本帖最后由 白影33 于 2022-9-25 12:26 编辑
0x0前言
本文仅为学习交流逆向技术
0x1定位验证算法
对函数GetWindowTextA下断点，第二次断下可以在堆栈中看见自己输入的name，aaaaaaaa，
验证算法对他们进行各种操作，所以肯定会读取的，对aaaaaaaa下个内存访问断点，
当断下时在系统里领空的时候，就不要管他，直到断在用户的内存领空，
这个应该就是验证函数的内部，但还是不能百分百确定，
向下可以找到弹出messagebox的地方，messagebox上面的判断应该就是确定，是否跳向弹出成功的messagebox，
我输入的注册码是错误的，所以这里的跳转肯定是跳向失败，我们就让他向相反的地方跳转。
提示注册成功，那这里就是验证算法函数无疑了，这么做可以达到爆破的效果，但是重启会重新验证
0x2逆向验证算法
[C++] 纯文本查看 复制代码 int __thiscall KeyFC(CWnd *this)
{
CWnd *v1; // ebp
const char *v2; // ST14_4
CString *v3; // ecx
int v4; // eax
int v5; // eax
int v6; // eax
signed int v7; // esi
char *v8; // edi
unsigned __int8 *v9; // eax
_DWORD *v10; // ecx
signed int v11; // eax
int v12; // edx
const char *v13; // ST14_4
const char *v14; // ST14_4
char v16; // [esp+Ch] [ebp-468h]
char v17; // [esp+10h] [ebp-464h]
const char *v18; // [esp+14h] [ebp-460h]
char v19; // [esp+18h] [ebp-45Ch]
char v20; // [esp+1Ch] [ebp-458h]
int serial; // [esp+20h] [ebp-454h]
int v22; // [esp+24h] [ebp-450h]
char v23; // [esp+28h] [ebp-44Ch]
char nameOrcompany[2]; // [esp+68h] [ebp-40Ch]
char v25; // [esp+6Ah] [ebp-40Ah]
char v26; // [esp+6Bh] [ebp-409h]
char v27; // [esp+6Ch] [ebp-408h]
char v28; // [esp+6Dh] [ebp-407h]
char v29; // [esp+6Eh] [ebp-406h]
char v30; // [esp+6Fh] [ebp-405h]
char v31; // [esp+70h] [ebp-404h]
char v32; // [esp+A7h] [ebp-3CDh]
int v33; // [esp+470h] [ebp-4h]
v1 = this;
CWnd::UpdateData(this, 1); // 更新数据
strcpy(nameOrcompany, *((const char **)v1 + 160));// v1为获取的name字符开始地址，加一定的偏移可以找到company和serial
if ( strlen(nameOrcompany) >= 1 ) // 比较name长度是否大于1
{
if ( strlen(nameOrcompany) > 0x3F ) // 比较name长度是否大于63
v32 = 0; // v32为name附近的一个地址
strcpy((char *)(*((_DWORD *)v1 + 167) + 145477), nameOrcompany);// 将name移动到*((_DWORD *)v1 + 167) + 145477
strcpy(nameOrcompany, *((const char **)v1 + 161));// [v1 + 161]==company
if ( strlen(nameOrcompany) > 0x3F ) // 比较company长度是否大于63
v32 = 0;
strcpy((char *)(*((_DWORD *)v1 + 167) + 145541), nameOrcompany);// 将company字符串移动到*((_DWORD *)v1 + 167) + 145541
v4 = operator+((int)&v19, (int)v1 + 648, (int)v1 + 652);// v1 + 648和v1 + 652分别为serial五部分中的1，2两部分，将两部分拼接后放入&v19，v19在v1附近且v19=v4
v33 = 1;
v5 = operator+((int)&v20, v4, (int)v1 + 656);// serial将前面拼接的两部分和第三部分拼接
LOBYTE(v33) = 2;
v6 = operator+((int)&v16, v5, (int)v1 + 660);// serial将前面拼接的三部分和第四部分拼接
LOBYTE(v33) = 3;
operator+((int)&v18, v6, (int)v1 + 664); // serial将前面拼接的四部分和第五部分拼接
LOBYTE(v33) = 7;
CString::~CString((CString *)&v16);
LOBYTE(v33) = 6;
CString::~CString((CString *)&v20);
LOBYTE(v33) = 5;
CString::~CString((CString *)&v19);
CString::MakeUpper((CString *)&v18); // 将五部分拼接的字符由小写字母变为大写
strcpy(&v23, v18); // 复制到v23，v23为堆栈
*(_BYTE *)(*((_DWORD *)v1 + 167) + 145461) = rand();// 生成随机数放入与前面name与company附近
v7 = 0;
v8 = &v23; // v8为serial转换为大写的字符串地址
*(_BYTE *)(*((_DWORD *)v1 + 167) + 145462) = rand();// // 生成随机数放入与前面name与company附近
do
{
sprintf(nameOrcompany, a0xCC_0, *v8, v8[1]);// sprintf(name, 0x%c%c, v8[1], v8[1]);循环向里打印，所以里面的两个数只为serial最后两个
v8 += 2;
*(_BYTE *)(*((_DWORD *)v1 + 167) + v7++ + 145463) = strtoul(nameOrcompany, 0, 16);// 将name的ascii转换为字符,也就是sprintf打印进去的serial
}
while ( v7 < 10 );
v9 = (unsigned __int8 *)(*((_DWORD *)v1 + 167) + 145464);// 从地址里取出serial的第一个字节
serial = *(unsigned __int8 *)(*((_DWORD *)v1 + 167) + 145467)
+ ((*(unsigned __int8 *)(*((_DWORD *)v1 + 167) + 145466)
+ ((*(unsigned __int8 *)(*((_DWORD *)v1 + 167) + 145465) + (*v9 << 8)) << 8)) << 8);// v9为密码的第一个，左移8位就是前移两个字节，
// ((*(unsigned __int8 *)(*((_DWORD *)v1 + 167) + 145465)为密码第二位，后面以此类推，取出前8位serial
v10 = (_DWORD *)*((_DWORD *)v1 + 169);
v22 = v9[7] + ((v9[6] + ((v9[5] + (v9[4] << 8)) << 8)) << 8);// 取出后8位serial
sub_401AD0(v10, (int)&serial, (int)nameOrcompany, 8);
v11 = 0;
do
{
nameOrcompany[v11] ^= *((_BYTE *)v1 + v11 + 684);// 将解密出来的结果nameOrcompany与指定的值异或
++v11;
}
while ( v11 < 8 );
v12 = *((_DWORD *)v1 + 167);
v31 = 0;
sub_406540(v12); // 保存输入的注册码
if ( !strncmp(nameOrcompany, Str2, 2u) // 检查计算出来的8个字节
// 当str1=str2时，返回值=0；即检查前2个字节为35 44
&& AsciiIsNmber(v25) // AsciiIsNmber，检查ascii码对应的值是否为数字，此处检查了后6个字节
&& AsciiIsNmber(v26) // 30-39为数字
&& AsciiIsNmber(v27)
&& AsciiIsNmber(v28)
&& AsciiIsNmber(v29)
&& AsciiIsNmber(v30) )
{
*(_BYTE *)(*((_DWORD *)v1 + 167) + 145428) = 1;
v13 = *(const char **)sub_406180((CString *)&v17, 0x7Du);
LOBYTE(v33) = 8; // LOBYTE指向16进制最低的那个字节
CWnd::MessageBoxA(v1, v13, 0, 0);
LOBYTE(v33) = 5;
CString::~CString((CString *)&v17);
CDialog::OnOK(v1);
}
else // 如果输入的serial错误
{
v14 = *(const char **)sub_406180((CString *)&v17, 0x7Eu);
LOBYTE(v33) = 9;
CWnd::MessageBoxA(v1, v14, 0, 0x10u);
LOBYTE(v33) = 5;
CString::~CString((CString *)&v17);
}
v33 = -1;
v3 = (CString *)&v18;
}
else // 如果没有name输入
{
v2 = *(const char **)sub_406180((CString *)&v16, 0x7Fu);
v33 = 0;
CWnd::MessageBoxA(v1, v2, 0, 0x10u);
v33 = -1;
v3 = (CString *)&v16;
}
return CString::~CString(v3);
}
这个函数将，名字，公司，存入一个地址，然后就把注册码的五部分拼接起来，
再分成把注册码的两部分传入sub_401AD0解密函数，再用一个循环，把解密出来的注册码异或一遍，
然后到了函数sub_406540里把和存入某个地址名字，公司一起写入文件保存，再检查这个注册码的前两个字节是否为35，44，
后6个字节是否为数字，即后6位为的大小必须在30-39之间，根据检测结果弹出相应的messagebox。其他细节的可以看我写的注释。
[C++] 纯文本查看 复制代码 int __thiscall sub_401AD0(_DWORD *this, int serial, int nameOrcompany, int a3)
{
int *serial_1; // esi
int *nameOrcompany_1; // edi
int result; // eax
unsigned int *nameOrcompanyadd0x4; // ebp
unsigned int *v8; // ebx
signed int v9; // eax
_DWORD *v10; // [esp+8h] [ebp-4h]
unsigned int Wseriala; // [esp+10h] [ebp+4h]
BOOL nameOrcompanya; // [esp+14h] [ebp+8h]
serial_1 = (int *)serial;
nameOrcompany_1 = (int *)nameOrcompany;
nameOrcompanya = serial == nameOrcompany;
result = a3;
v10 = this;
if ( a3 )
{
nameOrcompanyadd0x4 = (unsigned int *)(nameOrcompany_1 + 1);
v8 = (unsigned int *)(serial + 4);
Wseriala = (unsigned int)(a3 + 7) >> 3; // 8+7=15 =》 1111右移三位为1
while ( 1 ) // serial与nameorcompany的地址是否相等，如果不相等此处就位0
{
if ( nameOrcompanya )
{
sub_401440(this, serial_1, v8);
serial_1 += 2;
v8 += 2;
}
else
{
v9 = 0;
do
{
*((_BYTE *)nameOrcompany_1 + v9) = *((_BYTE *)serial_1 + v9);// 取字符型serial前八个字节放入nameOrcompany
++v9;
}
while ( v9 < 8 );
sub_401440(this, nameOrcompany_1, nameOrcompanyadd0x4);// 解密call，this为指向辅助解密的code的地址，宁外两个指向的开始8个字节都为serial，后面一个为serial的ascii，宁外一个为compang的ascii
serial_1 += 2;
v8 += 2;
nameOrcompany_1 += 2;
nameOrcompanyadd0x4 += 2;
}
result = Wseriala-- - 1; // Wseriala原来固定为1，此处减1后为0
if ( !Wseriala )
break;
this = v10;
}
}
return result;
}
这个就是函数sub_401AD0，a3就是传入的固定数8，这个8是不变的也就是说无论输入的注册码是不是正确的都会执行if里，
里面的还有一个if肯定执行else里，也是这样和输入无关，我多次测试过，所以看我写的注释也只有一部分的，进入执行的else里，
先是一个循环把注册码11-18位写入了，原来的company的地方，所以前面我说的是注册码的俩部分，而不是注册码和company，
然后把这两个传入函数sub_401440同时传入的还有一个指向用于辅助解密的代码的地方，接下来就是真正的解密函数sub_401440
[C++] 纯文本查看 复制代码 int __thiscall sub_401440(_DWORD *this, int *a2, unsigned int *a3)
{
_DWORD *v3; // esi
int *v4; // edi
unsigned int v5; // edx
int v6; // eax
unsigned int v7; // ecx
unsigned int v8; // edx
unsigned int v9; // ecx
unsigned int v10; // edx
unsigned int v11; // ecx
unsigned int v12; // edx
unsigned int v13; // ecx
unsigned int v14; // edx
unsigned int v15; // ecx
unsigned int v16; // edx
unsigned int v17; // ecx
unsigned int v18; // edx
unsigned int v19; // ecx
unsigned int v20; // edx
int v21; // ebp
int result; // eax
unsigned int v23; // [esp+14h] [ebp+4h]
v3 = (_DWORD *)*this;
v4 = a2;
v6 = this[1]; // v6为this指向的地址里第二个地址，与this指向的第一个地址*this地址相比大0x50，也就是说*this+0x50=v6
v5 = *a2 ^ *(_DWORD *)(*this + 68); // a2为serial取出前4个字节与一段地址里的值异或，serial为输入的serial的3-10位
v7 = *a3 ^ *(_DWORD *)(*this + 64) ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v5 + 3072)// a3为serial为输入的serial的11-18位
+ (*(_DWORD *)(v6 + 4 * BYTE1(v5) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v5 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v5) + 1024))));//
// BYTE2取地址里的值的第二个字节，
// v5 >> 24为第一个字节
// BYTE1取地址里的值的第三个字节，
// (unsigned __int8)v5 是指v5的最后一个字节，这里有误
v8 = v3[15] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v7 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v7) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v7 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v7) + 1024)))) ^ v5;
v9 = v3[14] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v8 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v8) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v8 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v8) + 1024)))) ^ v7;
v10 = v3[13] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v9 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v9) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v9 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v9) + 1024)))) ^ v8;
v11 = v3[12] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v10 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v10) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v10 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v10) + 1024)))) ^ v9;
v12 = v3[11] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v11 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v11) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v11 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v11) + 1024)))) ^ v10;
v13 = v3[10] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v12 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v12) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v12 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v12) + 1024)))) ^ v11;
v14 = v3[9] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v13 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v13) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v13 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v13) + 1024)))) ^ v12;
v15 = v3[8] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v14 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v14) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v14 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v14) + 1024)))) ^ v13;
v16 = v3[7] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v15 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v15) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v15 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v15) + 1024)))) ^ v14;
v17 = v3[6] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v16 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v16) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v16 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v16) + 1024)))) ^ v15;
v18 = v3[5] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v17 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v17) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v17 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v17) + 1024)))) ^ v16;
v19 = v3[4] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v18 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v18) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v18 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v18) + 1024)))) ^ v17;
v20 = v3[3] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v19 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v19) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v19 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v19) + 1024)))) ^ v18;
v23 = v3[2] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v20 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v20) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v20 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v20) + 1024)))) ^ v19;
v21 = v3[1] ^ (*(_DWORD *)(v6 + 4 * (unsigned __int8)v23 + 3072)
+ (*(_DWORD *)(v6 + 4 * BYTE1(v23) + 2048) ^ (*(_DWORD *)(v6 + 4 * (v23 >> 24))
+ *(_DWORD *)(v6 + 4 * BYTE2(v23) + 1024))));
result = v23 ^ *v3; // eax与edx为计算结果
*v4 = result; // 这两个写入值分别写入穿入的后两个参数的地址里
*a3 = v21 ^ v20; // ecx与edi为两写入的地址
return result;
}
代码看起来很多，其实看懂一个，后面的都一样，就是把注册码和解密码异或后，
把这个8位数分成四部分，每部分一个字节，以每部分位乘4作为偏移，加上给定的固定值，
算出地址取出地址里的值，与其他3部分先后异或，然后把结果传入下一个，这样的流程，
循环执行，最后把结果放入传入的参数地址里，具体细节可以看我写的注释。
0x3注册机编写[C++] 纯文本查看 复制代码 #include "stdio.h"#include "windows.h"
BYTE v6add1024[1072] = {
0xC1, 0x99, 0x64, 0xC7, 0x5F, 0x70, 0x2A, 0xFD, 0x4B, 0x5F, 0x65, 0xAA,
0x5A, 0xEF, 0x7E, 0x99, 0xF7, 0x08, 0x5E, 0xF1, 0x77, 0x84, 0xC8, 0xBE,
0xC1, 0x18, 0x0E, 0x71, 0x6D, 0x8A, 0xD5, 0xED, 0x77, 0x6D, 0x66, 0x8F,
0x90, 0x7A, 0x53, 0xFC, 0x4E, 0x41, 0x1F, 0xFB, 0x5C, 0x13, 0xAE, 0xA5,
0x8A, 0xBA, 0x29, 0x36, 0x0A, 0x18, 0xDE, 0x0A, 0xB2, 0xC2, 0x27, 0xBA,
0x6F, 0x1D, 0x8F, 0xC8, 0x58, 0x8B, 0x95, 0x30, 0x32, 0x0D, 0xCC, 0x24,
0xA1, 0x8E, 0xEE, 0x06, 0x35, 0x44, 0xCC, 0xF0, 0x4D, 0x66, 0x20, 0xE6,
0xF5, 0x13, 0x46, 0xAC, 0xB9, 0xEF, 0xDB, 0xBB, 0x70, 0x08, 0x5C, 0x4D,
0x77, 0x3F, 0x56, 0x29, 0x51, 0x97, 0x5A, 0x43, 0x6D, 0x33, 0x37, 0xEE,
0x8F, 0xC3, 0xDE, 0xDE, 0x46, 0x59, 0xFF, 0xBC, 0x9A, 0x40, 0x1C, 0x51,
0x10, 0x30, 0xC5, 0x9E, 0x44, 0x21, 0x56, 0x62, 0xC6, 0x85, 0x3B, 0xEC,
0x63, 0x1F, 0xE9, 0x9D, 0x2E, 0x61, 0x6F, 0xF5, 0x95, 0xED, 0x31, 0xB1,
0x54, 0x26, 0xFC, 0xF4, 0x36, 0xF7, 0x62, 0xDF, 0xE1, 0x36, 0xB9, 0x10,
0xBD, 0xBD, 0xAD, 0x62, 0xB2, 0x84, 0x67, 0x86, 0x46, 0xA2, 0xCF, 0x8E,
0xB6, 0xA2, 0x5D, 0x4E, 0x71, 0x63, 0x73, 0x76, 0x88, 0xC9, 0x55, 0x0F,
0x05, 0x0D, 0x6C, 0x80, 0x9B, 0xE3, 0x2C, 0x41, 0x90, 0x4F, 0xAF, 0xD3,
0x07, 0xDF, 0x73, 0xAF, 0x1F, 0x03, 0xAF, 0x51, 0xCF, 0x82, 0x3A, 0xB8,
0x76, 0xAC, 0x5A, 0x57, 0x90, 0x37, 0x3E, 0x3B, 0x98, 0x7C, 0xDF, 0x24,
0x13, 0x78, 0x70, 0xC5, 0x20, 0x8D, 0x8A, 0xC0, 0x5D, 0xA9, 0x77, 0xAF,
0xA7, 0x54, 0x41, 0xB6, 0xAD, 0x31, 0x6E, 0xD6, 0x90, 0xC2, 0xDF, 0x1D,
0x65, 0x50, 0x96, 0x81, 0x91, 0xF5, 0x55, 0x39, 0x01, 0x4A, 0x34, 0x8F,
0xAF, 0x58, 0x68, 0xB8, 0x50, 0x6B, 0x84, 0xF9, 0x49, 0xE7, 0xDF, 0xEC,
0x82, 0xC0, 0x01, 0x0A, 0x7C, 0xBF, 0xB7, 0xFB, 0xFE, 0x23, 0xD8, 0xDE,
0x77, 0x0D, 0xB9, 0xE4, 0x3E, 0xCD, 0x37, 0xFC, 0x5F, 0x59, 0xA8, 0xC4,
0xE7, 0x9F, 0xFB, 0xF2, 0x1E, 0x40, 0x67, 0x13, 0xF1, 0x6B, 0x18, 0x56,
0xCB, 0xC5, 0xD0, 0x31, 0xBA, 0xBF, 0xF6, 0x14, 0x2E, 0x36, 0x19, 0xC7,
0x6B, 0xBA, 0x70, 0x00, 0x19, 0xA5, 0x23, 0x02, 0x64, 0x84, 0x21, 0x7C,
0xA7, 0xC1, 0x8A, 0x91, 0x3C, 0xE1, 0x20, 0x65, 0xAD, 0xE2, 0x99, 0xE7,
0xCA, 0x5C, 0x68, 0x74, 0x7E, 0x72, 0xCB, 0xC3, 0x8E, 0x82, 0xCD, 0xAD,
0x74, 0x18, 0xCA, 0x84, 0x99, 0x13, 0x63, 0x5D, 0xBD, 0x0D, 0x1E, 0x4D,
0x7C, 0xC3, 0xD7, 0x8E, 0xC2, 0xD5, 0x10, 0xD2, 0x9A, 0x73, 0xCE, 0xA7,
0x77, 0x37, 0x2D, 0x81, 0x18, 0x32, 0xB4, 0x3C, 0x63, 0xAB, 0x49, 0x1D,
0xF8, 0x78, 0x11, 0x97, 0x87, 0x00, 0x41, 0xF8, 0xEA, 0x69, 0xC4, 0x44,
0x66, 0x8F, 0x60, 0x9D, 0xA8, 0x25, 0x36, 0x60, 0xE6, 0xA1, 0x33, 0x2F,
0xA9, 0x8E, 0x43, 0x88, 0x68, 0x89, 0x7A, 0x08, 0xBF, 0x55, 0x44, 0x18,
0x7A, 0xA3, 0x01, 0x3F, 0x5F, 0x20, 0x0D, 0xF1, 0xFD, 0x47, 0x50, 0xDD,
0xEB, 0xA3, 0xA4, 0x60, 0x0A, 0x3B, 0x31, 0xE2, 0x89, 0x33, 0x7E, 0x21,
0x8C, 0xA3, 0xAD, 0xDA, 0x32, 0x40, 0x64, 0xBF, 0x27, 0x91, 0x7C, 0xEA,
0x64, 0x7F, 0x77, 0xFE, 0xE5, 0x7C, 0xA8, 0x6F, 0xCC, 0x32, 0x4B, 0x7E,
0x3A, 0x18, 0x0B, 0xE0, 0xF7, 0xCA, 0xEC, 0x66, 0x33, 0xD6, 0xB7, 0xA1,
0x7C, 0x17, 0x42, 0xFD, 0x66, 0x26, 0xD0, 0x1A, 0xA3, 0x3C, 0xB2, 0x03,
0x16, 0x79, 0xD7, 0xF2, 0xF4, 0xB1, 0x35, 0xE8, 0x23, 0x52, 0x05, 0x4F,
0x84, 0xF3, 0xC7, 0x4A, 0x59, 0xC4, 0x01, 0x79, 0xDF, 0xF7, 0x1B, 0x65,
0x99, 0x8E, 0x5F, 0xB5, 0x47, 0x89, 0x9B, 0x3D, 0x05, 0xEA, 0xB2, 0xB7,
0x80, 0x1C, 0xE7, 0xB1, 0xDF, 0x71, 0x46, 0xBF, 0x5C, 0x64, 0x9E, 0x2B,
0x67, 0x93, 0xBD, 0x53, 0xBA, 0x07, 0x85, 0x65, 0x44, 0x54, 0x1C, 0x9B,
0xB1, 0x68, 0x08, 0xCE, 0x8F, 0x5D, 0xF7, 0x18, 0x78, 0xAF, 0x0F, 0xB6,
0x62, 0x35, 0x06, 0xC1, 0xC3, 0x88, 0xE8, 0x67, 0x69, 0x1A, 0x30, 0x6C,
0xAE, 0xE5, 0x7D, 0xF7, 0x77, 0x2A, 0x97, 0x63, 0x62, 0x25, 0xA0, 0xEB,
0xC6, 0x0F, 0x1E, 0x86, 0x01, 0x3E, 0xF7, 0xDD, 0x9F, 0x17, 0xA2, 0xCF,
0xBB, 0xEE, 0xF7, 0x46, 0xB1, 0x0E, 0xBA, 0x9C, 0xBE, 0xD2, 0xCF, 0xF1,
0xE5, 0xF8, 0xF5, 0x99, 0x55, 0x96, 0xBE, 0xF9, 0x13, 0x2C, 0x03, 0x94,
0x3B, 0x74, 0x16, 0xDD, 0x9A, 0xA4, 0x19, 0x00, 0x37, 0xD3, 0x9D, 0xE1,
0x49, 0x9B, 0xFD, 0xB5, 0x20, 0x18, 0xAD, 0xA1, 0x72, 0x80, 0x1D, 0x94,
0xEC, 0x76, 0xDB, 0x10, 0x39, 0x2F, 0x04, 0x56, 0xE8, 0x0D, 0xCD, 0xA7,
0xB6, 0x49, 0x1A, 0xCE, 0x30, 0xEB, 0xCA, 0x7B, 0x03, 0xD9, 0xCB, 0x0A,
0xED, 0x96, 0x0B, 0x59, 0x90, 0x45, 0xF6, 0x1D, 0xE3, 0xD8, 0xF1, 0x73,
0x89, 0xC9, 0x50, 0xF4, 0x91, 0x04, 0x81, 0xD2, 0xFD, 0xCF, 0x62, 0x9B,
0x9F, 0x40, 0x5B, 0xB6, 0xE0, 0x2A, 0x53, 0x59, 0x32, 0x56, 0x0A, 0xFA,
0xCF, 0x24, 0x4F, 0x57, 0xF5, 0x92, 0x92, 0xC2, 0x61, 0xD9, 0x41, 0x6F,
0x6D, 0x4C, 0x9D, 0xD0, 0xA9, 0x32, 0x6D, 0x21, 0x37, 0x5B, 0x44, 0x8A,
0x66, 0xC9, 0x44, 0x25, 0xC7, 0x61, 0x2D, 0x0D, 0x2D, 0xC7, 0xF9, 0xFC,
0xF2, 0x5E, 0x17, 0x58, 0xC7, 0xDA, 0x43, 0xB6, 0x87, 0xD3, 0x57, 0x2B,
0xCE, 0x27, 0x70, 0x2F, 0x44, 0x7C, 0x48, 0xDE, 0x6A, 0x18, 0x77, 0x2C,
0x8E, 0x29, 0x20, 0x83, 0xD0, 0xD5, 0x96, 0xA5, 0xAB, 0x6E, 0x13, 0xCC,
0xEF, 0x28, 0xA5, 0x79, 0xF8, 0xC9, 0x1C, 0x1F, 0xCE, 0x4F, 0xED, 0xCA,
0xB2, 0x55, 0x62, 0x9F, 0xA7, 0xD6, 0x36, 0xF4, 0x5B, 0x5A, 0x15, 0x9B,
0x00, 0xD4, 0x1D, 0xDD, 0x70, 0xA5, 0x3E, 0x7E, 0x40, 0x0E, 0x00, 0x91,
0xB4, 0x56, 0x0F, 0x46, 0x92, 0xA4, 0x52, 0x42, 0x2C, 0x31, 0xAF, 0xBB,
0xBC, 0x14, 0x98, 0x09, 0x65, 0x92, 0x42, 0x06, 0x6C, 0x4F, 0xD9, 0xD8,
0x94, 0xDE, 0x62, 0xAB, 0xF4, 0xDA, 0x55, 0x6D, 0x93, 0x04, 0xB5, 0xB9,
0x69, 0x6B, 0xAE, 0x53, 0x3B, 0x8F, 0xFB, 0xF0, 0x5D, 0x45, 0x3D, 0x05,
0x72, 0x69, 0xF1, 0x5F, 0x51, 0xF3, 0x89, 0xBB, 0xD9, 0x71, 0xFE, 0xBC,
0x68, 0x84, 0x30, 0xA5, 0x22, 0xD3, 0x72, 0x2F, 0x01, 0x88, 0x24, 0x4C,
0xC7, 0xD0, 0x9A, 0x83, 0xB4, 0x74, 0x6F, 0xCA, 0xB6, 0xD5, 0xEE, 0x50,
0xBB, 0x3E, 0xDC, 0x3E, 0x35, 0xE6, 0x16, 0x34, 0xA5, 0x01, 0x02, 0x56,
0x00, 0xB6, 0x80, 0x09, 0x23, 0xD3, 0xB2, 0x5F, 0x00, 0x88, 0x15, 0x91,
0x62, 0xEE, 0xEB, 0x35, 0x55, 0x8B, 0x4F, 0x9B, 0xBA, 0xD0, 0x30, 0x6F,
0x6E, 0x9F, 0x9C, 0x91, 0x1B, 0xA6, 0x54, 0x2B, 0xF0, 0x6E, 0x2A, 0x81,
0x70, 0x7C, 0x50, 0x18, 0x64, 0x4A, 0x53, 0x77, 0xE7, 0xE3, 0x06, 0xD7,
0x48, 0x35, 0x79, 0x42, 0x18, 0x79, 0x9A, 0x95, 0x56, 0x12, 0xCF, 0xB9,
0xF9, 0xAD, 0xB6, 0xBE, 0xAA, 0x4E, 0x62, 0xF8, 0x63, 0xD1, 0x49, 0x92,
0x14, 0x0E, 0x5E, 0xC6, 0x44, 0x47, 0xD5, 0x6F, 0xCC, 0xBA, 0xB8, 0x7C,
0x86, 0xDE, 0x9A, 0x9E, 0xF8, 0x70, 0x1F, 0x30, 0xB1, 0xA1, 0x38, 0x9B,
0xB8, 0xCA, 0x02, 0xF1, 0x47, 0x22, 0x47, 0xDF, 0x2F, 0x61, 0x13, 0xD2,
0x1E, 0x91, 0x24, 0x03, 0x8A, 0xF9, 0xA5, 0x54, 0x64, 0x3B, 0xA6, 0x87,
0x8D, 0xBB, 0xE3, 0xEA, 0x92, 0x6C, 0x84, 0x54, 0x6D, 0xA2, 0x19, 0xA7,
0xDA, 0xC2, 0xE8, 0x7C, 0xEF, 0x9E, 0xCF, 0xD0, 0xFE, 0x1E, 0xCB, 0xAB,
0x2E, 0x24, 0x84, 0x4D, 0x19, 0x3F, 0xB2, 0x13, 0xC5, 0x0E, 0x9B, 0x1C,
0x3C, 0xA4, 0x72, 0xA3 };
BYTE v6add2048[1056] = {
0x8A, 0xF9, 0xA5, 0x54, 0x64, 0x3B, 0xA6, 0x87, 0x8D, 0xBB, 0xE3, 0xEA,
0x92, 0x6C, 0x84, 0x54, 0x6D, 0xA2, 0x19, 0xA7, 0xDA, 0xC2, 0xE8, 0x7C,
0xEF, 0x9E, 0xCF, 0xD0, 0xFE, 0x1E, 0xCB, 0xAB, 0x2E, 0x24, 0x84, 0x4D,
0x19, 0x3F, 0xB2, 0x13, 0xC5, 0x0E, 0x9B, 0x1C, 0x3C, 0xA4, 0x72, 0xA3,
0xC1, 0xD7, 0x9F, 0x6A, 0xB4, 0x12, 0x2C, 0xDB, 0x14, 0x8E, 0xCC, 0x3E,
0x45, 0x80, 0x84, 0x3C, 0x5E, 0xD1, 0x65, 0x61, 0x12, 0xA1, 0xCD, 0xEF,
0x3D, 0x89, 0x7F, 0x4D, 0xF5, 0x32, 0x7E, 0x17, 0xC1, 0x89, 0x2D, 0x88,
0x71, 0x83, 0x8D, 0xEE, 0x9B, 0x94, 0xE1, 0x55, 0xAC, 0x69, 0x67, 0x9C,
0xF9, 0xA9, 0x40, 0xDB, 0x62, 0xE0, 0x3B, 0xE4, 0x8B, 0x31, 0x8C, 0xFA,
0xAA, 0x69, 0x1A, 0x98, 0x0E, 0xAF, 0xDC, 0x92, 0xDD, 0xE4, 0x16, 0x67,
0x71, 0x96, 0x38, 0xE1, 0xB6, 0x84, 0xA6, 0x95, 0x10, 0x38, 0xBD, 0x70,
0x77, 0x45, 0x7F, 0x6C, 0xCD, 0x3D, 0x21, 0xD8, 0x4D, 0xA5, 0x29, 0x2C,
0x54, 0xBE, 0xE6, 0xE2, 0xD0, 0x5D, 0x2D, 0x8D, 0x8E, 0x81, 0xAA, 0x51,
0xD4, 0xFE, 0xBD, 0x03, 0x3F, 0x04, 0x6C, 0x68, 0x5A, 0x93, 0x57, 0xC9,
0x78, 0x85, 0xB8, 0x05, 0xA5, 0xA7, 0xBC, 0xC6, 0x25, 0x75, 0x97, 0xFB,
0x90, 0xC8, 0x9A, 0x64, 0xD4, 0x71, 0x0F, 0xFD, 0x62, 0x21, 0xDB, 0x28,
0x7A, 0x88, 0xD8, 0xAA, 0x69, 0x45, 0xC9, 0x2F, 0x26, 0x14, 0x4D, 0x35,
0xBA, 0xED, 0x40, 0x2F, 0x83, 0xEE, 0x12, 0xB4, 0x9B, 0x63, 0x9B, 0x49,
0x1D, 0x9B, 0xBA, 0x73, 0x70, 0x94, 0x83, 0x32, 0x97, 0xBB, 0x73, 0x33,
0xAF, 0xFC, 0xD3, 0xCC, 0x50, 0x89, 0x02, 0x5F, 0xAB, 0x44, 0x7D, 0x49,
0x61, 0x9F, 0xE5, 0x70, 0x89, 0xBE, 0x8C, 0x11, 0xD5, 0x89, 0x33, 0x9B,
0x1D, 0x22, 0xBE, 0x89, 0xEA, 0x8A, 0x8B, 0x86, 0xBB, 0x52, 0xE8, 0x32,
0xB8, 0x71, 0x39, 0x1F, 0x97, 0x6F, 0x9D, 0xB8, 0xC2, 0x73, 0x71, 0x45,
0x45, 0x3A, 0x0B, 0xD9, 0x09, 0x8C, 0x9A, 0x68, 0x97, 0x86, 0xA9, 0xC0,
0xCF, 0x4D, 0x29, 0x3A, 0xDB, 0x4B, 0x4A, 0x00, 0x06, 0xF9, 0xDA, 0xAF,
0x51, 0xFB, 0x4E, 0x29, 0x05, 0x06, 0xC5, 0x62, 0x93, 0xFE, 0xB0, 0x08,
0x74, 0x71, 0xF1, 0xAF, 0x01, 0x30, 0x06, 0x64, 0x6B, 0x82, 0x36, 0x7C,
0x8C, 0x30, 0x4E, 0xED, 0x43, 0x3F, 0xA6, 0x0F, 0x2E, 0x80, 0x33, 0x85,
0xEB, 0x9F, 0x3F, 0x99, 0x58, 0xBB, 0x37, 0x7B, 0x85, 0x3D, 0x29, 0x2F,
0xF1, 0xCB, 0x6F, 0x30, 0xD1, 0xC7, 0xA9, 0xCD, 0xB0, 0x76, 0xA9, 0xDF,
0x33, 0x18, 0xE5, 0xF9, 0x29, 0xC5, 0x27, 0x49, 0x3E, 0x73, 0x68, 0x23,
0xE8, 0xAC, 0x8A, 0x3B, 0xD3, 0x89, 0xB9, 0xC4, 0xD3, 0xD6, 0x40, 0xDA,
0x21, 0xED, 0xC9, 0xA0, 0x59, 0xEB, 0xC7, 0x33, 0xF9, 0xD7, 0x85, 0x66,
0xA9, 0xB0, 0xBD, 0x73, 0xF3, 0x9B, 0x16, 0x23, 0xD3, 0x30, 0xDA, 0xEE,
0xA9, 0xD3, 0xEF, 0x71, 0xA6, 0xF9, 0x44, 0x8B, 0xF5, 0x57, 0xF0, 0xD3,
0x81, 0x6E, 0x5C, 0x44, 0x6B, 0xD8, 0x5F, 0x77, 0xF4, 0xD9, 0x8F, 0x40,
0x05, 0xB7, 0x99, 0x0A, 0xD0, 0xD6, 0xFE, 0xA2, 0xD0, 0x1E, 0x8F, 0x90,
0xB1, 0x13, 0xA0, 0x4B, 0x9A, 0xC5, 0x15, 0x05, 0xE5, 0x30, 0x7E, 0xFB,
0xCE, 0x38, 0x84, 0x69, 0x21, 0xB3, 0x02, 0x98, 0x6A, 0x11, 0x69, 0xBC,
0x33, 0x93, 0x3C, 0xDD, 0x63, 0x11, 0xDF, 0xC2, 0x80, 0x01, 0xA5, 0x02,
0xA7, 0x1A, 0xC4, 0xC2, 0xDB, 0x3B, 0x15, 0xDD, 0xEF, 0x02, 0x36, 0xB0,
0x15, 0x51, 0xD4, 0x4F, 0xE6, 0xC9, 0x37, 0xCC, 0x67, 0x57, 0xD9, 0xBA,
0xCC, 0xAD, 0xF3, 0xCF, 0xE5, 0xF7, 0x2F, 0x5E, 0x0A, 0xB8, 0x91, 0x78,
0xF6, 0xCC, 0xD9, 0xB9, 0xB0, 0x8D, 0xAA, 0x92, 0xAE, 0x48, 0xDA, 0xFA,
0x47, 0xB2, 0x55, 0x50, 0xB1, 0xCE, 0xBF, 0x6F, 0x3F, 0xB8, 0xAA, 0x69,
0x81, 0x69, 0x30, 0xEC, 0xA5, 0x7E, 0xD0, 0xF9, 0x8D, 0xBB, 0xF7, 0xD7,
0x0D, 0x06, 0x5A, 0x57, 0x17, 0xA5, 0x02, 0xA9, 0x19, 0xB7, 0x62, 0x7B,
0x83, 0x93, 0x0B, 0x17, 0xEF, 0xAE, 0xE5, 0xE7, 0x5A, 0x26, 0x7F, 0xBF,
0x51, 0xF2, 0x26, 0xD7, 0x8F, 0x6A, 0xA5, 0x5E, 0x90, 0x28, 0x1F, 0x72,
0x6F, 0x38, 0xC4, 0xED, 0x74, 0xF5, 0x39, 0x8F, 0xD5, 0x7F, 0xF1, 0x3B,
0x2C, 0xC1, 0xA4, 0x87, 0x4A, 0x34, 0xD6, 0x28, 0xB7, 0xBB, 0xE2, 0xDB,
0x81, 0xE9, 0x99, 0x34, 0x7F, 0xEE, 0x38, 0x33, 0xB3, 0x41, 0xC1, 0x5F,
0x30, 0x95, 0x90, 0x6A, 0xB4, 0x84, 0x22, 0x58, 0x97, 0xBE, 0xC8, 0x25,
0x22, 0x1C, 0x3F, 0x37, 0x26, 0xDC, 0xA1, 0x66, 0x98, 0x4B, 0xA9, 0x09,
0x65, 0x2B, 0x22, 0x41, 0x4C, 0x59, 0xB1, 0x08, 0x80, 0x30, 0x1A, 0xFD,
0xD5, 0x4C, 0xE1, 0x33, 0x91, 0x33, 0x07, 0x34, 0x8F, 0x1C, 0xA2, 0x28,
0x15, 0x42, 0x2F, 0x5E, 0xA8, 0x16, 0xD5, 0xE5, 0x5B, 0xE5, 0x8D, 0x3F,
0x83, 0xBB, 0xBA, 0x51, 0xD2, 0x7C, 0x97, 0xAB, 0x9B, 0x94, 0xF4, 0xB1,
0x1F, 0xA2, 0x82, 0x70, 0x76, 0x35, 0x6A, 0x70, 0x79, 0xE7, 0x05, 0xF0,
0x0B, 0xCE, 0x27, 0xDE, 0x8A, 0x1E, 0x07, 0x1B, 0x16, 0x87, 0x95, 0x91,
0x7A, 0xCF, 0x16, 0xFE, 0xD6, 0xBF, 0x45, 0xDE, 0x6B, 0x9E, 0x5B, 0xAC,
0xEF, 0x67, 0x47, 0xBE, 0x06, 0xD9, 0x93, 0x0F, 0xA8, 0xBC, 0x2B, 0xDF,
0x79, 0x45, 0x95, 0xC1, 0x0D, 0x49, 0x3A, 0xBC, 0xB2, 0xCE, 0x59, 0x6A,
0x3D, 0x4F, 0xEA, 0x6B, 0x1E, 0x02, 0x2A, 0x1A, 0x96, 0x7E, 0xD1, 0x2A,
0x1E, 0xAD, 0xCA, 0xD6, 0x51, 0xD4, 0x1A, 0xE7, 0x31, 0xC4, 0x38, 0x16,
0x6A, 0xD5, 0xC1, 0x97, 0x7F, 0x98, 0xF6, 0xC2, 0x71, 0xC9, 0x88, 0x10,
0x66, 0x35, 0xAB, 0x20, 0x0E, 0x53, 0x39, 0x59, 0x9F, 0x4A, 0x86, 0x5E,
0xCF, 0xA6, 0x76, 0x20, 0xF1, 0x8A, 0xC5, 0xB9, 0x9C, 0xA3, 0xFC, 0x47,
0xA4, 0x76, 0xA9, 0xA4, 0x35, 0xEB, 0xB6, 0xCC, 0x92, 0x53, 0x8B, 0x5B,
0x49, 0x38, 0x8D, 0x55, 0xFE, 0x07, 0x93, 0x08, 0x71, 0xE6, 0x72, 0xD4,
0x53, 0xD0, 0xE7, 0xDF, 0x50, 0x94, 0x49, 0x7D, 0xD8, 0x83, 0xDA, 0x31,
0x16, 0x13, 0x7B, 0xDE, 0x18, 0x69, 0x2B, 0x8E, 0x47, 0xEA, 0x65, 0x21,
0x4D, 0x1F, 0x3D, 0x2D, 0xBE, 0x56, 0x83, 0xF2, 0x32, 0xE9, 0x32, 0xAF,
0x01, 0x43, 0x4A, 0xED, 0x65, 0x04, 0x1A, 0x37, 0x17, 0xD4, 0x40, 0x11,
0x76, 0xB7, 0x78, 0xDD, 0xCC, 0x45, 0xC1, 0xDC, 0x58, 0x5A, 0x98, 0xB5,
0x67, 0x3F, 0x71, 0x51, 0x12, 0xA0, 0xFE, 0x2A, 0x51, 0x34, 0x78, 0xA8,
0xDB, 0x14, 0xE8, 0x3C, 0xBB, 0x19, 0x66, 0x4D, 0xAB, 0x5D, 0xEE, 0x8B,
0xB7, 0x57, 0x47, 0x77, 0xDD, 0x63, 0x87, 0x79, 0x6F, 0x3F, 0x49, 0x01,
0xF4, 0x5A, 0x4D, 0x6C, 0xF6, 0xE8, 0x1C, 0x2F, 0x0F, 0x98, 0xD6, 0x21,
0xD8, 0x48, 0xC0, 0xD5, 0xD7, 0x6C, 0x37, 0xAD, 0xA0, 0x3B, 0x4B, 0x61,
0xB7, 0x5A, 0x7D, 0x2B, 0x23, 0x97, 0x3D, 0xED, 0x2D, 0x5A, 0xAE, 0x7D,
0x86, 0xE3, 0x8A, 0xB2, 0xA1, 0x95, 0x10, 0x51, 0x18, 0xDD, 0x0D, 0x6B,
0xCC, 0xEB, 0x51, 0x3A, 0x04, 0xFD, 0xE0, 0xFA, 0xCC, 0x58, 0x96, 0x02,
0x84, 0xFA, 0xD9, 0x5D, 0xA7, 0x41, 0x85, 0xDF, 0x62, 0x05, 0x80, 0xC6,
0x0B, 0xE5, 0xF2, 0x67, 0xC5, 0xAC, 0xD6, 0xDA, 0xA1, 0x35, 0x86, 0x63,
0xF0, 0x26, 0x4B, 0xCC, 0x1B, 0x16, 0x2D, 0x22, 0x95, 0xF4, 0x7F, 0x19,
0xA6, 0xB7, 0xAF, 0x0C, 0xDB, 0xE0, 0x0E, 0x88, 0xEF, 0x92, 0x29, 0x96,
0x03, 0x3F, 0x52, 0xCB, 0x03, 0x66, 0xE0, 0xF1, 0x09, 0xD5, 0xA5, 0x21 };
BYTE v6add3072[1088] = {
0x1B, 0x16, 0x2D, 0x22, 0x95, 0xF4, 0x7F, 0x19, 0xA6, 0xB7, 0xAF, 0x0C,
0xDB, 0xE0, 0x0E, 0x88, 0xEF, 0x92, 0x29, 0x96, 0x03, 0x3F, 0x52, 0xCB,
0x03, 0x66, 0xE0, 0xF1, 0x09, 0xD5, 0xA5, 0x21, 0xF0, 0x4E, 0x6A, 0xFD,
0x69, 0x85, 0x0F, 0x09, 0xE0, 0x47, 0xC6, 0xDA, 0xDF, 0x01, 0xEA, 0x17,
0xC0, 0x14, 0x75, 0x0E, 0xAC, 0x33, 0xB5, 0xD2, 0xBC, 0x08, 0x8B, 0x26,
0x79, 0xB7, 0x24, 0xCA, 0x2C, 0x3B, 0x6C, 0x56, 0x5A, 0x63, 0xA5, 0xDB,
0xB0, 0x45, 0x22, 0x61, 0x2E, 0xD7, 0xDF, 0x71, 0x1A, 0x0A, 0x70, 0xC4,
0xEA, 0x61, 0x4F, 0xE5, 0x65, 0x25, 0x5B, 0x56, 0xC0, 0x79, 0x6D, 0x9B,
0x98, 0xAA, 0x9B, 0x9C, 0xE7, 0x8D, 0xEB, 0x58, 0x3C, 0x6C, 0x44, 0x4E,
0xB4, 0x1E, 0xB2, 0x52, 0x78, 0x08, 0x15, 0xD4, 0x81, 0x07, 0xA7, 0x89,
0xC4, 0x25, 0x6C, 0xD9, 0x65, 0xDF, 0xEF, 0xC2, 0x48, 0x45, 0xBF, 0xA4,
0xE5, 0x7D, 0xE0, 0xBA, 0x38, 0x43, 0x7E, 0xA5, 0x39, 0x8B, 0xE4, 0x71,
0xF6, 0x64, 0x7F, 0xFC, 0x19, 0x2B, 0x31, 0x22, 0xD4, 0xC3, 0x1B, 0x80,
0x66, 0x60, 0xC9, 0x32, 0x5A, 0x7A, 0x60, 0x7B, 0x73, 0x3E, 0x13, 0x37,
0xD5, 0xC5, 0x86, 0x5D, 0x50, 0xDC, 0xFB, 0x42, 0xDA, 0x95, 0x1E, 0x95,
0xD4, 0xF3, 0xC6, 0x5E, 0xFF, 0xCB, 0xF0, 0xC8, 0x3F, 0xEA, 0x2F, 0xCB,
0x44, 0x6B, 0x5E, 0x49, 0x7A, 0xEA, 0x1C, 0xFC, 0x7F, 0x6C, 0xC4, 0xF9,
0x3A, 0xBE, 0xFB, 0x5B, 0xFC, 0x0A, 0xA9, 0x91, 0xB7, 0x7F, 0x32, 0x38,
0xDC, 0x07, 0x6B, 0x8A, 0xB2, 0x75, 0x25, 0xD9, 0x72, 0x80, 0xE3, 0x84,
0x66, 0xBA, 0xBD, 0xF2, 0x6E, 0x9E, 0xD3, 0x24, 0x77, 0xB0, 0xBD, 0x7A,
0x2B, 0x92, 0xB9, 0xE1, 0xF8, 0xE9, 0x2C, 0x2D, 0x10, 0xA2, 0xFC, 0x34,
0xC7, 0x44, 0x5B, 0xCF, 0xFA, 0xB3, 0xB4, 0x46, 0x07, 0x46, 0x2F, 0x54,
0x01, 0xAF, 0xEB, 0x5D, 0x38, 0xEC, 0xC2, 0x3F, 0x51, 0x5D, 0xB7, 0xEB,
0xD6, 0x79, 0x18, 0xA6, 0x90, 0x6F, 0x49, 0x98, 0xAC, 0x13, 0x27, 0xCE,
0x56, 0x0D, 0xDA, 0x96, 0xB4, 0xDC, 0xD7, 0x81, 0x26, 0xEB, 0x0D, 0xF8,
0x5B, 0x66, 0x8E, 0xB1, 0xEA, 0x1A, 0x1C, 0xE6, 0xEB, 0x89, 0x1A, 0xBA,
0x6B, 0x72, 0x47, 0x3B, 0x71, 0x3C, 0x90, 0x00, 0x35, 0x7C, 0x39, 0xE2,
0x00, 0x2F, 0x01, 0x52, 0x34, 0xFE, 0xAF, 0x5D, 0x22, 0xB0, 0xF8, 0x61,
0x4D, 0xC9, 0x11, 0xC7, 0xE6, 0xDA, 0x97, 0xB9, 0x32, 0xE1, 0xF4, 0x70,
0xA0, 0xEE, 0xF6, 0x5D, 0xD1, 0xB5, 0x03, 0x0A, 0x2A, 0x86, 0x08, 0xB2,
0xE9, 0x96, 0x1B, 0x20, 0x64, 0x8F, 0x2C, 0xC5, 0x59, 0x1A, 0xCE, 0xB9,
0xFE, 0x37, 0x42, 0x87, 0xFD, 0x97, 0x48, 0xC7, 0x7D, 0x1D, 0x7A, 0x68,
0x5F, 0xA7, 0xBA, 0x78, 0x47, 0xF4, 0x5E, 0xA0, 0x53, 0xBD, 0x0E, 0xC0,
0xBE, 0x5E, 0x7E, 0x9A, 0xF6, 0x9C, 0xFC, 0xED, 0x6B, 0x91, 0x68, 0x3C,
0xCE, 0x2F, 0x12, 0xFF, 0x08, 0xC7, 0x7B, 0x4C, 0x31, 0xD1, 0xF7, 0x15,
0xE8, 0x98, 0x16, 0xD3, 0x00, 0xAB, 0x57, 0xF3, 0x03, 0x33, 0x6B, 0x48,
0x84, 0xB1, 0x27, 0x81, 0xC6, 0x27, 0x7A, 0x81, 0xE5, 0xB4, 0x96, 0xAC,
0x24, 0x6D, 0xC1, 0xF7, 0xC2, 0x51, 0xEB, 0x73, 0x00, 0x90, 0x2A, 0xC8,
0x1C, 0x0D, 0xCC, 0x9A, 0xB4, 0x6B, 0xDA, 0xE2, 0x2F, 0xE0, 0xAA, 0x1D,
0x5F, 0x3D, 0xF4, 0xF8, 0x9B, 0x65, 0x81, 0xC4, 0x06, 0x3C, 0x49, 0x8E,
0x5C, 0x6C, 0x36, 0x04, 0x20, 0x3D, 0xEE, 0x78, 0x1B, 0x90, 0x3D, 0x0F,
0xC5, 0x7A, 0x71, 0xC1, 0x40, 0x4B, 0x6E, 0x67, 0x95, 0x1E, 0xD6, 0x5A,
0x3E, 0x69, 0x26, 0x8C, 0x1B, 0x13, 0xF9, 0x5F, 0x0C, 0x62, 0x48, 0x2C,
0xAE, 0x17, 0x32, 0x47, 0xE5, 0xB6, 0x71, 0xCE, 0xEE, 0x32, 0x77, 0xE1,
0x41, 0x39, 0x04, 0xC4, 0x0B, 0x7B, 0x76, 0x40, 0x7F, 0x0F, 0xFE, 0xE6,
0x93, 0xA2, 0x43, 0xC7, 0xB5, 0xE0, 0x85, 0x0E, 0xE8, 0x1B, 0x58, 0x1D,
0x9F, 0xF1, 0x88, 0xD4, 0xC0, 0x5A, 0x53, 0xFB, 0x6B, 0xA1, 0x2E, 0xE2,
0xFB, 0x4F, 0xA6, 0x72, 0xB6, 0x64, 0x17, 0xD4, 0xB5, 0x88, 0x06, 0x7D,
0x3F, 0x22, 0xF9, 0xEF, 0x5E, 0x55, 0xE5, 0x3A, 0x17, 0xF4, 0xE8, 0x25,
0x94, 0xCE, 0x07, 0x22, 0xAB, 0xEE, 0x9A, 0xD4, 0x20, 0x03, 0x3E, 0x51,
0x05, 0x43, 0x96, 0x8A, 0x37, 0x7D, 0xE6, 0x49, 0x41, 0x21, 0x30, 0x41,
0xDC, 0xAD, 0x59, 0xDB, 0x0C, 0xD2, 0xB0, 0xE7, 0x4D, 0xCF, 0x90, 0x92,
0x8C, 0x82, 0xD8, 0x3E, 0xAC, 0x92, 0x11, 0x17, 0x7D, 0x46, 0x9A, 0xA1,
0xE3, 0xEF, 0x99, 0x73, 0x8B, 0x0E, 0x12, 0x92, 0x1A, 0xC4, 0x75, 0x0B,
0x45, 0x1F, 0xB4, 0xEE, 0xFE, 0x8E, 0xB0, 0x02, 0x1C, 0x26, 0x95, 0x54,
0x60, 0x3A, 0x36, 0x3C, 0xB9, 0xB7, 0x65, 0x3F, 0xBC, 0x62, 0xCB, 0x57,
0xC9, 0xFD, 0xCF, 0x30, 0x7A, 0x1E, 0xD9, 0x7B, 0x7F, 0xD5, 0x2F, 0xFE,
0x52, 0x7C, 0x1F, 0x2D, 0x9B, 0xD8, 0xAE, 0x9B, 0xAC, 0x27, 0xCC, 0xEF,
0x76, 0xCE, 0xEF, 0x73, 0x37, 0xB4, 0x53, 0x37, 0xE7, 0xF0, 0x3E, 0xF0,
0x47, 0x82, 0xA6, 0x82, 0xCC, 0x1A, 0xA5, 0x53, 0x66, 0x57, 0x8C, 0xE0,
0x01, 0x22, 0x0E, 0x32, 0x70, 0x7E, 0x57, 0xE5, 0x09, 0x92, 0xC1, 0x60,
0x78, 0x88, 0x3B, 0x2F, 0x69, 0x42, 0xBB, 0xE1, 0x2F, 0xD3, 0xB8, 0x10,
0xE7, 0xE9, 0x94, 0x2E, 0x9E, 0x18, 0x3A, 0xED, 0xC1, 0x1C, 0xDD, 0xBF,
0x65, 0xEC, 0xC8, 0xE8, 0xB0, 0x74, 0x50, 0xAD, 0x7D, 0x0C, 0x80, 0x07,
0xA1, 0x96, 0x3C, 0x3F, 0x9F, 0x98, 0xB2, 0x6C, 0x96, 0x65, 0xE6, 0xED,
0x48, 0x5C, 0xB3, 0x59, 0xC4, 0x7F, 0x25, 0x6E, 0x48, 0x1D, 0x36, 0xC5,
0xD4, 0xC8, 0xC9, 0xA2, 0xB8, 0x0C, 0x57, 0xDC, 0x0A, 0xB9, 0xA4, 0x4B,
0x88, 0xF0, 0x53, 0x2E, 0xD4, 0xDA, 0x67, 0x6C, 0x62, 0xE6, 0x7E, 0x41,
0xD8, 0xCB, 0x7F, 0x71, 0xC5, 0xA0, 0xB6, 0x40, 0x5D, 0x8A, 0xBB, 0x55,
0x6A, 0xD6, 0x61, 0x58, 0x80, 0x3F, 0xF3, 0x31, 0x5B, 0x64, 0xF4, 0x1A,
0xE4, 0x85, 0x0E, 0xE3, 0xD5, 0xC4, 0x6B, 0x69, 0x01, 0x00, 0x6D, 0x1A,
0xFB, 0xE4, 0x31, 0x1C, 0x20, 0x35, 0x68, 0x46, 0x7A, 0x5D, 0x36, 0xBB,
0xC1, 0x40, 0x63, 0xBB, 0xFF, 0xC1, 0x67, 0xE4, 0x31, 0xD3, 0xA6, 0x00,
0x7E, 0xB5, 0x86, 0xD3, 0x83, 0x0C, 0xA0, 0x70, 0xB8, 0xF4, 0x5B, 0xE0,
0x94, 0xC9, 0x5F, 0x48, 0x0F, 0x1B, 0x0B, 0x4F, 0xC8, 0x59, 0xDA, 0x44,
0x90, 0xC5, 0x36, 0xAD, 0xAA, 0xFD, 0xC4, 0xE8, 0xE2, 0x38, 0xB7, 0x1C,
0x2E, 0x2F, 0x22, 0xE4, 0x1E, 0xE4, 0x34, 0x81, 0x9F, 0xCE, 0x8C, 0xC3,
0x66, 0x13, 0xC5, 0x31, 0x2D, 0x5D, 0x3D, 0xF0, 0xBE, 0x14, 0xCE, 0xB8,
0x90, 0x7B, 0x7F, 0xB1, 0x33, 0x2E, 0xC2, 0x96, 0x95, 0xEB, 0xAE, 0x71,
0x11, 0xD9, 0xC1, 0x52, 0x1D, 0x04, 0xA1, 0x37, 0x85, 0xCA, 0x9B, 0x68,
0x02, 0xC8, 0x53, 0x18, 0xF4, 0xB8, 0x8E, 0x72, 0x74, 0x32, 0x34, 0xB1,
0x5D, 0x7E, 0x91, 0x0B, 0x38, 0xB2, 0x7A, 0xFE, 0xAB, 0x9E, 0xE8, 0x8C,
0x09, 0x9A, 0x7E, 0xD9, 0x57, 0x7B, 0x7F, 0x86, 0x92, 0x1B, 0xBD, 0x04,
0x9A, 0x79, 0x13, 0x93, 0x97, 0x72, 0x19, 0x49, 0x38, 0xEB, 0x40, 0x10,
0x49, 0xEA, 0xE0, 0x89, 0x8C, 0x1B, 0x7A, 0x9E, 0xF3, 0x53, 0x84, 0x1B,
0x5B, 0x21, 0x47, 0x1A, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB, 0xAB,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x36, 0x5D, 0x34, 0x3B,
0xE0, 0x95, 0x00, 0x18, 0x5D, 0x18, 0x24, 0x23, 0x1C, 0xD6, 0x72, 0xBD,
0x36, 0x8C, 0xCC, 0x32, 0xCB, 0x62, 0x6A, 0x5A, 0x83, 0x6D, 0x6F, 0xD5,
0xFE, 0x93, 0xA0, 0xC3, 0xF1, 0x2C, 0xEF, 0xE6, 0xDF, 0x6D, 0xC3, 0x25,
0x9D, 0x3E, 0x98, 0xC2, 0xEE, 0xFF, 0xAF, 0x3A };
BYTE v6add0[1072] = {
0x16, 0xEF, 0xD8, 0xC8, 0x1F, 0x71, 0xD5, 0xA1, 0x66, 0x3B, 0x78, 0xFB,
0x5E, 0xD5, 0x68, 0x15, 0xDF, 0x27, 0xA4, 0x0A, 0xC8, 0x98, 0x19, 0x7D,
0x90, 0xB9, 0x1E, 0x94, 0x6B, 0x7B, 0x18, 0x4B, 0xAF, 0xE7, 0xBF, 0x70,
0x9E, 0x60, 0x6D, 0xF7, 0x2B, 0x2B, 0x35, 0x67, 0x49, 0x04, 0x4D, 0xE6,
0xD9, 0x15, 0xE7, 0xDC, 0xC5, 0x3A, 0xB3, 0xFA, 0xB1, 0x95, 0x08, 0x2C,
0x9F, 0xEE, 0x87, 0x57, 0x0B, 0x4F, 0x3C, 0x06, 0xF7, 0xF3, 0xA2, 0x16,
0xD9, 0xAA, 0x73, 0xAD, 0x49, 0xB0, 0xB6, 0x12, 0x64, 0x22, 0x96, 0x27,
0x61, 0x5C, 0x4F, 0x9B, 0xDC, 0x14, 0x1E, 0x9B, 0xA9, 0x0F, 0xF7, 0x50,
0xAA, 0xAF, 0xE0, 0xFC, 0x6E, 0xA9, 0x01, 0x01, 0x15, 0x9B, 0x56, 0x28,
0x19, 0xB1, 0xFA, 0xAD, 0x42, 0x64, 0x08, 0x15, 0x52, 0x62, 0x20, 0xF6,
0x8F, 0xF7, 0x80, 0x85, 0x13, 0x72, 0xEC, 0x70, 0x9E, 0x36, 0xA9, 0x55,
0x55, 0x98, 0x91, 0x14, 0x02, 0x49, 0x18, 0x49, 0x46, 0x51, 0x36, 0x57,
0x54, 0x3E, 0xB0, 0x85, 0x7C, 0xAE, 0xE3, 0x38, 0xA2, 0xC1, 0x01, 0xA9,
0x00, 0x34, 0x49, 0x6D, 0x70, 0xC7, 0x78, 0x81, 0x4B, 0xED, 0x16, 0xD3,
0xB3, 0x81, 0x22, 0xDA, 0x23, 0x7C, 0x2C, 0x45, 0x98, 0x07, 0x67, 0x48,
0x27, 0x85, 0xCA, 0xDB, 0x48, 0xB7, 0x63, 0xBB, 0x99, 0xA9, 0xB3, 0x43,
0x63, 0x7D, 0x9C, 0x61, 0x74, 0xAE, 0x74, 0x52, 0x20, 0xF7, 0x5E, 0xEB,
0xD8, 0x08, 0x61, 0x4C, 0x9F, 0x53, 0x90, 0x9A, 0xCF, 0x4A, 0xBE, 0x24,
0x7F, 0x77, 0xF9, 0x01, 0x27, 0xCB, 0xC1, 0x51, 0x3B, 0x9A, 0x17, 0xC9,
0x19, 0x8D, 0x2B, 0x92, 0xCB, 0xDF, 0xCF, 0x4D, 0x6F, 0xE2, 0x1F, 0x65,
0x3F, 0x86, 0x12, 0x6E, 0x09, 0x4A, 0xF8, 0xC3, 0x3F, 0x91, 0xD8, 0x92,
0xC4, 0x92, 0x04, 0xBD, 0x47, 0x79, 0x77, 0xB9, 0x92, 0x51, 0x4B, 0x5A,
0x57, 0x9F, 0x68, 0x5A, 0x89, 0x9F, 0x2F, 0xC3, 0x52, 0x42, 0x97, 0xC7,
0xB3, 0xED, 0xA4, 0xB2, 0xD3, 0x9D, 0xD5, 0x84, 0x6F, 0x3C, 0xF8, 0xE9,
0xC4, 0x9E, 0xF9, 0xA2, 0xFB, 0x29, 0x16, 0xED, 0x8A, 0x9E, 0x57, 0x58,
0x04, 0x03, 0x90, 0x06, 0x94, 0x19, 0xA6, 0x97, 0xBD, 0x6E, 0xE0, 0x09,
0x1F, 0x5A, 0x4D, 0x66, 0x59, 0x83, 0xB8, 0x7E, 0x1D, 0xB2, 0x8A, 0x93,
0xF0, 0x49, 0xD1, 0x03, 0xC7, 0x39, 0x77, 0xF6, 0x07, 0xCE, 0xCE, 0x11,
0xC8, 0x08, 0x49, 0x07, 0x72, 0x6D, 0x94, 0x1A, 0x2D, 0xCB, 0x8A, 0xDC,
0x2A, 0xC8, 0xD9, 0x06, 0x72, 0xD8, 0x43, 0x46, 0x90, 0xBF, 0xEC, 0x8A,
0x53, 0xE5, 0xE3, 0xED, 0x34, 0x1E, 0x6F, 0x78, 0x81, 0x64, 0x9A, 0xBA,
0x50, 0x6C, 0xB7, 0xBE, 0xE2, 0x7D, 0x03, 0x7D, 0x32, 0x2F, 0xD3, 0xA3,
0x6E, 0xB9, 0xD8, 0x75, 0x77, 0xF1, 0x27, 0x1E, 0x6A, 0x52, 0x9C, 0x9F,
0x47, 0xDE, 0xA7, 0xBA, 0xB8, 0x5A, 0xB9, 0xAD, 0x03, 0x56, 0xF2, 0x30,
0x36, 0x16, 0x9B, 0xE9, 0x29, 0xB6, 0xB8, 0xCD, 0xA3, 0x66, 0x40, 0x87,
0x5D, 0xE4, 0xF1, 0xF1, 0x67, 0x32, 0x12, 0x51, 0xD8, 0xA8, 0xC2, 0x88,
0x76, 0x9F, 0x6A, 0x81, 0x5D, 0x34, 0xCF, 0xDA, 0x5B, 0xD9, 0x05, 0xA7,
0x67, 0x9C, 0x47, 0x16, 0xB0, 0x31, 0x78, 0x76, 0x18, 0xD0, 0xCD, 0x86,
0xC3, 0x11, 0x09, 0xD5, 0xB5, 0x84, 0x2D, 0x70, 0xDB, 0x37, 0xCE, 0xD5,
0x80, 0x23, 0xD6, 0x6E, 0x40, 0x8E, 0x8E, 0xA1, 0x03, 0x59, 0xFE, 0x2D,
0xF4, 0x7C, 0x89, 0xDC, 0x67, 0x8D, 0xC1, 0x46, 0xE1, 0xFC, 0xD9, 0xBC,
0xC0, 0xD6, 0x02, 0x2D, 0x51, 0x3A, 0x99, 0x18, 0xDA, 0x14, 0x6C, 0xCC,
0xF1, 0xCF, 0x62, 0x03, 0x2A, 0x81, 0x63, 0x5A, 0x66, 0x42, 0x0E, 0x75,
0xE3, 0x65, 0x15, 0xDE, 0x90, 0x39, 0x33, 0xD6, 0xFC, 0x48, 0x56, 0x83,
0x5B, 0xB9, 0x9A, 0x8C, 0x33, 0x27, 0xB1, 0x25, 0x0E, 0xAE, 0x43, 0x15,
0x70, 0xCA, 0x3B, 0xC3, 0x70, 0x5D, 0x1B, 0xFD, 0x1E, 0x29, 0x95, 0x5A,
0x5A, 0x19, 0x67, 0x79, 0x8D, 0x25, 0x88, 0x51, 0x4C, 0x9F, 0xCF, 0x87,
0xF4, 0x47, 0x6B, 0x89, 0xF9, 0x38, 0x2D, 0xE1, 0x7A, 0x54, 0x59, 0x80,
0x47, 0x56, 0x6A, 0xF5, 0xD9, 0x2E, 0xD7, 0x3A, 0x0D, 0x94, 0xC9, 0x82,
0x9C, 0x93, 0x93, 0x7B, 0x01, 0x0B, 0x23, 0xA6, 0x55, 0x35, 0xEE, 0x4D,
0x8E, 0xB8, 0xCD, 0xD6, 0x5D, 0x0F, 0xB2, 0x27, 0xE7, 0xDE, 0xDE, 0x07,
0xBD, 0xD5, 0xB1, 0xE2, 0x51, 0x41, 0x60, 0x1D, 0x79, 0xD3, 0x65, 0xB1,
0x36, 0x0B, 0x5E, 0xD7, 0x81, 0x4F, 0x54, 0x33, 0x23, 0xC4, 0x4C, 0x4E,
0x1A, 0x43, 0x1C, 0xBD, 0x9C, 0x4B, 0xB0, 0xF1, 0xC9, 0xCE, 0x1B, 0xFB,
0x3C, 0x12, 0x72, 0x40, 0x4B, 0x3F, 0xEE, 0x74, 0xE6, 0xB7, 0xF2, 0xCB,
0xB5, 0xCE, 0xE7, 0xF9, 0x45, 0x53, 0x78, 0xBA, 0x70, 0xA6, 0x9D, 0x59,
0xF2, 0x1D, 0x01, 0xF2, 0xEC, 0x20, 0x02, 0xE3, 0x6B, 0x6A, 0x7A, 0x53,
0x5F, 0x25, 0xD4, 0x0B, 0x47, 0xEE, 0x24, 0x20, 0xEB, 0xE5, 0x9C, 0x03,
0x96, 0x3D, 0xA6, 0x3F, 0x90, 0xC6, 0x31, 0x9C, 0x5C, 0x37, 0x40, 0x60,
0x8B, 0x50, 0xB7, 0x7B, 0xCF, 0x7F, 0x3D, 0x65, 0x7F, 0x72, 0x3C, 0xF6,
0x5C, 0xF5, 0x5C, 0xD1, 0x8D, 0x42, 0x01, 0x8A, 0xF6, 0xCB, 0xCC, 0xB9,
0x38, 0x74, 0x71, 0x7D, 0x61, 0x33, 0xFB, 0xDC, 0x40, 0x4F, 0x67, 0x0F,
0x27, 0x0E, 0x62, 0x99, 0x39, 0x4E, 0x7D, 0xC6, 0x8D, 0xE5, 0x7C, 0xE0,
0xE3, 0x56, 0xB9, 0x69, 0x17, 0x57, 0x61, 0x8A, 0x00, 0xA5, 0x41, 0xF0,
0xF9, 0x20, 0x6E, 0x90, 0x47, 0x34, 0x4F, 0x45, 0x40, 0x53, 0x42, 0xEC,
0xC2, 0x66, 0xAC, 0x42, 0xCB, 0x23, 0xD1, 0x39, 0xB6, 0x58, 0x2A, 0x36,
0xFA, 0xBE, 0x1B, 0x67, 0xF3, 0x2B, 0xE3, 0x78, 0x42, 0x55, 0x18, 0x0B,
0x2E, 0xD4, 0xED, 0x80, 0xC1, 0xC2, 0xE2, 0x2C, 0xCC, 0x5F, 0xCE, 0xEA,
0x8C, 0xE4, 0x9B, 0xDD, 0x69, 0x39, 0x06, 0xC7, 0xA7, 0x7E, 0x49, 0x5F,
0x6A, 0x71, 0xEC, 0x73, 0x46, 0x72, 0x82, 0xCE, 0x9B, 0x5B, 0x6D, 0x01,
0x6B, 0x7C, 0x3D, 0xD4, 0x65, 0x58, 0xF3, 0x1F, 0x70, 0x2D, 0x3D, 0x67,
0x89, 0xC6, 0xC5, 0xAF, 0x13, 0xC1, 0xDC, 0x7F, 0xB7, 0xA1, 0x88, 0x65,
0x96, 0x71, 0xBB, 0x54, 0x06, 0xD4, 0x1E, 0xA1, 0xEF, 0x09, 0x62, 0x6F,
0x66, 0xEB, 0xB4, 0x5C, 0xD5, 0x08, 0x63, 0xEE, 0x92, 0x8A, 0x02, 0x5D,
0x61, 0x27, 0xAF, 0x97, 0xC6, 0x5F, 0x2B, 0xE9, 0xE4, 0x9B, 0x6D, 0xF9,
0xE5, 0x28, 0x8F, 0x56, 0x6B, 0x68, 0x81, 0xB9, 0xBB, 0x22, 0x2A, 0x39,
0x28, 0x8F, 0x4C, 0x8E, 0x1A, 0x70, 0x57, 0xF1, 0xEA, 0xF9, 0xD8, 0xE9,
0xD6, 0x48, 0xFE, 0xF4, 0x1B, 0xA4, 0x51, 0x30, 0xE3, 0xF3, 0x30, 0x4B,
0x45, 0x28, 0xD6, 0xC9, 0x1A, 0x99, 0x5C, 0x27, 0x57, 0x6A, 0xC2, 0x2E,//c
0x91, 0x7A, 0x74, 0x93, 0x38, 0xD6, 0x7B, 0x82, 0x88, 0x54, 0x59, 0x3E,
0xE0, 0x47, 0x89, 0xB1, 0x10, 0xAE, 0x25, 0x61, 0xDB, 0x29, 0x4F, 0x0E,
0xFB, 0x3B, 0x50, 0x67, 0xE3, 0x97, 0xA4, 0x56, 0x51, 0x67, 0x4D, 0x58,
0x37, 0xF3, 0xCF, 0xEE, 0x94, 0xE7, 0x83, 0xFD, 0x68, 0xDB, 0x0B, 0x37,
0xC3, 0x71, 0x5F, 0xD2, 0x79, 0x70, 0x31, 0x06, 0x76, 0x5E, 0x2F, 0x8B,
0x27, 0xDF, 0xE0, 0xAD, 0xE3, 0x72, 0x72, 0xDF, 0x79, 0x3E, 0x25, 0x32,
0x42, 0x90, 0xAE, 0xF6, 0xC1, 0x99, 0x64, 0xC7, 0x5F, 0x70, 0x2A, 0xFD,
0x4B, 0x5F, 0x65, 0xAA, 0x5A, 0xEF, 0x7E, 0x99, 0xF7, 0x08, 0x5E, 0xF1,
0x77, 0x84, 0xC8, 0xBE, 0xC1, 0x18, 0x0E, 0x71, 0x6D, 0x8A, 0xD5, 0xED,
0x77, 0x6D, 0x66, 0x8F, 0x90, 0x7A, 0x53, 0xFC, 0x4E, 0x41, 0x1F, 0xFB,
0x5C, 0x13, 0xAE, 0xA5 };
byte temp[4] = { 0 };
byte temp2[3] = { 0 };
BYTE s1[4] = { 0 };
BYTE s2[4] = { 0 };
BYTE s3[4] = { 0 };
BYTE s4[4] = { 0 };
int fanzhuang(byte s[])
{
for (int i = 0; i < 4; i++)//内存的存储顺序是反过来的，这里反回去
{
int a = 3;
temp[a - i] = s[i];
}
for (int i = 0; i < 4; i++)
{
s[i] = temp[i];
}
return 1;
}
int ByteAdd(byte a[], byte b[],byte temp1[])
{
for (int i = 0; i < 4; i++)
{
temp1[i] = a[i] + b[i];
if (temp1[i]<b[i])
{
if (i > 0)
{
temp1[i - 1] = temp1[i - 1] + 0x1;
}
}
}
/*for (int i = 0; i < 4; i++)
{
printf("----");
printf("%x", temp1[i]);
}*/
return 0;
}
void ComplexCala(byte s4[], byte s1[], byte s2[], byte s3[], byte temp[], byte temp2[], byte av3[])
{
ByteAdd(s4, s1, temp);
for (int i = 0; i < 4; i++)
{
temp2[i] = temp[i] ^ s2[i];
}
ByteAdd(s3, temp2, temp);
for (int i = 0; i < 4; i++)
{
temp2[i] = temp[i] ^ av3[i];
}
}
void Getdata(byte s4[], byte s1[], byte s2[], byte s3[], byte x[])
{
for (int i = 0; i < 4; i++)
{
s1[i] = v6add1024[x[1] * 4 + i];
s2[i] = v6add2048[x[2] * 4 + i];
s3[i] = v6add3072[x[3] * 4 + i];
s4[i] = v6add0[x[0] * 4 + i];
}
fanzhuang(s1);
fanzhuang(s2);
fanzhuang(s3);
fanzhuang(s4);
}
void main()
{
BYTE av3[4] = {0xd0, 0x13, 0xef, 0x76};
BYTE wv11[] = { 0x44, 0x72, 0x69, 0x76, 0x65, 0x20, 0x50, 0x6F };
BYTE v3[4] = { 0xAA ,0x17, 0xA5,0xE6, };
BYTE key[] = { 0x35, 0x44, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30 };
BYTE v4[4] = { 0 };
BYTE v21[4] = { 0 };
BYTE a3[4] = { 0 };
BYTE CODE[9] ={0};
BYTE v23[4] = { 0 };
BYTE v20[4] = { 0 };
BYTE v19[4] = { 0 };
for (int i = 0; i < 8;i++)// 对应nameOrcompany[v11] ^= *((_BYTE *)v1 + v11 + 684);的反过程
{
CODE[i] = wv11[i] ^ key[i];
}
for (int i = 0; i < 4; i++)//内存的存储顺序是反过来的，这里反回去
{
int a = 3;
v4[a - i] = CODE[i];
}
for (int i = 4; i < 8; i++)//内存的存储顺序是反过来的，这里反回去
{
int a = 7;
a3[a - i] = CODE[i];
}
printf("\n");
printf("a3=");
for (int i = 0; i < 4; i++)//a3
{
printf("%x", a3[i]);
}
printf("\n");
printf("v23=");
for (int i = 0; i < 4; i++)//对应代码v23 ^ *v3;的反过程
{
v23[i] = v4[i] ^ v3[i];
printf("%x", v23[i]);
}
printf("\n");
printf("%x\n", v23[1]);
Getdata(s4, s1, s2, s3, v23);//模拟通过偏移获取地址里的值
printf("\n");
printf("--------------------------\n");
ByteAdd(s4, s1, temp); //模拟取出的值相加
for (int i = 0; i < 4; i++)
{
temp2[i] = temp[i] ^ s2[i];//模拟异或
}
ByteAdd(s3, temp2, temp);
for (int i = 0; i < 4; i++)
{
temp2[i] = temp[i] ^ av3[i];
}
printf("aaaaaaaaaaaaaaaaaaaaaa\n");
printf("v21=");
for (int i = 0; i < 4; i++)
{
v21[i]=temp2[i];
printf("%x", v21[i]);
}
printf("\n");
printf("v20=");
for (int i = 0; i < 4; i++)
{
v20[i] = v21[i] ^ a3[i];
printf("%x", v20[i]);
}printf("\n");
Getdata(s4, s1, s2, s3, v20);
BYTE av4[4] = {
0x03, 0x07, 0xDD, 0x7D };
fanzhuang(av4);
ComplexCala(s4, s1, s2, s3, temp, temp2, av4);//计算结果在temp2中
printf("\n");
printf("v19=");
for (int i = 0; i < 4; i++)
{
v19[i]=v23[i] ^ temp2[i];
printf("%x", v19[i]);
}
Getdata(s4, s1, s2, s3, v19);
BYTE av5[4] = {
0x7D, 0xCE, 0x8D, 0x04 };
BYTE v18[4] = {0};
fanzhuang(av5);
ComplexCala(s4, s1, s2, s3, temp, temp2, av5);
printf("\n");
printf("v18=");
for (int i = 0; i < 4; i++)
{
v18[i] = v20[i] ^ temp2[i];
printf("%x", v18[i]);
}
Getdata(s4, s1, s2, s3, v18);
BYTE av6[4] = {
0x37, 0x49, 0xCB, 0x3E };
BYTE v17[4] = { 0 };
fanzhuang(av6);
ComplexCala(s4, s1, s2, s3, temp, temp2, av6);
printf("\n");
printf("v17=");
for (int i = 0; i < 4; i++)
{
v17[i] = v19[i] ^ temp2[i];
printf("%x", v17[i]);
}
Getdata(s4, s1, s2, s3, v17);
BYTE v16[4] = { 0 };
BYTE av7[4] = {
0x16, 0xB0, 0x54, 0xCB };
fanzhuang(av7);
ComplexCala(s4, s1, s2, s3, temp, temp2, av7);
printf("\n");
printf("v16=");
for (int i = 0; i < 4; i++)
{
v16[i] = v18[i] ^ temp2[i];
printf("%x", v16[i]);
}
Getdata(s4, s1, s2, s3, v16);
BYTE v15[4] = { 0 };
BYTE av8[4] = {
0xDD, 0xB2, 0x16, 0x07 };
fanzhuang(av8);
ComplexCala(s4, s1, s2, s3, temp, temp2, av8);
printf("\n");
printf("v15=");
for (int i = 0; i < 4; i++)
{
v15[i] = v17[i] ^ temp2[i];
printf("%x-", v15[i]);
}
Getdata(s4, s1, s2, s3, v15);
BYTE v14[4] = { 0 };
BYTE av9[4] = {
0x55, 0x32, 0x46, 0x7E };
fanzhuang(av9);
ComplexCala(s4, s1, s2, s3, temp, temp2, av9);
printf("\n");
printf("v14=");
for (int i = 0; i < 4; i++)
{
v14[i] = v16[i] ^ temp2[i];
printf("%x ", v14[i]);
}
Getdata(s4, s1, s2, s3, v14);
BYTE v13[4] = { 0 };
BYTE av10[4] = {
0xB1, 0xA1, 0xFC, 0x0B };
fanzhuang(av10);
ComplexCala(s4, s1, s2, s3, temp, temp2, av10);
printf("\n");
printf("v13=");
for (int i = 0; i < 4; i++)
{
v13[i] = v15[i] ^ temp2[i];
printf("%x", v13[i]);
}
Getdata(s4, s1, s2, s3, v13);
BYTE v12[4] = { 0 };
BYTE av11[4] = {
0xD5, 0xB5, 0x3B, 0xE3 };
fanzhuang(av11);
ComplexCala(s4, s1, s2, s3, temp, temp2, av11);
printf("\n");
printf("v12=");
for (int i = 0; i < 4; i++)
{
v12[i] = v14[i] ^ temp2[i];
printf("%x-", v12[i]);
}
Getdata(s4, s1, s2, s3, v12);
BYTE v11[4] = { 0 };
BYTE av12[4] = {
0x77, 0x8B, 0x5A, 0x00 };
fanzhuang(av12);
ComplexCala(s4, s1, s2, s3, temp, temp2, av12);
printf("\n");
printf("v11=");
for (int i = 0; i < 4; i++)
{
v11[i] = v13[i] ^ temp2[i];
printf("%x-", v11[i]);
}
Getdata(s4, s1, s2, s3, v11);
BYTE v10[4] = { 0 };
BYTE av13[4] = {
0x70, 0x5C, 0x24, 0x38 };
fanzhuang(av13);
ComplexCala(s4, s1, s2, s3, temp, temp2, av13);
printf("\n");
printf("v10=");
for (int i = 0; i < 4; i++)
{
v10[i] = v12[i] ^ temp2[i];
printf("%x", v10[i]);
}
Getdata(s4, s1, s2, s3, v10);
BYTE v9[4] = { 0 };
BYTE av14[4] = {
0x0C, 0xA4, 0x58, 0xDE };
fanzhuang(av14);
ComplexCala(s4, s1, s2, s3, temp, temp2, av14);
printf("\n");
printf("v9=");
for (int i = 0; i < 4; i++)
{
v9[i] = v11[i] ^ temp2[i];
printf("%x", v9[i]);
}
Getdata(s4, s1, s2, s3, v9);
BYTE v8[4] = { 0 };
BYTE av15[4] = {
0x55, 0xF9, 0x4D, 0x7A };
fanzhuang(av15);
ComplexCala(s4, s1, s2, s3, temp, temp2, av15);
printf("\n");
printf("v8=");
for (int i = 0; i < 4; i++)
{
v8[i] = v10[i] ^ temp2[i];
printf("%x", v8[i]);
}
Getdata(s4, s1, s2, s3, v8);
BYTE v7[4] = { 0 };
BYTE av16[4] = {
0x58, 0x86, 0x25, 0x4B };
fanzhuang(av16);
ComplexCala(s4, s1, s2, s3, temp, temp2, av16);
printf("\n");
printf("v7=");
for (int i = 0; i < 4; i++)
{
v7[i] = v9[i] ^ temp2[i];
printf("%x ", v7[i]);
}
Getdata(s4, s1, s2, s3, v7);
BYTE v5[4] = { 0 };
BYTE av17[4] = {
0x01, 0xE0, 0xF8, 0x18 };
fanzhuang(av17);
ComplexCala(s4, s1, s2, s3, temp, temp2, av17);
printf("\n");
printf("v5=");
for (int i = 0; i < 4; i++)
{
v5[i] = v8[i] ^ temp2[i];
printf("%x-", v5[i]);
}
printf("\n");
printf("\n");
printf("\n");
BYTE seriaL[4] = { 0 };
BYTE seriaL2[4] = { 0 };
BYTE this68[4] = {
0x81, 0x3E, 0x88, 0x53 };
BYTE this64[4] = {
0x3C, 0x3A, 0xE3, 0x49 };
fanzhuang(this68);
fanzhuang(this64);
printf("this68=");
for (int i = 0; i < 4; i++)
{
printf("%X-", this68[i]);
}
printf("\n");
printf("serial=FA-");
for (int i = 0; i < 4; i++)
{
seriaL[i] = v5[i] ^ this68[i];
printf("%X-", seriaL[i]);
}
printf("\n");
Getdata(s4, s1, s2, s3, v5);
ByteAdd(s4, s1, temp);
for (int i = 0; i < 4; i++)
{
temp2[i] = temp[i] ^ s2[i];
}
ByteAdd(s3, temp2, temp);
for (int i = 0; i < 4; i++)
{
temp2[i] = temp[i] ^ this64[i];
}
printf("serial2=");
for (int i = 0; i < 4; i++)
{
seriaL2[i] = v7[i] ^ temp2[i];
printf("%X-", seriaL2[i]);
}
printf("-FC");
//right
printf("\n");
system("pause");
}
这个可以和那个加密函数对照着看，应该不难看懂，
关于注册机，修改key数字的后6位即可生成不同的注册码，后六位必须30-39之间。
0x4结束
最后上个效果图。
程序，代码，IDA文件都在连接里
链接：https://pan.baidu.com/s/1v340v02iSViWByoR8Zq5Fw
提取码：etw4
|
[复制链接]
发表于 2020-10-22 20:15
