From f431e1981f8fa9b30d0b480e97e1f587daf5dbbb Mon Sep 17 00:00:00 2001 From: Jonathan Herrewijnen Date: Tue, 17 Sep 2024 18:28:35 +0200 Subject: [PATCH] Adding DT_Sphinx confluence push. Fixing some errors in the documentation. --- README.md | 5 +- .../.~lock.exynos_exploit_chain.odg# | 1 - documentation/Makefile | 3 + .../confluence/.cache_confluence_config | 1 + .../confluence/.cache_confluence_dochash | 1 + .../confluence/.cache_confluence_publish | 1 + .../.doctrees/BootROM_8890/01_start.doctree | Bin 0 -> 12494 bytes .../BootROM_8890/02_frederics_exploit.doctree | Bin 0 -> 31004 bytes .../03_exploit_boot_chain.doctree | Bin 0 -> 57638 bytes .../.doctrees/BootROM_8890/04_notes.doctree | Bin 0 -> 27206 bytes .../confluence/.doctrees/environment.pickle | Bin 0 -> 37217 bytes .../_build/confluence/.doctrees/index.doctree | Bin 0 -> 3941 bytes .../confluence/BootROM_8890/01_start.conf | 18 ++ .../BootROM_8890/02_frederics_exploit.conf | 94 ++++++ .../BootROM_8890/03_exploit_boot_chain.conf | 281 ++++++++++++++++++ .../confluence/BootROM_8890/04_notes.conf | 143 +++++++++ .../_build/confluence/_static/drawio.css | 8 + documentation/_build/confluence/index.conf | 111 +++++++ documentation/_build/confluence/objects.inv | Bin 0 -> 313 bytes ...1d7a7a3be4730c319f3413d0ce2c72099478f6.svg | 2 + ...eb4f45fad7676c43c34240d2094962cb034211.svg | 2 + documentation/exynos_exploit_chain.odg | Bin 29120 -> 31580 bytes .../BootROM_8890/02_frederics_exploit.rst | 4 +- .../BootROM_8890/03_exploit_boot_chain.rst | 11 +- .../source/BootROM_8890/04_notes.rst | 32 +- documentation/source/conf.py | 22 +- documentation/source/index.rst | 6 +- source/exploit/exploit.py | 24 +- 28 files changed, 725 insertions(+), 45 deletions(-) delete mode 100644 documentation/.~lock.exynos_exploit_chain.odg# create mode 100644 documentation/_build/confluence/.cache_confluence_config create mode 100644 documentation/_build/confluence/.cache_confluence_dochash create mode 100644 documentation/_build/confluence/.cache_confluence_publish create mode 100644 documentation/_build/confluence/.doctrees/BootROM_8890/01_start.doctree create mode 100644 documentation/_build/confluence/.doctrees/BootROM_8890/02_frederics_exploit.doctree create mode 100644 documentation/_build/confluence/.doctrees/BootROM_8890/03_exploit_boot_chain.doctree create mode 100644 documentation/_build/confluence/.doctrees/BootROM_8890/04_notes.doctree create mode 100644 documentation/_build/confluence/.doctrees/environment.pickle create mode 100644 documentation/_build/confluence/.doctrees/index.doctree create mode 100644 documentation/_build/confluence/BootROM_8890/01_start.conf create mode 100644 documentation/_build/confluence/BootROM_8890/02_frederics_exploit.conf create mode 100644 documentation/_build/confluence/BootROM_8890/03_exploit_boot_chain.conf create mode 100644 documentation/_build/confluence/BootROM_8890/04_notes.conf create mode 100644 documentation/_build/confluence/_static/drawio.css create mode 100644 documentation/_build/confluence/index.conf create mode 100644 documentation/_build/confluence/objects.inv create mode 100644 documentation/_build/confluence/svgs/484c133648e1cadce9ac668f651d7a7a3be4730c319f3413d0ce2c72099478f6.svg create mode 100644 documentation/_build/confluence/svgs/f058c2f596741fd06339c24e16eb4f45fad7676c43c34240d2094962cb034211.svg diff --git a/README.md b/README.md index d2c353d..7aa7434 100644 --- a/README.md +++ b/README.md @@ -23,4 +23,7 @@ make -f devices/samsung_s7/Makefile Then proceed to move the debugger to `dump/debugger.bin`. To get to work, run `source/exploit/exploit.py`. The launch.json's are located in source/exploit, so its recommended to open this folder in your VSCode/favourite IDE. ### Viewing/building documentation -To view documentation, ensure you have sphinx installed. If not, run `sudo apt install python3-sphinx`. Then proceed to build the documentation by running `make livehtml` in `documentation`. \ No newline at end of file +To view documentation, ensure you have sphinx installed. If not, run `sudo apt install python3-sphinx`. Then proceed to build the documentation by running `make livehtml` in `documentation`. + +## Pushing documentation to confluence +Run `sphinx-build -b confluence source _build/confluence` from documentation/ to push docs to confluence. They will appear in the DT_Sphinx space. If running issues, be sure to remove the '_build' folder and try again! \ No newline at end of file diff --git a/documentation/.~lock.exynos_exploit_chain.odg# b/documentation/.~lock.exynos_exploit_chain.odg# deleted file mode 100644 index b800641..0000000 --- a/documentation/.~lock.exynos_exploit_chain.odg# +++ /dev/null @@ -1 +0,0 @@ -,jonathan,1kqdsx3-l,23.08.2024 11:35,file:///home/jonathan/.config/libreoffice/4; \ No newline at end of file diff --git a/documentation/Makefile b/documentation/Makefile index fd09622..e93a242 100644 --- a/documentation/Makefile +++ b/documentation/Makefile @@ -13,6 +13,9 @@ BUILDDIR = build help: @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) +confluence: + @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" -E -a $(O) + .PHONY: help Makefile livehtml: diff --git a/documentation/_build/confluence/.cache_confluence_config b/documentation/_build/confluence/.cache_confluence_config new file mode 100644 index 0000000..3f8d44e --- /dev/null +++ b/documentation/_build/confluence/.cache_confluence_config @@ -0,0 +1 @@ +{"hash": "23bc85713aeb2ef093eda071313cc8bc57509988f49973c4234ac4d9a94cc99d"} \ No newline at end of file diff --git a/documentation/_build/confluence/.cache_confluence_dochash b/documentation/_build/confluence/.cache_confluence_dochash new file mode 100644 index 0000000..71b4b78 --- /dev/null +++ b/documentation/_build/confluence/.cache_confluence_dochash @@ -0,0 +1 @@ +{"BootROM_8890/01_start": "646fdd9dfa95f318f95410cdd89da6f141cd2ec81a924baaa8ea4451e8a89bc0", "BootROM_8890/02_frederics_exploit": "836eaf31227b51f67d44ededc2f5bc094ecd6b536c61959ba812edb1fbedf03d", "BootROM_8890/03_exploit_boot_chain": "a45ee44296c16624fafa979a90cc1efea179119c1f765ccd6ed62a2e7448b0b4", "BootROM_8890/04_notes": "b18e488a60b63c232c39d00ba09877caff4bf846400e2c47c08fa17eba1ff0e6", "index": "b0809c6b5260a9da5c501beb8c077ab83786dbe3e371931ab45e23b93f316ec8"} \ No newline at end of file diff --git a/documentation/_build/confluence/.cache_confluence_publish b/documentation/_build/confluence/.cache_confluence_publish new file mode 100644 index 0000000..bd03b57 --- /dev/null +++ b/documentation/_build/confluence/.cache_confluence_publish @@ -0,0 +1 @@ +{"index": "187979570", "BootROM_8890/01_start": "187979572", "BootROM_8890/02_frederics_exploit": "187979553", "BootROM_8890/03_exploit_boot_chain": "187979576", "BootROM_8890/04_notes": "187979578"} \ No newline at end of file diff --git a/documentation/_build/confluence/.doctrees/BootROM_8890/01_start.doctree b/documentation/_build/confluence/.doctrees/BootROM_8890/01_start.doctree new file mode 100644 index 0000000000000000000000000000000000000000..baed073c6586a2b677adb9c6d763c3aa2a8d7b36 GIT binary patch literal 12494 zcmeHNOKe=#8BTEg7{Bs>SWpO@1gI0p%-E0ur38r((x!<6#0d>l==#pRXXf1TeGK;z z+q6`4K^0d=V!@?qrAl;F30108^|9-sMcr3byFy}tDpjKDwwrGH{pZ}*OdQ8fAyG>s zJj|TufBy6R&-1@I{O$*HJJdh9JL(C?Uu~GS?FTlGQaNS^R^o9#PTxt7d^dd~JuGXX zxe^6QXz^6;zz9n?t{rkeeKnQSG(2|PsFBSdjkpy%fnQ7)!(v2?zM38uH8~tRvCAu6 za(pp1!?^jiz~d>6!k}Fj_$uw**Y{ScX&LF6*f~zcURg5=QpJ!Q$tXN0ce#$w({oA7 zl;dU`hfXVraWXo|kYh(g^{C~VQG`Z(ANEa8e;c!tUiqVCTFW7C)0jk##%71QQn6dy zEhfc1Vn`g2FE$0}ZgvCTjD_hpdtuPU>7!<3dQswcjOg)ZPNPXoX=);yCxRe8|NMgS z#1mhhYtGFZ5iy|=MmX2KXNHm%xKP7E%}!|cM1@_KMt1JlaY1nQ-0GSiM2zOMY%%6U z%w&;gx-RQE+~O=~GYgl>KwHeh#E)3u<3}-jF?g1trv+lDJ9a$YV5ehRDCAKu@FS<9E~&!VK*dTm>_Io4J8$=N)Ya$6z>6hpUyTkB6)s1|C`ioC%xI z5h`R;JGZe34iIwFt_Qxm#ysu?;hNgOGJPLJwm9AX3ZG zlNrwkTg!cqZ-3vB%Dy!@(MnvG$A;@b7IFnt)gU$MF`Srtm2UaHrIQyHPqVh;@<`#8 zEBR33@sx<;Ui4(M*>Pf#v>I06HP1pr0Eo{oHUZx-aBO3lhdy_WTyPWLxy-}Jbd`k0 zA?HofDwtEBf1)wpG($_^!+Y#llfQp_9taO=67#+RM1;my~K7fwt@L>ix?FDVxZ zc^9tEsVn5vq3P-+a#Ayw7d>c0cwtZ`Oa)uTGRc)I$BRq1(=$8u>G_sqaSVgcUr%sf zz@P;U3KC!lx_GgW+gFxOL8J1}v6wzkJ&9VjO9tSpN(?sScRQQYtj=jF^m}F$^AH%H z9R&IJHOOBn_I~*@+goovBk#M;;VNSD_V&c)x+{yWJhp+Poi=kHmqZoP>px;w~7T;1RrUT5#p^xAEQH9O2%I2+syaxPU z`Hw&zEMLD8S!xbk@@)y^rZ0nxtOmB z@Q)9GU%qzJNl+9V7KONp50u+HBOls2Gb$JNhw8;$+f&HR%62w^s64ZQsBDkvh1~qE zPi{_r8uvLML=S1LrvT88rn*KGtVD*Uiab?jvHn?CVQ?c`@#m^&;f!08opH#{Z?`Wy z*IrzXXvZs+JL`(&XEL{tOpywA!2ZIqk-t2_S(L#0j{_WHu#%cd%5g7# zkT-<@NI7R~h$Y$L<7`E6#3SLF4jmA6@YS9hIB_#q@3Rz$WCE?Cl*0jb3Rj$LOKPLZ zD-L2F*IDL>8rr7gGP4b1#Uk#ju;j$qN9T_m)VDn&e|>XkhkpE2sV_aje{M}=tIqvo zjelwF#_>;ejExe zd#-8e;1eSOHxaCG;1cVx#RY`Ih-6K+uy9ewr__W&fVWLBN7&#YDzMC$18=cVm`ARI zq+lfoU0c&dl7JaGON12yy@_twv#4`o z>{MnSayhuVqdenN+d3m@nJ*VJ6jA&8(DL`3hLF1)ejjoLxv?r!2asSVWH!I-SUggy z0M&P$VSeWP5aO>nJ6qxTob`8K{9}u?Tb;=cI7dT%`U;XDkDQTIV@F>=j3Z zrIKK@e5CAMPTo=2O2-mVLW+Qhd5If4J>Xg;+Mpua14I=l{al^7M9$X>9BfC=%v2E6 zhn(+R5WIu|3JiLsr!$?G-X9fCm3VsxfBog^}uW&003@#P4)01o|OAS@xApJE`wd^e|Eh2d_(58LxKV7{FZ_2uuGK&=2xwx5%~1A>JA|#P#FuEpPIv2HlF= z(1T^Z>a&QuXLaJKl6l=Y|5EWvvME^#>)I)s4I=LDyI_7L=+4eqdO~^9H_z)<8F}{yQlM; zyJhGyH<63ICxaEA9C8))2Ug(b9NwU(MAbiteD#{Y6;zRYd{WF%@^Pe3K3@HX z%4tDJ$j4V9sERP*3~Gm-p25lcQyxE=;p|QPD05<_FcPt)EUC=S=gF@H1Q<(8+NURz zdGgcPrecu(Rh&t40dg{$d1h5vx$|0-<*dFV(*k{jSN0jcZ5!O~4$b&`$AwWWr*4Sui!RZ$EZ&PFW}C6e=y8GEdKDMyEE4#H zniiHT2^2}hYfOiMR1`u10Cz4^ii%c1u$U#R$~0BQDMP&qrM{3`ZNn*qeWSfq(p1G3 zgAgyGy#H46OF=xa9cUC)3rDYUpO>BiXvkJ&fIN|1Cc-tUlCctqomXfI%J11ZZ%rks zN@`Wwzwgcg5Z#C`fPyMTQK=%nic}!Q@2xe3o@~PgyXc!qEP~K^oq~JyDy7n#A*WIy z6tb|>y0(U8<04flM7qNcd?WHvXapjq`Pl+(4VLH1nSja766n~;WS0}yM`+b@ z6d<##MR7{X_K=dKqbses0i8LzE#8G(% zawC4^D)<{XMTgS4s%&pK4r0?y&+L%n`52CxiX930tUKj2lJHa%XcQ%YlX;6S1(ahE zkLjfd^^M>~R#w(p?cFHNLoAeXU zSS4=@1tW4gLhWMDpoa%cjj-h1x&_Hg)nd>)gprprV#jPkR@-<^PKLY}gs7&%GY8mr zn;aLWTl^fBd-9JYBY>0rBQyqwe93PzwR&qGU%(pQ`gm0pq4jt?Fg zsA@t@p5IAjEs5LpC+d-d@Avd~8axbx(11O(T^@qtM5+asa<}GmWtCyIN-7Tw^b9P~ zeGLL6r}ere4f*VQ`a1?D%RO`kU@a105j_i~NJVA27I56g@7qw|DsQKpM`#;1?*S>; z2Jcbe!w3?wZ5$IELG2h4H*IG%6(e#Q8agn_CV86!cum=f*E0$Tg0ZS0cL8a^-Ks@_ zo36iX>P0-U0|R*?jM@YJ9z@)z&QvI|V&k$CIU1t74cm#xe&HY)m7}?6K+Gm_milp$F|K0_?ez!e zj)9-kVcQy5o?6P~znCvi9v49t)qM?z$8EI-6hM;#8EjU=;}E0>;aqxVOdbFxJ);oM z;sA!u(5)lNUqk+V)hKds2#M%PD3z0_yM>^=mO!o}FzR;oTmLkW+B8v^NUS|zp>P%% zU><6D1D6#GF?%`bA>&8&)T&52(*x^3PhdHI8yLtH!#+|KQPLV1r<@CHrfPACGSW)G zjMw5eM0gD(2#&J5b-CZdsAYqDcq=!ucQZxy-mG{VV0GJCt*y%;?q8;IYB{FW3FH@0 zbnvzg;fM`g%%@Jb7eoPCF$%%~8=H!!-+;pFYt;qTXvS*o;>QSy5Nfm0K1z-H`{C{> z2zmEeGL*1IvhE?mXi}q{6bUMBOypD*Uh2G47M>^-!@vXGLRusrrx{yqA?T}Cz|m_3Zh=_U zc*j6vF}l{bVlCfQP1@JDzOwgZf%XrsmG!_5L&sSGYQ{;KPr#3K0R>z-?A++HS^GQS z^jqn9$SX?OA^CWFjpzZNiU`|ie?3}3CFkG#D<0mIy7tCCT*N4E^;wY&iil1 C$FlJN literal 0 HcmV?d00001 diff --git a/documentation/_build/confluence/.doctrees/BootROM_8890/02_frederics_exploit.doctree b/documentation/_build/confluence/.doctrees/BootROM_8890/02_frederics_exploit.doctree new file mode 100644 index 0000000000000000000000000000000000000000..14fe42aa64dd0e88c90887e16682b830acb9e1b0 GIT binary patch literal 31004 zcmeHQTX5XgdA2Q65~-W7j8j`NEXN{gb1x)yrEj4m(pF?s4oN$TQwPEV*aeo@#Tvkp z+%!s^PSQv-Xp*V7tuyINl6LAO?L()1sM9?3p-<^#rg>@H_BE3>edu)BnYNy3r_+A_ zxc~>?l3LP{CDqo%8v-~um;e0#cmCTscx~Xf?(E#c{>2Bvmg6?piiTx1eajBJ@ovjE z+YP%Jbzkp}eW81)I~orL#%k!d1Jmxtx1faSxSkc*&F(ARcs~`7TrVt&_jiT18M%Hl zdEFUsb~?LW>5e*s@j&E8o~=BJ@0ts2%MM&~B-CctTAuGlT`G;jw=dai)Qk8YS>~s& zeLXGpr7rK?&X$3`;H^93K|Sfbvm@Rq`aB=s?zv67JKwGt@sJTkfm>-u7%Po!hiip2 zj$Ni_gduL??}4V#;D7D5+O71WVwlT;U8OSZcvoc9=uy`>;N0)*bslhbI0xfbN{-*K zOLf0#M2^ucwF18mdW5CWXoT%%O%IQkWFHM8Q;B!7bjtUmh4atrCr+F!m&%iRRgfjr zZBCV95MqoUIk%%-0c{2`XrmSwEk_~dg&*B|%Po>tTB}|0+|aQt&Cn{IUu*ecr1?!P zuvhFLbelCTa%}D5i;JhUFv7?*zsl~+u63GzsEH0~PdHK33a3jY*`rF)ZC3r#WO))D zJyzn?*#)~<1Ci~Z&<-mFR$;-f7Hn2op@Pu`exv9_4e#Ntyz$gUT{D{bAqbKrV-Q^? z+V$OU(KGbc@(S%{=+>IHRWKn01v@{xhGshq z8Og zMdiH7>2N+y1UVNECA@8Q&)q8MGaMhfI)W%nlNFc~dpe~YNpZDDz;Yj z+gQ`F+A$48r9QM1=qYaG2c2}*YHsATD@D_9BuYq0eW?@$wq0r%VPpri&@%ecx_NNZ zh81!6vMLTvD)gVYsJ8Qq=$w?#4{cDf(y6biox1w+wPB5r(<4$&w?fK9oW6|NOvUN= zHYX;>^_lJ#(rH&XKT|{@ey=6qn=1EHhlk@^iwZF_Gu$6D?^Kw1k7Q`kP}K9GMw!@#0L@22~lm@Xt{FiQ5Sv7W{_ha?P^p!ffEO z2YV#a0%*Eq1d!m(az%g9KV8($M)XEthbum+L_NlNHe|1J%wmaG!q@fMx4+j*3^nXZ2)YD!BBFa&|l0He_2i<%@><226ea~@D%Gr zaVV=cNHa090e3Kad{h+Y?z2sL*^P&=s#q?XVh+Ig)`@>RD}*(6~+^1n`5j%XTfsYVM{1$8dVzsGenM- z1wwGk0jlGT+re~V4{v2+6ASHLIVqB3;k?f{>*J@E*n%pNHn1Cp3#IYV22>fZ^C*)} zc(b{N*tAzM3#ld<3KAy9U;PAilezzgcch@~ zT%V!R_p|mvnc-Nw>NwMx$agvwnLJz(Zb(r6Fq%7tRuPrh%(ku{ zVLeMFiFtC6KZE{a^ZiHj1%hmRI#jR??vtT zw&}S*fvFC8vcrHjh
ghOs2=X?0;kYBg^3fziINeR4t^TPj+Dsy zFQFxP!2}PH8!RB{d2dIq;PB<#G%D`3&s|RfNh~|SaV41~rR!hIb$w$Flrf}rmBIN| z>*0L67LzXhb#2)WFq1gNCHyzF;*UF;!!@ZQ~wr?1dG=> z?$(wg8;)-Sd#6Z|XR&m3+-w1UFpCs}@jf_{;8gN-gv-rkMcugY&D+oq%bbSMS^1a% zg0l82iERVdG<;3WZ}y~iNC@t@I(CLBhaOMgpe91?N$rWlCjF@$FPEPhSFWZqS0^%8 zC!fkyRA5O8sO^wpddr8#(FgJWEvLikr+Y28W$P_^kiH(+HR?opt(-y}`;#zDY35-8 zng!GLJl5|?^(ld2`e;IV6d28#9i|OZB(T*eyy}Mqw;55}lShwc+k*8UwW*Cm2$GZc z&O(P1%Ao=)uykwHoSN3?SD6QCgXZQ#=m_IfS{b`6-7gJfdGy;3f_5unbSP_+6H}T> zD_IV-=QAw2jBAjV&7^uqrIzw)I;SW+S-{IQhxmJn{hdP2dpZ& zNP`-CBeE(-ZouykfbZcZ_D?*x*6^l7nEyyU+uefJW(O5dK840CbJ~c7{IuO zyfH0Af|pipH(8cjIL@sB78CJ8A0A5d5x6Ei`cTvq`yq7vwr7!Za>eCQ7Ez4!HZmsQ zyj%so7PXlbBmfcgr7b~6*WQn51b5C9+ua{hDX<>@pTQ<)urFuu*zU zs+t8{6)ePC3RA_2a$(txmW`;eY8yd`+d*LofK#FtN+zN;MJE$q{mxB7FGW@OF>wOR z)e|XEX|VV6*O#nPAH8$kDbal+o%9;_A)jy2gCeQ# zr02tRdg;$;G>Tp-Mwg8_*YmvApIVBTwiqHH5j8A%4`X{B0&B{yq+#$Z%uL*YC{`Zfz8A8aAMKyoiirMi zPDB-Z_q#XCq)03p`sr(L5E~)!S{dOkSVJm?ULAyXa%SuTd45+~!#5&7CU8ZQn1QQr z-r$0iv%7a-(iB@;(tmyKWc@>A+A2^cMm`+>_6;PNoDIuhL)GlhOIm;UdNPBr^*_f< z%UqrdU#DpYSOxa0uBF(O5@DYK!Y(e&EWNl0>$E(c*rf9L>E~u=7WBDUlvtQWk%{$1 z2&B^jQ@sla6h{q5*B78poS9uby>Rx0rSl6Yb8LMXY9&+V`1&$b&*}5?b7!AOX`a*8hrreuSU+Rx@wLJ)V(bCE4_Eo`GHx zz&-EytD$z0VmkVn({s;ghvDF=(m%6Y);`C=S@OYgT#wR@nub2X${nwcX-_<%O+9`Q z@fd6iYEl{;lGCIG8fq06-k)+|k_CBSI!#S*%_OvOpFNx^oTSVK(l}NOugziwq78|x zP*Ru@4e9XLS!blb2>32zC zWen$XW7t@)Ae;UymA=1D1IJ1|9RK# zQPYaQVRN2V(r;c6{my6LOr~m`%)p^xQo;?rqK45k*5gkw=<`6BK&#o5I*T1>+z!I7 zPcv{^NXCW9M5(>x#$rA!mc2`$BuWZ2qnuW46c_wWc(c+nW6Z>&7%OT@om?eEP)A6y zqKslB=E9^&~#8DVj4Y1P*#udn4(@IZhig6c|h(^_S= zX|Vz`BG6l2J2AoPhAo3V5$qD!%i^}>@&q~SD#-i_U?8&KF7R7B4mTZ{lp_-(60RGz zfkc=j`d?{#%UXo^MhJk#em-OeQ!Wj~jnB?gD@ZHC-xNqeBjuj0j2s`4?Uc9C&iNOY zWU9c0f4JTg3?*HeyWA8*b-#fp8C{=153k`wqlM!{1I|=r&uptbHsL9{T-ge`Bq
    &#Y8YRWyq|!hPEUbeZhXU4Uds_ibpUiJS(x6Fp6GoOrn zpXy3eby1kBJmghpd1Y|5x2q&TLYQd|XrHWnpW0_`odk^-{-D;?z>OlffFhr#0n2)j zLvOOZ)zq}*H0eJ`h0m`skyE+&oo&g*QdTZD z$&S14RJ*24XrpHlUaNt3k;WBNv2|li>IoYcNIUu6Ep?J|u&Vl;xA&$*O`}Zey>-E*zoro?9$7Ks;rNB3_6ru1 z6pZrx-=D2|K>?)<7)=0-mS8yuYf{=+ENvIQ8J7Y`ERZFmLL|g|dmU^Cw(Uo3A>@iV z-$}?qU1Coi)h?bfV+D9&!bbybVTA888KJIL719NJ{J;5MKI z$_Vny;kZFMC$cT0sYxB#o3tmf^YpmZhN&?%In5G2$F-+5WF0|A;`b+xO=A-g-+w?o zBDDtSC2~ti{~&dWtP`XKW5)~y|B<^u3BY7r@Lz#*i6(#aIuZ}dI42*L?VFE)DL?;X z-{420CUf#%&hqmnzL&Rp_+H5R;rb6_9X;~(@>TsVl&eFW!(P#8Nv57m%FFrzWT z(^I2(Te-y~FZl4xaplX%?@=X{&?7{fh4@fu%!!Kx?QQs^tb_4RaWX4nvPVbLt5BFl) z^*zh7>sZRJA5J&?NolguXbBfq$vwX(>V_x--aWzoQU92j^ z&!}6JCl6(Zg{n;C$k37@H#=fAq3ub~jr>(m5UUD2wjLcB6_5hdOlC$KojOvUn3^~- z1!o6oMWnG{De}2fbP|gaj#q$vCY}sUjFE;#ZOLOMkcC4oP~HKy`Y8Lc8>F7)+61Fq zloQIzD~xh+EbS4YgJqi#QEzN~Xp%czaE}_tfrCC=!t^6rPdg7^5{d-L7^}3nx?m?z zBE+$Uo`xJr=F=5*iA_B!0TqtaMp-A7J7c34`(fpa%66RZ->fsG*p`bq0IGi++?vEx zere-5m6CejMzgLo^66Y78ym3DBxF30dIs4Tj^DgF*hd-f=0rW*AEQYEf3zRAR2px* zD`IE&mH@)+~E^SNjkYa)w+RV{W}CN?$B3lbGkH_B^sXXeh#9-o_2t2jiz{=Egm@PgdOsUYl@2~ zwKr&wa<3+kjz%FDtXVvhBoS@S{+!5+`CB-|mPI;M24+wAYDY^y7Yu-4bt$gUSkrcRu#Gd?WVTlVIeCeq`w9jN5sy|XCt@xuhsG^2sDR=8u7`9ulAO#=w18S>0G z8AVfa{CNoiGk(Y|nJ;EwgicYLhf%|}w*eW+mr5t9iG!3y^p{k6pe*yruHhKAXVc|L zIG_3PYa*wEytL#>M)UMn3%h}-0VKl+%Y{y%!B#T_rrg{K0CRJ5v*mK447_j0pK|68 zx5AkTAaxY3+T0EGl^%eE)mRs1F0cqY^p+Ve^^ZujoJ%{IDp(dif1`?Bl*&F8#k6K@ z(&s5v53<;Y~!62Twi&Ly$(t{qzJ-9N@@t0u-V%{|T!o zv;%Vk2Pj2|Cea{JMcxvWeoc`T z)eRZ{384u-uYuz%z~*$+Gd2&}v`5-U)~T?nDRYxE1~dSX^u-QpW80f46`qRAPa;5P z;OSjWDkIKu!^(`$h$ybR^o++*I?T;5v00g)O$(N1N2rcbrA!(%AE_n+!6o0_j6F|h zanJ4BQT~4|Gm9B7{)JzL7)Bi&ePmbRCZ(W`Afp~CyQ11i=Vh^S9=v>9E0y?mOqkO6 zJO~fB6YwP0r;FNi97kYaCp&x6dPrmLQO#+j_AAv)mN%~E1Uv~0G;GEr6%GW9JKrV%mr;}VP<}DZgxRK_TFr^pA*N>0uTAGs~`2{>OZE`KRI+sQ1NkT ze1AaaYfNV@B;fQ9Lq@J)Waf(*VM_g-@i1Itg$X+9h7tt}(!@#ClK4Jyo*|b|6j5>s zliix6$>IFIOmaW+{VD%%lO)9fN>ZGZI-0mjQRC>AP=nGBCzCf=`r%igOj4>!;`V>& zc{+E4oUevfF3lG#qeG!UX_VnK3*MRJ%#Hdi)wm0vVHuA5cscF+Gf7Xjax~m;VhpG8 zW`8Fx=7vk3&q+ESpT$at#TyzR-&g{fE6}EM zr1)XF$%(_iz#3CJy}T_tb(Oi^+zR_b4=ap0x$q2)qpsiNQONUB5^h; zOjLu;Ksj7y8)p*GMhZczBpxjMr~ETj%mV7u@Oq?|;gvKk`<#b{Q6_Jc9Z%6uI++OJXbTg)qQXq( z)dBENLD~Nl(+wcp)o>C(r6BU%kUf0oOCIdcj?YOu6yHmtnLgG^Y-_{1HZq@Lz+t6I z1NTq^P=w57zp^MYE}6Dn2=N^y{>{8Jw={W* zFY2XFMV6^pN${;YwkM5MjxWk>99d1iqUVgq_b|hh3nv}tQKM5d*;n)i*pbcMbGO7p zvW$&yFx}Fo_HK>$o9%$U(WfV0hjBiXi>Z%J~cQW@1^ga1d;9`Z02>(-4+iyhL>Cp#CO_j*e{3C z;5Na=Y;Z*@rq#wDSX<9Ybpepg48ajJojwPHCl<0ai;lKA3xwtD^okL_glo>rMM0 z-+mzbAop^72aO>Fp&XFNW9NVElV^Q_;ua44x(#2TjPJ%$3tJDH30vS4G=r~!fDSt$ z!8o;^D1rl3v2DBRu63QA@qVL?tjzRQe47jQ+Gn*JElS4ORy*%XJmtO$ae!NXyEIb z&)+c;?{C?ybYnOTW-r~LGh%W2z1NNJlc%)cc35n6;A?6Y{h(Ir#`jW5)&Z2%v0DSv z6Ja`b<9^|h@)6K;e^51Z)zh7{`opq%a{ds@;&8H}Ye!Yq1^|E`9|Vq#j0&X4ik$Ab z-SI*2WJ6EHGuhd$^AqB(#CL=pY%5#SlSAO}aX@*mi_Q?!}p%#ER8H|X*W`uRh; z{0{y68~ywX{XB&Hq54PYr$j}@>F4k0@+b83I$eGZKkaysS|{HGTX|UfSDcqFJDtnU z_b#)Budqh1um-QN#xAplF0)21vj(oP$}h8uue6%a3h?>ud==AHj`()oX)zgXw*qu#R4lQWrj{>Steb)IQ9^#@Vdd8htGx=S0=>-WM5 z$1-^9PtaeKWLp1A`k??_{T=!t*LM91Rl)SBc%Lc*Y*O}_E+mP-029UU5Y)+XeD>8l zyd1y;GSjH|ULsbk=smfcN$J5%jf1jP_R?LM`mt&S5iOJV=Iatqpez80ajGGKWjEe~ z@49%98;k*q@vhV2{_9}5`p+=*bGyPXbr%3GI79<51;1iQ!8pRhyAoW^+}@MiW)iW7 ce?0mos?w#S~kfI$YpCB% z>y5nQcKqG>My_3R>R#s)ov~l(yxbY}2U_-$+i16PPRD-$PvlDFYQE*vJ1=(p{q(q3 zuDS{N{w~+adF4i3zh2r=+F9E5VrR58;P3FtUez&f`4698ZdMy*&&oC$o|P-v<$8yn z#>3keoMnQd=QAJb2-tQuZ9w96N(cRcj0U~5&EF{@p7Xa?%XOzS*UsAhpzV3Ba<=VZ zq%^W^<-ALy*p;i=u8WKKzN2o}#JAn~b~E^qwR3k`PJy0j`@1~5NVhtrhf0S^drOa% zwv`_D-#b}q)SSsmqi%a8yFS@$H7dY{JL%drw_Pu0+!K=uMw^f{DS(_jgTddpb~Q6I zb22%ZoXR)?DH%dahLMtJxftXVm$$XEK+OO~Z5La1vt;7(*@aTswQ$R`FqJtB)Nw7Z zKb*haf z@sMTL^VSmG!X(yg7cV8U~b*ok;VkkLvtL51Fa=nO0 zT8(zG6y;IL{gPOQHm|*4tbYGvRrEs0=P@%+Y{Qyha`w_QH!}d;%)sDdYwh0t)&{{}e=&^JRluhD>f*{MQdY@W7?I1^og{QufLaAGYj&+*)$*U(2y- zcD)TbyTVHuv5pYBb`dLFq1C7{3+0_`yI6Eu<1BV7?OKzb%$HkOgXvWeqUAM0k6NQk zWv>M3V6|Prk&bn9{)~n3dyQP9I+n0l%rDulm2cD?djF2#ZU=&1^ao(dcX3N_Gc^`o zbjK}d9JmH~kacpzBoL1)0IX0b=h{`Q5(N;ob>_-c3ZRQ6`|8!3cpzUN!QE=Lu>|<2 zZ;~97OD(Ld^sClzJ&TFR9k-x{c{GGZp}@$rb2-Q5m#ASY-)_-eRC1dT_t>kJaST@XShB_TxF-T;`tQdR9 zfPoTB@>nezp=-ft{-XcU(7N%b#=7xXh~~a_(Gh|+*JzQ1hvBmVB_WRmq0!P37*>^p zORN*p60-{BR&5EUBfeA}NKd@N>xi_A$Si`$&E~5UXq&XS6{}pM;Z3SHUF(^W=QZ8g z$;l#Ux}8nr8nsEgZr3X|R`XOkm6~+e$fCw3#Mg;%o6p|P2w_TQ*UeXDK!!Q>6BG4h zMZ%l~m)4HD5-Qtv9;3EV@apMaJJ{GFcNDmsCy1?WGw8Du3es_bR|s6mHe0-O*;J)w!(5Dms# zYq0{}lEOpdtMUj2N&|ii{`!NO)bgFn56bZm`41+7i7bW4GZ0%!!&N(xZfI8Hk~?`pCtVL53$_Jt+!u*xK{E){0Qc1i7>&QIN^j^T@siyGz{c< zjJ(+AD=ljMP^H0-R$Tmv;5mSD|2({m^&-sww$}_i57Em3sQt6}Bl6X{b4pVHlk?$tI z(MlZ;h9`S8o&X+lNzNp)<$5ATp9+Uv*8>FpJ^{0C5;%gP{^vf1Dv9?$@uTsu4~kV7 z=4eWRZC(l>{?3LVeg`1_*5*RI%>b3Z2QdEahF}~4j6Ys4jD3;i*SOXDBB=B#1SPHq zLx1888zHDs4E+$^T*EP}q~Tlm(RhN|#r}sQ+Az?+16Yr32-Y#cn%-Pkw-c<2?8T1& z$}1a!@+hFZv|cD*D`J{jg_y+kVCdBi4gDz$z1;uM3;bw2G2OgbciSx|VV!N%Jp>Ek zV32EV6)V@QwQ%iv=G>)sWlo>HayfJL!r9F6WRl&1r>|eTa^;%1C%)deIhVP5ZSK;- zwHs>2U!~RqJbrLPcpL{FU)fwdg0|CoX%{~NC_lR)C?^2rr`8MQYeneOs}Q=l9t{28 zZfNKU4E=ZeANs%HN8<_o1x?_HVZqyrSU5c3@WhHh0)ofF&8-b9cJ(&N&xWaGKd*QI zp_f*poHyT8Gm5#aP28^Y-%aQa_17pDg=JFU7?W#mjk(obm)=y4~2|GOK4KMDB1 zyI&<@fHU`d`A?+C*+c!#ni(t%&Vu)`~9enUCwgw|Cr%#>mR#@kF9bH0JO7} zN6q2RY;@MdFttk!Jdp}`!rxJ3O4P(0xWS$$Afy|tG6GP@{Ut$z)3?}z77#evd};{T zg3w}GngPScx!RCmQ%NyGMN285DFW%}MY1CCnGx-+ zI~3});rEvjS&p+(Kw3tr;U#IiP9ELk0U6O+vR71wm3W+<;CKYvKnOBmZAQS=i1(sF z#9lFQ9j-Nj=Xfx!=hO*>At?4s+)sg8e~G3|MT7WPUD5CXjQ5h@6X+TRNn0 z(hy#z)ba)86NTQsjf~PeZmZn%65g_h^hpXL27$Z*<`H@_h;CH82sEV`y#ycZYEZ4I z`$8QVt-Ta!Eq-hyyQzPSXUN|vp$!lf1+BjY;ps4<27Ca^37?s4wUN7Hc<~pnVA;EJ zY3}m;*&COxFA&ZK2bJ!FJh29HSsm+?6iFnNo;Gh&+K#>nd1c(>c!9o2!tCk6!J562 zbux%^Wn9N=H#3wo!_UzDdQ`aTkgo*qQlF5}emoI-;xa(6S?HZ3y2WA+I=CL(Vcw@OJvs)h849Do=s zcD+X;IR%den$P5I&!z_)t^Fs@B|3^AAwt9^Z9nb3`gAjp1;3@ z#KkHlFJ`d#QCfNFUzUEu-(5w%ZyR)tjK8eymRK+C5Z8(f<5OYo(aMqk*lAYkNy@k@ zwJfZ&L^a7s5{E zlW1Q{%YQ%r?yG06U6}`31_!U6zk2P)yR8olTKGq~9;2K-1!~Tf z^K%y$o);Iv=YuZ~4$hxHyKw2+-29+uArX4xX>K(^t`{p|&B|V=r=z2M_2?KsA+Hd_ zhOe|5#z4XaMw(`np6o`dpM$gLm!q@xd8D+AHi0m0c_CCfckz*5>lRKt<;!yVAz3kBR$4e9rPiXS`B0Y)?vZ4#jX@i z_k*IO`ngnKiv?L!&{B9RhBA|3`{`8PGWvxl2o4+a+2S@-A%SSQ z@kXgVh6OrG_M>M(p$JSoyyu|<@12vtsoat}A@@bxH zjQ;gK+ku?;vF7@<+-oGORK}EJ$P37c80YGNOEMc@k*r#`x^DzP?cKg!;WeP&VBv*4 z%D_|Pe~36t$t?v3c?ZZ10v;jWzI{8noK7A;i530!ZFpnKUP;Ry((hqCkW)$98E|mW zD@nYQ<#+hDx|A1}upt9kSsvs_btN$D4)+0$p-8<|4^7OFp^)thL9H-5phse~G8}0o zemx*lkNRbG>>d4~!{{sqWayA4))dTx!9}B;>5T)ugXhC&s~?!ev_)W|i$*&aHV)H% zY`icDA|UuEaDiqK=S(eQmK5QK2tF^CYFarI+3S#i*tw~=fR;MFBLj{_P&zh+v>e*0 zh!p}nGAg#T6ielN%Z3-zE#sNGH#V!#^xAY5;Of2WngAuS?u2j^vIQ3Rz%ht5-m_k^ z&YeGV^P=^VR>(;yUra)42Yur9Vv4^Os>g_)DnbYYq=@YiGf zm0LQlzJ~ic!Ix80$8#V%Zf}OKNZCZ~om6iE906K7c>+%h00o5NyMRr67hvIgxWANu zu0Rc^1bFC*Xr8YKC{OZt0h+ijfJ*Uo0S|eB>1SGj#IiKnUD^OIZGe~7;GqQpl4#Aq zSX!eD&qzFVwJ!h@?<&C3$pXW6<;LXVlmaiEI+-Q>&R@qx0Tm`O=@gQZu(!w}xx7Ud zV0=XuLIgpMR3U-l>{NE$DA$f@l=g7*P*Bfs=+r`D%FtmxEQwcW@FcXU9swkE5%Sn+ z$&d)-HQhoT2COvVyWDLD+0Hx2X+I!eK^#VzPVj6(|3NHeOc@IP z>js`+Vff_@Eev-<7!MX+|A1UNC)8SLn)GT}HSUG?Jw?rF(nw>}Pq{nWaKOBQ}dzrjlKN=Rq;L!mR+Rt{Tsv7xEjc1uD#P%v4pulmf;2I$twd`He^`YwPRO zFYD{WQeTh3uF+8+;EG8IgG<+pR(@~e;C5;1eLy6LAPf;*Ga&lL#vvN%m%0LGjKUnq zkvIkZ{RUGa#l&<_FFH_4U8h<|VM?ON%ndB@ORn!Li9?Zfw{JMsQ(lJ5q!>#P_Sb`#S zfSXiyg%4zB@HTh!T12knC|jA#YU5he3W$vNC}ziRjb?{0T$z7-b5RpUbTNtVDknJbW<_^Q7XdyHWNUG%LnrS5JKoS?off>XTuY7v}Pq`wCly_O=sM;79I98j3+P=2*PqtB-U+5gw;T4|I+ z!Vf_kmi<417k*WTM7KMF&G60iLoB|gUWmn>J_uIy*uSu;K8VFv)dR7Z?%V&s!a3Ie zutfz}!f4t0#iRl)C3o#upOh4tBE4ngM?+F4&{9#tkqyvZ#;&}j^^mUcb=1}+!!pL! z-G8B6hbpR88KuQXF9!m47zkKjEc^8KS4lZn;>dQkfv6CxhMa6lR%wuX8cxU!iYg(^m8&(i>rncTRFBZB zG|%W^mAq%LQ(*OAQcXH#n#7QUeN&DtY+g^_xOX75jF? z3p_9YkHj+0nsu$aWiDr<-pYG!Srsv%GE2g?bv@V!v#j1$b zsf$KCGm&=Ic3Du*?6N4mW+W6ymFTboVHjt!e+B|nNtaLt(Eb8RwO;a5+|i7>ruZaj z6(c_PTxTViE3~Q!30(_@_`!;nr{X81L zS=PO-Ckf&62E0-4$x(Pu$VGw7T^#~dl2Uj}L{=|c4b7FngdSVdld_fvMf+yDTrSlH zRTWGy6r&^a9B8$93kN`9aoz*gkyRlwT{RrFymrBU4+65VKVKyjsO zv=_P^(aIf(l1ligmp>gfXM_(wQ9vY5v&cLUDw(`YuKms8w}=e zn`_wO<4_$hAaLch$~h|sWt+lNwyOFEHMC0Z*O8!x97#g1ppJT9BT!Y@7~supq`|_M zYtc3kUFy{urNXcCsEXcnS6u6y5h8S^E?g{7*9 zt-0mm@F2I8Yh#N$qD)99fZ_waW8w6Ti{}?I*DhR`Kff^l0xJ@tqT!1#Bwyrrma!#D z?u?>H3nD4;uccmu<|7`&Xo*93a~5r^68o#TRdtQx*r%+Vx6*XnL@t967=^z$j#PfX zlR>bJvieawd^<0UHynzyna@ysE!qso^HTjTa<$=05%pdZ);ysEU@f&8bw#U)`;~EI1}q)0g@O>` z8(tMs=7r#H7kL1v;;qmN%r>XeqloQ2#b2Umb5 zNDd-ecFpHER3@jc7A+%S+b8cYOejnH9$Hzsg}&?Nw^;vf?@n@WhkV6y5Rv6B(Z z!U88Db}l9|V54)qk>hzdzN$_}ZfP91&d;5@e(loSLgvg(luNpHbAd{gYh;Xfb&o3J zg4ePus5>)iupt&lsQ1KqQqC}pU^-0L`Bn=~If;2fgq#l%rIODZZ6z?j*dKz~j}G6M zef2yf08Nr;E6UW}EdZx87Ut;&%IISUxL{=|-cTL@0P`TAEMQ0dLaXhFpg9e!T<8`W z0S{Tvp6Ve&$k7-9>Y47xfZF(fq0mvx;OShB5 z=x`^cFLV#*SyM!YVTyDCnHydUCd^l@!>>YAOq1{JnJT4E8K zm3f~N_7ln^joxH1IvT(;IcWey(l?MZ1|>y_WF1p=*gC`Y9&TK_F84=?8EiDg2}U%7 zQsR@C)2q{jb$pD)>hbB=8BV@PPZ>?fl~&=Xhb|x`(yJ*hTWWYhSn8jUhZ`4_#O_4% z8kK^+T5yWB>e2>V+)^>ORLo7$ahXk{dKRsOA$>Wj2?^%jQZctwOlXu_DrTTHk8P=# zq>a$OEftduRjq_=shBWUwp7e@ic76izIH06j*onKjrfSKHcR!`AVr(0!r7mZEmOY} za-bS%pWj!zVByq}9#k%(K=~$Ahk|o>IE>BaHG+^eryQoM!^(kM{deRXel= zy&5$iV49*hgz(*~C`tm6j=O-g0bn`LmcIi;@gKPlFCz@BeW_uJ=D*jdE_k zv%B`{EbL~?KN(eG25_#Pg%d&5ls#wNqWkRd)@KQ-sf|9XB4Dq6M*)uh+lFxTmmwS( zp~FWw!ZeYZP}}5Ga4)FP`zSxc5kR$HE_f&=ut*WRn84z`c@8X+6WutnA#ybs_g}7S z+!R3kGyMh!5Px6>5dB#y%Qvq1Q*NNQJ){!SRyaC!vPwC65G<(0LJ-ndA_Sdbem_kF zcBY$DP6R!nZRh_&}AzjpkkX+xW<=33>qnQk-io&re&m z(~dugTtYA$BD+*a&42J{r}Fqt1nB*}4S3NhODn_et_eSHFgSo$fwO(|M-*NAA>(aV z&Td9dDE9}0p(zeGF9maVgj(zOn3l?6qi+dHD2k6N!c#%~URBoicQEQZ{!W2=9?c$V z>WRxgG^l_^#Ut7S-+vYL2&>ppY|ME;4g+*2gGAYyaohj+HSN?Se*VgYo}0M15yUj%?h9oDjg8&DEpV@k;Z@Gl zpiwQ2PbKdkS|hdbVr0I+HxKb4^w`LSI7#&IyS?T>H6;XtH(I_PX*o7&vNA_cqaHi{ zV9JJkYb`7qJ#~#CC>{FreIt9wKe55-G9b*Z2N!f!yF^5=Dn%uTS+nRzc>XLSE*{6H z1&*K9z|bOq($keQxT5O^{_Z@4JJnSMv5PJEM9)gqV&A`fOIC7X$t?=A$jR=masq)ksxrkec#vc6` zD9c1pX3*ZD7;qHPJ;FrS4Y1KeA<{!E@|dv+CYDE!$B#N#$D^a@Z$keT6Z!)86$?|J z6Z!+G+?C1|D#=DmFF9QDjiowO_zV_TEZ_IzTuJ70aIPSSHDq>@bA|PTKw$KC&ZK5$ zkh0k=D{_e}4#_|Tq~5iL#f-N4+RyQjUs5FVYLk_L&tKah zKKo<;{|EN}`;7nCdFqq>KX@9-Id3$suCUH7RC8&ei{reaKB+kMoQ&OIo?{LDWIC4w z`wvQ=y~AZx?^9W5k+Y-_@$-U;#=V;iTHZN zCVf>vo!ld$=nLgmLx741uy7K}$QKt$HRW!?nq!9{No{eR&tqL`v~jc{Qya$#xHalP z+`yA{WQE{V58eU<8suYA_<0dphn9ykFX1#pG6`szbio7?=sm7EgH5XB-4v=KMWm&& z*gHBG0!%#8Jq$?(TUg@hTNO(IsUO(A4pLXgYh2w;bgoDgnwut1|9{?aigt_B`pK}W+h!^=d0BkKLViOF)yOUQWQz)S+c1E$yfIZ4M zYr}Ji&|p`J-C1O2Qk@^vMXDF&;fGkrf8K`~5Xci7B9Or_fmD*)g4NQ$T!h5HjMeaG zCYL={NINMQhU!EnOaP@VQNbmW5Ih<3X^0cyAtt@BQCEkS1oT%)5V$bDFh`r(O@NT( zh7hu!5HgNe+u2xcs4@vm8O$Y?NvzKP(};%@N>R^vH38jMQgxC{@>9xlOvpR^=H ztns13DTpFKD>m?oQ+*)+wh3J6ZY#{yX@B!8yvi%=?%Xh z5X>L0hYd{I^{qrRG`f(k0o(Ohpkt`i%~fqzZbT7Ym+g8Gt0mI}FEY@#MW(J;sNQwv z^o`8KW%`Q6 zOWQ=1Jp;l7CvAVE&khY`av!~JIA0CL{x!^heNzOAwao&8+gv*1^fQYlZh&8iZCFL! zc4}yP=6c`!B`VU#9$J!H+M!C3cNHZtCv}xLntG2S6FsuXk_3c|Yai*WM`KpgdIVkO z8cZJ*Rb3BYL;m=BUNc}h8G$8s3fSZ$==+`9CuwdI{6cKQea>xuo)UjatI#ueA33P$ z9+h!>O!ZB|keup01^@;UZ$*%3u<0h`;>N-`qkC^;bg?tZBtrP;mqdn% zMCSR0*oONgk@uceXU*H1-67@S93nTVtQdN?Y_sHtOwfdcle<>oI6hP|eR6uH2XVZg za3hH$weGGBB)=3vvOz+Ir0*NTAz$xwSo0kNiVsGhh@BChYJ$7psXk0oz05DfHr(e_ zKNrZ|kVuG|NgTArjzdb0h^*EAv-j5?H%IIIfoMAhf`2W7U}Kv5%1Q{pS7ve_SqbVT z1CC#hz!5tiJkbPszZ3m-n&{8p$3(C0*{OU75#`EvDXfe*dXSQEmDLDkZHN5QSD=_L zkh#i6g*;*vep=ptg|Yx$kyBx^3hkflTrw1>20>uh$ekX1;D@xy#Zes;JNC#LXX8Sg z=K%|a&86`6kcEXaHAokyPTyS)hUqH`CXh=M{kXDgjyLl*e-GAN?Hc7mDLFwDP&Sf1D<{G+DN~? z8F&?i4qiW)Wjp4lh}*yn`ue(9RGw6J^&P}|0UHF2_;`*M|M&k~_Kz^`7)h?n8fH*OTJr@+@QRy3SyD<~1^K_K)U<8`d)6>ojg{ou| z!vCSDhbs5M*MK6>~nS)C&|8y}N z5M>k>0ei(+xJQX66?Gy4v8HR{o#fO~r@*Q$%dV-aYF9+T0aK~tOR&Mc=#KVKQ{Rl* zC2&#%VI%$S=e;td!6L z8k(N&hU4s=C+6%qJ?Sb5FN*N^uI zCep${74vnC^-;p1LojC=$QV zR)U41O|TjgG@d|%nlV??MAS4=lM5(o_IRMBtr>abMiiBHMILE;@#%aXX^0J!*Aa<` zO34u+I+;pC=QN#=SvF8#KxU@)1QSJSP)IQ>a*84JCDw#ooHj1vDM)y=RaOnzGV;Vg z?nWMEA)|t@Q-U)DiKfS4Z&eXbWKRvrH!@|2aL_VnoQ)yQ$}vKb2u`t87cyTsSr#Ei z2bvwK@yprywmlD)ply z&tAeYNT}*up!4Mmsa{+3ev@cOx-f^=2Ew4e-;Pk9LB$sW_2T|v9rDj8)nnt08E}6k z0{7ZnLnAc>a-6n*oM!%C@e8pHE4Ac{8k(L8=Fg&+^N;k9y7bQ1)XVuN5jbM!gT*63 z-tR=8po#tiej&EuRVR9NNwTW`$;72rb`wy4AFpF@ZA4u<`bK|l9CDikfcbl|9u}R6 zsc5VF`MO0}(LKFG=HYW|CN#@(kkg!EomNX;>8R4yM`{a zcNh+0a(c>RNyrUbgpU}-Wyw8Sg6<(!e360T!Y?B<6H3*>QElWkI*&{d1^m_fZ4-`2 zqt#&WmL7`Wtyt32%hA(Bs|pKnL3|RK^=il7;>Vy6l7a;c&>j@5CaF^nC-LC)I$SxW zoK0hc+G{LR~5mCRv8=4F0WT^_u8`jYMvR$6j;#-V;r&e-9jU2@GuP$Dd9u$@4*7jN8O-+bdS=^91fQb`Cx}Bz5!^8+0^VEG z9m9<%suAuOgQ2B{b&NDDqcX5BH7w#nc_)UYiGhqZAC{%NMXV3|HOut?USHj1jYg0Z z?nYYQCfrxVo|m`9ZPfF3y3m_)PNy{Pzll%gLP13sr5U9`p|10&zr#aZyxO_^fIq07 zaq{@tCZqX5f4@|_GP12Xf3LcN^h~ES=kG>II|`$_9sgjyk!vI4+)ZE$1?^MKqi*uM z=m0@i*E;rhHrigZ?RDl#56$@lMW^l{1HREhO9NbO+QZ%r{MaKpL>=Y&9sC@WKijP; ze(m!bxeQf2rn_#Z(t@JoKTM~7!Yp@;JC`4X0LH=P^>!_@3{|k!!4*tktBjM-u(^}A z(xSaX;))|q@^v$`#VwPApu^rX>Q26(FYHC)exrpV&j|qOLkTN+~FT|mdhU1 zwe;GqdT58ggHxf=-u@-KMF;8O3CM>Ut_%S8Ifq8n`G~*2TnBA4Pa1j zKNh|bdD%ZeV{n0}5>Qmdm^%KxDt0BeVXOe-dHjBZQ}6h1q=;%OkF7gRkO{geGp2Wn z{T76gavp^06w1q;(oTOr_GvdV!6p9K2}=O9}vqI;84e6gzXz><{`c!&ZWcj z2bY?z)6O?C%Qd2>17ORB>(HUK`c0;ioR_&0wUv?jHXVD9T_L!%OYsGGY%d0b zFmj!l4EOfQ$1(+YXx+|>9e;?vp%d3>F(XP{9#g&t<=!z>962TuJxI(2%BdGYh}AMS zA$P7G81eTvohDpMvRF0^W-ncVqT-+$d$r@grQ~@{cXo0Tm)(RsjJnY(PImk^(~}GU zp3I>9IHt$LbnM3Ui6hBr;B$Ygkc%`=SAyo>p_-?oc8O%M>L<#MS4dDF;Qq;ySF574 z0p!|%i}GHnb9uM_IB2q#(d?-Qfbb|$$UXmnyMiFda;8)+miV0Rj=#N%17tfeb89%L zIP<8?ekM#M^h;O?0sz(1~K>LJr&m^)zzj zdI2<`1jEB5D%^H9@*KxT&>3g^5M(5hKr^+hlLrg00ECj`cZ1=8{$T+s#& zv*w!o4~MSS?Ham5seZIp&_8w(3+4IxF1jebk5>LMn7s07`uGl%+sd~{!~Ig}H%s3w zeYEki_`6zwdq>mf);nT-G z`uHAw{BQbr9-9a%=jmfF^*%r!e~f&B%73Si?ez0O`Z!M?XXxV-^zjez(e?*u2z=@- ztzA5bdpv-9r7ztpefJ)NeviTaNM-ll2Ojtc!+Njsae#P_VZ6ui-DBA9Fd-gF*V{C{7B#*;Mc)`-RLVl&i?*c;d{IJ?z!&+R1ir|d!1!W? zxN?xXoF=G_Vdn)O!B82b*Qf+cfGKM$eR7WOT+utGen+N^v#B>mSm*y^9BPByC zmLv?F4ir%&eU1E37y1R&9EH=gytE zclOS`ll$=QrcGOv7VPTskUCTp3gsmb;?)*}DkOxUfCLp1f+7U{1F7O41mzzP2!Rm4 z?>qP0duP0l@y1SE*iAj1d+vFB=bZ2Tedo-lMt=P1_AdU59`?JY<*XL9M#FI%hTn_! zH(WjJ7*5dpTyOjbdaw8L(Ws}b_-^RwMlafh8oFuO4bO0Tuk@lrR6Ve4zZkdQ=No!p zxlYpD95MHr`(Ekg&CzHiumao2yoyFHy8(u!3V6R~(O9K{W$|Zv0)o9=4dVqp^Kdk( zCIFhdqrEX)m!mzlxggr8(}wn zsB8MNXEdo!80`zR7QO1351Wsh2h1nT-R9Bg`zKAeV@$SPM+;2Nne2LQ8*}z2eXZk% zPD}M?Cnby;Eybh&a`Lq61`Ag%skPc%X|hyR9h!R4^D(b?U)UYiu>hl(sMhkdu9;n= zm!CHr!_#bqTPUuhSWaMgh96i?YqD$Tp>1iN5@0J^zS49Tschd%$--lf>pTv$I!@u|9-*NmK$BLWp zGYjTXa{}wJN3J;5TA)~dcKsEt?uG#`Ha3@D0xM7{Q2api0$-`GDY|Ls%h(*{(u?QME~w`&ma!u( z%f}`v8aAup(o0RzU8i9Y%3!bSp62ML61YlfwNf%l_$$guzU^?NYkPV4wUt}DU#>Bu z{6X8oGHAA1w_SZXgZ4{rJg{q*LVv(#qY3hE@DqKkl;+FHgQ7gMaBlIXh0D+8GG*!4 z1;aOj^l{5?OAF_o`*8V{d9HZQ2|zY4VuOPGiSZn51N|xWx`NNCn$no&dL7S~9j{hq zCpulL;i-mQmMyBvELt>`*_tv};hMDZ@gKFIf5%Fz%~DA=sVTEfr8Gt3G{tQ7PB+^G z)sxD)QY}+W{BOF-mFh*uh-+Uwby^j0m#cB_Wpt|30JSNl95;}CD+)J=u`Wiso$a_! zwnNY!Xy~K75~YAuxQscXIoS#DY_ z)5gC*)w~wTPGZO(i5YS(rCKB5;L(0V@?TAI^S-hSXQvKg8Je)xO*s4E)8LX)wt*>1 zE#XMC&YP4UePVciM7;iE8D9Tbme((x0{1yZd>tIUOXNSHtQZOu2xvzQ!Q)B5Y9T(I zz|vXND=V6>_@NH*+6?UpX6{sr#4bsP6*sgSN;?D{lcqu3onAMLde~}_FldrUuwAVI zfiR&!hYWN1Ph^ zN9ap|wX>LaWieAMkA}x`DRqxXY-g#vw`sLPFRO}Yv~;UOY(eV(=1BB%v8ad!^YaS7 z^(X6gStaCGp)Ld09H4x$>$F$|&ud^K&b*?7G7K-rWkk;X#F7(|Wg~4c+8ugUFM3~} z+PwMTy(p(ctXd6C=>E|ICwk_u`OyK_vsxCkDwVr@_ZGbn+xrrh>x(h#dz_bSpRRQW zESu=j+h-+pwDn%48~EG9Z{SxY6a-ON&oEyYHsxNzccm5`jqvLCqP=4InT!7Bd8e84k^%zf~S8=4)0FL-VT4+(of>+9Fcm8p_` z{d!SZBp#Z)Yq$pbg9$}k3kHi|MBqbC5Nfu)#_SPVwAo)wPf6=XGKim*1<{8$V+&2!w%wIN*j0ID?g?)wZOR+gfuLvp`s+ROH_iX@%`ZpC z2HC)R4J0r4PE3VkSd!mLR$x6MXJ5vVby-8YDgQG(c1Zdk!=`*^kp3&T)4%zrw^2Sd zO*EZ8%3l_GL_cF@Q7=^%QdXE6`*aNO2Uat{ZWW;eFga()e8mc2y=IgfsSHGK>6poq zx8DhcZunJ~V)H$6>9B0CB>VmkzF{|udZXAeIx8LwSV+MZ?Djk?vI_od&XgvU?o>rQ z>tuV4j|(w)<;tQ;QsX4-dK8!ErphIL0~?oF9}MAg-uA}lxs+@&Ihf|@rrM~titsE1 zM)BeTIZ!7xI|Ocqj&0fSAj1X>)}@7?-T=|Hotn zqL`1j$ABlBSyrZPc1-7%=|+3IYk>(@r}=8Xsq|C^XHw_UPt&eL5R!IJs8$kbXkpp4Q>e+{16j&giOgCD|a9j9%HO=f;iqLQiF zi|GjX_h)?N5DS(s!uyo zULcPRhHwl5-BnDhO)etvOVTJx4VY34ttcqhYSi(HaXjPaAw(3j!1zVw8c>%s0UikJ z3{vum3}{@@J4TXr8R(9%S~NiP0#Ox+BX|q3^avPr@xa|TK~<@=_|kp8gBfP^=>gom zO(;Pb6C0i7o^fHOpJC)3x~@CXv?gNKSTef;6};du?H0KWUS5O2!Q2Nz*D z0X~!A=ZQ_U^g%3!WS;r6=T5)${PX7))Kh2AE{x~cf(iY)%EnT@KK9(jt1pa=E60@Q z?9ewAT|3E7vYxymIQSO1c5@!P6I~%3E|z_%X4Ly`~pMI9Ju`zH1{hp?_$& zz&P5gT8@8mtnQ7COXF*2RU!QD;;JTA-roURH?#86K-ukKF}46x^Di4Et7S+dHT^z! zsy|8u8BFNv8%Bo}fjZPu(oGYUBNjvu;bhMVZ)@yoJzhEvvk!r>0K$6(u_uW0ta}yT zV~0$GMY{CPxRCmg=W&cE4$Y9kcVc+pGOX{P2UuT5njT~mZ%~+yk}AdX%JlMY1HEi5 zOKDt|rSL1?zBtfnOQg--l?6)Ksx=wI~JVNUQSg4%U&OTf# z-h(KMaH6)q_d$>l{HQ~QQ`!emKlY+Nk1b5SsP9+@Y$792W8kDloONe{)G9a2cE4?&nxlQ50p#iX5jWH zDIZH5q(mXQ+kuu~QDFR}G8U)oO&F_dj_XrmULkHj_HW3e&zj$up{F&Q; zpUVJWJ#*$>0WZ5A3i#>_HZ0yCTKsM&RE0Z7MY3JsAxLF-^Rb7gkQM=brnfhPPB=CJ z#9H&w+2%+T4%%I$Su%z7KvxiP7ngmR+A+p z3Zg%qa`hO$pW?4dd3tuBKQ1qDW-U=#3+@Cph41yJW0ttIL(XrS9qo{_(b*yA&85&i zCubq=A+#4D?l-fn()gLkI~!J1m3;i} zq*5M_b+!D7JkRLFcs{gUr!^ifXdM!U{72sKa;Y|+FHMxu1@bwBZhdbDNznTfL!hfvCp>2VO*YM8PQ_5v3t#967To{{wCe z>K_ya6ePqXco|VSZnf8qRU?@qR2#=y+)loG+~Z4St+Gwa9c$ggN+by=OjR zQHhUOFjD|&muE}0c_Q(0tzOMv8=vU2z}D;L&dVeND$mW9=7|%PwQ4C34>d;{2>Ll3 zpqPzMQc(ZN;S*@V_?w=cE16Pv-C2)#JreHt8^dzPc0_bCkT~@-3nbL~Sz7tWsik0b(JUkjZ+fY2a43x5@P-pADIMM#)7yXhNrQ=s1i#n1Lp8 ze5wFjH%fs8NobTPGC+qn-R%u{e2kmeSCRb;}`}+pCX_7ojUP@>?we z<-;K6VwX3JOi@HB31*Fpv^dm9&vb;;gOW)JfE3Z<0XffVTse7CsgFHxo$?7BN?sux zgqvQSdJFO`&ec%e9DuY~tYWqyt~ zg9<8K!0)Ewca^C!j(Oo-l?(XmbXsjjeoaT2<)ZS`3=LGHrZq0fj58-&0R{n7CH627 zR01pkVFseI014&kSOATt)a2O+urN#m19ORhZjQeTutd24sLbU8mRN0}l8S(+Z=8yN zsfLc}kE>-st0bVIxd2Jj$*fc*St`_t*C;!ciU3NqOMx;Pw1gKICYPq!@mIUR*p zUqqqYLmaw8OFN8#a%^`P1Co7r7{gL|hcU!<1{8^J46A5un5Fzf{pv`nY`qbu zE(%pENnOK%MtEFs;*bO%ot#oRGrQyKj5LdQn;OuO2fCERl5cA7)a~K;^ z=szl(c1SM=&e3YwGe3jJa_JQ8CK1g;*9>D>nVMD#3S@0n+QNgy>5~2T9W5EfH~%wf z!ST&s%EmXBJ^>R{oLQl4L^22{Er*hZ4dv3Mmk8gIoCadlPOBsh?l`9r8x2nS)#zZaUsPVCJR@O@!0FK}@OccnG=v!yNT?NeNZ4y)U64HG;t~T1+tf4yqkO23^Q38(@Pa^mEq? z%WDX#fUl7*mSHSHbX2dviYh8sCB0GXRD%OB%~+xRfrTVbw&cY{Db-qGrix2Za6*@m z)rK5lqD#@UG}|QW41{nVzDE)nOm@^A8~@^vd`u*g0eu%hn(orOwzW&Y(!WcI{~-E` zw7YN1l9c;20j^XnjTcRW49nxCCjO&8`UIg@D2*ZW*WBW7o%Ve_Y|*@VT<+R;A>?8g zu@z5Y6Nig)ZFElTSNk?JBhU}5K*$!RrVA`$Q(1n9$}_@uQ$bF0b8A69v%Vltic_RL zbw@}`g8bQ}1q<@8^s$z|IiKEPg~K+^vOk|IDA!*ww5~#TRna*E937D5oEiBSa7FTO2BrVVCAZMiL8O%vQ z+Bp0X?cuxCqJgfWy;uXjreWo6+I+e&p?!_!@pzl|2xvPR?ZstYP#Ck@@>+@%Z#8;~ zZICx-L`2Q%EpkJeR;emAeN21*zhs-VyqHcQ$ z&66{p)7vK;&`mC-y3B~5!~nx7HWIJ0{j@Eb-g_lNZA!zpZ-3j)&Mu#B`=xjJS^hzd=X0blqx@-6C|m zj3QPplPkBJ)$ov|t|_rCL0<1k5v|}xMddQobCGM#CYC8rbA}G=A7KEIeFj5C-VoGm zN?RhjFJMVU-7jFFheI~X{g+zw?`*WvpT`^6kr~Pc0zcPZmocLDco?Otn;-t2E0<9-UC=Wf?Ck^s+WxZA{JS_1PIRQDnO^z0zP2m6~X&PuCD? zspM$=Wv6t41r6dN?kauc=B3=?nWQ@P%}-)bQql1z3*-7%&n#X{TIkc|+7yn=%0h04 z>vyJ0eZ|~V6y`3SI-fMJR*h1%#+OXa)ikX-p~P>wpE;visW+!*E4ZryR$o1N%iRsO z&7BE7x~&yhN9%$l7|zex*_9ZF?vq_fsqgok=^!-t5ZD`NE*2x~_N6eW zR3Nvgl|uLD+k)=v8$h@82gDmLR&pPH-z)H4088P!YZGm{liEqrK$2(tfW$!o)+ZIt^e@`v>v^> z2(P=$xriN?;79bw`WUAWb0%YHb#|skH8dr#a5G)r!s#8MrFjP3gwVhZBL-9{gToC% zi-RhQlT`3Q<34U&3u+Y8+dtlhk<(TD$8D|RUu?9B^H@dCfF_A~x((?J7H;6`@^X9( z6P{VRe4K7g!IEnYU2CR?$)4dZSo_;XC+W=oV_P%(%l?_Ae$&4#iyRupi0ntx&^2Vk zvOYxR^7*^w|D}}uKRiQ$71-JlWY2BphaKW1_dcY*X}D#m@51A6_MuH`Y)7$oc4hog5VY|I8HsiNx?u6c(*W1*`JD^4A{iGCVv{ioQU2T;C2BY zYz%%-6}Dsx88zak5k>+x(Cpp?xPD|E1FoN4A%XlrbVwJfyqf&X!U0(#er_S!5C17e zVe!imhm)Uzz|m6pcAW;UAbpvx2lW%LS+o~-<#)rNciDXSax~iF-!*^@+`|K3+8St` zE*>5d1FGZ~#$zsi3_Tl92Lo4ENta}=F|M?R8t1L`qDPyE2-8AlUS4=0I!M1r;e;J^ z75uvczgBbz?q92m6GI(}+4|`6aZzH}2A8OmR;tRMi@=C+gZTF&E=LD&q{Q_C)rP+r z%lBZEBk#0)9ElDat5!hik3s0Cr6VkhFx;UP&7<%wYQT}wLCGkVUpH7mz8M{|9ITOw zJ9TlBk<;o$qhZi2)C#_Z?@#ofI9UXWx z&_(+S2r4=x`b}Ywt)J+BG0-@AgysNT^Gz%fQg(5@_(6HoI99xY=LhlAA<;W1uI)9{ z1`j=yj0q1W8a33(EzF zn;RZ(`=t&a<`PD3+Wxet>lI#iaxByJ_9;z zCZOCWNdshd0F$Ag5v%dN-qo@Ea@1BT)1( z(HAhsX#o*!t78SdOOG6n4s{K>14UlAj6n`i3GQzP7=3yao_V1F?Zy(PKDvrY);RN3(1- zK2L+KzZo5le-=ljP_1BVx1!yKbAx`eCfYC93FsH72sfSu;s{g`abUzb44{Bo0j^pH z+CW+n`;H#%E9IlMRE*x5$pb}G==X0>zK;sU_k8<3AoBK;_%K(^u>J2yxoQ6^ef$f3 z{1bgV4P~ocqmL)3?)T8g4SMwH;|uihd3=P?DD@kxbum%=unYHm%Ur$1o!;UOZ*gb0 zxT9O#$xZIyW@tW1O&E>?W@w&dAk2>m2HSN$t_T z9!KS<-00E1{vjs3faKC+gMGzsAf3VabfjMZy?fC^I-OeQ@Fm3VzB6(8=dk+iSFlSL zcKe^{Er6O4@&sSNJ)u5a9Ae;v5%v{7loT@xK7`v8Yy?_?@-1RpI2{099kVr3K*D=^&B!Q1$Vgd;y|EhQN>zP@} z^lH)Xr`dY->Rt8fRnE<`LDr;+R#jYi`k-s>hwy!CLhILiI{vR)HNon5!P$>3RU~4hlCPs9kpj_wpX-jt^&i-Yz;8 z8cQ{bJ486F+o%n<)dGitf>%a6yQ13k=vAX3wYj&9J_{{TKlEdV%H85rtIko+FFWPSbGOOkRh^<^hfdwy6}N%E z_8dW73|Z5q8d|Xt{TWpqOL57X_KHr~CRtnmKs5+z4~{*c;vReeo%vur&doTr8bHe~ z7K5YKbaemyb5^Ztm%}2(ksT?3vs?CNYGI9jep@qlwIUyKS4 zjU(jE5*K$^-b@*cL;ntV<>vSmmtBUa-hwl2N5z^|4T=u2#V!=kuyUTp5Q!_slj~5` zPs9ThR|*Odq=-00xS?8*w}L4ej}RY-E@Llf##*5ZmWd28a@z|*$@b7&=OInWng+wm zLCvwM&a{Iv^A6IV7?+$8{cZAvi@69^IP|0ogFfSP~sn zs97Nx9QW6pQU%@Sgv2$MMnt!zaWp7Yz?!Oh1q`FfxNp{RDi~p3Qb|GVYpIfG0Hg%wnN^yijz>wl8%~oA_<00r5-OIL%FqL zXhFAl({mJ0p*#e$3iE@milEIcFc%gOd4=eb+TjRt%tONnTDD}v%ENon$hBsa9K0lz zBXO6~Ijo~s_%Gdr#G=n$?p?)UBAYjeQ%@yTT0upp+W5)HnwNlZ_Lx*aVsHM_*8r{bk zLi0$0Tq)~D7?|V}u_g#%IZ)ZVVo@MQp@q?eAp&--|!G5lmL?2%YkY8h==MR+{am1L7Rj{R@oL_d;9k!Jwz37!N|trC$vR_AA9!kQP$?s3si9K$&~@J+c+7xZx^5&7lY>(>pC1N(e*m5rL0!%;r6Q zu3M{B!fVFI^M&%59~PXVcceO2c5370N@-lu?%px(gjbA%o1>*taWqdg0Wth_m6_4f zeua~IfV}(__l&^ZzGn;kZ=IyzK@Q=8iuk)J{$9lEIa%0J(-*nTVefx5g zd-mU$yY|NYdv4vgd(YmzciedJ;B^?uNh&ejfD>hxAUFH=Ox}EG&&^1(Z{O~sHx^W9 zK;A$H0A_Ug4>EAUyMp+GHv)$m|Tnw>EttmG*a0{ zH6!N!-JB%i`3nXj<`iBPj1nHP5s#@H`FxuaRMj~gkq7EJHaiw*{Gb^tTz`0h2Davv z9O$C@#Q7%nXi%Lc*JPs2#MXgp%?{Tc{;GtLO!6-DIrtHCixvyF@^+ps<{-#riv~H z@X~2@0D>E#^o=SaUk%_{=}8x{pYp7!I_F(7*m1{Y&l`Q|MbEhpGgXc)J4eA480L6Y zRK^@8Uc+dbA8IqgmPO?y9r2W9={^R>2L4~IM&@mG-tr0-=C4@&h{%D4_zjWk0TthX z9>`n5@tAeyAWQ|K9f>>O7+@|ywPh%nM(r@z;6rtg_AJswyNmohuS^yd6CoHUOda6F z_DM&FCh1j}_uiUYg`8WwM1sM2K^{GM`U%H|e5E2>jpq5?AjdVfZY^P3weLcTI8%88 zLuI(Y~hNYG22a8ZSX3_v}(%E&tiEabdk}8l{qZ& zlr7T1QTZ@5H%$i$JjInO0`u|3lITngxJc4T^GIU{V+#(OQ-wdMX3c9bK8lX(6e}=e z}2xF%k)Mw6wL(-ebMHcm*Z2SN|i0)VK-G%r}e8VC*V9dYWYx`>mSk9x~uf0i|y zU=3C>(O2-$gi%H11fGI49aMsa*{5KUiU^As_OwceD)e);*k>+5$CFnw#3*G4Fx!Dn zgI!Hy*}>!K7vk1&94k``Gb#(x3ng5icwFWcMpL}*N-mX{rf~wGp@Z16l0}b~KY;%a z){kQZay)ec7Ea_!DR&796O1X4`z%*di}sWQF~z)#lbKOs8L(BNf;Z#w{6&-{5*31o zgh;yNP>GzOn2tjE@r(fF2tF$ZUaii?TVb!Z^PHg?VBQ(NL{VTlPKRG2r&q8{HatKs zK*}z=WK+R0m@hK%SlCBR#L_DT*okB;u|i3|pmWGO(W{6^O>+RT17Klo26Hu+>TO`{ ziU-*t?*q%W23}I@xb;RH%o{WzbV-Qb8a!0KxUv-)jNY}iTDW+0&s}gCnu%#z7GJ2R zPr6!T(7a<)?@@cY`N284ntX;S|&AOuXU!V5JRI794D>YI!2~3Yo}yJ%%YL(LZfyxA+fOH2s25e(ZaGhrbr+%b6_GDOLep` zLGINhW)4-D%rbd-@U&_e(Cp{%RB|#lnXG*|Wfx*z5=hC2ULxV;2cwi^Jq+R*LY);I zBNmHt?46`V7lsToKFse}9bl2cNI~Mx>toQmCOVvDaVFh`cBWDw3bm*LeU6bLkFB9{ zRI!LPq^i@BqhhD4K?$280q+&HNL`6AaYovl5vR-)b;-0RX6Nh%8#L1qY?fG5Ot*ce z7)-%n>$aQXCALk_PTI}u-h)X!{1K{qy3>W4unN_=YD9Blv(-u~(CR8}J2c3POe*&z z(kxaPm9(V{bI#AJ#2aK zo9&s5FE(GOZsXzLo9ai3zrH&#?> zsx=yH*V1N>rMeh7n%YD<0kq1|P+u97$ApqLa?`95-m1#8F;-5nc=9XktyyGx(qXcQ zW7rp!B4{di-^2ETs1$phW053}|iDCPfCW@xrCpvqEPkO*8gOIm_(yD}LWFrh=NXZ`w zv?+h49LZB7hN->4XocY)&?*{FLr_Pvvz4|{qG4!});f!(d=7QB*%j>dSnL~#8X?}S zrV%f_g_N_%K0hC_Nt+GYZpAQ?M+s1*INT(5F5o>o$9UnDGz1?kh&M|D<>yO+koK4A z6NRRDW-D_k&#SL0e_jfN%@$_{B$jLecAqgrT16%sXR}mka&-l|ZYsbU7#3;a#llSE z*iQoqtxAP%3H~SfY?#h9#LrY{9d=M+NxC5Vm^lI|HpWvs-UGt+&@Mg-_OM`zC4o+3 zt!2a=celnXaUu_sZ+Dx!-QTie*)o7Ta5M^Q8_+xmT;cBYFBkYL-Cc_0ssy|`0k4@< z@xS1XC~%8=nF62dUaP?8&Bq;b7l=x^ZeB(FqPtsyaVL9<=;OM^xqIB}73Jmbr~+?x zZ&BcF?t}vO>*`FNP`KMQbU;JDa9^mv7rA#Uf_pXT zi*<6#y-!iv8ad_WRhojXrK6!~UAGz6RjJ1&-Cban=lcA2R#O+}8Bub}{5Nnb{P(af ztvaz>WfHnI1wN=Vc&Vm*nZ`Y&tMGF76)MRqHS$%O@YNbRu45l|H8}5{RH<2%>CVoWs36M?t6@eBva-Socr&| zivGU*`#$#%82^6vQYCR8a6hQPKXf0HpgJ_dZbiH)Ii;D)sU1Nvy-@V}Yyt0X(d^_| zq;mgAkB~ps(1$ei7Wb{HW`E-TsRBRj{+R+l;(kB4R{)PJq1%C2`fkFfKD*34UpfC z9}aZ@5VW0y?^5_~3iYT^FNOMK$o+}?Q%*ZT*g-`zM4>e@6!&Y!@Om`X(>TdmB3h@C ztf$Zh71~IlO)7K_g*L0uxfD82h0X^sv79r!fWY$^%n{he;DrE1YcB%i595dNmjKwp z(4~O%wmD;d0T_{HL_u*EZF|!SgzDHX-LW|RVW=W_;_h~PV!7-te+#k@Y`siD@fxvi z$eSDb_?XrZyj9Jc=#9c;lnI-%-CwqH*|PY8+sh6e9B^{R!Mt2Box?&0onOW_@P3>z zcZ#qwIJOYt=sydR{~XlEzZ^f@=urxdsn9q8!Gf)X-=^@}0f^S@&=fm~;tKi^&Y6ED z!MhB^Re;qv^RK3eYmC_Enz7eX#Pf{U>j?fu1F@UnJqF@7z)GX|6BMz}h}}={q=C4d z-~$HYmjLVZcOW1dcu+%kngoXkty=ngGjNwl_5vd&UYG1-PKn*#CZ8hi(ll^3{TFgx z7ovX=co72r-Si_7_Yi!qfp{_CNf~QyB4g7RQc%D-`$Y2`+%;NP8Cga;|2{KdBQUSX zri_@_*t!mJEJ>VHfG;iThST(VXPb{1;6SR5Tb;xS&nRAPjGSArF{^48Z%#!lBH$P4M_75kL~z+a1c0@C zR?NU*qN>u59H$|{H3Ja=)@hHJfulrq%piRbupTrorHGdqu@4daas%-Sz&htwBA|Um z|5XU-oL)_7j?<5<NsHr<`I~9T+yARG`~zgGGR>cuNsI`fOSr7-NROsy#dWQK z{BPig%lUha{|62IqlUhzp??A-IQ=b+`?kjYv&Q`kApc+S!?}M)(s09eGCz8zs9ZB(14B| z)VLuHtq*ZGcx}?1hm;YpVC}FKQdv? zB)!lKTx14@jX=ECE6vc!6M0ZxE_=o+D>%$7^NsrzP2q?~c-*KHfFf9J5QIl&a3s3} z6bvbnK1Cv?XK|bOtD@JaXqqEoXZVPR4KCH}SjUQTu}^`UX><^?eRRggr3GA6+%|Rv zPEm~RC2-qT{EkkcqCI!gjY+X&U3XMry3MkZD!;gUbhI3dPGffrS5+1DkgA%PGs&`5 z?D}*ps&1EXDhTr_MWIWhLnd@auI5#+Q?H^2RR&Zn4ny9LMde-!3xi?m&Zv7s+zC&L&+Fmz*@(Vddg1lhqrcvpW( z)6H5Bn^ssgF9z7oiPxoRcG95|OyC;v+o&0IKK7zC{SK9rh4Z%9A$RF!=c#yr7uM-~ zo2(e7w7B8MTh@HL)gM@edD*6PX0i}Lu!aaONfWeafgm0v;!D%St*R!d*S08IHe3)4 zfdHreROP816%0yh1XtYO00N(C=x?MSD&F5jKa{n94*gIb{$~6@I@~L%`En^Ax6tY0 zW;m9wPpriG7;&RsBe4;N88o(EAVM1&BRzS;9dYU^zD|gn_7h#|PPi^aoDu;2riQ$d zlfhJtH4U+(gX$A2;&lypadNjlv8t(j$R#CctX5bn0PPMVs$Jw&pSUiH*UC*}I_rp$ zBQAr{W=RT<%SyP#j6DX~NIGcL3Et3+IdOQipSEde<4Yc2iC5r|aEx(EN2Q7ZAEv}+ z4jsC~)i55mkYrpQ4qXR4p2w*-P|e~FC0(G0N}wyfkpB~LZv_{AY1YAKf9ZafxI_eW zI40OIhKnsY{MJvD#zA@(<<#$$ zQ}?;t(YPN8cxq@J<9%~5jjkDB(=Lr2RF@Azr#Q`LWzpPj*T#)+z9&PsFxK-PJcJRa zW9Zm`ILyeWsmyz-VwOreo?Ur&rF#%(dDW6UIuIvr+!5T@rdzPskYyEeB8ofdlrE~v zeZ}MDWXH|lyX}&L7q#=4IoXlBVS+<6ZccWDpAsP&J10ASuxcO2k*YY^@&2_Ois;@t z9TmgDTRNx^_uwiGZN~8yecU6r1#x$%hKD4?1zLy;2v^dedZbRrOGdbKQk7d%IzwCq z#g(vQ;&du)YP&dVi__6C1Y>^1ff2jBRgx&2!sajDe?a%y1w0K9SX;-~IHy&ZECDMV zPIa1I62KuCK{wJW+X7vWgt*kk#CG8rjCehMUMtcW*8`1JIGW#K74p+F*ik(~@=Up3 z!-pZS$;0kotE53u$||8K5>Jc{dUHV3X}ncI)YOVSM}v#mBKDjGb55}WB*wO^BVD<$ zg6U~%|NcXC0@0cYf`YIdTaRs}#~*e&SBauWTNOyEJ=3vG!U61U zDIV@@mH$+6$2M`Z0yn>`5{_u#p1pI-rYj^|%qdpu3knVjv1s!Oht=qrh*5~cw(UE% z=0z2s)4E8RBpLRiB#a(;7_?CLColy3N&N8Ps6JeKq&q5h@u)o)(t-2!7TxQo3znoD zaQB05s^i=(^yNlzj)5YYBRlEbI3IryMeIWn@hUlZxU6JL{EsM~qWl|o8Ir}?t{*=aM_d#+g#&4llUS3_N2V>%P=^Oer zP=-@>+-+P7A{)BW<2ygN*CU_RzW4>HYW2e@=)$C;3n0$M~x%!S2H8D={R?&5`mP$I^KYgj|jdjmUbNg?-en;*Wy!0VOMezTFi>pQycjGAOOoNEC@Co^#{uMqQ zv03C5(txk~pFt41zM3 zBMv9l#Wik>7JH^@SLn^8R*6Mry0mIph>WGZc{mCle-*9#*#wLa6@qG{%)#vsiML5AMZ7JLG87Mm5X~ZZw+;##%DA4-M1%VpQ^| zF1d;I_hjW;!ul6x&7zU@&d=_GeL`z0VKOpgk<{W-S@k8=LV2SL*{lV1=tx$Zb!N}@ z^=C=8Xld+BR==KA3KBtj4QH{S)n5V*9y)k^4ilLCY|bm^;nsws`7SGrBou02}-s>bb8h87Di2WpPc)?Wx7{?#ZlK zBx>ae!TyC@*39F79ZByE*x|rigSd5(8_(^%>xLaE@%_<~F?}tIFIIhJ>7%q})hxZw zWMyBX6`mICTS%{-ed*nJeKeEXmK(Vh^B*iB<><;3E%R+jv367Y*>O^vbZfj}80(3n z+n^P={83eYGk4dc4vTeFvu2UV_W)10$G|rH561$$Gncm|r;I z5}SJbzO3Dq^!UA;MFu}6s|^^qRh+)S9V$#R(XNz!dgYQaa&TB4`xw;)H}UhK#q;yQ ztXU+od%x(Cvu%7=AEf8A3a$D6jwR#!z%UMwq1@B3{jFJfmWc72vSzX5Z12AbPec@3 zbN$mx#`V?1(^TwfnEuJE97~w~@vK=aIn#R%@H?|PoNP#MG5+h4aU7fJT;?d3*`!*& zot0M!yT6$=i$->5u&jx376v0j7D+A6V4SmBmQC14nQ^dgI+{~9Mx9SLUEt05e#zN5 zPtoiGZyaXtmlsa?gyECPIKG29z9Y?Yd&yYdCt1D&EJvYDLjK~c3`=-^ zH)rv4bWb-a)j_k_9A0q`q8S%r+`!bAFBwzM(S9n=r)3Qm;P6Wq&*2BMW|2tsG0{n9 z+hOfHKrembjz%;4-?n7z?;pk$9WHeNmcKbGzY?K-W7aGhS)RcPCx%=MtqfTtwOArU zF73xo)@JGbx2Kk@8$)pSpL1NSv0ad!!Sukn%FDKkVR69S7u#mrdnXLkB{g7{5Jbq9Q7aTIy-JR zwd73ud(S~xi}bEXIE$a7I-_2RGNMwGm z=z@jZip#?E0?UK8_vW%0~AnKg?p4@|^CovRE-Yx(HMQtQQp&)w|4nX?GEJhGh71^7sj}i9k>|J-><*7 zJ~Fw`(30{5)ufgLN^m!RP{m_mF0`O`Apgx(mMs$i#l{t8-16?kz z!^$tVb>lX7!X12}-ae{I@%Nz$xc^EIYt|>a-SzRFaeAeG9N&Dx^C5P597lNQdChQK zUY)bTUE{ci9?>Ti_!;7HaZ!BSco>H7fo`Rov)ltsl!K6~MJb2D#nd92isID}Tlx|` z-qjHDMR&y4K%ghu_<|B!q#iItC_7uxl5+Y$sLL_xM6vcfcTgZ*y9N?D- z29+qKu-)PT7rxnn0^{X*DmU)or{Tl7(iDBGv*{_EF-t|Y9~3lt_>+|2ot4nT=h4bD zd!}&E9pg!buXk|f9^p2A4if;L1;K*>;9zuig{bet_15YC*GCUh~kZm-@>AGzqqm2`Z&y5<}J+e-A2m0pF}L(hFp`tzLhB>yrO{a*$=A9p28 zz>^Gp%$FOIMVrm8r4?LkjcN_4B_UiD5)(-H8h6f&Vh~gFa zGB**wmJ`Jt_;yo7dQ$Ou6~A9(Q1rR@MkBss%vwjJrGn?U&mdnsl+h=9PQC~W z`QyjZ&;@we<^X??iTlpqf_l?e7w9u^7&UFT;w_nD^@r$7$JSX=*k3ihJpSgxTSDgVrwkTg*Y>}epAb;N^cL3Y9vcyy|{?|oY*2rD_h63>1 z0u7Rc4cvCg06g^f6jJ+N;w&hH2MCkLA1P;<{qZ{Y4jvxCmtn*pz#9yOfOyYircHct zk^1M^NK+KIi#Kran2_uQ@h#SYn_ztDse(gg@9rG01e$v!4UNiE z@g~~m!eGZ^W{uD5fcEY*tvtik;^`jH-kYM$o$(nSBzaLP$(CpTvJleVC)1KvITdfv zulDG7GVs6`-c8`hRmZBECq%ZQJx>iCW6 zczOp+zp~PpSkx$Sk?@*Ps;)4i;+xPYw>e5zwue8*iYC)X4&;|+aij-Nn~e$N7(KfO zOTE7Un+Eg^f>c>Ve1|+Jm4dSQz2Z*eQ^kYgaWuRKRdbTB6!)vID#;HN^JCHRP|ME~ zucv3|=w6NG*>KRP_9aOU@hyZAMJ{?sr(KpporerR}&M(}5suttkd zB%O!{T76!)Fa2d6Oy!E0K7 zIk>;+qrt1mpP;V;t7oV9UF%qhg!%Db*SZ%2$HhxU_$a*#{YYOolb?S+5%+jydi@h4 Mn7tKD5~jxf2a#3J_5c6? literal 0 HcmV?d00001 diff --git a/documentation/_build/confluence/.doctrees/index.doctree b/documentation/_build/confluence/.doctrees/index.doctree new file mode 100644 index 0000000000000000000000000000000000000000..de871f97352e0c6478603204a05d6871e04df8b7 GIT binary patch literal 3941 zcmds4U2hz>6?Lqv_CsHmW2+4kqmu%$bML(F{N;!m6wGnU)xhwA>Ht8c1Z*Vpvis8T1aa@XLIa3NF8^6C{P zH@&|V(hQpb-9%*z@AHoP=L?#dGM_|kaB79hql_BMbTk%{?L~=Z)Uq^+F9!9d_P;Jg za%wEqHiGj@UPgZ?Wpr>59ULA#e0ucwY4q^H!^gwHpHvwoG>>RX3maK3Ob8iaBZXv^ z$&1LU=mIB*q&OA%WG{+K8wnd3u1c9k)JBqFFM~womWmuPSfrJ*(U(>wRx|cxlnTuf zE6&)k;@wvj@4L5OvZ=qN|FhG5SNW{F)q*0$w&Lq1rfxv3)dIH$hh}0ncuA4|| z42*d0hrsc$&M9Pvbia@)8hEWVRSco{`-#~MW2WXuMx5RlhgH;?&4$z z{4QVN_fGizlQO3KXShrLF3|KIes}Qu1%4mAs!IMLAHjXEcIUhN{&6>KxR12ZiKYdg z-`C%M(~!3271+{lG-YQZVFvUnwa+KGkOASI62N%t_2O_CeZn-0&e=Wu&!&Y`!h$Km z>$lU3T$$*}lcx{%qH``19)V&ZdwHN{tSn!O7tuTorr9M$yPrS%-Tj6=+wSlGy)FOi z^2u=qHhOSCf|6F>S10a+#i@s6tXaymNDOIGAKZSq==P|cBrzhB zgab#xZ)v5+Bv)Q1zOR^D7kMJflzEBw08Icx5`DDqTXD(jV9jA(96p#26EHt_?jC8!Wsp5!*_tPb#)_Q*sj8J&#;$G ze!S%TahZ;8t4YQFIoMV(UD0KRe%j`>jsr%s8Kd2;Mw0f;;eICKNBi6h1#Ow`cAELf zcq#E7QR6YE0Uu$7l|>D>TA~fripESP`L4TVHO-9-azLPx6G&~X+#RbdmGx~kKH>68 zems z;iD7RpRk;1YLx~I`zZ=OP?;4Ntknw=ta6Ispc$50Vzhx=5MM|9EEewgyk1o9<`_uy zXq%fne#>omRR=K0bgXn%!Ln(QIU*5H9YCxfMr6eY|bs(Rx# zMUFcnEKgJlFVLX0A5JK5T$Z=mS&bh z@PD|?I_T8~+E?FSoLG9(-S7th&4F&<|>6}U*a4T2> z`hD)NOod@(stEcIc-?@^DZ|M8n*kz;C1=8j8lPJv6^6#rAEeo3x8(&mwvNLXFd>i( zK{pyV(u$qi@lRL;U5*zwB*sTek?%EV(`*QQZhLY8Hu(f7lp+(hdVb@c+bmc?a48VD z990~Ptb0pLv3Ji5_j7J-VU9*4n9Z=buw3Osr6;4x-S(bg1Mno4p%(_-eA~r}{SO~J z#(i$;ak3QNTdu<2ZNr19)Z_J(>7ihD9M%B)N8Dx-i}fvyL7~*EdC%PeATu)K=Ij8Z z?))y@4Re7;drG|GN&G@vrabP~O@@A-d|ieT^2WUr#`Ta$mC(A5xH~96*bfq4lMS~V zt`KjZmIc(`f0u-E(1-wP2P`5V0|Tup-1ItO%6Q37WFEXy(VB|BVLYvX85Ein{Jp>y zIAa!z+)m(iN*G!yN$?HjRTgP_ z&V<>}CU0X?fR=^00yZe0Uc24R1#8`4!;EO-*xH2husea-ib+n7&QczYueNV#7g5o?R*Wb0RNbKX+>;X44y&0-~I`46tQmW(s+ z{zAllyJ~pp=0g0se*sx;FUM+T&;UR&67*JpMdj8KB_$G!GoWO2f8E%Bz~R5EJ_GvE rN`puEW--Wjz2HnZ7R+lib4b}*(}Vyb6aV2eNWHc-GT^Iq84v#rk@)T> literal 0 HcmV?d00001 diff --git a/documentation/_build/confluence/BootROM_8890/01_start.conf b/documentation/_build/confluence/BootROM_8890/01_start.conf new file mode 100644 index 0000000..c00bc0a --- /dev/null +++ b/documentation/_build/confluence/BootROM_8890/01_start.conf @@ -0,0 +1,18 @@ +

    The Exynos 8890 BootROM is a small piece of code that runs on the Exynos SoC at boot runtime. It is responsible for initializing the hardware and loading the first stage bootloader from storage. The BootROM is stored in a read-only memory and cannot be modified.

    Useful links:

    +

    Be sure to use the correct firmware and firmware version for your S7 when trying this exploit/Frederic’s recovery boot (otherwise the booting will likely fail after sending BL31)!

    Protections

    +

    There are no stack canaries or guard pages, and no ASLR. Meaning there are almost no protections in place. There is however an SMC and a MMU. The SMC is used to communicate with the secure world, and the MMU is used to map the memory.

    Rom is at address 0x0 and is unwritable (Sometimes this is writeable due to MMU caching) and is 0x20000 bytes long.

    Samsung Firmware

    +

    Samsung releases firmware files for their devices. These files contain the bootloader, modem, and other firmware files. To see how the ROM works we are interested in the sboot firmware, which contains multiple stages of the bootloader.

    These files can then be used to boot the device into USB recovery. To extract the sboot.bin file from a samsung firmware file:

    +bash +false + + +

    For additional bootloaders, see: Github exynos8890-exynos-usbdl-recovery

    Memory Layout

    +

    The memory layout of the Exynos 8890 is as follows:

    Download protocol

    +

    When the ROM is unable to boot from the internal storage, it enters Exynos Recovery Mode.

    In this mode the bootROM accepts data over USB. There is little functionality other than receiving data, meaning almost no additional attack surface except for the download protocol.

    The Exynos BootROM uses a custom protocol to download a bootable image over USB. This image is verified and executed by the BootROM. Unauthorized images are rejected. Initial authorisation is done using the ‘_auth_bl1’ function. Frederic has exploited a vulnerability in the download protocol to load Unauthorized images.

    \ No newline at end of file diff --git a/documentation/_build/confluence/BootROM_8890/02_frederics_exploit.conf b/documentation/_build/confluence/BootROM_8890/02_frederics_exploit.conf new file mode 100644 index 0000000..503cbbb --- /dev/null +++ b/documentation/_build/confluence/BootROM_8890/02_frederics_exploit.conf @@ -0,0 +1,94 @@ +

    Frederic published a blogpost on reversing the USB stack of the Exynos BootROM and a blogpost on exploiting the Exynos 8890 BootROM. Here we will discuss the exploit in more detail.

    The code can be found in the exynos-usbdl repository.

    USB Stack in BootROM

    +

    The bootRom is the first code that runs on the Exynos SoC. It is responsible for initializing the hardware and loading the first stage bootloader from storage. The BootROM is stored in a read-only memory and cannot be modified (making vulnerabilities in this permanent/non-patcheable). The BootROM is responsible for initializing the USB controller and receiving the first stage bootloader from the USB host. It will be waiting for a package in the following format (dldata == download data):

    dldata

    +

    A key For uploading a stage to boot, a custom protocol is used. The dldata that has to be send is 512 bytes long, and has the following format:

    + +

    The dldata packet is used to send data to the BootROM.

    +

    +

    The size in the packet is the total size of the packet, including header and footer. If we modify this, we will have a payload size of around 502 bytes.

    +

    This protocol remains mostly the same for newer Exynos SoCs.

     +     +

    USB Controller / DWC3

    +

    The Exynos 8890 uses the Synopsys DesignWare USB 3.0 controller. Much of the code is shared with the DWC3 driver in the Linux kernel, except that the ROM does not do any scheduling and a lot of features have been removed(OTG handling, etc).

    The base address of the usb controller (dwusb3) is mapped at 0x1540000, with a size of 0x10000: (can be found at: Exynos8890 dtsi).

    +none +false +, <&clock 703>, <&clock 708>, <&clock 709>; + clock-names = "aclk", "sclk", "phyclock", "pipe_pclk"; + reg = <0x0 0x15400000 0x10000>; + #address-cells = <2>; + #size-cells = <1>; + ranges; + usb-pm-qos-int = <255000>; + status = "disabled"; + + usbdrd_dwc3: dwc3 { + compatible = "synopsys,dwc3"; + reg = <0x0 0x15400000 0x10000>; + interrupts = <0 213 0>; + phys = <&usbdrd_phy0 0>, <&usbdrd_phy0 1>; + phy-names = "usb2-phy", "usb3-phy"; + }; +};c]]> + +

    This is a basic USB controller, but some functions, that are also present in the linux kernel, should be visible in the bootROM as well. Available functions could be: linux-kernel-dwc3.

    The USB host sends a USB_REQ_SET_ADDRESS, ‘0x05’, which the connected device has to acknowledge, and will then start sending data to this address. Initially, the device will send data to ‘0x00’.

    +cpp +false + + +

    Ghidra shows DWC3_DCFG & 0xfffffc00 | DWC3_DCFG & 7 | (param_1 & 0x7f) << 3;, essentially preserves bits 0-2 and 10-31, and sets bits 3-9 to the value of param_1, which is then likely the address of the device.

    bootrom exynos 8890 dwc3_dcfg_devaddr

    +

    +

    Other general device descriptors are also sent from the device to the host (to describe the device), these are visible in/at ‘usb_init_device_descriptor’ (6098) and usb_init_descriptors (610c). Two end point addresses are visible: bEndpointAddress 0x81 and 0x02. 0x81 is 10000001 in binary, with bit 7 being ‘1’, which means that the bulk transfer direction is IN. 0x02 is 00000010 in binary, with bit ‘7’ being ‘0’, which means that the bulk transfer direction is OUT.

    Data is transferred via Transfer Request Blocks (TRB), dwc3_depcmd_starttransfer is used. The TRB then contains a buffer address, where transferred data from the host is written to. The buffer allocation is done by ‘usb_setup_event_buffer’, which sets bufferHigh (DWC3_GEVNTADRLO), bufferLow (DWC3_GEVNTADRHI) and bufferSize (DWC3_GEVNTSIZ).

    Bug 1 (Integer overflow)

    +

    Originally described in this blogpost. Our if-statement is written a bit different, but boils down to the same thing.

    The exynos bootrom uses a simple USB protocol to receive a bootloader binary from a USB host. The binary sent is called ‘dldata’. In Ghidra, at 21518, we can see that it consists of unit32_t: ready?, uint32: size, ? : data, uint16: footer. The contents of this data are checked before being being written.

    + +

    The ready flag is set to 0 in the Exynos 8890 BootROM in an earlier function on pdVar1->size (pdVar1.size)

    +

    +

    + +

    The dldata struct in the Exynos 8890 BootROM

    +

    + +cpp +false +size < 0x206ffff) && (0x206ffff < pdVar1->size + remaining)) { + *(undefined *)&pdVar1->ready = 2; +}]]> + +

    In essence, the payload is not allowed to be larger than 0x206fff (34013183), it checks so with 2 seperate checks 1) In the first condition, the size has to be smaller than 0x206ffff (pdVar1->size < 0x206ffff) (34013183 in decimal), 2) and in the second condition, it checks whether 0x206ffff is indeed still less than the size of the payload + remaining (size + remaining)(0x206ffff < pdVar1->size + remaining).

    If both conditions are met, the payload will NOT be loaded. But this makes sense, as both checks just ensure that the payload is not larger than 0x206ffff.

    The bug is however, that the check that the check is done on a uint32_t (2^32 = 4294967296), but the max value that can be checked by a uint32 is 0xFDFDE7FF = 4294967295. So a value of 0xFDFDE7FF + 1 = 0xFDFDE800 = 4294967296, which is larger than the max value of a uint32. So if a payload of this size or more is used, which is much larger than the max requested value 0x206ffff, the check will pass and the payload will still be loaded.

    + +

    The size check in the Exynos 8890 BootROM

    +

    +

    Sending such large amounts of data can cause a memory overflow, and will cause the target to crash. Not interesting for exploitation in this context. However, the USB packages that are sent, are split into smaller packages with a size of 0xFFFE00.

    + +

    The max allowed chunk size, after which the payload is split.

    +

    +

    The dl_buf pointer is set to the amount it expects to write, instead to the amount that it has written. By transferring a large amount of data, without actually writing it (so in a package, send no data, but tell the target that you’re sending data with a length larger than 0xFDFDE800), will cause the pointer to move, without actually writing data.

    The trick then becomes, to get the pointer to an address we would like to exploit unto. Then we have a little less than 512 bytes (502 according to dldata) to write our payload.

    +cpp +false + + +

    Bug 2

    + +

    Might be a 0/N-day if exploitable

     +     +

    There is a bug(unpatched?) in receiving the last packet of the usb image:

    + +

    The bug is an integer underflow in the calculation of the remaining size of the image.

    +

    diff --git a/documentation/_build/confluence/BootROM_8890/03_exploit_boot_chain.conf b/documentation/_build/confluence/BootROM_8890/03_exploit_boot_chain.conf new file mode 100644 index 0000000..9878293 --- /dev/null +++ b/documentation/_build/confluence/BootROM_8890/03_exploit_boot_chain.conf @@ -0,0 +1,281 @@ +

    This part describes the boot chain of the Exynos 8890 SoC.

    +

    This is all still under development and will change.

     +     +

    General overview

    +

    Memory layout

    +

    Keep this overview in mind when reading through the boot chain exploit.

    Approach

    +

    In our initial approach, we were manually booting all stages from the debugger, and jumping directly back to the debugger (without using the USB protocol). This was done to keep the debugger alive throughout the boot chain, but this became very difficult after BL31, as the MMU didn’t allow us to read/write to most spaces, cutting off our access to BL31 during boot at some point. And losing our debugger interface in the process.

    This is also why there is some ghost code within the project. We were trying to keep the debugger alive throughout the boot chain, but this was not easily feasible.

    Boot stages

    +

    Get the correct payloads for the bootROM stages from samsung firmware files, or from Exynos8890 usbdl-recovery images/firmwares.

    bootrom stages +

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

    File

    Strings output

    Likely boot stage?

    sboot.bin.1.bin

    Exynos BL1

    BL1

    sboot.bin.2.bin

    BL31 %s

    BL31

    sboot.bin.3.bin

    Unsure. Contains strings like: TOP_DIV_ACLK_MFC_600 and APOLLO_DIV_APOLLO_RUN_MONITOR

    BL2?

    sboot.bin.4.bin

    Contains more textual information, and references to post BL2 boot, and android information

    Kernel boot/BL33?

    +

    Gupje

    + +

    Gupje is the debugger we’ll be loading onto the device and will be moving around throughout the bootchain.

     +     +

    Gupje needs to be built and loaded onto the device. Throughout the exploit, we’ve been moving the debugger to different spaces in memory on the device. This was necessary as the space we initially used, was in the way of the space used for BL31 or BL2. After BL31, we lost access to the debugger, as BL2 was overwriting our last available space. At some point we moved the debugger to 0x11200000, as we saw that this space was used by BL31. Here below the most important arguments to build the debugger. This space is executable when the MMU is off.

    Here the linksript.txt file.

    +bash +false + + +

    And the symbols.ld file.

    +bash +false +ROM + +}]]> + +

    Debuggers

    +

    After initial exploitation the goal was to fully boot the device. We’re now moving into the next phase: 1) loading a debugger 2) and then to continue booting the device. If we manage to keep access to the debugger throughout the boot, this gives us room to exploit the device. But, the debugger needs to be kept ‘alive’ through the boot chain. The main difficulties here are the location of the debugger in memory (as it gets overwritten) and the MMU being enabled after BL31.

    Initial debugger

    +

    The initial debugger is written to 0x2069000, with debugger_stack and _storage at 0x0206b000 and 0x0206d000 respectively.

    After the initial loading of the debugger, the processor state reported is (using ghidra assistant):

    +bash +false + + +

    LR/X30 being the line register. This is the address the processor will jump to when the function is done (important to keep track off).

    Second debugger

    +

    After a cache flush, the debugger seems to be cleared as well, so the debugger is relocated to 0x20c0000, with _stack and _storage now at 0x20c2000 and 0x20c4000 respectively. This is done by running:

    +python +false + + +

    The processor state reported then is:

    +bash +false + + +

    Final debugger

    +

    We searched for quite some time for a space which was both writeable and executable. After BL31, most space became unreachable, with the MMU not allowing read/write at most spaces. We tried putting the debugger in the GPU cache, and tried some other spaces visible in the dtsi files, but eventually we found a space at 0x11200000. This space is executable when the MMU is off. With the MMU on, we can read/write but not execute here.

    Python part

    +

    Python code to setup the debugger.

    +python +false + + +

    Stage 1 - Initial exploit

    +

    Frederic created a payload called ‘Exynos8890dump_bootrom’, which used the usb dwc3 protocol (USB Synopsys DesignWare USB 3.0), to read and dump the bootrom. This payload was slightly modified, to keep the USB connection alive (stage1.bin). Frederic’s C code was implemented in python.

    +python +false += xfer_buffer_start and current_offset < xfer_buffer_start: + break + self.send_empty_transfer() + current_offset += CHUNK_SIZE + cnt += 1 + if current_offset > 0x100000000: + current_offset = current_offset - 0x100000000 #reset 32 byte integer + print(f"{cnt} {hex(current_offset)}") + + remaining = (TARGET_OFFSETS[self.target][1] - current_offset) + assert remaining != 0, "Invalid remaining, needs to be > 0 in order to overwrite with the last packet" + if remaining > BLOCK_SIZE: + self.send_empty_transfer() + # Send last transfer, TODO who aligns this ROM?? + current_offset += ((remaining // BLOCK_SIZE) * BLOCK_SIZE) + cnt += 1 + print(f"{cnt} {hex(current_offset)}") + + # Build ROP chain. + rop_chain = (b"\x00" * (ram_size - 6)) + p64(TARGET_OFFSETS[self.target][0]) + (b"\x00" * 2) + transferred = ctypes.c_int(0) + res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, rop_chain, len(rop_chain), ctypes.byref(transferred), 0) + assert res == 0, "Error sending ROP chain" + return]]> + +

    After this exploitation, we’re able to send custom payloads. The first payload that is sent, sets up the debugger. In order to run the debugger, a small amount of the bootROM was reversed in order to implement send/recv functionality.

    @EljakimHerrewijnen: what send/recv did you reverse? What code from the bootROM did you reverse?

    Stage 2 - BL1

    +

    Here, in order, the patches we applied to get BL1 to boot:

    + +

    Boot chain

    +

    +
      +
    • +

      Overwrite the USB return address pointer (0x02020f60) to jump back to the debugger. self.cd.memwrite_region(0x02020f60, p64(DEBUGGER_ADDR))

      • +
    • +

      Set link register to debugger and jump into the boot USB (0x000064e0) function. self.cd.arch_dbg.state.LR = DEBUGGER_ADDR and then self.cd.restore_stack_and_jump(0x000064e0)

      • +
    • +

      Now we can send the BL1 binary to the device. self.send_normal_stage(open("../S7/g930f_latest/g930f_sboot.bin.1.bin", "rb").read()). At this point, we retain access to the debugger.

      • +
    • +

      To patch the authentication, we set X0 and X1 to 1, then again set the link register to the debugger, and jump into the authentication function at 0x00012848. self.cd.arch_dbg.state.X0 = 1 and self.cd.arch_dbg.state.X1 = 1 and self.cd.arch_dbg.state.LR = lr and then self.cd.restore_stack_and_jump(0x00012848)

      • +
    • +

      We flush the cache self.usb_write(b"FLSH") (Frederic did this as well).

      • +
    • +

      Now we hijack the USB download function to jump back to the debugger. self.cd.memwrite_region(0x020200dc, p32(DEBUGGER_ADDR)) and self.cd.memwrite_region(0x02021880, self.cd.arch_dbg.sc.branch_absolute(DEBUGGER_ADDR, branch_ins="br"))

      • +
    • +

      And finally, we again restore our link register to the debugger, and jump into BL1 self.cd.restore_stack_and_jump(0x000002c0)

      • +
    +

    + +

    Overview of the initial boot function in the Exynos 8890.

    +

    +

    At this point, after loading and executing BL1, the device returns to the debugger. Normally, the device would boot into BL1, and would then wait for the next boot stage to be sent over USB. But because we hijacked the USB return address pointer, the device returns to the debugger.

    Regarding auth_bl1: Initially we thought that 0x0 indicated a verified boot state (as is plausible when reading the decompiled code in Ghidra). But after modifying BL1 in the header and contents, this value did not change.

    +

    git commit 8cb5f2e1 fully boots, you can use this commit to patch BL1 only.

     +     +

    Stage 3 - BL31

    +

    Initial boot through BL31

    +

    Next up is BL31, which is loaded by BL1. BL31 is written at 0x02024000 with the entry point at 0x02024010, it ends at 0x02048000. BL31 is the secure monitor. The monitor uses memory that is also being used by the debugger, so we will have to relocate it to keep code exeuction.

    + +

    Example of BL31 using memory from the initial debugger.

    +

    +

    BL31 also configures the VBAR_EL3 and MMU so the memory mapping will probably change after this stage (preparation for trustzone?). Here we decided to move the debugger to 0x02048000, as this space is still accessible after BL31, but this space will get overwritten by BL2.

    At this point we switched our approach to booting the device, as we were unable to keep the debugger alive throughout the boot chain. We now boot the device normally, and then try to get our debugger after booting each stage. Because of this, we didn’t need to modify a lot after BL1. Essentially all we did was:

      +
    • +

      Set the link register to the debugger: self.cd.arch_dbg.state.LR = DEBUGGER_ADDR

      • +
    • +

      Jump into our hijacked USB function: self.cd.restore_stack_and_jump(hijacked_fun)

      • +
    • +

      Send BL31: self.send_normal_stage(open("../S7/g930f_latest/g930f_sboot.bin.2.bin", "rb").read())

      • +
    • +

      Continue a function that BL1 called via the USB: self.cd.restore_stack_and_jump(0x2022948)

      • +
    • +

      Jump into BL31: self.cd.restore_stack_and_jump(0x02024010)

      • +
    +

    This boot process restores us to the debugger, but after this, we’re unable to access most memory spaces. Notably, we tried getting access to the TTBR0_EL3. But something prohibits us reading there. We weren’t able to find any executable space that was still available, for after BL2. BL2 would overwrite our debugger at this point.

    Patching BL31

    +

    While looking for flags which were used for the MMU, we found a function at 0x020244e8 which we were able to turn off, but which still allowed a full boot into recovery. The MMU however stated to being disabled.

      +
    • +

      get special registers: self.cd.arch_dbg.fetch_special_regs()

      • +
    • +

      MMU state: self.cd.arch_dbg.state.R_SCTLR_EL3.mmu

      • +
    +

    + +

    Function patheable that turns off MMU, but keeps boot intact.

    +

    +

    Additionally we found a space at 0x11207010, while looking for bit flags in ghidra, which seemed to be a memory read/write space. This space was not executable, unless the MMU was turned off. We used this space to store our debugger, then before booting BL31, we patched the if-statement above to disable the MMU. And booted.

      +
    • +

      Patch if-statement to not be met: self.cd.memwrite_region(0x020244e8, struct.pack('>I', 0x1f0c00f1))

      • +
    • +

      Jump into BL31: self.cd.restore_stack_and_jump(0x02024010)

      • +
    +

    Stage 4 - BL2

    +

    This is our current progress. BL2 has booted, and shows the VBAR’s for EL1.

    +bash +false + + +

    Stage 5 - BL33

    +

    The last stage before the kernel boots.

    + +

    Boot chain with EL3 and EL1 areas

    +

    diff --git a/documentation/_build/confluence/BootROM_8890/04_notes.conf b/documentation/_build/confluence/BootROM_8890/04_notes.conf new file mode 100644 index 0000000..0f01e17 --- /dev/null +++ b/documentation/_build/confluence/BootROM_8890/04_notes.conf @@ -0,0 +1,143 @@ +

    General notes on interesting/peculiar things found on the S7 USB recovery boot process

    Emulator

    +

    What is interesting about the ROM is that it starts by checking MPIDR_EL1 register and doing a conditional branch to 0x20e0000.

    +bash +false + + Reset XREF[1]: Entry Point(*) +00000000 bb 00 38 d5 mrs x27,mpidr_el1 +00000004 7b 0f 78 92 and x27,x27,#0xf00 +00000008 7f 03 00 f1 cmp x27,#0x0 +0000000c 41 00 00 54 b.ne LAB_00000014 +00000010 fc 7f 83 14 b LAB_020e0000]]> + +

    BL1 peculiarities

    +

    At this point, we assumed that the authentication was succesful, and the bootROM would jump back to the debugger after loading, but this was not the case. After running this function, we were able to send a single packet, but never received a response. Indicating that the function we were executing never returned on us.

    + +

    BL1 authentication

    +

    +

    If authentication at auth_bl1 is succesful, the returns a value from a function at 1230c. This function does some things, but eventually jumps to a function at:

    + +

    BL1 authentication

    +

    +

    After authentication the bootROM jumps to this function at, we can execute this function with the debugger.

    +python +false + + +

    BL1 is loaded at the download buffer and self copies to 0x02022000 and resumes execution there, with a size of 0x2000 (0x02022000 to 0x02024000).

    However, this does not result in a jump back to the debugger. But the ROM still allows receival of one data package from the USB host (this is likely the system ‘waiting’ to receive the bootloader).

    By adding the IMEM to ghidra, we can have a look at what is going here. After having modified the LR to jump back to the debugger and jumping into auth_bl1 at 0x00012848 we jump back to the debugger. Jumping into BL1 at 2c0 does not return us to the debugger. Here we need to hijack 020200dc and 02021880 we’re able to boot into BL1. We store the address of the hijacked function, to restore it later for a proper boot flow.

    +python +false + + +

    Authentication of BL1 seems to be done at 0x0012848. With return value ‘0’ expected when this function is executed, to execute other functions.

    + +

    BL1 authentication.

    +

    +

    purpose

    +

    bl1 interacts with several pheriperals, from the DTB these are:

    +bash +false +; + interrupts = <0 212 0>; + }; + + /* FSYS1 */ + pinctrl_6: pinctrl@15690000 { + compatible = "samsung,exynos8890-pinctrl"; + reg = <0x0 0x15690000 0x1000>; + interrupts = <0 202 0>; + }; + +/* PERIC1 */ + pinctrl_9: pinctrl@14CC0000 { + compatible = "samsung,exynos8890-pinctrl"; + reg = <0x0 0x14CC0000 0x1000>; + interrupts = <0 460 0>; + }; + +pmu_system_controller: system-controller@105C0000 { + compatible = "samsung,exynos8890-pmu", "syscon"; + reg = <0x0 0x105C0000 0x10000>; + }; + +rtc@10070000 { + compatible = "samsung,s3c6410-rtc"; + reg = <0x0 0x10070000 0x100>; + interrupts = <0 73 0>, <0 74 0>; + clocks = <&clock 157>; + clock-names = "gate_rtc"; + };]]> + +

    Probably the only thing it does is set some clocks and prepare for BL31.

    The reason for this is the following code in bl1:

    +cpp +false + + +

    This code uses a predefined ROM function(I was looking for it) and jumps back to that function when it’s done. This function is at address 0x020200e8, looking in our IMEM dump we can see where in the ROM this points to:

    +cpp +false + + +

    Replacing this function with our debugger makes us jump back:

    +python +false + + +

    However this does not fully run bl1, so we will have to dig a bit deeper to see the puropose and when to jump back to the debugger.

    Week 35 - 2024

    +

    After booting BL31, the MMU seems to be set up, and we’re unable to do get any data off of spaces we’re not ‘allowed’ to access. Patching the if-statement at 0x020244e8, disables the bit that says that the MMU is setup, but booting into recovery is possible (meaning the MMU is setup). Additionally, the memory at 0x02035600 is still not dumpable. At 0x02048000 is still accessible.

    Weird space found at 0x105c2400. Seems to contain references to usb buffer (about 48-64 bytes). Also space at 0x020307f0, but I lose access to this after booting

    +python +false + + +

    Week 36 - 2024

    +

    Interesting links: - Heap overflow - UART on S8

    By accident found space at 0x11207010. Seems to be a memory read/write space. Not executable however, unless the MMU is turned off.

    We can use this space to store our debugger, and patch the boot process. After loading BL2, we’re now indeed loading VBAR’s for EL1.

    bl31 MMU is 0x0 (0x1=enabled, 0x0=disabled) TTBR0_EL3: 0xbc4640892f1460, TTBR1_EL2: 0x854d39cb76f0, TTBR0_EL1: 0xa5c20f408c581142 VBAR_EL3: 0x18800, VBAR_EL2: 0x0, VBAR_EL1: 0x0 TCR_EL3: 0x0, TCR_EL2: 0x80800000, TCR_EL1: 0x0 SCTLR_EL3: 0xc5183a, SCTLR_EL2: 0x30c5083a, SCTLR_EL1: 0xc5083a MAIR_EL3: 0x44e048e000098aa4, MAIR_EL2: 0x9e42bf572931240b, MAIR_EL1: 0x44e048e000098aa4 Current EL: 0xc

    Jumped to 0x11207010 and back

    bL2 [+] Sent stage Connected device! 0x4e8 0x1234 MMU is 0x0 (0x1=enabled, 0x0=disabled) TTBR0_EL3: 0xbc4640892f1460, TTBR1_EL2: 0x854d39cb76f0, TTBR0_EL1: 0xa5c20f408c581142 VBAR_EL3: 0x2031800, VBAR_EL2: 0x0, VBAR_EL1: 0x2053800 TCR_EL3: 0x0, TCR_EL2: 0x80800000, TCR_EL1: 0x0 SCTLR_EL3: 0xc5183a, SCTLR_EL2: 0x30c5083a, SCTLR_EL1: 0x30c5083a MAIR_EL3: 0x44e048e000098aa4, MAIR_EL2: 0x9e42bf572931240b, MAIR_EL1: 0x44e048e000098aa4 Current EL: 0xc

    The debugger at 0x11200000 can only dump 0x768 at a time (its space related. Before BL31 this is also an issue.).

    There’s an odd space at 0x14kk. With things like deadcafe:

    +python +false + + diff --git a/documentation/_build/confluence/_static/drawio.css b/documentation/_build/confluence/_static/drawio.css new file mode 100644 index 0000000..5e555eb --- /dev/null +++ b/documentation/_build/confluence/_static/drawio.css @@ -0,0 +1,8 @@ +img.drawio { + border: 0; + max-width: 100%; +} + +object.drawio { + max-width: 100%; +} \ No newline at end of file diff --git a/documentation/_build/confluence/index.conf b/documentation/_build/confluence/index.conf new file mode 100644 index 0000000..ec08608 --- /dev/null +++ b/documentation/_build/confluence/index.conf @@ -0,0 +1,111 @@ +

    Documentation on Samsung devices, currently mainly the Samsung S7. Here we’re exploiting the Exynos 8890, which is present on both the Samsung S7 and the MIB3 High (VAG).

    BootROMs:

    +
      +
    • + + +Start/Home +
        +
      • + + +Protections +
        • +
      • + + +Samsung Firmware +
        • +
      • + + +Memory Layout +
        • +
      • + + +Download protocol +
        • +
      +
      • +
    • + + +Frederic’s Exploit +
        +
      • + + +USB Stack in BootROM +
        • +
      +
      • +
    • + + +Exploit boot chain +
        +
      • + + +General overview +
        • +
      • + + +Debuggers +
        • +
      • + + +Stage 1 - Initial exploit +
        • +
      • + + +Stage 2 - BL1 +
        • +
      • + + +Stage 3 - BL31 +
        • +
      • + + +Stage 4 - BL2 +
        • +
      • + + +Stage 5 - BL33 +
        • +
      +
      • +
    • + + +Notes +
        +
      • + + +Emulator +
        • +
      • + + +BL1 peculiarities +
        • +
      • + + +Week 35 - 2024 +
        • +
      • + + +Week 36 - 2024 +
        • +
      +
      • +
    diff --git a/documentation/_build/confluence/objects.inv b/documentation/_build/confluence/objects.inv new file mode 100644 index 0000000000000000000000000000000000000000..014961fa54b86e0336821b185a951fcdeaaae8aa GIT binary patch literal 313 zcmY#Z2rkIT%&Sny%qvUHE6FdaR47X=D$dN$Q!wIERtPA{&q_@$u~G<5%q=d>OIHXs z2a1M4R9Gnh*&!LJ3Pq{8iJ5sRsYMF;X$mD7nZ*ienK`KnKsq@;x1cDsxHvUMp|m&? zsJ|*FGf9uD;?~sjzI;sv0;~^gm(Q4L{nVeur-!qXO)Nu+JtHf6Vds{Xu+*2Pd*-QM zT&0t8{9Wp#?|XfemfF237IEE}Y^@h0wOwk;GH)$TpV*9olT&J+zDc{pBYbvg#Oyg2 zr%JaLO0X|vZ+&@l<(ipO|4fv#+S;>ens95x^*O5YXW8v?>W_W?7qH={QM2Oy=NCWL zx-U5t(^Hpn@o|E{4~6ErmO??srnCAI(yPS8r<5+f%_p)WOgzv@@DR% +
    Exploit
    Stage1
    Debugger
    ROM USB Download
    Debugger

    Stage1

    There is not enough space to load the full debugger in one transaction, so the first stage only configures USB receive and downloads the debugger

    Debugger

    The debugger hijacks the USB return function and lets the ROM download the next stage. Authenticates it and jumps to it. This allows patching BL1 after authentication
    Jump BL1

    USB Hijack

    Before jumping in BL1 the ROM function for downloading the next stage is also hijacked, giving us code execution after BL1 is loaded
    Debugger
     \ No newline at end of file diff --git a/documentation/_build/confluence/svgs/f058c2f596741fd06339c24e16eb4f45fad7676c43c34240d2094962cb034211.svg b/documentation/_build/confluence/svgs/f058c2f596741fd06339c24e16eb4f45fad7676c43c34240d2094962cb034211.svg new file mode 100644 index 0000000..a4b15b8 --- /dev/null +++ b/documentation/_build/confluence/svgs/f058c2f596741fd06339c24e16eb4f45fad7676c43c34240d2094962cb034211.svg @@ -0,0 +1,2 @@ + +
    uint32_t unk
    uint32_t data_size
    data[]
    uint16_t footer
     \ No newline at end of file diff --git a/documentation/exynos_exploit_chain.odg b/documentation/exynos_exploit_chain.odg index 01205f5e58c06d12a50de34fda44ec1a4ab7f566..bf5756e0c4c8195ddc90f95e5093f3623d969357 100644 GIT binary patch delta 29683 zcmbTcb8uk6w>28uwmH$n*2K1LClfm-wmGqF+jcUsoe3tk-~8@(Z`G~uulL@mQ>WLd zwY&RN*XgcRYwx}T(9K6sL`4~J2n-Mq7!VL`P38nddGP-<`mFz_Ax&sT`)`y4*u%m9 zuh2wL_Wv-6prlEN4ha97N%{%O`9Dtrp=|uO=liChSP~x6+C8k`S?Uxxv@vv+#Yn63Jx>}d0zdtK&F7S>1H`nO~$ZZFyjI*U#j$&te)&dxg z*`04@yynzKrhBg@&a&d)t@AkYV7~@tGc;b}KsN?|Y_1`Z_o^#pZ-KFI&Ql%vwWI$yX}iE>~>)|Z{S$Q zNl%DLU*F);Lw|4{SluW&jJ<@{Jxd#x0EnV#*{RzYLC5&^YqG4(tZR{8^B*$5%Mgi4 zB{BS1AV=OuGd$cLcDV~GPpBhbTogBMR%FFVZ3##5=-d0v8y!`wFvQ0EsAj#gN^4@T z-R218H+h?`wsA>NQm7Wis_%8>PXly!*61ca(siO_9Wx0A$3F zijW8p!<$iX5cSiwfPTXfgZTIkRK%qHC7B}-v--jurK-w){MU$glZ(wnguXD?fx3Q- z_n+*~{Nq|T)KL$?Fp40-OOfger92uQqH2OZSwCD5ntp130qQa$ zY*55qSjf92nrKlX%7j8S64Y{4I3x+`^Cx_zGHZyb%wOL_377Jy<7f#kzz969RU;x! z(!K5LeP)9)}RoEi_gY*MQwG8=dj#3AH7=^QkC#0I*r z2M$Ho7mkGXxg|StKx{ekHrZuxk1XH@q-?SSp>e}p7jZ^wz3IcFO&c>^!#q2vno82C0n@A6uZ(N5k$axPk0J4IhXZC*F* zgBb=sSed&;@Cce5^$QD)pxO`jVe}8Wv91}YeH*J1{i-dvTsyr6cS&^nvo353y1c1H za}5QoGd`mhy!s&o&>TTNfk7vAi^&Wh;FBF<%zz!%V5dnlWEG3gCpL<+JHt(x8$f1A zNs0i8j^WtiqJm{qwOjLRMID9}gN}@*T7mt+^!YHQ zKWJe3#~{MofX*$el@K}X@fLRuOym|j4^?D5*R6>`>8{7fVOM^NP57-HUl!FO-ng+5S)MbR!2$2zLm( zy*Fr~p9>u*H~YfthVo>xot?YlG}7O*^1fpk%>?&VNuV?2!;@mJQeAtrSEyLeONNs1 z)6=1i`ab<{c2l>NLq$61O%ju8zSD~=O11n^l5GKKuzcf1k#N)AxYSRPSCv)NCR!nEjH(ISUq*kqHSemo$>kKOZYDmRr|y@ zLVVq+oMo*owSO}smIm;y+bokSK*~L|sBntZqS%hZ(bCuz+-u5Jn;7;l^efJyHWTn) z0w-$f9z&$2OOkZ-loGt(DP`cu&}Ir*`_r_({EyP9W#bp<_#PE){Glx;Ga1NV(_89hDW~bsxQ{O@y6#C!>Cu zBLF5k&)6L`aHt66mi)D~8IE;`)Fw#FfLq?TPX~=xIO)v80=(`*$7c|5zt?y3gY?B5 zRkD=a$J3t{aP{_fYzjowy-oATzjH^zkUI%N2mf|?&l^tLeb|v=otakt&a=Nr?B^C2 zEOU+*ep+JtHl;@e`AEk#^wi+w= z;?CHA<{W*!ccrZ?>dhIU)=n~6TB&q)P&iuL8_nOiEu_>^FIVsqm=2Ylx|Q3w^c zNv5yo`X)~l5!}PR0}bok|7j}e5;BSwZ31pe%;$9s`XKfufRoPq5;t&ycjy;*`%Ioru8Wqeqw06n0nmf1+({ILkym z3j1Ln^*^?qUa9`94?sij{Am$Hf#JoRNkocGPBe}Q3rnBi@!0U9QEX}mceG31 zF6(?qp;mj;(yD#fkFr6md655um8yS--PrZYq$mRogI0R>1_ciSvML4w@_*Df3=GVF z)VCJMe_cs&h}ghZ;=Xul&rYf0_Z(PWW6%$hVC#;K!VSBt;MVo?pYB)kQ*vQKuwx7q z;%I8S(7!e!Rx^EjJrk#sgX2*G-~EdqC?(oxlc`mxXTP{#1}ixy)9LsVNnCucdWu~R zQ$@QH9C)`6dmdgE;x2^Gr_TZJqqxzT@XfVPOJ;KYMIzuuUsRBCeFOd~QGMs>N@sy4 zW5>1gGs|OqA(mLSqk=wj>(HC-!o+jtZ%;E!7w-;S_VrAoIYn2LxO>(4E5AFwCS3u} z_Am?;@?iSGEmEH$?Mx##q1j2|`}aHlV2tlXIqq#fx$l~V-xmv_p%fGpvZ)zzzDf-` ztEveT%oYJX5e2XfH+NwbYpX4(l@_wfkCXUP!76Y1(s^48a~(g`u{4WwFQ&nyQKiJiAoM^&4J-*M$A8jJ&33`8}7Ku zQ3!eKay%rA>QqZ_x6;2~yIIt|^r)_gd&6v;$I`ne%W-J82YYuQc$}*#cpE%maH;-W z-epD8>bf$ngT!?vys~NbXZf<802pmN1Uc^Cs!>)(L8vZywNE=n0Ki8g}!YkCuHL| z^MP^Q;jQjtCV4fo1k;P_#4j)AMv$23b~_Z%;AtV0;eyNJZY7n?gGV<355;s=>6CJo zkv>g>cWqiechyab#&c_gHo@Cz8eI-=vSV=?T&YEK9V3z%cMm=FJ?DR!e!U90pT9lv zF6-0`n$I(F-FZ!7e;O40W0(ldQ2w1F$W9?#Voe&+yA6(let8S{ z;Ns^}-7(?bid(@VfVK}1Z0vH*7Y`$F-Wvg73fP?WJG?5@gmP4JDY^n)6;2PH!s?|# znaE5t(|V}mQZ3{x1(6Uq`z!_a-#r)H&1V$h z1ZdI-=&$>IUlZS(2dwD6%BFJ^oe!C4)OyNp)1K~m-`)$5dfq1puR!W%%iAPM*Kht`w%^?k>gi3|T&*UuR)U^KaL9lNsxkty(`eV&A#FQ+{7HY8>H(`e88t>8hNjJP2{rBm(*N+z4-|Bqj@5zZ&sm9+UXMHjg2N2iiQAk^< z;x}hSRf`u^9$1u?=e@YbK~5;TnEbo)?Z;Xs4MP&-qHmLI_PQV6=_bzn zvI`z+iz3{vrW3Cx!QRs)wa#xGce+>%CfnedD~#1FiI5|d$0j=B+zW-DfG>cIT7Jk9nr!6|XsGgm^MQLV?DJ0`Qda&A%Pp@CeCk|B&gsZ2Lkzc_M*HA>oHcFMiQ4E;*@juEr?`H$SfA#9B4 zZwME{4GQFyc8eRpDsdMp*R0*{^;hvyW}Z~)*Xo4jUk?sShg8~YD1qW{Nx#PaXpK8| z^dUaNY|gaE?n1@)r9>%8XqPmVxZlZF=|*#}pO3bGO=sRZu^(9m4qF}Ag)JO;NyhN^ zVI>S}4n!$^`t0%LW^w%G3DC=x_KV72s=$t=)BxS};7)r4%1!f7*_e(c1ybnA{f|TT zpA;zZ2SQA`^3%%m{y?)%Zk3s1XzKsUVwS|JPjtj0)rq*X{VFGXQeaTPpr?^EE`M)l zcOr`fVFhV#eTxd$3a_Hiu!&@lU_*Q#HqBUck8)rD7pr{1l8u%h7JnxMwSTnyXxYCX zEH`Up)uf~cR`*R&3YGhu`8QRpKbH?E`SsA0I#)iW!I%UN)8lR6ubLJAIW;r5(T##D zF=7x-Z5N>7^qJ%epZNkdm@?ESU<`!8Vlo&_k|c9?((mqk07Eknz%2 z;)$TXbScRonLqO}&Q;1Eonc0+Rtqa51?a6@ju$I|CM$+dk)7st3(e%oEj_wnTb=Oz z%Xf@#YTk@u`Gl{13WXIjo2t^#yQM1SJVP?nTJp>31~AzZ>?N$7M*6=wVp|=%T2DPD zT?b{>3My}`kED%~5L8zw?!;}C%RR2EIIK81G#rxl>4Z5l?Y8m!hTZ5W=FS@~bgC6hhrU@nRZc_LgEVXv0h0SXW0oq zf-;NZ{W##tv$y4x%K#2ID^4lm1E2eLC0>4j3qQn*)4Ft;Rr!SDf~}G$J3{o;757Zn z8PCR@t~NmmKeVTNqNnI-xXTZdDY8+=B=P8mg2Q4bY>~O8qMJ=3vADxJ6h!i3Ym)EX$t_b!WKRW1&S+{$~hkEXeu&&0KX<6S#>9}-u*qg z=_R?iS4yyzCG@bpZycvOk-0l4dY&gz$yhc(M+U0s$thZ?X$G|C9_c#d_5wOCA%p%; z&6OzRBf&`q&`rQ)#O)|w9EtU8vpdWd~GVr1yyLP?M5ZbgRahXZC zVq7ca=kO*_6u)9wHg}DuB5qk;3`;!#@UD@kvf7DU*t8hbsTTnX@YOEQ6Q(Ckhdcj= zWu02gOU)cGfSPp90d>)Pnrc_mb9SYrE=Ab4K!ilX>|`IjKcgR{sC@GYMS~k&J$}MMT>yg zPKGEe5C^aL`2fUyVVcK(ev3wX8W4vfaO!<{1qD5JNB1=i{m(55`W7yqZz)867dHRz zh4vZ+l<4n5@7)Z}7$nX87fGLx;i?4Kpa2@qV?IjokBxyg9^rr9ujS}f-kW4qSS&(4 zN2`ns{C?W~U4>JrhHi|iT$=7^b{le0{xNSw?4`{w4*!MH5_&g*v;?F#!?8dhE zQrI&*HS{9ujJCYk-i{D2bYv%Ml;7`a9I6Y+8&9`!Fm*v7aj~PgOW`?OF}tOO&`_Z7@5m5|j^uolqy~(Z&udo#dv3><{u>YMLO3=W?%PC6hXuI8x z8=%MnG^~iLI=_x6jJG2yKNl%Ok8<+^FqCP4xHBO=)_r z1s6KlQSl+g+cT_Wjjw)}!U?E55{I#J>|BJnEU{|g%gMW+P93GPF85vhZR5*(jTZxs5H0 zdS+}DxF%D;;K21OtPaOyu)#1@O~6DfUqH{WuMudc4eqkj(y>v~8fYRGw1DPu!InjA z)I=dkzj!_DdSu3j-*GXPB z2ko$AgpXu|n~9c#?oHL!QyDueWxZ^rM6Bwf!;;IIj!%lFcFE3-foyjQu)vkKa!Kt! zZI@99R|I}uKjz2p3`J6vl>+;-`byZKYvy_P5pbv!Iq&!DW@@B-B)L@bU(X8Q8In9fuYywq!hXL5bA=_K5{b=o z@@aph5-VdzFDfche=iJ(Kkl`MZZ?j8@c$VKwx0n}fP%NL`_~=jCp54R_jL;z$!5x% z*9WakKjvacg+Ld|c5@Q4KfkXOx&BAyy%Rys^krC7{cY|$p60A*kn9+VFl(^oXm3tL z?9_ihtjNyOY4E5)3v?BU-c&WDq{Pf_7##6qx$SxNTK4Pa3Uypig^$*o5@-F+T-Qr z@a(SnD%B&?)F=Da?`i8$E+B2R54ye(py`Y-9xmp*rDKvXgLyBo{doZ-p#gXBG(pFu z1VP7f!~hOkFS_a6J1RsFl;2`a`;0MuTl)+dvXASE7LH_5a3syo{60Ki{Cq2G#NK|C-=P_94_T&p>d%K-|} zbm@BaJ#i>6fPi2mc!!?ZGJ5;Ho;(QZ3=M97_(lt?@?YXlaB2`08txmM@hc7+usD?W z@-O)oI>0#=_e0<`xH-u=Hu}h7u7qq1*H8n2T}#z5bRP-SILuuSo0n2MZWSzY?|WeQ zByd8)2-lVXwyu^hGOuF-mk}sU`BQGOmbOgS{BWbzv`fMtK*6dOE`It#fkKc&S*HiZ z?Q9+3f&mpl_gO}R#X}X+fHXn{72PwB)9)V@3C0SO(5v|fzO=_on~y?Z92QGc!O1Ygj01jeD0kBri=;Z;&QY|Z$${+e0tjOhlU7wE2BDKx^TWcqXM?ff6)AwQ!Bqy2yRj+9;PzllA*X`8`LKQHI1NbyAPUmOL?37vj8H0;znN zXcjCnmpam;$&F$E5tYjZ8cz&rm-ohnUw>9t=ws5Xp0bh*w@7vsm`c zPH@ZP^ZsR!39MK=b!mRGnSHAHZ!%V~wsu8`S@~wGm#380Jhb>Ifo+lKR;Z%;uQUXc zP@-C&$|ami=%dWgFl`5&o}<|EO7E(I_4($H{VhR~;B~jXYlH?3rb-pUT1Q7Qm1q`? zSMBYydmbnGtV^9BAeM^wT8+R~sWyXwY_Y?l!n1iMnWJ>Y6UDXgg}VHK5<+rvPtL;J z1>?>I_IHhTpml#*kCR*X1OlmBmes35>?VGw6wLXP_lC z)hky-&+rKoQd;!`1p;c9^Y6;3>wP89MFzR66Kg@kX$-=Vz~=lCI9U+^+%cwlruUrx zIioyX4UJZDfqOK`csay&3&rVDVi9}-MKgKkpM)X{6bkj*g1}^-`Wj8HLMwt1Va{ARmgL|CbY<1WiN& z>~moFUe%6$zmVn4rbm+MfN#tR>i%eOmpGlgUxav3RUQb{0ER*!*D)*=AYxn1%#m%*lukzqP z9N54^J(;!$x+}z1dquSaJSn3zeD$C<&`$qjU`0a^hMP%)zEWF1H;uy=rL!j8tgwBz7mx_pO?ZM34m|~^sj8y$|WbKr}k4ni(ETyZ{J7#L5{|30H=l9 z50$L6_|=(@FHHF3&Yb=n7*$Q`8ycHGZXoTX2^eptmfo+OS6N@WdJ{mem7@CH!gdmBse?ymIn_oi;AP&cG_lg^)xZG!8O-V(8Dei!cO0vzdl!@%LK8R!R zP=FCfVOksC8!V0BC)SslGeg&BxXHRsVP;;a>Zk6DcD(3Rf zwC`dXT8Ryg3TZ@u;1eB2Fz+K<5+-0Ru*E7=3)r*yfsMpSnGv_EWOBLyB=Li3M?)o( z%RvQJqqRQl2DTt>U3QsjX-V8=REE>8Pe~wG8*XikNJPH7ErXCBR;XSLVPmgxLB+qa zeak4OewPT`DWT~_T*7V%^|`>@yY8`sqteg(CCC+qN`5;HNyghVUae7QZ(nN*PfEJT zI`R_!eM|@f|2hcFT@4KmSOLS{jjZXwK;>#5FZ<%6lGz$ybDf_ONkU=64xb%YtTKDv zvl5RsE`Sn666^9tVzK5tNFhXzFB*wncSEbl`ofwTydPVe! zyJ(*yjJGKd&CT(d3d^#0Wwb1uM=QK~t+Pszg!lBA^&xK$?shEzxZD;@r$BccH^1<~ z+nLNs^isz7L>BhNr;F@OoXWt1^!+okU{N=(32pw8+P1VKS3>lg6Lxu$-3COoNgR(E zn2~Ha-W+Z7UObxf_I3u4y?(f6K7>e8*<1+H?yee*sn?L*qFK2-i**RIBe>Xt%@RH; zSHKH?{*_v_!|lcgq#k9o7~(08P?&L`UQU~C4rWnto+n5A8-CB>NWBZgGG(ff$WefO zP-T*RZ~mdegC8UXo#GT>$Y^`$$5F_bpp9XUK4XdQDTKOUxGZ^vC9$SrOLq;^f+^;6 zD1&D$@pmo$c-06W4_!8zK8kuhDw~{=YL{P<^eeE@-XqZsK;lZh2P-Epl3=EKKX=aU z)m;yomTNM3YV{0ICo~tg{O5iF+mQDR zpDm)lz%-589dhi7~W14eUiV%>lw&PZ~C@dsN;$f^U& zcZ&Ui-*W1W5CbBCbs$oTePy+<$_W&VfZF-y$y;=DEX5qz91GgLn78>G>OVF zT1b=<280;p4#jVK@}aVAH}4!}3osc|Y<2UyBd{ub?-`R77nylgpj>h{*w(*9 z-gi&LZ~4GNH|`1?Y>cCNksUx%aL3Zn?P4PJDJ&Z>Ze3HMSA?rM91i||5O-uhXl0Ov zz5m?*$zjMjly@(ih?_)W>aA+fai?Mvd8AUYov_&C|4-TRzt11Qq1B;JF3C4>I%7aQk#U=m(LW|6t#7D^~ zz>h1>&twMzB7(0bO=PUcCaO*CW6mwBAc~_QPbX)`Y9fbksYT^tNiVCYA**GjXDX#? z=4z&;W~X4~W+R_ePbm%^tg9W|;2x9&N`;FM;YgqFLl>##6Y3$CL`x+G#D{V=xhcv0EKdSRVBHJ1TQLrF{BZ?QTNmc2?lfXKKKMu3SCc)P#obaQr)$j{4c;wj3z{{$@H4Jnu_}&m8+b(h660 zGKu)#?GZ^q8Lgy@q{O4yX7~MdXJ`&cjqlMAp|~gd6HJ*P%1a=EFHB8wVetXp1i5Nu z3H&(nX}&+66r&D~Xrpf1Q+H`>8JsbRwV$7YUpsdktwP2tWA>ylFxG(?IKpy@=;URv z|9_z|1pEJt@DBq23;(}>(Roz=X8x}s{=dUO|9`zBP!}QCnFBNa8v_3e|2JfEh`4;w zWRp`gsPFD|*LRD|>rpQ=;PFzDL0N3n@$f6_?Y92taILi0X}xSoIbW$YaKvBNZ5FWj z3d+-0t^HiSeK@z*>9JpuHa%Zql8D2kV-#f&fn>UN&e*$HE8rKsRK)ei#YLjA#P2Of$4*^n7kfkzfc(aid{pfJx{}PcRw*-J*Q0ca#%=Keo5792kQ$FA8-mzF ze_$;z3o?KyeQy`dklJ|$Jv^QCeyG5t@uN3rcUp475L#yFW$0uXtOPy$Jt+S1vyoQv z991BD+~C~EG$WrEvTq-~LW@-oYC~An0<9Y6L5l++i>e19S4Xgdljd7(V|J(z(EJk- zL;$+oR79eZw@)a8gIgAnxJlSh8h@`|rBBbC7cq|)Y=*zI5JDJPoK~UkD)iwD`ih>$ z1F9B77we(b!64+_YpWxrmAs=}(l$zTBf`lZ8Pl|zE!g#vt8OuZ{=0L*Fpk0? zPbnkCv(c1MzAm^pm#lMjmn9oFP|n6yDb8pNpH;T91{Uue4$>A9%H!5&yC0(zi~Rk< z&A&V2M_OR+GCns-;~WRi#I;|elnWQ=AI{7ae5?l(-baC+(*QY01;9$BKZ!So!J{G1 zaP)~|>t*p#ZX;K>+xaYAt{NQ+#{g=i6`HyxJHZTV)Bv)Arm4b`5)m^5zz?>)jo#MNN(H<1rjHxKJ26D=*XWO520wqp2?1AFV=wLDA}80YfM|cZ`7BrmJU;KlxH#!T=e@cJq0NHl^rEg}b@sQkEWQ)OQmVKVKvT})( zMQf3U?ndR0?jsR$E)Cw{n_UpeNP&S6CZgFlIRHhop^Pb8SW6wVxKpk?i0K-gVtf$_C3Y?PA{jn%V4Nf8|!>puYI^=XtLuQl`Mq z>usUEwe(S-{R3B(Z+~SQx>YbrBX{fbaNEFcv@bVZ10FnUt$ ztwFF(Z0_G!2}baJyf3b{k)%0;>7_b!fh3lxG6s5?T(xO@l^9-?KyzZgTQ6+ODO~va zc=s=S>0U3%K_c6J{Q)$trySta1>aVwl3(~^V)N#@eJ{)OIC>%1Un3PV%}_znQtEm? zKx8`@l4*b_zp8dQCFWRz?}Gzwl^aNMt7>? zcjIwiKVDSA=ZKX(3Dk9i6nlb*>kJ=f5RX zF9cQ|q35jogA9DV9)f86->uo#{R}V5Y#?#X=7xR6KDx-^2D`Rwujix6a_3YJHj^J2=78KQ$0X z-JVCi)(U*J0->I{OjvXr@=kgx1>NU0>;UD0{}+eMWjb`OpVO5?&gXQHg5XCVIB%}+ ztyHp49-7miMsH%k>8g;O4KLyxL#8l$ zRh6=Gob|Ttb!x&9GG|bkzZwC4jn1$;wz(}M<@~g=tfO|QQt;n*a6&$Ca>zfN0f>|~ z(#sg~V%;}KFKPvhZ4A+(ZKFqvOkN!@*HMxT{|7Vr%YU+=^{ zt*ko5Pp18i8^jyw8#EqX4~_0KbpB1f_f{>5L_#L&zuY&SCaqu;o@2$>0hTI6=-8z* z8Q0z-Fb?bR{F_20?NqA=pg@1=+G4&0;^jD5n_fvf>7GLvgz`uHV>&}L>TmgFv*t~aLau(X+Ov~t&gXHDpZ-j+B z$=(sUd94R)3fOl0EXmtFg`OXIf+K2Usf}GbLWS9yx$`glPRX@IqblYhpdn*cS(=hr zVSkwV`Nd@f2)4iGVyic{)@{peU4Z)E#vJ|{3;X+6Cp3so#AqJ?&|);kX*ojempQ}f zzm=W1*Bj+Ol~{$~5)csJPpz*$^Xl^h@AtdAbGwROCtbzZp(p}?IZH4w!_|H?^(+ID@LL>vZT1NR* z(ki5~$iJ~csJ~PX+vp{w36RG4tEH0Na6IVJLi?cz>PME?XAd}0W|n;o$< z1T#dMFE@(xy*k_h)&hIzNZ~WO;?!7BSe!X`et#jueUr%47GWQ4v78Z{Wew^Aay~H^x z&F{=6c*EAI_E(ToLh0jrC7cl15B>=SU5qp*u2!1UoFt1{%=&boBt`lC_TXLsEzKA3oEAhfv58(H zpBnvL?fYH&BiPg*x|WJ1_7lq9TZ#&2k+~m4wO_Cr?cLtQ+V56(v)IoLU`uwo8R!T# z{yF%Do?%S#31A(F+BjyXTphXA$M&T0(TYmi~F_uGE`wW!Ih7JQl#F4{=GBnD5T9J2p7GEU87L2s}BrAPNG9m0$P(d+z_}u4D56;g+o)bK7`EBEzbD7+IbW7J+ z7pc^H|Hh*gO&KbYAp!K4?BHcIu`oh0x>JY6_hmG>5hH~k4X&?`ds%d7g*kDxELdplmNz zr}JT<>}D&VzJ2@D+K0!;6;Ac=&@$bH#=iILMB>zVwLIL9%jX*fl|#6`c`N;9dA&|t z*In4q)y)|Y*Lzo(8%zH;BWs991WD=-*8T`Z6i7u^DaSVwM8^8IjU@arq3}W$MDusR zxOBHpQ`!IGU(S5t3c|vbh-hpClsuXsdJdziQMp984nonSRNOxMWiO7y;qy~LP3>dc zyy-D1WNB#LVM%9z#6Evklb$0AQbT=%8y6?~dvX6#*^lg%i2!ERlI-Rnw=;}g6ZM>{ z)+`u|C$Q$W7|w58mGH018v^t$1KqD(v$o3H%@S92!Q*700K4qy6U2M zl>6|}C`hiAm_t}~)aoE84b1~6_Lmt$oxQfu?C0dxJPoB*gBAO%@001<2%QmTCV;5%P3*vyJr z+UY)s{kkB=_L#n`!z?8vkqRm^)F^9;UTl6B?!&?i`3a7`B9?ABF)(!EJd#&B{5KLO z9mmY7i6;n;#cs!7TYoc0&p&<)MS-T0qNTg$M zdRMKWBy%^hqbXK{9YMQp^v8>(_67(P9#ci(pJF1k(*wMW(p-3<1VRh@nCFna4Zopc zp^dr2p51`l#t90wAX0jNA=bX{z;_l&{m{M&mf+qC+EfhFV2V?OOQI@s2BpyWVg45J z`JdwfN3cVr*7Y=2&d z^MIMPJBq4{?@AtwqWC!hKM3)01JXs0Ls}PD)_DU3aKjvv&;ZC=nAbdrqz?*pgY_wt zZLKe}gS1R8-v@0N{8oa`6%mQ;PpHku{g$}ao;$g=qg<2$yRVx}z{76iBk0QKz#V8c zv)xelocusp#{A}PJ-cmPMfaxtah;p}jj zB|6y`5t^zwx6fYW@T0aTqpZ^$MEF(*Z;Zn08f2YI{e+y{ftV;kLj32mqCoICYFDJb z3HjOua^pNXb3xx~pQJm18~G^_J~wr-iR1p#!o|>$FTm6eQS=$JyL2@zl#QWy0~IvT z^n)SiVyI@sNP4Cj?N0|q7Vc0?yNY}gYnwqH{1qH;{$M7?Z+uzEK2lZYf zX-fIbAiR8VUag&;_5G)@ywQQv6OG>sp_NrJ=%sc!JNE-s%4~w>%w65!+<5=uSfUVy z)@_6F#sU6yhpkQC=u`(ZGR;lUQ?ea1XonloGUJs|HblNn=ZBXW636cmPZpxkB4J_p z)(#-52~)Ts;5`unkO+y=WZ>Ey9YPhSW`j)A`C-r) zNfsV)fMki)3z><^Ck%%xo;9^bi<#V$t~^bG?&R-Rzm`9sDoK?SpQ8G%xGMM^OpP@~(R2g@vKg(eEufJR z1Jgumw*brC4;;Ux|ks`F`|GbC{9Y618g3Q~!QY@R`HDY@5sHCxE;7k)V1uHE$q-2gwk z-ifDxWZ}{#T6QAu)8V*;yg+o|vv(T$@z-&H?kfTzXT@-L^5Gf3x&fh4yPLNbJfF_& z5JL5_iQhNW``@Ekr+K4T%qq-LYs>KG1jURsh!Ah874o8Qp2#ztWsl%cnY;7jQsq+= zUBbxf9iL?ZD(9~18{CvbbiJwu@&A?Pb53tt!EJie^=GAcw^OV+%W&1ecS$s zs@PgHFnL;e#Qa;nrsu<5n@T`FCNcO~-artmpo@;xRSu!*=v5_u%APJYxlozP(jH{3 znxPDz(+TmaOFenq!y2^Idls)eP);Na%bWD0K*Ha?_Uso7nFadF22k1QmbvW%Ux_5P*KE2mk6}(f@3mt3v7Rn2x`B=13S*x|?_oQuJyr>8It@me3x3D_R zdeuV? z^Q(jRMjg`Ku22Nn0O4$=SHNKCN)}6u&CYgI5L%|)eOEO4Pf-Ze`)UL9BnZA zAR)J-?=B>TucSZ7h5!UUt3!`4i0Ry9@Px`x_*j2M3&dnLJ-u!}EkAR1j8c%L!ml?+`R*weC_}9)_I<9u*imdd!9GCPvbEd*#3Omun z)(ov_8GOG#le-Lc*E>_vj^mS+F=9fbro4U&NhdfW4PiVax8{(VmCMAU`wm|v1iDny zSk;0p$e(t1Jr8lLZ+qIi-|%{Dzc(jb|7l=vik7?Zu+n$(8d}f0o^_Y*n?OJyTi#k0 z@7U+hZ^P;}s)e{!ygoYI78xlgK+LW;_vZO4>hP+HQsemXREvToW=UCQJxY{#bF>e39o@*5n5E`2 z%)R)CTVtY1P}ptz&2Vq zJ-X$se>iqGiT$qB=z`rF@^0+y+$`K|cQjwlr+!>^VftNGcEJ?nP@rKMDwVDvh9b=> zpS}VDf{;8o3tM_sNrUFo6>$UOk_6_+F7%58)m3sH{^x7~$&{!&`0pjjPLi7_CcI__ z8M6m2BX-s}r=l>Z3w~cX5kbN|`2@JOf!{W}9mZulMl}{Oj5Ory1}Cc$QSBj-^CJqU zVKY&6n0YCV`Mqwj?loQK(uJDy_7m3bCj=|c6CHB9Rn3JOLKcmKHnrM&?kW51Kw7Cqj_QtJmg9sU65TA&sj}9TG#A#Yhx4t;hxp$*^9z-jk$rRRZFmZWWceo+?AS zUyjbgv`(C?`WCyEU~~<#?iO9PUO9RYGmRitL)xca6tl(+d^f0hiyJ8PyVX;J_6xjc z(w0WEK_cZg&`f>1*(8>|i*U8I%+QlLrQ`4ONRp^iFO$iRV28MiLf#TL zA&&JK!Mwioqq%E9X4xfiJf~{@geiYQm+h+T=-<-Ne5OH1PGh~;THeeNyJAPC;T@IO z899Q1St~c#;nU~w^SNiz^O7aUi%4PRwwmt?k@uPIpzrs+&tXWUKJJFyl>A^XtD54h zhviDLrTfc{V3lQ{p2{u!d1v%ln+i82+G&d?^FA-AtfFLDU%j>nvAb{7=g0i%dLZz! zws3#?O2Y&=hgGS8bD^zYTUuzg&_PnEF(=fLSGXUV8texC$PYq>_W6U99m@`*;#TJH zk*u=_5`_dTenSa_ucEs0r4voqzCuKc_CyXa$c%v?f-U0nTmRn0=u~8PtmVTDYk>?! z%Qq?jZHL~3KfUvrn@MY85l364T#U+Qt_`f4?NzUl;%fE=3~@O(_`Ba0K*D!uhpv*0-jzAtx@DcAJxWB%MycZx zBZe0e*Bk=%UeCE)5U$)CPAsC5JYxWiy6xqO59nxf1dtl&uZCS&>=yu4Z>Wl)b+E7WDowbcJTzl;66XF+r z8WK{dDHP|S5f5Pl(F zy&ksKB^0r1dmpEye6OQ^9A}P*VICSJit1c+Cyt7a>~uC6O(V1QxEaEQM{EDsk{u7F zU4)C(%2iz^ZqdY9b(dMpV-okHsO3)Yzt0naMgH_GMNK_};eXGw}=_^i3E+PPeII5FI(~dWbV9@4@o;95t=$J5D|C1>&A1L{jC>gbof?DTAz$!e6GN+T@~s(V1aJQ z3ZNiQy!bxi~&Rt+|k%81QZks~7z8AxoHmEJU&QWj4 z_p!8EYS~`3oMIWK_HYS;3Mmxp>%!qIKl_xc_I@#Yx>IDo9r?S`z;GPTq~08>Y@iF? z@tc#nvvQ|ldm|fs=k13`2tmW-*f3%X@PxXi10A0kQt(u>{-q)Pix8JTm1OGZq zJ{7t5KzZ=8@p-Hx3TkDfSWc@}sGFUerk3PE*oHBwf*0z3V4b3Z^4vXg2~sCgq`sFQ z1~;h3Pt56qR1Ue*Cc%N(6UWdBbEUJuuRV0N2sg+V@iBLIqvy~XBgXMTwB#<(PSC&8E&W1pr+vv453LC{4-gTIrhFlLUZ_2 zg%>~xG8_jp<)1&GwRhM;5C_<)`pT_&#E<%DPS`~at(mKgBsw-SY7JG7#WUGm_>1(| zWtn~%Qd0(|4TgkUe!@5D5LpUsrx4*W)v}f8u)`>R*l$A=PwJ8ISq|=3#VmRB=OT;d zqJ*p5hYh8u2(q%t!FsCGnct=x)tqc+Ft}wA=y&l>>8aL1C%H=}1WzOoaS~zj^xaE4 z@Il1aFAPX{8>O9^HW=w^YaiRg05q-k zrL)WALuB)uZ$&BtoT7Dydf8;~RXgyTu>N9I66!^0fPR~|?C=0{R8ePnHqx?%q8yJp z|Ji1*Ju5;Gg7Xt}>F7GI^xT~1RAY*uCj@0+Am+zkG0Xalx4*8xYVlL*x+na_YCW(I z`Kq^Iua4)UH0NA0h{@iBI{yG&j8*g7@vb4ya6cL0Ykf0Mk(;R&YY*{-ESXS7s(c4Vl)U4rR5N3}na~>g^M*A)7iaH7R9rJgP!m}5-e0O)f z>M#~E?le0uHn+WO(c&mVM2bk6tvDS}jADOJ|C|hI0|&p#SKVTLEAe%u)VKP1B6t|g z$mP$AyvK5$!J6ulO-0>%^TU!j%p!i^tc?^4Ow< z=l*(e=Kf&vb==EhFSGH5lHC*F>MpV}dDlObkh|{P2A@p}3GL_d&D<_g+gQa_gK9@mCERtb|&cYHBm4!fRqpB)h`u?zP-~r>>Sw_Jt~@!0Cm^oISTI@3OAd&HVntGlnle@|pUgMzzf&wJ+|V+8+RVf=Sg=n7Gd>uaZPamh(e ziOpm?zbh3b!O+(W*?EaxTe7Vk=A(ykyIXb zZR|Z%aWT=^(c%qqN+7(l1fQ}Yi_yu;_wAumqKZj3NA{CN%8Zi_H!Pky=Fyvx%okcX zk3q@6c>iKc3azmZd9vDrjG4BSq5q(G+gh;oX53u$O~g}5aY@JH`!=HSE66x(Z>A)Y z->Szsw+9(%i~$AN=ujOEK9G(L6mbms0IW)bcHxjW;*iaguq#f5>r#gE8Xx1&IO590 z=0eq@F%Puq;cN;fu5(;8-b1%SO^5nhO~;m1y$Au_;OSnL;O{a5sUH(<1YL-4t9dD+ zVQ+`$U6|Ha%8I=|{mBdSk0WKsXPID6e-z16o?-DV!R;Az&0r#TB_{!NkkuwT{FQ)? z>RDUYM^2_NF}GUmX5D3;S)P)=5RUOHE(=W>lWdYg0~hN94AQIw)Mwj)7EUI2`mpZ= zNKpr2+r-kBf8u&RBf85#StwV{iCV!!vTm+MQ#n#3OrlYhd5Qs|c=O_fzi-I8jGf z-<&dsMiwUu8=;wC&e`}9{$Qn)n2hiv1J z|9Nc97^8Km=h@${kuW{IHDP;Z6MAN?N}}pIaOx#d-=254j-F0SF*~aSXHD}VMGWQn z30CB#TNxJaSvr!{7?jn{hn;7hn~NPhJq8%5{EC3&LLVQUZ>O5rgRmZLGOD)SHDnIY z-Nx`ku%)bCQp3?`81ZH_C$p|!JVVX|lU=Vfzajt1rAGvlz6A`LGN(K1(nUy=$-NAR|6&YJH5|No_Rgmt*%AxCS@H^S^v{&dL z@v~o==tz&06b7=EP7hDshRF(9O?}I$6oSNZ&_Tm+RkWN#c`kk}Bt3y8zs0F(PsY4M z;4%6RRQ&XOql*ffrbcEX$b*!%QFEf7$Kbrh$!*ynlJpLm@`}%I|NAYix13Kft2(VG z2jE&FT;4nl354IF5iuwNzlbUIogPUR3Wts%t@@ChwVD=E0sfY%8y-#~~3cS)>FHVV*&4#fSn0Ww;Ml zSX~g}sVFzRh9{vP;M3{di<6xhx8}099iT!>11Y->0_n8ocuNfP+Up0F)exU;sHim; zI!QdH#)kETUB`x9qhzgAH5H5K5)9=74}97k#+Oa4J7R&3)^Y|?Tfau?AFZzy&L3}PJL%&(l!_N@7OU>gN7~v(+D7Vs?0wa= zO4{3~znbT!D`T21YcAzbZZ%s9Nio6bCGPT8Y$l1~A*-O`!5CKYgoJTdO4?zSj;2i>-J{^{v zO1I}06tms=!a%q#UGXkI)ii;tFXt%npa?X-Z>_^4!<)(POryWcdJc88?4pTGR9aG$ zrUibm8pYlo7O{os#iI(G9U5Zh&MXvZy?Ab|74JS5p;*hK|3G#fU&FCxvnyf+^k4dk^m z>>|{s8&ixRqh>4~+b>CMwlXE*%TE~l)bB3D9RhC04y8>v)yvvX4x+V+Bx=jEQ5*X^ zXrhWsf2N zv1Tz6fkK7`j$#!+RetA#y*7d8cZHq;v)_fdF~9?$H+ARbc`SDVj&@HoaJU?&xH$dq zA-{Y5kjJW9+|;sDArL^X36H=b3z}C|Mj)RACLRFao>4+h^ndxfM(Dg$eDEkChnfe zxe#316DprqEW>t)n;BHy_|PP4m{8QUDcEQ%G+lxH>`!;-?&e1@n(EV>Lh>k|rwkh6auL z#?}$Wi_xO-Wu2D>NC2OGgvE%f?y_!(dRqbewnjewbPrgu77bL5WK5seVCsENEFZ6I zGp>|&q~uNvy*ILq06Th_O>|&(+op3!nShPde z@iZ*E)5B3!BO(>v?!=_Z#e;*pJD0s^6fc+FdotIUB8x+RJ(I3Vq9G98GqyxZLYNrX zUj_>rsEimuJ`s>Z19|}ZvB`JO$C}pbd8SdB6w=7$QHH6G)_J9yir- zuLi0IBoH3tc7|Rl9Y!0XBFQ{&hUR-$B0HP*dUrs&jcq>oXI3x!vXpNqW6{46%X3F# z(4)@}{98qsWKn;kpWt~C=SqG2fi$n7pBum%9c#Un&_&gmB z?nnaH`!c!)*2GIrZC4Llzq|k{v|| z2PUf-U3>y9D-yR=h}?OKDKb85VV*v0mnV?Ts}us;DT0@um0S%8#Cmc?sR+%(ZYgo8 zxwyBl)&391)-h9w7I)r+I*FBNLBybBoIOvUHsjzd;(;MTB10P+?;AGpx9Ns~UijPJ z@VOE(cmX{C7!^l z!(A~w+9t95RH-8$WIjdL@^IlYJ<7^A)@EPwJshH1EAKGYB*SPe-f`+0{d`8jyPZFG zS3{p%e(p!${TZ{xsFeyN3V*ga#{35Ql(ZIC2;bCHIE2R>#R~$Cf z)L>~9tn}9YEMId|q0zGn-;k`oj7RC0?H&Vs%=-B3Xcj~>pG_Eb$P6Co$BYkn>8(NW zaK|D`v93vq!7;-1FQWW3q~?Uqcp5Go==2lWu1DbTE4It8=Lek!*%nEJ6vGoJ&^au9`6#gN7ie|0^dV(kcmK-d)7(?14_`UA03mLeg)0=7LU zcId619W%#rT?b8X7G8m(Ha}HS{{Zfqs|%sva*oQMzXiXT;>0oUCrK!}>b#~8F&M=Q zTOiL&sL@a#mCmWUMpPg|9ateX2Jb~OU)!_91q+cwwT)ZG@P5>g|h5uiGBpmg>I_ioOj5jKX`5d9f@TLwVK!ALJy00Q z{Ik(@Ijs%jZl<>;@inqB=+Z}d0$9;!F9iNhRLxCM-G0@7aCMAyczeuSTRP-m9-Z<_ z*{*~5IA%Zsk!k+Ol_#)Xwup5P`KRmEj6h%mUCwkyz}%CHfh0JD@hAtvnP1$ddJ$IAVDvc$)F0=WW0N`#iyKjsmtJ142Z&9=3azGbhQ@>c!6BzKfWDO_AtFb?_Ji$VN8P=BRgSK*T@|p)hYze+B_Z@(QZK z(vIn0kUJb-`V*Xi&Yv^*vl9m=B8HECi@;8zY=*vrc)l^nH2kt~wuX^kd z)#^K3ixBXXXizP}eg8%e+1~{IbUXN6{>N|O!d2qE*j=G_7OQ7< zO>2HU3ZGB{nn2IZyfa$`FzS$tLVBeX9HMgI?wt4pL|y4o@w>px^KW@s(s(D}9-Yu* zE`d{xMv8OfJAE1O`^`$+UAg`Hcw^`7&yNbPSeceOIL$!^kd9d^QU_4j}Cf>&XOHH>oD11K6wpecmIuZ74LQMz)Wj2r3 z&lfS-RJ7i!8~{1dQv|X5$n%-x+U$bFv(Vq)P65`1r*p1o{^Y@e*?#xe=lU5AGUUEf zIHDlV0@&4D<4tcf_pxc{2v`+Zu>mJx)yk|Y*T!0kI{v4y$&lJgLd1sl7E0zI`uCNE1Kno_1g_AQ&{DdTGg1s zZ{BlGE;%?SnqLgOUa5{r^#gcOs-hLN#o!ocy44f!o{o$Cc<9pA{Nkqx>P`qYr3W)K z*SDa_E#Q!eUmpX+s`Z~-bHneG$qW3Dy?V0^I_&zxJ|I}ek59LZniSikzzXp(%?dq#ze>Go@3rgG z8&*5R4r81*g8A>MqrjYulcXK2OQ*T(TgFRTd);~~>L(mCv5amg?Z{j6qCCH5ZF(b+ z&cLX1iVFkjWOj0z$J_-KNY%IFi}U<+}>KIr~4wVxOk z8nw~`JYVI%*!MGF!_HTB`n;Yo&aeHNSEbSph8(gTlIe6ILd0Rbg6JdQzw&Gg=ouba zact8{(ET*VxUkUxDPoRB&MxRuE9(iTU6vqdep@@n^ko|=j#KDP+W#2 z1%okBGEs}ea`5w^%OmHr)JxQ|`NSmKDcK}Pus`)qF#V<>6L=bw{QK3-sac2DwDT@D zE7h~kb;hx~*ns#>)D9jE*=d%mvL+lsYh*QGVG2!=Mg*m4gHS3Nf(u{T{|SG_cP$%P zqjeNOIlXT)Y;^=iVW4Yq$Wa3+coA`3{`#DK0*#wAg=Q@UaHpE$?1JPgGRk>?w=;x} z=Z^?_s!nqMj_j@|PIx_F)UGt-Q$E#OL(G789F8%9-=I?U3P`Z>yVkqdY}fLr7l?Ue z=@~;1EwF9J4QhdkzaE6-;)CmgYnjz3??uW+T-I*ijO1ggn(e*P(3%7-E8V11m<)3E z96eOgt~ff?QE1JhsS<9J?VYT6JpR-T_Oo&vi*;6uIX)Mb4;Lw<4%j5pcq#uvA(_t5@(A!n!y{_W9PSJk}1 zOkR0zL^5R>g|MzPeZmGpDD%}ilmX3&>z9(#oHZT%>`kfOPD9EU%nKkEUdP0f{7V{1 zYc%%hw@Un&shyG@72wcb3Yj^ z=e^j)*VWf_p@4{T4ambrK`Dvbsnuru-a%lOjdCuTQ@1l@68HP)JZS zEX3|O+1ury$P0p)4@zvijcc6vv1o-@jf~Y@g*E_0p$N5reoKaMY#nzRAwgSQNpqaF z#dM*MDOv$>`~&0YnS;tt?>E3{W8daoJ=R~(2Yg}Ip-du!0#f#j)t@tF2VPyVKzP=x zG;Zkzn`PO<4P1N*BWq9cy~6?nZ34$X8v=wcKcQbLejd12TuH4-%kD5HvPK;ngg@?= zT1y1^C~0T7V}fsF)_9043^$EG{2n=X`eS)=0B!F|JId-OPtOm)E(iJtWHwU)kn+8F zz;eB>8TuBoJyn06cnGb|as=_crpkbbPX{0V@CFG9iqJ4kIW4NDlgBWT*ApF##E4t3 z(QJq%YNE>x(Ll8+R_yv5WtGY;8!Cw84C=@bUXxK_9V%TB@~GRl_$nYfVKf;7{$(g3s-Dq*)DBN5yxKqCPo1DkW0Y688+{%;N=Qwtb~| zzjU0zDh9`TrIzz^d0$dn4vP0(dzVF1Di5ja2(puMdakS$cf^9S4OFU=$=uILGxkMu zF8FQbvSptcbxvtPqJkO7Ou1T^|A8cQXtbdx=`bYhFWbS8>sT`;}$J* zytCbMur*!A)wXRTc2<8aGN@(a+C16YJcWXGw`Hx3Xl_?WWsGk>;r)gnqsOhx)M*P? zrok-5+nw9#_IzQd&el_@4ZFtz->~8i>H;Tb+sKp0UP$1N85>+0K)1-&Z}t%#3c5sM z?R?U|NdAFfe}KI=w2B8o@$4_@W}t`ZNw`54OUr<#5jkFN?wvu6w1zdV=ik|xMM0Kn zsaJbCFf_boJ{aH|%>5l#ubrqrC$LsNsG>mE9`7M?)KRs4{3J(-& zDq(?tAJ5hDT7P6k^heIwnlO#I{yiQ={zX%KKu}sal_#eR_VBs|?d=5Hdt%cX2pfVs z0Oj;d{83IKq#}MNgqFr$dLgfX&vNP?gKjM27DwU?(t@Ep{`{w+$9~#X3`K(T^Vp#8L@+nRhtJqyY4YP1+)JwRQ=Ql{q`{g6=ik&m-U#E>%n(C z%46A5Dy&_l+z`i^;!q4P#cJi1D)&~k($3(V@mZXwzfYLi+_~UBm6VgiU294d10>N1 zlTqir&Q}nzXI@Rlx7!&hamM2&-!x>UcM^zZ@wAmeJB{s@|gjGl1aVR*6jXn<3lOXp1iU`?-OV=$2ve#$y6>Uh+f^wl@( z;!xppOWl%oi%8NrMx}vKHJ@rQFMle_)I5&@R33;`RN$3GrDtp=Y3)Z$C{_rN75(<7 zZK!R2_sLUXyJd#VFEps!9Wk z>ch1BWjFt{M#V8=x!87(T)Wi%GS>FLYO~Z48obPruf!Yt%uu2FK46e|{;*N9bpT;& zJxIRE01Ipqw7@Na0#f>P%RM5Rn#N*IwUn0i5%^a_=axu%$6_k1qRdKUj0-#pUfp%H zV(kF1?aofrGD~q&W}9m2#mk{UfTwTIDlgO>OkkAvj&rYKro77JY$+>Gy0vl3@lBqr zPrjwm2lU$v2P+a6E51l6PFaPONptcT1jZw3k^Se|6&CJP>-j@*71j!1oY`tAUa94o z|Fz!*>F9EUU&Ws5WwICI1pLLLU@0)n} z`Bz0KQeJa9duFQ<2}aTY&#Nc@I!o77GsQoJtCv>OI{NAr!Iet7sSDnv9bomA(?|MH zUa@wz$~zK^iH=ks8K2B6h%lLQO~WoL+iR_IxI$zO+G0HBCF?Xrk%kyR4PC!+S|vSj zZ|iE$fUbtv_HJt~FOztkCIIxY#w{-t&RV6aT#DM$8Q}?VFMAz|k1JTrRZJ%uUlL}_ z%e2U_==Ib+a+QOHe|9oYLt8CaK@s{ilc5RD#6xo_er`>iu@Xg?s2mnDcP# zR0w6$+qfB3-fg*(b->h_y||T|aGm#XL_;le90+%)mEMt(m6zWi)x!zV@u@GrW>;O3 z7BygdJS#wOB-^P{A(OUnCkZA*XBPiX1sa-p!-mc+0Jxij7ka42RzD~bprcDaA{UDU z8~*rFAz4rNp?|SZ%wt46IeJO&W-oVhP;Jdz6=lc``UnL08O@DDM>Bmbs+#?g}{@w}Vz5cWB_tzI! zd)`sxW}3wN@l7e;W~C()khV78PVxT4t5KVjfpN$VzzjkfE*>*Jh6?c;vU(j+7EF^E zc6cmGDjc0K`Ip%AE}>P^R%jY}(&?`}z`ZYvju4RZ)=8x=VON7tks^7!D{A}l*Qxm+ zi(bW)HdWRwZC&SK8Lgvhxpc1g?Nm5R{GXN~WSK#ylY?YS=S{!c)gm?*EpLCTBYk?f z%)vuJx>VaW?BIVl)gG_27(hI3ZW2&@;RCkUd69i5i-&PH6>h3O-!uG&3dub+tGovS z0APatFDj(})V8UmvN4DFm)v8d?Z3n&<5cX3;x=sQ{^k3}rndVpTjD^kU{xJMCX6X>%?h0Flztf`FEPZ58a)AD`6-Az;}B) z7gIYI7I#}46$J=LYydXkzw~(io!ANa->Hg7;=0rwsr=KNJ9f^KWecfLd1oKv7CVj9E@e en$`B3ou!$n^MAe$%m*t~T$LjtEYXjDn*0y_fg7vR1_V0c9tP%tzgASfUp5^>B#czMwO7=70NZHN<_QT~T6|BI4<+5h860wzw@ z0!I4}COZOi{*P<&zg-8wJpcWQI9Uh; z1EMM7|9<#I<90*Eh?1t)zOS{%!xpWXV;W8S+KSlgnSK*r>;IZGeJU+h${f8yn+08q zgh)+~cb0>$B5oR^*Dgc+P=4E(V_xwba~~=Q6%<*Ur?(w$I({*s_h>sIm58<&Q)S7F zK9AOk!@L-k4yEWw^Q;1h9j1}~L_fsxKk{`D!i^(OTQ){WV-f6{)|XLIF}#mWHZftNbiJeALpB;tXg$9*jR_ht&PI) zfkT>U)3-zKedyh48OVNOy6Ay+1n$w;Nvi1ANm{#&`IqSe$o&W)Nf!IdWIo;}J9;)Js+%14py&IZXd@q`+b!nL~ zPBmDvd=e<-6Gj0@o3&cmh2XQjkeiH~LfTk_GuNq|Z$w z{*j!BV^ZObWEYt>TB{Hbor6S(-!amsGa)G~zpq{BkSL7tsvMAEiO@+?sNQLD)Qn4` z@Ao|K1ugn}yX}Ua)b(l|-qq}jcTaYk3yFM14@~W^Ok6?+2VXceIMOuC&vyzgbgtYCV$(X_~IYex~GhmWN(wV zlRA3FU<;-s6ap56zL7_|##CtE1eJ7Vz!Rf4!c1Sb~7lvlsG+c!G3`^-BcpudDXM<)@mX0_o zU4cZkQ6~dQfC}CVT`tcQX#oF42*Ip(_6PfrnPCmkcX-Qwa7gs_=F;(}!yyOF>lXoE z_Hg~#XKXi??1@rx{ouW)qrm&gNY8PKx!%eK9RE~zhWP0rgv((6@VnvN^mI4%SJV7j zcJS64pFn)}mM068=*P6&7p0s^%Xve~$o%MDMjRzP#H<8ndjAQk#;~(#XkED^^{Aljbo4F-2!3+Onwgz z!~(0#eXXhowvhf=#8wv}i18CbR~ZHKjLN7uUX@RNjn2n#e58~Oj?WU|{`HqPG1n)Y z3=DNz3yi}WP8uQF4+PcQ32_lv z=s1qvsgL4EX68bcaHcISsuSCez(T&XN*t9DKHr*@31~`XO}P{@BfCLToBpVr0(NPD zY^E`}RS%gtX+mwIRMqi`VjMhfsA=jUu);huq$jKVxJ3cfnsmel1_|)eJy~EV|9I4b zDX^pbLQq;nUmBgaz_t4w1fn@#V{`WzDJ$!spLE*9p z-1X#wViTLF=a;_*1%|$|cdw-N_%c;%2}82oIQco_?Y8xVHM8N#1OgN|D}2QEDe=k!r=Gsyhe%EX0~yI)M^jGj44)vmuPbErSLiG;9WI z_BZ%7G6VJ5HJHeh4ojY|k)~__ksJoobN))G)CuAOqzj6P-F7gOh}u9uR%$&ID+O2@ zN0udZF054_M<8XiS+24SH_Pssl~$4_27NMDO-o?IeDI;LaHxmDXqmjPB^izw1L$AK z9^&W*YEz@y!A9Gbl%081W}ij?`;~b}al{$}Ymcug8DjK`#tq>6t9AjtT9{5D#ZO)O zp9V%8nV(z$6%+i-71j3@&B69A190^B2#+N}pe3lh3y_ilZYWXDl z_;eHk#Xrl34?!7h`L{Qeuf2fER1yy1YX?&*3Wk?_C#07LCqrFTgS_G ze!3y9uB4*3B15=Rj3F@iSY6T^#P z(jHeCl^7d|ZC_lv8&fKp1jA+N<9IV;8Y?X)C&T?`KXo_mIqP{$1MtUZvyxr37Rk08 zhMLN*C`MDR+QhJbv0t$kxw*?=tG@E;E`l?5nW(xh1@F2qg^nIDm-6K9sI6J@IV!yXfC!iDWp*9xk4@6oxa z!L)&fxqO8mI|vELxLaK1#5Lf%rY2W@w=zKRNJF}`mUujHddSB9BKop&eQTPu;+mT6 zO2-*$bUsz^WT`JCaIqIvOSu9ctF*E6AZAVv!6augj6B!9(Y>L!}8mwX(e~ zz2EFO6V%Ndb=vf0Gt zv!;!F%`(Qwjc!luPitJJW(( zYCZonG-cQkgekU}`-ELqs^t_}){zzThx7?@yXt^r5t8mG|VLrruTMp2B{;GD!KbP#ZoYIv|r9qsx5t z(jLJAO!>;c2f)7NAmvd$J?*vT1;%d=__p#mzrs=Z@Ct^8?6)!tu_FZ-k1%PTBDMVV zeoK~pR4@L9rd5W*MnhcofbFNU9e{;hZUlV&MmBSMUrxgJ{_Q|W@VrrNX%V|uGN855 zUtd(Bc{n*JtA_vAju(w;LvyH&L&jlg`-3Kl=BKJ_^}{{dLayd{c$%K>>!i2m;i6Yj z1`sfKBI3E)>7rT0<)a zbd6B7{%A69<5K5LnQ5NJ@}c$I4NOe&AQaT3y`&WKS;(tP_3O#+UEgsIAbs(B5}7o+ z;qojhG9019Ct(jzFm6Wu8efIB5v8l7J=*{>FQUCZk`~;l8Hjua019Pr`YFIm7;m)s zu3WAvG(K3YNh+ZaPz%%?{FaiAA~FN!)Tm;S_+EB^)h{bo*6l{*{B#U=D(l#{&L7z2?!~1Fxtxw~kntS{^<*9fBMuoWQ=@ z+U}g|tfP)sDIM4E+@6v~gZpzFPE3!A+Vv|e^NFs(&LNo%Q1BbULUdDB_I_h{(xCyT z((AyXDiCfEt6@QQi8!(M*J$!42|k*BD3|lOr|fMCQW+7-CbAxrmDs>yQQ*Uxdi`br zEzbA%%|S8yXb-gAP$V{*dfY%sDC!5(0C8lJ>_&_8z9X`i>{LtG+Mw#XX9QVFvBmT> z)wvB5g)Z?d;JJ#^qs9V$sh-qjy%n7X)}=x>H>uFUjYg*i)@9lnSRGgUkHvAYoIT%` zPn)V|b)}h&#^f0If$4#O{8W#h(mKp2ALrY`l!LbRU8e(Opj` zi`U0Jv8O|~S2-Jvuh#AB-bZO$ipMZ7F6^FQk(brZXy>N$$++h}6rDue7xxg|4i=^j z!!0HbfZ13yq)3zj^|BJ=sh0krPHgx)JmdrJJTpDr#@fTdBc?CUQ7gE=96LX5*Kq!H zFJnl&Inb9-+t?7%c^fybuR|EwcOluJ16;_jWL5Q?eV{3rIR2hU)GG}!5zhKPidFL? z7Hz~$w+=_69@e~;%VvsI(bkAJ^E$@m0_oCpfW7J+(!`ep%0iqbgOj3L2xsrN+S}V7 zol4a^A~ISYzv$ZOz8v9h0vwD1pGD_2HiyN}6B1%qXrsugTwjsKURsj|(G-ugi~JLN zW6POe2}_kTMcT_+reQ9t6ZYZeVj2opB1frXPpmCTzq6;tNt|?NaZT|{+=h|5c;Zkn z0iz(xU_5bSm=)#NvyjI+B;BAl5p+PQwBkM9u&Yn6zcO|G3Ibs_HKLq`U(mqC}w zqA=KYM9O`nUhB-lTrmPKtkk0B)`^IK0rC!WQ&@_jsVKux%HZ=)Ti9HlyP?PEQruvM zt>;1NvQko=BE`tp6{<|+(jvi+e^?NCq3M<2n$%I+8@{%sq^PlD8i6!Ga;q-(};}B{DD2zoia8YdvwgCgtL#7?@TNn5PehLL7Rwb8iis)8s z0!U>WgN+@AX^qrD z*@^qYy_M1lPupG2EfcNsLHO2DK)A4vv#(K(afSVW>f-WXfb|uSHO)c0liD80a~vDF zht5l{4O8szL~kO#1m7}l{^hEAJHKl$c<&_}bGCLr<6^2qd{o@jR>y=PiRCQRY;CQ) zwX^BW*d8GxTP-qP*d14XCTZ7GH6%J?OY#b7?*3;_8X?5$zy+v!6x-B-508x|u z$8VNQxXf%X8}>1=@!(q&Q2V~1^FX$J(oL9$hg7?PvF)cKZiV|XGGKf*p)Oi$m%g1u zb8f%JuXOC_xy;dZlS!jJImVfG47%Ea<6);z@zZ9M$rmh3p%-A@4&R$u&0p#94$|t) zXt4RG^}L}&D$De}Q#h_3cMZs)NBJ!KZOJ|JhT^eZgUg+At0dGBfII0tAlE{o>xX)g zmPft4$ooO0z8ll-wq#-RQ|xj4yq%Kk`;LL%`sa_1R#dfyL;ISy)VR0b`%l2(B+jV^ z9B=jbDSpC!;J|ahnx_^lziM^=;6nY$b?e-{qtbc9iAk%{qhbAC!%1SR;-e7to7uGZ z%R(al`0qzLqC^L8!0=xg64r=!9gx4=Xbu+0i{Vy*a%m)$`5ozG+5u1=l4NZ3oWS5` zbd1mP7|?E@?=$A*5$)lo1c}48Gp&}D-7BF<*^Y8y<%^Cf{-SYNyA$4(2!eUp9DdOi zf582Eu$a|oyv?WSRS46YM{T^hfKMs>`<43i7mpmP&vO%v0fW#FdGBmr7V4U61tmJs zK#L@$27_AnEq}Xf0QN`j6;Obm*BJ z_E8a0MGK`Mlh?f8Tq5j$E3Sq^$ll@I39sTgVrZ0R&CBE*fRh-h<*JvHiO4`%9m) z#%wmRKRn>lTN3R9gBw5*oTLnJ^Nby3xj^^dkd$A;kdji0#iTY#MUwxSU0ji<5`1!z z;%?#+0&;=FuYH#ifA0p)kS5aS#SsEz9(h4IkN6j`#P2pdw{ouO=I~g;AZge?Lp|e+ z3yeL0oL)nPo^ua_H&(~I>_wZDUUB#2Uf@0f{N$c0^hI%ObhJhXG47Lr;%IXUp>(Kc zh&4#l2b1sAR@fa2@;on5!6OL4x-YP7-?{MN%oHYGGYW?zHw@s;}$4Ol8$e4y1 zYPCsxS}kHEuCjE4fsTvC(ba))4QlB!O^FO9d=7+@C(^VQuEC*EY1hGz()`@)!AnRK|siRP&Gn4UBKvCq;4;qy5(rRPlvRkbXtWM?Tk zKV1T)N|0a3E*_C(#rPyNNQ!D5Bs6uJjExxQN&N!dEk3fbjtvnY{Y}?UqxE+&ywvO1 z3PbRrJ*?=XFtO9{{7gz7XFS&yZ~!^Q9p&kru0hxp^4quH#RGui1;$^g5-cTb=luL%_@!h2L@fT)L$1O^JxPcr@htynpzfrvxIM({`|Al6;F8%ypJ5`{Y;Bs2eUwwhIWXG zWg&d_6m9t5#bMf&h3-ppD>h7PVlbjU;@#!Ot7Q^$=$#Op_7$2qq>hs>3(&Ja^kHP~ z??2tZvMC9Uiqx@vm_|cf?$HMx4^;8-Bfee>b-A74!fz8Oix$K)5 z1$VC9XI{V5>325I?sh)*@N%JQbHF6mNnYCPhD2ge10A@b%t_FsksZ~>l5Zi>d!tzZ z-=DoAx1m5|KMeWfv!APg0JOt{!OX6rOGOhNtHs_%;$yKlNXUu2nG!B$R60H10-$v| zf(3o;G%9|db(jPt2q~Vi?M@Aaka(`T&{fQc_^XZPJ9&C*p;mF0QDD7j%8Zu3x*0o) zMCY_lLD*W4m2P6u&v`(LxJm9Ae~^1XkS{0Ex7t6t?nJXXCt0QdNOlVy^v;+W#dt1e z9&^vA`=!wegn;$(M3q3JB>>T3|NGV#T!8WCgccZvThC@eLUp10g10Nl-)kJnE5IyC z$};j<`eI0p8(>y{ZNelqY8ci-ayjwOkTKB;Zn$+`_5U;q1F=sRdA1M={Bdc3_zZCC}v?^3V2CFX#aO1hXN)9D-LAvV?SLy*^72hel2>g8k7eq-=b1%b3 zJ4=;|Kno^1qoWVYC(d+Txj0{Dds6xW-bPUXitISGn5W{nz-k{Yv3v`>h~^c;2}4OW zg=8I%I)k#<{tw(f=%7Mkvo!f1ODr9q75FsEQz>3)$|L)lmL`!TJDCmZzWj`C->XL5 zBbotL%R4Q={Dup$YHEeScB@G!apdl765+>X?A#unYKv6~ND(k_I@t#Z=sHcAcUE8$CAvr-PIm-PuUJFD)d z12%?^D1Ylq;#Qa5(u1Ny_#u20T`UED_9s8VO%DYi!~uNX%8N1_WN%h#P$3*7Z)TV; zH`*%;1aZixD6%A$Cl2eW?z&PTy?4%S2A^BLW&M393vw`P19*9J{bg0*c4wE^X3czG zV=`;RWQsS(gn{|@K9P%-$oihXy~_;@JE7T3bk;lkd0~YcK9<&NRMZfH@wIzYY2d1) za|9%S{nVzrN|~onMboS#tvilloSX-JHqwJN`k`#v8FNvaHRYjchSJVTKVAIAHRpi{ zOgZ+UAA~I}p`JH*NpiXX(kLByq_NmykE@Cv(tA4q&9->d&-J^19%MYJ#`Rw0_5gg_u~ShA zuzAyB67+Bl8Jldvt2|C!8J8_h?_d&h6Cxc&hWlx>z>frdY!6YB@E)<=e>?wb6s_TO zPXCg0UH1TEuP^)WfWN-kCk)bi`UCl&)Px$3i;y@H5KvXz|DBou#!L<)BL-}6q516^ zBpP+FUSE-Mg*1gqpJgDT;)p=yLpuy83q{g-k#qNbe{{2u$w5;rjpXJY1IN(ky12Rd zxw&39I=IB+^C6d)?VV;GlG3^ewb3#iCqK&ep5pmW`_g_nQQX{?%S36m1xmIFsEXNG z79kYyY78Hn5f6EpS2P<;nFB%<-X5+J6OwIb8erCsf2JxB50-dm!ICh+l~vKXA0lY1 zTP-^TP|*QR;yAK&VHgYwH1Q33z_Od78lD0LG1y-4hcZP4Mo_)9TbBa0^}7AH=cXDd zW|ym9r!fzsn1nOtjm7KIXT66ag$eMr0-W17SAVk_(|_FAZP_;qjR2L08pO^?)cm7^ zE?6lu>Lyy>c*=5osHBjUi(yxMpcI(-RGHmk3g#-k`JZrQEU4x(LEZzid37h_LOA4=8zHU5es zzK5rnuuyvDMo)1lr~}p@K_nU6>ocZsJf~%UlZ%P`F+CvpQ+%0p5T^ZZ0`E@;MjB!9 z>otNp32ZkpsP@y7@C<(Wc5Cy!}ECH!Imf{Fz9Qv4sALVhoBu7m7s$XvP5c0rU za$tN(YXii-$Q5GIJg`FukG05_Lo^y~a5aPhPnA5&bzj|Nei48w2x1-MokA+N5kxQ2 z%Dx}c0>3?y<7chqB>9*|8%wP{Es08RxUVxR8Ra{Z-VfD2mcn3udV0^bk?_IxEBiO~ zmSoUw=~xfqGD=IBFTecYKD`pMY!^GTm!ms~#8D@#n6GcL4x`bwuEF{r5s|Xdm`4Vq zgg_{cJs)uUGA0084VZjCI=mV>FjxCP+2`WHoG0jQW@L9Kh!a#=#mK}Qc5jo~VVJ^oad_w}U z9+q6oxvP|}@%cUtk2c?_VV_0`g3ZvPA z`^J@4w+&zk;!Lr z`A6F_%7UNCs#cppb*emeE7n34z1+&0V?To<(FctQ-rUVCgeNN3*k&igP)BK~v!?w*N5B=)fSE199-_I{Oo z0Ig4X(l6PQ)g`bgTVEt^WH}~X?19Oq1@z{^@Df8nt9)5?eL{q9z)+cziu9E^)_c?@ zt{R{~f|48{B~uE6U&O0gO4gzQhG~SsfmhCV2E`5MOI37G6C=L z#VV8QNK)=oXPp`GC)PK^nYxQ%zW>AB%mG#ONa8J@fS396ptdS>eGQjx?#_Cl_w6R$ zE4&@`Q}F#iD|ZrJvxe83oZLq@&RXu0h;etDmbwYJxnbO!vU>5H(lpT1nQinED#c%06`R z6BvH>H#*{;n0{s)6}4cVsNb_+d&k{vsjBZU*KRalR@X>fw_Pu-!&-)9)y+q%A+TrI zj!whbj$6ap2(*hQtsSfzC6MU0hy&F5A;9ZYZ8tK0%D1~G(_-m7wygkvZIL7Ir2R&_KpK)7z4&Ej3@?a*E zbe~5(mm@BB64Qd2wFUC8^VK-d(#TM>s&dxDOsnvSDre3Q3z^%D?!OQC6cB|lvq<_C z?Fj`jL~+%A z5g6;SiD^^%nsduaisPusG0EAnIw;^+YErmb(90@n$ZA>Xno6shxtVFH*(q4L*~lex z(n+uc@c4)5YKJs*4x!*=*0~=lmh{^aLa}m5=Obu7kX1iY59hE z$|jf7i31WNd8%XClEPGDqYNX1eB%<#5~D0q!hJH*Eb@w+s*+WIXIi$FOEpxv3}v!U z|KaP))t-!Xo^FzxY<4*Akv!-#KubaZrhaxs~gfdF_VS(`x=aC!Og`f_=Ccl-SMaQXfH{jbvT^Yf!S(Le?S zBzz<-CamhYaor8@MP1E2%e}e2`O_@~(yh~J*WuCG4y!DV++KU`BbSOP(CUS{X|rg5 z&hFg`KfU8`zX`) zB`$-uCIMsr|HhC4ivP?2_|Fvo&Hv9BiL~@TWB)%8=|5j12W1sdh$x~0{ty1Y@cEg1 zn-?|m6zT#uO~uEY>>s>~d|lL6{>m!I(s3SCX-lY(2GSclje)k42Ry;e+kw`WTShEr8$VjN5fio2J`_o>gJwTDT+qgPBUq+|SoEr> z@yw_2{WqWos+P$YR<=Nxh<5e6Y@r(nqthAmTClJa+@f!($tbMY19a`@OtEa)!!1Dv zN?W~g`P4I87PdhQ@8PqtSoNR>WovinHjpl4Y{9sueaSmkx7bXXXlMWiGl)V3AaURc zVY+|XY0nTeiRH5KPfk2GiJ4Ai>kjc8HQarn3TQ{*x=UK`M9AC3yhJQ8gMhuxcFd$| zSF3fr8H;q9mh$H=1pKllwGMMOMME_i1L}lRfJ`v7Hl`wDq$dhdkBK`8-8-=+Qd#;tU~RWMi`qFj9YaGXJ^meIV?|B5C@g6hdV zIq}#Z2Vwj|%L#bYp=$>Z=pg5!2u!pyJn}TW+V;{ium4gjh?2cDi@2ujf~y0U?A0X+ zM@feb!^N)%<%JE?ONB+G4y}&KXV_6}D=OnQ4UWE5ME->?7+eM5>3DA_B68t(rrn{1 z?FZ%N&5ETS-iD6=xpmCMt@hs!J@|eW;7j`8PY5X8ua+RKlu=Tr+HC2M}^P7%9$d73Jr(+UC|#jtMjdG^_w=Bj@6UB`F) zIQ&U+h|`r{kxhCjhZ~#qxOpFrirv)cx;v)40l0tW9V_tt?Y^eXdwY1C%-6iX(#Y#| zTIyD+YB!fzIeCbduN**AbgBQCMDWQESE$9?nfY_FKZwGt7z=WOZvT7mr+_j zzwq~Jf4AcP++-g6s24mvpfd_|`n~7H&i=g~d@UZ#v}A`7ftWQru%~31$L2T=n4@WP ziDa9&(47(6kb`9*yh1v#PeAJ;9)&DQ=u}bqAuQI` z9)5_O6|4vNy+>#KWu3LpFR#wSqu6;5d|xX2nUsRc$@^95k_ktb84=Fu2R&SaS(1EU;A^gaSjwPF8C z5f_YWpH8C6JS+lxq`PWrx0}mBkemlc8>5^yrl21;hSN8d?aoZeb#7+X%@)%NOcxI9 z80K+|Rswu8ejhw~e!eR$oo8LVyu751m+8z&!~NYLo{H`j>BZ*tp&4^(Ck6_r7PbuH z+tdKqyS9qjv_xKLd!+@5rliZ%rQ(gM4iuWNX<5mN+Gx;@x%o_~rxh`r^Y_uH)HUY2 z;2Mem&6ytYn-?R1Xw!oow_-e7e4jXcAMBFO8PGR;pLn{}WZ2drU(!ODevSmGbbtBG z_O>|<_XNn?xdQ^(aTynNs!xJrlTpLt*! ztVk`4;3KPoLCiaMCK|toemgTS5r`mrrnFFDT6OE(t#$(0p()1X{g%T+UG~`qnS3PZ zze3TBdsU&L>TNFjIe0Yqf;-{QqE~mo3h$8Z^nT82fbIkE!`xyb_O{_+pIZ>_H2wvg zGV*o$4M*<+%!eOm0k@&~n8}O`KkqLF^u5eWUf|#-TmuZAB*RkJ$A~aVbTWq_+7We( zhg7@5aZ|&v7kiJ>B|F_N7i5memy*I*r*P!P<^R`y=`(PxNHt%0k5+f1e z(eSOE?tSGkZObeZQ}3B@V0&`dm~$oDm9_ikRuC@uNtFfyHy=aa2wiSdJmer%ugT3G z(x2WB>%jN0KF{8d$lkxJ$5MdU{I^NWUXN8hTK&J1lrMh|X7kq{kHcTDgvTv@9zywd ze-K$=jd%>cL}e(w`?Q6o`)WFGK9B|$dk~~qfi62i@Zpb-KLCXwe5s(Jv-eg|Qw~i? zZrbF3GEFi5Z65Ff2*MQV=>xMZZw~bOEVNa+N(Du*IDC1Fn)YjSNc0$r+m3P z7nt^MFg5EH#y}7&NdeycpfsEqG7+EsAVEZNKegv@)tN`5k>uaF@=$CnEGz=5vAZz> zO3B*dr}w}|6PAQ*$R&W6O~Pcqex<=JQ!8ln2AG0|wh3H~bhraA-`{YWvn5VeKB+Yz zHkcjW#sL}Z%D2wAEm_ckV6Fgc2r{pJKXoA|cDyREq{P?@le$d^BuB&MM&lLN@k!8d zq+V7f1s!|)mJH1Of#glp=b#jw1+IPX1{%9?M-?VSv(}*!LkU14xmE-X%G8)&Kioq> ztS@WBNujwbV*;A)Qi`0Ys{+@}>@TL!o3Sye1$-x4SThFWj);b&g8+NA@jHSFLLZ&Yg)QVsO8-?28mCV=#xJFCLaxy%wUH;oe`2#K!{+|Fp0ciYSkGa4Jc5p-_-+pySqnQawVDwc!oXfEE{H@<+-ER2qP!MneG0t8&bJT49(;wYmQX zukW3t?$-N^30L#Gg+`?CAKZulxoh1x)R-Ee;oq7&Mz6t(@(`N8rGC%baT4>&o58QR z-XxtnBV?h<@xdFdL5cOY7Zc9q290K1+OIrXse}l|n|P~;dgg~-G>j*0N+|sWj*5Oa zt1+lA!+-+Nudu;$N1n(b*OCvIW6M7&Mnc)Zb7NPM_YWYH0+&g&e5)5ROx$t`hQV_D zL~zF2`Jd91Imk9hWs;#4i2b%zo}rp|{gvv&nqJ&qMmCB%b{Nqzj;$0G<@d#euErBY zbrm^SmXq+?^;a4;XoslC35CCKf3-iVpL6Zei8eWaJLyuUq(p$6C1;{#IKgV7zYIkf ziL||ht{Agvc;3a&Y8mkuD}`)0zDk}hQF+nN$#YWa$Mx}KH| zeeVT8io}EYKvhhzYmE?@wN;$9vD3VENwb=<>&xlGgX?|wcPrp28Me`f64NZ#NK*9{ zgG?q&97t_u5eaiG0?Ev&k&-h3I9tdIXXd^dXb_P@e)(6RAOcGadlM4$| z)}A;#g9JKG7e@%HSy=j2K{AizBQ!3e^3-`>g?~Yf_31gDJ59%RDWaxlP2|C>HYU); z?$=dmHsR;G0^o;=;v4l%^35dYt#rM6DG_|94hb9t)5E;pA{$fF15FVG72U}$J=F!^ zz3tZ~!fA5~l-$yZ3Ng3N05nb;A`EB6br^ebC_xO0g>A))1p(V1fL7fUr1%3==wBM} z0r|t0emq%0H9~3XvO_D)peYMq=<-t8dtmHnRKPG+EcmwIaf3U5@pJD~Ilz!1G~`MsJYxuR11=qY zDi?xBzF_>?qr7{CdiKk{{Ve77qFi;IM}6SUnbQ{Y+c12IW@s%XwT=;HICA+7sl~r) zvp}j7<2(o?*wv?08UIyPuxzlQ+qAsfecL1W6Ru_L<}ehdb5rPuJp|q7H(?0U> zt7+RrwrZh(bF$%^)I@zcP8T8Q9Y$}`L`|8_(b+3|%mzd?e{>pj-0}(vL+8-@Tgcls z=cpXRA!sQ=#rfLQ%ca5Q+MtfprH~vrlH{VBI5WZ&8;J=gx{|;P!k48YTim{q&g=x0 z?f392RVFLW-lW<~UVw6e;VA=9Uixi$NJpuyCArwsaNoX^~CsXq45mG3NssAFPACt(Uyq zZkn{i6n}Z-$iPjO!#Stz#=!SJ?f?@6CW@{c1w8hz1cxIC_FRvxh;F{*d;Xn^tls<}?(+1U%non$ z^?kcXy|r8a*;%op)c0yMsJ3-nkJ0Ty$+3T+5Sh07;8m)0ptu0!N$-He^nND2n=;-A z;YuE*9)-5X=_WAh_MM1&A(}Jnk$u1$P~r7z)Dc*j3ZY;w_(}ifOcmenywE_AE?P!C zetO1lp8|n;c7UuF;D&aS5L(BDgGO~#reQPIAkRpRK8=<`VL;fM*m7ze_wrp2RS?ga z+fNPA&BuqS?@9oOjn=G{>QqwVBGK@{8Kz4XZgGdpAZeBAIA??)s2dvX02SRvf+Pd` zN6Vn(h=}sSc-hX__uGf-m7C8S#b9Br;REfL<)1(OnKq0l+~5Jlu&D`zcDjBNS-4Ph zQxIHr`BQ&Wj*W|Ck{-^xiye|CJW`H1^~J};t2K8{1=$WDPIGz3HawacOy!6>&f-x* zc(=z3p+Yk>hi9t`5=IQTh2Yj=UD`r-91ehi^OcrYNtlO#|6cCYSbEMmFW=<9rj)1VM9c7yEBl#= zDC#O`7(TagoBeXDY*`g(cUo3qZCTEL==*DK9=)Bc7@f@rGNlqQOxi#4pscOluuvEw zm>N0mtD&c81HQtE_ z`=uA)I{-PaCMNSUtT4}`dt)>kE~k^-`s%5`p&x7N-n)A>s|c9u8qD0Vqr1ub6~Whf z6`?E7iZ2quWA*vUzro@*B2hvz^jg~2Uh@9Fbmod{@$u;95<5ZAizvNQN`}HsO%VO~ zbNlH}27Z?fXLG+yO!F#Mlj~c#>zG1k?t20tJYFRY%w&JIA5fqEsLOlC7Y*V%KRD`% z_`+ExpPh)wcf79Jw16i)DKT@+Itn-CRJsWJy#!)Zs^<`^qQpNo*SB!atmR|Uny$W@ zSMKNiS~D`zK?!(QosH6K_OY??xzk=%aphNZKE2WFd|6q3;Zxph>vS5e(c|sy@j(X& z0QfX_VNAoGBPcCyTfA zwPO`I{lBJmIz~!g1+-S%DqHL!c~k(pKHeAJ-gn=${1zAPt9f2;-y@RhOVtAj(UYdt z-$O`(7rM=PkrBqsiEUBYB+)lV*QxaKh0C$=wzW38%WbcTxt;FzzNX8Ji8lvsr!~mc z_P)**+cmNO*2?iMWB2bO&W#=}Zf}pr@Xf}E+N#S-5d!wP<&dBNT{tP|su%$5c9?C7 z_x=@Y)mnLaU(?@r-5$9BCq9lAoUsRle|0(zE--^$?8ldGGXE0Q8QDi&>J@tKS`FVs z;z;>J-NsFU6h_6J^Jb$HbA2Z-FHfTBAlU-PN22ytVingTKKI7UtwhX;s|J{|xCJO;1Hvsq}{4+qzm+9=wZaH2_|N`QjLJQL+Go$;Z$ z6R>I4`DWhD4o;N;{w-%0`*LtQatOeF2#ScP3bmQLFX4pUC7A z$U^CkdQH#1cMeHYh+xcA$4(;9OI`{42%&DTXf&x=*ihK&pCVHagaLrVbWapK&#UoDPYg7h=)cGg_-Qw(8a2(K?N7A%~f)lo8s^?P#z5}XhYG+D56@~K5jzE!$b>0HDCeCoVpWEp$+Sf+SzGA00&4Lkvj@6E%?@nvk|!%gQ;*fd zLqs@n(OFVOxd5hj&Mc*nk!1uraOv|3I`0L*9=t`o)V+Z+Y`_9>#x7_>gQ>zhNucU$ zbG|%|k^3cKjYN<)bk#TQ#NxRl&-1&K6P3cH^c$xQT4nN-n_fWNBk!mXHR&rV-A1GY zbp4j-c6_&-do!*Sc|4yxk+ad`d6Aksta`%XBhEaC+v#gyqFX8o6T=jBOdiRnwO2S0Rw)Yh?`o!jO77OE7 zN7u2Dt-!L<>Scx1<-9GYlc|{wz1a9E%}Sr*HNgBH72jW59bEYHIEt}CD3rFZQDO1` z3?|F_Hkh*Tr;%>~W(ZYt6{g8D*;geE*<*+gPd_tmkC~2yX7AIujqPTOnJd4W^1O{q z8+HZ>0yy_kZj6a`0VI!(K?)1Ph?PzB^>y$A`vON>vT(>>&t>l7Y8^sD4yS8v(c`Kc z|2kSZ;T9^2b?)d)t7~k0Z_3r$bZ-;STjjaf8!hkUv-?eJnmcM*+*hMIN^LIP`Ce1? z8XJ~Zt6`LC{V&48qCVJsh(={P;s+Kz{7$q7(+lD5XK!)b(jjkW_NTq%VKvzMKmGKg zQ`A0}I%jjg@$Q9cs+Y}g+<+9)S3jT4c>yrvtkZb6^PFG>N^s!#BUHt;h$Ks1{Kp}p zG3Bg4z--IK33z2Iio6QU?r{d|Gu>d*Lf{@<>bJh8j3la`vp$67;yR}6@_FUg<(0gV zE2kGbR6ELRtN-GR-YbOsYVKD1VeCjpY1AcqCB#4tQ9AE74h)A_2?t)1j-C@u5+H2f zJH2#=WL#Zh`xph40$9*#JQ83W6jpdhaQ>JP>umF*XPEydM6r7P`ULn z_SBuYr_-Zn{&B0uLY-Zp`E?)P$0J64@c?H#mp6Z-)8uxCCqJlj3rW^!ABu24L^=#xK$=OL&i^tH7Lh*S~`+Uh~C zw9eOVZtZI?ec6{T6Fd(rgRKYiF>k?X$9Chzwb5YT`8m1?w|U($Sp65h0Nc&Yp4GVZ z2yV@t*7=*E@>>S2Ha^=m-Mk*lEBwz}qzX4xn}I9msex^GXk=P@V)juW_`2=*zysO&geS)2kM$RdnlJkZNPgC zQ3S8;|59~ls#Pp?pluTx04(<^B*rw}ERr}>xnTFcq5|g8_TU_0DW$IFT+zTk&n=lF zM=f-q=dmzj5od=5n+#lU{vA5`_4h^aLH3C0?x3J;rcIAq+#L~F2;d|^`R8!955*3L zQMoTb)@9VT?r%T|R*vPFme0*a;(U^kTiH}iRZhb`X4Lo7?(54lP;=6xZTX z+?^t&rTE6(-C?7FLV@B=aWC%fR@`ml?i(*`pwPnI&$;J)-*d;f_uI{v%&g3njI5Q+ zjI7N6Z|&fUnEFowq9-c3Nra)Rf67>oDMLA=BHpCOcnZ}YYs(E^_0GeBNOi=j%W8eCoTu=g5p9-i91l<*c+;1kdaPl1vhF^s||NQ#; zf?@+e5n}3$0WZzKTvIut5|=t(!RofAUgBE^gNf23KVReq7GDuXJ|E?-Z_<;7bhT{m zkBgX6vx%4j`6Pd$EUmH5g(yW-Kmt)*e84rc+CRUvAq2;4W#6I*Du^H?-M87mfO|gd3aI*P(Md>c% zEhFgx^yWWTmkx?W26o{V2RiGf56;Qqof?GylKnaT=Gfp*0uyE z9UOMcDGD44u%i~5_!q;QLLW_td?gKD$62nf$VKr20bQ!GQ7Epm=izx;NiUvlV54E` zRfh{qJf6M>*13~A`p9mj3zw$G<^gMcH?NR1LNiB){hDpB`uf?1m=ex7&+WFj3r#AZwYj##u>U&98w-8)cT?@8rZ-pU5J|+=FFU3; z7ddO!id}M_OGi1AojzI)2|RyP^5b6fOs>*jW~E2K{9OL{i3EAiwMLw9LQvdU1We}Y zSgH1!JW9_P!oiPXFv(>9x*vytwZ8)|GIYO0=Ct0&c`XJ%Ut*g$&;-3sJcc+2a0k0o zb0q5gqH?O1=W4O*anPbr#gh&4ULt&R<}GRi?r+4`fBNxydUZ>RU%y%4`%;xdcg2CVGG{}gQ5wvvEa_Dx#N~l}MqdqTW=gtwZ z2BaA6YFa3&GlKfKcu$E~gjn$al1|LRAcXc9Bu4~dR1sdUM+6nN6faix(H#5f1j0|` zW`elvG835_>l{wpc|Dop6VM6dmW%9-qf)P$l&S#ZWJD@du3-!Ns++A7Pz;yOJ2Iog zp1=Wal$*>YzYJ^G->L09EgxH7%Zde)&K7RSGOl-uCngssMjS{h-OLB*b-TBN_AXU)_j9YsN&28HEmas1U_&zPq;3$M%uE?X;2B-dy-NGccFZ!a_?fJn0) zwLzr2uHNpu;2GlmIPL(z!Yz#kpp$Lw5EOwK17Ze7&Pw$93cPKk=J?94?y9D$+mXRX zuedxdM*!FSeORW+3*+@k4O5Gz{y7G`pQuh)5u=zMhcC9=5lJ|Mqj<3L19gZ?oW2@G zGqN6EzMPaU&g<*o%v2{>%f`8)cgj1@lyF+W^q+tgBqnDXfpvk-c1QWCwCqEu=Qi4j zhY0CO_WP&74Mw{=h`5e^%C6JI;3-s5Pd>Qf;eZrkCIPuKHFK|;KG>TFbQ zOL?fMu`Jk|Fc+IFOh)Xw0aiXrU4X zT-xDA$!hyf&J6nUBZlJQ zZSHP1p|6+d-Moar`TgOb!B6B?ddgu&+i{Z&%_u4HCC1iMlHw)fRPx)OH4Sf2xqpLsw-qAt_3%|%&Rp}S$&V7J9i{|7aYE1B z6r}CdSGN6ES$Aki9>_0}f>-7;F+VD69exf^dv(a zPHKjfAR!JasYUEBaLMs6Df--hY;>`U;fW$MxdK8JFUkGZ2hb4@Z|gHpDs-m2gI-%s zBqIb?M30sFoN)1kT%eg`qY@>f$q9SSAk$LgjLSSAJiYX+??GTacMCIhAKt$aMgHSn zvT52`ApnGvX(&dGo!X~NfKl#hg88wz`El|NdMpNKUs;tzMj=oi<(ioIEwB}|n3-&# zi~}!7y-LoT$k?*JO!bI zzI3idIQo^2)qS zAL*O@T^Pr$}@kiC=Z&-leLEmx^uEfK(vK)tzFMAVh ze|5%M-1yOtQnW6L?`E)$Me07hj~Q-pb;6}S1&OE^!pBND?LoUX{a@aT6=6N&P3d<1 zMz?;nmf~@FUA)|kj5w5$l}Vi2LJkNH{eFWn4*jEt@)1fEtib*SOC7 z9S_q(*}sLHWmiiXYuF(olSTCH$J(zUZJpg>w?`6Pv7U^k;77eopPOfgq2uy*bN0xN z0nB60E~+TZKiF4PN%*{Y8$D3;CzF|Xy?H2CElWsr=k!$wUi0Hk{9FOE;Lxr&Dbz#p ziU=&Ag3Zn{%iea9ZK<g!m5s_Wq%yEnGzRIiz|Ai|^!g%>(hCL{Z5lgcZ!L@@RdK3f*(+UgJn#ghT zT;cc^jtpx(R5maBwbe^!Q5H1+I1S>C@?nYQ=w~cvaYTSMyoHsH5>*q&B|KmEMwCU= zIkD@i*IFtm5egfrg6e<#$hTF}X>4jMt7t3RaU*n#e3;u0(&wV4-<+<}X}6wOR4h9; zRR6LCsbDuy*S(eepko8**nAkskC3&%Wh=|(fMOt5GAw#yR0`4#T_Y0oIWI-3(SCN% zV5_6R;kLJO%X4W@KhaeA851V*-p1XF?4fkjLjPy{6b!rM-X%|Ei>Ch%XOc^r;ky78 z<_O`Y6Al`^#VPOHlP0W;i`GI*$N#4^?bd0>(hgjljIRDP8kbTru(YY{q>4o zsId}=20N&=a@m?t=iaf1Ye15|uLOgS*fiSnV_0HSo6Zuonq2l7U)%c?;v(lQ#|AeS z!yMyGOZ|xxesmacfDt+N1M$8eu>k%%S(}b>4A0C05k*mc^(5~pWKPM$SK8{giTlf3 zkr{)dvx(_7J6?6l%PMUhswR@d#xSji2t@Cimw8nWav%8m{O*v4C9A8LSoI9l40XB6 z7U<_7w#k$7mH3zi6af$@4mU;SRKgZg9I{N*z!%XtFFg_9Cj)(aVQ3tc=>&fm^C%yJ zA*mnXmvcp{L6drC8%+Q7!Oqa1KIh~`UXO3-IEeV%D4q2&h`DUXY{-y9)0qu1($S3s zRs~5~{>ZSstBcUw9CWo2$Bt`H8=LjuW9(}nA+gPAde}IVgju! zPd?T=p`V#DN$XePoLD^Z;CWUH*G`j-P}2tmHr7!SolhTYrXyKTsUpG(m{k+%Y;K@T zzbM^kV?x-zDd;9>j2uyz^5my04xgLMWW@~9nvz=r#=I$B;Ol%W=XEWk&!Z9eKEBdP zX8!T+_(hDLM7XLaHh+>?$+S;J`;t`aNTC7jqW5^mp^3t*v5tH>k`%*ItRn zko<2l;NR5t!#qs^^) z;iJCnH=+z&C68#&{3;{ma`xh7SG&L7Nlvw%IDQHfEm!wQ(plNL6~i1_$BLBGpd=fK z_NE5Q_@=^!!tl1!AhNmz(4-k*U_XvvwM8NoKrATb8UV#sfDs=q@*B@@mXsP6%2M9s z^A+*s$OO6sYU>)PKlNbSzy!CIQngc-px>I>j3v8N%PLE>J9Q)VZO`&a9hjvJKx(>N zBY|-}exMQo>IDc$pLv$Z1)TAUaGk4w)Gs zACyASEC{qCUhlyr^twXAmdUO)4(MHiLSGEF{qWJJv0V^sTHxcEv0Y1AKa*!5L&DkP z;6fPi$<4@zkMk+~zAQQAC7(s+-w8)l&^fJ9w?F@Nc+6&1k7QTWOOHmB52C|GA=z`9 zPfD(;nn_N{AFiorXu!(x%`GczxETZ*+NP5XWNV#y7Fm}nbwZ2l-6zxeW__wQL-H*? z78~!XT*{ZGruRRU;GqUb&CDIE9;-|zc)BIS97NCdW@o?1bmj&6s47hW6-=c%da7y$ zUokTw8t?iJ6(KRm>uO8-n;$@Nh$Nsy1HrYf0VJqWc zXE*5dgoSimKcKyp>UZ|m!gICJ>eUHeKTD~h;qAY*Gq#T0 zBJ%jj-X#CYog?c<_Lc=iGCh0lkhNs=FDJDcw4HCu%Hz=0R6Fz9+O`5TG-AP23j(&1 zk{i+^SbM~OjazlFW{a`UGROO3ahyb4z|VTQ**mT&g^Gn&#I+at3Y;~4b2(kY;3|I#TzZ!@6iVwlK6&lMPxM}IyO*i>{}=65zh z;k!f{qY8``spf`!x}luFnPW#Or8`F377fE(;3K zH^n=iw|cd3&H>;AL;9(=DOes4sV>Ey_U^r3=G`i=WK%G1GwC1{>hC$?icP+Fk3$5D?^^WHZLFJ zH5zd521U5`EzlE2DpE}+r&Q=X>Lf{t2d?3tA+O9PwBAY{$Q;zkK9b8u7V))l>jUAP z$JmiIz_qG#1>XW-q^6oL>$pjK8vkh#IiAq?RZuZ216;@W zp%JsBg=d<>7wu|h0b=tS%@b2XsHj-A9n3cg6UIuiFn%|^c~|nh1GNdu#1(R3D@}2w zlA$9_yU{X;hS;UCjSe5jm9~Lyv_oT6VMBgJ16J!2{3><%&+Ox+RXuoF23z%6=)V2| zo=VsZKYv)}7YaIjJK580mXNSRa4=W8KsK1!iM{AV=`A*2@Txh22e$DdHGjvtvE}Vp zj`Td4T$zhJ>EB6G7(wS9251gUj8Z;aX zk8U+z?3Y?Gra-XV;!G39S3(-_g^4cWR!Un_Axm;p7r*mi!i-S3VPccgaUS0RI{a0X z&mx{~ycS#1S=km-f*Enn!kjIvH%B#-*;Z^o^n4jRE5KEX6Li7FbGR}JTA8iM`p8Gq ziA}k9G&aMybhFJ8t=+|3q?b0`8-rN$0@d3Rv7dVo;XZK!1>HZlUTa8Q2u+{OO2qd&wFNZ!(g0B_z*kp11GlX|uMc&C2}tum*OPv*wZro__S?$8igd^ z&R0aR*Iy#^Ayj9tTA^hVjAQAlA}f#&Q1htWV9(Gq70oD(?q>*PPx7ja^{0mIuXzx8 z6SKEQeM#s}-VYjEH2mQM>CD>|*_)zqtS=Y;Q$R%i>d z;>fQO^t7J2jGURTIU;=Wr^S}06m@rK7{f$yOW)4YpC(p<+^MbomRKs`w+#Qa;;npP zY|-$dvqBI3q(H-~X!SFUl-}y-l>PnRZmKrg&48mwT>nQ*T>mRfU^Bov;ZN~%d(GcI zIKJ1U@Ao^u$H)Oj%-8_3YPiGd5h~N~0jJpRJ0RNaOe1ityfTf!E^Ng3_>zZwOJ{}D zGl?uL{tjZr`K1uC<1LRyF&IIzN5Dl0L8vQ>D&`(BoB9lwKh90yus8ScKFl`JFnkd+ z`A?55Sr(ymP{?0E(4kw~@#p5mFhzY2ju&eKu@pUu_W>y1P=ev)T<7eaH7g$M0gt z<7AOtui1Tl$KnK1+3vMmX92*B7TFED&n4Ilo87PKd|h0R;cBDBYNICmt6ATaN~5Ox zY~Pf%dh;u>kEyxqv-CidJ(tf+g2%_I4&T3o^ZpMF#wmdIu!TczBurQ4@Vm;~55Y0n zr7zE@bqvL;HYhy~=oi8c9sM|x+SYY-sw)I#QEoWONH`!hlla+41ImrTfg96`uF9_V zZzlqgun&rbg1&lpCt$}YnnZK%CYs6vF(QTSy1-R5*pA1?l!`~Mk3`i*-R2~;UEpJG zEZ{i7;{<@Ki0Z)WJ3A2xclmQi4Da2p>IT5=lY9Tj_o zUif#ey#=bd(JyOBG`IHsI9O@M$__Z{cpcS(!wP!WjW1yx6=lQDyS1!7+p=T<8YzT< ztWV}b)uW1ek1x+TgC8gKd#V!)-}-n^Hc!USNC5dbKGGwrD14@kjuf^_ApvWJ&EA5%8k?T_n9 zRgCCO$w!3LO22s*`kaMdr~lSxp;z`fO0kUGRjD?LIA+)JoWj3J1uh%)BV9=~b9c^Eo|gD}$v}hAnM#2I6lzAWs;#ByySdN;15@c{)?i4!-} zbWK`iDiKkYk7cKx2DlcaoBMIYR(hx(w~$73|^#^ta2c zT<+_6f!8qQ+SEH7F6!&R2a5L(wW4s#M3Qn<-x^Mmipz+7$eM^Pr7PLKQ21Dvk?debv67+W8#-KD zI6uclJ;%GSG(py$nwwn&s*lt~E(-EgD!Q#-VKCVG&X32L1lTqrMpv&Fv&wE5wO99$ zv7^9F>trc3_ZLy{mU9_;Qcy)P8Ur@Dl*-X$cRo9)He)tFVnB6lJlcyxAmpsFC3-WE zE1_t#qG)9e#5~gY4!~L<}&9IDZ zk$n2Wa5fp$oz+OjFRd|%`d2X@={i@|6<_BMlvSuSL_uXru{_?)N8$aJy-2Wj@mw}-e|Lmw*e%B(n7@Gni)vh1 zJg3t{zD{J1Nug7Ei5skrngGvssRX@Il)A*xNhqcJ<@cZ8nV$v)fJN00xJ1dPj@+gZefgVA_$_?+vAo(z!Vd+umV1k89o=M~v?IO-P~-I|0gcti zjVoo6J?gWHDpMbth%t!EkkW~=9CMV4#hkq~d&1hi8&mH8Jn~kySiNafSRBtd@kfqZGfj5^0IX_^Fq-W)%m6i_FTho>H-ld9e_WR;l7n=DC z^`k^5E<6KDr1EwK{blgwwh)i$CS z%C;k?Ghpi}CX*~eZ;x5W^pK6-$?W+b*?)}VZB0Y2grLMpSe4A9k&ce(Ha;xYNbF1} zAGwPM=V2Xv5?*`vjW|w75{T|2DoZd7@oKBwc1HTe8$(ZB| zw{uKh3Z7HUrBOXUrTxkwtYq<6lboqTZ$4udCy$g1Rv-UD=0~=AV8A6S0!a(%T1+Y) z6y?gJMKgYHY&ohc4{xB@HbKQc#;I3UPUrcuMq96yhz3u1M~IxhfRroe;Bl&c;Fti2 zqcp5vfZonzN2+^($j{h?Emh$0i41S8{A2|ZjHSkfzPv-=pHs|D)hjI^^5tPrwfPfG z^@@FUlfJsbBNS+j&)H6!`vq4i$p4jppY9%-_69Eh(CqVoCz?_kUWbxCMQKC5e@W`< zRWbft&d|Y_6SrZ`w87OkqoEmR%O7y5pH?#Pgp%oC3dG@A5|s?WlI*$%|B%RLF*I`W zV2}H&YuH6o6<27dc*!;*7Y_Oj>WY13QD(y5U<-Icn~XBvN?zks&R z+hUj7N&MjB_(gGlYL^aD{`SteLKw6&caJoLr3)8?tMXVN0;Q^27V{0(So@@+VX2@< zUmDa7pd4O%j7YBr^eC#kD_;3|Gk@7i=J2L^ds1$A7~HsvUPWDERj_b|m}NLu#=NLO zVx-p!dQLweZrYJ^Xg%mz4|P@kozDR8E~37BoQC`y#;q%g>pX{A=9&ozX-%i2UE?xN z)XAl+$|j1H6I44PHyb{p$t(@Ke<@M87zBU{_u0ekW@v62^}ksu?1n5`d$fKIHg1M` zEE(Hn!Jib}a&Jxbs@KkM^p))-3l`($y4~>mtdU^JD@Lg{NP~@SfoQQsxi%iwqwp9I zt8O)Iqn&gUZxenfUCxKtHrjCXo&QoTFKp2c!=tCQWUaYwp+NRLJC+^STK7XnC(tUT zq}h3+LqGyarTe=;R|z3%TnU@&3JgpvaBG5x(h(xuBZx4o|33eEutN16DpngZW#^>) z@humrLy@{xOrn`mF#KgCA(Awxb^)V*TBi;||H(v_-fRh6|SaRFd7Hmj^fo9xZMLF{mi{OBu&g;Vm+7hb_ z_Rs65W_{y^Z#i?Aq2Cg%KIy@M0I5OSh;I)uKe|vTMZX=&A=4Y~;C%m2kjD52hcN#? z=0A{xf0zD0OyK|N@&5s?@L!OGf0G*iZ=wyatq=_Lj{9lfP~v;py>L8be0OC~EJeI8XK>&+oa~(oQW-kZmLE zL%2UK!J>4T?Fq2ykH!C_e#No)?p*@%>vS({rZ>D>icXTr7L|x1A&LSPM^UD24YS;u z{Kjd!pPF+)aRxm0EW$&F+`1=~&vUIQGyrd(8}IxNX@Xs>iA`2@5*lb?*TrK^EXW~* z<*lL?S~dQ|9jhwK@|y3gs;|d*?W6DOs1-K|e_dB9MI+*(l1S#3O20R0uQGdcR%vl4 zs=P}7u-<#=FQBv96zCm$m_mw$^@DF);Il4OcWuB^TXTj*=nsaJyZYY9Kc-oAGe8|} zPSh?M!(H$;QC{x%LBtJ|q*H~_;ZQL-nivm1L87+=e*y$yoJ zuz0G$GIhrjb!Y*t{F})Fy;Z|MsQ;i}Y_IokdJqv1SW*59{qk?7dVP#R z*E-Kz9{V4F`+uX|6Jg%0RR5IxCsFMmr2GFYzKIe(q`Lq3{3o{t>wg^J)^7?p&Bnsr z-Nw<%jRWjpuksNQi2&ihr(yaJt_=bL@&8eC;BBHUD{10{4;JX3Q~YQ9z^8EfkA=n- v0l~q--Q+(H|6e?MkvmH+dU&f2AR{0U{zn}Igg5qy?|d2205~BB0pWiEd(~