8X9AvXio+T9XR`m$Sx(pl
z8~$$7v#svaT)BZgybzZ|jzXNwmMrjh+Qp-WUYUMou3IA-TIr|n9Ev^2vBr~JLD63^
zrH7;-l>+kg6(jLR+6OQg(BH?)XY@ZVT4F~dGL_6>?mP;2`t2)!F$GwJ$gH^nhVjI2
zNxO>57RRI6#6ZT~z{9uLf}0Y(@MeF~-8Vyp8TLveBU7iOZNIz5YzYWD&=?~+U3jqk
zPP{?gyV?xK@by_{d9e_Mqct6KYfeMK#+7a!K>-#v?iPAH)Q^cp!zTup+7yUC3g4>!
z#(v%&z20Ny5bmI(52JwzT%@)=1r_Zd1&|bZ`skbxGU$7QJVMiJCNEqWzmf%feH>&N
zJsRP&y)JgUg5VaLs&c=Vj5G(B%9lYnN2(b+H(n5O{lePyl9r_7f!BYHnCBV;02$&Fs9A@)H^MLQW
zqi_N1P7NzIrr$TXg7ZlfYQ%NLeSCa`5Iued;2>HkRQe}%5nv`rYUtIHI52npX>*bM
z_@t~zLr16GSS6V`Oi;>^pPTC@-u$N|J`>s*38#oWJL6OC8^b}hgd|^mYZVQ59%E6(
zpFecB-dmPq>@=t!7sHSxwq(xpc$CP9|5R5$wp5DzL3$;VhtpLyzVlVyS3lg{i60&RyGqr=eCPPEQ(Nu3__9A~&atkO)?P
zjQv3=%=(Qf4i$_5TOwpHYLm1`i8pPsPb6*f)hOF@Z?RGEA%9mb45)`9*VYK(5aT~-
zeqo;}Y~^=>zL9D(1_QBna@`3s1a2?31!JW8xaG#|MYv^Zj%wXLq++;GBfZEc-cpQs0I-tE&EOrE+UfkF3
z305AH5@ZU@2!k%j2K>LiRslzy@oB@KflV_t!!6N?3sGq10S(d}v6>+mtiQ2vv6Ao3
z=)J47ZbWgWqnusZ+;$Pa4Gp2Ry6x8Y^S(rE3cJpQR!*G1yIpfF*;<=jUVrqt4ULJ>
z1L+Qd#h3l_GT%>b&p~@%zI=IqU%eV~t@pVd>`_I?X#DeDuz=gWO(*hs-g}DTf0!p1
zSZj_M$l5Iju5$s|Hq+vLMdr8AmrXFL&1Vd;lB_UH#
z-ij#WG9g@Q(!hwtG2R4a-d6gds?^QTMW%Z^RQg~Kp5Fwi@@JZbZZud}0FQ$6vaPfu
zPBm2(ENnei0nW$)LO#J}!(Pm*X4Mj!!m`3(7PhW`d=IV4cv$m-dFV_8Tf_(_)@!0w
ze20R~MtjJ-sv7P9`!yQhKk`&pLjRkyzu(U}XI-k@T;|pb?;LlKinB9dX&B3RBS!M$
zc9^1HMo?^Fb6K)(9+FhGs>!OdoRDYMgmtL$h7$amME&f`K|e3kAox*({&ZbZS~V$D
z2|szt4e0bBk%VNH?`#X8Ew67
zs3o@%DF0llf+U%45ab1!VuO6uc8VK>1w%eY$S`Nz>zK?mRUn5G6F;^#k(Vm+L-g*)
z)C^q#Gl>etwTh|CvjC*tN_h(++~&bGf_t8&DQ6$t;
zP{EHzdBLPc%n``GHQ0ON-zbJv=m2LxXI_TB-1*zZIC-*x9{d
zngJP2Yj1(JFnDf5nwnFadEjXs{%W&3WnG_8q8~I19APX(BEEQkdZ*ph)~0)B!{Q;7~3aAtA6|ZhWSQfx10oMCtD-aF?NfQHb%a)7_
z#0uZs+}zU90Y!(AA|fkcUT&J$k6zo7CMpSeJsZX(AKDoB51<~g?`OOfOwVI!#-M6&
zKc7Brwqlz?SVg@mao>!JqRGP`Hn%94(sbs{mj-rh6@hU1M-
z;?E-1J8g^_XJ?5LU@x@vu0KrL;`~)@&}N;sN`ZDdgiV=gH>xF>$OdqYDol(?h5cE+
zs!SR}`b@i4Ko+YzC((+SDr;>RQ&f(mGX#q;B`qCnyZpT%=O)O?gcUYSfDOHR{$sAc
zTVy%<^BRCLeHgEW7m59+$5gDY{6JhnT%rk8?(j(cZgG41zQND>6@C5vC-JEY6oSBg
z_~$dx=}C^{pV(Jh7FCEq6NbvZ-z7g}Lit(kV^l*s{r#VShS=GrsB~qeg5IKVRs@C(
zQw^lK8F{blnD~}Qb{IUUYWngt^Csq&&@~Ke{SXOo`5*+n9_y@u%Z2%&KX}6N76ubv
z=?zK)6&*d(1WF54LNX8`gO?(8>IxG#z{9r8`~Xw!Y}AWqEEAo@S8(C+lNu+~dQ?
z%tm*Wa*JK}V?<(U?pyNzs%0<#BZCl7|FE*(KLaNHc{XRMIiP`x9!+3?jONant5hd^
zZS(fAb{^KM$OQBo+Cf%sc~zV7hgV%xy}RWSbgNNWGVRFIr23>{rSPTXuYmO1Aek!F
zSD9=X`*s$IczuG2iAjjog7g0AarQqe32IMwp#K3%Dp)r}8|`Z7DADb&Ci+Sz4u<(M
zvPXjX&P_%y)2E&P%e6Fe-_K4C{H-Klgv1dC7hs9r
zX-hv;-jTXV)*xM07ACrY50Slj7o2{)A@4Z+Pgn-yU&ztX*c_QM@;X7q
zex?fI2#p>-Iq!{YZM^rjp|R_ycLyE6deJClG&wel{~ExBfW%#?DPKcuh*nf4e_KwQ
zkCjz?SV7Fz3mC)Kf-%?0i8ZiBa@dmd@N_*ciQ>q3ONq>9q2aG;7%}nexBL}8?Wm66
zzrGI1l8Rf&LhfF2lR^PM@BIfi1bjk8lC)DBm5ju4F84~%?X9U@YJ;BZHj>*%QhSmEz3DGNvTPef|(l-N
zRMx-#YFaelO5OTKKv@Np{#2{+_}|dDW#5HL7=jvL6inFf7)RkHgwAq0yUhNc!*91Q8@YI@LiuO@{}@Yc8*^4=SB13*^6?f%_Z=B2jlzy_
z{qwkaLty;V2zXj~S=qgb3OR6HP#$)w$%94GP>%n9)!RBr_<3i0hEln(@_%EVg^7J_
z;+{@6|J@GV)7=3KWWm@Zx(EqukK&1#P
zBT5=tYf6ZR-yWAVnc`*)=Qt!_M)w>72#Kb^0`JBNHPEj#lv7|b(!5cCbLPi5Qv*Yv
zC0eLVZ4kN7mm_wbxk>o;cdIb14F!sF%u4dk_z+=63P&py*eAuM5<;Ozw4!xn8U!D6
zFmLk11aliWth(B*k
z%+%nIgbjV_hL$c70UhQ`v~G)FFg`fu#~iE@SofyI=~lyDLFcHnm{yXv*1t!U@_av!
z5Tl-I3{h^lh!9#*UPQJKFH(||FS!Uda}y^g3~b_FYwM4MBpl14kl_bBTZcmaW2cQm
z3}UvCeo}b&gnV|smz9x`VH}q04GPU;z~{y7gamYi$Szal)T^+YiuNU`5HRWf1T_Es
z_<#W+g>tjb%`xI_!W!0a8=784JUBrLoL(m)Q&;Bfo$(h*oKaz9%}(Qya`{FvxZ~it
zobnasDb5FjKz_F?E`<6Ao^-@YCrNaab+vqG72@PK-!k7#6gftC22?Vn-v|4e$0871
zDD@Bl!#fvlRTrZ@8w{vyB`W+?Y-1hv?5dILNW=>md;*+hQkHs>Xvf-ci)Z7OH>f6$+2d(~h0twi|$>j{l-J_aq_
zh9#MjdE)7Tw-KmNisY4AoM>VQaur`1=1Xd5@OW_nLL!`7lIHfP|xvoShqewd?zSeHyGov;GR7E&?8ql3qQ_*=uB0
zn-$2j?685tZ=3I9cT!B%aw@{N>bq?b^q#=dQh-({0yi#^{iB1G
z>Li&^m6jHqm>8ovGFm1kfz=rm4Gk!@9iT3xfDlABClYYznUheR_ooBeqe^>)kXo_4U`bfmhxc&Wj-rzYeIDNktY_r9-Kxn@B+dzByT0a-){tTx
z>m|y@%68kM)?EL^Ap}B8{2!5#;(68M^SH;Dma$h8>}J5MyrHhe3siM}I%`Sw#r6>$
zY^~Dlf7;)SjOZSd_+hTDH9ak902r_n*hS4KGU&ZeY62FDx#k}`m<~6%zeF?ywnAt4
zWZ<$5cj{J-EC=IzwOvlVRoxkFhpO!8;c%S4dT>J3`ttend}(H;!`z>rEN?5Y7d_k>
z$|g>etsrr+d-j>%z#5xeY0wOCc7nDg#KlbjiT)2_9DN?(-plkr_dOxL46a%-^*gB&
zC{D7zDPHbiG}%mTe5U?oB+hi(SL5IW{h-llS8aec2M`z_8REP*kXzP<(A+1=uT
z`5d2nb6_bF_8UOMA+2B+PJ@4pk)r(25&2&i#I!1hS$ITrqZ)Zo0%usHJc){^2EuX|
z_*8J#1ppKhGV+~Q+dz&4Rl@iiK4falSGLS$`mE;yK)ZQMHqDiWqhNYaTShqn_+)n%$A!G$Pa;`mlqKj6j6X0G(*wT5k&6q*g9>Z3
zTUGwv)%f@ZxkOR1rT&@zu_4kbcYI!@y*O9|q%!l|4DI7Ja^bc90@;5s?%wc4%A}Xw
zLDPlxk@;Q($9*90?p~_5nW28pON2~jbaPSv9d(`3!BiL(!QSa%a(i7>3E%p$!U^-Tri}(lL|U!3K)E2vjsx!)WI`)kT-*f(
zJvm)We-(ynIl155oPUz>;teh;a?b6d3-{rxe~XE|6FWX8)bAf;f;7=hsC#Xv@&7f^
z-*FiTTgQUr$^BmCH1_e9;JI(^3>+YQ*MM}!e~uKIkf^+li<(xncjG<5|MegGPh}D_
zp)uM)EUP#-cl-Jh+m2bi!~hRBo&ba~l4a`ER8{oM7)-h?++*zsp4Lq=S)$peHe_tI
z%0lM=h}edXH0mObe=$8GT=U$AL3!Gr?&q4V!V0uI&Gh;^Qk_q~_VVAZ7Y$rVPz@_0
zEG#g>vFhw@6eVh<4+pg03dG@KsETusERQxsHy624Q#9#F3J2mg?5wf}&Z&F0SC@CF
z%eY`R{`HJ#sWE}tP7}*U)Zr-7)vZ#oiH3$d=+9tN`Xf?T`LluP(2y07`x}6?OjJY!
zUOzv>K3L$<4Xevja)Nr-`MwaHU1?jUrx$VADMv>Jqp;6|?h&QHTy78;JT`f!&0KBf
zf-WmsaE?=pwP4)<-EmGS^WWEN)FkuhejT;x6PFn5>trH0+86SZZ)s7twWFb>Ei5Ss
z!^_O0t9XkDf`|2n3j4*+$w7PsA#waH{^FuyDX?_)%Pm=5dwg7kh+)TD@4U$JpeRp8
zrBMw>xm^GHaGu24?~(~AF&?1Ti~X+8hv9WSu^OK>LM;piZhT8caws90))f>7-S&yx
z=X+_MbiYHBqmPuSS@Ng{G$`y~mUT~xADJ$uyMO$sc;KEIFF4e6R;6?%@qWeZz$yZk
zw|IO3qG&2evYWtdAeY!om@Z_?Zj(h&LNo|lvl<_#fspS|#*rY4BAgQGJ`8>o-Zisv
zp-G3MXz{;Rn+973e7rRUZn+NJ$kfiSTL5`)seAqqUnWLd!>
z?$zb>PJ#m8p97beIAqFrg?=;arC
zgQ@6G)k}HD_)wt&GCk&Qv{#k*s-}`mab?ASuNQ)j0JzZPstboyRV6JhA-zMkNJ^o%
zi5`iJMOxa|^*^^C3H7>fUcK#p1u(fd
z07-qyKGNBo)3&O>iOI+_x;Vgx;V>I1sGpdTKWz>86690V@M
z)TiT5o%z0#t_w~yc~RCBQ>1I14oCn|86*j1wYIglqc;VTBU)FYk@h#H(9zzD#()L|7c+F
ziaD)8D=EBVv1>m9*~QnGGf>5|IUTutct_tR{aATZZm&l}UfV`kwdU*uUqTqDkAN|6
zRFqz-vJJ4K9v&+C%wRC^;NfwEk2lR|TH`(Q{`uRJH+pt?J`2iCh)r
zet{}u-!>j4e5iUWjjqHdpe1huJTG!>g+b|wwKd3VT|uRPVuY!;Dy_crLaYON8mjto
z@2?POdSWAIXKyUbgQmx(_G9MAeZIl`YKA
z7u50vD^i609z6M?UGL#Mo#_fQkc}ou}N~&$9Q+}Jp$g0(=@MX_-
z7!F3_y7Su0e|Nm}&TIb}0=@qC%%5>@a)4@j%%KiUkB0)MQw(B+v`0md;D9s7(^AMW
zRLoI{<@u7*z*zbumv=Se4U$py#V23sIV`&nmfFh;OInVBdj-U6C!`PLQYLHa<7$-=
z)`T(pDh^(&Z~uq@JJvx%nr(;1pRzVE%z}!N_VA0jnpk=_WQ&?wAWb=_o4$Vtn*DgS
z6eAS>x8KtbiUe;X;X(~ptStA{dxEZX3cIGwB^sMv2lxgf8qHJl<(f
zwZfukcTUPg4*~4Z20YvY&^3xb;2IpLn--|1aMY2hbwDCZse`b%tTaoOG_$4z<3`N(
z^qb#|I(uw>RXG$$CV}@MY37LKgDI3>l576r@5l&;9ZJmUPJw#TptBf(k+%UeX52N8nM^8V
zA!fn?Wj;`~ujgzCRdQU+)7ru7u(w|!e&<&DA(b*4GLU-fq3r3uaM>I)k-Bw^wC=xSqlQKnNex3310vprYR
zb~ZK-|Bg10k@+dGanRqMANNoo61DKeWGmY-qe8?w04`?OXH-Q^W~^{YEF}o^{Xj?G
zL*ZPD`c1m?#lY#x6*f=uV{Vmgwt?Gz&}xPfH)v?pFZ8mNSIYlaAHICdoba>H-4ik7
z-;rWDPd8da|*W5>?S>F6}gd9eoP
zw5uOdEr%pIpRr=Ylgfc0Mp?Thc2njtF`<-+o{{TNsYRimMk3EP-n)%shNG5yd6&@{
z>=)mENcY#26WLBzMn^m@#>gCq9wtvl(c|B8P?|_YCRj1>sPb~|6qsucR8EFcrcH)U
zSIP>G9blLY9$oP2KrA!Ohzq}6s!>>#rYE`y%LrrRV<-PY8edWn9=a4UvVVht$tq$<(f;yVDUZEqtkby(r^VKnblZ6&DbHJ={VW0W#1)EedYp9J53LSwPByFP9$
zWO{#l+t(^Et44BtWd50S0wH4)j^e?STx!AH9vg4F)}TC3i>
zoF6`_J%>||{3wq%LlI&$GlX_cRZwf&a6yNi_paT?el>lI;LqgS*}Tk-$JR(A|2JMu
zJVO|CY(HjA@ZqLqkyuouCUeL@sMFoT;5ol{#%uYOb)m@p(GZd!(jH
z&Vz*c#dAsX*YF^C4*QWK5i$=U_F+cSGXVFG;$tg97z5M={DqpH=gJT!J;H_h8V3)C
zL(>X2leT)J!;bR6`Em7_&)ugpi58n7vQWd_)ns^^)jP8s=Ju=Yaa;HR|1J}E@q9KC
zzT9X6hk}e?yy}r&x&*&Po6ax=ZCS|-bTR4?+{@ks{`&q;DFN1Vt4u{DBj2-xzwvo&0{d!@$e)twu
zG|<3)+6J~Db7i)G3l8YaEOhRYtf7Kc5V#&kIcwOO^7VPlZ+mPdhK=2{8ylATI~d{P
zHc~Ssnj4X^wjM(V=B@UJ;y&oKf&`}tWabcz!CuV;d-{2oPcfV)b8Ak*itTvjaxC2%
z7VWOW3YL8oD4x?Xd^KNap~a%+wr=G{2mho-m9+2QhLhfpgtz}LjRE>fnnbc4kr^q3
zkx-%}C4ELu1B?(fG{O%C&|)F$%dEG5e!GN7f~G4hHOCZ%V$fA2>wjr~o5y1Vw{BdB
zBc<&1%wvltyV@DG?>K+x4#iDp?Z_(+l_{2SlRW0u=L$8$Q2CxHjIRwVj{GRgLciEi
zCPgxB;ZBt^CffMp-cU>qVu5y3*q8Q0AKf`WP&cHz6GcrO7$l*;@WIGIw9NfKQu_j`3#HPyo5_Unm#VUzy`lpw!ZAJ^O3$v^y
zfvnL=3o9^|90Qd=)>W8vDYNYE1ksp_0pkZp7JbYtPpSD6I
zW&ows(yh&uB-MZ50vG1DG^oo}a{YD!F89|ZTN%!MS3~e2TDb9~2FXIr(9SnwQVLez
z&vtZSAE*auJa;fL+8!o{*&QA6i(ii0eIA#Z1s=IVmR=|^;0ukgve8#YTJMftnhj^t
z@^*Juvs`TMR&RaP9|z@R)4i=hAMwkUk༇w7W_{xmP!>$NI(uVYChQTTXHKp&_
zpRW1P@Ph)laN`&!Hyp$V|1&ZSlJKh+q&VEP+e4RK+E1H}dL@nLtu!_st*d+j*P($Z
z|1J}3+a|mE{Ao;WEKE&ZOkE63>#kBQbp>DgI?IU_=-oNkPdJokx+x>%^1hu2
zorPrOKu^D6)^ZQ(Kl*tkw}Xu-6B;R`e{+17LhbXsuOx?Thz(~e&5cPqE1_;3`rZAF
ztoHnl<0et%1)a3IyfN`PTYww3T@xh_#{V;(F0t*!nTJmOWV;fnXJOeS!6l}r-LzSa
zE$#ltzVd0)rqwQbckU@`tD@nI>Flqk_hD1orn60g$bLCs7Lf6d41r~E+n#AiN
sC-%YmrofBD_^=!=h;q!IRQu!q>^(c4bA^1(T*Ckap00i_>zopr0Fi<+TmS$7
literal 0
HcmV?d00001
diff --git a/writeups/ilm0/ctfzone.md b/writeups/ilm0/ctfzone.md
new file mode 100644
index 0000000..3318158
--- /dev/null
+++ b/writeups/ilm0/ctfzone.md
@@ -0,0 +1,285 @@
+# CTFZone 2019 Quals
+
+
+
+## Strange PDF
+
+**category**: forensics, rev
+
+**description**:
+
+You have one PDF file. Now calculate the flag. It's in decimal, by the way.
+
+___
+
+### Recon + solution
+
+We receive a .pdf file. Opening it we find a strange function definition f(x) = 109394007*x + 13
+In itself, this is not very helpful!
+
+I tried looking for clues in the file details, then taking it apart with LibreOffice draw, but nothing unusual was revealed.
+
+Analysing the file with the unix tool `strings` did not reveal any hidden information, but it revealed the underlying file structure.
+
+After getting into the details of how .pdf files are built up (see TD) , I took a closer look with `less`:
+
+The xref table:
+
+```
+xref
+0 26
+0000000000 65535 f
+0000020069 00000 n
+0000000019 00000 n
+0000000294 00000 n
+0000000314 00000 n
+0000000511 00000 n
+0000020212 00000 n
+0000000551 00000 n
+0000006741 00000 n
+0000006762 00000 n
+0000006964 00000 n
+0000007312 00000 n
+0000007527 00000 n
+0000012420 00000 n
+0000012442 00000 n
+0000012649 00000 n
+0000012966 00000 n
+0000013155 00000 n
+0000019098 00000 n
+0000019120 00000 n
+0000019317 00000 n
+0000019672 00000 n
+0000019891 00000 n
+0000019944 00000 n
+0000020311 00000 n
+0000020402 00000 n
+```
+
+There is only one section with 26 objects. First I thought that some of these are somehow hidden, I tried copying parts into a new file, but it did not work, later it turned out because of the offsets. As I looked into the exact specifications, it turned out that the offsets for the original file were not correct in the first place and that the file contained a mysterious second comment, apart from the standard pdf-header defining the version and file type.
+
+I tried interpreting the comment in many ways, looked at the hex and binary values, but could not determine the purpose of it. I was stuck here, until I've stumbled upon a writeup, which stated that the file command should've identified the file as a DOS/MBR boot sector. Which is surprising as I have received:
+
+```
+$ file document.pdf
+document.pdf: PDF document, version 1.4
+```
+
+every time when I tried identifying the data type.
+
+With this new information, the only thing standing in my way was being able to execute the instructions to get x.
+
+Interpreting the code as x86 assembly:
+
+```nasm
+and ax, 0x4450
+inc si
+sub ax, 0x2e31
+xor al, 0xa
+and ax, 0xb7e2
+mov ah, 2
+mov bh, 0
+mov dh, 1
+mov dl, 1
+int 0x10
+mov ah, 0xa
+mov al, 0x39
+mov bh, 0
+mov cx, 5
+int 0x10
+mov ah, 2
+mov bh, 0
+mov dh, 1
+mov dl, 3
+int 0x10
+mov ah, 0xa
+mov al, 0x33
+mov bh, 0
+mov cx, 1
+int 0x10
+```
+
+This code returns 99399, substituting it into the original equation:
+
+109394007*99399 + 13 = 10873654901806, so the flag is: ctfzone{10873654901806}
+
+### Technical details
+
+Structure of PDF files:
+
+![pdf.png](ctf_zone\pdf.png)
+
+[https://d3i71xaburhd42.cloudfront.net/b4f47fb71221a0676e2e892af7b98acad2c3c5cd/2-Figure1-1.png]
+
+### Lessons learned
+
+- PDF file structure
+- Always go a level deeper!
+
+
+
+## Joshua
+
+**category**: forensics
+
+**description**:
+
+This should be an easy one, just remember to rock. (Sorry, the flag on disk begins with CTFZone, please change it to all lowercase, when you submit).
+
+___
+
+### Recon + solution
+
+We get a 20GB raw disk image. The unix tool `file` tells us:
+
+```
+$ file joshua.img
+joshua.img: DOS/MBR boot sector
+```
+
+that it is the image of an MBR disk.
+
+I tried to mount the mentioned image, but it does not go as easy as one would think.
+
+We have to find the starting sector with the `fdisk` tool:
+
+```
+$ fdisk -l joshua.img
+Disk joshua.img: 20 GiB, 21474836480 bytes, 41943040 sectors
+Units: sectors of 1 * 512 = 512 bytes
+Sector size (logical/physical): 512 bytes / 512 bytes
+I/O size (minimum/optimal): 512 bytes / 512 bytes
+Disklabel type: dos
+Disk identifier: 0x70b3f931
+
+Device Boot Start End Sectors Size Id Type
+joshua.img1 * 2048 7999487 7997440 3.8G 82 Linux swap / Solaris
+joshua.img2 8001534 39835647 31834114 15.2G 5 Extended
+joshua.img3 39835648 41932799 2097152 1G 83 Linux
+joshua.img5 8001536 39835647 31834112 15.2G 83 Linux
+
+Partition table entries are not in disk order.
+```
+
+Based on these results we can calculate the offset:
+
+```
+mount -o ro,loop,offset=$((512 * 8001536)) joshua.img5 /mnt/joshua
+```
+
+After mounting the largest partition, we immediately head over to /etc/passwd, to find some more information about who this drive could belong to. (It needed reading around online how to approach such challenges.) We find an interesting entry:
+
+```
+joshua:x:1000:1000:joshua:/home/joshua:/bin/bash
+```
+
+there seems to be a user called "joshua", let's check out his home directory!
+
+We find an interesting file .bash_history:
+
+```
+sync
+sudo cryptsetup close cryptovolume
+chsh -s /bin/zsh
+echo $(SHELL)
+zsh
+cat /var/log/auth.log
+faillog
+chsh -s zsh
+sudo apt install zsh
+chsh -s /bin/zsh
+sudo apt install keepass2
+keepass2
+sudo luksformat /dev/sda3
+sudo cryptsetup close /dev/mapper/
+ls /dev/mapper
+chsh -s /bin/bash
+rm ~/.zshrc
+rm ~/.zsh_history
+sudo apt remove zsh
+ls -a
+cd ~
+ls
+ls -a
+rm -r .oh-my-zsh/
+```
+
+We can make some interesting observations:
+
+- joshua has sudo access
+- he used the zsh shell and he deleted its history
+- he set up an encrypted volume (probably joshua.img3)
+- he used the keepass2 password safe
+
+In the Documents folder we find a KeepItSafe.kdbx keepass2 file. But we do not have a key for opening it!
+
+```
+$ mount -o ro,loop,offset=$((512 * 39835648)) joshua.img3 /mnt/joshua_crypt
+mount: /mnt/joshua_crypt: failed to setup loop device for joshua.img3.
+```
+
+I could not mount the encrypted partition, probably the encryption prevents us from loading it.
+
+We also find an interesting file in the home directory ".recently-used":
+
+```
+
+
+ file:///home/joshua/Documents/KeepItSafe.keyapplication/x-iwork-keynote-sffkey1570444296
+
+
+ file:///home/joshua/Documents/KeepItSafe.kdbxapplication/x-keepass21570444267
+
+
+ file:///home/joshua/Documents/KeepItSage.kdbxapplication/x-keepass21570444179
+
+
+```
+
+He seems to have created an other keepass2 file, maybe deleted it later? But what is even more interesting: He created a key file to the safe, it has to be somewhere around!
+
+We find the key in the trash `/local/share/Trash`! This seems to easy!
+
+Unfortunately, it really is, keepass2 reports that the composite key is invalid! Maybe a password is also needed.
+
+I tried brute-forcing /etc/shadow with hashcat to maybe get a relevant password, but it took too long, maybe with a strong graphics card it would go faster!
+
+
+
+### Technical details
+
+Linux file structure:
+
+`/etc/passwd`:
+
+> The password file is human-readable file that contains information about users on the system including their encrypted passwords. Some systems donât have encrypted passwords in this file if [/etc/shadow](https://kerneltalks.com/user-management/understanding-etc-shadow-file/) file is generated.
+
+[https://kerneltalks.com/user-management/understanding-etc-passwd-file/]
+
+```
+joshua:x:1000:1000:joshua:/home/joshua:/bin/bash
+```
+
+In our case the second "x" meant that the password is in an encrypted format in the /etc/shadow file.
+
+
+
+`/etc/shadow`
+
+> The /etc/shadow file stores actual password in encrypted format.
+
+[https://www.2daygeek.com/understanding-linux-etc-shadow-file-format/]
+
+```
+joshua:$6$6PWRmE20$BAkQBhvRUnnyuGBgIrikxBp8YkOOUO7REg285NqJbFNt7E.19xNTfa2wdT0.NiFxdcw2nMLmT3/hgw1doIB2x/:18176:0:99999:7:::
+```
+
+In our case the prefix $6$6 means that the password is hashed with 6 rounds of SHA-512 and
+PWRmE20$BAkQBhvRUnnyuGBgIrikxBp8YkOOUO7REg285NqJbFNt7E.19xNTfa2wdT0.NiFxdcw2nMLmT3/hgw1doIB2x/ is the hashed password of the user "joshua".
+
+
+
+### Lessons learned
+
+- Mounting .img files
+- Approaching a forensic challenge
\ No newline at end of file
diff --git a/writeups/ilm0/hack_lu.md b/writeups/ilm0/hack_lu.md
new file mode 100644
index 0000000..0736bc0
--- /dev/null
+++ b/writeups/ilm0/hack_lu.md
@@ -0,0 +1,538 @@
+# Hack.lu 2019
+
+
+
+## Cobol OTP
+
+**type:** crypto
+
+**description:**
+
+To save the future you have to look at the past. Someone from the inside sent you an access code to a bank account with a lot of money. Can you handle the past and decrypt the code to save the future?
+
+___
+
+
+
+#### Recon
+
+We receive two files: the code of a COBOL program and an unusual looking output file.
+
+
+
+**otp.cob**
+
+```cobol
+ identification division.
+ program-id. otp.
+
+ environment division.
+ input-output section.
+ file-control.
+ select key-file assign to 'key.txt'
+ organization line sequential.
+
+ data division.
+ file section.
+ fd key-file.
+ 01 key-data pic x(50).
+
+ working-storage section.
+ 01 ws-flag pic x(1).
+ 01 ws-key pic x(50).
+ 01 ws-parse.
+ 05 ws-parse-data pic S9(9).
+ 01 ws-xor-len pic 9(1) value 1.
+ 77 ws-ctr pic 9(1).
+
+ procedure division.
+ open input key-file.
+ read key-file into ws-key end-read.
+
+ display 'Enter your message to encrypt:'.
+ move 1 to ws-ctr.
+ perform 50 times
+ call 'getchar' end-call
+ move return-code to ws-parse
+ move ws-parse to ws-flag
+
+ call 'CBL_XOR' using ws-key(ws-ctr:1) ws-flag by value
+ ws-xor-len end-call
+
+ display ws-flag with no advancing
+ add 1 to ws-ctr end-add
+ end-perform.
+
+ cleanup.
+ close key-file.
+ goback.
+ end program otp.
+```
+
+The first hurdle is to understand the basic functioning of COBOL, it is very different from the programming languages we are used to today. What one can tell on the first glimpse:
+
+- A message is read from user input to be encrypted
+- There is a key read from a key file, that is used for the encryption
+- XOR is used for some kind of encryption (OTP?!)
+
+
+
+```cobol
+ 01 ws-flag pic x(1).
+ 01 ws-key pic x(50).
+ 01 ws-xor-len pic 9(1) value 1.
+ 77 ws-ctr pic 9(1).
+```
+
+Variables are initialized, 1 character for a flag???, 50 characters for a key, 1 digit for ws-xor-len and 1 digit for ws-ctr, most likely a counter.
+
+
+
+```cobol
+ fd key-file.
+ 01 key-data pic x(50).
+```
+
+```cobol
+ procedure division.
+ open input key-file.
+ read key-file into ws-key end-read.
+```
+
+50 characters are to be read from a key file.
+
+`procedure division.` marks the beginning of the code real process body
+
+
+
+```cobol
+ perform 50 times
+ call 'getchar' end-call
+ move return-code to ws-parse
+ move ws-parse to ws-flag
+
+ call 'CBL_XOR' using ws-key(ws-ctr:1) ws-flag by value
+ ws-xor-len end-call
+
+ display ws-flag with no advancing
+ add 1 to ws-ctr end-add
+ end-perform.
+```
+
+The main loop where the 'magic' happens, we read 50 characters individually, xor it with the respective key character
+
+
+
+Here I turned to look at the output:
+
+**out**
+
+> Enter your message to encrypt:
+> ¦Ãây;dhuŸÃFŸ]UjhCÂÅ-â1T`h&ŸÃFâ¡1*T{_¦ë¤p02J
+
+
+
+The second line of the output does not seem human-readable. A hex viewer shows:
+
+A6 D2 13 96 79 3B 10 64 68 75 9F DD 46 9F 5D 17 55 6A 68 43 8F 8C 2D 92 31 07 54 60 68 26 9F CD 46 87 31 2A 54 7B 04 5F A6 EB 06 A4 70 30 11 32 4A 0A
+
+The 50-step loop we saw in the main code body corresponds to the length of the encrypted text, as we are doing OTP encryption, the key and cyphertext lengths are the same.
+
+It seemed like what we see is a pure one-time-pad realisation in COBOL. The code seems straightforward, brute-forcing would take ages. I got stuck here.
+
+
+
+#### Technical background
+
+Functioning of the one-time-pad:
+
+XOR-ing each bit with the corresponding bit of the key. This is a perfectly secure crypto scheme, for an attack to be realised one would need access to at least 2 pieces of ciphertext or preferably an oracle.
+
+#### Lessons learned
+
+COBOL is still used, the last revision was released in 2014
+
+
+
+## Lamport Verify
+
+**type:** crypto, rev
+
+**description:**
+
+I finally managed to create a signature verification service powered by time, artificial intelligence, the power of music and the randomness of entanglement (well, Leslie and the Emperor Penguinâs randomness also helped). It is resistent to all known and unknown attacks and will always be uncrackable. Leave and believe!
+
+nc lamport.forfuture.fluxfingers.net 1337
+
+___
+
+#### Recon
+
+The description first seemed to include some clues, such as "Leslie" and "Emperor Penguin", but I did not succeed in finding anything meaningful relating to crypto or signatures. We are provided with a binary called "verify" apart from the service. The name of the challenge hints, that we are dealing with Lamport signatures. (see TD) We connect to the service, which gives us the functionality of signing and verifying something.
+
+The functioning of the service is not clear at first, let's take a lot at the provided binary with Ghidra.
+
+The analysis provides us with an entry point:
+
+```c
+void entry(undefined8 param_1,undefined8 param_2,undefined8 param_3)
+{
+ undefined8 in_stack_00000000;
+ undefined auStack8 [8];
+
+ __libc_start_main(FUN_00401400,in_stack_00000000,&stack0x00000008,FUN_00401720,FUN_00401790,param_3,auStack8);
+ do {
+ /* WARNING: Do nothing block with infinite loop */
+ } while( true );
+}
+```
+
+We find unnamed functions. FUN_00401400 looks promising, lets take a look at it!
+
+
+
+```c
+ulong FUN_00401400(int param_1,char **param_2)
+{
+ char *__filename;
+ char cVar1;
+ int iVar2;
+ FILE *__stream;
+ size_t sVar3;
+ ulong uVar4;
+ int local_38;
+ uint local_c;
+
+ _DAT_004080c8 = 0;
+ while( true )
+ {
+ iVar2 = getopt(param_1,param_2,"hv");
+ cVar1 = (char)iVar2;
+
+ if (cVar1 == -1) break;
+
+ if (cVar1 == 'h')
+ {
+ printf("Usage: verify [-h|-v] secret_key\n");
+ local_c = 0;
+ goto LAB_00401713;
+ }
+
+ if (cVar1 != 'v')
+ {
+ fprintf(stderr,"Usage: verify [-h|-v] secret_key\n");
+ local_c = 1;
+ goto LAB_00401713;
+ }
+
+ _DAT_004080c8 = 1;
+ }
+
+ if (param_1 - optind < 1)
+ {
+ fprintf(stderr,"Usage: verify [-h|-v] secret_key\n");
+ local_c = 1;
+ }
+ else
+ {
+ __filename = param_2[optind];
+ DAT_004080b0 = &DAT_00408070;
+ DAT_004080b8 = &DAT_00408090;
+ DAT_004080c0 = &DAT_00404070;
+ __stream = fopen("flag","r");
+
+ if (__stream == (FILE *)0x0)
+ {
+ perror("Could not open the flag.\n");
+ local_c = 1;
+ }
+ else
+ {
+ sVar3 = fread(DAT_004080b0,1,0x20,__stream);
+
+ if ((sVar3 < 0x20) && (iVar2 = ferror(__stream), iVar2 != 0))
+ {
+ fprintf(stderr,"Could not read the flag.\n");
+ local_c = 1;
+ }
+ else
+ {
+ __stream = fopen(__filename,"r");
+
+ if (__stream == (FILE *)0x0)
+ {
+ perror("Could not open the secret key.\n");
+ local_c = 1;
+ }
+ else
+ {
+ sVar3 = fread(DAT_004080c0,1,0x4000,__stream);
+
+ if (sVar3 < 0x4000)
+ {
+ fprintf(stderr,"Could not read the secret key.\n");
+ local_c = 1;
+ }
+ else
+ {
+ local_38 = 0;
+
+ while (local_38 < 0x20)
+ {
+ DAT_004080b8[local_38] = 0;
+ local_38 = local_38 + 1;
+ }
+ local_38 = 0;
+
+ while (local_38 < 0x20)
+ {
+ uVar4 = FUN_004011a0(DAT_004080b8 + local_38);
+ if ((int)uVar4 == 0) break;
+ local_38 = (int)uVar4 + local_38;
+ }
+
+ uVar4 = FUN_00401290((long)&DAT_00404070,0x20);
+
+ if ((int)uVar4 == 0)
+ {
+ printf("The message is not correct.\n");
+ }
+ else
+ {
+ printf("The message is correct.\n");
+ }
+
+ local_c = 0;
+ }
+ }
+ }
+ }
+ }
+ LAB_00401713:
+ return (ulong)local_c;
+}
+```
+
+We recognize a simple c-program (I reformatted the code for easier reading). The hardcoded usage warnings tell us how the program functions, even though the parameter "-h" and "-v" always jump to the end of the program and returns 0.
+
+
+
+Read 0x20 bytes from a file named `flag`.
+
+Read 0x4000 files from a file named `secret_key`.
+
+Get 0x20 utf-8 characters from user (@ 0x4011A0). Weâll call it `user_input`.
+
+Verify if the `user_input == flag` (Time-safe memcmp) (function @ 0x401290).
+
+If verbose (`-v`) flag is on â print âthe signatureâ (function @ 0x401290)
+
+
+
+```c
+ulong FUN_00401290(long param_1,int param_2)
+{
+ char cVar1;
+ byte bVar2;
+ int local_20;
+ int local_1c;
+
+ bVar2 = 0;
+ local_1c = 0;
+
+ while (local_1c < param_2)
+ {
+ bVar2 = *(byte *)(*(long *)(param_1 + 0x4040) + (long)local_1c) ^
+ *(byte *)(*(long *)(param_1 + 0x4048) + (long)local_1c) | bVar2;
+ local_1c = local_1c + 1;
+ }
+
+ if (_DAT_004080c8 != 0)
+ {
+ printf("[+] Signature:\n");
+ local_1c = 0;
+
+ while (local_1c < param_2 * 8)
+ {
+ cVar1 = *(char *)(*(long *)(param_1 + 0x4040) + (long)(local_1c / 8));
+ local_20 = 0;
+
+ while (local_20 < 0x20)
+ {
+ printf("%02x",(ulong)*(byte *)(*(long *)(param_1 + 0x4050) +
+ (long)(int)(local_1c * 0x40 +
+ ((int)cVar1 >> (7U - (char)(local_1c % 8) & 0x1f)
+ & 1U) * 0x20 + local_20)));
+ local_20 = local_20 + 1;
+ }
+ printf("\n");
+ local_1c = local_1c + 1;
+ }
+ }
+ return (ulong)((bVar2 != 0 ^ 0xffU) & 1);
+}
+```
+
+Here I reached a roadblock, as I could not disassemble the used data object. I looked up writeups online:
+
+```c
+struct glob
+{
+
+ char key[16384];
+ char flag[32];
+ char user_input[32];
+ unsigned __int64 ptr_flag;
+ unsigned __int64 ptr_user_input;
+ unsigned __int64 ptr_key;
+ unsigned __int64 verbose;
+};
+```
+
+[https://blog.nsogroup.com/hacklu-2019-ctf-lamport-verify/]
+
+Apparently it is possible to dissassemble them, but I did not find a solution in ghidra.
+
+#### Technical background
+
+> In cryptography, a Lamport signature or Lamport one-time signature scheme is a method for constructing a digital signature. Lamport signatures can be built from any cryptographically secure one-way function; usually a cryptographic hash function is used.
+
+[https://en.wikipedia.org/wiki/Lamport_signature]
+
+
+
+![lamport.png](hack_lu\lamport.png)
+
+[https://asecuritysite.com/encryption/lamport]
+
+2 random numbers (A and B, to be used as the private key) of the same bit-length are sampled, and depending on the parity of the hash to be signed either the value of A or B at that particular bit position is used. The public key is constructed similarly, but with the hashes of A and B.
+
+
+
+Lamport signatures are also often mentioned among post-quantum crypto solutions, however, in this case their limitation is that they can only be used once.
+
+#### Lessons (to be) learned
+
+- Lamport crypto scheme
+
+- Disassembling complex data objects (C-structs).
+
+
+
+## Evil corp
+
+**type:** crypto
+
+**description:**
+
+You were called by the Incident Response Team of Evil Corp, the urgently need your help. Somebody broke into the main server of the company, bricked the device and stole all the files! Nothing is left! This should have been impossible. The Hacker used some secret backdoor to bypass authentication. Without the knowledge of the secret backdoor other servers are at risk as well! The Incident Response Team has a full packet capture of the incident and performed an emergency cold boot attack on the server to retrieve the contents of the memory (its a really important server, Evil Corp is always ready for such kinds of incidents. However they were unable to retrieve much information from the RAM, what's left is only some parts of the "key_block" of the TLS server. Can you help Evil Corp to analyze the exploit the attacker used?
+
+(Flag is inside of the attackers' secret message).
+
+
+TT = Could not recover
+
+Keyblock:
+6B 4F 93 6A TT TT TT TT TT TT 00 D9 F2 9B 4C B0
+2D 88 36 CF B0 CB F1 A6 7B 53 B2 00 B6 D9 DC EF
+66 E6 2C 33 5D 89 6A 92 ED D9 7C 07 49 57 AD E1
+TT TT TT TT TT TT TT TT 56 C6 D8 3A TT TT TT TT
+TT TT TT TT TT TT TT TT 94 TT 0C EB 50 8D 81 C4
+E4 40 B6 26 DF E3 40 9A 6C F3 95 84 E6 C5 86 40
+49 FD 4E F2 A0 A3 01 06
+
+___
+
+#### Recon
+
+This seemed like a very interesting challenge from the start, but also deeply technical. We are additionally provided with a .pcap packet capture file.
+
+The first step was to find out what is key_block and how does it relate to TLS. A quick google search returns promising results:
+
+> To generate the key material, compute
+>
+> ```
+> key_block = PRF(SecurityParameters.master_secret,
+> "key expansion",
+> SecurityParameters.server_random +
+> SecurityParameters.client_random);
+> ```
+>
+> until enough output has been generated. Then, the key_block is
+> partitioned as follows:
+>
+> ```
+> client_write_MAC_key[SecurityParameters.mac_key_length]
+> server_write_MAC_key[SecurityParameters.mac_key_length]
+> client_write_key[SecurityParameters.enc_key_length]
+> server_write_key[SecurityParameters.enc_key_length]
+> client_write_IV[SecurityParameters.fixed_iv_length]
+> server_write_IV[SecurityParameters.fixed_iv_length]
+> ```
+
+[https://tools.ietf.org/html/rfc5246]
+
+The TLS 1.2 specification uses this block as a PRNG function to generate random bits, which are then used as MAC keys, encryption keys and IVs. The seed for this PRNG is a parameter "master_secret".
+
+Let's open the packet capture and see how we can apply this knowledge!
+
+Looking at he capture we can see a succesfully executed TLS 1.1 handshake between client and server.
+
+As a side note: I tried to copy a packet as text from Wireshark and noticed this strange hidden message:
+
+```
+E?2@@ ¨BQh³¼Mÿ3
+%@5V%@4ÃNobodyknowsimacat Stop looking nothing to findhere5S7EvilCorp kills people
+,*ÃÃîîïïÿ
+```
+
+The packet capture is very short, it includes 11 packets. After the initial handshake we have some "heartbeats", after some quick googling I and looking at the RFC once again, I found out what they were:
+
+> Zero-length fragments of Application data MAY be sent as they are potentially useful as a traffic analysis countermeasure.
+
+But, what I also found is that they are the responsible entities in TLS for the infamous Heartbleed security bug.
+
+The alerts do not say anything meaningful, only "Internal Error".
+
+I tried looking for the expression "key" in the traffic, but did not find anything.
+
+I looked into the Heartbleed exploit, but for it to work one would need access to the keys, because the heartbeat packets are encrypted.
+
+#### Technical background
+
+The Heartbleed bug explained:
+
+> Here's how it worked: the SSL standard includes a heartbeat option, which allows a computer at one end of an SSL connection to send a short message to verify that the other computer is still online and get a response back. Researchers found that it's possible to send a cleverly formed, malicious heartbeat message that tricks the computer at the other end into divulging secret information. Specifically, a vulnerable computer can be tricked into transmitting the contents of the server's memory, known as RAM.
+
+[https://www.vox.com/2014/6/19/18076318/heartbleed]
+
+This could make it possible in this instance to leak the full key_block from the server, the description itself mentions that the incomplete `key_block` fragment is from there. However, one would need network access to the server, what was not given here.
+
+#### Lessons learned
+
+- Deeper functioning of TLS
+- Heartbleed bug
+
+
+
+## Shiny code
+
+**type:** misc, steg
+
+**description:**
+
+We got a video leaked of a new transmission technique working only with lights and colors. The company using it says it is completely secure because of its secret encoding. However, the whistleblower also says that the secret encoding is somehow encoded in the message itself. It uses an old, historical technique based on short and long signals. I have no fucking clue what he is talking about. Perhaps you can help us?
+
+Download challenge files
+
+Remark: This challenge has a non-standard flag format: FLAG{.*}
+
+___
+
+#### Recon
+
+We receive a 10-minute long video of a custom made PCB board with blinking LEDs. The surface of the board is divided up exactly like the FluxFingers logo into 6 areas. Not only the pattern of the areas is changing, but also the color of the LEDs, however they do not mix colors. Each color is changed after 6 seconds, I could not find any pattern regarding the colors. There are "steps" with no LEDs lit and also with all the LEDs lit up, and of course everything in between. Each blink last for 500ms, so one color is present for 3 secs and colors never repeat right after each other.
+
+My first tries were interpreting the signals as a form of senary encoding, but senary is not really used anywhere apart from certain representations of base36 and base64 encodings. Base36 seemed very promising, we have always 6 frames of consecutive colors, it would have made sense, but as I tried to decode the message only garbage came out.
+
+Trying to interpret the code as some form of Morse was a sensible next step, as the fixed length pulses provided a reliable way of differentiating between short and long signals used in Morse. However, it was still not clear how to divide up the signals, interpret them grouped by color, side, image region, channel.
diff --git a/writeups/ilm0/hack_lu/lamport.png b/writeups/ilm0/hack_lu/lamport.png
new file mode 100644
index 0000000000000000000000000000000000000000..cf67ca99ce1bf4e573d1359404e73b0f976efc18
GIT binary patch
literal 47676
zcmeFac|6o@+dn>STBTA6AqlCFgfzC2BpFJQY>7-+3yqz2iL6PMAygv~<6&*%J{%dxzV_i>!ZxT_%)88@(P
zfWcslN@q@8fWcO)f`6{BTM7P8@s!IJ@UIot7Zgvz5~_9&fd5#HJfU&|221wdIA^d1
z{P+4>XSA$gu+4?gKP!qYV~k+1%o?RrCobCQ;oCOm=v=q&r%dpie6B2aYURUct>;&q
z-y-t#Zs(eNQC3Oo#u9Jr-_tI*KUR9D@SaQFr6*K#o!1p#*=8<%FLM2X)oBds+`PNB
z->`jDPO2fSaX1uNoIV$>RV`|os5KI7+pFssk3r@RO_8L+4+n|`O2b7*X0IDt_DVyu
zhlxa@U@*Dlp7KCpoe#G-?~1>abtPx^g=L$!h&!(2IYEHI?yk&ecX&^bUva}bFc*J)
za`)-`xD_zi8Zy3`Trn92ODkp$pFZWddH!MS=C7x*h|QQ)FxUno)4nb)$~0xo;aKuO
zIJq?JJ=W_1_2n3jSAsDdOeSk#uVChR}<9W
zJE+?V7Vz>Q7V&6dWxX3P>f8%U&OAxD_+)-B{wKa-GSwNF^HJ~K*C$`9UEWGhz>M$V
zR?M#;rmdZbpP8N7Z97nmFk;(fAJelU!;SOfAvO3%oe0!{Qv?_$3KhKDWNpj_%&LkV
zCebIco7LbZ(WMcnyYJNCx@mS_b`r@Rclugl^;WU4jvv`|4;Q-yvkL2lyJ-bv;{X<6
zGpn0&{mV7@m)qnlqm2rL3fASLFkep+ICu4mr#^gmXJ(77WwVeH;o|*e<5ZnuwX5Sj
zxJUSGBjWor7EAd*JuF<8%&E6-nzyQ)MsJ*^S_@ea7WdCG~Vy=+k%v`_eFQ`a%22&
z2F)p9tBhX#_T8r@{MtKH_u
zKN1lZ2?rbI{@WB-HQ+NA16+ddI3hIt!+b0ZS<10q+2_ww)Zq2Mk9WEO@z#=IM?=-C
zpo4-jXoJSkZ2muPMGc1Mh*oV2!uvR;4$hr%y$rz>hYqV)^U%@7b(Kl(twAnfALUn$
z=(w$r(&NJyl=35?{$N4SB=do~fM-c3~75Th%PsdF9q
z66;Ze8P9Yyd(eHCQfOAXNk@J-7fr4o6u-GgOpN;R1=9kyquxtFxuarjt(BPHSyTR*
zT_MKqc{fGzg=VB0_CaKTBdJuZ#Zg7JfnkXC4klm|^{aGM)-}ZVdlEfXpRV_E_Ef1;
z5N>x2=O^W^*-LcsMeDs3nhaC@A>-$aGym9c`^;E+*|#ejyu5ZGE(kc-_479~v~L~s
z-?+2EOZbk1VMfdQ;DQYI)4EA1kkWg`aWogC$QJ@_T0eh`l~{x@{}DmonWUh6RA@){
z+YK)5eA;S3bv?M+7R;2jUkjVrfq3-Xb<T95
zYHRP}#5Cdd&8jJkvFHNZtA0TDY
zv7FOn?f!YyNC?9DvQD4FRfLG<;c7g(T|$jV1Gh{dFB3L}iP^>C*%eh@dqLaA8-u!#
zi3iKsHm}BP?>SDN<{Z?uZBdx4g;mt9=MTN=s5;(@b{LGUJuJC#=b@xjj~kOEKY^U>
z|7E{?-5d(;qwnZ5el)8{L3OwCD!KdCSvZs@5IR>u)Bj7{?W
zrTAL&>3!^KDAoB%N1G}jeogMLh#D-8l=0i4CR7E?E>2JZp#qrLEzkKM0OY@AC!vG(O|ETWLM1N8A>{ts|B
z?PAc7N2Q`IuzHTGR%&oYuvl=8X=^ZDCkWs$R-M~y68${_RR%%wvd!jCxjIs2Uw3~Vx0unG>~{}L&=YHGxmwsK(;(Yp
z$e-|`t2nog)4n@A?}&AzX!DS&a6)7F?dlz(EXgfr=S=FKRtPpofDdZaSGBZHif8YH
z8ER*v;-w!I$<6N=%s(m?SNitMr@?EXxKbVQmIKYDC=a#|WX}nh-D;JUL
zGIin7i8|X*2|EYEGKm7KXM2YxI|?IoJrmH?ZHDao*3NMmD;s}fvl<~xBwor;S`}MB
z+eW&0f|L2@473I#^>ApY36d%>%SU
zPK(#XY`i21_MOKR>EPf{_f`dEbj)P!It2)z0`Uba_=ipP5I||6zL+TZWw+f{B`Md-
zrJ8|GMo`Tqka%!@nYhw&7eDhegiU#?{3|}XH5WSV-s>{dc*7}!GA
zRMdsS6ri^!&qHXMwh&PakLYMnT95?N2@}OqN;+2gO_;mCItj-rWjcDHS;C9$EC)1!
zuQ;Wib$a*
zc!j6iycwd4JaQ6a-R-NWXWtVb?DTyj;n>|Vs`H_%>8Mh=71dggLe|%2`K}t|
z?3Sog1jgSZbUS9%Ln=^OtbJh3j};J4m#leS|2^Z-0|PfzyI;p}?AbnVspzU)Rf1z>
z{?mX!ofpd?-9pf9Bz+s#FVN)!6JEm^kuYo`OY|u78f08G?<9iLeghd+F@$j7u
zz;x}}&u)TTNk9HAXD_M1A0i@Ad}s5H7?&xiu8-r$4klxac^=_{U_b&cmqJpq=rJ6x
zBx(QpSoFD)?V+a#=V0KYaYm4WtmA$Emg6MSTLe1fCeS|-2tY0
z&-1uo)H*bH>3KweK@2(u%;FmF5KvRO{aRv#Eyvw)LHot(5fqa){}^=UDWJpwalr1w
zB8=+OaI8mfy?KNY
z#Yc*2({S?Vvkkx<+*M04!ExJc1Lt_U(W_*&swG@{5Q`Xj*!n^XwG$&6`1`bNE*cO#
zPt$^mgId76!A_RGyXp2-35!s?-ag5CP>-Qw62y=vew%o76vH6cPxjv@N|W-X%cSAs
zWgGur^kB)Q6n4v;^Lp4V$$@zjZxlK1Jm*+(SEK}5*Of*c>&ikV**H_@{h1$zrPc#r
zunnUgp+`8RpV!LC34?73thL0e(;{c=dvui7@iN-~o*C~O^5X*b0KzWdg^~x?n3!O&
zCtgA`5%WAlS!0y~i*DK`k>fwH>fTa6&cIi~41E*|Hb*?N(bCN7c8jE$fc^ULA6J_T
zAAcyZHZJw!MXiPv?eVzJadP88N`g%(lfok01Rd)BChjyJp`o*Zb85inYtqg4I^O?j
zF9EE;iVPiVDwaX5xSL!VE*p-E-9UvZOP2wj193yc%5_JjrOj0%L>9mlkiN*PZeLGk
z#U0fBA+MnUhYg-y02|9!`wLk8`!A5CS}F_wox8IdTlH2Yq#+X1KAE0@cKT6@TCLKY
za@|AP)yJ-K=mpM{@$Q%uDjHozl7Fo$6QS&~p9aSbTXDYVblu)+S%-p^Z{JuqA>b;~
zy&{>+L09^oplw~s$ix=)b?(ue&J~~f(B#jWdLIv0yi6@-X40Vo(UVPCVPAP=f%k^6
zvxo(uWWaIcLsw&OrQt5)ika3Ndk<7cTiD4nYVb|W$ANwHg-A{}gF!ZvVgoa4F&r$I!ov{&AMJ97D9>GQ6CzML*v*9xf#bcp5270lUS>VU-9G>S>|hTz
z2hbawtROU08%dbw{3g{V%50C
z`<>?4Zr|mcWiw%xcg)t}`zD=k-w@eBvyYx^CTjtvyruvtIy&gfLC)F{`|7Nb?kd61
zdmd6pobyswba6l@mgXpv)vUMK0R%mdaVG$fyG)HEkiBzvW(8H%;3}J-*`BSq*=U){
zZ_uD>AywIIC9dvt&{jt}DX6|GT{TbC`kG}su{3;N-!6%V33-x|4{!n^*v)_={rnVK
z*C4t@)2wE#!^ampGT_>mjs%6Y{3!hLpzjLdSah}aT;V-p|KqPSb)~FW1dtvfljzUe
zZO?dXbMzqlU+ahovlp2RIw
zP?f60dt>|qv)ckcK4w0+|v9z
z{(A1GF1n`PlM#qPlch^-H1k}Kgq(*1J^B!X-q!V=!_>3YyYl6^itUzrYUg&5+Y!BP
zw_0%n`TqWuFVnJ*@Lz!UxGg%&+@-HDj2DV4BMz0kyia{4H;ncQuN$O?yvBBJug82o
zS5#yl9EQsV;c6;tt3!SY2k@2MZ5=sz%e2^;5mURK6)bZE6RP;cd)seZ@k+2f-P4{|6q
z7sX$CihGQ^2`R-Bocj(aY{$Ygy<^_AR!6)sjOc7Y^!i&?iB}0&q^ZH5G0{%g!0kh<
zf8KY|sB?tvPG`+~FJP;5HZ3{OBvdO_sbe%~>m~TkeL<$f`HIi;DDs4(GFUGUa2}bP
zmAa4<-aUY$GT!jcwR055I<}E12CcPZ6#glt^rJ4PDVGsygbC(1XJjoOHzLyWTD{xP
z!{5+$t;pRi&3rar_M^QpujUc42CwmP*&`(7>lCgiEMg`CrN(W-4~U+%81<23V?OCB
z6n>M?sSBY~=BFDG1={kgJ4G!B+eve(ly@olxxqLAN!t9@aQHbY@@m4@P>MrvGNt1F
zdL(9#SvOozCA9mo3%kFe{Xl7Ml;3;weM(nl3GTLR(c3!8;Sh`7hN^Q8KUELSk=9}n
z&5-FuxQ{s
zi0>AEg*pppMVhIPwcVip8YCVp&WYPKI4f>6YQ+g0vo)R-smqS|gd3>5YOzBH&^Ca}
zVZqc5vjV~za7D5UE+$%3G!1ncFj@Z;R>24
zwgZGZ&8D=8`UqhW@^n{pTy)jINy1SPXrB#UevLrEJWoN!a+7)^WP{ucPJ)2(@HR*e
z51-S8R?G2tJqIvAS2C@7CMME2PMlh7h^dY*<|`J9O_G*QWBdKJ1!KH;e7d>aT!;36Z~+^H!1SA(sMT+8x)0d*tR{xt@x%$u=CW0Yp0tv
z8)Or_^pfrxycB^jj?9g4XS~3}hxjzXRa-h!%7sG0!qTJF)@e5~)4~Oa04$2B
zXjWfwSf-kJ1I*<5ki$u8FaS}3igHj|I6di(^eY9Hw-OkU
zLaE5VpZedu6Wn)bVDWEdg2vDTYjq6krL2dva?tlYNoTq+L($d!JQ94=o_O`V83B?mK)L{KbboUAwgmtHZaHzOz`YUyG+>9&Fog
z7oNZ=9U@$X);_k1#lE}O`#AgIsMA!90y8M$B+1da{5M)To!q4KsW>8Hxb+k3hZ3H;
zJ~;c~cHjnqX0-Sl;*N5)nF+6z25y0;n$3~?@XVzJD-Guc
zYI!;yWa;n?^-+2L3GjyxG?>K1YC*@s8cQVsy0%U&5Qls4_sTm_GaK0x(
z2hQpca9(9vg{a!g#rQ+@-7V5VS
zTI6nTKpe*+r0HkkFEv>ZgPvBS1w?3v;&^o0?v!w3dG4B{)9IeMQ+|xwzUSRB)ZDvO
zEKVDI5hSM`|2i?RL=-+3J%=p4$Y=aiV#`gJO|F*w<1Om|b+~KUq5!2kk392m$y2Bw
zT>I36UJA6!ZAy1De-ZjJ+nr3qo;0}@wR&uOhK)(7qQdE2rE?#@Iy_5j_I>SaU|Fu1
zkyZZ2d$=GEy5K8u60c$rP7Co>ZdXH_hk1=U-c$#i^12H(-r&G;X!^%9TX*D
zP>1rRB(*3^mfKIGZJ)REVH19t`KS{}QyhoHomvSedh=*RQd5N6Xiy4^YT3
zeo-r4c|w{4-Aecs%k081bNzzVvKjs~TwQdlJ%d#jzQ&UAdd2e{m^vUi^G=Q@`jz~w
zu7Tx9_mM)TMGw-+@CXt)BUk8SdX*z|`6fCrqM&1D!V^rx7*TLOYpA
z8Md`i56ZA!(R^IHjol{MOpoDzjzEPxre&5hn<*w_dXxd9AqinJ!#GLga&%!zBa4
zYv%y}Oi7byP-;V;@TjQq&Cm%~2Yz;`5aEVHLC%DVxl2Pve=EF?1ZrhPoF(|!rH1mN
zRE~hiA{4~68Kw*!iXh?4Zc@yfD4HoP`BtTivM};Ag<&Db|prD*4%XM#A
z(8N6=LxSy2`Qk_#tU_lElCUnX}~kt|)tC--s!9K0ao1~1t_^i?`^&O+78U>Ajc
zl>HE;>|XttksZIK^CS(`{|(alKkLK@at3$2c8bPD%ZZFt|U604S
z=|>B}TlDlf6&3r*iLZJz8tZTTJN+#G76tt8d`g!|Hkcj+EP$p3zhHnFpPm`_o)2Z*
zy`AyR$WQ}S?tKY4KgzDdPSPaYOjngA;WRzqd4+l#9o@KcUE1~XosJt;$UXS|0Z?nI
zy+G{J_k9&i?%}dWm&Q1s7yKc};BYTQPo1eCY=S@h0Hqf;!(dxe{zWm;qEFC^W%n8_
z4$9VoirZf^rdQEE@rfT=PYZ08f}gdpUy&GdcxAw2shrfGxo<5dR6?ixL+oCg}4VK%`z
zKU%myD+Jzo10@L-E#tU~-V9+&XJmO+EriM!$pxA(aSpZacFlF&0jeooFt{u3BK$R7
zz~T4L=hQwU2{;URl4?C*{YUM4GUT6lETq+FMK#P1ehxJXgG`_oOm5vDA6TXJaGE0p
zR_428Y#1%V76Fyg&zH_;{^+lPAbtPRHOv?Mdx&OLohO3ixy5EdJ$&z
zn;Js%gq0-E>lXdc_!)pq?kS#U9O%M}-UYHQcX$88gBQHhcrTRIzZaxZVVDPd=i%Ky
zA=q~jUD4!g3zW$sefhVvQMK&f()J6bx&JGq%{nQ0!O_r_VJ+-mVZrD=PAP$6$^
zKSJi=Zf$o!$7XIJTDqT3Icx&__?u-5ETmY{NLHGKT4wtI+)IvT;f3-$f3TW#okvhd
zCV+BW;0OL_u?i^G`zS?nwXwSW88g8NHyAa$euNNNJ3|$M(GhnJ{^9
z2@$^k&-1bz%i%xWL;N!_NVu43!>F=O6fI6$_AR=X
z3lTR5Y1lWQ0&&X{r$v7tWu2f_%ICihIDUir^f&(*2ReU~00Q4sdH|xp*4if&-vHB?7
zpp~GWELj36|04pk;LQIu!7jq7snUa*#GZa<=n??W|2SF$`1C&y
z1s?!BB&3^#^#X(!;nlkNT!{PXe2w)mpFf1Fzv!#QQH41uwEUA|{g($EKzYC&2>AUc
zG;-~)Vh&Ik3MBRB|D7?1g&wtn@lT=37`Xm;O;wnRdjALt7gB&!iyI>Ang_zQ-+(+d
zSV;pWq>20Um;WqN@=ww*C419s1}-e6RrnbI!>*lSf#Law9IvLH{hL26>v!($KN48{
zwN(VQ`isg`|2pWnS@#zB=%)WWgO28uFTk(-WzYdGbaDS3qqmqurdm01SF+PzSvk3z
zPF}K?{)h_ynJD%jvWqA3Y>TJB)c^`>wcTS*8A4i}*~T<3s0!_~oLUFerXn?z6A?5&!nDw0A*;
z=O5qwyT9)BcX|2DJNb(nwY|pjpxU>FDRoRFeI8tio8vy`*TMEHE@5SuS!v@_>;68=
z?c~;o@ZvR%tc0!6yiJ9!HJ
zvS(ZDYm!(pCVi`c-oxD-c_&yj!9yc}wu0;Xub5w;64sZV(H0Bm?k9%jijJWAW$
zom-9|WM+)u?68~^F5@mkv$2|yIBKF{KA20p{N1hjvJcEtRkot2xGD0r$NeRL)*dc2
zbMj=A+d`YLU&2P(Wu5t}x)zzxaf-uEOhAtbo=rczZ}DsiFMyQ2-+EUqP!|;h*;9iv
z)XkpX#4EzoQCGoU+uT(9RTUV6ZcwJq1_l$*WqZD;tS|a!EmLap_7$)TSx5I%vrP+I
z4jsEp5d*AbfuLNV{tABdl+Wy9hwUj}S|P~K01noGV
zD>3(BoqXcCpE*@{hv^#V|Io_^ejW5m
z6GgoNF90FFO5tY$wb0j6tro`%bTWVh$)Kov+kfNYYa8h$~(ugl2Vl>4!*o
zL)E4iOp3XwwG@vH=IBKfQS{3=(DjzTDN&f0#a(ZU==BwgiyeN=7P?IH*O~eG*wxLz
zWcNa8$G@jTElF9VzyAw%hwldUGSD&FWgr#NTT$MvbLWu{s(ux6NPoDu&?$jGl3E{`
zFiEYC3^x9Dnkz`Aqxn?}z4+?fS0|fP=^)1#v=Zw=p&Yy8tyT1#!YOO=anf797_|GY
z1;Oi08v{y;0c^f6(-0Q{*EBY+r1Nc1Pj89*lwTE~fIge=3;A6G|ppKmCV5l^?ku^Eqc
znb1ejx;BNH4mr;wapo~j0JP$w6=@X_d~6zJwbzNRfBpd!V@^uEupi-f1@&Fyv8j0R
zH5s)XwfgV}h7$W~4@RQ~ITy|;q&tEUv>KtM&{M%xqgq{x8F$4#wQHm1td7NR!5t-a
zW${ym9|njk^ts&bbXL^CRpz3Rs15B+zO1Oq841_j4-Di9n--P8F5X;p?YB+PG(Oc6B#
z4W;ZB>bYKmqD+y)P*J8y#6?2I>T{IO-!Y=bgZt_zuXGEF>uokjy!vawbsgzo<9T+k
zM)n2sML5aU>gmL|u^quP=y>S_&%1A3CdVIv>3*SW;4u!rbQM{KLnn>T?$JDQrxC$+
z)$p~~Ia%W)w#K*q_CpD%Bj$D9EBbhlRYdV9QzW0})5}_*=TVTY;pynbBP=?;ejk_i
zrWSZ6sL{N4sgJ+;^czItg%tPBoQ+4VR&kgh`~Skg9K(qEOFYCC^Ap2_u7e
z6sq+vxBf!Wm}|B>`^Cpbpnh$C(5qzJ`9hbdEA^t|
zu7?N_i?$$ntpw0$h
zpeJ-2yci-)vT=Y8gE(qG#s7L371P{U^@T;>Y4zPL(cvz$AO;4Fd#HEm7hh9YR?u0Q
zheCBY+h$9F``W!C-edS@O!EK#C8^`6*4v6E(O1A->A$^fA!QP6_3vl?`ZCJ@?EP7K
zwQJ#imfUy@y6jPXRY8lT>o6@msg6MH=FcBhP?etDMZXL7a3MKIePIpOD-^Ry?iI$g
z5vRTm#`ddp650cZ$AsZN(F0L?ETRW+1;1(@H-DvV)uO)D0MX;R8Itf`y{{5_54M6
zv(U@y1fzuaF(@nJ&f>PGxSQaPt0X9N`NhZ8d7j@|bAwRPijJr}B6a1jKkNDQi65pe
z|H{IX6EW)WTxKh6<7Tbq=UZnkm+FJng8oNKSIZpIiMt8IFyCD+FYYS6=HZWP
z4M)wnOpu^O+%iEiW55CL0eVy|{r`Uu_q8`Tmw$BC(ck2KMKEZDxl|fpl~K#Z?QSpV
z@w9ZkR3%*^5FD>)TKMYPLCu6#(Axv#vn3abq!uQq7R1OdzT0(f42ize;6fy1m^G(B
zIigiCHYB|`nx?vH_u{oP^lWMrRGkOaE%Ro2T`5zpuKf{i?WAE_*;Hn6h-(U1K`w
zG{3lt2EbD>Np|}%xlR{SMku8G4hnhd0-Q3&MHvgH%!GG<*KOPF`vP;idDA&yM}J*-
zou7XWU|?jsSgVhXIRn&1LU^cP{N#TA|Qau80oDTiEwrv=Y8Pm)i)IhPqZqN&*=XX>t
ziOK2PDySKoqRbE9wOmf4jrn9uLzSf~v4xA&ubAla^F51@&h&t)>#Qs@$nR$^-{UP;
zK^3#&?%SW&u;|?CaGsJL{kZBT;R#^1t-PftFQ*u}qr5=7P4czk0BFwqH@!fkK+HY)Mx!>0`;C{sK)sdpK+8wLc;_IC!>`B|j!VRL+Fo16)nl
zTu6K^NTd_s?X9Q3yXk{Io7==?XKTD`am`tGhFUtvD6Nu?F)!OW8PJ(+yjLQBrtDy1
z+R)0o49jHUK@(Vz!lj<;7I+8Kz1@jT*i9d0Jjb%rIA
zTr53&n;&iCXXH(882E(qeKyr%nGa+$`}C4S;v9cjOl_LGC7@51GNWqui5Z9kURgMI
zqC&L#dDF4UCc{S1j}z&wID1OS<=efrWrJk&h*KXVdv&>O9pJsOK<{
zkUc!BPcC=$y