From e33cd26b325bb8f387a7579564799ddbb8db2f51 Mon Sep 17 00:00:00 2001 From: physics-sp Date: Sat, 6 Mar 2021 17:04:55 -0300 Subject: [PATCH 1/2] ignore the DLL where beacon is --- README | 4 ---- src/refresh.c | 31 +++++++++++++++++++++++++++++-- src/refresh.h | 2 +- src/unhook.c | 9 +++++++-- unhook.cna | 11 +++++------ 5 files changed, 42 insertions(+), 15 deletions(-) diff --git a/README b/README index 4479270..5b31650 100644 --- a/README +++ b/README @@ -8,10 +8,6 @@ Load unhook.cna into Cobalt Strike via Cobalt Strike -> Script Manager Run 'unhook' from Beacon -Known issues: - -Unhook refreshes "everything". If you're module stomping--this would include that module. The unhook alias does detect if module stomping is enabled and report an error. Future improvements could limit which DLLs are refreshed to a list of high-interest DLLs or explicitly exclude our stomped module. - To build: x86: Open Visual Studio x86 Native Tools Command Prompt and type 'make' diff --git a/src/refresh.c b/src/refresh.c index 3929080..32717db 100755 --- a/src/refresh.c +++ b/src/refresh.c @@ -4,7 +4,32 @@ #include "unhook.h" #include "beacon.h" -void RefreshPE(void * buffer) +BOOL IsBeaconDLL(char* stomp, size_t beaconDllLength, PWSTR wszBaseDllName, USHORT BaseDllLength) +{ + BOOL isBeacon = FALSE; + if (beaconDllLength * 2 == BaseDllLength) + { + isBeacon = TRUE; + for (int i = 0; i < beaconDllLength; i++) + { + // make them lower case + char c1 = stomp[i]; + char c2 = wszBaseDllName[i]; + if (c1 >= 'A' && c1 <= 'Z') + c1 += 32; + if (c2 >= 'A' && c2 <= 'Z') + c2 += 32; + if (c1 != c2) + { + isBeacon = FALSE; + break; + } + } + } + return isBeacon; +} + +void RefreshPE(void * buffer, char* stomp) { HMODULE hModule; PWSTR wszFullDllName; @@ -14,13 +39,15 @@ void RefreshPE(void * buffer) PLDR_DATA_TABLE_ENTRY pLdteHead = NULL; PLDR_DATA_TABLE_ENTRY pLdteCurrent = NULL; + size_t beaconDllLength = strlen(stomp); + dprintf("[REFRESH] Running DLLRefresher"); pLdteHead = GetInMemoryOrderModuleList(); pLdteCurrent = pLdteHead; do { - if (pLdteCurrent->FullDllName.Length > 2) + if (pLdteCurrent->FullDllName.Length > 2 && !IsBeaconDLL(stomp, beaconDllLength, pLdteCurrent->BaseDllName.pBuffer, pLdteCurrent->BaseDllName.Length)) { wszFullDllName = pLdteCurrent->FullDllName.pBuffer; wszBaseDllName = pLdteCurrent->BaseDllName.pBuffer; diff --git a/src/refresh.h b/src/refresh.h index 2daa112..85669ed 100755 --- a/src/refresh.h +++ b/src/refresh.h @@ -11,7 +11,7 @@ #define OUTPUTDBGW(str) #endif -void RefreshPE(void * out); +void RefreshPE(void * out, char* stomp); HMODULE CustomLoadLibrary(const PWCHAR wszFullDllName, const PWCHAR wszBaseDllName, ULONG_PTR pDllBase); HMODULE CustomGetModuleHandleW(const PWSTR wszModule); FARPROC WINAPI CustomGetProcAddressEx(HMODULE hModule, const PCHAR lpProcName, PWSTR wszOriginalModule); diff --git a/src/unhook.c b/src/unhook.c index 6207be8..efd93ac 100755 --- a/src/unhook.c +++ b/src/unhook.c @@ -2,14 +2,19 @@ #include "refresh.c" #include "unhook.h" -void go() { +void go(char* args, int length) { + datap parser; formatp buffer; char *out; int size; + char* stomp; + + BeaconDataParse(&parser, args, length); + stomp = BeaconDataExtract(&parser, NULL); BeaconFormatAlloc(&buffer, 64 * 1024); - RefreshPE(&buffer); + RefreshPE(&buffer, stomp); /* we're done... I guess */ BeaconFormatPrintf(&buffer, "Unhook is done.\n"); diff --git a/unhook.cna b/unhook.cna index a04e6ba..be5fedb 100755 --- a/unhook.cna +++ b/unhook.cna @@ -1,5 +1,5 @@ alias unhook { - local('$barch $handle $data $stomp'); + local('$barch $handle $data $stomp $args'); # figure out the arch of this session $barch = barch($1); @@ -7,20 +7,19 @@ alias unhook { # if we're module stomping; don't run the unhook as-is because we'll walk over # everything. We don't want that. A nice improvement would ask unhooker to skip stomped module. $stomp = [data_query("metadata")["c2profile"] getString: ".stage.module_ $+ $barch"]; - if ($stomp ne "") { - berror($1, "Can't unhook when .stage.module_ $+ $barch is set. :("); - return; - } # read in the right BOF file $handle = openf(script_resource("unhook. $+ $barch $+ .o")); $data = readb($handle, -1); closef($handle); + # pack the arguments + $args = bof_pack($1, "z", $stomp); + btask($1, "Running unhook"); # run it.. - beacon_inline_execute($1, $data, "go", $null); + beacon_inline_execute($1, $data, "go", $args); } beacon_command_register( From 68936634b8898a7e154cfb2992f61b55d2b69220 Mon Sep 17 00:00:00 2001 From: physics-sp Date: Sat, 6 Mar 2021 17:07:08 -0300 Subject: [PATCH 2/2] update .o files --- unhook.x64.o | Bin 12587 -> 12545 bytes unhook.x86.o | Bin 8444 -> 8126 bytes 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100755 => 100644 unhook.x64.o mode change 100755 => 100644 unhook.x86.o diff --git a/unhook.x64.o b/unhook.x64.o old mode 100755 new mode 100644 index 2146a94ccbfd9c2cad65e48483b97df2cb207458..0b8b9783e92f5f3e66128421deb59702be94d331 GIT binary patch literal 12545 zcmb_ieQ;FQb-$}!j4WeT4%iVNb~f;cWn;u5$*_D(yh0LwBrDJ$K{S*xE2I_DAnmTT zyJqb&^*SrX;FU6Ttfn|=Q(9<(`!PdX#}ZCrFOH|kZkqysxNe=y5PPOYRi+K&&V;yW zx4(1leP8<|(V6y*^zQHd?z!ild(QoQ`+C2&SSUv{GGDo!zBPR#&8)b4~QN6P+9m}S*p|~OUmn((%5OU+IC9?-fK(t5e zvc28uZbM3l6M(OL&Uz*k7Qt{`(kXWV{QUtTeu#g%9>qV)ImN^);Jeq5gmr~QxLDWI ze=N1R(Ii7apO(pqD%cnZY;0-W)wDm-8QHya+Zx=O+d9`c$-R-5Jxy(`9cuzUsJVsz zVf;4=&wWTl^R`3#Q?cRHp$zVaT4JeV=|u8SCf=V&9NTat(WhWtc5`E0LTnQ|?h`wO zxGI*3RbuLCVWw>ZJ;RAqqAwk&-S{^vC@z2I9H zrH4~K4Or9j@6`P0Z}~!g?M-9}y%4U!e*k&4Dvtyrr&_cc{Zyw`t)Gf$l@JdZ;{7`E z0(zlEYuB%k3g`fl58aiii7;E})O5WN(ZXD0R-fIaBz*Hod|?*$v5ty)Bz&_K4Mo@( zQZ~Bn>vz~!dj;yqw%ICDTq+ti*A~J{wu15JThR+CPd`?K2O?UnKHlP4O^pkYF`+`( zCu#4rUbswrxZ%3WS#qfYx_^1AP;4m_b+k9j?JeC;RgMX|B%0nupXMzpR6-JdSOI6Nec7D zO7g9K=YTyqSHRFe=MPxB88BCyxr3T*wgrq`UTe8LOzjQBjUR6{D%O}!Su*xi7I9S#+LgT9}SUV|LXXgqQ#+PGi&eGtag-e*D$Q)j17N+SI ztrpr!dI^B6ZfCFMc2tVYEIrp!^Sk5-HOCWi0m=>dC&Quq?F#?b&ru!3wD>1=!~`f( z2t!+^1}}~Ah-NLL#msY@jkP6Air87u24Osfjl2Lo>9lM>TPN`mEo#~k)G;RpMS5d| z;$%u8PI5M4!KNvZ6M{xdL<`Chp|qpxs}_WG?vkT*Q_dz3urWZ5BMxFUF6b!19TZcmtaI=!&q!Y6Hvqa_##eVdx$izpY~5y_ibNZnYkB} zU`5~P^~}FD6lWK$D(0s>@ZX}DV|UAnf>e%Tn3HM1i?p@j-KHs0{RaMXeY`v3_f&&5~diJ*4RpsYP7T@WR!GcP+&{ z6d}^77fw)*OKbgw=}*p6Z)fGE((w^bCEP)^egIu)Zxo5#4Mcf25ars?v+qLJh^C%G z-BGN#7#?F>q|oB2rp~Azdl%e<A3ueR4O@HJ=Y4KdrVH*(o?oz>Y=aoUD#^oFoG6I87;e2!kj{#FRyhX<=@yj-eqX z^I4zpk9>%pVlV|DtQl5a$+>gTeyXal+oyXk)3{0c^Dna=K&f`bcy#H+Q~)X3pyY2> zHeBavT>s@QSj)|zOk>3ls~rIHu2Owc1oO58=y*h<5x+tQCADGyr0BbRb4g$RhTlI~ z%-^o^k4`{hs^ljD%n<&`yZhE+SY1Xo5wK=Lxyk3z*S~#9N@AYzPkyFv?KS`8d;ZCH zDWaH_d{ql7f&%XdyZH`UW;V}fuh&01zOcQ@+=9=ups@?viqdzs6e?!Msn5*iSdV}7 zFBUL#O#1ZlOtt>P&q^i4NIB6z>8n_Oc>(|QEnvCo!*gr(-bw3B5eCoMms`8zk} z|Gyz_jdyGW+fR!DuaPq!{u-;5F`m$!leV!t^8_-D$pU-wIVTJIRPfOJQ^AOqW9P{< zAHtaX1@&R9cSU5-MeCi;0OK?Vp!TljbTXp-0_+<;?owm?U`*R1+6`pUWW#Bx_y&~Y zdD;-5#UBfXP7B6P9z3Qf&Bj~`r%-G)q~eG?bLsl{m`1a_)YCM@i_y4Tzu*vE@;HtK z=Fjtw=3q=@d_=p=M)A>AuFy9@@XSkq7D6V{9pr4Kn;OOC7H-rKdqs&}yFqJ&t`}Zo zh42F{U{Gn+S5);;Nbkd)rYU!bD`W?~EfSi5E%nnzRVq1(TfBxKQDvi}l z>XGxb!r&;^;24{7)L~vynz@Ecc%Un%!@{+fb%db7R10byO&V%Dca=h1gs^Nr9$5J) z&+Oy&BHRv~A1dxtY-R`V@u)kc5upN;K4X(~`c2eAcfD8QY)q z(z0C+GA^KCNoFuq9S<96{e^dE^LY3v^Mqx*MbT*>1yPVkRILF51a9&ZwyX$&+L8wd z1=RNYw>BG3`YY?-zIIzb!vlf0xb0Z#>}Pm1g86Vjy;`A27`x$G-VJBY*@|FOteeKp zvmgEd_L2D^w$pScK+<5c28c=^dyRpqZ%7Ou8K7MP83)F2EzKn&v$&x+^J6t_5kn0K zQNu#I+USLh8BumqV?IP5ALFs0oBJn<3QBg#A!C-~qY!R|@M`jgjmH3G9wBh>NyX!h zm4nY>INXMj>(D7m*uFO#&(zo1)9ah6Y2u<6I^(_hN<8V(HbtI;F)|&K^A!#suUBuw+2bC)R2;dUxn(h$#YcI-H(P+^*D*BrG&Jqr6gz`GN3Xj#m0Sz z)4h;^3vOd0f9Wp3PtLoR5_RUBbD1&otYzjbE9|6N#`tWghQ0H|Cgd_>o@do*Y_4U- zYU(#xwGx%f3~G6eCn|H9F;v36Maa{13ZV(*Yx`8J=0@^{Dl}U|E-#N_4r*pUPdT)= z=Qk-yddlL7cQV(pG$7uRFM?siSNnw(Q)lS$HslrjTleUcN zq>8-jwG{18Q=zkZ38DUo_wC(oH(WhfFtWEu<#IP*jf8FOf>C;Ri2%_m^i{|ma>C^JJ zn@%i~;NbIB42l6r``?5BWj>(L!RMDqgltvT|7JwhYGAy25G?T#A2XAgDypf|3M4tDFP7}QdbPsd%)^-V_zrmemWuN#D++~R@VnV+a`o!Z{ zxg?qZlDUsy3n96iCTc5X3jNn0NKj1VhW?$4JC5o7dyAc~?-+y)9TYJ@V`qTN7!%=G{rWfTXJ`kn{s zXYM7F`!gWfw)cRfr5^(YSnff%wuaFYK(cN7fTUa%LeR~*D}dHB$^#u?^cGMLqb{hB zx!(d>%iKkvUPj*sLPOD__kkW_v>45ns1YGWn2_591Xlwc0D^;oVnAPDGzc`n=s1wn z_ae|T=DrOCccH|qKyWaS2ghh1+{Wonq{}>F8BFK&ZIymxOP6}YQhKiOi5kyZabL1J z>bct^?*6L5t&$v0B{hEpZlzbOJn}&D{wVMYk65t=>AfCtFLclaL(B^AaMiN^^6)#6avzj+ktxnqp*oc>z9}# z87k!!5filo(UX_wy~i1K;V#i3pgqh*ao^0S*F^n5RNl*RHe$LDO z^-Kk_yq=s>08jQWXS^&!-_B5H_^bVAC{dSBrCt#bq)Sez0i+f~0Sr4B>T)+6OgEl# zP+*mM222p@Ev5j*xMW>_Xgng7jPde^G9+`&C3Dloc*s@ilBHI=n2j#xOD<;6#k}ZZ zzUyLsi=&h|nvi~|MxT|87TH5H zBVP~|cL{?D;K^iYCK6#gvx%nL8!je?mYAhjM)p;unf1uFE2fdARM~dL&^)Qyu9!_! zOt#%%sFZBGVrUjtZ8v0sU}W1B!!4C=tbpiKB@jp2+u^WlHzN$*G40GqfR02soL|p;11gRx61E$&`JFKI1ru`U@j(GCW0sx= z0b3k0JHSL8G6%uX3~1H$EErm%kf_>!7myY?OXeb&tV3oROw=Ls5ttE&%zuI*&6XZN zjty8ZY;~;xL(8=#vjGe(t|$z9>TF*#A_G0)72N6C{@}8gCDJ;c+`MViR&oz|9F=0G zzJ3!$*}>EY%9t$;kCii9NRhqNmJr3l&TQS%?qnLaY-ucKwnodCPQmW zI%zWYFElZ6q3zs6AnV$K!cWH1?Zb(lSSr;Te`a7f5g&@h(>n(fJ;x|(cf2h&lo)kRpSnmLR^cw5k(>)Y(Glvgso{Mapi>w!i4-X6_5ATe1_ax#i z_@uSHdpH$yv8~zkaCcAI!S6~84|S)T24V6X{I21cQ;igFA0CLO`{t1EOmw7?chr%! zH9$2niS}86Qq0hiR5}3#hf~hdL$M*3##DMZ zJ{XHT1wrCZ?2AEns=vKeG-sf3$mT!AxI8WeLDSG^>cz+17#>;C(bFAoiudjs$jSiO zhz_)UAQ2b4Q>qU~B0|f=j}OFqHKk{+A*S(n*$YZoO6D7kmXdiTEG1>b)+$?`F<%iH z*YlO)y!i_@E>IA8^B1gNpdj*8K`YS8J{zG#+&w^v&XM6L;_4!fa_-#n!p@FVUbrk* j6?SzuRm{!13K-qdRl>|rMI8NAc18!K#IP?_s(}6nmr4t zexLcI?yG7=!(d`xe!t#pmSg~$U2+joyRBg`o{O78xcjPwc*`RfDK+F0g`7?9zTXhy zgkOlieMpkeT9+5ur#!#wqt*6h8Eb5NGg5*W>sjIZe}^>ge3w z_CmBTx?|hsNAc6%)%U2A+!gKE+1AzB`=|zw#7+DS;ICfz?!irbW%G-J*>q-Ky6|E? zHJnZ#P`8FcYfD2~Y!+MY5!-~gEJ%9jBVpaUk^|ZFSb8X@1$&;*c4czO(d5^Ysr_1e zdNh+9No0liYES3(p3Yw5C9Nl)N>N!yG}@CG$|lB!UFDKgBAc~(PR)QA5n0h725}!j z^<{gzG6}Xfgo>negQL7{WF$Qh&yl^+#ArJEsy39)Y9q;g*?9ImU3SqE1oN)Nj9v>OVk4Q(zS1p^6j=_MvJw1uB^vFT- zWXEVGoy}=&gXqd*V_IK)AGCry+WMZ*Z2m;k@j;SSEus);L)rAGR!>7AE;1r1o@8I> zCm{+VXL~Nku_rN@q#=_Sw3{LwdzUWD_a@@mfnlnd;|VXIIhr2Kn`t0bo1eV{ahZ6B zj61LOPd0^mwJr5y&#rRmZ%^k_TtRXuN%>5t5O%bdT4}Gx%;SMn`jwQnKb;=bRG#c< zqCP@bxjiqWIKD_ZqMgW@oh6gVjwZ*(D9t2q_P;yD^#vY4T5?PqOs5hJtAsIeqb^|- z{q-?eF%J86VBMH_ukP>O=L_Y*>r{hLjMU*zLs?LjkwElthhAqK?$c|H!%@8k;$c&K z*g%j)Mjt2Y4$COR>lQkij}ga}0SpfS_odypCz zCTGIMh+opxb4KwT@!ic=RmtizRj~c5o5fN`v1FjV1rqIE{2Wy|RmxQ@99ELGE*lZW zuU(v@FtU4^#1pUSng~pvgb8DSLVTdKmb4>=;=i3(-7w3QQ$>Jg>X4uwwmh3+TXMT+0 zq<)ADPLygWw*4273Op~9u;-Ra82V@Bgc(-CJZ(l~Y;CqBj6)tQhny1@LC7m6?9Zqf z&V->SajPojtGhzJV&!~2X=TCX`%!(IDzx{viYYrnk}_p6q^yln_B}IY1zXCzUZqP^%+}i!5|yo5QjXBL z_ft1g*>byOCd*w_OeM=Na^+;XJYPOpUUn@CrtVgD&wgG0+DWOB+-*bPZ65WBQ(DuV;C-$>7aqh zDkySajDikZQbCf6u~gfv7{}HY6DDR>Ikl*2(IJ&bAp;#n3rxL?mSS%2uiPJZ?=fD# zQHTCyT$t34qmj^9BzzK>E^7U-3HnW7NHD3hODs023z%VkW(D66`7l{tKNmP%JM{G0 zn*3)lDOC+kUCn>gTv}N1KxtymH&x27m_Klrtcc@{3WMV?Kw-z`Ty!>HY?~$1XYn^q z`3&JnwfwO3+L(A(KaS!>7<*V53*woL(4CFY(n5ioma@F27_e{>JXxT-fQ4VwNOv@P zhGu7T=`3xuNt0yEx)B*l*D&dvBpoCbi}<8oVqtY3h-{%;4VP!W0tpt-G1|_MS!5Iq zFJ5lGST>Ad$s&D5@iiR}IeoY|ck2XA?rhvLIy333K{%+^Yp{i&#c-38eT-M<7@I;L zU5QQ+8+#dsV^{&vrKVY>*x{?C-enxP2=1ulqN^}n_mR_AjN&CA6kkR0yRx|NK1@91 zSoMD!#h)2P{N5!0$v%?& z?9jR^fzy`)r!P`QF&X(+Eo%q{swX+jcd#zYACq@$tQ^BM@&cT!Si7>|8$JB?h-km}LU9{dA3@}c|0dTBwOed52$6(LWJ1Ck#>A{?~ zC-uvCqREEui>0$Lj^{a3fHnnKFbrBSw(;PxM9CIw;Z&$amEov70~yB5v`(|Uw9_`r zi_wf+zYq}Xgn^d~70Uus<8UTAGpXNZr}!u-SLo{?c;+QQ3n3G^UTU|pO^sr`$R{c{i& zcxY(^WB{;PMGEN0+_q}wM!J=FdNTfK{rM}mjbl6zcyrs0rOx(3Adf~cAJNpS4$6dS zFv$Dh{985^Y=;fYS?_t8_rtUtllx(EmO#V=!zRd>ASQwADJDKf02k@@o1j|)nFq#* z`NstEpK316|5#01#83mm)UdFjHhN)mMwEL7b3Wv5M70^#{)w^z&3-v#EIoRu1iHHz zd61%E<0FdKT>P-&@pi`{pTTgrjVkNWDHgGPZ#SQ*uXCi=x7E_b#V0`j>paDit%%Dd z)g%8w?IPe>9okKj)LRds3W9vzq)CDZjKA+I@nMg(S(MXAlJ{vjU*YiaPVHu#Jw9zL zmL{*}Z`w{CfvJ!(mcfo|X@}uaj9j94J`EiB=7&5iVgNrEz^89 zRKwnN-jd6V(x>#X-crjGMt|Gr#qJXeT3kHYUdppkbRFdA^~fpjSCx z0`r)~*%70J>_^OTZ#y*_RDdH5#w4VM)zqW!;Kn zH1~CfB3!6Jd*KruR`L3z7+r<^Ss!f~)kzg)SA&%8a9gpjb~T~lX!ZFW#mgOJstZS7 ze!0?BJ=Y~)KVt>rk#dO)6=+b%@Xh}cFNr+wPrUiVqJh`=R1uWP70QS;Sca*#7?omO zxAtt^vOGEib8WK`MAfQ1W2)w>7S_`i3I=ih=fQgG1Zz-BG`9l1#dmf#dY?6MqaQC$ zd{`l@-px>U5ap1)tPhrL&(zth>VnqvVUw7^3nuCo^ye3S7WyVokU4ra_ynUL;r9!S z{u94aqkw+4nYj&^jwLz@Buk&bx+uBp7V5wTSeAYOBul@&!bHCYdW`Mu!A!P|(QgBF zGCBejX7t#ngrNVO@{2csni#zg)W~RMjSw3c?FHJ%=-#`9*ve=l(9?{57w8#A(?FkP z^c^7S)k&Z=%>9kU{WH+x%-sUo!e}*4_R?M_P&;!SwL)|-`i6zR4V96`KeXNN@`=0t7|(TnQRiDH?#a}~e8l~p$vq%B zY^Li-?*3|V|Gs-OpNj!gUEt`V7Md4AWLCXtA8u$MXN>rqB6777E!nWNs<#VBGS>T?6kk-s|`kp+pmffCI1;dd9K zeha+_L@llsG5nHjHU1yjM8iNy=0@=QWkwkb<$w+_SHN!%qt`4n4m8T#Bz}7t9kS3g zP@1_T_$AM(#Ze0#1Ns_skpX$8cJ%lkNURr zvVTfbg`#R7wZnPYKcm643>o^6hOUQZpZ<|Vdhc^Bp~lt_J+X{XOsnQ(ni`uTZl)R=I^<#+!^d3AhVYz= z*%-dthb2F{ST+GH6>YKK@TEZ=J zE}8Jg%Wfuo&B<&CwbE-dX~+ImiJz?d=u;^gsmK2O-#)@kT~tPwUuXi#xM*e3@K%S;iBdC9uoG9Pi5%vlff6Axo^UupS}8S|2M9`rEJ zdYIqzFt2);Z+n=(_ApmG%zt>88tE20DdA%t<{1z3We+ppVZPyE{?Nmm@G!Gru3<-3 z&dzx-CG5h=%s+wAusbO;3t%ogm@0I)2o}Av%o^%|btbc)rbt|;EJly+q|F9j)caNn zlhN>GF|p->`Wa@X49$BL@KuppDiAsq8+I&{-APK7GFzt@t1$m{?n#kZV8OBD2_dvhq;?vCMLplyv$HeW+@!aUq{k9QJT*9C)=)0WV!M>sj*mLK;+YK0?eQpE5}qPNOU6#x z_LS52ol*IFUyX$-*HM(5!?qoKXkB`_RX*Ecd*`nz#Lbu4_V^LLS zSMTojo<4o=D+6Px^U4}VREmGbDmv0NGk_KrCv@zJiw;#e-58cC#_ zf*|ovsE>-fJ4JgQ7DsLIQ;a9#QV=wCcJ;Y!XF<>xt8J;l?a6{nkd5e-U;YX`pL!*k z8q}5UQUgWj54e|=C>yCXq{>DrN|cSb247j%T~JAdMrS20E~~8AvWz0iDl0ZEqlhx4 zSWd3;&qgQ_Z`PIQ5(N$wPq%RBc}v~O&d%djc9kk+PZv{aUf!c%bwSy`${JRIQo#mC HSq1uE1&m={ diff --git a/unhook.x86.o b/unhook.x86.o old mode 100755 new mode 100644 index 7d2ce34480bedd7be5d2633d4f33e6a5803eb891..e39a41af3eca4f3c9f9d9c1607231b71d0b1a35d GIT binary patch literal 8126 zcmbVReQaCTb-(Y$&PDFS}V!AuHx$1`g(Sd*kNdijHoZV zBH1XJxypF)>X%n-DPXJ);IvMmKMX8rwZeduF7PB(1(i&IrA`C1LLFpJ8z@uTw3)z| zOq2Gz_kEBQl@1so@%`TKoO|xQ=bn4+d5?{z9mM|IxJ#Q?E6|RaYAE4@8Q3`*g{hj}f9k&+1m0Q@D6Y z(`%(2zKBm(!d1q<3**ZE)R40A()P~o@R7p?T@3Wz7CmBzO^@gKdU~Q(Y;0?Mv95A2 zzK#oRdvnRtjrFH$1=_mTV}+Ujz<)pf4-?ZaT*&dtb7I)vA3hhw_qlq1xH}TMcrM!4 z847hDybua#uyo+)k#nzJjE@~dQM-A1bc&T z1^Zt291rzg4EFe0pQ5tb-0?vfkWAMV{QdL!U(RHGAWyI{DK!qI#(n;mOkX38vKE3X z&YiD_>r!Pwv{0e0CPi>GE26E1>q%3NWPP#@rlq4+$ORW|q+3YA z>iSTtK`!8Zo2BW&}EsX6(OygUsBlZx~0J(3yX@Fmfo_F$kU8$u<<@^nCMb= zpV7xy^JdrF19(w(DReQpGkI-g-{$6~KK&U!|KhCq!`ae=O%|3jju2DQBnFpa%PFL) z8sLaem?K0ug02rWx?Gq9rhpquomHkw3T~Tia}O|}Wq5w6d8;EdUAIgVijYv6t$g-t za0FeG5+?Xnimj1LzHVX7t%wQu+Lr5##Vltme33I2f2T7R;EZ=yp2>Cw;`IOH535s} zR{h~n{Q>vs{xIwAuzsOCex|z)bL8&WwY@hkAbuw9Syg|)&3bU`l10NE=vj4#RgVp; z5gXgN!(qe*bH|^rc(%Ah^~ZB@y2>IsPSfmy{Up+E9c|lUC}A5iSdS|L{iAlC471Cv9lb_Zm zFVh(*Hp6UvH=}_tn`zN4B&1k^$-R)nr!xIm5k5v7TAHh6ajDDNNs#c7e3XW!<}RYQ z!WLLkVyj9tp`2`cIIN&mLp6)ux9u#9Wcp#8&I0gUJIizJESfk+>k5w1+3>+`VYXNi zKkTNsL_bu{CoJa*-1=Q?)pDu8p*&O??XHKz$va3nG8@y!2r^4uHFn)cHkj_7+ktT* zMGf$cv82=;mgyK$63zv=`LIG4qyZ~&zCDNo50QtRXu)&#l#k!jWY=Matba)RP&Pkt}qHpC`#<0gG60ZH5n}omx7_D>E z?JAkeQDWT(w&~wB@xXQYzS?vWK5>pZ?3U@AQL_05m;7FcytsPoXzI_#ro zhs0~Jl|mYJ81fF6-1uofdY zNtl6CkSMmx_h51`;$b7z2o@o5(QWm(K{MHue8!N&G^!Od=6hSKYsC@SoV?Cl9C2s6 z&8jb%uqaKqv8pTkH#Rp}rj6K=`Za1}e61_Fo0Y>j zD^UurR|)CpD67oXC1<1H{dchAQacjYSl4knuU>e*kJDxKj-P9BIUV5cg-wKFr9E283Z=+1jBGGn6*d@q(iDAC zqDy9pE}92X97Jd0^ke24oc!a`G^%2D?8?Hh6dNYaD^cFptaH?iWHsczEaSkyL4bhA zxs*`MRdm_;J<7LqLfM65+tOq`CgLP3=UmDnEX%@FC+k2Fr}S`}vSAC#bVQ*eC3H%r z3)q&z0(OS6t+5DcDVApYZ6_bX0%BzfVFN7_Hb%NdF9D<}1U!;fdZ@aV?O^gz0lpp% z>$w7|S-B#ULugtLcJ|~HZ5tBCxLx)v$b$qCscrhm*I?cl8p|Q#7#>y(yT)M6NiXs{ zOCV__dYe@vdMC(6%!VS4U>-Ns4zSuecG(kJ$|5ey;!N_%tdxPO#ViZ6EC0^(`Hc5f zY=KD!$$j3HR*&*p5Sba7$H7B)fjOq34ZW(5r|L2YZV<+EZXruytYUH)71Nrwt#Y1D z7u1R=<&^eeJ-USys-`ui-d=>zM(#2v|4yq`6#;36J(#fKgYV!(pvuHc(REgeGC>`a ze2$7bP*uxI(N&b9308`J&P!3gj}ef+mOjNJAtHTVFCQ<&=@L5R1F)cIU}3n-9}G}# zRho>D2U%yjN;eo=%R_z{A-`mVyjl|KJ^>-GcxwcF9vcVO> zPd5C!$qNQL5A-F@#qjOm=zV-Y%F!sk)fP@T`5D|55XnHJK&rG5X%6IMcY@;*)iJ;zZD=m1AQ0{TOaeh%~%paSwZo~+6^8UkXk0Sm~_fPSB&yFj}+ z+JOwZhoiqh2SptHC6I@se*oIc(LVu|bM&u3>gfL)sDg7l@Lo~nz5;|lc9?ja_&Wg^8sPl==TjEb)+(ohwJ?m zsF0&cAazD}4ZWjy6g$MF6sQEqO|AnS=G+Dli?RZ8-K9&Xfc9~20q6)v_kr-57=_I}x?f3z$4Uda#c{`T0p8|3E8)m;a?Y|i{s z(~dXDrNNG|Z(B{QzP6B>fZrD>Ei3y0jxd$UexYwdD~suQt##&-{W2dr6gq<$p@yFeAK>f8TUl%eIk$fO&;@~d5nX(O8cmmi}RT3Jm%#*W-yQWaUL_7$K1tWXhk`@<2poT4j*R8CWm=}9WU9;u_NpV$YPF_m9d!5VajW^FcoDDIZQbk zwQXf8UfRmM@Y+`92uom@zRJrg$_ET4`$sgKk(fIhYwqU*_|N-If265D)b0<5Y2SB( z{h_{Ie_y1oC)D1}WiR##{@zgko2UDc4~0-iw8!5V3`e-E#orNRKPCD*PWgKM+fd#! zN48}TZ_8E?uQ%9x(d(`A``SZ&_4u{0$=4r-;jJ_si1ho~F^FuziBNy9FH+lsp>HQR z(eK}4No~;7AMA?+wrkNAYK=hndamqrG;%R&bp0*ba*8${swg_%6AJqqe0?1~{u)eA z9au)%kDTp4fnNdz-^GitdA6qFcWFUW(-`t~GzKs9`}*J9PK?ga z1pRNE4zQ8bRFvg)A@=p=sN|3FOt3!^_4RN!*OX&DYWq4)1P9c0 WB;E|u3U>rU7|M%bE&LlB$^Qa@OYiUi literal 8444 zcmbVReQX;?b{~GkN2|P&O4UZqxe4RQjT2vFS(0tZcJC&S^V*4NrV6Q4?pq(w_2 zRemJS2M><)dBiLPF0k$gj5H! z0MAgZ{$^%(xg?eQqlCnL^P4yCy?OKI&09{p%}IXv!o%JVstIW$;!_)phx(GQh4d!b z3*x%bFrF1&QX34NO`WUhHlSe;|6w%rr=NIRYlDGgz=HqEPDr=S0)X_Bx=d{{bRlVh zqm_hw*Gb4ve_wzv;o&14f9CV~_8yatwJz=#Sb9O$TaY5In_v2fD2yX#rs$>C&VDDq|`dd_z=HZ&X=48;j~rAs>AC3Ux*@pYx5QPy{?y}c_G zj)xNcCH(@_Sq}MjaaZ<{K@ummB#7rA)EDHP91d}LVJH&Zg}#=-!B}4)$z%V&g@O?l%AufD1miF8bcX`*zJ8{K`wJSu zJroP33>RB@`vPJ?i~8HR8(Dl6ubUChyPmJF>-HVlmH1wTMb`0HD#{f_!V$J^u_)Y& z873?|###+TW3NYj=VGy-PhSh`Qq&gBM~QM@VoBlIP|^s7;ZS@il1Q*+Wb0~nnr-g+72Tw4$0kop(D{BQXdrPA6!rph5LYf_%dc|*YxWz7von_H6?sghUUbdlr}3~Y08tu9P< z$*MK=C>!4CoxcZ9YF;WWu5Mrbc;(5>%}v7vmerY^<^I@h@duo*PP#OCx!@Qjr{09A zIkvoV?r<9%^GoI!B{y&z3$`)R?)73)m=YR}R;MN{Q8YVU^Y>uhGS*_Lv(zyiB^WCz6XhfVN!Vw7T*eO|aV`BztI!}_%V$spLhR(coXM6j}MMBPF z3+D9zVshb7#NozaIhRsP(~YqA?e0^jr==OpWOG`YWhPHc+~{d(O|X-5x|1bRAK61o2IVOGg-&0+o}rf^qS-CZEkv>wpV!XkFHK& z%{6A(4Mc~d^$2##=PoE1xb+AGW5-|6qy=OT+S#Zn6U<=QtF<*!WkG$@Nj&epgK~^A zjx`6%SiqSaJCzq4EzV|X*`xL{4rN)ecX9S*ogG!|GQa&-hI>Uy*v{^Gy#^kqtX0|miDMEluV?&As;pCIg+uZdNw@`Ab5^YU2&W?QTbR1SlPgeo7YgUq z2aeP$MUv;(sp9tTktd3T-v+F?izVx}ITUY^1l_ikKVS+m4QdZhW}$Ei3TM>c*ivs5 zNru@IllQ#ue6_hr2z&r@J>%|*Ju^jIOn-O_1H6+f-goYbq4RKxXWVIX+$?iIn0erR z1i}^`u%}{0_QL}cyM)9UX!VR&dH2j0aj+SNw{U;iBph2$0_(0$+BG@9a`%5XH(At3 z%lwpEUilCJkJ!n(a9$x|7t}Xcd@ggJilEe_MJg|<&47Oicv|9bPkLgdEPrDMAOn5U z?_{IoPs}3|hr;N2J5@$;3hP^3odTFs(>b=wPceRJ6bbYbBv8(U%-k^|zh{c5VtbzX zQ^}bUScy_?;NZ8M(5cfS@@2@%AsM^PGE0-LsOc*tc?d;-DcQ*^yZjB7-C!!^%ky_> zI!9AiSWd|q;&6OjSJT(o1b)KVm~WEb);)n7e`nPVhv8&&u=C>%DjBwM+fZqYtv*VX zJL*kTV1UQe3}lT_`3@7%jvi{?1&J4vPclPAn*|6QbX~7Kl`+k}`XsXk!)PUZj~d1f z-s|FQqVkw#Tm30>a1zBw!D&uo!K6hsgW_dz<(Y?@n=IWXD^SN6Zb5oR+sw!;p`$I$ z=uU>d-XFZe&n|wxy3O;IC0fLW^_b0L6BHk_&*PZ&jQeZ;YR}F2JZ69sb~isZtxM=) zc#C)S@uDL$pBiVCwP0ihaQ#7cTcbG1WxXMcagxOUMXO6P;q5T7C6ES$mma4s&-XsVpfUULA--cNB|bDnX8+xm$6lE&U6 z)>$=!6Ddn84=c-_A4z;KXQ_*w)-O7nWt?IAIF{ot2UB7j%Tq?AO}W$zs^u}NjO|gT zG-Uz%QCh&3F!wVSfmd1BXxq673yAY6#0$7=h@QMz0;p4nb!4mj$dQhJW)t~*8@}$3 z8cD*e!o>THnLJRmStGA!M4I4o*}E7I67cK0J$Vq~P19KNkS9<{6lP->YhUd}7t0)Z zn!1k6VJblyVluErF^?-k0ZO7Gx%_R;Aunt4?CN8dTrsC+;P1JW|7M9?n(h4ow!lp{ zvAhxS{m^6t0@9D0hc3LbK-+qtQM_L2%TNWtd{3=rDT-B0ZnI)q*SA&C+vS3&m~tL< zFJBM5UZQGRr^hO4MBcKm&g=Cmm8-oQCJPNtcU%QHSCv-uwT-{ei>oE zWQM&c3yrYHkvu2LSdx5E2p98nVbzS;N?ymY3ih6E0&WWcW8m5)_YB$Hy_XU zV!yqJ-sg}j1vY9@{|-v@Ham>o&rIrnK>ab-allDPE2mC_k~lR0s)=j+H&7Lvk{=MVU`#ALxC^naEKR~FH7yw?pwguDh&M|tmOppJ3swn?pk5+f>qhmZq&>{FoXIJM8DUIit5@DV6s z%LJ%K&iCivCgcfDy#>n8sZT)(3uZux8T|^>lf3u8K>0ZJYfwVoCa9-4w*7Yv>?u%U zZU;dLOHY6jlB1v+_=tBwiMf4b^5sE2#(N*Zo6B)fRpd`WRdXx@>JK>;^cuaFL4A*7 zS3y0_seb_VJg07fYUb3sNmb$}@;w~;BTy}%s>m)-J2|!&lo;y=Rm-tcp!RaA57c)# z z0)Y)4b|b+)fBTP@J{D9>_X`cp^^I(CVGH{g$o@KC3DSJPUy3w!6eA7$8U{;|1D8vY zW>!#GbT!mBv#er84(|72;#Q=o*;J&d^r2a+; z(p)!VBF0bja5F*bLL{&|r49S%tRl*2vk{}z(5Ty(mDns5aLw-_*{CyenMHymb0cMcs{2GrXgj`{DegotZ z!l8h;(eKAOP(W&cWQvgQ1DQiEF7R{$x#%^J-g7arFo-_E6GVUS3!!93Jl2OBGAa66 zBp!iw^~o{K|2wj^ptVRF)6uh~us?yj4$6tUHO$bH#lpQ_0~J<|8D% zBz3(kwKvq)936}$LT!O)a4_VDxuv~voExFzxQ3Ji!^4ny+F$?MxX|5HCIp@r4i#!n zZ=r`>PPU8d)vdar{8S|L`pGb}#9v=mrb3Ah6|t1tcq$T4rUHZ9&HjB@u9BJR{mk3` zedY?8ZqmCEK}p