diff --git a/.gitmodules b/.gitmodules index 9b688ab9d..cb0f75de6 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,3 +1,3 @@ [submodule "tests/data"] path = tests/data - url = ../flare-floss-testfiles.git + url = https://github.com/mandiant/flare-floss-testfiles.git diff --git a/docs/index.html b/docs/index.html index ff139dcdd..c5aa17dfd 100644 --- a/docs/index.html +++ b/docs/index.html @@ -1,10 +1,10 @@ - - - - - - Quantumstrand Viewer - - - - -
- - +`+e.stack}}function Dt(A){switch(typeof A){case"bigint":case"boolean":case"number":case"string":case"undefined":return A;case"object":return A;default:return""}}function Wu(A){var t=A.type;return(A=A.nodeName)&&A.toLowerCase()==="input"&&(t==="checkbox"||t==="radio")}function bp(A){var t=Wu(A)?"checked":"value",e=Object.getOwnPropertyDescriptor(A.constructor.prototype,t),a=""+A[t];if(!A.hasOwnProperty(t)&&typeof e<"u"&&typeof e.get=="function"&&typeof e.set=="function"){var i=e.get,n=e.set;return Object.defineProperty(A,t,{configurable:!0,get:function(){return i.call(this)},set:function(l){a=""+l,n.call(this,l)}}),Object.defineProperty(A,t,{enumerable:e.enumerable}),{getValue:function(){return a},setValue:function(l){a=""+l},stopTracking:function(){A._valueTracker=null,delete A[t]}}}}function Fi(A){A._valueTracker||(A._valueTracker=bp(A))}function Pu(A){if(!A)return!1;var t=A._valueTracker;if(!t)return!0;var e=t.getValue(),a="";return A&&(a=Wu(A)?A.checked?"true":"false":A.value),A=a,A!==e?(t.setValue(A),!0):!1}function Wi(A){if(A=A||(typeof document<"u"?document:void 0),typeof A>"u")return null;try{return A.activeElement||A.body}catch{return A.body}}var Sp=/[\n"\\]/g;function _t(A){return A.replace(Sp,function(t){return"\\"+t.charCodeAt(0).toString(16)+" "})}function yl(A,t,e,a,i,n,l,u){A.name="",l!=null&&typeof l!="function"&&typeof l!="symbol"&&typeof l!="boolean"?A.type=l:A.removeAttribute("type"),t!=null?l==="number"?(t===0&&A.value===""||A.value!=t)&&(A.value=""+Dt(t)):A.value!==""+Dt(t)&&(A.value=""+Dt(t)):l!=="submit"&&l!=="reset"||A.removeAttribute("value"),t!=null?xl(A,l,Dt(t)):e!=null?xl(A,l,Dt(e)):a!=null&&A.removeAttribute("value"),i==null&&n!=null&&(A.defaultChecked=!!n),i!=null&&(A.checked=i&&typeof i!="function"&&typeof i!="symbol"),u!=null&&typeof u!="function"&&typeof u!="symbol"&&typeof u!="boolean"?A.name=""+Dt(u):A.removeAttribute("name")}function Iu(A,t,e,a,i,n,l,u){if(n!=null&&typeof n!="function"&&typeof n!="symbol"&&typeof n!="boolean"&&(A.type=n),t!=null||e!=null){if(!(n!=="submit"&&n!=="reset"||t!=null))return;e=e!=null?""+Dt(e):"",t=t!=null?""+Dt(t):e,u||t===A.value||(A.value=t),A.defaultValue=t}a=a??i,a=typeof a!="function"&&typeof a!="symbol"&&!!a,A.checked=u?A.checked:!!a,A.defaultChecked=!!a,l!=null&&typeof l!="function"&&typeof l!="symbol"&&typeof l!="boolean"&&(A.name=l)}function xl(A,t,e){t==="number"&&Wi(A.ownerDocument)===A||A.defaultValue===""+e||(A.defaultValue=""+e)}function oa(A,t,e,a){if(A=A.options,t){t={};for(var i=0;i"u"||typeof window.document>"u"||typeof window.document.createElement>"u"),Tl=!1;if(Pt)try{var Pa={};Object.defineProperty(Pa,"passive",{get:function(){Tl=!0}}),window.addEventListener("test",Pa,Pa),window.removeEventListener("test",Pa,Pa)}catch{Tl=!1}var ge=null,Ol=null,Ii=null;function ls(){if(Ii)return Ii;var A,t=Ol,e=t.length,a,i="value"in ge?ge.value:ge.textContent,n=i.length;for(A=0;A=ti),rs=" ",ps=!1;function ds(A,t){switch(A){case"keyup":return Fp.indexOf(t.keyCode)!==-1;case"keydown":return t.keyCode!==229;case"keypress":case"mousedown":case"focusout":return!0;default:return!1}}function ms(A){return A=A.detail,typeof A=="object"&&"data"in A?A.data:null}var da=!1;function Pp(A,t){switch(A){case"compositionend":return ms(t);case"keypress":return t.which!==32?null:(ps=!0,rs);case"textInput":return A=t.data,A===rs&&ps?null:A;default:return null}}function Ip(A,t){if(da)return A==="compositionend"||!Ml&&ds(A,t)?(A=ls(),Ii=Ol=ge=null,da=!1,A):null;switch(A){case"paste":return null;case"keypress":if(!(t.ctrlKey||t.altKey||t.metaKey)||t.ctrlKey&&t.altKey){if(t.char&&1=t)return{node:e,offset:t-A};A=a}A:{for(;e;){if(e.nextSibling){e=e.nextSibling;break A}e=e.parentNode}e=void 0}e=zs(e)}}function Ts(A,t){return A&&t?A===t?!0:A&&A.nodeType===3?!1:t&&t.nodeType===3?Ts(A,t.parentNode):"contains"in A?A.contains(t):A.compareDocumentPosition?!!(A.compareDocumentPosition(t)&16):!1:!1}function Os(A){A=A!=null&&A.ownerDocument!=null&&A.ownerDocument.defaultView!=null?A.ownerDocument.defaultView:window;for(var t=Wi(A.document);t instanceof A.HTMLIFrameElement;){try{var e=typeof t.contentWindow.location.href=="string"}catch{e=!1}if(e)A=t.contentWindow;else break;t=Wi(A.document)}return t}function Ul(A){var t=A&&A.nodeName&&A.nodeName.toLowerCase();return t&&(t==="input"&&(A.type==="text"||A.type==="search"||A.type==="tel"||A.type==="url"||A.type==="password")||t==="textarea"||A.contentEditable==="true")}var cd=Pt&&"documentMode"in document&&11>=document.documentMode,ma=null,Cl=null,ni=null,ql=!1;function Ds(A,t,e){var a=e.window===e?e.document:e.nodeType===9?e:e.ownerDocument;ql||ma==null||ma!==Wi(a)||(a=ma,"selectionStart"in a&&Ul(a)?a={start:a.selectionStart,end:a.selectionEnd}:(a=(a.ownerDocument&&a.ownerDocument.defaultView||window).getSelection(),a={anchorNode:a.anchorNode,anchorOffset:a.anchorOffset,focusNode:a.focusNode,focusOffset:a.focusOffset}),ni&&ii(ni,a)||(ni=a,a=kn(Cl,"onSelect"),0>=l,i-=l,Ae=1<<32-JA(t)+i|e<n?n:8;var l=x.T,u={};x.T=u,bc(A,!1,t,e);try{var o=i(),v=x.S;if(v!==null&&v(u,o),o!==null&&typeof o=="object"&&typeof o.then=="function"){var b=gd(o,a);xi(A,t,b,Et(A))}else xi(A,t,a,Et(A))}catch(T){xi(A,t,{then:function(){},status:"rejected",reason:T},Et())}finally{j.p=n,x.T=l}}function bd(){}function yc(A,t,e,a){if(A.tag!==5)throw Error(s(476));var i=wo(A).queue;_o(A,i,t,Y,e===null?bd:function(){return jo(A),e(a)})}function wo(A){var t=A.memoizedState;if(t!==null)return t;t={memoizedState:Y,baseState:Y,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:ie,lastRenderedState:Y},next:null};var e={};return t.next={memoizedState:e,baseState:e,baseQueue:null,queue:{pending:null,lanes:0,dispatch:null,lastRenderedReducer:ie,lastRenderedState:e},next:null},A.memoizedState=t,A=A.alternate,A!==null&&(A.memoizedState=t),t}function jo(A){var t=wo(A).next.queue;xi(A,t,{},Et())}function xc(){return ct(Bi)}function Mo(){return ZA().memoizedState}function Ro(){return ZA().memoizedState}function Sd(A){for(var t=A.return;t!==null;){switch(t.tag){case 24:case 3:var e=Et();A=ye(e);var a=xe(t,A,e);a!==null&&(Tt(a,t,e),di(a,t,e)),t={cache:Fl()},A.payload=t;return}t=t.return}}function zd(A,t,e){var a=Et();e={lane:a,revertLane:0,action:e,hasEagerState:!1,eagerState:null,next:null},En(A)?Uo(t,e):(e=Yl(A,t,e,a),e!==null&&(Tt(e,A,a),Co(e,t,a)))}function No(A,t,e){var a=Et();xi(A,t,e,a)}function xi(A,t,e,a){var i={lane:a,revertLane:0,action:e,hasEagerState:!1,eagerState:null,next:null};if(En(A))Uo(t,i);else{var n=A.alternate;if(A.lanes===0&&(n===null||n.lanes===0)&&(n=t.lastRenderedReducer,n!==null))try{var l=t.lastRenderedState,u=n(l,e);if(i.hasEagerState=!0,i.eagerState=u,yt(u,l))return cn(A,t,i,0),OA===null&&ln(),!1}catch{}finally{}if(e=Yl(A,t,i,a),e!==null)return Tt(e,A,a),Co(e,t,a),!0}return!1}function bc(A,t,e,a){if(a={lane:2,revertLane:Ic(),action:a,hasEagerState:!1,eagerState:null,next:null},En(A)){if(t)throw Error(s(479))}else t=Yl(A,e,a,2),t!==null&&Tt(t,A,2)}function En(A){var t=A.alternate;return A===aA||t!==null&&t===aA}function Uo(A,t){Ta=hn=!0;var e=A.pending;e===null?t.next=t:(t.next=e.next,e.next=t),A.pending=t}function Co(A,t,e){if((e&4194048)!==0){var a=t.lanes;a&=A.pendingLanes,e|=a,t.lanes=e,Qu(A,e)}}var Tn={readContext:ct,use:xn,useCallback:QA,useContext:QA,useEffect:QA,useImperativeHandle:QA,useLayoutEffect:QA,useInsertionEffect:QA,useMemo:QA,useReducer:QA,useRef:QA,useState:QA,useDebugValue:QA,useDeferredValue:QA,useTransition:QA,useSyncExternalStore:QA,useId:QA,useHostTransitionStatus:QA,useFormState:QA,useActionState:QA,useOptimistic:QA,useMemoCache:QA,useCacheRefresh:QA},qo={readContext:ct,use:xn,useCallback:function(A,t){return gt().memoizedState=[A,t===void 0?null:t],A},useContext:ct,useEffect:yo,useImperativeHandle:function(A,t,e){e=e!=null?e.concat([A]):null,zn(4194308,4,zo.bind(null,t,A),e)},useLayoutEffect:function(A,t){return zn(4194308,4,A,t)},useInsertionEffect:function(A,t){zn(4,2,A,t)},useMemo:function(A,t){var e=gt();t=t===void 0?null:t;var a=A();if(We){HA(!0);try{A()}finally{HA(!1)}}return e.memoizedState=[a,t],a},useReducer:function(A,t,e){var a=gt();if(e!==void 0){var i=e(t);if(We){HA(!0);try{e(t)}finally{HA(!1)}}}else i=t;return a.memoizedState=a.baseState=i,A={pending:null,lanes:0,dispatch:null,lastRenderedReducer:A,lastRenderedState:i},a.queue=A,A=A.dispatch=zd.bind(null,aA,A),[a.memoizedState,A]},useRef:function(A){var t=gt();return A={current:A},t.memoizedState=A},useState:function(A){A=mc(A);var t=A.queue,e=No.bind(null,aA,t);return t.dispatch=e,[A.memoizedState,e]},useDebugValue:vc,useDeferredValue:function(A,t){var e=gt();return hc(e,A,t)},useTransition:function(){var A=mc(!1);return A=_o.bind(null,aA,A.queue,!0,!1),gt().memoizedState=A,[!1,A]},useSyncExternalStore:function(A,t,e){var a=aA,i=gt();if(dA){if(e===void 0)throw Error(s(407));e=e()}else{if(e=t(),OA===null)throw Error(s(349));(uA&124)!==0||eo(a,t,e)}i.memoizedState=e;var n={value:e,getSnapshot:t};return i.queue=n,yo(io.bind(null,a,n,A),[A]),a.flags|=2048,Da(9,Sn(),ao.bind(null,a,n,e,t),null),e},useId:function(){var A=gt(),t=OA.identifierPrefix;if(dA){var e=te,a=Ae;e=(a&~(1<<32-JA(a)-1)).toString(32)+e,t="«"+t+"R"+e,e=yn++,0V?(et=Q,Q=null):et=Q.sibling;var rA=h(m,Q,g[V],E);if(rA===null){Q===null&&(Q=et);break}A&&Q&&rA.alternate===null&&t(m,Q),p=n(rA,p,V),iA===null?B=rA:iA.sibling=rA,iA=rA,Q=et}if(V===g.length)return e(m,Q),dA&&Ke(m,V),B;if(Q===null){for(;VV?(et=Q,Q=null):et=Q.sibling;var He=h(m,Q,rA.value,E);if(He===null){Q===null&&(Q=et);break}A&&Q&&He.alternate===null&&t(m,Q),p=n(He,p,V),iA===null?B=He:iA.sibling=He,iA=He,Q=et}if(rA.done)return e(m,Q),dA&&Ke(m,V),B;if(Q===null){for(;!rA.done;V++,rA=g.next())rA=T(m,rA.value,E),rA!==null&&(p=n(rA,p,V),iA===null?B=rA:iA.sibling=rA,iA=rA);return dA&&Ke(m,V),B}for(Q=a(Q);!rA.done;V++,rA=g.next())rA=y(Q,m,V,rA.value,E),rA!==null&&(A&&rA.alternate!==null&&Q.delete(rA.key===null?V:rA.key),p=n(rA,p,V),iA===null?B=rA:iA.sibling=rA,iA=rA);return A&&Q.forEach(function(Tm){return t(m,Tm)}),dA&&Ke(m,V),B}function SA(m,p,g,E){if(typeof g=="object"&&g!==null&&g.type===sA&&g.key===null&&(g=g.props.children),typeof g=="object"&&g!==null){switch(g.$$typeof){case AA:A:{for(var B=g.key;p!==null;){if(p.key===B){if(B=g.type,B===sA){if(p.tag===7){e(m,p.sibling),E=i(p,g.props.children),E.return=m,m=E;break A}}else if(p.elementType===B||typeof B=="object"&&B!==null&&B.$$typeof===kA&&Bo(B)===p.type){e(m,p.sibling),E=i(p,g.props),Si(E,g),E.return=m,m=E;break A}e(m,p);break}else t(m,p);p=p.sibling}g.type===sA?(E=Xe(g.props.children,m.mode,E,g.key),E.return=m,m=E):(E=sn(g.type,g.key,g.props,null,m.mode,E),Si(E,g),E.return=m,m=E)}return l(m);case mA:A:{for(B=g.key;p!==null;){if(p.key===B)if(p.tag===4&&p.stateNode.containerInfo===g.containerInfo&&p.stateNode.implementation===g.implementation){e(m,p.sibling),E=i(p,g.children||[]),E.return=m,m=E;break A}else{e(m,p);break}else t(m,p);p=p.sibling}E=Xl(g,m.mode,E),E.return=m,m=E}return l(m);case kA:return B=g._init,g=B(g._payload),SA(m,p,g,E)}if(pA(g))return $(m,p,g,E);if(qA(g)){if(B=qA(g),typeof B!="function")throw Error(s(150));return g=B.call(g),K(m,p,g,E)}if(typeof g.then=="function")return SA(m,p,On(g),E);if(g.$$typeof===jA)return SA(m,p,pn(m,g),E);Dn(m,g)}return typeof g=="string"&&g!==""||typeof g=="number"||typeof g=="bigint"?(g=""+g,p!==null&&p.tag===6?(e(m,p.sibling),E=i(p,g),E.return=m,m=E):(e(m,p),E=Ql(g,m.mode,E),E.return=m,m=E),l(m)):e(m,p)}return function(m,p,g,E){try{bi=0;var B=SA(m,p,g,E);return _a=null,B}catch(Q){if(Q===ri||Q===mn)throw Q;var iA=xt(29,Q,null,m.mode);return iA.lanes=E,iA.return=m,iA}finally{}}}var wa=Go(!0),Yo=Go(!1),Nt=O(null),kt=null;function Se(A){var t=A.alternate;N(FA,FA.current&1),N(Nt,A),kt===null&&(t===null||Ea.current!==null||t.memoizedState!==null)&&(kt=A)}function Lo(A){if(A.tag===22){if(N(FA,FA.current),N(Nt,A),kt===null){var t=A.alternate;t!==null&&t.memoizedState!==null&&(kt=A)}}else ze()}function ze(){N(FA,FA.current),N(Nt,Nt.current)}function ne(A){C(Nt),kt===A&&(kt=null),C(FA)}var FA=O(0);function _n(A){for(var t=A;t!==null;){if(t.tag===13){var e=t.memoizedState;if(e!==null&&(e=e.dehydrated,e===null||e.data==="$?"||fu(e)))return t}else if(t.tag===19&&t.memoizedProps.revealOrder!==void 0){if((t.flags&128)!==0)return t}else if(t.child!==null){t.child.return=t,t=t.child;continue}if(t===A)break;for(;t.sibling===null;){if(t.return===null||t.return===A)return null;t=t.return}t.sibling.return=t.return,t=t.sibling}return null}function Sc(A,t,e,a){t=A.memoizedState,e=e(a,t),e=e==null?t:U({},t,e),A.memoizedState=e,A.lanes===0&&(A.updateQueue.baseState=e)}var zc={enqueueSetState:function(A,t,e){A=A._reactInternals;var a=Et(),i=ye(a);i.payload=t,e!=null&&(i.callback=e),t=xe(A,i,a),t!==null&&(Tt(t,A,a),di(t,A,a))},enqueueReplaceState:function(A,t,e){A=A._reactInternals;var a=Et(),i=ye(a);i.tag=1,i.payload=t,e!=null&&(i.callback=e),t=xe(A,i,a),t!==null&&(Tt(t,A,a),di(t,A,a))},enqueueForceUpdate:function(A,t){A=A._reactInternals;var e=Et(),a=ye(e);a.tag=2,t!=null&&(a.callback=t),t=xe(A,a,e),t!==null&&(Tt(t,A,e),di(t,A,e))}};function Qo(A,t,e,a,i,n,l){return A=A.stateNode,typeof A.shouldComponentUpdate=="function"?A.shouldComponentUpdate(a,n,l):t.prototype&&t.prototype.isPureReactComponent?!ii(e,a)||!ii(i,n):!0}function Xo(A,t,e,a){A=t.state,typeof t.componentWillReceiveProps=="function"&&t.componentWillReceiveProps(e,a),typeof t.UNSAFE_componentWillReceiveProps=="function"&&t.UNSAFE_componentWillReceiveProps(e,a),t.state!==A&&zc.enqueueReplaceState(t,t.state,null)}function Pe(A,t){var e=t;if("ref"in t){e={};for(var a in t)a!=="ref"&&(e[a]=t[a])}if(A=A.defaultProps){e===t&&(e=U({},e));for(var i in A)e[i]===void 0&&(e[i]=A[i])}return e}var wn=typeof reportError=="function"?reportError:function(A){if(typeof window=="object"&&typeof window.ErrorEvent=="function"){var t=new window.ErrorEvent("error",{bubbles:!0,cancelable:!0,message:typeof A=="object"&&A!==null&&typeof A.message=="string"?String(A.message):String(A),error:A});if(!window.dispatchEvent(t))return}else if(typeof process=="object"&&typeof process.emit=="function"){process.emit("uncaughtException",A);return}console.error(A)};function ko(A){wn(A)}function Ko(A){console.error(A)}function Zo(A){wn(A)}function jn(A,t){try{var e=A.onUncaughtError;e(t.value,{componentStack:t.stack})}catch(a){setTimeout(function(){throw a})}}function Vo(A,t,e){try{var a=A.onCaughtError;a(e.value,{componentStack:e.stack,errorBoundary:t.tag===1?t.stateNode:null})}catch(i){setTimeout(function(){throw i})}}function Ec(A,t,e){return e=ye(e),e.tag=3,e.payload={element:null},e.callback=function(){jn(A,t)},e}function Jo(A){return A=ye(A),A.tag=3,A}function $o(A,t,e,a){var i=e.type.getDerivedStateFromError;if(typeof i=="function"){var n=a.value;A.payload=function(){return i(n)},A.callback=function(){Vo(t,e,a)}}var l=e.stateNode;l!==null&&typeof l.componentDidCatch=="function"&&(A.callback=function(){Vo(t,e,a),typeof i!="function"&&(we===null?we=new Set([this]):we.add(this));var u=a.stack;this.componentDidCatch(a.value,{componentStack:u!==null?u:""})})}function Td(A,t,e,a,i){if(e.flags|=32768,a!==null&&typeof a=="object"&&typeof a.then=="function"){if(t=e.alternate,t!==null&&si(t,e,i,!0),e=Nt.current,e!==null){switch(e.tag){case 13:return kt===null?Jc():e.alternate===null&&GA===0&&(GA=3),e.flags&=-257,e.flags|=65536,e.lanes=i,a===Il?e.flags|=16384:(t=e.updateQueue,t===null?e.updateQueue=new Set([a]):t.add(a),Fc(A,a,i)),!1;case 22:return e.flags|=65536,a===Il?e.flags|=16384:(t=e.updateQueue,t===null?(t={transitions:null,markerInstances:null,retryQueue:new Set([a])},e.updateQueue=t):(e=t.retryQueue,e===null?t.retryQueue=new Set([a]):e.add(a)),Fc(A,a,i)),!1}throw Error(s(435,e.tag))}return Fc(A,a,i),Jc(),!1}if(dA)return t=Nt.current,t!==null?((t.flags&65536)===0&&(t.flags|=256),t.flags|=65536,t.lanes=i,a!==Zl&&(A=Error(s(422),{cause:a}),ui(wt(A,e)))):(a!==Zl&&(t=Error(s(423),{cause:a}),ui(wt(t,e))),A=A.current.alternate,A.flags|=65536,i&=-i,A.lanes|=i,a=wt(a,e),i=Ec(A.stateNode,a,i),ec(A,i),GA!==4&&(GA=2)),!1;var n=Error(s(520),{cause:a});if(n=wt(n,e),wi===null?wi=[n]:wi.push(n),GA!==4&&(GA=2),t===null)return!0;a=wt(a,e),e=t;do{switch(e.tag){case 3:return e.flags|=65536,A=i&-i,e.lanes|=A,A=Ec(e.stateNode,a,A),ec(e,A),!1;case 1:if(t=e.type,n=e.stateNode,(e.flags&128)===0&&(typeof t.getDerivedStateFromError=="function"||n!==null&&typeof n.componentDidCatch=="function"&&(we===null||!we.has(n))))return e.flags|=65536,i&=-i,e.lanes|=i,i=Jo(i),$o(i,A,e,a),ec(e,i),!1}e=e.return}while(e!==null);return!1}var Fo=Error(s(461)),At=!1;function at(A,t,e,a){t.child=A===null?Yo(t,null,e,a):wa(t,A.child,e,a)}function Wo(A,t,e,a,i){e=e.render;var n=t.ref;if("ref"in a){var l={};for(var u in a)u!=="ref"&&(l[u]=a[u])}else l=a;return $e(t),a=cc(A,t,e,l,n,i),u=uc(),A!==null&&!At?(sc(A,t,i),le(A,t,i)):(dA&&u&&kl(t),t.flags|=1,at(A,t,a,i),t.child)}function Po(A,t,e,a,i){if(A===null){var n=e.type;return typeof n=="function"&&!Ll(n)&&n.defaultProps===void 0&&e.compare===null?(t.tag=15,t.type=n,Io(A,t,n,a,i)):(A=sn(e.type,null,a,t,t.mode,i),A.ref=t.ref,A.return=t,t.child=A)}if(n=A.child,!Rc(A,i)){var l=n.memoizedProps;if(e=e.compare,e=e!==null?e:ii,e(l,a)&&A.ref===t.ref)return le(A,t,i)}return t.flags|=1,A=It(n,a),A.ref=t.ref,A.return=t,t.child=A}function Io(A,t,e,a,i){if(A!==null){var n=A.memoizedProps;if(ii(n,a)&&A.ref===t.ref)if(At=!1,t.pendingProps=a=n,Rc(A,i))(A.flags&131072)!==0&&(At=!0);else return t.lanes=A.lanes,le(A,t,i)}return Tc(A,t,e,a,i)}function Af(A,t,e){var a=t.pendingProps,i=a.children,n=A!==null?A.memoizedState:null;if(a.mode==="hidden"){if((t.flags&128)!==0){if(a=n!==null?n.baseLanes|e:e,A!==null){for(i=t.child=A.child,n=0;i!==null;)n=n|i.lanes|i.childLanes,i=i.sibling;t.childLanes=n&~a}else t.childLanes=0,t.child=null;return tf(A,t,a,e)}if((e&536870912)!==0)t.memoizedState={baseLanes:0,cachePool:null},A!==null&&dn(t,n!==null?n.cachePool:null),n!==null?Ps(t,n):ic(),Lo(t);else return t.lanes=t.childLanes=536870912,tf(A,t,n!==null?n.baseLanes|e:e,e)}else n!==null?(dn(t,n.cachePool),Ps(t,n),ze(),t.memoizedState=null):(A!==null&&dn(t,null),ic(),ze());return at(A,t,i,e),t.child}function tf(A,t,e,a){var i=Pl();return i=i===null?null:{parent:$A._currentValue,pool:i},t.memoizedState={baseLanes:e,cachePool:i},A!==null&&dn(t,null),ic(),Lo(t),A!==null&&si(A,t,a,!0),null}function Mn(A,t){var e=t.ref;if(e===null)A!==null&&A.ref!==null&&(t.flags|=4194816);else{if(typeof e!="function"&&typeof e!="object")throw Error(s(284));(A===null||A.ref!==e)&&(t.flags|=4194816)}}function Tc(A,t,e,a,i){return $e(t),e=cc(A,t,e,a,void 0,i),a=uc(),A!==null&&!At?(sc(A,t,i),le(A,t,i)):(dA&&a&&kl(t),t.flags|=1,at(A,t,e,i),t.child)}function ef(A,t,e,a,i,n){return $e(t),t.updateQueue=null,e=Ao(t,a,e,i),Is(A),a=uc(),A!==null&&!At?(sc(A,t,n),le(A,t,n)):(dA&&a&&kl(t),t.flags|=1,at(A,t,e,n),t.child)}function af(A,t,e,a,i){if($e(t),t.stateNode===null){var n=ya,l=e.contextType;typeof l=="object"&&l!==null&&(n=ct(l)),n=new e(a,n),t.memoizedState=n.state!==null&&n.state!==void 0?n.state:null,n.updater=zc,t.stateNode=n,n._reactInternals=t,n=t.stateNode,n.props=a,n.state=t.memoizedState,n.refs={},Ac(t),l=e.contextType,n.context=typeof l=="object"&&l!==null?ct(l):ya,n.state=t.memoizedState,l=e.getDerivedStateFromProps,typeof l=="function"&&(Sc(t,e,l,a),n.state=t.memoizedState),typeof e.getDerivedStateFromProps=="function"||typeof n.getSnapshotBeforeUpdate=="function"||typeof n.UNSAFE_componentWillMount!="function"&&typeof n.componentWillMount!="function"||(l=n.state,typeof n.componentWillMount=="function"&&n.componentWillMount(),typeof n.UNSAFE_componentWillMount=="function"&&n.UNSAFE_componentWillMount(),l!==n.state&&zc.enqueueReplaceState(n,n.state,null),gi(t,a,n,i),mi(),n.state=t.memoizedState),typeof n.componentDidMount=="function"&&(t.flags|=4194308),a=!0}else if(A===null){n=t.stateNode;var u=t.memoizedProps,o=Pe(e,u);n.props=o;var v=n.context,b=e.contextType;l=ya,typeof b=="object"&&b!==null&&(l=ct(b));var T=e.getDerivedStateFromProps;b=typeof T=="function"||typeof n.getSnapshotBeforeUpdate=="function",u=t.pendingProps!==u,b||typeof n.UNSAFE_componentWillReceiveProps!="function"&&typeof n.componentWillReceiveProps!="function"||(u||v!==l)&&Xo(t,n,a,l),he=!1;var h=t.memoizedState;n.state=h,gi(t,a,n,i),mi(),v=t.memoizedState,u||h!==v||he?(typeof T=="function"&&(Sc(t,e,T,a),v=t.memoizedState),(o=he||Qo(t,e,o,a,h,v,l))?(b||typeof n.UNSAFE_componentWillMount!="function"&&typeof n.componentWillMount!="function"||(typeof n.componentWillMount=="function"&&n.componentWillMount(),typeof n.UNSAFE_componentWillMount=="function"&&n.UNSAFE_componentWillMount()),typeof n.componentDidMount=="function"&&(t.flags|=4194308)):(typeof n.componentDidMount=="function"&&(t.flags|=4194308),t.memoizedProps=a,t.memoizedState=v),n.props=a,n.state=v,n.context=l,a=o):(typeof n.componentDidMount=="function"&&(t.flags|=4194308),a=!1)}else{n=t.stateNode,tc(A,t),l=t.memoizedProps,b=Pe(e,l),n.props=b,T=t.pendingProps,h=n.context,v=e.contextType,o=ya,typeof v=="object"&&v!==null&&(o=ct(v)),u=e.getDerivedStateFromProps,(v=typeof u=="function"||typeof n.getSnapshotBeforeUpdate=="function")||typeof n.UNSAFE_componentWillReceiveProps!="function"&&typeof n.componentWillReceiveProps!="function"||(l!==T||h!==o)&&Xo(t,n,a,o),he=!1,h=t.memoizedState,n.state=h,gi(t,a,n,i),mi();var y=t.memoizedState;l!==T||h!==y||he||A!==null&&A.dependencies!==null&&rn(A.dependencies)?(typeof u=="function"&&(Sc(t,e,u,a),y=t.memoizedState),(b=he||Qo(t,e,b,a,h,y,o)||A!==null&&A.dependencies!==null&&rn(A.dependencies))?(v||typeof n.UNSAFE_componentWillUpdate!="function"&&typeof n.componentWillUpdate!="function"||(typeof n.componentWillUpdate=="function"&&n.componentWillUpdate(a,y,o),typeof n.UNSAFE_componentWillUpdate=="function"&&n.UNSAFE_componentWillUpdate(a,y,o)),typeof n.componentDidUpdate=="function"&&(t.flags|=4),typeof n.getSnapshotBeforeUpdate=="function"&&(t.flags|=1024)):(typeof n.componentDidUpdate!="function"||l===A.memoizedProps&&h===A.memoizedState||(t.flags|=4),typeof n.getSnapshotBeforeUpdate!="function"||l===A.memoizedProps&&h===A.memoizedState||(t.flags|=1024),t.memoizedProps=a,t.memoizedState=y),n.props=a,n.state=y,n.context=o,a=b):(typeof n.componentDidUpdate!="function"||l===A.memoizedProps&&h===A.memoizedState||(t.flags|=4),typeof n.getSnapshotBeforeUpdate!="function"||l===A.memoizedProps&&h===A.memoizedState||(t.flags|=1024),a=!1)}return n=a,Mn(A,t),a=(t.flags&128)!==0,n||a?(n=t.stateNode,e=a&&typeof e.getDerivedStateFromError!="function"?null:n.render(),t.flags|=1,A!==null&&a?(t.child=wa(t,A.child,null,i),t.child=wa(t,null,e,i)):at(A,t,e,i),t.memoizedState=n.state,A=t.child):A=le(A,t,i),A}function nf(A,t,e,a){return ci(),t.flags|=256,at(A,t,e,a),t.child}var Oc={dehydrated:null,treeContext:null,retryLane:0,hydrationErrors:null};function Dc(A){return{baseLanes:A,cachePool:ks()}}function _c(A,t,e){return A=A!==null?A.childLanes&~e:0,t&&(A|=Ut),A}function lf(A,t,e){var a=t.pendingProps,i=!1,n=(t.flags&128)!==0,l;if((l=n)||(l=A!==null&&A.memoizedState===null?!1:(FA.current&2)!==0),l&&(i=!0,t.flags&=-129),l=(t.flags&32)!==0,t.flags&=-33,A===null){if(dA){if(i?Se(t):ze(),dA){var u=BA,o;if(o=u){A:{for(o=u,u=Xt;o.nodeType!==8;){if(!u){u=null;break A}if(o=Yt(o.nextSibling),o===null){u=null;break A}}u=o}u!==null?(t.memoizedState={dehydrated:u,treeContext:ke!==null?{id:Ae,overflow:te}:null,retryLane:536870912,hydrationErrors:null},o=xt(18,null,null,0),o.stateNode=u,o.return=t,t.child=o,ot=t,BA=null,o=!0):o=!1}o||Ve(t)}if(u=t.memoizedState,u!==null&&(u=u.dehydrated,u!==null))return fu(u)?t.lanes=32:t.lanes=536870912,null;ne(t)}return u=a.children,a=a.fallback,i?(ze(),i=t.mode,u=Rn({mode:"hidden",children:u},i),a=Xe(a,i,e,null),u.return=t,a.return=t,u.sibling=a,t.child=u,i=t.child,i.memoizedState=Dc(e),i.childLanes=_c(A,l,e),t.memoizedState=Oc,a):(Se(t),wc(t,u))}if(o=A.memoizedState,o!==null&&(u=o.dehydrated,u!==null)){if(n)t.flags&256?(Se(t),t.flags&=-257,t=jc(A,t,e)):t.memoizedState!==null?(ze(),t.child=A.child,t.flags|=128,t=null):(ze(),i=a.fallback,u=t.mode,a=Rn({mode:"visible",children:a.children},u),i=Xe(i,u,e,null),i.flags|=2,a.return=t,i.return=t,a.sibling=i,t.child=a,wa(t,A.child,null,e),a=t.child,a.memoizedState=Dc(e),a.childLanes=_c(A,l,e),t.memoizedState=Oc,t=i);else if(Se(t),fu(u)){if(l=u.nextSibling&&u.nextSibling.dataset,l)var v=l.dgst;l=v,a=Error(s(419)),a.stack="",a.digest=l,ui({value:a,source:null,stack:null}),t=jc(A,t,e)}else if(At||si(A,t,e,!1),l=(e&A.childLanes)!==0,At||l){if(l=OA,l!==null&&(a=e&-e,a=(a&42)!==0?1:rl(a),a=(a&(l.suspendedLanes|e))!==0?0:a,a!==0&&a!==o.retryLane))throw o.retryLane=a,ha(A,a),Tt(l,A,a),Fo;u.data==="$?"||Jc(),t=jc(A,t,e)}else u.data==="$?"?(t.flags|=192,t.child=A.child,t=null):(A=o.treeContext,BA=Yt(u.nextSibling),ot=t,dA=!0,Ze=null,Xt=!1,A!==null&&(Mt[Rt++]=Ae,Mt[Rt++]=te,Mt[Rt++]=ke,Ae=A.id,te=A.overflow,ke=t),t=wc(t,a.children),t.flags|=4096);return t}return i?(ze(),i=a.fallback,u=t.mode,o=A.child,v=o.sibling,a=It(o,{mode:"hidden",children:a.children}),a.subtreeFlags=o.subtreeFlags&65011712,v!==null?i=It(v,i):(i=Xe(i,u,e,null),i.flags|=2),i.return=t,a.return=t,a.sibling=i,t.child=a,a=i,i=t.child,u=A.child.memoizedState,u===null?u=Dc(e):(o=u.cachePool,o!==null?(v=$A._currentValue,o=o.parent!==v?{parent:v,pool:v}:o):o=ks(),u={baseLanes:u.baseLanes|e,cachePool:o}),i.memoizedState=u,i.childLanes=_c(A,l,e),t.memoizedState=Oc,a):(Se(t),e=A.child,A=e.sibling,e=It(e,{mode:"visible",children:a.children}),e.return=t,e.sibling=null,A!==null&&(l=t.deletions,l===null?(t.deletions=[A],t.flags|=16):l.push(A)),t.child=e,t.memoizedState=null,e)}function wc(A,t){return t=Rn({mode:"visible",children:t},A.mode),t.return=A,A.child=t}function Rn(A,t){return A=xt(22,A,null,t),A.lanes=0,A.stateNode={_visibility:1,_pendingMarkers:null,_retryCache:null,_transitions:null},A}function jc(A,t,e){return wa(t,A.child,null,e),A=wc(t,t.pendingProps.children),A.flags|=2,t.memoizedState=null,A}function cf(A,t,e){A.lanes|=t;var a=A.alternate;a!==null&&(a.lanes|=t),Jl(A.return,t,e)}function Mc(A,t,e,a,i){var n=A.memoizedState;n===null?A.memoizedState={isBackwards:t,rendering:null,renderingStartTime:0,last:a,tail:e,tailMode:i}:(n.isBackwards=t,n.rendering=null,n.renderingStartTime=0,n.last=a,n.tail=e,n.tailMode=i)}function uf(A,t,e){var a=t.pendingProps,i=a.revealOrder,n=a.tail;if(at(A,t,a.children,e),a=FA.current,(a&2)!==0)a=a&1|2,t.flags|=128;else{if(A!==null&&(A.flags&128)!==0)A:for(A=t.child;A!==null;){if(A.tag===13)A.memoizedState!==null&&cf(A,e,t);else if(A.tag===19)cf(A,e,t);else if(A.child!==null){A.child.return=A,A=A.child;continue}if(A===t)break A;for(;A.sibling===null;){if(A.return===null||A.return===t)break A;A=A.return}A.sibling.return=A.return,A=A.sibling}a&=1}switch(N(FA,a),i){case"forwards":for(e=t.child,i=null;e!==null;)A=e.alternate,A!==null&&_n(A)===null&&(i=e),e=e.sibling;e=i,e===null?(i=t.child,t.child=null):(i=e.sibling,e.sibling=null),Mc(t,!1,i,e,n);break;case"backwards":for(e=null,i=t.child,t.child=null;i!==null;){if(A=i.alternate,A!==null&&_n(A)===null){t.child=i;break}A=i.sibling,i.sibling=e,e=i,i=A}Mc(t,!0,e,null,n);break;case"together":Mc(t,!1,null,null,void 0);break;default:t.memoizedState=null}return t.child}function le(A,t,e){if(A!==null&&(t.dependencies=A.dependencies),_e|=t.lanes,(e&t.childLanes)===0)if(A!==null){if(si(A,t,e,!1),(e&t.childLanes)===0)return null}else return null;if(A!==null&&t.child!==A.child)throw Error(s(153));if(t.child!==null){for(A=t.child,e=It(A,A.pendingProps),t.child=e,e.return=t;A.sibling!==null;)A=A.sibling,e=e.sibling=It(A,A.pendingProps),e.return=t;e.sibling=null}return t.child}function Rc(A,t){return(A.lanes&t)!==0?!0:(A=A.dependencies,!!(A!==null&&rn(A)))}function Od(A,t,e){switch(t.tag){case 3:vA(t,t.stateNode.containerInfo),ve(t,$A,A.memoizedState.cache),ci();break;case 27:case 5:Lt(t);break;case 4:vA(t,t.stateNode.containerInfo);break;case 10:ve(t,t.type,t.memoizedProps.value);break;case 13:var a=t.memoizedState;if(a!==null)return a.dehydrated!==null?(Se(t),t.flags|=128,null):(e&t.child.childLanes)!==0?lf(A,t,e):(Se(t),A=le(A,t,e),A!==null?A.sibling:null);Se(t);break;case 19:var i=(A.flags&128)!==0;if(a=(e&t.childLanes)!==0,a||(si(A,t,e,!1),a=(e&t.childLanes)!==0),i){if(a)return uf(A,t,e);t.flags|=128}if(i=t.memoizedState,i!==null&&(i.rendering=null,i.tail=null,i.lastEffect=null),N(FA,FA.current),a)break;return null;case 22:case 23:return t.lanes=0,Af(A,t,e);case 24:ve(t,$A,A.memoizedState.cache)}return le(A,t,e)}function sf(A,t,e){if(A!==null)if(A.memoizedProps!==t.pendingProps)At=!0;else{if(!Rc(A,e)&&(t.flags&128)===0)return At=!1,Od(A,t,e);At=(A.flags&131072)!==0}else At=!1,dA&&(t.flags&1048576)!==0&&Hs(t,fn,t.index);switch(t.lanes=0,t.tag){case 16:A:{A=t.pendingProps;var a=t.elementType,i=a._init;if(a=i(a._payload),t.type=a,typeof a=="function")Ll(a)?(A=Pe(a,A),t.tag=1,t=af(null,t,a,A,e)):(t.tag=0,t=Tc(null,t,a,A,e));else{if(a!=null){if(i=a.$$typeof,i===WA){t.tag=11,t=Wo(null,t,a,A,e);break A}else if(i===_A){t.tag=14,t=Po(null,t,a,A,e);break A}}throw t=wA(a)||a,Error(s(306,t,""))}}return t;case 0:return Tc(A,t,t.type,t.pendingProps,e);case 1:return a=t.type,i=Pe(a,t.pendingProps),af(A,t,a,i,e);case 3:A:{if(vA(t,t.stateNode.containerInfo),A===null)throw Error(s(387));a=t.pendingProps;var n=t.memoizedState;i=n.element,tc(A,t),gi(t,a,null,e);var l=t.memoizedState;if(a=l.cache,ve(t,$A,a),a!==n.cache&&$l(t,[$A],e,!0),mi(),a=l.element,n.isDehydrated)if(n={element:a,isDehydrated:!1,cache:l.cache},t.updateQueue.baseState=n,t.memoizedState=n,t.flags&256){t=nf(A,t,a,e);break A}else if(a!==i){i=wt(Error(s(424)),t),ui(i),t=nf(A,t,a,e);break A}else{switch(A=t.stateNode.containerInfo,A.nodeType){case 9:A=A.body;break;default:A=A.nodeName==="HTML"?A.ownerDocument.body:A}for(BA=Yt(A.firstChild),ot=t,dA=!0,Ze=null,Xt=!0,e=Yo(t,null,a,e),t.child=e;e;)e.flags=e.flags&-3|4096,e=e.sibling}else{if(ci(),a===i){t=le(A,t,e);break A}at(A,t,a,e)}t=t.child}return t;case 26:return Mn(A,t),A===null?(e=pr(t.type,null,t.pendingProps,null))?t.memoizedState=e:dA||(e=t.type,A=t.pendingProps,a=Zn(k.current).createElement(e),a[lt]=t,a[dt]=A,nt(a,e,A),IA(a),t.stateNode=a):t.memoizedState=pr(t.type,A.memoizedProps,t.pendingProps,A.memoizedState),null;case 27:return Lt(t),A===null&&dA&&(a=t.stateNode=or(t.type,t.pendingProps,k.current),ot=t,Xt=!0,i=BA,Re(t.type)?(ru=i,BA=Yt(a.firstChild)):BA=i),at(A,t,t.pendingProps.children,e),Mn(A,t),A===null&&(t.flags|=4194304),t.child;case 5:return A===null&&dA&&((i=a=BA)&&(a=Am(a,t.type,t.pendingProps,Xt),a!==null?(t.stateNode=a,ot=t,BA=Yt(a.firstChild),Xt=!1,i=!0):i=!1),i||Ve(t)),Lt(t),i=t.type,n=t.pendingProps,l=A!==null?A.memoizedProps:null,a=n.children,uu(i,n)?a=null:l!==null&&uu(i,l)&&(t.flags|=32),t.memoizedState!==null&&(i=cc(A,t,hd,null,null,e),Bi._currentValue=i),Mn(A,t),at(A,t,a,e),t.child;case 6:return A===null&&dA&&((A=e=BA)&&(e=tm(e,t.pendingProps,Xt),e!==null?(t.stateNode=e,ot=t,BA=null,A=!0):A=!1),A||Ve(t)),null;case 13:return lf(A,t,e);case 4:return vA(t,t.stateNode.containerInfo),a=t.pendingProps,A===null?t.child=wa(t,null,a,e):at(A,t,a,e),t.child;case 11:return Wo(A,t,t.type,t.pendingProps,e);case 7:return at(A,t,t.pendingProps,e),t.child;case 8:return at(A,t,t.pendingProps.children,e),t.child;case 12:return at(A,t,t.pendingProps.children,e),t.child;case 10:return a=t.pendingProps,ve(t,t.type,a.value),at(A,t,a.children,e),t.child;case 9:return i=t.type._context,a=t.pendingProps.children,$e(t),i=ct(i),a=a(i),t.flags|=1,at(A,t,a,e),t.child;case 14:return Po(A,t,t.type,t.pendingProps,e);case 15:return Io(A,t,t.type,t.pendingProps,e);case 19:return uf(A,t,e);case 31:return a=t.pendingProps,e=t.mode,a={mode:a.mode,children:a.children},A===null?(e=Rn(a,e),e.ref=t.ref,t.child=e,e.return=t,t=e):(e=It(A.child,a),e.ref=t.ref,t.child=e,e.return=t,t=e),t;case 22:return Af(A,t,e);case 24:return $e(t),a=ct($A),A===null?(i=Pl(),i===null&&(i=OA,n=Fl(),i.pooledCache=n,n.refCount++,n!==null&&(i.pooledCacheLanes|=e),i=n),t.memoizedState={parent:a,cache:i},Ac(t),ve(t,$A,i)):((A.lanes&e)!==0&&(tc(A,t),gi(t,null,null,e),mi()),i=A.memoizedState,n=t.memoizedState,i.parent!==a?(i={parent:a,cache:a},t.memoizedState=i,t.lanes===0&&(t.memoizedState=t.updateQueue.baseState=i),ve(t,$A,a)):(a=n.cache,ve(t,$A,a),a!==i.cache&&$l(t,[$A],e,!0))),at(A,t,t.pendingProps.children,e),t.child;case 29:throw t.pendingProps}throw Error(s(156,t.tag))}function ce(A){A.flags|=4}function of(A,t){if(t.type!=="stylesheet"||(t.state.loading&4)!==0)A.flags&=-16777217;else if(A.flags|=16777216,!hr(t)){if(t=Nt.current,t!==null&&((uA&4194048)===uA?kt!==null:(uA&62914560)!==uA&&(uA&536870912)===0||t!==kt))throw pi=Il,Ks;A.flags|=8192}}function Nn(A,t){t!==null&&(A.flags|=4),A.flags&16384&&(t=A.tag!==22?Yu():536870912,A.lanes|=t,Na|=t)}function zi(A,t){if(!dA)switch(A.tailMode){case"hidden":t=A.tail;for(var e=null;t!==null;)t.alternate!==null&&(e=t),t=t.sibling;e===null?A.tail=null:e.sibling=null;break;case"collapsed":e=A.tail;for(var a=null;e!==null;)e.alternate!==null&&(a=e),e=e.sibling;a===null?t||A.tail===null?A.tail=null:A.tail.sibling=null:a.sibling=null}}function NA(A){var t=A.alternate!==null&&A.alternate.child===A.child,e=0,a=0;if(t)for(var i=A.child;i!==null;)e|=i.lanes|i.childLanes,a|=i.subtreeFlags&65011712,a|=i.flags&65011712,i.return=A,i=i.sibling;else for(i=A.child;i!==null;)e|=i.lanes|i.childLanes,a|=i.subtreeFlags,a|=i.flags,i.return=A,i=i.sibling;return A.subtreeFlags|=a,A.childLanes=e,t}function Dd(A,t,e){var a=t.pendingProps;switch(Kl(t),t.tag){case 31:case 16:case 15:case 0:case 11:case 7:case 8:case 12:case 9:case 14:return NA(t),null;case 1:return NA(t),null;case 3:return e=t.stateNode,a=null,A!==null&&(a=A.memoizedState.cache),t.memoizedState.cache!==a&&(t.flags|=2048),ae($A),VA(),e.pendingContext&&(e.context=e.pendingContext,e.pendingContext=null),(A===null||A.child===null)&&(li(t)?ce(t):A===null||A.memoizedState.isDehydrated&&(t.flags&256)===0||(t.flags|=1024,Ys())),NA(t),null;case 26:return e=t.memoizedState,A===null?(ce(t),e!==null?(NA(t),of(t,e)):(NA(t),t.flags&=-16777217)):e?e!==A.memoizedState?(ce(t),NA(t),of(t,e)):(NA(t),t.flags&=-16777217):(A.memoizedProps!==a&&ce(t),NA(t),t.flags&=-16777217),null;case 27:qt(t),e=k.current;var i=t.type;if(A!==null&&t.stateNode!=null)A.memoizedProps!==a&&ce(t);else{if(!a){if(t.stateNode===null)throw Error(s(166));return NA(t),null}A=G.current,li(t)?Bs(t):(A=or(i,a,e),t.stateNode=A,ce(t))}return NA(t),null;case 5:if(qt(t),e=t.type,A!==null&&t.stateNode!=null)A.memoizedProps!==a&&ce(t);else{if(!a){if(t.stateNode===null)throw Error(s(166));return NA(t),null}if(A=G.current,li(t))Bs(t);else{switch(i=Zn(k.current),A){case 1:A=i.createElementNS("http://www.w3.org/2000/svg",e);break;case 2:A=i.createElementNS("http://www.w3.org/1998/Math/MathML",e);break;default:switch(e){case"svg":A=i.createElementNS("http://www.w3.org/2000/svg",e);break;case"math":A=i.createElementNS("http://www.w3.org/1998/Math/MathML",e);break;case"script":A=i.createElement("div"),A.innerHTML=" + + + +
+ + diff --git a/floss/qs/db/expert.py b/floss/qs/db/expert.py index 738720f98..7769160da 100644 --- a/floss/qs/db/expert.py +++ b/floss/qs/db/expert.py @@ -82,8 +82,17 @@ def from_file(cls, path: pathlib.Path) -> "ExpertStringDatabase": ) -DEFAULT_PATHS = (pathlib.Path(floss.qs.db.__file__).parent / "data" / "expert" / "capa.jsonl",) +DEFAULT_PATHS = ( + pathlib.Path(floss.qs.db.__file__).parent / "data" / "expert" / "capa.jsonl", + pathlib.Path(floss.qs.db.__file__).parent / "data" / "expert" / "user.jsonl", +) +def create_user_db(): + user_json = pathlib.Path(floss.qs.db.__file__).parent / "data" / "expert" / "user.jsonl" + if not user_json.exists(): + user_json.parent.mkdir(parents=True, exist_ok=True) + user_json.write_text("") def get_default_databases() -> Sequence[ExpertStringDatabase]: + create_user_db() return [ExpertStringDatabase.from_file(path) for path in DEFAULT_PATHS] diff --git a/floss/qs/main.py b/floss/qs/main.py index ac3ba2e68..fae4a6199 100644 --- a/floss/qs/main.py +++ b/floss/qs/main.py @@ -8,6 +8,7 @@ import hashlib import logging import pathlib +import msgspec import argparse import datetime import functools @@ -24,6 +25,7 @@ from rich.text import Text from rich.style import Style from rich.console import Console +from elftools.elf.elffile import ELFFile import floss.main import floss.qs.db.gp @@ -39,6 +41,17 @@ QS_VERSION = "0.1.0" +KNOWN_TAGS = { + "#code", + "#code-junk", + "#common", + "#duplicate", + "#reloc", + "#winapi", + "#decoded", + "#capa" +} +USER_DB_PATH = pathlib.Path(floss.qs.db.__file__).parent / "data" / "expert" / "user.jsonl" @contextlib.contextmanager @@ -474,6 +487,22 @@ def get_reloc_offsets(slice: Slice, pe: pefile.PE) -> Set[int]: return ret +def get_reloc_offsets(slice: Slice, elf: ELFFile) -> Set[int]: + ret: Set[int] = set() + for section in elf.iter_sections(): + if section.name.startswith('.rel'): + if hasattr(section, 'iter_relocations'): + for relocation in section.iter_relocations(): + offset = relocation['r_offset'] + for segment in elf.iter_segments(): + if segment['p_type'] == 'PT_LOAD': + if segment['p_vaddr'] <= offset < segment['p_vaddr'] + segment['p_memsz']: + file_offset = offset - segment['p_vaddr'] + segment['p_offset'] + if 0 <= file_offset < len(slice.data): + ret.add(file_offset) + break + + return ret def check_is_xor(xor_key: int | None): if isinstance(xor_key, int): @@ -644,6 +673,100 @@ def collect_pe_structures(slice: Slice, pe: pefile.PE) -> Sequence[Structure]: return structures +def get_elf_structure_name(section_name: str, sh_type: int) -> str: + """ELF section types found from here: https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html""" + + # convert sh_type to integer if string + if isinstance(sh_type, str): + # map string constants to integers + sh_type_map = { + 'SHT_NULL': 0, + 'SHT_PROGBITS': 1, + 'SHT_SYMTAB': 2, + 'SHT_STRTAB': 3, + 'SHT_RELA': 4, + 'SHT_HASH': 5, + 'SHT_DYNAMIC': 6, + 'SHT_NOTE': 7, + 'SHT_NOBITS': 8, + 'SHT_REL': 9, + 'SHT_SHLIB': 10, + 'SHT_DYNSYM': 11, + 'SHT_INIT_ARRAY': 14, + 'SHT_FINI_ARRAY': 15, + 'SHT_PREINIT_ARRAY': 16, + 'SHT_GROUP': 17, + 'SHT_SYMTAB_SHNDX': 18, + 'SHT_LOOS': 0x60000000, + 'SHT_HIOS': 0x6fffffff, + 'SHT_LOPROC': 0x70000000, + 'SHT_HIPROC': 0x7fffffff, + 'SHT_LOUSER': 0x80000000, + 'SHT_HIUSER': 0x8fffffff, + } + sh_type = sh_type_map.get(sh_type, 0) # default to SHT_NULL if unknown + + if section_name.startswith('.dynsym') or section_name.startswith('.dynstr'): + return "import table" + elif section_name.startswith('.plt') or section_name.startswith('.got'): + return "import table" + + elif sh_type == 2: + return "symbol table" + elif sh_type == 3: + return "string table" + elif sh_type == 11: + return "import table" + + elif sh_type == 4 or sh_type == 9: + return "relocation table" + + elif sh_type == 6: + return "dynamic table" + + elif sh_type == 7: + return "note section" + + elif sh_type == 5: + return "hash table" + + elif sh_type in (14, 15, 16): + return "constructor/destructor table" + + elif 0x60000000 <= sh_type <= 0x6fffffff: + return "OS-specific section" + + elif 0x70000000 <= sh_type <= 0x7fffffff: + return "processor-specific section" + + elif 0x80000000 <= sh_type <= 0x8fffffff: + return "application-specific section" + + return "" + + +def collect_elf_structures(slice: Slice, elf: ELFFile) -> Sequence[Structure]: + structures = [] + logger = logging.getLogger(__name__) + + for section in elf.iter_sections(): + offset = section['sh_offset'] + size = section['sh_size'] + sh_type = section['sh_type'] + + # skip SHT_NULL + if sh_type == 0 or size == 0: + continue + + structure_name = get_elf_structure_name(section.name, sh_type) + + structures.append( + Structure( + slice=slice.slice(offset, size), + name=structure_name, + ) + ) + return structures class Layout(BaseModel, abc.ABC): """ @@ -843,6 +966,43 @@ def mark_structures(self, structures=(), **kwargs): # which is fine - but we don't expect it to know about the PE structures. child.mark_structures(structures=structures, **kwargs) +class ELFLayout(Layout): + # xor key if the file was xor decoded + xor_key: Optional[int] + + # file offsets of bytes that are part of the relocation table + reloc_offsets: Set[int] + + # file offsets of bytes that are recognized as code + code_offsets: Set[int] + + structures_by_address: Dict[int, Structure] + + def tag_strings(self, taggers: Sequence[Tagger]): + def check_is_xor_tagger(s: ExtractedString) -> Sequence[Tag]: + return check_is_xor(self.xor_key) + + def check_is_reloc_tagger(s: ExtractedString) -> Sequence[Tag]: + return check_is_reloc(self.reloc_offsets, s) + + def check_is_code_tagger(s: ExtractedString) -> Sequence[Tag]: + return check_is_code(self.code_offsets, s) + + taggers = tuple(taggers) + ( + check_is_xor_tagger, + check_is_reloc_tagger, + check_is_code_tagger, + ) + + super().tag_strings(taggers) + + def mark_structures(self, structures=(), **kwargs): + for child in self.children: + if isinstance(child, (SectionLayout, SegmentLayout)): + child.mark_structures(structures=structures + (self.structures_by_address,), **kwargs) + else: + child.mark_structures(structures=structures, **kwargs) + class ResourceLayout(Layout): pass @@ -1041,6 +1201,95 @@ def collect_pe_resources(dir_data: pefile.ResourceDirData, path: Tuple[str, ...] return layout +def compute_elf_layout(slice: Slice, xor_key: int | None) -> Layout: + data = slice.data + + try: + elf = ELFFile(io.BytesIO(data)) + except Exception as e: + raise ValueError("pyelftools failed to load workspace") from e + + structures = collect_elf_structures(slice, elf) + reloc_offsets = get_reloc_offsets(slice, elf) + + structures_by_address = {} + for structure in structures: + for offset in structure.slice.range: + structures_by_address[offset] = structure + + code_offsets = set() + + layout = ELFLayout( + slice=slice, + name="elf", + xor_key=xor_key, + reloc_offsets=reloc_offsets, + code_offsets=code_offsets, + structures_by_address=structures_by_address, + ) + + if xor_key: + layout.name += f" (XOR decoded with key: 0x{xor_key:x})" + + for section in elf.iter_sections(): + if section['sh_size'] == 0: + continue + + try: + name = section.name + except UnicodeDecodeError: + name = "(invalid)" + + offset = section['sh_offset'] + size = section['sh_size'] + + if offset > slice.range.end: + logger.warning("section %s out of range", name) + continue + + if offset + size > slice.range.length: + size_orig = size + size = slice.range.length - offset + assert size >= 0 + logger.warning("section size %s out of range, truncating from 0x%x to 0x%x bytes", name, size_orig, size) + + layout.add_child(SegmentLayout(slice=slice.slice(offset, size), name=name)) + + offset = 0 + size = layout.children[0].offset - slice.range.offset + layout.add_child( + SegmentLayout( + slice=slice.slice(offset, size), + name="header", + ) + ) + + last_section: Layout = layout.children[-1] + if last_section.end < layout.end: + offset = last_section.end - layout.offset + size = layout.end - last_section.end + layout.add_child( + SegmentLayout( + slice=slice.slice(offset, size), + name="overlay", + ) + ) + + for i in range(1, len(layout.children)): + prior: Layout = layout.children[i - 1] + current: Layout = layout.children[i] + + if prior.end != current.offset: + offset = prior.end + size = current.offset - prior.end + layout.add_child( + SegmentLayout( + slice=slice.slice(offset, size), + name="gap", + ) + ) + + return layout def xor_static(data: bytes, i: int) -> bytes: return bytes(c ^ i for c in data) @@ -1082,6 +1331,14 @@ def compute_layout(slice: Slice) -> Layout: # Fall back to using the default binary layout pass + # Try to parse as ELF file + elif decoded_slice.data.startswith(b"\x7fELF"): + try: + return compute_elf_layout(decoded_slice, xor_key) + except Exception as e: + logger.debug("failed to parse as ELF file: %s", e) + pass + return SegmentLayout( slice=slice, name="binary", @@ -1318,6 +1575,50 @@ def render_string_line(console: Console, tag_rules: TagRules, string: ResultStri console.print(footer) +def add_to_user_db(path: str, note: str, author: str, reference: str): + with open(path, 'r', encoding='utf-8') as f: + data = json.loads(f.read()) + strings = collect_strings_with_unknown_tags(data["layout"]) + floss.qs.db.expert.create_user_db() + new_entries = [] + for s in strings: + unknown_tags = s.get("unknown_tags", []) + if not unknown_tags: + continue + for tag in unknown_tags: + new_string = { + "type": "string", + "value": s["string"], + "tag": tag, + "action": "highlight", + "note": note, + "description": "", + "authors": [author] if author else [], + "references": [r.strip() for r in reference.split(',')] if reference else [] + } + new_entries.append(msgspec.json.encode(new_string).decode('utf-8')) + + if new_entries: + with open(USER_DB_PATH, 'a', encoding='utf-8') as user_db: + user_db.write('\n'.join(new_entries) + '\n') + +def collect_strings_with_unknown_tags(node, results = None): + if results is None: + results = [] + if "strings" in node and node["strings"]: + for s in node["strings"]: + tags = s.get("tags", []) + unknown_tags = [t for t in tags if t not in KNOWN_TAGS] + if unknown_tags: + results.append({ + "string": s["string"], + "unknown_tags": unknown_tags + }) + if "children" in node: + for child in node["children"]: + collect_strings_with_unknown_tags(child, results) + return results + def main(): # set environment variable NO_COLOR=1 to disable color output. # set environment variable FORCE_COLOR=1 to force color output, such as when piping to a pager. @@ -1328,7 +1629,7 @@ def main(): version=f"%(prog)s {QS_VERSION}", help="show program's version number and exit", ) - parser.add_argument("path", help="file or path to analyze") + parser.add_argument("path", nargs="?", help="file or path to analyze") parser.add_argument( "-n", "--minimum-length", @@ -1339,6 +1640,10 @@ def main(): ) parser.add_argument("-j", "--json", action="store_true", help="emit JSON instead of text") parser.add_argument("-l", "--load", action="store_true", help="load from existing FLOSS QUANTUMSTRAND results document") + parser.add_argument("--json-out", help="path to write layout to as JSON") + parser.add_argument("--json-in", help="path to read layout from as JSON") + + parser.add_argument("--expand", "-e", nargs="?", const=True, help="add strings to database") logging_group = parser.add_argument_group("logging arguments") logging_group.add_argument("-d", "--debug", action="store_true", help="enable debugging output on STDERR") @@ -1348,6 +1653,7 @@ def main(): action="store_true", help="disable all status output except fatal errors", ) + args = parser.parse_args() floss.main.set_log_config(args.debug, args.quiet) @@ -1367,18 +1673,49 @@ def main(): sys.stdout.reconfigure(encoding="utf-8") colorama.just_fix_windows_console() - path = pathlib.Path(args.path) - if not path.exists(): - logging.error("%s does not exist", path) - return 1 - - if args.load: - with path.open("r") as f: - results = ResultDocument.model_validate_json(f.read()) - else: - with path.open("rb") as f: - # because we store all the strings in memory - # in order to tag and reason about them + if args.expand: + if args.expand is True: + if not args.path: + parser.error("--expand without a value requires a path argument") + expand_path = pathlib.Path(args.path) + else: + expand_path = pathlib.Path(args.expand) + + if not expand_path.exists(): + logging.error("%s does not exist", expand_path) + return 1 + + note = input("A note for these strings: ") + author = input("Author: ") + reference = input("Reference: ") + add_to_user_db(str(expand_path), note, author, reference) + return 0 + elif args.load: + if args.path: + load_path = pathlib.Path(args.path) + elif args.json_in: + load_path = pathlib.Path(args.json_in) + else: + parser.error("--load requires either a path argument or --json-in option") + + if not load_path.exists(): + logging.error("%s does not exist", load_path) + return 1 + + with load_path.open("r") as f: + results = ResultDocument.model_validate_json(f.read()) + else: + if not args.path: + parser.error("path argument is required for analysis") + + path = pathlib.Path(args.path) + if not path.exists(): + logging.error("%s does not exist", path) + return 1 + + with path.open("rb") as f: + # because we store all the strings in memory + # in order to tag and reason about them # then our input file must be reasonably sized # so we just load it directly into memory. # no need to mmap or play any games. @@ -1420,6 +1757,12 @@ def main(): ) results = ResultDocument.from_qs(meta, layout) + # Output handling - works for both load and analysis modes + if args.json_out: + with pathlib.Path(args.json_out).open("w") as f: + f.write(results.model_dump_json(indent=2)) + logger.info("Wrote layout to %s", args.json_out) + if args.json: print(results.model_dump_json(indent=0)) else: @@ -1431,9 +1774,10 @@ def main(): "#reloc": "hide", # lib strings are muted (default) } + # hide (remove) strings according to the above rules hide_strings_by_rules(results.layout, tag_rules) - + console = Console() render_strings(console, results.layout, tag_rules) diff --git a/package-lock.json b/package-lock.json new file mode 100644 index 000000000..ff7ff1eb1 --- /dev/null +++ b/package-lock.json @@ -0,0 +1,6 @@ +{ + "name": "flare-floss", + "lockfileVersion": 3, + "requires": true, + "packages": {} +} diff --git a/qs-viewer/package-lock.json b/qs-viewer/package-lock.json index e9806344b..f90fe995b 100644 --- a/qs-viewer/package-lock.json +++ b/qs-viewer/package-lock.json @@ -3012,6 +3012,7 @@ "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz", "integrity": "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ==", "dev": true, + "license": "Apache-2.0", "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" diff --git a/qs-viewer/src/App.css b/qs-viewer/src/App.css index 3d6959408..b330c10eb 100644 --- a/qs-viewer/src/App.css +++ b/qs-viewer/src/App.css @@ -3,14 +3,15 @@ body { background-color: #f5f5f5; color: #333; margin: 0; - padding: 15px; + padding: min(1vw, 15px); + font-size: min(14px, 1rem); } .App { display: flex; flex-direction: column; - height: 100vh; - max-width: 1200px; + height: calc(100vh - 2 * min(1vw, 15px)); + max-width: min(1200px, 90vw); margin: 0 auto; background-color: #fff; border-radius: 8px; @@ -18,35 +19,36 @@ body { } .controls { - padding: 20px; + padding: min(1.5vw, 20px); border-bottom: 1px solid #eee; flex-shrink: 0; + max-height: 60vh; + overflow-y: auto; } .results-container { flex-grow: 1; overflow-y: auto; - padding: 20px; -} - -.file-upload-area { - /* margin is now handled by app-header */ + padding: min(1.5vw, 20px); } .app-header { display: flex; justify-content: space-between; align-items: center; - margin-bottom: 20px; + margin-bottom: min(1.5vw, 20px); + flex-wrap: wrap; + gap: min(1vw, 10px); } .app-header-buttons { display: flex; - gap: 10px; + gap: min(1vw, 10px); + flex-wrap: wrap; } .app-title { - font-size: 1.5em; + font-size: clamp(1.2em, 2vw, 1.5em); margin: 0; } @@ -71,13 +73,13 @@ body { .metadata { border: 1px solid #eee; border-radius: 4px; - padding: 15px; - margin-bottom: 20px; + padding: min(1.2vw, 15px); + margin-bottom: min(1.5vw, 20px); background-color: #f9f9f9; } .metadata p { margin: 0 0 5px 0; - font-size: 0.9em; + font-size: clamp(0.9em, 1.4vw, 1em); } .metadata p:last-child { margin-bottom: 0; @@ -136,9 +138,14 @@ body { margin-top: 15px; } -.copy-button { - background-color: #28a745; - color: white; +.actions-buttons { + display: flex; + align-items: center; + gap: 10px; +} + +.copy-button, +.mass-tag-button { border: none; border-radius: 4px; padding: 8px 12px; @@ -147,10 +154,24 @@ body { font-family: 'Menlo', 'Consolas', monospace; } +.copy-button { + background-color: #28a745; + color: white; +} + .copy-button:hover { background-color: #218838; } +.mass-tag-button { + background-color: #007bff; + color: white; +} + +.mass-tag-button:hover { + background-color: #0056b3; +} + .tag-actions { display: flex; gap: 15px; @@ -179,14 +200,16 @@ body { .filters-container { display: flex; - gap: 30px; - margin-top: 20px; - padding-top: 15px; + gap: min(2vw, 30px); + margin-top: min(1.5vw, 20px); + padding-top: min(1.2vw, 15px); border-top: 1px solid #eee; + flex-wrap: wrap; } .filter-group { flex: 1; + min-width: 250px; } .filter-group-header { @@ -233,6 +256,64 @@ body { justify-content: space-between; padding: 4px 0; border-bottom: 1px dotted #eee; + align-items: center; +} + +.string-select { + margin-right: 8px; + flex-shrink: 0; + cursor: pointer; +} + +.tags-section { + display: flex; + align-items: center; + position: relative; + min-width: 200px; + flex-shrink: 0; +} + +.tags-section:hover .add-tag-button { + opacity: 1; +} + +.add-tag-button { + width: 18px; + height: 18px; + border: 1px solid #007bff; + background-color: #007bff; + color: white; + border-radius: 50%; + font-size: 12px; + cursor: pointer; + opacity: 0; + transition: opacity 0.2s; + display: flex; + align-items: center; + justify-content: center; + padding: 0; + line-height: 1; + margin-right: 8px; + flex-shrink: 0; +} + +.add-tag-button:hover { + background-color: #0056b3; +} + +.tag-input { + margin-right: 8px; + padding: 2px 6px; + border: 1px solid #007bff; + border-radius: 3px; + font-size: 11px; + width: 80px; + font-family: 'Menlo', 'Consolas', monospace; +} + +.tag-input:focus { + outline: none; + border-color: #0056b3; } .string-view:last-child { @@ -257,9 +338,11 @@ body { } .string-tags { - width: 20ch; flex-shrink: 0; color: #808080; + display: flex; + align-items: center; + flex-wrap: nowrap; } .string-encoding { @@ -285,3 +368,167 @@ body { color: #0056b3; padding-left: 2px; } + +/* High DPI and zoom scaling adjustments */ +@media screen and (min-resolution: 120dpi), + screen and (min-device-pixel-ratio: 1.25) { + body { + font-size: 13px; + } + + .controls { + padding: 15px; + max-height: 50vh; + } + + .app-title { + font-size: 1.3em; + } + + .metadata { + padding: 12px; + margin-bottom: 15px; + } + + .filters-container { + margin-top: 15px; + padding-top: 12px; + gap: 20px; + } +} + +@media screen and (min-resolution: 144dpi), + screen and (min-device-pixel-ratio: 1.5) { + body { + font-size: 12px; + padding: 10px; + } + + .controls { + padding: 12px; + max-height: 45vh; + } + + .app-title { + font-size: 1.2em; + } + + .metadata { + padding: 10px; + margin-bottom: 12px; + } + + .filters-container { + margin-top: 12px; + padding-top: 10px; + gap: 15px; + } +} + +/* Modal Styles */ +.modal-overlay { + position: fixed; + top: 0; + left: 0; + right: 0; + bottom: 0; + background-color: rgba(0, 0, 0, 0.5); + display: flex; + align-items: center; + justify-content: center; + z-index: 1000; + backdrop-filter: blur(2px); +} + +.modal-content { + background: white; + border-radius: 8px; + padding: 24px; + min-width: 400px; + max-width: 500px; + position: relative; + box-shadow: 0 4px 12px rgba(0, 0, 0, 0.3); +} + +.modal-close { + position: absolute; + top: 12px; + right: 12px; + background: none; + border: none; + font-size: 24px; + cursor: pointer; + color: #666; + width: 32px; + height: 32px; + display: flex; + align-items: center; + justify-content: center; + border-radius: 4px; +} + +.modal-close:hover { + background-color: #f0f0f0; + color: #333; +} + +.modal-content h3 { + margin: 0 0 8px 0; + font-size: 18px; + color: #333; +} + +.modal-content p { + margin: 0 0 16px 0; + color: #666; + font-size: 14px; +} + +.modal-input { + width: 100%; + padding: 12px; + border: 1px solid #ccc; + border-radius: 4px; + font-size: 14px; + font-family: 'Menlo', 'Consolas', monospace; + margin-bottom: 20px; + box-sizing: border-box; +} + +.modal-input:focus { + outline: none; + border-color: #007bff; +} + +.modal-buttons { + display: flex; + gap: 12px; + justify-content: flex-end; +} + +.modal-button { + padding: 10px 16px; + border: none; + border-radius: 4px; + cursor: pointer; + font-size: 14px; + font-family: 'Menlo', 'Consolas', monospace; +} + +.modal-button-primary { + background-color: #007bff; + color: white; +} + +.modal-button-primary:hover { + background-color: #0056b3; +} + +.modal-button-secondary { + background-color: #6c757d; + color: white; +} + +.modal-button-secondary:hover { + background-color: #545b62; +} diff --git a/qs-viewer/src/App.tsx b/qs-viewer/src/App.tsx index d0fa73d83..e60635515 100644 --- a/qs-viewer/src/App.tsx +++ b/qs-viewer/src/App.tsx @@ -8,16 +8,48 @@ interface DisplayOptions { showTags: boolean; showEncoding: boolean; showOffsetAndStructure: boolean; + showSelection: boolean; } -const StringItem: React.FC<{ str: ResultString; displayOptions: DisplayOptions }> = ({ str, displayOptions }) => { +const StringItem: React.FC<{ + str: ResultString; + displayOptions: DisplayOptions; + onAddTag: (offset: number, tag: string) => void; + isSelected: boolean; + onToggleSelect: (offset: number) => void; +}> = ({ str, displayOptions, onAddTag, isSelected, onToggleSelect }) => { + const [showTagInput, setShowTagInput] = useState(false); + const [newTag, setNewTag] = useState(''); + const getStyleClass = () => { const { tags } = str; - if (tags.includes('#capa')) return 'highlight'; + const systemTags = ['#code', '#code-junk', '#common', '#duplicate', '#reloc', '#winapi', '#decoded']; + const highlightTags = tags.some(tag => !systemTags.includes(tag)); + + if (highlightTags) return 'highlight'; if (tags.includes('#common') || tags.includes('#duplicate')) return 'mute'; return ''; }; + const handleAddTag = () => { + if (newTag.trim()) { + const formattedTag = newTag.trim().startsWith('#') ? newTag.trim() : `#${newTag.trim()}`; + onAddTag(str.offset, formattedTag); + setNewTag(''); + setShowTagInput(false); + } + }; + + const handleKeyPress = (e: React.KeyboardEvent) => { + if (e.key === 'Enter') { + e.preventDefault(); + handleAddTag(); + } else if (e.key === 'Escape') { + setShowTagInput(false); + setNewTag(''); + } + }; + const styleClass = getStyleClass(); const offsetHex = str.offset.toString(16).padStart(8, '0'); @@ -27,8 +59,41 @@ const StringItem: React.FC<{ str: ResultString; displayOptions: DisplayOptions } return (
- {str.string} - {displayOptions.showTags && {str.tags.join(' ')}} + {displayOptions.showSelection && ( + onToggleSelect(str.offset)} + /> + )} + {JSON.stringify(str.string).slice(1, -1)} + {displayOptions.showTags && ( +
+ + + {showTagInput && ( + setNewTag(e.target.value)} + onKeyDown={handleKeyPress} + onBlur={() => setShowTagInput(false)} + placeholder="Enter tag..." + autoFocus + /> + )} + {str.tags.join(' ')} + +
+ )} {displayOptions.showEncoding && {str.encoding === 'unicode' ? 'U' : ''}} {displayOptions.showOffsetAndStructure && ( @@ -41,16 +106,36 @@ const StringItem: React.FC<{ str: ResultString; displayOptions: DisplayOptions } ); }; -const Layout: React.FC<{ layout: ResultLayout; displayOptions: DisplayOptions }> = ({ layout, displayOptions }) => { +const Layout: React.FC<{ + layout: ResultLayout; + displayOptions: DisplayOptions; + onAddTag: (offset: number, tag: string) => void; + selectedStrings: Set; + onToggleSelect: (offset: number) => void; +}> = ({ layout, displayOptions, onAddTag, selectedStrings, onToggleSelect }) => { return (
{layout.name}
{layout.strings.map((str, index) => ( - + ))} {layout.children.map((child, index) => ( - + ))}
@@ -69,8 +154,12 @@ const App: React.FC = () => { showTags: true, showEncoding: true, showOffsetAndStructure: true, + showSelection: false, }); const [copyFeedback, setCopyFeedback] = useState(''); + const [selectedStrings, setSelectedStrings] = useState>(new Set()); + const [showMassTagModal, setShowMassTagModal] = useState(false); + const [massTagInput, setMassTagInput] = useState(''); const processData = (jsonData: ResultDocument) => { setData(jsonData); @@ -232,6 +321,111 @@ const App: React.FC = () => { processData(previewData as ResultDocument); }; + const handleAddTag = (offset: number, tag: string) => { + if (!data) return; + + // Create a deep copy of the data to modify + const updatedData = JSON.parse(JSON.stringify(data)); + + // Find and update the string with the specified offset + const updateLayout = (layout: ResultLayout): boolean => { + for (let i = 0; i < layout.strings.length; i++) { + if (layout.strings[i].offset === offset) { + if (!layout.strings[i].tags.includes(tag)) { + layout.strings[i].tags.push(tag); + } + return true; + } + } + for (const child of layout.children) { + if (updateLayout(child)) { + return true; + } + } + return false; + }; + + updateLayout(updatedData.layout); + setData(updatedData); + + // Add the new tag to selectedTags if it's not already there + setSelectedTags(prev => { + if (!prev.includes(tag)) { + return [...prev, tag]; + } + return prev; + }); + }; + + const handleToggleSelect = (offset: number) => { + setSelectedStrings(prev => { + const newSet = new Set(prev); + if (newSet.has(offset)) { + newSet.delete(offset); + } else { + newSet.add(offset); + } + return newSet; + }); + }; + + const handleMassTag = () => { + if (selectedStrings.size > 0) { + setShowMassTagModal(true); + } + }; + + const handleMassTagSubmit = () => { + if (!data || !massTagInput.trim()) return; + + const formattedTag = massTagInput.trim().startsWith('#') ? massTagInput.trim() : `#${massTagInput.trim()}`; + const updatedData = JSON.parse(JSON.stringify(data)); + + let taggedCount = 0; + const updateLayout = (layout: ResultLayout): void => { + for (let i = 0; i < layout.strings.length; i++) { + if (selectedStrings.has(layout.strings[i].offset)) { + if (!layout.strings[i].tags.includes(formattedTag)) { + layout.strings[i].tags.push(formattedTag); + taggedCount++; + } + } + } + for (const child of layout.children) { + updateLayout(child); + } + }; + + updateLayout(updatedData.layout); + setData(updatedData); + + // Add the new tag to selectedTags if it's not already there + setSelectedTags(prev => { + if (!prev.includes(formattedTag)) { + return [...prev, formattedTag]; + } + return prev; + }); + + setMassTagInput(''); + setShowMassTagModal(false); + setSelectedStrings(new Set()); + }; + + const handleMassTagCancel = () => { + setMassTagInput(''); + setShowMassTagModal(false); + }; + + const handleMassTagKeyPress = (e: React.KeyboardEvent) => { + if (e.key === 'Enter') { + e.preventDefault(); + handleMassTagSubmit(); + } else if (e.key === 'Escape') { + handleMassTagCancel(); + } + }; + const filteredLayout = useMemo(() => { if (!data) return null; @@ -306,6 +500,25 @@ const App: React.FC = () => { }); }; + const handleExportJSON = () => { + if (!data) return; + + const jsonString = JSON.stringify(data, null, 2); + const blob = new Blob([jsonString], { type: 'application/json' }); + const url = URL.createObjectURL(blob); + + const link = document.createElement('a'); + link.href = url; + link.download = `${data.meta.sample.path.split(/[\\/]/).pop() || 'exported'}_tagged.json`; + document.body.appendChild(link); + link.click(); + document.body.removeChild(link); + URL.revokeObjectURL(url); + + setCopyFeedback('Exported!'); + setTimeout(() => setCopyFeedback(''), 2000); + }; + return (
@@ -392,6 +605,9 @@ const App: React.FC = () => {
Show Columns
+ @@ -428,8 +644,15 @@ const App: React.FC = () => {
Showing {visibleStringCount} of {tagInfo.totalStringCount} strings + {selectedStrings.size > 0 && ` (${selectedStrings.size} selected)`}
-
+
+ {selectedStrings.size > 0 && ( + + )} + {copyFeedback && {copyFeedback}}
@@ -441,11 +664,44 @@ const App: React.FC = () => { {!data ? (
Drop a JSON file or use the upload button to get started.
) : filteredLayout ? ( - + ) : (
No strings found matching your search and tag filters.
)}
+ + {showMassTagModal && ( +
+
e.stopPropagation()}> + +

Add Tag to Selected Strings

+

Adding tag to {selectedStrings.size} selected string{selectedStrings.size !== 1 ? 's' : ''}

+ setMassTagInput(e.target.value)} + onKeyDown={handleMassTagKeyPress} + placeholder="Enter tag name..." + autoFocus + /> +
+ + +
+
+
+ )}
); }; diff --git a/qs-viewer/src/pma0303_qs.json b/qs-viewer/src/pma0303_qs.json new file mode 100644 index 000000000..cae044707 --- /dev/null +++ b/qs-viewer/src/pma0303_qs.json @@ -0,0 +1,3976 @@ +{ + "meta": { + "version": "0.0.1", + "timestamp": "2025-07-11T15:02:41.906544", + "sample": { + "md5": "e2bf42217a67e46433da8b6f4507219e", + "sha1": "daf263702f11dc0430d30f9bf443e7885cf91fcb", + "sha256": "ae8a1c7eb64c42ea2a04f97523ebf0844c27029eb040d910048b680f884b9dce", + "path": "pma0303.exe_" + }, + "min_str_len": 6 + }, + "layout": { + "name": "pe", + "offset": 0, + "length": 53248, + "strings": [], + "children": [ + { + "name": "header", + "offset": 0, + "length": 4096, + "strings": [ + { + "string": "!This program cannot be run in DOS mode.", + "offset": 77, + "size": 40, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "`.rdata", + "offset": 511, + "size": 7, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "section header" + }, + { + "string": "@.data", + "offset": 551, + "size": 6, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "section header" + } + ], + "children": [] + }, + { + "name": ".text", + "offset": 4096, + "length": 12288, + "strings": [ + { + "string": "YYh P@", + "offset": 7361, + "size": 6, + "encoding": "ascii", + "tags": [ + "#code" + ], + "structure": "" + }, + { + "string": "SS@SSPVSS", + "offset": 8725, + "size": 9, + "encoding": "ascii", + "tags": [ + "#code", + "#common" + ], + "structure": "" + }, + { + "string": "t#SSUP", + "offset": 8759, + "size": 6, + "encoding": "ascii", + "tags": [ + "#code", + "#common" + ], + "structure": "" + }, + { + "string": "t$$VSS", + "offset": 8766, + "size": 6, + "encoding": "ascii", + "tags": [ + "#code", + "#common" + ], + "structure": "" + }, + { + "string": "_^][YY", + "offset": 8890, + "size": 6, + "encoding": "ascii", + "tags": [ + "#code", + "#code-junk", + "#common" + ], + "structure": "" + }, + { + "string": "DSUVWh", + "offset": 8899, + "size": 6, + "encoding": "ascii", + "tags": [ + "#code", + "#common" + ], + "structure": "" + }, + { + "string": "t.;t$$t(", + "offset": 9492, + "size": 8, + "encoding": "ascii", + "tags": [ + "#code", + "#common" + ], + "structure": "" + }, + { + "string": "VC20XC00U", + "offset": 9624, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + } + ], + "children": [] + }, + { + "name": ".rdata", + "offset": 16384, + "length": 4096, + "strings": [ + { + "string": "runtime error ", + "offset": 16620, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "TLOSS error", + "offset": 16640, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "SING error", + "offset": 16656, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "DOMAIN error", + "offset": 16672, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- unable to initialize heap", + "offset": 16695, + "size": 27, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- not enough space for lowio initialization", + "offset": 16735, + "size": 43, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- not enough space for stdio initialization", + "offset": 16791, + "size": 43, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- pure virtual function call", + "offset": 16847, + "size": 28, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- not enough space for _onexit/atexit table", + "offset": 16887, + "size": 43, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- unable to open console device", + "offset": 16943, + "size": 31, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- unexpected heap error", + "offset": 16987, + "size": 23, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- unexpected multithread lock error", + "offset": 17023, + "size": 35, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- not enough space for thread data", + "offset": 17071, + "size": 34, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "abnormal program termination", + "offset": 17110, + "size": 28, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- not enough space for environment", + "offset": 17151, + "size": 34, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- not enough space for arguments", + "offset": 17195, + "size": 32, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "- floating point not loaded", + "offset": 17239, + "size": 27, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "Microsoft Visual C++ Runtime Library", + "offset": 17272, + "size": 36, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "Runtime Error!", + "offset": 17316, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "Program: ", + "offset": 17332, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "", + "offset": 17348, + "size": 22, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "GetLastActivePopup", + "offset": 17372, + "size": 18, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "" + }, + { + "string": "GetActiveWindow", + "offset": 17392, + "size": 15, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "" + }, + { + "string": "MessageBoxA", + "offset": 17408, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "" + }, + { + "string": "user32.dll", + "offset": 17420, + "size": 10, + "encoding": "ascii", + "tags": [ + "#capa", + "#common", + "#winapi" + ], + "structure": "" + }, + { + "string": "CloseHandle", + "offset": 17738, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "VirtualFree", + "offset": 17752, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "ReadFile", + "offset": 17766, + "size": 8, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "VirtualAlloc", + "offset": 17778, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetFileSize", + "offset": 17794, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "CreateFileA", + "offset": 17808, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "ResumeThread", + "offset": 17822, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "SetThreadContext", + "offset": 17838, + "size": 16, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "WriteProcessMemory", + "offset": 17858, + "size": 18, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "VirtualAllocEx", + "offset": 17880, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetProcAddress", + "offset": 17898, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetModuleHandleA", + "offset": 17916, + "size": 16, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "ReadProcessMemory", + "offset": 17936, + "size": 17, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetThreadContext", + "offset": 17956, + "size": 16, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "CreateProcessA", + "offset": 17976, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FreeResource", + "offset": 17994, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "SizeofResource", + "offset": 18010, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LockResource", + "offset": 18028, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LoadResource", + "offset": 18044, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FindResourceA", + "offset": 18060, + "size": 13, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetSystemDirectoryA", + "offset": 18076, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "KERNEL32.dll", + "offset": 18104, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetCommandLineA", + "offset": 18120, + "size": 15, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetVersion", + "offset": 18138, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "ExitProcess", + "offset": 18152, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "TerminateProcess", + "offset": 18166, + "size": 16, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetCurrentProcess", + "offset": 18186, + "size": 17, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "UnhandledExceptionFilter", + "offset": 18206, + "size": 24, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetModuleFileNameA", + "offset": 18234, + "size": 18, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FreeEnvironmentStringsA", + "offset": 18256, + "size": 23, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FreeEnvironmentStringsW", + "offset": 18282, + "size": 23, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "WideCharToMultiByte", + "offset": 18308, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetEnvironmentStrings", + "offset": 18330, + "size": 21, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetEnvironmentStringsW", + "offset": 18354, + "size": 22, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "SetHandleCount", + "offset": 18380, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStdHandle", + "offset": 18398, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetFileType", + "offset": 18414, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStartupInfoA", + "offset": 18428, + "size": 15, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapDestroy", + "offset": 18446, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapCreate", + "offset": 18460, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapFree", + "offset": 18474, + "size": 8, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "RtlUnwind", + "offset": 18486, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "WriteFile", + "offset": 18498, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapAlloc", + "offset": 18510, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetCPInfo", + "offset": 18522, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetACP", + "offset": 18534, + "size": 6, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetOEMCP", + "offset": 18544, + "size": 8, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapReAlloc", + "offset": 18556, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LoadLibraryA", + "offset": 18570, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "MultiByteToWideChar", + "offset": 18586, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LCMapStringA", + "offset": 18608, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LCMapStringW", + "offset": 18624, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStringTypeA", + "offset": 18640, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStringTypeW", + "offset": 18658, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "import table" + } + ], + "children": [] + }, + { + "name": ".data", + "offset": 20480, + "length": 4096, + "strings": [ + { + "string": "\\svchost.exe", + "offset": 20528, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "NtUnmapViewOfSection", + "offset": 20544, + "size": 20, + "encoding": "ascii", + "tags": [ + "#common", + "#winapi" + ], + "structure": "" + }, + { + "string": "ntdll.dll", + "offset": 20568, + "size": 9, + "encoding": "ascii", + "tags": [ + "#capa", + "#common", + "#winapi" + ], + "structure": "" + }, + { + "string": "UNICODE", + "offset": 20580, + "size": 7, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "LOCALIZATION", + "offset": 20588, + "size": 12, + "encoding": "ascii", + "tags": [], + "structure": "" + } + ], + "children": [] + }, + { + "name": ".rsrc", + "offset": 24576, + "length": 28672, + "strings": [ + { + "string": "UNICODE", + "offset": 24666, + "size": 14, + "encoding": "unicode", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "LOCALIZATION", + "offset": 24682, + "size": 24, + "encoding": "unicode", + "tags": [], + "structure": "" + } + ], + "children": [ + { + "name": "rsrc: UNICODE/LOCALIZATION/0", + "offset": 24708, + "length": 24576, + "strings": [ + { + "string": "UNICODE", + "offset": 24666, + "size": 14, + "encoding": "unicode", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "LOCALIZATION", + "offset": 24682, + "size": 24, + "encoding": "unicode", + "tags": [], + "structure": "" + }, + { + "string": "ABAAAEAAA", + "offset": 24711, + "size": 9, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAA", + "offset": 24725, + "size": 7, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", + "offset": 24733, + "size": 35, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": ")(2a13.&3 ,a\" //.5a#$a34/a(/a", + "offset": 24787, + "size": 29, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "a,.%$oLLKeAAAAAAAV", + "offset": 24819, + "size": 18, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAAAAAAAAAAAA", + "offset": 24908, + "size": 24, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAA", + "offset": 24944, + "size": 8, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "AN@J@GAAqAAAqAAAAAA", + "offset": 24953, + "size": 19, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "VAAAQAAA", + "offset": 24973, + "size": 8, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAQAAAQAAEAAAAAAAEAAAAAAAA1AAAQAAAAAABAAAAAQAAQAAAAQAAQAAAAAAQAAAAAAAAAAAm", + "offset": 24987, + "size": 74, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AA}AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", + "offset": 25062, + "size": 87, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAAAAAAAAAAAAAAAo5$95AAAwlAAAQAAAqAAAQAAAAAAAAAAAAAAaAA!o3% 5 AA", + "offset": 25153, + "size": 75, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAQAAA", + "offset": 25234, + "size": 7, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAA", + "offset": 25242, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "o% 5 AAA=QAAA", + "offset": 25260, + "size": 13, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAQAAA", + "offset": 25274, + "size": 7, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAA", + "offset": 25282, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#duplicate" + ], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", + "offset": 25300, + "size": 3504, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "A)AEAA+@)", + "offset": 28856, + "size": 9, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "+A+A+A+A", + "offset": 28904, + "size": 8, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "NAA+A", + "offset": 35186, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "MLAA+A", + "offset": 35222, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "BAAA4U", + "offset": 35494, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "BAAA4e", + "offset": 35878, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAQA3F", + "offset": 36372, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "A4Hx_", + "offset": 38926, + "size": 8, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "BAAA4U", + "offset": 39526, + "size": 6, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "BAAA4e", + "offset": 39910, + "size": 6, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "AQAAlAQAA", + "offset": 40338, + "size": 9, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "@|AQAA2", + "offset": 40348, + "size": 7, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAq", + "offset": 40377, + "size": 716, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AA#\tAA", + "offset": 41114, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "\tAAm\tAA]\tAAK\tAA", + "offset": 41125, + "size": 15, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AA5\tAAAAAAU", + "offset": 41246, + "size": 11, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAA", + "offset": 41286, + "size": 6, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "A34/5(,$a$33.3aAALKAA", + "offset": 41303, + "size": 21, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "a$33.3LKAAA", + "offset": 41329, + "size": 11, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "a$33.3LKAAAA", + "offset": 41344, + "size": 12, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "a$33.3LKAA", + "offset": 41362, + "size": 10, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqsyLKla4/ #-$a5.a(/(5( -(;$a)$ 1LKAAAA", + "offset": 41373, + "size": 39, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqsvLKla/.5a$/.4&)a21 \"$a'.3a-.6(.a(/(5( -(; 5(./LKAAAA", + "offset": 41413, + "size": 55, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqswLKla/.5a$/.4&)a21 \"$a'.3a25%(.a(/(5( -(; 5(./LKAAAA", + "offset": 41469, + "size": 55, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqstLKla143$a7(354 -a'4/\"5(./a\" --LKAAA", + "offset": 41525, + "size": 39, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqsuLKla/.5a$/.4&)a21 \"$a'.3a", + "offset": 41565, + "size": 29, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "./$9(5n 5$9(5a5 #-$LKAAAA", + "offset": 41595, + "size": 25, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqpxLKla4/ #-$a5.a.1$/a\"./2.-$a%$7(\"$LKAAAA", + "offset": 41621, + "size": 43, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqpyLKla4/$91$\"5$%a)$ 1a$33.3LKAAAA", + "offset": 41665, + "size": 35, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqpvLKla4/$91$\"5$%a,4-5(5)3$ %a-.\"*a$33.3LKAAAA", + "offset": 41701, + "size": 47, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqpwLKla/.5a$/.4&)a21 \"$a'.3a5)3$ %a% 5 LKALK #/.3, -a13.&3 ,a5$3,(/ 5(./LKAAAA", + "offset": 41749, + "size": 79, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqqxLKla/.5a$/.4&)a21 \"$a'.3a$/7(3./,$/5LKA", + "offset": 41829, + "size": 43, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqqyLKla/.5a$/.4&)a21 \"$a'.3a 3&4,$/52LKAAA", + "offset": 41873, + "size": 43, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "wqqsLKla'-. 5(/&a1.(/5a/.5a-. %$%LKAAAA", + "offset": 41917, + "size": 39, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(\"3.2.'5a", + "offset": 41957, + "size": 9, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(24 -a", + "offset": 41967, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "4/5(,$a", + "offset": 41978, + "size": 7, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(#3 38AAAAKKAA", + "offset": 41986, + "size": 14, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "4/5(,$a", + "offset": 42001, + "size": 7, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "33.3`KK", + "offset": 42009, + "size": 7, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "3.&3 ,{aAAAoooA}13.&3 ,a/ ,$a4/*/.6/", + "offset": 42017, + "size": 36, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": ".141AA", + "offset": 42070, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(/%.6A", + "offset": 42086, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "$22 &$", + "offset": 42093, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "A42$3rso%--AAAAAAAAAA", + "offset": 42103, + "size": 21, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAAAA", + "offset": 42162, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common" + ], + "structure": "" + }, + { + "string": "AAAAAAAAAAk", + "offset": 42182, + "size": 11, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AAAAAAAAAAAAAAAAAAAAAAq", + "offset": 42198, + "size": 23, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "AA#\tAA", + "offset": 42242, + "size": 6, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "\tAAm\tAA]\tAAK\tAA", + "offset": 42253, + "size": 15, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "AA5\tAAAAAAU", + "offset": 42374, + "size": 11, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "AAAAAAg@", + "offset": 42414, + "size": 8, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": ".%4-$\t /%-$", + "offset": 42426, + "size": 11, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "./2.-$AAZA", + "offset": 42448, + "size": 10, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "-.2$\t /%-$A", + "offset": 42459, + "size": 11, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(-$A+C", + "offset": 42478, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": ".(/5$3AAuA", + "offset": 42492, + "size": 10, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "rso%--AA", + "offset": 42520, + "size": 8, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(/%.62\t..*", + "offset": 42537, + "size": 10, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "$22 &$", + "offset": 42556, + "size": 6, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "(/%.62\t..*", + "offset": 42570, + "size": 10, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "(/%.6AA", + "offset": 42591, + "size": 7, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "$95\t..*", + "offset": 42619, + "size": 7, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": ".3$&3.4/%", + "offset": 42654, + "size": 9, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "(/%.6A", + "offset": 42664, + "size": 6, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": "rso%--AA", + "offset": 42674, + "size": 8, + "encoding": "ascii", + "tags": [ + "#duplicate" + ], + "structure": "" + }, + { + "string": ".,, /%", + "offset": 42688, + "size": 6, + "encoding": "ascii", + "tags": [], + "structure": "" + }, + { + "string": "$32(./AA", + "offset": 17324, + "size": 22, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded" + ], + "structure": "" + }, + { + "string": "GetLastActivePopup", + "offset": 17348, + "size": 18, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "" + }, + { + "string": "GetActiveWindow", + "offset": 17368, + "size": 15, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "" + }, + { + "string": "MessageBoxA", + "offset": 17384, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "" + }, + { + "string": "user32.dll", + "offset": 17396, + "size": 10, + "encoding": "ascii", + "tags": [ + "#capa", + "#common", + "#decoded", + "#winapi" + ], + "structure": "" + }, + { + "string": "GetModuleHandleA", + "offset": 17714, + "size": 16, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "AllocConsole", + "offset": 17734, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "CloseHandle", + "offset": 17750, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "WriteFile", + "offset": 17764, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "SetFilePointer", + "offset": 17776, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "CreateFileA", + "offset": 17794, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "KERNEL32.dll", + "offset": 17806, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "UnhookWindowsHookEx", + "offset": 17822, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetMessageA", + "offset": 17844, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "SetWindowsHookExA", + "offset": 17858, + "size": 17, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "ShowWindow", + "offset": 17878, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FindWindowA", + "offset": 17892, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "CallNextHookEx", + "offset": 17906, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetWindowTextA", + "offset": 17924, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetForegroundWindow", + "offset": 17942, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "USER32.dll", + "offset": 17962, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetCommandLineA", + "offset": 17976, + "size": 15, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetVersion", + "offset": 17994, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "ExitProcess", + "offset": 18008, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "TerminateProcess", + "offset": 18022, + "size": 16, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetCurrentProcess", + "offset": 18042, + "size": 17, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "UnhandledExceptionFilter", + "offset": 18062, + "size": 24, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetModuleFileNameA", + "offset": 18090, + "size": 18, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FreeEnvironmentStringsA", + "offset": 18112, + "size": 23, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "FreeEnvironmentStringsW", + "offset": 18138, + "size": 23, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "WideCharToMultiByte", + "offset": 18164, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetEnvironmentStrings", + "offset": 18186, + "size": 21, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetEnvironmentStringsW", + "offset": 18210, + "size": 22, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "SetHandleCount", + "offset": 18236, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStdHandle", + "offset": 18254, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetFileType", + "offset": 18270, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStartupInfoA", + "offset": 18284, + "size": 15, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapDestroy", + "offset": 18302, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapCreate", + "offset": 18316, + "size": 10, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "VirtualFree", + "offset": 18330, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapFree", + "offset": 18344, + "size": 8, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "RtlUnwind", + "offset": 18356, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapAlloc", + "offset": 18368, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetCPInfo", + "offset": 18380, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetACP", + "offset": 18392, + "size": 6, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetOEMCP", + "offset": 18402, + "size": 8, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "VirtualAlloc", + "offset": 18414, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "HeapReAlloc", + "offset": 18430, + "size": 11, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetProcAddress", + "offset": 18444, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LoadLibraryA", + "offset": 18462, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "MultiByteToWideChar", + "offset": 18478, + "size": 19, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LCMapStringA", + "offset": 18500, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "LCMapStringW", + "offset": 18516, + "size": 12, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStringTypeA", + "offset": 18532, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + }, + { + "string": "GetStringTypeW", + "offset": 18550, + "size": 14, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded", + "#winapi" + ], + "structure": "import table" + } + ], + "children": [] + }, + { + "name": ".data", + "offset": 20480, + "length": 4096, + "strings": [ + { + "string": "[Window: ", + "offset": 20530, + "size": 9, + "encoding": "ascii", + "tags": [ + "#decoded" + ], + "structure": "" + }, + { + "string": "ConsoleWindowClass", + "offset": 20544, + "size": 18, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded" + ], + "structure": "" + }, + { + "string": "practicalmalwareanalysis.log", + "offset": 20564, + "size": 28, + "encoding": "ascii", + "tags": [ + "#decoded" + ], + "structure": "" + }, + { + "string": "[SHIFT]", + "offset": 20600, + "size": 7, + "encoding": "ascii", + "tags": [ + "#decoded" + ], + "structure": "" + }, + { + "string": "[ENTER]", + "offset": 20609, + "size": 7, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded" + ], + "structure": "" + }, + { + "string": "[BACKSPACE]", + "offset": 20620, + "size": 11, + "encoding": "ascii", + "tags": [ + "#decoded" + ], + "structure": "" + }, + { + "string": "BACKSPACE", + "offset": 20632, + "size": 9, + "encoding": "ascii", + "tags": [ + "#common", + "#decoded" + ], + "structure": "" + }, + { + "string": "[CTRL]", + "offset": 20652, + "size": 6, + "encoding": "ascii", + "tags": [ + "#decoded" + ], + "structure": "" + }, + { + "string": "[CAPS LOCK]", + "offset": 20708, + "size": 11, + "encoding": "ascii", + "tags": [ + "#decoded" + ], + "structure": "" + }, + { + "string": "[CAPS LOCK]", + "offset": 20720, + "size": 11, + "encoding": "ascii", + "tags": [ + "#decoded", + "#duplicate" + ], + "structure": "" + } + ], + "children": [] + } + ] + } + ] + } + ] + } + ] + } +} diff --git a/requirements.txt b/requirements.txt index bbeb12e48..b58054ec2 100644 --- a/requirements.txt +++ b/requirements.txt @@ -58,3 +58,4 @@ types-tabulate==0.9.0.20240106 virtualenv==20.30.0 viv-utils==0.8.0 vivisect==1.2.1 +python-lancelot==0.8.10