@guardbee/mcp-reverse-shield 0.0.0-stage → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +117 -2
- package/TR.md +114 -0
- package/ZH.md +61 -0
- package/dist/__tests__/android.test.d.ts +2 -0
- package/dist/__tests__/android.test.d.ts.map +1 -0
- package/dist/__tests__/android.test.js +114 -0
- package/dist/__tests__/android.test.js.map +1 -0
- package/dist/__tests__/electron.test.d.ts +2 -0
- package/dist/__tests__/electron.test.d.ts.map +1 -0
- package/dist/__tests__/electron.test.js +128 -0
- package/dist/__tests__/electron.test.js.map +1 -0
- package/dist/__tests__/live.test.d.ts +2 -0
- package/dist/__tests__/live.test.d.ts.map +1 -0
- package/dist/__tests__/live.test.js +67 -0
- package/dist/__tests__/live.test.js.map +1 -0
- package/dist/__tests__/native.test.d.ts +2 -0
- package/dist/__tests__/native.test.d.ts.map +1 -0
- package/dist/__tests__/native.test.js +111 -0
- package/dist/__tests__/native.test.js.map +1 -0
- package/dist/__tests__/scanner.test.d.ts +2 -0
- package/dist/__tests__/scanner.test.d.ts.map +1 -0
- package/dist/__tests__/scanner.test.js +127 -0
- package/dist/__tests__/scanner.test.js.map +1 -0
- package/dist/__tests__/testFixtures.d.ts +61 -0
- package/dist/__tests__/testFixtures.d.ts.map +1 -0
- package/dist/__tests__/testFixtures.js +416 -0
- package/dist/__tests__/testFixtures.js.map +1 -0
- package/dist/__tests__/web.test.d.ts +2 -0
- package/dist/__tests__/web.test.d.ts.map +1 -0
- package/dist/__tests__/web.test.js +156 -0
- package/dist/__tests__/web.test.js.map +1 -0
- package/dist/apk.d.ts +9 -0
- package/dist/apk.d.ts.map +1 -0
- package/dist/apk.js +132 -0
- package/dist/apk.js.map +1 -0
- package/dist/asar.d.ts +10 -0
- package/dist/asar.d.ts.map +1 -0
- package/dist/asar.js +73 -0
- package/dist/asar.js.map +1 -0
- package/dist/axml.d.ts +20 -0
- package/dist/axml.d.ts.map +1 -0
- package/dist/axml.js +104 -0
- package/dist/axml.js.map +1 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +172 -0
- package/dist/cli.js.map +1 -0
- package/dist/config.d.ts +8 -0
- package/dist/config.d.ts.map +1 -0
- package/dist/config.js +102 -0
- package/dist/config.js.map +1 -0
- package/dist/dex.d.ts +16 -0
- package/dist/dex.d.ts.map +1 -0
- package/dist/dex.js +63 -0
- package/dist/dex.js.map +1 -0
- package/dist/electron.d.ts +26 -0
- package/dist/electron.d.ts.map +1 -0
- package/dist/electron.js +146 -0
- package/dist/electron.js.map +1 -0
- package/dist/finding.d.ts +30 -0
- package/dist/finding.d.ts.map +1 -0
- package/dist/finding.js +38 -0
- package/dist/finding.js.map +1 -0
- package/dist/fsutil.d.ts +20 -0
- package/dist/fsutil.d.ts.map +1 -0
- package/dist/fsutil.js +80 -0
- package/dist/fsutil.js.map +1 -0
- package/dist/index.d.ts +16 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +12 -0
- package/dist/index.js.map +1 -0
- package/dist/live.d.ts +14 -0
- package/dist/live.d.ts.map +1 -0
- package/dist/live.js +144 -0
- package/dist/live.js.map +1 -0
- package/dist/native.d.ts +18 -0
- package/dist/native.d.ts.map +1 -0
- package/dist/native.js +411 -0
- package/dist/native.js.map +1 -0
- package/dist/rules.d.ts +22 -0
- package/dist/rules.d.ts.map +1 -0
- package/dist/rules.js +354 -0
- package/dist/rules.js.map +1 -0
- package/dist/sarif.d.ts +3 -0
- package/dist/sarif.d.ts.map +1 -0
- package/dist/sarif.js +60 -0
- package/dist/sarif.js.map +1 -0
- package/dist/scanner.d.ts +27 -0
- package/dist/scanner.d.ts.map +1 -0
- package/dist/scanner.js +169 -0
- package/dist/scanner.js.map +1 -0
- package/dist/server.d.ts +7 -0
- package/dist/server.d.ts.map +1 -0
- package/dist/server.js +88 -0
- package/dist/server.js.map +1 -0
- package/dist/web.d.ts +56 -0
- package/dist/web.d.ts.map +1 -0
- package/dist/web.js +301 -0
- package/dist/web.js.map +1 -0
- package/dist/zip.d.ts +21 -0
- package/dist/zip.d.ts.map +1 -0
- package/dist/zip.js +112 -0
- package/dist/zip.js.map +1 -0
- package/package.json +52 -3
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"live.d.ts","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAwDD;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CA2EhG"}
|
package/dist/live.js
ADDED
|
@@ -0,0 +1,144 @@
|
|
|
1
|
+
import { bySeverity, grade } from "./finding.js";
|
|
2
|
+
import { analyzeJavaScript, parseSourceMap, sourceMapFinding, sourceMappingUrl } from "./web.js";
|
|
3
|
+
const MAX_PAGE_BYTES = 5 * 1024 * 1024;
|
|
4
|
+
const MAX_SCRIPT_BYTES = 20 * 1024 * 1024;
|
|
5
|
+
const MAX_MAP_BYTES = 50 * 1024 * 1024;
|
|
6
|
+
const USER_AGENT = "guardbee-reverse-shield (+https://guardbee.ai)";
|
|
7
|
+
const SCRIPT_SRC = /<script\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*>/gi;
|
|
8
|
+
const MODULE_PRELOAD = /<link\b[^>]*?\brel\s*=\s*["']modulepreload["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/gi;
|
|
9
|
+
const INLINE_SCRIPT = /<script\b(?![^>]*\bsrc\s*=)[^>]*>([\s\S]*?)<\/script>/gi;
|
|
10
|
+
async function fetchText(url, limit, options) {
|
|
11
|
+
const controller = new AbortController();
|
|
12
|
+
const timer = setTimeout(() => controller.abort(), options.timeoutMs);
|
|
13
|
+
try {
|
|
14
|
+
const res = await options.fetchImpl(url, { signal: controller.signal, redirect: "follow", headers: { "user-agent": USER_AGENT } });
|
|
15
|
+
const declared = Number(res.headers.get("content-length") ?? "0");
|
|
16
|
+
if (declared > limit)
|
|
17
|
+
return { status: res.status, text: "" };
|
|
18
|
+
if (!res.body)
|
|
19
|
+
return { status: res.status, text: await res.text() };
|
|
20
|
+
const reader = res.body.getReader();
|
|
21
|
+
const chunks = [];
|
|
22
|
+
let total = 0;
|
|
23
|
+
for (;;) {
|
|
24
|
+
const { done, value } = await reader.read();
|
|
25
|
+
if (done)
|
|
26
|
+
break;
|
|
27
|
+
total += value.length;
|
|
28
|
+
if (total > limit) {
|
|
29
|
+
await reader.cancel();
|
|
30
|
+
break;
|
|
31
|
+
}
|
|
32
|
+
chunks.push(value);
|
|
33
|
+
}
|
|
34
|
+
return { status: res.status, text: Buffer.concat(chunks).toString("utf8") };
|
|
35
|
+
}
|
|
36
|
+
catch {
|
|
37
|
+
return null;
|
|
38
|
+
}
|
|
39
|
+
finally {
|
|
40
|
+
clearTimeout(timer);
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
/** Same site: the page's host or another host under the same last two labels (cdn.example.com for www.example.com). */
|
|
44
|
+
function sameSite(a, b) {
|
|
45
|
+
const root = (h) => h.split(".").slice(-2).join(".");
|
|
46
|
+
return a.hostname === b.hostname || root(a.hostname) === root(b.hostname);
|
|
47
|
+
}
|
|
48
|
+
async function probeMap(mapUrl, scriptUrl, referenced, opts) {
|
|
49
|
+
const res = await fetchText(mapUrl, MAX_MAP_BYTES, opts);
|
|
50
|
+
if (!res || res.status !== 200)
|
|
51
|
+
return null;
|
|
52
|
+
const info = parseSourceMap(res.text);
|
|
53
|
+
if (!info)
|
|
54
|
+
return null;
|
|
55
|
+
const f = sourceMapFinding(info, scriptUrl, "sourcemap_publicly_reachable");
|
|
56
|
+
f.match = `${mapUrl}${referenced ? "" : " (not referenced by the bundle, but served)"} — ${f.match}`;
|
|
57
|
+
return f;
|
|
58
|
+
}
|
|
59
|
+
/**
|
|
60
|
+
* Loads a live page, then checks the same-site scripts it pulls in the way
|
|
61
|
+
* an analyst would start: read the bundles, follow their source map comments,
|
|
62
|
+
* and try `<bundle>.map` even when the comment was stripped.
|
|
63
|
+
*/
|
|
64
|
+
export async function scanUrl(pageUrl, options = {}) {
|
|
65
|
+
const start = Date.now();
|
|
66
|
+
const opts = { timeoutMs: options.timeoutMs ?? 10_000, fetchImpl: options.fetchImpl ?? fetch };
|
|
67
|
+
const maxScripts = options.maxScripts ?? 25;
|
|
68
|
+
const page = new URL(pageUrl);
|
|
69
|
+
if (page.protocol !== "http:" && page.protocol !== "https:")
|
|
70
|
+
throw new Error(`Only http(s) URLs can be scanned: ${pageUrl}`);
|
|
71
|
+
const findings = [];
|
|
72
|
+
const notes = [];
|
|
73
|
+
const res = await fetchText(page.href, MAX_PAGE_BYTES, opts);
|
|
74
|
+
if (!res)
|
|
75
|
+
throw new Error(`Could not fetch ${page.href}`);
|
|
76
|
+
if (res.status >= 400)
|
|
77
|
+
notes.push(`${page.href} answered HTTP ${res.status}`);
|
|
78
|
+
const html = res.text;
|
|
79
|
+
const scripts = [];
|
|
80
|
+
let thirdParty = 0;
|
|
81
|
+
for (const re of [SCRIPT_SRC, MODULE_PRELOAD]) {
|
|
82
|
+
for (const m of html.matchAll(re)) {
|
|
83
|
+
let u;
|
|
84
|
+
try {
|
|
85
|
+
u = new URL(m[1], page);
|
|
86
|
+
}
|
|
87
|
+
catch {
|
|
88
|
+
continue;
|
|
89
|
+
}
|
|
90
|
+
if (!sameSite(page, u)) {
|
|
91
|
+
thirdParty++;
|
|
92
|
+
continue;
|
|
93
|
+
}
|
|
94
|
+
if (!scripts.includes(u.href))
|
|
95
|
+
scripts.push(u.href);
|
|
96
|
+
}
|
|
97
|
+
}
|
|
98
|
+
if (thirdParty > 0)
|
|
99
|
+
notes.push(`${thirdParty} third-party script(s) not checked`);
|
|
100
|
+
if (scripts.length > maxScripts)
|
|
101
|
+
notes.push(`Checked the first ${maxScripts} of ${scripts.length} same-site scripts`);
|
|
102
|
+
let inline = 0;
|
|
103
|
+
for (const m of html.matchAll(INLINE_SCRIPT)) {
|
|
104
|
+
if (m[1].trim().length === 0)
|
|
105
|
+
continue;
|
|
106
|
+
inline++;
|
|
107
|
+
findings.push(...analyzeJavaScript(m[1], `${page.href} (inline script ${inline})`, { skipMinifyCheck: true }));
|
|
108
|
+
}
|
|
109
|
+
let scanned = 0;
|
|
110
|
+
for (const scriptUrl of scripts.slice(0, maxScripts)) {
|
|
111
|
+
const script = await fetchText(scriptUrl, MAX_SCRIPT_BYTES, opts);
|
|
112
|
+
if (!script || script.status !== 200) {
|
|
113
|
+
notes.push(`${scriptUrl}: ${script ? `HTTP ${script.status}` : "fetch failed"}`);
|
|
114
|
+
continue;
|
|
115
|
+
}
|
|
116
|
+
scanned++;
|
|
117
|
+
const ref = sourceMappingUrl(script.text);
|
|
118
|
+
const external = ref !== null && !ref.startsWith("data:");
|
|
119
|
+
const mapUrl = external ? new URL(ref, scriptUrl).href : `${scriptUrl.split(/[?#]/)[0]}.map`;
|
|
120
|
+
const exposed = await probeMap(mapUrl, scriptUrl, external, opts);
|
|
121
|
+
for (const f of analyzeJavaScript(script.text, scriptUrl)) {
|
|
122
|
+
if (exposed && f.patternId === "sourcemap_reference")
|
|
123
|
+
continue;
|
|
124
|
+
findings.push(f);
|
|
125
|
+
}
|
|
126
|
+
if (exposed)
|
|
127
|
+
findings.push(exposed);
|
|
128
|
+
}
|
|
129
|
+
if (scripts.length === 0 && inline === 0)
|
|
130
|
+
notes.push("No scripts found in the page HTML (client-rendered shell loaded another way?)");
|
|
131
|
+
const sorted = findings.sort(bySeverity);
|
|
132
|
+
return {
|
|
133
|
+
target: page.href,
|
|
134
|
+
kinds: ["web"],
|
|
135
|
+
grade: grade(sorted),
|
|
136
|
+
scannedFiles: scanned + (inline > 0 ? 1 : 0),
|
|
137
|
+
totalFindings: sorted.length,
|
|
138
|
+
findings: sorted,
|
|
139
|
+
notes,
|
|
140
|
+
truncated: scripts.length > maxScripts,
|
|
141
|
+
durationMs: Date.now() - start,
|
|
142
|
+
};
|
|
143
|
+
}
|
|
144
|
+
//# sourceMappingURL=live.js.map
|
package/dist/live.js.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"live.js","sourceRoot":"","sources":["../src/live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAGjD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AASjG,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,UAAU,GAAG,gDAAgD,CAAC;AAEpE,MAAM,UAAU,GAAG,qDAAqD,CAAC;AACzE,MAAM,cAAc,GAAG,2FAA2F,CAAC;AACnH,MAAM,aAAa,GAAG,yDAAyD,CAAC;AAEhF,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa,EAAE,OAAkF;IACrI,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACnI,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;QAClE,IAAI,QAAQ,GAAG,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,uHAAuH;AACvH,SAAS,QAAQ,CAAC,CAAM,EAAE,CAAM;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,SAAiB,EAAE,UAAmB,EAAE,IAAoD;IAClI,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,8BAA8B,CAAC,CAAC;IAC5E,CAAC,CAAC,KAAK,GAAG,GAAG,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6CAA6C,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;IACrG,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,UAA0B,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;IAC/F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAE5C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;IAE7H,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,kBAAkB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEtB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,IAAI,CAAM,CAAC;YACX,IAAI,CAAC;gBACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvB,UAAU,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,UAAU,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,oCAAoC,CAAC,CAAC;IAClF,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,OAAO,OAAO,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAEtH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,EAAE,CAAC;QACT,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,mBAAmB,MAAM,GAAG,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,OAAO,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAElE,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1D,IAAI,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,qBAAqB;gBAAE,SAAS;YAC/D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACtI,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,KAAK,EAAE,CAAC,KAAK,CAAC;QACd,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,aAAa,EAAE,MAAM,CAAC,MAAM;QAC5B,QAAQ,EAAE,MAAM;QAChB,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,UAAU;QACtC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}
|
package/dist/native.d.ts
ADDED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import type { Finding } from "./finding.js";
|
|
2
|
+
export type NativeFormat = "elf" | "macho" | "fat-macho" | "pe";
|
|
3
|
+
export interface NativeResult {
|
|
4
|
+
format: NativeFormat;
|
|
5
|
+
/** "dotnet" when a PE carries a CLR header. */
|
|
6
|
+
flavor?: "dotnet";
|
|
7
|
+
findings: Finding[];
|
|
8
|
+
notes: string[];
|
|
9
|
+
}
|
|
10
|
+
export declare function detectNativeFormat(prefix: Buffer): NativeFormat | null;
|
|
11
|
+
export declare function analyzeNative(buf: Buffer, file: string): NativeResult | null;
|
|
12
|
+
/** The #Strings heap holds every type, member, namespace and parameter name the assembly defines or references. */
|
|
13
|
+
export declare function readDotnetStringsHeap(buf: Buffer, metaOff: number): string[] | null;
|
|
14
|
+
export declare function assessDotnetNames(names: string[]): {
|
|
15
|
+
obfuscated: boolean;
|
|
16
|
+
summary: string;
|
|
17
|
+
};
|
|
18
|
+
//# sourceMappingURL=native.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,OAAO,GAAG,WAAW,GAAG,IAAI,CAAC;AAEhE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAOD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAWtE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY5E;AAiVD,mHAAmH;AACnH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAiBnF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAc3F"}
|
package/dist/native.js
ADDED
|
@@ -0,0 +1,411 @@
|
|
|
1
|
+
import { finding } from "./finding.js";
|
|
2
|
+
const MH_MAGIC_64 = 0xfeedfacf;
|
|
3
|
+
const MH_MAGIC = 0xfeedface;
|
|
4
|
+
const FAT_MAGIC = 0xcafebabe;
|
|
5
|
+
const FAT_MAGIC_64 = 0xcafebabf;
|
|
6
|
+
export function detectNativeFormat(prefix) {
|
|
7
|
+
if (prefix.length < 8)
|
|
8
|
+
return null;
|
|
9
|
+
if (prefix[0] === 0x7f && prefix.toString("latin1", 1, 4) === "ELF")
|
|
10
|
+
return "elf";
|
|
11
|
+
const le = prefix.readUInt32LE(0);
|
|
12
|
+
if (le === MH_MAGIC_64 || le === MH_MAGIC)
|
|
13
|
+
return "macho";
|
|
14
|
+
const be = prefix.readUInt32BE(0);
|
|
15
|
+
// Java class files share 0xCAFEBABE; there the next word is the class
|
|
16
|
+
// version (>= 45), while a fat Mach-O holds a small architecture count.
|
|
17
|
+
if ((be === FAT_MAGIC || be === FAT_MAGIC_64) && prefix.readUInt32BE(4) > 0 && prefix.readUInt32BE(4) < 20)
|
|
18
|
+
return "fat-macho";
|
|
19
|
+
if (prefix[0] === 0x4d && prefix[1] === 0x5a)
|
|
20
|
+
return "pe";
|
|
21
|
+
return null;
|
|
22
|
+
}
|
|
23
|
+
export function analyzeNative(buf, file) {
|
|
24
|
+
const format = detectNativeFormat(buf);
|
|
25
|
+
if (!format)
|
|
26
|
+
return null;
|
|
27
|
+
try {
|
|
28
|
+
if (format === "elf")
|
|
29
|
+
return analyzeElf(buf, file);
|
|
30
|
+
if (format === "macho")
|
|
31
|
+
return { format, ...analyzeMachO(buf, file) };
|
|
32
|
+
if (format === "fat-macho")
|
|
33
|
+
return analyzeFat(buf, file);
|
|
34
|
+
return analyzePe(buf, file);
|
|
35
|
+
}
|
|
36
|
+
catch (err) {
|
|
37
|
+
// A truncated or malformed header is not a finding about the developer's build.
|
|
38
|
+
return { format, findings: [], notes: [`${file}: could not parse ${format} headers (${err.message})`] };
|
|
39
|
+
}
|
|
40
|
+
}
|
|
41
|
+
// ── ELF ─────────────────────────────────────────────────────────────────────
|
|
42
|
+
const PT_INTERP = 3;
|
|
43
|
+
const PT_GNU_STACK = 0x6474e551;
|
|
44
|
+
const PT_GNU_RELRO = 0x6474e552;
|
|
45
|
+
const SHT_SYMTAB = 2;
|
|
46
|
+
const ET_EXEC = 2;
|
|
47
|
+
const ET_DYN = 3;
|
|
48
|
+
function analyzeElf(buf, file) {
|
|
49
|
+
const is64 = buf[4] === 2;
|
|
50
|
+
const le = buf[5] === 1;
|
|
51
|
+
const u16 = (o) => (le ? buf.readUInt16LE(o) : buf.readUInt16BE(o));
|
|
52
|
+
const u32 = (o) => (le ? buf.readUInt32LE(o) : buf.readUInt32BE(o));
|
|
53
|
+
const addr = (o) => (is64 ? Number(le ? buf.readBigUInt64LE(o) : buf.readBigUInt64BE(o)) : u32(o));
|
|
54
|
+
const type = u16(16);
|
|
55
|
+
const phoff = addr(is64 ? 32 : 28);
|
|
56
|
+
const shoff = addr(is64 ? 40 : 32);
|
|
57
|
+
const phentsize = u16(is64 ? 54 : 42);
|
|
58
|
+
const phnum = u16(is64 ? 56 : 44);
|
|
59
|
+
const shentsize = u16(is64 ? 58 : 46);
|
|
60
|
+
const shnum = u16(is64 ? 60 : 48);
|
|
61
|
+
const shstrndx = u16(is64 ? 62 : 50);
|
|
62
|
+
const segments = [];
|
|
63
|
+
for (let i = 0; i < phnum; i++) {
|
|
64
|
+
const o = phoff + i * phentsize;
|
|
65
|
+
if (o + phentsize > buf.length)
|
|
66
|
+
break;
|
|
67
|
+
segments.push({ type: u32(o), flags: u32(o + (is64 ? 4 : 24)) });
|
|
68
|
+
}
|
|
69
|
+
const sections = [];
|
|
70
|
+
if (shoff > 0 && shoff + shnum * shentsize <= buf.length) {
|
|
71
|
+
const raw = [];
|
|
72
|
+
for (let i = 0; i < shnum; i++) {
|
|
73
|
+
const o = shoff + i * shentsize;
|
|
74
|
+
raw.push({
|
|
75
|
+
nameOff: u32(o),
|
|
76
|
+
type: u32(o + 4),
|
|
77
|
+
offset: addr(o + (is64 ? 24 : 16)),
|
|
78
|
+
size: addr(o + (is64 ? 32 : 20)),
|
|
79
|
+
entsize: addr(o + (is64 ? 56 : 36)),
|
|
80
|
+
});
|
|
81
|
+
}
|
|
82
|
+
const strtab = raw[shstrndx];
|
|
83
|
+
for (const s of raw) {
|
|
84
|
+
let name = "";
|
|
85
|
+
if (strtab) {
|
|
86
|
+
const start = strtab.offset + s.nameOff;
|
|
87
|
+
const end = buf.indexOf(0, start);
|
|
88
|
+
if (start < buf.length && end !== -1)
|
|
89
|
+
name = buf.toString("latin1", start, end);
|
|
90
|
+
}
|
|
91
|
+
sections.push({ name, type: s.type, offset: s.offset, size: s.size, entsize: s.entsize });
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
const findings = [];
|
|
95
|
+
const names = sections.map((s) => s.name);
|
|
96
|
+
const debug = names.filter((n) => /^\.z?debug_(info|line)$/.test(n));
|
|
97
|
+
if (debug.length > 0)
|
|
98
|
+
findings.push(finding("native_debug_info", file, { match: `sections: ${debug.join(", ")}` }));
|
|
99
|
+
const symtab = sections.find((s) => s.type === SHT_SYMTAB);
|
|
100
|
+
if (symtab) {
|
|
101
|
+
const count = symtab.entsize > 0 ? Math.floor(symtab.size / symtab.entsize) : 0;
|
|
102
|
+
findings.push(finding("native_symbols_not_stripped", file, { match: `.symtab with ${count} entries` }));
|
|
103
|
+
}
|
|
104
|
+
const hasInterp = segments.some((s) => s.type === PT_INTERP);
|
|
105
|
+
const isExecutable = type === ET_EXEC || (type === ET_DYN && hasInterp);
|
|
106
|
+
if (type === ET_EXEC)
|
|
107
|
+
findings.push(finding("native_no_pie", file, { match: "ELF type EXEC (fixed load address)" }));
|
|
108
|
+
if (type === ET_EXEC || type === ET_DYN) {
|
|
109
|
+
const stack = segments.find((s) => s.type === PT_GNU_STACK);
|
|
110
|
+
if (!stack)
|
|
111
|
+
findings.push(finding("native_no_nx", file, { match: "no PT_GNU_STACK segment (executable stack by default)" }));
|
|
112
|
+
else if (stack.flags & 1)
|
|
113
|
+
findings.push(finding("native_no_nx", file, { match: "PT_GNU_STACK is RWX" }));
|
|
114
|
+
if (!segments.some((s) => s.type === PT_GNU_RELRO))
|
|
115
|
+
findings.push(finding("native_no_relro", file, { match: "no PT_GNU_RELRO segment" }));
|
|
116
|
+
// Go and Rust toolchains do not use the libc canary; reporting it there is noise.
|
|
117
|
+
const isGo = names.includes(".gopclntab") || names.includes(".note.go.buildid");
|
|
118
|
+
const isRust = buf.includes("rust_begin_unwind") || names.includes(".rustc");
|
|
119
|
+
if (isExecutable && !isGo && !isRust && !buf.includes("__stack_chk_fail")) {
|
|
120
|
+
findings.push(finding("native_no_stack_canary", file, { match: "no reference to __stack_chk_fail" }));
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
return { format: "elf", findings, notes: [] };
|
|
124
|
+
}
|
|
125
|
+
// ── Mach-O ──────────────────────────────────────────────────────────────────
|
|
126
|
+
const LC_SEGMENT = 0x1;
|
|
127
|
+
const LC_SYMTAB = 0x2;
|
|
128
|
+
const LC_SEGMENT_64 = 0x19;
|
|
129
|
+
const LC_CODE_SIGNATURE = 0x1d;
|
|
130
|
+
const MH_EXECUTE = 2;
|
|
131
|
+
const MH_PIE = 0x200000;
|
|
132
|
+
const N_STAB = 0xe0;
|
|
133
|
+
const N_TYPE = 0x0e;
|
|
134
|
+
const N_SECT = 0x0e;
|
|
135
|
+
const N_EXT = 0x01;
|
|
136
|
+
const N_OSO = 0x66;
|
|
137
|
+
const N_FUN = 0x24;
|
|
138
|
+
const N_SO = 0x64;
|
|
139
|
+
const CS_ADHOC = 0x2;
|
|
140
|
+
const CS_RUNTIME = 0x10000;
|
|
141
|
+
const CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0;
|
|
142
|
+
const CSMAGIC_CODEDIRECTORY = 0xfade0c02;
|
|
143
|
+
const CSMAGIC_EMBEDDED_ENTITLEMENTS = 0xfade7171;
|
|
144
|
+
function entitlementTrue(xml, key) {
|
|
145
|
+
const tag = `<key>${key}</key>`;
|
|
146
|
+
const at = xml.indexOf(tag);
|
|
147
|
+
return at !== -1 && /^\s*<true\s*\/>/.test(xml.slice(at + tag.length, at + tag.length + 64));
|
|
148
|
+
}
|
|
149
|
+
function analyzeMachO(buf, file) {
|
|
150
|
+
const is64 = buf.readUInt32LE(0) === MH_MAGIC_64;
|
|
151
|
+
const filetype = buf.readUInt32LE(12);
|
|
152
|
+
const ncmds = buf.readUInt32LE(16);
|
|
153
|
+
const flags = buf.readUInt32LE(24);
|
|
154
|
+
const findings = [];
|
|
155
|
+
const notes = [];
|
|
156
|
+
let symtab = null;
|
|
157
|
+
let codeSig = null;
|
|
158
|
+
let hasDwarfSegment = false;
|
|
159
|
+
let p = is64 ? 32 : 28;
|
|
160
|
+
for (let i = 0; i < ncmds && p + 8 <= buf.length; i++) {
|
|
161
|
+
const cmd = buf.readUInt32LE(p);
|
|
162
|
+
const size = buf.readUInt32LE(p + 4);
|
|
163
|
+
if (size < 8)
|
|
164
|
+
break;
|
|
165
|
+
if (cmd === LC_SYMTAB)
|
|
166
|
+
symtab = { symoff: buf.readUInt32LE(p + 8), nsyms: buf.readUInt32LE(p + 12), stroff: buf.readUInt32LE(p + 16) };
|
|
167
|
+
else if (cmd === LC_CODE_SIGNATURE)
|
|
168
|
+
codeSig = { dataoff: buf.readUInt32LE(p + 8), datasize: buf.readUInt32LE(p + 12) };
|
|
169
|
+
else if ((cmd === LC_SEGMENT_64 || cmd === LC_SEGMENT) && buf.toString("latin1", p + 8, p + 24).split("\0")[0] === "__DWARF")
|
|
170
|
+
hasDwarfSegment = true;
|
|
171
|
+
p += size;
|
|
172
|
+
}
|
|
173
|
+
if (hasDwarfSegment)
|
|
174
|
+
findings.push(finding("native_debug_info", file, { match: "__DWARF segment in the binary" }));
|
|
175
|
+
if (symtab) {
|
|
176
|
+
const entSize = is64 ? 16 : 12;
|
|
177
|
+
let stabs = 0;
|
|
178
|
+
let localDefined = 0;
|
|
179
|
+
let firstObject = "";
|
|
180
|
+
for (let i = 0; i < symtab.nsyms; i++) {
|
|
181
|
+
const o = symtab.symoff + i * entSize;
|
|
182
|
+
if (o + entSize > buf.length)
|
|
183
|
+
break;
|
|
184
|
+
const nType = buf[o + 4];
|
|
185
|
+
if (nType & N_STAB) {
|
|
186
|
+
if (nType === N_OSO || nType === N_SO || nType === N_FUN)
|
|
187
|
+
stabs++;
|
|
188
|
+
if (!firstObject && nType === N_OSO) {
|
|
189
|
+
const s = symtab.stroff + buf.readUInt32LE(o);
|
|
190
|
+
const end = buf.indexOf(0, s);
|
|
191
|
+
if (end !== -1)
|
|
192
|
+
firstObject = buf.toString("utf8", s, end);
|
|
193
|
+
}
|
|
194
|
+
}
|
|
195
|
+
else if ((nType & N_TYPE) === N_SECT && !(nType & N_EXT)) {
|
|
196
|
+
localDefined++;
|
|
197
|
+
}
|
|
198
|
+
}
|
|
199
|
+
if (stabs > 0) {
|
|
200
|
+
findings.push(finding("native_debug_info", file, {
|
|
201
|
+
severity: "medium",
|
|
202
|
+
match: `${stabs} debug-map (stab) entries${firstObject ? `, e.g. ${firstObject}` : ""}`,
|
|
203
|
+
}));
|
|
204
|
+
}
|
|
205
|
+
if (localDefined > 10)
|
|
206
|
+
findings.push(finding("native_symbols_not_stripped", file, { match: `${localDefined} local symbols` }));
|
|
207
|
+
}
|
|
208
|
+
if (filetype === MH_EXECUTE && !(flags & MH_PIE))
|
|
209
|
+
findings.push(finding("native_no_pie", file, { match: "MH_PIE flag not set" }));
|
|
210
|
+
if (!codeSig) {
|
|
211
|
+
if (filetype === MH_EXECUTE)
|
|
212
|
+
findings.push(finding("native_unsigned", file, { match: "no LC_CODE_SIGNATURE" }));
|
|
213
|
+
return { findings, notes };
|
|
214
|
+
}
|
|
215
|
+
const sig = buf.subarray(codeSig.dataoff, codeSig.dataoff + codeSig.datasize);
|
|
216
|
+
if (sig.length < 12 || sig.readUInt32BE(0) !== CSMAGIC_EMBEDDED_SIGNATURE)
|
|
217
|
+
return { findings, notes };
|
|
218
|
+
const count = sig.readUInt32BE(8);
|
|
219
|
+
let cdFlags = null;
|
|
220
|
+
// Apple's own platform binaries are protected by SIP, not the hardened runtime flag.
|
|
221
|
+
let platform = 0;
|
|
222
|
+
let entitlements = "";
|
|
223
|
+
for (let i = 0; i < count; i++) {
|
|
224
|
+
const idx = 12 + i * 8;
|
|
225
|
+
if (idx + 8 > sig.length)
|
|
226
|
+
break;
|
|
227
|
+
const off = sig.readUInt32BE(idx + 4);
|
|
228
|
+
if (off + 8 > sig.length)
|
|
229
|
+
continue;
|
|
230
|
+
const magic = sig.readUInt32BE(off);
|
|
231
|
+
if (magic === CSMAGIC_CODEDIRECTORY && cdFlags === null) {
|
|
232
|
+
cdFlags = sig.readUInt32BE(off + 12);
|
|
233
|
+
platform = sig[off + 38];
|
|
234
|
+
}
|
|
235
|
+
else if (magic === CSMAGIC_EMBEDDED_ENTITLEMENTS)
|
|
236
|
+
entitlements = sig.toString("utf8", off + 8, off + sig.readUInt32BE(off + 4));
|
|
237
|
+
}
|
|
238
|
+
if (cdFlags !== null) {
|
|
239
|
+
if (cdFlags & CS_ADHOC)
|
|
240
|
+
findings.push(finding("native_adhoc_signed", file, { match: "CodeDirectory flags include CS_ADHOC" }));
|
|
241
|
+
if (filetype === MH_EXECUTE && platform === 0 && !(cdFlags & CS_RUNTIME))
|
|
242
|
+
findings.push(finding("native_no_hardened_runtime", file, { match: "CodeDirectory flags lack CS_RUNTIME" }));
|
|
243
|
+
}
|
|
244
|
+
if (entitlements) {
|
|
245
|
+
if (entitlementTrue(entitlements, "com.apple.security.get-task-allow")) {
|
|
246
|
+
findings.push(finding("native_debuggable_entitlement", file, { match: "com.apple.security.get-task-allow = true" }));
|
|
247
|
+
}
|
|
248
|
+
const injection = ["com.apple.security.cs.disable-library-validation", "com.apple.security.cs.allow-dyld-environment-variables"].filter((k) => entitlementTrue(entitlements, k));
|
|
249
|
+
if (injection.length > 0)
|
|
250
|
+
findings.push(finding("native_injection_entitlement", file, { match: injection.join(", ") }));
|
|
251
|
+
}
|
|
252
|
+
return { findings, notes };
|
|
253
|
+
}
|
|
254
|
+
function analyzeFat(buf, file) {
|
|
255
|
+
const is64 = buf.readUInt32BE(0) === FAT_MAGIC_64;
|
|
256
|
+
const nArch = buf.readUInt32BE(4);
|
|
257
|
+
const seen = new Map();
|
|
258
|
+
const notes = [];
|
|
259
|
+
for (let i = 0; i < nArch; i++) {
|
|
260
|
+
const o = 8 + i * (is64 ? 32 : 20);
|
|
261
|
+
const offset = is64 ? Number(buf.readBigUInt64BE(o + 8)) : buf.readUInt32BE(o + 8);
|
|
262
|
+
const size = is64 ? Number(buf.readBigUInt64BE(o + 16)) : buf.readUInt32BE(o + 12);
|
|
263
|
+
const slice = buf.subarray(offset, offset + size);
|
|
264
|
+
if (detectNativeFormat(slice) !== "macho")
|
|
265
|
+
continue;
|
|
266
|
+
const result = analyzeMachO(slice, file);
|
|
267
|
+
notes.push(...result.notes);
|
|
268
|
+
// Every slice is usually built the same way; report each issue once.
|
|
269
|
+
for (const f of result.findings)
|
|
270
|
+
if (!seen.has(f.patternId))
|
|
271
|
+
seen.set(f.patternId, f);
|
|
272
|
+
}
|
|
273
|
+
return { format: "fat-macho", findings: [...seen.values()], notes };
|
|
274
|
+
}
|
|
275
|
+
// ── PE / .NET ───────────────────────────────────────────────────────────────
|
|
276
|
+
const IMAGE_FILE_DLL = 0x2000;
|
|
277
|
+
const DLLCHAR_DYNAMIC_BASE = 0x40;
|
|
278
|
+
const DLLCHAR_NX_COMPAT = 0x100;
|
|
279
|
+
const DIR_SECURITY = 4;
|
|
280
|
+
const DIR_DEBUG = 6;
|
|
281
|
+
const DIR_CLR = 14;
|
|
282
|
+
const DEBUG_TYPE_CODEVIEW = 2;
|
|
283
|
+
const DEBUG_TYPE_EMBEDDED_PDB = 17;
|
|
284
|
+
/** Attribute and type names that commercial and open-source .NET obfuscators leave behind. */
|
|
285
|
+
const DOTNET_OBFUSCATOR_MARKERS = [
|
|
286
|
+
{ name: "ConfuserEx", marker: "ConfusedByAttribute" },
|
|
287
|
+
{ name: "Dotfuscator", marker: "DotfuscatorAttribute" },
|
|
288
|
+
{ name: "SmartAssembly", marker: "SmartAssembly.Attributes" },
|
|
289
|
+
{ name: "Babel", marker: "BabelObfuscatorAttribute" },
|
|
290
|
+
{ name: "Crypto Obfuscator", marker: "CryptoObfuscator" },
|
|
291
|
+
{ name: "Agile.NET", marker: "SecureTeam.Attributes" },
|
|
292
|
+
{ name: "Goliath", marker: "ObfuscatedByGoliath" },
|
|
293
|
+
{ name: "Xenocode", marker: "Xenocode.Client.Attributes" },
|
|
294
|
+
{ name: "Eazfuscator.NET", marker: "EazfuscatorNET" },
|
|
295
|
+
];
|
|
296
|
+
function analyzePe(buf, file) {
|
|
297
|
+
const peOff = buf.readUInt32LE(0x3c);
|
|
298
|
+
if (buf.toString("latin1", peOff, peOff + 4) !== "PE\0\0")
|
|
299
|
+
return { format: "pe", findings: [], notes: [] };
|
|
300
|
+
const coff = peOff + 4;
|
|
301
|
+
const nSections = buf.readUInt16LE(coff + 2);
|
|
302
|
+
const symPtr = buf.readUInt32LE(coff + 8);
|
|
303
|
+
const nSyms = buf.readUInt32LE(coff + 12);
|
|
304
|
+
const optSize = buf.readUInt16LE(coff + 16);
|
|
305
|
+
const characteristics = buf.readUInt16LE(coff + 18);
|
|
306
|
+
const opt = coff + 20;
|
|
307
|
+
const pe32plus = buf.readUInt16LE(opt) === 0x20b;
|
|
308
|
+
const dllChars = buf.readUInt16LE(opt + 70);
|
|
309
|
+
const nDirs = buf.readUInt32LE(opt + (pe32plus ? 108 : 92));
|
|
310
|
+
const dirBase = opt + (pe32plus ? 112 : 96);
|
|
311
|
+
const dir = (i) => (i < nDirs ? { rva: buf.readUInt32LE(dirBase + i * 8), size: buf.readUInt32LE(dirBase + i * 8 + 4) } : { rva: 0, size: 0 });
|
|
312
|
+
const sections = [];
|
|
313
|
+
for (let i = 0; i < nSections; i++) {
|
|
314
|
+
const o = opt + optSize + i * 40;
|
|
315
|
+
sections.push({ vsize: buf.readUInt32LE(o + 8), va: buf.readUInt32LE(o + 12), rawSize: buf.readUInt32LE(o + 16), raw: buf.readUInt32LE(o + 20) });
|
|
316
|
+
}
|
|
317
|
+
const rvaToOffset = (rva) => {
|
|
318
|
+
for (const s of sections) {
|
|
319
|
+
if (rva >= s.va && rva < s.va + Math.max(s.vsize, s.rawSize))
|
|
320
|
+
return rva - s.va + s.raw;
|
|
321
|
+
}
|
|
322
|
+
return null;
|
|
323
|
+
};
|
|
324
|
+
const isDll = (characteristics & IMAGE_FILE_DLL) !== 0;
|
|
325
|
+
const clr = dir(DIR_CLR);
|
|
326
|
+
const isDotnet = clr.size > 0;
|
|
327
|
+
const findings = [];
|
|
328
|
+
const notes = [];
|
|
329
|
+
if (!(dllChars & DLLCHAR_DYNAMIC_BASE))
|
|
330
|
+
findings.push(finding("native_no_pie", file, { match: "DllCharacteristics lacks DYNAMIC_BASE (ASLR)" }));
|
|
331
|
+
if (!(dllChars & DLLCHAR_NX_COMPAT))
|
|
332
|
+
findings.push(finding("native_no_nx", file, { match: "DllCharacteristics lacks NX_COMPAT (DEP)" }));
|
|
333
|
+
// Authenticode matters for what Windows launches; .NET apps also ship their
|
|
334
|
+
// entry assembly as a non-DLL .dll, where an unsigned file is the norm.
|
|
335
|
+
if (!isDll && /\.exe$/i.test(file) && dir(DIR_SECURITY).size === 0)
|
|
336
|
+
findings.push(finding("native_unsigned", file, { match: "no Authenticode certificate table" }));
|
|
337
|
+
if (symPtr !== 0 && nSyms > 0)
|
|
338
|
+
findings.push(finding("native_symbols_not_stripped", file, { match: `COFF symbol table with ${nSyms} entries` }));
|
|
339
|
+
const debugDir = dir(DIR_DEBUG);
|
|
340
|
+
const debugOff = debugDir.size > 0 ? rvaToOffset(debugDir.rva) : null;
|
|
341
|
+
if (debugOff !== null) {
|
|
342
|
+
for (let o = debugOff; o + 28 <= debugOff + debugDir.size && o + 28 <= buf.length; o += 28) {
|
|
343
|
+
const type = buf.readUInt32LE(o + 12);
|
|
344
|
+
const dataSize = buf.readUInt32LE(o + 16);
|
|
345
|
+
const dataPtr = buf.readUInt32LE(o + 24);
|
|
346
|
+
if (type === DEBUG_TYPE_CODEVIEW && buf.toString("latin1", dataPtr, dataPtr + 4) === "RSDS") {
|
|
347
|
+
const end = buf.indexOf(0, dataPtr + 24);
|
|
348
|
+
const pdbPath = buf.toString("utf8", dataPtr + 24, end === -1 ? dataPtr + dataSize : end);
|
|
349
|
+
if (/^[A-Za-z]:[\\/]|^\//.test(pdbPath))
|
|
350
|
+
findings.push(finding("native_build_path_leak", file, { match: pdbPath }));
|
|
351
|
+
}
|
|
352
|
+
else if (type === DEBUG_TYPE_EMBEDDED_PDB) {
|
|
353
|
+
findings.push(isDotnet
|
|
354
|
+
? finding("dotnet_embedded_pdb", file, { match: `embedded portable PDB (${dataSize} bytes)` })
|
|
355
|
+
: finding("native_debug_info", file, { match: `embedded PDB (${dataSize} bytes)` }));
|
|
356
|
+
}
|
|
357
|
+
}
|
|
358
|
+
}
|
|
359
|
+
if (isDotnet) {
|
|
360
|
+
const clrOff = rvaToOffset(clr.rva);
|
|
361
|
+
const metaOff = clrOff !== null ? rvaToOffset(buf.readUInt32LE(clrOff + 8)) : null;
|
|
362
|
+
const strings = metaOff !== null ? readDotnetStringsHeap(buf, metaOff) : null;
|
|
363
|
+
if (strings) {
|
|
364
|
+
const verdict = assessDotnetNames(strings);
|
|
365
|
+
notes.push(`${file}: .NET assembly, ${verdict.summary}`);
|
|
366
|
+
if (!verdict.obfuscated)
|
|
367
|
+
findings.push(finding("dotnet_not_obfuscated", file, { match: verdict.summary }));
|
|
368
|
+
}
|
|
369
|
+
else {
|
|
370
|
+
notes.push(`${file}: .NET assembly, metadata could not be read`);
|
|
371
|
+
}
|
|
372
|
+
}
|
|
373
|
+
return { format: "pe", flavor: isDotnet ? "dotnet" : undefined, findings, notes };
|
|
374
|
+
}
|
|
375
|
+
/** The #Strings heap holds every type, member, namespace and parameter name the assembly defines or references. */
|
|
376
|
+
export function readDotnetStringsHeap(buf, metaOff) {
|
|
377
|
+
if (buf.toString("latin1", metaOff, metaOff + 4) !== "BSJB")
|
|
378
|
+
return null;
|
|
379
|
+
const versionLen = buf.readUInt32LE(metaOff + 12);
|
|
380
|
+
let p = metaOff + 16 + versionLen;
|
|
381
|
+
const nStreams = buf.readUInt16LE(p + 2);
|
|
382
|
+
p += 4;
|
|
383
|
+
for (let i = 0; i < nStreams; i++) {
|
|
384
|
+
const offset = buf.readUInt32LE(p);
|
|
385
|
+
const size = buf.readUInt32LE(p + 4);
|
|
386
|
+
const nameEnd = buf.indexOf(0, p + 8);
|
|
387
|
+
const name = buf.toString("latin1", p + 8, nameEnd);
|
|
388
|
+
p = p + 8 + Math.ceil((name.length + 1) / 4) * 4;
|
|
389
|
+
if (name === "#Strings") {
|
|
390
|
+
return buf.toString("utf8", metaOff + offset, metaOff + offset + size).split("\0").filter((s) => s.length > 0);
|
|
391
|
+
}
|
|
392
|
+
}
|
|
393
|
+
return null;
|
|
394
|
+
}
|
|
395
|
+
export function assessDotnetNames(names) {
|
|
396
|
+
const joined = names.join("\n");
|
|
397
|
+
const marker = DOTNET_OBFUSCATOR_MARKERS.find((m) => joined.includes(m.marker));
|
|
398
|
+
if (marker)
|
|
399
|
+
return { obfuscated: true, summary: `obfuscator marker found (${marker.name})` };
|
|
400
|
+
// Compiler-generated names (<Main>$), dotted namespace/assembly names and
|
|
401
|
+
// GUIDs are not evidence either way. What renaming obfuscators leave are
|
|
402
|
+
// one- or two-letter names, bare numbers and non-ASCII junk identifiers.
|
|
403
|
+
const candidates = names.filter((n) => !n.startsWith("<") && !n.includes(".") && !/[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-/.test(n));
|
|
404
|
+
if (candidates.length < 30)
|
|
405
|
+
return { obfuscated: true, summary: `only ${candidates.length} metadata names, too few to judge` };
|
|
406
|
+
const renamed = candidates.filter((n) => /^[A-Za-z]{1,2}$/.test(n) || /^\d+$/.test(n) || /[^\x20-\x7e]/.test(n)).length;
|
|
407
|
+
const ratio = renamed / candidates.length;
|
|
408
|
+
const summary = `${renamed} of ${candidates.length} metadata names look renamed (${(ratio * 100).toFixed(0)}%), no obfuscator marker`;
|
|
409
|
+
return { obfuscated: ratio >= 0.1, summary };
|
|
410
|
+
}
|
|
411
|
+
//# sourceMappingURL=native.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAavC,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC;AAC5B,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,YAAY,GAAG,UAAU,CAAC;AAEhC,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE;QAAE,OAAO,WAAW,CAAC;IAC/H,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gFAAgF;QAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,qBAAqB,MAAM,aAAc,GAAa,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IACrH,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,OAAO,GAAG,CAAC,CAAC;AAClB,MAAM,MAAM,GAAG,CAAC,CAAC;AAEjB,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3G,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAErC,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM;QACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAyF,EAAE,CAAC;IAC1G,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,GAAG,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBACf,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;gBAChB,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAChC,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC;gBACxC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClC,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAClF,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEpH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC3D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,gBAAgB,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC;IAErH,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC,CAAC;aACxH,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;QAEzG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;QAE1I,kFAAkF;QAClF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC7E,IAAI,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC1E,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,MAAM,GAAG,IAAI,CAAC;AACpB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,IAAI,GAAG,IAAI,CAAC;AAClB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,UAAU,GAAG,OAAO,CAAC;AAC3B,MAAM,0BAA0B,GAAG,UAAU,CAAC;AAC9C,MAAM,qBAAqB,GAAG,UAAU,CAAC;AACzC,MAAM,6BAA6B,GAAG,UAAU,CAAC;AAEjD,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,MAAM,GAAG,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAChC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,GAA6D,IAAI,CAAC;IAC5E,IAAI,OAAO,GAAiD,IAAI,CAAC;IACjE,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,IAAI,GAAG,CAAC;YAAE,MAAM;QACpB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;aAClI,IAAI,GAAG,KAAK,iBAAiB;YAAE,OAAO,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;aAClH,IAAI,CAAC,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,eAAe,GAAG,IAAI,CAAC;QACrJ,CAAC,IAAI,IAAI,CAAC;IACZ,CAAC;IAED,IAAI,eAAe;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC;IAEnH,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC;YACtC,IAAI,CAAC,GAAG,OAAO,GAAG,GAAG,CAAC,MAAM;gBAAE,MAAM;YACpC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;gBACnB,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK;oBAAE,KAAK,EAAE,CAAC;gBAClE,IAAI,CAAC,WAAW,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;oBACpC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;oBAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC;gBAC3D,YAAY,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE;gBAC/C,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,GAAG,KAAK,4BAA4B,WAAW,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACxF,CAAC,CAAC,CAAC;QACN,CAAC;QACD,IAAI,YAAY,GAAG,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACjI,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;IAElI,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,QAAQ,KAAK,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAChH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,0BAA0B;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtG,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,qFAAqF;IACrF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,SAAS;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;YACrC,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;aACI,IAAI,KAAK,KAAK,6BAA6B;YAAE,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAClI,CAAC;IAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,OAAO,GAAG,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC,CAAC;QAC/H,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,UAAU,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;IACzL,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,eAAe,CAAC,YAAY,EAAE,mCAAmC,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,kDAAkD,EAAE,wDAAwD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5I,eAAe,CAAC,YAAY,EAAE,CAAC,CAAC,CACjC,CAAC;QACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1H,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,IAAY;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,OAAO;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,qEAAqE;QACrE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACtE,CAAC;AAED,+EAA+E;AAE/E,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,8FAA8F;AAC9F,MAAM,yBAAyB,GAA4C;IACzE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,qBAAqB,EAAE;IACrD,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACvD,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,0BAA0B,EAAE;IAC7D,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE;IACrD,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,kBAAkB,EAAE;IACzD,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,uBAAuB,EAAE;IACtD,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE;IAClD,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,4BAA4B,EAAE;IAC1D,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,EAAE;CACtD,CAAC;AAEF,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5G,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvJ,MAAM,QAAQ,GAAuE,EAAE,CAAC;IACxF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAW,EAAiB,EAAE;QACjD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC1F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,CAAC,CAAC,QAAQ,GAAG,oBAAoB,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,8CAA8C,EAAE,CAAC,CAAC,CAAC;IACjJ,IAAI,CAAC,CAAC,QAAQ,GAAG,iBAAiB,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC,CAAC;IACzI,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC;IACpK,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0BAA0B,KAAK,UAAU,EAAE,CAAC,CAAC,CAAC;IAEjJ,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,EAAE,IAAI,QAAQ,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;gBAC5F,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,EAAE,CAAC,CAAC;gBACzC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1F,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACtH,CAAC;iBAAM,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CAAC,QAAQ;oBACpB,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,0BAA0B,QAAQ,SAAS,EAAE,CAAC;oBAC9F,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,QAAQ,SAAS,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC3C,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,oBAAoB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,UAAU;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,6CAA6C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,OAAe;IAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACzE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG,OAAO,GAAG,EAAE,GAAG,UAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC,IAAI,CAAC,CAAC;IACP,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAe;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,IAAI,MAAM;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,4BAA4B,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IAE7F,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,UAAU,CAAC,MAAM,mCAAmC,EAAE,CAAC;IAC/H,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACxH,MAAM,KAAK,GAAG,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,OAAO,OAAO,UAAU,CAAC,MAAM,iCAAiC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACtI,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}
|