Browse code

Support for malloc in bytecode. Fix crash with mismatched api/flevel versions.

Török Edvin authored on 2010/01/21 03:04:01
Showing 16 changed files
... ...
@@ -64,6 +64,7 @@ struct cli_bc_ctx *cli_bytecode_context_alloc(void)
64 64
     ctx->directory = "";
65 65
     ctx->line = 0;
66 66
     ctx->col = 0;
67
+    ctx->mpool = NULL;
67 68
     return ctx;
68 69
 }
69 70
 
... ...
@@ -104,6 +105,14 @@ static int cli_bytecode_context_reset(struct cli_bc_ctx *ctx)
104 104
 	ctx->tempfile = NULL;
105 105
 	ctx->outfd = -1;
106 106
     }
107
+#if USE_MPOOL
108
+    if (ctx->mpool) {
109
+	mpool_destroy(ctx->mpool);
110
+	ctx->mpool = NULL;
111
+    }
112
+#else
113
+    //TODO: implement for no-mmap case too
114
+#endif
107 115
     return CL_SUCCESS;
108 116
 }
109 117
 
... ...
@@ -1222,6 +1231,7 @@ int cli_bytecode_load(struct cli_bc *bc, FILE *f, struct cli_dbio *dbio)
1222 1222
     enum parse_state state;
1223 1223
     int rc;
1224 1224
 
1225
+    memset(bc, 0, sizeof(*bc));
1225 1226
     if (!f && !dbio) {
1226 1227
 	cli_errmsg("Unable to load bytecode (null file)\n");
1227 1228
 	return CL_ENULLARG;
... ...
@@ -52,6 +52,11 @@ uint32_t cli_bcapi_test1(struct cli_bc_ctx *ctx, uint32_t a, uint32_t b)
52 52
     return (a==0xf00dbeef && b==0xbeeff00d) ? 0x12345678 : 0x55;
53 53
 }
54 54
 
55
+uint32_t cli_bcapi_test2(struct cli_bc_ctx *ctx, uint32_t a)
56
+{
57
+    return a == 0xf00d ? 0xd00f : 0x5555;
58
+}
59
+
55 60
 int32_t cli_bcapi_read(struct cli_bc_ctx* ctx, uint8_t *data, int32_t size)
56 61
 {
57 62
     if (!ctx->fmap)
... ...
@@ -87,7 +92,7 @@ uint32_t cli_bcapi_debug_print_str(struct cli_bc_ctx *ctx, const uint8_t *str, u
87 87
     return 0;
88 88
 }
89 89
 
90
-uint32_t cli_bcapi_debug_print_uint(struct cli_bc_ctx *ctx, uint32_t a, uint32_t b)
90
+uint32_t cli_bcapi_debug_print_uint(struct cli_bc_ctx *ctx, uint32_t a)
91 91
 {
92 92
     cli_dbgmsg("bytecode debug: %u\n", a);
93 93
     return 0;
... ...
@@ -254,7 +259,7 @@ uint32_t cli_bcapi_trace_ptr(struct cli_bc_ctx *ctx, const const uint8_t* ptr, u
254 254
     return 0;
255 255
 }
256 256
 
257
-uint32_t cli_bcapi_pe_rawaddr(struct cli_bc_ctx *ctx, uint32_t rva, uint32_t dummy)
257
+uint32_t cli_bcapi_pe_rawaddr(struct cli_bc_ctx *ctx, uint32_t rva)
258 258
 {
259 259
   uint32_t ret;
260 260
   int err = 0;
... ...
@@ -313,7 +318,7 @@ int32_t cli_bcapi_file_find(struct cli_bc_ctx *ctx, const uint8_t* data, uint32_
313 313
     return -1;
314 314
 }
315 315
 
316
-int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t off, uint32_t dummy)
316
+int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t off)
317 317
 {
318 318
     unsigned char c;
319 319
     if (!ctx->fmap)
... ...
@@ -322,3 +327,22 @@ int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t off, uint32_t dum
322 322
 	return -1;
323 323
     return c;
324 324
 }
325
+
326
+uint8_t* cli_bcapi_malloc(struct cli_bc_ctx *ctx, uint32_t size)
327
+{
328
+#if USE_MPOOL
329
+    if (!ctx->mpool) {
330
+	ctx->mpool = mpool_create();
331
+	if (!ctx->mpool) {
332
+	    cli_dbgmsg("bytecode: mpool_create failed!\n");
333
+	    return NULL;
334
+	}
335
+    }
336
+    return mpool_malloc(ctx->mpool, size);
337
+#else
338
+    /* TODO: implement using a list of pointers we allocated! */
339
+    cli_errmsg("cli_bcapi_malloc not implemented for systems without mmap yet!\n");
340
+    return NULL;
341
+#endif
342
+}
343
+
... ...
@@ -141,10 +141,9 @@ uint32_t debug_print_str(const uint8_t *str, uint32_t len);
141 141
  * Prints a number as a debug message.
142 142
  *
143 143
  * @param[in] a number to print
144
- * @param b unused
145 144
  * @return 0
146 145
  */
147
-uint32_t debug_print_uint(uint32_t a, uint32_t b);
146
+uint32_t debug_print_uint(uint32_t a);
148 147
 
149 148
 /**
150 149
  * Disassembles starting from current file position, the specified amount of
... ...
@@ -176,7 +175,7 @@ uint32_t trace_ptr(const uint8_t* ptr, uint32_t dummy);
176 176
   * @return absolute file offset mapped to the \p rva,
177 177
   * or PE_INVALID_RVA if the \p rva is invalid.
178 178
   */
179
-uint32_t pe_rawaddr(uint32_t rva, uint32_t dummy);
179
+uint32_t pe_rawaddr(uint32_t rva);
180 180
 
181 181
 /** Looks for the specified sequence of bytes in the current file.
182 182
   * @param[in] data the sequence of bytes to look for
... ...
@@ -188,7 +187,15 @@ int32_t file_find(const uint8_t* data, uint32_t len);
188 188
   * @param offset file offset
189 189
   * @return byte at offset \p off in the current file, or -1 if offset is
190 190
   * invalid */
191
-int32_t file_byteat(uint32_t offset, uint32_t dummy);
191
+int32_t file_byteat(uint32_t offset);
192
+
193
+/** Allocates memory. Currently this memory is freed automatically on exit
194
+  from the bytecode, and there is no way to free it sooner.
195
+  @param size amount of memory to allocate in bytes
196
+  @return pointer to allocated memory */
197
+void* malloc(uint32_t size);
198
+
199
+uint32_t test2(uint32_t a);
192 200
 
193 201
 #endif
194 202
 #endif
... ...
@@ -40,7 +40,7 @@ int32_t cli_bcapi_write(struct cli_bc_ctx *ctx, uint8_t*, int32_t);
40 40
 int32_t cli_bcapi_seek(struct cli_bc_ctx *ctx, int32_t, uint32_t);
41 41
 uint32_t cli_bcapi_setvirusname(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
42 42
 uint32_t cli_bcapi_debug_print_str(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
43
-uint32_t cli_bcapi_debug_print_uint(struct cli_bc_ctx *ctx, uint32_t, uint32_t);
43
+uint32_t cli_bcapi_debug_print_uint(struct cli_bc_ctx *ctx, uint32_t);
44 44
 uint32_t cli_bcapi_disasm_x86(struct cli_bc_ctx *ctx, struct DISASM_RESULT*, uint32_t);
45 45
 uint32_t cli_bcapi_trace_directory(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
46 46
 uint32_t cli_bcapi_trace_scope(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
... ...
@@ -48,9 +48,11 @@ uint32_t cli_bcapi_trace_source(struct cli_bc_ctx *ctx, const const uint8_t*, ui
48 48
 uint32_t cli_bcapi_trace_op(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
49 49
 uint32_t cli_bcapi_trace_value(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
50 50
 uint32_t cli_bcapi_trace_ptr(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
51
-uint32_t cli_bcapi_pe_rawaddr(struct cli_bc_ctx *ctx, uint32_t, uint32_t);
51
+uint32_t cli_bcapi_pe_rawaddr(struct cli_bc_ctx *ctx, uint32_t);
52 52
 int32_t cli_bcapi_file_find(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
53
-int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t, uint32_t);
53
+int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t);
54
+uint8_t* cli_bcapi_malloc(struct cli_bc_ctx *ctx, uint32_t);
55
+uint32_t cli_bcapi_test2(struct cli_bc_ctx *ctx, uint32_t);
54 56
 
55 57
 const struct cli_apiglobal cli_globals[] = {
56 58
 /* Bytecode globals BEGIN */
... ...
@@ -83,17 +85,19 @@ static uint16_t cli_tmp12[]={82};
83 83
 static uint16_t cli_tmp13[]={32, 32, 32, 32, 32, 32, 32, 32, 32};
84 84
 static uint16_t cli_tmp14[]={32};
85 85
 static uint16_t cli_tmp15[]={32};
86
-static uint16_t cli_tmp16[]={32, 32, 32};
87
-static uint16_t cli_tmp17[]={32, 65, 32};
88
-static uint16_t cli_tmp18[]={32, 88, 32};
89
-static uint16_t cli_tmp19[]={89};
90
-static uint16_t cli_tmp20[]={16, 8, 8, 8, 91, 90};
91
-static uint16_t cli_tmp21[]={8};
92
-static uint16_t cli_tmp22[]={92};
93
-static uint16_t cli_tmp23[]={8};
94
-static uint16_t cli_tmp24[]={32, 94, 32};
95
-static uint16_t cli_tmp25[]={95};
96
-static uint16_t cli_tmp26[]={94};
86
+static uint16_t cli_tmp16[]={32, 32};
87
+static uint16_t cli_tmp17[]={65, 32};
88
+static uint16_t cli_tmp18[]={32, 65, 32};
89
+static uint16_t cli_tmp19[]={32, 89, 32};
90
+static uint16_t cli_tmp20[]={90};
91
+static uint16_t cli_tmp21[]={16, 8, 8, 8, 92, 91};
92
+static uint16_t cli_tmp22[]={8};
93
+static uint16_t cli_tmp23[]={93};
94
+static uint16_t cli_tmp24[]={8};
95
+static uint16_t cli_tmp25[]={32, 32, 32};
96
+static uint16_t cli_tmp26[]={32, 96, 32};
97
+static uint16_t cli_tmp27[]={97};
98
+static uint16_t cli_tmp28[]={96};
97 99
 
98 100
 const struct cli_bc_type cli_apicall_types[]={
99 101
 	{DStructType, cli_tmp0, 11, 0, 0},
... ...
@@ -112,48 +116,49 @@ const struct cli_bc_type cli_apicall_types[]={
112 112
 	{DStructType, cli_tmp13, 9, 0, 0},
113 113
 	{DArrayType, cli_tmp14, 1, 0, 0},
114 114
 	{DArrayType, cli_tmp15, 64, 0, 0},
115
-	{DFunctionType, cli_tmp16, 3, 0, 0},
116
-	{DFunctionType, cli_tmp17, 3, 0, 0},
115
+	{DFunctionType, cli_tmp16, 2, 0, 0},
116
+	{DFunctionType, cli_tmp17, 2, 0, 0},
117 117
 	{DFunctionType, cli_tmp18, 3, 0, 0},
118
-	{DPointerType, cli_tmp19, 1, 0, 0},
119
-	{DStructType, cli_tmp20, 6, 0, 0},
120
-	{DArrayType, cli_tmp21, 29, 0, 0},
121
-	{DArrayType, cli_tmp22, 3, 0, 0},
122
-	{DArrayType, cli_tmp23, 10, 0, 0},
123
-	{DFunctionType, cli_tmp24, 3, 0, 0},
124
-	{DPointerType, cli_tmp25, 1, 0, 0},
125
-	{DStructType, cli_tmp26, 1, 0, 0}
118
+	{DFunctionType, cli_tmp19, 3, 0, 0},
119
+	{DPointerType, cli_tmp20, 1, 0, 0},
120
+	{DStructType, cli_tmp21, 6, 0, 0},
121
+	{DArrayType, cli_tmp22, 29, 0, 0},
122
+	{DArrayType, cli_tmp23, 3, 0, 0},
123
+	{DArrayType, cli_tmp24, 10, 0, 0},
124
+	{DFunctionType, cli_tmp25, 3, 0, 0},
125
+	{DFunctionType, cli_tmp26, 3, 0, 0},
126
+	{DPointerType, cli_tmp27, 1, 0, 0},
127
+	{DStructType, cli_tmp28, 1, 0, 0}
126 128
 };
127 129
 
128 130
 const unsigned cli_apicall_maxtypes=sizeof(cli_apicall_types)/sizeof(cli_apicall_types[0]);
129 131
 const struct cli_apicall cli_apicalls[]={
130 132
 /* Bytecode APIcalls BEGIN */
131
-	{"test0", 24, 0, 1},
132
-	{"test1", 16, 0, 0},
133
-	{"read", 17, 1, 1},
134
-	{"write", 17, 2, 1},
135
-	{"seek", 16, 1, 0},
136
-	{"setvirusname", 17, 3, 1},
137
-	{"debug_print_str", 17, 4, 1},
138
-	{"debug_print_uint", 16, 2, 0},
139
-	{"disasm_x86", 18, 5, 1},
140
-	{"trace_directory", 17, 6, 1},
141
-	{"trace_scope", 17, 7, 1},
142
-	{"trace_source", 17, 8, 1},
143
-	{"trace_op", 17, 9, 1},
144
-	{"trace_value", 17, 10, 1},
145
-	{"trace_ptr", 17, 11, 1},
146
-	{"pe_rawaddr", 16, 3, 0},
147
-	{"file_find", 17, 12, 1},
148
-	{"file_byteat", 16, 4, 0}
133
+	{"test0", 26, 0, 1},
134
+	{"test1", 25, 0, 0},
135
+	{"read", 18, 1, 1},
136
+	{"write", 18, 2, 1},
137
+	{"seek", 25, 1, 0},
138
+	{"setvirusname", 18, 3, 1},
139
+	{"debug_print_str", 18, 4, 1},
140
+	{"debug_print_uint", 16, 0, 2},
141
+	{"disasm_x86", 19, 5, 1},
142
+	{"trace_directory", 18, 6, 1},
143
+	{"trace_scope", 18, 7, 1},
144
+	{"trace_source", 18, 8, 1},
145
+	{"trace_op", 18, 9, 1},
146
+	{"trace_value", 18, 10, 1},
147
+	{"trace_ptr", 18, 11, 1},
148
+	{"pe_rawaddr", 16, 1, 2},
149
+	{"file_find", 18, 12, 1},
150
+	{"file_byteat", 16, 2, 2},
151
+	{"malloc", 17, 0, 3},
152
+	{"test2", 16, 3, 2}
149 153
 /* Bytecode APIcalls END */
150 154
 };
151 155
 const cli_apicall_int2 cli_apicalls0[] = {
152 156
 	(cli_apicall_int2)cli_bcapi_test1,
153
-	(cli_apicall_int2)cli_bcapi_seek,
154
-	(cli_apicall_int2)cli_bcapi_debug_print_uint,
155
-	(cli_apicall_int2)cli_bcapi_pe_rawaddr,
156
-	(cli_apicall_int2)cli_bcapi_file_byteat
157
+	(cli_apicall_int2)cli_bcapi_seek
157 158
 };
158 159
 const cli_apicall_pointer cli_apicalls1[] = {
159 160
 	(cli_apicall_pointer)cli_bcapi_test0,
... ...
@@ -170,4 +175,13 @@ const cli_apicall_pointer cli_apicalls1[] = {
170 170
 	(cli_apicall_pointer)cli_bcapi_trace_ptr,
171 171
 	(cli_apicall_pointer)cli_bcapi_file_find
172 172
 };
173
+const cli_apicall_int1 cli_apicalls2[] = {
174
+	(cli_apicall_int1)cli_bcapi_debug_print_uint,
175
+	(cli_apicall_int1)cli_bcapi_pe_rawaddr,
176
+	(cli_apicall_int1)cli_bcapi_file_byteat,
177
+	(cli_apicall_int1)cli_bcapi_test2
178
+};
179
+const cli_apicall_malloclike cli_apicalls3[] = {
180
+	(cli_apicall_malloclike)cli_bcapi_malloc
181
+};
173 182
 const unsigned cli_apicall_maxapi = sizeof(cli_apicalls)/sizeof(cli_apicalls[0]);
... ...
@@ -37,7 +37,7 @@ int32_t cli_bcapi_write(struct cli_bc_ctx *ctx, uint8_t*, int32_t);
37 37
 int32_t cli_bcapi_seek(struct cli_bc_ctx *ctx, int32_t, uint32_t);
38 38
 uint32_t cli_bcapi_setvirusname(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
39 39
 uint32_t cli_bcapi_debug_print_str(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
40
-uint32_t cli_bcapi_debug_print_uint(struct cli_bc_ctx *ctx, uint32_t, uint32_t);
40
+uint32_t cli_bcapi_debug_print_uint(struct cli_bc_ctx *ctx, uint32_t);
41 41
 uint32_t cli_bcapi_disasm_x86(struct cli_bc_ctx *ctx, struct DISASM_RESULT*, uint32_t);
42 42
 uint32_t cli_bcapi_trace_directory(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
43 43
 uint32_t cli_bcapi_trace_scope(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
... ...
@@ -45,8 +45,10 @@ uint32_t cli_bcapi_trace_source(struct cli_bc_ctx *ctx, const const uint8_t*, ui
45 45
 uint32_t cli_bcapi_trace_op(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
46 46
 uint32_t cli_bcapi_trace_value(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
47 47
 uint32_t cli_bcapi_trace_ptr(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
48
-uint32_t cli_bcapi_pe_rawaddr(struct cli_bc_ctx *ctx, uint32_t, uint32_t);
48
+uint32_t cli_bcapi_pe_rawaddr(struct cli_bc_ctx *ctx, uint32_t);
49 49
 int32_t cli_bcapi_file_find(struct cli_bc_ctx *ctx, const const uint8_t*, uint32_t);
50
-int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t, uint32_t);
50
+int32_t cli_bcapi_file_byteat(struct cli_bc_ctx *ctx, uint32_t);
51
+uint8_t* cli_bcapi_malloc(struct cli_bc_ctx *ctx, uint32_t);
52
+uint32_t cli_bcapi_test2(struct cli_bc_ctx *ctx, uint32_t);
51 53
 
52 54
 #endif
... ...
@@ -28,6 +28,7 @@
28 28
 #include "execs.h"
29 29
 #include "bytecode_hooks.h"
30 30
 #include "fmap.h"
31
+#include "mpool.h"
31 32
 
32 33
 typedef uint32_t operand_t;
33 34
 typedef uint16_t bbid_t;
... ...
@@ -144,6 +145,7 @@ struct cli_bc_ctx {
144 144
     uint32_t scopeid;
145 145
     unsigned line;
146 146
     unsigned col;
147
+    mpool_t *mpool;
147 148
 };
148 149
 struct cli_all_bc;
149 150
 int cli_vm_execute(const struct cli_bc *bc, struct cli_bc_ctx *ctx, const struct cli_bc_func *func, const struct cli_bc_inst *inst);
... ...
@@ -589,6 +589,22 @@ int cli_vm_execute(const struct cli_bc *bc, struct cli_bc_ctx *ctx, const struct
589 589
 			res =  cli_apicalls1[api->idx](p, u);
590 590
 			break;*/
591 591
 		    }
592
+		    case 2: {
593
+			int32_t a;
594
+			READ32(a, inst->u.ops.ops[0]);
595
+			res = cli_apicalls2[api->idx](ctx, a);
596
+			break;
597
+		    }
598
+		    case 3: {
599
+			cli_errmsg("bytecode: type 3 apicalls not yet implemented!\n");
600
+			stop = CL_EBYTECODE;
601
+		/*	void *p;
602
+			uint32_t u;
603
+			p = ...;
604
+			u = READ32(v, inst->u.ops.ops[1]);
605
+			res =  cli_apicalls1[api->idx](p, u);
606
+			break;*/
607
+			    }
592 608
 		}
593 609
 		WRITE32(inst->dest, res);
594 610
 		break;
... ...
@@ -1304,6 +1304,12 @@ int cli_bytecode_prepare_jit(struct cli_all_bc *bcs)
1304 1304
 		case 1:
1305 1305
 		    dest = (void*)(intptr_t)cli_apicalls1[api->idx];
1306 1306
 		    break;
1307
+		case 2:
1308
+		    dest = (void*)(intptr_t)cli_apicalls2[api->idx];
1309
+		    break;
1310
+		case 3:
1311
+		    dest = (void*)(intptr_t)cli_apicalls3[api->idx];
1312
+		    break;
1307 1313
 		default:
1308 1314
 		    llvm_unreachable("invalid api type");
1309 1315
 	    }
... ...
@@ -28,7 +28,7 @@ struct bytecode_metadata {
28 28
   char *targetExclude;
29 29
 };
30 30
 
31
-#define BC_FUNC_LEVEL 4
31
+#define BC_FUNC_LEVEL 5
32 32
 #define BC_HEADER "ClamBC"
33 33
 
34 34
 enum bc_opcode {
... ...
@@ -43,6 +43,8 @@ struct cli_bc_type {
43 43
 
44 44
 typedef uint32_t (*cli_apicall_int2)(struct cli_bc_ctx *, uint32_t, uint32_t);
45 45
 typedef uint32_t (*cli_apicall_pointer)(struct cli_bc_ctx *, void*, uint32_t);
46
+typedef uint32_t (*cli_apicall_int1)(struct cli_bc_ctx *, uint32_t);
47
+typedef void* (*cli_apicall_malloclike)(struct cli_bc_ctx *, uint32_t);
46 48
 
47 49
 struct cli_apicall {
48 50
     const char *name;
... ...
@@ -69,6 +71,8 @@ extern const struct cli_apiglobal cli_globals[];
69 69
 extern const struct cli_apicall cli_apicalls[];
70 70
 extern const cli_apicall_int2 cli_apicalls0[];
71 71
 extern const cli_apicall_pointer cli_apicalls1[];
72
+extern const cli_apicall_int1 cli_apicalls2[];
73
+extern const cli_apicall_malloclike cli_apicalls3[];
72 74
 extern const unsigned cli_apicall_maxapi;
73 75
 extern const unsigned cli_apicall_maxglobal;
74 76
 
... ...
@@ -1,4 +1,4 @@
1
-ClamBCad`|``````|`agafp`clamcoincidencejb:82
1
+ClamBCae`|``````|`agafp`clamcoincidencejb:82
2 2
 
3 3
 Tedaaa`aacb`bb`bb`b
4 4
 Eabaaabbfd|afdgefcgdgac``
... ...
@@ -1,11 +1,14 @@
1
-ClamBCad`|``````|`akafp`clamcoincidencejb:83
1
+ClamBCae`|``````|`amafp`clamcoincidencejb:92
2 2
 
3
-Tedcaabfdebedebfdaaa`aacb`bbfdb`baacb`bb`bb`b
4
-Eababaabid|afdgefcgdg`c``abbjd|afdgefcgdgac``
3
+Tedcaabfdebedebfdaaa`aabbadb`baabb`bb`baacb`bbfdb`baacb`bb`bb`b
4
+Ebdaadbcabid|agmfaflflfofcf``bdabjd|afdgefcgdgbc``aabkd|afdgefcgdg`c``abbld|afdgefcgdgac``
5 5
 G`aa`@`
6
-A`b`bLahbedabgd```b`b`aa`b`b`aa`b`b`Fajac
7
-Bbgdaadbbfd`@d``fb`aab`bacabbabHonnkm``odHm``oonnkdaaadeab`bacHhgfedcbadTaaadaaab
8
-Bb`baeabbaa`Honnkmjnmdaaafeab`baeHhgfedcbadb`bagoaafDm``odDmjnmdTcab`bag
6
+A`b`bLalbedabgd```b`b`aa`b`b`aa`b`b`aa`bad`aa`b`b`Fbaaaf
7
+Bbgdaadbbfd`@d``fb`aab`bacabbabHonnkm``odHm``oonnkdaaadeab`bacHhgfedcbadTaaadaaae
8
+Bb`baeabbaa`Honnkmjnmdaaafeab`baeHhgfedcbadTaaafabae
9
+Bb`bagababdaDm``odaaaheab`bagDo``mdTaaahacae
10
+BbadaiababcaAadaaajeabadai@`Taaajaead
11
+Bb`bakabbaaai@dTcab`bDm``od
9 12
 BTcab`bDmjnmdE
10 13
 Aab`bLabah`aa`b`b`Facaa
11 14
 Baaaaeaah`Bgaab`baboaaaDm``odDmjnmdTcab`babE
... ...
@@ -1,4 +1,4 @@
1
-ClamBCad`|``````|`afbbep`clamcoincidencejb:418
1
+ClamBCae`|``````|`afbbep`clamcoincidencejb:418
2 2
 
3 3
 Tedaaa`
4 4
 E``
... ...
@@ -1,4 +1,4 @@
1
-ClamBCad`|``````|`afabp`clamcoincidencejb:23
1
+ClamBCae`|``````|`afabp`clamcoincidencejb:23
2 2
 
3 3
 Tedaaa`
4 4
 E``
... ...
@@ -1,11 +1,11 @@
1
-ClamBCad`|``c``a```|`bjaabp`clamcoincidencejb:326
1
+ClamBCae`|``````|`bjaabp`clamcoincidencejb:318
2 2
 Trojan.Foo.{A,B};Target:1;(((0|1|2)=42,2)|(3=10));EP+0:aabb;ffff;aaccee;f00d;dead
3 3
 Tedebieebheebgeebfeebeeebdeebbeebaeebadebcdaaa`aacb`bbadb`bdb`db`bcajbadbcebadbcebadbcebadbcebadbcecaab`bdagahdaeahdajahdabbaddabahdakah
4 4
 Eafaaafb`e|amcgefdgfgifbgegcgnfafmfef``
5
-Gd```hbia`@`bieBdeBbgBofBjfBafBnfBnbBfdBofBof@`bheBad@`bheBbd@`bge@Ab@Ac`b`aAa`b`aC``a`bfeBedB`eBkbB`cBjcBafBafBbfBbf@`beeBffBffBffBff@`beeBffB`cB`cBdf@`bdeBafBafBcfBcfBefBef@`beeBdfBefBafBdf@`bbe@Ag@@AhAa@AiAc@AjAb@AkAd`bad@Ab`bad@Ac`bad@Ag`bad@Ah`bad@Ai`bad@Aj`bad@Ak`bcdAdD```h`bcdAcD```h`bcdAbD```h`bcdAaD```h`bcd@D```h`
5
+Gd```hbha`@`bieBdeBbgBofBjfBafBnfBnbBfdBofBof@`bheBad@`bheBbd@`bge@Ab@Ac`b`aAa`bfeBedB`eBkbB`cBjcBafBafBbfBbf@`beeBffBffBffBff@`beeBffB`cB`cBdf@`bdeBafBafBcfBcfBefBef@`beeBdfBefBafBdf@`bbe@Af@@AgAa@AhAc@AiAb@AjAd`bad@Ab`bad@Ac`bad@Af`bad@Ag`bad@Ah`bad@Ai`bad@Aj`bcdAdD```h`bcdAcD```h`bcdAbD```h`bcdAaD```h`bcd@D```h`
6 6
 A`b`bLaeb`b`aa`aa`bad`b`b`Fahac
7
-Bb`b`gbBda`aaaagab`b`AadTaaaaaaab
8
-Baaabeab`b`AbdbadacoaabAm`An`b`badabbafac@dTcab`b@d
7
+Bb`b`gbBca`aaaagab`b`AadTaaaaaaab
8
+Baaabeab`b`AbdbadacoaabAl`Am`b`badabbafac@dTcab`b@d
9 9
 BTcab`b@dE
10 10
 A`aaLbcab`b`b`b`b`b`b`b`b`b`aa`aa`aa`aa`b`b`b`b`b`b`b`b`b`b`aa`aa`b`b`aa`aa`Fbdaaa
11
-Bb`b`gbBha`b`baagbBga`b`babgbBfa`b`baca`aa`b`bada`acabaaaeeab`badBjbdaaaffab`bab@daaagfab`baa@daaahfab`b`@db`bai`aafb`baj`aagb`bak`aahb`bala`ajakb`bama`alaiaaaneab`bamAbdaaaok`anaeb`bb`agbBea`aabaaeab`bb`aAjdaabbal`aobaaTcaaabbaE
11
+Bb`b`gbBga`b`baagbBfa`b`babgbBea`b`baca`aa`b`bada`acabaaaeeab`badBjbdaaaffab`bab@daaagfab`baa@daaahfab`b`@db`bai`aafb`baj`aagb`bak`aahb`bala`ajakb`bama`alaiaaaneab`bamAbdaaaok`anaeb`bb`agbBda`aabaaeab`bb`aAjdaabbal`aobaaTcaaabbaE
... ...
@@ -1,4 +1,4 @@
1
-ClamBCad`|``````|`afaap`clamcoincidencejb:20
1
+ClamBCae`|``````|`afaap`clamcoincidencejb:20
2 2
 
3 3
 Tedaaa`
4 4
 E``