BR \-s ", " \-\-section\ Disassemble en entire section given. .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show this help. .SH EXAMPLES Disassemble RVA 0x4c4df from \fBputty.exe\fP: .IP $ pedis -r 0x4c4df putty.exe .PP Disassembly the entrypoint of a 64-bit PE32+ \fBwordpad.exe\fP: .IP $ pedis -m 64 --entrypoint putty.exe .PP Disassembly in 16-bits mode, starting from offset 0x40, 32 bytes of code from \fBgame.exe\fP: .IP $ pedis -m 16 -o 0x40 -n 32 game.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/pehash.1000066400000000000000000000031341455661113700166110ustar00rootroot00000000000000.TH PEHASH 1 .SH NAME pehash - calculate hashes of PE pieces .SH SYNOPSIS .B pehash [OPTIONS]... .IR pefile .SH DESCRIPTION pehash uses libssl, libfuzzy and other black magic to calculate PE file hashes. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-a ", " \-\-all Hash file, sections and headers with md5, sha1, sha256, ssdeep and imphash. .TP .BR \-c ", " \-\-content Hash only the file content (default). .TP .BR \-f ", " \-\-format\ Change output format (default is text). .TP .BR \-h ", " \-\-header\ Hash only the header with the specified name. .TP .BR \-s ", " \-\-section\ Hash only the section with the specified name. .TP .BR \-\-section-\index\ Hash only the section at the specified index (1..n). .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show this help. .SH EXAMPLES Check all supported checksums of \fBputty.exe\fP file: .IP $ pehash -a putty.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/peldd.1000066400000000000000000000022761455661113700164370ustar00rootroot00000000000000.TH PELDD 1 .SH NAME peldd - shows library dependencies for a given PE file .SH SYNOPSIS .B peldd [OPTIONS]... .IR pefile .SH DESCRIPTION peldd shows library dependencies for a given PE file. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-f ", " \-\-format\ Change output format (default is text). .TP .BR \-v ", " \-\-verbose Show more information about found items. .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show help. .SH EXAMPLES Show library dependencies for \fBputty.exe\fP: .IP $ peldd putty.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2018 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/pepack.1000066400000000000000000000024531455661113700166070ustar00rootroot00000000000000.TH PEPACK 1 .SH NAME pepack - check if a PE file is packed .SH SYNOPSIS .B pepack [OPTIONS]... .IR pefile .SH DESCRIPTION pepack uses a pre-defined database to check packer signatures patterns in PE file. If no database is set, pepack tries to identify if executable is packed. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-d ", " \-\-database\ Use database file (default: ./userdb.txt). .TP .BR \-f ", " \-\-format\ Change output format (default: text) .TP .BR \-V ", " \-\-version Show version and exit. .TP .BR \-\-help Show help. .SH EXAMPLES Check \fBsample.exe\fP for packers signatures: .IP $ pepack sample.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/peres.1000066400000000000000000000027561455661113700164700ustar00rootroot00000000000000.TH PERES 1 .SH NAME peres - analyze and extract PE file resources .SH SYNOPSIS .B peres [OPTIONS]... .IR pefile .SH DESCRIPTION peres opens the resource section of a PE file and to read and extract resources. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-a ", " \-\-all Show all information, statistics and extract the resources. .TP .BR \-f ", " \-\-format\ Change output format (default is text). .TP .BR \-i ", " \-\-info Show resources information. .TP .BR \-x ", " \-\-extract Extract resources. .TP .BR \-s ", " \-\-statistics Show resource section statistics. .TP .BR \-v ", " \-\-version Show the File Version from resources section. .TP .BR \-V ", " \-\-version Show program version and exit. .TP .BR \-\-help Show this help. .SH EXAMPLES Show resources statistics of \fBputty.exe\fP: .IP $ peres -s putty.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/pescan.1000066400000000000000000000023461455661113700166160ustar00rootroot00000000000000.TH PESCAN 1 .SH NAME pescan - identify suspicious characteristics in PE files .SH SYNOPSIS .B pescan [OPTIONS]... .IR pefile .SH DESCRIPTION pescan analyze a PE file statically to determine if it contains suspicious characteristics. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-f ", " \-\-format\ Change output format (default is text). .TP .BR \-v ", " \-\-verbose Show more information about found items. .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show help. .SH EXAMPLES Search suspicious things in \fBputty.exe\fP: .IP $ pescan putty.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2013 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/pesec.1000066400000000000000000000024711455661113700164430ustar00rootroot00000000000000.TH PESEC 1 .SH NAME pesec - check for protections in PE files .SH SYNOPSIS .B pesec [OPTIONS]... .IR pefile .SH DESCRIPTION pesec checks a PE file for security features. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-f ", " \-\-format\ Change output format (default is text). .TP .BR \-c ", " \-\-certoutform\ Specifies the certificate output format (default: text). .TP .BR \-o ", " \-\-certout\ Specifies the output filename to write certificates to (default: stdout). .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show help. .SH EXAMPLES Search for protections in \fBputty.exe\fP: .IP $ pesec putty.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/pestr.1000066400000000000000000000023041455661113700164740ustar00rootroot00000000000000.TH PESTR 1 .SH NAME pestr - search strings in PE files .SH SYNOPSIS .B pestr [OPTIONS]... .IR pefile .SH DESCRIPTION pestr search for ASCII and Unicode strings in PE files. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-n ", " \-\-min\-length Set minimum string length (default: 4). .TP .BR \-o ", " \-\-offset Show string offset in file. .TP .BR \-s ", " \-\-section Show string section, if exists. .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show help. .SH EXAMPLES Search all strings in \fBputty.exe\fP: .IP $ pestr putty.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBreadpe\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/readpe.1000066400000000000000000000034001455661113700165750ustar00rootroot00000000000000.TH READPE 1 .SH NAME readpe - displays information about PE files .SH SYNOPSIS .B readpe [OPTIONS]... .IR pefile .SH DESCRIPTION readpe can read and display all PE file headers, fields and values. It's part of pev, the PE file analysis toolkit. .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-A ", " \-\-all Full output (default). .TP .BR \-H ", " \-\-all-headers Show all PE headers. .TP .BR \-S ", " \-\-all-sections Show PE section headers. .TP .BR \-f ", " \-\-format\ Change output format (default: text). .TP .BR \-d ", " \-\-dirs Show data directories. .TP .BR \-h ", " \-\-header\ Show specific header. It can be used multiple times. .TP .BR \-i ", " \-\-imports Show imported functions. .TP .BR \-e ", " \-\-exports Show exported functions. .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show this help. .SH EXAMPLES Display the Optional file header of \fBputty.exe\fP: .IP $ readpe \-h optional putty.exe .PP Display data directories and exported functions of \fBcards.dll\fP: .IP $ readpe \-de cards.dll .PP Display all possible information about \fBsvchost.exe\fP file: .IP $ readpe svchost.exe .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBrva2ofs\fP(1) .SH COPYRIGHT Copyright (C) 2013 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. readpe-0.84/doc/manpages/rva2ofs.1000066400000000000000000000022741455661113700167270ustar00rootroot00000000000000.TH RVA2OFS 1 .SH NAME rva2ofs - converts a PE relative virtual address to raw file offset .SH SYNOPSIS .B rva2ofs .IR rvs .IR pefile .SH DESCRIPTION rva2ofs converts a RVA (Relative Virtual Address) to raw file offset, if possible. It's part of pev, the PE file analysis toolkit. .PP \&\fIrva\fR is a valid PE RVA in decimal or hexadecimal (prefixed with 0x). .PP \&\fIpefile\fR is a PE32/PE32+ executable or dynamic linked library file. .SH OPTIONS .TP .BR \-V ", " \-\-version Show version. .TP .BR \-\-help Show this help. .SH EXAMPLES Get offset from RVA 0x12db of \fBcards.dll\fP: .IP $ rva2ofs 0x12db cards.dll .SH REPORTING BUGS Please, check the latest development code and report at https://github.com/mentebinaria/readpe/issues .SH SEE ALSO \fBofs2rva\fP(1), \fBpedis\fP(1), \fBpehash\fP(1), \fBpeldd\fP(1), \fBpepack\fP(1), \fBperes\fP(1), \fBpescan\fP(1), \fBpesec\fP(1), \fBpestr\fP(1), \fBreadpe\fP(1) .SH COPYRIGHT Copyright (C) 2012 - 2020 pev authors. License GPLv2+: GNU GPL version 2 or later . This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. .SH SEE ALSO ofs2rva(1) readpe-0.84/doc/manual/000077500000000000000000000000001455661113700147405ustar00rootroot00000000000000readpe-0.84/doc/manual/en_us/000077500000000000000000000000001455661113700160515ustar00rootroot00000000000000readpe-0.84/doc/manual/en_us/Makefile000066400000000000000000000014451455661113700175150ustar00rootroot00000000000000# Debian-like: apt-get install docbook docbook-xsl xsltproc fop # MacPorts: port install docbook-xsl libxslt fop PLATFORM_OS := $(shell uname | cut -d_ -f1) NAME=pev-manual ifeq ($(PLATFORM_OS), Darwin) XSL=/opt/local/share/xsl/docbook-xsl/html/chunk.xsl FOXSL=/opt/local/share/xsl/docbook-xsl/fo/docbook.xsl else XSL=/usr/share/xml/docbook/stylesheet/nwalsh/html/chunk.xsl FOXSL=/usr/share/xml/docbook/stylesheet/nwalsh/fo/docbook.xsl endif SRC=manual.docbook HTML_DIR=html PDF_DIR=pdf VERSION=0.80 html: mkdir -p $(HTML_DIR)/figures cp figures/*.png $(HTML_DIR)/figures/ xsltproc -o $(HTML_DIR)/ $(XSL) $(SRC) pdf: mkdir -p $(PDF_DIR) xsltproc -o $(NAME).fo $(FOXSL) $(SRC) fop $(NAME).fo -pdf $(PDF_DIR)/$(NAME)-$(VERSION).pdf clean: rm -rf *.html *.pdf *.fo *~ $(HTML_DIR) $(PDF_DIR) readpe-0.84/doc/manual/en_us/advanced-features.docbook000066400000000000000000000056631455661113700230060ustar00rootroot00000000000000 Advanced features Security tests Not all binaries are suspicious. You might have some normal binaries to study, finding vulnerabilities on it, etc. You can use pesec to check security features in PE files. It may be useful for programmers or vulnerability researchers. Have a look: $ pesec about.exe ASLR: no DEP/NX: no SEH: yes Stack cookies (EXPERIMENTAL): yes Currently pesec can discover if the PE file has ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention) / NX (No eXecutable bit), SEH (Structured Exception Handling) and Stack Cookies, as known as Canary, enabled. If you want to use pesec, you probably know what these protection schemes are. ;) We experimentally support stack cookies put by Visual Studio only but we do really have plans to extend this support. Stay tuned! Disassembling pedis is a full disassembler that can be used for different purposes. Let's say you find the following output from pescan first: $ pescan -v malware.exe file entropy: 7.868122 (probably packed) fpu anti-disassembly: yes imagebase: normal - 0x400000 entrypoint: fake - va: 0x2ddb40 - raw: 0xe0f40 DOS stub: suspicious - raw: 0x40 TLS callback function: 0x6ddd10 TLS directory: found - 1 function(s) section count: 3 UPX0: suspicious name, zero length, self-modifying UPX1: suspicious name, self-modifying .rsrc: normal timestamp: normal - Mon, 18 Nov 2013 16:34:20 UTC You may want to see why DOS stub was marked as suspicious. You can use pedis for that. As DOS stub starts on offset 0x40 and it's a 16-bit assembly code, you can ask pedis to disassemble 16 bytes for example, starting at offset 0x40. Look: $ pedis -m 16 -o 0x40 -n 16 malware.exe 40: ba 10 00 mov dx, 0x10 43: 0e push cs 44: 1f pop ds 45: b4 09 mov ah, 0x9 47: cd 21 int 0x21 49: b8 01 4c mov ax, 0x4c01 4c: cd 21 int 0x21 4e: 90 nop readpe-0.84/doc/manual/en_us/basic-usage.docbook000066400000000000000000000412661455661113700216070ustar00rootroot00000000000000 Basic usage Getting headers and sections readpe is the right tool for parsing PE files without infer anything regarding its fields and values. Using readpe you can see all basic PE file information. For example, in order to see the Optional Header, you could run: $ readpe --header optional putty.exe Optional/Image header Magic number: 0x10b (PE32) Linker major version: 7 Linker minor version: 10 Size of .text section: 0x5c000 Size of .data section: 0x27000 Size of .bss section: 0 Entrypoint: 0x54eb0 Address of .text section: 0x1000 Address of .data section: 0x5d000 ImageBase: 0x400000 Alignment of sections: 0x1000 Alignment factor: 0x1000 Major version of required OS: 4 Minor version of required OS: 0 Major version of image: 0 Minor version of image: 0 Major version of subsystem: 4 Minor version of subsystem: 0 Size of image: 0x84000 Size of headers: 0x1000 Checksum: 0 Subsystem required: 0x2 (IMAGE_SUBSYSTEM_WINDOWS_GUI) DLL characteristics: 0 DLL characteristics names Size of stack to reserve: 0x100000 Size of stack to commit: 0x1000 Size of heap space to reserve: 0x100000 Size of heap space to commit: 0x1000 The Magic Number is 0x10b for PE32 files and 0x20b for PE32+ files. In order to parse pev tools output you can use the -f / --format option. The following example will output the DOS Header in HTML: $ readpe --format html --header dos putty.exe <!DOCTYPE html> <html lang="en" dir="ltr"> <head> <meta charset="utf-8"> <title>src/build/readpe --format html --header dos /home/user/PUTTY.EXE</title> </head> <body> <div class="object"> <h2>DOS Header</h2> <p><span class="key"><b>Magic number</b></span>: <span class="value">0x5a4d (MZ)</span></p> <p><span class="key"><b>Bytes in last page</b></span>: <span class="value">144</span></p> <p><span class="key"><b>Pages in file</b></span>: <span class="value">3</span></p> <p><span class="key"><b>Relocations</b></span>: <span class="value">0</span></p> <p><span class="key"><b>Size of header in paragraphs</b></span>: <span class="value">4</span></p> <p><span class="key"><b>Minimum extra paragraphs</b></span>: <span class="value">0</span></p> <p><span class="key"><b>Maximum extra paragraphs</b></span>: <span class="value">65535</span></p> <p><span class="key"><b>Initial (relative) SS value</b></span>: <span class="value">0</span></p> <p><span class="key"><b>Initial SP value</b></span>: <span class="value">0xb8</span></p> <p><span class="key"><b>Initial IP value</b></span>: <span class="value">0</span></p> <p><span class="key"><b>Initial (relative) CS value</b></span>: <span class="value">0</span></p> <p><span class="key"><b>Address of relocation table</b></span>: <span class="value">0x40</span></p> <p><span class="key"><b>Overlay number</b></span>: <span class="value">0</span></p> <p><span class="key"><b>OEM identifier</b></span>: <span class="value">0</span></p> <p><span class="key"><b>OEM information</b></span>: <span class="value">0</span></p> <p><span class="key"><b>PE header offset</b></span>: <span class="value">0xf8</span></p> </div> </body> </html> By combining readpe output with a filter like grep you could easily get the PE file entrypoint in CSV format by filtering the readpe output: $ readpe --format csv --header optional putty.exe | grep ^Entry Entrypoint,0x4f125 With readpe you can inspect the PE sections as well. Use -S option to see information about all PE sections, just like this: $ readpe -S putty.exe Sections Section Name: .text Virtual Address: 0x1000 Physical Address: 0x5bd41 Size: 0x5c000 (376832 bytes) Pointer To Data: 0x1000 Relocations: 0 Characteristics: 0x60000020 Characteristic Names IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ Section Name: .rdata Virtual Address: 0x5d000 Physical Address: 0x1ceda Size: 0x1d000 (118784 bytes) Pointer To Data: 0x5d000 Relocations: 0 Characteristics: 0x40000040 Characteristic Names IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ Section Name: .data Virtual Address: 0x7a000 Physical Address: 0x5924 Size: 0x2000 (8192 bytes) Pointer To Data: 0x7a000 Relocations: 0 Characteristics: 0xc0000040 Characteristic Names IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE Section Name: .rsrc Virtual Address: 0x80000 Physical Address: 0x3b90 Size: 0x4000 (16384 bytes) Pointer To Data: 0x7c000 Relocations: 0 Characteristics: 0x40000040 Characteristic Names IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ Looking at function directories readpe can show you the PE data directories with -d option, like this: $ readpe -d putty.exe Data directories Directory IMAGE_DIRECTORY_ENTRY_IMPORT: 0x78378 (240 bytes) Directory IMAGE_DIRECTORY_ENTRY_RESOURCE: 0x80000 (15248 bytes) Directory IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: 0x78318 (72 bytes) Directory IMAGE_DIRECTORY_ENTRY_IAT: 0x5d000 (1292 bytes) If the executable has an import directory you may want to see a list of imported functions with -i / --imports option: $ readpe -i putty.exe Imported functions Library Name: ADVAPI32.dll Functions Function Name: RegCloseKey Function Name: RegQueryValueExA Function Name: RegOpenKeyA Function Name: GetUserNameA Function Name: EqualSid Function Name: CopySid Library Name: COMCTL32.dll Functions Function Ordinal: 14 Function Ordinal: 15 Function Ordinal: 17 Function Ordinal: 13 Library Name: comdlg32.dll Functions Function Name: ChooseColorA Function Name: ChooseFontA You can see the exported functions as well by using readpe -e / --exports option. Comparing PE pieces With pehash you can calculate checksums of PE pieces and not only whole PE files. You can for example compare two malwares by similarity using ssdeep. Have a look: $ pehash -s CODE ComentarioDeVoz_.cpl sections section section_name: CODE md5: 67b498c232dfbe4f5cc0cabc5e78ac42 sha1: 32b5df9aaa201bc8cbfed37344aaa77bf842c1d4 sha256: 8f5b794da7fdbbc13f1abaae0949b4eb98935c99e7387c7e0dfef5d4f01ea298 ssdeep: 6144:2QrIKt9jjmVG0xcpcZTcLexXqS1XGtbNwI/4p3RLjD0OVG:2QrD3mVG0xcpcZTEexvXENv/e3RD0W $ pehash -s CODE comentario.cpl sections section section_name: CODE md5: 973d11759194c14071aa6963de8f55c7 sha1: 1934e0085c8776e3243bf658e95b8943d4f91bc9 sha256: e68349bfcb04b20c11973ce27770570ebb22c8c7750133d073f15f7ec9eeda38 ssdeep: 6144:FQrIKt9jjmVG0xcpcZTcLexXqS1XGtbNwI/4p3Zv60G4:FQrD3mVG0xcpcZTEexvXENv/e3J6V Although the CODE section hashes of each files are different, their ssdeep checksum matches. So, you could probably infer that these are variants. You can also have the hash for each part using pehash without any option: $ pehash -a putty.exe file filepath: /home/user/putty.exe md5: 33c9d1e56152e212367e9c5b01671e45 sha1: 9ded3ce2ae09c37ca173bbd3dcb57258b72cdbd5 sha256: b10922648f6ad71f3f20b9acdfacf9aeff706cad6c52737cdc426307ccfa51d9 ssdeep: 12288:ApoNd4D7aVwSn8nW+nGQZZcLYX4RXwWLJQ6LU:UoNde7aVT8WvQ3O+4NzLu6w imphash: dae4485dd029c5e0256f477eda4797a4 headers header header_name: IMAGE_DOS_HEADER md5: 5084c5d5cfe99932e67450023c068941 sha1: 856558429bb575486a46a92ba2684eaab8578cef sha256: 52ea4dd296abe995cc1052a3a29325a8306fc888b3d6fea352d2cebdd83e6eaa ssdeep: 3:WlWUqt/vllPln:idqH header header_name: IMAGE_COFF_HEADER md5: c29db8cff4c151279ea0f3e1e122bb92 sha1: 5df76c71b2fcb937b98d566dad7d353f23f23418 sha256: 4dc37a0d8a47d3c713b891a86b92acb28126729da2b7a6a5f3656d23fd8c1a9c ssdeep: 3:OHwkn:wwk header header_name: IMAGE_OPTIONAL_HEADER md5: 0de919344c187babea80d66adc2b0d9e sha1: 4bdec527003b46348d8f9a1594f39f064e9dd680 sha256: 97e834e37ee922bca8a9388b2b1663491ddf0d3b20c6d37782aa4f2d1d9ebf64 ssdeep: 3:2H2l0lvl9gXH9lhtllrll3lll/ldt1l9tllH:NGlvA3 sections section section_name: .text md5: 67b498c232dfbe4f5cc0cabc5e78ac42 sha1: 32b5df9aaa201bc8cbfed37344aaa77bf842c1d4 sha256: 8f5b794da7fdbbc13f1abaae0949b4eb98935c99e7387c7e0dfef5d4f01ea298 ssdeep: 6144:6poNd4D7aeaNqZs+iDpnRKnWDX/ZcnGs9BDT7JjZnZZGN+FAFtt6Xa//lrXwW:6poNd4D7aVwSn8nW+nGQZZcLYX4RXwW section section_name: .rdata md5: 6087c2ffc1a7d69f82696a4f2d3aca75 sha1: d69529b6402c520bdbee855c34ce4455112bd1eb sha256: 30b49d20acb96827857ca125ce0d49838fafafe9d7e49523982b2ff1afe54283 ssdeep: 3072:mDBKmaes7rlYhoAw/Jt8Lr6hx3bO6ta/4gRul:mS+oAw/Jt836L3bA/ section section_name: .data md5: 5578c6fd3e5a0b764a7f2bcde00f9a16 sha1: b71d5142594f56e896e79e12abf729e94512b9e0 sha256: edd88e6b2ccf3dd5624ebd07b8911e2fa51f4ddc7912d4699ed111d28a2a53e5 ssdeep: 96:j/1HpvU2Ro26mTfOkf14dBPBgtbAgUhoSkb/:9o26sN2dJ9rIb/ section section_name: .rsrc md5: 24b45ea2b1620870730382fb7308a074 sha1: bca5bc464c261f05751c24dce49d70458647e75c sha256: 695707a6f3385838f6e5b58ab45584acb716bec2a2a953327dcb40314f0c0908 ssdeep: 192:Icgh8G2PnHGaAnkTjVDBY5disWxDgPWDSL73oqEnngLg:I5SG2vHi4jVDBKjPfL730ng0 The OpenSSL library used by pev supports a wider range of hashing algorithms and you can extend pehash to use them by recompiling its source code. Analyzing suspicious files Suspicious files are nice. We could probably think about lots of suspicious characteristics that PE files may have and all we know is on pescan: $ pescan -v Nota.cpl file entropy: 7.986840 (probably packed) cpl analysis: malware fpu anti-disassembly: no imagebase: normal - 0x400000 entrypoint: normal - va: 0x15c330 - raw: 0x65530 DOS stub: suspicious - raw: 0x40 TLS directory: not found section count: 3 .text: self-modifying .rsrc: self-modifying .reloc: small length timestamp: normal - Wed, 26 Jun 2013 12:22:16 UTC pescan is the PE scanner program intended to find any suspicious characteristic on it. It's good for an initial analysis. Further you can analyze things deeply with readpe, pedis, peres and so on. Strings are also good indicators in general PE file analysis. To avoid the problem with Unicode and ASCII strings, we've developed our own strings dumper for PE files. With pestr you know exactly where the string is inside the file and you don't need to specify whether you are looking for ASCII or Unicode strings. pestr catches both. $ pestr --so dotnet.exe 0x2a69c .text Button4 0x2a6a9 .text TextBox1 0x2a6b6 .text 3System.Resources.Tools.StronglyTypedResourceBuilder 0x2a6eb .text 4.0.0.0 0x2a6f7 .text KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator 0x2a744 .text 12.0.0.0 0x2a752 .text My.Settings 0x2a972 .text _CorExeMain 0x2a97e .text mscoree.dll 0x2be7c .rsrc IHDR 0x2be95 .rsrc pHYs 0x2beaa .rsrc IDATx 0x2c1bb .rsrc IEND 0x2d742 .rsrc VS_VERSION_INFO 0x2d79e .rsrc VarFileInfo 0x2d7be .rsrc Translation 0x2d7e2 .rsrc StringFileInfo All tools are provided with manpages. Check it out and discover what you can do with pev. ;) readpe-0.84/doc/manual/en_us/configuration.docbook000066400000000000000000000011441455661113700222620ustar00rootroot00000000000000 Configuration Plugins So far we support only a single plugins path option in pev.conf file with the following structure: plugins_dir=/usr/lib/pev/plugins All pev binaries will look for a pev.conf file in their current directory first (Windows reasons) and a $HOME/.config/pev.conf file after to get the plugins path. If it cannot find both files, /usr/lib/pev/plugins is used. readpe-0.84/doc/manual/en_us/faq.docbook000066400000000000000000000113341455661113700201640ustar00rootroot00000000000000 FAQ (Frequently Asked Questions) What's imphash? It's a MD5 hash from the imported functions names, normally used to search for variants of the same file. The ideas was took in place by Mandiant and it is explained in their blog Tracking malware with Import Hashing, but keep in mind there are some people out there saying that the current algorithm for calculating imphash is broken. See Imphash implementation and Imphash implementation does not follows convention to understand better. This implementation from pefile is the one used in all software that we are aware of - and it's the one we use too. I use pev in Windows and every time I run one of the pev tools I see CYGWIN complaining about Windows-style file paths. Windows version of pev are dependent on CYGWIN libraries that are included in the ZIP package provided for Windows users, so CYGWIN is still there. A workaround is setting the CYGWIN environment variable to disable these warnings: $ set CYGWIN=nodosfilewarning You can confirm the variable is set by running the following command on MS-DOS Prompt or Powershell: $ set | findstr CYGWIN If you want to make it permanent, you'll have to add this variable with this value set in System Properties - Advanced - Environment Variables, as the image below shows: How can I get the File Version from PE files like I'm used to do with previous versions of pev? Use peres tool -v switch. Can my machine be infected when analyzing malware with pev tools? Yes. We have cpload tool that actually EXECUTES the target on Windows machines. Apart from that, attackers could exploit a vulnerability we don't know about in one of the tools to execute arbitrary code by sending you a specially crafted PE file. So please, consider using pev tools in a protected/isolated virtual machine for binary file analysis. Can any pev tool rate a file as malicious? No. Some tools can give you a hint but it's nearly impossible to programmatically claim a piece of code is malicious. I can't compile pev from the latest source code on git repository. What can I do? You can open an issue on GitHub. The repository usually has under development code and sometimes things are, indeed, broken. How do I uninstall the pev version I've installed from source code? On Linux and OS X, just point to the pev source code directory and run make uninstall. On Windows, just delete the pev folder. Can I use pev with my project? Yes, as long as you respect GPLv2 terms for pev tools and LGPLv3 terms for libpe. I like pev. How do I let you guys know that? We're glad you like it. Please, consider star it on GitHub or SourceForge (you can also make a comment), send your feedback to the pev-users list, tell your friends that pev exists, anything. We look forward to hear from you. Really. I found a bug. What do I do? If you suspect it is a bug we recommend you to first discuss that in the pev-users mailing list. If you are sure, please open an issue on GitHub project page. My question is not listed here. How do I get an answer for that? Send it over to pev-users mailing list or, if you're a developer, send it to pev-devel mailing list. readpe-0.84/doc/manual/en_us/figures/000077500000000000000000000000001455661113700175155ustar00rootroot00000000000000readpe-0.84/doc/manual/en_us/figures/cygwin-warning.png000066400000000000000000002310441455661113700231720ustar00rootroot00000000000000PNG  IHDRU iCCPICC ProfileHWXS[R -)wHދtH* ]Qq-,*bWD"*+bʛ9gsr|3(ڰrsP%@fBbG@zGF( +q plsڡ`V~B* b&b"Ŗ(_ SY,A bv ho؃@b'o1SbXicXD~.L Ĝ !~*`Ѽ0k6K+?=&H%p a8\?)ʸa|dEY2{%3vHX={=6ؓ VHl1Rn8 €/L # hIg @+f#^2ÇhP c~>Y.(cZ Jf $ٸ&a1GW%A6d.0;1hO݄{ y ||<,$g$*!Ǒ#Vn\5>a2ńNdPS))()o]ɗ(#B5RQE5j+-F3yђh5ZcGBGaBBuWrFފ3 (^SPS2VUb)-PT:tGiHlZy%*$c2]*gTz݀KgӗwT&%T;TT&ũVT;ƌ`Fc-068qV;8սԹ?k05525k4j<55hҬ<90^uxB̵jjޢ}F{@㥓QN.]CQL573Y< 7я__ȀbljѠ`Pp<:FrFFF.}0617^ahD$ؤФ)4ϴ,lY9j`n^i~pYl$XX--XQ zaK_M04a 8dy`bbĶۮ=>~}&u;LvXQxб)igUH].>. ]Z\>:v-mۋI&vOuwgt`z${dyV{>2xzm_W~___@AРAw!N!CΆRCC+B š'C&o0("#6D<4̋} qJ)ϢlE]Gό>'fm̃XXQl[bܴڸ~ '\IL%6%$ Mij4iEnO7>{3f85H2!9>y_V55e~lsݹ/6{|yA3>dFdddggU9:9sr-rr\6 B{p)_sE增ʂf~rtsó5-Ñ쑑\%9 `pPw/ 38P@" #->zx~lDjo'E7Ǒ*62u7${dEA;)2m\>EKV /&6V.]%Y**E۲$ Y;~ľ_ K'RvT-yJDFq)`X)J%dE&lCFacQO$dUA6 BH#+5qpp8D DhEww@"MӨ #$%'֨B3IMOG8 D1 UnaŬ H$hi}GEc~T?{E-IF#]\^?;|u xU€pчS`?ؖƲ*Bdr2Iްi` i eG888*Ka7H$@uغi{o!%1˲غÆSY#Jl k<97蒂ײszJqcHiIy- 0IJX HHHئ+/_|+$˴@RqەIAu+FVU$acBvR$LMѬ :H:e25os(-+$k@q , LFV;]iGϳcXQԈ6aHHxZjɧ%fn$Ƚ9 k&vQҎEvH_+kN+ I#MvD!ĕqhrf7^;23)/DzȽlŇ%@tHa(*-TGMU,%Ӹg[Ƒѽdbf)E݈ƶFMFAx+6ij.|8.^Qyi 3lb/Z&g"kJ(3w|VkĦPk xd9N!g! 9@hn?5nG6ШI&o1N1z/$$ y;~i 0 6nfŚ2Ry78=4#?@yc -5,2 mڋޝ:)r|d_R6u籥 MIN=U"K]\XRl1q.l&L?`@23Yn=2FbrRD]Մ-;1F+Y0 (bLH eK36&U[{SL6m #lp.cIw>GŕwS&嫢u VizmXOi[2M-D R{IȪo|rC9xYLvfӃ|f`S, Rp&{ad)YS&fMFۺu-cD-`.{">YXEܠ$Jk8LhɏJld6-N'#Cق)7Ī(e,- ɛyo&ҳ-tppp8h"uddYH$!$payo 5A*R@~;[\h<Odk&B!2VYv&:aL:>~'WRlGJ_Tݘ"z/c888|_ϑtʒƲm>4mle1Tw>!uTUdmv "`@@H-a-;iU$)]BnPN0,."++8$W7F_IntYeRt{6&m9"Qq SI1l7YCxV/R<:CVLH $ ,=^㧐-X%3R3NF'mL`J&u AOm`H2La߾$4x>p;O8ue%TR)d"YP0r2GR-' :a:Zz3#Ndfj32),@.Ð8!=XG"D,>}Kks A!,g*A(B0y(#Hco)YQP aaCRܙR^H}IL׏mX &i؝VD=2H%2{K ,+^zl̈ұ cIz n]a/#Ӱ:6յ|jEu0ͨIZf炄N cD/Y]6S/5m3R+%ɂ`^V4AY!D+U[ՓTٷeYjo5zU A dY~ t8*#LY 4LZZ|K0'Îtppp O}} v7?;,ޑ ~Hg;J,$Pe qpppp80qppppp@~N8H!pQx<|Y)@"۟B I)!!a|_Lz3E`aLB7E$F80ȡC.mY IG[[8B ?t}ze##喾~W@|k(AEMDӵAKO.&#s"l/.+HF5mB2\Hx& I&r(aR]" xF`c}4)dd% YPm]CM>xd[ P @ptЛIHĴ_ $~?vsĭ+dClFEu4K]߱"5c Abv!qA n YG٨NBW66"e"bBHߔ%RHߏ~nB: :u{kn9)Ev MlZ.qҏ8]~H?KUx' ,!!wOwq?6q'1[@7#r'sε/3ƢGf=`Wq_-Kyڣ8vL23nx[Mwsågs3e`κk;l]' qe~AyЦu̘z'x{ZzLv*9 sX*{t?oa6a][#߳mdI $rތhw#ّ~/Kmw/1J.;eʖDǦ*EFԮ~?-ؑY~]EV$h˸/<;.oj?!uH?ܷquamhYG'R]]Cmm m1q6l% G"2#nlWTિ%mGƈ2F~f?lfl0dN:k"z%Ԉigp(ZCgۨ l)Ac{dsKEzֱ;GN(-5cH*oD*h3OeQ]]MYn q!vNUKݎp@ l)+jIϨ*mK^3_ P{}ΎfALr6Ž|56В1h$ڋݻmcǺRv-э8xl( $*]G_E6z+/F͵4훍^ov8z. f(|^*NF@ѽPRrvV-12(TA@[Dqq1찈"{lxu'pv\>^s-r\SM/đy\|,> &WŦUp4&P[Xb v\;#\8 j2x9;xhM,8*\*C{G w;sJ.5(y= kͤiEA|zk`+ԭ_ OEQTeK#{˶7"G(@7Z_D̦2VC@vG٘T׶ '#h ғޅ${ ,%*mPЏ/O|l"*h VJ"F-#ٻl-B-`0U;*kk60.?p.6o (I,gT, t5*ضqٟlbۚmX2pL6):24>֩Duv#)ROaZ b=6 tLZرj UmALOѰA乚ؼ'K { f=;*齆QbXjmB++dž vӺw;J I^(*ʎ!~g'ߍ5UQ?)$$ڂV-7^:,S>יq /gz\7 nAOpa Z˪nM=}YA}DjW0Yb%uT𣇒wUmW<=Gŵ,$`;kwÝv-1z_IZX5<2Xь=.̭ HOVu c nzp]1E'x2\z773;4&$K'X9ePjTE+ڞWߋk޲fc ώֲ:K͆KPg)}Ƨ\~̳c΋_}!i~<IGvɌeOxYM~; +7;t Sz0 oWoXwW$xc0왬:-I00D lx<9r}9Zri<}<1o7RlqmR78~B Ym>lw 1U/_ýBzQ;4zL@Mg0v\ʴ# m6;]A8m | QtKLϸ ߽)Ǘ.W+NdYsfIZm^/a-6cƩ$w?n<Mded<bY :N=,K\=|px>r lyO_Y{ ].cK8gEz [ xձ 5/__چUHs |'a$=tFxql72iV3n gO#t38'[,.>m ]ǧ@s<5# ܷoI>"hb|Q#nR*dJ,X3:5~L{-sӻw붔cS}:<'dޭ=(}ȩ.<9)~.+v2>{nz KUu&\w ,W62;R4uCF LC0 aF^yvbn=['w\.EBZ IDATlfqgܴ!.20c"#̓wqb[$ ]G7ml; J^Gǹ *M}+FR|Ko|EQ }f EkG+mFN%^˟Hئ;_ L?gL oyD>V'MEuPgz>r) 7,y^cx}UKdhEn/ur&}gNGə /}Ći|䱅n%#, 0Ǝ'ߞOiٌ [?^KLLrbrٜ @KH]̬2p:p]%r% ˶ #WoRv3\ߩaw#<~\?W}!EC^p%w3qf޼}'#7h2/>w?obwx^L&&? |~*_{ sܿR^ve@y= qt^>Y=n&+y'Fl;ߥwx~tw.W"y3vQ }C+J c؟cbk[vg j/ޙگRpAv99@_%x\7n |?=¢޸C i-C1lmhr\_PƇ]_meǬB~ _ڜtLTWSKRw44C> D#@dUoK-Hc Wl"E,fp[Q{5XO)gOi2k}ز 7~CWRd%624B>` |M-*g]U[_aNJ^ZÄ{L=U{]vH6mpgBT4Ygz'UJh&3xb>zB69Ķ6;)(͕6uٸǪURHMF0mm~rɝѮi:9,?>3nS!o{75^_@ꏙ}s]DCaN ̱* 1tg9Jzǟa+syᰆ~&%OZװfgvXFu3ph0mui~kۤ͡hx8[_׸~'y,O?V@bv9 漰.,&qf^{=Jv|«BS400&Z(H H.EBsIJ\[oz}Y?}4se+c5+:RJ s/<^82t̟t]97d>ޔϱ׻y⶿'K fAme_Go`qXBqg0lLAF<[wQO^v:4tR ߇6}  /D"+X c٫9A/`}Vf:m`#⳰fjVJ%&oEvlvu1_Nm]#yA ܽ%9\Wh\]N|FU˯`zV$tcy<D]|Ȳ ;Bw rd$ RֲaIX9JyPз7Ma1VSY݄9d"rkZe@WJkr)m%p8斲Y&ljˍl{z>d\ τ:%L\bv7ۮ% R92k#O43?QfV DOR{ 20*;SCD$,GbB71[ Ɠݤd4ܗZum:"!&F գ"ǧ2/rGongλ{>4StV:B4@ۖL=Qkߪ?f=Ӱ-3"l7&ib!,,\{ ۙN cpuQgѦ@aaj>oʹ dO?Yǎ <6;btl+25br&}JyDL5jCC3 z!C:ftQW& /{+sײ}%ly*}/&S/7CzG$h>Bʵ|\]vq< N}aMgK|6/ @BOXL)c#8l]zFrW1 a$ Qr"{WIu2#!/EŸJa j<+:fNh|f25߿>Yquc@8@ٖml\ʦ 50m6L3#}#KV_K3MMD$xyksYWw.SSr;I؊;6w\LeRu(dӆ/&3 k>vOͧ`uV^o/R/9$2a%e"c i۽4pհYbic_˿ؿE[LFBBx-_Әri.olZH{H4+dw@eGZB؋8><.`}n~؆fXaaiG>~uq"ʼn.nqo7+m >vpg MY R15cM=V(0~Ghf ,kህ~]": ,˹=[v0ԅhk=Gb YG?GJKqd+V4&jCGֱ-`BL63sܿj6>7W*B lp8";l$I98yGܣ{4EH<)2Xe- HQ7)y Ejv> Jf&1TRsRI֍LNGֵް-5t-ٲ:m$''Wk1|MMM)eZo6f6M oROF nbAFaLӗ̤4璑O}J7a1P- ^A P8hzd0p'$aJ܏6R؄/ƍbh4\L 1%̴8~Ċj⣦qƙIѣ,l/IKK9@.*>_edOy%4L65ьŚ5ټ݁!\}$!K-ߛ4V.YGeSK۶9æQUZ9)dxһQVHɣ ۃS؍hNHWn${1ak4kP8?fCm3ry~ aanc?RF$ɜ}єHKS3&WM~CϢ ; ߾ngp׌:;="# I 8RIYv#YHssKg6 .smzPcK=m)[r&esڝ`lDHߠn ΠAx투<=KzgGll6H=n:'z0DpND.#O@QyZ9ᤄCMbb;vBZZJH >޿ Yqu _Ru!?l?cl%A# &&.ދ*Hv_Ö@(w|uPĻZ49nՃ': &6@quɑo5T7^ǥ c-X-a}neRt%FLTo6cڠaMl!@׿^ i/p%eΝ]mB!Id\..%2ruI!!L E8/nUA,, B ˖p%>BKj*O<^ e!>(0@qEtpy""1`Sȸ^^7 `!B!%&&*"֑PHV@ÒȈ.4R ӯo/2]w(JGǣ" M:ܫ8\B#ٸb_Z@: xȪ"7#ZPXF¶m dBzA^=~ k0~#|/NK?g3O#8qjFM͆)x-p`z |h|A't}~T`a?[!_|vezavRF`aF numOx@ݜ]3>ZpcjF?+½ή׵S*+DKcnLa 4?t @KqdjZwƎq~5,%txh_`alp#O~%MnM'Pudq45V&Zx1E^| Z-39%cĶȲ㉬e.5*U>{*1p@/IsY!.2Wd~I]aXGs! Av=Kb`~db,Y ZE"4_KLjU"A\gZ뾑$([n`$WAob˗G-{a1:g<,vۭxO>LQXl< w er8888aUXB[m=.۾Q ewӍO9aZN;888MfQ_׿x~h",Yʨ SPct ,_B0O{ taD+D(N; `omc8S_!B\|.We9r2N֮/ wsɉ}8888RVe( ]y8 AP~r^>D $rsG8888rCVC7Vd+|=LGXrpppAQdlAnV <䋲eY aNEFfP)Džc t`0DZzQÇXdY4o9h#Eݶ$$?P;=[{᧕QY*K2jhO}jRT(t%)tETJY?98 D-[fE[KD\V }9L>yIQS&m.K9JVT9cϬaVgP0%)9,ԩ~=yٙ귧[[V֌r ?+&\1\2΢eY?= b=c$mv/cߠQد Zʎ:~.?j3dQ_n O¬foB`L?.z2Xd)3dP:vmh" R TQ :$ 9 6 \}DބO7@z \Ԃ?m-SoH|Ի9"YK)}?^ )%'%/O.@J ~I[ت@D񡂐 @v34.KsοmoMz^}nzqRHyJ z1;ظUk4fn\o s)o2gr6\|4G17jWq/O¿_s^UWMk6"^f2gWߧ7s}<6yt: ]k.$*rpvֿזň]O;S$ڴ'rCI,IVYԣwog,p H;1zi7Ojɺ3,Z@q~Jc_΢`9-B` gg4^7ǽk1_%0YhBw< 0xYt]Z?b8VFbaW(~sD*j]QXq+wa!8c 3]ضw-?ȓCX +)J;ȇ@Ӷrٝ!,߄jj]s{r=gE}̍ɸ.bγ tuAeu%UQ"h.4 k IDAT}z;c|0ksy0C||hAu_Y c9G|u7>'ٿ;{,ϞbK)k 统W+>^o6EEa8r8o>c7˺r5n m\ú!~ #n}MhTF~|Eh:yO^Yh0ASC@$MCCT/H3N^Oee5urУ/6} D4,5.+BY@EƕyɋB& \'Óx4 3܎.f% B9L;F5a/ C (uuFudy@SH\MVÕңsCSXFp2\Ff/p1ZJ\Zr ]ЄhIf͊.lyvF 7‘ۨlB&Jf|ՙ|)9=jʷr-SVVΊy\{sԳ0LcY֮޽BX -jJ׳#14ɐHK%? [ҊȌYٳ/#ze`YT*ScSBZ61w(Bc>$`)RH!^C_@"eԾ4fb~-iO4 tẂH H0QQea04е&kmGGwT/YHoXQQ%Vzr{٤Jx SɦdMD;I͘\͚+X<Ǜ⪾ iW5@~K:NP^2>ʥaUEiʊXHCO= o큤:4-d2#َ)I_j%l-ZF]$˯MesCqި<W1xPǩWzYBalP26Y|=%VJs~ I'U F%lJ&zvto6])m3/GG4! \x?dqr<|zsi^4RPy-kUBT֍L[4%C0Y7kB P~Gkħ`tᐣEBr#aDz>2 q~ۊb$^.K7\G.ЯC tC8bCҊһO!!0974M"StO;W}V%iAzq_ȍ|ηTUDztL(!/nGF^yxWI:'37<=q1>#DNarf6vmBHı]DǟK24 :3!iAµma: pGj 8'H:f %e ^"0}7Ǒ%NB~|~]<¶%FH"%xHL$Y_CBt\Hh4iv=DCP(~߮>-o!$ApV6?0 Ia:ڧ8'XkFe~6l._PBWc-4ߟ* 4tćTm*怑FvN6A,A-*Ѝ0M!ZKe"X"DFFvU)q3LvN.iE]u%U1aCv -/T(8!DnhTy; jsSwpIuLn55<}hᬳd{om|~-ඳ#4:\4}BD$%%HZ_'8~K'3oW2̡i,=7S^q<Κ>ʞ÷NfC(Aa\X O~[#-n'vxt~3-&3ȹck`z}aR4G,>(-A^^Ak"T/6kNTsk*f?x\!ceI⤷1u*~d,O}R:o3m}~G"UTv3@P 4o+"{XGM¡]IA2Dt0\h, F}UI'9nK㎫]N;e=W+|H@GĻ]9hXB62ߑWoS}0>v|>?W5 &^ܛt"w4tPl _s?/eyuDM׃8{C~;O5٘-c:z"/d2vXOD#ΡM\;A<#aEZ=.!Z-_p-&? 7Nzg<"xk7;yg݆nFZͰi`UN7ĉd=R"At=rV4*$-ij0B;EUՐ߮r1*rb0}c#*?-nQ [vzy_}c{"Uo 2 ŵ-lRŚPb8n3督hR&^izHo47l=9"Ky38̣nz}wܘy O|cuX .A jlɎVS)It$lOK0P1j"@G"-@tbkJ*. pǓ:؎y:ן]2c V= ` @nV&[˫hcd:Юj6=߁.uk 6`fzsyѺ35sh ցac$lpt|  ߑ}n*ϧfTk[$4Y=L3,Ĭՙ Z#jW3[9E0(})2m6cBpMs nCgQgధF+qJȬw$6QBMm;,Й#k¦˱w&lw!Ų$4^0W`b2Gxxr`1ݚm໧<5[пE5 B1Y KHq+FayGu~\}ٵ4p3 UG5˧ar;.%G\M㺣]~/?8p6;⛛oPlBh3aK&Q)nKraɜ$ئ{t4oے\4Gm  3n7ɯ=^xѼzE TG?coO%@Ky~t]q7ܤmΑ7QQ (hюn\\;~$9 9{WCInC1``,CK j!tp唇t ZdzidwU״eUǽ_&sߎ4ۥ bn]jC&iw0Xx[Jya?m:bk;Tʞį_i2BTUUDTCIoȒ(uQ3-/q- -# _Cx&!I$C0C@h2^:8K4b @ЇY$<i!_23R~28nC/Nm$l8[h~|C4*G(DLф f$XCKj2N[L8 *H{~!q1~L&4 ,,[(*m#𠼲̟aiʢ;hK03YϛoA${@MDN+ر:c;ovVfmݍSSvID]5jY؛%?Sڝ vb7Oښ$ujk>He'b4*GvF#/=855mQ]o|qj{NJXVv>(} 5EP(J@ BDP(J@ BDP( % BO0jg[ "DH1@4m/$j Bt?*)TR^Qő#Tfr ٭ g\h~GƌC<#=6̲FOo%:9[};ֆa vmGjxR.i@KXO~l'>x8C0]d*8Oj$ u=lg{o%u]GQQz*C [n 4Yf)swt]r5˿}>t#g#Մ`h=1~|{tf.kZobE sɤλ0tG^}6k|-?mtl>x9g/3@gsIJy,bUYgNW+w7_͊1t .&SJLyn=e9.$Tx/IR&Z<~*USSÍ7Ƀ{Oy cĚZә tnKQ!USݫ%Y@ KͬEc$G,ϦۻjB'Zՙy 玣{gĀY>[6[̰Jɧ8J2(t+K_z@WubDyضeY;3o66pxP͛L-(kOqۜ>>Dnz1PRb-}C>Աh]ÑOIkh,ƒJJw.ؓ>Z?9-y@ Ͳ2f>N|5Gͦ`'9g3+Rv%%ƀו8nҵ'naFW{ ~^-{4 kw!c]Kpm{ pcz5B:(:z]u% 49\u7u_5)y<={CX?vrܦ\ҳ? x yiM34 x〮4zpHFMƒr(,iJV}T|*USm"ku`h$ͣ0}0Xx[Jya?m:bk;Tį2Gmce-ma }٧@!N'ji>BF}H!u*iSN jR`X,N @]fyZxW\z.9%g~&EPH;V]( poDQX5oEwhruIfFv؉H6^c[}W`%WG>!.֎'v1"1SoO/F &ɾhO4K4]]vB9Ll4Fa髅Dm'C*C]P-װt7BPB+Q(Z&Hf0k[$ 0Lt\;* % ?H$`Q ‰Sk >H-O"IZ7%J4_Q4G$B>~ +4 a hX )LL!O4+q, G-"cg$G G~q>5&Ew‘G+PB~%gI.K"\Q(٫_&Yż| lj\׫W#{2+H^Ƌ7|Lgp@|oqq|gf󧓺f(_6iV3?!Xa6hYwR4О:YVݖC?]wh_Wg5w+flzvGv#[%k4â|,&edc9˿fu oa8X2{!˫qQ7:ȏ9g&7:u|ޭp+q=s)MWWf9 Ne}ȏWb=}j"_ljY4+Ft}3_̜ʸ;ïRK#XʤghC5..%%F(-0p]H$ 0p:~#9&LA|,2Ţ4?pj F*G&!?&Q6\Cyx1A~~ u0H?O  ͗:&Y^~Ca™ALGZz@(_fz.0}B!?>"]rUc/燙0cMv36}:qp 9k-޼|CoaOM|5e!Fnm}7MIZ:Ceh©GJr #{|gM.#cʄ>Ʒ +Y>_Ԕ%:=:>+s;g.45/ G.ɫ-u,'|_qOҏ'*oW8:2ms /3h!#CSN_N7~)ZSW,_GгXo8s$E_^[IWddNh8g_ьo&RdMvi"CHDb#>څ/y9|:dେcW?t S^S@L8TWS]UEfAK):NƟ\=n>EfƆpA/|,y 9QL622<-Amp0o(B馅t xDz12zrUZ:߯y܄=5RknIP.؉k-,OI0h:ucu#ޚsP kx, r8 雟`*/y~N.}'4{=L仩af6!p!,;\߃{+$%'54)D^lSnϨ1~pv n,iёsͻ7ѷ.m׫R60Hf>*-cԹdfG>x {Â|:/L3ө <}.\tU-fbD G'Eul¶lۦ69P p4l)7~2q , ۉ׾/MtxȒ"yE"+D!GsDx5ԝa~D4 kOXTُ9^ =.6`uk1ܷ 5Y>!‘Zeuo< hy!e66'ñd26ѧ8B]Dhڑ?.]Ga9aOyW5})V.njgp hq sjÄs۹)mvX\j$:36^ ÄYT/ɼwW,hqci'Şs0wgTOegۀ/ВϹѣGsWF~gNB23|2{-aҎ\K=z4ǷQhhp-Լ4,8)+LcTo -[Ҷt?V"'>7+Wd֭$ \M-\qQZ+ێbu~2e5Ỹ&@x jJkt34:y!$2^qiѳõm\:?eôO_OLqˬ?M[.ҍcgM1}.+Ixx;F]gNp=i |:W}ƈч1uػ2?db77O%ÙCH,t>&,LĩHa'ĢT:9|ausqO~v5'KqFRhr9L OкGqORS ^j]FώQ[@ x88XDHXN!B;kR/c\8BW+ sW`:#p\'K;y /WrOc\e'[,͎:hDp0 pwbiE2tnde/NNG?kuhs<28dP"LXR'ychφ+ C.Bg]O\,$! 2=N)W3Dm%͸\§#͖Pno,zk6!0iuOQ7OcΤ[B#$0y-|wG+\S+SxNzYKrDENI7?EӼ9j6TKCt m6E3aMRu$UE|Vto&Up)yS,\kVU\R [qUTW t!}K<"%| ]JY1Al@U|NW'ƭLiicNDunwHtaoIIfº!287FM*,ȊVk WVqcǒIDd$ (2GPZfºLn~"00"&+U楙h"e@E &2̈́q$dYFӹ7^ ev;NBL:]CCCH ܔͯh#m^ D E%nU7L"%uL=U}?L1S\m&Vğq3ɽIoK?]k_ɣ .!5L`gݽ科Da*JSKGS3?IVˠǗRpx!Ov ,w<ϒ4'?؞2cMjN01c;oIS䫡K9:mHR0ɍܽTl`FJ~]T#++d`ª4wYTغ{#O%SCg;XA΅^Ҝy;x<8NՎp, ҢL<2CEOZ4󫇙W* ̸җ2iIUQճL ]͋CfQ_^g1m{* }im]~!mo&@EԚ<16\.)SLpt:ݯkQ3A$-aOvs))HN':c<*Ѣk86s8 fD)9*џx1F_#aIo0Oaf`JqtjC\<~W[CӼ |}ygz&jw]sϡ φi0o=D >ӳvF3 SKi+aZZxLnȘcIw;bs5>Nz]"zoª3`poJA Ï1w ڽ֣e@5`6/`@*FV *#bHn}?3aCꉩIj^MJs%s)(l՟ޭ+}#Mv  UQhQk?=g)0 %myr@ʷI8~zk_6l_jG bk:"y r~>[Hj:Cmñ̹;F?h|MEOQ$||n Mт^QQ].+^((-cI!W;3 K(8\ t [yΐ-HǯS"nم_wx~b.Ѡ#o)[v~N*p"+@||+;|JN8fMNoj hؖuV"bpfͫPpw3rςgT~lG^wRU㼶 YtJeo#J@<`1 Mxw&},rvgWps >'8~2CArqN8~̠HXp&p`v'm/%8UM%dKa %EeΥ2X.Τg} [T'ÄUח|x/DfqŞUUE=.25;XvlCX~&Ol60el1SI${xkSeOpX&E 9Mv[{9=VXV.'21J]82ΑKN)'5444rc%^ D֝C 'I^ɋAԩ[պ3候үyIC֭Kݺu_s3*Έ@DyMx"sUݩgnېletՁ-^ MQ-,p_L:PycvOyZ2` "̫TjГ$@@nsϏg]6̋ƔOv=ia}oCZ5?o1*ӗl7R5.[CPZD~-Gޜ/KhMCbyބ.7"5EPt-T׳{edqם1{l9E+*&{3y%$V #??BV:#iIݽ~?N]y}yj_7иXt)$&&^]UU q:9..Inˆ븧=5b .խf 9yڬ׌M$ U*/*b37w.%%%!_XExH-}{昍兣FBtciq1 SZvTe+zmGUEubKuWML>"/jCCZ%Zpɐ N1 N9c%'\b/ 5VTBL\ _5Wbq:8M+El@.|)f;RBjWc;s" h!E_ɊBBu0uNcGפNUt+}V"LW3BaǓo2qSnﵜ^YL rIȊ I5z}o+GAGfSH #:70{K՛`: k_9k{>+Ixbߝ>fԴyߗ/dIѫt.W_^L $dPGi6[}:<󒍂UGtc \GYc\8JK  ‡Ld Ph8-Et&r{:fmd~?Zg|8+r‰ ŐWR[tw `/gxW])(Nm;.$_"@zA[4bmD$7k2V3߻#ajg%.Mxh*&ݻң{/XC=ӻyg}%p}.Anj3g>㭭|ޛ&5j(u`1>  gVcs91bvS1gOrp1oG;8q sytn @0aF$`S}S.é9>% wqKzPoUwP͘fFwϖE :$xx8]OFm"{%6ԟ5 HG|Hyue  ,|# ?Wd <~-}.ͬ՟R2Nk㧖VuX+U eݻ2{NeezF }TS;sm8sc9Р fD_O3V&4sG)?xB mʷX"Q8ˊr<͓/iǁ4̜%0<CjHn/eGaO<=Mˎ c崙,}B d3P~@I2(zZ yAn(X oHwY,ϸ!՟bBTsW|dzzԕYEֲH6@z{: M_}>yK鈂rhu8+NiqۋCr{^ߋC0x`?xi1v$fOE 9YO!oZ؝d>Sv\j+b+]6teNa!ȡvԡAL:9q[$dG^2h?Y(8$%TNAI(/o/cdFt泽x ."v* Eߤװ2x<³cW- 'Sg -z/ eȀ~|ءV'z~#ZOG_YXy׻=Hci?+I:[|(/NZ $K>әh/E^aDn?f :‚_t,`Åj%42(":f3:OOO@"cb rż>4}W&]=G QjcDʬ]F D/QQDEtn#= r~+gY<W%evbJݍ# vu$サ7e,y[xu|uDvncYΙ Ly Vf[u[<=' lUhb¼N~Coxb" &L!'uG3`]C%:tQYμD[_D`Dj5DŽ< V`Ph<R\iҫO&=0: bv>za*MgϜo^)^psLT mKC)ʹӱ7)~97'~xysd'"KBpd"\Bzk;. Y6UEg78H N;v[z<[v*}/ulˆ=xîĊ*q kQ/k)Up ?1Fls?!cqlXF;a Іٹ| sz|6R] J>VЪTˏ 8OWϾ ;Z4]>i_Qrqz&b8n^jWSi15VD3'[QqI8l7̚mж^q?vCHnqM(pta_ _ݽlɂ;Nr ȌdY-^o4`hS⼒s{(Erq<)7`rfNdA5;ӳa%x6ۈtrBgm>e/D~pT¨De m<gb_[b}%AۿHM*wqg]H:/BBW? ՜SsΟDm߈#Bo؛7A~B9/ {> =$RW%y]VmE)9@ODD-\VJE^Lo ciX5x* es`@7`0[ V"v HEtTfd D%F5ADo0\aV(_*2aO^꧊ w2jÌ|x0=k툗.Ol4%~u_Ob[8-^lb_#kay|d[?WfxXHӁ<:lvUդ~\fu4,w>=pWG[3ef#FfLEcc5*{Y»/#> 9|{(Jz}62rH8'#\RJw`G5m0|!UCͲixٽ= 7c8cHҎvYx3nNq#ydc BaZEg[Ʈx^hÞO`-z ȑ#ydDGV p0 ,!)^F.4/H㋐4 ׺OQ]p u:CPǯ@T%x~cӣhLGBTmx=cߨ-}[m WƣԎ$._ "#hcp(.=S3;q</oAwc~:]8%T'EedeH Itm%Qa& ZO0vp@>֠Pr67"-<4,ܴ'D7@Jq~+Z" 9i)lĆaAmJ;MOuZ6I"ؚ/p ٯwń35ݭ PtjDp6C/+RBB3ܳ!gv~Kt#egO1?D5kF5#Bn9'Hq@ I}lz2'QD9-BTdɗh<,TP]5!1Tu #R%cw iDaڗ`vMgBs.5M71g`, N#dcIiPHp`dBEvySS[gMb)z(̊¹= tJDD`}X>'k5iLCu1tQi}jD޴gshҩ6a=Xe.ER\@`X,WU9pPO 43y@&-Te>T_;g$u"HJ4HQL@T!vAri+]HA*3/[E!77ÁdB|>[Lv;~~h<Ѹ)vcֽC𘷂W~z?oZĔJx4œ<˳,<978̝+rgTh]ᆧ'QS)_zꏟ ͙߻61yFs⬨!41$n̓O!x#J>9e7jM5/d[cOUOP8>Vzm273["1Ikwj+ZhhhhhhDCCCCC иJin(ؓƊUi2cST}p'׵Yrro Kq]R?ՍA of鉗XV, :ѣɄP_{p$d ƣxMNNg5-ڰ'e{C#B\A@ta>w?>cZERfС;sie#t̞9qtt"I|x'I Ш$v" (^1Owm N@s]2fd@ӡכI S}u/C6%WVQ62*GExdeu@RE9އ7TVQgos" ȜyaS)Ai7ǧ1xyp#uӫQ2Obѷ*u{E[;b'%<ʔ>IXw|[ub]'W1UXz.*AXwa^Dltu\V: P*˨Q`C~ձV@@T}#2D,L6z\HuTAɍh~}}YZD4$' 1c;vzꤤ0`n (c!:D}ETpХ?|R'l0nCo4]zS>M){zs >>U5'9w%$V3Z0mJ  ^A/ 1FSrgj͹@ŐCN^_>*SMǠгÊxmcT70wѾ7)G:D}?Q`У׹ۏNC!ry s;  z૪(zQET^1ѝL}~:c:?0kW>鹒)V~"m괠ur{ǖ3tkXjA_XIfNDW7g9;m&$8a; zA[2=w $??/?!mJ˧XmZ^Kٲ߄#O4"B&.wV T~z"I1ygfxd/&䇝t"Xnt:D>oA@gz V3fؓi eZ&H&i6ɏIi7EAyx危(Bqq1&LVZԨQjժѤIt:,kFԟMt<ކ٠70#w1u-i֊Ub;X_j֍ǠJH{ЬY#> `-PTR2W &|@,4xh63"Ma\k"(@ُ-#Hro,fVp<,pn?wc\x6 w吋y|]=/Mo;^ǧYPqޗ"H<4E'H$cHl>p4hfP$Vk͚ˑ1!:ѻ5cTԼ^ixLt_u;7\(-8?∽!+qdUű ^[`IYhcsNdڼyUUQ1G/N `:sΞA]99](*AoBamx ̸C$u*;ȞWd]X1[= HἫT)捙K*jD)޶ak3CO<ʡ!)+?2;Қm@QTԥC e(?^GqKUUJJJ3f $$$ M' iǻJUY|7O5!QNz7^*DD5{PT*\""in20uPg@Q@UBXa7É$~j,쀱Ja&?6n#`΋?r]AƔhd'?oWQ޺ECQh0}l<'M]'& ws]BNΖ[ӗsLGFr{`xd =t\~w1?uz("⯄n]vfdY)Bʊt ,& edEɲh:PbLNglS*'~9n% I'%mPE6 :t2ŅKˇy3ͻnWܾmy=׌hEF (R 8M1@p wJ/ %Qk7Z֤ +y8&PޡKLezYrUgCC_.BV ż%ێ;կw3Xh0?;><֮= ^HףK?DD{8=Mk9_pa,#O-ra疪?NGPUQ,6~t?Ae24TfMfݦtd;N[Keԣכ0S:>IxNAe]dwH:_+ՠ^V#^1;qPӂDedYEUWdx:TT܉;Ub{ 詪*6V\Vxgȕ[zU_2uӓb-S`dvmge>wU%`ts:9 TI |g|v׭Fi7 I^@viYYdeR[SQQ%M*bia!(GL6-B&>3&3K5Op;q_5G ##a/#^HNv)PU%9d瓓EVf.Evr! ^(}b `5c)"#+2+u15qv6PЉ%a5X>ggt:<$']YSlDmӈ^%p"[w5oEl2 )v&S>[}iՙ lDEn6(3ޢU2v*c>^KVI>ٙŨ*)âyI=rylڀ`XD&;s)DC}BGĸxdVzm l0.?OccLIؤgq7dd8;So&,!y.w}=n1}oݔW9PTڒϼ!Ol|>cȒo^fH$0Nߋɺ'>$JQ7yȽ Al9& j4ӫGŰi<ݺ|9hiJof}զ0\R}(߻_ZoPݍq[wjo?ؖ[tkYx}=*Gc~|"j_ؘmM@+5= N0bMMWA Nnű]D`<3Ow_R[t4TǸG;b1NlOhÃ6E1=݃O/։GPqYh+`ᅏTiD%d/Bb jAI'h? ބi[ܖOlL4#Yu3sWd=bU B7RPUW^{p^r߸ٍh<;2Ź+ybfLɯ>OgG3Tk [.12SYtvJIU?JI[=8J/.Si~Fu\erssET%)"@~K^>ۼz#ԄǍ+qWZ COe%4-9)*x F{!Iέ0ܻ\dY/Ira4aMDoJKpqk h~`9Y6=.g {F/D}h H.23H؞6A. =F"XiYԲ Ζ Q b{>&PE  ?w0=qEX-.}1[L'DŽȿF(BhH7иk;=BnMDCCCCC &@4444444  Mhhhhh;kEGɤ)GUUdYtfzzVvDQ~dB9yE@ƟB'.]J^^$҃ X,UF:u())pvyeEq/'+3>wWO h9QDչY~xYsN zߩlҎfQv(:|4[XQYxZIo|NvbWUTшӌNUQ!F,F2 `lT;GN.lQAU$Tyߍ_Y1=՗ xXX *9 ^˄ubŀ%UΝ@vS8O?0?;e᫪o$UILL")1بtOLU9#>܄pbƝ,5u _aPb_^nz|É % ~& ΍r</e%Չ'qT?&ˆן/KǞgCW1$TLkP@4r(((Dr2q[^\3:eŋd黎NwށQU2sg&=!@\(vb{[VwUu- * 6QDdAED%$L 'ѫ3s{<-]"MO 0{9KwY>6nv<_m5 EiBB#MAa"8/4].lLk_5 2ib)} }͋YRQAyuNSN1_7嬓NHՃTV1._`6ʼn&j(HMuB Wn.H)%qŰ$[.bԭ{[|.Ω7WG^0J穒t/ߧcCR>~+ .G8{҉^8,qZYm2ǚҦCȴ,B6.Ri1a^ B&BSW}yӇ*G%"U]G I$40?$`r'ǎ`KP(;vNy[P-Napزux T R7R'g{$^Bx>qtic;M{v6e p9#^D~H|T81+y|9  mǜt((Z>_^ leSX׹'9=1UEA DATobo$R=,U5~"[׳r}!;5 U(DeNJ4N\]BDx:'m8+^T8En ǁ$A&[@^Eqő'a7>ËAQ8r  $'[_f^=> \qAH!,bѾL!ӳI-p|f躅@ay=XlDΎGԋ[:Xl|璗O~~'t$䱣icڥﶗXo摧 $%4.{F1))wiܜQ>6.E=$U Gұe-2Pxs4v!;6?}U y=mCLߧ0ݔoAҾ:а6&a3]-;4?s:\>{{r;_ӰyG_]~97tp8_]pҴiSvuTozIMMeÆ z"!!X,F$9jݵB233 ضiΥdeeQ\\|ì,JJJ0 팸zۆa裏6lGuoZAaa!-k׮?+Bмys[i߾=@}ܹs?YjՊiӦ1j(b㩣]v ˑ# 3ɓ'+EQ0 ]rI' >4HJJ"1ǫ#R{H/x)RY9O.# W]\\\ڡU*XM4t]ـ1<& /A5H|1gD86i!׃* ,((9@b[I|m6L _oǬTRS3ue|Q40 2d(A9P:#S}'0aY4V2Aj>>yn^4mI$;ǿfW_FF׽X\s$q] 2eʒ8XQ񟑤$}j]ĂxH!|N5 #A>Ogn?wsVԮqtGD;*{WK4oB SUSժ-b>nхw_6ﮙLMYè?c[I|v gf3ZW<Τ2ӻ99ͳIb;}`.kpt2 2& .xeżM uxk1߷7P|w&8ףvfGEqW&2 .eN\` 3n|W/cx+Y >y+*[+f1Oέ_`g'٠\摥(FZ(BJI8p@IuZ[C^[.Fr~/iԖ'y9nx9 4Al@h[٠OᥬIniI4ixJ1Gy(ɣ76v;C6ocu KE~fwD ᙱG+ ]'u`MF2(:F$w(xY`9a$Z0l:=#ZwTy~M mwq::c8%%-6BuFeԄ"쮪!39pHEiMBfQ]]}@>,EQmI)g?$dfN/]Kccݓ'vYjK]3'M7=WE2>i-Lb IDATasYӝ;H6H%z۷ΥSm.~=>>TSw8eQ93;xe5H8&k+Kg"HK{UodloMB[\\0hC*"GDP:Dit%S:~6˷)%?{|u:4ٟyP$+׳XVEMmuuuԅhDrȨ?: ç,H^t-"]56o KKSU}*~0i`03;%^D#Q**Xk/9AfB2R8solhu!xmg_;.FqV..#B@#7hI9}yDJ0L,!NC8X7dYd-x+g[Hٌْ D,_@2B,jJbQE㏥^ D o<ʱ@m8B"`F-ozm"0M0zH$sP5.FTHP4MEkRA:1b1 ޅPQUCpa Ub\h # q̨J /+ƺ kiա)=ˆSEc?V!a [{eh>\{ұ<>6Mh 68ip3D YŠ~|^sqqq9!9v6 :]\\\\E(;J!n>>W@\\\\\\qqqqqqť!rDM+J~}yO,g㛡X]ƍsq9^,:lE(5܂TfּT5;ʫޡIm*/b=e-[xT;o )D( "Xzl"f_w–Rdq;ԯ98bxmo__GYQܒ.Z甐Rpݥ)4.k v6P}_*o%, R bMezt%l\Uw\Ŭ6R߆<*Zx5p,G}he(Bjj*wuf͢w\xh8op#!~ 8ʺ|_l]νo:w<'יmh; (u7~̔?./`KP), u*-[%?}ǂX ^CŦ6*=}klTR"xI^J-h8n}u!U~{܅2%t ][lޒc%.=;[=c E/u׽Fau u\qdo[: &ft<.ݥ hAFc;R`}3L<٤ytr##TGTQPb!jS3; zBY$VoYQ~"PXJ{tiFlLqy,fe<=E:ӹ e({{}AWlDzoI@̴p0٣=㐟-\.Å#7 އ!08vHfOzuиeS1Ї3K2Kʎa'Cة`{StH :mBMG G"@ukM46n*by.,1qbA<^ 'VK0b Eh /@1a$pu1EJ+EpH ѯ`F-t>3&= K Q(ByE%uKAEAAB׋"u~FhvڰG%hIw< 7ףS } !boJ瞖ΣO<ǭ7\vำF3 b*jHzea%h # QX?''`U1I ٫ KBs͟FZޟBD} N#%Hp;Do8~"e$$;k@}<$PD Aq9r{q:ju |GNu. ُݤ7˥a#UQ zjJJJ0MWH,Um۶Eݗ0yi)QT5jDԫX,o}k&55lܸ;p?@kR(BMM |>,B#İ, G'>WRSSKZj JqW\ks..xXjHሽD\ ėmtXfߛ8؎mض_? x)((O]o{PQ3*-QPFj.,Ua9Y,#Cbb &pVinV?HU4/:ĝ EД#k>jnh i:'~h(*zw麎[W~AýutBQRT{)6k(EA)/P wo|euRmu4UAe~_ ,erbfKQ5V]+Xv ŕTNt$PYE d"Bn$ҴM-SwC_+رiJInAd$8vH$]޺q8mY]$nOUQ2V/ S>^pD5ۿ&myM8?DgRd;+H3Ț.DVܒTT4Mg5&ɯHp)E7R(d2sH{V6o-# ׮K_&s9WrVQ[f{"B \DS]EFmM[&r{\$j8jͦ^ޗ?` )lk2ן?kgKC` Tp,yUc0;տ1DDrS\^MmH5>JT$m8)4MU li`c f5;~^5U4V-v /oe젶xD:6mxwPe:x#3-u-# yſ6I)(m[ j)Y2[y]-Tf>\Ո/_{{_\qv0nߴTU`k `_6FQV'bP4^IJr&>o&m;(MR@؎ݱ,l!* a#Q[4ь=ʭSx||/gb)Ua,r7|"/]1߇(8vsy(ˍbv^WSROǎ]2X=7"B"u]vca|5kwUͺ@xԆSATAyw1|M3l>ITZT,ڈ՚f:fב\6q*09mQA4-9MX1Zlзq_mlM&IޡEAdk)-Z{˶"׃O uVoM,ׅjV,զ92VAVd/ڌ{GR2iڕ=6nxk,)Y߬A4R)QGj۞4K {f*4%[_ŖaHnMIڰXx3͙ m-ZAI‘itr,V]!HQv}uf ܍We[-l2=5ϸC.OcxJ>m?N93"z#/M_gRҢ}Dl6_)5AdbTI M~eƨغˊ)uKLj-(NhdXѱyZtԗDgB4~B] R ۽a<C#c.55TKI֘iC<%5ΛG~լ[F?Э/"Ro\Q94oQi ?t?.Ȍ=O1EkkԟszҿO-B[?Syw"Dq ͒ 'QKVzIv2]om5҆xW]?}?xI 850M%g&JWeӥ R'+8wMv!_($F9iU}|6 [ `E}i 9 o) V$MsG#:6ۦUd 5˂oن;˼Xt`M0 )@Ango0x= w'8޿?PdHxsi|<}WFs|lj,Us34|Y-ױ6gs)Sͽgw稴GE l[/ikn]V8 R{2[Lj67nJrLiL6 67?q~EOH|".k\}˜;Q?ß o"e'۶NOOאQU/'OeYH.(*%b?%+mYiLF,ߋ (yE[Nsy+&gnkcMG8:*ǃ*\t?p"1$VF*NdZM_6n&.O-LQL(j{% ʂDmZtӞ†ca2vf: oev~%E1;F-xWynG.30BqOd=ĘQ_Nqiݮ?'4 -Kg\?{OK~ ޸!ZNcHˉ**cmN5j]ԤR-vRPRHtO۩|&=u(gַE Y#灩Ly5M+Mkܙ^,ږgRy%ZkMF3ykr F˓)v~k{§Ǥ/WS(#4Iggp??f̙|t{Fh*&kX "AJW}K DJF 'a뢏7^U BbKJk($$'C({GkRJl4ML$f>6MX,13~Xm Hؤ%_X!Fҡpe?N<kLt7d} &#]D" erX9 "ƢuоnS.I^F);EK/rU i!Ѕ eh?yɞ0#oddF3b, l,an]^eb47'Q5c)ƓspvNx /\mi |5俼ƎC0 G@8HB* njP's!ˍ7o/H9b~uElӈG\}#hF>gt Og'dց~0T|F# xl|(B?5F=7}:$u@~L*h1/<4ڤӠ98 ߍ^i/?Ʊ1s|GaA r☄z<6 GUi<dVQVRVKXěwc8''x@F9d:uI쿁x5!飲Ί #6˘Sx+!?eoi<x:u#gTnnaž6?X+3ab5|>cOLs6gwaw=E"f8UUٽ`(LvyGܽ:`O|o_B]"#5h4zД$RYUMruqJj*/bsQ%J0k? yE%D ќnZPԄtTГsٿ9KX-D$"I=K/Cd˝$6P͠Igp.fضn=01:t~7QTRJu]-iҩyÊB:В.ېboc͚݄몡4/yה}~Ǭ\xufWZ5҉e N8DZ%;H4tnArJ6 2P RsIMcҵ(Yg(;pIQa- "<4ԗ ";g&%F8$jv3*dJk3mDK7SըGv'SQJ9c`GdӺM%;6 2ˮ~[* BKb ^.MnYRHɡ{f0Y|-uA~yt˩B8ZDJKڷkKFwL׳O#S%T՗͂m=$ }G6tA> ,z%aryܾ Q|ѥgZ4mMNn;W,gW8BH˂xwԏcGTJ"$4ȉ Ƴ}-E rӻ5^ {Go9ݶm~?|G>DbHDc$* -Gr s9˲Pv_$ANu WtWɓ)+bk w2!!# 1~a/{gU,* qS pgX,F$ ~_}l>`G FbR'ǣ(XkXB$C^ H DބD -.B88Uk9u&ǤN#8E$!hxW[[:"fC[cwL‘(O4P(QsO7W]Lh«\1FE]0IvߗhT0D^)5HT{5 icx4l /皟$HJ ;$d+ ォ?W$LL]2miagxPaEGMlG|:!?^&'J]X/B3HI!3^ A8l}qgp, ^ FIZ1(O 3[X?Jƞ;h MD1?o|e"HF$ZQ4</~HX8xTX$$&8(Q[şgpbCO0 0h0HP,Fq aYOgTTՐ@]U*1M}\|{B'oAb#eMB=c'q4XCto4ƘD#AĞPQPp0#!ȁ"ָ BPS?~1;R(fk?S>%*!vHAb?E ܉R#R;*?3wnMAhi"ETi*Zuqkŵ]]+*M@RjB'iGH9s!޹Sޙy}ϙ*D'5㽈D똥u&FB#zM"Y"p#!\!+Ċ ?rpצI$Xx1nFW[ 5GM/#D~~[4J30MR{ koiE-j~rfJ4SM$lbmam7(sXfiWہm2cZ^Bm`,s,) <$x2FPY8g-Is{LG&/S+ `P )=,o+H(} H$D D"H3'CJ#l5LTv?N{ K+H9MQ_zvYԮSuk2O\)-ԡNeǠqX0~u-[sg9l!#"Ef} kRFuZ x G"<пi kG,ooIl֭KvvcnvxO3}zedRvu}癋RɨUrNԮNϖVx{&sɪYHXj~eż|9cBQorMfdլMt.{wRW$3959o Nqln̫ό}Lb~qY!"imp\5ofj7WF+$ٛ7yyu)kkVn&H/0v/#og|<ѧ`p󘅼eK]ϝi^x{.ݶٓ'1eM#x Đ^QgU<;EQ2?ԑɕ6Rh#f7chrl\HC7극49lZ^ևpx9Z"r =)kZvk0iE x? kF qP(Q)drٸboS@C&,+QN:=Do+.s9~ޝȕmJyC|W;]]];.nDcaV?W%!CBDB hݠZdW 5zş TfYC%]3Ofy.'~ZA ۃƼe=˚!Mi9$:uwN^uMH >އS[VQ.U!Qs{PXj\#^KK@gNvӛ>Ye~\hKג[D='xHļBŵ8r/i;ŬBNiZFU}$&y#ĥgI=~a*ucWR2юʝgH:J(WY)ˁu ܍i{~cjyC뎜pCLy/J$R@N%Eqs+Xf.]qH_׍#D}/wT&}ɏ1nTƶlh|a;A+La+xvL\βX?E:GDrn; 㶰ux^2AIl96*065>WD,m.E!uۇ<(Bs B B$) 6zIJ%3! 2ӣA)L[gݖ8l«)4p5[?xɮ߅6p}3Ky9^@+-D7{0;nx}NgXaX.ڊ׸y%XBԯN1Y17ݟ_6ۇ?Ĥ]z' cBa o-.~&EG-A~;/U㛉БFd0᫏dOɹZ˨c]ԍ$I$R@N-ec2+iZXѤI (nEROQo^`[e(FUUWEw<%PB`e?aku߁E->ac)T=lfD"3ٕ*1-U-O<~垸h%)~8=]y?9)c}ⱍ^M֧(\Br׹ߩ*e>wE-#;1j~*^-({<=rG(x!TQj\V>~'.|Ȳ{>WD"9)D"HH$D D"HH$D D"H$%Uvna$-=( 5={)qDJfc2aMZB%Ԣqjɳ sdN$Mkr udde.LΦDJ-l r%ޝlMr=Uvҍ%f5&+r(-4<Ȫxt,"B\n/@`Ѥ$%}f)ؖ˖BJȠFzrH$R@Ng{qF 12y}ψ[Wp/NzI|sE?^_{8XE9v}csͥy/.Wn~ZQ; eop[P2ػ=w3wt'q$$'^5% (4,Ja9]E7zfE"*ʃy,&6ƃCqu<|g؀ُяcT,O*|Mulزʬ~vg]MnOv<l^{?ބ|>v0V!''usɄr]9ֳ>g#δ1CS,ڝ{?Y浛-z$>fH鄲7DVE6nM#,;$EQt.ZӲ(v=G47~Z|TQSf:_̊&i[j'p2f 1<霓K3*Y:c;5yw%";Ê>DrfXCpM˶YD> #RRWK~H _@\1"=#ՒIrM"rXAve&OXi3YL_r.o:%sǿq1[jSdwGr<;  Wd Ng DRzwrivL9'c] Sy_I<]&umC60ͷm<-߅':weaǻ/29C?k_,km!D+ ̃v`\nd~eSoɼOeNyxoہ+b~hYڞhdz9rVhGĴ9amaĹ^ (z3%' f'ET6`y.;n="[DF nY2ytN9]uۯS+hp2? w⡏['a:oϿ;٘Ի{P{>nd.1,? r:)ЂO`gx6rsI܇ yz&?4#-Il{s~LW~@wmH=Ës>Մ{D}'s}V WMv-UB>xq .ܖ,zW"rӾC-TV>?$ـvMb'Cρ=\{Ir`*ȓڎAq八Y1k6OUmț_`cDP ;Q3+ذVyYlrj~^]VewEцv ujepgө܉!ډ-(ZQYl{ݑA ̱n~]֓Sw;G6DB)%$ɩ-RRĩGeY(gN7ÏvW_21V:9\3c>wI+ch .֨̈4\[ BQ*٥(RB$gAA&9pT2e4Cab! lRMmX8K$ EmUr*ߙ+6D"),ITCtI wslK$S*"5ipD"D"H$R@$D"D"9iIřqgՏ聤:IZ S c82Nh_B^TJ O||<~8~?~hTrYd(.ڋÈPyx'] x}|is?&΀:ӹ( 0}5 i`KG>dmzW3Fo?8w崯vf'vQ ~~7sPxֱ z ?T4poGB&=%Ot'_Ri1rHV\i!f͚3`) '̃ON:`)l4`};7~j&?x#Йx&x.'et400L a!a1bԯ_h 8:*}1<Us ED8i4g%kz͡Az N4lyVK,ܳ[csqN˚zH"ޗN͚Yd\0sA7&00"6O`GVZҺU4 ,ܑN3.$d|JU DDb3H,pM${w%Cj~XEݹ86߬1lM_b.a< ަCtsV]FpUrB*!1M˅mۧxuE &mO |mrͣ߱;8HvX/TUzʣ:[c&t򃏙"|ժ]F#lDv]gm}1q:qUO"5jϬsIOHfܱ$aߙ\\nus2vGh;.vw析'%#疝tN@2{D}ECQRyՋ|lԃKVAKC=CWIKW|h5(Z'? "mD"iI8A.rc ͐?i |~Cfz*D7-P4*lŅ@B4'P؁tkN0\&"T\n 6tlEAQ]x< 21 /yI$ v# eQ#3U*H$%8l˒!H$r D"HH$D D"HH$D D"H$R@$D"D"H$R@$Drf ’3p8d92ض}T~+`f4M ۙyJA ò,V\I0W-*tRZ5222u:NmFnn.vO6xSnגdryZ5X1 C ph"ϟOJJJԪ@Mֽ;iF"m ][Bv;hӦakb(IHH@Ӥ2Mݻwɮ[5F䙐ݻYfѫW/ڶm+l߾'2}tB(*믿b:###CXx1'LFVk:7ڷ碋.-D6mƎe6ip8Rlp`&mWV_`ltdGzISnPRQZBUZQ}o*vH7NM-9gSa/E{4}v;M:Q?Ͳ>n('>HNM Hpƃﳵ{Q:CE#Ol2$A"rWW&( ؆&ݸn54u0Ќ\qyosѦ[Oƹ-iY?ղOn@ Ïo?,e`F"nZX5i+Dq΂E|q.kOB9nEٵޜ5#*bRbs) S# -ɳd§ihdFԹ$:<}8a((T=Dyl T[#\.\N#:Q: bՊPwγsOgb:YBqq<]6>OQ*m[1M$?i| 9pԡE61UԪӾc6QesSX2_V8'xc|* z⯸{q@ 0meL bݨL=D0)ٓjfOh4Ƭ`[(8LbxX9s;RoWGob)c-|R@$g&eD1 l+L6e࿦p16gOOmlev> 9}Y?҃4fTK+bWFT  I˓B TtAt 31!K&5yLwix66Π l ERz\Г-3ApԤ@fֶSuL,S/^_DV*1._lWd=˯n)T̍ 7cEh[X9N/Jgxqg䬶-IJi# H*Ԃ<<zȅQՃ1N>[E D(ިLjN&ۘ2yi{i&KIjnymhw+-zvkv 7?N6Id=lnbH9~abg=6&V(. v`wQ;)HM&oYfa( XRN0tIRmlK'`Z6Ɗ=7! c9g1k؈M[qxВpG 번D:V&QDլ\Z{ٰd6!(NV_] !ǻ%> NDh;+E4;M?s/i$H_fnn,IfP8L$$ۅ^]73kwlco+ZH.e f/].Ʈ*j ]se /z-#Zͺat${wEGIۛ^1CF߇F[X@֎>o3'b`UB:XPڊhKZ"M|4/}VpVO^ \^/NW 1^N/V~㕋`҈WyS"AʔD`ծqU)hR{"5BXğNbm<](-JZ߄DN^ӟ(': Ԕ ym=n⪥Q]U@ةNJ"R#9x8m J-NkJiu M4QDO؆/>(01qF41-NXV%jJI;: C68ȎWJ́OXۆM"frq >HɊBXj45JWESyqFl+4M,EbfIG Ua[u+XJTr]$c%d&½ ]Y|IJ,o%[!qNuEk;ƃCQ6bߊ &-]J82Hؗ=7 w u5?t`qkb/qo!5nb_$vrmpcE< \F)ُFB#’/$))jj8 =?#CHJJхdm؝:%~mǦUEd%%Ԑ[ BMH$U4)((8{RiǠL+|[B d/̲X7~?*vv=BsN~~Omĸߪ3 6@Qq"5n!(bgbd~척?BswyQk埌]9@Wö#w1u}#cZ"L" <8*Tp8!ɉ㵱Ռm(ئPQO6ٻ^nRMTi6(2IG>x{_c-΍z\t7wiDfpQ+X5K=gB/@2/As m R;TpRm8<[6l-T-*H0aə²Ľ4ɝ%;(AQ@Q-B/e@te|.䥰' SaԨ9~{FsMNrV2}i{XتM6a=/Ǫ\6o–ϸ}u W(@^1u$ђ!x8H`a3G?A@ZWsd0aNO ~#nlWSNJ&XaeD sZ\|$s]ܨ//F$kO %Sls'˶-[X1 je58)3[w5iBWT }bJ*[H%@$*{q]0)G߻=:vD[|'$ۨ}Mu /!ǓªL|e]+ F62[5l5'C#كt ._4(궿XˣCb2%%vNxKRPLJ H2;HrXC?70"opR&fAЍv;ix\p:TlKɉ˲p:GUln7eQ2M0MN(@UU4MԑXkb2gnۈwDrիW;wҳ !HNNf͚5\#F<0ضmiii޽ʖ.\.[lvWNFUٰw6nwwDRضM-:u*`P6Ҁ\fΜI͏0INNfҤIkYg4Bڵk9+8CU;~,-[WT-%!x,/۶Ytit:SW^yak !HLLwL29sTz*vСڵiG9+8 pz  һw*~9@N<::iRQJ AӜrDrR;Ϗ۶ BD#lH$D D"HH$D D"HH$D"D"H$ǃRD"Gi=) D"9.NF"kK$əBq+ȝ*R>$L´*qB#YJ"H,kkNH$CvK$D D"HN~9+D"9+)SDM#!ځ[J K$Yף'TH@4qSR:RA p9]Xá꾪QK7z<ض@8 afIA4QEQ1mp9TDr(]u۶M{Ir8 +G@֬YC-=z4ᡇo߾L8yS;54yуA< ͺv]vnƎK||?^zܚr88qnFx,o$Ú YIENDB`readpe-0.84/doc/manual/en_us/figures/runbat.png000066400000000000000000006547241455661113700215400ustar00rootroot00000000000000PNG  IHDR'V iCCPICC ProfileHWXS[R -)7Az;FHC E{AEEWDT\ Du`CM ͽ=sΙ;3 , U /a&&%3I@8' (oC[(7,ű28΁(&[  bbU!$,R%ƩRl-2 ,`8 {3X!3bE*Ħ?Ic1Y1,E"d?^ 5,lQ3Aaf ciFDBEGb/3DAq2v/`/bXK!ʊa[P ^~p gFc@! ".rAJ M[  5q O/lqgeԏ8:*џG "x!l؄g.-B7\!,xTE=W$9n .zƐC;5%n3=anP#Cy<1sd,RYq;gKl9vk`0SX֎㱙T2FGp˂qx6u_ctPA>wvxA3pG2l L[ktxːw]i\J2egk-':"aT@peh`LaN/B@$I`:zȁgy`1(`-*v aZp\xFx {0  !tDE qF<$ F$#"d)E#N 9A.!]=G Q 6jNDQo4Eh.Z.EWh5m@ϠW[h7&10=s|H,KÄ+êX37nlq:- p6/W^?{AF"X\ DB:aPFC8F8WT=HdMNpm&3s+ۈ.b/qD"i,HHO*&m!'"]'>ɺd[r9''rJrFrrr9rkv5](SL(XJ&e1rrV^^^_E~=;nŸ㮏>^K^^~KS_#KcF#M\\s,*Uǻg/x}-T\+Zk.v!m@m: /L:'uu<ݍtd1r9栞^Ho^ް~~~#AFVAC]pyu䌜26}061N0^fhD$ؤФ)4״,lY9j`a^i~pYl@2?zKeee*̪ȪDÉMl:z"f7lJۛv4vMv-UwZ::9 :;:8mu eK'WG|îYes{1dwI,Lݞz,j'^^=^Ͻͼ3{;W_8@? =.`0!pn BPhк;!B1OÄahxHFH!QITn&WN~m=/-3#f_X5LDqSk?$%ON8?Jf/)'yhMS:L-z{ɴ.Mל= GR) )R"Yլԭl_fKg#]}架>E{ ό/:3(s{懬ȬrNJq ?n3bAwkAapO7-)_uE_D=g:2[y6v9+=u޼z{߹Yu¥ .ڻ8k"E$,i^t_+V(Ylr|9oy [V|+\..-+*UFVX㸦j-q-uW^_wC̍%mR}͔͢aM[ "VOeV+~vʫv?3pgCqu.⮂]vn={J|t{֩v־5uh4q> ζy~㗝/7^q~c ל5ut6wM:y~7. yVĭqޙz.{^/?`CÒGJk=n=~=Obj|Sχg}!})j[跇#9##%9 `iiGQ޿$H Khq E3JlFS[|XI^4bGFj@jpddxݐ=NJ}b!3 \5X ~k$'DHbKGD pHYs%%IR$tIME + nN IDATxwdw9{^#؁f34p3YHve,- ?  `X%@myG3D3 C6uKw了U^~pU x~{|Uz!ŝn׾o6`@RU_nYS]i-HQ 6"2uT~؏k !@&`DHr]"OIw4=pG|_p{MK[N,@T}Grib#&W"-1_gL^Kq,Z!D0`i-'&/1`D0Fc~H]4[,11I,.Y?%[#_S~0ٜ犁$4T$H J%0 !I_qƋ]޼\5EVm2ƀu뜅 6RlCaz"XXX눬:l]Yԁ:9矕9@BcB@0"Hh:&仜lxD Ư &b +TX*_a[B<?GbNM8_& AmN9"~݊1:?7\v_w&< DJ^yk$&^Trk˯4ūWb6nJˀDPi>k2ߋ y@pѮd@[kN6 R7cP7h3. rEh}62K6<(馣;u^0k̤GŪbiD.-$=S4 5NǾJ3אf-[y;6#M[ΎZœoyiHjfUDcV]]Jr'S2v c5R|M^ z ;Tb-J6.ZU%e%odLJ&K}8f㞸K&s?BAP(zK`EL*0M 6mslm| 3HsK1LT:?n N-Z(4$$AKaTʤz^!󻖛?eEkckRfw .wA y|g`)7ŃGیuI:X3([bs4ж+ƛ03~ŠIbK;/y2fɑHcqKb"9`Ԣ`Xb)='µIE `akݸ8FUc-(Qqare4[sr͈Hux+XT3)bedzrf8 RGPgb\̼&1F뮭likK[À2"UBĿe. IHJlՏ׳ *^qi3PyptJ/'5֒B<;u@۵U+ӱ*o]l}Y4'=zOV .IgtKSRI%8,iN:sYˬ=I@Q>oT*x̄X<[,q (撨業׵f?YvsNjkVQ+d<13 "ޅ7Kc?1M% tyz`6 5B1ކlqTb#! && 0>)3q('Qs(dq)@\ D܌1Dx#8'5W4*uZ5HUqKKE#P8Q&͹g Qeᶉ3rڵv JHiW,ڣ[.&:p1& k?N9p%EkfxE7xإtH%.=wLZ+AIӤk2e]b;\7@`|SzZX3g.-j.oÄ (}H kK*3`rvnܤ:Hug&ԫA(6ʦκRF׭bQ0+k9aBZkp.7v$q ,E(9--*g.-مE7FqYVuMU|.Yq4-0RPRIGγm[Ȇ-UƆTb`@t*J*iH2`I%AM.4 JQ7:ңct,d<>{K[uK\e**[I%$L8#_oB5uU"cc]uMO ϕ#\RI%TJ*i@'؆qhRQQ!:5(SUnV7z巉V[%' cƢV-"`Bn*%wj(YRI \dI%TRIw$[ɀJeM*I='MKJM)Catg rg%сx͎hm%fG?)y,`"ln\bj*h"gov Ařg-iec1-K*iEkJ*'*JÀȰaj,2fR`rFze2LYiK._SpUĖq̴#g%Md> |y\ʄbMU yK72k7HN+lJZCB a$h匓(\J)ʤj5nʨTRIǒJ*0%m+U60̍ŀF" NjsVjTI #aiùkaaYƕ} )6r ۦDpUx`L,We/CEXSajaN6,,XoâZm[[]JJ*Df%: N5W:Ljs2S o'J'F/KWJcxrp8QX,.A=ӸLe|ZPJTK'JOp9`@erɳ"D%߰\}{G::Q9ՠםTΡEDmt]&'ߝ%qWuYU]Nw;9&ܶ]%?%R࠼+/b nWsD;Sf§M4W-ѵQRIw[K*i%V;34甍B$uހ 8?k T`gH%>40\:6NQ"G$~V5B5P"%~8@޸F01jq7'{G:һ!v#8\*OSJ\W}gr>+JWj~K6.-(G,_&"`XƂCTU\{*M%TΏtTRI%ݍ}bިC݂MYT0KTז`aȃр =qΗM؞|eٳDfQubY?WF?,rmܼ+3,-Z/eK CH9\FMѾû2$嘻>Hŗ@Ȕt`#C ?  }w1+?;:7Xߢ<ѬZW`d 5ǹKu"c`Tx0zCڬe*lPex(Zk ް}ʼn-+|zRs梱æUP\iP+BM!.YjOSTNvI%Tޅb HiD@"hX\ΩсAuZPk֯stв71fIYs]pKƿ ~:7w%?wcs;?E5^+w#{VH`ׂ\:)3OPo0Շ3wC'U"l7Lo23y]gM1+Po^_#<=}[F6,~ȡݣl8ć.px8;D4~rK*BaKE۬o-.5EAd"ۍa˿:G"Ǿy oШ Ԯr}aUEcP%@*,Ap]fMс4 w -LV./aj`ݷ_C.^ S3d^ n׼5qMiF0]B9{/P SU?=ϫϭgTрF1oƆ7̦ff f1g2;oSݛÏ;{yt|yjO3`oߠ:K*R*cxmcӸsYvbrIJ(k_-s\lJ ڝB<PLR|"(O/<Oÿ,/W0˻Iv~ bKTҭheaI&=AiC  D;2 ssPϝbզmgֱXsF_t|gWp Oà/c6̛qO?Wwg98[7Tٛ7yRP\enodiITk>]GYBÃƱ"08=Qa!6>DH%TRI4\/-T>մ-myqJĹ Q03,BC%n}ӎQ㟡>a\.>SFX,\wWYlwS:U*=Ǣ4k$viUZ 3c@y4?2| .1s={-*ST'w<37ÿdZ3 $?yI_s`>Q;lą+u>-U60:6*#m.`.1a{FTp-Cܷe@WO1\5>JR\|[ka1;mSUFG&nR ӈ/J 3u>#9poOb!caɦm7"lZ_az"̅%"WnJ*P9%1UԅhU@|@VA 9ЛƏ ";_/SĶ"5^!~ZL>7Mq IDAT}n޷QH,C7a3||Qx\jNQcQRIzIΊ/h>0{@]^`_<ܸzrΙq-cRh2:2\uP[ #!'Oshed][G#wb8w8{ucL+MT[435<23O &0&ي b8k0nYNs(oa|_c0U9d 6w{G  eT?|mc8fb1 D|,ǩoZ$r+鞠sI%T]c݌jND(N JxQ;[!z#ub26:pV L%:KޝZ}a3w*(}(w)wJC՟|ı#T+>;#TBKXʍ11d%ԳTK#y T,Q/uC5s5EbP'^ 1!Tx#8aY9CI1)~)~qf-p#'A#Eӂn@O\leU 2H;R!x0Rjm?*j'HT$P~k ?9{zr("8,6Sw Jl@GD9o1pʦua 8I S>Ӌ  XOrF ⣳K9}a '05̑1NZXXlY_# W U[Z3KQeY$>\O򵈝+E\s|x/CY8yy;7U8kWYCDR;wy¹OQǰ@[9%AlKvW8p_?<4b`Ep . H04c\Z@ Ηt3_IfPAp8ǰ?oxelďK灯~yϾY5\ H_b-Bo]V%5[{kΑQ1f^1w؉};?gqj C𓌌O lF<7Sc pJ+@a{ e1R ]iyywfm뫬?rK8#H(TDw ?|kgg05 'G5?ʗ Ok\>>D 9sղP:k[COKJtJ?#?>ޙ:'!o`kOM!~mҤZRI%TRIw4D7BCSs yt֊8?`QgIeFk"=Aՠ"]maegoYf?̝E! %md̯|ؔqn`.nɻX_s4 Uɺŗ9J}뫶>-/hfY-3o3^waZm8v'T h-,AJU,݊GTt_kˎt +Fm7j;&^'ׂ{hk+Ybh"~Z`aqXڌ0:T扐_l3'<ʑeG(WR:<6sBkx5VvƊ;g*zH mVYCMWѡMy,&ܜ~tVڔ༤J* 4h4Q/s6F$r Du *A `Ӡ^,0yU2X:+hwK b%6M+(@"gQPh8 U?I8699&L&f`ɋ9 qQ^m biR@8F.XMKk.*Fjbr*FLym+y<5+B}$ˑmѨ@rki(\_xb˳QV?+J*ΧX9߸|% SZ'ns"C\Puĩ‹]c~aD09\5g95hx7.v4O'1PW99luuǿ.pi;I|\1pu{-SY;4ĪO,XbLk'Բ"hNimqZ\PڹT\e 3iku4=מ 5- -e*C2"(NǥMpqPmh,]K*i\*J{l 2Uh /Yj8.ݰ\{O`l7l[W]rzՅ8Iػfpj U ᓫ.ľ,^ニw8lp:}s%I$YsSsWt A4gcF n^xtݖXeYs]&DzA SA1K)CC:}>J^RI%TRI%,:]l Uh[t\1^.Kwv_0HgR|YYvtN5lM7m[ŽyfJj)S vmI7/ձ!ﺔ0E1؝ ձ% 6{Q=vv\{9y~K~w-K>շ+Dxڠ}[Y =Azhr.keuMУ146HN["D wa^K.%k9Іk쇷tХM*1!2X"'Iͪ}eE2ye!oڊY>'ņ GKRi $CmvJs^@KI84 voBޒbB|]}ET&lRk M](;"*jCV!!ꋉX6B:źJ rUZ+d趺3o_IxJW3~w%^rtZGt9V}(QFtκ井G"٥}~b~KE%m&Xf.7[_j]Xx9_XQK 1JM+1yNWLș@/*Qnvo -AzI Н ?9.ZPj[IXݑR"M׎[XmN|~iaY[$w_t(iA>J{0b><)Ȫx/uN"2jG+`8B#].on{+@O(kF"t1Mb6#yǀf2vpu@]RP$ަ#uyӹtި=-bVг4jEAGuzK[RoOxW8 ΥÆny2+5?EH9 u|B貨o;j_}mcEb_9# ¥w!ɑ-#!p0}RWbBo1B q֮lzqybВ>waeRFmWZ[uK*m6w~y+W\͂VBG\nk& v mڻI<SZIG}6[Eǣ:z|۩ ێq xYփn}ei,Nnikަ^۠+سx˂~ym w) mI=IۉO_yԛo-HAWxf$p ss\C_{9 {΂^ g]6˷E.r ߑ}Y%TRI%TRI%TҝL֢gb?!m^x?ߛÕTRI%tR}96T_Rmah qW/q~O+*C>#ol_~孳J,0KjAIl9vn`'`@ J'ų|<賌MToE(|EQ^A.ӿF`$g?`ێ|IƧbrzCjN&W/Om۹"o]{'gt{<3iÉWJmq.UG^1wO}6[of,.k/mGY'nB[0?ǣO|>Oa\}+vC %+|Z\wٙssg`$kaq(`.> _:06QexJ` ]V8}w,pN}U!'i{Ns^ox81Yʭq{%ݦZ>sF} ~sD Lu)4"8xl@BYOD6_a4:(ޚ] {N]J1;Mh psA?,c c|t Zk ,j}㌪N4a wJ0&-7_'}E j:w@DpΥNӒNֱc> e(& v &ٕK~2M:hDH[9h ͍ZkǿVǤ'bd΍Վʸ׸z_',чoQqDQĉW<:"ZmZ}Nu9/Vx`~裟#T8/bێLN( EFN WGxٲ~mܙq68ГjcGظa{xo\G" ~lƣPx'_-n`Qʈ0*8kٶs7/~gu _y*!|:vO^s}3WY-s~?v]9Ϩ-.061ők/T[`zF"GوO>~0pC8#,ϱw^-.019Opⵟ1?vǩNlݺx_Ya3/222{#<ԺCGٲe' Dw!j'^)ZvA i-/J'~}0>>/~<ůѩ<ܯƫ/翂//y瘹rN@İn\ zu7tڵXÙV\Fz>Ū󵹌t+We _MҵM2K޶M*]K=\{ىiwѤKl]G =lЬP9ipmAVFoY +-s׋r4}+3I:5=4?ƅp׮-ksѠ2R:dڊ'6@.;_O{P4X~1ji( @Eb{M;H{TW(G$ X3W.p|!" YqUehxPj\z sg6j/|oks>ɯNů.2G=æAi:O<n\{15??B&&{9s7h?0}o?{[LNUOxSmʩO`)U=Sٻr_1sy=7oųLNǘ0|1'^7`m>z7~P% +<^{|Q&&rŅ96m{}޸'ߌ!9QT_9W\ctl(q] "n\S8Q~տ? sqc{O}qo"?y[<سOLsuAسN.z<ʶ{>ѡW>ĥ gj.yo4|IQU~_ #; //}?{XAzm%@wՅ@\bhR}^{Ym|7W1<q >9ubxߊN_;{o!`#ǃ>Ə<aXa|b:Vh<A#,9N3';/dVm#?߭pUu~Uy1@ټe;oƩRqN9ɇ4uDQ{N5#M}ރa%]hnч魯} soʦ;Vn\ j T*C8ع(/ IDATiE}sM/8K*Nn-u@mF}amԹ1؋'mڋqT㲛ÛZ`=toDl'vcZޡ):M]=S9O⛥9V`uMؑ&#g,*@{,k^\t]wf@%Tf.q/8Û?;EL^qk!>xUz/z3 yW8t*)]`c#}!>gpǹt3:?$7yK2m޲yΟG'ٵ@)1&&س09ŏgb.[/^CGgtlK13syYF[wx-;;s'?*J;wVzXqn0~wޏ*L g[zXUڈ3Wxٯ'*ْJ*޽l!;S[\diqg#b>gO>3[2n'*wEA7@sfx=\m8_RG* װfz|}քaoG(a!0Ȁu^7X-#O* À/|8r)*0MPT8x1^79x1?e^wڈG˗_da~ɩu3>66 0p꥔LJa>‹D QԠZQ^Hbü?{#JWRI%tе+*`D/T B[Ow{+eki&~47oEZ: 2H xs'kbDZ+ 9'@;TԂ}*>b]'[K%ѠU r{\Eضx= tCoe"R?F)re%^{=puX\̫$pƭBܩݖw=geyz;zI'&q+\i/I$q-3n5l6w˰%IJ|*3Y Ք O;˖О7Zv:{&\,/u^E[6ļ>v^5|<=l%7>][0dj(;gx}}?a ftXjN?1m?y7[` 'D|4Q]v&E{.@& g>%DЊk~k/Ξ&dM[SpYxYcf.rOg|ˮmW,/ww]fε7ӵ_Q Kۍ\xCmvzA\tmJZݲXLT O]"+癙*X_ى 1=YuSJQ3ew#*HꙜ؉˅b8SOD4W'+n{oA6mQY3Ni]d2sڬn>r-M(OnTuܿP )TlV5K:Jˁ֚ymӗa(ܥnCZ-v7c#0N-N] mwjY,3YLs%r' De1g'n?E t^$m>A[F|DEw+SX_EetrmK_]BƷ/gy,WI۵W/e)Ѳ =Kp%2kZ-KdiOp(X{,mL-RJvk(Io_F M@ί 3[V++5*][&pmw:,T-m%u[#Pm]@ӭ-1 HEFuGWi n y-/j^ Oxk$=qɝB]gUIhJweδMtȪ~AmpDaj 7x=.>3}ڋ1%̟;|ҢnJOrvϐB\[#+NĤۚZ&fG@m{֪]ʸx1.S_RCô1bl/9:tna>YX6,3eK*J*RVuWwWvι}& sđy`[eVWY, i<|7ɬs֮"4U8%/DzUi%]jpIC/eHhx鼹8Wu윿й;8q ¬e(Y00=e5x":ŞuX;ǒX3, ԃ]Af~t_.:;5TkXBkbGpt;jʉW$:[K !GA@>0,ʁUV+RWҀd>OVJ#:I# W;A\y27h19eOeY =8S'P|zxUӂ)4HJ3 iR{vks+]]Q5N?v<=:yۧ.ܺ]B~{ԸD'2GG(,aCt#v^o .0;>#L&s@..M?"@:d2}}^qҦ}."7@B)Tw/?cBׯ%=Ҵ8@ԐMneg: %V:5[Ѧ`#!E=c(dJ"bfF 90R} Iimmk[ֶ:@_jW}GլQTH]V< JtE*耞1Ңi0`e$oiV3 IyDdY۷y{ܺ},@Å ntltW9Ǡr5n޼>Y!rO ] #?~o'Vܺ#rW߸\uHaF"<<6ql߿mmk[v'O_#Ơeoww HC^:r)#y$e-FQX)ސ|~s|5ExSW?Lm`gX6$h)pP1?D oVtR[릀NӍKc{ŔcZV]w7_kW].^pxxo6W._>5Z6= .\JJz+W_}*?z=#|Ә@_k\zC|$Irn&ݍxzZW~ݎ^[_X_W[x|}n?׶mmk{ߘNHEgJ9(\b* YZK&}Ԉ8Z{.|1B,ԝW&oeJ}"31"`$kQctR TY0w 5C22d1*<i-w[a|)is;̙3m> `0&p n߾3<Ù3gi^r8NxG4M9<<-W^~7n?Mө8f9Jna?ؼ[71~gp>?GR*/>j4yjӘ3{f/|_zcdf dc[DPHH(QpoS/g66اi_gt>=+7MTN;t5qmzfIIKf"{/ x5M 4Q{HG\j}3*91 /GQT>^%*`!NʽJWriȀ.$\d\2^H~gQ^e҉SZAM 8JS`.~W3!@%(kpԵD1wUT] ȯ$p st W`:Hx!=_Be<=},}6`ek{^>9{9*~+tS]}ʗ[dYʠ?H3;ò8I͛WxcV8t#U% ~sۜb;isbt 7~W|N]ex9dD /o~u-zn;mqއݶ|7>Kg_xèe(2<&ocbsqOZZӹH1bpxk!qcwS؄EjyW~3ͣAwOշSw΂X;~gss6v } 'wf!5!5Bu;sxRƏ6`_=w]v dTU@|:cK->y:T3urZ%ЩW )ZPkIc8xh_D\V^SƅutVoc{ |ӖHqA=գװK%XF3Wk"%#SM,u&ªE5W^7ʸiʎnˆ6HX?7YZyI5<;LmElq 1bZBw\D0ecȨ_Q<2ѫ~HG S_Hf_'u;w4M HO<Iӑz֭[<᧱.Y-Q~7*F n^`0?#.^`{{ͭ-^{Kxƭ͍ ]z|`fZVE0j;_iu$>f+NZ x._;;|#?)dw8K=\?d1__݅ ;]}K{~g$~@GM_g{ `o!dxs/]sQFDق gNw) 8fB!uWH3Gfl(Y{(=[󌜧ˏiP7/(K5iM2m^e&QA"qMTگMKxkM0Dk(ԅ PQ6hJ0bFyΆŧFm5@:竺(@oǢK48넣U뜂rtJ+N]$3ݬN81\1ڍ5xcu{2EWQ[eұ8k%R 劔u[d80u5]jғE0%[;H)UG 2ZwMU&C*~cÏ͝<  "Z_Wume IDATcI"E|ufT+nZ$x\$㮬RT:3-2޽.I~Gc?N766xW96w9xA{A o\{Wax=đ7WãD[Hzs=C@ԁhp@wQaN+i):7:ҽ\E|ӏ~[g0"h~~H Nؒ߾ ;mNKH|eupf3: ӵjֶmm`b/zUQI1X XjDHm69T'ݕfx!,%lJ:$U9fo'#>5-VWG("KL= 7hLx d|Y\b>NcC)-:tU3D0IzK4˟P[>)i{jLfDOܾu;쓦9Q#>/_&wb!"޸gN,7u oC$YJ:Hɲt(ݘ9W\Z<Y6$ w2r^.ʯwp҈t ܾC1Ɛ6IFgq:~c[=}iA0rv"ZIY9\_G~s֗D k~:"&ZV/KiγϞ3y>?@og8.wg~f ׶mmk; Х;L ^ؠa0QZjmShE f2)0z_<[w'e Y2qs2YݐO"S)!TΎknB ejo=1!s2qDxyWIQpNTu#Zt\S2u8 Mi^RZ1;nE"uK)wHdiq裏rYD4MvZvy;QNիWDzs(֭dY:;t:݅|k [[S~=:.VQ˗L6Hؽ3?doEϜ[@LƹMK@&a6o1&үirpH>ZoB7ҿhE!=Z+$)`v&=xl&q5M@1Q?,߂?$ओ58AZIqUCGݵ$m))@Vxf2SeS֧+N08@7P 99.w"PSEs CF˚u1\}S_iK_d%SI@zN>"JvX@X,Pu(IG<C/'kE)=mnY IO?$=<҅_tΟ.ZOP^Fހ>DȢU;9dSQ+_bS>s>ϭ+GW^S<㡇bgCa|| 1>BzIW + B-"'~g7xZmmk[f2RRD?Z)%az *chYx2vxC9$w%A*zpfN*Tye'm֓ sUJD&sr lLHe5M7!&8$L1ryE Bv+˔GK nC=;%'Roc2ȸ"Omb>)+GkqM[Hw ^<Ӵ-Dۻ r7V.{A3qchE1H$IB7΃1g#9sv>Yz;xSvGQky [O DوV}W8y?OGtڎ/^̇.9>8O˜ߊyscNɔuhxQtoznpAMjU0)NBP/~P%?=IEB O< q}A:#?/k[ߢ|p'ݽ;׶~T 6u"HBHݭG.C] 1#@S܋,9uEFߥm +#aG82>*C}3 X՛L%u{(i6{Adwp"ToSqin[ː ]CMv/^5Bb(H"`Ekk"#N2OܓzEՀA*C6tPH˱ֱ x~h<ԡcxfQF%KÇHNJ~U'dRum</2O<$nM{U,@B@~3ko:f5;S9<J{C5C aEn߼=!NgʩԸMmpM=< n}K|0k?FIsČMۨUnHo힃AɃ\sˍ78}+{}X7>:14=G8qW{%Urx-S9߄>|uO/iqFrO>ߑ # #(eX\FW Yh̺ O]UH{VG>oҴGK&]j/VOڴRL7h\71W<1u}HhU4ҪU^;q7=PZi 58q?)c5" =ip2fq5љۅ1ÅFV\AŌRaHV6ǍWT\AS: @DK8221Cp1Lf1Lɘ}]u0jbHbC;XHbl$Dcb#Jd!,"aU A?u{{='/X :*I,Pz GqP&Rѝމʘmu3zaw64mWp>87 */ 3D:VBIZ-PewoW_O< 1+WΣSU۷'?/q-RL].\8ϋnKOUQ.]#<1/ ׯ]/0ib7)I2eޣSN ׹gRs8^㻞 7}5>V;ye~`sq CޟzWȿ*l;cdY̫WnuQ~pX[}6/|u3kN>{Ik(X3*C cx~g e nF5Dϳa❒/1g*YY+;бKәUf8&?NV\䕨q2@8.?N&syY>we!Ḉvεb09ؖLyTK8}ӛ6:g5fdͥLЍ)G6j 5BsS5xزNs$*ӆSd#G7D'Ɵdn1ieݠ 9IlĴcC+Qډ6B+DV32Bl$! x3~ϲۅm=9ΐ:!ͅAqy 9t8 ˻ sT`~=1#G4K~$Z-?w~( y/vK/qܼyȎ ;n,;{,Xz=ڭv=5四\p( }pzҥloEj '&Å7^y{7?x<}4W~`&j^YUw.󅗅G9s$w_,W"kc(K(FNfiFwo W9p#G0?w9Y`l}3Ogs^ 5y!m;黓ls=>c^6]sl$WvX]vRN8ZKdp@%.˨& eA_xm*lX#WVтlfwr]P Nx˛+Cd*o 37yxWt(ͽږQQj[K7VZmDJvN[hViACdXR+VƉA+Ix^ž k/~OY^xܼy?t$xz;x1Ȟ5zu˰Y)o?g.?o=۽J[>Uw3xq䩿ije I"dZrts"W`-s{`(6}n^#6Ϗ~4#.ep˿2Z>Cv9*_xM|)!mmk[ֶrrEَ֩SO͋*%r0-5MH?6]ٽEvK5Jĸ"bͿ!BRZ<zyW[)+F|d|YЉ aFF~ iH>SLF+?$3EB=dpbOBxb뉍ҲNٲt;$`;ūu1-kmGvTA߳98hEB?Ueo>˾>>hJ|w2'Eo^0P՝9s=4/IHX;n߾ ˴4Mu_੧\Yq9'p^{Fw(*^??Eu<͛yoŋֹ.>.8O[&>x;22{yy3p>lA_~?!#Zq ] m?QZm NHspGp*!= ?ݓE:mmk[}ei*n!!ڇ@UCRx3EAG\"L_TDb*"baa%vKbCZՎA.'SpNpN} ܇P{w!Y jP-l$\cCXݵt۶H8iWnyz,#B 6DQ/滨R*  h? DzCR=KQn UGn4c`UD#,p8(:6BYڱ#haGD!& x9,8B/= İ!dΆ^O{ۭA}h0,͐DwbNU.)8HY~?2tBcbl*  eU|,x/rpp@ ){1xK|StXpg?K/}|8Nhۅyp"P8{{:y>яy}~) B!Yv%u}ܳw#D]p׈{/~޳g?Q.\b4]|3N08E4dӟaُl|wޠ+^S܃W!:.|z2Fk[ֶ-eTgŐjt^R͘'">o /4MI$6ŊUAeEVC%SuC C}r,Ўaei QAgC L iU>WKW!6)DF$0KY#mxDhMakӲe؈ 0.\q{_c@AZl% "]ƚq-]#Iף6z%7#N,NH =¹#ՀޫG].N l1D&8?:- b뉌 /quX h1D mlt:JGVa}C+ V4h2tȄ5*-AjLbcz)HO (aDyUuݝM IOHZ>lorz]zaκ4Kq9>㩧$#U.>ι+\v <|֞Z6/]'.<8^S? #SOl>JC /|pGkk;oļ~ ҥiPRquhݏtFZ&xccSa:Vw ?n̬O*޲:i?[sӿ&m]mmGX㋠@N(h`_"^"HIwѩ|(sDS+b#(Uڱ@'t[Jl,fp^OrrG&Dr*y|ZcH"~H8"<6ĉa ݮ݁( 8 `EH"K;NF9mO< ^ޝB[bdhJgdHfAJ@~^ꔫ/ Iphh~L,,A} +vBZacV)rB$bҶ[Ћ1wNEwc#89vW'$3KxM+c-<(?>(lmoI5F'ݮGO0JyAUbDUG?xGI* IDAT'wS|~L1C{~ٟ n aLB,>kF _jEIq#u>AY#zeU0[ޏ-M~n˜c5Iv\^-#s^kzYlۣ;? xTdT}HS˴ex~Nb:4'υ4O!.rv C"^P .ȶ5bKҎ;_2 2!s<+f# vD- Q ^)IN g+Z` X"0aZVJ8&DMYE:C%lt-[1B?˄STrT[F^H/@[!JHɒ^Hk $~q9 G:_D]D/2uXP[yHѦF(M8(ѩ8.5V 6tacI!zڱ6E?Jl"ŕmz{ՆB<췽8A2"6!w7#Оq|./B(]upeca{k͍BPpca_'sX0Ki%[g8stBe (,E}>_bp B;:ہ2v[||-FđxV%|6iyGY&H, ݎ_cթqVBҺǛG+zHFU=:nh*-v 5H$2ۑP:5~ݪ螔jX'ȶT4:B$_5pѱ?ٹ|+\ ބ4uX3TfVgҁSͦ}LNkUP9?=epmYb׎p#SIYŴIɟ<ޜc]=̵32ޱrI$Vm,bÓȳiތpޒ" =J=i4ZCr,) Qd 66$IEt5Dd> 3xCGɽAU.\kl86:N;ӆ$(IcղtB't[n:Ȕqq$60Q𦈮zb%lt V~JQ"KzbZ֩؝ͤXGeelJfj4m^.k@i6Bփ1+DHfDc).H3)jj=Hb]cmpA_\8O,V_M5jpYΣRB+1;,"!uǂO[dX]<PY f.esq{*HݽxzuN^Eu_Q|YN1lW.Vi0y. ߇E6zqS9MEsVVT!.Vl3]>!s#f/CBcaCd8tƶސ1I \dBx 3-@t[iFǰ:]--D6Ԓr:K >iϥ=6tcf;fk# ґuډ+m+tZ!٢ '$ ɽƇEЊ-8g 8ZyH79B_I(U9iǼCȹ^+5EXY >D5Fp5!9%wZG$ӉX6vːI@n!C\IkDܐ3 Jb:)ӝ'~o(8^rB ½Q yPHzOKlnmYֶmm:DY0?w QdS"l%PH6Of8iQ[#+ ƃQUr"tZB#t1V+"i NKN}26Eܻ"mH$.k!=5viGJ'6tCeh'ƕ{Wcl C-w$x"LcQopr9A_: bT硆^=NP-Q!At)!]Jptx(狟E*{Q;.+22>lBd^d$JL(j9+@gC y)hOS2@Xmh[:-!I|  QA&W-{`/@z !" DԠ"BDd Q ΕH!qق߇ycBB-[B pM@B&R)p&1$,cgmk[ֶmmk`A)MicdE -{ 3!< TX icc Q\@*1/R0pDЎ(1X N+D<رv zabȳKޓDJ'MilDx6J;N6J"Bd(VB:n tgDqc%DlP0{< 'wBDH m+.Jwɜ'EEqjD9_j HbKPDVɫ~v^q)+h8mbﻱd} ? 3YfUG)MÀ[tOcͫMa|#j)^^iAհnܫ/T#Xqt鮜w2E¥.8s>*I˪(d,v*]nnOz[i o"6y2"֚sVa^NziEⱦ"HsU-ձ6#]U3K4-ӗ%69m}Jq flƘL1&ЈKVQd CDِ,&B-eQD]F'c#wQF+ W8./Bt,B I$$q5&vbi'] ` )/ <[Jl0GZƍl^cB`< vτz:HӜLQ]".1M_+%1Pnp$۱tZ$0w .VTRC ؉!N I,$;̶ Gƚ"z> t}:p p0UqypP'4/)NȜ8r̕yUq"^|0,XTW|8eʤ+:9qB<;ka=y_{ہɊ\mϼ-V2mmkg2DZb VD4+5g" p1.KFR1D)8 _9ThI [O! aj)j`IPGBxAISO;\dxQO$ [QDZm :1.\.\FXАMy:SH R- H@fk;lq{fO CþzLɲFnTm`^LBJMMVꍄCD$ҊfF8%N+~7=.,v#mm*0%`^f5އ:3g5Zd[ @^*-Wǻ-|,(pMNY \B}wH|^FjU4E>KMw5۰m:%sBC?z޾c g z'!"$qF}u]:fB]uDnZ- t@ldH( ֖}t Dq`)p:ZF ;LI.!E*8"c"D#0\!p,9l cs ꢈ0x4E E6EVG^t]7C.ƹg)ǤzCukn?{O=8qdOmmk[vWM&77S{ʖGB'iI-&ioGL|Gt͐\ݣ0u<UD2thU9e43cOu|q?6bPXaZtt[)ATN>ȣCJf=Iؾ ́Ce%:y0C2X|H=͈DևLlt#1$&G{HXբpgu̐ ĖdkP5TB}}F0`,r!T޾e@*#M=YY J(|Ôbk[)5ĭm7J?Eo9tFqDChIUI:NtD': kA#sQzB++ww;WY_6XVGaiOkꫩ:\VR5<,vU׷[D}6_4B.ȆOҖ!RL8fU/MNnqCޒPW8v4,/Q1xq^/,d\% y9NZRAYR|{8t{Mx}PNxI@9Dt)%P5M"JLo+) "wqRkPQTST]󈊡 j5p乧ѐ$PBf;*(g6 zwwJW5(k)JEF/J[śͣSWDJFt (6V~-I*/->"_bmБsx əR\LIs6AOjɼ5BWQ!]T7Ԋ䀴\;MA|)j/f|) +vD':щNr!:Eo%0nah]Bb尶/g:PT®q\V{*ٚUU} pIN,uWg}c=׬擗[7*^oi)x9- jEwDZI3-J)0&A J{/Ga!ILPTHMN t6(J? ʸ=C^-(-#VbQcAk!1*;--lW/e~؂cZ#׽jR2KQL2h @5*lŐ;MAZ]VgYa=FFhШXJHTӪ-D@+7@VXyG&.HLBbxkR HT7.!D[$z;%(':%g=RA@GC'I(r~l5^`+奐0Juw]4 탘#$Hԑwqlu{O^}k/^υעT._y|`E&tJ΢D':щN\AfIMswa=m YGcFF V`\8m0Rba랭xnsxpd_s^[GVx#"d֑w?FoOWgЉNtD'^uA@*iǥwBÆSX_ ֳ}gdyv?< -Gڴ#Lj/*x`RD:`.*Sǒxς2сa-C݅$t_ArƂ耹g{Q (BbD'MP5QM`Eb2EG"mL\7D!"@+x8ɵJ .=&I@rhUs*A Qe rVŨEbzW㗪l7%˺uTocsr ˿9j4< -"m>-سB^?| iuϲz *=5{(J%2?<'gKwWEopL:E]ľ{؟zgmg9^v>-آD':щ7xDX!WQsXh_j5-9kkjy6xf3ܷ>6m |-0eh]iegnzkOS9KD~Pm|RͯWv} rao(+$ЬC5R1bY9yF_Sodd *$EWJN@u 4}5e 4,,juγrVO* ]"Q V `e'G B=3C#'[M)N g}ͱf cm-cm=|_Ws=} )PˠV0PVYM4r,q6C|bQbc"!asuH7s$w8eF=>Pg` ?/op8k }&IY;Y^X/Vs\kY:5 |M}9kj0PfZi؄F^%Z]1PS3-e^jMuVX.cQL IDAT]_K3d2pkjvA_!~iFboݜhItPOHPIcH!I Z \g4Z -] eÖ ėwi/ҿڤ^Zn-ox'>AҹK)#9X3H:s@W,/Ӽ.fs.[ qڽT?B I;3?)>6SeW~vH`3yd&MĢE6pVgvbL2իWw]*+^;s?#|߂ ꪫXr%{l?F9Ǎ7exiӦsoXk馛Ypޟ;Z;̤Ix'6Lx5|k_V뮻r;݂ e]6mZ9w/BvuWv}W;щNt 'm(4^ӟ~}q_YXK._3kᅾXW_G-Q:8XBl;mj@OGrES#>?p46&v}9pxhlմ2^Wn 6-R=Iwm"X9JԄh-xhD-Yr6,x$H.uB*T+mD`>zh F u!Цu4J˯ӡN9h2Q)Z0JGz{{ozJ>PZ Y@7^ګ^>.(E xBj"_w֮]K___yz{{޳b jr|VZũʟgDڋ;３#F3{l~1b>q 7pꩧrwn xY#Fiy^^.bAWrԱ?:D<5׿>1pޚ.6w;?Ljq;}@[r_fc裏K/--o#9s;w.J)$AkMWW]wp7p_xG1bg~ŋ7n'x"/Wۏo}[?SLO{ gu?<_gڴiy̟?.4e=3Dk>1c:,~1cƔUl=h'x"zsr駳>.-oy vw_җ裏}6lSO=7ߌ1:Kr͙gI\p/'}{oG>~_0sLΝsO>#8. 5-bҥ,Xkko\yzx㍌7c1coG}4x s+WdvSN緿-\r 7|3/8#'ΏK/'`Z֜r)x\x\wuhR+Vpgsiq{^wpgrJvqG>s)l2zzz8q"gu\r ;3/W'|2SN%I_wߝs=jg>q'?I__x =PۜddY}m}o/[lAѠ<dgqkxc=iI'G5\!›&N?t=PfϞ̓>s=>ܹs;w.sg;щNDn<އ}5Zt}oz,nvuš{e" -;:aqʛNs\hEmmn<_>BC먗CUU ˶+VO^\Z[-pl&X+E.͢XwD VKК/j(^E&PsΓ喼0c: @NSXB|PO./%tT+' в\џ)j8J"hk]yQ.6/[uP1 V\Mez_ª[mO{* 'N ? f͚vZ: =Xqiя~>'cﾛ. 5_=#Gn _WqZFٶZkp TUnfRq,ZN8~O}Sm;o<:z+J)z)Rrgp1ǰV[1uT|I?|$K.\Z3}|#x97sc֯_s=I'.¨Q8#9sYgiӦ}ݼV\r%<?O+ I>ͽg;@Dj`w5_җc֬Yi1o~s1\AH)ՙ=|{+GCxGYw+[:xTҔn~wڙCjzj5'W=Տ^&ێ}h֖r˲[(7\6qs/ǿ0rd+ރ>}ХZzt/9H/VTV*|n|jbg U@%)y+r 5(0-B8*V!.,m "g\+Hց&cctu&#D(YȜn(WA \ KX Vw*ap\+<S&>c%ő[PE+N!h䞚\Cm6P Z*/<MAAkHш$= E\KH|R+)He0FwO9jRFO{H$$ (-'s/" 9#daᥪi:A#"~ \0yTMߝF= R"+3f,o=x~y}3rZE⢞~ܶdU[UyHӔA7xBnwQa٪PC$8P:j+̜9c2{lf͚ť^G_Sr'?q'pϧRco%Mr{?>̝;SO=I&1{-\'Dj<[A]k|;/ӟ4?O6zN,XKr!p1ǐ$ {&L`Μ9L:O}S~ms~y=J)b fϞs]vمo~|Gᢋ.#Gϳ{ͯ$IH [SkzpB9W~ĉވGqӧOgɒ%#G$ecbz xKrƱKWE] *8`mTuV-kWS x^$_aRML*iRV'CefkZIPֆW SxLPxRc .#^&nEy0JHODg1TCuxEn5I E [pc`msj h15g ua 2$*Z{0 ky.dΗ.^ ChAEQL+tS-RCl='H_X% A@+W*!T+Piv>0 uH$Eu%JTQ ycb0*{XZv$C[qE鼘?XE;U8AR#0. cBD+C^vl m%SlQW^6&1{<;v,L=MD~-|ב#9kt ;y{,o===9s&(ిyFbi|[ؿ9};RVC[KH .h2vz2W^y%G}4_}[z^gWR)ͬ-˘?>ꪫpΑ9FJR,J]x0xmwR`뭷kol<x*v؁mݖӧsE8;ČhFZ-W&hjtuuf=fժUtI̛7}I.`7^b1b͛ǾNee"u\dYFRaΜ94egڴi,Z+-1Rb\%(?~Flr!Xk9蠃馛8蠃w}9CѣG|`-Z9i)YeY[R^%IRA1<9G^Z.wwq\G}t9g'L  Wl[DH;o䳟,]]] }Ƙrnuwwu^'{,7pӦMc#2f͚5"ksY]w… 9sJ ~R;щNU%f=f0qPnН9baeHUJTáppҌb9yb 䡥&Q͑,<]]~GeEiÕ4kCmTaUʪJ* SGMꢭ] `D"Ds4@ >SxeȽ&s]UCU'H X)l5U&` ̂@\}\ )e+*C` S4s{ ߉2$:쟏Hs.,zFC-CGģӰV~IEJAdBo( ӂBh(nK"ŀQ*]*9$e[P8e m9>Sc΀qM{o4 믿SO=c #G{ÿ˿0uTƎ… 1pi{p2a.bva4ma8q"z*;3i|r~i͛pe"jt_׹;g}Xf Zp1裏2s̲~a?9sp%я~m|>l?pf̘1)S`?3ggҤIh;\իqƱva .~w \?qe>:#8$Ix̂ ʱ3g_׿ΏP^* _:u*s=|*?v կ1bD[{ej5>Op!p}sO@}ȑtwwc)֓$a„ %UH ^gvRp#pWruALn;щNC\ bh:B+MCj n(HMǣ2n2I~(=h!gh1mLDgo4W IDAT?rU|z@kl R˪bZ.WTsa+qGc >Yf+fW̪&؎h+RK<Un3%&g?ۙD': \wg=)e7>Ef=g{Eq.3n1caT(I50v?|ܵNAi٪O)kc%V܇R}U]Ҟh)e?]e<ٱQI{K^UIKjڸε7іD0IE) G_ŇܢVZ@{ئ/EJ 9- XmIXKI>TiZoI Ź=*VR|SI^3;䧿D`Rȳ-J)smWHv SgD7Gȶqސ$1ǡ;?w .=#9cϗ>tV"rY^x%{'pG~M0cƌu5>}zi׉NtxcBV qZ]MXCrb*epʳfxhTd&'3 rGT7|deߊdxH26ZF5:l @ɔ<\iӒ)(o-a>5BKNChSPAА5[ޅ*B- UjL`YI(2hTV L*s^9>Xt KHX{/C̩A֚PRÁЎjDhѱ=6G4cC_\{L^ $V$qLcB(zz|ν t-Ǽi65F?* iB% k2yF5, s8aM{3{7mAcKUȫ'Os͘1ۿ}͏cuc 'x"kgbt440q+ŲUu+q᣼ cCsxԂ[>ÙמrRF}+I%'{8k7j3>lPP$Vv*5yξ jm,P THi/5TSh-B{UCcH]R4*Ҵ;<œNDwc/TB&ыxj @Z)X+$xQrc <^w!'wqbVp!I7U)ˀJ2LhS$/ihIG$jW&v+3nZt Z9zLBZ*iwid*k= k vV2O偖nAtDyFfP*CDl# *&U5p=C/Ǜj Aqso岉lPoS/Rdzm0zF x#ŋȐ!sXTnL/GPc~)R>M9gѫ1_β[6_eL)eʎ bl5 z()pT-9lZ (RX/RCԠFdi)qֿ7<dIx7z,4sJrϲᕠ 'Ǝa0+{Ay񱊪1ޒ~|;G>* -Y|8I By1㤂u`".zzClC7?<&)Ջw5h3xL}ClhqJ=ɩR]$AIIP*UEBbTkZYW>2kɜ%c5ZP &`¤ ΧXɭlawÕ)U@xYW/qg_XO_]^c#s8o #F{7#]f{v=3w ۖ4bG5^UO6n^x ۘ ځ k\Bo&5X?p󍗱8?t{͜cs.vav4UN>S\}U-K׮rƍ^sw2un?CJoo/?˗/o{szXkwI9}e,Xu8ߺNGK۹N~ܲ>n]$>xRoض/G~q'@iόEicfq7E1{?koKs;&s~-,_l֖8]&M }6}0פcE;Ӧns42gl\ϳhB}!mK':Z+CYɖv3F*箇3Ho&UQUh FgP`*ڡѐ1&Ї#rr Iȝ'\z+w @@&EK~>ft8 :b;U$Zi|σvCkVpkURIQҎNBS((ZMB#H v_"l`–`xkHY[,q>LL 8އ>('9ѷܓ'$STTj0icS8h EKܯDA':ŇwwR԰A-sH.vx 4up  eXgq6‡t,: U}ޔzTle$7H ]  xo{ĻOa OȤoa܈e|שLV[;E{Q!uE@i[&X7~ 7|3+;O4K=H;kۘ>}|CtEkaHv9MŜYU>O3&Bqz7{FW4J0UUZ<s`M<7r71qDLnf̘;ʕ+9c D'^L3+*Yx8'+u R0_IKڄHW4iZ5-P?TC/`MbtA"WFjEn1j CCߘ6T/Mѱ[R0EBHU%tYaZ%Ur.4Qy)Uѥ*xé au ;ՠ˰xD6 v訫ϥ'xѠ]m ^pb"lJCҀ$q :SFЍkLG" a;iWNT [shEAjt`R"5.Põ*Ue ŬRST^&UCvoPs">Ds>f@xw%q@bZ{q|Xxɳ`9ftٵ3HOzg`[iJM%/ 8fΣ)+d޼y_:@?~;zۺ+JiKsAD8q[7zHIYѣI*&*VqyN [eGw˥o4mz?}YyfϞO~7%s\{}qX>h?{J':ך"?&m T@1p4g8mdsڽi{EAp!|Z*DMwDAL Xʋ"t]'BA;o=z7hPMZyr,ۆ>A?d_xX!./TA*n _b~ y CS .UP0 ALJh!چ1 yܐ- 1F0YaB "ޑ$4QZ+ jw9q@bE}Tk"@5xDp*Ԉ_FIjEaI0.PT2 u=:_IR}qD':׉s֗ tG`y Uv o~g#̪xK8֭x'If K.?q#;_<^OUݹo# = `aV$$$ب1Q_3ɨyI@ JDE@44j353MϷ;V{sN[f[U9gg?:3g/{xSNeÆ p ٲ+WΝ;˹C /`,_=R|ٳJԩS9g>^z@n858hbҞT}KgwxWդցy֖wJ[/tFLl~~>OQ4OLݰaVÜ9sR000֭[曳q{%0{l8[[2e W\q;v@U5krgrWD+^ӨT=rVu5R|1Á"`Ez*սn|2E( VY"&('R/S%2D*6^&PuC/[Q&9LI 9{4PC!g%I* `7pHR0|3Z;_}ot$ h>[N2_W*M1%n R}kW)ԜBS0!׎`P, &.A4JVz{l䈜[~ + Dޅ15vNF %"c hP151ZJ5K/RW&;@mE+> .  z!tM\j<*/> fMhh#JfeE05ucX+VA+^RBD҆ /ۿ{r;34VE;qs'v *ǣ:2M#e-(aBs*QFXhDRI@r6&bR 5 %sߧ1 Jωjx kr+fkUͪ>;"9zO{Fߘɽ4sNSѴZ>&ac>]+ødIRCx'kUO*שb `!' Q5B $n* (WC$;#!i&Qd(#x,~*h/a Vc h (c0XN`6^'!ظmE+ZjΠ*^}VmݳWݽr,?a LYZ#6R\ttBl~vow,FOՃ&mweI؊W{Wť8#UwjlTwf9Su;#_I%hJ߶a޷k|B%h=VnE+~"bOq˭Rw^Hww7kн<^U NYԼpI/MP :[W/A_k yM]ޜn ں=ܹjG"9 D,Q״Q܄mJkaDxd6r5 i1s~ؔH&1ʪJ=*u΅w؇b.;cc+ P84>+Xkcm;" DQkk^ȩrd&%A5ۊ B^6>k1p"a׸1>|&Q{zSvmL*POL1WIג%P%?we IaڗDXNj?}}PSYu5IcAGlIis5NC!\#Tx,*D8SF IDATr #1CUGWgBP=\Q8Wi?|pBdJ]s1Uq\| 6*P,DJEEcK$&;0ƹ3y%ԊV9huz5jg\Fɜ,Fwq~{BR^ lgk(mP\v<;kܼ(~IZ~3|ցHǴw5]Fz)v0܏1]@ƒ?zCGg#ϭߍk?G4Ҷ BT5X;^}M7:ѹV|*:'~r)qɧ֯R+:QlL@A>VjcbUSD!B&AaM>'8tBcUh`xc.;Ao:v8vA/?ͱd~ʇ?a:::ƽOc/| \}DQďcMŋ=c~k(q̜9zR_C!C޿nLм<1B㢸y^™zșxJo0 cz,#pI:}ܗiY8Hxl,zSMĩ<&"H8AyINS5u!oM&dֈ;ɳ볬M3cRGjؗ4 PxbqgaцXh tx[TjI N+J+W^u r,b#0ԨQ6*(~ę~ewD oDP<ו%a9S.uÞbv𚪸qm xTm۶1}t ^O>8ٺukv5k;v`ڴiرI&!"ܹ>bȖ-[p.Օ}OZNSNZ/~+Wr=p2m4m]wg͗e>e `ѢE|s/G=۶mn_G?:*9jٳg344&Vo)|i&T.zzz(lܸN:l?&Mx~|TUnVwQV@eDQIhp1]og :OfS;_LO_cOv0-\Sflv^}޳iӦlN>aL6gy͛7300@[[SL[~dd;vd0;v֣ڵ72c 1l޼Ueԩխsǎ`e̙ g̙C\Uel޼v&O۳*uGGl۶SٵkCCCc2ĝ;w2<<Ι3g򶷽Z1cƌfb{?7nT*ɤIFm[( ڵiӦk.N%D$T+Q+s.4 uDF8 zEnPĸ%Ӛ1'̙恡Ԋ^aPmdrT'Sk 7,zIU7k KBIiOr#\NTЍ ީy#N W~qCԊ$maTꏗj # ׈+L][pɝ%t,# 8Ik=DkIc}6(uM- ZA6[A7_s*%MI":ԽBfp^XV|bbCϺD(YG E ՂTlA=h߂$D_G*jJl͒ &1jǡv;xmMjsCy[CUu/e jօ_Gۏ-/{H#|~4ٺֶ9-ӚiHͦSn|MZ7ƤC00'v]l},p4}]l·->pwpE!"qr!̟?o~,Z?8$ih{Ϻu>}z>}tNʺu8#yG2`3o޼:qǃ>ի]z(#T*qrQGE122Bǜx≔esgZv-qٙffΜIR~?*ݜxp uNKZS(83{6-_wrEM8oSOyI67i+oykgRpZ;/Asy Q|tZZO<~^|E^xD'EJsLj2WfΝj5?0"ܹs={6۷og՜uYgIO<1[laڵ)իGDXp!R{ｗy1sLlB[[+V&'OP(7 dogn77{B+(z MO45pW^_'׿pp恐$B$&y:+*QBt5\6V k"RM(O&# EVX>N:){ y-ZĪU8Srh=஻lcxGx1p90444涞q6=ӈs̩ 'g?٦q"BPȪ"Boo/]t~;w3g8S2 "XkAc'd֬Y]t>1?8"½˖-[(;wٶm[@'V __8y7rӿgl;9\f~B ;&gs&9 G]‹.;fө@/J=gaٱ\kKww7O>$?xظq#]v=\7pwsUWq衇rE%IpGZEDXz5˖-O<9#X~=ʻnT}swy,_O?=֭㩧BD hkkcڵ<3c`Ŋ0F=v䜍X[0[a` )21p poOkUQn2Zm9%zɾ6 P،**Ƨ暛1X @ޚ7m#CZ XAd+ +=rl%lSM]Y_F(ÚY4'&#Z9@4!窉@W[:qF&K5?({/%$W^t/D?I,Uh=k G1DdTz驒\rb|UX0Hz|h/{}YNhR,7m粍 J!j+P1Kmttt֞# N#t$zS=ftDjt2BO6cLf#H&wf4p!1z*n~yfOΚ5k8GMϯ#wqH{p:j*vܹs>| /}(vց~ ׾58 (b͚5ٲLkhoǣ?^o7:}9Z{:Kp,pE ^mJ (FB"BQ/(OuF>֬Y6<7矏dffstf57iuQkK,*QE[V\y\uU^å^ZhXxm[v-vw}*/Z4f̘ƍy饗xݚ@L`؋;XqT*І)zH5f2'صKuf8YG<"CMg&Z~utAԬ,Բ|16kȄhrH҇TH0b)XCl!({(H&~zIQ Z/iOv4+5%HDd؊֜k䷎>FHџ/~ &>彨6Tu2iߧ,*-CfסUCC(q5X A-8K1hCUCpsmE+ZQ!w]3"(\d㦝 3b[i]UǙgtc<3:t:P12w:g(U> n}Jb'Rq5p7r%dv̙K/S,36=z<쳜z,X/گ?}www][V.^|EO֭[ٵk{.###u* g``,Z^կfuu(R022}GCCCtvvf4iUrttt044;2{/W\qvRdattl!mT <;1FZ|6PhjF`U nb(`D1.c06ah5 hG/DTeu!XRyfu}uzLZސQQV:Hci.uueW(0&@>&L`d[C%7kN1JLX#z IF\NkcdJ\}e<^)hE+ravd6,JwW=̛Ooog=Sh+Ւr_Wf=I'q7P@gtŎc:;; {UW]"Z\wuXkٽ{7"Bgg'لڴi&MٳggSAlZ>sؾ};ӧOϨwy';wDU9y[׿u{3gNFinoo϶+wuuq7f.ٳg0yd""¬Y8ꨣXj7pCZww7Zj,YpBV\u]nj3;w.\k6e_pa}wGWW<O=b iӦ}oy[O~۹+^ xiĔM`g'}t PJ{RCtM*^z)gϦ^s~,Xs9|ٵ0eO˹10m4fΜҥKkK<>餓{y.c|+_P(rJ^z%zzzڸ[?pN?s 7dccժUXkYr%6m6"_)=VZEOO^z)WdEDz ͚5N̜9[oUeٲey䑬_>۶O<x̝;I&%%r&؊Uq:l;ۍAl`v3jehZO}ĀR=Fr(`^5T uõLhWU\av:Fl/f.xoa#y"CW X@!00 ] T*T*U*|+%>A5 ޥd{b*57if=L.,j2A a>bɉ 5Ȧ "K3Y@yO*辆Usvdt#M sM.)LD6ME3y^~D0Zi$SRn(aR%^$S&Jĺ*/cjuTMA+JώM2)Z/`΂.}9(S'qҎփU*5I~iN6A&f=~?;uLѽ}u"q݃ut}Get~H\]qGop[f&Ceݫ7e?P'mf LBTu{]JV?YD V7p߆0h4 Pi)ܵk t(̎ዟ_أT*ˬ^/8{m``uYџx-|?ymG%\3Hσs$Y5Cw哸W.Ⰵ"?_ꪫO<6lKbѿg{) CXDM1anVs;YűiR$y W]j VHnn,Jur=oY&\"""SDZùb. 5QOlj gA}ˡ/]4$V|QBH@mh4pZ`FP I$'z!Z#V44s˧m hM3jcKu }ZnQ{.IM(Kbԁ4+XBsytyz{CV"K^7ƾfb5j3Z=^,HڶzU<Q3]Q|b;2raX)˫j& Wt6NqIu$w,R<]+ IDAT96T8(r9W@DsX 7Arʂ5ppٟW.<%&wu8l>Hcڱ]Gc^_qwUz]z%5j)[\.yj^ G=}2e 'xb}9XbE GjH,阮&ɲ-dIڹHĀ$6%>IH"FhU"Mds , 0Z'4!\.%WhρQepNڰutcE9~>|E"+tM{^g})'9K2n'5 +U::"L cwAo#8}y*_PKxdh?3`Jxh:PǬIk 2e( ctc}[GGG}tk&܊dP1J86ɸޟ1MzQx H'|%R7ktwwz_gtɄerS@m/ Qd"K!"8҉+Ai<U\ Rj>;&6i9`Dp() HH= nBςK=c/k< *6!)"g=Ϸ%gg1D@;5 sxTٮ׌4K$zu/j::fB)1]$\N$IX^d7cXH $9RS=SMo&}鵱d|k0 ]4&J~4œ3H')+ߌ¿ͨ*M'yF8΅X}6_hi/ Q̙2qzS?ɟP.;s&T.{4Hٽ&+ZV,oYLE{w[^`)Bg7 .Mۇ?o^{&1R,FAw^WRx,1z1wg+Zqagyꩧq\T?1C`$C[ъ@( {yCl);;+ UTӇc%V*qhj\oQ֬w8Pi=[Ujyԃ,J Q1YS8@ D` M[T*VlRMOG^:T,%h‡ HP_H|rcTho/V"bg쉥RELbu^c~A¶j)ci2-gElHGT]d*gIio%iYPu[Fp^q^c{\a`ılOY6B xֽ0U|"%|̢.>7`'͚Zdv}vrsԂ.6(xN;k``exlOX͆e2K{exx^þ:yJ~r%mgbM3/ @Ogчv%P:5dxxb`2/nAvĨIW*Uw3crclYrԂqy ޢK_{ֆ!bnpd4 }W^u߼jܿn6~\r ~?+&KC|G6wqw`Dxr0{S ? ;mGOy>賃}l/IGdw=l$I6[_tFGH=7ȆeǗ_z^>Ui|O}OV{x5?oΧoxx.8cy/G_O|(W=ӟ_!Ӌ3gԆaTbf'_to~h1ً;8fQM^4;;=*7p+ELTw/LGeќpO7C3[wҶ}Jv>u"NY֋so,n UTb0?# s_Cә3=QQ ECgRO#凌޾ZKwW'Sb[8Q(Y~R͞E\x|?tPwR7[n+hktɁagqY "M*IuZJT@Ls)iP0H5U OJ쉀 ƦB[ MWK*5-6k@IRULҳX%J& Ubx^9`Y:T J3lO)bpDӣDX+ٻrpR35 +QZWU1dU$?2u#cW5socj%RB+uAJ1' @O[?(Ue}%p/ u,sb#&~9|NI W3rWRUo˱owlON!O*w.lbFo'_\mxɨ*4YT@QNxk3+ϛlaɜvzy-meߗ/u{u6D_؈sF{0{_YP7(Ԇ!F^d~ V( g;Es^fg{q[~ "`úBvܽf'/ g,N?U.?c}O\\aFox~ BM;`/ "+|$ 瑝|9vs6 T^;%I=]tum͔X~O69gV`5S&3er?[ V8U7-L!Dǣt$.! I+)X.[i^]=N fjv 'zؕ@4.<&(6L<3c:K:ut,ր-DV28g HXc\1Pu) 5O#Bd,  !6/!b%h kʷWuԾ+ $5cnZ8W % (1A~zڍ8 IԆ BaA" UE yMZ]qU6\op^ʬ)E>?g:|^'7r%Ouh'~ߡ.$R: p/㏯{;vFoG>/moToB{K~2htGIޔ羹}#}z9wWOwg`wKZ'(Rǜ%fO-_D NŚBx2 I*9o6Kv&ǬM;ο/_K{5˚XV?Տ^ c>;>|`1p@  E-}tu q;r؜.D'ѷL[Iy=Qɱ^0Zъ7I*hkUuWLFeEM,7$h}LM<+W=K(x>pZJM&REQFApYI48;KP*EP(_(]8.AA>49 }.Q*E+W)Ǖл]7QJ_^Et k_# ttBGY҅c:EBkDdV)ĂOΟf& .F$6%: F!$OՓ*u5֘Q9 VAqB>0&=D6T}h7=/?MTa2}ll]:Z4mki# ְqGmy[1vW3םo5 ?M*`6_;P-flb6$70B씙mJ`ۉWCx.U-;8kc0xcNkvmg[Xx@a#1/o[HT,{E܊Vhk ,/$cy䄻Hn5QNlg92ձtD WiK=yjxS8jU(EA BP-"`bO%4L3cXC<UT 8Cj-fn@Kjf_}&ޖ1]k:Up =&+'r3RS7 ǰf`ڊ,Mu$xb^r㴕hBLQM}y2$}npGi= {hudhåO/~_OXo)X·'?=p汓z>[^N)8 ]"S팸ώ$/π?}l):#c^LJXCfޅTbS_y=C1VMH>~cBGrlSPj?~t)El)Z.юn-̞MW{N7!b)V`,֚&7Y|+ZъV_=QM'|0T)i9 z2)@)> uC@:ؑՒ "ULR M$$=)6D&Hcq viJ\ൊ d\Qû &#EaemDQ"*=T 8Ge1e牝bm5`P5 ljJR%vqICd'J/:;9+LNs>fT\aM5[sMZY=)%Ʉ*.<`3ZDf['b&XbM֛=Scjlc $w5`&jO5 nֱ}z"leG액=\|j/pxG3Xt?|r-}r4ub& "}O[?_0?PJb$"ARjH4{}2kې~jn <^) )O>P,ͯ[ie3tTUĨKZ>+1q E%JE( )q΁xBW5Ÿ]1ȶVhū{Tt#:ƘI\+ydKV7]*Z0-g6}IR+9@[{?2$ק.~KAMjډ`9Lcň!$ '  q5d샬 vp6:\jзnCP-Uq#>T'z $e/oP"Nu P$yz_Wfꙏ+ʽ55]2@+c}VyHƠK*oz6i$ Ɔ^T.2O8@Fo# O!Rۿ~qp{,7t9G-p%_윒k870P(L)*q8*>$NM@h6B*XumhE+Stj=`PA: TFfpzPfՆVlZMIƀۏă)ƃ7S!C56P5LE,(L{:W⪣Pb$P2T\K`ۄ X B!spjCA(r HJ#3eURLZBO `'P" [C4"U!QG"!pV PԅY" ̻]ZxMZ`FOcz_OO!N?7cpgf`[Ak Jv(.q`xAX}lHԬ~Pd\68u[oE+ZъVL|J$NQab`:D(1ji7 4{MρuBE,V . Vjڤ'x6D!2E ZT ߩW O@C)-1Tq…y c0`^]RM3e﫯B^uxK>!{;Ri B^?{M4p=@mq8G` ! c0{Ok½ ky>[oIEB(R+L#Z1b7>Q:DUy4g cТc{ =:8FG[)﷢hE+Zȥ)@ <'O6Q_cc4 T5i/ohmLSzAoO[-IOhғVM3b.l[/X F`|8Ɔ>@HT40h«WbP1bTLjh@.y_ՇINo:,bB~Nvo ^5Qq6Oj " l(u m$;³]lLFjjzyŢD &,qH$WJfW^PLHZy) ֟H}Z\Ka-?i۫qWѤ[1,to}?eiKBW%ʲ ۙvif7dVC KĜ]9eisp=YU?~]pH082RP}+V .X,R(Z'85ZY3`at&K:Y *9wQT$JHB& µ,XA Qԋ%Jѫ^DʽJ\[63f7=@P9/>lv̜~9Rɑ8&Gq5 | A(ꡭR$+JVU^BTܜ0CM5PU6-`2pSU1˜Pr?4׍`:#p)JnXțK Di2KQt,#q fJJfܧx6g; IDAT.LHg"83tYEʜV̵&Qނ*W3YUh I{7g* (QUQ ސ, SrgV1)*vc1c'ڮMDǔrNONA\JHuu?t2ץ %k^$5 n5$uN]տW+NeW[e^!c?_Y|=ZSi~m '"-)s' PTatv3Q+6 RhݪE-4 t]磏>*NU$ W0a,Xh$E(BrNw?M9bGH y^ ">ëcQC~de!5[]oyXџOռD:I IE x NԸhۢ Wo\-i@æYF+fFw#gJ.IIA~gXu"IpL0 ݻwHDㄐo伀˗it ^/+\n~ۿԂ ,X`_$??\Å)u) 0UM6)֠͡(ٵrNSh2 E-#l$%$;;ߋ׶03=!,X8&Bv:ITJ/R8 Gɀ3P6?WuN)麔$Dxu(.+-(J~H+S71ͺȹL^*tIS*)48dJ/1'mZpحFpL(.VX@aݺ㣑tKtt4rN'aRRRgxٰ6,XhhZ5( ;~go(%]q4 &5[w@Qyq¹NWU_xENzFa<]8$[Ra J+jbU:hװDcHս"Tl7uM}$ֱUWD޸}o{Q?u[!j+bj ˜E#K[CV O)m;~z]48m9Eۦcp]eguϷ0eXo3`sqSÄO"-؄ v65sS}'%`v>E)-Ez=dqRQ aM˜1Щ²ekXb7pMyϐR2j(rsxyM3F`19&OM{j'IfDm̭6YFLMG-+v-.{F tj Q ;(SpI\yL| LEc'!DO[pτ윮!CeH`}{GCEͳpXmS~4FۉHv=2~Qߘo|-Ӯ\{24 s}pH.Nɵ x1.䜎Яu"7xwLZ}KvFgB2vmuoH!@΃Ľ}jK-cpݩNt݉ۓ<6mAZ$%&X :wV8$} ]ht!49dL@ KǂF@I~A,`^cOGs^`Ԡ6bp.q iCu{ǘq|ۮx8nvjq,%qxn@cH{}9ciVvq?ݍqId~7Art v_Zo!kW"x һ%\)U?.'d A^j4ݺf^~Y;VPM|`9/%|)nBI!dlBVq{P-X8QTT_fÆ\6mL^^~l߾)%o9BΦyVYXXWzgmY` H{ѽzGaa>M#MOiQOϹt ÏUVrU"M=@~.7\c?Πp{$Ja32[זƙ2.>l9uv[uZi±nT968|x7990 vڱ~8N6l؀6mڒBaaq̏ %NhY) sbzqhwwY30DT`KBu[S*QQdP%ڮYEʚpT^Gި9TTgʱOTj*گsy": ,XJBE~‚K{?"99#!NΝpm{Ÿ^߳e{v7iWm:ev,L)$ Dt䪫q $_S(*Aa,Xh4 ZZ-d6[>)-pԸsnRbmER[[bVߐAZ+6M]hzCF9 pR{'ztL8{~^mlhdh3d,9=OxoU)dv/{( 8Gf mjh x|;2PUA6ZjDE3t9coT $ڥ!Ya@cX/m]>6йdN%[3|fĪh8։ "(vl<`#K'pj'/ٝ&tѳvّոCZ$(w[.T-X` @Q~9EE5o)ӧ'z)ka!~kTn!Ya<4O/sZ~ZXGTUC##0elm(?UR"uhq`~rp=lqfѼys(,4ȫ&p$+Df`B8AtLM'7Ɠt/u2ea.Si&Bfg7YF55:م&^dMtjaW4 M k ɶL!ddÕ/.Pu ͟hW iQЧYT5r^1FPls-B^0xؾ}տ-XhL~N .3:R>/9\8LfϞʕ+뮻(,,fsYg'PrFZk@7`oPVLO啜p.?l7?:r1ؓm\ŦAd(AS!E0av_y%&J),5+Z~2~`V_EUOK{x R4If6Ax Dؠc3| L l.Y##ٚ[DcJMn+OV6_rQ\3(&(rEem~~_4lʸsD9^fDrvNmM مҭ>l`XO;-zy~"*󖕢Us`7n__¶L6Q%)h.KMn<+Wygz9hc`+I8p։ OrڥcJy &x'sυNf=-tv?{j7v+`G%tHR>;/W}j{4:yc_{L4z1 ύඳ#0Lohq6Icѡ0:,X`~x(JKK)..gn8Ĕ&8Y/{&(**mC7ڧ&KlL#*͈wRٜW!A'qe[aew޸\.w/Ҩ|׏>g}ÇmuB |>笳b5޳vZVZΝ; xC4p!T ##+Vk./^L^^sa:נTC ~&#T@|ƃ_tm83p{%Ocλ+݌=I*3Zˡ xRvf1!kC4oTF~9(:17[nsD4?jGc`_ >^ y *S/GRJ[%)h5S`RY𣇍|3g¢ SRul=ȝwމIAQ53>W)n>?O2꙼C:睤1}\,vv)p<`I.- r V+9C 10(Z6QR9&p'u-Ssl?'%hݕI;p4o= Nn1cT Lz/H$)6Bk9vμd1Wa/#f@S@Q`oͅ3l$Frl&伭ڦ¼l`^?][ؕ =hxF$^)bw l [ #L_sEj/fȑ`EՃDk7.XmL?hE#&R!.RӞɝE󐁦#vY:( ѫƃ~  w_>,Dޤ$$s͘+)♔yqwM۸뎛4Xn.i7n!4 )1$k.S@*A(:g(=1[H؉73+KsH*6[>.m?<N@cٲeDDDp7ӳgOvţ>ݻ5j]ta̜֭9\ F˖-ٰaO>${oyK.eڵv~_|\?By&nIvDʀRx|J4E0i6MU%} ?и Q NGwJ@U`V̾.M0(үb.Ņ&;ט<[`_ WˆW4-_^1ڝ:cwܑ{aB.`c IDAT{p qGbRe[҇_^YO M罟.k}<1v݆3*ͦEDr@xT(keK ecK)ر#iii駟ЩS'gٲe2vX4Ms-TzNII ]vY~7Ivv6;w ##)%t%f|'DDDCq_*iӺuk:tʚ5kk_0 3f駟"7*Ÿ(:6^܅uʦDwh_d_~ )kH^}?nsּ} B3 \ ?߻.8W ՗are̪ ZW PUHo6zft 3T)4IYf_1S_|[*ޅ%(NS:ΞlY:w+fšg*"msH$") F5.F pFn~)%"XGҸ(jYwQD|˧we`545wE5yQ=R˞[Q5Fw5{Q^QdRxf?0Lɬ]٭cר7EY,uQ1RT*Y~슨W,RDzüj9kz7.mUR2K m*TC~V) ,PzIPD'e@, !scuUm A#yw`HCl˄WDD"MzķFAI3B:R_~%sE+ЬY3t]gذao*ӡC.rvIjj*+V`ƌ~^oYp<>}:_~yH#bz8 ƍg̙31 .0*{={rJŋ9sf FD8$@ӸHJmh7Yղ-4~xlFl̪ϩQO,Uؓ_bnd[ Q'jL c :VY[]bNm+b,X#X!E .MUQ}4U4DYO̲RE0;͊^+-%(HLoxFNL=o4M־BbHb HGU詐dGwYRꫯҾ}{&Niر&MpҺukڶmKӦM9)..&993<3Dv;]tkaƍ!x饗ݻ7iii 4(w݂Ftt4{oȩۥ^{,tO6mpݴlْA1c >D' 66ҳg͚`hݻBƅ 6h*4DT|qjuc" zo,X`BC)%wq1+Soٸ̃{zCr- %7pXi ]=fiD1T܃y]@֦.SQ&(iz00 /#/ /S0/w!DR4e? 9ҳ` )i"  &*SÒi6Ij#|GuO޻^_=r7캨8˰V=(,e?vc/{.᧗u^E#ԍhvaZoEݡE=/٤TX1&u?Úx1aKm '#f + HCb6fiQ& 4U Gjox(8RHSAB0t?ABSٝ?Z4Utz5\> ,X(WLXÄ N;3u # O$Cyj%^ulNCyEwB+xkYeݝ(ѰEG?  q4Oǐq[ a2Zk_ey%1ׂ8՜ЀV>)e,K )iҨ^0OJj ( Gr=ledҥOKm3uA<{mksEHSjɞ,X`ZH@H0!LlBtXh,u|_ ^oҪ?m]%pyHno-nY39;٢ICQ2*~]}3Nr$N!}kY`zV:4*OЫX!(,(VxISֽ?Ңg'(dTkU֑ǚ}x/1S^Fkhd#g ,4!4-lDg#M߱C)e<[DJGκ7)m4xC~?+{ ̤EDEaݛ2" ef Yd{*^euB!(-u;RvSXPR%c9RRRPz68X$!!Gdn^dKl4d/99Irj>#GT}T$@p|>_wjÁ>,iӦhvpJ)*,<=F26 x}lDFDϑ\|Ѱi6&%Ç13Il\,Rea*I&_Ri mn_~ᒋ/`޼W1NayGrkv|^߱fSNer^+6 CikD3){ѫ߁6 och$C!̲I",X`!H2x.t)p;W_0\s7aHIJJO>{,]􄪊8ٿ_tBFFn;\_Gaa!_~y{>zbԨQ\vxiӦ- `Ѣx9ͨ:62%̘1k-[0ciRS&NHǎINNfСңgOLBBBC )#ۨgˌ?+V~o۶-T{4~\&O̞={9߂әiHLӨ|hb'1u0!*sL形8!:&;i!#ؙԎV vb"TvJcPq˞( ɋ ,X DD JfPaTLӬwR2uT҆=""{'@ڵ+4iҤ#''4==.222xYr%&MBu{94M7dʔ)s=|u>O4&O/C=Ri;K~={6S3S3 9s攙4Nl3<ÇylL4C6J<ɓYjU~rJ~gLӬuطoO?4 ֲeK~a:vP &ARRcƌ| N0 ?Oa٧q FS]AS2#INW^y% BJ޽{={vT#HqH)|w}![n[n]yNtt40e^/r cƌAJIqq1SN"TU'o߾zFmۓN͙:u*]v1gΜj2qDfϞIHHG > oPV SLa>KuEal޼9to߾p x^<~v"##>}zsȑz#>Kbۙ>}:( irկ*};6:w̝w /ۙ1c;v^cܸqt !֭7pOkٲe2@qq1?,(I1 ]98k!୷bʕc!73yd^~e6nȓO>YkגIbb"3f̠C?brrr6mZh0ӂچ\Msi6ed\/ڠ:k,g )A7'ﲊ7 W^t ,XP7Af`WJ@ KQ@QA(ǵ5 cҩS{gp;/2bƎ[mᭈ&M0{lvԩSiѢf`ь59skqM7qEЫW/Xt)?̝;:0m4V^͓O>I߾}%ԆaN/-[ƣ>ʴi0Msh"fΜ9äI|a…qn}Q6l7|3 ,W^aȑ\{tޝ={мysn]yYp! .䭷;v5MFF} /ΛoYDJ6lYh޼9`ܹakCtؑ ;ǃ]׹y۷oyg4SN9w}е7C>}5uܹ8Nxɒ%KxIKKCQKII <Ns|<\r%|'66n>}С#Fફ^W^a >Gzz:K.eDGGЮ];}Q~'IKK+3SK5Cc~ 0ׯw~!3fs{_~㏓䔒ڼy3i2}t>N;4(((୷B4ϟc=?_iӧ z)kַ`O4Y39lr/7ȹN%*򔩸[Шlq-0LS "&_*I֡, Çfqw8x`e^5L&k&DN'v<"##q8DFFNqq1a:JTTW\qÆ #777,[wFFEEQXXȑ#GPUz'̂;ވ4M~RtP͛ǂ j$VumH_E9rӧs(ǓO?agƍ:YB4{9-[VF IXx1?3?+ՑzX Ce*..wKLLdΜ9¥P8q"]tAu4Mt6x !PEѥKn{1rssCˣR۷_7;wr]wqz5"*‘#G())!::M6Eaƌdff2wP{QTTT/!Cqq1QY`AA~~;͞A^# §A,ةB> v|W%FoRV&ZP [hWz^Cv èDXdp۶mytܙ͛kC25kV\ueȐ! >+,۲jg^^wO>8N|>+m۶eժU<3(SNe͚5aݻ’%KB}"¬46*`=WpO0a<̜9Cj5͛7F N.]ݻYz5W]ux'aÆ}];v,>SO=~YfQPPo~Gz! K]۷s72x^Hbbbt\UUl6a0o<.&LaxX|y꫉e˖y!bѣ袋ݻ7nݚn N׮]9+m*t҅?VZĉټy3_5W_}5ZBUUw͛o_Fń 8묳-{Gjj*w}7%%%Zz MB$UUذaׯȑ# 8.]cǎJc/w޼ ٳGy^zq=rx޽;&L`ЪUЉfo]vH)3f b… 2#F}vE$&\KXx1K,aݬZ#GrgrOǔ)S8q"ڵo%++ dƌC޽4 &͛ٳ'6R^yϟŋYt)Ǐe˖H)8SxصkW(rJD&~P`‰lnw7Wr^7ٳseÏ_R/ۑH)NL"!Ǣ25, y(A"CrK(-1߿v¨J~_,Xpc4L)0xdET= ܱO?_G.qP-[w"ݻwFO6nHTTTȖ0 6mdCjnݺ:;wSNvlBBBmڴ'ᆘcǎH)ٺu+))) vcǎzչsg͛믿ΪUlݺ֭[Nٻwo(iEvvq[I&|PڵkGLL ~m۶lRe˖zSSSA`9+*u놦i!Q||J"&R+Q66bXvZ+ ǚ5Zc0jo.`f…8p/fnuQw222_֚Ȇ !@+@o}m'a`;vyvvv ~bؐAF ӼKM0]B]st[# ~R+̅B{'Xn3Ei76]wB!8X2ر t FjG\!/!8W9QucӃ !mܸgYH(!'@%>;e:kc-iiidff~zBPNff&ɬ]]y$''flݺuj 5ׯ'W{N&//]vS?nm۶Mtۼy3%%%ROBCtR1MX9ۣw}ϒ%K4MFx< C3uڶmVZΝ;OpBt 4X~SuMeXw7CLbȐ!7駟f8s;3h :t~+l;69C͹kyw3f~B߾}С7p6l^I'įk{9fϞ}Ae]$@ܹ3'|2;wf|GRKBg&zQVvll(Tdz| q>fZA**[1MSXpc)b-تtZk</> ) 8Tƍw;O+VreXEݫKNNow^7 yҸh{?eذaiӦNtu9s&>^zi:t(III|嗼RBh_|¿'+| PkxAӦa f!ÆaAx#?B_) uXkaT,Z '!||ij¡3UXEׁe˖rJnF.B:uD:t(̛7zEbsΝ;χeY̘1#]v1qm?k~/A)eYƶmlۦo߾m\|ԫWo.B!/"@ׅ;ϏLnYpm l/Nbݺl߾;b&~)6ZH6n/rBNp≊oYúuѥKgRRÕtؑVXA^Bԅ=_$T`(PX ,+QLff&^4iڴ)|AԩS9餓o[ΦiӦt-0rH Ʒ~ܹsINNNis}ѹsg}n0 -ZDaa!C !77gy'DŽMnݺqwWըQ#|A>aL<2={+dԩRBW.z4s :u!% .4^7q)FáU/pݏ Pai=2u:) tW{/{2ztisZ\+ F ] 5TYƥ@k@?~(֭qXD:sݺ=\ƍڵkiڴ)'6***QF^A)^/͛7g̘1˚5k~rlFk8R^u]|> g~-0l0O.]6m_}UuZneYeB!~yQz]}{l پG Jعs;eQZ\1Ͷmrs ؾ=D"awMii1ZkoJNNȔOB6LZ՚xE)'|„ x'g\s5PPP <@EE=w_cӫrgnƍcΝ 2ӣGD4+W[|ŗ_v-Æ /I&t \|\~kTTT$^?.oFءM諎WKNNu<#̝;W^y%Σ>JzXt)?m!=U%00t֯Y|_ (x7Xbw怜 "//N8Aû7bЏ,}_wBQQm/xEkO,Jx>fNJz2dHwʔ)?I&_0l0 Ffӧmڴ2yd-ZwieYuY<#̞=3j(&Mė_~ɶm9r$so믧~lݺs=4iΝ;ӲeK&O̔)S0`&LfC3ydFń Xn]eW^4lؐ&M$ƙtܙÇFٸq#ZXQFضM>}k?~s:\h4.A+ \@m)Չ 4 ] x_yoK BѠA,˪6x 0Ms`N0 JJJ, Ϯ]zԯ_ڗ:SXXHFFF{xG //h4]TTOÆ ),,$)) C$!?? VR"''55JdggqJjOxhذal׮]W^=@}SJѸqjwյdggH$ΖA!?K^{e:+y-v2pD*JVV^k2oG`*Oj ӧsI'aYEEGܹ60HOO'|r/^L^^^pM$I +GNǯwoΛog))Cbab(aehg_g&Bl{hWcF{>;wLTQJ&*#܀HE)> %oujop?3Եcrm%_~C&5kcǎ=>|8f͒ !є:x,g`YUOXS!B:9#P^K$RF0tK LiM]riRիWS\\̥^ʻ+DB!VZu9Ç~(P7JB lAEtF!Bq_ \I+[`:e%eHʠ$8N>67ou]4lؐT\eӦM4jԈaXEII aOdbZh! 6*R uP^^H~ܼysR?Fi֬iRZZ*^VRRBNNJ)өHw)zwFQ2&c.BfGI8\/Pp CKWVB,\^ǟt\s= /5]tw}7o6< ұcGϿ/y /u].RKfΜɧ~eYKx<tˣ}\z饸K^ѣO>$˖-C)E^袋Xf w}7p7s 7W_1a ]v'G)ܹsٶmw}7m[o  B+j$yPҏL!uL&2L\0Lv0 J K5󕒒ҥKݻ7=}wO<W\!Cضm={}:^{-W]u`-[sѩS'JJJjݾ?g DluBq!a)M >%hR*&܀\X+X`JCJwğq\5eeex^ 4MRRRСeqҰaC p˲m;~|O?Ν;W z8*`6Zkaиqc.+d{)((H,gY@?mrUW8`qQ(p5XJ.B!u&ˈ%S %92VR%$4qr:t8lRضSOO?妛nB)|RQ?}ضͲedѴi0xwPJq)$;S9Ӹ4M4hƍkZxb222h֬Yb-ZȼX99@c _lJNdR8]t0 ֬^I'DVV{IW.!g$.H%RQaE+҈VU)+H"G$p|7|S,--kV+oVl2{dq95ZǎY~}sUvw}Wm/^+"\Uea& UP ЀN =>k9e+zZZp :Nt4~Gv+%@B!q KuӠA)cOYeje q;V*8n$''s=ȁ>2%aRmuc=J4ั) MAռJS"F_݈wEy{օ[nݺj㯄Bq2Lh')p]_%I\KzTqChm%UV(JŠ␢ v)vlܡj.Q*w̬z֧f)B!~?}!''Ν;s=0l0JJJ +V`ى\hWJq0bĈD[o5qdeeaWf„ hIOO駟&v@i̚5 Ldٲe̛74ygزe G4MϟOii) wtq(**B!8D$qc $ y5ğ"ɛ#rfGnU8 j.D4hL"Nn( S ]GZ;o.ի~)cƌwaʕ< 0x?\ve|Geɒ% qX`A~1csW RTT_ϲe k3rHڴiرcYp!~;\r 0p@N;4c=֚!Cpӷo_-Z?L֭W!oOTKr'e`G8N^eY:+'ǒĥ6-aBc֊X7[M+8*6K{kr e?l1O̡ƍ+WJ8NS{쫥;^_b?aLӬ5^)Umm;*^{-mxbv@AAǏg8C׮]mҩS'ڶmk&WB(eS&iʲr 3֢(O"T Bq2=ƕVqA]r%ҎbybhcED0|M71dȐmuq]0Mwn"U pӲeKN?M,gf_ ]2l0 PmƏO?x 12r .ׯ箻Ja…L81B!+սW!ıNtj9UC('=iVjaFͰØ?> :Zp0g|>o+WD)ŬYWpo3i$n6." /@9s&999L:[n/C2}t|I^u6l#ziXn\֚O?4QZ^;b]srrFD"Ws8fɒ%(**bhKq]뮻H$›oYmӧOg֬YպһwD~}2d)..榛nBkM$.PHjBqr ât75%I 2IBs z8E#<)Y5[vAtU]tM6eڵ߿Zz@&qj^>cǎ4hЀN:{zK/E)E$|:B!quIx}Iu v,0LP*J17z>j Zf4cb8Q IDAT뀩5BUF&J(̃hݹ9]wz!:t@QQwqGnB!8 4r؜RFe=JLU^T.{7*g95g.:-; ] mK);e~V eeeҥK裏(--:>s9'|˗swбcDb''ӲU}jفamjn׮8!vΞoID*JcI|I +/pY 'zmKn&!hV]W]1i$JJJHII;d혦HB^^^blwZZ .$f͚ϧK.ضM 0 ٳ'mOO"]wůk~RZZJΝׯ`&v[iѢf͢TȆ 8s7nǏ?u۷cǎcN !"F'1Ze73j5ٳgֲ?~<_X`ݺuC<lܸS0`,bȐ!dffr 7矓K8~L8D_| .3<-ZsN ի@ {3vXR<#L:~@ٰaӦMc̟?.>Yf1zh&Ö#_ʛoٳWCC :oVjB'vBpJ)|=eh*'=999S]ʕRdggWK|+ā[ne˖-L(ϗ.B95PTv׎jqfOw]?#V\W_͠Ae>7n{[n @ x)**bԨQ*k1 M2rHZrrr0=]M<` 6`YXhIOOK.||gXt)կ8q"= .o\r SO/J!׉R87 N4LŒٕeH9wPդIRRR1'tڵ.ܕ"333cNˇ$aMJ\ F,supW̅Q}pz`9>&̠ۨAx<̞=CrW0tP"ƍ#??'Z{lfѢE̜9G}#FCŜ9sBlْ]2b-[5\ۨQ|\21al޼ٳgs 7ЪU_ΝiӦ 'Oo߾у_~4mmrM7zf !ѕI\%jG0- б2WYfVˇ t޿9@q۵q]0( AyBaGaF8C{}-ESNW¶mO^m_|K/srytRvލM6deeOЭ[7;<~qg`&h ڷoϢE[yWqs9aÆ1sL,Y¨Q;+=z4Pg}qߓ-5K!ODE?׉6_2"\u)TAn !8N)T`V6Tx"3#p+o.gxDxWv4Wzض(TfCFն/bƷgyFx<ov'->DDv˲x<Q= !b߮Mw^~&T?. %RQF0yx}ɱpI$qN4Ķz*>:h` }`rBo罯"%yh\76|vAbJk2l4b9me`X-@IFẁ6S5?k]u\`j.WB!/$ΗB,_vn-syZׅBO˨`LsM@q 'н{w%%%t‰'_WiB!SkRN{˜J(cev4W ΅B?4#D(&[9eeexߟju֍>}`N!ERѺ6u(eT6feYl0D1-/-KFt!+b`iV6Xvc!6;>nuj]-ˢ͛7Wk!WJa&'OU[4D^s{<=+^uLLdmƲjcBq.8<~\K&TZ@0p1`Ty^HE)>*S9B!~!1PxL5ZU.쳋uܹN:L޽)))adee8%%% 2r6lSO=Eqq1))),FEjj*J)l&0i$5jR~~p87aYٓ={RVVF0wҷo_~_ӧOvmW_M>}_>ӦM#??s7HB!X4RaZ&)!%yxKEya4?$.TYV{ 9B!~ ["p ڐ.0Ç{rM7a&SLK.\}ռ[oE(yٓ%Krʟ|#иqcZjł (((H#֭[R۷һwoN?t^~eB!Ds+9v/H@kcW `z(c-x2@(..h1 \K/^,qmoM'PVxX.YZ~\DQJKK9yGp^uO?7|M/_ԩS[iݺ5cƌ! b6?<}ӦMK.,X0GvPJ%mܸ)SпnV^owMN! 2qDC~9s&/cРAN!yQ$O4`JC"bPFeB< $ Q^KRJCڒi[M~~>@c[{Ieu] 9~~zo.5O^oضl {N4 ,Ys=G$Iɛ8qb;\wu(8Yn2׉uu{k?e]Xb_z%/^(ޜ9s3gN… Yh뒝UW]UBQ& 4"TVNkES.K)(+Ɨ~PԫW_ѣxrmNB(56{, QxaI!D"ָ(<ރ\X"v} a:X. r5Z+55Wu筷ޢy4hЀm۶UYDf_nsuY:5_r !Geœ$ORP*wH]գQ#4lRrrriܸ@ݻwS^^NƍQJKӦ;94/ULDN8AEaa!w椓N񒝝RFFع3K.) 0! WԮ6`XTNLz2RD"Qƌy_o&55;vꫯ{ӧ^uoK%B!~.-`neҸs5,gL_VG$,J ??ύ7J֧{_f7vۭXŋ/.';{pTq#p#7,_ｷ;＋FZsmSܹк^{-8~O#*Uy}_UVquѥK:UVѫW/.BB׍±+h0QX21 ,)?&ߏa@Ьq <xbf GӦLHK+D<@܈c'uI&͚)RS IM-Y3)8@ d(fOmu"$&6m۱, 5p I.[qw~?h1M{*ۂ4$V8H۷~%?>/1ݶmhb\Ml%X{B!<$q$qb2$ zIaۇvVj_]s+>`ؑMqq +\7o&;; 0 kFq #w$x+wqsϑ7|֚YfSZZʮ]hҤ| B%jx(]%LOie޼ylٲ / ҷo_ 9r$-Z 8{/EEE={rw0f>ڴiðapO<~yfRSS4iIIIAvv6=AN~1x`֮]7YD"~KON4eلagܹ9su]KB!A4RavLiHO$q E`JCJLN=.Hh"?`Wգ ͛ӨQcj7YgAZڑGZRPP@zz:ضݻi֬@b>>SN9Buy<8т FK/ĉXt)ƍ_+`֬Y3bNƉ'Ν;2e ]v[nu] ԩSѣsM6e 2vG%wi /pYg1m4}r'3eʔč?+V0`&Mȑ#9y衇ر#Y`۷ogĈs=5JjBqLˇv],oP1_2Teb<2tF,4WA۶G0%%%R!KJt":m݁'34 @ mx뭷tKBԱ'1 Zx6tuq`0Hii)ƍc˖-e6mʕ+˱mdFeYX"6&2+(++SN;?N}YTĻArssy衇(//穧b8àA|L4]vImB!NDJ{nULXeZ}̓f(,%//@ Q` 4&P8NixHJJJ oBqoAOͶysJ$7;wd;:Wcǎ,X%Kp7'o~5\ýYgŨQp]߉mǓ-Bǎ)--{?O6mȑ#پ};;w$==#F͛#? 5aff̘_|U!\Qa`ˋZx@lt0|FmpB-B!!xNI&K?$qKr{)|ԂM6N45kH (++, еcWhy昦oO?]-zUw}O0!?k&K{Ĉn;xȐ!Ϙ13fT+F{U[#ϟ!u )$/)$.TYV^hAV&aQZ~,tk_f m۶.ǁ}Ni!gFm]x^%>Dz,:t8_~4 !’2I\H/DqSYV:6_H?kt's!8. ')K-Yܣ(Ӧ?rwȐ!|>֬YҥKB!~ 3s$>?LGZ=:ì<*MQ|Tt֍ˇ(B8v$$.O!ZQaz0 h ô0Lъ2*p:u3$+++ǧӶm[^{5.B,7uYgѶm[^|E9⸦ 6wTJVλzh))%r x< qےQJ ccJKKq]˲eQ ˗/GkW\ŋ3gSN .3W_2vXZjwoAFFF\58(LXRO6֯_gMff& ''ѣGӰaC(@{ｗ\?|f̘A=dɼ{jՊ8-[d|ԯ_I&.<Vgdd0sL'),,$ qF}QB'OƲ, F0dΜ9|׌7֭[SVVF4hL'!Bh0 $7Ln,I\rk(Ln@yI.`j-[530S{t'1+_(mFkoѣ1 5k.eee#Gf̙Gmj.bY>2\壏>=뒞R]&>q7q ) A1b͚5qrpq5T%\BNNӟp]ѣGӱcG:u'|OV~a^/^{-O>񐝝Ͳemی;=zСC80vNzV0T\UJQVVƾ}4hPrYӴj eY1b|$:8Nqq1Ǐ򘐸l6iii?+_II ߟ}_u^|ElۦwU ߿{KB!~RD0PNez20'Ϻp8u]R:-ZOs8ڵϦ4Y֡Cyꩧu> 4>|8^{-J)q,"##Ov93JB)źu֭m3h իǕW^I׮]+qAgy&y̙gI>};(--㪫7W*ՃC_VyjT/d߾}L˳>[[4MvKnҥ\s5ݻwO{ذa|zr{Un?}:ӧO"BV2I\_jDB8p)ZDŘDrh_j-BeqN櫯:H'ĉ;#oGW1?蹡4iڄW^e^%@?3<7|Mh֬Y]!HgnX)_one˃*GyÇs 7pWm6ڶmY|9 6'41MaÆo߾þO^8ٷo[lذ+;!Cf駟΃>H۶mׯ֭M6L0T:!t .×RhM$&" h_JMe|A !8"t\TibQF~s=_5=Xbڊ+0`ugʕ]R8Þ={ذa?0P(ٳgsҥK^yvڅaXEYY7ndƍ2]!8tHljĢAܞĺtM0=Ģe=V42yB:+TW4(s<G)R 6yf DǎphFYY{a֭|W8mٳ;３={nj֭[y7;|7fټ[4k֬ł\V\I߾}'NЭ[7.DvxR-[FNӧ !A$qS ӃnU p,$qB!~5LR~8p7s5אG޽mSN9!CbƍL6 233馛ۮЧO_R}0k,Zhرcxw|4MK߼y3999ٓnp8̈#[o% 1i$K޽ѣ=*.>}`Y !$.%X4hĥ"I\Z]l;vԏ[1 ɠ.K$Ы|+7w1 %KsUB//V;Aj*nC~ȑ};w[n?C>j'OfooVvv!B$q`r5PUY3L7@m\ޔzL׋& m' SNjj"abqq FeBaĉ\.~]!T$tDZu3\M;QF`pҴn:t]?!b_4J )ԪU@ ʕ+OX8eɅ'!W^í˼*Zie*B!JEmnb_:X8$!cÉG,\Ǜ~\Wqؾ};iV rNȅ%ydj8*h[V5?u:c۶i!u^WŨB!~*+N$ KE(ǗRp),Be=i$T?6e%{ds`EO?{^i\.T>;ܹsϭzIcWMUo Md"==۶ٹs'%H$¾}6n89,???95RnD;8ܹ3yN:x^4M# ~5j)={95Ni+))MhԨh<6l]ȠFb1#E!8J.I$ U$4 B<)G›I(GJZl;k?Q5^2dW?(HW 4@|~?+V ;;:0tPrss!iѢ>([l . ''EѼysVX)Smn/o .#G`.rN=TRRR$'']v1e\./3weƌo[jœO>ڵk 3j( {hڴ)$##~/裏(**ⷿ-fÆ RcB`YQt-$A,@7DYq*`ʕlڴs!GI7\Yy./p _XM1]^"aPrWDZ7B!~q0\d]9tv֑H۶=z4:u`ܸq<|,[QFQ^=RD"Lr/sPfM|>}}hSbO>}xwyגehq1fN?t }ȑ|L:T8xݻwk.x :9B!QH K"*ty HjP10DBR'BoY+KUe^$*1޽;_~9۷ow@_~(Xt) <&MGu ̪0`:teY,F޽{y衇ׯ_|ɑ|n݊mؿz4ƎiL>KbC a;vX?~xsʬ!VXTȑO`)BVZ$ШTVQUۡv!'C *<2=Wm 5Möm~myBqTtÅRN"!\|:{4 ˗($ kb;B!N]G+OnVMSUBWH~T!B4Vw}7 !ǼSX4PhTtLJezEDR?~jadg7A3).>l觿&uwiA}+]/ڊsy^6mF8J8~[v\.$pB+_GU׽ih8n@TUu]"/ߍ Ыʎ$Gw1}tJKKϸ{hҤ ƍc„ B!~?vZ1s乕R(uH$œ9s5d^d .^#%/^ioߞ^{ qvͫ믿L'Bc4=(er UI%,ėAOt|wyL nEݺbw$a,/+NdO4=D& QS%[2讴qf4P8(~$|>ii.@x={aϔ)S(.. IOOvL0{&MK/pi&,"  )**_f 6 /}xg3f ~-| b1!;;=zBqc' "I\a"I\)G@@I ܩU ڏl޼?/Fz*rss1 RPڵ%G϶v8>z22l˗z*j]vżLI7S>ꎦ~x lܮ*.B6nȀ }ӦMfܸq5 MxGٻw/<> O?4W_}5\4f͚ bX2\$o[n[laذa% CaYG{XoQF1~d/Bq.ʱg4 xxOq~c=gЦF.:^ҥ 9so5E4..wmdӦoVROkhV'In".R4`˖8+;{wŋ^d'!~f(L+`&=}fΜ̙3?dM{I&ٳ-Y%KT+WxW?#>_jBq9v4 +tDB8G0DHgc! :s,!7wK7 "|&b8r* `}?-@?^(7n'/c(+ v:vþ}y(_} we,ı  U> >2Plظbd9B!ď ,ʱ1\nV Lq0tO2ǶqXs5kBFc Y|2vH$Fjj*-⫯"Fy뭷4@ @Æ u]*8ju@ǣa>#.F(2oWmw!BMñcۊH,i`[2+Aw*W\r )))'u۶͎;Xj8L)E9N،h4ʖ-[͕?Ǣ}T`Y iUGЕvβ,f97xٳg[oqWеkdFԮ]/˗}DRMcСjՊx޲eضmg}6wqSNfڴi г袋ذav]2w\>cy'袋(**⩧o`0HfxO>4*Zv-ѪU+f͚EII a8?ǃض-D!8LDZqyR O")tqǛNaAp^q:^JF1S9BG8A5~%tj׮ @aa!Hp8RӥK|I&N͛?> nݺ@bzL  ==^{czxlFٳgXqnҤIr/-Z$&O+=%%^z;vpsWӥK `XE~x'B!x,nD%&\Va0LPQ,Taz0LP`'MAp.B)1K9AYi"{Q3dٲe1{믿~ 00p@ 5k9r$W^y%[neȐ!\r%A/_mƘ1cad,X ͝;7<}#T+_|9˗/V>cƌ*?3>튋B!8N$sǎgul ,1Zq Ӎmd`?Ioft]gҥݛiӦ%-[xS"s,38",rrrhӦ 5j૯"sEIMqq1w}7{/mj*|A&Nj*x}Y\.ms%0ql+Vпƍiض9#8 HmۉAqSGҶlT,>]דͅB!DE8ۊb}((nOhV<ۛF$TPz_7zݻ;v,g}6l2uƘ1cٳ'&LkeU~޽|t]0  @ ͂ $@Ǖ4oޜZlɭĉСJ)/^_Əϴi޽;h~?EѳgOfϞͺu'ovp05Uj紃DkүzGСuB!8T$xǟVX4XL3gbYpl[LBz/iذ!3fm"Rg+@hw^7tO?4J)233#B*E%bHZ"" ӝH,ğV`i!ĝLal۶ ׋iӦB!"Fo%siѷo_t]I&|lٲ^/H`0H$9d/B(bl۶ v_>`P(]wE,# r-p:7N~QZZJٶm7oN%Ia;0!at6m~~>sZhAÆ ĺ+W+f]tQr-իۥըQva6'SOI&,^?Mشivv/2i߾=iii@"ܶm4/֮] 瞋i,YMrꩧꫯ!G4+ĥ 'pyRq{ӰG=4b>D"<ضM߾}93mвeKnF ]vstܙݻ֭SNW^Ʉ=z0 |>@&q 6b֭ۗx<άYbذa{hƛoI O>3ƍ3sLnvR<34jԈiӦqw0qD7o.o8"t[%4#&imZ[no\s ͛7gd㩧?G)EVViΝ;3rH,bhѢ*[p}qYgo>5kFn1b]tK..=G&_~̜9uңGNnn.͚5_~ :z#0yd7n̰aظq#wGa̟?_*BqTvp ]7˓忳+%z&SQfI~߮RvywՎ5kV/b]vMΓ('zVx뭷yRW]Nje 4v'pGGӨ*}PpnY6.eq-0sL";wSNiӦmۖ:Qe s= /l.RSS|tؑ+WSVVڵkٱc;wfƌ,X>,t=kK/Mf<b1|>EEEض͎;Us+š5kz;J/BgIғIR4Mq q\$ןQ$ursTqp\7B#AYQt8jvMQF~ à2@46lӹ+mMӨY&X27n8ݻ5kҸqcكidee%j]iڴ)uԡh4Ν;ut>Ə\WC1o޼*ӽdddСC^z%8 ڶmKNNƍcL:M )**"55:u0}tnFd{. pBmB!1*z"h^sIfriZgizwqI.TDbvhhh8]/'m޼"_[!8 VMӱo:P1.O J)xp .wbZ< \V_'B!N~kNy@aV:{. "rѣ@<k-[dر(2dk֬9GB!~\'2I\_M8!Gi$v#~8IvBLƍo 7܀eY<SLaѢEk<~ !?sX0I"IIBIDE$q/?1'iԨڵC407rѹsgt=1ܹb1ׯϹ˧~Jaa!>/kײuV.䅁+VcUB!0L7q0>b.?Np2Ƕ˓(x8PBr !8)sl[hG@Z 27уG}n6m0dԩc\ve;h߾=Æ f͚1zh-ZD׮]HfI yԨQCҮ];郦i7aȐ!4hz1bZneY<{_i 0nݺ ֭ Bulۦcǎ :T D׮]b/qZjé_T,!GDBJGIQ^iځAB~,$\Cvl#iض'|eYٓӧ  m۶QJ¶*#W_}5]wgqguV)]tcȐ!|jՊZj1o<>#ׯOfxQJˌ3(,,%Kp9zjzG}Ku.֭j=СC|Ljx /^u]8\|b1RSS XE8{׭[nݻs}%\.Bˈ#شiU:! &-?oÆ #;;oʱiiihF,#_PlܸAiF4 Fiܸ1Ŕ$F۷/i)((%B|_ Be$˒IR~zڵkc&[lI)E(Jdq ;;۶ٰa c6`Pǐe+4GiG=Ff$>,Ǝ_`4hЀSN9q())y}njf߾}$ѭ[7KYY-[PRRB~~>-Z@4j֬IFF4lؐ &0gMرcݻwrvMW_^@)Ŗ-[dggӿzdeeq뭷2zhƍc=Ʒ~iFӦM9+x衇BQ]<B RYDBE)( r@Hj@>nA}~pz~~>))m{_(Jc(,}x(..Y;KKK%HX|?窼8mLӤu6̜9CFFF2@1cJ)ӓ9#{+Yh< m۶eժU@bLii)nr6gy??AӦMYjH$7d:wLN={6SNfϞfڵ@"\~{kؼy3SLmׯO$G~ѫW/Zh t !CHp.Bp4=bALǶ@-/(ԁ2''=MCӴM:KH9իqgU5Mﾓ?Nb%rhnj P\-l9yfɻ&BruWl$q;^ V`,Y54D~a ۶3e=8Re1gΜsKIII&&P_OĨFp r@`9q4LH{J]X6vnc(<@-BqdE R BܞTPx47%HhģexS2 IOa&]t7B A۬I .BN-I|)X 믉mŰh"8䓒^7Bqr8$Ï]!hYI⢑R|1]t$NEt KEl !89 TyQZ.B!1]O$3LV,Xo.7V,TJ3KE!/[bBkJQB!8v4]n8nJfyT.3\NZB!~ck(GCt!BV<Ģex|D# Ín"eB7\D"lt^$@B P*#kЅBqܹ$q$qv /g83 :h5POwT Bq| k֬|P(C/ Kzz隦a TVVs1zhP(HIbRO n09JRSS7n=PNNEEEtZ3225k?~<_(G?^{f͚C;Q5!I\ IDATC zL0o<0 *++y-;;zxyg:u*|A~0G~{W^zx< P;kذaL0)%>>nҤ < H)aҤI_<ä:7o{%ѦM;*''k;v|;v,Fbᔔqly*++ KضM^())!++|z?|ƏϞ={SLq\Rc,ğMQ)4CrWr=0rH ࡇr6ڵ+={sNٳ!'QRR_RRR6m ,'O<.W^u>E4o~'u]nj39r$s=x UW]ŰayUV%ފ >c6ѼysMFƍkxxꩧ}h-XO>ĉs=dggclذ lСCg4~O>Gg̘A$aȑr-׿ڌ?N:[o0h q5jwq<9s"(δiӘ7oW]uz+M6lܸ;0a/S\\Lvv6^z)}6mb̘1~Z;î]imsFiժ(,,W_`\B!Z W_ .rɬY*|„ Nٳ \q9D"}Y}C EaYQilSOՙL.^ E]ʕ+ j۶-wy'͛7gb16mG}%W_}̼{^F]׉̚59Ӯ];*++7o#Ff׮]L0 믿NAA%%%2ydN}ݛO<4.͛͛q\7]בR/RUԩ3TZZK/wӦM)//gҥ\pk3|>N6nXoGQf̘oN;4}Ǝ/;wiӦ >!!u$DJm۴lْCs0zhmƵ^i<3DQڵk!^pM6dرNx^5j<ʂ ڵ+ӦMC47oUW]Eii)Vbܸq\ylذh4J8fɒ%,YJ|>> [f׿;*!l2/^LFF?餤0fRSSYhÇ#Ceĉ_?Gb֭K\}<#k̛7cDzrJ***2e 'x"mvZtRg ]j˖-c֭V\ɾ}ꫝeÕW^Inn.~)>w}7o櫯bΝw}STTwYp!7fڴiRQQOee%> ^9~5j.,ƌ <у p'rh׮SL+V0f&L_|!C6l͛7+O2|æ%, 41b/s}MZZ<|\pL:v}G 5k`&EEE,]Kb&NҥKo~M7M8sS>:NbѢE޽HF|= W^\qNJN+DQ-ZDӦM7n3ҪU+ƎKaa!k֬ꫯ/wc1j(y']?OV^ͨQhҤ SL9=sk#o/h[3ܘ(-h]ZB7<\#/F-u} cЯ`$w"_57瞻w_oҥl{.Q7Pɶ ӭ۩{3Hr9ЫW/:,:,zIqq1~:1 /J#HtCzG7[3'ׅm۶ !!3Ƌ-bԩL2 y>\'[JInn.`upBO>dXnSLD왔˲4h;wdx^?:HJٰ͛a.myfL$f͚:'{I&\Gz?AҜm|֬YC"pR-]Fʳ>,mx曝u)))H)wf(((`ڵYh4zȵm֭[G$qXӦMIKK?Ƕmڵk'|B8硇v;3u]<#I<wfk3fOҭ[7.'!55ƍ3|p-Z8XƍӣG^xFaTUU1k,3gd̘1ufO3ڷoE]4M^~e|><&L`TTT{n_|#==FeҤIx<ҜAõ˗aÆCꨬ )%L:^zGbРAiӆcǒc=Fyĉy֭)))޽}UVVrYga۶&|۶mιqV^MnN۸q#[n8C5mq 0q1w\'zb=nziԨ#Gdl޼Y=f"4 ' * RҮ6&\Ut$.\?CUMӫg Q( &zø\$pB*Pl.nD"A8۶ l߾3fqIiDQΝ!CK/1e^y 4_Ni|g*^D=ݶmKJJ >H$0Μ9< &NX>}:wu~;V\,ˢn7@CTu1i$7nVnƍo>Ld\ve1'NFîgy]׹;vcv(=䓙5kǸqxwy曁dѣ]޳|qU[hQ%^|kv$ 4k̹5rq5ФI^}U}Qgf@'N'駟;ص,1cХK^~e'0 ~a,YB ޷o?O8j&=))) ?1RMRYYIUUB***IKK#33#`۶m\z饌7ɓ'ιk?0sLƎO?]3ܥ53>9;k,x駹ٵk!_qb1F#''M((( %%ƍrCX,F,;l{RpBs׹餦:@; _g\qp8sBLӤiӦH)`M7i0ؽ{7UUUA @4˵^,h֬YC-Z0k,ϟϓO>fcIp~|5pB܏7E"$@&nvo}Ѵ<-[RXXB(_g޼yݻbi[l!==]A9_}g޽3f"HngdII i2p@lFuZnرc裏3P|e ruyᇘ4iK,rrJg+W{:6s/N; HM}0bvmTTT_ҩS'Ldx≴iI]T3ۥ:a dҥjՊs9qƱ{nN'F NodN?tntmFqq1r ꫯRYYe]Fl˗/׿5}Ŷmٳ'˗/s\]םu6m>}ӱcG>c***+lB׮]q\H)uѭ[7K۶mӧwq_}HkҮ]; –-[뮻RqF***߿?W_}53gd >Sу3͙3СCzuȑ#ݻ7> k׮eС,ZșEcڴix㍬Z~ѷo_ `Æ tܙEqWӡCfΜɎ;KYf lٲΝ;4i?<׿ҥ ~)̙2e 6m7|3-[D4 yY|9ݺuc׏޽{ӢE nV8)//wߥ_~\zlBŎ7ҷ}g;^EsEuZlɚ5kh߾aM_N^%_&t$95 CYi>_m~#gK^B|h"@(Arx͑R}v/_ 1suB[jE=R2{l.BlقalْٳgcY:tK.̙3D"au۶={6Xf͚ѻwoϟOqq1Æ cϞ=Ny,]۷8FɛoyT3]t>Lrssy8p k׮eӦM\p$ 'TsΡiӦ~zz4Om۶3fa YY&MӧRJ|:}I&:5ߦi:saРAl޼krr3g~:guO<^z11bn۶7oaCȃ 't˗/_~4jԈ"6ogͻK(⢋.r;sꩧ>}8{eѢEG:sٲe gqcN~L i|>3K\3͹ $è|MGtI$ fϞMfի} {̺lْ:nos/7駟0 ,X޽{\ 㪫bܸq̚5H$Ž;Xl4ӫy.[iߣ>ttkh'i[ΠNMزe3 i#Fpjwi{Ί+ׯ| #%% /4mIEfzɼy(//gذaܹo:th"q :XE4uR'ٓƍx뭷hԨ!sN~ߪ''E/WA<Ch6Bnal3`%ޕϚX;J$niPӧOY\|>?UUa@#koBB(⣏>7ޠHV|g}YJ3b23[y<5[ s3A'&[!c9Įz<ؿ7vg5ӴiSÞر#\r eDŽ xǜȰmr-i4hWWqQYQןł1WKCtd$!!nI!; 9TV/4lɏk tK/cEff&sn ;[=z4#GDu~mOر#w}7٬YnAyiܸ!`׮]9RU'=-5br̶-, fD S4A, ++ 4xו@W3uxu!yi+))bi)E5'ÿDk!LdŇt9Lr7?Xh9_WSZZJJJzaa!c֬Y$ 8 <]!ݻwwBwAzzZ tY-Y.&MЫ1&Q;^}UgIiG72z/رc+\OXU9:&qHy$71ZcWoJw;iѨQc9眣2<ضMaa!_~Ts < kgC DFڿo)h*FU-"=W{xPBGCBP( iB'kIpuYI\7H,RBmA76!)L@@ȴ61 lHE\.*CqTB8TP( aI7$ānS$jCD_C2e wqS_RR‚  .Mؼy3_|;7nd si5v IDAT0͞={ݻ"ضM׮]UX<#s)|F"ϟO=޽;~:O~~>ݻwk׮+ٳ+Vq_PPƍر#gqݻw7{B4&Drm 5P( A14 M4TjRtÍnJ,<|"INUV4oޜYYsvMV^@JɎ;hٲ%H)9餓+>}:*}q◇dx]Q "6_(&(El&EQFE¡2=Vl޺c׮]TUU1uT^{5,b̟?7|J yG>}:<Jy6lUb<@2죏>O %l  BP(J F" pRHDe0He*tχjSO=$Pp%ӡC?sLrssKKpi&RX X4\l>4L`[&t"0Gilܸ{rJ0֭#55ݻӢE GmcÆ ߿W^yI&b u>.B8K)o~_W;/^iR芤8-ۊbVE? xa!J[L{شivaп>cG'k^m=Yf ?Dhkv… 󑗗Ǘ_~-\={:$fGu^ E–h2c8YR(P( 1 RZ\~:y]@uف<.Oh_ {A?Bt۶?~<;w?;vIJ,&NHNNgy&UUU 8CrꩧңGv 'n2^M6i", iI),HHXK׈y4Jd'55N:9BO? :!9s&QRRR=͚5cΜ9Ν;GxKlߥK6l̙3B:Ǐ{?Fu."rrrشi#۴iٳԩӏQq-duL'il,. àk׮eW(Cܷ`ZnmGS-Ы k BP(C_HU^:x!4<eHӉTfcϺnN?t!"%%N?\◭Х .YZF,F*L¶ѤXRI^ wP^YE 8X,M4q^;ޯvTii?x?5><2ReWt!DbۇoZr‰pOvP( ac(eBfuY"Fwy"?^{5u(J#epi.04Ҽ>4MI(.] 8P]<ςh\RX)Z)R"9^/TT+q#o@V BP(\8H-tG73VҶ5Ghzpx]*u:h ;&+}Qx REU\;'3#4UE*[B8.M,!{AiK+ BP4˃-j|,5&qe@V27:7H$T/UIU(OoZÀfYn42m 6V@$h۪%QzX ?׿5)))lݺrٽ{7Lv 8. x[XvM{"h2[RHj Du궦 5P( aqLBpT6pY':*lDU^LU Q7%a3 3{˩,HE1z4a4 ֣5YxG[JI"Yψ#y˲طoׯgС|\qA6l%KѣH)(rM8~@O&4idltA-A.H5}P( 1s{3:f<75YKLDӉAP JXaҡeT:5I'Lڷ"5-;ivQ[}ҧO:kcΝlݺÇ~H$BZZ㊚T5L@ep΁ B&' )jqN BP( m 0Xf zœ&qe0 o8VPA=Sj4MԠχ?@OJY>ܶ!x7:uj;vvu-[8.EzII)я^8oP( @`Vҝ=VaxHl3  I1^S+P| >3Rr;0do߾~֯_֭[iڴL-a*!lߘ1T-$dH+8BP( b&qR<4,+mAR< x˼LާPH)Ypk6yyyzꩼNy"pfUqq}S+:HA+Is8%mc^+\E+mP( Ihz$.!\Yۛ ¥RsW0.*ߧL={rJhѢΚ@ iYr%H)cРA? ~jXelajBP( Vĥ %gM3@eT,3F2Z*P)@fkYm*!77o."vЭ[7Ui_ n7\ z) BhXl۪6Knl+0V2d,3f!3`0㡨s[E8Φ\ B Zc43B) BhXjL,+ p{Rb1ܞ*tËL3ۓB4\ .A !ALd?@,P(nEC Ϣ1am 0xa2]*]P( EQc WTxSe)cən/pe!`VJ$lٲ'g4DT)!Q(>Aa!aD`K q*BP(I?؈HNJ2FDCŸjLB%U d|c]D$QߛxUW]En+˲r?B" /P](/Z8 Nzj m"kU + B8j9vƶmu)))˘Iݱ,K]f4MVZEZZ'"ΡEg%x4z0XڄvvDq.,Ė6tLUErdNEe) Bh`,34H?N{"Ϩ= $ס6'"OJIfII/8餓G5r 7p[V71Cf(/O;2BLs;nwDG"@ C#-O"8|S( B޸u/peA&qNc8I??ryi޼= m{;͛{۶meYض͝w㩬u֤9Aׯ's7aڷo… :t(\.,YBNN_:u*۶m#77wyÇpBFM<GA"N֟{quBk%"]p3ea&n۹G )%x޽mIh qq "!0BP(#i:HlR\RJ2\,t4\?%pe!nq Mn y6w}7z+ڵöþ϶mv رcڵ+۷m۶ZζUUUӱcG6nH^^Dc#`YÆ cqrssY~=ݻ`0H"4M瘇CuN9V^M,-[墨H?RB$fT*+ F6mK,eŊ\~ddd;0l0JJJy׈ǽx<6[Zhm5kЫKEuW]P( E.1 /xǶL`jʼvrݶaZTbr&5z̙35jvaEB xH$3,>3Yz5۷&x}SO=ȑ#իO?4Fb̞=뮻)%i# o߾tҥα?SRRBnn.mڴa4oޜn^zkעi۷oW7:wE/\Kn#hLcضwo6y@3OfBq܊we%c !j+%yMjj BP(QFkӴ2 Y-Н2'?w ǶmhF"&Q^^ܹs9+#\r B:wL^^^r0$H8n0 \.ux<Ό36mӟx뭷sp7ԩSˣwެ^s#ԭuXWU>g׮2֭J>c22ٶm' yRVVJQQ M檋P4H۶qlK 4òhR\P( Eb1cF*ӉJp{R&qՆpuM2 WI={_ Jwv6o×_~A4% :pnNʛoIjj*ȑ#JKKKdl۶>}p=9F"@uH)2dӟxꩧx7L1cm2gYe9=K_{{ZA(tl\"lܸN"ag}iضc6dffՅQ('$-21H4! BP(eo$.3iڸ^@@ ߤI;_o||ɜ|r-,XΝ;c&NNu!7f˖-XE"SNH) BF=z4;Ķm<}!0D߿?K.=lؽ,0 h4nT x>VG.Gu۷?X ()%ia`I;yT-) BhP8_Jc'$V] a| .×EM H$v?Q{1) )m?{oWU{1\@J!oExzVU~b[Q㥨أW[O6jR.%\Iv^s11\k[v}>ks9y~瞍tIx^fʕ]ozӛ8#kx+^/| tITUEUUp)d:>lbcXbK,`l,z,^;W@ʸ_xz}y,Xk-<Gu .6/}KI-z}Y05u333sT OUU{+(x_ p֙Z4g? I홬3s lj4z7;\b:ORBk(WUQV>\Y|ZFG'9H]r-I?~#|>pe=ozӛo}+@W#>Oݶ{ݶ}_&͛xbVXZ(YyHtUjDc$fvzs@1>c%mwMvիvu)Y1G,E/Ї;{vr]|SwpUExer-e9>9S`1;;ڵk I/(WnPDC%DEc~Y)6 gcg2:'8zvcKAvپuMv3r)i0vY^ _ϥ"[;!SSŘWN8;d4{{A|{X=k޷4Y/xz\ِ9xOxeePVUPPPPPPP0zhgV&qۧ62`~2UXLL.zfvE3I MjND,۶=?q>WO<1g՜}ُD_tElذ???>sAc~xs[&t_x_'O#!!ĈPJ\QX X^f{FthF1%tǢE׿yW.w{ǯSS^~}POog<')c^җ255e׬Y~wcnwx u]vZpWrJ6mĵ^`N 1O>>I-Zex^.SO-`ؾ};a$s ~i%/$4 guvwL_W͛7csN OWU|x/l?oO7snb\qLMM155K.5k099%\ҥK9ٲe 6l/'{ݺu{\veLOOw}[uV?>rI'qiqEqM77=y~\xze ]H&FWaப(+|Ӛe}F'H=;{me|lrK/~]M=?W{Wc~#m?x7|#q"; !tfXJUeɒ%qz=nv^tÆZ .O/Uz!l^Q:5kpgsWxqWCAD89&WR)iyN4lذ%|; /Z˥^_D/͛7}kw=7 zQi&*pZATQbf#ZEl7Nbo{L򶉅BL9E}eW3On}>/É';d#9LJ?.ַk-^Qcc {xiGD.\Hwmݺˬ b||M6199qW_x;:%^,\cذaO'7Bh#DU\xb)$nv;{џقs(J=;bSINj6:MT v{]oR~/׽v?g0`@Jo|> ,_~HWKXamo{[\Бx3Xv-Z6lEm-Qw}ϬX[n; o΢EQU9ޛ3wk{ay晥ZCbbb7O~5\Ùg ''> nNOrsriq衇B?!\s kaƧ>)~pW[[<Kۮt ƸL{)FF'iDFSFY\5F=ĝC.݇KW[/~8~8/x!<㏇ ۷_{-_N:iwܜH?'zEۊ+ִ ;k~E]h k_9w=}{.-s;K̃<Rמᒬ]Dӿ2N$c{3;W`}?k{Xۣ?~?{Ō;_`Ӝ>jW㎁a&GLo'?ns'sGIU2Oyh4n>`TQ#A#A)]PPPPPPPQƉ1MOmdlb %񽘞b 72pM_]y|;-۽oxy? N5_=QUι2 XlYCWς@2 QG |H2k!\Oۚ&ל׳Sfщ=.R39K…kgn.d6ʕGv/pmSSL=y uƍ9lߴi"ŋ1n:,Ywّ:L5çTF"ΈAY+((((((_"ۭVD 1zDus{ҿn[o7Uӷk>~/x*,rοWW"Lrgrw0==+79b%P&XAAA 8*NUAA5" 晀0`Pe|+ۖvUo+\vªп'9~5ׯoC^14 /~ꪫs+[nk-+(((x 4A!+6= O/((((((Gj7S _5O}eO?kksLY? ;~W&Z1@ f5uYA(AAAAAA#g@ DwĜ-]2pOCXV~u]ci\P0oPE55D57^g c tu]f͚y>XB`vvkX[Yeb/(Z+Mpwm?kl۶ U-y 辁W"PQu^ >p'׽jޝ]9<#"]w5 1tG!F@ nD?x(Z(zAAAAAA{/Y:|tێ8g{ !p?Ȁ v|c{*'`wJ܉C R FFz~6mO|X7#Ƈ-畇gNoJ@;ƶ B"+Q=5h+((((((o$#9,D   ѣ!5) 2$]kHj!Ob 3xz>kw)M/((((((x!rfݭv^r((M<{AAAAAA+U `sځG>`^rR^PPPPPPȡ( &ƹ⪫W |yɤ<>|ib2x 1*1GW2O=~*7==C~PSR{Kiz^AAAAAAc^'GH?e˖'ԯlmg?Y1eJ*'nf+11"*ۦf^_gMq ! ӷmF'7MOSSY(-܂"OV ,`}t*((xԈ !H9leLqBύp;ܼ`>+'طPc߅O\arr 1loe=phi."1O(\wulذ~e<vA8h a`1\EU;#5timZ k77|D5S{s Fb*`1?7h{xC*Cu]Q~HRgǗYHdtlb+sFfh$GH"I!]E#j04vg} a&_~_o wv; *suF4Jw;c0?/~jD8v;4*QkK!;a9#"XWMr:guyv?"^CQS ',5l~u*K= CRAvAZҿ0l|$ݲÉG,]1?8qj}D׹Gc1 a~x!X¿^u79l1[SYҽFPm5Mg>allaff,\wIt~sNU^8?^d86Kizbu]&@!u5 5@0 *HĸuTqXcp *P|𘃮k&xOl0DsRU^GTBTkpa F5YD( ׫pOo!O|1@f#Xgt$0o<1|5UpY16#3}&:2/b`X5BBՈu֙fXD!@S7ĦA5*Dp *bLf2+@lG|hp=K jJPf%"*>⛐I@SZk֥#L ThpЈYC4 t#鿼KFyo=iV9 ~Mw íw%v. 1A9pyyas~ώuhs>m[ ߖɵ54׾a/`6m&&'UU ƋX}׏=4֯e͚{dXkxrI{vMۿ/{8}kuZ2|[WnEI>G20(9/x: % ,;YȺujt2C!mZ Y!(( ?U5MB4N1k1DB~KZU9zUU8[aJrk՘xl!HelG^"~Uz؜Ec &x1hLYCDń$֠z!ڴM33֠x #*UKPA3(XCz6gc7mO#4.j}"> `EbHVA@lm"1|(0x%AyI$xMi<]D>#&2 T1- CF&~$ILOASC Ę"HB͞FMK#j@q$C~ŊgYy^KLR.9ŘIY^h16oeZ,ΤycLLӹ04H"Ȫ7HT5ypbC #M2qM7)@eӸcӵ4M:.I#:dEE `*,J$f5G!+Z,M@]4tFh1&E AE  DdqG eH>F:C)0oz Xސe4!>okGp_?,Ysxױ Yx!C$>q?źcYНCu.)>x#8w -08/ oM,|OÊ|s︖:wQMpM[yT=aq7n*+,۫' 9L'1x}ߩ>c)7ۤˆuuey/.^ޓ*cJU1njk׮effo 7vml޼Zlܸ!/~+y_?bpys?я◾Fo`cCRSW;X^ 8X+_Y֭p9G|F~7Oq}Qu瘜61FG!f2F b.bB B'AY&|iӴqP;/- ]i2D8l2@} @p=-VeuW*Ƈ֘N]}6Ib<TbG"=h|XASՁ6ɄL&L@x*7V 3gPTT,F@5V`qK KIBl'qmn3ըxY5RF:  Sc:jrي0jo xIG />hlY?YAQu`R9LC77#r&bQiVR0hsD 9k.6?đRIL9DRP4T0L'Iמx0à+!gˣD^8#BF mi{S׼Ǽ7ܟsG]k85+Ayo)ϚD3|F_zě2ʻ.!?_^A7tz߯}od F"z Ueff3bNG{{Abfv;ZF9#4fbJ"ߦKT0Ӥ!vQ}^8!02ԆF}P۠1"6d$g#x@"&$2Sf53#I[5vDRjL5&גA<&n|D{r&Jk-UBʒdq\h wuCMW!mmMbq Xkl A|"mݾL~o|ږ vXIuP%lhJtNT*32DC>{uܝy]8/I_OS{@[ie>]lf)P*h@>RUqpNIDTw}* IU@IbE %besB0),`R* K+A"&k\smᄉ;!A )UTQD2#U&1C2aYaEY.ajo4TXƦ2 w3l% Jb#4ڤ2 RC$ \,P hKPT"I1b:|]O@kA\{6՜pBȗ/&~;pc#!;HQ Z;ş}6}8 G<]x =gɋ[ROh*|ns :bџw~۫yqq˘m}yinCnǴ'$U*x ra{HQ] d|=0ڴ*?wq>]}2u*GUHL§u'0>{fo_2wqLOO|~ӟ77}6o^NJA<`۶)F&&p$}B=0>ŧZlh:.H3)(=c6a2bId`}[æDԺX*ȷzIoMvyi툣S.9bA# 9ѐ,ŶdY7K]gm)`Lke4. YuVb$8 >ɖxo;)k! 3TjU܈!FřtB98*\st^*1+Ah*hU.1l8YpV1u5uQ5_(h !r48(&U1o@`C\b0)b Q:MxM)D3p66/Z(JH *PUqJp=3qT ٫` % uM_'gf58[12 ֹy%^x Ql"'B 3]lqB:-)tRM $C KȊd``W4Ś[ۯk+t>/ؽ_  w_/ɇz88E昗-ǯ>d!}w7;?~+|;Cw1:sƥ/:YO"?Oo QlEׇ!3cc,Y)@`CZ˲es7"<=LgYcpN{P\ǂ +W1 Gl!=?O>nZ^ 7PL vSS%`gD,ҙuG|ٱl0B̂ӖA0QtGUAk-T6v.:ttU`ld&9`h2 경oH@(3)W&& MI1&UT S7MumTk%٦omfMc"*fP-+6ϐ#i| Ƈm,}!9߷d0$rG p$=s8'y^(!iܲwSP ə5!) L.019kPZzUkS+i^K{(&./XÈ1:j iQq1=2+d=͆_2\˞ ϴd[!f5FYX2!k!J1V,޽rWehfkF2mRmK-pW!} d١)V%cd$u((&s)])h4uRU2Գy&$JjL!$Ÿ,'FO!ɟ$616Iߛ)(`*kc1i|Ci0DҨS =sۆY~eD+p }3y㿿}Ż~>|ټͳd2XjCUAo<.5ZP_>s?}+&w>ko̬gE,/?unׁΝwmatK'(Qnbvϊ+g6fUU;x=l`6N>-ji dK<r/;H9*ZsޛkG7(Ύ*'l, 1k 9W̴RR q-.&ڟLs8!W;g,j-N]&Pn9xZxβƀH|&iߚT%oy4FLUAd٤Ɖt!F*u[D>tgpirToKvQ U1KHWll"B1\SJZ[c ՉC"VU[S)ت0!Z{1eFQu+}LoDž.:Ȏ:\Bl:枭0@`r !mY*kH0 SyruBԽfcCbhv"izH c*\e* (rmv+78I$4||% .ᰋsI`H~ˊna69ZD$NbFTkC)4/0is*r]g]_gUXcS!Fz?\*{;GFF9Wue!4\ ]*riiu&x$2tygsv=ag,9mڮXm,\.`K֒PU#Y^Mr5FFzuS@pP 32J5F88 Ck{[+8^3l ٝ-0bU%r*X)g|ro`CDqcsJ +XRp!{%d1.KRWg@-m4ɦeY1В6VJĎGֈ͆yJ6k-Rj6,Q$O"uK3:DVV@rzkاm7:}u.wu!#}1l3PS8D\ր5#FTT}uM5=[`צ;='<1b,Fad9w,,K;>d!6#LL U{7%rT؊rUezL~[TUE{ߟƒ%{9ˀc-O y͉'3#u]sw~rB FE$`xVC6fАpin\SxZ2C$jүk3{+mB(c64S IfL+ !-Д@G<OC&Q1;r#UZ;%gdx5N6^Y3heS Fșb5D1B.HEbȆ0@ɭ[K>lZIk6=I澓 >f@Jd:!)9mkzCrx6l;Ō Q5533SDϹTi쐫MJ hQ-lm^!7v2@Dh&s 򩯻hRR:$@5":T?S2UQaЄ.XXĿy睬Y#p~U ?{ڠ"@;~;{G#}Ѿ&?JcG~u*((+I%L|&},Wt=UH퓋i'۹f)"*uٍʹ8#/3Xtޫdz;CMo| ccc$K]wv@5pLUֽDr7 0ThP~6ϖ{y[|^זp<ݔTbHפ{PlZ~x B$꛲1ҵ,KV9ŸtL!= VNR+v3tx6 3h$HCŶ{U2A$o稬,a\}[~)(! |&O>]oSgH=ۧn|r Ч !‡mkbiW$Qe$N--U"#5QUޗKVUgk}iEAA1* Jy0O!#D (1BAp@A% MCkZ{M<[U9u Z3OM^T0I#Vؔ{ qàW+Db Y3 &4nDb^XW0*@۴j =? Cwz~.YԈ}gXA#o5ِǓQ{HF߮6 F (ޗ" ~O/̡VxsvOdq1W0F1F Kڻ0%p&t7{X#O[ف耤0wu#%vcvVH,1D;<DL(JFcY(_(#)`y/y)1C &N #ƈ؟;'aЍw.At C{竇oaH;v`;upD4GU+ O$V JuZ!PBt@Ȁz;PrX  P0 IDAT\d袯)0J&X6S[OaMAE'y]0ń;t9#G( J'ihg5p &lxh[h 5;F y_޻ثj]Cj [bHS$PM(AP%e?oئ0 >Ķ8|<Km ݕJ Ml䶩ޢo{ĿnYWl Ҿv''n ^ \|G0_p bɒ=qWK/W\k+.׿q:,òeƍGbW.`io+#ypOW]}Mci7oI躌 67;;ǢE "ϏLx_ fƦM1;r7nŋPJ<^zaF`ӦMQWXxтaDU6l-  7mp{C׵9m~1;;ӞWUaF䜢6m K~ذaFW]u5.Gظq#N|Kp֧Nomf&}[; _*wgkYWϟ0N|17+׾~.>CD;q|.3cnnK.rθADh4իqgcvvzիnM7"t] .+WLQSx{ ktR NӉ"0*䲵ڛ P4OEtr_hׯXm] 9Y(9`1C+Wc7=![{(eܣ7> `U!`A1ɟ9¸2rft3k.r2w-6pt VDddQčHTK&de50@Rbt]`)Jߣ1w 0BDL̩ gj5HTk_;ѼF?knRǜe,?Q&jz ԕ"rBMbZ J z@#4 $;0ԹEh( Xm賀_`6==DBr:[' ŧo(O-M!粷!`QnKjeW RFq7)vlf'? >kBw/p"t+On~{~UD]d5ke}4lݍP\_ _ckv?G<K|g:|K.,_vmƍ?}5ngx_ .!v}Wugvwqҟqo ¿|Xt  {/{pπ#8/=; D58ak%/x+qӆ8WG?{CN8^/#WvÉu޿;^p?Ovux㞆 ~:p5>b4pḛr։u1y ;8tAx /333xހ<GuV^y{xK^o| "tM`f,Zq'BDg?'t6n܈; {,O/K<駟>=u1af2j9@r%U%Te -*2ҋwoGG3~ ]̀$ 0Xc.wogHSDq M Xhsrs SZLnL0l$ܚ v%"-Ǭ* I9ZeO30񡁈aVc%j㘐F)/)</|P{"ƍo8keA>7ݴo}{p Ay9!1:^#p~/yk>p<Oy91]0ah]hq3ubw?y8cpgbn't Ї>ycamocXZ __N8k֬ҥKqԧbժU8쳧;}7'2oL)S%Z(#ԸD.fPjKkpqJr@ff3qp799Ş"A&#Tϯ;K)^Bsv;x#Jj`m"_rte[dLh_aDK51LR:XsS9}KDKƧ~,^<7]"s` e".!qgE?#k! Lɉlk}Ым^PvdOp*68DP%XMWe f֤p0jU-Z~W=|0Sjj;{&FJQBg ^˜ٚSt'xK5׮AΗcn/q?X̿{.]ڪ2p}"'a=} ~'yXz}PD"\c/˗#YE|o67{y(~!GΌa_'R&paAJ$o_rqe)$|gO8`ٲmpNA2c'ʬ+= 3JX?`<߁g>gq\r%7a]vgR xv}6J՜/'?Wn?07tIO<{^WNt- f '$ g~|ܜKl5]TskQ~uC??<0$6TfR =SwۨJ JDvdkoh\0^5~JmajMm/nh5MXq?dw9dX (}"D8g`3Q<`<$ހ0 &h1979<+W>6meY3Cc<[ƌh1at|qO7MQ0bzOnv=~K*@k~Sam3= w"wW@"9MEnFT-"}#~r)3<?OsOS>hoƾ౷0~8?p>x^6u\jNQ܋晔P5ד5K`j)!^5I:^{t$`a\.Oa4AQT[02epH0h"ǥI3gHiXh("'w3a\{Lzi!:c JmƂ@C=@SFg RI9-,fgɺwkS'̌#u[0ͣDZ:g5=}bgMB4 B9sqٺ L2F"BK w)*(ԉx78Vߛ8; ١N2&suۇLA"*!U1cD:y wԃJyH-" {GX_+grN{A0#b4(+u<='b@A{?Jon1aO1ϚמSED7^6yqMO(!3Ÿ׭SOtMnNJx0]>gc̶e`͚58pW⦛6FFx"D}a;7?}/ǃ2cf6lR| >8lܸ 7ܰ8?#dax{+-0`m v躌]w|S33g}xAY:q}$Wo?`1/bmY,^n< +t8To}k9{?w<>Zq!x)b|{knƙ` K.)'{<9%lڴ˖m7b އŋ5u%K5gP5lRzc0??F;O~viF v˶ţ~X#7ĄU='={!3N{7V]t1E0/|r:bm ?6mڄ+V?ƍ'>^z)>hYg;}=^vmמe/{>O`8s;~(>kOc䖎ޏ c!bsKINfb VQJUX@Rra*vM:V4JuEE~v] 5E0S})%t뵶LgP*S5Cg EP =BE1 J[ QGNXnÖR{H%bl43_N 9z/<|w^6l؀Kq{ҝ/p N8x7`7aŊpQŢEęg+>QloB)yfI'}>?;l1'>1Nx O^^GDp%9眃ڵk$"5&k1w;L-=fkf[c9h՘o+ؽ㉶ZnnmvL{?Uek?Oy˖?4LOƞ{/V¡zȚ_>/w_nZ._9eK(2z@Q차`ْgM7vt:Woz+2{лJ9mfFhSKVX7Ki2b<]$YRNL)!.GkP`9^X^RpK5%n)%d͞$ wy.my[Jm_J37CZYpGm&Ovs&@Cgwx>ɜM.: Kg WlJ)$'pV Bӽ5 3&0'ǹ T:Ea vI} nBڬ~3R񡈄p?8[Kw3 Xj W[p"(0*}L(U(aEeY:)jސSŒ E3kML8q<" H{t9~XkDB@adħk~; 6lX3pypG>o[0="˿v<.2Y3*vռ-A"AzYtc[[[-ۡZp2)Eonm;n ߖ:ytMtMׯ^U_7"dUAyZܨôytS-]ox!=*mRqϫ!!Mk{EpcFVW@ǤHHT(j8yioA)c.hkOp úL'R« @Rɖmê6 6CP&H 2<4jaR)& a^ohk*:},y".n22rr~fn=ʾ*ʙ"}4<`y5J8yR7El%4怭&9 :5EgwDo`9WPZ𗘁L})S.",wD(֣{b}^HtuRA5 6pM($`I_>%nx(R~ vV$[Mr 4sTS;ֵ~/ 98`'F$ʇ iѥ.'t0G,*=EِI`ꟍZWkfx !~rѧ "C^ Jqm'9 mAC"_3 *`< >̀Š ZG+>'FN+6d`wSz<{c͚s⨣k(/c<*֭ls? .*VP-~`gq ]wozxʕ+o5@_#8&T4q隮+|M(bi[yt2EcE02Vc!ҬU%A+q2-Aœ3ePwfE3JN t a,27@Z6Pl K%0duR?ew9!er:y!ꠢK)G^0FsePgYK@[ۃʲz5+#Ψtyd"ݻ>vf+$.f!%FV%V)K٥QV]fYƈ4R]HDڏ(47;8rWbG S~/`*DCfh7 ѡ}-lCO"2Dz邾ZHyʻڶ7f&|`V8;iFZ \{Y- _? s^G;A?T 8Hd6hȝACW 4jFEAGy؃#D|~A4PL .5ŧ_5]u_˗/QGG<0{_cl xۀg֯,!0?k֬÷0^{= _ނR$c .x߆q-ĢE~8ScmNY隮隮;iT3"@ѸTBY[Qb:nI{#[7k E\yeN(啽 mRZsȁ\[Kx)7R;**~n V7"qB!1~jyյ. h~m~dG0VÉ&u!%uCW߳hU1J-I $:g$垙ƞT/8eъ=, C*!zk$&֠ZmdD؎l5LFbFzG{3pH~10萑oTb\ƀ<p0-Nj/{y'0=e P K0]"n8>Ih6;Փ,1a萟U*8j9[c\)  Pn@ իxohwc)0?d "y\&)Q``Y >(ϧQrL:g@S <5MGO 1M5]5+hKnR];M DKqՋq=RΫ݀t1.t)~Xy˗ohvv_FLU`42Ex)z/ο_J <>U:L0 @QAf .|v^c{5[o1|HQve ./80$\lPM(mFP8J 4<殬%ҏЂiD)R'Ec .HTDrG+BaBL9֬l %'%n4Kk5Eh!G_g ֗u 48yMLaaf> (H#O0,, 7yݹV$"B5> "Yh FSͦ$W |Į>1kc˄#y/qQJBF]H RPzOV .-'&㜸&32")y"p0;[ pxCCGEUZAa5!*隮;aA@JbAX8OcݺyXQĹ)qO=\q/}7p5t۽ /©9_O~8탧x3>]~%L?혖 3]5]5]w7dNAVf &vic"'BW4'[8bʝ˧+gp L)n /WS.ǵ3'gg]t- iBc%m ΫYkL!xyߴ3zJ2\hHk'u04{v\0t[ڄlD\0"u%9LL@{H eK*ab %@v-ך?'!a"eA&e}hRkk)HOBβ{.l;) ,jͼFN3ؿ؞C2[ {z>P g1,k3 r@C.()H8yVBʾ}UF&i 6f`,h@,>( )xׇc6vV8;h^:b 9 1F<"Z".iVe rOZds fi#Ο%ĉ:פ9.#w9;؄K%B.=/P8 ߱)A[^9Νw\^"M ѫ5   g?)bAxޖ77u0BS Z35 kmec2ȫ'^o5g3 *C`V\iUobpPЉLľVvbӠ1J:6a>%͚A.1qz1 qS3dj1KNQGݚibS#ːSh*H(<4NhKU ?>@d/zsmWJܧk~ ¶n>@r; `t=, R<< b·2HR@5SbpJ2g(G">+M@n8) R ;R2+Dx^ fQ#h͙bOrgpG!#(2gf$zDܱӥ;^DQJA/دϺu?-k*_h L#ދb oPƓl|nz\yոuqq5]5]wo5@^tG;k#[9lřSqvOQ4 BȣaM)qES0UrwcՊ9! $g&pT4%&t]F_#j%*apP<$(+ Rmw *%(H7{&0shG]K\{Ձ꟧ J`EY$?"^d!M S1J)P1DڍZG(%daH|םբ=`)R֫rXM g!3ԫT\Ll ʺpqăޥ٨*z ra&ewHޛ=)T`=,}0f@..͇İՐ0H4A|R,TyZ!C!q?j0 ^sC(VTYx"c ki8m nz$ jn3G[|DٙvQ?oЙ@"Zq #k뮽jxmrufggɏƓ#N=9Xvދ~:[ժZyvf1եu=<4 !%٫R6^ĩkAq؜E6#9(}/).kS4 5+#W;8#wR`J0 y"$({]M|n]`0)*\mOѵ tm_t>#%DZ kc:בƀC*5a&<ޢC^՚\\Mї)%XOFx͇P6z@H/iBH"-NsPe'5N!{Y)P"=PȽ̑,%(ɚ+l5^}d TiѶ͕#*RO3cT/ 6BR3HOzJAvE٤$ ЉA(9+ u/:d`"U=1PdRo &q:=1?+b1Q64*UL&'Z"xZ&)D%RhnO 隮N VX~#<ڴiӭ >Z @o< Xd1-G?:O|O5]ț7o`ʄ 8ֈ= }7;)wȹVr& gvR^uL9%Auw61uFHQD`VFyk/" +e2USWAbR)kx)y'WAPu_gz4,n2p ] p pFR`S%0Ruǜ2RL♐˨RaI͇"i^LN-{ERƞo,HZ0=C p{;ȅ 7 3Qι#fw<âEKX{'\Jtz<(twc9kx͌hbSA~Bֵ^?kC>8cΔ}SLQ7cnfH]f9\D!áx7A>@kj|?}%CvL9V`@t Q Z A S&эfc.!A }Qd8OtM]{]7o\uUwlڴ1[mk!reStz?ryaf/~dНK)隮W՞7l R—," p,PKhe>mխLiQg}6H)1iX}?E+QXMC>Rs✑k>=[eb%Xne R'Io L`U9Xak2jQ@hNn!ĭаZfyκC ZQ+nDPl/q 5 3 K˵;1H*7>A)w<"}c<UϹҐ IO56;^z: jk};pb?U֬rH9Ž`)Q!W) ǂ~3@J_xx[@(e*UL`6RE9 5KLgi0آ3ZOkqЍWioGuβf)E,W愮KF3ȣ8 {DXB $rmi^{MlLFz.*^?-e5Ou `Ph W┠L`5sؕ&OIo ࢵ/R+8* aO}/{ 9rAZ_l0#Qu #^$u {5!~(`"w."sQs&> e+r}92ϺW2e2|JkG#̌:W5PT)[d뮶"jַ5/saÆ iNtM׉癙Ab9!g r"ƨG=en[ }CȕF IDATƥp)]۶fggo#k~t=%u ʸoL3 3GPlT <˙ZB{C=JmMU r)x]dGF`ԍ< e7=rv0a3A)|Qzߎ*+F%" j%T+@)A#{\O#]2x6ts): 2ezPt{kRtw =1εN\'\!$b Rv֪n?,ZbKmtRmU7UXmtapN\$;cms AA;kosεy~3n0]ϫ=`Va(+ EtJм KANDDD2!s #B +ʜcJi>Bƹ6s4E88X0j,Zʌ%ms >s>HtMCR~Pǯkǀ&J jISI$Zz4 J˞$hЙ#h 4BֲQa8ڔ"}f!cG)⺚ݦ-o5jPG$3R)BlO@B>͠鈏)~4#l6:Y,5ݖO?" l~%QJA]~ĔhdjAj=I1 bnc8̆T%]Rr1Ec`Z'n.IV3]B .(;k(L 56q-( m]5f7!cMgMy13xLfcu/)U@&w̹ϱ ~b(3: @)"Kl݀NÐn Eg* s3 G}fT.m@%F'@nXm6͆8b)>vu9Lѐ篺?1,m}Lk6Y# 8 m_hW1fT[8h@r!%|韎>)GORgf;m(܂v dă ᛏ{ %b+4Mj^; W" vm>2x@"3>iP5 k&T!yL<6L ,aTL"q(4}r2SG",&ky58ُ4(u̥r,;/zn*ۭmoj!вe*!a. GдZ65:D-y#^-B>A!cHU.=O lFuC c|Y6Os $[ʂTd#7lCٹx>No' / iDQMDZC,uPx 3_|lKr>f 2 F/N@hV F ]92,}i )h sXnhi9[ ?3JlM)S'ye$`ᩇl1P߼:RhC`a-f!co3t zR DVs%9D┮{k=q6쩶q}6gSgL_<u2hJ˙|N9"TC` 8|l+P$pp+z@|ȳqDU`7*{>] Qrp\ cRzi)E%U/C ^{X2Z`eR+j!<"(njjIg٢q ^d^G_n|wJ<}4^yͯ "zlZJ=vO#{OVzK`]4 X{ \zsx>d&`x(CAڭ-7{Ǭ'Dkjú3hfAk1Z|HƒѪ綐 X1Q1<83u Xl,}B0fv{OM x^WLxX,arqa0gfgnhݡ0497G'!A;wmP:sp=)ж{xP0ᜡf? qĘлk+&TyX(%|8ұR=2"n$W`'(lDЙ&J %瀺Zl#ٿ g}&x*-lUqMJCqzٵ2"!$ȈX;a9V[mV[mV<>@07˷Th%t˅=]aAz׸!>@a\ܠN(Ty6ZEvYlM5#\bVК+uӣ;u='[w=y 'J+7F,`=sv:R+vXYC6I=#(g|@F!!yDVH}oGf䓦=`3lAI~6ec8ؠF򅈄YD\zErw7P&~4HP@Kyݭ7t n! j5<} *á]QD&Dc3"׽@UR @h0myBt rɇAa"v7 AvSH9 9#R=$RA%m栨q {8lGgt٨jA- AAC9, bH砈Q, :6k.1|HPlk{jjg1R}?j=2 ="Cx4. ĄZWVSUmT|UlGÂRZ4g4Q`JAJ9C{)=7 1 GHR=|rxTxcۺ\QEJ(J* b?8a<Z׆ ]xz)=DjfLl /p2'12X1;HfV028-,Z"K!rcn=7TC c0dTTDrW pĠ1 I]GM֠s!H 8`.pAan1 [4鱮|gW | T%)RHF9id[@D`ĿGR5 T[pE :+4i+k(/@21HS3XduzL:"`75(dyz1{%DҵD9CCae[<6Q )T>`Tʆ%.Pn ^c]զ-ejjv9/`Z4dqW;2:vR5DJh vQzC7Xۊw)f8Kfr[nǔDR)1j js Rw@{!5AHʆwaG?FzyU,6Eb玞Zs6ZP*p06)R:Irpq=@l˂dc"7}u&d!(/^;;T)lG޺Y gR i]()K3`)5V׊ 1Sh js8,%b2O~v˷<2kƻÍaG; k0zOX%A9z[lb& 5"d}mAӯ^ D)Sn]#7* - S$yKƊm)1v¬$t 5}fxccP7" g Ci>&޽ߔGs;c̒iOYv44=\PFxׄxq47 #'Ǽ6p6L|}gX qMZo+ԁ`h]{lڂ̿h[79RQ AHdar!a^kb57Ԟj0ϭ\>cǑyχs͠#=#u@%I"Y|-E>׆4 x6"\{QxMپ9+T8\ t3PTc%" 9 a@R46+ 4'|y1@nG$[XT3  8ëSd<ΎثءA=^WgXKB,V"%3m P ́fy>W?3V[=ΡS7G_hA>]3q%~(ĥ=8.qj+ov8yuK ?*2+Ry3^籤uh't 13JhئW|bCNز!iލgfmQIldF8 龪8=6Ԧ=)7Cn"@L@M2ːcz[W ?C~=~m'EPzl*ËRv=!qGײsC]4KClKߗ3ӎC; 9px. AAZ_SA{GIfQKM^@lޠ \4Ex>%ܥǽ2IڸB5CZ)_8NQ>TX;j) ?D.^8gښ0?hՈO#T Yؚ\'c#G@DhNOP#aFZ8)րun wD|1< a/TPuP.=}$.w%?htphxSDȁ0,qn"s|xc4x`4p)C@:s^5|`0 nhM5D #Z%#!XXCөVB"bg! @*"kfWadeV:_9𙎇f%S L} n}ߵ8hv1^n@Ni6\qɇO:'ގg ]/|SlV['ֆh ->T@E^9!av(hy[{P)QA5\[J h6;z7hLdJsy–3SFӥ#,#4vQ ]2h p;<3Uf$U) e`H . 9/Lg4Sxp 1$ZW| mj(RF2C8$R- (UE5 ZkqQJ9K4X7FFeV{-6=huI Eg[|{^1O s/|4'|Rpش"{7#:h@&=lq[o(\P>w^UޠgNHP*CQ855Iggt @3 ?[; A|gfH)L~DR@No<%Hb$SDyo bK& "| $Hr0 y_1kmy [_6 D@.iUp<\8];v}{X#TaKâ p(1"Rc85[mEvbO^k/70 ={_~o|?7pnoV[۟_B)_'eHcb*?ifKk6ƣG"ePhhg.9ݢuz4)MubNϻG씍;4("P#߶*WQ$sIId\*|>eTwl0N `kzhVJʝC:vrDThK y̨TpQ=@R%6k[aw.VGxV%adrd.=݃l/"Ė60ÜLŜ&7|]Rh8`5@mҦsD8XsR|ܘ$E} _ ESzV 6SQW $WR;x ,6آ 9i:8 kט3y_h8-%m16col3w09BUpR}#!$1i1k°nE"5ЧB0z^[mT_q'o>u7=.~2!=;s{^yO[g>+B|-\tX.7[.{C'?߀p]w״AYF IDATGyϟG};[mV_Ͻc Իf (VQ$6jhp(sNqkR+G[khMulV f35Y)$NjElKf3 GFi@̀{Vx1xH84"F#' -pPyn'ɞ8w"A|&v; KzKks@~`{Wf>=6N0L%%C$bADי)dM/orA\PezC8;h&jc:}OPrlHc@Sm; An n : \MU8 >w^ƠS*+.-|8iju0| _Yלŧ>u'p3O'{;<9ߍZ ᢓ/ӟ4,hDZﶯn| "|5\K/o}[馛g= ku]qE/zwUz~{pӟ4|\*n6q8}4~G~d;[mV_EDP uxa艈`N2O PL&@H R4%XjOv r٠Z4?[S S)ܵs6הd T3!7OuAxF%ٝy&r q^@0Rpك[zNppå Kxu{9IbpAi8<CwUG3,xTgs4t!'£8oB3j&I%@(:z>&7[mw[B}~ gx pw#zRد"\u]/x.%7gpz=??oxހ7͸{Dz,_<)O_8<<ě&vm.,aQ,˂|7 V[mu֜3 ųq0~c0Cx P"+2 a Z;'5F|Uz=q2F8|RjdX5_=8] #r-]c JA6Q ߹G ύz0!9Vt9qR}Çh2ļ旜AU1wo mF\h`^*^N=m6 x rZ 188Pȡ=2׶W N,DcggN(7%sZfmx_y kɛ,%߅Zl~R$㵖К)D9a \>̊ C@F?vMfBkç(&"yD!32y( s`橫kl&НVG翩¤JRJenYpcCrx$!3}Oz$̐KbBjE&4j(81oƶj=*Ӿ!"$Cqp( z;ң|~ wn:]pע֊ 7܀7͸kg???x^W;OOn V[m_`A)WGwWjn I]Y[bo.톦k[My)ن()L\@Klr#Kځ6o*asSr׌xBl]n[yh=xU7Q]k0 w,@=⸰,LPDIaG6D9lưd 1-:ӾJT 8Dh^,%ź\áP{fX;B[D[NBXjaK%gh-Vefp'-RΒƕ9ZBJ}f)H?ހ9E$ ASj*sbϡ  Մ1ɼGʠJ(pN($(^0ߠ{&pkmwLφ4 9Ā&l.^)A"#=AWP] \5ǐǺC.>+|6QT!e\_C&+ϟ3W UXC`)d:G.m~4瞛1h ̑3\ 퉳&#˗oZkhuןs(ZkO>soKOwǝwމ}c8{,qxGqvWDYP/V0>uX̀>d@]*ciJ{xƦͲiûلzeF?׺+OA- 'ְ6 R&wC%"ѯuxGn$XgN(T.Gr9SWr'pX)ނvP!|? `vfI$>0y<9ˆuVAY*88ax#,sG\&{RFz+ph.>080j] R`0 GZSJsPL,39!.q- 7])K3okU[a":>=3A3sFfx w RPXͦ0  A.KUA0s6X| |@9XHI5FQv]{GS=[JMPF& kAOe/{?5w+c3UW][mտ`F'6 ts79r$r n@T`yY䎞MvEמ43MaDIe#41Cx5oM{ȍCN- }Rcd3/l )f)cPDeOs38RboQrc.^;CB(/*C+అdSII s%i<222%tw0+hk 1W ];Zc )1*؁(Ӟ!/l73YE|¦,g\l:[ Jc`f:z0'hQTǭq{'j,߳p! <]w݅5B{ SDvX,!s«ڽÚ& DAɥ\7/w4q5Dsۢ Vnh jȌ&yۧ:6kkhC{4TI4#]-~h71tԍsOTJ3*hClfX[0<%A2=|GFx "0"휾fN€>,(W""6 1ahf9>iCl.)t#B044dvfM S4Gtܐfb FxtWF%i zg#p%0k<ՐkH1{nraP{!D{l QqhZ T#64e8?=6.8`gPƮ)4da{1`[D%Xc`,!0>3nhV쎎ӏV[=o\&hw;?7/{>N<ٻSNSpɓ8}4."9sGGG>Vb1Y(&۞Pi~GN 4v\"zuú62<5)1یr[mװ+MK6HRq\'yVR}KC+9}mŔȶ&^l IDAT"eAKEWhUF*\ӿ9g0qϏiF-;?GGDp%8;:9C]F~l#;; eF03Π}d1B4{h&urH)/3(k>az17ed ?9`(1B{Iޱ; A=6ڂL&Gf#2 59F=8,9Ƞy;oe7@-~p'Z HV5ցn i΂]*`0[{1J&Cem㽆ĝc|q)<)OA]qxxd$j5c'RPK& W\xG}k൯}- 'Oħ? kw}7~g/-߂ċ_b| _+^ _=JxXr <9u]3û:woFyspy睸{w}sq㮻‡?a||W^y%{Nooկ~ \|x _wxs 8}4jx+_'Nodzl< O?y|!V[mIwB@)@ɼoFcsw_#4) h-e)L}f2)-[yI I4\Y$+W^,.KJ:լ)̇zVE).I7")Ϙ\LkK8V_ֶ֮q1} `Y*0P9lFDuzE҇uսg9=aj]ӢHA)Avѭ`' AÀ)M؇nXZz|RrRspi͏ 諃3S^1`%%!p,'49WRaeMC|!f ѣ3O冺,An=Λh6͇w*9,`ԖÚU80TAwLuiGSehxu(d`p6%BC)(5Υ )sا[n 9u ΂\g)h́Do@xBUA pk9dvρBE #aTvd`1Ho31(6x!B-'O`eojM.IOz"~͈XU47t#>xWxl"`灻ܹss[}ܹyt?&'">}={=Zk?~'O̙3hᡇɓ8{,vyܹ GSpY<p9]M3gw~z\ve|#^Ξ=;/ٳg~qۜCA(J656@V@B-I#VI$hE35䷪#,V}6M;e~m;2gs}99v $ D+QE%A!DE@%>S)Uh FI)Rñ5wc\'6NUjȱ>{\s5{lPjHK4, i[>ca Zp8T,g (k[QD"5tN-2]k<.Ihu2B ^8 ֺ$mݰJwznS|" P]RGrHGYk !Ϝamcs䒾eu ʐc#`LO{g{W>d\K`ȷO7؂ st;PijYM.,e猥B!WYb "2/܂8OB1(ag$ύ%0$xӉ9p#U/ιv h R~q#'0#ox  ) /(1 xÕ` T.1I7 OȯDV=q@gdMDppS k_a KH2R\ - d|u7I'"Jp/(E&@^&OxO <3X{7z Nj |_7{߈7nmWnvUAN멧7sҀ>ڈ=+5 ?r_җryyVU/2^ KϔRkkYrT6f{^4븦.g"5V̒ h(T & t$RG`)=5#rF`#;sC]{k\G?ҽAX`H=P4=uIbxf + ?EwNw COiaDHE w=؈y6[:qQyl6^PfT PRKK kGgnY2&OkoްЌe) @WE)1`3Rv"+ֳA_Ѻ¬2z@ R8"@ܼ{zćRn ArfKWQ4}ɃS9³ANƳYlihMz Rv#'~qY:~cF@pqYbP*85 K(u= 8#s{??2v@{)y f...{hCl֋cGj@9q-9s~(f$00O q>aKߣ5^{}ᢓ W\]ׯw]kߎ;n _w~׮J9o^]j?a_;ށ3-oc=wǣ>=x@D׾6N}x'._K.*^<x~ws~?˿g^:Ɵ7wqG 1q=OO#}{yyٟ#<{ w~a<sC^{mЙPMhnL/ 22d$cmEamhjpR\+, N%87q68b e mmL2x0[nCzkxL)=)f3ϭvu֤RGLՠMw ( ws-JVq&^F =3t2=JTU ,XK)͉@ےNF:8W*3dYPrۏ!'rlɱ1uLD;Uqǵ@ln㢭uE汰@VCkT.qwGML|؀fQpI !9LiDH3dc [tTQBM ! mcDQӻXcyCn-79@PvX \(\y&@2pvspFE;ԐSR ш |L  zHLa)\T ('߬рIxLB؀݂^+!dD'{/\ T׾o>M|3~O~+׿/ /ڵk7wcX 'q=G}_??Z+}Q-֊|>"}݇k׮MYȏ̌ߎ3<"[V YPkG>\~z׻yz?D6;N\|ǝwމ;.]Bk /_ggg1|_Ʋ,xG77pw}ݸz* {oy׮]Í7p~~so"iuE)N&nw]A d  %֜-G IJt26Rr5px;Ձj܈fb ",;S7f#xkSB2 ҈:[׎j/\a_ n#'5K&Jk|"pkz_?|oɿSO='|wy~~;;~xpwo}^ UQG3, }xw_;mm2}"~:_wޏW}7˗/~wӼs_ Ir\20edZh="Ӏ/3e Z9֍{̹Śg hg;Vk׀WKPIWG1bҴgkG ~H3?@@%0E7E_c.Tf¨RQbI?kl"!sopH11 ;L뺢7-qL.֎;Z_ QaSsI{̽pqeP{;66ݜb@8oV` y1е5Payl9b3 -@d&XJMé:5D?Fe6#tS0Y:B,bn=<sx>hI 7Є.ѺGXkp "Zs>47c2oS!dC;~l$v3ҥ)E Gkq$uRhf!swXQ%<ϗK|I 7~1 Ŋ+g8]afG6KUO%@)ssTH0Лb][J ̙H0a.6+rUÞtkid{qID`̰Wk*H}w<~ m<_o؇'9\=qkd+23\T=}R2ǀi#v,1HJ^t8i.yέd7/<_#6R.ٸw=j/ yzSȰó۳h"~t g*5 -ú )Wo є&+V Pg3Qg@-t 5˼瘸Ƿp҆w̆Y&Gg6>'9""r1 gf6%'C  tV0ޑ2-f2b-R3\8tGoшH X :K9dHذ1|H>ڄ-p&8NHT [y^Lis KFC QyR Dyd2{2y[($,C)|~p n@wܤN[֠yq+k3.DŽ -o$ Z>^ӘeA %7Fh l Pp E`;Nj# sCd uHi(9p 9l1>7'ᘯ^z%ow w  wǻncDkP`Rik^]Rz'$Slf_"AedF$ z“ d5]zG?<(F$!Fńo5d`qtur2eÝ-}aylr@R!sG-Z<1&t7EW"`E SB;k䪊0zH B n7 |YR>0ubH Ɤp{zѱ΋7Ѻ7~!*!EPK6yu54 !S \cC[x, GW&R(RтiZ<Ą#"^aD BJSV#N^Il >PZh"nn9f:=P S4/,u@%ޤyڂ=rKGYFXAP|? {|CϡZ a 2!Ip>o4> h6Ѭ]%"#,rEܫ8I$N6ȘMNލ?2Ơ܉o7mn`^:߇@XSo>8;;åK;;xӛ_"nܸׯ~~ gp%w}y&{1~^{}rF`yJF:J?/߻v:rˎˋnSCbpj mMX1 Z `k$S@ &wRFXGlЉ$~ jƖ hv¢̴E:خNFY2BzGo ]q;k rST JEw5<잲[D6}zkt K6zM~ 1";E{?s8\,"8C@=|6 o*X3VRMڠXbUw12sϤD*BњGi6ʇsvGq!c0)%n6K"|L{,K\Y Dm#Pئԝs%=7-Y@HzQErSbp0@u]sQd;agtU{- #MYs9n!$Rg\r# "q6, RJa<+g.xFq$~PHoC-c>"`र-Z#c~``>Қ5n?m|WKo~gʌ#7=PTLa oo~pIHG>K.AUO5|C>?Mo6>яʕ++u]x߈g}O<~^{}suow<̋vZ3<7n_`8T=,@9we)g'r[&CN Ym6"M IDATt lkGS9k%JP@ԑIP,&xXr Z%wQW5sSsF ~ {0S@OKlYPH u!>VhO3ûq;3@ @0VABKrXx8=Wʊ:iC@"\b1f 'C$RpRps>%'@G:' ,#Rzᰀ05"Zƒ;R5j]FY$jWA)>s F Kzlcf X<-vl%$-agDZh-s3'D*=3$.ȁB T 21-qlå a*j`XzɠqRb#2̎ ,k<=z223P"pkhZB-*Q# 4Gs^{O#._6`[RuFI5U4L^g4lY4:xu'#d &N~F2R7f;e82K%, /$3~{KA ddJ" [E^{*07W2nzs~]LwDjlY[Wqj_U'?I|k_ýދ7nxn{z/|wqGs?sx[ނ{'KK ^{=>Mt;[sHKsnçxU=C-rUΦfdA͵Ϙ)z 427h ﻻm,iJ9_Dk ox;nH׃=B<9^|WeyWo|?Zk^Mo'' /̟{^G9>x"R ﺀ%tޟ"R Ͽh\v^R4!Ny?/t4 )y(*h9gjAn(]Sf67Mѭ5imYg< Bm_4teޜ&"R$hN"P.%@1]@sWH1Nbtcs BD11CNI̼&0Uxqıq׎T4nޱwU$64rkx[h)~rCo 1o0g=m!'-SL|UUkӣgú %ۈ)'b%b)SAI|u] X*%cQ0X0jXG@I9C7zu||$9T`d3 U [28i&77af!}hͯ=ø;qqqO|xCo~r?>??>O.]^{co*1.ДReJ4RU݆ąP0Đbyu=5nsT)ܮIm[|)ËGVȯ 323Fk6 W=y6sS=r[,!(xh7)MY,='h:p[(T2|6׆TWF/倅[L7Z_e6׸O!0p&kS@X7M>C5JK+Uz 툪P~ m,qP!edHhy+@)$,RF P,h/8+<$6ux%ԥ86ILFGGH=G޽PSlCШ[J;!RF\鴧0a@Yܐ6Fas6Iu5PFd=(8pǖn P# !H)8R&,˂ò@ۚ Bg8,81`1 ؞⻁L(QBx3~G8 = "^{} -.vSA7ƀDě I;' = xO^+W#2軨X"7M/Z)+2vZ[w}}_?;;OkuME'H #DGfc?QCpMsXb(5:F~ wq /} q,5O{'cRꐈN;˧CN.T}z<I 1|npK[R'>J2(Pr@4 32*imd*e#]|::!XYam%X!!rK( , [6sM֔DMt s6D(*Ƙ[1ed^ʩ!l{C-w\J(1$A%&m9:61 uEk [%5cc 86a-dS~e@@+]; .%7Jge1)7Sa /9L{kο__??u=BqUr \W89ވ^{uZ]_{y=~# E?׸q='#@p\$Jl#XݡFX=ci^zpl>o;RM9kl|l84n9e8Mɼu08J vԃI|>۩gAJ6r)3U3^=`V:;GAihA"ە֏PD@ %awj0Ng&RV7`-"Т!JCܳpYT`"~l bs^ Hh<S;m'qkϧIɶsL-F6e$YLF^xD^6XX!+-kܗe9'1hxynb`/| ?w ٶfRER18pXF09솘¡kP_v1(2rN!b,0uTu>~&5-#QiSyP+jM[K޴E]fs=R9{k^ ̳bkk wy5^y??ɟ1^e9E0Ӟr,~>CNAm;! @[Roq!!g ڸ/A}úc8WT+eOIq>e)(q\W\ܼbDo8U $/KBɂZ>00y(O* qC&TC\>Б Yc]{4r\M4;Xi+F}KfǦ8ĂZcKg5^)s1%Bpj3 FAP-'$&h .9l!.=ߓ|գ;u9Jl_\+Jqt5 Hw!1Qp: |8mD@ OEi6'l:3ͳ'L9e|i&%?\[Gk D 7KBB~3|( q:{Rqa=ϻy1Kɶvh))r 2<* }ԃs`4qwvQ@d8vװZd N3H5 d^{.f^:\vmok]?(~㿇/m5rYG)G[E ٬kƲI0A'$6ӸN~hDDgŶ(meKjztJ(1SASQXI=}DL" #24gIŚ gYY=2Gd]/ʌ+ǖvx6Zg3Ii@};k(f$r WPz+b$6Ր*eRA|k_oؠb<3{65&"yOW < |a[;# }xJ53<{L5fK _d6dF8lZkͭrX,ŽR{1+ Y4Q"O'q 2e3/9ͳ%ʰAB?sh]W XQL #B-i|Mmc56n6. RA%6=$|rEi!#Gn|k&Cf  9[fڌbypFvwON@X<6?F;5,[ FLcꑻh&)V S-rPFZp|I*O08l,c[k9Hqqpa \fe'Udv΍&yn E{pYPxax-T z>87ɝ1qG>ml׫9۰r/81D:ZXiSȆxtF[휍K 88;+ IDAT~2 @w^{^{^IG4l͎ٞ#?cXWEτyzKgTT*JǥېoTp < c˭a7,Sf_GD'T,RG Xn|*ŠƐXKKV ^ S>HIs~4bKkyҠAfԺoo4>" Cr[$l1=)wAl(M/lh R`3nn`almր{wꩦ!l5cN+ C6_ o[udzmG}ƀ[Ck n)ь,᜞3fa C(i~eY[TWb(qN%җ= Vw_T'b̧%& B7ik>xB NPklvǐKrbs[=|DauJƈ %txx6oD!sXUq3 k=TQ 7'c࠶'T3R1wc)K *hwVx]"=Ud&ɣNP J$ˉ84vp[0 ;T ٽ{}Y.}k[{'4z]x}3O=}čU|[6J.;v3)H~zgIJ !:6ȃptIQatOٮ%0#'0RYȑL`at"Pzfc'*,E6lsEGZF1gWl[: ((`gv865)p H? Nt0O*hl9o=/@ -}4mcsJӆ r(3b'A5 8AAqQgCGb%ʜ17擡N[A(y?=*`=p$ 3jyc˰)m30%) 6׾mq8߲G#L P "o\{X$<2ߘx*D6)jl,Cgp5Mc Ѽ*ȑ J4Gh6]#/풖!T0!9u2#ODP89uOHG~h ĺo/)#om|kc}G3kKK/v@+~y*Z?I@:"]q=^}w49/t$Qc6DMsFk/25tm ϵ>gM5 ?#O"%bMLz4#9cmj@@desofѠ#^,4[ӣs;<| ,mdsh1]ERp[-=[P:$`٤kg-h]׈`{R1L`ٍ+4Rg+,D0%-pMy>`dRu2w l[Sf{мIZ=g+%eX׎7٤3229J{4ǁ&:N و׋ăuĂrˎiSR  b RICy,c\Z(0z7TH,ˁJU!C u0U(`Y* :n?a66T !@!S[7]ج*r{x ͓ džD_WZ^k^{Nr5WE|wד\ r!qŶË#~k4bFp4#MS.1MȍƤH7A_@ _ovJ\5h F YHw[;ƃ=mHt=[lmD)y:efP cn,_=$c0⤴gCh&̱vcxy!)ՔF/Z䍶 U몀"GSܘb"p " JVxSh4#U6x6-/$86H R1elNjĄ3= "'OJdf?Svk:ٱMg "|;4Ϲoّ%ّ3uZ#@ gZh wZ#NU$-$}*3jE3ӛ z^fV31Đd6ٔJy$^`a[qahe5h3,Jz%&5e'9rloǁO!^4amފ!8 "oM4i˰q1 ȵR\"+4񥒗  * 6W7^F0WV0pl+.C?iNK xE7M<&VJz랲rzβj1` fON'[rq^R:ڀzmHh{¿ڣt՚g<(eZMi4tGZZmW]e/5-U󾂴P͏Ɠ_:Y{YMgSyuBF˧@w[&09&ӑh4ʁ"n`Z+#$=.hvJ-Gfe<(wqE-+KxB,x$KcYGBHJ/$Ԕۋ!PZK",f hMst~$Eg#\z>,fA+DLuX2&#dM'J_>\ҟ/T"ʿ3Kva2}ݟrm6v} ,kK&H~N~[߯%쳯_߭xMܕIҾ}KY'j.kQ~ys紖}Mߟo|~'/Oo=fsq7)B~Y|Ӫr]/}/a'_;>I{g+?4?Mo]~?Hͯ&Au6lkap}]޿φ[/K~:)o]ʗG%B]vOooϱɗ3FvWRd] %]BXF:*{i0MwL)Hx N@욈 0΍8?'Ƙ9lԧKM{eNx츷ޔy9K54_/c8^s 'KM?7;^K}Ylj5H/}3:ؗ9VͲ/Ym(׋_#B`30 e&Jcc2'S p1UX@7m }p&8\o$Zvt6/~۳"Ǯs;cZ;-(>>>v|B\^`UYf3 y]ˆ^"9_fϹAwֱY֒x=yrO{#넌ZPZTv6+s~8םBQ:0 /0d 3#1:DF16Zb@LtE)d8ܱ,R>cq-}O7#D0c(?G'ŝyirqwƄk~}B3"@DVw "(kbNlC1ϳ35][udGȹ; F(vp9#h8`i c D8 xI9ߑg/Y~~t0S,ת?x՞opGJj(5!V2e) k}7v\ qb7<0|nT) J~ `A蕶jR\eQ{c?SA[/'^s`NslB[۾31:L[:VH=J{z@ƉU-ZD|wy??ɳ5Ck} RDA? #UMȘJ'^Yÿ?q<0u'`/Lh"@SXRH2 %\Xk ƴqKƷ]Y1pQbWj2X"1|BL5qm [MuP"3'3ʴPqx|VQ9|5`ej8>:zkhqbu⋁Aac3e԰QθUI > *G?]{;UPJC4uYgr%5Ȩǁnv*Y^2L>R-@wnv]wXjΨ - 3Cʴo,=$S+*\!Gwuw P^YwtŠ^5NDǮICASE5E@ &R'L;Ul'I8UD6x kAAe"pԡHW9=("mM]F*@ xpHzmFB7 nM[ȵrAE~Oi5#/Hך h&QRGCV&U40S5iEk{A_9 DDf3aCp#z[Nrֆj`*.ƐMd#E^3`,~E77Jf^ YƑؒȄ}Amǟ'ѺyPg=Ow J8f}S^t'#aʃnh?˧Axql{`i hexTs`“^a _S8LそH8DFO|"O$6 :4E?nU'2 TPjQnPj=l{ f *D-'_N<1hKp?@B Ҡ_T0~Cn3J^VYE6i~^@*˼(45je(bBQ)ϣeҧ%2Xt7-4یeO#$9m$"bF.JE.]U# pts@Zr>OFRKX#h7ӘΛTǎk+M"+gh1v㣲^K%ꨵnସ5DNNb챞`Ie XqX8gud@ ¦eI.DMZ+en颋ژKbתbxH!&VYC}SlɪT_u\pjᙼ'JٮwW2CcG}Gle8-~ʻ,@nC%X6q g@`XuĘ9X'5[ej,,l&Z5׳ @3Nj\QMP6Hn*D,}>Z=\fY.M|~n-~FyH_)gcu׎mg/zڝz!ܼ y1l"Fo_R_?RM \ ^Z=EMB;Ҭ|uOX|e|S#gGgQcd]R[{b4ʫ_+_#1J6 44a2&3>W웑L̘ MQM]SzW'Hu ~PHg=:yyb@VwjdmT3<L }~_E'e%`^w)cZg5(xxp+x`h?5-iMiZIEjΡJAA/^^(Jܨu)'$! B_/ 5=XHG~xbL/L/spᷦM!{nJZhJ"L;X,}BL ӄM!M:`'|ğ{d4+f hnjFNÑ ǃ~m q8܁<`Л&!HO<܆V\_( ?/[w. v{7ŭeY&Zbfȫ_5 }fքn=)Zrv}Ӈgsb{rlxT>,w'3F.C%Q@M]=A"2k1% F}gaI xPJZ i+xښ0n ɉjp{7D ь{m/q.PklИ5Lr5+MF ̛nn[nm 2 F-*ϟ1D w&TD1gJF/FUkH@D'|L"DvM<}ۗ9H8!A{5^a X?X,wJuQd0|DpIkI{"uыi4~Y@`5z:DɶQ"2Aces*K5d[H5t !7u`i<3I^5,]V~_N?:}}ǻ%.] ʇ2A^ ŎZ{A\ݻ;OBIENDB`readpe-0.84/doc/manual/en_us/info.docbook000066400000000000000000000013771455661113700203560ustar00rootroot00000000000000 pev - User manual 0.80 2013-2017 Fernando Mercês Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the section entitled "GNU Free Documentation License". pev pe malware analysis threat manual readpe-0.84/doc/manual/en_us/install.docbook000066400000000000000000000172261455661113700210710ustar00rootroot00000000000000 Download and installation You can download the easy-to-install packages for pev that we call pre-compiled binaries. This is the easiest way to start using pev, although you may want to compile it in your environment if you feel comfortable but that will require you to install dependencies, some libraries headers and some programs too. If you choose to use the pre-compiled binaries (recommended for beginners), you just need to download its package from our download page. There are pre-compiled binaries for Windows and DEB and RPM packages for Linux. OS X users can use MacPorts to install pev, while Linux users can also opt out for using the native package manager.
Using the pre-compiled binaries
On GNU/Linux We recommend you to use your package manager for that, but in case pev is outdated or not present in your package manager repositories, you can still use it by compiling it from the sources.
On Windows Just download the ZIP package and uncompress it in any directory you want. There is a handy script called run.bat that you can use to open a Command Prompt window in pev's directory. This script also configures the environment for proper working of pev toolkit. You can also consider adding the pev's directory to PATH variable to make use of pev tools even easier. After running the script you should see a window like this: You DON'T need to install Cygwin to run pev in Windows. Cygwin is only needed if you want to compile pev toolkit by your own.
On Mac OS X If you haven't, please install either Homebrew or MacPorts first, then open a Terminal window and run one of the following commands: $ brew install pev $ sudo port install pev
From the sources Go to , and download the tarball named pev-x.xx.tar.gz, where x.xx is the version number you want. You can have the most up to date source code from the pev repository on GitHub (recommended). If you have git installed, run the following: $ git clone --recursive git://github.com/mentebinaria/readpe.git Even without git installed, you can download a ZIP or tarball file from project web page on GitHub.
Compiling on GNU/Linux Make sure you have the following dependencies installed and working properly: libpe (included with in the repository under lib/libpe) libssl (used by pehash and pesec) gcc make If you have downloaded the tarball, uncompress it with tar command: $ tar xf pev-x.xx.tar.gz $ cd pev-x.xx If you've cloned the git repository, it's time to compile pev and its libraries: $ make # make install (root privileges needed) If your Linux distribution does not set /usr/local/lib as one of default locations for libraries, you may need to create a symlink like this: # ln -s /usr/local/lib/libpe.so.1.0 /usr/lib/libpe.so.1 The commands above will compile libpe and all pev binaries. You can set DEST and PREFIX variables if you need. For compiling libpe only, enter in its directory and issue make command, as this: $ cd lib/libpe $ make To compile individual pev binaries, use: $ cd src/ $ make program In order to use any pev binary you should compile and install libpe first.
Compiling in Windows (via Cygwin) The first step is to download and install Cygwin. During the installation process, you must select at minimum the following packages: gcc-core binutils make zip openssl-devel git (just to clone the repository and make things easier) You should follow the same compilation steps for GNU/Linux, replacing "make install" by "make zip" at the end: $ make zip A file pev-x.xx.zip will be created and can be extracted in any directory you choose. All pev tools can be called directly from Windows Command Prompt (cmd.exe). You can add the pev's directory in %PATH% environment variable in order to call pev tools from anywhere. You can't call "make install" under Cygwin.
Compiling in OS X We recommend you use one of the following package managers to install dependencies first when compiling in OS X: Homebrew - http://brew.sh/ MacPorts - http://www.macports.org For Homebrew, use: $ brew install <pkgname> $ make CFLAGS="-I/opt/local/include" For MacPorts, use: $ sudo port install <pkgname> $ make CFLAGS="-I/opt/local/include" The directories above may change depending on your package manager installation settings.
Compiling in other platforms As pev is written in standard C language, we encourage you to compile it in different platforms and let us know about that. We believe pev can be compiled in many different platforms with just a few or no patches, but you may face some dependencies challenges. Anyway, we encourage you to get in touch to discuss. Previous versions were compiled for Android, Solaris and other systems. If you want to give it a try, go ahead! ;)
Output retro-compatibility As of version 0.70 the output format of pev programs changed. If you have some scripts calling pev and parsing the old 0.60 output format, you can define a macro called LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 before compilation, just like this: $ DFLAGS+=-DLIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 make readpe This retrocompatibility will be removed in the next release, so please consider updating your scripts as soon as possible.
readpe-0.84/doc/manual/en_us/manual.docbook000066400000000000000000000011611455661113700206670ustar00rootroot00000000000000 ]> &info; &pev; &install; &configuration; &basic-usage; &advanced-features; &tools; &faq; &license; readpe-0.84/doc/manual/en_us/pev.docbook000066400000000000000000000167041455661113700202150ustar00rootroot00000000000000 What is pev? Since version 0.50, pev is a multiplatform toolkit to work with PE (Portable Executable) binaries. Its main goal is to provide feature-rich tool for proper analyze binaries, specially suspicious ones. History pev was born back in 2010 from a simple need: a program to find out the version (File Version) of a PE32 file and that could run in Linux. This version number is stored in Resources (.rsrc) section but at the time we've decided to simply search for the string in the whole binary, without any optimization. Later on we've decided to parse the PE32 file until reach .rsrc section and get the File Version field. In order to do that, we realized we had to parse the entire file and we thought if we could print out all the fields and values we went through as well. Until version 0.40, pev was a unique program to parse the PE headers and sections (now readpe is responsible for this). In version 0.50 we focused on binary analysis and split pev into various programs beyond a library, called libpe. Currently most of pev toolkit programs depends on libpe. Changelog pev - the PE file analysis toolkit - ChangeLog Legend: + Added feature * Improved/changed feature - Bug fixed ! Known issue / missing feature pev 0.84 - February 1, 2024 * Add test executable pev 0.83 - November 28, 2023 * Add Linux install info to readme * Remove _FORTIFY_SOURCE definitions - Fix 8 character long section names being cut off - Various improvements for readpe - Removed all exit() calls from libpe - Fix and improve tests pev 0.82 - May 12, 2023 * added more image machine types - fix build on GNU/hurd and kFreeBSD - fix crash on executables with zero segments - fix various minor memory leaks - improve makefile to make build reproducible - pedis: show error on not x86 code - peres: ignore header resource size - pestr: fix bug with wide character detection - readpe: fix date overflow bug - rva2ofs: fix bug when exe has no offset pev 0.81 - January 12, 2021 + peldd: new tool to display what DLL's a PE file depends on. pev 0.80 - January 7, 2017 ! Missing documentation for libpe. ! peres does not reconstruct icons and cursors extracted from resources section. * Now the -V switch is used by all pev programs to show their version number. * pehash: Now the hash of the whole file is shown by default (-c option). * pestr: --net option removed. * udis86 upgraded to version 1.7.2. + Basic plugins support. + cpload: new tool for CPL file debugging (Windows only). + pehash: Import Hash (imphash) support. + peres: -v swtich outputs PE File Version from resources section. + Support for pev.conf configuration file. - pestr: unable to handle big strings. - readpe can now read virtual import descriptors. - Valid XML and HTML output formats (Jan Seidl). - readpe: Unecessary error message when there is no export directory. pev 0.70 - December 26, 2013 ! Missing full/English documentation. ! Missing valid XML and HTML output formats. ! pestr: no support for --net option when parsing unicode strings. ! pestr: unable to handle too big strings. * libpe: rewritten, now using mmap. (Jardel Weyrich). * pestr: added countries domains suffixes. * readpe and peres: output enhancements (Jardel Weyrich). + pehash: sections and headers hash calculation (Jardel Weyrich). + pehash: ssdeep fuzzy hash calculation. + pehash: support for new digest hashes like sha512, ripemd160 and more. + peres: added new tool to analyze/extract PE resources (Marcelo Fleury). + pescan: cpl malware detection. + pescan: undocumented anti-disassembly fpu trick detection. + pesec: show and extract certificates from digitally signed binaries (Jardel Weyrich). - readpe can't show functions exported by ID only. - readpe: fixed subsystem types (Dmitry Mostovenko). pev 0.60 - October 31, 2012 ! Missing full/English documentation. ! Missing valid XML and HTML output formats. ! pestr: no support for --net option with unicode strings. ! readpe can't show functions exported by ID only. * pedis: -F/--function option replaced by -r/--rva. + added manpages for all tools. + pedis: added -m/--mode option to set disassembly mode (16, 32 or 64-bit). + pedis: added -n option to limit number of disassembled instructions. + pedis: added options to disassembly entrypoint and raw fille offset. + pedis: disassemble bytes number specified by -n option. + pehash: new tool to calculate PE file hashes (Jan Seidl). + pepack: added PEiD signature search (Rodrigo Escobar). + pescan: added -f/--format option to format output. + pescan: added section, imagebase and timestamp analysis. + readpe: added --exports option to show exported functions. - pedis: fixed address representation in calls and jump instructions. pev 0.50 - June 25, 2012 ! Missing documentation. ! Missing valid XML and HTML output formats. ! pedis shows arguments of jumps and calls as relative positions. * Improved pev tools Makefile (Gabriel Barbosa). * MEW packer detection in packid (Rodrigo Rubira). * pev now is a collection of binaries and a library to work with PE executables. + libpe: xmalloc trick and fixes (Rodrigo Rubira). + Output in monospaced text and csv in most programs. + pedis: disassemble functions and sections (Tiago Zaniquelli). + pepack: detect fake EP (Wagner Barongello). + pescan: new tool to search for suspicious things in PE files including TLS callbacks. + pesec: find security features in PE files. + readpe can now show imported functions with --imports or -i switch. + readpe: show PE headers and sections information (most of obsolete pev binary). + Released libpe 1.0 to support our programs. + rva2ofs and ofs2rva: convert from rva to raw file offset and vice-versa. - Fixed erroneous ord numbers in functions imported without name. - Fixed two bugs with fake TLS callbacks in petls (thanks to Qualys guys for reporting). pev 0.40 - August 7, 2011 * Compatible with PE/COFF specification v8.2. * Date format in COFF header similar to RFC 2822. * Improved function to get machine type (Gabriel Duarte). + Added "-r" option to show resource items at first level. + Added more human-readable fields, like subsystem and section characteristics. + Added TLS callback functions detection in every PE section. + ASLR and DEP identification. + PE32+ support. Now pev can handle 64-bits executables. + Variable data directories support (no more fixed in 16). pev 0.31 - May 11, 2011 + Added characteristics flags in COFF output. + Added human-readable machine types in COFF output. - Fixed compilation in OS X. (Gustavo Roberto). - Fixed warning with Linux 32-bits boxes when compiling. pev 0.30 - February 20, 2011 * Improved memory usage. * Now pev shows the Product Version with option "-p". + Added option "-a" to show all information. + Added option "-c" to show the COFF header. + Added option "-d" to show the DOS header. + Added option "-o" to show the Option (PE) header. + Added option "-s" to show executable sections. pev 0.22 - January 9, 2011 ! Does not support PE32+ files. ! Plans to read more PE information. * Improved Makefile. + Added manpage. pev 0.2 - December 26, 2011 * Improved search algorithm. - Fixed bug compiling in MS-Windows platform. pev 0.1 - December 12, 2010 Initial release. (Eduardo Fernandes, Fernando Mercês, Francivan Bezerra and Thiago Moraes). readpe-0.84/doc/manual/en_us/tools.docbook000066400000000000000000000150371455661113700205610ustar00rootroot00000000000000 Included tools cpload Usage: cpload [-m MESSAGE] FILE Load .cpl (Control Panel Item) files for debugging Example: cpload -m init notafiscal.cpl Options: If -m is present, MESSAGE should be: Option Message ------------------------------ init CPL_INIT getcount CPL_GETCOUNT inquire CPL_INQUIRE select CPL_SELECT dblclk CPL_DBLCLK stop CPL_STOP exit CPL_EXIT newinquire CPL_NEWINQUIRE startwparms CPL_STARTWPARMS setup CPL_SETUP Otherwise, cpload will send all messages to CPlApplet() ofs2rva Usage: ofs2rva <offset> FILE Convert raw file offset to RVA Example: ofs2rva 0x1b9b8 calc.exe Options: -v, --version show version and exit --help show this help and exit pedis Usage: pedis OPTIONS FILE Disassemble PE sections and functions (by default, until found a RET or LEAVE instruction) Example: pedis -r 0x4c4df putty.exe Options: --att set AT&T syntax -e, --entrypoint disassemble entrypoint -f, --format <text|csv|xml|html> change output format (default: text) -m, --mode <16|32|64> disassembly mode (default: auto) -i, <number> number of instructions to be disassembled -n, <number> number of bytes to be disassembled -o, --offset <offset> disassemble at specified file offset -r, --rva <rva> disassemble at specified RVA -s, --section <section_name> disassemble entire section given -V, --version show version and exit --help show this help and exit pehash Usage: pehash OPTIONS FILE Calculate hashes of PE pieces Example: pehash -s '.text' winzip.exe Options: -f, --format <text|csv|xml|html> change output format (default: text) -a, --all hash file, sections and headers with md5, sha1, sha256, ssdeep and imphash -c, --content hash only the file content (default) -h, --header <dos|coff|optional> hash only the header with the specified name -s, --section <section_name> hash only the section with the specified name --section-index <section_index> hash only the section at the specified index (1..n) -V, --version show version and exit --help show this help and exit pepack Usage: pepack FILE Search for packers in PE files Example: pepack putty.exe Options: -d, --database <file> use database file (default: ./userdb.txt) -f, --format <text|csv|xml|html> change output format (default: text) -V, --version show version and exit --help show this help and exit peres Usage: peres OPTIONS FILE Show information about resource section and extract it Example: peres -a putty.exe Options: -a, --all Show all information, statistics and extract resources -i, --info Show resources information -s, --statistics Show resources statistics -x, --extract Extract resources -v, --file-version Show File Version from PE resource directory -V, --version show version and exit --help Show this help and exit pescan Usage: pescan OPTIONS FILE Search for suspicious things in PE files Example: pescan putty.exe Options: -f, --format <text|csv|xml|html> change output format (default: text) -v, --verbose show more info about items found -V, --version show version and exit --help show this help and exit pesec age: pesec [OPTIONS] FILE Check for security features in PE files Example: pesec wordpad.exe Options: -f, --format <text|csv|xml|html> change output format (default: text) -c, --certoutform <text|pem> specifies the certificate output format (default: text) -o, --certout <filename> specifies the output filename to write certificates to (default: stdout) -v, --version show version and exit --help show this help and exit pestr Usage: pestr OPTIONS FILE Search for strings in PE files Example: pestr acrobat.exe Options: -n, --min-length set minimum string length (default: 4) -o, --offset show string offset in file -s, --section show string section, if exists -V, --version show version and exit --help show this help and exit readpe Usage: readpe OPTIONS FILE Show PE file headers Example: readpe --header optional winzip.exe Options: -A, --all full output (default) -H, --all-headers print all PE headers -S, --all-sections print all PE sections headers -f, --format <text|csv|xml|html> change output format (default: text) -d, --dirs show data directories -h, --header <dos|coff|optional> show specific header -i, --imports show imported functions -e, --exports show exported functions -V, --version show version and exit --help show this help and exit rva2ofs Usage: rva2ofs <rva> FILE Convert RVA to raw file offset Example: rva2ofs 0x12db cards.dll Options: -V, --version show version and exit --help show this help and exit readpe-0.84/doc/pev-icon.png000066400000000000000000000311431455661113700157130ustar00rootroot00000000000000PNG  IHDR>abKGD pHYs B(xtIMEDG IDATx}w|յ3i]UY꽹Ȗ傁i!4{^ y/y!/P ƽ<[-[+YwiE۵ev(,m t>ٝ;~{sL"DI@!UQvh?.tj_wA!yT ЅhLBcczR9\+9q:RNù֪5 0 }P NN`0`+c9\ q-ϵTI݆kjw)J\! 1kmA2K8)\es5k\s[ pʲ@+LR;Gա= 1ĕ)EµpN'Zn4gsVFr-Bn e9JD@WQUpqrݖ˹.́􏃓!,5;Ye=O(s4w̥V.hP9.$8]j3kQnjՓim(Dylrhy+rdbH=B FST>T>HCP''W L-U$Zᣋa*\3dazfL^»H%itZ~k@W1x"Mu M\yCp^H< W $}vD1@8W W*pU` ;WYtY.YF{x_sqr1sYxQEEE>ŋx< 9s!I'%%5k 0Bh&8f+1 ]1F~_pQ訪M]VV6_t:^Wxuuu Q>;zúcǎ!Db7j@+@6a===#Gtvvfwuu%tuul6[ c $I@ HvL&',,l8""Gw78pKR|C pLFcÇ677lhhXc48xy<| h˲,4 6 L&DiyGEEAdd7))ȑ#Nd_իN>~gΜIf@ll,hZH$}$IB e1MӢ`0텁hhhؔU@\'>%&b 8#GVTT{{{vcDTPPAVrD">!Ir !`0( -w\qn{j]Ưd2Vuuu.ne``#4SNKmO_ag?O\>(nFY * DRcd6W(X"`H!`YHNFJ ::q5kd ׯ;v~衇XLwy?{AAAz}} äcJe+A>ш@ZPPDFFwra c|~H$ͧ~ | &>!D_m@@I}aiii讻jy~~3(NKK. زe /W0̑d.׿gϞ!xl6 'kcBؾ}{Doo/sN$Jd9֏-((𦦦>cd^6l0`$׏N@7olݺWnT*>3}(B!KLL|'..o`=== B!P(! Sd>obvkV$'' L7m~ vm*~KK  CׯgO[neAܟy˖-2 pee?7A@( QKKB|>6Ceɒ%/r-/|,#z{{޽{u555?B|W 4:I|V~1( JJJ`…o]MBqAz= Ѹ1ϟ_t:$I_Q~HQIVV^0 ×Jc{K.f[ۻ ={N(3o޼jNwV dN Jnv;_\6…z]wĀkmm\f @!wtu9  KRbѢEΌ7*dȑ#G7mtkxxD"QLmooZ}$Ieee ጶ➞*_W"##۲$Ihkk3gZ& ర0Grr^a 11gffgggZ8 8ѱZmEMMÇ4}J:"HDJn!t04twe{oTwyzL~FFZl0,]_px\^1xZڵd=*,,477 @"QJfTT  ƧΜ9e8Ju8ɓ/_Y(JnJ*:bqȓ,BL&}jllL( E.kݻ7o'_|͛77nܸeɒ%455\__+ކrMG1̋`U+@%WLfff&CZ 1㏳P(> M'|o۶ o~=ӳg2?xf>8_O1Y'~cBL@tZD4{lss>^[n6ڵkM^ A|>_Re@FFB!)|~.RCV4Muww?1,~wmoo_+ ;;1<}s1E<ȩzX>i'&:^W:,=LbfZJ,x>Nܹs9\.hL^^ޝ)I?UFDD=sex Ì! -f FihhHFW5t塡&^x'iP]T*.g}e֭vvvƺ\.NaYb,lHNWOtNxD JD♆w5ZIeqqq8(H$vR>v\ ras4MVWWzz@m6t* #o۶r9%rpS$IRIQ^|5`x>OȲ,P|>dOY*B( .HNR(#chWbEEEGFFw\Ҙ}}}k***Oo$$]b8@A`&L(z6O\QQcF01U$IEo2\$Q R`,ˢ`0xJGGp8GGGG> 0>/h4jD"K$fnwl0q\ݏL(:5MJ$y~ Bh{ll E`0 OSěW+P &|h&XXEZZZjM;,$LuPE!˷zk劻oILLAVVJiV꺻app0p% K*++7]^bHD</z!]/g2B>(iKu666DQٳgP(o?~JJʫrULvTѼhѢg}c4޾ԩSW0 ###D$L/].a( B' dNTzB!Ap8|6cN ]1VмR?b=BpFqnhh#|>f{޽kzSRRFGGwbPD4M q7Ǭ[ynwfAr4MOf Q̺\.bttT<444Yuu5}_LolltFFFZBa8Wwuuys9Mt8B@P(d2Yz3˲FÁ#I㝣i穩 X%VFGGW\G LKGGG4MBG{^ ʲ+1ed2AWW~+W^Zvϯi866f͚yoIĺ`0HEDDxD"4BH&9PhRN\޻~Bhf 3LaZBtǣB׮rfstGEEjq՟m0-2;v"5ݝꫯG?ֈo[;*ݻ)11EEEARi kTTZNB_O]]+yyyK>m@@?*qG~PeJmZ__߂dz}phh u ###55TYYmZb4 Wϼ,y7X,~?: 4M}}}K|~kXXLfS+FFFl'Nxt|>ʎ?Ν;a|hbM̰X,T*a޼yZ21^3KɌ})DtdggDDDYk.Lݞϋ<`YVf9?Hx1zm6eY>B(^׉&a^4 K`hJb۱Nhuuup/v]M3jMMM=ϰ,gΜYv9啗[Rghu(;;III?lmmH$Rb6d2oV/dRٙĩS!ٌ烖\M[WX!ɄO<o.Kq9Yza$IviiiGxOF~||Ѩ@ 0Lp*ONN~kÆ 4wFGEE@yyM,)&`g̬KOOan)//sIzmA 5 ӟoojjaRR&ݾulll;BMo>y)窪|kjj0χ"6 W;wbW+aHGGGʟD LRRбk׮LvI NKK[?s˖-KV[۵Z-699?sc6L~'pBϟߢ鶮Z  ֆۗ~:w,Y$bD"zĉkt{ｧ0L8,, JKKcmmmbK\8kI׿n']|9x<8q{BTҫ51Eed2qXXXCRRұkq.+>x?,jnn<qdds׮]p)@dill$Sl6_(l?aO>=p;.K{/c,>|?i^)bId)›7o[n'I2&+9`۳a'&~ zn'(AG[ sXXXeLLp\\G(N{(1!Fh4F9TVVF>|Y$ 00c~#$^zi>\uЕ40\9ܶ[vppj h0 wwNBߴZ'Z,EEEebX`*))^?ZUTC2"!b[` A>˲@ t:FQo[Z[[gΜ.1XT*İqqq>ɪ*A__g}-.2u2pZT _+* lX8SM<B W)R(ӆ h;wڊFGG1`FC@\\(L6(!<|>`GӴ+nw錳X,nhooٌ1  Q||<$%% :z٣r\ƍqBBHEt-`:Lδ!A_Idsx0&$?I]X80©cWWcXp]]hŊtsss $ {͖빞}`J`%Jϧt\(Mc`0M6uYŋغ@~uww7矣&g9Aw$gnVY Fs@Tj6'!?aΟ4A 卍Ԅ)ⅅ"T*QլP(d2SXXD9dT&##Ccw܉ bYVƦZjŊ;vlqooh4⁁QzzryP=$kLJ,C% 3vtp5 N @K$M$I?>? (}S6b pff&ObccypLb< >C 6|p#<ރ4.ɍrx,"a(a 9p8 '' ={vFQ9n]l`veBB7$5 2iy~si :Nq,_fYLdffBee%ι-[_8 8 q'ӹ455!999. A_s>#z>appqCC>/^(z ^/ZjUVUUUǵCCCrDsHC]Fe9\xӧOP__nXcPQQpoblyСC`08c\t@ig ,oZGoە'}cTǞ>}zj$,, $w}x޽ $*J`ff,H$BʔO~bc +222'''0PYY ?Zx L1x6k(-ZԤheYl0xt* Iҝ'''*Qww7Kj_- A󫪪6Lulvvxi***PwwCcfjժѰ0pmmv5K+ ^񠻻={69._XXiCCCDccc3g { bbb`ll WUUuvv>1&0$//﹛n)(ɐfuuua]PXXȒ$ P[[usE󻳳.\4 ===ҊikDDN~՚2$:WX5CCCkY|RSS?466Bss󊺺9"ILLlNII켱:j ؕ?Vh I/0(r%%% Nhoo/2L+fE!>>DVVtCMM _WW3Y$b!>>~W^^x^`6S@`y ΝKbu1Z=??|>Q__===k\"坝?>, N=zT0Y"qqqldddU||Txtuuɓ'S:;;`Innn[RRRyrr2&I***pggC)AllF> ,XJJʗ]Zv|a<88˩MIIiINN,##(v(//70X^***v7 r9x<̙3`v-33lB@9rDY[[iܓɀ1ƭӧK=Of˫t,AP]]3 7acv`0=z9.0|422I555ߟش-ZhMMMBif|\\\ k05557b$]t!L&O޿9.0)**B.2;{^^hzqCCü[0ƪ9._RVۍϞ=+ihhX1j={$`vpVV'-eQGG4552yDD[ . GN[ZZVbysE+Vi4lPSSt^t(55u(&&E~60$>>~8))iŋeY7 $LFy????(ˑdC0˄ ?/[ s~Aeee\OO=]¶c F1Q/,^)**e٦&tܹuD2oϿ`0H;::pMM͢z555i}ѺҦT(TXXV\reo s`噙7;v .cDK.ڬ\rdZ1=3?/oKV+A* \.df˲XRe˖AQQXBB+zâڐsbZ?_E˲0 h4PZZ .GFFJl=z})33TT* ѣzӉ% *((_bŧiii!ꢣ . ^y?:IENDB`readpe-0.84/doc/tutorial/000077500000000000000000000000001455661113700153265ustar00rootroot00000000000000readpe-0.84/doc/tutorial/pt_BR/000077500000000000000000000000001455661113700163345ustar00rootroot00000000000000readpe-0.84/doc/tutorial/pt_BR/Makefile000066400000000000000000000007671455661113700200060ustar00rootroot00000000000000# apt-get install docbook docbook-xsl xsltproc fop NAME=pev-tutorial XSL=/usr/share/xml/docbook/stylesheet/nwalsh/html/chunk.xsl FOXSL=/usr/share/xml/docbook/stylesheet/nwalsh/fo/docbook.xsl SRC=tutorial.docbook HTML_DIR=html PDF_DIR=pdf VERSION=1.0 html: mkdir -p $(HTML_DIR) xsltproc -o $(HTML_DIR)/ $(XSL) $(SRC) pdf: mkdir -p $(PDF_DIR) xsltproc -o $(NAME).fo $(FOXSL) $(SRC) fop $(NAME).fo -pdf $(PDF_DIR)/$(NAME)-$(VERSION).pdf clean: rm -rf *.html *.pdf *.fo *~ $(HTML_DIR) $(PDF_DIR) readpe-0.84/doc/tutorial/pt_BR/info.docbook000066400000000000000000000015231455661113700206320ustar00rootroot00000000000000 Análise de arquivos PE com o pev Tutorial para iniciantes 2013-12-03 1.0 2013 Fernando Mercês Você tem permissão para copiar, distribuir e/ou modificar este documento sob os termos da licença GNU Free Documentation License (GFDL), versão 1.3 ou superior, publicada pela Free Software Foundation. Uma cópia da licença (em inglês) está disponível no apêndice "GNU Free Documentation License". pev pe malware análise vírus ameaças executável executáveis readpe-0.84/doc/tutorial/pt_BR/pe.docbook000066400000000000000000000141661455661113700203120ustar00rootroot00000000000000 Visão geral do formato PE O formato PE (Portable Executable) é o padrão para arquivos executáveis utilizados nos sistemas MS-Windows atuais. Faremos um breve resumo sobre sua estrutura, mas a documentação completa (em inglês) pode ser obtida aqui. Quando um programador escreve um programa e o compila, não é somente o código escrito por ele que vai para o executável. O compilador adiciona todas as estruturas e informações necessárias para este executável seja devidamente carregado pelo sistema operacional, utilize funções de bibliotecas externas etc. Essas adição de informações precisa obedecer um padrão, uma especificação, e é exatamente aí que o formato PE entra.
Cabeçalhos Os primeiros bytes de um arquivo PE são elementos de vários cabeçalhos diferentes. Estes bytes são na realidade os valores dos vários campos dos cabeçalhos do PE. Um cabeçalho é um conjunto de campos e seus respectivos valores. Vamos analisar o primeiro cabeçalho do PE, ou seja, o que está logo no início de um arquivo PE. O primeiro cabeçalho num arquivo PE é o chamado Cabeçalho do DOS, ou no inglês, DOS Header. Este cabeçalho possui a seguinte estrutura: Cabeçalho do DOS Posição Tamanho Nome Descrição Total 64 0x00 2 e_magic Magic Number - para executáveis PE deve ser sempre 0x5a4d 0x02 2 e_cblp 0x04 2 e_cp 0x06 2 e_crlc 0x08 2 e_cparhdr 0x0a 2 e_minalloc 0x0c 2 e_maxalloc 0x0e 2 e_ss 0x10 2 e_sp 0x12 2 e_csum 0x14 2 e_ip 0x16 2 e_cs 0x18 2 e_lfarlc 0x1a 2 e_ovno 0x1c 8 e_res 0x24 2 e_oemid 0x26 2 e_oeminfo 0x28 20 e_res2 0x3c 4 e_lfanew Posição no arquivo da assinatura PE
Perceba que o valor presente nos dois primeiro bytes representa o campo de nome e_magic. A posição do início do campo está representada em hexadecimal para facilitar. Podemos então dizer que os primeiros 64 bytes de um arquivo PE definem o cabeçalho do DOS. O formato especifica que o valor do último campo, chamado e_lfanew, é na verdade o endereço de uma assinatura PE. Esta assinatura possui 4 bytes e deve ser o número 0x4550, do contrário, o arquivo não é um PE válido. Existem outros cabeçalhos no arquivo PE. Por favor, leia a documentação oficial para maiores detalhes sobre este e outros cabeçalhos existentes.
Seções Uma outra região do PE muito importante são as sessões. Tratam-se de áreas delimitadas dentro do PE para abrigar certos tipos de dados. Cada seção tem uma posição dentro do arquivo PE, ou seja, onde ela começa, e um tamanho, que torna possível saber em qual byte ela termina. Se você imaginar um executável PE como um criado-mudo, as seções seriam as gavetas. E como todo criado-mudo organizado, cada gaveta possui um tipo de roupa (uma para calças, outra para camisas e assim por diante), mas nada impede de separar duas ou mais gavetas só para camisas. O que não se pode fazer, pelo menos no PE, é misturar as coisas. O código executável fica numa seção de código. Já dados do tipo texto utilizados pelo programador para criar o programa, ficam em outra seção, que não possui código executável e sim dados. As seções possuem um nome, apesar de não ser regra. Outro atributo importante são as permissões da seção. Ela pode ser executável, legível e/ou gravável. Abaixo uma lista de de seções normalmente encontradas em executáveis PE sadios: .text / .code Seção de código executável, normalmente a primeira a ser executada (mas não é regra). Precisa de permissão de leitura e execução. .data Seção para dados (variáveis e outros). Precisa de permissão de leitura e gravação. .rdata Seção para dados somente para leitura. Precisa de permissão de leitura somente. As seções podem conter qualquer configuração. Inclusive a partir destas configurações, podemos inferir que estamos tratando de uma seção de um PE onde o criador utilizou técnicas para evitar o trabalho de analistas de malware. readpe-0.84/doc/tutorial/pt_BR/tutorial.docbook000066400000000000000000000003741455661113700215450ustar00rootroot00000000000000 ]> &info; &pe; &license; readpe-0.84/include/000077500000000000000000000000001455661113700143415ustar00rootroot00000000000000readpe-0.84/include/common.h000066400000000000000000000053211455661113700160030ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit common.h - common defitions for the pev toolkit. Copyright (C) 2013 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #include #include #include #include #include #include #include #include #include "config.h" #include "output.h" #include "plugins.h" #define UNUSED(x) (void)(sizeof((x))) #define EXIT_ERROR(msg) \ { \ fprintf(stderr, "ERROR: %s [at %s:%d]\n", msg, __FILE__, __LINE__); \ exit(EXIT_FAILURE); \ } #define MAX_MSG 81 #define MAX_PATH 256 #define VERSION "0.84" #define TOOLKIT "from pev " VERSION " toolkit" #define COPY \ "License GPLv2+: GNU GPL version 2 or later .\n" \ "This is free software: you are free to change and redistribute it.\n" \ "There is NO WARRANTY, to the extent permitted by law." void *malloc_s(size_t size); void *calloc_s(size_t nmemb, size_t size); #define PEV_INITIALIZE(config) \ do { \ memset(config, 0, sizeof(*config)); \ pev_load_config(config); \ int ret = plugins_load_all(config); \ if (ret < 0) \ exit(EXIT_FAILURE); \ output_init(); /* Requires plugin for text output. */ \ } while (0) #define PEV_FINALIZE(config) \ do { \ output_term(); \ plugins_unload_all(); \ pev_cleanup_config(config); \ } while (0) readpe-0.84/include/compat/000077500000000000000000000000001455661113700156245ustar00rootroot00000000000000readpe-0.84/include/compat/strlcat.h000066400000000000000000000002571455661113700174550ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ #ifndef STRLCAT_H_INCLUDED #define STRLCAT_H_INCLUDED #include size_t bsd_strlcat(char *dst, const char *src, size_t siz); #endif readpe-0.84/include/compat/sys/000077500000000000000000000000001455661113700164425ustar00rootroot00000000000000readpe-0.84/include/compat/sys/queue.h000066400000000000000000000561121455661113700177440ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /*- * Copyright (c) 1991, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)queue.h 8.5 (Berkeley) 8/20/94 * $FreeBSD$ */ #ifndef _SYS_QUEUE_H_ #define _SYS_QUEUE_H_ #include /* * This file defines four types of data structures: singly-linked lists, * singly-linked tail queues, lists and tail queues. * * A singly-linked list is headed by a single forward pointer. The elements * are singly linked for minimum space and pointer manipulation overhead at * the expense of O(n) removal for arbitrary elements. New elements can be * added to the list after an existing element or at the head of the list. * Elements being removed from the head of the list should use the explicit * macro for this purpose for optimum efficiency. A singly-linked list may * only be traversed in the forward direction. Singly-linked lists are ideal * for applications with large datasets and few or no removals or for * implementing a LIFO queue. * * A singly-linked tail queue is headed by a pair of pointers, one to the * head of the list and the other to the tail of the list. The elements are * singly linked for minimum space and pointer manipulation overhead at the * expense of O(n) removal for arbitrary elements. New elements can be added * to the list after an existing element, at the head of the list, or at the * end of the list. Elements being removed from the head of the tail queue * should use the explicit macro for this purpose for optimum efficiency. * A singly-linked tail queue may only be traversed in the forward direction. * Singly-linked tail queues are ideal for applications with large datasets * and few or no removals or for implementing a FIFO queue. * * A list is headed by a single forward pointer (or an array of forward * pointers for a hash table header). The elements are doubly linked * so that an arbitrary element can be removed without a need to * traverse the list. New elements can be added to the list before * or after an existing element or at the head of the list. A list * may be traversed in either direction. * * A tail queue is headed by a pair of pointers, one to the head of the * list and the other to the tail of the list. The elements are doubly * linked so that an arbitrary element can be removed without a need to * traverse the list. New elements can be added to the list before or * after an existing element, at the head of the list, or at the end of * the list. A tail queue may be traversed in either direction. * * For details on the use of these macros, see the queue(3) manual page. * * * SLIST LIST STAILQ TAILQ * _HEAD + + + + * _HEAD_INITIALIZER + + + + * _ENTRY + + + + * _INIT + + + + * _EMPTY + + + + * _FIRST + + + + * _NEXT + + + + * _PREV - + - + * _LAST - - + + * _FOREACH + + + + * _FOREACH_FROM + + + + * _FOREACH_SAFE + + + + * _FOREACH_FROM_SAFE + + + + * _FOREACH_REVERSE - - - + * _FOREACH_REVERSE_FROM - - - + * _FOREACH_REVERSE_SAFE - - - + * _FOREACH_REVERSE_FROM_SAFE - - - + * _INSERT_HEAD + + + + * _INSERT_BEFORE - + - + * _INSERT_AFTER + + + + * _INSERT_TAIL - - + + * _CONCAT - - + + * _REMOVE_AFTER + - + - * _REMOVE_HEAD + - + - * _REMOVE + + + + * _SWAP + + + + * */ #ifdef QUEUE_MACRO_DEBUG /* Store the last 2 places the queue element or head was altered */ struct qm_trace { unsigned long lastline; unsigned long prevline; const char *lastfile; const char *prevfile; }; #define TRACEBUF struct qm_trace trace; #define TRACEBUF_INITIALIZER { __FILE__, __LINE__, NULL, 0 } , #define TRASHIT(x) do {(x) = (void *)-1;} while (0) #define QMD_SAVELINK(name, link) void **name = (void *)&(link) #define QMD_TRACE_HEAD(head) do { \ (head)->trace.prevline = (head)->trace.lastline; \ (head)->trace.prevfile = (head)->trace.lastfile; \ (head)->trace.lastline = __LINE__; \ (head)->trace.lastfile = __FILE__; \ } while (0) #define QMD_TRACE_ELEM(elem) do { \ (elem)->trace.prevline = (elem)->trace.lastline; \ (elem)->trace.prevfile = (elem)->trace.lastfile; \ (elem)->trace.lastline = __LINE__; \ (elem)->trace.lastfile = __FILE__; \ } while (0) #else #define QMD_TRACE_ELEM(elem) #define QMD_TRACE_HEAD(head) #define QMD_SAVELINK(name, link) #define TRACEBUF #define TRACEBUF_INITIALIZER #define TRASHIT(x) #endif /* QUEUE_MACRO_DEBUG */ /* * Singly-linked List declarations. */ #define SLIST_HEAD(name, type) \ struct name { \ struct type *slh_first; /* first element */ \ } #define SLIST_HEAD_INITIALIZER(head) \ { NULL } #define SLIST_ENTRY(type) \ struct { \ struct type *sle_next; /* next element */ \ } /* * Singly-linked List functions. */ #define SLIST_EMPTY(head) ((head)->slh_first == NULL) #define SLIST_FIRST(head) ((head)->slh_first) #define SLIST_FOREACH(var, head, field) \ for ((var) = SLIST_FIRST((head)); \ (var); \ (var) = SLIST_NEXT((var), field)) #define SLIST_FOREACH_FROM(var, head, field) \ for ((var) = ((var) ? (var) : SLIST_FIRST((head))); \ (var); \ (var) = SLIST_NEXT((var), field)) #define SLIST_FOREACH_SAFE(var, head, field, tvar) \ for ((var) = SLIST_FIRST((head)); \ (var) && ((tvar) = SLIST_NEXT((var), field), 1); \ (var) = (tvar)) #define SLIST_FOREACH_FROM_SAFE(var, head, field, tvar) \ for ((var) = ((var) ? (var) : SLIST_FIRST((head))); \ (var) && ((tvar) = SLIST_NEXT((var), field), 1); \ (var) = (tvar)) #define SLIST_FOREACH_PREVPTR(var, varp, head, field) \ for ((varp) = &SLIST_FIRST((head)); \ ((var) = *(varp)) != NULL; \ (varp) = &SLIST_NEXT((var), field)) #define SLIST_INIT(head) do { \ SLIST_FIRST((head)) = NULL; \ } while (0) #define SLIST_INSERT_AFTER(slistelm, elm, field) do { \ SLIST_NEXT((elm), field) = SLIST_NEXT((slistelm), field); \ SLIST_NEXT((slistelm), field) = (elm); \ } while (0) #define SLIST_INSERT_HEAD(head, elm, field) do { \ SLIST_NEXT((elm), field) = SLIST_FIRST((head)); \ SLIST_FIRST((head)) = (elm); \ } while (0) #define SLIST_NEXT(elm, field) ((elm)->field.sle_next) #define SLIST_REMOVE(head, elm, type, field) do { \ QMD_SAVELINK(oldnext, (elm)->field.sle_next); \ if (SLIST_FIRST((head)) == (elm)) { \ SLIST_REMOVE_HEAD((head), field); \ } \ else { \ struct type *curelm = SLIST_FIRST((head)); \ while (SLIST_NEXT(curelm, field) != (elm)) \ curelm = SLIST_NEXT(curelm, field); \ SLIST_REMOVE_AFTER(curelm, field); \ } \ TRASHIT(*oldnext); \ } while (0) #define SLIST_REMOVE_AFTER(elm, field) do { \ SLIST_NEXT(elm, field) = \ SLIST_NEXT(SLIST_NEXT(elm, field), field); \ } while (0) #define SLIST_REMOVE_HEAD(head, field) do { \ SLIST_FIRST((head)) = SLIST_NEXT(SLIST_FIRST((head)), field); \ } while (0) #define SLIST_SWAP(head1, head2, type) do { \ struct type *swap_first = SLIST_FIRST(head1); \ SLIST_FIRST(head1) = SLIST_FIRST(head2); \ SLIST_FIRST(head2) = swap_first; \ } while (0) /* * Singly-linked Tail queue declarations. */ #define STAILQ_HEAD(name, type) \ struct name { \ struct type *stqh_first;/* first element */ \ struct type **stqh_last;/* addr of last next element */ \ } #define STAILQ_HEAD_INITIALIZER(head) \ { NULL, &(head).stqh_first } #define STAILQ_ENTRY(type) \ struct { \ struct type *stqe_next; /* next element */ \ } /* * Singly-linked Tail queue functions. */ #define STAILQ_CONCAT(head1, head2) do { \ if (!STAILQ_EMPTY((head2))) { \ *(head1)->stqh_last = (head2)->stqh_first; \ (head1)->stqh_last = (head2)->stqh_last; \ STAILQ_INIT((head2)); \ } \ } while (0) #define STAILQ_EMPTY(head) ((head)->stqh_first == NULL) #define STAILQ_FIRST(head) ((head)->stqh_first) #define STAILQ_FOREACH(var, head, field) \ for((var) = STAILQ_FIRST((head)); \ (var); \ (var) = STAILQ_NEXT((var), field)) #define STAILQ_FOREACH_FROM(var, head, field) \ for ((var) = ((var) ? (var) : STAILQ_FIRST((head))); \ (var); \ (var) = STAILQ_NEXT((var), field)) #define STAILQ_FOREACH_SAFE(var, head, field, tvar) \ for ((var) = STAILQ_FIRST((head)); \ (var) && ((tvar) = STAILQ_NEXT((var), field), 1); \ (var) = (tvar)) #define STAILQ_FOREACH_FROM_SAFE(var, head, field, tvar) \ for ((var) = ((var) ? (var) : STAILQ_FIRST((head))); \ (var) && ((tvar) = STAILQ_NEXT((var), field), 1); \ (var) = (tvar)) #define STAILQ_INIT(head) do { \ STAILQ_FIRST((head)) = NULL; \ (head)->stqh_last = &STAILQ_FIRST((head)); \ } while (0) #define STAILQ_INSERT_AFTER(head, tqelm, elm, field) do { \ if ((STAILQ_NEXT((elm), field) = STAILQ_NEXT((tqelm), field)) == NULL)\ (head)->stqh_last = &STAILQ_NEXT((elm), field); \ STAILQ_NEXT((tqelm), field) = (elm); \ } while (0) #define STAILQ_INSERT_HEAD(head, elm, field) do { \ if ((STAILQ_NEXT((elm), field) = STAILQ_FIRST((head))) == NULL) \ (head)->stqh_last = &STAILQ_NEXT((elm), field); \ STAILQ_FIRST((head)) = (elm); \ } while (0) #define STAILQ_INSERT_TAIL(head, elm, field) do { \ STAILQ_NEXT((elm), field) = NULL; \ *(head)->stqh_last = (elm); \ (head)->stqh_last = &STAILQ_NEXT((elm), field); \ } while (0) #define STAILQ_LAST(head, type, field) \ (STAILQ_EMPTY((head)) ? NULL : \ __containerof((head)->stqh_last, struct type, field.stqe_next)) #define STAILQ_NEXT(elm, field) ((elm)->field.stqe_next) #define STAILQ_REMOVE(head, elm, type, field) do { \ QMD_SAVELINK(oldnext, (elm)->field.stqe_next); \ if (STAILQ_FIRST((head)) == (elm)) { \ STAILQ_REMOVE_HEAD((head), field); \ } \ else { \ struct type *curelm = STAILQ_FIRST((head)); \ while (STAILQ_NEXT(curelm, field) != (elm)) \ curelm = STAILQ_NEXT(curelm, field); \ STAILQ_REMOVE_AFTER(head, curelm, field); \ } \ TRASHIT(*oldnext); \ } while (0) #define STAILQ_REMOVE_AFTER(head, elm, field) do { \ if ((STAILQ_NEXT(elm, field) = \ STAILQ_NEXT(STAILQ_NEXT(elm, field), field)) == NULL) \ (head)->stqh_last = &STAILQ_NEXT((elm), field); \ } while (0) #define STAILQ_REMOVE_HEAD(head, field) do { \ if ((STAILQ_FIRST((head)) = \ STAILQ_NEXT(STAILQ_FIRST((head)), field)) == NULL) \ (head)->stqh_last = &STAILQ_FIRST((head)); \ } while (0) #define STAILQ_SWAP(head1, head2, type) do { \ struct type *swap_first = STAILQ_FIRST(head1); \ struct type **swap_last = (head1)->stqh_last; \ STAILQ_FIRST(head1) = STAILQ_FIRST(head2); \ (head1)->stqh_last = (head2)->stqh_last; \ STAILQ_FIRST(head2) = swap_first; \ (head2)->stqh_last = swap_last; \ if (STAILQ_EMPTY(head1)) \ (head1)->stqh_last = &STAILQ_FIRST(head1); \ if (STAILQ_EMPTY(head2)) \ (head2)->stqh_last = &STAILQ_FIRST(head2); \ } while (0) /* * List declarations. */ #define LIST_HEAD(name, type) \ struct name { \ struct type *lh_first; /* first element */ \ } #define LIST_HEAD_INITIALIZER(head) \ { NULL } #define LIST_ENTRY(type) \ struct { \ struct type *le_next; /* next element */ \ struct type **le_prev; /* address of previous next element */ \ } /* * List functions. */ #if (defined(_KERNEL) && defined(INVARIANTS)) #define QMD_LIST_CHECK_HEAD(head, field) do { \ if (LIST_FIRST((head)) != NULL && \ LIST_FIRST((head))->field.le_prev != \ &LIST_FIRST((head))) \ panic("Bad list head %p first->prev != head", (head)); \ } while (0) #define QMD_LIST_CHECK_NEXT(elm, field) do { \ if (LIST_NEXT((elm), field) != NULL && \ LIST_NEXT((elm), field)->field.le_prev != \ &((elm)->field.le_next)) \ panic("Bad link elm %p next->prev != elm", (elm)); \ } while (0) #define QMD_LIST_CHECK_PREV(elm, field) do { \ if (*(elm)->field.le_prev != (elm)) \ panic("Bad link elm %p prev->next != elm", (elm)); \ } while (0) #else #define QMD_LIST_CHECK_HEAD(head, field) #define QMD_LIST_CHECK_NEXT(elm, field) #define QMD_LIST_CHECK_PREV(elm, field) #endif /* (_KERNEL && INVARIANTS) */ #define LIST_EMPTY(head) ((head)->lh_first == NULL) #define LIST_FIRST(head) ((head)->lh_first) #define LIST_FOREACH(var, head, field) \ for ((var) = LIST_FIRST((head)); \ (var); \ (var) = LIST_NEXT((var), field)) #define LIST_FOREACH_FROM(var, head, field) \ for ((var) = ((var) ? (var) : LIST_FIRST((head))); \ (var); \ (var) = LIST_NEXT((var), field)) #define LIST_FOREACH_SAFE(var, head, field, tvar) \ for ((var) = LIST_FIRST((head)); \ (var) && ((tvar) = LIST_NEXT((var), field), 1); \ (var) = (tvar)) #define LIST_FOREACH_FROM_SAFE(var, head, field, tvar) \ for ((var) = ((var) ? (var) : LIST_FIRST((head))); \ (var) && ((tvar) = LIST_NEXT((var), field), 1); \ (var) = (tvar)) #define LIST_INIT(head) do { \ LIST_FIRST((head)) = NULL; \ } while (0) #define LIST_INSERT_AFTER(listelm, elm, field) do { \ QMD_LIST_CHECK_NEXT(listelm, field); \ if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\ LIST_NEXT((listelm), field)->field.le_prev = \ &LIST_NEXT((elm), field); \ LIST_NEXT((listelm), field) = (elm); \ (elm)->field.le_prev = &LIST_NEXT((listelm), field); \ } while (0) #define LIST_INSERT_BEFORE(listelm, elm, field) do { \ QMD_LIST_CHECK_PREV(listelm, field); \ (elm)->field.le_prev = (listelm)->field.le_prev; \ LIST_NEXT((elm), field) = (listelm); \ *(listelm)->field.le_prev = (elm); \ (listelm)->field.le_prev = &LIST_NEXT((elm), field); \ } while (0) #define LIST_INSERT_HEAD(head, elm, field) do { \ QMD_LIST_CHECK_HEAD((head), field); \ if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL) \ LIST_FIRST((head))->field.le_prev = &LIST_NEXT((elm), field);\ LIST_FIRST((head)) = (elm); \ (elm)->field.le_prev = &LIST_FIRST((head)); \ } while (0) #define LIST_NEXT(elm, field) ((elm)->field.le_next) #define LIST_PREV(elm, head, type, field) \ ((elm)->field.le_prev == &LIST_FIRST((head)) ? NULL : \ __containerof((elm)->field.le_prev, struct type, field.le_next)) #define LIST_REMOVE(elm, field) do { \ QMD_SAVELINK(oldnext, (elm)->field.le_next); \ QMD_SAVELINK(oldprev, (elm)->field.le_prev); \ QMD_LIST_CHECK_NEXT(elm, field); \ QMD_LIST_CHECK_PREV(elm, field); \ if (LIST_NEXT((elm), field) != NULL) \ LIST_NEXT((elm), field)->field.le_prev = \ (elm)->field.le_prev; \ *(elm)->field.le_prev = LIST_NEXT((elm), field); \ TRASHIT(*oldnext); \ TRASHIT(*oldprev); \ } while (0) #define LIST_SWAP(head1, head2, type, field) do { \ struct type *swap_tmp = LIST_FIRST((head1)); \ LIST_FIRST((head1)) = LIST_FIRST((head2)); \ LIST_FIRST((head2)) = swap_tmp; \ if ((swap_tmp = LIST_FIRST((head1))) != NULL) \ swap_tmp->field.le_prev = &LIST_FIRST((head1)); \ if ((swap_tmp = LIST_FIRST((head2))) != NULL) \ swap_tmp->field.le_prev = &LIST_FIRST((head2)); \ } while (0) /* * Tail queue declarations. */ #define TAILQ_HEAD(name, type) \ struct name { \ struct type *tqh_first; /* first element */ \ struct type **tqh_last; /* addr of last next element */ \ TRACEBUF \ } #define TAILQ_HEAD_INITIALIZER(head) \ { NULL, &(head).tqh_first, TRACEBUF_INITIALIZER } #define TAILQ_ENTRY(type) \ struct { \ struct type *tqe_next; /* next element */ \ struct type **tqe_prev; /* address of previous next element */ \ TRACEBUF \ } /* * Tail queue functions. */ #if (defined(_KERNEL) && defined(INVARIANTS)) #define QMD_TAILQ_CHECK_HEAD(head, field) do { \ if (!TAILQ_EMPTY(head) && \ TAILQ_FIRST((head))->field.tqe_prev != \ &TAILQ_FIRST((head))) \ panic("Bad tailq head %p first->prev != head", (head)); \ } while (0) #define QMD_TAILQ_CHECK_TAIL(head, field) do { \ if (*(head)->tqh_last != NULL) \ panic("Bad tailq NEXT(%p->tqh_last) != NULL", (head)); \ } while (0) #define QMD_TAILQ_CHECK_NEXT(elm, field) do { \ if (TAILQ_NEXT((elm), field) != NULL && \ TAILQ_NEXT((elm), field)->field.tqe_prev != \ &((elm)->field.tqe_next)) \ panic("Bad link elm %p next->prev != elm", (elm)); \ } while (0) #define QMD_TAILQ_CHECK_PREV(elm, field) do { \ if (*(elm)->field.tqe_prev != (elm)) \ panic("Bad link elm %p prev->next != elm", (elm)); \ } while (0) #else #define QMD_TAILQ_CHECK_HEAD(head, field) #define QMD_TAILQ_CHECK_TAIL(head, headname) #define QMD_TAILQ_CHECK_NEXT(elm, field) #define QMD_TAILQ_CHECK_PREV(elm, field) #endif /* (_KERNEL && INVARIANTS) */ #define TAILQ_CONCAT(head1, head2, field) do { \ if (!TAILQ_EMPTY(head2)) { \ *(head1)->tqh_last = (head2)->tqh_first; \ (head2)->tqh_first->field.tqe_prev = (head1)->tqh_last; \ (head1)->tqh_last = (head2)->tqh_last; \ TAILQ_INIT((head2)); \ QMD_TRACE_HEAD(head1); \ QMD_TRACE_HEAD(head2); \ } \ } while (0) #define TAILQ_EMPTY(head) ((head)->tqh_first == NULL) #define TAILQ_FIRST(head) ((head)->tqh_first) #define TAILQ_FOREACH(var, head, field) \ for ((var) = TAILQ_FIRST((head)); \ (var); \ (var) = TAILQ_NEXT((var), field)) #define TAILQ_FOREACH_FROM(var, head, field) \ for ((var) = ((var) ? (var) : TAILQ_FIRST((head))); \ (var); \ (var) = TAILQ_NEXT((var), field)) #define TAILQ_FOREACH_SAFE(var, head, field, tvar) \ for ((var) = TAILQ_FIRST((head)); \ (var) && ((tvar) = TAILQ_NEXT((var), field), 1); \ (var) = (tvar)) #define TAILQ_FOREACH_FROM_SAFE(var, head, field, tvar) \ for ((var) = ((var) ? (var) : TAILQ_FIRST((head))); \ (var) && ((tvar) = TAILQ_NEXT((var), field), 1); \ (var) = (tvar)) #define TAILQ_FOREACH_REVERSE(var, head, headname, field) \ for ((var) = TAILQ_LAST((head), headname); \ (var); \ (var) = TAILQ_PREV((var), headname, field)) #define TAILQ_FOREACH_REVERSE_FROM(var, head, headname, field) \ for ((var) = ((var) ? (var) : TAILQ_LAST((head), headname)); \ (var); \ (var) = TAILQ_PREV((var), headname, field)) #define TAILQ_FOREACH_REVERSE_SAFE(var, head, headname, field, tvar) \ for ((var) = TAILQ_LAST((head), headname); \ (var) && ((tvar) = TAILQ_PREV((var), headname, field), 1); \ (var) = (tvar)) #define TAILQ_FOREACH_REVERSE_FROM_SAFE(var, head, headname, field, tvar) \ for ((var) = ((var) ? (var) : TAILQ_LAST((head), headname)); \ (var) && ((tvar) = TAILQ_PREV((var), headname, field), 1); \ (var) = (tvar)) #define TAILQ_INIT(head) do { \ TAILQ_FIRST((head)) = NULL; \ (head)->tqh_last = &TAILQ_FIRST((head)); \ QMD_TRACE_HEAD(head); \ } while (0) #define TAILQ_INSERT_AFTER(head, listelm, elm, field) do { \ QMD_TAILQ_CHECK_NEXT(listelm, field); \ if ((TAILQ_NEXT((elm), field) = TAILQ_NEXT((listelm), field)) != NULL)\ TAILQ_NEXT((elm), field)->field.tqe_prev = \ &TAILQ_NEXT((elm), field); \ else { \ (head)->tqh_last = &TAILQ_NEXT((elm), field); \ QMD_TRACE_HEAD(head); \ } \ TAILQ_NEXT((listelm), field) = (elm); \ (elm)->field.tqe_prev = &TAILQ_NEXT((listelm), field); \ QMD_TRACE_ELEM(&(elm)->field); \ QMD_TRACE_ELEM(&listelm->field); \ } while (0) #define TAILQ_INSERT_BEFORE(listelm, elm, field) do { \ QMD_TAILQ_CHECK_PREV(listelm, field); \ (elm)->field.tqe_prev = (listelm)->field.tqe_prev; \ TAILQ_NEXT((elm), field) = (listelm); \ *(listelm)->field.tqe_prev = (elm); \ (listelm)->field.tqe_prev = &TAILQ_NEXT((elm), field); \ QMD_TRACE_ELEM(&(elm)->field); \ QMD_TRACE_ELEM(&listelm->field); \ } while (0) #define TAILQ_INSERT_HEAD(head, elm, field) do { \ QMD_TAILQ_CHECK_HEAD(head, field); \ if ((TAILQ_NEXT((elm), field) = TAILQ_FIRST((head))) != NULL) \ TAILQ_FIRST((head))->field.tqe_prev = \ &TAILQ_NEXT((elm), field); \ else \ (head)->tqh_last = &TAILQ_NEXT((elm), field); \ TAILQ_FIRST((head)) = (elm); \ (elm)->field.tqe_prev = &TAILQ_FIRST((head)); \ QMD_TRACE_HEAD(head); \ QMD_TRACE_ELEM(&(elm)->field); \ } while (0) #define TAILQ_INSERT_TAIL(head, elm, field) do { \ QMD_TAILQ_CHECK_TAIL(head, field); \ TAILQ_NEXT((elm), field) = NULL; \ (elm)->field.tqe_prev = (head)->tqh_last; \ *(head)->tqh_last = (elm); \ (head)->tqh_last = &TAILQ_NEXT((elm), field); \ QMD_TRACE_HEAD(head); \ QMD_TRACE_ELEM(&(elm)->field); \ } while (0) #define TAILQ_LAST(head, headname) \ (*(((struct headname *)((head)->tqh_last))->tqh_last)) #define TAILQ_NEXT(elm, field) ((elm)->field.tqe_next) #define TAILQ_PREV(elm, headname, field) \ (*(((struct headname *)((elm)->field.tqe_prev))->tqh_last)) #define TAILQ_REMOVE(head, elm, field) do { \ QMD_SAVELINK(oldnext, (elm)->field.tqe_next); \ QMD_SAVELINK(oldprev, (elm)->field.tqe_prev); \ QMD_TAILQ_CHECK_NEXT(elm, field); \ QMD_TAILQ_CHECK_PREV(elm, field); \ if ((TAILQ_NEXT((elm), field)) != NULL) \ TAILQ_NEXT((elm), field)->field.tqe_prev = \ (elm)->field.tqe_prev; \ else { \ (head)->tqh_last = (elm)->field.tqe_prev; \ QMD_TRACE_HEAD(head); \ } \ *(elm)->field.tqe_prev = TAILQ_NEXT((elm), field); \ TRASHIT(*oldnext); \ TRASHIT(*oldprev); \ QMD_TRACE_ELEM(&(elm)->field); \ } while (0) #define TAILQ_SWAP(head1, head2, type, field) do { \ struct type *swap_first = (head1)->tqh_first; \ struct type **swap_last = (head1)->tqh_last; \ (head1)->tqh_first = (head2)->tqh_first; \ (head1)->tqh_last = (head2)->tqh_last; \ (head2)->tqh_first = swap_first; \ (head2)->tqh_last = swap_last; \ if ((swap_first = (head1)->tqh_first) != NULL) \ swap_first->field.tqe_prev = &(head1)->tqh_first; \ else \ (head1)->tqh_last = &(head1)->tqh_first; \ if ((swap_first = (head2)->tqh_first) != NULL) \ swap_first->field.tqe_prev = &(head2)->tqh_first; \ else \ (head2)->tqh_last = &(head2)->tqh_first; \ } while (0) #endif /* !_SYS_QUEUE_H_ */ readpe-0.84/include/config.h000066400000000000000000000041361455661113700157630ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit config.h Copyright (C) 2013 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #include struct _pev_config_t; // Forward declaration. typedef bool (*pev_config_parse_callback_t)(struct _pev_config_t * const config, const char *name, const char *value); typedef void (*pev_config_cleanup_callback_t)(void *data); typedef struct _pev_config_t { char *plugins_path; struct { pev_config_parse_callback_t parse_callback; pev_config_cleanup_callback_t cleanup_callback; void *data; } user_defined; } pev_config_t; const char *pev_plugins_path(void); int pev_load_config(pev_config_t * const config); void pev_cleanup_config(pev_config_t * const config); #ifdef USE_MY_ASPRINTF int asprintf( char **, char *, ... ); #endif readpe-0.84/include/output.h000066400000000000000000000066271455661113700160650ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit output.h - Symbols and APIs to be used to output data in multiple formats. Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #ifdef __cplusplus extern "C" { #endif #include #include typedef int format_id_t; typedef enum { OUTPUT_TYPE_SCOPE_UNKNOWN = 0, OUTPUT_TYPE_SCOPE_OPEN = 1, OUTPUT_TYPE_SCOPE_CLOSE = 2, OUTPUT_TYPE_ATTRIBUTE = 3 } output_type_e; typedef enum { OUTPUT_SCOPE_TYPE_UNKNOWN = 0, OUTPUT_SCOPE_TYPE_DOCUMENT = 1, OUTPUT_SCOPE_TYPE_OBJECT = 2, OUTPUT_SCOPE_TYPE_ARRAY = 3 } output_scope_type_e; typedef struct { char *name; output_scope_type_e type; uint16_t depth; output_scope_type_e parent_type; } output_scope_t; struct _format_t; // Forward declaration typedef void (*output_fn)( const struct _format_t *format, const output_type_e type, const output_scope_t *scope, const char *key, const char *value); typedef char * (*escape_fn)( const struct _format_t *format, const char *str); typedef char * const entity_t; typedef char ** const entity_table_t; typedef struct _format_t { const format_id_t id; const char *name; const output_fn output_fn; const escape_fn escape_fn; const entity_table_t entities_table; } format_t; void output_init(void); // IMPORTANT: Requires the text plugin to be already loaded. void output_term(void); const char *output_cmdline(void); void output_set_cmdline(int argc, char *argv[]); const format_t *output_format(void); const format_t *output_parse_format(const char *format_name); void output_set_format(const format_t *format); int output_set_format_by_name(const char *format_name); size_t output_available_formats(char *buffer, size_t size, char separator); void output_open_document(void); void output_open_document_with_name(const char *document_name); void output_close_document(void); void output_open_scope(const char *scope_name, output_scope_type_e type); void output_close_scope(void); void output(const char *key, const char *value); void output_keyval(const char *key, const char *value); #ifdef __cplusplus } //extern "C" #endif readpe-0.84/include/output_plugin.h000066400000000000000000000052111455661113700174270ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit output_plugin.h - Symbols and APIs to be used by output plugins. Copyright (C) 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #include "plugin.h" #include "output.h" #ifdef __cplusplus extern "C" { #endif // // Type definitions // // All definitions are in output.h // // Indentation macros // #define INDENT_TAB_SIZE 4 #define INDENT_COLUMNS_(level) (int)((int)(level) * (int)INDENT_TAB_SIZE) #define INDENT_FORMAT_ "%*s" #define INDENT_ARGS_(level) INDENT_COLUMNS_(level), "" #define INDENT(level, format) INDENT_FORMAT_ format, INDENT_ARGS_(level) // // Public API specific for output plugins. // typedef struct _output_plugin_api { const char * (* output_cmdline)(void); int (* output_plugin_register_format)(const format_t *format); void (* output_plugin_unregister_format)(const format_t *format); size_t (* escape_count_chars_ex)(const char *str, size_t len, const entity_table_t entities); char * (* escape_ex)(const char *str, const entity_table_t entities); char * (* escape_ex_quoted)(const char *str, const entity_table_t entities); char * (* escape)(const format_t *format, const char *str); char * (* escape_quoted)(const format_t *format, const char *str); } output_plugin_api_t; output_plugin_api_t *output_plugin_api_ptr(void); #ifdef __cplusplus } #endif readpe-0.84/include/pev_api.h000066400000000000000000000033431455661113700161400ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pev_api.h - Symbols and APIs to be used by all plugins. Copyright (C) 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #ifdef __cplusplus extern "C" { #endif struct _output_plugin_api; // from output_plugin.h typedef struct _pev_api_t { struct _output_plugin_api *output; } pev_api_t; pev_api_t *pev_api_ptr(void); #ifdef __cplusplus } //extern "C" #endif readpe-0.84/include/plugin.h000066400000000000000000000036751455661113700160230ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit plugin.h - Plugin API that every plugin MUST implement. Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #include #ifdef __cplusplus extern "C" { #endif struct _pev_api_t; typedef int (*plugin_loaded_fn_t)(void); typedef int (*plugin_initialize_fn_t)(const struct _pev_api_t *api); typedef void (*plugin_shutdown_fn_t)(void); typedef void (*plugin_unloaded_fn_t)(void); int plugin_loaded(void); int plugin_initialize(const struct _pev_api_t *api); void plugin_shutdown(void); void plugin_unloaded(void); #ifdef __cplusplus } //extern "C" #endif readpe-0.84/include/plugins.h000066400000000000000000000033751455661113700162030ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit plugins.h - Symbols and definitions for the plugins subsystem. Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once #include "config.h" #ifdef __cplusplus extern "C" { #endif int plugins_load(const char *path); int plugins_load_all(pev_config_t *config); int plugins_load_all_from_directory(const char *path); void plugins_unload_all(void); #ifdef __cplusplus } #endif readpe-0.84/include/stack.h000066400000000000000000000123461455661113700156250ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* stack.h - A simple stack implementation compatible with C99. The MIT License (MIT) Copyright (c) 2013, Jardel Weyrich Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ #pragma once #include #define STACK_PASTE_2_(_1,_2) _1 ## _2 #define STACK_PASTE_2(_1,_2) STACK_PASTE_2_(_1, _2) #if !defined(STACK_PREFIX) # define STACK_PREFIX PEV_ #endif #if !defined(STACK_ELEMENT_TYPE) # define STACK_ELEMENT_TYPE void * #endif #define STACK_TYPE STACK_PASTE_2(STACK_PREFIX, stack_t) #define STACK_API(fnname) STACK_PASTE_2(STACK_PREFIX, fnname) // Use these macros! Don't call functions directly. #define STACK_ALLOC(capacity) STACK_API(stack_alloc)(capacity) #define STACK_DEALLOC(stack_ptr) STACK_API(stack_dealloc)(stack_ptr) #define STACK_COUNT(stack_ptr) STACK_API(stack_count)(stack_ptr) #define STACK_GROW(stack_ptr, capacity) STACK_API(stack_grow)(stack_ptr, capacity) #define STACK_PUSH(stack_ptr, element) STACK_API(stack_push)(stack_ptr, element) #define STACK_POP(stack_ptr, element_ptr) STACK_API(stack_pop)(stack_ptr, element_ptr) #define STACK_PEEK(stack_ptr, element_ptr) STACK_API(stack_peek)(stack_ptr, element_ptr) typedef struct { uint16_t capacity; uint16_t used; STACK_ELEMENT_TYPE *elements; } STACK_TYPE; static STACK_TYPE *STACK_API(stack_alloc)(uint16_t capacity); static void STACK_API(stack_dealloc)(STACK_TYPE *stack); static uint16_t STACK_API(stack_count)(STACK_TYPE *stack); static int STACK_API(stack_grow)(STACK_TYPE *stack, uint16_t capacity); static int STACK_API(stack_push)(STACK_TYPE *stack, STACK_ELEMENT_TYPE element); static int STACK_API(stack_pop)(STACK_TYPE *stack, STACK_ELEMENT_TYPE *element); static int STACK_API(stack_peek)(STACK_TYPE *stack, STACK_ELEMENT_TYPE *element); // ---------------------------------------------------------------------------- #include #include #include #include STACK_TYPE * STACK_API(stack_alloc)(uint16_t capacity) { STACK_TYPE *stack = calloc(1, sizeof(STACK_TYPE)); if (stack == NULL) { fprintf(stderr, "stack: failed to allocate\n"); return NULL; } if (capacity > 0) { int ret = STACK_API(stack_grow)(stack, capacity); if (ret < 0) { STACK_API(stack_dealloc)(stack); return NULL; } } return stack; } void STACK_API(stack_dealloc)(STACK_TYPE *stack) { assert(stack != NULL); if (stack == NULL) { fprintf(stderr, "stack: attempt to deallocate NULL stack\n"); return; } if (stack->elements != NULL) free(stack->elements); //memset(stack, 0, sizeof(*stack)); free(stack); } uint16_t STACK_API(stack_count)(STACK_TYPE *stack) { assert(stack != NULL); return stack->used; } int STACK_API(stack_grow)(STACK_TYPE *stack, uint16_t capacity) { assert(stack != NULL); assert(capacity > stack->capacity); if (capacity <= stack->capacity) { fprintf(stderr, "stack: capacity cannot be decreased\n"); return -1; } const size_t element_size = sizeof(STACK_ELEMENT_TYPE); const size_t new_size = capacity * element_size; STACK_ELEMENT_TYPE *temp = realloc(stack->elements, new_size); if (temp == NULL) { fprintf(stderr, "stack: failed to allocate requested capacity\n"); return -2; } stack->elements = temp; stack->capacity = capacity; return 0; } int STACK_API(stack_push)(STACK_TYPE *stack, STACK_ELEMENT_TYPE element) { assert(stack != NULL); // Stack is full? if (stack->used >= stack->capacity) { // TODO(jweyrich): We could call `stack_grow` instead of failing miserably. Make this behavior adjustable? fprintf(stderr, "stack: stack is full - failed to push\n"); return -1; } stack->elements[stack->used++] = element; return 0; } int STACK_API(stack_pop)(STACK_TYPE *stack, STACK_ELEMENT_TYPE *element) { assert(stack != NULL); // Stack is empty? if (stack->used == 0) { fprintf(stderr, "stack: stack is empty - failed to pop\n"); return -1; } if (element != NULL) { *element = stack->elements[--stack->used]; } return 0; } int STACK_API(stack_peek)(STACK_TYPE *stack, STACK_ELEMENT_TYPE *element) { assert(stack != NULL); // Stack is empty? if (stack->used == 0) { fprintf(stderr, "stack: stack is empty - failed to peek\n"); return -1; } if (element != NULL) { *element = stack->elements[stack->used - 1]; } return 0; } readpe-0.84/lib/000077500000000000000000000000001455661113700134645ustar00rootroot00000000000000readpe-0.84/lib/libpe/000077500000000000000000000000001455661113700145575ustar00rootroot00000000000000readpe-0.84/lib/libpe/.github/000077500000000000000000000000001455661113700161175ustar00rootroot00000000000000readpe-0.84/lib/libpe/.github/workflows/000077500000000000000000000000001455661113700201545ustar00rootroot00000000000000readpe-0.84/lib/libpe/.github/workflows/ccpp.yml000066400000000000000000000003331455661113700216230ustar00rootroot00000000000000name: C/C++ CI on: push: branches: [ master ] pull_request: branches: [ master ] jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: make run: make readpe-0.84/lib/libpe/.gitignore000066400000000000000000000000271455661113700165460ustar00rootroot00000000000000*.o *.so *.dylib *.dll readpe-0.84/lib/libpe/.travis.yml000066400000000000000000000005421455661113700166710ustar00rootroot00000000000000language: c compiler: - gcc - clang branches: only: - master - mmap script: - make clean all - sudo make install notifications: email: on_success: change on_failure: always recipients: - jweyrich@gmail.com irc: on_success: always on_failure: always channels: - "irc.freenode.org#MenteBinaria" readpe-0.84/lib/libpe/LICENSE000066400000000000000000000167421455661113700155760ustar00rootroot00000000000000 GNU LESSER GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. This version of the GNU Lesser General Public License incorporates the terms and conditions of version 3 of the GNU General Public License, supplemented by the additional permissions listed below. 0. Additional Definitions. As used herein, "this License" refers to version 3 of the GNU Lesser General Public License, and the "GNU GPL" refers to version 3 of the GNU General Public License. "The Library" refers to a covered work governed by this License, other than an Application or a Combined Work as defined below. An "Application" is any work that makes use of an interface provided by the Library, but which is not otherwise based on the Library. Defining a subclass of a class defined by the Library is deemed a mode of using an interface provided by the Library. A "Combined Work" is a work produced by combining or linking an Application with the Library. The particular version of the Library with which the Combined Work was made is also called the "Linked Version". The "Minimal Corresponding Source" for a Combined Work means the Corresponding Source for the Combined Work, excluding any source code for portions of the Combined Work that, considered in isolation, are based on the Application, and not on the Linked Version. The "Corresponding Application Code" for a Combined Work means the object code and/or source code for the Application, including any data and utility programs needed for reproducing the Combined Work from the Application, but excluding the System Libraries of the Combined Work. 1. Exception to Section 3 of the GNU GPL. You may convey a covered work under sections 3 and 4 of this License without being bound by section 3 of the GNU GPL. 2. Conveying Modified Versions. If you modify a copy of the Library, and, in your modifications, a facility refers to a function or data to be supplied by an Application that uses the facility (other than as an argument passed when the facility is invoked), then you may convey a copy of the modified version: a) under this License, provided that you make a good faith effort to ensure that, in the event an Application does not supply the function or data, the facility still operates, and performs whatever part of its purpose remains meaningful, or b) under the GNU GPL, with none of the additional permissions of this License applicable to that copy. 3. Object Code Incorporating Material from Library Header Files. The object code form of an Application may incorporate material from a header file that is part of the Library. You may convey such object code under terms of your choice, provided that, if the incorporated material is not limited to numerical parameters, data structure layouts and accessors, or small macros, inline functions and templates (ten or fewer lines in length), you do both of the following: a) Give prominent notice with each copy of the object code that the Library is used in it and that the Library and its use are covered by this License. b) Accompany the object code with a copy of the GNU GPL and this license document. 4. Combined Works. You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in the Combined Work and reverse engineering for debugging such modifications, if you also do each of the following: a) Give prominent notice with each copy of the Combined Work that the Library is used in it and that the Library and its use are covered by this License. b) Accompany the Combined Work with a copy of the GNU GPL and this license document. c) For a Combined Work that displays copyright notices during execution, include the copyright notice for the Library among these notices, as well as a reference directing the user to the copies of the GNU GPL and this license document. d) Do one of the following: 0) Convey the Minimal Corresponding Source under the terms of this License, and the Corresponding Application Code in a form suitable for, and under terms that permit, the user to recombine or relink the Application with a modified version of the Linked Version to produce a modified Combined Work, in the manner specified by section 6 of the GNU GPL for conveying Corresponding Source. 1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version. e) Provide Installation Information, but only if you would otherwise be required to provide such information under section 6 of the GNU GPL, and only to the extent that such information is necessary to install and execute a modified version of the Combined Work produced by recombining or relinking the Application with a modified version of the Linked Version. (If you use option 4d0, the Installation Information must accompany the Minimal Corresponding Source and Corresponding Application Code. If you use option 4d1, you must provide the Installation Information in the manner specified by section 6 of the GNU GPL for conveying Corresponding Source.) 5. Combined Libraries. You may place library facilities that are a work based on the Library side by side in a single library together with other library facilities that are not Applications and are not covered by this License, and convey such a combined library under terms of your choice, if you do both of the following: a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities, conveyed under the terms of this License. b) Give prominent notice with the combined library that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. 6. Revised Versions of the GNU Lesser General Public License. The Free Software Foundation may publish revised and/or new versions of the GNU Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Library as you received it specifies that a certain numbered version of the GNU Lesser General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that published version or of any later version published by the Free Software Foundation. If the Library as you received it does not specify a version number of the GNU Lesser General Public License, you may choose any version of the GNU Lesser General Public License ever published by the Free Software Foundation. If the Library as you received it specifies that a proxy can decide whether future versions of the GNU Lesser General Public License shall apply, that proxy's public statement of acceptance of any version is permanent authorization for you to choose that version for the Library.readpe-0.84/lib/libpe/Makefile000066400000000000000000000135511455661113700162240ustar00rootroot00000000000000####### Platform specifics # cut is necessary for Cygwin PLATFORM_OS := $(shell uname | cut -d_ -f1) ####### Makefile Conventions - Directory variables srcdir = . prefix = /usr/local exec_prefix = $(prefix) sysconfdir = $(prefix)/etc includedir = $(prefix)/include datarootdir = $(prefix)/share localstatedir = $(prefix)/var bindir = $(exec_prefix)/bin libdir = $(exec_prefix)/lib libexecdir = $(exec_prefix)/libexec sbindir = $(exec_prefix)/sbin datadir = $(datarootdir) docdir = $(datarootdir)/doc/pev infodir = $(datarootdir)/info localedir = $(datarootdir)/locale mandir = $(datarootdir)/man manext = .1 man1dir = $(mandir)/man1 man1ext = .1 ####### Makefile Conventions - Utilities CC ?= gcc LINK = $(CC) CHK_DIR_EXISTS = test -d CHK_FILE_EXISTS = test -f INSTALL = install INSTALL_DATA = ${INSTALL} -m 644 INSTALL_PROGRAM = $(INSTALL) SYMLINK = ln -sf MKDIR = mkdir -p RM = rm -f RM_DIR = rm -rf ifeq ($(PLATFORM_OS), Darwin) STRIP = strip -x else STRIP = strip --strip-unneeded endif ####### Compiler options override CFLAGS += \ -O2 -ffast-math \ -I"./include" \ -fPIC \ -W -Wall -Wextra -pedantic -std=c99 -c #override LDFLAGS += -lssl -lcrypto LIBS = -lssl -lcrypto -lm # --- FIX: -fPIC is necessary to ALL shared objects! Changed above. #ifneq ($(PLATFORM_OS), CYGWIN) # override CFLAGS += -fPIC #endif VERSION = 0.84 LIBNAME = libpe SRC_DIRS = $(srcdir) $(srcdir)/libfuzzy libpe_BUILDDIR = $(CURDIR)/build libpe_SRCS_FILTER = $(sort $(wildcard ${dir}/*.c)) libpe_SRCS = $(foreach dir, ${SRC_DIRS}, ${libpe_SRCS_FILTER}) libpe_OBJS = $(addprefix ${libpe_BUILDDIR}/, $(addsuffix .o, $(basename ${libpe_SRCS}))) ####### Build rules .PHONY : libpe install strip-binaries install-strip uninstall clean all: libpe # FIX: WARNING.. ld expects -l option at the END of the command line or after the object files. # From gcc's documentation: # # It makes a difference where in the command you write this option; the linker searches and processes # libraries and object files in the order they are specified. Thus, ‘foo.o -lz bar.o’ searches library # ‘z’ after file foo.o but before bar.o. If bar.o refers to functions in ‘z’, those functions # may not be loaded. # libpe: CPPFLAGS += -D_GNU_SOURCE ifeq ($(PLATFORM_OS), CYGWIN) libpe: CPPFLAGS += -D_XOPEN_SOURCE=600 endif libpe: $(libpe_OBJS) ifeq ($(PLATFORM_OS), Linux) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o $(LIBNAME).so $^ $(LIBS) else ifeq ($(PLATFORM_OS), NetBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o $(LIBNAME).so $^ $(LIBS) else ifeq ($(PLATFORM_OS), FreeBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o $(LIBNAME).so $^ $(LIBS) else ifeq ($(PLATFORM_OS), OpenBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o $(LIBNAME).so $^ $(LIBS) else ifeq ($(PLATFORM_OS), GNU) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o $(LIBNAME).so $^ $(LIBS) else ifeq ($(PLATFORM_OS), GNU/kFreeBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o $(LIBNAME).so $^ $(LIBS) else ifeq ($(PLATFORM_OS), Darwin) $(LINK) -headerpad_max_install_names -dynamiclib \ -flat_namespace -install_name $(LIBNAME).$(VERSION).dylib \ -current_version $(VERSION) -compatibility_version $(VERSION) \ $(LDFLAGS) -o $(LIBNAME).dylib $^ $(LIBS) else ifeq ($(PLATFORM_OS), CYGWIN) $(LINK) -shared -o $(LIBNAME).dll $^ $(LDFLAGS) $(LIBS) endif $(libpe_BUILDDIR)/%.o: %.c @$(CHK_DIR_EXISTS) $(dir $@) || $(MKDIR) $(dir $@) $(CC) -c $(CFLAGS) $(CPPFLAGS) -o $@ $< install: installdirs ifeq ($(PLATFORM_OS), Linux) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).so $(DESTDIR)$(libdir)/$(LIBNAME).so.$(VERSION) cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so.1 else ifeq ($(PLATFORM_OS), NetBSD) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).so $(DESTDIR)$(libdir)/$(LIBNAME).so.$(VERSION) cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so.1 else ifeq ($(PLATFORM_OS), FreeBSD) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).so $(DESTDIR)$(libdir)/$(LIBNAME).so.$(VERSION) cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so.1 else ifeq ($(PLATFORM_OS), OpenBSD) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).so $(DESTDIR)$(libdir)/$(LIBNAME).so.$(VERSION) cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so.1 else ifeq ($(PLATFORM_OS), GNU) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).so $(DESTDIR)$(libdir)/$(LIBNAME).so.$(VERSION) cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so.1 else ifeq ($(PLATFORM_OS), GNU/kFreeBSD) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).so $(DESTDIR)$(libdir)/$(LIBNAME).so.$(VERSION) cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).so.$(VERSION) $(LIBNAME).so.1 else ifeq ($(PLATFORM_OS), Darwin) $(INSTALL_DATA) $(INSTALL_FLAGS) $(LIBNAME).dylib $(DESTDIR)$(libdir)/$(LIBNAME).$(VERSION).dylib cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).$(VERSION).dylib $(LIBNAME).dylib cd $(DESTDIR)$(libdir); $(SYMLINK) $(LIBNAME).$(VERSION).dylib $(LIBNAME).1.dylib else ifeq ($(PLATFORM_OS), CYGWIN) # TODO endif installdirs: @$(CHK_DIR_EXISTS) $(DESTDIR) || $(MKDIR) $(DESTDIR) @$(CHK_DIR_EXISTS) $(DESTDIR)$(libdir) || $(MKDIR) $(DESTDIR)$(libdir) install-strip: INSTALL_FLAGS += -s install-strip: install uninstall: $(RM) $(DESTDIR)$(libdir)/$(LIBNAME).so* \ $(DESTDIR)$(libdir)/$(LIBNAME)*.dylib clean: $(RM_DIR) $(libpe_BUILDDIR) $(RM) $(LIBNAME)*.o \ $(LIBNAME)*.so \ $(LIBNAME)*.dylib \ $(LIBNAME)*.dll readpe-0.84/lib/libpe/README.md000066400000000000000000000040421455661113700160360ustar00rootroot00000000000000# libpe [![LGPLv3](https://www.gnu.org/graphics/lgplv3-88x31.png)](http://www.gnu.org/licenses/lgpl.html) ![C/C++ CI](https://github.com/mentebinaria/readpe/workflows/C/C++%20CI/badge.svg) The PE library used by [pev](https://github.com/mentebinaria/readpe) - the PE file toolkit purely written in C and available to many platforms. ## Features - Support for both 32 and 64-bits PE files. - ssdeep support (built-in libfuzzy). - Imphash support. - Crypographic digests calculation (using OpeenSSL). ## How to get the source code git clone https://github.com/mentebinaria/readpe.git ## How to build on Linux cd libpe make **NOTE**: You may need to install OpenSSL using your package manager. Examples: apt install libssl-dev yum install openssl-devel ## How to build on macOS cd libpe CFLAGS="-I/usr/local/opt/openssl/include/" LDFLAGS="-L/usr/local/opt/openssl/lib/" make **NOTE**: You may need to install OpenSSL and PCRE via [Homebrew](http://brew.sh/): brew update brew install openssl ## Usage example ```c #include #include "../include/libpe/pe.h" int main(int argc, char *argv[]) { if (argc < 2) return 1; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, argv[1]); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return 1; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return 1; } if (!pe_is_pe(&ctx)) return 1; printf("Entrypoint: %#llx\n", ctx.pe.entrypoint); return 0; } ``` Compile with: cc -o example example.c -lpe ## Troubleshooting - **Error while loading shared libraries: libpe.so.1** - The prefix used in libpe's makefile is `/usr/local/lib` - If your system isn't set to look here, you can add it to `ld.so.conf` - Alternatively, change prefix to whatever suits, ie. `/usr/lib` - **Undefined reference to `log`** - Linux' glibc does not define math functions, they live instead in libm - Link against both libpe and libm to fix this (ie. `-lm`) readpe-0.84/lib/libpe/error.c000066400000000000000000000124121455661113700160540ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/error.h" #include "libpe/macros.h" #include #include #include // FIX: Since all errors, except the first, // are negative values, we could change the // order of the strings in the static array // to simplify this function. // // If you change pe_err_e in libpe/error.h, this // this must be changed too. const char *pe_error_msg(pe_err_e error) { static const char * const errors[] = { // This is 0 "no error", // LIBPE_E_OK, // FIX: Strings in reverse... // ALL those errors are 'negative' (as in libpe/error.h). // Misc "no functions found", //LIBPE_E_NO_FUNCIONS_FOUND "no callbacks found", //LIBPE_E_NO_CALLBACKS_FOUND // Hashes Errors "error calculating hash", // LIBPE_E_HASHING_FAILED // Exports errors "number of functions not equal to number of names", //LIBPE_E_EXPORTS_FUNC_NEQ_NAMES "cannot read exports directory", // LIBPE_E_EXPORTS_CANT_READ_DIR "cannot read relative virtual address", //LIBPE_E_EXPORTS_CANT_READ_RVA "type punning failed", // LIBPE_E_TYPE_PUNNING_FAILED "too many sections", // LIBPE_E_TOO_MANY_SECTIONS, "too many directories", // LIBPE_E_TOO_MANY_DIRECTORIES, "close() failed", // LIBPE_E_CLOSE_FAILED, "munmap() failed", // LIBPE_E_MUNMAP_FAILED, "mmap() failed", // LIBPE_E_MMAP_FAILED, "unsupported image format", // LIBPE_E_UNSUPPORTED_IMAGE, "invalid signature", // LIBPE_E_INVALID_SIGNATURE, "missing OPTIONAL header", // LIBPE_E_MISSING_OPTIONAL_HEADER, "missing COFF header", // LIBPE_E_MISSING_COFF_HEADER, "invalid e_lfanew", // LIBPE_E_INVALID_LFANEW, "not a PE file", // LIBPE_E_NOT_A_PE_FILE, "not a regular file", // LIBPE_E_NOT_A_FILE, "fstat() failed", // LIBPE_E_FSTAT_FAILED, "fdopen() failed", // LIBPE_E_FDOPEN_FAILED, "open() failed", // LIBPE_E_OPEN_FAILED, "allocation failure" // LIBPE_E_ALLOCATION_FAILURE, }; // FIX: Convoluted way to use negative errors! The code below is easier and faster. // static const size_t index_max = LIBPE_SIZEOF_ARRAY(errors); // size_t index = index_max + error; // return (index < index_max) // ? errors[index] // : (index == index_max) // ? errors[0] // LIBPE_E_OK // : "invalid error code"; unsigned int index = abs(error); if ( index >= LIBPE_SIZEOF_ARRAY(errors) ) return "invalid error code"; return errors[index]; } void pe_error_print(FILE *stream, pe_err_e error) { if (errno == 0) { fprintf(stream, "ERROR [%d]: %s\n", error, pe_error_msg(error)); } else { char errmsg[255]; /* * Quotes from https://linux.die.net/man/3/strerror_r * * The strerror_r() function is similar to strerror(), but is thread safe. This function * is available in two versions: an XSI-compliant version specified in POSIX.1-2001 * (available since glibc 2.3.4, but not POSIX-compliant until glibc 2.13), and a * GNU-specific version (available since glibc 2.0). The XSI-compliant version is provided * with the feature test macros settings shown in the SYNOPSIS; otherwise the GNU-specific * version is provided. If no feature test macros are explicitly defined, then (since * glibc 2.4) _POSIX_SOURCE is defined by default with the value 200112L, so that the * XSI-compliant version of strerror_r() is provided by default. * * The XSI-compliant strerror_r() is preferred for portable applications. It returns the * error string in the user-supplied buffer buf of length buflen. * * The GNU-specific strerror_r() returns a pointer to a string containing the error * message. This may be either a pointer to a string that the function stores in buf, or * a pointer to some (immutable) static string (in which case buf is unused). If the * function stores a string in buf, then at most buflen bytes are stored (the string may * be truncated if buflen is too small and errnum is unknown). The string always includes * a terminating null byte. */ // Since we define _GNU_SOURCE in our Makefile, strerror_r should be GNU-compliant. // However, looks like if you're on macOS, strerror_r is XSI-compliant. #if defined(__DARWIN_C_LEVEL) // XSI-compliant /* int ret = */ strerror_r(errno, errmsg, sizeof errmsg); const char *errmsg_ptr = errmsg; #elif defined(_GNU_SOURCE) // GNU-specific const char *errmsg_ptr = strerror_r(errno, errmsg, sizeof errmsg); #else // Fallback to XSI-compliant /* int ret = */ strerror_r(errno, errmsg, sizeof errmsg); const char *errmsg_ptr = errmsg; #endif fprintf(stream, "ERROR [%d]: %s (%s)\n", error, pe_error_msg(error), errmsg_ptr); } } readpe-0.84/lib/libpe/exports.c000066400000000000000000000156171455661113700164410ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/exports.h" #include "libpe/pe.h" #include #include pe_exports_t *pe_exports(pe_ctx_t *ctx) { if (ctx->cached_data.exports != NULL) return ctx->cached_data.exports; pe_exports_t *exports = ctx->cached_data.exports = calloc(1, sizeof(pe_exports_t)); if (exports == NULL) { // TODO(jweyrich): Should we report an error? If yes, we need a redesign. return NULL; } exports->err = LIBPE_E_OK; const IMAGE_DATA_DIRECTORY *dir = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_EXPORT); if (dir == NULL) { return exports; } const uint64_t va = dir->VirtualAddress; if (va == 0) { // NOTE: This file has no exported symbols. return exports; } uint64_t ofs; ofs = pe_rva2ofs(ctx, va); const IMAGE_EXPORT_DIRECTORY *exp = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, exp, sizeof(IMAGE_EXPORT_DIRECTORY))) { exports->err = LIBPE_E_EXPORTS_CANT_READ_DIR; return exports; } ofs = pe_rva2ofs(ctx, exp->Name); const char *name_ptr = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, name_ptr, 1)) { exports->err = LIBPE_E_EXPORTS_CANT_READ_RVA; return exports; } exports->name = strdup(name_ptr); const uint32_t ordinal_base = exp->Base; ofs = pe_rva2ofs(ctx, exp->AddressOfNames); const uint32_t *rva_ptr = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, rva_ptr, sizeof(uint32_t))) { exports->err = LIBPE_E_EXPORTS_CANT_READ_RVA; return exports; } // If `NumberOfNames == 0` then all functions are exported by ordinal. // Otherwise `NumberOfNames` should be equal to `NumberOfFunctions` // if (exp->NumberOfNames != 0 && exp->NumberOfNames != exp->NumberOfFunctions) { // exports->err = LIBPE_E_EXPORTS_FUNC_NEQ_NAMES; // return exports; // } // // The format of IMAGE_EXPORT_DIRECTORY can be seen in http://i.msdn.microsoft.com/dynimg/IC60608.gif // // We want to use `NumberOfFunctions` for looping as it's the total number of functions/symbols // exported by the module. On the other hand, `NumberOfNames` is the number of // functions/symbols exported by name only. exports->functions_count = exp->NumberOfFunctions; exports->functions = calloc(exp->NumberOfFunctions, sizeof(pe_exported_function_t)); if (exports->functions == NULL) { exports->err = LIBPE_E_ALLOCATION_FAILURE; return exports; } const uint64_t offset_to_AddressOfFunctions = pe_rva2ofs(ctx, exp->AddressOfFunctions); const uint64_t offset_to_AddressOfNames = pe_rva2ofs(ctx, exp->AddressOfNames); const uint64_t offset_to_AddressOfNameOrdinals = pe_rva2ofs(ctx, exp->AddressOfNameOrdinals); uint64_t offsets_to_Names[exp->NumberOfFunctions]; memset(offsets_to_Names, 0, sizeof(offsets_to_Names)); // This is needed for VLAs. // // Names // for (uint32_t i=0; i < exp->NumberOfNames; i++) { uint64_t entry_ordinal_list_ptr = offset_to_AddressOfNameOrdinals + sizeof(uint16_t) * i; uint16_t *entry_ordinal_list = LIBPE_PTR_ADD(ctx->map_addr, entry_ordinal_list_ptr); if (!pe_can_read(ctx, entry_ordinal_list, sizeof(uint16_t))) { // TODO: Should we report something? break; } const uint16_t ordinal = *entry_ordinal_list; uint64_t entry_name_list_ptr = offset_to_AddressOfNames + sizeof(uint32_t) * i; uint32_t *entry_name_list = LIBPE_PTR_ADD(ctx->map_addr, entry_name_list_ptr); if (!pe_can_read(ctx, entry_name_list, sizeof(uint32_t))) { // TODO: Should we report something? break; } const uint32_t entry_name_rva = *entry_name_list; const uint64_t entry_name_ofs = pe_rva2ofs(ctx, entry_name_rva); if (ordinal < exp->NumberOfFunctions) { offsets_to_Names[ordinal] = entry_name_ofs; } } // // Functions // for (uint32_t i=0; i < exp->NumberOfFunctions; i++) { uint64_t entry_va_list_ptr = offset_to_AddressOfFunctions + sizeof(uint32_t) * i; uint32_t *entry_va_list = LIBPE_PTR_ADD(ctx->map_addr, entry_va_list_ptr); if (!pe_can_read(ctx, entry_va_list, sizeof(uint32_t))) { break; } // Add `Base` to the element of `AddressOfNameOrdinals` array to get the correct ordinal.. //const uint16_t entry_ordinal = exp->Base + *entry_ordinal_list; const uint32_t entry_va = *entry_va_list; const uint64_t entry_name_ofs = offsets_to_Names[i]; // FIX: Don't need to zero all elements! // FIXME: 300 bytes is enough or too much? char fname[300]; fname[0] = 0; if (entry_name_ofs != 0) { const char *entry_name = LIBPE_PTR_ADD(ctx->map_addr, entry_name_ofs); // Validate whether it's ok to access at least 1 byte after entry_name. // It might be '\0', for example. if (!pe_can_read(ctx, entry_name, 1)) { break; } //printf("ord=%d, va=%x, name=%s\n", entry_ordinal, entry_va, entry_name); const size_t fname_size = sizeof(fname); strncpy(fname, entry_name, fname_size-1); // Because `strncpy` does not guarantee to NUL terminate the string itself, this must be done explicitly. fname[fname_size - 1] = '\0'; } exports->functions[i].ordinal = ordinal_base + i; exports->functions[i].address = entry_va; exports->functions[i].name = strdup(fname); if (exports->functions[i].name == NULL) { exports->err = LIBPE_E_ALLOCATION_FAILURE; return exports; } // Check whether the exported function is forwarded. // It's forwarded if its RVA is inside the exports section. if (entry_va >= va && entry_va <= va + dir->Size) { // When a symbol is forwarded, its RVA points to a string containing // the name of the DLL and symbol to which it is forwarded. const uint64_t fw_entry_name_ofs = pe_rva2ofs(ctx, entry_va); const char *fw_entry_name = LIBPE_PTR_ADD(ctx->map_addr, fw_entry_name_ofs); // Validate whether it's ok to access at least 1 byte after fw_entry_name. // It might be '\0', for example. if (!pe_can_read(ctx, fw_entry_name, 1)) { break; } exports->functions[i].fwd_name = strdup(fw_entry_name); if (exports->functions[i].fwd_name == NULL) { exports->err = LIBPE_E_ALLOCATION_FAILURE; return exports; } } } return exports; } void pe_exports_dealloc(pe_exports_t *obj) { if (obj == NULL) return; for (uint32_t i=0; i < obj->functions_count; i++) free(obj->functions[i].name); free(obj->functions); free(obj->name); free(obj); } readpe-0.84/lib/libpe/hashes.c000066400000000000000000000463351455661113700162110ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/hashes.h" #include "libpe/error.h" #include "libpe/pe.h" #include "libfuzzy/fuzzy.h" #include "libpe/ordlookup.h" #include "libpe/utlist.h" #include #include #include #include #include #include // add utility #define PEV_ABORT_IF(cond) \ do { (cond) ? abort() : (void)0; } while (0) /* By liw. */ static char *last_strstr(char *haystack, const char *needle) { if (needle == NULL || *needle == '\0') return haystack; char *result = NULL; for (;;) { char *p = strstr(haystack, needle); if (p == NULL) break; result = p; haystack = p + 1; } return result; } static pe_err_e get_hashes(pe_hash_t *output, const char *name, const unsigned char *data, size_t data_size) { pe_err_e ret = LIBPE_E_OK; const size_t hash_maxsize = pe_hash_recommended_size(); char *hash_value = calloc(1, hash_maxsize); if (hash_value == NULL) { ret = LIBPE_E_ALLOCATION_FAILURE; goto error; } output->name = strdup(name); if (output->name == NULL) { ret = LIBPE_E_ALLOCATION_FAILURE; goto error; } bool hash_ok; hash_ok = pe_hash_raw_data(hash_value, hash_maxsize, "md5", data, data_size); if (!hash_ok) { ret = LIBPE_E_HASHING_FAILED; goto error; } output->md5 = strdup(hash_value); if (output->md5 == NULL) { ret = LIBPE_E_ALLOCATION_FAILURE; goto error; } hash_ok = pe_hash_raw_data(hash_value, hash_maxsize, "sha1", data, data_size); if (!hash_ok) { ret = LIBPE_E_HASHING_FAILED; goto error; } output->sha1 = strdup(hash_value); if (output->sha1 == NULL) { ret = LIBPE_E_ALLOCATION_FAILURE; goto error; } hash_ok = pe_hash_raw_data(hash_value, hash_maxsize, "sha256", data, data_size); if (!hash_ok) { ret = LIBPE_E_HASHING_FAILED; goto error; } output->sha256 = strdup(hash_value); if (output->sha256 == NULL) { ret = LIBPE_E_ALLOCATION_FAILURE; goto error; } hash_ok = pe_hash_raw_data(hash_value, hash_maxsize, "ssdeep", data, data_size); if (!hash_ok) { ret = LIBPE_E_HASHING_FAILED; goto error; } output->ssdeep = strdup(hash_value); if (output->ssdeep == NULL) { ret = LIBPE_E_ALLOCATION_FAILURE; goto error; } error: free(hash_value); return ret; } static pe_err_e get_headers_dos_hash(pe_ctx_t *ctx, pe_hash_t *output) { const IMAGE_DOS_HEADER *sample = pe_dos(ctx); const unsigned char *data = (const unsigned char *)sample; const uint64_t data_size = sizeof(IMAGE_DOS_HEADER); return get_hashes(output, "IMAGE_DOS_HEADER", data, data_size); } static pe_err_e get_headers_coff_hash(pe_ctx_t *ctx, pe_hash_t *output) { const IMAGE_COFF_HEADER *sample = pe_coff(ctx); const unsigned char *data = (const unsigned char *)sample; const uint64_t data_size = sizeof(IMAGE_COFF_HEADER); return get_hashes(output, "IMAGE_COFF_HEADER", data, data_size); } static pe_err_e get_headers_optional_hash(pe_ctx_t *ctx, pe_hash_t *output) { const IMAGE_OPTIONAL_HEADER *sample = pe_optional(ctx); switch (sample->type) { case MAGIC_ROM: { const unsigned char *data = (const unsigned char *)sample->_rom; const uint64_t data_size = sizeof(IMAGE_ROM_OPTIONAL_HEADER); return get_hashes(output, "IMAGE_ROM_OPTIONAL_HEADER", data, data_size); } case MAGIC_PE32: { const unsigned char *data = (const unsigned char *)sample->_32; const uint64_t data_size = sizeof(IMAGE_OPTIONAL_HEADER_32); return get_hashes(output, "IMAGE_OPTIONAL_HEADER_32", data, data_size); } case MAGIC_PE64: { const unsigned char *data = (const unsigned char *)sample->_64; const uint64_t data_size = sizeof(IMAGE_OPTIONAL_HEADER_64); return get_hashes(output, "IMAGE_OPTIONAL_HEADER_64", data, data_size); } default: return LIBPE_E_UNSUPPORTED_IMAGE; } } // FIX: Don't need to allocate space for these constants! #define G_OPENSSL_HASH_MAXSIZE (EVP_MAX_MD_SIZE * 2 + 1) #define G_SSDEEP_HASH_MAXSIZE (FUZZY_MAX_RESULT) size_t pe_hash_recommended_size(void) { // Since standard C lacks max(), we do it manually. const size_t result = G_OPENSSL_HASH_MAXSIZE > G_SSDEEP_HASH_MAXSIZE ? G_OPENSSL_HASH_MAXSIZE : G_SSDEEP_HASH_MAXSIZE; return result; } // add function to tranforms set of bytes in hex equivalente into output string static void to_hex_str(const uint8_t* input, char* output, size_t n) { for (const uint8_t* input_ptr = input; n; --n, ++input_ptr) { unsigned b = (*input_ptr); *output++ = "0123456789abcdef"[b >> 4]; *output++ = "0123456789abcdef"[b & 0xf]; } } bool pe_hash_raw_data(char *output, size_t output_size, const char *alg_name, const unsigned char *data, size_t data_size) { if (strcmp("ssdeep", alg_name) == 0) { if (output_size < G_SSDEEP_HASH_MAXSIZE) { // Not enough space. return false; } fuzzy_hash_buf(data, data_size, output); return true; } if (output_size < G_OPENSSL_HASH_MAXSIZE) { // Not enough space. return false; } const EVP_MD *md = EVP_get_digestbyname(alg_name); if (md == NULL) { // Unsupported hash algorithm. return false; } unsigned char md_value[EVP_MAX_MD_SIZE]; unsigned int md_len; // See https://wiki.openssl.org/index.php/1.1_API_Changes #if OPENSSL_VERSION_NUMBER < 0x10100000L EVP_MD_CTX md_ctx_auto; EVP_MD_CTX *md_ctx = &md_ctx_auto; #else EVP_MD_CTX *md_ctx = EVP_MD_CTX_new(); #endif // FIXME: Handle errors - Check return values. EVP_MD_CTX_init(md_ctx); EVP_DigestInit_ex(md_ctx, md, NULL); EVP_DigestUpdate(md_ctx, data, data_size); EVP_DigestFinal_ex(md_ctx, md_value, &md_len); #if OPENSSL_VERSION_NUMBER < 0x10100000L EVP_MD_CTX_cleanup(md_ctx); #else EVP_MD_CTX_free(md_ctx); #endif // FIX: Better than going through all the input calculating the byte2hex of each byte. to_hex_str(md_value, output, md_len); return true; } pe_hash_headers_t *pe_get_headers_hashes(pe_ctx_t *ctx) { if (ctx->cached_data.hash_headers != NULL) return ctx->cached_data.hash_headers; pe_hash_headers_t *result = ctx->cached_data.hash_headers = calloc(1, sizeof(pe_hash_headers_t)); if (result == NULL) { // TODO(jweyrich): Should we report an error? If yes, we need a redesign. return NULL; } result->err = LIBPE_E_OK; pe_err_e status = LIBPE_E_OK; result->dos = malloc(sizeof(pe_hash_t)); if (result->dos == NULL) { result->err = LIBPE_E_ALLOCATION_FAILURE; goto error; } status = get_headers_dos_hash(ctx, result->dos); if (status != LIBPE_E_OK) { result->err = status; goto error; } result->optional = malloc(sizeof(pe_hash_t)); if (result->optional == NULL) { result->err = LIBPE_E_ALLOCATION_FAILURE; goto error; } status = get_headers_optional_hash(ctx, result->optional); if (status != LIBPE_E_OK) { result->err = status; goto error; } result->coff = malloc(sizeof(pe_hash_t)); if (result->coff == NULL) { status = LIBPE_E_ALLOCATION_FAILURE; result->err = status; goto error; } status = get_headers_coff_hash(ctx, result->coff); if (status != LIBPE_E_OK) { result->err = status; goto error; } error: return result; } pe_hash_sections_t *pe_get_sections_hash(pe_ctx_t *ctx) { if (ctx->cached_data.hash_sections != NULL) return ctx->cached_data.hash_sections; pe_hash_sections_t *result = ctx->cached_data.hash_sections = calloc(1, sizeof(pe_hash_sections_t)); if (result == NULL) { // TODO(jweyrich): Should we report an error? If yes, we need a redesign. return NULL; } result->err = LIBPE_E_OK; const size_t num_sections = pe_sections_count(ctx); // Allocate an array of pointers once so we can store each pe_hash_t pointer in the // respective result->sections[i]. result->sections = calloc(num_sections, sizeof(pe_hash_t *)); if (result->sections == NULL) { result->err = LIBPE_E_ALLOCATION_FAILURE; return result; } IMAGE_SECTION_HEADER ** const sections = pe_sections(ctx); for (size_t i=0; i < num_sections; i++) { uint64_t data_size = sections[i]->SizeOfRawData; const unsigned char *data = LIBPE_PTR_ADD(ctx->map_addr, sections[i]->PointerToRawData); if (!pe_can_read(ctx, data, data_size)) { //fprintf(stderr, "%s\n", "unable to read sections data"); continue; } if (data_size) { char *name = (char *)sections[i]->Name; pe_hash_t *section_hash = calloc(1, sizeof(pe_hash_t)); if (section_hash == NULL) { result->err = LIBPE_E_ALLOCATION_FAILURE; break; } pe_err_e status = get_hashes(section_hash, name, data, data_size); if (status != LIBPE_E_OK) { // TODO: Should we skip this section and continue the loop? result->err = status; free(section_hash); break; } result->sections[result->count] = section_hash; result->count++; } } return result; } pe_hash_t *pe_get_file_hash(pe_ctx_t *ctx) { if (ctx->cached_data.hash_file != NULL) return ctx->cached_data.hash_file; pe_hash_t *hash = ctx->cached_data.hash_file = calloc(1, sizeof(pe_hash_t)); if (hash == NULL) { // TODO(jweyrich): Should we report an error? If yes, we need a redesign. return NULL; } const uint64_t data_size = pe_filesize(ctx); pe_err_e status = get_hashes(hash, "PEfile hash", ctx->map_addr, data_size); if (status != LIBPE_E_OK) abort(); return hash; } typedef struct element { char *dll_name; char *function_name; //struct element *prev; // needed for a doubly-linked list only struct element *next; // needed for singly- or doubly-linked lists } element_t; // strlwr - string lowercase static void pe_transform_to_lowercase_str(char* str) { if (str == NULL) // TODO: Should we warn here? return; for (char* p = str; *p; ++p) *p = tolower((unsigned char)*p); } static void pe_get_all_ord_lkp_func_name_with_hint(element_t* elem_ptr, ord_t* ord_ptr, int hint) { for (ord_t* p = ord_ptr; p->number; ++p) { if (hint == p->number) { errno = 0; elem_ptr->function_name = strdup(p->fname); PEV_ABORT_IF(!elem_ptr->function_name || errno == ENOMEM); break; } } } static void imphash_load_imported_functions(pe_ctx_t *ctx, uint64_t offset, char *dll_name, element_t **head, pe_imphash_flavor_e flavor) { if (dll_name == NULL || dll_name[0] == '\0') return; uint64_t ofs = offset; char* hint_str = NULL; char* fname = NULL; bool is_ordinal = false; int errcode = 0; // for asprintf return code while (1) { switch (ctx->pe.optional_hdr.type) { case MAGIC_PE32: { const IMAGE_THUNK_DATA32 *thunk = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, thunk, sizeof(IMAGE_THUNK_DATA32))) { // TODO: Should we report something? return; } // Type punning const uint32_t thunk_type = *(uint32_t *)thunk; if (thunk_type == 0) return; is_ordinal = (thunk_type & IMAGE_ORDINAL_FLAG32) != 0; if (is_ordinal) { errcode = asprintf(&hint_str, "%"PRIu32, thunk->u1.Ordinal & ~IMAGE_ORDINAL_FLAG32); // FIX-ME: devemos abortar a execucao? PEV_ABORT_IF(errcode == -1); } else { const uint64_t imp_ofs = pe_rva2ofs(ctx, thunk->u1.AddressOfData); const IMAGE_IMPORT_BY_NAME *imp_name = LIBPE_PTR_ADD(ctx->map_addr, imp_ofs); if (!pe_can_read(ctx, imp_name, sizeof(IMAGE_IMPORT_BY_NAME))) { // TODO: Should we report something? return; } errcode = asprintf(&hint_str, "%"PRIu16, imp_name->Hint); PEV_ABORT_IF(errcode == -1); errno = 0; // if the character '\0' comes before MAX_FUNCTION_NAME - 1 // we duplicate the string and put it in fname // if you can't find '\ 0' copy up to the maximum // MAX_FUNCTION_NAME - 1 characters fname = strndup((char*)imp_name->Name, MAX_FUNCTION_NAME - 1); PEV_ABORT_IF(!fname || errno == ENOMEM); } ofs += sizeof(IMAGE_THUNK_DATA32); break; } case MAGIC_PE64: { const IMAGE_THUNK_DATA64 *thunk = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, thunk, sizeof(IMAGE_THUNK_DATA64))) { // TODO: Should we report something? return; } // Type punning const uint64_t thunk_type = *(uint64_t *)thunk; if (thunk_type == 0) return; is_ordinal = (thunk_type & IMAGE_ORDINAL_FLAG64) != 0; if (is_ordinal) { errcode = asprintf(&hint_str, "%"PRIu64, (uint64_t)(thunk->u1.Ordinal & ~IMAGE_ORDINAL_FLAG64)); PEV_ABORT_IF(errcode == -1); } else { uint64_t imp_ofs = pe_rva2ofs(ctx, thunk->u1.AddressOfData); const IMAGE_IMPORT_BY_NAME *imp_name = LIBPE_PTR_ADD(ctx->map_addr, imp_ofs); if (!pe_can_read(ctx, imp_name, sizeof(IMAGE_IMPORT_BY_NAME))) { // TODO: Should we report something? return; } errcode = asprintf(&hint_str, "%"PRIu16, imp_name->Hint); PEV_ABORT_IF(errcode == -1); errno = 0; fname = strndup((char*)imp_name->Name, MAX_FUNCTION_NAME - 1); PEV_ABORT_IF(!fname || errno == ENOMEM); } ofs += sizeof(IMAGE_THUNK_DATA64); break; } default: return; } // Beginning of imphash logic - that's the weirdest thing I've even seen... pe_transform_to_lowercase_str(dll_name); char *aux = NULL; //TODO use a reverse search function instead switch (flavor) { default: abort(); case LIBPE_IMPHASH_FLAVOR_MANDIANT: { aux = last_strstr(dll_name, "."); break; } case LIBPE_IMPHASH_FLAVOR_PEFILE: { aux = last_strstr(dll_name, ".dll"); if (aux) *aux = '\0'; aux = last_strstr(dll_name, ".ocx"); if (aux) *aux = '\0'; aux = last_strstr(dll_name, ".sys"); if (aux) *aux = '\0'; break; } } if (aux) *aux = '\0'; pe_transform_to_lowercase_str(fname); element_t *el = calloc(1, sizeof(element_t)); if (el == NULL) { // TODO: Handle allocation failure. abort(); } errno = 0; el->dll_name = strdup(dll_name); // add verification of allocation error PEV_ABORT_IF(!el->dll_name || errno == ENOMEM); switch (flavor) { default: abort(); case LIBPE_IMPHASH_FLAVOR_MANDIANT: { el->function_name = is_ordinal ? hint_str : fname; break; } case LIBPE_IMPHASH_FLAVOR_PEFILE: { errno = 0; char* rest = NULL; int hint = (int) strtol(hint_str, &rest, 10); // should we treat the error or abort? PEV_ABORT_IF(hint_str == rest || errno == ERANGE); if (strncmp(dll_name, "oleaut32", 8) == 0 && is_ordinal) { pe_get_all_ord_lkp_func_name_with_hint(el, oleaut32_arr, hint); } else if (strncmp(dll_name, "ws2_32", 6) == 0 && is_ordinal) { pe_get_all_ord_lkp_func_name_with_hint(el, ws2_32_arr, hint); } else { if (is_ordinal) { char* ord_str = NULL; errcode = asprintf(&ord_str, "ord%s", hint_str); PEV_ABORT_IF(errcode == -1); el->function_name = ord_str; } else { el->function_name = fname; } } break; } } pe_transform_to_lowercase_str(el->function_name); LL_APPEND(*head, el); } } static void freeNodes(element_t *currentNode) { if (currentNode == NULL) return; while(currentNode != NULL) { element_t *temp = currentNode; currentNode = currentNode->next; free(temp->function_name); free(temp->dll_name); free(temp); } } char *pe_imphash(pe_ctx_t *ctx, pe_imphash_flavor_e flavor) { const IMAGE_DATA_DIRECTORY *dir = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_IMPORT); if (dir == NULL) return NULL; const uint64_t va = dir->VirtualAddress; if (va == 0) { //fprintf(stderr, "import directory not found\n"); return NULL; } uint64_t ofs = pe_rva2ofs(ctx, va); element_t *elt, *tmp, *head = NULL; int count = 0; while (1) { IMAGE_IMPORT_DESCRIPTOR *id = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, id, sizeof(IMAGE_IMPORT_DESCRIPTOR))) { // TODO: Should we report something? return NULL; } if (!id->u1.OriginalFirstThunk && !id->FirstThunk) break; ofs += sizeof(IMAGE_IMPORT_DESCRIPTOR); const uint64_t aux = ofs; // Store current ofs ofs = pe_rva2ofs(ctx, id->Name); if (ofs == 0 || ofs > (uint64_t) ctx->map_size) return NULL; const char *dll_name_ptr = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, dll_name_ptr, 1)) { // TODO: Should we report something? break; } char* dll_name = NULL; errno = 0; // if the character '\0' comes before MAX_DLL_NAME - 1 // we duplicate the string and put it in fname // if you can't find '\ 0' copy up to the maximum // MAX_DLL_NAME - 1 characters dll_name = strndup(dll_name_ptr, MAX_DLL_NAME - 1); PEV_ABORT_IF(!dll_name || errno == ENOMEM); ofs = pe_rva2ofs(ctx, id->u1.OriginalFirstThunk ? id->u1.OriginalFirstThunk : id->FirstThunk); if (ofs == 0) { free(dll_name); break; } imphash_load_imported_functions(ctx, ofs, dll_name, &head, flavor); // release dll_name from memory free(dll_name); // Restore previous ofs ofs = aux; } LL_COUNT(head, elt, count); // Allocate enough memory to store N times "dll_name.func_name,", plus 1 byte for the NUL terminator. const size_t imphash_string_size = count * (MAX_DLL_NAME + MAX_FUNCTION_NAME + 2) + 1; char *imphash_string = calloc(1, imphash_string_size); if (imphash_string == NULL) { // TODO: Handle allocation failure. abort(); } LL_FOREACH_SAFE(head, elt, tmp) { sprintf(imphash_string + strlen(imphash_string), "%s.%s,", elt->dll_name, elt->function_name); LL_DELETE(head, elt); } assert(!elt); freeNodes(head); size_t imphash_string_len = strlen(imphash_string); if (imphash_string_len == 0) { free(imphash_string); //ret = LIBPE_E_ALLOCATION_FAILURE; return NULL; } // Remove the last comma sign and decrement the string length by 1. imphash_string[imphash_string_len-1] = '\0'; imphash_string_len--; const unsigned char *data = (const unsigned char *)imphash_string; const size_t data_size = imphash_string_len; const size_t hash_maxsize = pe_hash_recommended_size(); char *hash_value = calloc(1, hash_maxsize); if (hash_value == NULL) { free(imphash_string); //ret = LIBPE_E_ALLOCATION_FAILURE; return NULL; } const bool hash_ok = pe_hash_raw_data(hash_value, hash_maxsize, "md5", data, data_size); free(imphash_string); //printf("### DEBUG imphash_string [%zu] = %s\n", imphash_string_len, imphash_string); if (!hash_ok) { free(hash_value); return NULL; } return hash_value; } void pe_hash_headers_dealloc(pe_hash_headers_t *obj) { if (obj == NULL) return; pe_hash_dealloc(obj->dos); pe_hash_dealloc(obj->coff); pe_hash_dealloc(obj->optional); free(obj); } void pe_hash_sections_dealloc(pe_hash_sections_t *obj) { if (obj == NULL) return; for (uint32_t i=0; i < obj->count; i++) { pe_hash_dealloc(obj->sections[i]); } free(obj->sections); free(obj); } void pe_hash_dealloc(pe_hash_t *obj) { if (obj == NULL) return; free(obj->name); free(obj->md5); free(obj->sha1); free(obj->sha256); free(obj->ssdeep); free(obj); } readpe-0.84/lib/libpe/imports.c000066400000000000000000000235521455661113700164270ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/imports.h" #include "libpe/pe.h" #include #include #include #include #include static uint32_t get_dll_count(pe_ctx_t *ctx) { uint32_t count = 0; const IMAGE_DATA_DIRECTORY *dir = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_IMPORT); if (dir == NULL) return count; const uint64_t va = dir->VirtualAddress; if (va == 0) { // TODO: report error? return count; } uint64_t ofs = pe_rva2ofs(ctx, va); while (1) { IMAGE_IMPORT_DESCRIPTOR *id = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, id, sizeof(IMAGE_IMPORT_DESCRIPTOR))) { // TODO: Should we report something? return count; } if (!id->u1.OriginalFirstThunk && !id->FirstThunk) break; ofs += sizeof(IMAGE_IMPORT_DESCRIPTOR); const uint64_t aux = ofs; // Store current ofs ofs = pe_rva2ofs(ctx, id->Name); if (ofs == 0) break; ofs = pe_rva2ofs(ctx, id->u1.OriginalFirstThunk ? id->u1.OriginalFirstThunk : id->FirstThunk); if (ofs == 0) break; count++; ofs = aux; // Restore previous ofs } return count; } static uint32_t get_functions_count(pe_ctx_t *ctx, uint64_t offset) { uint64_t ofs = offset; uint32_t count = 0; while (1) { switch (ctx->pe.optional_hdr.type) { case MAGIC_PE32: { const IMAGE_THUNK_DATA32 *thunk = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, thunk, sizeof(IMAGE_THUNK_DATA32))) return count; // Type punning const uint32_t thunk_type = *(uint32_t *)thunk; if (thunk_type == 0) return count; bool is_ordinal = (thunk_type & IMAGE_ORDINAL_FLAG32) != 0; if (!is_ordinal) { const uint64_t imp_ofs = pe_rva2ofs(ctx, thunk->u1.AddressOfData); const IMAGE_IMPORT_BY_NAME *imp_name = LIBPE_PTR_ADD(ctx->map_addr, imp_ofs); if (!pe_can_read(ctx, imp_name, sizeof(IMAGE_IMPORT_BY_NAME))) return count; } ofs += sizeof(IMAGE_THUNK_DATA32); break; } case MAGIC_PE64: { const IMAGE_THUNK_DATA64 *thunk = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, thunk, sizeof(IMAGE_THUNK_DATA64))) return count; const uint64_t thunk_type = *(uint64_t *)thunk; if (thunk_type == 0) return count; bool is_ordinal = (thunk_type & IMAGE_ORDINAL_FLAG32) != 0; if (!is_ordinal) { uint64_t imp_ofs = pe_rva2ofs(ctx, thunk->u1.AddressOfData); const IMAGE_IMPORT_BY_NAME *imp_name = LIBPE_PTR_ADD(ctx->map_addr, imp_ofs); if (!pe_can_read(ctx, imp_name, sizeof(IMAGE_IMPORT_BY_NAME))) return count; } ofs += sizeof(IMAGE_THUNK_DATA64); break; } } count++; } return count; } static pe_err_e parse_imported_functions(pe_ctx_t *ctx, pe_imported_dll_t *imported_dll, uint64_t offset) { imported_dll->err = LIBPE_E_OK; imported_dll->functions_count = get_functions_count(ctx, offset); imported_dll->functions = calloc(imported_dll->functions_count, sizeof(pe_imported_function_t)); if (imported_dll->functions == NULL) { imported_dll->err = LIBPE_E_ALLOCATION_FAILURE; return imported_dll->err; } // FIX: Unecessary to fill the buffer with zeroes. char fname[MAX_FUNCTION_NAME]; const size_t size_fname = sizeof(fname); bool is_ordinal = false; uint16_t ordinal = 0; uint16_t hint = 0; uint64_t ofs = offset; for (uint32_t i=0; i < imported_dll->functions_count; i++) { switch (ctx->pe.optional_hdr.type) { case MAGIC_PE32: { const IMAGE_THUNK_DATA32 *thunk = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, thunk, sizeof(IMAGE_THUNK_DATA32))) { imported_dll->err = LIBPE_E_INVALID_THUNK; return imported_dll->err; } // Type punning const uint32_t thunk_type = *(uint32_t *)thunk; if (thunk_type == 0) { imported_dll->err = LIBPE_E_INVALID_THUNK; return imported_dll->err; } // If the MSB of the member is 1, the function is exported by ordinal. is_ordinal = (thunk_type & IMAGE_ORDINAL_FLAG32) != 0; if (is_ordinal) { hint = 0; ordinal = (thunk->u1.Ordinal & ~IMAGE_ORDINAL_FLAG32) & 0xffff; } else { const uint64_t imp_ofs = pe_rva2ofs(ctx, thunk->u1.AddressOfData); const IMAGE_IMPORT_BY_NAME *imp_name = LIBPE_PTR_ADD(ctx->map_addr, imp_ofs); if (!pe_can_read(ctx, imp_name, sizeof(IMAGE_IMPORT_BY_NAME))) { imported_dll->err = LIBPE_E_ALLOCATION_FAILURE; return imported_dll->err; } hint = imp_name->Hint; ordinal = 0; strncpy(fname, (char *)imp_name->Name, size_fname-1); // Because `strncpy` does not guarantee to NUL terminate the string itself, this must be done explicitly. fname[size_fname - 1] = '\0'; } ofs += sizeof(IMAGE_THUNK_DATA32); break; } case MAGIC_PE64: { const IMAGE_THUNK_DATA64 *thunk = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, thunk, sizeof(IMAGE_THUNK_DATA64))) { imported_dll->err = LIBPE_E_ALLOCATION_FAILURE; return imported_dll->err; // DO something so that API notifies of the error } // Type punning const uint64_t thunk_type = *(uint64_t *)thunk; if (thunk_type == 0) { imported_dll->err = LIBPE_E_INVALID_THUNK; return imported_dll->err; } // If the MSB of the member is 1, the function is exported by ordinal. is_ordinal = (thunk_type & IMAGE_ORDINAL_FLAG64) != 0; if (is_ordinal) { hint = 0; // No hint ordinal = (thunk->u1.Ordinal & ~IMAGE_ORDINAL_FLAG64) & 0xffff; } else { uint64_t imp_ofs = pe_rva2ofs(ctx, thunk->u1.AddressOfData); const IMAGE_IMPORT_BY_NAME *imp_name = LIBPE_PTR_ADD(ctx->map_addr, imp_ofs); if (!pe_can_read(ctx, imp_name, sizeof(IMAGE_IMPORT_BY_NAME))) { imported_dll->err = LIBPE_E_ALLOCATION_FAILURE; return imported_dll->err; } hint = imp_name->Hint; ordinal = 0; // No ordinal strncpy(fname, (char *)imp_name->Name, size_fname-1); // Because `strncpy` does not guarantee to NUL terminate the string itself, this must be done explicitly. fname[size_fname - 1] = '\0'; } ofs += sizeof(IMAGE_THUNK_DATA64); break; } } imported_dll->functions[i].hint = hint; imported_dll->functions[i].ordinal = ordinal; if (!is_ordinal) { imported_dll->functions[i].name = strdup(fname); if (imported_dll->functions[i].name == NULL) { imported_dll->err = LIBPE_E_ALLOCATION_FAILURE; return imported_dll->err; } } } return LIBPE_E_OK; } pe_imports_t *pe_imports(pe_ctx_t *ctx) { if (ctx->cached_data.imports != NULL) return ctx->cached_data.imports; pe_imports_t *imports = ctx->cached_data.imports = calloc(1, sizeof(pe_imports_t)); if (imports == NULL) { // TODO(jweyrich): Should we report an error? If yes, we need a redesign. return NULL; } imports->err = LIBPE_E_OK; imports->dll_count = get_dll_count(ctx); if (imports->dll_count == 0) return imports; // Allocate array to store DLLs imports->dlls = calloc(imports->dll_count, sizeof(pe_imported_dll_t)); if (imports->dlls == NULL) { imports->err = LIBPE_E_ALLOCATION_FAILURE; return imports; } const IMAGE_DATA_DIRECTORY *dir = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_IMPORT); if (dir == NULL) { return imports; } const uint64_t va = dir->VirtualAddress; if (va == 0) { // TODO: report error? return imports; } uint64_t ofs = pe_rva2ofs(ctx, va); for (uint32_t i=0; i < imports->dll_count; i++) { IMAGE_IMPORT_DESCRIPTOR *id = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, id, sizeof(IMAGE_IMPORT_DESCRIPTOR))) { break; } if (!id->u1.OriginalFirstThunk && !id->FirstThunk) break; ofs += sizeof(IMAGE_IMPORT_DESCRIPTOR); const uint64_t aux = ofs; // Store current ofs ofs = pe_rva2ofs(ctx, id->Name); if (ofs == 0) break; const char *dll_name_ptr = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, dll_name_ptr, 1)) { // TODO: Should we report something? break; } pe_imported_dll_t * const dll = &imports->dlls[i]; // Allocate string to store DLL name const size_t dll_name_size = MAX_DLL_NAME; dll->name = calloc(1, dll_name_size); if (dll->name == NULL) { imports->err = LIBPE_E_ALLOCATION_FAILURE; return imports; } // Validate whether it's ok to access at least 1 byte after dll_name_ptr. // It might be '\0', for example. strncpy(dll->name, dll_name_ptr, dll_name_size-1); // Because `strncpy` does not guarantee to NUL terminate the string itself, this must be done explicitly. dll->name[dll_name_size - 1] = '\0'; ofs = pe_rva2ofs(ctx, id->u1.OriginalFirstThunk ? id->u1.OriginalFirstThunk : id->FirstThunk); if (ofs == 0) { break; } pe_err_e parse_err = parse_imported_functions(ctx, dll, ofs); if (parse_err != LIBPE_E_OK) { imports->err = parse_err; return imports; } ofs = aux; // Restore previous ofs } return imports; } void pe_imports_dealloc(pe_imports_t *obj) { if (obj == NULL) return; for (uint32_t i=0; i < obj->dll_count; i++) { const pe_imported_dll_t *dll = &obj->dlls[i]; for (uint32_t j=0; j < dll->functions_count; j++) { const pe_imported_function_t *function = &dll->functions[j]; free(function->name); } free(dll->name); free(dll->functions); } free(obj->dlls); free(obj); } readpe-0.84/lib/libpe/include/000077500000000000000000000000001455661113700162025ustar00rootroot00000000000000readpe-0.84/lib/libpe/include/libpe/000077500000000000000000000000001455661113700172755ustar00rootroot00000000000000readpe-0.84/lib/libpe/include/libpe/context.h000066400000000000000000000041441455661113700211350ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2023 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_CONTEXT_H #define LIBPE_CONTEXT_H #include #include #include "hdr_dos.h" #include "hdr_coff.h" #include "hdr_optional.h" #include "directories.h" #include "sections.h" #include "imports.h" #include "exports.h" #include "hashes.h" #include "types_resources.h" typedef struct { // DOS header IMAGE_DOS_HEADER *dos_hdr; // Signature uint32_t signature; // COFF header IMAGE_COFF_HEADER *coff_hdr; // Optional header void *optional_hdr_ptr; IMAGE_OPTIONAL_HEADER optional_hdr; // Directories uint32_t num_directories; void *directories_ptr; IMAGE_DATA_DIRECTORY **directories; // array up to MAX_DIRECTORIES // Sections uint16_t num_sections; void *sections_ptr; IMAGE_SECTION_HEADER **sections; // array up to MAX_SECTIONS // Symbols uint32_t num_symbols; void *symbols_ptr; // Strings uint32_t strings_size; const char *strings_ptr; uint64_t entrypoint; uint64_t imagebase; } pe_file_t; typedef struct { // Parsed directories pe_imports_t *imports; pe_exports_t *exports; // Hashes pe_hash_headers_t *hash_headers; pe_hash_sections_t *hash_sections; pe_hash_t *hash_file; // Resources pe_resources_t *resources; } pe_cached_data_t; typedef struct pe_ctx { FILE *stream; char *path; void *map_addr; off_t map_size; uintptr_t map_end; pe_file_t pe; pe_cached_data_t cached_data; } pe_ctx_t; #endif readpe-0.84/lib/libpe/include/libpe/dir_import.h000066400000000000000000000040271455661113700216210ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_DIR_IMPORT_H #define LIBPE_DIR_IMPORT_H #include #ifdef __cplusplus extern "C" { #endif #pragma pack(push, 1) typedef struct { union { uint32_t Characteristics; // 0 for terminating null import descriptor uint32_t OriginalFirstThunk; // RVA to original unbound IAT } u1; uint32_t TimeDateStamp; uint32_t ForwarderChain; // -1 if no forwarders uint32_t Name; // RVA to IAT (if bound this IAT has actual addresses) uint32_t FirstThunk; } IMAGE_IMPORT_DESCRIPTOR; // import name entry typedef struct { uint16_t Hint; uint8_t Name[1]; } IMAGE_IMPORT_BY_NAME; typedef struct { union { uint64_t ForwarderString; // RVA to a forwarder string uint64_t Function; // Memory address of the imported function uint64_t Ordinal; // Ordinal value of imported API uint64_t AddressOfData; // RVA to an IMAGE_IMPORT_BY_NAME with the imported API name } u1; } IMAGE_THUNK_DATA64; typedef struct { union { uint32_t ForwarderString; // RVA to a forwarder string uint32_t Function; // Memory address of the imported function uint32_t Ordinal; // Ordinal value of imported API uint32_t AddressOfData; // RVA to an IMAGE_IMPORT_BY_NAME with the imported API name } u1; } IMAGE_THUNK_DATA32; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/dir_resources.h000066400000000000000000000064701455661113700223250ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_DIR_RESOURCES_H #define LIBPE_DIR_RESOURCES_H #include #include #ifdef __cplusplus extern "C" { #endif #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000 // REFERENCE: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types typedef enum { RT_CURSOR = 1, // cursor image RT_BITMAP = 2, // bitmap (.bmp) RT_ICON = 3, // icon RT_MENU = 4, // menu RT_DIALOG = 5, // dialog window RT_STRING = 6, // unicode string RT_FONTDIR = 7, // font directory RT_FONT = 8, // font RT_ACCELERATOR = 9, // hot keys RT_RCDATA = 10, // data RT_MESSAGETABLE = 11, // string table RT_GROUP_CURSOR = 12, // cursor group RT_GROUP_ICON = 14, // icon group RT_VERSION = 16, // version information RT_DLGINCLUDE = 17, // names of header files for dialogs (*.h) used by compiler RT_PLUGPLAY = 19, // data determined by application RT_VXD = 20, // vxd info RT_ANICURSOR = 21, // animated cursor RT_ANIICON = 22, // animated icon RT_HTML = 23, // html page RT_MANIFEST = 24, // manifest of Windows XP build RT_DLGINIT = 240, // strings used for initiating some controls in dialogs RT_TOOLBAR = 241 // configuration of toolbars } ResourceType; #pragma pack(push, 1) typedef struct { uint32_t Characteristics; uint32_t TimeDateStamp; uint16_t MajorVersion; uint16_t MinorVersion; uint16_t NumberOfNamedEntries; uint16_t NumberOfIdEntries; } IMAGE_RESOURCE_DIRECTORY; typedef struct { union { struct { uint32_t NameOffset:31; uint32_t NameIsString:1; } data; uint32_t Name; uint16_t Id; } u0; union { uint32_t OffsetToData; struct { uint32_t OffsetToDirectory:31; uint32_t DataIsDirectory:1; } data; } u1; } IMAGE_RESOURCE_DIRECTORY_ENTRY; typedef struct { uint16_t Length; char String[1]; } IMAGE_RESOURCE_DATA_STRING; typedef struct { uint16_t Length; // Number of Unicode characters uint16_t String[1]; } IMAGE_RESOURCE_DATA_STRING_U; typedef struct { uint32_t OffsetToData; uint32_t Size; uint32_t CodePage; uint32_t Reserved; } IMAGE_RESOURCE_DATA_ENTRY; typedef struct { uint32_t dwSignature; uint32_t dwStrucVersion; uint32_t dwFileVersionMS; uint32_t dwFileVersionLS; uint32_t dwProductVersionMS; uint32_t dwProductVersionLS; uint32_t dwFileFlagsMask; uint32_t dwFileFlags; uint32_t dwFileOS; uint32_t dwFileType; uint32_t dwFileSubtype; uint32_t dwFileDateMS; uint32_t dwFileDateLS; } VS_FIXEDFILEINFO; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/dir_security.h000066400000000000000000000054311455661113700221560ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_DIR_SECURITY_H #define LIBPE_DIR_SECURITY_H #include #ifdef __cplusplus extern "C" { #endif #define ANYSIZE_ARRAY 1 // #define WIN_TRUST_MAJOR_REVISION_MASK 0xFFFF0000 // #define WIN_TRUST_MINOR_REVISION_MASK 0x0000FFFF // #define WIN_TRUST_REVISION_1_0 0x00010000 typedef enum { // Version 1, legacy version of the Win_Certificate // structure. It is supported only for purposes of // verifying legacy Authenticode signatures WIN_CERT_REVISION_1_0 = 0x0100, // Version 2 is the current version of the Win_Certificate structure. WIN_CERT_REVISION_2_0 = 0x0200 } CertRevision; typedef enum { WIN_CERT_TYPE_X509 = 0x0001, // bCertificate contains an X.509 (Certificate) WIN_CERT_TYPE_PKCS_SIGNED_DATA = 0x0002, // bCertificate contains a PKCS#7 (SignedData structure) WIN_CERT_TYPE_RESERVED_1 = 0x0003, // Reserved WIN_CERT_TYPE_TS_STACK_SIGNED = 0x0004, // Terminal Server Protocol Stack (Certificate signing) WIN_CERT_TYPE_EFI_PKCS115 = 0x0EF0, WIN_CERT_TYPE_EFI_GUID = 0x0EF1 } CertType; #pragma pack(push, 4) // Originally declared in Wintrust.h typedef struct { // Specified the size, in bytes, of the WIN_CERTIFICATE structure, // including the data in bCertificate. uint32_t dwLength; // Indicates the revision of the structure. uint16_t wRevision; // Specifies the type of certificate. // This member can be one of the following values: // Value Meaning // ---------------------------------------------------------------------------------------- // WIN_CERT_TYPE_X509 The certificate contains an X.509 Certificate. // WIN_CERT_TYPE_PKCS_SIGNED_DATA The certificate contains a PKCS SignedData structure. // WIN_CERT_TYPE_RESERVED_1 Reserved. // WIN_CERT_TYPE_TS_STACK_SIGNED uint16_t wCertificateType; // A variable-sized array of bytes that contains the certificate data. uint8_t bCertificate[ANYSIZE_ARRAY]; } WIN_CERTIFICATE; typedef struct { uint32_t cbData; uint8_t *pbData; } CRYPT_DATA_BLOB; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/directories.h000066400000000000000000000055631455661113700217730ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_DIRECTORIES_H #define LIBPE_DIRECTORIES_H #include #include "dir_import.h" #include "dir_resources.h" #include "dir_security.h" #ifdef __cplusplus extern "C" { #endif // Directory entries typedef enum { IMAGE_DIRECTORY_ENTRY_EXPORT = 0, // Export Table IMAGE_DIRECTORY_ENTRY_IMPORT = 1, // Import Table IMAGE_DIRECTORY_ENTRY_RESOURCE = 2, // Resource Table IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3, // Exception Table IMAGE_DIRECTORY_ENTRY_SECURITY = 4, // Certificate Table IMAGE_DIRECTORY_ENTRY_BASERELOC = 5, // Base Relocation Table IMAGE_DIRECTORY_ENTRY_DEBUG = 6, // Debug //IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7, // (X86 usage) IMAGE_DIRECTORY_ENTRY_ARCHITECTURE = 7, // Architecture IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8, // Global Ptr IMAGE_DIRECTORY_ENTRY_TLS = 9, // TLS Table IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10, // Load Config Table IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11, // Bound Import IMAGE_DIRECTORY_ENTRY_IAT = 12, // IAT IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT = 13, // Delay Import Descriptor IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR = 14, // CLR Runtime Header IMAGE_DIRECTORY_RESERVED = 15 // Reserved, must be zero } ImageDirectoryEntry; typedef struct { uint32_t Characteristics; uint32_t TimeDateStamp; uint16_t MajorVersion; uint16_t MinorVersion; uint32_t Name; uint32_t Base; uint32_t NumberOfFunctions; uint32_t NumberOfNames; uint32_t AddressOfFunctions; uint32_t AddressOfNames; uint32_t AddressOfNameOrdinals; } IMAGE_EXPORT_DIRECTORY; typedef struct { uint32_t StartAddressOfRawData; uint32_t EndAddressOfRawData; uint32_t AddressOfIndex; uint32_t AddressOfCallBacks; // PIMAGE_TLS_CALLBACK uint32_t SizeOfZeroFill; uint32_t Characteristics; // reserved for future use } IMAGE_TLS_DIRECTORY32; typedef struct { uint64_t StartAddressOfRawData; uint64_t EndAddressOfRawData; uint64_t AddressOfIndex; uint64_t AddressOfCallBacks; uint32_t SizeOfZeroFill; uint32_t Characteristics; } IMAGE_TLS_DIRECTORY64; typedef struct { uint32_t VirtualAddress; uint32_t Size; } IMAGE_DATA_DIRECTORY; #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/error.h000066400000000000000000000036171455661113700206060ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2015 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_ERROR_H #define LIBPE_ERROR_H #include #ifdef __cplusplus extern "C" { #endif // FIXME: Must be careful with this enum and pe_error_msg() function. typedef enum { LIBPE_E_OK = 0, // Declaring negative values this way is EVIL because it // BREAKS compatiblity every time we add/remove an error code. LIBPE_E_ALLOCATION_FAILURE = -23, LIBPE_E_OPEN_FAILED, LIBPE_E_FDOPEN_FAILED, LIBPE_E_FSTAT_FAILED, LIBPE_E_NOT_A_FILE, LIBPE_E_NOT_A_PE_FILE, LIBPE_E_INVALID_LFANEW, LIBPE_E_MISSING_COFF_HEADER, LIBPE_E_MISSING_OPTIONAL_HEADER, LIBPE_E_INVALID_SIGNATURE, LIBPE_E_UNSUPPORTED_IMAGE, LIBPE_E_MMAP_FAILED, LIBPE_E_MUNMAP_FAILED, LIBPE_E_CLOSE_FAILED, LIBPE_E_TOO_MANY_DIRECTORIES, LIBPE_E_TOO_MANY_SECTIONS, LIBPE_E_INVALID_THUNK, // Exports LIBPE_E_EXPORTS_CANT_READ_RVA, LIBPE_E_EXPORTS_CANT_READ_DIR, LIBPE_E_EXPORTS_FUNC_NEQ_NAMES, // Hashes LIBPE_E_HASHING_FAILED, // Misc LIBPE_E_NO_CALLBACKS_FOUND, LIBPE_E_NO_FUNCTIONS_FOUND // this will be -1. } pe_err_e; const char *pe_error_msg(pe_err_e error); void pe_error_print(FILE *stream, pe_err_e error); #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/exports.h000066400000000000000000000025641455661113700211610ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_EXPORTS_H #define LIBPE_EXPORTS_H #include #include "error.h" #ifdef __cplusplus extern "C" { #endif typedef struct { uint32_t ordinal; // ordinal of the function char *name; // name of the function char *fwd_name; // name of the forwarded function uint32_t address; // address of the function } pe_exported_function_t; typedef struct { pe_err_e err; char *name; // name of the DLL uint32_t functions_count; pe_exported_function_t *functions; // array of exported functions } pe_exports_t; void pe_exports_dealloc(pe_exports_t *exports); #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/hashes.h000066400000000000000000000027451455661113700207310ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_HASHES_H #define LIBPE_HASHES_H #include #include "error.h" #ifdef __cplusplus extern "C" { #endif typedef enum { LIBPE_IMPHASH_FLAVOR_MANDIANT = 1, LIBPE_IMPHASH_FLAVOR_PEFILE = 2, } pe_imphash_flavor_e; typedef struct { char *name; char *md5; char *ssdeep; char *sha1; char *sha256; } pe_hash_t; typedef struct { pe_err_e err; pe_hash_t *dos; pe_hash_t *coff; pe_hash_t *optional; } pe_hash_headers_t; typedef struct { pe_err_e err; uint32_t count; pe_hash_t **sections; } pe_hash_sections_t; void pe_hash_headers_dealloc(pe_hash_headers_t *obj); void pe_hash_sections_dealloc(pe_hash_sections_t *obj); void pe_hash_dealloc(pe_hash_t *obj); #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/hdr_coff.h000066400000000000000000000132101455661113700212150ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_HDR_COFF_H #define LIBPE_HDR_COFF_H #include #ifdef __cplusplus extern "C" { #endif typedef enum { IMAGE_FILE_MACHINE_UNKNOWN = 0x0, IMAGE_FILE_MACHINE_ALPHA_OLD = 0x183, IMAGE_FILE_MACHINE_ALPHA = 0x184, IMAGE_FILE_MACHINE_ALPHA64 = 0x284, IMAGE_FILE_MACHINE_AM33 = 0x1d3, IMAGE_FILE_MACHINE_AMD64 = 0x8664, IMAGE_FILE_MACHINE_ARM = 0x1c0, IMAGE_FILE_MACHINE_ARMV7 = 0x1c4, IMAGE_FILE_MACHINE_ARM64 = 0xaa64, IMAGE_FILE_MACHINE_ARM64EC = 0xa641, IMAGE_FILE_MACHINE_ARM64X = 0xa64e, IMAGE_FILE_MACHINE_CEE = 0xc0ee, IMAGE_FILE_MACHINE_CEF = 0xcef, IMAGE_FILE_MACHINE_CHPE_X86 = 0x3a64, IMAGE_FILE_MACHINE_EBC = 0xebc, IMAGE_FILE_MACHINE_I386 = 0x14c, IMAGE_FILE_MACHINE_I860 = 0x14d, IMAGE_FILE_MACHINE_IA64 = 0x200, IMAGE_FILE_MACHINE_LOONGARCH32 = 0x6232, IMAGE_FILE_MACHINE_LOONGARCH64 = 0x6264, IMAGE_FILE_MACHINE_M32R = 0x9041, IMAGE_FILE_MACHINE_M68K = 0x268, IMAGE_FILE_MACHINE_MIPS16 = 0x266, IMAGE_FILE_MACHINE_MIPSFPU = 0x366, IMAGE_FILE_MACHINE_MIPSFPU16 = 0x466, IMAGE_FILE_MACHINE_MPPC_601 = 0x601, IMAGE_FILE_MACHINE_OMNI = 0xace1, IMAGE_FILE_MACHINE_PARISC = 0x290, IMAGE_FILE_MACHINE_POWERPC = 0x1f0, IMAGE_FILE_MACHINE_POWERPCFP = 0x1f1, IMAGE_FILE_MACHINE_POWERPCBE = 0x1f2, IMAGE_FILE_MACHINE_R3000 = 0x162, IMAGE_FILE_MACHINE_R3000_BE = 0x160, IMAGE_FILE_MACHINE_R4000 = 0x166, IMAGE_FILE_MACHINE_R10000 = 0x168, IMAGE_FILE_MACHINE_RISCV32 = 0x5032, IMAGE_FILE_MACHINE_RISCV64 = 0x5064, IMAGE_FILE_MACHINE_RISCV128 = 0x5128, IMAGE_FILE_MACHINE_SH3 = 0x1a2, IMAGE_FILE_MACHINE_SH3DSP = 0x1a3, IMAGE_FILE_MACHINE_SH3E = 0x1a4, IMAGE_FILE_MACHINE_SH4 = 0x1a6, IMAGE_FILE_MACHINE_SH5 = 0x1a8, IMAGE_FILE_MACHINE_TRICORE = 0x520, IMAGE_FILE_MACHINE_THUMB = 0x1c2, IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x169 } MachineType; typedef enum { // Image only, Windows CE, Windows NT and above. Indicates that the // file does not contain base relocations and must therefore be // loaded at its preferred base address. If the base address is not // available, the loader reports an error. The default behavior of // the linker is to strip base relocations from EXEs. IMAGE_FILE_RELOCS_STRIPPED = 0x0001, // Image only. Indicates that the image file is valid and can be run. // If this flag is not set, it indicates a linker error. IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002, // COFF line numbers have been removed. // Deprecated and should be zero. IMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004, // COFF symbol table entries for local symbols have been removed. // Deprecated and should be zero. IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008, // Obsolete. Aggressively trim working set. // Deprecated in Windows 2000 and later. Must be zero. IMAGE_FILE_AGGRESSIVE_WS_TRIM = 0x0010, // App can handle > 2gb addresses. IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020, // Machine based on 16-bit-word architecture. IMAGE_FILE_16BIT_MACHINE = 0x0040, // Bytes of the word are reversed from CPU defaults. // Test either IMAGE_FILE_BYTES_REVERSED_LO or IMAGE_FILE_BYTES_REVERSED_HI, they are in the same bit position in each short word. // Microsoft PE 32-Bit LINK.EXE Version 1.00 always sets this bit, but no words are reversed. New LINK.EXE versions never set this bit. // Deprecated and should be zero. IMAGE_FILE_BYTES_REVERSED_LO = 0x0080, // Machine based on 32-bit-word architecture. IMAGE_FILE_32BIT_MACHINE = 0x0100, // Debugging information removed from image file. IMAGE_FILE_DEBUG_STRIPPED = 0x0200, // If image is on removable media, fully load it and copy it to the // swap file. IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0x0400, // If image is on network media, fully load it and copy it to the // swap file. IMAGE_FILE_NET_RUN_FROM_SWAP = 0x0800, // The image file is a system file, not a user program. IMAGE_FILE_SYSTEM = 0x1000, // The image file is a dynamic-link library (DLL). Such files are // considered executable files for almost all purposes, although // they cannot be directly run. IMAGE_FILE_DLL = 0x2000, // File should be run only on a UP machine. IMAGE_FILE_UP_SYSTEM_ONLY = 0x4000, // Bytes of the word are reversed from CPU defaults. // Test either IMAGE_FILE_BYTES_REVERSED_LO or IMAGE_FILE_BYTES_REVERSED_HI, they are in the same bit position in each short word. // Microsoft PE 32-Bit LINK.EXE Version 1.00 always sets this bit, but no words are reversed. New LINK.EXE versions never set this bit. // Deprecated and should be zero. IMAGE_FILE_BYTES_REVERSED_HI = 0x8000 } ImageCharacteristics; #pragma pack(push, 1) typedef struct { uint16_t Machine; // MachineType uint16_t NumberOfSections; uint32_t TimeDateStamp; uint32_t PointerToSymbolTable; uint32_t NumberOfSymbols; uint16_t SizeOfOptionalHeader; uint16_t Characteristics; // ImageCharacteristics } IMAGE_FILE_HEADER, IMAGE_COFF_HEADER; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/hdr_dos.h000066400000000000000000000026111455661113700210700ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_HDR_DOS_H #define LIBPE_HDR_DOS_H #include #ifdef __cplusplus extern "C" { #endif #pragma pack(push, 1) typedef struct { uint16_t e_magic; uint16_t e_cblp; uint16_t e_cp; uint16_t e_crlc; uint16_t e_cparhdr; uint16_t e_minalloc; uint16_t e_maxalloc; uint16_t e_ss; uint16_t e_sp; uint16_t e_csum; uint16_t e_ip; uint16_t e_cs; uint16_t e_lfarlc; uint16_t e_ovno; uint16_t e_res[4]; uint16_t e_oemid; uint16_t e_oeminfo; uint16_t e_res2[10]; uint32_t e_lfanew; // sizeof(IMAGE_DOS_HEADER) + size of MS-DOS stub } IMAGE_DOS_HEADER; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/hdr_optional.h000066400000000000000000000177621455661113700221450ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_HDR_OPTIONAL_H #define LIBPE_HDR_OPTIONAL_H #include #include #ifdef __cplusplus extern "C" { #endif // REFERENCE: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx typedef enum { // Unknown subsystem IMAGE_SUBSYSTEM_UNKNOWN = 0, // No subsystem required (device drivers and native system processes) IMAGE_SUBSYSTEM_NATIVE = 1, // Windows graphical user interface (GUI) subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI = 2, // Windows character-mode user interface (CUI) subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI = 3, // Old Windows CE subsystem IMAGE_SUBSYSTEM_WINDOWS_OLD_CE_GUI = 4, // OS/2 CUI subsystem IMAGE_SUBSYSTEM_OS2_CUI = 5, // POSIX CUI subsystem IMAGE_SUBSYSTEM_POSIX_CUI = 7, // MMOSA/Native Win32E IMAGE_SUBSYSTEM_MMOSA = 8, // Windows CE system IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9, // Extensible Firmware Interface (EFI) application IMAGE_SUBSYSTEM_EFI_APPLICATION = 10, // EFI driver with boot services IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 11, // EFI driver with run-time services IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 12, // EFI ROM image IMAGE_SUBSYSTEM_EFI_ROM = 13, // Xbox system IMAGE_SUBSYSTEM_XBOX = 14, // Boot application IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 16, // XBOX Code Catalog IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG = 17 } WindowsSubsystem; // REFERENCE: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx typedef enum { // IMAGE_LIBRARY_* defined in PECOFF 4.0 (https://bytepointer.com/resources/pecoff_v4.0.htm) // DLL initialization function called just after process initialization. IMAGE_LIBRARY_PROCESS_INIT = 0x0001, // DLL initialization function called just before process termination. IMAGE_LIBRARY_PROCESS_TERM = 0x0002, // DLL initialization function called just after thread initialization. // This does not apply to the first thread, which is allocated during process initialization. IMAGE_LIBRARY_THREAD_INIT = 0x0004, // DLL initialization function called just before thread initialization. // This does not apply to the first thread allocated. IMAGE_LIBRARY_THREAD_TERM = 0x0008, // IMAGE_DLLCHARACTERISTICS_RESERVED_10 = 0x0010, // ASLR with 64 bit address space IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020, // The DLL can be relocated at load time. IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040, // Code integrity checks are forced. IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0x0080, // The image is compatible with data execution prevention (DEP). // Prevents code execution on the stack, in the PE header and sections without IMAGE_SCN_MEM_EXECUTE. IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0x0100, // The image is isolation aware, but should not be isolated. IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200, // The image does not use structured exception handling (SEH). // No handlers can be called in this image. // Vectored Exception Handler still work. IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400, // Do not bind the image. IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800, // Image is a Wx86 Thunk DLL. // Valid only for non-x86 (risc) DLL files. // Can be generated by undocumented MSVC5+ linker flag /dllchar:x86thunk. IMAGE_DLLCHARACTERISTICS_X86_THUNK = 0x1000, // Image should execute in an AppContainer (Metro Apps in Windows 8). // Valid only for EXE files. IMAGE_DLLCHARACTERISTICS_APPCONTAINER = 0x1000, // A WDM driver. IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000, // Image supports Control Flow Guard IMAGE_DLLCHARACTERISTICS_GUARD_CF = 0x4000, // The image is terminal server (Remote Desktop Services) aware. // https://learn.microsoft.com/en-us/windows/win32/termserv/application-compatibility-layer IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000 } ImageDllCharacteristics; // PECOFF 4.0 (https://bytepointer.com/resources/pecoff_v4.0.htm) and WDK's ntimage.h typedef enum { // DLL initialization function: Halt prior to executing first instruction. IMAGE_LOADER_FLAGS_BREAK_ON_LOAD = 0x00000001, // DLL initialization function: Break prior to executing first instruction; effect is similar to a breakpoint. IMAGE_LOADER_FLAGS_DEBUG_ON_LOAD = 0x00000002, // COM+ image executable; obsolete and automatically set by loader when IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR is present. IMAGE_LOADER_FLAGS_COMPLUS = 0x00000001, // Global subsections apply across TS sessions. IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL = 0x01000000 } ImageLoaderFlags; typedef enum { MAGIC_ROM = 0x107, MAGIC_PE32 = 0x10b, MAGIC_PE64 = 0x20b // PE32+ } opt_type_e; #pragma pack(push, 1) typedef struct { uint16_t Magic; uint8_t MajorLinkerVersion; uint8_t MinorLinkerVersion; uint32_t SizeOfCode; uint32_t SizeOfInitializedData; uint32_t SizeOfUninitializedData; uint32_t AddressOfEntryPoint; uint32_t BaseOfCode; uint32_t BaseOfData; uint32_t BaseOfBss; uint32_t GprMask; uint32_t CprMask[4]; uint32_t GpValue; } IMAGE_ROM_OPTIONAL_HEADER; // REFERENCE: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx typedef struct { uint16_t Magic; uint8_t MajorLinkerVersion; uint8_t MinorLinkerVersion; uint32_t SizeOfCode; uint32_t SizeOfInitializedData; uint32_t SizeOfUninitializedData; uint32_t AddressOfEntryPoint; uint32_t BaseOfCode; uint32_t BaseOfData; // only in PE32 uint32_t ImageBase; uint32_t SectionAlignment; uint32_t FileAlignment; uint16_t MajorOperatingSystemVersion; uint16_t MinorOperatingSystemVersion; uint16_t MajorImageVersion; uint16_t MinorImageVersion; uint16_t MajorSubsystemVersion; uint16_t MinorSubsystemVersion; uint32_t Win32VersionValue; uint32_t SizeOfImage; uint32_t SizeOfHeaders; uint32_t CheckSum; uint16_t Subsystem; // WindowsSubsystem uint16_t DllCharacteristics; uint32_t SizeOfStackReserve; uint32_t SizeOfStackCommit; uint32_t SizeOfHeapReserve; uint32_t SizeOfHeapCommit; uint32_t LoaderFlags; uint32_t NumberOfRvaAndSizes; // IMAGE_DATA_DIRECTORY DataDirectory[MAX_DIRECTORIES]; } IMAGE_OPTIONAL_HEADER_32; // REFERENCE: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680339(v=vs.85).aspx typedef struct { uint16_t Magic; uint8_t MajorLinkerVersion; uint8_t MinorLinkerVersion; uint32_t SizeOfCode; uint32_t SizeOfInitializedData; uint32_t SizeOfUninitializedData; uint32_t AddressOfEntryPoint; uint32_t BaseOfCode; uint64_t ImageBase; uint32_t SectionAlignment; uint32_t FileAlignment; uint16_t MajorOperatingSystemVersion; uint16_t MinorOperatingSystemVersion; uint16_t MajorImageVersion; uint16_t MinorImageVersion; uint16_t MajorSubsystemVersion; uint16_t MinorSubsystemVersion; uint32_t Win32VersionValue; uint32_t SizeOfImage; uint32_t SizeOfHeaders; uint32_t CheckSum; uint16_t Subsystem; // WindowsSubsystem uint16_t DllCharacteristics; uint64_t SizeOfStackReserve; uint64_t SizeOfStackCommit; uint64_t SizeOfHeapReserve; uint64_t SizeOfHeapCommit; uint32_t LoaderFlags; uint32_t NumberOfRvaAndSizes; // IMAGE_DATA_DIRECTORY DataDirectory[MAX_DIRECTORIES]; } IMAGE_OPTIONAL_HEADER_64; typedef struct { uint16_t type; // opt_type_e size_t length; IMAGE_OPTIONAL_HEADER_32 *_32; IMAGE_OPTIONAL_HEADER_64 *_64; IMAGE_ROM_OPTIONAL_HEADER *_rom; } IMAGE_OPTIONAL_HEADER; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/imports.h000066400000000000000000000031451455661113700211460ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_IMPORTS_H #define LIBPE_IMPORTS_H #include #include "error.h" #ifdef __cplusplus extern "C" { #endif typedef struct { char *name; uint16_t hint; uint16_t ordinal; } pe_imported_function_t; typedef struct { pe_err_e err; char *name; uint32_t functions_count; pe_imported_function_t *functions; // array of imported functions } pe_imported_dll_t; typedef struct { pe_err_e err; uint32_t dll_count; pe_imported_dll_t *dlls; // array of DLLs } pe_imports_t; void pe_imports_dealloc(pe_imports_t *imports); /* * We have an array of names and an array of functions. * * functions[i] has functions corresponding to names[i] * * "Imports": [ * { * "DllName": "SHELL32.dll", * "Functions": [ * "ShellExecuteA", * "FindExecutableA" * ] * } * ] */ #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/macros.h000066400000000000000000000023061455661113700207330ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_MACROS_H #define LIBPE_MACROS_H #ifdef __cplusplus extern "C" { #endif #define LIBPE_PTR_ADD(p, o) ((void *)((char *)(p) + (o))) #define LIBPE_SIZEOF_ARRAY(array) (sizeof(array) / sizeof(array[0])) #define LIBPE_SIZEOF_MEMBER(type, member) sizeof(((type *)0)->member) #define LIBPE_WARNING(msg) \ { \ fprintf(stderr, "WARNING: %s [at %s:%d]\n", msg, __FILE__, __LINE__); \ } #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/ordlookup.h000066400000000000000000000405641455661113700214750ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ // This lookup database is necessary to match Ero Carrera's pefile imphash implementation used by VT and other programs // https://github.com/erocarrera/pefile/tree/master/ordlookup #pragma once typedef struct { int number; char *fname; } ord_t; ord_t oleaut32_arr[] = { { 2, "SysAllocString" }, { 3, "SysReAllocString" }, { 4, "SysAllocStringLen" }, { 5, "SysReAllocStringLen" }, { 6, "SysFreeString" }, { 7, "SysStringLen" }, { 8, "VariantInit" }, { 9, "VariantClear" }, { 10, "VariantCopy" }, { 11, "VariantCopyInd" }, { 12, "VariantChangeType" }, { 13, "VariantTimeToDosDateTime" }, { 14, "DosDateTimeToVariantTime" }, { 15, "SafeArrayCreate" }, { 16, "SafeArrayDestroy" }, { 17, "SafeArrayGetDim" }, { 18, "SafeArrayGetElemsize" }, { 19, "SafeArrayGetUBound" }, { 20, "SafeArrayGetLBound" }, { 21, "SafeArrayLock" }, { 22, "SafeArrayUnlock" }, { 23, "SafeArrayAccessData" }, { 24, "SafeArrayUnaccessData" }, { 25, "SafeArrayGetElement" }, { 26, "SafeArrayPutElement" }, { 27, "SafeArrayCopy" }, { 28, "DispGetParam" }, { 29, "DispGetIDsOfNames" }, { 30, "DispInvoke" }, { 31, "CreateDispTypeInfo" }, { 32, "CreateStdDispatch" }, { 33, "RegisterActiveObject" }, { 34, "RevokeActiveObject" }, { 35, "GetActiveObject" }, { 36, "SafeArrayAllocDescriptor" }, { 37, "SafeArrayAllocData" }, { 38, "SafeArrayDestroyDescriptor" }, { 39, "SafeArrayDestroyData" }, { 40, "SafeArrayRedim" }, { 41, "SafeArrayAllocDescriptorEx" }, { 42, "SafeArrayCreateEx" }, { 43, "SafeArrayCreateVectorEx" }, { 44, "SafeArraySetRecordInfo" }, { 45, "SafeArrayGetRecordInfo" }, { 46, "VarParseNumFromStr" }, { 47, "VarNumFromParseNum" }, { 48, "VarI2FromUI1" }, { 49, "VarI2FromI4" }, { 50, "VarI2FromR4" }, { 51, "VarI2FromR8" }, { 52, "VarI2FromCy" }, { 53, "VarI2FromDate" }, { 54, "VarI2FromStr" }, { 55, "VarI2FromDisp" }, { 56, "VarI2FromBool" }, { 57, "SafeArraySetIID" }, { 58, "VarI4FromUI1" }, { 59, "VarI4FromI2" }, { 60, "VarI4FromR4" }, { 61, "VarI4FromR8" }, { 62, "VarI4FromCy" }, { 63, "VarI4FromDate" }, { 64, "VarI4FromStr" }, { 65, "VarI4FromDisp" }, { 66, "VarI4FromBool" }, { 67, "SafeArrayGetIID" }, { 68, "VarR4FromUI1" }, { 69, "VarR4FromI2" }, { 70, "VarR4FromI4" }, { 71, "VarR4FromR8" }, { 72, "VarR4FromCy" }, { 73, "VarR4FromDate" }, { 74, "VarR4FromStr" }, { 75, "VarR4FromDisp" }, { 76, "VarR4FromBool" }, { 77, "SafeArrayGetVartype" }, { 78, "VarR8FromUI1" }, { 79, "VarR8FromI2" }, { 80, "VarR8FromI4" }, { 81, "VarR8FromR4" }, { 82, "VarR8FromCy" }, { 83, "VarR8FromDate" }, { 84, "VarR8FromStr" }, { 85, "VarR8FromDisp" }, { 86, "VarR8FromBool" }, { 87, "VarFormat" }, { 88, "VarDateFromUI1" }, { 89, "VarDateFromI2" }, { 90, "VarDateFromI4" }, { 91, "VarDateFromR4" }, { 92, "VarDateFromR8" }, { 93, "VarDateFromCy" }, { 94, "VarDateFromStr" }, { 95, "VarDateFromDisp" }, { 96, "VarDateFromBool" }, { 97, "VarFormatDateTime" }, { 98, "VarCyFromUI1" }, { 99, "VarCyFromI2" }, { 100, "VarCyFromI4" }, { 101, "VarCyFromR4" }, { 102, "VarCyFromR8" }, { 103, "VarCyFromDate" }, { 104, "VarCyFromStr" }, { 105, "VarCyFromDisp" }, { 106, "VarCyFromBool" }, { 107, "VarFormatNumber" }, { 108, "VarBstrFromUI1" }, { 109, "VarBstrFromI2" }, { 110, "VarBstrFromI4" }, { 111, "VarBstrFromR4" }, { 112, "VarBstrFromR8" }, { 113, "VarBstrFromCy" }, { 114, "VarBstrFromDate" }, { 115, "VarBstrFromDisp" }, { 116, "VarBstrFromBool" }, { 117, "VarFormatPercent" }, { 118, "VarBoolFromUI1" }, { 119, "VarBoolFromI2" }, { 120, "VarBoolFromI4" }, { 121, "VarBoolFromR4" }, { 122, "VarBoolFromR8" }, { 123, "VarBoolFromDate" }, { 124, "VarBoolFromCy" }, { 125, "VarBoolFromStr" }, { 126, "VarBoolFromDisp" }, { 127, "VarFormatCurrency" }, { 128, "VarWeekdayName" }, { 129, "VarMonthName" }, { 130, "VarUI1FromI2" }, { 131, "VarUI1FromI4" }, { 132, "VarUI1FromR4" }, { 133, "VarUI1FromR8" }, { 134, "VarUI1FromCy" }, { 135, "VarUI1FromDate" }, { 136, "VarUI1FromStr" }, { 137, "VarUI1FromDisp" }, { 138, "VarUI1FromBool" }, { 139, "VarFormatFromTokens" }, { 140, "VarTokenizeFormatString" }, { 141, "VarAdd" }, { 142, "VarAnd" }, { 143, "VarDiv" }, { 144, "DllCanUnloadNow" }, { 145, "DllGetClassObject" }, { 146, "DispCallFunc" }, { 147, "VariantChangeTypeEx" }, { 148, "SafeArrayPtrOfIndex" }, { 149, "SysStringByteLen" }, { 150, "SysAllocStringByteLen" }, { 151, "DllRegisterServer" }, { 152, "VarEqv" }, { 153, "VarIdiv" }, { 154, "VarImp" }, { 155, "VarMod" }, { 156, "VarMul" }, { 157, "VarOr" }, { 158, "VarPow" }, { 159, "VarSub" }, { 160, "CreateTypeLib" }, { 161, "LoadTypeLib" }, { 162, "LoadRegTypeLib" }, { 163, "RegisterTypeLib" }, { 164, "QueryPathOfRegTypeLib" }, { 165, "LHashValOfNameSys" }, { 166, "LHashValOfNameSysA" }, { 167, "VarXor" }, { 168, "VarAbs" }, { 169, "VarFix" }, { 170, "OaBuildVersion" }, { 171, "ClearCustData" }, { 172, "VarInt" }, { 173, "VarNeg" }, { 174, "VarNot" }, { 175, "VarRound" }, { 176, "VarCmp" }, { 177, "VarDecAdd" }, { 178, "VarDecDiv" }, { 179, "VarDecMul" }, { 180, "CreateTypeLib2" }, { 181, "VarDecSub" }, { 182, "VarDecAbs" }, { 183, "LoadTypeLibEx" }, { 184, "SystemTimeToVariantTime" }, { 185, "VariantTimeToSystemTime" }, { 186, "UnRegisterTypeLib" }, { 187, "VarDecFix" }, { 188, "VarDecInt" }, { 189, "VarDecNeg" }, { 190, "VarDecFromUI1" }, { 191, "VarDecFromI2" }, { 192, "VarDecFromI4" }, { 193, "VarDecFromR4" }, { 194, "VarDecFromR8" }, { 195, "VarDecFromDate" }, { 196, "VarDecFromCy" }, { 197, "VarDecFromStr" }, { 198, "VarDecFromDisp" }, { 199, "VarDecFromBool" }, { 200, "GetErrorInfo" }, { 201, "SetErrorInfo" }, { 202, "CreateErrorInfo" }, { 203, "VarDecRound" }, { 204, "VarDecCmp" }, { 205, "VarI2FromI1" }, { 206, "VarI2FromUI2" }, { 207, "VarI2FromUI4" }, { 208, "VarI2FromDec" }, { 209, "VarI4FromI1" }, { 210, "VarI4FromUI2" }, { 211, "VarI4FromUI4" }, { 212, "VarI4FromDec" }, { 213, "VarR4FromI1" }, { 214, "VarR4FromUI2" }, { 215, "VarR4FromUI4" }, { 216, "VarR4FromDec" }, { 217, "VarR8FromI1" }, { 218, "VarR8FromUI2" }, { 219, "VarR8FromUI4" }, { 220, "VarR8FromDec" }, { 221, "VarDateFromI1" }, { 222, "VarDateFromUI2" }, { 223, "VarDateFromUI4" }, { 224, "VarDateFromDec" }, { 225, "VarCyFromI1" }, { 226, "VarCyFromUI2" }, { 227, "VarCyFromUI4" }, { 228, "VarCyFromDec" }, { 229, "VarBstrFromI1" }, { 230, "VarBstrFromUI2" }, { 231, "VarBstrFromUI4" }, { 232, "VarBstrFromDec" }, { 233, "VarBoolFromI1" }, { 234, "VarBoolFromUI2" }, { 235, "VarBoolFromUI4" }, { 236, "VarBoolFromDec" }, { 237, "VarUI1FromI1" }, { 238, "VarUI1FromUI2" }, { 239, "VarUI1FromUI4" }, { 240, "VarUI1FromDec" }, { 241, "VarDecFromI1" }, { 242, "VarDecFromUI2" }, { 243, "VarDecFromUI4" }, { 244, "VarI1FromUI1" }, { 245, "VarI1FromI2" }, { 246, "VarI1FromI4" }, { 247, "VarI1FromR4" }, { 248, "VarI1FromR8" }, { 249, "VarI1FromDate" }, { 250, "VarI1FromCy" }, { 251, "VarI1FromStr" }, { 252, "VarI1FromDisp" }, { 253, "VarI1FromBool" }, { 254, "VarI1FromUI2" }, { 255, "VarI1FromUI4" }, { 256, "VarI1FromDec" }, { 257, "VarUI2FromUI1" }, { 258, "VarUI2FromI2" }, { 259, "VarUI2FromI4" }, { 260, "VarUI2FromR4" }, { 261, "VarUI2FromR8" }, { 262, "VarUI2FromDate" }, { 263, "VarUI2FromCy" }, { 264, "VarUI2FromStr" }, { 265, "VarUI2FromDisp" }, { 266, "VarUI2FromBool" }, { 267, "VarUI2FromI1" }, { 268, "VarUI2FromUI4" }, { 269, "VarUI2FromDec" }, { 270, "VarUI4FromUI1" }, { 271, "VarUI4FromI2" }, { 272, "VarUI4FromI4" }, { 273, "VarUI4FromR4" }, { 274, "VarUI4FromR8" }, { 275, "VarUI4FromDate" }, { 276, "VarUI4FromCy" }, { 277, "VarUI4FromStr" }, { 278, "VarUI4FromDisp" }, { 279, "VarUI4FromBool" }, { 280, "VarUI4FromI1" }, { 281, "VarUI4FromUI2" }, { 282, "VarUI4FromDec" }, { 283, "BSTR_UserSize" }, { 284, "BSTR_UserMarshal" }, { 285, "BSTR_UserUnmarshal" }, { 286, "BSTR_UserFree" }, { 287, "VARIANT_UserSize" }, { 288, "VARIANT_UserMarshal" }, { 289, "VARIANT_UserUnmarshal" }, { 290, "VARIANT_UserFree" }, { 291, "LPSAFEARRAY_UserSize" }, { 292, "LPSAFEARRAY_UserMarshal" }, { 293, "LPSAFEARRAY_UserUnmarshal" }, { 294, "LPSAFEARRAY_UserFree" }, { 295, "LPSAFEARRAY_Size" }, { 296, "LPSAFEARRAY_Marshal" }, { 297, "LPSAFEARRAY_Unmarshal" }, { 298, "VarDecCmpR8" }, { 299, "VarCyAdd" }, { 300, "DllUnregisterServer" }, { 301, "OACreateTypeLib2" }, { 303, "VarCyMul" }, { 304, "VarCyMulI4" }, { 305, "VarCySub" }, { 306, "VarCyAbs" }, { 307, "VarCyFix" }, { 308, "VarCyInt" }, { 309, "VarCyNeg" }, { 310, "VarCyRound" }, { 311, "VarCyCmp" }, { 312, "VarCyCmpR8" }, { 313, "VarBstrCat" }, { 314, "VarBstrCmp" }, { 315, "VarR8Pow" }, { 316, "VarR4CmpR8" }, { 317, "VarR8Round" }, { 318, "VarCat" }, { 319, "VarDateFromUdateEx" }, { 322, "GetRecordInfoFromGuids" }, { 323, "GetRecordInfoFromTypeInfo" }, { 325, "SetVarConversionLocaleSetting" }, { 326, "GetVarConversionLocaleSetting" }, { 327, "SetOaNoCache" }, { 329, "VarCyMulI8" }, { 330, "VarDateFromUdate" }, { 331, "VarUdateFromDate" }, { 332, "GetAltMonthNames" }, { 333, "VarI8FromUI1" }, { 334, "VarI8FromI2" }, { 335, "VarI8FromR4" }, { 336, "VarI8FromR8" }, { 337, "VarI8FromCy" }, { 338, "VarI8FromDate" }, { 339, "VarI8FromStr" }, { 340, "VarI8FromDisp" }, { 341, "VarI8FromBool" }, { 342, "VarI8FromI1" }, { 343, "VarI8FromUI2" }, { 344, "VarI8FromUI4" }, { 345, "VarI8FromDec" }, { 346, "VarI2FromI8" }, { 347, "VarI2FromUI8" }, { 348, "VarI4FromI8" }, { 349, "VarI4FromUI8" }, { 360, "VarR4FromI8" }, { 361, "VarR4FromUI8" }, { 362, "VarR8FromI8" }, { 363, "VarR8FromUI8" }, { 364, "VarDateFromI8" }, { 365, "VarDateFromUI8" }, { 366, "VarCyFromI8" }, { 367, "VarCyFromUI8" }, { 368, "VarBstrFromI8" }, { 369, "VarBstrFromUI8" }, { 370, "VarBoolFromI8" }, { 371, "VarBoolFromUI8" }, { 372, "VarUI1FromI8" }, { 373, "VarUI1FromUI8" }, { 374, "VarDecFromI8" }, { 375, "VarDecFromUI8" }, { 376, "VarI1FromI8" }, { 377, "VarI1FromUI8" }, { 378, "VarUI2FromI8" }, { 379, "VarUI2FromUI8" }, { 401, "OleLoadPictureEx" }, { 402, "OleLoadPictureFileEx" }, { 411, "SafeArrayCreateVector" }, { 412, "SafeArrayCopyData" }, { 413, "VectorFromBstr" }, { 414, "BstrFromVector" }, { 415, "OleIconToCursor" }, { 416, "OleCreatePropertyFrameIndirect" }, { 417, "OleCreatePropertyFrame" }, { 418, "OleLoadPicture" }, { 419, "OleCreatePictureIndirect" }, { 420, "OleCreateFontIndirect" }, { 421, "OleTranslateColor" }, { 422, "OleLoadPictureFile" }, { 423, "OleSavePictureFile" }, { 424, "OleLoadPicturePath" }, { 425, "VarUI4FromI8" }, { 426, "VarUI4FromUI8" }, { 427, "VarI8FromUI8" }, { 428, "VarUI8FromI8" }, { 429, "VarUI8FromUI1" }, { 430, "VarUI8FromI2" }, { 431, "VarUI8FromR4" }, { 432, "VarUI8FromR8" }, { 433, "VarUI8FromCy" }, { 434, "VarUI8FromDate" }, { 435, "VarUI8FromStr" }, { 436, "VarUI8FromDisp" }, { 437, "VarUI8FromBool" }, { 438, "VarUI8FromI1" }, { 439, "VarUI8FromUI2" }, { 440, "VarUI8FromUI4" }, { 441, "VarUI8FromDec" }, { 442, "RegisterTypeLibForUser" }, { 443, "UnRegisterTypeLibForUser" }, { 0 } }; ord_t ws2_32_arr[] = { { 1, "accept" }, { 2, "bind" }, { 3, "closesocket" }, { 4, "connect" }, { 5, "getpeername" }, { 6, "getsockname" }, { 7, "getsockopt" }, { 8, "htonl" }, { 9, "htons" }, { 10, "ioctlsocket" }, { 11, "inet_addr" }, { 12, "inet_ntoa" }, { 13, "listen" }, { 14, "ntohl" }, { 15, "ntohs" }, { 16, "recv" }, { 17, "recvfrom" }, { 18, "select" }, { 19, "send" }, { 20, "sendto" }, { 21, "setsockopt" }, { 22, "shutdown" }, { 23, "socket" }, { 24, "GetAddrInfoW" }, { 25, "GetNameInfoW" }, { 26, "WSApSetPostRoutine" }, { 27, "FreeAddrInfoW" }, { 28, "WPUCompleteOverlappedRequest" }, { 29, "WSAAccept" }, { 30, "WSAAddressToStringA" }, { 31, "WSAAddressToStringW" }, { 32, "WSACloseEvent" }, { 33, "WSAConnect" }, { 34, "WSACreateEvent" }, { 35, "WSADuplicateSocketA" }, { 36, "WSADuplicateSocketW" }, { 37, "WSAEnumNameSpaceProvidersA" }, { 38, "WSAEnumNameSpaceProvidersW" }, { 39, "WSAEnumNetworkEvents" }, { 40, "WSAEnumProtocolsA" }, { 41, "WSAEnumProtocolsW" }, { 42, "WSAEventSelect" }, { 43, "WSAGetOverlappedResult" }, { 44, "WSAGetQOSByName" }, { 45, "WSAGetServiceClassInfoA" }, { 46, "WSAGetServiceClassInfoW" }, { 47, "WSAGetServiceClassNameByClassIdA" }, { 48, "WSAGetServiceClassNameByClassIdW" }, { 49, "WSAHtonl" }, { 50, "WSAHtons" }, { 51, "gethostbyaddr" }, { 52, "gethostbyname" }, { 53, "getprotobyname" }, { 54, "getprotobynumber" }, { 55, "getservbyname" }, { 56, "getservbyport" }, { 57, "gethostname" }, { 58, "WSAInstallServiceClassA" }, { 59, "WSAInstallServiceClassW" }, { 60, "WSAIoctl" }, { 61, "WSAJoinLeaf" }, { 62, "WSALookupServiceBeginA" }, { 63, "WSALookupServiceBeginW" }, { 64, "WSALookupServiceEnd" }, { 65, "WSALookupServiceNextA" }, { 66, "WSALookupServiceNextW" }, { 67, "WSANSPIoctl" }, { 68, "WSANtohl" }, { 69, "WSANtohs" }, { 70, "WSAProviderConfigChange" }, { 71, "WSARecv" }, { 72, "WSARecvDisconnect" }, { 73, "WSARecvFrom" }, { 74, "WSARemoveServiceClass" }, { 75, "WSAResetEvent" }, { 76, "WSASend" }, { 77, "WSASendDisconnect" }, { 78, "WSASendTo" }, { 79, "WSASetEvent" }, { 80, "WSASetServiceA" }, { 81, "WSASetServiceW" }, { 82, "WSASocketA" }, { 83, "WSASocketW" }, { 84, "WSAStringToAddressA" }, { 85, "WSAStringToAddressW" }, { 86, "WSAWaitForMultipleEvents" }, { 87, "WSCDeinstallProvider" }, { 88, "WSCEnableNSProvider" }, { 89, "WSCEnumProtocols" }, { 90, "WSCGetProviderPath" }, { 91, "WSCInstallNameSpace" }, { 92, "WSCInstallProvider" }, { 93, "WSCUnInstallNameSpace" }, { 94, "WSCUpdateProvider" }, { 95, "WSCWriteNameSpaceOrder" }, { 96, "WSCWriteProviderOrder" }, { 97, "freeaddrinfo" }, { 98, "getaddrinfo" }, { 99, "getnameinfo" }, { 101, "WSAAsyncSelect" }, { 102, "WSAAsyncGetHostByAddr" }, { 103, "WSAAsyncGetHostByName" }, { 104, "WSAAsyncGetProtoByNumber" }, { 105, "WSAAsyncGetProtoByName" }, { 106, "WSAAsyncGetServByPort" }, { 107, "WSAAsyncGetServByName" }, { 108, "WSACancelAsyncRequest" }, { 109, "WSASetBlockingHook" }, { 110, "WSAUnhookBlockingHook" }, { 111, "WSAGetLastError" }, { 112, "WSASetLastError" }, { 113, "WSACancelBlockingCall" }, { 114, "WSAIsBlocking" }, { 115, "WSAStartup" }, { 116, "WSACleanup" }, { 151, "__WSAFDIsSet" }, { 500, "WEP" }, { 0 } }; readpe-0.84/lib/libpe/include/libpe/pe.h000066400000000000000000000117511455661113700200570ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_H #define LIBPE_H #ifdef __cplusplus extern "C" { #endif #include "macros.h" #include #include #include #include #include #include "context.h" #include "error.h" #include "hdr_dos.h" #include "hdr_coff.h" #include "hdr_optional.h" #include "directories.h" #include "sections.h" #include "hashes.h" #include "imports.h" #include "exports.h" #include "resources.h" #include "utils.h" #define MAGIC_MZ 0x5a4d // Belongs to the DOS header #define MAX_DIRECTORIES 16 #define MAX_SECTIONS 96 // TODO(jweyrich): Does the PE spec define a length limit for // function names and import/export library names? #define MAX_DLL_NAME 256 #define MAX_FUNCTION_NAME 512 static const uint32_t IMAGE_ORDINAL_FLAG32 = 0x80000000; static const uint64_t IMAGE_ORDINAL_FLAG64 = 0x8000000000000000; #define SIGNATURE_PE 0x00004550 // PE\0\0 in little-endian typedef enum { LIBPE_OPT_NOCLOSE_FD = (1 << 0), // Keeps `stream` open for further usage. LIBPE_OPT_OPEN_RW = (1 << 1) // Open file for read and writing } pe_option_e; typedef uint16_t pe_options_e; // bitmasked pe_option_e values // General functions bool pe_can_read(const pe_ctx_t *ctx, const void *ptr, size_t size); pe_err_e pe_load_file(pe_ctx_t *ctx, const char *path); pe_err_e pe_load_file_ext(pe_ctx_t *ctx, const char *path, pe_options_e options); pe_err_e pe_unload(pe_ctx_t *ctx); pe_err_e pe_parse(pe_ctx_t *ctx); bool pe_is_loaded(const pe_ctx_t *ctx); bool pe_is_pe(const pe_ctx_t *ctx); bool pe_is_exec(const pe_ctx_t *ctx); bool pe_is_obj(const pe_ctx_t *ctx); bool pe_is_rom(const pe_ctx_t *ctx); bool pe_is_dll(const pe_ctx_t *ctx); uint64_t pe_filesize(const pe_ctx_t *ctx); IMAGE_SECTION_HEADER *pe_rva2section(pe_ctx_t *ctx, uint64_t rva); uint64_t pe_rva2ofs(const pe_ctx_t *ctx, uint64_t rva); uint64_t pe_ofs2rva(const pe_ctx_t *ctx, uint64_t ofs); // Header functions IMAGE_DOS_HEADER *pe_dos(pe_ctx_t *ctx); IMAGE_COFF_HEADER *pe_coff(pe_ctx_t *ctx); IMAGE_OPTIONAL_HEADER *pe_optional(pe_ctx_t *ctx); uint32_t pe_directories_count(const pe_ctx_t *ctx); IMAGE_DATA_DIRECTORY **pe_directories(pe_ctx_t *ctx); IMAGE_DATA_DIRECTORY *pe_directory_by_entry(pe_ctx_t *ctx, ImageDirectoryEntry entry); uint16_t pe_sections_count(const pe_ctx_t *ctx); IMAGE_SECTION_HEADER **pe_sections(pe_ctx_t *ctx); IMAGE_SECTION_HEADER *pe_section_by_name(pe_ctx_t *ctx, const char *section_name); const char *pe_section_name(const pe_ctx_t *ctx, const IMAGE_SECTION_HEADER *section_hdr, char *out_name, size_t out_name_size); const char *pe_machine_type_name(MachineType type); const char *pe_image_characteristic_name(ImageCharacteristics characteristic); const char *pe_image_dllcharacteristic_name(ImageDllCharacteristics characteristic); const char *pe_dll_image_dllcharacteristic_name(ImageDllCharacteristics characteristic); const char *pe_image_loader_flags_name(ImageLoaderFlags flags); const char *pe_dll_image_loader_flags_name(ImageLoaderFlags flags); const char *pe_windows_subsystem_name(WindowsSubsystem subsystem); const char *pe_directory_name(ImageDirectoryEntry entry); const char *pe_section_characteristic_name(SectionCharacteristics characteristic); const char *pe_m68k_section_characteristic_name(SectionCharacteristics characteristic); const char *pe_rom_section_characteristic_name(ROMSectionCharacteristics characteristic); bool pe_use_rom_section_characteristic(pe_ctx_t *ctx); // Hash functions size_t pe_hash_recommended_size(void); bool pe_hash_raw_data(char *output, size_t output_size, const char *alg_name, const unsigned char *data, size_t data_size); pe_hash_headers_t *pe_get_headers_hashes(pe_ctx_t *ctx); pe_hash_sections_t *pe_get_sections_hash(pe_ctx_t *ctx); pe_hash_t *pe_get_file_hash(pe_ctx_t *ctx); char *pe_imphash(pe_ctx_t *ctx, pe_imphash_flavor_e flavor); // Imports functions pe_imports_t *pe_imports(pe_ctx_t *ctx); // Exports functions pe_exports_t *pe_exports(pe_ctx_t *ctx); // Resources functions pe_resources_t *pe_resources(pe_ctx_t *ctx); // Misc functions double pe_calculate_entropy_file(pe_ctx_t *ctx); bool pe_fpu_trick(pe_ctx_t *ctx); int pe_get_cpl_analysis(pe_ctx_t *ctx); int pe_has_fake_entrypoint(pe_ctx_t *ctx); int pe_get_tls_callback(pe_ctx_t *ctx); #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/resources.h000066400000000000000000000050011455661113700214540ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_RESOURCES_H #define LIBPE_RESOURCES_H #include #include #include "context.h" #include "error.h" #include "dir_resources.h" #ifdef __cplusplus extern "C" { #endif // // Type Lookup for IMAGE_RESOURCE_DATA_ENTRY // typedef struct { char *name; ResourceType type; char *extension; char *dir_name; } pe_resource_entry_info_t; const pe_resource_entry_info_t *pe_resource_entry_info_lookup(uint32_t name_offset); // // Search nodes // typedef bool (* pe_resource_node_predicate_fn)(const pe_resource_node_t *node); typedef struct pe_resource_node_search_result_item { const pe_resource_node_t *node; struct pe_resource_node_search_result_item *next; } pe_resource_node_search_result_item_t; typedef struct { size_t count; pe_resource_node_search_result_item_t *items; } pe_resource_node_search_result_t; void pe_resource_search_nodes(pe_resource_node_search_result_t *result, const pe_resource_node_t *node, pe_resource_node_predicate_fn predicate); void pe_resources_dealloc_node_search_result(pe_resource_node_search_result_t *result); // // Main // pe_resource_node_t *pe_resource_root_node(const pe_resource_node_t *node); pe_resource_node_t *pe_resource_last_child_node(const pe_resource_node_t *parent_node); pe_resource_node_t *pe_resource_find_node_by_type_and_level(const pe_resource_node_t *node, pe_resource_node_type_e type, uint32_t dirLevel); pe_resource_node_t *pe_resource_find_parent_node_by_type_and_level(const pe_resource_node_t *node, pe_resource_node_type_e type, uint32_t dirLevel); char *pe_resource_parse_string_u(pe_ctx_t *ctx, char *output, size_t output_size, const IMAGE_RESOURCE_DATA_STRING_U *data_string_ptr); void pe_resources_dealloc(pe_resources_t *obj); #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/sections.h000066400000000000000000000174671455661113700213140ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_SECTIONS_H #define LIBPE_SECTIONS_H #include #ifdef __cplusplus extern "C" { #endif #define SECTION_NAME_SIZE 8 // These informations were filled from various sources: // - various versions of SDK files ntimage.h, winnt.h and coff.doc, pecoff*.doc documents // - behavior of MSVC40 CL.EXE (I386 and M68K versions), LINK.EXE and DUMPBIN.EXE typedef enum { IMAGE_SCN_SCALE_INDEX = 0x00000001, // Address of tls index is scaled (multiplied by 4). This is valid only for .tls section and only on MIPS. IMAGE_SCN_TYPE_NO_LOAD = 0x00000002, // Reserved. IMAGE_SCN_TYPE_GROUPED = 0x00000004, // Used for 16-bit offset code. Linker combines sections with the same name (they may have different flags) into one output section with max 64 kB size. All offsets inside the section are signed 16-bit from the middle of the section. This is valid only for object files. (Not supported by LINK.EXE) IMAGE_SCN_TYPE_NO_PAD = 0x00000008, // Same as IMAGE_SCN_ALIGN_1BYTES. This is valid only for object files. IMAGE_SCN_TYPE_COPY = 0x00000010, // Reserved. IMAGE_SCN_CNT_CODE = 0x00000020, // The section contains executable code. IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040, // The section contains initialized data. IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080, // The section contains uninitialized data. IMAGE_SCN_LNK_OTHER = 0x00000100, // The section contains other than info, code or data. This is valid only for object files. IMAGE_SCN_LNK_INFO = 0x00000200, // The section contains comments or other information. This is valid only for object files. IMAGE_SCN_LNK_OVERLAY = 0x00000400, // The section contains an overlay (Reserved). IMAGE_SCN_LNK_REMOVE = 0x00000800, // The section will not become part of the image. This is valid only for object files. IMAGE_SCN_LNK_COMDAT = 0x00001000, // The section contains COMDAT data. This is valid only for object files. // RESERVED = 0x00002000, // Reserved. IMAGE_SCN_MEM_PROTECTED = 0x00004000, // The section is memory protected. This is valid only for M68K (Mac OS memory management). IMAGE_SCN_NO_DEFER_SPEC_EXC = 0x00004000, // Reset speculative exceptions handling bits in the TLB entries for this section. This is not valid for M68K. IMAGE_SCN_MEM_FARDATA = 0x00008000, // The section contains FAR_EXTERNAL relocations. This is valid only for M68K (Mac OS memory management). IMAGE_SCN_GPREL = 0x00008000, // The section contains data referenced through the global pointer. This is not valid for M68K. IMAGE_SCN_MEM_SYSHEAP = 0x00010000, // The section uses System heap. This is valid only for M68K (Mac OS memory management). IMAGE_SCN_MEM_PURGEABLE = 0x00020000, // The section can be released from RAM. This is valid only for M68K (Mac OS memory management). IMAGE_SCN_MEM_16BIT = 0x00020000, // The section contains 16-bit code. This is valid only for non-M68K architectures where it makes sense (I386, THUMB, MIPS16, MIPSFPU16, ...). IMAGE_SCN_MEM_LOCKED = 0x00040000, // The section is locked/resident and prevented from being moved in RAM. This is valid only for M68K (Mac OS memory management) and I386 object files (e.g. for building Linear Executables). IMAGE_SCN_MEM_PRELOAD = 0x00080000, // The section is preloaded to RAM. This is valid only for M68K (Mac OS memory management) and I386 object files (e.g. for building Linear Executables). IMAGE_SCN_ALIGN_1BYTES = 0x00100000, // Align data on a 1-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_2BYTES = 0x00200000, // Align data on a 2-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_4BYTES = 0x00300000, // Align data on a 4-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_8BYTES = 0x00400000, // Align data on a 8-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_16BYTES = 0x00500000, // Align data on a 16-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_32BYTES = 0x00600000, // Align data on a 32-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_64BYTES = 0x00700000, // Align data on a 64-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_128BYTES = 0x00800000, // Align data on a 128-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_256BYTES = 0x00900000, // Align data on a 256-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_512BYTES = 0x00A00000, // Align data on a 512-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_1024BYTES = 0x00B00000, // Align data on a 1024-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_2048BYTES = 0x00C00000, // Align data on a 2048-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_4096BYTES = 0x00D00000, // Align data on a 4096-byte boundary. This is valid only for object files. IMAGE_SCN_ALIGN_8192BYTES = 0x00E00000, // Align data on a 8192-byte boundary. This is valid only for object files. // RESERVED = 0x00F00000, // Reserved. IMAGE_SCN_LNK_NRELOC_OVFL = 0x01000000, // The section contains extended relocations. This is valid only for object files. IMAGE_SCN_MEM_DISCARDABLE = 0x02000000, // The section can be discarded as needed. IMAGE_SCN_MEM_NOT_CACHED = 0x04000000, // The section cannot be cached. IMAGE_SCN_MEM_NOT_PAGED = 0x08000000, // The section cannot be paged. IMAGE_SCN_MEM_SHARED = 0x10000000, // The section is shareable. When used with a DLL, the data in this section will be shared among all processes using the DLL. IMAGE_SCN_MEM_EXECUTE = 0x20000000, // The section is executable. IMAGE_SCN_MEM_READ = 0x40000000, // The section is readable. IMAGE_SCN_MEM_WRITE = -2147483648 // The section is writeable. (0x80000000U) } SectionCharacteristics; // Used only when IMAGE_ROM_OPTIONAL_HEADER is present typedef enum { STYP_DUMMY = 0x00000001, // Dummy STYP_TEXT = 0x00000020, // Text STYP_DATA = 0x00000040, // Data STYP_SBSS = 0x00000080, // GP Uninit Data STYP_RDATA = 0x00000100, // Readonly Data STYP_SDATA = 0x00000200, // GP Init Data STYP_BSS = 0x00000400, // Uninit Data STYP_UCODE = 0x00000800, // UCode STYP_LIT8 = 0x08000000, // Literal 8 STYP_LIT4 = 0x10000000, // Literal 4 S_NRELOC_OVFL = 0x20000000, // Non-Relocatable overlay STYP_LIB = 0x40000000, // Library STYP_INIT = -2147483648 // Init Code (0x80000000U) } ROMSectionCharacteristics; #pragma pack(push, 1) // Quoting pecoff_v8.docx: "Entries in the section table are numbered starting from one (1)". typedef struct { uint8_t Name[SECTION_NAME_SIZE]; // TODO: Should we use char instead? union { uint32_t PhysicalAddress; // same value as next field uint32_t VirtualSize; } Misc; uint32_t VirtualAddress; uint32_t SizeOfRawData; uint32_t PointerToRawData; uint32_t PointerToRelocations; // always zero in executables uint32_t PointerToLinenumbers; // deprecated uint16_t NumberOfRelocations; uint16_t NumberOfLinenumbers; // deprecated uint32_t Characteristics; // SectionCharacteristics or ROMSectionCharacteristics } IMAGE_SECTION_HEADER; #pragma pack(pop) #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/types_resources.h000066400000000000000000000041731455661113700227110ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2023 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_TYPES_RESOURCES_H #define LIBPE_TYPES_RESOURCES_H #include #include "dir_resources.h" #include "error.h" typedef enum { LIBPE_RDT_LEVEL1 = 1, LIBPE_RDT_LEVEL2 = 2, LIBPE_RDT_LEVEL3 = 3 } pe_resource_level_e; typedef enum { LIBPE_RDT_RESOURCE_DIRECTORY = 1, LIBPE_RDT_DIRECTORY_ENTRY = 2, LIBPE_RDT_DATA_STRING = 3, LIBPE_RDT_DATA_ENTRY = 4 } pe_resource_node_type_e; typedef struct pe_resource_node { uint16_t depth; uint32_t dirLevel; // pe_resouces_level_e pe_resource_node_type_e type; char *name; union { void *raw_ptr; // We are allowed to rely on type-punning in C99, but not in C++. IMAGE_RESOURCE_DIRECTORY *resourceDirectory; // type == LIBPE_RDT_RESOURCE_DIRECTORY IMAGE_RESOURCE_DIRECTORY_ENTRY *directoryEntry; // type == LIBPE_RDT_DIRECTORY_ENTRY IMAGE_RESOURCE_DATA_STRING_U *dataString; // type == LIBPE_RDT_DATA_STRING IMAGE_RESOURCE_DATA_ENTRY *dataEntry; // type == LIBPE_RDT_DATA_ENTRY } raw; struct pe_resource_node *parentNode; // Points to the parent node, if any. struct pe_resource_node *childNode; // Points to the 1st child node, if any. struct pe_resource_node *nextNode; // Points to the next sibling node, if any. } pe_resource_node_t; typedef struct { pe_err_e err; void *resource_base_ptr; // A pointer to the beggining of the `IMAGE_RESOURCE_DIRECTORY`. pe_resource_node_t *root_node; } pe_resources_t; #endif readpe-0.84/lib/libpe/include/libpe/utils.h000066400000000000000000000036601455661113700206130ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #ifndef LIBPE_UTILS_H #define LIBPE_UTILS_H #include #include #ifdef __cplusplus extern "C" { #endif #ifndef pe_utils_min // IMPORTANT: Do not pass expressions as arguments because this macro evaluates each argument more than once! # define pe_utils_min(a, b) (((a) < (b)) ? (a) : (b)) #endif #ifndef pe_utils_max // IMPORTANT: Do not pass expressions as arguments because this macro evaluates each argument more than once! # define pe_utils_max(a, b) (((a) > (b)) ? (a) : (b)) #endif bool pe_utils_str_ends_with(const char* text, const char* pattern); char *pe_utils_str_inplace_ltrim(char *str); char *pe_utils_str_inplace_rtrim(char *str); char *pe_utils_str_inplace_trim(char *str); char *pe_utils_str_array_join(char *strings[], size_t count, char delimiter); void pe_utils_str_widechar2ascii(char *output, size_t output_size, const char *widechar, size_t widechar_count); // FIX: Don't need this. #if 0 int pe_utils_round_up(int num_to_round, int multiple); #endif int pe_utils_is_file_readable(const char *path); // IMPORTANT: This is not thread-safe - not reentrant. const char *pe_utils_get_homedir(void); #ifdef __cplusplus } // extern "C" #endif #endif readpe-0.84/lib/libpe/include/libpe/utlist.h000066400000000000000000002036501455661113700210000ustar00rootroot00000000000000/* Copyright (c) 2007-2016, Troy D. Hanson http://troydhanson.github.com/uthash/ All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UTLIST_H #define UTLIST_H #define UTLIST_VERSION 2.0.1 #include /* * This file contains macros to manipulate singly and doubly-linked lists. * * 1. LL_ macros: singly-linked lists. * 2. DL_ macros: doubly-linked lists. * 3. CDL_ macros: circular doubly-linked lists. * * To use singly-linked lists, your structure must have a "next" pointer. * To use doubly-linked lists, your structure must "prev" and "next" pointers. * Either way, the pointer to the head of the list must be initialized to NULL. * * ----------------.EXAMPLE ------------------------- * struct item { * int id; * struct item *prev, *next; * } * * struct item *list = NULL: * * int main() { * struct item *item; * ... allocate and populate item ... * DL_APPEND(list, item); * } * -------------------------------------------------- * * For doubly-linked lists, the append and delete macros are O(1) * For singly-linked lists, append and delete are O(n) but prepend is O(1) * The sort macro is O(n log(n)) for all types of single/double/circular lists. */ /* These macros use decltype or the earlier __typeof GNU extension. As decltype is only available in newer compilers (VS2010 or gcc 4.3+ when compiling c++ code), this code uses whatever method is needed or, for VS2008 where neither is available, uses casting workarounds. */ #ifdef _MSC_VER /* MS compiler */ #if _MSC_VER >= 1600 && defined(__cplusplus) /* VS2010 or newer in C++ mode */ #define LDECLTYPE(x) decltype(x) #else /* VS2008 or older (or VS2010 in C mode) */ #define NO_DECLTYPE #endif #elif defined(__ICCARM__) #define NO_DECLTYPE #else /* GNU, Sun and other compilers */ #define LDECLTYPE(x) __typeof(x) #endif /* for VS2008 we use some workarounds to get around the lack of decltype, * namely, we always reassign our tmp variable to the list head if we need * to dereference its prev/next pointers, and save/restore the real head.*/ #ifdef NO_DECLTYPE #define IF_NO_DECLTYPE(x) x #define LDECLTYPE(x) char* #define _SV(elt,list) _tmp = (char*)(list); {char **_alias = (char**)&(list); *_alias = (elt); } #define _NEXT(elt,list,next) ((char*)((list)->next)) #define _NEXTASGN(elt,list,to,next) { char **_alias = (char**)&((list)->next); *_alias=(char*)(to); } /* #define _PREV(elt,list,prev) ((char*)((list)->prev)) */ #define _PREVASGN(elt,list,to,prev) { char **_alias = (char**)&((list)->prev); *_alias=(char*)(to); } #define _RS(list) { char **_alias = (char**)&(list); *_alias=_tmp; } #define _CASTASGN(a,b) { char **_alias = (char**)&(a); *_alias=(char*)(b); } #else #define IF_NO_DECLTYPE(x) #define _SV(elt,list) #define _NEXT(elt,list,next) ((elt)->next) #define _NEXTASGN(elt,list,to,next) ((elt)->next)=(to) /* #define _PREV(elt,list,prev) ((elt)->prev) */ #define _PREVASGN(elt,list,to,prev) ((elt)->prev)=(to) #define _RS(list) #define _CASTASGN(a,b) (a)=(b) #endif /****************************************************************************** * The sort macro is an adaptation of Simon Tatham's O(n log(n)) mergesort * * Unwieldy variable names used here to avoid shadowing passed-in variables. * *****************************************************************************/ #define LL_SORT(list, cmp) \ LL_SORT2(list, cmp, next) #define LL_SORT2(list, cmp, next) \ do { \ LDECLTYPE(list) _ls_p; \ LDECLTYPE(list) _ls_q; \ LDECLTYPE(list) _ls_e; \ LDECLTYPE(list) _ls_tail; \ IF_NO_DECLTYPE(LDECLTYPE(list) _tmp;) \ int _ls_insize, _ls_nmerges, _ls_psize, _ls_qsize, _ls_i, _ls_looping; \ if (list) { \ _ls_insize = 1; \ _ls_looping = 1; \ while (_ls_looping) { \ _CASTASGN(_ls_p,list); \ (list) = NULL; \ _ls_tail = NULL; \ _ls_nmerges = 0; \ while (_ls_p) { \ _ls_nmerges++; \ _ls_q = _ls_p; \ _ls_psize = 0; \ for (_ls_i = 0; _ls_i < _ls_insize; _ls_i++) { \ _ls_psize++; \ _SV(_ls_q,list); _ls_q = _NEXT(_ls_q,list,next); _RS(list); \ if (!_ls_q) break; \ } \ _ls_qsize = _ls_insize; \ while (_ls_psize > 0 || (_ls_qsize > 0 && _ls_q)) { \ if (_ls_psize == 0) { \ _ls_e = _ls_q; _SV(_ls_q,list); _ls_q = \ _NEXT(_ls_q,list,next); _RS(list); _ls_qsize--; \ } else if (_ls_qsize == 0 || !_ls_q) { \ _ls_e = _ls_p; _SV(_ls_p,list); _ls_p = \ _NEXT(_ls_p,list,next); _RS(list); _ls_psize--; \ } else if (cmp(_ls_p,_ls_q) <= 0) { \ _ls_e = _ls_p; _SV(_ls_p,list); _ls_p = \ _NEXT(_ls_p,list,next); _RS(list); _ls_psize--; \ } else { \ _ls_e = _ls_q; _SV(_ls_q,list); _ls_q = \ _NEXT(_ls_q,list,next); _RS(list); _ls_qsize--; \ } \ if (_ls_tail) { \ _SV(_ls_tail,list); _NEXTASGN(_ls_tail,list,_ls_e,next); _RS(list); \ } else { \ _CASTASGN(list,_ls_e); \ } \ _ls_tail = _ls_e; \ } \ _ls_p = _ls_q; \ } \ if (_ls_tail) { \ _SV(_ls_tail,list); _NEXTASGN(_ls_tail,list,NULL,next); _RS(list); \ } \ if (_ls_nmerges <= 1) { \ _ls_looping=0; \ } \ _ls_insize *= 2; \ } \ } \ } while (0) #define DL_SORT(list, cmp) \ DL_SORT2(list, cmp, prev, next) #define DL_SORT2(list, cmp, prev, next) \ do { \ LDECLTYPE(list) _ls_p; \ LDECLTYPE(list) _ls_q; \ LDECLTYPE(list) _ls_e; \ LDECLTYPE(list) _ls_tail; \ IF_NO_DECLTYPE(LDECLTYPE(list) _tmp;) \ int _ls_insize, _ls_nmerges, _ls_psize, _ls_qsize, _ls_i, _ls_looping; \ if (list) { \ _ls_insize = 1; \ _ls_looping = 1; \ while (_ls_looping) { \ _CASTASGN(_ls_p,list); \ (list) = NULL; \ _ls_tail = NULL; \ _ls_nmerges = 0; \ while (_ls_p) { \ _ls_nmerges++; \ _ls_q = _ls_p; \ _ls_psize = 0; \ for (_ls_i = 0; _ls_i < _ls_insize; _ls_i++) { \ _ls_psize++; \ _SV(_ls_q,list); _ls_q = _NEXT(_ls_q,list,next); _RS(list); \ if (!_ls_q) break; \ } \ _ls_qsize = _ls_insize; \ while ((_ls_psize > 0) || ((_ls_qsize > 0) && _ls_q)) { \ if (_ls_psize == 0) { \ _ls_e = _ls_q; _SV(_ls_q,list); _ls_q = \ _NEXT(_ls_q,list,next); _RS(list); _ls_qsize--; \ } else if ((_ls_qsize == 0) || (!_ls_q)) { \ _ls_e = _ls_p; _SV(_ls_p,list); _ls_p = \ _NEXT(_ls_p,list,next); _RS(list); _ls_psize--; \ } else if (cmp(_ls_p,_ls_q) <= 0) { \ _ls_e = _ls_p; _SV(_ls_p,list); _ls_p = \ _NEXT(_ls_p,list,next); _RS(list); _ls_psize--; \ } else { \ _ls_e = _ls_q; _SV(_ls_q,list); _ls_q = \ _NEXT(_ls_q,list,next); _RS(list); _ls_qsize--; \ } \ if (_ls_tail) { \ _SV(_ls_tail,list); _NEXTASGN(_ls_tail,list,_ls_e,next); _RS(list); \ } else { \ _CASTASGN(list,_ls_e); \ } \ _SV(_ls_e,list); _PREVASGN(_ls_e,list,_ls_tail,prev); _RS(list); \ _ls_tail = _ls_e; \ } \ _ls_p = _ls_q; \ } \ _CASTASGN((list)->prev, _ls_tail); \ _SV(_ls_tail,list); _NEXTASGN(_ls_tail,list,NULL,next); _RS(list); \ if (_ls_nmerges <= 1) { \ _ls_looping=0; \ } \ _ls_insize *= 2; \ } \ } \ } while (0) #define CDL_SORT(list, cmp) \ CDL_SORT2(list, cmp, prev, next) #define CDL_SORT2(list, cmp, prev, next) \ do { \ LDECLTYPE(list) _ls_p; \ LDECLTYPE(list) _ls_q; \ LDECLTYPE(list) _ls_e; \ LDECLTYPE(list) _ls_tail; \ LDECLTYPE(list) _ls_oldhead; \ LDECLTYPE(list) _tmp; \ int _ls_insize, _ls_nmerges, _ls_psize, _ls_qsize, _ls_i, _ls_looping; \ if (list) { \ _ls_insize = 1; \ _ls_looping = 1; \ while (_ls_looping) { \ _CASTASGN(_ls_p,list); \ _CASTASGN(_ls_oldhead,list); \ (list) = NULL; \ _ls_tail = NULL; \ _ls_nmerges = 0; \ while (_ls_p) { \ _ls_nmerges++; \ _ls_q = _ls_p; \ _ls_psize = 0; \ for (_ls_i = 0; _ls_i < _ls_insize; _ls_i++) { \ _ls_psize++; \ _SV(_ls_q,list); \ if (_NEXT(_ls_q,list,next) == _ls_oldhead) { \ _ls_q = NULL; \ } else { \ _ls_q = _NEXT(_ls_q,list,next); \ } \ _RS(list); \ if (!_ls_q) break; \ } \ _ls_qsize = _ls_insize; \ while (_ls_psize > 0 || (_ls_qsize > 0 && _ls_q)) { \ if (_ls_psize == 0) { \ _ls_e = _ls_q; _SV(_ls_q,list); _ls_q = \ _NEXT(_ls_q,list,next); _RS(list); _ls_qsize--; \ if (_ls_q == _ls_oldhead) { _ls_q = NULL; } \ } else if (_ls_qsize == 0 || !_ls_q) { \ _ls_e = _ls_p; _SV(_ls_p,list); _ls_p = \ _NEXT(_ls_p,list,next); _RS(list); _ls_psize--; \ if (_ls_p == _ls_oldhead) { _ls_p = NULL; } \ } else if (cmp(_ls_p,_ls_q) <= 0) { \ _ls_e = _ls_p; _SV(_ls_p,list); _ls_p = \ _NEXT(_ls_p,list,next); _RS(list); _ls_psize--; \ if (_ls_p == _ls_oldhead) { _ls_p = NULL; } \ } else { \ _ls_e = _ls_q; _SV(_ls_q,list); _ls_q = \ _NEXT(_ls_q,list,next); _RS(list); _ls_qsize--; \ if (_ls_q == _ls_oldhead) { _ls_q = NULL; } \ } \ if (_ls_tail) { \ _SV(_ls_tail,list); _NEXTASGN(_ls_tail,list,_ls_e,next); _RS(list); \ } else { \ _CASTASGN(list,_ls_e); \ } \ _SV(_ls_e,list); _PREVASGN(_ls_e,list,_ls_tail,prev); _RS(list); \ _ls_tail = _ls_e; \ } \ _ls_p = _ls_q; \ } \ _CASTASGN((list)->prev,_ls_tail); \ _CASTASGN(_tmp,list); \ _SV(_ls_tail,list); _NEXTASGN(_ls_tail,list,_tmp,next); _RS(list); \ if (_ls_nmerges <= 1) { \ _ls_looping=0; \ } \ _ls_insize *= 2; \ } \ } \ } while (0) /****************************************************************************** * singly linked list macros (non-circular) * *****************************************************************************/ #define LL_PREPEND(head,add) \ LL_PREPEND2(head,add,next) #define LL_PREPEND2(head,add,next) \ do { \ (add)->next = (head); \ (head) = (add); \ } while (0) #define LL_CONCAT(head1,head2) \ LL_CONCAT2(head1,head2,next) #define LL_CONCAT2(head1,head2,next) \ do { \ LDECLTYPE(head1) _tmp; \ if (head1) { \ _tmp = (head1); \ while (_tmp->next) { _tmp = _tmp->next; } \ _tmp->next=(head2); \ } else { \ (head1)=(head2); \ } \ } while (0) #define LL_APPEND(head,add) \ LL_APPEND2(head,add,next) #define LL_APPEND2(head,add,next) \ do { \ LDECLTYPE(head) _tmp; \ (add)->next=NULL; \ if (head) { \ _tmp = (head); \ while (_tmp->next) { _tmp = _tmp->next; } \ _tmp->next=(add); \ } else { \ (head)=(add); \ } \ } while (0) #define LL_DELETE(head,del) \ LL_DELETE2(head,del,next) #define LL_DELETE2(head,del,next) \ do { \ LDECLTYPE(head) _tmp; \ if ((head) == (del)) { \ (head)=(head)->next; \ } else { \ _tmp = (head); \ while (_tmp->next && (_tmp->next != (del))) { \ _tmp = _tmp->next; \ } \ if (_tmp->next) { \ _tmp->next = (del)->next; \ } \ } \ } while (0) #define LL_COUNT(head,el,counter) \ LL_COUNT2(head,el,counter,next) \ #define LL_COUNT2(head,el,counter,next) \ do { \ (counter) = 0; \ LL_FOREACH2(head,el,next) { ++(counter); } \ } while (0) #define LL_FOREACH(head,el) \ LL_FOREACH2(head,el,next) #define LL_FOREACH2(head,el,next) \ for ((el) = (head); el; (el) = (el)->next) #define LL_FOREACH_SAFE(head,el,tmp) \ LL_FOREACH_SAFE2(head,el,tmp,next) #define LL_FOREACH_SAFE2(head,el,tmp,next) \ for ((el) = (head); (el) && ((tmp) = (el)->next, 1); (el) = (tmp)) #define LL_SEARCH_SCALAR(head,out,field,val) \ LL_SEARCH_SCALAR2(head,out,field,val,next) #define LL_SEARCH_SCALAR2(head,out,field,val,next) \ do { \ LL_FOREACH2(head,out,next) { \ if ((out)->field == (val)) break; \ } \ } while (0) #define LL_SEARCH(head,out,elt,cmp) \ LL_SEARCH2(head,out,elt,cmp,next) #define LL_SEARCH2(head,out,elt,cmp,next) \ do { \ LL_FOREACH2(head,out,next) { \ if ((cmp(out,elt))==0) break; \ } \ } while (0) #define LL_REPLACE_ELEM2(head, el, add, next) \ do { \ LDECLTYPE(head) _tmp; \ assert((head) != NULL); \ assert((el) != NULL); \ assert((add) != NULL); \ (add)->next = (el)->next; \ if ((head) == (el)) { \ (head) = (add); \ } else { \ _tmp = (head); \ while (_tmp->next && (_tmp->next != (el))) { \ _tmp = _tmp->next; \ } \ if (_tmp->next) { \ _tmp->next = (add); \ } \ } \ } while (0) #define LL_REPLACE_ELEM(head, el, add) \ LL_REPLACE_ELEM2(head, el, add, next) #define LL_PREPEND_ELEM2(head, el, add, next) \ do { \ if (el) { \ LDECLTYPE(head) _tmp; \ assert((head) != NULL); \ assert((add) != NULL); \ (add)->next = (el); \ if ((head) == (el)) { \ (head) = (add); \ } else { \ _tmp = (head); \ while (_tmp->next && (_tmp->next != (el))) { \ _tmp = _tmp->next; \ } \ if (_tmp->next) { \ _tmp->next = (add); \ } \ } \ } else { \ LL_APPEND2(head, add, next); \ } \ } while (0) \ #define LL_PREPEND_ELEM(head, el, add) \ LL_PREPEND_ELEM2(head, el, add, next) #define LL_APPEND_ELEM2(head, el, add, next) \ do { \ if (el) { \ assert((head) != NULL); \ assert((add) != NULL); \ (add)->next = (el)->next; \ (el)->next = (add); \ } else { \ LL_PREPEND2(head, add, next); \ } \ } while (0) \ #define LL_APPEND_ELEM(head, el, add) \ LL_APPEND_ELEM2(head, el, add, next) #ifdef NO_DECLTYPE /* Here are VS2008 / NO_DECLTYPE replacements for a few functions */ #undef LL_CONCAT2 #define LL_CONCAT2(head1,head2,next) \ do { \ char *_tmp; \ if (head1) { \ _tmp = (char*)(head1); \ while ((head1)->next) { (head1) = (head1)->next; } \ (head1)->next = (head2); \ _RS(head1); \ } else { \ (head1)=(head2); \ } \ } while (0) #undef LL_APPEND2 #define LL_APPEND2(head,add,next) \ do { \ if (head) { \ (add)->next = head; /* use add->next as a temp variable */ \ while ((add)->next->next) { (add)->next = (add)->next->next; } \ (add)->next->next=(add); \ } else { \ (head)=(add); \ } \ (add)->next=NULL; \ } while (0) #undef LL_DELETE2 #define LL_DELETE2(head,del,next) \ do { \ if ((head) == (del)) { \ (head)=(head)->next; \ } else { \ char *_tmp = (char*)(head); \ while ((head)->next && ((head)->next != (del))) { \ (head) = (head)->next; \ } \ if ((head)->next) { \ (head)->next = ((del)->next); \ } \ _RS(head); \ } \ } while (0) #undef LL_REPLACE_ELEM2 #define LL_REPLACE_ELEM2(head, el, add, next) \ do { \ assert((head) != NULL); \ assert((el) != NULL); \ assert((add) != NULL); \ if ((head) == (el)) { \ (head) = (add); \ } else { \ (add)->next = head; \ while ((add)->next->next && ((add)->next->next != (el))) { \ (add)->next = (add)->next->next; \ } \ if ((add)->next->next) { \ (add)->next->next = (add); \ } \ } \ (add)->next = (el)->next; \ } while (0) #undef LL_PREPEND_ELEM2 #define LL_PREPEND_ELEM2(head, el, add, next) \ do { \ if (el) { \ assert((head) != NULL); \ assert((add) != NULL); \ if ((head) == (el)) { \ (head) = (add); \ } else { \ (add)->next = (head); \ while ((add)->next->next && ((add)->next->next != (el))) { \ (add)->next = (add)->next->next; \ } \ if ((add)->next->next) { \ (add)->next->next = (add); \ } \ } \ (add)->next = (el); \ } else { \ LL_APPEND2(head, add, next); \ } \ } while (0) \ #endif /* NO_DECLTYPE */ /****************************************************************************** * doubly linked list macros (non-circular) * *****************************************************************************/ #define DL_PREPEND(head,add) \ DL_PREPEND2(head,add,prev,next) #define DL_PREPEND2(head,add,prev,next) \ do { \ (add)->next = (head); \ if (head) { \ (add)->prev = (head)->prev; \ (head)->prev = (add); \ } else { \ (add)->prev = (add); \ } \ (head) = (add); \ } while (0) #define DL_APPEND(head,add) \ DL_APPEND2(head,add,prev,next) #define DL_APPEND2(head,add,prev,next) \ do { \ if (head) { \ (add)->prev = (head)->prev; \ (head)->prev->next = (add); \ (head)->prev = (add); \ (add)->next = NULL; \ } else { \ (head)=(add); \ (head)->prev = (head); \ (head)->next = NULL; \ } \ } while (0) #define DL_CONCAT(head1,head2) \ DL_CONCAT2(head1,head2,prev,next) #define DL_CONCAT2(head1,head2,prev,next) \ do { \ LDECLTYPE(head1) _tmp; \ if (head2) { \ if (head1) { \ _CASTASGN(_tmp, (head2)->prev); \ (head2)->prev = (head1)->prev; \ (head1)->prev->next = (head2); \ _CASTASGN((head1)->prev, _tmp); \ } else { \ (head1)=(head2); \ } \ } \ } while (0) #define DL_DELETE(head,del) \ DL_DELETE2(head,del,prev,next) #define DL_DELETE2(head,del,prev,next) \ do { \ assert((del)->prev != NULL); \ if ((del)->prev == (del)) { \ (head)=NULL; \ } else if ((del)==(head)) { \ (del)->next->prev = (del)->prev; \ (head) = (del)->next; \ } else { \ (del)->prev->next = (del)->next; \ if ((del)->next) { \ (del)->next->prev = (del)->prev; \ } else { \ (head)->prev = (del)->prev; \ } \ } \ } while (0) #define DL_COUNT(head,el,counter) \ DL_COUNT2(head,el,counter,next) \ #define DL_COUNT2(head,el,counter,next) \ do { \ (counter) = 0; \ DL_FOREACH2(head,el,next) { ++(counter); } \ } while (0) #define DL_FOREACH(head,el) \ DL_FOREACH2(head,el,next) #define DL_FOREACH2(head,el,next) \ for ((el) = (head); el; (el) = (el)->next) /* this version is safe for deleting the elements during iteration */ #define DL_FOREACH_SAFE(head,el,tmp) \ DL_FOREACH_SAFE2(head,el,tmp,next) #define DL_FOREACH_SAFE2(head,el,tmp,next) \ for ((el) = (head); (el) && ((tmp) = (el)->next, 1); (el) = (tmp)) /* these are identical to their singly-linked list counterparts */ #define DL_SEARCH_SCALAR LL_SEARCH_SCALAR #define DL_SEARCH LL_SEARCH #define DL_SEARCH_SCALAR2 LL_SEARCH_SCALAR2 #define DL_SEARCH2 LL_SEARCH2 #define DL_REPLACE_ELEM2(head, el, add, prev, next) \ do { \ assert((head) != NULL); \ assert((el) != NULL); \ assert((add) != NULL); \ if ((head) == (el)) { \ (head) = (add); \ (add)->next = (el)->next; \ if ((el)->next == NULL) { \ (add)->prev = (add); \ } else { \ (add)->prev = (el)->prev; \ (add)->next->prev = (add); \ } \ } else { \ (add)->next = (el)->next; \ (add)->prev = (el)->prev; \ (add)->prev->next = (add); \ if ((el)->next == NULL) { \ (head)->prev = (add); \ } else { \ (add)->next->prev = (add); \ } \ } \ } while (0) #define DL_REPLACE_ELEM(head, el, add) \ DL_REPLACE_ELEM2(head, el, add, prev, next) #define DL_PREPEND_ELEM2(head, el, add, prev, next) \ do { \ if (el) { \ assert((head) != NULL); \ assert((add) != NULL); \ (add)->next = (el); \ (add)->prev = (el)->prev; \ (el)->prev = (add); \ if ((head) == (el)) { \ (head) = (add); \ } else { \ (add)->prev->next = (add); \ } \ } else { \ DL_APPEND2(head, add, prev, next); \ } \ } while (0) \ #define DL_PREPEND_ELEM(head, el, add) \ DL_PREPEND_ELEM2(head, el, add, prev, next) #define DL_APPEND_ELEM2(head, el, add, prev, next) \ do { \ if (el) { \ assert((head) != NULL); \ assert((add) != NULL); \ (add)->next = (el)->next; \ (add)->prev = (el); \ (el)->next = (add); \ if ((add)->next) { \ (add)->next->prev = (add); \ } else { \ (head)->prev = (add); \ } \ } else { \ DL_PREPEND2(head, add, prev, next); \ } \ } while (0) \ #define DL_APPEND_ELEM(head, el, add) \ DL_APPEND_ELEM2(head, el, add, prev, next) /****************************************************************************** * circular doubly linked list macros * *****************************************************************************/ #define CDL_APPEND(head,add) \ CDL_APPEND2(head,add,prev,next) #define CDL_APPEND2(head,add,prev,next) \ do { \ if (head) { \ (add)->prev = (head)->prev; \ (add)->next = (head); \ (head)->prev = (add); \ (add)->prev->next = (add); \ } else { \ (add)->prev = (add); \ (add)->next = (add); \ (head) = (add); \ } \ } while (0) #define CDL_PREPEND(head,add) \ CDL_PREPEND2(head,add,prev,next) #define CDL_PREPEND2(head,add,prev,next) \ do { \ if (head) { \ (add)->prev = (head)->prev; \ (add)->next = (head); \ (head)->prev = (add); \ (add)->prev->next = (add); \ } else { \ (add)->prev = (add); \ (add)->next = (add); \ } \ (head) = (add); \ } while (0) #define CDL_DELETE(head,del) \ CDL_DELETE2(head,del,prev,next) #define CDL_DELETE2(head,del,prev,next) \ do { \ if (((head)==(del)) && ((head)->next == (head))) { \ (head) = NULL; \ } else { \ (del)->next->prev = (del)->prev; \ (del)->prev->next = (del)->next; \ if ((del) == (head)) (head)=(del)->next; \ } \ } while (0) #define CDL_COUNT(head,el,counter) \ CDL_COUNT2(head,el,counter,next) \ #define CDL_COUNT2(head, el, counter,next) \ do { \ (counter) = 0; \ CDL_FOREACH2(head,el,next) { ++(counter); } \ } while (0) #define CDL_FOREACH(head,el) \ CDL_FOREACH2(head,el,next) #define CDL_FOREACH2(head,el,next) \ for ((el)=(head);el;(el)=(((el)->next==(head)) ? NULL : (el)->next)) #define CDL_FOREACH_SAFE(head,el,tmp1,tmp2) \ CDL_FOREACH_SAFE2(head,el,tmp1,tmp2,prev,next) #define CDL_FOREACH_SAFE2(head,el,tmp1,tmp2,prev,next) \ for ((el) = (head), (tmp1) = (head) ? (head)->prev : NULL; \ (el) && ((tmp2) = (el)->next, 1); \ (el) = ((el) == (tmp1) ? NULL : (tmp2))) #define CDL_SEARCH_SCALAR(head,out,field,val) \ CDL_SEARCH_SCALAR2(head,out,field,val,next) #define CDL_SEARCH_SCALAR2(head,out,field,val,next) \ do { \ CDL_FOREACH2(head,out,next) { \ if ((out)->field == (val)) break; \ } \ } while (0) #define CDL_SEARCH(head,out,elt,cmp) \ CDL_SEARCH2(head,out,elt,cmp,next) #define CDL_SEARCH2(head,out,elt,cmp,next) \ do { \ CDL_FOREACH2(head,out,next) { \ if ((cmp(out,elt))==0) break; \ } \ } while (0) #define CDL_REPLACE_ELEM2(head, el, add, prev, next) \ do { \ assert((head) != NULL); \ assert((el) != NULL); \ assert((add) != NULL); \ if ((el)->next == (el)) { \ (add)->next = (add); \ (add)->prev = (add); \ (head) = (add); \ } else { \ (add)->next = (el)->next; \ (add)->prev = (el)->prev; \ (add)->next->prev = (add); \ (add)->prev->next = (add); \ if ((head) == (el)) { \ (head) = (add); \ } \ } \ } while (0) #define CDL_REPLACE_ELEM(head, el, add) \ CDL_REPLACE_ELEM2(head, el, add, prev, next) #define CDL_PREPEND_ELEM2(head, el, add, prev, next) \ do { \ if (el) { \ assert((head) != NULL); \ assert((add) != NULL); \ (add)->next = (el); \ (add)->prev = (el)->prev; \ (el)->prev = (add); \ (add)->prev->next = (add); \ if ((head) == (el)) { \ (head) = (add); \ } \ } else { \ CDL_APPEND2(head, add, prev, next); \ } \ } while (0) #define CDL_PREPEND_ELEM(head, el, add) \ CDL_PREPEND_ELEM2(head, el, add, prev, next) #define CDL_APPEND_ELEM2(head, el, add, prev, next) \ do { \ if (el) { \ assert((head) != NULL); \ assert((add) != NULL); \ (add)->next = (el)->next; \ (add)->prev = (el); \ (el)->next = (add); \ (add)->next->prev = (add); \ } else { \ CDL_PREPEND2(head, add, prev, next); \ } \ } while (0) #define CDL_APPEND_ELEM(head, el, add) \ CDL_APPEND_ELEM2(head, el, add, prev, next) #endif /* UTLIST_H */ readpe-0.84/lib/libpe/libfuzzy/000077500000000000000000000000001455661113700164355ustar00rootroot00000000000000readpe-0.84/lib/libpe/libfuzzy/edit_dist.c000066400000000000000000000164671455661113700205670ustar00rootroot00000000000000/* This edit distance code is taken from trn3.6. A few minor modifications have been made by Andrew Tridgell for use in spamsum. */ /***************************************************************************/ /* The authors make no claims as to the fitness or correctness of this software * for any use whatsoever, and it is provided as is. Any use of this software * is at the user's own risk. */ #include #include /* edit_dist -- returns the minimum edit distance between two strings Program by: Mark Maimone CMU Computer Science 13 Nov 89 Last Modified: 28 Jan 90 If the input strings have length n and m, the algorithm runs in time O(nm) and space O(min(m,n)). HISTORY 13 Nov 89 (mwm) Created edit_dist() and set_costs(). 28 Jan 90 (mwm) Added view_costs(). Should verify that THRESHOLD computations will work even when THRESHOLD is not a multiple of sizeof(int). 17 May 93 (mwm) Improved performance when used with trn's newsgroup processing; assume all costs are 1, and you can terminate when a threshold is exceeded. */ #define MIN_DIST 100 #define TRN_SPEEDUP /* Use a less-general version of the routine, one that's better for trn. All change costs are 1, and it's okay to terminate if the edit distance is known to exceed MIN_DIST */ #define THRESHOLD 4000 /* worry about allocating more memory only when this # of bytes is exceeded */ #define STRLENTHRESHOLD ((int) ((THRESHOLD / sizeof (int) - 3) / 2)) #define SAFE_ASSIGN(x,y) (((x) != NULL) ? (*(x) = (y)) : (y)) #define swap_int(x,y) do { int _iswap = (x); (x) = (y); (y) = _iswap; } while (0) #define swap_char(x,y) do { const char *_cswap = (x); (x) = (y); (y) = _cswap; } while (0) static inline int min3(int x, int y, int z) { return x < y ? (x < z ? x : z) : (z < y) ? z : y; } static inline int min2(int x, int y) { return x < y ? x : y; } static int insert_cost = 1; static int delete_cost = 1; #ifndef TRN_SPEEDUP static int change_cost = 1; static int swap_cost = 1; #endif /* edit_distn -- returns the edit distance between two strings, or -1 on failure */ int edit_distn(const char *from, int from_len, const char *to, int to_len) { #ifndef TRN_SPEEDUP register int ins, del, ch; /* local copies of edit costs */ #endif register int row, col, index; /* dynamic programming counters */ register int radix; /* radix for modular indexing */ #ifdef TRN_SPEEDUP register int low; #endif int *buffer; /* pointer to storage for one row of the d.p. array */ int store[THRESHOLD / sizeof (int)]; /* a small amount of static storage, to be used when the input strings are small enough */ /* Handle trivial cases when one string is empty */ if (from == NULL || !from_len) if (to == NULL || !to_len) return 0; else return to_len * insert_cost; else if (to == NULL || !to_len) return from_len * delete_cost; /* Initialize registers */ radix = 2 * from_len + 3; #ifdef TRN_SPEEDUP #define ins 1 #define del 1 #define ch 3 #define swap_cost 5 #else ins = insert_cost; del = delete_cost; ch = change_cost; #endif /* Make from short enough to fit in the static storage, if it's at all possible */ if (from_len > to_len && from_len > STRLENTHRESHOLD) { swap_int(from_len, to_len); swap_char(from, to); #ifndef TRN_SPEEDUP swap_int(ins, del); #endif } /* if from_len > to_len */ /* Allocate the array storage (from the heap if necessary) */ if (from_len <= STRLENTHRESHOLD) buffer = store; else buffer = (int *) malloc(radix * sizeof (int)); /* Here's where the fun begins. We will find the minimum edit distance using dynamic programming. We only need to store two rows of the matrix at a time, since we always progress down the matrix. For example, given the strings "one" and "two", and insert, delete and change costs equal to 1: _ o n e _ 0 1 2 3 t 1 1 2 3 w 2 2 2 3 o 3 2 3 3 The dynamic programming recursion is defined as follows: ar(x,0) := x * insert_cost ar(0,y) := y * delete_cost ar(x,y) := min(a(x - 1, y - 1) + (from[x] == to[y] ? 0 : change), a(x - 1, y) + insert_cost, a(x, y - 1) + delete_cost, a(x - 2, y - 2) + (from[x] == to[y-1] && from[x-1] == to[y] ? swap_cost : infinity)) Since this only looks at most two rows and three columns back, we need only store the values for the two preceeding rows. In this implementation, we do not explicitly store the zero column, so only 2 * from_len + 2 words are needed. However, in the implementation of the swap_cost check, the current matrix value is used as a buffer; we can't overwrite the earlier value until the swap_cost check has been performed. So we use 2 * from_len + 3 elements in the buffer. */ #define ar(x,y,index) (((x) == 0) ? (y) * del : (((y) == 0) ? (x) * ins : \ buffer[mod(index)])) #define NW(x,y) ar(x, y, index + from_len + 2) #define N(x,y) ar(x, y, index + from_len + 3) #define W(x,y) ar(x, y, index + radix - 1) #define NNWW(x,y) ar(x, y, index + 1) #define mod(x) ((x) % radix) index = 0; #ifdef DEBUG_EDITDIST printf(" "); for (col = 0; col < from_len; col++) printf(" %c ", from[col]); printf("\n "); for (col = 0; col <= from_len; col++) printf("%2d ", col * del); #endif /* Row 0 is handled implicitly; its value at a given column is col*del. The loop below computes the values for Row 1. At this point we know the strings are nonempty. We also don't need to consider swap costs in row 1. COMMENT: the indicies row and col below point into the STRING, so the corresponding MATRIX indicies are row+1 and col+1. */ buffer[index++] = min2(ins + del, (from[0] == to[0] ? 0 : ch)); #ifdef TRN_SPEEDUP low = buffer[mod(index + radix - 1)]; #endif #ifdef DEBUG_EDITDIST printf("\n %c %2d %2d ", to[0], ins, buffer[index - 1]); #endif for (col = 1; col < from_len; col++) { buffer[index] = min3( col * del + ((from[col] == to[0]) ? 0 : ch), (col + 1) * del + ins, buffer[index - 1] + del); #ifdef TRN_SPEEDUP if (buffer[index] < low) low = buffer[index]; #endif index++; #ifdef DEBUG_EDITDIST printf("%2d ", buffer[index - 1]); #endif } /* for col = 1 */ #ifdef DEBUG_EDITDIST printf("\n %c %2d ", to[1], 2 * ins); #endif /* Now handle the rest of the matrix */ for (row = 1; row < to_len; row++) { for (col = 0; col < from_len; col++) { buffer[index] = min3( NW(row, col) + ((from[col] == to[row]) ? 0 : ch), N(row, col + 1) + ins, W(row + 1, col) + del); if (from[col] == to[row - 1] && col > 0 && from[col - 1] == to[row]) buffer[index] = min2(buffer[index], NNWW(row - 1, col - 1) + swap_cost); #ifdef DEBUG_EDITDIST printf("%2d ", buffer[index]); #endif #ifdef TRN_SPEEDUP if (buffer[index] < low || col == 0) low = buffer[index]; #endif index = mod(index + 1); } /* for col = 1 */ #ifdef DEBUG_EDITDIST if (row < to_len - 1) printf("\n %c %2d ", to[row+1], (row + 2) * ins); else printf("\n"); #endif #ifdef TRN_SPEEDUP if (low > MIN_DIST) break; #endif } /* for row = 1 */ row = buffer[mod(index + radix - 1)]; if (buffer != store) free((char *) buffer); return row; } /* edit_distn */ readpe-0.84/lib/libpe/libfuzzy/fuzzy.c000066400000000000000000000456161455661113700200040ustar00rootroot00000000000000/* ssdeep * Copyright (C) 2002 Andrew Tridgell * Copyright (C) 2006 ManTech International Corporation * Copyright (C) 2013 Helmut Grohne * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA * * Earlier versions of this code were named fuzzy.c and can be found at: * http://www.samba.org/ftp/unpacked/junkcode/spamsum/ * http://ssdeep.sf.net/ */ #include #include #include #include #include #include #include "fuzzy.h" #if defined(__GNUC__) && __GNUC__ >= 3 #define likely(x) __builtin_expect(!!(x), 1) #define unlikely(x) __builtin_expect(!!(x), 0) #else #define likely(x) x #define unlikely(x) x #endif #ifndef MIN #define MIN(a,b) ((a)<(b)?(a):(b)) #endif #ifndef MAX #define MAX(a,b) ((a)>(b)?(a):(b)) #endif #define ROLLING_WINDOW 7 #define MIN_BLOCKSIZE 3 #define HASH_PRIME 0x01000193 #define HASH_INIT 0x28021967 #define NUM_BLOCKHASHES 31 struct roll_state { unsigned char window[ROLLING_WINDOW]; uint32_t h1, h2, h3; uint32_t n; }; static void roll_init(/*@out@*/ struct roll_state *self) { memset(self, 0, sizeof(struct roll_state)); } /* * a rolling hash, based on the Adler checksum. By using a rolling hash * we can perform auto resynchronisation after inserts/deletes * internally, h1 is the sum of the bytes in the window and h2 * is the sum of the bytes times the index * h3 is a shift/xor based rolling hash, and is mostly needed to ensure that * we can cope with large blocksize values */ static void roll_hash(struct roll_state *self, unsigned char c) { self->h2 -= self->h1; self->h2 += ROLLING_WINDOW * (uint32_t)c; self->h1 += (uint32_t)c; self->h1 -= (uint32_t)self->window[self->n % ROLLING_WINDOW]; self->window[self->n % ROLLING_WINDOW] = c; self->n++; /* The original spamsum AND'ed this value with 0xFFFFFFFF which * in theory should have no effect. This AND has been removed * for performance (jk) */ self->h3 <<= 5; self->h3 ^= c; } static uint32_t roll_sum(const struct roll_state *self) { return self->h1 + self->h2 + self->h3; } /* A simple non-rolling hash, based on the FNV hash. */ static uint32_t sum_hash(unsigned char c, uint32_t h) { return (h * HASH_PRIME) ^ c; } /* A blockhash contains a signature state for a specific (implicit) blocksize. * The blocksize is given by SSDEEP_BS(index). The h and halfh members are the * FNV hashes, where halfh stops to be reset after digest is SPAMSUM_LENGTH/2 * long. The halfh hash is needed be able to truncate digest for the second * output hash to stay compatible with ssdeep output. */ struct blockhash_context { uint32_t h, halfh; char digest[SPAMSUM_LENGTH]; unsigned int dlen; }; struct fuzzy_state { unsigned int bhstart, bhend; struct blockhash_context bh[NUM_BLOCKHASHES]; size_t total_size; struct roll_state roll; }; #define SSDEEP_BS(index) (((uint32_t)MIN_BLOCKSIZE) << (index)) /*@only@*/ /*@null@*/ struct fuzzy_state *fuzzy_new(void) { struct fuzzy_state *self; if(NULL == (self = malloc(sizeof(struct fuzzy_state)))) /* malloc sets ENOMEM */ return NULL; self->bhstart = 0; self->bhend = 1; self->bh[0].h = HASH_INIT; self->bh[0].halfh = HASH_INIT; self->bh[0].dlen = 0; self->total_size = 0; roll_init(&self->roll); return self; } static void fuzzy_try_fork_blockhash(struct fuzzy_state *self) { struct blockhash_context *obh, *nbh; if (self->bhend >= NUM_BLOCKHASHES) return; assert(self->bhend > 0); obh = self->bh + (self->bhend - 1); nbh = obh + 1; nbh->h = obh->h; nbh->halfh = obh->halfh; nbh->dlen = 0; ++self->bhend; } static void fuzzy_try_reduce_blockhash(struct fuzzy_state *self) { assert(self->bhstart < self->bhend); if (self->bhend - self->bhstart < 2) /* Need at least two working hashes. */ return; if ((size_t)SSDEEP_BS(self->bhstart) * SPAMSUM_LENGTH >= self->total_size) /* Initial blocksize estimate would select this or a smaller * blocksize. */ return; if (self->bh[self->bhstart + 1].dlen < SPAMSUM_LENGTH / 2) /* Estimate adjustment would select this blocksize. */ return; /* At this point we are clearly no longer interested in the * start_blocksize. Get rid of it. */ ++self->bhstart; } static const char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; static void fuzzy_engine_step(struct fuzzy_state *self, unsigned char c) { size_t h; unsigned int i; /* At each character we update the rolling hash and the normal hashes. * When the rolling hash hits a reset value then we emit a normal hash * as a element of the signature and reset the normal hash. */ roll_hash(&self->roll, c); h = roll_sum(&self->roll); for (i = self->bhstart; i < self->bhend; ++i) { self->bh[i].h = sum_hash(c, self->bh[i].h); self->bh[i].halfh = sum_hash(c, self->bh[i].halfh); } for (i = self->bhstart; i < self->bhend; ++i) { /* With growing blocksize almost no runs fail the next test. */ if (likely(h % SSDEEP_BS(i) != SSDEEP_BS(i) - 1)) /* Once this condition is false for one bs, it is * automatically false for all further bs. I.e. if * h === -1 (mod 2*bs) then h === -1 (mod bs). */ break; /* We have hit a reset point. We now emit hashes which are * based on all characters in the piece of the message between * the last reset point and this one */ if (unlikely(0 == self->bh[i].dlen)) { /* Can only happen 30 times. */ /* First step for this blocksize. Clone next. */ fuzzy_try_fork_blockhash(self); } if (self->bh[i].dlen < SPAMSUM_LENGTH - 1) { /* We can have a problem with the tail overflowing. The * easiest way to cope with this is to only reset the * normal hash if we have room for more characters in * our signature. This has the effect of combining the * last few pieces of the message into a single piece * */ self->bh[i].digest[self->bh[i].dlen++] = b64[self->bh[i].h % 64]; self->bh[i].h = HASH_INIT; if (self->bh[i].dlen < SPAMSUM_LENGTH / 2) self->bh[i].halfh = HASH_INIT; } else fuzzy_try_reduce_blockhash(self); } } int fuzzy_update(struct fuzzy_state *self, const unsigned char *buffer, size_t buffer_size) { self->total_size += buffer_size; for ( ;buffer_size > 0; ++buffer, --buffer_size) fuzzy_engine_step(self, *buffer); return 0; } static int memcpy_eliminate_sequences(char *dst, const char *src, int n) { const char *srcend = src + n; assert(n >= 0); if (src < srcend) *dst++ = *src++; if (src < srcend) *dst++ = *src++; if (src < srcend) *dst++ = *src++; while (src < srcend) if (*src == dst[-1] && *src == dst[-2] && *src == dst[-3]) { ++src; --n; } else *dst++ = *src++; return n; } #ifdef S_SPLINT_S extern const int EOVERFLOW; #endif // We need some extra help on Win32 #ifdef _WIN32 # define EOVERFLOW 84 # define ftello ftell # define fseeko fseek #endif int fuzzy_digest(const struct fuzzy_state *self, /*@out@*/ char *result, unsigned int flags) { unsigned int bi = self->bhstart; uint32_t h = roll_sum(&self->roll); int i, remain = FUZZY_MAX_RESULT - 1; /* Exclude terminating '\0'. */ /* Verify that our elimination was not overeager. */ assert(bi == 0 || (size_t)SSDEEP_BS(bi) / 2 * SPAMSUM_LENGTH < self->total_size); /* Initial blocksize guess. */ while ((size_t)SSDEEP_BS(bi) * SPAMSUM_LENGTH < self->total_size) { ++bi; if (bi >= NUM_BLOCKHASHES) { /* The input exceeds data types. */ errno = EOVERFLOW; return -1; } } /* Adapt blocksize guess to actual digest length. */ while (bi >= self->bhend) --bi; while (bi > self->bhstart && self->bh[bi].dlen < SPAMSUM_LENGTH / 2) --bi; assert (!(bi > 0 && self->bh[bi].dlen < SPAMSUM_LENGTH / 2)); i = snprintf(result, (size_t)remain, "%u:", SSDEEP_BS(bi)); if (i <= 0) /* Maybe snprintf has set errno here? */ return -1; assert(i < remain); remain -= i; result += i; i = (int)self->bh[bi].dlen; assert(i <= remain); if ((flags & FUZZY_FLAG_ELIMSEQ) != 0) i = memcpy_eliminate_sequences(result, self->bh[bi].digest, i); else memcpy(result, self->bh[bi].digest, (size_t)i); result += i; remain -= i; if (h != 0) { assert(remain > 0); *result = b64[self->bh[bi].h % 64]; if((flags & FUZZY_FLAG_ELIMSEQ) == 0 || i < 3 || *result != result[-1] || *result != result[-2] || *result != result[-3]) { ++result; --remain; } } assert(remain > 0); *result++ = ':'; --remain; if (bi < self->bhend - 1) { ++bi; i = (int)self->bh[bi].dlen; if ((flags & FUZZY_FLAG_NOTRUNC) == 0 && i > SPAMSUM_LENGTH / 2 - 1) i = SPAMSUM_LENGTH / 2 - 1; assert(i <= remain); if ((flags & FUZZY_FLAG_ELIMSEQ) != 0) i = memcpy_eliminate_sequences(result, self->bh[bi].digest, i); else memcpy(result, self->bh[bi].digest, (size_t)i); result += i; remain -= i; if (h != 0) { assert(remain > 0); h = (flags & FUZZY_FLAG_NOTRUNC) != 0 ? self->bh[bi].h : self->bh[bi].halfh; *result = b64[h % 64]; if ((flags & FUZZY_FLAG_ELIMSEQ) == 0 || i < 3 || *result != result[-1] || *result != result[-2] || *result != result[-3]) { ++result; --remain; } } } else if (h != 0) { assert(self->bh[bi].dlen == 0); assert(remain > 0); *result++ = b64[self->bh[bi].h % 64]; /* No need to bother with FUZZY_FLAG_ELIMSEQ, because this * digest has length 1. */ --remain; } *result = '\0'; return 0; } void fuzzy_free(/*@only@*/ struct fuzzy_state *self) { free(self); } int fuzzy_hash_buf(const unsigned char *buf, uint32_t buf_len, /*@out@*/ char *result) { struct fuzzy_state *ctx; int ret = -1; if (NULL == (ctx = fuzzy_new())) return -1; if (fuzzy_update(ctx, buf, buf_len) < 0) goto out; if (fuzzy_digest(ctx, result, 0) < 0) goto out; ret = 0; out: fuzzy_free(ctx); return ret; } int fuzzy_hash_stream(FILE *handle, /*@out@*/ char *result) { struct fuzzy_state *ctx; unsigned char buffer[4096]; size_t n; int ret = -1; if (NULL == (ctx = fuzzy_new())) return -1; for(;;) { n = fread(buffer, 1, 4096, handle); if (0 == n) break; if (fuzzy_update(ctx, buffer, n) < 0) goto out; } if (ferror(handle) != 0) goto out; if (fuzzy_digest(ctx, result, 0) < 0) goto out; ret = 0; out: fuzzy_free(ctx); return ret; } #ifdef S_SPLINT_S typedef size_t off_t; int fseeko(FILE *, off_t, int); off_t ftello(FILE *); #endif int fuzzy_hash_file(FILE *handle, /*@out@*/ char *result) { off_t fpos; int status; fpos = ftello(handle); if (fseek(handle, 0, SEEK_SET) < 0) return -1; status = fuzzy_hash_stream(handle, result); if (status == 0) { if (fseeko(handle, fpos, SEEK_SET) < 0) return -1; } return status; } int fuzzy_hash_filename(const char *filename, /*@out@*/ char *result) { int status; FILE *handle = fopen(filename, "rb"); if (NULL == handle) return -1; status = fuzzy_hash_stream(handle, result); /* We cannot do anything about an fclose failure. */ (void)fclose(handle); return status; } // // We only accept a match if we have at least one common substring in // the signature of length ROLLING_WINDOW. This dramatically drops the // false positive rate for low score thresholds while having // negligable affect on the rate of spam detection. // // return 1 if the two strings do have a common substring, 0 otherwise // static int has_common_substring(const char *s1, const char *s2) { int i, j; int num_hashes; uint32_t hashes[SPAMSUM_LENGTH]; // there are many possible algorithms for common substring // detection. In this case I am re-using the rolling hash code // to act as a filter for possible substring matches memset(hashes, 0, sizeof(hashes)); // first compute the windowed rolling hash at each offset in // the first string struct roll_state state; roll_init (&state); for (i=0;s1[i];i++) { roll_hash(&state, (unsigned char)s1[i]); hashes[i] = roll_sum(&state); } num_hashes = i; roll_init(&state); // now for each offset in the second string compute the // rolling hash and compare it to all of the rolling hashes // for the first string. If one matches then we have a // candidate substring match. We then confirm that match with // a direct string comparison */ for (i=0;s2[i];i++) { roll_hash(&state, (unsigned char)s2[i]); uint32_t h = roll_sum(&state); if (i < ROLLING_WINDOW-1) continue; for (j=ROLLING_WINDOW-1;j= ROLLING_WINDOW && strncmp(s2+i-(ROLLING_WINDOW-1), s1+j-(ROLLING_WINDOW-1), ROLLING_WINDOW) == 0) { return 1; } } } } return 0; } // eliminate sequences of longer than 3 identical characters. These // sequences contain very little information so they tend to just bias // the result unfairly static char *eliminate_sequences(const char *str) { char *ret; size_t i, j, len; ret = strdup(str); if (!ret) return NULL; len = strlen(str); if (len < 3) return ret; for (i=j=3 ; i SPAMSUM_LENGTH || len2 > SPAMSUM_LENGTH) { // not a real spamsum signature? return 0; } // the two strings must have a common substring of length // ROLLING_WINDOW to be candidates if (has_common_substring(s1, s2) == 0) { return 0; } // compute the edit distance between the two strings. The edit distance gives // us a pretty good idea of how closely related the two strings are score = edit_distn(s1, len1, s2, len2); // scale the edit distance by the lengths of the two // strings. This changes the score to be a measure of the // proportion of the message that has changed rather than an // absolute quantity. It also copes with the variability of // the string lengths. score = (score * SPAMSUM_LENGTH) / (len1 + len2); // at this stage the score occurs roughly on a 0-64 scale, // with 0 being a good match and 64 being a complete // mismatch // rescale to a 0-100 scale (friendlier to humans) score = (100 * score) / 64; // it is possible to get a score above 100 here, but it is a // really terrible match if (score >= 100) return 0; // now re-scale on a 0-100 scale with 0 being a poor match and // 100 being a excellent match. score = 100 - score; // printf ("len1: %"PRIu32" len2: %"PRIu32"\n", len1, len2); // when the blocksize is small we don't want to exaggerate the match size if (score > block_size/MIN_BLOCKSIZE * MIN(len1, len2)) { score = block_size/MIN_BLOCKSIZE * MIN(len1, len2); } return score; } // // Given two spamsum strings return a value indicating the degree // to which they match. // int fuzzy_compare(const char *str1, const char *str2) { unsigned int block_size1, block_size2; uint32_t score = 0; char *s1, *s2; char *s1_1, *s1_2, *s1_3; char *s2_1, *s2_2, *s2_3; if (NULL == str1 || NULL == str2) return -1; // each spamsum is prefixed by its block size if (sscanf(str1, "%u:", &block_size1) != 1 || sscanf(str2, "%u:", &block_size2) != 1) { return -1; } // if the blocksizes don't match then we are comparing // apples to oranges. This isn't an 'error' per se. We could // have two valid signatures, but they can't be compared. if (block_size1 != block_size2 && block_size1 != block_size2*2 && block_size2 != block_size1*2) { return 0; } // move past the prefix str1 = strchr(str1, ':'); str2 = strchr(str2, ':'); if (!str1 || !str2) { // badly formed ... return -1; } // there is very little information content is sequences of // the same character like 'LLLLL'. Eliminate any sequences // longer than 3. This is especially important when combined // with the has_common_substring() test below. // NOTE: This function duplciates str1 and str2 s1 = eliminate_sequences(str1+1); if (!s1) return 0; s2 = eliminate_sequences(str2+1); if (!s2) { free(s1); return 0; } // now break them into the two pieces s1_1 = s1; s2_1 = s2; s1_2 = strchr(s1, ':'); s2_2 = strchr(s2, ':'); if (!s1_2 || !s2_2) { // a signature is malformed - it doesn't have 2 parts free(s1); free(s2); return -1; } // Chop the first substring. We terminate the first substring // and then advance the pointer to the start of the second substring. *s1_2 = 0; s1_2++; *s2_2 = 0; s2_2++; // Chop the second string at the comma--just before the filename. // If the strings don't have a comma (i.e. don't have a filename) // that's ok. It's not an error. This function can be called on // signatures which don't have filenames attached. // We also don't have to advance past the comma however. We don't care // about the filename s1_3 = strchr(s1_2, ','); s2_3 = strchr(s2_2, ','); if (s1_3 != NULL) *s1_3 = 0; if (s2_3 != NULL) *s2_3 = 0; // each signature has a string for two block sizes. We now // choose how to combine the two block sizes. We checked above // that they have at least one block size in common if (block_size1 == block_size2) { uint32_t score1, score2; score1 = score_strings(s1_1, s2_1, block_size1); score2 = score_strings(s1_2, s2_2, block_size1*2); score = MAX(score1, score2); } else if (block_size1 == block_size2*2) { score = score_strings(s1_1, s2_2, block_size1); } else { score = score_strings(s1_2, s2_1, block_size2); } free(s1); free(s2); return (int)score; } readpe-0.84/lib/libpe/libfuzzy/fuzzy.h000066400000000000000000000157221455661113700200040ustar00rootroot00000000000000/* * Copyright (C) ManTech International Corporation 2010 * Copyright (C) Kyrus 2012 * Copyright (C) 2013 Helmut Grohne * * $Id: fuzzy.h 180 2013-06-10 23:24:26Z jessekornblum $ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA * * Earlier versions of this code can be found at: * http://ssdeep.sf.net/ */ /// \mainpage /// This is the documentation for the fuzzy hashing API from ssdeep. /// /// There is a complete function reference in fuzzy.h. /// /// The most recent version of this documentation can be found /// at http://ssdeep.sourceforge.net/. /// /// \copydoc fuzzy.h /// /// \version 3.0 /// /// \author Jesse Kornblum, research@jessekornblum.com /// \author Helmut Grohne, helmut@subdivi.de /// \file fuzzy.h /// \brief /// These functions allow a programmer to compute the fuzzy hashes /// (also called the context-triggered piecewise hashes) of /// \link fuzzy_hash_buf() a buffer /// of text @endlink, /// \link fuzzy_hash_filename() the contents of a file on the disk @endlink, /// and /// @link fuzzy_hash_file() the contents of /// an open file handle @endlink . /// There is also a function to /// @link fuzzy_compare() compute the /// similarity between any two fuzzy signatures @endlink. #include #include #ifdef __cplusplus extern "C" { #endif #ifndef FUZZY_H #define FUZZY_H /** * @brief fuzzy_digest flag indicating to eliminate sequences of more than * three identical characters */ #define FUZZY_FLAG_ELIMSEQ 0x1u /** * @brief fuzzy_digest flag indicating not to truncate the second part to * SPAMSUM_LENGTH/2 characters. */ #define FUZZY_FLAG_NOTRUNC 0x2u struct fuzzy_state; /** * @brief Construct a fuzzy_state object and return it. * * To use it call fuzzy_update and fuzzy_digest on it. It must be disposed * with fuzzy_free. * @return the constructed fuzzy_state or NULL on failure */ extern /*@only@*/ /*@null@*/ struct fuzzy_state *fuzzy_new(void); /** * @brief Feed the data contained in the given buffer to the state. * * When an error occurs, the state is undefined. In that case it must not be * passed to any function besides fuzzy_free. * @param buffer The data to be hashes * @param buffer_size The length of the given buffer * @return zero on success, non-zero on error */ extern int fuzzy_update(struct fuzzy_state *state, const unsigned char *buffer, size_t buffer_size); /** * @brief Obtain the fuzzy hash from the state. * * This operation does not change the state at all. It reports the hash for the * concatenation of the data previously fed using fuzzy_update. * @param result Where the fuzzy hash is stored. This variable * must be allocated to hold at least FUZZY_MAX_RESULT bytes. * @param flags is a bitwise or of FUZZY_FLAG_* macros. The absence of flags is * represented by a zero. * @return zero on success, non-zero on error */ extern int fuzzy_digest(const struct fuzzy_state *state, /*@out@*/ char *result, unsigned int flags); /** * @brief Dispose a fuzzy state. */ extern void fuzzy_free(/*@only@*/ struct fuzzy_state *state); /** * @brief Compute the fuzzy hash of a buffer * * The computes the fuzzy hash of the first buf_len bytes of the buffer. * It is the caller's responsibility to append the filename, * if any, to result after computation. * @param buf The data to be fuzzy hashed * @param buf_len The length of the data being hashed * @param result Where the fuzzy hash of buf is stored. This variable * must be allocated to hold at least FUZZY_MAX_RESULT bytes. * @return Returns zero on success, non-zero on error. */ extern int fuzzy_hash_buf(const unsigned char *buf, uint32_t buf_len, /*@out@*/ char *result); /** * @brief Compute the fuzzy hash of a file using an open handle * * Computes the fuzzy hash of the contents of the open file, starting * at the beginning of the file. When finished, the file pointer is * returned to its original position. If an error occurs, the file * pointer's value is undefined. * It is the callers's responsibility to append the filename * to the result after computation. * @param handle Open handle to the file to be hashed * @param result Where the fuzzy hash of the file is stored. This * variable must be allocated to hold at least FUZZY_MAX_RESULT bytes. * @return Returns zero on success, non-zero on error */ extern int fuzzy_hash_file(FILE *handle, /*@out@*/ char *result); /** * @brief Compute the fuzzy hash of a stream using an open handle * * Computes the fuzzy hash of the contents of the open stream, starting at the * current file position until reaching EOF. Unlike fuzzy_hash_file the stream * is never seeked. If an error occurs, the result as well as the file position * are undefined. * It is the callers's responsibility to append the filename * to the result after computation. * @param handle Open handle to the stream to be hashed * @param result Where the fuzzy hash of the file is stored. This * variable must be allocated to hold at least FUZZY_MAX_RESULT bytes. * @return Returns zero on success, non-zero on error */ extern int fuzzy_hash_stream(FILE *handle, /*@out@*/ char *result); /** * @brief Compute the fuzzy hash of a file * * Opens, reads, and hashes the contents of the file 'filename' * The result must be allocated to hold FUZZY_MAX_RESULT characters. * It is the caller's responsibility to append the filename * to the result after computation. * @param filename The file to be hashed * @param result Where the fuzzy hash of the file is stored. This * variable must be allocated to hold at least FUZZY_MAX_RESULT bytes. * @return Returns zero on success, non-zero on error. */ extern int fuzzy_hash_filename(const char *filename, /*@out@*/ char * result); /// Computes the match score between two fuzzy hash signatures. /// @return Returns a value from zero to 100 indicating the /// match score of the /// two signatures. A match score of zero indicates the sigantures /// did not match. When an error occurs, such as if one of the /// inputs is NULL, returns -1. extern int fuzzy_compare(const char *sig1, const char *sig2); /** Length of an individual fuzzy hash signature component. */ #define SPAMSUM_LENGTH 64 /** The longest possible length for a fuzzy hash signature * (without the filename) */ #define FUZZY_MAX_RESULT (2 * SPAMSUM_LENGTH + 20) #ifdef __cplusplus } #endif #endif readpe-0.84/lib/libpe/misc.c000066400000000000000000000166121455661113700156640ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ // for memmem() to work. #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include "libpe/pe.h" #include #include #include #include static double calculate_entropy(const unsigned int counted_bytes[256], const size_t total_length) { double entropy = 0.; for (size_t i = 0; i < 256; i++) { double temp = (double)counted_bytes[i] / total_length; if (temp > 0.) entropy += temp * fabs( log2(temp) ); } return entropy; } double pe_calculate_entropy_file(pe_ctx_t *ctx) { unsigned int counted_bytes[256] = { 0 }; const uint8_t *file_bytes = LIBPE_PTR_ADD(ctx->map_addr, 0); const uint64_t filesize = pe_filesize(ctx); for (uint64_t ofs=0; ofs < filesize; ofs++) { const uint8_t byte = file_bytes[ofs]; counted_bytes[byte]++; } return calculate_entropy(counted_bytes, (size_t)filesize); } bool pe_fpu_trick(pe_ctx_t *ctx) { // NOTE: What 0xdf has to do with fpu? return !! memmem( ctx->map_addr, ctx->map_size, "\xdf\xdf\xdf\xdf", 4 ); // const char *opcode_ptr = ctx->map_addr; // // for (uint32_t i=0, times=0; i < ctx->map_size; i++) { // if (*opcode_ptr++ == '\xdf') { // if (++times == 4) // return true; // } else { // times = 0; // } // } // // return false; } int cpl_analysis(pe_ctx_t *ctx) { const IMAGE_COFF_HEADER *hdr_coff_ptr = pe_coff(ctx); const IMAGE_DOS_HEADER *hdr_dos_ptr = pe_dos(ctx); if (hdr_coff_ptr == NULL || hdr_dos_ptr == NULL) return 0; static const uint16_t characteristics1 = ( IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_LOCAL_SYMS_STRIPPED | IMAGE_FILE_BYTES_REVERSED_LO | IMAGE_FILE_32BIT_MACHINE | IMAGE_FILE_DLL | IMAGE_FILE_BYTES_REVERSED_HI); static const uint16_t characteristics2 = ( IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_LOCAL_SYMS_STRIPPED | IMAGE_FILE_BYTES_REVERSED_LO | IMAGE_FILE_32BIT_MACHINE | IMAGE_FILE_DEBUG_STRIPPED | IMAGE_FILE_DLL | IMAGE_FILE_BYTES_REVERSED_HI); static const uint16_t characteristics3 = ( IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_32BIT_MACHINE | IMAGE_FILE_DEBUG_STRIPPED | IMAGE_FILE_DLL); // FIXME: Which timestamps are those? // UNIX timestams: // 708992537 = 19/jun/1992 @ 19:22:17 // 1354555867 = 3/dez/2012 @ 15:31:07 // // Findings: // * 708992537 is the timestamp from an old delphi compiler bug // * 1354555867 was probably just the current time if ((hdr_coff_ptr->TimeDateStamp == 708992537 || hdr_coff_ptr->TimeDateStamp > 1354555867) && (hdr_coff_ptr->Characteristics == characteristics1 || // equals 0xa18e hdr_coff_ptr->Characteristics == characteristics2 || // equals 0xa38e hdr_coff_ptr->Characteristics == characteristics3) // equals 0x2306 && hdr_dos_ptr->e_sp == 0xb8 // ??? ) return 1; return 0; } int pe_get_cpl_analysis(pe_ctx_t *ctx) { return pe_is_dll(ctx) ? cpl_analysis(ctx) : -1; } const IMAGE_SECTION_HEADER *pe_check_fake_entrypoint(pe_ctx_t *ctx, uint32_t ep) { const uint16_t num_sections = pe_sections_count(ctx); if (num_sections == 0) return NULL; const IMAGE_SECTION_HEADER *section = pe_rva2section(ctx, ep); if (section == NULL) return NULL; if (section->Characteristics & IMAGE_SCN_CNT_CODE) return NULL; return section; } int pe_has_fake_entrypoint(pe_ctx_t *ctx) { const IMAGE_OPTIONAL_HEADER *optional = pe_optional(ctx); if (optional == NULL) return -1; // Unable to read optional header. const uint32_t ep = optional->_32 ? optional->_32->AddressOfEntryPoint : optional->_64 ? optional->_64->AddressOfEntryPoint : optional->_rom ? optional->_rom->AddressOfEntryPoint : 0; int value; if (ep == 0) { value = -2; // null } else if (pe_check_fake_entrypoint(ctx, ep)) { value = 1; // fake } else { value = 0; // normal } return value; } uint32_t pe_get_tls_directory(pe_ctx_t *ctx) { if (ctx->pe.num_directories == 0 || ctx->pe.num_directories > MAX_DIRECTORIES) return 0; const IMAGE_DATA_DIRECTORY *directory = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_TLS); if (directory == NULL) return 0; if (directory->Size == 0) return 0; return directory->VirtualAddress; } static int count_tls_callbacks(pe_ctx_t *ctx) { int ret = 0; const IMAGE_OPTIONAL_HEADER *optional_hdr = pe_optional(ctx); if (optional_hdr == NULL) return 0; IMAGE_SECTION_HEADER ** const sections = pe_sections(ctx); if (sections == NULL) return 0; const uint64_t tls_addr = pe_get_tls_directory(ctx); if (tls_addr == 0) return 0; const uint16_t num_sections = pe_sections_count(ctx); uint64_t ofs = 0; // search for tls in all sections for (uint16_t i=0, j=0; i < num_sections; i++) { const bool can_process = tls_addr >= sections[i]->VirtualAddress && tls_addr < (sections[i]->VirtualAddress + sections[i]->SizeOfRawData); if (!can_process) continue; ofs = tls_addr - sections[i]->VirtualAddress + sections[i]->PointerToRawData; switch (optional_hdr->type) { default: return 0; case MAGIC_PE32: { const IMAGE_TLS_DIRECTORY32 *tls_dir = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, tls_dir, sizeof(IMAGE_TLS_DIRECTORY32))) { // TODO: Should we report something? return 0; } if (!(tls_dir->AddressOfCallBacks & optional_hdr->_32->ImageBase)) break; ofs = pe_rva2ofs(ctx, tls_dir->AddressOfCallBacks - optional_hdr->_32->ImageBase); break; } case MAGIC_PE64: { const IMAGE_TLS_DIRECTORY64 *tls_dir = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, tls_dir, sizeof(IMAGE_TLS_DIRECTORY64))) { // TODO: Should we report something? return 0; } if (!(tls_dir->AddressOfCallBacks & optional_hdr->_64->ImageBase)) break; ofs = pe_rva2ofs(ctx, tls_dir->AddressOfCallBacks - optional_hdr->_64->ImageBase); break; } } ret = -1; // tls directory and section exists uint32_t funcaddr = 0; // FIXME: Why this loop if 'funcaddr' isn't updated? do { const uint32_t *funcaddr_ptr = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, funcaddr_ptr, sizeof(*funcaddr_ptr))) { // TODO: Should we report something? return 0; } // FIXME: This funcaddr is declared in block scope! uint32_t funcaddr = *funcaddr_ptr; if (funcaddr) { ret = ++j; // function found } } while (funcaddr); } return ret; } int pe_get_tls_callback(pe_ctx_t *ctx) { const int callbacks = count_tls_callbacks(ctx); int ret = 0; if (callbacks == 0) ret = LIBPE_E_NO_CALLBACKS_FOUND; // not found else if (callbacks == -1) // FIXME: Is this correct? ret = LIBPE_E_NO_FUNCTIONS_FOUND; // found no functions else if (callbacks > 0) ret = callbacks; return ret; } readpe-0.84/lib/libpe/pe.c000066400000000000000000000653451455661113700153440ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/pe.h" #include #include #include #include #include #include #include #include #include #include #include #include bool pe_can_read(const pe_ctx_t *ctx, const void *ptr, size_t size) { const uintptr_t start = (uintptr_t)ptr; const uintptr_t end = start + size; return start >= (uintptr_t)ctx->map_addr && end <= (uintptr_t)ctx->map_end; } pe_err_e pe_load_file(pe_ctx_t *ctx, const char *path) { return pe_load_file_ext(ctx, path, 0); } pe_err_e pe_load_file_ext(pe_ctx_t *ctx, const char *path, pe_options_e options) { // Cleanup the whole struct. memset(ctx, 0, sizeof(pe_ctx_t)); ctx->path = strdup(path); if (ctx->path == NULL) { //perror("strdup"); return LIBPE_E_ALLOCATION_FAILURE; } // Open the file. int oflag = options & LIBPE_OPT_OPEN_RW ? O_RDWR : O_RDONLY; const int fd = open(ctx->path, oflag); if (fd == -1) { //perror("open"); return LIBPE_E_OPEN_FAILED; } int ret = 0; // Stat the fd to retrieve the file informations. // If file is a symlink, fstat will stat the pointed file, not the link. struct stat stat; ret = fstat(fd, &stat); if (ret == -1) { close(fd); //perror("fstat"); return LIBPE_E_FSTAT_FAILED; } // Check if we're dealing with a regular file. if (!S_ISREG(stat.st_mode)) { close(fd); //fprintf(stderr, "%s is not a file\n", ctx->path); return LIBPE_E_NOT_A_FILE; } // Grab the file size. ctx->map_size = stat.st_size; // Create the virtual memory mapping. int mprot = options & LIBPE_OPT_OPEN_RW ? PROT_READ|PROT_WRITE /* Pages may be written */ : PROT_READ; // MAP_SHARED makes updates to the mapping visible to other processes that map this file. // The file may not actually be updated until msync(2) or munmap() is called. int mflags = options & LIBPE_OPT_OPEN_RW ? MAP_SHARED : MAP_PRIVATE; ctx->map_addr = mmap(NULL, ctx->map_size, mprot, mflags, fd, 0); if (ctx->map_addr == MAP_FAILED) { close(fd); //perror("mmap"); return LIBPE_E_MMAP_FAILED; } ctx->map_end = (uintptr_t)LIBPE_PTR_ADD(ctx->map_addr, ctx->map_size); if (options & LIBPE_OPT_NOCLOSE_FD) { // The file descriptor is not dup'ed, and will be closed when the stream created by fdopen() is closed. FILE *fp = fdopen(fd, options & LIBPE_OPT_OPEN_RW ? "r+b" : "rb"); // NOTE: 'b' is ignored on all POSIX conforming systems. if (fp == NULL) { //perror("fdopen"); return LIBPE_E_FDOPEN_FAILED; } ctx->stream = fp; } else { // We can now close the fd. ret = close(fd); if (ret == -1) { //perror("close"); return LIBPE_E_CLOSE_FAILED; } } // Give advice about how we'll use our memory mapping. ret = madvise(ctx->map_addr, ctx->map_size, MADV_SEQUENTIAL); if (ret < 0) { //perror("madvise"); // NOTE: This is a recoverable error. Do not abort. } OpenSSL_add_all_digests(); return LIBPE_E_OK; } static void cleanup_cached_data(pe_ctx_t *ctx) { pe_imports_dealloc(ctx->cached_data.imports); pe_exports_dealloc(ctx->cached_data.exports); pe_hash_headers_dealloc(ctx->cached_data.hash_headers); pe_hash_sections_dealloc(ctx->cached_data.hash_sections); pe_hash_dealloc(ctx->cached_data.hash_file); pe_resources_dealloc(ctx->cached_data.resources); memset(&ctx->cached_data, 0, sizeof(pe_cached_data_t)); } pe_err_e pe_unload(pe_ctx_t *ctx) { if (ctx->stream != NULL) { fclose(ctx->stream); } free(ctx->path); // Dealloc internal pointers. free(ctx->pe.directories); free(ctx->pe.sections); cleanup_cached_data(ctx); // Dealloc the virtual mapping. if (ctx->map_addr != NULL) { int ret = munmap(ctx->map_addr, ctx->map_size); if (ret != 0) { //perror("munmap"); return LIBPE_E_MUNMAP_FAILED; } } CRYPTO_cleanup_all_ex_data(); EVP_cleanup(); // Clean OpenSSL_add_all_digests. // Cleanup the whole struct. memset(ctx, 0, sizeof(pe_ctx_t)); return LIBPE_E_OK; } pe_err_e pe_parse(pe_ctx_t *ctx) { ctx->pe.dos_hdr = ctx->map_addr; if (ctx->pe.dos_hdr->e_magic == MAGIC_MZ) { const uint32_t *signature_ptr = LIBPE_PTR_ADD(ctx->pe.dos_hdr, ctx->pe.dos_hdr->e_lfanew); if (!pe_can_read(ctx, signature_ptr, LIBPE_SIZEOF_MEMBER(pe_file_t, signature))) return LIBPE_E_INVALID_LFANEW; // NT signature (PE\0\0) ctx->pe.signature = *signature_ptr; switch (ctx->pe.signature) { default: //fprintf(stderr, "Invalid signature: %x\n", ctx->pe.signature); return LIBPE_E_INVALID_SIGNATURE; case SIGNATURE_PE: break; } ctx->pe.coff_hdr = LIBPE_PTR_ADD(signature_ptr, LIBPE_SIZEOF_MEMBER(pe_file_t, signature)); } else if (pe_machine_type_name(ctx->pe.dos_hdr->e_magic) != NULL) { ctx->pe.coff_hdr = (void *)ctx->pe.dos_hdr; ctx->pe.dos_hdr = NULL; } else { return LIBPE_E_NOT_A_PE_FILE; } if (!pe_can_read(ctx, ctx->pe.coff_hdr, sizeof(IMAGE_COFF_HEADER))) return LIBPE_E_MISSING_COFF_HEADER; ctx->pe.num_sections = ctx->pe.coff_hdr->NumberOfSections; if (ctx->pe.coff_hdr->SizeOfOptionalHeader > 0) { // Optional header points right after the COFF header. ctx->pe.optional_hdr_ptr = LIBPE_PTR_ADD(ctx->pe.coff_hdr, sizeof(IMAGE_COFF_HEADER)); // Figure out whether it's a PE32 or PE32+. uint16_t *opt_type_ptr = ctx->pe.optional_hdr_ptr; if (!pe_can_read(ctx, opt_type_ptr, LIBPE_SIZEOF_MEMBER(IMAGE_OPTIONAL_HEADER, type))) return LIBPE_E_MISSING_OPTIONAL_HEADER; ctx->pe.optional_hdr.type = *opt_type_ptr; switch (ctx->pe.optional_hdr.type) { default: return LIBPE_E_UNSUPPORTED_IMAGE; case MAGIC_ROM: if (ctx->pe.coff_hdr->SizeOfOptionalHeader != sizeof(IMAGE_ROM_OPTIONAL_HEADER)) return LIBPE_E_UNSUPPORTED_IMAGE; if (!pe_can_read(ctx, ctx->pe.optional_hdr_ptr, sizeof(IMAGE_ROM_OPTIONAL_HEADER))) return LIBPE_E_MISSING_OPTIONAL_HEADER; ctx->pe.optional_hdr._rom = ctx->pe.optional_hdr_ptr; ctx->pe.optional_hdr.length = sizeof(IMAGE_ROM_OPTIONAL_HEADER); ctx->pe.entrypoint = ctx->pe.optional_hdr._rom->AddressOfEntryPoint; break; case MAGIC_PE32: if (ctx->pe.coff_hdr->SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER_32)) return LIBPE_E_UNSUPPORTED_IMAGE; if (!pe_can_read(ctx, ctx->pe.optional_hdr_ptr, sizeof(IMAGE_OPTIONAL_HEADER_32))) return LIBPE_E_MISSING_OPTIONAL_HEADER; ctx->pe.optional_hdr._32 = ctx->pe.optional_hdr_ptr; ctx->pe.optional_hdr.length = sizeof(IMAGE_OPTIONAL_HEADER_32); ctx->pe.num_directories = ctx->pe.optional_hdr._32->NumberOfRvaAndSizes; ctx->pe.entrypoint = ctx->pe.optional_hdr._32->AddressOfEntryPoint; ctx->pe.imagebase = ctx->pe.optional_hdr._32->ImageBase; break; case MAGIC_PE64: if (ctx->pe.coff_hdr->SizeOfOptionalHeader < sizeof(IMAGE_OPTIONAL_HEADER_64)) return LIBPE_E_UNSUPPORTED_IMAGE; if (!pe_can_read(ctx, ctx->pe.optional_hdr_ptr, sizeof(IMAGE_OPTIONAL_HEADER_64))) return LIBPE_E_MISSING_OPTIONAL_HEADER; ctx->pe.optional_hdr._64 = ctx->pe.optional_hdr_ptr; ctx->pe.optional_hdr.length = sizeof(IMAGE_OPTIONAL_HEADER_64); ctx->pe.num_directories = ctx->pe.optional_hdr._64->NumberOfRvaAndSizes; ctx->pe.entrypoint = ctx->pe.optional_hdr._64->AddressOfEntryPoint; ctx->pe.imagebase = ctx->pe.optional_hdr._64->ImageBase; break; } } if (ctx->pe.num_directories > MAX_DIRECTORIES) { //fprintf(stderr, "Too many directories (%u)\n", ctx->pe.num_directories); return LIBPE_E_TOO_MANY_DIRECTORIES; } if (ctx->pe.num_sections > MAX_SECTIONS) { //fprintf(stderr, "Too many sections (%u)\n", ctx->pe.num_sections); return LIBPE_E_TOO_MANY_SECTIONS; } if (ctx->pe.optional_hdr_ptr) ctx->pe.directories_ptr = LIBPE_PTR_ADD(ctx->pe.optional_hdr_ptr, ctx->pe.optional_hdr.length); uint32_t sections_offset = sizeof(IMAGE_FILE_HEADER) + (uint32_t)ctx->pe.coff_hdr->SizeOfOptionalHeader; ctx->pe.sections_ptr = LIBPE_PTR_ADD(ctx->pe.coff_hdr, sections_offset); if (ctx->pe.num_directories > 0) { ctx->pe.directories = malloc(ctx->pe.num_directories * sizeof(IMAGE_DATA_DIRECTORY *)); if (ctx->pe.directories == NULL) return LIBPE_E_ALLOCATION_FAILURE; for (uint32_t i = 0; i < ctx->pe.num_directories; i++) { ctx->pe.directories[i] = LIBPE_PTR_ADD(ctx->pe.directories_ptr, i * sizeof(IMAGE_DATA_DIRECTORY)); } } else { ctx->pe.directories_ptr = NULL; } if (ctx->pe.num_sections > 0) { ctx->pe.sections = malloc(ctx->pe.num_sections * sizeof(IMAGE_SECTION_HEADER *)); if (ctx->pe.sections == NULL) return LIBPE_E_ALLOCATION_FAILURE; for (uint32_t i = 0; i < ctx->pe.num_sections; i++) { ctx->pe.sections[i] = LIBPE_PTR_ADD(ctx->pe.sections_ptr, i * sizeof(IMAGE_SECTION_HEADER)); } } else { ctx->pe.sections_ptr = NULL; } if (ctx->pe.coff_hdr->PointerToSymbolTable != 0) { uint32_t symbols_offset = ctx->pe.coff_hdr->PointerToSymbolTable; if (symbols_offset < ctx->map_size) { ctx->pe.symbols_ptr = LIBPE_PTR_ADD(ctx->map_addr, symbols_offset); ctx->pe.num_symbols = ctx->pe.coff_hdr->NumberOfSymbols; if (symbols_offset + ctx->pe.num_symbols * 18 < ctx->map_size) { ctx->pe.strings_ptr = LIBPE_PTR_ADD(ctx->pe.symbols_ptr, ctx->pe.num_symbols * 18); ctx->pe.strings_size = *(uint32_t *)ctx->pe.strings_ptr; if (ctx->pe.strings_size < 4 || symbols_offset + ctx->pe.num_symbols * 18 + ctx->pe.strings_size > ctx->map_size) { ctx->pe.strings_ptr = NULL; ctx->pe.strings_size = 0; } } if (ctx->pe.num_symbols == 0) ctx->pe.symbols_ptr = NULL; } } return LIBPE_E_OK; } bool pe_is_loaded(const pe_ctx_t *ctx) { return ctx->map_addr != NULL && ctx->map_size > 0; } bool pe_is_pe(const pe_ctx_t *ctx) { return pe_is_exec(ctx) || pe_is_obj(ctx) || pe_is_rom(ctx); } bool pe_is_exec(const pe_ctx_t *ctx) { // Check MZ header if (ctx->pe.dos_hdr == NULL || ctx->pe.dos_hdr->e_magic != MAGIC_MZ) return false; // Check PE signature if (ctx->pe.signature != SIGNATURE_PE) return false; return true; } bool pe_is_obj(const pe_ctx_t *ctx) { // Object file does not have neither MZ header nor PE\0\0 signature nor optional header if (ctx->pe.dos_hdr != NULL || ctx->pe.signature != 0 || ctx->pe.optional_hdr_ptr != NULL) return false; return true; } bool pe_is_rom(const pe_ctx_t *ctx) { // ROM file does not have neither MZ header nor PE\0\0 signature if (ctx->pe.dos_hdr != NULL || ctx->pe.signature != 0) return false; // ROM file has either MAGIC_ROM optional header (R3000, R4000, R10000, ALPHA) or MAGIC_PE32 optional header (I386, MPPC_601, POWERPC, ...) if (ctx->pe.optional_hdr_ptr == NULL || (ctx->pe.optional_hdr.type != MAGIC_ROM && ctx->pe.optional_hdr.type != MAGIC_PE32)) return false; return true; } bool pe_is_dll(const pe_ctx_t *ctx) { if (!pe_is_exec(ctx)) return false; if (ctx->pe.coff_hdr == NULL) return false; return ctx->pe.coff_hdr->Characteristics & IMAGE_FILE_DLL ? true : false; } uint64_t pe_filesize(const pe_ctx_t *ctx) { return ctx->map_size; } // return the section of given rva IMAGE_SECTION_HEADER *pe_rva2section(pe_ctx_t *ctx, uint64_t rva) { if (rva == 0 || ctx->pe.sections == NULL) return NULL; for (uint32_t i=0; i < ctx->pe.num_sections; i++) { const uint64_t start = ctx->pe.sections[i]->VirtualAddress; const uint64_t end = ctx->pe.sections[i]->VirtualAddress + ctx->pe.sections[i]->Misc.VirtualSize; if (rva >= start && rva <= end) return ctx->pe.sections[i]; } return NULL; } // Converts a RVA (Relative Virtual Address) to a raw file offset uint64_t pe_rva2ofs(const pe_ctx_t *ctx, uint64_t rva) { if (rva == 0) return 0; if (ctx->pe.sections == NULL) return rva; // Find out which section the given RVA belongs for (uint32_t i=0; i < ctx->pe.num_sections; i++) { if (ctx->pe.sections[i] == NULL) return 0; // Use SizeOfRawData if VirtualSize == 0 size_t section_size = ctx->pe.sections[i]->Misc.VirtualSize; if (section_size == 0) section_size = ctx->pe.sections[i]->SizeOfRawData; if (ctx->pe.sections[i]->VirtualAddress <= rva) { if ((ctx->pe.sections[i]->VirtualAddress + section_size) > rva) { rva -= ctx->pe.sections[i]->VirtualAddress; rva += ctx->pe.sections[i]->PointerToRawData; return rva; } } } // Handle PE with a single section if (ctx->pe.num_sections == 1) { rva -= ctx->pe.sections[0]->VirtualAddress; rva += ctx->pe.sections[0]->PointerToRawData; return rva; } return rva; // PE with no sections, return RVA } // Returns the RVA for a given offset uint64_t pe_ofs2rva(const pe_ctx_t *ctx, uint64_t ofs) { if (ofs == 0 || ctx->pe.sections == NULL) return 0; for (uint32_t i=0; i < ctx->pe.num_sections; i++) { if (ctx->pe.sections[i] == NULL) return 0; if (ctx->pe.sections[i]->PointerToRawData <= ofs) { if ((ctx->pe.sections[i]->PointerToRawData + ctx->pe.sections[i]->SizeOfRawData) > ofs) { ofs -= ctx->pe.sections[i]->PointerToRawData; ofs += ctx->pe.sections[i]->VirtualAddress; return ofs; } } } return 0; } IMAGE_DOS_HEADER *pe_dos(pe_ctx_t *ctx) { return ctx->pe.dos_hdr; } IMAGE_COFF_HEADER *pe_coff(pe_ctx_t *ctx) { return ctx->pe.coff_hdr; } IMAGE_OPTIONAL_HEADER *pe_optional(pe_ctx_t *ctx) { if (ctx->pe.optional_hdr_ptr == NULL) return NULL; return &ctx->pe.optional_hdr; } uint32_t pe_directories_count(const pe_ctx_t *ctx) { return ctx->pe.num_directories; } IMAGE_DATA_DIRECTORY **pe_directories(pe_ctx_t *ctx) { return ctx->pe.directories; } IMAGE_DATA_DIRECTORY *pe_directory_by_entry(pe_ctx_t *ctx, ImageDirectoryEntry entry) { if (ctx->pe.directories == NULL || entry > ctx->pe.num_directories - 1) return NULL; return ctx->pe.directories[entry]; } uint16_t pe_sections_count(const pe_ctx_t *ctx) { return ctx->pe.num_sections; } IMAGE_SECTION_HEADER **pe_sections(pe_ctx_t *ctx) { return ctx->pe.sections; } IMAGE_SECTION_HEADER *pe_section_by_name(pe_ctx_t *ctx, const char *name) { if (ctx->pe.sections == NULL || name == NULL) return NULL; for (uint32_t i=0; i < ctx->pe.num_sections; i++) { if (strncmp((const char *)ctx->pe.sections[i]->Name, name, SECTION_NAME_SIZE) == 0) return ctx->pe.sections[i]; } return NULL; } const char *pe_section_name(const pe_ctx_t *ctx, const IMAGE_SECTION_HEADER *section_hdr, char *out_name, size_t out_name_size) { assert(ctx != NULL); assert(out_name_size >= SECTION_NAME_SIZE+1); strncpy(out_name, (const char *)section_hdr->Name, SECTION_NAME_SIZE); out_name[SECTION_NAME_SIZE] = '\0'; if (out_name[0] == '/' && out_name[1] >= '0' && out_name[1] <= '9' && ctx->pe.strings_ptr) { char *endptr = NULL; long int offset = -1; errno = 0; offset = strtol(out_name+1, &endptr, 10); if (errno == 0 && *endptr == 0 && offset >= 0 && offset < ctx->pe.strings_size) { return ctx->pe.strings_ptr + offset; } } return out_name; } #define LIBPE_ENTRY(v) { v, # v } const char *pe_machine_type_name(MachineType type) { typedef struct { MachineType type; const char * const name; } MachineEntry; static const MachineEntry names[] = { LIBPE_ENTRY(IMAGE_FILE_MACHINE_UNKNOWN), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ALPHA_OLD), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ALPHA), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ALPHA64), LIBPE_ENTRY(IMAGE_FILE_MACHINE_AM33), LIBPE_ENTRY(IMAGE_FILE_MACHINE_AMD64), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ARM), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ARMV7), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ARM64), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ARM64EC), LIBPE_ENTRY(IMAGE_FILE_MACHINE_ARM64X), LIBPE_ENTRY(IMAGE_FILE_MACHINE_CEE), LIBPE_ENTRY(IMAGE_FILE_MACHINE_CEF), LIBPE_ENTRY(IMAGE_FILE_MACHINE_CHPE_X86), LIBPE_ENTRY(IMAGE_FILE_MACHINE_EBC), LIBPE_ENTRY(IMAGE_FILE_MACHINE_I386), LIBPE_ENTRY(IMAGE_FILE_MACHINE_I860), LIBPE_ENTRY(IMAGE_FILE_MACHINE_IA64), LIBPE_ENTRY(IMAGE_FILE_MACHINE_LOONGARCH32), LIBPE_ENTRY(IMAGE_FILE_MACHINE_LOONGARCH64), LIBPE_ENTRY(IMAGE_FILE_MACHINE_M32R), LIBPE_ENTRY(IMAGE_FILE_MACHINE_M68K), LIBPE_ENTRY(IMAGE_FILE_MACHINE_MIPS16), LIBPE_ENTRY(IMAGE_FILE_MACHINE_MIPSFPU), LIBPE_ENTRY(IMAGE_FILE_MACHINE_MIPSFPU16), LIBPE_ENTRY(IMAGE_FILE_MACHINE_MPPC_601), LIBPE_ENTRY(IMAGE_FILE_MACHINE_OMNI), LIBPE_ENTRY(IMAGE_FILE_MACHINE_PARISC), LIBPE_ENTRY(IMAGE_FILE_MACHINE_POWERPC), LIBPE_ENTRY(IMAGE_FILE_MACHINE_POWERPCFP), LIBPE_ENTRY(IMAGE_FILE_MACHINE_POWERPCBE), LIBPE_ENTRY(IMAGE_FILE_MACHINE_R3000), LIBPE_ENTRY(IMAGE_FILE_MACHINE_R3000_BE), LIBPE_ENTRY(IMAGE_FILE_MACHINE_R4000), LIBPE_ENTRY(IMAGE_FILE_MACHINE_R10000), LIBPE_ENTRY(IMAGE_FILE_MACHINE_RISCV32), LIBPE_ENTRY(IMAGE_FILE_MACHINE_RISCV64), LIBPE_ENTRY(IMAGE_FILE_MACHINE_RISCV128), LIBPE_ENTRY(IMAGE_FILE_MACHINE_SH3), LIBPE_ENTRY(IMAGE_FILE_MACHINE_SH3DSP), LIBPE_ENTRY(IMAGE_FILE_MACHINE_SH3E), LIBPE_ENTRY(IMAGE_FILE_MACHINE_SH4), LIBPE_ENTRY(IMAGE_FILE_MACHINE_SH5), LIBPE_ENTRY(IMAGE_FILE_MACHINE_TRICORE), LIBPE_ENTRY(IMAGE_FILE_MACHINE_THUMB), LIBPE_ENTRY(IMAGE_FILE_MACHINE_WCEMIPSV2) }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (type == names[i].type) return names[i].name; } return NULL; } const char *pe_image_characteristic_name(ImageCharacteristics characteristic) { typedef struct { ImageCharacteristics characteristic; const char * const name; } ImageCharacteristicsName; static const ImageCharacteristicsName names[] = { LIBPE_ENTRY(IMAGE_FILE_RELOCS_STRIPPED), LIBPE_ENTRY(IMAGE_FILE_EXECUTABLE_IMAGE), LIBPE_ENTRY(IMAGE_FILE_LINE_NUMS_STRIPPED), LIBPE_ENTRY(IMAGE_FILE_LOCAL_SYMS_STRIPPED), LIBPE_ENTRY(IMAGE_FILE_AGGRESSIVE_WS_TRIM), LIBPE_ENTRY(IMAGE_FILE_LARGE_ADDRESS_AWARE), LIBPE_ENTRY(IMAGE_FILE_16BIT_MACHINE), LIBPE_ENTRY(IMAGE_FILE_BYTES_REVERSED_LO), LIBPE_ENTRY(IMAGE_FILE_32BIT_MACHINE), LIBPE_ENTRY(IMAGE_FILE_DEBUG_STRIPPED), LIBPE_ENTRY(IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP), LIBPE_ENTRY(IMAGE_FILE_NET_RUN_FROM_SWAP), LIBPE_ENTRY(IMAGE_FILE_SYSTEM), LIBPE_ENTRY(IMAGE_FILE_DLL), LIBPE_ENTRY(IMAGE_FILE_UP_SYSTEM_ONLY), LIBPE_ENTRY(IMAGE_FILE_BYTES_REVERSED_HI) }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (characteristic == names[i].characteristic) return names[i].name; } return NULL; } const char *pe_image_dllcharacteristic_name(ImageDllCharacteristics characteristic) { typedef struct { ImageDllCharacteristics characteristic; const char * const name; } ImageDllCharacteristicsName; static const ImageDllCharacteristicsName names[] = { LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_NX_COMPAT), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_NO_ISOLATION), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_NO_SEH), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_NO_BIND), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_APPCONTAINER), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_WDM_DRIVER), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_GUARD_CF), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE) }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (characteristic == names[i].characteristic) return names[i].name; } return NULL; } const char *pe_dll_image_dllcharacteristic_name(ImageDllCharacteristics characteristic) { typedef struct { ImageDllCharacteristics characteristic; const char * const name; } ImageDllCharacteristicsName; static const ImageDllCharacteristicsName names[] = { LIBPE_ENTRY(IMAGE_LIBRARY_PROCESS_INIT), LIBPE_ENTRY(IMAGE_LIBRARY_PROCESS_TERM), LIBPE_ENTRY(IMAGE_LIBRARY_THREAD_INIT), LIBPE_ENTRY(IMAGE_LIBRARY_THREAD_TERM), LIBPE_ENTRY(IMAGE_DLLCHARACTERISTICS_X86_THUNK), }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (characteristic == names[i].characteristic) return names[i].name; } return NULL; } const char *pe_image_loader_flags_name(ImageLoaderFlags flags) { typedef struct { ImageLoaderFlags flags; const char * const name; } ImageLoaderFlagsName; static const ImageLoaderFlagsName names[] = { LIBPE_ENTRY(IMAGE_LOADER_FLAGS_COMPLUS), LIBPE_ENTRY(IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL), }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (flags == names[i].flags) return names[i].name; } return NULL; } const char *pe_dll_image_loader_flags_name(ImageLoaderFlags flags) { typedef struct { ImageLoaderFlags flags; const char * const name; } ImageLoaderFlagsName; static const ImageLoaderFlagsName names[] = { LIBPE_ENTRY(IMAGE_LOADER_FLAGS_BREAK_ON_LOAD), LIBPE_ENTRY(IMAGE_LOADER_FLAGS_DEBUG_ON_LOAD), }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (flags == names[i].flags) return names[i].name; } return NULL; } const char *pe_windows_subsystem_name(WindowsSubsystem subsystem) { typedef struct { WindowsSubsystem subsystem; const char * const name; } WindowsSubsystemName; static const WindowsSubsystemName names[] = { LIBPE_ENTRY(IMAGE_SUBSYSTEM_UNKNOWN), LIBPE_ENTRY(IMAGE_SUBSYSTEM_NATIVE), LIBPE_ENTRY(IMAGE_SUBSYSTEM_WINDOWS_GUI), LIBPE_ENTRY(IMAGE_SUBSYSTEM_WINDOWS_CUI), LIBPE_ENTRY(IMAGE_SUBSYSTEM_WINDOWS_OLD_CE_GUI), LIBPE_ENTRY(IMAGE_SUBSYSTEM_OS2_CUI), LIBPE_ENTRY(IMAGE_SUBSYSTEM_POSIX_CUI), LIBPE_ENTRY(IMAGE_SUBSYSTEM_MMOSA), LIBPE_ENTRY(IMAGE_SUBSYSTEM_WINDOWS_CE_GUI), LIBPE_ENTRY(IMAGE_SUBSYSTEM_EFI_APPLICATION), LIBPE_ENTRY(IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER), LIBPE_ENTRY(IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER), LIBPE_ENTRY(IMAGE_SUBSYSTEM_EFI_ROM), LIBPE_ENTRY(IMAGE_SUBSYSTEM_XBOX), LIBPE_ENTRY(IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION), LIBPE_ENTRY(IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG) }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (subsystem == names[i].subsystem) return names[i].name; } return NULL; } const char *pe_directory_name(ImageDirectoryEntry entry) { typedef struct { ImageDirectoryEntry entry; const char * const name; } ImageDirectoryEntryName; static const ImageDirectoryEntryName names[] = { LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_EXPORT), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_IMPORT), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_RESOURCE), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_EXCEPTION), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_SECURITY), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_BASERELOC), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_DEBUG), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_ARCHITECTURE), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_GLOBALPTR), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_TLS), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_IAT), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT), LIBPE_ENTRY(IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR), LIBPE_ENTRY(IMAGE_DIRECTORY_RESERVED) }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (entry == names[i].entry) return names[i].name; } return NULL; } const char *pe_section_characteristic_name(SectionCharacteristics characteristic) { typedef struct { SectionCharacteristics characteristic; const char * const name; } SectionCharacteristicsName; static const SectionCharacteristicsName names[] = { LIBPE_ENTRY(IMAGE_SCN_SCALE_INDEX), LIBPE_ENTRY(IMAGE_SCN_TYPE_NO_LOAD), LIBPE_ENTRY(IMAGE_SCN_TYPE_GROUPED), LIBPE_ENTRY(IMAGE_SCN_TYPE_NO_PAD), LIBPE_ENTRY(IMAGE_SCN_TYPE_COPY), LIBPE_ENTRY(IMAGE_SCN_CNT_CODE), LIBPE_ENTRY(IMAGE_SCN_CNT_INITIALIZED_DATA), LIBPE_ENTRY(IMAGE_SCN_CNT_UNINITIALIZED_DATA), LIBPE_ENTRY(IMAGE_SCN_LNK_OTHER), LIBPE_ENTRY(IMAGE_SCN_LNK_INFO), LIBPE_ENTRY(IMAGE_SCN_LNK_OVERLAY), LIBPE_ENTRY(IMAGE_SCN_LNK_REMOVE), LIBPE_ENTRY(IMAGE_SCN_LNK_COMDAT), LIBPE_ENTRY(IMAGE_SCN_NO_DEFER_SPEC_EXC), LIBPE_ENTRY(IMAGE_SCN_GPREL), LIBPE_ENTRY(IMAGE_SCN_MEM_16BIT), LIBPE_ENTRY(IMAGE_SCN_MEM_LOCKED), LIBPE_ENTRY(IMAGE_SCN_MEM_PRELOAD), LIBPE_ENTRY(IMAGE_SCN_ALIGN_1BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_2BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_4BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_8BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_16BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_32BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_64BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_128BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_256BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_512BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_1024BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_2048BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_4096BYTES), LIBPE_ENTRY(IMAGE_SCN_ALIGN_8192BYTES), LIBPE_ENTRY(IMAGE_SCN_LNK_NRELOC_OVFL), LIBPE_ENTRY(IMAGE_SCN_MEM_DISCARDABLE), LIBPE_ENTRY(IMAGE_SCN_MEM_NOT_CACHED), LIBPE_ENTRY(IMAGE_SCN_MEM_NOT_PAGED), LIBPE_ENTRY(IMAGE_SCN_MEM_SHARED), LIBPE_ENTRY(IMAGE_SCN_MEM_EXECUTE), LIBPE_ENTRY(IMAGE_SCN_MEM_READ), LIBPE_ENTRY(IMAGE_SCN_MEM_WRITE) }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (characteristic == names[i].characteristic) return names[i].name; } return NULL; } const char *pe_m68k_section_characteristic_name(SectionCharacteristics characteristic) { typedef struct { SectionCharacteristics characteristic; const char * const name; } SectionCharacteristicsName; static const SectionCharacteristicsName names[] = { LIBPE_ENTRY(IMAGE_SCN_MEM_PROTECTED), LIBPE_ENTRY(IMAGE_SCN_MEM_FARDATA), LIBPE_ENTRY(IMAGE_SCN_MEM_SYSHEAP), LIBPE_ENTRY(IMAGE_SCN_MEM_PURGEABLE), LIBPE_ENTRY(IMAGE_SCN_MEM_LOCKED), LIBPE_ENTRY(IMAGE_SCN_MEM_PRELOAD), }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (characteristic == names[i].characteristic) return names[i].name; } return NULL; } const char *pe_rom_section_characteristic_name(ROMSectionCharacteristics characteristic) { typedef struct { ROMSectionCharacteristics characteristic; const char * const name; } ROMSectionCharacteristicsName; static const ROMSectionCharacteristicsName names[] = { LIBPE_ENTRY(STYP_DUMMY), LIBPE_ENTRY(STYP_TEXT), LIBPE_ENTRY(STYP_DATA), LIBPE_ENTRY(STYP_SBSS), LIBPE_ENTRY(STYP_RDATA), LIBPE_ENTRY(STYP_SDATA), LIBPE_ENTRY(STYP_BSS), LIBPE_ENTRY(STYP_UCODE), LIBPE_ENTRY(STYP_LIT8), LIBPE_ENTRY(STYP_LIT4), LIBPE_ENTRY(S_NRELOC_OVFL), LIBPE_ENTRY(STYP_LIB), LIBPE_ENTRY(STYP_INIT), }; for (unsigned int i=0; i < LIBPE_SIZEOF_ARRAY(names); i++) { if (characteristic == names[i].characteristic) return names[i].name; } return NULL; } bool pe_use_rom_section_characteristic(pe_ctx_t *ctx) { return ctx->pe.optional_hdr_ptr != NULL && ctx->pe.optional_hdr.type == MAGIC_ROM; } readpe-0.84/lib/libpe/resources.c000066400000000000000000000510761455661113700167460ustar00rootroot00000000000000/* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/resources.h" #include "libpe/dir_resources.h" #include "libpe/pe.h" #include "libpe/utlist.h" #include #include #include #include #include #include #include // REFERENCE: https://msdn.microsoft.com/en-us/library/ms648009(v=vs.85).aspx static const pe_resource_entry_info_t g_resource_dataentry_info_table[] = { { "???_0", 0, ".0", "_0" }, { "RT_CURSOR", RT_CURSOR, ".cur", "cursors" }, { "RT_BITMAP", RT_BITMAP, ".bmp", "bitmaps" }, { "RT_ICON", RT_ICON, ".ico", "icons" }, { "RT_MENU", RT_MENU, ".rc", "menus" }, { "RT_DIALOG", RT_DIALOG, ".dlg", "dialogs" }, { "RT_STRING", RT_STRING, ".rc", "strings" }, { "RT_FONTDIR", RT_FONTDIR, ".fnt", "fontdirs" }, { "RT_FONT", RT_FONT, ".fnt", "fonts" }, { "RT_ACCELERATOR", RT_ACCELERATOR, ".rc", "accelerators" }, { "RT_RCDATA", RT_RCDATA, ".rc", "rcdatas" }, { "RT_MESSAGETABLE", RT_MESSAGETABLE, ".mc", "messagetables" }, { "RT_GROUP_CURSOR", RT_GROUP_CURSOR, ".cur", "groupcursors" }, { "???_13", 13, ".13", "_13" }, { "RT_GROUP_ICON", RT_GROUP_ICON, ".ico", "groupicons" }, { "???_15", 15, ".15", "_15" }, { "RT_VERSION", RT_VERSION, ".rc", "versions" }, { "RT_DLGINCLUDE", RT_DLGINCLUDE, ".rc", "dlgincludes" }, { "???_18", 18, ".18", "_18" }, { "RT_PLUGPLAY", RT_PLUGPLAY, ".rc", "plugplays" }, { "RT_VXD", RT_VXD, ".rc", "vxds" }, { "RT_ANICURSOR", RT_ANICURSOR, ".rc", "anicursors" }, { "RT_ANIICON", RT_ANIICON, ".rc", "aniicons" }, { "RT_HTML", RT_HTML, ".html", "htmls" }, { "RT_MANIFEST", RT_MANIFEST, ".xml", "manifests" }, { "RT_DLGINIT", RT_DLGINIT, ".rc", "dlginits" }, { "RT_TOOLBAR", RT_TOOLBAR, ".rc", "toolbars" }, { NULL } }; const pe_resource_entry_info_t *pe_resource_entry_info_lookup(uint32_t name_offset) { const pe_resource_entry_info_t *p; p = g_resource_dataentry_info_table; while ( p->name ) { if ( p->type == name_offset ) return p; p++; } return NULL; } void pe_resources_dealloc_node_search_result(pe_resource_node_search_result_t *result) { if (result == NULL) return; pe_resource_node_search_result_item_t *item = result->items; while (item != NULL) { pe_resource_node_search_result_item_t *next = item->next; free(item); item = next; } } void pe_resource_search_nodes(pe_resource_node_search_result_t *result, const pe_resource_node_t *node, pe_resource_node_predicate_fn predicate) { assert(result != NULL); if (node == NULL) return; if (predicate(node)) { // Found the matching node. Return it. pe_resource_node_search_result_item_t *item = calloc(1, sizeof(*item)); if (item == NULL) { // TODO: Handle allocation failure. abort(); } item->node = node; LL_APPEND(result->items, item); result->count++; // IMPORTANT: We do NOT return early because we want all matching nodes. } // Traverse the tree to find the matching node. pe_resource_search_nodes(result, node->childNode, predicate); pe_resource_search_nodes(result, node->nextNode, predicate); } pe_resource_node_t *pe_resource_root_node(const pe_resource_node_t *node) { if (node == NULL) return NULL; // Traverse the linked-list to find the root parent node. pe_resource_node_t *parent = node->parentNode; while (parent != NULL) { if (parent->parentNode == NULL) { // Found the root parent node. Return it. return parent; } // Move to the next parent node. parent = parent->parentNode; } return (pe_resource_node_t *)node; // Return the node itself if it has no parent. } pe_resource_node_t *pe_resource_last_child_node(const pe_resource_node_t *parent_node) { if (parent_node == NULL) return NULL; // Traverse the linked-list to find the last child node. pe_resource_node_t *child = parent_node->childNode; while (child != NULL) { if (child->nextNode == NULL) { // Found the last child node. Return it. return child; } // Move to the next node. child = child->nextNode; } return NULL; } pe_resource_node_t *pe_resource_find_node_by_type_and_level(const pe_resource_node_t *node, pe_resource_node_type_e type, uint32_t dirLevel) { if (node == NULL) return NULL; // Found the matching node. Return it. if (node->type == type && node->dirLevel == dirLevel) { return (pe_resource_node_t *)node; } // Traverse the tree to find the matching node. const pe_resource_node_t *child = pe_resource_find_node_by_type_and_level(node->childNode, type, dirLevel); // Found the matching node. Return it. if (child != NULL) return (pe_resource_node_t *)child; const pe_resource_node_t *sibling = pe_resource_find_node_by_type_and_level(node->nextNode, type, dirLevel); // Found the matching node. Return it. if (sibling != NULL) return (pe_resource_node_t *)sibling; return NULL; } pe_resource_node_t *pe_resource_find_parent_node_by_type_and_level(const pe_resource_node_t *node, pe_resource_node_type_e type, uint32_t dirLevel) { if (node == NULL) return NULL; // Traverse the linked-list to find the matching parent node. pe_resource_node_t *parent = node->parentNode; while (parent != NULL) { if (parent->type == type && parent->dirLevel == dirLevel) { // Found the matching parent node. Return it. return parent; } // Move to the next parent node. parent = parent->parentNode; } return NULL; } char *pe_resource_parse_string_u(pe_ctx_t *ctx, char *output, size_t output_size, const IMAGE_RESOURCE_DATA_STRING_U *data_string_ptr) { if (data_string_ptr == NULL) return NULL; if (!pe_can_read(ctx, data_string_ptr->String, data_string_ptr->Length)) { LIBPE_WARNING("Cannot read string from IMAGE_RESOURCE_DATA_STRING_U"); return NULL; } // If the caller provided a NULL pointer, we do the allocation and return it. const size_t buffer_size = output_size == 0 ? (size_t)data_string_ptr->Length + 1 : output_size; if (output == NULL) { output = malloc(buffer_size); if (output == NULL) { // TODO: Handle allocation failure. abort(); } } pe_utils_str_widechar2ascii(output, buffer_size, (const char *)data_string_ptr->String, (size_t)data_string_ptr->Length); return output; } // FIX: Retired code just to avoid unecessary warnings. #if 0 static char *pe_resource_name_from_id(pe_ctx_t *ctx, char *out_name, size_t out_name_size, uint32_t id) { const bool is_string = id & IMAGE_RESOURCE_NAME_IS_STRING; // entry->u0.data.NameIsString // If it's a regular ID, simply use it. if (!is_string) { if (out_name == NULL) { const size_t estimated_size = 8 + 1; // 8 == strlen("FFFFFFFF"), +1 for the `\0`. out_name = malloc(estimated_size); if (out_name == NULL) { // TODO: Handle allocation failure. abort(); } } snprintf(out_name, out_name_size, "%X", id); return out_name; } id &= ~(uint32_t)IMAGE_RESOURCE_NAME_IS_STRING; // Ignore the highest bit. const IMAGE_RESOURCE_DATA_STRING_U *data_string_u = LIBPE_PTR_ADD(ctx->cached_data.resources->resource_base_ptr, id); if (!pe_can_read(ctx, data_string_u, sizeof(IMAGE_RESOURCE_DATA_STRING_U))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DATA_STRING_U"); return false; } out_name = pe_resource_parse_string_u(ctx, out_name, out_name_size, data_string_u); return out_name; } static char *pe_resource_name_from_type(char *out_name, size_t out_name_size, uint32_t type) { const pe_resource_entry_info_t *match = pe_resource_entry_info_lookup(type); if (out_name == NULL) { const size_t estimated_size = (match != NULL ? strlen(match->name) : 8) + 1; // 8 == strlen("FFFFFFFF"), +1 for the `\0`. out_name = malloc(estimated_size); if (out_name == NULL) { // TODO: Handle allocation failure. abort(); } } if (match != NULL) { strncpy(out_name, match->name, out_name_size); out_name[out_name_size - 1] = '\0'; } else { snprintf(out_name, out_name_size, "%" PRIX32, type); } return out_name; } static void pe_resource_debug_node(pe_ctx_t *ctx, const pe_resource_node_t *node) { if (node == NULL) return; switch (node->type) { default: LIBPE_WARNING("Invalid node type"); break; case LIBPE_RDT_RESOURCE_DIRECTORY: { char resource_name[256]; const size_t resource_name_size = sizeof(resource_name); resource_name[0] = '\0'; if (node->dirLevel == LIBPE_RDT_LEVEL1) { // dirLevel == 1 is where Resource Types are defined. if (node->parentNode != NULL && node->parentNode->type == LIBPE_RDT_DIRECTORY_ENTRY) { IMAGE_RESOURCE_DIRECTORY_ENTRY *dir_entry = node->parentNode->raw.directoryEntry; if (dir_entry->u0.data.NameIsString) { pe_resource_name_from_id(ctx, resource_name, resource_name_size, dir_entry->u0.Name); } else { pe_resource_name_from_type(resource_name, resource_name_size, dir_entry->u0.Name); } } } else { if (node->parentNode != NULL && node->parentNode->type == LIBPE_RDT_DIRECTORY_ENTRY) { IMAGE_RESOURCE_DIRECTORY_ENTRY *dir_entry = node->parentNode->raw.directoryEntry; pe_resource_name_from_id(ctx, resource_name, resource_name_size, dir_entry->u0.Name); } else { resource_name[0] = '0'; resource_name[1] = '\0'; } } const IMAGE_RESOURCE_DIRECTORY * const dir = node->raw.resourceDirectory; // Indentation. for (size_t i=0; i < node->depth; i++) printf(" "); printf("LIBPE_RDT_RESOURCE_DIRECTORY [dirLevel=%d]: ", node->dirLevel); printf("ResDir (%s) Entries:%02u[%02X] (Named:%02u[%02X], ID:%02u[%02X]) TimeDate:%08u[%08X]", resource_name, dir->NumberOfIdEntries + dir->NumberOfNamedEntries, dir->NumberOfIdEntries + dir->NumberOfNamedEntries, dir->NumberOfNamedEntries, dir->NumberOfNamedEntries, dir->NumberOfIdEntries, dir->NumberOfIdEntries, dir->TimeDateStamp, dir->TimeDateStamp ); if (dir->MajorVersion || dir->MinorVersion) printf(" Vers:%u.%02u", dir->MajorVersion, dir->MinorVersion); if (dir->Characteristics) printf(" Char:%08u[%08X]", dir->Characteristics, dir->Characteristics); printf("\n"); break; } case LIBPE_RDT_DIRECTORY_ENTRY: { // Indentation. for (size_t i=0; i < node->depth; i++) printf(" "); printf("LIBPE_RDT_DIRECTORY_ENTRY [dirLevel=%d]: ", node->dirLevel); const IMAGE_RESOURCE_DIRECTORY_ENTRY * const entry = node->raw.directoryEntry; if (entry->u0.data.NameIsString) { // entry->u0.Name & IMAGE_RESOURCE_NAME_IS_STRING char res_name[256]; pe_resource_name_from_id(ctx, res_name, sizeof(res_name), entry->u0.Name); printf("Name: %s DataEntryOffs: %08u[%08X]\n", res_name, entry->u1.OffsetToData, entry->u1.OffsetToData); } else { printf("ID: %08u[%08X] DataEntryOffs: %08u[%08X]\n", entry->u0.Name, entry->u0.Name, entry->u1.OffsetToData, entry->u1.OffsetToData); } break; } case LIBPE_RDT_DATA_STRING: { const IMAGE_RESOURCE_DATA_STRING_U * const dataString = node->raw.dataString; char ascii_string[256]; pe_resource_parse_string_u(ctx, ascii_string, sizeof(ascii_string), dataString); // Indentation. for (size_t i=0; i < node->depth; i++) printf(" "); printf("LIBPE_RDT_DATA_STRING [dirLevel=%d]: ", node->dirLevel); printf("String: %s Length: %02hu\n", ascii_string, dataString->Length); break; } case LIBPE_RDT_DATA_ENTRY: { const IMAGE_RESOURCE_DATA_ENTRY * const data_entry = node->raw.dataEntry; // Indentation. for (size_t i=0; i < node->depth; i++) printf(" "); printf("LIBPE_RDT_DATA_ENTRY [dirLevel=%d]: ", node->dirLevel); printf("DataRVA: %05u[%05X] DataSize: %05u[%05X] CodePage: %u[%X]\n", data_entry->OffsetToData, data_entry->OffsetToData, data_entry->Size, data_entry->Size, data_entry->CodePage, data_entry->CodePage); break; } } } static void pe_resource_debug_nodes(pe_ctx_t *ctx, const pe_resource_node_t *node) { if (node == NULL) return; pe_resource_debug_node(ctx, node); pe_resource_debug_nodes(ctx, node->childNode); pe_resource_debug_nodes(ctx, node->nextNode); } #endif static pe_resource_node_t *pe_resource_create_node(uint8_t depth, pe_resource_node_type_e type, void *raw_ptr, pe_resource_node_t *parent_node) { pe_resource_node_t *node = calloc(1, sizeof(pe_resource_node_t)); if (node == NULL) { // TODO: Handle allocation failure. abort(); } node->depth = depth; node->type = type; // Determine directory level. if (parent_node != NULL) { // node->dirLevel = parent_node->type == LIBPE_RDT_RESOURCE_DIRECTORY && node->type == LIBPE_RDT_DIRECTORY_ENTRY node->dirLevel = parent_node->type == LIBPE_RDT_RESOURCE_DIRECTORY ? parent_node->dirLevel + 1 : parent_node->dirLevel; } else { node->dirLevel = 0; // Only the root directory has dirLevel == 0. } // Establish relationships. Makes the node more human! if (parent_node != NULL) { node->parentNode = parent_node; if (parent_node->childNode == NULL) { // This is the 1st child node of parent_node. parent_node->childNode = node; } else { // This is NOT the 1st child node of parent_node, so we need to append it to the end of the linked-list. pe_resource_node_t *last_child_node = pe_resource_last_child_node(parent_node); if (last_child_node != NULL) { // Found the last child node. Append our new node. last_child_node->nextNode = node; } } } node->raw.raw_ptr = raw_ptr; switch (type) { default: LIBPE_WARNING("Invalid node type"); break; case LIBPE_RDT_RESOURCE_DIRECTORY: node->raw.resourceDirectory = raw_ptr; break; case LIBPE_RDT_DIRECTORY_ENTRY: node->raw.directoryEntry = raw_ptr; break; case LIBPE_RDT_DATA_STRING: node->raw.dataString = raw_ptr; break; case LIBPE_RDT_DATA_ENTRY: node->raw.dataEntry = raw_ptr; break; } return node; } static void pe_resource_free_nodes(pe_resource_node_t *node) { if (node == NULL) return; pe_resource_free_nodes(node->childNode); pe_resource_free_nodes(node->nextNode); free(node->name); free(node); } static bool pe_resource_parse_nodes(pe_ctx_t *ctx, pe_resource_node_t *node) { switch (node->type) { default: LIBPE_WARNING("Invalid node type"); return false; case LIBPE_RDT_RESOURCE_DIRECTORY: { const IMAGE_RESOURCE_DIRECTORY * const resdir_ptr = node->raw.resourceDirectory; IMAGE_RESOURCE_DIRECTORY_ENTRY *first_entry_ptr = LIBPE_PTR_ADD(resdir_ptr, sizeof(IMAGE_RESOURCE_DIRECTORY)); const size_t total_entries = resdir_ptr->NumberOfIdEntries + resdir_ptr->NumberOfNamedEntries; for (size_t i = 0; i < total_entries; i++) { IMAGE_RESOURCE_DIRECTORY_ENTRY *entry = &first_entry_ptr[i]; if (!pe_can_read(ctx, entry, sizeof(IMAGE_RESOURCE_DIRECTORY_ENTRY))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DIRECTORY_ENTRY"); break; } pe_resource_node_t *new_node = pe_resource_create_node(node->depth + 1, LIBPE_RDT_DIRECTORY_ENTRY, entry, node); pe_resource_parse_nodes(ctx, new_node); } break; } case LIBPE_RDT_DIRECTORY_ENTRY: { const IMAGE_RESOURCE_DIRECTORY_ENTRY *entry_ptr = node->raw.directoryEntry; //fprintf(stderr, "DEBUG: id=%#x, dataOffset=%#x\n", entry_ptr->u0.Id, entry_ptr->u1.OffsetToData); pe_resource_node_t *new_node = NULL; // This resource has a name? if (entry_ptr->u0.data.NameIsString) { // entry->u0.Name & IMAGE_RESOURCE_NAME_IS_STRING IMAGE_RESOURCE_DATA_STRING_U *data_string_ptr = LIBPE_PTR_ADD(ctx->cached_data.resources->resource_base_ptr, entry_ptr->u0.data.NameOffset); if (!pe_can_read(ctx, data_string_ptr, sizeof(IMAGE_RESOURCE_DATA_STRING_U))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DATA_STRING_U"); return NULL; } node->name = pe_resource_parse_string_u(ctx, NULL, 0, data_string_ptr); new_node = pe_resource_create_node(node->depth + 1, LIBPE_RDT_DATA_STRING, data_string_ptr, node); pe_resource_parse_nodes(ctx, new_node); } // Is it a directory? if (entry_ptr->u1.data.DataIsDirectory) { // entry->u1.OffsetToData & IMAGE_RESOURCE_DATA_IS_DIRECTORY IMAGE_RESOURCE_DIRECTORY *child_resdir_ptr = LIBPE_PTR_ADD(ctx->cached_data.resources->resource_base_ptr, entry_ptr->u1.data.OffsetToDirectory); if (!pe_can_read(ctx, child_resdir_ptr, sizeof(IMAGE_RESOURCE_DIRECTORY))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DIRECTORY"); break; } new_node = pe_resource_create_node(node->depth + 1, LIBPE_RDT_RESOURCE_DIRECTORY, child_resdir_ptr, node); } else { // Not a directory IMAGE_RESOURCE_DATA_ENTRY *data_entry_ptr = LIBPE_PTR_ADD(ctx->cached_data.resources->resource_base_ptr, entry_ptr->u1.data.OffsetToDirectory); if (!pe_can_read(ctx, data_entry_ptr, sizeof(IMAGE_RESOURCE_DATA_ENTRY))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DATA_ENTRY"); break; } new_node = pe_resource_create_node(node->depth + 1, LIBPE_RDT_DATA_ENTRY, data_entry_ptr, node); } pe_resource_parse_nodes(ctx, new_node); break; } case LIBPE_RDT_DATA_STRING: { const IMAGE_RESOURCE_DATA_STRING_U *data_string_ptr = node->raw.dataString; if (!pe_can_read(ctx, data_string_ptr, sizeof(IMAGE_RESOURCE_DATA_STRING_U))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DATA_STRING_U"); break; } // TODO(jweyrich): We should store the result in the node to be useful, // but we still don't store specific data in the node, except for its name. char *buffer = pe_resource_parse_string_u(ctx, NULL, 0, data_string_ptr); fprintf(stderr, "DEBUG: Length=%hu, String=%s\n", data_string_ptr->Length, buffer); free(buffer); break; } case LIBPE_RDT_DATA_ENTRY: { // const IMAGE_RESOURCE_DATA_ENTRY *data_entry_ptr = node->raw.dataEntry; // fprintf(stderr, "DEBUG: CodePage=%u, OffsetToData=%u[%#x], Reserved=%u[%#x], Size=%u[%#x]\n", // data_entry_ptr->CodePage, // data_entry_ptr->OffsetToData, // data_entry_ptr->OffsetToData, // data_entry_ptr->Reserved, // data_entry_ptr->Reserved, // data_entry_ptr->Size, // data_entry_ptr->Size); //////////////////////////////////////////////////////////////////////////////////// // TODO(jweyrich): To be written. //////////////////////////////////////////////////////////////////////////////////// break; } } return true; } static pe_resource_node_t *pe_resource_parse(pe_ctx_t *ctx, void *resource_base_ptr) { pe_resource_node_t *root_node = pe_resource_create_node(0, LIBPE_RDT_RESOURCE_DIRECTORY, resource_base_ptr, NULL); pe_resource_parse_nodes(ctx, root_node); //pe_resource_debug_nodes(ctx, root_node); return root_node; } static void *pe_resource_base_ptr(pe_ctx_t *ctx) { const IMAGE_DATA_DIRECTORY * const directory = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_RESOURCE); if (directory == NULL) { LIBPE_WARNING("Resource directory does not exist") return NULL; } if (directory->VirtualAddress == 0) { LIBPE_WARNING("Resource directory VA is zero") return NULL; } if (directory->Size == 0) { // Windows does not seem to care about the size // so we just continue with a warning LIBPE_WARNING("Resource directory size is 0") } const uintptr_t offset = pe_rva2ofs(ctx, directory->VirtualAddress); void *ptr = LIBPE_PTR_ADD(ctx->map_addr, offset); if (!pe_can_read(ctx, ptr, sizeof(IMAGE_RESOURCE_DIRECTORY))) { LIBPE_WARNING("Cannot read IMAGE_RESOURCE_DIRECTORY"); return NULL; } return ptr; } pe_resources_t *pe_resources(pe_ctx_t *ctx) { if (ctx->cached_data.resources != NULL) return ctx->cached_data.resources; pe_resources_t *res_ptr = calloc(1, sizeof(pe_resources_t)); if (res_ptr == NULL) { // TODO: Handle allocation failure. abort(); } ctx->cached_data.resources = res_ptr; ctx->cached_data.resources->err = LIBPE_E_OK; ctx->cached_data.resources->resource_base_ptr = pe_resource_base_ptr(ctx); // Various parts of the parsing rely on `resource_base_ptr`. if (ctx->cached_data.resources->resource_base_ptr != NULL) { ctx->cached_data.resources->root_node = pe_resource_parse(ctx, ctx->cached_data.resources->resource_base_ptr); } return ctx->cached_data.resources; } void pe_resources_dealloc(pe_resources_t *obj) { if (obj == NULL) return; pe_resource_free_nodes(obj->root_node); free(obj); } readpe-0.84/lib/libpe/utils.c000066400000000000000000000136761455661113700161000ustar00rootroot00000000000000/* vim:set ts=4 sw=4 noet: */ /* libpe - the PE library Copyright (C) 2010 - 2017 libpe authors This file is part of libpe. libpe is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. libpe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with libpe. If not, see . */ #include "libpe/utils.h" #include "libpe/error.h" #include #include #include #include #include #include #include #include #include #include bool pe_utils_str_ends_with(const char* text, const char* pattern) { if (!text || !pattern) return false; const size_t n = strspn(pattern, text); if (*(pattern + n) != '\0') return false; return !memcmp(text + strlen(text) - n, pattern, n); } char *pe_utils_str_inplace_ltrim(char *str) { return str + strspn( str, " \f\n\r\t\v" ); } char *pe_utils_str_inplace_rtrim(char *str) { const size_t length = strlen(str); char *ptr = str + length - 1; // If str points to a empty string, ptr will point // to a place before str... while (ptr > str && isspace(*ptr)) ptr--; // Move back to space. // Replace it with '\0'. *++ptr = 0; return str; } char *pe_utils_str_inplace_trim(char *str) { char *ptr; ptr = pe_utils_str_inplace_ltrim( str ); return pe_utils_str_inplace_rtrim( ptr ); } char *pe_utils_str_array_join(char *strings[], size_t count, char delimiter) { size_t i; if (strings == NULL || strings[0] == NULL) return strdup(""); // Count how much memory the resulting string is going to need, // considering delimiters for each string. The last delimiter will // be a NUL terminator; size_t result_length = 0; for (i = 0; i < count; i++) { result_length += strlen(strings[i]) + 1; } // Allocate the resulting string. char *result = malloc(result_length); if (result == NULL) return NULL; // Return NULL because it failed miserably! // FIX: Instead of copying char by char, uses sprintf/strcpy to do it. char *p; p = result; for ( i = 0; i < count - 1; i++ ) { int size; size = sprintf( p, "%s%c", strings[i], delimiter ); p += size; } strcpy( p, strings[i] ); // // // Null terminate it. // result[--result_length] = '\0'; // // // Join all strings. // char **current_string = strings; // char *current_char = current_string[0]; // for (size_t i = 0; i < result_length; i++) { // if (*current_char != '\0') { // result[i] = *current_char++; // } else { // // Reached the end of a string. Add a delimiter and move to the next one. // result[i] = delimiter; // current_string++; // current_char = current_string[0]; // } // } return result; } static char windows1252_char( uint16_t chr ) { // windows-1252 Unicode codepoints from 0x80 to 0x9f. // These 32 unicode codepoints was taken from Wikipedia: // https://en.wikipedia.org/wiki/Windows-1252 static const uint16_t w1252chrs[] = { 0x20ac, 0, // invalid 0x201a, 0x0192, 0x201e, 0x2026, 0x2020, 0x2021, 0x02c6, 0x2030, 0x0160, 0x2039, 0x0152, 0, // invalid 0x017d, 0, // invalid 0, // invalid 0x2018, 0x2019, 0x201c, 0x201d, 0x2022, 0x2013, 0x2014, 0x02dc, 0x2122, 0x0161, 0x203a, 0x0153, 0, // invalid 0x017e, 0x0178 }; // Return any char in range of ASCII or ISO-8859-1. // FIXME: 0xa0 is a 'non breaking space'. It could be converted to ' ', // but I didn't. Feel free to do it if you need. if ( chr <= 0x7f || ( chr >= 0xa0 && chr <= 0xff ) ) // if ( chr == 0xa0 ) return ' '; else return chr; // Return any char inside WINDOWS-1252 codepage range of 0x80 to 0x9f. for ( unsigned int i = 0; i < sizeof w1252chrs / sizeof w1252chrs[0]; i++ ) if ( chr == w1252chrs[i] ) return 0x80 + i; // Any other char returns 0 (to ignore). return 0; } void pe_utils_str_widechar2ascii(char *output, size_t output_size, const char *widechar, size_t widechar_count) { // FIX: Quick & dirty UFT16 to WINDOWS-1252 conversion size_t length = pe_utils_min(output_size - 1, widechar_count); uint16_t *p = (uint16_t *)widechar; while (length--) { char c = windows1252_char( *p ); // ignores "invalid" char. if ( c ) *output++ = c; p++; } *output = '\0'; } // FIX: Don't need this here. Only used in pesec.c! #if 0 int pe_utils_round_up(int num_to_round, int multiple) { if (multiple == 0) return 0; return (num_to_round + multiple - 1) / multiple * multiple; } #endif // FIXME: Don't need to open the file! // FIXME: I believe I saw the same routine inside another function in pe.c. int pe_utils_is_file_readable(const char *path) { // Open the file. const int fd = open(path, O_RDWR); if (fd == -1) { //perror("open"); return LIBPE_E_OPEN_FAILED; } // Stat the fd to retrieve the file informations. // If file is a symlink, fstat will stat the pointed file, not the link. struct stat stat; int ret = fstat(fd, &stat); if (ret == -1) { close(fd); //perror("fstat"); return LIBPE_E_FSTAT_FAILED; } // Check if we're dealing with a regular file. if (!S_ISREG(stat.st_mode)) { close(fd); //fprintf(stderr, "%s is not a file\n", path); return LIBPE_E_NOT_A_FILE; } close(fd); return LIBPE_E_OK; } // IMPORTANT: This is not thread-safe - not reentrant. const char *pe_utils_get_homedir(void) { const char *homedir = getenv("HOME"); if (homedir != NULL) return homedir; // FIXME: Instead of using getpwuid() we could use // getpwuid_r() to make this function 'thread-safe'. errno = 0; struct passwd *pwd = getpwuid(getuid()); return pwd == NULL ? NULL : pwd->pw_dir; } readpe-0.84/lib/libudis86/000077500000000000000000000000001455661113700152755ustar00rootroot00000000000000readpe-0.84/lib/libudis86/libudis86/000077500000000000000000000000001455661113700171065ustar00rootroot00000000000000readpe-0.84/lib/libudis86/libudis86/Makefile.am000066400000000000000000000016601455661113700211450ustar00rootroot00000000000000# # -- udis86/libudis86 # PYTHON = @PYTHON@ OPTABLE = @top_srcdir@/docs/x86/optable.xml MAINTAINERCLEANFILES = Makefile.in lib_LTLIBRARIES = libudis86.la libudis86_la_SOURCES = \ itab.c \ decode.c \ syn.c \ syn-intel.c \ syn-att.c \ udis86.c \ udint.h \ syn.h \ decode.h include_ladir = ${includedir}/libudis86 include_la_HEADERS = \ types.h \ extern.h \ itab.h BUILT_SOURCES = \ itab.c \ itab.h # # DLLs may not contain undefined symbol references. # We have the linker check this explicitly. # if TARGET_WINDOWS libudis86_la_LDFLAGS = -no-undefined -version-info 0:0:0 endif itab.c itab.h: $(OPTABLE) \ $(top_srcdir)/scripts/ud_itab.py \ $(top_srcdir)/scripts/ud_opcode.py \ $(top_srcdir)/scripts/ud_optable.py $(PYTHON) $(top_srcdir)/scripts/ud_itab.py $(OPTABLE) $(srcdir) clean-local: rm -rf $(BUILT_SOURCES) maintainer-clean-local: readpe-0.84/lib/libudis86/libudis86/Makefile.in000066400000000000000000000525111455661113700211570ustar00rootroot00000000000000# Makefile.in generated by automake 1.13.1 from Makefile.am. # @configure_input@ # Copyright (C) 1994-2012 Free Software Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY, to the extent permitted by law; without # even the implied warranty of MERCHANTABILITY or FITNESS FOR A # PARTICULAR PURPOSE. @SET_MAKE@ # # -- udis86/libudis86 # VPATH = @srcdir@ am__make_dryrun = \ { \ am__dry=no; \ case $$MAKEFLAGS in \ *\\[\ \ ]*) \ echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ *) \ for am__flg in $$MAKEFLAGS; do \ case $$am__flg in \ *=*|--*) ;; \ *n*) am__dry=yes; break;; \ esac; \ done;; \ esac; \ test $$am__dry = yes; \ } pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ pkglibexecdir = $(libexecdir)/@PACKAGE@ am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd install_sh_DATA = $(install_sh) -c -m 644 install_sh_PROGRAM = $(install_sh) -c install_sh_SCRIPT = $(install_sh) -c INSTALL_HEADER = $(INSTALL_DATA) transform = $(program_transform_name) NORMAL_INSTALL = : PRE_INSTALL = : POST_INSTALL = : NORMAL_UNINSTALL = : PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ subdir = libudis86 DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am \ $(top_srcdir)/build/depcomp $(include_la_HEADERS) ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 am__aclocal_m4_deps = $(top_srcdir)/build/m4/libtool.m4 \ $(top_srcdir)/build/m4/ltoptions.m4 \ $(top_srcdir)/build/m4/ltsugar.m4 \ $(top_srcdir)/build/m4/ltversion.m4 \ $(top_srcdir)/build/m4/lt~obsolete.m4 \ $(top_srcdir)/m4/ax_compare_version.m4 \ $(top_srcdir)/m4/ax_prog_sphinx_version.m4 \ $(top_srcdir)/m4/ax_prog_yasm_version.m4 \ $(top_srcdir)/m4/ax_with_prog.m4 \ $(top_srcdir)/m4/ax_with_python.m4 $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; am__vpath_adj = case $$p in \ $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ *) f=$$p;; \ esac; am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; am__install_max = 40 am__nobase_strip_setup = \ srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` am__nobase_strip = \ for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" am__nobase_list = $(am__nobase_strip_setup); \ for p in $$list; do echo "$$p $$p"; done | \ sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ if (++n[$$2] == $(am__install_max)) \ { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ END { for (dir in files) print dir, files[dir] }' am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' am__uninstall_files_from_dir = { \ test -z "$$files" \ || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ $(am__cd) "$$dir" && rm -f $$files; }; \ } am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(include_ladir)" LTLIBRARIES = $(lib_LTLIBRARIES) libudis86_la_LIBADD = am_libudis86_la_OBJECTS = itab.lo decode.lo syn.lo syn-intel.lo \ syn-att.lo udis86.lo libudis86_la_OBJECTS = $(am_libudis86_la_OBJECTS) AM_V_lt = $(am__v_lt_@AM_V@) am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) am__v_lt_0 = --silent am__v_lt_1 = libudis86_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(libudis86_la_LDFLAGS) $(LDFLAGS) -o $@ AM_V_P = $(am__v_P_@AM_V@) am__v_P_ = $(am__v_P_@AM_DEFAULT_V@) am__v_P_0 = false am__v_P_1 = : AM_V_GEN = $(am__v_GEN_@AM_V@) am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) am__v_GEN_0 = @echo " GEN " $@; am__v_GEN_1 = AM_V_at = $(am__v_at_@AM_V@) am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) am__v_at_0 = @ am__v_at_1 = DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/build/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ $(AM_CFLAGS) $(CFLAGS) AM_V_CC = $(am__v_CC_@AM_V@) am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) am__v_CC_0 = @echo " CC " $@; am__v_CC_1 = CCLD = $(CC) LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(AM_LDFLAGS) $(LDFLAGS) -o $@ AM_V_CCLD = $(am__v_CCLD_@AM_V@) am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) am__v_CCLD_0 = @echo " CCLD " $@; am__v_CCLD_1 = SOURCES = $(libudis86_la_SOURCES) DIST_SOURCES = $(libudis86_la_SOURCES) am__can_run_installinfo = \ case $$AM_UPDATE_INFO_DIR in \ n|no|NO) false;; \ *) (install-info --version) >/dev/null 2>&1;; \ esac HEADERS = $(include_la_HEADERS) am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP) # Read a list of newline-separated strings from the standard input, # and print each of them once, without duplicates. Input order is # *not* preserved. am__uniquify_input = $(AWK) '\ BEGIN { nonempty = 0; } \ { items[$$0] = 1; nonempty = 1; } \ END { if (nonempty) { for (i in items) print i; }; } \ ' # Make sure the list of sources is unique. This is necessary because, # e.g., the same source file might be shared among _SOURCES variables # for different programs/libraries. am__define_uniq_tagged_files = \ list='$(am__tagged_files)'; \ unique=`for i in $$list; do \ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ done | $(am__uniquify_input)` ETAGS = etags CTAGS = ctags DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ACLOCAL_AMFLAGS = @ACLOCAL_AMFLAGS@ AMTAR = @AMTAR@ AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AS = @AS@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ ECHO_N = @ECHO_N@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ LD = @LD@ LDFLAGS = @LDFLAGS@ LIBOBJS = @LIBOBJS@ LIBS = @LIBS@ LIBTOOL = @LIBTOOL@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ NM = @NM@ NMEDIT = @NMEDIT@ OBJDUMP = @OBJDUMP@ OBJEXT = @OBJEXT@ OTOOL = @OTOOL@ OTOOL64 = @OTOOL64@ PACKAGE = @PACKAGE@ PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ PACKAGE_NAME = @PACKAGE_NAME@ PACKAGE_STRING = @PACKAGE_STRING@ PACKAGE_TARNAME = @PACKAGE_TARNAME@ PACKAGE_URL = @PACKAGE_URL@ PACKAGE_VERSION = @PACKAGE_VERSION@ PATH_SEPARATOR = @PATH_SEPARATOR@ PYTHON = @PYTHON@ RANLIB = @RANLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SPHINX_BUILD = @SPHINX_BUILD@ SPHINX_VERSION = @SPHINX_VERSION@ STRIP = @STRIP@ VERSION = @VERSION@ YASM = @YASM@ YASM_VERSION = @YASM_VERSION@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ am__leading_dot = @am__leading_dot@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ build_cpu = @build_cpu@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ datadir = @datadir@ datarootdir = @datarootdir@ docdir = @docdir@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ host = @host@ host_alias = @host_alias@ host_cpu = @host_cpu@ host_os = @host_os@ host_vendor = @host_vendor@ htmldir = @htmldir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ libdir = @libdir@ libexecdir = @libexecdir@ localedir = @localedir@ localstatedir = @localstatedir@ mandir = @mandir@ mkdir_p = @mkdir_p@ oldincludedir = @oldincludedir@ pdfdir = @pdfdir@ prefix = @prefix@ program_transform_name = @program_transform_name@ psdir = @psdir@ sbindir = @sbindir@ sharedstatedir = @sharedstatedir@ srcdir = @srcdir@ sysconfdir = @sysconfdir@ target_alias = @target_alias@ top_build_prefix = @top_build_prefix@ top_builddir = @top_builddir@ top_srcdir = @top_srcdir@ OPTABLE = @top_srcdir@/docs/x86/optable.xml MAINTAINERCLEANFILES = Makefile.in lib_LTLIBRARIES = libudis86.la libudis86_la_SOURCES = \ itab.c \ decode.c \ syn.c \ syn-intel.c \ syn-att.c \ udis86.c \ udint.h \ syn.h \ decode.h include_ladir = ${includedir}/libudis86 include_la_HEADERS = \ types.h \ extern.h \ itab.h BUILT_SOURCES = \ itab.c \ itab.h # # DLLs may not contain undefined symbol references. # We have the linker check this explicitly. # @TARGET_WINDOWS_TRUE@libudis86_la_LDFLAGS = -no-undefined -version-info 0:0:0 all: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) all-am .SUFFIXES: .SUFFIXES: .c .lo .o .obj $(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) @for dep in $?; do \ case '$(am__configure_deps)' in \ *$$dep*) \ ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ && { if test -f $@; then exit 0; else break; fi; }; \ exit 1;; \ esac; \ done; \ echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign libudis86/Makefile'; \ $(am__cd) $(top_srcdir) && \ $(AUTOMAKE) --foreign libudis86/Makefile .PRECIOUS: Makefile Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status @case '$?' in \ *config.status*) \ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ *) \ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ esac; $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(top_srcdir)/configure: $(am__configure_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(ACLOCAL_M4): $(am__aclocal_m4_deps) cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh $(am__aclocal_m4_deps): install-libLTLIBRARIES: $(lib_LTLIBRARIES) @$(NORMAL_INSTALL) @list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ list2="$$list2 $$p"; \ else :; fi; \ done; \ test -z "$$list2" || { \ echo " $(MKDIR_P) '$(DESTDIR)$(libdir)'"; \ $(MKDIR_P) "$(DESTDIR)$(libdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \ } uninstall-libLTLIBRARIES: @$(NORMAL_UNINSTALL) @list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \ for p in $$list; do \ $(am__strip_dir) \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \ done clean-libLTLIBRARIES: -test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES) @list='$(lib_LTLIBRARIES)'; \ locs=`for p in $$list; do echo $$p; done | \ sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \ sort -u`; \ test -z "$$locs" || { \ echo rm -f $${locs}; \ rm -f $${locs}; \ } libudis86.la: $(libudis86_la_OBJECTS) $(libudis86_la_DEPENDENCIES) $(EXTRA_libudis86_la_DEPENDENCIES) $(AM_V_CCLD)$(libudis86_la_LINK) -rpath $(libdir) $(libudis86_la_OBJECTS) $(libudis86_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/decode.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/itab.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/syn-att.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/syn-intel.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/syn.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/udis86.Plo@am__quote@ .c.o: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: @am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: @am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo @AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo clean-libtool: -rm -rf .libs _libs install-include_laHEADERS: $(include_la_HEADERS) @$(NORMAL_INSTALL) @list='$(include_la_HEADERS)'; test -n "$(include_ladir)" || list=; \ if test -n "$$list"; then \ echo " $(MKDIR_P) '$(DESTDIR)$(include_ladir)'"; \ $(MKDIR_P) "$(DESTDIR)$(include_ladir)" || exit 1; \ fi; \ for p in $$list; do \ if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ echo "$$d$$p"; \ done | $(am__base_list) | \ while read files; do \ echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(include_ladir)'"; \ $(INSTALL_HEADER) $$files "$(DESTDIR)$(include_ladir)" || exit $$?; \ done uninstall-include_laHEADERS: @$(NORMAL_UNINSTALL) @list='$(include_la_HEADERS)'; test -n "$(include_ladir)" || list=; \ files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \ dir='$(DESTDIR)$(include_ladir)'; $(am__uninstall_files_from_dir) ID: $(am__tagged_files) $(am__define_uniq_tagged_files); mkid -fID $$unique tags: tags-am TAGS: tags tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) set x; \ here=`pwd`; \ $(am__define_uniq_tagged_files); \ shift; \ if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ test -n "$$unique" || unique=$$empty_fix; \ if test $$# -gt 0; then \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ "$$@" $$unique; \ else \ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ $$unique; \ fi; \ fi ctags: ctags-am CTAGS: ctags ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files) $(am__define_uniq_tagged_files); \ test -z "$(CTAGS_ARGS)$$unique" \ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ $$unique GTAGS: here=`$(am__cd) $(top_builddir) && pwd` \ && $(am__cd) $(top_srcdir) \ && gtags -i $(GTAGS_ARGS) "$$here" cscopelist: cscopelist-am cscopelist-am: $(am__tagged_files) list='$(am__tagged_files)'; \ case "$(srcdir)" in \ [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \ *) sdir=$(subdir)/$(srcdir) ;; \ esac; \ for i in $$list; do \ if test -f "$$i"; then \ echo "$(subdir)/$$i"; \ else \ echo "$$sdir/$$i"; \ fi; \ done >> $(top_builddir)/cscope.files distclean-tags: -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags distdir: $(DISTFILES) @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ list='$(DISTFILES)'; \ dist_files=`for file in $$list; do echo $$file; done | \ sed -e "s|^$$srcdirstrip/||;t" \ -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ case $$dist_files in \ */*) $(MKDIR_P) `echo "$$dist_files" | \ sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ sort -u` ;; \ esac; \ for file in $$dist_files; do \ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ if test -d $$d/$$file; then \ dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ if test -d "$(distdir)/$$file"; then \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ fi; \ cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ else \ test -f "$(distdir)/$$file" \ || cp -p $$d/$$file "$(distdir)/$$file" \ || exit 1; \ fi; \ done check-am: all-am check: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) check-am all-am: Makefile $(LTLIBRARIES) $(HEADERS) installdirs: for dir in "$(DESTDIR)$(libdir)" "$(DESTDIR)$(include_ladir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: $(BUILT_SOURCES) $(MAKE) $(AM_MAKEFLAGS) install-am install-exec: install-exec-am install-data: install-data-am uninstall: uninstall-am install-am: all-am @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am installcheck: installcheck-am install-strip: if test -z '$(STRIP)'; then \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ install; \ else \ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ fi mostlyclean-generic: clean-generic: distclean-generic: -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." -test -z "$(BUILT_SOURCES)" || rm -f $(BUILT_SOURCES) -test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES) clean: clean-am clean-am: clean-generic clean-libLTLIBRARIES clean-libtool clean-local \ mostlyclean-am distclean: distclean-am -rm -rf ./$(DEPDIR) -rm -f Makefile distclean-am: clean-am distclean-compile distclean-generic \ distclean-tags dvi: dvi-am dvi-am: html: html-am html-am: info: info-am info-am: install-data-am: install-include_laHEADERS install-dvi: install-dvi-am install-dvi-am: install-exec-am: install-libLTLIBRARIES install-html: install-html-am install-html-am: install-info: install-info-am install-info-am: install-man: install-pdf: install-pdf-am install-pdf-am: install-ps: install-ps-am install-ps-am: installcheck-am: maintainer-clean: maintainer-clean-am -rm -rf ./$(DEPDIR) -rm -f Makefile maintainer-clean-am: distclean-am maintainer-clean-generic \ maintainer-clean-local mostlyclean: mostlyclean-am mostlyclean-am: mostlyclean-compile mostlyclean-generic \ mostlyclean-libtool pdf: pdf-am pdf-am: ps: ps-am ps-am: uninstall-am: uninstall-include_laHEADERS uninstall-libLTLIBRARIES .MAKE: all check install install-am install-strip .PHONY: CTAGS GTAGS TAGS all all-am check check-am clean clean-generic \ clean-libLTLIBRARIES clean-libtool clean-local cscopelist-am \ ctags ctags-am distclean distclean-compile distclean-generic \ distclean-libtool distclean-tags distdir dvi dvi-am html \ html-am info info-am install install-am install-data \ install-data-am install-dvi install-dvi-am install-exec \ install-exec-am install-html install-html-am \ install-include_laHEADERS install-info install-info-am \ install-libLTLIBRARIES install-man install-pdf install-pdf-am \ install-ps install-ps-am install-strip installcheck \ installcheck-am installdirs maintainer-clean \ maintainer-clean-generic maintainer-clean-local mostlyclean \ mostlyclean-compile mostlyclean-generic mostlyclean-libtool \ pdf pdf-am ps ps-am tags tags-am uninstall uninstall-am \ uninstall-include_laHEADERS uninstall-libLTLIBRARIES itab.c itab.h: $(OPTABLE) \ $(top_srcdir)/scripts/ud_itab.py \ $(top_srcdir)/scripts/ud_opcode.py \ $(top_srcdir)/scripts/ud_optable.py $(PYTHON) $(top_srcdir)/scripts/ud_itab.py $(OPTABLE) $(srcdir) clean-local: rm -rf $(BUILT_SOURCES) maintainer-clean-local: # Tell versions [3.59,3.63) of GNU make to not export all variables. # Otherwise a system limit (for SysV at least) may be exceeded. .NOEXPORT: readpe-0.84/lib/libudis86/libudis86/decode.c000066400000000000000000000654141455661113700205070ustar00rootroot00000000000000/* udis86 - libudis86/decode.c * * Copyright (c) 2002-2009 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "udint.h" #include "types.h" #include "decode.h" #ifndef __UD_STANDALONE__ # include #endif /* __UD_STANDALONE__ */ /* The max number of prefixes to an instruction */ #define MAX_PREFIXES 15 /* rex prefix bits */ #define REX_W(r) ( ( 0xF & ( r ) ) >> 3 ) #define REX_R(r) ( ( 0x7 & ( r ) ) >> 2 ) #define REX_X(r) ( ( 0x3 & ( r ) ) >> 1 ) #define REX_B(r) ( ( 0x1 & ( r ) ) >> 0 ) #define REX_PFX_MASK(n) ( ( P_REXW(n) << 3 ) | \ ( P_REXR(n) << 2 ) | \ ( P_REXX(n) << 1 ) | \ ( P_REXB(n) << 0 ) ) /* scable-index-base bits */ #define SIB_S(b) ( ( b ) >> 6 ) #define SIB_I(b) ( ( ( b ) >> 3 ) & 7 ) #define SIB_B(b) ( ( b ) & 7 ) /* modrm bits */ #define MODRM_REG(b) ( ( ( b ) >> 3 ) & 7 ) #define MODRM_NNN(b) ( ( ( b ) >> 3 ) & 7 ) #define MODRM_MOD(b) ( ( ( b ) >> 6 ) & 3 ) #define MODRM_RM(b) ( ( b ) & 7 ) static int decode_ext(struct ud *u, uint16_t ptr); enum reg_class { /* register classes */ REGCLASS_GPR, REGCLASS_MMX, REGCLASS_CR, REGCLASS_DB, REGCLASS_SEG, REGCLASS_XMM }; /* * inp_start * Should be called before each de-code operation. */ static void inp_start(struct ud *u) { u->inp_ctr = 0; } static uint8_t inp_next(struct ud *u) { if (u->inp_end == 0) { if (u->inp_buf != NULL) { if (u->inp_buf_index < u->inp_buf_size) { u->inp_ctr++; return (u->inp_curr = u->inp_buf[u->inp_buf_index++]); } } else { int c; if ((c = u->inp_hook(u)) != UD_EOI) { u->inp_curr = c; u->inp_sess[u->inp_ctr++] = u->inp_curr; return u->inp_curr; } } } u->inp_end = 1; UDERR(u, "byte expected, eoi received\n"); return 0; } static uint8_t inp_curr(struct ud *u) { return u->inp_curr; } /* * inp_uint8 * int_uint16 * int_uint32 * int_uint64 * Load little-endian values from input */ static uint8_t inp_uint8(struct ud* u) { return inp_next(u); } static uint16_t inp_uint16(struct ud* u) { uint16_t r, ret; ret = inp_next(u); r = inp_next(u); return ret | (r << 8); } static uint32_t inp_uint32(struct ud* u) { uint32_t r, ret; ret = inp_next(u); r = inp_next(u); ret = ret | (r << 8); r = inp_next(u); ret = ret | (r << 16); r = inp_next(u); return ret | (r << 24); } static uint64_t inp_uint64(struct ud* u) { uint64_t r, ret; ret = inp_next(u); r = inp_next(u); ret = ret | (r << 8); r = inp_next(u); ret = ret | (r << 16); r = inp_next(u); ret = ret | (r << 24); r = inp_next(u); ret = ret | (r << 32); r = inp_next(u); ret = ret | (r << 40); r = inp_next(u); ret = ret | (r << 48); r = inp_next(u); return ret | (r << 56); } static inline int eff_opr_mode(int dis_mode, int rex_w, int pfx_opr) { if (dis_mode == 64) { return rex_w ? 64 : (pfx_opr ? 16 : 32); } else if (dis_mode == 32) { return pfx_opr ? 16 : 32; } else { UD_ASSERT(dis_mode == 16); return pfx_opr ? 32 : 16; } } static inline int eff_adr_mode(int dis_mode, int pfx_adr) { if (dis_mode == 64) { return pfx_adr ? 32 : 64; } else if (dis_mode == 32) { return pfx_adr ? 16 : 32; } else { UD_ASSERT(dis_mode == 16); return pfx_adr ? 32 : 16; } } /* * decode_prefixes * * Extracts instruction prefixes. */ static int decode_prefixes(struct ud *u) { int done = 0; uint8_t curr = 0, last = 0; UD_RETURN_ON_ERROR(u); do { last = curr; curr = inp_next(u); UD_RETURN_ON_ERROR(u); if (u->inp_ctr == MAX_INSN_LENGTH) { UD_RETURN_WITH_ERROR(u, "max instruction length"); } switch (curr) { case 0x2E: u->pfx_seg = UD_R_CS; break; case 0x36: u->pfx_seg = UD_R_SS; break; case 0x3E: u->pfx_seg = UD_R_DS; break; case 0x26: u->pfx_seg = UD_R_ES; break; case 0x64: u->pfx_seg = UD_R_FS; break; case 0x65: u->pfx_seg = UD_R_GS; break; case 0x67: /* adress-size override prefix */ u->pfx_adr = 0x67; break; case 0xF0: u->pfx_lock = 0xF0; break; case 0x66: u->pfx_opr = 0x66; break; case 0xF2: u->pfx_str = 0xf2; break; case 0xF3: u->pfx_str = 0xf3; break; default: /* consume if rex */ done = (u->dis_mode == 64 && (curr & 0xF0) == 0x40) ? 0 : 1; break; } } while (!done); /* rex prefixes in 64bit mode, must be the last prefix */ if (u->dis_mode == 64 && (last & 0xF0) == 0x40) { u->pfx_rex = last; } return 0; } static inline unsigned int modrm( struct ud * u ) { if ( !u->have_modrm ) { u->modrm = inp_next( u ); u->have_modrm = 1; } return u->modrm; } static unsigned int resolve_operand_size( const struct ud * u, unsigned int s ) { switch ( s ) { case SZ_V: return ( u->opr_mode ); case SZ_Z: return ( u->opr_mode == 16 ) ? 16 : 32; case SZ_Y: return ( u->opr_mode == 16 ) ? 32 : u->opr_mode; case SZ_RDQ: return ( u->dis_mode == 64 ) ? 64 : 32; default: return s; } } static int resolve_mnemonic( struct ud* u ) { /* resolve 3dnow weirdness. */ if ( u->mnemonic == UD_I3dnow ) { u->mnemonic = ud_itab[ u->le->table[ inp_curr( u ) ] ].mnemonic; } /* SWAPGS is only valid in 64bits mode */ if ( u->mnemonic == UD_Iswapgs && u->dis_mode != 64 ) { UDERR(u, "swapgs invalid in 64bits mode\n"); return -1; } if (u->mnemonic == UD_Ixchg) { if ((u->operand[0].type == UD_OP_REG && u->operand[0].base == UD_R_AX && u->operand[1].type == UD_OP_REG && u->operand[1].base == UD_R_AX) || (u->operand[0].type == UD_OP_REG && u->operand[0].base == UD_R_EAX && u->operand[1].type == UD_OP_REG && u->operand[1].base == UD_R_EAX)) { u->operand[0].type = UD_NONE; u->operand[1].type = UD_NONE; u->mnemonic = UD_Inop; } } if (u->mnemonic == UD_Inop && u->pfx_repe) { u->pfx_repe = 0; u->mnemonic = UD_Ipause; } return 0; } /* ----------------------------------------------------------------------------- * decode_a()- Decodes operands of the type seg:offset * ----------------------------------------------------------------------------- */ static void decode_a(struct ud* u, struct ud_operand *op) { if (u->opr_mode == 16) { /* seg16:off16 */ op->type = UD_OP_PTR; op->size = 32; op->lval.ptr.off = inp_uint16(u); op->lval.ptr.seg = inp_uint16(u); } else { /* seg16:off32 */ op->type = UD_OP_PTR; op->size = 48; op->lval.ptr.off = inp_uint32(u); op->lval.ptr.seg = inp_uint16(u); } } /* ----------------------------------------------------------------------------- * decode_gpr() - Returns decoded General Purpose Register * ----------------------------------------------------------------------------- */ static enum ud_type decode_gpr(register struct ud* u, unsigned int s, unsigned char rm) { switch (s) { case 64: return UD_R_RAX + rm; case 32: return UD_R_EAX + rm; case 16: return UD_R_AX + rm; case 8: if (u->dis_mode == 64 && u->pfx_rex) { if (rm >= 4) return UD_R_SPL + (rm-4); return UD_R_AL + rm; } else return UD_R_AL + rm; case 0: /* invalid size in case of a decode error */ UD_ASSERT(u->error); return UD_NONE; default: UD_ASSERT(!"invalid operand size"); return UD_NONE; } } static void decode_reg(struct ud *u, struct ud_operand *opr, int type, int num, int size) { int reg; size = resolve_operand_size(u, size); switch (type) { case REGCLASS_GPR : reg = decode_gpr(u, size, num); break; case REGCLASS_MMX : reg = UD_R_MM0 + (num & 7); break; case REGCLASS_XMM : reg = UD_R_XMM0 + num; break; case REGCLASS_CR : reg = UD_R_CR0 + num; break; case REGCLASS_DB : reg = UD_R_DR0 + num; break; case REGCLASS_SEG : { /* * Only 6 segment registers, anything else is an error. */ if ((num & 7) > 5) { UDERR(u, "invalid segment register value\n"); return; } else { reg = UD_R_ES + (num & 7); } break; } default: UD_ASSERT(!"invalid register type"); return; } opr->type = UD_OP_REG; opr->base = reg; opr->size = size; } /* * decode_imm * * Decode Immediate values. */ static void decode_imm(struct ud* u, unsigned int size, struct ud_operand *op) { op->size = resolve_operand_size(u, size); op->type = UD_OP_IMM; switch (op->size) { case 8: op->lval.sbyte = inp_uint8(u); break; case 16: op->lval.uword = inp_uint16(u); break; case 32: op->lval.udword = inp_uint32(u); break; case 64: op->lval.uqword = inp_uint64(u); break; default: return; } } /* * decode_mem_disp * * Decode mem address displacement. */ static void decode_mem_disp(struct ud* u, unsigned int size, struct ud_operand *op) { switch (size) { case 8: op->offset = 8; op->lval.ubyte = inp_uint8(u); break; case 16: op->offset = 16; op->lval.uword = inp_uint16(u); break; case 32: op->offset = 32; op->lval.udword = inp_uint32(u); break; case 64: op->offset = 64; op->lval.uqword = inp_uint64(u); break; default: return; } } /* * decode_modrm_reg * * Decodes reg field of mod/rm byte * */ static inline void decode_modrm_reg(struct ud *u, struct ud_operand *operand, unsigned int type, unsigned int size) { uint8_t reg = (REX_R(u->pfx_rex) << 3) | MODRM_REG(modrm(u)); decode_reg(u, operand, type, reg, size); } /* * decode_modrm_rm * * Decodes rm field of mod/rm byte * */ static void decode_modrm_rm(struct ud *u, struct ud_operand *op, unsigned char type, /* register type */ unsigned int size) /* operand size */ { size_t offset = 0; unsigned char mod, rm; /* get mod, r/m and reg fields */ mod = MODRM_MOD(modrm(u)); rm = (REX_B(u->pfx_rex) << 3) | MODRM_RM(modrm(u)); /* * If mod is 11b, then the modrm.rm specifies a register. * */ if (mod == 3) { decode_reg(u, op, type, rm, size); return; } /* * !11b => Memory Address */ op->type = UD_OP_MEM; op->size = resolve_operand_size(u, size); if (u->adr_mode == 64) { op->base = UD_R_RAX + rm; if (mod == 1) { offset = 8; } else if (mod == 2) { offset = 32; } else if (mod == 0 && (rm & 7) == 5) { op->base = UD_R_RIP; offset = 32; } else { offset = 0; } /* * Scale-Index-Base (SIB) */ if ((rm & 7) == 4) { inp_next(u); op->scale = (1 << SIB_S(inp_curr(u))) & ~1; op->index = UD_R_RAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3)); op->base = UD_R_RAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3)); /* special conditions for base reference */ if (op->index == UD_R_RSP) { op->index = UD_NONE; op->scale = UD_NONE; } if (op->base == UD_R_RBP || op->base == UD_R_R13) { if (mod == 0) { op->base = UD_NONE; } if (mod == 1) { offset = 8; } else { offset = 32; } } } } else if (u->adr_mode == 32) { op->base = UD_R_EAX + rm; if (mod == 1) { offset = 8; } else if (mod == 2) { offset = 32; } else if (mod == 0 && rm == 5) { op->base = UD_NONE; offset = 32; } else { offset = 0; } /* Scale-Index-Base (SIB) */ if ((rm & 7) == 4) { inp_next(u); op->scale = (1 << SIB_S(inp_curr(u))) & ~1; op->index = UD_R_EAX + (SIB_I(inp_curr(u)) | (REX_X(u->pfx_rex) << 3)); op->base = UD_R_EAX + (SIB_B(inp_curr(u)) | (REX_B(u->pfx_rex) << 3)); if (op->index == UD_R_ESP) { op->index = UD_NONE; op->scale = UD_NONE; } /* special condition for base reference */ if (op->base == UD_R_EBP) { if (mod == 0) { op->base = UD_NONE; } if (mod == 1) { offset = 8; } else { offset = 32; } } } } else { const unsigned int bases[] = { UD_R_BX, UD_R_BX, UD_R_BP, UD_R_BP, UD_R_SI, UD_R_DI, UD_R_BP, UD_R_BX }; const unsigned int indices[] = { UD_R_SI, UD_R_DI, UD_R_SI, UD_R_DI, UD_NONE, UD_NONE, UD_NONE, UD_NONE }; op->base = bases[rm & 7]; op->index = indices[rm & 7]; if (mod == 0 && rm == 6) { offset = 16; op->base = UD_NONE; } else if (mod == 1) { offset = 8; } else if (mod == 2) { offset = 16; } } if (offset) { decode_mem_disp(u, offset, op); } } /* * decode_moffset * Decode offset-only memory operand */ static void decode_moffset(struct ud *u, unsigned int size, struct ud_operand *opr) { opr->type = UD_OP_MEM; opr->size = resolve_operand_size(u, size); decode_mem_disp(u, u->adr_mode, opr); } /* ----------------------------------------------------------------------------- * decode_operands() - Disassembles Operands. * ----------------------------------------------------------------------------- */ static int decode_operand(struct ud *u, struct ud_operand *operand, enum ud_operand_code type, unsigned int size) { operand->_oprcode = type; switch (type) { case OP_A : decode_a(u, operand); break; case OP_MR: decode_modrm_rm(u, operand, REGCLASS_GPR, MODRM_MOD(modrm(u)) == 3 ? Mx_reg_size(size) : Mx_mem_size(size)); break; case OP_F: u->br_far = 1; /* intended fall through */ case OP_M: if (MODRM_MOD(modrm(u)) == 3) { UDERR(u, "expected modrm.mod != 3\n"); } /* intended fall through */ case OP_E: decode_modrm_rm(u, operand, REGCLASS_GPR, size); break; case OP_G: decode_modrm_reg(u, operand, REGCLASS_GPR, size); break; case OP_sI: case OP_I: decode_imm(u, size, operand); break; case OP_I1: operand->type = UD_OP_CONST; operand->lval.udword = 1; break; case OP_N: if (MODRM_MOD(modrm(u)) != 3) { UDERR(u, "expected modrm.mod == 3\n"); } /* intended fall through */ case OP_Q: decode_modrm_rm(u, operand, REGCLASS_MMX, size); break; case OP_P: decode_modrm_reg(u, operand, REGCLASS_MMX, size); break; case OP_U: if (MODRM_MOD(modrm(u)) != 3) { UDERR(u, "expected modrm.mod == 3\n"); } /* intended fall through */ case OP_W: decode_modrm_rm(u, operand, REGCLASS_XMM, size); break; case OP_V: decode_modrm_reg(u, operand, REGCLASS_XMM, size); break; case OP_MU: decode_modrm_rm(u, operand, REGCLASS_XMM, MODRM_MOD(modrm(u)) == 3 ? Mx_reg_size(size) : Mx_mem_size(size)); break; case OP_S: decode_modrm_reg(u, operand, REGCLASS_SEG, size); break; case OP_O: decode_moffset(u, size, operand); break; case OP_R0: case OP_R1: case OP_R2: case OP_R3: case OP_R4: case OP_R5: case OP_R6: case OP_R7: decode_reg(u, operand, REGCLASS_GPR, (REX_B(u->pfx_rex) << 3) | (type - OP_R0), size); break; case OP_AL: case OP_AX: case OP_eAX: case OP_rAX: decode_reg(u, operand, REGCLASS_GPR, 0, size); break; case OP_CL: case OP_CX: case OP_eCX: decode_reg(u, operand, REGCLASS_GPR, 1, size); break; case OP_DL: case OP_DX: case OP_eDX: decode_reg(u, operand, REGCLASS_GPR, 2, size); break; case OP_ES: case OP_CS: case OP_DS: case OP_SS: case OP_FS: case OP_GS: /* in 64bits mode, only fs and gs are allowed */ if (u->dis_mode == 64) { if (type != OP_FS && type != OP_GS) { UDERR(u, "invalid segment register in 64bits\n"); } } operand->type = UD_OP_REG; operand->base = (type - OP_ES) + UD_R_ES; operand->size = 16; break; case OP_J : decode_imm(u, size, operand); operand->type = UD_OP_JIMM; break ; case OP_R : if (MODRM_MOD(modrm(u)) != 3) { UDERR(u, "expected modrm.mod == 3\n"); } decode_modrm_rm(u, operand, REGCLASS_GPR, size); break; case OP_C: decode_modrm_reg(u, operand, REGCLASS_CR, size); break; case OP_D: decode_modrm_reg(u, operand, REGCLASS_DB, size); break; case OP_I3 : operand->type = UD_OP_CONST; operand->lval.sbyte = 3; break; case OP_ST0: case OP_ST1: case OP_ST2: case OP_ST3: case OP_ST4: case OP_ST5: case OP_ST6: case OP_ST7: operand->type = UD_OP_REG; operand->base = (type - OP_ST0) + UD_R_ST0; operand->size = 80; break; default : break; } return 0; } /* * decode_operands * * Disassemble upto 3 operands of the current instruction being * disassembled. By the end of the function, the operand fields * of the ud structure will have been filled. */ static int decode_operands(struct ud* u) { decode_operand(u, &u->operand[0], u->itab_entry->operand1.type, u->itab_entry->operand1.size); decode_operand(u, &u->operand[1], u->itab_entry->operand2.type, u->itab_entry->operand2.size); decode_operand(u, &u->operand[2], u->itab_entry->operand3.type, u->itab_entry->operand3.size); return 0; } /* ----------------------------------------------------------------------------- * clear_insn() - clear instruction structure * ----------------------------------------------------------------------------- */ static void clear_insn(register struct ud* u) { u->error = 0; u->pfx_seg = 0; u->pfx_opr = 0; u->pfx_adr = 0; u->pfx_lock = 0; u->pfx_repne = 0; u->pfx_rep = 0; u->pfx_repe = 0; u->pfx_rex = 0; u->pfx_str = 0; u->mnemonic = UD_Inone; u->itab_entry = NULL; u->have_modrm = 0; u->br_far = 0; memset( &u->operand[ 0 ], 0, sizeof( struct ud_operand ) ); memset( &u->operand[ 1 ], 0, sizeof( struct ud_operand ) ); memset( &u->operand[ 2 ], 0, sizeof( struct ud_operand ) ); } static inline int resolve_pfx_str(struct ud* u) { if (u->pfx_str == 0xf3) { if (P_STR(u->itab_entry->prefix)) { u->pfx_rep = 0xf3; } else { u->pfx_repe = 0xf3; } } else if (u->pfx_str == 0xf2) { u->pfx_repne = 0xf3; } return 0; } static int resolve_mode( struct ud* u ) { int default64; /* if in error state, bail out */ if ( u->error ) return -1; /* propagate prefix effects */ if ( u->dis_mode == 64 ) { /* set 64bit-mode flags */ /* Check validity of instruction m64 */ if ( P_INV64( u->itab_entry->prefix ) ) { UDERR(u, "instruction invalid in 64bits\n"); return -1; } /* effective rex prefix is the effective mask for the * instruction hard-coded in the opcode map. */ u->pfx_rex = ( u->pfx_rex & 0x40 ) | ( u->pfx_rex & REX_PFX_MASK( u->itab_entry->prefix ) ); /* whether this instruction has a default operand size of * 64bit, also hardcoded into the opcode map. */ default64 = P_DEF64( u->itab_entry->prefix ); /* calculate effective operand size */ if ( REX_W( u->pfx_rex ) ) { u->opr_mode = 64; } else if ( u->pfx_opr ) { u->opr_mode = 16; } else { /* unless the default opr size of instruction is 64, * the effective operand size in the absence of rex.w * prefix is 32. */ u->opr_mode = default64 ? 64 : 32; } /* calculate effective address size */ u->adr_mode = (u->pfx_adr) ? 32 : 64; } else if ( u->dis_mode == 32 ) { /* set 32bit-mode flags */ u->opr_mode = ( u->pfx_opr ) ? 16 : 32; u->adr_mode = ( u->pfx_adr ) ? 16 : 32; } else if ( u->dis_mode == 16 ) { /* set 16bit-mode flags */ u->opr_mode = ( u->pfx_opr ) ? 32 : 16; u->adr_mode = ( u->pfx_adr ) ? 32 : 16; } return 0; } static inline int decode_insn(struct ud *u, uint16_t ptr) { UD_ASSERT((ptr & 0x8000) == 0); u->itab_entry = &ud_itab[ ptr ]; u->mnemonic = u->itab_entry->mnemonic; return (resolve_pfx_str(u) == 0 && resolve_mode(u) == 0 && decode_operands(u) == 0 && resolve_mnemonic(u) == 0) ? 0 : -1; } /* * decode_3dnow() * * Decoding 3dnow is a little tricky because of its strange opcode * structure. The final opcode disambiguation depends on the last * byte that comes after the operands have been decoded. Fortunately, * all 3dnow instructions have the same set of operand types. So we * go ahead and decode the instruction by picking an arbitrarily chosen * valid entry in the table, decode the operands, and read the final * byte to resolve the menmonic. */ static inline int decode_3dnow(struct ud* u) { uint16_t ptr; UD_ASSERT(u->le->type == UD_TAB__OPC_3DNOW); UD_ASSERT(u->le->table[0xc] != 0); decode_insn(u, u->le->table[0xc]); inp_next(u); if (u->error) { return -1; } ptr = u->le->table[inp_curr(u)]; UD_ASSERT((ptr & 0x8000) == 0); u->mnemonic = ud_itab[ptr].mnemonic; return 0; } static int decode_ssepfx(struct ud *u) { uint8_t idx; uint8_t pfx; /* * String prefixes (f2, f3) take precedence over operand * size prefix (66). */ pfx = u->pfx_str; if (pfx == 0) { pfx = u->pfx_opr; } idx = ((pfx & 0xf) + 1) / 2; if (u->le->table[idx] == 0) { idx = 0; } if (idx && u->le->table[idx] != 0) { /* * "Consume" the prefix as a part of the opcode, so it is no * longer exported as an instruction prefix. */ u->pfx_str = 0; if (pfx == 0x66) { /* * consume "66" only if it was used for decoding, leaving * it to be used as an operands size override for some * simd instructions. */ u->pfx_opr = 0; } } return decode_ext(u, u->le->table[idx]); } /* * decode_ext() * * Decode opcode extensions (if any) */ static int decode_ext(struct ud *u, uint16_t ptr) { uint8_t idx = 0; if ((ptr & 0x8000) == 0) { return decode_insn(u, ptr); } u->le = &ud_lookup_table_list[(~0x8000 & ptr)]; if (u->le->type == UD_TAB__OPC_3DNOW) { return decode_3dnow(u); } switch (u->le->type) { case UD_TAB__OPC_MOD: /* !11 = 0, 11 = 1 */ idx = (MODRM_MOD(modrm(u)) + 1) / 4; break; /* disassembly mode/operand size/address size based tables. * 16 = 0,, 32 = 1, 64 = 2 */ case UD_TAB__OPC_MODE: idx = u->dis_mode != 64 ? 0 : 1; break; case UD_TAB__OPC_OSIZE: idx = eff_opr_mode(u->dis_mode, REX_W(u->pfx_rex), u->pfx_opr) / 32; break; case UD_TAB__OPC_ASIZE: idx = eff_adr_mode(u->dis_mode, u->pfx_adr) / 32; break; case UD_TAB__OPC_X87: idx = modrm(u) - 0xC0; break; case UD_TAB__OPC_VENDOR: if (u->vendor == UD_VENDOR_ANY) { /* choose a valid entry */ idx = (u->le->table[idx] != 0) ? 0 : 1; } else if (u->vendor == UD_VENDOR_AMD) { idx = 0; } else { idx = 1; } break; case UD_TAB__OPC_RM: idx = MODRM_RM(modrm(u)); break; case UD_TAB__OPC_REG: idx = MODRM_REG(modrm(u)); break; case UD_TAB__OPC_SSE: return decode_ssepfx(u); default: UD_ASSERT(!"not reached"); break; } return decode_ext(u, u->le->table[idx]); } static int decode_opcode(struct ud *u) { uint16_t ptr; UD_ASSERT(u->le->type == UD_TAB__OPC_TABLE); UD_RETURN_ON_ERROR(u); u->primary_opcode = inp_curr(u); ptr = u->le->table[inp_curr(u)]; if (ptr & 0x8000) { u->le = &ud_lookup_table_list[ptr & ~0x8000]; if (u->le->type == UD_TAB__OPC_TABLE) { inp_next(u); return decode_opcode(u); } } return decode_ext(u, ptr); } /* ============================================================================= * ud_decode() - Instruction decoder. Returns the number of bytes decoded. * ============================================================================= */ unsigned int ud_decode(struct ud *u) { inp_start(u); clear_insn(u); u->le = &ud_lookup_table_list[0]; u->error = decode_prefixes(u) == -1 || decode_opcode(u) == -1 || u->error; /* Handle decode error. */ if (u->error) { /* clear out the decode data. */ clear_insn(u); /* mark the sequence of bytes as invalid. */ u->itab_entry = &ud_itab[0]; /* entry 0 is invalid */ u->mnemonic = u->itab_entry->mnemonic; } /* maybe this stray segment override byte * should be spewed out? */ if ( !P_SEG( u->itab_entry->prefix ) && u->operand[0].type != UD_OP_MEM && u->operand[1].type != UD_OP_MEM ) u->pfx_seg = 0; u->insn_offset = u->pc; /* set offset of instruction */ u->asm_buf_fill = 0; /* set translation buffer index to 0 */ u->pc += u->inp_ctr; /* move program counter by bytes decoded */ /* return number of bytes disassembled. */ return u->inp_ctr; } /* vim: set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/libudis86/decode.h000066400000000000000000000124331455661113700205050ustar00rootroot00000000000000/* udis86 - libudis86/decode.h * * Copyright (c) 2002-2009 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UD_DECODE_H #define UD_DECODE_H #include "types.h" #include "itab.h" #define MAX_INSN_LENGTH 15 /* itab prefix bits */ #define P_none ( 0 ) #define P_cast ( 1 << 0 ) #define P_CAST(n) ( ( n >> 0 ) & 1 ) #define P_rexb ( 1 << 1 ) #define P_REXB(n) ( ( n >> 1 ) & 1 ) #define P_inv64 ( 1 << 4 ) #define P_INV64(n) ( ( n >> 4 ) & 1 ) #define P_rexw ( 1 << 5 ) #define P_REXW(n) ( ( n >> 5 ) & 1 ) #define P_def64 ( 1 << 7 ) #define P_DEF64(n) ( ( n >> 7 ) & 1 ) #define P_rexr ( 1 << 8 ) #define P_REXR(n) ( ( n >> 8 ) & 1 ) #define P_oso ( 1 << 9 ) #define P_OSO(n) ( ( n >> 9 ) & 1 ) #define P_aso ( 1 << 10 ) #define P_ASO(n) ( ( n >> 10 ) & 1 ) #define P_rexx ( 1 << 11 ) #define P_REXX(n) ( ( n >> 11 ) & 1 ) #define P_ImpAddr ( 1 << 12 ) #define P_IMPADDR(n) ( ( n >> 12 ) & 1 ) #define P_seg ( 1 << 13 ) #define P_SEG(n) ( ( n >> 13 ) & 1 ) #define P_str ( 1 << 14 ) #define P_STR(n) ( ( n >> 14 ) & 1 ) #define P_strz ( 1 << 15 ) #define P_STR_ZF(n) ( ( n >> 15 ) & 1 ) /* operand type constants -- order is important! */ enum ud_operand_code { OP_NONE, OP_A, OP_E, OP_M, OP_G, OP_I, OP_F, OP_R0, OP_R1, OP_R2, OP_R3, OP_R4, OP_R5, OP_R6, OP_R7, OP_AL, OP_CL, OP_DL, OP_AX, OP_CX, OP_DX, OP_eAX, OP_eCX, OP_eDX, OP_rAX, OP_rCX, OP_rDX, OP_ES, OP_CS, OP_SS, OP_DS, OP_FS, OP_GS, OP_ST0, OP_ST1, OP_ST2, OP_ST3, OP_ST4, OP_ST5, OP_ST6, OP_ST7, OP_J, OP_S, OP_O, OP_I1, OP_I3, OP_sI, OP_V, OP_W, OP_Q, OP_P, OP_U, OP_N, OP_MU, OP_R, OP_C, OP_D, OP_MR } UD_ATTR_PACKED; /* operand size constants */ enum ud_operand_size { SZ_NA = 0, SZ_Z = 1, SZ_V = 2, SZ_RDQ = 7, /* the following values are used as is, * and thus hard-coded. changing them * will break internals */ SZ_B = 8, SZ_W = 16, SZ_D = 32, SZ_Q = 64, SZ_T = 80, SZ_O = 128, SZ_Y = 17, /* * complex size types, that encode sizes for operands * of type MR (memory or register), for internal use * only. Id space 256 and above. */ SZ_BD = (SZ_B << 8) | SZ_D, SZ_BV = (SZ_B << 8) | SZ_V, SZ_WD = (SZ_W << 8) | SZ_D, SZ_WV = (SZ_W << 8) | SZ_V, SZ_WY = (SZ_W << 8) | SZ_Y, SZ_DY = (SZ_D << 8) | SZ_Y, SZ_WO = (SZ_W << 8) | SZ_O, SZ_DO = (SZ_D << 8) | SZ_O, SZ_QO = (SZ_Q << 8) | SZ_O, } UD_ATTR_PACKED; /* resolve complex size type. */ static inline enum ud_operand_size Mx_mem_size(enum ud_operand_size size) { return (size >> 8) & 0xff; } static inline enum ud_operand_size Mx_reg_size(enum ud_operand_size size) { return size & 0xff; } /* A single operand of an entry in the instruction table. * (internal use only) */ struct ud_itab_entry_operand { enum ud_operand_code type; enum ud_operand_size size; }; /* A single entry in an instruction table. *(internal use only) */ struct ud_itab_entry { enum ud_mnemonic_code mnemonic; struct ud_itab_entry_operand operand1; struct ud_itab_entry_operand operand2; struct ud_itab_entry_operand operand3; uint32_t prefix; }; struct ud_lookup_table_list_entry { const uint16_t *table; enum ud_table_type type; const char *meta; }; static inline int ud_opcode_field_sext(uint8_t primary_opcode) { return (primary_opcode & 0x02) != 0; } extern struct ud_itab_entry ud_itab[]; extern struct ud_lookup_table_list_entry ud_lookup_table_list[]; #endif /* UD_DECODE_H */ /* vim:cindent * vim:expandtab * vim:ts=4 * vim:sw=4 */ readpe-0.84/lib/libudis86/libudis86/extern.h000066400000000000000000000070511455661113700205670ustar00rootroot00000000000000/* udis86 - libudis86/extern.h * * Copyright (c) 2002-2009, 2013 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UD_EXTERN_H #define UD_EXTERN_H #ifdef __cplusplus extern "C" { #endif #include "types.h" /* ============================= PUBLIC API ================================= */ extern void ud_init(struct ud*); extern void ud_set_mode(struct ud*, uint8_t); extern void ud_set_pc(struct ud*, uint64_t); extern void ud_set_input_hook(struct ud*, int (*)(struct ud*)); extern void ud_set_input_buffer(struct ud*, const uint8_t*, size_t); #ifndef __UD_STANDALONE__ extern void ud_set_input_file(struct ud*, FILE*); #endif /* __UD_STANDALONE__ */ extern void ud_set_vendor(struct ud*, unsigned); extern void ud_set_syntax(struct ud*, void (*)(struct ud*)); extern void ud_input_skip(struct ud*, size_t); extern int ud_input_end(const struct ud*); extern unsigned int ud_decode(struct ud*); extern unsigned int ud_disassemble(struct ud*); extern void ud_translate_intel(struct ud*); extern void ud_translate_att(struct ud*); extern const char* ud_insn_asm(const struct ud* u); extern const uint8_t* ud_insn_ptr(const struct ud* u); extern uint64_t ud_insn_off(const struct ud*); extern const char* ud_insn_hex(struct ud*); extern unsigned int ud_insn_len(const struct ud* u); extern const struct ud_operand* ud_insn_opr(const struct ud *u, unsigned int n); extern int ud_opr_is_sreg(const struct ud_operand *opr); extern int ud_opr_is_gpr(const struct ud_operand *opr); extern enum ud_mnemonic_code ud_insn_mnemonic(const struct ud *u); extern const char* ud_lookup_mnemonic(enum ud_mnemonic_code c); extern void ud_set_user_opaque_data(struct ud*, void*); extern void* ud_get_user_opaque_data(const struct ud*); extern uint64_t ud_insn_sext_imm(const struct ud*, const struct ud_operand*); extern void ud_set_asm_buffer(struct ud *u, char *buf, size_t size); extern void ud_set_sym_resolver(struct ud *u, const char* (*resolver)(struct ud*, uint64_t addr, int64_t *offset)); /* ========================================================================== */ #ifdef __cplusplus } #endif #endif /* UD_EXTERN_H */ readpe-0.84/lib/libudis86/libudis86/itab.c000066400000000000000000011526551455661113700202100ustar00rootroot00000000000000/* itab.c -- generated by udis86:scripts/ud_itab.py, do no edit */ #include "decode.h" #define GROUP(n) (0x8000 | (n)) static const uint16_t ud_itab__1[] = { /* 0 */ 7, 0, }; static const uint16_t ud_itab__2[] = { /* 0 */ 8, 0, }; static const uint16_t ud_itab__3[] = { /* 0 */ 15, 0, }; static const uint16_t ud_itab__6[] = { /* 0 */ 16, 0, 0, 0, }; static const uint16_t ud_itab__7[] = { /* 0 */ 17, 0, 0, 0, }; static const uint16_t ud_itab__8[] = { /* 0 */ 18, 0, 0, 0, }; static const uint16_t ud_itab__9[] = { /* 0 */ 19, 0, 0, 0, }; static const uint16_t ud_itab__10[] = { /* 0 */ 20, 0, 0, 0, }; static const uint16_t ud_itab__11[] = { /* 0 */ 21, 0, 0, 0, }; static const uint16_t ud_itab__5[] = { /* 0 */ GROUP(6), GROUP(7), GROUP(8), GROUP(9), /* 4 */ GROUP(10), GROUP(11), 0, 0, }; static const uint16_t ud_itab__15[] = { /* 0 */ 22, 0, }; static const uint16_t ud_itab__14[] = { /* 0 */ GROUP(15), 0, 0, 0, }; static const uint16_t ud_itab__17[] = { /* 0 */ 23, 0, }; static const uint16_t ud_itab__16[] = { /* 0 */ GROUP(17), 0, 0, 0, }; static const uint16_t ud_itab__19[] = { /* 0 */ 24, 0, }; static const uint16_t ud_itab__18[] = { /* 0 */ GROUP(19), 0, 0, 0, }; static const uint16_t ud_itab__21[] = { /* 0 */ 25, 0, }; static const uint16_t ud_itab__20[] = { /* 0 */ GROUP(21), 0, 0, 0, }; static const uint16_t ud_itab__23[] = { /* 0 */ 26, 0, }; static const uint16_t ud_itab__22[] = { /* 0 */ GROUP(23), 0, 0, 0, }; static const uint16_t ud_itab__25[] = { /* 0 */ 27, 0, }; static const uint16_t ud_itab__24[] = { /* 0 */ GROUP(25), 0, 0, 0, }; static const uint16_t ud_itab__27[] = { /* 0 */ 28, 0, }; static const uint16_t ud_itab__26[] = { /* 0 */ GROUP(27), 0, 0, 0, }; static const uint16_t ud_itab__13[] = { /* 0 */ GROUP(14), GROUP(16), GROUP(18), GROUP(20), /* 4 */ GROUP(22), 0, GROUP(24), GROUP(26), }; static const uint16_t ud_itab__32[] = { /* 0 */ 0, 29, 0, }; static const uint16_t ud_itab__31[] = { /* 0 */ 0, GROUP(32), }; static const uint16_t ud_itab__30[] = { /* 0 */ GROUP(31), 0, 0, 0, }; static const uint16_t ud_itab__35[] = { /* 0 */ 0, 30, 0, }; static const uint16_t ud_itab__34[] = { /* 0 */ 0, GROUP(35), }; static const uint16_t ud_itab__33[] = { /* 0 */ GROUP(34), 0, 0, 0, }; static const uint16_t ud_itab__38[] = { /* 0 */ 0, 31, 0, }; static const uint16_t ud_itab__37[] = { /* 0 */ 0, GROUP(38), }; static const uint16_t ud_itab__36[] = { /* 0 */ GROUP(37), 0, 0, 0, }; static const uint16_t ud_itab__41[] = { /* 0 */ 0, 32, 0, }; static const uint16_t ud_itab__40[] = { /* 0 */ 0, GROUP(41), }; static const uint16_t ud_itab__39[] = { /* 0 */ GROUP(40), 0, 0, 0, }; static const uint16_t ud_itab__29[] = { /* 0 */ 0, GROUP(30), GROUP(33), GROUP(36), /* 4 */ GROUP(39), 0, 0, 0, }; static const uint16_t ud_itab__44[] = { /* 0 */ 0, 33, }; static const uint16_t ud_itab__43[] = { /* 0 */ GROUP(44), 0, 0, 0, }; static const uint16_t ud_itab__46[] = { /* 0 */ 0, 34, }; static const uint16_t ud_itab__45[] = { /* 0 */ GROUP(46), 0, 0, 0, }; static const uint16_t ud_itab__42[] = { /* 0 */ GROUP(43), GROUP(45), 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__49[] = { /* 0 */ 0, 35, }; static const uint16_t ud_itab__48[] = { /* 0 */ GROUP(49), 0, 0, 0, }; static const uint16_t ud_itab__51[] = { /* 0 */ 0, 36, }; static const uint16_t ud_itab__50[] = { /* 0 */ GROUP(51), 0, 0, 0, }; static const uint16_t ud_itab__47[] = { /* 0 */ GROUP(48), GROUP(50), 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__55[] = { /* 0 */ 37, 0, 0, }; static const uint16_t ud_itab__54[] = { /* 0 */ 0, GROUP(55), }; static const uint16_t ud_itab__53[] = { /* 0 */ GROUP(54), 0, 0, 0, }; static const uint16_t ud_itab__58[] = { /* 0 */ 38, 0, 0, }; static const uint16_t ud_itab__57[] = { /* 0 */ 0, GROUP(58), }; static const uint16_t ud_itab__56[] = { /* 0 */ GROUP(57), 0, 0, 0, }; static const uint16_t ud_itab__61[] = { /* 0 */ 39, 0, 0, }; static const uint16_t ud_itab__60[] = { /* 0 */ 0, GROUP(61), }; static const uint16_t ud_itab__59[] = { /* 0 */ GROUP(60), 0, 0, 0, }; static const uint16_t ud_itab__64[] = { /* 0 */ 40, 0, 0, }; static const uint16_t ud_itab__63[] = { /* 0 */ 0, GROUP(64), }; static const uint16_t ud_itab__62[] = { /* 0 */ GROUP(63), 0, 0, 0, }; static const uint16_t ud_itab__67[] = { /* 0 */ 41, 0, 0, }; static const uint16_t ud_itab__66[] = { /* 0 */ 0, GROUP(67), }; static const uint16_t ud_itab__65[] = { /* 0 */ GROUP(66), 0, 0, 0, }; static const uint16_t ud_itab__70[] = { /* 0 */ 42, 0, 0, }; static const uint16_t ud_itab__69[] = { /* 0 */ 0, GROUP(70), }; static const uint16_t ud_itab__68[] = { /* 0 */ GROUP(69), 0, 0, 0, }; static const uint16_t ud_itab__73[] = { /* 0 */ 43, 0, 0, }; static const uint16_t ud_itab__72[] = { /* 0 */ 0, GROUP(73), }; static const uint16_t ud_itab__71[] = { /* 0 */ GROUP(72), 0, 0, 0, }; static const uint16_t ud_itab__76[] = { /* 0 */ 44, 0, 0, }; static const uint16_t ud_itab__75[] = { /* 0 */ 0, GROUP(76), }; static const uint16_t ud_itab__74[] = { /* 0 */ GROUP(75), 0, 0, 0, }; static const uint16_t ud_itab__52[] = { /* 0 */ GROUP(53), GROUP(56), GROUP(59), GROUP(62), /* 4 */ GROUP(65), GROUP(68), GROUP(71), GROUP(74), }; static const uint16_t ud_itab__78[] = { /* 0 */ 0, 45, }; static const uint16_t ud_itab__77[] = { /* 0 */ GROUP(78), 0, 0, 0, }; static const uint16_t ud_itab__80[] = { /* 0 */ 0, 46, }; static const uint16_t ud_itab__79[] = { /* 0 */ GROUP(80), 0, 0, 0, }; static const uint16_t ud_itab__83[] = { /* 0 */ 0, 47, }; static const uint16_t ud_itab__82[] = { /* 0 */ GROUP(83), 0, 0, 0, }; static const uint16_t ud_itab__86[] = { /* 0 */ 48, 0, 0, }; static const uint16_t ud_itab__85[] = { /* 0 */ 0, GROUP(86), }; static const uint16_t ud_itab__84[] = { /* 0 */ GROUP(85), 0, 0, 0, }; static const uint16_t ud_itab__81[] = { /* 0 */ GROUP(82), GROUP(84), 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__28[] = { /* 0 */ GROUP(29), GROUP(42), GROUP(47), GROUP(52), /* 4 */ GROUP(77), 0, GROUP(79), GROUP(81), }; static const uint16_t ud_itab__12[] = { /* 0 */ GROUP(13), GROUP(28), }; static const uint16_t ud_itab__87[] = { /* 0 */ 49, 0, 0, 0, }; static const uint16_t ud_itab__88[] = { /* 0 */ 50, 0, 0, 0, }; static const uint16_t ud_itab__89[] = { /* 0 */ 51, 0, 0, 0, }; static const uint16_t ud_itab__90[] = { /* 0 */ 52, 0, 0, 0, }; static const uint16_t ud_itab__91[] = { /* 0 */ 53, 0, 0, 0, }; static const uint16_t ud_itab__92[] = { /* 0 */ 54, 0, 0, 0, }; static const uint16_t ud_itab__93[] = { /* 0 */ 55, 0, 0, 0, }; static const uint16_t ud_itab__94[] = { /* 0 */ 56, 0, 0, 0, }; static const uint16_t ud_itab__96[] = { /* 0 */ 57, 0, 0, 0, }; static const uint16_t ud_itab__97[] = { /* 0 */ 58, 0, 0, 0, }; static const uint16_t ud_itab__98[] = { /* 0 */ 59, 0, 0, 0, }; static const uint16_t ud_itab__99[] = { /* 0 */ 60, 0, 0, 0, }; static const uint16_t ud_itab__100[] = { /* 0 */ 61, 0, 0, 0, }; static const uint16_t ud_itab__101[] = { /* 0 */ 62, 0, 0, 0, }; static const uint16_t ud_itab__102[] = { /* 0 */ 63, 0, 0, 0, }; static const uint16_t ud_itab__103[] = { /* 0 */ 64, 0, 0, 0, }; static const uint16_t ud_itab__95[] = { /* 0 */ GROUP(96), GROUP(97), GROUP(98), GROUP(99), /* 4 */ GROUP(100), GROUP(101), GROUP(102), GROUP(103), }; static const uint16_t ud_itab__104[] = { /* 0 */ 65, 0, 0, 0, }; static const uint16_t ud_itab__105[] = { /* 0 */ 0, 0, 0, 0, /* 4 */ 0, 0, 0, 0, /* 8 */ 0, 0, 0, 0, /* c */ 66, 67, 0, 0, /* 10 */ 0, 0, 0, 0, /* 14 */ 0, 0, 0, 0, /* 18 */ 0, 0, 0, 0, /* 1c */ 68, 69, 0, 0, /* 20 */ 0, 0, 0, 0, /* 24 */ 0, 0, 0, 0, /* 28 */ 0, 0, 0, 0, /* 2c */ 0, 0, 0, 0, /* 30 */ 0, 0, 0, 0, /* 34 */ 0, 0, 0, 0, /* 38 */ 0, 0, 0, 0, /* 3c */ 0, 0, 0, 0, /* 40 */ 0, 0, 0, 0, /* 44 */ 0, 0, 0, 0, /* 48 */ 0, 0, 0, 0, /* 4c */ 0, 0, 0, 0, /* 50 */ 0, 0, 0, 0, /* 54 */ 0, 0, 0, 0, /* 58 */ 0, 0, 0, 0, /* 5c */ 0, 0, 0, 0, /* 60 */ 0, 0, 0, 0, /* 64 */ 0, 0, 0, 0, /* 68 */ 0, 0, 0, 0, /* 6c */ 0, 0, 0, 0, /* 70 */ 0, 0, 0, 0, /* 74 */ 0, 0, 0, 0, /* 78 */ 0, 0, 0, 0, /* 7c */ 0, 0, 0, 0, /* 80 */ 0, 0, 0, 0, /* 84 */ 0, 0, 0, 0, /* 88 */ 0, 0, 70, 0, /* 8c */ 0, 0, 71, 0, /* 90 */ 72, 0, 0, 0, /* 94 */ 73, 0, 74, 75, /* 98 */ 0, 0, 76, 0, /* 9c */ 0, 0, 77, 0, /* a0 */ 78, 0, 0, 0, /* a4 */ 79, 0, 80, 81, /* a8 */ 0, 0, 82, 0, /* ac */ 0, 0, 83, 0, /* b0 */ 84, 0, 0, 0, /* b4 */ 85, 0, 86, 87, /* b8 */ 0, 0, 0, 88, /* bc */ 0, 0, 0, 89, /* c0 */ 0, 0, 0, 0, /* c4 */ 0, 0, 0, 0, /* c8 */ 0, 0, 0, 0, /* cc */ 0, 0, 0, 0, /* d0 */ 0, 0, 0, 0, /* d4 */ 0, 0, 0, 0, /* d8 */ 0, 0, 0, 0, /* dc */ 0, 0, 0, 0, /* e0 */ 0, 0, 0, 0, /* e4 */ 0, 0, 0, 0, /* e8 */ 0, 0, 0, 0, /* ec */ 0, 0, 0, 0, /* f0 */ 0, 0, 0, 0, /* f4 */ 0, 0, 0, 0, /* f8 */ 0, 0, 0, 0, /* fc */ 0, 0, 0, 0, }; static const uint16_t ud_itab__106[] = { /* 0 */ 90, 91, 92, 93, }; static const uint16_t ud_itab__107[] = { /* 0 */ 94, 95, 96, 97, }; static const uint16_t ud_itab__110[] = { /* 0 */ 98, 0, }; static const uint16_t ud_itab__111[] = { /* 0 */ 99, 0, }; static const uint16_t ud_itab__112[] = { /* 0 */ 100, 0, }; static const uint16_t ud_itab__113[] = { /* 0 */ 101, 0, }; static const uint16_t ud_itab__109[] = { /* 0 */ GROUP(110), GROUP(111), GROUP(112), GROUP(113), }; static const uint16_t ud_itab__115[] = { /* 0 */ 0, 102, }; static const uint16_t ud_itab__116[] = { /* 0 */ 0, 103, }; static const uint16_t ud_itab__117[] = { /* 0 */ 0, 104, }; static const uint16_t ud_itab__114[] = { /* 0 */ GROUP(115), GROUP(116), GROUP(117), 0, }; static const uint16_t ud_itab__108[] = { /* 0 */ GROUP(109), GROUP(114), }; static const uint16_t ud_itab__118[] = { /* 0 */ 105, 0, 0, 106, }; static const uint16_t ud_itab__119[] = { /* 0 */ 107, 0, 0, 108, }; static const uint16_t ud_itab__120[] = { /* 0 */ 109, 0, 0, 110, }; static const uint16_t ud_itab__123[] = { /* 0 */ 111, 0, }; static const uint16_t ud_itab__124[] = { /* 0 */ 112, 0, }; static const uint16_t ud_itab__125[] = { /* 0 */ 113, 0, }; static const uint16_t ud_itab__122[] = { /* 0 */ GROUP(123), 0, GROUP(124), GROUP(125), }; static const uint16_t ud_itab__127[] = { /* 0 */ 0, 114, }; static const uint16_t ud_itab__128[] = { /* 0 */ 0, 115, }; static const uint16_t ud_itab__126[] = { /* 0 */ GROUP(127), 0, GROUP(128), 0, }; static const uint16_t ud_itab__121[] = { /* 0 */ GROUP(122), GROUP(126), }; static const uint16_t ud_itab__129[] = { /* 0 */ 116, 0, 0, 117, }; static const uint16_t ud_itab__131[] = { /* 0 */ 118, 0, 0, 0, }; static const uint16_t ud_itab__132[] = { /* 0 */ 119, 0, 0, 0, }; static const uint16_t ud_itab__133[] = { /* 0 */ 120, 0, 0, 0, }; static const uint16_t ud_itab__134[] = { /* 0 */ 121, 0, 0, 0, }; static const uint16_t ud_itab__130[] = { /* 0 */ GROUP(131), GROUP(132), GROUP(133), GROUP(134), /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__135[] = { /* 0 */ 122, 0, 0, 0, }; static const uint16_t ud_itab__136[] = { /* 0 */ 123, 0, 0, 0, }; static const uint16_t ud_itab__137[] = { /* 0 */ 124, 0, 0, 0, }; static const uint16_t ud_itab__138[] = { /* 0 */ 125, 0, 0, 0, }; static const uint16_t ud_itab__139[] = { /* 0 */ 126, 0, 0, 0, }; static const uint16_t ud_itab__140[] = { /* 0 */ 127, 0, 0, 0, }; static const uint16_t ud_itab__141[] = { /* 0 */ 128, 0, 0, 0, }; static const uint16_t ud_itab__142[] = { /* 0 */ 129, 0, 0, 0, }; static const uint16_t ud_itab__143[] = { /* 0 */ 130, 0, 0, 0, }; static const uint16_t ud_itab__144[] = { /* 0 */ 131, 0, 0, 0, }; static const uint16_t ud_itab__145[] = { /* 0 */ 132, 0, 0, 0, }; static const uint16_t ud_itab__146[] = { /* 0 */ 133, 0, 0, 134, }; static const uint16_t ud_itab__147[] = { /* 0 */ 135, 0, 0, 136, }; static const uint16_t ud_itab__148[] = { /* 0 */ 137, 138, 139, 140, }; static const uint16_t ud_itab__149[] = { /* 0 */ 141, 0, 0, 142, }; static const uint16_t ud_itab__150[] = { /* 0 */ 143, 144, 145, 146, }; static const uint16_t ud_itab__151[] = { /* 0 */ 147, 148, 149, 150, }; static const uint16_t ud_itab__152[] = { /* 0 */ 151, 0, 0, 152, }; static const uint16_t ud_itab__153[] = { /* 0 */ 153, 0, 0, 154, }; static const uint16_t ud_itab__154[] = { /* 0 */ 155, 0, 0, 0, }; static const uint16_t ud_itab__155[] = { /* 0 */ 156, 0, 0, 0, }; static const uint16_t ud_itab__156[] = { /* 0 */ 157, 0, 0, 0, }; static const uint16_t ud_itab__157[] = { /* 0 */ 158, 0, 0, 0, }; static const uint16_t ud_itab__160[] = { /* 0 */ 0, 160, 0, }; static const uint16_t ud_itab__159[] = { /* 0 */ 159, GROUP(160), }; static const uint16_t ud_itab__158[] = { /* 0 */ GROUP(159), 0, 0, 0, }; static const uint16_t ud_itab__163[] = { /* 0 */ 0, 162, 0, }; static const uint16_t ud_itab__162[] = { /* 0 */ 161, GROUP(163), }; static const uint16_t ud_itab__161[] = { /* 0 */ GROUP(162), 0, 0, 0, }; static const uint16_t ud_itab__164[] = { /* 0 */ 163, 0, 0, 0, }; static const uint16_t ud_itab__166[] = { /* 0 */ 164, 0, 0, 165, }; static const uint16_t ud_itab__167[] = { /* 0 */ 166, 0, 0, 167, }; static const uint16_t ud_itab__168[] = { /* 0 */ 168, 0, 0, 169, }; static const uint16_t ud_itab__169[] = { /* 0 */ 170, 0, 0, 171, }; static const uint16_t ud_itab__170[] = { /* 0 */ 172, 0, 0, 173, }; static const uint16_t ud_itab__171[] = { /* 0 */ 174, 0, 0, 175, }; static const uint16_t ud_itab__172[] = { /* 0 */ 176, 0, 0, 177, }; static const uint16_t ud_itab__173[] = { /* 0 */ 178, 0, 0, 179, }; static const uint16_t ud_itab__174[] = { /* 0 */ 180, 0, 0, 181, }; static const uint16_t ud_itab__175[] = { /* 0 */ 182, 0, 0, 183, }; static const uint16_t ud_itab__176[] = { /* 0 */ 184, 0, 0, 185, }; static const uint16_t ud_itab__177[] = { /* 0 */ 186, 0, 0, 187, }; static const uint16_t ud_itab__178[] = { /* 0 */ 0, 0, 0, 188, }; static const uint16_t ud_itab__179[] = { /* 0 */ 0, 0, 0, 189, }; static const uint16_t ud_itab__180[] = { /* 0 */ 0, 0, 0, 190, }; static const uint16_t ud_itab__181[] = { /* 0 */ 0, 0, 0, 191, }; static const uint16_t ud_itab__182[] = { /* 0 */ 192, 0, 0, 193, }; static const uint16_t ud_itab__183[] = { /* 0 */ 194, 0, 0, 195, }; static const uint16_t ud_itab__184[] = { /* 0 */ 196, 0, 0, 197, }; static const uint16_t ud_itab__185[] = { /* 0 */ 0, 0, 0, 198, }; static const uint16_t ud_itab__186[] = { /* 0 */ 0, 0, 0, 199, }; static const uint16_t ud_itab__187[] = { /* 0 */ 0, 0, 0, 200, }; static const uint16_t ud_itab__188[] = { /* 0 */ 0, 0, 0, 201, }; static const uint16_t ud_itab__189[] = { /* 0 */ 0, 0, 0, 202, }; static const uint16_t ud_itab__190[] = { /* 0 */ 0, 0, 0, 203, }; static const uint16_t ud_itab__191[] = { /* 0 */ 0, 0, 0, 204, }; static const uint16_t ud_itab__192[] = { /* 0 */ 0, 0, 0, 205, }; static const uint16_t ud_itab__193[] = { /* 0 */ 0, 0, 0, 206, }; static const uint16_t ud_itab__194[] = { /* 0 */ 0, 0, 0, 207, }; static const uint16_t ud_itab__195[] = { /* 0 */ 0, 0, 0, 208, }; static const uint16_t ud_itab__196[] = { /* 0 */ 0, 0, 0, 209, }; static const uint16_t ud_itab__197[] = { /* 0 */ 0, 0, 0, 210, }; static const uint16_t ud_itab__198[] = { /* 0 */ 0, 0, 0, 211, }; static const uint16_t ud_itab__199[] = { /* 0 */ 0, 0, 0, 212, }; static const uint16_t ud_itab__200[] = { /* 0 */ 0, 0, 0, 213, }; static const uint16_t ud_itab__201[] = { /* 0 */ 0, 0, 0, 214, }; static const uint16_t ud_itab__202[] = { /* 0 */ 0, 0, 0, 215, }; static const uint16_t ud_itab__203[] = { /* 0 */ 0, 0, 0, 216, }; static const uint16_t ud_itab__204[] = { /* 0 */ 0, 0, 0, 217, }; static const uint16_t ud_itab__205[] = { /* 0 */ 0, 0, 0, 218, }; static const uint16_t ud_itab__206[] = { /* 0 */ 0, 0, 0, 219, }; static const uint16_t ud_itab__207[] = { /* 0 */ 0, 0, 0, 220, }; static const uint16_t ud_itab__208[] = { /* 0 */ 0, 0, 0, 221, }; static const uint16_t ud_itab__209[] = { /* 0 */ 0, 0, 0, 222, }; static const uint16_t ud_itab__210[] = { /* 0 */ 0, 0, 0, 223, }; static const uint16_t ud_itab__211[] = { /* 0 */ 0, 0, 0, 224, }; static const uint16_t ud_itab__214[] = { /* 0 */ 0, 225, 0, }; static const uint16_t ud_itab__213[] = { /* 0 */ 0, GROUP(214), }; static const uint16_t ud_itab__212[] = { /* 0 */ 0, 0, 0, GROUP(213), }; static const uint16_t ud_itab__217[] = { /* 0 */ 0, 226, 0, }; static const uint16_t ud_itab__216[] = { /* 0 */ 0, GROUP(217), }; static const uint16_t ud_itab__215[] = { /* 0 */ 0, 0, 0, GROUP(216), }; static const uint16_t ud_itab__218[] = { /* 0 */ 0, 0, 0, 227, }; static const uint16_t ud_itab__219[] = { /* 0 */ 0, 0, 0, 228, }; static const uint16_t ud_itab__220[] = { /* 0 */ 0, 0, 0, 229, }; static const uint16_t ud_itab__221[] = { /* 0 */ 0, 0, 0, 230, }; static const uint16_t ud_itab__222[] = { /* 0 */ 0, 0, 0, 231, }; static const uint16_t ud_itab__223[] = { /* 0 */ 232, 233, 0, 0, }; static const uint16_t ud_itab__224[] = { /* 0 */ 234, 235, 0, 0, }; static const uint16_t ud_itab__165[] = { /* 0 */ GROUP(166), GROUP(167), GROUP(168), GROUP(169), /* 4 */ GROUP(170), GROUP(171), GROUP(172), GROUP(173), /* 8 */ GROUP(174), GROUP(175), GROUP(176), GROUP(177), /* c */ 0, 0, 0, 0, /* 10 */ GROUP(178), 0, 0, 0, /* 14 */ GROUP(179), GROUP(180), 0, GROUP(181), /* 18 */ 0, 0, 0, 0, /* 1c */ GROUP(182), GROUP(183), GROUP(184), 0, /* 20 */ GROUP(185), GROUP(186), GROUP(187), GROUP(188), /* 24 */ GROUP(189), GROUP(190), 0, 0, /* 28 */ GROUP(191), GROUP(192), GROUP(193), GROUP(194), /* 2c */ 0, 0, 0, 0, /* 30 */ GROUP(195), GROUP(196), GROUP(197), GROUP(198), /* 34 */ GROUP(199), GROUP(200), 0, GROUP(201), /* 38 */ GROUP(202), GROUP(203), GROUP(204), GROUP(205), /* 3c */ GROUP(206), GROUP(207), GROUP(208), GROUP(209), /* 40 */ GROUP(210), GROUP(211), 0, 0, /* 44 */ 0, 0, 0, 0, /* 48 */ 0, 0, 0, 0, /* 4c */ 0, 0, 0, 0, /* 50 */ 0, 0, 0, 0, /* 54 */ 0, 0, 0, 0, /* 58 */ 0, 0, 0, 0, /* 5c */ 0, 0, 0, 0, /* 60 */ 0, 0, 0, 0, /* 64 */ 0, 0, 0, 0, /* 68 */ 0, 0, 0, 0, /* 6c */ 0, 0, 0, 0, /* 70 */ 0, 0, 0, 0, /* 74 */ 0, 0, 0, 0, /* 78 */ 0, 0, 0, 0, /* 7c */ 0, 0, 0, 0, /* 80 */ GROUP(212), GROUP(215), 0, 0, /* 84 */ 0, 0, 0, 0, /* 88 */ 0, 0, 0, 0, /* 8c */ 0, 0, 0, 0, /* 90 */ 0, 0, 0, 0, /* 94 */ 0, 0, 0, 0, /* 98 */ 0, 0, 0, 0, /* 9c */ 0, 0, 0, 0, /* a0 */ 0, 0, 0, 0, /* a4 */ 0, 0, 0, 0, /* a8 */ 0, 0, 0, 0, /* ac */ 0, 0, 0, 0, /* b0 */ 0, 0, 0, 0, /* b4 */ 0, 0, 0, 0, /* b8 */ 0, 0, 0, 0, /* bc */ 0, 0, 0, 0, /* c0 */ 0, 0, 0, 0, /* c4 */ 0, 0, 0, 0, /* c8 */ 0, 0, 0, 0, /* cc */ 0, 0, 0, 0, /* d0 */ 0, 0, 0, 0, /* d4 */ 0, 0, 0, 0, /* d8 */ 0, 0, 0, GROUP(218), /* dc */ GROUP(219), GROUP(220), GROUP(221), GROUP(222), /* e0 */ 0, 0, 0, 0, /* e4 */ 0, 0, 0, 0, /* e8 */ 0, 0, 0, 0, /* ec */ 0, 0, 0, 0, /* f0 */ GROUP(223), GROUP(224), 0, 0, /* f4 */ 0, 0, 0, 0, /* f8 */ 0, 0, 0, 0, /* fc */ 0, 0, 0, 0, }; static const uint16_t ud_itab__226[] = { /* 0 */ 0, 0, 0, 236, }; static const uint16_t ud_itab__227[] = { /* 0 */ 0, 0, 0, 237, }; static const uint16_t ud_itab__228[] = { /* 0 */ 0, 0, 0, 238, }; static const uint16_t ud_itab__229[] = { /* 0 */ 0, 0, 0, 239, }; static const uint16_t ud_itab__230[] = { /* 0 */ 0, 0, 0, 240, }; static const uint16_t ud_itab__231[] = { /* 0 */ 0, 0, 0, 241, }; static const uint16_t ud_itab__232[] = { /* 0 */ 0, 0, 0, 242, }; static const uint16_t ud_itab__233[] = { /* 0 */ 243, 0, 0, 244, }; static const uint16_t ud_itab__234[] = { /* 0 */ 0, 0, 0, 245, }; static const uint16_t ud_itab__235[] = { /* 0 */ 0, 0, 0, 246, }; static const uint16_t ud_itab__237[] = { /* 0 */ 247, 248, 249, }; static const uint16_t ud_itab__236[] = { /* 0 */ 0, 0, 0, GROUP(237), }; static const uint16_t ud_itab__238[] = { /* 0 */ 0, 0, 0, 250, }; static const uint16_t ud_itab__239[] = { /* 0 */ 0, 0, 0, 251, }; static const uint16_t ud_itab__240[] = { /* 0 */ 0, 0, 0, 252, }; static const uint16_t ud_itab__242[] = { /* 0 */ 253, 254, 255, }; static const uint16_t ud_itab__241[] = { /* 0 */ 0, 0, 0, GROUP(242), }; static const uint16_t ud_itab__243[] = { /* 0 */ 0, 0, 0, 256, }; static const uint16_t ud_itab__244[] = { /* 0 */ 0, 0, 0, 257, }; static const uint16_t ud_itab__245[] = { /* 0 */ 0, 0, 0, 258, }; static const uint16_t ud_itab__246[] = { /* 0 */ 0, 0, 0, 259, }; static const uint16_t ud_itab__247[] = { /* 0 */ 0, 0, 0, 260, }; static const uint16_t ud_itab__248[] = { /* 0 */ 0, 0, 0, 261, }; static const uint16_t ud_itab__249[] = { /* 0 */ 0, 0, 0, 262, }; static const uint16_t ud_itab__250[] = { /* 0 */ 0, 0, 0, 263, }; static const uint16_t ud_itab__251[] = { /* 0 */ 0, 0, 0, 264, }; static const uint16_t ud_itab__225[] = { /* 0 */ 0, 0, 0, 0, /* 4 */ 0, 0, 0, 0, /* 8 */ GROUP(226), GROUP(227), GROUP(228), GROUP(229), /* c */ GROUP(230), GROUP(231), GROUP(232), GROUP(233), /* 10 */ 0, 0, 0, 0, /* 14 */ GROUP(234), GROUP(235), GROUP(236), GROUP(238), /* 18 */ 0, 0, 0, 0, /* 1c */ 0, 0, 0, 0, /* 20 */ GROUP(239), GROUP(240), GROUP(241), 0, /* 24 */ 0, 0, 0, 0, /* 28 */ 0, 0, 0, 0, /* 2c */ 0, 0, 0, 0, /* 30 */ 0, 0, 0, 0, /* 34 */ 0, 0, 0, 0, /* 38 */ 0, 0, 0, 0, /* 3c */ 0, 0, 0, 0, /* 40 */ GROUP(243), GROUP(244), GROUP(245), 0, /* 44 */ GROUP(246), 0, 0, 0, /* 48 */ 0, 0, 0, 0, /* 4c */ 0, 0, 0, 0, /* 50 */ 0, 0, 0, 0, /* 54 */ 0, 0, 0, 0, /* 58 */ 0, 0, 0, 0, /* 5c */ 0, 0, 0, 0, /* 60 */ GROUP(247), GROUP(248), GROUP(249), GROUP(250), /* 64 */ 0, 0, 0, 0, /* 68 */ 0, 0, 0, 0, /* 6c */ 0, 0, 0, 0, /* 70 */ 0, 0, 0, 0, /* 74 */ 0, 0, 0, 0, /* 78 */ 0, 0, 0, 0, /* 7c */ 0, 0, 0, 0, /* 80 */ 0, 0, 0, 0, /* 84 */ 0, 0, 0, 0, /* 88 */ 0, 0, 0, 0, /* 8c */ 0, 0, 0, 0, /* 90 */ 0, 0, 0, 0, /* 94 */ 0, 0, 0, 0, /* 98 */ 0, 0, 0, 0, /* 9c */ 0, 0, 0, 0, /* a0 */ 0, 0, 0, 0, /* a4 */ 0, 0, 0, 0, /* a8 */ 0, 0, 0, 0, /* ac */ 0, 0, 0, 0, /* b0 */ 0, 0, 0, 0, /* b4 */ 0, 0, 0, 0, /* b8 */ 0, 0, 0, 0, /* bc */ 0, 0, 0, 0, /* c0 */ 0, 0, 0, 0, /* c4 */ 0, 0, 0, 0, /* c8 */ 0, 0, 0, 0, /* cc */ 0, 0, 0, 0, /* d0 */ 0, 0, 0, 0, /* d4 */ 0, 0, 0, 0, /* d8 */ 0, 0, 0, 0, /* dc */ 0, 0, 0, GROUP(251), /* e0 */ 0, 0, 0, 0, /* e4 */ 0, 0, 0, 0, /* e8 */ 0, 0, 0, 0, /* ec */ 0, 0, 0, 0, /* f0 */ 0, 0, 0, 0, /* f4 */ 0, 0, 0, 0, /* f8 */ 0, 0, 0, 0, /* fc */ 0, 0, 0, 0, }; static const uint16_t ud_itab__252[] = { /* 0 */ 265, 0, 0, 0, }; static const uint16_t ud_itab__253[] = { /* 0 */ 266, 0, 0, 0, }; static const uint16_t ud_itab__254[] = { /* 0 */ 267, 0, 0, 0, }; static const uint16_t ud_itab__255[] = { /* 0 */ 268, 0, 0, 0, }; static const uint16_t ud_itab__256[] = { /* 0 */ 269, 0, 0, 0, }; static const uint16_t ud_itab__257[] = { /* 0 */ 270, 0, 0, 0, }; static const uint16_t ud_itab__258[] = { /* 0 */ 271, 0, 0, 0, }; static const uint16_t ud_itab__259[] = { /* 0 */ 272, 0, 0, 0, }; static const uint16_t ud_itab__260[] = { /* 0 */ 273, 0, 0, 0, }; static const uint16_t ud_itab__261[] = { /* 0 */ 274, 0, 0, 0, }; static const uint16_t ud_itab__262[] = { /* 0 */ 275, 0, 0, 0, }; static const uint16_t ud_itab__263[] = { /* 0 */ 276, 0, 0, 0, }; static const uint16_t ud_itab__264[] = { /* 0 */ 277, 0, 0, 0, }; static const uint16_t ud_itab__265[] = { /* 0 */ 278, 0, 0, 0, }; static const uint16_t ud_itab__266[] = { /* 0 */ 279, 0, 0, 0, }; static const uint16_t ud_itab__267[] = { /* 0 */ 280, 0, 0, 0, }; static const uint16_t ud_itab__268[] = { /* 0 */ 281, 0, 0, 282, }; static const uint16_t ud_itab__269[] = { /* 0 */ 283, 284, 285, 286, }; static const uint16_t ud_itab__270[] = { /* 0 */ 287, 0, 288, 0, }; static const uint16_t ud_itab__271[] = { /* 0 */ 289, 0, 290, 0, }; static const uint16_t ud_itab__272[] = { /* 0 */ 291, 0, 0, 292, }; static const uint16_t ud_itab__273[] = { /* 0 */ 293, 0, 0, 294, }; static const uint16_t ud_itab__274[] = { /* 0 */ 295, 0, 0, 296, }; static const uint16_t ud_itab__275[] = { /* 0 */ 297, 0, 0, 298, }; static const uint16_t ud_itab__276[] = { /* 0 */ 299, 300, 301, 302, }; static const uint16_t ud_itab__277[] = { /* 0 */ 303, 304, 305, 306, }; static const uint16_t ud_itab__278[] = { /* 0 */ 307, 308, 309, 310, }; static const uint16_t ud_itab__279[] = { /* 0 */ 311, 0, 312, 313, }; static const uint16_t ud_itab__280[] = { /* 0 */ 314, 315, 316, 317, }; static const uint16_t ud_itab__281[] = { /* 0 */ 318, 319, 320, 321, }; static const uint16_t ud_itab__282[] = { /* 0 */ 322, 323, 324, 325, }; static const uint16_t ud_itab__283[] = { /* 0 */ 326, 327, 328, 329, }; static const uint16_t ud_itab__284[] = { /* 0 */ 330, 0, 0, 331, }; static const uint16_t ud_itab__285[] = { /* 0 */ 332, 0, 0, 333, }; static const uint16_t ud_itab__286[] = { /* 0 */ 334, 0, 0, 335, }; static const uint16_t ud_itab__287[] = { /* 0 */ 336, 0, 0, 337, }; static const uint16_t ud_itab__288[] = { /* 0 */ 338, 0, 0, 339, }; static const uint16_t ud_itab__289[] = { /* 0 */ 340, 0, 0, 341, }; static const uint16_t ud_itab__290[] = { /* 0 */ 342, 0, 0, 343, }; static const uint16_t ud_itab__291[] = { /* 0 */ 344, 0, 0, 345, }; static const uint16_t ud_itab__292[] = { /* 0 */ 346, 0, 0, 347, }; static const uint16_t ud_itab__293[] = { /* 0 */ 348, 0, 0, 349, }; static const uint16_t ud_itab__294[] = { /* 0 */ 350, 0, 0, 351, }; static const uint16_t ud_itab__295[] = { /* 0 */ 352, 0, 0, 353, }; static const uint16_t ud_itab__296[] = { /* 0 */ 0, 0, 0, 354, }; static const uint16_t ud_itab__297[] = { /* 0 */ 0, 0, 0, 355, }; static const uint16_t ud_itab__298[] = { /* 0 */ 356, 0, 0, 357, }; static const uint16_t ud_itab__299[] = { /* 0 */ 358, 0, 359, 360, }; static const uint16_t ud_itab__300[] = { /* 0 */ 361, 362, 363, 364, }; static const uint16_t ud_itab__302[] = { /* 0 */ 365, 0, 0, 366, }; static const uint16_t ud_itab__303[] = { /* 0 */ 367, 0, 0, 368, }; static const uint16_t ud_itab__304[] = { /* 0 */ 369, 0, 0, 370, }; static const uint16_t ud_itab__301[] = { /* 0 */ 0, 0, GROUP(302), 0, /* 4 */ GROUP(303), 0, GROUP(304), 0, }; static const uint16_t ud_itab__306[] = { /* 0 */ 371, 0, 0, 372, }; static const uint16_t ud_itab__307[] = { /* 0 */ 373, 0, 0, 374, }; static const uint16_t ud_itab__308[] = { /* 0 */ 375, 0, 0, 376, }; static const uint16_t ud_itab__305[] = { /* 0 */ 0, 0, GROUP(306), 0, /* 4 */ GROUP(307), 0, GROUP(308), 0, }; static const uint16_t ud_itab__310[] = { /* 0 */ 377, 0, 0, 378, }; static const uint16_t ud_itab__311[] = { /* 0 */ 0, 0, 0, 379, }; static const uint16_t ud_itab__312[] = { /* 0 */ 380, 0, 0, 381, }; static const uint16_t ud_itab__313[] = { /* 0 */ 0, 0, 0, 382, }; static const uint16_t ud_itab__309[] = { /* 0 */ 0, 0, GROUP(310), GROUP(311), /* 4 */ 0, 0, GROUP(312), GROUP(313), }; static const uint16_t ud_itab__314[] = { /* 0 */ 383, 0, 0, 384, }; static const uint16_t ud_itab__315[] = { /* 0 */ 385, 0, 0, 386, }; static const uint16_t ud_itab__316[] = { /* 0 */ 387, 0, 0, 388, }; static const uint16_t ud_itab__317[] = { /* 0 */ 389, 0, 0, 0, }; static const uint16_t ud_itab__319[] = { /* 0 */ 0, 390, 0, }; static const uint16_t ud_itab__318[] = { /* 0 */ GROUP(319), 0, 0, 0, }; static const uint16_t ud_itab__321[] = { /* 0 */ 0, 391, 0, }; static const uint16_t ud_itab__320[] = { /* 0 */ GROUP(321), 0, 0, 0, }; static const uint16_t ud_itab__322[] = { /* 0 */ 0, 392, 0, 393, }; static const uint16_t ud_itab__323[] = { /* 0 */ 0, 394, 0, 395, }; static const uint16_t ud_itab__324[] = { /* 0 */ 396, 0, 397, 398, }; static const uint16_t ud_itab__325[] = { /* 0 */ 399, 0, 400, 401, }; static const uint16_t ud_itab__326[] = { /* 0 */ 402, 0, 0, 0, }; static const uint16_t ud_itab__327[] = { /* 0 */ 403, 0, 0, 0, }; static const uint16_t ud_itab__328[] = { /* 0 */ 404, 0, 0, 0, }; static const uint16_t ud_itab__329[] = { /* 0 */ 405, 0, 0, 0, }; static const uint16_t ud_itab__330[] = { /* 0 */ 406, 0, 0, 0, }; static const uint16_t ud_itab__331[] = { /* 0 */ 407, 0, 0, 0, }; static const uint16_t ud_itab__332[] = { /* 0 */ 408, 0, 0, 0, }; static const uint16_t ud_itab__333[] = { /* 0 */ 409, 0, 0, 0, }; static const uint16_t ud_itab__334[] = { /* 0 */ 410, 0, 0, 0, }; static const uint16_t ud_itab__335[] = { /* 0 */ 411, 0, 0, 0, }; static const uint16_t ud_itab__336[] = { /* 0 */ 412, 0, 0, 0, }; static const uint16_t ud_itab__337[] = { /* 0 */ 413, 0, 0, 0, }; static const uint16_t ud_itab__338[] = { /* 0 */ 414, 0, 0, 0, }; static const uint16_t ud_itab__339[] = { /* 0 */ 415, 0, 0, 0, }; static const uint16_t ud_itab__340[] = { /* 0 */ 416, 0, 0, 0, }; static const uint16_t ud_itab__341[] = { /* 0 */ 417, 0, 0, 0, }; static const uint16_t ud_itab__342[] = { /* 0 */ 418, 0, 0, 0, }; static const uint16_t ud_itab__343[] = { /* 0 */ 419, 0, 0, 0, }; static const uint16_t ud_itab__344[] = { /* 0 */ 420, 0, 0, 0, }; static const uint16_t ud_itab__345[] = { /* 0 */ 421, 0, 0, 0, }; static const uint16_t ud_itab__346[] = { /* 0 */ 422, 0, 0, 0, }; static const uint16_t ud_itab__347[] = { /* 0 */ 423, 0, 0, 0, }; static const uint16_t ud_itab__348[] = { /* 0 */ 424, 0, 0, 0, }; static const uint16_t ud_itab__349[] = { /* 0 */ 425, 0, 0, 0, }; static const uint16_t ud_itab__350[] = { /* 0 */ 426, 0, 0, 0, }; static const uint16_t ud_itab__351[] = { /* 0 */ 427, 0, 0, 0, }; static const uint16_t ud_itab__352[] = { /* 0 */ 428, 0, 0, 0, }; static const uint16_t ud_itab__353[] = { /* 0 */ 429, 0, 0, 0, }; static const uint16_t ud_itab__354[] = { /* 0 */ 430, 0, 0, 0, }; static const uint16_t ud_itab__355[] = { /* 0 */ 431, 0, 0, 0, }; static const uint16_t ud_itab__356[] = { /* 0 */ 432, 0, 0, 0, }; static const uint16_t ud_itab__357[] = { /* 0 */ 433, 0, 0, 0, }; static const uint16_t ud_itab__358[] = { /* 0 */ 434, 0, 0, 0, }; static const uint16_t ud_itab__359[] = { /* 0 */ 435, 0, 0, 0, }; static const uint16_t ud_itab__360[] = { /* 0 */ 436, 0, 0, 0, }; static const uint16_t ud_itab__361[] = { /* 0 */ 437, 0, 0, 0, }; static const uint16_t ud_itab__362[] = { /* 0 */ 438, 0, 0, 0, }; static const uint16_t ud_itab__363[] = { /* 0 */ 439, 0, 0, 0, }; static const uint16_t ud_itab__368[] = { /* 0 */ 0, 440, }; static const uint16_t ud_itab__367[] = { /* 0 */ GROUP(368), 0, 0, 0, }; static const uint16_t ud_itab__366[] = { /* 0 */ GROUP(367), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__371[] = { /* 0 */ 0, 441, }; static const uint16_t ud_itab__370[] = { /* 0 */ GROUP(371), 0, 0, 0, }; static const uint16_t ud_itab__369[] = { /* 0 */ GROUP(370), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__374[] = { /* 0 */ 0, 442, }; static const uint16_t ud_itab__373[] = { /* 0 */ GROUP(374), 0, 0, 0, }; static const uint16_t ud_itab__372[] = { /* 0 */ GROUP(373), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__365[] = { /* 0 */ GROUP(366), GROUP(369), GROUP(372), 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__364[] = { /* 0 */ 0, GROUP(365), }; static const uint16_t ud_itab__379[] = { /* 0 */ 0, 443, }; static const uint16_t ud_itab__378[] = { /* 0 */ GROUP(379), 0, 0, 0, }; static const uint16_t ud_itab__377[] = { /* 0 */ GROUP(378), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__382[] = { /* 0 */ 0, 444, }; static const uint16_t ud_itab__381[] = { /* 0 */ GROUP(382), 0, 0, 0, }; static const uint16_t ud_itab__380[] = { /* 0 */ GROUP(381), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__385[] = { /* 0 */ 0, 445, }; static const uint16_t ud_itab__384[] = { /* 0 */ GROUP(385), 0, 0, 0, }; static const uint16_t ud_itab__383[] = { /* 0 */ GROUP(384), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__388[] = { /* 0 */ 0, 446, }; static const uint16_t ud_itab__387[] = { /* 0 */ GROUP(388), 0, 0, 0, }; static const uint16_t ud_itab__386[] = { /* 0 */ GROUP(387), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__391[] = { /* 0 */ 0, 447, }; static const uint16_t ud_itab__390[] = { /* 0 */ GROUP(391), 0, 0, 0, }; static const uint16_t ud_itab__389[] = { /* 0 */ GROUP(390), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__394[] = { /* 0 */ 0, 448, }; static const uint16_t ud_itab__393[] = { /* 0 */ GROUP(394), 0, 0, 0, }; static const uint16_t ud_itab__392[] = { /* 0 */ GROUP(393), 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__376[] = { /* 0 */ GROUP(377), GROUP(380), GROUP(383), GROUP(386), /* 4 */ GROUP(389), GROUP(392), 0, 0, }; static const uint16_t ud_itab__375[] = { /* 0 */ 0, GROUP(376), }; static const uint16_t ud_itab__395[] = { /* 0 */ 449, 0, 0, 0, }; static const uint16_t ud_itab__396[] = { /* 0 */ 450, 0, 0, 0, }; static const uint16_t ud_itab__397[] = { /* 0 */ 451, 0, 0, 0, }; static const uint16_t ud_itab__398[] = { /* 0 */ 452, 0, 0, 0, }; static const uint16_t ud_itab__399[] = { /* 0 */ 453, 0, 0, 0, }; static const uint16_t ud_itab__400[] = { /* 0 */ 454, 0, 0, 0, }; static const uint16_t ud_itab__404[] = { /* 0 */ 455, 0, }; static const uint16_t ud_itab__403[] = { /* 0 */ GROUP(404), 0, 0, 0, }; static const uint16_t ud_itab__406[] = { /* 0 */ 456, 0, }; static const uint16_t ud_itab__405[] = { /* 0 */ GROUP(406), 0, 0, 0, }; static const uint16_t ud_itab__408[] = { /* 0 */ 457, 0, }; static const uint16_t ud_itab__407[] = { /* 0 */ GROUP(408), 0, 0, 0, }; static const uint16_t ud_itab__410[] = { /* 0 */ 458, 0, }; static const uint16_t ud_itab__409[] = { /* 0 */ GROUP(410), 0, 0, 0, }; static const uint16_t ud_itab__412[] = { /* 0 */ 459, 0, }; static const uint16_t ud_itab__411[] = { /* 0 */ GROUP(412), 0, 0, 0, }; static const uint16_t ud_itab__414[] = { /* 0 */ 460, 0, }; static const uint16_t ud_itab__413[] = { /* 0 */ GROUP(414), 0, 0, 0, }; static const uint16_t ud_itab__416[] = { /* 0 */ 461, 0, }; static const uint16_t ud_itab__415[] = { /* 0 */ GROUP(416), 0, 0, 0, }; static const uint16_t ud_itab__402[] = { /* 0 */ GROUP(403), GROUP(405), GROUP(407), GROUP(409), /* 4 */ GROUP(411), GROUP(413), 0, GROUP(415), }; static const uint16_t ud_itab__420[] = { /* 0 */ 0, 462, }; static const uint16_t ud_itab__419[] = { /* 0 */ GROUP(420), 0, 0, 0, }; static const uint16_t ud_itab__422[] = { /* 0 */ 0, 463, }; static const uint16_t ud_itab__421[] = { /* 0 */ GROUP(422), 0, 0, 0, }; static const uint16_t ud_itab__424[] = { /* 0 */ 0, 464, }; static const uint16_t ud_itab__423[] = { /* 0 */ GROUP(424), 0, 0, 0, }; static const uint16_t ud_itab__426[] = { /* 0 */ 0, 465, }; static const uint16_t ud_itab__425[] = { /* 0 */ GROUP(426), 0, 0, 0, }; static const uint16_t ud_itab__428[] = { /* 0 */ 0, 466, }; static const uint16_t ud_itab__427[] = { /* 0 */ GROUP(428), 0, 0, 0, }; static const uint16_t ud_itab__430[] = { /* 0 */ 0, 467, }; static const uint16_t ud_itab__429[] = { /* 0 */ GROUP(430), 0, 0, 0, }; static const uint16_t ud_itab__432[] = { /* 0 */ 0, 468, }; static const uint16_t ud_itab__431[] = { /* 0 */ GROUP(432), 0, 0, 0, }; static const uint16_t ud_itab__434[] = { /* 0 */ 0, 469, }; static const uint16_t ud_itab__433[] = { /* 0 */ GROUP(434), 0, 0, 0, }; static const uint16_t ud_itab__418[] = { /* 0 */ GROUP(419), GROUP(421), GROUP(423), GROUP(425), /* 4 */ GROUP(427), GROUP(429), GROUP(431), GROUP(433), }; static const uint16_t ud_itab__437[] = { /* 0 */ 0, 470, }; static const uint16_t ud_itab__436[] = { /* 0 */ GROUP(437), 0, 0, 0, }; static const uint16_t ud_itab__439[] = { /* 0 */ 0, 471, }; static const uint16_t ud_itab__438[] = { /* 0 */ GROUP(439), 0, 0, 0, }; static const uint16_t ud_itab__441[] = { /* 0 */ 0, 472, }; static const uint16_t ud_itab__440[] = { /* 0 */ GROUP(441), 0, 0, 0, }; static const uint16_t ud_itab__443[] = { /* 0 */ 0, 473, }; static const uint16_t ud_itab__442[] = { /* 0 */ GROUP(443), 0, 0, 0, }; static const uint16_t ud_itab__445[] = { /* 0 */ 0, 474, }; static const uint16_t ud_itab__444[] = { /* 0 */ GROUP(445), 0, 0, 0, }; static const uint16_t ud_itab__447[] = { /* 0 */ 0, 475, }; static const uint16_t ud_itab__446[] = { /* 0 */ GROUP(447), 0, 0, 0, }; static const uint16_t ud_itab__449[] = { /* 0 */ 0, 476, }; static const uint16_t ud_itab__448[] = { /* 0 */ GROUP(449), 0, 0, 0, }; static const uint16_t ud_itab__451[] = { /* 0 */ 0, 477, }; static const uint16_t ud_itab__450[] = { /* 0 */ GROUP(451), 0, 0, 0, }; static const uint16_t ud_itab__435[] = { /* 0 */ GROUP(436), GROUP(438), GROUP(440), GROUP(442), /* 4 */ GROUP(444), GROUP(446), GROUP(448), GROUP(450), }; static const uint16_t ud_itab__454[] = { /* 0 */ 0, 478, }; static const uint16_t ud_itab__453[] = { /* 0 */ GROUP(454), 0, 0, 0, }; static const uint16_t ud_itab__456[] = { /* 0 */ 0, 479, }; static const uint16_t ud_itab__455[] = { /* 0 */ GROUP(456), 0, 0, 0, }; static const uint16_t ud_itab__458[] = { /* 0 */ 0, 480, }; static const uint16_t ud_itab__457[] = { /* 0 */ GROUP(458), 0, 0, 0, }; static const uint16_t ud_itab__460[] = { /* 0 */ 0, 481, }; static const uint16_t ud_itab__459[] = { /* 0 */ GROUP(460), 0, 0, 0, }; static const uint16_t ud_itab__462[] = { /* 0 */ 0, 482, }; static const uint16_t ud_itab__461[] = { /* 0 */ GROUP(462), 0, 0, 0, }; static const uint16_t ud_itab__464[] = { /* 0 */ 0, 483, }; static const uint16_t ud_itab__463[] = { /* 0 */ GROUP(464), 0, 0, 0, }; static const uint16_t ud_itab__466[] = { /* 0 */ 0, 484, }; static const uint16_t ud_itab__465[] = { /* 0 */ GROUP(466), 0, 0, 0, }; static const uint16_t ud_itab__468[] = { /* 0 */ 0, 485, }; static const uint16_t ud_itab__467[] = { /* 0 */ GROUP(468), 0, 0, 0, }; static const uint16_t ud_itab__452[] = { /* 0 */ GROUP(453), GROUP(455), GROUP(457), GROUP(459), /* 4 */ GROUP(461), GROUP(463), GROUP(465), GROUP(467), }; static const uint16_t ud_itab__417[] = { /* 0 */ 0, 0, 0, 0, /* 4 */ 0, GROUP(418), GROUP(435), GROUP(452), }; static const uint16_t ud_itab__401[] = { /* 0 */ GROUP(402), GROUP(417), }; static const uint16_t ud_itab__469[] = { /* 0 */ 486, 0, 0, 0, }; static const uint16_t ud_itab__470[] = { /* 0 */ 487, 0, 0, 0, }; static const uint16_t ud_itab__471[] = { /* 0 */ 488, 0, 0, 0, }; static const uint16_t ud_itab__472[] = { /* 0 */ 489, 0, 0, 0, }; static const uint16_t ud_itab__473[] = { /* 0 */ 490, 0, 0, 0, }; static const uint16_t ud_itab__474[] = { /* 0 */ 491, 0, 0, 0, }; static const uint16_t ud_itab__475[] = { /* 0 */ 492, 0, 0, 0, }; static const uint16_t ud_itab__476[] = { /* 0 */ 493, 0, 0, 0, }; static const uint16_t ud_itab__477[] = { /* 0 */ 494, 0, 0, 0, }; static const uint16_t ud_itab__478[] = { /* 0 */ 0, 0, 495, 0, }; static const uint16_t ud_itab__480[] = { /* 0 */ 496, 0, 0, 0, }; static const uint16_t ud_itab__481[] = { /* 0 */ 497, 0, 0, 0, }; static const uint16_t ud_itab__482[] = { /* 0 */ 498, 0, 0, 0, }; static const uint16_t ud_itab__483[] = { /* 0 */ 499, 0, 0, 0, }; static const uint16_t ud_itab__479[] = { /* 0 */ 0, 0, 0, 0, /* 4 */ GROUP(480), GROUP(481), GROUP(482), GROUP(483), }; static const uint16_t ud_itab__484[] = { /* 0 */ 500, 0, 0, 0, }; static const uint16_t ud_itab__485[] = { /* 0 */ 501, 0, 0, 0, }; static const uint16_t ud_itab__486[] = { /* 0 */ 502, 0, 0, 0, }; static const uint16_t ud_itab__487[] = { /* 0 */ 503, 0, 0, 0, }; static const uint16_t ud_itab__488[] = { /* 0 */ 504, 0, 0, 0, }; static const uint16_t ud_itab__489[] = { /* 0 */ 505, 0, 0, 0, }; static const uint16_t ud_itab__490[] = { /* 0 */ 506, 0, 0, 0, }; static const uint16_t ud_itab__491[] = { /* 0 */ 507, 508, 509, 510, }; static const uint16_t ud_itab__492[] = { /* 0 */ 511, 0, 0, 0, }; static const uint16_t ud_itab__493[] = { /* 0 */ 512, 0, 0, 513, }; static const uint16_t ud_itab__494[] = { /* 0 */ 514, 0, 0, 515, }; static const uint16_t ud_itab__495[] = { /* 0 */ 516, 0, 0, 517, }; static const uint16_t ud_itab__498[] = { /* 0 */ 518, 519, 520, }; static const uint16_t ud_itab__497[] = { /* 0 */ GROUP(498), 0, 0, 0, }; static const uint16_t ud_itab__500[] = { /* 0 */ 0, 521, 0, }; static const uint16_t ud_itab__501[] = { /* 0 */ 0, 522, 0, }; static const uint16_t ud_itab__502[] = { /* 0 */ 0, 523, 0, }; static const uint16_t ud_itab__499[] = { /* 0 */ GROUP(500), 0, GROUP(501), GROUP(502), }; static const uint16_t ud_itab__504[] = { /* 0 */ 0, 524, 0, }; static const uint16_t ud_itab__503[] = { /* 0 */ GROUP(504), 0, 0, 0, }; static const uint16_t ud_itab__496[] = { /* 0 */ 0, GROUP(497), 0, 0, /* 4 */ 0, 0, GROUP(499), GROUP(503), }; static const uint16_t ud_itab__505[] = { /* 0 */ 525, 0, 0, 0, }; static const uint16_t ud_itab__506[] = { /* 0 */ 526, 0, 0, 0, }; static const uint16_t ud_itab__507[] = { /* 0 */ 527, 0, 0, 0, }; static const uint16_t ud_itab__508[] = { /* 0 */ 528, 0, 0, 0, }; static const uint16_t ud_itab__509[] = { /* 0 */ 529, 0, 0, 0, }; static const uint16_t ud_itab__510[] = { /* 0 */ 530, 0, 0, 0, }; static const uint16_t ud_itab__511[] = { /* 0 */ 531, 0, 0, 0, }; static const uint16_t ud_itab__512[] = { /* 0 */ 532, 0, 0, 0, }; static const uint16_t ud_itab__513[] = { /* 0 */ 0, 533, 0, 534, }; static const uint16_t ud_itab__514[] = { /* 0 */ 535, 0, 0, 536, }; static const uint16_t ud_itab__515[] = { /* 0 */ 537, 0, 0, 538, }; static const uint16_t ud_itab__516[] = { /* 0 */ 539, 0, 0, 540, }; static const uint16_t ud_itab__517[] = { /* 0 */ 541, 0, 0, 542, }; static const uint16_t ud_itab__518[] = { /* 0 */ 543, 0, 0, 544, }; static const uint16_t ud_itab__519[] = { /* 0 */ 0, 545, 546, 547, }; static const uint16_t ud_itab__520[] = { /* 0 */ 548, 0, 0, 549, }; static const uint16_t ud_itab__521[] = { /* 0 */ 550, 0, 0, 551, }; static const uint16_t ud_itab__522[] = { /* 0 */ 552, 0, 0, 553, }; static const uint16_t ud_itab__523[] = { /* 0 */ 554, 0, 0, 555, }; static const uint16_t ud_itab__524[] = { /* 0 */ 556, 0, 0, 557, }; static const uint16_t ud_itab__525[] = { /* 0 */ 558, 0, 0, 559, }; static const uint16_t ud_itab__526[] = { /* 0 */ 560, 0, 0, 561, }; static const uint16_t ud_itab__527[] = { /* 0 */ 562, 0, 0, 563, }; static const uint16_t ud_itab__528[] = { /* 0 */ 564, 0, 0, 565, }; static const uint16_t ud_itab__529[] = { /* 0 */ 566, 0, 0, 567, }; static const uint16_t ud_itab__530[] = { /* 0 */ 568, 0, 0, 569, }; static const uint16_t ud_itab__531[] = { /* 0 */ 570, 0, 0, 571, }; static const uint16_t ud_itab__532[] = { /* 0 */ 572, 0, 0, 573, }; static const uint16_t ud_itab__533[] = { /* 0 */ 574, 0, 0, 575, }; static const uint16_t ud_itab__534[] = { /* 0 */ 576, 0, 0, 577, }; static const uint16_t ud_itab__535[] = { /* 0 */ 0, 578, 579, 580, }; static const uint16_t ud_itab__536[] = { /* 0 */ 581, 0, 0, 582, }; static const uint16_t ud_itab__537[] = { /* 0 */ 583, 0, 0, 584, }; static const uint16_t ud_itab__538[] = { /* 0 */ 585, 0, 0, 586, }; static const uint16_t ud_itab__539[] = { /* 0 */ 587, 0, 0, 588, }; static const uint16_t ud_itab__540[] = { /* 0 */ 589, 0, 0, 590, }; static const uint16_t ud_itab__541[] = { /* 0 */ 591, 0, 0, 592, }; static const uint16_t ud_itab__542[] = { /* 0 */ 593, 0, 0, 594, }; static const uint16_t ud_itab__543[] = { /* 0 */ 595, 0, 0, 596, }; static const uint16_t ud_itab__544[] = { /* 0 */ 597, 0, 0, 598, }; static const uint16_t ud_itab__545[] = { /* 0 */ 0, 599, 0, 0, }; static const uint16_t ud_itab__546[] = { /* 0 */ 600, 0, 0, 601, }; static const uint16_t ud_itab__547[] = { /* 0 */ 602, 0, 0, 603, }; static const uint16_t ud_itab__548[] = { /* 0 */ 604, 0, 0, 605, }; static const uint16_t ud_itab__549[] = { /* 0 */ 606, 0, 0, 607, }; static const uint16_t ud_itab__550[] = { /* 0 */ 608, 0, 0, 609, }; static const uint16_t ud_itab__551[] = { /* 0 */ 610, 0, 0, 611, }; static const uint16_t ud_itab__554[] = { /* 0 */ 0, 612, }; static const uint16_t ud_itab__555[] = { /* 0 */ 0, 613, }; static const uint16_t ud_itab__553[] = { /* 0 */ GROUP(554), 0, 0, GROUP(555), }; static const uint16_t ud_itab__552[] = { /* 0 */ 0, GROUP(553), }; static const uint16_t ud_itab__556[] = { /* 0 */ 614, 0, 0, 615, }; static const uint16_t ud_itab__557[] = { /* 0 */ 616, 0, 0, 617, }; static const uint16_t ud_itab__558[] = { /* 0 */ 618, 0, 0, 619, }; static const uint16_t ud_itab__559[] = { /* 0 */ 620, 0, 0, 621, }; static const uint16_t ud_itab__560[] = { /* 0 */ 622, 0, 0, 623, }; static const uint16_t ud_itab__561[] = { /* 0 */ 624, 0, 0, 625, }; static const uint16_t ud_itab__562[] = { /* 0 */ 626, 0, 0, 627, }; static const uint16_t ud_itab__4[] = { /* 0 */ GROUP(5), GROUP(12), GROUP(87), GROUP(88), /* 4 */ 0, GROUP(89), GROUP(90), GROUP(91), /* 8 */ GROUP(92), GROUP(93), 0, GROUP(94), /* c */ 0, GROUP(95), GROUP(104), GROUP(105), /* 10 */ GROUP(106), GROUP(107), GROUP(108), GROUP(118), /* 14 */ GROUP(119), GROUP(120), GROUP(121), GROUP(129), /* 18 */ GROUP(130), GROUP(135), GROUP(136), GROUP(137), /* 1c */ GROUP(138), GROUP(139), GROUP(140), GROUP(141), /* 20 */ GROUP(142), GROUP(143), GROUP(144), GROUP(145), /* 24 */ 0, 0, 0, 0, /* 28 */ GROUP(146), GROUP(147), GROUP(148), GROUP(149), /* 2c */ GROUP(150), GROUP(151), GROUP(152), GROUP(153), /* 30 */ GROUP(154), GROUP(155), GROUP(156), GROUP(157), /* 34 */ GROUP(158), GROUP(161), 0, GROUP(164), /* 38 */ GROUP(165), 0, GROUP(225), 0, /* 3c */ 0, 0, 0, 0, /* 40 */ GROUP(252), GROUP(253), GROUP(254), GROUP(255), /* 44 */ GROUP(256), GROUP(257), GROUP(258), GROUP(259), /* 48 */ GROUP(260), GROUP(261), GROUP(262), GROUP(263), /* 4c */ GROUP(264), GROUP(265), GROUP(266), GROUP(267), /* 50 */ GROUP(268), GROUP(269), GROUP(270), GROUP(271), /* 54 */ GROUP(272), GROUP(273), GROUP(274), GROUP(275), /* 58 */ GROUP(276), GROUP(277), GROUP(278), GROUP(279), /* 5c */ GROUP(280), GROUP(281), GROUP(282), GROUP(283), /* 60 */ GROUP(284), GROUP(285), GROUP(286), GROUP(287), /* 64 */ GROUP(288), GROUP(289), GROUP(290), GROUP(291), /* 68 */ GROUP(292), GROUP(293), GROUP(294), GROUP(295), /* 6c */ GROUP(296), GROUP(297), GROUP(298), GROUP(299), /* 70 */ GROUP(300), GROUP(301), GROUP(305), GROUP(309), /* 74 */ GROUP(314), GROUP(315), GROUP(316), GROUP(317), /* 78 */ GROUP(318), GROUP(320), 0, 0, /* 7c */ GROUP(322), GROUP(323), GROUP(324), GROUP(325), /* 80 */ GROUP(326), GROUP(327), GROUP(328), GROUP(329), /* 84 */ GROUP(330), GROUP(331), GROUP(332), GROUP(333), /* 88 */ GROUP(334), GROUP(335), GROUP(336), GROUP(337), /* 8c */ GROUP(338), GROUP(339), GROUP(340), GROUP(341), /* 90 */ GROUP(342), GROUP(343), GROUP(344), GROUP(345), /* 94 */ GROUP(346), GROUP(347), GROUP(348), GROUP(349), /* 98 */ GROUP(350), GROUP(351), GROUP(352), GROUP(353), /* 9c */ GROUP(354), GROUP(355), GROUP(356), GROUP(357), /* a0 */ GROUP(358), GROUP(359), GROUP(360), GROUP(361), /* a4 */ GROUP(362), GROUP(363), GROUP(364), GROUP(375), /* a8 */ GROUP(395), GROUP(396), GROUP(397), GROUP(398), /* ac */ GROUP(399), GROUP(400), GROUP(401), GROUP(469), /* b0 */ GROUP(470), GROUP(471), GROUP(472), GROUP(473), /* b4 */ GROUP(474), GROUP(475), GROUP(476), GROUP(477), /* b8 */ GROUP(478), 0, GROUP(479), GROUP(484), /* bc */ GROUP(485), GROUP(486), GROUP(487), GROUP(488), /* c0 */ GROUP(489), GROUP(490), GROUP(491), GROUP(492), /* c4 */ GROUP(493), GROUP(494), GROUP(495), GROUP(496), /* c8 */ GROUP(505), GROUP(506), GROUP(507), GROUP(508), /* cc */ GROUP(509), GROUP(510), GROUP(511), GROUP(512), /* d0 */ GROUP(513), GROUP(514), GROUP(515), GROUP(516), /* d4 */ GROUP(517), GROUP(518), GROUP(519), GROUP(520), /* d8 */ GROUP(521), GROUP(522), GROUP(523), GROUP(524), /* dc */ GROUP(525), GROUP(526), GROUP(527), GROUP(528), /* e0 */ GROUP(529), GROUP(530), GROUP(531), GROUP(532), /* e4 */ GROUP(533), GROUP(534), GROUP(535), GROUP(536), /* e8 */ GROUP(537), GROUP(538), GROUP(539), GROUP(540), /* ec */ GROUP(541), GROUP(542), GROUP(543), GROUP(544), /* f0 */ GROUP(545), GROUP(546), GROUP(547), GROUP(548), /* f4 */ GROUP(549), GROUP(550), GROUP(551), GROUP(552), /* f8 */ GROUP(556), GROUP(557), GROUP(558), GROUP(559), /* fc */ GROUP(560), GROUP(561), GROUP(562), 0, }; static const uint16_t ud_itab__563[] = { /* 0 */ 634, 0, }; static const uint16_t ud_itab__564[] = { /* 0 */ 635, 0, }; static const uint16_t ud_itab__565[] = { /* 0 */ 642, 0, }; static const uint16_t ud_itab__566[] = { /* 0 */ 643, 0, }; static const uint16_t ud_itab__567[] = { /* 0 */ 650, 0, }; static const uint16_t ud_itab__568[] = { /* 0 */ 657, 0, }; static const uint16_t ud_itab__569[] = { /* 0 */ 664, 0, }; static const uint16_t ud_itab__570[] = { /* 0 */ 671, 0, }; static const uint16_t ud_itab__572[] = { /* 0 */ 704, 0, }; static const uint16_t ud_itab__573[] = { /* 0 */ 705, 0, }; static const uint16_t ud_itab__571[] = { /* 0 */ GROUP(572), GROUP(573), 0, }; static const uint16_t ud_itab__575[] = { /* 0 */ 706, 0, }; static const uint16_t ud_itab__576[] = { /* 0 */ 707, 0, }; static const uint16_t ud_itab__574[] = { /* 0 */ GROUP(575), GROUP(576), 0, }; static const uint16_t ud_itab__577[] = { /* 0 */ 708, 0, }; static const uint16_t ud_itab__578[] = { /* 0 */ 709, 710, }; static const uint16_t ud_itab__579[] = { /* 0 */ 716, 717, 0, }; static const uint16_t ud_itab__580[] = { /* 0 */ 719, 720, 0, }; static const uint16_t ud_itab__581[] = { /* 0 */ 737, 738, 739, 740, /* 4 */ 741, 742, 743, 744, }; static const uint16_t ud_itab__582[] = { /* 0 */ 745, 746, 747, 748, /* 4 */ 749, 750, 751, 752, }; static const uint16_t ud_itab__584[] = { /* 0 */ 753, 0, }; static const uint16_t ud_itab__585[] = { /* 0 */ 754, 0, }; static const uint16_t ud_itab__586[] = { /* 0 */ 755, 0, }; static const uint16_t ud_itab__587[] = { /* 0 */ 756, 0, }; static const uint16_t ud_itab__588[] = { /* 0 */ 757, 0, }; static const uint16_t ud_itab__589[] = { /* 0 */ 758, 0, }; static const uint16_t ud_itab__590[] = { /* 0 */ 759, 0, }; static const uint16_t ud_itab__591[] = { /* 0 */ 760, 0, }; static const uint16_t ud_itab__583[] = { /* 0 */ GROUP(584), GROUP(585), GROUP(586), GROUP(587), /* 4 */ GROUP(588), GROUP(589), GROUP(590), GROUP(591), }; static const uint16_t ud_itab__592[] = { /* 0 */ 761, 762, 763, 764, /* 4 */ 765, 766, 767, 768, }; static const uint16_t ud_itab__593[] = { /* 0 */ 780, 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__594[] = { /* 0 */ 789, 790, 791, }; static const uint16_t ud_itab__595[] = { /* 0 */ 792, 793, 794, }; static const uint16_t ud_itab__596[] = { /* 0 */ 795, 0, }; static const uint16_t ud_itab__598[] = { /* 0 */ 797, 798, }; static const uint16_t ud_itab__599[] = { /* 0 */ 799, 800, }; static const uint16_t ud_itab__600[] = { /* 0 */ 0, 801, }; static const uint16_t ud_itab__597[] = { /* 0 */ GROUP(598), GROUP(599), GROUP(600), }; static const uint16_t ud_itab__602[] = { /* 0 */ 802, 0, }; static const uint16_t ud_itab__603[] = { /* 0 */ 803, 804, }; static const uint16_t ud_itab__604[] = { /* 0 */ 0, 805, }; static const uint16_t ud_itab__601[] = { /* 0 */ GROUP(602), GROUP(603), GROUP(604), }; static const uint16_t ud_itab__605[] = { /* 0 */ 813, 814, 815, }; static const uint16_t ud_itab__606[] = { /* 0 */ 817, 818, 819, }; static const uint16_t ud_itab__607[] = { /* 0 */ 823, 824, 825, }; static const uint16_t ud_itab__608[] = { /* 0 */ 827, 828, 829, }; static const uint16_t ud_itab__609[] = { /* 0 */ 831, 832, 833, }; static const uint16_t ud_itab__610[] = { /* 0 */ 850, 851, 852, 853, /* 4 */ 854, 855, 856, 857, }; static const uint16_t ud_itab__611[] = { /* 0 */ 858, 859, 860, 861, /* 4 */ 862, 863, 864, 865, }; static const uint16_t ud_itab__612[] = { /* 0 */ 868, 0, }; static const uint16_t ud_itab__613[] = { /* 0 */ 869, 0, }; static const uint16_t ud_itab__614[] = { /* 0 */ 870, 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__615[] = { /* 0 */ 871, 0, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__616[] = { /* 0 */ 878, 0, }; static const uint16_t ud_itab__617[] = { /* 0 */ 879, 880, 881, }; static const uint16_t ud_itab__618[] = { /* 0 */ 882, 883, 884, 885, /* 4 */ 886, 887, 888, 889, }; static const uint16_t ud_itab__619[] = { /* 0 */ 890, 891, 892, 893, /* 4 */ 894, 895, 896, 897, }; static const uint16_t ud_itab__620[] = { /* 0 */ 898, 899, 900, 901, /* 4 */ 902, 903, 904, 905, }; static const uint16_t ud_itab__621[] = { /* 0 */ 906, 907, 908, 909, /* 4 */ 910, 911, 912, 913, }; static const uint16_t ud_itab__622[] = { /* 0 */ 914, 0, }; static const uint16_t ud_itab__623[] = { /* 0 */ 915, 0, }; static const uint16_t ud_itab__624[] = { /* 0 */ 916, 0, }; static const uint16_t ud_itab__627[] = { /* 0 */ 918, 0, }; static const uint16_t ud_itab__628[] = { /* 0 */ 919, 0, }; static const uint16_t ud_itab__629[] = { /* 0 */ 920, 0, }; static const uint16_t ud_itab__630[] = { /* 0 */ 921, 0, }; static const uint16_t ud_itab__631[] = { /* 0 */ 922, 0, }; static const uint16_t ud_itab__632[] = { /* 0 */ 923, 0, }; static const uint16_t ud_itab__633[] = { /* 0 */ 924, 0, }; static const uint16_t ud_itab__634[] = { /* 0 */ 925, 0, }; static const uint16_t ud_itab__626[] = { /* 0 */ GROUP(627), GROUP(628), GROUP(629), GROUP(630), /* 4 */ GROUP(631), GROUP(632), GROUP(633), GROUP(634), }; static const uint16_t ud_itab__636[] = { /* 0 */ 0, 926, }; static const uint16_t ud_itab__637[] = { /* 0 */ 0, 927, }; static const uint16_t ud_itab__638[] = { /* 0 */ 0, 928, }; static const uint16_t ud_itab__639[] = { /* 0 */ 0, 929, }; static const uint16_t ud_itab__640[] = { /* 0 */ 0, 930, }; static const uint16_t ud_itab__641[] = { /* 0 */ 0, 931, }; static const uint16_t ud_itab__642[] = { /* 0 */ 0, 932, }; static const uint16_t ud_itab__643[] = { /* 0 */ 0, 933, }; static const uint16_t ud_itab__644[] = { /* 0 */ 0, 934, }; static const uint16_t ud_itab__645[] = { /* 0 */ 0, 935, }; static const uint16_t ud_itab__646[] = { /* 0 */ 0, 936, }; static const uint16_t ud_itab__647[] = { /* 0 */ 0, 937, }; static const uint16_t ud_itab__648[] = { /* 0 */ 0, 938, }; static const uint16_t ud_itab__649[] = { /* 0 */ 0, 939, }; static const uint16_t ud_itab__650[] = { /* 0 */ 0, 940, }; static const uint16_t ud_itab__651[] = { /* 0 */ 0, 941, }; static const uint16_t ud_itab__652[] = { /* 0 */ 0, 942, }; static const uint16_t ud_itab__653[] = { /* 0 */ 0, 943, }; static const uint16_t ud_itab__654[] = { /* 0 */ 0, 944, }; static const uint16_t ud_itab__655[] = { /* 0 */ 0, 945, }; static const uint16_t ud_itab__656[] = { /* 0 */ 0, 946, }; static const uint16_t ud_itab__657[] = { /* 0 */ 0, 947, }; static const uint16_t ud_itab__658[] = { /* 0 */ 0, 948, }; static const uint16_t ud_itab__659[] = { /* 0 */ 0, 949, }; static const uint16_t ud_itab__660[] = { /* 0 */ 0, 950, }; static const uint16_t ud_itab__661[] = { /* 0 */ 0, 951, }; static const uint16_t ud_itab__662[] = { /* 0 */ 0, 952, }; static const uint16_t ud_itab__663[] = { /* 0 */ 0, 953, }; static const uint16_t ud_itab__664[] = { /* 0 */ 0, 954, }; static const uint16_t ud_itab__665[] = { /* 0 */ 0, 955, }; static const uint16_t ud_itab__666[] = { /* 0 */ 0, 956, }; static const uint16_t ud_itab__667[] = { /* 0 */ 0, 957, }; static const uint16_t ud_itab__668[] = { /* 0 */ 0, 958, }; static const uint16_t ud_itab__669[] = { /* 0 */ 0, 959, }; static const uint16_t ud_itab__670[] = { /* 0 */ 0, 960, }; static const uint16_t ud_itab__671[] = { /* 0 */ 0, 961, }; static const uint16_t ud_itab__672[] = { /* 0 */ 0, 962, }; static const uint16_t ud_itab__673[] = { /* 0 */ 0, 963, }; static const uint16_t ud_itab__674[] = { /* 0 */ 0, 964, }; static const uint16_t ud_itab__675[] = { /* 0 */ 0, 965, }; static const uint16_t ud_itab__676[] = { /* 0 */ 0, 966, }; static const uint16_t ud_itab__677[] = { /* 0 */ 0, 967, }; static const uint16_t ud_itab__678[] = { /* 0 */ 0, 968, }; static const uint16_t ud_itab__679[] = { /* 0 */ 0, 969, }; static const uint16_t ud_itab__680[] = { /* 0 */ 0, 970, }; static const uint16_t ud_itab__681[] = { /* 0 */ 0, 971, }; static const uint16_t ud_itab__682[] = { /* 0 */ 0, 972, }; static const uint16_t ud_itab__683[] = { /* 0 */ 0, 973, }; static const uint16_t ud_itab__684[] = { /* 0 */ 0, 974, }; static const uint16_t ud_itab__685[] = { /* 0 */ 0, 975, }; static const uint16_t ud_itab__686[] = { /* 0 */ 0, 976, }; static const uint16_t ud_itab__687[] = { /* 0 */ 0, 977, }; static const uint16_t ud_itab__688[] = { /* 0 */ 0, 978, }; static const uint16_t ud_itab__689[] = { /* 0 */ 0, 979, }; static const uint16_t ud_itab__690[] = { /* 0 */ 0, 980, }; static const uint16_t ud_itab__691[] = { /* 0 */ 0, 981, }; static const uint16_t ud_itab__692[] = { /* 0 */ 0, 982, }; static const uint16_t ud_itab__693[] = { /* 0 */ 0, 983, }; static const uint16_t ud_itab__694[] = { /* 0 */ 0, 984, }; static const uint16_t ud_itab__695[] = { /* 0 */ 0, 985, }; static const uint16_t ud_itab__696[] = { /* 0 */ 0, 986, }; static const uint16_t ud_itab__697[] = { /* 0 */ 0, 987, }; static const uint16_t ud_itab__698[] = { /* 0 */ 0, 988, }; static const uint16_t ud_itab__699[] = { /* 0 */ 0, 989, }; static const uint16_t ud_itab__635[] = { /* 0 */ GROUP(636), GROUP(637), GROUP(638), GROUP(639), /* 4 */ GROUP(640), GROUP(641), GROUP(642), GROUP(643), /* 8 */ GROUP(644), GROUP(645), GROUP(646), GROUP(647), /* c */ GROUP(648), GROUP(649), GROUP(650), GROUP(651), /* 10 */ GROUP(652), GROUP(653), GROUP(654), GROUP(655), /* 14 */ GROUP(656), GROUP(657), GROUP(658), GROUP(659), /* 18 */ GROUP(660), GROUP(661), GROUP(662), GROUP(663), /* 1c */ GROUP(664), GROUP(665), GROUP(666), GROUP(667), /* 20 */ GROUP(668), GROUP(669), GROUP(670), GROUP(671), /* 24 */ GROUP(672), GROUP(673), GROUP(674), GROUP(675), /* 28 */ GROUP(676), GROUP(677), GROUP(678), GROUP(679), /* 2c */ GROUP(680), GROUP(681), GROUP(682), GROUP(683), /* 30 */ GROUP(684), GROUP(685), GROUP(686), GROUP(687), /* 34 */ GROUP(688), GROUP(689), GROUP(690), GROUP(691), /* 38 */ GROUP(692), GROUP(693), GROUP(694), GROUP(695), /* 3c */ GROUP(696), GROUP(697), GROUP(698), GROUP(699), }; static const uint16_t ud_itab__625[] = { /* 0 */ GROUP(626), GROUP(635), }; static const uint16_t ud_itab__702[] = { /* 0 */ 990, 0, }; static const uint16_t ud_itab__703[] = { /* 0 */ 991, 0, }; static const uint16_t ud_itab__704[] = { /* 0 */ 992, 0, }; static const uint16_t ud_itab__705[] = { /* 0 */ 993, 0, }; static const uint16_t ud_itab__706[] = { /* 0 */ 994, 0, }; static const uint16_t ud_itab__707[] = { /* 0 */ 995, 0, }; static const uint16_t ud_itab__708[] = { /* 0 */ 996, 0, }; static const uint16_t ud_itab__701[] = { /* 0 */ GROUP(702), 0, GROUP(703), GROUP(704), /* 4 */ GROUP(705), GROUP(706), GROUP(707), GROUP(708), }; static const uint16_t ud_itab__710[] = { /* 0 */ 0, 997, }; static const uint16_t ud_itab__711[] = { /* 0 */ 0, 998, }; static const uint16_t ud_itab__712[] = { /* 0 */ 0, 999, }; static const uint16_t ud_itab__713[] = { /* 0 */ 0, 1000, }; static const uint16_t ud_itab__714[] = { /* 0 */ 0, 1001, }; static const uint16_t ud_itab__715[] = { /* 0 */ 0, 1002, }; static const uint16_t ud_itab__716[] = { /* 0 */ 0, 1003, }; static const uint16_t ud_itab__717[] = { /* 0 */ 0, 1004, }; static const uint16_t ud_itab__718[] = { /* 0 */ 0, 1005, }; static const uint16_t ud_itab__719[] = { /* 0 */ 0, 1006, }; static const uint16_t ud_itab__720[] = { /* 0 */ 0, 1007, }; static const uint16_t ud_itab__721[] = { /* 0 */ 0, 1008, }; static const uint16_t ud_itab__722[] = { /* 0 */ 0, 1009, }; static const uint16_t ud_itab__723[] = { /* 0 */ 0, 1010, }; static const uint16_t ud_itab__724[] = { /* 0 */ 0, 1011, }; static const uint16_t ud_itab__725[] = { /* 0 */ 0, 1012, }; static const uint16_t ud_itab__726[] = { /* 0 */ 0, 1013, }; static const uint16_t ud_itab__727[] = { /* 0 */ 0, 1014, }; static const uint16_t ud_itab__728[] = { /* 0 */ 0, 1015, }; static const uint16_t ud_itab__729[] = { /* 0 */ 0, 1016, }; static const uint16_t ud_itab__730[] = { /* 0 */ 0, 1017, }; static const uint16_t ud_itab__731[] = { /* 0 */ 0, 1018, }; static const uint16_t ud_itab__732[] = { /* 0 */ 0, 1019, }; static const uint16_t ud_itab__733[] = { /* 0 */ 0, 1020, }; static const uint16_t ud_itab__734[] = { /* 0 */ 0, 1021, }; static const uint16_t ud_itab__735[] = { /* 0 */ 0, 1022, }; static const uint16_t ud_itab__736[] = { /* 0 */ 0, 1023, }; static const uint16_t ud_itab__737[] = { /* 0 */ 0, 1024, }; static const uint16_t ud_itab__738[] = { /* 0 */ 0, 1025, }; static const uint16_t ud_itab__739[] = { /* 0 */ 0, 1026, }; static const uint16_t ud_itab__740[] = { /* 0 */ 0, 1027, }; static const uint16_t ud_itab__741[] = { /* 0 */ 0, 1028, }; static const uint16_t ud_itab__742[] = { /* 0 */ 0, 1029, }; static const uint16_t ud_itab__743[] = { /* 0 */ 0, 1030, }; static const uint16_t ud_itab__744[] = { /* 0 */ 0, 1031, }; static const uint16_t ud_itab__745[] = { /* 0 */ 0, 1032, }; static const uint16_t ud_itab__746[] = { /* 0 */ 0, 1033, }; static const uint16_t ud_itab__747[] = { /* 0 */ 0, 1034, }; static const uint16_t ud_itab__748[] = { /* 0 */ 0, 1035, }; static const uint16_t ud_itab__749[] = { /* 0 */ 0, 1036, }; static const uint16_t ud_itab__750[] = { /* 0 */ 0, 1037, }; static const uint16_t ud_itab__751[] = { /* 0 */ 0, 1038, }; static const uint16_t ud_itab__752[] = { /* 0 */ 0, 1039, }; static const uint16_t ud_itab__753[] = { /* 0 */ 0, 1040, }; static const uint16_t ud_itab__754[] = { /* 0 */ 0, 1041, }; static const uint16_t ud_itab__755[] = { /* 0 */ 0, 1042, }; static const uint16_t ud_itab__756[] = { /* 0 */ 0, 1043, }; static const uint16_t ud_itab__757[] = { /* 0 */ 0, 1044, }; static const uint16_t ud_itab__758[] = { /* 0 */ 0, 1045, }; static const uint16_t ud_itab__759[] = { /* 0 */ 0, 1046, }; static const uint16_t ud_itab__760[] = { /* 0 */ 0, 1047, }; static const uint16_t ud_itab__761[] = { /* 0 */ 0, 1048, }; static const uint16_t ud_itab__709[] = { /* 0 */ GROUP(710), GROUP(711), GROUP(712), GROUP(713), /* 4 */ GROUP(714), GROUP(715), GROUP(716), GROUP(717), /* 8 */ GROUP(718), GROUP(719), GROUP(720), GROUP(721), /* c */ GROUP(722), GROUP(723), GROUP(724), GROUP(725), /* 10 */ GROUP(726), 0, 0, 0, /* 14 */ 0, 0, 0, 0, /* 18 */ GROUP(727), GROUP(728), GROUP(729), GROUP(730), /* 1c */ GROUP(731), GROUP(732), GROUP(733), GROUP(734), /* 20 */ GROUP(735), GROUP(736), 0, 0, /* 24 */ GROUP(737), GROUP(738), 0, 0, /* 28 */ GROUP(739), GROUP(740), GROUP(741), GROUP(742), /* 2c */ GROUP(743), GROUP(744), GROUP(745), 0, /* 30 */ GROUP(746), GROUP(747), GROUP(748), GROUP(749), /* 34 */ GROUP(750), GROUP(751), GROUP(752), GROUP(753), /* 38 */ GROUP(754), GROUP(755), GROUP(756), GROUP(757), /* 3c */ GROUP(758), GROUP(759), GROUP(760), GROUP(761), }; static const uint16_t ud_itab__700[] = { /* 0 */ GROUP(701), GROUP(709), }; static const uint16_t ud_itab__764[] = { /* 0 */ 1049, 0, }; static const uint16_t ud_itab__765[] = { /* 0 */ 1050, 0, }; static const uint16_t ud_itab__766[] = { /* 0 */ 1051, 0, }; static const uint16_t ud_itab__767[] = { /* 0 */ 1052, 0, }; static const uint16_t ud_itab__768[] = { /* 0 */ 1053, 0, }; static const uint16_t ud_itab__769[] = { /* 0 */ 1054, 0, }; static const uint16_t ud_itab__770[] = { /* 0 */ 1055, 0, }; static const uint16_t ud_itab__771[] = { /* 0 */ 1056, 0, }; static const uint16_t ud_itab__763[] = { /* 0 */ GROUP(764), GROUP(765), GROUP(766), GROUP(767), /* 4 */ GROUP(768), GROUP(769), GROUP(770), GROUP(771), }; static const uint16_t ud_itab__773[] = { /* 0 */ 0, 1057, }; static const uint16_t ud_itab__774[] = { /* 0 */ 0, 1058, }; static const uint16_t ud_itab__775[] = { /* 0 */ 0, 1059, }; static const uint16_t ud_itab__776[] = { /* 0 */ 0, 1060, }; static const uint16_t ud_itab__777[] = { /* 0 */ 0, 1061, }; static const uint16_t ud_itab__778[] = { /* 0 */ 0, 1062, }; static const uint16_t ud_itab__779[] = { /* 0 */ 0, 1063, }; static const uint16_t ud_itab__780[] = { /* 0 */ 0, 1064, }; static const uint16_t ud_itab__781[] = { /* 0 */ 0, 1065, }; static const uint16_t ud_itab__782[] = { /* 0 */ 0, 1066, }; static const uint16_t ud_itab__783[] = { /* 0 */ 0, 1067, }; static const uint16_t ud_itab__784[] = { /* 0 */ 0, 1068, }; static const uint16_t ud_itab__785[] = { /* 0 */ 0, 1069, }; static const uint16_t ud_itab__786[] = { /* 0 */ 0, 1070, }; static const uint16_t ud_itab__787[] = { /* 0 */ 0, 1071, }; static const uint16_t ud_itab__788[] = { /* 0 */ 0, 1072, }; static const uint16_t ud_itab__789[] = { /* 0 */ 0, 1073, }; static const uint16_t ud_itab__790[] = { /* 0 */ 0, 1074, }; static const uint16_t ud_itab__791[] = { /* 0 */ 0, 1075, }; static const uint16_t ud_itab__792[] = { /* 0 */ 0, 1076, }; static const uint16_t ud_itab__793[] = { /* 0 */ 0, 1077, }; static const uint16_t ud_itab__794[] = { /* 0 */ 0, 1078, }; static const uint16_t ud_itab__795[] = { /* 0 */ 0, 1079, }; static const uint16_t ud_itab__796[] = { /* 0 */ 0, 1080, }; static const uint16_t ud_itab__797[] = { /* 0 */ 0, 1081, }; static const uint16_t ud_itab__798[] = { /* 0 */ 0, 1082, }; static const uint16_t ud_itab__799[] = { /* 0 */ 0, 1083, }; static const uint16_t ud_itab__800[] = { /* 0 */ 0, 1084, }; static const uint16_t ud_itab__801[] = { /* 0 */ 0, 1085, }; static const uint16_t ud_itab__802[] = { /* 0 */ 0, 1086, }; static const uint16_t ud_itab__803[] = { /* 0 */ 0, 1087, }; static const uint16_t ud_itab__804[] = { /* 0 */ 0, 1088, }; static const uint16_t ud_itab__805[] = { /* 0 */ 0, 1089, }; static const uint16_t ud_itab__772[] = { /* 0 */ GROUP(773), GROUP(774), GROUP(775), GROUP(776), /* 4 */ GROUP(777), GROUP(778), GROUP(779), GROUP(780), /* 8 */ GROUP(781), GROUP(782), GROUP(783), GROUP(784), /* c */ GROUP(785), GROUP(786), GROUP(787), GROUP(788), /* 10 */ GROUP(789), GROUP(790), GROUP(791), GROUP(792), /* 14 */ GROUP(793), GROUP(794), GROUP(795), GROUP(796), /* 18 */ GROUP(797), GROUP(798), GROUP(799), GROUP(800), /* 1c */ GROUP(801), GROUP(802), GROUP(803), GROUP(804), /* 20 */ 0, 0, 0, 0, /* 24 */ 0, 0, 0, 0, /* 28 */ 0, GROUP(805), 0, 0, /* 2c */ 0, 0, 0, 0, /* 30 */ 0, 0, 0, 0, /* 34 */ 0, 0, 0, 0, /* 38 */ 0, 0, 0, 0, /* 3c */ 0, 0, 0, 0, }; static const uint16_t ud_itab__762[] = { /* 0 */ GROUP(763), GROUP(772), }; static const uint16_t ud_itab__808[] = { /* 0 */ 1090, 0, }; static const uint16_t ud_itab__809[] = { /* 0 */ 1091, 0, }; static const uint16_t ud_itab__810[] = { /* 0 */ 1092, 0, }; static const uint16_t ud_itab__811[] = { /* 0 */ 1093, 0, }; static const uint16_t ud_itab__812[] = { /* 0 */ 1094, 0, }; static const uint16_t ud_itab__813[] = { /* 0 */ 1095, 0, }; static const uint16_t ud_itab__807[] = { /* 0 */ GROUP(808), GROUP(809), GROUP(810), GROUP(811), /* 4 */ 0, GROUP(812), 0, GROUP(813), }; static const uint16_t ud_itab__815[] = { /* 0 */ 0, 1096, }; static const uint16_t ud_itab__816[] = { /* 0 */ 0, 1097, }; static const uint16_t ud_itab__817[] = { /* 0 */ 0, 1098, }; static const uint16_t ud_itab__818[] = { /* 0 */ 0, 1099, }; static const uint16_t ud_itab__819[] = { /* 0 */ 0, 1100, }; static const uint16_t ud_itab__820[] = { /* 0 */ 0, 1101, }; static const uint16_t ud_itab__821[] = { /* 0 */ 0, 1102, }; static const uint16_t ud_itab__822[] = { /* 0 */ 0, 1103, }; static const uint16_t ud_itab__823[] = { /* 0 */ 0, 1104, }; static const uint16_t ud_itab__824[] = { /* 0 */ 0, 1105, }; static const uint16_t ud_itab__825[] = { /* 0 */ 0, 1106, }; static const uint16_t ud_itab__826[] = { /* 0 */ 0, 1107, }; static const uint16_t ud_itab__827[] = { /* 0 */ 0, 1108, }; static const uint16_t ud_itab__828[] = { /* 0 */ 0, 1109, }; static const uint16_t ud_itab__829[] = { /* 0 */ 0, 1110, }; static const uint16_t ud_itab__830[] = { /* 0 */ 0, 1111, }; static const uint16_t ud_itab__831[] = { /* 0 */ 0, 1112, }; static const uint16_t ud_itab__832[] = { /* 0 */ 0, 1113, }; static const uint16_t ud_itab__833[] = { /* 0 */ 0, 1114, }; static const uint16_t ud_itab__834[] = { /* 0 */ 0, 1115, }; static const uint16_t ud_itab__835[] = { /* 0 */ 0, 1116, }; static const uint16_t ud_itab__836[] = { /* 0 */ 0, 1117, }; static const uint16_t ud_itab__837[] = { /* 0 */ 0, 1118, }; static const uint16_t ud_itab__838[] = { /* 0 */ 0, 1119, }; static const uint16_t ud_itab__839[] = { /* 0 */ 0, 1120, }; static const uint16_t ud_itab__840[] = { /* 0 */ 0, 1121, }; static const uint16_t ud_itab__841[] = { /* 0 */ 0, 1122, }; static const uint16_t ud_itab__842[] = { /* 0 */ 0, 1123, }; static const uint16_t ud_itab__843[] = { /* 0 */ 0, 1124, }; static const uint16_t ud_itab__844[] = { /* 0 */ 0, 1125, }; static const uint16_t ud_itab__845[] = { /* 0 */ 0, 1126, }; static const uint16_t ud_itab__846[] = { /* 0 */ 0, 1127, }; static const uint16_t ud_itab__847[] = { /* 0 */ 0, 1128, }; static const uint16_t ud_itab__848[] = { /* 0 */ 0, 1129, }; static const uint16_t ud_itab__849[] = { /* 0 */ 0, 1130, }; static const uint16_t ud_itab__850[] = { /* 0 */ 0, 1131, }; static const uint16_t ud_itab__851[] = { /* 0 */ 0, 1132, }; static const uint16_t ud_itab__852[] = { /* 0 */ 0, 1133, }; static const uint16_t ud_itab__853[] = { /* 0 */ 0, 1134, }; static const uint16_t ud_itab__854[] = { /* 0 */ 0, 1135, }; static const uint16_t ud_itab__855[] = { /* 0 */ 0, 1136, }; static const uint16_t ud_itab__856[] = { /* 0 */ 0, 1137, }; static const uint16_t ud_itab__857[] = { /* 0 */ 0, 1138, }; static const uint16_t ud_itab__858[] = { /* 0 */ 0, 1139, }; static const uint16_t ud_itab__859[] = { /* 0 */ 0, 1140, }; static const uint16_t ud_itab__860[] = { /* 0 */ 0, 1141, }; static const uint16_t ud_itab__861[] = { /* 0 */ 0, 1142, }; static const uint16_t ud_itab__862[] = { /* 0 */ 0, 1143, }; static const uint16_t ud_itab__863[] = { /* 0 */ 0, 1144, }; static const uint16_t ud_itab__864[] = { /* 0 */ 0, 1145, }; static const uint16_t ud_itab__814[] = { /* 0 */ GROUP(815), GROUP(816), GROUP(817), GROUP(818), /* 4 */ GROUP(819), GROUP(820), GROUP(821), GROUP(822), /* 8 */ GROUP(823), GROUP(824), GROUP(825), GROUP(826), /* c */ GROUP(827), GROUP(828), GROUP(829), GROUP(830), /* 10 */ GROUP(831), GROUP(832), GROUP(833), GROUP(834), /* 14 */ GROUP(835), GROUP(836), GROUP(837), GROUP(838), /* 18 */ GROUP(839), GROUP(840), GROUP(841), GROUP(842), /* 1c */ GROUP(843), GROUP(844), GROUP(845), GROUP(846), /* 20 */ 0, 0, GROUP(847), GROUP(848), /* 24 */ 0, 0, 0, 0, /* 28 */ GROUP(849), GROUP(850), GROUP(851), GROUP(852), /* 2c */ GROUP(853), GROUP(854), GROUP(855), GROUP(856), /* 30 */ GROUP(857), GROUP(858), GROUP(859), GROUP(860), /* 34 */ GROUP(861), GROUP(862), GROUP(863), GROUP(864), /* 38 */ 0, 0, 0, 0, /* 3c */ 0, 0, 0, 0, }; static const uint16_t ud_itab__806[] = { /* 0 */ GROUP(807), GROUP(814), }; static const uint16_t ud_itab__867[] = { /* 0 */ 1146, 0, }; static const uint16_t ud_itab__868[] = { /* 0 */ 1147, 0, }; static const uint16_t ud_itab__869[] = { /* 0 */ 1148, 0, }; static const uint16_t ud_itab__870[] = { /* 0 */ 1149, 0, }; static const uint16_t ud_itab__871[] = { /* 0 */ 1150, 0, }; static const uint16_t ud_itab__872[] = { /* 0 */ 1151, 0, }; static const uint16_t ud_itab__873[] = { /* 0 */ 1152, 0, }; static const uint16_t ud_itab__874[] = { /* 0 */ 1153, 0, }; static const uint16_t ud_itab__866[] = { /* 0 */ GROUP(867), GROUP(868), GROUP(869), GROUP(870), /* 4 */ GROUP(871), GROUP(872), GROUP(873), GROUP(874), }; static const uint16_t ud_itab__876[] = { /* 0 */ 0, 1154, }; static const uint16_t ud_itab__877[] = { /* 0 */ 0, 1155, }; static const uint16_t ud_itab__878[] = { /* 0 */ 0, 1156, }; static const uint16_t ud_itab__879[] = { /* 0 */ 0, 1157, }; static const uint16_t ud_itab__880[] = { /* 0 */ 0, 1158, }; static const uint16_t ud_itab__881[] = { /* 0 */ 0, 1159, }; static const uint16_t ud_itab__882[] = { /* 0 */ 0, 1160, }; static const uint16_t ud_itab__883[] = { /* 0 */ 0, 1161, }; static const uint16_t ud_itab__884[] = { /* 0 */ 0, 1162, }; static const uint16_t ud_itab__885[] = { /* 0 */ 0, 1163, }; static const uint16_t ud_itab__886[] = { /* 0 */ 0, 1164, }; static const uint16_t ud_itab__887[] = { /* 0 */ 0, 1165, }; static const uint16_t ud_itab__888[] = { /* 0 */ 0, 1166, }; static const uint16_t ud_itab__889[] = { /* 0 */ 0, 1167, }; static const uint16_t ud_itab__890[] = { /* 0 */ 0, 1168, }; static const uint16_t ud_itab__891[] = { /* 0 */ 0, 1169, }; static const uint16_t ud_itab__892[] = { /* 0 */ 0, 1170, }; static const uint16_t ud_itab__893[] = { /* 0 */ 0, 1171, }; static const uint16_t ud_itab__894[] = { /* 0 */ 0, 1172, }; static const uint16_t ud_itab__895[] = { /* 0 */ 0, 1173, }; static const uint16_t ud_itab__896[] = { /* 0 */ 0, 1174, }; static const uint16_t ud_itab__897[] = { /* 0 */ 0, 1175, }; static const uint16_t ud_itab__898[] = { /* 0 */ 0, 1176, }; static const uint16_t ud_itab__899[] = { /* 0 */ 0, 1177, }; static const uint16_t ud_itab__900[] = { /* 0 */ 0, 1178, }; static const uint16_t ud_itab__901[] = { /* 0 */ 0, 1179, }; static const uint16_t ud_itab__902[] = { /* 0 */ 0, 1180, }; static const uint16_t ud_itab__903[] = { /* 0 */ 0, 1181, }; static const uint16_t ud_itab__904[] = { /* 0 */ 0, 1182, }; static const uint16_t ud_itab__905[] = { /* 0 */ 0, 1183, }; static const uint16_t ud_itab__906[] = { /* 0 */ 0, 1184, }; static const uint16_t ud_itab__907[] = { /* 0 */ 0, 1185, }; static const uint16_t ud_itab__908[] = { /* 0 */ 0, 1186, }; static const uint16_t ud_itab__909[] = { /* 0 */ 0, 1187, }; static const uint16_t ud_itab__910[] = { /* 0 */ 0, 1188, }; static const uint16_t ud_itab__911[] = { /* 0 */ 0, 1189, }; static const uint16_t ud_itab__912[] = { /* 0 */ 0, 1190, }; static const uint16_t ud_itab__913[] = { /* 0 */ 0, 1191, }; static const uint16_t ud_itab__914[] = { /* 0 */ 0, 1192, }; static const uint16_t ud_itab__915[] = { /* 0 */ 0, 1193, }; static const uint16_t ud_itab__916[] = { /* 0 */ 0, 1194, }; static const uint16_t ud_itab__917[] = { /* 0 */ 0, 1195, }; static const uint16_t ud_itab__918[] = { /* 0 */ 0, 1196, }; static const uint16_t ud_itab__919[] = { /* 0 */ 0, 1197, }; static const uint16_t ud_itab__920[] = { /* 0 */ 0, 1198, }; static const uint16_t ud_itab__921[] = { /* 0 */ 0, 1199, }; static const uint16_t ud_itab__922[] = { /* 0 */ 0, 1200, }; static const uint16_t ud_itab__923[] = { /* 0 */ 0, 1201, }; static const uint16_t ud_itab__924[] = { /* 0 */ 0, 1202, }; static const uint16_t ud_itab__925[] = { /* 0 */ 0, 1203, }; static const uint16_t ud_itab__926[] = { /* 0 */ 0, 1204, }; static const uint16_t ud_itab__927[] = { /* 0 */ 0, 1205, }; static const uint16_t ud_itab__928[] = { /* 0 */ 0, 1206, }; static const uint16_t ud_itab__929[] = { /* 0 */ 0, 1207, }; static const uint16_t ud_itab__930[] = { /* 0 */ 0, 1208, }; static const uint16_t ud_itab__931[] = { /* 0 */ 0, 1209, }; static const uint16_t ud_itab__932[] = { /* 0 */ 0, 1210, }; static const uint16_t ud_itab__933[] = { /* 0 */ 0, 1211, }; static const uint16_t ud_itab__934[] = { /* 0 */ 0, 1212, }; static const uint16_t ud_itab__935[] = { /* 0 */ 0, 1213, }; static const uint16_t ud_itab__936[] = { /* 0 */ 0, 1214, }; static const uint16_t ud_itab__937[] = { /* 0 */ 0, 1215, }; static const uint16_t ud_itab__938[] = { /* 0 */ 0, 1216, }; static const uint16_t ud_itab__939[] = { /* 0 */ 0, 1217, }; static const uint16_t ud_itab__875[] = { /* 0 */ GROUP(876), GROUP(877), GROUP(878), GROUP(879), /* 4 */ GROUP(880), GROUP(881), GROUP(882), GROUP(883), /* 8 */ GROUP(884), GROUP(885), GROUP(886), GROUP(887), /* c */ GROUP(888), GROUP(889), GROUP(890), GROUP(891), /* 10 */ GROUP(892), GROUP(893), GROUP(894), GROUP(895), /* 14 */ GROUP(896), GROUP(897), GROUP(898), GROUP(899), /* 18 */ GROUP(900), GROUP(901), GROUP(902), GROUP(903), /* 1c */ GROUP(904), GROUP(905), GROUP(906), GROUP(907), /* 20 */ GROUP(908), GROUP(909), GROUP(910), GROUP(911), /* 24 */ GROUP(912), GROUP(913), GROUP(914), GROUP(915), /* 28 */ GROUP(916), GROUP(917), GROUP(918), GROUP(919), /* 2c */ GROUP(920), GROUP(921), GROUP(922), GROUP(923), /* 30 */ GROUP(924), GROUP(925), GROUP(926), GROUP(927), /* 34 */ GROUP(928), GROUP(929), GROUP(930), GROUP(931), /* 38 */ GROUP(932), GROUP(933), GROUP(934), GROUP(935), /* 3c */ GROUP(936), GROUP(937), GROUP(938), GROUP(939), }; static const uint16_t ud_itab__865[] = { /* 0 */ GROUP(866), GROUP(875), }; static const uint16_t ud_itab__942[] = { /* 0 */ 1218, 0, }; static const uint16_t ud_itab__943[] = { /* 0 */ 1219, 0, }; static const uint16_t ud_itab__944[] = { /* 0 */ 1220, 0, }; static const uint16_t ud_itab__945[] = { /* 0 */ 1221, 0, }; static const uint16_t ud_itab__946[] = { /* 0 */ 1222, 0, }; static const uint16_t ud_itab__947[] = { /* 0 */ 1223, 0, }; static const uint16_t ud_itab__948[] = { /* 0 */ 1224, 0, }; static const uint16_t ud_itab__941[] = { /* 0 */ GROUP(942), GROUP(943), GROUP(944), GROUP(945), /* 4 */ GROUP(946), 0, GROUP(947), GROUP(948), }; static const uint16_t ud_itab__950[] = { /* 0 */ 0, 1225, }; static const uint16_t ud_itab__951[] = { /* 0 */ 0, 1226, }; static const uint16_t ud_itab__952[] = { /* 0 */ 0, 1227, }; static const uint16_t ud_itab__953[] = { /* 0 */ 0, 1228, }; static const uint16_t ud_itab__954[] = { /* 0 */ 0, 1229, }; static const uint16_t ud_itab__955[] = { /* 0 */ 0, 1230, }; static const uint16_t ud_itab__956[] = { /* 0 */ 0, 1231, }; static const uint16_t ud_itab__957[] = { /* 0 */ 0, 1232, }; static const uint16_t ud_itab__958[] = { /* 0 */ 0, 1233, }; static const uint16_t ud_itab__959[] = { /* 0 */ 0, 1234, }; static const uint16_t ud_itab__960[] = { /* 0 */ 0, 1235, }; static const uint16_t ud_itab__961[] = { /* 0 */ 0, 1236, }; static const uint16_t ud_itab__962[] = { /* 0 */ 0, 1237, }; static const uint16_t ud_itab__963[] = { /* 0 */ 0, 1238, }; static const uint16_t ud_itab__964[] = { /* 0 */ 0, 1239, }; static const uint16_t ud_itab__965[] = { /* 0 */ 0, 1240, }; static const uint16_t ud_itab__966[] = { /* 0 */ 0, 1241, }; static const uint16_t ud_itab__967[] = { /* 0 */ 0, 1242, }; static const uint16_t ud_itab__968[] = { /* 0 */ 0, 1243, }; static const uint16_t ud_itab__969[] = { /* 0 */ 0, 1244, }; static const uint16_t ud_itab__970[] = { /* 0 */ 0, 1245, }; static const uint16_t ud_itab__971[] = { /* 0 */ 0, 1246, }; static const uint16_t ud_itab__972[] = { /* 0 */ 0, 1247, }; static const uint16_t ud_itab__973[] = { /* 0 */ 0, 1248, }; static const uint16_t ud_itab__974[] = { /* 0 */ 0, 1249, }; static const uint16_t ud_itab__975[] = { /* 0 */ 0, 1250, }; static const uint16_t ud_itab__976[] = { /* 0 */ 0, 1251, }; static const uint16_t ud_itab__977[] = { /* 0 */ 0, 1252, }; static const uint16_t ud_itab__978[] = { /* 0 */ 0, 1253, }; static const uint16_t ud_itab__979[] = { /* 0 */ 0, 1254, }; static const uint16_t ud_itab__980[] = { /* 0 */ 0, 1255, }; static const uint16_t ud_itab__981[] = { /* 0 */ 0, 1256, }; static const uint16_t ud_itab__982[] = { /* 0 */ 0, 1257, }; static const uint16_t ud_itab__983[] = { /* 0 */ 0, 1258, }; static const uint16_t ud_itab__984[] = { /* 0 */ 0, 1259, }; static const uint16_t ud_itab__985[] = { /* 0 */ 0, 1260, }; static const uint16_t ud_itab__986[] = { /* 0 */ 0, 1261, }; static const uint16_t ud_itab__987[] = { /* 0 */ 0, 1262, }; static const uint16_t ud_itab__988[] = { /* 0 */ 0, 1263, }; static const uint16_t ud_itab__989[] = { /* 0 */ 0, 1264, }; static const uint16_t ud_itab__990[] = { /* 0 */ 0, 1265, }; static const uint16_t ud_itab__991[] = { /* 0 */ 0, 1266, }; static const uint16_t ud_itab__992[] = { /* 0 */ 0, 1267, }; static const uint16_t ud_itab__993[] = { /* 0 */ 0, 1268, }; static const uint16_t ud_itab__994[] = { /* 0 */ 0, 1269, }; static const uint16_t ud_itab__995[] = { /* 0 */ 0, 1270, }; static const uint16_t ud_itab__996[] = { /* 0 */ 0, 1271, }; static const uint16_t ud_itab__997[] = { /* 0 */ 0, 1272, }; static const uint16_t ud_itab__949[] = { /* 0 */ GROUP(950), GROUP(951), GROUP(952), GROUP(953), /* 4 */ GROUP(954), GROUP(955), GROUP(956), GROUP(957), /* 8 */ GROUP(958), GROUP(959), GROUP(960), GROUP(961), /* c */ GROUP(962), GROUP(963), GROUP(964), GROUP(965), /* 10 */ GROUP(966), GROUP(967), GROUP(968), GROUP(969), /* 14 */ GROUP(970), GROUP(971), GROUP(972), GROUP(973), /* 18 */ GROUP(974), GROUP(975), GROUP(976), GROUP(977), /* 1c */ GROUP(978), GROUP(979), GROUP(980), GROUP(981), /* 20 */ GROUP(982), GROUP(983), GROUP(984), GROUP(985), /* 24 */ GROUP(986), GROUP(987), GROUP(988), GROUP(989), /* 28 */ GROUP(990), GROUP(991), GROUP(992), GROUP(993), /* 2c */ GROUP(994), GROUP(995), GROUP(996), GROUP(997), /* 30 */ 0, 0, 0, 0, /* 34 */ 0, 0, 0, 0, /* 38 */ 0, 0, 0, 0, /* 3c */ 0, 0, 0, 0, }; static const uint16_t ud_itab__940[] = { /* 0 */ GROUP(941), GROUP(949), }; static const uint16_t ud_itab__1000[] = { /* 0 */ 1273, 0, }; static const uint16_t ud_itab__1001[] = { /* 0 */ 1274, 0, }; static const uint16_t ud_itab__1002[] = { /* 0 */ 1275, 0, }; static const uint16_t ud_itab__1003[] = { /* 0 */ 1276, 0, }; static const uint16_t ud_itab__1004[] = { /* 0 */ 1277, 0, }; static const uint16_t ud_itab__1005[] = { /* 0 */ 1278, 0, }; static const uint16_t ud_itab__1006[] = { /* 0 */ 1279, 0, }; static const uint16_t ud_itab__1007[] = { /* 0 */ 1280, 0, }; static const uint16_t ud_itab__999[] = { /* 0 */ GROUP(1000), GROUP(1001), GROUP(1002), GROUP(1003), /* 4 */ GROUP(1004), GROUP(1005), GROUP(1006), GROUP(1007), }; static const uint16_t ud_itab__1009[] = { /* 0 */ 0, 1281, }; static const uint16_t ud_itab__1010[] = { /* 0 */ 0, 1282, }; static const uint16_t ud_itab__1011[] = { /* 0 */ 0, 1283, }; static const uint16_t ud_itab__1012[] = { /* 0 */ 0, 1284, }; static const uint16_t ud_itab__1013[] = { /* 0 */ 0, 1285, }; static const uint16_t ud_itab__1014[] = { /* 0 */ 0, 1286, }; static const uint16_t ud_itab__1015[] = { /* 0 */ 0, 1287, }; static const uint16_t ud_itab__1016[] = { /* 0 */ 0, 1288, }; static const uint16_t ud_itab__1017[] = { /* 0 */ 0, 1289, }; static const uint16_t ud_itab__1018[] = { /* 0 */ 0, 1290, }; static const uint16_t ud_itab__1019[] = { /* 0 */ 0, 1291, }; static const uint16_t ud_itab__1020[] = { /* 0 */ 0, 1292, }; static const uint16_t ud_itab__1021[] = { /* 0 */ 0, 1293, }; static const uint16_t ud_itab__1022[] = { /* 0 */ 0, 1294, }; static const uint16_t ud_itab__1023[] = { /* 0 */ 0, 1295, }; static const uint16_t ud_itab__1024[] = { /* 0 */ 0, 1296, }; static const uint16_t ud_itab__1025[] = { /* 0 */ 0, 1297, }; static const uint16_t ud_itab__1026[] = { /* 0 */ 0, 1298, }; static const uint16_t ud_itab__1027[] = { /* 0 */ 0, 1299, }; static const uint16_t ud_itab__1028[] = { /* 0 */ 0, 1300, }; static const uint16_t ud_itab__1029[] = { /* 0 */ 0, 1301, }; static const uint16_t ud_itab__1030[] = { /* 0 */ 0, 1302, }; static const uint16_t ud_itab__1031[] = { /* 0 */ 0, 1303, }; static const uint16_t ud_itab__1032[] = { /* 0 */ 0, 1304, }; static const uint16_t ud_itab__1033[] = { /* 0 */ 0, 1305, }; static const uint16_t ud_itab__1034[] = { /* 0 */ 0, 1306, }; static const uint16_t ud_itab__1035[] = { /* 0 */ 0, 1307, }; static const uint16_t ud_itab__1036[] = { /* 0 */ 0, 1308, }; static const uint16_t ud_itab__1037[] = { /* 0 */ 0, 1309, }; static const uint16_t ud_itab__1038[] = { /* 0 */ 0, 1310, }; static const uint16_t ud_itab__1039[] = { /* 0 */ 0, 1311, }; static const uint16_t ud_itab__1040[] = { /* 0 */ 0, 1312, }; static const uint16_t ud_itab__1041[] = { /* 0 */ 0, 1313, }; static const uint16_t ud_itab__1042[] = { /* 0 */ 0, 1314, }; static const uint16_t ud_itab__1043[] = { /* 0 */ 0, 1315, }; static const uint16_t ud_itab__1044[] = { /* 0 */ 0, 1316, }; static const uint16_t ud_itab__1045[] = { /* 0 */ 0, 1317, }; static const uint16_t ud_itab__1046[] = { /* 0 */ 0, 1318, }; static const uint16_t ud_itab__1047[] = { /* 0 */ 0, 1319, }; static const uint16_t ud_itab__1048[] = { /* 0 */ 0, 1320, }; static const uint16_t ud_itab__1049[] = { /* 0 */ 0, 1321, }; static const uint16_t ud_itab__1050[] = { /* 0 */ 0, 1322, }; static const uint16_t ud_itab__1051[] = { /* 0 */ 0, 1323, }; static const uint16_t ud_itab__1052[] = { /* 0 */ 0, 1324, }; static const uint16_t ud_itab__1053[] = { /* 0 */ 0, 1325, }; static const uint16_t ud_itab__1054[] = { /* 0 */ 0, 1326, }; static const uint16_t ud_itab__1055[] = { /* 0 */ 0, 1327, }; static const uint16_t ud_itab__1056[] = { /* 0 */ 0, 1328, }; static const uint16_t ud_itab__1057[] = { /* 0 */ 0, 1329, }; static const uint16_t ud_itab__1058[] = { /* 0 */ 0, 1330, }; static const uint16_t ud_itab__1059[] = { /* 0 */ 0, 1331, }; static const uint16_t ud_itab__1060[] = { /* 0 */ 0, 1332, }; static const uint16_t ud_itab__1061[] = { /* 0 */ 0, 1333, }; static const uint16_t ud_itab__1062[] = { /* 0 */ 0, 1334, }; static const uint16_t ud_itab__1063[] = { /* 0 */ 0, 1335, }; static const uint16_t ud_itab__1064[] = { /* 0 */ 0, 1336, }; static const uint16_t ud_itab__1065[] = { /* 0 */ 0, 1337, }; static const uint16_t ud_itab__1008[] = { /* 0 */ GROUP(1009), GROUP(1010), GROUP(1011), GROUP(1012), /* 4 */ GROUP(1013), GROUP(1014), GROUP(1015), GROUP(1016), /* 8 */ GROUP(1017), GROUP(1018), GROUP(1019), GROUP(1020), /* c */ GROUP(1021), GROUP(1022), GROUP(1023), GROUP(1024), /* 10 */ GROUP(1025), GROUP(1026), GROUP(1027), GROUP(1028), /* 14 */ GROUP(1029), GROUP(1030), GROUP(1031), GROUP(1032), /* 18 */ 0, GROUP(1033), 0, 0, /* 1c */ 0, 0, 0, 0, /* 20 */ GROUP(1034), GROUP(1035), GROUP(1036), GROUP(1037), /* 24 */ GROUP(1038), GROUP(1039), GROUP(1040), GROUP(1041), /* 28 */ GROUP(1042), GROUP(1043), GROUP(1044), GROUP(1045), /* 2c */ GROUP(1046), GROUP(1047), GROUP(1048), GROUP(1049), /* 30 */ GROUP(1050), GROUP(1051), GROUP(1052), GROUP(1053), /* 34 */ GROUP(1054), GROUP(1055), GROUP(1056), GROUP(1057), /* 38 */ GROUP(1058), GROUP(1059), GROUP(1060), GROUP(1061), /* 3c */ GROUP(1062), GROUP(1063), GROUP(1064), GROUP(1065), }; static const uint16_t ud_itab__998[] = { /* 0 */ GROUP(999), GROUP(1008), }; static const uint16_t ud_itab__1068[] = { /* 0 */ 1338, 0, }; static const uint16_t ud_itab__1069[] = { /* 0 */ 1339, 0, }; static const uint16_t ud_itab__1070[] = { /* 0 */ 1340, 0, }; static const uint16_t ud_itab__1071[] = { /* 0 */ 1341, 0, }; static const uint16_t ud_itab__1072[] = { /* 0 */ 1342, 0, }; static const uint16_t ud_itab__1073[] = { /* 0 */ 1343, 0, }; static const uint16_t ud_itab__1074[] = { /* 0 */ 1344, 0, }; static const uint16_t ud_itab__1075[] = { /* 0 */ 1345, 0, }; static const uint16_t ud_itab__1067[] = { /* 0 */ GROUP(1068), GROUP(1069), GROUP(1070), GROUP(1071), /* 4 */ GROUP(1072), GROUP(1073), GROUP(1074), GROUP(1075), }; static const uint16_t ud_itab__1077[] = { /* 0 */ 0, 1346, }; static const uint16_t ud_itab__1078[] = { /* 0 */ 0, 1347, }; static const uint16_t ud_itab__1079[] = { /* 0 */ 0, 1348, }; static const uint16_t ud_itab__1080[] = { /* 0 */ 0, 1349, }; static const uint16_t ud_itab__1081[] = { /* 0 */ 0, 1350, }; static const uint16_t ud_itab__1082[] = { /* 0 */ 0, 1351, }; static const uint16_t ud_itab__1083[] = { /* 0 */ 0, 1352, }; static const uint16_t ud_itab__1084[] = { /* 0 */ 0, 1353, }; static const uint16_t ud_itab__1085[] = { /* 0 */ 0, 1354, }; static const uint16_t ud_itab__1086[] = { /* 0 */ 0, 1355, }; static const uint16_t ud_itab__1087[] = { /* 0 */ 0, 1356, }; static const uint16_t ud_itab__1088[] = { /* 0 */ 0, 1357, }; static const uint16_t ud_itab__1089[] = { /* 0 */ 0, 1358, }; static const uint16_t ud_itab__1090[] = { /* 0 */ 0, 1359, }; static const uint16_t ud_itab__1091[] = { /* 0 */ 0, 1360, }; static const uint16_t ud_itab__1092[] = { /* 0 */ 0, 1361, }; static const uint16_t ud_itab__1093[] = { /* 0 */ 0, 1362, }; static const uint16_t ud_itab__1094[] = { /* 0 */ 0, 1363, }; static const uint16_t ud_itab__1095[] = { /* 0 */ 0, 1364, }; static const uint16_t ud_itab__1096[] = { /* 0 */ 0, 1365, }; static const uint16_t ud_itab__1097[] = { /* 0 */ 0, 1366, }; static const uint16_t ud_itab__1098[] = { /* 0 */ 0, 1367, }; static const uint16_t ud_itab__1099[] = { /* 0 */ 0, 1368, }; static const uint16_t ud_itab__1100[] = { /* 0 */ 0, 1369, }; static const uint16_t ud_itab__1101[] = { /* 0 */ 0, 1370, }; static const uint16_t ud_itab__1102[] = { /* 0 */ 0, 1371, }; static const uint16_t ud_itab__1103[] = { /* 0 */ 0, 1372, }; static const uint16_t ud_itab__1104[] = { /* 0 */ 0, 1373, }; static const uint16_t ud_itab__1105[] = { /* 0 */ 0, 1374, }; static const uint16_t ud_itab__1106[] = { /* 0 */ 0, 1375, }; static const uint16_t ud_itab__1107[] = { /* 0 */ 0, 1376, }; static const uint16_t ud_itab__1108[] = { /* 0 */ 0, 1377, }; static const uint16_t ud_itab__1109[] = { /* 0 */ 0, 1378, }; static const uint16_t ud_itab__1110[] = { /* 0 */ 0, 1379, }; static const uint16_t ud_itab__1111[] = { /* 0 */ 0, 1380, }; static const uint16_t ud_itab__1112[] = { /* 0 */ 0, 1381, }; static const uint16_t ud_itab__1113[] = { /* 0 */ 0, 1382, }; static const uint16_t ud_itab__1114[] = { /* 0 */ 0, 1383, }; static const uint16_t ud_itab__1115[] = { /* 0 */ 0, 1384, }; static const uint16_t ud_itab__1116[] = { /* 0 */ 0, 1385, }; static const uint16_t ud_itab__1117[] = { /* 0 */ 0, 1386, }; static const uint16_t ud_itab__1118[] = { /* 0 */ 0, 1387, }; static const uint16_t ud_itab__1119[] = { /* 0 */ 0, 1388, }; static const uint16_t ud_itab__1120[] = { /* 0 */ 0, 1389, }; static const uint16_t ud_itab__1121[] = { /* 0 */ 0, 1390, }; static const uint16_t ud_itab__1122[] = { /* 0 */ 0, 1391, }; static const uint16_t ud_itab__1123[] = { /* 0 */ 0, 1392, }; static const uint16_t ud_itab__1124[] = { /* 0 */ 0, 1393, }; static const uint16_t ud_itab__1125[] = { /* 0 */ 0, 1394, }; static const uint16_t ud_itab__1076[] = { /* 0 */ GROUP(1077), GROUP(1078), GROUP(1079), GROUP(1080), /* 4 */ GROUP(1081), GROUP(1082), GROUP(1083), GROUP(1084), /* 8 */ GROUP(1085), GROUP(1086), GROUP(1087), GROUP(1088), /* c */ GROUP(1089), GROUP(1090), GROUP(1091), GROUP(1092), /* 10 */ GROUP(1093), GROUP(1094), GROUP(1095), GROUP(1096), /* 14 */ GROUP(1097), GROUP(1098), GROUP(1099), GROUP(1100), /* 18 */ GROUP(1101), GROUP(1102), GROUP(1103), GROUP(1104), /* 1c */ GROUP(1105), GROUP(1106), GROUP(1107), GROUP(1108), /* 20 */ GROUP(1109), 0, 0, 0, /* 24 */ 0, 0, 0, 0, /* 28 */ GROUP(1110), GROUP(1111), GROUP(1112), GROUP(1113), /* 2c */ GROUP(1114), GROUP(1115), GROUP(1116), GROUP(1117), /* 30 */ GROUP(1118), GROUP(1119), GROUP(1120), GROUP(1121), /* 34 */ GROUP(1122), GROUP(1123), GROUP(1124), GROUP(1125), /* 38 */ 0, 0, 0, 0, /* 3c */ 0, 0, 0, 0, }; static const uint16_t ud_itab__1066[] = { /* 0 */ GROUP(1067), GROUP(1076), }; static const uint16_t ud_itab__1126[] = { /* 0 */ 1398, 1399, 1400, }; static const uint16_t ud_itab__1127[] = { /* 0 */ 1407, 0, }; static const uint16_t ud_itab__1128[] = { /* 0 */ 1419, 1420, 1421, 1422, /* 4 */ 1423, 1424, 1425, 1426, }; static const uint16_t ud_itab__1129[] = { /* 0 */ 1427, 1428, 1429, 1430, /* 4 */ 1431, 1432, 1433, 1434, }; static const uint16_t ud_itab__1130[] = { /* 0 */ 1441, 1442, 0, 0, /* 4 */ 0, 0, 0, 0, }; static const uint16_t ud_itab__1132[] = { /* 0 */ 1445, 1446, }; static const uint16_t ud_itab__1131[] = { /* 0 */ 1443, 1444, GROUP(1132), 1447, /* 4 */ 1448, 1449, 1450, 0, }; const uint16_t ud_itab__0[] = { /* 0 */ 1, 2, 3, 4, /* 4 */ 5, 6, GROUP(1), GROUP(2), /* 8 */ 9, 10, 11, 12, /* c */ 13, 14, GROUP(3), GROUP(4), /* 10 */ 628, 629, 630, 631, /* 14 */ 632, 633, GROUP(563), GROUP(564), /* 18 */ 636, 637, 638, 639, /* 1c */ 640, 641, GROUP(565), GROUP(566), /* 20 */ 644, 645, 646, 647, /* 24 */ 648, 649, 0, GROUP(567), /* 28 */ 651, 652, 653, 654, /* 2c */ 655, 656, 0, GROUP(568), /* 30 */ 658, 659, 660, 661, /* 34 */ 662, 663, 0, GROUP(569), /* 38 */ 665, 666, 667, 668, /* 3c */ 669, 670, 0, GROUP(570), /* 40 */ 672, 673, 674, 675, /* 44 */ 676, 677, 678, 679, /* 48 */ 680, 681, 682, 683, /* 4c */ 684, 685, 686, 687, /* 50 */ 688, 689, 690, 691, /* 54 */ 692, 693, 694, 695, /* 58 */ 696, 697, 698, 699, /* 5c */ 700, 701, 702, 703, /* 60 */ GROUP(571), GROUP(574), GROUP(577), GROUP(578), /* 64 */ 0, 0, 0, 0, /* 68 */ 711, 712, 713, 714, /* 6c */ 715, GROUP(579), 718, GROUP(580), /* 70 */ 721, 722, 723, 724, /* 74 */ 725, 726, 727, 728, /* 78 */ 729, 730, 731, 732, /* 7c */ 733, 734, 735, 736, /* 80 */ GROUP(581), GROUP(582), GROUP(583), GROUP(592), /* 84 */ 769, 770, 771, 772, /* 88 */ 773, 774, 775, 776, /* 8c */ 777, 778, 779, GROUP(593), /* 90 */ 781, 782, 783, 784, /* 94 */ 785, 786, 787, 788, /* 98 */ GROUP(594), GROUP(595), GROUP(596), 796, /* 9c */ GROUP(597), GROUP(601), 806, 807, /* a0 */ 808, 809, 810, 811, /* a4 */ 812, GROUP(605), 816, GROUP(606), /* a8 */ 820, 821, 822, GROUP(607), /* ac */ 826, GROUP(608), 830, GROUP(609), /* b0 */ 834, 835, 836, 837, /* b4 */ 838, 839, 840, 841, /* b8 */ 842, 843, 844, 845, /* bc */ 846, 847, 848, 849, /* c0 */ GROUP(610), GROUP(611), 866, 867, /* c4 */ GROUP(612), GROUP(613), GROUP(614), GROUP(615), /* c8 */ 872, 873, 874, 875, /* cc */ 876, 877, GROUP(616), GROUP(617), /* d0 */ GROUP(618), GROUP(619), GROUP(620), GROUP(621), /* d4 */ GROUP(622), GROUP(623), GROUP(624), 917, /* d8 */ GROUP(625), GROUP(700), GROUP(762), GROUP(806), /* dc */ GROUP(865), GROUP(940), GROUP(998), GROUP(1066), /* e0 */ 1395, 1396, 1397, GROUP(1126), /* e4 */ 1401, 1402, 1403, 1404, /* e8 */ 1405, 1406, GROUP(1127), 1408, /* ec */ 1409, 1410, 1411, 1412, /* f0 */ 1413, 1414, 1415, 1416, /* f4 */ 1417, 1418, GROUP(1128), GROUP(1129), /* f8 */ 1435, 1436, 1437, 1438, /* fc */ 1439, 1440, GROUP(1130), GROUP(1131), }; struct ud_lookup_table_list_entry ud_lookup_table_list[] = { /* 000 */ { ud_itab__0, UD_TAB__OPC_TABLE, "table0" }, /* 001 */ { ud_itab__1, UD_TAB__OPC_MODE, "/m" }, /* 002 */ { ud_itab__2, UD_TAB__OPC_MODE, "/m" }, /* 003 */ { ud_itab__3, UD_TAB__OPC_MODE, "/m" }, /* 004 */ { ud_itab__4, UD_TAB__OPC_TABLE, "0f" }, /* 005 */ { ud_itab__5, UD_TAB__OPC_REG, "/reg" }, /* 006 */ { ud_itab__6, UD_TAB__OPC_SSE, "/sse" }, /* 007 */ { ud_itab__7, UD_TAB__OPC_SSE, "/sse" }, /* 008 */ { ud_itab__8, UD_TAB__OPC_SSE, "/sse" }, /* 009 */ { ud_itab__9, UD_TAB__OPC_SSE, "/sse" }, /* 010 */ { ud_itab__10, UD_TAB__OPC_SSE, "/sse" }, /* 011 */ { ud_itab__11, UD_TAB__OPC_SSE, "/sse" }, /* 012 */ { ud_itab__12, UD_TAB__OPC_MOD, "/mod" }, /* 013 */ { ud_itab__13, UD_TAB__OPC_REG, "/reg" }, /* 014 */ { ud_itab__14, UD_TAB__OPC_SSE, "/sse" }, /* 015 */ { ud_itab__15, UD_TAB__OPC_MOD, "/mod" }, /* 016 */ { ud_itab__16, UD_TAB__OPC_SSE, "/sse" }, /* 017 */ { ud_itab__17, UD_TAB__OPC_MOD, "/mod" }, /* 018 */ { ud_itab__18, UD_TAB__OPC_SSE, "/sse" }, /* 019 */ { ud_itab__19, UD_TAB__OPC_MOD, "/mod" }, /* 020 */ { ud_itab__20, UD_TAB__OPC_SSE, "/sse" }, /* 021 */ { ud_itab__21, UD_TAB__OPC_MOD, "/mod" }, /* 022 */ { ud_itab__22, UD_TAB__OPC_SSE, "/sse" }, /* 023 */ { ud_itab__23, UD_TAB__OPC_MOD, "/mod" }, /* 024 */ { ud_itab__24, UD_TAB__OPC_SSE, "/sse" }, /* 025 */ { ud_itab__25, UD_TAB__OPC_MOD, "/mod" }, /* 026 */ { ud_itab__26, UD_TAB__OPC_SSE, "/sse" }, /* 027 */ { ud_itab__27, UD_TAB__OPC_MOD, "/mod" }, /* 028 */ { ud_itab__28, UD_TAB__OPC_REG, "/reg" }, /* 029 */ { ud_itab__29, UD_TAB__OPC_RM, "/rm" }, /* 030 */ { ud_itab__30, UD_TAB__OPC_SSE, "/sse" }, /* 031 */ { ud_itab__31, UD_TAB__OPC_MOD, "/mod" }, /* 032 */ { ud_itab__32, UD_TAB__OPC_VENDOR, "intel" }, /* 033 */ { ud_itab__33, UD_TAB__OPC_SSE, "/sse" }, /* 034 */ { ud_itab__34, UD_TAB__OPC_MOD, "/mod" }, /* 035 */ { ud_itab__35, UD_TAB__OPC_VENDOR, "intel" }, /* 036 */ { ud_itab__36, UD_TAB__OPC_SSE, "/sse" }, /* 037 */ { ud_itab__37, UD_TAB__OPC_MOD, "/mod" }, /* 038 */ { ud_itab__38, UD_TAB__OPC_VENDOR, "intel" }, /* 039 */ { ud_itab__39, UD_TAB__OPC_SSE, "/sse" }, /* 040 */ { ud_itab__40, UD_TAB__OPC_MOD, "/mod" }, /* 041 */ { ud_itab__41, UD_TAB__OPC_VENDOR, "intel" }, /* 042 */ { ud_itab__42, UD_TAB__OPC_RM, "/rm" }, /* 043 */ { ud_itab__43, UD_TAB__OPC_SSE, "/sse" }, /* 044 */ { ud_itab__44, UD_TAB__OPC_MOD, "/mod" }, /* 045 */ { ud_itab__45, UD_TAB__OPC_SSE, "/sse" }, /* 046 */ { ud_itab__46, UD_TAB__OPC_MOD, "/mod" }, /* 047 */ { ud_itab__47, UD_TAB__OPC_RM, "/rm" }, /* 048 */ { ud_itab__48, UD_TAB__OPC_SSE, "/sse" }, /* 049 */ { ud_itab__49, UD_TAB__OPC_MOD, "/mod" }, /* 050 */ { ud_itab__50, UD_TAB__OPC_SSE, "/sse" }, /* 051 */ { ud_itab__51, UD_TAB__OPC_MOD, "/mod" }, /* 052 */ { ud_itab__52, UD_TAB__OPC_RM, "/rm" }, /* 053 */ { ud_itab__53, UD_TAB__OPC_SSE, "/sse" }, /* 054 */ { ud_itab__54, UD_TAB__OPC_MOD, "/mod" }, /* 055 */ { ud_itab__55, UD_TAB__OPC_VENDOR, "amd" }, /* 056 */ { ud_itab__56, UD_TAB__OPC_SSE, "/sse" }, /* 057 */ { ud_itab__57, UD_TAB__OPC_MOD, "/mod" }, /* 058 */ { ud_itab__58, UD_TAB__OPC_VENDOR, "amd" }, /* 059 */ { ud_itab__59, UD_TAB__OPC_SSE, "/sse" }, /* 060 */ { ud_itab__60, UD_TAB__OPC_MOD, "/mod" }, /* 061 */ { ud_itab__61, UD_TAB__OPC_VENDOR, "amd" }, /* 062 */ { ud_itab__62, UD_TAB__OPC_SSE, "/sse" }, /* 063 */ { ud_itab__63, UD_TAB__OPC_MOD, "/mod" }, /* 064 */ { ud_itab__64, UD_TAB__OPC_VENDOR, "amd" }, /* 065 */ { ud_itab__65, UD_TAB__OPC_SSE, "/sse" }, /* 066 */ { ud_itab__66, UD_TAB__OPC_MOD, "/mod" }, /* 067 */ { ud_itab__67, UD_TAB__OPC_VENDOR, "amd" }, /* 068 */ { ud_itab__68, UD_TAB__OPC_SSE, "/sse" }, /* 069 */ { ud_itab__69, UD_TAB__OPC_MOD, "/mod" }, /* 070 */ { ud_itab__70, UD_TAB__OPC_VENDOR, "amd" }, /* 071 */ { ud_itab__71, UD_TAB__OPC_SSE, "/sse" }, /* 072 */ { ud_itab__72, UD_TAB__OPC_MOD, "/mod" }, /* 073 */ { ud_itab__73, UD_TAB__OPC_VENDOR, "amd" }, /* 074 */ { ud_itab__74, UD_TAB__OPC_SSE, "/sse" }, /* 075 */ { ud_itab__75, UD_TAB__OPC_MOD, "/mod" }, /* 076 */ { ud_itab__76, UD_TAB__OPC_VENDOR, "amd" }, /* 077 */ { ud_itab__77, UD_TAB__OPC_SSE, "/sse" }, /* 078 */ { ud_itab__78, UD_TAB__OPC_MOD, "/mod" }, /* 079 */ { ud_itab__79, UD_TAB__OPC_SSE, "/sse" }, /* 080 */ { ud_itab__80, UD_TAB__OPC_MOD, "/mod" }, /* 081 */ { ud_itab__81, UD_TAB__OPC_RM, "/rm" }, /* 082 */ { ud_itab__82, UD_TAB__OPC_SSE, "/sse" }, /* 083 */ { ud_itab__83, UD_TAB__OPC_MOD, "/mod" }, /* 084 */ { ud_itab__84, UD_TAB__OPC_SSE, "/sse" }, /* 085 */ { ud_itab__85, UD_TAB__OPC_MOD, "/mod" }, /* 086 */ { ud_itab__86, UD_TAB__OPC_VENDOR, "amd" }, /* 087 */ { ud_itab__87, UD_TAB__OPC_SSE, "/sse" }, /* 088 */ { ud_itab__88, UD_TAB__OPC_SSE, "/sse" }, /* 089 */ { ud_itab__89, UD_TAB__OPC_SSE, "/sse" }, /* 090 */ { ud_itab__90, UD_TAB__OPC_SSE, "/sse" }, /* 091 */ { ud_itab__91, UD_TAB__OPC_SSE, "/sse" }, /* 092 */ { ud_itab__92, UD_TAB__OPC_SSE, "/sse" }, /* 093 */ { ud_itab__93, UD_TAB__OPC_SSE, "/sse" }, /* 094 */ { ud_itab__94, UD_TAB__OPC_SSE, "/sse" }, /* 095 */ { ud_itab__95, UD_TAB__OPC_REG, "/reg" }, /* 096 */ { ud_itab__96, UD_TAB__OPC_SSE, "/sse" }, /* 097 */ { ud_itab__97, UD_TAB__OPC_SSE, "/sse" }, /* 098 */ { ud_itab__98, UD_TAB__OPC_SSE, "/sse" }, /* 099 */ { ud_itab__99, UD_TAB__OPC_SSE, "/sse" }, /* 100 */ { ud_itab__100, UD_TAB__OPC_SSE, "/sse" }, /* 101 */ { ud_itab__101, UD_TAB__OPC_SSE, "/sse" }, /* 102 */ { ud_itab__102, UD_TAB__OPC_SSE, "/sse" }, /* 103 */ { ud_itab__103, UD_TAB__OPC_SSE, "/sse" }, /* 104 */ { ud_itab__104, UD_TAB__OPC_SSE, "/sse" }, /* 105 */ { ud_itab__105, UD_TAB__OPC_3DNOW, "/3dnow" }, /* 106 */ { ud_itab__106, UD_TAB__OPC_SSE, "/sse" }, /* 107 */ { ud_itab__107, UD_TAB__OPC_SSE, "/sse" }, /* 108 */ { ud_itab__108, UD_TAB__OPC_MOD, "/mod" }, /* 109 */ { ud_itab__109, UD_TAB__OPC_SSE, "/sse" }, /* 110 */ { ud_itab__110, UD_TAB__OPC_MOD, "/mod" }, /* 111 */ { ud_itab__111, UD_TAB__OPC_MOD, "/mod" }, /* 112 */ { ud_itab__112, UD_TAB__OPC_MOD, "/mod" }, /* 113 */ { ud_itab__113, UD_TAB__OPC_MOD, "/mod" }, /* 114 */ { ud_itab__114, UD_TAB__OPC_SSE, "/sse" }, /* 115 */ { ud_itab__115, UD_TAB__OPC_MOD, "/mod" }, /* 116 */ { ud_itab__116, UD_TAB__OPC_MOD, "/mod" }, /* 117 */ { ud_itab__117, UD_TAB__OPC_MOD, "/mod" }, /* 118 */ { ud_itab__118, UD_TAB__OPC_SSE, "/sse" }, /* 119 */ { ud_itab__119, UD_TAB__OPC_SSE, "/sse" }, /* 120 */ { ud_itab__120, UD_TAB__OPC_SSE, "/sse" }, /* 121 */ { ud_itab__121, UD_TAB__OPC_MOD, "/mod" }, /* 122 */ { ud_itab__122, UD_TAB__OPC_SSE, "/sse" }, /* 123 */ { ud_itab__123, UD_TAB__OPC_MOD, "/mod" }, /* 124 */ { ud_itab__124, UD_TAB__OPC_MOD, "/mod" }, /* 125 */ { ud_itab__125, UD_TAB__OPC_MOD, "/mod" }, /* 126 */ { ud_itab__126, UD_TAB__OPC_SSE, "/sse" }, /* 127 */ { ud_itab__127, UD_TAB__OPC_MOD, "/mod" }, /* 128 */ { ud_itab__128, UD_TAB__OPC_MOD, "/mod" }, /* 129 */ { ud_itab__129, UD_TAB__OPC_SSE, "/sse" }, /* 130 */ { ud_itab__130, UD_TAB__OPC_REG, "/reg" }, /* 131 */ { ud_itab__131, UD_TAB__OPC_SSE, "/sse" }, /* 132 */ { ud_itab__132, UD_TAB__OPC_SSE, "/sse" }, /* 133 */ { ud_itab__133, UD_TAB__OPC_SSE, "/sse" }, /* 134 */ { ud_itab__134, UD_TAB__OPC_SSE, "/sse" }, /* 135 */ { ud_itab__135, UD_TAB__OPC_SSE, "/sse" }, /* 136 */ { ud_itab__136, UD_TAB__OPC_SSE, "/sse" }, /* 137 */ { ud_itab__137, UD_TAB__OPC_SSE, "/sse" }, /* 138 */ { ud_itab__138, UD_TAB__OPC_SSE, "/sse" }, /* 139 */ { ud_itab__139, UD_TAB__OPC_SSE, "/sse" }, /* 140 */ { ud_itab__140, UD_TAB__OPC_SSE, "/sse" }, /* 141 */ { ud_itab__141, UD_TAB__OPC_SSE, "/sse" }, /* 142 */ { ud_itab__142, UD_TAB__OPC_SSE, "/sse" }, /* 143 */ { ud_itab__143, UD_TAB__OPC_SSE, "/sse" }, /* 144 */ { ud_itab__144, UD_TAB__OPC_SSE, "/sse" }, /* 145 */ { ud_itab__145, UD_TAB__OPC_SSE, "/sse" }, /* 146 */ { ud_itab__146, UD_TAB__OPC_SSE, "/sse" }, /* 147 */ { ud_itab__147, UD_TAB__OPC_SSE, "/sse" }, /* 148 */ { ud_itab__148, UD_TAB__OPC_SSE, "/sse" }, /* 149 */ { ud_itab__149, UD_TAB__OPC_SSE, "/sse" }, /* 150 */ { ud_itab__150, UD_TAB__OPC_SSE, "/sse" }, /* 151 */ { ud_itab__151, UD_TAB__OPC_SSE, "/sse" }, /* 152 */ { ud_itab__152, UD_TAB__OPC_SSE, "/sse" }, /* 153 */ { ud_itab__153, UD_TAB__OPC_SSE, "/sse" }, /* 154 */ { ud_itab__154, UD_TAB__OPC_SSE, "/sse" }, /* 155 */ { ud_itab__155, UD_TAB__OPC_SSE, "/sse" }, /* 156 */ { ud_itab__156, UD_TAB__OPC_SSE, "/sse" }, /* 157 */ { ud_itab__157, UD_TAB__OPC_SSE, "/sse" }, /* 158 */ { ud_itab__158, UD_TAB__OPC_SSE, "/sse" }, /* 159 */ { ud_itab__159, UD_TAB__OPC_MODE, "/m" }, /* 160 */ { ud_itab__160, UD_TAB__OPC_VENDOR, "intel" }, /* 161 */ { ud_itab__161, UD_TAB__OPC_SSE, "/sse" }, /* 162 */ { ud_itab__162, UD_TAB__OPC_MODE, "/m" }, /* 163 */ { ud_itab__163, UD_TAB__OPC_VENDOR, "intel" }, /* 164 */ { ud_itab__164, UD_TAB__OPC_SSE, "/sse" }, /* 165 */ { ud_itab__165, UD_TAB__OPC_TABLE, "38" }, /* 166 */ { ud_itab__166, UD_TAB__OPC_SSE, "/sse" }, /* 167 */ { ud_itab__167, UD_TAB__OPC_SSE, "/sse" }, /* 168 */ { ud_itab__168, UD_TAB__OPC_SSE, "/sse" }, /* 169 */ { ud_itab__169, UD_TAB__OPC_SSE, "/sse" }, /* 170 */ { ud_itab__170, UD_TAB__OPC_SSE, "/sse" }, /* 171 */ { ud_itab__171, UD_TAB__OPC_SSE, "/sse" }, /* 172 */ { ud_itab__172, UD_TAB__OPC_SSE, "/sse" }, /* 173 */ { ud_itab__173, UD_TAB__OPC_SSE, "/sse" }, /* 174 */ { ud_itab__174, UD_TAB__OPC_SSE, "/sse" }, /* 175 */ { ud_itab__175, UD_TAB__OPC_SSE, "/sse" }, /* 176 */ { ud_itab__176, UD_TAB__OPC_SSE, "/sse" }, /* 177 */ { ud_itab__177, UD_TAB__OPC_SSE, "/sse" }, /* 178 */ { ud_itab__178, UD_TAB__OPC_SSE, "/sse" }, /* 179 */ { ud_itab__179, UD_TAB__OPC_SSE, "/sse" }, /* 180 */ { ud_itab__180, UD_TAB__OPC_SSE, "/sse" }, /* 181 */ { ud_itab__181, UD_TAB__OPC_SSE, "/sse" }, /* 182 */ { ud_itab__182, UD_TAB__OPC_SSE, "/sse" }, /* 183 */ { ud_itab__183, UD_TAB__OPC_SSE, "/sse" }, /* 184 */ { ud_itab__184, UD_TAB__OPC_SSE, "/sse" }, /* 185 */ { ud_itab__185, UD_TAB__OPC_SSE, "/sse" }, /* 186 */ { ud_itab__186, UD_TAB__OPC_SSE, "/sse" }, /* 187 */ { ud_itab__187, UD_TAB__OPC_SSE, "/sse" }, /* 188 */ { ud_itab__188, UD_TAB__OPC_SSE, "/sse" }, /* 189 */ { ud_itab__189, UD_TAB__OPC_SSE, "/sse" }, /* 190 */ { ud_itab__190, UD_TAB__OPC_SSE, "/sse" }, /* 191 */ { ud_itab__191, UD_TAB__OPC_SSE, "/sse" }, /* 192 */ { ud_itab__192, UD_TAB__OPC_SSE, "/sse" }, /* 193 */ { ud_itab__193, UD_TAB__OPC_SSE, "/sse" }, /* 194 */ { ud_itab__194, UD_TAB__OPC_SSE, "/sse" }, /* 195 */ { ud_itab__195, UD_TAB__OPC_SSE, "/sse" }, /* 196 */ { ud_itab__196, UD_TAB__OPC_SSE, "/sse" }, /* 197 */ { ud_itab__197, UD_TAB__OPC_SSE, "/sse" }, /* 198 */ { ud_itab__198, UD_TAB__OPC_SSE, "/sse" }, /* 199 */ { ud_itab__199, UD_TAB__OPC_SSE, "/sse" }, /* 200 */ { ud_itab__200, UD_TAB__OPC_SSE, "/sse" }, /* 201 */ { ud_itab__201, UD_TAB__OPC_SSE, "/sse" }, /* 202 */ { ud_itab__202, UD_TAB__OPC_SSE, "/sse" }, /* 203 */ { ud_itab__203, UD_TAB__OPC_SSE, "/sse" }, /* 204 */ { ud_itab__204, UD_TAB__OPC_SSE, "/sse" }, /* 205 */ { ud_itab__205, UD_TAB__OPC_SSE, "/sse" }, /* 206 */ { ud_itab__206, UD_TAB__OPC_SSE, "/sse" }, /* 207 */ { ud_itab__207, UD_TAB__OPC_SSE, "/sse" }, /* 208 */ { ud_itab__208, UD_TAB__OPC_SSE, "/sse" }, /* 209 */ { ud_itab__209, UD_TAB__OPC_SSE, "/sse" }, /* 210 */ { ud_itab__210, UD_TAB__OPC_SSE, "/sse" }, /* 211 */ { ud_itab__211, UD_TAB__OPC_SSE, "/sse" }, /* 212 */ { ud_itab__212, UD_TAB__OPC_SSE, "/sse" }, /* 213 */ { ud_itab__213, UD_TAB__OPC_MODE, "/m" }, /* 214 */ { ud_itab__214, UD_TAB__OPC_VENDOR, "intel" }, /* 215 */ { ud_itab__215, UD_TAB__OPC_SSE, "/sse" }, /* 216 */ { ud_itab__216, UD_TAB__OPC_MODE, "/m" }, /* 217 */ { ud_itab__217, UD_TAB__OPC_VENDOR, "intel" }, /* 218 */ { ud_itab__218, UD_TAB__OPC_SSE, "/sse" }, /* 219 */ { ud_itab__219, UD_TAB__OPC_SSE, "/sse" }, /* 220 */ { ud_itab__220, UD_TAB__OPC_SSE, "/sse" }, /* 221 */ { ud_itab__221, UD_TAB__OPC_SSE, "/sse" }, /* 222 */ { ud_itab__222, UD_TAB__OPC_SSE, "/sse" }, /* 223 */ { ud_itab__223, UD_TAB__OPC_SSE, "/sse" }, /* 224 */ { ud_itab__224, UD_TAB__OPC_SSE, "/sse" }, /* 225 */ { ud_itab__225, UD_TAB__OPC_TABLE, "3a" }, /* 226 */ { ud_itab__226, UD_TAB__OPC_SSE, "/sse" }, /* 227 */ { ud_itab__227, UD_TAB__OPC_SSE, "/sse" }, /* 228 */ { ud_itab__228, UD_TAB__OPC_SSE, "/sse" }, /* 229 */ { ud_itab__229, UD_TAB__OPC_SSE, "/sse" }, /* 230 */ { ud_itab__230, UD_TAB__OPC_SSE, "/sse" }, /* 231 */ { ud_itab__231, UD_TAB__OPC_SSE, "/sse" }, /* 232 */ { ud_itab__232, UD_TAB__OPC_SSE, "/sse" }, /* 233 */ { ud_itab__233, UD_TAB__OPC_SSE, "/sse" }, /* 234 */ { ud_itab__234, UD_TAB__OPC_SSE, "/sse" }, /* 235 */ { ud_itab__235, UD_TAB__OPC_SSE, "/sse" }, /* 236 */ { ud_itab__236, UD_TAB__OPC_SSE, "/sse" }, /* 237 */ { ud_itab__237, UD_TAB__OPC_OSIZE, "/o" }, /* 238 */ { ud_itab__238, UD_TAB__OPC_SSE, "/sse" }, /* 239 */ { ud_itab__239, UD_TAB__OPC_SSE, "/sse" }, /* 240 */ { ud_itab__240, UD_TAB__OPC_SSE, "/sse" }, /* 241 */ { ud_itab__241, UD_TAB__OPC_SSE, "/sse" }, /* 242 */ { ud_itab__242, UD_TAB__OPC_OSIZE, "/o" }, /* 243 */ { ud_itab__243, UD_TAB__OPC_SSE, "/sse" }, /* 244 */ { ud_itab__244, UD_TAB__OPC_SSE, "/sse" }, /* 245 */ { ud_itab__245, UD_TAB__OPC_SSE, "/sse" }, /* 246 */ { ud_itab__246, UD_TAB__OPC_SSE, "/sse" }, /* 247 */ { ud_itab__247, UD_TAB__OPC_SSE, "/sse" }, /* 248 */ { ud_itab__248, UD_TAB__OPC_SSE, "/sse" }, /* 249 */ { ud_itab__249, UD_TAB__OPC_SSE, "/sse" }, /* 250 */ { ud_itab__250, UD_TAB__OPC_SSE, "/sse" }, /* 251 */ { ud_itab__251, UD_TAB__OPC_SSE, "/sse" }, /* 252 */ { ud_itab__252, UD_TAB__OPC_SSE, "/sse" }, /* 253 */ { ud_itab__253, UD_TAB__OPC_SSE, "/sse" }, /* 254 */ { ud_itab__254, UD_TAB__OPC_SSE, "/sse" }, /* 255 */ { ud_itab__255, UD_TAB__OPC_SSE, "/sse" }, /* 256 */ { ud_itab__256, UD_TAB__OPC_SSE, "/sse" }, /* 257 */ { ud_itab__257, UD_TAB__OPC_SSE, "/sse" }, /* 258 */ { ud_itab__258, UD_TAB__OPC_SSE, "/sse" }, /* 259 */ { ud_itab__259, UD_TAB__OPC_SSE, "/sse" }, /* 260 */ { ud_itab__260, UD_TAB__OPC_SSE, "/sse" }, /* 261 */ { ud_itab__261, UD_TAB__OPC_SSE, "/sse" }, /* 262 */ { ud_itab__262, UD_TAB__OPC_SSE, "/sse" }, /* 263 */ { ud_itab__263, UD_TAB__OPC_SSE, "/sse" }, /* 264 */ { ud_itab__264, UD_TAB__OPC_SSE, "/sse" }, /* 265 */ { ud_itab__265, UD_TAB__OPC_SSE, "/sse" }, /* 266 */ { ud_itab__266, UD_TAB__OPC_SSE, "/sse" }, /* 267 */ { ud_itab__267, UD_TAB__OPC_SSE, "/sse" }, /* 268 */ { ud_itab__268, UD_TAB__OPC_SSE, "/sse" }, /* 269 */ { ud_itab__269, UD_TAB__OPC_SSE, "/sse" }, /* 270 */ { ud_itab__270, UD_TAB__OPC_SSE, "/sse" }, /* 271 */ { ud_itab__271, UD_TAB__OPC_SSE, "/sse" }, /* 272 */ { ud_itab__272, UD_TAB__OPC_SSE, "/sse" }, /* 273 */ { ud_itab__273, UD_TAB__OPC_SSE, "/sse" }, /* 274 */ { ud_itab__274, UD_TAB__OPC_SSE, "/sse" }, /* 275 */ { ud_itab__275, UD_TAB__OPC_SSE, "/sse" }, /* 276 */ { ud_itab__276, UD_TAB__OPC_SSE, "/sse" }, /* 277 */ { ud_itab__277, UD_TAB__OPC_SSE, "/sse" }, /* 278 */ { ud_itab__278, UD_TAB__OPC_SSE, "/sse" }, /* 279 */ { ud_itab__279, UD_TAB__OPC_SSE, "/sse" }, /* 280 */ { ud_itab__280, UD_TAB__OPC_SSE, "/sse" }, /* 281 */ { ud_itab__281, UD_TAB__OPC_SSE, "/sse" }, /* 282 */ { ud_itab__282, UD_TAB__OPC_SSE, "/sse" }, /* 283 */ { ud_itab__283, UD_TAB__OPC_SSE, "/sse" }, /* 284 */ { ud_itab__284, UD_TAB__OPC_SSE, "/sse" }, /* 285 */ { ud_itab__285, UD_TAB__OPC_SSE, "/sse" }, /* 286 */ { ud_itab__286, UD_TAB__OPC_SSE, "/sse" }, /* 287 */ { ud_itab__287, UD_TAB__OPC_SSE, "/sse" }, /* 288 */ { ud_itab__288, UD_TAB__OPC_SSE, "/sse" }, /* 289 */ { ud_itab__289, UD_TAB__OPC_SSE, "/sse" }, /* 290 */ { ud_itab__290, UD_TAB__OPC_SSE, "/sse" }, /* 291 */ { ud_itab__291, UD_TAB__OPC_SSE, "/sse" }, /* 292 */ { ud_itab__292, UD_TAB__OPC_SSE, "/sse" }, /* 293 */ { ud_itab__293, UD_TAB__OPC_SSE, "/sse" }, /* 294 */ { ud_itab__294, UD_TAB__OPC_SSE, "/sse" }, /* 295 */ { ud_itab__295, UD_TAB__OPC_SSE, "/sse" }, /* 296 */ { ud_itab__296, UD_TAB__OPC_SSE, "/sse" }, /* 297 */ { ud_itab__297, UD_TAB__OPC_SSE, "/sse" }, /* 298 */ { ud_itab__298, UD_TAB__OPC_SSE, "/sse" }, /* 299 */ { ud_itab__299, UD_TAB__OPC_SSE, "/sse" }, /* 300 */ { ud_itab__300, UD_TAB__OPC_SSE, "/sse" }, /* 301 */ { ud_itab__301, UD_TAB__OPC_REG, "/reg" }, /* 302 */ { ud_itab__302, UD_TAB__OPC_SSE, "/sse" }, /* 303 */ { ud_itab__303, UD_TAB__OPC_SSE, "/sse" }, /* 304 */ { ud_itab__304, UD_TAB__OPC_SSE, "/sse" }, /* 305 */ { ud_itab__305, UD_TAB__OPC_REG, "/reg" }, /* 306 */ { ud_itab__306, UD_TAB__OPC_SSE, "/sse" }, /* 307 */ { ud_itab__307, UD_TAB__OPC_SSE, "/sse" }, /* 308 */ { ud_itab__308, UD_TAB__OPC_SSE, "/sse" }, /* 309 */ { ud_itab__309, UD_TAB__OPC_REG, "/reg" }, /* 310 */ { ud_itab__310, UD_TAB__OPC_SSE, "/sse" }, /* 311 */ { ud_itab__311, UD_TAB__OPC_SSE, "/sse" }, /* 312 */ { ud_itab__312, UD_TAB__OPC_SSE, "/sse" }, /* 313 */ { ud_itab__313, UD_TAB__OPC_SSE, "/sse" }, /* 314 */ { ud_itab__314, UD_TAB__OPC_SSE, "/sse" }, /* 315 */ { ud_itab__315, UD_TAB__OPC_SSE, "/sse" }, /* 316 */ { ud_itab__316, UD_TAB__OPC_SSE, "/sse" }, /* 317 */ { ud_itab__317, UD_TAB__OPC_SSE, "/sse" }, /* 318 */ { ud_itab__318, UD_TAB__OPC_SSE, "/sse" }, /* 319 */ { ud_itab__319, UD_TAB__OPC_VENDOR, "intel" }, /* 320 */ { ud_itab__320, UD_TAB__OPC_SSE, "/sse" }, /* 321 */ { ud_itab__321, UD_TAB__OPC_VENDOR, "intel" }, /* 322 */ { ud_itab__322, UD_TAB__OPC_SSE, "/sse" }, /* 323 */ { ud_itab__323, UD_TAB__OPC_SSE, "/sse" }, /* 324 */ { ud_itab__324, UD_TAB__OPC_SSE, "/sse" }, /* 325 */ { ud_itab__325, UD_TAB__OPC_SSE, "/sse" }, /* 326 */ { ud_itab__326, UD_TAB__OPC_SSE, "/sse" }, /* 327 */ { ud_itab__327, UD_TAB__OPC_SSE, "/sse" }, /* 328 */ { ud_itab__328, UD_TAB__OPC_SSE, "/sse" }, /* 329 */ { ud_itab__329, UD_TAB__OPC_SSE, "/sse" }, /* 330 */ { ud_itab__330, UD_TAB__OPC_SSE, "/sse" }, /* 331 */ { ud_itab__331, UD_TAB__OPC_SSE, "/sse" }, /* 332 */ { ud_itab__332, UD_TAB__OPC_SSE, "/sse" }, /* 333 */ { ud_itab__333, UD_TAB__OPC_SSE, "/sse" }, /* 334 */ { ud_itab__334, UD_TAB__OPC_SSE, "/sse" }, /* 335 */ { ud_itab__335, UD_TAB__OPC_SSE, "/sse" }, /* 336 */ { ud_itab__336, UD_TAB__OPC_SSE, "/sse" }, /* 337 */ { ud_itab__337, UD_TAB__OPC_SSE, "/sse" }, /* 338 */ { ud_itab__338, UD_TAB__OPC_SSE, "/sse" }, /* 339 */ { ud_itab__339, UD_TAB__OPC_SSE, "/sse" }, /* 340 */ { ud_itab__340, UD_TAB__OPC_SSE, "/sse" }, /* 341 */ { ud_itab__341, UD_TAB__OPC_SSE, "/sse" }, /* 342 */ { ud_itab__342, UD_TAB__OPC_SSE, "/sse" }, /* 343 */ { ud_itab__343, UD_TAB__OPC_SSE, "/sse" }, /* 344 */ { ud_itab__344, UD_TAB__OPC_SSE, "/sse" }, /* 345 */ { ud_itab__345, UD_TAB__OPC_SSE, "/sse" }, /* 346 */ { ud_itab__346, UD_TAB__OPC_SSE, "/sse" }, /* 347 */ { ud_itab__347, UD_TAB__OPC_SSE, "/sse" }, /* 348 */ { ud_itab__348, UD_TAB__OPC_SSE, "/sse" }, /* 349 */ { ud_itab__349, UD_TAB__OPC_SSE, "/sse" }, /* 350 */ { ud_itab__350, UD_TAB__OPC_SSE, "/sse" }, /* 351 */ { ud_itab__351, UD_TAB__OPC_SSE, "/sse" }, /* 352 */ { ud_itab__352, UD_TAB__OPC_SSE, "/sse" }, /* 353 */ { ud_itab__353, UD_TAB__OPC_SSE, "/sse" }, /* 354 */ { ud_itab__354, UD_TAB__OPC_SSE, "/sse" }, /* 355 */ { ud_itab__355, UD_TAB__OPC_SSE, "/sse" }, /* 356 */ { ud_itab__356, UD_TAB__OPC_SSE, "/sse" }, /* 357 */ { ud_itab__357, UD_TAB__OPC_SSE, "/sse" }, /* 358 */ { ud_itab__358, UD_TAB__OPC_SSE, "/sse" }, /* 359 */ { ud_itab__359, UD_TAB__OPC_SSE, "/sse" }, /* 360 */ { ud_itab__360, UD_TAB__OPC_SSE, "/sse" }, /* 361 */ { ud_itab__361, UD_TAB__OPC_SSE, "/sse" }, /* 362 */ { ud_itab__362, UD_TAB__OPC_SSE, "/sse" }, /* 363 */ { ud_itab__363, UD_TAB__OPC_SSE, "/sse" }, /* 364 */ { ud_itab__364, UD_TAB__OPC_MOD, "/mod" }, /* 365 */ { ud_itab__365, UD_TAB__OPC_REG, "/reg" }, /* 366 */ { ud_itab__366, UD_TAB__OPC_RM, "/rm" }, /* 367 */ { ud_itab__367, UD_TAB__OPC_SSE, "/sse" }, /* 368 */ { ud_itab__368, UD_TAB__OPC_MOD, "/mod" }, /* 369 */ { ud_itab__369, UD_TAB__OPC_RM, "/rm" }, /* 370 */ { ud_itab__370, UD_TAB__OPC_SSE, "/sse" }, /* 371 */ { ud_itab__371, UD_TAB__OPC_MOD, "/mod" }, /* 372 */ { ud_itab__372, UD_TAB__OPC_RM, "/rm" }, /* 373 */ { ud_itab__373, UD_TAB__OPC_SSE, "/sse" }, /* 374 */ { ud_itab__374, UD_TAB__OPC_MOD, "/mod" }, /* 375 */ { ud_itab__375, UD_TAB__OPC_MOD, "/mod" }, /* 376 */ { ud_itab__376, UD_TAB__OPC_REG, "/reg" }, /* 377 */ { ud_itab__377, UD_TAB__OPC_RM, "/rm" }, /* 378 */ { ud_itab__378, UD_TAB__OPC_SSE, "/sse" }, /* 379 */ { ud_itab__379, UD_TAB__OPC_MOD, "/mod" }, /* 380 */ { ud_itab__380, UD_TAB__OPC_RM, "/rm" }, /* 381 */ { ud_itab__381, UD_TAB__OPC_SSE, "/sse" }, /* 382 */ { ud_itab__382, UD_TAB__OPC_MOD, "/mod" }, /* 383 */ { ud_itab__383, UD_TAB__OPC_RM, "/rm" }, /* 384 */ { ud_itab__384, UD_TAB__OPC_SSE, "/sse" }, /* 385 */ { ud_itab__385, UD_TAB__OPC_MOD, "/mod" }, /* 386 */ { ud_itab__386, UD_TAB__OPC_RM, "/rm" }, /* 387 */ { ud_itab__387, UD_TAB__OPC_SSE, "/sse" }, /* 388 */ { ud_itab__388, UD_TAB__OPC_MOD, "/mod" }, /* 389 */ { ud_itab__389, UD_TAB__OPC_RM, "/rm" }, /* 390 */ { ud_itab__390, UD_TAB__OPC_SSE, "/sse" }, /* 391 */ { ud_itab__391, UD_TAB__OPC_MOD, "/mod" }, /* 392 */ { ud_itab__392, UD_TAB__OPC_RM, "/rm" }, /* 393 */ { ud_itab__393, UD_TAB__OPC_SSE, "/sse" }, /* 394 */ { ud_itab__394, UD_TAB__OPC_MOD, "/mod" }, /* 395 */ { ud_itab__395, UD_TAB__OPC_SSE, "/sse" }, /* 396 */ { ud_itab__396, UD_TAB__OPC_SSE, "/sse" }, /* 397 */ { ud_itab__397, UD_TAB__OPC_SSE, "/sse" }, /* 398 */ { ud_itab__398, UD_TAB__OPC_SSE, "/sse" }, /* 399 */ { ud_itab__399, UD_TAB__OPC_SSE, "/sse" }, /* 400 */ { ud_itab__400, UD_TAB__OPC_SSE, "/sse" }, /* 401 */ { ud_itab__401, UD_TAB__OPC_MOD, "/mod" }, /* 402 */ { ud_itab__402, UD_TAB__OPC_REG, "/reg" }, /* 403 */ { ud_itab__403, UD_TAB__OPC_SSE, "/sse" }, /* 404 */ { ud_itab__404, UD_TAB__OPC_MOD, "/mod" }, /* 405 */ { ud_itab__405, UD_TAB__OPC_SSE, "/sse" }, /* 406 */ { ud_itab__406, UD_TAB__OPC_MOD, "/mod" }, /* 407 */ { ud_itab__407, UD_TAB__OPC_SSE, "/sse" }, /* 408 */ { ud_itab__408, UD_TAB__OPC_MOD, "/mod" }, /* 409 */ { ud_itab__409, UD_TAB__OPC_SSE, "/sse" }, /* 410 */ { ud_itab__410, UD_TAB__OPC_MOD, "/mod" }, /* 411 */ { ud_itab__411, UD_TAB__OPC_SSE, "/sse" }, /* 412 */ { ud_itab__412, UD_TAB__OPC_MOD, "/mod" }, /* 413 */ { ud_itab__413, UD_TAB__OPC_SSE, "/sse" }, /* 414 */ { ud_itab__414, UD_TAB__OPC_MOD, "/mod" }, /* 415 */ { ud_itab__415, UD_TAB__OPC_SSE, "/sse" }, /* 416 */ { ud_itab__416, UD_TAB__OPC_MOD, "/mod" }, /* 417 */ { ud_itab__417, UD_TAB__OPC_REG, "/reg" }, /* 418 */ { ud_itab__418, UD_TAB__OPC_RM, "/rm" }, /* 419 */ { ud_itab__419, UD_TAB__OPC_SSE, "/sse" }, /* 420 */ { ud_itab__420, UD_TAB__OPC_MOD, "/mod" }, /* 421 */ { ud_itab__421, UD_TAB__OPC_SSE, "/sse" }, /* 422 */ { ud_itab__422, UD_TAB__OPC_MOD, "/mod" }, /* 423 */ { ud_itab__423, UD_TAB__OPC_SSE, "/sse" }, /* 424 */ { ud_itab__424, UD_TAB__OPC_MOD, "/mod" }, /* 425 */ { ud_itab__425, UD_TAB__OPC_SSE, "/sse" }, /* 426 */ { ud_itab__426, UD_TAB__OPC_MOD, "/mod" }, /* 427 */ { ud_itab__427, UD_TAB__OPC_SSE, "/sse" }, /* 428 */ { ud_itab__428, UD_TAB__OPC_MOD, "/mod" }, /* 429 */ { ud_itab__429, UD_TAB__OPC_SSE, "/sse" }, /* 430 */ { ud_itab__430, UD_TAB__OPC_MOD, "/mod" }, /* 431 */ { ud_itab__431, UD_TAB__OPC_SSE, "/sse" }, /* 432 */ { ud_itab__432, UD_TAB__OPC_MOD, "/mod" }, /* 433 */ { ud_itab__433, UD_TAB__OPC_SSE, "/sse" }, /* 434 */ { ud_itab__434, UD_TAB__OPC_MOD, "/mod" }, /* 435 */ { ud_itab__435, UD_TAB__OPC_RM, "/rm" }, /* 436 */ { ud_itab__436, UD_TAB__OPC_SSE, "/sse" }, /* 437 */ { ud_itab__437, UD_TAB__OPC_MOD, "/mod" }, /* 438 */ { ud_itab__438, UD_TAB__OPC_SSE, "/sse" }, /* 439 */ { ud_itab__439, UD_TAB__OPC_MOD, "/mod" }, /* 440 */ { ud_itab__440, UD_TAB__OPC_SSE, "/sse" }, /* 441 */ { ud_itab__441, UD_TAB__OPC_MOD, "/mod" }, /* 442 */ { ud_itab__442, UD_TAB__OPC_SSE, "/sse" }, /* 443 */ { ud_itab__443, UD_TAB__OPC_MOD, "/mod" }, /* 444 */ { ud_itab__444, UD_TAB__OPC_SSE, "/sse" }, /* 445 */ { ud_itab__445, UD_TAB__OPC_MOD, "/mod" }, /* 446 */ { ud_itab__446, UD_TAB__OPC_SSE, "/sse" }, /* 447 */ { ud_itab__447, UD_TAB__OPC_MOD, "/mod" }, /* 448 */ { ud_itab__448, UD_TAB__OPC_SSE, "/sse" }, /* 449 */ { ud_itab__449, UD_TAB__OPC_MOD, "/mod" }, /* 450 */ { ud_itab__450, UD_TAB__OPC_SSE, "/sse" }, /* 451 */ { ud_itab__451, UD_TAB__OPC_MOD, "/mod" }, /* 452 */ { ud_itab__452, UD_TAB__OPC_RM, "/rm" }, /* 453 */ { ud_itab__453, UD_TAB__OPC_SSE, "/sse" }, /* 454 */ { ud_itab__454, UD_TAB__OPC_MOD, "/mod" }, /* 455 */ { ud_itab__455, UD_TAB__OPC_SSE, "/sse" }, /* 456 */ { ud_itab__456, UD_TAB__OPC_MOD, "/mod" }, /* 457 */ { ud_itab__457, UD_TAB__OPC_SSE, "/sse" }, /* 458 */ { ud_itab__458, UD_TAB__OPC_MOD, "/mod" }, /* 459 */ { ud_itab__459, UD_TAB__OPC_SSE, "/sse" }, /* 460 */ { ud_itab__460, UD_TAB__OPC_MOD, "/mod" }, /* 461 */ { ud_itab__461, UD_TAB__OPC_SSE, "/sse" }, /* 462 */ { ud_itab__462, UD_TAB__OPC_MOD, "/mod" }, /* 463 */ { ud_itab__463, UD_TAB__OPC_SSE, "/sse" }, /* 464 */ { ud_itab__464, UD_TAB__OPC_MOD, "/mod" }, /* 465 */ { ud_itab__465, UD_TAB__OPC_SSE, "/sse" }, /* 466 */ { ud_itab__466, UD_TAB__OPC_MOD, "/mod" }, /* 467 */ { ud_itab__467, UD_TAB__OPC_SSE, "/sse" }, /* 468 */ { ud_itab__468, UD_TAB__OPC_MOD, "/mod" }, /* 469 */ { ud_itab__469, UD_TAB__OPC_SSE, "/sse" }, /* 470 */ { ud_itab__470, UD_TAB__OPC_SSE, "/sse" }, /* 471 */ { ud_itab__471, UD_TAB__OPC_SSE, "/sse" }, /* 472 */ { ud_itab__472, UD_TAB__OPC_SSE, "/sse" }, /* 473 */ { ud_itab__473, UD_TAB__OPC_SSE, "/sse" }, /* 474 */ { ud_itab__474, UD_TAB__OPC_SSE, "/sse" }, /* 475 */ { ud_itab__475, UD_TAB__OPC_SSE, "/sse" }, /* 476 */ { ud_itab__476, UD_TAB__OPC_SSE, "/sse" }, /* 477 */ { ud_itab__477, UD_TAB__OPC_SSE, "/sse" }, /* 478 */ { ud_itab__478, UD_TAB__OPC_SSE, "/sse" }, /* 479 */ { ud_itab__479, UD_TAB__OPC_REG, "/reg" }, /* 480 */ { ud_itab__480, UD_TAB__OPC_SSE, "/sse" }, /* 481 */ { ud_itab__481, UD_TAB__OPC_SSE, "/sse" }, /* 482 */ { ud_itab__482, UD_TAB__OPC_SSE, "/sse" }, /* 483 */ { ud_itab__483, UD_TAB__OPC_SSE, "/sse" }, /* 484 */ { ud_itab__484, UD_TAB__OPC_SSE, "/sse" }, /* 485 */ { ud_itab__485, UD_TAB__OPC_SSE, "/sse" }, /* 486 */ { ud_itab__486, UD_TAB__OPC_SSE, "/sse" }, /* 487 */ { ud_itab__487, UD_TAB__OPC_SSE, "/sse" }, /* 488 */ { ud_itab__488, UD_TAB__OPC_SSE, "/sse" }, /* 489 */ { ud_itab__489, UD_TAB__OPC_SSE, "/sse" }, /* 490 */ { ud_itab__490, UD_TAB__OPC_SSE, "/sse" }, /* 491 */ { ud_itab__491, UD_TAB__OPC_SSE, "/sse" }, /* 492 */ { ud_itab__492, UD_TAB__OPC_SSE, "/sse" }, /* 493 */ { ud_itab__493, UD_TAB__OPC_SSE, "/sse" }, /* 494 */ { ud_itab__494, UD_TAB__OPC_SSE, "/sse" }, /* 495 */ { ud_itab__495, UD_TAB__OPC_SSE, "/sse" }, /* 496 */ { ud_itab__496, UD_TAB__OPC_REG, "/reg" }, /* 497 */ { ud_itab__497, UD_TAB__OPC_SSE, "/sse" }, /* 498 */ { ud_itab__498, UD_TAB__OPC_OSIZE, "/o" }, /* 499 */ { ud_itab__499, UD_TAB__OPC_SSE, "/sse" }, /* 500 */ { ud_itab__500, UD_TAB__OPC_VENDOR, "intel" }, /* 501 */ { ud_itab__501, UD_TAB__OPC_VENDOR, "intel" }, /* 502 */ { ud_itab__502, UD_TAB__OPC_VENDOR, "intel" }, /* 503 */ { ud_itab__503, UD_TAB__OPC_SSE, "/sse" }, /* 504 */ { ud_itab__504, UD_TAB__OPC_VENDOR, "intel" }, /* 505 */ { ud_itab__505, UD_TAB__OPC_SSE, "/sse" }, /* 506 */ { ud_itab__506, UD_TAB__OPC_SSE, "/sse" }, /* 507 */ { ud_itab__507, UD_TAB__OPC_SSE, "/sse" }, /* 508 */ { ud_itab__508, UD_TAB__OPC_SSE, "/sse" }, /* 509 */ { ud_itab__509, UD_TAB__OPC_SSE, "/sse" }, /* 510 */ { ud_itab__510, UD_TAB__OPC_SSE, "/sse" }, /* 511 */ { ud_itab__511, UD_TAB__OPC_SSE, "/sse" }, /* 512 */ { ud_itab__512, UD_TAB__OPC_SSE, "/sse" }, /* 513 */ { ud_itab__513, UD_TAB__OPC_SSE, "/sse" }, /* 514 */ { ud_itab__514, UD_TAB__OPC_SSE, "/sse" }, /* 515 */ { ud_itab__515, UD_TAB__OPC_SSE, "/sse" }, /* 516 */ { ud_itab__516, UD_TAB__OPC_SSE, "/sse" }, /* 517 */ { ud_itab__517, UD_TAB__OPC_SSE, "/sse" }, /* 518 */ { ud_itab__518, UD_TAB__OPC_SSE, "/sse" }, /* 519 */ { ud_itab__519, UD_TAB__OPC_SSE, "/sse" }, /* 520 */ { ud_itab__520, UD_TAB__OPC_SSE, "/sse" }, /* 521 */ { ud_itab__521, UD_TAB__OPC_SSE, "/sse" }, /* 522 */ { ud_itab__522, UD_TAB__OPC_SSE, "/sse" }, /* 523 */ { ud_itab__523, UD_TAB__OPC_SSE, "/sse" }, /* 524 */ { ud_itab__524, UD_TAB__OPC_SSE, "/sse" }, /* 525 */ { ud_itab__525, UD_TAB__OPC_SSE, "/sse" }, /* 526 */ { ud_itab__526, UD_TAB__OPC_SSE, "/sse" }, /* 527 */ { ud_itab__527, UD_TAB__OPC_SSE, "/sse" }, /* 528 */ { ud_itab__528, UD_TAB__OPC_SSE, "/sse" }, /* 529 */ { ud_itab__529, UD_TAB__OPC_SSE, "/sse" }, /* 530 */ { ud_itab__530, UD_TAB__OPC_SSE, "/sse" }, /* 531 */ { ud_itab__531, UD_TAB__OPC_SSE, "/sse" }, /* 532 */ { ud_itab__532, UD_TAB__OPC_SSE, "/sse" }, /* 533 */ { ud_itab__533, UD_TAB__OPC_SSE, "/sse" }, /* 534 */ { ud_itab__534, UD_TAB__OPC_SSE, "/sse" }, /* 535 */ { ud_itab__535, UD_TAB__OPC_SSE, "/sse" }, /* 536 */ { ud_itab__536, UD_TAB__OPC_SSE, "/sse" }, /* 537 */ { ud_itab__537, UD_TAB__OPC_SSE, "/sse" }, /* 538 */ { ud_itab__538, UD_TAB__OPC_SSE, "/sse" }, /* 539 */ { ud_itab__539, UD_TAB__OPC_SSE, "/sse" }, /* 540 */ { ud_itab__540, UD_TAB__OPC_SSE, "/sse" }, /* 541 */ { ud_itab__541, UD_TAB__OPC_SSE, "/sse" }, /* 542 */ { ud_itab__542, UD_TAB__OPC_SSE, "/sse" }, /* 543 */ { ud_itab__543, UD_TAB__OPC_SSE, "/sse" }, /* 544 */ { ud_itab__544, UD_TAB__OPC_SSE, "/sse" }, /* 545 */ { ud_itab__545, UD_TAB__OPC_SSE, "/sse" }, /* 546 */ { ud_itab__546, UD_TAB__OPC_SSE, "/sse" }, /* 547 */ { ud_itab__547, UD_TAB__OPC_SSE, "/sse" }, /* 548 */ { ud_itab__548, UD_TAB__OPC_SSE, "/sse" }, /* 549 */ { ud_itab__549, UD_TAB__OPC_SSE, "/sse" }, /* 550 */ { ud_itab__550, UD_TAB__OPC_SSE, "/sse" }, /* 551 */ { ud_itab__551, UD_TAB__OPC_SSE, "/sse" }, /* 552 */ { ud_itab__552, UD_TAB__OPC_MOD, "/mod" }, /* 553 */ { ud_itab__553, UD_TAB__OPC_SSE, "/sse" }, /* 554 */ { ud_itab__554, UD_TAB__OPC_MOD, "/mod" }, /* 555 */ { ud_itab__555, UD_TAB__OPC_MOD, "/mod" }, /* 556 */ { ud_itab__556, UD_TAB__OPC_SSE, "/sse" }, /* 557 */ { ud_itab__557, UD_TAB__OPC_SSE, "/sse" }, /* 558 */ { ud_itab__558, UD_TAB__OPC_SSE, "/sse" }, /* 559 */ { ud_itab__559, UD_TAB__OPC_SSE, "/sse" }, /* 560 */ { ud_itab__560, UD_TAB__OPC_SSE, "/sse" }, /* 561 */ { ud_itab__561, UD_TAB__OPC_SSE, "/sse" }, /* 562 */ { ud_itab__562, UD_TAB__OPC_SSE, "/sse" }, /* 563 */ { ud_itab__563, UD_TAB__OPC_MODE, "/m" }, /* 564 */ { ud_itab__564, UD_TAB__OPC_MODE, "/m" }, /* 565 */ { ud_itab__565, UD_TAB__OPC_MODE, "/m" }, /* 566 */ { ud_itab__566, UD_TAB__OPC_MODE, "/m" }, /* 567 */ { ud_itab__567, UD_TAB__OPC_MODE, "/m" }, /* 568 */ { ud_itab__568, UD_TAB__OPC_MODE, "/m" }, /* 569 */ { ud_itab__569, UD_TAB__OPC_MODE, "/m" }, /* 570 */ { ud_itab__570, UD_TAB__OPC_MODE, "/m" }, /* 571 */ { ud_itab__571, UD_TAB__OPC_OSIZE, "/o" }, /* 572 */ { ud_itab__572, UD_TAB__OPC_MODE, "/m" }, /* 573 */ { ud_itab__573, UD_TAB__OPC_MODE, "/m" }, /* 574 */ { ud_itab__574, UD_TAB__OPC_OSIZE, "/o" }, /* 575 */ { ud_itab__575, UD_TAB__OPC_MODE, "/m" }, /* 576 */ { ud_itab__576, UD_TAB__OPC_MODE, "/m" }, /* 577 */ { ud_itab__577, UD_TAB__OPC_MODE, "/m" }, /* 578 */ { ud_itab__578, UD_TAB__OPC_MODE, "/m" }, /* 579 */ { ud_itab__579, UD_TAB__OPC_OSIZE, "/o" }, /* 580 */ { ud_itab__580, UD_TAB__OPC_OSIZE, "/o" }, /* 581 */ { ud_itab__581, UD_TAB__OPC_REG, "/reg" }, /* 582 */ { ud_itab__582, UD_TAB__OPC_REG, "/reg" }, /* 583 */ { ud_itab__583, UD_TAB__OPC_REG, "/reg" }, /* 584 */ { ud_itab__584, UD_TAB__OPC_MODE, "/m" }, /* 585 */ { ud_itab__585, UD_TAB__OPC_MODE, "/m" }, /* 586 */ { ud_itab__586, UD_TAB__OPC_MODE, "/m" }, /* 587 */ { ud_itab__587, UD_TAB__OPC_MODE, "/m" }, /* 588 */ { ud_itab__588, UD_TAB__OPC_MODE, "/m" }, /* 589 */ { ud_itab__589, UD_TAB__OPC_MODE, "/m" }, /* 590 */ { ud_itab__590, UD_TAB__OPC_MODE, "/m" }, /* 591 */ { ud_itab__591, UD_TAB__OPC_MODE, "/m" }, /* 592 */ { ud_itab__592, UD_TAB__OPC_REG, "/reg" }, /* 593 */ { ud_itab__593, UD_TAB__OPC_REG, "/reg" }, /* 594 */ { ud_itab__594, UD_TAB__OPC_OSIZE, "/o" }, /* 595 */ { ud_itab__595, UD_TAB__OPC_OSIZE, "/o" }, /* 596 */ { ud_itab__596, UD_TAB__OPC_MODE, "/m" }, /* 597 */ { ud_itab__597, UD_TAB__OPC_OSIZE, "/o" }, /* 598 */ { ud_itab__598, UD_TAB__OPC_MODE, "/m" }, /* 599 */ { ud_itab__599, UD_TAB__OPC_MODE, "/m" }, /* 600 */ { ud_itab__600, UD_TAB__OPC_MODE, "/m" }, /* 601 */ { ud_itab__601, UD_TAB__OPC_OSIZE, "/o" }, /* 602 */ { ud_itab__602, UD_TAB__OPC_MODE, "/m" }, /* 603 */ { ud_itab__603, UD_TAB__OPC_MODE, "/m" }, /* 604 */ { ud_itab__604, UD_TAB__OPC_MODE, "/m" }, /* 605 */ { ud_itab__605, UD_TAB__OPC_OSIZE, "/o" }, /* 606 */ { ud_itab__606, UD_TAB__OPC_OSIZE, "/o" }, /* 607 */ { ud_itab__607, UD_TAB__OPC_OSIZE, "/o" }, /* 608 */ { ud_itab__608, UD_TAB__OPC_OSIZE, "/o" }, /* 609 */ { ud_itab__609, UD_TAB__OPC_OSIZE, "/o" }, /* 610 */ { ud_itab__610, UD_TAB__OPC_REG, "/reg" }, /* 611 */ { ud_itab__611, UD_TAB__OPC_REG, "/reg" }, /* 612 */ { ud_itab__612, UD_TAB__OPC_MODE, "/m" }, /* 613 */ { ud_itab__613, UD_TAB__OPC_MODE, "/m" }, /* 614 */ { ud_itab__614, UD_TAB__OPC_REG, "/reg" }, /* 615 */ { ud_itab__615, UD_TAB__OPC_REG, "/reg" }, /* 616 */ { ud_itab__616, UD_TAB__OPC_MODE, "/m" }, /* 617 */ { ud_itab__617, UD_TAB__OPC_OSIZE, "/o" }, /* 618 */ { ud_itab__618, UD_TAB__OPC_REG, "/reg" }, /* 619 */ { ud_itab__619, UD_TAB__OPC_REG, "/reg" }, /* 620 */ { ud_itab__620, UD_TAB__OPC_REG, "/reg" }, /* 621 */ { ud_itab__621, UD_TAB__OPC_REG, "/reg" }, /* 622 */ { ud_itab__622, UD_TAB__OPC_MODE, "/m" }, /* 623 */ { ud_itab__623, UD_TAB__OPC_MODE, "/m" }, /* 624 */ { ud_itab__624, UD_TAB__OPC_MODE, "/m" }, /* 625 */ { ud_itab__625, UD_TAB__OPC_MOD, "/mod" }, /* 626 */ { ud_itab__626, UD_TAB__OPC_REG, "/reg" }, /* 627 */ { ud_itab__627, UD_TAB__OPC_MOD, "/mod" }, /* 628 */ { ud_itab__628, UD_TAB__OPC_MOD, "/mod" }, /* 629 */ { ud_itab__629, UD_TAB__OPC_MOD, "/mod" }, /* 630 */ { ud_itab__630, UD_TAB__OPC_MOD, "/mod" }, /* 631 */ { ud_itab__631, UD_TAB__OPC_MOD, "/mod" }, /* 632 */ { ud_itab__632, UD_TAB__OPC_MOD, "/mod" }, /* 633 */ { ud_itab__633, UD_TAB__OPC_MOD, "/mod" }, /* 634 */ { ud_itab__634, UD_TAB__OPC_MOD, "/mod" }, /* 635 */ { ud_itab__635, UD_TAB__OPC_X87, "/x87" }, /* 636 */ { ud_itab__636, UD_TAB__OPC_MOD, "/mod" }, /* 637 */ { ud_itab__637, UD_TAB__OPC_MOD, "/mod" }, /* 638 */ { ud_itab__638, UD_TAB__OPC_MOD, "/mod" }, /* 639 */ { ud_itab__639, UD_TAB__OPC_MOD, "/mod" }, /* 640 */ { ud_itab__640, UD_TAB__OPC_MOD, "/mod" }, /* 641 */ { ud_itab__641, UD_TAB__OPC_MOD, "/mod" }, /* 642 */ { ud_itab__642, UD_TAB__OPC_MOD, "/mod" }, /* 643 */ { ud_itab__643, UD_TAB__OPC_MOD, "/mod" }, /* 644 */ { ud_itab__644, UD_TAB__OPC_MOD, "/mod" }, /* 645 */ { ud_itab__645, UD_TAB__OPC_MOD, "/mod" }, /* 646 */ { ud_itab__646, UD_TAB__OPC_MOD, "/mod" }, /* 647 */ { ud_itab__647, UD_TAB__OPC_MOD, "/mod" }, /* 648 */ { ud_itab__648, UD_TAB__OPC_MOD, "/mod" }, /* 649 */ { ud_itab__649, UD_TAB__OPC_MOD, "/mod" }, /* 650 */ { ud_itab__650, UD_TAB__OPC_MOD, "/mod" }, /* 651 */ { ud_itab__651, UD_TAB__OPC_MOD, "/mod" }, /* 652 */ { ud_itab__652, UD_TAB__OPC_MOD, "/mod" }, /* 653 */ { ud_itab__653, UD_TAB__OPC_MOD, "/mod" }, /* 654 */ { ud_itab__654, UD_TAB__OPC_MOD, "/mod" }, /* 655 */ { ud_itab__655, UD_TAB__OPC_MOD, "/mod" }, /* 656 */ { ud_itab__656, UD_TAB__OPC_MOD, "/mod" }, /* 657 */ { ud_itab__657, UD_TAB__OPC_MOD, "/mod" }, /* 658 */ { ud_itab__658, UD_TAB__OPC_MOD, "/mod" }, /* 659 */ { ud_itab__659, UD_TAB__OPC_MOD, "/mod" }, /* 660 */ { ud_itab__660, UD_TAB__OPC_MOD, "/mod" }, /* 661 */ { ud_itab__661, UD_TAB__OPC_MOD, "/mod" }, /* 662 */ { ud_itab__662, UD_TAB__OPC_MOD, "/mod" }, /* 663 */ { ud_itab__663, UD_TAB__OPC_MOD, "/mod" }, /* 664 */ { ud_itab__664, UD_TAB__OPC_MOD, "/mod" }, /* 665 */ { ud_itab__665, UD_TAB__OPC_MOD, "/mod" }, /* 666 */ { ud_itab__666, UD_TAB__OPC_MOD, "/mod" }, /* 667 */ { ud_itab__667, UD_TAB__OPC_MOD, "/mod" }, /* 668 */ { ud_itab__668, UD_TAB__OPC_MOD, "/mod" }, /* 669 */ { ud_itab__669, UD_TAB__OPC_MOD, "/mod" }, /* 670 */ { ud_itab__670, UD_TAB__OPC_MOD, "/mod" }, /* 671 */ { ud_itab__671, UD_TAB__OPC_MOD, "/mod" }, /* 672 */ { ud_itab__672, UD_TAB__OPC_MOD, "/mod" }, /* 673 */ { ud_itab__673, UD_TAB__OPC_MOD, "/mod" }, /* 674 */ { ud_itab__674, UD_TAB__OPC_MOD, "/mod" }, /* 675 */ { ud_itab__675, UD_TAB__OPC_MOD, "/mod" }, /* 676 */ { ud_itab__676, UD_TAB__OPC_MOD, "/mod" }, /* 677 */ { ud_itab__677, UD_TAB__OPC_MOD, "/mod" }, /* 678 */ { ud_itab__678, UD_TAB__OPC_MOD, "/mod" }, /* 679 */ { ud_itab__679, UD_TAB__OPC_MOD, "/mod" }, /* 680 */ { ud_itab__680, UD_TAB__OPC_MOD, "/mod" }, /* 681 */ { ud_itab__681, UD_TAB__OPC_MOD, "/mod" }, /* 682 */ { ud_itab__682, UD_TAB__OPC_MOD, "/mod" }, /* 683 */ { ud_itab__683, UD_TAB__OPC_MOD, "/mod" }, /* 684 */ { ud_itab__684, UD_TAB__OPC_MOD, "/mod" }, /* 685 */ { ud_itab__685, UD_TAB__OPC_MOD, "/mod" }, /* 686 */ { ud_itab__686, UD_TAB__OPC_MOD, "/mod" }, /* 687 */ { ud_itab__687, UD_TAB__OPC_MOD, "/mod" }, /* 688 */ { ud_itab__688, UD_TAB__OPC_MOD, "/mod" }, /* 689 */ { ud_itab__689, UD_TAB__OPC_MOD, "/mod" }, /* 690 */ { ud_itab__690, UD_TAB__OPC_MOD, "/mod" }, /* 691 */ { ud_itab__691, UD_TAB__OPC_MOD, "/mod" }, /* 692 */ { ud_itab__692, UD_TAB__OPC_MOD, "/mod" }, /* 693 */ { ud_itab__693, UD_TAB__OPC_MOD, "/mod" }, /* 694 */ { ud_itab__694, UD_TAB__OPC_MOD, "/mod" }, /* 695 */ { ud_itab__695, UD_TAB__OPC_MOD, "/mod" }, /* 696 */ { ud_itab__696, UD_TAB__OPC_MOD, "/mod" }, /* 697 */ { ud_itab__697, UD_TAB__OPC_MOD, "/mod" }, /* 698 */ { ud_itab__698, UD_TAB__OPC_MOD, "/mod" }, /* 699 */ { ud_itab__699, UD_TAB__OPC_MOD, "/mod" }, /* 700 */ { ud_itab__700, UD_TAB__OPC_MOD, "/mod" }, /* 701 */ { ud_itab__701, UD_TAB__OPC_REG, "/reg" }, /* 702 */ { ud_itab__702, UD_TAB__OPC_MOD, "/mod" }, /* 703 */ { ud_itab__703, UD_TAB__OPC_MOD, "/mod" }, /* 704 */ { ud_itab__704, UD_TAB__OPC_MOD, "/mod" }, /* 705 */ { ud_itab__705, UD_TAB__OPC_MOD, "/mod" }, /* 706 */ { ud_itab__706, UD_TAB__OPC_MOD, "/mod" }, /* 707 */ { ud_itab__707, UD_TAB__OPC_MOD, "/mod" }, /* 708 */ { ud_itab__708, UD_TAB__OPC_MOD, "/mod" }, /* 709 */ { ud_itab__709, UD_TAB__OPC_X87, "/x87" }, /* 710 */ { ud_itab__710, UD_TAB__OPC_MOD, "/mod" }, /* 711 */ { ud_itab__711, UD_TAB__OPC_MOD, "/mod" }, /* 712 */ { ud_itab__712, UD_TAB__OPC_MOD, "/mod" }, /* 713 */ { ud_itab__713, UD_TAB__OPC_MOD, "/mod" }, /* 714 */ { ud_itab__714, UD_TAB__OPC_MOD, "/mod" }, /* 715 */ { ud_itab__715, UD_TAB__OPC_MOD, "/mod" }, /* 716 */ { ud_itab__716, UD_TAB__OPC_MOD, "/mod" }, /* 717 */ { ud_itab__717, UD_TAB__OPC_MOD, "/mod" }, /* 718 */ { ud_itab__718, UD_TAB__OPC_MOD, "/mod" }, /* 719 */ { ud_itab__719, UD_TAB__OPC_MOD, "/mod" }, /* 720 */ { ud_itab__720, UD_TAB__OPC_MOD, "/mod" }, /* 721 */ { ud_itab__721, UD_TAB__OPC_MOD, "/mod" }, /* 722 */ { ud_itab__722, UD_TAB__OPC_MOD, "/mod" }, /* 723 */ { ud_itab__723, UD_TAB__OPC_MOD, "/mod" }, /* 724 */ { ud_itab__724, UD_TAB__OPC_MOD, "/mod" }, /* 725 */ { ud_itab__725, UD_TAB__OPC_MOD, "/mod" }, /* 726 */ { ud_itab__726, UD_TAB__OPC_MOD, "/mod" }, /* 727 */ { ud_itab__727, UD_TAB__OPC_MOD, "/mod" }, /* 728 */ { ud_itab__728, UD_TAB__OPC_MOD, "/mod" }, /* 729 */ { ud_itab__729, UD_TAB__OPC_MOD, "/mod" }, /* 730 */ { ud_itab__730, UD_TAB__OPC_MOD, "/mod" }, /* 731 */ { ud_itab__731, UD_TAB__OPC_MOD, "/mod" }, /* 732 */ { ud_itab__732, UD_TAB__OPC_MOD, "/mod" }, /* 733 */ { ud_itab__733, UD_TAB__OPC_MOD, "/mod" }, /* 734 */ { ud_itab__734, UD_TAB__OPC_MOD, "/mod" }, /* 735 */ { ud_itab__735, UD_TAB__OPC_MOD, "/mod" }, /* 736 */ { ud_itab__736, UD_TAB__OPC_MOD, "/mod" }, /* 737 */ { ud_itab__737, UD_TAB__OPC_MOD, "/mod" }, /* 738 */ { ud_itab__738, UD_TAB__OPC_MOD, "/mod" }, /* 739 */ { ud_itab__739, UD_TAB__OPC_MOD, "/mod" }, /* 740 */ { ud_itab__740, UD_TAB__OPC_MOD, "/mod" }, /* 741 */ { ud_itab__741, UD_TAB__OPC_MOD, "/mod" }, /* 742 */ { ud_itab__742, UD_TAB__OPC_MOD, "/mod" }, /* 743 */ { ud_itab__743, UD_TAB__OPC_MOD, "/mod" }, /* 744 */ { ud_itab__744, UD_TAB__OPC_MOD, "/mod" }, /* 745 */ { ud_itab__745, UD_TAB__OPC_MOD, "/mod" }, /* 746 */ { ud_itab__746, UD_TAB__OPC_MOD, "/mod" }, /* 747 */ { ud_itab__747, UD_TAB__OPC_MOD, "/mod" }, /* 748 */ { ud_itab__748, UD_TAB__OPC_MOD, "/mod" }, /* 749 */ { ud_itab__749, UD_TAB__OPC_MOD, "/mod" }, /* 750 */ { ud_itab__750, UD_TAB__OPC_MOD, "/mod" }, /* 751 */ { ud_itab__751, UD_TAB__OPC_MOD, "/mod" }, /* 752 */ { ud_itab__752, UD_TAB__OPC_MOD, "/mod" }, /* 753 */ { ud_itab__753, UD_TAB__OPC_MOD, "/mod" }, /* 754 */ { ud_itab__754, UD_TAB__OPC_MOD, "/mod" }, /* 755 */ { ud_itab__755, UD_TAB__OPC_MOD, "/mod" }, /* 756 */ { ud_itab__756, UD_TAB__OPC_MOD, "/mod" }, /* 757 */ { ud_itab__757, UD_TAB__OPC_MOD, "/mod" }, /* 758 */ { ud_itab__758, UD_TAB__OPC_MOD, "/mod" }, /* 759 */ { ud_itab__759, UD_TAB__OPC_MOD, "/mod" }, /* 760 */ { ud_itab__760, UD_TAB__OPC_MOD, "/mod" }, /* 761 */ { ud_itab__761, UD_TAB__OPC_MOD, "/mod" }, /* 762 */ { ud_itab__762, UD_TAB__OPC_MOD, "/mod" }, /* 763 */ { ud_itab__763, UD_TAB__OPC_REG, "/reg" }, /* 764 */ { ud_itab__764, UD_TAB__OPC_MOD, "/mod" }, /* 765 */ { ud_itab__765, UD_TAB__OPC_MOD, "/mod" }, /* 766 */ { ud_itab__766, UD_TAB__OPC_MOD, "/mod" }, /* 767 */ { ud_itab__767, UD_TAB__OPC_MOD, "/mod" }, /* 768 */ { ud_itab__768, UD_TAB__OPC_MOD, "/mod" }, /* 769 */ { ud_itab__769, UD_TAB__OPC_MOD, "/mod" }, /* 770 */ { ud_itab__770, UD_TAB__OPC_MOD, "/mod" }, /* 771 */ { ud_itab__771, UD_TAB__OPC_MOD, "/mod" }, /* 772 */ { ud_itab__772, UD_TAB__OPC_X87, "/x87" }, /* 773 */ { ud_itab__773, UD_TAB__OPC_MOD, "/mod" }, /* 774 */ { ud_itab__774, UD_TAB__OPC_MOD, "/mod" }, /* 775 */ { ud_itab__775, UD_TAB__OPC_MOD, "/mod" }, /* 776 */ { ud_itab__776, UD_TAB__OPC_MOD, "/mod" }, /* 777 */ { ud_itab__777, UD_TAB__OPC_MOD, "/mod" }, /* 778 */ { ud_itab__778, UD_TAB__OPC_MOD, "/mod" }, /* 779 */ { ud_itab__779, UD_TAB__OPC_MOD, "/mod" }, /* 780 */ { ud_itab__780, UD_TAB__OPC_MOD, "/mod" }, /* 781 */ { ud_itab__781, UD_TAB__OPC_MOD, "/mod" }, /* 782 */ { ud_itab__782, UD_TAB__OPC_MOD, "/mod" }, /* 783 */ { ud_itab__783, UD_TAB__OPC_MOD, "/mod" }, /* 784 */ { ud_itab__784, UD_TAB__OPC_MOD, "/mod" }, /* 785 */ { ud_itab__785, UD_TAB__OPC_MOD, "/mod" }, /* 786 */ { ud_itab__786, UD_TAB__OPC_MOD, "/mod" }, /* 787 */ { ud_itab__787, UD_TAB__OPC_MOD, "/mod" }, /* 788 */ { ud_itab__788, UD_TAB__OPC_MOD, "/mod" }, /* 789 */ { ud_itab__789, UD_TAB__OPC_MOD, "/mod" }, /* 790 */ { ud_itab__790, UD_TAB__OPC_MOD, "/mod" }, /* 791 */ { ud_itab__791, UD_TAB__OPC_MOD, "/mod" }, /* 792 */ { ud_itab__792, UD_TAB__OPC_MOD, "/mod" }, /* 793 */ { ud_itab__793, UD_TAB__OPC_MOD, "/mod" }, /* 794 */ { ud_itab__794, UD_TAB__OPC_MOD, "/mod" }, /* 795 */ { ud_itab__795, UD_TAB__OPC_MOD, "/mod" }, /* 796 */ { ud_itab__796, UD_TAB__OPC_MOD, "/mod" }, /* 797 */ { ud_itab__797, UD_TAB__OPC_MOD, "/mod" }, /* 798 */ { ud_itab__798, UD_TAB__OPC_MOD, "/mod" }, /* 799 */ { ud_itab__799, UD_TAB__OPC_MOD, "/mod" }, /* 800 */ { ud_itab__800, UD_TAB__OPC_MOD, "/mod" }, /* 801 */ { ud_itab__801, UD_TAB__OPC_MOD, "/mod" }, /* 802 */ { ud_itab__802, UD_TAB__OPC_MOD, "/mod" }, /* 803 */ { ud_itab__803, UD_TAB__OPC_MOD, "/mod" }, /* 804 */ { ud_itab__804, UD_TAB__OPC_MOD, "/mod" }, /* 805 */ { ud_itab__805, UD_TAB__OPC_MOD, "/mod" }, /* 806 */ { ud_itab__806, UD_TAB__OPC_MOD, "/mod" }, /* 807 */ { ud_itab__807, UD_TAB__OPC_REG, "/reg" }, /* 808 */ { ud_itab__808, UD_TAB__OPC_MOD, "/mod" }, /* 809 */ { ud_itab__809, UD_TAB__OPC_MOD, "/mod" }, /* 810 */ { ud_itab__810, UD_TAB__OPC_MOD, "/mod" }, /* 811 */ { ud_itab__811, UD_TAB__OPC_MOD, "/mod" }, /* 812 */ { ud_itab__812, UD_TAB__OPC_MOD, "/mod" }, /* 813 */ { ud_itab__813, UD_TAB__OPC_MOD, "/mod" }, /* 814 */ { ud_itab__814, UD_TAB__OPC_X87, "/x87" }, /* 815 */ { ud_itab__815, UD_TAB__OPC_MOD, "/mod" }, /* 816 */ { ud_itab__816, UD_TAB__OPC_MOD, "/mod" }, /* 817 */ { ud_itab__817, UD_TAB__OPC_MOD, "/mod" }, /* 818 */ { ud_itab__818, UD_TAB__OPC_MOD, "/mod" }, /* 819 */ { ud_itab__819, UD_TAB__OPC_MOD, "/mod" }, /* 820 */ { ud_itab__820, UD_TAB__OPC_MOD, "/mod" }, /* 821 */ { ud_itab__821, UD_TAB__OPC_MOD, "/mod" }, /* 822 */ { ud_itab__822, UD_TAB__OPC_MOD, "/mod" }, /* 823 */ { ud_itab__823, UD_TAB__OPC_MOD, "/mod" }, /* 824 */ { ud_itab__824, UD_TAB__OPC_MOD, "/mod" }, /* 825 */ { ud_itab__825, UD_TAB__OPC_MOD, "/mod" }, /* 826 */ { ud_itab__826, UD_TAB__OPC_MOD, "/mod" }, /* 827 */ { ud_itab__827, UD_TAB__OPC_MOD, "/mod" }, /* 828 */ { ud_itab__828, UD_TAB__OPC_MOD, "/mod" }, /* 829 */ { ud_itab__829, UD_TAB__OPC_MOD, "/mod" }, /* 830 */ { ud_itab__830, UD_TAB__OPC_MOD, "/mod" }, /* 831 */ { ud_itab__831, UD_TAB__OPC_MOD, "/mod" }, /* 832 */ { ud_itab__832, UD_TAB__OPC_MOD, "/mod" }, /* 833 */ { ud_itab__833, UD_TAB__OPC_MOD, "/mod" }, /* 834 */ { ud_itab__834, UD_TAB__OPC_MOD, "/mod" }, /* 835 */ { ud_itab__835, UD_TAB__OPC_MOD, "/mod" }, /* 836 */ { ud_itab__836, UD_TAB__OPC_MOD, "/mod" }, /* 837 */ { ud_itab__837, UD_TAB__OPC_MOD, "/mod" }, /* 838 */ { ud_itab__838, UD_TAB__OPC_MOD, "/mod" }, /* 839 */ { ud_itab__839, UD_TAB__OPC_MOD, "/mod" }, /* 840 */ { ud_itab__840, UD_TAB__OPC_MOD, "/mod" }, /* 841 */ { ud_itab__841, UD_TAB__OPC_MOD, "/mod" }, /* 842 */ { ud_itab__842, UD_TAB__OPC_MOD, "/mod" }, /* 843 */ { ud_itab__843, UD_TAB__OPC_MOD, "/mod" }, /* 844 */ { ud_itab__844, UD_TAB__OPC_MOD, "/mod" }, /* 845 */ { ud_itab__845, UD_TAB__OPC_MOD, "/mod" }, /* 846 */ { ud_itab__846, UD_TAB__OPC_MOD, "/mod" }, /* 847 */ { ud_itab__847, UD_TAB__OPC_MOD, "/mod" }, /* 848 */ { ud_itab__848, UD_TAB__OPC_MOD, "/mod" }, /* 849 */ { ud_itab__849, UD_TAB__OPC_MOD, "/mod" }, /* 850 */ { ud_itab__850, UD_TAB__OPC_MOD, "/mod" }, /* 851 */ { ud_itab__851, UD_TAB__OPC_MOD, "/mod" }, /* 852 */ { ud_itab__852, UD_TAB__OPC_MOD, "/mod" }, /* 853 */ { ud_itab__853, UD_TAB__OPC_MOD, "/mod" }, /* 854 */ { ud_itab__854, UD_TAB__OPC_MOD, "/mod" }, /* 855 */ { ud_itab__855, UD_TAB__OPC_MOD, "/mod" }, /* 856 */ { ud_itab__856, UD_TAB__OPC_MOD, "/mod" }, /* 857 */ { ud_itab__857, UD_TAB__OPC_MOD, "/mod" }, /* 858 */ { ud_itab__858, UD_TAB__OPC_MOD, "/mod" }, /* 859 */ { ud_itab__859, UD_TAB__OPC_MOD, "/mod" }, /* 860 */ { ud_itab__860, UD_TAB__OPC_MOD, "/mod" }, /* 861 */ { ud_itab__861, UD_TAB__OPC_MOD, "/mod" }, /* 862 */ { ud_itab__862, UD_TAB__OPC_MOD, "/mod" }, /* 863 */ { ud_itab__863, UD_TAB__OPC_MOD, "/mod" }, /* 864 */ { ud_itab__864, UD_TAB__OPC_MOD, "/mod" }, /* 865 */ { ud_itab__865, UD_TAB__OPC_MOD, "/mod" }, /* 866 */ { ud_itab__866, UD_TAB__OPC_REG, "/reg" }, /* 867 */ { ud_itab__867, UD_TAB__OPC_MOD, "/mod" }, /* 868 */ { ud_itab__868, UD_TAB__OPC_MOD, "/mod" }, /* 869 */ { ud_itab__869, UD_TAB__OPC_MOD, "/mod" }, /* 870 */ { ud_itab__870, UD_TAB__OPC_MOD, "/mod" }, /* 871 */ { ud_itab__871, UD_TAB__OPC_MOD, "/mod" }, /* 872 */ { ud_itab__872, UD_TAB__OPC_MOD, "/mod" }, /* 873 */ { ud_itab__873, UD_TAB__OPC_MOD, "/mod" }, /* 874 */ { ud_itab__874, UD_TAB__OPC_MOD, "/mod" }, /* 875 */ { ud_itab__875, UD_TAB__OPC_X87, "/x87" }, /* 876 */ { ud_itab__876, UD_TAB__OPC_MOD, "/mod" }, /* 877 */ { ud_itab__877, UD_TAB__OPC_MOD, "/mod" }, /* 878 */ { ud_itab__878, UD_TAB__OPC_MOD, "/mod" }, /* 879 */ { ud_itab__879, UD_TAB__OPC_MOD, "/mod" }, /* 880 */ { ud_itab__880, UD_TAB__OPC_MOD, "/mod" }, /* 881 */ { ud_itab__881, UD_TAB__OPC_MOD, "/mod" }, /* 882 */ { ud_itab__882, UD_TAB__OPC_MOD, "/mod" }, /* 883 */ { ud_itab__883, UD_TAB__OPC_MOD, "/mod" }, /* 884 */ { ud_itab__884, UD_TAB__OPC_MOD, "/mod" }, /* 885 */ { ud_itab__885, UD_TAB__OPC_MOD, "/mod" }, /* 886 */ { ud_itab__886, UD_TAB__OPC_MOD, "/mod" }, /* 887 */ { ud_itab__887, UD_TAB__OPC_MOD, "/mod" }, /* 888 */ { ud_itab__888, UD_TAB__OPC_MOD, "/mod" }, /* 889 */ { ud_itab__889, UD_TAB__OPC_MOD, "/mod" }, /* 890 */ { ud_itab__890, UD_TAB__OPC_MOD, "/mod" }, /* 891 */ { ud_itab__891, UD_TAB__OPC_MOD, "/mod" }, /* 892 */ { ud_itab__892, UD_TAB__OPC_MOD, "/mod" }, /* 893 */ { ud_itab__893, UD_TAB__OPC_MOD, "/mod" }, /* 894 */ { ud_itab__894, UD_TAB__OPC_MOD, "/mod" }, /* 895 */ { ud_itab__895, UD_TAB__OPC_MOD, "/mod" }, /* 896 */ { ud_itab__896, UD_TAB__OPC_MOD, "/mod" }, /* 897 */ { ud_itab__897, UD_TAB__OPC_MOD, "/mod" }, /* 898 */ { ud_itab__898, UD_TAB__OPC_MOD, "/mod" }, /* 899 */ { ud_itab__899, UD_TAB__OPC_MOD, "/mod" }, /* 900 */ { ud_itab__900, UD_TAB__OPC_MOD, "/mod" }, /* 901 */ { ud_itab__901, UD_TAB__OPC_MOD, "/mod" }, /* 902 */ { ud_itab__902, UD_TAB__OPC_MOD, "/mod" }, /* 903 */ { ud_itab__903, UD_TAB__OPC_MOD, "/mod" }, /* 904 */ { ud_itab__904, UD_TAB__OPC_MOD, "/mod" }, /* 905 */ { ud_itab__905, UD_TAB__OPC_MOD, "/mod" }, /* 906 */ { ud_itab__906, UD_TAB__OPC_MOD, "/mod" }, /* 907 */ { ud_itab__907, UD_TAB__OPC_MOD, "/mod" }, /* 908 */ { ud_itab__908, UD_TAB__OPC_MOD, "/mod" }, /* 909 */ { ud_itab__909, UD_TAB__OPC_MOD, "/mod" }, /* 910 */ { ud_itab__910, UD_TAB__OPC_MOD, "/mod" }, /* 911 */ { ud_itab__911, UD_TAB__OPC_MOD, "/mod" }, /* 912 */ { ud_itab__912, UD_TAB__OPC_MOD, "/mod" }, /* 913 */ { ud_itab__913, UD_TAB__OPC_MOD, "/mod" }, /* 914 */ { ud_itab__914, UD_TAB__OPC_MOD, "/mod" }, /* 915 */ { ud_itab__915, UD_TAB__OPC_MOD, "/mod" }, /* 916 */ { ud_itab__916, UD_TAB__OPC_MOD, "/mod" }, /* 917 */ { ud_itab__917, UD_TAB__OPC_MOD, "/mod" }, /* 918 */ { ud_itab__918, UD_TAB__OPC_MOD, "/mod" }, /* 919 */ { ud_itab__919, UD_TAB__OPC_MOD, "/mod" }, /* 920 */ { ud_itab__920, UD_TAB__OPC_MOD, "/mod" }, /* 921 */ { ud_itab__921, UD_TAB__OPC_MOD, "/mod" }, /* 922 */ { ud_itab__922, UD_TAB__OPC_MOD, "/mod" }, /* 923 */ { ud_itab__923, UD_TAB__OPC_MOD, "/mod" }, /* 924 */ { ud_itab__924, UD_TAB__OPC_MOD, "/mod" }, /* 925 */ { ud_itab__925, UD_TAB__OPC_MOD, "/mod" }, /* 926 */ { ud_itab__926, UD_TAB__OPC_MOD, "/mod" }, /* 927 */ { ud_itab__927, UD_TAB__OPC_MOD, "/mod" }, /* 928 */ { ud_itab__928, UD_TAB__OPC_MOD, "/mod" }, /* 929 */ { ud_itab__929, UD_TAB__OPC_MOD, "/mod" }, /* 930 */ { ud_itab__930, UD_TAB__OPC_MOD, "/mod" }, /* 931 */ { ud_itab__931, UD_TAB__OPC_MOD, "/mod" }, /* 932 */ { ud_itab__932, UD_TAB__OPC_MOD, "/mod" }, /* 933 */ { ud_itab__933, UD_TAB__OPC_MOD, "/mod" }, /* 934 */ { ud_itab__934, UD_TAB__OPC_MOD, "/mod" }, /* 935 */ { ud_itab__935, UD_TAB__OPC_MOD, "/mod" }, /* 936 */ { ud_itab__936, UD_TAB__OPC_MOD, "/mod" }, /* 937 */ { ud_itab__937, UD_TAB__OPC_MOD, "/mod" }, /* 938 */ { ud_itab__938, UD_TAB__OPC_MOD, "/mod" }, /* 939 */ { ud_itab__939, UD_TAB__OPC_MOD, "/mod" }, /* 940 */ { ud_itab__940, UD_TAB__OPC_MOD, "/mod" }, /* 941 */ { ud_itab__941, UD_TAB__OPC_REG, "/reg" }, /* 942 */ { ud_itab__942, UD_TAB__OPC_MOD, "/mod" }, /* 943 */ { ud_itab__943, UD_TAB__OPC_MOD, "/mod" }, /* 944 */ { ud_itab__944, UD_TAB__OPC_MOD, "/mod" }, /* 945 */ { ud_itab__945, UD_TAB__OPC_MOD, "/mod" }, /* 946 */ { ud_itab__946, UD_TAB__OPC_MOD, "/mod" }, /* 947 */ { ud_itab__947, UD_TAB__OPC_MOD, "/mod" }, /* 948 */ { ud_itab__948, UD_TAB__OPC_MOD, "/mod" }, /* 949 */ { ud_itab__949, UD_TAB__OPC_X87, "/x87" }, /* 950 */ { ud_itab__950, UD_TAB__OPC_MOD, "/mod" }, /* 951 */ { ud_itab__951, UD_TAB__OPC_MOD, "/mod" }, /* 952 */ { ud_itab__952, UD_TAB__OPC_MOD, "/mod" }, /* 953 */ { ud_itab__953, UD_TAB__OPC_MOD, "/mod" }, /* 954 */ { ud_itab__954, UD_TAB__OPC_MOD, "/mod" }, /* 955 */ { ud_itab__955, UD_TAB__OPC_MOD, "/mod" }, /* 956 */ { ud_itab__956, UD_TAB__OPC_MOD, "/mod" }, /* 957 */ { ud_itab__957, UD_TAB__OPC_MOD, "/mod" }, /* 958 */ { ud_itab__958, UD_TAB__OPC_MOD, "/mod" }, /* 959 */ { ud_itab__959, UD_TAB__OPC_MOD, "/mod" }, /* 960 */ { ud_itab__960, UD_TAB__OPC_MOD, "/mod" }, /* 961 */ { ud_itab__961, UD_TAB__OPC_MOD, "/mod" }, /* 962 */ { ud_itab__962, UD_TAB__OPC_MOD, "/mod" }, /* 963 */ { ud_itab__963, UD_TAB__OPC_MOD, "/mod" }, /* 964 */ { ud_itab__964, UD_TAB__OPC_MOD, "/mod" }, /* 965 */ { ud_itab__965, UD_TAB__OPC_MOD, "/mod" }, /* 966 */ { ud_itab__966, UD_TAB__OPC_MOD, "/mod" }, /* 967 */ { ud_itab__967, UD_TAB__OPC_MOD, "/mod" }, /* 968 */ { ud_itab__968, UD_TAB__OPC_MOD, "/mod" }, /* 969 */ { ud_itab__969, UD_TAB__OPC_MOD, "/mod" }, /* 970 */ { ud_itab__970, UD_TAB__OPC_MOD, "/mod" }, /* 971 */ { ud_itab__971, UD_TAB__OPC_MOD, "/mod" }, /* 972 */ { ud_itab__972, UD_TAB__OPC_MOD, "/mod" }, /* 973 */ { ud_itab__973, UD_TAB__OPC_MOD, "/mod" }, /* 974 */ { ud_itab__974, UD_TAB__OPC_MOD, "/mod" }, /* 975 */ { ud_itab__975, UD_TAB__OPC_MOD, "/mod" }, /* 976 */ { ud_itab__976, UD_TAB__OPC_MOD, "/mod" }, /* 977 */ { ud_itab__977, UD_TAB__OPC_MOD, "/mod" }, /* 978 */ { ud_itab__978, UD_TAB__OPC_MOD, "/mod" }, /* 979 */ { ud_itab__979, UD_TAB__OPC_MOD, "/mod" }, /* 980 */ { ud_itab__980, UD_TAB__OPC_MOD, "/mod" }, /* 981 */ { ud_itab__981, UD_TAB__OPC_MOD, "/mod" }, /* 982 */ { ud_itab__982, UD_TAB__OPC_MOD, "/mod" }, /* 983 */ { ud_itab__983, UD_TAB__OPC_MOD, "/mod" }, /* 984 */ { ud_itab__984, UD_TAB__OPC_MOD, "/mod" }, /* 985 */ { ud_itab__985, UD_TAB__OPC_MOD, "/mod" }, /* 986 */ { ud_itab__986, UD_TAB__OPC_MOD, "/mod" }, /* 987 */ { ud_itab__987, UD_TAB__OPC_MOD, "/mod" }, /* 988 */ { ud_itab__988, UD_TAB__OPC_MOD, "/mod" }, /* 989 */ { ud_itab__989, UD_TAB__OPC_MOD, "/mod" }, /* 990 */ { ud_itab__990, UD_TAB__OPC_MOD, "/mod" }, /* 991 */ { ud_itab__991, UD_TAB__OPC_MOD, "/mod" }, /* 992 */ { ud_itab__992, UD_TAB__OPC_MOD, "/mod" }, /* 993 */ { ud_itab__993, UD_TAB__OPC_MOD, "/mod" }, /* 994 */ { ud_itab__994, UD_TAB__OPC_MOD, "/mod" }, /* 995 */ { ud_itab__995, UD_TAB__OPC_MOD, "/mod" }, /* 996 */ { ud_itab__996, UD_TAB__OPC_MOD, "/mod" }, /* 997 */ { ud_itab__997, UD_TAB__OPC_MOD, "/mod" }, /* 998 */ { ud_itab__998, UD_TAB__OPC_MOD, "/mod" }, /* 999 */ { ud_itab__999, UD_TAB__OPC_REG, "/reg" }, /* 1000 */ { ud_itab__1000, UD_TAB__OPC_MOD, "/mod" }, /* 1001 */ { ud_itab__1001, UD_TAB__OPC_MOD, "/mod" }, /* 1002 */ { ud_itab__1002, UD_TAB__OPC_MOD, "/mod" }, /* 1003 */ { ud_itab__1003, UD_TAB__OPC_MOD, "/mod" }, /* 1004 */ { ud_itab__1004, UD_TAB__OPC_MOD, "/mod" }, /* 1005 */ { ud_itab__1005, UD_TAB__OPC_MOD, "/mod" }, /* 1006 */ { ud_itab__1006, UD_TAB__OPC_MOD, "/mod" }, /* 1007 */ { ud_itab__1007, UD_TAB__OPC_MOD, "/mod" }, /* 1008 */ { ud_itab__1008, UD_TAB__OPC_X87, "/x87" }, /* 1009 */ { ud_itab__1009, UD_TAB__OPC_MOD, "/mod" }, /* 1010 */ { ud_itab__1010, UD_TAB__OPC_MOD, "/mod" }, /* 1011 */ { ud_itab__1011, UD_TAB__OPC_MOD, "/mod" }, /* 1012 */ { ud_itab__1012, UD_TAB__OPC_MOD, "/mod" }, /* 1013 */ { ud_itab__1013, UD_TAB__OPC_MOD, "/mod" }, /* 1014 */ { ud_itab__1014, UD_TAB__OPC_MOD, "/mod" }, /* 1015 */ { ud_itab__1015, UD_TAB__OPC_MOD, "/mod" }, /* 1016 */ { ud_itab__1016, UD_TAB__OPC_MOD, "/mod" }, /* 1017 */ { ud_itab__1017, UD_TAB__OPC_MOD, "/mod" }, /* 1018 */ { ud_itab__1018, UD_TAB__OPC_MOD, "/mod" }, /* 1019 */ { ud_itab__1019, UD_TAB__OPC_MOD, "/mod" }, /* 1020 */ { ud_itab__1020, UD_TAB__OPC_MOD, "/mod" }, /* 1021 */ { ud_itab__1021, UD_TAB__OPC_MOD, "/mod" }, /* 1022 */ { ud_itab__1022, UD_TAB__OPC_MOD, "/mod" }, /* 1023 */ { ud_itab__1023, UD_TAB__OPC_MOD, "/mod" }, /* 1024 */ { ud_itab__1024, UD_TAB__OPC_MOD, "/mod" }, /* 1025 */ { ud_itab__1025, UD_TAB__OPC_MOD, "/mod" }, /* 1026 */ { ud_itab__1026, UD_TAB__OPC_MOD, "/mod" }, /* 1027 */ { ud_itab__1027, UD_TAB__OPC_MOD, "/mod" }, /* 1028 */ { ud_itab__1028, UD_TAB__OPC_MOD, "/mod" }, /* 1029 */ { ud_itab__1029, UD_TAB__OPC_MOD, "/mod" }, /* 1030 */ { ud_itab__1030, UD_TAB__OPC_MOD, "/mod" }, /* 1031 */ { ud_itab__1031, UD_TAB__OPC_MOD, "/mod" }, /* 1032 */ { ud_itab__1032, UD_TAB__OPC_MOD, "/mod" }, /* 1033 */ { ud_itab__1033, UD_TAB__OPC_MOD, "/mod" }, /* 1034 */ { ud_itab__1034, UD_TAB__OPC_MOD, "/mod" }, /* 1035 */ { ud_itab__1035, UD_TAB__OPC_MOD, "/mod" }, /* 1036 */ { ud_itab__1036, UD_TAB__OPC_MOD, "/mod" }, /* 1037 */ { ud_itab__1037, UD_TAB__OPC_MOD, "/mod" }, /* 1038 */ { ud_itab__1038, UD_TAB__OPC_MOD, "/mod" }, /* 1039 */ { ud_itab__1039, UD_TAB__OPC_MOD, "/mod" }, /* 1040 */ { ud_itab__1040, UD_TAB__OPC_MOD, "/mod" }, /* 1041 */ { ud_itab__1041, UD_TAB__OPC_MOD, "/mod" }, /* 1042 */ { ud_itab__1042, UD_TAB__OPC_MOD, "/mod" }, /* 1043 */ { ud_itab__1043, UD_TAB__OPC_MOD, "/mod" }, /* 1044 */ { ud_itab__1044, UD_TAB__OPC_MOD, "/mod" }, /* 1045 */ { ud_itab__1045, UD_TAB__OPC_MOD, "/mod" }, /* 1046 */ { ud_itab__1046, UD_TAB__OPC_MOD, "/mod" }, /* 1047 */ { ud_itab__1047, UD_TAB__OPC_MOD, "/mod" }, /* 1048 */ { ud_itab__1048, UD_TAB__OPC_MOD, "/mod" }, /* 1049 */ { ud_itab__1049, UD_TAB__OPC_MOD, "/mod" }, /* 1050 */ { ud_itab__1050, UD_TAB__OPC_MOD, "/mod" }, /* 1051 */ { ud_itab__1051, UD_TAB__OPC_MOD, "/mod" }, /* 1052 */ { ud_itab__1052, UD_TAB__OPC_MOD, "/mod" }, /* 1053 */ { ud_itab__1053, UD_TAB__OPC_MOD, "/mod" }, /* 1054 */ { ud_itab__1054, UD_TAB__OPC_MOD, "/mod" }, /* 1055 */ { ud_itab__1055, UD_TAB__OPC_MOD, "/mod" }, /* 1056 */ { ud_itab__1056, UD_TAB__OPC_MOD, "/mod" }, /* 1057 */ { ud_itab__1057, UD_TAB__OPC_MOD, "/mod" }, /* 1058 */ { ud_itab__1058, UD_TAB__OPC_MOD, "/mod" }, /* 1059 */ { ud_itab__1059, UD_TAB__OPC_MOD, "/mod" }, /* 1060 */ { ud_itab__1060, UD_TAB__OPC_MOD, "/mod" }, /* 1061 */ { ud_itab__1061, UD_TAB__OPC_MOD, "/mod" }, /* 1062 */ { ud_itab__1062, UD_TAB__OPC_MOD, "/mod" }, /* 1063 */ { ud_itab__1063, UD_TAB__OPC_MOD, "/mod" }, /* 1064 */ { ud_itab__1064, UD_TAB__OPC_MOD, "/mod" }, /* 1065 */ { ud_itab__1065, UD_TAB__OPC_MOD, "/mod" }, /* 1066 */ { ud_itab__1066, UD_TAB__OPC_MOD, "/mod" }, /* 1067 */ { ud_itab__1067, UD_TAB__OPC_REG, "/reg" }, /* 1068 */ { ud_itab__1068, UD_TAB__OPC_MOD, "/mod" }, /* 1069 */ { ud_itab__1069, UD_TAB__OPC_MOD, "/mod" }, /* 1070 */ { ud_itab__1070, UD_TAB__OPC_MOD, "/mod" }, /* 1071 */ { ud_itab__1071, UD_TAB__OPC_MOD, "/mod" }, /* 1072 */ { ud_itab__1072, UD_TAB__OPC_MOD, "/mod" }, /* 1073 */ { ud_itab__1073, UD_TAB__OPC_MOD, "/mod" }, /* 1074 */ { ud_itab__1074, UD_TAB__OPC_MOD, "/mod" }, /* 1075 */ { ud_itab__1075, UD_TAB__OPC_MOD, "/mod" }, /* 1076 */ { ud_itab__1076, UD_TAB__OPC_X87, "/x87" }, /* 1077 */ { ud_itab__1077, UD_TAB__OPC_MOD, "/mod" }, /* 1078 */ { ud_itab__1078, UD_TAB__OPC_MOD, "/mod" }, /* 1079 */ { ud_itab__1079, UD_TAB__OPC_MOD, "/mod" }, /* 1080 */ { ud_itab__1080, UD_TAB__OPC_MOD, "/mod" }, /* 1081 */ { ud_itab__1081, UD_TAB__OPC_MOD, "/mod" }, /* 1082 */ { ud_itab__1082, UD_TAB__OPC_MOD, "/mod" }, /* 1083 */ { ud_itab__1083, UD_TAB__OPC_MOD, "/mod" }, /* 1084 */ { ud_itab__1084, UD_TAB__OPC_MOD, "/mod" }, /* 1085 */ { ud_itab__1085, UD_TAB__OPC_MOD, "/mod" }, /* 1086 */ { ud_itab__1086, UD_TAB__OPC_MOD, "/mod" }, /* 1087 */ { ud_itab__1087, UD_TAB__OPC_MOD, "/mod" }, /* 1088 */ { ud_itab__1088, UD_TAB__OPC_MOD, "/mod" }, /* 1089 */ { ud_itab__1089, UD_TAB__OPC_MOD, "/mod" }, /* 1090 */ { ud_itab__1090, UD_TAB__OPC_MOD, "/mod" }, /* 1091 */ { ud_itab__1091, UD_TAB__OPC_MOD, "/mod" }, /* 1092 */ { ud_itab__1092, UD_TAB__OPC_MOD, "/mod" }, /* 1093 */ { ud_itab__1093, UD_TAB__OPC_MOD, "/mod" }, /* 1094 */ { ud_itab__1094, UD_TAB__OPC_MOD, "/mod" }, /* 1095 */ { ud_itab__1095, UD_TAB__OPC_MOD, "/mod" }, /* 1096 */ { ud_itab__1096, UD_TAB__OPC_MOD, "/mod" }, /* 1097 */ { ud_itab__1097, UD_TAB__OPC_MOD, "/mod" }, /* 1098 */ { ud_itab__1098, UD_TAB__OPC_MOD, "/mod" }, /* 1099 */ { ud_itab__1099, UD_TAB__OPC_MOD, "/mod" }, /* 1100 */ { ud_itab__1100, UD_TAB__OPC_MOD, "/mod" }, /* 1101 */ { ud_itab__1101, UD_TAB__OPC_MOD, "/mod" }, /* 1102 */ { ud_itab__1102, UD_TAB__OPC_MOD, "/mod" }, /* 1103 */ { ud_itab__1103, UD_TAB__OPC_MOD, "/mod" }, /* 1104 */ { ud_itab__1104, UD_TAB__OPC_MOD, "/mod" }, /* 1105 */ { ud_itab__1105, UD_TAB__OPC_MOD, "/mod" }, /* 1106 */ { ud_itab__1106, UD_TAB__OPC_MOD, "/mod" }, /* 1107 */ { ud_itab__1107, UD_TAB__OPC_MOD, "/mod" }, /* 1108 */ { ud_itab__1108, UD_TAB__OPC_MOD, "/mod" }, /* 1109 */ { ud_itab__1109, UD_TAB__OPC_MOD, "/mod" }, /* 1110 */ { ud_itab__1110, UD_TAB__OPC_MOD, "/mod" }, /* 1111 */ { ud_itab__1111, UD_TAB__OPC_MOD, "/mod" }, /* 1112 */ { ud_itab__1112, UD_TAB__OPC_MOD, "/mod" }, /* 1113 */ { ud_itab__1113, UD_TAB__OPC_MOD, "/mod" }, /* 1114 */ { ud_itab__1114, UD_TAB__OPC_MOD, "/mod" }, /* 1115 */ { ud_itab__1115, UD_TAB__OPC_MOD, "/mod" }, /* 1116 */ { ud_itab__1116, UD_TAB__OPC_MOD, "/mod" }, /* 1117 */ { ud_itab__1117, UD_TAB__OPC_MOD, "/mod" }, /* 1118 */ { ud_itab__1118, UD_TAB__OPC_MOD, "/mod" }, /* 1119 */ { ud_itab__1119, UD_TAB__OPC_MOD, "/mod" }, /* 1120 */ { ud_itab__1120, UD_TAB__OPC_MOD, "/mod" }, /* 1121 */ { ud_itab__1121, UD_TAB__OPC_MOD, "/mod" }, /* 1122 */ { ud_itab__1122, UD_TAB__OPC_MOD, "/mod" }, /* 1123 */ { ud_itab__1123, UD_TAB__OPC_MOD, "/mod" }, /* 1124 */ { ud_itab__1124, UD_TAB__OPC_MOD, "/mod" }, /* 1125 */ { ud_itab__1125, UD_TAB__OPC_MOD, "/mod" }, /* 1126 */ { ud_itab__1126, UD_TAB__OPC_ASIZE, "/a" }, /* 1127 */ { ud_itab__1127, UD_TAB__OPC_MODE, "/m" }, /* 1128 */ { ud_itab__1128, UD_TAB__OPC_REG, "/reg" }, /* 1129 */ { ud_itab__1129, UD_TAB__OPC_REG, "/reg" }, /* 1130 */ { ud_itab__1130, UD_TAB__OPC_REG, "/reg" }, /* 1131 */ { ud_itab__1131, UD_TAB__OPC_REG, "/reg" }, /* 1132 */ { ud_itab__1132, UD_TAB__OPC_MODE, "/m" }, }; /* itab entry operand definitions (for readability) */ #define O_AL { OP_AL, SZ_B } #define O_AX { OP_AX, SZ_W } #define O_Av { OP_A, SZ_V } #define O_C { OP_C, SZ_NA } #define O_CL { OP_CL, SZ_B } #define O_CS { OP_CS, SZ_NA } #define O_CX { OP_CX, SZ_W } #define O_D { OP_D, SZ_NA } #define O_DL { OP_DL, SZ_B } #define O_DS { OP_DS, SZ_NA } #define O_DX { OP_DX, SZ_W } #define O_E { OP_E, SZ_NA } #define O_ES { OP_ES, SZ_NA } #define O_Eb { OP_E, SZ_B } #define O_Ed { OP_E, SZ_D } #define O_Eq { OP_E, SZ_Q } #define O_Ev { OP_E, SZ_V } #define O_Ew { OP_E, SZ_W } #define O_Ey { OP_E, SZ_Y } #define O_Ez { OP_E, SZ_Z } #define O_FS { OP_FS, SZ_NA } #define O_Fv { OP_F, SZ_V } #define O_G { OP_G, SZ_NA } #define O_GS { OP_GS, SZ_NA } #define O_Gb { OP_G, SZ_B } #define O_Gd { OP_G, SZ_D } #define O_Gq { OP_G, SZ_Q } #define O_Gv { OP_G, SZ_V } #define O_Gw { OP_G, SZ_W } #define O_Gy { OP_G, SZ_Y } #define O_Gz { OP_G, SZ_Z } #define O_I1 { OP_I1, SZ_NA } #define O_I3 { OP_I3, SZ_NA } #define O_Ib { OP_I, SZ_B } #define O_Iv { OP_I, SZ_V } #define O_Iw { OP_I, SZ_W } #define O_Iz { OP_I, SZ_Z } #define O_Jb { OP_J, SZ_B } #define O_Jv { OP_J, SZ_V } #define O_Jz { OP_J, SZ_Z } #define O_M { OP_M, SZ_NA } #define O_Mb { OP_M, SZ_B } #define O_MbRd { OP_MR, SZ_BD } #define O_MbRv { OP_MR, SZ_BV } #define O_Md { OP_M, SZ_D } #define O_MdRy { OP_MR, SZ_DY } #define O_MdU { OP_MU, SZ_DO } #define O_Mo { OP_M, SZ_O } #define O_Mq { OP_M, SZ_Q } #define O_MqU { OP_MU, SZ_QO } #define O_Ms { OP_M, SZ_W } #define O_Mt { OP_M, SZ_T } #define O_Mv { OP_M, SZ_V } #define O_Mw { OP_M, SZ_W } #define O_MwRd { OP_MR, SZ_WD } #define O_MwRv { OP_MR, SZ_WV } #define O_MwRy { OP_MR, SZ_WY } #define O_MwU { OP_MU, SZ_WO } #define O_N { OP_N, SZ_Q } #define O_NONE { OP_NONE, SZ_NA } #define O_Ob { OP_O, SZ_B } #define O_Ov { OP_O, SZ_V } #define O_Ow { OP_O, SZ_W } #define O_P { OP_P, SZ_Q } #define O_Q { OP_Q, SZ_Q } #define O_R { OP_R, SZ_RDQ } #define O_R0b { OP_R0, SZ_B } #define O_R0v { OP_R0, SZ_V } #define O_R0w { OP_R0, SZ_W } #define O_R0y { OP_R0, SZ_Y } #define O_R0z { OP_R0, SZ_Z } #define O_R1b { OP_R1, SZ_B } #define O_R1v { OP_R1, SZ_V } #define O_R1w { OP_R1, SZ_W } #define O_R1y { OP_R1, SZ_Y } #define O_R1z { OP_R1, SZ_Z } #define O_R2b { OP_R2, SZ_B } #define O_R2v { OP_R2, SZ_V } #define O_R2w { OP_R2, SZ_W } #define O_R2y { OP_R2, SZ_Y } #define O_R2z { OP_R2, SZ_Z } #define O_R3b { OP_R3, SZ_B } #define O_R3v { OP_R3, SZ_V } #define O_R3w { OP_R3, SZ_W } #define O_R3y { OP_R3, SZ_Y } #define O_R3z { OP_R3, SZ_Z } #define O_R4b { OP_R4, SZ_B } #define O_R4v { OP_R4, SZ_V } #define O_R4w { OP_R4, SZ_W } #define O_R4y { OP_R4, SZ_Y } #define O_R4z { OP_R4, SZ_Z } #define O_R5b { OP_R5, SZ_B } #define O_R5v { OP_R5, SZ_V } #define O_R5w { OP_R5, SZ_W } #define O_R5y { OP_R5, SZ_Y } #define O_R5z { OP_R5, SZ_Z } #define O_R6b { OP_R6, SZ_B } #define O_R6v { OP_R6, SZ_V } #define O_R6w { OP_R6, SZ_W } #define O_R6y { OP_R6, SZ_Y } #define O_R6z { OP_R6, SZ_Z } #define O_R7b { OP_R7, SZ_B } #define O_R7v { OP_R7, SZ_V } #define O_R7w { OP_R7, SZ_W } #define O_R7y { OP_R7, SZ_Y } #define O_R7z { OP_R7, SZ_Z } #define O_S { OP_S, SZ_NA } #define O_SS { OP_SS, SZ_NA } #define O_ST0 { OP_ST0, SZ_NA } #define O_ST1 { OP_ST1, SZ_NA } #define O_ST2 { OP_ST2, SZ_NA } #define O_ST3 { OP_ST3, SZ_NA } #define O_ST4 { OP_ST4, SZ_NA } #define O_ST5 { OP_ST5, SZ_NA } #define O_ST6 { OP_ST6, SZ_NA } #define O_ST7 { OP_ST7, SZ_NA } #define O_U { OP_U, SZ_O } #define O_V { OP_V, SZ_O } #define O_W { OP_W, SZ_O } #define O_eAX { OP_eAX, SZ_Z } #define O_eCX { OP_eCX, SZ_Z } #define O_eDX { OP_eDX, SZ_Z } #define O_rAX { OP_rAX, SZ_V } #define O_rCX { OP_rCX, SZ_V } #define O_rDX { OP_rDX, SZ_V } #define O_sIb { OP_sI, SZ_B } #define O_sIv { OP_sI, SZ_V } #define O_sIz { OP_sI, SZ_Z } struct ud_itab_entry ud_itab[] = { /* 0000 */ { UD_Iinvalid, O_NONE, O_NONE, O_NONE, P_none }, /* 0001 */ { UD_Iadd, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0002 */ { UD_Iadd, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0003 */ { UD_Iadd, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0004 */ { UD_Iadd, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0005 */ { UD_Iadd, O_AL, O_Ib, O_NONE, P_none }, /* 0006 */ { UD_Iadd, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0007 */ { UD_Ipush, O_ES, O_NONE, O_NONE, P_inv64 }, /* 0008 */ { UD_Ipop, O_ES, O_NONE, O_NONE, P_inv64 }, /* 0009 */ { UD_Ior, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0010 */ { UD_Ior, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0011 */ { UD_Ior, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0012 */ { UD_Ior, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0013 */ { UD_Ior, O_AL, O_Ib, O_NONE, P_none }, /* 0014 */ { UD_Ior, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0015 */ { UD_Ipush, O_CS, O_NONE, O_NONE, P_inv64 }, /* 0016 */ { UD_Isldt, O_MwRv, O_NONE, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0017 */ { UD_Istr, O_MwRv, O_NONE, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0018 */ { UD_Illdt, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0019 */ { UD_Iltr, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0020 */ { UD_Iverr, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0021 */ { UD_Iverw, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0022 */ { UD_Isgdt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0023 */ { UD_Isidt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0024 */ { UD_Ilgdt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0025 */ { UD_Ilidt, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0026 */ { UD_Ismsw, O_MwRv, O_NONE, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0027 */ { UD_Ilmsw, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0028 */ { UD_Iinvlpg, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0029 */ { UD_Ivmcall, O_NONE, O_NONE, O_NONE, P_none }, /* 0030 */ { UD_Ivmlaunch, O_NONE, O_NONE, O_NONE, P_none }, /* 0031 */ { UD_Ivmresume, O_NONE, O_NONE, O_NONE, P_none }, /* 0032 */ { UD_Ivmxoff, O_NONE, O_NONE, O_NONE, P_none }, /* 0033 */ { UD_Imonitor, O_NONE, O_NONE, O_NONE, P_none }, /* 0034 */ { UD_Imwait, O_NONE, O_NONE, O_NONE, P_none }, /* 0035 */ { UD_Ixgetbv, O_NONE, O_NONE, O_NONE, P_none }, /* 0036 */ { UD_Ixsetbv, O_NONE, O_NONE, O_NONE, P_none }, /* 0037 */ { UD_Ivmrun, O_NONE, O_NONE, O_NONE, P_none }, /* 0038 */ { UD_Ivmmcall, O_NONE, O_NONE, O_NONE, P_none }, /* 0039 */ { UD_Ivmload, O_NONE, O_NONE, O_NONE, P_none }, /* 0040 */ { UD_Ivmsave, O_NONE, O_NONE, O_NONE, P_none }, /* 0041 */ { UD_Istgi, O_NONE, O_NONE, O_NONE, P_none }, /* 0042 */ { UD_Iclgi, O_NONE, O_NONE, O_NONE, P_none }, /* 0043 */ { UD_Iskinit, O_NONE, O_NONE, O_NONE, P_none }, /* 0044 */ { UD_Iinvlpga, O_NONE, O_NONE, O_NONE, P_none }, /* 0045 */ { UD_Ismsw, O_MwRv, O_NONE, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0046 */ { UD_Ilmsw, O_Ew, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0047 */ { UD_Iswapgs, O_NONE, O_NONE, O_NONE, P_none }, /* 0048 */ { UD_Irdtscp, O_NONE, O_NONE, O_NONE, P_none }, /* 0049 */ { UD_Ilar, O_Gv, O_Ew, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0050 */ { UD_Ilsl, O_Gv, O_Ew, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0051 */ { UD_Isyscall, O_NONE, O_NONE, O_NONE, P_none }, /* 0052 */ { UD_Iclts, O_NONE, O_NONE, O_NONE, P_none }, /* 0053 */ { UD_Isysret, O_NONE, O_NONE, O_NONE, P_none }, /* 0054 */ { UD_Iinvd, O_NONE, O_NONE, O_NONE, P_none }, /* 0055 */ { UD_Iwbinvd, O_NONE, O_NONE, O_NONE, P_none }, /* 0056 */ { UD_Iud2, O_NONE, O_NONE, O_NONE, P_none }, /* 0057 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0058 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0059 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0060 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0061 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0062 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0063 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0064 */ { UD_Iprefetch, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0065 */ { UD_Ifemms, O_NONE, O_NONE, O_NONE, P_none }, /* 0066 */ { UD_Ipi2fw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0067 */ { UD_Ipi2fd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0068 */ { UD_Ipf2iw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0069 */ { UD_Ipf2id, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0070 */ { UD_Ipfnacc, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0071 */ { UD_Ipfpnacc, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0072 */ { UD_Ipfcmpge, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0073 */ { UD_Ipfmin, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0074 */ { UD_Ipfrcp, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0075 */ { UD_Ipfrsqrt, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0076 */ { UD_Ipfsub, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0077 */ { UD_Ipfadd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0078 */ { UD_Ipfcmpgt, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0079 */ { UD_Ipfmax, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0080 */ { UD_Ipfrcpit1, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0081 */ { UD_Ipfrsqit1, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0082 */ { UD_Ipfsubr, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0083 */ { UD_Ipfacc, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0084 */ { UD_Ipfcmpeq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0085 */ { UD_Ipfmul, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0086 */ { UD_Ipfrcpit2, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0087 */ { UD_Ipmulhrw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0088 */ { UD_Ipswapd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0089 */ { UD_Ipavgusb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0090 */ { UD_Imovups, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0091 */ { UD_Imovsd, O_V, O_W, O_NONE, P_str|P_aso|P_rexr|P_rexx|P_rexb }, /* 0092 */ { UD_Imovss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0093 */ { UD_Imovupd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0094 */ { UD_Imovups, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0095 */ { UD_Imovsd, O_W, O_V, O_NONE, P_str|P_aso|P_rexr|P_rexx|P_rexb }, /* 0096 */ { UD_Imovss, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0097 */ { UD_Imovupd, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0098 */ { UD_Imovlps, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0099 */ { UD_Imovddup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0100 */ { UD_Imovsldup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0101 */ { UD_Imovlpd, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0102 */ { UD_Imovhlps, O_V, O_U, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0103 */ { UD_Imovddup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0104 */ { UD_Imovsldup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0105 */ { UD_Imovlps, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0106 */ { UD_Imovlpd, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0107 */ { UD_Iunpcklps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0108 */ { UD_Iunpcklpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0109 */ { UD_Iunpckhps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0110 */ { UD_Iunpckhpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0111 */ { UD_Imovhps, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0112 */ { UD_Imovshdup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0113 */ { UD_Imovhpd, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0114 */ { UD_Imovlhps, O_V, O_U, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0115 */ { UD_Imovshdup, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0116 */ { UD_Imovhps, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0117 */ { UD_Imovhpd, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0118 */ { UD_Iprefetchnta, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0119 */ { UD_Iprefetcht0, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0120 */ { UD_Iprefetcht1, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0121 */ { UD_Iprefetcht2, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0122 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0123 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0124 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0125 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0126 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0127 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0128 */ { UD_Inop, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0129 */ { UD_Imov, O_R, O_C, O_NONE, P_rexr|P_rexw|P_rexb }, /* 0130 */ { UD_Imov, O_R, O_D, O_NONE, P_rexr|P_rexw|P_rexb }, /* 0131 */ { UD_Imov, O_C, O_R, O_NONE, P_rexr|P_rexw|P_rexb }, /* 0132 */ { UD_Imov, O_D, O_R, O_NONE, P_rexr|P_rexw|P_rexb }, /* 0133 */ { UD_Imovaps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0134 */ { UD_Imovapd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0135 */ { UD_Imovaps, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0136 */ { UD_Imovapd, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0137 */ { UD_Icvtpi2ps, O_V, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0138 */ { UD_Icvtsi2sd, O_V, O_Ey, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0139 */ { UD_Icvtsi2ss, O_V, O_Ey, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0140 */ { UD_Icvtpi2pd, O_V, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0141 */ { UD_Imovntps, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0142 */ { UD_Imovntpd, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0143 */ { UD_Icvttps2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0144 */ { UD_Icvttsd2si, O_Gy, O_W, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0145 */ { UD_Icvttss2si, O_Gy, O_W, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0146 */ { UD_Icvttpd2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0147 */ { UD_Icvtps2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0148 */ { UD_Icvtsd2si, O_Gy, O_W, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0149 */ { UD_Icvtss2si, O_Gy, O_W, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0150 */ { UD_Icvtpd2pi, O_P, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0151 */ { UD_Iucomiss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0152 */ { UD_Iucomisd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0153 */ { UD_Icomiss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0154 */ { UD_Icomisd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0155 */ { UD_Iwrmsr, O_NONE, O_NONE, O_NONE, P_none }, /* 0156 */ { UD_Irdtsc, O_NONE, O_NONE, O_NONE, P_none }, /* 0157 */ { UD_Irdmsr, O_NONE, O_NONE, O_NONE, P_none }, /* 0158 */ { UD_Irdpmc, O_NONE, O_NONE, O_NONE, P_none }, /* 0159 */ { UD_Isysenter, O_NONE, O_NONE, O_NONE, P_none }, /* 0160 */ { UD_Isysenter, O_NONE, O_NONE, O_NONE, P_none }, /* 0161 */ { UD_Isysexit, O_NONE, O_NONE, O_NONE, P_none }, /* 0162 */ { UD_Isysexit, O_NONE, O_NONE, O_NONE, P_none }, /* 0163 */ { UD_Igetsec, O_NONE, O_NONE, O_NONE, P_none }, /* 0164 */ { UD_Ipshufb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0165 */ { UD_Ipshufb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0166 */ { UD_Iphaddw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0167 */ { UD_Iphaddw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0168 */ { UD_Iphaddd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0169 */ { UD_Iphaddd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0170 */ { UD_Iphaddsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0171 */ { UD_Iphaddsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0172 */ { UD_Ipmaddubsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0173 */ { UD_Ipmaddubsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0174 */ { UD_Iphsubw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0175 */ { UD_Iphsubw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0176 */ { UD_Iphsubd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0177 */ { UD_Iphsubd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0178 */ { UD_Iphsubsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0179 */ { UD_Iphsubsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0180 */ { UD_Ipsignb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0181 */ { UD_Ipsignb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0182 */ { UD_Ipsignw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0183 */ { UD_Ipsignw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0184 */ { UD_Ipsignd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0185 */ { UD_Ipsignd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0186 */ { UD_Ipmulhrsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0187 */ { UD_Ipmulhrsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0188 */ { UD_Ipblendvb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0189 */ { UD_Iblendvps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0190 */ { UD_Iblendvpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0191 */ { UD_Iptest, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0192 */ { UD_Ipabsb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0193 */ { UD_Ipabsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0194 */ { UD_Ipabsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0195 */ { UD_Ipabsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0196 */ { UD_Ipabsd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0197 */ { UD_Ipabsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0198 */ { UD_Ipmovsxbw, O_V, O_MqU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0199 */ { UD_Ipmovsxbd, O_V, O_MdU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0200 */ { UD_Ipmovsxbq, O_V, O_MwU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0201 */ { UD_Ipmovsxwd, O_V, O_MqU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0202 */ { UD_Ipmovsxwq, O_V, O_MdU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0203 */ { UD_Ipmovsxdq, O_V, O_MqU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0204 */ { UD_Ipmuldq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0205 */ { UD_Ipcmpeqq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0206 */ { UD_Imovntdqa, O_V, O_Mo, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0207 */ { UD_Ipackusdw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0208 */ { UD_Ipmovzxbw, O_V, O_MqU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0209 */ { UD_Ipmovzxbd, O_V, O_MdU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0210 */ { UD_Ipmovzxbq, O_V, O_MwU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0211 */ { UD_Ipmovzxwd, O_V, O_MqU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0212 */ { UD_Ipmovzxwq, O_V, O_MdU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0213 */ { UD_Ipmovzxdq, O_V, O_MqU, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0214 */ { UD_Ipcmpgtq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0215 */ { UD_Ipminsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0216 */ { UD_Ipminsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0217 */ { UD_Ipminuw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0218 */ { UD_Ipminud, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0219 */ { UD_Ipmaxsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0220 */ { UD_Ipmaxsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0221 */ { UD_Ipmaxuw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0222 */ { UD_Ipmaxud, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0223 */ { UD_Ipmulld, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0224 */ { UD_Iphminposuw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0225 */ { UD_Iinvept, O_Gq, O_Mo, O_NONE, P_none }, /* 0226 */ { UD_Iinvvpid, O_Gq, O_Mo, O_NONE, P_none }, /* 0227 */ { UD_Iaesimc, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0228 */ { UD_Iaesenc, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0229 */ { UD_Iaesenclast, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0230 */ { UD_Iaesdec, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0231 */ { UD_Iaesdeclast, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0232 */ { UD_Imovbe, O_Gv, O_Mv, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0233 */ { UD_Icrc32, O_Gy, O_Eb, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0234 */ { UD_Imovbe, O_Mv, O_Gv, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0235 */ { UD_Icrc32, O_Gy, O_Ev, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0236 */ { UD_Iroundps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0237 */ { UD_Iroundpd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0238 */ { UD_Iroundss, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0239 */ { UD_Iroundsd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0240 */ { UD_Iblendps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0241 */ { UD_Iblendpd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0242 */ { UD_Ipblendw, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0243 */ { UD_Ipalignr, O_P, O_Q, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0244 */ { UD_Ipalignr, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0245 */ { UD_Ipextrb, O_MbRv, O_V, O_Ib, P_aso|P_rexx|P_rexr|P_rexb|P_def64 }, /* 0246 */ { UD_Ipextrw, O_MwRd, O_V, O_Ib, P_aso|P_rexx|P_rexr|P_rexb }, /* 0247 */ { UD_Ipextrd, O_Ed, O_V, O_Ib, P_aso|P_rexr|P_rexx|P_rexw|P_rexb }, /* 0248 */ { UD_Ipextrd, O_Ed, O_V, O_Ib, P_aso|P_rexr|P_rexx|P_rexw|P_rexb }, /* 0249 */ { UD_Ipextrq, O_Eq, O_V, O_Ib, P_aso|P_rexr|P_rexw|P_rexb|P_def64 }, /* 0250 */ { UD_Iextractps, O_MdRy, O_V, O_Ib, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0251 */ { UD_Ipinsrb, O_V, O_MbRd, O_Ib, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0252 */ { UD_Iinsertps, O_V, O_Md, O_Ib, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0253 */ { UD_Ipinsrd, O_V, O_Ed, O_Ib, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0254 */ { UD_Ipinsrd, O_V, O_Ed, O_Ib, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0255 */ { UD_Ipinsrq, O_V, O_Eq, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0256 */ { UD_Idpps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0257 */ { UD_Idppd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0258 */ { UD_Impsadbw, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0259 */ { UD_Ipclmulqdq, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0260 */ { UD_Ipcmpestrm, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0261 */ { UD_Ipcmpestri, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0262 */ { UD_Ipcmpistrm, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0263 */ { UD_Ipcmpistri, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0264 */ { UD_Iaeskeygenassist, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0265 */ { UD_Icmovo, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0266 */ { UD_Icmovno, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0267 */ { UD_Icmovb, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0268 */ { UD_Icmovae, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0269 */ { UD_Icmovz, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0270 */ { UD_Icmovnz, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0271 */ { UD_Icmovbe, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0272 */ { UD_Icmova, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0273 */ { UD_Icmovs, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0274 */ { UD_Icmovns, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0275 */ { UD_Icmovp, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0276 */ { UD_Icmovnp, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0277 */ { UD_Icmovl, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0278 */ { UD_Icmovge, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0279 */ { UD_Icmovle, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0280 */ { UD_Icmovg, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0281 */ { UD_Imovmskps, O_Gd, O_U, O_NONE, P_oso|P_rexr|P_rexb }, /* 0282 */ { UD_Imovmskpd, O_Gd, O_U, O_NONE, P_oso|P_rexr|P_rexb }, /* 0283 */ { UD_Isqrtps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0284 */ { UD_Isqrtsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0285 */ { UD_Isqrtss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0286 */ { UD_Isqrtpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0287 */ { UD_Irsqrtps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0288 */ { UD_Irsqrtss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0289 */ { UD_Ircpps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0290 */ { UD_Ircpss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0291 */ { UD_Iandps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0292 */ { UD_Iandpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0293 */ { UD_Iandnps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0294 */ { UD_Iandnpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0295 */ { UD_Iorps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0296 */ { UD_Iorpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0297 */ { UD_Ixorps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0298 */ { UD_Ixorpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0299 */ { UD_Iaddps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0300 */ { UD_Iaddsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0301 */ { UD_Iaddss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0302 */ { UD_Iaddpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0303 */ { UD_Imulps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0304 */ { UD_Imulsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0305 */ { UD_Imulss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0306 */ { UD_Imulpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0307 */ { UD_Icvtps2pd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0308 */ { UD_Icvtsd2ss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0309 */ { UD_Icvtss2sd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0310 */ { UD_Icvtpd2ps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0311 */ { UD_Icvtdq2ps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0312 */ { UD_Icvttps2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0313 */ { UD_Icvtps2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0314 */ { UD_Isubps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0315 */ { UD_Isubsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0316 */ { UD_Isubss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0317 */ { UD_Isubpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0318 */ { UD_Iminps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0319 */ { UD_Iminsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0320 */ { UD_Iminss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0321 */ { UD_Iminpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0322 */ { UD_Idivps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0323 */ { UD_Idivsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0324 */ { UD_Idivss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0325 */ { UD_Idivpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0326 */ { UD_Imaxps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0327 */ { UD_Imaxsd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0328 */ { UD_Imaxss, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0329 */ { UD_Imaxpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0330 */ { UD_Ipunpcklbw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0331 */ { UD_Ipunpcklbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0332 */ { UD_Ipunpcklwd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0333 */ { UD_Ipunpcklwd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0334 */ { UD_Ipunpckldq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0335 */ { UD_Ipunpckldq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0336 */ { UD_Ipacksswb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0337 */ { UD_Ipacksswb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0338 */ { UD_Ipcmpgtb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0339 */ { UD_Ipcmpgtb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0340 */ { UD_Ipcmpgtw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0341 */ { UD_Ipcmpgtw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0342 */ { UD_Ipcmpgtd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0343 */ { UD_Ipcmpgtd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0344 */ { UD_Ipackuswb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0345 */ { UD_Ipackuswb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0346 */ { UD_Ipunpckhbw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0347 */ { UD_Ipunpckhbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0348 */ { UD_Ipunpckhwd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0349 */ { UD_Ipunpckhwd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0350 */ { UD_Ipunpckhdq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0351 */ { UD_Ipunpckhdq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0352 */ { UD_Ipackssdw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0353 */ { UD_Ipackssdw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0354 */ { UD_Ipunpcklqdq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0355 */ { UD_Ipunpckhqdq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0356 */ { UD_Imovd, O_P, O_Ey, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0357 */ { UD_Imovd, O_V, O_Ey, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0358 */ { UD_Imovq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0359 */ { UD_Imovdqu, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0360 */ { UD_Imovdqa, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0361 */ { UD_Ipshufw, O_P, O_Q, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0362 */ { UD_Ipshuflw, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0363 */ { UD_Ipshufhw, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0364 */ { UD_Ipshufd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0365 */ { UD_Ipsrlw, O_N, O_Ib, O_NONE, P_none }, /* 0366 */ { UD_Ipsrlw, O_U, O_Ib, O_NONE, P_rexb }, /* 0367 */ { UD_Ipsraw, O_N, O_Ib, O_NONE, P_none }, /* 0368 */ { UD_Ipsraw, O_U, O_Ib, O_NONE, P_rexb }, /* 0369 */ { UD_Ipsllw, O_N, O_Ib, O_NONE, P_none }, /* 0370 */ { UD_Ipsllw, O_U, O_Ib, O_NONE, P_rexb }, /* 0371 */ { UD_Ipsrld, O_N, O_Ib, O_NONE, P_none }, /* 0372 */ { UD_Ipsrld, O_U, O_Ib, O_NONE, P_rexb }, /* 0373 */ { UD_Ipsrad, O_N, O_Ib, O_NONE, P_none }, /* 0374 */ { UD_Ipsrad, O_U, O_Ib, O_NONE, P_rexb }, /* 0375 */ { UD_Ipslld, O_N, O_Ib, O_NONE, P_none }, /* 0376 */ { UD_Ipslld, O_U, O_Ib, O_NONE, P_rexb }, /* 0377 */ { UD_Ipsrlq, O_N, O_Ib, O_NONE, P_none }, /* 0378 */ { UD_Ipsrlq, O_U, O_Ib, O_NONE, P_rexb }, /* 0379 */ { UD_Ipsrldq, O_U, O_Ib, O_NONE, P_rexb }, /* 0380 */ { UD_Ipsllq, O_N, O_Ib, O_NONE, P_none }, /* 0381 */ { UD_Ipsllq, O_U, O_Ib, O_NONE, P_rexb }, /* 0382 */ { UD_Ipslldq, O_U, O_Ib, O_NONE, P_rexb }, /* 0383 */ { UD_Ipcmpeqb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0384 */ { UD_Ipcmpeqb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0385 */ { UD_Ipcmpeqw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0386 */ { UD_Ipcmpeqw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0387 */ { UD_Ipcmpeqd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0388 */ { UD_Ipcmpeqd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0389 */ { UD_Iemms, O_NONE, O_NONE, O_NONE, P_none }, /* 0390 */ { UD_Ivmread, O_Ey, O_Gy, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_def64 }, /* 0391 */ { UD_Ivmwrite, O_Gy, O_Ey, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_def64 }, /* 0392 */ { UD_Ihaddps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0393 */ { UD_Ihaddpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0394 */ { UD_Ihsubps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0395 */ { UD_Ihsubpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0396 */ { UD_Imovd, O_Ey, O_P, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0397 */ { UD_Imovq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0398 */ { UD_Imovd, O_Ey, O_V, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0399 */ { UD_Imovq, O_Q, O_P, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0400 */ { UD_Imovdqu, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0401 */ { UD_Imovdqa, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0402 */ { UD_Ijo, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0403 */ { UD_Ijno, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0404 */ { UD_Ijb, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0405 */ { UD_Ijae, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0406 */ { UD_Ijz, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0407 */ { UD_Ijnz, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0408 */ { UD_Ijbe, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0409 */ { UD_Ija, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0410 */ { UD_Ijs, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0411 */ { UD_Ijns, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0412 */ { UD_Ijp, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0413 */ { UD_Ijnp, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0414 */ { UD_Ijl, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0415 */ { UD_Ijge, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0416 */ { UD_Ijle, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0417 */ { UD_Ijg, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0418 */ { UD_Iseto, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0419 */ { UD_Isetno, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0420 */ { UD_Isetb, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0421 */ { UD_Isetae, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0422 */ { UD_Isetz, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0423 */ { UD_Isetnz, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0424 */ { UD_Isetbe, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0425 */ { UD_Iseta, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0426 */ { UD_Isets, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0427 */ { UD_Isetns, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0428 */ { UD_Isetp, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0429 */ { UD_Isetnp, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0430 */ { UD_Isetl, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0431 */ { UD_Isetge, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0432 */ { UD_Isetle, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0433 */ { UD_Isetg, O_Eb, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0434 */ { UD_Ipush, O_FS, O_NONE, O_NONE, P_none }, /* 0435 */ { UD_Ipop, O_FS, O_NONE, O_NONE, P_none }, /* 0436 */ { UD_Icpuid, O_NONE, O_NONE, O_NONE, P_none }, /* 0437 */ { UD_Ibt, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0438 */ { UD_Ishld, O_Ev, O_Gv, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0439 */ { UD_Ishld, O_Ev, O_Gv, O_CL, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0440 */ { UD_Imontmul, O_NONE, O_NONE, O_NONE, P_none }, /* 0441 */ { UD_Ixsha1, O_NONE, O_NONE, O_NONE, P_none }, /* 0442 */ { UD_Ixsha256, O_NONE, O_NONE, O_NONE, P_none }, /* 0443 */ { UD_Ixstore, O_NONE, O_NONE, O_NONE, P_none }, /* 0444 */ { UD_Ixcryptecb, O_NONE, O_NONE, O_NONE, P_none }, /* 0445 */ { UD_Ixcryptcbc, O_NONE, O_NONE, O_NONE, P_none }, /* 0446 */ { UD_Ixcryptctr, O_NONE, O_NONE, O_NONE, P_none }, /* 0447 */ { UD_Ixcryptcfb, O_NONE, O_NONE, O_NONE, P_none }, /* 0448 */ { UD_Ixcryptofb, O_NONE, O_NONE, O_NONE, P_none }, /* 0449 */ { UD_Ipush, O_GS, O_NONE, O_NONE, P_none }, /* 0450 */ { UD_Ipop, O_GS, O_NONE, O_NONE, P_none }, /* 0451 */ { UD_Irsm, O_NONE, O_NONE, O_NONE, P_none }, /* 0452 */ { UD_Ibts, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0453 */ { UD_Ishrd, O_Ev, O_Gv, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0454 */ { UD_Ishrd, O_Ev, O_Gv, O_CL, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0455 */ { UD_Ifxsave, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0456 */ { UD_Ifxrstor, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0457 */ { UD_Ildmxcsr, O_Md, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0458 */ { UD_Istmxcsr, O_Md, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0459 */ { UD_Ixsave, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0460 */ { UD_Ixrstor, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0461 */ { UD_Iclflush, O_M, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0462 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0463 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0464 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0465 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0466 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0467 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0468 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0469 */ { UD_Ilfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0470 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0471 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0472 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0473 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0474 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0475 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0476 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0477 */ { UD_Imfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0478 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0479 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0480 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0481 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0482 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0483 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0484 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0485 */ { UD_Isfence, O_NONE, O_NONE, O_NONE, P_none }, /* 0486 */ { UD_Iimul, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0487 */ { UD_Icmpxchg, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0488 */ { UD_Icmpxchg, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0489 */ { UD_Ilss, O_Gv, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0490 */ { UD_Ibtr, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0491 */ { UD_Ilfs, O_Gz, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0492 */ { UD_Ilgs, O_Gz, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0493 */ { UD_Imovzx, O_Gv, O_Eb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0494 */ { UD_Imovzx, O_Gy, O_Ew, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0495 */ { UD_Ipopcnt, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexr|P_rexw|P_rexx|P_rexb }, /* 0496 */ { UD_Ibt, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0497 */ { UD_Ibts, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0498 */ { UD_Ibtr, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0499 */ { UD_Ibtc, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0500 */ { UD_Ibtc, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0501 */ { UD_Ibsf, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0502 */ { UD_Ibsr, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0503 */ { UD_Imovsx, O_Gv, O_Eb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0504 */ { UD_Imovsx, O_Gy, O_Ew, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0505 */ { UD_Ixadd, O_Eb, O_Gb, O_NONE, P_aso|P_oso|P_rexr|P_rexx|P_rexb }, /* 0506 */ { UD_Ixadd, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0507 */ { UD_Icmpps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0508 */ { UD_Icmpsd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0509 */ { UD_Icmpss, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0510 */ { UD_Icmppd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0511 */ { UD_Imovnti, O_M, O_Gy, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0512 */ { UD_Ipinsrw, O_P, O_MwRy, O_Ib, P_aso|P_rexw|P_rexr|P_rexx|P_rexb|P_def64 }, /* 0513 */ { UD_Ipinsrw, O_V, O_MwRy, O_Ib, P_aso|P_rexw|P_rexr|P_rexx|P_rexb|P_def64 }, /* 0514 */ { UD_Ipextrw, O_Gd, O_N, O_Ib, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0515 */ { UD_Ipextrw, O_Gd, O_U, O_Ib, P_aso|P_rexr|P_rexb }, /* 0516 */ { UD_Ishufps, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0517 */ { UD_Ishufpd, O_V, O_W, O_Ib, P_aso|P_rexr|P_rexx|P_rexb }, /* 0518 */ { UD_Icmpxchg8b, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0519 */ { UD_Icmpxchg8b, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0520 */ { UD_Icmpxchg16b, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0521 */ { UD_Ivmptrld, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0522 */ { UD_Ivmxon, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0523 */ { UD_Ivmclear, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0524 */ { UD_Ivmptrst, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0525 */ { UD_Ibswap, O_R0y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0526 */ { UD_Ibswap, O_R1y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0527 */ { UD_Ibswap, O_R2y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0528 */ { UD_Ibswap, O_R3y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0529 */ { UD_Ibswap, O_R4y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0530 */ { UD_Ibswap, O_R5y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0531 */ { UD_Ibswap, O_R6y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0532 */ { UD_Ibswap, O_R7y, O_NONE, O_NONE, P_oso|P_rexw|P_rexb }, /* 0533 */ { UD_Iaddsubps, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0534 */ { UD_Iaddsubpd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0535 */ { UD_Ipsrlw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0536 */ { UD_Ipsrlw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0537 */ { UD_Ipsrld, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0538 */ { UD_Ipsrld, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0539 */ { UD_Ipsrlq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0540 */ { UD_Ipsrlq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0541 */ { UD_Ipaddq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0542 */ { UD_Ipaddq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0543 */ { UD_Ipmullw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0544 */ { UD_Ipmullw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0545 */ { UD_Imovdq2q, O_P, O_U, O_NONE, P_aso|P_rexb }, /* 0546 */ { UD_Imovq2dq, O_V, O_N, O_NONE, P_aso|P_rexr }, /* 0547 */ { UD_Imovq, O_W, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0548 */ { UD_Ipmovmskb, O_Gd, O_N, O_NONE, P_oso|P_rexr|P_rexb }, /* 0549 */ { UD_Ipmovmskb, O_Gd, O_U, O_NONE, P_rexr|P_rexb }, /* 0550 */ { UD_Ipsubusb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0551 */ { UD_Ipsubusb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0552 */ { UD_Ipsubusw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0553 */ { UD_Ipsubusw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0554 */ { UD_Ipminub, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0555 */ { UD_Ipminub, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0556 */ { UD_Ipand, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0557 */ { UD_Ipand, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0558 */ { UD_Ipaddusb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0559 */ { UD_Ipaddusb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0560 */ { UD_Ipaddusw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0561 */ { UD_Ipaddusw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0562 */ { UD_Ipmaxub, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0563 */ { UD_Ipmaxub, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0564 */ { UD_Ipandn, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0565 */ { UD_Ipandn, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0566 */ { UD_Ipavgb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0567 */ { UD_Ipavgb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0568 */ { UD_Ipsraw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0569 */ { UD_Ipsraw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0570 */ { UD_Ipsrad, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0571 */ { UD_Ipsrad, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0572 */ { UD_Ipavgw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0573 */ { UD_Ipavgw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0574 */ { UD_Ipmulhuw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0575 */ { UD_Ipmulhuw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0576 */ { UD_Ipmulhw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0577 */ { UD_Ipmulhw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0578 */ { UD_Icvtpd2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0579 */ { UD_Icvtdq2pd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0580 */ { UD_Icvttpd2dq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0581 */ { UD_Imovntq, O_M, O_P, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0582 */ { UD_Imovntdq, O_M, O_V, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0583 */ { UD_Ipsubsb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0584 */ { UD_Ipsubsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0585 */ { UD_Ipsubsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0586 */ { UD_Ipsubsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0587 */ { UD_Ipminsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0588 */ { UD_Ipminsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0589 */ { UD_Ipor, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0590 */ { UD_Ipor, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0591 */ { UD_Ipaddsb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0592 */ { UD_Ipaddsb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0593 */ { UD_Ipaddsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0594 */ { UD_Ipaddsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0595 */ { UD_Ipmaxsw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0596 */ { UD_Ipmaxsw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0597 */ { UD_Ipxor, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0598 */ { UD_Ipxor, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0599 */ { UD_Ilddqu, O_V, O_M, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0600 */ { UD_Ipsllw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0601 */ { UD_Ipsllw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0602 */ { UD_Ipslld, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0603 */ { UD_Ipslld, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0604 */ { UD_Ipsllq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0605 */ { UD_Ipsllq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0606 */ { UD_Ipmuludq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0607 */ { UD_Ipmuludq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0608 */ { UD_Ipmaddwd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0609 */ { UD_Ipmaddwd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0610 */ { UD_Ipsadbw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0611 */ { UD_Ipsadbw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0612 */ { UD_Imaskmovq, O_P, O_N, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0613 */ { UD_Imaskmovdqu, O_V, O_U, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0614 */ { UD_Ipsubb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0615 */ { UD_Ipsubb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0616 */ { UD_Ipsubw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0617 */ { UD_Ipsubw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0618 */ { UD_Ipsubd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0619 */ { UD_Ipsubd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0620 */ { UD_Ipsubq, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0621 */ { UD_Ipsubq, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0622 */ { UD_Ipaddb, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0623 */ { UD_Ipaddb, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0624 */ { UD_Ipaddw, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0625 */ { UD_Ipaddw, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0626 */ { UD_Ipaddd, O_P, O_Q, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0627 */ { UD_Ipaddd, O_V, O_W, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0628 */ { UD_Iadc, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0629 */ { UD_Iadc, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0630 */ { UD_Iadc, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0631 */ { UD_Iadc, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0632 */ { UD_Iadc, O_AL, O_Ib, O_NONE, P_none }, /* 0633 */ { UD_Iadc, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0634 */ { UD_Ipush, O_SS, O_NONE, O_NONE, P_inv64 }, /* 0635 */ { UD_Ipop, O_SS, O_NONE, O_NONE, P_inv64 }, /* 0636 */ { UD_Isbb, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0637 */ { UD_Isbb, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0638 */ { UD_Isbb, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0639 */ { UD_Isbb, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0640 */ { UD_Isbb, O_AL, O_Ib, O_NONE, P_none }, /* 0641 */ { UD_Isbb, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0642 */ { UD_Ipush, O_DS, O_NONE, O_NONE, P_inv64 }, /* 0643 */ { UD_Ipop, O_DS, O_NONE, O_NONE, P_inv64 }, /* 0644 */ { UD_Iand, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0645 */ { UD_Iand, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0646 */ { UD_Iand, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0647 */ { UD_Iand, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0648 */ { UD_Iand, O_AL, O_Ib, O_NONE, P_none }, /* 0649 */ { UD_Iand, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0650 */ { UD_Idaa, O_NONE, O_NONE, O_NONE, P_inv64 }, /* 0651 */ { UD_Isub, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0652 */ { UD_Isub, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0653 */ { UD_Isub, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0654 */ { UD_Isub, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0655 */ { UD_Isub, O_AL, O_Ib, O_NONE, P_none }, /* 0656 */ { UD_Isub, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0657 */ { UD_Idas, O_NONE, O_NONE, O_NONE, P_inv64 }, /* 0658 */ { UD_Ixor, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0659 */ { UD_Ixor, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0660 */ { UD_Ixor, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0661 */ { UD_Ixor, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0662 */ { UD_Ixor, O_AL, O_Ib, O_NONE, P_none }, /* 0663 */ { UD_Ixor, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0664 */ { UD_Iaaa, O_NONE, O_NONE, O_NONE, P_none }, /* 0665 */ { UD_Icmp, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0666 */ { UD_Icmp, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0667 */ { UD_Icmp, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0668 */ { UD_Icmp, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0669 */ { UD_Icmp, O_AL, O_Ib, O_NONE, P_none }, /* 0670 */ { UD_Icmp, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0671 */ { UD_Iaas, O_NONE, O_NONE, O_NONE, P_none }, /* 0672 */ { UD_Iinc, O_R0z, O_NONE, O_NONE, P_oso }, /* 0673 */ { UD_Iinc, O_R1z, O_NONE, O_NONE, P_oso }, /* 0674 */ { UD_Iinc, O_R2z, O_NONE, O_NONE, P_oso }, /* 0675 */ { UD_Iinc, O_R3z, O_NONE, O_NONE, P_oso }, /* 0676 */ { UD_Iinc, O_R4z, O_NONE, O_NONE, P_oso }, /* 0677 */ { UD_Iinc, O_R5z, O_NONE, O_NONE, P_oso }, /* 0678 */ { UD_Iinc, O_R6z, O_NONE, O_NONE, P_oso }, /* 0679 */ { UD_Iinc, O_R7z, O_NONE, O_NONE, P_oso }, /* 0680 */ { UD_Idec, O_R0z, O_NONE, O_NONE, P_oso }, /* 0681 */ { UD_Idec, O_R1z, O_NONE, O_NONE, P_oso }, /* 0682 */ { UD_Idec, O_R2z, O_NONE, O_NONE, P_oso }, /* 0683 */ { UD_Idec, O_R3z, O_NONE, O_NONE, P_oso }, /* 0684 */ { UD_Idec, O_R4z, O_NONE, O_NONE, P_oso }, /* 0685 */ { UD_Idec, O_R5z, O_NONE, O_NONE, P_oso }, /* 0686 */ { UD_Idec, O_R6z, O_NONE, O_NONE, P_oso }, /* 0687 */ { UD_Idec, O_R7z, O_NONE, O_NONE, P_oso }, /* 0688 */ { UD_Ipush, O_R0v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0689 */ { UD_Ipush, O_R1v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0690 */ { UD_Ipush, O_R2v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0691 */ { UD_Ipush, O_R3v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0692 */ { UD_Ipush, O_R4v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0693 */ { UD_Ipush, O_R5v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0694 */ { UD_Ipush, O_R6v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0695 */ { UD_Ipush, O_R7v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0696 */ { UD_Ipop, O_R0v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0697 */ { UD_Ipop, O_R1v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0698 */ { UD_Ipop, O_R2v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0699 */ { UD_Ipop, O_R3v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0700 */ { UD_Ipop, O_R4v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0701 */ { UD_Ipop, O_R5v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0702 */ { UD_Ipop, O_R6v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0703 */ { UD_Ipop, O_R7v, O_NONE, O_NONE, P_oso|P_rexb|P_def64 }, /* 0704 */ { UD_Ipusha, O_NONE, O_NONE, O_NONE, P_oso|P_inv64 }, /* 0705 */ { UD_Ipushad, O_NONE, O_NONE, O_NONE, P_oso|P_inv64 }, /* 0706 */ { UD_Ipopa, O_NONE, O_NONE, O_NONE, P_oso|P_inv64 }, /* 0707 */ { UD_Ipopad, O_NONE, O_NONE, O_NONE, P_oso|P_inv64 }, /* 0708 */ { UD_Ibound, O_Gv, O_M, O_NONE, P_aso|P_oso }, /* 0709 */ { UD_Iarpl, O_Ew, O_Gw, O_NONE, P_aso }, /* 0710 */ { UD_Imovsxd, O_Gq, O_Ed, O_NONE, P_aso|P_oso|P_rexw|P_rexx|P_rexr|P_rexb }, /* 0711 */ { UD_Ipush, O_sIz, O_NONE, O_NONE, P_oso|P_def64 }, /* 0712 */ { UD_Iimul, O_Gv, O_Ev, O_Iz, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0713 */ { UD_Ipush, O_sIb, O_NONE, O_NONE, P_oso|P_def64 }, /* 0714 */ { UD_Iimul, O_Gv, O_Ev, O_sIb, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0715 */ { UD_Iinsb, O_NONE, O_NONE, O_NONE, P_str|P_seg }, /* 0716 */ { UD_Iinsw, O_NONE, O_NONE, O_NONE, P_str|P_oso|P_seg }, /* 0717 */ { UD_Iinsd, O_NONE, O_NONE, O_NONE, P_str|P_oso|P_seg }, /* 0718 */ { UD_Ioutsb, O_NONE, O_NONE, O_NONE, P_str|P_seg }, /* 0719 */ { UD_Ioutsw, O_NONE, O_NONE, O_NONE, P_str|P_oso|P_seg }, /* 0720 */ { UD_Ioutsd, O_NONE, O_NONE, O_NONE, P_str|P_oso|P_seg }, /* 0721 */ { UD_Ijo, O_Jb, O_NONE, O_NONE, P_none }, /* 0722 */ { UD_Ijno, O_Jb, O_NONE, O_NONE, P_none }, /* 0723 */ { UD_Ijb, O_Jb, O_NONE, O_NONE, P_none }, /* 0724 */ { UD_Ijae, O_Jb, O_NONE, O_NONE, P_none }, /* 0725 */ { UD_Ijz, O_Jb, O_NONE, O_NONE, P_none }, /* 0726 */ { UD_Ijnz, O_Jb, O_NONE, O_NONE, P_none }, /* 0727 */ { UD_Ijbe, O_Jb, O_NONE, O_NONE, P_none }, /* 0728 */ { UD_Ija, O_Jb, O_NONE, O_NONE, P_none }, /* 0729 */ { UD_Ijs, O_Jb, O_NONE, O_NONE, P_none }, /* 0730 */ { UD_Ijns, O_Jb, O_NONE, O_NONE, P_none }, /* 0731 */ { UD_Ijp, O_Jb, O_NONE, O_NONE, P_none }, /* 0732 */ { UD_Ijnp, O_Jb, O_NONE, O_NONE, P_none }, /* 0733 */ { UD_Ijl, O_Jb, O_NONE, O_NONE, P_none }, /* 0734 */ { UD_Ijge, O_Jb, O_NONE, O_NONE, P_none }, /* 0735 */ { UD_Ijle, O_Jb, O_NONE, O_NONE, P_none }, /* 0736 */ { UD_Ijg, O_Jb, O_NONE, O_NONE, P_none }, /* 0737 */ { UD_Iadd, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0738 */ { UD_Ior, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0739 */ { UD_Iadc, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0740 */ { UD_Isbb, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0741 */ { UD_Iand, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0742 */ { UD_Isub, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0743 */ { UD_Ixor, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0744 */ { UD_Icmp, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0745 */ { UD_Iadd, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0746 */ { UD_Ior, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0747 */ { UD_Iadc, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0748 */ { UD_Isbb, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0749 */ { UD_Iand, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0750 */ { UD_Isub, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0751 */ { UD_Ixor, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0752 */ { UD_Icmp, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0753 */ { UD_Iadd, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0754 */ { UD_Ior, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0755 */ { UD_Iadc, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0756 */ { UD_Isbb, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0757 */ { UD_Iand, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0758 */ { UD_Isub, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0759 */ { UD_Ixor, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0760 */ { UD_Icmp, O_Eb, O_Ib, O_NONE, P_aso|P_rexr|P_rexx|P_rexb|P_inv64 }, /* 0761 */ { UD_Iadd, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0762 */ { UD_Ior, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0763 */ { UD_Iadc, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0764 */ { UD_Isbb, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0765 */ { UD_Iand, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0766 */ { UD_Isub, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0767 */ { UD_Ixor, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0768 */ { UD_Icmp, O_Ev, O_sIb, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0769 */ { UD_Itest, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0770 */ { UD_Itest, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0771 */ { UD_Ixchg, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0772 */ { UD_Ixchg, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0773 */ { UD_Imov, O_Eb, O_Gb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0774 */ { UD_Imov, O_Ev, O_Gv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0775 */ { UD_Imov, O_Gb, O_Eb, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0776 */ { UD_Imov, O_Gv, O_Ev, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0777 */ { UD_Imov, O_MwRv, O_S, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0778 */ { UD_Ilea, O_Gv, O_M, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0779 */ { UD_Imov, O_S, O_MwRv, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0780 */ { UD_Ipop, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb|P_def64 }, /* 0781 */ { UD_Ixchg, O_R0v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0782 */ { UD_Ixchg, O_R1v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0783 */ { UD_Ixchg, O_R2v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0784 */ { UD_Ixchg, O_R3v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0785 */ { UD_Ixchg, O_R4v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0786 */ { UD_Ixchg, O_R5v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0787 */ { UD_Ixchg, O_R6v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0788 */ { UD_Ixchg, O_R7v, O_rAX, O_NONE, P_oso|P_rexw|P_rexb }, /* 0789 */ { UD_Icbw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0790 */ { UD_Icwde, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0791 */ { UD_Icdqe, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0792 */ { UD_Icwd, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0793 */ { UD_Icdq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0794 */ { UD_Icqo, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0795 */ { UD_Icall, O_Av, O_NONE, O_NONE, P_oso }, /* 0796 */ { UD_Iwait, O_NONE, O_NONE, O_NONE, P_none }, /* 0797 */ { UD_Ipushfw, O_NONE, O_NONE, O_NONE, P_oso }, /* 0798 */ { UD_Ipushfw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw|P_def64 }, /* 0799 */ { UD_Ipushfd, O_NONE, O_NONE, O_NONE, P_oso }, /* 0800 */ { UD_Ipushfq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw|P_def64 }, /* 0801 */ { UD_Ipushfq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw|P_def64 }, /* 0802 */ { UD_Ipopfw, O_NONE, O_NONE, O_NONE, P_oso }, /* 0803 */ { UD_Ipopfd, O_NONE, O_NONE, O_NONE, P_oso }, /* 0804 */ { UD_Ipopfq, O_NONE, O_NONE, O_NONE, P_oso|P_def64 }, /* 0805 */ { UD_Ipopfq, O_NONE, O_NONE, O_NONE, P_oso|P_def64 }, /* 0806 */ { UD_Isahf, O_NONE, O_NONE, O_NONE, P_none }, /* 0807 */ { UD_Ilahf, O_NONE, O_NONE, O_NONE, P_none }, /* 0808 */ { UD_Imov, O_AL, O_Ob, O_NONE, P_none }, /* 0809 */ { UD_Imov, O_rAX, O_Ov, O_NONE, P_aso|P_oso|P_rexw }, /* 0810 */ { UD_Imov, O_Ob, O_AL, O_NONE, P_none }, /* 0811 */ { UD_Imov, O_Ov, O_rAX, O_NONE, P_aso|P_oso|P_rexw }, /* 0812 */ { UD_Imovsb, O_NONE, O_NONE, O_NONE, P_str|P_seg }, /* 0813 */ { UD_Imovsw, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0814 */ { UD_Imovsd, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0815 */ { UD_Imovsq, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0816 */ { UD_Icmpsb, O_NONE, O_NONE, O_NONE, P_strz|P_seg }, /* 0817 */ { UD_Icmpsw, O_NONE, O_NONE, O_NONE, P_strz|P_oso|P_rexw|P_seg }, /* 0818 */ { UD_Icmpsd, O_NONE, O_NONE, O_NONE, P_strz|P_oso|P_rexw|P_seg }, /* 0819 */ { UD_Icmpsq, O_NONE, O_NONE, O_NONE, P_strz|P_oso|P_rexw|P_seg }, /* 0820 */ { UD_Itest, O_AL, O_Ib, O_NONE, P_none }, /* 0821 */ { UD_Itest, O_rAX, O_sIz, O_NONE, P_oso|P_rexw }, /* 0822 */ { UD_Istosb, O_NONE, O_NONE, O_NONE, P_str|P_seg }, /* 0823 */ { UD_Istosw, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0824 */ { UD_Istosd, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0825 */ { UD_Istosq, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0826 */ { UD_Ilodsb, O_NONE, O_NONE, O_NONE, P_str|P_seg }, /* 0827 */ { UD_Ilodsw, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0828 */ { UD_Ilodsd, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0829 */ { UD_Ilodsq, O_NONE, O_NONE, O_NONE, P_str|P_seg|P_oso|P_rexw }, /* 0830 */ { UD_Iscasb, O_NONE, O_NONE, O_NONE, P_strz }, /* 0831 */ { UD_Iscasw, O_NONE, O_NONE, O_NONE, P_strz|P_oso|P_rexw }, /* 0832 */ { UD_Iscasd, O_NONE, O_NONE, O_NONE, P_strz|P_oso|P_rexw }, /* 0833 */ { UD_Iscasq, O_NONE, O_NONE, O_NONE, P_strz|P_oso|P_rexw }, /* 0834 */ { UD_Imov, O_R0b, O_Ib, O_NONE, P_rexb }, /* 0835 */ { UD_Imov, O_R1b, O_Ib, O_NONE, P_rexb }, /* 0836 */ { UD_Imov, O_R2b, O_Ib, O_NONE, P_rexb }, /* 0837 */ { UD_Imov, O_R3b, O_Ib, O_NONE, P_rexb }, /* 0838 */ { UD_Imov, O_R4b, O_Ib, O_NONE, P_rexb }, /* 0839 */ { UD_Imov, O_R5b, O_Ib, O_NONE, P_rexb }, /* 0840 */ { UD_Imov, O_R6b, O_Ib, O_NONE, P_rexb }, /* 0841 */ { UD_Imov, O_R7b, O_Ib, O_NONE, P_rexb }, /* 0842 */ { UD_Imov, O_R0v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0843 */ { UD_Imov, O_R1v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0844 */ { UD_Imov, O_R2v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0845 */ { UD_Imov, O_R3v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0846 */ { UD_Imov, O_R4v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0847 */ { UD_Imov, O_R5v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0848 */ { UD_Imov, O_R6v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0849 */ { UD_Imov, O_R7v, O_Iv, O_NONE, P_oso|P_rexw|P_rexb }, /* 0850 */ { UD_Irol, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0851 */ { UD_Iror, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0852 */ { UD_Ircl, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0853 */ { UD_Ircr, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0854 */ { UD_Ishl, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0855 */ { UD_Ishr, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0856 */ { UD_Ishl, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0857 */ { UD_Isar, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0858 */ { UD_Irol, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0859 */ { UD_Iror, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0860 */ { UD_Ircl, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0861 */ { UD_Ircr, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0862 */ { UD_Ishl, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0863 */ { UD_Ishr, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0864 */ { UD_Ishl, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0865 */ { UD_Isar, O_Ev, O_Ib, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0866 */ { UD_Iret, O_Iw, O_NONE, O_NONE, P_none }, /* 0867 */ { UD_Iret, O_NONE, O_NONE, O_NONE, P_none }, /* 0868 */ { UD_Iles, O_Gv, O_M, O_NONE, P_aso|P_oso }, /* 0869 */ { UD_Ilds, O_Gv, O_M, O_NONE, P_aso|P_oso }, /* 0870 */ { UD_Imov, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0871 */ { UD_Imov, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0872 */ { UD_Ienter, O_Iw, O_Ib, O_NONE, P_def64 }, /* 0873 */ { UD_Ileave, O_NONE, O_NONE, O_NONE, P_none }, /* 0874 */ { UD_Iretf, O_Iw, O_NONE, O_NONE, P_none }, /* 0875 */ { UD_Iretf, O_NONE, O_NONE, O_NONE, P_none }, /* 0876 */ { UD_Iint3, O_NONE, O_NONE, O_NONE, P_none }, /* 0877 */ { UD_Iint, O_Ib, O_NONE, O_NONE, P_none }, /* 0878 */ { UD_Iinto, O_NONE, O_NONE, O_NONE, P_inv64 }, /* 0879 */ { UD_Iiretw, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0880 */ { UD_Iiretd, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0881 */ { UD_Iiretq, O_NONE, O_NONE, O_NONE, P_oso|P_rexw }, /* 0882 */ { UD_Irol, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0883 */ { UD_Iror, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0884 */ { UD_Ircl, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0885 */ { UD_Ircr, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0886 */ { UD_Ishl, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0887 */ { UD_Ishr, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0888 */ { UD_Ishl, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0889 */ { UD_Isar, O_Eb, O_I1, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0890 */ { UD_Irol, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0891 */ { UD_Iror, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0892 */ { UD_Ircl, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0893 */ { UD_Ircr, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0894 */ { UD_Ishl, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0895 */ { UD_Ishr, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0896 */ { UD_Ishl, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0897 */ { UD_Isar, O_Ev, O_I1, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0898 */ { UD_Irol, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0899 */ { UD_Iror, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0900 */ { UD_Ircl, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0901 */ { UD_Ircr, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0902 */ { UD_Ishl, O_Eb, O_CL, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0903 */ { UD_Ishr, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0904 */ { UD_Ishl, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0905 */ { UD_Isar, O_Eb, O_CL, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0906 */ { UD_Irol, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0907 */ { UD_Iror, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0908 */ { UD_Ircl, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0909 */ { UD_Ircr, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0910 */ { UD_Ishl, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0911 */ { UD_Ishr, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0912 */ { UD_Ishl, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0913 */ { UD_Isar, O_Ev, O_CL, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 0914 */ { UD_Iaam, O_Ib, O_NONE, O_NONE, P_none }, /* 0915 */ { UD_Iaad, O_Ib, O_NONE, O_NONE, P_none }, /* 0916 */ { UD_Isalc, O_NONE, O_NONE, O_NONE, P_inv64 }, /* 0917 */ { UD_Ixlatb, O_NONE, O_NONE, O_NONE, P_rexw|P_seg }, /* 0918 */ { UD_Ifadd, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0919 */ { UD_Ifmul, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0920 */ { UD_Ifcom, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0921 */ { UD_Ifcomp, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0922 */ { UD_Ifsub, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0923 */ { UD_Ifsubr, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0924 */ { UD_Ifdiv, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0925 */ { UD_Ifdivr, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0926 */ { UD_Ifadd, O_ST0, O_ST0, O_NONE, P_none }, /* 0927 */ { UD_Ifadd, O_ST0, O_ST1, O_NONE, P_none }, /* 0928 */ { UD_Ifadd, O_ST0, O_ST2, O_NONE, P_none }, /* 0929 */ { UD_Ifadd, O_ST0, O_ST3, O_NONE, P_none }, /* 0930 */ { UD_Ifadd, O_ST0, O_ST4, O_NONE, P_none }, /* 0931 */ { UD_Ifadd, O_ST0, O_ST5, O_NONE, P_none }, /* 0932 */ { UD_Ifadd, O_ST0, O_ST6, O_NONE, P_none }, /* 0933 */ { UD_Ifadd, O_ST0, O_ST7, O_NONE, P_none }, /* 0934 */ { UD_Ifmul, O_ST0, O_ST0, O_NONE, P_none }, /* 0935 */ { UD_Ifmul, O_ST0, O_ST1, O_NONE, P_none }, /* 0936 */ { UD_Ifmul, O_ST0, O_ST2, O_NONE, P_none }, /* 0937 */ { UD_Ifmul, O_ST0, O_ST3, O_NONE, P_none }, /* 0938 */ { UD_Ifmul, O_ST0, O_ST4, O_NONE, P_none }, /* 0939 */ { UD_Ifmul, O_ST0, O_ST5, O_NONE, P_none }, /* 0940 */ { UD_Ifmul, O_ST0, O_ST6, O_NONE, P_none }, /* 0941 */ { UD_Ifmul, O_ST0, O_ST7, O_NONE, P_none }, /* 0942 */ { UD_Ifcom, O_ST0, O_ST0, O_NONE, P_none }, /* 0943 */ { UD_Ifcom, O_ST0, O_ST1, O_NONE, P_none }, /* 0944 */ { UD_Ifcom, O_ST0, O_ST2, O_NONE, P_none }, /* 0945 */ { UD_Ifcom, O_ST0, O_ST3, O_NONE, P_none }, /* 0946 */ { UD_Ifcom, O_ST0, O_ST4, O_NONE, P_none }, /* 0947 */ { UD_Ifcom, O_ST0, O_ST5, O_NONE, P_none }, /* 0948 */ { UD_Ifcom, O_ST0, O_ST6, O_NONE, P_none }, /* 0949 */ { UD_Ifcom, O_ST0, O_ST7, O_NONE, P_none }, /* 0950 */ { UD_Ifcomp, O_ST0, O_ST0, O_NONE, P_none }, /* 0951 */ { UD_Ifcomp, O_ST0, O_ST1, O_NONE, P_none }, /* 0952 */ { UD_Ifcomp, O_ST0, O_ST2, O_NONE, P_none }, /* 0953 */ { UD_Ifcomp, O_ST0, O_ST3, O_NONE, P_none }, /* 0954 */ { UD_Ifcomp, O_ST0, O_ST4, O_NONE, P_none }, /* 0955 */ { UD_Ifcomp, O_ST0, O_ST5, O_NONE, P_none }, /* 0956 */ { UD_Ifcomp, O_ST0, O_ST6, O_NONE, P_none }, /* 0957 */ { UD_Ifcomp, O_ST0, O_ST7, O_NONE, P_none }, /* 0958 */ { UD_Ifsub, O_ST0, O_ST0, O_NONE, P_none }, /* 0959 */ { UD_Ifsub, O_ST0, O_ST1, O_NONE, P_none }, /* 0960 */ { UD_Ifsub, O_ST0, O_ST2, O_NONE, P_none }, /* 0961 */ { UD_Ifsub, O_ST0, O_ST3, O_NONE, P_none }, /* 0962 */ { UD_Ifsub, O_ST0, O_ST4, O_NONE, P_none }, /* 0963 */ { UD_Ifsub, O_ST0, O_ST5, O_NONE, P_none }, /* 0964 */ { UD_Ifsub, O_ST0, O_ST6, O_NONE, P_none }, /* 0965 */ { UD_Ifsub, O_ST0, O_ST7, O_NONE, P_none }, /* 0966 */ { UD_Ifsubr, O_ST0, O_ST0, O_NONE, P_none }, /* 0967 */ { UD_Ifsubr, O_ST0, O_ST1, O_NONE, P_none }, /* 0968 */ { UD_Ifsubr, O_ST0, O_ST2, O_NONE, P_none }, /* 0969 */ { UD_Ifsubr, O_ST0, O_ST3, O_NONE, P_none }, /* 0970 */ { UD_Ifsubr, O_ST0, O_ST4, O_NONE, P_none }, /* 0971 */ { UD_Ifsubr, O_ST0, O_ST5, O_NONE, P_none }, /* 0972 */ { UD_Ifsubr, O_ST0, O_ST6, O_NONE, P_none }, /* 0973 */ { UD_Ifsubr, O_ST0, O_ST7, O_NONE, P_none }, /* 0974 */ { UD_Ifdiv, O_ST0, O_ST0, O_NONE, P_none }, /* 0975 */ { UD_Ifdiv, O_ST0, O_ST1, O_NONE, P_none }, /* 0976 */ { UD_Ifdiv, O_ST0, O_ST2, O_NONE, P_none }, /* 0977 */ { UD_Ifdiv, O_ST0, O_ST3, O_NONE, P_none }, /* 0978 */ { UD_Ifdiv, O_ST0, O_ST4, O_NONE, P_none }, /* 0979 */ { UD_Ifdiv, O_ST0, O_ST5, O_NONE, P_none }, /* 0980 */ { UD_Ifdiv, O_ST0, O_ST6, O_NONE, P_none }, /* 0981 */ { UD_Ifdiv, O_ST0, O_ST7, O_NONE, P_none }, /* 0982 */ { UD_Ifdivr, O_ST0, O_ST0, O_NONE, P_none }, /* 0983 */ { UD_Ifdivr, O_ST0, O_ST1, O_NONE, P_none }, /* 0984 */ { UD_Ifdivr, O_ST0, O_ST2, O_NONE, P_none }, /* 0985 */ { UD_Ifdivr, O_ST0, O_ST3, O_NONE, P_none }, /* 0986 */ { UD_Ifdivr, O_ST0, O_ST4, O_NONE, P_none }, /* 0987 */ { UD_Ifdivr, O_ST0, O_ST5, O_NONE, P_none }, /* 0988 */ { UD_Ifdivr, O_ST0, O_ST6, O_NONE, P_none }, /* 0989 */ { UD_Ifdivr, O_ST0, O_ST7, O_NONE, P_none }, /* 0990 */ { UD_Ifld, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0991 */ { UD_Ifst, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0992 */ { UD_Ifstp, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0993 */ { UD_Ifldenv, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0994 */ { UD_Ifldcw, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0995 */ { UD_Ifnstenv, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0996 */ { UD_Ifnstcw, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 0997 */ { UD_Ifld, O_ST0, O_NONE, O_NONE, P_none }, /* 0998 */ { UD_Ifld, O_ST1, O_NONE, O_NONE, P_none }, /* 0999 */ { UD_Ifld, O_ST2, O_NONE, O_NONE, P_none }, /* 1000 */ { UD_Ifld, O_ST3, O_NONE, O_NONE, P_none }, /* 1001 */ { UD_Ifld, O_ST4, O_NONE, O_NONE, P_none }, /* 1002 */ { UD_Ifld, O_ST5, O_NONE, O_NONE, P_none }, /* 1003 */ { UD_Ifld, O_ST6, O_NONE, O_NONE, P_none }, /* 1004 */ { UD_Ifld, O_ST7, O_NONE, O_NONE, P_none }, /* 1005 */ { UD_Ifxch, O_ST0, O_ST0, O_NONE, P_none }, /* 1006 */ { UD_Ifxch, O_ST0, O_ST1, O_NONE, P_none }, /* 1007 */ { UD_Ifxch, O_ST0, O_ST2, O_NONE, P_none }, /* 1008 */ { UD_Ifxch, O_ST0, O_ST3, O_NONE, P_none }, /* 1009 */ { UD_Ifxch, O_ST0, O_ST4, O_NONE, P_none }, /* 1010 */ { UD_Ifxch, O_ST0, O_ST5, O_NONE, P_none }, /* 1011 */ { UD_Ifxch, O_ST0, O_ST6, O_NONE, P_none }, /* 1012 */ { UD_Ifxch, O_ST0, O_ST7, O_NONE, P_none }, /* 1013 */ { UD_Ifnop, O_NONE, O_NONE, O_NONE, P_none }, /* 1014 */ { UD_Ifstp1, O_ST0, O_NONE, O_NONE, P_none }, /* 1015 */ { UD_Ifstp1, O_ST1, O_NONE, O_NONE, P_none }, /* 1016 */ { UD_Ifstp1, O_ST2, O_NONE, O_NONE, P_none }, /* 1017 */ { UD_Ifstp1, O_ST3, O_NONE, O_NONE, P_none }, /* 1018 */ { UD_Ifstp1, O_ST4, O_NONE, O_NONE, P_none }, /* 1019 */ { UD_Ifstp1, O_ST5, O_NONE, O_NONE, P_none }, /* 1020 */ { UD_Ifstp1, O_ST6, O_NONE, O_NONE, P_none }, /* 1021 */ { UD_Ifstp1, O_ST7, O_NONE, O_NONE, P_none }, /* 1022 */ { UD_Ifchs, O_NONE, O_NONE, O_NONE, P_none }, /* 1023 */ { UD_Ifabs, O_NONE, O_NONE, O_NONE, P_none }, /* 1024 */ { UD_Iftst, O_NONE, O_NONE, O_NONE, P_none }, /* 1025 */ { UD_Ifxam, O_NONE, O_NONE, O_NONE, P_none }, /* 1026 */ { UD_Ifld1, O_NONE, O_NONE, O_NONE, P_none }, /* 1027 */ { UD_Ifldl2t, O_NONE, O_NONE, O_NONE, P_none }, /* 1028 */ { UD_Ifldl2e, O_NONE, O_NONE, O_NONE, P_none }, /* 1029 */ { UD_Ifldpi, O_NONE, O_NONE, O_NONE, P_none }, /* 1030 */ { UD_Ifldlg2, O_NONE, O_NONE, O_NONE, P_none }, /* 1031 */ { UD_Ifldln2, O_NONE, O_NONE, O_NONE, P_none }, /* 1032 */ { UD_Ifldz, O_NONE, O_NONE, O_NONE, P_none }, /* 1033 */ { UD_If2xm1, O_NONE, O_NONE, O_NONE, P_none }, /* 1034 */ { UD_Ifyl2x, O_NONE, O_NONE, O_NONE, P_none }, /* 1035 */ { UD_Ifptan, O_NONE, O_NONE, O_NONE, P_none }, /* 1036 */ { UD_Ifpatan, O_NONE, O_NONE, O_NONE, P_none }, /* 1037 */ { UD_Ifxtract, O_NONE, O_NONE, O_NONE, P_none }, /* 1038 */ { UD_Ifprem1, O_NONE, O_NONE, O_NONE, P_none }, /* 1039 */ { UD_Ifdecstp, O_NONE, O_NONE, O_NONE, P_none }, /* 1040 */ { UD_Ifincstp, O_NONE, O_NONE, O_NONE, P_none }, /* 1041 */ { UD_Ifprem, O_NONE, O_NONE, O_NONE, P_none }, /* 1042 */ { UD_Ifyl2xp1, O_NONE, O_NONE, O_NONE, P_none }, /* 1043 */ { UD_Ifsqrt, O_NONE, O_NONE, O_NONE, P_none }, /* 1044 */ { UD_Ifsincos, O_NONE, O_NONE, O_NONE, P_none }, /* 1045 */ { UD_Ifrndint, O_NONE, O_NONE, O_NONE, P_none }, /* 1046 */ { UD_Ifscale, O_NONE, O_NONE, O_NONE, P_none }, /* 1047 */ { UD_Ifsin, O_NONE, O_NONE, O_NONE, P_none }, /* 1048 */ { UD_Ifcos, O_NONE, O_NONE, O_NONE, P_none }, /* 1049 */ { UD_Ifiadd, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1050 */ { UD_Ifimul, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1051 */ { UD_Ificom, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1052 */ { UD_Ificomp, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1053 */ { UD_Ifisub, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1054 */ { UD_Ifisubr, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1055 */ { UD_Ifidiv, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1056 */ { UD_Ifidivr, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1057 */ { UD_Ifcmovb, O_ST0, O_ST0, O_NONE, P_none }, /* 1058 */ { UD_Ifcmovb, O_ST0, O_ST1, O_NONE, P_none }, /* 1059 */ { UD_Ifcmovb, O_ST0, O_ST2, O_NONE, P_none }, /* 1060 */ { UD_Ifcmovb, O_ST0, O_ST3, O_NONE, P_none }, /* 1061 */ { UD_Ifcmovb, O_ST0, O_ST4, O_NONE, P_none }, /* 1062 */ { UD_Ifcmovb, O_ST0, O_ST5, O_NONE, P_none }, /* 1063 */ { UD_Ifcmovb, O_ST0, O_ST6, O_NONE, P_none }, /* 1064 */ { UD_Ifcmovb, O_ST0, O_ST7, O_NONE, P_none }, /* 1065 */ { UD_Ifcmove, O_ST0, O_ST0, O_NONE, P_none }, /* 1066 */ { UD_Ifcmove, O_ST0, O_ST1, O_NONE, P_none }, /* 1067 */ { UD_Ifcmove, O_ST0, O_ST2, O_NONE, P_none }, /* 1068 */ { UD_Ifcmove, O_ST0, O_ST3, O_NONE, P_none }, /* 1069 */ { UD_Ifcmove, O_ST0, O_ST4, O_NONE, P_none }, /* 1070 */ { UD_Ifcmove, O_ST0, O_ST5, O_NONE, P_none }, /* 1071 */ { UD_Ifcmove, O_ST0, O_ST6, O_NONE, P_none }, /* 1072 */ { UD_Ifcmove, O_ST0, O_ST7, O_NONE, P_none }, /* 1073 */ { UD_Ifcmovbe, O_ST0, O_ST0, O_NONE, P_none }, /* 1074 */ { UD_Ifcmovbe, O_ST0, O_ST1, O_NONE, P_none }, /* 1075 */ { UD_Ifcmovbe, O_ST0, O_ST2, O_NONE, P_none }, /* 1076 */ { UD_Ifcmovbe, O_ST0, O_ST3, O_NONE, P_none }, /* 1077 */ { UD_Ifcmovbe, O_ST0, O_ST4, O_NONE, P_none }, /* 1078 */ { UD_Ifcmovbe, O_ST0, O_ST5, O_NONE, P_none }, /* 1079 */ { UD_Ifcmovbe, O_ST0, O_ST6, O_NONE, P_none }, /* 1080 */ { UD_Ifcmovbe, O_ST0, O_ST7, O_NONE, P_none }, /* 1081 */ { UD_Ifcmovu, O_ST0, O_ST0, O_NONE, P_none }, /* 1082 */ { UD_Ifcmovu, O_ST0, O_ST1, O_NONE, P_none }, /* 1083 */ { UD_Ifcmovu, O_ST0, O_ST2, O_NONE, P_none }, /* 1084 */ { UD_Ifcmovu, O_ST0, O_ST3, O_NONE, P_none }, /* 1085 */ { UD_Ifcmovu, O_ST0, O_ST4, O_NONE, P_none }, /* 1086 */ { UD_Ifcmovu, O_ST0, O_ST5, O_NONE, P_none }, /* 1087 */ { UD_Ifcmovu, O_ST0, O_ST6, O_NONE, P_none }, /* 1088 */ { UD_Ifcmovu, O_ST0, O_ST7, O_NONE, P_none }, /* 1089 */ { UD_Ifucompp, O_NONE, O_NONE, O_NONE, P_none }, /* 1090 */ { UD_Ifild, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1091 */ { UD_Ifisttp, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1092 */ { UD_Ifist, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1093 */ { UD_Ifistp, O_Md, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1094 */ { UD_Ifld, O_Mt, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1095 */ { UD_Ifstp, O_Mt, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1096 */ { UD_Ifcmovnb, O_ST0, O_ST0, O_NONE, P_none }, /* 1097 */ { UD_Ifcmovnb, O_ST0, O_ST1, O_NONE, P_none }, /* 1098 */ { UD_Ifcmovnb, O_ST0, O_ST2, O_NONE, P_none }, /* 1099 */ { UD_Ifcmovnb, O_ST0, O_ST3, O_NONE, P_none }, /* 1100 */ { UD_Ifcmovnb, O_ST0, O_ST4, O_NONE, P_none }, /* 1101 */ { UD_Ifcmovnb, O_ST0, O_ST5, O_NONE, P_none }, /* 1102 */ { UD_Ifcmovnb, O_ST0, O_ST6, O_NONE, P_none }, /* 1103 */ { UD_Ifcmovnb, O_ST0, O_ST7, O_NONE, P_none }, /* 1104 */ { UD_Ifcmovne, O_ST0, O_ST0, O_NONE, P_none }, /* 1105 */ { UD_Ifcmovne, O_ST0, O_ST1, O_NONE, P_none }, /* 1106 */ { UD_Ifcmovne, O_ST0, O_ST2, O_NONE, P_none }, /* 1107 */ { UD_Ifcmovne, O_ST0, O_ST3, O_NONE, P_none }, /* 1108 */ { UD_Ifcmovne, O_ST0, O_ST4, O_NONE, P_none }, /* 1109 */ { UD_Ifcmovne, O_ST0, O_ST5, O_NONE, P_none }, /* 1110 */ { UD_Ifcmovne, O_ST0, O_ST6, O_NONE, P_none }, /* 1111 */ { UD_Ifcmovne, O_ST0, O_ST7, O_NONE, P_none }, /* 1112 */ { UD_Ifcmovnbe, O_ST0, O_ST0, O_NONE, P_none }, /* 1113 */ { UD_Ifcmovnbe, O_ST0, O_ST1, O_NONE, P_none }, /* 1114 */ { UD_Ifcmovnbe, O_ST0, O_ST2, O_NONE, P_none }, /* 1115 */ { UD_Ifcmovnbe, O_ST0, O_ST3, O_NONE, P_none }, /* 1116 */ { UD_Ifcmovnbe, O_ST0, O_ST4, O_NONE, P_none }, /* 1117 */ { UD_Ifcmovnbe, O_ST0, O_ST5, O_NONE, P_none }, /* 1118 */ { UD_Ifcmovnbe, O_ST0, O_ST6, O_NONE, P_none }, /* 1119 */ { UD_Ifcmovnbe, O_ST0, O_ST7, O_NONE, P_none }, /* 1120 */ { UD_Ifcmovnu, O_ST0, O_ST0, O_NONE, P_none }, /* 1121 */ { UD_Ifcmovnu, O_ST0, O_ST1, O_NONE, P_none }, /* 1122 */ { UD_Ifcmovnu, O_ST0, O_ST2, O_NONE, P_none }, /* 1123 */ { UD_Ifcmovnu, O_ST0, O_ST3, O_NONE, P_none }, /* 1124 */ { UD_Ifcmovnu, O_ST0, O_ST4, O_NONE, P_none }, /* 1125 */ { UD_Ifcmovnu, O_ST0, O_ST5, O_NONE, P_none }, /* 1126 */ { UD_Ifcmovnu, O_ST0, O_ST6, O_NONE, P_none }, /* 1127 */ { UD_Ifcmovnu, O_ST0, O_ST7, O_NONE, P_none }, /* 1128 */ { UD_Ifclex, O_NONE, O_NONE, O_NONE, P_none }, /* 1129 */ { UD_Ifninit, O_NONE, O_NONE, O_NONE, P_none }, /* 1130 */ { UD_Ifucomi, O_ST0, O_ST0, O_NONE, P_none }, /* 1131 */ { UD_Ifucomi, O_ST0, O_ST1, O_NONE, P_none }, /* 1132 */ { UD_Ifucomi, O_ST0, O_ST2, O_NONE, P_none }, /* 1133 */ { UD_Ifucomi, O_ST0, O_ST3, O_NONE, P_none }, /* 1134 */ { UD_Ifucomi, O_ST0, O_ST4, O_NONE, P_none }, /* 1135 */ { UD_Ifucomi, O_ST0, O_ST5, O_NONE, P_none }, /* 1136 */ { UD_Ifucomi, O_ST0, O_ST6, O_NONE, P_none }, /* 1137 */ { UD_Ifucomi, O_ST0, O_ST7, O_NONE, P_none }, /* 1138 */ { UD_Ifcomi, O_ST0, O_ST0, O_NONE, P_none }, /* 1139 */ { UD_Ifcomi, O_ST0, O_ST1, O_NONE, P_none }, /* 1140 */ { UD_Ifcomi, O_ST0, O_ST2, O_NONE, P_none }, /* 1141 */ { UD_Ifcomi, O_ST0, O_ST3, O_NONE, P_none }, /* 1142 */ { UD_Ifcomi, O_ST0, O_ST4, O_NONE, P_none }, /* 1143 */ { UD_Ifcomi, O_ST0, O_ST5, O_NONE, P_none }, /* 1144 */ { UD_Ifcomi, O_ST0, O_ST6, O_NONE, P_none }, /* 1145 */ { UD_Ifcomi, O_ST0, O_ST7, O_NONE, P_none }, /* 1146 */ { UD_Ifadd, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1147 */ { UD_Ifmul, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1148 */ { UD_Ifcom, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1149 */ { UD_Ifcomp, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1150 */ { UD_Ifsub, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1151 */ { UD_Ifsubr, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1152 */ { UD_Ifdiv, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1153 */ { UD_Ifdivr, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1154 */ { UD_Ifadd, O_ST0, O_ST0, O_NONE, P_none }, /* 1155 */ { UD_Ifadd, O_ST1, O_ST0, O_NONE, P_none }, /* 1156 */ { UD_Ifadd, O_ST2, O_ST0, O_NONE, P_none }, /* 1157 */ { UD_Ifadd, O_ST3, O_ST0, O_NONE, P_none }, /* 1158 */ { UD_Ifadd, O_ST4, O_ST0, O_NONE, P_none }, /* 1159 */ { UD_Ifadd, O_ST5, O_ST0, O_NONE, P_none }, /* 1160 */ { UD_Ifadd, O_ST6, O_ST0, O_NONE, P_none }, /* 1161 */ { UD_Ifadd, O_ST7, O_ST0, O_NONE, P_none }, /* 1162 */ { UD_Ifmul, O_ST0, O_ST0, O_NONE, P_none }, /* 1163 */ { UD_Ifmul, O_ST1, O_ST0, O_NONE, P_none }, /* 1164 */ { UD_Ifmul, O_ST2, O_ST0, O_NONE, P_none }, /* 1165 */ { UD_Ifmul, O_ST3, O_ST0, O_NONE, P_none }, /* 1166 */ { UD_Ifmul, O_ST4, O_ST0, O_NONE, P_none }, /* 1167 */ { UD_Ifmul, O_ST5, O_ST0, O_NONE, P_none }, /* 1168 */ { UD_Ifmul, O_ST6, O_ST0, O_NONE, P_none }, /* 1169 */ { UD_Ifmul, O_ST7, O_ST0, O_NONE, P_none }, /* 1170 */ { UD_Ifcom2, O_ST0, O_NONE, O_NONE, P_none }, /* 1171 */ { UD_Ifcom2, O_ST1, O_NONE, O_NONE, P_none }, /* 1172 */ { UD_Ifcom2, O_ST2, O_NONE, O_NONE, P_none }, /* 1173 */ { UD_Ifcom2, O_ST3, O_NONE, O_NONE, P_none }, /* 1174 */ { UD_Ifcom2, O_ST4, O_NONE, O_NONE, P_none }, /* 1175 */ { UD_Ifcom2, O_ST5, O_NONE, O_NONE, P_none }, /* 1176 */ { UD_Ifcom2, O_ST6, O_NONE, O_NONE, P_none }, /* 1177 */ { UD_Ifcom2, O_ST7, O_NONE, O_NONE, P_none }, /* 1178 */ { UD_Ifcomp3, O_ST0, O_NONE, O_NONE, P_none }, /* 1179 */ { UD_Ifcomp3, O_ST1, O_NONE, O_NONE, P_none }, /* 1180 */ { UD_Ifcomp3, O_ST2, O_NONE, O_NONE, P_none }, /* 1181 */ { UD_Ifcomp3, O_ST3, O_NONE, O_NONE, P_none }, /* 1182 */ { UD_Ifcomp3, O_ST4, O_NONE, O_NONE, P_none }, /* 1183 */ { UD_Ifcomp3, O_ST5, O_NONE, O_NONE, P_none }, /* 1184 */ { UD_Ifcomp3, O_ST6, O_NONE, O_NONE, P_none }, /* 1185 */ { UD_Ifcomp3, O_ST7, O_NONE, O_NONE, P_none }, /* 1186 */ { UD_Ifsubr, O_ST0, O_ST0, O_NONE, P_none }, /* 1187 */ { UD_Ifsubr, O_ST1, O_ST0, O_NONE, P_none }, /* 1188 */ { UD_Ifsubr, O_ST2, O_ST0, O_NONE, P_none }, /* 1189 */ { UD_Ifsubr, O_ST3, O_ST0, O_NONE, P_none }, /* 1190 */ { UD_Ifsubr, O_ST4, O_ST0, O_NONE, P_none }, /* 1191 */ { UD_Ifsubr, O_ST5, O_ST0, O_NONE, P_none }, /* 1192 */ { UD_Ifsubr, O_ST6, O_ST0, O_NONE, P_none }, /* 1193 */ { UD_Ifsubr, O_ST7, O_ST0, O_NONE, P_none }, /* 1194 */ { UD_Ifsub, O_ST0, O_ST0, O_NONE, P_none }, /* 1195 */ { UD_Ifsub, O_ST1, O_ST0, O_NONE, P_none }, /* 1196 */ { UD_Ifsub, O_ST2, O_ST0, O_NONE, P_none }, /* 1197 */ { UD_Ifsub, O_ST3, O_ST0, O_NONE, P_none }, /* 1198 */ { UD_Ifsub, O_ST4, O_ST0, O_NONE, P_none }, /* 1199 */ { UD_Ifsub, O_ST5, O_ST0, O_NONE, P_none }, /* 1200 */ { UD_Ifsub, O_ST6, O_ST0, O_NONE, P_none }, /* 1201 */ { UD_Ifsub, O_ST7, O_ST0, O_NONE, P_none }, /* 1202 */ { UD_Ifdivr, O_ST0, O_ST0, O_NONE, P_none }, /* 1203 */ { UD_Ifdivr, O_ST1, O_ST0, O_NONE, P_none }, /* 1204 */ { UD_Ifdivr, O_ST2, O_ST0, O_NONE, P_none }, /* 1205 */ { UD_Ifdivr, O_ST3, O_ST0, O_NONE, P_none }, /* 1206 */ { UD_Ifdivr, O_ST4, O_ST0, O_NONE, P_none }, /* 1207 */ { UD_Ifdivr, O_ST5, O_ST0, O_NONE, P_none }, /* 1208 */ { UD_Ifdivr, O_ST6, O_ST0, O_NONE, P_none }, /* 1209 */ { UD_Ifdivr, O_ST7, O_ST0, O_NONE, P_none }, /* 1210 */ { UD_Ifdiv, O_ST0, O_ST0, O_NONE, P_none }, /* 1211 */ { UD_Ifdiv, O_ST1, O_ST0, O_NONE, P_none }, /* 1212 */ { UD_Ifdiv, O_ST2, O_ST0, O_NONE, P_none }, /* 1213 */ { UD_Ifdiv, O_ST3, O_ST0, O_NONE, P_none }, /* 1214 */ { UD_Ifdiv, O_ST4, O_ST0, O_NONE, P_none }, /* 1215 */ { UD_Ifdiv, O_ST5, O_ST0, O_NONE, P_none }, /* 1216 */ { UD_Ifdiv, O_ST6, O_ST0, O_NONE, P_none }, /* 1217 */ { UD_Ifdiv, O_ST7, O_ST0, O_NONE, P_none }, /* 1218 */ { UD_Ifld, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1219 */ { UD_Ifisttp, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1220 */ { UD_Ifst, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1221 */ { UD_Ifstp, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1222 */ { UD_Ifrstor, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1223 */ { UD_Ifnsave, O_M, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1224 */ { UD_Ifnstsw, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1225 */ { UD_Iffree, O_ST0, O_NONE, O_NONE, P_none }, /* 1226 */ { UD_Iffree, O_ST1, O_NONE, O_NONE, P_none }, /* 1227 */ { UD_Iffree, O_ST2, O_NONE, O_NONE, P_none }, /* 1228 */ { UD_Iffree, O_ST3, O_NONE, O_NONE, P_none }, /* 1229 */ { UD_Iffree, O_ST4, O_NONE, O_NONE, P_none }, /* 1230 */ { UD_Iffree, O_ST5, O_NONE, O_NONE, P_none }, /* 1231 */ { UD_Iffree, O_ST6, O_NONE, O_NONE, P_none }, /* 1232 */ { UD_Iffree, O_ST7, O_NONE, O_NONE, P_none }, /* 1233 */ { UD_Ifxch4, O_ST0, O_NONE, O_NONE, P_none }, /* 1234 */ { UD_Ifxch4, O_ST1, O_NONE, O_NONE, P_none }, /* 1235 */ { UD_Ifxch4, O_ST2, O_NONE, O_NONE, P_none }, /* 1236 */ { UD_Ifxch4, O_ST3, O_NONE, O_NONE, P_none }, /* 1237 */ { UD_Ifxch4, O_ST4, O_NONE, O_NONE, P_none }, /* 1238 */ { UD_Ifxch4, O_ST5, O_NONE, O_NONE, P_none }, /* 1239 */ { UD_Ifxch4, O_ST6, O_NONE, O_NONE, P_none }, /* 1240 */ { UD_Ifxch4, O_ST7, O_NONE, O_NONE, P_none }, /* 1241 */ { UD_Ifst, O_ST0, O_NONE, O_NONE, P_none }, /* 1242 */ { UD_Ifst, O_ST1, O_NONE, O_NONE, P_none }, /* 1243 */ { UD_Ifst, O_ST2, O_NONE, O_NONE, P_none }, /* 1244 */ { UD_Ifst, O_ST3, O_NONE, O_NONE, P_none }, /* 1245 */ { UD_Ifst, O_ST4, O_NONE, O_NONE, P_none }, /* 1246 */ { UD_Ifst, O_ST5, O_NONE, O_NONE, P_none }, /* 1247 */ { UD_Ifst, O_ST6, O_NONE, O_NONE, P_none }, /* 1248 */ { UD_Ifst, O_ST7, O_NONE, O_NONE, P_none }, /* 1249 */ { UD_Ifstp, O_ST0, O_NONE, O_NONE, P_none }, /* 1250 */ { UD_Ifstp, O_ST1, O_NONE, O_NONE, P_none }, /* 1251 */ { UD_Ifstp, O_ST2, O_NONE, O_NONE, P_none }, /* 1252 */ { UD_Ifstp, O_ST3, O_NONE, O_NONE, P_none }, /* 1253 */ { UD_Ifstp, O_ST4, O_NONE, O_NONE, P_none }, /* 1254 */ { UD_Ifstp, O_ST5, O_NONE, O_NONE, P_none }, /* 1255 */ { UD_Ifstp, O_ST6, O_NONE, O_NONE, P_none }, /* 1256 */ { UD_Ifstp, O_ST7, O_NONE, O_NONE, P_none }, /* 1257 */ { UD_Ifucom, O_ST0, O_NONE, O_NONE, P_none }, /* 1258 */ { UD_Ifucom, O_ST1, O_NONE, O_NONE, P_none }, /* 1259 */ { UD_Ifucom, O_ST2, O_NONE, O_NONE, P_none }, /* 1260 */ { UD_Ifucom, O_ST3, O_NONE, O_NONE, P_none }, /* 1261 */ { UD_Ifucom, O_ST4, O_NONE, O_NONE, P_none }, /* 1262 */ { UD_Ifucom, O_ST5, O_NONE, O_NONE, P_none }, /* 1263 */ { UD_Ifucom, O_ST6, O_NONE, O_NONE, P_none }, /* 1264 */ { UD_Ifucom, O_ST7, O_NONE, O_NONE, P_none }, /* 1265 */ { UD_Ifucomp, O_ST0, O_NONE, O_NONE, P_none }, /* 1266 */ { UD_Ifucomp, O_ST1, O_NONE, O_NONE, P_none }, /* 1267 */ { UD_Ifucomp, O_ST2, O_NONE, O_NONE, P_none }, /* 1268 */ { UD_Ifucomp, O_ST3, O_NONE, O_NONE, P_none }, /* 1269 */ { UD_Ifucomp, O_ST4, O_NONE, O_NONE, P_none }, /* 1270 */ { UD_Ifucomp, O_ST5, O_NONE, O_NONE, P_none }, /* 1271 */ { UD_Ifucomp, O_ST6, O_NONE, O_NONE, P_none }, /* 1272 */ { UD_Ifucomp, O_ST7, O_NONE, O_NONE, P_none }, /* 1273 */ { UD_Ifiadd, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1274 */ { UD_Ifimul, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1275 */ { UD_Ificom, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1276 */ { UD_Ificomp, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1277 */ { UD_Ifisub, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1278 */ { UD_Ifisubr, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1279 */ { UD_Ifidiv, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1280 */ { UD_Ifidivr, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1281 */ { UD_Ifaddp, O_ST0, O_ST0, O_NONE, P_none }, /* 1282 */ { UD_Ifaddp, O_ST1, O_ST0, O_NONE, P_none }, /* 1283 */ { UD_Ifaddp, O_ST2, O_ST0, O_NONE, P_none }, /* 1284 */ { UD_Ifaddp, O_ST3, O_ST0, O_NONE, P_none }, /* 1285 */ { UD_Ifaddp, O_ST4, O_ST0, O_NONE, P_none }, /* 1286 */ { UD_Ifaddp, O_ST5, O_ST0, O_NONE, P_none }, /* 1287 */ { UD_Ifaddp, O_ST6, O_ST0, O_NONE, P_none }, /* 1288 */ { UD_Ifaddp, O_ST7, O_ST0, O_NONE, P_none }, /* 1289 */ { UD_Ifmulp, O_ST0, O_ST0, O_NONE, P_none }, /* 1290 */ { UD_Ifmulp, O_ST1, O_ST0, O_NONE, P_none }, /* 1291 */ { UD_Ifmulp, O_ST2, O_ST0, O_NONE, P_none }, /* 1292 */ { UD_Ifmulp, O_ST3, O_ST0, O_NONE, P_none }, /* 1293 */ { UD_Ifmulp, O_ST4, O_ST0, O_NONE, P_none }, /* 1294 */ { UD_Ifmulp, O_ST5, O_ST0, O_NONE, P_none }, /* 1295 */ { UD_Ifmulp, O_ST6, O_ST0, O_NONE, P_none }, /* 1296 */ { UD_Ifmulp, O_ST7, O_ST0, O_NONE, P_none }, /* 1297 */ { UD_Ifcomp5, O_ST0, O_NONE, O_NONE, P_none }, /* 1298 */ { UD_Ifcomp5, O_ST1, O_NONE, O_NONE, P_none }, /* 1299 */ { UD_Ifcomp5, O_ST2, O_NONE, O_NONE, P_none }, /* 1300 */ { UD_Ifcomp5, O_ST3, O_NONE, O_NONE, P_none }, /* 1301 */ { UD_Ifcomp5, O_ST4, O_NONE, O_NONE, P_none }, /* 1302 */ { UD_Ifcomp5, O_ST5, O_NONE, O_NONE, P_none }, /* 1303 */ { UD_Ifcomp5, O_ST6, O_NONE, O_NONE, P_none }, /* 1304 */ { UD_Ifcomp5, O_ST7, O_NONE, O_NONE, P_none }, /* 1305 */ { UD_Ifcompp, O_NONE, O_NONE, O_NONE, P_none }, /* 1306 */ { UD_Ifsubrp, O_ST0, O_ST0, O_NONE, P_none }, /* 1307 */ { UD_Ifsubrp, O_ST1, O_ST0, O_NONE, P_none }, /* 1308 */ { UD_Ifsubrp, O_ST2, O_ST0, O_NONE, P_none }, /* 1309 */ { UD_Ifsubrp, O_ST3, O_ST0, O_NONE, P_none }, /* 1310 */ { UD_Ifsubrp, O_ST4, O_ST0, O_NONE, P_none }, /* 1311 */ { UD_Ifsubrp, O_ST5, O_ST0, O_NONE, P_none }, /* 1312 */ { UD_Ifsubrp, O_ST6, O_ST0, O_NONE, P_none }, /* 1313 */ { UD_Ifsubrp, O_ST7, O_ST0, O_NONE, P_none }, /* 1314 */ { UD_Ifsubp, O_ST0, O_ST0, O_NONE, P_none }, /* 1315 */ { UD_Ifsubp, O_ST1, O_ST0, O_NONE, P_none }, /* 1316 */ { UD_Ifsubp, O_ST2, O_ST0, O_NONE, P_none }, /* 1317 */ { UD_Ifsubp, O_ST3, O_ST0, O_NONE, P_none }, /* 1318 */ { UD_Ifsubp, O_ST4, O_ST0, O_NONE, P_none }, /* 1319 */ { UD_Ifsubp, O_ST5, O_ST0, O_NONE, P_none }, /* 1320 */ { UD_Ifsubp, O_ST6, O_ST0, O_NONE, P_none }, /* 1321 */ { UD_Ifsubp, O_ST7, O_ST0, O_NONE, P_none }, /* 1322 */ { UD_Ifdivrp, O_ST0, O_ST0, O_NONE, P_none }, /* 1323 */ { UD_Ifdivrp, O_ST1, O_ST0, O_NONE, P_none }, /* 1324 */ { UD_Ifdivrp, O_ST2, O_ST0, O_NONE, P_none }, /* 1325 */ { UD_Ifdivrp, O_ST3, O_ST0, O_NONE, P_none }, /* 1326 */ { UD_Ifdivrp, O_ST4, O_ST0, O_NONE, P_none }, /* 1327 */ { UD_Ifdivrp, O_ST5, O_ST0, O_NONE, P_none }, /* 1328 */ { UD_Ifdivrp, O_ST6, O_ST0, O_NONE, P_none }, /* 1329 */ { UD_Ifdivrp, O_ST7, O_ST0, O_NONE, P_none }, /* 1330 */ { UD_Ifdivp, O_ST0, O_ST0, O_NONE, P_none }, /* 1331 */ { UD_Ifdivp, O_ST1, O_ST0, O_NONE, P_none }, /* 1332 */ { UD_Ifdivp, O_ST2, O_ST0, O_NONE, P_none }, /* 1333 */ { UD_Ifdivp, O_ST3, O_ST0, O_NONE, P_none }, /* 1334 */ { UD_Ifdivp, O_ST4, O_ST0, O_NONE, P_none }, /* 1335 */ { UD_Ifdivp, O_ST5, O_ST0, O_NONE, P_none }, /* 1336 */ { UD_Ifdivp, O_ST6, O_ST0, O_NONE, P_none }, /* 1337 */ { UD_Ifdivp, O_ST7, O_ST0, O_NONE, P_none }, /* 1338 */ { UD_Ifild, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1339 */ { UD_Ifisttp, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1340 */ { UD_Ifist, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1341 */ { UD_Ifistp, O_Mw, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1342 */ { UD_Ifbld, O_Mt, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1343 */ { UD_Ifild, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1344 */ { UD_Ifbstp, O_Mt, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1345 */ { UD_Ifistp, O_Mq, O_NONE, O_NONE, P_aso|P_rexr|P_rexx|P_rexb }, /* 1346 */ { UD_Iffreep, O_ST0, O_NONE, O_NONE, P_none }, /* 1347 */ { UD_Iffreep, O_ST1, O_NONE, O_NONE, P_none }, /* 1348 */ { UD_Iffreep, O_ST2, O_NONE, O_NONE, P_none }, /* 1349 */ { UD_Iffreep, O_ST3, O_NONE, O_NONE, P_none }, /* 1350 */ { UD_Iffreep, O_ST4, O_NONE, O_NONE, P_none }, /* 1351 */ { UD_Iffreep, O_ST5, O_NONE, O_NONE, P_none }, /* 1352 */ { UD_Iffreep, O_ST6, O_NONE, O_NONE, P_none }, /* 1353 */ { UD_Iffreep, O_ST7, O_NONE, O_NONE, P_none }, /* 1354 */ { UD_Ifxch7, O_ST0, O_NONE, O_NONE, P_none }, /* 1355 */ { UD_Ifxch7, O_ST1, O_NONE, O_NONE, P_none }, /* 1356 */ { UD_Ifxch7, O_ST2, O_NONE, O_NONE, P_none }, /* 1357 */ { UD_Ifxch7, O_ST3, O_NONE, O_NONE, P_none }, /* 1358 */ { UD_Ifxch7, O_ST4, O_NONE, O_NONE, P_none }, /* 1359 */ { UD_Ifxch7, O_ST5, O_NONE, O_NONE, P_none }, /* 1360 */ { UD_Ifxch7, O_ST6, O_NONE, O_NONE, P_none }, /* 1361 */ { UD_Ifxch7, O_ST7, O_NONE, O_NONE, P_none }, /* 1362 */ { UD_Ifstp8, O_ST0, O_NONE, O_NONE, P_none }, /* 1363 */ { UD_Ifstp8, O_ST1, O_NONE, O_NONE, P_none }, /* 1364 */ { UD_Ifstp8, O_ST2, O_NONE, O_NONE, P_none }, /* 1365 */ { UD_Ifstp8, O_ST3, O_NONE, O_NONE, P_none }, /* 1366 */ { UD_Ifstp8, O_ST4, O_NONE, O_NONE, P_none }, /* 1367 */ { UD_Ifstp8, O_ST5, O_NONE, O_NONE, P_none }, /* 1368 */ { UD_Ifstp8, O_ST6, O_NONE, O_NONE, P_none }, /* 1369 */ { UD_Ifstp8, O_ST7, O_NONE, O_NONE, P_none }, /* 1370 */ { UD_Ifstp9, O_ST0, O_NONE, O_NONE, P_none }, /* 1371 */ { UD_Ifstp9, O_ST1, O_NONE, O_NONE, P_none }, /* 1372 */ { UD_Ifstp9, O_ST2, O_NONE, O_NONE, P_none }, /* 1373 */ { UD_Ifstp9, O_ST3, O_NONE, O_NONE, P_none }, /* 1374 */ { UD_Ifstp9, O_ST4, O_NONE, O_NONE, P_none }, /* 1375 */ { UD_Ifstp9, O_ST5, O_NONE, O_NONE, P_none }, /* 1376 */ { UD_Ifstp9, O_ST6, O_NONE, O_NONE, P_none }, /* 1377 */ { UD_Ifstp9, O_ST7, O_NONE, O_NONE, P_none }, /* 1378 */ { UD_Ifnstsw, O_AX, O_NONE, O_NONE, P_none }, /* 1379 */ { UD_Ifucomip, O_ST0, O_ST0, O_NONE, P_none }, /* 1380 */ { UD_Ifucomip, O_ST0, O_ST1, O_NONE, P_none }, /* 1381 */ { UD_Ifucomip, O_ST0, O_ST2, O_NONE, P_none }, /* 1382 */ { UD_Ifucomip, O_ST0, O_ST3, O_NONE, P_none }, /* 1383 */ { UD_Ifucomip, O_ST0, O_ST4, O_NONE, P_none }, /* 1384 */ { UD_Ifucomip, O_ST0, O_ST5, O_NONE, P_none }, /* 1385 */ { UD_Ifucomip, O_ST0, O_ST6, O_NONE, P_none }, /* 1386 */ { UD_Ifucomip, O_ST0, O_ST7, O_NONE, P_none }, /* 1387 */ { UD_Ifcomip, O_ST0, O_ST0, O_NONE, P_none }, /* 1388 */ { UD_Ifcomip, O_ST0, O_ST1, O_NONE, P_none }, /* 1389 */ { UD_Ifcomip, O_ST0, O_ST2, O_NONE, P_none }, /* 1390 */ { UD_Ifcomip, O_ST0, O_ST3, O_NONE, P_none }, /* 1391 */ { UD_Ifcomip, O_ST0, O_ST4, O_NONE, P_none }, /* 1392 */ { UD_Ifcomip, O_ST0, O_ST5, O_NONE, P_none }, /* 1393 */ { UD_Ifcomip, O_ST0, O_ST6, O_NONE, P_none }, /* 1394 */ { UD_Ifcomip, O_ST0, O_ST7, O_NONE, P_none }, /* 1395 */ { UD_Iloopne, O_Jb, O_NONE, O_NONE, P_none }, /* 1396 */ { UD_Iloope, O_Jb, O_NONE, O_NONE, P_none }, /* 1397 */ { UD_Iloop, O_Jb, O_NONE, O_NONE, P_none }, /* 1398 */ { UD_Ijcxz, O_Jb, O_NONE, O_NONE, P_aso }, /* 1399 */ { UD_Ijecxz, O_Jb, O_NONE, O_NONE, P_aso }, /* 1400 */ { UD_Ijrcxz, O_Jb, O_NONE, O_NONE, P_aso }, /* 1401 */ { UD_Iin, O_AL, O_Ib, O_NONE, P_none }, /* 1402 */ { UD_Iin, O_eAX, O_Ib, O_NONE, P_oso }, /* 1403 */ { UD_Iout, O_Ib, O_AL, O_NONE, P_none }, /* 1404 */ { UD_Iout, O_Ib, O_eAX, O_NONE, P_oso }, /* 1405 */ { UD_Icall, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 1406 */ { UD_Ijmp, O_Jz, O_NONE, O_NONE, P_oso|P_def64 }, /* 1407 */ { UD_Ijmp, O_Av, O_NONE, O_NONE, P_oso }, /* 1408 */ { UD_Ijmp, O_Jb, O_NONE, O_NONE, P_def64 }, /* 1409 */ { UD_Iin, O_AL, O_DX, O_NONE, P_none }, /* 1410 */ { UD_Iin, O_eAX, O_DX, O_NONE, P_oso }, /* 1411 */ { UD_Iout, O_DX, O_AL, O_NONE, P_none }, /* 1412 */ { UD_Iout, O_DX, O_eAX, O_NONE, P_oso }, /* 1413 */ { UD_Ilock, O_NONE, O_NONE, O_NONE, P_none }, /* 1414 */ { UD_Iint1, O_NONE, O_NONE, O_NONE, P_none }, /* 1415 */ { UD_Irepne, O_NONE, O_NONE, O_NONE, P_none }, /* 1416 */ { UD_Irep, O_NONE, O_NONE, O_NONE, P_none }, /* 1417 */ { UD_Ihlt, O_NONE, O_NONE, O_NONE, P_none }, /* 1418 */ { UD_Icmc, O_NONE, O_NONE, O_NONE, P_none }, /* 1419 */ { UD_Itest, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1420 */ { UD_Itest, O_Eb, O_Ib, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1421 */ { UD_Inot, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1422 */ { UD_Ineg, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1423 */ { UD_Imul, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1424 */ { UD_Iimul, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1425 */ { UD_Idiv, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1426 */ { UD_Iidiv, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1427 */ { UD_Itest, O_Ev, O_sIz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1428 */ { UD_Itest, O_Ev, O_Iz, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1429 */ { UD_Inot, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1430 */ { UD_Ineg, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1431 */ { UD_Imul, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1432 */ { UD_Iimul, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1433 */ { UD_Idiv, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1434 */ { UD_Iidiv, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1435 */ { UD_Iclc, O_NONE, O_NONE, O_NONE, P_none }, /* 1436 */ { UD_Istc, O_NONE, O_NONE, O_NONE, P_none }, /* 1437 */ { UD_Icli, O_NONE, O_NONE, O_NONE, P_none }, /* 1438 */ { UD_Isti, O_NONE, O_NONE, O_NONE, P_none }, /* 1439 */ { UD_Icld, O_NONE, O_NONE, O_NONE, P_none }, /* 1440 */ { UD_Istd, O_NONE, O_NONE, O_NONE, P_none }, /* 1441 */ { UD_Iinc, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1442 */ { UD_Idec, O_Eb, O_NONE, O_NONE, P_aso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1443 */ { UD_Iinc, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1444 */ { UD_Idec, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1445 */ { UD_Icall, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1446 */ { UD_Icall, O_Eq, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb|P_def64 }, /* 1447 */ { UD_Icall, O_Fv, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1448 */ { UD_Ijmp, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb|P_def64 }, /* 1449 */ { UD_Ijmp, O_Fv, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb }, /* 1450 */ { UD_Ipush, O_Ev, O_NONE, O_NONE, P_aso|P_oso|P_rexw|P_rexr|P_rexx|P_rexb|P_def64 }, }; const char * ud_mnemonics_str[] = { "invalid", "3dnow", "none", "db", "pause", "aaa", "aad", "aam", "aas", "adc", "add", "addpd", "addps", "addsd", "addss", "and", "andpd", "andps", "andnpd", "andnps", "arpl", "movsxd", "bound", "bsf", "bsr", "bswap", "bt", "btc", "btr", "bts", "call", "cbw", "cwde", "cdqe", "clc", "cld", "clflush", "clgi", "cli", "clts", "cmc", "cmovo", "cmovno", "cmovb", "cmovae", "cmovz", "cmovnz", "cmovbe", "cmova", "cmovs", "cmovns", "cmovp", "cmovnp", "cmovl", "cmovge", "cmovle", "cmovg", "cmp", "cmppd", "cmpps", "cmpsb", "cmpsw", "cmpsd", "cmpsq", "cmpss", "cmpxchg", "cmpxchg8b", "cmpxchg16b", "comisd", "comiss", "cpuid", "cvtdq2pd", "cvtdq2ps", "cvtpd2dq", "cvtpd2pi", "cvtpd2ps", "cvtpi2ps", "cvtpi2pd", "cvtps2dq", "cvtps2pi", "cvtps2pd", "cvtsd2si", "cvtsd2ss", "cvtsi2ss", "cvtss2si", "cvtss2sd", "cvttpd2pi", "cvttpd2dq", "cvttps2dq", "cvttps2pi", "cvttsd2si", "cvtsi2sd", "cvttss2si", "cwd", "cdq", "cqo", "daa", "das", "dec", "div", "divpd", "divps", "divsd", "divss", "emms", "enter", "f2xm1", "fabs", "fadd", "faddp", "fbld", "fbstp", "fchs", "fclex", "fcmovb", "fcmove", "fcmovbe", "fcmovu", "fcmovnb", "fcmovne", "fcmovnbe", "fcmovnu", "fucomi", "fcom", "fcom2", "fcomp3", "fcomi", "fucomip", "fcomip", "fcomp", "fcomp5", "fcompp", "fcos", "fdecstp", "fdiv", "fdivp", "fdivr", "fdivrp", "femms", "ffree", "ffreep", "ficom", "ficomp", "fild", "fincstp", "fninit", "fiadd", "fidivr", "fidiv", "fisub", "fisubr", "fist", "fistp", "fisttp", "fld", "fld1", "fldl2t", "fldl2e", "fldpi", "fldlg2", "fldln2", "fldz", "fldcw", "fldenv", "fmul", "fmulp", "fimul", "fnop", "fpatan", "fprem", "fprem1", "fptan", "frndint", "frstor", "fnsave", "fscale", "fsin", "fsincos", "fsqrt", "fstp", "fstp1", "fstp8", "fstp9", "fst", "fnstcw", "fnstenv", "fnstsw", "fsub", "fsubp", "fsubr", "fsubrp", "ftst", "fucom", "fucomp", "fucompp", "fxam", "fxch", "fxch4", "fxch7", "fxrstor", "fxsave", "fxtract", "fyl2x", "fyl2xp1", "hlt", "idiv", "in", "imul", "inc", "insb", "insw", "insd", "int1", "int3", "int", "into", "invd", "invept", "invlpg", "invlpga", "invvpid", "iretw", "iretd", "iretq", "jo", "jno", "jb", "jae", "jz", "jnz", "jbe", "ja", "js", "jns", "jp", "jnp", "jl", "jge", "jle", "jg", "jcxz", "jecxz", "jrcxz", "jmp", "lahf", "lar", "lddqu", "ldmxcsr", "lds", "lea", "les", "lfs", "lgs", "lidt", "lss", "leave", "lfence", "lgdt", "lldt", "lmsw", "lock", "lodsb", "lodsw", "lodsd", "lodsq", "loopne", "loope", "loop", "lsl", "ltr", "maskmovq", "maxpd", "maxps", "maxsd", "maxss", "mfence", "minpd", "minps", "minsd", "minss", "monitor", "montmul", "mov", "movapd", "movaps", "movd", "movhpd", "movhps", "movlhps", "movlpd", "movlps", "movhlps", "movmskpd", "movmskps", "movntdq", "movnti", "movntpd", "movntps", "movntq", "movq", "movsb", "movsw", "movsd", "movsq", "movss", "movsx", "movupd", "movups", "movzx", "mul", "mulpd", "mulps", "mulsd", "mulss", "mwait", "neg", "nop", "not", "or", "orpd", "orps", "out", "outsb", "outsw", "outsd", "packsswb", "packssdw", "packuswb", "paddb", "paddw", "paddd", "paddsb", "paddsw", "paddusb", "paddusw", "pand", "pandn", "pavgb", "pavgw", "pcmpeqb", "pcmpeqw", "pcmpeqd", "pcmpgtb", "pcmpgtw", "pcmpgtd", "pextrb", "pextrd", "pextrq", "pextrw", "pinsrb", "pinsrw", "pinsrd", "pinsrq", "pmaddwd", "pmaxsw", "pmaxub", "pminsw", "pminub", "pmovmskb", "pmulhuw", "pmulhw", "pmullw", "pop", "popa", "popad", "popfw", "popfd", "popfq", "por", "prefetch", "prefetchnta", "prefetcht0", "prefetcht1", "prefetcht2", "psadbw", "pshufw", "psllw", "pslld", "psllq", "psraw", "psrad", "psrlw", "psrld", "psrlq", "psubb", "psubw", "psubd", "psubsb", "psubsw", "psubusb", "psubusw", "punpckhbw", "punpckhwd", "punpckhdq", "punpcklbw", "punpcklwd", "punpckldq", "pi2fw", "pi2fd", "pf2iw", "pf2id", "pfnacc", "pfpnacc", "pfcmpge", "pfmin", "pfrcp", "pfrsqrt", "pfsub", "pfadd", "pfcmpgt", "pfmax", "pfrcpit1", "pfrsqit1", "pfsubr", "pfacc", "pfcmpeq", "pfmul", "pfrcpit2", "pmulhrw", "pswapd", "pavgusb", "push", "pusha", "pushad", "pushfw", "pushfd", "pushfq", "pxor", "rcl", "rcr", "rol", "ror", "rcpps", "rcpss", "rdmsr", "rdpmc", "rdtsc", "rdtscp", "repne", "rep", "ret", "retf", "rsm", "rsqrtps", "rsqrtss", "sahf", "salc", "sar", "shl", "shr", "sbb", "scasb", "scasw", "scasd", "scasq", "seto", "setno", "setb", "setae", "setz", "setnz", "setbe", "seta", "sets", "setns", "setp", "setnp", "setl", "setge", "setle", "setg", "sfence", "sgdt", "shld", "shrd", "shufpd", "shufps", "sidt", "sldt", "smsw", "sqrtps", "sqrtpd", "sqrtsd", "sqrtss", "stc", "std", "stgi", "sti", "skinit", "stmxcsr", "stosb", "stosw", "stosd", "stosq", "str", "sub", "subpd", "subps", "subsd", "subss", "swapgs", "syscall", "sysenter", "sysexit", "sysret", "test", "ucomisd", "ucomiss", "ud2", "unpckhpd", "unpckhps", "unpcklps", "unpcklpd", "verr", "verw", "vmcall", "vmclear", "vmxon", "vmptrld", "vmptrst", "vmlaunch", "vmresume", "vmxoff", "vmread", "vmwrite", "vmrun", "vmmcall", "vmload", "vmsave", "wait", "wbinvd", "wrmsr", "xadd", "xchg", "xgetbv", "xlatb", "xor", "xorpd", "xorps", "xcryptecb", "xcryptcbc", "xcryptctr", "xcryptcfb", "xcryptofb", "xrstor", "xsave", "xsetbv", "xsha1", "xsha256", "xstore", "aesdec", "aesdeclast", "aesenc", "aesenclast", "aesimc", "aeskeygenassist", "pclmulqdq", "getsec", "movdqa", "maskmovdqu", "movdq2q", "movdqu", "movq2dq", "paddq", "psubq", "pmuludq", "pshufhw", "pshuflw", "pshufd", "pslldq", "psrldq", "punpckhqdq", "punpcklqdq", "addsubpd", "addsubps", "haddpd", "haddps", "hsubpd", "hsubps", "movddup", "movshdup", "movsldup", "pabsb", "pabsw", "pabsd", "pshufb", "phaddw", "phaddd", "phaddsw", "pmaddubsw", "phsubw", "phsubd", "phsubsw", "psignb", "psignd", "psignw", "pmulhrsw", "palignr", "pblendvb", "pmuldq", "pminsb", "pminsd", "pminuw", "pminud", "pmaxsb", "pmaxsd", "pmaxud", "pmaxuw", "pmulld", "phminposuw", "roundps", "roundpd", "roundss", "roundsd", "blendpd", "pblendw", "blendps", "blendvpd", "blendvps", "dpps", "dppd", "mpsadbw", "extractps", "insertps", "movntdqa", "packusdw", "pmovsxbw", "pmovsxbd", "pmovsxbq", "pmovsxwd", "pmovsxwq", "pmovsxdq", "pmovzxbw", "pmovzxbd", "pmovzxbq", "pmovzxwd", "pmovzxwq", "pmovzxdq", "pcmpeqq", "popcnt", "ptest", "pcmpestri", "pcmpestrm", "pcmpgtq", "pcmpistri", "pcmpistrm", "movbe", "crc32" }; readpe-0.84/lib/libudis86/libudis86/itab.h000066400000000000000000000247621455661113700202110ustar00rootroot00000000000000#ifndef UD_ITAB_H #define UD_ITAB_H /* itab.h -- generated by udis86:scripts/ud_itab.py, do no edit */ /* ud_table_type -- lookup table types (see decode.c) */ enum ud_table_type { UD_TAB__OPC_TABLE, UD_TAB__OPC_X87, UD_TAB__OPC_MOD, UD_TAB__OPC_VEX_M, UD_TAB__OPC_VEX_P, UD_TAB__OPC_RM, UD_TAB__OPC_VENDOR, UD_TAB__OPC_OSIZE, UD_TAB__OPC_MODE, UD_TAB__OPC_3DNOW, UD_TAB__OPC_REG, UD_TAB__OPC_ASIZE, UD_TAB__OPC_SSE }; /* ud_mnemonic -- mnemonic constants */ enum ud_mnemonic_code { UD_Iinvalid, UD_I3dnow, UD_Inone, UD_Idb, UD_Ipause, UD_Iaaa, UD_Iaad, UD_Iaam, UD_Iaas, UD_Iadc, UD_Iadd, UD_Iaddpd, UD_Iaddps, UD_Iaddsd, UD_Iaddss, UD_Iand, UD_Iandpd, UD_Iandps, UD_Iandnpd, UD_Iandnps, UD_Iarpl, UD_Imovsxd, UD_Ibound, UD_Ibsf, UD_Ibsr, UD_Ibswap, UD_Ibt, UD_Ibtc, UD_Ibtr, UD_Ibts, UD_Icall, UD_Icbw, UD_Icwde, UD_Icdqe, UD_Iclc, UD_Icld, UD_Iclflush, UD_Iclgi, UD_Icli, UD_Iclts, UD_Icmc, UD_Icmovo, UD_Icmovno, UD_Icmovb, UD_Icmovae, UD_Icmovz, UD_Icmovnz, UD_Icmovbe, UD_Icmova, UD_Icmovs, UD_Icmovns, UD_Icmovp, UD_Icmovnp, UD_Icmovl, UD_Icmovge, UD_Icmovle, UD_Icmovg, UD_Icmp, UD_Icmppd, UD_Icmpps, UD_Icmpsb, UD_Icmpsw, UD_Icmpsd, UD_Icmpsq, UD_Icmpss, UD_Icmpxchg, UD_Icmpxchg8b, UD_Icmpxchg16b, UD_Icomisd, UD_Icomiss, UD_Icpuid, UD_Icvtdq2pd, UD_Icvtdq2ps, UD_Icvtpd2dq, UD_Icvtpd2pi, UD_Icvtpd2ps, UD_Icvtpi2ps, UD_Icvtpi2pd, UD_Icvtps2dq, UD_Icvtps2pi, UD_Icvtps2pd, UD_Icvtsd2si, UD_Icvtsd2ss, UD_Icvtsi2ss, UD_Icvtss2si, UD_Icvtss2sd, UD_Icvttpd2pi, UD_Icvttpd2dq, UD_Icvttps2dq, UD_Icvttps2pi, UD_Icvttsd2si, UD_Icvtsi2sd, UD_Icvttss2si, UD_Icwd, UD_Icdq, UD_Icqo, UD_Idaa, UD_Idas, UD_Idec, UD_Idiv, UD_Idivpd, UD_Idivps, UD_Idivsd, UD_Idivss, UD_Iemms, UD_Ienter, UD_If2xm1, UD_Ifabs, UD_Ifadd, UD_Ifaddp, UD_Ifbld, UD_Ifbstp, UD_Ifchs, UD_Ifclex, UD_Ifcmovb, UD_Ifcmove, UD_Ifcmovbe, UD_Ifcmovu, UD_Ifcmovnb, UD_Ifcmovne, UD_Ifcmovnbe, UD_Ifcmovnu, UD_Ifucomi, UD_Ifcom, UD_Ifcom2, UD_Ifcomp3, UD_Ifcomi, UD_Ifucomip, UD_Ifcomip, UD_Ifcomp, UD_Ifcomp5, UD_Ifcompp, UD_Ifcos, UD_Ifdecstp, UD_Ifdiv, UD_Ifdivp, UD_Ifdivr, UD_Ifdivrp, UD_Ifemms, UD_Iffree, UD_Iffreep, UD_Ificom, UD_Ificomp, UD_Ifild, UD_Ifincstp, UD_Ifninit, UD_Ifiadd, UD_Ifidivr, UD_Ifidiv, UD_Ifisub, UD_Ifisubr, UD_Ifist, UD_Ifistp, UD_Ifisttp, UD_Ifld, UD_Ifld1, UD_Ifldl2t, UD_Ifldl2e, UD_Ifldpi, UD_Ifldlg2, UD_Ifldln2, UD_Ifldz, UD_Ifldcw, UD_Ifldenv, UD_Ifmul, UD_Ifmulp, UD_Ifimul, UD_Ifnop, UD_Ifpatan, UD_Ifprem, UD_Ifprem1, UD_Ifptan, UD_Ifrndint, UD_Ifrstor, UD_Ifnsave, UD_Ifscale, UD_Ifsin, UD_Ifsincos, UD_Ifsqrt, UD_Ifstp, UD_Ifstp1, UD_Ifstp8, UD_Ifstp9, UD_Ifst, UD_Ifnstcw, UD_Ifnstenv, UD_Ifnstsw, UD_Ifsub, UD_Ifsubp, UD_Ifsubr, UD_Ifsubrp, UD_Iftst, UD_Ifucom, UD_Ifucomp, UD_Ifucompp, UD_Ifxam, UD_Ifxch, UD_Ifxch4, UD_Ifxch7, UD_Ifxrstor, UD_Ifxsave, UD_Ifxtract, UD_Ifyl2x, UD_Ifyl2xp1, UD_Ihlt, UD_Iidiv, UD_Iin, UD_Iimul, UD_Iinc, UD_Iinsb, UD_Iinsw, UD_Iinsd, UD_Iint1, UD_Iint3, UD_Iint, UD_Iinto, UD_Iinvd, UD_Iinvept, UD_Iinvlpg, UD_Iinvlpga, UD_Iinvvpid, UD_Iiretw, UD_Iiretd, UD_Iiretq, UD_Ijo, UD_Ijno, UD_Ijb, UD_Ijae, UD_Ijz, UD_Ijnz, UD_Ijbe, UD_Ija, UD_Ijs, UD_Ijns, UD_Ijp, UD_Ijnp, UD_Ijl, UD_Ijge, UD_Ijle, UD_Ijg, UD_Ijcxz, UD_Ijecxz, UD_Ijrcxz, UD_Ijmp, UD_Ilahf, UD_Ilar, UD_Ilddqu, UD_Ildmxcsr, UD_Ilds, UD_Ilea, UD_Iles, UD_Ilfs, UD_Ilgs, UD_Ilidt, UD_Ilss, UD_Ileave, UD_Ilfence, UD_Ilgdt, UD_Illdt, UD_Ilmsw, UD_Ilock, UD_Ilodsb, UD_Ilodsw, UD_Ilodsd, UD_Ilodsq, UD_Iloopne, UD_Iloope, UD_Iloop, UD_Ilsl, UD_Iltr, UD_Imaskmovq, UD_Imaxpd, UD_Imaxps, UD_Imaxsd, UD_Imaxss, UD_Imfence, UD_Iminpd, UD_Iminps, UD_Iminsd, UD_Iminss, UD_Imonitor, UD_Imontmul, UD_Imov, UD_Imovapd, UD_Imovaps, UD_Imovd, UD_Imovhpd, UD_Imovhps, UD_Imovlhps, UD_Imovlpd, UD_Imovlps, UD_Imovhlps, UD_Imovmskpd, UD_Imovmskps, UD_Imovntdq, UD_Imovnti, UD_Imovntpd, UD_Imovntps, UD_Imovntq, UD_Imovq, UD_Imovsb, UD_Imovsw, UD_Imovsd, UD_Imovsq, UD_Imovss, UD_Imovsx, UD_Imovupd, UD_Imovups, UD_Imovzx, UD_Imul, UD_Imulpd, UD_Imulps, UD_Imulsd, UD_Imulss, UD_Imwait, UD_Ineg, UD_Inop, UD_Inot, UD_Ior, UD_Iorpd, UD_Iorps, UD_Iout, UD_Ioutsb, UD_Ioutsw, UD_Ioutsd, UD_Ipacksswb, UD_Ipackssdw, UD_Ipackuswb, UD_Ipaddb, UD_Ipaddw, UD_Ipaddd, UD_Ipaddsb, UD_Ipaddsw, UD_Ipaddusb, UD_Ipaddusw, UD_Ipand, UD_Ipandn, UD_Ipavgb, UD_Ipavgw, UD_Ipcmpeqb, UD_Ipcmpeqw, UD_Ipcmpeqd, UD_Ipcmpgtb, UD_Ipcmpgtw, UD_Ipcmpgtd, UD_Ipextrb, UD_Ipextrd, UD_Ipextrq, UD_Ipextrw, UD_Ipinsrb, UD_Ipinsrw, UD_Ipinsrd, UD_Ipinsrq, UD_Ipmaddwd, UD_Ipmaxsw, UD_Ipmaxub, UD_Ipminsw, UD_Ipminub, UD_Ipmovmskb, UD_Ipmulhuw, UD_Ipmulhw, UD_Ipmullw, UD_Ipop, UD_Ipopa, UD_Ipopad, UD_Ipopfw, UD_Ipopfd, UD_Ipopfq, UD_Ipor, UD_Iprefetch, UD_Iprefetchnta, UD_Iprefetcht0, UD_Iprefetcht1, UD_Iprefetcht2, UD_Ipsadbw, UD_Ipshufw, UD_Ipsllw, UD_Ipslld, UD_Ipsllq, UD_Ipsraw, UD_Ipsrad, UD_Ipsrlw, UD_Ipsrld, UD_Ipsrlq, UD_Ipsubb, UD_Ipsubw, UD_Ipsubd, UD_Ipsubsb, UD_Ipsubsw, UD_Ipsubusb, UD_Ipsubusw, UD_Ipunpckhbw, UD_Ipunpckhwd, UD_Ipunpckhdq, UD_Ipunpcklbw, UD_Ipunpcklwd, UD_Ipunpckldq, UD_Ipi2fw, UD_Ipi2fd, UD_Ipf2iw, UD_Ipf2id, UD_Ipfnacc, UD_Ipfpnacc, UD_Ipfcmpge, UD_Ipfmin, UD_Ipfrcp, UD_Ipfrsqrt, UD_Ipfsub, UD_Ipfadd, UD_Ipfcmpgt, UD_Ipfmax, UD_Ipfrcpit1, UD_Ipfrsqit1, UD_Ipfsubr, UD_Ipfacc, UD_Ipfcmpeq, UD_Ipfmul, UD_Ipfrcpit2, UD_Ipmulhrw, UD_Ipswapd, UD_Ipavgusb, UD_Ipush, UD_Ipusha, UD_Ipushad, UD_Ipushfw, UD_Ipushfd, UD_Ipushfq, UD_Ipxor, UD_Ircl, UD_Ircr, UD_Irol, UD_Iror, UD_Ircpps, UD_Ircpss, UD_Irdmsr, UD_Irdpmc, UD_Irdtsc, UD_Irdtscp, UD_Irepne, UD_Irep, UD_Iret, UD_Iretf, UD_Irsm, UD_Irsqrtps, UD_Irsqrtss, UD_Isahf, UD_Isalc, UD_Isar, UD_Ishl, UD_Ishr, UD_Isbb, UD_Iscasb, UD_Iscasw, UD_Iscasd, UD_Iscasq, UD_Iseto, UD_Isetno, UD_Isetb, UD_Isetae, UD_Isetz, UD_Isetnz, UD_Isetbe, UD_Iseta, UD_Isets, UD_Isetns, UD_Isetp, UD_Isetnp, UD_Isetl, UD_Isetge, UD_Isetle, UD_Isetg, UD_Isfence, UD_Isgdt, UD_Ishld, UD_Ishrd, UD_Ishufpd, UD_Ishufps, UD_Isidt, UD_Isldt, UD_Ismsw, UD_Isqrtps, UD_Isqrtpd, UD_Isqrtsd, UD_Isqrtss, UD_Istc, UD_Istd, UD_Istgi, UD_Isti, UD_Iskinit, UD_Istmxcsr, UD_Istosb, UD_Istosw, UD_Istosd, UD_Istosq, UD_Istr, UD_Isub, UD_Isubpd, UD_Isubps, UD_Isubsd, UD_Isubss, UD_Iswapgs, UD_Isyscall, UD_Isysenter, UD_Isysexit, UD_Isysret, UD_Itest, UD_Iucomisd, UD_Iucomiss, UD_Iud2, UD_Iunpckhpd, UD_Iunpckhps, UD_Iunpcklps, UD_Iunpcklpd, UD_Iverr, UD_Iverw, UD_Ivmcall, UD_Ivmclear, UD_Ivmxon, UD_Ivmptrld, UD_Ivmptrst, UD_Ivmlaunch, UD_Ivmresume, UD_Ivmxoff, UD_Ivmread, UD_Ivmwrite, UD_Ivmrun, UD_Ivmmcall, UD_Ivmload, UD_Ivmsave, UD_Iwait, UD_Iwbinvd, UD_Iwrmsr, UD_Ixadd, UD_Ixchg, UD_Ixgetbv, UD_Ixlatb, UD_Ixor, UD_Ixorpd, UD_Ixorps, UD_Ixcryptecb, UD_Ixcryptcbc, UD_Ixcryptctr, UD_Ixcryptcfb, UD_Ixcryptofb, UD_Ixrstor, UD_Ixsave, UD_Ixsetbv, UD_Ixsha1, UD_Ixsha256, UD_Ixstore, UD_Iaesdec, UD_Iaesdeclast, UD_Iaesenc, UD_Iaesenclast, UD_Iaesimc, UD_Iaeskeygenassist, UD_Ipclmulqdq, UD_Igetsec, UD_Imovdqa, UD_Imaskmovdqu, UD_Imovdq2q, UD_Imovdqu, UD_Imovq2dq, UD_Ipaddq, UD_Ipsubq, UD_Ipmuludq, UD_Ipshufhw, UD_Ipshuflw, UD_Ipshufd, UD_Ipslldq, UD_Ipsrldq, UD_Ipunpckhqdq, UD_Ipunpcklqdq, UD_Iaddsubpd, UD_Iaddsubps, UD_Ihaddpd, UD_Ihaddps, UD_Ihsubpd, UD_Ihsubps, UD_Imovddup, UD_Imovshdup, UD_Imovsldup, UD_Ipabsb, UD_Ipabsw, UD_Ipabsd, UD_Ipshufb, UD_Iphaddw, UD_Iphaddd, UD_Iphaddsw, UD_Ipmaddubsw, UD_Iphsubw, UD_Iphsubd, UD_Iphsubsw, UD_Ipsignb, UD_Ipsignd, UD_Ipsignw, UD_Ipmulhrsw, UD_Ipalignr, UD_Ipblendvb, UD_Ipmuldq, UD_Ipminsb, UD_Ipminsd, UD_Ipminuw, UD_Ipminud, UD_Ipmaxsb, UD_Ipmaxsd, UD_Ipmaxud, UD_Ipmaxuw, UD_Ipmulld, UD_Iphminposuw, UD_Iroundps, UD_Iroundpd, UD_Iroundss, UD_Iroundsd, UD_Iblendpd, UD_Ipblendw, UD_Iblendps, UD_Iblendvpd, UD_Iblendvps, UD_Idpps, UD_Idppd, UD_Impsadbw, UD_Iextractps, UD_Iinsertps, UD_Imovntdqa, UD_Ipackusdw, UD_Ipmovsxbw, UD_Ipmovsxbd, UD_Ipmovsxbq, UD_Ipmovsxwd, UD_Ipmovsxwq, UD_Ipmovsxdq, UD_Ipmovzxbw, UD_Ipmovzxbd, UD_Ipmovzxbq, UD_Ipmovzxwd, UD_Ipmovzxwq, UD_Ipmovzxdq, UD_Ipcmpeqq, UD_Ipopcnt, UD_Iptest, UD_Ipcmpestri, UD_Ipcmpestrm, UD_Ipcmpgtq, UD_Ipcmpistri, UD_Ipcmpistrm, UD_Imovbe, UD_Icrc32, UD_MAX_MNEMONIC_CODE } UD_ATTR_PACKED; extern const char * ud_mnemonics_str[]; #endif /* UD_ITAB_H */ readpe-0.84/lib/libudis86/libudis86/syn-att.c000066400000000000000000000134141455661113700206540ustar00rootroot00000000000000/* udis86 - libudis86/syn-att.c * * Copyright (c) 2002-2009 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "types.h" #include "extern.h" #include "decode.h" #include "itab.h" #include "syn.h" #include "udint.h" /* ----------------------------------------------------------------------------- * opr_cast() - Prints an operand cast. * ----------------------------------------------------------------------------- */ static void opr_cast(struct ud* u, struct ud_operand* op) { switch(op->size) { case 16 : case 32 : ud_asmprintf(u, "*"); break; default: break; } } /* ----------------------------------------------------------------------------- * gen_operand() - Generates assembly output for each operand. * ----------------------------------------------------------------------------- */ static void gen_operand(struct ud* u, struct ud_operand* op) { switch(op->type) { case UD_OP_CONST: ud_asmprintf(u, "$0x%x", op->lval.udword); break; case UD_OP_REG: ud_asmprintf(u, "%%%s", ud_reg_tab[op->base - UD_R_AL]); break; case UD_OP_MEM: if (u->br_far) { opr_cast(u, op); } if (u->pfx_seg) { ud_asmprintf(u, "%%%s:", ud_reg_tab[u->pfx_seg - UD_R_AL]); } if (op->offset != 0) { ud_syn_print_mem_disp(u, op, 0); } if (op->base) { ud_asmprintf(u, "(%%%s", ud_reg_tab[op->base - UD_R_AL]); } if (op->index) { if (op->base) { ud_asmprintf(u, ","); } else { ud_asmprintf(u, "("); } ud_asmprintf(u, "%%%s", ud_reg_tab[op->index - UD_R_AL]); } if (op->scale) { ud_asmprintf(u, ",%d", op->scale); } if (op->base || op->index) { ud_asmprintf(u, ")"); } break; case UD_OP_IMM: ud_asmprintf(u, "$"); ud_syn_print_imm(u, op); break; case UD_OP_JIMM: ud_syn_print_addr(u, ud_syn_rel_target(u, op)); break; case UD_OP_PTR: switch (op->size) { case 32: ud_asmprintf(u, "$0x%x, $0x%x", op->lval.ptr.seg, op->lval.ptr.off & 0xFFFF); break; case 48: ud_asmprintf(u, "$0x%x, $0x%x", op->lval.ptr.seg, op->lval.ptr.off); break; } break; default: return; } } /* ============================================================================= * translates to AT&T syntax * ============================================================================= */ extern void ud_translate_att(struct ud *u) { int size = 0; int star = 0; /* check if P_OSO prefix is used */ if (! P_OSO(u->itab_entry->prefix) && u->pfx_opr) { switch (u->dis_mode) { case 16: ud_asmprintf(u, "o32 "); break; case 32: case 64: ud_asmprintf(u, "o16 "); break; } } /* check if P_ASO prefix was used */ if (! P_ASO(u->itab_entry->prefix) && u->pfx_adr) { switch (u->dis_mode) { case 16: ud_asmprintf(u, "a32 "); break; case 32: ud_asmprintf(u, "a16 "); break; case 64: ud_asmprintf(u, "a32 "); break; } } if (u->pfx_lock) ud_asmprintf(u, "lock "); if (u->pfx_rep) { ud_asmprintf(u, "rep "); } else if (u->pfx_rep) { ud_asmprintf(u, "repe "); } else if (u->pfx_repne) { ud_asmprintf(u, "repne "); } /* special instructions */ switch (u->mnemonic) { case UD_Iretf: ud_asmprintf(u, "lret "); break; case UD_Idb: ud_asmprintf(u, ".byte 0x%x", u->operand[0].lval.ubyte); return; case UD_Ijmp: case UD_Icall: if (u->br_far) ud_asmprintf(u, "l"); if (u->operand[0].type == UD_OP_REG) { star = 1; } ud_asmprintf(u, "%s", ud_lookup_mnemonic(u->mnemonic)); break; case UD_Ibound: case UD_Ienter: if (u->operand[0].type != UD_NONE) gen_operand(u, &u->operand[0]); if (u->operand[1].type != UD_NONE) { ud_asmprintf(u, ","); gen_operand(u, &u->operand[1]); } return; default: ud_asmprintf(u, "%s", ud_lookup_mnemonic(u->mnemonic)); } if (size == 8) ud_asmprintf(u, "b"); else if (size == 16) ud_asmprintf(u, "w"); else if (size == 64) ud_asmprintf(u, "q"); if (star) { ud_asmprintf(u, " *"); } else { ud_asmprintf(u, " "); } if (u->operand[2].type != UD_NONE) { gen_operand(u, &u->operand[2]); ud_asmprintf(u, ", "); } if (u->operand[1].type != UD_NONE) { gen_operand(u, &u->operand[1]); ud_asmprintf(u, ", "); } if (u->operand[0].type != UD_NONE) gen_operand(u, &u->operand[0]); } /* vim: set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/libudis86/syn-intel.c000066400000000000000000000143341455661113700212010ustar00rootroot00000000000000/* udis86 - libudis86/syn-intel.c * * Copyright (c) 2002-2013 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "types.h" #include "extern.h" #include "decode.h" #include "itab.h" #include "syn.h" #include "udint.h" /* ----------------------------------------------------------------------------- * opr_cast() - Prints an operand cast. * ----------------------------------------------------------------------------- */ static void opr_cast(struct ud* u, struct ud_operand* op) { if (u->br_far) { ud_asmprintf(u, "far "); } switch(op->size) { case 8: ud_asmprintf(u, "byte " ); break; case 16: ud_asmprintf(u, "word " ); break; case 32: ud_asmprintf(u, "dword "); break; case 64: ud_asmprintf(u, "qword "); break; case 80: ud_asmprintf(u, "tword "); break; default: break; } } /* ----------------------------------------------------------------------------- * gen_operand() - Generates assembly output for each operand. * ----------------------------------------------------------------------------- */ static void gen_operand(struct ud* u, struct ud_operand* op, int syn_cast) { switch(op->type) { case UD_OP_REG: ud_asmprintf(u, "%s", ud_reg_tab[op->base - UD_R_AL]); break; case UD_OP_MEM: if (syn_cast) { opr_cast(u, op); } ud_asmprintf(u, "["); if (u->pfx_seg) { ud_asmprintf(u, "%s:", ud_reg_tab[u->pfx_seg - UD_R_AL]); } if (op->base) { ud_asmprintf(u, "%s", ud_reg_tab[op->base - UD_R_AL]); } if (op->index) { ud_asmprintf(u, "%s%s", op->base != UD_NONE? "+" : "", ud_reg_tab[op->index - UD_R_AL]); if (op->scale) { ud_asmprintf(u, "*%d", op->scale); } } if (op->offset != 0) { ud_syn_print_mem_disp(u, op, (op->base != UD_NONE || op->index != UD_NONE) ? 1 : 0); } ud_asmprintf(u, "]"); break; case UD_OP_IMM: ud_syn_print_imm(u, op); break; case UD_OP_JIMM: ud_syn_print_addr(u, ud_syn_rel_target(u, op)); break; case UD_OP_PTR: switch (op->size) { case 32: ud_asmprintf(u, "word 0x%x:0x%x", op->lval.ptr.seg, op->lval.ptr.off & 0xFFFF); break; case 48: ud_asmprintf(u, "dword 0x%x:0x%x", op->lval.ptr.seg, op->lval.ptr.off); break; } break; case UD_OP_CONST: if (syn_cast) opr_cast(u, op); ud_asmprintf(u, "%d", op->lval.udword); break; default: return; } } /* ============================================================================= * translates to intel syntax * ============================================================================= */ extern void ud_translate_intel(struct ud* u) { /* check if P_OSO prefix is used */ if (!P_OSO(u->itab_entry->prefix) && u->pfx_opr) { switch (u->dis_mode) { case 16: ud_asmprintf(u, "o32 "); break; case 32: case 64: ud_asmprintf(u, "o16 "); break; } } /* check if P_ASO prefix was used */ if (!P_ASO(u->itab_entry->prefix) && u->pfx_adr) { switch (u->dis_mode) { case 16: ud_asmprintf(u, "a32 "); break; case 32: ud_asmprintf(u, "a16 "); break; case 64: ud_asmprintf(u, "a32 "); break; } } if (u->pfx_seg && u->operand[0].type != UD_OP_MEM && u->operand[1].type != UD_OP_MEM ) { ud_asmprintf(u, "%s ", ud_reg_tab[u->pfx_seg - UD_R_AL]); } if (u->pfx_lock) { ud_asmprintf(u, "lock "); } if (u->pfx_rep) { ud_asmprintf(u, "rep "); } else if (u->pfx_repe) { ud_asmprintf(u, "repe "); } else if (u->pfx_repne) { ud_asmprintf(u, "repne "); } /* print the instruction mnemonic */ ud_asmprintf(u, "%s", ud_lookup_mnemonic(u->mnemonic)); if (u->operand[0].type != UD_NONE) { int cast = 0; ud_asmprintf(u, " "); if (u->operand[0].type == UD_OP_MEM) { if (u->operand[1].type == UD_OP_IMM || u->operand[1].type == UD_OP_CONST || u->operand[1].type == UD_NONE || (u->operand[0].size != u->operand[1].size && u->operand[1].type != UD_OP_REG)) { cast = 1; } else if (u->operand[1].type == UD_OP_REG && u->operand[1].base == UD_R_CL) { switch (u->mnemonic) { case UD_Ircl: case UD_Irol: case UD_Iror: case UD_Ircr: case UD_Ishl: case UD_Ishr: case UD_Isar: cast = 1; break; default: break; } } } gen_operand(u, &u->operand[0], cast); } if (u->operand[1].type != UD_NONE) { int cast = 0; ud_asmprintf(u, ", "); if (u->operand[1].type == UD_OP_MEM && u->operand[0].size != u->operand[1].size && !ud_opr_is_sreg(&u->operand[0])) { cast = 1; } gen_operand(u, &u->operand[1], cast); } if (u->operand[2].type != UD_NONE) { ud_asmprintf(u, ", "); gen_operand(u, &u->operand[2], 0); } } /* vim: set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/libudis86/syn.c000066400000000000000000000141271455661113700200700ustar00rootroot00000000000000/* udis86 - libudis86/syn.c * * Copyright (c) 2002-2013 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "types.h" #include "decode.h" #include "syn.h" #include "udint.h" /* ----------------------------------------------------------------------------- * Intel Register Table - Order Matters (types.h)! * ----------------------------------------------------------------------------- */ const char* ud_reg_tab[] = { "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh", "spl", "bpl", "sil", "dil", "r8b", "r9b", "r10b", "r11b", "r12b", "r13b", "r14b", "r15b", "ax", "cx", "dx", "bx", "sp", "bp", "si", "di", "r8w", "r9w", "r10w", "r11w", "r12w", "r13w" , "r14w", "r15w", "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi", "r8d", "r9d", "r10d", "r11d", "r12d", "r13d", "r14d", "r15d", "rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "es", "cs", "ss", "ds", "fs", "gs", "cr0", "cr1", "cr2", "cr3", "cr4", "cr5", "cr6", "cr7", "cr8", "cr9", "cr10", "cr11", "cr12", "cr13", "cr14", "cr15", "dr0", "dr1", "dr2", "dr3", "dr4", "dr5", "dr6", "dr7", "dr8", "dr9", "dr10", "dr11", "dr12", "dr13", "dr14", "dr15", "mm0", "mm1", "mm2", "mm3", "mm4", "mm5", "mm6", "mm7", "st0", "st1", "st2", "st3", "st4", "st5", "st6", "st7", "xmm0", "xmm1", "xmm2", "xmm3", "xmm4", "xmm5", "xmm6", "xmm7", "xmm8", "xmm9", "xmm10", "xmm11", "xmm12", "xmm13", "xmm14", "xmm15", "rip" }; uint64_t ud_syn_rel_target(struct ud *u, struct ud_operand *opr) { const uint64_t trunc_mask = 0xffffffffffffffffull >> (64 - u->opr_mode); switch (opr->size) { case 8 : return (u->pc + opr->lval.sbyte) & trunc_mask; case 16: return (u->pc + opr->lval.sword) & trunc_mask; case 32: return (u->pc + opr->lval.sdword) & trunc_mask; default: UD_ASSERT(!"invalid relative offset size."); return 0ull; } } /* * asmprintf * Printf style function for printing translated assembly * output. Returns the number of characters written and * moves the buffer pointer forward. On an overflow, * returns a negative number and truncates the output. */ int ud_asmprintf(struct ud *u, const char *fmt, ...) { int ret; int avail; va_list ap; va_start(ap, fmt); avail = u->asm_buf_size - u->asm_buf_fill - 1 /* nullchar */; ret = vsnprintf((char*) u->asm_buf + u->asm_buf_fill, avail, fmt, ap); if (ret < 0 || ret > avail) { u->asm_buf_fill = u->asm_buf_size - 1; } else { u->asm_buf_fill += ret; } va_end(ap); return ret; } void ud_syn_print_addr(struct ud *u, uint64_t addr) { const char *name = NULL; if (u->sym_resolver) { int64_t offset = 0; name = u->sym_resolver(u, addr, &offset); if (name) { if (offset) { ud_asmprintf(u, "%s%+" FMT64 "d", name, offset); } else { ud_asmprintf(u, "%s", name); } return; } } ud_asmprintf(u, "0x%" FMT64 "x", addr); } void ud_syn_print_imm(struct ud* u, const struct ud_operand *op) { uint64_t v; if (op->_oprcode == OP_sI && op->size != u->opr_mode) { if (op->size == 8) { v = (int64_t)op->lval.sbyte; } else { UD_ASSERT(op->size == 32); v = (int64_t)op->lval.sdword; } if (u->opr_mode < 64) { v = v & ((1ull << u->opr_mode) - 1ull); } } else { switch (op->size) { case 8 : v = op->lval.ubyte; break; case 16: v = op->lval.uword; break; case 32: v = op->lval.udword; break; case 64: v = op->lval.uqword; break; default: UD_ASSERT(!"invalid offset"); v = 0; /* keep cc happy */ } } ud_asmprintf(u, "0x%" FMT64 "x", v); } void ud_syn_print_mem_disp(struct ud* u, const struct ud_operand *op, int sign) { UD_ASSERT(op->offset != 0); if (op->base == UD_NONE && op->index == UD_NONE) { uint64_t v; UD_ASSERT(op->scale == UD_NONE && op->offset != 8); /* unsigned mem-offset */ switch (op->offset) { case 16: v = op->lval.uword; break; case 32: v = op->lval.udword; break; case 64: v = op->lval.uqword; break; default: UD_ASSERT(!"invalid offset"); v = 0; /* keep cc happy */ } ud_asmprintf(u, "0x%" FMT64 "x", v); } else { int64_t v; UD_ASSERT(op->offset != 64); switch (op->offset) { case 8 : v = op->lval.sbyte; break; case 16: v = op->lval.sword; break; case 32: v = op->lval.sdword; break; default: UD_ASSERT(!"invalid offset"); v = 0; /* keep cc happy */ } if (v < 0) { ud_asmprintf(u, "-0x%" FMT64 "x", -v); } else if (v > 0) { ud_asmprintf(u, "%s0x%" FMT64 "x", sign? "+" : "", v); } } } /* vim: set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/libudis86/syn.h000066400000000000000000000040451455661113700200730ustar00rootroot00000000000000/* udis86 - libudis86/syn.h * * Copyright (c) 2002-2009 * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UD_SYN_H #define UD_SYN_H #include "types.h" #ifndef __UD_STANDALONE__ # include #endif /* __UD_STANDALONE__ */ extern const char* ud_reg_tab[]; uint64_t ud_syn_rel_target(struct ud*, struct ud_operand*); #ifdef __GNUC__ int ud_asmprintf(struct ud *u, const char *fmt, ...) __attribute__ ((format (printf, 2, 3))); #else int ud_asmprintf(struct ud *u, const char *fmt, ...); #endif void ud_syn_print_addr(struct ud *u, uint64_t addr); void ud_syn_print_imm(struct ud* u, const struct ud_operand *op); void ud_syn_print_mem_disp(struct ud* u, const struct ud_operand *, int sign); #endif /* UD_SYN_H */ /* vim: set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/libudis86/types.h000066400000000000000000000162561455661113700204350ustar00rootroot00000000000000/* udis86 - libudis86/types.h * * Copyright (c) 2002-2013 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UD_TYPES_H #define UD_TYPES_H #ifdef __KERNEL__ /* -D__KERNEL__ is automatically passed on the command line when building something as part of the Linux kernel */ # include # include # ifndef __UD_STANDALONE__ # define __UD_STANDALONE__ 1 #endif #endif /* __KERNEL__ */ #if defined(_MSC_VER) || defined(__BORLANDC__) # include # include # define inline __inline /* MS Visual Studio requires __inline instead of inline for C code */ #elif !defined(__UD_STANDALONE__) # include # include #endif /* !__UD_STANDALONE__ */ /* gcc specific extensions */ #ifdef __GNUC__ # define UD_ATTR_PACKED __attribute__((packed)) #else # define UD_ATTR_PACKED #endif /* UD_ATTR_PACKED */ /* ----------------------------------------------------------------------------- * All possible "types" of objects in udis86. Order is Important! * ----------------------------------------------------------------------------- */ enum ud_type { UD_NONE, /* 8 bit GPRs */ UD_R_AL, UD_R_CL, UD_R_DL, UD_R_BL, UD_R_AH, UD_R_CH, UD_R_DH, UD_R_BH, UD_R_SPL, UD_R_BPL, UD_R_SIL, UD_R_DIL, UD_R_R8B, UD_R_R9B, UD_R_R10B, UD_R_R11B, UD_R_R12B, UD_R_R13B, UD_R_R14B, UD_R_R15B, /* 16 bit GPRs */ UD_R_AX, UD_R_CX, UD_R_DX, UD_R_BX, UD_R_SP, UD_R_BP, UD_R_SI, UD_R_DI, UD_R_R8W, UD_R_R9W, UD_R_R10W, UD_R_R11W, UD_R_R12W, UD_R_R13W, UD_R_R14W, UD_R_R15W, /* 32 bit GPRs */ UD_R_EAX, UD_R_ECX, UD_R_EDX, UD_R_EBX, UD_R_ESP, UD_R_EBP, UD_R_ESI, UD_R_EDI, UD_R_R8D, UD_R_R9D, UD_R_R10D, UD_R_R11D, UD_R_R12D, UD_R_R13D, UD_R_R14D, UD_R_R15D, /* 64 bit GPRs */ UD_R_RAX, UD_R_RCX, UD_R_RDX, UD_R_RBX, UD_R_RSP, UD_R_RBP, UD_R_RSI, UD_R_RDI, UD_R_R8, UD_R_R9, UD_R_R10, UD_R_R11, UD_R_R12, UD_R_R13, UD_R_R14, UD_R_R15, /* segment registers */ UD_R_ES, UD_R_CS, UD_R_SS, UD_R_DS, UD_R_FS, UD_R_GS, /* control registers*/ UD_R_CR0, UD_R_CR1, UD_R_CR2, UD_R_CR3, UD_R_CR4, UD_R_CR5, UD_R_CR6, UD_R_CR7, UD_R_CR8, UD_R_CR9, UD_R_CR10, UD_R_CR11, UD_R_CR12, UD_R_CR13, UD_R_CR14, UD_R_CR15, /* debug registers */ UD_R_DR0, UD_R_DR1, UD_R_DR2, UD_R_DR3, UD_R_DR4, UD_R_DR5, UD_R_DR6, UD_R_DR7, UD_R_DR8, UD_R_DR9, UD_R_DR10, UD_R_DR11, UD_R_DR12, UD_R_DR13, UD_R_DR14, UD_R_DR15, /* mmx registers */ UD_R_MM0, UD_R_MM1, UD_R_MM2, UD_R_MM3, UD_R_MM4, UD_R_MM5, UD_R_MM6, UD_R_MM7, /* x87 registers */ UD_R_ST0, UD_R_ST1, UD_R_ST2, UD_R_ST3, UD_R_ST4, UD_R_ST5, UD_R_ST6, UD_R_ST7, /* extended multimedia registers */ UD_R_XMM0, UD_R_XMM1, UD_R_XMM2, UD_R_XMM3, UD_R_XMM4, UD_R_XMM5, UD_R_XMM6, UD_R_XMM7, UD_R_XMM8, UD_R_XMM9, UD_R_XMM10, UD_R_XMM11, UD_R_XMM12, UD_R_XMM13, UD_R_XMM14, UD_R_XMM15, UD_R_RIP, /* Operand Types */ UD_OP_REG, UD_OP_MEM, UD_OP_PTR, UD_OP_IMM, UD_OP_JIMM, UD_OP_CONST }; #include "itab.h" union ud_lval { int8_t sbyte; uint8_t ubyte; int16_t sword; uint16_t uword; int32_t sdword; uint32_t udword; int64_t sqword; uint64_t uqword; struct { uint16_t seg; uint32_t off; } ptr; }; /* ----------------------------------------------------------------------------- * struct ud_operand - Disassembled instruction Operand. * ----------------------------------------------------------------------------- */ struct ud_operand { enum ud_type type; uint8_t size; enum ud_type base; enum ud_type index; uint8_t scale; uint8_t offset; union ud_lval lval; /* * internal use only */ uint64_t _legacy; /* this will be removed in 1.8 */ uint8_t _oprcode; }; /* ----------------------------------------------------------------------------- * struct ud - The udis86 object. * ----------------------------------------------------------------------------- */ struct ud { /* * input buffering */ int (*inp_hook) (struct ud*); #ifndef __UD_STANDALONE__ FILE* inp_file; #endif const uint8_t* inp_buf; size_t inp_buf_size; size_t inp_buf_index; uint8_t inp_curr; size_t inp_ctr; uint8_t inp_sess[64]; int inp_end; void (*translator)(struct ud*); uint64_t insn_offset; char insn_hexcode[64]; /* * Assembly output buffer */ char *asm_buf; size_t asm_buf_size; size_t asm_buf_fill; char asm_buf_int[128]; /* * Symbol resolver for use in the translation phase. */ const char* (*sym_resolver)(struct ud*, uint64_t addr, int64_t *offset); uint8_t dis_mode; uint64_t pc; uint8_t vendor; enum ud_mnemonic_code mnemonic; struct ud_operand operand[3]; uint8_t error; uint8_t pfx_rex; uint8_t pfx_seg; uint8_t pfx_opr; uint8_t pfx_adr; uint8_t pfx_lock; uint8_t pfx_str; uint8_t pfx_rep; uint8_t pfx_repe; uint8_t pfx_repne; uint8_t opr_mode; uint8_t adr_mode; uint8_t br_far; uint8_t br_near; uint8_t have_modrm; uint8_t modrm; uint8_t primary_opcode; void * user_opaque_data; struct ud_itab_entry * itab_entry; struct ud_lookup_table_list_entry *le; }; /* ----------------------------------------------------------------------------- * Type-definitions * ----------------------------------------------------------------------------- */ typedef enum ud_type ud_type_t; typedef enum ud_mnemonic_code ud_mnemonic_code_t; typedef struct ud ud_t; typedef struct ud_operand ud_operand_t; #define UD_SYN_INTEL ud_translate_intel #define UD_SYN_ATT ud_translate_att #define UD_EOI (-1) #define UD_INP_CACHE_SZ 32 #define UD_VENDOR_AMD 0 #define UD_VENDOR_INTEL 1 #define UD_VENDOR_ANY 2 #endif /* vim: set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/libudis86/udint.h000066400000000000000000000052071455661113700204060ustar00rootroot00000000000000/* udis86 - libudis86/udint.h -- definitions for internal use only * * Copyright (c) 2002-2009 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef _UDINT_H_ #define _UDINT_H_ #ifdef HAVE_CONFIG_H # include #endif /* HAVE_CONFIG_H */ #if defined(UD_DEBUG) && HAVE_ASSERT_H # include # define UD_ASSERT(_x) assert(_x) #else # define UD_ASSERT(_x) #endif /* !HAVE_ASSERT_H */ #if defined(UD_DEBUG) #define UDERR(u, msg) \ do { \ (u)->error = 1; \ fprintf(stderr, "decode-error: %s:%d: %s", \ __FILE__, __LINE__, (msg)); \ } while (0) #else #define UDERR(u, m) \ do { \ (u)->error = 1; \ } while (0) #endif /* !LOGERR */ #define UD_RETURN_ON_ERROR(u) \ do { \ if ((u)->error != 0) { \ return (u)->error; \ } \ } while (0) #define UD_RETURN_WITH_ERROR(u, m) \ do { \ UDERR(u, m); \ return (u)->error; \ } while (0) #ifndef __UD_STANDALONE__ # define UD_NON_STANDALONE(x) x #else # define UD_NON_STANDALONE(x) #endif /* printf formatting int64 specifier */ #ifdef FMT64 # undef FMT64 #endif #if defined(_MSC_VER) || defined(__BORLANDC__) # define FMT64 "I64" #else # if defined(__APPLE__) # define FMT64 "ll" # elif defined(__amd64__) || defined(__x86_64__) # define FMT64 "l" # else # define FMT64 "ll" # endif /* !x64 */ #endif #endif /* _UDINT_H_ */ readpe-0.84/lib/libudis86/libudis86/udis86.c000066400000000000000000000307401455661113700204000ustar00rootroot00000000000000/* udis86 - libudis86/udis86.c * * Copyright (c) 2002-2013 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "udint.h" #include "extern.h" #include "decode.h" #if !defined(__UD_STANDALONE__) # if HAVE_STRING_H # include # endif #endif /* !__UD_STANDALONE__ */ static void ud_inp_init(struct ud *u); /* ============================================================================= * ud_init * Initializes ud_t object. * ============================================================================= */ extern void ud_init(struct ud* u) { memset((void*)u, 0, sizeof(struct ud)); ud_set_mode(u, 16); u->mnemonic = UD_Iinvalid; ud_set_pc(u, 0); #ifndef __UD_STANDALONE__ ud_set_input_file(u, stdin); #endif /* __UD_STANDALONE__ */ ud_set_asm_buffer(u, u->asm_buf_int, sizeof(u->asm_buf_int)); } /* ============================================================================= * ud_disassemble * Disassembles one instruction and returns the number of * bytes disassembled. A zero means end of disassembly. * ============================================================================= */ extern unsigned int ud_disassemble(struct ud* u) { int len; if (u->inp_end) { return 0; } if ((len = ud_decode(u)) > 0) { if (u->translator != NULL) { u->asm_buf[0] = '\0'; u->translator(u); } } return len; } /* ============================================================================= * ud_set_mode() - Set Disassemly Mode. * ============================================================================= */ extern void ud_set_mode(struct ud* u, uint8_t m) { switch(m) { case 16: case 32: case 64: u->dis_mode = m ; return; default: u->dis_mode = 16; return; } } /* ============================================================================= * ud_set_vendor() - Set vendor. * ============================================================================= */ extern void ud_set_vendor(struct ud* u, unsigned v) { switch(v) { case UD_VENDOR_INTEL: u->vendor = v; break; case UD_VENDOR_ANY: u->vendor = v; break; default: u->vendor = UD_VENDOR_AMD; } } /* ============================================================================= * ud_set_pc() - Sets code origin. * ============================================================================= */ extern void ud_set_pc(struct ud* u, uint64_t o) { u->pc = o; } /* ============================================================================= * ud_set_syntax() - Sets the output syntax. * ============================================================================= */ extern void ud_set_syntax(struct ud* u, void (*t)(struct ud*)) { u->translator = t; } /* ============================================================================= * ud_insn() - returns the disassembled instruction * ============================================================================= */ const char* ud_insn_asm(const struct ud* u) { return u->asm_buf; } /* ============================================================================= * ud_insn_offset() - Returns the offset. * ============================================================================= */ uint64_t ud_insn_off(const struct ud* u) { return u->insn_offset; } /* ============================================================================= * ud_insn_hex() - Returns hex form of disassembled instruction. * ============================================================================= */ const char* ud_insn_hex(struct ud* u) { u->insn_hexcode[0] = 0; if (!u->error) { unsigned int i; const unsigned char *src_ptr = ud_insn_ptr(u); char* src_hex; src_hex = (char*) u->insn_hexcode; /* for each byte used to decode instruction */ for (i = 0; i < ud_insn_len(u) && i < sizeof(u->insn_hexcode) / 2; ++i, ++src_ptr) { sprintf(src_hex, "%02x", *src_ptr & 0xFF); src_hex += 2; } } return u->insn_hexcode; } /* ============================================================================= * ud_insn_ptr * Returns a pointer to buffer containing the bytes that were * disassembled. * ============================================================================= */ extern const uint8_t* ud_insn_ptr(const struct ud* u) { return (u->inp_buf == NULL) ? u->inp_sess : u->inp_buf + (u->inp_buf_index - u->inp_ctr); } /* ============================================================================= * ud_insn_len * Returns the count of bytes disassembled. * ============================================================================= */ extern unsigned int ud_insn_len(const struct ud* u) { return u->inp_ctr; } /* ============================================================================= * ud_insn_get_opr * Return the operand struct representing the nth operand of * the currently disassembled instruction. Returns NULL if * there's no such operand. * ============================================================================= */ const struct ud_operand* ud_insn_opr(const struct ud *u, unsigned int n) { if (n > 2 || u->operand[n].type == UD_NONE) { return NULL; } else { return &u->operand[n]; } } /* ============================================================================= * ud_opr_is_sreg * Returns non-zero if the given operand is of a segment register type. * ============================================================================= */ int ud_opr_is_sreg(const struct ud_operand *opr) { return opr->type == UD_OP_REG && opr->base >= UD_R_ES && opr->base <= UD_R_GS; } /* ============================================================================= * ud_opr_is_sreg * Returns non-zero if the given operand is of a general purpose * register type. * ============================================================================= */ int ud_opr_is_gpr(const struct ud_operand *opr) { return opr->type == UD_OP_REG && opr->base >= UD_R_AL && opr->base <= UD_R_R15; } /* ============================================================================= * ud_set_user_opaque_data * ud_get_user_opaque_data * Get/set user opaqute data pointer * ============================================================================= */ void ud_set_user_opaque_data(struct ud * u, void* opaque) { u->user_opaque_data = opaque; } void* ud_get_user_opaque_data(const struct ud *u) { return u->user_opaque_data; } /* ============================================================================= * ud_set_asm_buffer * Allow the user to set an assembler output buffer. If `buf` is NULL, * we switch back to the internal buffer. * ============================================================================= */ void ud_set_asm_buffer(struct ud *u, char *buf, size_t size) { if (buf == NULL) { ud_set_asm_buffer(u, u->asm_buf_int, sizeof(u->asm_buf_int)); } else { u->asm_buf = buf; u->asm_buf_size = size; } } /* ============================================================================= * ud_set_sym_resolver * Set symbol resolver for relative targets used in the translation * phase. * * The resolver is a function that takes a uint64_t address and returns a * symbolic name for the that address. The function also takes a second * argument pointing to an integer that the client can optionally set to a * non-zero value for offsetted targets. (symbol+offset) The function may * also return NULL, in which case the translator only prints the target * address. * * The function pointer maybe NULL which resets symbol resolution. * ============================================================================= */ void ud_set_sym_resolver(struct ud *u, const char* (*resolver)(struct ud*, uint64_t addr, int64_t *offset)) { u->sym_resolver = resolver; } /* ============================================================================= * ud_insn_mnemonic * Return the current instruction mnemonic. * ============================================================================= */ enum ud_mnemonic_code ud_insn_mnemonic(const struct ud *u) { return u->mnemonic; } /* ============================================================================= * ud_lookup_mnemonic * Looks up mnemonic code in the mnemonic string table. * Returns NULL if the mnemonic code is invalid. * ============================================================================= */ const char* ud_lookup_mnemonic(enum ud_mnemonic_code c) { if (c < UD_MAX_MNEMONIC_CODE) { return ud_mnemonics_str[c]; } else { return NULL; } } /* * ud_inp_init * Initializes the input system. */ static void ud_inp_init(struct ud *u) { u->inp_hook = NULL; u->inp_buf = NULL; u->inp_buf_size = 0; u->inp_buf_index = 0; u->inp_curr = 0; u->inp_ctr = 0; u->inp_end = 0; UD_NON_STANDALONE(u->inp_file = NULL); } /* ============================================================================= * ud_inp_set_hook * Sets input hook. * ============================================================================= */ void ud_set_input_hook(register struct ud* u, int (*hook)(struct ud*)) { ud_inp_init(u); u->inp_hook = hook; } /* ============================================================================= * ud_inp_set_buffer * Set buffer as input. * ============================================================================= */ void ud_set_input_buffer(register struct ud* u, const uint8_t* buf, size_t len) { ud_inp_init(u); u->inp_buf = buf; u->inp_buf_size = len; u->inp_buf_index = 0; } #ifndef __UD_STANDALONE__ /* ============================================================================= * ud_input_set_file * Set FILE as input. * ============================================================================= */ static int inp_file_hook(struct ud* u) { return fgetc(u->inp_file); } void ud_set_input_file(register struct ud* u, FILE* f) { ud_inp_init(u); u->inp_hook = inp_file_hook; u->inp_file = f; } #endif /* __UD_STANDALONE__ */ /* ============================================================================= * ud_input_skip * Skip n input bytes. * ============================================================================ */ void ud_input_skip(struct ud* u, size_t n) { if (u->inp_end) { return; } if (u->inp_buf == NULL) { while (n--) { int c = u->inp_hook(u); if (c == UD_EOI) { goto eoi; } } return; } else { if (n > u->inp_buf_size || u->inp_buf_index > u->inp_buf_size - n) { u->inp_buf_index = u->inp_buf_size; goto eoi; } u->inp_buf_index += n; return; } eoi: u->inp_end = 1; UDERR(u, "cannot skip, eoi received\b"); return; } /* ============================================================================= * ud_input_end * Returns non-zero on end-of-input. * ============================================================================= */ int ud_input_end(const struct ud *u) { return u->inp_end; } /* vim:set ts=2 sw=2 expandtab */ readpe-0.84/lib/libudis86/udis86.h000066400000000000000000000030221455661113700165650ustar00rootroot00000000000000/* udis86 - udis86.h * * Copyright (c) 2002-2009 Vivek Thampi * All rights reserved. * * Redistribution and use in source and binary forms, with or without modification, * are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UDIS86_H #define UDIS86_H #include "libudis86/types.h" #include "libudis86/extern.h" #include "libudis86/itab.h" #endif readpe-0.84/pev.conf000066400000000000000000000000361455661113700143560ustar00rootroot00000000000000plugins_dir=src/build/plugins readpe-0.84/pev.spec000066400000000000000000000010751455661113700143670ustar00rootroot00000000000000Name: pev Version: 0.84 Release: 1 License: GPL2 URL: http://pev.sf.net/ Requires: readline BuildRequires: openssl-devel Source0: https://github.com/mentebinaria/readpe/archive/v%{version}.tar.gz Summary: The PE file analysis toolkit %description pev the PE file analysis toolkit. It is fast, multiplatform, feature-rich, free and open source %prep %setup -n pev %build make %install make install DESTDIR=$RPM_BUILD_ROOT %clean rm -rf $RPM_BUILD_ROOT %files %defattr(-, root, root) /usr/bin/* /usr/lib/* readpe-0.84/src/000077500000000000000000000000001455661113700135055ustar00rootroot00000000000000readpe-0.84/src/Makefile000066400000000000000000000125561455661113700151560ustar00rootroot00000000000000####### Platform specifics # cut is necessary for Cygwin export PLATFORM_OS := $(shell uname | cut -d_ -f1) ####### Makefile Conventions - Directory variables srcdir = . prefix = /usr/local exec_prefix = $(prefix) sysconfdir = $(prefix)/etc includedir = $(prefix)/include datarootdir = $(prefix)/share localstatedir = $(prefix)/var bindir = $(exec_prefix)/bin libdir = $(exec_prefix)/lib libexecdir = $(exec_prefix)/libexec sbindir = $(exec_prefix)/sbin datadir = $(datarootdir) docdir = $(datarootdir)/doc/pev infodir = $(datarootdir)/info localedir = $(datarootdir)/locale mandir = $(datarootdir)/man manext = .1 man1dir = $(mandir)/man1 man1ext = .1 export pluginsdir = $(libdir)/pev/plugins ####### Makefile Conventions - Utilities export CC ?= gcc export LINK = $(CC) export CHK_DIR_EXISTS = test -d export CHK_FILE_EXISTS = test -f export INSTALL = install export INSTALL_DATA = ${INSTALL} -m 644 export INSTALL_PROGRAM = ${INSTALL} export SYMLINK = ln -sf export MKDIR = mkdir -p export RM = rm -f export RM_DIR = rm -rf ifeq ($(PLATFORM_OS), Darwin) export STRIP = strip -x else export STRIP = strip --strip-unneeded endif ####### Compiler options override LDFLAGS += -L$(LIBPE) -lpe -lcrypto -lssl -ldl -lm override CFLAGS += -O2 -ffast-math -I$(LIBPE)/include -I"../include" -W -Wall -Wextra -Wno-implicit-fallthrough -std=c99 -pedantic # To compile for production define the symbol NDEBUG before invoking this makefile. override CPPFLAGS += \ -D_GNU_SOURCE \ -DSHAREDIR="\"$(SHAREDIR)"\" \ -DPLUGINSDIR="\"$(pluginsdir)"\" ifeq ($(PLATFORM_OS), Darwin) # We disable warnings for deprecated declarations since Apple deprecated OpenSSL in Mac OS X 10.7 override CFLAGS += -Wno-deprecated-declarations endif ifeq ($(PLATFORM_OS), CYGWIN) override CPPFLAGS += -D_XOPEN_SOURCE=600 endif SRC_DIRS = $(srcdir) $(srcdir)/compat PROGS = readpe rva2ofs ofs2rva pehash pesec pescan pepack pestr pedis peres peldd PLUGINS_DIR = $(srcdir)/plugins SHAREDIR = $(datadir)/pev export LIBPE = $(realpath $(srcdir)/../lib/libpe) LIBUDIS86 = $(srcdir)/../lib/libudis86 MANDIR = $(srcdir)/../doc/manpages export pev_BUILDDIR = ./build pev_SRCS_FILTER = $(sort $(wildcard ${dir}/*.c)) pev_SRCS = $(foreach dir, ${SRC_DIRS}, ${pev_SRCS_FILTER}) pev_OBJS = $(addprefix ${pev_BUILDDIR}/, $(addsuffix .o, $(basename ${pev_SRCS}))) pev_COMMON_DEPS = \ $(pev_BUILDDIR)/compat/strlcat.o \ $(pev_BUILDDIR)/config.o \ $(pev_BUILDDIR)/dylib.o \ $(pev_BUILDDIR)/malloc_s.o \ $(pev_BUILDDIR)/plugins.o \ $(pev_BUILDDIR)/output_plugin.o \ $(pev_BUILDDIR)/output.o \ $(pev_BUILDDIR)/pev_api.o ####### Build rules .PHONY: plugins install installdirs uninstall clean all: $(PROGS) plugins plugins: cd $(PLUGINS_DIR) && $(MAKE) $@ ofs2rva: $(pev_BUILDDIR)/ofs2rva.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) pedis: CPPFLAGS += -DHAVE_STRING_H pedis: CFLAGS += -I$(LIBUDIS86) pedis: $(pev_BUILDDIR)/pedis.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) $(sort $(LIBUDIS86)/libudis86/*.c) pehash: $(pev_BUILDDIR)/pehash.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) pepack: $(pev_BUILDDIR)/pepack.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) peres: $(pev_BUILDDIR)/peres.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) pescan: LDFLAGS += -lm pescan: $(pev_BUILDDIR)/pescan.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) pesec: LDFLAGS += -lcrypto pesec: $(pev_BUILDDIR)/pesec.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) pestr: $(pev_BUILDDIR)/pestr.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) readpe: $(pev_BUILDDIR)/readpe.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) rva2ofs: $(pev_BUILDDIR)/rva2ofs.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) peldd: $(pev_BUILDDIR)/peldd.o $(pev_OBJS) $(CC) $< -o $(pev_BUILDDIR)/$@ $(pev_COMMON_DEPS) $(LDFLAGS) $(CFLAGS) $(CPPFLAGS) # Generic rule matching sources $(pev_BUILDDIR)/%.o: %.c @$(CHK_DIR_EXISTS) $(dir $@) || $(MKDIR) $(dir $@) $(CC) -c -o $@ $< $(CFLAGS) $(CPPFLAGS) $(INCPATH) install: installdirs for prog in $(PROGS); do \ $(INSTALL_PROGRAM) $(INSTALL_FLAGS) $(pev_BUILDDIR)/$$prog $(DESTDIR)$(bindir); \ $(CHK_FILE_EXISTS) $(MANDIR)/$$prog$(man1ext) && \ gzip -c -9 $(MANDIR)/$$prog$(man1ext) > $(DESTDIR)$(man1dir)/$$prog$(man1ext).gz || \ echo -n; \ done $(INSTALL_DATA) $(srcdir)/userdb.txt $(DESTDIR)$(SHAREDIR) cd $(PLUGINS_DIR) && $(MAKE) $@ install-strip: INSTALL_FLAGS += -s install-strip: install installdirs: @$(CHK_DIR_EXISTS) $(DESTDIR) || $(MKDIR) $(DESTDIR) @$(CHK_DIR_EXISTS) $(DESTDIR)$(bindir) || $(MKDIR) $(DESTDIR)$(bindir) @$(CHK_DIR_EXISTS) $(DESTDIR)$(man1dir) || $(MKDIR) $(DESTDIR)$(man1dir) @$(CHK_DIR_EXISTS) $(DESTDIR)$(SHAREDIR) || $(MKDIR) $(DESTDIR)$(SHAREDIR) uninstall: for prog in $(PROGS); do \ $(RM) $(DESTDIR)$(bindir)/$$prog; \ $(RM) $(DESTDIR)$(man1dir)/$$prog$(man1ext).gz; \ done $(RM_DIR) $(DESTDIR)$(SHAREDIR) cd $(PLUGINS_DIR) && $(MAKE) $@ clean: $(RM_DIR) $(pev_BUILDDIR) $(RM) $(PROGS) cd $(PLUGINS_DIR) && $(MAKE) $@ readpe-0.84/src/compat/000077500000000000000000000000001455661113700147705ustar00rootroot00000000000000readpe-0.84/src/compat/strlcat.c000066400000000000000000000032341455661113700166120ustar00rootroot00000000000000/* $OpenBSD: strlcat.c,v 1.13 2005/08/08 08:05:37 espie Exp $ */ /* * Copyright (c) 1998 Todd C. Miller * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ #include "compat/strlcat.h" #include /* * Appends src to string dst of size siz (unlike strncat, siz is the * full size of dst, not space left). At most siz-1 characters * will be copied. Always NUL terminates (unless siz <= strlen(dst)). * Returns strlen(src) + MIN(siz, strlen(initial dst)). * If retval >= siz, truncation occurred. */ size_t bsd_strlcat(char *dst, const char *src, size_t siz) { char *d = dst; const char *s = src; size_t n = siz; size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; if (n == 0) return(dlen + strlen(s)); while (*s != '\0') { if (n != 1) { *d++ = *s; n--; } s++; } *d = '\0'; return(dlen + (s - src)); /* count does not include NUL */ } readpe-0.84/src/config.c000066400000000000000000000121141455661113700151150ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit config.c Copyright (C) 2013 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "config.h" #include #include #include #include #include #if defined(__linux__) #include // FIXME: Why? #elif defined(__APPLE__) || defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__CYGWIN__) #include #endif #define DEFAULT_CONFIG_FILENAME "pev.conf" #if defined(__CYGWIN__) // Set current directory as default #define DEFAULT_CONFIG_PATH DEFAULT_CONFIG_FILENAME #define DEFAULT_PLUGINS_PATH "plugins" #else #define DEFAULT_CONFIG_PATH ".config/pev/" DEFAULT_CONFIG_FILENAME // PLUGINSDIR is defined via CPPFLAGS in the Makefile #define DEFAULT_PLUGINS_PATH PLUGINSDIR #endif static bool _load_config_cb(pev_config_t * const config, const char *name, const char *value) { //fprintf(stderr, "DEBUG: %s=%s\n", name, value); if (!strcmp("plugins_dir", name)) { config->plugins_path = strdup(value); return true; } return false; } // FIX: Now the lines of config can have any size! static int _load_config_and_parse(pev_config_t * const config, const char *path, pev_config_parse_callback_t pev_cb) { FILE *fp = fopen(path, "r"); if (fp == NULL) return 0; char *p, *line = NULL; size_t size = 0; while ( getline( &line, &size, fp ) != -1 ) { // remove newline if ((p = strrchr( line, '\n')) != NULL) *p = '\0'; p = pe_utils_str_inplace_trim(line); // if not a comment line... if (*p != '#') { char *param = strtok(p, "="); char *value = strtok(NULL, "="); const char *trimmed_param = pe_utils_str_inplace_trim(param); const char *trimmed_value = pe_utils_str_inplace_trim(value); //fprintf(stderr, "DEBUG: '%s'='%s'\n", trimmed_param, trimmed_value); const bool processed = pev_cb(config, trimmed_param, trimmed_value); if (!processed && config->user_defined.parse_callback != NULL) config->user_defined.parse_callback(config->user_defined.data, trimmed_param, trimmed_value); } free( line ); line = NULL; size = 0; } free( line ); fclose(fp); return 1; } #ifdef USE_MY_ASPRINTF int asprintf( char **pp, char *fmt, ... ) { char *p; int size; va_list args, args_safe; va_start( args, fmt ); va_copy( args_safe, args ); // Just get the string size. if ( ( size = vsnprintf( NULL, 0, fmt, args_safe ) ) < 0 ) { va_end( args_safe ); va_end( args ); return -1; } if ( ! ( p = malloc( size + 1 ) ) ) { va_end( args_safe ); va_end( args ); return -1; } vsprintf( *pp = p, fmt, args ); va_end( args_safe ); va_end( args ); return size; } #endif // FIX: To avoid using fixed size PATH names we can use asprintf(). int pev_load_config(pev_config_t * const config) { char *buff; int ret = pe_utils_is_file_readable(DEFAULT_CONFIG_FILENAME); if (ret == LIBPE_E_OK) if ( ! _load_config_and_parse(config, DEFAULT_CONFIG_FILENAME, _load_config_cb) ) return -1; // OBS: If asprintf isn't available to your system, use the definition above // using -DUSE_MY_ASPRINTF at compile time. if ( asprintf(&buff, "%s/" DEFAULT_CONFIG_PATH, pe_utils_get_homedir()) < 0 ) return -1; ret = pe_utils_is_file_readable(buff); if (ret == LIBPE_E_OK) if ( ! _load_config_and_parse(config, buff, _load_config_cb) ) { free( buff ); return -1; } free( buff ); // // Default values // if (config->plugins_path == NULL) config->plugins_path = strdup(DEFAULT_PLUGINS_PATH); return 0; } void pev_cleanup_config(pev_config_t * const config) { if (config == NULL) return; if ( config->user_defined.cleanup_callback && config->user_defined.data ) config->user_defined.cleanup_callback(config->user_defined.data); free(config->plugins_path); config->plugins_path = NULL; } readpe-0.84/src/dylib.c000066400000000000000000000063061455661113700147610ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* The MIT License (MIT) Copyright (c) 2013, Jardel Weyrich Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "dylib.h" #include "common.h" #include #include #include // FIX: Don't need to export. //inline const char *dylib_error(dylib_t *lib) { // UNUSED(lib); // return dlerror(); //} #define dylib_error(...) dlerror() int dylib_load(dylib_t *lib, const char *path) { if (lib->handle) { fprintf(stderr, "Can't load library because it's already loaded: %s\n", lib->path); return -1; } lib->handle = dlopen(path, RTLD_LAZY | RTLD_GLOBAL); if ( ! lib->handle ) { fprintf(stderr, "Failed to load library %s: %s\n", path, dylib_error(lib)); return -1; } lib->path = strdup(path); return 0; } int dylib_unload(dylib_t *lib) { int ret; if ( !lib->handle ) { fprintf(stderr, "Can't unload library '%s' because it's not loaded\n", lib->path); return -1; } ret = dlclose(lib->handle); if (ret != 0) { fprintf(stderr, "Failed to unload library %s: %s\n", lib->path, dylib_error(lib)); return -1; } lib->handle = NULL; free(lib->path); lib->path = NULL; return 0; } void *dylib_get_symbol(dylib_t *lib, const char *symbol) { void *addr = dlsym(lib->handle, symbol); if (addr == NULL) { fprintf(stderr, "Symbol '%s' not found in '%s': %s\n", symbol, lib->path, dylib_error(lib)); } return addr; } int dylib_has_symbol(dylib_t *lib, const char *symbol) { void *addr = dlsym(lib->handle, symbol); return addr != NULL; } readpe-0.84/src/dylib.h000066400000000000000000000043321455661113700147630ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* The MIT License (MIT) Copyright (c) 2013, Jardel Weyrich Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #pragma once typedef struct dylib { char *path; void *handle; //int loaded; // FIX: Unecessary (use 'handle' to check if loaded). } dylib_t; const char *dylib_error(dylib_t *lib); int dylib_load(dylib_t *lib, const char *path); int dylib_unload(dylib_t *lib); void *dylib_get_symbol(dylib_t *lib, const char *symbol); int dylib_has_symbol(dylib_t *lib, const char *symbol); readpe-0.84/src/malloc_s.c000066400000000000000000000010561455661113700154440ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ #include #include void *malloc_s(size_t size) { if (!size) return NULL; void *new_mem = malloc(size); if (!new_mem) { fprintf(stderr, "fatal: memory exhausted (malloc of %zu bytes)\n", size); exit(-1); } return new_mem; } void *calloc_s( size_t nmemb, size_t size ) { void *p = NULL; if ( size && nmemb ) if ( ! ( p = calloc( nmemb, size ) ) ) { fprintf( stderr, "fatal: unable to calloc (%zu elements of %zu bytes)\n", nmemb, size ); exit( EXIT_FAILURE ); } return p; } readpe-0.84/src/ofs2rva.c000066400000000000000000000064111455661113700152350ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit ofs2rva.c - converts raw file offset to RVA Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ // FIX: Needed if strtoull() is used and to test overflow. #include #include "common.h" #define PROGRAM "ofs2rva" static void usage(void) { printf("Usage: %s FILE\n" "Convert raw file offset to RVA\n" "\nExample: %s 0x1b9b8 calc.exe\n" "\nOptions:\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM); } static void parse_options(int argc, char *argv[]) { /* Parameters for getopt_long() function */ static const char short_options[] = "V"; static const struct option long_options[] = { { "help", no_argument, NULL, 1 }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } } int main(int argc, char *argv[]) { //PEV_INITIALIZE(); if (argc != 3) { usage(); return EXIT_FAILURE; } parse_options(argc, argv); pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, argv[2]); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } uint64_t ofs; // FIX: changed to strtoull(). errno = 0; ofs = strtoull(argv[1], NULL, 0); if ( !ofs || errno == ERANGE ) EXIT_ERROR("invalid offset"); err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); printf("%#"PRIx64"\n", pe_ofs2rva(&ctx, ofs)); // libera a memoria pe_unload(&ctx); //PEV_FINALIZE(); return EXIT_SUCCESS; } readpe-0.84/src/output.c000066400000000000000000000215661455661113700152230ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit output.c - Symbols and APIs to be used to output data in multiple formats. Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "output.h" #include "output_plugin.h" #include "stack.h" #include "compat/strlcat.h" #include "compat/sys/queue.h" #include #include #include // // Global variables // #define FORMAT_ID_FOR_TEXT 3 static bool g_is_document_open = false; static const format_t *g_format = NULL; static STACK_TYPE *g_scope_stack = NULL; static int g_argc = 0; static char **g_argv = NULL; static char *g_cmdline = NULL; typedef struct _format_entry { const format_t *format; SLIST_ENTRY(_format_entry) entries; } format_entry_t; static SLIST_HEAD(_format_t_list, _format_entry) g_registered_formats = SLIST_HEAD_INITIALIZER(g_registered_formats); // // Definition of internal functions // static format_entry_t *_lookup_format_entry_by_id(format_id_t id) { format_entry_t *entry; SLIST_FOREACH(entry, &g_registered_formats, entries) { if (entry->format->id == id) return entry; } return NULL; } static const format_t *_lookup_format_by_id(format_id_t id) { const format_entry_t *entry = _lookup_format_entry_by_id(id); if (entry == NULL) return NULL; return entry->format; } static void _unregister_all_formats(void) { while (!SLIST_EMPTY(&g_registered_formats)) { format_entry_t *entry = SLIST_FIRST(&g_registered_formats); SLIST_REMOVE_HEAD(&g_registered_formats, entries); free(entry); } } // // API // int output_plugin_register_format(const format_t *format) { format_entry_t *entry = calloc(1, sizeof *entry); if (entry == NULL) { //fprintf(stderr, "output: allocation failed for format entry\n"); return -1; } entry->format = format; SLIST_INSERT_HEAD(&g_registered_formats, entry, entries); return 0; } void output_plugin_unregister_format(const format_t *format) { format_entry_t *entry = _lookup_format_entry_by_id(format->id); if (entry == NULL) return; SLIST_REMOVE(&g_registered_formats, entry, _format_entry, entries); free(entry); } void output(const char *key, const char *value) { output_keyval(key, value); } void output_init(void) { g_format = _lookup_format_by_id(FORMAT_ID_FOR_TEXT); g_scope_stack = STACK_ALLOC(15); if (g_scope_stack == NULL) abort(); } void output_term(void) { free(g_cmdline); g_cmdline = NULL; const uint16_t scope_depth = STACK_COUNT(g_scope_stack); if (scope_depth > 0) { fprintf(stderr, "output: terminating the output while there are open scopes will cause memory leaks"); } // TODO(jweyrich): Should we loop to pop + close + output every scope? if (g_scope_stack != NULL) STACK_DEALLOC(g_scope_stack); _unregister_all_formats(); } const char *output_cmdline(void) { return g_cmdline; } void output_set_cmdline(int argc, char *argv[]) { g_argc = argc; g_argv = argv; free(g_cmdline); g_cmdline = pe_utils_str_array_join(g_argv, g_argc, ' '); if (g_cmdline == NULL) { fprintf(stderr, "output: allocation failed for pe_utils_str_array_join\n"); abort(); } //fprintf(stderr, "DEBUG: cmdline = %s\n", g_cmdline); } const format_t *output_format(void) { return g_format; } const format_t *output_parse_format(const char *format_name) { const format_t *format = NULL; format_entry_t *entry; SLIST_FOREACH(entry, &g_registered_formats, entries) { // TODO(jweyrich): Should we use strcasecmp? Conforms to 4.4BSD and POSIX.1-2001, but not to C89 nor C99. if (strcmp(format_name, entry->format->name) == 0) { format = entry->format; break; } } return format; } void output_set_format(const format_t *format) { g_format = format; } int output_set_format_by_name(const char *format_name) { const format_t *format = output_parse_format(format_name); if (format == NULL) return -1; output_set_format(format); return 0; } size_t output_available_formats(char *buffer, size_t size, char separator) { size_t total_available = 0; size_t consumed = 0; bool truncated = false; // FIXME: Theoretically unecessary, since a NUL char is // appended at the end of the buffer. memset(buffer, 0, size); format_entry_t *entry; SLIST_FOREACH(entry, &g_registered_formats, entries) { if (!truncated) { const char *format_name = entry->format->name; consumed = bsd_strlcat(buffer, format_name, size); if (consumed > size) { // TODO(jweyrich): Handle truncation. total_available++; truncated = true; continue; } if (consumed < size - 1) { buffer[consumed++] = separator; } } total_available++; } // FIXME: What if the list is empty? // In that case 'consumed-1' will evaluate to -1. buffer[consumed - 1] = '\0'; return total_available; } void output_open_document(void) { output_open_document_with_name(NULL); } void output_open_document_with_name(const char *document_name) { assert(g_format != NULL); // Cannot open a new document while there's one already open. assert(!g_is_document_open); const char *key = document_name; const output_scope_type_e scope_type = OUTPUT_SCOPE_TYPE_DOCUMENT; output_open_scope(key, scope_type); g_is_document_open = true; } void output_close_document(void) { assert(g_format != NULL); // Closing a document without first opening it is an error. assert(g_is_document_open); const output_scope_t *scope = NULL; int ret = STACK_PEEK(g_scope_stack, (void *)&scope); if (ret < 0) { fprintf(stderr, "output: cannot close a scope that has not been opened.\n"); abort(); } if (scope->type != OUTPUT_SCOPE_TYPE_DOCUMENT) { fprintf(stderr, "output: trying to close a document, but the current scope is of a different type.\n"); abort(); } output_close_scope(); g_is_document_open = false; } void output_open_scope(const char *scope_name, output_scope_type_e scope_type) { assert(g_format != NULL); const char *key = scope_name; const char *value = NULL; const output_type_e type = OUTPUT_TYPE_SCOPE_OPEN; const uint16_t scope_depth = STACK_COUNT(g_scope_stack); output_scope_t * const scope = malloc(sizeof *scope); if (scope == NULL) abort(); // Abort because it failed miserably! scope->name = scope_name == NULL ? NULL : strdup(scope_name); scope->type = scope_type; scope->depth = scope_depth + 1; if (scope_depth > 0) { output_scope_t * parent_scope = NULL; STACK_PEEK(g_scope_stack, (void *)&parent_scope); scope->parent_type = parent_scope->type; } //fprintf(stderr, "DEBUG: output_open_scope: scope_depth=%d\n", STACK_COUNT(g_scope_stack)); if (g_format != NULL) g_format->output_fn(g_format, type, scope, key, value); int ret = STACK_PUSH(g_scope_stack, (void *)scope); if (ret < 0) abort(); // Abort because it failed miserably! } void output_close_scope(void) { assert(g_format != NULL); output_scope_t *scope = NULL; int ret = STACK_POP(g_scope_stack, (void *)&scope); if (ret < 0) { fprintf(stderr, "output: cannot close a scope that has not been opened.\n"); abort(); } const char *key = NULL; const char *value = NULL; const output_type_e type = OUTPUT_TYPE_SCOPE_CLOSE; //fprintf(stderr, "DEBUG: output_close_scope: scope_depth=%d\n", STACK_COUNT(g_scope_stack)); if (g_format != NULL) g_format->output_fn(g_format, type, scope, key, value); free(scope->name); free(scope); } void output_keyval(const char *key, const char *value) { assert(g_format != NULL); const uint16_t scope_depth = STACK_COUNT(g_scope_stack); const output_scope_t *scope = NULL; if (scope_depth > 0) STACK_PEEK(g_scope_stack, (void *)&scope); const output_type_e type = OUTPUT_TYPE_ATTRIBUTE; if (g_format != NULL) g_format->output_fn(g_format, type, scope, key, value); } readpe-0.84/src/output_plugin.c000066400000000000000000000123341455661113700165720ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit output_plugin.c - Symbols and APIs to be used by output plugins. Copyright (C) 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "output_plugin.h" #include #include size_t escape_count_chars_ex(const char *str, size_t len, const entity_table_t entities) { size_t result = 0; for (size_t i = 0; i < len; i++) { const unsigned char index = (unsigned char)str[i]; const entity_t entity = entities[index]; result += entity == NULL ? 1 : strlen(entity); } return result; } // Returns a new copy of `str` enclosed with quotes. static char *strdup_quoted(const char *str) { if (str == NULL) return NULL; // const size_t old_length = strlen(str); // const size_t new_length = old_length + 2; // // char *new_str = malloc(new_length + 1); // Extra byte for NULL terminator // if (new_str == NULL) // return NULL; // // new_str[0] = '"'; // new_str[new_length - 1] = '"'; // new_str[new_length] = '\0'; // // memcpy(new_str + 1, str, old_length); // // return new_str; char *new_str; if ( asprintf( &new_str, "\"%s\"", str ) < 0 ) return NULL; return new_str; } #if 0 static size_t escape_count_chars(const format_t *format, const char *str, size_t len) { return escape_count_chars_ex(str, len, format->entities_table); } #endif char *escape_ex_quoted(const char *str, const entity_table_t entities) { if (str == NULL) return NULL; if (str[0] == '\0') return strdup("\"\""); if (entities == NULL) return strdup_quoted(str); const size_t old_length = strlen(str); const size_t new_length = escape_count_chars_ex(str, old_length, entities) + 2; // Extra bytes for quotes char *new_str = malloc(new_length + 1); // Extra byte for NULL terminator if (new_str == NULL) abort(); new_str[0] = '"'; new_str[new_length - 1] = '"'; new_str[new_length] = '\0'; // `consumed` starts in 1 because of the initial quote. size_t consumed = 1; for (size_t i = 0; i < old_length; i++) { const unsigned char index = (unsigned char)str[i]; const entity_t entity = entities[index]; if (entity == NULL) { new_str[consumed++] = str[i]; } else { const size_t entity_len = strlen(entity); memcpy(new_str + consumed, entity, entity_len); consumed += entity_len; } } return new_str; } char *escape_ex(const char *str, const entity_table_t entities) { if (str == NULL) return NULL; if (str[0] == '\0') return strdup(""); if (entities == NULL) return strdup(str); const size_t old_length = strlen(str); const size_t new_length = escape_count_chars_ex(str, old_length, entities); char *new_str = malloc(new_length + 1); // Extra byte for NULL terminator if (new_str == NULL) abort(); new_str[new_length] = '\0'; size_t consumed = 0; for (size_t i = 0; i < old_length; i++) { const unsigned char index = (unsigned char)str[i]; const entity_t entity = entities[index]; if (entity == NULL) { new_str[consumed++] = str[i]; } else { const size_t entity_len = strlen(entity); memcpy(new_str + consumed, entity, entity_len); consumed += entity_len; } } return new_str; } char *escape(const format_t *format, const char *str) { return escape_ex(str, format->entities_table); } char *escape_quoted(const format_t *format, const char *str) { return escape_ex_quoted(str, format->entities_table); } // These 2 are implemented in `output.c`. extern int output_plugin_register_format(const format_t *format); extern void output_plugin_unregister_format(const format_t *format); output_plugin_api_t *output_plugin_api_ptr(void) { static output_plugin_api_t api = { .output_cmdline = output_cmdline, .output_plugin_register_format = output_plugin_register_format, .output_plugin_unregister_format = output_plugin_unregister_format, .escape_count_chars_ex = escape_count_chars_ex, .escape_ex = escape_ex, .escape_ex_quoted = escape_ex_quoted, .escape = escape, .escape_quoted = escape_quoted }; return &api; } readpe-0.84/src/pedis.c000066400000000000000000000265561455661113700147730ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pedis.c - PE disassembler Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include "../lib/libudis86/udis86.h" #include #include #include "plugins.h" #define PROGRAM "pedis" #define SPACES 32 // spaces # for text-based output #define SYN_ATT 1 #define SYN_INTEL 0 typedef struct { bool all_sections; char *section; bool syntax; uint64_t offset; uint64_t nbytes; // limit the number of bytes instructions. 0 means no limit. uint64_t ninstructions; // limit the number of disassembled instructions. 0 means no limit. bool entrypoint; bool offset_is_rva; uint16_t mode; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s OPTIONS FILE\n" "Disassemble PE sections and functions (by default, until found a RET or LEAVE instruction)\n" "\nExample: %s -r 0x4c4df putty.exe\n" "\nOptions:\n" " --att Set AT&T assembly syntax (default: Intel).\n" " -e, --entrypoint Disassemble the entire entrypoint function.\n" " -f, --format <%s> Change output format (default: text).\n" " -m, --mode <16|32|64> Disassembly mode (default: auto).\n" " -i Number of instructions to disassemble.\n" " -n Number of bytes to disassemble\n" " -o, --offset Disassemble at specified offset, either in decimal or hexadecimal format (prefixed with 0x).\n" " -r, --rva Disassemble at specified RVA, either in decimal or hexadecimal format (prefixed with 0x).\n" " -s, --section Disassemble en entire section given.\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM, formats); } static void free_options(options_t *options) { if (options) free(options->section); free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); /* Parameters for getopt_long() function */ static const char short_options[] = "em:i:n:o:r:s:f:V"; static const struct option long_options[] = { { "help", no_argument, NULL, 1 }, { "att", no_argument, NULL, 2 }, { "", required_argument, NULL, 'n' }, { "entrypoint", no_argument, NULL, 'e' }, { "mode", required_argument, NULL, 'm' }, { "offset", required_argument, NULL, 'o' }, { "rva", required_argument, NULL, 'r' }, { "section", required_argument, NULL, 's' }, { "format", required_argument, NULL, 'f' }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; options->syntax = SYN_INTEL; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 2: options->syntax = SYN_ATT; break; case 'e': options->entrypoint = true; break; case 'm': options->mode = strtol(optarg, NULL, 10); switch (options->mode) { default: EXIT_ERROR("Bad argument for mode."); case 16: break; case 32: break; case 64: break; } break; case 'i': // FIX: errno is not zeroed automatically if already set. errno = 0; options->ninstructions = strtol(optarg, NULL, 0); if (errno == ERANGE) EXIT_ERROR("number of instructions value would underflow or overflow"); break; case 'n': // FIX: errno is not zeroed automatically if already set. errno = 0; options->nbytes = strtol(optarg, NULL, 0); if (errno == ERANGE) EXIT_ERROR("number of bytes value would underflow or overflow"); break; case 'o': // FIX: errno is not zeroed automatically if already set. errno = 0; options->offset = strtol(optarg, NULL, 0); if (errno == ERANGE) EXIT_ERROR("offset value would underflow or overflow"); options->offset_is_rva = false; break; case 'r': // FIX: errno is not zeroed automatically if already set. errno = 0; options->offset = strtol(optarg, NULL, 0); if (errno == ERANGE) EXIT_ERROR("rva value would underflow or overflow"); options->offset_is_rva = true; break; case 's': options->section = strdup(optarg); break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } static char *insert_spaces(const char *s) { size_t size /*, wsize */; char *new; size = strlen(s); if (!size) return NULL; // wsize = size / 2; size = size + (size/2); // FIXME: Maybe a better approach to the loop below is: // new = malloc( size + 1 ); // // short *p = (short *)str; // short *q = (short *)new; // while ( wsize-- ) // { // *q++ = *p++; // *(char *)q++ = ' '; // } // *(char *)q = 0; // return new; new = calloc_s(1, size+1); for (unsigned int i=0, j=0, pos=0; i < size; i++) { if (pos==2) { new[i] = ' '; pos=0; } else { new[i] = s[j++]; pos++; } } return new; } static bool is_ret_instruction(unsigned char opcode) { switch (opcode) { case 0xc9: // leave (this isn't a ret instruction!). //case 0xc2: // ret imm16 (why not?) case 0xc3: // ret case 0xca: // retf imm16 //case 0xcb: // retf (why not?) return true; default: return false; } } static void disassemble_offset(pe_ctx_t *ctx, const options_t *options, ud_t *ud_obj, uint64_t offset) { if (ctx == NULL || offset == 0) return; uint64_t instr_counter = 0; // counter for disassembled instructions uint64_t byte_counter = 0; // counter for disassembled bytes while (ud_disassemble(ud_obj)) { char ofs[MAX_MSG], value[MAX_MSG], *bytes; const uint8_t *opcode = ud_insn_ptr(ud_obj); instr_counter++; // increment instruction counter byte_counter += ud_insn_len(ud_obj); if (options->nbytes && byte_counter >= options->nbytes) return; const ud_mnemonic_code_t mnic = ud_insn_mnemonic(ud_obj); const ud_operand_t *operand = ud_insn_opr(ud_obj, 0); const ud_type_t op_type = operand != NULL ? operand->type : 0; snprintf(ofs, MAX_MSG, "%"PRIx64, (options->offset_is_rva ? ctx->pe.imagebase : 0) + offset + ud_insn_off(ud_obj)); bytes = insert_spaces(ud_insn_hex(ud_obj)); if (!bytes) return; // correct near operand addresses for calls and jumps if (op_type && (op_type != UD_OP_MEM) && (mnic == UD_Icall || (mnic >= UD_Ijo && mnic <= UD_Ijmp))) { char *instr_asm = strdup(ud_insn_asm(ud_obj)); char *instr = strtok(instr_asm, "0x"); snprintf(value, MAX_MSG, "%s%*c%s%#"PRIx64, bytes, SPACES - (int) strlen(bytes), ' ', instr ? instr : "", ctx->pe.imagebase + offset + ud_insn_off(ud_obj) + ud_obj->operand[0].lval.sdword + ud_insn_len(ud_obj) ); free(instr_asm); } else snprintf(value, MAX_MSG, "%s%*c%s", bytes, SPACES - (int) strlen(bytes), ' ', ud_insn_asm(ud_obj)); free(bytes); output(ofs, value); // for sections, we stop at end of section if (options->section && instr_counter >= options->ninstructions) break; else if (instr_counter >= options->ninstructions && options->ninstructions) break; else if (options->entrypoint) { // search for LEAVE or RET insrtuctions for (unsigned int i=0; i < ud_insn_len(ud_obj); i++) if (is_ret_instruction(opcode[i])) return; } } } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); exit(EXIT_FAILURE); } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); // opcoes const char *path = argv[argc-1]; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, path); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); IMAGE_OPTIONAL_HEADER *optional = pe_optional(&ctx); if (optional == NULL) return EXIT_FAILURE; uint8_t mode_bits = 0; switch (optional->type) { default: EXIT_ERROR("Unsupported architecture."); return EXIT_FAILURE; case MAGIC_PE32: mode_bits = 32; break; case MAGIC_PE64: mode_bits = 64; break; } // FIX: Only those are supported here. IMAGE_COFF_HEADER *coff = pe_coff(&ctx); switch ( coff->Machine ) { case IMAGE_FILE_MACHINE_AMD64: case IMAGE_FILE_MACHINE_I386: break; default: EXIT_ERROR("Unsupported machine (AMD64 or I386)." ); return EXIT_FAILURE; } ud_t ud_obj; // libudis86 object ud_init(&ud_obj); // set disassembly mode according with PE architecture ud_set_mode(&ud_obj, options->mode ? options->mode : mode_bits); uint64_t offset = 0; // offset to start disassembly if (options->entrypoint) offset = pe_rva2ofs(&ctx, ctx.pe.entrypoint); else if (options->offset) offset = options->offset_is_rva ? pe_rva2ofs(&ctx, options->offset) : options->offset; else if (options->section) { IMAGE_SECTION_HEADER *section = pe_section_by_name(&ctx, options->section); if (section) { // section found offset = section->PointerToRawData; if (!options->ninstructions) options->ninstructions = section->SizeOfRawData; } else EXIT_ERROR("invalid section name"); } else { usage(); return EXIT_FAILURE; } if (!offset) { fprintf(stderr, "unable to reach file offset (%#"PRIx64")\n", offset); return EXIT_FAILURE; } output_open_document(); ud_set_syntax(&ud_obj, options->syntax ? UD_SYN_ATT : UD_SYN_INTEL); ud_set_input_buffer(&ud_obj, ctx.map_addr, pe_filesize(&ctx)); //ud_set_input_file(&ud_obj, ctx.stream); ud_input_skip(&ud_obj, offset); disassemble_offset(&ctx, options, &ud_obj, offset); output_close_document(); // libera a memoria free_options(options); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/pehash.c000066400000000000000000000276431455661113700151350ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pehash.c - calculate hashes of PE pieces Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include "plugins.h" #define PROGRAM "pehash" unsigned pefile_warn = 0; typedef struct { bool all; bool content; struct { bool all; bool dos; bool coff; bool optional; } headers; struct { char *name; uint16_t index; } sections; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s OPTIONS FILE\n" "Calculate hashes of PE pieces\n" "\nExample: %s -s '.text' winzip.exe\n" "\nOptions:\n" " -f, --format <%s> Change output format (default: text).\n" " -a, --all Hash file, sections and headers with md5, sha1, sha256, ssdeep and imphash.\n" " -c, --content Hash only the file content (default).\n" " -h, --header Hash only the header with the specified name.\n" " -s, --section Hash only the section with the specified name.\n" " --section-index Hash only the section at the specified index (1..n).\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM, formats); } static void parse_header_name(options_t *options, const char *optarg) { if (strcmp(optarg, "dos") == 0) options->headers.dos = true; else if (strcmp(optarg, "coff") == 0) options->headers.coff = true; else if (strcmp(optarg, "optional") == 0) options->headers.optional = true; else EXIT_ERROR("invalid header name option"); } static void free_options(options_t *options) { if (options) free(options->sections.name); free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); // parameters for getopt_long() function static const char short_options[] = "f:a:c:h:s:V"; static const struct option long_options[] = { { "help", no_argument, NULL, 1 }, { "format", required_argument, NULL, 'f' }, { "all", no_argument, NULL, 'a' }, { "content", no_argument, NULL, 'c' }, { "header", required_argument, NULL, 'h' }, { "section-name", required_argument, NULL, 's' }, { "section-index", required_argument, NULL, 2 }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; // Setting the default option options->content = true; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; case 'a': options->all = true; break; case 'c': // default options->all = false; //TODO remover? options->content = true; break; case 's': options->all = false; options->headers.all = false; // TODO: How do we need to handle non-ascii names? options->sections.name = strdup(optarg); break; case 2: options->all = false; options->headers.all = false; options->sections.index = strtol(optarg, NULL, 10); if (options->sections.index < 1 || options->sections.index > MAX_SECTIONS) { EXIT_ERROR("Bad argument for section-index,"); } break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); case 'h': options->all = false; options->headers.all = false; parse_header_name(options, optarg); break; default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } // TODO: Warn about simultaneous usage of -h, -s, and --section-index. return options; } static void print_basic_hash(const unsigned char *data, size_t data_size) { if (!data || !data_size) return; const char *basic_hashes[] = { "md5", "sha1", "sha256", "ssdeep" }; const size_t hash_value_size = pe_hash_recommended_size(); char *hash_value = malloc_s(hash_value_size); for (size_t i=0; i < sizeof(basic_hashes) / sizeof(char *); i++) { pe_hash_raw_data(hash_value, hash_value_size, basic_hashes[i], data, data_size); output(basic_hashes[i], hash_value); } free(hash_value); } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); return EXIT_FAILURE; } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, argv[argc-1]); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); const IMAGE_SECTION_HEADER *section_ptr = NULL; const unsigned char *data = NULL; uint64_t data_size = 0; unsigned c = pe_sections_count(&ctx); IMAGE_SECTION_HEADER ** const sections = pe_sections(&ctx); data = ctx.map_addr; data_size = pe_filesize(&ctx); output_open_document(); if (options->headers.all || options->headers.dos || options->headers.coff || options->headers.optional || options->sections.name || options->sections.index) { options->all = false; options->content = false; } if (options->all) { options->content = true; options->headers.all = true; } if (options->content) { output_open_scope("file", OUTPUT_SCOPE_TYPE_OBJECT); output("filepath", ctx.path); print_basic_hash(data, data_size); char *imphash = NULL; // imphash = pe_imphash(&ctx, LIBPE_IMPHASH_FLAVOR_MANDIANT); // output("imphash (Mandiant)", imphash); // free(imphash); imphash = pe_imphash(&ctx, LIBPE_IMPHASH_FLAVOR_PEFILE); if (imphash) { output("imphash", imphash); free(imphash); } output_close_scope(); // file if (!options->all) // whole file content only goto BYE; } if (options->headers.all) { options->headers.dos = true; options->headers.coff = true; options->headers.optional = true; } if (options->headers.all || options->headers.dos || options->headers.coff || options->headers.optional) output_open_scope("headers", OUTPUT_SCOPE_TYPE_ARRAY); if (options->headers.all || options->headers.dos) { const IMAGE_DOS_HEADER *dos_hdr = pe_dos(&ctx); data = (const unsigned char *)dos_hdr; data_size = sizeof(IMAGE_DOS_HEADER); output_open_scope("header", OUTPUT_SCOPE_TYPE_OBJECT); output("header_name", "IMAGE_DOS_HEADER"); print_basic_hash(data, data_size); output_close_scope(); // header } if (options->headers.all || options->headers.coff) { const IMAGE_COFF_HEADER *coff_hdr = pe_coff(&ctx); data = (const unsigned char *)coff_hdr; data_size = sizeof(IMAGE_COFF_HEADER); output_open_scope("header", OUTPUT_SCOPE_TYPE_OBJECT); output("header_name", "IMAGE_COFF_HEADER"); print_basic_hash(data, data_size); output_close_scope(); // header } if (options->headers.all || options->headers.optional) { const IMAGE_OPTIONAL_HEADER *opt_hdr = pe_optional(&ctx); switch (opt_hdr->type) { case MAGIC_ROM: if (!pe_can_read(&ctx, opt_hdr->_rom, sizeof(IMAGE_ROM_OPTIONAL_HEADER))) { // TODO: Should we report something? break; } data = (const unsigned char *)opt_hdr->_rom; data_size = sizeof(IMAGE_ROM_OPTIONAL_HEADER); break; case MAGIC_PE32: if (!pe_can_read(&ctx, opt_hdr->_32, sizeof(IMAGE_OPTIONAL_HEADER_32))) { // TODO: Should we report something? break; } data = (const unsigned char *)opt_hdr->_32; data_size = sizeof(IMAGE_OPTIONAL_HEADER_32); break; case MAGIC_PE64: if (!pe_can_read(&ctx, opt_hdr->_64, sizeof(IMAGE_OPTIONAL_HEADER_64))) { // TODO: Should we report something? break; } data = (const unsigned char *)opt_hdr->_64; data_size = sizeof(IMAGE_OPTIONAL_HEADER_64); break; } output_open_scope("header", OUTPUT_SCOPE_TYPE_OBJECT); output("header_name", "IMAGE_OPTIONAL_HEADER"); print_basic_hash(data, data_size); output_close_scope(); // header } if (options->headers.all || options->headers.dos || options->headers.coff || options->headers.optional) output_close_scope(); // headers if (options->all || options->sections.name || options->sections.index) output_open_scope("sections", OUTPUT_SCOPE_TYPE_ARRAY); if (options->all) { for (unsigned int i=0; iSizeOfRawData; data = LIBPE_PTR_ADD(ctx.map_addr, sections[i]->PointerToRawData); if (!pe_can_read(&ctx, data, data_size)) { LIBPE_WARNING("Unable to read section data"); } else { output_open_scope("section", OUTPUT_SCOPE_TYPE_OBJECT); output("section_name", (char *)sections[i]->Name); if (data_size) { print_basic_hash(data, data_size); } output_close_scope(); // section } } //output_close_scope(); // sections } else if (options->sections.name != NULL) { const IMAGE_SECTION_HEADER *section = pe_section_by_name(&ctx, options->sections.name); if (section == NULL) { EXIT_ERROR("The requested section could not be found on this binary"); } section_ptr = section; } else if (options->sections.index > 0) { const uint16_t num_sections = pe_sections_count(&ctx); if (num_sections == 0 || options->sections.index > num_sections) { EXIT_ERROR("The requested section could not be found on this binary"); } IMAGE_SECTION_HEADER ** const sections = pe_sections(&ctx); const IMAGE_SECTION_HEADER *section = sections[options->sections.index - 1]; section_ptr = section; } if (section_ptr != NULL) { if (section_ptr->SizeOfRawData > 0) { const uint8_t *section_data_ptr = LIBPE_PTR_ADD(ctx.map_addr, section_ptr->PointerToRawData); // fprintf(stderr, "map_addr = %p\n", ctx.map_addr); // fprintf(stderr, "section_data_ptr = %p\n", section_data_ptr); // fprintf(stderr, "SizeOfRawData = %u\n", section_ptr->SizeOfRawData); if (!pe_can_read(&ctx, section_data_ptr, section_ptr->SizeOfRawData)) { EXIT_ERROR("The requested section has an invalid size"); } data = (const unsigned char *)section_data_ptr; data_size = section_ptr->SizeOfRawData; } else { data = (const unsigned char *)""; data_size = 0; } } if (!options->all && data != NULL) { output_open_scope("section", OUTPUT_SCOPE_TYPE_OBJECT); output("section_name", options->sections.name); print_basic_hash(data, data_size); output_close_scope(); } if (options->all || options->sections.name || options->sections.index) output_close_scope(); BYE: output_close_document(); // free free_options(options); err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/peldd.c000066400000000000000000000100061455661113700147360ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit peldd.c - shows library dependencies for a given PE file Copyright (C) 2018 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include #include "output.h" #define PROGRAM "peldd" static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s FILE\n" "Display PE library dependencies\n" "\nExample: %s winzip.exe\n" "\nOptions:\n" " -f, --format <%s> Change output format (default: text).\n" " -V, --version Show version.\n" " --help Show help.\n", PROGRAM, PROGRAM, formats); } static void parse_options(int argc, char *argv[]) { /* Parameters for getopt_long() function */ static const char short_options[] = "Vf:"; static const struct option long_options[] = { { "help", no_argument, NULL, 1 }, { "format", required_argument, NULL, 'f' }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } } static void print_dependencies(pe_ctx_t *ctx) { output_open_scope("Dependencies", OUTPUT_SCOPE_TYPE_ARRAY); const pe_imports_t *imports = pe_imports(ctx); for (size_t i=0; i < imports->dll_count; i++) { const pe_imported_dll_t *dll = &imports->dlls[i]; output(dll->name, NULL); } output_close_scope(); } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); return EXIT_FAILURE; } output_set_cmdline(argc, argv); parse_options(argc, argv); pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, argv[argc-1]); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); output_open_document(); IMAGE_DATA_DIRECTORY **directories = pe_directories(&ctx); if (directories == NULL) { LIBPE_WARNING("directories not found"); } else { print_dependencies(&ctx); } output_close_document(); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/pepack.c000066400000000000000000000176661455661113700151340ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pepack.c - search packers in PE files Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include "plugins.h" #define PROGRAM "pepack" #define MAX_SIG_SIZE 2048 typedef struct { char *dbfile; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s FILE\n" "Search for packers in PE files\n" "\nExample: %s putty.exe\n" "\nOptions:\n" " -d, --database Use database file (default: ./userdb.txt).\n" " -f, --format <%s> Change output format (default: text).\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM, formats); } static void free_options(options_t *options) { if (options) free(options->dbfile); free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); /* Parameters for getopt_long() function */ static const char short_options[] = "d:f:V"; static const struct option long_options[] = { { "database", required_argument, NULL, 'd' }, { "format", required_argument, NULL, 'f' }, { "help", no_argument, NULL, 1 }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'd': options->dbfile = strdup(optarg); break; case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } /* MEW Packer and others basically stores the entrypoint in a section marked only as readable (without executable and/or writable flags) Windows Loader still executes the binary */ static bool generic_packer(pe_ctx_t *ctx, uint64_t entrypoint) { IMAGE_SECTION_HEADER *section = pe_rva2section(ctx, entrypoint); if (section == NULL) return false; // we count the flags for the section and if there is more than // 2 it means we don't have the mew_packer static const SectionCharacteristics invalid_flags[] = { IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE }; // MEW never leave EP in .text section if (memcmp(section->Name, ".text", 5) == 0) return false; unsigned short flags_count = 0; for (size_t i=0; i < LIBPE_SIZEOF_ARRAY(invalid_flags); i++) { if (section->Characteristics & invalid_flags[i]) flags_count++; } return flags_count < 3; } // FIX: Changed function name 'cause this don't 'load' anything. static bool opendb(FILE **fp, const options_t *options) { const char *dbfile = options->dbfile ? options->dbfile : "userdb.txt"; *fp = fopen(dbfile, "r"); // FIXME(jweyrich): Granted read permission to the informed dbfile, this will succeed even if it's a directory! if (!*fp) { // SHAREDIR is defined via CPPFLAGS in the Makefile *fp = fopen(SHAREDIR "/userdb.txt", "r"); } return *fp != NULL; } static bool match_peid_signature(const unsigned char *data, char *sig) { unsigned char byte_str[3], byte; // add null terminator byte_str[2] = '\0'; while (*sig) { // ignore '=' and blank spaces if (*sig == '=' || *sig == ' ') { sig++; continue; } // match "??" if (*sig == '?') { sig += 2; data++; continue; } memcpy(byte_str, sig, 2); byte = strtoul((char *) byte_str, NULL, 16); if (*data++ != byte) return false; sig += 2; // next two characters of signature } return true; } static bool compare_signature(const unsigned char *data, uint64_t ep_offset, FILE *dbfile, char *packer_name, size_t packer_name_len) { if (!dbfile || !data) return false; // FIX: 2 KiB buffer isn't a big deal and this function is single threaded. static char buff[MAX_SIG_SIZE]; //memset(buff, 0, MAX_SIG_SIZE); while (fgets(buff, MAX_SIG_SIZE, dbfile)) { // line length size_t len = strlen(buff); // ignore comments and blank lines if (*buff == ';' || *buff == '\n' || *buff == '\r') continue; // remove newline from buffer if (*(buff+len-1) == '\n') *(buff+len-1) = '\0'; // removing carriage return, if present if (*(buff+len-2) == '\r') { *(buff+len-2) = '\0'; //*(buff+len-1) = '\0'; len--; // update line length } // line have [packer name]? Fill packer_name pointer if (*buff == '[' && *(buff+len-2) == ']') { *(buff+len-2) = '\0'; // remove square brackets strncpy(packer_name, buff+1, packer_name_len); packer_name[packer_name_len-1] = '\0'; // Guarantee it's Null-terminated. } // check if signature match if (!strncasecmp(buff, "signature", 9)) if (match_peid_signature(data + ep_offset, buff+9)) return true; } return false; } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); exit(EXIT_FAILURE); } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); // opcoes const char *path = argv[argc-1]; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, path); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); const uint64_t ep_offset = pe_rva2ofs(&ctx, ctx.pe.entrypoint); if (ep_offset == 0) EXIT_ERROR("unable to get entrypoint offset"); FILE *dbfile; if (!opendb(&dbfile, options)) fprintf(stderr, "WARNING: without valid database file, %s will search in generic mode only\n", PROGRAM); static char value[MAX_MSG + 1]; // TODO(jweyrich): Create a new API to retrieve map_addr. // TODO(jweyrich): Should we use `LIBPE_PTR_ADD(ctx->map_addr, ep_offset)` instead? const unsigned char *pe_data = ctx.map_addr; // packer by signature if (compare_signature(pe_data, ep_offset, dbfile, value, MAX_MSG)) ; // generic detection else if (generic_packer(&ctx, ep_offset)) snprintf(value, MAX_MSG, "generic"); else snprintf(value, MAX_MSG, "no packer found"); output_open_document(); output("packer", value); output_close_document(); // FIX: Already tested of openess. fclose(dbfile); // libera a memoria free_options(options); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/peres.c000066400000000000000000000522511455661113700147740ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit peres.c - retrive informations and binary data of resources Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include #include #include #include #include #include #define PROGRAM "peres" const char *g_resourceDir = "resources"; typedef struct { bool all; bool extract; bool namedExtract; bool info; bool statistics; bool list; bool version; bool help; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s OPTIONS FILE\n" "Show information about resource section and extract it\n" "\nExample: %s -a putty.exe\n" "\nOptions:\n" " -a, --all Show all information, statistics and extract resources\n" " -f, --format <%s> change output format (default: text)\n" " -i, --info Show resources information\n" " -l, --list Show list view\n" " -s, --statistics Show resources statistics\n" " -x, --extract Extract resources\n" " -X, --named-extract Extract resources with path names\n" " -v, --file-version Show File Version from PE resource directory\n" " -V, --version Show version and exit\n" " --help Show this help and exit\n", PROGRAM, PROGRAM, formats); } static void free_options(options_t *options) { // FIX: Don't need to test for NULL pointer. //if (options == NULL) // return; free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof *options); /* Parameters for getopt_long() function */ static const char short_options[] = "a:f:ilsxXvV"; static const struct option long_options[] = { { "all", required_argument, NULL, 'a' }, { "format", required_argument, NULL, 'f' }, { "info", no_argument, NULL, 'i' }, { "list", no_argument, NULL, 'l' }, { "statistics", no_argument, NULL, 's' }, { "extract", no_argument, NULL, 'x' }, { "named-extract", no_argument, NULL, 'X' }, { "file-version", no_argument, NULL, 'v' }, { "version", no_argument, NULL, 'V' }, { "help", no_argument, NULL, 1 }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 'a': options->all = true; break; case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; case 'i': options->info = true; break; case 'l': options->list = true; break; case 's': options->statistics = true; break; case 'x': options->extract = true; break; case 'X': options->extract = true; options->namedExtract = true; break; case 'v': options->version = true; break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); case 1: // --help option usage(); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } static void peres_show_node(pe_ctx_t *ctx, const pe_resource_node_t *node) { char value[MAX_MSG]; switch (node->type) { default: LIBPE_WARNING("Invalid node type"); break; case LIBPE_RDT_RESOURCE_DIRECTORY: { const IMAGE_RESOURCE_DIRECTORY * const resourceDirectory = node->raw.resourceDirectory; snprintf(value, MAX_MSG, "Resource Directory / %d", node->dirLevel); output("\nNode Type / Level", value); snprintf(value, MAX_MSG, "%d", resourceDirectory->Characteristics); output("Characteristics", value); snprintf(value, MAX_MSG, "%d", resourceDirectory->TimeDateStamp); output("Timestamp", value); snprintf(value, MAX_MSG, "%d", resourceDirectory->MajorVersion); output("Major Version", value); snprintf(value, MAX_MSG, "%d", resourceDirectory->MinorVersion); output("Minor Version", value); snprintf(value, MAX_MSG, "%d", resourceDirectory->NumberOfNamedEntries); output("Named entries", value); snprintf(value, MAX_MSG, "%d", resourceDirectory->NumberOfIdEntries); output("Id entries", value); break; } case LIBPE_RDT_DIRECTORY_ENTRY: { const IMAGE_RESOURCE_DIRECTORY_ENTRY * const directoryEntry = node->raw.directoryEntry; snprintf(value, MAX_MSG, "Directory Entry / %d", node->dirLevel); output("\nNode Type / Level", value); snprintf(value, MAX_MSG, "%d", directoryEntry->u0.data.NameOffset); output("Name offset", value); snprintf(value, MAX_MSG, "%d", directoryEntry->u0.data.NameIsString); output("Name is string", value); snprintf(value, MAX_MSG, "%x", directoryEntry->u1.data.OffsetToDirectory); output("Offset to directory", value); snprintf(value, MAX_MSG, "%d", directoryEntry->u1.data.DataIsDirectory); output("Data is directory", value); break; } case LIBPE_RDT_DATA_STRING: { const IMAGE_RESOURCE_DATA_STRING_U * const dataString = node->raw.dataString; snprintf(value, MAX_MSG, "Data String / %d", node->dirLevel); output("\nNode Type / Level", value); snprintf(value, MAX_MSG, "%d", dataString->Length); output("String len", value); char ascii_string[MAX_MSG]; // FIXME: dataString->Length + 1 is right?! pe_utils_str_widechar2ascii(ascii_string, sizeof ascii_string, (const char *)dataString->String, dataString->Length + 1); snprintf(value, MAX_MSG, "%s", ascii_string); output("String", value); break; } case LIBPE_RDT_DATA_ENTRY: { const IMAGE_RESOURCE_DATA_ENTRY * const dataEntry = node->raw.dataEntry; snprintf(value, MAX_MSG, "Data Entry / %d", node->dirLevel); output("\nNode Type / Level", value); snprintf(value, MAX_MSG, "%x", dataEntry->OffsetToData); output("OffsetToData", value); snprintf(value, MAX_MSG, "%d", dataEntry->Size); output("Size", value); snprintf(value, MAX_MSG, "%d", dataEntry->CodePage); output("CodePage", value); snprintf(value, MAX_MSG, "%d", dataEntry->Reserved); output("Reserved", value); break; } } } static void peres_show_nodes(pe_ctx_t *ctx, const pe_resource_node_t *node) { if (node == NULL) return; peres_show_node(ctx, node); peres_show_nodes(ctx, node->childNode); peres_show_nodes(ctx, node->nextNode); } static void peres_build_node_filename(pe_ctx_t *ctx, char *output, size_t output_size, const pe_resource_node_t *node) { UNUSED(ctx); char partial_path[MAX_PATH]; for (pe_resource_level_e level = LIBPE_RDT_LEVEL1; level <= node->dirLevel; level++) { const pe_resource_node_t *dir_entry_node = pe_resource_find_parent_node_by_type_and_level(node, LIBPE_RDT_DIRECTORY_ENTRY, level); if (dir_entry_node->raw.directoryEntry->u0.data.NameIsString) { snprintf(partial_path, sizeof(partial_path), "%s ", dir_entry_node->name); } else { const pe_resource_entry_info_t *match = pe_resource_entry_info_lookup(dir_entry_node->raw.directoryEntry->u0.data.NameOffset); if (match != NULL && level == LIBPE_RDT_LEVEL1) { snprintf(partial_path, sizeof(partial_path), "%s ", match->name); } else { snprintf(partial_path, sizeof(partial_path), "%04x ", dir_entry_node->raw.directoryEntry->u0.data.NameOffset); } } strncat(output, partial_path, output_size - strlen(output) - 1); } size_t length = strlen(output); output[length - 1] = '\0'; // Remove the last whitespace. } static void peres_show_list_node(pe_ctx_t *ctx, const pe_resource_node_t *node) { if (node->type != LIBPE_RDT_DATA_ENTRY) return; char node_info[MAX_PATH]; memset(node_info, 0, sizeof(node_info)); peres_build_node_filename(ctx, node_info, sizeof(node_info), node); printf("%s (%d bytes)\n", node_info, node->raw.dataEntry->Size); } static void peres_show_list(pe_ctx_t *ctx, const pe_resource_node_t *node) { if (node == NULL) return; peres_show_list_node(ctx, node); peres_show_list(ctx, node->childNode); peres_show_list(ctx, node->nextNode); } #pragma pack(push, 1) typedef struct { uint32_t biSize; int32_t biWidth; int32_t biHeight; uint16_t biPlanes; uint16_t biBitCount; uint32_t biCompression; uint32_t biSizeImage; int32_t biXPelsPerMeter; int32_t biYPelsPerMeter; uint32_t biClrUsed; uint32_t biClrImportant; } BITMAPINFOHEADER; #pragma pack(pop) #pragma pack(push, 2) typedef struct { uint16_t icReserved; // Always zero uint16_t icType; // 1 for .ico, 2 for .cur, other values are invalid uint16_t icImageCount; // number of images in the file } ICOFILEHEADER; typedef struct { uint8_t biWidth; // Width of image uint8_t biHeight; // Height of image uint8_t biClrUsed; // Number of colors used uint8_t biReserved; // Reserved union { uint16_t biPlanes; // ICO - Number of color planes. Should be 0 or 1 uint16_t biXHotspot; // CUR - Horizontal coord of the hotspot in number of pixels from the left } u0; union { uint16_t biBitCount; // ICO - Number of bits per pixel uint16_t biYHotspot; // CUR - Vertical coord of the hotspot in number of pixels from the top } u1; uint32_t biSizeImage; // Size of image data in bytes uint32_t biOffBits; // Offset of BMP or PNG data from the beggining of the ICO/CUR file } ICODIRENTRY; #pragma pack(pop) typedef struct { bool is_modified; uint8_t *restore_buffer; size_t restore_size; } peres_resource_restore_t; static void peres_restore_resource_icon(peres_resource_restore_t *restore, const pe_resource_entry_info_t *entry_info, void *raw_data_ptr, size_t raw_data_size) { if (memcmp(raw_data_ptr, "\x89PNG", 4) == 0) { // A PNG icon is stored along with its original header, so just return untouched. return; } const BITMAPINFOHEADER *bitmap = raw_data_ptr; // Is it valid? if (bitmap->biSize != 40) { LIBPE_WARNING("RT_ICON bitmap is not valid"); return; } ICOFILEHEADER fileheader = { .icReserved = 0, .icType = 1, .icImageCount = 1, }; ICODIRENTRY direntry = { .biWidth = bitmap->biWidth, .biHeight = bitmap->biHeight / ((entry_info->type == RT_ICON || entry_info->type == RT_CURSOR || entry_info->type == RT_BITMAP) ? 2 : 1), .biClrUsed = 0, // What should we put here? .biReserved = 0, .u0 = { .biPlanes = 1 }, .u1 = { .biBitCount = bitmap->biBitCount }, .biSizeImage = bitmap->biSizeImage, .biOffBits = sizeof(ICOFILEHEADER) + sizeof(ICODIRENTRY) }; size_t written = 0; uint8_t *buffer = malloc_s(sizeof(ICOFILEHEADER) + sizeof(ICODIRENTRY) + raw_data_size); #define PERES_APPEND(dst, src, size) memcpy(dst + written, src, size); written += size PERES_APPEND(buffer, &fileheader, sizeof(ICOFILEHEADER)); PERES_APPEND(buffer, &direntry, sizeof(ICODIRENTRY)); PERES_APPEND(buffer, raw_data_ptr, raw_data_size); #undef PERES_APPEND restore->is_modified = true; restore->restore_buffer = buffer; restore->restore_size = written; } static void peres_restore_resource(peres_resource_restore_t *restore, const pe_resource_entry_info_t *entry_info, void *raw_data_ptr, size_t raw_data_size) { assert(restore != NULL); assert(raw_data_ptr != NULL); // If we don't know this type or the data size is 0, just return with the raw information untouched. if (entry_info == NULL || raw_data_size == 0) { goto fallback_untouched; } switch (entry_info->type) { default: goto fallback_untouched; case RT_ICON: peres_restore_resource_icon(restore, entry_info, raw_data_ptr, raw_data_size); break; } if (restore->is_modified) return; fallback_untouched: restore->is_modified = false; restore->restore_buffer = raw_data_ptr; restore->restore_size = raw_data_size; } static void peres_save_resource(pe_ctx_t *ctx, const pe_resource_node_t *node, bool namedExtract) { UNUSED(ctx); assert(node != NULL); assert(node->type == LIBPE_RDT_DATA_ENTRY); assert(node->dirLevel == LIBPE_RDT_LEVEL3); const IMAGE_RESOURCE_DATA_ENTRY *entry = node->raw.dataEntry; const uint64_t raw_data_offset = pe_rva2ofs(ctx, entry->OffsetToData); const size_t raw_data_size = entry->Size; uint8_t *raw_data_ptr = LIBPE_PTR_ADD(ctx->map_addr, raw_data_offset); if (!pe_can_read(ctx, raw_data_ptr, raw_data_size)) { // TODO: Should we report something? fprintf(stderr, "Attempted to read range [ %p, %p ] which is not within the mapped range [ %p, %lx ]\n", (void *)raw_data_ptr, LIBPE_PTR_ADD(raw_data_ptr, raw_data_size), ctx->map_addr, ctx->map_end); return; } struct stat statDir; if (stat(g_resourceDir, &statDir) == -1) mkdir(g_resourceDir, 0700); char *dirName; const pe_resource_node_t *folder_node = pe_resource_find_parent_node_by_type_and_level(node, LIBPE_RDT_DIRECTORY_ENTRY, LIBPE_RDT_LEVEL1); // dirLevel == 1 is where Resource Types are defined. const pe_resource_entry_info_t *entry_info = pe_resource_entry_info_lookup(folder_node->raw.directoryEntry->u0.Name); if (entry_info != NULL) { if ( asprintf( &dirName, "%s/%s", g_resourceDir, entry_info->dir_name ) < 0 ) abort(); //snprintf(dirName, sizeof(dirName), "%s/%s", g_resourceDir, entry_info->dir_name); } else { dirName = strdup( g_resourceDir ); //snprintf(dirName, sizeof(dirName), "%s", g_resourceDir); } if (stat(dirName, &statDir) == -1) mkdir(dirName, 0700); const pe_resource_node_t *name_node = pe_resource_find_parent_node_by_type_and_level(node, LIBPE_RDT_DIRECTORY_ENTRY, LIBPE_RDT_LEVEL2); // dirLevel == 2 if (name_node == NULL) { // TODO: Should we report something? free( dirName ); fprintf(stderr, "pe_resource_find_parent_node_by_type_and_level returned NULL\n"); return; } //fprintf(stderr, "DEBUG: Name=%d\n", name_node->raw.directoryEntry->u0.Name); char *relativeFileName; if (namedExtract) { char fileName[MAX_PATH]; // ok? peres_build_node_filename(ctx, fileName, sizeof(fileName), node); if ( asprintf(&relativeFileName, "%s/%s%s", dirName, fileName, entry_info != NULL ? entry_info->extension : ".bin") < 0 ) abort(); } else { if ( asprintf(&relativeFileName, "%s/" "%" PRIu32 "%s", dirName, name_node->raw.directoryEntry->u0.data.NameOffset, entry_info != NULL ? entry_info->extension : ".bin") < 0 ) abort(); } free( dirName ); //printf("DEBUG: raw_data_offset=%#llx, raw_data_size=%ld, relativeFileName=%s\n", raw_data_offset, raw_data_size, relativeFileName); peres_resource_restore_t restore = {0}; peres_restore_resource(&restore, entry_info, raw_data_ptr, raw_data_size); FILE *fp = fopen(relativeFileName, "wb+"); if (fp == NULL) { free( relativeFileName ); // TODO: Should we report something? return; } fwrite(restore.restore_buffer, restore.restore_size, 1, fp); fclose(fp); if (restore.is_modified) { free(restore.restore_buffer); } output("Save On", relativeFileName); free( relativeFileName ); } static void peres_save_all_resources(pe_ctx_t *ctx, const pe_resource_node_t *node, bool namedExtract) { if (node == NULL) return; if (node->type == LIBPE_RDT_DATA_ENTRY && node->dirLevel == 3) { peres_save_resource(ctx, node, namedExtract); } peres_save_all_resources(ctx, node->childNode, namedExtract); peres_save_all_resources(ctx, node->nextNode, namedExtract); } bool peres_contains_version_node(const pe_resource_node_t *node) { if (node->type != LIBPE_RDT_DIRECTORY_ENTRY) return false; if (node->dirLevel != LIBPE_RDT_LEVEL1) // dirLevel == 1 belongs to the resource type directory. return false; return node->raw.directoryEntry->u0.data.NameOffset == RT_VERSION; } static void peres_show_version(pe_ctx_t *ctx, const pe_resource_node_t *node) { if (node == NULL) return; pe_resource_node_search_result_t search_result = {0}; pe_resource_search_nodes(&search_result, node, peres_contains_version_node); pe_resource_node_search_result_item_t *result_item = {0}; LL_FOREACH(search_result.items, result_item) { const pe_resource_node_t *version_node = pe_resource_find_node_by_type_and_level(result_item->node, LIBPE_RDT_DATA_ENTRY, LIBPE_RDT_LEVEL3); if (version_node != NULL) { const uint64_t data_offset = pe_rva2ofs(ctx, version_node->raw.dataEntry->OffsetToData); const size_t data_size = version_node->raw.dataEntry->Size; const void *data_ptr = LIBPE_PTR_ADD(ctx->map_addr, 32 + data_offset); // TODO(jweyrich): The literal 32 refers to the size of the if (!pe_can_read(ctx, data_ptr, data_size)) { LIBPE_WARNING("Cannot read VS_FIXEDFILEINFO"); return; } const VS_FIXEDFILEINFO *info_ptr = data_ptr; static char value[MAX_MSG]; snprintf(value, MAX_MSG, "%u.%u.%u.%u", (uint32_t)(info_ptr->dwFileVersionMS & 0xffff0000) >> 16, (uint32_t)info_ptr->dwFileVersionMS & 0x0000ffff, (uint32_t)(info_ptr->dwFileVersionLS & 0xffff0000) >> 16, (uint32_t)info_ptr->dwFileVersionLS & 0x0000ffff); output("File Version", value); snprintf(value, MAX_MSG, "%u.%u.%u.%u", (uint32_t)(info_ptr->dwProductVersionMS & 0xffff0000) >> 16, (uint32_t)info_ptr->dwProductVersionMS & 0x0000ffff, (uint32_t)(info_ptr->dwProductVersionLS & 0xffff0000) >> 16, (uint32_t)info_ptr->dwProductVersionLS & 0x0000ffff); output("Product Version", value); } } pe_resources_dealloc_node_search_result(&search_result); } typedef struct { int totalCount; int totalResourceDirectory; int totalDirectoryEntry; int totalDataString; int totalDataEntry; } peres_stats_t; static void peres_generate_stats(peres_stats_t *stats, const pe_resource_node_t *node) { if (node == NULL) return; stats->totalCount++; switch (node->type) { case LIBPE_RDT_RESOURCE_DIRECTORY: stats->totalResourceDirectory++; break; case LIBPE_RDT_DIRECTORY_ENTRY: stats->totalDirectoryEntry++; break; case LIBPE_RDT_DATA_STRING: stats->totalDataString++; break; case LIBPE_RDT_DATA_ENTRY: stats->totalDataEntry++; break; } if (node->childNode) { peres_generate_stats(stats, node->childNode); } if (node->nextNode) { peres_generate_stats(stats, node->nextNode); } } static void peres_show_stats(const pe_resource_node_t *node) { peres_stats_t stats = {0}; peres_generate_stats(&stats, node); static char value[MAX_MSG]; snprintf(value, MAX_MSG, "%d", stats.totalCount); output("Total Structs", value); snprintf(value, MAX_MSG, "%d", stats.totalResourceDirectory); output("Total Resource Directory", value); snprintf(value, MAX_MSG, "%d", stats.totalDirectoryEntry); output("Total Directory Entry", value); snprintf(value, MAX_MSG, "%d", stats.totalDataString); output("Total Data String", value); snprintf(value, MAX_MSG, "%d", stats.totalDataEntry); output("Total Data Entry", value); } int main(int argc, char **argv) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 3) { usage(); exit(EXIT_FAILURE); } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); // opcoes const char *path = argv[argc-1]; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, path); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); output_open_document(); pe_resources_t *resources = pe_resources(&ctx); if (resources == NULL || resources->err != LIBPE_E_OK) { LIBPE_WARNING("This file has no resources"); return EXIT_SUCCESS; } pe_resource_node_t *root_node = resources->root_node; if (options->all) { peres_show_nodes(&ctx, root_node); peres_show_stats(root_node); peres_show_list(&ctx, root_node); peres_save_all_resources(&ctx, root_node, options->namedExtract); peres_show_version(&ctx, root_node); } else { if (options->extract) peres_save_all_resources(&ctx, root_node, options->namedExtract); if (options->info) peres_show_nodes(&ctx, root_node); if (options->list) peres_show_list(&ctx, root_node); if (options->statistics) peres_show_stats(root_node); if (options->version) peres_show_version(&ctx, root_node); } output_close_document(); // libera a memoria free_options(options); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/pescan.c000066400000000000000000000361001455661113700151220ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pescan.c - search for suspicious things in PE files. Copyright (C) 2013 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include #include #include #include "plugins.h" #define PROGRAM "pescan" typedef struct { bool verbose; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s OPTIONS FILE\n" "Search for suspicious things in PE files\n" "\nExample: %s putty.exe\n" "\nOptions:\n" " -f, --format <%s> Change output format (default: text).\n" " -v, --verbose Show more information about found items.\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM, formats); } static void free_options(options_t *options) { // FIX: Don't need to test for NULL pointer. //if (options == NULL) // return; free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); /* Parameters for getopt_long() function */ static const char short_options[] = "f:vV"; static const struct option long_options[] = { { "format", required_argument, NULL, 'f' }, { "help", no_argument, NULL, 1 }, { "verbose", no_argument, NULL, 'v' }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; case 'v': options->verbose = true; break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } // check for abnormal dos stub (common in packed files) static bool normal_dos_stub(pe_ctx_t *ctx, uint32_t *stub_offset) { static const uint8_t dos_stub[] = "\x0e" // push cs "\x1f" // pop ds "\xba\x0e\x00" // mov dx, 0x0e "\xb4\x09" // mov ah, 0x09 "\xcd\x21" // int 0x21 "\xb8\x01\x4c" // mov ax, 0x4c01 "\xcd\x21" // int 0x21 "This program cannot be run in DOS mode.\r\r\n$"; const size_t dos_stub_size = sizeof(dos_stub) - 1; // -1 to ignore ending null const IMAGE_DOS_HEADER *dos = pe_dos(ctx); if (dos == NULL) { LIBPE_WARNING("unable to retrieve PE DOS header"); return false; } *stub_offset = dos->e_cparhdr << 4; // dos stub starts at e_cparhdr shifted by 4 const char *dos_stub_ptr = LIBPE_PTR_ADD(ctx->map_addr, *stub_offset); if (!pe_can_read(ctx, dos_stub_ptr, dos_stub_size)) { LIBPE_WARNING("unable to seek in file"); return false; } return memcmp(dos_stub, dos_stub_ptr, dos_stub_size) == 0; } static const IMAGE_SECTION_HEADER *pe_check_fake_entrypoint(pe_ctx_t *ctx, uint32_t ep) { const uint16_t num_sections = pe_sections_count(ctx); if (num_sections == 0) return NULL; const IMAGE_SECTION_HEADER *section = pe_rva2section(ctx, ep); if (section == NULL) return NULL; if (section->Characteristics & IMAGE_SCN_CNT_CODE) return NULL; return section; } static uint32_t pe_get_tls_directory(pe_ctx_t *ctx) { if (ctx->pe.num_directories == 0 || ctx->pe.num_directories > MAX_DIRECTORIES) return 0; const IMAGE_DATA_DIRECTORY *directory = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_TLS); if (directory == NULL) return 0; if (directory->Size == 0) return 0; return directory->VirtualAddress; } /* * -1 - fake tls callbacks detected * 0 - no tls directory * >0 - number of callbacks functions found */ static int pe_get_tls_callbacks(pe_ctx_t *ctx, const options_t *options) { int ret = 0; const IMAGE_OPTIONAL_HEADER *optional_hdr = pe_optional(ctx); if (optional_hdr == NULL) return 0; IMAGE_SECTION_HEADER ** const sections = pe_sections(ctx); if (sections == NULL) return 0; const uint64_t tls_addr = pe_get_tls_directory(ctx); if (tls_addr == 0) return 0; const uint16_t num_sections = pe_sections_count(ctx); uint64_t ofs = 0; // search for tls in all sections for (uint16_t i=0, j=0; i < num_sections; i++) { if (tls_addr >= sections[i]->VirtualAddress && tls_addr < (sections[i]->VirtualAddress + sections[i]->SizeOfRawData)) { ofs = tls_addr - sections[i]->VirtualAddress + sections[i]->PointerToRawData; switch (optional_hdr->type) { default: return 0; case MAGIC_PE32: { const IMAGE_TLS_DIRECTORY32 *tls_dir = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, tls_dir, sizeof(IMAGE_TLS_DIRECTORY32))) { // TODO: Should we report something? return 0; } if (!(tls_dir->AddressOfCallBacks & optional_hdr->_32->ImageBase)) break; ofs = pe_rva2ofs(ctx, tls_dir->AddressOfCallBacks - optional_hdr->_32->ImageBase); break; } case MAGIC_PE64: { const IMAGE_TLS_DIRECTORY64 *tls_dir = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, tls_dir, sizeof(IMAGE_TLS_DIRECTORY64))) { // TODO: Should we report something? return 0; } if (!(tls_dir->AddressOfCallBacks & optional_hdr->_64->ImageBase)) break; ofs = pe_rva2ofs(ctx, tls_dir->AddressOfCallBacks - optional_hdr->_64->ImageBase); break; } } ret = -1; // tls directory and section exists char value[MAX_MSG]; uint32_t funcaddr = 0; do { const uint32_t *funcaddr_ptr = LIBPE_PTR_ADD(ctx->map_addr, ofs); if (!pe_can_read(ctx, funcaddr_ptr, sizeof(*funcaddr_ptr))) { // TODO: Should we report something? return 0; } uint32_t funcaddr = *funcaddr_ptr; if (funcaddr) { ret = ++j; // function found if (options->verbose) { snprintf(value, MAX_MSG, "%#x", funcaddr); output("TLS callback function", value); } } } while (funcaddr); return ret; } } return 0; } static bool strisprint(const char *string) { const char *s = string; if (strncmp(string, ".tls", 5) == 0) return false; if (*s++ != '.') return false; while (*s) { if (!isalpha((int)*s)) return false; s++; } return true; } static void stradd(char *dest, const char *src, bool *pad) { if (*pad) strcat(dest, ", "); strcat(dest, src); *pad = true; } static void print_strange_sections(pe_ctx_t *ctx) { const uint16_t num_sections = pe_sections_count(ctx); if (num_sections == 0) return; char value[MAX_MSG]; if (ctx->pe.num_sections <= 2) snprintf(value, MAX_MSG, "%d (low)", num_sections); else if (ctx->pe.num_sections > 8) snprintf(value, MAX_MSG, "%d (high)", num_sections); else snprintf(value, MAX_MSG, "%d", num_sections); output("section count", value); IMAGE_SECTION_HEADER ** const sections = pe_sections(ctx); output_open_scope("sections", OUTPUT_SCOPE_TYPE_ARRAY); bool aux = false; for (uint16_t i=0; i < num_sections; i++, aux=false) { output_open_scope("section", OUTPUT_SCOPE_TYPE_OBJECT); memset(&value, 0, sizeof(value)); if (!strisprint((const char *)sections[i]->Name)) stradd(value, "suspicious name", &aux); if (sections[i]->SizeOfRawData == 0) stradd(value, "zero length", &aux); else if (sections[i]->SizeOfRawData <= 512) stradd(value, "small length", &aux); // rwx or writable + executable code if (sections[i]->Characteristics & IMAGE_SCN_MEM_WRITE && (sections[i]->Characteristics & IMAGE_SCN_CNT_CODE || sections[i]->Characteristics & IMAGE_SCN_MEM_EXECUTE)) stradd(value, "self-modifying", &aux); if (!aux) strncpy(value, "normal", 7); output((const char *)sections[i]->Name, value); output_close_scope(); // section } output_close_scope(); // sections } static bool normal_imagebase(pe_ctx_t *ctx) { return (ctx->pe.imagebase == 0x100000000 || ctx->pe.imagebase == 0x1000000 || ctx->pe.imagebase == 0x400000); } // FIX: Already in libpe! // new anti-disassembly technique with undocumented Intel FPU instructions //static bool fpu_trick(pe_ctx_t *ctx) //{ // const char *opcode_ptr = ctx->map_addr; // // for (uint32_t i=0, times=0; i < ctx->map_size; i++) { // if (*opcode_ptr++ == '\xdf') { // if (++times == 4) // return true; // } // else // times = 0; // } // // return false; //} static void print_timestamp(const options_t *options, const IMAGE_COFF_HEADER *hdr_coff_ptr) { const time_t now = time(NULL); static char value[MAX_MSG]; if (hdr_coff_ptr->TimeDateStamp == 0) snprintf(value, MAX_MSG, "zero/invalid"); else if (hdr_coff_ptr->TimeDateStamp < 946692000) snprintf(value, MAX_MSG, "too old (pre-2000)"); else if (hdr_coff_ptr->TimeDateStamp > (uint32_t) now) snprintf(value, MAX_MSG, "future time"); else snprintf(value, MAX_MSG, "normal"); if (options->verbose) { // FIX: Bigger string because week-day abbreviation is locale dependant. static char timestr[64]; strftime(timestr, sizeof timestr, " - %a, %d %b %Y %H:%M:%S UTC", gmtime((time_t *) &hdr_coff_ptr->TimeDateStamp)); strcat(value, timestr); } output("timestamp", value); } static int8_t cpl_analysis(pe_ctx_t *ctx) { const IMAGE_COFF_HEADER *hdr_coff_ptr = pe_coff(ctx); const IMAGE_DOS_HEADER *hdr_dos_ptr = pe_dos(ctx); if (hdr_coff_ptr == NULL || hdr_dos_ptr == NULL) return -1; static const uint16_t characteristics1 = ( IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_LOCAL_SYMS_STRIPPED | IMAGE_FILE_BYTES_REVERSED_LO | IMAGE_FILE_32BIT_MACHINE | IMAGE_FILE_DLL | IMAGE_FILE_BYTES_REVERSED_HI); static const uint16_t characteristics2 = ( IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_LOCAL_SYMS_STRIPPED | IMAGE_FILE_BYTES_REVERSED_LO | IMAGE_FILE_32BIT_MACHINE | IMAGE_FILE_DEBUG_STRIPPED | IMAGE_FILE_DLL | IMAGE_FILE_BYTES_REVERSED_HI); static const uint16_t characteristics3 = ( IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_LINE_NUMS_STRIPPED | IMAGE_FILE_32BIT_MACHINE | IMAGE_FILE_DEBUG_STRIPPED | IMAGE_FILE_DLL); if ((hdr_coff_ptr->TimeDateStamp == 708992537 || hdr_coff_ptr->TimeDateStamp > 1354555867) && (hdr_coff_ptr->Characteristics == characteristics1 || // equals 0xa18e hdr_coff_ptr->Characteristics == characteristics2 || // equals 0xa38e hdr_coff_ptr->Characteristics == characteristics3) // equals 0x2306 && hdr_dos_ptr->e_sp == 0xb8 ) return 1; return 0; } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); return EXIT_FAILURE; } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); // opcoes const char *path = argv[argc-1]; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, path); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); output_open_document(); // File entropy const double entropy = pe_calculate_entropy_file(&ctx); static char value[MAX_MSG]; if (entropy < 7.0) snprintf(value, MAX_MSG, "%f (normal)", entropy); else snprintf(value, MAX_MSG, "%f (probably packed)", entropy); output("file entropy", value); if (pe_is_dll(&ctx)) { uint16_t ret = cpl_analysis(&ctx); switch (ret) { case 1: output("cpl analysis", "malware"); break; default: output("cpl analysis:", "no threat"); break; } } output("fpu anti-disassembly", pe_fpu_trick(&ctx) ? "yes" : "no"); // imagebase analysis if (!normal_imagebase(&ctx)) { if (options->verbose) snprintf(value, MAX_MSG, "suspicious - %#"PRIx64, ctx.pe.imagebase); else snprintf(value, MAX_MSG, "suspicious"); } else { if (options->verbose) snprintf(value, MAX_MSG, "normal - %#"PRIx64, ctx.pe.imagebase); else snprintf(value, MAX_MSG, "normal"); } output("imagebase", value); const IMAGE_OPTIONAL_HEADER *optional = pe_optional(&ctx); if (optional == NULL) { LIBPE_WARNING("unable to read optional header"); } else { uint32_t ep = optional->_32 ? optional->_32->AddressOfEntryPoint : optional->_64 ? optional->_64->AddressOfEntryPoint : optional->_rom ? optional->_rom->AddressOfEntryPoint : 0; // fake ep if (ep == 0) { snprintf(value, MAX_MSG, "null"); } else if (pe_check_fake_entrypoint(&ctx, ep)) { if (options->verbose) snprintf(value, MAX_MSG, "fake - va: %#x - raw: %#"PRIx64, ep, pe_rva2ofs(&ctx, ep)); else snprintf(value, MAX_MSG, "fake"); } else { if (options->verbose) snprintf(value, MAX_MSG, "normal - va: %#x - raw: %#"PRIx64, ep, pe_rva2ofs(&ctx, ep)); else snprintf(value, MAX_MSG, "normal"); } output("entrypoint", value); } // dos stub uint32_t stub_offset = 0; if (!normal_dos_stub(&ctx, &stub_offset)) { if (options->verbose) snprintf(value, MAX_MSG, "suspicious - raw: %#x", stub_offset); else snprintf(value, MAX_MSG, "suspicious"); } else snprintf(value, MAX_MSG, "normal"); output("DOS stub", value); // tls callbacks int callbacks = pe_get_tls_callbacks(&ctx, options); if (callbacks == 0) snprintf(value, MAX_MSG, "not found"); else if (callbacks == -1) snprintf(value, MAX_MSG, "found - no functions"); else if (callbacks > 0) snprintf(value, MAX_MSG, "found - %d function(s)", callbacks); output("TLS directory", value); // invalid timestamp IMAGE_COFF_HEADER *coff = pe_coff(&ctx); if (coff == NULL) { LIBPE_WARNING("unable to read coff header"); } else { print_timestamp(options, coff); } // section analysis print_strange_sections(&ctx); output_close_document(); // free memory free_options(options); err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/pesec.c000066400000000000000000000333101455661113700147500ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pesec.c - Checks for security features in PE files. Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include #include #include #include #include "compat/strlcat.h" #include "plugins.h" #define PROGRAM "pesec" typedef enum { CERT_FORMAT_TEXT = 1, CERT_FORMAT_PEM = 2, CERT_FORMAT_DER = 3 } cert_format_e; typedef struct { cert_format_e certoutform; BIO *certout; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s [OPTIONS] FILE\n" "Check for security features in PE files\n" "\nExample: %s wordpad.exe\n" "\nOptions:\n" " -f, --format <%s> Change output format (default: text)\n" " -c, --certoutform Specifies the certificate output format (default: text).\n" " -o, --certout Specifies the output filename to write certificates to (default: stdout).\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM, formats); } static cert_format_e parse_certoutform(const char *optarg) { cert_format_e result; if (strcmp(optarg, "text") == 0) result = CERT_FORMAT_TEXT; else if (strcmp(optarg, "pem") == 0) result = CERT_FORMAT_PEM; else if (strcmp(optarg, "der") == 0) result = CERT_FORMAT_DER; else EXIT_ERROR("invalid cert_format option"); return result; } static BIO *parse_certout(const char *optarg) { BIO *bio = BIO_new(BIO_s_file()); if (bio == NULL) { EXIT_ERROR("could not allocate BIO"); } if (strcmp(optarg, "stdout") == 0) { BIO_set_fp(bio, stdout, BIO_NOCLOSE); } else if (strcmp(optarg, "stderr") == 0) { BIO_set_fp(bio, stderr, BIO_NOCLOSE); } else { int ret = BIO_write_filename(bio, (char *)optarg); if (ret == 0) { BIO_free(bio); EXIT_ERROR("failed to open file"); } } return bio; } static void free_options(options_t *options) { if (options && options->certout) BIO_free(options->certout); free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); /* Parameters for getopt_long() function */ static const char short_options[] = "f:c:o:V"; static const struct option long_options[] = { { "format", required_argument, NULL, 'f' }, { "certoutform", required_argument, NULL, 'c' }, { "certout", required_argument, NULL, 'o' }, { "help", no_argument, NULL, 1 }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; case 'v': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); case 'c': options->certoutform = parse_certoutform(optarg); break; case 'o': options->certout = parse_certout(optarg); break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } /* find stack cookies, a.k.a canary, buffer security check option in MVS 2010 */ // FIXME: What about other versions? static bool stack_cookies(pe_ctx_t *ctx) { static const unsigned char mvs2010[] = { 0x55, 0x8b, 0xec, 0x83, 0x33, 0xc5, 0x33, 0xcd, 0xe8, 0xc3 }; if (ctx == NULL) return false; size_t found = 0; const uint8_t *file_bytes = LIBPE_PTR_ADD(ctx->map_addr, 0); const uint64_t filesize = pe_filesize(ctx); // FIXME: Is this right?! Seems like partial matches will be // Accumulated. Example: If all these bytes are found, // separatelly in the file, this function will return true. for (uint64_t ofs=0; ofs < filesize; ofs++) { for (size_t i=0; i < sizeof(mvs2010); i++) { if (file_bytes[ofs] == mvs2010[i] && found == i) found++; } } return found == sizeof(mvs2010); } static void print_certificate(BIO *out, cert_format_e format, X509 *cert) { if (out == NULL) return; switch (format) { default: case CERT_FORMAT_TEXT: X509_print(out, cert); break; case CERT_FORMAT_PEM: PEM_write_bio_X509(out, cert); break; case CERT_FORMAT_DER: LIBPE_WARNING("DER format is not yet supported for output"); break; } } static unsigned int roundBy8( unsigned int n ) { unsigned int t = n & ~7U; if ( n & 7U ) t += 8; return t; } static int parse_pkcs7_data(const options_t *options, const CRYPT_DATA_BLOB *blob) { int result = 0; const cert_format_e input_fmt = CERT_FORMAT_DER; PKCS7 *p7 = NULL; /* Need to be initialized! */ BIO *in; #if OPENSSL_VERSION_NUMBER < 0x10100000L CRYPTO_malloc_init(); #endif ERR_load_crypto_strings(); OpenSSL_add_all_algorithms(); in = BIO_new_mem_buf(blob->pbData, blob->cbData); if (in == NULL) { result = -2; goto error; } // FIXME: input_fmt never changed! switch (input_fmt) { default: LIBPE_WARNING("unhandled input format for certificate"); break; case CERT_FORMAT_DER: p7 = d2i_PKCS7_bio(in, NULL); break; case CERT_FORMAT_PEM: p7 = PEM_read_bio_PKCS7(in, NULL, NULL, NULL); break; } if (p7 == NULL) { ERR_print_errors_fp(stderr); result = -3; goto error; } STACK_OF(X509) *certs = NULL; int type = OBJ_obj2nid(p7->type); switch (type) { default: break; case NID_pkcs7_signed: // PKCS7_type_is_signed(p7) certs = p7->d.sign->cert; break; case NID_pkcs7_signedAndEnveloped: // PKCS7_type_is_signedAndEnveloped(p7) certs = p7->d.signed_and_enveloped->cert; break; } const int numcerts = certs != NULL ? sk_X509_num(certs) : 0; for (int i = 0; i < numcerts; i++) { X509 *cert = sk_X509_value(certs, i); print_certificate(options->certout, options->certoutform, cert); // NOTE: Calling X509_free(cert) is unnecessary. } // Print whether certificate signature is valid if (numcerts > 0) { X509 *subject = sk_X509_value(certs, 0); X509 *issuer = sk_X509_value(certs, numcerts - 1); EVP_PKEY *issuer_pubkey = X509_get_pubkey(issuer); int valid_sig = X509_verify(subject, issuer_pubkey); EVP_PKEY_free(issuer_pubkey); output("Signature", valid_sig == 1 ? "valid" : "invalid"); } // Print signers if (numcerts > 0) { output_open_scope("signers", OUTPUT_SCOPE_TYPE_ARRAY); for (int i = 0; i < numcerts; i++) { X509 *cert = sk_X509_value(certs, i); X509_NAME *name = X509_get_subject_name(cert); int issuer_name_len = X509_NAME_get_text_by_NID(name, NID_commonName, NULL, 0); if (issuer_name_len > 0) { output_open_scope("signer", OUTPUT_SCOPE_TYPE_OBJECT); char issuer_name[issuer_name_len + 1]; X509_NAME_get_text_by_NID(name, NID_commonName, issuer_name, issuer_name_len + 1); output("Issuer", issuer_name); output_close_scope(); // signer } } output_close_scope(); // signers } error: if (p7 != NULL) PKCS7_free(p7); if (in != NULL) BIO_free(in); // Deallocate everything from OpenSSL_add_all_algorithms EVP_cleanup(); // Deallocate everything from ERR_load_crypto_strings ERR_free_strings(); return result; } static void parse_certificates(const options_t *options, pe_ctx_t *ctx) { const IMAGE_DATA_DIRECTORY * const directory = pe_directory_by_entry(ctx, IMAGE_DIRECTORY_ENTRY_SECURITY); if (directory == NULL) return; if (directory->VirtualAddress == 0 || directory->Size == 0) return; uint32_t fileOffset = directory->VirtualAddress; // This a file pointer rather than a common RVA. // TODO(jweyrich): We should count how many certificates the file has, and based on this // decide whether to proceed and open the certificates scope. output_open_scope("certificates", OUTPUT_SCOPE_TYPE_ARRAY); while (fileOffset - directory->VirtualAddress < directory->Size) { // Read the size of this WIN_CERTIFICATE uint32_t *dwLength_ptr = LIBPE_PTR_ADD(ctx->map_addr, fileOffset); if (!pe_can_read(ctx, dwLength_ptr, sizeof(uint32_t))) { output_close_scope(); // certificates // TODO: Should we report something? return; } // Type punning uint32_t dwLength = *(uint32_t *)dwLength_ptr; WIN_CERTIFICATE *cert = LIBPE_PTR_ADD(ctx->map_addr, fileOffset); if (!pe_can_read(ctx, cert, dwLength)) { output_close_scope(); // certificates // TODO: Should we report something? return; } output_open_scope("certificate", OUTPUT_SCOPE_TYPE_OBJECT); static char value[MAX_MSG]; snprintf(value, MAX_MSG, "%u bytes", cert->dwLength); output("Length", value); snprintf(value, MAX_MSG, "0x%x (%s)", cert->wRevision, cert->wRevision == WIN_CERT_REVISION_1_0 ? "1" : cert->wRevision == WIN_CERT_REVISION_2_0 ? "2" : "unknown"); output("Revision", value); snprintf(value, MAX_MSG, "0x%x", cert->wCertificateType); switch (cert->wCertificateType) { default: bsd_strlcat(value, " (UNKNOWN)", MAX_MSG); break; case WIN_CERT_TYPE_X509: bsd_strlcat(value, " (X509)", MAX_MSG); break; case WIN_CERT_TYPE_PKCS_SIGNED_DATA: bsd_strlcat(value, " (PKCS_SIGNED_DATA)", MAX_MSG); break; case WIN_CERT_TYPE_TS_STACK_SIGNED: bsd_strlcat(value, " (TS_STACK_SIGNED)", MAX_MSG); break; } output("Type", value); fileOffset += roundBy8(cert->dwLength); // Offset to the next certificate. if (fileOffset - directory->VirtualAddress > directory->Size) { LIBPE_WARNING("either the attribute certificate table or the Size field is corrupted"); output_close_scope(); // certificate break; // Exit the while-loop. } switch (cert->wRevision) { default: LIBPE_WARNING("unknown wRevision"); break; case WIN_CERT_REVISION_1_0: LIBPE_WARNING("WIN_CERT_REVISION_1_0 is not supported"); break; case WIN_CERT_REVISION_2_0: break; } switch (cert->wCertificateType) { default: LIBPE_WARNING("unknown wCertificateType"); break; case WIN_CERT_TYPE_X509: LIBPE_WARNING("WIN_CERT_TYPE_X509 is not supported"); break; case WIN_CERT_TYPE_PKCS_SIGNED_DATA: { CRYPT_DATA_BLOB p7data; p7data.cbData = cert->dwLength - offsetof(WIN_CERTIFICATE, bCertificate); p7data.pbData = cert->bCertificate; parse_pkcs7_data(options, &p7data); break; } case WIN_CERT_TYPE_TS_STACK_SIGNED: LIBPE_WARNING("WIN_CERT_TYPE_TS_STACK_SIGNED is not supported"); break; case WIN_CERT_TYPE_EFI_PKCS115: LIBPE_WARNING("WIN_CERT_TYPE_EFI_PKCS115 is not supported"); break; case WIN_CERT_TYPE_EFI_GUID: LIBPE_WARNING("WIN_CERT_TYPE_EFI_GUID is not supported"); break; } output_close_scope(); // certificate } output_close_scope(); // certificates } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); exit(EXIT_FAILURE); } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); // opcoes const char *path = argv[argc-1]; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, path); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); IMAGE_OPTIONAL_HEADER *optional = pe_optional(&ctx); if (optional == NULL) return EXIT_FAILURE; uint16_t dllchar = 0; switch (optional->type) { default: return EXIT_FAILURE; case MAGIC_ROM: break; case MAGIC_PE32: dllchar = optional->_32->DllCharacteristics; break; case MAGIC_PE64: dllchar = optional->_64->DllCharacteristics; break; } output_open_document(); static char field[MAX_MSG]; // aslr snprintf(field, MAX_MSG, "ASLR"); output(field, (dllchar & 0x40) ? "yes" : "no"); // dep/nx snprintf(field, MAX_MSG, "DEP/NX"); output(field, (dllchar & 0x100) ? "yes" : "no"); // seh snprintf(field, MAX_MSG, "SEH"); output(field, (dllchar & 0x400) ? "no" : "yes"); // cfg snprintf(field, MAX_MSG, "CFG"); output(field, (dllchar & 0x4000) ? "yes" : "no"); // stack cookies snprintf(field, MAX_MSG, "Stack cookies (EXPERIMENTAL)"); output(field, stack_cookies(&ctx) ? "yes" : "no"); // certificados parse_certificates(options, &ctx); output_close_document(); // libera a memoria free_options(options); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/pestr.c000066400000000000000000000157641455661113700150230ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pestr.c - search for strings in PE files. Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include #include #include #include #define PROGRAM "pestr" #define BUFSIZE 4 #define LINE_BUFFER 32768 typedef struct { unsigned short strsize; bool offset; bool section; } options_t; static void usage(void) { printf("Usage: %s OPTIONS FILE\n" "Search for strings in PE files\n" "\nExample: %s acrobat.exe\n" "\nOptions:\n" " -n, --min-length Set minimum string length (default: 4).\n" " -o, --offset Show string offset in file.\n" " -s, --section Show string section, if exists.\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM); } static void free_options(options_t *options) { // FIX: Don't need to test for NULL pointer. //if (options == NULL) // return; free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); /* Parameters for getopt_long() function */ static const char short_options[] = "osn:V"; static const struct option long_options[] = { { "offset", no_argument, NULL, 'o' }, { "section", no_argument, NULL, 's' }, { "min-length", required_argument, NULL, 'n' }, { "help", no_argument, NULL, 1 }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'o': options->offset = true; break; case 's': options->section = true; break; case 'n': { // FIX: errno isn't automatically zeroed if already set. errno = 0; unsigned long value = strtoul(optarg, NULL, 0); if (value == ULONG_MAX && errno == ERANGE) { fprintf(stderr, "The original (nonnegated) value would overflow"); exit(EXIT_FAILURE); } options->strsize = (unsigned char)value; break; } case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } // TODO Move it to libpe static unsigned char *ofs2section(pe_ctx_t *ctx, uint64_t offset) { IMAGE_SECTION_HEADER **sections = pe_sections(ctx); for (uint16_t i=0; i < ctx->pe.num_sections; i++) { uint32_t sect_offset = sections[i]->PointerToRawData; uint32_t sect_size = sections[i]->SizeOfRawData; if (offset >= sect_offset && offset <= (sect_offset + sect_size)) { return (unsigned char *)sections[i]->Name; } } return NULL; } static void printb( pe_ctx_t *ctx, const options_t *options, const uint8_t *bytes, size_t pos, size_t end, bool is_wide) { if (options->offset) printf("%#lx\t", (unsigned long) pos); if (options->section) { char *s = (char *) ofs2section(ctx, pos); printf("%s\t", s ? s : "[none]"); } // printf("%s\t", is_wide ? "U16LE" : "U8" ); if (is_wide) { for (;pos < end;) { // Byte swap; Internal PE uses little endian while C uses big endian wchar_t wc = bytes[pos] | bytes[pos+1]<<8; if ( wc ) { putwchar( wc ); } pos += 2; } } else { for (;pos < end; ++pos ) { char c = bytes[pos]; if ( c ) putchar( c ); } } putchar('\n'); } int main(int argc, char *argv[]) { if (argc < 2) { usage(); exit(EXIT_FAILURE); } options_t *options = parse_options(argc, argv); // opcoes const char *path = argv[argc-1]; pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, path); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); const uint64_t pe_size = pe_filesize(&ctx); const uint8_t *pe_raw_data = ctx.map_addr; uint16_t chunk; size_t buff_start = 0; size_t odd_wbuff_start = 0; size_t even_wbuff_start = 0; for (size_t pe_raw_offset = 0; pe_raw_offset < pe_size; ++pe_raw_offset) { const uint8_t byte = pe_raw_data[pe_raw_offset]; if (pe_raw_offset+1 < pe_size) // Byte swap; Internal PE uses little endian while C uses big endian chunk = byte | pe_raw_data[pe_raw_offset+1]<<8; else chunk = 0; if (isprint(byte)) { if ( buff_start == 0 ) { buff_start = pe_raw_offset; } } else { if ( buff_start != 0 ) { if ((pe_raw_offset - buff_start) >= (options->strsize ? options->strsize : 4)) printb(&ctx, options, pe_raw_data, buff_start, pe_raw_offset, false); buff_start = 0; } } if (iswprint(chunk)) { if( pe_raw_offset & 0x1 ) { if ( odd_wbuff_start == 0 ) { odd_wbuff_start = pe_raw_offset; } } else { if ( even_wbuff_start == 0 ) { even_wbuff_start = pe_raw_offset; } } } else { if( pe_raw_offset & 0x1 ) { if ( odd_wbuff_start != 0 ) { if ((pe_raw_offset - odd_wbuff_start)/2 >= (options->strsize ? options->strsize : 4)) printb(&ctx, options, pe_raw_data, odd_wbuff_start, pe_raw_offset, true); odd_wbuff_start = 0; } } else { if ( even_wbuff_start != 0 ) { if ((pe_raw_offset - even_wbuff_start)/2 >= (options->strsize ? options->strsize : 4)) printb(&ctx, options, pe_raw_data, even_wbuff_start, pe_raw_offset, true); even_wbuff_start = 0; } } } } // libera a memoria free_options(options); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } return EXIT_SUCCESS; } readpe-0.84/src/pev.conf000066400000000000000000000000471455661113700151470ustar00rootroot00000000000000plugins_dir=/usr/local/lib/pev/plugins readpe-0.84/src/pev_api.c000066400000000000000000000035611455661113700153010ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit pev_api.c - Symbols and APIs to be used by all plugins. Copyright (C) 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "pev_api.h" #include "output_plugin.h" #include #include pev_api_t *pev_api_ptr(void) { static bool initialized = false; static pev_api_t api; // Garanteed to be zeroed. if (!initialized) { initialized = true; //api = ( pev_api_t ){0}; // FIX: Don't need to zero. //memset(&api, 0, sizeof(api)); api.output = output_plugin_api_ptr(); } return &api; } readpe-0.84/src/plugins.c000066400000000000000000000162161455661113700153400ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit plugins.c - Implementation for the plugins subsystem. Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "plugins.h" #include "plugin.h" #include "dylib.h" #include "common.h" #include "compat/sys/queue.h" #include #include #include #include #include #include "config.h" #include "pev_api.h" typedef struct _plugins_entry { dylib_t library; plugin_loaded_fn_t plugin_loaded_fn; plugin_initialize_fn_t plugin_initialize_fn; plugin_shutdown_fn_t plugin_shutdown_fn; plugin_unloaded_fn_t plugin_unloaded_fn; SLIST_ENTRY(_plugins_entry) entries; } plugins_entry_t; static SLIST_HEAD(_plugins_t_list, _plugins_entry) g_loaded_plugins = SLIST_HEAD_INITIALIZER(g_loaded_plugins); int plugins_load(const char *path) { plugins_entry_t *entry = calloc(1, sizeof *entry); if (entry == NULL) { fprintf(stderr, "plugin: allocation failed for entry\n"); return -1; } dylib_t *library = &entry->library; //fprintf(stdout, "plugins: Loading '%s'... ", path); int ret = dylib_load(library, path); //fprintf(stdout, "%s.\n", ret < 0 ? "failed" : "ok"); if (ret < 0) { free(entry); return -2; } // FIX: Ugly way to do it! //*(void **)(&entry->plugin_loaded_fn) = dylib_get_symbol(library, "plugin_loaded"); //*(void **)(&entry->plugin_initialize_fn) = dylib_get_symbol(library, "plugin_initialize"); //*(void **)(&entry->plugin_shutdown_fn) = dylib_get_symbol(library, "plugin_shutdown"); //*(void **)(&entry->plugin_unloaded_fn) = dylib_get_symbol(library, "plugin_unloaded"); entry->plugin_loaded_fn = dylib_get_symbol( library, "plugin_loaded" ); entry->plugin_initialize_fn = dylib_get_symbol(library, "plugin_initialize"); entry->plugin_shutdown_fn = dylib_get_symbol(library, "plugin_shutdown"); entry->plugin_unloaded_fn = dylib_get_symbol(library, "plugin_unloaded"); // Only plugin_initialize_fn and plugin_shutdown_fn are required. if (entry->plugin_initialize_fn == NULL || entry->plugin_shutdown_fn == NULL) { fprintf(stderr, "plugins: %s is incompatible with this version.\n", path); dylib_unload(library); free(entry); return -3; } if (entry->plugin_loaded_fn != NULL) { const int loaded = entry->plugin_loaded_fn(); if (loaded < 0) { fprintf(stderr, "plugins: plugin didn't load correctly\n"); dylib_unload(library); free(entry); return -4; } } const pev_api_t *pev_api = pev_api_ptr(); const int initialized = entry->plugin_initialize_fn(pev_api); if (initialized < 0) { fprintf(stderr, "plugins: plugin didn't initialize correctly\n"); dylib_unload(library); free(entry); return -5; } SLIST_INSERT_HEAD(&g_loaded_plugins, entry, entries); return 0; } static void plugin_unload_without_removal(plugins_entry_t *entry) { dylib_t *library = &entry->library; entry->plugin_shutdown_fn(); if (entry->plugin_unloaded_fn != NULL) { entry->plugin_unloaded_fn(); } int ret = dylib_unload(library); if (ret < 0) { // TODO(jweyrich): What should we do? } } #if 0 static void plugin_unload(plugins_entry_t *entry) { plugin_unload_without_removal(entry); SLIST_REMOVE(&g_loaded_plugins, entry, _plugins_entry, entries); free(entry); } #endif int plugins_load_all_from_directory(const char *path) { // FIX: errno isn't automatically zeroed if already set. errno = 0; DIR *dir = opendir(path); if (dir == NULL) { fprintf(stderr, "plugins: could not open directory '%s' -- %s\n", path, strerror(errno)); return -1; } // FIX: Don't need this. //long path_max = pathconf(path, _PC_PATH_MAX); //char *relative_path = malloc(path_max); //if (relative_path == NULL) { // fprintf(stderr, "plugins: allocation failed for relative path\n"); // closedir(dir); // return -2; //} char *relative_path; size_t load_count = 0; struct dirent *dir_entry; // print all the files and directories within directory // SECURITY: Don't use readdir_r because it will introduce a // race condition between the opendir and pathconf calls. // MORE: http://womble.decadent.org.uk/readdir_r-advisory.html // NOTE: readdir is not thread-safe. while ((dir_entry = readdir(dir)) != NULL) { switch (dir_entry->d_type) { default: // Unhandled break; #if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GNU__) || (defined(__FreeBSD_kernel__) && defined(__GLIBC__)) case DT_UNKNOWN: #endif case DT_REG: // Regular file { const char *filename = dir_entry->d_name; // TODO(jweyrich): Use macro conditions for each system: .so, .dylib, .dll #if defined(__linux__) || defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(__GNU__) || (defined(__FreeBSD_kernel__) && defined(__GLIBC__)) const bool possible_plugin = pe_utils_str_ends_with(filename, ".so") != 0; #elif defined(__APPLE__) const bool possible_plugin = pe_utils_str_ends_with(filename, ".dylib") != 0; #elif defined(__CYGWIN__) const bool possible_plugin = pe_utils_str_ends_with(filename, ".dll") != 0; #else #error Not supported #endif if (!possible_plugin) break; if ( asprintf(&relative_path, "%s/%s", path, filename) < 0 ) { fprintf(stderr, "plugins: allocation failed for relative path\n"); closedir(dir); return -2; } int ret = plugins_load(relative_path); free(relative_path); if (ret < 0) { closedir(dir); return ret; } load_count++; break; } case DT_DIR: // Directory break; } } closedir(dir); return load_count; } int plugins_load_all(pev_config_t *config) { return plugins_load_all_from_directory(config->plugins_path); } void plugins_unload_all(void) { while (!SLIST_EMPTY(&g_loaded_plugins)) { plugins_entry_t *entry = SLIST_FIRST(&g_loaded_plugins); plugin_unload_without_removal(entry); SLIST_REMOVE_HEAD(&g_loaded_plugins, entries); free(entry); } } readpe-0.84/src/plugins/000077500000000000000000000000001455661113700151665ustar00rootroot00000000000000readpe-0.84/src/plugins/Makefile000066400000000000000000000066151455661113700166360ustar00rootroot00000000000000####### Compiler options override CFLAGS += -O2 -I$(LIBPE) -I"../../include" -W -Wall -Wextra -std=c99 -pedantic -fPIC override CPPFLAGS += -D_GNU_SOURCE PLUGINS = csv html text xml json VERSION = 1.0 plugins_BUILDDIR = ../$(pev_BUILDDIR)/plugins csv_srcdir = $(CURDIR) csv_SRCS = csv.c csv_OBJS = $(addprefix ${plugins_BUILDDIR}/, $(addsuffix .o, $(basename ${csv_SRCS}))) csv_LIBNAME = csv_plugin html_srcdir = $(CURDIR) html_SRCS = html.c html_OBJS = $(addprefix ${plugins_BUILDDIR}/, $(addsuffix .o, $(basename ${html_SRCS}))) html_LIBNAME = html_plugin text_srcdir = $(CURDIR) text_SRCS = text.c text_OBJS = $(addprefix ${plugins_BUILDDIR}/, $(addsuffix .o, $(basename ${text_SRCS}))) text_LIBNAME = text_plugin xml_srcdir = $(CURDIR) xml_SRCS = xml.c xml_OBJS = $(addprefix ${plugins_BUILDDIR}/, $(addsuffix .o, $(basename ${xml_SRCS}))) xml_LIBNAME = xml_plugin json_srcdir = $(CURDIR) json_SRCS = json.c json_OBJS = $(addprefix ${plugins_BUILDDIR}/, $(addsuffix .o, $(basename ${json_SRCS}))) json_LIBNAME = json_plugin ####### Build rules .PHONY: plugins plugins: $(PLUGINS) csv: LIBNAME = $(csv_LIBNAME) csv: $(csv_OBJS) html: LIBNAME = $(html_LIBNAME) html: $(html_OBJS) text: LIBNAME = $(text_LIBNAME) text: $(text_OBJS) xml: LIBNAME = $(xml_LIBNAME) xml: $(xml_OBJS) json: LIBNAME = $(json_LIBNAME) json: $(json_OBJS) $(PLUGINS): ifeq ($(PLATFORM_OS), Linux) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).so $^ else ifeq ($(PLATFORM_OS), NetBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).so $^ else ifeq ($(PLATFORM_OS), FreeBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).so $^ else ifeq ($(PLATFORM_OS), OpenBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).so $^ else ifeq ($(PLATFORM_OS), GNU) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).so $^ else ifeq ($(PLATFORM_OS), GNU/kFreeBSD) $(LINK) -shared -Wl,-soname,$(LIBNAME).so.1 $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).so $^ else ifeq ($(PLATFORM_OS), Darwin) $(LINK) -headerpad_max_install_names -dynamiclib \ -undefined dynamic_lookup -fno-common \ -install_name $(LIBNAME).$(VERSION).dylib \ -current_version $(VERSION) -compatibility_version $(VERSION) \ $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).dylib $^ else ifeq ($(PLATFORM_OS), CYGWIN) $(LINK) -shared $(LDFLAGS) -o ${plugins_BUILDDIR}/$(LIBNAME).dll $^ endif $(plugins_BUILDDIR)/%.o: %.c @$(CHK_DIR_EXISTS) $(dir $@) || $(MKDIR) $(dir $@) $(CC) -c $(CFLAGS) $(CPPFLAGS) -o $@ $^ clean: $(RM_DIR) ${plugins_BUILDDIR} ### install: installdirs $(INSTALL_PROGRAM) $(INSTALL_FLAGS) -m 755 $(plugins_BUILDDIR)/$(csv_LIBNAME).* $(DESTDIR)$(pluginsdir) $(INSTALL_PROGRAM) $(INSTALL_FLAGS) -m 755 $(plugins_BUILDDIR)/$(html_LIBNAME).* $(DESTDIR)$(pluginsdir) $(INSTALL_PROGRAM) $(INSTALL_FLAGS) -m 755 $(plugins_BUILDDIR)/$(text_LIBNAME).* $(DESTDIR)$(pluginsdir) $(INSTALL_PROGRAM) $(INSTALL_FLAGS) -m 755 $(plugins_BUILDDIR)/$(xml_LIBNAME).* $(DESTDIR)$(pluginsdir) $(INSTALL_PROGRAM) $(INSTALL_FLAGS) -m 755 $(plugins_BUILDDIR)/$(json_LIBNAME).* $(DESTDIR)$(pluginsdir) install-strip: INSTALL_FLAGS += -s install-strip: install installdirs: @$(CHK_DIR_EXISTS) $(DESTDIR)$(pluginsdir) || $(MKDIR) $(DESTDIR)$(pluginsdir) uninstall: $(RM_DIR) $(DESTDIR)$(pluginsdir) readpe-0.84/src/plugins/csv.c000066400000000000000000000141401455661113700161250ustar00rootroot00000000000000/* pev - the PE file analyzer toolkit csv.c - Principal implementation file for the CSV output plugin Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include #include #include #include "pev_api.h" #include "output_plugin.h" const pev_api_t *g_pev_api = NULL; // REFERENCE: http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references // CSV entities ',', '"', '\n' static const entity_t g_entities[255] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, "\\n", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, "\"\"", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, }; static char *escape_csv(const format_t *format, const char *str) { if (str == NULL) return NULL; // If `str` contains a line-break, or a double-quote, or a comma, // escape and enclose the entire `str` with double quotes. return strpbrk(str, "\n\",") != NULL ? g_pev_api->output->escape_ex_quoted(str, format->entities_table) : g_pev_api->output->escape_ex(str, format->entities_table); } // // The CSV output encloses fields with double quotes if they contain // any of the following characters: // // a) line-break; // b) double-quote; // c) comma; // // Apart from the enclosing, any double-quote character found is escaped // to 2 double-quote characters. // // KNOWN BUG: // // Our CSV output still doesn't follow the following rule: // > Each record "should" contain the same number of comma-separated // > fields. // // REFERENCE: http://en.wikipedia.org/wiki/Comma-separated_values // static void to_format( const format_t *format, const output_type_e type, const output_scope_t *scope, const char *key, const char *value) { char * const escaped_key = format->escape_fn(format, key); char * const escaped_value = format->escape_fn(format, value); switch (type) { default: break; case OUTPUT_TYPE_SCOPE_OPEN: switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: break; case OUTPUT_SCOPE_TYPE_OBJECT: case OUTPUT_SCOPE_TYPE_ARRAY: printf("\n%s\n", escaped_key); break; } break; case OUTPUT_TYPE_SCOPE_CLOSE: switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: break; case OUTPUT_SCOPE_TYPE_OBJECT: case OUTPUT_SCOPE_TYPE_ARRAY: printf("\n"); break; } break; case OUTPUT_TYPE_ATTRIBUTE: if (key && value) printf("%s,%s\n", escaped_key, escaped_value); else if (key) printf("\n%s\n", escaped_key); else if (value) printf(",%s\n", escaped_value); break; } if (escaped_key != NULL) free(escaped_key); if (escaped_value != NULL) free(escaped_value); } // ---------------------------------------------------------------------------- #define FORMAT_ID 1 #define FORMAT_NAME "csv" static const format_t g_format = { FORMAT_ID, FORMAT_NAME, &to_format, &escape_csv, (entity_table_t)g_entities }; #define PLUGIN_TYPE "output" #define PLUGIN_NAME FORMAT_NAME int plugin_loaded(void) { //printf("Loading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); return 0; } void plugin_unloaded(void) { //printf("Unloading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); } int plugin_initialize(const pev_api_t *api) { g_pev_api = api; int ret = g_pev_api->output->output_plugin_register_format(&g_format); if (ret < 0) return -1; return 0; } void plugin_shutdown(void) { g_pev_api->output->output_plugin_unregister_format(&g_format); } readpe-0.84/src/plugins/html.c000066400000000000000000000162021455661113700162770ustar00rootroot00000000000000/* pev - the PE file analyzer toolkit html.c - Principal implementation file for the HTML output plugin Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include #include #include #include "pev_api.h" #include "output_plugin.h" const pev_api_t *g_pev_api = NULL; // REFERENCE: http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references // HTML entities '"', '&', '\'', '<', '>', ... static const entity_t g_entities[255] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, """,NULL, NULL, NULL, "&","'", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, "<", NULL, ">", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, }; static char *escape_html(const format_t *format, const char *str) { return g_pev_api->output->escape(format, str); } #define TEMPLATE_DOCUMENT_OPEN \ "\n" \ "\n" \ "\n" \ " \n" \ " %s\n" \ "\n" \ "\n" #define TEMPLATE_DOCUMENT_CLOSE \ "\n" \ "\n" static void to_format( const format_t *format, const output_type_e type, const output_scope_t *scope, const char *key, const char *value) { static int indent = 0; char * const escaped_key = format->escape_fn(format, key); char * const escaped_value = format->escape_fn(format, value); const bool is_within_array = scope->parent_type == OUTPUT_SCOPE_TYPE_ARRAY; switch (type) { default: break; case OUTPUT_TYPE_SCOPE_OPEN: { // NOTE: HTML doesn't allow `div` inside `ul`. If we're inside a `ul`, it // means the parent is an array, so we can safely replace `div` by `li`. const char * wrap_el = is_within_array ? "li" : "div"; switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: printf(TEMPLATE_DOCUMENT_OPEN, g_pev_api->output->output_cmdline()); indent++; break; case OUTPUT_SCOPE_TYPE_OBJECT: printf(INDENT(indent++, "<%s class=\"object\">\n"), wrap_el); printf(INDENT(indent, "

%s

\n"), escaped_key); break; case OUTPUT_SCOPE_TYPE_ARRAY: printf(INDENT(indent++, "<%s class=\"array\">\n"), wrap_el); printf(INDENT(indent, "

%s

\n"), escaped_key); printf(INDENT(indent++, "
    \n")); break; } break; } case OUTPUT_TYPE_SCOPE_CLOSE: { if (indent <= 0) { fprintf(stderr, "html: programming error? indent is <= 0"); abort(); } // NOTE: HTML doesn't allow `div` inside `ul`. If we're inside a `ul`, it // means the parent is an array, so we can safely replace `div` by `li`. const char * wrap_el = is_within_array ? "li" : "div"; switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: printf(TEMPLATE_DOCUMENT_CLOSE); break; case OUTPUT_SCOPE_TYPE_OBJECT: printf(INDENT(--indent, "\n"), wrap_el); break; case OUTPUT_SCOPE_TYPE_ARRAY: printf(INDENT(--indent, "
\n")); printf(INDENT(--indent, "\n"), wrap_el); break; } break; } case OUTPUT_TYPE_ATTRIBUTE: { const char * wrap_el = scope->type == OUTPUT_SCOPE_TYPE_ARRAY ? "li" : "p"; if (key && value) { printf(INDENT(indent, "<%s>%s: %s\n"), wrap_el, escaped_key, escaped_value, wrap_el); } else if (key) { putchar('\n'); printf(INDENT(indent, "<%s>%s\n"), wrap_el, escaped_key, wrap_el); } else if (value) { printf(INDENT(indent, "<%s>%s\n"), wrap_el, escaped_value, wrap_el); } break; } } if (escaped_key != NULL) free(escaped_key); if (escaped_value != NULL) free(escaped_value); } // ---------------------------------------------------------------------------- #define FORMAT_ID 2 #define FORMAT_NAME "html" static const format_t g_format = { FORMAT_ID, FORMAT_NAME, &to_format, &escape_html, (entity_table_t)g_entities }; #define PLUGIN_TYPE "output" #define PLUGIN_NAME FORMAT_NAME int plugin_loaded(void) { //printf("Loading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); return 0; } void plugin_unloaded(void) { //printf("Unloading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); } int plugin_initialize(const pev_api_t *api) { g_pev_api = api; int ret = g_pev_api->output->output_plugin_register_format(&g_format); if (ret < 0) return -1; return 0; } void plugin_shutdown(void) { g_pev_api->output->output_plugin_unregister_format(&g_format); } readpe-0.84/src/plugins/json.c000066400000000000000000000157631455661113700163170ustar00rootroot00000000000000/* pev - the PE file analyzer toolkit json.c - Principal implementation file for the JSON output plugin Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include #include #include #include #include "pev_api.h" #include "output_plugin.h" const pev_api_t *g_pev_api = NULL; // REFERENCE: https://tools.ietf.org/html/rfc7159 // JSON entities '"', '\', ... static const entity_t g_entities[255] = { NULL, "\\u0001","\\u0002","\\u0003","\\u0004","\\u0005","\\u0006","\\u0007","\\b","\\u0009", // 0-9 "\\n", "\\t", "\\u000c","\\r","\\u000e","\\u000f","\\u0010","\\u0011","\\u0012","\\u0013", // 10-19 "\\u0014","\\u0015","\\u0016","\\u0017","\\u0018","\\u0019","\\u001a","\\u001b","\\u001c","\\u001d", // 20-29 "\\u001e","\\u001f",NULL, NULL, "\\\"", NULL, NULL, NULL, NULL, NULL, // 30-39 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 40-49 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 50-59 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 60-69 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 70-79 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 80-89 NULL, NULL, "\\\\", NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 90-99 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 100-109 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 110-119 NULL, NULL, NULL, NULL, NULL, NULL, NULL, "\\u007f",NULL, NULL, // 120-129 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 130-139 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 140-149 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 150-159 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 160-169 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 170-179 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 180-189 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 190-199 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 200-209 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 210-219 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 220-229 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 230-239 NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, // 240-249 NULL, NULL, NULL, NULL, NULL, // 250-254 }; static char *escape_json(const format_t *format, const char *str) { return g_pev_api->output->escape(format, str); } static void to_format( const format_t *format, const output_type_e type, const output_scope_t *scope, const char *key, const char *value) { static int indent = 0; static int num_attr = 0; char * const escaped_key = format->escape_fn(format, key); char * const escaped_value = format->escape_fn(format, value); const bool is_within_array = scope->parent_type == OUTPUT_SCOPE_TYPE_ARRAY; switch (type) { default: break; case OUTPUT_TYPE_SCOPE_OPEN: switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: printf(INDENT(indent++, "{")); num_attr = 0; break; case OUTPUT_SCOPE_TYPE_OBJECT: // Already printed an attribute in the same scope? if (num_attr > 0) putchar(','); putchar('\n'); // NOTE: We don't want duplicate keys inside the array. if (key && !is_within_array) printf(INDENT(indent++, "\"%s\": {"), escaped_key); else printf(INDENT(indent++, "{")); num_attr = 0; break; case OUTPUT_SCOPE_TYPE_ARRAY: // Already printed an attribute in the same scope? if (num_attr > 0) putchar(','); putchar('\n'); // NOTE: We don't want duplicate keys inside the array. if (key && !is_within_array) printf(INDENT(indent++, "\"%s\": ["), escaped_key); else printf(INDENT(indent++, "[")); num_attr = 0; break; } break; case OUTPUT_TYPE_SCOPE_CLOSE: if (indent <= 0) { fprintf(stderr, "json: programming error? indent is <= 0"); abort(); } putchar('\n'); switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: printf(INDENT(--indent, "}\n")); break; case OUTPUT_SCOPE_TYPE_OBJECT: printf(INDENT(--indent, "}")); break; case OUTPUT_SCOPE_TYPE_ARRAY: printf(INDENT(--indent, "]")); break; } // Increment the number of attributes because this scope is itself an // attribute. num_attr++; break; case OUTPUT_TYPE_ATTRIBUTE: // Already printed an attribute in the same scope? if (num_attr > 0) putchar(','); putchar('\n'); if (key && value) printf(INDENT(indent, "\"%s\": \"%s\""), escaped_key, escaped_value); else if (key) printf(INDENT(indent, "\"%s\""), escaped_key); else if (value) printf(INDENT(indent, "\"%s\""), escaped_value); num_attr++; break; } if (escaped_key != NULL) free(escaped_key); if (escaped_value != NULL) free(escaped_value); } // ---------------------------------------------------------------------------- #define FORMAT_ID 6 #define FORMAT_NAME "json" static const format_t g_format = { FORMAT_ID, FORMAT_NAME, &to_format, &escape_json, (entity_table_t)g_entities }; #define PLUGIN_TYPE "output" #define PLUGIN_NAME FORMAT_NAME int plugin_loaded(void) { //printf("Loading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); return 0; } void plugin_unloaded(void) { //printf("Unloading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); } int plugin_initialize(const pev_api_t *api) { g_pev_api = api; int ret = g_pev_api->output->output_plugin_register_format(&g_format); if (ret < 0) return -1; return 0; } void plugin_shutdown(void) { g_pev_api->output->output_plugin_unregister_format(&g_format); } readpe-0.84/src/plugins/text.c000066400000000000000000000076171455661113700163310ustar00rootroot00000000000000/* pev - the PE file analyzer toolkit text.c - Principal implementation file for the TEXT output plugin Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include #include #include #include "pev_api.h" #include "output_plugin.h" const pev_api_t *g_pev_api = NULL; static char *escape_text(const format_t *format, const char *str) { return g_pev_api->output->escape(format, str); } #define SPACES 32 // spaces # for text-based output static void to_format( const format_t *format, const output_type_e type, const output_scope_t *scope, const char *key, const char *value) { static int indent = 0; char * const escaped_key = format->escape_fn(format, key); char * const escaped_value = format->escape_fn(format, value); switch (type) { default: break; case OUTPUT_TYPE_SCOPE_OPEN: switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: break; case OUTPUT_SCOPE_TYPE_OBJECT: if (key) { printf(INDENT(indent++, "%s\n"), escaped_key); } else { indent++; } break; case OUTPUT_SCOPE_TYPE_ARRAY: //putchar('\n'); if (key) { printf(INDENT(indent++, "%s\n"), escaped_key); } else { indent++; } break; } break; case OUTPUT_TYPE_SCOPE_CLOSE: indent--; break; case OUTPUT_TYPE_ATTRIBUTE: { const size_t key_size = key ? strlen(key) : 0; if (key && value) { printf(INDENT(indent, "%s:%*c%s\n"), escaped_key, (int)(SPACES - key_size), ' ', escaped_value); } else if (key) { printf(INDENT(indent, "%s\n"), escaped_key); } else if (value) { printf(INDENT(indent, "%*c%s\n"), (int)(SPACES - key_size + 1), ' ', escaped_value); } break; } } if (escaped_key != NULL) free(escaped_key); if (escaped_value != NULL) free(escaped_value); } // ---------------------------------------------------------------------------- #define FORMAT_ID 3 #define FORMAT_NAME "text" static const format_t g_format = { FORMAT_ID, FORMAT_NAME, &to_format, &escape_text, NULL }; #define PLUGIN_TYPE "output" #define PLUGIN_NAME FORMAT_NAME int plugin_loaded(void) { //printf("Loading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); return 0; } void plugin_unloaded(void) { //printf("Unloading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); } int plugin_initialize(const pev_api_t *api) { g_pev_api = api; int ret = g_pev_api->output->output_plugin_register_format(&g_format); if (ret < 0) return -1; return 0; } void plugin_shutdown(void) { g_pev_api->output->output_plugin_unregister_format(&g_format); } readpe-0.84/src/plugins/xml.c000066400000000000000000000146631455661113700161440ustar00rootroot00000000000000/* pev - the PE file analyzer toolkit xml.c - Principal implementation file for the XML output plugin Copyright (C) 2012 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include #include #include "pev_api.h" #include "output_plugin.h" const pev_api_t *g_pev_api = NULL; // REFERENCE: http://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references // XML entities '"', '&', '\'', '<', '>' static const entity_t g_entities[255] = { NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, """,NULL, NULL, NULL, "&","'", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, "<", NULL, ">", NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, }; static char *escape_xml(const format_t *format, const char *str) { return g_pev_api->output->escape(format, str); } #define TEMPLATE_DOCUMENT_OPEN \ "\n" #define TEMPLATE_DOCUMENT_CLOSE \ "\n" static void to_format( const format_t *format, const output_type_e type, const output_scope_t *scope, const char *key, const char *value) { static int indent = 0; // FIXME(jweyrich): Somehow output the XML root element. char * const escaped_key = format->escape_fn(format, key); char * const escaped_value = format->escape_fn(format, value); // // Quoting http://www.w3schools.com/xml/xml_elements.asp // // XML Naming Rules // XML elements must follow these naming rules: // Names can contain letters, numbers, and other characters // Names cannot start with a number or punctuation character // Names cannot start with the letters xml (or XML, or Xml, etc) // Names cannot contain spaces // switch (type) { default: break; case OUTPUT_TYPE_SCOPE_OPEN: switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: printf(TEMPLATE_DOCUMENT_OPEN, g_pev_api->output->output_cmdline()); indent++; break; case OUTPUT_SCOPE_TYPE_OBJECT: printf(INDENT(indent++, "\n"), escaped_key); break; case OUTPUT_SCOPE_TYPE_ARRAY: printf(INDENT(indent++, "\n"), escaped_key); break; } break; case OUTPUT_TYPE_SCOPE_CLOSE: if (indent <= 0) { fprintf(stderr, "xml: programming error? indent is <= 0"); abort(); } switch (scope->type) { default: break; case OUTPUT_SCOPE_TYPE_DOCUMENT: printf(TEMPLATE_DOCUMENT_CLOSE); break; case OUTPUT_SCOPE_TYPE_OBJECT: printf(INDENT(--indent, "\n")); break; case OUTPUT_SCOPE_TYPE_ARRAY: printf(INDENT(--indent, "\n")); break; } break; case OUTPUT_TYPE_ATTRIBUTE: if (key && value) { printf(INDENT(indent, "%s\n"), escaped_key, escaped_value); } else if (key) { printf(INDENT(indent, "\n"), escaped_key); } else if (value) { printf(INDENT(indent, "%s\n"), value); } break; } if (escaped_key != NULL) free(escaped_key); if (escaped_value != NULL) free(escaped_value); } // ---------------------------------------------------------------------------- #define FORMAT_ID 4 #define FORMAT_NAME "xml" static const format_t g_format = { FORMAT_ID, FORMAT_NAME, &to_format, &escape_xml, (entity_table_t)g_entities }; #define PLUGIN_TYPE "output" #define PLUGIN_NAME FORMAT_NAME int plugin_loaded(void) { //printf("Loading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); return 0; } void plugin_unloaded(void) { //printf("Unloading %s plugin %s\n", PLUGIN_TYPE, PLUGIN_NAME); } int plugin_initialize(const pev_api_t *api) { g_pev_api = api; int ret = g_pev_api->output->output_plugin_register_format(&g_format); if (ret < 0) return -1; return 0; } void plugin_shutdown(void) { g_pev_api->output->output_plugin_unregister_format(&g_format); } readpe-0.84/src/readpe.c000066400000000000000000001143311455661113700151140ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit readpe.c - show PE file headers Copyright (C) 2013 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #include #include #include "output.h" #define PROGRAM "readpe" typedef struct { bool all; bool dos; bool coff; bool opt; bool dirs; bool imports; bool exports; bool all_headers; bool all_sections; } options_t; static void usage(void) { static char formats[255]; output_available_formats(formats, sizeof(formats), '|'); printf("Usage: %s OPTIONS FILE\n" "Show PE file headers\n" "\nExample: %s --header optional winzip.exe\n" "\nOptions:\n" " -A, --all Full output (default).\n" " -H, --all-headers Show all PE headers.\n" " -S, --all-sections Show PE section headers.\n" " -f, --format <%s> Change output format (default: text).\n" " -d, --dirs Show data directories.\n" " -h, --header Show specific header. It can be used multiple times.\n" " -i, --imports Show imported functions.\n" " -e, --exports Show exported functions.\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM, formats); } static void parse_headers(options_t *options, const char *optarg) { if (!strcmp(optarg, "dos")) options->dos = true; else if (!strcmp(optarg, "coff")) options->coff = true; else if (!strcmp(optarg, "optional")) options->opt = true; else EXIT_ERROR("invalid header option"); } static void free_options(options_t *options) { // FIX: Don't need to test for NULL pointer. //if (options == NULL) // return; free(options); } static options_t *parse_options(int argc, char *argv[]) { options_t *options = calloc_s(1, sizeof(options_t)); /* Parameters for getopt_long() function */ static const char short_options[] = "AHSh:dief:V"; static const struct option long_options[] = { { "help", no_argument, NULL, 1 }, { "all", no_argument, NULL, 'A' }, { "all-headers", no_argument, NULL, 'H' }, { "all-sections", no_argument, NULL, 'S' }, { "header", required_argument, NULL, 'h' }, { "imports", no_argument, NULL, 'i' }, { "exports", no_argument, NULL, 'e' }, { "dirs", no_argument, NULL, 'd' }, { "format", required_argument, NULL, 'f' }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; options->all = true; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'A': options->all = true; break; case 'H': options->all = false; options->all_headers = true; break; case 'd': options->all = false; options->dirs = true; break; case 'S': options->all = false; options->all_sections = true; break; case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); case 'h': options->all = false; parse_headers(options, optarg); break; case 'i': options->all = false; options->imports = true; break; case 'e': options->all = false; options->exports = true; break; case 'f': if (output_set_format_by_name(optarg) < 0) EXIT_ERROR("invalid format option"); break; default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } return options; } static void print_sections(pe_ctx_t *ctx) { #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 static const char * const flags_name[] = { "contains executable code", "contains initialized data", "contains uninitialized data", "contains data referenced through the GP", "contains extended relocations", "can be discarded as needed", "cannot be cached", "is not pageable", "can be shared in memory", "is executable", "is readable", "is writable" }; // valid flags only for executables referenced in pecoffv8 static const unsigned int valid_flags[] = { IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_GPREL, IMAGE_SCN_LNK_NRELOC_OVFL, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_NOT_CACHED, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE }; static const size_t max_flags = LIBPE_SIZEOF_ARRAY(valid_flags); #endif output_open_scope("Sections", OUTPUT_SCOPE_TYPE_ARRAY); const uint32_t num_sections = pe_sections_count(ctx); if (num_sections == 0 || num_sections > MAX_SECTIONS) return; IMAGE_SECTION_HEADER **sections = pe_sections(ctx); if (sections == NULL) return; static char s[MAX_MSG]; static char section_name_buffer[SECTION_NAME_SIZE+1]; for (uint32_t i=0; i < num_sections; i++) { output_open_scope("Section", OUTPUT_SCOPE_TYPE_OBJECT); const char *section_name = pe_section_name(ctx, sections[i], section_name_buffer, sizeof(section_name_buffer)); output("Name", section_name); snprintf(s, MAX_MSG, "%#x (%" PRIu32 " bytes)", sections[i]->Misc.VirtualSize, sections[i]->Misc.VirtualSize); output("Virtual Size", s); snprintf(s, MAX_MSG, "%#x", sections[i]->VirtualAddress); output("Virtual Address", s); snprintf(s, MAX_MSG, "%#x (%" PRIu32 " bytes)", sections[i]->SizeOfRawData, sections[i]->SizeOfRawData); output("Size Of Raw Data", s); snprintf(s, MAX_MSG, "%#x", sections[i]->PointerToRawData); output("Pointer To Raw Data", s); snprintf(s, MAX_MSG, "%" PRIu16, sections[i]->NumberOfRelocations); output("Number Of Relocations", s); snprintf(s, MAX_MSG, "%#x", sections[i]->Characteristics); output("Characteristics", s); output_open_scope("Characteristic Names", OUTPUT_SCOPE_TYPE_ARRAY); #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 for (size_t j=0; j < max_flags; j++) { if (sections[i]->Characteristics & valid_flags[j]) { snprintf(s, MAX_MSG, "%s", flags_name[j]); output(NULL, s); } } #else if (pe_use_rom_section_characteristic(ctx)) { for (unsigned int flag = 1; flag != 0; flag <<= 1) { if (sections[i]->Characteristics & flag) { const char *characteristic_name = pe_rom_section_characteristic_name(flag); char formatted_characteristic_name[32]; if (characteristic_name == NULL) { snprintf(formatted_characteristic_name, sizeof(formatted_characteristic_name)-1, "UNKNOWN[%#x]", flag); characteristic_name = formatted_characteristic_name; } output(NULL, characteristic_name); } } } else { for (unsigned int flag = 1; flag != 0; flag <<= 1) { if (flag & 0x00F00000) continue; if (sections[i]->Characteristics & flag) { const char *characteristic_name = NULL; char formatted_characteristic_name[32]; if (pe_coff(ctx)->Machine == IMAGE_FILE_MACHINE_M68K) characteristic_name = pe_m68k_section_characteristic_name(flag); if (characteristic_name == NULL) characteristic_name = pe_section_characteristic_name(flag); if (characteristic_name == NULL) { snprintf(formatted_characteristic_name, sizeof(formatted_characteristic_name)-1, "UNKNOWN[%#x]", flag); characteristic_name = formatted_characteristic_name; } output(NULL, characteristic_name); } } if (sections[i]->Characteristics & 0x00F00000) { unsigned int flag = sections[i]->Characteristics & 0x00F00000; const char *characteristic_name = pe_section_characteristic_name(flag); char formatted_characteristic_name[32]; if (characteristic_name == NULL) { snprintf(formatted_characteristic_name, sizeof(formatted_characteristic_name)-1, "UNKNOWN[%#x]", flag); characteristic_name = formatted_characteristic_name; } output(NULL, characteristic_name); } } #endif output_close_scope(); // Characteristic Names output_close_scope(); // Section } output_close_scope(); // Sections } static void print_directories(pe_ctx_t *ctx) { #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 typedef struct { ImageDirectoryEntry entry; const char * const name; } ImageDirectoryEntryName; static const ImageDirectoryEntryName directoryEntryNames[] = { { IMAGE_DIRECTORY_ENTRY_EXPORT, "Export Table" }, // "Export directory", { IMAGE_DIRECTORY_ENTRY_IMPORT, "Import Table" }, // "Import directory", { IMAGE_DIRECTORY_ENTRY_RESOURCE, "Resource Table" }, // "Resource directory", { IMAGE_DIRECTORY_ENTRY_EXCEPTION, "Exception Table" }, // "Exception directory", { IMAGE_DIRECTORY_ENTRY_SECURITY, "Certificate Table" }, // "Security directory", { IMAGE_DIRECTORY_ENTRY_BASERELOC, "Base Relocation Table" }, // "Base relocation table", { IMAGE_DIRECTORY_ENTRY_DEBUG, "Debug" }, // "Debug directory", { IMAGE_DIRECTORY_ENTRY_ARCHITECTURE, "Architecture" }, // "Architecture-specific data", { IMAGE_DIRECTORY_ENTRY_GLOBALPTR, "Global Ptr" }, // "Global pointer", { IMAGE_DIRECTORY_ENTRY_TLS, "Thread Local Storage (TLS)"}, // "Thread local storage (TLS) directory", { IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG, "Load Config Table" }, // "Load configuration directory", { IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT, "Bound Import" }, // "Bound import directory", { IMAGE_DIRECTORY_ENTRY_IAT, "Import Address Table (IAT)"}, // "Import address table (IAT)", { IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, "Delay Import Descriptor" }, // "Delay import table", { IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR, "CLR Runtime Header" }, // "COM descriptor table" { IMAGE_DIRECTORY_RESERVED, "" } // "Reserved" }; //static const size_t max_directory_entry = LIBPE_SIZEOF_ARRAY(names); #endif output_open_scope("Data directories", OUTPUT_SCOPE_TYPE_ARRAY); const uint32_t num_directories = pe_directories_count(ctx); if (num_directories == 0 || num_directories > MAX_DIRECTORIES) return; IMAGE_DATA_DIRECTORY **directories = pe_directories(ctx); if (directories == NULL) return; static char s[MAX_MSG]; for (uint32_t i=0; i < num_directories; i++) { if (directories[i]->Size) { output_open_scope("Directory", OUTPUT_SCOPE_TYPE_OBJECT); snprintf(s, MAX_MSG, "%#x (%" PRIu32 " bytes)", directories[i]->VirtualAddress, directories[i]->Size); #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 output(directoryEntryNames[i].name, s); #else output(pe_directory_name(i), s); #endif output_close_scope(); // Directory } } output_close_scope(); // Data directories } static void print_optional_header(pe_ctx_t *ctx, IMAGE_OPTIONAL_HEADER *header) { #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 typedef struct { WindowsSubsystem subsystem; const char * const name; } WindowsSubsystemName; static const WindowsSubsystemName subsystemNames[] = { { IMAGE_SUBSYSTEM_UNKNOWN, "Unknown subsystem" }, { IMAGE_SUBSYSTEM_NATIVE, "System native" }, { IMAGE_SUBSYSTEM_WINDOWS_GUI, "Windows GUI" }, { IMAGE_SUBSYSTEM_WINDOWS_CUI, "Windows CLI" }, { IMAGE_SUBSYSTEM_UNKNOWN, "Unknown subsystem" }, { IMAGE_SUBSYSTEM_UNKNOWN, "Unknown subsystem" }, { IMAGE_SUBSYSTEM_UNKNOWN, "Unknown subsystem" }, { IMAGE_SUBSYSTEM_POSIX_CUI, "Posix CLI" }, { IMAGE_SUBSYSTEM_WINDOWS_CE_GUI, "Windows CE GUI" }, { IMAGE_SUBSYSTEM_EFI_APPLICATION, "EFI application" }, { IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER, "EFI driver with boot" }, { IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER, "EFI run-time driver" }, { IMAGE_SUBSYSTEM_EFI_ROM, "EFI ROM" }, { IMAGE_SUBSYSTEM_XBOX, "XBOX" }, { IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION, "Boot application" } }; static const size_t max_subsystem = LIBPE_SIZEOF_ARRAY(subsystemNames); #endif if (!header) return; static char s[MAX_MSG]; output_open_scope("Optional/Image header", OUTPUT_SCOPE_TYPE_OBJECT); switch (header->type) { case MAGIC_ROM: { snprintf(s, MAX_MSG, "%#x (%s)", header->_rom->Magic, "ROM"); output("Magic number", s); snprintf(s, MAX_MSG, "%" PRIu8, header->_rom->MajorLinkerVersion); output("Linker major version", s); snprintf(s, MAX_MSG, "%" PRIu8, header->_rom->MinorLinkerVersion); output("Linker minor version", s); snprintf(s, MAX_MSG, "%#x", header->_rom->SizeOfCode); output("Size of .text section", s); snprintf(s, MAX_MSG, "%#x", header->_rom->SizeOfInitializedData); output("Size of .data section", s); snprintf(s, MAX_MSG, "%#x", header->_rom->SizeOfUninitializedData); output("Size of .bss section", s); snprintf(s, MAX_MSG, "%#x", header->_rom->AddressOfEntryPoint); output("Entrypoint", s); snprintf(s, MAX_MSG, "%#x", header->_rom->BaseOfCode); output("Address of .text section", s); snprintf(s, MAX_MSG, "%#x", header->_rom->BaseOfData); output("Address of .data section", s); snprintf(s, MAX_MSG, "%#x", header->_rom->BaseOfBss); output("Address of .bss section", s); snprintf(s, MAX_MSG, "%#x", header->_rom->GprMask); output("GprMask", s); snprintf(s, MAX_MSG, "%#x", header->_rom->CprMask[0]); output("CprMask[0]", s); snprintf(s, MAX_MSG, "%#x", header->_rom->CprMask[1]); output("CprMask[1]", s); snprintf(s, MAX_MSG, "%#x", header->_rom->CprMask[2]); output("CprMask[2]", s); snprintf(s, MAX_MSG, "%#x", header->_rom->CprMask[3]); output("CprMask[3]", s); snprintf(s, MAX_MSG, "%#x", header->_rom->GpValue); output("GpValue", s); break; } case MAGIC_PE32: { snprintf(s, MAX_MSG, "%#x (%s)", header->_32->Magic, "PE32"); output("Magic number", s); snprintf(s, MAX_MSG, "%" PRIu8, header->_32->MajorLinkerVersion); output("Linker major version", s); snprintf(s, MAX_MSG, "%" PRIu8, header->_32->MinorLinkerVersion); output("Linker minor version", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfCode); output("Size of .text section", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfInitializedData); output("Size of .data section", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfUninitializedData); output("Size of .bss section", s); snprintf(s, MAX_MSG, "%#x", header->_32->AddressOfEntryPoint); output("Entrypoint", s); snprintf(s, MAX_MSG, "%#x", header->_32->BaseOfCode); output("Address of .text section", s); snprintf(s, MAX_MSG, "%#x", header->_32->BaseOfData); output("Address of .data section", s); snprintf(s, MAX_MSG, "%#x", header->_32->ImageBase); output("ImageBase", s); snprintf(s, MAX_MSG, "%#x", header->_32->SectionAlignment); output("Alignment of sections", s); snprintf(s, MAX_MSG, "%#x", header->_32->FileAlignment); output("Alignment factor", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_32->MajorOperatingSystemVersion); output("Major version of required OS", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_32->MinorOperatingSystemVersion); output("Minor version of required OS", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_32->MajorImageVersion); output("Major version of image", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_32->MinorImageVersion); output("Minor version of image", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_32->MajorSubsystemVersion); output("Major version of subsystem", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_32->MinorSubsystemVersion); output("Minor version of subsystem", s); #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 snprintf(s, MAX_MSG, "Win32 version value: %#x", header->_32->Win32VersionValue); output_open_scope(s, OUTPUT_SCOPE_TYPE_OBJECT); if (header->_32->Win32VersionValue == 0) strcpy(s, "(default)"); else snprintf(s, MAX_MSG, "%u", header->_32->Win32VersionValue & 0xff); output("Overwrite OS major version", s); if (header->_32->Win32VersionValue == 0) strcpy(s, "(default)"); else snprintf(s, MAX_MSG, "%u", (header->_32->Win32VersionValue >> 8) & 0xff); output("Overwrite OS minor version", s); if (header->_32->Win32VersionValue == 0) strcpy(s, "(default)"); else snprintf(s, MAX_MSG, "%u", (header->_32->Win32VersionValue >> 16) & 0x3fff); output("Overwrite OS build number", s); if (header->_32->Win32VersionValue == 0) strcpy(s, "(default)"); else { uint8_t platform_id = header->_32->Win32VersionValue >> 30; static const char *const win32_version_value_platform_id[4] = { "NT", "CE", "Win32s", "Win9x" }; snprintf(s, MAX_MSG, "%u (%s)", platform_id, win32_version_value_platform_id[platform_id]); } output("Overwrite OS platform id", s); output_close_scope(); #endif snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfImage); output("Size of image", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfHeaders); output("Size of headers", s); snprintf(s, MAX_MSG, "%#x", header->_32->CheckSum); output("Checksum", s); const uint16_t subsystem = header->_32->Subsystem; #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 const char *subsystem_name = "Unknown"; for (size_t i=0; i < max_subsystem; i++) { if (subsystem == subsystemNames[i].subsystem) subsystem_name = subsystemNames[i].name; } #else const char *subsystem_name = pe_windows_subsystem_name(subsystem); if (subsystem_name == NULL) subsystem_name = "Unknown"; #endif snprintf(s, MAX_MSG, "%#x (%s)", subsystem, subsystem_name); output("Subsystem required", s); snprintf(s, MAX_MSG, "%#x", header->_32->DllCharacteristics); output("DLL characteristics", s); #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 output_open_scope("DLL characteristics names", OUTPUT_SCOPE_TYPE_ARRAY); for (uint16_t i=0, flag=0x0001; i < 16; i++, flag <<= 1) { if (header->_32->DllCharacteristics & flag) { const char *characteristic_name = NULL; char formatted_characteristic_name[32]; if (pe_coff(ctx)->Characteristics & IMAGE_FILE_DLL) characteristic_name = pe_dll_image_dllcharacteristic_name(flag); if (characteristic_name == NULL) characteristic_name = pe_image_dllcharacteristic_name(flag); if (characteristic_name == NULL) { snprintf(formatted_characteristic_name, sizeof(formatted_characteristic_name)-1, "UNKNOWN[%#x]", flag); characteristic_name = formatted_characteristic_name; } output(NULL, characteristic_name); } } output_close_scope(); // DLL characteristics names #endif snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfStackReserve); output("Size of stack to reserve", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfStackCommit); output("Size of stack to commit", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfHeapReserve); output("Size of heap space to reserve", s); snprintf(s, MAX_MSG, "%#x", header->_32->SizeOfHeapCommit); output("Size of heap space to commit", s); #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 snprintf(s, MAX_MSG, "%#x", header->_32->LoaderFlags); output("Loader Flags", s); output_open_scope("Loader Flags names", OUTPUT_SCOPE_TYPE_ARRAY); for (uint32_t i=0, flag=0x00000001; i < 32; i++, flag <<= 1) { if (header->_32->LoaderFlags & flag) { const char *flag_name = NULL; char formatted_flag_name[32]; if (pe_coff(ctx)->Characteristics & IMAGE_FILE_DLL) flag_name = pe_dll_image_loader_flags_name(flag); if (flag_name == NULL) flag_name = pe_image_loader_flags_name(flag); if (flag_name == NULL) { snprintf(formatted_flag_name, sizeof(formatted_flag_name)-1, "UNKNOWN[%#x]", flag); flag_name = formatted_flag_name; } output(NULL, flag_name); } } output_close_scope(); // Loader Flags names #endif break; } case MAGIC_PE64: { snprintf(s, MAX_MSG, "%#x (%s)", header->_64->Magic, "PE32+"); output("Magic number", s); snprintf(s, MAX_MSG, "%" PRIu8, header->_64->MajorLinkerVersion); output("Linker major version", s); snprintf(s, MAX_MSG, "%" PRIu8, header->_64->MinorLinkerVersion); output("Linker minor version", s); snprintf(s, MAX_MSG, "%#x", header->_64->SizeOfCode); output("Size of .text section", s); snprintf(s, MAX_MSG, "%#x", header->_64->SizeOfInitializedData); output("Size of .data section", s); snprintf(s, MAX_MSG, "%#x", header->_64->SizeOfUninitializedData); output("Size of .bss section", s); snprintf(s, MAX_MSG, "%#x", header->_64->AddressOfEntryPoint); output("Entrypoint", s); snprintf(s, MAX_MSG, "%#x", header->_64->BaseOfCode); output("Address of .text section", s); snprintf(s, MAX_MSG, "%#"PRIx64, header->_64->ImageBase); output("ImageBase", s); snprintf(s, MAX_MSG, "%#x", header->_64->SectionAlignment); output("Alignment of sections", s); snprintf(s, MAX_MSG, "%#x", header->_64->FileAlignment); output("Alignment factor", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_64->MajorOperatingSystemVersion); output("Major version of required OS", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_64->MinorOperatingSystemVersion); output("Minor version of required OS", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_64->MajorImageVersion); output("Major version of image", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_64->MinorImageVersion); output("Minor version of image", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_64->MajorSubsystemVersion); output("Major version of subsystem", s); snprintf(s, MAX_MSG, "%" PRIu16, header->_64->MinorSubsystemVersion); output("Minor version of subsystem", s); #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 snprintf(s, MAX_MSG, "Win32 version value: %#x", header->_64->Win32VersionValue); output_open_scope(s, OUTPUT_SCOPE_TYPE_OBJECT); if (header->_64->Win32VersionValue == 0) strcpy(s, "(default)"); else snprintf(s, MAX_MSG, "%u", header->_64->Win32VersionValue & 0xff); output("Overwrite OS major version", s); if (header->_64->Win32VersionValue == 0) strcpy(s, "(default)"); else snprintf(s, MAX_MSG, "%u", (header->_64->Win32VersionValue >> 8) & 0xff); output("Overwrite OS minor version", s); if (header->_64->Win32VersionValue == 0) strcpy(s, "(default)"); else snprintf(s, MAX_MSG, "%u", (header->_64->Win32VersionValue >> 16) & 0x3fff); output("Overwrite OS build number", s); if (header->_64->Win32VersionValue == 0) strcpy(s, "(default)"); else { uint8_t platform_id = header->_64->Win32VersionValue >> 30; static const char *const win32_version_value_platform_id[4] = { "NT", "CE", "Win32s", "Win9x" }; snprintf(s, MAX_MSG, "%u (%s)", platform_id, win32_version_value_platform_id[platform_id]); } output("Overwrite OS platform id", s); output_close_scope(); #endif snprintf(s, MAX_MSG, "%#x", header->_64->SizeOfImage); output("Size of image", s); snprintf(s, MAX_MSG, "%#x", header->_64->SizeOfHeaders); output("Size of headers", s); snprintf(s, MAX_MSG, "%#x", header->_64->CheckSum); output("Checksum", s); const uint16_t subsystem = header->_64->Subsystem; #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 const char *subsystem_name = "Unknown"; for (size_t i=0; i < max_subsystem; i++) { if (subsystem == subsystemNames[i].subsystem) subsystem_name = subsystemNames[i].name; } #else const char *subsystem_name = pe_windows_subsystem_name(subsystem); if (subsystem_name == NULL) subsystem_name = "Unknown"; #endif snprintf(s, MAX_MSG, "%#x (%s)", subsystem, subsystem_name); output("Subsystem required", s); snprintf(s, MAX_MSG, "%#x", header->_64->DllCharacteristics); output("DLL characteristics", s); #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 output_open_scope("DLL characteristics names", OUTPUT_SCOPE_TYPE_ARRAY); for (uint16_t i=0, flag=0x0001; i < 16; i++, flag <<= 1) { if (header->_64->DllCharacteristics & flag) { const char *characteristic_name = NULL; char formatted_characteristic_name[32]; if (pe_coff(ctx)->Characteristics & IMAGE_FILE_DLL) characteristic_name = pe_dll_image_dllcharacteristic_name(flag); if (characteristic_name == NULL) characteristic_name = pe_image_dllcharacteristic_name(flag); if (characteristic_name == NULL) { snprintf(formatted_characteristic_name, sizeof(formatted_characteristic_name)-1, "UNKNOWN[%#x]", flag); characteristic_name = formatted_characteristic_name; } output(NULL, characteristic_name); } } output_close_scope(); // DLL characteristics names #endif snprintf(s, MAX_MSG, "%#"PRIx64, header->_64->SizeOfStackReserve); output("Size of stack to reserve", s); snprintf(s, MAX_MSG, "%#"PRIx64, header->_64->SizeOfStackCommit); output("Size of stack to commit", s); snprintf(s, MAX_MSG, "%#"PRIx64, header->_64->SizeOfHeapReserve); output("Size of heap space to reserve", s); snprintf(s, MAX_MSG, "%#"PRIx64, header->_64->SizeOfHeapCommit); output("Size of heap space to commit", s); #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 snprintf(s, MAX_MSG, "%#x", header->_64->LoaderFlags); output("Loader Flags", s); output_open_scope("Loader Flags names", OUTPUT_SCOPE_TYPE_ARRAY); for (uint32_t i=0, flag=0x00000001; i < 32; i++, flag <<= 1) { if (header->_64->LoaderFlags & flag) { const char *flag_name = NULL; char formatted_flag_name[32]; if (pe_coff(ctx)->Characteristics & IMAGE_FILE_DLL) flag_name = pe_dll_image_loader_flags_name(flag); if (flag_name == NULL) flag_name = pe_image_loader_flags_name(flag); if (flag_name == NULL) { snprintf(formatted_flag_name, sizeof(formatted_flag_name)-1, "UNKNOWN[%#x]", flag); flag_name = formatted_flag_name; } output(NULL, flag_name); } } output_close_scope(); // Loader Flags names #endif break; } } output_close_scope(); // Optional/Image heade } static void print_coff_header(IMAGE_COFF_HEADER *header) { #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 typedef struct { ImageCharacteristics characteristic; const char * const name; } ImageCharacteristicsName; static const ImageCharacteristicsName characteristicsTable[] = { { IMAGE_FILE_RELOCS_STRIPPED, "base relocations stripped" }, { IMAGE_FILE_EXECUTABLE_IMAGE, "executable image" }, { IMAGE_FILE_LINE_NUMS_STRIPPED, "line numbers removed (deprecated)" }, { IMAGE_FILE_LOCAL_SYMS_STRIPPED, "local symbols removed (deprecated)" }, { IMAGE_FILE_AGGRESSIVE_WS_TRIM, "aggressively trim (deprecated for Windows 2000 and later)" }, { IMAGE_FILE_LARGE_ADDRESS_AWARE, "can handle more than 2 GB addresses" }, { IMAGE_FILE_16BIT_MACHINE, "" }, { IMAGE_FILE_BYTES_REVERSED_LO, "little-endian (deprecated)" }, { IMAGE_FILE_32BIT_MACHINE, "32-bit machine" }, { IMAGE_FILE_DEBUG_STRIPPED, "debugging information removed" }, { IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP, "copy to swap if it's on removable media" }, { IMAGE_FILE_NET_RUN_FROM_SWAP, "copy to swap if it's on network media" }, { IMAGE_FILE_SYSTEM, "system file" }, { IMAGE_FILE_DLL, "DLL image" }, { IMAGE_FILE_UP_SYSTEM_ONLY, "uniprocessor machine" }, { IMAGE_FILE_BYTES_REVERSED_HI, "big-endian (deprecated)" } }; typedef struct { MachineType type; const char * const name; } MachineTypeName; static const MachineTypeName machineTypeTable[] = { { IMAGE_FILE_MACHINE_UNKNOWN, "Any machine type" }, { IMAGE_FILE_MACHINE_AM33, "Matsushita AM33" }, { IMAGE_FILE_MACHINE_AMD64, "x86-64 (64-bits)" }, { IMAGE_FILE_MACHINE_ARM, "ARM little endian" }, { IMAGE_FILE_MACHINE_ARMV7, "ARMv7 (or higher) Thumb mode only" }, { IMAGE_FILE_MACHINE_CEE, "clr pure MSIL (object only)" }, { IMAGE_FILE_MACHINE_EBC, "EFI byte code" }, { IMAGE_FILE_MACHINE_I386, "Intel 386 and compatible (32-bits)"}, { IMAGE_FILE_MACHINE_IA64, "Intel Itanium" }, { IMAGE_FILE_MACHINE_M32R, "Mitsubishi M32R little endian" }, { IMAGE_FILE_MACHINE_MIPS16, "MIPS16" }, { IMAGE_FILE_MACHINE_MIPSFPU, "MIPS with FPU" }, { IMAGE_FILE_MACHINE_MIPSFPU16, "MIPS16 with FPU" }, { IMAGE_FILE_MACHINE_POWERPC, "Power PC little endian" }, { IMAGE_FILE_MACHINE_POWERPCFP, "Power PC with floating point support" }, { IMAGE_FILE_MACHINE_R4000, "MIPS little endian" }, { IMAGE_FILE_MACHINE_SH3, "Hitachi SH3" }, { IMAGE_FILE_MACHINE_SH3DSP, "Hitachi SH3 DSP" }, { IMAGE_FILE_MACHINE_SH4, "Hitachi SH4" }, { IMAGE_FILE_MACHINE_SH5, "Hitachi SH5" }, { IMAGE_FILE_MACHINE_THUMB, "ARM or Thumb (\"interworking\")" }, { IMAGE_FILE_MACHINE_WCEMIPSV2, "MIPS little-endian WCE v2" } }; static const size_t max_machine_type = LIBPE_SIZEOF_ARRAY(machineTypeTable); #endif output_open_scope("COFF/File header", OUTPUT_SCOPE_TYPE_OBJECT); #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 const char *machine = "Unknown machine type"; for (size_t i=0; i < max_machine_type; i++) { if (header->Machine == machineTypeTable[i].type) machine = machineTypeTable[i].name; } #else const char *machine = pe_machine_type_name(header->Machine); if (machine == NULL) machine = "Unknown machine type"; #endif static char s[MAX_MSG]; snprintf(s, MAX_MSG, "%#x %s", header->Machine, machine); output("Machine", s); snprintf(s, MAX_MSG, "%" PRIu16, header->NumberOfSections); output("Number of sections", s); char timestr[40] = "invalid"; const time_t timestamp = header->TimeDateStamp; struct tm *t = gmtime(×tamp); if (t) strftime(timestr, sizeof(timestr), "%a, %d %b %Y %H:%M:%S UTC", t); snprintf(s, MAX_MSG, "%" PRIu32 " (%s)", header->TimeDateStamp, timestr); output("Date/time stamp", s); snprintf(s, MAX_MSG, "%#x", header->PointerToSymbolTable); output("Symbol Table offset", s); snprintf(s, MAX_MSG, "%" PRIu32, header->NumberOfSymbols); output("Number of symbols", s); snprintf(s, MAX_MSG, "%#x", header->SizeOfOptionalHeader); output("Size of optional header", s); snprintf(s, MAX_MSG, "%#x", header->Characteristics); output("Characteristics", s); output_open_scope("Characteristics names", OUTPUT_SCOPE_TYPE_ARRAY); for (uint16_t i=0, flag=0x0001; i < 16; i++, flag <<= 1) { if (header->Characteristics & flag) { #ifdef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 output(NULL, characteristicsTable[i].name); #else const char *characteristic_name = pe_image_characteristic_name(flag); char formatted_characteristic_name[32]; if (characteristic_name == NULL) { snprintf(formatted_characteristic_name, sizeof(formatted_characteristic_name)-1, "UNKNOWN[%#x]", flag); characteristic_name = formatted_characteristic_name; } output(NULL, characteristic_name); #endif } } output_close_scope(); // Characteristics names output_close_scope(); // COFF/File header } static void print_dos_header(IMAGE_DOS_HEADER *header) { char s[MAX_MSG]; output_open_scope("DOS Header", OUTPUT_SCOPE_TYPE_OBJECT); snprintf(s, MAX_MSG, "%#x (MZ)", header->e_magic); output("Magic number", s); snprintf(s, MAX_MSG, "%" PRIu16, header->e_cblp); output("Bytes in last page", s); snprintf(s, MAX_MSG, "%" PRIu16, header->e_cp); output("Pages in file", s); snprintf(s, MAX_MSG, "%" PRIu16, header->e_crlc); output("Relocations", s); snprintf(s, MAX_MSG, "%" PRIu16, header->e_cparhdr); output("Size of header in paragraphs", s); snprintf(s, MAX_MSG, "%" PRIu16, header->e_minalloc); output("Minimum extra paragraphs", s); snprintf(s, MAX_MSG, "%" PRIu16, header->e_maxalloc); output("Maximum extra paragraphs", s); snprintf(s, MAX_MSG, "%#x", header->e_ss); output("Initial (relative) SS value", s); snprintf(s, MAX_MSG, "%#x", header->e_sp); output("Initial SP value", s); snprintf(s, MAX_MSG, "%#x", header->e_ip); output("Initial IP value", s); snprintf(s, MAX_MSG, "%#x", header->e_cs); output("Initial (relative) CS value", s); snprintf(s, MAX_MSG, "%#x", header->e_lfarlc); output("Address of relocation table", s); snprintf(s, MAX_MSG, "%#x", header->e_ovno); output("Overlay number", s); snprintf(s, MAX_MSG, "%#x", header->e_oemid); output("OEM identifier", s); snprintf(s, MAX_MSG, "%#x", header->e_oeminfo); output("OEM information", s); snprintf(s, MAX_MSG, "%#x", header->e_lfanew); output("PE header offset", s); output_close_scope(); // DOS Header } static void print_exports(pe_ctx_t *ctx) { output_open_scope("Exported functions", OUTPUT_SCOPE_TYPE_ARRAY); const pe_exports_t *exports = pe_exports(ctx); if (exports->functions_count > 0) { output_open_scope("Library", OUTPUT_SCOPE_TYPE_OBJECT); output("Name", exports->name); output_open_scope("Functions", OUTPUT_SCOPE_TYPE_ARRAY); } for (size_t i=0; i < exports->functions_count; i++) { const pe_exported_function_t *func = &exports->functions[i]; if (func->address != 0) { output_open_scope("Function", OUTPUT_SCOPE_TYPE_OBJECT); char ordinal_str[32] = { 0 }; char address_str[16] = { 0 }; snprintf(ordinal_str, sizeof(ordinal_str)-1, "%"PRIu32, func->ordinal); snprintf(address_str, sizeof(address_str)-1, "%#"PRIx32, func->address); if (func->fwd_name != NULL) { char full_name[300 * 2 + 4]; snprintf(full_name, sizeof(full_name)-1, "%s -> %s", func->name, func->fwd_name); output("Ordinal", ordinal_str); output("Address", address_str); output("Name", full_name); } else { output("Ordinal", ordinal_str); output("Address", address_str); output("Name", func->name); } output_close_scope(); // Function } } if (exports->functions_count > 0) { output_close_scope(); // Functions output_close_scope(); // Library } output_close_scope(); // Exported functions } static void print_imports(pe_ctx_t *ctx) { output_open_scope("Imported functions", OUTPUT_SCOPE_TYPE_ARRAY); const pe_imports_t *imports = pe_imports(ctx); for (size_t i=0; i < imports->dll_count; i++) { const pe_imported_dll_t *dll = &imports->dlls[i]; output_open_scope("Library", OUTPUT_SCOPE_TYPE_OBJECT); output("Name", dll->name); output_open_scope("Functions", OUTPUT_SCOPE_TYPE_ARRAY); for (size_t j=0; j < dll->functions_count; j++) { const pe_imported_function_t *func = &dll->functions[j]; output_open_scope("Function", OUTPUT_SCOPE_TYPE_OBJECT); { if (func->ordinal) { char ordinal_str[16]; snprintf(ordinal_str, sizeof(ordinal_str)-1, "%"PRIu16, func->ordinal); output("Ordinal", ordinal_str); } else { char hint_str[16]; snprintf(hint_str, sizeof(hint_str)-1, "%"PRIu16, func->hint); output("Hint", hint_str); output("Name", func->name); } } output_close_scope(); // Function } output_close_scope(); // Functions output_close_scope(); // Library } output_close_scope(); // Imported functions } int main(int argc, char *argv[]) { pev_config_t config; PEV_INITIALIZE(&config); if (argc < 2) { usage(); return EXIT_FAILURE; } output_set_cmdline(argc, argv); options_t *options = parse_options(argc, argv); // opcoes pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, argv[argc-1]); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); output_open_document(); // dos header if (options->dos || options->all_headers || options->all) { IMAGE_DOS_HEADER *header_ptr = pe_dos(&ctx); if (header_ptr) print_dos_header(header_ptr); else if (pe_is_exec(&ctx)) { LIBPE_WARNING("unable to read DOS header"); } } // coff/file header if (options->coff || options->all_headers || options->all) { #ifndef LIBPE_ENABLE_OUTPUT_COMPAT_WITH_V06 if (ctx.pe.signature) { static char s[MAX_MSG]; output_open_scope("PE header", OUTPUT_SCOPE_TYPE_OBJECT); snprintf(s, MAX_MSG, "0x%08x (PE)", ctx.pe.signature); output("Signature", s); output_close_scope(); } #endif IMAGE_COFF_HEADER *header_ptr = pe_coff(&ctx); if (header_ptr) print_coff_header(header_ptr); else { LIBPE_WARNING("unable to read COFF file header"); } } // optional header if (options->opt || options->all_headers || options->all) { IMAGE_OPTIONAL_HEADER *header_ptr = pe_optional(&ctx); if (header_ptr) print_optional_header(&ctx, header_ptr); else if (pe_is_exec(&ctx)) { LIBPE_WARNING("unable to read Optional (Image) file header"); } } IMAGE_DATA_DIRECTORY **directories = pe_directories(&ctx); bool directories_warned = false; // directories if (options->dirs || options->all) { if (directories != NULL) print_directories(&ctx); else if (pe_is_exec(&ctx) && !directories_warned) { LIBPE_WARNING("directories not found"); directories_warned = true; } } // imports if (options->imports || options->all) { if (directories != NULL) print_imports(&ctx); else if (pe_is_exec(&ctx) && !directories_warned) { LIBPE_WARNING("directories not found"); directories_warned = true; } } // exports if (options->exports || options->all) { if (directories != NULL) print_exports(&ctx); else if (pe_is_exec(&ctx) && !directories_warned) { LIBPE_WARNING("directories not found"); directories_warned = true; } } // sections if (options->all_sections || options->all) { if (pe_sections(&ctx) != NULL) print_sections(&ctx); else { LIBPE_WARNING("unable to read sections"); } } output_close_document(); // libera a memoria free_options(options); // free err = pe_unload(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } PEV_FINALIZE(&config); return EXIT_SUCCESS; } readpe-0.84/src/rva2ofs.c000066400000000000000000000061541455661113700152410ustar00rootroot00000000000000/* vim: set ts=4 sw=4 noet: */ /* pev - the PE file analyzer toolkit rva2ofs.c - converts RVA to raw file offset Copyright (C) 2012 - 2020 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include "common.h" #define PROGRAM "rva2ofs" static void usage(void) { printf("Usage: %s FILE\n" "Convert RVA to raw file offset\n" "\nExample: %s 0x12db cards.dll\n" "\nOptions:\n" " -V, --version Show version.\n" " --help Show this help.\n", PROGRAM, PROGRAM); } static void parse_options(int argc, char *argv[]) { /* Parameters for getopt_long() function */ static const char short_options[] = "V"; static const struct option long_options[] = { { "help", no_argument, NULL, 1 }, { "version", no_argument, NULL, 'V' }, { NULL, 0, NULL, 0 } }; int c, ind; while ((c = getopt_long(argc, argv, short_options, long_options, &ind))) { if (c < 0) break; switch (c) { case 1: // --help option usage(); exit(EXIT_SUCCESS); case 'V': printf("%s %s\n%s\n", PROGRAM, TOOLKIT, COPY); exit(EXIT_SUCCESS); default: fprintf(stderr, "%s: try '--help' for more information\n", PROGRAM); exit(EXIT_FAILURE); } } } int main(int argc, char *argv[]) { //PEV_INITIALIZE(); if (argc != 3) { usage(); return EXIT_FAILURE; } parse_options(argc, argv); // opcoes pe_ctx_t ctx; pe_err_e err = pe_load_file(&ctx, argv[2]); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } uint64_t rva = (uint64_t)strtoll(argv[1], NULL, 0); if (!rva) EXIT_ERROR("invalid RVA"); err = pe_parse(&ctx); if (err != LIBPE_E_OK) { pe_error_print(stderr, err); return EXIT_FAILURE; } if (!pe_is_pe(&ctx)) EXIT_ERROR("not a valid PE file"); printf("%#"PRIx64"\n", pe_rva2ofs(&ctx, rva)); pe_unload(&ctx); //PEV_FINALIZE(); return EXIT_SUCCESS; } readpe-0.84/src/userdb.txt000066400000000000000000023543531455661113700155510ustar00rootroot00000000000000; Made with Add Signature v2.00 by BoB / BobSoft .. ; 3520 Signatures in list .. [Native UD Packer 1.1 (Modded Poison Ivy Shellcode) -> okkixot] signature = 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 ep_only = true [Obsidium v1.3.0.0 -> Obsidium Software (h)] signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 ep_only = true [PESpin v0.1 -> Cyberbob] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF ep_only = true [Private Personal Packer (PPP) v1.0.2 --> ConquestOfTroy.com] signature = E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 ep_only = true [PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix] signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 ep_only = true [PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix] signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 ep_only = true [PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix] signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 ep_only = true [PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix] signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 ep_only = true [PseudoSigner 0.1 [Morphine 1.2] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 ep_only = true [PseudoSigner 0.1 [Neolite 2.0] --> Anorganix] signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 ep_only = true [PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix] signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FF FF E9 ep_only = true [SimplePack 1.11 Method 1 -> bagie[TMX] (h)] signature = 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 ep_only = true [Software Compress v1.2 -> BG Software Protect Technologies] signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 ep_only = true [Software Compress v1.4 LITE -> BG Software Protect Technologies (h)] signature = E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 ep_only = true [* PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix] signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [ACProtect 1.09] --> Anorganix] signature = 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 ep_only = true [* PseudoSigner 0.1 [ASPack 2.xx Heuristic] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 ep_only = true [* PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix] signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Borland Delphi 3.0] --> Anorganix] signature = 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix] signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Borland Delphi 5.0 KOL/MCK] --> Anorganix] signature = 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 ep_only = true [* PseudoSigner 0.1 [Borland Delphi 6.0 - 7.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 ep_only = true [* PseudoSigner 0.1 [FSG 1.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 ep_only = true [* PseudoSigner 0.1 [FSG 1.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 ep_only = true [* PseudoSigner 0.1 [Macromedia Flash Projector 6.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 ep_only = true [* PseudoSigner 0.1 [Macromedia Flash Projector 6.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix] signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 6.0 (Debug Version)] --> Anorganix] signature = 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Morphine 1.2] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Morphine 1.2] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Neolite 2.0] --> Anorganix] signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Neolite 2.0] --> Anorganix] signature = E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix] signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [Pack Master 1.0 (PEX Clone)] --> Anorganix] signature = 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 ep_only = true [* PseudoSigner 0.1 [PECompact 1.4+] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 EB 06 68 90 90 90 90 C3 9C 60 E8 02 90 90 90 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 ep_only = true [* PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 ep_only = true [* PseudoSigner 0.1 [PEtite 2.x (level 0)] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 ep_only = true [* PseudoSigner 0.1 [Ste@lth PE 1.01] --> Anorganix] signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 ep_only = true [* PseudoSigner 0.1 [Ste@lth PE 1.01] --> Anorganix] signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 BA ?? ?? ?? ?? FF E2 BA E0 10 40 00 B8 68 24 1A 40 89 02 83 C2 03 B8 40 00 E8 EE 89 02 83 C2 FD FF E2 2D 3D 5B 20 48 69 64 65 50 45 20 5D 3D 2D 90 00 00 00 ep_only = true [* PseudoSigner 0.1 [Video-Lan-Client] --> Anorganix] signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 ep_only = true [* PseudoSigner 0.1 [Video-Lan-Client] --> Anorganix] signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 ep_only = true [* PseudoSigner 0.2 [FSG 1.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B ep_only = true [* PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C ep_only = true [* PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix] signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 9C 52 56 53 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 21 71 45 00 C3 ep_only = true [ACProtect 1.09g -> Risco software Inc.] signature = 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 ep_only = true [ACProtect 1.09g -> Risco software Inc.] signature = 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 ep_only = true [Alloy 4.x -> PGWare LLC] signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 ep_only = true [Alloy 4.x -> PGWare LLC] signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 ep_only = true [Apex_c beta -> 500mhz] signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [Apex_c beta -> 500mhz] signature = 68 ?? ?? ?? ?? B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [Armadillo v3.01, v3.05] signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F ep_only = true [Armadillo v3.01, v3.05] signature = 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F ep_only = true [Armadillo v3.10] signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 ep_only = true [Armadillo v3.10] signature = 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 ep_only = true [ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov (h)] signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [ASProtect SKE 2.1x (dll) -> Alexey Solodovnikov (h)] signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)] signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [ASProtect v1.23 RC4 build 08.07 (dll) -> Alexey Solodovnikov (h)] signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [beria v0.07 public WIP --> symbiont] signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 ep_only = true [beria v0.07 public WIP --> symbiont (h)] signature = 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 ep_only = true [BeRo Tiny Pascal -> BeRo] signature = E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 ep_only = true [BeRo Tiny Pascal -> BeRo] signature = E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 ep_only = true [BeRo Tiny Pascal -> BeRo / Farbrausch] signature = E9 ?? ?? ?? ?? 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 ep_only = true [BobPack v1.00 --> BoB / BobSoft] signature = 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 ep_only = true [CICompress v1.0] signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 ep_only = true [CICompress v1.0] signature = 6A 04 68 00 10 00 00 FF 35 9C 14 40 00 6A 00 FF 15 38 10 40 00 A3 FC 10 40 00 97 BE 00 20 40 00 E8 71 00 00 00 3B 05 9C 14 40 00 75 61 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 68 94 10 40 00 FF 15 2C 10 40 00 A3 F8 10 40 00 6A 00 68 F4 10 40 00 FF 35 ep_only = true [CipherWall Self-Extrator/Decryptor (Console) v1.5] signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 ep_only = true [CipherWall Self-Extrator/Decryptor (Console) v1.5] signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 ep_only = true [CipherWall Self-Extrator/Decryptor (GUI) v1.5] signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 ep_only = true [CipherWall Self-Extrator/Decryptor (GUI) v1.5] signature = 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 ep_only = true [CreateInstall Stub vx.x] signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 ep_only = true [CreateInstall Stub vx.x] signature = 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 ep_only = true [Crunch v4.0] signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 ep_only = true [Crunch v4.0] signature = EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 ep_only = true [Crunch v5 -> Bit-Arts] signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 ep_only = true [Crunch v5 -> Bit-Arts] signature = EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 ep_only = true [Crypto-Lock v2.02 (Eng) -> Ryan Thian] signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 ep_only = true [Crypto-Lock v2.02 (Eng) -> Ryan Thian] signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 ep_only = true [Crypto-Lock v2.02 (Eng) -> Ryan Thian] signature = 60 BE ?? 90 40 00 8D BE ?? ?? FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 ep_only = true [Crypto-Lock v2.02 (Eng) -> Ryan Thian] signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 ep_only = true [DBPE v2.10] signature = 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE ep_only = true [DBPE v2.10] signature = 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE ep_only = true [DEF 1.0 -> bart/xt] signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [DEF 1.0 -> bart/xt] signature = BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [DEF v1.00 (Eng) -> bart/xt] signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [DEF v1.00 (Eng) -> bart/xt] signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [diPacker V1.X -> diProtector Software] signature = 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 ep_only = true [diProtector V1.X -> diProtector Software] signature = 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 ep_only = true [DotFix NiceProtect vna] signature = 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 ep_only = true [Dual's eXe 1.0] signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 ep_only = true [Dual's eXe 1.0] signature = 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 ep_only = true [EmbedPE 1.13 -> cyclotron] signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 ep_only = true [EmbedPE 1.13 -> cyclotron] signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 ep_only = true [EP v1.0] signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 ep_only = true [EP v1.0] signature = 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C ?? ?? ?? ?? C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 ep_only = true [Exe Guarder v1.8 -> Exeicon.com (h)] signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 ep_only = true [Exe Guarder v1.8 -> Exeicon.com (h)] signature = 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 ep_only = true [Exe Locker v1.0 --> IonIce] signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 ep_only = true [Exe Locker v1.0 --> IonIce] signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 3E 8F 85 6C 00 00 00 3E 8F 85 68 00 00 00 3E 8F 85 64 00 00 00 3E 8F 85 60 00 00 00 3E 8F 85 5C 00 00 00 3E 8F 85 58 00 00 00 3E 8F 85 54 00 00 ep_only = true [EXE Shield V0.5 -> Smoke] signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 ep_only = true [EXE Shield V0.6 -> SMoKE] signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 ep_only = true [Exe Shield v2.7b] signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 ep_only = true [Exe Shield v2.7b] signature = EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 ep_only = true [Exe Stealth 2.75a -> WebtoolMaster] signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 ep_only = true [ExeBundle v3.0 (small loader)] signature = 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 ep_only = true [ExeBundle v3.0 (small loader)] signature = 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 ep_only = true [ExeBundle v3.0 (standard loader)] signature = 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB ep_only = true [ExeBundle v3.0 (standard loader)] signature = 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB ep_only = true [ExeJoiner 1.0 -> Yoda f2f] signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 ep_only = true [ExeJoiner 1.0 -> Yoda f2f] signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 ep_only = true [ExeShield 3.6 -> www.exeshield.com] signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F ep_only = true [ExeShield v3.7 -> ExeShield Team (h)] signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F ep_only = true [EXEStealth v2.75a -> WebtoolMaster (h)] signature = EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 ep_only = true [FixupPak v1.20] signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 ep_only = true [FixupPak v1.20] signature = 55 E8 00 00 00 00 5D 81 ED ?? ?? 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 ?? ?? 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 ep_only = true [FreePascal 2.0.0 Win32 -> (B閞czi G醔or, Pierre Muller & Peter Vreman)] signature = C6 05 ?? ?? ?? ?? 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 ep_only = true [FreePascal 2.0.0 Win32 -> (B閞czi G醔or, Pierre Muller & Peter Vreman)] signature = C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 ep_only = true [FSG v1.00 (Eng) -> dulek/xt] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 ep_only = true [FSG v1.00 (Eng) -> dulek/xt] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 ep_only = true [FSG v1.10 (Eng) -> bart/xt] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)] signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)] signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)] signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)] signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)] signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Borland C++)] signature = C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] signature = 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] signature = 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)] signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (MASM32 / TASM32)] signature = 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 ep_only = true [FSG v1.20 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 ep_only = true [FSG v1.3] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 ep_only = true [FSG v1.3] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 ep_only = true [FSG v1.30 (Eng) -> dulek/xt] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 ep_only = true [FSG v1.31 (Eng) -> dulek/xt] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB ep_only = true [FSG v1.31 (Eng) -> dulek/xt] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB ep_only = true [FSG v1.33 (Eng) -> dulek/xt] signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D ep_only = true [FSG v1.33 (Eng) -> dulek/xt] signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D ep_only = true [Fuck'n'Joy v1.0c -> UsAr] signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 ep_only = true [Fuck'n'Joy v1.0c -> UsAr] signature = 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 ep_only = true [Goat's PE Mutilator 1.6] signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [hmimys Protect v1.0] signature = E8 BA 00 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 40 00 ?? ?? ?? 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00 ep_only = true [InstallAnywhere 6.1 -> Zero G Software Inc] signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 ep_only = true [InstallAnywhere 6.1 ->Zero G Software Inc] signature = 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 ep_only = true [InstallShield Custom] signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B ep_only = true [KGB SFX] signature = 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ep_only = true [LaunchAnywhere v4.0.0.1] signature = 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 ep_only = true [Macromedia Windows Flash Projector/Player v5.0] signature = 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 ep_only = true [Microsoft Visual C# / Basic .NET] signature = FF 25 00 20 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [Microsoft Visual C++ 6.0 SFX Custom] signature = E8 21 48 00 00 E9 16 FE FF FF 51 C7 01 08 B4 00 30 E8 A4 48 00 00 59 C3 56 8B F1 E8 EA FF FF FF F6 ?? ?? ?? ?? 74 07 56 E8 F6 04 00 00 59 8B C6 5E C2 04 00 8B 44 24 04 83 C1 09 51 83 C0 09 50 ep_only = true [Microsoft Visual C++ 7.0 Custom] signature = 60 BE 00 B0 44 00 8D BE 00 60 FB FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ep_only = true [Microsoft Visual C++ v7.0] signature = 6A 0C 68 88 BF 01 10 E8 B8 1C 00 00 33 C0 40 89 45 E4 8B 75 0C 33 FF 3B F7 75 0C 39 3D 6C 1E 12 10 0F 84 B3 00 00 00 89 7D FC 3B F0 74 05 83 FE 02 75 31 A1 98 36 12 10 3B C7 74 0C FF 75 10 56 ep_only = true [MinGW v3.2.x (Dll_main)] signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 ep_only = true [MinGW v3.2.x (Dll_mainCRTStartup)] signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 ep_only = true [MinGW v3.2.x (Dll_WinMain)] signature = 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 76 01 00 00 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D 00 30 00 10 85 C9 75 10 31 DB 89 D8 8B 5D F8 8B 75 FC 89 EC 5D C2 0C 00 E8 59 00 ep_only = true [MinGW v3.2.x (main)] signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D ep_only = true [MinGW v3.2.x (WinMain)] signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D ep_only = true [MinGW v3.2.x (_mainCRTStartup)] signature = 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 40 00 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 ep_only = true [NoodleCrypt v2.00 (Eng) -> NoodleSpa] signature = EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 ep_only = true [Nullsoft Install System v1.xx] signature = 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 ep_only = true [Nullsoft Install System v1.xx] signature = 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 ep_only = true [Nullsoft Install System v2.0b2, v2.0b3] signature = 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 ep_only = true [Obsidium v1.2.5.0 -> Obsidium Software (h)] signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 ep_only = true [Obsidium v1.2.5.0 -> Obsidium Software (h)] signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 ep_only = true [Obsidium v1.3.0.0 -> Obsidium Software (h)] signature = EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B ep_only = true [Obsidium v1.3.0.4 -> Obsidium Software] signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 ep_only = true [ORiEN v2.11 (DEMO)] signature = E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F ep_only = true [ORiEN v2.11 - 2.12 -> Fisun Alexander] signature = E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F ep_only = true [PassLock 2000 v1.0 (Eng) -> Moonlight-Software] signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 ep_only = true [PC Guard for Win32 v5.00 -> SofPro/Blagoje Ceklic (h)] signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 ?? ?? ?? 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C ep_only = true [PC-Guard v5.00d] signature = FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C ep_only = true [PE Diminisher v0.1 -> Teraphy] signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 ep_only = true [PE Protector 0.9.3 --> CRYPToCRACk] signature = 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 ep_only = true [PE Spin v0.b] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 ep_only = true [Pe123 v2006.4.12] signature = 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B ep_only = true [Pe123 v2006.4.4] signature = 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 ep_only = true [PECompact v1.67] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 8B 11 ep_only = true [PECompact v1.68 - v1.84] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 ep_only = true [PEiD-Bundle v1.00 - v1.01 --> BoB / BobSoft] signature = 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A ep_only = true [PEiD-Bundle v1.00 --> BoB / BobSoft] signature = 60 E8 21 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A ep_only = true [PEiD-Bundle v1.01 --> BoB / BobSoft] signature = 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A ep_only = true [PEiD-Bundle v1.02 --> BoB / BobSoft] signature = 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 ep_only = true [PEnguinCrypt v1.0] signature = B8 93 ?? ?? 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 ep_only = true [PESpin v0.1 -> Cyberbob (h)] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [PESpin v0.3 (Eng) -> cyberbob] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [PESpin v0.7 -> Cyberbob (h)] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [PESpin v1.1 -> Cyberbob (h)] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [PESPin v1.3 -> Cyberbob (h)] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [PESpin v1.304 -> Cyberbob (h)] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 88 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [PESpin v1.3beta -> Cyberbob (h)] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF ep_only = true [Petite 1.2 -> (c)1998 Ian Luck (h)] signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 ep_only = true [Petite 1.4 -> (c)1998-99 Ian Luck (h)] signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 ep_only = true [PeX v0.99 (Eng) -> bart/CrackPl] signature = E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ep_only = true [Private EXE Protector 1.8 -> SetiSoft] signature = A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 ep_only = false [Private EXE Protector 1.9.7 -> SetiSoft (h)] signature = 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 ep_only = false [PseudoSigner 0.2 [FSG 1.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B ep_only = true [PseudoSigner 0.2 [Macromedia Flash Projector 6.0] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C ep_only = true [PseudoSigner 0.2 [Video-Lan-Client] --> Anorganix] signature = 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 ep_only = true [PUNiSHER v1.5 (DEMO) -> FEUERRADER/AHTeam] signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 ep_only = true [RE-Crypt v0.7x -> Crudd [RET] (h1)] signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B ep_only = true [RE-Crypt v0.7x -> Crudd [RET] (h2)] signature = 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B ep_only = true [Reflexive Arcade Wrapper] signature = 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 ep_only = true [RLPack 1.0 beta -> ap0x] signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 ?? ?? ?? ?? C3 60 8B 74 24 24 8B 7C ep_only = true [RLPack Full Edition 1.17 DLL [aPLib] -> Ap0x] signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 ep_only = true [RLPack V1.0.beta -> ap0x] signature = 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB ep_only = true [SafeDisc/SafeCast 2.xx - 3.xx -> Macrovision] signature = 55 8B EC 60 BB ?? ?? ?? ?? 33 C9 8A 0D 3D ?? ?? ?? 85 C9 74 0C B8 ?? ?? ?? ?? 2B C3 83 E8 05 EB 0E 51 B9 ?? ?? ?? ?? 8B C1 2B C3 03 41 01 59 C6 03 E9 89 43 01 51 68 09 ?? ?? ?? 33 C0 85 C9 74 05 8B 45 08 EB 00 50 E8 76 00 00 00 83 C4 08 59 83 F8 00 74 1C C6 03 C2 C6 43 01 0C 85 C9 74 09 61 5D B8 00 00 00 00 EB 97 50 A1 29 ?? ?? ?? ?? D0 61 5D EB 46 80 7C 24 08 00 75 3F 51 8B 4C 24 04 89 0D ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 4C 24 04 59 EB 28 50 B8 2D ?? ?? ?? ?? 70 08 8B 40 0C FF D0 B8 2D ?? ?? ?? ?? 30 8B 40 04 FF D0 58 FF 35 ?? ?? ?? ?? C3 72 16 61 13 60 0D E9 ?? ?? ?? ?? CC CC 81 EC E8 02 00 00 53 55 56 57 ep_only = true [SDProtect -> Randy Li] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 ep_only = true [SDProtector 1.x -> Randy Li] signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 ep_only = true [SDProtector Basic/Pro Edition 1.10 -> Randy Li (h)] signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 ep_only = true [SDProtector Pro Edition 1.16 -> Randy Li (h)] signature = 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 ep_only = true [SmartE -> Microsoft] signature = EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 ep_only = true [Soft Defender v1.0 - v1.1] signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 ?? ?? ?? ?? 58 05 BA 01 ?? ?? 03 C8 74 BE 75 BC E8 ep_only = true [SoftDefender 1.x -> Randy Li] signature = 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 ep_only = true [SOFTWrapper for Win9x/NT (Evaluation Version)] signature = E8 00 00 00 00 5D 8B C5 2D ?? ?? ?? 00 50 81 ED 05 00 00 00 8B C5 2B 85 03 0F 00 00 89 85 03 0F 00 00 8B F0 03 B5 0B 0F 00 00 8B F8 03 BD 07 0F 00 00 83 7F 0C 00 74 2B 56 57 8B 7F 10 03 F8 8B 76 10 03 F0 83 3F 00 74 0C 8B 1E 89 1F 83 C6 04 83 C7 04 EB EF ep_only = true [Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven] signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 ep_only = true [SuperDAT] signature = 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D ep_only = true [SVK Protector v1.32 (Eng) -> Pavol Cerven] signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E ep_only = true [SVK Protector v1.3x (Eng) -> Pavol Cerven] signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E ep_only = true [themida 1.0.0.5 -> http://www.oreans.com] signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 ep_only = true [Themida 1.0.x.x - 1.8.0.0 (compressed engine) -> Oreans Technologies] signature = B8 ?? ?? ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 5A ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 5A ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 ep_only = true [Themida 1.2.0.1 (compressed) -> Oreans Technologies (h)] signature = B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ep_only = true [Themida 1.8.x.x -> Oreans Technologies] signature = B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 ep_only = true [Thinstall v2.460 -> Jitit] signature = 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E ep_only = true [Upack 0.1x beta -> Dwing] signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 ep_only = true [Upack 0.20 beta -> Dwing] signature = BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 ep_only = true [Upack 0.21 beta -> Dwing] signature = BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 ep_only = true [Upack 0.22 - 0.23 beta -> Dwing] signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 ep_only = true [Upack 0.24 beta -> Dwing] signature = BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 ep_only = true [Upack v0.399 -> Dwing] signature = 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ep_only = true [UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB ep_only = true [UPX Modified Stub b -> Farb-rausch Consumer Consulting] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC ep_only = true [UPX Modified Stub c -> Farb-rausch Consumer Consulting] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 ep_only = true [Upx v1.2 -> Marcus & Lazlo] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 ep_only = true [UPX-SCRAMBLER 3.06 -> ㎡nT畂L] signature = E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 ep_only = true [Vcasm-Protector 1.0] signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 ep_only = true [vfp&exeNc v6.00 -> Wang JianGuo] signature = 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC ep_only = true [vprotector 1.2 -> vcasm] signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 ep_only = true [VProtector V1.0E -> vcasm] signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 ep_only = true [WinUpack v0.39 final (relocated image base) -> By Dwing (c)2005 (h2)] signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 ep_only = true [WinZip Self-Extractor 2.2 personal edition -> WinZip Computing (h)] signature = 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B ep_only = true [Wise Installer Stub] signature = 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF ep_only = true [Wise Installer Stub v1.10.1029.1] signature = 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 ep_only = true [Xtreme-Protector v1.06] signature = B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 ep_only = true [yoda's Crypter 1.3 -> Ashkbiz Danehkar] signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC ep_only = true [yoda's Protector 1.0 beta -> Ashkbiz Danehkar] signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 ep_only = true [yoda's Protector 1.02 - 1.03 -> Ashkbiz Danehkar] signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 ep_only = true [yoda's Protector v1.01 -> Ashkbiz Danehkar (h)] signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 ep_only = true [yoda's Protector v1.03.2 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)] signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 ep_only = true [Yoda's Protector v1.03.2 Beta2 -> Ashkbiz Danehkar] signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 ep_only = true [yoda's Protector v1.03.3 (.exe,.scr,.com) -> Ashkbiz Danehkar (h)] signature = E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 ep_only = true [yoda's Protector v1.0b -> Ashkbiz Danehkar (h)] signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 00 00 EB 01 ep_only = true [* PseudoSigner 0.1 [Armadillo 3.00] --> Anorganix] signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 ep_only = true [* PseudoSigner 0.1 [Armadillo 3.00] --> Anorganix] signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 ep_only = true [* PseudoSigner 0.1 [CodeSafe 2.0] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 ep_only = true [* PseudoSigner 0.1 [CodeSafe 2.0] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 ep_only = true [* PseudoSigner 0.1 [DEF 1.0] --> Anorganix] signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 ep_only = true [* PseudoSigner 0.1 [DEF 1.0] --> Anorganix] signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 ep_only = true [* PseudoSigner 0.1 [DxPack 1.0] --> Anorganix] signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [DxPack 1.0] --> Anorganix] signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [ExeSmasher] --> Anorganix] signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 ep_only = true [* PseudoSigner 0.1 [ExeSmasher] --> Anorganix] signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 ep_only = true [* PseudoSigner 0.1 [Gleam 1.00] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 ep_only = true [* PseudoSigner 0.1 [Gleam 1.00] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 ep_only = true [* PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] --> Anorganix] signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 ep_only = true [* PseudoSigner 0.1 [JDPack 1.x / JDProtect 0.9] --> Anorganix] signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 ep_only = true [* PseudoSigner 0.1 [LCC Win32 DLL] --> Anorganix] signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 ep_only = true [* PseudoSigner 0.1 [LCC Win32 DLL] --> Anorganix] signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 ep_only = true [* PseudoSigner 0.1 [Lockless Intro Pack] --> Anorganix] signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 ep_only = true [* PseudoSigner 0.1 [Lockless Intro Pack] --> Anorganix] signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF ep_only = true [* PseudoSigner 0.1 [Microsoft Visual Basic 6.0 DLL] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 6.20] --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] --> Anorganix] signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 7.0 DLL] --> Anorganix] signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ?? ?? ?? ?? E9 ep_only = true [* PseudoSigner 0.1 [PE Intro 1.0] --> Anorganix] signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 ep_only = true [* PseudoSigner 0.1 [PE Intro 1.0] --> Anorganix] signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 ep_only = true [* PseudoSigner 0.1 [PENinja 1.31] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 ep_only = true [* PseudoSigner 0.1 [PENinja 1.31] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 ep_only = true [* PseudoSigner 0.1 [PESHiELD 0.25] --> Anorganix] signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 ep_only = true [* PseudoSigner 0.1 [PESHiELD 0.25] --> Anorganix] signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 ep_only = true [* PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix] signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 ep_only = true [* PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 ep_only = true [* PseudoSigner 0.2 [DEF 1.0] --> Anorganix] signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 ep_only = true [* PseudoSigner 0.2 [DxPack 1.0] --> Anorganix] signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 ep_only = true [* PseudoSigner 0.2 [ExeSmasher] --> Anorganix] signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B ep_only = true [* PseudoSigner 0.2 [Gleam 1.00] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF ep_only = true [* PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix] signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 ep_only = true [* PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix] signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC ep_only = true [* PseudoSigner 0.2 [ZCode 1.01] --> Anorganix] signature = E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 57 51 9C 50 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 9C 57 52 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 53 50 57 53 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 9C 50 55 51 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 53 52 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 55 52 9C 50 51 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 52 51 55 57 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 50 9C 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 9C 51 50 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 57 54 53 9C 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 50 51 57 50 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 57 52 50 51 51 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 50 57 55 51 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 50 52 54 9C 53 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 56 53 51 55 9C 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 56 55 50 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 53 55 50 55 56 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 52 53 56 9C 55 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 53 52 50 51 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 52 53 55 52 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 9C 51 55 52 51 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 52 55 51 53 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 53 54 51 55 56 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 52 53 56 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 52 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 53 50 51 51 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 57 53 56 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 52 51 50 53 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 56 50 52 53 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 57 51 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 53 50 54 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 51 9C 56 53 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 56 51 52 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 50 52 53 52 51 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 51 55 56 53 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 53 51 50 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 9C 51 56 53 52 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 51 53 57 52 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 57 53 57 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 57 51 53 9C 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 50 53 51 57 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 52 9C 55 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 50 53 9C 57 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 55 53 51 50 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 50 52 51 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 53 9C 51 57 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 52 9C 52 51 57 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 9C 57 52 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 53 54 57 55 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 55 51 53 50 52 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 51 56 52 50 9C 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 57 55 53 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 56 50 9C 53 50 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 54 53 9C 55 52 50 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 56 55 55 9C 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 53 52 51 57 55 9C 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 50 53 51 56 55 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 9C 56 53 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 51 56 57 55 52 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 56 50 55 51 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 54 55 51 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 52 53 50 9C 56 53 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 52 50 56 9C 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5A 5B 59 9D 5E 58 5F 5D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 50 51 56 55 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 55 52 50 53 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 56 56 50 55 51 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 01 7D 00 00 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 55 52 54 50 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 57 53 55 56 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 9C 51 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 51 57 53 9C 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 53 55 53 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 56 52 51 50 9C 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 53 55 50 9C 55 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 9C 56 53 55 52 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 53 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 57 56 55 56 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 57 56 52 55 50 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 53 53 52 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 51 56 52 56 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 52 57 50 57 51 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 51 9C 52 50 53 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 55 50 9C 51 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 57 53 52 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 9C 57 50 53 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 55 9C 56 57 50 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 51 50 52 55 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 50 56 52 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 56 50 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 55 55 9C 56 52 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 51 56 57 50 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 53 50 52 56 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 53 55 51 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 51 57 9C 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 54 53 56 57 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 53 51 55 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 55 51 57 52 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 50 52 51 57 53 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 52 51 56 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 57 55 53 51 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 55 56 52 56 51 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 9C 57 55 52 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 50 56 53 57 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 50 52 57 53 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 51 9C 50 57 53 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 55 57 56 57 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 51 56 51 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 55 52 56 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 50 52 57 56 51 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 52 51 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 54 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 50 56 56 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 52 9C 57 51 55 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 50 57 9C 51 53 52 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 57 52 51 9C 53 53 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 50 9C 55 53 56 52 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5B 5A 5E 58 5D 9D 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 9C 55 50 54 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 53 50 9C 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 52 53 56 50 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 53 55 51 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 51 52 55 51 50 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 51 53 55 56 50 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 57 51 50 55 51 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 51 55 52 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 50 52 56 51 50 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5B 5A 59 5E 5A 58 5D 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 55 56 56 57 51 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 51 52 55 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 57 53 52 55 51 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 56 53 57 52 51 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8A 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 55 52 56 53 57 51 54 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 57 52 55 56 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 52 56 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 51 56 57 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 56 51 55 9C 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 53 50 56 53 51 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 56 55 56 9C 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 9C 52 50 57 56 53 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 51 50 55 53 56 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 9C 54 56 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 52 57 51 9C 53 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 55 52 9C 57 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 55 56 51 57 50 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 55 51 53 53 57 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 53 51 55 57 56 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 55 52 50 55 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 50 52 51 55 56 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 53 55 53 51 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 52 56 51 57 53 50 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 56 57 51 52 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 52 53 52 56 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 51 53 57 56 52 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 56 53 52 50 55 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 55 57 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 50 57 53 51 52 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 5E 59 5D 5A 59 5B 5F 58 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 53 52 50 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F A5 D0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 8A 4D 08 83 C5 02 0F AD D0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 50 39 C5 0F 87 ?? ?? ?? ?? 8D 4F 40 29 E1 8D 45 80 29 C8 89 C4 9C 56 89 FE 8D BD 40 FF FF FF 57 FC F3 A4 5F 5E 9D E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 56 53 57 52 51 50 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 53 57 50 55 56 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 9C 51 52 56 50 53 56 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 8D 76 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 57 55 56 51 50 9C 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 55 50 52 9C 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 53 53 50 9C 52 57 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 52 53 50 9C 57 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 51 9C 56 50 57 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 57 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 52 51 55 55 56 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 57 9C 56 50 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 52 53 51 55 9C 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 52 53 51 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 66 8B 55 02 F6 D0 F6 D2 83 ED 02 20 D0 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E8 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 8A 4D 02 83 ED 02 66 D3 E0 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 52 53 55 55 9C 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 55 51 9C 55 52 53 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 57 52 53 57 51 55 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 55 54 52 51 9C 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 51 51 52 55 57 9C 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 9C 56 50 51 53 52 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 56 53 57 51 52 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 55 51 9C 52 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 52 51 55 9C 50 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 0F B6 06 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 53 51 55 53 9C 57 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 53 57 51 55 56 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 9C 50 56 51 55 54 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 55 50 9C 56 54 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 57 53 56 9C 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 50 53 56 51 9C 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 54 56 50 9C 55 53 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 50 56 57 51 9C 53 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 9C 56 53 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 56 53 55 57 9C 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 53 9C 57 55 51 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 56 53 57 9C 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 58 59 5D 9D 5F 5A 5E 58 5B 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 53 50 55 51 56 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 51 9C 53 57 51 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 56 51 50 9C 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 53 9C 50 50 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 57 50 53 51 56 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 53 52 57 55 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 51 51 9C 52 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 9C 56 53 55 57 54 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 55 56 57 51 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 9C 50 51 57 53 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 55 56 9C 57 51 50 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 56 57 55 53 9C 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 51 50 9C 57 50 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 56 53 50 55 9C 57 51 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 55 57 53 9C 50 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 56 52 9C 50 53 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5F 5D 5B 58 9D 5A 5E 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 52 56 53 50 55 9C 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 50 55 56 53 9C 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 57 50 53 55 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 52 53 50 56 57 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 57 9C 50 53 56 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 52 9C 57 54 55 53 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 57 50 9C 56 52 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 53 57 50 52 50 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 9C 50 55 53 54 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 57 52 55 50 9C 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 56 56 53 55 57 9C 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 50 57 53 56 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 56 57 53 9C 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 55 56 9C 57 53 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 9C 55 51 54 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 53 50 57 9C 55 54 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5B 5E 5D 5D 9D 5F 58 5B 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 51 50 56 55 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 9C 55 53 51 56 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 56 50 52 57 57 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 53 56 50 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 55 53 50 52 53 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 50 53 51 9C 55 54 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 53 50 55 51 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 9C 57 50 50 56 53 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 52 50 51 57 56 55 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 9C 56 50 51 55 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 56 51 50 9C 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 51 9C 57 53 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 56 51 52 50 55 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 9C 53 56 51 57 55 52 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 9C 52 52 51 55 50 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 51 55 50 57 9C 52 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 56 57 51 50 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 56 55 50 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 55 50 51 57 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 51 52 50 51 9C 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 57 52 51 9C 53 56 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 51 51 56 50 52 57 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 51 56 53 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 52 57 50 9C 53 56 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 57 51 52 53 53 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 56 52 57 50 55 53 9C 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 53 52 9C 57 56 50 53 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 57 52 57 56 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 53 51 56 52 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 9C 56 52 51 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 57 56 52 50 56 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 56 50 56 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 51 9C 53 51 52 50 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 9C 50 57 57 51 56 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 55 56 54 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 54 51 57 52 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 9C 50 56 57 51 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 55 57 50 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 9C 55 52 50 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 50 52 52 57 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 53 9C 52 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 55 50 51 9C 52 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 54 9C 51 56 55 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 9C 56 51 52 55 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 9C 55 52 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50 57 56 55 51 9C 51 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 52 55 56 56 9C 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 56 51 55 9C 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 55 51 9C 56 50 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 57 50 55 51 9C 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 55 57 51 56 50 9C 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 ED 04 83 C6 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 52 57 57 50 9C 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 9C 55 57 50 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 9C 52 57 55 50 56 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 56 50 57 55 52 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 51 55 56 52 9C 57 50 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 56 9C 57 50 51 55 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 55 9C 57 56 51 50 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 FF 24 85 ?? ?? ?? ?? 89 EC 5A 5E 58 59 5E 5F 9D 5D 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 52 50 56 51 57 56 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 55 52 9C 53 56 57 50 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 89 EC 5A 5B 58 5F 5E 5A 9D 5A 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 52 53 57 51 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 55 51 55 9C 56 53 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 57 52 56 51 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 66 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 56 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 55 51 56 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 52 53 51 55 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 51 51 9C 52 55 57 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 56 57 57 51 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 9C 53 57 51 52 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 51 55 57 52 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53 50 55 9C 51 52 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 52 53 55 57 9C 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 56 53 52 55 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 55 52 54 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 9C 56 53 57 52 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 57 9C 53 53 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 55 9C 56 53 52 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 5A 58 5F 5A 5B 5E 9D 5D 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 53 55 9C 55 56 57 50 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 52 50 53 56 55 57 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 55 54 56 52 57 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF 8D 0C 85 ?? ?? ?? ?? FF 21 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 54 55 56 52 53 51 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 53 57 52 57 56 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 55 56 50 53 9C 57 52 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 24 85 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 50 52 9C 53 57 50 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 9C 56 53 53 55 57 52 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 55 53 56 52 57 56 51 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 53 56 51 57 52 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 9C 52 56 55 57 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 54 57 56 52 55 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 9C 53 57 55 52 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 56 53 55 57 52 9C 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 EC 59 5D 9D 5A 5F 5D 5B 5E 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 55 9C 57 57 56 52 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 53 9C 56 57 56 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 9C 53 55 57 52 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 24 85 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 57 9C 55 52 56 51 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 C6 01 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 53 52 55 9C 52 57 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 9C 50 53 57 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 51 52 57 56 55 53 9C 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 8D 76 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 53 9C 55 56 53 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 24 85 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 50 9C 51 57 52 55 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 06 83 EE FC 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 55 53 57 51 53 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 9C 50 55 53 51 56 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 57 52 52 9C 56 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 57 52 55 51 53 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 8D 0C 85 ?? ?? ?? ?? FF 21 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 54 52 57 51 55 56 9C 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 24 85 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 53 57 51 9C 52 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 53 53 55 9C 57 51 56 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 46 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 51 9C 56 53 57 51 55 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 C6 01 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 9C 54 53 55 56 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 8D 76 01 0F B6 C0 8D 0C 85 ?? ?? ?? ?? FF 21 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 57 56 57 9C 51 55 53 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 83 EE FF 0F B6 C0 FF 34 85 ?? ?? ?? ?? C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 52 56 9C 53 54 57 55 51 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 0F B6 C0 83 EE FF FF 34 85 ?? ?? ?? ?? C3 ep_only = true [*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)] signature = 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 ep_only = true [*** Protector v1.1.11 (DDeM->PE Engine v0.9, DDeM->CI v0.9.2)] signature = 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 ep_only = true [.NET executable] signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [ACProtect 1.4x -> RISCO soft] signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 ep_only = false [ACProtect 1.4x -> RISCO soft] signature = 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 ep_only = false [ActiveMARK 5.x -> Trymedia Systems,Inc. (h)] signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 ep_only = false [ActiveMARK 5.x -> Trymedia Systems,Inc. (h)] signature = 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 ep_only = false [AHpack 0.1 -> FEUERRADER (h)] signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 ep_only = true [AHpack 0.1 -> FEUERRADER (h)] signature = 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 ep_only = true [Alex Protector 1.0 beta 2 by Alex] signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 ep_only = false [Alex Protector 1.0 beta 2 by Alex] signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 ep_only = false [Alex Protector v0.4 beta 1 by Alex] signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 ep_only = false [Alex Protector v0.4 beta 1 by Alex] signature = 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 ep_only = false [ARM Protector v0.1 by SMoKE] signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 ep_only = false [ARM Protector v0.1 by SMoKE] signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 ep_only = false [Armadillo 3.00a -> Silicon Realms Toolworks] signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ep_only = true [Armadillo 3.00a -> Silicon Realms Toolworks] signature = 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ep_only = true [Armadillo 4.30a -> Silicon Realms Toolworks (h)] signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 ep_only = false [Armadillo 4.30a -> Silicon Realms Toolworks (h)] signature = 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 ep_only = false [Armadillo 4.40 -> Silicon Realms Toolworks (h)] signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 ep_only = false [Armadillo 4.40 -> Silicon Realms Toolworks (h)] signature = 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 ep_only = false [Armadillo v1.60a] signature = 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.60a] signature = 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.77] signature = 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.77] signature = 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.80] signature = 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.80] signature = 55 8B EC 6A FF 68 E8 C1 00 00 68 F4 86 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.82] signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.82] signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.83] signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.83] signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 64 84 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.84] signature = 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.84] signature = 55 8B EC 6A FF 68 E8 C1 40 00 68 F4 86 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90] signature = 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90] signature = 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90a] signature = 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90a] signature = 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b1] signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b1] signature = 55 8B EC 6A FF 68 E0 C1 40 00 68 04 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b2] signature = 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b2] signature = 55 8B EC 6A FF 68 F0 C1 40 00 68 A4 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b3] signature = 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b3] signature = 55 8B EC 6A FF 68 08 E2 40 00 68 94 95 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b4] signature = 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90b4] signature = 55 8B EC 6A FF 68 08 E2 40 00 68 B4 96 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90c] signature = 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v1.90c] signature = 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.00] signature = 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.00] signature = 55 8B EC 6A FF 68 00 02 41 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.00b2-2.00b3] signature = 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.00b2-2.00b3] signature = 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.01] signature = 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.01] signature = 55 8B EC 6A FF 68 08 02 41 00 68 04 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.10b2] signature = 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.10b2] signature = 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.20] signature = 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.20] signature = 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.20b1] signature = 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.20b1] signature = 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 ep_only = true [Armadillo v2.50] signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 ep_only = true [Armadillo v2.50] signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 ep_only = true [Armadillo v2.53] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 ep_only = true [Armadillo v2.53] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 40 ?? ?? ?? ?? 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 ep_only = true [Armadillo v2.5x - v2.6x] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC ep_only = true [Armadillo v2.5x - v2.6x] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC ep_only = true [Armadillo v3.00] signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 ep_only = true [Armadillo v3.00] signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 ep_only = true [Armadillo v3.00a] signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB ep_only = true [Armadillo v3.00a] signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB ep_only = true [Armadillo v3.xx] signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 ep_only = true [Armadillo v3.xx] signature = 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 ep_only = true [ASPack v1.00b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 ep_only = true [ASPack v1.00b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 ep_only = true [ASPack v1.01b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 ep_only = true [ASPack v1.01b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 ep_only = true [ASPack v1.02a] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF ep_only = true [ASPack v1.02a] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF ep_only = true [ASPack v1.02b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43 ep_only = true [ASPack v1.02b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 C5 2B 85 7D 7C 43 ?? 89 85 89 7C 43 ?? 80 BD 74 7C 43 ep_only = true [ASPack v1.03b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 ep_only = true [ASPack v1.03b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 ep_only = true [ASPack v1.05b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 ep_only = true [ASPack v1.05b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 ep_only = true [ASPack v1.061b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 ep_only = true [ASPack v1.061b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 ep_only = true [ASPack v1.08.01] signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D ep_only = true [ASPack v1.08.01] signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D ep_only = true [ASPack v1.08.01] signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 ?? BB 10 ?? 44 ?? 03 DD 2B 9D ep_only = true [ASPack v1.08.01] signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ?? ?? ?? 44 00 BB 10 ?? 44 00 03 DD 2B 9D ep_only = true [ASPack v1.08.02] signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 ep_only = true [ASPack v1.08.02] signature = 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 ep_only = true [ASPack v1.08.03] signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E ep_only = true [ASPack v1.08.03] signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E ep_only = true [ASPack v2.xx] signature = A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 ep_only = true [ASPack v2.xx] signature = A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 ep_only = true [ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov (h)] signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [ASProtect SKE 2.1x (exe) -> Alexey Solodovnikov (h)] signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)] signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [ASProtect v1.23 RC4 build 08.07 (exe) -> Alexey Solodovnikov (h)] signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [ASProtect v?.? -> If you know this version, post on PEiD board (h2)] signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [ASProtect v?.? -> If you know this version, post on PEiD board (h2)] signature = 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [BeRoEXEPacker v1.00 DLL [LZBRS] -> BeRo / Farbrausch] signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 ep_only = true [BeRoEXEPacker v1.00 [LZBRS] -> BeRo / Farbrausch] signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 ep_only = true [BlackEnergy DDoS Bot Crypter] signature = 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F ep_only = true [CExe v1.0a] signature = 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 ep_only = true [CExe v1.0a] signature = 55 8B EC 81 EC 0C 02 ?? ?? 56 BE 04 01 ?? ?? 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 ep_only = true [Com4mail v1.0] signature = 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A ep_only = true [CreateInstall v2003.3.5] signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 ep_only = false [CreateInstall v2003.3.5] signature = 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 ep_only = false [CRYPToCRACK's PE Protector V0.9.2 -> Lukas Fleischer] signature = E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 ep_only = true [Dev-C++ 4.9.9.2 -> Bloodshed Software] signature = 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ep_only = true [DotFix Nice Protect 2.1 -> GPcH Soft] signature = E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 ?? ?? ?? ?? 03 C5 50 B8 ?? ?? ?? ?? 03 C5 FF 10 BB ?? ?? ?? ?? 03 DD 83 C3 0C 53 50 B8 ?? ?? ?? ?? 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 ep_only = false [DxPack V0.86 -> Dxd] signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00 ep_only = true [DxPack V0.86 -> Dxd] signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 06 10 40 00 2B BD 94 12 40 00 81 EF 06 00 00 00 83 BD 14 13 40 00 01 0F 84 2F 01 00 00 ep_only = true [DzA Patcher v1.3 Loader] signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 ep_only = false [DzA Patcher v1.3 Loader] signature = BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 ep_only = false [Enigma protector 1.10 (unregistered)] signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 ep_only = false [Enigma protector 1.10 (unregistered)] signature = 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 ep_only = false [Exe Shield v1.7] signature = EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 ep_only = true [Exe Shield v1.7] signature = EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 ep_only = true [Exe Shield v2.9] signature = 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 ep_only = true [Exe Shield v2.9] signature = 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 ep_only = true [EXE Stealth v2.5] signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ep_only = false [EXE Stealth v2.5] signature = 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ep_only = false [EXE Stealth v2.73] signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 ep_only = false [EXE Stealth v2.73] signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 EB 16 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 60 90 E8 00 00 00 00 5D 81 ED F0 27 40 00 B9 15 00 00 00 83 C1 05 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 ep_only = false [EXE Stealth v2.74] signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 ep_only = false [EXE Stealth v2.74] signature = EB 00 EB 17 53 68 61 72 65 77 61 72 65 20 2D 20 45 78 65 53 74 65 61 6C 74 68 00 60 90 E8 00 00 00 00 5D 81 ED C4 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 ep_only = false [EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)] signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 ep_only = true [EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h1)] signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 ep_only = true [EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)] signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 ep_only = false [EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h3)] signature = 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 ep_only = false [EXECryptor v1.3.0.45] signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 ep_only = true [EXECryptor v1.3.0.45] signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 ep_only = true [EXECryptor v1.4.0.1] signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 ep_only = true [EXECryptor v1.4.0.1] signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 ep_only = true [EXECryptor v1.5.1.x] signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3 ep_only = true [EXECryptor v1.5.1.x] signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 C1 ?? ?? ?? FE C3 31 C0 64 FF 30 64 89 20 CC C3 ep_only = true [EXECryptor v1.5.3] signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 ep_only = false [EXECryptor v1.5.3] signature = E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 ep_only = false [EXEJoiner v1.0] signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 ep_only = true [EXEJoiner v1.0] signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 E8 ep_only = true [ExeSafeguard v1.0 -> simonzh (h)] signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE ep_only = false [ExeSafeguard v1.0 -> simonzh (h)] signature = C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE ep_only = false [ExeShield Protector V3.6 -> www.exeshield.com] signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC ep_only = true [ExeShield Protector V3.6 -> www.exeshield.com] signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC ep_only = true [eXPressor V1.0 -> CGSoftLabs] signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 ep_only = true [eXPressor V1.0 -> CGSoftLabs] signature = E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 ep_only = true [eXpressor v1.1 -> CGSoftLabs] signature = E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 ep_only = true [eXpressor v1.1 -> CGSoftLabs] signature = E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 ep_only = true [eXPressor v1.2 -> CGSoftLabs (h)] signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 ep_only = true [eXPressor v1.2 -> CGSoftLabs (h)] signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 ep_only = true [eXPressor V1.4.5.1 -> CGSoftLabs] signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D ep_only = true [eXPressor V1.4.5.1 -> CGSoftLabs] signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D ep_only = true [eXPressor v1.4.5.1 -> CGSoftLabs (h)] signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 ep_only = true [eXPressor v1.4.5.1 -> CGSoftLabs (h)] signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 ep_only = true [eXPressor V1.4.5.x -> CGSoftLabs] signature = 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D ep_only = true [eXPressor v1.5x -> CGSoftLabs (h)] signature = 55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23 ep_only = true [EZIP v1.0] signature = E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C ep_only = true [EZIP v1.0] signature = E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C ep_only = true [FSG v1.0] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B ep_only = true [FSG v1.0] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B ep_only = true [FSG v1.2] signature = 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 ep_only = true [FSG v1.2] signature = 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 ep_only = true [FSG v1.31] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 ep_only = true [FSG v1.31] signature = BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 BB ?? ?? ?? ?? B2 80 A4 B6 80 FF D3 73 F9 33 C9 ep_only = true [Goats Mutilator v1.6 -> Goat/_e0f] signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D ep_only = true [Goats Mutilator v1.6 -> Goat/_e0f] signature = E8 EA 0B 00 00 ?? ?? ?? 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D ep_only = true [GP-Install v5.0.3.32] signature = 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0 ep_only = false [GP-Install v5.0.3.32] signature = 55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 B8 C4 1C 41 00 E8 6B 3E FF FF 33 C0 55 68 76 20 41 00 64 FF 30 64 89 20 BA A0 47 41 00 33 C0 E8 31 0A FF FF 33 D2 A1 A0 ep_only = false [HACKSTOP v1.10p1] signature = B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB ep_only = true [HACKSTOP v1.10p1] signature = B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 ?? ?? 58 EB ep_only = true [Hardlock dongle (Alladin)] signature = 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 ep_only = true [Hasp dongle (Alladin)] signature = 50 53 51 52 57 56 8B 75 1C 8B 3E ?? ?? ?? ?? ?? 8B 5D 08 8A FB ?? ?? 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 ep_only = true [Hide PE 1.01 -> BGCorp] signature = ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D ep_only = true [Hide PE 1.01 -> BGCorp] signature = ?? BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 04 B8 ?? ?? ?? ?? 89 02 83 C2 F8 FF E2 0D 0A 2D 3D 5B 20 48 69 64 65 50 45 20 62 79 20 42 47 43 6F 72 70 20 5D 3D 2D ep_only = true [Inno Setup Module v1.09a] signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 ep_only = true [Inno Setup Module v1.2.9] signature = 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 ep_only = true [iPBProtect v0.1.3] signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 ep_only = false [JDPack V2.00 -> JDPack] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? 05 00 00 00 00 83 C4 0C 5D 60 E8 00 00 00 00 5D 8B D5 64 FF 35 00 00 00 00 EB ep_only = true [kkrunchy -> Ryd] signature = BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 ep_only = true [LameCrypt -> LaZaRus] signature = 60 66 9C BB 00 ?? ?? 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 ?? ?? 40 00 FF E0 ep_only = true [Launcher Generator v1.03] signature = 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 ep_only = false [Macromedia Windows Flash Projector/Player v3.0] signature = 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06 ep_only = true [Macromedia Windows Flash Projector/Player v4.0] signature = 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C ep_only = true [Macromedia Windows Flash Projector/Player v6.0] signature = 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C ep_only = true [Metrowerks CodeWarrior (DLL) v2.0] signature = 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 ep_only = false [MEW 11 SE v1.2] signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [Microsoft CAB SFX module] signature = 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20 ep_only = true [Microsoft Visual C# v7.0 / Basic .NET] signature = FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = false [Microsoft Visual C++ 6.0 - 8.0] signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 8D 45 F0 64 A3 00 00 00 00 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 ep_only = false [Microsoft Visual C++ 6.0 - 8.0] signature = 3D 00 10 00 00 73 0E F7 D8 03 C4 83 C0 04 85 00 94 8B 00 50 C3 51 8D 4C 24 08 81 E9 00 10 00 00 2D 00 10 00 00 85 01 3D 00 10 00 00 73 EC 2B C8 8B C4 85 01 8B E1 8B 08 8B 40 04 50 C3 ep_only = false [Microsoft Visual C++ 6.0 - 8.0] signature = 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 8B 44 24 10 89 6C 24 10 8D 6C 24 10 2B E0 53 56 57 8B 45 F8 89 65 E8 50 8B 45 FC C7 45 FC FF FF FF FF 89 45 F8 C3 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B C9 51 C3 ep_only = false [Microsoft Visual C++ v7.1 DLL] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC ep_only = true [Microsoft Visual C++ v7.1 DLL] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 75 09 83 3D ?? ?? 40 00 00 EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ep_only = true [Microsoft Windows Update CAB SFX module] signature = E9 C5 FA FF FF 55 8B EC 56 8B 75 08 68 04 08 00 00 FF D6 59 33 C9 3B C1 75 0F 51 6A 05 FF 75 28 E8 2E 11 00 00 33 C0 EB 69 8B 55 0C 83 88 88 00 00 00 FF 83 88 84 00 00 00 FF 89 50 04 8B 55 10 89 50 0C 8B 55 14 89 50 10 8B 55 18 89 50 14 8B 55 1C 89 50 18 ep_only = false [MingWin32 v?.? (h)] signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FE FF FF 90 8D B4 26 00 00 00 00 55 ep_only = true [Morphine v3.3 -> Silent Software & Silent Shield (c)2005] signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 ep_only = false [nBinder v4.0] signature = 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 ep_only = false [nMacro recorder 1.0] signature = 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 ep_only = false [North Star PE Shrinker v1.3 by Liuxingping] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 ep_only = false [nPack v1.1 150-200 Beta -> NEOx] signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 ep_only = true [nPack v1.1 250 Beta -> NEOx] signature = 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ep_only = true [nPack V1.1.150.2006.Beta -> NEOx/[uinC]] signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 56 57 68 54 ?? ?? ?? FF 15 00 ?? ?? ?? 8B 35 08 ?? ?? ?? 8B F8 68 44 ?? ?? ?? 57 FF D6 68 38 ?? ?? ?? 57 A3 38 ?? ?? ?? FF D6 5F A3 34 ?? ?? ?? 5E C3 ep_only = true [nPack V1.1.150.2006.Beta -> NEOx/[uinC]] signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 ep_only = true [nPack V1.1.200.2006.Beta -> NEOx/[uinC]] signature = 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 ep_only = true [nPack v1.1.xxx -> NEOx] signature = 83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ep_only = true [NsPack v3.1 -> North Star (h)] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 ep_only = true [NTkrnl Secure Suite -> NTkrnl Team (Blue)] signature = 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF ep_only = false [NTkrnl Secure Suite -> NTkrnl team (h)] signature = 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 ep_only = false [NTkrnl Secure Suite V0.1 -> NTkrnl Software] signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 ep_only = false [NTkrnl Secure Suite V0.1 DLL -> NTkrnl Software] signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 8B 44 24 04 05 ?? ?? ?? ?? 50 E8 01 00 00 00 C3 C3 ep_only = false [NTKrnlPacker -> Ashkbiz Danehkar] signature = 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 ep_only = false [Nullsoft Install System v2.0] signature = 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 ep_only = false [Nullsoft Install System v2.0 RC2] signature = 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 ep_only = false [Nullsoft Install System v2.0a0] signature = 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 ep_only = false [Nullsoft Install System v2.0b4] signature = 83 EC 14 83 64 24 04 00 53 55 56 57 C6 44 24 13 20 FF 15 30 70 40 00 BE 00 20 7A 00 BD 00 04 00 00 56 55 FF 15 C4 70 40 00 56 E8 7D 2B 00 00 8B 1D 8C 70 40 00 6A 00 56 FF D3 BF 80 92 79 00 56 57 E8 15 26 00 00 85 C0 75 38 68 F8 91 40 00 55 56 FF 15 60 71 ep_only = false [Nullsoft Install System v2.0b4] signature = 83 EC 10 53 55 56 57 C7 44 24 14 F0 91 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 88 72 40 00 BE 00 D4 42 00 BF 00 04 00 00 56 57 A3 60 6F 42 00 FF 15 C4 70 40 00 E8 9F FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 60 71 40 00 ep_only = false [Obsidium 1.3.0.17 -> Obsidium software] signature = EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ep_only = true [Obsidium v1.3.0.37 -> Obsidium Software (h)] signature = EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 04 ?? ?? ?? ?? EB 01 ?? 58 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? E8 23 27 ep_only = true [Obsidium v1.3.0.4 -> Obsidium Software (h)] signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ep_only = true [Obsidium v1.3.3.1 -> Obsidium Software (h)] signature = EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 01 ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 ?? ?? E8 5F 27 00 00 ep_only = true [Obsiduim 1.3.0.4 -> Obsiduim Software] signature = EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 ep_only = true [Pack Master v1.0] signature = 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 ep_only = true [Packanoid 1.0 -> ackanoid] signature = BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 ep_only = true [Packanoid v1 -> Arkanoid] signature = BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 ep_only = true [Packman 0.0.0.1 -> Bubbasoft (h)] signature = 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 ep_only = false [PC PE Encryptor Alpha preview] signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 ep_only = true [PE Diminisher v0.1] signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 ep_only = true [PE Lock v1.06] signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 ep_only = true [PE Ninja v1.0 -> +DzA kRAker TNT] signature = BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [PE Protect v0.9] signature = E9 ?? 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 20 28 43 29 6F ep_only = false [PE-Armor 0.46 -> China Cracking Group] signature = E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 ep_only = true [PE-PaCK v1.0 -> (C) Copyright 1998 by ANAKiN (h)] signature = C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 ep_only = false [PeCompact 2.xx --> BitSum Technologies] signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 ep_only = true [PECompact v0.90] signature = EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 ep_only = true [PECompact v0.977] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 ep_only = true [PECompact v0.978] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 ep_only = true [PECompact v0.978.1] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 ep_only = true [PECompact v0.978.2] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 ?? 87 DD 8B 85 56 85 ep_only = true [PECompact v0.98] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 ep_only = true [PECompact v0.99] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 ep_only = true [PECompact v1.00] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 ep_only = true [PECompact v1.10b1] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 ?? 87 DD 8B 85 AD 63 ep_only = true [PECompact v1.10b2] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 ep_only = true [PECompact v1.10b3] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 ep_only = true [PECompact v1.10b4] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44 ep_only = true [PECompact v1.10b5] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 ep_only = true [PECompact v1.10b6] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 ep_only = true [PECompact v1.10b7] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB 14 ep_only = true [PECompact v1.20 - v1.20.1] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 9A 70 40 ep_only = true [PECompact v1.22] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 ep_only = true [PECompact v1.23b3 - v1.24.1] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 ep_only = true [PECompact v1.24.2 - v1.24.3] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 ep_only = true [PECompact v1.25] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D ep_only = true [PECompact v1.26b1 - v1.26b2] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E ep_only = true [PECompact v1.33] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E ep_only = true [PECompact v1.34 - v1.40b1] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10 ep_only = true [PECompact v1.40 - v1.45] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11 ep_only = true [PECompact v1.40b2 - v1.40b4] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 86 11 ep_only = true [PECompact v1.40b5 - v1.40b6] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 ep_only = true [PECompact v1.46] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 ep_only = true [PECompact v1.47 - v1.50] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 ep_only = true [PECompact v1.55] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 ep_only = true [PECompact v1.56] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 ep_only = true [PECompact v1.60 - v1.65] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 ep_only = true [PECompact v1.66] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 ?? 87 DD 8B 85 E6 90 40 ?? 01 85 33 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 DA 90 40 ?? 01 85 DE 90 40 ?? 01 85 E2 90 40 ?? BB 5B 11 ep_only = true [PECompact v2.00 alpha 38] signature = B8 ?? ?? ?? ?? 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F ep_only = false [PECompact v2.5 Retail -> Bitsum Technologies] signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 ep_only = true [PeCompact2 2.53-2.76 --> BitSum Technologies] signature = B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF ep_only = false [PEncrypt v3.0] signature = E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB ?? ?? ?? ?? AD 33 C3 E2 FA ep_only = true [PENinja] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ep_only = true [PENinja modified] signature = 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD ep_only = true [PEQuake v0.06 by fORGAT] signature = E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 ep_only = false [PESpin V0.71 -> cyberbob] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E ep_only = true [Petite 1.3 -> (c)1998 Ian Luck (h)] signature = ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 ep_only = true [Petite 2.2 -> (c)1998-99 Ian Luck (h)] signature = ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 ep_only = true [PEZip v1.0 by BaGIE] signature = D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 ep_only = false [PocketPC ARM] signature = F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00 ep_only = true [PocketPC MIB] signature = E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 ep_only = true [PocketPC SHA] signature = 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 ep_only = true [PowerBASIC/CC 4.0] signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03 ep_only = true [PowerBASIC/Win 8.00] signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 14 04 00 00 E9 19 02 ep_only = true [PrincessSandy v1.0 eMiNENCE Process Patcher Patch] signature = 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 ep_only = false [Private exe Protector V1.8X-V1.9X -> SetiSoft Team] signature = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 ep_only = false [PseudoSigner 0.2 [Armadillo 3.00] --> Anorganix] signature = 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 ep_only = true [PseudoSigner 0.2 [CodeSafe 2.0] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 ep_only = true [PseudoSigner 0.2 [DEF 1.0] --> Anorganix] signature = BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 ep_only = true [PseudoSigner 0.2 [DxPack 1.0] --> Anorganix] signature = 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 ep_only = true [PseudoSigner 0.2 [ExeSmasher] --> Anorganix] signature = 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B ep_only = true [PseudoSigner 0.2 [Gleam 1.00] --> Anorganix] signature = 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF ep_only = true [PseudoSigner 0.2 [JDPack 1.x / JDProtect 0.9] --> Anorganix] signature = 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 ep_only = true [PseudoSigner 0.2 [PESHiELD 0.25] --> Anorganix] signature = 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC ep_only = true [PseudoSigner 0.2 [ZCode 1.01] --> Anorganix] signature = E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 ep_only = true [R!SC's Process Patcher v1.4] signature = E8 E1 01 00 00 80 38 22 75 13 80 38 00 74 2E 80 38 20 75 06 80 78 FF 22 74 18 40 EB ED 80 38 00 74 1B EB 19 40 80 78 FF 20 75 F9 80 38 00 74 0D EB 0B 40 80 38 00 74 05 80 38 22 74 00 8B F8 B8 04 60 40 00 68 00 20 40 00 C7 05 A2 20 40 00 44 00 00 00 68 92 ep_only = false [R!SC's Process Patcher v1.5.1] signature = 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 ep_only = false [RJcrush v1.00] signature = 06 FC 8C C8 BA ?? ?? 03 D0 52 BA ?? ?? 52 BA ?? ?? 03 C2 8B D8 05 ?? ?? 8E DB 8E C0 33 F6 33 FF B9 ep_only = true [RLPack -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 3A 0A ep_only = true [RLPack -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 CD 09 00 00 89 85 ?? ?? ?? ?? EB 14 60 FF B5 14 0A ep_only = true [RLPack 1.17+] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 ep_only = true [RLPack Full Edition 1.17 DLL [LZMA] -> Ap0x] signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 ep_only = true [RLPack FullEdition V1.1X -> ap0x * Sign.By.fly] signature = 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 ep_only = false [RLPack v0.7.3beta -> ap0x (h)] signature = 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 ep_only = false [RLPack V1.11 -> ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB ep_only = true [SecuPack v1.5] signature = 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 ep_only = true [Setup Factory v6.0.0.3 Setup Launcher] signature = 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 ep_only = false [Shrinker v3.4] signature = 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF ep_only = true [SimplePack 1.11 Method 2(NT) -> bagie[TMX] (h)] signature = 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB ep_only = true [SimplePack V1.0X -> bagie] signature = 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 ep_only = true [SimplePack V1.X (Method1) -> bagie] signature = 60 E8 00 00 00 00 5B 8D 5B FA BD ?? ?? ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 ep_only = true [SoftProtect -> SoftProtect.by.ru] signature = EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 60 E8 03 ?? ?? ?? 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 EB 01 83 9C EB 01 D5 EB 08 35 9D EB 01 89 EB 03 0B EB F7 E8 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 59 83 01 01 80 39 5C ep_only = true [SPEC b3] signature = 5B 53 50 45 43 5D E8 ?? ?? ?? ?? 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD ep_only = true [Special EXE Password Protector v1.0] signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 ep_only = true [Stone's PE Encryptor v1.0] signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 ep_only = true [Stone's PE Encryptor v1.13] signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 ep_only = true [SVK-Protector v1.051] signature = 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB ep_only = true [tElock v0.41x] signature = 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 ep_only = true [tElock v0.42] signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 ep_only = true [tElock v0.4x - v0.5x] signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 ep_only = true [tElock v0.51] signature = C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 ep_only = true [tElock v0.99 Special Build -> heXer & forgot] signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 ep_only = true [Themida/WinLicense V1.0.0.0-V1.8.0.0-> Oreans Technologies] signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? E8 00 00 00 00 ep_only = true [Themida/WinLicense V1.8.0.2 + -> Oreans Technologies] signature = B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 ep_only = true [Thinstall 2.5 -> ??? (h)] signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 ep_only = true [Trainer Creation Kit v5 Trainer] signature = 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 ep_only = false [Upack 0.22 - 0.23 beta -> Dwing] signature = ?? ?? ?? ?? ?? ?? ?? AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 ep_only = true [UPack v0.11] signature = BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 ep_only = false [Upack v0.37 beta -> Dwing] signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ep_only = true [Upack v0.38 beta -> Dwing] signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ep_only = true [Upack v0.399 -> Dwing] signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ep_only = true [UPX + ECLiPSE layer] signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 ep_only = true [UPX Alternative stub] signature = 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B ep_only = true [UPX Inliner v1.0 by GPcH] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D5 FE FF FF 8B 06 83 F8 00 74 11 8D B5 E1 FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 B1 FE FF FF 2B D0 89 95 B1 FE FF FF 01 95 C9 FE FF FF 8D B5 E5 FE FF FF 01 ep_only = false [UPX Modified stub] signature = 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF ep_only = true [UPX v0.51] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90 ep_only = true [UPX v0.62] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 ep_only = true [UPX v0.70] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 EC 01 ?? ?? 83 CD FF 31 DB EB 07 90 8A 06 46 88 07 47 01 DB 75 07 ep_only = true [UPX v0.81 - v0.84 Modified] signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 EF ep_only = true [UPX v0.89.6 - v1.02 / v1.05 - v1.22 Modified] signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB ?? ED B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ep_only = true [UPX v1.03 - v1.04 Modified] signature = 01 DB ?? 07 8B 1E 83 EE FC 11 DB 8A 07 ?? EB B8 01 00 00 00 01 DB ?? 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF ep_only = true [UPX-Shit v0.1 -> 500mhz] signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 ep_only = true [UPX-Shit v0.1 -> 500mhz] signature = E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 ep_only = true [VcAsm Protector -> VcAsm] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 ep_only = true [VcAsm Protector V1.0X-> VcAsm] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 ep_only = true [VIRUS - I-Worm.Bagle] signature = 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 ep_only = false [VProtector V1.0 [Build 2004.12.13] test! -> vcasm] signature = 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 ep_only = true [VProtector V1.0A -> vcasm] signature = 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 ep_only = true [VProtector V1.0B -> vcasm] signature = 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 ep_only = true [VProtector V1.0D -> vcasm] signature = 55 8B EC 6A FF 68 CA 31 41 00 68 06 32 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 ep_only = true [VProtector V1.1 -> vcasm] signature = B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 ep_only = true [VProtector V1.1A -> vcasm] signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 ep_only = true [Watcom C/C++] signature = E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 ep_only = false [Winkript v1.0] signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 ep_only = true [WinKript v1.0 -> Mr. Crimson (h)] signature = 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 83 C0 08 EB D5 61 E9 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ep_only = true [WinUpack v0.39 final -> By Dwing (c)2005 (h1)] signature = BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ep_only = true [WinZip 32-bit SFX v6.x module] signature = FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 ep_only = true [WinZip 32-bit SFX v8.x module] signature = 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 ep_only = true [XJ / XPAL -> LiNSoN] signature = 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C ep_only = true [yC v1.3 by Ashkbiz Danehkar] signature = 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC ep_only = false [ZipWorxSecureEXE v2.5 -> ZipWORX Technologies LLC (h)] signature = E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 ep_only = true [[MSLRH] v0.1 -> emadicius] signature = 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 ep_only = false [[MSLRH] v0.31a] signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F ep_only = false [[MSLRH] v0.32a -> emadicius] signature = EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 ep_only = false [[MSLRH] v0.32a -> emadicius (h)] signature = E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 ep_only = false [* PseudoSigner 0.1 --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 ep_only = true [* PseudoSigner 0.1 --> Anorganix] signature = 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 ep_only = true [* PseudoSigner 0.1 [32Lite 0.03] --> Anorganix] signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 ep_only = true [* PseudoSigner 0.1 [32Lite 0.03] --> Anorganix] signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 ep_only = true [* PseudoSigner 0.1 [ASProtect] --> Anorganix] signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 ep_only = true [* PseudoSigner 0.1 [ASProtect] --> Anorganix] signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 ep_only = true [* PseudoSigner 0.1 [CD-Cops II] --> Anorganix] signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 ep_only = true [* PseudoSigner 0.1 [CD-Cops II] --> Anorganix] signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 ep_only = true [* PseudoSigner 0.1 [Code-Lock] --> Anorganix] signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 ep_only = true [* PseudoSigner 0.1 [Code-Lock] --> Anorganix] signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 ep_only = true [* PseudoSigner 0.1 [Crunch/PE Heuristic] --> Anorganix] signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [Crunch/PE Heuristic] --> Anorganix] signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [FSG 1.31] --> Anorganix] signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 ep_only = true [* PseudoSigner 0.1 [FSG 1.31] --> Anorganix] signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 ep_only = true [* PseudoSigner 0.1 [LCC Win32 1.x] --> Anorganix] signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 ep_only = true [* PseudoSigner 0.1 [LCC Win32 1.x] --> Anorganix] signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 ep_only = true [* PseudoSigner 0.1 [LTC 1.3] --> Anorganix] signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 ep_only = true [* PseudoSigner 0.1 [LTC 1.3] --> Anorganix] signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix] signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix] signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] --> Anorganix] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 ep_only = true [* PseudoSigner 0.1 [Microsoft Visual C++ 5.0+ (MFC)] --> Anorganix] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 ep_only = true [* PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] --> Anorganix] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [NorthStar PE Shrinker 1.3] --> Anorganix] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [PE Pack 0.99] --> Anorganix] signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 ep_only = true [* PseudoSigner 0.1 [PE Pack 0.99] --> Anorganix] signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 ep_only = true [* PseudoSigner 0.1 [PE Protect 0.9] --> Anorganix] signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 ep_only = true [* PseudoSigner 0.1 [PE Protect 0.9] --> Anorganix] signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 ep_only = true [* PseudoSigner 0.1 [PENightMare 2 Beta] --> Anorganix] signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 ep_only = true [* PseudoSigner 0.1 [PENightMare 2 Beta] --> Anorganix] signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 ep_only = true [* PseudoSigner 0.1 [PEX 0.99] --> Anorganix] signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 ep_only = true [* PseudoSigner 0.1 [PEX 0.99] --> Anorganix] signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 ep_only = true [* PseudoSigner 0.1 [REALBasic] --> Anorganix] signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 ep_only = true [* PseudoSigner 0.1 [REALBasic] --> Anorganix] signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 ep_only = true [* PseudoSigner 0.1 [UPX 0.6] --> Anorganix] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [UPX 0.6] --> Anorganix] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 ep_only = true [* PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix] signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 ep_only = true [* PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix] signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 ep_only = true [* PseudoSigner 0.2 [ASProtect] --> Anorganix] signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD ep_only = true [* PseudoSigner 0.2 [Borland C++ 1999] --> Anorganix] signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 ep_only = true [* PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix] signature = 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 ep_only = true [* PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix] signature = 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 ep_only = true [* PseudoSigner 0.2 [Code-Lock] --> Anorganix] signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B ep_only = true [* PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix] signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 ep_only = true [* PseudoSigner 0.2 [FSG 1.31] --> Anorganix] signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 ep_only = true [* PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix] signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 ep_only = true [* PseudoSigner 0.2 [LCC Win32 DLL] --> Anorganix] signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ep_only = true [* PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix] signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD ep_only = true [* PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] --> Anorganix] signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ep_only = true [* PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 ep_only = true [* PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix] signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A ep_only = true [* PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix] signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A ep_only = true [* PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix] signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 ep_only = true [* PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix] signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A ep_only = true [* PseudoSigner 0.2 [PEX 0.99] --> Anorganix] signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 ep_only = true [* PseudoSigner 0.2 [REALBasic] --> Anorganix] signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 ep_only = true [* PseudoSigner 0.2 [UPX 0.6] --> Anorganix] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 ep_only = true [* PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix] signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = false [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5A 5D 5F 5B 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5E 5B 9D 58 5B 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 5A 5E 5D 5B 58 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 5F 5B 5D 58 5A 9D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 59 58 5F 5D 58 5B 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 58 5F 5D 5B 5A 59 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 59 5A 58 9D 5D 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 58 5D 5F 9D 5A 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 9D 5E 5D 58 5F 5A 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5F 59 59 5A 5E 5B 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 5B 9D 59 5A 5D 58 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5F 58 5A 5E 9D 5D 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 59 5B 5A 58 5F 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5A 5F 5E 5D 5D 58 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5F 5B 5A 9D 5E 5D 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5E 9D 59 5A 5A 5B 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5D 5A 5B 58 5F 5E 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 5D 58 5B 58 59 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 58 5B 5F 59 5D 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 59 5E 5F 5D 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5F 9D 5D 5B 58 5E 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 58 59 5B 5A 5F 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 5E 58 5B 9D 59 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5A 5B 59 5D 9D 59 5E 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 9D 5A 5D 5F 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5F 58 5E 5D 9D 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5B 5E 5B 5D 59 5A 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5E 5E 59 9D 5D 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5F 9D 59 5D 5A 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 9D 5D 58 5B 5A 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 5D 59 9D 5B 58 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5E 58 5D 5B 59 9D 5A 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 5F 58 58 5D 59 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5A 59 5D 5B 58 5F 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 59 5D 9D 58 5B 5A 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5F 5B 59 5D 58 9D 5A 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5D 5A 5F 58 59 58 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 5A 59 5D 58 5F 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 58 5F 5F 5B 5A 59 5D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5B 5D 5F 5E 5A 5F 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5B 5D 5E 5B 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 59 5A 59 5E 5D 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5A 5F 5B 58 59 5D 9D 5D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5F 5B 5B 5D 58 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5A 9D 5E 58 5F 5D 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 59 5E 5D 5F 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5F 5D 5E 5B 58 59 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 5E 58 59 5B 5F 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 9D 5A 5F 5D 5A 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 5A 5F 59 5D 5D 5E 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5B 59 5F 5A 5E 5D 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5B 5E 5F 9D 5D 5F 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5F 5B 5D 58 5A 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5E 5A 58 5F 5D 5B 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 5B 59 5D 5A 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5F 5E 59 9D 5D 5B 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 58 5A 5E 5F 5B 5B 5D 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 59 59 5A 5B 9D 5E 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 9D 5A 5D 5F 58 5B 59 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5F 58 5B 5A 59 5D 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 9D 5A 59 5E 5D 5F 5B 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5B 9D 5D 5A 5E 58 5A 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5A 59 5D 9D 5E 58 5B 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5D 5A 58 9D 5B 5E 5F 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 5D 5E 5F 58 9D 5A 58 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5E 5F 5D 5A 9D 58 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 9D 5B 5F 5E 5D 58 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5A 5F 58 9D 5E 5B 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 59 9D 5A 5E 58 5B 5F 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 9D 58 59 58 5E 5D 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5F 5B 58 5A 9D 58 5E 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5F 5D 5A 5B 58 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 5E 5A 5F 5B 9D 5B 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5D 59 5D 5F 58 5E 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 59 5E 5D 5F 9D 5E 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 58 5B 59 5E 5D 5F 5F 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5B 58 9D 59 5D 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 58 5D 5E 5D 5F 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5F 5E 5D 5A 5B 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5F 5D 9D 5E 5B 5A 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5F 5E 58 5D 59 5D 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5F 58 5D 5E 5D 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 5B 5D 5E 58 5F 59 5D 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5B 5D 5E 5A 5E 59 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 9D 5F 59 5A 5B 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5F 58 5A 5E 5D 5E 5B 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5D 5A 5F 5E 58 9D 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5A 5B 9D 58 5E 5F 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 9D 5B 5E 5A 5D 5F 5F 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5A 59 5E 9D 5E 5D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 9D 5A 5B 59 58 5E 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5B 5D 58 5E 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5F 5A 59 5B 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5D 5B 5F 5E 59 58 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5B 5A 58 5D 59 5F 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 5B 9D 58 5E 59 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 9D 58 5F 5E 5E 59 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 59 9D 5D 5A 5E 58 5F 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 58 9D 59 5A 5F 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5E 58 5A 9D 5F 59 5B 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 9D 5F 5D 58 5A 5E 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5E 59 5F 5D 5D 9D 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5F 5E 58 9D 59 5A 5B 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 58 5D 5F 9D 5A 5E 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5E 58 9D 5D 58 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 9D 5B 5D 5E 5F 5A 59 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 58 5D 5B 9D 5F 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5D 5F 5E 5A 5B 9D 5B 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 9D 5E 5F 5A 58 5D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 58 5F 9D 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 5E 59 5A 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 59 5E 5D 5B 9D 5F 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5F 5B 5F 5D 59 5E 9D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5E 5A 59 5D 59 9D 5F 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5B 5E 5D 9D 5B 59 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5B 5D 5A 5E 9D 5F 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 59 5E 5D 5D 5F 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5E 5A 58 5F 58 59 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 59 5F 5E 58 9D 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 59 9D 5D 58 5B 5E 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 58 5A 5B 5D 9D 5F 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 5E 5A 5E 59 5F 5D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5E 5D 9D 5B 58 5F 59 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 59 5D 5E 58 5F 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5B 58 9D 5E 5F 5D 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 58 9D 59 5F 5E 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5D 58 5F 5B 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 5B 5F 5B 58 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 8D 76 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 66 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 8D 76 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 C6 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5D 5A 5A 5F 5B 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 59 5B 59 5A 5D 9D 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 59 5E 5A 58 5B 5F 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5D 5F 5E 9D 58 5A 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 59 5D 5F 5B 5E 9D 58 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5B 59 5D 9D 5E 5F 5A 5D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5E 5D 5B 9D 59 58 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5F 5E 9D 5F 59 5A 5D 58 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 9D 5B 59 5E 5B 5D 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 58 5D 5E 5F 9D 5A 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 9D 5F 5D 5E 5B 59 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5A 5F 58 5B 59 5B 5D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 58 5A 5F 5B 5E 5D 5D 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5F 5E 59 5E 5D 5B 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 58 5A 9D 5D 59 5B 59 5E 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 58 5B 5F 5A 59 5D 9D 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5E 9D 58 5B 5F 59 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5D 58 59 9D 5E 5A 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5E 59 5D 5D 58 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 58 5A 5D 5B 9D 59 5F 5F 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 9D 5D 59 5F 5E 58 58 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5F 58 5B 5A 5A 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5F 5A 59 58 5D 9D 5E 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5A 5F 59 5B 5D 58 5B 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5F 5E 5E 5A 5D 5B 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5F 5D 5B 5A 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 59 5A 5B 58 5B 5F 5E 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 59 59 58 5B 5E 5F 5A 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5E 5E 5A 58 5D 9D 59 5F 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5F 5E 58 9D 5D 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5A 5B 5E 58 5D 5F 9D 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 5E 9D 58 5D 5F 5A 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5B 5E 5A 5F 58 5D 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5D 5F 5A 5B 5E 58 9D 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 5F 58 59 5B 5D 5E 9D 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5E 5B 59 5D 5F 9D 5A 58 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5B 5A 5F 5E 5D 58 58 59 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5B 5E 59 5D 9D 5F 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 59 5D 5B 5F 58 5E 5A 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5B 9D 5A 5F 59 58 5D 5E 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5F 5A 5B 5E 5D 5B 9D 59 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 9D 58 5F 5E 59 5D 5D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5F 5D 58 59 9D 5E 5B 5A 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5E 5D 5A 5F 59 58 9D 5B 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 5D 5D 58 5F 59 5B 9D 5E 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 59 5F 59 58 9D 5E 5D 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 46 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5F 5D 5B 58 5D 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 9D 5D 5B 59 5A 58 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5F 58 59 9D 5F 5B 5D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 59 58 5F 5A 5E 5B 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 9D 58 5B 5D 5A 5A 5E 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5A 58 5E 5D 5B 9D 59 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 58 5F 5B 5D 5D 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 58 5F 5D 5A 59 9D 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 58 5A 59 5F 9D 5E 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 5B 5A 9D 58 5A 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5D 58 59 58 9D 5A 5B 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 5A 59 9D 5F 5D 5B 58 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5D 5E 59 5B 58 5B 5F 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 59 5D 5A 5B 5B 5E 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 9D 5F 58 5E 5A 5B 59 5D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5B 5D 5E 59 5F 58 9D 58 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 9D 5B 59 5D 5F 58 5E 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 8D 76 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 8D 76 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 46 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 83 ED 04 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 98 98 46 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5F 5D 9D 58 59 59 5B 5E C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5A 5B 5F 5E 9D 58 5D 59 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 5A 59 5F 58 5E 9D 5D 5F 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5E 59 5A 5B 9D 5F 58 58 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 9D 59 5F 5D 58 5E 5A 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5D 5B 59 5F 5E 9D 5D 5A 58 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 59 5B 58 5A 5B 5F 5E 9D 5D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 9D 5F 5B 5A 5B 58 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5D 5E 5B 5F 58 5E 59 5A 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 5E 5F 5D 5A 58 5B 9D 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A 58 59 5E 5D 5F 5B 9D 5A 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 9D 5B 5D 5A 5F 59 5E 58 59 C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B 5F 5F 5B 58 59 5D 5A 5E 9D C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 83 C5 08 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 36 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 55 04 F7 D0 F7 D2 21 D0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E8 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 4D 04 83 ED 02 D3 E0 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8A 55 04 83 C5 06 36 88 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 00 83 C5 02 8A 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F7 55 00 66 8B 45 00 83 ED 02 66 21 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 83 C5 02 66 36 8B 00 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 83 ED 02 00 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 8A 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 06 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E0 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 8D 76 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 EE FC 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 66 8B 55 04 83 C5 06 66 36 89 10 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 C6 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 C6 04 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 00 8A 4D 02 83 ED 02 D2 E8 66 89 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 EE FC E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 89 45 00 83 C6 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 06 83 ED 04 83 EE FC 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 5A 58 5E 5D 5B 5B 9D 59 5F C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 8D 76 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 46 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 ED 02 66 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 ep_only = false [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 46 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 46 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 C6 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 46 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 46 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 EE FE 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 83 C6 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 C6 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 ED 04 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 EE FE 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 83 C6 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 C6 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 8D 76 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 EE FE 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 83 ED 02 8D 76 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 83 EE FE 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 55 00 83 C5 04 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 E0 3C 8B 14 07 83 ED 04 89 55 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5F 58 5A 9D 5D 5E 5E 5B C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 59 5E 5B 5F 5B 9D 58 5D 5A C3 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 45 00 83 ED 02 66 01 45 04 9C 8F 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 98 8D 76 02 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 EE FE 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 C6 02 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 C6 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 EE FE 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 83 C6 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 8D 76 02 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 98 83 ED 04 89 45 00 83 EE FE E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 EE FE 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 83 C6 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 66 89 45 00 8D 76 02 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 8D 76 02 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 EE FE 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 83 ED 02 8D 76 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 83 C6 01 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 ED 02 66 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 8D 76 01 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 EE FF 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 8D 76 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 C6 01 66 8B 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 8D 76 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 83 EE FF 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8D 76 01 66 8B 55 00 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 8A 04 07 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 83 EE FF 66 98 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 ED 02 66 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 83 C6 01 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 8A 04 07 46 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 88 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 8D 76 01 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 46 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 04 07 83 EE FF 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 EE FF 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 83 C6 01 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C5 02 66 89 14 07 8D 76 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 C6 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 C6 01 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 46 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 8D 76 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 EE FF E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 89 45 00 83 C6 01 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 98 83 ED 04 83 EE FF 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 8D 76 01 83 C5 02 66 89 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 8B 55 00 83 EE FF 83 C5 02 88 14 07 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 EE FF 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 83 C6 01 98 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 66 98 46 98 83 ED 04 89 45 00 E9 ep_only = true [.BJFnt v1.3] signature = EB ?? 3A ?? ?? 1E EB ?? CD 20 9C EB ?? CD 20 EB ?? CD 20 60 EB ep_only = true [624 (Six to Four) v1.0] signature = 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED ep_only = true [Ady`s Glue v0.10] signature = 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F ep_only = true [AHPack 0.1 -> FEUERRADER] signature = 60 68 54 ?? ?? 00 B8 48 ?? ?? 00 FF 10 68 B3 ?? ?? 00 50 B8 44 ?? ?? 00 FF 10 68 00 ep_only = true [Alex Protector v1.0 -> Alex] signature = 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B ep_only = true [Alloy v1.x.2000] signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B ep_only = true [Anticrack Software Protector v1.09 (ACProtect)] signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 04 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ep_only = true [aPack v0.82] signature = 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB ep_only = true [Armadillo v2.50b3] signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 ep_only = true [Armadillo v2.52] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 ep_only = true [Armadillo v2.52 beta2] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? B0 ?? ?? ?? ?? 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 24 ep_only = true [Armadillo v2.53] signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC ep_only = true [Armadillo v2.60] signature = 55 8B EC 6A FF 68 D0 ?? ?? ?? 68 34 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 68 ?? ?? ?? 33 D2 8A D4 89 15 84 ep_only = true [Armadillo v2.60a] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 94 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 B4 ep_only = true [Armadillo v2.60b1] signature = 55 8B EC 6A FF 68 50 ?? ?? ?? 68 74 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 FC ep_only = true [Armadillo v2.60b2] signature = 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C ep_only = true [Armadillo v2.60c] signature = 55 8B EC 6A FF 68 40 ?? ?? ?? 68 F4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 F4 ep_only = true [Armadillo v2.61] signature = 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C ep_only = true [Armadillo v2.65b1] signature = 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 ep_only = true [Armadillo v2.75a] signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 ep_only = true [Armadillo v2.85] signature = 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 ep_only = true [Armadillo v2.xx (CopyMem II)] signature = 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82 ep_only = true [ASPack v1.08.03] signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E ep_only = true [ASPack v1.08.x] signature = 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A ep_only = true [ASPack v2.11b] signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 ep_only = true [ASPack v2.11c] signature = 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 59 04 00 00 ep_only = true [ASPack v2.12] signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ep_only = true [ASProtect v1.2 -> Alexey Solodovnikov (h1)] signature = 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 ep_only = false [ASProtect V2.X DLL -> Alexey Solodovnikov] signature = 60 E8 03 00 00 00 E9 ?? ?? 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ?? ?? ?? ?? 03 DD ep_only = true [AVPACK v1.20] signature = 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB ep_only = true [BamBam v0.01] signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 ep_only = false [BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch] signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2 ep_only = true [BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch] signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 ep_only = true [BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch] signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 ep_only = true [BeRoEXEPacker v1.00 (DLL) -> BeRo / Farbrausch] signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 ep_only = true [BeRoEXEPacker V1.00 -> BeRo] signature = BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 ep_only = false [BeRoEXEPacker v1.00 -> BeRo / Farbrausch] signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 BA ?? ?? ?? ?? 8D B2 ep_only = true [BeRoEXEPacker v1.00 -> BeRo / Farbrausch] signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 ep_only = true [BeRoEXEPacker v1.00 DLL [LZMA] -> BeRo / Farbrausch] signature = 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 ep_only = true [BeRoEXEPacker v1.00 [LZMA] -> BeRo / Farbrausch] signature = 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 04 00 00 00 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 ep_only = true [CA Visual Objects 2.0 - 2.5] signature = 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ep_only = true [CAN2EXE v0.01] signature = 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 ep_only = true [ChinaProtect -> dummy * Sign.By.fly] signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 ep_only = false [CodeCrypt v0.164] signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 ep_only = true [COMPACK v4.5 (2)] signature = BE ?? ?? E8 ?? ?? 5D 83 ?? ?? 55 50 53 51 52 0E 07 0E 1F 8B CE ep_only = true [COMPACK v5.1] signature = BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 ep_only = true [CopyControl v3.03] signature = CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C ep_only = true [Cracked by AutoHack (1)] signature = FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC ep_only = true [Cracked by Autohack (2)] signature = 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 ep_only = true [Crunch/PE] signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ep_only = true [Crunch/PE v2.0.x.x] signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 55 BB ?? ?? ?? ?? 03 DD 53 64 67 FF 36 ?? ?? 64 67 89 26 ep_only = true [Crunch/PE v4.0] signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 ep_only = false [Crypto-Lock v2.02 (Eng) -> Ryan Thian] signature = 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 ep_only = true [DAEMON Protect v0.6.7] signature = 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 ep_only = true [DBPE v1.53] signature = 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA ep_only = true [DBPE v2.10] signature = EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C ep_only = true [DBPE v2.33] signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 ep_only = true [DEF v1.0] signature = BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 ep_only = false [DIET v1.00, v1.00d] signature = BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC ep_only = true [DIET v1.02b, v1.10a, v1.20] signature = BE ?? ?? BF ?? ?? B9 ?? ?? 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC ep_only = true [Ding Boy's PE-lock Phantasm v1.5b3] signature = 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 ep_only = true [DOS32 v.3.3 DOS-Extender and Loader] signature = 0E 1F FC 9C 5B 8B C3 80 F4 ?? 50 9D 9C 58 3A E7 75 ?? BA ?? ?? B4 09 CD 21 B4 4C CD 21 ep_only = true [Dropper Creator V0.1 -> Conflict] signature = 60 E8 00 00 00 00 5D 8D 05 ?? ?? ?? ?? 29 C5 8D 85 ?? ?? ?? ?? 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 ep_only = false [dUP v2.x Patcher --> www.diablo2oo2.cjb.net] signature = 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F ep_only = false [dUP2 -> diablo2oo2] signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? A2 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 3C 01 75 19 BE ?? ?? ?? ?? 68 00 02 00 00 56 68 ep_only = true [EEXE Version 1.12] signature = B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 ep_only = true [ENIGMA Protector V1.12-> Sukhov Vladimir] signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ED ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 ep_only = true [Exact Audio Copy] signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ep_only = true [EXE Packer v7.0 by TurboPower Software] signature = 1E 06 8C C3 83 ?? ?? 2E ?? ?? ?? ?? B9 ?? ?? 8C C8 8E D8 8B F1 4E 8B FE ep_only = true [EXE Stealth v1.1] signature = 60 E8 00 00 00 00 5D 81 ED FB 1D 40 00 B9 7B 09 00 00 8B F7 AC ep_only = true [EXE2COM (regular)] signature = E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D ep_only = true [EXE2COM (With CRC check)] signature = B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3 ep_only = true [EXE32Pack v1.36] signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 ep_only = true [EXE32Pack v1.37] signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 ep_only = true [EXE32Pack v1.38] signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 ep_only = true [EXE32Pack v1.39] signature = 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 ep_only = true [EXECryptor 2.1.17 -> Strongbit/SoftComplete Development (h)] signature = BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 ep_only = false [EXECryptor 2.2.4 -> Strongbit/SoftComplete Development (h2)] signature = E8 F7 FE FF FF 05 ?? ?? 00 00 FF E0 E8 EB FE FF FF 05 ?? ?? 00 00 FF E0 E8 ?? 00 00 00 ep_only = true [EXECryptor 2.x -> SoftComplete Developement] signature = A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF ep_only = false [ExeJoiner V1.0 -> Yoda f2f] signature = 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 ep_only = true [EXEPACK v4.05, v4.06] signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 ep_only = true [EXERefactor V0.1 -> random] signature = 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E ep_only = true [ExeSmasher vx.x] signature = 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 ep_only = true [ExeTools COM2EXE] signature = E8 ?? ?? 5D 83 ED ?? 8C DA 2E 89 96 ?? ?? 83 C2 ?? 8E DA 8E C2 2E 01 96 ?? ?? 60 ep_only = true [eXPressor 1.2 -> CGSoftLabs] signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E ep_only = true [eXPressor 1.2.0 Beta PE Packer] signature = 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 EB ?? 45 78 50 72 2D 76 2E 31 2E 32 2E 2E ep_only = true [eXPressor v1.2.0b] signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 ep_only = false [eXPressor v1.3 -> CGSoftLabs (h)] signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 ep_only = true [eXPressor v1.4 -> CGSoftLabs (h)] signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 ep_only = true [E游地带-> 月黑风高] signature = 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 ?? ?? ?? ?? 0F 6E C0 B8 ?? ?? ?? ?? 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 ?? ?? ?? ?? ?? FF E0 ep_only = true [FACRYPT v1.0] signature = B9 ?? ?? B3 ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 49 43 32 E4 03 D0 E3 ep_only = true [Feokt] signature = 89 25 A8 11 40 00 BF ?? ?? ?? 00 31 C0 B9 ?? ?? ?? 00 29 F9 FC F3 AA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ep_only = true [FreeBasic 0.14] signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D ep_only = true [FSG v1.1] signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 ep_only = true [FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX] signature = 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 ep_only = true [FSG v1.10 (Eng) -> bart/xt -> WinRAR-SFX] signature = EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland C++ 1999)] signature = EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland C++)] signature = 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] signature = EB 01 2E EB 02 A5 55 BB 80 ?? ?? 00 87 FE 8D 05 AA CE E0 63 EB 01 75 BA 5E CE E0 63 EB 02 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Borland C++)] signature = 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++ / ASM)] signature = EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)] signature = C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 ?? ?? 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi / Microsoft Visual C++)x] signature = 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Borland Delphi 2.0)] signature = EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32 / Microsoft Visual Basic)] signature = F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (MASM32 / TASM32)] signature = 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (MASM32)] signature = EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic / MASM32)] signature = EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual Basic 5.0 / 6.0)] signature = C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 4.x / LCC Win32 1.x)] signature = 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 5.0 / 6.0)] signature = 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0 / ASM)] signature = E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 ?? ?? ?? EB 02 CD 20 03 D3 8D 35 F4 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = F7 D8 40 49 EB 02 E0 0A 8D 35 80 ?? ?? ?? 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = 87 FE E8 02 00 00 00 98 CC 5F BB 80 ?? ?? 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / ASM)] signature = F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? ?? BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 ?? ?? 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 ?? ?? 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = EB 02 AB 35 EB 02 B5 C6 8D 05 80 ?? ?? 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = D1 E9 03 C0 68 80 ?? ?? 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = C1 CE 10 C1 F6 0F 68 00 ?? ?? 00 2B FA 5B 23 F9 8D 15 80 ?? ?? 00 E8 01 00 00 00 B6 5E 0B ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = EB 01 4D 83 F6 4C 68 80 ?? ?? 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 ep_only = true [FSG v1.33 (Eng) -> dulek/xt] signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF ep_only = true [FSG v2.0] signature = 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 ep_only = false [Fusion 1.0 -> jaNooNi] signature = 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 ep_only = true [GHF Protector (pack only) -> GPcH] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 00 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 ep_only = false [GHF Protector / GPcH] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 ep_only = true [HACKSTOP v1.10, v1.11] signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 ?? ?? 58 EB ep_only = true [HACKSTOP v1.11c] signature = B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB ep_only = true [HACKSTOP v1.13] signature = 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA ep_only = true [HASP HL Protection V1.X -> Aladdin] signature = 55 8B EC 53 56 57 60 8B C4 A3 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 15 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 04 E9 A5 00 00 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ep_only = true [HPA] signature = E8 ?? ?? 5E 8B D6 83 ?? ?? 83 ?? ?? 06 0E 1E 0E 1F 33 FF 8C D3 ep_only = true [Hying's PE-Armor 0.75.exe -> Hying [CCG] (h)] signature = 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 ep_only = false [hying's PEArmor V0.76 -> hying] signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A ?? E8 A3 00 00 00 ep_only = true [IMP-Packer 1.0 -> Mahdi Hezavehi [IMPOSTER] (h)] signature = 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 ep_only = false [IMPostor Pack 1.0 -> Mahdi Hezavehi] signature = BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 ep_only = true [Inno Setup Module] signature = 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 ep_only = true [Inno Setup Module v2.0.18] signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 ep_only = false [Inno Setup Module v3.0.4-beta/v3.0.6/v3.0.7] signature = 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C ep_only = false [iPB Protect 0.1.3 - 0.1.7 -> forgot] signature = 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 ep_only = true [JAM v2.11] signature = 50 06 16 07 BE ?? ?? 8B FE B9 ?? ?? FD FA F3 2E A5 FB 06 BD ?? ?? 55 CB ep_only = true [JDPack 2.x -> JDPack] signature = 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 ep_only = true [Krypton v0.3] signature = 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA ep_only = true [Krypton v0.4] signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 61 34 ?? ?? 2B 85 60 37 ?? ?? 83 E8 06 ep_only = true [Krypton v0.5] signature = 54 E8 ?? ?? ?? ?? 5D 8B C5 81 ED 71 44 ?? ?? 2B 85 64 60 ?? ?? EB 43 DF ep_only = true [kryptor 9] signature = 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 ep_only = true [LameCrypt v1.0] signature = 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 ep_only = true [LCC Win32 DLL] signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 ?? ?? ?? FF 75 10 FF 75 0C FF 75 08 A1 ep_only = true [LTC v1.3] signature = 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 ep_only = true [MASM32] signature = 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20 ep_only = true [Metrowerks CodeWarrior v2.0 (GUI)] signature = 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 ?? ?? 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ep_only = false [Mew 11 SE v1.2 (Eng) -> Northfox] signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ep_only = true [MicroJoiner 1.7 -> coban2k] signature = BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 ep_only = true [Microsoft C (1990/1992)] signature = B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 ep_only = true [Microsoft C++ (1990/1992)] signature = B8 00 30 CD 21 3C 03 73 ?? 0E 1F BA ?? ?? B4 09 CD 21 06 33 C0 50 CB ep_only = true [Microsoft Visual Basic v5.0] signature = ?? ?? ?? ?? ?? ?? ?? FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 ep_only = true [Microsoft Visual C++] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 ep_only = true [Microsoft Visual C++ 6.0 DLL] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 75 09 83 3D ?? ?? ?? ?? ?? EB 26 83 FE 01 74 05 83 FE 02 75 22 A1 ?? ?? ?? ?? 85 C0 74 09 57 56 53 FF D0 85 C0 74 0C 57 56 53 E8 15 FF FF FF 85 C0 75 04 33 C0 EB 4E ep_only = false [Microsoft Visual C++ 8.0] signature = 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 ep_only = true [Microsoft Visual C++ 8.0 [Debug]] signature = E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ep_only = true [Microsoft Visual C++ ?.?] signature = 83 ?? ?? 6A 00 FF 15 F8 10 0B B0 8D ?? ?? ?? 51 6A 08 6A 00 6A 00 68 ep_only = true [Microsoft Visual C++ DLL] signature = 53 B8 01 00 00 00 8B 5C 24 0C 56 57 85 DB 55 75 12 83 3D ?? ?? ?? ?? ?? 75 09 33 C0 ep_only = true [Microsoft Visual C++ v4.x] signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 ep_only = true [Microsoft Visual C++ v5.0] signature = 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57 ep_only = true [Microsoft Visual C++ v5.0/v6.0 (MFC)] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 ep_only = true [Microsoft Visual C++ v6.0] signature = 55 8B EC 83 EC 50 53 56 57 BE ?? ?? ?? ?? 8D 7D F4 A5 A5 66 A5 8B ep_only = true [Microsoft Visual C++ v6.0 (Debug Version)] signature = 55 8B EC 51 ?? ?? ?? 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [Microsoft Visual C++ v6.0 DLL] signature = 83 7C 24 08 01 75 09 8B 44 24 04 A3 ?? ?? 00 10 E8 8B FF FF FF ep_only = true [Microsoft Visual C++ v7.0] signature = 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 89 65 ?? 8B F4 89 3E 56 FF 15 ?? ?? ?? ?? 8B 4E ?? 89 0D ?? ?? ?? ?? 8B 46 ?? A3 ep_only = true [Microsoft Visual C++ v7.1 DLL] signature = 83 7C 24 08 01 75 ?? ?? ?? 24 04 50 A3 ?? ?? ?? 50 FF 15 00 10 ?? 50 33 C0 40 C2 0C 00 ep_only = true [Microsoft Visual C++ v7.1 EXE] signature = 6A ?? 68 ?? ?? ?? 01 E8 ?? ?? 00 00 66 81 3D 00 00 00 01 4D 5A 75 ?? A1 3C 00 00 01 ?? ?? 00 00 00 01 ep_only = true [Microsoft Visual C++ vx.x] signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 04 ep_only = true [Microsoft Visual C++ vx.x DLL] signature = ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ep_only = true [MingWin32 - Dev C++ v4.x (h)] signature = 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 89 E5 83 EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? 00 ep_only = true [MingWin32 GCC 3.x] signature = 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? 40 00 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [modified HACKSTOP v1.11f] signature = 52 B4 30 CD 21 52 FA ?? FB 3D ?? ?? EB ?? CD 20 0E 1F B4 09 E8 ep_only = true [MS Run-Time Library 1988 (04)] signature = 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB ep_only = true [MS Run-Time Library 1992 (11)] signature = B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5 ep_only = true [Nakedbind 1.0 -> nakedcrew] signature = 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 ep_only = true [Name of the Packer v1.0] signature = 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 ep_only = true [nBinder v3.6.1] signature = 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C 00 5C 6E 35 36 34 35 36 35 33 32 33 34 35 34 33 5F 6E 62 33 5C ep_only = false [NoodleCrypt v2.0] signature = EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 ep_only = true [North Star PE Shrinker 1.3 -> Liuxingping] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 ep_only = true [NsPack 1.4 by North Star (Liu Xing Ping)] signature = 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 ep_only = false [NSPack 3.x -> Liu Xing Ping] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 ep_only = true [NsPack v2.3 -> North Star (h)] signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD ep_only = false [NsPacK V3.0 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? ?? ?? 66 8B 06 66 83 F8 00 74 ep_only = true [NsPacK V3.1 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 ep_only = true [NsPacK V3.3 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74 ep_only = true [NsPacK V3.4-V3.5 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 01 0F 84 ep_only = true [NsPacK V3.6 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 83 38 01 0F 84 47 02 00 00 ep_only = true [NsPacK V3.7 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D 83 ED 07 8D ?? ?? ?? ?? ?? 80 39 01 0F ?? ?? ?? 00 00 ep_only = true [Nullsoft PIMP Install System v1.3x] signature = 55 8B EC 81 EC ?? ?? 00 00 56 57 6A ?? BE ?? ?? ?? ?? 59 8D BD ep_only = true [Nullsoft PiMP Install System v1.x] signature = 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 ?? ?? 40 00 50 56 FF 15 ?? ?? 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D ?? ?? 40 00 84 C0 74 ?? 3A C3 74 ep_only = false [Pack Master v1.0] signature = 60 E8 01 ?? ?? ?? E8 83 C4 04 E8 01 ?? ?? ?? E9 5D 81 ED D3 22 40 ?? E8 04 02 ?? ?? E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 ep_only = true [Packman 0.0.0.1 -> bubba] signature = 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ep_only = true [Packman v0.0.0.1] signature = 60 E8 00 00 00 00 58 8D A8 ?? ?? FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ep_only = true [Packman V1.0 -> Brandon LaCombe] signature = 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA ep_only = true [PACKWIN v1.01p] signature = 8C C0 FA 8E D0 BC ?? ?? FB 06 0E 1F 2E ?? ?? ?? ?? 8B F1 4E 8B FE 8C DB 2E ?? ?? ?? ?? 8E C3 FD F3 A4 53 B8 ?? ?? 50 CB ep_only = true [PassLock 2000 v1.0 (Eng) -> Moonlight-Software] signature = 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 ep_only = true [Password Protector (c) MiniSoft 1992] signature = 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA ep_only = true [PC Shrinker v0.71] signature = 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 ep_only = true [PC-Guard v3.03d, v3.05d] signature = 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 ep_only = true [PE Crypt 1.5 -> BitShape Software] signature = 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC ep_only = true [PE Diminisher v0.1] signature = 5D 8B D5 81 ED A2 30 40 ?? 2B 95 91 33 40 ?? 81 EA 0B ?? ?? ?? 89 95 9A 33 40 ?? 80 BD 99 ep_only = true [PE Intro v1.0] signature = 8B 04 24 9C 60 E8 ?? ?? ?? ?? 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 ?? ?? 0F 85 48 ep_only = true [PE Password v0.2 SMT/SMF] signature = E8 04 ?? ?? ?? 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF ?? ?? ?? ?? 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 ep_only = true [PE Protect v0.9] signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 ?? ?? ?? ?? 58 83 C0 07 C6 ?? C3 ep_only = true [PEBundle v0.2 - v2.0x] signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 ep_only = true [PEBundle v2.0b5 - v2.3] signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 01 AD ?? ?? ?? ?? 01 AD ep_only = true [PEBundle v2.44] signature = 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD ep_only = true [PEBundle v3.10] signature = 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD ?? ?? ?? ?? 40 00 01 ep_only = false [PeCompact 2.xx (Slim Loader) --> BitSum Technologies] signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 ep_only = true [PECompact v1.4x+] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 ep_only = true [PECompact v2.0 beta -> Jeremy Collake] signature = B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC 90 90 90 90 ep_only = true [PECompact v2.5 Retail (Slim Loader) -> Bitsum Technologies] signature = B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 ep_only = true [PECompact V2.X-> Bitsum Technologies] signature = B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 ep_only = true [PECompact v2.xx] signature = B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 ep_only = false [PECrc32 0.88 -> ZhouJinYu] signature = 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 ep_only = true [PEMangle] signature = 60 9C BE ?? ?? ?? ?? 8B FE B9 ?? ?? ?? ?? BB 44 52 4F 4C AD 33 C3 ep_only = true [PEncrypt v1.0] signature = 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 ep_only = true [PENightMare 2 Beta] signature = 60 E9 ?? ?? ?? ?? EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A ep_only = true [PESpin v0.3 (Eng) -> cyberbob] signature = EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 ep_only = true [PEtite v1.4] signature = ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC ep_only = true [PEtite v2.0] signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 18 8B CC 8D A0 54 BC ?? ?? 8B C3 8D 90 E0 15 ?? ?? 68 ep_only = true [PeX 0.99 -> bart^CrackPl] signature = E9 F5 ?? ?? ?? 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ep_only = true [PKLITE v1.50 (Device driver compression)] signature = B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB ep_only = true [PKLITE v2.00b] signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 ep_only = true [PKLITE v2.00b [extra]] signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EA ?? ?? ?? ?? F3 A5 C3 59 2D ?? ?? 8E D0 51 2D ?? ?? 50 80 ep_only = true [PKLITE32 v1.1] signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10 ep_only = true [Pksmart 1.0b] signature = BA ?? ?? 8C C8 8B C8 03 C2 81 ?? ?? ?? 51 B9 ?? ?? 51 1E 8C D3 ep_only = true [PMODE/W v.1.12, 1.16, 1.21, 1.33 DOS extender] signature = FC 16 07 BF ?? ?? 8B F7 57 B9 ?? ?? F3 A5 06 1E 07 1F 5F BE ?? ?? 06 0E A4 ep_only = true [PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-signed)] signature = 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 ep_only = false [PolyCryptor by SMT Version %v3.%v4] signature = EB ?? 28 50 6F 6C 79 53 63 72 79 70 74 20 ?? ?? ?? 20 62 79 20 53 4D 54 29 ep_only = true [PowerBASIC/CC 3.0x] signature = 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85 ep_only = true [PowerBASIC/Win 7.0x] signature = 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00 ep_only = true [Private exe Protector V2.0 -> SetiSoft Team] signature = 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 ep_only = false [PRO-PACK v2.08] signature = 8C D3 8E C3 8C CA 8E DA 8B 0E ?? ?? 8B F1 83 ?? ?? 8B FE D1 ?? FD F3 A5 53 ep_only = true [Program Protector XP v1.0] signature = E8 ?? ?? ?? ?? 58 83 D8 05 89 C3 81 C3 ?? ?? ?? ?? 8B 43 64 50 ep_only = true [Protection Plus vx.x] signature = 50 60 29 C0 64 FF 30 E8 ?? ?? ?? ?? 5D 83 ED 3C 89 E8 89 A5 14 ?? ?? ?? 2B 85 1C ?? ?? ?? 89 85 1C ?? ?? ?? 8D 85 27 03 ?? ?? 50 8B ?? 85 C0 0F 85 C0 ?? ?? ?? 8D BD 5B 03 ?? ?? 8D B5 43 03 ?? ?? E8 DD ?? ?? ?? 89 85 1F 03 ?? ?? 6A 40 68 ?? 10 ?? ?? 8B 85 ep_only = true [PseudoSigner 0.2 [.BJFNT 1.1b] --> Anorganix] signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 ep_only = true [PseudoSigner 0.2 [.BJFNT 1.2] --> Anorganix] signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 ep_only = true [PseudoSigner 0.2 [ASProtect] --> Anorganix] signature = 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD ep_only = true [PseudoSigner 0.2 [Borland C++ 1999] --> Anorganix] signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 ep_only = true [PseudoSigner 0.2 [Borland Delphi DLL] --> Anorganix] signature = 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 ep_only = true [PseudoSigner 0.2 [Borland Delphi Setup Module] --> Anorganix] signature = 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 ep_only = true [PseudoSigner 0.2 [Code-Lock] --> Anorganix] signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B ep_only = true [PseudoSigner 0.2 [Crunch/PE Heuristic] --> Anorganix] signature = 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 ep_only = true [PseudoSigner 0.2 [FSG 1.31] --> Anorganix] signature = BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 ep_only = true [PseudoSigner 0.2 [LCC Win32 1.x] --> Anorganix] signature = 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 ep_only = true [PseudoSigner 0.2 [LCC Win32 DLL] --> Anorganix] signature = 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ep_only = true [PseudoSigner 0.2 [Lockless Intro Pack] --> Anorganix] signature = 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD ep_only = true [PseudoSigner 0.2 [Microsoft Visual C++ 7.0 DLL] --> Anorganix] signature = 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 ep_only = true [PseudoSigner 0.2 [NorthStar PE Shrinker 1.3] --> Anorganix] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 ep_only = true [PseudoSigner 0.2 [PE Intro 1.0] --> Anorganix] signature = 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A ep_only = true [PseudoSigner 0.2 [PE Pack 0.99] --> Anorganix] signature = 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A ep_only = true [PseudoSigner 0.2 [PE Protect 0.9] --> Anorganix] signature = 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 ep_only = true [PseudoSigner 0.2 [PENightMare 2 Beta] --> Anorganix] signature = 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A ep_only = true [PseudoSigner 0.2 [PEX 0.99] --> Anorganix] signature = 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 ep_only = true [PseudoSigner 0.2 [REALBasic] --> Anorganix] signature = 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 ep_only = true [PseudoSigner 0.2 [UPX 0.6] --> Anorganix] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 ep_only = true [PseudoSigner 0.2 [Watcom C/C++ DLL] --> Anorganix] signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 ep_only = true [PUNiSHER V1.5-> FEUERRADER] signature = 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 ep_only = false [RatPacker (Glue) stub] signature = 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF ep_only = true [RCryptor v1.6x --> Vaska] signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? C3 ep_only = true [RCryptor v1.?? -> Vaska] signature = 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [RLPack -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 ?? ?? ?? ?? EB 03 ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 95 9B 0A ep_only = true [RLPack Full Edition 1.17 iBox [aPLib] -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 ep_only = true [RLPack Full Edition 1.17 iBox [LZMA] -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ep_only = true [RLPack Full Edition 1.17 [aPLib] -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 ep_only = true [RLPack Full Edition 1.17 [LZMA] -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ep_only = true [RLPack V1.12-V1.14 (LZMA 4.30) -> ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 60 ep_only = true [SCRAM! v0.8a1] signature = B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C ep_only = true [SCRAM! vC5] signature = B8 ?? ?? 50 9D 9C 58 25 ?? ?? 75 ?? BA ?? ?? B4 09 CD 21 CD 20 ep_only = true [Sentinel SuperPro (Automatic Protection) v6.4.0 -> Safenet] signature = 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 15 ep_only = true [Sentinel SuperPro (Automatic Protection) v6.4.1 -> Safenet] signature = A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 ep_only = true [Shegerd Dongle V4.78 -> MS.Co.] signature = E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C ep_only = true [ShellModify 0.1 -> pll621] signature = 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 ep_only = true [Shrink v2.0] signature = E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 ep_only = true [Shrinker v3.2] signature = 83 3D ?? ?? ?? ?? ?? 55 8B EC 56 57 75 65 68 00 01 ?? ?? E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 ?? ?? ?? ?? 85 F6 74 1D 68 FF ep_only = true [Shrinker v3.4] signature = BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B ep_only = true [Silicon Realms Install Stub] signature = 55 8B EC 6A FF 68 ?? 92 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D ?? ?? 40 00 C1 E1 08 03 CA 89 0D ?? ?? 40 00 C1 E8 10 A3 ep_only = false [Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE] signature = 60 B8 ?? ?? ?? 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 ep_only = true [Simple UPX Cryptor v30.4.2005 [One layer encryption] --> MANtiCORE] signature = 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 ep_only = true [SLVc0deProtector 0.60 -> SLV / ICU] signature = EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD ep_only = false [SoftComp 1.x -> BG Soft PT] signature = E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 ep_only = false [Software Compress V1.2 -> BG Software Protect Technologies] signature = E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 ep_only = true [Special EXE Pasword Protector v1.01 (Eng) -> Pavol Cerven] signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E ep_only = true [Stone's PE Encryptor v2.0] signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 ep_only = true [SVK-Protector v1.32] signature = 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 ep_only = true [Symantec C v4.00 + Libraries] signature = FA B8 ?? ?? DB E3 8E D8 8C 06 ?? ?? 8B D8 2B 1E ?? ?? 89 1E ?? ?? 26 ep_only = true [tElock 0.98 Special Build -> forgot & heXer] signature = E9 99 D7 FF FF 00 00 00 ?? ?? ?? ?? AA ?? ?? 00 00 00 00 00 00 00 00 00 CA ep_only = true [tElock 0.99 -> tE!] signature = E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ep_only = true [tElock v0.98 -> tHE EGOiSTE (h)] signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 ep_only = true [tElock v0.99] signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 ep_only = true [Themida -> Oreans Technologies 2004] signature = B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 ep_only = true [Themida 1.2.0.1 -> Oreans Technologies (h)] signature = 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 ep_only = false [Thinstall 2.4x - 2.5x -> Jitit Software] signature = 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? BD ?? ?? ?? ?? 03 E8 ep_only = true [TMT-Pascal v0.40] signature = 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 ep_only = true [Trivial173 by SMT/SMF] signature = EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 ep_only = true [Turbo C 1987] signature = FB 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA ep_only = true [Turbo C or Borland C++] signature = BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA ep_only = true [TXT2COM v2.06] signature = 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20 ep_only = true [UCEXE v2.3, v2.4] signature = 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB ep_only = true [UltraPro V1.0 -> SafeNet] signature = A1 ?? ?? ?? ?? 85 C0 0F 85 3B 06 00 00 55 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ep_only = true [unknown -> jac] signature = 55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3 ep_only = true [Unknown encryptor (1)] signature = EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF ep_only = true [Unknown packer (05)] signature = FA BB ?? ?? B9 ?? ?? 87 E5 87 27 03 E3 91 8A CB 80 E1 ?? D3 C4 91 33 E3 87 27 ep_only = true [Unknown packer (08)] signature = 8B C4 2D ?? ?? 24 00 8B F8 57 B9 ?? ?? BE ?? ?? F3 A5 FD C3 97 4F 4F ep_only = true [Unpacked BS-SFX Archive v1.9] signature = 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 ep_only = true [Upack 0.12 beta-->Dwing] signature = BE 48 01 40 00 AD ?? ?? ?? A5 ?? C0 33 C9 ?? ?? ?? ?? ?? ?? ?? F3 AB ?? ?? 0A ?? ?? ?? ?? AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B6 5F FF C1 ep_only = true [Upack v0.36 beta -> Dwing] signature = BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C ep_only = true [UPX 2.90 [LZMA] (Delphi stub) -> Markus Oberhumer, Laszlo Molnar & John Reiser] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 ep_only = true [UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 ep_only = true [UPX v0.60 - v0.61] signature = 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 E8 ep_only = true [UPX v0.71 - v0.72] signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 ep_only = true [UPX v0.89.6 - v1.02 / v1.05 -v1.24 -> Markus & Laszlo [overlay]] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75 ep_only = true [UPX V1.94 -> Markus Oberhumer & Laszlo Molnar & John Reiser] signature = FF D5 80 A7 ?? ?? ?? ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 ep_only = false [UPX V2.00-V2.90 -> Markus Oberhumer & Laszlo Molnar & John Reiser] signature = FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 ep_only = false [UPX-Shit v0.1 -> 500mhz] signature = E8 ?? ?? ?? ?? 5E 83 C6 ?? AD 89 C7 AD 89 C1 AD 30 07 47 E2 ?? AD FF E0 C3 ep_only = true [UPXcrypter -> archphase/NWC] signature = BF ?? ?? ?? 00 81 FF ?? ?? ?? 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 ?? ?? 00 FF E3 BE ?? ?? ?? 00 FF E6 00 00 00 00 ep_only = true [UPXFreak v0.1 (Borland Delphi) -> HMX0101] signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 00 ?? ?? ?? 00 03 00 00 00 ?? ?? ?? ?? 00 10 00 00 00 00 ?? ?? ?? ?? 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 24 ?? 00 ?? ?? ?? 00 ep_only = true [UPXShit 0.06] signature = B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF ep_only = true [VBOX v4.3 - v4.6] signature = 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 ep_only = false [Video-Lan-Client -> (UnknownCompiler)] signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [VMProtect 0.7x - 0.8 -> PolyTech] signature = 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D ep_only = false [Vx: ACME (Clonewar Mutant)] signature = FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE ep_only = true [Vx: ARCV.4] signature = E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 ep_only = true [Vx: August 16th (Iron Maiden)] signature = BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 ep_only = true [Vx: Backfont.900] signature = E8 ?? ?? B4 30 CD 21 3C 03 ?? ?? B8 ?? ?? BA ?? ?? CD 21 81 FA ?? ?? ?? ?? BA ?? ?? 8C C0 48 8E C0 8E D8 80 ?? ?? ?? 5A ?? ?? 03 ?? ?? ?? 40 8E D8 80 ?? ?? ?? 5A ?? ?? 83 ep_only = true [Vx: Doom.666] signature = E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 ep_only = true [Vx: Eddie.1028] signature = E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 ep_only = true [Vx: Eddie.1530] signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E ep_only = true [Vx: Eddie.1800] signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E ep_only = true [Vx: Eddie.2000] signature = E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 ?? ?? ?? B4 30 CD 21 ep_only = true [Vx: Einstein] signature = 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 ep_only = true [Vx: Gotcha.879] signature = E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 ep_only = true [Vx: Grazie.883] signature = 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 ep_only = true [Vx: GRUNT.4.Family] signature = E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 ep_only = true [Vx: Hafen.809] signature = E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D ep_only = true [Vx: Kuku.886] signature = 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 ep_only = true [Vx: Modification of Hi.924] signature = 50 53 51 52 1E 06 9C B8 21 35 CD 21 53 BB ?? ?? 26 ?? ?? 49 48 5B ep_only = true [Vx: Uddy.2617] signature = 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? 8C C8 8E D8 8C ?? ?? ?? 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? A1 ?? ?? A3 ?? ?? 8C C8 2B ?? ?? ?? 03 ?? ?? ?? A3 ?? ?? B8 AB 9C CD 2F 3D 76 98 ep_only = true [Vx: XRCV.1015] signature = E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B ep_only = true [W32.Jeefo (PE File Infector)] signature = 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 ep_only = true [WARNING -> TROJAN -> ADinjector] signature = 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E ep_only = true [WATCOM C/C++ 32 Run-Time System 1988-1995] signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 ep_only = true [WATCOM C/C++ DLL] signature = 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 ep_only = true [WebCops [DLL] -> LINK Data Security] signature = A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B ep_only = true [WebCops [EXE] -> LINK Data Security] signature = EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 ep_only = true [Wise Installer Stub] signature = 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? 40 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 80 ?? 20 ep_only = true [Wise Installer Stub] signature = 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 ep_only = false [WWPACK v3.00, v3.01 (Extractable)] signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 6A ?? 06 06 8C D3 83 ?? ?? 53 6A ?? FC ep_only = true [WWPACK v3.02, v3.02a (Extractable)] signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 ep_only = true [WWPACK v3.02, v3.02a, v3.04 (Relocations pack)] signature = BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC ep_only = true [WWPACK v3.03] signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 BB ?? ?? 53 ep_only = true [WWPACK v3.05c4 (Extr. Passw.check. Vir. shield)] signature = 03 05 C0 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Extractable + Password checking)] signature = 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Extractable + Virus Shield)] signature = 03 05 40 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Extractable)] signature = 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Modified)] signature = B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Unextr. Passw.check. Vir. shield)] signature = 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Unextractable + Password checking)] signature = 03 05 80 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Unextractable + Virus Shield)] signature = 03 05 40 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [WWPACK v3.05c4 (Unextractable)] signature = 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 ep_only = true [XCR v0.13] signature = 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB ep_only = true [XPack 1.67] signature = B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB ep_only = true [y0da's Crypter v1.0] signature = 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 ep_only = true [y0da's Crypter v1.1] signature = 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 ep_only = true [y0da's Crypter v1.2] signature = 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC ep_only = true [yoda's Crypter 1.3-->Ashkbiz Danehkar] signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 ep_only = true [yP v1.0b by Ashkbiz Danehkar] signature = 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ep_only = false [!EP (ExE Pack) V1.0 -> Elite Coding Group] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 ep_only = true [$pirit v1.5] signature = ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D ep_only = true [* PseudoSigner 0.1 [MEW 11 SE 1.0] --> Anorganix] signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 ep_only = true [* PseudoSigner 0.1 [MinGW GCC 2.x] --> Anorganix] signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 ep_only = true [* PseudoSigner 0.1 [VBOX 4.3 MTE] --> Anorganix] signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 ep_only = true [* PseudoSigner 0.1 [VOB ProtectCD 5] --> Anorganix] signature = 36 3E 26 8A C0 60 E8 00 00 00 00 E9 ep_only = true [* PseudoSigner 0.1 [WATCOM C/C++ EXE] --> Anorganix] signature = E9 00 00 00 00 90 90 90 90 57 41 E9 ep_only = true [* PseudoSigner 0.1 [XCR 0.11] --> Anorganix] signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 ep_only = true [* PseudoSigner 0.1 [Yoda's Protector 1.02] --> Anorganix] signature = E8 03 00 00 00 EB 01 90 90 E9 ep_only = true [* PseudoSigner 0.2 [32Lite 0.03] --> Anorganix] signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ep_only = true [* PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix] signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 ep_only = true [* PseudoSigner 0.2 [CD-Cops II] --> Anorganix] signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 ep_only = true [* PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix] signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 ep_only = true [* PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix] signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 ep_only = true [* PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix] signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 ep_only = true [* PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix] signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 ep_only = true [* PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix] signature = 36 3E 26 8A C0 60 E8 00 00 00 00 ep_only = true [* PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix] signature = E9 00 00 00 00 90 90 90 90 57 41 ep_only = true [* PseudoSigner 0.2 [XCR 0.11] --> Anorganix] signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 ep_only = true [* PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix] signature = E8 03 00 00 00 EB 01 90 90 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 00 83 C5 04 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 6D 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 00 36 8B 00 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 02 66 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 E8 83 ED 04 89 45 00 E9 ep_only = true [* VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 6D 00 E9 ep_only = true [.BJFnt v1.1b] signature = EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 ep_only = true [.BJFnt v1.2 RC] signature = EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB ep_only = true [.BJFnt v1.3] signature = EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 ep_only = true [32Lite v0.03a] signature = 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 ?? 10 ?? ?? 68 ep_only = true [A program by Jupiter ..] signature = 2B C0 74 05 68 ?? ?? ?? ?? 50 ep_only = true [A3E (TXT2COM)] signature = 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB ep_only = true [AcidCrypt] signature = BE ?? ?? ?? ?? 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB ep_only = true [AcidCrypt] signature = 60 B9 ?? ?? ?? 00 BA ?? ?? ?? 00 BE ?? ?? ?? 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB ep_only = true [ACProtect v1.35 -> risco software Inc. & Anticrack Software (h)] signature = 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 ep_only = false [ACProtect V1.3X -> risco] signature = 60 50 E8 01 00 00 00 75 83 ep_only = true [ACProtect V1.4X -> risco] signature = 60 E8 01 00 00 00 7C 83 04 24 06 C3 ep_only = true [ACProtect v1.90g -> Risco software Inc.] signature = 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 ep_only = true [ActiveMARK[TM] R5.31.1140 -> Trymedia] signature = 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 ep_only = true [AdFlt2] signature = 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE ?? ?? AD ep_only = true [Ady's Glue 1.10] signature = 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC ep_only = true [AINEXE v2.1] signature = A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 ep_only = true [AINEXE v2.30] signature = 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 ep_only = true [Aluwain v8.09] signature = 8B EC 1E E8 ?? ?? 9D 5E ep_only = true [Anskya Binder v1.1 -> Anskya] signature = BE ?? ?? ?? 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 ep_only = true [Anticrack Software Protector v1.09 (ACProtect)] signature = 60 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 04 24 06 C3 ?? ?? ?? ?? ?? 00 ep_only = true [AntiVirus Vaccine v.1.03] signature = FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 ep_only = true [aPack v0.62] signature = 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 ep_only = true [aPack v0.98 -m] signature = 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 ep_only = false [aPack v0.98b (DS&ES not saved)] signature = 8C CB BA ?? ?? 03 DA FC 33 F6 33 FF 4B 8E DB 8D ?? ?? ?? 8E C0 B9 ?? ?? F3 A5 4A 75 ep_only = false [APatch GUI v1.1] signature = 52 31 C0 E8 FF FF FF FF ep_only = true [ARC-SFX Archive] signature = 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 ep_only = true ; Disabled due to false positives ;[Armadillo v1.71] ;signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ;ep_only = true [Armadillo v1.72 - v1.73] signature = 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 ep_only = true [Armadillo v1.9x] signature = 55 8B EC 6A FF 68 98 ?? ?? ?? 68 10 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 ep_only = true ; False positive - https://www.zscaler.com/blogs/research/your-windows-8-packed ;[Armadillo v1.xx - v2.xx] ;signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ;ep_only = true [Armadillo v2.51] signature = 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 ep_only = true [Armadillo v2.52] signature = 55 8B EC 6A FF 68 E0 ?? ?? ?? 68 D4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 38 ep_only = true [Armadillo v2.52b2] signature = 55 8B EC 6A FF 68 B0 ?? ?? ?? 68 60 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 24 ep_only = true [Armadillo v2.53b3] signature = 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 ep_only = true [ASPack v1.02b] signature = 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 ep_only = true [ASPack v1.04b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D ep_only = true [ASPack v1.07b] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE ?? ?? 80 BD 01 DE ep_only = true [ASPack v1.07b (DLL)] signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 ep_only = true [ASPack v1.08.01] signature = 60 EB ?? 5D EB ?? FF ?? ?? ?? ?? ?? E9 ep_only = true [ASPack v1.08.03] signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD ep_only = true [ASPack v1.08.03] signature = 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD ep_only = true [ASPack v1.08.04] signature = 60 E8 41 06 00 00 EB 41 ep_only = true [ASPack v2.000] signature = 60 E8 70 05 00 00 EB 4C ep_only = true [ASPack v2.001] signature = 60 E8 72 05 00 00 EB 4C ep_only = true [ASPack v2.1] signature = 60 E8 72 05 00 00 EB 33 87 DB 90 00 ep_only = true [ASPack v2.11d] signature = 60 E8 02 00 00 00 EB 09 5D 55 ep_only = true [ASPack v2.12] signature = 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 ep_only = true [ASPack v2.xx] signature = A8 03 ?? ?? 61 75 08 B8 01 ?? ?? ?? C2 0C ?? 68 ?? ?? ?? ?? C3 8B 85 26 04 ?? ?? 8D 8D 3B 04 ?? ?? 51 50 FF 95 ep_only = true [ASPR Stripper v2.x unpacked] signature = BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC ep_only = true [ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov] signature = 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 ep_only = true [ASProtect v1.0] signature = 60 E8 01 ?? ?? ?? 90 5D 81 ED ?? ?? ?? ?? BB ?? ?? ?? ?? 03 DD 2B 9D ep_only = true [ASProtect v1.1] signature = 60 E9 ?? 04 ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? EE ep_only = true [ASProtect v1.1 MTE] signature = 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 ep_only = true [ASProtect v1.1 MTEc] signature = 90 60 E8 1B ?? ?? ?? E9 FC ep_only = true [ASProtect v1.23 RC1] signature = 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 ep_only = true [ASProtect v1.2x] signature = 00 00 68 01 ?? ?? ?? C3 AA ep_only = true [ASProtect v1.2x (New Strain)] signature = 68 01 ?? ?? ?? E8 01 ?? ?? ?? C3 C3 ep_only = true [ASProtect vx.x] signature = 60 ?? ?? ?? ?? ?? 90 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 DD ep_only = true [bambam V0.01 -> bedrock] signature = 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF ep_only = true [BeRoEXEPacker v1.00 -> BeRo / Farbrausch] signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 ep_only = true [BeRoEXEPacker v1.00 -> BeRo / Farbrausch] signature = 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 ep_only = true [Blade Joiner v1.5] signature = 55 8B EC 81 C4 E4 FE FF FF 53 56 57 33 C0 89 45 F0 89 85 ep_only = true [BobSoft Mini Delphi -> BoB / BobSoft] signature = 55 8B EC 83 C4 F0 B8 ?? ?? ?? ?? E8 ep_only = true [BobSoft Mini Delphi -> BoB / BobSoft] signature = 55 8B EC 83 C4 F0 53 56 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ep_only = true [BobSoft Mini Delphi -> BoB / BobSoft] signature = 55 8B EC 83 C4 F0 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B8 ?? ?? ?? ?? E8 ep_only = true [BookManager v9510] signature = FC A3 ?? ?? 89 1E ?? ?? 49 89 0E ?? ?? BB ?? ?? 8C 1F 83 ?? ?? 89 ?? ?? B8 ?? ?? 50 89 ?? ?? F7 D0 50 ep_only = true [BopCrypt v1.0] signature = 60 BD ?? ?? ?? ?? E8 ?? ?? 00 00 ep_only = true [by Central Point Software] signature = 50 51 52 56 57 8B EB 1E 2E ep_only = true [Can2Exe v0.01] signature = 0E 1F 0E 07 E8 ?? ?? E8 ?? ?? 3A C6 73 ep_only = true [CauseWay DOS Extender v3.25] signature = FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07 ep_only = true [CC v2.61 Beta] signature = BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB ep_only = true [CD-Cops II] signature = 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D ep_only = true [CERBERUS v2.0] signature = 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 ep_only = true [CHECKPRG (c) 1992] signature = 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 ep_only = true [ChSfx (small) v1.1] signature = BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 ep_only = true [Code-Lock vx.x] signature = 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 ep_only = true [CodeCrypt v0.14b] signature = E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F ep_only = true [CodeCrypt v0.15b] signature = E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F ep_only = true [CodeCrypt v0.16b - v0.163b] signature = E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F ep_only = true [COP v1.0 (c) 1988] signature = BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 ep_only = true [Copy Protector v2.0] signature = 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F ep_only = true [CPAV] signature = E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 ep_only = true [CrackStop v1.01 (c) Stefan Esser 1997] signature = B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC ep_only = true [Crinkler V0.1-V0.2 -> Rune L.H.Stubbe and Aske Simon Christensen] signature = B9 ?? ?? ?? ?? 01 C0 68 ?? ?? ?? ?? 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE ?? ?? ?? ?? E9 ep_only = true [Crinkler V0.3-V0.4 -> Rune L.H.Stubbe and Aske Simon Christensen] signature = B8 00 00 42 00 31 DB 43 EB 58 ep_only = true [Crunch/PE v1.0.x.x] signature = 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 ep_only = true [Crunch/PE v3.0.x.x] signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74 ep_only = true [Cruncher v1.0] signature = 2E ?? ?? ?? ?? 2E ?? ?? ?? B4 30 CD 21 3C 03 73 ?? BB ?? ?? 8E DB 8D ?? ?? ?? B4 09 CD 21 06 33 C0 50 CB ep_only = true [CrypKey v5 - v6] signature = E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 ep_only = true [CrypKey V5.6.X -> Kenonic Controls Ltd.] signature = E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8 ep_only = true [CrypKey V5.6.X DLL -> Kenonic Controls Ltd.] signature = 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8 ep_only = true [CrypKey V6.1X DLL -> CrypKey (Canada) Inc.] signature = 83 3D ?? ?? ?? ?? 00 75 34 68 ?? ?? ?? ?? E8 ep_only = true [CRYPT Version 1.7 (c) Dismember] signature = 0E 17 9C 58 F6 ?? ?? 74 ?? E9 ep_only = true [CRYPT Version 1.7 (c) Dismember (COM)] signature = 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60 ep_only = true [CRYPT Version 1.7 (c) Dismember (EXE)] signature = 0E 17 9C 58 F6 ?? ?? 74 ?? E9 ep_only = true [CryptCom v1.1] signature = BF ?? ?? 57 BE ?? ?? ?? B9 ?? ?? F3 A4 C3 8B ?? ?? ?? 8B ?? ?? ?? BF ?? ?? 57 BE ?? ?? ?? AD 33 C2 AB E2 ?? C3 ep_only = true [CrypWrap vx.x] signature = E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E ep_only = true [Cygwin32] signature = 55 89 E5 83 EC 04 83 3D ep_only = true [DBPE vx.xx] signature = EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ep_only = true [DEF v1.0] signature = BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 ep_only = true [dePACK -> deNULL] signature = EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ep_only = true [Dev-C++ v4] signature = 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF ep_only = false [DIET v1.00d] signature = FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ep_only = true [DIET v1.44, v1.45f] signature = F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 ep_only = true [Ding Boy's PE-lock Phantasm v0.8] signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 ep_only = true [Ding Boy's PE-lock Phantasm v1.0 / v1.1] signature = 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC ep_only = true [Ding Boy's PE-lock v0.07] signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 ep_only = true [DJoin v0.7 public (RC4 encryption) -> drmist] signature = C6 05 ?? ?? 40 00 00 C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ep_only = true [DJoin v0.7 public (xor encryption) -> drmist] signature = C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ep_only = true [DOS/16M DOS Extender (c) Tenberry Software Inc 1987-1995] signature = BF ?? ?? 8E C7 8E D7 BC ?? ?? 36 ?? ?? ?? ?? FF ?? ?? ?? 36 ?? ?? ?? ?? BE ?? ?? AC 8A D8 B7 00 ?? ?? 8B ?? ?? ?? 4F 8E C7 ep_only = true [Dr.Web Virus-Finding Engine -> InSoft EDV-Systeme] signature = B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 ep_only = true [DSHIELD] signature = 06 E8 ?? ?? 5E 83 EE ?? 16 17 9C 58 B9 ?? ?? 25 ?? ?? 2E ep_only = true [dUP 2.x Patcher --> www.diablo2oo2.cjb.net] signature = 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 ep_only = false [DxPack 1.0] signature = 60 E8 ?? ?? ?? ?? 5D 8B FD 81 ED ?? ?? ?? ?? 2B B9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ep_only = true [E language] signature = E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF ep_only = true [E.S.O. Eclipse Operating System v.2.08 + DOS Extender] signature = 8C C8 8E D8 BA ?? ?? E8 ?? ?? BB ?? ?? 8C C0 2B D8 B4 4A CD 21 BA ?? ?? 73 ?? E9 ep_only = true [E2C by DoP] signature = BE ?? ?? BF ?? ?? B9 ?? ?? FC 57 F3 A5 C3 ep_only = true [Elicense System V4.0.0.0 -> ViaTech Inc] signature = 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 ep_only = false [Embed PE v1.13 -> cyclotron] signature = 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 ep_only = true [EmbedPE v1.24 -> cyclotron] signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 CB FF 00 00 ep_only = true [EmbedPE V1.X -> cyclotron] signature = 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 ep_only = true [EncryptPE 1.2003.5.18 -> WFS] signature = 60 9C 64 FF 35 00 00 00 00 E8 79 ep_only = true [EncryptPE 2.2004.8.10 - 2.2005.3.14 -> WFS] signature = 60 9C 64 FF 35 00 00 00 00 E8 7A ep_only = true [EncryptPE V2.2006.1.15 -> WFS] signature = 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35 ep_only = false [EncryptPE V2.2006.7.10 -> WFS] signature = 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 ep_only = true [Enigma protector 1.10/1.11 -> Vladimir Sukhov] signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 ep_only = false [ENIGMA Protector V1.0-V1.2-> Sukhov Vladimir] signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ep_only = true [ENIGMA Protector V1.1 CracKed By: shoooo & fly -> Sukhov Vladimir] signature = 60 E8 00 00 00 00 5D 83 C5 FA 81 ep_only = true [ENIGMA Protector V1.1-> Sukhov Vladimir] signature = 60 E8 00 00 00 00 5D 83 ?? ?? 81 ep_only = true [ENIGMA Protector V1.1-V1.2-> Sukhov Vladimir] signature = 60 E8 00 00 00 00 5D 83 ED 06 81 ep_only = true [EPW v1.2] signature = 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E ep_only = true [EPW v1.30] signature = 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E ep_only = true [Escargot V0.1 -> ++Meat] signature = EB 04 40 30 2E 31 60 68 61 ep_only = true [Exact Audio Copy -> (UnknownCompiler)] signature = E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [Excalibur 1.03 -> forgot] signature = E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 ep_only = true [EXE joiner -> Amok] signature = A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 ep_only = true [Exe Locker 1.0 -> IonIce] signature = E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 ep_only = true [EXE Manager Version 3.0 1994 (c) Solar Designer] signature = B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 ep_only = true [EXE Shield v0.1b - v0.3b, v0.3 -> SMoKE] signature = E8 04 00 00 00 83 60 EB 0C 5D EB 05 ep_only = true [Exe Shield v2.7] signature = EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 ep_only = true [Exe Shield vx.x] signature = 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 ep_only = true [EXE Stealth v2.7] signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 ep_only = true [EXE Stealth v2.71] signature = EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 ep_only = true [EXE Stealth v2.72] signature = EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 ep_only = true [EXE Stealth v2.74 -> WebToolMaster] signature = EB 00 EB 17 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 90 E8 00 00 00 00 5D ep_only = true [EXE2COM (Encrypted without selfcheck)] signature = B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6 ep_only = true [EXE2COM (Limited)] signature = BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20 ep_only = true [EXE2COM (Method 1)] signature = 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 ep_only = true [EXE2COM (Packed)] signature = BD ?? ?? 89 ?? ?? ?? 81 ?? ?? ?? ?? ?? 8C ?? ?? ?? 8C C8 05 ?? ?? 8E C0 BE ?? ?? 8B FE 0E 57 54 59 F3 A4 06 68 ?? ?? CB ep_only = true [EXE32Pack v1.3x] signature = 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 ?? ?? ?? ?? ?? 02 81 ?? ?? E8 ?? ?? ?? ?? 3B 74 01 ?? 5D 8B D5 81 ED ep_only = true [EXECryptor v1.3.0.45] signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 14 89 41 18 80 A1 ep_only = true [EXECryptor V2.1X -> SoftComplete.com] signature = E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 ep_only = true [EXECryptor vx.x.x.x] signature = E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 ep_only = true [EXELOCK 666 1.5] signature = BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 ep_only = true [ExeLock v1.00] signature = 06 8C C8 8E C0 BE ?? ?? 26 ?? ?? 34 ?? 26 ?? ?? 46 81 ?? ?? ?? 75 ?? 40 B3 ?? B3 ?? F3 ep_only = true [EXEPACK (LINK) v3.60, v3.64, v3.65 or 5.01.21] signature = 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB ep_only = true [EXEStealth 2.75 -> WebtoolMaster] signature = 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 ep_only = true [ExeTools v2.1 Encruptor by DISMEMBER] signature = E8 ?? ?? 5D 83 ?? ?? 1E 8C DA 83 ?? ?? 8E DA 8E C2 BB ?? ?? BA ?? ?? 85 D2 74 ep_only = true [eXPressor 1.1 -> CGSoftLabs] signature = E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 E9 ?? ?? 00 00 ep_only = true [eXpressor v1.2 -> CGSoftLabs] signature = 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 ep_only = true [eXPressor V1.3 -> CGSoftLabs] signature = 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 ep_only = true [eXpressor v1.4.5 -> CGSoftLabs] signature = 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C ep_only = true [eXpressor v1.4.5 -> CGSoftLabs] signature = 55 8B EC 83 EC ?? 53 56 57 83 65 DC 00 F3 EB 0C ep_only = true [FASM v1.3x] signature = 6A ?? FF 15 ?? ?? ?? ?? A3 ep_only = true [FileShield] signature = 50 1E EB ?? 90 00 00 8B D8 ep_only = true [Free Pascal v0.99.10] signature = ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29 ep_only = true [Free Pascal v1.0.10 (win32 GUI)] signature = C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ep_only = false [FreeBASIC v0.11] signature = E8 ?? ?? 00 00 E8 01 00 00 00 C3 55 89 E5 ep_only = true [FreePascal 1.0.4 Win32 -> (Berczi Gabor, Pierre Muller & Peter Vreman)] signature = 55 89 E5 C6 05 ?? ?? ?? ?? 00 E8 ?? ?? ?? ?? 55 31 ED 89 E0 A3 ?? ?? ?? ?? 66 8C D5 89 2D ?? ?? ?? ?? DB E3 D9 2D ?? ?? ?? ?? 31 ED E8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? C9 C3 ep_only = false [FreePascal 1.0.4 Win32 DLL -> (Berczi Gabor, Pierre Muller & Peter Vreman)] signature = C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00 ep_only = false [Freshbind v2.0 -> gFresh] signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 ep_only = true [from NORMAN Anti-Virus Utilites] signature = E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A ep_only = true [Frusion -> biff] signature = 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 ep_only = true [FSG 1.31 -> dulek/xt] signature = BE ?? ?? ?? 00 BF ?? ?? ?? 00 BB ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 ep_only = true [FSG v1.10 (Eng) -> bart/xt -> (Watcom C/C++ EXE)] signature = EB 02 CD 20 03 ?? 8D ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ep_only = true [FSG v1.10 (Eng) -> dulek/xt] signature = EB 01 ?? EB 02 ?? ?? ?? 80 ?? ?? 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt] signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? F6 ep_only = true [FSG v1.10 (Eng) -> dulek/xt] signature = BB D0 01 40 ?? BF ?? 10 40 ?? BE ep_only = true [FSG v1.10 (Eng) -> dulek/xt] signature = E8 01 00 00 00 ?? ?? E8 ?? 00 00 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = 87 FE ?? 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0 / 7.0)] signature = EB 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ep_only = true [FSG v1.10 (Eng) -> dulek/xt -> (Microsoft Visual C++ 6.0)] signature = EB 02 CD 20 ?? CF ?? ?? 80 ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [FSG v1.33] signature = BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 ep_only = true [FSG v2.0 -> bart/xt] signature = 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 ep_only = true [Gamehouse Media Protector Version Unknown] signature = 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? 00 00 00 00 00 00 00 00 ep_only = true [Gardian Angel 1.0] signature = 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB ep_only = true [Go32Stub v.2.00 DOS-Extender] signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80 ep_only = true [Go32Stub v.2.00T DOS-Extender] signature = 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C ep_only = true [Guardant Stealth aka Novex Dongle] signature = 55 8B EC 83 C4 F0 60 E8 51 FF FF FF ep_only = true [HACKSTOP v1.00] signature = FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F ep_only = true [HACKSTOP v1.18] signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? FD 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB ep_only = true [HACKSTOP v1.19] signature = 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB ep_only = true [HEALTH v.5.1 by Muslim M.Polyak] signature = 1E E8 ?? ?? 2E 8C 06 ?? ?? 2E 89 3E ?? ?? 8B D7 B8 ?? ?? CD 21 8B D8 0E 1F E8 ?? ?? 06 57 A1 ?? ?? 26 ep_only = true [ILUCRYPT v4.015 [exe]] signature = 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 ep_only = true [iLUCRYPT v4.018 [exe]] signature = 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 ep_only = true [Inbuild v1.0 [hard]] signature = B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 ep_only = true [Inno Setup Module] signature = 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF ep_only = false [Install Stub 32-bit] signature = 55 8B EC 81 EC 14 ?? 00 00 53 56 57 6A 00 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 29 ep_only = true [InstallShield 2000] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 ep_only = true [JDPack] signature = 60 E8 ?? ?? ?? ?? 5D 8B D5 81 ED ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 81 EA 06 ?? ?? ?? 89 95 ?? ?? ?? ?? 83 BD 45 ep_only = true [KGCrypt vx.x] signature = E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74 ep_only = true [Krypton v0.2] signature = 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04 ep_only = true [kryptor 5] signature = E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0 ep_only = true [kryptor 6] signature = E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 ep_only = true [LamerStop v1.0c (c) Stefan Esser] signature = E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA ep_only = true [Lattice C v1.01] signature = FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB ep_only = true [Lattice C v3.0] signature = FA B8 ?? ?? 8E D8 B8 ?? ?? 8E ep_only = true [LCC Win32 v1.x] signature = 64 A1 ?? ?? ?? ?? 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 ?? 50 ep_only = true [LCC-Win32] signature = 64 A1 00 00 00 00 55 89 E5 6A FF 68 10 30 40 00 68 9A 10 40 ep_only = true [Libraries by John Socha] signature = BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 ep_only = true [Lockless Intro Pack] signature = 2C E8 ?? ?? ?? ?? 5D 8B C5 81 ED F6 73 ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 06 89 85 ep_only = true [LSI C-86 Run-Time Libray] signature = B8 ?? ?? 8E C0 06 17 BC ?? ?? 26 8C ?? ?? ?? B4 30 CD 21 26 A3 ?? ?? FC ep_only = true [MASM / TASM] signature = 6A 00 E8 ?? ?? 00 00 A3 ?? 32 40 00 E8 ?? ?? 00 00 ep_only = true [MEGALITE v1.20a] signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 2D 73 ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 90 ep_only = true [MESS v1.20] signature = ?? ?? ?? ?? FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 ep_only = true [MetaWare High C + Phar Lap DOS Extender 1983-89] signature = B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 ep_only = true [MetaWare High C Run-Time Library + Phar Lap DOS Extender 1983-89] signature = B8 ?? ?? 50 B8 ?? ?? 50 CB ep_only = true [Metrowerks CodeWarrior v2.0 (Console)] signature = 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 ep_only = false [Mew 10 exe-coder 1.0 -> Northfox [HCC]] signature = 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 ep_only = true [MEW 11 SE v1.2 -> Northfox[HCC]] signature = E9 ?? ?? ?? FF 0C ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? ?? 00 ep_only = true [MEW 5 1.0 -> Northfox] signature = BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ep_only = true [MicroJoiner 1.1 -> coban2k] signature = BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 ep_only = true [MicroJoiner 1.5 -> coban2k] signature = BF 05 10 40 00 83 EC 30 8B EC E8 C8 FF FF FF E8 C3 FF FF FF ep_only = true [MicroJoiner 1.6 -> coban2k] signature = 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B ep_only = true [Microsoft Basic Compiler v5.60 1982-97] signature = 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB ep_only = true [Microsoft C] signature = B4 30 CD 21 3C 02 73 ?? B8 ep_only = true [Microsoft C (1988/1989)] signature = B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72 ep_only = true [Microsoft C for Windows (1)] signature = 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 ep_only = true [Microsoft C for Windows (2)] signature = 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89 ep_only = true [Microsoft C Library 1985] signature = BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73 ep_only = true [Microsoft C v1.04] signature = FA B8 ?? ?? 8E D8 8E D0 26 8B ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 04 D3 E3 EB ep_only = true [Microsoft CAB SFX] signature = E8 0A 00 00 00 E9 7A FF FF FF CC CC CC CC CC ep_only = true [Microsoft FORTRAN] signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? B9 ?? ?? 9A ?? ?? ?? ?? 80 ?? ?? ?? ?? 74 ?? E9 ep_only = true [Microsoft Visual Basic v5.0/v6.0] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 ep_only = true [Microsoft Visual Basic v6.0 DLL] signature = 5A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E9 ?? ?? FF ep_only = true [Microsoft Visual C 2.0] signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ep_only = true [Microsoft Visual C v2.0] signature = 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 ep_only = true [Microsoft Visual C++] signature = 8B 44 24 08 83 ?? ?? 74 ep_only = true [Microsoft Visual C++] signature = 8B 44 24 08 56 83 E8 ?? 74 ?? 48 75 ep_only = true [Microsoft Visual C++ (3.0 old crap)] signature = 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10 ep_only = true [Microsoft Visual C++ 7.1] signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 39 75 0C 0F 84 ?? ?? ?? ?? 33 C0 40 5E 5D C2 0C 00 ep_only = false [Microsoft Visual C++ 7.1] signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 0F 84 ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ep_only = false [Microsoft Visual C++ 7.1] signature = 8B FF 55 8B EC 56 33 F6 39 75 0C 75 0E 39 35 ?? ?? ?? ?? 7E 2D FF 0D ?? ?? ?? ?? 83 7D 0C 01 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? 75 3D 68 80 00 00 00 FF 15 ?? ?? ?? ?? 3B C6 59 A3 ?? ?? ?? ?? 75 04 33 C0 EB 67 89 30 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ep_only = false [Microsoft Visual C++ DLL] signature = 53 56 57 BB 01 ?? ?? ?? 8B ?? 24 14 ep_only = true [Microsoft Visual C++ DLL] signature = 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C ep_only = true [Microsoft Visual C++ DLL] signature = 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00 ep_only = true [Microsoft Visual C++ v4.2] signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF ep_only = true [Microsoft Visual C++ v4.2] signature = 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? C7 ep_only = true [Microsoft Visual C++ v4.2 DLL] signature = 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75 ep_only = true [Microsoft Visual C++ v6.0] signature = 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 89 65 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF ep_only = false [Microsoft Visual C++ v6.0 DLL] signature = 55 8D 6C ?? ?? 81 EC ?? ?? ?? ?? 8B 45 ?? 83 F8 01 56 0F 84 ?? ?? ?? ?? 85 C0 0F 84 ep_only = true [Microsoft Visual C++ v6.0 DLL] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C ep_only = true [Microsoft Visual C++ v6.0 DLL] signature = 55 8B EC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = false [Microsoft Visual C++ v6.0 SPx] signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 6A 01 8B F0 FF 15 ep_only = true [Microsoft Visual C++ v6.0 SPx] signature = 55 8B EC 83 EC 44 56 FF 15 ?? ?? ?? ?? 8B F0 8A ?? 3C 22 ep_only = true [Microsoft Visual C++ v7.0 (64 Bit)] signature = ?? ?? 41 00 00 00 00 00 00 00 63 00 00 00 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 20 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ep_only = false [Microsoft Visual C++ v7.0 DLL] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ep_only = true [Microsoft Visual C++ v7.1 DLL] signature = 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 40 89 45 E4 ep_only = true [Microsoft Visual C++ v7.1 DLL (Debug)] signature = 55 8B EC ?? ?? 0C 83 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 8B ep_only = true [Microsoft Visual C++ v7.1 EXE] signature = 6A ?? 68 ?? ?? ?? ?? E8 ep_only = true [Microsoft Visual C++ vx.x] signature = 55 8B EC 56 57 BF ?? ?? ?? ?? 8B ?? ?? 3B F7 0F ep_only = true [Microsoft Visual C++ vx.x] signature = 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2 ep_only = true [MinGW GCC DLL v2xx] signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [MinGW GCC v2.x] signature = 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45 ep_only = true [MinGW GCC v2.x] signature = 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 ep_only = true [MoleBox V2.X -> MoleStudio.com] signature = E8 00 00 00 00 60 E8 4F 00 00 00 ep_only = true [MS FORTRAN Library 19??] signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 ep_only = true [MS FORTRAN Library 19??] signature = FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9 ep_only = true [MS Run-Time Library (OS/2) & FORTRAN Compiler 1989] signature = B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 ep_only = true [MS Run-Time Library 1987] signature = B4 30 CD 21 3C 02 73 ?? 9A ?? ?? ?? ?? B8 ?? ?? 50 9A ?? ?? ?? ?? 92 ep_only = true [MS Run-Time Library 1990 (07)] signature = 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB ep_only = true [MS Run-Time Library 1990 (10)] signature = E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB ep_only = true [MS Run-Time Library 1990, 1992 (09)] signature = B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E ep_only = true [MS Run-Time Library 1992 (13)] signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21 ep_only = true [MS Run-Time Library 1992 (14)] signature = 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30 ep_only = true [nbuild v1.0 [soft]] signature = B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 ep_only = true [NeoLite v1.0] signature = 8B 44 24 04 8D 54 24 FC 23 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 FF 25 ep_only = true [NeoLite v2.0] signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 4E 65 6F 4C 69 74 65 ep_only = true [NeoLite v2.00] signature = 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 ep_only = true [NFO v1.0] signature = 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C ep_only = true [NoodleCrypt v2.0] signature = EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 ep_only = false [Noodlecrypt2 -> r!sc] signature = EB 01 9A E8 76 00 00 00 ep_only = true [NsPack V1.1 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 ep_only = true [nSpack V1.3 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 ep_only = true [NsPack V1.4 -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 ep_only = true [Nullsoft Install System v1.98] signature = 83 EC 0C 53 56 57 FF 15 2C 81 40 ep_only = true [Nullsoft PIMP Install System v1.x] signature = 83 EC 5C 53 55 56 57 FF 15 ?? ?? ?? 00 ep_only = true [NX PE Packer v1.0] signature = FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00 ep_only = true [Obsidium 1.2.0.0 -> Obsidium Software] signature = EB 02 ?? ?? E8 3F 1E 00 00 ep_only = true [Obsidium v1.1.1.1] signature = EB 02 ?? ?? E8 E7 1C 00 00 ep_only = true [Obsidium V1.2 -> Obsidium Software] signature = EB 02 ?? ?? E8 77 1E 00 00 ep_only = true [Obsidium V1.2.5.8 -> Obsidium Software] signature = EB 01 ?? E8 ?? 00 00 00 ep_only = true [Obsidium V1.25 -> Obsidium Software] signature = E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 ep_only = true [Obsidium V1.3.0.0 -> Obsidium Software] signature = EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 ep_only = true [Obsidium V1.3.0.0 -> Obsidium Software] signature = EB 04 ?? ?? ?? ?? E8 29 00 00 00 ep_only = true [Obsidium V1.3.0.4 -> Obsidium Software] signature = EB 02 ?? ?? E8 ?? 00 00 00 ep_only = true [ORiEN V2.12 -> Fisun A.V.] signature = E9 5D 01 00 00 CE D1 CE CD 0D ep_only = true [Packanoid -> Arkanoid] signature = BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ep_only = true [Packed with: PKLITE v1.50 with CRC check (1)] signature = 1F B4 09 BA ?? ?? CD 21 B8 ?? ?? CD 21 ep_only = true [Packman V0.0.0.1 -> Bubbasoft] signature = 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 ep_only = true [PAK-SFX Archive] signature = 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D ep_only = true [PassEXE v2.0] signature = 06 1E 0E 0E 07 1F BE ?? ?? B9 ?? ?? 87 14 81 ?? ?? ?? EB ?? C7 ?? ?? ?? 84 00 87 ?? ?? ?? FB 1F 58 4A ep_only = true [Password protector my SMT] signature = E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 ep_only = true [PC Shrinker v0.20] signature = E8 E8 01 ?? ?? 60 01 AD B3 27 40 ?? 68 ep_only = true [PC Shrinker v0.29] signature = ?? BD ?? ?? ?? ?? 01 AD 55 39 40 ?? 8D B5 35 39 40 ep_only = true [PC Shrinker v0.45] signature = ?? BD ?? ?? ?? ?? 01 AD E3 38 40 ?? FF B5 DF 38 40 ep_only = true [PC-Guard v4.05d, v4.10d, v4.15d] signature = FC 55 50 E8 00 00 00 00 5D EB 01 ep_only = true [PCPEC "alpha - preview"] signature = 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 ep_only = true [PCPEC [alpha]] signature = 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 ep_only = true [PCrypt v3.51] signature = 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 ep_only = true [PcShare 文件捆绑器 v4.0 -> 无可非议] signature = 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 ep_only = true [PCShrink 0.71 beta] signature = 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 ep_only = true [PCShrink v0.40b] signature = 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D ep_only = true [PE Crypt v1.00/v1.01] signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB ep_only = true [PE Crypt v1.02] signature = E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 ep_only = true [PE Crypt32 (Console v1.0, v1.01, v1.02)] signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB ep_only = true [PE Crypt32 v1.02] signature = E8 00 00 00 00 5B 83 ?? ?? EB ?? 52 4E 44 21 ep_only = true [PE Diminisher V0.1 -> Teraphy] signature = 53 51 52 56 57 55 E8 00 00 00 00 ep_only = true [PE Lock NT v2.01] signature = EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD ep_only = true [PE Lock NT v2.02c] signature = EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD ep_only = true [PE Lock NT v2.03] signature = EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 ep_only = true [PE Lock NT v2.04] signature = EB ?? CD ?? ?? ?? ?? ?? CD ?? ?? ?? ?? ?? EB ?? EB ?? EB ?? EB ?? CD ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 50 C3 ep_only = true [PE Pack v0.99] signature = 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 ep_only = true [PE Packer] signature = FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 ep_only = true [PE-Armor 0.46 -> Hying] signature = E8 AA 00 00 00 2D ?? ?? ?? 00 00 00 00 00 00 00 00 3D ep_only = true [PE-Armor 0.49 -> Hying] signature = 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 ep_only = true [PE-Crypt 1.02] signature = E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 ep_only = true [PE-Crypter] signature = 60 E8 00 00 00 00 5D EB 26 ep_only = true [PE-PACK 0.99] signature = 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 ep_only = true [PE-PACK v1.0 by ANAKiN 1998 (???)] signature = 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 ep_only = true [PE-PROTECT 0.9] signature = E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 ep_only = true [PE-SHiELD 0.2] signature = 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 ep_only = true [PEArmor V0.7X -> Hying] signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 ep_only = true [PECompact v0.92] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 ep_only = true [PECompact v0.94] signature = EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 ep_only = true [PECompact v0.971 - v0.976] signature = EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 ep_only = true [PECompact v1.84] signature = 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 ep_only = true [PEEncrypt v4.0b (JunkCode)] signature = 66 ?? ?? 00 66 83 ?? 00 ep_only = true [PELOCKnt 2.04] signature = EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 ep_only = true [PEncrypt v3.1] signature = E9 ?? ?? ?? 00 F0 0F C6 ep_only = true [PENightMare v1.3] signature = 60 E8 00 00 00 00 5D B9 ?? ?? ?? ?? 80 31 15 41 81 F9 ep_only = true [PESHiELD v0.1b MTE] signature = E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 ep_only = true [PESHiELD v0.2 / v0.2b / v0.2b2] signature = 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 ep_only = true [PESHiELD v0.251] signature = 5D 83 ED 06 EB 02 EA 04 8D ep_only = true [PEShit] signature = B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF ep_only = true [PEStubOEP v1.x] signature = 40 48 BE 00 ?? ?? 00 40 48 60 33 C0 B8 ?? ?? ?? 00 FF E0 C3 C3 ep_only = false [Petite 1.2] signature = 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 ep_only = true [PEtite v1.2] signature = 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 ep_only = true [PEtite v1.3] signature = ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 ep_only = true [Petite v1.4] signature = B8 ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 ?? ?? ?? ?? 6A 00 ep_only = true [PEtite v1.4] signature = 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC ep_only = true [PEtite v2.1] signature = B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 ep_only = true [Petite v2.1 (1)] signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 ep_only = true [Petite v2.1 (2)] signature = B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 ep_only = true [PEtite v2.2] signature = B8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 ep_only = true [Petite v?.? (after v1.4)] signature = B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 ep_only = true [PEtite vx.x] signature = B8 ?? ?? ?? ?? 66 9C 60 50 ep_only = true [PEX v0.99] signature = 60 E8 01 ?? ?? ?? ?? 83 C4 04 E8 01 ?? ?? ?? ?? 5D 81 ep_only = true [PGMPACK v0.13] signature = FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 ep_only = true [PGMPACK v0.14] signature = 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 ep_only = true [PIRIT v1.5] signature = B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 ep_only = true [PKLITE v1.00, v1.03] signature = B8 ?? ?? BA ?? ?? 8C DB 03 D8 3B ep_only = true [PKLITE v1.00c (1)] signature = 2E 8C 1E ?? ?? 8B 1E ?? ?? 8C DA 81 C2 ?? ?? 3B DA 72 ?? 81 EB ?? ?? 83 EB ?? FA 8E D3 BC ?? ?? FB FD BE ?? ?? 8B FE ep_only = true [PKLITE v1.00c (2)] signature = BA ?? ?? A1 ?? ?? 2D ?? ?? 8C CB 81 C3 ?? ?? 3B C3 77 ?? 05 ?? ?? 3B C3 77 ?? B4 09 BA ?? ?? CD 21 CD 20 90 ep_only = true [PKLITE v1.12, v1.15, v1.20 (1)] signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 ep_only = true [PKLITE v1.12, v1.15, v1.20 (2)] signature = B8 ?? ?? BA ?? ?? 3B C4 73 ep_only = true [PKLITE v1.14, v1.15, v1.20 (3)] signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F ep_only = true [PKLITE v1.14, v1.20] signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 CD 20 ep_only = true [PKLITE v1.20] signature = B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 ep_only = true [PKLITE v1.50 (1)] signature = 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 ep_only = true [PKLITE v2.00c] signature = 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC ep_only = true [PKLITE32 1.1] signature = 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 ep_only = true [PKLITE32 1.1 -> PKWARE Inc.] signature = 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 ep_only = true [PKLITE32 v1.1] signature = 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 ?? ?? ?? 5D C2 0C ?? 8B 45 0C 57 56 53 8B 5D 10 ep_only = false [PKLITE32 v1.1] signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 00 00 00 00 E8 ep_only = true [PKLITE32 v1.1] signature = 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50 ep_only = true [PKTINY v1.0 with TINYPROG v3.8] signature = 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? 2E C6 06 ?? ?? ?? E9 ?? ?? E8 ?? ?? 83 ep_only = true [PKZIP-SFX v1.1 1989-90] signature = FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB ep_only = true [PLINK86 1984, 1985] signature = FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 ep_only = true [PolyEnE V0.01+ -> Lennart Hedlund] signature = 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C ep_only = false [Prepared by SLR (OPTLINK)] signature = 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F ep_only = true [Private EXE Protector 1.8] signature = BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0 ep_only = true [Private EXE Protector 2.0 -> SetiSoft] signature = 89 ?? ?? 38 00 00 00 8B ?? 00 00 00 00 81 ?? ?? ?? ?? ?? 89 ?? 00 00 00 00 81 ?? 04 00 00 00 81 ?? 04 00 00 00 81 ?? 00 00 00 00 0F 85 D6 FF FF FF ep_only = false [Private EXE v2.0a] signature = 53 E8 00 00 00 00 5B 8B C3 2D ep_only = true [PrivateEXE v2.0a] signature = 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E ep_only = true [PrivateEXE v2.0a] signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ?? ?? ?? ?? 50 81 ?? ?? ?? ?? ?? 8B ep_only = true [PRO-PACK v2.08, emphasis on packed size, locked] signature = 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B ep_only = true [PROTECT! EXE/COM v6.0] signature = 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 ep_only = true [PseudoSigner 0.1 [MEW 11 SE 1.0] --> Anorganix] signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 ep_only = true [PseudoSigner 0.1 [MinGW GCC 2.x] --> Anorganix] signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 ep_only = true [PseudoSigner 0.1 [VBOX 4.3 MTE] --> Anorganix] signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 ep_only = true [PseudoSigner 0.1 [VOB ProtectCD 5] --> Anorganix] signature = 36 3E 26 8A C0 60 E8 00 00 00 00 E9 ep_only = true [PseudoSigner 0.1 [WATCOM C/C++ EXE] --> Anorganix] signature = E9 00 00 00 00 90 90 90 90 57 41 E9 ep_only = true [PseudoSigner 0.1 [XCR 0.11] --> Anorganix] signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 ep_only = true [PseudoSigner 0.1 [Yoda's Protector 1.02] --> Anorganix] signature = E8 03 00 00 00 EB 01 90 90 E9 ep_only = true [PseudoSigner 0.2 [32Lite 0.03] --> Anorganix] signature = 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ep_only = true [PseudoSigner 0.2 [Borland C++ DLL (Method 2)] --> Anorganix] signature = EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 ep_only = true [PseudoSigner 0.2 [CD-Cops II] --> Anorganix] signature = 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 ep_only = true [PseudoSigner 0.2 [MEW 11 SE 1.0] --> Anorganix] signature = E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 ep_only = true [PseudoSigner 0.2 [Microsoft Visual Basic 5.0 - 6.0] --> Anorganix] signature = 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 ep_only = true [PseudoSigner 0.2 [MinGW GCC 2.x] --> Anorganix] signature = 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 ep_only = true [PseudoSigner 0.2 [VBOX 4.3 MTE] --> Anorganix] signature = 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 ep_only = true [PseudoSigner 0.2 [VOB ProtectCD 5] --> Anorganix] signature = 36 3E 26 8A C0 60 E8 00 00 00 00 ep_only = true [PseudoSigner 0.2 [WATCOM C/C++ EXE] --> Anorganix] signature = E9 00 00 00 00 90 90 90 90 57 41 ep_only = true [PseudoSigner 0.2 [XCR 0.11] --> Anorganix] signature = 60 8B F0 33 DB 83 C3 01 83 C0 01 ep_only = true [PseudoSigner 0.2 [Yoda's Protector 1.02] --> Anorganix] signature = E8 03 00 00 00 EB 01 90 90 ep_only = true [PUNiSHER V1.5 Demo-> FEUERRADER] signature = EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 ep_only = true [RAZOR 1911 encruptor] signature = E8 ?? ?? BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC ep_only = true [RCryptor v1.3 / v1.4 --> Vaska] signature = 55 8B EC 8B 44 24 04 83 E8 4F 68 ?? ?? ?? ?? FF D0 58 59 50 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [RCryptor v1.3b --> Vaska] signature = 61 83 EF 4F 60 68 ?? ?? ?? ?? FF D7 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [RCryptor v1.5 (Private) --> Vaska] signature = 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [RCryptor v1.6 -> Vaska] signature = 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [RCryptor v1.6b / v1.6c --> Vaska] signature = 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [RCryptor v1.6d --> Vaska] signature = 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 90 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = true [REALbasic] signature = 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 ep_only = true [REC v0.32] signature = 06 1E 52 B8 ?? ?? 1E CD 21 86 E0 3D ep_only = true [REC v0.34 [3]] signature = 06 1E B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB ep_only = true [REC, C0ded by ROSE] signature = 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB ep_only = true [REC.Small v1.02] signature = 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 ep_only = true [ReversingLabsProtector 0.7.4 beta -> Ap0x] signature = 68 00 00 41 00 E8 01 00 00 00 C3 C3 ep_only = true [RLP V0.7.3.beta -> ap0x] signature = 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ep_only = false [RLPack Full Edition 1.17 -> Ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF ep_only = true [RLPack Full Edition 1.17 DLL -> Ap0x] signature = 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 ep_only = true [RLPack V1.12-V1.14 (aPlib 0.43) -> ap0x] signature = 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB ep_only = true [ROD High TECH -> Ayman] signature = 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00 ep_only = true [SCAN /AV] signature = 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 ep_only = true [SEA-AXE] signature = FC BC ?? ?? 0E 1F E8 ?? ?? 26 A1 ?? ?? 8B 1E ?? ?? 2B C3 8E C0 B1 ?? D3 E3 ep_only = true [SEA-AXE v2.2] signature = FC BC ?? ?? 0E 1F A3 ?? ?? E8 ?? ?? A1 ?? ?? 8B ?? ?? ?? 2B C3 8E C0 B1 03 D3 E3 8B CB BF ?? ?? 8B F7 F3 A5 ep_only = true [SecureEXE 3.0 -> ZipWorx] signature = E9 B8 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 ep_only = true [SEN Debug Protector???] signature = BB ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 29 ?? ?? 4E E8 ep_only = true [Shrink v1.0] signature = 50 9C FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? F3 A4 8B ?? ?? ?? BE ?? ?? BF ?? ?? F3 A4 C3 ep_only = true [Shrink Wrap v1.4] signature = 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB ep_only = true [Shrinker v3.3] signature = 83 3D ?? ?? ?? 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 ep_only = true [Simple UPX Cryptor V30.4.2005 -> MANtiCORE] signature = 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 ep_only = true [Simple UPX Cryptor v30.4.2005 [multi layer encryption] --> MANtiCORE] signature = 60 B8 ?? ?? ?? ?? B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? ?? C3 ep_only = true [SimplePack V1.1X-V1.2X (Method2) -> bagie] signature = 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 ep_only = true [SLR (OPTLINK)] signature = BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21 ep_only = true [SLR (OPTLINK) (1)] signature = 87 C0 EB ?? 71 ?? 02 D8 ep_only = true [SLVc0deProtector 1.1x -> SLV / ICU] signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ?? ?? 00 ep_only = true [SLVc0deProtector v1.1 -> SLV (h)] signature = E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C ep_only = true [SmokesCrypt v1.2] signature = 60 B8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 ep_only = true [Soft Defender v1.1x -> Randy Li] signature = 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D ep_only = true [SoftSentry v2.11] signature = 55 8B EC 83 EC ?? 53 56 57 E9 50 ep_only = true [SoftSentry v3.0] signature = 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 ep_only = true [SoftWrap] signature = 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F ep_only = true [Spalsher 1.0 - 3.0 -> Amok] signature = 9C 60 8B 44 24 24 E8 00 00 00 00 ep_only = true [Spalsher v1.0 - v3.0] signature = 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 ep_only = true [SPEC b2] signature = 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 ep_only = true [StarForce Protection Driver -> Protection Technology] signature = 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 ep_only = true [StarForce V3.X -> StarForce Copy Protection System] signature = 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ep_only = true [StarForce V3.X DLL -> StarForce Copy Protection System] signature = E8 ?? ?? ?? ?? 00 00 00 00 00 00 ep_only = true [Stealth PE v1.1] signature = BA ?? ?? ?? 00 FF E2 BA ?? ?? ?? 00 B8 ?? ?? ?? ?? 89 02 83 C2 03 B8 ?? ?? ?? ?? 89 02 83 C2 FD FF E2 ep_only = true [STNPEE 1.13] signature = 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 ep_only = true [Stone`s PE Encruptor v1.13] signature = 55 57 56 52 51 53 E8 ?? ?? ?? ?? 5D 8B D5 81 ep_only = true [Stony Brook Pascal v6.14] signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 ?? EC ?? ?? 9A ep_only = true [Stony Brook Pascal+ v7.0] signature = 31 ED 9A ?? ?? ?? ?? 55 89 E5 81 EC ?? ?? B8 ?? ?? 0E 50 9A ?? ?? ?? ?? BE ?? ?? 1E 0E BF ?? ?? 1E 07 1F FC ep_only = true [Stranik 1.3 Modula/C/Pascal] signature = E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ep_only = true [SuckStop v1.11] signature = EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B ep_only = true [SVK-Protector v1.11] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 ep_only = true [Symantec Visual Cafe v3.0] signature = 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC ep_only = true [T-PACK v0.5c -m1] signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 8E FE ep_only = true [T-PACK v0.5c -m2] signature = 68 ?? ?? FD 60 BE ?? ?? BF ?? ?? B9 ?? ?? F3 A4 8B F7 BF ?? ?? FC 46 E9 CE FD ep_only = true [TASM / MASM] signature = 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 ep_only = true [tElock 0.99 - 1.0 private -> tE!] signature = E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 ep_only = true [tElock v0.60] signature = E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 ep_only = true [tElock v0.70] signature = 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 ep_only = true [tElock v0.71] signature = 60 E8 ED 10 00 00 C3 83 ep_only = true [tElock v0.71b2] signature = 60 E8 44 11 00 00 C3 83 ep_only = true [tElock v0.71b7] signature = 60 E8 48 11 00 00 C3 83 ep_only = true [tElock v0.80] signature = 60 E8 F9 11 00 00 C3 83 ep_only = true [tElock v0.85f] signature = 60 E8 02 00 00 00 CD 20 E8 00 00 00 00 5E 2B C9 58 74 02 ep_only = true [tElock v0.90] signature = ?? ?? E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B ep_only = true [tElock v0.98] signature = E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? 1E ep_only = true [Thinstall vx.x] signature = B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF ep_only = true [TopSpeed v3.01 1989] signature = 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 ep_only = true [Turbo C] signature = BC ?? ?? E8 ?? ?? 2E 8E ?? ?? ?? E8 ?? ?? 2E 80 ?? ?? ?? ?? 75 ?? E8 ?? ?? 8B C3 2E F7 ?? ?? ?? E8 ep_only = true [Turbo C 1987 or Borland C++ 1991] signature = FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 ep_only = true [Turbo C 1988] signature = 8C D8 BB ?? ?? 8E DB 8C D3 8B CC FA 8E ?? ?? ?? BC ep_only = true [Turbo C 1990 or Turbo C 1988] signature = BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 8B ?? ?? ?? 8B ?? ?? ?? 8E DA ep_only = true [Turbo C++ 3.0 1990] signature = 8C CA 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C 06 ep_only = true [Turbo or Borland Pascal v7.0] signature = 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 ep_only = true [Turbo Pascal v2.0 1984] signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 ep_only = true [Turbo Pascal v3.0 1985] signature = ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 35 ep_only = true [TurboBAT v3.10 .. 5.0] signature = BA ?? ?? B4 09 ?? ?? 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ?? ?? 26 ?? ?? ?? 24 0F 3A C4 ep_only = true [TurboBAT v3.10 .. 5.0 (Patched)] signature = 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 ep_only = true [TXT2COM (Read-A-Matic v1.0)] signature = B8 ?? ?? 8E D8 8C 06 ?? ?? FA 8E D0 BC ?? ?? FB B4 ?? CD 21 A3 ?? ?? 06 50 B4 34 CD 21 ep_only = true [UG2002 Cruncher v0.3b3] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? E8 0D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 ep_only = true [Unknown by SMT] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB ep_only = true [Unknown encryptor (2) - "PK7Tjrvx"] signature = 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 ep_only = true [Unknown packer (01)] signature = EB ?? ?? BE ?? ?? BF ?? ?? 2E ep_only = true [Unknown packer (02)] signature = FA 8C DE 8C CF 8E DF 8E C7 83 C7 ?? BB ep_only = true [Unknown packer (03)] signature = 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C ep_only = true [Unknown packer (04)] signature = BC ?? ?? C3 2E FF 2E ?? ?? CF ep_only = true [Unknown packer (06)] signature = FA B8 ?? ?? BE ?? ?? 33 F0 0E 17 2E ?? ?? ?? BA ?? ?? 87 E6 5B 33 DC ep_only = true [Unknown packer (07)] signature = 8C C8 05 ?? ?? 50 B8 ?? ?? 50 B0 ?? 06 8C D2 06 83 ep_only = true [Unknown Protected Mode compiler (1)] signature = FA BC ?? ?? 8C C8 8E D8 E8 ?? ?? E8 ?? ?? E8 ?? ?? 66 B8 ?? ?? ?? ?? 66 C1 ep_only = true [Unknown Protected Mode compiler (2)] signature = FA FC 0E 1F E8 ?? ?? 8C C0 66 0F B7 C0 66 C1 E0 ?? 66 67 A3 ep_only = true [Upack v0.10 - v0.12Beta -> Sign by hot_UNP] signature = BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 ep_only = true [Upack V0.1X-V0.2X -> Dwing] signature = BE 88 01 ?? ?? AD 8B F8 95 ep_only = true [Upack v0.21Beta -> Sign by hot_UNP] signature = BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 ep_only = true [Upack v0.22 ~ v0.23Beta -> Sign by hot_UNP] signature = 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 ep_only = true [Upack v0.24 ~ v0.28alpha -> Sign by hot_UNP] signature = BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD ep_only = true [Upack v0.29 beta -> Dwing] signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 29 ep_only = true [Upack v0.2Beta] signature = BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 ep_only = true [Upack v0.30 beta -> Dwing] signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 ep_only = true [Upack v0.31 beta -> Dwing] signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 ep_only = true [Upack v0.32 beta -> Dwing] signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 32 ep_only = true [Upack v0.33 ~ v0.34 Beta -> Sign by hot_UNP] signature = ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 ep_only = true [Upack V0.36 -> Dwing] signature = BE ?? ?? ?? ?? FF 36 E9 C3 00 00 00 ep_only = true [Upack V0.37-V0.39 -> Dwing] signature = BE ?? ?? ?? ?? AD 50 FF ?? ?? EB ep_only = true [Upack v0.39 final -> Sign by hot_UNP] signature = 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 ep_only = false [Upack v0.39 final -> Sign by hot_UNP] signature = FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF ep_only = false [Upack V0.3X -> Dwing] signature = 60 E8 09 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 5E 87 0E ep_only = true [Upack_Patch -> Sign by hot_UNP] signature = 81 3A 00 00 00 02 00 00 00 00 ep_only = true [Upack_Patch or any Version -> Sign by hot_UNP] signature = 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 ep_only = true [Upack_Unknown (DLL ???) -> Sign by hot_UNP] signature = 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 ep_only = true [UPX 0.50 - 0.70] signature = 60 E8 00 00 00 00 58 83 E8 3D ep_only = true [UPX 0.72] signature = 60 E8 00 00 00 00 83 CD FF 31 DB 5E ep_only = true [UPX Modifier v0.1x] signature = 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD ep_only = true [UPX Protector v1.0x] signature = EB EC ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 ep_only = true [UPX Protector v1.0x (2)] signature = EB ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB ep_only = false [UPX v0.62] signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? 31 DB ?? ?? ?? EB ep_only = true [UPX v0.62 [DLL]] signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 ep_only = true [UPX v0.70] signature = 8C CB B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8D ?? ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC 2E ?? ?? ?? ?? 73 ep_only = true [UPX v0.70] signature = 60 E8 ?? ?? ?? ?? 58 83 ?? ?? 50 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 83 ?? ?? 31 DB EB ep_only = true [UPX v0.71 [DLL]] signature = 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 ep_only = true [UPX v0.72] signature = 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB ep_only = true [UPX v0.76.1 [dos exe]] signature = B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC ep_only = true [UPX v0.76.1 [pe exe]] signature = 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB ep_only = true [UPX v0.89.6 - v1.02 / v1.05 - v1.22 DLL] signature = 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF ep_only = true [UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub] signature = 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B ep_only = true [UPX [com]] signature = B9 ?? ?? BE ?? ?? BF C0 FF FD ep_only = true [UPX$HiT v0.0.1] signature = 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 ep_only = false [Upx-Lock 1.0 - 1.2 --> CyberDoom / Team-X & BoB / BobSoft] signature = 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 ep_only = true [UPX-Scrambler RC v1.x] signature = 90 61 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF ep_only = true [UPXFreak V0.1 -> HMX0101] signature = BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 ep_only = true [UPXLock v1.0 -> CyberDoom] signature = 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00 ep_only = true [USERNAME v3.00] signature = FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 ep_only = true [VBOX v4.2 MTE] signature = 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 ep_only = true [VBOX v4.3 - v4.6] signature = ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40 ep_only = false [Vcasm Protector V1.X -> vcasm] signature = EB ?? 5B 56 50 72 6F 74 65 63 74 5D ep_only = true [Vcasm-Protector 1.0e -> vcasm] signature = EB 0A 5B 56 50 72 6F 74 65 63 74 5D ep_only = true [Vcasm-Protector 1.1 - 1.2 -> vcasm] signature = EB 0B 5B 56 50 72 6F 74 65 63 74 5D ep_only = true [vfp&exeNc V5.00 -> Wang JianGuo] signature = 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC ep_only = true [Video-Lan-Client] signature = 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF FF ep_only = true [Virogen Crypt v0.75] signature = 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 ep_only = true [Virogen`s PE Shrinker v0.14] signature = 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 ep_only = true [VIRUS - I-Worm.KLEZ] signature = 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 ep_only = false [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 06 ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F B7 06 ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 8B 06 ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 58 ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 59 ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5A ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 EC 5B ep_only = true [VMProtect v1.25 --> PolyTech] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 55 50 52 ep_only = true [VMProtect V1.X -> PolyTech] signature = 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 ep_only = false [VOB ProtectCD] signature = 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F ep_only = true [Vterminal V1.0X -> Lei Peng] signature = E8 00 00 00 00 58 05 ?? ?? ?? ?? 9C 50 C2 04 00 ep_only = true [Vx: Caz.1204] signature = E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 ep_only = true [Vx: CIH Version 1.2 TTIT (! WIN95CIH !)] signature = 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D ep_only = true [Vx: Compiler] signature = 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E ep_only = true [Vx: Danish tiny] signature = 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 ep_only = true [Vx: Eddie.2100] signature = E8 ?? ?? 4F 4F 0E E8 ?? ?? 47 47 1E FF ?? ?? CB E8 ?? ?? 84 C0 ?? ?? 50 53 56 57 1E 06 B4 51 CD 21 8E C3 ?? ?? ?? ?? ?? ?? ?? 8B F2 B4 2F CD 21 AC ep_only = true [Vx: Eddie.based.1745] signature = E8 ?? ?? 5E 81 EE ?? ?? FC ?? 2E ?? ?? ?? ?? 4D 5A ?? ?? FA ?? 8B E6 81 ?? ?? ?? FB ?? 3B ?? ?? ?? ?? ?? 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 ep_only = true [Vx: Explosion.1000] signature = E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 ep_only = true [Vx: FaxFree.Topo] signature = FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB ep_only = true [Vx: GRUNT.2.Family] signature = 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 ep_only = true [Vx: Hafen.1641] signature = E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC ep_only = true [Vx: Haryanto] signature = 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB ep_only = true [Vx: Heloween.1172] signature = E8 ?? ?? 5E 81 EE ?? ?? 56 50 06 0E 1F 8C C0 01 ?? ?? 01 ?? ?? 80 ?? ?? ?? ?? 8B ?? ?? A3 ?? ?? 8A ?? ?? A2 ?? ?? B8 ?? ?? CD 21 3D ep_only = true [Vx: Horse.1776] signature = E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 ep_only = true [Vx: Hymn.1865] signature = E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 ep_only = true [Vx: Igor] signature = 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C ep_only = true [Vx: Involuntary.1349] signature = ?? BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB ep_only = true [Vx: KBDflags.1024] signature = 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 ep_only = true [Vx: Keypress.1212] signature = E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB ep_only = true [Vx: Kuku.448] signature = AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB ep_only = true [Vx: MTE (non-encrypted)] signature = F7 D9 80 E1 FE 75 02 49 49 97 A3 ?? ?? 03 C1 24 FE 75 02 48 ep_only = true [Vx: Ncu-Li.1688] signature = 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 ep_only = true [Vx: Necropolis] signature = 50 FC AD 33 C2 AB 8B D0 E2 F8 ep_only = true [Vx: Necropolis.1963] signature = B4 30 CD 21 3C 03 ?? ?? B8 00 12 CD 2F 3C FF B8 ?? ?? ?? ?? B4 4A BB 40 01 CD 21 ?? ?? FA 0E 17 BC ?? ?? E8 ?? ?? FB A1 ?? ?? 0B C0 ep_only = true [Vx: Noon.1163] signature = E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC ep_only = true [Vx: November 17.768] signature = E8 ?? ?? 5E 81 EE ?? ?? 50 33 C0 8E D8 80 3E ?? ?? ?? 0E 1F ?? ?? FC ep_only = true [Vx: Number One] signature = F9 07 3C 53 6D 69 6C 65 3E E8 ep_only = true [Vx: Phoenix.927] signature = E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 ep_only = true [Vx: Predator.2448] signature = 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC ep_only = true [Vx: Quake.518] signature = 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 ep_only = true [Vx: SK] signature = CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 ep_only = true [Vx: Slowload] signature = 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 ep_only = true [Vx: Sonik Youth] signature = 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB ep_only = true [Vx: Spanz] signature = E8 00 00 5E 81 EE ?? ?? 8D 94 ?? ?? B4 1A CD 21 C7 84 ep_only = true [Vx: SYP] signature = 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A ep_only = true [Vx: TravJack.883] signature = EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 ep_only = true [Vx: Trivial.25] signature = B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD ep_only = true [Vx: Trivial.46] signature = B4 4E B1 20 BA ?? ?? CD 21 BA ?? ?? B8 ?? 3D CD 21 ep_only = true [Vx: Trojan.Telefoon] signature = 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 ep_only = true [Vx: VCL] signature = AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 ep_only = true [Vx: VCL (encrypted)] signature = 01 B9 ?? ?? 81 34 ?? ?? 46 46 E2 F8 C3 ep_only = true [Vx: VCL (encrypted)] signature = 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 ep_only = true [Vx: VirusConstructor(IVP).based] signature = E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 ep_only = true [Vx: VirusConstructor.based] signature = BB ?? ?? B9 ?? ?? 2E ?? ?? ?? ?? 43 43 ?? ?? 8B EC CC 8B ?? ?? 81 ?? ?? ?? 06 1E B8 ?? ?? CD 21 3D ?? ?? ?? ?? 8C D8 48 8E D8 ep_only = true [Vx: VirusConstructor.based] signature = E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 ep_only = true [Vx: XPEH.4768] signature = E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 ep_only = true [WARNING -> TROJAN -> HuiGeZi] signature = 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF ep_only = true [WARNING -> TROJAN -> RobinPE] signature = 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 ep_only = true [WARNING -> TROJAN -> XiaoHui] signature = 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 ep_only = true [WATCOM C/C++] signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 ep_only = true [WATCOM C/C++ 32 Run-Time System 1988-1994] signature = FB 83 ?? ?? 89 E3 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 66 ?? ?? ?? 66 ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 29 C0 B4 30 CD 21 ep_only = true [WATCOM C/C++ 32 Run-Time System 1988-1995] signature = E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 54 43 4F 4D ?? 43 2F 43 2B 2B 33 32 ?? 52 75 ep_only = true [WATCOM C/C++ 32 Run-Time System 1989, 1994] signature = 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 ep_only = true [WATCOM C/C++ Run-Time system+DOS4GW DOS Extender 1988-93] signature = BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3 ep_only = true [WinRAR 32-bit SFX Module] signature = E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF ep_only = true [WinUpack v0.30 beta -> By Dwing] signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ep_only = false [WinZip (32-bit) 6.x] signature = FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 ep_only = true [with added 'PK' signature] signature = C7 ?? ?? ?? ?? ?? 8C D8 05 ep_only = true [WWPACK v3.00, v3.01 (Relocations pack)] signature = BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC ep_only = true [WWPack32 v1.00, v1.11, v1.12, v1.20] signature = 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 ep_only = true [WWPack32 v1.x] signature = 53 55 8B E8 33 DB EB 60 ep_only = true [X-Pack v1.4.2] signature = 72 ?? C3 8B DE 83 ?? ?? C1 ?? ?? 8C D8 03 C3 8E D8 8B DF 83 ?? ?? C1 ?? ?? 8C C0 03 C3 8E C0 C3 ep_only = false [X-PEOR v0.99b] signature = E8 00 00 00 00 5D 8B CD 81 ED 7A 29 40 00 89 AD 0F 6D 40 00 ep_only = true [X-PEOR v0.99b] signature = E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40 ep_only = true [XCR v0.12] signature = 60 9C E8 ?? ?? ?? ?? 8B DD 5D 81 ED ?? ?? ?? ?? 89 9D ep_only = true [XPack 1.52 - 1.64] signature = 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB ep_only = true [XPack 1.67 [com]] signature = E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 ep_only = true [xPEP 0.3x -> xIkUg] signature = 55 53 56 51 52 57 E8 16 00 00 00 ep_only = true [Xtreme-Protector v1.05] signature = E9 ?? ?? 00 00 00 00 00 00 00 00 ep_only = true [y0da's Crypter v1.x / Modified] signature = 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC ep_only = true [yoda's Protector 1.0x-->Ashkbiz Danehkar] signature = 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ep_only = true [ZCode Win32/PE Protector v1.01] signature = E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 ep_only = true [Zortech C] signature = E8 ?? ?? 2E FF ?? ?? ?? FC 06 ep_only = true [Zortech C v2.00 1988, 1989] signature = FA B8 ?? ?? 8E D8 8C ?? ?? ?? 26 8B ?? ?? ?? 89 1E ?? ?? 8B D8 2B 1E ?? ?? 89 1E ep_only = true [Zortech C v3.0] signature = FA FC B8 ?? ?? ?? 8C C8 8E D8 ep_only = true [Zurenava DOS Extender v0.45, v0.49] signature = BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 ep_only = true [[MSLRH] V0.31 -> emadicius] signature = 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 ep_only = true [心奇EXE合并器 -> yy66] signature = 68 78 18 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 ep_only = true [aPack v0.98b -> Jibz] signature = 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA ep_only = false [aPack v0.98b [com]] signature = BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 ep_only = false [aPack v0.98b [exe]] signature = 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA ep_only = false [AsCrypt v0.1 -> SToRM - needs to be added] signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 83 ?? ?? E2 ep_only = false [AsCrypt v0.1 -> SToRM - needs to be added] signature = 83 ?? ?? E2 ?? ?? E2 ?? FF ep_only = false [AsCrypt v0.1 -> SToRM - needs to be added] signature = 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 E2 ep_only = false [AsCrypt v0.1 -> SToRM - needs to be added] signature = 81 ?? ?? ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? ?? 83 ?? ?? E2 ?? EB ep_only = false [ASProtect v2.0] signature = 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ep_only = false [Crunch 4] signature = EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ep_only = false [Crunch 5 Fusion 4] signature = EB 15 03 ?? ?? ?? 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 E8 ep_only = false [Dev-C++ v5] signature = 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ep_only = false [ENIGMA Protector -> Sukhov Vladimir] signature = 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 ep_only = false [ENIGMA Protector V1.X-> Sukhov Vladimir] signature = 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 ep_only = false [EXECryptor V2.1X -> softcomplete.com] signature = 83 C6 14 8B 55 FC E9 ?? FF FF FF ep_only = false [EXECryptor V2.2X -> softcomplete.com] signature = FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 ep_only = false [eXPressor v1.2 -> CGSoftLabs] signature = 45 78 50 72 2D 76 2E 31 2E 32 2E ep_only = false [eXPressor v1.3 -> CGSoftLabs] signature = 45 78 50 72 2D 76 2E 31 2E 33 2E ep_only = false [eXPressor v1.4 -> CGSoftLabs] signature = 65 58 50 72 2D 76 2E 31 2E 34 2E ep_only = false [FASM v1.5x] signature = 6A 00 FF 15 ?? ?? 40 00 A3 ?? ?? 40 00 ep_only = false [Free Pascal 0.99.10] signature = E8 00 6E 00 00 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 29 ep_only = false [Free Pascal v1.0.10 (win32 console)] signature = C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC ep_only = false [Free Pascal v1.06] signature = C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ep_only = false [Gleam 1.00] signature = 83 EC 0C 53 56 57 E8 24 02 00 ep_only = false [kkrunchy v0.17 -> F. Giesen] signature = FC FF 4D 08 31 D2 8D 7D 30 BE ep_only = false [MEW 10 by Northfox] signature = 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 ep_only = false [MEW 11 SE v1.1] signature = E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ep_only = false [Microsoft Visual Basic 5.0] signature = FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 ep_only = false [Microsoft Visual Basic v5.0 - v6.0] signature = FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ep_only = false [Microsoft Visual Basic v5.0 - v6.0] signature = 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 ?? 00 00 00 30 ?? 00 ep_only = false [Microsoft Visual Basic v6.0] signature = FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 ep_only = false [Microsoft Visual C 5.0] signature = 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 A8 53 56 57 ep_only = false [Microsoft Visual C++ 6.0 DLL (Debug)] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83 ep_only = false [Microsoft Visual C++ 7.0 DLL] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 85 F6 57 8B 7D 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 ep_only = false [Microsoft Visual C++ v6.0] signature = 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 ep_only = false [Microsoft Visual C++ v7.0 DLL] signature = 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 ep_only = false [MoleBox v2.0] signature = E8 ?? ?? ?? ?? 60 E8 4F ep_only = false [nSpack V2.3 -> LiuXingPing] signature = 9C 60 70 61 63 6B 24 40 ep_only = false [nSpack V2.x -> LiuXingPing] signature = 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ep_only = false [NsPack V2.X -> LiuXingPing] signature = 6E 73 70 61 63 6B 24 40 ep_only = false [PE Spin v0.4x] signature = EB 01 68 60 E8 00 00 00 00 8B ep_only = false [PE-Protect 0.9 by Cristoph Gabler 1998] signature = 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 ep_only = false [PeStubOEP v1.x] signature = E8 05 00 00 00 33 C0 40 48 C3 E8 05 ep_only = false [PeStubOEP v1.x] signature = 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF ep_only = false [PeStubOEP v1.x] signature = ?? ?? B8 ?? ?? ?? 00 FF E0 ep_only = false [Petite 1.3] signature = 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 ep_only = false [Petite 1.4] signature = 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC ep_only = false [Petite 2.1] signature = 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 ep_only = false [PolyCrypt PE - 2.1.4b/2.1.5 -> JLab Software Creations (h-oep)] signature = 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB ep_only = false [PolyEnE 0.01+ by Lennart Hedlund] signature = 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0 ep_only = false [Private EXE v2.0a] signature = 53 E8 ?? ?? ?? ?? 5B 8B C3 2D ep_only = false [RAR-SFX Archive (1)] signature = 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 52 53 46 58 ep_only = false [RatPacker (Glue) stub] signature = 40 20 FF ?? ?? ?? ?? ?? ?? ?? ?? BE ?? 60 40 ?? 8D BE ?? B0 FF FF ep_only = false [RCryptor v1.1 --> Vaska] signature = 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 ep_only = false [Safe 2.0] signature = 83 EC 10 53 56 57 E8 C4 01 00 ep_only = false [SafeDisc v4] signature = 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F ep_only = false [Setup2Go Installer Stub] signature = 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 ep_only = false [Shrinker 3.2] signature = 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 ep_only = false [Shrinker 3.3] signature = 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 ep_only = false [Shrinker 3.4] signature = 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 ep_only = false [SPLayer v0.08] signature = 8D 40 00 B9 ?? ?? ?? ?? 6A ?? 58 C0 0C ?? ?? 48 ?? ?? 66 13 F0 91 3B D9 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ep_only = false [Trilobyte's JPEG graphics Library] signature = 84 10 FF FF FF FF 1E 00 01 10 08 00 00 00 00 00 ep_only = false [Upack v0.29 Beta ~ v0.31 Beta -> Sign by hot_UNP] signature = BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 ep_only = false [Upack v0.32 Beta (Patch) -> Sign by hot_UNP] signature = BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 ep_only = false [Upack v0.32 Beta -> Sign by hot_UNP] signature = BE 88 01 ?? ?? AD 50 ?? AD 91 ?? F3 A5 ep_only = false [Upack v0.32 Beta -> Sign by hot_UNP] signature = BE 88 01 ?? ?? AD 50 ?? ?? AD 91 F3 A5 ep_only = false [Upack v0.35 alpha -> Sign by hot_UNP] signature = 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 ep_only = false [Upack v0.36 alpha -> Sign by hot_UNP] signature = AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 ep_only = false [Upack v0.37 ~ v0.38 Beta (Strip base relocation table Option)-> Sign by hot_UNP] signature = 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 ep_only = false [UPX$HiT 0.0.1 -> sibaway7@yahoo.com] signature = E2 FA 94 FF E0 61 00 00 00 00 00 00 00 ep_only = false [VIRUS - I-Worm.Hybris] signature = EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 ep_only = false [WinUpack v0.30 beta -> By Dwing (h)] signature = E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 ep_only = false [ASPack 1.08] signature = 90 90 90 75 01 90 E9 ep_only = true [ASPack v1.06b] signature = 90 90 90 75 00 E9 ep_only = true [ASPack v1.06b] signature = 90 75 00 E9 ep_only = true [ASPack v1.06b] signature = 90 90 75 00 E9 ep_only = true [ASPack v1.07b] signature = 90 90 75 ?? E9 ep_only = true [ASPack v1.07b] signature = 90 90 90 75 ?? E9 ep_only = true [ASPack v1.07b] signature = 90 75 ?? E9 ep_only = true [ASPack v1.08] signature = 90 75 01 FF E9 ep_only = true [ASPack v1.08] signature = 90 90 90 75 01 FF E9 ep_only = true [ASPack v1.08] signature = 90 90 75 01 FF E9 ep_only = true [ASPack v1.08.01] signature = 90 90 75 ?? 90 E9 ep_only = true [ASPack v1.08.01] signature = 90 75 ?? 90 E9 ep_only = true [ASPack v1.08.01] signature = 90 90 90 75 ?? 90 E9 ep_only = true [ASPack v1.08.02] signature = 90 90 75 01 90 E9 ep_only = true [ASPack v1.08.02] signature = 90 75 01 90 E9 ep_only = true [ASPack v1.08.04] signature = 60 E8 ?? ?? ?? ?? EB ep_only = true [ASPack v2.11] signature = 60 E9 3D 04 00 00 ep_only = true [ASProtect v1.1 BRS] signature = 60 E9 ?? 05 ep_only = true [ASProtect v1.1 MTEb] signature = 90 60 E9 ?? 04 ep_only = true [ASProtect v1.2] signature = 68 01 ?? ?? ?? C3 ep_only = true [ASProtect vx.x] signature = 90 60 ?? ?? ?? 00 00 ep_only = true [Crunch V5.0 -> Bitarts] signature = EB 15 03 00 00 00 06 ep_only = true [Crunch/PE v5.0] signature = EB 15 03 ?? ?? ?? 06 ep_only = false [EP v2.0] signature = 6A ?? 60 E9 01 01 ep_only = true [EXEPACK v5.31.009 (LINK v3.69)] signature = 8B E8 8C C0 ep_only = true [Hasp 4 envelope dongle (Alladin)] signature = 10 02 D0 51 0F 00 83 ep_only = true [Hide&Protect V1.0X-> SoftWar Company] signature = 90 90 90 E9 D8 ep_only = true [Mew 10 v1.0 (Eng) -> Northfox] signature = 33 C0 E9 ?? ?? ?? FF ep_only = true [MEW 11 SE v1.1 -> Northfox [HCC]] signature = E9 ?? ?? ?? FF 0C ep_only = true [NeoLite v1.0] signature = E9 9B 00 00 00 A0 ep_only = true [Neolite v2.0] signature = E9 A6 00 00 00 ep_only = true [NFO v1.x modified] signature = 60 9C 8D 50 ep_only = true [Obsidium v1.0.0.61] signature = E8 AF 1C 00 00 ep_only = true [PCIENC Cryptor] signature = 06 50 43 49 45 4E ep_only = false [PEQuake V0.06 -> forgat] signature = E8 A5 00 00 00 ep_only = true [PESHiELD v0.25] signature = 60 E8 2B 00 00 00 ep_only = true [pex V0.99 -> params] signature = E9 F5 00 00 00 ep_only = true [PROTECT! EXE/COM v5.0] signature = 1E 0E 0E 1F 07 ep_only = true [Safeguard 1.0 -> Simonzh] signature = E8 00 00 00 00 EB 29 ep_only = true [Symantec C v2.10, v4.00 or Zortech C v3.0r1] signature = FA FC B8 ?? ?? 8E D8 ep_only = true [TAV] signature = E8 ?? ?? 4D 5A CB ep_only = true [tElock v0.7x - v0.84] signature = 60 E8 00 00 C3 83 ep_only = true [tElock v0.92a] signature = E9 7E E9 FF FF 00 ep_only = true [tElock v0.95] signature = E9 D5 E4 FF FF 00 ep_only = true [tElock v0.96] signature = E9 59 E4 FF FF 00 ep_only = true [tElock v0.98b1] signature = E9 25 E4 FF FF ep_only = true [tElock v0.98b2] signature = E9 1B E4 FF FF ep_only = true [tElock v1.00] signature = E9 E5 E2 FF FF ep_only = true [Turbo Basic v1.0 1987] signature = 2E 8C ?? ?? ?? 2E C7 ep_only = true [TXT2COM] signature = E8 ?? ?? CD 20 ep_only = true [UNITA3 (tm) by Sanitary Equipment Research] signature = E8 ?? ?? 4D 5A 3E ep_only = true [Unknown Packer -> Northfox] signature = 54 59 68 61 7A 79 ep_only = true [Upack_Patch -> Sign by hot_UNP] signature = 2A A3 F2 54 CE ep_only = false [VOB ProtectCD 5] signature = 36 3E 26 8A C0 60 E8 ep_only = true [Vx: GRUNT.1.Family] signature = 01 B9 ?? 00 31 17 ep_only = true readpe-0.84/src/windows/000077500000000000000000000000001455661113700151775ustar00rootroot00000000000000readpe-0.84/src/windows/Makefile000066400000000000000000000002361455661113700166400ustar00rootroot00000000000000CFLAGS = -O2 -W -Wall -Wextra -std=c99 -pedantic pev_BUILDDIR = ../build/ all: cc $(CFLAGS) -o $(pev_BUILDDIR)/cpload.exe cpload.c clean: rm -f cpload.exe readpe-0.84/src/windows/cpload.c000066400000000000000000000101521455661113700166040ustar00rootroot00000000000000/* pev - the PE file analyzer toolkit cpload.c - CPL file loader Copyright (C) 2013 - 2014 pev authors This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . In addition, as a special exception, the copyright holders give permission to link the code of portions of this program with the OpenSSL library under certain conditions as described in each individual source file, and distribute linked combinations including the two. You must obey the GNU General Public License in all respects for all of the code used other than OpenSSL. If you modify file(s) with this exception, you may extend this exception to your version of the file(s), but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. If you delete this exception statement from all source files in the program, then also delete it here. */ #include #include #include typedef int (*cplapplet) (void*,int,void*,void*); int main(int argc, char* argv[]) { cplapplet _cplapplet; HINSTANCE dll; char* filename; CPLINFO cplinfo; NEWCPLINFO newcplinfo; char *msg; char* msgs[] = { "null", "init", "getcount", "inquire", "select", "dblclk", "stop", "exit", "newinquire", "null", "startwparms", "setup" }; if (argc == 2) filename = argv[1]; // cpload file.cpl else if (argc == 4) filename = argv[3]; // cpload -m MESSAGE file.cpl else { printf( "\nUsage:\n\tcpload [-m MESSAGE] \n\n" "If -m is present, MESSAGE should be:\n\n" "\tOption\t\tMessage\n" "\t------------------------------\n" "\tinit\t\tCPL_INIT\n" "\tgetcount\tCPL_GETCOUNT\n" "\tinquire\t\tCPL_INQUIRE\n" "\tselect\t\tCPL_SELECT\n" "\tdblclk\t\tCPL_DBLCLK\n" "\tstop\t\tCPL_STOP\n" "\texit\t\tCPL_EXIT\n" "\tnewinquire\tCPL_NEWINQUIRE\n" "\tstartwparms\tCPL_STARTWPARMS\n" "\tsetup\t\tCPL_SETUP\n" "\nOtherwise, cpload will send all messages to CPlApplet()\n" ); return 1; } printf("loading library...\n"); if (IsDebuggerPresent()) __asm__("int $3"); if (NULL == (dll = LoadLibrary(filename))) { fprintf(stderr, "file not found or not a valid CPL\n"); return 1; } printf("looking for CPlApplet()...\n"); _cplapplet = (cplapplet) GetProcAddress(dll, "CPlApplet"); if (!_cplapplet) { fprintf(stderr, "CPlApplet function not found. Aborting...\n"); return 1; } if (argc == 4) { msg = argv[2]; for (int i=1; i<=11; i++) { if (i==9) continue; if (!strncmp(msg, msgs[i], strlen(msgs[i]))) { if (IsDebuggerPresent()) __asm__("int $3"); printf("sending %s message...\n", msgs[i]); if (i == CPL_INQUIRE) _cplapplet(NULL, CPL_INQUIRE, 0, &cplinfo); // lParam1 is applet # - lParam2 is ptr to CPLINFO struct else if (i == CPL_NEWINQUIRE) _cplapplet(NULL, CPL_NEWINQUIRE, 0, &newcplinfo); else _cplapplet(NULL, i, NULL, NULL); break; } } } else // send all messages { if (IsDebuggerPresent()) __asm__("int $3"); _cplapplet(NULL, CPL_INIT, NULL, NULL); _cplapplet(NULL, CPL_GETCOUNT, NULL, NULL); _cplapplet(NULL, CPL_INQUIRE, 0, &cplinfo); // lParam1 is applet # - lParam2 is ptr to CPLINFO struct _cplapplet(NULL, CPL_SELECT, NULL, NULL); _cplapplet(NULL, CPL_DBLCLK, NULL, NULL); _cplapplet(NULL, CPL_STOP, NULL, NULL); _cplapplet(NULL, CPL_EXIT, NULL, NULL); _cplapplet(NULL, CPL_NEWINQUIRE, 0, &newcplinfo); _cplapplet(NULL, CPL_STARTWPARMS, NULL, NULL); _cplapplet(NULL, CPL_SETUP, NULL, NULL); } FreeLibrary(dll); return 0; } readpe-0.84/src/windows/run.bat000077500000000000000000000002321455661113700164730ustar00rootroot00000000000000@echo off set CYGWIN=nodosfilewarning echo Welcome to pev - the PE file analysis toolkit! echo. echo Available tools: echo. dir /b *.exe cmd /k remreadpe-0.84/tests/000077500000000000000000000000001455661113700140605ustar00rootroot00000000000000readpe-0.84/tests/run.sh000077500000000000000000000227771455661113700152420ustar00rootroot00000000000000#!/bin/bash ROOT_DIR=. INC_DIR=include SRC_DIR=src TOOLS_DIR=$SRC_DIR/build TESTS_DIR=tests REPORTS_DIR=$TESTS_DIR/running_report EXPECTED_OUTPUTS_DIR=$TESTS_DIR/expected_outputs SUPPORTED_FORMATS="csv html json text xml" BINDIFF=$(which diff) now=$(date +"%F_%H-%M") arch=$(uname -m) so=$(uname -s) # We use `-s` because `-o` is not supported on Mac OS X so=${so#*/} version=$(sed -n 's/^.*VERSION \"\([0-9]\.[0-9]*\)\"/\1/p' $INC_DIR/common.h) err=0 function test_build { . $TESTS_DIR/test_build.sh } function test_binary { local onsuccess=$1; shift; local onfailure=$1; shift; local logname=$1; shift; local binname=$1; shift; local args=$* if [ ! -d $REPORTS_DIR/${binname} ] then mkdir -p $REPORTS_DIR/${binname} fi echo -n "Testing ${binname} ${args}... " if $TOOLS_DIR/${binname} ${args} > "$REPORTS_DIR/${binname}/${now}_${binname}_${logname}.txt" then eval ${onsuccess} else eval ${onfailure} err=1 return # Stop at error fi } function test_binary_using_all_formats { local onsuccess=$1; shift; local onfailure=$1; shift; local logname=$1; shift; local binname=$1; shift; local args=$* # First run using the default output format. test_binary "${onsuccess}" "${onfailure}" "${logname}" ${binname} ${args} # Then run using every supported output format. for format in $SUPPORTED_FORMATS do echo -n "Testing ${binname} -f ${format} ${args}... " if $TOOLS_DIR/${binname} -f ${format} ${args} > "$REPORTS_DIR/${binname}/${now}_${binname}_${logname}_${format}.txt" then eval ${onsuccess} else eval ${onfailure} err=1 break # Stop at 1st error fi done } function test_binary_output_against_expected_output { local onsuccess=$1; shift; local onfailure=$1; shift; local logname=$1; shift; local binname=$1; shift; local binsample=$1; shift; local args=$*; local reported_output="$EXPECTED_OUTPUTS_DIR/_tmp/${binsample}/${binname}_${logname}.txt"; local expected_output_ok="$EXPECTED_OUTPUTS_DIR/${binsample}/${binname}_${logname}.txt"; local expected_output_fail="$EXPECTED_OUTPUTS_DIR/${binsample}/${binname}_${logname}_fail.txt"; if [ ! -d $EXPECTED_OUTPUTS_DIR/_tmp/${binsample} ] then mkdir -p $EXPECTED_OUTPUTS_DIR/_tmp/${binsample} fi echo -n "Running $TOOLS_DIR/${binname} -f json ${args} ${binsample} &> \"${reported_output}\"... " $TOOLS_DIR/${binname} -f json ${args} ${binsample} &> "${reported_output}" local ret="$?" echo "ret=$ret" if [ "$ret" -eq "0" ] then expected_output=${expected_output_ok} else expected_output=${expected_output_fail} fi echo -n "Comparing \"${expected_output}\" against \"${reported_output}\"... " ${BINDIFF} -u "${expected_output}" "${reported_output}" &> /dev/null ret="$?" if [ "$ret" -eq "0" ] then eval ${onsuccess} else eval ${onfailure} #echo "Showing differences:" #head -n 5 tmp.diff err=1 return # Stop at error fi } function run_pepack { local binname=pepack local args=$* echo "---------- ${binname} ----------" test_binary_using_all_formats "echo OK" "echo NOK" "default" ${binname} ${args} } function run_pehash { local binname=pehash local args=$* echo "---------- ${binname} ----------" test_binary_using_all_formats "echo OK" "echo NOK" "default" ${binname} ${args} test_binary_using_all_formats "echo OK" "echo NOK" "h_dos" ${binname} -h dos ${args} test_binary_using_all_formats "echo OK" "echo NOK" "a_sha512" ${binname} -a sha512 ${args} test_binary_using_all_formats "echo OK" "echo NOK" "s_text" ${binname} -s '.text' ${args} test_binary_using_all_formats "echo OK" "echo NOK" "section_index_1" ${binname} --section-index 1 ${args} } function run_pescan { local binname=pescan local args=$* echo "---------- ${binname} ----------" test_binary_using_all_formats "echo OK" "echo NOK" "default" ${binname} ${args} test_binary_using_all_formats "echo OK" "echo NOK" "v" ${binname} -v ${args} } function run_pestr { local binname=pestr local args=$* echo "---------- ${binname} ----------" test_binary "echo OK" "echo NOK" "default" ${binname} ${args} test_binary "echo OK" "echo NOK" "n_5" ${binname} -n 5 ${args} test_binary "echo OK" "echo NOK" "o" ${binname} -o ${args} test_binary "echo OK" "echo NOK" "s" ${binname} -s ${args} } function peres_on_success { if [ -d resources ] then echo "OK" rm -rf resources else echo "binary returns OK, but no resource was extracted" fi } function run_peres { local binname=peres local args=$* echo "---------- ${binname} ----------" test_binary "echo OK" "echo NOK" "i" ${binname} -i ${args} test_binary "echo OK" "echo NOK" "s" ${binname} -s ${args} test_binary peres_on_success "echo NOK" "x" ${binname} -x ${args} test_binary peres_on_success "echo NOK" "a" ${binname} -a ${args} } function pesec_on_success { if [ -f tmp_cert -a -s tmp_cert ] then echo "OK" else echo "Command returns OK but don't export the cert to file." fi rm tmp_cert } function run_pesec { local binname=pesec local args=$* echo "---------- ${binname} ----------" test_binary_using_all_formats "echo OK" "echo NOK" "default" ${binname} ${args} test_binary_using_all_formats "echo OK" "echo NOK" "c_pem" ${binname} -c pem ${args} test_binary_using_all_formats pesec_on_success "echo NOK" "o_tmp_cert" ${binname} -o tmp_cert ${args} } function run_readpe { local binname=readpe local args=$* echo "---------- ${binname} ----------" test_binary_using_all_formats "echo OK" "echo NOK" "default" ${binname} ${args} test_binary_using_all_formats "echo OK" "echo NOK" "H" ${binname} -H ${args} test_binary_using_all_formats "echo OK" "echo NOK" "S" ${binname} -S ${args} test_binary_using_all_formats "echo OK" "echo NOK" "d" ${binname} -d ${args} test_binary_using_all_formats "echo OK" "echo NOK" "h_dos" ${binname} -h dos ${args} test_binary_using_all_formats "echo OK" "echo NOK" "i" ${binname} -i ${args} test_binary_using_all_formats "echo OK" "echo NOK" "e" ${binname} -e ${args} } function test_regression { if [ ! -d $EXPECTED_OUTPUTS_DIR ] then mkdir -p $EXPECTED_OUTPUTS_DIR fi local binsample="$1" test_binary_output_against_expected_output "echo OK" "echo NOK" "default" pepack ${binsample} test_binary_output_against_expected_output "echo OK" "echo NOK" "default" pehash ${binsample} test_binary_output_against_expected_output "echo OK" "echo NOK" "h_dos" pehash ${binsample} -h dos test_binary_output_against_expected_output "echo OK" "echo NOK" "a_sha512" pehash ${binsample} -a sha512 test_binary_output_against_expected_output "echo OK" "echo NOK" "s_text" pehash ${binsample} -s '.text' test_binary_output_against_expected_output "echo OK" "echo NOK" "section_index_1" pehash ${binsample} --section-index 1 test_binary_output_against_expected_output "echo OK" "echo NOK" "default" pescan ${binsample} test_binary_output_against_expected_output "echo OK" "echo NOK" "v" pescan ${binsample} -v test_binary_output_against_expected_output "echo OK" "echo NOK" "i" peres ${binsample} -i test_binary_output_against_expected_output "echo OK" "echo NOK" "s" peres ${binsample} -s test_binary_output_against_expected_output "echo OK" "echo NOK" "x" peres ${binsample} -x test_binary_output_against_expected_output "echo OK" "echo NOK" "a" peres ${binsample} -a test_binary_output_against_expected_output "echo OK" "echo NOK" "default" pesec ${binsample} test_binary_output_against_expected_output "echo OK" "echo NOK" "c_pem" pesec ${binsample} -c pem test_binary_output_against_expected_output "echo OK" "echo NOK" "o_tmp_cert" pesec ${binsample} -o tmp_cert test_binary_output_against_expected_output "echo OK" "echo NOK" "default" readpe ${binsample} test_binary_output_against_expected_output "echo OK" "echo NOK" "H" readpe ${binsample} -H test_binary_output_against_expected_output "echo OK" "echo NOK" "S" readpe ${binsample} -S test_binary_output_against_expected_output "echo OK" "echo NOK" "d" readpe ${binsample} -d test_binary_output_against_expected_output "echo OK" "echo NOK" "h_dos" readpe ${binsample} -h dos test_binary_output_against_expected_output "echo OK" "echo NOK" "i" readpe ${binsample} -i test_binary_output_against_expected_output "echo OK" "echo NOK" "e" readpe ${binsample} -e } function test_pe32 { if [ ! -d $REPORTS_DIR ] then mkdir -p $REPORTS_DIR fi run_pepack $1 run_pehash $1 run_pescan $1 run_peres $1 run_pestr $1 run_pesec $1 run_readpe $1 } function test_pe64 { echo 'coming soon...' } function clean { if [ -d $REPORTS_DIR ] then rm -rf $REPORTS_DIR fi rm -rf $TESTS_DIR/*.log } case "$1" in "clean") clean ;; "build") test_build ;; "pe32") if [ $# -ne 2 ] then echo "missing argument: use $0 pe32 " exit 1 else test_pe32 $2 exit $err fi ;; "pe64") test_pe64 exit $err ;; "regression") if [ $# -ne 2 ] then echo "missing argument: use $0 regression " exit 1 else test_regression $2 exit $err fi ;; *) echo "illegal option -- $1" echo "usage: run.sh