From 334b3bfb77f3ed856e085efd5e76488d1d24e59b Mon Sep 17 00:00:00 2001 From: dxl <64101226@qq.com> Date: Tue, 13 Oct 2020 14:26:40 +0800 Subject: [PATCH 001/125] fix text --- client/src/cmdlfem4x50.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c index 4e608cd42..fa4e2f765 100644 --- a/client/src/cmdlfem4x50.c +++ b/client/src/cmdlfem4x50.c @@ -16,7 +16,7 @@ #include "em4x50.h" static int usage_lf_em4x50_info(void) { - PrintAndLogEx(NORMAL, "Read all information of EM4x50. Tag nust be on antenna."); + PrintAndLogEx(NORMAL, "Read all information of EM4x50. Tag must be on antenna."); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Usage: lf em 4x50_info [h] [v] [p ]"); PrintAndLogEx(NORMAL, "Options:"); From 597e069c5001ba9b24e8e80c68e731e4534b98e8 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 11:54:38 +0200 Subject: [PATCH 002/125] remove HF ICLASS REPLAY, use HF ICLASS RDBL or HF ICLASS DUMP instead with option "n" --- armsrc/appmain.c | 17 ++-- armsrc/iclass.c | 141 ++++++---------------------- armsrc/iclass.h | 1 - client/src/cmdhficlass.c | 197 ++++++++++----------------------------- include/pm3_cmd.h | 2 +- 5 files changed, 86 insertions(+), 272 deletions(-) diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 9aa65de03..0b274f654 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -1512,20 +1512,19 @@ static void PacketReceived(PacketCommandNG *packet) { break; } case CMD_HF_ICLASS_SIMULATE: { - SimulateIClass(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes); - break; - } - case CMD_HF_ICLASS_READER: { - ReaderIClass(packet->oldarg[0]); - break; - } - case CMD_HF_ICLASS_REPLAY: { +/* struct p { uint8_t reader[4]; uint8_t mac[4]; } PACKED; struct p *payload = (struct p *) packet->data.asBytes; - ReaderIClass_Replay(payload->reader, payload->mac); +*/ + + SimulateIClass(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes); + break; + } + case CMD_HF_ICLASS_READER: { + ReaderIClass(packet->oldarg[0]); break; } case CMD_HF_ICLASS_EML_MEMSET: { diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 7f22b59cc..baaff65c5 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -1470,101 +1470,6 @@ void ReaderIClass(uint8_t flags) { switch_off(); } -// turn off afterwards -void ReaderIClass_Replay(uint8_t *rnr, uint8_t *mac) { - - BigBuf_free(); - - uint8_t check[] = { ICLASS_CMD_CHECK, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; - - memcpy(check + 1, rnr, 4); - memcpy(check + 5, mac, 4); - - uint8_t *card_data = BigBuf_malloc(ICLASS_16KS_SIZE); - if (card_data == NULL) { - DbpString("fail to allocate memory"); - reply_ng(CMD_HF_ICLASS_REPLAY, PM3_EMALLOC, NULL, 0); - return; - } - memset(card_data, 0xFF, ICLASS_16KS_SIZE); - - uint32_t start_time = 0; - uint32_t eof_time = 0; - - Iso15693InitReader(); - - picopass_hdr hdr = {0}; - bool res = select_iclass_tag((uint8_t *)&hdr, false, &eof_time); - if (res == false) { - reply_ng(CMD_HF_ICLASS_REPLAY, PM3_ETIMEOUT, NULL, 0); - switch_off(); - return; - } - - uint8_t resp[10] = {0}; - - //for now replay captured auth (as cc not updated) - start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; - res = iclass_send_cmd_with_retries(check, sizeof(check), resp, sizeof(resp), 4, 3, &start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); - if (res == false) { - reply_ng(CMD_HF_ICLASS_REPLAY, PM3_ETIMEOUT, NULL, 0); - switch_off(); - return; - } - - uint8_t mem = hdr.conf.mem_config; - uint8_t cardsize = ((mem & 0x80) == 0x80) ? 255 : 32; - - /* - static struct memory_t { - int k16; - int book; - int k2; - int lockauth; - int keyaccess; - } memory; - - // memory.k16 = ((mem & 0x80) == 0x80); - // memory.book = ((mem & 0x20) == 0x20); - // memory.k2 = ((mem & 0x08) == 0x08); - // memory.lockauth = ((mem & 0x02) == 0x02); - // memory.keyaccess = ((mem & 0x01) == 0x01); - // uint8_t cardsize = memory.k16 ? 255 : 32; - */ - - bool dumpsuccess = true; - - // main read loop - uint16_t i; - for (i = 0; i <= cardsize; i++) { - - uint8_t c[] = {ICLASS_CMD_READ_OR_IDENTIFY, i, 0x00, 0x00}; - AddCrc(c + 1, 1); - - res = iclass_send_cmd_with_retries(c, sizeof(c), resp, sizeof(resp), 10, 3, &start_time, ICLASS_READER_TIMEOUT_OTHERS, &eof_time); - if (res) { - memcpy(card_data + (8 * i), resp, 8); - } else { - Dbprintf("failed to read block %u ( 0x%02x)", i, i); - dumpsuccess = false; - } - } - - struct p { - bool isOK; - uint16_t block_cnt; - uint32_t bb_offset; - } PACKED response; - - response.isOK = dumpsuccess; - response.block_cnt = i; - response.bb_offset = card_data - BigBuf_get_addr(); - reply_ng(CMD_HF_ICLASS_REPLAY, PM3_SUCCESS, (uint8_t *)&response, sizeof(response)); - - BigBuf_free(); - switch_off(); -} - // used with function select_and_auth (cmdhficlass.c) // which needs to authenticate before doing more things like read/write // selects and authenticate to a card, sends back div_key and mac to client. @@ -1585,24 +1490,30 @@ bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint memcpy(ccnr, hdr->epurse, sizeof(hdr->epurse)); - if (payload->use_raw) - memcpy(div_key, payload->key, 8); - else - iclass_calc_div_key(hdr->csn, payload->key, div_key, payload->use_elite); + if ( payload->use_replay) { - if (payload->use_credit_key) - memcpy(hdr->key_c, div_key, sizeof(hdr->key_c)); - else - memcpy(hdr->key_d, div_key, sizeof(hdr->key_d)); + memcpy(pmac, payload->key + 4, 4); + memcpy(cmd_check + 1, payload->key, 8); - opt_doReaderMAC(ccnr, div_key, pmac); + } else { + if (payload->use_raw) + memcpy(div_key, payload->key, 8); + else + iclass_calc_div_key(hdr->csn, payload->key, div_key, payload->use_elite); - // copy MAC to check command (readersignature) - cmd_check[5] = pmac[0]; - cmd_check[6] = pmac[1]; - cmd_check[7] = pmac[2]; - cmd_check[8] = pmac[3]; + if (payload->use_credit_key) + memcpy(hdr->key_c, div_key, sizeof(hdr->key_c)); + else + memcpy(hdr->key_d, div_key, sizeof(hdr->key_d)); + opt_doReaderMAC(ccnr, div_key, pmac); + + // copy MAC to check command (readersignature) + cmd_check[5] = pmac[0]; + cmd_check[6] = pmac[1]; + cmd_check[7] = pmac[2]; + cmd_check[8] = pmac[3]; + } return iclass_send_cmd_with_retries(cmd_check, sizeof(cmd_check), resp_auth, sizeof(resp_auth), 4, 2, start_time, ICLASS_READER_TIMEOUT_OTHERS, eof_time); } @@ -1937,10 +1848,14 @@ void iClass_WriteBlock(uint8_t *msg) { wb[0] = payload->req.blockno; memcpy(wb + 1, payload->data, 8); - if (payload->req.use_credit_key) - doMAC_N(wb, sizeof(wb), hdr.key_c, mac); - else - doMAC_N(wb, sizeof(wb), hdr.key_d, mac); + if (payload->req.use_replay) { + doMAC_N(wb, sizeof(wb), payload->req.key + 4, mac); + } else { + if (payload->req.use_credit_key) + doMAC_N(wb, sizeof(wb), hdr.key_c, mac); + else + doMAC_N(wb, sizeof(wb), hdr.key_d, mac); + } memcpy(write + 2, payload->data, 8); // data memcpy(write + 10, mac, sizeof(mac)); // mac diff --git a/armsrc/iclass.h b/armsrc/iclass.h index 3776aa385..ec9ff7b15 100644 --- a/armsrc/iclass.h +++ b/armsrc/iclass.h @@ -17,7 +17,6 @@ void SniffIClass(uint8_t jam_search_len, uint8_t *jam_search_string); void ReaderIClass(uint8_t arg0); -void ReaderIClass_Replay(uint8_t *rnr, uint8_t *mac); void iClass_WriteBlock(uint8_t *msg); void iClass_Dump(uint8_t *msg); diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 28b710fe8..81bca140e 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -155,10 +155,11 @@ static int usage_hf_iclass_dump(void) { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h : Show this help"); PrintAndLogEx(NORMAL, " f : specify a filename to save dump to"); - PrintAndLogEx(NORMAL, " k : access Key as 16 hex symbols or 1 hex to select key from memory"); + PrintAndLogEx(NORMAL, " k : access Key as 16 hex symbols or 1 hex to select key from memory OR NR/MAC for replay"); PrintAndLogEx(NORMAL, " c : credit key as 16 hex symbols or 1 hex to select key from memory"); PrintAndLogEx(NORMAL, " e : elite computations applied to key"); PrintAndLogEx(NORMAL, " r : raw, the key is interpreted as raw block 3/4"); + PrintAndLogEx(NORMAL, " n : replay of NR/MAC"); PrintAndLogEx(NORMAL, " v : verbose output"); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(NORMAL, "Examples:"); @@ -195,10 +196,11 @@ static int usage_hf_iclass_writeblock(void) { PrintAndLogEx(NORMAL, " h : Show this help"); PrintAndLogEx(NORMAL, " b : The block number as 2 hex symbols"); PrintAndLogEx(NORMAL, " d : set the Data to write as 16 hex symbols"); - PrintAndLogEx(NORMAL, " k : access Key as 16 hex symbols or 1 hex to select key from memory"); + PrintAndLogEx(NORMAL, " k : access Key as 16 hex symbols or 1 hex to select key from memory OR NR/MAC for replay"); PrintAndLogEx(NORMAL, " c : credit key assumed\n"); PrintAndLogEx(NORMAL, " e : elite computations applied to key"); PrintAndLogEx(NORMAL, " r : raw, no computations applied to key (raw)"); +// PrintAndLogEx(NORMAL, " n : replay of NR/MAC"); PrintAndLogEx(NORMAL, " v : verbose output"); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, _YELLOW_("\thf iclass wrbl b 0A d AAAAAAAAAAAAAAAA k 001122334455667B")); @@ -213,10 +215,11 @@ static int usage_hf_iclass_readblock(void) { PrintAndLogEx(NORMAL, "Options:"); PrintAndLogEx(NORMAL, " h : Show this help"); PrintAndLogEx(NORMAL, " b : The block number as 2 hex symbols"); - PrintAndLogEx(NORMAL, " k : Access Key as 16 hex symbols or 1 hex to select key from memory"); + PrintAndLogEx(NORMAL, " k : access Key as 16 hex symbols or 1 hex to select key from memory OR NR/MAC for replay"); PrintAndLogEx(NORMAL, " c : credit key assumed\n"); PrintAndLogEx(NORMAL, " e : elite computations applied to key"); PrintAndLogEx(NORMAL, " r : raw, no computations applied to key"); + PrintAndLogEx(NORMAL, " n : replay of NR/MAC"); PrintAndLogEx(NORMAL, " v : verbose output"); PrintAndLogEx(NORMAL, "Examples:"); PrintAndLogEx(NORMAL, _YELLOW_("\thf iclass rdbl b 06 k 0011223344556677")); @@ -280,18 +283,6 @@ static int usage_hf_iclass_reader(void) { PrintAndLogEx(NORMAL, ""); return PM3_SUCCESS; } -static int usage_hf_iclass_replay(void) { - PrintAndLogEx(NORMAL, "Replay a collected mac message\n"); - PrintAndLogEx(NORMAL, "Usage: hf iclass replay [h] [m ]\n"); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h Show this help"); - PrintAndLogEx(NORMAL, " r Reader nonce bytes to replay (8 hexsymbols)"); - PrintAndLogEx(NORMAL, " m Mac bytes to replay (8 hexsymbols)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, _YELLOW_("\thf iclass replay r 00000000 m 89cb984b")); - PrintAndLogEx(NORMAL, ""); - return PM3_SUCCESS; -} static int usage_hf_iclass_loclass(void) { PrintAndLogEx(NORMAL, "Execute the offline part of loclass attack"); PrintAndLogEx(NORMAL, " An iclass dumpfile is assumed to consist of an arbitrary number of"); @@ -346,7 +337,6 @@ static int usage_hf_iclass_lookup(void) { return PM3_SUCCESS; } - static int cmp_uint32(const void *a, const void *b) { const iclass_prekey_t *x = (const iclass_prekey_t *)a; @@ -890,131 +880,6 @@ static int CmdHFiClassReader(const char *Cmd) { return read_iclass_csn(loop_read, true); } -static int CmdHFiClassReader_Replay(const char *Cmd) { - - struct { - uint8_t reader[4]; - uint8_t mac[4]; - } PACKED payload; - - - bool got_rnr, got_mac; - got_rnr = got_mac = false; - bool errors = false; - uint8_t cmdp = 0; - while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { - switch (tolower(param_getchar(Cmd, cmdp))) { - case 'h': { - return usage_hf_iclass_replay(); - } - case 'r': { - if (param_gethex(Cmd, cmdp + 1, payload.reader, 8)) { - PrintAndLogEx(FAILED, "Reader Nr must include 8 HEX symbols"); - errors = true; - } else { - got_rnr = true; - } - cmdp += 2; - break; - } - case 'm': { - if (param_gethex(Cmd, cmdp + 1, payload.mac, 8)) { - PrintAndLogEx(FAILED, "Reader MAC must include 8 HEX symbols"); - errors = true; - } else { - got_mac = true; - } - cmdp += 2; - break; - } - default: { - PrintAndLogEx(WARNING, "Unknown parameter '%c'", param_getchar(Cmd, cmdp)); - errors = true; - break; - } - } - } - - //Validations - if (errors || cmdp == 0) { - return usage_hf_iclass_replay(); - } - - if (got_rnr == false || got_mac == false) { - PrintAndLogEx(FAILED, "Reader Nr and MAC is needed"); - return PM3_EINVARG; - } - - PacketResponseNG resp; - clearCommandBuffer(); - SendCommandNG(CMD_HF_ICLASS_REPLAY, (uint8_t *)&payload, sizeof(payload)); - - while (true) { - PrintAndLogEx(NORMAL, "." NOLF); - - if (kbd_enter_pressed()) { - PrintAndLogEx(WARNING, "\naborted via keyboard!\n"); - DropField(); - return PM3_EOPABORTED; - } - - if (WaitForResponseTimeout(CMD_HF_ICLASS_REPLAY, &resp, 2000)) - break; - } - - PrintAndLogEx(NORMAL, ""); - if (resp.status != PM3_SUCCESS) { - PrintAndLogEx(ERR, "failed to communicate with card"); - return resp.status; - } - - struct p_resp { - bool isOK; - uint16_t block_cnt; - uint32_t bb_offset; - } PACKED; - struct p_resp *packet = (struct p_resp *)resp.data.asBytes; - - if (packet->isOK == false) { - PrintAndLogEx(WARNING, "replay reading blocks failed"); - return PM3_ESOFT; - } - - uint32_t startindex = packet->bb_offset; - uint32_t bytes_got = (packet->block_cnt * 8); - - uint8_t tag_data[0x100 * 8]; - memset(tag_data, 0xFF, sizeof(tag_data)); - - // response ok - now get bigbuf content of the dump - if (!GetFromDevice(BIG_BUF, tag_data, sizeof(tag_data), startindex, NULL, 0, NULL, 2500, false)) { - PrintAndLogEx(WARNING, "command execution time out"); - return PM3_ETIMEOUT; - } - - // print the dump - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "------+----+-------------------------+----------"); - PrintAndLogEx(INFO, " CSN |0x00| " _GREEN_("%s") "|", sprint_hex(tag_data, 8)); - printIclassDumpContents(tag_data, 1, (bytes_got / 8), bytes_got); - - // use CSN as filename - char filename[FILE_PATH_SIZE] = {0}; - strcat(filename, "hf-iclass-"); - FillFileNameByUID(filename, tag_data, "-dump", 8); - - // save the dump to .bin file - PrintAndLogEx(SUCCESS, "saving dump file - %u blocks read", bytes_got / 8); - saveFile(filename, ".bin", tag_data, bytes_got); - saveFileEML(filename, tag_data, bytes_got, 8); - saveFileJSON(filename, jsfIclass, tag_data, bytes_got, NULL); - - PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass decrypt") "` to decrypt dump file"); - PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass view") "` to view dump file"); - PrintAndLogEx(NORMAL, ""); - return PM3_SUCCESS; -} - static int CmdHFiClassELoad(const char *Cmd) { DumpFileType_t dftype = BIN; @@ -1271,7 +1136,6 @@ static int CmdHFiClassEView(const char *Cmd) { return PM3_SUCCESS; } - static int CmdHFiClassDecrypt(const char *Cmd) { bool errors = false; @@ -1665,6 +1529,7 @@ static int CmdHFiClassDump(const char *Cmd) { bool have_credit_key = false; bool elite = false; bool rawkey = false; + bool use_replay = false; bool errors = false; bool auth = false; uint8_t cmdp = 0; @@ -1732,12 +1597,23 @@ static int CmdHFiClassDump(const char *Cmd) { rawkey = true; cmdp++; break; + case 'n': + PrintAndLogEx(SUCCESS, "Using " _YELLOW_("replay NR/MAC mode")); + use_replay = true; + cmdp++; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; break; } } + + if ((use_replay + rawkey + elite) > 0) { + PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); + errors = true; + } + if (errors) return usage_hf_iclass_dump(); uint32_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE); @@ -1808,6 +1684,7 @@ static int CmdHFiClassDump(const char *Cmd) { .req.use_raw = rawkey, .req.use_elite = elite, .req.use_credit_key = false, + .req.use_replay = use_replay, .req.send_reply = true, .req.do_auth = auth, .end_block = app_limit1, @@ -1974,7 +1851,7 @@ write_dump: return PM3_SUCCESS; } -static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool verbose) { +static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool replay, bool verbose) { /* uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00}; uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; @@ -2017,6 +1894,7 @@ static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bo .req.use_raw = rawkey, .req.use_elite = elite, .req.use_credit_key = use_credit_key, + .req.use_replay = replay, .req.blockno = blockno, .req.send_reply = true, .req.do_auth = true, @@ -2052,6 +1930,7 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { bool use_credit_key = false; bool elite = false; bool rawkey = false; + bool use_replay = false; bool errors = false; bool verbose = false; uint8_t cmdp = 0; @@ -2105,6 +1984,13 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { rawkey = true; cmdp++; break; +/* + case 'n': + PrintAndLogEx(SUCCESS, "Using " _YELLOW_("replay NR/MAC mode")); + use_replay = true; + cmdp++; + break; +*/ case 'v': verbose = true; cmdp++; @@ -2118,9 +2004,14 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { if (got_blockno == false) errors = true; + if ((use_replay + rawkey + elite) > 0) { + PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); + errors = true; + } + if (errors || cmdp < 6) return usage_hf_iclass_writeblock(); - int isok = iclass_write_block(blockno, bldata, KEY, use_credit_key, elite, rawkey, verbose); + int isok = iclass_write_block(blockno, bldata, KEY, use_credit_key, elite, rawkey, use_replay, verbose); if (isok == PM3_SUCCESS) PrintAndLogEx(SUCCESS, "Wrote block %02X successful", blockno); else @@ -2337,12 +2228,13 @@ static int CmdHFiClassRestore(const char *Cmd) { return resp.status; } -static int iclass_read_block(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool verbose, bool auth, uint8_t *out) { +static int iclass_read_block(uint8_t *KEY, uint8_t blockno, uint8_t keyType, bool elite, bool rawkey, bool replay, bool verbose, bool auth, uint8_t *out) { iclass_auth_req_t payload = { .use_raw = rawkey, .use_elite = elite, .use_credit_key = (keyType == 0x18), + .use_replay = replay, .blockno = blockno, .send_reply = true, .do_auth = auth, @@ -2391,6 +2283,7 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { bool got_blockno = false; bool elite = false; bool rawkey = false; + bool use_replay = false; bool errors = false; bool auth = false; bool verbose = false; @@ -2439,6 +2332,11 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { rawkey = true; cmdp++; break; + case 'n': + PrintAndLogEx(SUCCESS, "Using " _YELLOW_("replay NR/MAC mode")); + use_replay = true; + cmdp++; + break; case 'v': verbose = true; cmdp++; @@ -2451,6 +2349,11 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { } if (got_blockno == false) errors = true; + + if ((use_replay + rawkey + elite) > 0) { + PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); + errors = true; + } if (errors) return usage_hf_iclass_readblock(); @@ -2467,7 +2370,7 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { } uint8_t data[8] = {0}; - int res = iclass_read_block(KEY, blockno, keyType, elite, rawkey, verbose, auth, data); + int res = iclass_read_block(KEY, blockno, keyType, elite, rawkey, use_replay, verbose, auth, data); if (res != PM3_SUCCESS) return res; @@ -3541,8 +3444,6 @@ static command_t CommandTable[] = { {"chk", CmdHFiClassCheckKeys, AlwaysAvailable, "[options..] Check keys"}, {"loclass", CmdHFiClass_loclass, AlwaysAvailable, "[options..] Use loclass to perform bruteforce reader attack"}, {"lookup", CmdHFiClassLookUp, AlwaysAvailable, "[options..] Uses authentication trace to check for key in dictionary file"}, - {"replay", CmdHFiClassReader_Replay, IfPm3Iclass, " Read Picopass / iCLASS tag via replay attack"}, - {"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("simulation") " ---------------------"}, {"sim", CmdHFiClassSim, IfPm3Iclass, "[options..] Simulate iCLASS tag"}, {"eload", CmdHFiClassELoad, IfPm3Iclass, "[f ] Load Picopass / iCLASS dump file into emulator memory"}, diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index 3bbedd9c7..141f51621 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -306,6 +306,7 @@ typedef struct { bool use_raw; bool use_elite; bool use_credit_key; + bool use_replay; bool send_reply; bool do_auth; uint8_t blockno; @@ -564,7 +565,6 @@ typedef struct { #define CMD_HF_ICLASS_SNIFF 0x0392 #define CMD_HF_ICLASS_SIMULATE 0x0393 #define CMD_HF_ICLASS_READER 0x0394 -#define CMD_HF_ICLASS_REPLAY 0x0395 #define CMD_HF_ICLASS_READBL 0x0396 #define CMD_HF_ICLASS_WRITEBL 0x0397 #define CMD_HF_ICLASS_EML_MEMSET 0x0398 From 57f52a5fdec698e2fbf59baec530497f84851059 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 11:56:14 +0200 Subject: [PATCH 003/125] text --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e5f00a78..d7bdfe891 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ All notable changes to this project will be documented in this file. This project uses the changelog in accordance with [keepchangelog](http://keepachangelog.com/). Please use this to write notable changes, which is not the same as git commit log... ## [unreleased][unreleased] + - Removed 'hf iclass replay' - use the 'hf iclass dump' or 'hf iclass rdbl' with option "n" instead (@iceman1001). Concept taken from official repo (@pwpiwi) - Add low level support for 14b' aka Innovatron (@doegox) - Add doc/cliparser.md (@mwalker33) - Add `hf 14b apdu` - send APDU over ISO14443B (@iceman1001) From 14fd9a54dfbb90e1f76d8eec730bcc469ef4199e Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 12:07:33 +0200 Subject: [PATCH 004/125] hf mf rdsc - use fcts instead --- client/src/cmdhfmf.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c index ead78d7e4..c723ea6aa 100644 --- a/client/src/cmdhfmf.c +++ b/client/src/cmdhfmf.c @@ -825,12 +825,9 @@ static int CmdHF14AMfRdSc(const char *Cmd) { PrintAndLogEx(NORMAL, "isOk:%02x", isOK); if (isOK) { - uint8_t blocks = 4; - uint8_t start = sectorNo * 4; - if (sectorNo >= 32) { - blocks = 16; - start = 128 + (sectorNo - 32) * 16; - } + uint8_t blocks = NumBlocksPerSector(sectorNo); + uint8_t start = FirstBlockOfSector(sectorNo); + for (int i = 0; i < blocks; i++) { PrintAndLogEx(NORMAL, "%3d | %s", start + i, sprint_hex(data + (i * 16), 16)); } From 125548a44ca368c57669db80f4e7a686fc734827 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 12:08:34 +0200 Subject: [PATCH 005/125] hf mf rdsc - use fcts instead --- client/src/cmdhfmf.c | 138 ++++++++++++++++++++++--------------------- 1 file changed, 70 insertions(+), 68 deletions(-) diff --git a/client/src/cmdhfmf.c b/client/src/cmdhfmf.c index c723ea6aa..599884120 100644 --- a/client/src/cmdhfmf.c +++ b/client/src/cmdhfmf.c @@ -627,6 +627,76 @@ static void decode_print_st(uint16_t blockno, uint8_t *data) { } } + +static uint16_t NumOfBlocks(char card) { + switch (card) { + case '0' : + return MIFARE_MINI_MAXBLOCK; + case '1' : + return MIFARE_1K_MAXBLOCK; + case '2' : + return MIFARE_2K_MAXBLOCK; + case '4' : + return MIFARE_4K_MAXBLOCK; + default : + return 0; + } +} + +static uint8_t NumOfSectors(char card) { + switch (card) { + case '0' : + return MIFARE_MINI_MAXSECTOR; + case '1' : + return MIFARE_1K_MAXSECTOR; + case '2' : + return MIFARE_2K_MAXSECTOR; + case '4' : + return MIFARE_4K_MAXSECTOR; + default : + return 0; + } +} + +static uint8_t FirstBlockOfSector(uint8_t sectorNo) { + if (sectorNo < 32) { + return sectorNo * 4; + } else { + return 32 * 4 + (sectorNo - 32) * 16; + } +} + +static uint8_t NumBlocksPerSector(uint8_t sectorNo) { + if (sectorNo < 32) { + return 4; + } else { + return 16; + } +} + +static uint8_t GetSectorFromBlockNo(uint8_t blockNo) { + if (blockNo < 128) + return blockNo / 4; + else + return 32 + ((128 - blockNo) / 16); +} + +static char GetFormatFromSector(uint8_t sectorNo) { + switch (sectorNo) { + case MIFARE_MINI_MAXSECTOR: + return '0'; + case MIFARE_1K_MAXSECTOR: + return '1'; + case MIFARE_2K_MAXSECTOR: + return '2'; + case MIFARE_4K_MAXSECTOR: + return '4'; + default : + return ' '; + } +} + + static int CmdHF14AMfDarkside(const char *Cmd) { uint8_t blockno = 0, key_type = MIFARE_AUTH_KEYA; uint64_t key = 0; @@ -840,74 +910,6 @@ static int CmdHF14AMfRdSc(const char *Cmd) { return PM3_SUCCESS; } -static uint16_t NumOfBlocks(char card) { - switch (card) { - case '0' : - return MIFARE_MINI_MAXBLOCK; - case '1' : - return MIFARE_1K_MAXBLOCK; - case '2' : - return MIFARE_2K_MAXBLOCK; - case '4' : - return MIFARE_4K_MAXBLOCK; - default : - return 0; - } -} - -static uint8_t NumOfSectors(char card) { - switch (card) { - case '0' : - return MIFARE_MINI_MAXSECTOR; - case '1' : - return MIFARE_1K_MAXSECTOR; - case '2' : - return MIFARE_2K_MAXSECTOR; - case '4' : - return MIFARE_4K_MAXSECTOR; - default : - return 0; - } -} - -static uint8_t FirstBlockOfSector(uint8_t sectorNo) { - if (sectorNo < 32) { - return sectorNo * 4; - } else { - return 32 * 4 + (sectorNo - 32) * 16; - } -} - -static uint8_t NumBlocksPerSector(uint8_t sectorNo) { - if (sectorNo < 32) { - return 4; - } else { - return 16; - } -} - -static uint8_t GetSectorFromBlockNo(uint8_t blockNo) { - if (blockNo < 128) - return blockNo / 4; - else - return 32 + ((128 - blockNo) / 16); -} - -static char GetFormatFromSector(uint8_t sectorNo) { - switch (sectorNo) { - case MIFARE_MINI_MAXSECTOR: - return '0'; - case MIFARE_1K_MAXSECTOR: - return '1'; - case MIFARE_2K_MAXSECTOR: - return '2'; - case MIFARE_4K_MAXSECTOR: - return '4'; - default : - return ' '; - } -} - static int FastDumpWithEcFill(uint8_t numsectors) { PacketResponseNG resp; From d8b2dc2ebfbe66e242bb23c0106ceb5ae7b96ced Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 14:00:03 +0200 Subject: [PATCH 006/125] enable tearoff for LF EM 4x50_WRITE & EM_WRITE_PASSWORD --- armsrc/em4x50.c | 90 +++++++++++++++++++++++++--------------- client/src/cmdlfem4x50.c | 12 +++--- 2 files changed, 63 insertions(+), 39 deletions(-) diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c index 3f0ad9b6b..bce422908 100644 --- a/armsrc/em4x50.c +++ b/armsrc/em4x50.c @@ -14,6 +14,7 @@ #include "lfadc.h" #include "commonutil.h" #include "em4x50.h" +#include "appmain.h" // tear // 4 data bytes // + byte with row parities @@ -470,6 +471,8 @@ static bool find_double_listen_window(bool bcommand) { if (bcommand) { +// SpinDelay(10); + // data transmission from card has to be stopped, because // a commamd shall be issued @@ -816,7 +819,7 @@ void em4x50_info(em4x50_data_t *etd) { status = (bsuccess << 1) + blogin; lf_finalize(); - reply_ng(CMD_ACK, status, (uint8_t *)tag.sectors, 238); + reply_ng(CMD_LF_EM4X50_INFO, status, (uint8_t *)tag.sectors, 238); } void em4x50_read(em4x50_data_t *etd) { @@ -860,14 +863,13 @@ void em4x50_read(em4x50_data_t *etd) { status = (now << 2) + (bsuccess << 1) + blogin; lf_finalize(); - reply_ng(CMD_ACK, status, (uint8_t *)tag.sectors, 238); + reply_ng(CMD_LF_EM4X50_READ, status, (uint8_t *)tag.sectors, 238); } //============================================================================== // write functions //============================================================================== - -static bool write(uint8_t word[4], uint8_t address) { +static int write(uint8_t word[4], uint8_t address) { // writes to specified
@@ -882,17 +884,23 @@ static bool write(uint8_t word[4], uint8_t address) { // send data em4x50_send_word(word); - // wait for T0 * EM4X50_T_TAG_TWA (write access time) - wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); + if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured + reply_ng(CMD_LF_EM4X50_WRITE, PM3_ETEAROFF, NULL, 0); + return PM3_ETEAROFF; + } else { - // look for ACK sequence - if (check_ack(false)) { + // wait for T0 * EM4X50_T_TAG_TWA (write access time) + wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); - // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time) - // for saving data and should return with ACK - if (check_ack(false)) - return true; + // look for ACK sequence + if (check_ack(false)) { + // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time) + // for saving data and should return with ACK + if (check_ack(false)) + return PM3_SUCCESS; + + } } } else { @@ -900,10 +908,10 @@ static bool write(uint8_t word[4], uint8_t address) { Dbprintf("error in command request"); } - return false; + return PM3_ESOFT; } -static bool write_password(uint8_t password[4], uint8_t new_password[4]) { +static int write_password(uint8_t password[4], uint8_t new_password[4]) { // changes password from to @@ -915,23 +923,29 @@ static bool write_password(uint8_t password[4], uint8_t new_password[4]) { // send address data em4x50_send_word(password); - // wait for T0 * EM4x50_T_TAG_TPP (processing pause time) - wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TPP); + if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured + reply_ng(CMD_LF_EM4X50_WRITE, PM3_ETEAROFF, NULL, 0); + return PM3_ETEAROFF; + } else { - // look for ACK sequence and send rm request - // during following listen window - if (check_ack(true)) { + // wait for T0 * EM4x50_T_TAG_TPP (processing pause time) + wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TPP); - // send new password - em4x50_send_word(new_password); + // look for ACK sequence and send rm request + // during following listen window + if (check_ack(true)) { - // wait for T0 * EM4X50_T_TAG_TWA (write access time) - wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); + // send new password + em4x50_send_word(new_password); + + // wait for T0 * EM4X50_T_TAG_TWA (write access time) + wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); - if (check_ack(false)) if (check_ack(false)) - return true; + if (check_ack(false)) + return PM3_SUCCESS; + } } } else { @@ -939,7 +953,7 @@ static bool write_password(uint8_t password[4], uint8_t new_password[4]) { Dbprintf("error in command request"); } - return false; + return PM3_ESOFT; } void em4x50_write(em4x50_data_t *etd) { @@ -966,8 +980,13 @@ void em4x50_write(em4x50_data_t *etd) { blogin = login(etd->password); // write word to given address - if (write(etd->word, etd->address)) { - + int res = write(etd->word, etd->address); + if (res == PM3_ETEAROFF) { + lf_finalize(); + return; + } + + if (res == PM3_SUCCESS) { // to verify result reset EM4x50 if (reset()) { @@ -996,9 +1015,8 @@ void em4x50_write(em4x50_data_t *etd) { } status = (bsuccess << 1) + blogin; - lf_finalize(); - reply_ng(CMD_ACK, status, (uint8_t *)tag.sectors, 238); + reply_ng(CMD_LF_EM4X50_WRITE, status, (uint8_t *)tag.sectors, 238); } void em4x50_write_password(em4x50_data_t *etd) { @@ -1015,12 +1033,18 @@ void em4x50_write_password(em4x50_data_t *etd) { // login and change password if (login(etd->password)) { - bsuccess = write_password(etd->password, etd->new_password); + + int res = write_password(etd->password, etd->new_password); + if (res == PM3_ETEAROFF) { + lf_finalize(); + return; + } + bsuccess = (res == PM3_SUCCESS); } } lf_finalize(); - reply_ng(CMD_ACK, bsuccess, 0, 0); + reply_ng(CMD_LF_EM4X50_WRITE_PASSWORD, bsuccess, 0, 0); } void em4x50_wipe(em4x50_data_t *etd) { @@ -1078,5 +1102,5 @@ void em4x50_wipe(em4x50_data_t *etd) { } lf_finalize(); - reply_ng(CMD_ACK, bsuccess, (uint8_t *)tag.sectors, 238); + reply_ng(CMD_LF_EM4X50_WIPE, bsuccess, (uint8_t *)tag.sectors, 238); } diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c index fa4e2f765..3bddc2113 100644 --- a/client/src/cmdlfem4x50.c +++ b/client/src/cmdlfem4x50.c @@ -315,7 +315,7 @@ int CmdEM4x50Info(const char *Cmd) { SendCommandNG(CMD_LF_EM4X50_INFO, (uint8_t *)&etd, sizeof(etd)); PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { + if (!WaitForResponseTimeout(CMD_LF_EM4X50_INFO, &resp, TIMEOUT)) { PrintAndLogEx(WARNING, "timeout while waiting for reply."); return PM3_ETIMEOUT; } @@ -388,7 +388,7 @@ int CmdEM4x50Write(const char *Cmd) { clearCommandBuffer(); SendCommandNG(CMD_LF_EM4X50_WRITE, (uint8_t *)&etd, sizeof(etd)); PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { + if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE, &resp, TIMEOUT)) { PrintAndLogEx(WARNING, "timeout while waiting for reply."); return PM3_ETIMEOUT; } @@ -483,7 +483,7 @@ int CmdEM4x50WritePassword(const char *Cmd) { clearCommandBuffer(); SendCommandNG(CMD_LF_EM4X50_WRITE_PASSWORD, (uint8_t *)&etd, sizeof(etd)); - if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { + if (!WaitForResponseTimeout(CMD_LF_EM4X50_WRITE_PASSWORD, &resp, TIMEOUT)) { PrintAndLogEx(WARNING, "timeout while waiting for reply."); return PM3_ETIMEOUT; } @@ -515,7 +515,7 @@ int em4x50_read(em4x50_data_t *etd, em4x50_word_t *out, bool verbose) { SendCommandNG(CMD_LF_EM4X50_READ, (uint8_t *)&edata, sizeof(edata)); PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { + if (!WaitForResponseTimeout(CMD_LF_EM4X50_READ, &resp, TIMEOUT)) { PrintAndLogEx(WARNING, "(em4x50) timeout while waiting for reply."); return PM3_ETIMEOUT; } @@ -651,7 +651,7 @@ int CmdEM4x50Dump(const char *Cmd) { clearCommandBuffer(); SendCommandNG(CMD_LF_EM4X50_INFO, (uint8_t *)&etd, sizeof(etd)); PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_ACK, &resp, TIMEOUT)) { + if (!WaitForResponseTimeout(CMD_LF_EM4X50_INFO, &resp, TIMEOUT)) { PrintAndLogEx(WARNING, "timeout while waiting for reply."); return PM3_ETIMEOUT; } @@ -726,7 +726,7 @@ int CmdEM4x50Wipe(const char *Cmd) { clearCommandBuffer(); SendCommandNG(CMD_LF_EM4X50_WIPE, (uint8_t *)&etd, sizeof(etd)); - if (!WaitForResponseTimeout(CMD_ACK, &resp, 2 * TIMEOUT)) { + if (!WaitForResponseTimeout(CMD_LF_EM4X50_WIPE, &resp, 2 * TIMEOUT)) { PrintAndLogEx(WARNING, "\ntimeout while waiting for reply.\n"); return PM3_ETIMEOUT; } From 9a3c669e593f6e209292204f8fe881d8864cfde0 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 14:05:18 +0200 Subject: [PATCH 007/125] EM4x50 to exit if tear off --- client/src/cmdlfem4x50.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/client/src/cmdlfem4x50.c b/client/src/cmdlfem4x50.c index 3bddc2113..7296ccbb1 100644 --- a/client/src/cmdlfem4x50.c +++ b/client/src/cmdlfem4x50.c @@ -393,6 +393,9 @@ int CmdEM4x50Write(const char *Cmd) { return PM3_ETIMEOUT; } + if (resp.status == PM3_ETEAROFF) + return PM3_SUCCESS; + bool isOK = (resp.status & STATUS_SUCCESS) >> 1; if (isOK == false) { PrintAndLogEx(FAILED, "writing " _RED_("failed")); @@ -487,6 +490,10 @@ int CmdEM4x50WritePassword(const char *Cmd) { PrintAndLogEx(WARNING, "timeout while waiting for reply."); return PM3_ETIMEOUT; } + + if (resp.status == PM3_ETEAROFF) + return PM3_SUCCESS; + success = (bool)resp.status; // get, prepare and print response From 6e6c8cbd6be0ef645d9344ba4d5d4bd99a1cc451 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 16:09:17 +0200 Subject: [PATCH 008/125] hf 14b raw - added tearoff --- armsrc/iso14443a.c | 10 +++++----- armsrc/iso14443b.c | 15 ++++++++++----- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index 19c16f656..d40080ae1 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -2624,13 +2624,13 @@ int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *p_card, uint32 } // else force RATS // RATS, Request for answer to select - if (!no_rats) { - uint8_t rats[] = { ISO14443A_CMD_RATS, 0x80, 0x00, 0x00 }; // FSD=256, FSDI=8, CID=0 + if (no_rats == false) { + uint8_t rats[] = { ISO14443A_CMD_RATS, 0x80, 0x00, 0x00 }; // FSD=256, FSDI=8, CID=0 AddCrc14A(rats, 2); ReaderTransmit(rats, sizeof(rats), NULL); int len = ReaderReceive(resp, resp_par); - - if (!len) return 0; + if (len == 0) + return 0; if (p_card) { memcpy(p_card->ats, resp, sizeof(p_card->ats)); @@ -2932,7 +2932,7 @@ void ReaderIso14443a(PacketCommandNG *c) { if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured FpgaDisableTracing(); - reply_old(CMD_ACK, 0, 0, 0, NULL, 0); + reply_mix(CMD_ACK, 0, 0, 0, NULL, 0); } else { arg0 = ReaderReceive(buf, par); FpgaDisableTracing(); diff --git a/armsrc/iso14443b.c b/armsrc/iso14443b.c index 976e13148..64c0ba67f 100644 --- a/armsrc/iso14443b.c +++ b/armsrc/iso14443b.c @@ -1895,12 +1895,17 @@ void SendRawCommand14443B_Ex(PacketCommandNG *c) { uint32_t eof_time = 0; CodeAndTransmit14443bAsReader(cmd, len, &start_time, &eof_time); - eof_time += DELAY_ISO14443B_VCD_TO_VICC_READER; - status = Get14443bAnswerFromTag(buf, sizeof(buf), 5 * ISO14443B_READER_TIMEOUT, &eof_time); // raw - FpgaDisableTracing(); + if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured + FpgaDisableTracing(); + reply_mix(CMD_HF_ISO14443B_COMMAND, -2, 0, 0, NULL, 0); + } else { + eof_time += DELAY_ISO14443B_VCD_TO_VICC_READER; + status = Get14443bAnswerFromTag(buf, sizeof(buf), 5 * ISO14443B_READER_TIMEOUT, &eof_time); // raw + FpgaDisableTracing(); - sendlen = MIN(Demod.len, PM3_CMD_DATA_SIZE); - reply_mix(CMD_HF_ISO14443B_COMMAND, status, sendlen, 0, Demod.output, sendlen); + sendlen = MIN(Demod.len, PM3_CMD_DATA_SIZE); + reply_mix(CMD_HF_ISO14443B_COMMAND, status, sendlen, 0, Demod.output, sendlen); + } } out: From 045f90ecf418e2403279c52b6c5fae5562493cb5 Mon Sep 17 00:00:00 2001 From: tcprst Date: Tue, 13 Oct 2020 11:19:18 -0400 Subject: [PATCH 009/125] fix fido2 list/info --- client/src/cmdhffido.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/cmdhffido.c b/client/src/cmdhffido.c index 009a14e9f..eac2c71c5 100644 --- a/client/src/cmdhffido.c +++ b/client/src/cmdhffido.c @@ -915,7 +915,7 @@ static int cmd_hf_fido_2get_assertion(const char *cmd) { static command_t CommandTable[] = { {"help", CmdHelp, AlwaysAvailable, "This help."}, - {"info", cmd_hf_fido_list, IfPm3Iso14443a, "List ISO 14443A history"}, + {"list", cmd_hf_fido_list, IfPm3Iso14443a, "List ISO 14443A history"}, {"info", cmd_hf_fido_info, IfPm3Iso14443a, "Info about FIDO tag."}, {"reg", cmd_hf_fido_register, IfPm3Iso14443a, "FIDO U2F Registration Message."}, {"auth", cmd_hf_fido_authenticate, IfPm3Iso14443a, "FIDO U2F Authentication Message."}, From 3868b0b4e69fdd316d3f0664edb1f367c263d1d7 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Tue, 13 Oct 2020 22:43:28 +0200 Subject: [PATCH 010/125] hf iclass write, hf 15 raw, write, etc supports tear off trigger --- armsrc/iclass.c | 30 +++++++- armsrc/iso15693.c | 148 ++++++++++++++++++++------------------- client/src/cmdhf15.c | 44 ++++++++++-- client/src/cmdhficlass.c | 19 +++-- 4 files changed, 156 insertions(+), 85 deletions(-) diff --git a/armsrc/iclass.c b/armsrc/iclass.c index baaff65c5..00e88f405 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -1864,8 +1864,34 @@ void iClass_WriteBlock(uint8_t *msg) { start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; uint8_t resp[10] = {0}; - res = iclass_send_cmd_with_retries(write, sizeof(write), resp, sizeof(resp), 10, 3, &start_time, ICLASS_READER_TIMEOUT_UPDATE, &eof_time); - if (res == false) { + + uint8_t tries = 3; + while (tries-- > 0) { + + iclass_send_as_reader(write, sizeof(write), &start_time, &eof_time); + + if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured + res = false; + switch_off(); + if (payload->req.send_reply) + reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t *)&res, sizeof(uint8_t)); + return; + } else { + + if (resp == NULL) { + res = true; + break; + } + + if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_UPDATE, &eof_time) == 10) { + res = true; + break; + } + } + } + + if (tries == 0) { + res = false; goto out; } diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c index e84edd8a0..00af14c4f 100644 --- a/armsrc/iso15693.c +++ b/armsrc/iso15693.c @@ -290,6 +290,7 @@ void TransmitTo15693Tag(const uint8_t *cmd, int len, uint32_t *start_time) { LED_B_OFF(); *start_time = *start_time + DELAY_ARM_TO_TAG; + FpgaDisableTracing(); } //----------------------------------------------------------------------------- @@ -732,6 +733,7 @@ int GetIso15693AnswerFromTag(uint8_t *response, uint16_t max_len, uint16_t timeo } FpgaDisableSscDma(); + FpgaDisableTracing(); uint32_t sof_time = *eof_time - (dt->len * 8 * 8 * 16) // time for byte transfers @@ -1469,17 +1471,22 @@ int SendDataTag(uint8_t *send, int sendlen, bool init, bool speed_fast, uint8_t // low speed (1 out of 256) CodeIso15693AsReader256(send, sendlen); } - + int res = 0; tosend_t *ts = get_tosend(); TransmitTo15693Tag(ts->buf, ts->max, &start_time); - *eof_time = start_time + 32 * ((8 * ts->max) - 4); // substract the 4 padding bits after EOF - LogTrace_ISO15693(send, sendlen, (start_time * 4), (*eof_time * 4), NULL, true); + + if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured - int res = 0; - if (recv != NULL) { - res = GetIso15693AnswerFromTag(recv, max_recv_len, timeout, eof_time); + res = PM3_ETEAROFF; + + } else { + + *eof_time = start_time + 32 * ((8 * ts->max) - 4); // substract the 4 padding bits after EOF + LogTrace_ISO15693(send, sendlen, (start_time * 4), (*eof_time * 4), NULL, true); + if (recv != NULL) { + res = GetIso15693AnswerFromTag(recv, max_recv_len, timeout, eof_time); + } } - FpgaDisableTracing(); return res; } @@ -1495,7 +1502,6 @@ int SendDataTagEOF(uint8_t *recv, uint16_t max_recv_len, uint32_t start_time, ui if (recv != NULL) { res = GetIso15693AnswerFromTag(recv, max_recv_len, timeout, eof_time); } - FpgaDisableTracing(); return res; } @@ -1588,41 +1594,49 @@ void ReaderIso15693(uint32_t parameter) { BuildIdentifyRequest(cmd); uint32_t start_time = 0; uint32_t eof_time; - int answerLen = SendDataTag(cmd, sizeof(cmd), true, true, answer, ISO15693_MAX_RESPONSE_LENGTH, start_time, ISO15693_READER_TIMEOUT, &eof_time); - start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER; + int recvlen = SendDataTag(cmd, sizeof(cmd), true, true, answer, ISO15693_MAX_RESPONSE_LENGTH, start_time, ISO15693_READER_TIMEOUT, &eof_time); + + if (recvlen == PM3_ETEAROFF) { // tearoff occured + reply_mix(CMD_ACK, recvlen, 0, 0, NULL, 0); + } else { + + start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER; - // we should do a better check than this - if (answerLen >= 12) { - uint8_t uid[8]; - uid[0] = answer[9]; // always E0 - uid[1] = answer[8]; // IC Manufacturer code - uid[2] = answer[7]; - uid[3] = answer[6]; - uid[4] = answer[5]; - uid[5] = answer[4]; - uid[6] = answer[3]; - uid[7] = answer[2]; + // we should do a better check than this + if (recvlen >= 12) { + uint8_t uid[8]; + uid[0] = answer[9]; // always E0 + uid[1] = answer[8]; // IC Manufacturer code + uid[2] = answer[7]; + uid[3] = answer[6]; + uid[4] = answer[5]; + uid[5] = answer[4]; + uid[6] = answer[3]; + uid[7] = answer[2]; - if (DBGLEVEL >= DBG_EXTENDED) { - Dbprintf("[+] UID = %02X%02X%02X%02X%02X%02X%02X%02X", - uid[0], uid[1], uid[2], uid[3], - uid[4], uid[5], uid[5], uid[6] - ); + if (DBGLEVEL >= DBG_EXTENDED) { + Dbprintf("[+] UID = %02X%02X%02X%02X%02X%02X%02X%02X", + uid[0], uid[1], uid[2], uid[3], + uid[4], uid[5], uid[5], uid[6] + ); + } + // send UID back to client. + // arg0 = 1 = OK + // arg1 = len of response (12 bytes) + // arg2 = rtf + // asbytes = uid. + reply_mix(CMD_ACK, 1, sizeof(uid), 0, uid, sizeof(uid)); + + if (DBGLEVEL >= DBG_EXTENDED) { + Dbprintf("[+] %d octets read from IDENTIFY request:", recvlen); + DbdecodeIso15693Answer(recvlen, answer); + Dbhexdump(recvlen, answer, true); + } + } else { + DbpString("Failed to select card"); + reply_mix(CMD_ACK, 0, 0, 0, NULL, 0); } - // send UID back to client. - // arg0 = 1 = OK - // arg1 = len of response (12 bytes) - // arg2 = rtf - // asbytes = uid. - reply_mix(CMD_ACK, 1, sizeof(uid), 0, uid, sizeof(uid)); } - - if (DBGLEVEL >= DBG_EXTENDED) { - Dbprintf("[+] %d octets read from IDENTIFY request:", answerLen); - DbdecodeIso15693Answer(answerLen, answer); - Dbhexdump(answerLen, answer, true); - } - switch_off(); BigBuf_free(); } @@ -1767,6 +1781,11 @@ void BruteforceIso15693Afi(uint32_t speed) { if (recvlen >= 12) { Dbprintf("NoAFI UID = %s", iso15693_sprintUID(NULL, recv + 2)); + } else { + DbpString("Failed to select card"); + reply_ng(CMD_ACK, PM3_ESOFT, NULL, 0); + switch_off(); + return; } // now with AFI @@ -1816,10 +1835,9 @@ void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint LED_A_ON(); - int recvlen = 0; uint8_t recvbuf[ISO15693_MAX_RESPONSE_LENGTH]; - uint32_t eof_time = 0; uint16_t timeout; + uint32_t eof_time = 0; bool request_answer = false; switch (data[1]) { @@ -1837,43 +1855,29 @@ void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint timeout = ISO15693_READER_TIMEOUT; } - if (DBGLEVEL >= DBG_EXTENDED) { - Dbprintf("SEND:"); - Dbhexdump(datalen, data, false); - } - uint32_t start_time = 0; - recvlen = SendDataTag(data, datalen, true, speed, (recv ? recvbuf : NULL), sizeof(recvbuf), start_time, timeout, &eof_time); + int recvlen = SendDataTag(data, datalen, true, speed, (recv ? recvbuf : NULL), sizeof(recvbuf), start_time, timeout, &eof_time); - // send a single EOF to get the tag response - if (request_answer) { - start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER; - recvlen = SendDataTagEOF((recv ? recvbuf : NULL), sizeof(recvbuf), start_time, ISO15693_READER_TIMEOUT, &eof_time); + if (recvlen == PM3_ETEAROFF) { // tearoff occured + reply_mix(CMD_ACK, recvlen, 0, 0, NULL, 0); + } else { + + // send a single EOF to get the tag response + if (request_answer) { + start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER; + recvlen = SendDataTagEOF((recv ? recvbuf : NULL), sizeof(recvbuf), start_time, ISO15693_READER_TIMEOUT, &eof_time); + } + + if (recv) { + recvlen = MIN(recvlen,ISO15693_MAX_RESPONSE_LENGTH); + reply_mix(CMD_ACK, recvlen, 0, 0, recvbuf, recvlen); + } else { + reply_mix(CMD_ACK, 1, 0, 0, NULL, 0); + } } - - // for the time being, switch field off to protect rdv4.0 // note: this prevents using hf 15 cmd with s option - which isn't implemented yet anyway FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); LED_D_OFF(); - - if (recv) { - - if (recvlen > ISO15693_MAX_RESPONSE_LENGTH) { - recvlen = ISO15693_MAX_RESPONSE_LENGTH; - } - reply_mix(CMD_ACK, recvlen, 0, 0, recvbuf, recvlen); - - if (DBGLEVEL >= DBG_EXTENDED) { - - Dbprintf("RECV:"); - if (recvlen > 0) { - Dbhexdump(recvlen, recvbuf, false); - DbdecodeIso15693Answer(recvlen, recvbuf); - } - } - } else { - reply_mix(CMD_ACK, 1, 0, 0, 0, 0); - } } /* diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c index 238aad435..407815a93 100644 --- a/client/src/cmdhf15.c +++ b/client/src/cmdhf15.c @@ -323,7 +323,7 @@ static int usage_15_raw(void) { return PM3_SUCCESS; } static int usage_15_read(void) { - PrintAndLogEx(NORMAL, "Usage: hf 15 read [options] \n" + PrintAndLogEx(NORMAL, "Usage: hf 15 rdbl [options] \n" "Options:\n" "\t-2 use slower '1 out of 256' mode\n" "\tuid (either): \n" @@ -334,7 +334,7 @@ static int usage_15_read(void) { return PM3_SUCCESS; } static int usage_15_write(void) { - PrintAndLogEx(NORMAL, "Usage: hf 15 write [options] \n" + PrintAndLogEx(NORMAL, "Usage: hf 15 wrbl [options] \n" "Options:\n" "\t-2 use slower '1 out of 256' mode\n" "\t-o set OPTION Flag (needed for TI)\n" @@ -816,6 +816,10 @@ static int NxpSysInfo(uint8_t *uid) { DropField(); int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } + if (status < 2) { PrintAndLogEx(WARNING, "iso15693 card doesn't answer to NXP systeminfo command"); return PM3_EWRONGANSWER; @@ -975,6 +979,9 @@ static int CmdHF15Info(const char *Cmd) { DropField(); int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } if (status < 2) { PrintAndLogEx(WARNING, "iso15693 card doesn't answer to systeminfo command (%d)", status); return PM3_EWRONGANSWER; @@ -1153,9 +1160,13 @@ static int CmdHF15WriteAfi(const char *Cmd) { DropField(); return PM3_ETIMEOUT; } - DropField(); + int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } + uint8_t *data = resp.data.asBytes; if ((data[0] & ISO15_RES_ERROR) == ISO15_RES_ERROR) { @@ -1212,6 +1223,10 @@ static int CmdHF15WriteDsfid(const char *Cmd) { } DropField(); + int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } uint8_t *data = resp.data.asBytes; @@ -1296,6 +1311,9 @@ static int CmdHF15Dump(const char *Cmd) { if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) { int len = resp.oldarg[0]; + if (len == PM3_ETEAROFF) { + continue; + } if (len < 2) { PrintAndLogEx(FAILED, "iso15693 command failed"); continue; @@ -1321,6 +1339,7 @@ static int CmdHF15Dump(const char *Cmd) { blocknum++; PrintAndLogEx(NORMAL, "." NOLF); + fflush(stdout); } } @@ -1419,6 +1438,10 @@ static int CmdHF15Raw(const char *Cmd) { if (reply) { if (WaitForResponseTimeout(CMD_ACK, &resp, 2000)) { int len = resp.oldarg[0]; + if (len == PM3_ETEAROFF) { + DropField(); + return len; + } if (len < 2) { PrintAndLogEx(WARNING, "command failed"); } else { @@ -1491,6 +1514,10 @@ static int CmdHF15Readmulti(const char *Cmd) { DropField(); int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } + if (status < 2) { PrintAndLogEx(FAILED, "iso15693 card readmulti failed"); return PM3_EWRONGANSWER; @@ -1574,6 +1601,9 @@ static int CmdHF15Read(const char *Cmd) { DropField(); int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } if (status < 2) { PrintAndLogEx(ERR, "iso15693 command failed"); return PM3_EWRONGANSWER; @@ -1661,6 +1691,10 @@ static int CmdHF15Write(const char *Cmd) { DropField(); int status = resp.oldarg[0]; + if (status == PM3_ETEAROFF) { + return status; + } + if (status < 2) { PrintAndLogEx(FAILED, "iso15693 command failed"); return PM3_EWRONGANSWER; @@ -1876,13 +1910,13 @@ static command_t CommandTable[] = { {"info", CmdHF15Info, IfPm3Iso15693, "Tag information"}, {"sniff", CmdHF15Sniff, IfPm3Iso15693, "Sniff ISO15693 traffic"}, {"raw", CmdHF15Raw, IfPm3Iso15693, "Send raw hex data to tag"}, - {"read", CmdHF15Read, IfPm3Iso15693, "Read a block"}, + {"rdbl", CmdHF15Read, IfPm3Iso15693, "Read a block"}, {"reader", CmdHF15Reader, IfPm3Iso15693, "Act like an ISO15693 reader"}, {"readmulti", CmdHF15Readmulti, IfPm3Iso15693, "Reads multiple Blocks"}, {"restore", CmdHF15Restore, IfPm3Iso15693, "Restore from file to all memory pages of an ISO15693 tag"}, {"samples", CmdHF15Samples, IfPm3Iso15693, "Acquire Samples as Reader (enables carrier, sends inquiry)"}, {"sim", CmdHF15Sim, IfPm3Iso15693, "Fake an ISO15693 tag"}, - {"write", CmdHF15Write, IfPm3Iso15693, "Write a block"}, + {"wrbl", CmdHF15Write, IfPm3Iso15693, "Write a block"}, {"-----------", CmdHF15Help, IfPm3Iso15693, "----------------------- " _CYAN_("afi") " -----------------------"}, {"findafi", CmdHF15FindAfi, IfPm3Iso15693, "Brute force AFI of an ISO15693 tag"}, {"writeafi", CmdHF15WriteAfi, IfPm3Iso15693, "Writes the AFI on an ISO15693 tag"}, diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 81bca140e..bf40e2d1e 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -1913,9 +1913,8 @@ static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bo if (resp.status != PM3_SUCCESS) { if (verbose) PrintAndLogEx(ERR, "failed to communicate with card"); - return PM3_EWRONGANSWER; + return resp.status; } - return (resp.data.asBytes[0] == 1) ? PM3_SUCCESS : PM3_ESOFT; } @@ -2012,10 +2011,18 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { if (errors || cmdp < 6) return usage_hf_iclass_writeblock(); int isok = iclass_write_block(blockno, bldata, KEY, use_credit_key, elite, rawkey, use_replay, verbose); - if (isok == PM3_SUCCESS) - PrintAndLogEx(SUCCESS, "Wrote block %02X successful", blockno); - else - PrintAndLogEx(FAILED, "Writing failed"); + switch(isok) { + case PM3_SUCCESS: + PrintAndLogEx(SUCCESS, "Wrote block %02X successful", blockno); + break; + case PM3_ETEAROFF: + if (verbose) + PrintAndLogEx(INFO, "Writing tear off triggered"); + break; + default: + PrintAndLogEx(FAILED, "Writing failed"); + break; + } return isok; } From 53c7e47e75eb1503bb93a66a1300a08ec5dc2e84 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Wed, 14 Oct 2020 17:41:34 +0200 Subject: [PATCH 011/125] fix: hf iclass restore - now uses NG and better reporting and works :) --- armsrc/Standalone/hf_iceclass.c | 8 +- armsrc/appmain.c | 12 +-- armsrc/iclass.c | 115 ++++++++++++++++------- armsrc/iclass.h | 5 +- client/src/cmdhficlass.c | 161 +++++++++----------------------- include/pm3_cmd.h | 17 ++-- 6 files changed, 143 insertions(+), 175 deletions(-) diff --git a/armsrc/Standalone/hf_iceclass.c b/armsrc/Standalone/hf_iceclass.c index 00de115e6..0c06bc90b 100644 --- a/armsrc/Standalone/hf_iceclass.c +++ b/armsrc/Standalone/hf_iceclass.c @@ -302,15 +302,17 @@ static int reader_dump_mode(void) { Iso15693InitReader(); set_tracing(false); + + picopass_hdr *hdr = (picopass_hdr *)card_data; + // select tag. uint32_t eof_time = 0; - bool res = select_iclass_tag(card_data, auth.use_credit_key, &eof_time); + bool res = select_iclass_tag(hdr, auth.use_credit_key, &eof_time); if (res == false) { switch_off(); continue; } - picopass_hdr *hdr = (picopass_hdr *)card_data; // sanity check of CSN. if (hdr->csn[7] != 0xE0 && hdr->csn[6] != 0x12) { switch_off(); @@ -366,7 +368,7 @@ static int reader_dump_mode(void) { auth.use_credit_key = true; memcpy(auth.key, aa2_key, sizeof(auth.key)); - res = select_iclass_tag(card_data, auth.use_credit_key, &eof_time); + res = select_iclass_tag(hdr, auth.use_credit_key, &eof_time); if (res) { // sanity check of CSN. diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 0b274f654..6b40a3909 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -1553,18 +1553,8 @@ static void PacketReceived(PacketCommandNG *packet) { iClass_Dump(packet->data.asBytes); break; } - case CMD_HF_ICLASS_CLONE: { - struct p { - uint8_t startblock; - uint8_t endblock; - uint8_t data[]; - } PACKED; - struct p *payload = (struct p *)packet->data.asBytes; - iClass_Clone(payload->startblock, payload->endblock, payload->data); - break; - } case CMD_HF_ICLASS_RESTORE: { - iClass_Restore(packet->data.asBytes); + iClass_Restore( (iclass_restore_req_t *)packet->data.asBytes); break; } #endif diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 00e88f405..36ba0706b 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -1276,7 +1276,7 @@ static bool iclass_send_cmd_with_retries(uint8_t *cmd, size_t cmdsize, uint8_t * * @return false = fail * true = Got all. */ -static bool select_iclass_tag_ex(uint8_t *card_data, bool use_credit_key, uint32_t *eof_time, uint8_t *status) { +static bool select_iclass_tag_ex(picopass_hdr *hdr, bool use_credit_key, uint32_t *eof_time, uint8_t *status) { static uint8_t act_all[] = { ICLASS_CMD_ACTALL }; static uint8_t identify[] = { ICLASS_CMD_READ_OR_IDENTIFY, 0x00, 0x73, 0x33 }; @@ -1286,8 +1286,6 @@ static bool select_iclass_tag_ex(uint8_t *card_data, bool use_credit_key, uint32 uint8_t read_check_cc[] = { 0x80 | ICLASS_CMD_READCHECK, 0x02 }; uint8_t resp[ICLASS_BUFFER_SIZE] = {0}; - picopass_hdr *hdr = (picopass_hdr *)card_data; - // Bit 4: K.If this bit equals to one, the READCHECK will use the Credit Key (Kc); if equals to zero, Debit Key (Kd) will be used // bit 7: parity. if (use_credit_key) @@ -1369,6 +1367,8 @@ static bool select_iclass_tag_ex(uint8_t *card_data, bool use_credit_key, uint32 *status |= FLAG_ICLASS_CC; } else { + + // on NON_SECURE_PAGEMODE cards, AIA is on block2.. // read App Issuer Area block 2 read_aia[1] = 0x02; @@ -1385,23 +1385,23 @@ static bool select_iclass_tag_ex(uint8_t *card_data, bool use_credit_key, uint32 if (status) { *status |= FLAG_ICLASS_AIA; - memcpy(card_data + (8 * 2), resp, 8); + memcpy(hdr->epurse, resp, sizeof(hdr->epurse)); } } return true; } -bool select_iclass_tag(uint8_t *card_data, bool use_credit_key, uint32_t *eof_time) { +bool select_iclass_tag(picopass_hdr *hdr, bool use_credit_key, uint32_t *eof_time) { uint8_t result = 0; - return select_iclass_tag_ex(card_data, use_credit_key, eof_time, &result); + return select_iclass_tag_ex(hdr, use_credit_key, eof_time, &result); } // Reader iClass Anticollission // turn off afterwards void ReaderIClass(uint8_t flags) { - uint8_t card_data[6 * 8] = {0xFF}; + picopass_hdr hdr = {0}; // uint8_t last_csn[8] = {0, 0, 0, 0, 0, 0, 0, 0}; uint8_t resp[ICLASS_BUFFER_SIZE] = {0}; memset(resp, 0xFF, sizeof(resp)); @@ -1419,14 +1419,13 @@ void ReaderIClass(uint8_t flags) { uint8_t result_status = 0; uint32_t eof_time = 0; - bool status = select_iclass_tag_ex(card_data, use_credit_key, &eof_time, &result_status); + bool status = select_iclass_tag_ex(&hdr, use_credit_key, &eof_time, &result_status); if (status == false) { - reply_mix(CMD_ACK, 0xFF, 0, 0, card_data, 0); + reply_mix(CMD_ACK, 0xFF, 0, 0, NULL, 0); switch_off(); return; } - // Page mapping for secure mode // 0 : CSN // 1 : Configuration @@ -1444,7 +1443,7 @@ void ReaderIClass(uint8_t flags) { // with 0xFF:s in block 3 and 4. LED_B_ON(); - reply_mix(CMD_ACK, result_status, 0, 0, card_data, sizeof(card_data)); + reply_mix(CMD_ACK, result_status, 0, 0, (uint8_t*)&hdr, sizeof(hdr)); //Send back to client, but don't bother if we already sent this - // only useful if looping in arm (not try_once && not abort_after_read) @@ -1543,7 +1542,7 @@ void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain) { readcheck_cc[0] = 0x10 | ICLASS_CMD_READCHECK; // select card / e-purse - uint8_t card_data[6 * 8] = {0}; + picopass_hdr hdr = {0}; iclass_premac_t *keys = (iclass_premac_t *)datain; @@ -1557,7 +1556,7 @@ void iClass_Authentication_fast(uint64_t arg0, uint64_t arg1, uint8_t *datain) { uint32_t start_time = 0, eof_time = 0; - if (select_iclass_tag(card_data, use_credit_key, &eof_time) == false) + if (select_iclass_tag(&hdr, use_credit_key, &eof_time) == false) goto out; start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; @@ -1634,7 +1633,7 @@ void iClass_ReadBlock(uint8_t *msg) { // select tag. uint32_t eof_time = 0; picopass_hdr hdr = {0}; - bool res = select_iclass_tag((uint8_t *)&hdr, payload->use_credit_key, &eof_time); + bool res = select_iclass_tag(&hdr, payload->use_credit_key, &eof_time); if (res == false) { if (payload->send_reply) { response.isOK = res; @@ -1707,7 +1706,7 @@ void iClass_Dump(uint8_t *msg) { // select tag. uint32_t eof_time = 0; picopass_hdr hdr = {0}; - bool res = select_iclass_tag((uint8_t *)&hdr, req->use_credit_key, &eof_time); + bool res = select_iclass_tag(&hdr, req->use_credit_key, &eof_time); if (res == false) { if (req->send_reply) { reply_ng(CMD_HF_ICLASS_DUMP, PM3_ETIMEOUT, NULL, 0); @@ -1777,10 +1776,12 @@ void iClass_Dump(uint8_t *msg) { BigBuf_free(); } -static bool iclass_writeblock_ext(uint8_t blockno, uint8_t *data) { +static bool iclass_writeblock_ext(uint8_t blockno, uint8_t *data, uint8_t *mac) { + // write command: cmd, 1 blockno, 8 data, 4 mac uint8_t write[16] = { 0x80 | ICLASS_CMD_UPDATE, blockno }; - memcpy(write + 2, data, 12); // data + mac + memcpy(write + 2, data, 8); + memcpy(write + 10, mac, 4); AddCrc(write + 1, 13); uint8_t resp[10] = {0}; @@ -1825,7 +1826,7 @@ void iClass_WriteBlock(uint8_t *msg) { // select tag. uint32_t eof_time = 0; picopass_hdr hdr = {0}; - bool res = select_iclass_tag((uint8_t *)&hdr, payload->req.use_credit_key, &eof_time); + bool res = select_iclass_tag(&hdr, payload->req.use_credit_key, &eof_time); if (res == false) { goto out; } @@ -1924,29 +1925,75 @@ out: reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_SUCCESS, (uint8_t *)&res, sizeof(uint8_t)); } -// turn off afterwards -void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data) { -} +void iClass_Restore(iclass_restore_req_t *msg) { -void iClass_Restore(uint8_t *msg) { + // sanitation + if (msg == NULL) { + reply_ng(CMD_HF_ICLASS_RESTORE, PM3_ESOFT, NULL, 0); + return; + } - iclass_restore_req_t *cmd = (iclass_restore_req_t *)msg; -// iclass_auth_req_t *req = &cmd->req; + if (msg->item_cnt == 0) { + if (msg->req.send_reply) { + reply_ng(CMD_HF_ICLASS_RESTORE, PM3_ESOFT, NULL, 0); + } + return; + } LED_A_ON(); - uint16_t written = 0; - uint16_t total_blocks = (cmd->end_block - cmd->start_block) + 1; - for (uint8_t b = cmd->start_block; b < total_blocks; b++) { + Iso15693InitReader(); - if (iclass_writeblock_ext(b, cmd->data + ((b - cmd->start_block) * 12))) { - Dbprintf("Write block [%02x] successful", b); - written++; - } else { - Dbprintf("Write block [%02x] failed", b); + uint16_t written = 0; + uint32_t eof_time = 0; + picopass_hdr hdr = {0}; + + // select + bool res = select_iclass_tag(&hdr, msg->req.use_credit_key, &eof_time); + if (res == false) { + goto out; + } + + // authenticate + uint8_t mac[4] = {0}; + uint32_t start_time = eof_time + DELAY_ICLASS_VICC_TO_VCD_READER; + + // authenticate + if (msg->req.do_auth) { + res = authenticate_iclass_tag(&msg->req, &hdr, &start_time, &eof_time, mac); + if (res == false) { + goto out; } } + // main loop + for (uint8_t i = 0; i < msg->item_cnt; i++) { + + iclass_restore_item_t item = msg->blocks[i]; + + // calc new mac for data, using 1b blockno, 8b data, + uint8_t wb[9] = {0}; + wb[0] = item.blockno; + memcpy(wb + 1, item.data, 8); + + if (msg->req.use_credit_key) + doMAC_N(wb, sizeof(wb), hdr.key_c, mac); + else + doMAC_N(wb, sizeof(wb), hdr.key_d, mac); + + // data + mac + if (iclass_writeblock_ext(item.blockno, item.data, mac)) { + Dbprintf("Write block [%02x] " _GREEN_("successful"), item.blockno); + written++; + } else { + Dbprintf("Write block [%02x] " _RED_("failed"), item.blockno); + } + } + +out: + switch_off(); - uint8_t isOK = (written == total_blocks) ? 1 : 0; - reply_ng(CMD_HF_ICLASS_CLONE, PM3_SUCCESS, (uint8_t *)&isOK, sizeof(uint8_t)); + if (msg->req.send_reply) { + int isOK = (written == msg->item_cnt) ? PM3_SUCCESS : PM3_ESOFT; + reply_ng(CMD_HF_ICLASS_RESTORE, isOK, NULL, 0); + } } diff --git a/armsrc/iclass.h b/armsrc/iclass.h index ec9ff7b15..1895ebbf6 100644 --- a/armsrc/iclass.h +++ b/armsrc/iclass.h @@ -21,8 +21,7 @@ void ReaderIClass(uint8_t arg0); void iClass_WriteBlock(uint8_t *msg); void iClass_Dump(uint8_t *msg); -void iClass_Restore(uint8_t *msg); -void iClass_Clone(uint8_t startblock, uint8_t endblock, uint8_t *data); +void iClass_Restore(iclass_restore_req_t *msg); int do_iclass_simulation_nonsec(void); int do_iclass_simulation(int simulationMode, uint8_t *reader_mac_buf); @@ -36,6 +35,6 @@ bool iclass_auth(iclass_auth_req_t *payload, uint8_t *out); void iClass_ReadBlock(uint8_t *msg); bool iclass_read_block(uint16_t blockno, uint8_t *data, uint32_t *start_time, uint32_t *eof_time); -bool select_iclass_tag(uint8_t *card_data, bool use_credit_key, uint32_t *eof_time); +bool select_iclass_tag(picopass_hdr *hdr, bool use_credit_key, uint32_t *eof_time); bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint32_t *start_time, uint32_t *eof_time, uint8_t *mac_out); #endif diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index bf40e2d1e..57a231e2e 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -1431,13 +1431,6 @@ static int CmdHFiClassEncryptBlk(const char *Cmd) { return PM3_SUCCESS; } -static void calc_wb_mac(uint8_t blockno, uint8_t *data, uint8_t *div_key, uint8_t *MAC) { - uint8_t wb[9]; - wb[0] = blockno; - memcpy(wb + 1, data, 8); - doMAC_N(wb, sizeof(wb), div_key, MAC); -} - static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool verbose) { uint8_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE); @@ -1475,47 +1468,6 @@ static bool select_only(uint8_t *CSN, uint8_t *CCNR, bool verbose) { return true; } -static bool select_and_auth(uint8_t *KEY, uint8_t *MAC, uint8_t *div_key, bool use_credit_key, bool elite, bool rawkey, bool verbose) { - - iclass_auth_req_t payload = { - .use_raw = rawkey, - .use_elite = elite, - .use_credit_key = use_credit_key - }; - memcpy(payload.key, KEY, 8); - - SendCommandNG(CMD_HF_ICLASS_AUTH, (uint8_t *)&payload, sizeof(payload)); - PacketResponseNG resp; - clearCommandBuffer(); - if (WaitForResponseTimeout(CMD_HF_ICLASS_AUTH, &resp, 2000) == 0) { - if (verbose) PrintAndLogEx(WARNING, "Command execute timeout"); - return false; - } - - if (resp.status != PM3_SUCCESS) { - if (verbose) PrintAndLogEx(ERR, "failed to communicate with card"); - return false; - } - - iclass_readblock_resp_t *packet = (iclass_readblock_resp_t *)resp.data.asBytes; - - if (packet->isOK == 0) { - if (verbose) PrintAndLogEx(FAILED, "authentication error"); - return false; - } - - if (div_key) - memcpy(div_key, packet->div_key, sizeof(packet->div_key)); - - if (MAC) - memcpy(MAC, packet->mac, sizeof(packet->mac)); - - if (verbose) - PrintAndLogEx(SUCCESS, "authing with %s: %s", rawkey ? "raw key" : "diversified key", sprint_hex(div_key, 8)); - - return true; -} - static int CmdHFiClassDump(const char *Cmd) { uint8_t KEY[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; @@ -2026,11 +1978,6 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { return isok; } -/* -static int CmdHFiClassClone(const char *Cmd) { - return PM3_SUCCESS; -} -*/ static int CmdHFiClassRestore(const char *Cmd) { char filename[FILE_PATH_SIZE] = { 0x00 }; char tempStr[50] = {0}; @@ -2082,7 +2029,7 @@ static int CmdHFiClassRestore(const char *Cmd) { } else if (dataLen == 1) { keyNbr = param_get8(Cmd, cmdp + 1); if (keyNbr < ICLASS_KEYS_MAX) { - PrintAndLogEx(SUCCESS, "Using key[%d] %s", keyNbr, sprint_hex(iClass_Key_Table[keyNbr], 8)); + PrintAndLogEx(SUCCESS, "Using key[%d] " _GREEN_("%s"), keyNbr, sprint_hex(iClass_Key_Table[keyNbr], 8)); memcpy(KEY, iClass_Key_Table[keyNbr], 8); } else { PrintAndLogEx(WARNING, "\nERROR: Credit KeyNbr is invalid\n"); @@ -2119,14 +2066,19 @@ static int CmdHFiClassRestore(const char *Cmd) { if (errors || cmdp < 8) return usage_hf_iclass_restore(); + if (rawkey + elite > 1) { + PrintAndLogEx(FAILED, "Can not use both 'e', 'r'"); + return PM3_EINVARG; + } + if (startblock < 5) { PrintAndLogEx(WARNING, "you cannot write key blocks this way. yet... make your start block > 4"); return PM3_EINVARG; } - int total_bytes = (((endblock - startblock) + 1) * 12); + uint32_t payload_size = sizeof(iclass_restore_req_t) + (sizeof(iclass_restore_item_t) * (endblock - startblock + 1)); - if (total_bytes > PM3_CMD_DATA_SIZE - 2) { + if (payload_size > PM3_CMD_DATA_SIZE) { PrintAndLogEx(NORMAL, "Trying to write too many blocks at once. Max: %d", PM3_CMD_DATA_SIZE / 8); return PM3_EINVARG; } @@ -2144,93 +2096,68 @@ static int CmdHFiClassRestore(const char *Cmd) { return PM3_EFILE; } - if (bytes_read < sizeof(iclass_block_t) * (endblock - startblock + 1)) { - PrintAndLogEx(ERR, "file wrong size"); + if (bytes_read < ((endblock - startblock + 1) * 8 )) { + PrintAndLogEx(ERR, "file is smaller than your suggested block range ( " _RED_("0x%02x..0x%02x")" )", + startblock, endblock + ); free(dump); return PM3_EFILE; } + iclass_restore_req_t *payload = calloc(1, payload_size); + payload->req.use_raw = rawkey, + payload->req.use_elite = elite, + payload->req.use_credit_key = use_credit_key, + payload->req.use_replay = false, + payload->req.blockno = startblock, + payload->req.send_reply = true, + payload->req.do_auth = true, + memcpy(payload->req.key, KEY, 8); + + payload->item_cnt = (endblock - startblock + 1); + // read data from file from block 6 --- 19 // we will use this struct [data 8 bytes][MAC 4 bytes] for each block calculate all mac number for each data // then copy to usbcommand->asbytes; // max is 32 - 6 = 28 block. 28 x 12 bytes gives 336 bytes - iclass_block_t tag_data[PM3_CMD_DATA_SIZE / 12]; - memcpy(tag_data, dump + startblock * 8, sizeof(iclass_block_t) * (endblock - startblock + 1)); + for (uint8_t i = 0; i < payload->item_cnt; i++) { + payload->blocks[i].blockno = startblock + i; + memcpy(payload->blocks[i].data, dump + (startblock * 8) + (i * 8) , sizeof(payload->blocks[i].data)); + } free(dump); - uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00}; - uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; - - int i; - int numberAuthRetries = ICLASS_AUTH_RETRY; - do { - if (select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose)) - break; - } while (numberAuthRetries--); - - if (numberAuthRetries <= 0) { - PrintAndLogEx(ERR, "failed to authenticate"); - DropField(); - return PM3_ESOFT; - } - - uint8_t data[total_bytes]; - - // calculate all mac for every the block we will write - for (i = startblock; i <= endblock; i++) { - - calc_wb_mac(i, tag_data[i - startblock].d, div_key, MAC); - // usb command d start pointer = d + (i - 6) * 12 - // memcpy(pointer,tag_data[i - 6],8) 8 bytes - // memcpy(pointer + 8,mac,sizoof(mac) 4 bytes; - // next one - uint8_t *ptr = data + (i - startblock) * 12; - memcpy(ptr, &(tag_data[i - startblock].d[0]), 8); - memcpy(ptr + 8, MAC, 4); - } - if (verbose) { - PrintAndLogEx(INFO, "------+--------------------------+-------------"); - PrintAndLogEx(INFO, "block | data | mac"); - PrintAndLogEx(INFO, "------+--------------------------+-------------"); - uint8_t p[12]; - for (i = 0; i <= endblock - startblock; i++) { - memcpy(p, data + (i * 12), 12); - char *s = calloc(70, sizeof(uint8_t)); - snprintf(s, 70, "| %s ", sprint_hex(p, 8)); - snprintf(s + strlen(s), 70 - strlen(s), "| %s", sprint_hex(p + 8, 4)); - PrintAndLogEx(NORMAL, " %02X %s", i + startblock, s); - free(s); + PrintAndLogEx(INFO, "Preparing to restore block range 0x02x..0x%02x", startblock, endblock); + + PrintAndLogEx(INFO, "------+----------------------"); + PrintAndLogEx(INFO, "block | data"); + PrintAndLogEx(INFO, "------+----------------------"); + + for (uint8_t i = 0; i < payload->item_cnt; i++) { + iclass_restore_item_t item = payload->blocks[i]; + PrintAndLogEx(INFO, " %02X | %s", item.blockno, sprint_hex_inrow(item.data, sizeof(item.data))); } } - struct p { - uint8_t startblock; - uint8_t endblock; - uint8_t data[PM3_CMD_DATA_SIZE - 2]; - } PACKED payload; - - payload.startblock = startblock; - payload.endblock = endblock; - memcpy(payload.data, data, total_bytes); + PrintAndLogEx(INFO, "restore started..."); PacketResponseNG resp; clearCommandBuffer(); - SendCommandNG(CMD_HF_ICLASS_CLONE, (uint8_t *)&payload, total_bytes + 2); + SendCommandNG(CMD_HF_ICLASS_RESTORE, (uint8_t *)payload, payload_size); - if (WaitForResponseTimeout(CMD_HF_ICLASS_CLONE, &resp, 2000) == 0) { + if (WaitForResponseTimeout(CMD_HF_ICLASS_RESTORE, &resp, 2500) == 0) { PrintAndLogEx(WARNING, "command execute timeout"); DropField(); return PM3_ETIMEOUT; } if (resp.status == PM3_SUCCESS) { - if (resp.data.asBytes[0] == 1) - PrintAndLogEx(SUCCESS, "Restore successful"); - else - PrintAndLogEx(WARNING, "Restore failed"); + PrintAndLogEx(SUCCESS, "iCLASS restore " _GREEN_("successful")); + PrintAndLogEx(HINT, "Try `" _YELLOW_("hf iclass rdbl ") "` to verify data on card"); + } else { + PrintAndLogEx(WARNING, "iCLASS restore " _RED_("failed")); } return resp.status; } diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index 141f51621..a473eb7f3 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -334,11 +334,15 @@ typedef struct { } PACKED iclass_writeblock_req_t; // iCLASS dump data structure +typedef struct { + uint8_t blockno; + uint8_t data[8]; +} PACKED iclass_restore_item_t; + typedef struct { iclass_auth_req_t req; - uint8_t start_block; - uint8_t end_block; - uint8_t data[]; + uint8_t item_cnt; + iclass_restore_item_t blocks[]; } PACKED iclass_restore_req_t; @@ -351,7 +355,7 @@ typedef struct { uint8_t mem_config; //[13] uint8_t eas; //[14] uint8_t fuses; //[15] -} picopass_conf_block_t; +} PACKED picopass_conf_block_t; // iCLASS secure mode memory mapping typedef struct { @@ -361,14 +365,14 @@ typedef struct { uint8_t key_d[8]; uint8_t key_c[8]; uint8_t app_issuer_area[8]; -} picopass_hdr; +} PACKED picopass_hdr; // iCLASS non-secure mode memory mapping typedef struct { uint8_t csn[8]; picopass_conf_block_t conf; uint8_t app_issuer_area[8]; -} picopass_ns_hdr; +} PACKED picopass_ns_hdr; // For the bootloader @@ -560,7 +564,6 @@ typedef struct { // iCLASS / Picopass #define CMD_HF_ICLASS_READCHECK 0x038F -#define CMD_HF_ICLASS_CLONE 0x0390 #define CMD_HF_ICLASS_DUMP 0x0391 #define CMD_HF_ICLASS_SNIFF 0x0392 #define CMD_HF_ICLASS_SIMULATE 0x0393 From ba8aa6f0abe7605fcec993df853a88acfee5f255 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 19:29:54 +0200 Subject: [PATCH 012/125] lf em stuff --- client/src/cmdhfmfp.c | 28 ++-- client/src/cmdhw.c | 27 +++ client/src/cmdhw.h | 2 + client/src/cmdlfem4x.c | 367 ++++++++++++++++++++++++++++++++++++++++- include/pm3_cmd.h | 6 + 5 files changed, 416 insertions(+), 14 deletions(-) diff --git a/client/src/cmdhfmfp.c b/client/src/cmdhfmfp.c index e72799bc4..7d9c077fb 100644 --- a/client/src/cmdhfmfp.c +++ b/client/src/cmdhfmfp.c @@ -233,6 +233,7 @@ static int plus_print_version(uint8_t *version) { PrintAndLogEx(SUCCESS, " Production date: week " _GREEN_("%02x") " / " _GREEN_("20%02x"), version[7 + 7 + 7 + 5], version[7 + 7 + 7 + 5 + 1]); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(INFO, "--- " _CYAN_("Hardware Information")); + PrintAndLogEx(INFO, " Raw : %s", sprint_hex(version, 7)); PrintAndLogEx(INFO, " Vendor Id: " _YELLOW_("%s"), getTagInfo(version[0])); PrintAndLogEx(INFO, " Type: %s", getTypeStr(version[1])); PrintAndLogEx(INFO, " Subtype: " _YELLOW_("0x%02X"), version[2]); @@ -241,6 +242,7 @@ static int plus_print_version(uint8_t *version) { PrintAndLogEx(INFO, " Protocol: %s", getProtocolStr(version[6], true)); PrintAndLogEx(NORMAL, ""); PrintAndLogEx(INFO, "--- " _CYAN_("Software Information")); + PrintAndLogEx(INFO, " Raw : %s", sprint_hex(version + 7, 6)); PrintAndLogEx(INFO, " Vendor Id: " _YELLOW_("%s"), getTagInfo(version[7])); PrintAndLogEx(INFO, " Type: %s", getTypeStr(version[8])); PrintAndLogEx(INFO, " Subtype: " _YELLOW_("0x%02X"), version[9]); @@ -265,13 +267,21 @@ static int get_plus_version(uint8_t *version, int *version_len) { static int CmdHFMFPInfo(const char *Cmd) { - if (Cmd && strlen(Cmd) > 0) - PrintAndLogEx(WARNING, "command don't have any parameters.\n"); - PrintAndLogEx(NORMAL, ""); PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------"); PrintAndLogEx(INFO, "-------------------------------------------------------------"); + // Mifare Plus info + SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT, 0, 0, NULL, 0); + PacketResponseNG resp; + WaitForResponse(CMD_ACK, &resp); + + iso14a_card_select_t card; + memcpy(&card, (iso14a_card_select_t *)resp.data.asBytes, sizeof(iso14a_card_select_t)); + + uint64_t select_status = resp.oldarg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision + + bool supportVersion = false; bool supportSignature = false; @@ -284,17 +294,11 @@ static int CmdHFMFPInfo(const char *Cmd) { } else { // info about 14a part infoHF14A(false, false, false); + + // Historical bytes. + } - // Mifare Plus info - SendCommandMIX(CMD_HF_ISO14443A_READER, ISO14A_CONNECT, 0, 0, NULL, 0); - PacketResponseNG resp; - WaitForResponse(CMD_ACK, &resp); - - iso14a_card_select_t card; - memcpy(&card, (iso14a_card_select_t *)resp.data.asBytes, sizeof(iso14a_card_select_t)); - - uint64_t select_status = resp.oldarg[0]; // 0: couldn't read, 1: OK, with ATS, 2: OK, no ATS, 3: proprietary Anticollision // Signature originality check uint8_t signature[56] = {0}; diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c index 68b5fdf40..22da51558 100644 --- a/client/src/cmdhw.c +++ b/client/src/cmdhw.c @@ -22,6 +22,7 @@ #include "cmdhw.h" #include "cmddata.h" #include "commonutil.h" +#include "pm3_cmd.h" static int CmdHelp(const char *Cmd); @@ -516,6 +517,32 @@ static int CmdStatus(const char *Cmd) { return PM3_SUCCESS; } +int handle_tearoff(tearoff_params_t *params, bool verbose) { + + if (params == NULL) + return PM3_EINVARG; + + clearCommandBuffer(); + SendCommandNG(CMD_SET_TEAROFF, (uint8_t *)params, sizeof(tearoff_params_t)); + PacketResponseNG resp; + if (WaitForResponseTimeout(CMD_SET_TEAROFF, &resp, 500) == false) { + PrintAndLogEx(WARNING, "Tear-off command timeout."); + return PM3_ETIMEOUT; + } + + if (resp.status == PM3_SUCCESS) { + if (params->delay_us > 0 && verbose) + PrintAndLogEx(INFO, "Tear-off hook configured with delay of " _GREEN_("%i us"), params->delay_us); + + if (params->on && verbose) + PrintAndLogEx(INFO, "Tear-off hook " _GREEN_("enabled")); + + if (params->off && verbose) + PrintAndLogEx(INFO, "Tear-off hook " _RED_("disabled")); + } + return resp.status; +} + static int CmdTearoff(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "hw tearoff", diff --git a/client/src/cmdhw.h b/client/src/cmdhw.h index bf40b70a8..4b48eb840 100644 --- a/client/src/cmdhw.h +++ b/client/src/cmdhw.h @@ -12,9 +12,11 @@ #define CMDHW_H__ #include "common.h" +#include "pm3_cmd.h" int CmdHW(const char *Cmd); +int handle_tearoff(tearoff_params_t *params, bool verbose); void pm3_version(bool verbose, bool oneliner); #endif diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 00019a569..7ffbc4824 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -32,6 +32,7 @@ #include "lfdemod.h" #include "generator.h" #include "cliparser.h" +#include "cmdhw.h" static uint64_t g_em410xid = 0; @@ -715,7 +716,7 @@ static bool EM_ColParityTest(uint8_t *bs, size_t size, uint8_t rows, uint8_t col static bool downloadSamplesEM(void) { // 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples) - uint8_t got[6000]; + uint8_t got[5500]; if (!GetFromDevice(BIG_BUF, got, sizeof(got), 0, NULL, 0, NULL, 2500, false)) { PrintAndLogEx(WARNING, "(downloadSamplesEM) command execution time out"); return false; @@ -1413,10 +1414,11 @@ static void printEM4x05info(uint32_t block0, uint32_t serial) { // 7,8, rfu // 9 - 18 customer code // 19, rfu - + 98765432109876543210 001000000000 // 00100000000001111000 + xxx---- // 1100 // 011 // 00100000000 @@ -1643,6 +1645,366 @@ static int CmdEM4x05Chk(const char *Cmd) { return PM3_SUCCESS; } + +static int unlock_write_protect(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { + + struct { + uint32_t password; + uint32_t data; + uint8_t usepwd; + } PACKED payload; + + payload.password = pwd; + payload.data = data; + payload.usepwd = use_pwd; + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X_PROTECTWORD, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (WaitForResponseTimeout(CMD_LF_EM4X_PROTECTWORD, &resp, 2000) == false) { + PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); + return PM3_ETIMEOUT; + } + + if (!downloadSamplesEM()) + return PM3_ENODATA; + + uint32_t dummy = 0; + int status = demodEM4x05resp(&dummy, true); + if (status == PM3_SUCCESS && verbose) + PrintAndLogEx(SUCCESS, "Success writing to tag"); + else if (status == PM3_EFAILED) + PrintAndLogEx(ERR, "Tag denied PROTECT operation"); + else + PrintAndLogEx(DEBUG, "No answer from tag"); + + return status; +} +static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data) { + PrintAndLogEx(FAILED, "resetting the " _RED_("active") " lock block"); + return unlock_write_protect(use_pwd, pwd, data, false); +} + +static int CmdEM4x05Unlock(const char *Cmd) { + + CLIParserContext *ctx; + CLIParserInit(&ctx, "lf em 4x05_unlock", + "execute tear off against EM4205/4305/4469/4569", + "lf em 4x05_unlock\n" + "lf em 4x05_unlock -s 4100 -e 4100 -> lock on and autotune at 4100us\n" + "lf em 4x05_unlock -n 10 -s 3000 -e 4400 -> scan delays 3000us -> 4400us" + ); + + void *argtable[] = { + arg_param_begin, + arg_u64_0("n", NULL, NULL, "steps to skip"), + arg_u64_0("s", "start", "", "start scan from delay (us)"), + arg_u64_0("e", "end", "", "end scan at delay (us)"), + arg_u64_0("p", "pwd", "", "password (0x00000000)"), + arg_lit0("v", "verbose", "verbose output"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); + + uint64_t n = arg_get_u64_def(ctx, 1, 10); + uint64_t start = arg_get_u64_def(ctx, 2, 2000); + uint64_t end = arg_get_u64_def(ctx, 3, 6000); + uint64_t inputpwd = arg_get_u64_def(ctx, 4, 0xFFFFFFFFFFFFFFFF); + bool verbose = arg_get_lit(ctx, 5); + CLIParserFree(ctx); + + if (session.pm3_present == false) { + PrintAndLogEx(WARNING, "device offline\n"); + return PM3_ENODATA; + } + + bool use_pwd = false; + uint32_t pwd = 0; + if (inputpwd != 0xFFFFFFFFFFFFFFFF) { + use_pwd = true; + pwd = inputpwd & 0xFFFFFFFF; + } + + uint32_t search_value = 0; + uint32_t write_value = 0; + // + // inital phase + // + // read word 14 + uint32_t init_14 = 0; + int res = EM4x05ReadWord_ext(14, pwd, use_pwd, &init_14); + if (res != PM3_SUCCESS) { + PrintAndLogEx(FAILED, "failed to read word 14\n"); + return PM3_ENODATA; + } + + + // read 15 + uint32_t init_15 = 0; + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &init_15); + if (res != PM3_SUCCESS) { + PrintAndLogEx(FAILED, "failed to read word 15\n"); + return PM3_ENODATA; + } + + +#define UNLOCK_WORD 0x00008000 + if (init_15 == UNLOCK_WORD) { + PrintAndLogEx(SUCCESS, "Tag already fully unlocked, nothing to do"); + return PM3_SUCCESS; + } + +#define ACTIVE_MASK 0x00008000 + if ((init_15 & ACTIVE_MASK) == ACTIVE_MASK) { + search_value = init_15; + } else { + search_value = init_14; + } + + + bool my_auto = false; + if (n == 0) { + my_auto = true; + n = (end - start) / 2; + } else { + if ( start > end ) { + PrintAndLogEx(FAILED, "start delay can\'t be larger than end delay %u vs %u", start, end); + return PM3_EINVARG; + } + } + + // fix at one specific delay + if (start == end) { + n = 0; + } + + PrintAndLogEx(INFO, "--------------- " _CYAN_("EM4x05 tear-off : target PROTECT") " -----------------------\n"); + + PrintAndLogEx(INFO, " Word 14,15 inital [ " _GREEN_("%08"PRIX32) ", " _GREEN_("%08"PRIX32) " ]", init_14, init_15); + + if (use_pwd) { + PrintAndLogEx(INFO, " target password [ " _GREEN_("%08"PRIX32) " ]", pwd); + } + if (my_auto) { + PrintAndLogEx(INFO, " automatic mode [ " _GREEN_("enabled") " ]"); + } + + PrintAndLogEx(INFO, " target stepping [ " _GREEN_("%u") " ]", n); + PrintAndLogEx(INFO, "target delay range [ " _GREEN_("%"PRIu32) " ... " _GREEN_("%"PRIu32) " ]", start, end); + PrintAndLogEx(INFO, " search value [ " _GREEN_("%08"PRIX32) " ]", search_value); + PrintAndLogEx(INFO, " write value [ " _GREEN_("%08"PRIX32) " ]", write_value); + + PrintAndLogEx(INFO, "----------------------------------------------------------------------------\n"); + PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); + + int exit_code = PM3_SUCCESS; + uint32_t word14 = 0, word15 = 0; + uint32_t tries = 0; + uint32_t soon = 0; + uint32_t late = 0; + // + // main loop + // + //uint32_t prev_delay = 0; + + uint64_t t1 = msclock(); + while (start <= end) { + + if (my_auto && n < 1) { + PrintAndLogEx(INFO, "Reached n < 1 => " _YELLOW_("disabling automatic mode")); + end = start; + my_auto = false; + n = 0; + } + + if (my_auto == false) { + start += n; + } + + if (tries >= 5 && n == 0 && soon != late) { + + if (soon > late) { + PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust +1us >> %u us"), tries, soon, late, start); + start++; + end++; + } else { + PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust -1us >> %u us"), tries, soon, late, start); + start--; + end--; + } + tries = 0; + soon = 0; + late = 0; + } + + + + if (is_cancelled()) { + exit_code = PM3_EOPABORTED; + break; + } + + /* + if ( start != prev_delay) { + PrintAndLogEx(INFO, "Tear-off delay hook configured => " _GREEN_("%u us"), start); + prev_delay = start; + } + */ + + // set tear off trigger + clearCommandBuffer(); + tearoff_params_t params = { + .delay_us = start, + .on = true, + .off = false + }; + res = handle_tearoff(¶ms, verbose); + if ( res != PM3_SUCCESS ) { + PrintAndLogEx(WARNING, "failed to configure tear off"); + return PM3_EOPABORTED; + } + + // write + res = unlock_write_protect(use_pwd, pwd, write_value, verbose); + + // read after trigger + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); + if (res == PM3_SUCCESS) { + //PrintAndLogEx(INFO, "14 after [ " _GREEN_("%08"PRIX32) " ]", word14); + } else { + continue; + } + + // read after trigger + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); + if (res == PM3_SUCCESS) { + //PrintAndLogEx(INFO, "15 after [ " _GREEN_("%08"PRIX32) " ]", word15); + } else { + continue; + } + + PrintAndLogEx(INFO, "ref:%08X 14:%08X 15:%08X ", search_value, word14, word15); + + if ( word14 == search_value && word15 == 0) { + PrintAndLogEx(INFO, "Status: Nothing happened => " _GREEN_("tearing too soon")); + + if (my_auto) { + start += n; + n /= 2; + PrintAndLogEx(INFO, "Adjusting params: n %i start %i end %i", n, start, end); + } else { + soon++; + } + } else { + + if (word15 == search_value) { + + if (word14 == 0) { + PrintAndLogEx(INFO, "Status: Protect succeeded => " _GREEN_("tearing too late")); + } else { + if ( word14 == search_value) { + PrintAndLogEx(INFO, "Status: 15 ok, 14 not yet erased => " _GREEN_("tearing too late")); + } else { + PrintAndLogEx(INFO, "Status: 15 ok, 14 partially erased => " _GREEN_("tearing too late")); + } + } + unlock_reset(use_pwd, pwd, write_value); + + // read after reset + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); + if (res != PM3_SUCCESS) { + continue; + } + + if (word14 == 0) { + unlock_reset(use_pwd, pwd, write_value); + } + + if (word14 != search_value) { + + // read after reset + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); + if (res == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14, word15); + break; + } else { + continue; + } + } + if (my_auto) { + end = start; + start -= n; + n /= 2; + PrintAndLogEx(INFO, "Adjusting params: n %i start %i end %i", n, start, end); + } else { + late++; + } + + } else { + + if (( word15 & ACTIVE_MASK) == ACTIVE_MASK) { + + PrintAndLogEx(INFO, "Status: 15 bitflipped and active => " _RED_("SUCCESS?: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); + PrintAndLogEx(INFO, "Committing results..."); + + unlock_reset(use_pwd, pwd, write_value); + // read after reset + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); + if ( res != PM3_SUCCESS ) { + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_EOPABORTED; + } + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); + if ( res != PM3_SUCCESS ) { + PrintAndLogEx(WARNING, "failed to read 15"); + return PM3_EOPABORTED; + } + + PrintAndLogEx(INFO, "ref:%08x 14:%08X 15:%08X", search_value, word14, word15); + + if ((word14 & ACTIVE_MASK) == ACTIVE_MASK) { + + if (word14 == word15) { + PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14, word15); + break; + } + + if (word14 != search_value) { + PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14, word15); + break; + } + + PrintAndLogEx(INFO, "Status: failed to commit bitflip => " _RED_("FAIL: ") "14: %08X 15: %08X", word14, word15); + } else { + PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); + + } + + if (my_auto) { + n = 0; + end = start; + } else { + tries = 0; + soon = 0; + late = 0; + } + } + } + } + + if (my_auto == false) { + tries++; + } + } + + PrintAndLogEx(INFO, "----------------------------- " _CYAN_("exit") " ----------------------------------\n"); + t1 = msclock() - t1; + PrintAndLogEx(SUCCESS, "\ntime in unlock " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); + PrintAndLogEx(INFO, "try " _YELLOW_("`lf em 4x05_dump`")); + PrintAndLogEx(NORMAL, ""); + return exit_code; +} + static command_t CommandTable[] = { {"help", CmdHelp, AlwaysAvailable, "This help"}, {"----------", CmdHelp, AlwaysAvailable, "----------------------- " _CYAN_("EM 410x") " -----------------------"}, @@ -1662,6 +2024,7 @@ static command_t CommandTable[] = { {"4x05_info", CmdEM4x05Info, IfPm3Lf, "tag information EM4x05/EM4x69"}, {"4x05_read", CmdEM4x05Read, IfPm3Lf, "read word data from EM4x05/EM4x69"}, {"4x05_write", CmdEM4x05Write, IfPm3Lf, "write word data to EM4x05/EM4x69"}, + {"4x05_unlock", CmdEM4x05Unlock, IfPm3Lf, "execute tear off against EM4x05/EM4x69"}, {"----------", CmdHelp, AlwaysAvailable, "----------------------- " _CYAN_("EM 4x50") " -----------------------"}, {"4x50_dump", CmdEM4x50Dump, IfPm3EM4x50, "dump EM4x50 tag"}, {"4x50_info", CmdEM4x50Info, IfPm3EM4x50, "tag information EM4x50"}, diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index a473eb7f3..6fca06786 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -375,6 +375,12 @@ typedef struct { } PACKED picopass_ns_hdr; +typedef struct { + uint16_t delay_us; + bool on; + bool off; +} PACKED tearoff_params_t; + // For the bootloader #define CMD_DEVICE_INFO 0x0000 //#define CMD_SETUP_WRITE 0x0001 From 4ba31596d5f432b2b3496efcb3643cdbe5422a8e Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 19:30:49 +0200 Subject: [PATCH 013/125] adapt some tag identification of ats historical bytes --- client/src/cmdhf14a.c | 44 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 4 deletions(-) diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c index 2b65be89c..e9ddbf6c5 100644 --- a/client/src/cmdhf14a.c +++ b/client/src/cmdhf14a.c @@ -1831,11 +1831,47 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) { if (card.ats[0] > pos && card.ats[0] < card.ats_len - 2) { const char *tip = ""; if (card.ats[0] - pos >= 7) { - if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) { - tip = "-> MIFARE Plus X 2K or 4K"; - } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { - tip = "-> MIFARE Plus S 2K or 4K"; + + if ((card.sak & 0x70) == 0x40) { // and no GetVersion().. + + if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) { + tip = "-> MIFARE Plus X 2K/4K (SL3)"; + } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { + + if ((card.atqa[0] & 0x02) == 0x02) + tip = "-> MIFARE Plus S 2K (SL3)"; + else if ((card.atqa[0] & 0x04) == 0x04) + tip = "-> MIFARE Plus S 4K (SL3)"; + + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x00\xF6\xD1", 7) == 0) { + tip = "-> MIFARE Plus SE 1K (17pF)"; + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x10\xF6\xD1", 7) == 0) { + tip = "-> MIFARE Plus SE 1K (70pF)"; + } + + } else { //SAK B4,5,6 + + if ((card.sak & 0x20) == 0x20) { // and no GetVersion().. + + + if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) { + tip = "-> MIFARE Plus X 2K (SL1)"; + } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { + tip = "-> MIFARE Plus S 2K (SL1)"; + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x00\xF6\xD1", 7) == 0) { + tip = "-> MIFARE Plus SE 1K (17pF)"; + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x10\xF6\xD1", 7) == 0) { + tip = "-> MIFARE Plus SE 1K (70pF)"; + } + } else { + if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) { + tip = "-> MIFARE Plus X 4K (SL1)"; + } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { + tip = "-> MIFARE Plus S 4K (SL1)"; + } + } } + } PrintAndLogEx(SUCCESS, " - HB : %s%s", sprint_hex(card.ats + pos, card.ats[0] - pos), tip); if (card.ats[pos] == 0xC1) { From 8bb762dc5b067e23854f678b7dfb7cf609ffc7a4 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 19:31:33 +0200 Subject: [PATCH 014/125] structs must be PACKED --- include/em4x50.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/em4x50.h b/include/em4x50.h index b70072c32..4542e7bec 100644 --- a/include/em4x50.h +++ b/include/em4x50.h @@ -49,7 +49,7 @@ typedef struct { uint8_t addresses[4]; uint8_t address; uint8_t word[4]; -} em4x50_data_t; +} PACKED em4x50_data_t; typedef struct { uint8_t byte[4]; @@ -60,6 +60,6 @@ typedef struct { bool cparity[8]; bool stopparity; bool parity; -} em4x50_word_t; +} PACKED em4x50_word_t; #endif /* EM4X50_H__ */ From df5c635a7d3c999c07f7e81d5bd666aa4f3fed52 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 19:38:49 +0200 Subject: [PATCH 015/125] hook up 4x50 read for lua --- client/src/scripting.c | 73 +++++++++++++++++++++++++++++++++++++++--- 1 file changed, 68 insertions(+), 5 deletions(-) diff --git a/client/src/scripting.c b/client/src/scripting.c index 050b4147b..90e19151c 100644 --- a/client/src/scripting.c +++ b/client/src/scripting.c @@ -37,6 +37,8 @@ #include "cmdlf.h" // lf_config #include "generator.h" #include "cmdlfem4x.h" // read 4305 +#include "cmdlfem4x50.h" // read 4350 +#include "em4x50.h" // 4x50 structs static int returnToLuaWithError(lua_State *L, const char *fmt, ...) { char buffer[200]; @@ -1088,7 +1090,7 @@ static int l_T55xx_detect(lua_State *L) { return 2; } -// +// 4305 static int l_em4x05_read(lua_State *L) { bool use_pwd = false; @@ -1103,12 +1105,12 @@ static int l_em4x05_read(lua_State *L) { sscanf(p_addr, "%u", &addr); // get password - const char *p_pwd = luaL_checklstring(L, 2, &size); - if (size == 0) { + const char *p_pwd = luaL_checkstring(L, 2); + if (p_pwd == NULL || strlen(p_pwd) == 0 ) { use_pwd = false; } else { - if (size != 8) - return returnToLuaWithError(L, "Wrong size of password, got %zu , expected 8", size); + if (strlen(p_pwd) != 8) + return returnToLuaWithError(L, "Wrong size of password, got %zu , expected 8", strlen(p_pwd)); sscanf(p_pwd, "%08x", &password); use_pwd = true; @@ -1128,6 +1130,66 @@ static int l_em4x05_read(lua_State *L) { return 1; } +// 4350 +static int l_em4x50_read(lua_State *L) { + + // get addr + size_t size = 0; + const char *p_addr = luaL_checklstring(L, 1, &size); + uint32_t addr = 0; + sscanf(p_addr, "%u", &addr); + + if (addr > 33) + return returnToLuaWithError(L, "Address out-of-range (0..33) got %zu", addr); + + // setting up structures + em4x50_data_t etd; + memset(&etd, 0x00, sizeof(em4x50_data_t)); + etd.addr_given = true; + etd.address = addr & 0xFF; + etd.newpwd_given = false; + + // get password + const char *p_pwd = luaL_checkstring(L, 2); + if (p_pwd == NULL || strlen(p_pwd) == 0) { + etd.pwd_given = false; + } else { + if (strlen(p_pwd) != 8) + return returnToLuaWithError(L, "Wrong size of password, got %zu , expected 8", strlen(p_pwd)); + + uint32_t pwd = 0; + sscanf(p_pwd, "%08x", &pwd); + + PrintAndLogEx(DEBUG, " Pwd %08X", pwd); + + etd.password[0] = pwd & 0xFF; + etd.password[1] = (pwd >> 8) & 0xFF; + etd.password[2] = (pwd >> 16) & 0xFF; + etd.password[3] = (pwd >> 24) & 0xFF; + etd.pwd_given = true; + } + + PrintAndLogEx(DEBUG, "Addr %u", etd.address); + if (etd.pwd_given) + PrintAndLogEx(DEBUG, " Pwd %08X", etd.password); + + em4x50_word_t words[EM4X50_NO_WORDS]; + + int res = em4x50_read(&etd, words, false); + if (res != PM3_SUCCESS) { + return returnToLuaWithError(L, "Failed to read EM4x50 data"); + } + + uint32_t word = ( + words[etd.address].byte[0] << 24 | + words[etd.address].byte[1] << 16 | + words[etd.address].byte[2] << 8 | + words[etd.address].byte[3] + ); + lua_pushinteger(L, word); + return 1; +} + // static int l_ndefparse(lua_State *L) { @@ -1320,6 +1382,7 @@ int set_pm3_libraries(lua_State *L) { {"ud", l_ud}, {"rem", l_remark}, {"em4x05_read", l_em4x05_read}, + {"em4x50_read", l_em4x50_read}, {NULL, NULL} }; From e4967ac654ebe07b701b086dec49170af0ce8196 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Thu, 15 Oct 2020 20:06:27 +0200 Subject: [PATCH 016/125] use handle --- client/src/cmdhw.c | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-) diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c index 22da51558..f2eff6966 100644 --- a/client/src/cmdhw.c +++ b/client/src/cmdhw.c @@ -539,7 +539,8 @@ int handle_tearoff(tearoff_params_t *params, bool verbose) { if (params->off && verbose) PrintAndLogEx(INFO, "Tear-off hook " _RED_("disabled")); - } + } else if (verbose) + PrintAndLogEx(WARNING, "Tear-off command failed."); return resp.status; } @@ -563,11 +564,7 @@ static int CmdTearoff(const char *Cmd) { }; CLIExecWithReturn(ctx, Cmd, argtable, false); - struct { - uint16_t delay_us; - bool on; - bool off; - } PACKED params; + tearoff_params_t params; int delay = arg_get_int_def(ctx, 1, -1); params.on = arg_get_lit(ctx, 2); params.off = arg_get_lit(ctx, 3); @@ -589,29 +586,7 @@ static int CmdTearoff(const char *Cmd) { return PM3_EINVARG; } - clearCommandBuffer(); - SendCommandNG(CMD_SET_TEAROFF, (uint8_t *)¶ms, sizeof(params)); - PacketResponseNG resp; - - if (WaitForResponseTimeout(CMD_SET_TEAROFF, &resp, 500) == false) { - PrintAndLogEx(WARNING, "Tear-off command timeout."); - return PM3_ETIMEOUT; - } - - if (resp.status == PM3_SUCCESS) { - if (params.delay_us > 0) - PrintAndLogEx(INFO, "Tear-off hook configured with delay of " _GREEN_("%i us"), params.delay_us); - if (params.on && silent == false) - PrintAndLogEx(INFO, "Tear-off hook " _GREEN_("enabled")); - if (params.off && silent == false) - PrintAndLogEx(INFO, "Tear-off hook " _RED_("disabled")); - return PM3_SUCCESS; - } - - if (silent == false) - PrintAndLogEx(WARNING, "Tear-off command failed."); - - return resp.status; + return handle_tearoff(¶ms, !silent); } static int CmdTia(const char *Cmd) { From 6872095b978807ff01d610ea4cd178de9f0baf69 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 20:10:56 +0200 Subject: [PATCH 017/125] qt session management error --- doc/md/Installation_Instructions/Troubleshooting.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/doc/md/Installation_Instructions/Troubleshooting.md b/doc/md/Installation_Instructions/Troubleshooting.md index da41d56bd..17161ed09 100644 --- a/doc/md/Installation_Instructions/Troubleshooting.md +++ b/doc/md/Installation_Instructions/Troubleshooting.md @@ -22,6 +22,7 @@ Always use the latest repository commits from *master* branch. There are always * [Troubles with running the Proxmark3 client](#troubles-with-running-the-proxmark3-client) * [libQt5Core.so.5 not found](#libQt5Coreso5-not-found) * [Target attribute is not supported on this machine](#target-attribute-is-not-supported-on-this-machine) + * [Qt: Session management error:](#qt-session-management-error) ## `pm3` or `pm3-flash*` doesn't see my Proxmark @@ -222,4 +223,16 @@ ticks.h:26:1: error: target attribute is not supported on this machine [-Werror= ^ ``` +## Qt Session management error +If you get the message +``` +Qt: Session management error: None of the authentication protocols specified are supported +``` when running the Proxmark3 client it might be because a a environment variable. + +Solution: +Try running the client without the SESSION_MANAGER environment variable. + +``` +env -u SESSION_MANAGER ./pm3 +``` \ No newline at end of file From 03d994ea2cdaebf0172406cfae067485e3724ed6 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Thu, 15 Oct 2020 22:01:19 +0200 Subject: [PATCH 018/125] em stuff --- client/luascripts/lf_em_tearoff_protect.lua | 2 +- client/src/cmdlfem4x.c | 123 ++++++++++---------- 2 files changed, 62 insertions(+), 63 deletions(-) diff --git a/client/luascripts/lf_em_tearoff_protect.lua b/client/luascripts/lf_em_tearoff_protect.lua index 49ee99cec..04cb7d0b5 100644 --- a/client/luascripts/lf_em_tearoff_protect.lua +++ b/client/luascripts/lf_em_tearoff_protect.lua @@ -36,7 +36,7 @@ arguments = [[ end ]] -local set_tearoff_delay = 'hw tearoff -s --on --delay %d' +local set_tearoff_delay = 'hw tearoff --on --delay %d' local wr_template = 'lf em 4x05_write %s %s %s' --- diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 7ffbc4824..616b4be8f 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1681,7 +1681,7 @@ static int unlock_write_protect(bool use_pwd, uint32_t pwd, uint32_t data, bool return status; } static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data) { - PrintAndLogEx(FAILED, "resetting the " _RED_("active") " lock block"); + PrintAndLogEx(INFO, "resetting the " _RED_("active") " lock block"); return unlock_write_protect(use_pwd, pwd, data, false); } @@ -1697,22 +1697,26 @@ static int CmdEM4x05Unlock(const char *Cmd) { void *argtable[] = { arg_param_begin, - arg_u64_0("n", NULL, NULL, "steps to skip"), - arg_u64_0("s", "start", "", "start scan from delay (us)"), - arg_u64_0("e", "end", "", "end scan at delay (us)"), + arg_int0("n", NULL, NULL, "steps to skip"), + arg_int0("s", "start", "", "start scan from delay (us)"), + arg_int0("e", "end", "", "end scan at delay (us)"), arg_u64_0("p", "pwd", "", "password (0x00000000)"), arg_lit0("v", "verbose", "verbose output"), arg_param_end }; - CLIExecWithReturn(ctx, Cmd, argtable, false); - - uint64_t n = arg_get_u64_def(ctx, 1, 10); - uint64_t start = arg_get_u64_def(ctx, 2, 2000); - uint64_t end = arg_get_u64_def(ctx, 3, 6000); + CLIExecWithReturn(ctx, Cmd, argtable, true); + double n = (double)arg_get_int_def(ctx, 1, 0); + double start = (double)arg_get_int_def(ctx, 2, 2000); + double end = (double)arg_get_int_def(ctx, 3, 6000); uint64_t inputpwd = arg_get_u64_def(ctx, 4, 0xFFFFFFFFFFFFFFFF); bool verbose = arg_get_lit(ctx, 5); CLIParserFree(ctx); + if ( start > end ) { + PrintAndLogEx(FAILED, "start delay can\'t be larger than end delay %.0lf vs %.0lf", start, end); + return PM3_EINVARG; + } + if (session.pm3_present == false) { PrintAndLogEx(WARNING, "device offline\n"); return PM3_ENODATA; @@ -1726,7 +1730,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { } uint32_t search_value = 0; - uint32_t write_value = 0; + uint32_t write_value = 0xFFFF0000; // // inital phase // @@ -1747,13 +1751,6 @@ static int CmdEM4x05Unlock(const char *Cmd) { return PM3_ENODATA; } - -#define UNLOCK_WORD 0x00008000 - if (init_15 == UNLOCK_WORD) { - PrintAndLogEx(SUCCESS, "Tag already fully unlocked, nothing to do"); - return PM3_SUCCESS; - } - #define ACTIVE_MASK 0x00008000 if ((init_15 & ACTIVE_MASK) == ACTIVE_MASK) { search_value = init_15; @@ -1761,16 +1758,15 @@ static int CmdEM4x05Unlock(const char *Cmd) { search_value = init_14; } + if (search_value == ACTIVE_MASK) { + PrintAndLogEx(SUCCESS, "Tag already fully unlocked, nothing to do"); + return PM3_SUCCESS; + } bool my_auto = false; if (n == 0) { my_auto = true; n = (end - start) / 2; - } else { - if ( start > end ) { - PrintAndLogEx(FAILED, "start delay can\'t be larger than end delay %u vs %u", start, end); - return PM3_EINVARG; - } } // fix at one specific delay @@ -1780,19 +1776,19 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "--------------- " _CYAN_("EM4x05 tear-off : target PROTECT") " -----------------------\n"); - PrintAndLogEx(INFO, " Word 14,15 inital [ " _GREEN_("%08"PRIX32) ", " _GREEN_("%08"PRIX32) " ]", init_14, init_15); + PrintAndLogEx(INFO, "initial prot 14&15 [ " _GREEN_("%08X") ", " _GREEN_("%08X") " ]", init_14, init_15); if (use_pwd) { - PrintAndLogEx(INFO, " target password [ " _GREEN_("%08"PRIX32) " ]", pwd); + PrintAndLogEx(INFO, " target password [ " _GREEN_("%08"PRIX64) " ]", pwd); } if (my_auto) { PrintAndLogEx(INFO, " automatic mode [ " _GREEN_("enabled") " ]"); } - PrintAndLogEx(INFO, " target stepping [ " _GREEN_("%u") " ]", n); - PrintAndLogEx(INFO, "target delay range [ " _GREEN_("%"PRIu32) " ... " _GREEN_("%"PRIu32) " ]", start, end); - PrintAndLogEx(INFO, " search value [ " _GREEN_("%08"PRIX32) " ]", search_value); - PrintAndLogEx(INFO, " write value [ " _GREEN_("%08"PRIX32) " ]", write_value); + PrintAndLogEx(INFO, " target stepping [ " _GREEN_("%.0lf") " ]", n); + PrintAndLogEx(INFO, "target delay range [ " _GREEN_("%.0lf") " ... " _GREEN_("%.0lf") " ]", start, end); + PrintAndLogEx(INFO, " search value [ " _GREEN_("%08X") " ]", search_value); + PrintAndLogEx(INFO, " write value [ " _GREEN_("%08X") " ]", write_value); PrintAndLogEx(INFO, "----------------------------------------------------------------------------\n"); PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); @@ -1824,11 +1820,11 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (tries >= 5 && n == 0 && soon != late) { if (soon > late) { - PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust +1us >> %u us"), tries, soon, late, start); + PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust +1 us >> %.0lf us"), tries, soon, late, start); start++; end++; } else { - PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust -1us >> %u us"), tries, soon, late, start); + PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust -1 us >> %.0lf us"), tries, soon, late, start); start--; end--; } @@ -1846,7 +1842,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { /* if ( start != prev_delay) { - PrintAndLogEx(INFO, "Tear-off delay hook configured => " _GREEN_("%u us"), start); + PrintAndLogEx(INFO, "Tear-off delay hook configured => " _GREEN_("%.0lf us"), start); prev_delay = start; } */ @@ -1870,7 +1866,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { // read after trigger res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); if (res == PM3_SUCCESS) { - //PrintAndLogEx(INFO, "14 after [ " _GREEN_("%08"PRIX32) " ]", word14); + //PrintAndLogEx(INFO, "14 after [ " _GREEN_("%08X") " ]", word14); } else { continue; } @@ -1878,20 +1874,21 @@ static int CmdEM4x05Unlock(const char *Cmd) { // read after trigger res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); if (res == PM3_SUCCESS) { - //PrintAndLogEx(INFO, "15 after [ " _GREEN_("%08"PRIX32) " ]", word15); + //PrintAndLogEx(INFO, "15 after [ " _GREEN_("%08X") " ]", word15); } else { continue; } - PrintAndLogEx(INFO, "ref:%08X 14:%08X 15:%08X ", search_value, word14, word15); + if (verbose) + PrintAndLogEx(INFO, "ref:%08X 14:%08X 15:%08X ", search_value, word14, word15); if ( word14 == search_value && word15 == 0) { PrintAndLogEx(INFO, "Status: Nothing happened => " _GREEN_("tearing too soon")); if (my_auto) { start += n; + PrintAndLogEx(INFO, " => " _CYAN_("adjust +%.0lf us >> %.0lf us"), n, start); n /= 2; - PrintAndLogEx(INFO, "Adjusting params: n %i start %i end %i", n, start, end); } else { soon++; } @@ -1909,23 +1906,23 @@ static int CmdEM4x05Unlock(const char *Cmd) { } } unlock_reset(use_pwd, pwd, write_value); - + uint32_t word14b = 0, word15b = 0; // read after reset - res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if (res != PM3_SUCCESS) { continue; } - if (word14 == 0) { + if (word14b == 0) { unlock_reset(use_pwd, pwd, write_value); } - if (word14 != search_value) { + if (word14b != search_value) { // read after reset - res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); if (res == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14, word15); + PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); break; } else { continue; @@ -1934,8 +1931,8 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (my_auto) { end = start; start -= n; + PrintAndLogEx(INFO, " => " _CYAN_("adjust -%.0lf us >> %.0lf us"), n, start); n /= 2; - PrintAndLogEx(INFO, "Adjusting params: n %i start %i end %i", n, start, end); } else { late++; } @@ -1948,46 +1945,48 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "Committing results..."); unlock_reset(use_pwd, pwd, write_value); + uint32_t word14b = 0, word15b = 0; // read after reset - res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if ( res != PM3_SUCCESS ) { PrintAndLogEx(WARNING, "failed to read 14"); return PM3_EOPABORTED; } - res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); if ( res != PM3_SUCCESS ) { PrintAndLogEx(WARNING, "failed to read 15"); return PM3_EOPABORTED; } - PrintAndLogEx(INFO, "ref:%08x 14:%08X 15:%08X", search_value, word14, word15); + if (verbose) + PrintAndLogEx(INFO, "ref:%08x 14:%08X 15:%08X", search_value, word14b, word15b); - if ((word14 & ACTIVE_MASK) == ACTIVE_MASK) { + if ((word14b & ACTIVE_MASK) == ACTIVE_MASK) { - if (word14 == word15) { - PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14, word15); + if (word14b == word15) { + PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); break; } - if (word14 != search_value) { - PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14, word15); + if (word14b != search_value) { + PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); break; } - PrintAndLogEx(INFO, "Status: failed to commit bitflip => " _RED_("FAIL: ") "14: %08X 15: %08X", word14, word15); - } else { - PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); - + PrintAndLogEx(INFO, "Status: failed to commit bitflip => " _RED_("FAIL: ") "14: %08X 15: %08X", word14b, word15b); } + } else { + PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); - if (my_auto) { - n = 0; - end = start; - } else { - tries = 0; - soon = 0; - late = 0; - } + } + + if (my_auto) { + n = 0; + end = start; + } else { + tries = 0; + soon = 0; + late = 0; } } } From 63a2d38191c32eac5ae7e7f5bd41dfa2c302e069 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Thu, 15 Oct 2020 22:05:18 +0200 Subject: [PATCH 019/125] fix debug val --- client/src/cmdlfem4x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 616b4be8f..b3d436d91 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1730,7 +1730,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { } uint32_t search_value = 0; - uint32_t write_value = 0xFFFF0000; + uint32_t write_value = 0; // // inital phase // From 17e5e721114edc0620d530a0c0742cb1c4848651 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 22:42:05 +0200 Subject: [PATCH 020/125] math const --- client/dictionaries/t55xx_default_pwds.dic | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/client/dictionaries/t55xx_default_pwds.dic b/client/dictionaries/t55xx_default_pwds.dic index c35014d79..cd03c7b7a 100644 --- a/client/dictionaries/t55xx_default_pwds.dic +++ b/client/dictionaries/t55xx_default_pwds.dic @@ -123,3 +123,7 @@ b5f44686 # seeds ul-ev1 C6EF3720 # TEA 7854794A # xbox tea constant :) F1EA5EED # burtle +69314718 # ln2 +57721566 # euler constant (dec) +93C467E3 # euler constant (hex) +27182818 # natural log \ No newline at end of file From f39131f5f05745232431ee412b412f4001a7d74c Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Thu, 15 Oct 2020 22:57:57 +0200 Subject: [PATCH 021/125] forgot to read back after reset --- client/luascripts/lf_em_tearoff_protect.lua | 4 ++++ client/src/cmdlfem4x.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/client/luascripts/lf_em_tearoff_protect.lua b/client/luascripts/lf_em_tearoff_protect.lua index 04cb7d0b5..7ab6f9314 100644 --- a/client/luascripts/lf_em_tearoff_protect.lua +++ b/client/luascripts/lf_em_tearoff_protect.lua @@ -250,6 +250,10 @@ local function main(args) local wordstr14b = ('%08X'):format(word14b) if (wordstr14b == '00000000') then reset(wr_value, password) + word14b, err14b = core.em4x05_read(14, password) + if err14b then + return oops(err14b) + end end if (wordstr14b ~= rd_value) then local word15b, err15b = core.em4x05_read(15, password) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index b3d436d91..a69c7894b 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1915,6 +1915,10 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (word14b == 0) { unlock_reset(use_pwd, pwd, write_value); + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); + if (res != PM3_SUCCESS) { + continue; + } } if (word14b != search_value) { From ab2d23268944b31d6ae36f1309bca5219526c80e Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Thu, 15 Oct 2020 23:31:03 +0200 Subject: [PATCH 022/125] em tuning --- client/src/cmdlfem4x.c | 39 ++++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index a69c7894b..29ab12287 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1802,7 +1802,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { // main loop // //uint32_t prev_delay = 0; - + bool success = false; uint64_t t1 = msclock(); while (start <= end) { @@ -1868,7 +1868,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (res == PM3_SUCCESS) { //PrintAndLogEx(INFO, "14 after [ " _GREEN_("%08X") " ]", word14); } else { - continue; + break; } // read after trigger @@ -1876,7 +1876,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (res == PM3_SUCCESS) { //PrintAndLogEx(INFO, "15 after [ " _GREEN_("%08X") " ]", word15); } else { - continue; + break; } if (verbose) @@ -1910,14 +1910,14 @@ static int CmdEM4x05Unlock(const char *Cmd) { // read after reset res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if (res != PM3_SUCCESS) { - continue; + break; } if (word14b == 0) { unlock_reset(use_pwd, pwd, write_value); res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if (res != PM3_SUCCESS) { - continue; + break; } } @@ -1927,10 +1927,9 @@ static int CmdEM4x05Unlock(const char *Cmd) { res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); if (res == PM3_SUCCESS) { PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); - break; - } else { - continue; + success = true; } + break; } if (my_auto) { end = start; @@ -1969,28 +1968,29 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (word14b == word15) { PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + success = true; break; } if (word14b != search_value) { PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + success = true; break; } PrintAndLogEx(INFO, "Status: failed to commit bitflip => " _RED_("FAIL: ") "14: %08X 15: %08X", word14b, word15b); } + if (my_auto) { + n = 0; + end = start; + } else { + tries = 0; + soon = 0; + late = 0; + } } else { PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); - - } - - if (my_auto) { - n = 0; - end = start; - } else { - tries = 0; - soon = 0; - late = 0; + soon ++; } } } @@ -2003,7 +2003,8 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "----------------------------- " _CYAN_("exit") " ----------------------------------\n"); t1 = msclock() - t1; PrintAndLogEx(SUCCESS, "\ntime in unlock " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); - PrintAndLogEx(INFO, "try " _YELLOW_("`lf em 4x05_dump`")); + if (success) + PrintAndLogEx(INFO, "try " _YELLOW_("`lf em 4x05_dump`")); PrintAndLogEx(NORMAL, ""); return exit_code; } From c454b1f3e61ae4599c6ff0e3d31a6b8f88bb11ec Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Thu, 15 Oct 2020 23:36:17 +0200 Subject: [PATCH 023/125] sync script --- client/luascripts/lf_em_tearoff_protect.lua | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/client/luascripts/lf_em_tearoff_protect.lua b/client/luascripts/lf_em_tearoff_protect.lua index 7ab6f9314..8d18ec5da 100644 --- a/client/luascripts/lf_em_tearoff_protect.lua +++ b/client/luascripts/lf_em_tearoff_protect.lua @@ -303,17 +303,17 @@ local function main(args) else print(('[=] Status: failed to commit => '..ansicolors.red..'FAIL: '..ansicolors.reset..'14: %08X 15: %08X'):format(word14b, word15b)) end + if auto then + n = 0 + ed = sd + else + tries = 0 + soon = 0 + late = 0 + end else print(('[=] Status: 15 bitflipped but inactive => '..ansicolors.yellow..'PROMISING: '..ansicolors.reset..'14: %08X 15: '..ansicolors.cyan..'%08X'..ansicolors.reset):format(word14, word15)) end - if auto then - n = 0 - ed = sd - else - tries = 0 - soon = 0 - late = 0 - end end end if not auto then From 275986e74398b7487f285bff427deda55cb65d57 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Thu, 15 Oct 2020 23:54:18 +0200 Subject: [PATCH 024/125] exits --- client/src/cmdlfem4x.c | 75 ++++++++++++++++++++++-------------------- 1 file changed, 40 insertions(+), 35 deletions(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 29ab12287..0f2d11431 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1680,8 +1680,10 @@ static int unlock_write_protect(bool use_pwd, uint32_t pwd, uint32_t data, bool return status; } -static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data) { - PrintAndLogEx(INFO, "resetting the " _RED_("active") " lock block"); +static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { + if (verbose) + PrintAndLogEx(INFO, "resetting the " _RED_("active") " lock block"); + return unlock_write_protect(use_pwd, pwd, data, false); } @@ -1776,7 +1778,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "--------------- " _CYAN_("EM4x05 tear-off : target PROTECT") " -----------------------\n"); - PrintAndLogEx(INFO, "initial prot 14&15 [ " _GREEN_("%08X") ", " _GREEN_("%08X") " ]", init_14, init_15); + PrintAndLogEx(INFO, "initial prot 14&15 [ " _GREEN_("%08X") ", " _GREEN_("%08X") " ]", init_14, init_15); if (use_pwd) { PrintAndLogEx(INFO, " target password [ " _GREEN_("%08"PRIX64) " ]", pwd); @@ -1791,8 +1793,11 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, " write value [ " _GREEN_("%08X") " ]", write_value); PrintAndLogEx(INFO, "----------------------------------------------------------------------------\n"); + PrintAndLogEx(NORMAL, ""); PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); - + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "--------------- " _CYAN_("start") " -----------------------\n"); + int exit_code = PM3_SUCCESS; uint32_t word14 = 0, word15 = 0; uint32_t tries = 0; @@ -1807,7 +1812,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { while (start <= end) { if (my_auto && n < 1) { - PrintAndLogEx(INFO, "Reached n < 1 => " _YELLOW_("disabling automatic mode")); + PrintAndLogEx(INFO, "Reached n < 1 => " _YELLOW_("disabling automatic mode")); end = start; my_auto = false; n = 0; @@ -1833,20 +1838,11 @@ static int CmdEM4x05Unlock(const char *Cmd) { late = 0; } - - if (is_cancelled()) { exit_code = PM3_EOPABORTED; break; } - - /* - if ( start != prev_delay) { - PrintAndLogEx(INFO, "Tear-off delay hook configured => " _GREEN_("%.0lf us"), start); - prev_delay = start; - } - */ - + // set tear off trigger clearCommandBuffer(); tearoff_params_t params = { @@ -1857,7 +1853,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { res = handle_tearoff(¶ms, verbose); if ( res != PM3_SUCCESS ) { PrintAndLogEx(WARNING, "failed to configure tear off"); - return PM3_EOPABORTED; + return PM3_ESOFT; } // write @@ -1865,18 +1861,16 @@ static int CmdEM4x05Unlock(const char *Cmd) { // read after trigger res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); - if (res == PM3_SUCCESS) { - //PrintAndLogEx(INFO, "14 after [ " _GREEN_("%08X") " ]", word14); - } else { - break; + if (res != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; } // read after trigger res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); - if (res == PM3_SUCCESS) { - //PrintAndLogEx(INFO, "15 after [ " _GREEN_("%08X") " ]", word15); - } else { - break; + if (res != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "failed to read 15"); + return PM3_ESOFT; } if (verbose) @@ -1900,36 +1894,45 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "Status: Protect succeeded => " _GREEN_("tearing too late")); } else { if ( word14 == search_value) { - PrintAndLogEx(INFO, "Status: 15 ok, 14 not yet erased => " _GREEN_("tearing too late")); + PrintAndLogEx(INFO, "Status: 15 ok, 14 not yet erased => " _GREEN_("tearing too late")); } else { - PrintAndLogEx(INFO, "Status: 15 ok, 14 partially erased => " _GREEN_("tearing too late")); + PrintAndLogEx(INFO, "Status: 15 ok, 14 partially erased => " _GREEN_("tearing too late")); } } - unlock_reset(use_pwd, pwd, write_value); + + unlock_reset(use_pwd, pwd, write_value, verbose); + uint32_t word14b = 0, word15b = 0; + // read after reset res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if (res != PM3_SUCCESS) { - break; + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; } if (word14b == 0) { - unlock_reset(use_pwd, pwd, write_value); + + unlock_reset(use_pwd, pwd, write_value, verbose); + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if (res != PM3_SUCCESS) { - break; + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; } } if (word14b != search_value) { - // read after reset res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); if (res == PM3_SUCCESS) { PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); success = true; + break; + } else { + PrintAndLogEx(WARNING, "failed to read 15"); + return PM3_ESOFT; } - break; } if (my_auto) { end = start; @@ -1947,18 +1950,20 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "Status: 15 bitflipped and active => " _RED_("SUCCESS?: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); PrintAndLogEx(INFO, "Committing results..."); - unlock_reset(use_pwd, pwd, write_value); + unlock_reset(use_pwd, pwd, write_value, verbose); uint32_t word14b = 0, word15b = 0; + // read after reset res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if ( res != PM3_SUCCESS ) { PrintAndLogEx(WARNING, "failed to read 14"); - return PM3_EOPABORTED; + return PM3_ESOFT; } + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); if ( res != PM3_SUCCESS ) { PrintAndLogEx(WARNING, "failed to read 15"); - return PM3_EOPABORTED; + return PM3_ESOFT; } if (verbose) From b589699c38cbac4cc6470a58399d3d29e04da43e Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Fri, 16 Oct 2020 00:11:52 +0200 Subject: [PATCH 025/125] em: show bitflips --- client/src/cmdlfem4x.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 0f2d11431..4e01c2466 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1800,6 +1800,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { int exit_code = PM3_SUCCESS; uint32_t word14 = 0, word15 = 0; + uint32_t word14b = 0, word15b = 0; uint32_t tries = 0; uint32_t soon = 0; uint32_t late = 0; @@ -1902,8 +1903,6 @@ static int CmdEM4x05Unlock(const char *Cmd) { unlock_reset(use_pwd, pwd, write_value, verbose); - uint32_t word14b = 0, word15b = 0; - // read after reset res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); if (res != PM3_SUCCESS) { @@ -1951,7 +1950,6 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "Committing results..."); unlock_reset(use_pwd, pwd, write_value, verbose); - uint32_t word14b = 0, word15b = 0; // read after reset res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); @@ -2008,8 +2006,17 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "----------------------------- " _CYAN_("exit") " ----------------------------------\n"); t1 = msclock() - t1; PrintAndLogEx(SUCCESS, "\ntime in unlock " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); - if (success) - PrintAndLogEx(INFO, "try " _YELLOW_("`lf em 4x05_dump`")); + if (success) { + uint32_t bitflips = search_value ^ word14b; + PrintAndLogEx(INFO, "Old protection word => " _YELLOW_("%08X"), search_value); + char bitstring[9] = {0}; + for (int i=0; i < 8; i++) { + bitstring[i] = bitflips & (0xF << ((7-i) * 4)) ? 'x' : '.'; + } + PrintAndLogEx(INFO, "Bitflips => %s", bitstring); + PrintAndLogEx(INFO, "New protection word => " _CYAN_("%08X") "\n", word14b); + PrintAndLogEx(INFO, "Try " _YELLOW_("`lf em 4x05_dump`")); + } PrintAndLogEx(NORMAL, ""); return exit_code; } From d4e6a5b7a6844b2539556521d6a28f3e2c6d6032 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Fri, 16 Oct 2020 01:30:08 +0200 Subject: [PATCH 026/125] em: display nr of flips --- client/src/cmdlfem4x.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 4e01c2466..db6979dfe 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -2013,7 +2013,12 @@ static int CmdEM4x05Unlock(const char *Cmd) { for (int i=0; i < 8; i++) { bitstring[i] = bitflips & (0xF << ((7-i) * 4)) ? 'x' : '.'; } - PrintAndLogEx(INFO, "Bitflips => %s", bitstring); + // compute number of bits flipped + uint32_t i = bitflips; + i = i - ((i >> 1) & 0x55555555); + i = (i & 0x33333333) + ((i >> 2) & 0x33333333); + i = (((i + (i >> 4)) & 0x0F0F0F0F) * 0x01010101) >> 24; + PrintAndLogEx(INFO, "Bitflips: %2u events => %s", i, bitstring); PrintAndLogEx(INFO, "New protection word => " _CYAN_("%08X") "\n", word14b); PrintAndLogEx(INFO, "Try " _YELLOW_("`lf em 4x05_dump`")); } From ffffa77dd9e4b7aee16a705ef99ce41631e730a5 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 07:49:51 +0200 Subject: [PATCH 027/125] some more stats --- client/src/cmdlfem4x.c | 52 +++++++++++++++++++++++++++++++++++++----- client/src/util.c | 37 ++++++++++++++++++++++++++++++ client/src/util.h | 5 ++++ 3 files changed, 88 insertions(+), 6 deletions(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index db6979dfe..1bcd5b244 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1645,6 +1645,10 @@ static int CmdEM4x05Chk(const char *Cmd) { return PM3_SUCCESS; } +typedef struct { + uint16_t cnt; + uint32_t value; +} em4x05_unlock_item_t; static int unlock_write_protect(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { @@ -1686,6 +1690,22 @@ static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) return unlock_write_protect(use_pwd, pwd, data, false); } +static void unlock_add_item(em4x05_unlock_item_t *array, uint8_t len, uint32_t value) { + + uint8_t i = 0; + for (; i < len; i++) { + if ( array[i].cnt == 0) + break; + + if ( array[i].value == value) { + array[i].cnt++; + return; + } + } + + array[i].cnt++; + array[i].value = value; +} static int CmdEM4x05Unlock(const char *Cmd) { @@ -1804,10 +1824,12 @@ static int CmdEM4x05Unlock(const char *Cmd) { uint32_t tries = 0; uint32_t soon = 0; uint32_t late = 0; + + em4x05_unlock_item_t flipped[64]; + // // main loop // - //uint32_t prev_delay = 0; bool success = false; uint64_t t1 = msclock(); while (start <= end) { @@ -1971,12 +1993,16 @@ static int CmdEM4x05Unlock(const char *Cmd) { if (word14b == word15) { PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + + unlock_add_item(flipped, 64, word14b); success = true; break; } if (word14b != search_value) { PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + + unlock_add_item(flipped, 64, word14b); success = true; break; } @@ -1993,6 +2019,9 @@ static int CmdEM4x05Unlock(const char *Cmd) { } } else { PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); + + unlock_add_item(flipped, 64, word15); + soon ++; } } @@ -2014,14 +2043,25 @@ static int CmdEM4x05Unlock(const char *Cmd) { bitstring[i] = bitflips & (0xF << ((7-i) * 4)) ? 'x' : '.'; } // compute number of bits flipped - uint32_t i = bitflips; - i = i - ((i >> 1) & 0x55555555); - i = (i & 0x33333333) + ((i >> 2) & 0x33333333); - i = (((i + (i >> 4)) & 0x0F0F0F0F) * 0x01010101) >> 24; - PrintAndLogEx(INFO, "Bitflips: %2u events => %s", i, bitstring); + + PrintAndLogEx(INFO, "Bitflips: %2u events => %s", bitcount32(bitflips), bitstring); PrintAndLogEx(INFO, "New protection word => " _CYAN_("%08X") "\n", word14b); + + PrintAndLogEx(INFO, "Try " _YELLOW_("`lf em 4x05_dump`")); } + + if (verbose) { + PrintAndLogEx(NORMAL, "Stats:"); + PrintAndLogEx(INFO, " idx | value | cnt | flipped bits"); + PrintAndLogEx(INFO, "-----+----------+-----+------"); + for (uint8_t i = 0; i < 64; i++) { + if (flipped[i].cnt == 0) + break; + + PrintAndLogEx(INFO, " %3u | %08X | %3u | %u", i, flipped[i].value, flipped[i].cnt, bitcount32(search_value ^ flipped[i].value)); + } + } PrintAndLogEx(NORMAL, ""); return exit_code; } diff --git a/client/src/util.c b/client/src/util.c index 161115993..6a49a27dd 100644 --- a/client/src/util.c +++ b/client/src/util.c @@ -895,3 +895,40 @@ int hexstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str) } return i - 1; } + +inline uint32_t bitcount32(uint32_t a) { +#if defined __GNUC__ + return __builtin_popcountl(a); +#else + a = a - ((a >> 1) & 0x55555555); + a = (a & 0x33333333) + ((a >> 2) & 0x33333333); + return (((a + (a >> 4)) & 0x0f0f0f0f) * 0x01010101) >> 24; +#endif +} + +inline uint64_t bitcount64(uint64_t a) { +#if defined __GNUC__ + return __builtin_popcountll(a); +#else + PrintAndLogEx(FAILED, "Was not compiled with fct bitcount64"); + return 0; +#endif +} + +inline uint32_t leadingzeros32(uint32_t a) { +#if defined __GNUC__ + return __builtin_clzl(a); +#else + PrintAndLogEx(FAILED, "Was not compiled with fct bitcount64"); + return 0; +#endif +} + +inline uint64_t leadingzeros64(uint64_t a) { +#if defined __GNUC__ + return __builtin_clzll(a); +#else + PrintAndLogEx(FAILED, "Was not compiled with fct bitcount64"); + return 0; +#endif +} diff --git a/client/src/util.h b/client/src/util.h index 663abbc55..f65c94622 100644 --- a/client/src/util.h +++ b/client/src/util.h @@ -101,4 +101,9 @@ void strcreplace(char *buf, size_t len, char from, char to); char *str_dup(const char *src); char *str_ndup(const char *src, size_t len); int hexstring_to_u96(uint32_t *hi2, uint32_t *hi, uint32_t *lo, const char *str); + +uint32_t bitcount32(uint32_t a); +uint64_t bitcount64(uint64_t a); +uint32_t leadingzeros32(uint32_t a); +uint64_t leadingzeros64(uint64_t a); #endif From a7b7e0ba9b3a06b69706449e29c264dcd67e47e4 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 14:02:21 +0200 Subject: [PATCH 028/125] fix overflow --- client/src/cmdlfem4x.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 1bcd5b244..5e008b369 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1703,6 +1703,9 @@ static void unlock_add_item(em4x05_unlock_item_t *array, uint8_t len, uint32_t v } } + if (i >= len ) + return; + array[i].cnt++; array[i].value = value; } From 1dfd2f512798e31513173a10100b8d277cfd3ffd Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Fri, 16 Oct 2020 14:15:12 +0200 Subject: [PATCH 029/125] simpler --- client/src/cmdlfem4x.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 5e008b369..242c37307 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -1694,20 +1694,16 @@ static void unlock_add_item(em4x05_unlock_item_t *array, uint8_t len, uint32_t v uint8_t i = 0; for (; i < len; i++) { - if ( array[i].cnt == 0) - break; - - if ( array[i].value == value) { + if ( array[i].value == value ) { array[i].cnt++; - return; + break; + } + if ( array[i].cnt == 0 ) { + array[i].cnt++; + array[i].value = value; + break; } } - - if (i >= len ) - return; - - array[i].cnt++; - array[i].value = value; } static int CmdEM4x05Unlock(const char *Cmd) { From 91a1520ce3b27420771c5d2dd7acdc5282418a81 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 14:19:52 +0200 Subject: [PATCH 030/125] disabling stuff --- client/src/cmdhfmfu.c | 368 +++++++++++++++++++++++++++++++++++------- 1 file changed, 311 insertions(+), 57 deletions(-) diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c index 771ae0e41..bda3d5732 100644 --- a/client/src/cmdhfmfu.c +++ b/client/src/cmdhfmfu.c @@ -21,6 +21,7 @@ #include "generator.h" #include "mifare/ndef.h" #include "cliparser.h" +#include "cmdmain.h" #define MAX_UL_BLOCKS 0x0F @@ -343,21 +344,28 @@ static int ul_send_cmd_raw(uint8_t *cmd, uint8_t cmdlen, uint8_t *response, uint return resplen; } -static int ul_select(iso14a_card_select_t *card) { +static bool ul_select(iso14a_card_select_t *card) { ul_switch_on_field(); PacketResponseNG resp; - bool ans = WaitForResponseTimeout(CMD_ACK, &resp, 1500); - - if (!ans || resp.oldarg[0] < 1) { - PrintAndLogEx(WARNING, "iso14443a card select failed"); + if (WaitForResponseTimeout(CMD_ACK, &resp, 1500) == false) { + PrintAndLogEx(WARNING, "timeout while waiting for reply."); DropField(); - return 0; - } + return false; + } else { - memcpy(card, resp.data.asBytes, sizeof(iso14a_card_select_t)); - return 1; + uint16_t len = (resp.oldarg[1] & 0xFFFF); + if (len == 0) { + PrintAndLogEx(WARNING, "iso14443a card select failed"); + DropField(); + return false; + } + + if (card) + memcpy(card, resp.data.asBytes, sizeof(iso14a_card_select_t)); + } + return true; } // This read command will at least return 16bytes. @@ -885,7 +893,7 @@ static int ulev1_print_counters(void) { len = ulev1_readCounter(i, counter, sizeof(counter)); if (len == 3) { PrintAndLogEx(INFO, " [%0d]: %s", i, sprint_hex(counter, 3)); - PrintAndLogEx(SUCCESS, " - %02X tearing (" _GREEN_("%s") ")", tear[0], (tear[0] == 0xBD) ? "ok" : "failure"); + PrintAndLogEx(SUCCESS, " - %02X tearing (%s)", tear[0], (tear[0] == 0xBD) ? _GREEN_("ok") : _RED_("failure")); } } return len; @@ -1027,11 +1035,10 @@ static int ulc_magic_test(){ iso14a_card_select_t card; uint8_t nonce1[11] = {0x00}; uint8_t nonce2[11] = {0x00}; - int status = ul_select(&card); - if ( !status ){ + if ( !ul_select(&card) ){ return UL_ERROR; } - status = ulc_requestAuthentication(nonce1, sizeof(nonce1)); + int status = ulc_requestAuthentication(nonce1, sizeof(nonce1)); if ( status > 0 ) { status = ulc_requestAuthentication(nonce2, sizeof(nonce2)); returnValue = ( !memcmp(nonce1, nonce2, 11) ) ? UL_C_MAGIC : UL_C; @@ -1620,7 +1627,7 @@ static int CmdHF14AMfUWrBl(const char *Cmd) { PrintAndLogEx(WARNING, "Command execute timeout"); } - return 0; + return PM3_SUCCESS; } // // Read Single Block @@ -2839,12 +2846,10 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) { return usage_hf_mfu_otp_tearoff(); case 'b': blockNoUint = param_get8(Cmd, cmdp + 1); -/* if (blockNoUint < 2) { PrintAndLogEx(WARNING, "Wrong block number"); errors = true; } -*/ cmdp += 2; break; case 'i': @@ -2942,11 +2947,19 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) { clearCommandBuffer(); SendCommandMIX(CMD_HF_MFU_OTP_TEAROFF, blockNoUint, actualTime, 0, teardata, 8); + + // we be getting ACK that we are silently ignoring here.. + if (!WaitForResponseTimeout(CMD_HF_MFU_OTP_TEAROFF, &resp, 2000)) { PrintAndLogEx(WARNING, "Failed"); return PM3_ESOFT; } + if (resp.status != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "Tear off reporting failure to select tag"); + continue; + } + got_post = false; clearCommandBuffer(); SendCommandMIX(CMD_HF_MIFAREU_READBL, blockNoUint, 0, 0, NULL, 0); @@ -3046,6 +3059,34 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) { return PM3_SUCCESS; } +static int counter_reset_tear(iso14a_card_select_t *card, uint8_t cnt_no) { + + PrintAndLogEx(INFO, "Reset tear check"); + + uint8_t cw[6] = { MIFARE_ULEV1_INCR_CNT, cnt_no, 0x00, 0x00, 0x00, 0x00}; + uint8_t ct[1] = {0}; + uint8_t resp[10] = {0}; + + if (ul_select(card) == false) { + PrintAndLogEx(FAILED, "failed to select card, exiting..."); + return PM3_ESOFT; + } + if (ul_send_cmd_raw(cw, sizeof(cw), resp, sizeof(resp) < 0)) { + PrintAndLogEx(FAILED, "failed to write all ZEROS"); + return PM3_ESOFT; + } + if (ulev1_readTearing(cnt_no, ct, sizeof(ct)) < 0) { + PrintAndLogEx(FAILED, "AFTER, failed to read ANTITEAR, exiting..."); + return PM3_ESOFT; + } + DropField(); + + if (ct[0] != 0xBD) { + PrintAndLogEx(INFO, "Resetting seem to have failed, WHY!?"); + return PM3_ESOFT; + } + return PM3_SUCCESS; +} static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { @@ -3062,14 +3103,31 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { arg_int0("c", "cnt", "<0,1,2>", "Target this EV1 counter (0,1,2)"), arg_int0("i", "inc", "", "time interval to increase in each iteration - default 10 us"), arg_int0("l", "limit", "", "test upper limit time - default 3000 us"), - arg_int0("s", "start", "", "test start time - default 0 us"), + arg_int0("s", "start", "", "test start time - default 0 us"), + arg_int0(NULL, "fix", "", "test fixed loop delay"), + arg_str0("x", "hex", NULL, "3 byte hex to increase counter with"), arg_param_end }; CLIExecWithReturn(ctx, Cmd, argtable, false); + + int interval = 0; + int time_limit, start_time = 0; int counter = arg_get_int_def(ctx, 1, 0); - int interval = arg_get_int_def(ctx, 2, 10); - int time_limit = arg_get_int_def(ctx, 3, 3000); - int start_time = arg_get_int_def(ctx, 4, 0); + int fixed = arg_get_int_def(ctx, 5, -1); + + if ( fixed == -1 ) { + interval = arg_get_int_def(ctx, 2, 10); + time_limit = arg_get_int_def(ctx, 3, 3000); + start_time = arg_get_int_def(ctx, 4, 0); + } else { + start_time = fixed; + interval = 0; + time_limit = fixed; + } + + uint8_t newvalue[5] = {0}; + int newvaluelen = 0; + CLIGetHexWithReturn(ctx, 6, newvalue, &newvaluelen); CLIParserFree(ctx); // Validations @@ -3095,106 +3153,302 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { iso14a_card_select_t card; - if (ul_select(&card) == 0) { - PrintAndLogEx(WARNING, "Failed to select card"); + // reset counter tear + counter_reset_tear(&card, cnt_no); + + if (ul_select(&card) == false) { + PrintAndLogEx(INFO, "failed to select card, exiting..."); return PM3_ESOFT; } - + uint8_t inital_cnt[3] = {0, 0, 0}; int len = ulev1_readCounter(cnt_no, inital_cnt, sizeof(inital_cnt)); - DropField(); if ( len != sizeof(inital_cnt) ) { - PrintAndLogEx(WARNING, "Failed to read counter"); + PrintAndLogEx(WARNING, "failed to read counter"); + return PM3_ESOFT; + } + + uint8_t inital_tear[1] = {0}; + len = ulev1_readTearing(cnt_no, inital_tear, sizeof(inital_tear)); + DropField(); + if ( len != sizeof(inital_tear) ) { + PrintAndLogEx(WARNING, "failed to read ANTITEAR, exiting... %d", len); return PM3_ESOFT; } + uint32_t wr_value = ( newvalue[0] | newvalue[1] << 8 | newvalue[2] << 16 ); + uint32_t inital_value = ( inital_cnt[0] | inital_cnt[1] << 8 | inital_cnt[2] << 16 );; + PrintAndLogEx(INFO, "----------------- " _CYAN_("MFU Ev1 Counter Tear off") " ---------------------"); - PrintAndLogEx(INFO, "Target counter no " _GREEN_("%u"), counter); - PrintAndLogEx(INFO, "Target initial value " _GREEN_("%s"), sprint_hex_inrow(inital_cnt, sizeof(inital_cnt))); + PrintAndLogEx(INFO, "Target counter no [ " _GREEN_("%u") " ]", counter); + PrintAndLogEx(INFO, " counter value [ " _GREEN_("%s") " ]", sprint_hex_inrow(inital_cnt, sizeof(inital_cnt))); + PrintAndLogEx(INFO, " anti-tear value [ " _GREEN_("%02X") " ]", inital_tear[0]); + PrintAndLogEx(INFO, " increase value [ " _GREEN_("%s") " ]", sprint_hex_inrow(newvalue, newvaluelen)); PrintAndLogEx(INFO, "----------------------------------------------------"); - bool got_pre = false, got_post = false; + uint8_t pre_tear = 0, post_tear = 0; uint8_t pre[3] = {0}; uint8_t post[3] = {0}; uint32_t actual_time = start_time; + uint32_t a = 0, b = 0; + uint32_t loop = 0; + uint16_t late = 0; + while (actual_time <= (time_limit - interval)) { + + DropField(); + + loop++; + if (kbd_enter_pressed()) { PrintAndLogEx(INFO, "\naborted via keyboard!\n"); break; } - PrintAndLogEx(INPLACE, "Using tear-off delay " _GREEN_("%" PRIu32) " us", actual_time); + PrintAndLogEx(INPLACE, "Using tear-off delay " _GREEN_("%" PRIu32) " us (attempt %u)", actual_time, loop); - if (ul_select(&card) == 0) - return PM3_ESOFT; + if (ul_select(&card) == false) { + PrintAndLogEx(FAILED, "BEFORE, failed to select card, looping..."); + continue; + } - got_pre = false; - uint8_t cntresp[3] = {0, 0, 0}; + uint8_t cntresp[3] = {0, 0, 0}; int rlen = ulev1_readCounter(cnt_no, cntresp, sizeof(cntresp)); if ( rlen == sizeof(cntresp) ) { memcpy(pre, cntresp, sizeof(pre)); - got_pre = true; + } else { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(FAILED, "BEFORE, failed to read COUNTER, exiting..."); + break; + } + + uint8_t tear[1] = {0}; + int tlen = ulev1_readTearing(cnt_no, tear, sizeof(tear)); + if ( tlen == sizeof(tear) ) { + pre_tear = tear[0]; + } else { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(FAILED, "BEFORE, failed to read ANTITEAR, exiting... %d", tlen); + break; } - DropField(); + DropField(); + struct p { uint8_t counter; uint32_t tearoff_time; + uint8_t value[3]; } PACKED payload; payload.counter = cnt_no; payload.tearoff_time = actual_time; + memcpy(payload.value, newvalue, sizeof(payload.value)); clearCommandBuffer(); PacketResponseNG resp; SendCommandNG(CMD_HF_MFU_COUNTER_TEAROFF, (uint8_t*)&payload, sizeof(payload)); if (!WaitForResponseTimeout(CMD_HF_MFU_COUNTER_TEAROFF, &resp, 2000)) { PrintAndLogEx(WARNING, "\ntear off command failed"); - return PM3_ESOFT; + continue; } - got_post = false; - if (ul_select(&card) == 0) - return PM3_ESOFT; + if (ul_select(&card) == false) { + PrintAndLogEx(FAILED, "AFTER, failed to select card, exiting..."); + break; + } rlen = ulev1_readCounter(cnt_no, cntresp, sizeof(cntresp)); if ( rlen == sizeof(cntresp) ) { memcpy(post, cntresp, sizeof(post)); - got_post = true; + } else { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(FAILED, "AFTER, failed to read COUNTER, exiting..."); + break; } + + tear[0] = 0; + tlen = ulev1_readTearing(cnt_no, tear, sizeof(tear)); + if ( tlen == sizeof(tear) ) { + post_tear = tear[0]; + } else { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(FAILED, "AFTER, failed to read ANTITEAR, exiting..."); + break; + } + DropField(); - if (got_pre && got_post) { + char prestr[20] = {0}; + snprintf(prestr, sizeof(prestr), "%s", sprint_hex_inrow(pre, sizeof(pre))); + char poststr[20] = {0}; + snprintf(poststr, sizeof(poststr), "%s", sprint_hex_inrow(post, sizeof(post))); - char prestr[20] = {0}; - snprintf(prestr, sizeof(prestr), "%s", sprint_hex_inrow(pre, sizeof(pre))); - char poststr[20] = {0}; - snprintf(poststr, sizeof(poststr), "%s", sprint_hex_inrow(post, sizeof(post))); + bool post_tear_check = (post_tear == 0xBD); + a = (pre[0] | pre[1] << 8 | pre[2] << 16); + b = (post[0] | post[1] << 8 | post[2] << 16); + + // A != B + if (memcmp(pre, post, sizeof(pre)) != 0) { - if (memcmp(pre, post, sizeof(pre)) == 0) { -// PrintAndLogEx(INFO, "Current %d - %s", cnt_no, poststr); + + PrintAndLogEx(NORMAL, ""); + + if (inital_value != a ) { + + if ( inital_value != b ) + PrintAndLogEx(INFO, "pre %08x, post %08x != inital %08x | tear: 0x%02X == 0x%02X", a, b, inital_value, pre_tear, post_tear); + else + PrintAndLogEx(INFO, "pre %08x != inital and post %08x == inital %08x | tear: 0x%02X == 0x%02X", a, b, inital_value, pre_tear, post_tear); } else { - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, _CYAN_("Tear off occured") " : %d %s vs " _RED_("%s") - , cnt_no, prestr, poststr); + + if ( inital_value != b ) + PrintAndLogEx(INFO, "pre %08x == inital and post %08x != inital %08x | tear: 0x%02X == 0x%02X", a, b, inital_value, pre_tear, post_tear); } - } else { - if (got_pre == false) { - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(FAILED, "Failed to read Counter BEFORE"); + if ( b == 0 ) { + PrintAndLogEx(INFO, _CYAN_("Tear off occured (ZEROS value!) -> ") "%s vs " _GREEN_("%s") " Tear status: 0x%02X == 0x%02X ( %s )" + , prestr + , poststr + , pre_tear + , post_tear + , post_tear_check ? _GREEN_("OK") : _RED_("DETECTED") + ); + break; } - if (got_post == false) { - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(FAILED, "Failed to read Counter AFTER"); + + if ( a > b ) { + PrintAndLogEx(INFO, _CYAN_("Tear off occured " _RED_("( LESS )") " -> ") "%s vs " _GREEN_("%s") " Tear status: 0x%02X == 0x%02X ( %s )" + , prestr + , poststr + , pre_tear + , post_tear + , post_tear_check ? _GREEN_("OK") : _RED_("DETECTED") + ); + + + if (counter_reset_tear(&card, cnt_no) != PM3_SUCCESS){ + PrintAndLogEx(FAILED, "failed to reset tear, exiting..."); + break; + } + + uint32_t bar = (0x1000000 - b) + 2; + //wr_value = bar; + //newvalue[0] = (bar) & 0xFF; + //newvalue[1] = ((bar >> 8) & 0xFF); + //newvalue[2] = ((bar >> 16) & 0xFF); + + wr_value = 0; + newvalue[0] = 0; + newvalue[1] = 0; + newvalue[2] = 0; + + PrintAndLogEx(INFO, " 0x1000000 - 0x%x == 0x%x", b, bar); + PrintAndLogEx(INFO, " new increase value 0x%x" , wr_value); + PrintAndLogEx(INFO, " because BAR + post == 0x%x" , bar + b); + + PrintAndLogEx(INFO, "New increase value " _YELLOW_("%s"), sprint_hex_inrow(newvalue, newvaluelen)); + continue; + } else { + + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, _CYAN_("Tear off occured (+1) (too late) -> ") "%s vs %s Tear: 0x%02X == 0x%02X ( %s )" + , prestr + , poststr + , pre_tear + , post_tear + , post_tear_check ? _GREEN_("OK") : _RED_("DETECTED") + ); + + if ( post_tear_check && b == inital_value) { + PrintAndLogEx(INFO, "Reverted to previous value"); + break; + } + if ( wr_value != 0 ) { + + //uint32_t bar = (0x1000000 - b) + 2; + wr_value = 0; + newvalue[0] = 0; + newvalue[1] = 0; + newvalue[2] = 0; + + if ( b >= (inital_value + (2 * wr_value))) { + PrintAndLogEx(INFO, "Large " _YELLOW_("( JUMP )") " detected"); + + /* + wr_value = bar; + newvalue[0] = (bar) & 0xFF; + newvalue[1] = ((bar >> 8) & 0xFF); + newvalue[2] = ((bar >> 16) & 0xFF); + + */ + } else { + /* + wr_value = bar; + newvalue[0] = (bar) & 0xFF; + newvalue[1] = ((bar >> 8) & 0xFF); + newvalue[2] = ((bar >> 16) & 0xFF); + wr_value = 0; + newvalue[0] = 0; + newvalue[1] = 0; + newvalue[2] = 0; + */ + } + + } + PrintAndLogEx(INFO, "New increase value " _YELLOW_("%s"), sprint_hex_inrow(newvalue, newvaluelen)); + + //actual_time--; + late++; + } + } else { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, _CYAN_("Status: same value! -> ") "%s == %s Tear: 0x%02X == 0x%02X ( %s )" + , prestr + , poststr + , pre_tear + , post_tear + , post_tear_check ? _GREEN_("OK") : _RED_("DETECTED") + ); + + if ( post_tear_check ) { + if ( a == b ) { + //actual_time--; + continue; + } + + if ( b == inital_value ) { + PrintAndLogEx(INFO, "Reverted to previous value"); + break; + } + } else { + + if (counter_reset_tear(&card, cnt_no) != PM3_SUCCESS){ + PrintAndLogEx(FAILED, "failed to reset tear, exiting..."); + break; + } + } } actual_time += interval; } + DropField(); + + PrintAndLogEx(INFO, " Sent %u tear offs ", loop); + + counter_reset_tear(&card, cnt_no); + + PrintAndLogEx(INFO, "hf 14a raw -s -c 3900 --> read counter 0"); + PrintAndLogEx(INFO, "hf 14a raw -s -c 3e00 --> read tearing 0"); PrintAndLogEx(NORMAL, ""); + char read_cnt_str[30]; + sprintf(read_cnt_str, "hf 14a raw -s -c 39%02x", counter); + CommandReceived(read_cnt_str); + char read_tear_str[30]; + sprintf(read_tear_str, "hf 14a raw -s -c 3e%02x", counter); + CommandReceived(read_tear_str); return PM3_SUCCESS; } From 867750b7eeff0aff6132e7bf79adbc0ab6610600 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 16:07:39 +0200 Subject: [PATCH 031/125] fix coverity --- client/src/cmdhficlass.c | 44 +++++----------------------------------- 1 file changed, 5 insertions(+), 39 deletions(-) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 57a231e2e..9e61e5d89 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -1804,44 +1804,7 @@ write_dump: } static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool replay, bool verbose) { - /* - uint8_t MAC[4] = {0x00, 0x00, 0x00, 0x00}; - uint8_t div_key[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; - if (select_and_auth(KEY, MAC, div_key, use_credit_key, elite, rawkey, verbose) == false) { - return PM3_ESOFT; - } - - calc_wb_mac(blockno, bldata, div_key, MAC); - - struct p { - uint8_t blockno; - uint8_t data[12]; - } PACKED payload; - payload.blockno = blockno; - - memcpy(payload.data, bldata, 8); - memcpy(payload.data + 8, MAC, 4); - - - // - typedef struct { - uint8_t key[8]; - bool use_raw; - bool use_elite; - bool use_credit_key; - bool send_reply; - bool do_auth; - uint8_t blockno; - } PACKED iclass_auth_req_t; - - // iCLASS write block request data structure - typedef struct { - iclass_auth_req_t req; - uint8_t data[8]; - } PACKED iclass_writeblock_req_t; - - - */ + iclass_writeblock_req_t payload = { .req.use_raw = rawkey, .req.use_elite = elite, @@ -2129,7 +2092,7 @@ static int CmdHFiClassRestore(const char *Cmd) { free(dump); if (verbose) { - PrintAndLogEx(INFO, "Preparing to restore block range 0x02x..0x%02x", startblock, endblock); + PrintAndLogEx(INFO, "Preparing to restore block range 0x%02x..0x%02x", startblock, endblock); PrintAndLogEx(INFO, "------+----------------------"); PrintAndLogEx(INFO, "block | data"); @@ -2150,6 +2113,7 @@ static int CmdHFiClassRestore(const char *Cmd) { if (WaitForResponseTimeout(CMD_HF_ICLASS_RESTORE, &resp, 2500) == 0) { PrintAndLogEx(WARNING, "command execute timeout"); DropField(); + free(payload); return PM3_ETIMEOUT; } @@ -2159,6 +2123,8 @@ static int CmdHFiClassRestore(const char *Cmd) { } else { PrintAndLogEx(WARNING, "iCLASS restore " _RED_("failed")); } + + free(payload); return resp.status; } From c85962f815d4ddeed816eb8f93a79c75e0089788 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:09:27 +0200 Subject: [PATCH 032/125] fix coverity --- client/src/cmdlfdestron.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/cmdlfdestron.c b/client/src/cmdlfdestron.c index 635f2b4f9..52ae5fc6d 100644 --- a/client/src/cmdlfdestron.c +++ b/client/src/cmdlfdestron.c @@ -71,7 +71,7 @@ int demodDestron(bool verbose) { parity_err += oddparity8(data[i]); data[i] &= 0x7F; } - if (errCnt > 0) { + if (parity_err > 0) { PrintAndLogEx(DEBUG, "DEBUG: Error - Destron: parity errors: %d", parity_err); return PM3_ESOFT; } From 495009804292fd63604c1decd25d35a30cbb52fb Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:10:24 +0200 Subject: [PATCH 033/125] fix coverity --- client/src/scripting.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/client/src/scripting.c b/client/src/scripting.c index 90e19151c..17362e5f6 100644 --- a/client/src/scripting.c +++ b/client/src/scripting.c @@ -1139,8 +1139,8 @@ static int l_em4x50_read(lua_State *L) { uint32_t addr = 0; sscanf(p_addr, "%u", &addr); - if (addr > 33) - return returnToLuaWithError(L, "Address out-of-range (0..33) got %zu", addr); + if (addr > 31) + return returnToLuaWithError(L, "Address out-of-range (0..31) got %u", addr); // setting up structures em4x50_data_t etd; From 1c8194a84fcba837661b27c8af6bdd3b58178ebc Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:13:05 +0200 Subject: [PATCH 034/125] fix coverity --- client/src/scripting.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/scripting.c b/client/src/scripting.c index 17362e5f6..e603ce359 100644 --- a/client/src/scripting.c +++ b/client/src/scripting.c @@ -1171,7 +1171,7 @@ static int l_em4x50_read(lua_State *L) { PrintAndLogEx(DEBUG, "Addr %u", etd.address); if (etd.pwd_given) - PrintAndLogEx(DEBUG, " Pwd %08X", etd.password); + PrintAndLogEx(DEBUG, " Pwd %s", sprint_hex(etd.password, sizeof(etd.password))); em4x50_word_t words[EM4X50_NO_WORDS]; From 63603cc422e729987dd01c2994c5ab8b0a39ea83 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:13:14 +0200 Subject: [PATCH 035/125] fix coverity --- armsrc/iclass.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 36ba0706b..204cd9ea1 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -1879,11 +1879,6 @@ void iClass_WriteBlock(uint8_t *msg) { return; } else { - if (resp == NULL) { - res = true; - break; - } - if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_UPDATE, &eof_time) == 10) { res = true; break; From e41e87101419f98ada7f2ded0d9e6d80e80121f7 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:15:04 +0200 Subject: [PATCH 036/125] fix coverity --- client/src/cmdlfem4x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index 242c37307..fadb4a7f2 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -716,7 +716,7 @@ static bool EM_ColParityTest(uint8_t *bs, size_t size, uint8_t rows, uint8_t col static bool downloadSamplesEM(void) { // 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples) - uint8_t got[5500]; + uint8_t got[6000]; if (!GetFromDevice(BIG_BUF, got, sizeof(got), 0, NULL, 0, NULL, 2500, false)) { PrintAndLogEx(WARNING, "(downloadSamplesEM) command execution time out"); return false; @@ -1800,7 +1800,7 @@ static int CmdEM4x05Unlock(const char *Cmd) { PrintAndLogEx(INFO, "initial prot 14&15 [ " _GREEN_("%08X") ", " _GREEN_("%08X") " ]", init_14, init_15); if (use_pwd) { - PrintAndLogEx(INFO, " target password [ " _GREEN_("%08"PRIX64) " ]", pwd); + PrintAndLogEx(INFO, " target password [ " _GREEN_("%08X") " ]", pwd); } if (my_auto) { PrintAndLogEx(INFO, " automatic mode [ " _GREEN_("enabled") " ]"); From c6902245f058581c84bd06eacfd12433526c0d74 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:22:12 +0200 Subject: [PATCH 037/125] fix coverity --- client/src/cmdhfmfu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c index bda3d5732..6437d11eb 100644 --- a/client/src/cmdhfmfu.c +++ b/client/src/cmdhfmfu.c @@ -3071,7 +3071,7 @@ static int counter_reset_tear(iso14a_card_select_t *card, uint8_t cnt_no) { PrintAndLogEx(FAILED, "failed to select card, exiting..."); return PM3_ESOFT; } - if (ul_send_cmd_raw(cw, sizeof(cw), resp, sizeof(resp) < 0)) { + if (ul_send_cmd_raw(cw, sizeof(cw), resp, sizeof(resp)) < 0) { PrintAndLogEx(FAILED, "failed to write all ZEROS"); return PM3_ESOFT; } @@ -3452,7 +3452,6 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { return PM3_SUCCESS; } - static int CmdHF14MfuNDEF(const char *Cmd) { int keylen; From d27a8abe809bcf8f03c862b012632571d49f81d1 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:42:28 +0200 Subject: [PATCH 038/125] WIP, not suitable for running --- client/src/cmdhfmfu.c | 46 ++++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c index 6437d11eb..c472b8d59 100644 --- a/client/src/cmdhfmfu.c +++ b/client/src/cmdhfmfu.c @@ -3059,6 +3059,7 @@ static int CmdHF14AMfuOtpTearoff(const char *Cmd) { return PM3_SUCCESS; } +/* static int counter_reset_tear(iso14a_card_select_t *card, uint8_t cnt_no) { PrintAndLogEx(INFO, "Reset tear check"); @@ -3087,7 +3088,9 @@ static int counter_reset_tear(iso14a_card_select_t *card, uint8_t cnt_no) { } return PM3_SUCCESS; } +*/ +/* static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { CLIParserContext *ctx; @@ -3333,10 +3336,10 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { } uint32_t bar = (0x1000000 - b) + 2; - //wr_value = bar; - //newvalue[0] = (bar) & 0xFF; - //newvalue[1] = ((bar >> 8) & 0xFF); - //newvalue[2] = ((bar >> 16) & 0xFF); + // wr_value = bar; + // newvalue[0] = (bar) & 0xFF; + // newvalue[1] = ((bar >> 8) & 0xFF); + // newvalue[2] = ((bar >> 16) & 0xFF); wr_value = 0; newvalue[0] = 0; @@ -3375,24 +3378,21 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { if ( b >= (inital_value + (2 * wr_value))) { PrintAndLogEx(INFO, "Large " _YELLOW_("( JUMP )") " detected"); - /* - wr_value = bar; - newvalue[0] = (bar) & 0xFF; - newvalue[1] = ((bar >> 8) & 0xFF); - newvalue[2] = ((bar >> 16) & 0xFF); - - */ + + // wr_value = bar; + // newvalue[0] = (bar) & 0xFF; + // newvalue[1] = ((bar >> 8) & 0xFF); + // newvalue[2] = ((bar >> 16) & 0xFF); } else { - /* - wr_value = bar; - newvalue[0] = (bar) & 0xFF; - newvalue[1] = ((bar >> 8) & 0xFF); - newvalue[2] = ((bar >> 16) & 0xFF); - wr_value = 0; - newvalue[0] = 0; - newvalue[1] = 0; - newvalue[2] = 0; - */ + + // wr_value = bar; + // newvalue[0] = (bar) & 0xFF; + // newvalue[1] = ((bar >> 8) & 0xFF); + // newvalue[2] = ((bar >> 16) & 0xFF); + // wr_value = 0; + // newvalue[0] = 0; + // newvalue[1] = 0; + // newvalue[2] = 0; } } @@ -3452,6 +3452,8 @@ static int CmdHF14AMfuEv1CounterTearoff(const char *Cmd) { return PM3_SUCCESS; } +*/ + static int CmdHF14MfuNDEF(const char *Cmd) { int keylen; @@ -3582,7 +3584,7 @@ static command_t CommandTable[] = { {"gen", CmdHF14AMfUGenDiverseKeys, AlwaysAvailable, "Generate 3des mifare diversified keys"}, {"pwdgen", CmdHF14AMfUPwdGen, AlwaysAvailable, "Generate pwd from known algos"}, {"otptear", CmdHF14AMfuOtpTearoff, IfPm3Iso14443a, "Tear-off test on OTP bits"}, - {"countertear", CmdHF14AMfuEv1CounterTearoff, IfPm3Iso14443a, "Tear-off test on Ev1 Counter bits"}, +// {"countertear", CmdHF14AMfuEv1CounterTearoff, IfPm3Iso14443a, "Tear-off test on Ev1 Counter bits"}, {"ndef", CmdHF14MfuNDEF, IfPm3Iso14443a, "Prints NDEF records from card"}, {NULL, NULL, NULL, NULL} }; From 4c406ba04ac06705ee7b69074f07d8173d101ea0 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 17:56:51 +0200 Subject: [PATCH 039/125] thanks @mwalker --- client/dictionaries/t55xx_default_pwds.dic | 2 ++ 1 file changed, 2 insertions(+) diff --git a/client/dictionaries/t55xx_default_pwds.dic b/client/dictionaries/t55xx_default_pwds.dic index cd03c7b7a..b5b981177 100644 --- a/client/dictionaries/t55xx_default_pwds.dic +++ b/client/dictionaries/t55xx_default_pwds.dic @@ -26,6 +26,8 @@ A5B4C3D2 50520901 # default PROX 50524F58 +# blue gun EM4305 +F9DCEBA0 # Default pwd, simple: 00000000 11111111 From 8aa70b37e348027c637521f8b6da7a5f47ac9865 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Fri, 16 Oct 2020 19:13:40 +0200 Subject: [PATCH 040/125] extract em 4x05 into own file --- client/CMakeLists.txt | 1 + client/Makefile | 1 + client/src/cmdlf.c | 3 +- client/src/cmdlfem4x.c | 1441 +------------------------------------ client/src/cmdlfem4x.h | 4 +- client/src/cmdlfem4x05.c | 1474 ++++++++++++++++++++++++++++++++++++++ client/src/cmdlfem4x05.h | 31 + client/src/scripting.c | 2 +- 8 files changed, 1512 insertions(+), 1445 deletions(-) create mode 100644 client/src/cmdlfem4x05.c create mode 100644 client/src/cmdlfem4x05.h diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt index e7262ba33..46e77a14f 100644 --- a/client/CMakeLists.txt +++ b/client/CMakeLists.txt @@ -248,6 +248,7 @@ set (TARGET_SOURCES ${PM3_ROOT}/client/src/cmdlfcotag.c ${PM3_ROOT}/client/src/cmdlfdestron.c ${PM3_ROOT}/client/src/cmdlfem4x.c + ${PM3_ROOT}/client/src/cmdlfem4x05.c ${PM3_ROOT}/client/src/cmdlfem4x50.c ${PM3_ROOT}/client/src/cmdlffdxb.c ${PM3_ROOT}/client/src/cmdlfgallagher.c diff --git a/client/Makefile b/client/Makefile index 27702a9d6..b4393ad36 100644 --- a/client/Makefile +++ b/client/Makefile @@ -443,6 +443,7 @@ SRCS = aidsearch.c \ cmdlfcotag.c \ cmdlfdestron.c \ cmdlfem4x.c \ + cmdlfem4x05.c \ cmdlfem4x50.c \ cmdlffdxb.c \ cmdlfguard.c \ diff --git a/client/src/cmdlf.c b/client/src/cmdlf.c index d278d4c9c..f5effbd17 100644 --- a/client/src/cmdlf.c +++ b/client/src/cmdlf.c @@ -30,7 +30,8 @@ #include "cmddata.h" // for `lf search` #include "cmdlfawid.h" // for awid menu #include "cmdlfem4x.h" // for em4x menu -#include "cmdlfem4x50.h" // for em4x50 +#include "cmdlfem4x05.h" // for em4x05 / 4x69 +#include "cmdlfem4x50.h" // for em4x50 #include "cmdlfhid.h" // for hid menu #include "cmdlfhitag.h" // for hitag menu #include "cmdlfidteck.h" // for idteck menu diff --git a/client/src/cmdlfem4x.c b/client/src/cmdlfem4x.c index fadb4a7f2..f20610a2e 100644 --- a/client/src/cmdlfem4x.c +++ b/client/src/cmdlfem4x.c @@ -9,6 +9,7 @@ //----------------------------------------------------------------------------- #include "cmdlfem4x.h" +#include "cmdlfem4x05.h" #include "cmdlfem4x50.h" #include @@ -119,75 +120,6 @@ static int usage_lf_em410x_brute(void) { return PM3_SUCCESS; } -//////////////// 4205 / 4305 commands -static int usage_lf_em4x05_dump(void) { - PrintAndLogEx(NORMAL, "Dump EM4x05/EM4x69. Tag must be on antenna. "); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf em 4x05_dump [h] [f ] "); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " f - overide filename prefix (optional). Default is based on UID"); - PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf em 4x05_dump"); - PrintAndLogEx(NORMAL, " lf em 4x05_dump 11223344"); - PrintAndLogEx(NORMAL, " lf em 4x05_dump f card1 11223344"); - return PM3_SUCCESS; -} -static int usage_lf_em4x05_wipe(void) { - PrintAndLogEx(NORMAL, "Wipe EM4x05/EM4x69. Tag must be on antenna. "); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf em 4x05_wipe [h] "); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " c - chip type : 0 em4205"); - PrintAndLogEx(NORMAL, " 1 em4305 (default)"); - PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf em 4x05_wipe"); - PrintAndLogEx(NORMAL, " lf em 4x05_wipe 11223344"); - return PM3_SUCCESS; -} -static int usage_lf_em4x05_read(void) { - PrintAndLogEx(NORMAL, "Read EM4x05/EM4x69. Tag must be on antenna. "); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf em 4x05_read [h]
"); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " address - memory address to read. (0-15)"); - PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf em 4x05_read 1"); - PrintAndLogEx(NORMAL, " lf em 4x05_read 1 11223344"); - return PM3_SUCCESS; -} -static int usage_lf_em4x05_write(void) { - PrintAndLogEx(NORMAL, "Write EM4x05/4x69. Tag must be on antenna. "); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf em 4x05_write [h]
"); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " address - memory address to write to. (0-13, 99 for Protection Words)"); - PrintAndLogEx(NORMAL, " data - data to write (hex)"); - PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf em 4x05_write 1 deadc0de"); - PrintAndLogEx(NORMAL, " lf em 4x05_write 1 deadc0de 11223344"); - return PM3_SUCCESS; -} -static int usage_lf_em4x05_info(void) { - PrintAndLogEx(NORMAL, "Tag information EM4205/4305/4469//4569 tags. Tag must be on antenna."); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf em 4x05_info [h] "); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf em 4x05_info"); - PrintAndLogEx(NORMAL, " lf em 4x05_info deadc0de"); - return PM3_SUCCESS; -} - /* Read the ID of an EM410x tag. * Format: * 1111 1111 1 <-- standard non-repeatable header @@ -694,1377 +626,6 @@ static int CmdEM410xClone(const char *Cmd) { return resp.status; } -//**************** Start of EM4x50 Code ************************ - -// even parity COLUMN -static bool EM_ColParityTest(uint8_t *bs, size_t size, uint8_t rows, uint8_t cols, uint8_t pType) { - if (rows * cols > size) return false; - uint8_t colP = 0; - - for (uint8_t c = 0; c < cols - 1; c++) { - for (uint8_t r = 0; r < rows; r++) { - colP ^= bs[(r * cols) + c]; - } - if (colP != pType) return false; - colP = 0; - } - return true; -} - -#define EM_PREAMBLE_LEN 6 -// download samples from device and copy to Graphbuffer -static bool downloadSamplesEM(void) { - - // 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples) - uint8_t got[6000]; - if (!GetFromDevice(BIG_BUF, got, sizeof(got), 0, NULL, 0, NULL, 2500, false)) { - PrintAndLogEx(WARNING, "(downloadSamplesEM) command execution time out"); - return false; - } - - setGraphBuf(got, sizeof(got)); - // set signal properties low/high/mean/amplitude and is_noise detection - computeSignalProperties(got, sizeof(got)); - RepaintGraphWindow(); - if (getSignalProperties()->isnoise) { - PrintAndLogEx(DEBUG, "No tag found - signal looks like noise"); - return false; - } - return true; -} - -// em_demod -static int doPreambleSearch(size_t *startIdx) { - - // sanity check - if (DemodBufferLen < EM_PREAMBLE_LEN) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM4305 demodbuffer too small"); - return PM3_ESOFT; - } - - // set size to 9 to only test first 3 positions for the preamble - // do not set it too long else an error preamble followed by 010 could be seen as success. - size_t size = (9 > DemodBufferLen) ? DemodBufferLen : 9; - *startIdx = 0; - // skip first two 0 bits as they might have been missed in the demod - uint8_t preamble[EM_PREAMBLE_LEN] = {0, 0, 1, 0, 1, 0}; - - if (!preambleSearchEx(DemodBuffer, preamble, EM_PREAMBLE_LEN, &size, startIdx, true)) { - uint8_t errpreamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 0, 1}; - if (!preambleSearchEx(DemodBuffer, errpreamble, EM_PREAMBLE_LEN, &size, startIdx, true)) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM4305 preamble not found :: %zu", *startIdx); - return PM3_ESOFT; - } - return PM3_EFAILED; // Error preamble found - } - return PM3_SUCCESS; -} - -static bool detectFSK(void) { - // detect fsk clock - if (GetFskClock("", false) == 0) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: FSK clock failed"); - return false; - } - // demod - int ans = FSKrawDemod(0, 0, 0, 0, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: FSK Demod failed"); - return false; - } - return true; -} -// PSK clocks should be easy to detect ( but difficult to demod a non-repeating pattern... ) -static bool detectPSK(void) { - int ans = GetPskClock("", false); - if (ans <= 0) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: PSK clock failed"); - return false; - } - //demod - //try psk1 -- 0 0 6 (six errors?!?) - ans = PSKDemod(0, 0, 6, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: PSK1 Demod failed"); - - //try psk1 inverted - ans = PSKDemod(0, 1, 6, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: PSK1 inverted Demod failed"); - return false; - } - } - // either PSK1 or PSK1 inverted is ok from here. - // lets check PSK2 later. - return true; -} -// try manchester - NOTE: ST only applies to T55x7 tags. -static bool detectASK_MAN(void) { - bool stcheck = false; - if (ASKDemod_ext(0, 0, 50, 0, false, false, false, 1, &stcheck) != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: ASK/Manchester Demod failed"); - return false; - } - return true; -} - -static bool detectASK_BI(void) { - int ans = ASKbiphaseDemod(0, 0, 1, 50, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: ASK/biphase normal demod failed"); - - ans = ASKbiphaseDemod(0, 1, 1, 50, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: ASK/biphase inverted demod failed"); - return false; - } - } - return true; -} -static bool detectNRZ(void) { - int ans = NRZrawDemod(0, 0, 1, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: NRZ normal demod failed"); - - ans = NRZrawDemod(0, 1, 1, false); - if (ans != PM3_SUCCESS) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM: NRZ inverted demod failed"); - return false; - } - } - - return true; -} - -// param: idx - start index in demoded data. -static int setDemodBufferEM(uint32_t *word, size_t idx) { - - //test for even parity bits. - uint8_t parity[45] = {0}; - memcpy(parity, DemodBuffer, 45); - if (!EM_ColParityTest(DemodBuffer + idx + EM_PREAMBLE_LEN, 45, 5, 9, 0)) { - PrintAndLogEx(DEBUG, "DEBUG: Error - End Parity check failed"); - return PM3_ESOFT; - } - - // test for even parity bits and remove them. (leave out the end row of parities so 36 bits) - if (!removeParity(DemodBuffer, idx + EM_PREAMBLE_LEN, 9, 0, 36)) { - PrintAndLogEx(DEBUG, "DEBUG: Error - EM, failed removing parity"); - return PM3_ESOFT; - } - setDemodBuff(DemodBuffer, 32, 0); - *word = bytebits_to_byteLSBF(DemodBuffer, 32); - return PM3_SUCCESS; -} - -// FSK, PSK, ASK/MANCHESTER, ASK/BIPHASE, ASK/DIPHASE, NRZ -// should cover 90% of known used configs -// the rest will need to be manually demoded for now... -static int demodEM4x05resp(uint32_t *word, bool onlyPreamble) { - size_t idx = 0; - *word = 0; - bool found_err = false; - int res = PM3_SUCCESS; - do { - if (detectASK_MAN()) { - res = doPreambleSearch(&idx); - if (res == PM3_SUCCESS) - break; - if (res == PM3_EFAILED) - // go on, maybe it's false positive and another modulation will work - found_err = true; - } - if (detectASK_BI()) { - res = doPreambleSearch(&idx); - if (res == PM3_SUCCESS) - break; - if (res == PM3_EFAILED) - found_err = true; - } - if (detectNRZ()) { - res = doPreambleSearch(&idx); - if (res == PM3_SUCCESS) - break; - if (res == PM3_EFAILED) - found_err = true; - } - if (detectFSK()) { - res = doPreambleSearch(&idx); - if (res == PM3_SUCCESS) - break; - if (res == PM3_EFAILED) - found_err = true; - } - if (detectPSK()) { - res = doPreambleSearch(&idx); - if (res == PM3_SUCCESS) - break; - if (res == PM3_EFAILED) - found_err = true; - - psk1TOpsk2(DemodBuffer, DemodBufferLen); - res = doPreambleSearch(&idx); - if (res == PM3_SUCCESS) - break; - if (res == PM3_EFAILED) - found_err = true; - } - if (found_err) - return PM3_EFAILED; - return PM3_ESOFT; - } while (0); - if (onlyPreamble) - return PM3_SUCCESS; - res = setDemodBufferEM(word, idx); - if (res == PM3_SUCCESS) - return res; - if (found_err) - return PM3_EFAILED; - return res; -} - -//////////////// 4205 / 4305 commands -#include "util_posix.h" // msclock -int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *word) { - - struct { - uint32_t password; - uint8_t address; - uint8_t usepwd; - } PACKED payload; - - payload.password = pwd; - payload.address = addr; - payload.usepwd = usePwd; - - clearCommandBuffer(); - SendCommandNG(CMD_LF_EM4X_READWORD, (uint8_t *)&payload, sizeof(payload)); - PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_LF_EM4X_READWORD, &resp, 10000)) { - PrintAndLogEx(WARNING, "(EM4x05ReadWord_ext) timeout while waiting for reply."); - return PM3_ETIMEOUT; - } - - if (downloadSamplesEM() == false) { - return PM3_ESOFT; - } - return demodEM4x05resp(word, false); -} - -static int CmdEM4x05Demod(const char *Cmd) { -// uint8_t ctmp = tolower(param_getchar(Cmd, 0)); -// if (ctmp == 'h') return usage_lf_em4x05_demod(); - uint32_t dummy = 0; - return demodEM4x05resp(&dummy, false); -} - -static int CmdEM4x05Dump(const char *Cmd) { - uint8_t addr = 0; - uint32_t pwd = 0; - bool usePwd = false; - bool needReadPwd = true; - uint8_t cmdp = 0; - uint8_t bytes[4] = {0}; - uint32_t data[16]; - char preferredName[FILE_PATH_SIZE] = {0}; - char optchk[10]; - - while (param_getchar(Cmd, cmdp) != 0x00) { - switch (tolower(param_getchar(Cmd, cmdp))) { - case 'h': - return usage_lf_em4x05_dump(); - break; - case 'f': // since f could match in password, lets confirm it is 1 character only for an option - param_getstr(Cmd, cmdp, optchk, sizeof(optchk)); - if (strlen(optchk) == 1) { // Have a single character f so filename no password - param_getstr(Cmd, cmdp + 1, preferredName, FILE_PATH_SIZE); - cmdp += 2; - break; - } // if not a single 'f' dont break and flow onto default as should be password - - default : // for backwards-compatibility options should be > 'f' else assume its the hex password` - // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) - pwd = param_get32ex(Cmd, cmdp, 1, 16); - if (pwd != 1) - usePwd = true; - cmdp++; - }; - } - - int success = PM3_SUCCESS; - int status, status14, status15; - uint32_t lock_bits = 0x00; // no blocks locked - bool gotLockBits = false; - bool lockInPW2 = false; - uint32_t word = 0; - const char *info[] = {"Info/User", "UID", "Password", "User", "Config", "User", "User", "User", "User", "User", "User", "User", "User", "User", "Lock", "Lock"}; - - if (usePwd) { - // Test first if a password is required - status = EM4x05ReadWord_ext(14, pwd, false, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); - needReadPwd = false; - } - } - PrintAndLogEx(NORMAL, "Addr | data | ascii |lck| info"); - PrintAndLogEx(NORMAL, "-----+----------+-------+---+-----"); - - // To flag any blocks locked we need to read blocks 14 and 15 first - // dont swap endin until we get block lock flags. - status14 = EM4x05ReadWord_ext(14, pwd, usePwd, &word); - if (status14 == PM3_SUCCESS) { - if (!usePwd) - needReadPwd = false; - if ((word & 0x00008000) != 0x00) { - lock_bits = word; - gotLockBits = true; - } - data[14] = word; - } else { - success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data - } - status15 = EM4x05ReadWord_ext(15, pwd, usePwd, &word); - if (status15 == PM3_SUCCESS) { - if ((word & 0x00008000) != 0x00) { // assume block 15 is the current lock block - lock_bits = word; - gotLockBits = true; - lockInPW2 = true; - } - data[15] = word; - } else { - success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data - } - uint32_t lockbit; - // Now read blocks 0 - 13 as we have 14 and 15 - for (; addr < 14; addr++) { - lockbit = (lock_bits >> addr) & 1; - if (addr == 2) { - if (usePwd) { - if ((needReadPwd) && (success != PM3_ESOFT)) { - data[addr] = BSWAP_32(pwd); - num_to_bytes(pwd, 4, bytes); - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); - } else { - // The pwd is not needed for Login so we're not sure what's the actual content of that block - PrintAndLogEx(NORMAL, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); - } - } else { - data[addr] = 0x00; // Unknown password, but not used to set to zeros - PrintAndLogEx(NORMAL, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); - } - } else { - // success &= EM4x05ReadWord_ext(addr, pwd, usePwd, &word); - status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); // Get status for single read - if (status != PM3_SUCCESS) - success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data - data[addr] = BSWAP_32(word); - if (status == PM3_SUCCESS) { - num_to_bytes(word, 4, bytes); - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %s", addr, word, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); - } else - PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); - } - } - // Print blocks 14 and 15 - // Both lock bits are protected with bit idx 14 (special case) - addr = 14; - if (status14 == PM3_SUCCESS) { - lockbit = (lock_bits >> addr) & 1; - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? "" : _GREEN_("active")); - } else { - PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status14 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); - } - addr = 15; - if (status15 == PM3_SUCCESS) { - lockbit = (lock_bits >> 14) & 1; // beware lock bit of word15 is pr14 - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? _GREEN_("active") : ""); - } else { - PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status15 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); - } - // Update endian for files - data[14] = BSWAP_32(data[14]); - data[15] = BSWAP_32(data[15]); - - if (success == PM3_SUCCESS) { // all ok save dump to file - // saveFileEML will add .eml extension to filename - // saveFile (binary) passes in the .bin extension. - if (strcmp(preferredName, "") == 0) // Set default filename, if not set by user - sprintf(preferredName, "lf-4x05-%08X-dump", BSWAP_32(data[1])); - - saveFileEML(preferredName, (uint8_t *)data, 16 * sizeof(uint32_t), sizeof(uint32_t)); - saveFile(preferredName, ".bin", data, sizeof(data)); - } - - return success; -} - -static int CmdEM4x05Read(const char *Cmd) { - uint8_t addr; - uint32_t pwd; - bool usePwd = false; - - uint8_t ctmp = tolower(param_getchar(Cmd, 0)); - if (strlen(Cmd) == 0 || ctmp == 'h') return usage_lf_em4x05_read(); - - addr = param_get8ex(Cmd, 0, 50, 10); - pwd = param_get32ex(Cmd, 1, 0xFFFFFFFF, 16); - - if (addr > 15) { - PrintAndLogEx(WARNING, "Address must be between 0 and 15"); - return PM3_ESOFT; - } - if (pwd == 0xFFFFFFFF) { - PrintAndLogEx(INFO, "Reading address %02u", addr); - } else { - usePwd = true; - PrintAndLogEx(INFO, "Reading address %02u using password %08X", addr, pwd); - } - - uint32_t word = 0; - int status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); - if (status == PM3_SUCCESS) - PrintAndLogEx(SUCCESS, "Address %02d | %08X - %s", addr, word, (addr > 13) ? "Lock" : ""); - else if (status == PM3_EFAILED) - PrintAndLogEx(ERR, "Tag denied Read operation"); - else - PrintAndLogEx(WARNING, "No answer from tag"); - return status; -} - -static int CmdEM4x05Write(const char *Cmd) { - uint8_t ctmp = tolower(param_getchar(Cmd, 0)); - if (strlen(Cmd) == 0 || ctmp == 'h') return usage_lf_em4x05_write(); - - bool usePwd = false; - uint8_t addr; - uint32_t data, pwd; - - addr = param_get8ex(Cmd, 0, 50, 10); - data = param_get32ex(Cmd, 1, 0, 16); - pwd = param_get32ex(Cmd, 2, 0xFFFFFFFF, 16); - bool protectOperation = addr == 99; // will do better with cliparser... - - if ((addr > 13) && (!protectOperation)) { - PrintAndLogEx(WARNING, "Address must be between 0 and 13"); - return PM3_EINVARG; - } - if (pwd == 0xFFFFFFFF) { - if (protectOperation) - PrintAndLogEx(INFO, "Writing protection words data %08X", data); - else - PrintAndLogEx(INFO, "Writing address %d data %08X", addr, data); - } else { - usePwd = true; - if (protectOperation) - PrintAndLogEx(INFO, "Writing protection words data %08X using password %08X", data, pwd); - else - PrintAndLogEx(INFO, "Writing address %d data %08X using password %08X", addr, data, pwd); - } - - if (protectOperation) { // set Protect Words - struct { - uint32_t password; - uint32_t data; - uint8_t usepwd; - } PACKED payload; - - payload.password = pwd; - payload.data = data; - payload.usepwd = usePwd; - - clearCommandBuffer(); - SendCommandNG(CMD_LF_EM4X_PROTECTWORD, (uint8_t *)&payload, sizeof(payload)); - PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_LF_EM4X_PROTECTWORD, &resp, 2000)) { - PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); - return PM3_ETIMEOUT; - } - } else { - struct { - uint32_t password; - uint32_t data; - uint8_t address; - uint8_t usepwd; - } PACKED payload; - - payload.password = pwd; - payload.data = data; - payload.address = addr; - payload.usepwd = usePwd; - - clearCommandBuffer(); - SendCommandNG(CMD_LF_EM4X_WRITEWORD, (uint8_t *)&payload, sizeof(payload)); - PacketResponseNG resp; - if (!WaitForResponseTimeout(CMD_LF_EM4X_WRITEWORD, &resp, 2000)) { - PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); - return PM3_ETIMEOUT; - } - } - if (!downloadSamplesEM()) - return PM3_ENODATA; - - uint32_t dummy = 0; - int status = demodEM4x05resp(&dummy, true); - if (status == PM3_SUCCESS) - PrintAndLogEx(SUCCESS, "Success writing to tag"); - else if (status == PM3_EFAILED) - PrintAndLogEx(ERR, "Tag denied %s operation", protectOperation ? "Protect" : "Write"); - else - PrintAndLogEx(DEBUG, "No answer from tag"); - - PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 4x05_read`") " to verify"); - return status; -} -static int CmdEM4x05Wipe(const char *Cmd) { - uint8_t addr = 0; - uint32_t pwd = 0; - uint8_t cmdp = 0; - uint8_t chipType = 1; // em4305 - uint32_t chipInfo = 0x00040072; // Chip info/User Block normal 4305 Chip Type - uint32_t chipUID = 0x614739AE; // UID normally readonly, but just in case - uint32_t blockData = 0x00000000; // UserBlock/Password (set to 0x00000000 for a wiped card1 - uint32_t config = 0x0001805F; // Default config (no password) - int success = PM3_SUCCESS; - char cmdStr [100]; - char optchk[10]; - - while (param_getchar(Cmd, cmdp) != 0x00) { - // check if cmd is a 1 byte option - param_getstr(Cmd, cmdp, optchk, sizeof(optchk)); - if (strlen(optchk) == 1) { // Have a single character so option not part of password - switch (tolower(param_getchar(Cmd, cmdp))) { - case 'c': // chip type - if (param_getchar(Cmd, cmdp) != 0x00) - chipType = param_get8ex(Cmd, cmdp + 1, 0, 10); - cmdp += 2; - break; - case 'h': // return usage_lf_em4x05_wipe(); - default : // Unknown or 'h' send help - return usage_lf_em4x05_wipe(); - break; - }; - } else { // Not a single character so assume password - pwd = param_get32ex(Cmd, cmdp, 1, 16); - cmdp++; - } - } - - switch (chipType) { - case 0 : // em4205 - chipInfo = 0x00040070; - config = 0x0001805F; - break; - case 1 : // em4305 - chipInfo = 0x00040072; - config = 0x0001805F; - break; - default : // Type 0/Default : EM4305 - chipInfo = 0x00040072; - config = 0x0001805F; - } - - // block 0 : User Data or Chip Info - sprintf(cmdStr, "%d %08X %08X", 0, chipInfo, pwd); - CmdEM4x05Write(cmdStr); - // block 1 : UID - this should be read only for EM4205 and EM4305 not sure about others - sprintf(cmdStr, "%d %08X %08X", 1, chipUID, pwd); - CmdEM4x05Write(cmdStr); - // block 2 : password - sprintf(cmdStr, "%d %08X %08X", 2, blockData, pwd); - CmdEM4x05Write(cmdStr); - pwd = blockData; // Password should now have changed, so use new password - // block 3 : user data - sprintf(cmdStr, "%d %08X %08X", 3, blockData, pwd); - CmdEM4x05Write(cmdStr); - // block 4 : config - sprintf(cmdStr, "%d %08X %08X", 4, config, pwd); - CmdEM4x05Write(cmdStr); - - // Remainder of user/data blocks - for (addr = 5; addr < 14; addr++) {// Clear user data blocks - sprintf(cmdStr, "%d %08X %08X", addr, blockData, pwd); - CmdEM4x05Write(cmdStr); - } - - return success; -} - -static void printEM4x05config(uint32_t wordData) { - uint16_t datarate = (((wordData & 0x3F) + 1) * 2); - uint8_t encoder = ((wordData >> 6) & 0xF); - char enc[14]; - memset(enc, 0, sizeof(enc)); - - uint8_t PSKcf = (wordData >> 10) & 0x3; - char cf[10]; - memset(cf, 0, sizeof(cf)); - uint8_t delay = (wordData >> 12) & 0x3; - char cdelay[33]; - memset(cdelay, 0, sizeof(cdelay)); - uint8_t numblks = EM4x05_GET_NUM_BLOCKS(wordData); - uint8_t LWR = numblks + 5 - 1; //last word read - switch (encoder) { - case 0: - snprintf(enc, sizeof(enc), "NRZ"); - break; - case 1: - snprintf(enc, sizeof(enc), "Manchester"); - break; - case 2: - snprintf(enc, sizeof(enc), "Biphase"); - break; - case 3: - snprintf(enc, sizeof(enc), "Miller"); - break; - case 4: - snprintf(enc, sizeof(enc), "PSK1"); - break; - case 5: - snprintf(enc, sizeof(enc), "PSK2"); - break; - case 6: - snprintf(enc, sizeof(enc), "PSK3"); - break; - case 7: - snprintf(enc, sizeof(enc), "Unknown"); - break; - case 8: - snprintf(enc, sizeof(enc), "FSK1"); - break; - case 9: - snprintf(enc, sizeof(enc), "FSK2"); - break; - default: - snprintf(enc, sizeof(enc), "Unknown"); - break; - } - - switch (PSKcf) { - case 0: - snprintf(cf, sizeof(cf), "RF/2"); - break; - case 1: - snprintf(cf, sizeof(cf), "RF/8"); - break; - case 2: - snprintf(cf, sizeof(cf), "RF/4"); - break; - case 3: - snprintf(cf, sizeof(cf), "unknown"); - break; - } - - switch (delay) { - case 0: - snprintf(cdelay, sizeof(cdelay), "no delay"); - break; - case 1: - snprintf(cdelay, sizeof(cdelay), "BP/8 or 1/8th bit period delay"); - break; - case 2: - snprintf(cdelay, sizeof(cdelay), "BP/4 or 1/4th bit period delay"); - break; - case 3: - snprintf(cdelay, sizeof(cdelay), "no delay"); - break; - } - uint8_t readLogin = (wordData & EM4x05_READ_LOGIN_REQ) >> 18; - uint8_t readHKL = (wordData & EM4x05_READ_HK_LOGIN_REQ) >> 19; - uint8_t writeLogin = (wordData & EM4x05_WRITE_LOGIN_REQ) >> 20; - uint8_t writeHKL = (wordData & EM4x05_WRITE_HK_LOGIN_REQ) >> 21; - uint8_t raw = (wordData & EM4x05_READ_AFTER_WRITE) >> 22; - uint8_t disable = (wordData & EM4x05_DISABLE_ALLOWED) >> 23; - uint8_t rtf = (wordData & EM4x05_READER_TALK_FIRST) >> 24; - uint8_t pigeon = (wordData & (1 << 26)) >> 26; - - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "--- " _CYAN_("Config Information") " ---------------------------"); - PrintAndLogEx(INFO, "ConfigWord: %08X (Word 4)", wordData); - PrintAndLogEx(INFO, " Data Rate: %02u | "_YELLOW_("RF/%u"), wordData & 0x3F, datarate); - PrintAndLogEx(INFO, " Encoder: %u | " _YELLOW_("%s"), encoder, enc); - PrintAndLogEx(INFO, " PSK CF: %u | %s", PSKcf, cf); - PrintAndLogEx(INFO, " Delay: %u | %s", delay, cdelay); - PrintAndLogEx(INFO, " LastWordR: %02u | Address of last word for default read - meaning %u blocks are output", LWR, numblks); - PrintAndLogEx(INFO, " ReadLogin: %u | Read login is %s", readLogin, readLogin ? _YELLOW_("required") : _GREEN_("not required")); - PrintAndLogEx(INFO, " ReadHKL: %u | Read housekeeping words login is %s", readHKL, readHKL ? _YELLOW_("required") : _GREEN_("not required")); - PrintAndLogEx(INFO, "WriteLogin: %u | Write login is %s", writeLogin, writeLogin ? _YELLOW_("required") : _GREEN_("not required")); - PrintAndLogEx(INFO, " WriteHKL: %u | Write housekeeping words login is %s", writeHKL, writeHKL ? _YELLOW_("required") : _GREEN_("not Required")); - PrintAndLogEx(INFO, " R.A.W.: %u | Read after write is %s", raw, raw ? "on" : "off"); - PrintAndLogEx(INFO, " Disable: %u | Disable command is %s", disable, disable ? "accepted" : "not accepted"); - PrintAndLogEx(INFO, " R.T.F.: %u | Reader talk first is %s", rtf, rtf ? _YELLOW_("enabled") : "disabled"); - PrintAndLogEx(INFO, " Pigeon: %u | Pigeon mode is %s", pigeon, pigeon ? _YELLOW_("enabled") : "disabled"); -} - -static void printEM4x05info(uint32_t block0, uint32_t serial) { - - uint8_t chipType = (block0 >> 1) & 0xF; - uint8_t cap = (block0 >> 5) & 3; - uint16_t custCode = (block0 >> 9) & 0x2FF; - - PrintAndLogEx(INFO, " block0: %X", block0); - PrintAndLogEx(INFO, " chiptype: %X", chipType); - PrintAndLogEx(INFO, "capacitor: %X", cap); - PrintAndLogEx(INFO, " custcode: %X", custCode); - - /* bits - // 0, rfu - // 1,2,3,4 chip type - // 5,6 resonant cap - // 7,8, rfu - // 9 - 18 customer code - // 19, rfu - - 98765432109876543210 - 001000000000 - // 00100000000001111000 - xxx---- - // 1100 - // 011 - // 00100000000 - */ - - PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------"); - - char ctstr[50]; - snprintf(ctstr, sizeof(ctstr), " Chip Type: %u | ", chipType); - switch (chipType) { - case 9: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4305"); - break; - case 4: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4469"); - break; - case 8: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4205"); - break; - //add more here when known - default: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "Unknown"); - break; - } - PrintAndLogEx(SUCCESS, "%s", ctstr); - - switch (cap) { - case 3: - PrintAndLogEx(SUCCESS, " Cap Type: %u | 330pF", cap); - break; - case 2: - PrintAndLogEx(SUCCESS, " Cap Type: %u | %spF", cap, (chipType == 2) ? "75" : "210"); - break; - case 1: - PrintAndLogEx(SUCCESS, " Cap Type: %u | 250pF", cap); - break; - case 0: - PrintAndLogEx(SUCCESS, " Cap Type: %u | no resonant capacitor", cap); - break; - default: - PrintAndLogEx(SUCCESS, " Cap Type: %u | unknown", cap); - break; - } - - PrintAndLogEx(SUCCESS, " Cust Code: %03u | %s", custCode, (custCode == 0x200) ? "Default" : "Unknown"); - if (serial != 0) - PrintAndLogEx(SUCCESS, " Serial #: " _YELLOW_("%08X"), serial); -} - -static void printEM4x05ProtectionBits(uint32_t word, uint8_t addr) { - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "--- " _CYAN_("Protection") " ---------------------------"); - PrintAndLogEx(INFO, "ProtectionWord: %08X (Word %i)", word, addr); - for (uint8_t i = 0; i < 15; i++) { - PrintAndLogEx(INFO, " Word: %02u | %s", i, ((1 << i) & word) ? _RED_("write Locked") : "unlocked"); - if (i == 14) - PrintAndLogEx(INFO, " Word: %02u | %s", i + 1, ((1 << i) & word) ? _RED_("write locked") : "unlocked"); - } -} - -//quick test for EM4x05/EM4x69 tag -bool EM4x05IsBlock0(uint32_t *word) { - return (EM4x05ReadWord_ext(0, 0, false, word) == PM3_SUCCESS); -} - -static int CmdEM4x05Info(const char *Cmd) { -#define EM_SERIAL_BLOCK 1 -#define EM_CONFIG_BLOCK 4 -#define EM_PROT1_BLOCK 14 -#define EM_PROT2_BLOCK 15 - uint32_t pwd; - uint32_t word = 0, block0 = 0, serial = 0; - bool usePwd = false; - uint8_t ctmp = tolower(param_getchar(Cmd, 0)); - if (ctmp == 'h') return usage_lf_em4x05_info(); - - // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) - pwd = param_get32ex(Cmd, 0, 0xFFFFFFFF, 16); - - if (pwd != 0xFFFFFFFF) - usePwd = true; - - // read word 0 (chip info) - // block 0 can be read even without a password. - if (EM4x05IsBlock0(&block0) == false) - return PM3_ESOFT; - - // read word 1 (serial #) doesn't need pwd - // continue if failed, .. non blocking fail. - EM4x05ReadWord_ext(EM_SERIAL_BLOCK, 0, false, &serial); - printEM4x05info(block0, serial); - - // read word 4 (config block) - // needs password if one is set - if (EM4x05ReadWord_ext(EM_CONFIG_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) - return PM3_ESOFT; - - printEM4x05config(word); - - // read word 14 and 15 to see which is being used for the protection bits - if (EM4x05ReadWord_ext(EM_PROT1_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) { - return PM3_ESOFT; - } - if (word & 0x8000) { - printEM4x05ProtectionBits(word, EM_PROT1_BLOCK); - return PM3_SUCCESS; - } else { // if status bit says this is not the used protection word - if (EM4x05ReadWord_ext(EM_PROT2_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) - return PM3_ESOFT; - if (word & 0x8000) { - printEM4x05ProtectionBits(word, EM_PROT2_BLOCK); - return PM3_SUCCESS; - } - } - //something went wrong - return PM3_ESOFT; -} - -static bool is_cancelled(void) { - if (kbd_enter_pressed()) { - PrintAndLogEx(WARNING, "\naborted via keyboard!\n"); - return true; - } - return false; -} -// load a default pwd file. -static int CmdEM4x05Chk(const char *Cmd) { - - CLIParserContext *ctx; - CLIParserInit(&ctx, "lf em 4x05_chk", - "This command uses a dictionary attack against EM4205/4305/4469/4569", - "lf em 4x05_chk\n" - "lf em 4x05_chk -e 0x00000022B8 -> remember to use 0x for hex\n" - "lf em 4x05_chk -f t55xx_default_pwds -> use T55xx default dictionary" - ); - - void *argtable[] = { - arg_param_begin, - arg_strx0("f", "file", "<*.dic>", "loads a default keys dictionary file <*.dic>"), - arg_u64_0("e", "em", "", "try the calculated password from some cloners based on EM4100 ID"), - arg_param_end - }; - CLIExecWithReturn(ctx, Cmd, argtable, true); - int fnlen = 0; - char filename[FILE_PATH_SIZE] = {0}; - CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen); - uint64_t card_id = arg_get_u64_def(ctx, 2, 0); - CLIParserFree(ctx); - - if (strlen(filename) == 0) { - snprintf(filename, sizeof(filename), "t55xx_default_pwds"); - } - PrintAndLogEx(NORMAL, ""); - - uint8_t addr = 4; - uint32_t word = 0; - bool found = false; - uint64_t t1 = msclock(); - - // White cloner password based on EM4100 ID - if ( card_id > 0 ) { - - uint32_t pwd = lf_t55xx_white_pwdgen(card_id & 0xFFFFFFFF); - PrintAndLogEx(INFO, "testing %08"PRIX32" generated ", pwd); - - int status = EM4x05ReadWord_ext(addr, pwd, true, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", pwd); - found = true; - } - } - - // Loop dictionary - uint8_t *keyBlock = NULL; - if (found == false) { - - PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); - - word = 0; - uint32_t keycount = 0; - - int res = loadFileDICTIONARY_safe(filename, (void **) &keyBlock, 4, &keycount); - if (res != PM3_SUCCESS || keycount == 0 || keyBlock == NULL) { - PrintAndLogEx(WARNING, "no keys found in file"); - if (keyBlock != NULL) - free(keyBlock); - - return PM3_ESOFT; - } - - for (uint32_t c = 0; c < keycount; ++c) { - - if (!session.pm3_present) { - PrintAndLogEx(WARNING, "device offline\n"); - free(keyBlock); - return PM3_ENODATA; - } - - if (is_cancelled()) { - free(keyBlock); - return PM3_EOPABORTED; - } - - uint32_t curr_password = bytes_to_num(keyBlock + 4 * c, 4); - - PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password); - - int status = EM4x05ReadWord_ext(addr, curr_password, 1, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", curr_password); - found = true; - break; - } - } - } - - if (found == false) - PrintAndLogEx(WARNING, "check pwd failed"); - - free(keyBlock); - - t1 = msclock() - t1; - PrintAndLogEx(SUCCESS, "\ntime in check pwd " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); - return PM3_SUCCESS; -} - -typedef struct { - uint16_t cnt; - uint32_t value; -} em4x05_unlock_item_t; - -static int unlock_write_protect(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { - - struct { - uint32_t password; - uint32_t data; - uint8_t usepwd; - } PACKED payload; - - payload.password = pwd; - payload.data = data; - payload.usepwd = use_pwd; - - clearCommandBuffer(); - SendCommandNG(CMD_LF_EM4X_PROTECTWORD, (uint8_t *)&payload, sizeof(payload)); - PacketResponseNG resp; - if (WaitForResponseTimeout(CMD_LF_EM4X_PROTECTWORD, &resp, 2000) == false) { - PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); - return PM3_ETIMEOUT; - } - - if (!downloadSamplesEM()) - return PM3_ENODATA; - - uint32_t dummy = 0; - int status = demodEM4x05resp(&dummy, true); - if (status == PM3_SUCCESS && verbose) - PrintAndLogEx(SUCCESS, "Success writing to tag"); - else if (status == PM3_EFAILED) - PrintAndLogEx(ERR, "Tag denied PROTECT operation"); - else - PrintAndLogEx(DEBUG, "No answer from tag"); - - return status; -} -static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { - if (verbose) - PrintAndLogEx(INFO, "resetting the " _RED_("active") " lock block"); - - return unlock_write_protect(use_pwd, pwd, data, false); -} -static void unlock_add_item(em4x05_unlock_item_t *array, uint8_t len, uint32_t value) { - - uint8_t i = 0; - for (; i < len; i++) { - if ( array[i].value == value ) { - array[i].cnt++; - break; - } - if ( array[i].cnt == 0 ) { - array[i].cnt++; - array[i].value = value; - break; - } - } -} - -static int CmdEM4x05Unlock(const char *Cmd) { - - CLIParserContext *ctx; - CLIParserInit(&ctx, "lf em 4x05_unlock", - "execute tear off against EM4205/4305/4469/4569", - "lf em 4x05_unlock\n" - "lf em 4x05_unlock -s 4100 -e 4100 -> lock on and autotune at 4100us\n" - "lf em 4x05_unlock -n 10 -s 3000 -e 4400 -> scan delays 3000us -> 4400us" - ); - - void *argtable[] = { - arg_param_begin, - arg_int0("n", NULL, NULL, "steps to skip"), - arg_int0("s", "start", "", "start scan from delay (us)"), - arg_int0("e", "end", "", "end scan at delay (us)"), - arg_u64_0("p", "pwd", "", "password (0x00000000)"), - arg_lit0("v", "verbose", "verbose output"), - arg_param_end - }; - CLIExecWithReturn(ctx, Cmd, argtable, true); - double n = (double)arg_get_int_def(ctx, 1, 0); - double start = (double)arg_get_int_def(ctx, 2, 2000); - double end = (double)arg_get_int_def(ctx, 3, 6000); - uint64_t inputpwd = arg_get_u64_def(ctx, 4, 0xFFFFFFFFFFFFFFFF); - bool verbose = arg_get_lit(ctx, 5); - CLIParserFree(ctx); - - if ( start > end ) { - PrintAndLogEx(FAILED, "start delay can\'t be larger than end delay %.0lf vs %.0lf", start, end); - return PM3_EINVARG; - } - - if (session.pm3_present == false) { - PrintAndLogEx(WARNING, "device offline\n"); - return PM3_ENODATA; - } - - bool use_pwd = false; - uint32_t pwd = 0; - if (inputpwd != 0xFFFFFFFFFFFFFFFF) { - use_pwd = true; - pwd = inputpwd & 0xFFFFFFFF; - } - - uint32_t search_value = 0; - uint32_t write_value = 0; - // - // inital phase - // - // read word 14 - uint32_t init_14 = 0; - int res = EM4x05ReadWord_ext(14, pwd, use_pwd, &init_14); - if (res != PM3_SUCCESS) { - PrintAndLogEx(FAILED, "failed to read word 14\n"); - return PM3_ENODATA; - } - - - // read 15 - uint32_t init_15 = 0; - res = EM4x05ReadWord_ext(15, pwd, use_pwd, &init_15); - if (res != PM3_SUCCESS) { - PrintAndLogEx(FAILED, "failed to read word 15\n"); - return PM3_ENODATA; - } - -#define ACTIVE_MASK 0x00008000 - if ((init_15 & ACTIVE_MASK) == ACTIVE_MASK) { - search_value = init_15; - } else { - search_value = init_14; - } - - if (search_value == ACTIVE_MASK) { - PrintAndLogEx(SUCCESS, "Tag already fully unlocked, nothing to do"); - return PM3_SUCCESS; - } - - bool my_auto = false; - if (n == 0) { - my_auto = true; - n = (end - start) / 2; - } - - // fix at one specific delay - if (start == end) { - n = 0; - } - - PrintAndLogEx(INFO, "--------------- " _CYAN_("EM4x05 tear-off : target PROTECT") " -----------------------\n"); - - PrintAndLogEx(INFO, "initial prot 14&15 [ " _GREEN_("%08X") ", " _GREEN_("%08X") " ]", init_14, init_15); - - if (use_pwd) { - PrintAndLogEx(INFO, " target password [ " _GREEN_("%08X") " ]", pwd); - } - if (my_auto) { - PrintAndLogEx(INFO, " automatic mode [ " _GREEN_("enabled") " ]"); - } - - PrintAndLogEx(INFO, " target stepping [ " _GREEN_("%.0lf") " ]", n); - PrintAndLogEx(INFO, "target delay range [ " _GREEN_("%.0lf") " ... " _GREEN_("%.0lf") " ]", start, end); - PrintAndLogEx(INFO, " search value [ " _GREEN_("%08X") " ]", search_value); - PrintAndLogEx(INFO, " write value [ " _GREEN_("%08X") " ]", write_value); - - PrintAndLogEx(INFO, "----------------------------------------------------------------------------\n"); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "--------------- " _CYAN_("start") " -----------------------\n"); - - int exit_code = PM3_SUCCESS; - uint32_t word14 = 0, word15 = 0; - uint32_t word14b = 0, word15b = 0; - uint32_t tries = 0; - uint32_t soon = 0; - uint32_t late = 0; - - em4x05_unlock_item_t flipped[64]; - - // - // main loop - // - bool success = false; - uint64_t t1 = msclock(); - while (start <= end) { - - if (my_auto && n < 1) { - PrintAndLogEx(INFO, "Reached n < 1 => " _YELLOW_("disabling automatic mode")); - end = start; - my_auto = false; - n = 0; - } - - if (my_auto == false) { - start += n; - } - - if (tries >= 5 && n == 0 && soon != late) { - - if (soon > late) { - PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust +1 us >> %.0lf us"), tries, soon, late, start); - start++; - end++; - } else { - PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust -1 us >> %.0lf us"), tries, soon, late, start); - start--; - end--; - } - tries = 0; - soon = 0; - late = 0; - } - - if (is_cancelled()) { - exit_code = PM3_EOPABORTED; - break; - } - - // set tear off trigger - clearCommandBuffer(); - tearoff_params_t params = { - .delay_us = start, - .on = true, - .off = false - }; - res = handle_tearoff(¶ms, verbose); - if ( res != PM3_SUCCESS ) { - PrintAndLogEx(WARNING, "failed to configure tear off"); - return PM3_ESOFT; - } - - // write - res = unlock_write_protect(use_pwd, pwd, write_value, verbose); - - // read after trigger - res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); - if (res != PM3_SUCCESS) { - PrintAndLogEx(WARNING, "failed to read 14"); - return PM3_ESOFT; - } - - // read after trigger - res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); - if (res != PM3_SUCCESS) { - PrintAndLogEx(WARNING, "failed to read 15"); - return PM3_ESOFT; - } - - if (verbose) - PrintAndLogEx(INFO, "ref:%08X 14:%08X 15:%08X ", search_value, word14, word15); - - if ( word14 == search_value && word15 == 0) { - PrintAndLogEx(INFO, "Status: Nothing happened => " _GREEN_("tearing too soon")); - - if (my_auto) { - start += n; - PrintAndLogEx(INFO, " => " _CYAN_("adjust +%.0lf us >> %.0lf us"), n, start); - n /= 2; - } else { - soon++; - } - } else { - - if (word15 == search_value) { - - if (word14 == 0) { - PrintAndLogEx(INFO, "Status: Protect succeeded => " _GREEN_("tearing too late")); - } else { - if ( word14 == search_value) { - PrintAndLogEx(INFO, "Status: 15 ok, 14 not yet erased => " _GREEN_("tearing too late")); - } else { - PrintAndLogEx(INFO, "Status: 15 ok, 14 partially erased => " _GREEN_("tearing too late")); - } - } - - unlock_reset(use_pwd, pwd, write_value, verbose); - - // read after reset - res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); - if (res != PM3_SUCCESS) { - PrintAndLogEx(WARNING, "failed to read 14"); - return PM3_ESOFT; - } - - if (word14b == 0) { - - unlock_reset(use_pwd, pwd, write_value, verbose); - - res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); - if (res != PM3_SUCCESS) { - PrintAndLogEx(WARNING, "failed to read 14"); - return PM3_ESOFT; - } - } - - if (word14b != search_value) { - - res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); - if (res == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); - success = true; - break; - } else { - PrintAndLogEx(WARNING, "failed to read 15"); - return PM3_ESOFT; - } - } - if (my_auto) { - end = start; - start -= n; - PrintAndLogEx(INFO, " => " _CYAN_("adjust -%.0lf us >> %.0lf us"), n, start); - n /= 2; - } else { - late++; - } - - } else { - - if (( word15 & ACTIVE_MASK) == ACTIVE_MASK) { - - PrintAndLogEx(INFO, "Status: 15 bitflipped and active => " _RED_("SUCCESS?: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); - PrintAndLogEx(INFO, "Committing results..."); - - unlock_reset(use_pwd, pwd, write_value, verbose); - - // read after reset - res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); - if ( res != PM3_SUCCESS ) { - PrintAndLogEx(WARNING, "failed to read 14"); - return PM3_ESOFT; - } - - res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); - if ( res != PM3_SUCCESS ) { - PrintAndLogEx(WARNING, "failed to read 15"); - return PM3_ESOFT; - } - - if (verbose) - PrintAndLogEx(INFO, "ref:%08x 14:%08X 15:%08X", search_value, word14b, word15b); - - if ((word14b & ACTIVE_MASK) == ACTIVE_MASK) { - - if (word14b == word15) { - PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); - - unlock_add_item(flipped, 64, word14b); - success = true; - break; - } - - if (word14b != search_value) { - PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); - - unlock_add_item(flipped, 64, word14b); - success = true; - break; - } - - PrintAndLogEx(INFO, "Status: failed to commit bitflip => " _RED_("FAIL: ") "14: %08X 15: %08X", word14b, word15b); - } - if (my_auto) { - n = 0; - end = start; - } else { - tries = 0; - soon = 0; - late = 0; - } - } else { - PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); - - unlock_add_item(flipped, 64, word15); - - soon ++; - } - } - } - - if (my_auto == false) { - tries++; - } - } - - PrintAndLogEx(INFO, "----------------------------- " _CYAN_("exit") " ----------------------------------\n"); - t1 = msclock() - t1; - PrintAndLogEx(SUCCESS, "\ntime in unlock " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); - if (success) { - uint32_t bitflips = search_value ^ word14b; - PrintAndLogEx(INFO, "Old protection word => " _YELLOW_("%08X"), search_value); - char bitstring[9] = {0}; - for (int i=0; i < 8; i++) { - bitstring[i] = bitflips & (0xF << ((7-i) * 4)) ? 'x' : '.'; - } - // compute number of bits flipped - - PrintAndLogEx(INFO, "Bitflips: %2u events => %s", bitcount32(bitflips), bitstring); - PrintAndLogEx(INFO, "New protection word => " _CYAN_("%08X") "\n", word14b); - - - PrintAndLogEx(INFO, "Try " _YELLOW_("`lf em 4x05_dump`")); - } - - if (verbose) { - PrintAndLogEx(NORMAL, "Stats:"); - PrintAndLogEx(INFO, " idx | value | cnt | flipped bits"); - PrintAndLogEx(INFO, "-----+----------+-----+------"); - for (uint8_t i = 0; i < 64; i++) { - if (flipped[i].cnt == 0) - break; - - PrintAndLogEx(INFO, " %3u | %08X | %3u | %u", i, flipped[i].value, flipped[i].cnt, bitcount32(search_value ^ flipped[i].value)); - } - } - PrintAndLogEx(NORMAL, ""); - return exit_code; -} - static command_t CommandTable[] = { {"help", CmdHelp, AlwaysAvailable, "This help"}, {"----------", CmdHelp, AlwaysAvailable, "----------------------- " _CYAN_("EM 410x") " -----------------------"}, diff --git a/client/src/cmdlfem4x.h b/client/src/cmdlfem4x.h index 670517092..34801000e 100644 --- a/client/src/cmdlfem4x.h +++ b/client/src/cmdlfem4x.h @@ -16,10 +16,8 @@ int CmdLFEM4X(const char *Cmd); int demodEM410x(bool verbose); -bool EM4x05IsBlock0(uint32_t *word); -int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *word); - void printEM410x(uint32_t hi, uint64_t id); + int AskEm410xDecode(bool verbose, uint32_t *hi, uint64_t *lo); int AskEm410xDemod(int clk, int invert, int maxErr, size_t maxLen, bool amplify, uint32_t *hi, uint64_t *lo, bool verbose); diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c new file mode 100644 index 000000000..f8f88b40a --- /dev/null +++ b/client/src/cmdlfem4x05.c @@ -0,0 +1,1474 @@ +//----------------------------------------------------------------------------- +// Copyright (C) 2010 iZsh +// +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// Low frequency EM4x commands +//----------------------------------------------------------------------------- + +#include "cmdlfem4x05.h" + +#include +#include +#include +#include +#include + +#include "util_posix.h" // msclock +#include "fileutils.h" +#include "cmdparser.h" // command_t +#include "comms.h" +#include "commonutil.h" +#include "common.h" +#include "util_posix.h" +#include "protocols.h" +#include "ui.h" +#include "proxgui.h" +#include "graph.h" +#include "cmddata.h" +#include "cmdlf.h" +#include "lfdemod.h" +#include "generator.h" +#include "cliparser.h" +#include "cmdhw.h" + +//////////////// 4205 / 4305 commands +static int usage_lf_em4x05_dump(void) { + PrintAndLogEx(NORMAL, "Dump EM4x05/EM4x69. Tag must be on antenna. "); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x05_dump [h] [f ] "); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " f - overide filename prefix (optional). Default is based on UID"); + PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, " lf em 4x05_dump"); + PrintAndLogEx(NORMAL, " lf em 4x05_dump 11223344"); + PrintAndLogEx(NORMAL, " lf em 4x05_dump f card1 11223344"); + return PM3_SUCCESS; +} +static int usage_lf_em4x05_wipe(void) { + PrintAndLogEx(NORMAL, "Wipe EM4x05/EM4x69. Tag must be on antenna. "); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x05_wipe [h] "); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " c - chip type : 0 em4205"); + PrintAndLogEx(NORMAL, " 1 em4305 (default)"); + PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, " lf em 4x05_wipe"); + PrintAndLogEx(NORMAL, " lf em 4x05_wipe 11223344"); + return PM3_SUCCESS; +} +static int usage_lf_em4x05_read(void) { + PrintAndLogEx(NORMAL, "Read EM4x05/EM4x69. Tag must be on antenna. "); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x05_read [h]
"); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " address - memory address to read. (0-15)"); + PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, " lf em 4x05_read 1"); + PrintAndLogEx(NORMAL, " lf em 4x05_read 1 11223344"); + return PM3_SUCCESS; +} +static int usage_lf_em4x05_write(void) { + PrintAndLogEx(NORMAL, "Write EM4x05/4x69. Tag must be on antenna. "); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x05_write [h]
"); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " address - memory address to write to. (0-13, 99 for Protection Words)"); + PrintAndLogEx(NORMAL, " data - data to write (hex)"); + PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, " lf em 4x05_write 1 deadc0de"); + PrintAndLogEx(NORMAL, " lf em 4x05_write 1 deadc0de 11223344"); + return PM3_SUCCESS; +} +static int usage_lf_em4x05_info(void) { + PrintAndLogEx(NORMAL, "Tag information EM4205/4305/4469//4569 tags. Tag must be on antenna."); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(NORMAL, "Usage: lf em 4x05_info [h] "); + PrintAndLogEx(NORMAL, "Options:"); + PrintAndLogEx(NORMAL, " h - this help"); + PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); + PrintAndLogEx(NORMAL, "Examples:"); + PrintAndLogEx(NORMAL, " lf em 4x05_info"); + PrintAndLogEx(NORMAL, " lf em 4x05_info deadc0de"); + return PM3_SUCCESS; +} + +// even parity COLUMN +static bool EM_ColParityTest(uint8_t *bs, size_t size, uint8_t rows, uint8_t cols, uint8_t pType) { + if (rows * cols > size) return false; + uint8_t colP = 0; + + for (uint8_t c = 0; c < cols - 1; c++) { + for (uint8_t r = 0; r < rows; r++) { + colP ^= bs[(r * cols) + c]; + } + if (colP != pType) return false; + colP = 0; + } + return true; +} + +#define EM_PREAMBLE_LEN 6 +// download samples from device and copy to Graphbuffer +static bool downloadSamplesEM(void) { + + // 8 bit preamble + 32 bit word response (max clock (128) * 40bits = 5120 samples) + uint8_t got[6000]; + if (!GetFromDevice(BIG_BUF, got, sizeof(got), 0, NULL, 0, NULL, 2500, false)) { + PrintAndLogEx(WARNING, "(downloadSamplesEM) command execution time out"); + return false; + } + + setGraphBuf(got, sizeof(got)); + // set signal properties low/high/mean/amplitude and is_noise detection + computeSignalProperties(got, sizeof(got)); + RepaintGraphWindow(); + if (getSignalProperties()->isnoise) { + PrintAndLogEx(DEBUG, "No tag found - signal looks like noise"); + return false; + } + return true; +} + +// em_demod +static int doPreambleSearch(size_t *startIdx) { + + // sanity check + if (DemodBufferLen < EM_PREAMBLE_LEN) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM4305 demodbuffer too small"); + return PM3_ESOFT; + } + + // set size to 9 to only test first 3 positions for the preamble + // do not set it too long else an error preamble followed by 010 could be seen as success. + size_t size = (9 > DemodBufferLen) ? DemodBufferLen : 9; + *startIdx = 0; + // skip first two 0 bits as they might have been missed in the demod + uint8_t preamble[EM_PREAMBLE_LEN] = {0, 0, 1, 0, 1, 0}; + + if (!preambleSearchEx(DemodBuffer, preamble, EM_PREAMBLE_LEN, &size, startIdx, true)) { + uint8_t errpreamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 0, 1}; + if (!preambleSearchEx(DemodBuffer, errpreamble, EM_PREAMBLE_LEN, &size, startIdx, true)) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM4305 preamble not found :: %zu", *startIdx); + return PM3_ESOFT; + } + return PM3_EFAILED; // Error preamble found + } + return PM3_SUCCESS; +} + +static bool detectFSK(void) { + // detect fsk clock + if (GetFskClock("", false) == 0) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: FSK clock failed"); + return false; + } + // demod + int ans = FSKrawDemod(0, 0, 0, 0, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: FSK Demod failed"); + return false; + } + return true; +} +// PSK clocks should be easy to detect ( but difficult to demod a non-repeating pattern... ) +static bool detectPSK(void) { + int ans = GetPskClock("", false); + if (ans <= 0) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: PSK clock failed"); + return false; + } + //demod + //try psk1 -- 0 0 6 (six errors?!?) + ans = PSKDemod(0, 0, 6, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: PSK1 Demod failed"); + + //try psk1 inverted + ans = PSKDemod(0, 1, 6, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: PSK1 inverted Demod failed"); + return false; + } + } + // either PSK1 or PSK1 inverted is ok from here. + // lets check PSK2 later. + return true; +} +// try manchester - NOTE: ST only applies to T55x7 tags. +static bool detectASK_MAN(void) { + bool stcheck = false; + if (ASKDemod_ext(0, 0, 50, 0, false, false, false, 1, &stcheck) != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: ASK/Manchester Demod failed"); + return false; + } + return true; +} + +static bool detectASK_BI(void) { + int ans = ASKbiphaseDemod(0, 0, 1, 50, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: ASK/biphase normal demod failed"); + + ans = ASKbiphaseDemod(0, 1, 1, 50, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: ASK/biphase inverted demod failed"); + return false; + } + } + return true; +} +static bool detectNRZ(void) { + int ans = NRZrawDemod(0, 0, 1, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: NRZ normal demod failed"); + + ans = NRZrawDemod(0, 1, 1, false); + if (ans != PM3_SUCCESS) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM: NRZ inverted demod failed"); + return false; + } + } + + return true; +} + +// param: idx - start index in demoded data. +static int setDemodBufferEM(uint32_t *word, size_t idx) { + + //test for even parity bits. + uint8_t parity[45] = {0}; + memcpy(parity, DemodBuffer, 45); + if (!EM_ColParityTest(DemodBuffer + idx + EM_PREAMBLE_LEN, 45, 5, 9, 0)) { + PrintAndLogEx(DEBUG, "DEBUG: Error - End Parity check failed"); + return PM3_ESOFT; + } + + // test for even parity bits and remove them. (leave out the end row of parities so 36 bits) + if (!removeParity(DemodBuffer, idx + EM_PREAMBLE_LEN, 9, 0, 36)) { + PrintAndLogEx(DEBUG, "DEBUG: Error - EM, failed removing parity"); + return PM3_ESOFT; + } + setDemodBuff(DemodBuffer, 32, 0); + *word = bytebits_to_byteLSBF(DemodBuffer, 32); + return PM3_SUCCESS; +} + +// FSK, PSK, ASK/MANCHESTER, ASK/BIPHASE, ASK/DIPHASE, NRZ +// should cover 90% of known used configs +// the rest will need to be manually demoded for now... +static int demodEM4x05resp(uint32_t *word, bool onlyPreamble) { + size_t idx = 0; + *word = 0; + bool found_err = false; + int res = PM3_SUCCESS; + do { + if (detectASK_MAN()) { + res = doPreambleSearch(&idx); + if (res == PM3_SUCCESS) + break; + if (res == PM3_EFAILED) + // go on, maybe it's false positive and another modulation will work + found_err = true; + } + if (detectASK_BI()) { + res = doPreambleSearch(&idx); + if (res == PM3_SUCCESS) + break; + if (res == PM3_EFAILED) + found_err = true; + } + if (detectNRZ()) { + res = doPreambleSearch(&idx); + if (res == PM3_SUCCESS) + break; + if (res == PM3_EFAILED) + found_err = true; + } + if (detectFSK()) { + res = doPreambleSearch(&idx); + if (res == PM3_SUCCESS) + break; + if (res == PM3_EFAILED) + found_err = true; + } + if (detectPSK()) { + res = doPreambleSearch(&idx); + if (res == PM3_SUCCESS) + break; + if (res == PM3_EFAILED) + found_err = true; + + psk1TOpsk2(DemodBuffer, DemodBufferLen); + res = doPreambleSearch(&idx); + if (res == PM3_SUCCESS) + break; + if (res == PM3_EFAILED) + found_err = true; + } + if (found_err) + return PM3_EFAILED; + return PM3_ESOFT; + } while (0); + if (onlyPreamble) + return PM3_SUCCESS; + res = setDemodBufferEM(word, idx); + if (res == PM3_SUCCESS) + return res; + if (found_err) + return PM3_EFAILED; + return res; +} + +//////////////// 4205 / 4305 commands + +int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *word) { + + struct { + uint32_t password; + uint8_t address; + uint8_t usepwd; + } PACKED payload; + + payload.password = pwd; + payload.address = addr; + payload.usepwd = usePwd; + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X_READWORD, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (!WaitForResponseTimeout(CMD_LF_EM4X_READWORD, &resp, 10000)) { + PrintAndLogEx(WARNING, "(EM4x05ReadWord_ext) timeout while waiting for reply."); + return PM3_ETIMEOUT; + } + + if (downloadSamplesEM() == false) { + return PM3_ESOFT; + } + return demodEM4x05resp(word, false); +} + +int CmdEM4x05Demod(const char *Cmd) { +// uint8_t ctmp = tolower(param_getchar(Cmd, 0)); +// if (ctmp == 'h') return usage_lf_em4x05_demod(); + uint32_t dummy = 0; + return demodEM4x05resp(&dummy, false); +} + +int CmdEM4x05Dump(const char *Cmd) { + uint8_t addr = 0; + uint32_t pwd = 0; + bool usePwd = false; + bool needReadPwd = true; + uint8_t cmdp = 0; + uint8_t bytes[4] = {0}; + uint32_t data[16]; + char preferredName[FILE_PATH_SIZE] = {0}; + char optchk[10]; + + while (param_getchar(Cmd, cmdp) != 0x00) { + switch (tolower(param_getchar(Cmd, cmdp))) { + case 'h': + return usage_lf_em4x05_dump(); + break; + case 'f': // since f could match in password, lets confirm it is 1 character only for an option + param_getstr(Cmd, cmdp, optchk, sizeof(optchk)); + if (strlen(optchk) == 1) { // Have a single character f so filename no password + param_getstr(Cmd, cmdp + 1, preferredName, FILE_PATH_SIZE); + cmdp += 2; + break; + } // if not a single 'f' dont break and flow onto default as should be password + + default : // for backwards-compatibility options should be > 'f' else assume its the hex password` + // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) + pwd = param_get32ex(Cmd, cmdp, 1, 16); + if (pwd != 1) + usePwd = true; + cmdp++; + }; + } + + int success = PM3_SUCCESS; + int status, status14, status15; + uint32_t lock_bits = 0x00; // no blocks locked + bool gotLockBits = false; + bool lockInPW2 = false; + uint32_t word = 0; + const char *info[] = {"Info/User", "UID", "Password", "User", "Config", "User", "User", "User", "User", "User", "User", "User", "User", "User", "Lock", "Lock"}; + + if (usePwd) { + // Test first if a password is required + status = EM4x05ReadWord_ext(14, pwd, false, &word); + if (status == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); + needReadPwd = false; + } + } + PrintAndLogEx(NORMAL, "Addr | data | ascii |lck| info"); + PrintAndLogEx(NORMAL, "-----+----------+-------+---+-----"); + + // To flag any blocks locked we need to read blocks 14 and 15 first + // dont swap endin until we get block lock flags. + status14 = EM4x05ReadWord_ext(14, pwd, usePwd, &word); + if (status14 == PM3_SUCCESS) { + if (!usePwd) + needReadPwd = false; + if ((word & 0x00008000) != 0x00) { + lock_bits = word; + gotLockBits = true; + } + data[14] = word; + } else { + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + } + status15 = EM4x05ReadWord_ext(15, pwd, usePwd, &word); + if (status15 == PM3_SUCCESS) { + if ((word & 0x00008000) != 0x00) { // assume block 15 is the current lock block + lock_bits = word; + gotLockBits = true; + lockInPW2 = true; + } + data[15] = word; + } else { + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + } + uint32_t lockbit; + // Now read blocks 0 - 13 as we have 14 and 15 + for (; addr < 14; addr++) { + lockbit = (lock_bits >> addr) & 1; + if (addr == 2) { + if (usePwd) { + if ((needReadPwd) && (success != PM3_ESOFT)) { + data[addr] = BSWAP_32(pwd); + num_to_bytes(pwd, 4, bytes); + PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); + } else { + // The pwd is not needed for Login so we're not sure what's the actual content of that block + PrintAndLogEx(NORMAL, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); + } + } else { + data[addr] = 0x00; // Unknown password, but not used to set to zeros + PrintAndLogEx(NORMAL, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); + } + } else { + // success &= EM4x05ReadWord_ext(addr, pwd, usePwd, &word); + status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); // Get status for single read + if (status != PM3_SUCCESS) + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + data[addr] = BSWAP_32(word); + if (status == PM3_SUCCESS) { + num_to_bytes(word, 4, bytes); + PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %s", addr, word, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); + } else + PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); + } + } + // Print blocks 14 and 15 + // Both lock bits are protected with bit idx 14 (special case) + addr = 14; + if (status14 == PM3_SUCCESS) { + lockbit = (lock_bits >> addr) & 1; + PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? "" : _GREEN_("active")); + } else { + PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status14 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); + } + addr = 15; + if (status15 == PM3_SUCCESS) { + lockbit = (lock_bits >> 14) & 1; // beware lock bit of word15 is pr14 + PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? _GREEN_("active") : ""); + } else { + PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status15 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); + } + // Update endian for files + data[14] = BSWAP_32(data[14]); + data[15] = BSWAP_32(data[15]); + + if (success == PM3_SUCCESS) { // all ok save dump to file + // saveFileEML will add .eml extension to filename + // saveFile (binary) passes in the .bin extension. + if (strcmp(preferredName, "") == 0) // Set default filename, if not set by user + sprintf(preferredName, "lf-4x05-%08X-dump", BSWAP_32(data[1])); + + saveFileEML(preferredName, (uint8_t *)data, 16 * sizeof(uint32_t), sizeof(uint32_t)); + saveFile(preferredName, ".bin", data, sizeof(data)); + } + + return success; +} + +int CmdEM4x05Read(const char *Cmd) { + uint8_t addr; + uint32_t pwd; + bool usePwd = false; + + uint8_t ctmp = tolower(param_getchar(Cmd, 0)); + if (strlen(Cmd) == 0 || ctmp == 'h') return usage_lf_em4x05_read(); + + addr = param_get8ex(Cmd, 0, 50, 10); + pwd = param_get32ex(Cmd, 1, 0xFFFFFFFF, 16); + + if (addr > 15) { + PrintAndLogEx(WARNING, "Address must be between 0 and 15"); + return PM3_ESOFT; + } + if (pwd == 0xFFFFFFFF) { + PrintAndLogEx(INFO, "Reading address %02u", addr); + } else { + usePwd = true; + PrintAndLogEx(INFO, "Reading address %02u using password %08X", addr, pwd); + } + + uint32_t word = 0; + int status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); + if (status == PM3_SUCCESS) + PrintAndLogEx(SUCCESS, "Address %02d | %08X - %s", addr, word, (addr > 13) ? "Lock" : ""); + else if (status == PM3_EFAILED) + PrintAndLogEx(ERR, "Tag denied Read operation"); + else + PrintAndLogEx(WARNING, "No answer from tag"); + return status; +} + +int CmdEM4x05Write(const char *Cmd) { + uint8_t ctmp = tolower(param_getchar(Cmd, 0)); + if (strlen(Cmd) == 0 || ctmp == 'h') return usage_lf_em4x05_write(); + + bool usePwd = false; + uint8_t addr; + uint32_t data, pwd; + + addr = param_get8ex(Cmd, 0, 50, 10); + data = param_get32ex(Cmd, 1, 0, 16); + pwd = param_get32ex(Cmd, 2, 0xFFFFFFFF, 16); + bool protectOperation = addr == 99; // will do better with cliparser... + + if ((addr > 13) && (!protectOperation)) { + PrintAndLogEx(WARNING, "Address must be between 0 and 13"); + return PM3_EINVARG; + } + if (pwd == 0xFFFFFFFF) { + if (protectOperation) + PrintAndLogEx(INFO, "Writing protection words data %08X", data); + else + PrintAndLogEx(INFO, "Writing address %d data %08X", addr, data); + } else { + usePwd = true; + if (protectOperation) + PrintAndLogEx(INFO, "Writing protection words data %08X using password %08X", data, pwd); + else + PrintAndLogEx(INFO, "Writing address %d data %08X using password %08X", addr, data, pwd); + } + + if (protectOperation) { // set Protect Words + struct { + uint32_t password; + uint32_t data; + uint8_t usepwd; + } PACKED payload; + + payload.password = pwd; + payload.data = data; + payload.usepwd = usePwd; + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X_PROTECTWORD, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (!WaitForResponseTimeout(CMD_LF_EM4X_PROTECTWORD, &resp, 2000)) { + PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); + return PM3_ETIMEOUT; + } + } else { + struct { + uint32_t password; + uint32_t data; + uint8_t address; + uint8_t usepwd; + } PACKED payload; + + payload.password = pwd; + payload.data = data; + payload.address = addr; + payload.usepwd = usePwd; + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X_WRITEWORD, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (!WaitForResponseTimeout(CMD_LF_EM4X_WRITEWORD, &resp, 2000)) { + PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); + return PM3_ETIMEOUT; + } + } + if (!downloadSamplesEM()) + return PM3_ENODATA; + + uint32_t dummy = 0; + int status = demodEM4x05resp(&dummy, true); + if (status == PM3_SUCCESS) + PrintAndLogEx(SUCCESS, "Success writing to tag"); + else if (status == PM3_EFAILED) + PrintAndLogEx(ERR, "Tag denied %s operation", protectOperation ? "Protect" : "Write"); + else + PrintAndLogEx(DEBUG, "No answer from tag"); + + PrintAndLogEx(HINT, "Hint: try " _YELLOW_("`lf em 4x05_read`") " to verify"); + return status; +} + +int CmdEM4x05Wipe(const char *Cmd) { + uint8_t addr = 0; + uint32_t pwd = 0; + uint8_t cmdp = 0; + uint8_t chipType = 1; // em4305 + uint32_t chipInfo = 0x00040072; // Chip info/User Block normal 4305 Chip Type + uint32_t chipUID = 0x614739AE; // UID normally readonly, but just in case + uint32_t blockData = 0x00000000; // UserBlock/Password (set to 0x00000000 for a wiped card1 + uint32_t config = 0x0001805F; // Default config (no password) + int success = PM3_SUCCESS; + char cmdStr [100]; + char optchk[10]; + + while (param_getchar(Cmd, cmdp) != 0x00) { + // check if cmd is a 1 byte option + param_getstr(Cmd, cmdp, optchk, sizeof(optchk)); + if (strlen(optchk) == 1) { // Have a single character so option not part of password + switch (tolower(param_getchar(Cmd, cmdp))) { + case 'c': // chip type + if (param_getchar(Cmd, cmdp) != 0x00) + chipType = param_get8ex(Cmd, cmdp + 1, 0, 10); + cmdp += 2; + break; + case 'h': // return usage_lf_em4x05_wipe(); + default : // Unknown or 'h' send help + return usage_lf_em4x05_wipe(); + break; + }; + } else { // Not a single character so assume password + pwd = param_get32ex(Cmd, cmdp, 1, 16); + cmdp++; + } + } + + switch (chipType) { + case 0 : // em4205 + chipInfo = 0x00040070; + config = 0x0001805F; + break; + case 1 : // em4305 + chipInfo = 0x00040072; + config = 0x0001805F; + break; + default : // Type 0/Default : EM4305 + chipInfo = 0x00040072; + config = 0x0001805F; + } + + // block 0 : User Data or Chip Info + sprintf(cmdStr, "%d %08X %08X", 0, chipInfo, pwd); + CmdEM4x05Write(cmdStr); + // block 1 : UID - this should be read only for EM4205 and EM4305 not sure about others + sprintf(cmdStr, "%d %08X %08X", 1, chipUID, pwd); + CmdEM4x05Write(cmdStr); + // block 2 : password + sprintf(cmdStr, "%d %08X %08X", 2, blockData, pwd); + CmdEM4x05Write(cmdStr); + pwd = blockData; // Password should now have changed, so use new password + // block 3 : user data + sprintf(cmdStr, "%d %08X %08X", 3, blockData, pwd); + CmdEM4x05Write(cmdStr); + // block 4 : config + sprintf(cmdStr, "%d %08X %08X", 4, config, pwd); + CmdEM4x05Write(cmdStr); + + // Remainder of user/data blocks + for (addr = 5; addr < 14; addr++) {// Clear user data blocks + sprintf(cmdStr, "%d %08X %08X", addr, blockData, pwd); + CmdEM4x05Write(cmdStr); + } + + return success; +} + +static void printEM4x05config(uint32_t wordData) { + uint16_t datarate = (((wordData & 0x3F) + 1) * 2); + uint8_t encoder = ((wordData >> 6) & 0xF); + char enc[14]; + memset(enc, 0, sizeof(enc)); + + uint8_t PSKcf = (wordData >> 10) & 0x3; + char cf[10]; + memset(cf, 0, sizeof(cf)); + uint8_t delay = (wordData >> 12) & 0x3; + char cdelay[33]; + memset(cdelay, 0, sizeof(cdelay)); + uint8_t numblks = EM4x05_GET_NUM_BLOCKS(wordData); + uint8_t LWR = numblks + 5 - 1; //last word read + switch (encoder) { + case 0: + snprintf(enc, sizeof(enc), "NRZ"); + break; + case 1: + snprintf(enc, sizeof(enc), "Manchester"); + break; + case 2: + snprintf(enc, sizeof(enc), "Biphase"); + break; + case 3: + snprintf(enc, sizeof(enc), "Miller"); + break; + case 4: + snprintf(enc, sizeof(enc), "PSK1"); + break; + case 5: + snprintf(enc, sizeof(enc), "PSK2"); + break; + case 6: + snprintf(enc, sizeof(enc), "PSK3"); + break; + case 7: + snprintf(enc, sizeof(enc), "Unknown"); + break; + case 8: + snprintf(enc, sizeof(enc), "FSK1"); + break; + case 9: + snprintf(enc, sizeof(enc), "FSK2"); + break; + default: + snprintf(enc, sizeof(enc), "Unknown"); + break; + } + + switch (PSKcf) { + case 0: + snprintf(cf, sizeof(cf), "RF/2"); + break; + case 1: + snprintf(cf, sizeof(cf), "RF/8"); + break; + case 2: + snprintf(cf, sizeof(cf), "RF/4"); + break; + case 3: + snprintf(cf, sizeof(cf), "unknown"); + break; + } + + switch (delay) { + case 0: + snprintf(cdelay, sizeof(cdelay), "no delay"); + break; + case 1: + snprintf(cdelay, sizeof(cdelay), "BP/8 or 1/8th bit period delay"); + break; + case 2: + snprintf(cdelay, sizeof(cdelay), "BP/4 or 1/4th bit period delay"); + break; + case 3: + snprintf(cdelay, sizeof(cdelay), "no delay"); + break; + } + uint8_t readLogin = (wordData & EM4x05_READ_LOGIN_REQ) >> 18; + uint8_t readHKL = (wordData & EM4x05_READ_HK_LOGIN_REQ) >> 19; + uint8_t writeLogin = (wordData & EM4x05_WRITE_LOGIN_REQ) >> 20; + uint8_t writeHKL = (wordData & EM4x05_WRITE_HK_LOGIN_REQ) >> 21; + uint8_t raw = (wordData & EM4x05_READ_AFTER_WRITE) >> 22; + uint8_t disable = (wordData & EM4x05_DISABLE_ALLOWED) >> 23; + uint8_t rtf = (wordData & EM4x05_READER_TALK_FIRST) >> 24; + uint8_t pigeon = (wordData & (1 << 26)) >> 26; + + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "--- " _CYAN_("Config Information") " ---------------------------"); + PrintAndLogEx(INFO, "ConfigWord: %08X (Word 4)", wordData); + PrintAndLogEx(INFO, " Data Rate: %02u | "_YELLOW_("RF/%u"), wordData & 0x3F, datarate); + PrintAndLogEx(INFO, " Encoder: %u | " _YELLOW_("%s"), encoder, enc); + PrintAndLogEx(INFO, " PSK CF: %u | %s", PSKcf, cf); + PrintAndLogEx(INFO, " Delay: %u | %s", delay, cdelay); + PrintAndLogEx(INFO, " LastWordR: %02u | Address of last word for default read - meaning %u blocks are output", LWR, numblks); + PrintAndLogEx(INFO, " ReadLogin: %u | Read login is %s", readLogin, readLogin ? _YELLOW_("required") : _GREEN_("not required")); + PrintAndLogEx(INFO, " ReadHKL: %u | Read housekeeping words login is %s", readHKL, readHKL ? _YELLOW_("required") : _GREEN_("not required")); + PrintAndLogEx(INFO, "WriteLogin: %u | Write login is %s", writeLogin, writeLogin ? _YELLOW_("required") : _GREEN_("not required")); + PrintAndLogEx(INFO, " WriteHKL: %u | Write housekeeping words login is %s", writeHKL, writeHKL ? _YELLOW_("required") : _GREEN_("not Required")); + PrintAndLogEx(INFO, " R.A.W.: %u | Read after write is %s", raw, raw ? "on" : "off"); + PrintAndLogEx(INFO, " Disable: %u | Disable command is %s", disable, disable ? "accepted" : "not accepted"); + PrintAndLogEx(INFO, " R.T.F.: %u | Reader talk first is %s", rtf, rtf ? _YELLOW_("enabled") : "disabled"); + PrintAndLogEx(INFO, " Pigeon: %u | Pigeon mode is %s", pigeon, pigeon ? _YELLOW_("enabled") : "disabled"); +} + +static void printEM4x05info(uint32_t block0, uint32_t serial) { + + uint8_t chipType = (block0 >> 1) & 0xF; + uint8_t cap = (block0 >> 5) & 3; + uint16_t custCode = (block0 >> 9) & 0x2FF; + + PrintAndLogEx(INFO, " block0: %X", block0); + PrintAndLogEx(INFO, " chiptype: %X", chipType); + PrintAndLogEx(INFO, "capacitor: %X", cap); + PrintAndLogEx(INFO, " custcode: %X", custCode); + + /* bits + // 0, rfu + // 1,2,3,4 chip type + // 5,6 resonant cap + // 7,8, rfu + // 9 - 18 customer code + // 19, rfu + + 98765432109876543210 + 001000000000 + // 00100000000001111000 + xxx---- + // 1100 + // 011 + // 00100000000 + */ + + PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------"); + + char ctstr[50]; + snprintf(ctstr, sizeof(ctstr), " Chip Type: %u | ", chipType); + switch (chipType) { + case 9: + snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4305"); + break; + case 4: + snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4469"); + break; + case 8: + snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4205"); + break; + //add more here when known + default: + snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "Unknown"); + break; + } + PrintAndLogEx(SUCCESS, "%s", ctstr); + + switch (cap) { + case 3: + PrintAndLogEx(SUCCESS, " Cap Type: %u | 330pF", cap); + break; + case 2: + PrintAndLogEx(SUCCESS, " Cap Type: %u | %spF", cap, (chipType == 2) ? "75" : "210"); + break; + case 1: + PrintAndLogEx(SUCCESS, " Cap Type: %u | 250pF", cap); + break; + case 0: + PrintAndLogEx(SUCCESS, " Cap Type: %u | no resonant capacitor", cap); + break; + default: + PrintAndLogEx(SUCCESS, " Cap Type: %u | unknown", cap); + break; + } + + PrintAndLogEx(SUCCESS, " Cust Code: %03u | %s", custCode, (custCode == 0x200) ? "Default" : "Unknown"); + if (serial != 0) + PrintAndLogEx(SUCCESS, " Serial #: " _YELLOW_("%08X"), serial); +} + +static void printEM4x05ProtectionBits(uint32_t word, uint8_t addr) { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "--- " _CYAN_("Protection") " ---------------------------"); + PrintAndLogEx(INFO, "ProtectionWord: %08X (Word %i)", word, addr); + for (uint8_t i = 0; i < 15; i++) { + PrintAndLogEx(INFO, " Word: %02u | %s", i, ((1 << i) & word) ? _RED_("write Locked") : "unlocked"); + if (i == 14) + PrintAndLogEx(INFO, " Word: %02u | %s", i + 1, ((1 << i) & word) ? _RED_("write locked") : "unlocked"); + } +} + +//quick test for EM4x05/EM4x69 tag +bool EM4x05IsBlock0(uint32_t *word) { + return (EM4x05ReadWord_ext(0, 0, false, word) == PM3_SUCCESS); +} + +int CmdEM4x05Info(const char *Cmd) { +#define EM_SERIAL_BLOCK 1 +#define EM_CONFIG_BLOCK 4 +#define EM_PROT1_BLOCK 14 +#define EM_PROT2_BLOCK 15 + uint32_t pwd; + uint32_t word = 0, block0 = 0, serial = 0; + bool usePwd = false; + uint8_t ctmp = tolower(param_getchar(Cmd, 0)); + if (ctmp == 'h') return usage_lf_em4x05_info(); + + // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) + pwd = param_get32ex(Cmd, 0, 0xFFFFFFFF, 16); + + if (pwd != 0xFFFFFFFF) + usePwd = true; + + // read word 0 (chip info) + // block 0 can be read even without a password. + if (EM4x05IsBlock0(&block0) == false) + return PM3_ESOFT; + + // read word 1 (serial #) doesn't need pwd + // continue if failed, .. non blocking fail. + EM4x05ReadWord_ext(EM_SERIAL_BLOCK, 0, false, &serial); + printEM4x05info(block0, serial); + + // read word 4 (config block) + // needs password if one is set + if (EM4x05ReadWord_ext(EM_CONFIG_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) + return PM3_ESOFT; + + printEM4x05config(word); + + // read word 14 and 15 to see which is being used for the protection bits + if (EM4x05ReadWord_ext(EM_PROT1_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) { + return PM3_ESOFT; + } + if (word & 0x8000) { + printEM4x05ProtectionBits(word, EM_PROT1_BLOCK); + return PM3_SUCCESS; + } else { // if status bit says this is not the used protection word + if (EM4x05ReadWord_ext(EM_PROT2_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) + return PM3_ESOFT; + if (word & 0x8000) { + printEM4x05ProtectionBits(word, EM_PROT2_BLOCK); + return PM3_SUCCESS; + } + } + //something went wrong + return PM3_ESOFT; +} + +static bool is_cancelled(void) { + if (kbd_enter_pressed()) { + PrintAndLogEx(WARNING, "\naborted via keyboard!\n"); + return true; + } + return false; +} +// load a default pwd file. +int CmdEM4x05Chk(const char *Cmd) { + + CLIParserContext *ctx; + CLIParserInit(&ctx, "lf em 4x05_chk", + "This command uses a dictionary attack against EM4205/4305/4469/4569", + "lf em 4x05_chk\n" + "lf em 4x05_chk -e 0x00000022B8 -> remember to use 0x for hex\n" + "lf em 4x05_chk -f t55xx_default_pwds -> use T55xx default dictionary" + ); + + void *argtable[] = { + arg_param_begin, + arg_strx0("f", "file", "<*.dic>", "loads a default keys dictionary file <*.dic>"), + arg_u64_0("e", "em", "", "try the calculated password from some cloners based on EM4100 ID"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + int fnlen = 0; + char filename[FILE_PATH_SIZE] = {0}; + CLIParamStrToBuf(arg_get_str(ctx, 1), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen); + uint64_t card_id = arg_get_u64_def(ctx, 2, 0); + CLIParserFree(ctx); + + if (strlen(filename) == 0) { + snprintf(filename, sizeof(filename), "t55xx_default_pwds"); + } + PrintAndLogEx(NORMAL, ""); + + uint8_t addr = 4; + uint32_t word = 0; + bool found = false; + uint64_t t1 = msclock(); + + // White cloner password based on EM4100 ID + if ( card_id > 0 ) { + + uint32_t pwd = lf_t55xx_white_pwdgen(card_id & 0xFFFFFFFF); + PrintAndLogEx(INFO, "testing %08"PRIX32" generated ", pwd); + + int status = EM4x05ReadWord_ext(addr, pwd, true, &word); + if (status == PM3_SUCCESS) { + PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", pwd); + found = true; + } + } + + // Loop dictionary + uint8_t *keyBlock = NULL; + if (found == false) { + + PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); + + word = 0; + uint32_t keycount = 0; + + int res = loadFileDICTIONARY_safe(filename, (void **) &keyBlock, 4, &keycount); + if (res != PM3_SUCCESS || keycount == 0 || keyBlock == NULL) { + PrintAndLogEx(WARNING, "no keys found in file"); + if (keyBlock != NULL) + free(keyBlock); + + return PM3_ESOFT; + } + + for (uint32_t c = 0; c < keycount; ++c) { + + if (!session.pm3_present) { + PrintAndLogEx(WARNING, "device offline\n"); + free(keyBlock); + return PM3_ENODATA; + } + + if (is_cancelled()) { + free(keyBlock); + return PM3_EOPABORTED; + } + + uint32_t curr_password = bytes_to_num(keyBlock + 4 * c, 4); + + PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password); + + int status = EM4x05ReadWord_ext(addr, curr_password, 1, &word); + if (status == PM3_SUCCESS) { + PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", curr_password); + found = true; + break; + } + } + } + + if (found == false) + PrintAndLogEx(WARNING, "check pwd failed"); + + free(keyBlock); + + t1 = msclock() - t1; + PrintAndLogEx(SUCCESS, "\ntime in check pwd " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); + return PM3_SUCCESS; +} + +typedef struct { + uint16_t cnt; + uint32_t value; +} em4x05_unlock_item_t; + +static int unlock_write_protect(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { + + struct { + uint32_t password; + uint32_t data; + uint8_t usepwd; + } PACKED payload; + + payload.password = pwd; + payload.data = data; + payload.usepwd = use_pwd; + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X_PROTECTWORD, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (WaitForResponseTimeout(CMD_LF_EM4X_PROTECTWORD, &resp, 2000) == false) { + PrintAndLogEx(ERR, "Error occurred, device did not respond during write operation."); + return PM3_ETIMEOUT; + } + + if (!downloadSamplesEM()) + return PM3_ENODATA; + + uint32_t dummy = 0; + int status = demodEM4x05resp(&dummy, true); + if (status == PM3_SUCCESS && verbose) + PrintAndLogEx(SUCCESS, "Success writing to tag"); + else if (status == PM3_EFAILED) + PrintAndLogEx(ERR, "Tag denied PROTECT operation"); + else + PrintAndLogEx(DEBUG, "No answer from tag"); + + return status; +} +static int unlock_reset(bool use_pwd, uint32_t pwd, uint32_t data, bool verbose) { + if (verbose) + PrintAndLogEx(INFO, "resetting the " _RED_("active") " lock block"); + + return unlock_write_protect(use_pwd, pwd, data, false); +} +static void unlock_add_item(em4x05_unlock_item_t *array, uint8_t len, uint32_t value) { + + uint8_t i = 0; + for (; i < len; i++) { + if ( array[i].value == value ) { + array[i].cnt++; + break; + } + if ( array[i].cnt == 0 ) { + array[i].cnt++; + array[i].value = value; + break; + } + } +} + +int CmdEM4x05Unlock(const char *Cmd) { + + CLIParserContext *ctx; + CLIParserInit(&ctx, "lf em 4x05_unlock", + "execute tear off against EM4205/4305/4469/4569", + "lf em 4x05_unlock\n" + "lf em 4x05_unlock -s 4100 -e 4100 -> lock on and autotune at 4100us\n" + "lf em 4x05_unlock -n 10 -s 3000 -e 4400 -> scan delays 3000us -> 4400us" + ); + + void *argtable[] = { + arg_param_begin, + arg_int0("n", NULL, NULL, "steps to skip"), + arg_int0("s", "start", "", "start scan from delay (us)"), + arg_int0("e", "end", "", "end scan at delay (us)"), + arg_u64_0("p", "pwd", "", "password (0x00000000)"), + arg_lit0("v", "verbose", "verbose output"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + double n = (double)arg_get_int_def(ctx, 1, 0); + double start = (double)arg_get_int_def(ctx, 2, 2000); + double end = (double)arg_get_int_def(ctx, 3, 6000); + uint64_t inputpwd = arg_get_u64_def(ctx, 4, 0xFFFFFFFFFFFFFFFF); + bool verbose = arg_get_lit(ctx, 5); + CLIParserFree(ctx); + + if ( start > end ) { + PrintAndLogEx(FAILED, "start delay can\'t be larger than end delay %.0lf vs %.0lf", start, end); + return PM3_EINVARG; + } + + if (session.pm3_present == false) { + PrintAndLogEx(WARNING, "device offline\n"); + return PM3_ENODATA; + } + + bool use_pwd = false; + uint32_t pwd = 0; + if (inputpwd != 0xFFFFFFFFFFFFFFFF) { + use_pwd = true; + pwd = inputpwd & 0xFFFFFFFF; + } + + uint32_t search_value = 0; + uint32_t write_value = 0; + // + // inital phase + // + // read word 14 + uint32_t init_14 = 0; + int res = EM4x05ReadWord_ext(14, pwd, use_pwd, &init_14); + if (res != PM3_SUCCESS) { + PrintAndLogEx(FAILED, "failed to read word 14\n"); + return PM3_ENODATA; + } + + + // read 15 + uint32_t init_15 = 0; + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &init_15); + if (res != PM3_SUCCESS) { + PrintAndLogEx(FAILED, "failed to read word 15\n"); + return PM3_ENODATA; + } + +#define ACTIVE_MASK 0x00008000 + if ((init_15 & ACTIVE_MASK) == ACTIVE_MASK) { + search_value = init_15; + } else { + search_value = init_14; + } + + if (search_value == ACTIVE_MASK) { + PrintAndLogEx(SUCCESS, "Tag already fully unlocked, nothing to do"); + return PM3_SUCCESS; + } + + bool my_auto = false; + if (n == 0) { + my_auto = true; + n = (end - start) / 2; + } + + // fix at one specific delay + if (start == end) { + n = 0; + } + + PrintAndLogEx(INFO, "--------------- " _CYAN_("EM4x05 tear-off : target PROTECT") " -----------------------\n"); + + PrintAndLogEx(INFO, "initial prot 14&15 [ " _GREEN_("%08X") ", " _GREEN_("%08X") " ]", init_14, init_15); + + if (use_pwd) { + PrintAndLogEx(INFO, " target password [ " _GREEN_("%08X") " ]", pwd); + } + if (my_auto) { + PrintAndLogEx(INFO, " automatic mode [ " _GREEN_("enabled") " ]"); + } + + PrintAndLogEx(INFO, " target stepping [ " _GREEN_("%.0lf") " ]", n); + PrintAndLogEx(INFO, "target delay range [ " _GREEN_("%.0lf") " ... " _GREEN_("%.0lf") " ]", start, end); + PrintAndLogEx(INFO, " search value [ " _GREEN_("%08X") " ]", search_value); + PrintAndLogEx(INFO, " write value [ " _GREEN_("%08X") " ]", write_value); + + PrintAndLogEx(INFO, "----------------------------------------------------------------------------\n"); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "--------------- " _CYAN_("start") " -----------------------\n"); + + int exit_code = PM3_SUCCESS; + uint32_t word14 = 0, word15 = 0; + uint32_t word14b = 0, word15b = 0; + uint32_t tries = 0; + uint32_t soon = 0; + uint32_t late = 0; + + em4x05_unlock_item_t flipped[64]; + + // + // main loop + // + bool success = false; + uint64_t t1 = msclock(); + while (start <= end) { + + if (my_auto && n < 1) { + PrintAndLogEx(INFO, "Reached n < 1 => " _YELLOW_("disabling automatic mode")); + end = start; + my_auto = false; + n = 0; + } + + if (my_auto == false) { + start += n; + } + + if (tries >= 5 && n == 0 && soon != late) { + + if (soon > late) { + PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust +1 us >> %.0lf us"), tries, soon, late, start); + start++; + end++; + } else { + PrintAndLogEx(INFO, "Tried %d times, soon:%i late:%i => " _CYAN_("adjust -1 us >> %.0lf us"), tries, soon, late, start); + start--; + end--; + } + tries = 0; + soon = 0; + late = 0; + } + + if (is_cancelled()) { + exit_code = PM3_EOPABORTED; + break; + } + + // set tear off trigger + clearCommandBuffer(); + tearoff_params_t params = { + .delay_us = start, + .on = true, + .off = false + }; + res = handle_tearoff(¶ms, verbose); + if ( res != PM3_SUCCESS ) { + PrintAndLogEx(WARNING, "failed to configure tear off"); + return PM3_ESOFT; + } + + // write + res = unlock_write_protect(use_pwd, pwd, write_value, verbose); + + // read after trigger + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14); + if (res != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; + } + + // read after trigger + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15); + if (res != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "failed to read 15"); + return PM3_ESOFT; + } + + if (verbose) + PrintAndLogEx(INFO, "ref:%08X 14:%08X 15:%08X ", search_value, word14, word15); + + if ( word14 == search_value && word15 == 0) { + PrintAndLogEx(INFO, "Status: Nothing happened => " _GREEN_("tearing too soon")); + + if (my_auto) { + start += n; + PrintAndLogEx(INFO, " => " _CYAN_("adjust +%.0lf us >> %.0lf us"), n, start); + n /= 2; + } else { + soon++; + } + } else { + + if (word15 == search_value) { + + if (word14 == 0) { + PrintAndLogEx(INFO, "Status: Protect succeeded => " _GREEN_("tearing too late")); + } else { + if ( word14 == search_value) { + PrintAndLogEx(INFO, "Status: 15 ok, 14 not yet erased => " _GREEN_("tearing too late")); + } else { + PrintAndLogEx(INFO, "Status: 15 ok, 14 partially erased => " _GREEN_("tearing too late")); + } + } + + unlock_reset(use_pwd, pwd, write_value, verbose); + + // read after reset + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); + if (res != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; + } + + if (word14b == 0) { + + unlock_reset(use_pwd, pwd, write_value, verbose); + + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); + if (res != PM3_SUCCESS) { + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; + } + } + + if (word14b != search_value) { + + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); + if (res == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS:") " 14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + success = true; + break; + } else { + PrintAndLogEx(WARNING, "failed to read 15"); + return PM3_ESOFT; + } + } + if (my_auto) { + end = start; + start -= n; + PrintAndLogEx(INFO, " => " _CYAN_("adjust -%.0lf us >> %.0lf us"), n, start); + n /= 2; + } else { + late++; + } + + } else { + + if (( word15 & ACTIVE_MASK) == ACTIVE_MASK) { + + PrintAndLogEx(INFO, "Status: 15 bitflipped and active => " _RED_("SUCCESS?: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); + PrintAndLogEx(INFO, "Committing results..."); + + unlock_reset(use_pwd, pwd, write_value, verbose); + + // read after reset + res = EM4x05ReadWord_ext(14, pwd, use_pwd, &word14b); + if ( res != PM3_SUCCESS ) { + PrintAndLogEx(WARNING, "failed to read 14"); + return PM3_ESOFT; + } + + res = EM4x05ReadWord_ext(15, pwd, use_pwd, &word15b); + if ( res != PM3_SUCCESS ) { + PrintAndLogEx(WARNING, "failed to read 15"); + return PM3_ESOFT; + } + + if (verbose) + PrintAndLogEx(INFO, "ref:%08x 14:%08X 15:%08X", search_value, word14b, word15b); + + if ((word14b & ACTIVE_MASK) == ACTIVE_MASK) { + + if (word14b == word15) { + PrintAndLogEx(INFO, "Status: confirmed => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + + unlock_add_item(flipped, 64, word14b); + success = true; + break; + } + + if (word14b != search_value) { + PrintAndLogEx(INFO, "Status: new definitive value! => " _RED_("SUCCESS: ") "14: " _CYAN_("%08X") " 15: %08X", word14b, word15b); + + unlock_add_item(flipped, 64, word14b); + success = true; + break; + } + + PrintAndLogEx(INFO, "Status: failed to commit bitflip => " _RED_("FAIL: ") "14: %08X 15: %08X", word14b, word15b); + } + if (my_auto) { + n = 0; + end = start; + } else { + tries = 0; + soon = 0; + late = 0; + } + } else { + PrintAndLogEx(INFO, "Status: 15 bitflipped but inactive => " _YELLOW_("PROMISING: ") "14: %08X 15: " _CYAN_("%08X"), word14, word15); + + unlock_add_item(flipped, 64, word15); + + soon ++; + } + } + } + + if (my_auto == false) { + tries++; + } + } + + PrintAndLogEx(INFO, "----------------------------- " _CYAN_("exit") " ----------------------------------\n"); + t1 = msclock() - t1; + PrintAndLogEx(SUCCESS, "\ntime in unlock " _YELLOW_("%.0f") " seconds\n", (float)t1 / 1000.0); + if (success) { + uint32_t bitflips = search_value ^ word14b; + PrintAndLogEx(INFO, "Old protection word => " _YELLOW_("%08X"), search_value); + char bitstring[9] = {0}; + for (int i=0; i < 8; i++) { + bitstring[i] = bitflips & (0xF << ((7-i) * 4)) ? 'x' : '.'; + } + // compute number of bits flipped + + PrintAndLogEx(INFO, "Bitflips: %2u events => %s", bitcount32(bitflips), bitstring); + PrintAndLogEx(INFO, "New protection word => " _CYAN_("%08X") "\n", word14b); + + + PrintAndLogEx(INFO, "Try " _YELLOW_("`lf em 4x05_dump`")); + } + + if (verbose) { + PrintAndLogEx(NORMAL, "Stats:"); + PrintAndLogEx(INFO, " idx | value | cnt | flipped bits"); + PrintAndLogEx(INFO, "-----+----------+-----+------"); + for (uint8_t i = 0; i < 64; i++) { + if (flipped[i].cnt == 0) + break; + + PrintAndLogEx(INFO, " %3u | %08X | %3u | %u", i, flipped[i].value, flipped[i].cnt, bitcount32(search_value ^ flipped[i].value)); + } + } + PrintAndLogEx(NORMAL, ""); + return exit_code; +} diff --git a/client/src/cmdlfem4x05.h b/client/src/cmdlfem4x05.h new file mode 100644 index 000000000..0c41f431f --- /dev/null +++ b/client/src/cmdlfem4x05.h @@ -0,0 +1,31 @@ +//----------------------------------------------------------------------------- +// Copyright (C) 2010 iZsh +// 2016, 2017 marshmellow, iceman +// This code is licensed to you under the terms of the GNU GPL, version 2 or, +// at your option, any later version. See the LICENSE.txt file for the text of +// the license. +//----------------------------------------------------------------------------- +// Low frequency EM4x05 commands +//----------------------------------------------------------------------------- + +#ifndef CMDLFEM4X05_H__ +#define CMDLFEM4X05_H__ + +#include "common.h" + +int CmdLFEM4X05(const char *Cmd); + +bool EM4x05IsBlock0(uint32_t *word); +int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *word); + + +int CmdEM4x05Demod(const char *Cmd); +int CmdEM4x05Dump(const char *Cmd); +int CmdEM4x05Read(const char *Cmd); +int CmdEM4x05Write(const char *Cmd); +int CmdEM4x05Wipe(const char *Cmd); +int CmdEM4x05Info(const char *Cmd); +int CmdEM4x05Chk(const char *Cmd); +int CmdEM4x05Unlock(const char *Cmd); + +#endif diff --git a/client/src/scripting.c b/client/src/scripting.c index e603ce359..8d990fe1b 100644 --- a/client/src/scripting.c +++ b/client/src/scripting.c @@ -36,7 +36,7 @@ #include "fileutils.h" // searchfile #include "cmdlf.h" // lf_config #include "generator.h" -#include "cmdlfem4x.h" // read 4305 +#include "cmdlfem4x05.h" // read 4305 #include "cmdlfem4x50.h" // read 4350 #include "em4x50.h" // 4x50 structs From bb59250ecaabada8dbf262e971f16ea194c89e54 Mon Sep 17 00:00:00 2001 From: mwalker33 <51802811+mwalker33@users.noreply.github.com> Date: Sat, 17 Oct 2020 09:20:33 +1100 Subject: [PATCH 041/125] Cliparser fix Fix CLIGetStrwithRetrun Allows casting and requires the buffer length to be passed in. Existing uses of the function have been updated. --- client/deps/cliparser/cliparser.h | 2 +- client/src/cmdhffido.c | 11 ++++++++++- client/src/cmdlfhid.c | 2 +- client/src/cmdlfkeri.c | 2 +- client/src/emv/cmdemv.c | 2 +- doc/cliparser.md | 4 ++-- 6 files changed, 16 insertions(+), 7 deletions(-) diff --git a/client/deps/cliparser/cliparser.h b/client/deps/cliparser/cliparser.h index 68beca038..89c9e00ca 100644 --- a/client/deps/cliparser/cliparser.h +++ b/client/deps/cliparser/cliparser.h @@ -49,7 +49,7 @@ #define CLIGetHexWithReturn(ctx, paramnum, data, datalen) if (CLIParamHexToBuf(arg_get_str((ctx), (paramnum)), (data), sizeof((data)), (datalen))) {CLIParserFree((ctx)); return PM3_ESOFT;} -#define CLIGetStrWithReturn(ctx, paramnum, data, datalen) if (CLIParamStrToBuf(arg_get_str((ctx), (paramnum)), (data), sizeof((data)), (datalen))) {CLIParserFree((ctx)); return PM3_ESOFT;} +#define CLIGetStrWithReturn(ctx, paramnum, data, datalen) if (CLIParamStrToBuf(arg_get_str((ctx), (paramnum)), (data), (*datalen), (datalen))) {CLIParserFree((ctx)); return PM3_ESOFT;} typedef struct { void **argtable; diff --git a/client/src/cmdhffido.c b/client/src/cmdhffido.c index eac2c71c5..53cb10c98 100644 --- a/client/src/cmdhffido.c +++ b/client/src/cmdhffido.c @@ -209,6 +209,7 @@ static int cmd_hf_fido_register(const char *cmd) { if (paramsPlain) { memset(cdata, 0x00, 32); + chlen = sizeof(cdata); CLIGetStrWithReturn(ctx, 6, cdata, &chlen); if (chlen > 16) { PrintAndLogEx(ERR, "ERROR: challenge parameter length in ASCII mode must be less than 16 chars instead of: %d", chlen); @@ -216,6 +217,7 @@ static int cmd_hf_fido_register(const char *cmd) { return PM3_EINVARG; } } else { + chlen = sizeof(cdata); CLIGetHexWithReturn(ctx, 6, cdata, &chlen); if (chlen && chlen != 32) { PrintAndLogEx(ERR, "ERROR: challenge parameter length must be 32 bytes only."); @@ -229,6 +231,7 @@ static int cmd_hf_fido_register(const char *cmd) { if (paramsPlain) { memset(adata, 0x00, 32); + applen = sizeof(adata); CLIGetStrWithReturn(ctx, 7, adata, &applen); if (applen > 16) { PrintAndLogEx(ERR, "ERROR: application parameter length in ASCII mode must be less than 16 chars instead of: %d", applen); @@ -236,6 +239,7 @@ static int cmd_hf_fido_register(const char *cmd) { return PM3_EINVARG; } } else { + applen = sizeof(adata); CLIGetHexWithReturn(ctx, 7, adata, &applen); if (applen && applen != 32) { PrintAndLogEx(ERR, "ERROR: application parameter length must be 32 bytes only."); @@ -485,6 +489,7 @@ static int cmd_hf_fido_authenticate(const char *cmd) { if (paramsPlain) { memset(hdata, 0x00, 32); + hdatalen = sizeof(hdata); CLIGetStrWithReturn(ctx, 9, hdata, &hdatalen); if (hdatalen > 16) { PrintAndLogEx(ERR, "ERROR: challenge parameter length in ASCII mode must be less than 16 chars instead of: %d", hdatalen); @@ -492,6 +497,7 @@ static int cmd_hf_fido_authenticate(const char *cmd) { return PM3_EINVARG; } } else { + hdatalen = sizeof(hdata); CLIGetHexWithReturn(ctx, 10, hdata, &hdatalen); if (hdatalen && hdatalen != 32) { PrintAndLogEx(ERR, "ERROR: challenge parameter length must be 32 bytes only."); @@ -505,6 +511,7 @@ static int cmd_hf_fido_authenticate(const char *cmd) { if (paramsPlain) { memset(hdata, 0x00, 32); + hdatalen = sizeof(hdata); CLIGetStrWithReturn(ctx, 11, hdata, &hdatalen); if (hdatalen > 16) { PrintAndLogEx(ERR, "ERROR: application parameter length in ASCII mode must be less than 16 chars instead of: %d", hdatalen); @@ -512,6 +519,7 @@ static int cmd_hf_fido_authenticate(const char *cmd) { return PM3_EINVARG; } } else { + hdatalen = sizeof(hdata); CLIGetHexWithReturn(ctx, 10, hdata, &hdatalen); if (hdatalen && hdatalen != 32) { PrintAndLogEx(ERR, "ERROR: application parameter length must be 32 bytes only."); @@ -693,6 +701,7 @@ static int cmd_hf_fido_2make_credential(const char *cmd) { uint8_t jsonname[FILE_PATH_SIZE] = {0}; char *cjsonname = (char *)jsonname; int jsonnamelen = 0; + jsonnamelen = sizeof(jsonname); CLIGetStrWithReturn(ctx, 5, jsonname, &jsonnamelen); if (!jsonnamelen) { @@ -817,7 +826,7 @@ static int cmd_hf_fido_2get_assertion(const char *cmd) { uint8_t jsonname[FILE_PATH_SIZE] = {0}; char *cjsonname = (char *)jsonname; - int jsonnamelen = 0; + int jsonnamelen = sizeof(jsonname); CLIGetStrWithReturn(ctx, 5, jsonname, &jsonnamelen); if (!jsonnamelen) { diff --git a/client/src/cmdlfhid.c b/client/src/cmdlfhid.c index 48dfc9928..7379d882e 100644 --- a/client/src/cmdlfhid.c +++ b/client/src/cmdlfhid.c @@ -417,7 +417,7 @@ static int CmdHIDBrute(const char *Cmd) { CLIExecWithReturn(ctx, Cmd, argtable, false); bool verbose = arg_get_lit(ctx, 1); - + formatLen = sizeof(format); CLIGetStrWithReturn(ctx, 2, format, &formatLen); format_idx = HIDFindCardFormat((char *) format); diff --git a/client/src/cmdlfkeri.c b/client/src/cmdlfkeri.c index 1279c6f8c..396a4a79f 100644 --- a/client/src/cmdlfkeri.c +++ b/client/src/cmdlfkeri.c @@ -225,7 +225,7 @@ static int CmdKeriClone(const char *Cmd) { blocks[0] = T5555_FIXED | T5555_MODULATION_PSK1 | T5555_SET_BITRATE(32) | T5555_PSK_RF_2 | 2 << T5555_MAXBLOCK_SHIFT; q5 = true; } - + typeLen = sizeof(keritype); CLIGetStrWithReturn(ctx, 2, keritype, &typeLen); fc = arg_get_int_def(ctx, 3, 0); diff --git a/client/src/emv/cmdemv.c b/client/src/emv/cmdemv.c index 95134251b..fa1e9618a 100644 --- a/client/src/emv/cmdemv.c +++ b/client/src/emv/cmdemv.c @@ -1435,7 +1435,7 @@ static int CmdEMVScan(const char *Cmd) { uint8_t psenum = (channel == ECC_CONTACT) ? 1 : 2; uint8_t filename[FILE_PATH_SIZE] = {0}; - int filenamelen = 0; + int filenamelen = sizeof(filename); CLIGetStrWithReturn(ctx, 12, filename, &filenamelen); CLIParserFree(ctx); diff --git a/doc/cliparser.md b/doc/cliparser.md index 142f5c37a..9dcab7867 100644 --- a/doc/cliparser.md +++ b/doc/cliparser.md @@ -203,11 +203,11 @@ CLIGetHexWithReturn(\, \, \, \,\, \, \); +CLIGetStrWithReturn(\,\, \, \); If failed to retrieve string, it will exit fct uint8_t buffer[100]; - int slen = 0; + int slen = sizeof(buffer); // <- slen MUST be the maximum number of characters that you want returned. e.g. Buffer Size CLIGetStrWithReturn(ctx, 1, buffer, &slen); **string option** From 30fc54988096fdea9b6703b9713c0805d233b324 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Sat, 17 Oct 2020 00:29:53 +0200 Subject: [PATCH 042/125] Avoid 'Qt: Session management error' --- client/src/proxgui.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/client/src/proxgui.cpp b/client/src/proxgui.cpp index d5f82ffe9..cda746b9a 100644 --- a/client/src/proxgui.cpp +++ b/client/src/proxgui.cpp @@ -60,6 +60,7 @@ extern "C" void InitGraphics(int argc, char **argv, char *script_cmds_file, char if (getenv("DISPLAY") == NULL) return; #endif + unsetenv("SESSION_MANAGER"); main_loop_thread = new WorkerThread(script_cmds_file, script_cmd, stayInCommandLoop); gui = new ProxGuiQT(argc, argv, main_loop_thread); } From 34a56fae9aa82d44951a56eb6a648f5f90963780 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Sat, 17 Oct 2020 00:46:10 +0200 Subject: [PATCH 043/125] blue cloner trace --- traces/README.md | 1 + traces/lf_sniff_blue_cloner_em4100.pm3 | 108120 ++++++++++++++++++++++ 2 files changed, 108121 insertions(+) create mode 100644 traces/lf_sniff_blue_cloner_em4100.pm3 diff --git a/traces/README.md b/traces/README.md index 2c28d2e8e..b8d4d1c4d 100644 --- a/traces/README.md +++ b/traces/README.md @@ -56,6 +56,7 @@ |filename|description| |--------|-----------| +|lf_sniff_blue_cloner_em4100.pm3 |Sniffing of blue cloner writing an EM4100 on T5577 and EM4305| |lf_sniff_ht2-BC3B8810-acg-reader.pm3 |Sniffing of Hitag2 being read by an HID ACG LF Multitag reader| |lf_sniff_ht2-BC3B8810-frosch-reader.pm3 |Sniffing of Hitag2 being read by a Frosch Hitag reader| |lf_sniff_ht2-BC3B8810-rfidler-reader.pm3 |Sniffing of Hitag2 being read by a RFIDler| diff --git a/traces/lf_sniff_blue_cloner_em4100.pm3 b/traces/lf_sniff_blue_cloner_em4100.pm3 new file mode 100644 index 000000000..98f923389 --- /dev/null +++ b/traces/lf_sniff_blue_cloner_em4100.pm3 @@ -0,0 +1,108120 @@ +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +114 +107 +99 +92 +86 +80 +74 +69 +64 +60 +56 +53 +49 +46 +42 +40 +36 +34 +32 +30 +27 +26 +24 +23 +25 +28 +25 +24 +22 +21 +19 +18 +17 +16 +14 +14 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +4 +9 +9 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +5 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +3 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +1 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +0 +4 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +1 +5 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +4 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +2 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +5 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +3 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +3 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +1 +5 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +2 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +4 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +-1 +3 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +5 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +0 +4 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +2 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +5 +6 +5 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +0 +3 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +0 +4 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +2 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +0 +5 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +2 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +-1 +1 +5 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +0 +3 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-39 +-42 +-44 +-45 +-47 +-48 +-49 +-51 +-51 +-52 +-53 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-55 +-55 +-55 +-55 +-55 +-54 +-29 +28 +65 +82 +87 +88 +85 +82 +78 +73 +68 +64 +59 +55 +51 +47 +43 +40 +37 +35 +24 +16 +7 +0 +-7 +-12 +-18 +-22 +-26 +-29 +-33 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-50 +-51 +-44 +-2 +27 +45 +56 +62 +64 +63 +61 +58 +55 +51 +48 +44 +41 +37 +35 +32 +30 +27 +25 +24 +27 +28 +26 +24 +22 +21 +20 +18 +17 +16 +15 +13 +13 +12 +22 +13 +5 +-2 +-8 +-14 +-19 +-24 +-28 +-31 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-47 +-12 +15 +33 +44 +51 +53 +53 +51 +48 +45 +42 +39 +36 +33 +31 +28 +26 +23 +22 +20 +19 +17 +16 +14 +15 +19 +19 +18 +17 +15 +14 +13 +13 +11 +11 +3 +-4 +-10 +-16 +-21 +-25 +-29 +-32 +-36 +-38 +-41 +-43 +-44 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-52 +-53 +-53 +-47 +-7 +22 +40 +52 +59 +61 +60 +59 +55 +52 +49 +46 +42 +39 +35 +33 +30 +28 +25 +24 +15 +7 +-1 +-7 +-13 +-18 +-23 +-27 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-46 +-6 +22 +40 +52 +58 +60 +59 +57 +54 +51 +48 +45 +41 +38 +35 +33 +35 +36 +33 +22 +13 +5 +-2 +-8 +-14 +-19 +-24 +-27 +-31 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-47 +-48 +-50 +-50 +-51 +-51 +-46 +-14 +10 +30 +44 +58 +68 +67 +64 +60 +57 +53 +49 +46 +42 +39 +36 +33 +30 +28 +25 +17 +8 +1 +-6 +-12 +-17 +-22 +-26 +-29 +-33 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-46 +-6 +23 +41 +52 +58 +61 +60 +58 +55 +52 +48 +45 +42 +39 +35 +33 +30 +28 +25 +23 +21 +20 +18 +17 +18 +22 +21 +20 +18 +17 +16 +15 +14 +13 +12 +4 +-3 +-9 +-15 +-20 +-25 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-52 +-53 +-53 +-45 +-4 +24 +42 +53 +59 +61 +60 +58 +55 +52 +49 +45 +42 +38 +35 +32 +30 +27 +25 +23 +15 +6 +-1 +-7 +-13 +-18 +-23 +-27 +-30 +-34 +-36 +-39 +-41 +-43 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-52 +-46 +-11 +16 +34 +48 +55 +58 +57 +56 +53 +51 +47 +44 +40 +38 +34 +32 +30 +33 +33 +30 +28 +26 +24 +23 +21 +20 +18 +17 +15 +15 +13 +12 +11 +10 +9 +9 +1 +-5 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-49 +-12 +15 +34 +45 +52 +55 +55 +53 +51 +48 +45 +41 +38 +35 +33 +30 +28 +25 +23 +21 +20 +10 +3 +-4 +-10 +-16 +-20 +-25 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-46 +-12 +13 +32 +44 +52 +54 +54 +53 +56 +57 +53 +49 +46 +42 +39 +36 +34 +31 +29 +26 +17 +8 +1 +-6 +-12 +-17 +-21 +-26 +-29 +-33 +-36 +-38 +-40 +-43 +-44 +-46 +-47 +-48 +-49 +-50 +-50 +-51 +-44 +-8 +19 +39 +53 +59 +63 +62 +60 +57 +55 +51 +47 +44 +41 +37 +35 +32 +29 +27 +25 +23 +14 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-31 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-46 +-9 +18 +36 +48 +55 +57 +56 +55 +52 +49 +46 +43 +39 +37 +33 +33 +36 +34 +31 +29 +27 +25 +23 +22 +20 +19 +17 +16 +15 +14 +12 +12 +11 +10 +9 +8 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-51 +-21 +5 +26 +41 +51 +54 +55 +53 +52 +49 +47 +43 +40 +37 +34 +32 +29 +26 +25 +25 +20 +11 +3 +-4 +-10 +-16 +-20 +-25 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-46 +-10 +16 +34 +45 +52 +54 +56 +61 +60 +55 +52 +48 +45 +41 +38 +35 +33 +30 +27 +25 +16 +8 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-51 +-26 +6 +29 +47 +57 +62 +62 +62 +59 +56 +53 +50 +46 +42 +39 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +17 +21 +20 +19 +17 +16 +15 +14 +13 +12 +4 +-3 +-9 +-15 +-20 +-24 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-52 +-53 +-53 +-28 +2 +26 +44 +55 +60 +61 +60 +58 +55 +52 +48 +45 +42 +39 +35 +33 +30 +28 +25 +23 +14 +6 +-1 +-7 +-13 +-18 +-23 +-27 +-31 +-33 +-37 +-39 +-41 +-43 +-45 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-47 +-7 +20 +38 +50 +56 +58 +58 +55 +53 +49 +46 +43 +40 +36 +34 +31 +29 +27 +31 +22 +13 +5 +-2 +-9 +-14 +-19 +-24 +-28 +-31 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-49 +-51 +-51 +-52 +-52 +-43 +-3 +22 +39 +50 +56 +64 +68 +64 +60 +56 +52 +48 +45 +42 +38 +35 +33 +30 +28 +25 +24 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +0 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-39 +-42 +-43 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-50 +-18 +6 +27 +40 +49 +51 +52 +51 +49 +47 +50 +49 +46 +42 +39 +36 +34 +31 +28 +26 +17 +8 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-51 +-45 +-7 +20 +39 +53 +60 +63 +63 +61 +58 +55 +51 +48 +44 +41 +38 +35 +32 +29 +27 +25 +23 +14 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-31 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-47 +-7 +20 +38 +50 +56 +58 +57 +55 +53 +50 +46 +43 +39 +36 +33 +31 +28 +30 +32 +22 +12 +5 +-3 +-9 +-15 +-19 +-24 +-28 +-31 +-34 +-37 +-39 +-42 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-51 +-52 +-47 +-14 +11 +30 +44 +52 +58 +66 +64 +61 +57 +54 +50 +46 +43 +40 +36 +33 +30 +28 +35 +25 +16 +8 +0 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-48 +-49 +-50 +-51 +-45 +-6 +21 +39 +50 +56 +58 +57 +56 +52 +50 +46 +43 +39 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +15 +15 +19 +19 +18 +17 +15 +15 +13 +12 +12 +4 +-4 +-10 +-15 +-20 +-25 +-28 +-32 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-49 +-50 +-51 +-51 +-52 +-53 +-53 +-53 +-48 +-7 +22 +41 +53 +59 +62 +62 +59 +56 +53 +50 +46 +43 +39 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +14 +13 +12 +13 +17 +17 +15 +14 +14 +5 +-2 +-9 +-14 +-20 +-24 +-28 +-31 +-35 +-37 +-40 +-42 +-44 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-53 +-53 +-53 +-53 +-45 +5 +40 +57 +62 +64 +63 +61 +58 +55 +51 +48 +44 +41 +37 +34 +31 +29 +27 +25 +16 +8 +0 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-38 +-41 +-43 +-45 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-52 +-46 +-5 +24 +42 +54 +60 +62 +61 +59 +56 +53 +49 +46 +42 +39 +36 +33 +30 +28 +26 +24 +23 +26 +27 +25 +23 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +22 +13 +5 +-2 +-9 +-15 +-20 +-24 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-52 +-47 +-11 +15 +33 +45 +51 +53 +53 +51 +48 +45 +42 +39 +36 +33 +31 +28 +26 +23 +22 +20 +18 +17 +16 +14 +15 +18 +19 +18 +16 +15 +14 +13 +12 +11 +11 +3 +-4 +-11 +-16 +-21 +-25 +-29 +-32 +-36 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-53 +-48 +-7 +22 +40 +53 +59 +61 +61 +59 +55 +52 +49 +45 +42 +39 +35 +33 +30 +28 +26 +24 +15 +7 +-1 +-7 +-13 +-18 +-23 +-27 +-31 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-47 +-13 +12 +33 +47 +55 +57 +58 +57 +54 +51 +48 +45 +42 +38 +36 +33 +30 +32 +33 +31 +20 +11 +4 +-4 +-10 +-15 +-20 +-25 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-47 +-8 +18 +35 +46 +58 +66 +66 +62 +58 +54 +51 +47 +44 +40 +37 +34 +31 +29 +27 +24 +23 +21 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +-1 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-39 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-54 +-54 +-46 +-8 +18 +35 +46 +52 +54 +53 +52 +52 +55 +51 +48 +44 +41 +37 +35 +32 +30 +27 +18 +9 +2 +-5 +-11 +-17 +-21 +-26 +-29 +-33 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-44 +-7 +21 +40 +54 +61 +64 +63 +61 +58 +55 +52 +48 +45 +41 +38 +35 +32 +30 +27 +25 +23 +14 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-31 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-49 +-51 +-51 +-52 +-51 +-22 +6 +27 +44 +53 +57 +58 +58 +55 +53 +49 +46 +43 +40 +37 +34 +32 +35 +34 +31 +29 +27 +25 +23 +21 +20 +18 +17 +16 +15 +13 +13 +11 +11 +10 +9 +1 +-5 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-48 +-13 +12 +32 +45 +53 +55 +55 +54 +51 +48 +46 +42 +39 +36 +33 +30 +28 +26 +24 +22 +20 +10 +3 +-4 +-10 +-16 +-20 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-46 +-12 +13 +32 +45 +52 +55 +55 +54 +57 +57 +53 +49 +46 +42 +39 +36 +34 +31 +28 +26 +17 +8 +1 +-6 +-12 +-17 +-22 +-26 +-29 +-33 +-36 +-39 +-41 +-43 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-51 +-45 +-5 +23 +41 +54 +61 +63 +62 +60 +57 +54 +50 +47 +43 +40 +36 +34 +31 +28 +26 +24 +31 +21 +12 +4 +-3 +-9 +-15 +-20 +-24 +-28 +-32 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-46 +-9 +18 +35 +47 +52 +54 +53 +52 +49 +46 +43 +40 +37 +34 +31 +31 +34 +32 +29 +19 +10 +3 +-4 +-10 +-16 +-20 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-46 +-12 +13 +32 +49 +64 +67 +65 +62 +59 +55 +52 +48 +44 +41 +38 +34 +32 +29 +27 +25 +16 +7 +0 +-7 +-12 +-18 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-52 +-52 +-32 +2 +27 +44 +55 +61 +62 +61 +59 +56 +52 +49 +45 +42 +39 +36 +33 +30 +27 +26 +23 +14 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-30 +-34 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-46 +-11 +15 +34 +47 +54 +56 +56 +55 +52 +50 +46 +48 +48 +45 +41 +38 +35 +33 +30 +28 +18 +10 +2 +-5 +-11 +-16 +-21 +-25 +-29 +-32 +-36 +-38 +-41 +-42 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-51 +-20 +11 +34 +51 +60 +64 +65 +64 +61 +58 +55 +51 +48 +44 +41 +37 +35 +32 +29 +26 +25 +15 +7 +0 +-7 +-13 +-18 +-23 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-48 +-50 +-50 +-51 +-52 +-52 +-27 +4 +27 +43 +54 +58 +60 +58 +57 +54 +51 +47 +44 +40 +37 +34 +32 +29 +28 +31 +22 +12 +5 +-3 +-9 +-15 +-19 +-24 +-28 +-32 +-34 +-37 +-40 +-42 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-52 +-27 +1 +24 +40 +50 +56 +65 +66 +63 +60 +56 +52 +49 +45 +42 +38 +35 +32 +30 +27 +18 +9 +2 +-5 +-11 +-17 +-21 +-26 +-29 +-33 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-50 +-20 +9 +32 +48 +58 +62 +63 +61 +59 +56 +53 +49 +46 +43 +39 +36 +33 +31 +28 +25 +23 +15 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-30 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-51 +-52 +-47 +-13 +12 +32 +46 +54 +57 +57 +55 +53 +51 +47 +44 +41 +40 +42 +40 +37 +34 +31 +29 +19 +11 +3 +-4 +-11 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-52 +-44 +5 +42 +58 +64 +66 +65 +63 +60 +56 +53 +49 +45 +41 +38 +35 +32 +30 +28 +25 +16 +8 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-52 +-45 +-9 +18 +37 +51 +57 +60 +60 +58 +55 +53 +49 +46 +42 +39 +36 +33 +30 +28 +26 +24 +21 +12 +4 +-3 +-9 +-15 +-20 +-24 +-28 +-31 +-35 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-52 +-28 +2 +24 +41 +51 +56 +56 +56 +54 +55 +57 +54 +49 +46 +42 +40 +36 +34 +31 +29 +19 +10 +2 +-4 +-11 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-51 +-45 +-3 +25 +44 +55 +62 +64 +63 +61 +59 +55 +51 +47 +44 +40 +37 +34 +32 +29 +27 +24 +16 +7 +0 +-7 +-12 +-18 +-22 +-27 +-30 +-34 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-50 +-51 +-52 +-53 +-43 +-1 +25 +43 +53 +59 +60 +60 +58 +55 +51 +48 +44 +41 +38 +35 +32 +31 +33 +33 +22 +13 +5 +-2 +-9 +-14 +-19 +-24 +-28 +-31 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-51 +-52 +-52 +-43 +-3 +23 +40 +51 +64 +70 +68 +64 +61 +56 +53 +49 +45 +41 +38 +35 +33 +30 +28 +18 +10 +2 +-5 +-11 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-51 +-52 +-44 +-1 +27 +45 +57 +63 +65 +63 +61 +58 +55 +51 +47 +44 +40 +37 +34 +31 +29 +26 +25 +15 +7 +0 +-7 +-13 +-18 +-23 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-53 +-43 +-2 +24 +41 +52 +57 +59 +58 +57 +53 +50 +47 +46 +48 +46 +42 +39 +36 +33 +31 +41 +29 +20 +11 +3 +-4 +-10 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-50 +-8 +24 +42 +53 +59 +61 +61 +58 +55 +52 +48 +44 +41 +38 +35 +32 +30 +27 +25 +23 +14 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-31 +-34 +-37 +-39 +-41 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-51 +-52 +-53 +-46 +-4 +24 +42 +53 +59 +61 +60 +58 +55 +52 +48 +45 +42 +38 +35 +32 +30 +27 +26 +44 +32 +22 +13 +5 +-2 +-9 +-14 +-20 +-24 +-28 +-31 +-35 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-46 +-9 +16 +33 +44 +50 +51 +56 +59 +56 +52 +49 +44 +41 +38 +36 +32 +30 +27 +25 +16 +8 +0 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-48 +-50 +-50 +-51 +-52 +-52 +-42 +0 +28 +46 +58 +63 +65 +64 +61 +58 +55 +51 +47 +43 +40 +37 +34 +31 +29 +27 +24 +15 +7 +0 +-7 +-13 +-18 +-23 +-27 +-30 +-33 +-37 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-50 +-52 +-52 +-53 +-46 +-5 +23 +40 +52 +58 +60 +59 +58 +54 +51 +48 +45 +41 +39 +41 +40 +37 +34 +32 +22 +12 +5 +-3 +-9 +-15 +-19 +-24 +-28 +-32 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-51 +-52 +-52 +-45 +2 +42 +62 +68 +69 +69 +66 +63 +59 +56 +51 +48 +44 +41 +37 +35 +32 +29 +27 +18 +9 +2 +-5 +-11 +-17 +-21 +-26 +-29 +-33 +-36 +-38 +-40 +-43 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-43 +0 +27 +45 +56 +62 +63 +62 +60 +57 +53 +50 +46 +43 +39 +36 +33 +31 +28 +26 +24 +15 +6 +-1 +-8 +-13 +-19 +-23 +-27 +-31 +-34 +-37 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-46 +-11 +15 +34 +47 +53 +56 +56 +55 +52 +52 +54 +52 +47 +44 +40 +37 +35 +32 +30 +37 +26 +17 +8 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-51 +-51 +-44 +-4 +23 +42 +53 +59 +61 +60 +58 +55 +52 +48 +44 +41 +37 +35 +32 +29 +27 +25 +23 +33 +22 +13 +5 +-2 +-9 +-14 +-19 +-24 +-28 +-31 +-35 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-46 +-8 +18 +35 +46 +52 +54 +53 +51 +49 +46 +43 +39 +36 +33 +31 +28 +27 +29 +30 +19 +10 +2 +-4 +-11 +-16 +-21 +-25 +-29 +-32 +-36 +-38 +-41 +-42 +-44 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-52 +-53 +-47 +-7 +20 +38 +49 +62 +69 +68 +64 +60 +56 +53 +48 +45 +41 +38 +35 +33 +30 +28 +19 +11 +3 +-4 +-10 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-52 +-42 +1 +28 +46 +57 +62 +64 +63 +61 +57 +54 +50 +47 +43 +40 +36 +34 +31 +29 +26 +24 +22 +13 +5 +-2 +-9 +-14 +-20 +-24 +-28 +-31 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-53 +-44 +-5 +22 +38 +50 +55 +57 +56 +54 +51 +48 +45 +43 +45 +44 +40 +37 +34 +32 +29 +27 +17 +9 +1 +-5 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-50 +-51 +-52 +-51 +-6 +29 +47 +58 +64 +65 +65 +62 +59 +55 +52 +48 +44 +41 +37 +34 +32 +29 +27 +25 +17 +8 +1 +-6 +-12 +-18 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-53 +-43 +-1 +26 +43 +54 +60 +61 +61 +58 +55 +52 +49 +45 +41 +38 +35 +32 +30 +27 +26 +23 +14 +5 +-2 +-8 +-14 +-19 +-23 +-28 +-31 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-52 +-45 +-4 +22 +40 +50 +56 +58 +61 +65 +63 +58 +54 +50 +47 +43 +40 +36 +34 +31 +29 +19 +11 +3 +-4 +-10 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-40 +-42 +-44 +-46 +-47 +-48 +-49 +-50 +-51 +-51 +-45 +-10 +17 +39 +53 +61 +64 +64 +62 +59 +56 +52 +49 +45 +42 +38 +35 +33 +30 +28 +25 +32 +22 +13 +5 +-2 +-9 +-14 +-20 +-24 +-28 +-31 +-35 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-52 +-52 +-46 +-8 +18 +36 +47 +53 +54 +54 +52 +49 +46 +43 +40 +37 +34 +32 +34 +34 +32 +29 +27 +25 +23 +22 +20 +19 +17 +16 +15 +14 +12 +12 +11 +10 +9 +9 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-37 +-39 +-42 +-43 +-45 +-47 +-48 +-49 +-51 +-51 +-52 +-53 +-53 +-54 +-54 +-49 +-9 +19 +37 +49 +55 +57 +57 +55 +52 +49 +46 +43 +39 +36 +33 +31 +28 +26 +25 +28 +28 +26 +24 +23 +21 +20 +18 +17 +16 +15 +13 +13 +11 +11 +10 +2 +-5 +-11 +-17 +-21 +-26 +-29 +-33 +-36 +-39 +-41 +-43 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-46 +-4 +23 +41 +52 +58 +59 +58 +56 +53 +50 +47 +43 +40 +37 +34 +31 +29 +26 +24 +22 +21 +19 +19 +23 +23 +21 +20 +18 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +6 +8 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +2 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +5 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +1 +5 +7 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +3 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +1 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +2 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +0 +5 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +1 +5 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +3 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +1 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +0 +0 +-1 +2 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +0 +0 +-1 +0 +0 +5 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +1 +6 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +4 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +2 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +3 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +1 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +2 +6 +6 +6 +6 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +2 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +5 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +3 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +1 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +0 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +2 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +0 +0 +5 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +2 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +1 +5 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +4 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +2 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +1 +5 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +1 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +-1 +0 +4 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +3 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +0 +0 +1 +6 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +0 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +1 +6 +6 +6 +6 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +0 +0 +4 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +3 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +2 +6 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +5 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +1 +5 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +4 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +0 +0 +-1 +0 +2 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +3 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +2 +6 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +5 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +1 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +3 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +2 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +5 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +1 +6 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +4 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +3 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +2 +6 +6 +5 +5 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +4 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +2 +6 +16 +7 +-1 +-8 +-14 +-19 +-24 +-28 +-32 +-36 +-38 +-41 +-43 +-45 +-47 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-57 +-56 +-57 +-56 +-34 +16 +46 +65 +75 +81 +81 +79 +76 +72 +67 +63 +58 +54 +49 +46 +42 +39 +36 +33 +30 +28 +26 +24 +22 +21 +19 +18 +20 +23 +22 +20 +19 +18 +17 +16 +14 +14 +12 +12 +10 +10 +9 +8 +7 +7 +-1 +-7 +-13 +-18 +-23 +-28 +-31 +-35 +-38 +-40 +-43 +-45 +-46 +-48 +-49 +-50 +-52 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-56 +-57 +-56 +-47 +-1 +30 +53 +68 +76 +79 +79 +76 +73 +69 +65 +60 +60 +60 +56 +52 +39 +28 +19 +10 +2 +-5 +-11 +-16 +-21 +-26 +-29 +-33 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-49 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-54 +-39 +12 +45 +69 +85 +92 +95 +94 +91 +86 +81 +76 +71 +65 +61 +56 +52 +48 +36 +26 +17 +8 +1 +-6 +-12 +-18 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-47 +-49 +-49 +-51 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-54 +-33 +14 +43 +64 +78 +85 +87 +85 +86 +89 +85 +78 +73 +68 +63 +58 +54 +50 +46 +42 +40 +36 +34 +31 +29 +26 +25 +23 +21 +19 +18 +17 +16 +14 +13 +12 +12 +10 +10 +9 +13 +16 +15 +13 +13 +12 +4 +-4 +-10 +-16 +-21 +-26 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-56 +-56 +-56 +-56 +-40 +7 +38 +60 +75 +83 +85 +84 +81 +77 +73 +68 +64 +59 +54 +50 +47 +42 +32 +21 +12 +4 +-3 +-9 +-15 +-20 +-24 +-28 +-32 +-35 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-53 +-54 +-54 +-55 +-54 +-55 +-28 +22 +50 +68 +79 +84 +91 +95 +91 +85 +80 +74 +68 +63 +59 +54 +50 +46 +43 +40 +37 +34 +32 +29 +27 +25 +23 +21 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +14 +16 +15 +14 +13 +12 +12 +11 +3 +-5 +-11 +-17 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-56 +-56 +-56 +-56 +-35 +18 +48 +66 +78 +83 +84 +82 +79 +74 +69 +64 +60 +55 +51 +47 +44 +32 +22 +13 +5 +-2 +-9 +-14 +-19 +-24 +-28 +-32 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-54 +-54 +-54 +-24 +26 +55 +74 +95 +104 +101 +97 +92 +85 +80 +74 +69 +64 +59 +55 +49 +37 +27 +17 +9 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-38 +-41 +-43 +-45 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-52 +-53 +-53 +-53 +-54 +-54 +-54 +-54 +-20 +31 +59 +77 +87 +91 +91 +89 +84 +80 +75 +70 +64 +60 +55 +51 +47 +35 +24 +15 +7 +0 +-7 +-13 +-18 +-23 +-27 +-30 +-34 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-54 +2 +52 +78 +92 +99 +101 +99 +95 +91 +85 +80 +74 +69 +64 +59 +54 +50 +46 +43 +39 +37 +34 +31 +29 +27 +25 +23 +21 +20 +18 +17 +16 +19 +21 +20 +19 +18 +16 +16 +14 +13 +12 +12 +10 +10 +9 +2 +-6 +-12 +-18 +-22 +-27 +-30 +-34 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-51 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-57 +-56 +-57 +-57 +-57 +-53 +-7 +28 +52 +69 +78 +82 +82 +79 +76 +72 +67 +62 +57 +53 +49 +46 +41 +30 +20 +11 +3 +-4 +-10 +-15 +-21 +-25 +-29 +-32 +-35 +-38 +-41 +-42 +-44 +-46 +-47 +-48 +-50 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-54 +-54 +-41 +15 +48 +72 +88 +96 +98 +97 +94 +90 +84 +79 +73 +68 +62 +58 +53 +49 +37 +27 +17 +9 +1 +-6 +-12 +-17 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-55 +-55 +-27 +26 +55 +73 +83 +88 +88 +86 +82 +78 +73 +68 +65 +66 +63 +58 +54 +50 +46 +43 +40 +37 +34 +32 +30 +28 +26 +24 +22 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +10 +5 +-3 +-9 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-41 +-44 +-45 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-57 +-56 +-57 +-56 +-57 +-56 +-30 +24 +55 +74 +85 +90 +90 +88 +84 +80 +74 +69 +64 +60 +55 +51 +47 +54 +42 +31 +20 +12 +4 +-3 +-10 +-15 +-20 +-25 +-29 +-32 +-35 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-55 +-55 +-55 +-25 +24 +51 +69 +78 +83 +82 +81 +77 +73 +70 +72 +67 +63 +58 +54 +41 +30 +20 +11 +3 +-4 +-10 +-16 +-21 +-25 +-29 +-32 +-36 +-38 +-41 +-43 +-44 +-46 +-47 +-48 +-50 +-50 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-54 +-54 +-54 +-21 +33 +64 +82 +93 +97 +97 +94 +90 +84 +79 +73 +68 +63 +58 +54 +50 +46 +43 +39 +37 +34 +32 +29 +30 +33 +32 +29 +27 +25 +24 +22 +21 +19 +18 +16 +16 +14 +13 +12 +11 +10 +10 +9 +8 +7 +17 +8 +1 +-7 +-13 +-18 +-23 +-28 +-31 +-35 +-38 +-41 +-43 +-45 +-47 +-48 +-49 +-51 +-52 +-53 +-53 +-54 +-55 +-55 +-56 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-33 +14 +41 +59 +69 +74 +74 +73 +73 +76 +71 +66 +61 +56 +52 +48 +36 +26 +16 +8 +0 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-39 +-42 +-43 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-54 +-55 +-55 +-40 +12 +44 +67 +83 +91 +93 +92 +89 +85 +79 +75 +69 +65 +59 +55 +51 +47 +35 +25 +15 +7 +-1 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-39 +-42 +-43 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-55 +-55 +-40 +9 +40 +62 +83 +101 +103 +99 +94 +89 +83 +78 +72 +67 +62 +57 +53 +41 +29 +20 +11 +3 +-4 +-10 +-16 +-21 +-25 +-29 +-32 +-35 +-38 +-41 +-43 +-44 +-46 +-47 +-49 +-50 +-51 +-51 +-52 +-53 +-53 +-53 +-54 +-54 +-54 +-55 +-55 +-32 +17 +47 +68 +84 +90 +92 +90 +87 +83 +78 +73 +68 +63 +58 +53 +50 +55 +42 +31 +21 +12 +4 +-4 +-10 +-15 +-20 +-25 +-29 +-32 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-49 +-50 +-51 +-51 +-52 +-53 +-54 +-54 +-54 +-54 +-54 +-54 +-48 +25 +63 +81 +92 +96 +96 +94 +89 +85 +79 +73 +68 +63 +58 +54 +49 +46 +42 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +17 +16 +16 +21 +20 +19 +17 +17 +15 +14 +13 +12 +11 +11 +10 +9 +1 +-6 +-12 +-17 +-23 +-27 +-31 +-34 +-38 +-40 +-43 +-45 +-47 +-48 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-26 +23 +52 +69 +80 +84 +84 +81 +78 +73 +68 +64 +59 +54 +50 +46 +45 +48 +46 +42 +39 +36 +34 +31 +29 +27 +25 +23 +22 +20 +19 +17 +16 +14 +14 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +-2 +-9 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-47 +-49 +-50 +-52 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-37 +26 +64 +81 +89 +92 +91 +88 +84 +79 +74 +69 +64 +59 +54 +50 +46 +34 +24 +15 +7 +-1 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-40 +-42 +-44 +-46 +-47 +-48 +-49 +-51 +-51 +-52 +-53 +-53 +-54 +-54 +-54 +-55 +-55 +-55 +-55 +-27 +26 +56 +74 +84 +89 +89 +87 +83 +78 +73 +68 +63 +59 +54 +53 +54 +52 +47 +44 +41 +38 +35 +33 +31 +28 +26 +25 +23 +21 +19 +18 +17 +16 +14 +14 +12 +12 +11 +10 +9 +8 +7 +7 +6 +6 +-2 +-8 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-41 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-56 +-44 +23 +56 +76 +87 +92 +93 +91 +87 +82 +77 +72 +66 +61 +57 +52 +48 +45 +41 +38 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +16 +16 +20 +21 +20 +18 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +1 +-6 +-12 +-18 +-23 +-27 +-31 +-35 +-38 +-40 +-43 +-45 +-47 +-48 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-47 +1 +33 +56 +71 +80 +82 +81 +79 +75 +71 +66 +62 +57 +53 +49 +46 +41 +29 +20 +11 +3 +-4 +-11 +-16 +-21 +-26 +-29 +-33 +-36 +-39 +-41 +-43 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-55 +-38 +15 +49 +73 +89 +97 +99 +97 +94 +89 +84 +79 +73 +67 +63 +57 +53 +49 +37 +26 +17 +8 +1 +-6 +-12 +-18 +-22 +-26 +-30 +-34 +-36 +-39 +-41 +-44 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-54 +-54 +-55 +-55 +-55 +-32 +16 +46 +67 +82 +88 +90 +88 +85 +81 +76 +71 +71 +70 +66 +60 +56 +51 +48 +44 +41 +38 +36 +33 +30 +28 +26 +24 +22 +20 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +8 +13 +13 +4 +-4 +-10 +-16 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-53 +-54 +-55 +-56 +-56 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-39 +10 +41 +64 +80 +87 +89 +88 +85 +80 +76 +70 +66 +60 +56 +51 +48 +44 +32 +22 +13 +5 +-2 +-9 +-15 +-20 +-24 +-28 +-32 +-35 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-26 +24 +53 +71 +83 +87 +88 +85 +82 +77 +79 +77 +71 +66 +61 +56 +52 +40 +29 +19 +10 +2 +-5 +-11 +-16 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-47 +8 +43 +69 +85 +94 +96 +95 +91 +87 +82 +77 +71 +66 +61 +57 +52 +48 +44 +41 +38 +35 +32 +30 +33 +35 +32 +30 +28 +26 +24 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +10 +9 +8 +8 +7 +-1 +-8 +-14 +-19 +-24 +-28 +-32 +-36 +-38 +-41 +-43 +-45 +-47 +-49 +-50 +-52 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-58 +-57 +-57 +-35 +16 +45 +63 +74 +78 +79 +78 +83 +80 +75 +69 +64 +59 +55 +51 +45 +33 +23 +14 +6 +-2 +-8 +-14 +-19 +-24 +-28 +-32 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-55 +-55 +-18 +34 +63 +80 +90 +94 +94 +91 +86 +81 +76 +70 +65 +60 +55 +51 +47 +36 +25 +16 +7 +0 +-7 +-13 +-19 +-23 +-27 +-31 +-34 +-37 +-40 +-42 +-44 +-46 +-47 +-48 +-50 +-50 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-55 +-32 +15 +45 +70 +97 +105 +103 +98 +94 +88 +83 +77 +72 +66 +61 +56 +52 +39 +29 +19 +10 +2 +-5 +-11 +-16 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-32 +18 +48 +70 +84 +92 +93 +91 +87 +83 +78 +73 +67 +63 +58 +54 +49 +45 +33 +23 +14 +6 +-2 +-8 +-14 +-19 +-24 +-28 +-32 +-35 +-38 +-40 +-43 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-52 +-53 +-54 +-54 +-54 +-54 +-55 +-55 +-55 +-35 +35 +68 +86 +97 +101 +101 +98 +93 +88 +83 +76 +71 +65 +61 +56 +52 +39 +29 +19 +10 +2 +-5 +-11 +-16 +-22 +-26 +-30 +-33 +-36 +-39 +-41 +-43 +-45 +-47 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-15 +35 +64 +80 +90 +94 +93 +90 +86 +81 +75 +70 +65 +63 +64 +60 +55 +51 +48 +44 +41 +38 +36 +33 +31 +28 +27 +24 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +8 +7 +7 +5 +-2 +-9 +-15 +-20 +-25 +-30 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-56 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-57 +-52 +0 +37 +63 +79 +89 +92 +91 +87 +84 +79 +74 +68 +64 +58 +54 +50 +56 +44 +32 +22 +13 +4 +-3 +-9 +-15 +-20 +-25 +-29 +-32 +-36 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-56 +-26 +25 +54 +71 +81 +86 +85 +83 +79 +75 +69 +65 +64 +64 +59 +55 +51 +47 +44 +41 +38 +35 +32 +30 +28 +26 +24 +22 +20 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +8 +7 +7 +12 +4 +-3 +-10 +-16 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-45 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-57 +-58 +-57 +-57 +-45 +6 +40 +64 +80 +88 +91 +89 +86 +82 +78 +72 +67 +62 +57 +52 +49 +45 +34 +23 +14 +5 +-2 +-9 +-14 +-20 +-24 +-28 +-32 +-35 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-56 +-25 +27 +57 +74 +84 +89 +89 +86 +82 +78 +73 +73 +72 +66 +61 +57 +44 +32 +22 +13 +4 +-3 +-9 +-15 +-20 +-25 +-28 +-32 +-35 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-55 +-46 +10 +47 +72 +88 +97 +99 +97 +94 +89 +84 +78 +73 +67 +63 +57 +53 +49 +37 +26 +17 +8 +1 +-7 +-12 +-18 +-23 +-27 +-30 +-34 +-37 +-40 +-42 +-44 +-45 +-47 +-48 +-50 +-51 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-47 +5 +40 +64 +80 +88 +91 +95 +98 +93 +87 +81 +75 +69 +64 +59 +55 +50 +47 +43 +40 +37 +34 +32 +29 +27 +25 +23 +22 +20 +19 +17 +16 +14 +14 +13 +12 +11 +11 +15 +17 +15 +14 +13 +12 +12 +3 +-4 +-11 +-17 +-22 +-27 +-30 +-34 +-37 +-40 +-43 +-45 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-57 +-58 +-56 +-9 +32 +57 +75 +84 +88 +87 +85 +81 +76 +71 +66 +61 +56 +52 +48 +44 +33 +22 +13 +4 +-3 +-9 +-15 +-20 +-25 +-29 +-32 +-36 +-38 +-41 +-43 +-45 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-56 +-56 +-39 +11 +42 +64 +81 +98 +104 +100 +95 +89 +84 +78 +73 +67 +62 +57 +63 +50 +38 +26 +17 +8 +1 +-7 +-12 +-18 +-23 +-27 +-31 +-34 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-24 +29 +58 +76 +86 +90 +89 +87 +83 +78 +73 +68 +62 +58 +53 +49 +45 +42 +39 +41 +42 +39 +36 +34 +31 +29 +27 +25 +23 +22 +20 +19 +17 +16 +15 +14 +12 +12 +11 +10 +9 +9 +8 +7 +6 +6 +-2 +-8 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-57 +-52 +-5 +30 +60 +88 +97 +95 +92 +88 +83 +77 +72 +67 +62 +57 +53 +48 +37 +26 +16 +7 +0 +-7 +-13 +-18 +-23 +-27 +-31 +-34 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-56 +-56 +-24 +28 +58 +77 +88 +92 +92 +89 +86 +81 +75 +70 +65 +60 +55 +51 +47 +43 +31 +21 +12 +4 +-3 +-10 +-16 +-21 +-25 +-29 +-33 +-36 +-39 +-41 +-43 +-45 +-47 +-48 +-49 +-51 +-52 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-55 +-40 +24 +56 +79 +94 +101 +102 +100 +96 +91 +85 +80 +74 +69 +63 +59 +54 +49 +45 +42 +39 +36 +33 +31 +28 +26 +24 +23 +21 +20 +18 +18 +22 +23 +21 +19 +18 +17 +16 +15 +14 +13 +11 +11 +10 +9 +8 +1 +-7 +-13 +-18 +-23 +-28 +-32 +-35 +-38 +-41 +-43 +-46 +-47 +-49 +-50 +-52 +-53 +-54 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-56 +-10 +29 +54 +72 +81 +85 +84 +81 +77 +73 +68 +63 +58 +54 +51 +53 +42 +30 +20 +11 +3 +-4 +-11 +-16 +-21 +-26 +-30 +-33 +-36 +-39 +-42 +-43 +-45 +-47 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-55 +-52 +4 +45 +72 +89 +99 +101 +100 +97 +92 +86 +81 +75 +69 +64 +59 +54 +50 +38 +27 +18 +9 +1 +-6 +-12 +-17 +-22 +-26 +-31 +-34 +-37 +-39 +-42 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-56 +-47 +7 +42 +66 +82 +90 +92 +91 +88 +83 +79 +80 +78 +72 +66 +61 +57 +44 +32 +22 +12 +4 +-3 +-9 +-15 +-20 +-25 +-29 +-32 +-36 +-39 +-41 +-43 +-45 +-47 +-48 +-50 +-50 +-52 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-29 +22 +54 +77 +91 +97 +99 +96 +93 +87 +82 +76 +71 +65 +61 +56 +52 +47 +36 +25 +15 +7 +-1 +-8 +-13 +-19 +-23 +-28 +-31 +-35 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-55 +-56 +-56 +-56 +-23 +27 +56 +74 +85 +89 +96 +99 +94 +88 +82 +76 +70 +65 +60 +55 +51 +47 +44 +40 +37 +34 +32 +30 +28 +25 +23 +22 +20 +19 +18 +16 +15 +14 +13 +12 +11 +11 +15 +17 +15 +14 +14 +12 +12 +11 +3 +-5 +-11 +-17 +-22 +-27 +-31 +-35 +-38 +-41 +-43 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-55 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-31 +22 +53 +72 +83 +86 +87 +84 +81 +75 +71 +65 +61 +56 +52 +47 +44 +40 +37 +34 +32 +29 +28 +32 +32 +29 +28 +25 +24 +22 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +10 +8 +8 +7 +7 +6 +-1 +-8 +-14 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-33 +19 +49 +68 +78 +82 +86 +92 +88 +82 +76 +71 +66 +61 +56 +52 +39 +28 +18 +10 +1 +-5 +-12 +-17 +-22 +-26 +-31 +-34 +-37 +-40 +-42 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-38 +15 +49 +73 +87 +95 +96 +95 +90 +86 +81 +76 +70 +65 +60 +55 +51 +47 +43 +40 +37 +36 +39 +38 +35 +33 +30 +28 +26 +25 +23 +21 +20 +18 +17 +16 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +6 +-1 +-8 +-14 +-20 +-25 +-29 +-33 +-37 +-39 +-42 +-44 +-47 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-32 +19 +48 +65 +76 +86 +94 +90 +85 +79 +74 +68 +63 +58 +54 +50 +46 +42 +39 +36 +34 +31 +28 +26 +24 +23 +21 +19 +18 +17 +15 +14 +14 +12 +12 +10 +10 +14 +17 +15 +14 +13 +12 +11 +11 +2 +-5 +-12 +-17 +-23 +-27 +-31 +-35 +-38 +-41 +-44 +-45 +-47 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-21 +30 +59 +76 +86 +90 +89 +86 +82 +77 +72 +66 +62 +56 +52 +48 +44 +33 +23 +13 +5 +-3 +-9 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-41 +-44 +-45 +-47 +-48 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-47 +6 +40 +66 +94 +107 +105 +101 +96 +91 +84 +79 +73 +68 +62 +58 +53 +41 +29 +19 +10 +3 +-5 +-11 +-17 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-55 +-56 +-56 +-56 +-30 +20 +52 +74 +88 +94 +95 +93 +89 +84 +80 +74 +69 +63 +59 +53 +50 +46 +45 +47 +45 +41 +38 +36 +33 +31 +29 +26 +25 +23 +21 +20 +18 +17 +16 +14 +13 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-54 +-55 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-31 +29 +71 +91 +96 +96 +92 +88 +83 +78 +72 +67 +62 +57 +52 +48 +36 +26 +16 +7 +-1 +-7 +-13 +-19 +-24 +-28 +-32 +-35 +-38 +-40 +-43 +-45 +-47 +-48 +-50 +-51 +-52 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-57 +-57 +-38 +14 +47 +71 +85 +93 +94 +92 +88 +84 +79 +74 +68 +63 +58 +54 +50 +45 +33 +23 +13 +5 +-3 +-9 +-15 +-20 +-25 +-29 +-32 +-36 +-39 +-41 +-44 +-45 +-47 +-48 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-20 +38 +70 +89 +100 +103 +103 +99 +94 +88 +83 +77 +71 +65 +60 +55 +51 +47 +44 +40 +37 +34 +32 +29 +27 +25 +24 +22 +20 +19 +18 +21 +24 +22 +20 +19 +18 +16 +16 +14 +13 +12 +11 +10 +10 +9 +1 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-38 +-41 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-59 +-58 +-59 +-59 +-32 +22 +53 +71 +82 +87 +87 +84 +80 +75 +70 +65 +60 +56 +52 +53 +43 +31 +21 +12 +3 +-4 +-10 +-16 +-21 +-26 +-30 +-33 +-37 +-39 +-42 +-44 +-46 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-55 +-56 +-56 +-56 +-56 +-19 +37 +69 +88 +98 +103 +102 +98 +93 +88 +82 +76 +70 +65 +59 +55 +51 +39 +27 +18 +9 +1 +-6 +-12 +-18 +-22 +-27 +-31 +-34 +-37 +-40 +-42 +-44 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-57 +-56 +-17 +35 +65 +83 +92 +96 +95 +91 +86 +82 +76 +74 +74 +69 +64 +59 +45 +34 +23 +14 +5 +-2 +-9 +-15 +-20 +-24 +-29 +-32 +-36 +-38 +-41 +-43 +-45 +-47 +-48 +-49 +-51 +-52 +-53 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-56 +-56 +-56 +-13 +41 +72 +90 +100 +103 +102 +99 +94 +88 +82 +76 +70 +64 +60 +55 +51 +47 +44 +40 +37 +34 +32 +29 +28 +29 +32 +30 +28 +26 +24 +23 +21 +20 +18 +17 +16 +14 +14 +13 +12 +10 +10 +9 +8 +7 +0 +-7 +-13 +-19 +-24 +-29 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-53 +-53 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-58 +-59 +-59 +-59 +-58 +-27 +25 +54 +71 +81 +85 +84 +82 +78 +78 +78 +73 +67 +62 +57 +53 +49 +46 +42 +39 +36 +34 +31 +29 +26 +25 +23 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +10 +9 +9 +8 +13 +14 +13 +12 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-38 +-41 +-43 +-46 +-47 +-49 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-58 +-59 +-58 +-59 +-58 +-19 +33 +62 +80 +89 +93 +92 +89 +84 +79 +74 +69 +63 +58 +53 +50 +45 +42 +38 +36 +33 +30 +28 +26 +24 +24 +27 +28 +26 +24 +22 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +-1 +-8 +-14 +-20 +-25 +-29 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-59 +-45 +4 +36 +59 +74 +82 +83 +82 +79 +75 +72 +74 +70 +65 +60 +55 +51 +47 +44 +41 +37 +35 +32 +29 +27 +25 +23 +22 +20 +19 +17 +16 +14 +14 +12 +12 +11 +10 +9 +8 +7 +7 +10 +14 +13 +12 +11 +11 +10 +9 +8 +8 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +2 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +1 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +1 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +-5 +-12 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-60 +-60 +-44 +5 +39 +62 +78 +84 +86 +84 +81 +77 +72 +66 +62 +57 +53 +49 +45 +43 +46 +43 +40 +37 +34 +32 +30 +27 +26 +24 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +15 +5 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-40 +-43 +-45 +-48 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-19 +45 +78 +91 +94 +93 +89 +85 +80 +75 +69 +64 +58 +54 +49 +46 +34 +23 +14 +5 +-2 +-9 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-14 +39 +68 +85 +95 +98 +96 +92 +88 +82 +76 +70 +65 +60 +55 +52 +47 +34 +24 +14 +5 +-2 +-9 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-41 +-44 +-46 +-48 +-49 +-50 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-56 +-57 +-57 +-57 +-56 +-4 +49 +79 +97 +106 +108 +106 +102 +96 +91 +84 +78 +72 +66 +61 +56 +52 +48 +44 +41 +37 +35 +32 +30 +27 +26 +23 +22 +20 +20 +25 +25 +23 +21 +20 +18 +17 +16 +15 +14 +12 +12 +11 +10 +9 +9 +0 +-7 +-13 +-19 +-24 +-28 +-33 +-36 +-39 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-19 +31 +60 +76 +86 +89 +88 +84 +80 +75 +70 +64 +59 +56 +58 +55 +60 +46 +34 +23 +14 +5 +-2 +-9 +-15 +-21 +-25 +-30 +-33 +-37 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-56 +-57 +-57 +-57 +-57 +-12 +40 +70 +88 +96 +99 +97 +93 +88 +83 +77 +71 +65 +60 +55 +51 +47 +43 +40 +37 +34 +32 +29 +27 +25 +23 +21 +21 +25 +25 +23 +22 +20 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +8 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-28 +26 +56 +74 +84 +87 +87 +84 +80 +75 +70 +67 +68 +64 +59 +54 +41 +30 +20 +10 +2 +-5 +-11 +-17 +-22 +-27 +-31 +-34 +-37 +-40 +-43 +-45 +-47 +-49 +-50 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-44 +15 +53 +78 +95 +101 +103 +100 +96 +91 +85 +79 +74 +68 +63 +58 +53 +49 +37 +26 +16 +7 +0 +-7 +-13 +-19 +-24 +-28 +-32 +-36 +-38 +-41 +-43 +-46 +-47 +-49 +-50 +-52 +-52 +-54 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-19 +34 +64 +81 +91 +93 +92 +90 +92 +90 +84 +77 +71 +66 +61 +56 +43 +31 +21 +12 +4 +-4 +-10 +-16 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-45 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-56 +-57 +-57 +-57 +-57 +-7 +46 +75 +92 +101 +103 +101 +98 +92 +86 +80 +75 +68 +63 +58 +53 +49 +45 +42 +39 +35 +34 +36 +37 +35 +32 +30 +28 +26 +24 +22 +21 +19 +18 +16 +16 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +-1 +-8 +-15 +-20 +-25 +-30 +-34 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-59 +-60 +-23 +28 +57 +74 +83 +87 +95 +95 +89 +83 +77 +71 +66 +60 +56 +51 +39 +27 +18 +8 +1 +-7 +-13 +-18 +-23 +-28 +-32 +-35 +-38 +-41 +-43 +-45 +-47 +-49 +-50 +-52 +-52 +-54 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-12 +42 +72 +90 +99 +101 +100 +96 +90 +85 +79 +73 +67 +62 +57 +53 +48 +36 +25 +16 +7 +-1 +-8 +-14 +-20 +-24 +-29 +-32 +-36 +-39 +-42 +-44 +-46 +-47 +-49 +-50 +-52 +-53 +-54 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-43 +16 +69 +100 +109 +110 +108 +103 +98 +91 +86 +79 +73 +68 +63 +57 +53 +48 +45 +41 +38 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +16 +15 +14 +17 +20 +19 +17 +17 +15 +14 +13 +13 +12 +11 +10 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-42 +9 +43 +66 +81 +88 +89 +87 +84 +79 +74 +69 +64 +59 +55 +50 +46 +42 +30 +20 +11 +2 +-5 +-12 +-17 +-22 +-27 +-31 +-34 +-38 +-40 +-43 +-45 +-47 +-49 +-50 +-51 +-53 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-54 +25 +72 +94 +103 +107 +105 +102 +96 +91 +84 +79 +72 +67 +61 +56 +51 +48 +36 +25 +15 +7 +-1 +-8 +-14 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-35 +18 +51 +75 +89 +95 +96 +93 +89 +84 +79 +74 +68 +63 +60 +62 +58 +54 +49 +46 +42 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +6 +6 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-59 +-25 +31 +63 +83 +93 +97 +96 +93 +87 +83 +77 +71 +65 +60 +55 +51 +47 +54 +41 +30 +20 +11 +2 +-5 +-12 +-17 +-23 +-27 +-31 +-35 +-38 +-41 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-21 +32 +61 +78 +87 +90 +89 +85 +81 +76 +70 +65 +62 +63 +60 +55 +42 +30 +20 +11 +2 +-5 +-12 +-17 +-22 +-27 +-31 +-34 +-38 +-40 +-43 +-45 +-47 +-49 +-50 +-51 +-53 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-57 +-57 +-58 +-9 +47 +77 +94 +104 +106 +104 +100 +95 +88 +82 +76 +70 +64 +59 +55 +51 +38 +27 +17 +8 +0 +-7 +-13 +-18 +-24 +-28 +-32 +-35 +-38 +-41 +-44 +-45 +-47 +-49 +-50 +-51 +-53 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-8 +42 +71 +87 +95 +97 +96 +92 +93 +92 +85 +79 +73 +67 +62 +57 +44 +32 +22 +12 +4 +-4 +-10 +-16 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-45 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-33 +22 +57 +81 +95 +101 +102 +98 +94 +89 +84 +77 +72 +66 +62 +56 +52 +48 +44 +40 +37 +34 +32 +34 +36 +33 +31 +29 +27 +25 +24 +22 +20 +19 +18 +16 +15 +13 +13 +11 +11 +10 +9 +8 +8 +7 +7 +-2 +-9 +-15 +-20 +-26 +-30 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-36 +12 +43 +65 +78 +84 +85 +91 +91 +85 +79 +73 +68 +63 +58 +53 +49 +45 +41 +38 +35 +32 +30 +28 +25 +23 +22 +20 +19 +17 +16 +15 +13 +13 +11 +11 +10 +9 +10 +15 +15 +14 +13 +12 +11 +21 +12 +3 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-53 +-54 +-56 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-26 +28 +57 +75 +85 +89 +87 +84 +79 +74 +68 +64 +58 +54 +49 +46 +42 +35 +24 +14 +5 +-2 +-9 +-15 +-21 +-25 +-30 +-33 +-37 +-40 +-43 +-45 +-47 +-48 +-50 +-51 +-53 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-9 +40 +66 +83 +93 +104 +105 +100 +93 +86 +80 +74 +68 +63 +58 +53 +49 +46 +42 +39 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +16 +15 +14 +13 +12 +11 +12 +17 +17 +16 +14 +14 +12 +12 +11 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-53 +-54 +-56 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-24 +30 +61 +79 +89 +92 +91 +87 +83 +77 +72 +66 +61 +56 +52 +47 +44 +40 +37 +34 +31 +29 +29 +32 +32 +29 +27 +25 +24 +22 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-20 +31 +59 +76 +84 +88 +91 +95 +89 +83 +77 +71 +65 +61 +56 +52 +38 +28 +17 +9 +0 +-7 +-13 +-18 +-24 +-28 +-32 +-35 +-39 +-41 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-9 +44 +75 +91 +100 +102 +101 +96 +91 +85 +80 +73 +68 +62 +57 +52 +48 +36 +25 +15 +7 +-1 +-8 +-14 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-57 +-57 +-4 +59 +98 +112 +114 +111 +107 +101 +95 +88 +81 +75 +69 +64 +59 +54 +50 +46 +42 +39 +36 +33 +31 +28 +27 +24 +23 +21 +20 +18 +17 +15 +14 +15 +20 +19 +18 +17 +16 +14 +14 +13 +12 +11 +10 +2 +-6 +-12 +-18 +-24 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-15 +36 +65 +81 +90 +93 +91 +87 +83 +77 +72 +66 +61 +56 +52 +47 +44 +47 +35 +24 +15 +6 +-2 +-9 +-15 +-20 +-25 +-30 +-33 +-37 +-40 +-43 +-45 +-47 +-48 +-50 +-51 +-53 +-53 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-34 +43 +77 +93 +102 +105 +102 +98 +92 +87 +80 +74 +68 +63 +58 +53 +49 +37 +26 +16 +7 +-1 +-8 +-14 +-20 +-24 +-29 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-59 +-58 +-11 +42 +72 +89 +97 +100 +98 +94 +88 +83 +77 +71 +65 +61 +61 +61 +56 +52 +48 +45 +41 +38 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +5 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-51 +9 +48 +74 +90 +97 +99 +96 +92 +87 +82 +76 +70 +65 +60 +55 +50 +46 +35 +24 +14 +5 +-2 +-9 +-15 +-21 +-25 +-30 +-33 +-37 +-40 +-43 +-45 +-47 +-48 +-50 +-51 +-53 +-53 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-16 +37 +67 +84 +94 +96 +95 +90 +86 +80 +75 +69 +64 +64 +63 +58 +44 +32 +22 +12 +4 +-4 +-10 +-17 +-22 +-26 +-30 +-34 +-37 +-40 +-43 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-57 +-2 +51 +81 +98 +106 +108 +106 +102 +95 +89 +83 +77 +70 +65 +59 +55 +50 +38 +27 +17 +8 +0 +-7 +-13 +-19 +-24 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-6 +44 +72 +89 +97 +98 +96 +93 +90 +92 +86 +79 +73 +68 +62 +57 +44 +32 +21 +12 +4 +-4 +-11 +-16 +-22 +-26 +-31 +-34 +-38 +-40 +-43 +-45 +-47 +-49 +-50 +-51 +-53 +-53 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-57 +-58 +-58 +-41 +18 +55 +81 +96 +103 +103 +101 +96 +91 +85 +79 +73 +67 +62 +57 +52 +48 +36 +25 +15 +7 +-2 +-8 +-15 +-20 +-25 +-29 +-33 +-36 +-39 +-42 +-44 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-26 +23 +54 +76 +92 +107 +109 +104 +97 +91 +85 +79 +73 +67 +62 +57 +52 +48 +44 +41 +37 +35 +32 +30 +27 +25 +23 +22 +20 +19 +17 +16 +14 +14 +12 +12 +13 +18 +17 +16 +14 +14 +13 +12 +11 +10 +2 +-6 +-13 +-18 +-24 +-28 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-23 +32 +62 +80 +89 +92 +91 +87 +82 +77 +72 +66 +61 +56 +51 +47 +43 +32 +21 +12 +3 +-4 +-11 +-17 +-22 +-27 +-31 +-34 +-38 +-41 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-33 +18 +51 +79 +105 +111 +108 +102 +97 +91 +85 +78 +73 +67 +62 +57 +52 +48 +44 +41 +38 +34 +32 +29 +27 +25 +23 +21 +20 +18 +17 +16 +15 +13 +13 +13 +18 +18 +17 +15 +15 +14 +13 +12 +11 +21 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-61 +-25 +28 +58 +75 +85 +88 +86 +83 +79 +73 +68 +63 +58 +53 +49 +44 +41 +29 +19 +10 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-38 +-41 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-58 +-15 +50 +93 +110 +113 +110 +106 +100 +94 +87 +81 +74 +69 +63 +58 +53 +41 +29 +19 +10 +2 +-6 +-12 +-18 +-23 +-28 +-31 +-35 +-38 +-41 +-43 +-46 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-59 +-14 +41 +72 +88 +97 +100 +99 +94 +89 +83 +77 +71 +66 +60 +56 +51 +47 +34 +24 +14 +5 +-3 +-9 +-16 +-21 +-26 +-30 +-34 +-37 +-40 +-42 +-45 +-47 +-49 +-50 +-52 +-52 +-54 +-54 +-55 +-56 +-57 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-5 +53 +84 +101 +109 +112 +110 +105 +99 +93 +86 +80 +73 +68 +62 +57 +52 +49 +44 +41 +38 +35 +32 +30 +27 +26 +23 +22 +20 +19 +18 +20 +23 +22 +20 +19 +17 +17 +15 +15 +13 +12 +11 +11 +9 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-14 +36 +65 +82 +90 +92 +91 +87 +82 +76 +71 +65 +60 +55 +51 +51 +42 +30 +20 +10 +2 +-5 +-12 +-18 +-23 +-28 +-31 +-35 +-38 +-41 +-43 +-46 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-4 +51 +82 +100 +108 +110 +107 +103 +96 +90 +84 +78 +71 +66 +60 +55 +51 +39 +27 +17 +8 +0 +-7 +-13 +-19 +-24 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-32 +21 +55 +78 +92 +97 +97 +94 +90 +85 +79 +75 +77 +73 +67 +62 +57 +52 +49 +45 +42 +38 +36 +33 +30 +28 +26 +24 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +10 +14 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-20 +36 +67 +85 +95 +97 +96 +91 +86 +80 +75 +69 +64 +58 +54 +49 +45 +49 +37 +25 +16 +7 +-1 +-8 +-14 +-20 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-58 +-58 +-59 +-59 +-59 +-10 +39 +66 +83 +91 +92 +90 +86 +82 +78 +79 +75 +69 +63 +58 +53 +41 +29 +19 +9 +1 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-41 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-2 +51 +80 +97 +105 +106 +103 +99 +93 +87 +80 +75 +68 +63 +58 +54 +49 +45 +41 +39 +35 +33 +30 +29 +33 +33 +30 +28 +26 +24 +23 +21 +20 +18 +17 +16 +14 +14 +12 +12 +10 +10 +8 +8 +7 +7 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-56 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-61 +-60 +-61 +-60 +-60 +-14 +35 +63 +79 +88 +89 +88 +86 +89 +84 +78 +72 +66 +61 +57 +52 +39 +27 +18 +8 +0 +-7 +-13 +-19 +-24 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-58 +-3 +50 +78 +95 +103 +105 +102 +98 +92 +86 +79 +74 +68 +62 +57 +53 +48 +36 +25 +15 +6 +-1 +-9 +-15 +-20 +-25 +-29 +-33 +-37 +-39 +-42 +-44 +-47 +-48 +-50 +-51 +-53 +-53 +-55 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-58 +-9 +43 +77 +107 +116 +114 +108 +102 +96 +89 +82 +76 +70 +65 +59 +55 +42 +30 +20 +11 +2 +-5 +-12 +-17 +-23 +-27 +-31 +-35 +-38 +-41 +-44 +-45 +-48 +-49 +-51 +-52 +-53 +-54 +-55 +-55 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-2 +49 +78 +94 +102 +103 +101 +97 +91 +85 +79 +73 +67 +62 +57 +52 +55 +51 +38 +26 +17 +7 +0 +-8 +-14 +-20 +-24 +-29 +-33 +-36 +-39 +-42 +-44 +-47 +-48 +-50 +-51 +-53 +-54 +-55 +-55 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-58 +-4 +51 +80 +97 +105 +106 +104 +99 +93 +87 +81 +75 +68 +63 +58 +53 +49 +45 +41 +38 +35 +33 +30 +28 +25 +24 +21 +20 +19 +18 +16 +19 +22 +21 +19 +18 +17 +16 +14 +14 +12 +12 +10 +10 +9 +8 +0 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-40 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-56 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +-61 +-60 +-61 +-61 +-61 +-22 +32 +63 +81 +90 +92 +92 +87 +83 +77 +72 +66 +61 +56 +52 +51 +53 +48 +45 +41 +39 +36 +33 +31 +29 +26 +25 +23 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +10 +8 +8 +7 +7 +6 +6 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-61 +-60 +-60 +-60 +-46 +34 +71 +89 +98 +100 +99 +95 +89 +84 +78 +72 +66 +61 +55 +51 +47 +35 +24 +14 +5 +-2 +-9 +-15 +-21 +-25 +-30 +-34 +-37 +-40 +-43 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-57 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-7 +45 +74 +91 +99 +101 +98 +94 +88 +83 +77 +71 +65 +60 +60 +60 +55 +51 +47 +44 +41 +38 +35 +32 +30 +28 +25 +24 +22 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +-61 +-60 +-61 +-60 +-18 +39 +72 +91 +99 +103 +101 +97 +90 +85 +79 +73 +67 +62 +57 +52 +47 +44 +40 +37 +34 +32 +29 +27 +25 +23 +21 +20 +18 +17 +18 +22 +21 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +10 +8 +8 +0 +-7 +-14 +-20 +-25 +-29 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-52 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +-61 +-61 +-61 +-61 +-33 +17 +49 +72 +85 +90 +89 +87 +82 +77 +72 +67 +62 +57 +53 +51 +53 +40 +28 +18 +9 +1 +-7 +-13 +-19 +-24 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-55 +-56 +-57 +-58 +-58 +-58 +-58 +-59 +-58 +-58 +-9 +47 +78 +96 +105 +107 +105 +100 +95 +88 +82 +76 +70 +64 +59 +54 +50 +37 +26 +16 +7 +-1 +-8 +-14 +-19 +-25 +-29 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-59 +-59 +-3 +48 +76 +91 +99 +100 +98 +93 +88 +82 +77 +77 +75 +68 +63 +58 +54 +50 +46 +42 +40 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +10 +9 +8 +7 +9 +14 +14 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +-61 +-61 +-61 +-60 +-47 +12 +49 +76 +91 +98 +98 +96 +91 +86 +80 +75 +69 +64 +58 +54 +49 +57 +43 +32 +21 +12 +3 +-4 +-11 +-17 +-23 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-15 +37 +65 +82 +90 +92 +90 +86 +81 +77 +78 +75 +68 +63 +58 +54 +44 +32 +21 +12 +3 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-49 +-51 +-52 +-54 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-58 +-59 +1 +52 +81 +97 +105 +105 +103 +98 +92 +86 +80 +73 +68 +62 +57 +52 +48 +44 +41 +37 +35 +32 +30 +28 +32 +32 +30 +28 +26 +24 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +-1 +-9 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-21 +31 +60 +77 +86 +88 +86 +82 +80 +81 +78 +71 +66 +60 +56 +51 +39 +27 +17 +8 +0 +-7 +-14 +-20 +-24 +-29 +-33 +-36 +-39 +-42 +-44 +-47 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-59 +-59 +-40 +19 +57 +82 +97 +103 +104 +100 +96 +90 +84 +78 +72 +66 +61 +56 +52 +47 +36 +24 +15 +5 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-59 +-59 +-40 +16 +52 +75 +92 +107 +112 +106 +100 +93 +87 +80 +75 +69 +64 +58 +53 +40 +29 +19 +10 +1 +-6 +-13 +-18 +-24 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-48 +-50 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-58 +-58 +-59 +-59 +-29 +25 +59 +83 +96 +101 +101 +98 +93 +88 +82 +76 +70 +65 +60 +55 +50 +47 +42 +43 +45 +42 +38 +36 +33 +31 +28 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-38 +12 +51 +88 +104 +103 +100 +95 +90 +84 +78 +72 +67 +61 +57 +52 +48 +44 +40 +37 +34 +31 +29 +26 +24 +22 +21 +19 +18 +16 +15 +14 +13 +12 +12 +17 +18 +16 +15 +14 +13 +12 +12 +10 +10 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-30 +20 +53 +75 +88 +92 +92 +88 +84 +79 +74 +68 +63 +58 +54 +49 +46 +42 +38 +36 +40 +38 +35 +32 +30 +28 +26 +24 +23 +21 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +15 +6 +-2 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-23 +28 +57 +82 +98 +98 +93 +88 +82 +76 +70 +65 +60 +55 +50 +46 +42 +39 +35 +33 +30 +28 +25 +24 +21 +20 +19 +17 +16 +15 +13 +12 +11 +11 +10 +14 +17 +15 +14 +13 +12 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +0 +0 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +-1 +2 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +-1 +2 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-62 +-62 +-62 +-61 +-62 +-61 +-7 +46 +76 +93 +100 +101 +98 +94 +87 +82 +76 +70 +64 +59 +54 +49 +45 +42 +38 +35 +32 +30 +27 +25 +23 +22 +20 +19 +21 +25 +23 +21 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-62 +-62 +-36 +16 +49 +73 +86 +91 +90 +87 +83 +78 +72 +68 +62 +62 +62 +57 +53 +40 +28 +18 +8 +0 +-7 +-13 +-20 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-54 +-54 +-56 +-56 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-25 +30 +65 +89 +103 +106 +106 +102 +97 +90 +85 +78 +73 +67 +62 +57 +52 +48 +36 +24 +15 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-40 +-43 +-45 +-48 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-19 +30 +61 +82 +94 +97 +96 +92 +90 +91 +87 +81 +75 +69 +64 +58 +54 +49 +46 +42 +39 +35 +33 +30 +28 +25 +24 +22 +20 +19 +17 +16 +15 +13 +12 +11 +11 +10 +9 +8 +12 +15 +14 +13 +12 +11 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-25 +25 +59 +82 +94 +97 +97 +92 +88 +82 +77 +71 +66 +60 +56 +51 +47 +43 +31 +20 +11 +2 +-5 +-12 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-9 +41 +70 +87 +95 +96 +97 +100 +96 +88 +82 +76 +70 +64 +59 +54 +50 +46 +43 +39 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +14 +12 +12 +11 +10 +9 +12 +16 +15 +14 +13 +12 +11 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-61 +-14 +40 +71 +88 +96 +97 +95 +90 +84 +78 +73 +67 +62 +56 +52 +47 +43 +31 +21 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-3 +48 +76 +91 +103 +113 +111 +103 +96 +89 +82 +76 +70 +64 +59 +54 +44 +32 +21 +12 +3 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +6 +56 +83 +99 +106 +106 +102 +97 +91 +85 +78 +72 +66 +61 +56 +52 +47 +35 +24 +14 +5 +-3 +-10 +-16 +-22 +-26 +-31 +-34 +-38 +-41 +-44 +-46 +-48 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +6 +67 +99 +110 +114 +112 +108 +102 +96 +89 +83 +76 +70 +65 +60 +55 +50 +46 +42 +39 +36 +33 +31 +28 +26 +23 +22 +20 +19 +17 +16 +15 +15 +20 +20 +18 +17 +16 +15 +14 +13 +12 +11 +10 +10 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-62 +-62 +-62 +-44 +13 +50 +74 +89 +94 +94 +90 +86 +81 +75 +69 +65 +60 +55 +50 +46 +42 +30 +19 +10 +1 +-6 +-13 +-18 +-24 +-28 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-59 +-33 +34 +69 +93 +107 +111 +110 +106 +100 +94 +87 +81 +75 +69 +64 +59 +54 +50 +37 +26 +16 +7 +-1 +-8 +-15 +-20 +-25 +-30 +-34 +-37 +-40 +-43 +-45 +-47 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-6 +48 +76 +92 +100 +101 +98 +93 +87 +81 +75 +69 +64 +63 +63 +58 +53 +49 +45 +42 +39 +36 +33 +31 +28 +26 +24 +23 +21 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +7 +7 +7 +6 +6 +5 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-62 +-61 +-62 +-61 +-3 +51 +81 +97 +104 +106 +102 +97 +90 +84 +78 +72 +66 +61 +56 +51 +47 +49 +36 +25 +15 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-1 +48 +75 +91 +96 +97 +94 +89 +83 +77 +71 +70 +70 +65 +59 +55 +41 +29 +19 +10 +1 +-6 +-13 +-19 +-24 +-28 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-59 +5 +59 +88 +104 +111 +111 +107 +101 +95 +88 +82 +75 +69 +64 +59 +53 +49 +45 +41 +38 +35 +32 +30 +28 +26 +26 +31 +29 +27 +25 +23 +21 +20 +19 +18 +16 +15 +14 +13 +11 +11 +10 +9 +8 +8 +7 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-8 +40 +66 +81 +88 +89 +85 +82 +76 +75 +75 +70 +64 +59 +54 +50 +37 +26 +15 +7 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-25 +31 +66 +90 +102 +106 +104 +100 +95 +89 +83 +77 +71 +66 +60 +56 +51 +47 +35 +24 +14 +5 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-26 +26 +59 +82 +94 +102 +109 +106 +99 +92 +86 +80 +74 +68 +62 +58 +53 +40 +28 +18 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-15 +35 +68 +90 +101 +104 +102 +98 +93 +86 +80 +74 +69 +63 +59 +54 +50 +56 +43 +31 +20 +10 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-58 +24 +79 +103 +109 +110 +106 +101 +94 +88 +81 +75 +69 +63 +58 +53 +49 +45 +41 +38 +34 +32 +29 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +14 +18 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-62 +-4 +47 +75 +90 +98 +98 +95 +90 +84 +78 +72 +66 +61 +56 +52 +47 +43 +41 +45 +42 +39 +36 +33 +30 +29 +26 +25 +23 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +5 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-62 +-33 +22 +73 +101 +106 +105 +101 +95 +90 +83 +78 +71 +66 +61 +56 +51 +47 +35 +24 +14 +5 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-4 +50 +78 +95 +102 +102 +99 +94 +88 +82 +75 +70 +64 +59 +54 +50 +47 +50 +47 +44 +40 +37 +34 +32 +30 +28 +25 +24 +22 +20 +18 +17 +16 +15 +13 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +-3 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-62 +-61 +-50 +38 +82 +100 +107 +109 +105 +100 +94 +88 +81 +75 +68 +63 +57 +53 +48 +45 +41 +38 +34 +32 +29 +27 +25 +23 +21 +19 +18 +17 +15 +14 +13 +17 +20 +18 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-62 +-62 +-33 +20 +55 +79 +91 +95 +94 +90 +85 +80 +74 +69 +63 +59 +54 +50 +45 +41 +29 +19 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-48 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-34 +36 +72 +96 +109 +112 +111 +106 +100 +94 +88 +81 +75 +69 +64 +58 +54 +49 +37 +25 +16 +6 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-15 +34 +66 +88 +99 +101 +99 +95 +90 +83 +78 +72 +67 +64 +66 +61 +57 +52 +48 +44 +41 +38 +35 +32 +30 +27 +25 +23 +21 +20 +18 +16 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +6 +10 +4 +-4 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-62 +-20 +31 +66 +88 +100 +103 +101 +97 +91 +85 +80 +73 +68 +62 +58 +53 +49 +44 +33 +22 +12 +3 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-4 +46 +76 +92 +99 +99 +97 +92 +86 +80 +74 +70 +72 +67 +62 +57 +52 +39 +27 +17 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-31 +29 +66 +91 +105 +109 +107 +104 +98 +91 +85 +79 +72 +67 +62 +57 +52 +48 +44 +40 +37 +34 +31 +29 +26 +26 +30 +30 +27 +26 +24 +22 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +-2 +-9 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-63 +-62 +-62 +-11 +41 +69 +84 +92 +92 +90 +84 +79 +75 +76 +72 +66 +61 +56 +51 +41 +29 +18 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-48 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-59 +11 +62 +89 +105 +110 +110 +105 +100 +92 +86 +79 +73 +67 +62 +57 +52 +47 +35 +24 +14 +5 +-3 +-10 +-16 +-22 +-26 +-31 +-35 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-15 +34 +65 +86 +97 +99 +104 +106 +99 +92 +85 +79 +73 +67 +63 +57 +53 +39 +28 +18 +8 +0 +-7 +-14 +-20 +-25 +-29 +-34 +-37 +-40 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-13 +38 +70 +92 +103 +106 +103 +99 +93 +87 +80 +75 +68 +63 +58 +54 +49 +45 +33 +22 +12 +4 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +4 +69 +106 +116 +116 +112 +106 +99 +92 +85 +79 +73 +66 +61 +56 +52 +39 +27 +17 +8 +0 +-8 +-14 +-20 +-25 +-29 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +8 +58 +86 +101 +107 +106 +103 +97 +91 +84 +78 +71 +66 +60 +56 +51 +62 +46 +34 +23 +13 +4 +-4 +-11 +-17 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +-47 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-59 +12 +63 +90 +106 +112 +111 +107 +101 +94 +87 +80 +74 +68 +63 +57 +53 +48 +36 +25 +15 +6 +-2 +-9 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +5 +56 +84 +99 +105 +104 +100 +95 +89 +82 +76 +73 +73 +69 +63 +58 +58 +44 +32 +21 +12 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +10 +61 +89 +103 +109 +108 +104 +98 +91 +84 +78 +72 +66 +60 +56 +51 +47 +34 +23 +13 +5 +-3 +-10 +-17 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +-60 +7 +56 +83 +97 +103 +103 +99 +100 +98 +91 +84 +77 +71 +65 +61 +55 +42 +30 +20 +10 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-36 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +10 +63 +90 +105 +111 +111 +106 +100 +93 +87 +80 +74 +68 +62 +57 +53 +48 +36 +24 +15 +5 +-2 +-10 +-16 +-22 +-26 +-31 +-35 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-59 +7 +59 +98 +116 +116 +116 +110 +103 +95 +88 +81 +75 +69 +63 +58 +54 +40 +29 +18 +9 +0 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +9 +60 +88 +102 +109 +108 +104 +98 +92 +85 +78 +72 +66 +61 +56 +51 +47 +34 +23 +13 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-25 +40 +76 +100 +112 +115 +113 +108 +102 +95 +89 +82 +76 +70 +65 +59 +54 +62 +48 +35 +24 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-2 +49 +77 +92 +99 +98 +95 +89 +84 +77 +71 +66 +61 +59 +60 +55 +55 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-56 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-59 +11 +62 +89 +105 +110 +109 +104 +99 +91 +85 +78 +72 +66 +61 +55 +51 +47 +43 +39 +36 +33 +30 +28 +26 +23 +22 +20 +22 +26 +24 +22 +21 +19 +18 +17 +16 +15 +14 +12 +11 +10 +10 +9 +8 +7 +7 +-1 +-9 +-15 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-63 +-62 +-63 +-63 +-62 +1 +50 +77 +91 +97 +96 +93 +87 +81 +75 +70 +67 +68 +63 +58 +53 +53 +40 +28 +18 +8 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-52 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +11 +61 +89 +104 +108 +108 +103 +97 +90 +83 +77 +71 +65 +60 +55 +51 +46 +42 +38 +36 +32 +30 +28 +26 +23 +24 +28 +27 +25 +23 +21 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-63 +-62 +-63 +-63 +-62 +0 +49 +76 +91 +97 +96 +92 +87 +81 +77 +79 +73 +67 +62 +57 +52 +39 +27 +17 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-61 +-60 +12 +64 +92 +107 +112 +112 +107 +101 +94 +87 +80 +74 +68 +63 +57 +53 +48 +36 +24 +15 +5 +-2 +-10 +-16 +-22 +-26 +-31 +-35 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-60 +-61 +-30 +26 +62 +85 +97 +102 +109 +108 +101 +94 +87 +80 +75 +69 +63 +58 +54 +49 +45 +41 +38 +35 +32 +29 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +11 +16 +16 +15 +14 +13 +12 +12 +10 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-63 +-62 +-63 +-36 +21 +58 +83 +97 +100 +99 +94 +89 +83 +77 +71 +66 +60 +56 +51 +47 +43 +31 +20 +11 +2 +-6 +-13 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-45 +-48 +-50 +-51 +-53 +-54 +-56 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-60 +2 +52 +79 +95 +111 +114 +107 +100 +93 +86 +79 +73 +68 +62 +57 +52 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-19 +35 +70 +93 +104 +106 +104 +99 +94 +87 +81 +75 +69 +64 +59 +54 +50 +45 +33 +22 +12 +3 +-4 +-12 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-50 +44 +93 +112 +116 +116 +112 +105 +98 +91 +84 +78 +71 +66 +60 +55 +51 +38 +26 +16 +7 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-60 +9 +61 +88 +103 +108 +108 +103 +97 +90 +84 +77 +71 +65 +60 +55 +56 +45 +33 +22 +12 +3 +-4 +-12 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-59 +19 +71 +99 +114 +116 +116 +112 +105 +98 +91 +84 +77 +71 +65 +60 +55 +50 +38 +26 +16 +7 +-1 +-8 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-60 +13 +62 +88 +102 +107 +105 +101 +95 +89 +82 +78 +78 +74 +68 +63 +57 +44 +31 +21 +11 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-60 +14 +66 +95 +110 +115 +114 +109 +103 +95 +88 +81 +75 +69 +64 +58 +53 +49 +37 +25 +15 +6 +-2 +-9 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-61 +-60 +10 +60 +86 +100 +105 +105 +106 +106 +98 +90 +83 +77 +70 +65 +60 +55 +50 +47 +43 +39 +36 +33 +30 +28 +26 +24 +22 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +10 +15 +17 +15 +14 +13 +12 +11 +2 +-6 +-13 +-19 +-24 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-63 +-62 +-63 +-35 +23 +61 +85 +98 +102 +100 +96 +90 +84 +78 +72 +67 +61 +56 +52 +48 +55 +42 +30 +19 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +0 +49 +76 +90 +96 +101 +104 +97 +90 +83 +76 +70 +65 +59 +55 +50 +46 +42 +39 +35 +33 +30 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +14 +16 +14 +14 +12 +12 +11 +10 +1 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-25 +29 +64 +87 +98 +101 +98 +94 +88 +82 +76 +70 +65 +60 +55 +51 +46 +43 +30 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-60 +4 +54 +81 +95 +107 +113 +107 +100 +92 +86 +79 +73 +67 +62 +56 +52 +39 +27 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-60 +-61 +-61 +-27 +32 +69 +93 +105 +108 +106 +101 +94 +88 +82 +76 +69 +64 +59 +54 +50 +46 +33 +22 +12 +4 +-4 +-11 +-18 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-60 +-61 +-60 +8 +72 +103 +116 +116 +116 +110 +104 +97 +90 +83 +77 +71 +66 +60 +55 +51 +38 +26 +16 +7 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-16 +36 +70 +92 +103 +105 +103 +97 +91 +85 +79 +72 +67 +62 +58 +58 +58 +44 +31 +20 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-60 +-61 +-60 +13 +67 +95 +111 +115 +114 +109 +103 +95 +88 +81 +75 +68 +63 +58 +53 +49 +36 +25 +15 +6 +-2 +-10 +-16 +-22 +-26 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-27 +30 +66 +89 +101 +104 +102 +97 +91 +85 +79 +74 +76 +72 +66 +61 +69 +54 +41 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-60 +-61 +-60 +8 +61 +88 +103 +108 +107 +102 +96 +89 +82 +75 +69 +64 +59 +53 +50 +45 +41 +38 +35 +31 +29 +27 +25 +22 +22 +26 +26 +24 +23 +21 +20 +18 +17 +15 +15 +13 +12 +11 +11 +9 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +6 +9 +9 +8 +8 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +0 +6 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +3 +8 +7 +-2 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-63 +-62 +4 +52 +82 +99 +105 +104 +100 +93 +87 +80 +74 +68 +63 +57 +53 +48 +45 +41 +38 +34 +32 +28 +26 +24 +22 +20 +19 +17 +20 +23 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +5 +55 +80 +94 +98 +97 +91 +86 +79 +73 +67 +62 +60 +61 +56 +52 +38 +27 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-10 +44 +80 +102 +112 +113 +110 +104 +97 +90 +83 +77 +70 +65 +60 +55 +51 +47 +35 +24 +13 +5 +-4 +-11 +-17 +-22 +-28 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-3 +44 +75 +94 +102 +103 +99 +94 +88 +89 +85 +79 +72 +67 +62 +58 +53 +49 +45 +41 +38 +35 +31 +29 +26 +24 +22 +21 +19 +17 +16 +15 +13 +12 +11 +10 +9 +9 +8 +8 +9 +15 +13 +13 +12 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-8 +42 +74 +95 +103 +104 +100 +95 +88 +82 +75 +69 +64 +59 +54 +50 +46 +43 +30 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-60 +11 +58 +84 +98 +102 +101 +97 +97 +94 +86 +79 +74 +68 +63 +57 +53 +49 +45 +41 +38 +35 +32 +29 +27 +24 +22 +20 +19 +17 +16 +15 +14 +12 +11 +10 +10 +9 +8 +9 +15 +15 +14 +12 +12 +11 +10 +1 +-7 +-14 +-20 +-25 +-30 +-35 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +9 +61 +88 +101 +105 +103 +98 +91 +84 +78 +71 +65 +60 +55 +51 +47 +42 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-62 +-60 +15 +64 +89 +102 +106 +111 +110 +103 +95 +87 +80 +74 +68 +63 +58 +53 +41 +29 +19 +9 +1 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-57 +26 +73 +99 +111 +114 +110 +105 +98 +91 +83 +77 +70 +65 +59 +55 +50 +46 +33 +22 +12 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +4 +69 +108 +116 +116 +115 +108 +102 +94 +87 +80 +75 +68 +63 +58 +54 +49 +45 +41 +38 +35 +32 +29 +27 +24 +23 +20 +19 +17 +16 +15 +14 +12 +15 +19 +18 +16 +15 +14 +13 +12 +12 +11 +10 +9 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-29 +27 +63 +87 +98 +100 +98 +93 +87 +81 +74 +69 +63 +58 +53 +50 +45 +42 +29 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-30 +46 +84 +106 +116 +116 +113 +107 +101 +93 +86 +79 +73 +67 +62 +57 +53 +48 +36 +25 +15 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-60 +16 +65 +91 +104 +108 +105 +100 +93 +86 +79 +73 +67 +62 +57 +59 +57 +53 +48 +45 +41 +38 +35 +32 +30 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +5 +4 +-4 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-61 +19 +69 +97 +110 +113 +111 +106 +98 +91 +84 +77 +71 +65 +60 +55 +50 +46 +44 +32 +21 +12 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-59 +20 +65 +91 +102 +105 +102 +97 +90 +84 +77 +71 +65 +65 +65 +59 +54 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-58 +25 +76 +103 +116 +116 +116 +110 +102 +94 +87 +80 +73 +67 +62 +57 +52 +48 +44 +40 +37 +34 +31 +28 +26 +24 +23 +25 +28 +26 +24 +22 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-64 +-62 +11 +57 +82 +94 +97 +95 +90 +84 +78 +71 +70 +69 +64 +59 +54 +50 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-9 +44 +79 +101 +111 +111 +108 +102 +95 +88 +82 +75 +69 +64 +59 +54 +50 +46 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-11 +38 +72 +92 +101 +102 +100 +102 +99 +91 +84 +77 +72 +67 +62 +57 +53 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +1 +50 +82 +102 +109 +109 +105 +99 +92 +85 +79 +73 +67 +62 +57 +53 +48 +57 +43 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-60 +9 +60 +98 +116 +115 +109 +101 +94 +86 +80 +73 +67 +62 +57 +52 +48 +44 +41 +37 +34 +31 +28 +26 +24 +22 +20 +18 +17 +15 +14 +13 +12 +11 +10 +14 +17 +16 +15 +13 +13 +12 +11 +10 +10 +8 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-62 +13 +63 +89 +102 +106 +104 +98 +91 +84 +78 +71 +65 +60 +55 +50 +46 +43 +39 +36 +37 +39 +36 +33 +31 +28 +26 +24 +23 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-20 +30 +62 +85 +104 +110 +104 +97 +90 +83 +77 +71 +65 +61 +56 +52 +47 +35 +24 +14 +4 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-48 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-60 +17 +67 +93 +106 +109 +107 +101 +94 +87 +80 +74 +67 +62 +57 +53 +48 +44 +40 +40 +42 +40 +37 +34 +31 +29 +27 +25 +23 +21 +20 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +5 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-63 +-62 +3 +59 +99 +116 +115 +110 +102 +95 +88 +81 +74 +68 +63 +58 +53 +49 +44 +41 +37 +34 +31 +29 +26 +24 +22 +20 +18 +17 +16 +15 +13 +12 +11 +11 +15 +18 +16 +15 +14 +13 +12 +12 +10 +10 +9 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-18 +33 +68 +90 +100 +101 +98 +93 +87 +80 +74 +68 +63 +58 +53 +49 +45 +41 +29 +19 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-61 +-3 +65 +106 +116 +116 +114 +109 +101 +94 +87 +81 +74 +68 +63 +59 +53 +49 +36 +25 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +0 +47 +79 +99 +106 +106 +102 +96 +89 +83 +76 +71 +65 +60 +55 +52 +54 +53 +49 +45 +41 +38 +35 +32 +29 +27 +25 +23 +21 +19 +17 +16 +15 +14 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-63 +-29 +44 +80 +101 +109 +109 +105 +99 +93 +86 +79 +73 +67 +62 +57 +53 +49 +45 +32 +22 +12 +3 +-5 +-12 +-18 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-60 +15 +62 +89 +102 +106 +104 +99 +92 +85 +79 +72 +66 +61 +57 +57 +58 +52 +39 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-18 +41 +79 +102 +114 +115 +112 +105 +99 +91 +84 +77 +72 +66 +61 +56 +52 +48 +44 +40 +37 +33 +31 +28 +26 +23 +22 +20 +22 +25 +24 +22 +20 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-63 +8 +57 +83 +96 +99 +97 +92 +86 +79 +73 +66 +61 +60 +61 +56 +52 +39 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-56 +30 +78 +104 +115 +116 +114 +108 +101 +93 +85 +79 +72 +66 +61 +56 +52 +47 +35 +24 +13 +5 +-4 +-11 +-17 +-22 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-1 +46 +76 +96 +103 +103 +99 +94 +88 +88 +85 +79 +72 +67 +62 +58 +53 +40 +28 +17 +8 +0 +-8 +-14 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +2 +51 +83 +103 +111 +110 +106 +100 +93 +86 +80 +73 +68 +62 +58 +53 +49 +45 +33 +21 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-60 +16 +63 +89 +100 +108 +113 +108 +100 +92 +84 +78 +72 +66 +61 +56 +52 +47 +43 +40 +36 +33 +30 +28 +25 +24 +22 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +12 +16 +16 +14 +13 +12 +12 +11 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-62 +14 +64 +91 +104 +107 +105 +100 +93 +86 +78 +72 +66 +61 +56 +51 +47 +43 +39 +36 +33 +30 +30 +34 +32 +30 +27 +25 +23 +22 +20 +19 +17 +16 +14 +14 +12 +11 +10 +10 +9 +8 +7 +7 +6 +6 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-63 +-61 +11 +58 +83 +96 +99 +102 +103 +97 +89 +82 +75 +69 +64 +59 +54 +50 +45 +42 +38 +35 +32 +29 +27 +25 +23 +21 +19 +18 +16 +15 +13 +13 +12 +11 +10 +9 +8 +13 +15 +14 +13 +12 +11 +11 +10 +1 +-7 +-14 +-20 +-25 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-63 +-63 +-28 +30 +67 +90 +102 +103 +101 +95 +89 +83 +76 +70 +65 +59 +55 +50 +46 +42 +39 +36 +33 +30 +28 +29 +32 +29 +27 +25 +23 +21 +20 +18 +17 +16 +15 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +5 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-62 +8 +56 +81 +93 +97 +95 +90 +89 +88 +81 +74 +69 +63 +58 +53 +49 +45 +41 +38 +35 +31 +29 +26 +24 +22 +21 +19 +17 +16 +15 +14 +12 +11 +11 +10 +9 +8 +8 +7 +13 +14 +13 +12 +11 +10 +2 +-7 +-13 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-16 +36 +72 +93 +103 +104 +101 +95 +89 +82 +76 +70 +65 +59 +55 +50 +47 +42 +39 +36 +33 +30 +27 +25 +23 +27 +28 +26 +24 +22 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-62 +8 +56 +81 +94 +97 +95 +90 +84 +78 +78 +76 +69 +64 +59 +54 +50 +46 +42 +38 +35 +32 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +7 +13 +13 +12 +11 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-63 +-61 +16 +67 +94 +107 +110 +108 +102 +95 +87 +81 +74 +68 +62 +57 +52 +48 +44 +41 +37 +34 +31 +28 +26 +24 +22 +21 +26 +26 +23 +22 +20 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +7 +7 +6 +6 +-2 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-64 +-62 +12 +60 +85 +97 +101 +98 +93 +87 +81 +75 +77 +72 +66 +61 +56 +52 +48 +44 +40 +37 +34 +31 +29 +26 +24 +22 +20 +19 +17 +16 +15 +13 +13 +11 +10 +9 +9 +8 +7 +7 +6 +9 +14 +13 +12 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-61 +17 +67 +95 +108 +111 +108 +103 +95 +88 +81 +75 +68 +63 +57 +53 +48 +44 +32 +21 +11 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-12 +39 +72 +93 +102 +103 +100 +95 +89 +90 +86 +79 +73 +68 +62 +58 +53 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-59 +20 +68 +95 +109 +113 +110 +105 +98 +91 +83 +77 +70 +65 +59 +55 +50 +47 +42 +31 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-62 +-11 +38 +71 +92 +110 +116 +112 +104 +96 +89 +83 +76 +70 +65 +60 +55 +51 +38 +27 +16 +7 +-2 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-60 +19 +69 +95 +108 +110 +108 +102 +95 +88 +81 +74 +68 +62 +58 +53 +49 +44 +32 +21 +11 +2 +-5 +-13 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-60 +16 +78 +109 +116 +116 +116 +110 +103 +96 +88 +82 +75 +70 +64 +59 +54 +50 +46 +42 +39 +36 +32 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +14 +19 +19 +18 +17 +15 +14 +13 +13 +11 +11 +9 +9 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-64 +-63 +11 +60 +86 +98 +102 +100 +95 +88 +82 +74 +69 +63 +58 +53 +49 +44 +41 +38 +41 +40 +37 +34 +31 +28 +27 +24 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +5 +4 +-4 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-63 +-63 +-29 +26 +76 +107 +113 +109 +104 +97 +90 +83 +77 +71 +66 +60 +56 +51 +47 +43 +40 +36 +33 +30 +28 +25 +23 +21 +20 +18 +16 +15 +14 +12 +12 +10 +12 +17 +17 +15 +14 +13 +12 +11 +11 +10 +9 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-28 +28 +66 +89 +100 +101 +99 +93 +87 +81 +75 +68 +63 +58 +54 +49 +46 +42 +39 +38 +41 +38 +35 +32 +30 +27 +26 +23 +22 +20 +18 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +5 +4 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-19 +30 +64 +98 +112 +109 +103 +97 +89 +83 +76 +71 +65 +60 +55 +51 +47 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-60 +17 +64 +91 +104 +109 +106 +101 +94 +87 +80 +74 +67 +63 +57 +53 +48 +45 +40 +28 +18 +8 +0 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-11 +49 +84 +107 +116 +116 +113 +107 +100 +92 +85 +79 +72 +67 +62 +57 +52 +49 +36 +25 +14 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-60 +17 +66 +92 +105 +108 +105 +99 +93 +85 +79 +72 +67 +61 +61 +61 +57 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-18 +42 +80 +104 +114 +116 +112 +106 +99 +92 +85 +79 +72 +67 +61 +57 +52 +48 +35 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-48 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-21 +35 +70 +93 +103 +105 +101 +96 +90 +84 +84 +82 +75 +69 +64 +60 +55 +41 +29 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-7 +46 +80 +102 +112 +111 +108 +102 +95 +88 +81 +75 +69 +63 +59 +54 +50 +46 +34 +22 +13 +3 +-4 +-12 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +16 +64 +89 +101 +104 +106 +108 +101 +93 +85 +79 +72 +67 +61 +57 +52 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-20 +38 +75 +98 +109 +110 +107 +101 +95 +88 +81 +74 +69 +63 +58 +53 +50 +46 +42 +38 +37 +40 +39 +35 +33 +30 +28 +26 +24 +22 +20 +18 +17 +16 +15 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +5 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-63 +-10 +36 +66 +86 +98 +107 +103 +97 +89 +82 +76 +71 +65 +60 +55 +51 +47 +43 +39 +36 +33 +30 +28 +25 +23 +21 +19 +18 +16 +15 +13 +12 +11 +11 +9 +9 +11 +16 +15 +14 +13 +12 +11 +11 +9 +9 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-62 +10 +58 +85 +99 +103 +101 +96 +90 +83 +77 +70 +65 +59 +55 +50 +46 +42 +38 +26 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-62 +-61 +-3 +44 +86 +115 +116 +114 +107 +101 +93 +86 +79 +74 +68 +63 +58 +54 +49 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-10 +42 +76 +97 +106 +107 +103 +97 +91 +84 +78 +71 +66 +61 +56 +52 +49 +51 +50 +46 +42 +39 +36 +33 +30 +28 +26 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +4 +4 +-5 +-11 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-50 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-62 +7 +69 +98 +110 +112 +109 +104 +98 +90 +84 +77 +71 +65 +60 +55 +51 +46 +43 +39 +36 +33 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +13 +14 +19 +18 +17 +15 +15 +13 +12 +11 +11 +10 +9 +8 +8 +-1 +-8 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-63 +10 +59 +85 +98 +101 +100 +94 +88 +81 +75 +68 +63 +57 +53 +48 +44 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-60 +29 +82 +108 +116 +116 +116 +112 +104 +97 +89 +82 +75 +69 +63 +58 +53 +49 +36 +25 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-60 +17 +67 +93 +106 +108 +106 +100 +93 +86 +80 +73 +67 +61 +57 +57 +57 +52 +48 +44 +41 +38 +35 +32 +30 +27 +25 +23 +21 +20 +18 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +5 +13 +4 +-4 +-11 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-61 +20 +69 +95 +107 +110 +108 +102 +95 +87 +81 +74 +68 +62 +57 +52 +48 +44 +40 +36 +34 +31 +28 +25 +23 +21 +20 +18 +17 +15 +14 +14 +20 +20 +18 +17 +16 +14 +14 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +5 +9 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-64 +-64 +-63 +-63 +12 +68 +96 +109 +113 +110 +105 +97 +91 +83 +76 +70 +65 +59 +54 +50 +46 +41 +38 +35 +32 +29 +27 +25 +23 +21 +19 +18 +16 +15 +14 +14 +19 +19 +18 +17 +16 +14 +13 +12 +12 +10 +10 +9 +8 +7 +8 +0 +-8 +-15 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-62 +12 +59 +84 +97 +100 +98 +92 +86 +79 +73 +66 +61 +56 +52 +47 +45 +47 +46 +42 +38 +35 +33 +30 +28 +26 +24 +21 +20 +18 +17 +16 +15 +13 +12 +11 +10 +9 +9 +8 +8 +6 +6 +5 +5 +4 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-62 +11 +70 +98 +109 +110 +108 +102 +96 +89 +82 +76 +70 +64 +60 +55 +51 +46 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-11 +40 +74 +95 +105 +105 +102 +96 +90 +83 +77 +71 +66 +60 +56 +57 +57 +52 +49 +44 +41 +38 +35 +32 +29 +27 +25 +23 +21 +19 +18 +16 +15 +14 +13 +11 +11 +10 +9 +8 +8 +7 +6 +6 +5 +4 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-21 +39 +75 +98 +108 +108 +106 +100 +94 +86 +80 +74 +68 +63 +58 +53 +49 +57 +44 +32 +21 +11 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-61 +10 +58 +85 +98 +101 +99 +94 +88 +81 +74 +68 +62 +58 +57 +58 +53 +49 +45 +42 +38 +36 +33 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +5 +5 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-26 +33 +71 +96 +107 +109 +106 +101 +94 +87 +80 +74 +68 +63 +58 +54 +49 +45 +33 +22 +12 +4 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-60 +14 +61 +87 +102 +105 +103 +98 +92 +85 +78 +72 +67 +64 +66 +61 +56 +52 +38 +26 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +2 +51 +84 +104 +113 +112 +108 +102 +95 +88 +81 +75 +69 +64 +59 +54 +50 +46 +34 +22 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-62 +-12 +38 +71 +92 +102 +102 +99 +95 +96 +92 +85 +78 +72 +67 +62 +57 +53 +49 +45 +41 +38 +35 +32 +29 +27 +24 +22 +20 +19 +17 +16 +14 +13 +12 +11 +10 +10 +8 +8 +9 +15 +14 +13 +12 +11 +10 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-40 +24 +65 +90 +103 +105 +103 +97 +91 +84 +78 +72 +67 +61 +56 +52 +48 +44 +32 +21 +11 +2 +-5 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-62 +-23 +32 +67 +90 +100 +103 +108 +106 +99 +91 +84 +78 +72 +67 +62 +56 +52 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +0 +48 +80 +101 +108 +108 +104 +99 +92 +85 +78 +73 +66 +62 +57 +52 +48 +45 +41 +38 +39 +41 +37 +34 +31 +29 +27 +25 +23 +21 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +6 +53 +79 +93 +106 +107 +100 +92 +85 +78 +73 +67 +62 +56 +52 +47 +35 +23 +14 +4 +-3 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-11 +41 +75 +97 +107 +107 +104 +98 +92 +85 +79 +72 +67 +62 +57 +52 +49 +44 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-39 +56 +102 +116 +116 +116 +112 +105 +97 +90 +82 +76 +70 +65 +59 +54 +50 +46 +41 +38 +35 +32 +29 +27 +25 +23 +20 +19 +17 +16 +15 +14 +13 +15 +19 +18 +17 +16 +14 +14 +13 +12 +11 +10 +9 +9 +0 +-8 +-15 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-64 +-63 +4 +57 +85 +99 +104 +102 +98 +91 +85 +77 +71 +65 +60 +55 +51 +46 +42 +30 +19 +9 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-3 +72 +104 +116 +116 +116 +112 +104 +97 +89 +82 +75 +69 +64 +59 +53 +49 +37 +25 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-60 +18 +67 +94 +107 +111 +108 +103 +96 +89 +82 +75 +69 +64 +59 +59 +59 +44 +31 +21 +11 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-58 +25 +77 +104 +116 +116 +116 +111 +105 +97 +89 +82 +75 +69 +64 +58 +54 +49 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-23 +34 +70 +92 +103 +105 +102 +97 +91 +84 +80 +81 +76 +70 +65 +60 +56 +51 +47 +43 +40 +36 +34 +30 +28 +25 +24 +22 +20 +18 +17 +16 +15 +13 +12 +11 +10 +9 +9 +8 +7 +7 +10 +14 +13 +12 +3 +-6 +-12 +-19 +-24 +-30 +-34 +-38 +-41 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-17 +36 +72 +94 +104 +106 +102 +97 +91 +84 +78 +71 +66 +60 +56 +51 +47 +43 +40 +36 +33 +30 +28 +25 +23 +21 +20 +22 +25 +23 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-63 +6 +55 +80 +94 +97 +96 +91 +85 +78 +72 +66 +66 +66 +61 +56 +51 +49 +36 +24 +15 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-58 +23 +71 +97 +110 +113 +110 +104 +97 +90 +82 +76 +69 +64 +58 +54 +49 +46 +41 +38 +35 +32 +29 +27 +24 +23 +24 +28 +26 +24 +22 +21 +19 +18 +17 +16 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-64 +-62 +9 +57 +83 +96 +100 +98 +93 +87 +81 +78 +78 +72 +66 +61 +56 +52 +47 +44 +40 +37 +34 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +14 +12 +11 +10 +10 +9 +8 +7 +7 +7 +12 +14 +13 +11 +3 +-5 +-12 +-19 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-60 +19 +68 +93 +107 +109 +107 +101 +95 +87 +80 +74 +68 +62 +57 +52 +48 +44 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-60 +13 +62 +88 +100 +105 +102 +97 +90 +88 +87 +81 +74 +69 +63 +58 +53 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-59 +23 +73 +99 +112 +116 +113 +107 +100 +93 +86 +78 +72 +66 +61 +56 +51 +47 +43 +39 +37 +33 +31 +30 +35 +32 +30 +28 +26 +24 +22 +21 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-37 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +9 +57 +82 +95 +99 +97 +96 +97 +90 +83 +76 +70 +65 +59 +55 +50 +37 +25 +16 +6 +-2 +-9 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-12 +42 +77 +98 +108 +109 +106 +100 +94 +87 +80 +74 +68 +63 +58 +53 +49 +45 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-59 +12 +58 +91 +116 +116 +114 +107 +99 +92 +84 +78 +72 +66 +61 +56 +51 +47 +43 +40 +36 +33 +30 +28 +25 +24 +21 +20 +18 +17 +15 +14 +13 +12 +11 +12 +17 +17 +16 +15 +13 +13 +12 +11 +10 +9 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-43 +21 +61 +86 +99 +102 +100 +95 +89 +82 +76 +70 +65 +59 +55 +50 +46 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-54 +38 +93 +116 +116 +116 +112 +105 +97 +90 +83 +77 +70 +65 +59 +55 +50 +59 +45 +33 +21 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +8 +59 +85 +98 +102 +101 +95 +89 +82 +76 +69 +64 +59 +54 +49 +49 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-58 +25 +76 +103 +116 +116 +116 +112 +104 +97 +89 +82 +75 +69 +64 +58 +53 +49 +36 +25 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +18 +67 +93 +105 +109 +107 +102 +94 +88 +81 +75 +76 +73 +67 +62 +57 +52 +48 +44 +41 +38 +34 +32 +29 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +9 +13 +13 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +14 +65 +93 +106 +111 +109 +103 +96 +89 +82 +75 +69 +64 +58 +53 +49 +45 +41 +38 +35 +32 +29 +27 +24 +22 +20 +19 +20 +24 +23 +21 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-32 +24 +60 +84 +95 +97 +95 +90 +85 +78 +73 +67 +64 +66 +62 +56 +52 +48 +44 +41 +38 +34 +32 +29 +27 +24 +22 +20 +19 +17 +16 +14 +14 +12 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +10 +13 +3 +-6 +-12 +-19 +-24 +-30 +-34 +-38 +-41 +-44 +-47 +-50 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-7 +42 +76 +97 +105 +106 +103 +97 +91 +84 +78 +71 +66 +61 +56 +51 +48 +44 +40 +36 +34 +31 +28 +25 +23 +21 +19 +18 +17 +19 +23 +21 +19 +18 +17 +15 +15 +13 +13 +11 +11 +10 +9 +8 +7 +6 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-63 +4 +52 +78 +93 +98 +96 +91 +86 +80 +74 +67 +62 +57 +58 +58 +53 +49 +45 +41 +38 +35 +32 +30 +27 +25 +23 +21 +19 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +5 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-28 +31 +69 +94 +105 +107 +105 +100 +93 +87 +80 +74 +68 +63 +58 +53 +49 +45 +41 +38 +34 +32 +29 +26 +24 +22 +20 +18 +17 +17 +21 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +7 +7 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-64 +-63 +5 +55 +81 +94 +99 +97 +92 +86 +80 +73 +68 +62 +57 +53 +55 +53 +49 +44 +41 +38 +35 +32 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +4 +4 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-61 +16 +67 +95 +108 +113 +110 +105 +98 +91 +83 +77 +70 +65 +59 +55 +50 +46 +42 +38 +35 +32 +29 +27 +25 +23 +20 +19 +18 +17 +15 +18 +21 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +-1 +-9 +-15 +-22 +-27 +-32 +-36 +-39 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +8 +58 +84 +98 +102 +100 +95 +89 +82 +76 +70 +64 +59 +54 +53 +54 +50 +47 +42 +39 +36 +34 +31 +29 +26 +24 +22 +21 +19 +17 +16 +15 +14 +13 +11 +11 +10 +9 +8 +8 +6 +6 +5 +5 +4 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +14 +67 +95 +109 +112 +111 +106 +99 +91 +84 +77 +71 +65 +60 +55 +50 +46 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-24 +32 +69 +92 +103 +105 +102 +97 +91 +85 +79 +72 +67 +64 +66 +61 +70 +54 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-60 +13 +65 +93 +107 +111 +109 +103 +97 +89 +82 +76 +70 +64 +59 +54 +49 +45 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-58 +21 +67 +92 +104 +106 +104 +99 +93 +86 +85 +83 +76 +70 +65 +59 +55 +41 +30 +19 +9 +0 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-21 +38 +75 +99 +110 +113 +109 +104 +97 +90 +83 +77 +71 +65 +60 +55 +51 +47 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-52 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-36 +27 +64 +89 +100 +108 +114 +108 +100 +93 +86 +80 +73 +68 +63 +58 +53 +49 +45 +41 +37 +34 +31 +29 +26 +24 +22 +20 +19 +18 +16 +15 +13 +13 +11 +11 +10 +13 +17 +16 +14 +13 +12 +12 +11 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +7 +58 +85 +100 +104 +102 +97 +91 +83 +77 +71 +65 +59 +55 +50 +46 +42 +39 +35 +32 +29 +27 +28 +32 +29 +27 +25 +23 +22 +20 +19 +18 +16 +15 +14 +13 +11 +11 +10 +9 +8 +7 +6 +6 +5 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +8 +55 +81 +94 +98 +97 +98 +97 +90 +82 +76 +70 +64 +59 +55 +50 +46 +42 +39 +35 +32 +30 +27 +25 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +14 +15 +14 +13 +12 +11 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +12 +62 +89 +103 +107 +105 +100 +93 +87 +79 +73 +67 +62 +56 +52 +47 +44 +39 +37 +33 +31 +28 +27 +30 +31 +28 +26 +24 +23 +21 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-63 +-32 +22 +58 +81 +93 +95 +93 +90 +92 +88 +81 +74 +69 +63 +59 +54 +63 +48 +36 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +10 +61 +88 +102 +105 +104 +99 +92 +85 +79 +72 +66 +60 +56 +51 +47 +43 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-57 +20 +65 +92 +115 +116 +116 +108 +100 +92 +85 +78 +72 +66 +61 +56 +52 +39 +27 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-23 +36 +72 +95 +106 +109 +105 +100 +94 +87 +80 +74 +68 +63 +58 +54 +49 +45 +32 +22 +12 +3 +-5 +-12 +-18 +-23 +-28 +-33 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-50 +34 +78 +103 +116 +116 +116 +110 +104 +96 +89 +82 +76 +70 +64 +59 +55 +50 +38 +26 +16 +6 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-36 +28 +67 +91 +104 +106 +104 +99 +93 +86 +80 +73 +68 +64 +66 +63 +58 +44 +31 +20 +11 +2 +-6 +-13 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-21 +40 +77 +102 +113 +115 +112 +106 +99 +92 +85 +79 +72 +67 +62 +57 +52 +48 +36 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-4 +43 +74 +94 +102 +103 +99 +94 +87 +86 +85 +79 +73 +68 +62 +58 +53 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +15 +65 +93 +107 +112 +110 +105 +98 +91 +84 +77 +71 +65 +60 +55 +51 +47 +42 +39 +36 +33 +30 +28 +29 +32 +30 +28 +25 +24 +22 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +3 +52 +78 +92 +96 +94 +89 +89 +88 +81 +74 +68 +63 +58 +54 +49 +45 +42 +38 +35 +32 +29 +27 +25 +22 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +13 +14 +13 +12 +11 +10 +2 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +4 +58 +87 +103 +107 +106 +101 +95 +87 +81 +74 +68 +62 +58 +53 +48 +44 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-15 +36 +69 +90 +100 +102 +104 +106 +99 +91 +84 +78 +72 +66 +62 +57 +52 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-23 +36 +72 +96 +107 +109 +106 +101 +94 +88 +81 +75 +69 +64 +58 +54 +50 +46 +42 +39 +38 +41 +38 +35 +32 +30 +28 +26 +24 +22 +20 +19 +17 +16 +15 +14 +12 +12 +10 +10 +8 +8 +7 +7 +6 +6 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +3 +51 +77 +90 +102 +106 +100 +93 +86 +79 +73 +67 +62 +57 +52 +48 +44 +40 +37 +33 +31 +28 +26 +23 +22 +20 +18 +17 +16 +14 +13 +12 +11 +10 +9 +9 +13 +16 +15 +13 +13 +12 +11 +10 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-31 +27 +63 +88 +99 +102 +99 +95 +88 +82 +76 +70 +65 +60 +55 +50 +46 +43 +30 +20 +10 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-6 +41 +72 +103 +116 +115 +109 +102 +94 +88 +81 +75 +69 +64 +59 +54 +50 +37 +25 +16 +6 +-2 +-9 +-16 +-22 +-26 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +13 +61 +89 +103 +108 +106 +101 +95 +88 +81 +75 +68 +63 +58 +54 +49 +45 +43 +46 +44 +40 +37 +34 +31 +29 +27 +25 +23 +21 +20 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +4 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-61 +15 +77 +106 +112 +110 +105 +98 +91 +84 +77 +71 +65 +60 +55 +50 +46 +42 +39 +35 +33 +30 +27 +25 +23 +21 +19 +17 +16 +15 +14 +13 +12 +11 +15 +18 +17 +15 +14 +13 +12 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +2 +8 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +8 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +8 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +8 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +-4 +-10 +-17 +-23 +-28 +-32 +-37 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-12 +72 +109 +117 +117 +111 +100 +89 +79 +71 +63 +58 +53 +49 +45 +42 +39 +43 +43 +40 +37 +34 +32 +30 +27 +25 +23 +21 +19 +18 +16 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-62 +11 +93 +117 +117 +117 +111 +99 +89 +80 +72 +66 +60 +55 +51 +47 +44 +41 +29 +19 +9 +1 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +18 +78 +110 +117 +117 +112 +103 +93 +84 +75 +68 +62 +57 +53 +49 +46 +50 +38 +27 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-55 +35 +92 +117 +117 +117 +117 +111 +101 +90 +82 +74 +68 +63 +58 +53 +50 +46 +43 +40 +37 +34 +32 +30 +28 +26 +24 +22 +20 +18 +17 +21 +23 +20 +19 +17 +16 +14 +13 +12 +12 +10 +10 +8 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-61 +20 +73 +103 +113 +111 +104 +95 +85 +77 +69 +63 +57 +53 +49 +51 +52 +48 +35 +24 +13 +5 +-4 +-11 +-17 +-22 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-55 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-13 +65 +108 +117 +117 +117 +113 +102 +92 +83 +75 +68 +63 +57 +53 +49 +46 +43 +40 +37 +35 +32 +30 +27 +26 +24 +22 +20 +19 +22 +25 +22 +21 +19 +17 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-18 +64 +101 +115 +114 +107 +97 +86 +77 +69 +62 +56 +51 +53 +53 +50 +46 +34 +22 +13 +3 +-4 +-11 +-18 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +8 +93 +117 +117 +117 +117 +113 +100 +89 +79 +72 +65 +60 +54 +51 +47 +44 +41 +43 +31 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-3 +77 +112 +117 +117 +109 +98 +87 +78 +75 +70 +64 +59 +55 +51 +48 +45 +32 +21 +11 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-56 +32 +87 +116 +117 +117 +115 +104 +95 +85 +77 +69 +64 +59 +54 +50 +47 +43 +40 +37 +35 +32 +30 +29 +34 +33 +31 +29 +26 +24 +23 +21 +19 +17 +16 +14 +13 +12 +11 +9 +9 +8 +7 +6 +6 +5 +5 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +1 +66 +99 +111 +111 +104 +96 +91 +85 +76 +70 +64 +60 +55 +52 +48 +45 +32 +21 +11 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +21 +83 +115 +117 +117 +116 +105 +95 +85 +77 +70 +64 +58 +54 +50 +46 +43 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-8 +75 +115 +117 +117 +117 +106 +94 +85 +76 +69 +63 +59 +54 +50 +47 +44 +40 +38 +35 +33 +30 +28 +26 +24 +22 +20 +18 +17 +15 +14 +13 +11 +10 +10 +14 +16 +14 +13 +12 +11 +11 +10 +9 +9 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-8 +77 +114 +117 +117 +113 +103 +91 +81 +72 +65 +59 +54 +49 +46 +43 +40 +37 +51 +37 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-48 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +47 +112 +117 +117 +117 +107 +96 +85 +76 +68 +62 +56 +52 +48 +45 +41 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-1 +83 +117 +117 +117 +117 +105 +94 +83 +74 +66 +61 +55 +51 +47 +47 +50 +48 +44 +41 +38 +36 +33 +31 +28 +27 +24 +22 +20 +19 +17 +16 +14 +13 +11 +10 +9 +9 +7 +7 +6 +5 +5 +5 +4 +4 +19 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-17 +76 +113 +117 +117 +113 +101 +90 +80 +71 +64 +58 +52 +49 +45 +41 +38 +36 +24 +15 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-61 +18 +77 +108 +117 +117 +110 +100 +90 +81 +73 +66 +61 +56 +55 +57 +54 +50 +37 +25 +15 +5 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +26 +88 +117 +117 +117 +117 +110 +99 +89 +80 +73 +67 +61 +56 +53 +49 +45 +42 +30 +20 +10 +1 +-6 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-56 +29 +81 +109 +117 +116 +108 +98 +89 +81 +79 +76 +69 +64 +59 +56 +52 +48 +35 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-3 +85 +117 +117 +117 +117 +109 +97 +86 +77 +69 +63 +57 +53 +49 +45 +42 +39 +37 +34 +32 +29 +27 +26 +30 +31 +28 +26 +24 +22 +21 +19 +17 +15 +14 +13 +12 +10 +10 +8 +8 +7 +6 +6 +5 +4 +4 +-4 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-15 +70 +106 +117 +116 +108 +98 +88 +83 +78 +70 +65 +59 +55 +51 +48 +45 +42 +38 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +15 +14 +13 +11 +10 +9 +8 +7 +7 +6 +8 +13 +13 +11 +11 +10 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +14 +75 +108 +117 +117 +112 +102 +92 +83 +75 +67 +62 +57 +52 +48 +45 +42 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-12 +62 +101 +116 +117 +109 +101 +96 +89 +80 +73 +67 +62 +58 +54 +50 +47 +43 +40 +37 +35 +32 +30 +27 +26 +23 +22 +20 +19 +17 +15 +14 +12 +11 +10 +9 +8 +7 +10 +14 +13 +12 +11 +10 +10 +9 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-3 +81 +117 +117 +117 +115 +104 +92 +82 +73 +66 +59 +54 +50 +46 +43 +40 +37 +35 +32 +30 +28 +26 +28 +31 +29 +27 +24 +22 +21 +19 +17 +16 +14 +13 +11 +11 +9 +9 +8 +7 +6 +6 +5 +5 +4 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +10 +68 +99 +111 +109 +102 +93 +88 +84 +77 +70 +65 +60 +56 +52 +48 +45 +33 +21 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +22 +82 +115 +117 +117 +116 +106 +95 +86 +77 +70 +64 +59 +54 +50 +46 +43 +40 +28 +18 +8 +0 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-56 +27 +81 +117 +117 +117 +114 +104 +94 +85 +77 +71 +66 +61 +56 +52 +49 +45 +42 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +16 +15 +13 +12 +11 +14 +17 +16 +14 +13 +12 +12 +11 +10 +9 +9 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-60 +22 +76 +106 +116 +114 +106 +97 +88 +79 +71 +65 +59 +54 +50 +46 +43 +40 +37 +25 +15 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +17 +95 +117 +117 +117 +117 +106 +96 +86 +78 +71 +65 +60 +56 +51 +48 +45 +42 +30 +19 +9 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +11 +78 +112 +117 +117 +114 +103 +93 +83 +75 +68 +62 +57 +52 +50 +54 +52 +48 +45 +42 +39 +37 +34 +32 +29 +27 +25 +23 +21 +19 +17 +16 +14 +13 +11 +10 +9 +9 +7 +7 +6 +6 +5 +5 +4 +4 +3 +-5 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-22 +80 +117 +117 +117 +117 +109 +97 +87 +77 +70 +63 +58 +53 +49 +45 +42 +39 +42 +29 +19 +9 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-3 +78 +113 +117 +117 +111 +99 +88 +78 +69 +62 +56 +52 +49 +52 +50 +47 +34 +23 +13 +4 +-4 +-11 +-18 +-23 +-28 +-32 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-55 +34 +89 +117 +117 +117 +117 +108 +98 +88 +80 +72 +66 +60 +56 +52 +49 +45 +42 +30 +19 +9 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-56 +29 +81 +109 +117 +116 +108 +98 +89 +80 +77 +75 +70 +64 +60 +55 +52 +48 +36 +24 +14 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-3 +86 +117 +117 +117 +117 +109 +98 +86 +77 +69 +63 +57 +53 +49 +46 +42 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-5 +79 +114 +117 +117 +115 +109 +99 +88 +80 +72 +66 +61 +57 +53 +49 +46 +61 +47 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-6 +76 +112 +117 +117 +109 +98 +87 +77 +68 +61 +55 +50 +46 +43 +40 +37 +34 +32 +31 +36 +35 +32 +30 +28 +26 +24 +22 +21 +19 +17 +15 +14 +13 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-7 +72 +107 +117 +117 +114 +101 +90 +81 +73 +66 +61 +56 +52 +48 +45 +42 +30 +19 +10 +1 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-62 +10 +78 +113 +117 +117 +115 +105 +94 +85 +76 +69 +62 +57 +53 +49 +45 +42 +39 +27 +16 +7 +-1 +-8 +-15 +-21 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-32 +74 +117 +117 +117 +117 +116 +104 +94 +84 +76 +69 +64 +58 +54 +50 +47 +43 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-3 +83 +117 +117 +117 +117 +107 +95 +85 +75 +68 +61 +56 +52 +52 +54 +51 +47 +44 +41 +38 +36 +34 +31 +29 +26 +25 +22 +21 +19 +17 +15 +14 +13 +12 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +-6 +-12 +-19 +-24 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +1 +86 +117 +117 +117 +117 +110 +98 +87 +77 +70 +63 +58 +53 +50 +46 +43 +39 +28 +18 +8 +0 +-8 +-14 +-20 +-26 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-1 +82 +117 +117 +117 +115 +104 +93 +83 +73 +67 +60 +59 +60 +57 +52 +49 +46 +43 +40 +37 +34 +32 +30 +28 +25 +23 +21 +20 +17 +16 +14 +13 +11 +11 +9 +9 +7 +7 +6 +5 +5 +5 +5 +10 +12 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-45 +-47 +-50 +-51 +-53 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-6 +83 +117 +117 +117 +117 +109 +97 +86 +77 +69 +63 +57 +53 +49 +45 +42 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-61 +18 +76 +108 +117 +117 +109 +100 +90 +81 +73 +70 +70 +66 +60 +56 +53 +49 +46 +43 +40 +37 +34 +32 +29 +27 +25 +23 +21 +19 +17 +16 +14 +13 +11 +11 +9 +9 +8 +7 +6 +6 +6 +11 +13 +12 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-14 +76 +115 +117 +117 +117 +105 +94 +84 +75 +67 +61 +55 +51 +47 +44 +40 +37 +52 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-11 +70 +104 +115 +112 +104 +93 +82 +73 +67 +66 +61 +56 +53 +48 +45 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-62 +-4 +85 +117 +117 +117 +117 +111 +99 +88 +78 +70 +64 +59 +53 +50 +46 +43 +40 +37 +34 +32 +29 +28 +28 +32 +31 +29 +26 +24 +22 +20 +18 +17 +15 +14 +12 +11 +10 +10 +8 +8 +7 +7 +6 +5 +5 +5 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-6 +74 +108 +117 +116 +107 +96 +88 +83 +76 +69 +63 +58 +54 +50 +47 +44 +41 +38 +35 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +12 +11 +10 +9 +8 +7 +7 +6 +10 +13 +12 +11 +11 +9 +9 +13 +4 +-5 +-11 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-9 +76 +112 +117 +117 +112 +100 +89 +79 +70 +63 +57 +52 +48 +44 +41 +38 +35 +24 +14 +5 +-3 +-11 +-16 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-62 +-10 +73 +110 +117 +117 +109 +101 +95 +86 +77 +70 +64 +59 +55 +51 +48 +45 +32 +21 +11 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +11 +80 +115 +117 +117 +117 +107 +96 +86 +78 +70 +64 +58 +54 +50 +47 +43 +40 +37 +35 +35 +39 +37 +34 +32 +30 +27 +25 +23 +21 +19 +18 +16 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +-4 +-11 +-17 +-24 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +11 +67 +99 +110 +113 +111 +101 +91 +82 +74 +68 +63 +58 +54 +50 +46 +43 +31 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-16 +59 +101 +117 +117 +116 +107 +96 +87 +78 +71 +64 +59 +54 +50 +46 +43 +40 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +9 +90 +117 +117 +117 +117 +114 +102 +93 +84 +76 +69 +64 +59 +55 +50 +47 +44 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-61 +-6 +75 +112 +117 +117 +115 +104 +93 +83 +74 +66 +60 +55 +51 +47 +50 +51 +47 +44 +41 +38 +36 +33 +31 +28 +27 +24 +23 +20 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +6 +6 +5 +4 +4 +4 +4 +3 +-5 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +-5 +86 +117 +117 +117 +117 +111 +99 +88 +79 +70 +64 +59 +54 +50 +46 +43 +40 +37 +35 +32 +30 +27 +26 +23 +22 +20 +18 +16 +15 +14 +14 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-5 +77 +113 +117 +117 +111 +100 +89 +79 +70 +63 +57 +52 +48 +45 +44 +48 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +9 +94 +117 +117 +117 +117 +114 +103 +91 +82 +73 +67 +61 +56 +52 +48 +45 +42 +38 +36 +33 +31 +28 +27 +25 +23 +21 +20 +18 +18 +22 +22 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-5 +76 +111 +117 +117 +110 +99 +88 +79 +70 +63 +57 +52 +49 +53 +51 +47 +44 +41 +38 +36 +33 +31 +28 +26 +24 +22 +20 +18 +17 +16 +14 +13 +11 +10 +9 +8 +7 +7 +6 +5 +5 +4 +4 +4 +7 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-5 +83 +117 +117 +117 +117 +110 +98 +87 +78 +70 +63 +58 +53 +50 +46 +43 +40 +37 +34 +32 +30 +28 +25 +23 +21 +20 +18 +17 +15 +16 +20 +19 +17 +16 +14 +13 +12 +12 +11 +10 +9 +8 +7 +7 +6 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +0 +68 +102 +115 +114 +108 +98 +88 +79 +71 +64 +59 +54 +50 +49 +52 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-14 +64 +106 +117 +117 +117 +113 +103 +93 +84 +75 +69 +63 +58 +54 +50 +46 +43 +40 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-57 +28 +81 +109 +117 +115 +107 +98 +88 +80 +72 +71 +70 +65 +59 +56 +52 +49 +45 +42 +39 +37 +34 +32 +29 +27 +25 +23 +21 +20 +17 +16 +15 +13 +12 +11 +9 +9 +8 +7 +6 +6 +7 +12 +12 +12 +11 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-8 +72 +112 +117 +117 +117 +107 +96 +86 +77 +69 +63 +58 +53 +49 +46 +43 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-62 +-4 +72 +109 +117 +117 +112 +103 +92 +86 +83 +76 +69 +65 +60 +56 +52 +49 +36 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +13 +82 +117 +117 +117 +117 +108 +98 +88 +79 +71 +65 +60 +55 +51 +48 +44 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-56 +26 +79 +107 +117 +117 +116 +105 +95 +86 +79 +72 +66 +61 +57 +53 +49 +46 +43 +39 +37 +34 +32 +29 +27 +25 +23 +21 +20 +18 +16 +14 +13 +12 +11 +9 +12 +16 +15 +14 +13 +12 +11 +10 +10 +9 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-16 +72 +111 +117 +117 +112 +101 +90 +80 +71 +64 +58 +53 +49 +45 +41 +39 +36 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-61 +17 +74 +113 +117 +117 +115 +105 +94 +85 +77 +71 +65 +61 +56 +52 +48 +45 +42 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +17 +15 +15 +13 +12 +11 +12 +16 +16 +14 +13 +12 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +6 +9 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +8 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +8 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +8 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +8 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +8 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +-6 +-12 +-19 +-24 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-63 +-21 +66 +105 +117 +117 +110 +100 +89 +79 +71 +64 +58 +53 +49 +52 +52 +48 +45 +42 +39 +36 +34 +31 +29 +26 +24 +22 +20 +18 +17 +15 +14 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +5 +5 +4 +6 +30 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-14 +73 +110 +117 +117 +112 +100 +89 +79 +71 +63 +57 +52 +48 +44 +41 +38 +36 +33 +31 +28 +27 +24 +22 +21 +19 +17 +16 +14 +13 +13 +18 +18 +16 +15 +14 +12 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +1 +67 +102 +115 +115 +107 +98 +88 +79 +71 +64 +58 +54 +50 +48 +51 +50 +36 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +25 +87 +117 +117 +117 +117 +111 +100 +90 +81 +74 +68 +62 +57 +53 +49 +46 +43 +39 +37 +34 +32 +29 +27 +25 +23 +21 +20 +19 +24 +23 +21 +19 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +11 +70 +103 +114 +113 +105 +96 +86 +78 +70 +63 +57 +54 +57 +55 +51 +48 +35 +23 +13 +5 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-5 +85 +117 +117 +117 +117 +112 +99 +89 +79 +71 +64 +59 +54 +50 +47 +43 +40 +38 +35 +32 +30 +28 +26 +24 +22 +20 +19 +23 +24 +22 +20 +18 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +-3 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +1 +67 +101 +114 +113 +106 +97 +87 +78 +70 +63 +58 +60 +59 +54 +51 +47 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-40 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-15 +63 +105 +117 +117 +117 +111 +101 +91 +82 +74 +67 +61 +57 +52 +49 +45 +42 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-56 +28 +80 +109 +117 +115 +107 +98 +90 +87 +80 +74 +68 +63 +58 +55 +51 +48 +35 +24 +13 +5 +-4 +-10 +-17 +-22 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-55 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +25 +85 +117 +117 +117 +116 +106 +96 +86 +78 +70 +64 +59 +54 +50 +47 +43 +41 +38 +35 +33 +33 +37 +35 +32 +30 +28 +26 +24 +22 +20 +18 +16 +15 +14 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +-4 +-11 +-17 +-24 +-28 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-11 +64 +101 +113 +113 +108 +104 +94 +85 +76 +69 +64 +59 +55 +51 +47 +44 +32 +21 +11 +3 +-5 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +11 +80 +114 +117 +117 +117 +106 +96 +86 +77 +70 +64 +58 +54 +50 +46 +43 +40 +27 +17 +8 +0 +-8 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-46 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-36 +66 +117 +117 +117 +117 +114 +103 +93 +84 +77 +70 +65 +60 +56 +52 +48 +44 +42 +38 +36 +33 +31 +28 +27 +24 +23 +20 +19 +17 +16 +14 +13 +13 +18 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +-1 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-16 +71 +109 +117 +117 +110 +100 +88 +79 +70 +63 +57 +52 +47 +44 +41 +38 +35 +24 +13 +5 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +0 +85 +117 +117 +117 +117 +113 +102 +92 +83 +76 +69 +63 +59 +54 +51 +47 +44 +32 +21 +11 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-8 +68 +106 +117 +117 +114 +104 +93 +84 +75 +68 +61 +56 +52 +49 +50 +51 +48 +45 +41 +39 +36 +34 +31 +29 +27 +25 +23 +21 +20 +18 +16 +15 +13 +12 +10 +10 +8 +8 +6 +6 +5 +5 +4 +4 +4 +5 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-1 +88 +117 +117 +117 +117 +110 +98 +87 +77 +70 +63 +58 +53 +49 +45 +43 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-7 +78 +114 +117 +117 +114 +102 +91 +81 +72 +65 +59 +53 +50 +51 +53 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +10 +95 +117 +117 +117 +117 +114 +101 +90 +80 +73 +66 +60 +55 +51 +47 +44 +41 +30 +19 +9 +1 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +2 +83 +117 +117 +117 +115 +103 +92 +82 +75 +74 +69 +64 +58 +55 +51 +48 +35 +24 +13 +5 +-4 +-10 +-17 +-22 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +14 +83 +117 +117 +117 +117 +109 +98 +88 +79 +71 +66 +60 +55 +51 +48 +44 +41 +38 +36 +33 +31 +28 +29 +33 +32 +29 +27 +24 +23 +21 +19 +17 +16 +14 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +11 +69 +101 +111 +110 +102 +93 +85 +83 +77 +70 +64 +60 +55 +52 +48 +45 +42 +39 +36 +34 +31 +29 +26 +25 +22 +21 +19 +17 +16 +14 +13 +12 +10 +9 +8 +8 +7 +6 +10 +14 +12 +12 +11 +10 +9 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-15 +75 +113 +117 +117 +115 +103 +92 +82 +73 +65 +59 +54 +50 +46 +43 +40 +37 +51 +38 +26 +16 +7 +-1 +-9 +-15 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-10 +69 +103 +114 +111 +102 +93 +88 +79 +71 +65 +59 +54 +51 +47 +44 +41 +38 +35 +33 +30 +28 +26 +24 +22 +21 +19 +17 +15 +14 +12 +11 +10 +9 +8 +7 +6 +6 +10 +13 +12 +11 +10 +10 +9 +9 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-3 +81 +117 +117 +117 +116 +104 +93 +82 +74 +66 +60 +54 +50 +46 +43 +40 +37 +34 +32 +30 +28 +26 +29 +31 +29 +26 +24 +22 +21 +19 +17 +15 +14 +13 +12 +10 +10 +8 +8 +7 +7 +6 +5 +5 +5 +4 +8 +-1 +-8 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-12 +68 +103 +113 +111 +102 +93 +85 +80 +72 +65 +60 +55 +51 +48 +44 +42 +29 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-7 +81 +117 +117 +117 +117 +106 +94 +84 +75 +67 +61 +56 +52 +48 +44 +41 +38 +27 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +0 +80 +116 +117 +117 +117 +108 +96 +86 +77 +71 +65 +60 +55 +51 +47 +44 +41 +39 +36 +33 +31 +29 +26 +24 +22 +21 +19 +17 +15 +14 +13 +12 +10 +10 +13 +16 +14 +14 +13 +12 +11 +10 +9 +9 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-7 +78 +115 +117 +117 +114 +103 +91 +82 +72 +65 +59 +54 +50 +46 +42 +40 +37 +25 +15 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-57 +43 +110 +117 +117 +117 +114 +104 +93 +85 +77 +71 +65 +60 +55 +52 +48 +45 +32 +21 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-14 +59 +101 +117 +117 +115 +106 +95 +86 +77 +70 +63 +58 +53 +50 +46 +45 +49 +47 +43 +41 +38 +35 +33 +31 +28 +26 +24 +22 +21 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +7 +5 +5 +4 +4 +4 +3 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +-16 +77 +117 +117 +117 +117 +110 +100 +89 +80 +72 +66 +60 +55 +51 +48 +44 +41 +29 +19 +9 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-17 +57 +98 +116 +117 +113 +104 +93 +84 +76 +69 +62 +57 +53 +51 +54 +52 +48 +35 +23 +14 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-40 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-2 +88 +117 +117 +117 +117 +112 +100 +88 +79 +71 +64 +58 +54 +50 +47 +43 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +1 +84 +117 +117 +117 +115 +103 +92 +82 +73 +71 +69 +63 +59 +55 +51 +48 +35 +24 +14 +4 +-3 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +0 +88 +117 +117 +117 +117 +112 +100 +89 +79 +71 +64 +59 +54 +51 +47 +43 +40 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +20 +76 +108 +117 +116 +111 +107 +97 +88 +79 +73 +67 +63 +58 +54 +50 +47 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-55 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-4 +83 +117 +117 +117 +117 +107 +95 +85 +75 +68 +61 +56 +51 +48 +44 +41 +38 +36 +33 +34 +38 +36 +33 +31 +28 +27 +24 +23 +21 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +-5 +-11 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +1 +66 +99 +111 +115 +113 +102 +92 +83 +75 +68 +63 +58 +54 +50 +47 +43 +32 +20 +11 +2 +-6 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-16 +60 +100 +117 +117 +116 +106 +96 +86 +78 +70 +64 +58 +54 +50 +46 +43 +40 +37 +25 +15 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +21 +93 +117 +117 +117 +117 +111 +101 +91 +83 +75 +69 +63 +58 +54 +50 +47 +44 +32 +21 +11 +3 +-6 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +22 +81 +112 +117 +117 +112 +102 +92 +82 +74 +67 +61 +56 +53 +56 +55 +51 +48 +45 +42 +39 +36 +34 +32 +29 +27 +25 +23 +20 +19 +17 +16 +14 +13 +11 +10 +9 +9 +7 +7 +6 +6 +5 +5 +4 +7 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +-6 +76 +115 +117 +117 +117 +109 +99 +88 +79 +71 +65 +59 +55 +50 +47 +43 +41 +29 +18 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +9 +76 +110 +117 +117 +112 +102 +92 +82 +74 +67 +62 +63 +62 +57 +54 +50 +47 +43 +41 +37 +35 +32 +30 +27 +26 +23 +21 +20 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +7 +12 +12 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +6 +77 +113 +117 +117 +117 +106 +96 +86 +78 +70 +64 +58 +54 +50 +46 +43 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-8 +76 +112 +117 +117 +112 +101 +90 +80 +71 +65 +65 +63 +58 +54 +50 +47 +44 +41 +38 +36 +33 +31 +28 +26 +24 +22 +20 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +7 +12 +12 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-11 +79 +117 +117 +117 +117 +109 +97 +86 +77 +69 +63 +57 +53 +49 +45 +42 +39 +30 +19 +9 +1 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-62 +2 +81 +115 +117 +117 +113 +102 +90 +81 +76 +74 +67 +62 +57 +54 +50 +47 +34 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +24 +86 +117 +117 +117 +117 +107 +97 +86 +78 +71 +65 +59 +55 +51 +47 +44 +41 +38 +35 +33 +31 +29 +31 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +12 +11 +9 +9 +8 +7 +6 +6 +5 +5 +4 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-18 +62 +99 +113 +112 +105 +95 +85 +79 +76 +69 +63 +58 +54 +50 +47 +44 +41 +38 +35 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +6 +6 +6 +11 +13 +11 +11 +10 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-12 +77 +116 +117 +117 +117 +106 +95 +84 +75 +68 +62 +56 +52 +48 +44 +41 +38 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +8 +73 +106 +117 +117 +109 +103 +98 +88 +80 +73 +68 +63 +58 +54 +51 +47 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-56 +31 +86 +116 +117 +117 +114 +104 +94 +85 +76 +70 +63 +58 +53 +50 +46 +43 +40 +38 +35 +37 +39 +37 +34 +32 +30 +28 +25 +23 +21 +20 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-17 +66 +102 +114 +112 +107 +101 +90 +81 +73 +66 +61 +56 +52 +48 +45 +42 +30 +19 +9 +1 +-7 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +20 +80 +113 +117 +117 +114 +103 +94 +84 +76 +69 +63 +58 +53 +49 +46 +43 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +21 +99 +117 +117 +117 +117 +106 +95 +85 +77 +71 +64 +60 +55 +51 +47 +44 +32 +21 +11 +3 +-5 +-12 +-18 +-23 +-29 +-33 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +7 +89 +117 +117 +117 +117 +106 +95 +84 +75 +67 +61 +56 +52 +47 +45 +48 +48 +44 +42 +39 +36 +34 +32 +29 +27 +25 +23 +21 +19 +17 +16 +14 +13 +12 +11 +9 +9 +8 +7 +6 +5 +5 +5 +4 +4 +8 +6 +-2 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-19 +82 +117 +117 +117 +117 +106 +95 +84 +75 +67 +61 +55 +51 +47 +44 +40 +38 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +16 +15 +13 +12 +13 +18 +17 +15 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +13 +72 +105 +115 +114 +106 +97 +87 +78 +70 +64 +58 +53 +49 +46 +42 +42 +36 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-56 +36 +92 +117 +117 +117 +117 +110 +100 +90 +81 +74 +68 +62 +57 +53 +50 +46 +43 +40 +37 +34 +32 +30 +28 +25 +24 +22 +20 +18 +17 +17 +22 +21 +19 +17 +16 +14 +13 +12 +12 +10 +9 +8 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-61 +21 +74 +104 +113 +111 +104 +95 +85 +77 +69 +63 +57 +53 +49 +48 +51 +49 +45 +42 +39 +37 +34 +32 +29 +27 +25 +23 +21 +19 +17 +16 +14 +13 +12 +11 +9 +9 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +-6 +-13 +-19 +-24 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-18 +80 +117 +117 +117 +117 +108 +97 +86 +77 +69 +63 +57 +53 +49 +45 +42 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +16 +15 +13 +12 +16 +18 +16 +15 +14 +13 +12 +11 +10 +10 +9 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-15 +72 +110 +117 +117 +112 +101 +90 +80 +71 +64 +58 +53 +49 +45 +43 +46 +38 +26 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +8 +94 +117 +117 +117 +117 +114 +102 +90 +81 +73 +66 +60 +56 +51 +48 +45 +42 +30 +19 +9 +1 +-7 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +20 +79 +110 +117 +117 +111 +101 +91 +81 +74 +66 +64 +65 +61 +57 +53 +50 +47 +43 +41 +37 +35 +32 +30 +28 +25 +23 +21 +19 +18 +16 +15 +13 +12 +11 +10 +8 +8 +7 +6 +6 +5 +5 +10 +13 +12 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-62 +-63 +-63 +-63 +-63 +-63 +-13 +72 +112 +117 +117 +117 +106 +95 +85 +76 +68 +62 +57 +52 +48 +45 +42 +38 +27 +16 +7 +-1 +-8 +-15 +-21 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-61 +19 +76 +109 +117 +117 +109 +100 +90 +81 +73 +68 +69 +66 +61 +57 +52 +49 +36 +25 +15 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-55 +34 +90 +117 +117 +117 +117 +106 +97 +87 +78 +71 +65 +60 +55 +51 +48 +44 +41 +29 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-6 +77 +113 +117 +117 +111 +101 +93 +87 +79 +72 +65 +60 +56 +52 +48 +45 +42 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +16 +15 +13 +12 +11 +10 +8 +8 +7 +7 +12 +13 +12 +12 +10 +10 +9 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-11 +77 +116 +117 +117 +116 +106 +94 +84 +74 +67 +61 +55 +51 +48 +44 +41 +37 +40 +28 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-61 +-62 +-3 +76 +110 +117 +116 +110 +103 +92 +82 +74 +67 +61 +57 +53 +49 +45 +43 +39 +37 +34 +32 +29 +27 +25 +23 +21 +20 +18 +17 +15 +13 +12 +11 +9 +9 +8 +8 +12 +14 +13 +12 +11 +10 +9 +9 +8 +8 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +1 +3 +8 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +4 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +4 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +8 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +6 +8 +8 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-7 +80 +117 +117 +117 +117 +107 +96 +85 +76 +68 +62 +57 +53 +48 +45 +42 +39 +36 +34 +31 +29 +26 +24 +22 +21 +19 +18 +22 +23 +21 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +-3 +-10 +-16 +-23 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-16 +69 +108 +117 +117 +109 +100 +89 +79 +70 +64 +58 +59 +58 +54 +50 +47 +43 +41 +38 +35 +33 +30 +28 +26 +23 +21 +19 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +6 +12 +12 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-2 +84 +117 +117 +117 +117 +108 +97 +86 +76 +69 +62 +57 +52 +49 +45 +42 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-1 +81 +116 +117 +117 +114 +104 +92 +82 +73 +71 +69 +64 +59 +55 +51 +48 +45 +42 +39 +36 +33 +31 +29 +27 +24 +22 +20 +19 +17 +15 +14 +13 +11 +10 +9 +8 +7 +7 +6 +5 +6 +12 +12 +12 +11 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-6 +81 +117 +117 +117 +117 +107 +96 +85 +76 +68 +62 +57 +52 +48 +44 +41 +38 +27 +16 +7 +-1 +-8 +-15 +-21 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-61 +-61 +18 +75 +107 +117 +116 +108 +99 +89 +84 +81 +75 +69 +64 +59 +55 +52 +48 +45 +42 +39 +36 +33 +31 +28 +26 +24 +22 +20 +18 +17 +16 +14 +12 +11 +10 +9 +8 +7 +7 +7 +12 +13 +12 +11 +11 +10 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-14 +75 +114 +117 +117 +115 +104 +93 +82 +73 +66 +60 +54 +50 +46 +43 +40 +37 +52 +39 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-10 +70 +104 +114 +111 +103 +92 +84 +79 +72 +65 +60 +55 +51 +47 +44 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-62 +-3 +85 +117 +117 +117 +117 +109 +97 +87 +77 +69 +63 +58 +53 +49 +45 +42 +39 +28 +17 +8 +-1 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +2 +84 +117 +117 +117 +117 +107 +96 +86 +77 +71 +65 +60 +55 +51 +48 +44 +41 +38 +36 +33 +31 +29 +26 +25 +22 +21 +19 +17 +15 +14 +13 +12 +10 +12 +16 +16 +14 +13 +12 +12 +11 +10 +9 +9 +7 +-1 +-9 +-15 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-3 +80 +116 +117 +117 +113 +102 +90 +81 +72 +65 +58 +53 +49 +45 +42 +39 +36 +25 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +-50 +73 +117 +117 +117 +117 +117 +105 +93 +84 +75 +69 +63 +58 +53 +50 +46 +43 +31 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-4 +83 +117 +117 +117 +117 +107 +95 +84 +76 +68 +62 +56 +52 +48 +49 +52 +48 +45 +42 +39 +37 +34 +32 +29 +27 +24 +23 +21 +19 +17 +16 +14 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +2 +79 +115 +117 +117 +117 +108 +98 +88 +79 +72 +66 +60 +55 +51 +48 +44 +41 +29 +19 +9 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-8 +78 +115 +117 +117 +114 +103 +91 +82 +72 +65 +59 +54 +50 +50 +52 +50 +51 +38 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +3 +88 +117 +117 +117 +117 +109 +97 +85 +77 +68 +62 +57 +52 +48 +45 +42 +39 +36 +34 +31 +29 +26 +25 +23 +21 +19 +18 +19 +23 +22 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-17 +64 +101 +116 +115 +107 +96 +87 +77 +69 +61 +56 +51 +49 +53 +50 +46 +33 +22 +12 +3 +-4 +-12 +-18 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +14 +84 +117 +117 +117 +117 +112 +100 +90 +81 +74 +66 +61 +56 +52 +48 +45 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-33 +-37 +-41 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-61 +10 +75 +110 +117 +117 +111 +102 +91 +82 +78 +76 +70 +65 +60 +56 +52 +49 +36 +25 +14 +5 +-3 +-10 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +-60 +25 +86 +117 +117 +117 +117 +107 +97 +87 +79 +71 +65 +60 +55 +51 +48 +44 +41 +29 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-7 +77 +112 +117 +117 +112 +106 +96 +86 +77 +71 +65 +60 +56 +52 +48 +45 +41 +39 +36 +33 +31 +29 +27 +25 +22 +21 +19 +18 +16 +14 +13 +12 +10 +10 +8 +8 +10 +15 +13 +13 +11 +11 +10 +10 +9 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-6 +79 +117 +117 +117 +115 +104 +93 +82 +73 +66 +59 +54 +50 +47 +43 +40 +37 +35 +32 +30 +28 +29 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +11 +11 +9 +9 +7 +7 +6 +6 +5 +5 +4 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +0 +66 +99 +111 +110 +104 +96 +93 +84 +77 +70 +64 +59 +55 +51 +48 +44 +32 +21 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-16 +61 +102 +117 +117 +117 +107 +98 +88 +79 +71 +65 +60 +55 +50 +47 +44 +41 +38 +35 +33 +32 +37 +36 +33 +31 +28 +26 +24 +23 +21 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +7 +6 +5 +5 +5 +4 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +1 +66 +99 +111 +112 +111 +102 +92 +83 +75 +68 +63 +58 +54 +50 +47 +43 +40 +37 +35 +32 +30 +28 +26 +23 +22 +20 +18 +16 +15 +13 +12 +10 +10 +9 +8 +10 +15 +14 +13 +12 +11 +10 +10 +9 +9 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-18 +60 +101 +117 +117 +111 +102 +92 +82 +73 +67 +60 +55 +51 +47 +43 +40 +37 +26 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +9 +73 +106 +117 +117 +117 +107 +96 +87 +78 +72 +66 +61 +56 +53 +49 +45 +33 +22 +12 +4 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-51 +-53 +-55 +-55 +-57 +-58 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +22 +83 +115 +117 +117 +114 +104 +94 +84 +76 +69 +63 +58 +54 +49 +46 +43 +41 +44 +44 +41 +38 +35 +33 +31 +29 +26 +24 +22 +20 +18 +17 +15 +14 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +5 +4 +3 +-4 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +18 +90 +117 +117 +117 +109 +99 +89 +81 +73 +67 +61 +57 +52 +49 +45 +42 +30 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-7 +80 +117 +117 +117 +116 +105 +93 +83 +74 +66 +60 +55 +51 +47 +43 +41 +66 +51 +37 +26 +15 +6 +-2 +-9 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-2 +84 +117 +117 +117 +117 +106 +94 +83 +74 +66 +60 +54 +51 +47 +43 +40 +37 +34 +32 +30 +28 +26 +24 +22 +21 +19 +17 +16 +15 +13 +16 +19 +17 +16 +15 +13 +12 +11 +11 +9 +9 +8 +7 +6 +6 +5 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-64 +-4 +77 +113 +117 +117 +110 +100 +88 +78 +69 +63 +57 +52 +47 +44 +45 +48 +63 +48 +35 +24 +14 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-4 +82 +117 +117 +117 +116 +104 +92 +82 +73 +65 +59 +54 +50 +46 +42 +39 +37 +25 +15 +6 +-2 +-9 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-61 +19 +77 +108 +117 +116 +109 +99 +90 +80 +73 +66 +66 +65 +60 +56 +52 +49 +36 +24 +14 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +27 +88 +117 +117 +117 +117 +109 +98 +88 +79 +72 +65 +61 +56 +52 +48 +45 +41 +30 +19 +9 +1 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-56 +29 +80 +109 +117 +115 +106 +99 +95 +88 +80 +74 +67 +63 +58 +54 +50 +47 +34 +23 +13 +5 +-4 +-11 +-17 +-22 +-28 +-32 +-36 +-39 +-43 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-3 +85 +117 +117 +117 +117 +108 +95 +85 +76 +68 +61 +56 +52 +48 +44 +42 +38 +36 +33 +31 +30 +34 +34 +32 +29 +27 +25 +23 +21 +20 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-14 +70 +105 +117 +115 +108 +101 +94 +83 +75 +68 +63 +58 +54 +50 +47 +43 +40 +37 +35 +32 +30 +28 +26 +24 +22 +20 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +8 +13 +14 +12 +12 +10 +10 +9 +9 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +14 +74 +107 +117 +117 +111 +101 +91 +82 +74 +67 +61 +56 +52 +47 +44 +41 +38 +26 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-11 +62 +101 +116 +116 +113 +108 +97 +87 +79 +72 +66 +61 +57 +53 +49 +46 +33 +22 +12 +4 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-55 +-57 +-58 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +8 +90 +117 +117 +117 +117 +108 +96 +85 +76 +68 +62 +57 +53 +48 +45 +42 +39 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-40 +82 +117 +117 +117 +117 +117 +105 +94 +84 +76 +69 +63 +58 +54 +50 +46 +43 +31 +20 +11 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +7 +88 +117 +117 +117 +117 +106 +94 +83 +74 +67 +61 +56 +51 +48 +50 +51 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +12 +97 +117 +117 +117 +117 +114 +102 +91 +81 +73 +66 +60 +56 +51 +48 +45 +42 +29 +19 +9 +1 +-7 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-4 +82 +117 +117 +117 +116 +104 +93 +83 +74 +67 +68 +65 +60 +55 +52 +48 +64 +49 +37 +25 +15 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-3 +81 +116 +117 +117 +113 +101 +90 +80 +70 +63 +57 +52 +48 +45 +41 +38 +35 +24 +14 +5 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-62 +4 +83 +116 +117 +117 +112 +103 +96 +87 +78 +71 +65 +60 +56 +52 +48 +45 +60 +46 +33 +22 +12 +4 +-5 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-5 +78 +113 +117 +117 +110 +98 +87 +77 +69 +61 +55 +50 +46 +43 +40 +37 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +23 +105 +117 +117 +117 +117 +106 +95 +84 +76 +69 +64 +58 +54 +50 +47 +43 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +3 +86 +117 +117 +117 +117 +107 +95 +84 +75 +68 +61 +56 +51 +48 +44 +46 +37 +26 +15 +6 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +8 +96 +117 +117 +117 +117 +116 +104 +92 +83 +74 +67 +61 +57 +52 +49 +45 +42 +30 +20 +10 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-62 +-4 +82 +117 +117 +117 +117 +105 +94 +83 +74 +67 +61 +61 +61 +56 +53 +49 +36 +25 +15 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-56 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +26 +87 +117 +117 +117 +117 +109 +98 +89 +80 +72 +66 +61 +56 +52 +48 +45 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-61 +-61 +-6 +78 +113 +117 +117 +112 +101 +90 +81 +78 +73 +67 +61 +57 +53 +50 +46 +61 +47 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-4 +79 +115 +117 +117 +111 +100 +88 +78 +69 +62 +56 +51 +47 +44 +40 +37 +35 +23 +13 +5 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-61 +1 +81 +115 +117 +117 +117 +107 +95 +86 +77 +70 +64 +60 +55 +51 +48 +44 +41 +38 +35 +33 +30 +29 +26 +24 +22 +21 +19 +18 +16 +15 +13 +12 +11 +10 +9 +13 +15 +14 +13 +12 +11 +10 +9 +9 +8 +24 +14 +5 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-13 +69 +105 +116 +114 +105 +94 +83 +74 +65 +58 +52 +48 +43 +40 +37 +35 +32 +21 +11 +3 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +-61 +17 +79 +117 +117 +117 +114 +103 +93 +84 +77 +70 +64 +60 +55 +51 +48 +45 +32 +22 +11 +3 +-5 +-12 +-18 +-23 +-29 +-33 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-62 +-61 +23 +82 +114 +117 +117 +113 +103 +93 +84 +75 +68 +63 +57 +53 +49 +46 +43 +39 +26 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-57 +39 +95 +117 +117 +117 +117 +112 +100 +91 +82 +75 +68 +63 +58 +54 +50 +46 +43 +32 +21 +11 +2 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-62 +-5 +81 +116 +117 +117 +115 +103 +92 +81 +73 +65 +59 +54 +52 +55 +52 +48 +35 +24 +14 +5 +-3 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-60 +27 +87 +117 +117 +117 +117 +110 +99 +89 +80 +73 +66 +61 +56 +53 +49 +46 +42 +30 +19 +10 +1 +-6 +-13 +-19 +-25 +-29 +-33 +-37 +-41 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-60 +-61 +-61 +-62 +-61 +-14 +59 +98 +116 +117 +112 +102 +93 +83 +75 +72 +71 +65 +61 +56 +53 +49 +46 +33 +22 +12 +4 +-5 +-11 +-18 +-23 +-28 +-32 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-60 +26 +86 +117 +117 +117 +117 +106 +96 +86 +78 +70 +64 +59 +54 +50 +47 +43 +41 +29 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-5 +73 +109 +117 +117 +111 +106 +97 +87 +78 +71 +65 +61 +56 +52 +48 +45 +33 +22 +12 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-37 +-40 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-61 +13 +82 +116 +117 +117 +117 +106 +96 +86 +77 +70 +64 +58 +54 +50 +46 +43 +40 +28 +18 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +-59 +41 +112 +117 +117 +117 +117 +105 +95 +86 +78 +71 +66 +60 +56 +52 +49 +45 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-53 +-54 +-56 +-57 +-58 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-61 +-61 +-61 +23 +82 +114 +117 +117 +113 +103 +92 +83 +75 +68 +62 +57 +53 +49 +46 +50 +38 +27 +16 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-60 +-60 +-61 +-61 +-61 +1 +90 +117 +117 +117 +117 +115 +102 +91 +81 +73 +66 +60 +55 +51 +47 +44 +41 +39 +36 +33 +31 +29 +26 +24 +22 +21 +19 +18 +16 +15 +19 +21 +19 +17 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-63 +-8 +76 +112 +117 +117 +111 +100 +89 +79 +71 +63 +57 +52 +48 +45 +47 +48 +45 +42 +39 +36 +34 +32 +29 +27 +25 +23 +21 +19 +17 +16 +14 +13 +12 +10 +10 +8 +8 +7 +6 +5 +5 +4 +4 +4 +4 +2 +-5 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-62 +-63 +-63 +-63 +-63 +-63 +-62 +3 +79 +115 +117 +117 +117 +108 +98 +88 +79 +72 +66 +60 +55 +51 +48 +44 +41 +38 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +15 +14 +13 +18 +19 +17 +16 +14 +13 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +4 +9 +9 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +6 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-2 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +19 +10 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-43 +-46 +-48 +-51 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-65 +-65 +-33 +49 +87 +101 +102 +96 +87 +79 +70 +62 +56 +56 +55 +51 +47 +44 +41 +38 +35 +33 +30 +19 +9 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-49 +37 +80 +97 +99 +93 +85 +75 +67 +59 +53 +47 +43 +39 +36 +33 +30 +28 +26 +24 +22 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-62 +-53 +31 +71 +87 +89 +84 +76 +67 +59 +52 +46 +41 +37 +33 +31 +28 +26 +24 +25 +29 +28 +16 +7 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-52 +27 +66 +81 +84 +79 +76 +70 +62 +55 +49 +45 +41 +37 +35 +32 +30 +27 +26 +23 +22 +20 +19 +16 +15 +14 +12 +11 +10 +8 +8 +6 +6 +5 +4 +3 +3 +5 +10 +10 +9 +8 +8 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +-4 +-11 +-18 +-23 +-29 +-33 +-38 +-41 +-44 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-27 +64 +106 +116 +116 +116 +106 +96 +85 +77 +69 +63 +57 +53 +49 +45 +42 +39 +35 +33 +30 +28 +25 +23 +21 +23 +26 +24 +22 +20 +19 +17 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +-4 +-11 +-17 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-36 +53 +96 +112 +114 +108 +99 +89 +80 +75 +74 +68 +63 +58 +54 +50 +47 +33 +22 +12 +4 +-5 +-12 +-18 +-23 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-26 +69 +111 +116 +116 +116 +112 +102 +91 +82 +73 +67 +61 +56 +52 +48 +44 +41 +29 +19 +9 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-27 +60 +101 +116 +116 +116 +113 +102 +92 +83 +75 +69 +64 +60 +55 +51 +47 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-17 +72 +111 +116 +116 +116 +107 +96 +86 +77 +69 +63 +57 +52 +48 +45 +42 +39 +36 +24 +14 +5 +-4 +-11 +-17 +-23 +-28 +-32 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-11 +75 +116 +116 +116 +116 +110 +101 +91 +83 +75 +69 +63 +59 +54 +50 +47 +64 +50 +37 +25 +15 +5 +-3 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-19 +64 +101 +115 +114 +106 +96 +86 +76 +68 +61 +55 +50 +46 +42 +40 +45 +33 +21 +11 +3 +-6 +-12 +-19 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-23 +74 +116 +116 +116 +116 +116 +105 +94 +84 +76 +69 +63 +58 +53 +50 +46 +43 +30 +20 +10 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-15 +72 +110 +116 +116 +116 +105 +94 +84 +76 +68 +66 +66 +61 +57 +53 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-11 +78 +116 +116 +116 +116 +113 +102 +91 +81 +74 +67 +61 +56 +52 +48 +45 +41 +29 +18 +9 +0 +-7 +-14 +-20 +-26 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-15 +69 +107 +116 +116 +113 +104 +98 +92 +82 +75 +69 +63 +58 +55 +51 +47 +34 +23 +13 +4 +-4 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-13 +76 +115 +116 +116 +116 +110 +99 +89 +80 +71 +65 +59 +54 +50 +47 +43 +40 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-25 +46 +89 +116 +116 +116 +109 +99 +89 +81 +74 +68 +63 +58 +54 +50 +46 +62 +48 +35 +24 +13 +4 +-4 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-18 +66 +103 +116 +115 +108 +97 +87 +77 +69 +61 +55 +51 +47 +43 +40 +37 +34 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-62 +-62 +-25 +76 +116 +116 +116 +116 +116 +106 +95 +85 +77 +70 +64 +58 +54 +50 +46 +43 +40 +37 +34 +32 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +18 +19 +17 +15 +15 +13 +12 +11 +10 +9 +9 +8 +7 +6 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-37 +-40 +-44 +-47 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-24 +64 +102 +116 +116 +111 +101 +91 +81 +72 +65 +59 +54 +50 +45 +43 +47 +36 +24 +14 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-23 +73 +116 +116 +116 +116 +116 +105 +95 +85 +77 +69 +64 +58 +54 +50 +46 +43 +40 +37 +35 +32 +29 +27 +25 +23 +21 +19 +17 +16 +20 +21 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +-3 +-10 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-25 +62 +102 +116 +116 +110 +100 +90 +80 +72 +64 +59 +53 +50 +52 +52 +48 +35 +23 +13 +4 +-4 +-12 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-13 +78 +116 +116 +116 +116 +115 +103 +93 +83 +75 +68 +62 +57 +53 +49 +45 +42 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-62 +-36 +38 +82 +107 +113 +111 +103 +95 +86 +78 +73 +73 +68 +63 +59 +55 +51 +48 +44 +41 +38 +36 +33 +30 +28 +26 +23 +22 +20 +18 +16 +15 +13 +12 +10 +9 +8 +8 +6 +6 +5 +5 +9 +12 +11 +10 +9 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-43 +-46 +-48 +-51 +-53 +-54 +-56 +-58 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-42 +36 +82 +108 +116 +114 +106 +98 +88 +80 +72 +66 +60 +55 +51 +47 +44 +41 +58 +44 +32 +21 +10 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-21 +60 +96 +110 +109 +102 +92 +83 +74 +72 +67 +61 +56 +52 +48 +45 +42 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-24 +53 +95 +116 +116 +116 +108 +98 +89 +80 +72 +66 +60 +56 +51 +48 +44 +41 +38 +26 +15 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-18 +67 +103 +116 +116 +114 +107 +96 +86 +78 +71 +65 +60 +55 +51 +48 +44 +32 +21 +11 +2 +-5 +-13 +-19 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-11 +76 +114 +116 +116 +116 +109 +97 +87 +78 +70 +64 +58 +53 +49 +45 +42 +39 +27 +16 +7 +-2 +-9 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-55 +66 +116 +116 +116 +116 +116 +107 +96 +87 +78 +71 +65 +60 +55 +51 +47 +44 +32 +21 +11 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-15 +72 +111 +116 +116 +116 +107 +96 +86 +77 +69 +63 +57 +53 +49 +51 +52 +38 +26 +16 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-8 +82 +116 +116 +116 +116 +116 +104 +94 +84 +75 +68 +63 +57 +53 +49 +46 +42 +31 +19 +10 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-15 +70 +109 +116 +116 +115 +105 +94 +84 +75 +70 +70 +66 +60 +56 +52 +49 +46 +43 +39 +37 +34 +31 +29 +27 +24 +22 +20 +18 +16 +15 +13 +12 +10 +9 +8 +8 +7 +6 +5 +5 +4 +9 +12 +11 +10 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-46 +-48 +-51 +-52 +-54 +-56 +-58 +-58 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-42 +37 +83 +109 +116 +115 +107 +98 +89 +81 +73 +66 +61 +56 +51 +48 +44 +41 +57 +43 +31 +20 +10 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-20 +61 +98 +111 +110 +103 +93 +84 +74 +67 +67 +63 +57 +53 +49 +46 +43 +30 +19 +10 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-63 +-24 +67 +110 +116 +116 +116 +111 +100 +90 +81 +73 +66 +61 +55 +52 +48 +44 +41 +29 +18 +9 +0 +-8 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-36 +37 +81 +105 +111 +109 +108 +103 +93 +85 +77 +71 +65 +61 +56 +52 +49 +45 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-49 +32 +81 +110 +116 +116 +110 +101 +92 +83 +75 +68 +63 +57 +53 +49 +46 +42 +39 +27 +16 +7 +-1 +-9 +-15 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-11 +75 +116 +116 +116 +116 +111 +101 +92 +83 +76 +69 +64 +59 +55 +51 +47 +44 +32 +21 +11 +2 +-6 +-13 +-19 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-63 +-34 +42 +85 +110 +116 +114 +106 +97 +88 +79 +71 +65 +59 +55 +51 +48 +52 +65 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-13 +63 +103 +116 +116 +116 +108 +97 +87 +78 +71 +64 +59 +54 +50 +46 +43 +40 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-17 +68 +106 +116 +116 +111 +101 +90 +81 +72 +65 +62 +63 +58 +54 +50 +47 +44 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-34 +45 +89 +115 +116 +116 +110 +101 +92 +83 +75 +68 +62 +58 +53 +49 +46 +42 +39 +36 +34 +31 +29 +27 +25 +26 +30 +28 +26 +24 +22 +20 +19 +17 +15 +14 +12 +11 +10 +9 +8 +7 +6 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +6 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +6 +7 +6 +5 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +3 +4 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +-5 +-12 +-19 +-24 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-41 +36 +80 +104 +110 +107 +100 +91 +83 +75 +68 +62 +56 +52 +48 +44 +41 +38 +36 +33 +37 +38 +35 +32 +30 +27 +25 +23 +21 +19 +17 +15 +14 +13 +12 +10 +10 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +20 +10 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-43 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-31 +50 +86 +103 +110 +105 +94 +84 +75 +68 +61 +56 +51 +48 +44 +41 +38 +26 +15 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-63 +-18 +70 +110 +116 +116 +116 +107 +96 +86 +77 +69 +63 +58 +53 +49 +45 +42 +38 +26 +16 +7 +-2 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-24 +82 +116 +116 +116 +116 +116 +107 +96 +86 +78 +71 +64 +60 +55 +51 +47 +44 +40 +38 +34 +32 +30 +28 +25 +23 +21 +19 +17 +16 +14 +13 +15 +19 +17 +16 +14 +13 +12 +12 +10 +10 +9 +8 +7 +7 +6 +-2 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-25 +62 +102 +116 +116 +111 +101 +91 +82 +73 +66 +59 +54 +50 +46 +43 +44 +46 +43 +40 +37 +34 +32 +29 +27 +25 +23 +20 +19 +17 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +6 +5 +4 +4 +3 +3 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +2 +77 +113 +116 +116 +112 +103 +94 +85 +77 +71 +64 +59 +55 +51 +47 +44 +40 +38 +34 +32 +30 +28 +25 +23 +21 +19 +18 +16 +14 +13 +12 +11 +15 +17 +15 +14 +13 +12 +11 +10 +9 +9 +7 +7 +6 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-36 +-40 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-61 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-65 +-30 +44 +84 +103 +107 +102 +94 +85 +77 +69 +62 +56 +51 +47 +44 +40 +37 +35 +39 +39 +36 +34 +32 +29 +27 +25 +23 +20 +19 +17 +15 +13 +12 +11 +10 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +-6 +-13 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-1 +85 +116 +116 +116 +110 +99 +89 +80 +72 +65 +60 +55 +51 +47 +44 +40 +38 +35 +32 +30 +27 +25 +23 +21 +19 +17 +16 +14 +12 +11 +10 +9 +10 +14 +15 +13 +13 +11 +11 +10 +9 +8 +8 +7 +6 +6 +-3 +-10 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-45 +31 +76 +101 +109 +108 +101 +93 +84 +77 +69 +63 +57 +53 +49 +45 +42 +39 +37 +42 +40 +37 +35 +32 +30 +28 +25 +23 +21 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +7 +6 +5 +5 +4 +3 +3 +3 +2 +-6 +-13 +-20 +-25 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-27 +60 +108 +116 +116 +111 +101 +90 +81 +73 +66 +60 +55 +51 +48 +44 +41 +38 +35 +32 +30 +28 +25 +23 +21 +19 +17 +15 +14 +12 +11 +10 +9 +8 +10 +15 +14 +13 +12 +11 +10 +9 +9 +8 +8 +7 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-25 +63 +103 +116 +116 +113 +103 +93 +83 +74 +67 +60 +55 +51 +47 +43 +40 +37 +35 +35 +39 +36 +34 +31 +28 +26 +24 +22 +20 +18 +17 +15 +13 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +-5 +-12 +-19 +-24 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-25 +58 +98 +116 +116 +116 +104 +93 +84 +76 +69 +63 +58 +54 +49 +46 +43 +40 +36 +34 +31 +29 +26 +24 +22 +20 +18 +16 +14 +13 +12 +11 +9 +8 +8 +11 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-24 +65 +104 +116 +116 +113 +103 +93 +83 +75 +67 +61 +55 +51 +47 +44 +40 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-38 +41 +100 +116 +116 +116 +110 +100 +91 +83 +76 +69 +64 +59 +55 +50 +47 +63 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-37 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-20 +64 +101 +115 +114 +107 +97 +87 +77 +69 +61 +56 +51 +47 +42 +40 +37 +34 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-62 +-62 +-23 +70 +115 +116 +116 +116 +116 +106 +96 +86 +78 +70 +64 +59 +55 +50 +47 +43 +31 +20 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-37 +39 +83 +107 +115 +113 +105 +96 +87 +79 +72 +66 +60 +58 +60 +57 +53 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-49 +34 +85 +115 +116 +116 +116 +106 +97 +87 +79 +72 +66 +60 +56 +52 +48 +44 +42 +38 +35 +33 +31 +28 +26 +24 +23 +23 +28 +26 +24 +21 +20 +18 +16 +15 +14 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +-4 +-11 +-17 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-28 +58 +96 +112 +112 +105 +96 +86 +77 +69 +62 +58 +59 +56 +52 +48 +45 +42 +39 +36 +33 +31 +28 +27 +24 +22 +20 +18 +16 +15 +13 +12 +10 +10 +8 +7 +6 +6 +5 +5 +4 +4 +3 +8 +11 +10 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-43 +-46 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-23 +69 +110 +116 +116 +116 +109 +98 +88 +79 +71 +64 +58 +54 +49 +46 +42 +40 +37 +34 +31 +29 +27 +25 +22 +21 +19 +17 +19 +22 +20 +19 +17 +16 +14 +14 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-26 +60 +99 +115 +116 +108 +100 +89 +80 +71 +65 +58 +58 +59 +55 +51 +47 +44 +41 +38 +36 +33 +30 +27 +25 +23 +21 +19 +17 +15 +14 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +4 +10 +11 +2 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-44 +35 +82 +109 +116 +116 +109 +100 +91 +83 +75 +68 +62 +57 +53 +49 +45 +42 +58 +44 +31 +21 +10 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-22 +61 +97 +111 +110 +104 +94 +84 +75 +67 +60 +57 +58 +55 +51 +47 +44 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-62 +-63 +-26 +66 +111 +116 +116 +116 +113 +102 +92 +83 +75 +67 +62 +57 +53 +48 +45 +42 +30 +19 +9 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-62 +-37 +37 +80 +104 +112 +110 +102 +95 +91 +87 +79 +73 +67 +62 +57 +54 +50 +46 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-50 +-52 +-54 +-56 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-50 +31 +81 +110 +116 +116 +112 +103 +93 +84 +77 +70 +64 +58 +54 +50 +46 +43 +40 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-49 +27 +77 +115 +116 +116 +113 +103 +93 +84 +78 +71 +65 +60 +56 +52 +48 +44 +33 +21 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-35 +42 +86 +111 +116 +115 +107 +98 +89 +81 +73 +66 +60 +56 +51 +47 +44 +50 +50 +37 +25 +15 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-17 +64 +104 +116 +116 +116 +109 +99 +89 +80 +72 +65 +60 +55 +51 +47 +44 +40 +38 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-18 +68 +107 +116 +116 +112 +102 +91 +82 +73 +66 +59 +54 +54 +56 +51 +48 +45 +42 +39 +37 +34 +31 +29 +27 +24 +22 +20 +19 +17 +15 +14 +12 +11 +10 +9 +8 +6 +6 +5 +4 +4 +4 +3 +4 +9 +11 +1 +-7 +-14 +-20 +-26 +-31 +-36 +-39 +-43 +-46 +-48 +-51 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-24 +67 +109 +116 +116 +116 +107 +96 +86 +76 +69 +62 +57 +52 +48 +44 +41 +38 +36 +33 +31 +28 +26 +24 +22 +20 +18 +16 +15 +14 +18 +19 +18 +16 +15 +13 +13 +11 +11 +10 +9 +8 +7 +6 +6 +5 +5 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-24 +55 +94 +111 +114 +108 +99 +90 +81 +73 +66 +60 +55 +51 +53 +53 +49 +36 +23 +14 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-25 +53 +97 +116 +116 +116 +113 +104 +94 +85 +77 +70 +64 +59 +54 +50 +46 +43 +40 +29 +18 +8 +0 +-8 +-15 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-62 +-37 +38 +80 +105 +112 +110 +103 +95 +86 +78 +73 +74 +68 +63 +58 +55 +51 +47 +44 +41 +38 +35 +33 +30 +28 +26 +24 +22 +20 +18 +16 +15 +13 +12 +10 +9 +8 +7 +6 +6 +5 +5 +9 +12 +11 +10 +9 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-40 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-26 +65 +106 +116 +116 +115 +105 +95 +84 +76 +68 +61 +56 +52 +47 +44 +40 +38 +35 +32 +30 +28 +25 +23 +21 +20 +18 +21 +23 +21 +19 +18 +16 +15 +14 +12 +11 +10 +9 +9 +7 +7 +6 +6 +5 +5 +4 +-4 +-11 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-65 +-64 +-45 +28 +72 +98 +106 +104 +97 +90 +82 +74 +67 +61 +60 +61 +57 +53 +49 +59 +45 +33 +21 +11 +2 +-5 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-19 +57 +97 +116 +116 +113 +105 +94 +85 +76 +69 +63 +58 +53 +49 +45 +42 +39 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-62 +-63 +-20 +65 +103 +116 +116 +109 +100 +90 +86 +80 +73 +66 +62 +57 +53 +49 +46 +42 +39 +36 +34 +31 +29 +26 +25 +22 +20 +18 +17 +15 +14 +12 +11 +9 +9 +8 +7 +6 +6 +8 +13 +12 +11 +10 +9 +9 +8 +-1 +-8 +-15 +-21 +-27 +-31 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-26 +63 +104 +116 +116 +112 +103 +92 +83 +74 +67 +60 +55 +50 +47 +43 +40 +36 +34 +31 +29 +27 +25 +23 +24 +27 +26 +23 +21 +19 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +6 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-48 +31 +79 +106 +115 +114 +107 +99 +90 +82 +74 +68 +62 +57 +52 +49 +45 +42 +39 +36 +33 +31 +28 +26 +24 +22 +20 +18 +17 +21 +22 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +24 +14 +5 +-4 +-11 +-18 +-23 +-29 +-33 +-38 +-41 +-44 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-65 +-32 +51 +89 +103 +105 +98 +89 +80 +71 +63 +57 +51 +47 +48 +49 +45 +42 +30 +19 +9 +1 +-8 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-16 +75 +116 +116 +116 +116 +113 +102 +91 +82 +73 +67 +61 +56 +52 +48 +44 +41 +29 +19 +9 +0 +-8 +-14 +-20 +-26 +-30 +-34 +-38 +-42 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-18 +68 +106 +116 +116 +114 +104 +94 +85 +83 +77 +71 +65 +60 +56 +52 +48 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-36 +42 +87 +114 +116 +116 +110 +102 +92 +84 +76 +69 +63 +58 +54 +50 +46 +43 +60 +46 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-23 +58 +94 +108 +108 +105 +100 +89 +80 +72 +65 +60 +55 +51 +47 +44 +40 +37 +35 +32 +30 +28 +25 +24 +21 +20 +18 +16 +14 +13 +12 +11 +9 +8 +7 +7 +6 +12 +13 +12 +11 +10 +9 +9 +8 +8 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-25 +65 +105 +116 +116 +114 +104 +94 +84 +75 +67 +61 +56 +51 +47 +44 +40 +38 +26 +16 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-17 +59 +101 +116 +116 +116 +109 +99 +89 +81 +74 +68 +62 +58 +53 +50 +46 +34 +22 +12 +3 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-27 +49 +91 +113 +116 +115 +107 +98 +88 +80 +72 +66 +60 +55 +51 +47 +44 +41 +37 +25 +15 +6 +-3 +-10 +-17 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-53 +45 +94 +116 +116 +116 +116 +108 +98 +89 +81 +73 +68 +62 +57 +53 +49 +45 +42 +39 +36 +34 +32 +29 +27 +25 +23 +21 +19 +18 +16 +14 +15 +19 +19 +17 +16 +14 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +-3 +-10 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-65 +-64 +-28 +59 +98 +114 +115 +108 +98 +89 +79 +71 +63 +57 +52 +48 +44 +41 +40 +35 +23 +13 +4 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-62 +-62 +-25 +71 +116 +116 +116 +116 +116 +106 +96 +86 +78 +70 +64 +59 +54 +50 +47 +43 +40 +37 +35 +32 +30 +27 +25 +23 +21 +19 +17 +15 +15 +20 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-37 +54 +97 +115 +116 +111 +102 +92 +82 +74 +66 +60 +55 +50 +48 +52 +49 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-15 +76 +116 +116 +116 +116 +116 +104 +94 +84 +76 +68 +63 +58 +53 +49 +46 +42 +39 +36 +34 +31 +29 +26 +25 +22 +20 +18 +18 +22 +22 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +5 +-3 +-10 +-17 +-23 +-28 +-33 +-37 +-40 +-44 +-47 +-49 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-65 +-64 +-27 +60 +100 +115 +115 +109 +100 +90 +80 +72 +65 +59 +55 +58 +55 +51 +48 +35 +23 +13 +4 +-4 +-12 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-27 +66 +111 +116 +116 +116 +115 +104 +94 +84 +76 +69 +63 +58 +54 +50 +46 +43 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-63 +-62 +-38 +35 +79 +105 +112 +110 +103 +95 +86 +82 +80 +74 +68 +63 +58 +54 +51 +47 +44 +41 +38 +35 +32 +30 +28 +26 +23 +21 +20 +18 +16 +15 +13 +11 +10 +9 +8 +7 +6 +6 +5 +11 +12 +11 +10 +10 +9 +0 +-8 +-15 +-21 +-26 +-31 +-36 +-40 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-27 +64 +105 +116 +116 +114 +104 +94 +84 +75 +67 +61 +55 +51 +47 +44 +40 +38 +34 +32 +30 +28 +25 +23 +21 +20 +23 +25 +22 +20 +18 +17 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +4 +4 +-4 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-27 +58 +98 +113 +114 +107 +99 +89 +79 +71 +70 +67 +62 +57 +53 +49 +46 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-62 +-17 +74 +114 +116 +116 +116 +112 +101 +90 +81 +73 +66 +60 +56 +51 +48 +44 +41 +29 +18 +8 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-28 +44 +85 +106 +112 +108 +104 +101 +93 +84 +77 +70 +65 +60 +56 +52 +48 +45 +42 +38 +36 +33 +31 +28 +26 +24 +22 +20 +18 +16 +15 +13 +12 +10 +10 +8 +8 +7 +11 +14 +13 +12 +11 +10 +9 +9 +20 +10 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-51 +-52 +-54 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-30 +46 +87 +106 +110 +105 +98 +88 +79 +71 +65 +58 +53 +49 +45 +41 +38 +36 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-62 +-63 +-21 +62 +100 +114 +116 +116 +107 +95 +86 +77 +70 +64 +59 +55 +51 +47 +44 +32 +21 +11 +2 +-6 +-13 +-19 +-24 +-29 +-34 +-38 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-17 +72 +111 +116 +116 +116 +108 +98 +88 +79 +70 +64 +58 +54 +49 +46 +43 +40 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-51 +68 +116 +116 +116 +116 +116 +109 +98 +88 +80 +72 +66 +61 +56 +52 +48 +45 +42 +38 +36 +33 +31 +28 +26 +24 +22 +19 +18 +16 +14 +13 +12 +16 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +7 +-2 +-9 +-16 +-22 +-28 +-32 +-36 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-27 +62 +102 +116 +116 +111 +102 +92 +82 +74 +66 +60 +54 +50 +46 +43 +40 +43 +44 +41 +38 +35 +32 +30 +27 +25 +23 +21 +19 +17 +15 +14 +13 +12 +10 +9 +8 +8 +7 +7 +5 +5 +4 +4 +3 +3 +2 +-6 +-13 +-19 +-25 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-62 +45 +109 +116 +116 +116 +113 +102 +91 +82 +74 +68 +62 +57 +52 +49 +45 +42 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-19 +69 +108 +116 +116 +116 +106 +96 +86 +77 +69 +63 +57 +53 +49 +50 +52 +48 +45 +42 +38 +36 +34 +31 +28 +26 +23 +21 +19 +18 +16 +14 +13 +12 +10 +10 +8 +8 +7 +6 +5 +5 +4 +4 +4 +3 +2 +-6 +-13 +-19 +-25 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-27 +71 +112 +116 +116 +116 +112 +101 +90 +82 +73 +67 +61 +56 +51 +48 +44 +41 +38 +35 +32 +30 +27 +25 +23 +21 +19 +17 +16 +14 +13 +12 +17 +18 +16 +15 +13 +13 +12 +11 +10 +9 +8 +8 +7 +6 +6 +-2 +-10 +-16 +-23 +-28 +-32 +-37 +-40 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-65 +-28 +60 +101 +116 +116 +110 +102 +91 +82 +73 +66 +59 +55 +50 +46 +44 +47 +46 +43 +40 +37 +34 +32 +29 +27 +24 +22 +20 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +4 +4 +4 +3 +3 +-6 +-13 +-19 +-25 +-30 +-34 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +26 +89 +116 +116 +116 +110 +101 +92 +83 +76 +69 +62 +58 +53 +50 +45 +43 +39 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-22 +66 +105 +116 +116 +113 +103 +93 +83 +74 +67 +61 +55 +51 +47 +50 +50 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-62 +-13 +78 +116 +116 +116 +116 +116 +104 +94 +84 +76 +69 +63 +57 +53 +49 +46 +42 +40 +36 +34 +31 +29 +26 +24 +22 +20 +18 +17 +21 +22 +20 +18 +16 +15 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +-3 +-10 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-37 +51 +94 +112 +115 +110 +100 +91 +82 +74 +66 +60 +55 +57 +57 +53 +70 +55 +41 +29 +18 +9 +0 +-8 +-15 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-22 +66 +106 +116 +116 +114 +103 +93 +83 +74 +66 +60 +55 +51 +46 +43 +40 +37 +25 +15 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-61 +-62 +-62 +-62 +-62 +-63 +-63 +-19 +66 +105 +116 +116 +113 +103 +93 +83 +77 +76 +70 +64 +60 +55 +52 +48 +35 +24 +14 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-37 +42 +88 +114 +116 +116 +111 +102 +93 +84 +76 +70 +64 +59 +54 +50 +46 +43 +40 +37 +34 +32 +30 +27 +28 +32 +30 +28 +26 +24 +21 +20 +18 +17 +15 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +4 +4 +4 +-5 +-12 +-18 +-24 +-29 +-34 +-38 +-41 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-36 +36 +78 +100 +106 +102 +95 +87 +81 +79 +74 +67 +62 +57 +53 +49 +46 +43 +31 +20 +10 +1 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-62 +-19 +71 +110 +116 +116 +116 +107 +96 +86 +77 +69 +63 +57 +53 +49 +45 +41 +39 +36 +33 +31 +29 +29 +33 +31 +28 +26 +24 +22 +20 +18 +17 +15 +14 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +6 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +-3 +-10 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-31 +55 +98 +116 +116 +114 +105 +95 +86 +77 +70 +63 +58 +53 +49 +45 +42 +39 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-63 +-63 +-54 +23 +72 +100 +111 +110 +105 +96 +88 +80 +78 +75 +70 +64 +60 +55 +52 +48 +35 +24 +14 +4 +-4 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-61 +-62 +-62 +-62 +-62 +-51 +31 +81 +111 +116 +116 +113 +104 +94 +86 +78 +71 +65 +60 +55 +51 +47 +44 +40 +38 +35 +33 +30 +28 +31 +33 +31 +28 +26 +24 +22 +20 +18 +17 +15 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +3 +8 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +25 +14 +4 +-4 +-11 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-64 +-63 +-63 +-63 +-63 +-62 +-62 +-62 +-62 +-61 +-61 +-61 +17 +106 +116 +116 +116 +116 +116 +116 +116 +116 +109 +101 +93 +86 +80 +64 +49 +37 +25 +15 +6 +-2 +-9 +-16 +-22 +-26 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-57 +-26 +67 +107 +116 +116 +116 +105 +95 +85 +76 +68 +62 +56 +52 +47 +44 +32 +21 +11 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-38 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-30 +53 +92 +106 +107 +100 +91 +81 +72 +64 +57 +51 +47 +42 +40 +36 +25 +15 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-37 +47 +84 +100 +100 +94 +85 +76 +67 +60 +53 +48 +44 +47 +46 +43 +40 +37 +34 +32 +30 +28 +25 +23 +21 +20 +17 +16 +14 +13 +11 +10 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +4 +10 +9 +9 +8 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +4 +8 +-2 +-10 +-17 +-22 +-28 +-32 +-37 +-41 +-44 +-47 +-49 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-47 +32 +69 +84 +90 +89 +81 +71 +64 +57 +51 +46 +43 +39 +36 +33 +22 +12 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-52 +17 +62 +88 +97 +95 +89 +81 +74 +66 +60 +54 +49 +45 +42 +38 +56 +42 +30 +19 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-38 +42 +77 +91 +91 +85 +76 +67 +59 +52 +45 +41 +37 +34 +30 +28 +17 +8 +-1 +-8 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-36 +45 +82 +96 +96 +90 +82 +72 +65 +63 +59 +53 +49 +45 +42 +30 +19 +9 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-60 +-61 +-33 +58 +98 +112 +112 +105 +96 +85 +76 +67 +60 +54 +49 +45 +41 +38 +26 +16 +7 +-2 +-9 +-16 +-22 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-31 +54 +92 +106 +106 +99 +89 +80 +70 +63 +55 +50 +45 +42 +38 +35 +23 +14 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-46 +41 +82 +99 +101 +94 +86 +77 +68 +60 +54 +48 +45 +47 +47 +33 +22 +12 +3 +-5 +-12 +-19 +-24 +-29 +-33 +-38 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-27 +50 +87 +108 +108 +98 +88 +78 +69 +62 +56 +51 +46 +43 +40 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-30 +56 +95 +109 +108 +101 +92 +82 +72 +64 +57 +51 +46 +43 +39 +36 +25 +15 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-27 +54 +90 +103 +102 +95 +86 +76 +68 +59 +53 +48 +43 +40 +37 +33 +22 +12 +3 +-5 +-12 +-19 +-24 +-29 +-33 +-38 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-46 +40 +80 +96 +98 +93 +84 +77 +73 +67 +60 +55 +50 +47 +43 +31 +20 +10 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-29 +58 +97 +112 +112 +105 +95 +85 +75 +67 +60 +54 +49 +45 +41 +38 +26 +16 +7 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-32 +52 +90 +105 +105 +98 +89 +79 +70 +62 +55 +49 +45 +41 +38 +35 +24 +13 +4 +-4 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-46 +41 +81 +98 +100 +94 +85 +76 +68 +60 +53 +49 +51 +49 +45 +32 +21 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-36 +44 +84 +106 +106 +96 +85 +76 +68 +61 +55 +50 +45 +42 +38 +55 +42 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-37 +46 +82 +96 +96 +90 +80 +71 +62 +55 +48 +43 +39 +36 +32 +30 +19 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-62 +-62 +-28 +52 +88 +101 +101 +94 +84 +75 +66 +58 +52 +46 +42 +38 +35 +32 +21 +11 +2 +-6 +-13 +-19 +-24 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-34 +47 +83 +98 +97 +91 +82 +75 +71 +65 +59 +54 +49 +45 +42 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-32 +56 +96 +112 +112 +105 +95 +85 +75 +67 +60 +54 +48 +45 +41 +38 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-62 +-30 +54 +92 +105 +105 +98 +89 +78 +70 +62 +55 +49 +45 +41 +38 +34 +23 +13 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-31 +50 +86 +100 +100 +93 +84 +75 +66 +59 +52 +48 +50 +48 +44 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-22 +64 +106 +116 +109 +98 +88 +78 +70 +62 +56 +51 +47 +43 +40 +28 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-60 +-61 +-30 +55 +93 +108 +108 +101 +91 +81 +72 +63 +57 +51 +46 +42 +39 +36 +25 +14 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-34 +42 +80 +96 +98 +92 +83 +74 +66 +58 +52 +47 +43 +39 +36 +34 +48 +35 +24 +13 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-39 +38 +73 +87 +86 +80 +72 +65 +62 +56 +50 +46 +42 +39 +36 +24 +14 +5 +-4 +-11 +-18 +-23 +-28 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-28 +58 +96 +111 +110 +103 +93 +83 +73 +65 +58 +52 +47 +43 +40 +37 +25 +15 +5 +-3 +-10 +-16 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-34 +45 +83 +99 +100 +95 +86 +77 +68 +60 +54 +48 +44 +40 +37 +34 +31 +21 +10 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-37 +34 +71 +89 +93 +88 +81 +72 +65 +57 +51 +46 +43 +45 +45 +41 +29 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-36 +33 +72 +98 +103 +95 +85 +76 +68 +61 +56 +51 +46 +43 +39 +37 +25 +15 +5 +-3 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-32 +48 +85 +102 +103 +97 +88 +79 +69 +62 +55 +50 +45 +41 +38 +35 +45 +33 +21 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-36 +44 +80 +93 +93 +86 +78 +68 +60 +52 +47 +41 +38 +34 +32 +29 +26 +15 +6 +-2 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-59 +4 +50 +77 +86 +86 +81 +76 +74 +68 +61 +56 +52 +48 +44 +41 +29 +18 +8 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-60 +-29 +51 +89 +106 +107 +101 +91 +82 +73 +65 +57 +52 +47 +43 +39 +37 +34 +23 +12 +4 +-5 +-11 +-18 +-23 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-58 +8 +56 +84 +95 +93 +88 +80 +72 +65 +58 +53 +48 +43 +40 +37 +47 +34 +23 +12 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-34 +44 +79 +92 +91 +85 +76 +68 +59 +52 +46 +42 +44 +43 +39 +37 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-26 +58 +101 +110 +103 +93 +83 +73 +65 +58 +52 +47 +44 +40 +37 +34 +23 +12 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-34 +51 +89 +103 +104 +97 +87 +77 +68 +60 +54 +48 +44 +40 +37 +34 +44 +32 +21 +11 +2 +-6 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-61 +-61 +-37 +43 +78 +92 +92 +86 +77 +68 +59 +52 +46 +41 +37 +34 +31 +44 +44 +32 +20 +10 +1 +-6 +-14 +-20 +-25 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-39 +37 +71 +85 +85 +79 +72 +68 +61 +54 +49 +44 +41 +37 +35 +23 +13 +4 +-4 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-34 +52 +91 +107 +106 +100 +90 +80 +71 +63 +56 +50 +45 +41 +38 +35 +32 +22 +12 +3 +-5 +-12 +-19 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-59 +7 +55 +83 +94 +93 +87 +79 +72 +64 +58 +52 +48 +44 +40 +37 +34 +23 +13 +3 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-35 +47 +83 +98 +97 +91 +82 +73 +64 +56 +50 +46 +47 +47 +43 +40 +27 +17 +7 +-1 +-9 +-15 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-38 +38 +88 +105 +102 +94 +85 +77 +69 +62 +57 +52 +48 +43 +40 +37 +26 +15 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-48 +21 +65 +90 +98 +96 +89 +81 +73 +65 +59 +53 +49 +44 +41 +38 +35 +23 +13 +4 +-4 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-50 +18 +60 +86 +93 +91 +84 +77 +69 +62 +55 +50 +45 +42 +38 +36 +38 +40 +37 +35 +32 +30 +28 +26 +24 +22 +20 +19 +18 +17 +15 +14 +12 +11 +10 +9 +7 +7 +6 +5 +4 +4 +3 +2 +2 +2 +1 +2 +7 +8 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +-5 +-12 +-18 +-25 +-29 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-63 +-63 +-63 +-63 +-63 +-62 +-62 +-62 +-62 +-61 +-61 +-61 +-60 +-60 +20 +116 +116 +116 +116 +116 +116 +116 +116 +116 +116 +109 +101 +93 +86 +80 +64 +50 +37 +26 +15 +6 +-2 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +-44 +-47 +-48 +-50 +-52 +-54 +-55 +-56 +-56 +-58 +-21 +63 +102 +116 +116 +110 +100 +90 +80 +71 +65 +58 +53 +49 +45 +41 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-30 +51 +87 +101 +101 +95 +86 +77 +68 +61 +54 +49 +44 +46 +47 +44 +40 +38 +35 +33 +30 +28 +26 +24 +22 +20 +18 +16 +14 +13 +11 +10 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +3 +2 +3 +9 +23 +12 +2 +-6 +-13 +-19 +-25 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-47 +29 +65 +80 +88 +85 +76 +67 +59 +53 +48 +44 +40 +37 +34 +32 +29 +27 +24 +23 +21 +19 +17 +16 +14 +13 +12 +10 +9 +8 +7 +6 +5 +4 +4 +4 +9 +11 +9 +9 +8 +8 +7 +7 +6 +6 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-45 +35 +76 +93 +96 +92 +84 +75 +67 +59 +53 +47 +43 +39 +36 +33 +31 +29 +27 +24 +23 +21 +19 +17 +16 +15 +13 +12 +17 +18 +16 +14 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +-5 +-12 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-40 +42 +79 +93 +95 +89 +81 +72 +64 +57 +50 +45 +41 +37 +34 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-39 +42 +78 +93 +94 +89 +80 +71 +63 +57 +57 +53 +48 +45 +41 +39 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-60 +-51 +50 +92 +108 +108 +102 +92 +83 +74 +66 +58 +53 +48 +44 +40 +37 +47 +35 +23 +13 +4 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-38 +44 +82 +96 +96 +89 +81 +71 +63 +55 +49 +44 +40 +36 +34 +30 +28 +26 +24 +22 +21 +19 +18 +20 +24 +22 +20 +18 +17 +15 +14 +12 +11 +9 +9 +7 +7 +6 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +-6 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-45 +38 +76 +91 +92 +87 +79 +71 +62 +55 +49 +44 +40 +40 +42 +30 +18 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-61 +-31 +47 +82 +99 +105 +98 +88 +78 +70 +62 +56 +51 +47 +43 +40 +28 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-33 +53 +93 +108 +108 +101 +92 +82 +73 +64 +58 +52 +47 +43 +40 +37 +25 +15 +6 +-3 +-10 +-17 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-37 +48 +86 +101 +102 +96 +87 +78 +69 +61 +54 +49 +44 +41 +37 +35 +22 +13 +3 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-32 +48 +84 +97 +98 +92 +83 +74 +70 +66 +60 +54 +50 +46 +43 +40 +37 +34 +32 +29 +27 +25 +23 +21 +19 +18 +16 +14 +13 +12 +11 +9 +8 +7 +6 +5 +5 +4 +4 +4 +10 +11 +10 +9 +8 +8 +7 +-2 +-9 +-16 +-22 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-62 +-63 +-63 +-45 +44 +84 +100 +101 +95 +86 +77 +68 +61 +54 +48 +44 +40 +37 +34 +31 +29 +27 +25 +23 +21 +19 +18 +16 +15 +13 +12 +11 +10 +8 +9 +13 +14 +12 +11 +10 +9 +9 +8 +7 +7 +6 +5 +4 +4 +4 +4 +-5 +-12 +-18 +-24 +-29 +-34 +-38 +-41 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-44 +41 +80 +96 +97 +92 +83 +74 +66 +58 +52 +46 +42 +38 +35 +32 +30 +28 +26 +24 +22 +21 +26 +26 +24 +21 +20 +18 +17 +15 +13 +12 +11 +9 +9 +8 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +3 +8 +8 +7 +6 +6 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-8 +-15 +-21 +-26 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-48 +28 +66 +84 +87 +83 +75 +68 +60 +53 +47 +43 +39 +38 +41 +39 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +16 +14 +12 +11 +10 +9 +8 +7 +6 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +6 +9 +0 +-8 +-15 +-21 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-49 +21 +58 +78 +87 +89 +82 +73 +65 +59 +53 +49 +45 +41 +38 +36 +32 +30 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +11 +10 +8 +8 +6 +6 +5 +4 +8 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +1 +6 +8 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +-4 +-12 +-18 +-24 +-29 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-63 +-46 +34 +74 +93 +97 +91 +84 +75 +68 +60 +53 +48 +44 +40 +37 +34 +32 +20 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-60 +4 +51 +81 +92 +92 +86 +79 +72 +65 +58 +53 +48 +44 +40 +37 +47 +34 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-37 +41 +76 +90 +91 +84 +76 +67 +59 +52 +49 +50 +46 +42 +39 +36 +34 +31 +30 +27 +25 +23 +22 +20 +18 +17 +15 +14 +12 +11 +10 +8 +8 +6 +6 +4 +4 +3 +3 +2 +2 +2 +6 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +4 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-63 +-9 +68 +99 +102 +96 +88 +78 +69 +62 +55 +50 +45 +41 +38 +35 +32 +30 +28 +25 +24 +22 +20 +18 +17 +15 +14 +12 +11 +9 +8 +7 +6 +5 +8 +12 +12 +10 +10 +9 +8 +7 +7 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +7 +7 +6 +6 +5 +5 +5 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +22 +12 +3 +-5 +-12 +-19 +-25 +-30 +-34 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-60 +-62 +-62 +-63 +-63 +-49 +31 +69 +85 +87 +82 +74 +66 +57 +51 +44 +40 +36 +33 +30 +28 +17 +8 +-1 +-9 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-63 +-39 +44 +82 +97 +98 +92 +84 +75 +66 +58 +52 +47 +43 +39 +36 +35 +39 +37 +35 +32 +30 +28 +26 +24 +22 +20 +18 +16 +15 +13 +12 +10 +9 +8 +7 +6 +6 +5 +5 +4 +3 +3 +3 +2 +2 +1 +2 +5 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-9 +-16 +-22 +-28 +-32 +-37 +-40 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-45 +34 +71 +87 +89 +84 +77 +73 +68 +61 +55 +50 +46 +43 +40 +27 +17 +7 +-1 +-9 +-15 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-60 +-61 +-30 +55 +94 +109 +109 +103 +94 +83 +74 +66 +59 +53 +48 +44 +41 +37 +34 +32 +30 +27 +26 +24 +22 +20 +18 +16 +15 +13 +12 +11 +15 +17 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +-6 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-47 +38 +78 +94 +95 +91 +83 +74 +65 +58 +52 +47 +42 +39 +35 +33 +30 +28 +26 +24 +22 +24 +27 +25 +23 +21 +19 +18 +16 +15 +13 +12 +10 +9 +8 +8 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +7 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-8 +-15 +-21 +-27 +-31 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-56 +28 +69 +87 +90 +86 +79 +71 +63 +56 +50 +46 +47 +47 +43 +30 +19 +10 +1 +-7 +-14 +-20 +-26 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-59 +-60 +-61 +-61 +-61 +-30 +57 +102 +113 +107 +97 +87 +78 +70 +62 +57 +51 +47 +44 +40 +37 +35 +32 +29 +27 +25 +23 +21 +19 +18 +16 +14 +13 +12 +10 +9 +8 +7 +6 +11 +13 +12 +11 +10 +9 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +8 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +8 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-63 +-63 +-63 +-62 +-63 +-62 +-62 +-61 +-61 +-61 +-61 +-61 +-61 +19 +113 +116 +116 +116 +116 +116 +116 +116 +116 +108 +99 +91 +84 +78 +72 +67 +52 +39 +27 +17 +7 +-1 +-8 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-58 +-48 +20 +62 +88 +97 +96 +91 +90 +85 +77 +70 +64 +59 +55 +51 +47 +34 +23 +13 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-50 +21 +66 +93 +102 +100 +94 +87 +78 +70 +64 +58 +52 +48 +44 +41 +38 +26 +16 +7 +-2 +-9 +-16 +-22 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-42 +27 +68 +90 +96 +92 +86 +78 +70 +63 +57 +51 +47 +42 +39 +36 +33 +31 +29 +26 +27 +32 +30 +28 +26 +24 +22 +21 +19 +17 +16 +14 +13 +11 +10 +8 +8 +6 +6 +5 +5 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +6 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-8 +-15 +-21 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-46 +36 +73 +89 +91 +86 +78 +69 +62 +54 +49 +49 +49 +45 +42 +29 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-61 +-61 +-61 +11 +83 +112 +114 +106 +97 +86 +77 +68 +61 +55 +51 +46 +43 +39 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-35 +44 +83 +100 +103 +97 +88 +79 +70 +62 +56 +50 +46 +42 +39 +35 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-39 +33 +71 +90 +94 +90 +82 +74 +66 +59 +53 +48 +43 +40 +36 +34 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-38 +31 +68 +86 +90 +86 +80 +77 +72 +64 +58 +53 +49 +45 +42 +39 +36 +33 +31 +29 +27 +24 +23 +21 +20 +18 +17 +15 +14 +12 +11 +10 +8 +7 +6 +5 +5 +4 +7 +11 +11 +9 +9 +8 +8 +7 +19 +9 +0 +-8 +-15 +-21 +-26 +-31 +-36 +-40 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-44 +39 +78 +93 +94 +89 +81 +72 +63 +56 +49 +44 +39 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +12 +11 +10 +9 +10 +15 +14 +12 +11 +10 +9 +9 +8 +7 +6 +6 +5 +4 +4 +3 +3 +3 +-5 +-12 +-19 +-24 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-64 +-46 +32 +71 +89 +91 +87 +79 +71 +63 +56 +50 +45 +41 +38 +34 +31 +29 +27 +25 +23 +21 +22 +26 +25 +23 +21 +19 +18 +16 +15 +13 +12 +10 +9 +8 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +5 +8 +8 +7 +6 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-8 +-15 +-21 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-53 +13 +53 +76 +82 +81 +76 +69 +61 +55 +50 +45 +46 +47 +43 +40 +37 +35 +32 +30 +28 +26 +24 +22 +20 +18 +16 +15 +14 +12 +11 +10 +8 +8 +6 +6 +5 +4 +3 +3 +3 +2 +2 +3 +8 +10 +8 +-1 +-9 +-15 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-35 +54 +97 +106 +101 +93 +84 +74 +67 +60 +54 +49 +45 +41 +38 +35 +33 +30 +28 +25 +24 +22 +20 +18 +17 +15 +13 +12 +11 +9 +8 +7 +7 +7 +12 +13 +12 +10 +10 +9 +8 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +-6 +-12 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-48 +38 +78 +95 +96 +91 +83 +74 +65 +58 +52 +46 +42 +38 +35 +32 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-47 +22 +62 +84 +91 +89 +83 +75 +68 +60 +55 +49 +45 +41 +38 +35 +32 +20 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-52 +13 +54 +79 +88 +87 +81 +75 +73 +69 +62 +57 +52 +48 +45 +42 +38 +36 +33 +31 +28 +27 +24 +23 +21 +19 +18 +16 +14 +13 +12 +11 +9 +9 +7 +6 +5 +5 +4 +6 +11 +10 +9 +9 +8 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +5 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +-4 +-11 +-18 +-24 +-29 +-33 +-38 +-41 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-45 +36 +76 +95 +98 +94 +85 +77 +68 +61 +54 +50 +45 +41 +37 +35 +32 +29 +27 +25 +23 +21 +20 +18 +16 +15 +14 +12 +11 +10 +8 +10 +14 +14 +12 +11 +10 +10 +9 +8 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +-6 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-50 +23 +64 +84 +90 +86 +80 +72 +65 +57 +52 +46 +42 +38 +36 +33 +30 +19 +10 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-62 +-40 +36 +74 +91 +93 +88 +80 +72 +64 +57 +51 +46 +43 +47 +44 +41 +38 +36 +33 +31 +29 +27 +24 +23 +21 +19 +17 +16 +14 +12 +11 +10 +8 +8 +7 +6 +5 +4 +4 +3 +3 +2 +2 +2 +5 +10 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +25 +14 +4 +-4 +-11 +-18 +-24 +-29 +-34 +-38 +-41 +-44 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-59 +-61 +-61 +-62 +-62 +-63 +-63 +-50 +25 +62 +83 +89 +82 +73 +65 +57 +51 +45 +42 +38 +35 +32 +21 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-62 +-38 +49 +88 +104 +106 +100 +90 +81 +71 +64 +56 +51 +46 +42 +39 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +16 +21 +20 +18 +16 +15 +13 +13 +11 +10 +9 +9 +8 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +4 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +12 +4 +-5 +-12 +-19 +-24 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-64 +-49 +30 +68 +84 +86 +80 +73 +65 +57 +50 +44 +39 +36 +32 +30 +27 +25 +24 +29 +29 +27 +24 +23 +21 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +4 +9 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-2 +-9 +-16 +-22 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-49 +26 +65 +81 +85 +81 +74 +66 +63 +60 +55 +50 +46 +42 +39 +36 +25 +14 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-37 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-37 +44 +85 +102 +104 +99 +91 +82 +73 +65 +58 +52 +47 +43 +40 +36 +34 +32 +29 +27 +25 +23 +22 +19 +18 +16 +15 +13 +12 +11 +10 +13 +16 +14 +13 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +0 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +9 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-40 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-63 +-63 +-63 +-62 +-62 +-62 +-62 +-61 +-61 +-61 +-60 +10 +113 +116 +116 +116 +116 +116 +116 +116 +116 +116 +106 +98 +90 +83 +77 +62 +47 +35 +24 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-32 +57 +97 +113 +115 +109 +100 +90 +80 +72 +64 +59 +53 +49 +45 +42 +29 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-45 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-39 +44 +83 +98 +101 +95 +87 +77 +69 +61 +55 +52 +54 +50 +47 +43 +41 +37 +35 +32 +30 +27 +26 +23 +21 +19 +18 +15 +14 +12 +11 +10 +9 +8 +7 +6 +5 +5 +4 +4 +4 +3 +3 +7 +11 +9 +0 +-8 +-15 +-21 +-26 +-31 +-36 +-40 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-64 +-42 +44 +91 +106 +102 +92 +83 +74 +66 +59 +53 +49 +45 +41 +38 +35 +33 +30 +28 +25 +23 +21 +20 +18 +16 +14 +13 +12 +10 +9 +8 +7 +6 +6 +10 +13 +12 +10 +10 +9 +9 +8 +7 +6 +6 +5 +17 +7 +-1 +-9 +-15 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-47 +35 +74 +90 +91 +86 +78 +70 +61 +54 +48 +43 +38 +35 +32 +30 +27 +17 +7 +-1 +-9 +-15 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-47 +20 +61 +83 +90 +88 +82 +74 +67 +60 +54 +49 +44 +41 +38 +34 +34 +38 +37 +34 +32 +29 +27 +25 +24 +22 +20 +18 +17 +15 +14 +12 +11 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +1 +1 +0 +-8 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-44 +36 +73 +88 +89 +85 +78 +75 +68 +61 +55 +50 +46 +43 +39 +27 +16 +7 +-2 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-32 +54 +93 +108 +109 +103 +93 +84 +74 +66 +59 +53 +48 +44 +40 +38 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-62 +-38 +47 +86 +102 +104 +97 +88 +79 +70 +62 +56 +50 +45 +41 +38 +35 +33 +30 +28 +26 +29 +31 +29 +26 +25 +23 +21 +19 +17 +15 +14 +12 +11 +10 +9 +8 +7 +6 +6 +5 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +2 +8 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +3 +8 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-8 +-15 +-21 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-51 +19 +59 +79 +84 +81 +76 +68 +61 +54 +49 +44 +41 +44 +43 +40 +37 +34 +32 +30 +28 +26 +24 +21 +20 +18 +16 +14 +13 +11 +10 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +4 +9 +22 +11 +2 +-6 +-13 +-20 +-25 +-31 +-35 +-39 +-42 +-45 +-48 +-51 +-52 +-54 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-48 +27 +64 +82 +90 +85 +76 +67 +60 +53 +48 +43 +40 +37 +34 +31 +20 +10 +2 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-61 +-61 +-60 +5 +54 +83 +95 +95 +90 +82 +75 +67 +61 +55 +50 +46 +42 +38 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-37 +41 +79 +95 +97 +92 +84 +75 +67 +59 +53 +48 +43 +40 +36 +33 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-47 +-50 +-51 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-61 +-59 +3 +49 +76 +88 +87 +82 +75 +74 +70 +63 +58 +53 +49 +46 +56 +42 +30 +19 +9 +1 +-7 +-14 +-20 +-26 +-31 +-34 +-39 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-33 +51 +88 +102 +103 +96 +87 +77 +68 +60 +54 +48 +44 +39 +36 +33 +31 +20 +11 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-38 +46 +83 +99 +100 +93 +84 +75 +66 +59 +52 +47 +42 +39 +35 +33 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-38 +42 +80 +94 +95 +89 +81 +71 +63 +56 +50 +45 +46 +46 +43 +53 +39 +27 +17 +7 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-60 +-34 +49 +92 +105 +98 +89 +79 +70 +62 +56 +50 +45 +41 +38 +35 +51 +38 +27 +16 +7 +-2 +-9 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-40 +42 +79 +94 +94 +88 +79 +70 +61 +54 +47 +43 +38 +35 +32 +30 +27 +25 +23 +22 +20 +18 +17 +16 +14 +16 +20 +19 +17 +16 +14 +13 +12 +11 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-8 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-63 +-63 +-64 +-64 +-48 +33 +72 +88 +90 +85 +77 +69 +61 +53 +48 +43 +39 +35 +32 +30 +27 +16 +7 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-41 +34 +71 +88 +90 +86 +79 +76 +70 +63 +57 +52 +47 +44 +41 +38 +26 +16 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-60 +-36 +45 +85 +102 +104 +99 +90 +81 +72 +65 +58 +52 +47 +43 +39 +36 +34 +31 +29 +27 +25 +23 +21 +20 +18 +17 +15 +14 +12 +12 +16 +17 +15 +14 +12 +11 +10 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +-5 +-12 +-19 +-24 +-29 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-64 +-64 +-43 +40 +79 +94 +96 +90 +82 +73 +65 +57 +51 +46 +41 +38 +35 +32 +21 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-37 +45 +81 +96 +97 +92 +83 +74 +66 +59 +55 +56 +51 +47 +44 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-60 +-3 +75 +107 +112 +104 +95 +84 +75 +67 +60 +54 +50 +45 +41 +38 +36 +24 +14 +5 +-3 +-11 +-17 +-23 +-28 +-33 +-37 +-40 +-43 +-46 +-48 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-52 +17 +60 +87 +96 +95 +88 +81 +73 +66 +59 +54 +49 +45 +41 +38 +56 +43 +30 +19 +9 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-41 +38 +75 +89 +90 +83 +75 +66 +58 +51 +45 +40 +36 +32 +30 +27 +16 +7 +-1 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-38 +43 +80 +94 +95 +90 +87 +80 +70 +63 +57 +52 +48 +44 +41 +29 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-34 +54 +93 +109 +110 +104 +94 +84 +74 +66 +59 +53 +48 +44 +40 +38 +26 +16 +6 +-2 +-10 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-62 +-34 +50 +88 +103 +104 +97 +88 +78 +70 +62 +55 +49 +45 +41 +38 +34 +23 +13 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-48 +38 +78 +96 +98 +93 +85 +76 +68 +61 +60 +58 +52 +49 +45 +33 +21 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-48 +56 +99 +114 +113 +106 +96 +86 +76 +68 +61 +55 +50 +46 +42 +39 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-61 +-33 +51 +91 +105 +106 +99 +90 +80 +71 +63 +56 +51 +46 +42 +39 +35 +24 +14 +5 +-4 +-11 +-17 +-23 +-28 +-32 +-37 +-40 +-43 +-46 +-49 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-30 +50 +87 +101 +100 +94 +85 +76 +67 +59 +52 +47 +43 +40 +43 +33 +21 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-48 +37 +77 +94 +103 +101 +91 +81 +73 +65 +59 +54 +49 +45 +42 +30 +19 +9 +1 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-33 +54 +94 +108 +109 +103 +94 +83 +74 +65 +59 +52 +48 +44 +40 +37 +35 +32 +30 +27 +25 +23 +22 +20 +19 +17 +16 +17 +21 +19 +18 +16 +15 +13 +12 +10 +10 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +-7 +-14 +-21 +-26 +-31 +-35 +-39 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-54 +14 +55 +78 +85 +83 +78 +71 +64 +57 +51 +47 +42 +39 +35 +33 +42 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-40 +37 +74 +87 +88 +83 +75 +66 +59 +57 +54 +49 +45 +41 +38 +35 +33 +31 +29 +26 +25 +23 +21 +19 +18 +16 +14 +13 +12 +10 +9 +8 +7 +6 +5 +4 +4 +3 +3 +2 +4 +9 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +-4 +-11 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-50 +36 +77 +95 +98 +94 +86 +77 +69 +62 +55 +49 +45 +41 +37 +34 +32 +30 +27 +25 +23 +22 +20 +18 +17 +15 +13 +12 +11 +10 +8 +8 +12 +14 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +8 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +6 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +0 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +-4 +-11 +-18 +-23 +-29 +-33 +-38 +-41 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-63 +-63 +-63 +-62 +-62 +-62 +-62 +-61 +-61 +-61 +-61 +-60 +-60 +-18 +70 +116 +116 +116 +116 +116 +116 +116 +116 +116 +110 +102 +94 +87 +81 +65 +50 +38 +26 +16 +6 +-1 +-9 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-55 +-56 +-57 +-29 +59 +100 +116 +116 +111 +102 +91 +81 +73 +66 +59 +54 +49 +46 +42 +39 +27 +17 +7 +-1 +-9 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-56 +-57 +-59 +-59 +-60 +-61 +-40 +44 +83 +99 +100 +94 +85 +77 +68 +60 +54 +48 +44 +40 +37 +34 +31 +29 +29 +34 +32 +30 +27 +25 +23 +21 +19 +18 +16 +14 +12 +12 +10 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-42 +-46 +-48 +-51 +-52 +-54 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-63 +-63 +-64 +-64 +-64 +-49 +32 +72 +88 +90 +85 +78 +70 +64 +62 +57 +52 +48 +44 +41 +38 +36 +33 +31 +28 +26 +23 +21 +19 +18 +16 +14 +13 +12 +10 +9 +8 +7 +6 +5 +5 +4 +3 +3 +3 +8 +11 +10 +9 +9 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +1 +7 +7 +7 +6 +6 +24 +14 +4 +-4 +-12 +-18 +-24 +-29 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-57 +34 +75 +90 +93 +87 +79 +70 +63 +55 +49 +44 +40 +36 +33 +30 +28 +26 +24 +22 +20 +19 +17 +16 +14 +12 +11 +10 +9 +7 +7 +6 +7 +12 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-38 +-42 +-44 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-47 +31 +72 +89 +93 +88 +81 +73 +65 +57 +52 +46 +42 +38 +35 +32 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-41 +36 +73 +91 +93 +89 +80 +72 +64 +57 +51 +46 +42 +39 +41 +42 +29 +18 +8 +0 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-61 +-40 +39 +76 +91 +97 +95 +86 +76 +68 +61 +55 +50 +46 +42 +39 +57 +44 +31 +20 +10 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-41 +41 +80 +94 +95 +89 +81 +71 +63 +55 +49 +44 +40 +36 +33 +30 +28 +26 +24 +22 +20 +19 +18 +16 +15 +13 +12 +13 +18 +17 +15 +14 +12 +11 +10 +9 +8 +7 +7 +6 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +0 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +-7 +-14 +-20 +-26 +-30 +-35 +-39 +-43 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-49 +35 +75 +93 +95 +90 +82 +74 +65 +58 +52 +47 +42 +38 +35 +33 +30 +28 +25 +24 +26 +29 +26 +24 +22 +21 +18 +17 +15 +14 +12 +12 +10 +9 +8 +8 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +13 +4 +-4 +-12 +-18 +-24 +-29 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-56 +-57 +-59 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-50 +28 +65 +81 +83 +78 +71 +63 +55 +49 +43 +43 +44 +41 +37 +35 +23 +13 +4 +-4 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-61 +-17 +60 +98 +104 +100 +92 +84 +75 +68 +61 +55 +50 +46 +42 +39 +36 +25 +14 +5 +-3 +-10 +-17 +-23 +-28 +-32 +-37 +-40 +-43 +-46 +-49 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-43 +27 +68 +90 +97 +94 +88 +79 +72 +64 +58 +52 +48 +43 +40 +37 +34 +23 +13 +4 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-61 +-43 +25 +64 +86 +92 +90 +83 +75 +67 +61 +54 +49 +45 +41 +38 +39 +31 +20 +10 +2 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-37 +32 +68 +86 +90 +88 +86 +79 +71 +64 +58 +52 +49 +45 +41 +38 +36 +33 +31 +28 +27 +24 +23 +21 +19 +18 +16 +15 +14 +12 +11 +10 +9 +7 +7 +5 +5 +8 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +-5 +-12 +-19 +-24 +-30 +-34 +-38 +-42 +-45 +-47 +-50 +-52 +-54 +-56 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-64 +-63 +-64 +-43 +42 +83 +99 +101 +95 +87 +77 +69 +61 +54 +49 +44 +40 +37 +34 +23 +13 +4 +-4 +-11 +-18 +-23 +-29 +-33 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-37 +47 +85 +100 +101 +96 +87 +78 +68 +61 +54 +49 +44 +41 +37 +34 +22 +13 +3 +-4 +-12 +-18 +-24 +-28 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-62 +-40 +42 +81 +96 +98 +92 +84 +75 +67 +64 +62 +56 +52 +47 +44 +31 +20 +10 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-40 +56 +96 +112 +113 +106 +97 +86 +77 +68 +62 +55 +50 +46 +42 +39 +27 +17 +7 +-1 +-9 +-15 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-36 +43 +82 +99 +101 +96 +88 +78 +70 +62 +55 +50 +45 +41 +38 +35 +51 +38 +26 +15 +6 +-2 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-42 +38 +74 +88 +88 +83 +75 +66 +58 +51 +45 +40 +36 +33 +35 +27 +16 +7 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-43 +-46 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-62 +-35 +44 +80 +94 +98 +97 +88 +78 +70 +62 +56 +51 +47 +43 +40 +28 +17 +8 +-1 +-8 +-15 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-57 +-59 +-59 +-60 +-60 +-35 +46 +85 +102 +105 +99 +90 +81 +72 +64 +57 +52 +47 +43 +39 +36 +34 +23 +12 +4 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-62 +-38 +34 +73 +91 +96 +91 +84 +75 +68 +60 +54 +48 +44 +40 +37 +34 +32 +29 +27 +30 +33 +30 +29 +26 +25 +22 +21 +19 +18 +16 +15 +13 +12 +10 +9 +8 +7 +6 +5 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +11 +2 +-6 +-13 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-63 +-64 +-64 +-49 +30 +66 +81 +83 +78 +70 +62 +54 +48 +44 +45 +43 +40 +36 +34 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-61 +-21 +52 +89 +100 +99 +94 +87 +78 +71 +64 +58 +53 +49 +44 +41 +38 +35 +33 +30 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +12 +11 +9 +10 +14 +15 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +3 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +-5 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-40 +44 +81 +97 +98 +93 +84 +75 +66 +59 +52 +47 +42 +39 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +19 +23 +21 +19 +17 +16 +14 +13 +12 +11 +9 +8 +7 +7 +6 +5 +4 +4 +3 +3 +3 +3 +2 +2 +-6 +-13 +-20 +-25 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-63 +-63 +-64 +-64 +-53 +14 +55 +78 +84 +83 +78 +71 +63 +57 +51 +46 +42 +38 +35 +36 +29 +18 +8 +0 +-8 +-14 +-21 +-26 +-31 +-35 +-39 +-42 +-45 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-62 +-40 +29 +66 +84 +89 +86 +85 +79 +71 +64 +58 +52 +49 +45 +41 +38 +27 +16 +7 +-2 +-9 +-16 +-22 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-36 +51 +90 +105 +106 +100 +91 +80 +72 +63 +57 +50 +46 +42 +39 +35 +33 +30 +28 +26 +24 +22 +21 +19 +18 +16 +15 +13 +13 +17 +18 +16 +15 +13 +12 +11 +10 +9 +8 +7 +6 +6 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +20 +10 +1 +-7 +-14 +-20 +-26 +-31 +-35 +-39 +-43 +-46 +-48 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-51 +28 +66 +81 +83 +79 +71 +63 +55 +49 +43 +38 +34 +31 +28 +26 +24 +22 +20 +22 +26 +25 +22 +21 +19 +17 +16 +15 +13 +12 +10 +9 +8 +7 +6 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +1 +6 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +8 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +0 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +8 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +25 +15 +5 +-3 +-11 +-18 +-23 +-29 +-33 +-38 +-41 +-44 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-64 +-64 +-64 +-64 +-64 +-65 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-64 +-63 +-63 +-63 +-63 +-62 +-63 +-62 +-62 +-62 +-62 +-61 +-61 +13 +101 +116 +116 +116 +116 +116 +116 +116 +116 +107 +99 +91 +84 +79 +62 +48 +35 +24 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-57 +-58 +-23 +63 +103 +116 +116 +113 +103 +93 +84 +74 +67 +60 +55 +50 +47 +43 +31 +20 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-37 +-41 +-44 +-47 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-59 +-60 +-61 +-31 +51 +88 +103 +104 +98 +89 +80 +71 +63 +56 +51 +46 +42 +39 +36 +33 +31 +28 +30 +33 +31 +29 +27 +24 +23 +20 +19 +17 +15 +14 +12 +11 +10 +8 +8 +7 +6 +6 +5 +4 +4 +3 +3 +3 +3 +2 +13 +4 +-4 +-12 +-18 +-24 +-29 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-49 +29 +66 +81 +83 +79 +71 +63 +55 +49 +46 +47 +44 +40 +37 +35 +32 +30 +27 +26 +23 +22 +20 +18 +16 +15 +13 +12 +10 +9 +8 +7 +6 +5 +4 +4 +3 +3 +2 +2 +2 +2 +7 +10 +8 +8 +7 +-1 +-9 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-47 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +-5 +67 +97 +101 +95 +88 +79 +71 +63 +57 +51 +47 +42 +39 +36 +33 +31 +29 +26 +25 +23 +21 +19 +17 +16 +15 +12 +12 +10 +9 +8 +7 +6 +10 +13 +12 +10 +10 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +-5 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-53 +15 +58 +82 +89 +87 +82 +74 +67 +60 +54 +49 +44 +40 +37 +34 +32 +21 +11 +2 +-6 +-13 +-19 +-25 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-45 +22 +62 +85 +91 +88 +82 +75 +67 +60 +54 +49 +44 +41 +38 +39 +31 +20 +10 +2 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-38 +31 +68 +86 +90 +87 +86 +79 +71 +64 +58 +53 +49 +45 +42 +38 +27 +16 +7 +-2 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-36 +51 +90 +105 +106 +100 +90 +80 +72 +63 +56 +51 +46 +42 +38 +35 +52 +39 +27 +17 +7 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-39 +-43 +-46 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-41 +39 +75 +90 +91 +85 +76 +68 +59 +52 +46 +41 +37 +34 +31 +29 +17 +8 +-1 +-8 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-62 +-62 +-31 +47 +83 +96 +97 +90 +82 +72 +64 +57 +57 +55 +50 +46 +43 +39 +37 +34 +32 +29 +27 +25 +24 +21 +20 +18 +17 +15 +14 +12 +11 +9 +9 +7 +6 +5 +5 +4 +4 +3 +3 +4 +10 +10 +9 +8 +8 +-2 +-9 +-16 +-22 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-63 +23 +81 +101 +102 +97 +88 +79 +70 +62 +55 +50 +45 +41 +37 +35 +32 +21 +11 +3 +-6 +-12 +-19 +-24 +-29 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-59 +-59 +-60 +-60 +-61 +-39 +40 +80 +97 +99 +94 +86 +77 +68 +61 +54 +49 +44 +40 +37 +34 +32 +20 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-39 +38 +76 +93 +94 +90 +82 +73 +65 +58 +52 +47 +42 +39 +37 +41 +39 +37 +34 +32 +30 +28 +25 +24 +22 +20 +18 +17 +15 +13 +12 +11 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +5 +0 +-8 +-15 +-21 +-27 +-32 +-36 +-40 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-44 +35 +72 +87 +92 +92 +84 +75 +67 +60 +54 +49 +45 +41 +38 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-61 +-35 +51 +91 +107 +108 +101 +92 +82 +73 +65 +58 +52 +48 +43 +40 +37 +34 +32 +30 +27 +25 +23 +21 +19 +18 +16 +15 +14 +19 +19 +17 +15 +14 +13 +12 +11 +10 +9 +8 +7 +7 +6 +5 +4 +4 +3 +3 +23 +13 +3 +-5 +-12 +-18 +-24 +-29 +-34 +-38 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-63 +-63 +-50 +28 +66 +82 +84 +78 +71 +63 +55 +48 +43 +38 +34 +31 +29 +26 +24 +22 +22 +26 +27 +24 +22 +21 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +-7 +-14 +-21 +-26 +-31 +-36 +-39 +-43 +-46 +-49 +-51 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-64 +-64 +-49 +20 +59 +79 +84 +81 +75 +67 +60 +54 +54 +52 +48 +44 +41 +38 +26 +15 +6 +-2 +-10 +-16 +-22 +-28 +-32 +-36 +-40 +-43 +-46 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-61 +-58 +30 +80 +100 +104 +100 +92 +83 +75 +67 +60 +54 +50 +45 +42 +38 +36 +33 +31 +28 +26 +24 +23 +20 +19 +18 +16 +14 +13 +12 +11 +9 +9 +12 +15 +13 +12 +11 +10 +9 +9 +7 +7 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-60 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-46 +38 +79 +95 +98 +92 +84 +75 +67 +59 +53 +47 +43 +39 +36 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-38 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-39 +37 +75 +92 +95 +90 +82 +74 +66 +58 +52 +47 +43 +39 +36 +37 +30 +18 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-59 +2 +47 +75 +86 +88 +90 +84 +76 +69 +62 +57 +52 +48 +44 +41 +38 +36 +33 +31 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +12 +11 +9 +8 +7 +6 +5 +8 +12 +11 +10 +10 +9 +8 +7 +7 +6 +-2 +-10 +-16 +-23 +-28 +-33 +-37 +-41 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-63 +-45 +40 +81 +97 +100 +93 +85 +76 +68 +59 +53 +48 +43 +39 +36 +33 +31 +20 +10 +1 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-42 +-44 +-47 +-49 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-40 +43 +81 +97 +98 +92 +84 +75 +66 +59 +52 +47 +42 +39 +36 +33 +42 +30 +19 +9 +0 +-7 +-14 +-20 +-26 +-30 +-35 +-38 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-41 +37 +74 +88 +89 +83 +76 +67 +59 +52 +48 +49 +46 +42 +40 +36 +34 +32 +30 +27 +25 +23 +21 +20 +18 +16 +15 +13 +12 +10 +9 +8 +7 +6 +5 +4 +4 +3 +3 +2 +2 +2 +6 +10 +9 +8 +8 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +-3 +-11 +-18 +-23 +-29 +-33 +-38 +-41 +-44 +-47 +-50 +-52 +-54 +-55 +-57 +-58 +-60 +-60 +-61 +-62 +-63 +-63 +-63 +-63 +-63 +2 +65 +93 +97 +94 +87 +79 +71 +64 +57 +52 +47 +43 +39 +36 +33 +31 +29 +27 +24 +23 +21 +19 +18 +16 +15 +13 +12 +11 +9 +8 +7 +7 +12 +13 +11 +11 +9 +9 +8 +8 +7 +7 +6 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +3 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-39 +-42 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-59 +-60 +-60 +-62 +-62 +-63 +-63 +-64 +-63 +-64 +-47 +38 +79 +95 +98 +92 +85 +76 +67 +59 +53 +48 +43 +39 +37 +33 +22 +12 +3 +-5 +-12 +-18 +-24 +-29 +-33 +-37 +-41 +-44 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-41 +36 +75 +92 +95 +90 +83 +74 +66 +58 +53 +47 +43 +39 +36 +34 +36 +38 +35 +32 +31 +28 +26 +24 +22 +20 +18 +17 +15 +13 +12 +10 +10 +8 +8 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +-7 +-14 +-20 +-26 +-31 +-36 +-39 +-43 +-46 +-49 +-51 +-53 +-54 +-56 +-57 +-59 +-60 +-61 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-46 +34 +71 +87 +89 +85 +81 +77 +68 +61 +55 +50 +46 +43 +39 +28 +17 +7 +-1 +-9 +-15 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-56 +-58 +-59 +-60 +-60 +-61 +-61 +-34 +53 +92 +108 +109 +102 +93 +84 +74 +66 +59 +53 +48 +44 +40 +38 +26 +16 +6 +-2 +-9 +-16 +-22 +-27 +-32 +-36 +-40 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-59 +-60 +-61 +-38 +40 +79 +97 +99 +94 +86 +77 +68 +61 +54 +49 +44 +41 +37 +35 +32 +21 +11 +2 +-6 +-13 +-19 +-25 +-30 +-34 +-38 +-41 +-44 +-47 +-49 +-51 +-53 +-55 +-56 +-57 +-58 +-59 +-60 +-61 +-62 +-40 +30 +69 +87 +91 +88 +81 +73 +65 +58 +52 +50 +52 +48 +45 +41 +29 +18 +9 +0 +-8 +-15 +-20 +-26 +-31 +-35 +-39 +-42 +-45 +-48 +-50 +-52 +-53 +-55 +-56 +-58 +-58 +-60 +-60 +-61 +-61 +-17 +61 +99 +107 +102 +94 +85 +76 +68 +62 +55 +51 +46 +43 +39 +36 +34 +31 +29 +27 +25 +23 +21 +20 +18 +17 +15 +14 +12 +11 +10 +9 +7 +9 +13 +13 +12 +11 +9 +9 +8 +8 +6 +6 +5 +5 +16 +7 +-2 +-9 +-16 +-22 +-28 +-32 +-37 +-40 +-44 +-46 +-49 +-51 +-53 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-46 +36 +74 +89 +91 +85 +78 +68 +61 +53 +47 +42 +38 +35 +32 +29 +27 +16 +7 +-2 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-56 +-57 +-58 +-59 +-60 +-60 +-62 +-62 +-61 +2 +48 +77 +88 +89 +83 +77 +69 +63 +56 +51 +46 +43 +39 +36 +39 +41 +37 +35 +32 +30 +28 +26 +24 +22 +20 +19 +17 +16 +14 +13 +11 +10 +9 +8 +7 +6 +5 +4 +3 +3 +3 +2 +2 +2 +1 +3 +8 +9 +8 +8 +7 +6 +6 +6 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-9 +-16 +-22 +-28 +-32 +-37 +-40 +-44 +-47 +-49 +-51 +-54 +-55 +-57 +-58 +-59 +-60 +-61 +-62 +-62 +-63 +-63 +-64 +-64 +-64 +-42 +37 +73 +87 +89 +84 +77 +74 +68 +60 +54 +50 +45 +42 +39 +27 +16 +7 +-2 +-9 +-16 +-21 +-27 +-31 +-36 +-39 +-43 +-45 +-48 +-50 +-52 +-54 +-55 +-57 +-58 +-59 +-60 +-60 +-61 +-37 +50 +90 +105 +107 +100 +92 +82 +73 +64 +58 +52 +47 +43 +40 +36 +34 +31 +29 +27 +25 +23 +21 +19 +18 +16 +15 +13 +12 +10 +10 +15 +16 +14 +12 +11 +11 +10 +9 +8 +8 +7 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +5 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +5 +4 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +1 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +4 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +7 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +0 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +5 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +1 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +1 +6 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +4 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +3 +7 +6 +6 +6 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +1 +2 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +2 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +0 +5 +7 +6 +6 +6 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +0 +1 +7 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-36 +-40 +-42 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-60 +-60 +-59 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-55 +-56 +-55 +-55 +-55 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-36 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-34 +-35 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-31 +-30 +-30 +-30 +-30 +-29 +-30 +-29 +-29 +-29 +-29 +-28 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-1 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +38 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +115 +107 +100 +93 +87 +81 +75 +70 +65 +61 +56 +52 +49 +46 +43 +44 +46 +43 +40 +37 +35 +33 +31 +28 +27 +25 +23 +21 +20 +18 +17 +16 +15 +13 +13 +12 +11 +10 +9 +8 +8 +7 +7 +6 +6 +5 +7 +12 +12 +11 +11 +10 +9 +9 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +5 +8 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +7 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +1 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-46 +-4 +37 +49 +49 +43 +35 +27 +23 +19 +9 +1 +-6 +-13 +-19 +-24 +-28 +-33 +-36 +-40 +-43 +-1 +57 +70 +64 +53 +42 +32 +23 +16 +11 +8 +6 +4 +3 +4 +9 +8 +8 +7 +7 +6 +6 +5 +5 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +-8 +50 +63 +58 +48 +38 +28 +20 +14 +9 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-9 +38 +56 +53 +45 +35 +26 +18 +13 +8 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-39 +-42 +-26 +56 +83 +77 +62 +49 +37 +27 +19 +13 +6 +-2 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-42 +-44 +15 +64 +69 +60 +47 +36 +25 +17 +9 +4 +11 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +12 +63 +69 +59 +47 +35 +24 +16 +8 +2 +-2 +-4 +-7 +-8 +-8 +-8 +-9 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-43 +-46 +-47 +10 +50 +57 +51 +42 +33 +24 +17 +12 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-36 +-40 +-43 +-45 +4 +53 +63 +56 +46 +35 +26 +21 +16 +6 +-2 +-9 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +2 +51 +62 +56 +45 +35 +25 +17 +11 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +28 +79 +84 +73 +58 +46 +34 +24 +16 +10 +5 +2 +0 +-2 +-3 +-3 +-4 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-46 +-43 +24 +57 +57 +47 +37 +28 +21 +15 +12 +3 +-4 +-11 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-45 +6 +57 +67 +59 +48 +37 +27 +19 +13 +8 +5 +2 +2 +6 +7 +6 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +-33 +21 +48 +51 +44 +36 +27 +20 +14 +11 +7 +0 +-8 +-14 +-20 +-25 +-30 +-33 +-37 +-40 +-42 +19 +59 +65 +58 +48 +37 +29 +21 +16 +11 +3 +-5 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +7 +56 +65 +58 +47 +37 +27 +21 +16 +7 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +3 +51 +63 +56 +46 +35 +25 +17 +11 +6 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +30 +81 +85 +73 +59 +46 +35 +24 +16 +10 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +17 +65 +69 +59 +46 +35 +24 +16 +8 +14 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +14 +65 +69 +59 +46 +35 +24 +15 +7 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-37 +-40 +-43 +-45 +0 +49 +56 +49 +39 +30 +21 +15 +9 +6 +-3 +-9 +-16 +-21 +-27 +-31 +-35 +-38 +-42 +-44 +-42 +13 +45 +49 +43 +34 +25 +18 +12 +8 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +14 +60 +67 +59 +49 +37 +28 +20 +14 +9 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-39 +-42 +-42 +31 +73 +74 +62 +49 +37 +27 +19 +13 +4 +-4 +-10 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-8 +37 +53 +48 +40 +30 +22 +14 +8 +4 +-3 +-11 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +29 +79 +83 +71 +57 +44 +33 +23 +15 +8 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +15 +63 +67 +57 +45 +34 +24 +16 +9 +16 +7 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-42 +10 +60 +65 +55 +43 +32 +21 +13 +5 +0 +-7 +-14 +-20 +-25 +-30 +-34 +-38 +-40 +-43 +-46 +5 +51 +58 +52 +41 +31 +21 +14 +8 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-44 +-46 +7 +44 +50 +43 +35 +25 +19 +15 +12 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +7 +58 +68 +60 +49 +38 +28 +19 +13 +8 +0 +-8 +-14 +-20 +-25 +-30 +-33 +-37 +-40 +7 +57 +69 +62 +51 +40 +29 +21 +14 +9 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +22 +69 +73 +62 +50 +37 +27 +18 +11 +5 +-4 +-11 +-17 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +20 +69 +74 +63 +51 +38 +27 +18 +10 +4 +7 +-1 +-9 +-15 +-21 +-26 +-30 +-35 +-38 +-41 +17 +72 +77 +65 +52 +39 +29 +19 +11 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +3 +40 +46 +40 +31 +22 +14 +9 +4 +0 +-7 +-14 +-20 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +7 +60 +69 +61 +49 +38 +28 +19 +12 +8 +-1 +-8 +-14 +-20 +-25 +-29 +-34 +-37 +-40 +-43 +-41 +27 +61 +62 +51 +40 +30 +22 +15 +11 +2 +-5 +-12 +-18 +-24 +-28 +-32 +-36 +-40 +-43 +-45 +4 +60 +71 +62 +50 +38 +28 +19 +12 +6 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-5 +42 +57 +53 +44 +34 +24 +17 +11 +6 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-37 +-41 +-43 +-46 +22 +68 +72 +61 +49 +38 +28 +19 +13 +5 +-2 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +17 +66 +72 +61 +48 +36 +26 +17 +9 +3 +10 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +15 +66 +72 +61 +48 +36 +25 +16 +9 +2 +-5 +-12 +-18 +-23 +-28 +-33 +-36 +-40 +-43 +-45 +-47 +-1 +42 +49 +43 +33 +24 +17 +12 +8 +-1 +-8 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +3 +60 +70 +62 +49 +38 +27 +19 +11 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-35 +-38 +-41 +-43 +6 +60 +70 +62 +50 +39 +28 +20 +13 +8 +0 +-7 +-14 +-20 +-25 +-29 +-34 +-37 +-41 +-43 +-1 +46 +57 +51 +40 +31 +21 +14 +8 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +25 +74 +77 +66 +53 +41 +29 +20 +12 +7 +-1 +-9 +-15 +-21 +-26 +-30 +-35 +-38 +-41 +-43 +25 +77 +82 +70 +56 +44 +32 +22 +14 +8 +10 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +12 +60 +65 +54 +43 +31 +21 +13 +6 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-37 +-41 +-44 +-46 +6 +44 +50 +44 +35 +25 +17 +11 +6 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-34 +44 +73 +67 +55 +43 +33 +23 +17 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +1 +48 +60 +53 +43 +32 +23 +15 +9 +4 +-4 +-11 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +27 +77 +81 +69 +56 +43 +32 +22 +14 +7 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-40 +-43 +-45 +15 +63 +67 +57 +45 +35 +24 +16 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-44 +-46 +18 +66 +70 +60 +47 +35 +25 +16 +8 +3 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +19 +71 +75 +65 +51 +39 +28 +19 +11 +5 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +8 +56 +61 +51 +40 +29 +20 +12 +6 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +0 +45 +53 +46 +37 +26 +18 +11 +5 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +7 +66 +76 +67 +55 +43 +32 +22 +15 +8 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-10 +34 +50 +46 +37 +28 +20 +12 +8 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-45 +26 +75 +79 +67 +54 +41 +30 +21 +13 +7 +-1 +-8 +-15 +-21 +-25 +-30 +-34 +-38 +-41 +-43 +26 +77 +82 +70 +56 +43 +32 +22 +14 +8 +10 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +12 +60 +65 +55 +43 +32 +21 +13 +6 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +6 +44 +50 +44 +34 +25 +17 +11 +5 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-24 +53 +75 +68 +55 +43 +32 +24 +16 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +1 +48 +59 +53 +43 +32 +23 +15 +8 +5 +-4 +-11 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-44 +27 +77 +81 +69 +55 +43 +31 +22 +13 +7 +-1 +-8 +-14 +-20 +-25 +-30 +-34 +-37 +-41 +-43 +-46 +16 +63 +67 +57 +45 +34 +24 +15 +9 +11 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +12 +61 +67 +56 +44 +33 +23 +13 +6 +1 +-5 +-12 +-18 +-23 +-28 +-33 +-36 +-40 +-42 +-45 +18 +69 +74 +63 +50 +38 +27 +17 +10 +4 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +7 +55 +60 +51 +39 +29 +20 +12 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +0 +45 +53 +46 +36 +26 +18 +11 +5 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +6 +65 +76 +67 +55 +43 +31 +22 +14 +9 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-10 +34 +49 +46 +37 +28 +19 +13 +8 +3 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +26 +75 +79 +67 +54 +42 +30 +21 +13 +7 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-42 +24 +75 +80 +69 +55 +43 +31 +22 +13 +7 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +9 +58 +63 +53 +41 +30 +20 +11 +5 +5 +1 +-7 +-13 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +12 +62 +67 +57 +45 +33 +23 +14 +7 +1 +-6 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-20 +40 +56 +49 +39 +29 +21 +14 +9 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +-47 +4 +55 +64 +56 +45 +34 +24 +17 +10 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +4 +53 +65 +58 +47 +36 +26 +18 +11 +6 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +-45 +21 +67 +71 +61 +48 +37 +26 +18 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-46 +18 +67 +71 +60 +48 +36 +25 +16 +9 +3 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +17 +68 +72 +62 +49 +37 +26 +17 +9 +3 +-5 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-43 +-45 +-24 +21 +40 +39 +32 +24 +17 +13 +8 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-42 +-45 +-41 +15 +47 +52 +44 +36 +27 +19 +13 +9 +5 +-2 +-9 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-43 +17 +63 +71 +63 +52 +40 +30 +22 +16 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +5 +60 +69 +61 +49 +38 +28 +21 +15 +6 +-3 +-9 +-16 +-21 +-27 +-31 +-35 +-38 +-42 +-6 +39 +55 +50 +41 +31 +23 +15 +9 +5 +-2 +-10 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +-43 +32 +82 +86 +74 +60 +47 +35 +25 +17 +10 +4 +-4 +-11 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +16 +64 +68 +59 +46 +35 +24 +16 +8 +13 +8 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +12 +63 +68 +58 +45 +34 +23 +14 +6 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-10 +56 +67 +59 +47 +36 +26 +18 +11 +6 +2 +0 +-2 +-3 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-1 +5 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +-1 +2 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +6 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +1 +0 +0 +1 +5 +7 +7 +6 +6 +5 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +9 +1 +-6 +-13 +-19 +-24 +-29 +-32 +-36 +-39 +3 +60 +71 +64 +52 +41 +31 +22 +15 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-42 +-43 +6 +38 +45 +40 +32 +24 +19 +17 +15 +12 +10 +9 +8 +8 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +-5 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +4 +56 +66 +59 +48 +37 +27 +20 +13 +17 +7 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +11 +61 +67 +58 +46 +35 +24 +16 +8 +3 +-5 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +8 +47 +53 +47 +37 +29 +20 +14 +9 +5 +-3 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +-44 +-46 +2 +52 +61 +54 +44 +34 +26 +19 +14 +4 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +1 +49 +60 +54 +44 +34 +24 +17 +10 +6 +-2 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +-43 +27 +78 +83 +72 +58 +45 +33 +24 +15 +9 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +6 +42 +48 +41 +33 +24 +17 +11 +10 +2 +-6 +-13 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-46 +6 +58 +68 +59 +49 +37 +28 +19 +13 +7 +5 +2 +1 +-1 +-1 +-2 +-2 +-2 +-9 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-42 +16 +50 +55 +49 +40 +31 +23 +17 +12 +9 +1 +-7 +-13 +-19 +-24 +-29 +-32 +-37 +-39 +-42 +-39 +32 +67 +67 +55 +44 +34 +25 +19 +14 +11 +8 +7 +5 +5 +4 +3 +3 +-4 +-11 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-44 +12 +63 +71 +61 +50 +38 +29 +21 +15 +7 +-1 +-8 +-15 +-21 +-25 +-30 +-34 +-38 +-41 +-44 +17 +67 +72 +62 +50 +37 +27 +18 +11 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +23 +74 +78 +67 +54 +41 +30 +20 +13 +6 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +15 +62 +66 +57 +45 +34 +23 +15 +10 +12 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +13 +63 +68 +58 +45 +34 +23 +15 +7 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-44 +10 +49 +54 +48 +38 +29 +20 +14 +8 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +-47 +3 +53 +63 +55 +45 +34 +24 +16 +10 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +2 +51 +63 +57 +46 +35 +25 +17 +10 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +1 +73 +86 +74 +60 +47 +35 +25 +17 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +-46 +18 +65 +70 +59 +47 +35 +25 +16 +9 +3 +-1 +-3 +-2 +0 +0 +-1 +-2 +-9 +-15 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-47 +-49 +5 +50 +59 +52 +42 +32 +23 +16 +10 +6 +4 +2 +1 +0 +0 +1 +6 +-2 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +-44 +14 +69 +76 +67 +53 +42 +30 +21 +13 +8 +4 +1 +-1 +-2 +-3 +-3 +-4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +8 +54 +63 +57 +46 +36 +26 +19 +13 +9 +6 +4 +3 +2 +1 +1 +0 +0 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +18 +73 +82 +71 +58 +45 +34 +24 +16 +10 +6 +3 +1 +-1 +-2 +-2 +-3 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +12 +59 +68 +61 +50 +39 +30 +22 +16 +11 +9 +6 +5 +4 +3 +2 +2 +1 +-6 +-12 +-18 +-24 +-28 +-32 +-36 +-39 +-42 +-44 +11 +62 +70 +61 +50 +38 +28 +20 +13 +9 +6 +3 +2 +1 +0 +-1 +-1 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-43 +-46 +-48 +4 +47 +56 +50 +41 +31 +23 +19 +15 +12 +9 +8 +7 +6 +5 +5 +4 +-4 +-10 +-17 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +12 +65 +72 +63 +50 +39 +28 +20 +12 +7 +3 +4 +5 +4 +3 +2 +2 +11 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-43 +12 +63 +69 +59 +47 +36 +25 +16 +9 +4 +-4 +-11 +-17 +-22 +-28 +-32 +-36 +-39 +-42 +-44 +10 +48 +55 +48 +38 +29 +21 +14 +9 +5 +-3 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +-44 +-46 +3 +53 +62 +54 +44 +34 +26 +19 +14 +4 +-3 +-11 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +1 +50 +61 +55 +44 +34 +24 +16 +10 +5 +-3 +-9 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-43 +28 +79 +83 +72 +58 +45 +33 +23 +15 +9 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +17 +64 +68 +58 +46 +34 +24 +15 +11 +6 +3 +1 +-1 +-2 +-2 +-3 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-49 +16 +66 +73 +62 +50 +38 +28 +19 +12 +6 +2 +3 +4 +2 +2 +1 +1 +16 +7 +-2 +-9 +-15 +-21 +-26 +-30 +-35 +-38 +-42 +11 +61 +67 +58 +46 +34 +24 +15 +8 +2 +-1 +-4 +-5 +-7 +-5 +-1 +0 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-49 +17 +68 +75 +65 +52 +40 +29 +20 +13 +7 +3 +0 +-2 +-3 +-4 +-4 +-4 +9 +9 +0 +-7 +-14 +-19 +-25 +-29 +-34 +-37 +-41 +13 +64 +71 +61 +48 +36 +26 +17 +10 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-44 +-11 +51 +64 +56 +46 +35 +26 +18 +12 +7 +-1 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +2 +58 +68 +60 +48 +37 +26 +18 +11 +6 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-6 +40 +56 +52 +43 +33 +24 +16 +10 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +-45 +21 +67 +72 +62 +49 +37 +27 +19 +12 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-42 +-45 +17 +66 +71 +60 +48 +36 +25 +16 +9 +3 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +14 +65 +70 +60 +47 +35 +25 +16 +8 +2 +4 +-4 +-11 +-17 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +8 +55 +61 +51 +40 +29 +20 +12 +6 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-47 +4 +41 +47 +41 +32 +23 +16 +9 +5 +1 +-1 +-2 +-3 +-4 +-4 +-4 +0 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +15 +69 +76 +66 +53 +41 +30 +21 +13 +7 +3 +0 +-2 +-3 +-4 +-5 +-5 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-46 +13 +52 +58 +52 +42 +33 +24 +18 +12 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-36 +-40 +-42 +-45 +6 +55 +65 +58 +47 +36 +27 +19 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +2 +50 +61 +55 +44 +34 +24 +17 +10 +5 +2 +0 +-1 +-2 +-3 +-1 +4 +14 +4 +-4 +-11 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +17 +68 +73 +63 +50 +38 +27 +18 +11 +5 +1 +-2 +-4 +-5 +-6 +-6 +-6 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +-7 +41 +58 +53 +45 +34 +26 +18 +12 +7 +5 +3 +2 +1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +2 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +4 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +6 +8 +7 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +7 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +7 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +3 +7 +8 +7 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +18 +7 +-1 +-8 +-14 +-20 +-25 +-30 +-33 +-37 +-40 +-1 +54 +65 +59 +48 +37 +28 +20 +13 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-36 +-40 +-41 +13 +50 +56 +50 +41 +33 +25 +20 +15 +12 +9 +8 +6 +6 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +-6 +-13 +-19 +-24 +-29 +-32 +-36 +-39 +-42 +10 +67 +77 +68 +56 +44 +33 +24 +17 +11 +14 +5 +-3 +-10 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +9 +58 +65 +56 +44 +33 +23 +17 +11 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +5 +43 +49 +43 +34 +26 +18 +12 +7 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +8 +62 +73 +65 +53 +42 +31 +23 +15 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-42 +-1 +46 +58 +52 +42 +32 +22 +15 +9 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +24 +73 +77 +66 +53 +41 +30 +20 +13 +7 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-38 +-41 +-43 +6 +53 +59 +52 +42 +32 +24 +17 +11 +8 +-1 +-8 +-14 +-20 +-25 +-29 +-34 +-37 +-41 +-43 +-46 +5 +55 +65 +56 +46 +35 +25 +17 +11 +6 +4 +5 +7 +5 +5 +4 +4 +-4 +-11 +-17 +-22 +-27 +-32 +-36 +-39 +-42 +-45 +-43 +13 +46 +51 +45 +37 +28 +21 +15 +11 +7 +0 +-8 +-14 +-20 +-25 +-30 +-33 +-37 +-40 +-43 +15 +62 +70 +62 +51 +40 +30 +22 +16 +11 +8 +5 +4 +3 +3 +2 +2 +1 +-6 +-13 +-18 +-24 +-28 +-33 +-36 +-39 +-42 +20 +76 +83 +73 +59 +47 +35 +26 +17 +11 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +15 +63 +69 +59 +47 +35 +25 +16 +9 +5 +5 +2 +1 +0 +-1 +-1 +-1 +7 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +12 +61 +67 +57 +46 +34 +24 +15 +8 +3 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-42 +-44 +9 +47 +53 +47 +37 +28 +20 +13 +8 +4 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +-46 +3 +53 +62 +56 +45 +34 +25 +18 +13 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +1 +49 +60 +54 +44 +33 +24 +16 +10 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +27 +78 +82 +70 +57 +44 +32 +22 +15 +8 +0 +-7 +-14 +-20 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +16 +63 +67 +57 +45 +34 +24 +17 +10 +12 +3 +-4 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +13 +63 +67 +57 +45 +34 +23 +14 +7 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-41 +12 +45 +49 +43 +34 +25 +18 +12 +7 +4 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +7 +51 +59 +51 +41 +31 +23 +16 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +6 +63 +73 +65 +53 +41 +30 +21 +14 +8 +4 +1 +0 +-2 +-2 +-3 +-3 +-4 +-11 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-44 +-46 +13 +52 +59 +52 +42 +32 +24 +17 +12 +8 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-39 +-42 +-37 +40 +74 +71 +59 +46 +36 +26 +19 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +2 +49 +61 +54 +44 +33 +24 +16 +10 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +-44 +28 +77 +82 +70 +56 +43 +32 +22 +14 +8 +3 +0 +-2 +-4 +-4 +-5 +-5 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +-46 +15 +54 +61 +54 +44 +34 +26 +19 +14 +9 +2 +-6 +-12 +-19 +-24 +-28 +-32 +-36 +-40 +-43 +-39 +15 +47 +51 +44 +35 +27 +20 +15 +15 +13 +11 +10 +8 +8 +7 +6 +6 +-2 +-9 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-4 +41 +57 +53 +44 +34 +25 +18 +12 +8 +0 +-8 +-14 +-20 +-25 +-30 +-33 +-37 +-40 +-43 +30 +79 +83 +71 +58 +45 +33 +23 +16 +9 +5 +1 +0 +-2 +-3 +-4 +-4 +-5 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +10 +57 +67 +59 +48 +37 +28 +20 +14 +10 +2 +-6 +-12 +-19 +-24 +-29 +-32 +-36 +-40 +-43 +-45 +4 +58 +68 +61 +49 +38 +29 +21 +15 +5 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-42 +-7 +38 +54 +50 +41 +31 +23 +15 +9 +5 +3 +0 +-1 +-1 +-2 +-2 +-2 +10 +11 +2 +-5 +-12 +-18 +-24 +-28 +-32 +-36 +-40 +17 +67 +73 +62 +50 +38 +27 +18 +10 +4 +0 +-3 +-4 +-6 +-6 +-7 +-7 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-6 +42 +58 +55 +45 +35 +26 +18 +12 +8 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +23 +69 +74 +63 +50 +39 +29 +20 +14 +4 +-3 +-11 +-17 +-22 +-27 +-32 +-35 +-39 +-42 +-45 +21 +68 +73 +62 +49 +37 +27 +17 +10 +4 +0 +-3 +-5 +-6 +-7 +-7 +-3 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-43 +-46 +-48 +10 +49 +55 +48 +39 +30 +22 +15 +10 +7 +-1 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-40 +-43 +14 +67 +77 +68 +56 +44 +34 +25 +18 +12 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +1 +48 +60 +53 +43 +32 +23 +15 +9 +4 +-4 +-11 +-17 +-22 +-27 +-32 +-35 +-39 +-42 +-44 +26 +75 +80 +68 +55 +42 +31 +21 +13 +7 +3 +-1 +-2 +-4 +-5 +-6 +-5 +-6 +-12 +-18 +-24 +-29 +-32 +-37 +-40 +-43 +-45 +-46 +14 +52 +60 +53 +43 +33 +25 +18 +13 +8 +6 +4 +3 +2 +2 +2 +2 +1 +-6 +-13 +-19 +-24 +-28 +-33 +-36 +-40 +-42 +21 +77 +85 +74 +60 +48 +36 +26 +17 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-45 +18 +65 +70 +59 +48 +36 +25 +16 +10 +6 +5 +2 +1 +-1 +-1 +-1 +-1 +13 +4 +-4 +-10 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +10 +60 +66 +56 +45 +33 +23 +14 +7 +2 +-2 +-5 +-4 +-1 +-1 +-2 +-2 +-10 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +-44 +-47 +-9 +37 +53 +50 +41 +32 +23 +16 +10 +6 +3 +1 +0 +0 +-1 +-1 +-1 +22 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +16 +67 +72 +62 +50 +38 +27 +18 +10 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +8 +56 +63 +56 +45 +35 +25 +18 +11 +7 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-37 +-41 +-44 +-46 +2 +57 +68 +59 +48 +37 +27 +18 +11 +6 +3 +5 +4 +3 +3 +2 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-47 +10 +48 +54 +48 +39 +30 +22 +15 +10 +7 +-1 +-8 +-15 +-21 +-25 +-30 +-34 +-38 +-40 +-43 +11 +64 +74 +66 +54 +42 +32 +23 +16 +10 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-7 +37 +52 +48 +39 +30 +24 +17 +13 +9 +7 +5 +5 +4 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +0 +1 +6 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +5 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +5 +8 +7 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +7 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +5 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +4 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +3 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-35 +-39 +-37 +37 +69 +67 +55 +44 +34 +25 +18 +13 +4 +-4 +-10 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-42 +6 +40 +46 +42 +34 +26 +19 +14 +9 +7 +5 +4 +5 +10 +10 +9 +8 +8 +7 +7 +6 +6 +5 +5 +5 +-3 +-10 +-16 +-22 +-26 +-31 +-35 +-38 +-41 +-44 +4 +58 +67 +59 +48 +37 +27 +19 +12 +20 +9 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +13 +64 +70 +60 +48 +36 +26 +17 +10 +4 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +9 +51 +57 +50 +41 +31 +23 +16 +11 +7 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-37 +-41 +-44 +-46 +3 +53 +63 +56 +45 +35 +25 +18 +11 +6 +-2 +-9 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +3 +52 +64 +57 +47 +36 +26 +18 +11 +6 +-1 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-40 +-43 +-44 +28 +71 +73 +61 +47 +36 +26 +18 +11 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +7 +44 +49 +43 +34 +25 +17 +11 +6 +3 +-5 +-11 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +8 +61 +71 +63 +51 +40 +29 +21 +14 +9 +5 +3 +1 +0 +0 +-1 +-1 +-1 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-43 +-41 +18 +53 +58 +52 +43 +34 +25 +19 +14 +11 +2 +-5 +-12 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-44 +10 +53 +61 +54 +44 +34 +25 +19 +17 +13 +11 +9 +8 +7 +6 +5 +5 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-42 +-44 +13 +66 +73 +64 +51 +39 +29 +20 +12 +7 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +20 +71 +76 +65 +52 +40 +29 +19 +12 +6 +1 +-1 +-3 +-4 +-5 +-6 +-6 +-6 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-39 +-42 +16 +69 +75 +65 +52 +40 +28 +19 +11 +6 +1 +-1 +-3 +-4 +-5 +-6 +-6 +-6 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-42 +-45 +3 +54 +67 +61 +50 +39 +29 +21 +14 +9 +6 +4 +2 +1 +0 +0 +0 +-1 +8 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-39 +35 +71 +71 +58 +45 +34 +23 +16 +10 +5 +2 +0 +-1 +-2 +-3 +-3 +-4 +-10 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +-47 +-3 +44 +56 +50 +41 +31 +23 +18 +13 +9 +7 +5 +4 +3 +3 +2 +2 +10 +2 +-6 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +13 +62 +69 +59 +47 +35 +25 +16 +9 +5 +5 +3 +1 +0 +0 +-1 +-1 +-8 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +-2 +46 +59 +53 +43 +33 +23 +16 +10 +5 +2 +1 +-1 +-1 +3 +5 +4 +13 +4 +-3 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +15 +66 +71 +62 +49 +37 +27 +18 +10 +5 +1 +-2 +-4 +-5 +-6 +-6 +-6 +-6 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +2 +60 +71 +64 +52 +40 +29 +21 +13 +9 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-27 +38 +63 +58 +48 +38 +29 +20 +14 +10 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +23 +71 +75 +64 +51 +39 +28 +19 +12 +6 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-37 +-41 +-43 +20 +71 +75 +65 +51 +39 +28 +19 +11 +5 +12 +3 +-5 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +12 +58 +63 +52 +40 +28 +19 +11 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +-45 +-48 +0 +44 +52 +45 +35 +26 +17 +10 +5 +1 +-1 +-3 +-4 +-4 +2 +2 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +13 +67 +74 +64 +52 +40 +29 +20 +12 +7 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-42 +22 +74 +79 +68 +55 +42 +31 +21 +13 +7 +2 +0 +-3 +-4 +-5 +-5 +-6 +-6 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-42 +-45 +-47 +8 +76 +86 +74 +60 +47 +35 +25 +17 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-45 +17 +66 +71 +60 +48 +36 +26 +17 +10 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +22 +70 +75 +64 +51 +38 +28 +18 +11 +5 +-1 +-8 +-15 +-21 +-25 +-30 +-34 +-38 +-41 +-43 +-45 +22 +65 +68 +56 +43 +32 +22 +14 +8 +14 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-42 +9 +58 +63 +54 +42 +31 +20 +12 +5 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-41 +-44 +-46 +3 +49 +57 +50 +39 +29 +20 +13 +7 +3 +-5 +-11 +-17 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +1 +54 +65 +57 +46 +35 +26 +18 +12 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-43 +-9 +37 +52 +48 +39 +30 +21 +14 +8 +4 +-4 +-10 +-17 +-22 +-27 +-31 +-35 +-39 +-42 +-44 +29 +79 +83 +72 +58 +45 +33 +23 +15 +9 +1 +-7 +-13 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-46 +18 +65 +69 +58 +46 +34 +24 +17 +11 +2 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +18 +67 +71 +60 +48 +36 +25 +16 +9 +3 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-41 +18 +69 +75 +63 +51 +38 +27 +18 +10 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-36 +-39 +-42 +-45 +-47 +3 +39 +45 +39 +30 +22 +14 +8 +6 +0 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-40 +-44 +-46 +6 +58 +67 +59 +48 +37 +27 +19 +12 +7 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-37 +-40 +4 +58 +70 +62 +51 +40 +30 +21 +14 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +22 +70 +73 +63 +50 +38 +27 +18 +10 +5 +-4 +-10 +-17 +-22 +-27 +-31 +-36 +-39 +-42 +-45 +21 +71 +75 +64 +51 +39 +27 +18 +11 +5 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-38 +-42 +-44 +-28 +51 +77 +70 +56 +44 +32 +22 +14 +8 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +15 +63 +68 +57 +45 +34 +23 +14 +7 +2 +8 +-1 +-8 +-14 +-20 +-26 +-30 +-34 +-37 +-41 +13 +63 +69 +58 +46 +34 +24 +14 +7 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-2 +41 +49 +44 +34 +25 +17 +11 +6 +-2 +-9 +-15 +-21 +-26 +-31 +-34 +-38 +-41 +-44 +-47 +2 +58 +68 +60 +48 +37 +27 +18 +11 +5 +-3 +-10 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-5 +41 +58 +53 +44 +34 +25 +17 +11 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +-46 +22 +69 +72 +62 +49 +37 +27 +20 +13 +6 +-3 +-9 +-16 +-21 +-27 +-31 +-35 +-38 +-42 +-44 +18 +67 +72 +61 +48 +37 +26 +17 +9 +4 +-1 +-3 +-5 +-6 +-7 +-7 +-8 +-4 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +-1 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +6 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +-1 +0 +4 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +6 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +7 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +4 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +7 +7 +6 +6 +5 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +1 +5 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-59 +-60 +-60 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-55 +-55 +-55 +-55 +-54 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-36 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-35 +-35 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-29 +-29 +-29 +-29 +-29 +-28 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +37 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +113 +105 +98 +91 +85 +79 +73 +68 +64 +59 +59 +61 +57 +53 +50 +46 +44 +40 +38 +35 +33 +30 +28 +26 +24 +23 +21 +20 +18 +17 +16 +14 +14 +13 +12 +11 +10 +9 +9 +8 +7 +8 +13 +14 +13 +12 +11 +10 +10 +9 +9 +8 +7 +7 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +5 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +4 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +6 +5 +5 +4 +4 +3 +-4 +-11 +-17 +-22 +-27 +-31 +-35 +-39 +-41 +-44 +-46 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-60 +-60 +-60 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-59 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-56 +-55 +-55 +-55 +-55 +-54 +-54 +-54 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-37 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-35 +-35 +-34 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-30 +-29 +-29 +-29 +-29 +-28 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +116 +108 +101 +94 +87 +81 +75 +71 +66 +61 +57 +53 +49 +46 +43 +40 +37 +35 +32 +30 +28 +26 +24 +22 +21 +22 +26 +25 +23 +22 +20 +19 +18 +17 +15 +14 +13 +13 +11 +11 +10 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +3 +8 +10 +9 +8 +8 +7 +7 +6 +6 +6 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +4 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +-7 +-14 +-20 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-60 +-59 +-60 +-60 +-60 +-60 +-60 +-59 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-56 +-55 +-55 +-55 +-55 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-37 +-37 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-35 +-35 +-34 +-34 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-32 +-33 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-31 +-30 +-30 +-30 +-30 +-29 +-30 +-29 +-29 +-29 +-29 +-29 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +115 +107 +99 +93 +86 +80 +75 +70 +65 +61 +61 +63 +58 +54 +50 +47 +44 +41 +38 +36 +33 +31 +29 +27 +25 +23 +21 +20 +18 +17 +16 +15 +14 +13 +12 +11 +10 +10 +9 +8 +7 +9 +14 +14 +13 +12 +11 +11 +10 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +6 +9 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +3 +8 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +4 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-60 +-60 +-59 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-56 +-55 +-55 +-54 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-37 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-35 +-35 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-30 +-29 +-29 +-29 +-29 +-29 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +111 +104 +96 +89 +83 +78 +72 +67 +62 +58 +54 +51 +47 +44 +41 +38 +35 +33 +31 +29 +26 +25 +23 +22 +22 +27 +25 +24 +22 +21 +19 +18 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +8 +10 +9 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +1 +4 +8 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +9 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-53 +-55 +-55 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-56 +-55 +-55 +-55 +-54 +-54 +-54 +-54 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-37 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-35 +-35 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-30 +-29 +-29 +-29 +-29 +-28 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +108 +101 +93 +87 +81 +76 +70 +66 +61 +63 +63 +59 +54 +51 +48 +45 +41 +39 +36 +34 +31 +29 +27 +25 +23 +22 +20 +19 +17 +16 +15 +14 +13 +12 +11 +10 +9 +9 +8 +8 +9 +14 +14 +13 +12 +11 +10 +10 +9 +9 +7 +7 +7 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +2 +6 +9 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +3 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +18 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +-47 +-49 +-51 +-52 +-54 +-55 +-56 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-59 +-60 +-60 +-60 +-60 +-60 +-60 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-55 +-55 +-55 +-55 +-54 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-42 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-36 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-34 +-35 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-29 +-29 +-29 +-29 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-4 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +111 +103 +96 +89 +83 +77 +72 +67 +63 +58 +54 +50 +47 +44 +41 +38 +35 +33 +31 +28 +26 +25 +23 +21 +24 +27 +25 +23 +22 +20 +19 +18 +17 +16 +15 +13 +13 +11 +11 +10 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +4 +9 +10 +9 +8 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +5 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +3 +7 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +5 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +0 +4 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +4 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +2 +7 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +0 +3 +7 +7 +7 +6 +5 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +1 +6 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +2 +7 +7 +7 +7 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +1 +6 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +7 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +1 +6 +7 +7 +6 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +4 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +7 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +3 +8 +8 +7 +6 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +-3 +-10 +-16 +-21 +-26 +-30 +-35 +-38 +-41 +-43 +-46 +-48 +-50 +-51 +-53 +-54 +-55 +-56 +-57 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-59 +-60 +-59 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-56 +-55 +-55 +-55 +-55 +-54 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-37 +-38 +-37 +-37 +-37 +-37 +-36 +-36 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-34 +-35 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-29 +-29 +-29 +-29 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +2 +1 +2 +1 +1 +1 +1 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +3 +2 +2 +2 +2 +2 +2 +2 +3 +2 +2 +2 +3 +2 +3 +2 +2 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +3 +3 +2 +3 +3 +3 +3 +3 +2 +3 +3 +3 +2 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +2 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +117 +110 +102 +96 +89 +83 +77 +72 +67 +62 +58 +54 +50 +47 +43 +44 +47 +44 +41 +39 +36 +34 +31 +29 +27 +26 +24 +22 +20 +19 +17 +17 +15 +14 +13 +12 +11 +10 +9 +9 +8 +7 +7 +7 +6 +6 +6 +11 +12 +12 +11 +10 +9 +9 +8 +8 +7 +7 +6 +6 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +4 +9 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +7 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +3 +8 +7 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +14 +5 +-3 +-10 +-16 +-22 +-26 +-31 +-34 +-38 +-4 +52 +64 +58 +48 +37 +27 +19 +13 +8 +5 +3 +2 +1 +0 +0 +0 +-1 +-8 +-14 +-20 +-25 +-29 +-34 +-37 +-40 +-43 +-46 +15 +68 +77 +68 +55 +43 +33 +23 +16 +11 +7 +4 +3 +1 +1 +0 +0 +-1 +-8 +-14 +-20 +-25 +-29 +-34 +-37 +-40 +-43 +11 +69 +79 +70 +57 +45 +34 +24 +17 +11 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-40 +-42 +-45 +15 +63 +69 +59 +47 +35 +26 +17 +10 +4 +-4 +-11 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-45 +16 +67 +73 +63 +51 +38 +28 +18 +11 +5 +-2 +-10 +-16 +-21 +-26 +-31 +-35 +-38 +-41 +-4 +49 +59 +50 +38 +28 +19 +12 +6 +3 +0 +-2 +-3 +-4 +-4 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-1 +4 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +0 +1 +0 +0 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +3 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +1 +7 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +8 +6 +6 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +6 +8 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +1 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +6 +6 +5 +5 +5 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +6 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +4 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +3 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +1 +0 +0 +0 +4 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +7 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +14 +5 +-3 +-10 +-16 +-21 +-26 +-31 +-34 +-38 +-41 +-10 +45 +57 +52 +43 +33 +26 +20 +14 +11 +9 +7 +6 +5 +4 +4 +3 +-4 +-11 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-45 +-47 +9 +60 +68 +60 +49 +38 +27 +19 +13 +12 +10 +8 +6 +5 +4 +4 +3 +-4 +-11 +-17 +-23 +-27 +-32 +-35 +-39 +-42 +-45 +5 +59 +69 +60 +49 +37 +27 +18 +12 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-41 +-44 +20 +70 +76 +66 +53 +40 +30 +20 +13 +7 +-1 +-8 +-14 +-20 +-25 +-30 +-34 +-38 +-40 +-43 +-45 +14 +61 +66 +56 +45 +34 +24 +16 +10 +1 +-6 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-35 +14 +41 +43 +37 +28 +21 +14 +9 +5 +3 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +19 +74 +81 +70 +57 +44 +33 +23 +15 +9 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-3 +42 +54 +47 +38 +28 +19 +13 +10 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +3 +60 +70 +61 +50 +38 +28 +19 +12 +6 +-2 +-9 +-15 +-21 +-26 +-30 +-34 +-38 +-40 +4 +54 +66 +59 +48 +37 +27 +19 +12 +7 +-1 +-8 +-15 +-20 +-26 +-30 +-34 +-37 +-41 +-44 +-46 +2 +57 +67 +59 +47 +36 +26 +17 +10 +5 +5 +5 +4 +2 +2 +1 +1 +-7 +-13 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-46 +-48 +6 +49 +59 +52 +43 +33 +24 +16 +11 +7 +-1 +-8 +-15 +-21 +-25 +-30 +-34 +-38 +-40 +-43 +12 +58 +67 +59 +48 +37 +28 +20 +14 +9 +7 +4 +3 +2 +2 +1 +1 +0 +-7 +-14 +-19 +-25 +-29 +-33 +-37 +-40 +-42 +-14 +37 +58 +58 +49 +40 +31 +23 +17 +13 +9 +1 +-6 +-13 +-19 +-24 +-28 +-32 +-36 +-39 +-43 +16 +67 +74 +64 +52 +39 +29 +20 +14 +6 +-2 +-10 +-16 +-22 +-26 +-31 +-35 +-38 +-42 +-8 +38 +54 +50 +40 +31 +21 +14 +8 +5 +2 +0 +-1 +-2 +-3 +-3 +-3 +-3 +-10 +-16 +-22 +-27 +-31 +-35 +-39 +-41 +-44 +-46 +7 +66 +77 +68 +56 +44 +32 +23 +16 +10 +2 +-5 +-12 +-18 +-24 +-28 +-33 +-36 +-40 +-42 +-1 +44 +55 +50 +40 +31 +22 +16 +10 +2 +-6 +-12 +-19 +-24 +-29 +-33 +-37 +-40 +-43 +-45 +7 +52 +59 +52 +42 +32 +23 +15 +9 +5 +-3 +-9 +-16 +-21 +-27 +-31 +-35 +-38 +-41 +-44 +9 +62 +72 +64 +52 +41 +30 +21 +14 +9 +5 +3 +1 +0 +-1 +-1 +-1 +-1 +-9 +-15 +-21 +-25 +-30 +-34 +-37 +-28 +40 +65 +59 +49 +37 +28 +20 +13 +8 +5 +3 +2 +0 +0 +-1 +-1 +-1 +-1 +-1 +-1 +-2 +-1 +-1 +-1 +-2 +-2 +-2 +-1 +-2 +-1 +-1 +-1 +3 +7 +6 +6 +5 +5 +4 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +2 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +5 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +0 +3 +7 +7 +6 +6 +5 +5 +5 +4 +4 +3 +4 +3 +3 +2 +2 +1 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +1 +6 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +5 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +3 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +0 +1 +7 +8 +7 +6 +6 +5 +5 +5 +4 +4 +4 +4 +3 +3 +2 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +5 +8 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +0 +0 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +6 +5 +5 +5 +4 +4 +3 +3 +3 +2 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +2 +2 +2 +2 +1 +2 +1 +1 +1 +1 +1 +0 +0 +1 +0 +0 +0 +5 +8 +7 +7 +6 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +0 +1 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +1 +2 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +1 +6 +8 +7 +7 +6 +6 +5 +5 +4 +4 +4 +4 +3 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +0 +0 +0 +0 +0 +0 +0 +4 +8 +7 +6 +6 +6 +6 +5 +5 +4 +4 +4 +3 +3 +3 +2 +2 +2 +2 +1 +1 +1 +1 +1 +1 +1 +0 +0 +0 +0 +0 +2 +8 +7 +7 +6 +6 +5 +5 +5 +5 +4 +4 +3 +3 +3 +3 +2 +2 +2 +-5 +-12 +-18 +-23 +-28 +-32 +-36 +-39 +-42 +-44 +-47 +-49 +-50 +-52 +-53 +-54 +-55 +-56 +-57 +-58 +-58 +-59 +-59 +-59 +-59 +-60 +-59 +-60 +-59 +-60 +-59 +-60 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-59 +-58 +-58 +-58 +-58 +-57 +-57 +-57 +-57 +-56 +-56 +-56 +-56 +-55 +-55 +-55 +-54 +-54 +-54 +-53 +-53 +-53 +-53 +-52 +-52 +-52 +-52 +-51 +-51 +-51 +-51 +-50 +-50 +-50 +-50 +-49 +-49 +-49 +-49 +-48 +-48 +-48 +-48 +-47 +-47 +-47 +-47 +-46 +-46 +-46 +-46 +-45 +-45 +-45 +-45 +-44 +-44 +-44 +-44 +-44 +-43 +-43 +-43 +-43 +-43 +-42 +-42 +-42 +-42 +-41 +-41 +-41 +-41 +-41 +-41 +-40 +-40 +-40 +-40 +-39 +-39 +-39 +-39 +-38 +-38 +-38 +-38 +-38 +-38 +-37 +-37 +-37 +-37 +-36 +-37 +-36 +-36 +-36 +-36 +-35 +-35 +-35 +-35 +-35 +-35 +-34 +-34 +-34 +-34 +-34 +-33 +-33 +-33 +-33 +-33 +-32 +-32 +-32 +-32 +-32 +-32 +-31 +-31 +-31 +-31 +-31 +-31 +-30 +-30 +-30 +-30 +-30 +-30 +-29 +-29 +-29 +-29 +-29 +-29 +-28 +-29 +-28 +-28 +-28 +-28 +-28 +-28 +-27 +-27 +-27 +-27 +-27 +-27 +-26 +-26 +-26 +-26 +-26 +-26 +-26 +-26 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-25 +-24 +-24 +-24 +-24 +-24 +-24 +-23 +-24 +-23 +-23 +-23 +-23 +-23 +-23 +-22 +-23 +-22 +-22 +-22 +-22 +-22 +-22 +-21 +-22 +-21 +-21 +-21 +-21 +-21 +-21 +-20 +-21 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-20 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-19 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-18 +-17 +-18 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-17 +-16 +-17 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-16 +-15 +-16 +-15 +-16 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-15 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-14 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-13 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-12 +-11 +-12 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-11 +-10 +-11 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-10 +-9 +-10 +-9 +-10 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-9 +-8 +-9 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-8 +-7 +-8 +-7 +-8 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-7 +-6 +-7 +-6 +-7 +-6 +-7 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-6 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-5 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-4 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-3 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-2 +-1 +-2 +-1 +-2 +-1 +-2 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +-1 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +0 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +1 +2 +1 +2 +1 +1 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +1 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +3 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +3 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +2 +3 +3 +3 +2 +3 +3 +3 +2 +3 +2 +3 +2 +3 +2 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +2 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +2 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 +3 From 0ea561f239285376f736acdabe7203fce013901e Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 01:03:27 +0200 Subject: [PATCH 044/125] WIP adapt for cliparser and EM4x69 --- client/src/cmdlfem4x05.c | 453 ++++++++++++++++++++++++--------------- 1 file changed, 285 insertions(+), 168 deletions(-) diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index f8f88b40a..93b136981 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -35,20 +35,7 @@ #include "cmdhw.h" //////////////// 4205 / 4305 commands -static int usage_lf_em4x05_dump(void) { - PrintAndLogEx(NORMAL, "Dump EM4x05/EM4x69. Tag must be on antenna. "); - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(NORMAL, "Usage: lf em 4x05_dump [h] [f ] "); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h - this help"); - PrintAndLogEx(NORMAL, " f - overide filename prefix (optional). Default is based on UID"); - PrintAndLogEx(NORMAL, " pwd - password (hex) (optional)"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, " lf em 4x05_dump"); - PrintAndLogEx(NORMAL, " lf em 4x05_dump 11223344"); - PrintAndLogEx(NORMAL, " lf em 4x05_dump f card1 11223344"); - return PM3_SUCCESS; -} + static int usage_lf_em4x05_wipe(void) { PrintAndLogEx(NORMAL, "Wipe EM4x05/EM4x69. Tag must be on antenna. "); PrintAndLogEx(NORMAL, ""); @@ -103,6 +90,48 @@ static int usage_lf_em4x05_info(void) { return PM3_SUCCESS; } +#define EM_SERIAL_BLOCK 1 +#define EM_CONFIG_BLOCK 4 +#define EM4305_PROT1_BLOCK 14 +#define EM4305_PROT2_BLOCK 15 +#define EM4469_PROT_BLOCK 3 + +typedef enum { + EM_UNKNOWN, + EM_4205, + EM_4305, + EM_4X69, +} em_tech_type_t; + +// 1 = EM4x69 +// 2 = EM4x05 +static em_tech_type_t em_get_card_type(uint32_t config) { + uint8_t t = (config >> 1) & 0xF; + switch(t) { + case 4: + return EM_4X69; + case 8: + return EM_4205; + case 9: + return EM_4305; + } + return EM_UNKNOWN; +} + +static const char* em_get_card_str(uint32_t config) { + switch (em_get_card_type(config)) { + case EM_4305: + return "EM4305"; + case EM_4X69: + return "EM4469"; + case EM_4205: + return "EM4205"; + case EM_UNKNOWN: + break; + } + return "Unknown"; +} + // even parity COLUMN static bool EM_ColParityTest(uint8_t *bs, size_t size, uint8_t rows, uint8_t cols, uint8_t pType) { if (rows * cols > size) return false; @@ -366,37 +395,52 @@ int CmdEM4x05Demod(const char *Cmd) { } int CmdEM4x05Dump(const char *Cmd) { + + CLIParserContext *ctx; + CLIParserInit(&ctx, "lf em dump", + "Dump EM4x05/EM4x69. Tag must be on antenna.", + "lf em dump\n" + "lf em dump -p 11223344\n" + "lf em dump -f myfile -p 11223344" + ); + + void *argtable[] = { + arg_param_begin, + arg_u64_0("p", "pwd", "", "password (0x00000000)"), + arg_str0("f", "file", "", "overide filename prefix (optional). Default is based on UID"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + + uint64_t inputpwd = arg_get_u64_def(ctx, 1, 0xFFFFFFFFFFFFFFFF); + int fnlen = 0; + char filename[FILE_PATH_SIZE] = {0}; + CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)filename, FILE_PATH_SIZE, &fnlen); + CLIParserFree(ctx); + uint8_t addr = 0; uint32_t pwd = 0; - bool usePwd = false; + bool usePwd = false; + if (inputpwd != 0xFFFFFFFFFFFFFFFF) { + + if (inputpwd & 0xFFFFFFFF00000000) { + PrintAndLogEx(FAILED, "Pwd too large"); + return PM3_EINVARG; + } + + usePwd = true; + pwd = (inputpwd & 0xFFFFFFFF); + } + + uint32_t block0 = 0; + // read word 0 (chip info) + // block 0 can be read even without a password. + if (EM4x05IsBlock0(&block0) == false) + return PM3_ESOFT; + bool needReadPwd = true; - uint8_t cmdp = 0; uint8_t bytes[4] = {0}; uint32_t data[16]; - char preferredName[FILE_PATH_SIZE] = {0}; - char optchk[10]; - - while (param_getchar(Cmd, cmdp) != 0x00) { - switch (tolower(param_getchar(Cmd, cmdp))) { - case 'h': - return usage_lf_em4x05_dump(); - break; - case 'f': // since f could match in password, lets confirm it is 1 character only for an option - param_getstr(Cmd, cmdp, optchk, sizeof(optchk)); - if (strlen(optchk) == 1) { // Have a single character f so filename no password - param_getstr(Cmd, cmdp + 1, preferredName, FILE_PATH_SIZE); - cmdp += 2; - break; - } // if not a single 'f' dont break and flow onto default as should be password - - default : // for backwards-compatibility options should be > 'f' else assume its the hex password` - // for now use default input of 1 as invalid (unlikely 1 will be a valid password...) - pwd = param_get32ex(Cmd, cmdp, 1, 16); - if (pwd != 1) - usePwd = true; - cmdp++; - }; - } int success = PM3_SUCCESS; int status, status14, status15; @@ -404,105 +448,187 @@ int CmdEM4x05Dump(const char *Cmd) { bool gotLockBits = false; bool lockInPW2 = false; uint32_t word = 0; + const char *info[] = {"Info/User", "UID", "Password", "User", "Config", "User", "User", "User", "User", "User", "User", "User", "User", "User", "Lock", "Lock"}; + const char *info4x69 [] = {"Info", "UID", "Password", "Config", "User", "User", "User", "User", "User", "User", "User", "User", "User", "User", "User", "User"}; - if (usePwd) { - // Test first if a password is required - status = EM4x05ReadWord_ext(14, pwd, false, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); - needReadPwd = false; - } - } - PrintAndLogEx(NORMAL, "Addr | data | ascii |lck| info"); - PrintAndLogEx(NORMAL, "-----+----------+-------+---+-----"); + // EM4305 vs EM4469 + em_tech_type_t card_type = em_get_card_type(block0); + + PrintAndLogEx(INFO, "Found a " _GREEN_("%s") " tag", em_get_card_str(block0)); + PrintAndLogEx(NORMAL, ""); - // To flag any blocks locked we need to read blocks 14 and 15 first - // dont swap endin until we get block lock flags. - status14 = EM4x05ReadWord_ext(14, pwd, usePwd, &word); - if (status14 == PM3_SUCCESS) { - if (!usePwd) - needReadPwd = false; - if ((word & 0x00008000) != 0x00) { - lock_bits = word; - gotLockBits = true; + PrintAndLogEx(INFO, "Addr | data | ascii |lck| info"); + PrintAndLogEx(INFO, "-----+----------+-------+---+-----"); + + if ( card_type == EM_4205 || card_type == EM_4305 || card_type == EM_UNKNOWN) { + + if (usePwd) { + // Test first if a password is required + status = EM4x05ReadWord_ext(EM4305_PROT1_BLOCK, pwd, false, &word); + if (status == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); + needReadPwd = false; + } } - data[14] = word; - } else { - success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data - } - status15 = EM4x05ReadWord_ext(15, pwd, usePwd, &word); - if (status15 == PM3_SUCCESS) { - if ((word & 0x00008000) != 0x00) { // assume block 15 is the current lock block - lock_bits = word; - gotLockBits = true; - lockInPW2 = true; + + // To flag any blocks locked we need to read blocks 14 and 15 first + // dont swap endin until we get block lock flags. + status14 = EM4x05ReadWord_ext(EM4305_PROT1_BLOCK, pwd, usePwd, &word); + if (status14 == PM3_SUCCESS) { + if (!usePwd) + needReadPwd = false; + if ((word & 0x00008000) != 0x00) { + lock_bits = word; + gotLockBits = true; + } + data[EM4305_PROT1_BLOCK] = word; + } else { + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data } - data[15] = word; - } else { - success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data - } - uint32_t lockbit; - // Now read blocks 0 - 13 as we have 14 and 15 - for (; addr < 14; addr++) { - lockbit = (lock_bits >> addr) & 1; - if (addr == 2) { - if (usePwd) { - if ((needReadPwd) && (success != PM3_ESOFT)) { - data[addr] = BSWAP_32(pwd); - num_to_bytes(pwd, 4, bytes); - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); + status15 = EM4x05ReadWord_ext(EM4305_PROT2_BLOCK, pwd, usePwd, &word); + if (status15 == PM3_SUCCESS) { + if ((word & 0x00008000) != 0x00) { // assume block 15 is the current lock block + lock_bits = word; + gotLockBits = true; + lockInPW2 = true; + } + data[EM4305_PROT2_BLOCK] = word; + } else { + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + } + uint32_t lockbit; + // Now read blocks 0 - 13 as we have 14 and 15 + for (; addr < 14; addr++) { + lockbit = (lock_bits >> addr) & 1; + if (addr == 2) { + if (usePwd) { + if ((needReadPwd) && (success != PM3_ESOFT)) { + data[addr] = BSWAP_32(pwd); + num_to_bytes(pwd, 4, bytes); + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); + } else { + // The pwd is not needed for Login so we're not sure what's the actual content of that block + PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); + } } else { - // The pwd is not needed for Login so we're not sure what's the actual content of that block - PrintAndLogEx(NORMAL, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); + data[addr] = 0x00; // Unknown password, but not used to set to zeros + PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); } } else { - data[addr] = 0x00; // Unknown password, but not used to set to zeros - PrintAndLogEx(NORMAL, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); + // success &= EM4x05ReadWord_ext(addr, pwd, usePwd, &word); + status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); // Get status for single read + if (status != PM3_SUCCESS) + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + data[addr] = BSWAP_32(word); + if (status == PM3_SUCCESS) { + num_to_bytes(word, 4, bytes); + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, word, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); + } else + PrintAndLogEx(INFO, " %02u | | | | %-10s %s", addr, info[addr], status == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); } - } else { - // success &= EM4x05ReadWord_ext(addr, pwd, usePwd, &word); - status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); // Get status for single read - if (status != PM3_SUCCESS) - success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data - data[addr] = BSWAP_32(word); - if (status == PM3_SUCCESS) { - num_to_bytes(word, 4, bytes); - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %s", addr, word, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); - } else - PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); } - } - // Print blocks 14 and 15 - // Both lock bits are protected with bit idx 14 (special case) - addr = 14; - if (status14 == PM3_SUCCESS) { - lockbit = (lock_bits >> addr) & 1; - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? "" : _GREEN_("active")); + // Print blocks 14 and 15 + // Both lock bits are protected with bit idx 14 (special case) + addr = 14; + if (status14 == PM3_SUCCESS) { + lockbit = (lock_bits >> addr) & 1; + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? "" : _GREEN_("active")); + } else { + PrintAndLogEx(INFO, " %02u | | | | %-10s %s", addr, info[addr], status14 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); + } + addr = 15; + if (status15 == PM3_SUCCESS) { + lockbit = (lock_bits >> 14) & 1; // beware lock bit of word15 is pr14 + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? _GREEN_("active") : ""); + } else { + PrintAndLogEx(INFO, " %02u | | | | %-10s %s", addr, info[addr], status15 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); + } + // Update endian for files + data[14] = BSWAP_32(data[14]); + data[15] = BSWAP_32(data[15]); + + } else if (card_type == EM_4X69) { + + if (usePwd) { + // Test first if a password is required + status = EM4x05ReadWord_ext(EM4469_PROT_BLOCK, pwd, false, &word); + if (status == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); + needReadPwd = false; + } + } + + // To flag any blocks locked we need to read blocks 14 and 15 first + // dont swap endin until we get block lock flags. + status14 = EM4x05ReadWord_ext(EM4469_PROT_BLOCK, pwd, usePwd, &word); + if (status14 == PM3_SUCCESS) { + if (!usePwd) + needReadPwd = false; + if ((word & 0x00008000) != 0x00) { + lock_bits = word; + gotLockBits = true; + } + data[EM4469_PROT_BLOCK] = word; + } else { + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + } + + uint32_t lockbit; + + for (; addr < 15; addr++) { + lockbit = (lock_bits >> addr) & 1; + if (addr == 2) { + if (usePwd) { + if ((needReadPwd) && (success != PM3_ESOFT)) { + data[addr] = BSWAP_32(pwd); + num_to_bytes(pwd, 4, bytes); + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info4x69[addr]); + } else { + // The pwd is not needed for Login so we're not sure what's the actual content of that block + PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info4x69[addr]); + } + } else { + data[addr] = 0x00; // Unknown password, but not used to set to zeros + PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info4x69[addr]); + } + } else { + + status = EM4x05ReadWord_ext(addr, pwd, usePwd, &word); + if (status != PM3_SUCCESS) { + success = PM3_ESOFT; // If any error ensure fail is set so not to save invalid data + } + + data[addr] = BSWAP_32(word); + if (status == PM3_SUCCESS) { + num_to_bytes(word, 4, bytes); + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, word, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info4x69[addr]); + } else { + PrintAndLogEx(INFO, " %02u | | | | %-10s %s", addr, info4x69[addr], status == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); + } + } + } + } else { - PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status14 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); } - addr = 15; - if (status15 == PM3_SUCCESS) { - lockbit = (lock_bits >> 14) & 1; // beware lock bit of word15 is pr14 - PrintAndLogEx(NORMAL, " %02u | %08X | %s | %s | %-10s %s", addr, data[addr], sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr], lockInPW2 ? _GREEN_("active") : ""); - } else { - PrintAndLogEx(NORMAL, " %02u | | | | %-10s %s", addr, info[addr], status15 == PM3_EFAILED ? _RED_("read denied") : _RED_("read failed")); - } - // Update endian for files - data[14] = BSWAP_32(data[14]); - data[15] = BSWAP_32(data[15]); if (success == PM3_SUCCESS) { // all ok save dump to file // saveFileEML will add .eml extension to filename // saveFile (binary) passes in the .bin extension. - if (strcmp(preferredName, "") == 0) // Set default filename, if not set by user - sprintf(preferredName, "lf-4x05-%08X-dump", BSWAP_32(data[1])); + if (strcmp(filename, "") == 0) { + + if ( card_type == EM_4X69) { + sprintf(filename, "lf-4x69-%08X-dump", BSWAP_32(data[1])); + } else { + sprintf(filename, "lf-4x05-%08X-dump", BSWAP_32(data[1])); + } - saveFileEML(preferredName, (uint8_t *)data, 16 * sizeof(uint32_t), sizeof(uint32_t)); - saveFile(preferredName, ".bin", data, sizeof(data)); + } + PrintAndLogEx(NORMAL, ""); + saveFileEML(filename, (uint8_t *)data, 16 * sizeof(uint32_t), sizeof(uint32_t)); + saveFile(filename, ".bin", data, sizeof(data)); } - + PrintAndLogEx(NORMAL, ""); return success; } @@ -787,7 +913,7 @@ static void printEM4x05config(uint32_t wordData) { uint8_t pigeon = (wordData & (1 << 26)) >> 26; PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "--- " _CYAN_("Config Information") " ---------------------------"); + PrintAndLogEx(INFO, "--- " _CYAN_("Config Information") " ------------------------"); PrintAndLogEx(INFO, "ConfigWord: %08X (Word 4)", wordData); PrintAndLogEx(INFO, " Data Rate: %02u | "_YELLOW_("RF/%u"), wordData & 0x3F, datarate); PrintAndLogEx(INFO, " Encoder: %u | " _YELLOW_("%s"), encoder, enc); @@ -810,11 +936,6 @@ static void printEM4x05info(uint32_t block0, uint32_t serial) { uint8_t cap = (block0 >> 5) & 3; uint16_t custCode = (block0 >> 9) & 0x2FF; - PrintAndLogEx(INFO, " block0: %X", block0); - PrintAndLogEx(INFO, " chiptype: %X", chipType); - PrintAndLogEx(INFO, "capacitor: %X", cap); - PrintAndLogEx(INFO, " custcode: %X", custCode); - /* bits // 0, rfu // 1,2,3,4 chip type @@ -834,51 +955,35 @@ static void printEM4x05info(uint32_t block0, uint32_t serial) { PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " ---------------------------"); - char ctstr[50]; - snprintf(ctstr, sizeof(ctstr), " Chip Type: %u | ", chipType); - switch (chipType) { - case 9: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4305"); - break; - case 4: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4469"); - break; - case 8: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "EM4205"); - break; - //add more here when known - default: - snprintf(ctstr + strlen(ctstr), sizeof(ctstr) - strlen(ctstr), _YELLOW_("%s"), "Unknown"); - break; - } - PrintAndLogEx(SUCCESS, "%s", ctstr); + PrintAndLogEx(SUCCESS, " Block0: " _GREEN_("%08x") " (Word 0)", block0); + PrintAndLogEx(SUCCESS, " Chip Type: %3u | " _YELLOW_("%s"), chipType, em_get_card_str(block0)); switch (cap) { case 3: - PrintAndLogEx(SUCCESS, " Cap Type: %u | 330pF", cap); + PrintAndLogEx(SUCCESS, " Cap Type: %3u | 330pF", cap); break; case 2: - PrintAndLogEx(SUCCESS, " Cap Type: %u | %spF", cap, (chipType == 2) ? "75" : "210"); + PrintAndLogEx(SUCCESS, " Cap Type: %3u | %spF", cap, (chipType == 4) ? "75" : "210"); break; case 1: - PrintAndLogEx(SUCCESS, " Cap Type: %u | 250pF", cap); + PrintAndLogEx(SUCCESS, " Cap Type: %3u | 250pF", cap); break; case 0: - PrintAndLogEx(SUCCESS, " Cap Type: %u | no resonant capacitor", cap); + PrintAndLogEx(SUCCESS, " Cap Type: %3u | no resonant capacitor", cap); break; default: - PrintAndLogEx(SUCCESS, " Cap Type: %u | unknown", cap); + PrintAndLogEx(SUCCESS, " Cap Type: %3u | unknown", cap); break; } - PrintAndLogEx(SUCCESS, " Cust Code: %03u | %s", custCode, (custCode == 0x200) ? "Default" : "Unknown"); + PrintAndLogEx(SUCCESS, " Cust Code: 0x%x | %s", custCode, (custCode == 0x200) ? "Default" : "Unknown"); if (serial != 0) PrintAndLogEx(SUCCESS, " Serial #: " _YELLOW_("%08X"), serial); } static void printEM4x05ProtectionBits(uint32_t word, uint8_t addr) { PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "--- " _CYAN_("Protection") " ---------------------------"); + PrintAndLogEx(INFO, "--- " _CYAN_("Protection") " --------------------------------"); PrintAndLogEx(INFO, "ProtectionWord: %08X (Word %i)", word, addr); for (uint8_t i = 0; i < 15; i++) { PrintAndLogEx(INFO, " Word: %02u | %s", i, ((1 << i) & word) ? _RED_("write Locked") : "unlocked"); @@ -893,10 +998,6 @@ bool EM4x05IsBlock0(uint32_t *word) { } int CmdEM4x05Info(const char *Cmd) { -#define EM_SERIAL_BLOCK 1 -#define EM_CONFIG_BLOCK 4 -#define EM_PROT1_BLOCK 14 -#define EM_PROT2_BLOCK 15 uint32_t pwd; uint32_t word = 0, block0 = 0, serial = 0; bool usePwd = false; @@ -914,9 +1015,13 @@ int CmdEM4x05Info(const char *Cmd) { if (EM4x05IsBlock0(&block0) == false) return PM3_ESOFT; + // based on Block0 , decide type. + int card_type = em_get_card_type(block0); + // read word 1 (serial #) doesn't need pwd // continue if failed, .. non blocking fail. EM4x05ReadWord_ext(EM_SERIAL_BLOCK, 0, false, &serial); + printEM4x05info(block0, serial); // read word 4 (config block) @@ -925,21 +1030,33 @@ int CmdEM4x05Info(const char *Cmd) { return PM3_ESOFT; printEM4x05config(word); + + // if 4469 read EM4469_PROT_BLOCK + // if 4305 read 14,15 + if (card_type == EM_4205 || card_type == EM_4305) { - // read word 14 and 15 to see which is being used for the protection bits - if (EM4x05ReadWord_ext(EM_PROT1_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) { - return PM3_ESOFT; - } - if (word & 0x8000) { - printEM4x05ProtectionBits(word, EM_PROT1_BLOCK); - return PM3_SUCCESS; - } else { // if status bit says this is not the used protection word - if (EM4x05ReadWord_ext(EM_PROT2_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) + // read word 14 and 15 to see which is being used for the protection bits + if (EM4x05ReadWord_ext(EM4305_PROT1_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) { return PM3_ESOFT; - if (word & 0x8000) { - printEM4x05ProtectionBits(word, EM_PROT2_BLOCK); - return PM3_SUCCESS; } + + if (word & 0x8000) { + printEM4x05ProtectionBits(word, EM4305_PROT1_BLOCK); + return PM3_SUCCESS; + } else { // if status bit says this is not the used protection word + if (EM4x05ReadWord_ext(EM4305_PROT2_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) + return PM3_ESOFT; + if (word & 0x8000) { + printEM4x05ProtectionBits(word, EM4305_PROT2_BLOCK); + return PM3_SUCCESS; + } + } + } else if (card_type == EM_4X69) { + // read word 3 to see which is being used for the protection bits + if (EM4x05ReadWord_ext(EM4469_PROT_BLOCK, pwd, usePwd, &word) != PM3_SUCCESS) { + return PM3_ESOFT; + } + printEM4x05ProtectionBits(word, EM4469_PROT_BLOCK); } //something went wrong return PM3_ESOFT; From b7e431842e8d3cde88d1d2c63c9af6e4f23a68cb Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 01:18:45 +0200 Subject: [PATCH 045/125] em4x05_dump - also save as json --- client/src/cmdlfem4x05.c | 2 ++ client/src/fileutils.c | 27 +++++++++++++++++++++++++++ client/src/fileutils.h | 2 ++ 3 files changed, 31 insertions(+) diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index 93b136981..82e069092 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -625,6 +625,8 @@ int CmdEM4x05Dump(const char *Cmd) { } PrintAndLogEx(NORMAL, ""); + saveFileJSON(filename, (card_type == EM_4X69) ? jsfEM4x69 : jsfEM4x05, (uint8_t *)data, 16 * sizeof(uint32_t), NULL); + saveFileEML(filename, (uint8_t *)data, 16 * sizeof(uint32_t), sizeof(uint32_t)); saveFile(filename, ".bin", data, sizeof(data)); } diff --git a/client/src/fileutils.c b/client/src/fileutils.c index 9b6482a66..ab4a7d241 100644 --- a/client/src/fileutils.c +++ b/client/src/fileutils.c @@ -494,6 +494,33 @@ int saveFileJSONex(const char *preferredName, JSONFileType ftype, uint8_t *data, } break; } + case jsfEM4x05: { + JsonSaveStr(root, "FileType", "EM4205/EM4305"); + JsonSaveBufAsHexCompact(root, "$.Card.UID", data + (1 * 4), 4); + JsonSaveBufAsHexCompact(root, "$.Card.Config", data + (4 * 4), 4); + JsonSaveBufAsHexCompact(root, "$.Card.Protection1", data + (14 * 4), 4); + JsonSaveBufAsHexCompact(root, "$.Card.Protection2", data + (15 * 4), 4); + + for (size_t i = 0; i < (datalen / 4); i++) { + char path[PATH_MAX_LENGTH] = {0}; + sprintf(path, "$.blocks.%zu", i); + JsonSaveBufAsHexCompact(root, path, data + (i * 4), 4); + } + break; + } + case jsfEM4x69: { + JsonSaveStr(root, "FileType", "EM4469/EM4569"); + JsonSaveBufAsHexCompact(root, "$.Card.UID", data + (1 * 4), 4); + JsonSaveBufAsHexCompact(root, "$.Card.Protection", data + (3 * 4), 4); + JsonSaveBufAsHexCompact(root, "$.Card.Config", data + (4 * 4), 4); + + for (size_t i = 0; i < (datalen / 4); i++) { + char path[PATH_MAX_LENGTH] = {0}; + sprintf(path, "$.blocks.%zu", i); + JsonSaveBufAsHexCompact(root, path, data + (i * 4), 4); + } + break; + } case jsfMfPlusKeys: { JsonSaveStr(root, "FileType", "mfp"); JsonSaveBufAsHexCompact(root, "$.Card.UID", &data[0], 7); diff --git a/client/src/fileutils.h b/client/src/fileutils.h index d9bad1364..49992c998 100644 --- a/client/src/fileutils.h +++ b/client/src/fileutils.h @@ -64,6 +64,8 @@ typedef enum { jsfMfPlusKeys, jsfCustom, jsfMfDesfireKeys, + jsfEM4x05, + jsfEM4x69, } JSONFileType; typedef enum { From 4b70d8e6aa69427a7affa72aefe6525effed0a26 Mon Sep 17 00:00:00 2001 From: will-caruana <20567604+will-caruana@users.noreply.github.com> Date: Fri, 16 Oct 2020 21:40:03 -0400 Subject: [PATCH 046/125] Removing duplicating passwords Removing duplicating passwords: aabbccdd bbccddee ccddeeff --- client/dictionaries/t55xx_default_pwds.dic | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/client/dictionaries/t55xx_default_pwds.dic b/client/dictionaries/t55xx_default_pwds.dic index b5b981177..6e7a69583 100644 --- a/client/dictionaries/t55xx_default_pwds.dic +++ b/client/dictionaries/t55xx_default_pwds.dic @@ -47,9 +47,6 @@ EEEEEEEE FFFFFFFF a0a1a2a3 b0b1b2b3 -aabbccdd -bbccddee -ccddeeff 50415353 00000001 00000002 @@ -128,4 +125,4 @@ F1EA5EED # burtle 69314718 # ln2 57721566 # euler constant (dec) 93C467E3 # euler constant (hex) -27182818 # natural log \ No newline at end of file +27182818 # natural log From 5233e9c855e53c1525a88fe1b030599cfb703525 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 10:34:31 +0200 Subject: [PATCH 047/125] fix #1016 (thanks @mwalker33!) --- client/src/cmdlfindala.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/client/src/cmdlfindala.c b/client/src/cmdlfindala.c index 58256dbc2..c9693422d 100644 --- a/client/src/cmdlfindala.c +++ b/client/src/cmdlfindala.c @@ -567,13 +567,9 @@ static int CmdIndalaSim(const char *Cmd) { static int CmdIndalaClone(const char *Cmd) { - bool is_long_uid = false, got_cn = false, got_26 = false; - bool is_t5555 = false; int32_t cardnumber; uint32_t blocks[8] = {0}; uint8_t max = 0; - uint8_t data[7 * 4]; - int datalen = 0; uint8_t fc = 0; uint16_t cn = 0; @@ -597,13 +593,16 @@ static int CmdIndalaClone(const char *Cmd) { }; CLIExecWithReturn(ctx, Cmd, argtable, false); - is_long_uid = arg_get_lit(ctx, 1); + bool is_long_uid = arg_get_lit(ctx, 1); // raw param + int datalen = 0; + uint8_t data[(7 * 4) + 1 ]; CLIGetHexWithReturn(ctx, 3, data, &datalen); - is_t5555 = arg_get_lit(ctx, 4); - + bool is_t5555 = arg_get_lit(ctx, 4); + + bool got_cn = false, got_26 = false; if (is_long_uid == false) { // Heden param From 076372425c1e857ed542fe1a865b7f9a48ccdeca Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 10:39:15 +0200 Subject: [PATCH 048/125] lf indala clone - textual --- client/src/cmdlfindala.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/client/src/cmdlfindala.c b/client/src/cmdlfindala.c index c9693422d..9ed08d557 100644 --- a/client/src/cmdlfindala.c +++ b/client/src/cmdlfindala.c @@ -616,12 +616,14 @@ static int CmdIndalaClone(const char *Cmd) { } CLIParserFree(ctx); + + PrintAndLogEx(INFO, "Target chip " _YELLOW_("%s"), (is_t5555) ? "Q5/T5555" : "T55x7"); if (is_long_uid) { // 224 BIT UID // config for Indala (RF/32;PSK2 with RF/2;Maxblock=7) PrintAndLogEx(INFO, "Preparing to clone Indala 224bit tag"); - PrintAndLogEx(INFO, "RawID %s", sprint_hex(data, datalen)); + PrintAndLogEx(INFO, "Using raw " _GREEN_("%s"), sprint_hex_inrow(data, datalen)); if (is_t5555) blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK2 | (7 << T5555_MAXBLOCK_SHIFT); @@ -674,7 +676,7 @@ static int CmdIndalaClone(const char *Cmd) { // config for Indala 64 format (RF/32;PSK1 with RF/2;Maxblock=2) PrintAndLogEx(INFO, "Preparing to clone Indala 64bit tag"); - PrintAndLogEx(INFO, "RawID %s", sprint_hex(data, datalen)); + PrintAndLogEx(INFO, "Using raw " _GREEN_("%s"), sprint_hex_inrow(data, datalen)); if (is_t5555) blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK1 | (2 << T5555_MAXBLOCK_SHIFT); From ab749f3d2999a3bd0b14d50d8b077e19608d5f8c Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Sat, 17 Oct 2020 11:48:23 +0200 Subject: [PATCH 049/125] unsetenv -> qunsetenv (thanks @libin-ka) --- client/src/proxgui.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/proxgui.cpp b/client/src/proxgui.cpp index cda746b9a..cec64d8be 100644 --- a/client/src/proxgui.cpp +++ b/client/src/proxgui.cpp @@ -60,7 +60,7 @@ extern "C" void InitGraphics(int argc, char **argv, char *script_cmds_file, char if (getenv("DISPLAY") == NULL) return; #endif - unsetenv("SESSION_MANAGER"); + qunsetenv("SESSION_MANAGER"); main_loop_thread = new WorkerThread(script_cmds_file, script_cmd, stayInCommandLoop); gui = new ProxGuiQT(argc, argv, main_loop_thread); } From b6fd1a869475c20a96d15d624de3f02863a0067c Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Sat, 17 Oct 2020 11:53:26 +0200 Subject: [PATCH 050/125] Need Qt >= 5.1 for qunsetenv --- client/src/proxgui.cpp | 2 ++ 1 file changed, 2 insertions(+) diff --git a/client/src/proxgui.cpp b/client/src/proxgui.cpp index cec64d8be..525e64da6 100644 --- a/client/src/proxgui.cpp +++ b/client/src/proxgui.cpp @@ -60,7 +60,9 @@ extern "C" void InitGraphics(int argc, char **argv, char *script_cmds_file, char if (getenv("DISPLAY") == NULL) return; #endif +#if QT_VERSION >= 0x050100 qunsetenv("SESSION_MANAGER"); +#endif main_loop_thread = new WorkerThread(script_cmds_file, script_cmd, stayInCommandLoop); gui = new ProxGuiQT(argc, argv, main_loop_thread); } From c2d5a7d745537ffbeb591963b1b013384b0f4f2a Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 16:16:07 +0200 Subject: [PATCH 051/125] cliparser, making sure both hex and string arrays fits into max size of 256 bytes --- client/deps/cliparser/cliparser.c | 60 ++++++++++++++++++------------- 1 file changed, 35 insertions(+), 25 deletions(-) diff --git a/client/deps/cliparser/cliparser.c b/client/deps/cliparser/cliparser.c index cc82fc334..a601e6490 100644 --- a/client/deps/cliparser/cliparser.c +++ b/client/deps/cliparser/cliparser.c @@ -203,34 +203,33 @@ int CLIParserParseStringEx(CLIParserContext *ctx, const char *str, void *vargtab int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen) { *datalen = 0; - int ibuf = 0; - uint8_t tmp_buf[512] = {0}; - int res = CLIParamStrToBuf(argstr, tmp_buf, maxdatalen * 2, &ibuf); // *2 because here HEX + int tmplen = 0; + uint8_t tmpstr[(256 * 2) + 1] = {0}; + + // concat all strings in argstr into tmpstr[] + // + int res = CLIParamStrToBuf(argstr, tmpstr, sizeof(tmpstr), &tmplen); if (res) { - printf("Parameter error: buffer overflow.\n"); - fflush(stdout); return res; } - if (ibuf == 0) { + if (tmplen == 0) { return res; } - switch (param_gethex_to_eol((char *)tmp_buf, 0, data, maxdatalen, datalen)) { + res = param_gethex_to_eol((char*)tmpstr, 0, data, maxdatalen, datalen); + switch (res) { case 1: - printf("Parameter error: Invalid HEX value.\n"); - fflush(stdout); - return 1; + printf("Parameter error: Invalid HEX value\n"); + break; case 2: - printf("Parameter error: parameter too large.\n"); - fflush(stdout); - return 2; + printf("Parameter error: parameter too large\n"); + break; case 3: - printf("Parameter error: Hex string must have even number of digits.\n"); - fflush(stdout); - return 3; + printf("Parameter error: Hex string must have EVEN number of digits\n"); + break; } - - return 0; + fflush(stdout); + return res; } int CLIParamStrToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int *datalen) { @@ -238,26 +237,37 @@ int CLIParamStrToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int if (!argstr->count) return 0; - uint8_t tmp_buf[512] = {0}; + uint8_t tmpstr[(256 * 2) + 1] = {0}; int ibuf = 0; for (int i = 0; i < argstr->count; i++) { + int len = strlen(argstr->sval[i]); - memcpy(&tmp_buf[ibuf], argstr->sval[i], len); + + if (len > ( (sizeof(tmpstr) / 2 ) - ibuf)) { + printf("Parameter error: string too long (%i chars), expect MAX %zu chars\n", len + ibuf, (sizeof(tmpstr) / 2)); + fflush(stdout); + return 2; + } + + memcpy(&tmpstr[ibuf], argstr->sval[i], len); + ibuf += len; } - tmp_buf[ibuf] = 0; + + ibuf = MIN(ibuf, (sizeof(tmpstr) / 2)); + tmpstr[ibuf] = 0; - if (!ibuf) + if (ibuf == 0) return 0; - if (ibuf + 1 > maxdatalen) { - printf("Parameter error: string too long, expect max %i chars\n", maxdatalen - 1); + if (ibuf > maxdatalen) { + printf("Parameter error: string too long (%i chars), expected MAX %i chars\n", ibuf, maxdatalen); fflush(stdout); return 2; } - memcpy(data, tmp_buf, ibuf + 1); + memcpy(data, tmpstr, ibuf + 1); *datalen = ibuf; return 0; } From 66182ea85c21f78cd0efae91a8a64438ef80fc9f Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 16:33:00 +0200 Subject: [PATCH 052/125] lf motorola clone - to properly use cliparser --- client/src/cmdlfmotorola.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/client/src/cmdlfmotorola.c b/client/src/cmdlfmotorola.c index a717e6e89..c7cd16021 100644 --- a/client/src/cmdlfmotorola.c +++ b/client/src/cmdlfmotorola.c @@ -156,26 +156,36 @@ static int CmdMotorolaClone(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "lf motorola clone", - "Enables cloning of Motorola card with specified uid onto T55x7\n" - "defaults to 64.", - "lf motorola clone a0000000a0002021" + "clone Motorola UID to T55x7 or Q5/T5555 tag\n" + "defaults to 64 bit format", + "lf motorola clone -r a0000000a0002021" ); void *argtable[] = { arg_param_begin, - arg_strx1(NULL, NULL, "", NULL), + arg_strx1("r", "raw", "", "raw bytes"), + arg_lit0("q", "Q5", "optional - specify writing to Q5/T5555 tag"), arg_param_end }; CLIExecWithReturn(ctx, Cmd, argtable, false); CLIGetHexWithReturn(ctx, 1, data, &datalen); + bool is_t5555 = arg_get_lit(ctx, 2); CLIParserFree(ctx); //TODO add selection of chip for Q5 or T55x7 - // data[0] = T5555_FIXED | T5555_SET_BITRATE(32 | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT; + + PrintAndLogEx(INFO, "Target chip " _YELLOW_("%s"), (is_t5555) ? "Q5/T5555" : "T55x7"); // config for Motorola 64 format (RF/32;PSK1 with RF/2; Maxblock=2) - PrintAndLogEx(INFO, "Preparing to clone Motorola 64bit tag with RawID %s", sprint_hex(data, datalen)); - blocks[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT); + PrintAndLogEx(INFO, "Preparing to clone Motorola 64bit tag"); + PrintAndLogEx(INFO, "Using raw " _GREEN_("%s"), sprint_hex_inrow(data, datalen)); + + if (is_t5555) + blocks[0] = T5555_FIXED | T5555_SET_BITRATE(32) | T5555_MODULATION_PSK1 | 2 << T5555_MAXBLOCK_SHIFT; + else + blocks[0] = T55x7_BITRATE_RF_32 | T55x7_MODULATION_PSK1 | (2 << T55x7_MAXBLOCK_SHIFT); + + blocks[1] = bytes_to_num(data, 4); blocks[2] = bytes_to_num(data + 4, 4); From 2fbffe08947006e3ace85f34c5cee4e1a764d880 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 16:33:46 +0200 Subject: [PATCH 053/125] hf 14b sim - better help text and must use PUPI --- client/src/cmdhf14b.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c index 9056b26a9..85898fe04 100644 --- a/client/src/cmdhf14b.c +++ b/client/src/cmdhf14b.c @@ -130,7 +130,6 @@ static int CmdHF14BSim(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "hf 14b sim", "Simulate a ISO/IEC 14443 type B tag with 4 byte UID / PUPI", - "hf 14b sim\n" "hf 14b sim -u 11AA33BB" ); @@ -139,7 +138,7 @@ static int CmdHF14BSim(const char *Cmd) { arg_strx0("u", "uid", "hex", "4byte UID/PUPI"), arg_param_end }; - CLIExecWithReturn(ctx, Cmd, argtable, true); + CLIExecWithReturn(ctx, Cmd, argtable, false); uint8_t pupi[4]; int n = 0; @@ -150,6 +149,9 @@ static int CmdHF14BSim(const char *Cmd) { PrintAndLogEx(FAILED, "failed to read pupi"); return PM3_EINVARG; } + + PrintAndLogEx(INFO, "Simulate with PUPI : " _GREEN_("%s"), sprint_hex_inrow(pupi, sizeof(pupi))); + PrintAndLogEx(INFO, "Press pm3-button to abort simulation"); clearCommandBuffer(); SendCommandNG(CMD_HF_ISO14443B_SIMULATE, pupi, sizeof(pupi)); return PM3_SUCCESS; From 4d1b0f182eb7b54b60df9a7f89fea5b9b2f49780 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 16:36:58 +0200 Subject: [PATCH 054/125] hf iclass sim - textual --- client/src/cmdhficlass.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 9e61e5d89..4393787ad 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -816,6 +816,8 @@ static int CmdHFiClassSim(const char *Cmd) { case ICLASS_SIM_MODE_CSN_DEFAULT: case ICLASS_SIM_MODE_FULL: default: { + PrintAndLogEx(INFO, "Starting iCLASS simulation"); + PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel"); uint8_t numberOfCSNs = 0; clearCommandBuffer(); SendCommandMIX(CMD_HF_ICLASS_SIMULATE, sim_type, numberOfCSNs, 1, CSN, 8); From abaef4de6c7a7846e0767bee849a91f4aa59c6ac Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 17:47:58 +0200 Subject: [PATCH 055/125] hf 15 demod - dont calc crc if we didnt get enough data --- client/src/cmdhf15.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c index 407815a93..6b1b1a51b 100644 --- a/client/src/cmdhf15.c +++ b/client/src/cmdhf15.c @@ -766,7 +766,9 @@ static int CmdHF15Demod(const char *Cmd) { for (i = 0; i < k; i++) PrintAndLogEx(SUCCESS, "# %2d: %02x ", i, outBuf[i]); - PrintAndLogEx(SUCCESS, "CRC %04x", Crc15(outBuf, k - 2)); + if (k > 2) { + PrintAndLogEx(SUCCESS, "CRC %04x", Crc15(outBuf, k - 2)); + } return PM3_SUCCESS; } From 3b5cb752a440134e6b4a4014425a9a57b6cd402c Mon Sep 17 00:00:00 2001 From: tcprst Date: Sat, 17 Oct 2020 15:00:07 -0400 Subject: [PATCH 056/125] ST25TA drop field on error & buffer fixes --- client/src/cmdhfst.c | 157 +++++++++++++++++++++++++++++-------------- 1 file changed, 108 insertions(+), 49 deletions(-) diff --git a/client/src/cmdhfst.c b/client/src/cmdhfst.c index 39b47146c..2f94e355b 100644 --- a/client/src/cmdhfst.c +++ b/client/src/cmdhfst.c @@ -215,15 +215,20 @@ int infoHF_ST(void) { int aSELECT_AID_n = 0; param_gethex_to_eol("00a4040007d276000085010100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n); int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } - if (resplen < 2) + if (resplen < 2) { + DropField(); return PM3_ESOFT; + } uint16_t sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -235,12 +240,15 @@ int infoHF_ST(void) { int aSELECT_FILE_CC_n = 0; param_gethex_to_eol("00a4000c02e103", 0, aSELECT_FILE_CC, sizeof(aSELECT_FILE_CC), &aSELECT_FILE_CC_n); res = ExchangeAPDU14a(aSELECT_FILE_CC, aSELECT_FILE_CC_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting CC file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -248,12 +256,15 @@ int infoHF_ST(void) { int aREAD_CC_n = 0; param_gethex_to_eol("00b000000f", 0, aREAD_CC, sizeof(aREAD_CC), &aREAD_CC_n); res = ExchangeAPDU14a(aREAD_CC, aREAD_CC_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "reading CC file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -265,12 +276,15 @@ int infoHF_ST(void) { int aSELECT_FILE_SYS_n = 0; param_gethex_to_eol("00a4000c02e101", 0, aSELECT_FILE_SYS, sizeof(aSELECT_FILE_SYS), &aSELECT_FILE_SYS_n); res = ExchangeAPDU14a(aSELECT_FILE_SYS, aSELECT_FILE_SYS_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting system file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -280,12 +294,15 @@ int infoHF_ST(void) { int aREAD_SYS_n = 0; param_gethex_to_eol("00b0000012", 0, aREAD_SYS, sizeof(aREAD_SYS), &aREAD_SYS_n); res = ExchangeAPDU14a(aREAD_SYS, aREAD_SYS_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "reading system file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } print_st_system_info(response, resplen - 2); @@ -340,7 +357,7 @@ static int cmd_hf_st_sim(const char *Cmd) { static int cmd_hf_st_ndef(const char *Cmd) { int pwdlen = 0; - uint8_t pwd[16] = {0}; + uint8_t pwd[16 + 1] = {0}; bool with_pwd = false; CLIParserContext *ctx; @@ -377,15 +394,21 @@ static int cmd_hf_st_ndef(const char *Cmd) { int aSELECT_AID_n = 0; param_gethex_to_eol("00a4040007d276000085010100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n); int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } - if (resplen < 2) + if (resplen < 2) { + DropField(); return PM3_ESOFT; + } uint16_t sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + printf("Dropping field: 3\n"); + DropField(); return PM3_ESOFT; } @@ -397,12 +420,15 @@ static int cmd_hf_st_ndef(const char *Cmd) { int aSELECT_FILE_NDEF_n = 0; param_gethex_to_eol("00a4000c020001", 0, aSELECT_FILE_NDEF, sizeof(aSELECT_FILE_NDEF), &aSELECT_FILE_NDEF_n); res = ExchangeAPDU14a(aSELECT_FILE_NDEF, aSELECT_FILE_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -412,8 +438,10 @@ static int cmd_hf_st_ndef(const char *Cmd) { int aVERIFY_n = 0; param_gethex_to_eol("0020000100", 0, aVERIFY, sizeof(aVERIFY), &aVERIFY_n); res = ExchangeAPDU14a(aVERIFY, aVERIFY_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw == 0x6300) { @@ -421,12 +449,15 @@ static int cmd_hf_st_ndef(const char *Cmd) { param_gethex_to_eol("0020000110", 0, aVERIFY, sizeof(aVERIFY), &aVERIFY_n); memcpy(aVERIFY + aVERIFY_n, pwd, pwdlen); res = ExchangeAPDU14a(aVERIFY, aVERIFY_n + pwdlen, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Verify password failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } } @@ -437,12 +468,15 @@ static int cmd_hf_st_ndef(const char *Cmd) { int aREAD_NDEF_n = 0; param_gethex_to_eol("00b000001d", 0, aREAD_NDEF, sizeof(aREAD_NDEF), &aREAD_NDEF_n); res = ExchangeAPDU14a(aREAD_NDEF, aREAD_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "reading NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -453,7 +487,7 @@ static int cmd_hf_st_ndef(const char *Cmd) { static int cmd_hf_st_protect(const char *Cmd) { int pwdlen = 0; - uint8_t pwd[16] = {0}; + uint8_t pwd[16 + 1] = {0}; int statelen = 3; uint8_t state[3] = {0x26, 0, 0x02}; @@ -490,25 +524,23 @@ static int cmd_hf_st_protect(const char *Cmd) { if (enable_protection && disable_protection) { PrintAndLogEx(ERR, "Must specify either enable or disable protection, not both"); return PM3_EINVARG; - } else { - if (enable_protection) { - state[0] = 0x28; - } - if (disable_protection) { - state[0] = 0x26; - } + } + if (enable_protection) { + state[0] = 0x28; } - + if (disable_protection) { + state[0] = 0x26; + } + if (read_protection && write_protection) { PrintAndLogEx(ERR, "Must specify either read or write protection, not both"); return PM3_EINVARG; - } else { - if (read_protection) { - state[2] = 0x01; - } - if (write_protection) { - state[2] = 0x02; - } + } + if (read_protection) { + state[2] = 0x01; + } + if (write_protection) { + state[2] = 0x02; } if (pwdlen != 16) { @@ -526,15 +558,20 @@ static int cmd_hf_st_protect(const char *Cmd) { int aSELECT_AID_n = 0; param_gethex_to_eol("00a4040007d276000085010100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n); int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } - if (resplen < 2) + if (resplen < 2) { + DropField(); return PM3_ESOFT; + } uint16_t sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -546,12 +583,15 @@ static int cmd_hf_st_protect(const char *Cmd) { int aSELECT_FILE_NDEF_n = 0; param_gethex_to_eol("00a4000c020001", 0, aSELECT_FILE_NDEF, sizeof(aSELECT_FILE_NDEF), &aSELECT_FILE_NDEF_n); res = ExchangeAPDU14a(aSELECT_FILE_NDEF, aSELECT_FILE_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -562,12 +602,15 @@ static int cmd_hf_st_protect(const char *Cmd) { param_gethex_to_eol("0020000210", 0, aVERIFY, sizeof(aVERIFY), &aVERIFY_n); memcpy(aVERIFY + aVERIFY_n, pwd, pwdlen); res = ExchangeAPDU14a(aVERIFY, aVERIFY_n + pwdlen, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Verify password failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -578,12 +621,15 @@ static int cmd_hf_st_protect(const char *Cmd) { param_gethex_to_eol("00", 0, aPROTECT, sizeof(aPROTECT), &aPROTECT_n); memcpy(aPROTECT + aPROTECT_n, state, statelen); res = ExchangeAPDU14a(aPROTECT, aPROTECT_n + statelen, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "changing protection failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -596,9 +642,9 @@ static int cmd_hf_st_protect(const char *Cmd) { static int cmd_hf_st_pwd(const char *Cmd) { int pwdlen = 0; - uint8_t pwd[16] = {0}; + uint8_t pwd[16 + 1] = {0}; int newpwdlen = 0; - uint8_t newpwd[16] = {0}; + uint8_t newpwd[16 + 1] = {0}; int changePwdlen = 4; uint8_t changePwd[4] = {0x24, 0x00, 0x01, 0x10}; bool change_read_password = false; @@ -629,15 +675,14 @@ static int cmd_hf_st_pwd(const char *Cmd) { if (change_read_password && change_write_password) { PrintAndLogEx(ERR, "Must specify either read or write, not both"); return PM3_EINVARG; - } else { - if (change_read_password) { - changePwd[2] = 0x01; - } - if (change_write_password) { - changePwd[2] = 0x02; - } } - + if (change_read_password) { + changePwd[2] = 0x01; + } + if (change_write_password) { + changePwd[2] = 0x02; + } + if (pwdlen != 16) { PrintAndLogEx(ERR, "Original write password must be 16 hex bytes"); return PM3_EINVARG; @@ -657,15 +702,20 @@ static int cmd_hf_st_pwd(const char *Cmd) { int aSELECT_AID_n = 0; param_gethex_to_eol("00a4040007d276000085010100", 0, aSELECT_AID, sizeof(aSELECT_AID), &aSELECT_AID_n); int res = ExchangeAPDU14a(aSELECT_AID, aSELECT_AID_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } - if (resplen < 2) + if (resplen < 2) { + DropField(); return PM3_ESOFT; + } uint16_t sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -677,12 +727,15 @@ static int cmd_hf_st_pwd(const char *Cmd) { int aSELECT_FILE_NDEF_n = 0; param_gethex_to_eol("00a4000c020001", 0, aSELECT_FILE_NDEF, sizeof(aSELECT_FILE_NDEF), &aSELECT_FILE_NDEF_n); res = ExchangeAPDU14a(aSELECT_FILE_NDEF, aSELECT_FILE_NDEF_n, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF file failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -693,12 +746,15 @@ static int cmd_hf_st_pwd(const char *Cmd) { param_gethex_to_eol("0020000210", 0, aVERIFY, sizeof(aVERIFY), &aVERIFY_n); memcpy(aVERIFY + aVERIFY_n, pwd, pwdlen); res = ExchangeAPDU14a(aVERIFY, aVERIFY_n + pwdlen, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Verify password failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } @@ -711,12 +767,15 @@ static int cmd_hf_st_pwd(const char *Cmd) { memcpy(aCHG_PWD + aCHG_PWD_n, changePwd, changePwdlen); memcpy(aCHG_PWD + aCHG_PWD_n + changePwdlen, newpwd, newpwdlen); res = ExchangeAPDU14a(aCHG_PWD, aCHG_PWD_n + changePwdlen + newpwdlen, activate_field, keep_field_on, response, sizeof(response), &resplen); - if (res) + if (res) { + DropField(); return res; + } sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "password change failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); + DropField(); return PM3_ESOFT; } PrintAndLogEx(SUCCESS, " %s password changed", ((changePwd[2] & 0x01) == 0x01) ? _YELLOW_("read") : _YELLOW_("write")); From 4a5e58281b3023b6799627576fdb0c1f5b4b5a8c Mon Sep 17 00:00:00 2001 From: tcprst Date: Sat, 17 Oct 2020 15:00:55 -0400 Subject: [PATCH 057/125] remove debug print --- client/src/cmdhfst.c | 1 - 1 file changed, 1 deletion(-) diff --git a/client/src/cmdhfst.c b/client/src/cmdhfst.c index 2f94e355b..502e6413a 100644 --- a/client/src/cmdhfst.c +++ b/client/src/cmdhfst.c @@ -407,7 +407,6 @@ static int cmd_hf_st_ndef(const char *Cmd) { uint16_t sw = get_sw(response, resplen); if (sw != 0x9000) { PrintAndLogEx(ERR, "Selecting NDEF aid failed (%04x - %s).", sw, GetAPDUCodeDescription(sw >> 8, sw & 0xff)); - printf("Dropping field: 3\n"); DropField(); return PM3_ESOFT; } From 8c7f1e0609c436c1aeb54d2f041eced2ccebef08 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 23:09:34 +0200 Subject: [PATCH 058/125] fix bad param sanity checks --- client/src/cmdhficlass.c | 40 ++++++++++++++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 4393787ad..bd5254c1b 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -1563,7 +1563,7 @@ static int CmdHFiClassDump(const char *Cmd) { } } - if ((use_replay + rawkey + elite) > 0) { + if ((use_replay + rawkey + elite) > 1) { PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); errors = true; } @@ -1920,7 +1920,7 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { if (got_blockno == false) errors = true; - if ((use_replay + rawkey + elite) > 0) { + if ((use_replay + rawkey + elite) > 1) { PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); errors = true; } @@ -2252,7 +2252,7 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { if (got_blockno == false) errors = true; - if ((use_replay + rawkey + elite) > 0) { + if ((use_replay + rawkey + elite) > 1) { PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); errors = true; } @@ -2807,6 +2807,12 @@ static void add_key(uint8_t *key) { } } +/* +static int iclass_chk_keys(void) { + return PM3_SUCCESS; +} +*/ + static int CmdHFiClassCheckKeys(const char *Cmd) { // empty string @@ -3290,7 +3296,6 @@ static int CmdHFiClassPermuteKey(const char *Cmd) { uint8_t key[8] = {0}; uint8_t data[16] = {0}; - bool isReverse = false; int len = 0; CLIParserContext *ctx; @@ -3307,7 +3312,7 @@ static int CmdHFiClassPermuteKey(const char *Cmd) { }; CLIExecWithReturn(ctx, Cmd, argtable, false); - isReverse = arg_get_lit(ctx, 1); + bool isReverse = arg_get_lit(ctx, 1); CLIGetHexWithReturn(ctx, 2, data, &len); @@ -3329,6 +3334,28 @@ static int CmdHFiClassPermuteKey(const char *Cmd) { return PM3_SUCCESS; } +static int CmdHFiClassAutopwn(const char *Cmd) { + + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf iclass autopwn", + "Tries to check keys, if found, dump card and save file", + "hf iclass autopwn\n"); + + void *argtable[] = { + arg_param_begin, + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + CLIParserFree(ctx); + + // Check keys. + + // dump + + PrintAndLogEx(INFO, "to be implemented"); + return PM3_SUCCESS; +} + static command_t CommandTable[] = { {"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("operations") " ---------------------"}, {"help", CmdHelp, AlwaysAvailable, "This help"}, @@ -3343,7 +3370,8 @@ static command_t CommandTable[] = { {"wrbl", CmdHFiClass_WriteBlock, IfPm3Iclass, "[options..] Write Picopass / iCLASS block"}, {"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("recovery") " ---------------------"}, - {"chk", CmdHFiClassCheckKeys, AlwaysAvailable, "[options..] Check keys"}, + {"autopwn", CmdHFiClassAutopwn, IfPm3Iclass, "[options..] Automatic key recovery tool for iCLASS"}, + {"chk", CmdHFiClassCheckKeys, IfPm3Iclass, "[options..] Check keys"}, {"loclass", CmdHFiClass_loclass, AlwaysAvailable, "[options..] Use loclass to perform bruteforce reader attack"}, {"lookup", CmdHFiClassLookUp, AlwaysAvailable, "[options..] Uses authentication trace to check for key in dictionary file"}, {"-----------", CmdHelp, AlwaysAvailable, "--------------------- " _CYAN_("simulation") " ---------------------"}, From 2b77c732b1debdf73b42939d43f7ecc86f720ebe Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sat, 17 Oct 2020 23:10:23 +0200 Subject: [PATCH 059/125] hf 15 demod, and others uses cliparser and different output --- client/src/cmdhf15.c | 230 +++++++++++++++++++++++++++---------------- 1 file changed, 145 insertions(+), 85 deletions(-) diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c index 6b1b1a51b..da433a010 100644 --- a/client/src/cmdhf15.c +++ b/client/src/cmdhf15.c @@ -34,6 +34,7 @@ #include "crc16.h" // iso15 crc #include "cmddata.h" // getsamples #include "fileutils.h" // savefileEML +#include "cliparser.h" #define FrameSOF Iso15693FrameSOF #define Logic0 Iso15693Logic0 @@ -209,16 +210,6 @@ const productName_t uidmapping[] = { static int CmdHF15Help(const char *Cmd); -static int usage_15_demod(void) { - PrintAndLogEx(NORMAL, "Tries to demodulate / decode ISO15693, from downloaded samples.\n" - "Gather samples with 'hf 15 read' / 'hf 15 record'"); - return PM3_SUCCESS; -} -static int usage_15_samples(void) { - PrintAndLogEx(NORMAL, "Acquire samples as Reader (enables carrier, send inquiry\n" - "and download it to graphbuffer. Try 'hf 15 demod' to try to demodulate/decode signal"); - return PM3_SUCCESS; -} static int usage_15_info(void) { PrintAndLogEx(NORMAL, "Uses the optional command 'get_systeminfo' 0x2B to try and extract information\n" "command may fail, depending on tag.\n" @@ -235,36 +226,7 @@ static int usage_15_info(void) { _YELLOW_("\thf 15 info u")); return PM3_SUCCESS; } -static int usage_15_record(void) { - PrintAndLogEx(NORMAL, "Record activity without enabling carrier"); - return PM3_SUCCESS; -} -static int usage_15_reader(void) { - PrintAndLogEx(NORMAL, "This command identifies a ISO 15693 tag\n" - "\n" - "Usage: hf 15 reader [h]\n" - "Options:\n" - "\th this help\n" - "\t1 read once\n" - "\n" - "Example:\n" - _YELLOW_("\thf 15 reader\n") - _YELLOW_("\thf 15 reader 1\n")); - return PM3_SUCCESS; -} -static int usage_15_sim(void) { - PrintAndLogEx(NORMAL, "Usage: hf 15 sim \n" - "\n" - "Example:\n" - _YELLOW_("\thf 15 sim E016240000000000")); - return PM3_SUCCESS; -} -static int usage_15_findafi(void) { - PrintAndLogEx(NORMAL, "This command attempts to brute force AFI of an ISO15693 tag\n" - "\n" - "Usage: hf 15 findafi"); - return PM3_SUCCESS; -} + static int usage_15_writeafi(void) { PrintAndLogEx(NORMAL, "Usage: hf 15 writeafi \n" "\tuid (either): \n" @@ -358,17 +320,6 @@ static int usage_15_readmulti(void) { "\t 1-6, number of pages"); return PM3_SUCCESS; } -static int usage_15_csetuid(void) { - PrintAndLogEx(NORMAL, "Set UID for magic Chinese card (only works with such cards)\n" - "\n" - "Usage: hf 15 csetuid \n" - "Options:\n" - "\tuid : <8B hex> full UID eg E011223344556677\n" - "\n" - "Example:\n" - _YELLOW_("\thf 15 csetuid E011223344556677")); - return PM3_SUCCESS; -} static int nxp_15693_print_signature(uint8_t *uid, uint8_t *signature) { @@ -691,17 +642,31 @@ static bool prepareHF15Cmd(char **cmd, uint16_t *reqlen, uint8_t *arg1, uint8_t } // Mode 3 -//helptext static int CmdHF15Demod(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'h') return usage_15_demod(); + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 demod", + "Tries to demodulate / decode ISO15693, from downloaded samples.\n" + "Gather samples with 'hf 15 samples' / 'hf 15 sniff'", + "hf 15 demod\n"); + + void *argtable[] = { + arg_param_begin, + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + CLIParserFree(ctx); + // The sampling rate is 106.353 ksps/s, for T = 18.8 us int i, j; int max = 0, maxPos = 0; int skip = 4; - if (GraphTraceLen < 1000) return PM3_ESOFT; + if (GraphTraceLen < 1000) { + PrintAndLogEx(FAILED, "Too few samples in GraphBuffer. Need more than 1000"); + PrintAndLogEx(HINT, "Run " _YELLOW_("`hf 15 samples`") " to collect and download data"); + return PM3_ESOFT; + } // First, correlate for SOF for (i = 0; i < 1000; i++) { @@ -719,7 +684,7 @@ static int CmdHF15Demod(const char *Cmd) { i = maxPos + ARRAYLEN(FrameSOF) / skip; int k = 0; - uint8_t outBuf[20]; + uint8_t outBuf[2048] = {0}; memset(outBuf, 0, sizeof(outBuf)); uint8_t mask = 0x01; for (;;) { @@ -746,42 +711,80 @@ static int CmdHF15Demod(const char *Cmd) { } else { i += ARRAYLEN(Logic0) / skip; } + mask <<= 1; if (mask == 0) { k++; mask = 0x01; } + if ((i + (int)ARRAYLEN(FrameEOF)) >= GraphTraceLen) { PrintAndLogEx(INFO, "ran off end!"); break; } + + if (k > 2048) { + PrintAndLogEx(INFO, "ran out of buffer"); + break; + } } if (mask != 0x01) { PrintAndLogEx(WARNING, "Warning, uneven octet! (discard extra bits!)"); PrintAndLogEx(INFO, " mask = %02x", mask); } - PrintAndLogEx(INFO, "%d octets", k); - - for (i = 0; i < k; i++) - PrintAndLogEx(SUCCESS, "# %2d: %02x ", i, outBuf[i]); - - if (k > 2) { - PrintAndLogEx(SUCCESS, "CRC %04x", Crc15(outBuf, k - 2)); + + if ( k == 0 ) { + return PM3_SUCCESS; } + + i = 0; + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "Got %d octets, decoded as following", k); + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(SUCCESS, " idx | data"); + PrintAndLogEx(SUCCESS, "-----+-------------------------------------------------"); + if ( k / 16 > 0) { + for (; i < k; i += 16) { + PrintAndLogEx(SUCCESS, " %3i | %s", i, sprint_hex(outBuf + i, 16)); + } + } + + uint8_t mod = (k % 16); + if (mod > 0) { + PrintAndLogEx(SUCCESS, " %3i | %s", i, sprint_hex(outBuf + i, mod)); + } + PrintAndLogEx(SUCCESS, "-----+-------------------------------------------------"); + if (k > 2) { + PrintAndLogEx(SUCCESS, "--> CRC %04x", Crc15(outBuf, k - 2)); + } + PrintAndLogEx(NORMAL, ""); return PM3_SUCCESS; } // * Acquire Samples as Reader (enables carrier, sends inquiry) //helptext static int CmdHF15Samples(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'h') return usage_15_samples(); + + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 samples", + "Acquire samples as Reader (enables carrier, send inquiry\n" + "and download it to graphbuffer. Try 'hf 15 demod' to try to demodulate/decode signal", + "hf 15 samples"); + + void *argtable[] = { + arg_param_begin, + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); + CLIParserFree(ctx); clearCommandBuffer(); SendCommandNG(CMD_HF_ISO15693_ACQ_RAW_ADC, NULL, 0); getSamples(0, true); + + PrintAndLogEx(HINT, "Try `" _YELLOW_("hf 15 demod") "` to decode signal"); return PM3_SUCCESS; } @@ -1042,12 +1045,20 @@ static int CmdHF15Info(const char *Cmd) { return PM3_SUCCESS; } -// Record Activity without enabling carrier -//helptext +// Sniff Activity without enabling carrier static int CmdHF15Sniff(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'h') return usage_15_record(); + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 sniff", + "Sniff activity without enabling carrier", + "hf 15 sniff\n"); + void *argtable[] = { + arg_param_begin, + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + CLIParserFree(ctx); + PacketResponseNG resp; clearCommandBuffer(); SendCommandNG(CMD_HF_ISO15693_SNIFF, NULL, 0); @@ -1060,10 +1071,23 @@ static int CmdHF15Sniff(const char *Cmd) { } static int CmdHF15Reader(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'h') return usage_15_reader(); - bool loop_read = (cmdp == '1') ? false : true; + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 reader", + "This command continues loops and tries to identify ISO 15693 tags\n", + "hf 15 reader\n" + "hf 15 reader -1"); + void *argtable[] = { + arg_param_begin, + arg_lit0("", NULL, "read once"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + bool loop_read = arg_get_lit(ctx, 1); + CLIParserFree(ctx); + + PrintAndLogEx(INFO, "Starting ISO15 reader mode"); + PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel"); readHF15Uid(loop_read, true); return PM3_SUCCESS; } @@ -1071,19 +1095,34 @@ static int CmdHF15Reader(const char *Cmd) { // Simulation is still not working very good // helptext static int CmdHF15Sim(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (strlen(Cmd) < 1 || cmdp == 'h') return usage_15_sim(); + + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 sim", + "Simulate a ISO15693 tag\n", + "hf 15 sim -u E011223344556677"); + + void *argtable[] = { + arg_param_begin, + arg_str1("u", "uid", "<8b hex>", "UID eg E011223344556677"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); struct { uint8_t uid[8]; } PACKED payload; + + int uidlen = 0; + CLIGetHexWithReturn(ctx, 1, payload.uid, &uidlen); + CLIParserFree(ctx); - if (param_gethex(Cmd, 0, payload.uid, 16)) { + if (uidlen != 9) { PrintAndLogEx(WARNING, "UID must include 16 HEX symbols"); return PM3_EINVARG; } PrintAndLogEx(SUCCESS, "Starting simulating UID " _YELLOW_("%s"), iso15693_sprintUID(NULL, payload.uid)); + PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel"); PacketResponseNG resp; clearCommandBuffer(); @@ -1096,17 +1135,25 @@ static int CmdHF15Sim(const char *Cmd) { // (There is no standard way of reading the AFI, although some tags support this) // helptext static int CmdHF15FindAfi(const char *Cmd) { - PacketResponseNG resp; - uint32_t timeout = 0; + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 findafi", + "This command attempts to brute force AFI of an ISO15693 tag\n", + "hf 15 findafi"); - char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'h') return usage_15_findafi(); + void *argtable[] = { + arg_param_begin, + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); + CLIParserFree(ctx); PrintAndLogEx(SUCCESS, "press pm3-button to cancel"); clearCommandBuffer(); + PacketResponseNG resp; SendCommandMIX(CMD_HF_ISO15693_FINDAFI, strtol(Cmd, NULL, 0), 0, 0, NULL, 0); + uint32_t timeout = 0; while (!WaitForResponseTimeout(CMD_ACK, &resp, 2000)) { timeout++; @@ -1842,16 +1889,28 @@ static int CmdHF15Restore(const char *Cmd) { */ static int CmdHF15CSetUID(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (strlen(Cmd) < 1 || cmdp == 'h') return usage_15_csetuid(); + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf 15 csetuid", + "Set UID for magic Chinese card (only works with such cards)\n", + "hf 15 csetuid -u E011223344556677"); + void *argtable[] = { + arg_param_begin, + arg_str1("u", "uid", "<8b hex>", "UID eg E011223344556677"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, false); struct { uint8_t uid[8]; } PACKED payload; - - if (param_gethex(Cmd, 0, payload.uid, 16)) { - PrintAndLogEx(WARNING, "UID must include 16 HEX symbols"); + + int uidlen = 0; + CLIGetHexWithReturn(ctx, 1, payload.uid, &uidlen); + CLIParserFree(ctx); + + if (uidlen != 8) { + PrintAndLogEx(WARNING, "UID must include 16 HEX symbols got "); return PM3_EINVARG; } @@ -1874,9 +1933,10 @@ static int CmdHF15CSetUID(const char *Cmd) { PacketResponseNG resp; clearCommandBuffer(); SendCommandNG(CMD_HF_ISO15693_CSETUID, (uint8_t *)&payload, sizeof(payload)); - if (WaitForResponseTimeout(CMD_HF_ISO15693_CSETUID, &resp, 2000) == false) { PrintAndLogEx(WARNING, "timeout while waiting for reply"); + DropField(); + return PM3_ESOFT; } PrintAndLogEx(INFO, "getting updated card details..."); From 41286b823092904fe1367177e99ab9bed31bf2dd Mon Sep 17 00:00:00 2001 From: tcprst Date: Sat, 17 Oct 2020 17:38:49 -0400 Subject: [PATCH 060/125] remove cliparser buffer bandaid --- client/src/cmdhfst.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/client/src/cmdhfst.c b/client/src/cmdhfst.c index 502e6413a..f48db7e73 100644 --- a/client/src/cmdhfst.c +++ b/client/src/cmdhfst.c @@ -357,7 +357,7 @@ static int cmd_hf_st_sim(const char *Cmd) { static int cmd_hf_st_ndef(const char *Cmd) { int pwdlen = 0; - uint8_t pwd[16 + 1] = {0}; + uint8_t pwd[16] = {0}; bool with_pwd = false; CLIParserContext *ctx; @@ -486,7 +486,7 @@ static int cmd_hf_st_ndef(const char *Cmd) { static int cmd_hf_st_protect(const char *Cmd) { int pwdlen = 0; - uint8_t pwd[16 + 1] = {0}; + uint8_t pwd[16] = {0}; int statelen = 3; uint8_t state[3] = {0x26, 0, 0x02}; @@ -641,9 +641,9 @@ static int cmd_hf_st_protect(const char *Cmd) { static int cmd_hf_st_pwd(const char *Cmd) { int pwdlen = 0; - uint8_t pwd[16 + 1] = {0}; + uint8_t pwd[16] = {0}; int newpwdlen = 0; - uint8_t newpwd[16 + 1] = {0}; + uint8_t newpwd[16] = {0}; int changePwdlen = 4; uint8_t changePwd[4] = {0x24, 0x00, 0x01, 0x10}; bool change_read_password = false; From e016582e1fd9f408bb39efcb371668c6a02a130c Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 18 Oct 2020 00:15:09 +0200 Subject: [PATCH 061/125] textual --- client/src/cmdhf15.c | 2 +- client/src/cmdhficlass.c | 32 ++++++++++++++++++-------------- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c index da433a010..73a7778a8 100644 --- a/client/src/cmdhf15.c +++ b/client/src/cmdhf15.c @@ -1073,7 +1073,7 @@ static int CmdHF15Sniff(const char *Cmd) { static int CmdHF15Reader(const char *Cmd) { CLIParserContext *ctx; CLIParserInit(&ctx, "hf 15 reader", - "This command continues loops and tries to identify ISO 15693 tags\n", + "Act as a ISO15693 reader. Look for ISO15693 tags until Enter or the pm3 button is pressed\n", "hf 15 reader\n" "hf 15 reader -1"); diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index bd5254c1b..4e065090c 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -272,17 +272,6 @@ static int usage_hf_iclass_managekeys(void) { PrintAndLogEx(NORMAL, ""); return PM3_SUCCESS; } -static int usage_hf_iclass_reader(void) { - PrintAndLogEx(NORMAL, "Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed\n"); - PrintAndLogEx(NORMAL, "Usage: hf iclass reader [h] [1]\n"); - PrintAndLogEx(NORMAL, "Options:"); - PrintAndLogEx(NORMAL, " h Show this help"); - PrintAndLogEx(NORMAL, " 1 read only 1 tag"); - PrintAndLogEx(NORMAL, "Examples:"); - PrintAndLogEx(NORMAL, _YELLOW_("\thf iclass reader 1")); - PrintAndLogEx(NORMAL, ""); - return PM3_SUCCESS; -} static int usage_hf_iclass_loclass(void) { PrintAndLogEx(NORMAL, "Execute the offline part of loclass attack"); PrintAndLogEx(NORMAL, " An iclass dumpfile is assumed to consist of an arbitrary number of"); @@ -875,10 +864,25 @@ int read_iclass_csn(bool loop, bool verbose) { } static int CmdHFiClassReader(const char *Cmd) { - char cmdp = tolower(param_getchar(Cmd, 0)); - if (cmdp == 'h') return usage_hf_iclass_reader(); - bool loop_read = (cmdp == '1') ? false : true; + CLIParserContext *ctx; + CLIParserInit(&ctx, "hf iclass reader", + "Act as a iCLASS reader. Look for iCLASS tags until Enter or the pm3 button is pressed\n", + "hf iclass reader\n" + "hf iclass reader -1"); + + void *argtable[] = { + arg_param_begin, + arg_lit0("", NULL, "read once"), + arg_param_end + }; + CLIExecWithReturn(ctx, Cmd, argtable, true); + bool loop_read = arg_get_lit(ctx, 1); + CLIParserFree(ctx); + + + PrintAndLogEx(INFO, "Starting iCLASS reader mode"); + PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel"); return read_iclass_csn(loop_read, true); } From 452323fc11a72c4fcddc2daa6cc2245f32259837 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 18 Oct 2020 00:46:15 +0200 Subject: [PATCH 062/125] take notice of read_once vs looping --- client/src/cmdhf15.c | 6 +++--- client/src/cmdhficlass.c | 7 +++---- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c index 73a7778a8..b4cde234f 100644 --- a/client/src/cmdhf15.c +++ b/client/src/cmdhf15.c @@ -1079,16 +1079,16 @@ static int CmdHF15Reader(const char *Cmd) { void *argtable[] = { arg_param_begin, - arg_lit0("", NULL, "read once"), + arg_lit0("1", "one", "read once"), arg_param_end }; CLIExecWithReturn(ctx, Cmd, argtable, true); - bool loop_read = arg_get_lit(ctx, 1); + bool read_once = arg_get_lit(ctx, 1); CLIParserFree(ctx); PrintAndLogEx(INFO, "Starting ISO15 reader mode"); PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel"); - readHF15Uid(loop_read, true); + readHF15Uid(!read_once, true); return PM3_SUCCESS; } diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 4e065090c..5a5e07373 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -873,17 +873,16 @@ static int CmdHFiClassReader(const char *Cmd) { void *argtable[] = { arg_param_begin, - arg_lit0("", NULL, "read once"), + arg_lit0("1", "one", "read once"), arg_param_end }; CLIExecWithReturn(ctx, Cmd, argtable, true); - bool loop_read = arg_get_lit(ctx, 1); + bool read_once = arg_get_lit(ctx, 1); CLIParserFree(ctx); - PrintAndLogEx(INFO, "Starting iCLASS reader mode"); PrintAndLogEx(INFO, "press " _YELLOW_("`enter`") " to cancel"); - return read_iclass_csn(loop_read, true); + return read_iclass_csn(!read_once, true); } static int CmdHFiClassELoad(const char *Cmd) { From a36001ca03caef4924a8009421115a58573f92c7 Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Sun, 18 Oct 2020 11:50:20 +0200 Subject: [PATCH 063/125] hf iclass dump/view/decrypt - output redesign --- client/src/cmdhficlass.c | 433 ++++++++++++++++++++++++--------------- 1 file changed, 266 insertions(+), 167 deletions(-) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index 5a5e07373..dd025852f 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -424,57 +424,55 @@ uint8_t get_pagemap(const picopass_hdr *hdr) { } static void fuse_config(const picopass_hdr *hdr) { + + uint16_t otp = (hdr->conf.otp[1] << 8 | hdr->conf.otp[0]); + + PrintAndLogEx(INFO, " Raw: " _YELLOW_("%s"), sprint_hex((uint8_t*)&hdr->conf, 8)); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "..................... App limit", hdr->conf.app_limit); + PrintAndLogEx(INFO, " " _YELLOW_("%04X") " ( %5u )...... OTP", otp, otp); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "............ Block write lock", hdr->conf.block_writelock); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "......... Chip", hdr->conf.chip_config); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "...... Mem", hdr->conf.mem_config); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "... EAS", hdr->conf.eas); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") " Fuses", hdr->conf.fuses); + uint8_t fuses = hdr->conf.fuses; + PrintAndLogEx(INFO, " Fuses:"); if (isset(fuses, FUSE_FPERS)) - PrintAndLogEx(SUCCESS, " Mode: " _GREEN_("Personalization (programmable)")); + PrintAndLogEx(SUCCESS, " mode..... " _GREEN_("Personalization (programmable)")); else - PrintAndLogEx(SUCCESS, " Mode: " _YELLOW_("Application (locked)")); + PrintAndLogEx(SUCCESS, " mode..... " _YELLOW_("Application (locked)")); if (isset(fuses, FUSE_CODING1)) { - PrintAndLogEx(SUCCESS, "Coding: RFU"); + PrintAndLogEx(SUCCESS, " coding.. RFU"); } else { if (isset(fuses, FUSE_CODING0)) - PrintAndLogEx(SUCCESS, "Coding: " _YELLOW_("ISO 14443-2 B / 15693")); + PrintAndLogEx(SUCCESS, " coding... " _YELLOW_("ISO 14443-2 B / 15693")); else - PrintAndLogEx(SUCCESS, "Coding: " _YELLOW_("ISO 14443-B only")); + PrintAndLogEx(SUCCESS, " coding... " _YELLOW_("ISO 14443-B only")); } uint8_t pagemap = get_pagemap(hdr); switch (pagemap) { case 0x0: - PrintAndLogEx(INFO, " Crypt: No auth possible. Read only if RA is enabled"); + PrintAndLogEx(INFO, " crypt.... No auth possible. Read only if RA is enabled"); break; case 0x1: - PrintAndLogEx(SUCCESS, " Crypt: Non secured page"); + PrintAndLogEx(SUCCESS, " crypt.... Non secured page"); break; case 0x2: - PrintAndLogEx(INFO, " Crypt: Secured page, keys locked"); + PrintAndLogEx(INFO, " crypt.... Secured page, keys locked"); break; case 0x03: - PrintAndLogEx(SUCCESS, " Crypt: Secured page, " _GREEN_("keys not locked")); + PrintAndLogEx(SUCCESS, " crypt.... Secured page, " _GREEN_("keys not locked")); break; } if (isset(fuses, FUSE_RA)) - PrintAndLogEx(SUCCESS, " RA: Read access enabled"); + PrintAndLogEx(SUCCESS, " RA....... Read access enabled (non-secure mode)"); else - PrintAndLogEx(INFO, " RA: Read access not enabled"); - - PrintAndLogEx(INFO, - "App limit " _YELLOW_("0x%02X") ", OTP " _YELLOW_("0x%02X%02X") ", Block write lock " _YELLOW_("0x%02X") - , hdr->conf.app_limit - , hdr->conf.otp[1] - , hdr->conf.otp[0] - , hdr->conf.block_writelock - ); - PrintAndLogEx(INFO, - " Chip " _YELLOW_("0x%02X") ", Mem " _YELLOW_("0x%02X") ", EAS " _YELLOW_("0x%02X") ", Fuses " _YELLOW_("0x%02X") - , hdr->conf.chip_config - , hdr->conf.mem_config - , hdr->conf.eas - , hdr->conf.fuses - ); + PrintAndLogEx(INFO, " RA....... Read access not enabled"); } static void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *app_areas, uint8_t *kb) { @@ -535,19 +533,19 @@ static void mem_app_config(const picopass_hdr *hdr) { uint8_t app2_limit = card_app2_limit[type]; uint8_t pagemap = get_pagemap(hdr); - PrintAndLogEx(INFO, "------ " _CYAN_("Memory") " ------"); + PrintAndLogEx(INFO, "-------------------------- " _CYAN_("Memory") " --------------------------"); if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) { - PrintAndLogEx(INFO, " %u KBits (%u bytes)", kb, app2_limit * 8); + PrintAndLogEx(INFO, " %u KBits ( " _YELLOW_("%u") " bytes )", kb, app2_limit * 8); PrintAndLogEx(INFO, " Tag has not App Areas"); return; } - PrintAndLogEx(INFO, " %u KBits/%u App Areas (%u bytes)", kb, app_areas, (app2_limit + 1) * 8); + PrintAndLogEx(INFO, " %u KBits/%u App Areas ( " _YELLOW_("%u") " bytes )", kb, app_areas, (app2_limit + 1) * 8); PrintAndLogEx(INFO, " AA1 blocks %u { 0x06 - 0x%02X (06 - %02d) }", app1_limit, app1_limit + 5, app1_limit + 5); PrintAndLogEx(INFO, " AA2 blocks %u { 0x%02X - 0x%02X (%02d - %02d) }", app2_limit - app1_limit, app1_limit + 5 + 1, app2_limit, app1_limit + 5 + 1, app2_limit); - PrintAndLogEx(INFO, "------ " _CYAN_("KeyAccess") " ------"); + PrintAndLogEx(INFO, "------------------------ " _CYAN_("KeyAccess") " -------------------------"); PrintAndLogEx(INFO, " Kd = Debit key (AA1), Kc = Credit key (AA2)"); uint8_t book = isset(mem, 0x20); if (book) { @@ -568,18 +566,18 @@ static void mem_app_config(const picopass_hdr *hdr) { } static void print_picopass_info(const picopass_hdr *hdr) { - PrintAndLogEx(INFO, "------ " _CYAN_("card configuration") " ------"); + PrintAndLogEx(INFO, "-------------------- " _CYAN_("card configuration") " --------------------"); fuse_config(hdr); mem_app_config(hdr); } static void print_picopass_header(const picopass_hdr *hdr) { - PrintAndLogEx(INFO, "------------ " _CYAN_("card") " -------------"); - PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s") " (uid)", sprint_hex(hdr->csn, sizeof(hdr->csn))); - PrintAndLogEx(SUCCESS, " Config: %s (Card configuration)", sprint_hex((uint8_t *)&hdr->conf, sizeof(hdr->conf))); - PrintAndLogEx(SUCCESS, "E-purse: %s (Card challenge, CC)", sprint_hex(hdr->epurse, sizeof(hdr->epurse))); - PrintAndLogEx(SUCCESS, " Kd: %s (Debit key, hidden)", sprint_hex(hdr->key_d, sizeof(hdr->key_d))); - PrintAndLogEx(SUCCESS, " Kc: %s (Credit key, hidden)", sprint_hex(hdr->key_c, sizeof(hdr->key_c))); - PrintAndLogEx(SUCCESS, " AIA: %s (Application Issuer area)", sprint_hex(hdr->app_issuer_area, sizeof(hdr->app_issuer_area))); + PrintAndLogEx(INFO, "--------------------------- " _CYAN_("card") " ---------------------------"); + PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s") " uid", sprint_hex(hdr->csn, sizeof(hdr->csn))); + PrintAndLogEx(SUCCESS, " Config: %s Card configuration", sprint_hex((uint8_t *)&hdr->conf, sizeof(hdr->conf))); + PrintAndLogEx(SUCCESS, "E-purse: %s Card challenge, CC", sprint_hex(hdr->epurse, sizeof(hdr->epurse))); + PrintAndLogEx(SUCCESS, " Kd: %s Debit key, hidden", sprint_hex(hdr->key_d, sizeof(hdr->key_d))); + PrintAndLogEx(SUCCESS, " Kc: %s Credit key, hidden", sprint_hex(hdr->key_c, sizeof(hdr->key_c))); + PrintAndLogEx(SUCCESS, " AIA: %s Application Issuer area", sprint_hex(hdr->app_issuer_area, sizeof(hdr->app_issuer_area))); } static int CmdHFiClassList(const char *Cmd) { @@ -1121,22 +1119,7 @@ static int CmdHFiClassEView(const char *Cmd) { } PrintAndLogEx(NORMAL, ""); - uint8_t *csn = dump; - PrintAndLogEx(INFO, "------+----+-------------------------+----------"); - PrintAndLogEx(INFO, " CSN |0x00| " _GREEN_("%s") "|", sprint_hex(csn, 8)); printIclassDumpContents(dump, 1, blocks, bytes); - - /* - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "----+-------------------------+---------"); - PrintAndLogEx(INFO, "blk | data | ascii"); - PrintAndLogEx(INFO, "----+-------------------------+---------"); - for (uint16_t i = 0; i < blocks; i++){ - PrintAndLogEx(INFO, "%03d | %s ", i, sprint_hex_ascii(dump + (i * 8) , 8) ); - } - PrintAndLogEx(INFO, "----+-------------------------+---------"); - PrintAndLogEx(NORMAL, ""); - */ free(dump); return PM3_SUCCESS; } @@ -1290,7 +1273,6 @@ static int CmdHFiClassDecrypt(const char *Cmd) { saveFileEML(fptr, decrypted, decryptedlen, 8); saveFileJSON(fptr, jsfIclass, decrypted, decryptedlen, NULL); - PrintAndLogEx(INFO, "Following output skips CSN / block0"); printIclassDumpContents(decrypted, 1, (decryptedlen / 8), decryptedlen); PrintAndLogEx(NORMAL, ""); @@ -1785,9 +1767,6 @@ write_dump: PrintAndLogEx(INFO, "Reading AA2 failed. dumping AA1 data to file"); // print the dump - PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "------+----+-------------------------+----------"); - PrintAndLogEx(INFO, " CSN |0x00| " _GREEN_("%s") "|", sprint_hex(tag_data, 8)); printIclassDumpContents(tag_data, 1, (bytes_got / 8), bytes_got); // use CSN as filename @@ -2416,9 +2395,20 @@ void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t e , filemaxblock ); */ + uint8_t pagemap = get_pagemap(hdr); + + int i = startblock; - PrintAndLogEx(INFO, "------+----+-------------------------+----------"); + + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, " blk| data | ascii |lck| info"); + PrintAndLogEx(INFO, "----+-------------------------+----------+---+--------------"); + PrintAndLogEx(INFO, "0x00| " _GREEN_("%s") " | | CSN ", sprint_hex_ascii(iclass_dump, 8)); + + if (i != 1) + PrintAndLogEx(INFO, "...."); + while (i <= endblock) { uint8_t *blk = iclass_dump + (i * 8); @@ -2458,10 +2448,28 @@ void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t e bl_lock = true; } - PrintAndLogEx(INFO, " %c |0x%02X| %s", (bl_lock) ? 'x' : ' ', i, sprint_hex_ascii(blk, 8)); + const char *lockstr = (bl_lock) ? _RED_("x") : " "; + + if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) { + const char *info_nonks[] = {"CSN", "Config", "AIA", "User"}; + const char *s = info_nonks[3]; + if (i < 3) { + s = info_nonks[i]; + } + + PrintAndLogEx(INFO, "0x%02X| %s | %s | %s ", i, sprint_hex_ascii(blk, 8), lockstr, s); + } else { + const char *info_ks[] = {"CSN", "Config", "E-purse", "Debit", "Credit", "AIA", "User"}; + const char *s = info_ks[6]; + if (i < 6) { + s = info_ks[i]; + } + PrintAndLogEx(INFO, "0x%02X| %s | %s | %s ", i, sprint_hex_ascii(blk, 8), lockstr, s); + } i++; } - PrintAndLogEx(INFO, "------+----+-------------------------+----------"); + PrintAndLogEx(INFO, "----+-------------------------+----------+---+--------------"); + PrintAndLogEx(NORMAL, ""); } static int CmdHFiClassView(const char *Cmd) { @@ -2505,13 +2513,9 @@ static int CmdHFiClassView(const char *Cmd) { PrintAndLogEx(INFO, "start " _YELLOW_("0x%02x") " end " _YELLOW_("0x%02x"), (startblock == 0) ? 6 : startblock, endblock); } + PrintAndLogEx(NORMAL, ""); print_picopass_header((picopass_hdr *) dump); print_picopass_info((picopass_hdr *) dump); - - PrintAndLogEx(NORMAL, ""); - uint8_t *csn = dump; - PrintAndLogEx(INFO, "------+----+-------------------------+----------"); - PrintAndLogEx(INFO, " CSN |0x00| " _GREEN_("%s") "|", sprint_hex(csn, 8)); printIclassDumpContents(dump, startblock, endblock, bytes_read); free(dump); return PM3_SUCCESS; @@ -2687,12 +2691,15 @@ static int saveKeys(char *filename) { static int printKeys(void) { PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(INFO, "idx| key"); + PrintAndLogEx(INFO, "---+------------------------"); for (uint8_t i = 0; i < ICLASS_KEYS_MAX; i++) { if (memcmp(iClass_Key_Table[i], "\x00\x00\x00\x00\x00\x00\x00\x00", 8) == 0) - PrintAndLogEx(INFO, "%u: %s", i, sprint_hex(iClass_Key_Table[i], 8)); + PrintAndLogEx(INFO, " %u |", i); else - PrintAndLogEx(INFO, "%u: "_YELLOW_("%s"), i, sprint_hex(iClass_Key_Table[i], 8)); + PrintAndLogEx(INFO, " %u | " _YELLOW_("%s"), i, sprint_hex(iClass_Key_Table[i], 8)); } + PrintAndLogEx(INFO, "---+------------------------"); PrintAndLogEx(NORMAL, ""); return PM3_SUCCESS; } @@ -2810,111 +2817,15 @@ static void add_key(uint8_t *key) { } } + /* -static int iclass_chk_keys(void) { - return PM3_SUCCESS; -} -*/ - -static int CmdHFiClassCheckKeys(const char *Cmd) { - - // empty string - if (strlen(Cmd) == 0) return usage_hf_iclass_chk(); - - uint8_t CSN[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; - uint8_t CCNR[12] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; - - // elite key, raw key, standard key - bool use_elite = false; - bool use_raw = false; - bool use_credit_key = false; - bool found_key = false; - //bool found_credit = false; - bool got_csn = false; - bool errors = false; - uint8_t cmdp = 0x00; - - char filename[FILE_PATH_SIZE] = {0}; - uint8_t fileNameLen = 0; - - uint64_t t1 = msclock(); - - while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { - switch (tolower(param_getchar(Cmd, cmdp))) { - case 'h': - return usage_hf_iclass_chk(); - case 'f': - fileNameLen = param_getstr(Cmd, cmdp + 1, filename, sizeof(filename)); - if (fileNameLen < 1) { - PrintAndLogEx(WARNING, _RED_("no filename found after f")); - errors = true; - } - cmdp += 2; - break; - case 'e': - use_elite = true; - cmdp++; - break; - case 'c': - use_credit_key = true; - cmdp++; - break; - case 'r': - use_raw = true; - cmdp++; - break; - default: - PrintAndLogEx(WARNING, "unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); - errors = true; - break; - } - } - if (errors) return usage_hf_iclass_chk(); - - uint8_t *keyBlock = NULL; - uint32_t keycount = 0; - - // load keys - int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount); - if (res != PM3_SUCCESS || keycount == 0) { - free(keyBlock); - return res; - } +static int iclass_chk_keys(uint8_t *keyBlock, uint32_t keycount) { iclass_premac_t *pre = calloc(keycount, sizeof(iclass_premac_t)); - if (!pre) { - free(keyBlock); + if (pre == NULL) { return PM3_EMALLOC; } - // Get CSN / UID and CCNR - PrintAndLogEx(SUCCESS, "Reading tag CSN / CCNR..."); - for (uint8_t i = 0; i < ICLASS_AUTH_RETRY && !got_csn; i++) { - got_csn = select_only(CSN, CCNR, false); - if (got_csn == false) - PrintAndLogEx(WARNING, "one more try"); - } - - if (got_csn == false) { - PrintAndLogEx(WARNING, "Tried 10 times. Can't select card, aborting..."); - free(keyBlock); - DropField(); - return PM3_ESOFT; - } - - PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s"), sprint_hex(CSN, sizeof(CSN))); - PrintAndLogEx(SUCCESS, " CCNR: " _GREEN_("%s"), sprint_hex(CCNR, sizeof(CCNR))); - - PrintAndLogEx(SUCCESS, "Generating diversified keys %s", (use_elite || use_raw) ? NOLF : ""); - if (use_elite) - PrintAndLogEx(NORMAL, "using " _YELLOW_("elite algo")); - if (use_raw) - PrintAndLogEx(NORMAL, "using " _YELLOW_("raw mode")); - - GenerateMacFrom(CSN, CCNR, use_raw, use_elite, keyBlock, keycount, pre); - - PrintAndLogEx(SUCCESS, "Searching for " _YELLOW_("%s") " key...", (use_credit_key) ? "CREDIT" : "DEBIT"); - // max 42 keys inside USB_COMMAND. 512/4 = 103 mac uint32_t chunksize = keycount > (PM3_CMD_DATA_SIZE / 4) ? (PM3_CMD_DATA_SIZE / 4) : keycount; bool lastChunk = false; @@ -2998,7 +2909,195 @@ static int CmdHFiClassCheckKeys(const char *Cmd) { break; } - } // end chunks of keys + } + return PM3_SUCCESS; +} +*/ + +static int CmdHFiClassCheckKeys(const char *Cmd) { + + // empty string + if (strlen(Cmd) == 0) return usage_hf_iclass_chk(); + + uint8_t CSN[8] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + uint8_t CCNR[12] = {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}; + + // elite key, raw key, standard key + bool use_elite = false; + bool use_raw = false; + bool use_credit_key = false; + bool found_key = false; + //bool found_credit = false; + bool got_csn = false; + bool errors = false; + uint8_t cmdp = 0x00; + + char filename[FILE_PATH_SIZE] = {0}; + uint8_t fileNameLen = 0; + + uint64_t t1 = msclock(); + + while (param_getchar(Cmd, cmdp) != 0x00 && !errors) { + switch (tolower(param_getchar(Cmd, cmdp))) { + case 'h': + return usage_hf_iclass_chk(); + case 'f': + fileNameLen = param_getstr(Cmd, cmdp + 1, filename, sizeof(filename)); + if (fileNameLen < 1) { + PrintAndLogEx(WARNING, _RED_("no filename found after f")); + errors = true; + } + cmdp += 2; + break; + case 'e': + use_elite = true; + cmdp++; + break; + case 'c': + use_credit_key = true; + cmdp++; + break; + case 'r': + use_raw = true; + cmdp++; + break; + default: + PrintAndLogEx(WARNING, "unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); + errors = true; + break; + } + } + if (errors) return usage_hf_iclass_chk(); + + uint8_t *keyBlock = NULL; + uint32_t keycount = 0; + + // load keys + int res = loadFileDICTIONARY_safe(filename, (void **)&keyBlock, 8, &keycount); + if (res != PM3_SUCCESS || keycount == 0) { + free(keyBlock); + return res; + } + + // Get CSN / UID and CCNR + PrintAndLogEx(SUCCESS, "Reading tag CSN / CCNR..."); + for (uint8_t i = 0; i < ICLASS_AUTH_RETRY && !got_csn; i++) { + got_csn = select_only(CSN, CCNR, false); + if (got_csn == false) + PrintAndLogEx(WARNING, "one more try"); + } + + if (got_csn == false) { + PrintAndLogEx(WARNING, "Tried 10 times. Can't select card, aborting..."); + free(keyBlock); + DropField(); + return PM3_ESOFT; + } + + iclass_premac_t *pre = calloc(keycount, sizeof(iclass_premac_t)); + if (pre == NULL) { + return PM3_EMALLOC; + } + + + PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s"), sprint_hex(CSN, sizeof(CSN))); + PrintAndLogEx(SUCCESS, " CCNR: " _GREEN_("%s"), sprint_hex(CCNR, sizeof(CCNR))); + + PrintAndLogEx(SUCCESS, "Generating diversified keys %s", (use_elite || use_raw) ? NOLF : ""); + if (use_elite) + PrintAndLogEx(NORMAL, "using " _YELLOW_("elite algo")); + if (use_raw) + PrintAndLogEx(NORMAL, "using " _YELLOW_("raw mode")); + + GenerateMacFrom(CSN, CCNR, use_raw, use_elite, keyBlock, keycount, pre); + + PrintAndLogEx(SUCCESS, "Searching for " _YELLOW_("%s") " key...", (use_credit_key) ? "CREDIT" : "DEBIT"); + + + // max 42 keys inside USB_COMMAND. 512/4 = 103 mac + uint32_t chunksize = keycount > (PM3_CMD_DATA_SIZE / 4) ? (PM3_CMD_DATA_SIZE / 4) : keycount; + bool lastChunk = false; + + // fast push mode + conn.block_after_ACK = true; + + // keep track of position of found key + uint8_t found_offset = 0; + uint32_t key_offset = 0; + // main keychunk loop + for (key_offset = 0; key_offset < keycount; key_offset += chunksize) { + + uint64_t t2 = msclock(); + uint8_t timeout = 0; + + if (kbd_enter_pressed()) { + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(WARNING, "Aborted via keyboard!"); + goto out; + } + + uint32_t keys = ((keycount - key_offset) > chunksize) ? chunksize : keycount - key_offset; + + // last chunk? + if (keys == keycount - key_offset) { + lastChunk = true; + // Disable fast mode on last command + conn.block_after_ACK = false; + } + uint32_t flags = lastChunk << 8; + // bit 16 + // - 1 indicates credit key + // - 0 indicates debit key (default) + flags |= (use_credit_key << 16); + + clearCommandBuffer(); + SendCommandOLD(CMD_HF_ICLASS_CHKKEYS, flags, keys, 0, pre + key_offset, 4 * keys); + PacketResponseNG resp; + + bool looped = false; + while (!WaitForResponseTimeout(CMD_HF_ICLASS_CHKKEYS, &resp, 2000)) { + timeout++; + PrintAndLogEx(NORMAL, "." NOLF); + if (timeout > 120) { + PrintAndLogEx(WARNING, "\nNo response from Proxmark3. Aborting..."); + goto out; + } + looped = true; + } + + if (looped) + PrintAndLogEx(NORMAL, ""); + + found_offset = resp.oldarg[1] & 0xFF; + uint8_t isOK = resp.oldarg[0] & 0xFF; + + t2 = msclock() - t2; + switch (isOK) { + case 1: { + found_key = true; + PrintAndLogEx(NORMAL, ""); + PrintAndLogEx(SUCCESS, "Found valid key " _GREEN_("%s") + , sprint_hex(keyBlock + (key_offset + found_offset) * 8, 8) + ); + break; + } + case 0: { + PrintAndLogEx(INPLACE, "Chunk [%d/%d]", key_offset, keycount); + break; + } + case 99: { + } + default: { + break; + } + } + + // both keys found. + if (found_key) { + break; + } + + } out: t1 = msclock() - t1; From c86df6b83d393cf0e438196077c6f82ba7a9282c Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Sun, 18 Oct 2020 16:16:09 +0200 Subject: [PATCH 064/125] em 4x05_chk: check if a pwd is really activated to avoid false positives --- client/src/cmdlfem4x05.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index 82e069092..a1999dd9d 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -1095,13 +1095,20 @@ int CmdEM4x05Chk(const char *Cmd) { uint64_t card_id = arg_get_u64_def(ctx, 2, 0); CLIParserFree(ctx); + uint8_t addr = 4; + uint32_t word = 0; + // Test first if a password is required + int status = EM4x05ReadWord_ext(addr, 0, false, &word); + if (status == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Password doesn't seem to be needed to read the tag"); + return PM3_SUCCESS; + } + if (strlen(filename) == 0) { snprintf(filename, sizeof(filename), "t55xx_default_pwds"); } PrintAndLogEx(NORMAL, ""); - uint8_t addr = 4; - uint32_t word = 0; bool found = false; uint64_t t1 = msclock(); @@ -1111,7 +1118,7 @@ int CmdEM4x05Chk(const char *Cmd) { uint32_t pwd = lf_t55xx_white_pwdgen(card_id & 0xFFFFFFFF); PrintAndLogEx(INFO, "testing %08"PRIX32" generated ", pwd); - int status = EM4x05ReadWord_ext(addr, pwd, true, &word); + status = EM4x05ReadWord_ext(addr, pwd, true, &word); if (status == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", pwd); found = true; @@ -1153,7 +1160,7 @@ int CmdEM4x05Chk(const char *Cmd) { PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password); - int status = EM4x05ReadWord_ext(addr, curr_password, 1, &word); + status = EM4x05ReadWord_ext(addr, curr_password, 1, &word); if (status == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", curr_password); found = true; From 95bf65cda94536b420f4e449d33b9cb364c4367c Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Sun, 18 Oct 2020 23:46:36 +0200 Subject: [PATCH 065/125] Add EM 4x05 Login --- armsrc/appmain.c | 8 ++++ armsrc/lfops.c | 31 ++++++++++-- armsrc/lfops.h | 1 + client/src/cmdlfem4x05.c | 101 +++++++++++++++++++-------------------- include/pm3_cmd.h | 1 + 5 files changed, 87 insertions(+), 55 deletions(-) diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 6b40a3909..02d6f1d23 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -970,6 +970,14 @@ static void PacketReceived(PacketCommandNG *packet) { ); break; } + case CMD_LF_EM4X_LOGIN: { + struct p { + uint32_t password; + } PACKED; + struct p *payload = (struct p *) packet->data.asBytes; + EM4xLogin(payload->password); + break; + } case CMD_LF_EM4X_READWORD: { struct p { uint32_t password; diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 03e322681..de1803690 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -2501,7 +2501,7 @@ static void SendForward(uint8_t fwd_bit_count) { } } -static void EM4xLogin(uint32_t pwd) { +static void EM4xLoginEx(uint32_t pwd) { forward_ptr = forwardLink_data; uint8_t len = Prepare_Cmd(FWD_CMD_LOGIN); len += Prepare_Data(pwd & 0xFFFF, pwd >> 16); @@ -2512,6 +2512,29 @@ static void EM4xLogin(uint32_t pwd) { // 0000 0001 fail } +void EM4xLogin(uint32_t pwd) { + + StartTicks(); + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + WaitMS(20); + + LED_A_ON(); + + // clear buffer now so it does not interfere with timing later + BigBuf_Clear_ext(false); + + EM4xLoginEx(pwd); + + WaitUS(400); + + DoPartialAcquisition(20, false, 1000, 1000); + + StopTicks(); + FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); + reply_ng(CMD_LF_EM4X_LOGIN, PM3_SUCCESS, NULL, 0); + LEDsoff(); +} + void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) { StartTicks(); @@ -2529,7 +2552,7 @@ void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) { * 0000 1010 ok * 0000 0001 fail **/ - if (usepwd) EM4xLogin(pwd); + if (usepwd) EM4xLoginEx(pwd); forward_ptr = forwardLink_data; uint8_t len = Prepare_Cmd(FWD_CMD_READ); @@ -2564,7 +2587,7 @@ void EM4xWriteWord(uint8_t addr, uint32_t data, uint32_t pwd, uint8_t usepwd) { * 0000 1010 ok. * 0000 0001 fail **/ - if (usepwd) EM4xLogin(pwd); + if (usepwd) EM4xLoginEx(pwd); forward_ptr = forwardLink_data; uint8_t len = Prepare_Cmd(FWD_CMD_WRITE); @@ -2607,7 +2630,7 @@ void EM4xProtectWord(uint32_t data, uint32_t pwd, uint8_t usepwd) { * 0000 1010 ok. * 0000 0001 fail **/ - if (usepwd) EM4xLogin(pwd); + if (usepwd) EM4xLoginEx(pwd); forward_ptr = forwardLink_data; uint8_t len = Prepare_Cmd(FWD_CMD_PROTECT); diff --git a/armsrc/lfops.h b/armsrc/lfops.h index 1c191d65d..bf251ac85 100644 --- a/armsrc/lfops.h +++ b/armsrc/lfops.h @@ -56,6 +56,7 @@ void T55xxDangerousRawTest(uint8_t *data); void TurnReadLFOn(uint32_t delay); +void EM4xLogin(uint32_t pwd); void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd); void EM4xWriteWord(uint8_t addr, uint32_t data, uint32_t pwd, uint8_t usepwd); void EM4xProtectWord(uint32_t data, uint32_t pwd, uint8_t usepwd); diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index a1999dd9d..75e20e9eb 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -361,6 +361,29 @@ static int demodEM4x05resp(uint32_t *word, bool onlyPreamble) { //////////////// 4205 / 4305 commands +static int EM4x05Login_ext(uint32_t pwd) { + + struct { + uint32_t password; + } PACKED payload; + + payload.password = pwd; + + clearCommandBuffer(); + SendCommandNG(CMD_LF_EM4X_LOGIN, (uint8_t *)&payload, sizeof(payload)); + PacketResponseNG resp; + if (!WaitForResponseTimeout(CMD_LF_EM4X_LOGIN, &resp, 10000)) { + PrintAndLogEx(WARNING, "(EM4x05Login_ext) timeout while waiting for reply."); + return PM3_ETIMEOUT; + } + + if (downloadSamplesEM() == false) { + return PM3_ESOFT; + } + uint32_t word; + return demodEM4x05resp(&word, true); +} + int EM4x05ReadWord_ext(uint8_t addr, uint32_t pwd, bool usePwd, uint32_t *word) { struct { @@ -438,7 +461,6 @@ int CmdEM4x05Dump(const char *Cmd) { if (EM4x05IsBlock0(&block0) == false) return PM3_ESOFT; - bool needReadPwd = true; uint8_t bytes[4] = {0}; uint32_t data[16]; @@ -456,28 +478,32 @@ int CmdEM4x05Dump(const char *Cmd) { em_tech_type_t card_type = em_get_card_type(block0); PrintAndLogEx(INFO, "Found a " _GREEN_("%s") " tag", em_get_card_str(block0)); - PrintAndLogEx(NORMAL, ""); + if (usePwd) { + // Test first if the password is correct + status = EM4x05Login_ext(pwd); + if (status == PM3_SUCCESS) { + PrintAndLogEx(INFO, "Password is " _GREEN_("correct")); + } else if (status == PM3_EFAILED) { + PrintAndLogEx(WARNING, "Password is " _RED_("incorrect") ", will try without password"); + usePwd = false; + } else if (status != PM3_EFAILED) { + PrintAndLogEx(WARNING, "Login attempt: No answer from tag"); + return status; + } + } + + PrintAndLogEx(NORMAL, ""); PrintAndLogEx(INFO, "Addr | data | ascii |lck| info"); PrintAndLogEx(INFO, "-----+----------+-------+---+-----"); if ( card_type == EM_4205 || card_type == EM_4305 || card_type == EM_UNKNOWN) { - if (usePwd) { - // Test first if a password is required - status = EM4x05ReadWord_ext(EM4305_PROT1_BLOCK, pwd, false, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); - needReadPwd = false; - } - } // To flag any blocks locked we need to read blocks 14 and 15 first // dont swap endin until we get block lock flags. status14 = EM4x05ReadWord_ext(EM4305_PROT1_BLOCK, pwd, usePwd, &word); if (status14 == PM3_SUCCESS) { - if (!usePwd) - needReadPwd = false; if ((word & 0x00008000) != 0x00) { lock_bits = word; gotLockBits = true; @@ -503,14 +529,9 @@ int CmdEM4x05Dump(const char *Cmd) { lockbit = (lock_bits >> addr) & 1; if (addr == 2) { if (usePwd) { - if ((needReadPwd) && (success != PM3_ESOFT)) { - data[addr] = BSWAP_32(pwd); - num_to_bytes(pwd, 4, bytes); - PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); - } else { - // The pwd is not needed for Login so we're not sure what's the actual content of that block - PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); - } + data[addr] = BSWAP_32(pwd); + num_to_bytes(pwd, 4, bytes); + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info[addr]); } else { data[addr] = 0x00; // Unknown password, but not used to set to zeros PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info[addr]); @@ -550,21 +571,10 @@ int CmdEM4x05Dump(const char *Cmd) { } else if (card_type == EM_4X69) { - if (usePwd) { - // Test first if a password is required - status = EM4x05ReadWord_ext(EM4469_PROT_BLOCK, pwd, false, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Note that password doesn't seem to be needed"); - needReadPwd = false; - } - } - // To flag any blocks locked we need to read blocks 14 and 15 first // dont swap endin until we get block lock flags. status14 = EM4x05ReadWord_ext(EM4469_PROT_BLOCK, pwd, usePwd, &word); if (status14 == PM3_SUCCESS) { - if (!usePwd) - needReadPwd = false; if ((word & 0x00008000) != 0x00) { lock_bits = word; gotLockBits = true; @@ -580,14 +590,9 @@ int CmdEM4x05Dump(const char *Cmd) { lockbit = (lock_bits >> addr) & 1; if (addr == 2) { if (usePwd) { - if ((needReadPwd) && (success != PM3_ESOFT)) { - data[addr] = BSWAP_32(pwd); - num_to_bytes(pwd, 4, bytes); - PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info4x69[addr]); - } else { - // The pwd is not needed for Login so we're not sure what's the actual content of that block - PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info4x69[addr]); - } + data[addr] = BSWAP_32(pwd); + num_to_bytes(pwd, 4, bytes); + PrintAndLogEx(INFO, " %02u | %08X | %s | %s | %s", addr, pwd, sprint_ascii(bytes, 4), gotLockBits ? (lockbit ? _RED_("x") : " ") : _YELLOW_("?"), info4x69[addr]); } else { data[addr] = 0x00; // Unknown password, but not used to set to zeros PrintAndLogEx(INFO, " %02u | | | | %-10s " _YELLOW_("write only"), addr, info4x69[addr]); @@ -1095,15 +1100,6 @@ int CmdEM4x05Chk(const char *Cmd) { uint64_t card_id = arg_get_u64_def(ctx, 2, 0); CLIParserFree(ctx); - uint8_t addr = 4; - uint32_t word = 0; - // Test first if a password is required - int status = EM4x05ReadWord_ext(addr, 0, false, &word); - if (status == PM3_SUCCESS) { - PrintAndLogEx(INFO, "Password doesn't seem to be needed to read the tag"); - return PM3_SUCCESS; - } - if (strlen(filename) == 0) { snprintf(filename, sizeof(filename), "t55xx_default_pwds"); } @@ -1118,10 +1114,12 @@ int CmdEM4x05Chk(const char *Cmd) { uint32_t pwd = lf_t55xx_white_pwdgen(card_id & 0xFFFFFFFF); PrintAndLogEx(INFO, "testing %08"PRIX32" generated ", pwd); - status = EM4x05ReadWord_ext(addr, pwd, true, &word); + int status = EM4x05Login_ext(pwd); if (status == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", pwd); found = true; + } else if (status != PM3_EFAILED) { + PrintAndLogEx(WARNING, "No answer from tag"); } } @@ -1131,7 +1129,6 @@ int CmdEM4x05Chk(const char *Cmd) { PrintAndLogEx(INFO, "press " _YELLOW_("'enter'") " to cancel the command"); - word = 0; uint32_t keycount = 0; int res = loadFileDICTIONARY_safe(filename, (void **) &keyBlock, 4, &keycount); @@ -1160,11 +1157,13 @@ int CmdEM4x05Chk(const char *Cmd) { PrintAndLogEx(INFO, "testing %08"PRIX32, curr_password); - status = EM4x05ReadWord_ext(addr, curr_password, 1, &word); + int status = EM4x05Login_ext(curr_password); if (status == PM3_SUCCESS) { PrintAndLogEx(SUCCESS, "found valid password [ " _GREEN_("%08"PRIX32) " ]", curr_password); found = true; break; + } else if (status != PM3_EFAILED) { + PrintAndLogEx(WARNING, "No answer from tag"); } } } diff --git a/include/pm3_cmd.h b/include/pm3_cmd.h index 6fca06786..7fb978d75 100644 --- a/include/pm3_cmd.h +++ b/include/pm3_cmd.h @@ -496,6 +496,7 @@ typedef struct { #define CMD_LF_T55XX_RESET_READ 0x0216 #define CMD_LF_PCF7931_READ 0x0217 #define CMD_LF_PCF7931_WRITE 0x0223 +#define CMD_LF_EM4X_LOGIN 0x0229 #define CMD_LF_EM4X_READWORD 0x0218 #define CMD_LF_EM4X_WRITEWORD 0x0219 #define CMD_LF_EM4X_PROTECTWORD 0x021B From a8ca19bec58c774d7b93e398cab96647c1888bb1 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 00:15:01 +0200 Subject: [PATCH 066/125] EM 4x05: acquire more samples for Login --- armsrc/lfops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/armsrc/lfops.c b/armsrc/lfops.c index de1803690..6f815afe1 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -2526,8 +2526,8 @@ void EM4xLogin(uint32_t pwd) { EM4xLoginEx(pwd); WaitUS(400); - - DoPartialAcquisition(20, false, 1000, 1000); + // We need to acquire more than needed, to help demodulators finding the proper modulation + DoPartialAcquisition(20, false, 6000, 1000); StopTicks(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); From dd6044e508b43b59bd38f8f2fbaa8c3cd60dda0e Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 00:51:20 +0200 Subject: [PATCH 067/125] EM4x05: use full preambles --- client/src/cmdlfem4x05.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index 75e20e9eb..2ad3471c6 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -147,7 +147,7 @@ static bool EM_ColParityTest(uint8_t *bs, size_t size, uint8_t rows, uint8_t col return true; } -#define EM_PREAMBLE_LEN 6 +#define EM_PREAMBLE_LEN 8 // download samples from device and copy to Graphbuffer static bool downloadSamplesEM(void) { @@ -178,15 +178,15 @@ static int doPreambleSearch(size_t *startIdx) { return PM3_ESOFT; } - // set size to 9 to only test first 3 positions for the preamble + // set size to 11 to only test first 3 positions for the preamble // do not set it too long else an error preamble followed by 010 could be seen as success. - size_t size = (9 > DemodBufferLen) ? DemodBufferLen : 9; + size_t size = (11 > DemodBufferLen) ? DemodBufferLen : 11; *startIdx = 0; // skip first two 0 bits as they might have been missed in the demod - uint8_t preamble[EM_PREAMBLE_LEN] = {0, 0, 1, 0, 1, 0}; + uint8_t preamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 1, 0, 1, 0}; if (!preambleSearchEx(DemodBuffer, preamble, EM_PREAMBLE_LEN, &size, startIdx, true)) { - uint8_t errpreamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 0, 1}; + uint8_t errpreamble[EM_PREAMBLE_LEN] = {0, 0, 0, 0, 0, 0, 0, 1}; if (!preambleSearchEx(DemodBuffer, errpreamble, EM_PREAMBLE_LEN, &size, startIdx, true)) { PrintAndLogEx(DEBUG, "DEBUG: Error - EM4305 preamble not found :: %zu", *startIdx); return PM3_ESOFT; From 1731db2f0c0faf028ba178aee4c59d1d6290a993 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 00:51:41 +0200 Subject: [PATCH 068/125] EM4x05: init flipped array --- client/src/cmdlfem4x05.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/src/cmdlfem4x05.c b/client/src/cmdlfem4x05.c index 2ad3471c6..4992ab1c8 100644 --- a/client/src/cmdlfem4x05.c +++ b/client/src/cmdlfem4x05.c @@ -1357,7 +1357,7 @@ int CmdEM4x05Unlock(const char *Cmd) { uint32_t soon = 0; uint32_t late = 0; - em4x05_unlock_item_t flipped[64]; + em4x05_unlock_item_t flipped[64] ={{0,0}}; // // main loop From ae1b4b62b66765cc4009080a11dcfb34af8267f6 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 00:52:21 +0200 Subject: [PATCH 069/125] EM4x05 login & read: don't use threshold for acquisition --- armsrc/lfops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/armsrc/lfops.c b/armsrc/lfops.c index 6f815afe1..4d25bd314 100644 --- a/armsrc/lfops.c +++ b/armsrc/lfops.c @@ -2527,7 +2527,7 @@ void EM4xLogin(uint32_t pwd) { WaitUS(400); // We need to acquire more than needed, to help demodulators finding the proper modulation - DoPartialAcquisition(20, false, 6000, 1000); + DoPartialAcquisition(0, false, 6000, 1000); StopTicks(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); @@ -2562,7 +2562,7 @@ void EM4xReadWord(uint8_t addr, uint32_t pwd, uint8_t usepwd) { WaitUS(400); - DoPartialAcquisition(20, false, 6000, 1000); + DoPartialAcquisition(0, false, 6000, 1000); StopTicks(); FpgaWriteConfWord(FPGA_MAJOR_MODE_OFF); From 3616f145e1c4a29cd8d1d743e247a7f672c4755e Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Mon, 19 Oct 2020 10:33:45 +0200 Subject: [PATCH 070/125] textual --- client/src/cmdhficlass.c | 91 ++++++++++++++++++++-------------------- 1 file changed, 45 insertions(+), 46 deletions(-) diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index dd025852f..e9aaa1880 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -428,51 +428,51 @@ static void fuse_config(const picopass_hdr *hdr) { uint16_t otp = (hdr->conf.otp[1] << 8 | hdr->conf.otp[0]); PrintAndLogEx(INFO, " Raw: " _YELLOW_("%s"), sprint_hex((uint8_t*)&hdr->conf, 8)); - PrintAndLogEx(INFO, " " _YELLOW_("%02X") "..................... App limit", hdr->conf.app_limit); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "..................... app limit", hdr->conf.app_limit); PrintAndLogEx(INFO, " " _YELLOW_("%04X") " ( %5u )...... OTP", otp, otp); - PrintAndLogEx(INFO, " " _YELLOW_("%02X") "............ Block write lock", hdr->conf.block_writelock); - PrintAndLogEx(INFO, " " _YELLOW_("%02X") "......... Chip", hdr->conf.chip_config); - PrintAndLogEx(INFO, " " _YELLOW_("%02X") "...... Mem", hdr->conf.mem_config); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "............ block write lock", hdr->conf.block_writelock); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "......... chip", hdr->conf.chip_config); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") "...... mem", hdr->conf.mem_config); PrintAndLogEx(INFO, " " _YELLOW_("%02X") "... EAS", hdr->conf.eas); - PrintAndLogEx(INFO, " " _YELLOW_("%02X") " Fuses", hdr->conf.fuses); + PrintAndLogEx(INFO, " " _YELLOW_("%02X") " fuses", hdr->conf.fuses); uint8_t fuses = hdr->conf.fuses; PrintAndLogEx(INFO, " Fuses:"); if (isset(fuses, FUSE_FPERS)) - PrintAndLogEx(SUCCESS, " mode..... " _GREEN_("Personalization (programmable)")); + PrintAndLogEx(SUCCESS, " mode......... " _GREEN_("Personalization (programmable)")); else - PrintAndLogEx(SUCCESS, " mode..... " _YELLOW_("Application (locked)")); + PrintAndLogEx(SUCCESS, " mode......... " _YELLOW_("Application (locked)")); if (isset(fuses, FUSE_CODING1)) { - PrintAndLogEx(SUCCESS, " coding.. RFU"); + PrintAndLogEx(SUCCESS, " coding...... RFU"); } else { if (isset(fuses, FUSE_CODING0)) - PrintAndLogEx(SUCCESS, " coding... " _YELLOW_("ISO 14443-2 B / 15693")); + PrintAndLogEx(SUCCESS, " coding....... " _YELLOW_("ISO 14443-2 B / 15693")); else - PrintAndLogEx(SUCCESS, " coding... " _YELLOW_("ISO 14443-B only")); + PrintAndLogEx(SUCCESS, " coding....... " _YELLOW_("ISO 14443-B only")); } uint8_t pagemap = get_pagemap(hdr); switch (pagemap) { case 0x0: - PrintAndLogEx(INFO, " crypt.... No auth possible. Read only if RA is enabled"); + PrintAndLogEx(INFO, " crypt........ No auth possible. Read only if RA is enabled"); break; case 0x1: - PrintAndLogEx(SUCCESS, " crypt.... Non secured page"); + PrintAndLogEx(SUCCESS, " crypt........ Non secured page"); break; case 0x2: - PrintAndLogEx(INFO, " crypt.... Secured page, keys locked"); + PrintAndLogEx(INFO, " crypt........ Secured page, keys locked"); break; case 0x03: - PrintAndLogEx(SUCCESS, " crypt.... Secured page, " _GREEN_("keys not locked")); + PrintAndLogEx(SUCCESS, " crypt........ Secured page, " _GREEN_("keys not locked")); break; } if (isset(fuses, FUSE_RA)) - PrintAndLogEx(SUCCESS, " RA....... Read access enabled (non-secure mode)"); + PrintAndLogEx(SUCCESS, " RA........... Read access enabled (non-secure mode)"); else - PrintAndLogEx(INFO, " RA....... Read access not enabled"); + PrintAndLogEx(INFO, " RA........... Read access not enabled"); } static void getMemConfig(uint8_t mem_cfg, uint8_t chip_cfg, uint8_t *app_areas, uint8_t *kb) { @@ -545,23 +545,23 @@ static void mem_app_config(const picopass_hdr *hdr) { PrintAndLogEx(INFO, " AA1 blocks %u { 0x06 - 0x%02X (06 - %02d) }", app1_limit, app1_limit + 5, app1_limit + 5); PrintAndLogEx(INFO, " AA2 blocks %u { 0x%02X - 0x%02X (%02d - %02d) }", app2_limit - app1_limit, app1_limit + 5 + 1, app2_limit, app1_limit + 5 + 1, app2_limit); - PrintAndLogEx(INFO, "------------------------ " _CYAN_("KeyAccess") " -------------------------"); - PrintAndLogEx(INFO, " Kd = Debit key (AA1), Kc = Credit key (AA2)"); + PrintAndLogEx(INFO, "------------------------- " _CYAN_("KeyAccess") " ------------------------"); + PrintAndLogEx(INFO, " * Kd, Debit key, AA1 Kc, Credit key, AA2 *"); uint8_t book = isset(mem, 0x20); if (book) { - PrintAndLogEx(INFO, " Read A - Kd"); - PrintAndLogEx(INFO, " Read B - Kc"); - PrintAndLogEx(INFO, " Write A - Kd"); - PrintAndLogEx(INFO, " Write B - Kc"); - PrintAndLogEx(INFO, " Debit - Kd or Kc"); - PrintAndLogEx(INFO, " Credit - Kc"); + PrintAndLogEx(INFO, " Read A....... debit"); + PrintAndLogEx(INFO, " Read B....... credit"); + PrintAndLogEx(INFO, " Write A...... debit"); + PrintAndLogEx(INFO, " Write B...... credit"); + PrintAndLogEx(INFO, " Debit........ debit or credit"); + PrintAndLogEx(INFO, " Credit....... credit"); } else { - PrintAndLogEx(INFO, " Read A - Kd or Kc"); - PrintAndLogEx(INFO, " Read B - Kd or Kc"); - PrintAndLogEx(INFO, " Write A - Kc"); - PrintAndLogEx(INFO, " Write B - Kc"); - PrintAndLogEx(INFO, " Debit - Kd or Kc"); - PrintAndLogEx(INFO, " Credit - Kc"); + PrintAndLogEx(INFO, " Read A....... debit or credit"); + PrintAndLogEx(INFO, " Read B....... debit or credit"); + PrintAndLogEx(INFO, " Write A...... credit"); + PrintAndLogEx(INFO, " Write B...... credit"); + PrintAndLogEx(INFO, " Debit........ debit or credit"); + PrintAndLogEx(INFO, " redit........ credit"); } } @@ -3539,33 +3539,33 @@ int info_iclass(void) { picopass_ns_hdr *ns_hdr = (picopass_ns_hdr *)resp.data.asBytes; PrintAndLogEx(NORMAL, ""); - PrintAndLogEx(INFO, "--- " _CYAN_("Tag Information") " --------------------------"); - PrintAndLogEx(INFO, "-------------------------------------------------------------"); + PrintAndLogEx(INFO, "--------------------- " _CYAN_("Tag Information") " ----------------------"); + PrintAndLogEx(INFO, "------------------------------------------------------------"); if (readStatus & FLAG_ICLASS_CSN) { - PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s") " (uid)", sprint_hex(hdr->csn, sizeof(hdr->csn))); + PrintAndLogEx(SUCCESS, " CSN: " _GREEN_("%s") " uid", sprint_hex(hdr->csn, sizeof(hdr->csn))); } if (readStatus & FLAG_ICLASS_CONF) { - PrintAndLogEx(SUCCESS, " Config: %s (Card configuration)", sprint_hex((uint8_t *)&hdr->conf, sizeof(hdr->conf))); + PrintAndLogEx(SUCCESS, " Config: %s card configuration", sprint_hex((uint8_t *)&hdr->conf, sizeof(hdr->conf))); } // page mapping. If fuse0|1 == 0x01, card is in non-secure mode, with CSN, CONF, AIA as top 3 blocks. // page9 in http://www.proxmark.org/files/Documents/13.56%20MHz%20-%20iClass/DS%20Picopass%202KS%20V1-0.pdf uint8_t pagemap = get_pagemap(hdr); if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) { - PrintAndLogEx(SUCCESS, " AIA: %s (Application Issuer area)", sprint_hex(ns_hdr->app_issuer_area, sizeof(ns_hdr->app_issuer_area))); + PrintAndLogEx(SUCCESS, " AIA: %s application issuer area", sprint_hex(ns_hdr->app_issuer_area, sizeof(ns_hdr->app_issuer_area))); } else { if (readStatus & FLAG_ICLASS_CC) { - PrintAndLogEx(SUCCESS, "E-purse: %s (Card challenge, CC)", sprint_hex(hdr->epurse, sizeof(hdr->epurse))); + PrintAndLogEx(SUCCESS, "E-purse: %s Card challenge, CC", sprint_hex(hdr->epurse, sizeof(hdr->epurse))); } - PrintAndLogEx(SUCCESS, " Kd: %s (Debit key, hidden)", sprint_hex(hdr->key_d, sizeof(hdr->key_d))); - PrintAndLogEx(SUCCESS, " Kc: %s (Credit key, hidden)", sprint_hex(hdr->key_c, sizeof(hdr->key_c))); + PrintAndLogEx(SUCCESS, " Kd: %s debit key, hidden", sprint_hex(hdr->key_d, sizeof(hdr->key_d))); + PrintAndLogEx(SUCCESS, " Kc: %s credit key, hidden", sprint_hex(hdr->key_c, sizeof(hdr->key_c))); if (readStatus & FLAG_ICLASS_AIA) { - PrintAndLogEx(SUCCESS, " AIA: %s (Application Issuer area)", sprint_hex(hdr->app_issuer_area, sizeof(hdr->app_issuer_area))); + PrintAndLogEx(SUCCESS, " AIA: %s application issuer area", sprint_hex(hdr->app_issuer_area, sizeof(hdr->app_issuer_area))); } } @@ -3573,7 +3573,7 @@ int info_iclass(void) { print_picopass_info(hdr); } - PrintAndLogEx(INFO, "------ " _CYAN_("Fingerprint") " ------"); + PrintAndLogEx(INFO, "------------------------ " _CYAN_("Fingerprint") " -----------------------"); uint8_t aia[8]; if (pagemap == PICOPASS_NON_SECURE_PAGEMODE) @@ -3588,18 +3588,17 @@ int info_iclass(void) { bool se_enabled = (memcmp(aia, "\xff\xff\xff\x00\x06\xff\xff\xff", 8) == 0); if (isHidRange) { - PrintAndLogEx(SUCCESS, "CSN is in HID range"); + PrintAndLogEx(SUCCESS, " CSN.......... " _YELLOW_("HID range")); if (legacy) - PrintAndLogEx(SUCCESS, "Credential : " _GREEN_("iCLASS legacy")); + PrintAndLogEx(SUCCESS, " Credential... " _GREEN_("iCLASS legacy")); if (se_enabled) - PrintAndLogEx(SUCCESS, "Credential : " _GREEN_("iCLASS SE")); - + PrintAndLogEx(SUCCESS, " Credential... " _GREEN_("iCLASS SE")); } else { - PrintAndLogEx(SUCCESS, _YELLOW_("PicoPass")" (CSN is not in HID range)"); + PrintAndLogEx(SUCCESS, " CSN..-....... " _YELLOW_("outside HID range")); } uint8_t cardtype = get_mem_config(hdr); - PrintAndLogEx(SUCCESS, " Card type : " _GREEN_("%s"), card_types[cardtype]); + PrintAndLogEx(SUCCESS, " Card type.... " _GREEN_("%s"), card_types[cardtype]); } DropField(); From 0e4a9fbc346e88ae8ddd8d1d45bf213a7126471d Mon Sep 17 00:00:00 2001 From: iceman1001 Date: Mon, 19 Oct 2020 12:42:26 +0200 Subject: [PATCH 071/125] text --- client/src/cmdhw.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c index f2eff6966..7ad1ba5b8 100644 --- a/client/src/cmdhw.c +++ b/client/src/cmdhw.c @@ -792,18 +792,18 @@ void pm3_version(bool verbose, bool oneliner) { PrintAndLogEx(NORMAL, "\n [ " _YELLOW_("PROXMARK3") " ]"); if (IfPm3Rdv4Fw() == false) { - PrintAndLogEx(NORMAL, " firmware.........................%s", _GREEN_("PM3OTHER")); + PrintAndLogEx(NORMAL, " firmware.................. %s", _YELLOW_("PM3OTHER")); if (IfPm3FpcUsartHost()) { - PrintAndLogEx(NORMAL, " FPC USART for BT add-on..........%s", _GREEN_("present")); + PrintAndLogEx(NORMAL, " FPC USART for BT add-on... %s", _GREEN_("present")); } } else { - PrintAndLogEx(NORMAL, " firmware.........................%s", _GREEN_("PM3RDV4")); - PrintAndLogEx(NORMAL, " external flash...................%s", IfPm3Flash() ? _GREEN_("present") : _YELLOW_("absent")); - PrintAndLogEx(NORMAL, " smartcard reader.................%s", IfPm3Smartcard() ? _GREEN_("present") : _YELLOW_("absent")); - PrintAndLogEx(NORMAL, " FPC USART for BT add-on..........%s", IfPm3FpcUsartHost() ? _GREEN_("present") : _YELLOW_("absent")); + PrintAndLogEx(NORMAL, " firmware.................. %s", _YELLOW_("PM3RDV4")); + PrintAndLogEx(NORMAL, " external flash............ %s", IfPm3Flash() ? _GREEN_("present") : _YELLOW_("absent")); + PrintAndLogEx(NORMAL, " smartcard reader.......... %s", IfPm3Smartcard() ? _GREEN_("present") : _YELLOW_("absent")); + PrintAndLogEx(NORMAL, " FPC USART for BT add-on... %s", IfPm3FpcUsartHost() ? _GREEN_("present") : _YELLOW_("absent")); } if (IfPm3FpcUsartDevFromUsb()) { - PrintAndLogEx(NORMAL, " FPC USART for developer..........%s", _GREEN_("present")); + PrintAndLogEx(NORMAL, " FPC USART for developer... %s", _GREEN_("present")); } PrintAndLogEx(NORMAL, ""); From f1d39f7e53718951d9f7923c4a81ccd87c9f08a5 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 15:48:45 +0200 Subject: [PATCH 072/125] fix support for waveshare 1.54 --- client/src/cmdhf14a.c | 10 ++++++++-- client/src/cmdhfwaveshare.c | 15 +++++++++++++-- 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c index e9ddbf6c5..837311062 100644 --- a/client/src/cmdhf14a.c +++ b/client/src/cmdhf14a.c @@ -1681,10 +1681,16 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) { } getTagLabel(card.uid[0], card.uid[1]); break; - case 0x57: // Qualcomm + case 0x46: + if (memcmp(card.uid, "FSTN10m", 7) == 0) { + isMifareClassic = false; + printTag("Waveshare NFC-Powered e-Paper 1.54\" (please disregard MANUFACTURER mapping above)"); + } + break; + case 0x57: if (memcmp(card.uid, "WSDZ10m", 7) == 0) { isMifareClassic = false; - printTag("Waveshare NFC-Powered e-Paper"); + printTag("Waveshare NFC-Powered e-Paper (please disregard MANUFACTURER mapping above)"); } break; default: diff --git a/client/src/cmdhfwaveshare.c b/client/src/cmdhfwaveshare.c index 4e5728e7f..1ea7013a1 100644 --- a/client/src/cmdhfwaveshare.c +++ b/client/src/cmdhfwaveshare.c @@ -693,11 +693,21 @@ static int start_drawing(uint8_t model_nr, uint8_t *black, uint8_t *red) { return PM3_ESOFT; } - if ((card.uidlen != 7) || (memcmp(card.uid, "WSDZ10m", 7) != 0)) { + if ((card.uidlen != 7) || ((memcmp(card.uid, "FSTN10m", 7) != 0) && (memcmp(card.uid, "WSDZ10m", 7) != 0))) { PrintAndLogEx(WARNING, "Card doesn't look like Waveshare tag"); DropField(); return PM3_ESOFT; } + if (((model_nr != M1in54B) && (memcmp(card.uid, "FSTN10m", 7) == 0))) { + PrintAndLogEx(WARNING, "Card is a Waveshare tag 1.54\", not %s", models[model_nr].desc); + DropField(); + return PM3_ESOFT; + } + if (((model_nr == M1in54B) && (memcmp(card.uid, "FSTN10m", 7) != 0))) { + PrintAndLogEx(WARNING, "Card is not a Waveshare tag 1.54\", check your model number"); + DropField(); + return PM3_ESOFT; + } PrintAndLogEx(DEBUG, "model_nr = %d", model_nr); int ret; PrintAndLogEx(DEBUG, "Step0"); @@ -921,6 +931,7 @@ static int start_drawing(uint8_t model_nr, uint8_t *black, uint8_t *red) { msleep(200); } PrintAndLogEx(DEBUG, "Step11: Wait tag to be ready"); + PrintAndLogEx(INPLACE, "E-paper Reflashing, Waiting"); if (model_nr == M2in13B || model_nr == M1in54B) { // Black, white and red screen refresh time is longer, wait first msleep(9000); } else if (model_nr == M7in5HD) { @@ -950,7 +961,7 @@ static int start_drawing(uint8_t model_nr, uint8_t *black, uint8_t *red) { } else { fail_num++; PrintAndLogEx(INPLACE, "E-paper Reflashing, Waiting"); - msleep(100); + msleep(400); } } } From daabdf2e31cde2f8f91bb5e10452f05eb08bbdbc Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 21:21:24 +0200 Subject: [PATCH 073/125] Avoid spurious GCC10 stringop-overflow errors I already got them at several occasions --- Makefile.defs | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Makefile.defs b/Makefile.defs index 06eb2e36f..4045fb711 100644 --- a/Makefile.defs +++ b/Makefile.defs @@ -27,6 +27,9 @@ LD = g++ SH = sh BASH = bash PERL = perl +CCC =foo +CC_VERSION = $(shell $(CC) -dumpversion 2>/dev/null|sed 's/\..*//') +CC_VERSION := $(or $(strip $(CC_VERSION)),0) PATHSEP=/ PREFIX ?= /usr/local @@ -62,7 +65,11 @@ DEFCFLAGS += -Wbad-function-cast -Wredundant-decls -Wmissing-prototypes -Wchar-s # Some more warnings we need first to eliminate, so temporarely tolerated: DEFCFLAGS += -Wcast-align -Wno-error=cast-align DEFCFLAGS += -Wswitch-enum -Wno-error=switch-enum - +# GCC 10 has issues with false positives on stringop-overflow, let's disable them for now (cf https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92955, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94335) +# beware these flags didn't exist for GCC < 7 +ifeq ($(shell expr $(CC_VERSION) \>= 10), 1) + DEFCFLAGS += -Wno-stringop-overflow -Wno-error=stringop-overflow +endif ifeq ($(platform),Darwin) # their readline has strict-prototype issues DEFCFLAGS += -Wno-strict-prototypes From 8d14b46232b59a451973e67eeaa02266ad97a0d6 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Mon, 19 Oct 2020 21:25:24 +0200 Subject: [PATCH 074/125] waveshare: tolerate (but ignore) alpha channel --- client/src/cmdhfwaveshare.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/client/src/cmdhfwaveshare.c b/client/src/cmdhfwaveshare.c index 1ea7013a1..b47043be2 100644 --- a/client/src/cmdhfwaveshare.c +++ b/client/src/cmdhfwaveshare.c @@ -351,7 +351,7 @@ static void map8to1(uint8_t *colormap, uint16_t width, uint16_t height, uint8_t static int read_bmp_rgb(uint8_t *bmp, const size_t bmpsize, uint8_t model_nr, uint8_t **black, uint8_t **red, char *filename, bool save_conversions) { BMP_HEADER *pbmpheader = (BMP_HEADER *)bmp; // check file is full color - if (pbmpheader->bpp != 24) { + if ((pbmpheader->bpp != 24) && (pbmpheader->bpp != 32)) { return PM3_ESOFT; } @@ -400,6 +400,8 @@ static int read_bmp_rgb(uint8_t *bmp, const size_t bmpsize, uint8_t model_nr, ui chanB[X + (height - Y - 1) * width] = bmp[offset++]; chanG[X + (height - Y - 1) * width] = bmp[offset++]; chanR[X + (height - Y - 1) * width] = bmp[offset++]; + if (pbmpheader->bpp == 32) // Skip Alpha chan + offset++; } // Skip line padding offset += width % 4; @@ -436,6 +438,8 @@ static int read_bmp_rgb(uint8_t *bmp, const size_t bmpsize, uint8_t model_nr, ui bmp[offset++] = chanB[X + (height - Y - 1) * width] & 0xFF; bmp[offset++] = chanG[X + (height - Y - 1) * width] & 0xFF; bmp[offset++] = chanR[X + (height - Y - 1) * width] & 0xFF; + if (pbmpheader->bpp == 32) // Fill Alpha chan + bmp[offset++] = 0xFF; } // Skip line padding offset += width % 4; @@ -500,6 +504,8 @@ static int read_bmp_rgb(uint8_t *bmp, const size_t bmpsize, uint8_t model_nr, ui bmp[offset++] = chanGrey[X + (height - Y - 1) * width] & 0xFF; bmp[offset++] = chanGrey[X + (height - Y - 1) * width] & 0xFF; bmp[offset++] = chanGrey[X + (height - Y - 1) * width] & 0xFF; + if (pbmpheader->bpp == 32) // Fill Alpha chan + bmp[offset++] = 0xFF; } // Skip line padding offset += width % 4; @@ -1059,11 +1065,13 @@ static int CmdHF14AWSLoadBmp(const char *Cmd) { return PM3_ESOFT; } } else if (depth == 32) { - PrintAndLogEx(ERR, "Error, BMP color depth %i not supported. Remove alpha channel.", depth); - free(bmp); - return PM3_ESOFT; + PrintAndLogEx(DEBUG, "BMP file is a RGBA, we will ignore the Alpha channel"); + if (read_bmp_rgb(bmp, bytes_read, model_nr, &black, &red, filename, save_conversions) != PM3_SUCCESS) { + free(bmp); + return PM3_ESOFT; + } } else { - PrintAndLogEx(ERR, "Error, BMP color depth %i not supported. Must be 1 (BW) or 24 (RGB)", depth); + PrintAndLogEx(ERR, "Error, BMP color depth %i not supported. Must be 1 (BW), 24 (RGB) or 32 (RGBA)", depth); free(bmp); return PM3_ESOFT; } From 86ff6aebefeed0759e4529035f05f1758fed8b73 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Tue, 20 Oct 2020 00:45:03 +0200 Subject: [PATCH 075/125] vscode --- .vscode/launch.json | 55 ++++++++++++++++++++++++++++++++++ .vscode/tasks.json | 73 +++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 122 insertions(+), 6 deletions(-) create mode 100644 .vscode/launch.json diff --git a/.vscode/launch.json b/.vscode/launch.json new file mode 100644 index 000000000..f115c5c7e --- /dev/null +++ b/.vscode/launch.json @@ -0,0 +1,55 @@ +{ + // Use IntelliSense to learn about possible attributes. + // Hover to view descriptions of existing attributes. + // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387 + "version": "0.2.0", + "configurations": [ + { + "name": "(gdb) Attach", + "type": "cppdbg", + "request": "attach", + "program": "${cwd}/client/proxmark3", + //"processId": "${command:pickProcess}", + "processId": "${input:ProcessID}", + "MIMode": "gdb", + "setupCommands": [ + { + "description": "Enable pretty-printing for gdb", + "text": "-enable-pretty-printing", + "ignoreFailures": true + } + ] + },{ + "name": "(gdb) Build & Launch", + "type": "cppdbg", + "request": "launch", + "program": "${cwd}/client/proxmark3", + "args": ["/dev/ttyACM0"], + "stopAtEntry": false, + "cwd": "${workspaceFolder}", + "environment": [], + "externalConsole": false, + "MIMode": "gdb", + "setupCommands": [ + { + "description": "Enable pretty-printing for gdb", + "text": "-enable-pretty-printing", + "ignoreFailures": true + } + ], + "preLaunchTask": "Debug: clean & make client", + "miDebuggerPath": "/usr/bin/gdb" + } + ], + "inputs": [ + { + // Using Extension "Tasks Shell Input" https://marketplace.visualstudio.com/items?itemName=augustocdias.tasks-shell-input + "id": "ProcessID", + "type": "command", + "command": "shellCommand.execute", + "args": { + "command": "pgrep -n proxmark3", + } + } + ] +} \ No newline at end of file diff --git a/.vscode/tasks.json b/.vscode/tasks.json index 20b68be0e..352f22a42 100644 --- a/.vscode/tasks.json +++ b/.vscode/tasks.json @@ -4,24 +4,85 @@ "version": "2.0.0", "tasks": [ { - "label": "build", + "label": "Make all & run", "type": "shell", - "command": "make clean && make all -j$(nproc --all)", + "command": "make -j && ./pm3", "problemMatcher": [ "$gcc" - ] + ], + "group": { + "kind": "build", + "isDefault": true + } }, { - "label": "flash fullimage", + "label": "Make TARGET", "type": "shell", - "command": "sudo ./pm3-flash-fullimage", + "command": "make ${input:componentType} -j", + "problemMatcher": [ + "$gcc" + ], + "group": "build", + }, + { + "label": "Debug: make client", + "type": "shell", + "command": "make client -j DEBUG=1", + "problemMatcher": [ + "$gcc" + ], + "group": "build", + }, + { + "label": "Debug: clean & make client", + "type": "shell", + "command": "make client/clean && make client -j DEBUG=1", + "problemMatcher": [ + "$gcc" + ], + "group": "build", + }, + { + "label": "Flash fullimage", + "type": "shell", + "command": "./pm3-flash-fullimage", "problemMatcher": [] }, { "label": "FLASH BOOTROM", "type": "shell", - "command": "sudo ./pm3-flash-bootrom", + "command": "./pm3-flash-bootrom", "problemMatcher": [] + }, + { + "label": "Run client", + "type": "shell", + "command": "./pm3", + "problemMatcher": [], + "dependsOn": [ + "Release: build client" + ] + } + ], + "inputs": [ + { + "type": "pickString", + "id": "componentType", + "description": "What Makefile target do you want to execute?", + "options": [ + "all", + "client", + "bootrom", + "fullimage", + "recovery", + "clean", + "install", + "uninstall", + "style", + "miscchecks", + "check", + ], + "default": "all" } ] } \ No newline at end of file From ec820db997af8c9a7508d21b204a72a2debb0204 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Tue, 20 Oct 2020 01:00:00 +0200 Subject: [PATCH 076/125] Add DEBUG flag to Makefile --- Makefile.defs | 12 +++++++++--- doc/md/Development/Makefile-vs-CMake.md | 5 +++-- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/Makefile.defs b/Makefile.defs index 4045fb711..a06cbb31e 100644 --- a/Makefile.defs +++ b/Makefile.defs @@ -51,9 +51,15 @@ else RANLIB= ranlib endif -DEFCXXFLAGS = -Wall -Werror -O3 -pipe -DEFCFLAGS = -Wall -Werror -O3 -fstrict-aliasing -pipe -DEFLDFLAGS = +ifeq ($(DEBUG),1) + DEFCXXFLAGS = -g -O0 -pipe + DEFCFLAGS = -g -O0 -fstrict-aliasing -pipe + DEFLDFLAGS = +else + DEFCXXFLAGS = -Wall -Werror -O3 -pipe + DEFCFLAGS = -Wall -Werror -O3 -fstrict-aliasing -pipe + DEFLDFLAGS = +endif # Next ones are activated only if SANITIZE=1 ifeq ($(SANITIZE),1) DEFCFLAGS += -g -fsanitize=address -fno-omit-frame-pointer diff --git a/doc/md/Development/Makefile-vs-CMake.md b/doc/md/Development/Makefile-vs-CMake.md index 314cd1e7a..6fa95066c 100644 --- a/doc/md/Development/Makefile-vs-CMake.md +++ b/doc/md/Development/Makefile-vs-CMake.md @@ -13,7 +13,8 @@ At the moment both are maintained because they don't perfectly overlap yet. | Feature | Makefile | CMake | Remarks | |-----|---|---|---| -| verbose | V=1 | VERBOSE=1 | | +| verbose | `V=1` | `VERBOSE=1` | | +| debug build | `DEBUG=1` | `-DCMAKE_BUILD_TYPE=Debug` | client only | | warnings management | yes (1) | **no** | (1) cf Makefile.defs | | extra GCC warnings | GCCEXTRA=1 | **no** | | | extra Clang warnings | CLANGEXTRA=1 | **no** | only on host | @@ -32,7 +33,7 @@ At the moment both are maintained because they don't perfectly overlap yet. | bzip2 detection | **none** | find_package, Cross:gitclone | | | dep cliparser | in_deps | in_deps | | | dep hardnested | in_deps | in_deps | | -| hardn arch autodetect | `uname -m` =? 86 or amd64; `$(CC) -E -mavx512f`? +AVX512` | `CMAKE_SYSTEM_PROCESSOR` =? x86 or x86_64 or i686 or AMD64 (1) | (1) currently it always includes AVX512 on Intel arch | +| hardn arch autodetect | `uname -m` =? 86 or amd64; `$(CC) -E -mavx512f`? +`AVX512` | `CMAKE_SYSTEM_PROCESSOR` =? x86 or x86_64 or i686 or AMD64 (1) | (1) currently it always includes AVX512 on Intel arch | | `cpu_arch` | yes | **no/auto?** | e.g. `cpu_arch=generic` for cross-compilation | dep jansson | sys / in_deps | sys / in_deps | | | jansson detection | pc | pc/find* | | From 29f1147aadc64bf9bbcaf9bafcb856da4ece1e68 Mon Sep 17 00:00:00 2001 From: Philippe Teuwen Date: Tue, 20 Oct 2020 01:00:23 +0200 Subject: [PATCH 077/125] make style --- armsrc/appmain.c | 20 ++-- armsrc/em4x50.c | 22 ++-- armsrc/iclass.c | 30 +++--- armsrc/iso14443a.c | 2 +- armsrc/iso15693.c | 12 +-- armsrc/mifarecmd.c | 18 ++-- client/deps/cliparser/cliparser.c | 16 +-- client/src/cmdhf14a.c | 22 ++-- client/src/cmdhf14b.c | 2 +- client/src/cmdhf15.c | 22 ++-- client/src/cmdhficlass.c | 70 ++++++------- client/src/cmdhfmfp.c | 4 +- client/src/cmdhfmfu.c | 80 +++++++------- client/src/cmdhfst.c | 6 +- client/src/cmdlf.c | 2 +- client/src/cmdlfdestron.c | 8 +- client/src/cmdlfem4x05.c | 168 +++++++++++++++--------------- client/src/cmdlfem4x50.c | 2 +- client/src/cmdlffdxb.c | 6 +- client/src/cmdlfindala.c | 4 +- client/src/cmdlfmotorola.c | 8 +- client/src/scripting.c | 18 ++-- doc/commands.md | 25 ++++- include/pm3_cmd.h | 2 +- 24 files changed, 292 insertions(+), 277 deletions(-) diff --git a/armsrc/appmain.c b/armsrc/appmain.c index 02d6f1d23..6b127c831 100644 --- a/armsrc/appmain.c +++ b/armsrc/appmain.c @@ -1481,12 +1481,12 @@ static void PacketReceived(PacketCommandNG *packet) { MifareU_Otp_Tearoff(packet->oldarg[0], packet->oldarg[1], packet->data.asBytes); break; } - case CMD_HF_MFU_COUNTER_TEAROFF: { + case CMD_HF_MFU_COUNTER_TEAROFF: { struct p { uint8_t counter; uint32_t tearoff_time; } PACKED; - struct p *payload = (struct p *) packet->data.asBytes; + struct p *payload = (struct p *) packet->data.asBytes; MifareU_Counter_Tearoff(payload->counter, payload->tearoff_time); break; } @@ -1520,13 +1520,13 @@ static void PacketReceived(PacketCommandNG *packet) { break; } case CMD_HF_ICLASS_SIMULATE: { -/* - struct p { - uint8_t reader[4]; - uint8_t mac[4]; - } PACKED; - struct p *payload = (struct p *) packet->data.asBytes; -*/ + /* + struct p { + uint8_t reader[4]; + uint8_t mac[4]; + } PACKED; + struct p *payload = (struct p *) packet->data.asBytes; + */ SimulateIClass(packet->oldarg[0], packet->oldarg[1], packet->oldarg[2], packet->data.asBytes); break; @@ -1562,7 +1562,7 @@ static void PacketReceived(PacketCommandNG *packet) { break; } case CMD_HF_ICLASS_RESTORE: { - iClass_Restore( (iclass_restore_req_t *)packet->data.asBytes); + iClass_Restore((iclass_restore_req_t *)packet->data.asBytes); break; } #endif diff --git a/armsrc/em4x50.c b/armsrc/em4x50.c index bce422908..9ab8dcf35 100644 --- a/armsrc/em4x50.c +++ b/armsrc/em4x50.c @@ -889,18 +889,18 @@ static int write(uint8_t word[4], uint8_t address) { return PM3_ETEAROFF; } else { - // wait for T0 * EM4X50_T_TAG_TWA (write access time) - wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); + // wait for T0 * EM4X50_T_TAG_TWA (write access time) + wait_timer(FPGA_TIMER_0, T0 * EM4X50_T_TAG_TWA); - // look for ACK sequence - if (check_ack(false)) { + // look for ACK sequence + if (check_ack(false)) { - // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time) - // for saving data and should return with ACK - if (check_ack(false)) - return PM3_SUCCESS; + // now EM4x50 needs T0 * EM4X50_T_TAG_TWEE (EEPROM write time) + // for saving data and should return with ACK + if (check_ack(false)) + return PM3_SUCCESS; - } + } } } else { @@ -985,7 +985,7 @@ void em4x50_write(em4x50_data_t *etd) { lf_finalize(); return; } - + if (res == PM3_SUCCESS) { // to verify result reset EM4x50 if (reset()) { @@ -1033,7 +1033,7 @@ void em4x50_write_password(em4x50_data_t *etd) { // login and change password if (login(etd->password)) { - + int res = write_password(etd->password, etd->new_password); if (res == PM3_ETEAROFF) { lf_finalize(); diff --git a/armsrc/iclass.c b/armsrc/iclass.c index 204cd9ea1..03f7dcbba 100644 --- a/armsrc/iclass.c +++ b/armsrc/iclass.c @@ -1367,7 +1367,7 @@ static bool select_iclass_tag_ex(picopass_hdr *hdr, bool use_credit_key, uint32_ *status |= FLAG_ICLASS_CC; } else { - + // on NON_SECURE_PAGEMODE cards, AIA is on block2.. // read App Issuer Area block 2 @@ -1443,7 +1443,7 @@ void ReaderIClass(uint8_t flags) { // with 0xFF:s in block 3 and 4. LED_B_ON(); - reply_mix(CMD_ACK, result_status, 0, 0, (uint8_t*)&hdr, sizeof(hdr)); + reply_mix(CMD_ACK, result_status, 0, 0, (uint8_t *)&hdr, sizeof(hdr)); //Send back to client, but don't bother if we already sent this - // only useful if looping in arm (not try_once && not abort_after_read) @@ -1489,9 +1489,9 @@ bool authenticate_iclass_tag(iclass_auth_req_t *payload, picopass_hdr *hdr, uint memcpy(ccnr, hdr->epurse, sizeof(hdr->epurse)); - if ( payload->use_replay) { + if (payload->use_replay) { - memcpy(pmac, payload->key + 4, 4); + memcpy(pmac, payload->key + 4, 4); memcpy(cmd_check + 1, payload->key, 8); } else { @@ -1780,7 +1780,7 @@ static bool iclass_writeblock_ext(uint8_t blockno, uint8_t *data, uint8_t *mac) // write command: cmd, 1 blockno, 8 data, 4 mac uint8_t write[16] = { 0x80 | ICLASS_CMD_UPDATE, blockno }; - memcpy(write + 2, data, 8); + memcpy(write + 2, data, 8); memcpy(write + 10, mac, 4); AddCrc(write + 1, 13); @@ -1872,11 +1872,11 @@ void iClass_WriteBlock(uint8_t *msg) { iclass_send_as_reader(write, sizeof(write), &start_time, &eof_time); if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured - res = false; - switch_off(); - if (payload->req.send_reply) - reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t *)&res, sizeof(uint8_t)); - return; + res = false; + switch_off(); + if (payload->req.send_reply) + reply_ng(CMD_HF_ICLASS_WRITEBL, PM3_ETEAROFF, (uint8_t *)&res, sizeof(uint8_t)); + return; } else { if (GetIso15693AnswerFromTag(resp, sizeof(resp), ICLASS_READER_TIMEOUT_UPDATE, &eof_time) == 10) { @@ -1885,7 +1885,7 @@ void iClass_WriteBlock(uint8_t *msg) { } } } - + if (tries == 0) { res = false; goto out; @@ -1932,7 +1932,7 @@ void iClass_Restore(iclass_restore_req_t *msg) { if (msg->req.send_reply) { reply_ng(CMD_HF_ICLASS_RESTORE, PM3_ESOFT, NULL, 0); } - return; + return; } LED_A_ON(); @@ -1942,7 +1942,7 @@ void iClass_Restore(iclass_restore_req_t *msg) { uint32_t eof_time = 0; picopass_hdr hdr = {0}; - // select + // select bool res = select_iclass_tag(&hdr, msg->req.use_credit_key, &eof_time); if (res == false) { goto out; @@ -1974,7 +1974,7 @@ void iClass_Restore(iclass_restore_req_t *msg) { doMAC_N(wb, sizeof(wb), hdr.key_c, mac); else doMAC_N(wb, sizeof(wb), hdr.key_d, mac); - + // data + mac if (iclass_writeblock_ext(item.blockno, item.data, mac)) { Dbprintf("Write block [%02x] " _GREEN_("successful"), item.blockno); @@ -1983,7 +1983,7 @@ void iClass_Restore(iclass_restore_req_t *msg) { Dbprintf("Write block [%02x] " _RED_("failed"), item.blockno); } } - + out: switch_off(); diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c index d40080ae1..6e1e22738 100644 --- a/armsrc/iso14443a.c +++ b/armsrc/iso14443a.c @@ -2629,7 +2629,7 @@ int iso14443a_select_card(uint8_t *uid_ptr, iso14a_card_select_t *p_card, uint32 AddCrc14A(rats, 2); ReaderTransmit(rats, sizeof(rats), NULL); int len = ReaderReceive(resp, resp_par); - if (len == 0) + if (len == 0) return 0; if (p_card) { diff --git a/armsrc/iso15693.c b/armsrc/iso15693.c index 00af14c4f..bacceb165 100644 --- a/armsrc/iso15693.c +++ b/armsrc/iso15693.c @@ -1474,13 +1474,13 @@ int SendDataTag(uint8_t *send, int sendlen, bool init, bool speed_fast, uint8_t int res = 0; tosend_t *ts = get_tosend(); TransmitTo15693Tag(ts->buf, ts->max, &start_time); - + if (tearoff_hook() == PM3_ETEAROFF) { // tearoff occured res = PM3_ETEAROFF; } else { - + *eof_time = start_time + 32 * ((8 * ts->max) - 4); // substract the 4 padding bits after EOF LogTrace_ISO15693(send, sendlen, (start_time * 4), (*eof_time * 4), NULL, true); if (recv != NULL) { @@ -1595,11 +1595,11 @@ void ReaderIso15693(uint32_t parameter) { uint32_t start_time = 0; uint32_t eof_time; int recvlen = SendDataTag(cmd, sizeof(cmd), true, true, answer, ISO15693_MAX_RESPONSE_LENGTH, start_time, ISO15693_READER_TIMEOUT, &eof_time); - + if (recvlen == PM3_ETEAROFF) { // tearoff occured reply_mix(CMD_ACK, recvlen, 0, 0, NULL, 0); } else { - + start_time = eof_time + DELAY_ISO15693_VICC_TO_VCD_READER; // we should do a better check than this @@ -1634,7 +1634,7 @@ void ReaderIso15693(uint32_t parameter) { } } else { DbpString("Failed to select card"); - reply_mix(CMD_ACK, 0, 0, 0, NULL, 0); + reply_mix(CMD_ACK, 0, 0, 0, NULL, 0); } } switch_off(); @@ -1869,7 +1869,7 @@ void DirectTag15693Command(uint32_t datalen, uint32_t speed, uint32_t recv, uint } if (recv) { - recvlen = MIN(recvlen,ISO15693_MAX_RESPONSE_LENGTH); + recvlen = MIN(recvlen, ISO15693_MAX_RESPONSE_LENGTH); reply_mix(CMD_ACK, recvlen, 0, 0, recvbuf, recvlen); } else { reply_mix(CMD_ACK, 1, 0, 0, NULL, 0); diff --git a/armsrc/mifarecmd.c b/armsrc/mifarecmd.c index f442166f4..11c89a98b 100644 --- a/armsrc/mifarecmd.c +++ b/armsrc/mifarecmd.c @@ -2752,15 +2752,15 @@ void MifareU_Counter_Tearoff(uint8_t counter, uint32_t tearoff_time) { // Send MFU counter increase cmd uint8_t cmd[] = { - MIFARE_ULEV1_INCR_CNT, - counter, - 0, // lsb - 0, - 0, // msb - 0, // rfu - 0, - 0, - }; + MIFARE_ULEV1_INCR_CNT, + counter, + 0, // lsb + 0, + 0, // msb + 0, // rfu + 0, + 0, + }; AddCrc14A(cmd, sizeof(cmd) - 2); // anticollision / select card diff --git a/client/deps/cliparser/cliparser.c b/client/deps/cliparser/cliparser.c index a601e6490..258346c00 100644 --- a/client/deps/cliparser/cliparser.c +++ b/client/deps/cliparser/cliparser.c @@ -205,9 +205,9 @@ int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int int tmplen = 0; uint8_t tmpstr[(256 * 2) + 1] = {0}; - + // concat all strings in argstr into tmpstr[] - // + // int res = CLIParamStrToBuf(argstr, tmpstr, sizeof(tmpstr), &tmplen); if (res) { return res; @@ -216,7 +216,7 @@ int CLIParamHexToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int return res; } - res = param_gethex_to_eol((char*)tmpstr, 0, data, maxdatalen, datalen); + res = param_gethex_to_eol((char *)tmpstr, 0, data, maxdatalen, datalen); switch (res) { case 1: printf("Parameter error: Invalid HEX value\n"); @@ -241,20 +241,20 @@ int CLIParamStrToBuf(struct arg_str *argstr, uint8_t *data, int maxdatalen, int int ibuf = 0; for (int i = 0; i < argstr->count; i++) { - + int len = strlen(argstr->sval[i]); - - if (len > ( (sizeof(tmpstr) / 2 ) - ibuf)) { + + if (len > ((sizeof(tmpstr) / 2) - ibuf)) { printf("Parameter error: string too long (%i chars), expect MAX %zu chars\n", len + ibuf, (sizeof(tmpstr) / 2)); fflush(stdout); return 2; } - + memcpy(&tmpstr[ibuf], argstr->sval[i], len); ibuf += len; } - + ibuf = MIN(ibuf, (sizeof(tmpstr) / 2)); tmpstr[ibuf] = 0; diff --git a/client/src/cmdhf14a.c b/client/src/cmdhf14a.c index 837311062..dac2193c6 100644 --- a/client/src/cmdhf14a.c +++ b/client/src/cmdhf14a.c @@ -1843,30 +1843,30 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) { if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) { tip = "-> MIFARE Plus X 2K/4K (SL3)"; } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { - + if ((card.atqa[0] & 0x02) == 0x02) tip = "-> MIFARE Plus S 2K (SL3)"; else if ((card.atqa[0] & 0x04) == 0x04) tip = "-> MIFARE Plus S 4K (SL3)"; - + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x00\xF6\xD1", 7) == 0) { tip = "-> MIFARE Plus SE 1K (17pF)"; - } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x10\xF6\xD1", 7) == 0) { + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x10\xF6\xD1", 7) == 0) { tip = "-> MIFARE Plus SE 1K (70pF)"; } - - } else { //SAK B4,5,6 - - if ((card.sak & 0x20) == 0x20) { // and no GetVersion().. - - + + } else { //SAK B4,5,6 + + if ((card.sak & 0x20) == 0x20) { // and no GetVersion().. + + if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x01\xBC\xD6", 7) == 0) { tip = "-> MIFARE Plus X 2K (SL1)"; } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { tip = "-> MIFARE Plus S 2K (SL1)"; } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x00\xF6\xD1", 7) == 0) { tip = "-> MIFARE Plus SE 1K (17pF)"; - } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x10\xF6\xD1", 7) == 0) { + } else if (memcmp(card.ats + pos, "\xC1\x05\x21\x30\x10\xF6\xD1", 7) == 0) { tip = "-> MIFARE Plus SE 1K (70pF)"; } } else { @@ -1874,7 +1874,7 @@ int infoHF14A(bool verbose, bool do_nack_test, bool do_aid_search) { tip = "-> MIFARE Plus X 4K (SL1)"; } else if (memcmp(card.ats + pos, "\xC1\x05\x2F\x2F\x00\x35\xC7", 7) == 0) { tip = "-> MIFARE Plus S 4K (SL1)"; - } + } } } diff --git a/client/src/cmdhf14b.c b/client/src/cmdhf14b.c index 85898fe04..73f8c2a8f 100644 --- a/client/src/cmdhf14b.c +++ b/client/src/cmdhf14b.c @@ -149,7 +149,7 @@ static int CmdHF14BSim(const char *Cmd) { PrintAndLogEx(FAILED, "failed to read pupi"); return PM3_EINVARG; } - + PrintAndLogEx(INFO, "Simulate with PUPI : " _GREEN_("%s"), sprint_hex_inrow(pupi, sizeof(pupi))); PrintAndLogEx(INFO, "Press pm3-button to abort simulation"); clearCommandBuffer(); diff --git a/client/src/cmdhf15.c b/client/src/cmdhf15.c index b4cde234f..6d276617c 100644 --- a/client/src/cmdhf15.c +++ b/client/src/cmdhf15.c @@ -656,13 +656,13 @@ static int CmdHF15Demod(const char *Cmd) { }; CLIExecWithReturn(ctx, Cmd, argtable, true); CLIParserFree(ctx); - + // The sampling rate is 106.353 ksps/s, for T = 18.8 us int i, j; int max = 0, maxPos = 0; int skip = 4; - if (GraphTraceLen < 1000) { + if (GraphTraceLen < 1000) { PrintAndLogEx(FAILED, "Too few samples in GraphBuffer. Need more than 1000"); PrintAndLogEx(HINT, "Run " _YELLOW_("`hf 15 samples`") " to collect and download data"); return PM3_ESOFT; @@ -733,8 +733,8 @@ static int CmdHF15Demod(const char *Cmd) { PrintAndLogEx(WARNING, "Warning, uneven octet! (discard extra bits!)"); PrintAndLogEx(INFO, " mask = %02x", mask); } - - if ( k == 0 ) { + + if (k == 0) { return PM3_SUCCESS; } @@ -744,7 +744,7 @@ static int CmdHF15Demod(const char *Cmd) { PrintAndLogEx(NORMAL, ""); PrintAndLogEx(SUCCESS, " idx | data"); PrintAndLogEx(SUCCESS, "-----+-------------------------------------------------"); - if ( k / 16 > 0) { + if (k / 16 > 0) { for (; i < k; i += 16) { PrintAndLogEx(SUCCESS, " %3i | %s", i, sprint_hex(outBuf + i, 16)); } @@ -824,7 +824,7 @@ static int NxpSysInfo(uint8_t *uid) { if (status == PM3_ETEAROFF) { return status; } - + if (status < 2) { PrintAndLogEx(WARNING, "iso15693 card doesn't answer to NXP systeminfo command"); return PM3_EWRONGANSWER; @@ -1058,7 +1058,7 @@ static int CmdHF15Sniff(const char *Cmd) { }; CLIExecWithReturn(ctx, Cmd, argtable, true); CLIParserFree(ctx); - + PacketResponseNG resp; clearCommandBuffer(); SendCommandNG(CMD_HF_ISO15693_SNIFF, NULL, 0); @@ -1111,7 +1111,7 @@ static int CmdHF15Sim(const char *Cmd) { struct { uint8_t uid[8]; } PACKED payload; - + int uidlen = 0; CLIGetHexWithReturn(ctx, 1, payload.uid, &uidlen); CLIParserFree(ctx); @@ -1904,11 +1904,11 @@ static int CmdHF15CSetUID(const char *Cmd) { struct { uint8_t uid[8]; } PACKED payload; - + int uidlen = 0; CLIGetHexWithReturn(ctx, 1, payload.uid, &uidlen); CLIParserFree(ctx); - + if (uidlen != 8) { PrintAndLogEx(WARNING, "UID must include 16 HEX symbols got "); return PM3_EINVARG; @@ -1936,7 +1936,7 @@ static int CmdHF15CSetUID(const char *Cmd) { if (WaitForResponseTimeout(CMD_HF_ISO15693_CSETUID, &resp, 2000) == false) { PrintAndLogEx(WARNING, "timeout while waiting for reply"); DropField(); - return PM3_ESOFT; + return PM3_ESOFT; } PrintAndLogEx(INFO, "getting updated card details..."); diff --git a/client/src/cmdhficlass.c b/client/src/cmdhficlass.c index e9aaa1880..782e782eb 100644 --- a/client/src/cmdhficlass.c +++ b/client/src/cmdhficlass.c @@ -427,7 +427,7 @@ static void fuse_config(const picopass_hdr *hdr) { uint16_t otp = (hdr->conf.otp[1] << 8 | hdr->conf.otp[0]); - PrintAndLogEx(INFO, " Raw: " _YELLOW_("%s"), sprint_hex((uint8_t*)&hdr->conf, 8)); + PrintAndLogEx(INFO, " Raw: " _YELLOW_("%s"), sprint_hex((uint8_t *)&hdr->conf, 8)); PrintAndLogEx(INFO, " " _YELLOW_("%02X") "..................... app limit", hdr->conf.app_limit); PrintAndLogEx(INFO, " " _YELLOW_("%04X") " ( %5u )...... OTP", otp, otp); PrintAndLogEx(INFO, " " _YELLOW_("%02X") "............ block write lock", hdr->conf.block_writelock); @@ -1540,7 +1540,7 @@ static int CmdHFiClassDump(const char *Cmd) { PrintAndLogEx(SUCCESS, "Using " _YELLOW_("replay NR/MAC mode")); use_replay = true; cmdp++; - break; + break; default: PrintAndLogEx(WARNING, "Unknown parameter '%c'\n", param_getchar(Cmd, cmdp)); errors = true; @@ -1552,7 +1552,7 @@ static int CmdHFiClassDump(const char *Cmd) { PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); errors = true; } - + if (errors) return usage_hf_iclass_dump(); uint32_t flags = (FLAG_ICLASS_READER_INIT | FLAG_ICLASS_READER_CLEARTRACE); @@ -1788,7 +1788,7 @@ write_dump: } static int iclass_write_block(uint8_t blockno, uint8_t *bldata, uint8_t *KEY, bool use_credit_key, bool elite, bool rawkey, bool replay, bool verbose) { - + iclass_writeblock_req_t payload = { .req.use_raw = rawkey, .req.use_elite = elite, @@ -1882,13 +1882,13 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { rawkey = true; cmdp++; break; -/* - case 'n': - PrintAndLogEx(SUCCESS, "Using " _YELLOW_("replay NR/MAC mode")); - use_replay = true; - cmdp++; - break; -*/ + /* + case 'n': + PrintAndLogEx(SUCCESS, "Using " _YELLOW_("replay NR/MAC mode")); + use_replay = true; + cmdp++; + break; + */ case 'v': verbose = true; cmdp++; @@ -1910,7 +1910,7 @@ static int CmdHFiClass_WriteBlock(const char *Cmd) { if (errors || cmdp < 6) return usage_hf_iclass_writeblock(); int isok = iclass_write_block(blockno, bldata, KEY, use_credit_key, elite, rawkey, use_replay, verbose); - switch(isok) { + switch (isok) { case PM3_SUCCESS: PrintAndLogEx(SUCCESS, "Wrote block %02X successful", blockno); break; @@ -2043,24 +2043,24 @@ static int CmdHFiClassRestore(const char *Cmd) { return PM3_EFILE; } - if (bytes_read < ((endblock - startblock + 1) * 8 )) { + if (bytes_read < ((endblock - startblock + 1) * 8)) { PrintAndLogEx(ERR, "file is smaller than your suggested block range ( " _RED_("0x%02x..0x%02x")" )", - startblock, endblock - ); + startblock, endblock + ); free(dump); return PM3_EFILE; } iclass_restore_req_t *payload = calloc(1, payload_size); payload->req.use_raw = rawkey, - payload->req.use_elite = elite, - payload->req.use_credit_key = use_credit_key, - payload->req.use_replay = false, - payload->req.blockno = startblock, - payload->req.send_reply = true, - payload->req.do_auth = true, - memcpy(payload->req.key, KEY, 8); - + payload->req.use_elite = elite, + payload->req.use_credit_key = use_credit_key, + payload->req.use_replay = false, + payload->req.blockno = startblock, + payload->req.send_reply = true, + payload->req.do_auth = true, + memcpy(payload->req.key, KEY, 8); + payload->item_cnt = (endblock - startblock + 1); // read data from file from block 6 --- 19 @@ -2068,21 +2068,21 @@ static int CmdHFiClassRestore(const char *Cmd) { // then copy to usbcommand->asbytes; // max is 32 - 6 = 28 block. 28 x 12 bytes gives 336 bytes - for (uint8_t i = 0; i < payload->item_cnt; i++) { + for (uint8_t i = 0; i < payload->item_cnt; i++) { payload->blocks[i].blockno = startblock + i; - memcpy(payload->blocks[i].data, dump + (startblock * 8) + (i * 8) , sizeof(payload->blocks[i].data)); + memcpy(payload->blocks[i].data, dump + (startblock * 8) + (i * 8), sizeof(payload->blocks[i].data)); } free(dump); if (verbose) { PrintAndLogEx(INFO, "Preparing to restore block range 0x%02x..0x%02x", startblock, endblock); - + PrintAndLogEx(INFO, "------+----------------------"); PrintAndLogEx(INFO, "block | data"); PrintAndLogEx(INFO, "------+----------------------"); - for (uint8_t i = 0; i < payload->item_cnt; i++) { + for (uint8_t i = 0; i < payload->item_cnt; i++) { iclass_restore_item_t item = payload->blocks[i]; PrintAndLogEx(INFO, " %02X | %s", item.blockno, sprint_hex_inrow(item.data, sizeof(item.data))); } @@ -2233,7 +2233,7 @@ static int CmdHFiClass_ReadBlock(const char *Cmd) { } if (got_blockno == false) errors = true; - + if ((use_replay + rawkey + elite) > 1) { PrintAndLogEx(FAILED, "Can not use a combo of 'e', 'r', 'n'"); errors = true; @@ -2405,7 +2405,7 @@ void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t e PrintAndLogEx(INFO, " blk| data | ascii |lck| info"); PrintAndLogEx(INFO, "----+-------------------------+----------+---+--------------"); PrintAndLogEx(INFO, "0x00| " _GREEN_("%s") " | | CSN ", sprint_hex_ascii(iclass_dump, 8)); - + if (i != 1) PrintAndLogEx(INFO, "...."); @@ -2455,8 +2455,8 @@ void printIclassDumpContents(uint8_t *iclass_dump, uint8_t startblock, uint8_t e const char *s = info_nonks[3]; if (i < 3) { s = info_nonks[i]; - } - + } + PrintAndLogEx(INFO, "0x%02X| %s | %s | %s ", i, sprint_hex_ascii(blk, 8), lockstr, s); } else { const char *info_ks[] = {"CSN", "Config", "E-purse", "Debit", "Credit", "AIA", "User"}; @@ -2978,8 +2978,8 @@ static int CmdHFiClassCheckKeys(const char *Cmd) { free(keyBlock); return res; } - - // Get CSN / UID and CCNR + + // Get CSN / UID and CCNR PrintAndLogEx(SUCCESS, "Reading tag CSN / CCNR..."); for (uint8_t i = 0; i < ICLASS_AUTH_RETRY && !got_csn; i++) { got_csn = select_only(CSN, CCNR, false); @@ -2993,7 +2993,7 @@ static int CmdHFiClassCheckKeys(const char *Cmd) { DropField(); return PM3_ESOFT; } - + iclass_premac_t *pre = calloc(keycount, sizeof(iclass_premac_t)); if (pre == NULL) { return PM3_EMALLOC; @@ -3449,7 +3449,7 @@ static int CmdHFiClassAutopwn(const char *Cmd) { }; CLIExecWithReturn(ctx, Cmd, argtable, true); CLIParserFree(ctx); - + // Check keys. // dump diff --git a/client/src/cmdhfmfp.c b/client/src/cmdhfmfp.c index 7d9c077fb..fd0f6c93a 100644 --- a/client/src/cmdhfmfp.c +++ b/client/src/cmdhfmfp.c @@ -294,9 +294,9 @@ static int CmdHFMFPInfo(const char *Cmd) { } else { // info about 14a part infoHF14A(false, false, false); - + // Historical bytes. - + } diff --git a/client/src/cmdhfmfu.c b/client/src/cmdhfmfu.c index c472b8d59..55e03a848 100644 --- a/client/src/cmdhfmfu.c +++ b/client/src/cmdhfmfu.c @@ -242,7 +242,7 @@ static int usage_hf_mfu_otp_tearoff(void) { PrintAndLogEx(NORMAL, " s