0sec-cli 0.15.0 → 0.17.0

package/chunks/exploit-climb-2FAUP6XU.js

@@ -0,0 +1,358 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  findingSchema,
+  formatZodError
+} from "./chunk-KKGE5RQE.js";
+import {
+  external_exports
+} from "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+
+// packages/cli/src/commands/exploit-climb.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { resolve } from "node:path";
+
+// packages/benchmark/dist/kernel-weaponization-collector.js
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname, isAbsolute } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+var __dirname = dirname(fileURLToPath(import.meta.url));
+var ESCALATION_RUNGS = [
+  "none",
+  "attempted",
+  "reclaim",
+  "arb-read",
+  "arb-write",
+  "root"
+];
+function pick(obj, ...keys) {
+  if (!obj)
+    return void 0;
+  for (const k of keys) {
+    if (obj[k] !== void 0 && obj[k] !== null)
+      return obj[k];
+  }
+  return void 0;
+}
+function asString(v) {
+  return typeof v === "string" ? v : v === void 0 || v === null ? "" : String(v);
+}
+function rungRank(rung) {
+  const idx = ESCALATION_RUNGS.indexOf(rung);
+  return idx;
+}
+function normalizeStep(raw) {
+  const r = raw ?? {};
+  const attemptedRung = asString(pick(r, "attempted_rung", "attemptedRung", "target_rung", "targetRung"));
+  const reachedRung = asString(pick(r, "reached_rung", "reachedRung"));
+  const reason = asString(pick(r, "reason"));
+  const refused = attemptedRung !== "" && reachedRung !== "" && rungRank(reachedRung) < rungRank(attemptedRung);
+  return {
+    stepId: asString(pick(r, "strategy_id", "strategyId", "node_id", "nodeId")),
+    title: asString(pick(r, "title")),
+    attemptedRung,
+    reachedRung,
+    reason,
+    refused
+  };
+}
+function collectSampleFromRun(run, index = 0) {
+  if (!run || typeof run !== "object")
+    return void 0;
+  const root = run;
+  const result = root["result"] ?? root;
+  const weap = result["weaponization"] ?? result;
+  const detail = weap["detail"] ?? weap;
+  const highestRung = asString(pick(weap, "highestRung", "highest_rung"));
+  if (highestRung === "")
+    return void 0;
+  const rawSteps = pick(detail, "perStep", "per_step", "attempts");
+  const perStep = Array.isArray(rawSteps) ? rawSteps.map(normalizeStep) : [];
+  const exploitContext = pick(detail, "exploitContext", "exploit_context") ?? void 0;
+  const findingId = asString(pick(root, "finding_id", "findingId") || pick(result, "finding_id", "findingId") || pick(weap, "finding_id", "findingId"));
+  const runId = asString(pick(root, "run_id", "runId", "id"));
+  const source = runId || findingId || `run-${index}`;
+  return {
+    id: source,
+    input: {
+      ...findingId ? { findingId } : {},
+      ...asString(pick(root, "kasan", "signature", "crash_dmesg")) ? { kasan: asString(pick(root, "kasan", "signature", "crash_dmesg")) } : {},
+      ...pick(root, "primitive") ? { primitive: pick(root, "primitive") } : {},
+      ...pick(exploitContext, "writeProfile", "write_profile") ? { writeProfile: pick(exploitContext, "writeProfile", "write_profile") } : {},
+      ...pick(exploitContext, "sprayPlans", "spray_plans") ? { sprayPlans: pick(exploitContext, "sprayPlans", "spray_plans") } : {},
+      ...pick(exploitContext, "rootTailPlan", "root_tail_plan") ? { rootTailPlan: pick(exploitContext, "rootTailPlan", "root_tail_plan") } : {},
+      ...asString(pick(root, "cache_key", "cacheKey")) ? { cacheKey: asString(pick(root, "cache_key", "cacheKey")) } : {}
+    },
+    label: {
+      highestRung,
+      lpeAchieved: Boolean(pick(weap, "lpeAchieved", "lpe_achieved")),
+      reclaimLanded: Boolean(pick(weap, "reclaimLanded", "reclaim_landed")),
+      perStep,
+      refusedReasons: perStep.filter((s) => s.refused && s.reason !== "").map((s) => s.reason)
+    },
+    source
+  };
+}
+function collectFromRunsFile(path) {
+  const data = JSON.parse(readFileSync(path, "utf8"));
+  const runs = Array.isArray(data) ? data : Array.isArray(data?.runs) ? data.runs : Array.isArray(data?.rows) ? data.rows : [];
+  const samples = [];
+  runs.forEach((run, i) => {
+    const s = collectSampleFromRun(run, i);
+    if (s)
+      samples.push(s);
+  });
+  return samples;
+}
+function toJsonl(sample) {
+  return JSON.stringify({
+    id: sample.id,
+    input: sample.input,
+    label: sample.label,
+    source: sample.source
+  });
+}
+var KERNEL_WEAPONIZATION_CORPUS_PATH = "results/kernel-weaponization-v1.jsonl";
+function resolveKernelWeaponizationCorpusPath(override, packageRoot = join(__dirname, "..")) {
+  const requested = override ?? process.env.KERNEL_WEAPONIZATION_CORPUS_PATH;
+  if (requested && requested.length > 0) {
+    return isAbsolute(requested) ? requested : join(process.cwd(), requested);
+  }
+  return join(packageRoot, KERNEL_WEAPONIZATION_CORPUS_PATH);
+}
+function appendWeaponizationRun(run, opts = {}) {
+  try {
+    const sample = collectSampleFromRun(run);
+    if (!sample)
+      return false;
+    const corpus = resolveKernelWeaponizationCorpusPath(opts.corpusPath);
+    const dir = dirname(corpus);
+    if (dir && dir !== ".")
+      mkdirSync(dir, { recursive: true });
+    const line = toJsonl(sample) + "\n";
+    if (existsSync(corpus)) {
+      appendFileSync(corpus, line);
+    } else {
+      writeFileSync(corpus, line);
+    }
+    return true;
+  } catch (err) {
+    opts.logger?.(`[weaponization-corpus] append skipped: ${err instanceof Error ? err.message : String(err)}`);
+    return false;
+  }
+}
+async function main() {
+  const args = process.argv.slice(2);
+  const runsIdx = args.indexOf("--runs");
+  if (runsIdx === -1) {
+    console.error("usage: kernel-weaponization-collector --runs <runs.json> [--output <out.jsonl>]");
+    process.exit(1);
+  }
+  const runsPath = args[runsIdx + 1];
+  const samples = collectFromRunsFile(runsPath);
+  const lpe = samples.filter((s) => s.label.lpeAchieved).length;
+  const refused = samples.filter((s) => s.label.refusedReasons.length > 0).length;
+  console.error("\n=== Kernel Weaponization Corpus ===");
+  console.error(`  Runs collected:   ${samples.length}`);
+  console.error(`  LPE achieved:     ${lpe}`);
+  console.error(`  With REFUSED rows: ${refused}`);
+  const outIdx = args.indexOf("--output");
+  const outputPath = outIdx !== -1 ? args[outIdx + 1] : void 0;
+  const lines = samples.map(toJsonl);
+  if (outputPath) {
+    const dir = dirname(outputPath);
+    if (dir && dir !== ".")
+      mkdirSync(dir, { recursive: true });
+    writeFileSync(outputPath, lines.length > 0 ? lines.join("\n") + "\n" : "");
+    console.error(`  Written to: ${outputPath}`);
+  } else {
+    const corpus = join(__dirname, "..", KERNEL_WEAPONIZATION_CORPUS_PATH);
+    if (existsSync(dirname(corpus))) {
+      writeFileSync(corpus, lines.length > 0 ? lines.join("\n") + "\n" : "");
+      console.error(`  Written to: ${corpus}`);
+    } else {
+      for (const line of lines)
+        console.log(line);
+    }
+  }
+}
+var isScript = process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isScript) {
+  main().catch((err) => {
+    console.error("Kernel weaponization collection failed:", err);
+    process.exit(1);
+  });
+}
+
+// packages/cli/src/commands/exploit-climb.ts
+function readFinding(findingPath) {
+  const abs = resolve(findingPath);
+  let raw;
+  try {
+    raw = readFileSync2(abs, "utf8");
+  } catch (err) {
+    throw new Error(
+      `failed to read finding from ${abs}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `failed to parse finding as JSON (${abs}): ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  try {
+    return findingSchema.parse(parsed);
+  } catch (err) {
+    if (err instanceof external_exports.ZodError) {
+      throw new Error(formatZodError(err, "finding JSON"));
+    }
+    throw err;
+  }
+}
+function widenerStatusFromEnv() {
+  const symbol = process.env["0SEC_KERNEL_QEMU_WIDEN_SYMBOL"]?.trim();
+  const offset = process.env["0SEC_KERNEL_QEMU_WIDEN_OFFSET"]?.trim();
+  const delay = process.env["0SEC_KERNEL_QEMU_WIDEN_DELAY_MS"]?.trim();
+  const guestBuildDir = process.env["0SEC_KERNEL_QEMU_GUEST_BUILD_DIR"]?.trim();
+  const configured = Boolean(symbol && offset && delay && guestBuildDir);
+  return {
+    configured,
+    note: configured ? `race-widener configured at ${symbol}+${offset} delay=${delay}ms (in-guest build is fail-soft; outcome is in the guest widen.log)` : "race-widener NOT configured (0SEC_KERNEL_QEMU_WIDEN_SYMBOL/_OFFSET/_DELAY_MS + _GUEST_BUILD_DIR); boots run WITHOUT widening \u2014 a flaky root race may simply not have been hit"
+  };
+}
+async function runClimb(opts) {
+  const log = opts.logger ?? ((line) => process.stderr.write(line + "\n"));
+  const {
+    runKernelExploitChain,
+    bootedCacheKey,
+    writeProofFileReadOnly,
+    defaultDmesgOutPath
+  } = await import("./dist-FDKALV4R.js");
+  const finding = readFinding(opts.findingPath);
+  const reproducer = opts.reproducerPath ? readFileSync2(resolve(opts.reproducerPath), "utf8") : void 0;
+  const kernelConfigText = opts.kernelConfigPath ? readFileSync2(resolve(opts.kernelConfigPath), "utf8") : void 0;
+  const vmlinuxPath = opts.vmlinuxPath ? resolve(opts.vmlinuxPath) : void 0;
+  const widener = widenerStatusFromEnv();
+  log(`[climb] ${widener.note}`);
+  const weaponizeLane = /^(1|true|on|yes)$/i.test(process.env["0SEC_KERNEL_QEMU_INITRAMFS"]?.trim() ?? "") || /^(1|true|on|yes)$/i.test(process.env.USE_KERNEL_WEAPONIZE?.trim() ?? "");
+  log(
+    weaponizeLane ? "[climb] weaponize lane: lightweight busybox-initramfs boot (rdinit=/init, no 9p root disk)" : "[climb] weaponize lane: 9p disk boot (set USE_KERNEL_WEAPONIZE=1 for the lightweight initramfs lane)"
+  );
+  const attempts = [];
+  let highestRung = "none";
+  let rootsAchieved = 0;
+  let creditingCacheKey;
+  let creditingReason = "";
+  let proofPath = null;
+  for (let boot = 1; boot <= opts.loopBoots; boot++) {
+    log(`[climb] boot ${boot}/${opts.loopBoots} \u2014 driving real chain runner`);
+    const result = await runKernelExploitChain([finding], {
+      bootKaslr: false,
+      ...reproducer ? { reproducer } : {},
+      ...vmlinuxPath ? { vmlinuxPath } : {},
+      ...kernelConfigText ? { kernelConfigText } : {},
+      ...opts.freedStruct ? { freedStruct: opts.freedStruct } : {},
+      logger: log
+    });
+    const cacheKey = bootedCacheKey();
+    const attempt = {
+      boot,
+      ran: result.ran,
+      highestRung: result.highestRung,
+      lpeAchieved: result.lpeAchieved,
+      reclaimLanded: result.reclaimLanded,
+      ...cacheKey ? { cacheKey } : {},
+      reason: result.reason
+    };
+    attempts.push(attempt);
+    if (result.ran) {
+      appendWeaponizationRun(
+        {
+          run_id: `${finding.id}-boot${boot}`,
+          finding_id: finding.id,
+          result: {
+            weaponization: {
+              highestRung: result.highestRung,
+              lpeAchieved: result.lpeAchieved,
+              reclaimLanded: result.reclaimLanded,
+              attempts: result.summary.attempts,
+              detail: {
+                perStep: result.perStep,
+                ...result.exploitContext ? { exploitContext: result.exploitContext } : {}
+              }
+            }
+          }
+        },
+        { corpusPath: opts.corpusPath, logger: log }
+      );
+    }
+    if (result.lpeAchieved || highestRung === "none") {
+      highestRung = result.highestRung;
+    }
+    if (!result.ran) {
+      log(
+        "[climb] artifacts not present \u2014 chain returned plan-only (ran:false). No QEMU was spawned. Stage the vulnerable-kernel target (see runbook)."
+      );
+      creditingReason = result.reason;
+      break;
+    }
+    if (result.lpeAchieved) {
+      rootsAchieved++;
+      creditingCacheKey = cacheKey;
+      creditingReason = result.reason;
+      highestRung = result.highestRung;
+      const out = opts.proofOutPath ? resolve(opts.proofOutPath) : defaultDmesgOutPath();
+      const proof = JSON.stringify(
+        {
+          kind: "kernel-root-climb-proof",
+          finding_id: finding.id,
+          boot,
+          boots_attempted: boot,
+          highest_rung: result.highestRung,
+          lpe_achieved: true,
+          reclaim_landed: result.reclaimLanded,
+          cache_key: cacheKey ?? null,
+          verdict: result.reason,
+          rationale: result.rationale,
+          per_step: result.perStep,
+          summary: result.summary,
+          artifact_c: result.summary.artifactC ?? null
+        },
+        null,
+        2
+      );
+      writeProofFileReadOnly(out, proof + "\n");
+      proofPath = out;
+      log(`[climb] ROOT credited on boot ${boot}. proof: ${out} cacheKey: ${cacheKey ?? "<none>"}`);
+      break;
+    }
+    creditingReason = result.reason;
+    log(`[climb] boot ${boot}: no root (rung='${result.highestRung}'). ${result.reason}`);
+  }
+  const rootReached = rootsAchieved > 0;
+  const exitCode = rootReached ? 0 : attempts.some((a) => a.ran) ? 1 : 2;
+  return {
+    exitCode,
+    result: {
+      mode: "kernel-root-climb",
+      finding_id: finding.id,
+      boots_attempted: attempts.length,
+      roots_achieved: rootsAchieved,
+      root_reached: rootReached,
+      highest_rung: highestRung,
+      cache_key: creditingCacheKey ?? null,
+      proof_path: proofPath,
+      verdict: creditingReason,
+      widener,
+      attempts
+    }
+  };
+}
+export {
+  runClimb
+};

package/chunks/fix-IG7LYXH3.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  runSourceFix
+} from "./chunk-F3WBKITT.js";
+import "./chunk-LP3HHYQU.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  runSourceFix
+};

package/chunks/github-issues-MJ6OYOOU.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import "./chunk-IR537GON.js";
+
+// packages/cli/src/exporters/github-issues.ts
+function buildIssueTitle(finding) {
+  const sev = finding.severity.toUpperCase();
+  return `[${sev}] ${finding.title}`;
+}
+function buildIssueBody(finding) {
+  const lines = [];
+  lines.push(`## Description`);
+  lines.push(finding.description);
+  lines.push("");
+  lines.push(`## Details`);
+  lines.push(`- **Severity:** ${finding.severity}`);
+  lines.push(`- **Category:** ${finding.category}`);
+  lines.push(`- **Status:** ${finding.status}`);
+  if (finding.cvssScore !== void 0) {
+    lines.push(`- **CVSS Score:** ${finding.cvssScore}`);
+  }
+  if (finding.cvssVector) {
+    lines.push(`- **CVSS Vector:** ${finding.cvssVector}`);
+  }
+  if (finding.confidence !== void 0) {
+    lines.push(`- **Confidence:** ${(finding.confidence * 100).toFixed(0)}%`);
+  }
+  lines.push("");
+  if (finding.evidence) {
+    lines.push(`## Evidence`);
+    if (finding.evidence.request) {
+      lines.push(`### Request`);
+      lines.push("```");
+      lines.push(finding.evidence.request);
+      lines.push("```");
+      lines.push("");
+    }
+    if (finding.evidence.response) {
+      lines.push(`### Response`);
+      lines.push("```");
+      lines.push(finding.evidence.response);
+      lines.push("```");
+      lines.push("");
+    }
+    if (finding.evidence.analysis) {
+      lines.push(`### Analysis`);
+      lines.push(finding.evidence.analysis);
+      lines.push("");
+    }
+  }
+  lines.push("---");
+  lines.push(`*Exported by [0sec](https://github.com/0sec-labs/0sec) | Finding ID: \`${finding.id}\`*`);
+  return lines.join("\n");
+}
+function getLabels(finding) {
+  const labels = ["0sec", `severity:${finding.severity}`, `category:${finding.category}`];
+  return labels;
+}
+async function githubApi(method, url, token, body) {
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28"
+  };
+  if (body !== void 0) {
+    headers["Content-Type"] = "application/json";
+  }
+  const resp = await fetch(url, {
+    method,
+    headers,
+    body: body !== void 0 ? JSON.stringify(body) : void 0
+  });
+  if (!resp.ok) {
+    const text = await resp.text();
+    throw new Error(`GitHub API ${method} ${url} returned ${resp.status}: ${text}`);
+  }
+  return resp.json();
+}
+async function fetchExistingIssueTitles(repo, token) {
+  const titles = /* @__PURE__ */ new Set();
+  let page = 1;
+  const perPage = 100;
+  while (true) {
+    const url = `https://api.github.com/repos/${repo}/issues?state=open&labels=0sec&per_page=${perPage}&page=${page}`;
+    const issues = await githubApi("GET", url, token);
+    for (const issue of issues) {
+      titles.add(issue.title);
+    }
+    if (issues.length < perPage) break;
+    page++;
+  }
+  return titles;
+}
+async function ensureLabels(repo, token, labels) {
+  const url = `https://api.github.com/repos/${repo}/labels?per_page=100`;
+  const existing = await githubApi("GET", url, token);
+  const existingNames = new Set(existing.map((l) => l.name));
+  const severityColors = {
+    "severity:critical": "b60205",
+    "severity:high": "d93f0b",
+    "severity:medium": "e4e669",
+    "severity:low": "0e8a16",
+    "severity:info": "c5def5"
+  };
+  for (const label of labels) {
+    if (existingNames.has(label)) continue;
+    const color = severityColors[label] ?? "ededed";
+    try {
+      await githubApi("POST", `https://api.github.com/repos/${repo}/labels`, token, {
+        name: label,
+        color
+      });
+    } catch {
+    }
+  }
+}
+async function exportToGitHubIssues(findings, repo) {
+  const token = process.env.GITHUB_TOKEN;
+  if (!token) {
+    throw new Error(
+      "GITHUB_TOKEN environment variable is required for GitHub Issues export. Create a token at https://github.com/settings/tokens with the 'repo' scope."
+    );
+  }
+  if (findings.length === 0) {
+    return { created: 0, skipped: 0 };
+  }
+  const allLabels = /* @__PURE__ */ new Set();
+  allLabels.add("0sec");
+  for (const f of findings) {
+    for (const l of getLabels(f)) {
+      allLabels.add(l);
+    }
+  }
+  await ensureLabels(repo, token, [...allLabels]);
+  const existingTitles = await fetchExistingIssueTitles(repo, token);
+  let created = 0;
+  let skipped = 0;
+  for (const finding of findings) {
+    const title = buildIssueTitle(finding);
+    if (existingTitles.has(title)) {
+      skipped++;
+      continue;
+    }
+    await githubApi("POST", `https://api.github.com/repos/${repo}/issues`, token, {
+      title,
+      body: buildIssueBody(finding),
+      labels: getLabels(finding)
+    });
+    existingTitles.add(title);
+    created++;
+  }
+  return { created, skipped };
+}
+export {
+  exportToGitHubIssues
+};

package/chunks/harness-HWOYFKFY.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  bootedCacheKey,
+  kernelVmArtifactsReady,
+  mintCanary,
+  runStrategy,
+  runWeaponization
+} from "./chunk-KTQDLNSR.js";
+import "./chunk-SNKTC4BP.js";
+import "./chunk-RJWOYEOG.js";
+import "./chunk-KKGE5RQE.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  bootedCacheKey,
+  kernelVmArtifactsReady,
+  mintCanary,
+  runStrategy,
+  runWeaponization
+};

package/chunks/http-conformance-DU66MZIU.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  runHttpConformanceCheck
+} from "./chunk-IOL7D5YV.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-IR537GON.js";
+export {
+  runHttpConformanceCheck
+};

package/chunks/http-sender-GWH2IYEA.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  createLiveHttpSender
+} from "./chunk-2RMLOJVB.js";
+import "./chunk-IR537GON.js";
+export {
+  createLiveHttpSender
+};

package/chunks/hunt-scan-XPELSPQQ.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  AimdState,
+  composeGate,
+  makeMultiLensVerifier,
+  makeSkepticVerifier,
+  runHuntScan
+} from "./chunk-K26SZ37E.js";
+import "./chunk-RJWOYEOG.js";
+import "./chunk-O462Y7P2.js";
+import "./chunk-LOHTE223.js";
+import "./chunk-3MOLBTLS.js";
+import "./chunk-P6WKNFWX.js";
+import "./chunk-SOG2U7B3.js";
+import "./chunk-LP3HHYQU.js";
+import "./chunk-KLTNTE2Z.js";
+import "./chunk-HT6P7RY3.js";
+import "./chunk-RRMJC3ZE.js";
+import "./chunk-H2FFLZNK.js";
+import "./chunk-UM3ZNQIM.js";
+import "./chunk-57ZENEX2.js";
+import "./chunk-MMLDQR4H.js";
+import "./chunk-2SANI5RH.js";
+import "./chunk-CLHCDHP4.js";
+import "./chunk-QOKTUOU2.js";
+import "./chunk-KKGE5RQE.js";
+import "./chunk-YLMN3N25.js";
+import "./chunk-DW5UWPFY.js";
+import "./chunk-IR537GON.js";
+export {
+  AimdState,
+  composeGate,
+  makeMultiLensVerifier,
+  makeSkepticVerifier,
+  runHuntScan
+};