├── README.md
├── makednslog.zip
├── README.txt
├── domains.txt
├── LICENSE
├── COPYING.txt
└── makednslog.c


/README.md:
--------------------------------------------------------------------------------
1 | # ThreatHuntingExcursions
2 | Code, commands, and chatter about Threat Hunting.
3 | 


--------------------------------------------------------------------------------
/makednslog.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/jantonakos/ThreatHuntingExcursions/HEAD/makednslog.zip


--------------------------------------------------------------------------------
/README.txt:
--------------------------------------------------------------------------------
1 | This repository was created as a way to provide the Information Security
2 | community with any tools or files related to threat hunting. 
3 | 
4 | Please note that no malicious files are being stored in the repository.


--------------------------------------------------------------------------------
/domains.txt:
--------------------------------------------------------------------------------
   1 | server1.mcpmag.com
   2 | somecomputer.domain.com
   3 | quad.sub.domain.com
   4 | www.yahoo.com
   5 | pk.sub.domain.com
   6 | tertiary.domain.com
   7 | www.l.google.com
   8 | www.facebook.com
   9 | www.yahoo.com
  10 | messaging.microsoft.com
  11 | akamaiedge.net
  12 | twitter.com
  13 | grokdebug.herokuapp.com
  14 | www.cnn.com
  15 | www.target.com
  16 | www.facebook.com
  17 | www.champlain.edu
  18 | www.comptia.org
  19 | www.hightechcrimecops.org
  20 | www.youtube.com
  21 | www.excelsior.edu
  22 | tickets.ticketmaster.com
  23 | www.htcia.org
  24 | www.yahoo.com
  25 | www.nutsvolts.com
  26 | www.servo.com
  27 | www.circuitcellar.com
  28 | www.yahoo.com
  29 | www.offensive-security.com
  30 | vknowledge.net
  31 | www.hhs.gov
  32 | www.facebook.com
  33 | blog.techorganic.com
  34 | tzworks.net
  35 | www.tap.hesc.ny.gov
  36 | www.l.google.com
  37 | answers.microsoft.com
  38 | images.search.yahoo.com
  39 | sectools.org
  40 | www.yahoo.com
  41 | threatpost.org
  42 | www.linux.org
  43 | www.sans.edu
  44 | www.l.google.com
  45 | resources.infosecinstitute.com
  46 | www.nationalcybersecurityinstitute.com
  47 | www.ask.com
  48 | www.youtube.com
  49 | www.brighttalk.com
  50 | security.radware.com
  51 | www.decalage.info
  52 | sysforensics.org
  53 | reverseengineering.stackexchange.com
  54 | login.blogspot.com
  55 | twitter.com
  56 | www.howstuffworks.com
  57 | www.facebook.com
  58 | www.trustwave.com
  59 | openioc.org
  60 | www.l.google.com
  61 | blogs.rsa.com
  62 | securityintelligence.com
  63 | blog.malwarebytes.org
  64 | www.yahoo.com
  65 | www.techspot.com
  66 | datadrivensecurity.info
  67 | www.reddit.com
  68 | www.facebook.com
  69 | www.bro.org
  70 | logrythem.org
  71 | www.techexams.net
  72 | www.l.google.com
  73 | www.gartner.com
  74 | malware-traffic-analysis.net
  75 | isc.sans.edu
  76 | twitter.com
  77 | www.surveymonkey.com
  78 | blog.opensecurityresearch.com
  79 | www.youtube.com
  80 | www.yahoo.com
  81 | ad.doubleclick.net
  82 | www.contentprovider.com
  83 | www.acanac.ca
  84 | www.acfun.tv
  85 | www.adeventspermitgate.ae
  86 | www.adstuff.co.nz
  87 | www.afisha.ru
  88 | www.agrant.cn
  89 | www.aim.edu.au
  90 | www.aitonline.tv
  91 | www.alc.co.jp
  92 | www.allianzgi.it
  93 | www.alumni.mcgill.ca
  94 | www.americantourister.ca
  95 | www.ana.co.jp
  96 | www.angelina-paris.fr
  97 | www.anycard.ca
  98 | www.arabischesbuch.de
  99 | www.armstrongsbrandsource.ca
 100 | www.asahicom.rakuten.co.jp
 101 | www.athletebiz.us
 102 | www.audiaccessories.ca
 103 | www.auto.cz
 104 | www.autonet.ca
 105 | www.autotrader.ca
 106 | www.avis.ca
 107 | www.b-ms.de
 108 | www.baidu.cm
 109 | www.bankcardservices.co.uk
 110 | www.barbadostraveldeals.co.uk
 111 | www.bathescape.co.uk
 112 | www.bcparksvolunteers.ca
 113 | www.be-come.fr
 114 | www.bedroomfurnituregalleries.ca
 115 | www.bellmedia.ca
 116 | www.bergodesigns.ca
 117 | www.bgoperator.ru
 118 | www.bilecikhaber.com.tr
 119 | www.bitec.co.th
 120 | www.blencathra.org.uk
 121 | www.blogtoplist.se
 122 | www.bnn.ca
 123 | www.bokwang.co.id
 124 | www.boyner.com.tr
 125 | www.bravofly.es
 126 | www.britishgolfmuseum.co.uk
 127 | www.bsnl.in
 128 | www.buienradar.nl
 129 | www.buscouncil.ca
 130 | www.bytowndays.ca
 131 | www.calorizator.ru
 132 | www.cancer.ca
 133 | www.capitalistexploits.at
 134 | www.careerjet.ae
 135 | www.cartersoshkosh.ca
 136 | www.catho.com.br
 137 | www.cbc.radio-canada.ca
 138 | www.cbr.ru
 139 | www.celebrateevents.ca
 140 | www.centralbank.org.bb
 141 | www.cfdi.com.mx
 142 | www.cheapoair.ca
 143 | www.chevrolet.ca
 144 | www.chinadaily.com.cn
 145 | www.chiriottieditori.it
 146 | www.cibc.ca
 147 | www.cinepolis.com.co
 148 | www.citc.gov.sa
 149 | www.cityclub.com.mx
 150 | www.classifieds.lk
 151 | www.clipconverter.cc
 152 | www.cmhc-schl.gc.ca
 153 | www.cnt.gouv.qc.ca
 154 | www.coca-cola.com.mx
 155 | www.colgateprofessional.ca
 156 | www.commercialrealestate.com.au
 157 | www.conagua.gob.mx
 158 | www.conrad.nl
 159 | www.corby.ca
 160 | www.cosmogirl.com.tr
 161 | www.cpij.or.jp
 162 | www.crd.bc.ca
 163 | www.cruisecritic.com.au
 164 | www.ctvalberta.ca
 165 | www.cw.com.hk
 166 | www.cypres.com.mx
 167 | www.dailymail.co.uk
 168 | www.das-geschichtsbuch.de
 169 | www.debate.com.mx
 170 | www.denhelderstores.nl
 171 | www.destentor.nl
 172 | www.dha.com.tr
 173 | www.dib.ae
 174 | www.dintaifung.tw
 175 | www.dispatchlive.co.za
 176 | www.dln.com.hk
 177 | www.domainecanardblanc.qc.ca
 178 | www.dreamtv.com.tr
 179 | www.dubaiairports.ae
 180 | www.dunk.com.cn
 181 | www.e-taxes.gov.az
 182 | www.ebay-kleinanzeigen.de
 183 | www.edge.ca
 184 | www.educationpost.com.hk
 185 | www.eharmony.com.au
 186 | www.elcatrin.ca
 187 | www.elgrafico.mx
 188 | www.eluniversaldf.mx
 189 | www.enbici.eu
 190 | www.enterprise.ca
 191 | www.epost.ca
 192 | www.espcializados.es
 193 | www.etisalat.ae
 194 | www.europarl.europa.eu
 195 | www.eventim.co.uk
 196 | www.expedia.mx
 197 | www.ezbbq.com.sg
 198 | www.fairfaxmedia.co.nz
 199 | www.farandaway.us
 200 | www.fcp-pbdd.ru
 201 | www.ficelle.co.jp
 202 | www.firmy.cz
 203 | www.flyercity.ca
 204 | www.foodnetwork.ca
 205 | www.fordmustang.in
 206 | www.fr.tyrebaydirect.eu
 207 | www.frischekueche.at
 208 | www.fsjw.gov.cn
 209 | www.furnituregalaxy.ca
 210 | www.gaj2.suzhou.gov.cn
 211 | www.gamewallpapers.us
 212 | www.gatag.it
 213 | www.gdp.gov.sa
 214 | www.getconnect.fr
 215 | www.ghafla.co.ke
 216 | www.gismeteo.ru
 217 | www.gkvnet-ag.de
 218 | www.globalbuzz.in
 219 | www.gm.ca
 220 | www.go2hr.ca
 221 | www.goldbook.ca
 222 | www.goodle.ca
 223 | www.gosuslugi.ru
 224 | www.gov.uk
 225 | www.grazia.fr
 226 | www.grupoverticale.es
 227 | www.gtai.de
 228 | www.h-santos.es
 229 | www.halton.ca
 230 | www.hbwedding.co.uk
 231 | www.hearst.co.uk
 232 | www.hetnieuwerijden.nl
 233 | www.hirufm.lk
 234 | www.hmv.ca
 235 | www.homehardware.ca
 236 | www.hongthai.sg
 237 | www.hostcms.ru
 238 | www.hotelkoenigalbert.de
 239 | www.hovogliadidolce.it
 240 | www.hrpatoday.ca
 241 | www.huf-shop.de
 242 | www.humsafar.co.cc
 243 | www.ia.com.mx
 244 | www.icanto.ru
 245 | www.idea-awards.com.au
 246 | www.ihbarweb.org.tr
 247 | www.imgserver.ca
 248 | www.imperialpainting.ca
 249 | www.independent.co.uk
 250 | www.infinisoft.co.th
 251 | www.infonavit.org.mx
 252 | www.inspired-communications.ca
 253 | www.interep.com.br
 254 | www.investegate.co.uk
 255 | www.irishmirror.ie
 256 | www.itc.nl
 257 | www.jackfm.ca
 258 | www.jasperpizza.ca
 259 | www.jinjianghotels.com.cn
 260 | www.jma.go.jp
 261 | www.jobstreet.com.sg
 262 | www.jsciq.gov.cn
 263 | www.kamstrupspb.ru
 264 | www.kau.edu.sa
 265 | www.kia-villejuif.fr
 266 | www.kiids.de
 267 | www.kodap.ru
 268 | www.kraemer.de
 269 | www.ks.js.cn
 270 | www.kshrss.gov.cn
 271 | www.kuxun.cn
 272 | www.laeuropea.com.mx
 273 | www.lapresse.ca
 274 | www.lazada.vn
 275 | www.legifiscal.fr
 276 | www.lemuh.ch
 277 | www.lhotellerie-restauration.fr
 278 | www.lighting.philips.ca
 279 | www.lingvo-online.ru
 280 | www.littlefin.ca
 281 | www.llamadorevisiongm.mx
 282 | www.loudtronix.co
 283 | www.lula.ca
 284 | www.macworld.co.uk
 285 | www.mailadvertising.co.uk
 286 | www.malgre-nous.eu
 287 | www.manitowocfs.es
 288 | www.marcoriccardi.it
 289 | www.marriott.com.cn
 290 | www.mayaworld.cc
 291 | www.mcmaster.ca
 292 | www.media.highlight-led.de
 293 | www.mendocino.ca
 294 | www.meydangazetesi.com.tr
 295 | www.michaelhill.ca
 296 | www.miitbeian.gov.cn
 297 | www.milton.ca
 298 | www.mirror.co.uk
 299 | www.mixer.cz
 300 | www.mobilizejobs.ca
 301 | www.mofa.gov.ae
 302 | www.moneyhouse.de
 303 | www.motherhoodcanada.ca
 304 | www.mpoisk.ru
 305 | www.mummyliciousbeauty.co.uk
 306 | www.my.mail.ru
 307 | www.mymail.co.uk
 308 | www.myweddingplanning.in
 309 | www.nascarmexico.com.mx
 310 | www.ncwcd.gov.sa
 311 | www.net831.caisse-epargne.fr
 312 | www.newswire.ca
 313 | www.njam.tv
 314 | www.novenet.com.mx
 315 | www.nrigujarati.co.in
 316 | www.nus.edu.sg
 317 | www.nzhomeloans.co.nz
 318 | www.oberweis.lu
 319 | www.oeuvresduprince.ca
 320 | www.ok.ru
 321 | www.oneman.gr
 322 | www.opel.fr
 323 | www.orchardandthesea.ca
 324 | www.osym.gov.tr
 325 | www.owascovw.ca
 326 | www.pagesjaunes.ca
 327 | www.park2go.ca
 328 | www.partsengine.ca
 329 | www.payu.ru
 330 | www.pdfmagaz.in
 331 | www.pentalocal.ca
 332 | www.perthnow.com.au
 333 | www.philips.co.th
 334 | www.picnix.ca
 335 | www.plala.or.jp
 336 | www.pne.ca
 337 | www.polaris.fi
 338 | www.politico.eu
 339 | www.postbank.de
 340 | www.premex.com.mx
 341 | www.prevision-meteo.ch
 342 | www.privateproperty.co.za
 343 | www.propertyguru.com.sg
 344 | www.pueblaonline.com.mx
 345 | www.pvcar.pt
 346 | www.qld.gov.au
 347 | www.quicklane.ca
 348 | www.radio1.ch
 349 | www.rainbowzebra.co.uk
 350 | www.rav4.mx
 351 | www.rds.ca
 352 | www.recyclethis.co.uk
 353 | www.redpolitica.mx
 354 | www.remax.ca
 355 | www.reseaukia.fr
 356 | www.retrosupply.co
 357 | www.rian.ru
 358 | www.rock-the-kitchen.de
 359 | www.royalcollege.ca
 360 | www.rubena.cz
 361 | www.saaravita.lk
 362 | www.saldaposuda.ru
 363 | www.saosa.com.mx
 364 | www.sat.gob.mx
 365 | www.savigny.ch
 366 | www.scenic.ca
 367 | www.sd34.bc.ca
 368 | www.seeds.ca
 369 | www.sellact.de
 370 | www.service-public.fr
 371 | www.sevenoaksart.co.uk
 372 | www.sharebutton.co
 373 | www.shoeme.ca
 374 | www.silverspot.ch
 375 | www.sirlocal.pl
 376 | www.slimfigures.co.uk
 377 | www.smh.com.au
 378 | www.som.cranfield.ac.uk
 379 | www.soundandlightshow.ca
 380 | www.space.ca
 381 | www.spienn.comgel.de
 382 | www.sprint42.ru
 383 | www.standard.co.uk
 384 | www.starhit.ru
 385 | www.stern.de
 386 | www.strawpoll.me
 387 | www.stylepark.ru
 388 | www.sunlife.ca
 389 | www.swatch.ca
 390 | www.szgjj.gov.cn
 391 | www.taiwan.cn
 392 | www.tauck.ca
 393 | www.tcmb.gov.tr
 394 | www.techandecommerceawards.co.za
 395 | www.telegraph.co.uk
 396 | www.thaipbs.or.th
 397 | www.thecourier.co.uk
 398 | www.thekeen.co
 399 | www.therentalguide.ca
 400 | www.theweathernetwork.ca
 401 | www.thomascook.fr
 402 | www.ticketstonight.ca
 403 | www.timeslive.co.za
 404 | www.tootoo.cn
 405 | www.toppblogg.se
 406 | www.tourdafrique.co.za
 407 | www.toytraders.ca
 408 | www.trainpackages.ca
 409 | www.travelline.ru
 410 | www.tribute.ca
 411 | www.triplinx.ca
 412 | www.trustcenter.de
 413 | www.tunasgroup.co.id
 414 | www.tuusik.ee
 415 | www.tvtc.gov.sa
 416 | www.ufredbookstore.ca
 417 | www.unilad.co.uk
 418 | www.universodeportivo.mx
 419 | www.utc.fr
 420 | www.vdnh.ru
 421 | www.vice.cn
 422 | www.viralbladet.dk
 423 | www.vivanuncios.com.mx
 424 | www.volaris.mx
 425 | www.vsi-schmierstoffe.de
 426 | www.vwemissionsinfo.ca
 427 | www.w3school.com.cn
 428 | www.watson.ae
 429 | www.webienglish.cn
 430 | www.weightwatchers.ca
 431 | www.westin-osaka.co.jp
 432 | www.whisky.com.uy
 433 | www.wildberries.ru
 434 | www.winsport.ca
 435 | www.workabroad.ph
 436 | www.wp7.nl
 437 | www.xcaret.com.mx
 438 | www.xoximilco.com.mx
 439 | www.yallayalla.it
 440 | www.yellostrom.de
 441 | www.yomiuri.co.jp
 442 | www.yqhhy.cc
 443 | www.zattini.com.br
 444 | www.zielonagora.sport.pl
 445 | www.zonajobs.com.ar
 446 | www.zumvo.me
 447 | aal-shehata.com
 448 | aartsennsomers.net
 449 | ababaloka.com
 450 | abogadospericia.com
 451 | abou-digital.com
 452 | abudin.pswebstore.com
 453 | acosas.com
 454 | acountsercureservice.com
 455 | adheb.com
 456 | adm.ilmugendam.com
 457 | adminuseridservercra.from-id.com
 458 | admisoft.com
 459 | adrisport.com
 460 | afrisance.com
 461 | agosducatosweb.com
 462 | agreement4.gdmachinery.net
 463 | aguadolaw.com
 464 | alemeitu.com
 465 | aljeyad.net
 466 | all-about-you-sxm.com
 467 | allindiadesigners.com
 468 | aloneround.net
 469 | altosdecordoba.com
 470 | amazinggracefashion.com
 471 | ambassadorep.com
 472 | ambientmediaassociation.org
 473 | americahotgirls.com
 474 | amsfr.org
 475 | amslv.crabdance.com
 476 | anhui-rili.com
 477 | anwar-tiba.com
 478 | anzemah.com
 479 | aoneatm.com
 480 | aonikesi.com
 481 | apiparbion.com
 482 | apotekroxy.com
 483 | appie-restore.com
 484 | apple-cgy.com
 485 | apple-icilouds.com
 486 | apple-icloudn.com
 487 | apple-oxs-imessage.com
 488 | apple.com.reliableservice-co.com
 489 | appleid-verify.net
 490 | appleid.apple.idesecuronlines.com
 491 | appleid.apple.rieuremn.com
 492 | applepayment.brianfeed.com
 493 | ardillantas.com
 494 | aricimpastanesi.com
 495 | arrivabestsecurity.com
 496 | arthurwinley.com
 497 | aru1004.org
 498 | assurafric.com
 499 | astrosanjog.com
 500 | atousauniversal.com
 501 | atxinspection.com
 502 | aumu.com
 503 | austinbannerprint.com
 504 | austinoptionsrealestate.com
 505 | auth.forfait.forfait-orange-fr.com
 506 | averyandgreig.com
 507 | avokka.com
 508 | babycotsonline.com
 509 | bachecubano.com
 510 | backderecouvr-deswaie.com
 511 | badebilgisayar.com
 512 | bag86.com
 513 | bahisodam.com
 514 | bajucrony.com
 515 | balanaeguia.com
 516 | bancomers-enlinea-mx-net.net
 517 | banlk2.com
 518 | barelyhuman.net
 519 | barerootsgenealogy.com
 520 | batikconcept.com
 521 | bbspeaks249.com
 522 | bc.kuaiche.com
 523 | bcs-subjects.com
 524 | becjiewedding.com
 525 | bestfilesdownload.com
 526 | bestplasticsurgeontoronto.com
 527 | bestpoker4u.com
 528 | bestqualitytreatments.com
 529 | bhajankutir.vedicseasons.com
 530 | bhoocare.com
 531 | bienestarbien.org
 532 | bjharyles.com
 533 | bjpkaushikmachinery.com
 534 | bleilesupply.com
 535 | blockchaln.co.com
 536 | blrkelandbruk.com
 537 | bodiesbybridget.com
 538 | bonballoon.com
 539 | bookmark-ref-bookmarks-count.atwebpages.com
 540 | boulosfeghali.org
 541 | brokenheartart.net
 542 | c242k.com
 543 | cakpmm.org
 544 | camerashopny.com
 545 | caramecakes.com
 546 | caresupport-intl.com
 547 | casarurallacabezuela.com
 548 | casasdelight.com
 549 | cataldoproductions.com
 550 | cbtechrepairs.com
 551 | ccalpha.net
 552 | ccrum.net
 553 | cctvec.com
 554 | cdmswj.com
 555 | celesdigital.com
 556 | celexy.com
 557 | cgi7ebay.com
 558 | challengerent.com
 559 | chanen1.com
 560 | cherokeeclassof96.com
 561 | chlawhome.org
 562 | christhousechurch.org
 563 | christian-view.com
 564 | chunxiady.com
 565 | cienxcientoseguros.com
 566 | cimaproject.com
 567 | circuitair.com
 568 | civiljobsindia.com
 569 | clarejohnsontherapy.com
 570 | cleaning-position.com
 571 | cliente1.gugliandolo.com
 572 | cluster.wh.vtr.net
 573 | cndownmb.com
 574 | coatingaluminum.com
 575 | collectionkr.com
 576 | collegenation.net
 577 | collegeprepathletics.com
 578 | colorstreamdigital.net
 579 | comercializadoramarlo.com
 580 | complet-facture.pswebshop.com
 581 | conventofmercyros.com
 582 | coopsicreuniao.com
 583 | creationprintersbd.com
 584 | creditmutuel.fr-87.draytongossip.com
 585 | cuencarestaurants.com
 586 | curtiravida.com
 587 | customheavytimber.com
 588 | daltontvrepair.com
 589 | darkknightaurora.com
 590 | darshanautomotive.com
 591 | datatrinity.com
 592 | davidmc.com
 593 | ddirectdownload-about.com
 594 | ddkoo.com
 595 | dealsuzuki.com
 596 | deboedovengo.com
 597 | defygravity.com
 598 | degreesuccess.net
 599 | dekorasyontadilatiatasehir.com
 600 | denmarkflorist.com
 601 | dentalcamposoto.com
 602 | derenhukuk.com
 603 | desayunasano.com
 604 | designqaqc.com
 605 | designzer.com
 606 | desjardinslongueuil.com
 607 | dharold.com
 608 | dhdholding.com
 609 | diamariscreatejoy.com
 610 | diamondbladedealer.com
 611 | dicolourist.com
 612 | didi-apple.com
 613 | diegocerezo.com
 614 | dimpapanikolaoufurs.com
 615 | dimplexx.net
 616 | divyachemical.com
 617 | dog.halfbirthdayproducts.com
 618 | download.cdn.0023.78302.com
 619 | downloadri.com
 620 | downtownturkeytravel.com
 621 | dreamzteakforestry.com
 622 | dsdglobalresources.com
 623 | duhoey.com
 624 | eb5thomassenlawgroup.com
 625 | ebayreportitem272003404580.uhostfull.com
 626 | ecowaterprojects.com
 627 | edmartindentist.com
 628 | edsimportaciones.com
 629 | efdilokulu.com
 630 | efenditesisi.com
 631 | eggfred.com
 632 | electroimages.com
 633 | elfatehals.com
 634 | emailaccountverificatiemp.com
 635 | engineeringenterprise.net
 636 | erikacostruzioni.com
 637 | essentialoilkits.net
 638 | eternalfriendstv.com
 639 | etxlzx.net
 640 | euromerltd.com
 641 | evengritithan.com
 642 | eventsmagicph.com
 643 | eviestar.com
 644 | eyang-agung.com
 645 | fabianomotta.com
 646 | facehear.net
 647 | faithbasewealthgenerators.com
 648 | fastbreaklacrosse.net
 649 | fazeebook.com
 650 | featuressaloonspa.com
 651 | fecasing.com
 652 | federadosconeldeporte.com
 653 | feeds.nsdnsupdate.org
 654 | fideln.com
 655 | fightdemand.net
 656 | filetpgoog.com
 657 | fitnessnutritionreview.com
 658 | flextintas.com
 659 | flndmiphone.com
 660 | fondopatrimonial.com
 661 | footballbrasil.net
 662 | foreigntradebankplc.com
 663 | forkuniondriving.net
 664 | fox.websitewelcome.com
 665 | fsrelbd.com
 666 | gainover.net
 667 | gamanteles.com
 668 | ganarsininversion.com
 669 | gao1122.com
 670 | gavih.org
 671 | ge365.net
 672 | geekograffi.com
 673 | geoross.com
 674 | giantoutput.com
 675 | giltydream.com
 676 | giordanopk.com
 677 | giorgostsaousis.com
 678 | gitloinvestbud.com
 679 | giuko.com
 680 | global.glamourvila.com
 681 | globalcredithub.com
 682 | goblinada.net
 683 | goldenroadenterprises.com
 684 | gooddaywestchester.com
 685 | gootle.com
 686 | gov.ukgovernment.zecowen.com
 687 | gradiskapdp.org
 688 | graficasseryal.com
 689 | guelphrealestateagent.com
 690 | h3ds4.maconslab.com
 691 | haihuang-audio.com
 692 | hairguide.net
 693 | hairplace.net
 694 | hammervpn.net
 695 | hasurvey2015.com
 696 | hayagrivajyotisham.com
 697 | headwear.net
 698 | healththoroughfare.com
 699 | hellooyun.com
 700 | hescolor.com
 701 | hideocustom.com
 702 | himalayanherbsgarden.com
 703 | himalayanyogakendra.com
 704 | hjgk.net
 705 | honky.net
 706 | horyong.net
 707 | hoshiomi.yu-nagi.com
 708 | hotelcoromandel.com
 709 | hotelseapalacebd.com
 710 | howtoearnmoneyfromwebsite.com
 711 | hpwowbattle.net
 712 | htxvcl.com
 713 | hud.thesourcechagrin.net
 714 | humansound.net
 715 | hvmtindia.com
 716 | iacwindow.com
 717 | icctips.com
 718 | icemed.net
 719 | icitydavanagere.com
 720 | icloud-fa.com
 721 | icloud-find-itunes.com
 722 | icloud-goin.com
 723 | icloud-stoer.com
 724 | icloudisr.com
 725 | idcln.com
 726 | ifiia.com
 727 | ikontrend.com
 728 | imageprohosting.com
 729 | incapple.managesslservice.com
 730 | increasebattle.net
 731 | indiahostingsolutions.com
 732 | industrialdataanalytics.com
 733 | infoupdatecentertaxuser.servesarcasm.com
 734 | inkrepublique.com
 735 | inndl.com
 736 | insurancecondition.com
 737 | interiorwoods.com
 738 | ipromedics.com
 739 | irbistech.com
 740 | irevservice.com
 741 | islandhues.net
 742 | isolplus-tunisie.com
 743 | itechworldbd.com
 744 | itfindia.org
 745 | itunes-remind.com
 746 | itworms.com
 747 | iuiqjzqrlwx.yi.org
 748 | jairoregalado.com
 749 | jameser.com
 750 | jamilahui.com
 751 | jdcarr.com
 752 | jezzjackson.com
 753 | jherem.com
 754 | jipin180.com
 755 | jiridinsayphotography.com
 756 | jjc55.com
 757 | jmikespeck.com
 758 | jobventure.net
 759 | jocelyndonegan.com
 760 | johnsons-excavating.com
 761 | jokemrt.com
 762 | jordangood.com
 763 | joslinsalesltd.com
 764 | jovenescoparmexstam.com
 765 | jq9998.com
 766 | jscimport.com
 767 | jualsabunberas.com
 768 | jyotided.org
 769 | kat-gifts.com
 770 | kenyonblunt.com
 771 | kevingerman.com
 772 | kgpowersports.com
 773 | khoangiengthutiep.com
 774 | khonkaenstudio.com
 775 | kirkjellum.com
 776 | kitchenerflorist.com
 777 | klasste.tripod.com
 778 | kuebandung.com
 779 | lagovistatexoma.com
 780 | laiqukeji.com
 781 | laleven.com
 782 | largenumber.net
 783 | lashcollection.com
 784 | lavazone.org
 785 | learnworld.net
 786 | lecafecafe.com
 787 | letstile.com
 788 | lewinhosting.net
 789 | libertywise-profit.com
 790 | lifestylezones.com
 791 | lincos.net
 792 | linfenit.com
 793 | linnarbioenergy.com
 794 | liontarigroup.com
 795 | liqueur.juragan-followers.com
 796 | ljfreecredits.com
 797 | llo123.com
 798 | logint.santandermodulonet.com
 799 | lojasrana.com
 800 | lordhave.net
 801 | losmercantes.com
 802 | lospequenines.com
 803 | lost-aleart-findmyiphone.com
 804 | lpmxp2022.com
 805 | luksuzni-stanovi.com
 806 | macumberoloretano.com
 807 | magazinsumok.com
 808 | magiclifeent.com
 809 | magnumtubes.com
 810 | mahersportstherapy.com
 811 | maihama.2jikai-p.net
 812 | manadsapp.com
 813 | managangavaram.org
 814 | marashthermal.com
 815 | markstrailerparts.com
 816 | matakanaestatewine.com
 817 | matrixengtech.com
 818 | mckinleyhigh.org
 819 | mdsignsbog.com
 820 | medicalexportservice.com
 821 | medisonsteeltech.com
 822 | megafonealert.net
 823 | melsanazaria.com
 824 | member900115ym.com
 825 | membersconnects.com
 826 | membership-rewards.apex-automation.com
 827 | mesaia.ina-ka.com
 828 | michiganincome.com
 829 | microsearchstat.com
 830 | midvalleyrehab.com
 831 | milestoneabroad.com
 832 | militiaman.sewapompabeton.com
 833 | mirrorofstart.com
 834 | mismerizer.com
 835 | mizahturk.com
 836 | mobile.free-h.net
 837 | mobisoftbd.com
 838 | moblao.com
 839 | modplc.com
 840 | mogyang.net
 841 | moirapoh.com
 842 | monequipemobfree.com
 843 | mrktedge.com
 844 | mrusby.com
 845 | mtmoriahcogic.org
 846 | multiplusnet.com
 847 | musacelik.net
 848 | muscleinjuries.com
 849 | mvmart.com
 850 | mvsbuilders.com
 851 | myapologies.net
 852 | mymorningstore.com
 853 | mypcneedhelp.com
 854 | n3fumigaciones.net
 855 | nationalsecuritydirect.com
 856 | naturalbeautybathandbody.com
 857 | navyfederal.lyfapp.com
 858 | neglite.com
 859 | net4um.com
 860 | netempresa.starparksfr.com
 861 | netmarketinghq.com
 862 | neuroinvent.com
 863 | niagararealestateagent.com
 864 | nightcontrol.net
 865 | nikscomputers.com
 866 | nlazovic.mybesthost.com
 867 | nqpsra.yi.org
 868 | ns8087.websitewelcome.com
 869 | nskam.com
 870 | oezelotel.com
 871 | oficinavirtualccct.com
 872 | ogbonidesk.com
 873 | oismeark.com
 874 | ojaofs.com
 875 | okblack.com
 876 | olivetoursntravels.com
 877 | omglolrofl.com
 878 | oneniceprint.com
 879 | onfreesoftware.com
 880 | onlinedaa.com
 881 | onlineinfonabsecure.homeip.net
 882 | onlinepsychictips.com
 883 | organicasales.com
 884 | orientepro.com
 885 | orlandofamilyholiday.com
 886 | orunodoiprakashan.com
 887 | os9-apple-support.com
 888 | os9-verify-apple.com
 889 | oufala.com
 890 | ozaydesign.com
 891 | paceinfocomm.com
 892 | paddingtonpublicschool.com
 893 | paksoft.org
 894 | pamphlet.qw361.com
 895 | particuliers-impositions.com
 896 | patioumbrellas-utc.com
 897 | payseecure.com
 898 | pbnetassociate.com
 899 | pcupgrade.check4newupdates.net
 900 | pecantree.net
 901 | peterboroughmover.com
 902 | petiquettesouthboston.com
 903 | photofundays.com
 904 | pianolessonstampa.com
 905 | pimpwebpage.com
 906 | pizzachezmichel.com
 907 | platinumfitnessusvi.com
 908 | podarki-vkont.besaba.com
 909 | polskieprawo.net
 910 | ponchatoulakiss.com
 911 | poojaent.com
 912 | potbnb.com
 913 | poyday.com
 914 | pratikverma.com
 915 | premiumoutletshop.com
 916 | property1.gdmachinery.net
 917 | propertylaunchsales.com
 918 | prosperity.charifree.org
 919 | pypl-service.com
 920 | qualitychannel.com
 921 | queensrootcanal.com
 922 | questoequello.net
 923 | quinnpharma.com
 924 | qwepa.com
 925 | railrocket-italy.com
 926 | rapmusicplace.com
 927 | rb0577.com
 928 | realgreatfire.com
 929 | realtyproshop.com
 930 | regie-scene.com
 931 | returnfound.net
 932 | rexboothtradingroup.com
 933 | ribermad.com
 934 | riccardolocco.com
 935 | rocktree.net
 936 | roknasala.com
 937 | rt7890.com
 938 | rubinbashir.net
 939 | rvassistedliving.com
 940 | ryanrange.com
 941 | safariheroes.com
 942 | saishrushti.com
 943 | sales3.gdmachinery.net
 944 | sanderawel.com
 945 | sanfordcny.com
 946 | santander-registros.com
 947 | sararoceng81phpex.dotcloudapp.com
 948 | saraspastriesanddeli.com
 949 | saydadapps.com
 950 | scleramania.com
 951 | secondlifestore23.net16.net
 952 | secretskenya.com
 953 | secure-systemlogin.com
 954 | secure.lemondekor.com
 955 | security.center-activate.your.account.kimbre.com
 956 | self-defining.com
 957 | sentimentindia.com
 958 | serienplaner.com
 959 | server2.imaginamos.com
 960 | serviceadmin122.com
 961 | servicesuser-apps-ios.from-mo.com
 962 | shaheendevelopment.com
 963 | shammah.openbrazil.org
 964 | sherehindtipu.com
 965 | shhbndr.com
 966 | shophalloweenboutique.com
 967 | sidegra.net
 968 | sightshare.com
 969 | simpaticodentalstudio.com
 970 | singsweebeegroup.com
 971 | sisiwasiperu.com
 972 | skylineimportsales.com
 973 | snickersapp.com
 974 | soctracao.com
 975 | softlased.1536cashmere.com
 976 | softwarekioscos.com
 977 | sosflight.com
 978 | southernvermontstorm.com
 979 | spacechemgroup.com
 980 | spencersmill.com
 981 | ssl.login.skype.com.gohiding.com
 982 | sterlingandstonesjewelry.com
 983 | stylusyou.com
 984 | subhajitbanerjee.com
 985 | subjectsister.net
 986 | sunmel.com
 987 | suntbnk.meritnbweb.com
 988 | superbhotdeals.com
 989 | superelectronicsindia.com
 990 | supporthdit.16mb.com
 991 | supreme9events.com
 992 | supremefunds.com
 993 | surprisenotice.com
 994 | swacatha.com
 995 | swastikpolyvinyls.com
 996 | swatfservices.com
 997 | syyrzs.com
 998 | szzlzn.com
 999 | taibra26.com
1000 | take5withgod.org
1001 | tampaiphonerepair.com
1002 | tartadequesophiladelphia.com
1003 | taylortea.com
1004 | tazshascreations.com
1005 | techieprojects.com
1006 | tgrankin.com
1007 | theblocktvshow.com
1008 | theconroysflorist.com
1009 | thecourtyardcolfaxcom.sites.qwestoffice.net
1010 | thegoodnewsband.org
1011 | thegrilledburger.com
1012 | theposhteam.com
1013 | thequestforcrap.com
1014 | thesinglegirlinthecity.com
1015 | thespecialsearch.com
1016 | thomessag22-autotrade.com
1017 | tiantmall.com
1018 | toczymy.com
1019 | todopilas.com
1020 | travelandbookings.com
1021 | tripvidus.com
1022 | trpaulsen.com
1023 | trumbullcountycvb.org
1024 | tsws.org
1025 | tszedu.com
1026 | tumalodropshipping.com
1027 | tunesappsupport.com
1028 | u-products.com
1029 | udayinchetelangana.com
1030 | unsalvinc.com
1031 | urban-garden.net
1032 | usaaupdate-us.com
1033 | usinadaweb.com
1034 | vacationhomes365.com
1035 | vancouverrealestatebroker.com
1036 | verfi-id-appel.com
1037 | verifieer.com
1038 | verifysupportppl.com
1039 | verifythevote.com
1040 | vibrantyou.com
1041 | virt2241.unelink.net
1042 | vloyolablog.com
1043 | vulcanusventure.com
1044 | waitheight.net
1045 | walk-in-baths.com
1046 | watchbeen.net
1047 | weasuaair.net
1048 | web.kiaanevents.com
1049 | webappsverified.com
1050 | webthemedesigner.com
1051 | wellwash.net
1052 | wfwf1011.warabuki.net
1053 | whippanygyms.com
1054 | wishfood.net
1055 | wm5u.com
1056 | womenbeautyconcepts.com
1057 | wp.zontown.com
1058 | wpodosail.com
1059 | www.awalkerjones.com
1060 | www.etiennodent.com
1061 | www.lydaoyou.com
1062 | www.qhdast.com
1063 | www.us.kctctour.com
1064 | www.usaphotocopyservice.com
1065 | www.xntk.net
1066 | www.yntscp.com
1067 | xiaoyaojsq.net
1068 | xigushan.com
1069 | xioooo.com
1070 | xiugaiba.com
1071 | xr.flyboytees.com
1072 | xxxiooo.com
1073 | xyxsol.com
1074 | yamintl.com
1075 | yclydq.com
1076 | yeniyuzyillions.org
1077 | yeshigongzhu.com
1078 | yttestsite.com
1079 | zalevichfilms.com
1080 | zambianscorpion.com
1081 | zarayaadkar.com
1082 | zgfhl.com
1083 | zhongguociwang.com
1084 | zumutor.com
1085 | zzha.net
1086 | zzmyw.com
1087 | /END/


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 3, 29 June 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 |                             Preamble
  9 | 
 10 |   The GNU General Public License is a free, copyleft license for
 11 | software and other kinds of works.
 12 | 
 13 |   The licenses for most software and other practical works are designed
 14 | to take away your freedom to share and change the works.  By contrast,
 15 | the GNU General Public License is intended to guarantee your freedom to
 16 | share and change all versions of a program--to make sure it remains free
 17 | software for all its users.  We, the Free Software Foundation, use the
 18 | GNU General Public License for most of our software; it applies also to
 19 | any other work released this way by its authors.  You can apply it to
 20 | your programs, too.
 21 | 
 22 |   When we speak of free software, we are referring to freedom, not
 23 | price.  Our General Public Licenses are designed to make sure that you
 24 | have the freedom to distribute copies of free software (and charge for
 25 | them if you wish), that you receive source code or can get it if you
 26 | want it, that you can change the software or use pieces of it in new
 27 | free programs, and that you know you can do these things.
 28 | 
 29 |   To protect your rights, we need to prevent others from denying you
 30 | these rights or asking you to surrender the rights.  Therefore, you have
 31 | certain responsibilities if you distribute copies of the software, or if
 32 | you modify it: responsibilities to respect the freedom of others.
 33 | 
 34 |   For example, if you distribute copies of such a program, whether
 35 | gratis or for a fee, you must pass on to the recipients the same
 36 | freedoms that you received.  You must make sure that they, too, receive
 37 | or can get the source code.  And you must show them these terms so they
 38 | know their rights.
 39 | 
 40 |   Developers that use the GNU GPL protect your rights with two steps:
 41 | (1) assert copyright on the software, and (2) offer you this License
 42 | giving you legal permission to copy, distribute and/or modify it.
 43 | 
 44 |   For the developers' and authors' protection, the GPL clearly explains
 45 | that there is no warranty for this free software.  For both users' and
 46 | authors' sake, the GPL requires that modified versions be marked as
 47 | changed, so that their problems will not be attributed erroneously to
 48 | authors of previous versions.
 49 | 
 50 |   Some devices are designed to deny users access to install or run
 51 | modified versions of the software inside them, although the manufacturer
 52 | can do so.  This is fundamentally incompatible with the aim of
 53 | protecting users' freedom to change the software.  The systematic
 54 | pattern of such abuse occurs in the area of products for individuals to
 55 | use, which is precisely where it is most unacceptable.  Therefore, we
 56 | have designed this version of the GPL to prohibit the practice for those
 57 | products.  If such problems arise substantially in other domains, we
 58 | stand ready to extend this provision to those domains in future versions
 59 | of the GPL, as needed to protect the freedom of users.
 60 | 
 61 |   Finally, every program is threatened constantly by software patents.
 62 | States should not allow patents to restrict development and use of
 63 | software on general-purpose computers, but in those that do, we wish to
 64 | avoid the special danger that patents applied to a free program could
 65 | make it effectively proprietary.  To prevent this, the GPL assures that
 66 | patents cannot be used to render the program non-free.
 67 | 
 68 |   The precise terms and conditions for copying, distribution and
 69 | modification follow.
 70 | 
 71 |                        TERMS AND CONDITIONS
 72 | 
 73 |   0. Definitions.
 74 | 
 75 |   "This License" refers to version 3 of the GNU General Public License.
 76 | 
 77 |   "Copyright" also means copyright-like laws that apply to other kinds of
 78 | works, such as semiconductor masks.
 79 | 
 80 |   "The Program" refers to any copyrightable work licensed under this
 81 | License.  Each licensee is addressed as "you".  "Licensees" and
 82 | "recipients" may be individuals or organizations.
 83 | 
 84 |   To "modify" a work means to copy from or adapt all or part of the work
 85 | in a fashion requiring copyright permission, other than the making of an
 86 | exact copy.  The resulting work is called a "modified version" of the
 87 | earlier work or a work "based on" the earlier work.
 88 | 
 89 |   A "covered work" means either the unmodified Program or a work based
 90 | on the Program.
 91 | 
 92 |   To "propagate" a work means to do anything with it that, without
 93 | permission, would make you directly or secondarily liable for
 94 | infringement under applicable copyright law, except executing it on a
 95 | computer or modifying a private copy.  Propagation includes copying,
 96 | distribution (with or without modification), making available to the
 97 | public, and in some countries other activities as well.
 98 | 
 99 |   To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies.  Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 | 
103 |   An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License.  If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 | 
112 |   1. Source Code.
113 | 
114 |   The "source code" for a work means the preferred form of the work
115 | for making modifications to it.  "Object code" means any non-source
116 | form of a work.
117 | 
118 |   A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 | 
123 |   The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form.  A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 | 
134 |   The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities.  However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work.  For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 | 
147 |   The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 | 
151 |   The Corresponding Source for a work in source code form is that
152 | same work.
153 | 
154 |   2. Basic Permissions.
155 | 
156 |   All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met.  This License explicitly affirms your unlimited
159 | permission to run the unmodified Program.  The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work.  This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 | 
164 |   You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force.  You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright.  Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 | 
175 |   Conveying under any other circumstances is permitted solely under
176 | the conditions stated below.  Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 | 
179 |   3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 | 
181 |   No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 | 
187 |   When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 | 
195 |   4. Conveying Verbatim Copies.
196 | 
197 |   You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 | 
205 |   You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 | 
208 |   5. Conveying Modified Source Versions.
209 | 
210 |   You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 | 
214 |     a) The work must carry prominent notices stating that you modified
215 |     it, and giving a relevant date.
216 | 
217 |     b) The work must carry prominent notices stating that it is
218 |     released under this License and any conditions added under section
219 |     7.  This requirement modifies the requirement in section 4 to
220 |     "keep intact all notices".
221 | 
222 |     c) You must license the entire work, as a whole, under this
223 |     License to anyone who comes into possession of a copy.  This
224 |     License will therefore apply, along with any applicable section 7
225 |     additional terms, to the whole of the work, and all its parts,
226 |     regardless of how they are packaged.  This License gives no
227 |     permission to license the work in any other way, but it does not
228 |     invalidate such permission if you have separately received it.
229 | 
230 |     d) If the work has interactive user interfaces, each must display
231 |     Appropriate Legal Notices; however, if the Program has interactive
232 |     interfaces that do not display Appropriate Legal Notices, your
233 |     work need not make them do so.
234 | 
235 |   A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit.  Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 | 
245 |   6. Conveying Non-Source Forms.
246 | 
247 |   You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 | 
252 |     a) Convey the object code in, or embodied in, a physical product
253 |     (including a physical distribution medium), accompanied by the
254 |     Corresponding Source fixed on a durable physical medium
255 |     customarily used for software interchange.
256 | 
257 |     b) Convey the object code in, or embodied in, a physical product
258 |     (including a physical distribution medium), accompanied by a
259 |     written offer, valid for at least three years and valid for as
260 |     long as you offer spare parts or customer support for that product
261 |     model, to give anyone who possesses the object code either (1) a
262 |     copy of the Corresponding Source for all the software in the
263 |     product that is covered by this License, on a durable physical
264 |     medium customarily used for software interchange, for a price no
265 |     more than your reasonable cost of physically performing this
266 |     conveying of source, or (2) access to copy the
267 |     Corresponding Source from a network server at no charge.
268 | 
269 |     c) Convey individual copies of the object code with a copy of the
270 |     written offer to provide the Corresponding Source.  This
271 |     alternative is allowed only occasionally and noncommercially, and
272 |     only if you received the object code with such an offer, in accord
273 |     with subsection 6b.
274 | 
275 |     d) Convey the object code by offering access from a designated
276 |     place (gratis or for a charge), and offer equivalent access to the
277 |     Corresponding Source in the same way through the same place at no
278 |     further charge.  You need not require recipients to copy the
279 |     Corresponding Source along with the object code.  If the place to
280 |     copy the object code is a network server, the Corresponding Source
281 |     may be on a different server (operated by you or a third party)
282 |     that supports equivalent copying facilities, provided you maintain
283 |     clear directions next to the object code saying where to find the
284 |     Corresponding Source.  Regardless of what server hosts the
285 |     Corresponding Source, you remain obligated to ensure that it is
286 |     available for as long as needed to satisfy these requirements.
287 | 
288 |     e) Convey the object code using peer-to-peer transmission, provided
289 |     you inform other peers where the object code and Corresponding
290 |     Source of the work are being offered to the general public at no
291 |     charge under subsection 6d.
292 | 
293 |   A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 | 
297 |   A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling.  In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage.  For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product.  A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 | 
310 |   "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source.  The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 | 
318 |   If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information.  But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 | 
329 |   The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed.  Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 | 
337 |   Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 | 
343 |   7. Additional Terms.
344 | 
345 |   "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law.  If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 | 
354 |   When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it.  (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.)  You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 | 
361 |   Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 | 
365 |     a) Disclaiming warranty or limiting liability differently from the
366 |     terms of sections 15 and 16 of this License; or
367 | 
368 |     b) Requiring preservation of specified reasonable legal notices or
369 |     author attributions in that material or in the Appropriate Legal
370 |     Notices displayed by works containing it; or
371 | 
372 |     c) Prohibiting misrepresentation of the origin of that material, or
373 |     requiring that modified versions of such material be marked in
374 |     reasonable ways as different from the original version; or
375 | 
376 |     d) Limiting the use for publicity purposes of names of licensors or
377 |     authors of the material; or
378 | 
379 |     e) Declining to grant rights under trademark law for use of some
380 |     trade names, trademarks, or service marks; or
381 | 
382 |     f) Requiring indemnification of licensors and authors of that
383 |     material by anyone who conveys the material (or modified versions of
384 |     it) with contractual assumptions of liability to the recipient, for
385 |     any liability that these contractual assumptions directly impose on
386 |     those licensors and authors.
387 | 
388 |   All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10.  If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term.  If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 | 
398 |   If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 | 
403 |   Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 | 
407 |   8. Termination.
408 | 
409 |   You may not propagate or modify a covered work except as expressly
410 | provided under this License.  Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 | 
415 |   However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 | 
422 |   Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 | 
429 |   Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License.  If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 | 
435 |   9. Acceptance Not Required for Having Copies.
436 | 
437 |   You are not required to accept this License in order to receive or
438 | run a copy of the Program.  Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance.  However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work.  These actions infringe copyright if you do
443 | not accept this License.  Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 | 
446 |   10. Automatic Licensing of Downstream Recipients.
447 | 
448 |   Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License.  You are not responsible
451 | for enforcing compliance by third parties with this License.
452 | 
453 |   An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations.  If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 | 
463 |   You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License.  For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 | 
471 |   11. Patents.
472 | 
473 |   A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based.  The
475 | work thus licensed is called the contributor's "contributor version".
476 | 
477 |   A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version.  For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 | 
487 |   Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 | 
492 |   In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement).  To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 | 
499 |   If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients.  "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 | 
513 |   If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 | 
521 |   A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License.  You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 | 
536 |   Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 | 
540 |   12. No Surrender of Others' Freedom.
541 | 
542 |   If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License.  If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all.  For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 | 
552 |   13. Use with the GNU Affero General Public License.
553 | 
554 |   Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work.  The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 | 
563 |   14. Revised Versions of this License.
564 | 
565 |   The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time.  Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 | 
570 |   Each version is given a distinguishing version number.  If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation.  If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 | 
579 |   If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 | 
584 |   Later license versions may give you additional or different
585 | permissions.  However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 | 
589 |   15. Disclaimer of Warranty.
590 | 
591 |   THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 | 
600 |   16. Limitation of Liability.
601 | 
602 |   IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 | 
612 |   17. Interpretation of Sections 15 and 16.
613 | 
614 |   If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 | 
621 |                      END OF TERMS AND CONDITIONS
622 | 
623 |             How to Apply These Terms to Your New Programs
624 | 
625 |   If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 | 
629 |   To do so, attach the following notices to the program.  It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 | 
634 |     {one line to give the program's name and a brief idea of what it does.}
635 |     Copyright (C) {year}  {name of author}
636 | 
637 |     This program is free software: you can redistribute it and/or modify
638 |     it under the terms of the GNU General Public License as published by
639 |     the Free Software Foundation, either version 3 of the License, or
640 |     (at your option) any later version.
641 | 
642 |     This program is distributed in the hope that it will be useful,
643 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
644 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
645 |     GNU General Public License for more details.
646 | 
647 |     You should have received a copy of the GNU General Public License
648 |     along with this program.  If not, see <http://www.gnu.org/licenses/>.
649 | 
650 | Also add information on how to contact you by electronic and paper mail.
651 | 
652 |   If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 | 
655 |     {project}  Copyright (C) {year}  {fullname}
656 |     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 |     This is free software, and you are welcome to redistribute it
658 |     under certain conditions; type `show c' for details.
659 | 
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License.  Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 | 
664 |   You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | <http://www.gnu.org/licenses/>.
668 | 
669 |   The GNU General Public License does not permit incorporating your program
670 | into proprietary programs.  If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library.  If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License.  But first, please read
674 | <http://www.gnu.org/philosophy/why-not-lgpl.html>.
675 | 


--------------------------------------------------------------------------------
/COPYING.txt:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 3, 29 June 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 |                             Preamble
  9 | 
 10 |   The GNU General Public License is a free, copyleft license for
 11 | software and other kinds of works.
 12 | 
 13 |   The licenses for most software and other practical works are designed
 14 | to take away your freedom to share and change the works.  By contrast,
 15 | the GNU General Public License is intended to guarantee your freedom to
 16 | share and change all versions of a program--to make sure it remains free
 17 | software for all its users.  We, the Free Software Foundation, use the
 18 | GNU General Public License for most of our software; it applies also to
 19 | any other work released this way by its authors.  You can apply it to
 20 | your programs, too.
 21 | 
 22 |   When we speak of free software, we are referring to freedom, not
 23 | price.  Our General Public Licenses are designed to make sure that you
 24 | have the freedom to distribute copies of free software (and charge for
 25 | them if you wish), that you receive source code or can get it if you
 26 | want it, that you can change the software or use pieces of it in new
 27 | free programs, and that you know you can do these things.
 28 | 
 29 |   To protect your rights, we need to prevent others from denying you
 30 | these rights or asking you to surrender the rights.  Therefore, you have
 31 | certain responsibilities if you distribute copies of the software, or if
 32 | you modify it: responsibilities to respect the freedom of others.
 33 | 
 34 |   For example, if you distribute copies of such a program, whether
 35 | gratis or for a fee, you must pass on to the recipients the same
 36 | freedoms that you received.  You must make sure that they, too, receive
 37 | or can get the source code.  And you must show them these terms so they
 38 | know their rights.
 39 | 
 40 |   Developers that use the GNU GPL protect your rights with two steps:
 41 | (1) assert copyright on the software, and (2) offer you this License
 42 | giving you legal permission to copy, distribute and/or modify it.
 43 | 
 44 |   For the developers' and authors' protection, the GPL clearly explains
 45 | that there is no warranty for this free software.  For both users' and
 46 | authors' sake, the GPL requires that modified versions be marked as
 47 | changed, so that their problems will not be attributed erroneously to
 48 | authors of previous versions.
 49 | 
 50 |   Some devices are designed to deny users access to install or run
 51 | modified versions of the software inside them, although the manufacturer
 52 | can do so.  This is fundamentally incompatible with the aim of
 53 | protecting users' freedom to change the software.  The systematic
 54 | pattern of such abuse occurs in the area of products for individuals to
 55 | use, which is precisely where it is most unacceptable.  Therefore, we
 56 | have designed this version of the GPL to prohibit the practice for those
 57 | products.  If such problems arise substantially in other domains, we
 58 | stand ready to extend this provision to those domains in future versions
 59 | of the GPL, as needed to protect the freedom of users.
 60 | 
 61 |   Finally, every program is threatened constantly by software patents.
 62 | States should not allow patents to restrict development and use of
 63 | software on general-purpose computers, but in those that do, we wish to
 64 | avoid the special danger that patents applied to a free program could
 65 | make it effectively proprietary.  To prevent this, the GPL assures that
 66 | patents cannot be used to render the program non-free.
 67 | 
 68 |   The precise terms and conditions for copying, distribution and
 69 | modification follow.
 70 | 
 71 |                        TERMS AND CONDITIONS
 72 | 
 73 |   0. Definitions.
 74 | 
 75 |   "This License" refers to version 3 of the GNU General Public License.
 76 | 
 77 |   "Copyright" also means copyright-like laws that apply to other kinds of
 78 | works, such as semiconductor masks.
 79 | 
 80 |   "The Program" refers to any copyrightable work licensed under this
 81 | License.  Each licensee is addressed as "you".  "Licensees" and
 82 | "recipients" may be individuals or organizations.
 83 | 
 84 |   To "modify" a work means to copy from or adapt all or part of the work
 85 | in a fashion requiring copyright permission, other than the making of an
 86 | exact copy.  The resulting work is called a "modified version" of the
 87 | earlier work or a work "based on" the earlier work.
 88 | 
 89 |   A "covered work" means either the unmodified Program or a work based
 90 | on the Program.
 91 | 
 92 |   To "propagate" a work means to do anything with it that, without
 93 | permission, would make you directly or secondarily liable for
 94 | infringement under applicable copyright law, except executing it on a
 95 | computer or modifying a private copy.  Propagation includes copying,
 96 | distribution (with or without modification), making available to the
 97 | public, and in some countries other activities as well.
 98 | 
 99 |   To "convey" a work means any kind of propagation that enables other
100 | parties to make or receive copies.  Mere interaction with a user through
101 | a computer network, with no transfer of a copy, is not conveying.
102 | 
103 |   An interactive user interface displays "Appropriate Legal Notices"
104 | to the extent that it includes a convenient and prominently visible
105 | feature that (1) displays an appropriate copyright notice, and (2)
106 | tells the user that there is no warranty for the work (except to the
107 | extent that warranties are provided), that licensees may convey the
108 | work under this License, and how to view a copy of this License.  If
109 | the interface presents a list of user commands or options, such as a
110 | menu, a prominent item in the list meets this criterion.
111 | 
112 |   1. Source Code.
113 | 
114 |   The "source code" for a work means the preferred form of the work
115 | for making modifications to it.  "Object code" means any non-source
116 | form of a work.
117 | 
118 |   A "Standard Interface" means an interface that either is an official
119 | standard defined by a recognized standards body, or, in the case of
120 | interfaces specified for a particular programming language, one that
121 | is widely used among developers working in that language.
122 | 
123 |   The "System Libraries" of an executable work include anything, other
124 | than the work as a whole, that (a) is included in the normal form of
125 | packaging a Major Component, but which is not part of that Major
126 | Component, and (b) serves only to enable use of the work with that
127 | Major Component, or to implement a Standard Interface for which an
128 | implementation is available to the public in source code form.  A
129 | "Major Component", in this context, means a major essential component
130 | (kernel, window system, and so on) of the specific operating system
131 | (if any) on which the executable work runs, or a compiler used to
132 | produce the work, or an object code interpreter used to run it.
133 | 
134 |   The "Corresponding Source" for a work in object code form means all
135 | the source code needed to generate, install, and (for an executable
136 | work) run the object code and to modify the work, including scripts to
137 | control those activities.  However, it does not include the work's
138 | System Libraries, or general-purpose tools or generally available free
139 | programs which are used unmodified in performing those activities but
140 | which are not part of the work.  For example, Corresponding Source
141 | includes interface definition files associated with source files for
142 | the work, and the source code for shared libraries and dynamically
143 | linked subprograms that the work is specifically designed to require,
144 | such as by intimate data communication or control flow between those
145 | subprograms and other parts of the work.
146 | 
147 |   The Corresponding Source need not include anything that users
148 | can regenerate automatically from other parts of the Corresponding
149 | Source.
150 | 
151 |   The Corresponding Source for a work in source code form is that
152 | same work.
153 | 
154 |   2. Basic Permissions.
155 | 
156 |   All rights granted under this License are granted for the term of
157 | copyright on the Program, and are irrevocable provided the stated
158 | conditions are met.  This License explicitly affirms your unlimited
159 | permission to run the unmodified Program.  The output from running a
160 | covered work is covered by this License only if the output, given its
161 | content, constitutes a covered work.  This License acknowledges your
162 | rights of fair use or other equivalent, as provided by copyright law.
163 | 
164 |   You may make, run and propagate covered works that you do not
165 | convey, without conditions so long as your license otherwise remains
166 | in force.  You may convey covered works to others for the sole purpose
167 | of having them make modifications exclusively for you, or provide you
168 | with facilities for running those works, provided that you comply with
169 | the terms of this License in conveying all material for which you do
170 | not control copyright.  Those thus making or running the covered works
171 | for you must do so exclusively on your behalf, under your direction
172 | and control, on terms that prohibit them from making any copies of
173 | your copyrighted material outside their relationship with you.
174 | 
175 |   Conveying under any other circumstances is permitted solely under
176 | the conditions stated below.  Sublicensing is not allowed; section 10
177 | makes it unnecessary.
178 | 
179 |   3. Protecting Users' Legal Rights From Anti-Circumvention Law.
180 | 
181 |   No covered work shall be deemed part of an effective technological
182 | measure under any applicable law fulfilling obligations under article
183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
184 | similar laws prohibiting or restricting circumvention of such
185 | measures.
186 | 
187 |   When you convey a covered work, you waive any legal power to forbid
188 | circumvention of technological measures to the extent such circumvention
189 | is effected by exercising rights under this License with respect to
190 | the covered work, and you disclaim any intention to limit operation or
191 | modification of the work as a means of enforcing, against the work's
192 | users, your or third parties' legal rights to forbid circumvention of
193 | technological measures.
194 | 
195 |   4. Conveying Verbatim Copies.
196 | 
197 |   You may convey verbatim copies of the Program's source code as you
198 | receive it, in any medium, provided that you conspicuously and
199 | appropriately publish on each copy an appropriate copyright notice;
200 | keep intact all notices stating that this License and any
201 | non-permissive terms added in accord with section 7 apply to the code;
202 | keep intact all notices of the absence of any warranty; and give all
203 | recipients a copy of this License along with the Program.
204 | 
205 |   You may charge any price or no price for each copy that you convey,
206 | and you may offer support or warranty protection for a fee.
207 | 
208 |   5. Conveying Modified Source Versions.
209 | 
210 |   You may convey a work based on the Program, or the modifications to
211 | produce it from the Program, in the form of source code under the
212 | terms of section 4, provided that you also meet all of these conditions:
213 | 
214 |     a) The work must carry prominent notices stating that you modified
215 |     it, and giving a relevant date.
216 | 
217 |     b) The work must carry prominent notices stating that it is
218 |     released under this License and any conditions added under section
219 |     7.  This requirement modifies the requirement in section 4 to
220 |     "keep intact all notices".
221 | 
222 |     c) You must license the entire work, as a whole, under this
223 |     License to anyone who comes into possession of a copy.  This
224 |     License will therefore apply, along with any applicable section 7
225 |     additional terms, to the whole of the work, and all its parts,
226 |     regardless of how they are packaged.  This License gives no
227 |     permission to license the work in any other way, but it does not
228 |     invalidate such permission if you have separately received it.
229 | 
230 |     d) If the work has interactive user interfaces, each must display
231 |     Appropriate Legal Notices; however, if the Program has interactive
232 |     interfaces that do not display Appropriate Legal Notices, your
233 |     work need not make them do so.
234 | 
235 |   A compilation of a covered work with other separate and independent
236 | works, which are not by their nature extensions of the covered work,
237 | and which are not combined with it such as to form a larger program,
238 | in or on a volume of a storage or distribution medium, is called an
239 | "aggregate" if the compilation and its resulting copyright are not
240 | used to limit the access or legal rights of the compilation's users
241 | beyond what the individual works permit.  Inclusion of a covered work
242 | in an aggregate does not cause this License to apply to the other
243 | parts of the aggregate.
244 | 
245 |   6. Conveying Non-Source Forms.
246 | 
247 |   You may convey a covered work in object code form under the terms
248 | of sections 4 and 5, provided that you also convey the
249 | machine-readable Corresponding Source under the terms of this License,
250 | in one of these ways:
251 | 
252 |     a) Convey the object code in, or embodied in, a physical product
253 |     (including a physical distribution medium), accompanied by the
254 |     Corresponding Source fixed on a durable physical medium
255 |     customarily used for software interchange.
256 | 
257 |     b) Convey the object code in, or embodied in, a physical product
258 |     (including a physical distribution medium), accompanied by a
259 |     written offer, valid for at least three years and valid for as
260 |     long as you offer spare parts or customer support for that product
261 |     model, to give anyone who possesses the object code either (1) a
262 |     copy of the Corresponding Source for all the software in the
263 |     product that is covered by this License, on a durable physical
264 |     medium customarily used for software interchange, for a price no
265 |     more than your reasonable cost of physically performing this
266 |     conveying of source, or (2) access to copy the
267 |     Corresponding Source from a network server at no charge.
268 | 
269 |     c) Convey individual copies of the object code with a copy of the
270 |     written offer to provide the Corresponding Source.  This
271 |     alternative is allowed only occasionally and noncommercially, and
272 |     only if you received the object code with such an offer, in accord
273 |     with subsection 6b.
274 | 
275 |     d) Convey the object code by offering access from a designated
276 |     place (gratis or for a charge), and offer equivalent access to the
277 |     Corresponding Source in the same way through the same place at no
278 |     further charge.  You need not require recipients to copy the
279 |     Corresponding Source along with the object code.  If the place to
280 |     copy the object code is a network server, the Corresponding Source
281 |     may be on a different server (operated by you or a third party)
282 |     that supports equivalent copying facilities, provided you maintain
283 |     clear directions next to the object code saying where to find the
284 |     Corresponding Source.  Regardless of what server hosts the
285 |     Corresponding Source, you remain obligated to ensure that it is
286 |     available for as long as needed to satisfy these requirements.
287 | 
288 |     e) Convey the object code using peer-to-peer transmission, provided
289 |     you inform other peers where the object code and Corresponding
290 |     Source of the work are being offered to the general public at no
291 |     charge under subsection 6d.
292 | 
293 |   A separable portion of the object code, whose source code is excluded
294 | from the Corresponding Source as a System Library, need not be
295 | included in conveying the object code work.
296 | 
297 |   A "User Product" is either (1) a "consumer product", which means any
298 | tangible personal property which is normally used for personal, family,
299 | or household purposes, or (2) anything designed or sold for incorporation
300 | into a dwelling.  In determining whether a product is a consumer product,
301 | doubtful cases shall be resolved in favor of coverage.  For a particular
302 | product received by a particular user, "normally used" refers to a
303 | typical or common use of that class of product, regardless of the status
304 | of the particular user or of the way in which the particular user
305 | actually uses, or expects or is expected to use, the product.  A product
306 | is a consumer product regardless of whether the product has substantial
307 | commercial, industrial or non-consumer uses, unless such uses represent
308 | the only significant mode of use of the product.
309 | 
310 |   "Installation Information" for a User Product means any methods,
311 | procedures, authorization keys, or other information required to install
312 | and execute modified versions of a covered work in that User Product from
313 | a modified version of its Corresponding Source.  The information must
314 | suffice to ensure that the continued functioning of the modified object
315 | code is in no case prevented or interfered with solely because
316 | modification has been made.
317 | 
318 |   If you convey an object code work under this section in, or with, or
319 | specifically for use in, a User Product, and the conveying occurs as
320 | part of a transaction in which the right of possession and use of the
321 | User Product is transferred to the recipient in perpetuity or for a
322 | fixed term (regardless of how the transaction is characterized), the
323 | Corresponding Source conveyed under this section must be accompanied
324 | by the Installation Information.  But this requirement does not apply
325 | if neither you nor any third party retains the ability to install
326 | modified object code on the User Product (for example, the work has
327 | been installed in ROM).
328 | 
329 |   The requirement to provide Installation Information does not include a
330 | requirement to continue to provide support service, warranty, or updates
331 | for a work that has been modified or installed by the recipient, or for
332 | the User Product in which it has been modified or installed.  Access to a
333 | network may be denied when the modification itself materially and
334 | adversely affects the operation of the network or violates the rules and
335 | protocols for communication across the network.
336 | 
337 |   Corresponding Source conveyed, and Installation Information provided,
338 | in accord with this section must be in a format that is publicly
339 | documented (and with an implementation available to the public in
340 | source code form), and must require no special password or key for
341 | unpacking, reading or copying.
342 | 
343 |   7. Additional Terms.
344 | 
345 |   "Additional permissions" are terms that supplement the terms of this
346 | License by making exceptions from one or more of its conditions.
347 | Additional permissions that are applicable to the entire Program shall
348 | be treated as though they were included in this License, to the extent
349 | that they are valid under applicable law.  If additional permissions
350 | apply only to part of the Program, that part may be used separately
351 | under those permissions, but the entire Program remains governed by
352 | this License without regard to the additional permissions.
353 | 
354 |   When you convey a copy of a covered work, you may at your option
355 | remove any additional permissions from that copy, or from any part of
356 | it.  (Additional permissions may be written to require their own
357 | removal in certain cases when you modify the work.)  You may place
358 | additional permissions on material, added by you to a covered work,
359 | for which you have or can give appropriate copyright permission.
360 | 
361 |   Notwithstanding any other provision of this License, for material you
362 | add to a covered work, you may (if authorized by the copyright holders of
363 | that material) supplement the terms of this License with terms:
364 | 
365 |     a) Disclaiming warranty or limiting liability differently from the
366 |     terms of sections 15 and 16 of this License; or
367 | 
368 |     b) Requiring preservation of specified reasonable legal notices or
369 |     author attributions in that material or in the Appropriate Legal
370 |     Notices displayed by works containing it; or
371 | 
372 |     c) Prohibiting misrepresentation of the origin of that material, or
373 |     requiring that modified versions of such material be marked in
374 |     reasonable ways as different from the original version; or
375 | 
376 |     d) Limiting the use for publicity purposes of names of licensors or
377 |     authors of the material; or
378 | 
379 |     e) Declining to grant rights under trademark law for use of some
380 |     trade names, trademarks, or service marks; or
381 | 
382 |     f) Requiring indemnification of licensors and authors of that
383 |     material by anyone who conveys the material (or modified versions of
384 |     it) with contractual assumptions of liability to the recipient, for
385 |     any liability that these contractual assumptions directly impose on
386 |     those licensors and authors.
387 | 
388 |   All other non-permissive additional terms are considered "further
389 | restrictions" within the meaning of section 10.  If the Program as you
390 | received it, or any part of it, contains a notice stating that it is
391 | governed by this License along with a term that is a further
392 | restriction, you may remove that term.  If a license document contains
393 | a further restriction but permits relicensing or conveying under this
394 | License, you may add to a covered work material governed by the terms
395 | of that license document, provided that the further restriction does
396 | not survive such relicensing or conveying.
397 | 
398 |   If you add terms to a covered work in accord with this section, you
399 | must place, in the relevant source files, a statement of the
400 | additional terms that apply to those files, or a notice indicating
401 | where to find the applicable terms.
402 | 
403 |   Additional terms, permissive or non-permissive, may be stated in the
404 | form of a separately written license, or stated as exceptions;
405 | the above requirements apply either way.
406 | 
407 |   8. Termination.
408 | 
409 |   You may not propagate or modify a covered work except as expressly
410 | provided under this License.  Any attempt otherwise to propagate or
411 | modify it is void, and will automatically terminate your rights under
412 | this License (including any patent licenses granted under the third
413 | paragraph of section 11).
414 | 
415 |   However, if you cease all violation of this License, then your
416 | license from a particular copyright holder is reinstated (a)
417 | provisionally, unless and until the copyright holder explicitly and
418 | finally terminates your license, and (b) permanently, if the copyright
419 | holder fails to notify you of the violation by some reasonable means
420 | prior to 60 days after the cessation.
421 | 
422 |   Moreover, your license from a particular copyright holder is
423 | reinstated permanently if the copyright holder notifies you of the
424 | violation by some reasonable means, this is the first time you have
425 | received notice of violation of this License (for any work) from that
426 | copyright holder, and you cure the violation prior to 30 days after
427 | your receipt of the notice.
428 | 
429 |   Termination of your rights under this section does not terminate the
430 | licenses of parties who have received copies or rights from you under
431 | this License.  If your rights have been terminated and not permanently
432 | reinstated, you do not qualify to receive new licenses for the same
433 | material under section 10.
434 | 
435 |   9. Acceptance Not Required for Having Copies.
436 | 
437 |   You are not required to accept this License in order to receive or
438 | run a copy of the Program.  Ancillary propagation of a covered work
439 | occurring solely as a consequence of using peer-to-peer transmission
440 | to receive a copy likewise does not require acceptance.  However,
441 | nothing other than this License grants you permission to propagate or
442 | modify any covered work.  These actions infringe copyright if you do
443 | not accept this License.  Therefore, by modifying or propagating a
444 | covered work, you indicate your acceptance of this License to do so.
445 | 
446 |   10. Automatic Licensing of Downstream Recipients.
447 | 
448 |   Each time you convey a covered work, the recipient automatically
449 | receives a license from the original licensors, to run, modify and
450 | propagate that work, subject to this License.  You are not responsible
451 | for enforcing compliance by third parties with this License.
452 | 
453 |   An "entity transaction" is a transaction transferring control of an
454 | organization, or substantially all assets of one, or subdividing an
455 | organization, or merging organizations.  If propagation of a covered
456 | work results from an entity transaction, each party to that
457 | transaction who receives a copy of the work also receives whatever
458 | licenses to the work the party's predecessor in interest had or could
459 | give under the previous paragraph, plus a right to possession of the
460 | Corresponding Source of the work from the predecessor in interest, if
461 | the predecessor has it or can get it with reasonable efforts.
462 | 
463 |   You may not impose any further restrictions on the exercise of the
464 | rights granted or affirmed under this License.  For example, you may
465 | not impose a license fee, royalty, or other charge for exercise of
466 | rights granted under this License, and you may not initiate litigation
467 | (including a cross-claim or counterclaim in a lawsuit) alleging that
468 | any patent claim is infringed by making, using, selling, offering for
469 | sale, or importing the Program or any portion of it.
470 | 
471 |   11. Patents.
472 | 
473 |   A "contributor" is a copyright holder who authorizes use under this
474 | License of the Program or a work on which the Program is based.  The
475 | work thus licensed is called the contributor's "contributor version".
476 | 
477 |   A contributor's "essential patent claims" are all patent claims
478 | owned or controlled by the contributor, whether already acquired or
479 | hereafter acquired, that would be infringed by some manner, permitted
480 | by this License, of making, using, or selling its contributor version,
481 | but do not include claims that would be infringed only as a
482 | consequence of further modification of the contributor version.  For
483 | purposes of this definition, "control" includes the right to grant
484 | patent sublicenses in a manner consistent with the requirements of
485 | this License.
486 | 
487 |   Each contributor grants you a non-exclusive, worldwide, royalty-free
488 | patent license under the contributor's essential patent claims, to
489 | make, use, sell, offer for sale, import and otherwise run, modify and
490 | propagate the contents of its contributor version.
491 | 
492 |   In the following three paragraphs, a "patent license" is any express
493 | agreement or commitment, however denominated, not to enforce a patent
494 | (such as an express permission to practice a patent or covenant not to
495 | sue for patent infringement).  To "grant" such a patent license to a
496 | party means to make such an agreement or commitment not to enforce a
497 | patent against the party.
498 | 
499 |   If you convey a covered work, knowingly relying on a patent license,
500 | and the Corresponding Source of the work is not available for anyone
501 | to copy, free of charge and under the terms of this License, through a
502 | publicly available network server or other readily accessible means,
503 | then you must either (1) cause the Corresponding Source to be so
504 | available, or (2) arrange to deprive yourself of the benefit of the
505 | patent license for this particular work, or (3) arrange, in a manner
506 | consistent with the requirements of this License, to extend the patent
507 | license to downstream recipients.  "Knowingly relying" means you have
508 | actual knowledge that, but for the patent license, your conveying the
509 | covered work in a country, or your recipient's use of the covered work
510 | in a country, would infringe one or more identifiable patents in that
511 | country that you have reason to believe are valid.
512 | 
513 |   If, pursuant to or in connection with a single transaction or
514 | arrangement, you convey, or propagate by procuring conveyance of, a
515 | covered work, and grant a patent license to some of the parties
516 | receiving the covered work authorizing them to use, propagate, modify
517 | or convey a specific copy of the covered work, then the patent license
518 | you grant is automatically extended to all recipients of the covered
519 | work and works based on it.
520 | 
521 |   A patent license is "discriminatory" if it does not include within
522 | the scope of its coverage, prohibits the exercise of, or is
523 | conditioned on the non-exercise of one or more of the rights that are
524 | specifically granted under this License.  You may not convey a covered
525 | work if you are a party to an arrangement with a third party that is
526 | in the business of distributing software, under which you make payment
527 | to the third party based on the extent of your activity of conveying
528 | the work, and under which the third party grants, to any of the
529 | parties who would receive the covered work from you, a discriminatory
530 | patent license (a) in connection with copies of the covered work
531 | conveyed by you (or copies made from those copies), or (b) primarily
532 | for and in connection with specific products or compilations that
533 | contain the covered work, unless you entered into that arrangement,
534 | or that patent license was granted, prior to 28 March 2007.
535 | 
536 |   Nothing in this License shall be construed as excluding or limiting
537 | any implied license or other defenses to infringement that may
538 | otherwise be available to you under applicable patent law.
539 | 
540 |   12. No Surrender of Others' Freedom.
541 | 
542 |   If conditions are imposed on you (whether by court order, agreement or
543 | otherwise) that contradict the conditions of this License, they do not
544 | excuse you from the conditions of this License.  If you cannot convey a
545 | covered work so as to satisfy simultaneously your obligations under this
546 | License and any other pertinent obligations, then as a consequence you may
547 | not convey it at all.  For example, if you agree to terms that obligate you
548 | to collect a royalty for further conveying from those to whom you convey
549 | the Program, the only way you could satisfy both those terms and this
550 | License would be to refrain entirely from conveying the Program.
551 | 
552 |   13. Use with the GNU Affero General Public License.
553 | 
554 |   Notwithstanding any other provision of this License, you have
555 | permission to link or combine any covered work with a work licensed
556 | under version 3 of the GNU Affero General Public License into a single
557 | combined work, and to convey the resulting work.  The terms of this
558 | License will continue to apply to the part which is the covered work,
559 | but the special requirements of the GNU Affero General Public License,
560 | section 13, concerning interaction through a network will apply to the
561 | combination as such.
562 | 
563 |   14. Revised Versions of this License.
564 | 
565 |   The Free Software Foundation may publish revised and/or new versions of
566 | the GNU General Public License from time to time.  Such new versions will
567 | be similar in spirit to the present version, but may differ in detail to
568 | address new problems or concerns.
569 | 
570 |   Each version is given a distinguishing version number.  If the
571 | Program specifies that a certain numbered version of the GNU General
572 | Public License "or any later version" applies to it, you have the
573 | option of following the terms and conditions either of that numbered
574 | version or of any later version published by the Free Software
575 | Foundation.  If the Program does not specify a version number of the
576 | GNU General Public License, you may choose any version ever published
577 | by the Free Software Foundation.
578 | 
579 |   If the Program specifies that a proxy can decide which future
580 | versions of the GNU General Public License can be used, that proxy's
581 | public statement of acceptance of a version permanently authorizes you
582 | to choose that version for the Program.
583 | 
584 |   Later license versions may give you additional or different
585 | permissions.  However, no additional obligations are imposed on any
586 | author or copyright holder as a result of your choosing to follow a
587 | later version.
588 | 
589 |   15. Disclaimer of Warranty.
590 | 
591 |   THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
592 | APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
596 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
597 | IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
599 | 
600 |   16. Limitation of Liability.
601 | 
602 |   IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
610 | SUCH DAMAGES.
611 | 
612 |   17. Interpretation of Sections 15 and 16.
613 | 
614 |   If the disclaimer of warranty and limitation of liability provided
615 | above cannot be given local legal effect according to their terms,
616 | reviewing courts shall apply local law that most closely approximates
617 | an absolute waiver of all civil liability in connection with the
618 | Program, unless a warranty or assumption of liability accompanies a
619 | copy of the Program in return for a fee.
620 | 
621 |                      END OF TERMS AND CONDITIONS
622 | 
623 |             How to Apply These Terms to Your New Programs
624 | 
625 |   If you develop a new program, and you want it to be of the greatest
626 | possible use to the public, the best way to achieve this is to make it
627 | free software which everyone can redistribute and change under these terms.
628 | 
629 |   To do so, attach the following notices to the program.  It is safest
630 | to attach them to the start of each source file to most effectively
631 | state the exclusion of warranty; and each file should have at least
632 | the "copyright" line and a pointer to where the full notice is found.
633 | 
634 |     <one line to give the program's name and a brief idea of what it does.>
635 |     Copyright (C) <year>  <name of author>
636 | 
637 |     This program is free software: you can redistribute it and/or modify
638 |     it under the terms of the GNU General Public License as published by
639 |     the Free Software Foundation, either version 3 of the License, or
640 |     (at your option) any later version.
641 | 
642 |     This program is distributed in the hope that it will be useful,
643 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
644 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
645 |     GNU General Public License for more details.
646 | 
647 |     You should have received a copy of the GNU General Public License
648 |     along with this program.  If not, see <http://www.gnu.org/licenses/>.
649 | 
650 | Also add information on how to contact you by electronic and paper mail.
651 | 
652 |   If the program does terminal interaction, make it output a short
653 | notice like this when it starts in an interactive mode:
654 | 
655 |     <program>  Copyright (C) <year>  <name of author>
656 |     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
657 |     This is free software, and you are welcome to redistribute it
658 |     under certain conditions; type `show c' for details.
659 | 
660 | The hypothetical commands `show w' and `show c' should show the appropriate
661 | parts of the General Public License.  Of course, your program's commands
662 | might be different; for a GUI interface, you would use an "about box".
663 | 
664 |   You should also get your employer (if you work as a programmer) or school,
665 | if any, to sign a "copyright disclaimer" for the program, if necessary.
666 | For more information on this, and how to apply and follow the GNU GPL, see
667 | <http://www.gnu.org/licenses/>.
668 | 
669 |   The GNU General Public License does not permit incorporating your program
670 | into proprietary programs.  If your program is a subroutine library, you
671 | may consider it more useful to permit linking proprietary applications with
672 | the library.  If this is what you want to do, use the GNU Lesser General
673 | Public License instead of this License.  But first, please read
674 | <http://www.gnu.org/philosophy/why-not-lgpl.html>.


--------------------------------------------------------------------------------
/makednslog.c:
--------------------------------------------------------------------------------
   1 | //Copyright (c) 2017 James L. Antonakos
   2 | 
   3 | //This program is free software: you can redistribute it and/or modify
   4 | //    it under the terms of the GNU General Public License as published by
   5 | //    the Free Software Foundation, either version 3 of the License, or
   6 | //    (at your option) any later version.
   7 | 
   8 | //    This program is distributed in the hope that it will be useful,
   9 | //    but WITHOUT ANY WARRANTY; without even the implied warranty of
  10 | //    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11 | //    GNU General Public License for more details.
  12 | 
  13 | //    You should have received a copy of the GNU General Public License
  14 | //    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  15 | 
  16 | #include <stdio.h>
  17 | #include <string.h>
  18 | #include <stdlib.h>
  19 | #include <time.h>
  20 | 
  21 | #define FALSE 0
  22 | #define TRUE  1
  23 | #define SIMPLE 0
  24 | 
  25 | // Search for a specific command line parameter
  26 | int checkparm(int narg, char **args, char parm[])
  27 | {
  28 | 	int p,found;
  29 | 
  30 | 	found = FALSE;
  31 | 	p = 0;
  32 | 	do
  33 | 	{
  34 | 		if(0 == strcmp(args[p],parm))
  35 | 			found = TRUE;
  36 | 		else
  37 | 			p++;
  38 | 	} while ((p < narg) && !found);
  39 | 	if(found)
  40 | 		return(p);
  41 | 	else
  42 | 		return(0);
  43 | }
  44 | 
  45 | // Convert into Microsoft-format domain
  46 | // www.yahoo.com --> (3)www(5)yahoo(3)com(0)
  47 | void makemsd(char instr[], char *outstr)
  48 | {
  49 | 	int j,jstart,k,p,n;
  50 | 	char tempstr[6];
  51 | 
  52 | 	k = 0;
  53 | 	p = 0;
  54 | 	jstart = 0;
  55 | 	do
  56 | 	{
  57 | 		j = 0;
  58 | 		do
  59 | 		{
  60 | 			j++;
  61 | 			p++;
  62 | 		} while(('.' != instr[p]) && ('\0' != instr[p]));
  63 | 		sprintf(tempstr,"(%d)",j);
  64 | 		for(n = 0; n < strlen(tempstr); n++)
  65 | 		{
  66 | 			outstr[k] = tempstr[n];
  67 | 			k++;
  68 | 		}
  69 | 		for(n = jstart; n < p; n++)
  70 | 		{
  71 | 			outstr[k] = instr[n];
  72 | 			k++;
  73 | 		}
  74 | 		p++;
  75 | 		jstart = p;
  76 | 	} while (p < strlen(instr));
  77 | 	outstr[k] = '(';
  78 | 	outstr[k+1] = '0';
  79 | 	outstr[k+2] = ')';
  80 | 	outstr[k+3] = '\0';
  81 | } 
  82 | 
  83 | // Return a country code
  84 | char *ccode(void)
  85 | {
  86 | 	int cca[] = {0,1,2,3,4,5,6,7,8,0,1,2,3,4,5,6,7,0,1,2,3,4,5,6,0,1,2,3,4,5,0,1,2,3,4,0,1,2,3,0,1,2,0,1,0};
  87 | 
  88 | 	switch(cca[rand() % 45])
  89 | 	{
  90 | 	case 0: return ".ru"; break;  // most frequent
  91 | 	case 1: return ".cn"; break;
  92 | 	case 2: return ".ca"; break;
  93 | 	case 3: return ".tw"; break;
  94 | 	case 4: return ".bg"; break;
  95 | 	case 5: return ".uk"; break;
  96 | 	case 6: return ".in"; break;
  97 | 	case 7: return ".mx"; break;
  98 | 	case 8: return ".de"; break;  // least frequent
  99 | 	}
 100 | }
 101 | 
 102 | // Return a country code in Microsoft format
 103 | char *ccode2(void)
 104 | {
 105 | 	int cca[] = {0,1,2,3,4,5,6,7,8,0,1,2,3,4,5,6,7,0,1,2,3,4,5,6,0,1,2,3,4,5,0,1,2,3,4,0,1,2,3,0,1,2,0,1,0};
 106 | 
 107 | 	switch(cca[rand() % 45])
 108 | 	{
 109 | 	case 0: return "(2)ru(0)"; break;
 110 | 	case 1: return "(2)cn(0)"; break;
 111 | 	case 2: return "(2)ca(0)"; break;
 112 | 	case 3: return "(2)tw(0)"; break;
 113 | 	case 4: return "(2)bg(0)"; break;
 114 | 	case 5: return "(2)uk(0)"; break;
 115 | 	case 6: return "(2)in(0)"; break;
 116 | 	case 7: return "(2)mx(0)"; break;
 117 | 	case 8: return "(2)de(0)"; break;
 118 | 	}
 119 | }
 120 | 
 121 | int main(int argc, char *argv[])
 122 | {
 123 | 	// Ya know what? I like using lots of variables. I try to give them descriptive names
 124 | 	// but that whole lpiCount is too much. So, you'll see k, and n1, and dk among others.
 125 | 	int p,k,dr;
 126 | 	int hr,min,sec,subsec;
 127 | 	int hrlist[] = {12,1,2,3,4,5,6,7,8,9,10,11,12,1,2,3,4,5,6,7,8,9,10,11};
 128 | 	int mon,day,yr;
 129 | 	int monlist[] = {0,31,28,31,30,31,30,31,31,30,31,30,31};
 130 | 	char months[][4] = {"Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"};
 131 | 	int nopci[] = {12,1,2,3,4,5,6,7,8,9,10,11};
 132 | 	int datemode;
 133 | 	char tmpstr[4];
 134 | 	int pcimon;
 135 | 	int pcimode;
 136 | 	int today_day;
 137 | 	int today_mon;
 138 | 	int today_yr;
 139 | 
 140 | 	time_t t;
 141 | 	char timedate[32];
 142 | 
 143 | 	int sr;
 144 | 	int ipr;
 145 | 	int special;
 146 | 	int n1,n2;
 147 | 	char exfil[41],exalpha[] = "0123456789abcdef";
 148 | 	char exalpha2[] = "abcdefghijklmnopqrstuvwxyz0123456789";
 149 | 	char dga[] = "abcdefghijklmnopqrstuvwxyz";
 150 | 	char wlist[60][20] = {"welcome","fixture","change","monitor","sleeper","trust","upwards","against","promote","dignity",
 151 | 		"immediate","after","delay","allow","combine","filter","mixture","transfer","mobile","currency",
 152 | 		"extra","another","people","help","working","given","schedule","project","next","optional",
 153 | 		"tool","network","server","network","assist","simple","easy","manual","install","client",
 154 | 		"question","answer","best","background","sideways","wonder","machine","quick","survey","monkey",
 155 | 		"sky","green","software","power","planet","universe","download","matrix","shopper","portal"};
 156 | 	int new1min;
 157 | 	int new10min;
 158 | 	int new1hour;
 159 | 	int bursty;
 160 | 	int burstknt;
 161 | 
 162 | 	// This message is base64 encoded and saved in b64str:
 163 | 	// If you are reading this I assume you have been correctly identifying and decoding the different types of IoCs 
 164 | 	// I have placed into the fake DNS log. My congratulations for a job well done. Of course I could be wrong, and 
 165 | 	// you may never read any of this, but I choose to remain positive that you will solve my little mystery. Good 
 166 | 	// luck and happy threat hunting!
 167 | 	char b64str[] = "SWYgeW91IGFyZSByZWFkaW5nIHRoaXMgSSBhc3N1bWUgeW91IGhhdmUgYmVlbiBjb3JyZWN0bHkgaWRlbnRpZnlpbmcgYW"
 168 | 		"5kIGRlY29kaW5nIHRoZSBkaWZmZXJlbnQgdHlwZXMgb2YgSW9DcyBJIGhhdmUgcGxhY2VkIGludG8gdGhlIGZha2UgRE5TIGxvZy4gTXkg"
 169 | 		"Y29uZ3JhdHVsYXRpb25zIGZvciBhIGpvYiB3ZWxsIGRvbmUuIE9mIGNvdXJzZSBJIGNvdWxkIGJlIHdyb25nLCBhbmQgeW91IG1heSBuZX"
 170 | 		"ZlciByZWFkIGFueSBvZiB0aGlzLCBidXQgSSBjaG9vc2UgdG8gcmVtYWluIHBvc2l0aXZlIHRoYXQgeW91IHdpbGwgc29sdmUgbXkgbGl0"
 171 | 		"dGxlIG15c3RlcnkuIEdvb2QgbHVjayBhbmQgaGFwcHkgdGhyZWF0IGh1bnRpbmch";
 172 | 
 173 | 	char b64[16][40] = {"V2luZG93cyA3LDMyLWJpdCw4IEdC",  // Windows 7,32-bit,8 GB
 174 | 		"V2luZG93cyBYUC1TUC0xLDMyLWJpdCw0IEdC",          // Windows XP-SP-1,32-bit,4 GB
 175 | 		"V2luZG93cyAyMDA4UjIsNjQgR0IsSUlT",              // Windows 2008R2,64 GB,IIS
 176 | 		"V2luZG93cyAyMDEyLDMyIEdC",                      // Windows 2012,32 GB
 177 | 		"QWNjdDoganNtaXRo",       // Acct: jsmith
 178 | 		"QWNjdDogc3lzYWRtaW43",   // Acct: sysadmin7
 179 | 		"QWNjdDogbW1vdXNl",       // Acct: mmouse
 180 | 		"QWNjdDogc3FsZGJtZ250",   // Acct: sqldbmgnt
 181 | 		"VklTQTEyMzQ1Njc4OTAxMjM0NTYxMDE5",   // VISA12345678901234561019
 182 | 		"VklTQTc3Nzc2NjY2NTU1NTQ0NDQwMTE4",   // VISA77776666555544440118
 183 | 		"TUMtOTg3NjU0MzIxMDk4NzY1NC0wNzIw",   // MC-9876543210987654-0720
 184 | 		"TUMtMTEyMjMzNDQ1NTY2Nzc4OC0xMTIx",   // MC-1122334455667788-1121
 185 | 		"Tm8gQVYgZXhpc3Rz",           // No AV exists
 186 | 		"U29waG9zIEFWIHJ1bm5pbmcu",   // Sophos AV running.
 187 | 		"QVZHZnJlZSBBViBydW5uaW5n",   // AVGfree AV running
 188 | 		"RVNFVCBBViBydW5uaW5n"};      // ESET AV running
 189 | 	int b64pos;
 190 | 	char bmsg[49];
 191 | 	int lastburst;
 192 | 	int noms,ampm;
 193 | 	int found;
 194 | 	int verb;
 195 | 	int goback,back;
 196 | 
 197 | 	char doms[2000][80];    // This string array is filled with domains read from domains.txt
 198 | 	int NDOMS;              // This is the number of domains read
 199 | 	char msdoms[2000][80];  // This string array is populated by converting doms[] into Microsoft domain name format
 200 | 
 201 | 	long int passes,lineslogged;
 202 | 	int dots,megs;
 203 | 	int dlen;
 204 | 	char ld[12],lt[12],lh1[4],lh2[9],lsr[4],lip[16],lh3[5],lqr[4],lstat[18],ldom[81];
 205 | 	char startime[32];
 206 | 	char logline[180];
 207 | 	FILE *ifile,*ofile;
 208 | 	char fstr[80],fstr2[80];
 209 | 	int pv,rv;
 210 | 	char fname[128];
 211 | 	char fname1[120];
 212 | 	char fname2[8];
 213 | 	int fknt;
 214 | 	int filesplit;
 215 | 	int filelimit;
 216 | 	long int filesize,filemaxsize;
 217 | 	long int maxlines;
 218 | 	int linestop;
 219 | 	int dk;
 220 | 	int net10,net172,net192;
 221 | 	int state;
 222 | 	char malwareip10[8][16],malwareip172[8][16],malwareip192[8][16];
 223 | 	int s10,s172,s192;
 224 | 	int plist[6][3] = {{0,1,2},{0,2,1},{1,0,2},{1,2,0},{2,0,1},{2,1,0}};
 225 | 	int ppick;
 226 | 	char spoofip[8][16];
 227 | 
 228 | 	if(argc == 1)
 229 | 	{
 230 | 		printf("Usage: makednslog [-v] [-ofile OUTPUT-FILE] [-noms] [-ampm] [-datemode 1|2] [-goback N] [-pci] "
 231 | 			"[-split N] [-lines N] [-net 172[,192][,10]]\n");
 232 | 	}
 233 | 	fname[0] = '\0';
 234 | 	strcpy(fname,"dns.log");
 235 | 	fname1[0] = '\0';
 236 | 	strcpy(fname1,"dns");
 237 | 	fname2[0] = '\0';
 238 | 	strcpy(fname2,"log");
 239 | 
 240 | 	srand( (unsigned)time( NULL ) );  // Make sure the logs are different every time
 241 | 
 242 | 	printf("This program creates fake DNS logs.\n\n");
 243 | 
 244 | 	// Process all command line parameters
 245 | 	for(pv = 1; pv < argc; pv++)
 246 | 		printf("p%d: %s\n",pv,argv[pv]);
 247 | 	printf("Checking parameters...\n");
 248 | 	
 249 | 	noms = FALSE;
 250 | 	if(0 != checkparm(argc,argv,"-noms"))
 251 | 	{
 252 | 		noms = TRUE;
 253 | 		printf("   No Microsoft format.\n");
 254 | 	}
 255 | 
 256 | 	ampm = FALSE;
 257 | 	if(0 != checkparm(argc,argv,"-ampm"))
 258 | 	{
 259 | 		ampm = TRUE;
 260 | 		printf("   12-hour clock.\n");
 261 | 	}
 262 | 
 263 | 	datemode = 0;
 264 | 	pv = checkparm(argc,argv,"-datemode");
 265 | 	if(0 != pv)
 266 | 	{
 267 | 		datemode = atoi(argv[pv+1]);
 268 | 		if((datemode >= 0) && (datemode <= 2))
 269 | 			printf("   Date mode = %d\n",datemode);
 270 | 		else
 271 | 		{
 272 | 			printf("Invalid datemode value.\n");
 273 | 			exit(0);
 274 | 		}
 275 | 	}
 276 | 
 277 | 	time(&t);
 278 | 	sprintf(timedate,ctime(&t));
 279 | 	yr = atoi(&timedate[strlen(timedate)-5]);
 280 | 	today_yr = yr;
 281 | 	goback = FALSE;
 282 | 	pv = checkparm(argc,argv,"-goback");
 283 | 	if(0 != pv)
 284 | 	{
 285 | 		goback = TRUE;
 286 | 		back = atoi(argv[pv+1]);
 287 | 		if (back > 1)
 288 | 		{
 289 | 			printf("   Going back %d months.\n",back);
 290 | 			back--;
 291 | 		}
 292 | 		else
 293 | 		{
 294 | 			printf("   Must go back at least 2 months.\n");
 295 | 			exit(0);
 296 | 		}
 297 | 	}
 298 | 	
 299 | 	linestop = FALSE;
 300 | 	maxlines = 500000;
 301 | 	pv = checkparm(argc,argv,"-lines");
 302 | 	if(0 != pv)
 303 | 	{
 304 | 		linestop = TRUE;
 305 | 		maxlines = atoi(argv[pv+1]);
 306 | 		printf("   Maxlines = %ld\n",maxlines);
 307 | 	}
 308 | 
 309 | 	verb = FALSE;
 310 | 	pv = checkparm(argc,argv,"-v");
 311 | 	if(0 != pv)
 312 | 	{
 313 | 		printf("   Verbose-mode enabled.\n");
 314 | 		verb = TRUE;
 315 | 	}
 316 | 
 317 | 	// How many times do you get a chance to create a state machine?
 318 | 	// This code parses the -net parameter, looking for 10, 172, and/or 192
 319 | 	//         "1"   "0"   "7"   "9"   "2"   ","
 320 | 	// State
 321 | 	//   0      1     5     5     5     5     5
 322 | 	//   1      5     2     3     4     5     5  "10"
 323 | 	//   2      5     5     5     5     5     0  
 324 | 	//   3      5     5     5     5     2     5  "172"
 325 | 	//   4      5     5     5     5     2     5  "192"
 326 | 	net10 = FALSE;
 327 | 	net172 = FALSE;
 328 | 	net192 = FALSE;
 329 | 	pv = checkparm(argc,argv,"-net");
 330 | 	if(0 != pv)
 331 | 	{
 332 | 		state = 0;
 333 | 		n1 = 0;
 334 | 		do
 335 | 		{
 336 | 			if(verb)
 337 | 				printf("state: %d, n1: %d, argv[pv+1][n]: %c\n",state,n1,argv[pv+1][n1]);
 338 | 			switch(state) 
 339 | 			{
 340 | 			case 0: if('1' == argv[pv+1][n1])
 341 | 					{
 342 | 						state = 1;
 343 | 						n1++;
 344 | 					}
 345 | 					else
 346 | 						state = 5;
 347 | 					break;
 348 | 			case 1: if('0' == argv[pv+1][n1])
 349 | 					{
 350 | 						net10 = TRUE;
 351 | 						state = 2;
 352 | 						n1++;
 353 | 					}
 354 | 					else
 355 | 						if('7' == argv[pv+1][n1])
 356 | 						{
 357 | 							state = 3;
 358 | 							n1++;
 359 | 						}
 360 | 						else
 361 | 							if('9' == argv[pv+1][n1])
 362 | 							{
 363 | 								state = 4;
 364 | 								n1++;
 365 | 							}
 366 | 							else
 367 | 								state = 5;
 368 | 					break;
 369 | 			case 2: if(',' == argv[pv+1][n1])
 370 | 					{
 371 | 						state = 0;
 372 | 						n1++;
 373 | 					}
 374 | 					else
 375 | 						state = 5;
 376 | 					break;
 377 | 			case 3: if('2' == argv[pv+1][n1])
 378 | 					{
 379 | 						net172 = TRUE;
 380 | 						state = 2;
 381 | 						n1++;
 382 | 					}
 383 | 					else
 384 | 						state = 5;
 385 | 					break;
 386 | 			case 4: if('2' == argv[pv+1][n1])
 387 | 					{
 388 | 						net192 = TRUE;
 389 | 						state = 2;
 390 | 						n1++;
 391 | 					}
 392 | 					else
 393 | 						state = 5;
 394 | 					break;
 395 | 			}
 396 | 		} while (state != 5);
 397 | 		if(0 == (net10 || net172 || net192))
 398 | 		{
 399 | 			printf("Error extracting network.\n");
 400 | 			exit(0);
 401 | 		}
 402 | 		if(net10)
 403 | 			printf("   Network 10.x.x.x selected.\n");
 404 | 		if(net172)
 405 | 			printf("   Network 172.x.x.x selected.\n");
 406 | 		if(net192)
 407 | 			printf("   Network 192.x.x.x selected.\n");
 408 | 	}
 409 | 	else
 410 | 		net10 = TRUE;  // default
 411 | 
 412 | 	// Pick network octets and populate arrays with "compromised" systems in each network
 413 | 	// even if only one network is being used (because the code is easier this way).
 414 | 	s10 = 1 + (rand() % 200);
 415 | 	s172 = 1 + (rand() % 200);
 416 | 	s192 = 1 + (rand() % 200);
 417 | 	if(verb)
 418 | 	{
 419 | 		printf("\nAssign IP addresses to \"compromised\" systems.\n");
 420 | 		printf("\tmalwareip10\tmalwareip172\tmalwareip192\n");
 421 | 	}
 422 | 	for(n1 = 0; n1 < 8; n1++)
 423 | 	{
 424 | 		sprintf(malwareip10[n1],"10.%d.%d.%d",s10,(1 + (rand() % 200)),(1 + (rand() % 250)));
 425 | 		sprintf(malwareip172[n1],"172.%d.%d.%d",s172,(1 + (rand() % 200)),(1 + (rand() % 250)));
 426 | 		sprintf(malwareip192[n1],"192.168.%d.%d",s192,(1 + (rand() % 250)));
 427 | 		if(verb)
 428 | 			printf("[%d]\t%s\t%s\t%s\n",n1,malwareip10[n1],malwareip172[n1],malwareip192[n1]);
 429 | 	}
 430 | 
 431 | 	// Make up some spoofed IPs
 432 | 	if(verb)
 433 | 		printf("\nCreate spoofed IPs.\n");
 434 | 	for(n1 = 0; n1 < 8; n1++)
 435 | 	{
 436 | 		do
 437 | 		{
 438 | 			n2 = 4 + (rand() % 220);
 439 | 		} while ((n2 == 10) && (n2 == 172) && (n2 == 192));
 440 | 		sprintf(spoofip[n1],"%d.%d.%d.%d",n2,(1+(rand() % 250)),(1+(rand() % 250)),(1+(rand() % 250)));
 441 | 		if(verb)
 442 | 			printf("[%d] %s\n",n1,spoofip[n1]);
 443 | 	}
 444 | 
 445 | 	pcimode = FALSE;
 446 | 	pv = checkparm(argc,argv,"-pci");
 447 | 	if(0 != pv)
 448 | 	{
 449 | 		printf("   PCI 90-day log enabled.\n");
 450 | 		pcimode = TRUE;
 451 | 	}
 452 | 	strncpy(tmpstr,&timedate[4],3);
 453 | 	tmpstr[3] = '\0';
 454 | 	pcimon = 0;
 455 | 	found = FALSE;
 456 | 	do
 457 | 	{
 458 | 		if(0 == strcmp(tmpstr,months[pcimon]))
 459 | 			found = TRUE;
 460 | 		else 
 461 | 			pcimon++;
 462 | 	} while ((pcimon < 12) && !found);
 463 | 	if(!found)
 464 | 	{
 465 | 		printf("Error extracting month from timedate.\n");
 466 | 		exit(0);
 467 | 	}
 468 | 	today_mon = 1 + pcimon;
 469 | 	mon = nopci[pcimon];  // Default is one month back
 470 | 
 471 | 	// Sorry this is complicated, but going back even one month could
 472 | 	// take us to previous year. Argh!
 473 | 	if(goback || pcimode)
 474 | 	{
 475 | 		if(pcimode)
 476 | 			back = 2;
 477 | 		do
 478 | 		{
 479 | 			if(back > 12)
 480 | 			{
 481 | 				back =- 12;
 482 | 				yr--;
 483 | 			} 
 484 | 		}while (back > 11);
 485 | 		do
 486 | 		{
 487 | 			if(back > 0)
 488 | 			{
 489 | 				if (mon == 1)
 490 | 				{
 491 | 					mon = 12;
 492 | 					yr--;
 493 | 				}
 494 | 				else
 495 | 					mon--;
 496 | 				back--;
 497 | 			}
 498 | 		} while(back > 0);
 499 | 		if(verb)
 500 | 			printf("Going back to %s %d.\n",months[mon-1],yr);
 501 | 	}
 502 | 
 503 | 	tmpstr[0] = timedate[8];
 504 | 	if((timedate[9] >= '0') && (timedate[9] <= '9'))
 505 | 	{
 506 | 		tmpstr[1] = timedate[9];
 507 | 		tmpstr[2] = '\0';
 508 | 	}
 509 | 	else
 510 | 		tmpstr[1] = '\0';
 511 | 	day = atoi(tmpstr);
 512 | 	today_day = day;
 513 | 
 514 | 	// Read all domains from domains.txt and convert into Microsoft format as we go
 515 | 	printf("Reading domains...\n");
 516 | 	ifile = fopen("domains.txt","r");
 517 | 	if(ifile == NULL)
 518 | 	{
 519 | 		printf("Error! Can not open domains.txt\n");
 520 | 		perror(NULL);
 521 | 		exit(0);
 522 | 	}
 523 | 	dk = 0;
 524 | 	dlen = 0;
 525 | 	do
 526 | 	{
 527 | 		fgets(fstr,80,ifile);
 528 | 		p = strlen(fstr)-1;
 529 | 		do
 530 | 		{
 531 | 			if(32 > fstr[p])
 532 | 			{
 533 | 				fstr[p] = '\0';
 534 | 				p--;
 535 | 			}
 536 | 		} while(32 > fstr[p]);
 537 | 
 538 | 		if(0 != strcmp(fstr,"/END/"))
 539 | 		{
 540 | 			if(verb)
 541 | 				printf("%s\n",fstr);
 542 | 			strcpy(doms[dk],fstr);
 543 | 			makemsd(fstr,&fstr2);
 544 | 			strcpy(msdoms[dk],fstr2);
 545 | 			if(dlen < strlen(fstr2))
 546 | 				dlen = strlen(fstr2);
 547 | 			if(verb)
 548 | 				printf("--> %s\n",fstr2);
 549 | 		}
 550 | 		dk++;
 551 | 	} while((0 != strcmp(fstr,"/END/")) && (dk < 2001));
 552 | 	fclose(ifile);
 553 | 	dk--;
 554 | 	NDOMS = dk;
 555 | 	printf("%d domains read from file.\n",dk);
 556 | 	if(verb)
 557 | 		printf("Max MS domain length = %d\n",dlen);
 558 | 
 559 | 	pv = checkparm(argc,argv,"-ofile");
 560 | 	if(0 != pv)
 561 | 	{
 562 | 		fname[0] = '\0';
 563 | 		strcpy(fname,argv[pv+1]);
 564 | 		printf("   Output file: %s\n",fname);
 565 | 	}
 566 | 
 567 | 	ofile = fopen(fname,"w");
 568 | 	if(ofile == NULL)
 569 | 	{
 570 | 		printf("Error! Can not open %s\n",fname);
 571 | 		perror(NULL);
 572 | 		exit(0);
 573 | 	}
 574 | 
 575 | 	// Go through all this nonsense to split filename into name and extension.
 576 | 	// This makes it easier to add numbers to multiple log files.
 577 | 	p = strlen(fname);
 578 | 	found = FALSE;
 579 | 	do
 580 | 	{
 581 | 		p--;
 582 | 		if('.' == fname[p])
 583 | 			found = TRUE;
 584 | 	} while((p > 0) && !found);
 585 | 	if(found)
 586 | 	{
 587 | 		p++;
 588 | 		k = 0;
 589 | 		do
 590 | 		{
 591 | 			fname2[k] = fname[p];
 592 | 			k++;
 593 | 			p++;
 594 | 		} while('\0' != fname[p]);
 595 | 		fname2[k] = '\0';
 596 | 		p -= k;
 597 | 		p -= 2;
 598 | 		for(k = 0; k <= p; k++)
 599 | 			fname1[k] = fname[k];
 600 | 		fname1[p+1] = '\0';
 601 | 	}
 602 | 	else
 603 | 	{
 604 | 		strcpy(fname1,fname);
 605 | 		fname2[0] = '\0';
 606 | 	}
 607 | 	printf("LogFile: [%s].[%s]\n",fname1,fname2);
 608 | 	
 609 | 	filesplit = FALSE;
 610 | 	pv = checkparm(argc,argv,"-split");
 611 | 	if(0 != pv)
 612 | 	{
 613 | 		filesplit = TRUE;
 614 | 		filelimit = atoi(argv[pv+1]);
 615 | 		printf("   File splitting at %d MB\n",filelimit);
 616 | 		filemaxsize = 1024*1024*filelimit;
 617 | 		fknt = 1;
 618 | 		filesize = 0;
 619 | 	}
 620 | 
 621 | 	printf("Generating log, every . equals 100,000 lines.\n");
 622 | 	
 623 | 	switch(datemode)
 624 | 	{
 625 | 	case 0: sprintf(ld,"%d%02d%02d",yr,mon,day); break;
 626 | 	case 1: sprintf(ld,"%d-%02d-%02d",yr,mon,day); break;
 627 | 	case 2: sprintf(ld,"%s %d %d",months[mon-1],day,yr); break;
 628 | 	}
 629 | 
 630 | 	lt[0] = '\0';
 631 | 	strcpy(lt,"20:40:00");  // I was born at 8:40 pm, ok?
 632 | 	hr = 20;
 633 | 	min = 40;
 634 | 	sec = 0;
 635 | 	if(ampm)
 636 | 	{
 637 | 		if(hr < 12)
 638 | 			sprintf(lt,"%02d:%02d:%02d am",hrlist[hr],min,sec);
 639 | 		else
 640 | 			sprintf(lt,"%02d:%02d:%02d pm",hrlist[hr],min,sec);
 641 | 	}
 642 | 	else
 643 | 		sprintf(lt,"%02d:%02d:%02d",hr,min,sec);
 644 | 
 645 | 	sprintf(startime,"%s, %s",ld,lt);
 646 | 	lh3[0] = '\0';
 647 | 	strcpy(lh3,"80FD");
 648 | 
 649 | 	passes = 0;
 650 | 	dots = 0;
 651 | 	megs = 0;
 652 | 	dr = 0;
 653 | 	new1min = FALSE;
 654 | 	new10min = FALSE;
 655 | 	new1hour = FALSE;
 656 | 	bursty = FALSE;
 657 | 	lastburst = 0;
 658 | 	lineslogged = 0;
 659 | 
 660 | 	// This begins the main log-entry generating loop.
 661 | 	// Each pass through the loop generates one or more log entries.
 662 | 	subsec = 2 + (rand() % 11);
 663 | 	do
 664 | 	{
 665 | 		lstat[0] = '\0';
 666 | 		strcpy(lstat,"[0001 D NOERROR]");
 667 | 
 668 | 		lh1[0] = '\0';
 669 | 		switch(rand() % 4)
 670 | 		{
 671 | 		case 0: strcpy(lh1,"710"); break;
 672 | 		case 1: strcpy(lh1,"8A8"); break;
 673 | 		case 2: strcpy(lh1,"588"); break;
 674 | 		case 3: strcpy(lh1,"544"); break;
 675 | 		}
 676 | 
 677 | 		lh2[0] = '\0';
 678 | 		sprintf(lh2,"%04X%04X", rand() % 4096, rand() % 65536);
 679 | 
 680 | 		lsr[0] = '\0';
 681 | 
 682 | //      Not implementing Snd at this time
 683 | //      switch(rand() % 2)
 684 | 		switch(0)
 685 | 		{
 686 | 		case 0: strcpy(lsr,"Rcv"); sr = 0; break;
 687 | 		case 1: strcpy(lsr,"Snd"); sr = 1; break;
 688 | 		}
 689 | 
 690 | 		lqr[0] = '\0';
 691 | 		if(sr == 0)
 692 | 			strcpy(lqr,"Q");
 693 | 		else
 694 | 			strcpy(lqr,"R,Q");
 695 | 
 696 | 		lip[0] = '\0';
 697 | 
 698 | 		// Ok, ok. So I don't remember what "ipr" stood for when I named the variable.
 699 | 		// But when ipr == 5, malware happens !!! Wheeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.
 700 | 		if(new1min || new10min || new1hour)  // Beacons ! (not Bacon !)
 701 | 			ipr = 5;
 702 | 		else
 703 | 			ipr = rand() % 100;  // Well, if it wasn't 5 before, maybe it will be now.
 704 | 		if(ipr == 5)
 705 | 		{
 706 | 			if(new1min || new10min || new1hour)
 707 | 			{
 708 | 				if(new1min)
 709 | 				{
 710 | 					special = 0;
 711 | 					new1min = FALSE;
 712 | 				}
 713 | 				if(new10min)
 714 | 				{
 715 | 					special = 1;
 716 | 					new10min = FALSE;
 717 | 				}
 718 | 				if(new1hour)
 719 | 				{
 720 | 					special = 2;
 721 | 					new1hour = FALSE;
 722 | 				}
 723 | 			}
 724 | 			else
 725 | 				special = 3 + (rand() % 5);
 726 | 
 727 | 			// At this point, malware rules and "special" is in the range 0..7.
 728 | 			// That's eight different malware behaviors we can log.
 729 | 
 730 | 			// See, when I first wrote this code, the only network was 10.x.x.x
 731 | 			// So, I just assigned random IPs to the eight behaviors.
 732 | //			case 0: strcpy(lip,"10.161.1.5"); break;     // Domain: [a-z]{20,36}
 733 | //			case 1: strcpy(lip,"10.161.1.18"); break;    // "word"-zone domain
 734 | //			case 2: strcpy(lip,"10.161.1.58"); break;    // Domain: [a-f0-9]{32}
 735 | //			case 3: strcpy(lip,"10.161.1.102"); break;   // Domain: (p|s|t)([a-f0-9]{4}\-){3}[a-f0-9]{4}
 736 | //			case 4: strcpy(lip,"10.161.1.117"); break;   // Domain: [a-f0-9]{40}
 737 | //			case 5: strcpy(lip,"10.161.1.160"); break;   // Domain: [a-z0-9]{8,40}
 738 | //			case 6: strcpy(lip,"10.161.1.204"); break;   // base64 encoded subdomain
 739 | //			case 7: strcpy(lip,"10.161.1.241"); break;   // base64 encoded message snippet subdomain	
 740 | 
 741 | 			// Now, with up to three networks to choose from, picking a malware IP
 742 | 			// is more difficult. But I think I came up with a cool way to pick one.
 743 | 
 744 | 			// First, look at this array: int plist[6][3] = {{0,1,2},{0,2,1},{1,0,2},{1,2,0},{2,0,1},{2,1,0}};
 745 | 			// It represents all six permutations of 0, 1, and 2.
 746 | 			// These numbers represent the three networks (0: net10, 1: net172, 2: net192)
 747 | 			// Now, we pick a number between 0 and 5 to access a 012 group. Let's pretend it is 4.
 748 | 			// In the {2,0,1} group (plist[4]), we check the first value (2). If net192 is TRUE, we grab its malware IP.
 749 | 			// Otherwise, we check the second value (0). If net10 is TRUE, you get the idea.
 750 | 			// Last, we check the third value (1) and then test net172.
 751 | 			// Note: we exit the loop when the first TRUE net variable is found.
 752 | 			// All active networks (in a truly random world) have the same probability of being chosen.
 753 | 			ppick = FALSE;
 754 | 			n1 = rand() % 6;
 755 | 			n2 = 0;
 756 | 			do
 757 | 			{
 758 | 				switch(plist[n1][n2])
 759 | 				{
 760 | 				case 0: if(net10)
 761 | 							{
 762 | 								strcpy(lip,malwareip10[special]); 
 763 | 								ppick = TRUE;
 764 | 							}
 765 | 						break;
 766 | 				case 1: if(net172)
 767 | 							{
 768 | 								strcpy(lip,malwareip172[special]); 
 769 | 								ppick = TRUE;
 770 | 							}
 771 | 						break;
 772 | 
 773 | 				case 2: if(net192)
 774 | 							{
 775 | 								strcpy(lip,malwareip192[special]); 
 776 | 								ppick = TRUE;
 777 | 							}
 778 | 						break;
 779 | 				}
 780 | 				n2++;
 781 | 			} while (!ppick);
 782 | 		}
 783 | 		else
 784 | 			if(ipr == 22)  // These are spoofed IPs.
 785 | 				strcpy(lip,spoofip[rand() % 8]);
 786 | 			else
 787 | 			{
 788 | 				ppick = FALSE;  // Now we just pick an ordinary, non-infected system from the available networks.
 789 | 				n1 = rand() % 6;
 790 | 				n2 = 0;
 791 | 				do
 792 | 				{
 793 | 					switch(plist[n1][n2])
 794 | 					{
 795 | 					case 0: if(net10)
 796 | 								{
 797 | 									sprintf(lip,"10.%d.%d.%d",s10,(1 + (rand() % 200)),(1 + (rand() % 250)));
 798 | 									ppick = TRUE;
 799 | 								}
 800 | 							break;
 801 | 					case 1: if(net172)
 802 | 								{
 803 | 									sprintf(lip,"172.%d.%d.%d",s172,(1 + (rand() % 200)),(1 + (rand() % 250))); 
 804 | 									ppick = TRUE;
 805 | 								}
 806 | 							break;
 807 | 					case 2: if(net192)
 808 | 								{
 809 | 									sprintf(lip,"192.168.%d.%d",s192,(1 + (rand() % 250)));
 810 | 									ppick = TRUE;
 811 | 								}
 812 | 							break;
 813 | 					}
 814 | 					n2++;
 815 | 				} while (!ppick);
 816 | 			}
 817 | 
 818 | 		lh3[0] = '\0';
 819 | 		sprintf(lh3,"%04X", rand() % 65536);
 820 | 
 821 | 		// Generate one of eight different malware domain types.
 822 | 		ldom[0] = '\0';
 823 | 		if(ipr == 5)
 824 | 		{
 825 | 			switch(special)
 826 | 			{
 827 | 			case 0: n2 = 20 + (rand() % 17);  // Domain: [a-z]{20,36}
 828 | 				for(n1 = 0; n1 < n2; n1++) 
 829 | 					exfil[n1] = dga[rand() % 26];
 830 | 				exfil[n2] = '\0';
 831 | 				if (noms)
 832 | 					sprintf(ldom,"%s",exfil);
 833 | 				else
 834 | 					sprintf(ldom,"(%d)%s",n2,exfil);
 835 | 				rv = rand() % 6;
 836 | 				if (noms)
 837 | 					switch(rv)
 838 | 					{
 839 | 					case 0: strcat(ldom,".com"); break; 
 840 | 					case 1: strcat(ldom,".org"); break;
 841 | 					case 2: strcat(ldom,".net"); break;
 842 | 					case 3: strcat(ldom,".biz"); break;
 843 | 					case 4: strcat(ldom,".info"); break;
 844 | 					case 5: strcat(ldom,ccode()); break;
 845 | 					}
 846 | 				else
 847 | 					switch(rv)
 848 | 					{
 849 | 					case 0: strcat(ldom,"(3)com(0)"); break;
 850 | 					case 1: strcat(ldom,"(3)org(0)"); break;
 851 | 					case 2: strcat(ldom,"(3)net(0)"); break;
 852 | 					case 3: strcat(ldom,"(3)biz(0)"); break;
 853 | 					case 4: strcat(ldom,"(4)info(0)"); break;
 854 | 					case 5: strcat(ldom,ccode2()); break;
 855 | 					}
 856 | 				lstat[0] = '\0';
 857 | 				if(5 == (rand() % 20))
 858 | 					strcpy(lstat,"[0001 D NOERROR]");
 859 | 				else
 860 | 					strcpy(lstat,"[8081 D NXDOMAIN]");
 861 | 				break;
 862 | 			case 1: n1 = rand() % 60;  // "word"-zone domain
 863 | 				if (noms)
 864 | 				{
 865 | 					switch(rand() % 6)
 866 | 					{
 867 | 					case 0: sprintf(ldom,"%s%04x-zone.net",wlist[n1],(rand() % 65536)); break;
 868 | 					case 1: sprintf(ldom,"%s%04x-area.com",wlist[n1],(rand() % 65536));  break;
 869 | 					case 2: sprintf(ldom,"%s%04x-machine.org",wlist[n1],(rand() % 65536));  break;
 870 | 					case 3: sprintf(ldom,"%s%04x-service.biz",wlist[n1],(rand() % 65536));  break;
 871 | 					case 4: sprintf(ldom,"%s%04x-list.de",wlist[n1],(rand() % 65536)); break;
 872 | 					case 5: sprintf(ldom,"%s%04x-dump.bg",wlist[n1],(rand() % 65536)); break;
 873 | 					}
 874 | 				}
 875 | 				else
 876 | 				{
 877 | 					switch(rand() % 6)
 878 | 					{
 879 | 					case 0: sprintf(ldom,"(%d)%s%04x-zone(3)net(0)",(9+strlen(wlist[n1])),wlist[n1],(rand() % 65536)); break;
 880 | 					case 1: sprintf(ldom,"(%d)%s%04x-area(3)com(0)",(9+strlen(wlist[n1])),wlist[n1],(rand() % 65536));  break;
 881 | 					case 2: sprintf(ldom,"(%d)%s%04x-machine(3)org(0)",(12+strlen(wlist[n1])),wlist[n1],(rand() % 65536));  break;
 882 | 					case 3: sprintf(ldom,"(%d)%s%04x-service(3)biz(0)",(12+strlen(wlist[n1])),wlist[n1],(rand() % 65536));  break;
 883 | 					case 4: sprintf(ldom,"(%d)%s%04x-list(2)de(0)",(9+strlen(wlist[n1])),wlist[n1],(rand() % 65536)); break;
 884 | 					case 5: sprintf(ldom,"(%d)%s%04x-dump(2)bg(0)",(9+strlen(wlist[n1])),wlist[n1],(rand() % 65536)); break;
 885 | 					}
 886 | 				}
 887 | 				lstat[0] = '\0';
 888 | 				if(5 == (rand() % 20))
 889 | 					strcpy(lstat,"[0001 D NOERROR]");
 890 | 				else
 891 | 					strcpy(lstat,"[8081 D NXDOMAIN]");
 892 | 				break;
 893 | 			case 2: for(n1 = 0; n1 < 32; n1++) exfil[n1] = exalpha[rand() % 16];  // Domain: [a-f0-9]{32}
 894 | 				exfil[32] = '\0';
 895 | 				if (noms)
 896 | 				{
 897 | 					switch(rand() % 6)
 898 | 					{
 899 | 					case 0: sprintf(ldom,"%s.daisyland.net",exfil); break;
 900 | 					case 1: sprintf(ldom,"%s.shopctr.com",exfil);  break;
 901 | 					case 2: sprintf(ldom,"%s.biztrack.org",exfil);  break;
 902 | 					case 3: sprintf(ldom,"%s.baidv.cn",exfil);  break;
 903 | 					case 4: sprintf(ldom,"%s.kronosya.ru",exfil); break;
 904 | 					case 5: sprintf(ldom,"%s.bialystok.pl",exfil); break;
 905 | 					}
 906 | 				}
 907 | 				else
 908 | 				{
 909 | 					switch(rand() % 6)
 910 | 					{
 911 | 					case 0: sprintf(ldom,"(32)%s(9)daisyland(3)net(0)",exfil);  break;
 912 | 					case 1: sprintf(ldom,"(32)%s(7)shopctr(3)com(0)",exfil);  break;
 913 | 					case 2: sprintf(ldom,"(32)%s(8)biztrack(3)org(0)",exfil);  break;
 914 | 					case 3: sprintf(ldom,"(32)%s(5)baidv(2)cn(0)",exfil);  break;
 915 | 					case 4: sprintf(ldom,"(32)%s(8)kronosya(2)ru(0)",exfil); break;
 916 | 					case 5: sprintf(ldom,"(32)%s(9)bialystok(2)pl(0)",exfil); break;
 917 | 					}
 918 | 				}
 919 | 				break;
 920 | 			case 3: for(n1 = 0; n1 < 20; n1++) exfil[n1] = exalpha[rand() % 16];  // Domain: (p|s|t)([a-f0-9]{4}\-){3}[a-f0-9]{4}
 921 | 				exfil[20] = '\0';
 922 | 				switch(rand() % 3)
 923 | 				{
 924 | 				case 0: exfil[0] = 'p'; break;
 925 | 				case 1: exfil[0] = 's'; break;
 926 | 				case 2: exfil[0] = 't'; break;
 927 | 				}
 928 | 				exfil[5]='-';
 929 | 				exfil[10]='-';
 930 | 				exfil[15]='-';
 931 | 				if (noms)
 932 | 				{
 933 | 					switch(rand() % 6)
 934 | 					{
 935 | 					case 0: sprintf(ldom,"%s.badguy.com",exfil); break;
 936 | 					case 1: sprintf(ldom,"%s.secret.org",exfil); break;
 937 | 					case 2: sprintf(ldom,"%s.hidden.net",exfil); break;
 938 | 					case 3: sprintf(ldom,"%s.sinkhole.biz",exfil); break;
 939 | 					case 4: sprintf(ldom,"%s.zhishubao.cn",exfil); break;
 940 | 					case 5: sprintf(ldom,"%s.click.in",exfil); break;
 941 | 					}
 942 | 				}
 943 | 				else
 944 | 				{
 945 | 					switch(rand() % 6)
 946 | 					{
 947 | 					case 0: sprintf(ldom,"(20)%s(6)badguy(3)com(0)",exfil); break;
 948 | 					case 1: sprintf(ldom,"(20)%s(6)secret(3)org(0)",exfil); break;
 949 | 					case 2: sprintf(ldom,"(20)%s(6)hidden(3)net(0)",exfil); break;
 950 | 					case 3: sprintf(ldom,"(20)%s(8)sinkhole(3)biz(0)",exfil); break;
 951 | 					case 4: sprintf(ldom,"(20)%s(9)zhishubao(2)cn(0)",exfil); break;
 952 | 					case 5: sprintf(ldom,"(20)%s(5)click(2)in(0)",exfil); break;
 953 | 					}
 954 | 				}
 955 | 				break;			
 956 | 			case 4: for(n1 = 0; n1 < 40; n1++) exfil[n1] = exalpha[rand() % 16];   // Domain: [a-f0-9]{40}
 957 | 				exfil[40] = '\0';
 958 | 				if (noms)
 959 | 				{
 960 | 					switch(rand() % 6)
 961 | 					{
 962 | 					case 0: sprintf(ldom,"%s.jennyhaden.com",exfil); break;
 963 | 					case 1: sprintf(ldom,"%s.starsearch.net",exfil); break;
 964 | 					case 2: sprintf(ldom,"%s.allexpensespaid.biz",exfil); break;
 965 | 					case 3: sprintf(ldom,"%s.dosvidanya.ru",exfil); break;
 966 | 					case 4: sprintf(ldom,"%s.doubleclack.org",exfil); break;
 967 | 					case 5: sprintf(ldom,"%s.spy.ro",exfil); break;
 968 | 					}
 969 | 				}
 970 | 				else
 971 | 				{
 972 | 					switch(rand() % 6)
 973 | 					{
 974 | 					case 0: sprintf(ldom,"(40)%s(10)jennyhaden(3)com(0)",exfil); break;
 975 | 					case 1: sprintf(ldom,"(40)%s(10)starsearch(3)net(0)",exfil); break;
 976 | 					case 2: sprintf(ldom,"(40)%s(15)allexpensespaid(3)biz(0)",exfil); break;
 977 | 					case 3: sprintf(ldom,"(40)%s(10)dosvidanya(2)ru(0)",exfil); break;
 978 | 					case 4: sprintf(ldom,"(40)%s(11)doubleclack(3)org(0)",exfil); break;
 979 | 					case 5: sprintf(ldom,"(40)%s(3)spy(2)ro(0)",exfil); break;					}
 980 | 				}
 981 | 				break;
 982 | 			case 5: n2 = 8 + (rand() % 33);   // Domain: [a-z0-9]{8,40}
 983 | 				for(n1 = 0; n1 < n2; n1++) exfil[n1] = exalpha2[rand() % 36];
 984 | 				exfil[n2] = '\0';
 985 | 				if (noms)
 986 | 				{
 987 | 					switch(rand() % 6)
 988 | 					{
 989 | 					case 0: sprintf(ldom,"%s.oldbooks.org",exfil); break;
 990 | 					case 1: sprintf(ldom,"%s.targit.com",exfil); break;
 991 | 					case 2: sprintf(ldom,"%s.stapels.net",exfil); break;
 992 | 					case 3: sprintf(ldom,"%s.bestbye.biz",exfil); break;
 993 | 					case 4: sprintf(ldom,"%s.izvestiia.ru",exfil); break;
 994 | 					case 5: sprintf(ldom,"%s.huitek.cn",exfil); break;
 995 | 					}
 996 | 				}
 997 | 				else
 998 | 				{
 999 | 					switch(rand() % 6)
1000 | 					{
1001 | 					case 0: sprintf(ldom,"(%d)%s(8)oldbooks(3)org(0)",n2,exfil); break;
1002 | 					case 1: sprintf(ldom,"(%d)%s(6)targit(3)com(0)",n2,exfil); break;
1003 | 					case 2: sprintf(ldom,"(%d)%s(7)stapels(3)net(0)",n2,exfil); break;
1004 | 					case 3: sprintf(ldom,"(%d)%s(7)bestbye(3)biz(0)",n2,exfil); break;
1005 | 					case 4: sprintf(ldom,"(%d)%s(9)izvestiia(2)ru(0)",n2,exfil); break;
1006 | 					case 5: sprintf(ldom,"(%d)%s(6)huitek(2)cn(0)",n2,exfil); break;
1007 | 					}
1008 | 				}
1009 | 				break;
1010 | 			case 6: b64pos = rand() % 16;   // base64 encoded subdomain
1011 | 				if (noms)
1012 | 				{
1013 | 					switch(rand() % 6)
1014 | 					{
1015 | 					case 0: sprintf(ldom,"%s.petraplace.net",b64[b64pos]); break;
1016 | 					case 1: sprintf(ldom,"%s.shopctr.com",b64[b64pos]);  break;
1017 | 					case 2: sprintf(ldom,"%s.biztrack.org",b64[b64pos]);  break;
1018 | 					case 3: sprintf(ldom,"%s.googel.tw",b64[b64pos]);  break;
1019 | 					case 4: sprintf(ldom,"%s.yaho.com",b64[b64pos]); break;
1020 | 					case 5: sprintf(ldom,"%s.merhaba.tr",b64[b64pos]); break;
1021 | 					}
1022 | 				}
1023 | 				else
1024 | 				{
1025 | 					switch(rand() % 6)
1026 | 					{
1027 | 					case 0: sprintf(ldom,"(%d)%s(10)petraplace(3)net(0)",strlen(b64[b64pos]),b64[b64pos]);  break;
1028 | 					case 1: sprintf(ldom,"(%d)%s(7)shopctr(3)com(0)",strlen(b64[b64pos]),b64[b64pos]);  break;
1029 | 					case 2: sprintf(ldom,"(%d)%s(8)biztrack(3)org(0)",strlen(b64[b64pos]),b64[b64pos]);  break;
1030 | 					case 3: sprintf(ldom,"(%d)%s(6)googel(2)tw(0)",strlen(b64[b64pos]),b64[b64pos]);  break;
1031 | 					case 4: sprintf(ldom,"(%d)%s(4)yaho(3)com(0)",strlen(b64[b64pos]),b64[b64pos]); break;
1032 | 					case 5: sprintf(ldom,"(%d)%s(7)merhaba(2)tr(0)",strlen(b64[b64pos]),b64[b64pos]); break;
1033 | 					}
1034 | 				}
1035 | 				break;
1036 | 			case 7: if(1200 <= (passes - lastburst))   // base64 encoded message snippet subdomain trigger code
1037 | 					{
1038 | 						bursty = TRUE;
1039 | 						burstknt = 5 + (rand() % 10);
1040 | 						lastburst = passes;
1041 | 					}
1042 | 					else  // Or pick an ordinary domain
1043 | 					{
1044 | 						if(noms)
1045 | 							strcpy(ldom,doms[rand() % NDOMS]);  
1046 | 						else
1047 | 							strcpy(ldom,msdoms[rand() % NDOMS]);
1048 | 					}
1049 | 					break;
1050 | 			}
1051 | 		}
1052 | 		else  // Or pick an ordinary domain
1053 | 		{
1054 | 			if(noms)
1055 | 				strcpy(ldom,doms[rand() % NDOMS]);  
1056 | 			else
1057 | 				strcpy(ldom,msdoms[rand() % NDOMS]);
1058 | 		}
1059 | 
1060 | 		if(!bursty)
1061 | 		{
1062 | 			if(!SIMPLE)
1063 | 			{
1064 | 				fprintf(ofile,"%s %s %s PACKET %s UDP %s %s %s %s %s A %s\n",ld,lt,lh1,lh2,lsr,lip,lh3,lqr,lstat,ldom);
1065 | 				sprintf(logline,"%s %s %s PACKET %s UDP %s %s %s %s %s A %s\n",ld,lt,lh1,lh2,lsr,lip,lh3,lqr,lstat,ldom);
1066 | 				filesize += strlen(logline);
1067 | 				lineslogged++;
1068 | 			}
1069 | 			else
1070 | 			{
1071 | 				fprintf(ofile,"%s %s %s %s %s\n",ld,lt,lip,lstat,ldom);
1072 | 				lineslogged++;
1073 | 			}
1074 | 		}
1075 | 		else  // base64 encoded message snippet subdomain burst generation
1076 | 		{
1077 | 			rv = rand() % 6;
1078 | 			for(n1 = 0; n1 < burstknt; n1++)
1079 | 			{
1080 | 				ldom[0] = '\0';
1081 | 				bmsg[0] = '\0';
1082 | 				b64pos = 4 * (rand() % ((strlen(b64str) - 48)/4));
1083 | 				for(n2 = 0; n2 < 48; n2++)
1084 | 					bmsg[n2] = b64str[b64pos+n2];
1085 | 				bmsg[48] = '\0';
1086 | 				if (noms)
1087 | 				{
1088 | 					switch(rv)
1089 | 					{
1090 | 					case 0: sprintf(ldom,"%s.axa.biz",bmsg); break;
1091 | 					case 1: sprintf(ldom,"%s.colorpix.org",bmsg); break;
1092 | 					case 2: sprintf(ldom,"%s.windosupdate.com",bmsg); break;
1093 | 					case 3: sprintf(ldom,"%s.travel.id",bmsg); break;
1094 | 					case 4: sprintf(ldom,"%s.kouponcash.net",bmsg); break;
1095 | 					case 5: sprintf(ldom,"%s.zelora.sg",bmsg); break;
1096 | 					}
1097 | 				}
1098 | 				else
1099 | 				{
1100 | 					switch(rv)
1101 | 					{
1102 | 					case 0: sprintf(ldom,"(48)%s(3)axa(3)biz(0)",bmsg); break;
1103 | 					case 1: sprintf(ldom,"(48)%s(8)colorpix(3)org(0)",bmsg); break;
1104 | 					case 2: sprintf(ldom,"(48)%s(12)windosupdate(3)com(0)",bmsg); break;
1105 | 					case 3: sprintf(ldom,"(48)%s(6)travel(2)id(0)",bmsg); break;
1106 | 					case 4: sprintf(ldom,"(48)%s(10)kouponcash(3)net(0)",bmsg); break;
1107 | 					case 5: sprintf(ldom,"(48)%s(6)zelora(2)sg(0)",bmsg); break;
1108 | 					}
1109 | 				}
1110 | 				if(!SIMPLE)
1111 | 				{
1112 | 					fprintf(ofile,"%s %s %s PACKET %s UDP %s %s %s %s %s A %s\n",ld,lt,lh1,lh2,lsr,lip,lh3,lqr,lstat,ldom);
1113 | 					sprintf(logline,"%s %s %s PACKET %s UDP %s %s %s %s %s A %s\n",ld,lt,lh1,lh2,lsr,lip,lh3,lqr,lstat,ldom);
1114 | 					filesize += strlen(logline);
1115 | 					lineslogged++;
1116 | 				}
1117 | 				else
1118 | 				{
1119 | 					fprintf(ofile,"%s %s %s %s %s\n",ld,lt,lip,lstat,ldom);
1120 | 					lineslogged++;
1121 | 				}
1122 | 			}
1123 | 			bursty = FALSE;
1124 | 		}
1125 | 
1126 | 		// Check need to split log file
1127 | 		if((filesize > filemaxsize) && filesplit)
1128 | 		{
1129 | 			fclose(ofile);
1130 | 			if(0 == strlen(fname2))
1131 | 				sprintf(fname,"%s%d",fname1,fknt);
1132 | 			else
1133 | 				sprintf(fname,"%s%d.%s",fname1,fknt,fname2);
1134 | 			ofile = fopen(fname,"w");
1135 | 			if(ofile == NULL)
1136 | 			{
1137 | 				printf("Error! Can not open %s\n",fname);
1138 | 				perror(NULL);
1139 | 				exit(0);
1140 | 			}
1141 | 			fknt++;
1142 | 			filesize = 0;
1143 | 		}
1144 | 
1145 | 		// At this point we have generated and written one or more log entries during the current second.
1146 | 		// A burst will cause multiple log entries.
1147 | 
1148 | 		// Now we see if we have used up all the sub-seconds for the current second.
1149 | 		// Even a moderatly large network will exhibit multiple DNS requests each second.
1150 | 		subsec--;
1151 | 		if(subsec == 0)
1152 | 		{
1153 | 			sec++;
1154 | 			subsec = 2 + (rand() % 11);
1155 | 			if(sec == 15)
1156 | 				new1min = TRUE;   // 1-minute beacons occur at the 15-second mark
1157 | 			if(sec == 30)
1158 | 			{
1159 | 				if(0 == (min % 10))
1160 | 					new10min = TRUE;   // 10-minute beacons occur at the 30-second mark
1161 | 			}
1162 | 			if(sec == 60)
1163 | 			{
1164 | 				sec = 0;
1165 | 				min++;
1166 | 				if(min == 60)
1167 | 				{
1168 | 					min = 0;
1169 | 					hr++;
1170 | 					new1hour = TRUE;   // 1-hour beacons occur at the 0-second mark
1171 | 					if(hr == 24)
1172 | 					{
1173 | 						hr = 0;
1174 | 						day++;
1175 | 						if(day > monlist[mon])
1176 | 						{
1177 | 							day = 1;
1178 | 							mon++;
1179 | 							if(mon > 12)
1180 | 							{
1181 | 								mon = 1;
1182 | 								yr++;
1183 | 							}
1184 | 						}
1185 | 						switch(datemode)
1186 | 						{
1187 | 						case 0: sprintf(ld,"%d%02d%02d",yr,mon,day); break;
1188 | 						case 1: sprintf(ld,"%d-%02d-%02d",yr,mon,day); break;
1189 | 						case 2: sprintf(ld,"%s %d %d",months[mon],day,yr); break;
1190 | 						}
1191 | 						if(verb)
1192 | 							printf("\n%s\n",ld);
1193 | 					}
1194 | 				}
1195 | 			}
1196 | 			if(ampm)
1197 | 			{
1198 | 				if(hr < 12)
1199 | 					sprintf(lt,"%02d:%02d:%02d am",hrlist[hr],min,sec);
1200 | 				else
1201 | 					sprintf(lt,"%02d:%02d:%02d pm",hrlist[hr],min,sec);
1202 | 			}
1203 | 			else
1204 | 				sprintf(lt,"%02d:%02d:%02d",hr,min,sec);
1205 | 		}
1206 | 		passes++;
1207 | 
1208 | 		// Give the user something to look at and see signs of life when large log files are being generated.
1209 | 		if(0 == (passes % 100000))
1210 | 		{
1211 | 			printf(".");
1212 | 			dots++;
1213 | 			if(dots == 10)
1214 | 			{
1215 | 				dots = 0;
1216 | 				printf(" ");
1217 | 				megs++;
1218 | 				if(0 == (megs % 10))
1219 | 					printf("\n%dM\n",megs);
1220 | 			}
1221 | 		}
1222 | 	} while (((passes < maxlines) && linestop) || ((!linestop) && ((mon != today_mon) || (day != today_day) || (yr != today_yr))));
1223 | 	printf("\n");
1224 | 	printf("Start date/time: %s\n",startime);
1225 | 	printf("Final date/time: %s, %s\n",ld,lt);
1226 | 	printf("%ld lines logged.\n",lineslogged);
1227 | 	fclose(ofile);
1228 | 	exit(1);
1229 | }
1230 | 


--------------------------------------------------------------------------------