HomepageOther stuffGuys, I could use some crypto/stegano analysis help| Author | Post | |||
| unknown user |
In combination with the "cool hacks" thread I was looking at bios passwords, since those "backdoor" passwords never worked for me and opening the casing of a laptop, or a pc not in your control is a bit tricky. I came across cmospwd which allows you to read/write some cmos memory. and even extract the password if it knows how your bios stores it. (This software is GPL) hence the sourcecode is out there. jeej. Naturally my bios was not supported, I'm currently using phoenix bios 2324 or something other combination of those letters. I'm going to paste here some of the cmos dumps that _most_lightly contain the password in some form. (when i write 00's everywhere it removes the password. Although it's possible that only a flag (whether or not it's there) is set or something similar. I'm going to spend more time on this myself too, but humble as I am (wink wink) i have to recognise that there are people here far better at the crypto and stegano stuff than I am. common techniques that are used to store it in the bios, is random order, xorring, storing only some kind of checksum (the code only has a sum(of letters) ). There is one more thing to be aware of, and that is scancode encoding, hence letters that are next to eachother in the alphabet probably aren't next to eachother on the keyboard .. hence less related scancodes. I can create more samples, if anybody requests them No password set:  Quote:00: 51 00 33 00 00 00 01 08 06 07 26 02 50 80 00 00 |Q 3 & P | 10: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 20: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 30: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 40: C0 02 02 00 00 00 20 10 A0 E5 19 0E 00 7F 00 F0 | a | 50: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 60: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 70: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | A0: 00 12 B9 62 55 C0 09 05 25 02 00 03 30 39 40 73 | bU % 09@s| B0: 74 21 32 AC 15 00 90 27 06 04 5A 9A FB CD 22 11 |t!2 E' ZU " | C0: 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 | D | D0: 80 00 D0 6E DB B6 7E 80 31 00 40 B2 21 01 00 04 | n 1 @ ! | E0: 1B 10 00 40 00 00 01 00 04 00 10 00 40 08 C0 00 | @ @ | F0: 00 04 89 00 00 00 F8 01 00 00 00 00 00 00 00 5A | e Z| 100: 51 00 33 00 00 00 01 08 06 07 26 02 40 80 00 00 |Q 3 & @ | 110: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 120: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 130: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 140: C0 02 02 00 00 00 20 10 A0 E5 19 0E 00 7F 00 F0 | a | 150: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 160: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 170: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | password bbbbbbbb set: Quote:00: 13 00 41 00 19 00 00 07 06 07 26 02 50 80 00 00 | A & P | 10: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 20: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 30: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 40: C0 02 02 00 C0 0E 23 10 A0 E5 19 0E 00 7F 00 F0 | # a | 50: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 60: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 70: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | A0: 00 12 B9 62 55 C0 09 05 25 02 00 03 30 39 40 73 | bU % 09@s| B0: 75 24 32 AC 15 00 90 27 06 04 5A 9A FB CD 22 11 |u$2 E' ZU " | C0: 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 | D | D0: 80 00 D0 6E DB B6 7E 80 31 00 40 B2 21 01 00 04 | n 1 @ ! | E0: 1B 10 00 40 00 00 01 00 04 00 10 00 40 08 C0 00 | @ @ | F0: 00 04 89 00 00 00 F8 01 00 00 00 00 00 00 00 5A | e Z| 100: 13 00 41 00 19 00 00 07 06 07 26 02 40 80 00 00 | A & @ | 110: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 120: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 130: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 140: C0 02 02 00 C0 0E 23 10 A0 E5 19 0E 00 7F 00 F0 | # a | 150: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 160: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 170: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | password bbbbbbbc set: Quote:00: 13 00 43 00 19 00 00 07 06 07 26 02 50 80 00 00 | C & P | 10: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 20: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 30: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 40: C0 02 02 00 C0 26 23 10 A0 E5 19 0E 00 7F 00 F0 | &# a | 50: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 60: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 70: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | A0: 00 12 B9 62 55 C0 09 05 25 02 00 03 30 39 40 73 | bU % 09@s| B0: 72 16 32 AC 15 00 90 27 06 04 5A 9A FB CD 22 11 |r 2 E' ZU " | C0: 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 | D | D0: 80 00 D0 6E DB B6 7E 80 31 00 40 B2 21 01 00 04 | n 1 @ ! | E0: 1B 10 00 40 00 00 01 00 04 00 10 00 40 08 C0 00 | @ @ | F0: 00 04 89 00 00 00 F8 01 00 00 00 00 00 00 00 5A | e Z| 100: 13 00 43 00 19 00 00 07 06 07 26 02 40 80 00 00 | C & @ | 110: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 120: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 130: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 140: C0 02 02 00 C0 26 23 10 A0 E5 19 0E 00 7F 00 F0 | &# a | 150: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 160: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 170: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | password bbbbbbcc set: Quote:00: 17 00 46 00 19 00 00 07 06 07 26 02 50 80 00 00 | F & P | 10: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 20: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 30: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 40: C0 02 02 00 F0 26 21 10 A0 E5 19 0E 00 7F 00 F0 | &! a | 50: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 60: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 70: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | A0: 00 12 B9 62 55 C0 09 05 25 02 00 03 30 39 40 73 | bU % 09@s| B0: 73 21 32 AC 15 00 90 27 06 04 5A 9A FB CD 22 11 |s!2 E' ZU " | C0: 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 | D | D0: 80 00 D0 6E DB B6 7E 80 31 00 40 B2 21 01 00 04 | n 1 @ ! | E0: 1B 10 00 40 00 00 01 00 04 00 10 00 40 08 C0 00 | @ @ | F0: 00 04 89 00 00 00 F8 01 00 00 00 00 00 00 00 5A | e Z| 100: 17 00 46 00 19 00 00 07 06 07 26 02 40 80 00 00 | F & @ | 110: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 120: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 130: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 140: C0 02 02 00 F0 26 21 10 A0 E5 19 0E 00 7F 00 F0 | &! a | 150: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 160: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 170: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | password bbbbbccc set: Quote:00: 42 00 48 00 19 00 00 07 06 07 26 02 50 80 00 00 |B H & P | 10: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 20: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 30: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 40: C0 02 02 00 F0 20 21 10 A0 E5 19 0E 00 7F 00 F0 | ! a | 50: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 60: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 70: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | A0: 00 12 B9 62 55 C0 09 05 25 02 00 03 30 39 40 73 | bU % 09@s| B0: 73 17 32 AC 15 00 90 27 06 04 5A 9A FB CD 22 11 |s 2 E' ZU " | C0: 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 | D | D0: 80 00 D0 6E DB B6 7E 80 31 00 40 B2 21 01 00 04 | n 1 @ ! | E0: 1B 10 00 40 00 00 01 00 04 00 10 00 40 08 C0 00 | @ @ | F0: 00 04 89 00 00 00 F8 01 00 00 00 00 00 00 00 5A | e Z| 100: 42 00 48 00 19 00 00 07 06 07 26 02 40 80 00 00 |B H & @ | 110: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 120: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 130: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 140: C0 02 02 00 F0 20 21 10 A0 E5 19 0E 00 7F 00 F0 | ! a | 150: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 160: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 170: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | password cccccccc set: Quote:00: 18 00 51 00 19 00 00 07 06 07 26 02 50 80 00 00 | Q & P | 10: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 20: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 30: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 40: C0 02 02 00 60 E8 20 10 A0 E5 19 0E 00 7F 00 F0 | ` a | 50: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 60: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 70: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | | A0: 00 12 B9 62 55 C0 09 05 25 02 00 03 30 39 40 73 | bU % 09@s| B0: 75 20 32 AC 15 00 90 27 06 04 5A 9A FB CD 22 11 |u 2 E' ZU " | C0: 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 | D | D0: 80 00 D0 6E DB B6 7E 80 31 00 40 B2 21 01 00 04 | n 1 @ ! | E0: 1B 10 00 40 00 00 01 00 04 00 10 00 40 08 C0 00 | @ @ | F0: 00 04 89 00 00 00 F8 01 00 00 00 00 00 00 00 5A | e Z| 100: 18 00 51 00 19 00 00 07 06 07 26 02 40 80 00 00 | Q & @ | 110: 00 51 F0 84 02 80 02 00 FC 01 00 00 6D 90 02 00 | Q a mE | 120: 00 10 00 FF 60 0F 84 F8 00 D1 10 00 80 02 08 A2 | ` a o| 130: 00 FC 20 C8 C1 19 80 00 00 00 00 00 7E 27 00 00 | ' | 140: C0 02 02 00 60 E8 20 10 A0 E5 19 0E 00 7F 00 F0 | ` a | 150: FF E7 7F 00 00 00 00 2D 80 F7 FF 9F 45 C0 73 00 | - E s | 160: 01 00 00 00 E0 01 88 88 88 88 00 10 00 00 00 00 | eeee | 170: 11 00 D4 11 00 00 00 00 00 00 00 00 00 00 00 80 | | there is more data in there than just the pw obviously, the first few bytes appear to be the time I would be glad if somebody could beat me to it. And/or share your results with the tool, might be cool to expand the tool for a larger number of bios' using this community. |
|||
| 07.06.2007 22:42:21 |
|
|||
quangntenemy             |
Is the minimum password length 8? If not it would be better if you can provide some dump for 1-char long passes  And you should provide dump for multiple passes with only 1 char different in the same place too I would like the output of: a b c 0 1 2 aa ab ac a0 a1 a2 ba abcdef 012345678 |
|||
 08.06.2007 01:13:14 |
|
|||
| unknown user |
passwords in bios are 8 bytes anyways, it's better to have them set to some value you know about (imho). there are passwords with multiple one characters imho, you just want more of the same  anyway when i get the time i'll provide the requested dumps |
|||
| 08.06.2007 16:52:31 |
|
|||
| unknown user |
some testing indicates to me that the bytes at these adresses do something else, > 0000000 > 0000002 > 0000004 > 0000400 > 0000402 > 0000404 (still working on those dumps, can't reset my pc right now) |
|||
| 09.06.2007 23:18:50 |
|
|||
moose      |
I'll edit this post later if I find out something new: PC01: AMIBIOS 3.31a: Max. 6 letters: Non of these Passwords worked PC02: Award BIOS: Max. 8 letters: AWARD?SW worked PC03: PhoenixBIOS: Max. 7 letters: non of these Passwords worked PC04: Phoenix - AwardBIOS: Max. 8 letters: non of these Passwords worked |
|||
Edited by moose on 10.06.2007 11:05:34 | ||||
 10.06.2007 10:10:29 |
|
|||
| unknown user |
i'm pretty confident that the bytes at 44 45 46 contain some sort of checksum for the password for "bbbbbbbb" that's C0 0E 23 when you look at the bytes for the different pw cmos_bbbbbbbb.dat:0000104 c0 cmos_bbbbbbbc.dat:0000104 c0 cmos_bbbbbbcc.dat:0000104 f0 cmos_bbbbbccc.dat:0000104 f0 cmos_cccccccc.dat:0000104 60 cmos_clear.dat: 0000104 00 cmos_bbbbbbbb.dat:0000105 0e cmos_bbbbbbbc.dat:0000105 26 cmos_bbbbbbcc.dat:0000105 26 cmos_bbbbbccc.dat:0000105 20 cmos_cccccccc.dat:0000105 e8 cmos_clear.dat: 0000105 00 cmos_bbbbbbbb.dat:0000106 23 cmos_bbbbbbbc.dat:0000106 23 cmos_bbbbbbcc.dat:0000106 21 cmos_bbbbbccc.dat:0000106 21 cmos_cccccccc.dat:0000106 20 cmos_clear.dat: 0000106 20 you can imagine several patterns, most notably that the first two bytes are 0 when the password is not set. the byte at 104 and 106 (well niblles really) exhibit a pattern, but how this should be interpreted is not too clear yet for me the fact that the sequence at 104 is repeated in the file, leads me to believe that the second time, it's actually the password for setup vs boot pw, which if only one is set, it'would be the same... or something  one of the problems i'm strugling with obviously is that there only appears to be 16bit of entropy for an "8byte" password i'm thinking that reverse engineering the bios for that particular code, might be the easiest way to go. |
|||
| 10.06.2007 18:03:09 |
|
|||
| unknown user |
i created all these dumps, on request for quang I really hope you can figure it out with these  Quote:cmos_0 0000000 05 00 38 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 10 e4 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 73 21 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 05 00 38 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 10 e4 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_01234567 0000000 50 00 24 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 20 4a 22 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 73 20 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 50 00 24 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 20 4a 22 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_1 0000000 13 00 39 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 10 f8 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 24 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 13 00 39 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 10 f8 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_2 0000000 13 00 40 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 00 04 20 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 20 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 13 00 40 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 00 04 20 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_a 0000000 09 00 16 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 10 c0 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 73 24 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 09 00 16 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 10 c0 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_a0 0000000 10 00 31 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 c0 1b 20 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 73 23 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 10 00 31 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 c0 1b 20 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_a1 0000000 38 00 32 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 c0 07 20 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 17 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 38 00 32 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 c0 07 20 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_a2 0000000 08 00 35 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 d0 fb 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 22 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 08 00 35 00 20 00 01 10 06 07 26 02 00 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 d0 fb 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_aa 0000000 26 00 26 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 c0 3f 20 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 16 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 26 00 26 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 c0 3f 20 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_ab 0000000 13 00 28 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 d0 bf 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 21 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 13 00 28 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 d0 bf 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_abcdef 0000000 30 00 22 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 a0 91 21 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 17 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 30 00 22 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 a0 91 21 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_ac 0000000 44 00 29 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 d0 97 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 72 22 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 44 00 29 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 d0 97 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_b 0000000 07 00 19 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 00 40 20 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 73 22 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 07 00 19 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 00 40 20 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_ba 0000000 35 00 36 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 50 c0 23 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 74 22 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 35 00 36 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 50 c0 23 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_bbbbcccc 0000000 37 00 41 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 f0 a0 21 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 74 22 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 37 00 41 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 f0 a0 21 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 cmos_c 0000000 43 00 20 00 20 00 01 10 06 07 26 02 50 80 00 00 0000020 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000040 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000060 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000100 c0 02 02 00 00 68 20 10 a0 e5 19 0e 00 7f 00 f0 0000120 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000140 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000160 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000240 00 12 b9 62 55 c0 09 05 25 02 00 03 30 39 40 73 0000260 73 21 32 ac 15 00 90 27 06 04 5a 9a fb cd 22 11 0000300 91 02 44 00 00 00 00 20 00 00 00 01 01 20 00 04 0000320 80 00 d0 6e db b6 7e 80 31 00 40 b2 21 01 00 04 0000340 1b 10 00 40 00 00 01 00 04 00 10 00 40 08 c0 00 0000360 00 04 89 00 00 00 f8 01 00 00 00 00 00 00 00 5a 0000400 43 00 20 00 20 00 01 10 06 07 26 02 40 80 00 00 0000420 00 51 f0 84 02 80 02 00 fc 01 00 00 6d 90 02 00 0000440 00 10 00 ff 60 0f 84 f8 00 d1 10 00 80 02 08 a2 0000460 00 fc 20 c8 c1 19 01 00 00 00 00 00 7e 27 00 00 0000500 c0 02 02 00 00 68 20 10 a0 e5 19 0e 00 7f 00 f0 0000520 ff e7 7f 00 00 00 00 2d 80 f7 ff 9f 45 c0 73 00 0000540 01 00 00 00 e0 01 88 88 88 88 00 10 00 00 00 00 0000560 11 00 d4 11 00 00 00 00 00 00 00 00 00 00 00 80 0000600 this is the above output filtered for the 3 bytes i suspect Quote:cmos_0 0000104 10 cmos_01234567 0000104 20 cmos_1 0000104 10 cmos_2 0000104 00 cmos_a 0000104 10 cmos_a0 0000104 c0 cmos_a1 0000104 c0 cmos_a2 0000104 d0 cmos_aa 0000104 c0 cmos_ab 0000104 d0 cmos_abcdef 0000104 a0 cmos_ac 0000104 d0 cmos_b 0000104 00 cmos_ba 0000104 50 cmos_bbbbcccc 0000104 f0 cmos_c 0000104 00 cmos_0 0000105 e4 cmos_01234567 0000105 4a cmos_1 0000105 f8 cmos_2 0000105 04 cmos_a 0000105 c0 cmos_a0 0000105 1b cmos_a1 0000105 07 cmos_a2 0000105 fb cmos_aa 0000105 3f cmos_ab 0000105 bf cmos_abcdef 0000105 91 cmos_ac 0000105 97 cmos_b 0000105 40 cmos_ba 0000105 c0 cmos_bbbbcccc 0000105 a0 cmos_c 0000105 68 cmos_0 0000106 23 cmos_01234567 0000106 22 cmos_1 0000106 23 cmos_2 0000106 20 cmos_a 0000106 23 cmos_a0 0000106 20 cmos_a1 0000106 20 cmos_a2 0000106 23 cmos_aa 0000106 20 cmos_ab 0000106 23 cmos_abcdef 0000106 21 cmos_ac 0000106 23 cmos_b 0000106 20 cmos_ba 0000106 23 cmos_bbbbcccc 0000106 21 cmos_c 0000106 20 |
|||
| 10.06.2007 19:08:08 |
|
|||
| unknown user |
uch i hate stegano/crypto's i've been using this algorithm -invent hypothesis -try to disprove -if disprove restart -else have victory needless to say i haven't reach victory... yet I already have quite a lengthy list of incorrect hypothesis |
|||
| 10.06.2007 23:43:44 |
|
|||
|
quangntenemy |
I think those bytes are important, but I don't think the whole checksum is there. Because only byte 45 actually changes. For byte 44 and 46 only the first/last nibbles change. I think the bytes at 00 02 B0 B1 are important too. Can you, say, change the password to one you have used to see it it produces exactly the same dump? Or there are other factors (like date/time) involved? |
|||
|
11.06.2007 02:18:58 |
|
|||
| unknown user |
i already did that, and that's why i listed the above odd byte addresses Quote:euh look at the diff a bit later, i think i misinterpreted this file when typing this post as irrelevant, but maybe there are still nibbles of importance, well a 16bit checksum would make it 1 in 65535 chance of typing the wrong password and getting in ... and since the bios only allows 3 attempts. before showing a pretty scare "System locked" after wich only pressing the powerbutton for 10s works .i might need to redo it on the basis of nibbles though. I'm pretty sure the first few bytes are time stuff. also be aware that some of the covariance could be because i did certain pwds in sequence. Though intentionally not all, hence no pattern should be there that isn't true. I analysed the sourcode for the program "cmospwd" a bit more, and one of the checksums that Phoenix bios uses is
for all 7 letters
crc+= (letter ^ 0xf0) + position
Yet i did the inverse calculation to search for the cecksums, I found nothing |
|||
| 11.06.2007 08:44:08 |
|
|||
EMail
private message
Website