1// Copyright 2017 syzkaller project authors. All rights reserved. 2// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. 3 4package ifuzz 5 6import ( 7 "math/rand" 8) 9 10func initPseudo() { 11 Insns = append(Insns, &Insn{ 12 Name: "PSEUDO_RDMSR", 13 Mode: 1<<ModeLast - 1, 14 Priv: true, 15 Pseudo: true, 16 generator: func(cfg *Config, r *rand.Rand) []byte { 17 gen := makeGen(cfg, r) 18 msr := msrs[r.Intn(len(msrs))] 19 gen.mov32(regECX, msr) 20 gen.byte(0x0f, 0x32) // rdmsr 21 return gen.text 22 }, 23 }) 24 Insns = append(Insns, &Insn{ 25 Name: "PSEUDO_WRMSR", 26 Mode: 1<<ModeLast - 1, 27 Priv: true, 28 Pseudo: true, 29 generator: func(cfg *Config, r *rand.Rand) []byte { 30 gen := makeGen(cfg, r) 31 msr := msrs[r.Intn(len(msrs))] 32 v := generateInt(cfg, r, 8) 33 gen.mov32(regECX, msr) 34 gen.mov32(regEAX, uint32(v>>0)) 35 gen.mov32(regEDX, uint32(v>>32)) 36 gen.byte(0x0f, 0x30) // wrmsr 37 return gen.text 38 }, 39 }) 40 Insns = append(Insns, &Insn{ 41 Name: "PSEUDO_PCI_READ", 42 Mode: 1<<ModeLast - 1, 43 Priv: true, 44 Pseudo: true, 45 generator: func(cfg *Config, r *rand.Rand) []byte { 46 gen := makeGen(cfg, r) 47 addr, port, size := pciAddrPort(r) 48 gen.out32(0xcf8, addr) 49 gen.in(port, size) 50 return gen.text 51 }, 52 }) 53 Insns = append(Insns, &Insn{ 54 Name: "PSEUDO_PCI_WRITE", 55 Mode: 1<<ModeLast - 1, 56 Priv: true, 57 Pseudo: true, 58 generator: func(cfg *Config, r *rand.Rand) []byte { 59 gen := makeGen(cfg, r) 60 addr, port, size := pciAddrPort(r) 61 val := generateInt(cfg, r, 4) 62 gen.out32(0xcf8, addr) 63 gen.out(port, uint32(val), size) 64 return gen.text 65 }, 66 }) 67 Insns = append(Insns, &Insn{ 68 Name: "PSEUDO_PORT_READ", 69 Mode: 1<<ModeLast - 1, 70 Priv: true, 71 Pseudo: true, 72 generator: func(cfg *Config, r *rand.Rand) []byte { 73 gen := makeGen(cfg, r) 74 port := ports[r.Intn(len(ports))] 75 gen.in(port, r.Intn(3)) 76 return gen.text 77 }, 78 }) 79 Insns = append(Insns, &Insn{ 80 Name: "PSEUDO_PORT_WRITE", 81 Mode: 1<<ModeLast - 1, 82 Priv: true, 83 Pseudo: true, 84 generator: func(cfg *Config, r *rand.Rand) []byte { 85 gen := makeGen(cfg, r) 86 port := ports[r.Intn(len(ports))] 87 val := generateInt(cfg, r, 4) 88 gen.out(port, uint32(val), r.Intn(3)) 89 return gen.text 90 }, 91 }) 92 Insns = append(Insns, &Insn{ 93 Name: "PSEUDO_XOR_CR", 94 Mode: 1<<ModeLast - 1, 95 Priv: true, 96 Pseudo: true, 97 generator: func(cfg *Config, r *rand.Rand) []byte { 98 gen := makeGen(cfg, r) 99 cr := controlRegisters[r.Intn(len(controlRegisters))] 100 var v uint32 101 if cr == 8 { 102 v = uint32(r.Intn(15) + 1) 103 } else { 104 bit := controlRegistersBits[cr][r.Intn(len(controlRegistersBits[cr]))] 105 v = 1 << bit 106 } 107 gen.readCR(cr) 108 gen.xor32(regEAX, v) 109 gen.writeCR(cr) 110 return gen.text 111 }, 112 }) 113 Insns = append(Insns, &Insn{ 114 Name: "PSEUDO_XOR_EFER", 115 Mode: 1<<ModeLast - 1, 116 Priv: true, 117 Pseudo: true, 118 generator: func(cfg *Config, r *rand.Rand) []byte { 119 gen := makeGen(cfg, r) 120 gen.mov32(regECX, eferMSR) 121 gen.byte(0x0f, 0x32) // rdmsr 122 bit := eferBits[r.Intn(len(eferBits))] 123 gen.xor32(regEAX, 1<<bit) 124 gen.byte(0x0f, 0x30) // wrmsr 125 return gen.text 126 }, 127 }) 128 Insns = append(Insns, &Insn{ 129 Name: "PSEUDO_SET_BREAK", 130 Mode: 1<<ModeLast - 1, 131 Priv: true, 132 Pseudo: true, 133 generator: func(cfg *Config, r *rand.Rand) []byte { 134 gen := makeGen(cfg, r) 135 br := uint8(r.Intn(4)) 136 loc := uint32(r.Intn(4)) 137 typ := uint32(r.Intn(16)) 138 addr := generateInt(cfg, r, 8) 139 if cfg.Mode == ModeLong64 { 140 gen.mov64(regRAX, addr) 141 } else { 142 gen.mov32(regEAX, uint32(addr)) 143 } 144 gen.writeDR(br) 145 gen.readDR(7) 146 gen.xor32(regEAX, loc<<(br*2)|typ<<(16+br*4)) 147 gen.writeDR(7) 148 return gen.text 149 }, 150 }) 151 Insns = append(Insns, &Insn{ 152 Name: "PSEUDO_LOAD_SEG", 153 Mode: 1<<ModeLast - 1, 154 Priv: true, 155 Pseudo: true, 156 generator: func(cfg *Config, r *rand.Rand) []byte { 157 gen := makeGen(cfg, r) 158 sel := randSelector(r) 159 if cfg.Mode == ModeReal16 { 160 sel = uint16(generateInt(cfg, r, 8)) >> 4 161 } 162 reg := uint8(r.Intn(6)) 163 gen.mov16(regAX, sel) 164 gen.byte(0x8e, 0xc0|(reg<<3)) // mov %ax, %seg 165 return gen.text 166 }, 167 }) 168 Insns = append(Insns, &Insn{ 169 Name: "PSEUDO_FAR_JMP", 170 Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16, 171 Priv: true, 172 Pseudo: true, 173 generator: func(cfg *Config, r *rand.Rand) []byte { 174 gen := makeGen(cfg, r) 175 sel := randSelector(r) 176 off := generateInt(cfg, r, 4) 177 if cfg.Mode == ModeLong64 { 178 gen.mov32toSPaddr(uint32(sel), 0) 179 gen.mov32toSPaddr(uint32(off), 2) 180 if r.Intn(2) == 0 { 181 gen.byte(0xff, 0x2c, 0x24) // ljmp (%rsp) 182 } else { 183 gen.byte(0xff, 0x1c, 0x24) // lcall (%rsp) 184 } 185 } else { 186 if r.Intn(2) == 0 { 187 gen.byte(0xea) // ljmp $imm16, $imm16/32 188 } else { 189 gen.byte(0x9a) // lcall $imm16, $imm16/32 190 } 191 if cfg.Mode == ModeProt16 { 192 gen.imm16(uint16(off)) 193 } else { 194 gen.imm32(uint32(off)) 195 } 196 gen.imm16(sel) 197 } 198 return gen.text 199 }, 200 }) 201 Insns = append(Insns, &Insn{ 202 Name: "PSEUDO_LTR_LLDT", 203 Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16, 204 Priv: true, 205 Pseudo: true, 206 generator: func(cfg *Config, r *rand.Rand) []byte { 207 gen := makeGen(cfg, r) 208 sel := randSelector(r) 209 gen.mov16(regAX, sel) 210 if r.Intn(2) == 0 { 211 gen.byte(0x0f, 0x00, 0xd8) // ltr %ax 212 } else { 213 gen.byte(0x0f, 0x00, 0xd0) // lldt %ax 214 } 215 return gen.text 216 }, 217 }) 218 Insns = append(Insns, &Insn{ 219 Name: "PSEUDO_LGIDT", 220 Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16, 221 Priv: true, 222 Pseudo: true, 223 generator: func(cfg *Config, r *rand.Rand) []byte { 224 gen := makeGen(cfg, r) 225 limit := uint32(generateInt(cfg, r, 2)) 226 base := uint32(generateInt(cfg, r, 4)) 227 gen.mov32toSPaddr(limit, 0) 228 gen.mov32toSPaddr(base, 2) 229 gen.mov32toSPaddr(0, 6) 230 gen.addr32() 231 if r.Intn(2) == 0 { 232 gen.byte(0x0f, 0x01, 0x14, 0x24) // lgdt (%rsp) 233 } else { 234 gen.byte(0x0f, 0x01, 0x1c, 0x24) // lidt (%rsp) 235 } 236 return gen.text 237 }, 238 }) 239 Insns = append(Insns, &Insn{ 240 Name: "PSEUDO_HYPERCALL", 241 Mode: 1<<ModeLong64 | 1<<ModeProt32 | 1<<ModeProt16, 242 Priv: true, 243 Pseudo: true, 244 generator: func(cfg *Config, r *rand.Rand) []byte { 245 gen := makeGen(cfg, r) 246 switch r.Intn(2) { 247 case 0: 248 gen.mov32(regEAX, 1) // KVM_HC_VAPIC_POLL_IRQ 249 case 1: 250 gen.mov32(regEAX, 5) // KVM_HC_KICK_CPU 251 gen.mov32(regECX, uint32(generateInt(cfg, r, 4))) // APIC ID 252 default: 253 panic("bad") 254 } 255 if r.Intn(2) == 0 { 256 gen.byte(0x0f, 0x01, 0xd9) // vmmcall 257 } else { 258 gen.byte(0x0f, 0x01, 0xc1) // vmcall 259 } 260 return gen.text 261 }, 262 }) 263} 264 265const ( 266 regAL = iota 267 regAX 268 regEAX 269 regRAX 270 regCL 271 regCX 272 regECX 273 regRCX 274 regDL 275 regDX 276 regEDX 277 regRDX 278) 279 280type generator struct { 281 mode int 282 r *rand.Rand 283 text []byte 284} 285 286func makeGen(cfg *Config, r *rand.Rand) *generator { 287 return &generator{ 288 mode: cfg.Mode, 289 r: r, 290 } 291} 292 293func (gen *generator) byte(v ...uint8) { 294 gen.text = append(gen.text, v...) 295} 296 297func (gen *generator) imm16(v uint16) { 298 gen.byte(byte(v>>0), byte(v>>8)) 299} 300 301func (gen *generator) imm32(v uint32) { 302 gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24)) 303} 304 305func (gen *generator) imm64(v uint64) { 306 gen.byte(byte(v>>0), byte(v>>8), byte(v>>16), byte(v>>24), 307 byte(v>>32), byte(v>>40), byte(v>>48), byte(v>>56)) 308} 309 310func (gen *generator) operand16() { 311 switch gen.mode { 312 case ModeLong64, ModeProt32: 313 gen.byte(0x66) 314 case ModeProt16, ModeReal16: 315 default: 316 panic("bad mode") 317 } 318} 319 320func (gen *generator) operand32() { 321 switch gen.mode { 322 case ModeLong64, ModeProt32: 323 case ModeProt16, ModeReal16: 324 gen.byte(0x66) 325 default: 326 panic("bad mode") 327 } 328} 329 330func (gen *generator) addr32() { 331 switch gen.mode { 332 case ModeLong64, ModeProt32: 333 case ModeProt16, ModeReal16: 334 gen.byte(0x67) 335 default: 336 panic("bad mode") 337 } 338} 339 340func (gen *generator) mov8(reg int, v uint8) { 341 switch reg { 342 case regAL: 343 gen.byte(0xb0) 344 case regCL: 345 gen.byte(0xb1) 346 case regDL: 347 gen.byte(0xb2) 348 default: 349 panic("unknown register") 350 } 351 gen.byte(v) 352} 353 354func (gen *generator) mov16(reg int, v uint16) { 355 gen.operand16() 356 switch reg { 357 case regAX: 358 gen.byte(0xb8) 359 case regCX: 360 gen.byte(0xb9) 361 case regDX: 362 gen.byte(0xba) 363 default: 364 panic("unknown register") 365 } 366 gen.imm16(v) 367} 368 369func (gen *generator) mov32(reg int, v uint32) { 370 gen.operand32() 371 switch reg { 372 case regEAX: 373 gen.byte(0xb8) 374 case regECX: 375 gen.byte(0xb9) 376 case regEDX: 377 gen.byte(0xba) 378 default: 379 panic("unknown register") 380 } 381 gen.imm32(v) 382} 383 384func (gen *generator) mov64(reg int, v uint64) { 385 if gen.mode != ModeLong64 { 386 panic("bad mode") 387 } 388 gen.byte(0x48) 389 switch reg { 390 case regRAX: 391 gen.byte(0xb8) 392 case regRCX: 393 gen.byte(0xb9) 394 case regRDX: 395 gen.byte(0xba) 396 default: 397 panic("unknown register") 398 } 399 gen.imm64(v) 400} 401 402// movl $v, off(%rsp) 403func (gen *generator) mov32toSPaddr(v uint32, off uint8) { 404 gen.addr32() 405 gen.operand32() 406 gen.byte(0xc7, 0x44, 0x24, off) 407 gen.imm32(v) 408} 409 410func (gen *generator) xor32(reg int, v uint32) { 411 gen.operand32() 412 switch reg { 413 case regEAX: 414 gen.byte(0x35) 415 default: 416 panic("unknown register") 417 } 418 gen.imm32(v) 419} 420 421func (gen *generator) readCR(cr uint8) { 422 if cr < 8 { 423 // mov %crN, %eax/%rax 424 gen.byte(0x0f, 0x20, 0xc0|cr<<3) 425 } else if cr < 16 { 426 // mov %crN, %eax/%rax 427 gen.byte(0x44, 0x0f, 0x20, 0xc0|(cr-8)<<3) 428 } else { 429 panic("bad cr") 430 } 431} 432 433func (gen *generator) writeCR(cr uint8) { 434 if cr < 8 { 435 // mov %eax/%rax, %crN 436 gen.byte(0x0f, 0x22, 0xc0|cr<<3) 437 } else if cr < 16 { 438 // mov %eax/%rax, %crN 439 gen.byte(0x44, 0x0f, 0x22, 0xc0|(cr-8)<<3) 440 } else { 441 panic("bad cr") 442 } 443} 444 445func (gen *generator) readDR(dr uint8) { 446 if dr >= 8 { 447 panic("bad dr") 448 } 449 // mov %drN, %eax/%rax 450 gen.byte(0x0f, 0x21, 0xc0|dr<<3) 451} 452 453func (gen *generator) writeDR(dr uint8) { 454 if dr >= 8 { 455 panic("bad dr") 456 } 457 // mov %eax/%rax, %drN 458 gen.byte(0x0f, 0x23, 0xc0|dr<<3) 459} 460 461func (gen *generator) in8(port uint16) { 462 gen.mov16(regDX, port) 463 gen.byte(0xec) // in %al, %dx 464} 465 466func (gen *generator) in16(port uint16) { 467 gen.mov16(regDX, port) 468 gen.operand16() 469 gen.byte(0xed) // in %ax, %dx 470} 471 472func (gen *generator) in32(port uint16) { 473 gen.mov16(regDX, port) 474 gen.operand32() 475 gen.byte(0xed) // in %eax, %dx 476} 477 478func (gen *generator) in(port uint16, size int) { 479 switch size { 480 case 0: 481 gen.in8(port) 482 case 1: 483 gen.in16(port) 484 case 2: 485 gen.in32(port) 486 default: 487 panic("bad size") 488 } 489} 490 491func (gen *generator) out8(port uint16, v uint8) { 492 gen.mov16(regDX, port) 493 gen.mov8(regAL, v) 494 gen.byte(0xee) // out %dx, %al 495} 496 497func (gen *generator) out16(port uint16, v uint16) { 498 gen.mov16(regDX, port) 499 gen.mov16(regAX, v) 500 gen.operand16() 501 gen.byte(0xef) // out %dx, %ax 502} 503 504func (gen *generator) out32(port uint16, v uint32) { 505 gen.mov16(regDX, port) 506 gen.mov32(regEAX, v) 507 gen.operand32() 508 gen.byte(0xef) // out %dx, %eax 509} 510 511func (gen *generator) out(port uint16, v uint32, size int) { 512 switch size { 513 case 0: 514 gen.out8(port, uint8(v)) 515 case 1: 516 gen.out16(port, uint16(v)) 517 case 2: 518 gen.out32(port, v) 519 default: 520 panic("bad size") 521 } 522} 523 524func randSelector(r *rand.Rand) uint16 { 525 seg := uint16(r.Intn(40)) 526 dpl := uint16(r.Intn(4)) 527 ldt := uint16(r.Intn(2)) 528 return seg<<3 | ldt<<2 | dpl 529} 530 531func pciAddrPort(r *rand.Rand) (addr uint32, port uint16, size int) { 532 bus := uint32(r.Intn(256)) 533 dev := uint32(r.Intn(32)) 534 fn := uint32(r.Intn(8)) 535 reghi := uint32(r.Intn(16)) 536 reglo := uint32(r.Intn(64)) << 2 537 port = 0xcfc 538 switch size = r.Intn(3); size { 539 case 0: 540 port += uint16(reglo & 3) 541 reglo += uint32(r.Intn(4)) 542 case 1: 543 port += uint16(reglo & 2) 544 reglo += uint32(r.Intn(2) * 2) 545 case 2: 546 } 547 addr = 0x80000000 | reghi<<24 | bus<<16 | dev<<11 | fn<<8 | reglo 548 return 549} 550 551var controlRegisters = []uint8{0, 3, 4, 8} 552var controlRegistersBits = map[uint8][]uint8{ 553 0: {0, 1, 2, 3, 4, 5, 16, 18, 29, 30, 31}, 554 3: {3, 5}, 555 4: {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 13, 14, 16, 17, 18, 20, 21, 22}, 556} 557 558const eferMSR = 0xC0000080 559 560var eferBits = []uint8{0, 8, 10, 11, 12, 13, 14, 15} 561 562var ports = []uint16{ 563 0x40, 0x41, 0x42, 0x43, // PIT 564 0x61, // speaker 565 0x20, 0x21, 0xa0, 0xa1, 0x4d0, 0x4d1, // 8259 566} 567 568// sys/kvm.txt also knows this list 569var msrs = []uint32{ 570 0x0, 0x1, 0x10, 0x11, 0x12, 0x13, 0x17, 0x1b, 571 0x20, 0x21, 0x28, 0x29, 0x2a, 0x2c, 0x33, 0x34, 572 0x3a, 0x3b, 0x40, 0x60, 0x79, 0x88, 0x89, 0x8a, 573 0x8b, 0x9b, 0x9e, 0xc1, 0xc2, 0xcd, 0xce, 0xe2, 574 0xe7, 0xe8, 0xfe, 0x116, 0x118, 0x119, 0x11a, 0x11b, 575 0x11e, 0x174, 0x175, 0x176, 0x179, 0x17a, 0x17b, 0x180, 576 0x181, 0x182, 0x183, 0x184, 0x185, 0x186, 0x187, 0x188, 577 0x189, 0x18a, 0x198, 0x199, 0x19a, 0x19b, 0x19c, 0x19d, 578 0x1a0, 0x1a2, 0x1a6, 0x1a7, 0x1aa, 0x1ad, 0x1ae, 0x1af, 579 0x1b0, 0x1b1, 0x1b2, 0x1c8, 0x1c9, 0x1d9, 0x1db, 0x1dc, 580 0x1dd, 0x1de, 0x1e0, 0x1fc, 0x200, 0x201, 0x202, 0x203, 581 0x204, 0x205, 0x206, 0x207, 0x208, 0x209, 0x20a, 0x20b, 582 0x20c, 0x20d, 0x20e, 0x20f, 0x210, 0x211, 0x212, 0x213, 583 0x214, 0x215, 0x216, 0x217, 0x218, 0x219, 0x21a, 0x21b, 584 0x21c, 0x21d, 0x21e, 0x21f, 0x220, 0x221, 0x222, 0x223, 585 0x224, 0x225, 0x226, 0x227, 0x228, 0x229, 0x22a, 0x22b, 586 0x22c, 0x22d, 0x22e, 0x22f, 0x230, 0x231, 0x232, 0x233, 587 0x234, 0x235, 0x236, 0x237, 0x238, 0x239, 0x23a, 0x23b, 588 0x23c, 0x23d, 0x23e, 0x23f, 0x240, 0x241, 0x242, 0x243, 589 0x244, 0x245, 0x246, 0x247, 0x248, 0x249, 0x24a, 0x24b, 590 0x24c, 0x24d, 0x24e, 0x24f, 0x250, 0x251, 0x252, 0x253, 591 0x254, 0x255, 0x256, 0x257, 0x258, 0x259, 0x25a, 0x25b, 592 0x25c, 0x25d, 0x25e, 0x25f, 0x260, 0x261, 0x262, 0x263, 593 0x264, 0x265, 0x266, 0x267, 0x268, 0x269, 0x26a, 0x26b, 594 0x26c, 0x26d, 0x26e, 0x26f, 0x270, 0x271, 0x272, 0x273, 595 0x274, 0x275, 0x276, 0x277, 0x278, 0x279, 0x27a, 0x27b, 596 0x27c, 0x27d, 0x27e, 0x27f, 0x280, 0x281, 0x282, 0x283, 597 0x284, 0x285, 0x286, 0x287, 0x288, 0x289, 0x28a, 0x28b, 598 0x28c, 0x28d, 0x28e, 0x28f, 0x290, 0x291, 0x292, 0x293, 599 0x294, 0x295, 0x296, 0x297, 0x298, 0x299, 0x29a, 0x29b, 600 0x29c, 0x29d, 0x29e, 0x29f, 0x2a0, 0x2a1, 0x2a2, 0x2a3, 601 0x2a4, 0x2a5, 0x2a6, 0x2a7, 0x2a8, 0x2a9, 0x2aa, 0x2ab, 602 0x2ac, 0x2ad, 0x2ae, 0x2af, 0x2b0, 0x2b1, 0x2b2, 0x2b3, 603 0x2b4, 0x2b5, 0x2b6, 0x2b7, 0x2b8, 0x2b9, 0x2ba, 0x2bb, 604 0x2bc, 0x2bd, 0x2be, 0x2bf, 0x2c0, 0x2c1, 0x2c2, 0x2c3, 605 0x2c4, 0x2c5, 0x2c6, 0x2c7, 0x2c8, 0x2c9, 0x2ca, 0x2cb, 606 0x2cc, 0x2cd, 0x2ce, 0x2cf, 0x2d0, 0x2d1, 0x2d2, 0x2d3, 607 0x2d4, 0x2d5, 0x2d6, 0x2d7, 0x2d8, 0x2d9, 0x2da, 0x2db, 608 0x2dc, 0x2dd, 0x2de, 0x2df, 0x2e0, 0x2e1, 0x2e2, 0x2e3, 609 0x2e4, 0x2e5, 0x2e6, 0x2e7, 0x2e8, 0x2e9, 0x2ea, 0x2eb, 610 0x2ec, 0x2ed, 0x2ee, 0x2ef, 0x2f0, 0x2f1, 0x2f2, 0x2f3, 611 0x2f4, 0x2f5, 0x2f6, 0x2f7, 0x2f8, 0x2f9, 0x2fa, 0x2fb, 612 0x2fc, 0x2fd, 0x2fe, 0x2ff, 0x300, 0x301, 0x302, 0x303, 613 0x304, 0x305, 0x306, 0x307, 0x308, 0x309, 0x30a, 0x30b, 614 0x30c, 0x30d, 0x30e, 0x30f, 0x310, 0x311, 0x312, 0x313, 615 0x314, 0x315, 0x316, 0x317, 0x318, 0x319, 0x31a, 0x31b, 616 0x31c, 0x31d, 0x31e, 0x31f, 0x320, 0x321, 0x322, 0x323, 617 0x324, 0x325, 0x326, 0x327, 0x328, 0x329, 0x32a, 0x32b, 618 0x32c, 0x32d, 0x32e, 0x32f, 0x330, 0x331, 0x332, 0x333, 619 0x334, 0x335, 0x336, 0x337, 0x338, 0x339, 0x33a, 0x33b, 620 0x33c, 0x33d, 0x33e, 0x33f, 0x340, 0x341, 0x342, 0x343, 621 0x344, 0x345, 0x346, 0x347, 0x348, 0x349, 0x34a, 0x34b, 622 0x34c, 0x34d, 0x34e, 0x34f, 0x350, 0x351, 0x352, 0x353, 623 0x354, 0x355, 0x356, 0x357, 0x358, 0x359, 0x35a, 0x35b, 624 0x35c, 0x35d, 0x35e, 0x35f, 0x360, 0x361, 0x362, 0x363, 625 0x364, 0x365, 0x366, 0x367, 0x368, 0x369, 0x36a, 0x36b, 626 0x36c, 0x36d, 0x36e, 0x36f, 0x370, 0x371, 0x372, 0x373, 627 0x374, 0x375, 0x376, 0x377, 0x378, 0x379, 0x37a, 0x37b, 628 0x37c, 0x37d, 0x37e, 0x37f, 0x380, 0x381, 0x382, 0x383, 629 0x384, 0x385, 0x386, 0x387, 0x388, 0x389, 0x38a, 0x38b, 630 0x38c, 0x38d, 0x38e, 0x38f, 0x390, 0x391, 0x392, 0x393, 631 0x394, 0x395, 0x396, 0x397, 0x398, 0x399, 0x39a, 0x39b, 632 0x39c, 0x39d, 0x39e, 0x39f, 0x3a0, 0x3a1, 0x3a2, 0x3a3, 633 0x3a4, 0x3a5, 0x3a6, 0x3a7, 0x3a8, 0x3a9, 0x3aa, 0x3ab, 634 0x3ac, 0x3ad, 0x3ae, 0x3af, 0x3b0, 0x3b1, 0x3b2, 0x3b3, 635 0x3b4, 0x3b5, 0x3b6, 0x3b7, 0x3b8, 0x3b9, 0x3ba, 0x3bb, 636 0x3bc, 0x3bd, 0x3be, 0x3bf, 0x3c2, 0x3c3, 0x3c4, 0x3c5, 637 0x3f1, 0x3f2, 0x3f6, 0x3f7, 0x3f8, 0x3f9, 0x3fa, 0x3fc, 638 0x3fd, 0x3fe, 0x3ff, 0x400, 0x401, 0x402, 0x403, 0x404, 639 0x405, 0x406, 0x407, 0x408, 0x409, 0x40a, 0x40b, 0x40c, 640 0x40d, 0x40e, 0x40f, 0x410, 0x411, 0x412, 0x413, 0x480, 641 0x481, 0x482, 0x483, 0x484, 0x485, 0x486, 0x487, 0x488, 642 0x489, 0x48a, 0x48b, 0x48c, 0x48d, 0x48e, 0x48f, 0x490, 643 0x491, 0x4c1, 0x4d0, 0x560, 0x561, 0x570, 0x571, 0x572, 644 0x580, 0x581, 0x582, 0x583, 0x584, 0x585, 0x586, 0x587, 645 0x600, 0x606, 0x60a, 0x60b, 0x60c, 0x60d, 0x610, 0x611, 646 0x613, 0x614, 0x618, 0x619, 0x61b, 0x61c, 0x630, 0x631, 647 0x632, 0x633, 0x634, 0x635, 0x638, 0x639, 0x63a, 0x63b, 648 0x640, 0x641, 0x642, 0x648, 0x649, 0x64a, 0x64b, 0x64c, 649 0x64d, 0x64e, 0x64f, 0x658, 0x659, 0x65a, 0x65b, 0x660, 650 0x668, 0x669, 0x680, 0x690, 0x6b0, 0x6b1, 0x6c0, 0x6e0, 651 0x770, 0x771, 0x772, 0x773, 0x774, 0x777, 0x800, 0x801, 652 0x802, 0x803, 0x804, 0x805, 0x806, 0x807, 0x808, 0x809, 653 0x80a, 0x80b, 0x80c, 0x80d, 0x80e, 0x80f, 0x810, 0x811, 654 0x812, 0x813, 0x814, 0x815, 0x816, 0x817, 0x818, 0x819, 655 0x81a, 0x81b, 0x81c, 0x81d, 0x81e, 0x81f, 0x820, 0x821, 656 0x822, 0x823, 0x824, 0x825, 0x826, 0x827, 0x828, 0x829, 657 0x82a, 0x82b, 0x82c, 0x82d, 0x82e, 0x82f, 0x830, 0x831, 658 0x832, 0x833, 0x834, 0x835, 0x836, 0x837, 0x838, 0x839, 659 0x83a, 0x83b, 0x83c, 0x83d, 0x83e, 0x83f, 0x840, 0x841, 660 0x842, 0x843, 0x844, 0x845, 0x846, 0x847, 0x848, 0x849, 661 0x84a, 0x84b, 0x84c, 0x84d, 0x84e, 0x84f, 0x850, 0x851, 662 0x852, 0x853, 0x854, 0x855, 0x856, 0x857, 0x858, 0x859, 663 0x85a, 0x85b, 0x85c, 0x85d, 0x85e, 0x85f, 0x860, 0x861, 664 0x862, 0x863, 0x864, 0x865, 0x866, 0x867, 0x868, 0x869, 665 0x86a, 0x86b, 0x86c, 0x86d, 0x86e, 0x86f, 0x870, 0x871, 666 0x872, 0x873, 0x874, 0x875, 0x876, 0x877, 0x878, 0x879, 667 0x87a, 0x87b, 0x87c, 0x87d, 0x87e, 0x87f, 0x880, 0x881, 668 0x882, 0x883, 0x884, 0x885, 0x886, 0x887, 0x888, 0x889, 669 0x88a, 0x88b, 0x88c, 0x88d, 0x88e, 0x88f, 0x890, 0x891, 670 0x892, 0x893, 0x894, 0x895, 0x896, 0x897, 0x898, 0x899, 671 0x89a, 0x89b, 0x89c, 0x89d, 0x89e, 0x89f, 0x8a0, 0x8a1, 672 0x8a2, 0x8a3, 0x8a4, 0x8a5, 0x8a6, 0x8a7, 0x8a8, 0x8a9, 673 0x8aa, 0x8ab, 0x8ac, 0x8ad, 0x8ae, 0x8af, 0x8b0, 0x8b1, 674 0x8b2, 0x8b3, 0x8b4, 0x8b5, 0x8b6, 0x8b7, 0x8b8, 0x8b9, 675 0x8ba, 0x8bb, 0x8bc, 0x8bd, 0x8be, 0x8bf, 0x8c0, 0x8c1, 676 0x8c2, 0x8c3, 0x8c4, 0x8c5, 0x8c6, 0x8c7, 0x8c8, 0x8c9, 677 0x8ca, 0x8cb, 0x8cc, 0x8cd, 0x8ce, 0x8cf, 0x8d0, 0x8d1, 678 0x8d2, 0x8d3, 0x8d4, 0x8d5, 0x8d6, 0x8d7, 0x8d8, 0x8d9, 679 0x8da, 0x8db, 0x8dc, 0x8dd, 0x8de, 0x8df, 0x8e0, 0x8e1, 680 0x8e2, 0x8e3, 0x8e4, 0x8e5, 0x8e6, 0x8e7, 0x8e8, 0x8e9, 681 0x8ea, 0x8eb, 0x8ec, 0x8ed, 0x8ee, 0x8ef, 0x8f0, 0x8f1, 682 0x8f2, 0x8f3, 0x8f4, 0x8f5, 0x8f6, 0x8f7, 0x8f8, 0x8f9, 683 0x8fa, 0x8fb, 0x8fc, 0x8fd, 0x8fe, 0x8ff, 0x900, 0x901, 684 0x902, 0x903, 0x904, 0x905, 0x906, 0x907, 0x908, 0x909, 685 0x90a, 0x90b, 0x90c, 0x90d, 0x90e, 0x90f, 0x910, 0x911, 686 0x912, 0x913, 0x914, 0x915, 0x916, 0x917, 0x918, 0x919, 687 0x91a, 0x91b, 0x91c, 0x91d, 0x91e, 0x91f, 0x920, 0x921, 688 0x922, 0x923, 0x924, 0x925, 0x926, 0x927, 0x928, 0x929, 689 0x92a, 0x92b, 0x92c, 0x92d, 0x92e, 0x92f, 0x930, 0x931, 690 0x932, 0x933, 0x934, 0x935, 0x936, 0x937, 0x938, 0x939, 691 0x93a, 0x93b, 0x93c, 0x93d, 0x93e, 0x93f, 0x940, 0x941, 692 0x942, 0x943, 0x944, 0x945, 0x946, 0x947, 0x948, 0x949, 693 0x94a, 0x94b, 0x94c, 0x94d, 0x94e, 0x94f, 0x950, 0x951, 694 0x952, 0x953, 0x954, 0x955, 0x956, 0x957, 0x958, 0x959, 695 0x95a, 0x95b, 0x95c, 0x95d, 0x95e, 0x95f, 0x960, 0x961, 696 0x962, 0x963, 0x964, 0x965, 0x966, 0x967, 0x968, 0x969, 697 0x96a, 0x96b, 0x96c, 0x96d, 0x96e, 0x96f, 0x970, 0x971, 698 0x972, 0x973, 0x974, 0x975, 0x976, 0x977, 0x978, 0x979, 699 0x97a, 0x97b, 0x97c, 0x97d, 0x97e, 0x97f, 0x980, 0x981, 700 0x982, 0x983, 0x984, 0x985, 0x986, 0x987, 0x988, 0x989, 701 0x98a, 0x98b, 0x98c, 0x98d, 0x98e, 0x98f, 0x990, 0x991, 702 0x992, 0x993, 0x994, 0x995, 0x996, 0x997, 0x998, 0x999, 703 0x99a, 0x99b, 0x99c, 0x99d, 0x99e, 0x99f, 0x9a0, 0x9a1, 704 0x9a2, 0x9a3, 0x9a4, 0x9a5, 0x9a6, 0x9a7, 0x9a8, 0x9a9, 705 0x9aa, 0x9ab, 0x9ac, 0x9ad, 0x9ae, 0x9af, 0x9b0, 0x9b1, 706 0x9b2, 0x9b3, 0x9b4, 0x9b5, 0x9b6, 0x9b7, 0x9b8, 0x9b9, 707 0x9ba, 0x9bb, 0x9bc, 0x9bd, 0x9be, 0x9bf, 0x9c0, 0x9c1, 708 0x9c2, 0x9c3, 0x9c4, 0x9c5, 0x9c6, 0x9c7, 0x9c8, 0x9c9, 709 0x9ca, 0x9cb, 0x9cc, 0x9cd, 0x9ce, 0x9cf, 0x9d0, 0x9d1, 710 0x9d2, 0x9d3, 0x9d4, 0x9d5, 0x9d6, 0x9d7, 0x9d8, 0x9d9, 711 0x9da, 0x9db, 0x9dc, 0x9dd, 0x9de, 0x9df, 0x9e0, 0x9e1, 712 0x9e2, 0x9e3, 0x9e4, 0x9e5, 0x9e6, 0x9e7, 0x9e8, 0x9e9, 713 0x9ea, 0x9eb, 0x9ec, 0x9ed, 0x9ee, 0x9ef, 0x9f0, 0x9f1, 714 0x9f2, 0x9f3, 0x9f4, 0x9f5, 0x9f6, 0x9f7, 0x9f8, 0x9f9, 715 0x9fa, 0x9fb, 0x9fc, 0x9fd, 0x9fe, 0x9ff, 0xa00, 0xa01, 716 0xa02, 0xa03, 0xa04, 0xa05, 0xa06, 0xa07, 0xa08, 0xa09, 717 0xa0a, 0xa0b, 0xa0c, 0xa0d, 0xa0e, 0xa0f, 0xa10, 0xa11, 718 0xa12, 0xa13, 0xa14, 0xa15, 0xa16, 0xa17, 0xa18, 0xa19, 719 0xa1a, 0xa1b, 0xa1c, 0xa1d, 0xa1e, 0xa1f, 0xa20, 0xa21, 720 0xa22, 0xa23, 0xa24, 0xa25, 0xa26, 0xa27, 0xa28, 0xa29, 721 0xa2a, 0xa2b, 0xa2c, 0xa2d, 0xa2e, 0xa2f, 0xa30, 0xa31, 722 0xa32, 0xa33, 0xa34, 0xa35, 0xa36, 0xa37, 0xa38, 0xa39, 723 0xa3a, 0xa3b, 0xa3c, 0xa3d, 0xa3e, 0xa3f, 0xa40, 0xa41, 724 0xa42, 0xa43, 0xa44, 0xa45, 0xa46, 0xa47, 0xa48, 0xa49, 725 0xa4a, 0xa4b, 0xa4c, 0xa4d, 0xa4e, 0xa4f, 0xa50, 0xa51, 726 0xa52, 0xa53, 0xa54, 0xa55, 0xa56, 0xa57, 0xa58, 0xa59, 727 0xa5a, 0xa5b, 0xa5c, 0xa5d, 0xa5e, 0xa5f, 0xa60, 0xa61, 728 0xa62, 0xa63, 0xa64, 0xa65, 0xa66, 0xa67, 0xa68, 0xa69, 729 0xa6a, 0xa6b, 0xa6c, 0xa6d, 0xa6e, 0xa6f, 0xa70, 0xa71, 730 0xa72, 0xa73, 0xa74, 0xa75, 0xa76, 0xa77, 0xa78, 0xa79, 731 0xa7a, 0xa7b, 0xa7c, 0xa7d, 0xa7e, 0xa7f, 0xa80, 0xa81, 732 0xa82, 0xa83, 0xa84, 0xa85, 0xa86, 0xa87, 0xa88, 0xa89, 733 0xa8a, 0xa8b, 0xa8c, 0xa8d, 0xa8e, 0xa8f, 0xa90, 0xa91, 734 0xa92, 0xa93, 0xa94, 0xa95, 0xa96, 0xa97, 0xa98, 0xa99, 735 0xa9a, 0xa9b, 0xa9c, 0xa9d, 0xa9e, 0xa9f, 0xaa0, 0xaa1, 736 0xaa2, 0xaa3, 0xaa4, 0xaa5, 0xaa6, 0xaa7, 0xaa8, 0xaa9, 737 0xaaa, 0xaab, 0xaac, 0xaad, 0xaae, 0xaaf, 0xab0, 0xab1, 738 0xab2, 0xab3, 0xab4, 0xab5, 0xab6, 0xab7, 0xab8, 0xab9, 739 0xaba, 0xabb, 0xabc, 0xabd, 0xabe, 0xabf, 0xac0, 0xac1, 740 0xac2, 0xac3, 0xac4, 0xac5, 0xac6, 0xac7, 0xac8, 0xac9, 741 0xaca, 0xacb, 0xacc, 0xacd, 0xace, 0xacf, 0xad0, 0xad1, 742 0xad2, 0xad3, 0xad4, 0xad5, 0xad6, 0xad7, 0xad8, 0xad9, 743 0xada, 0xadb, 0xadc, 0xadd, 0xade, 0xadf, 0xae0, 0xae1, 744 0xae2, 0xae3, 0xae4, 0xae5, 0xae6, 0xae7, 0xae8, 0xae9, 745 0xaea, 0xaeb, 0xaec, 0xaed, 0xaee, 0xaef, 0xaf0, 0xaf1, 746 0xaf2, 0xaf3, 0xaf4, 0xaf5, 0xaf6, 0xaf7, 0xaf8, 0xaf9, 747 0xafa, 0xafb, 0xafc, 0xafd, 0xafe, 0xaff, 0xb00, 0xb01, 748 0xb02, 0xb03, 0xb04, 0xb05, 0xb06, 0xb07, 0xb08, 0xb09, 749 0xb0a, 0xb0b, 0xb0c, 0xb0d, 0xb0e, 0xb0f, 0xb10, 0xb11, 750 0xb12, 0xb13, 0xb14, 0xb15, 0xb16, 0xb17, 0xb18, 0xb19, 751 0xb1a, 0xb1b, 0xb1c, 0xb1d, 0xb1e, 0xb1f, 0xb20, 0xb21, 752 0xb22, 0xb23, 0xb24, 0xb25, 0xb26, 0xb27, 0xb28, 0xb29, 753 0xb2a, 0xb2b, 0xb2c, 0xb2d, 0xb2e, 0xb2f, 0xb30, 0xb31, 754 0xb32, 0xb33, 0xb34, 0xb35, 0xb36, 0xb37, 0xb38, 0xb39, 755 0xb3a, 0xb3b, 0xb3c, 0xb3d, 0xb3e, 0xb3f, 0xb40, 0xb41, 756 0xb42, 0xb43, 0xb44, 0xb45, 0xb46, 0xb47, 0xb48, 0xb49, 757 0xb4a, 0xb4b, 0xb4c, 0xb4d, 0xb4e, 0xb4f, 0xb50, 0xb51, 758 0xb52, 0xb53, 0xb54, 0xb55, 0xb56, 0xb57, 0xb58, 0xb59, 759 0xb5a, 0xb5b, 0xb5c, 0xb5d, 0xb5e, 0xb5f, 0xb60, 0xb61, 760 0xb62, 0xb63, 0xb64, 0xb65, 0xb66, 0xb67, 0xb68, 0xb69, 761 0xb6a, 0xb6b, 0xb6c, 0xb6d, 0xb6e, 0xb6f, 0xb70, 0xb71, 762 0xb72, 0xb73, 0xb74, 0xb75, 0xb76, 0xb77, 0xb78, 0xb79, 763 0xb7a, 0xb7b, 0xb7c, 0xb7d, 0xb7e, 0xb7f, 0xb80, 0xb81, 764 0xb82, 0xb83, 0xb84, 0xb85, 0xb86, 0xb87, 0xb88, 0xb89, 765 0xb8a, 0xb8b, 0xb8c, 0xb8d, 0xb8e, 0xb8f, 0xb90, 0xb91, 766 0xb92, 0xb93, 0xb94, 0xb95, 0xb96, 0xb97, 0xb98, 0xb99, 767 0xb9a, 0xb9b, 0xb9c, 0xb9d, 0xb9e, 0xb9f, 0xba0, 0xba1, 768 0xba2, 0xba3, 0xba4, 0xba5, 0xba6, 0xba7, 0xba8, 0xba9, 769 0xbaa, 0xbab, 0xbac, 0xbad, 0xbae, 0xbaf, 0xbb0, 0xbb1, 770 0xbb2, 0xbb3, 0xbb4, 0xbb5, 0xbb6, 0xbb7, 0xbb8, 0xbb9, 771 0xbba, 0xbbb, 0xbbc, 0xbbd, 0xbbe, 0xbbf, 0xbc0, 0xbc1, 772 0xbc2, 0xbc3, 0xbc4, 0xbc5, 0xbc6, 0xbc7, 0xbc8, 0xbc9, 773 0xbca, 0xbcb, 0xbcc, 0xbcd, 0xbce, 0xbcf, 0xbd0, 0xbd1, 774 0xbd2, 0xbd3, 0xbd4, 0xbd5, 0xbd6, 0xbd7, 0xbd8, 0xbd9, 775 0xbda, 0xbdb, 0xbdc, 0xbdd, 0xbde, 0xbdf, 0xbe0, 0xbe1, 776 0xbe2, 0xbe3, 0xbe4, 0xbe5, 0xbe6, 0xbe7, 0xbe8, 0xbe9, 777 0xbea, 0xbeb, 0xbec, 0xbed, 0xbee, 0xbef, 0xbf0, 0xbf1, 778 0xbf2, 0xbf3, 0xbf4, 0xbf5, 0xbf6, 0xbf7, 0xbf8, 0xbf9, 779 0xbfa, 0xbfb, 0xbfc, 0xbfd, 0xbfe, 0xbff, 0xd90, 0xda0, 780 0xdc0, 0xdc1, 0xdc2, 0xdc3, 0xdc4, 0xdc5, 0xdc6, 0xdc7, 781 0x40000000, 0x40000001, 0x40000002, 0x40000003, 0x40000010, 0x40000020, 0x40000022, 0x40000023, 782 0x40000070, 0x40000071, 0x40000072, 0x40000073, 0x40000080, 0x40000081, 0x40000082, 0x40000083, 783 0x40000084, 0x40000090, 0x40000091, 0x40000092, 0x40000093, 0x40000094, 0x40000095, 0x40000096, 784 0x40000097, 0x40000098, 0x40000099, 0x4000009a, 0x4000009b, 0x4000009c, 0x4000009d, 0x4000009e, 785 0x4000009f, 0x400000b0, 0x400000b1, 0x400000b2, 0x400000b3, 0x400000b4, 0x400000b5, 0x400000b6, 786 0x400000b7, 0x40000100, 0x40000101, 0x40000102, 0x40000103, 0x40000104, 0x40000105, 0x4b564d00, 787 0x4b564d01, 0x4b564d02, 0x4b564d03, 0x4b564d04, 0xc0000080, 0xc0000081, 0xc0000082, 0xc0000083, 788 0xc0000084, 0xc0000100, 0xc0000101, 0xc0000102, 0xc0000103, 0xc0000104, 0xc001001f, 0xc0010020, 789 0xc0010044, 0xc0010062, 0xc0010063, 0xc0010064, 0xc0010114, 0xc0010115, 0xc0010117, 0xc0010140, 790 0xc0010141, 0xc0011020, 0xc0011022, 0xc001102a, 0xc0011030, 0xc0011031, 0xc0011032, 0xc0011033, 791 0xc0011034, 0xc0011035, 0xc0011036, 0xc0011037, 0xc0011038, 0xc0011039, 0xc001103a, 0xc001103b, 792 0xc001103d, 793} 794