Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
CTF From Zero To One
Inndy
December 17, 2016
Technology
4
3.2k
CTF From Zero To One
2016 / TDOH Conf
Inndy
December 17, 2016
Tweet
Share
More Decks by Inndy
See All by Inndy
inndy
0
10
inndy
3
2k
inndy
2
550
inndy
0
250
inndy
7
3k
inndy
0
1.1k
inndy
33
6.3k
inndy
1
580
inndy
4
1.3k
Other Decks in Technology
See All in Technology
takaking22
2
510
sasakendayo
2
450
kilometer
0
150
bells17
0
590
nkjzm
1
870
ytaka23
5
1.6k
saik1010
0
410
stakaya
14
8.4k
oyakata2438
0
290
yasuakiomokawa
0
400
kraj
0
3.7k
hisaichi5518
0
200
Featured
See All Featured
zakiwarfel
88
3.3k
imathis
478
150k
lemiorhan
627
43k
robhawkes
52
2.8k
searls
204
35k
pedronauck
652
110k
hatefulcrawdad
257
17k
jasonvnalue
82
8.1k
62gerente
587
200k
colly
66
3k
skipperchong
7
670
qrush
285
18k
Transcript
5%0)$POG *OOEZJOOEZUX!HNBJMDPN $5''SPN;FSP5P0OF
XIPBNJ ˙ *OOEZBLB加啄 ˙ 〵猰须䊨㣐♲ ˙ 噠긅4FDVSJUZ3FTFBSDIFS ˙ 噠긅䊨玑䌌BU4IBSFMJLF ˙
噠긅㷸欰 ˙ $5'⟿GPSYꟀ ˙ ꆄ湽ⱟ鮪
85'JT$5'
ˊ笞㛇涰猰 չ䵻唿麉䨡歋Ⰽ➃꼛✽湱䖃㼩倰涸㛇㖒㤾偫 խխ䪾侰倰涸偫䖰侰倰涸㛇㖒䌟㔐荈䊹⟿涸㛇㖒պ
꽺㹐涸䵻唿麉䨡
捀➊랃䩧$5' ˙ 㖈㢫✥䩧㣖⽭ꦖ➛㣔䭭SPPU僈㣔叆宐ꐹ ˙ ㄤⰦ➮➃ⴗ煔❜崩 ˙ 诔歋$5'㷸须㸞
➛㣔䧮銴铞涸佦✲僽 䖰➊랃鿪♶剚ⵌ䌟㕰䭭♴痧♧そ涸麕玑
➛㣔䧮銴铞涸佦✲僽 䖰➊랃鿪♶剚ⵌ♧⦐➃䩧$5'涸麕玑
'SPN;FSP ˙ 䟝銴㻨荈䊹涸麉䨡㢫䱦 ˙ 搭䖕㽠㷸剚✫㻨玑䒭ㄤ鷠ぢ䊨玑 ˙ 荛㼱⯓澗鍑♧⦐걆㚖ꄷ屘䩞♶剚㣖ꅾ#JOBSZ 8FC $SZQUP
'PSN;FSP ˙ 騈㖈)BDL4UV涸㣐㣐⦛倾鼹䩧ꄷ屘鑑衽鍑)*5$0/8BSHBNF鷠ぢ겗 ˙ 穅倴濼麥➊랃僽*%"1SPՂ䊺濼欽抡 ˙ 㖈鸏⛓鿪僽欽$IFBU&OHJOF /PUFQBE ⨞鷠ぢ ˙
)*5$0/8BSHBNF鱲㘗䧭)*5$0/$5'㨥隶䧭㕜ꥹ飓✲
5P0OF ˙ 鸏媯儘㨥㷸鷠ぢ⛓㢫涸匌銯8FC $SZQUP #JOBSZ&YQMPJUBUJPO ˙ 魨鼹尝剤➃♧饱䩧$5'〫㥪♧⦐➃梖 ˙ ♧➃䨞僽汥蕲涸尝剤〫㥪荈䊹㷸ぐ⦐걆㚖涸濼陏 ˙
⡎僽ꨈ⟃꧌⚥礶牟溏ꨈ겗剤❉겗湡♶ꨈ⡎僽蔅儘
5IFO 5P0OF ˙ 䎃⛰剢儘穉✫GPSY䌟䎙⦐ず㷸♧饱梖⡎僽䨞⸂㻜㖈♶㣁9% ˙ 䎃䏁涸儘⦬㣐㣐䌟䧮⦛♧饱䩧9$5'耢飓 ˙ 3$5''JOBMOE QMBDF ˙
44$5''JOBMTU QMBDF ˙ 9$5''JOBMUI QMBDF ˙ ꆄ湽栁TU QMBDF
♶ず涸$5'飓ⵖ ˙ +FPQBSEZ瘸겗䮋䨞 ˙ "UUBDL%FGFOTF余畹飓 ˙ %"31"$($堥㐼➃余 ˙ ,JOHPGUIF)JMM⡥걆걆㖒
+FPQBSEZ 겗湡 鎙ⴕ匢
+FPQBSEZ ˙ 鍑겗䭭BH䳖ⴕ侸 ˙ STUCMPPE剤儘⦬剤CPOVT ˙ ♶ず겳㘗涸겗湡剤ぐ珏ꨈ䏞 ˙ 莅壋⡜剤ꨶ舡剤笪騟⽰〳
+FPQBSEZ8FC ˙ 剚♳笪㽠〳⟃㨥䩧㣁矦㋲✫ゅ ˙ 须鎝峾ꪫ ˙ SPCPUTUYUHJUTWOFSSPSNFTTBHFTIBSFEIPTU ˙ 岤Ⰵ余乹 ˙
42-*OKFDUJPO ˙ PS ˙ 6/*0/4&-&$5 ˙ #MJOE*OKFDUJPO
+FPQBSEZ8FC ˙ 岤Ⰵ余乹糵 ˙ $PNNBOE*OKFDUJPO ˙ ⡹騈-JOVYDPNNBOE剤㢵擿 ˙ 鸒䌢剚銴粕麕厥❉랱そ㋲瑠涯䒸贫ⴕ贫 ˙
DBUBH ˙ BDBUBH ˙ \HSFQ S ^ ˙ TIQSPDTFMGFOW )551IFBEFS BQBDIF
+FPQBSEZ8FC ˙ 岤Ⰵ余乹糵 ˙ $SPTT4JUF4DSJQUJOH 944 ˙ 剓鵜♶㼱8FC鿪銴⯓944ⱄ䖃䖕䩧 ˙
9.-&OUJUZ*OKFDUJPO 99& ˙ ⟃+FPQBSEZ⢵铞♶㢵鋅㔔捀〳⟃%P4 #JMMJPOMBVHIT ˙ 梖忶鷴涸铞Ⰵ涸儘⦬䖎㻜欽
+FPQBSEZ8FC ˙ 3BDF$POEJUJPO ˙ 须俲䏨䧴Ⱖ➮乽⡲尝剤欽5SBOTBDUJPO-PDL鸤䧭涸朜䢀♶♧荞 欴欰ꥵ〳⟃ⵄ欽 ˙ &Y鱲颹齅鱀 ˙ 隡《긅겙4&-&$5
䩾妵JO1)1佖隶긅겙61%"5& ˙ 㥶卓⠿剪㐼MPBEJOH鯱ꅾ4&-&$5莅61%"5&乽⡲剚剤儘䊴〳⟃ ꅾ醳鱲ⴀ ˙ 㖈155涮欰麕䖎㢵鵜劍涸%JSUZ$08怪峯⛳僽3BDF$POEJUJPO
3BDF$POEJUJPOPO155
+FPQBSEZ8FC ˙ 铃鎊暶䚍#VH1)1 ˙ 㖒邍剓㢵➃欽涸铃鎊8FC剓䢔涸DPEFCBTF ˙ VOTFSJBMJ[FNFNPSZDPSSVQUJPO VTFBGUFSGSFF ˙ QBSTF@VSMQBSTFS齅鱀ꐫ铐
˙ TUSDNQ @(&5<TFDSFU> QE.I3772D.XK:3Z,6T4 ˙ BQIQ TFDSFU<>TFDSFU<> ˙ NE NE 2/,$%;0
+FPQBSEZ8FC ˙ 铃鎊暶䚍#VH3VCZ ˙ 3VCZ欽$㻨JOUFQSFUFS罜⚂䎙⛖尝剤MJCSBSZEFQFOEFODZ[MJC PQFOTTM MJCVOXJOE ˙ 鸏➿邍䖎㢵匌銯鿪荈䎍♶⣜飅㢫鿈玑䒭䏨⟃玑䒭㸞涸錬䏞⢵溏
˙ 嵥럊侸贖椚儘剤0WFSPX ˙ #JH%FDJNBM & UP@T ' UP@G ˙ :".-QBSTFS㼬荞3$&$7& ˙ 湱㼩⢵铞3VCZ爢纈岤ꅾ㸞䖤㢵
+FPQBSEZ8FC ˙ $SZQUP'BJM ˙ ⡹剚銴增叆须俲剤尝剤鄄佖麕⡹剚 ˙ 欽NE ˙ NE TFDSFU
EBUB ˙ -FOHUI&YUFOTJPO"UUBDL ˙ ⡹剚銴⸈㺙须俲⛳鏪僽4FTTJPO ˙ "&4$#$ ˙ 1BEEJOH0SBDMF"UUBDL
+FPQBSEZ8FC ˙ 8FC䩧饱⢵⫹僽㖈枤閱 ˙ 锞ꡠ岤须㸞倞耂剓鵜涸Ⱇ怪峯 ˙ TUSVDUT ˙ 8FCⴀ겗剚剤崩遤馸 ˙
ꤏ㶩剤4FSWFS4JEF5FNQMBUF*OKFDUJPO 1BEEJOH0SBDMF 幋ざ944 ˙ ꡠ岤ⴀ겗㕰涸8FC㼠㹻剓鵜㖈灇瑖➊랃 ˙ ⴀ겗䌢䌢⚥
+FPQBSEZ#JOBSZ3FWFSTF ˙ 窍⡹♧⦐#JOBSZ䟝鳵岁䵆䥢➮㖈⨞➊랃 ˙ Ⱙ㘗涸3FWFSTJOH겗湡剚僽OBUJWFDPEF鸒䌢欽$铃鎊㻨 ˙ 銴隡穉ざ铃鎊涸腋⸂ ˙ 겗湡㣐嚌剤䎙珏Ꟁ湱 ˙
鱒ⰅBH겗湡剚デ鏰⡹僽♶僽㼩涸 ˙ 鱒Ⰵ㺙焺鍑㺙BH䖕⽫ⴀ⢵ ˙ 窍⡹⸈㺙涸BHㄤ⸈㺙玑䒭剤儘⦬剚剤♧穉䊺濼僈俒涸㺙俒 ˙ 鏽ⱁ堥䍲䭸㹁涸6TFS皿ⴀ➮涸䎸贫
+FPQBSEZ#JOBSZ3FWFSTF ˙ Ⱙ㘗涸겗湡⫹僽鸏垺
+FPQBSEZ#JOBSZ3FWFSTF ˙ 鹎ꥣ♧럊涸겗湡 ˙ ⸈媽幋差麕涸玑䒭ⴕ區銴⯓膨媽%FPCGVTDBUF ˙ 䩛䊨穉ざ涸㛂遤墂䩛㻨BTTFNCMZ♶僽넞ꥣ铃鎊管陼ⴀ⢵涸 ˙ $ 㛂遤墂⸈管陼剓⢕⻋
˙ TUSJOH涸贖椚㽠㣁ꨈ溏✫PQUJNJ[F♴刿䟝娦 ˙ 㣼䚓涸铃鎊管陼ⴀ⢵涸CJOBSZ㥶HPMBOH TXJGU IBTLFMM ˙ 7JSUVBM.BDIJOF⫹僽(#"&NVMBUPS齡겳涸匌銯 ˙ TUBUJDDPNQJMFEBOETUSJQFECJOBSZ85'
+FPQBSEZ#JOBSZ3FWFSTF ˙ ⨋♧럊涸겗湡 ˙ 厥❉管陼䧭CJOBSZDPEF⡎♶僽OBUJWFDPEF涸CJOBSZ鸒䌢尝剤 EFDPNQJMFS〳⟃欽㽠皿剤⛳剚䟝鳵岁䵆㡏EFDPNQJMFS ˙ 7#1$PEF 4&$$0/SFUSPTQFDUJWF
˙ 4RVJSSFMMBOH #$5'TJG ˙ ⯕僽䪪ⴀ➮僽➊랃铃鎊㽠蔅✫䧮㥪⛉涸儘22 ˙ 1ZUIPOCZUFDPEF QZD +BWBDMBTT PCGVTDBUFE/&5 ˙ 䩛㻨♧❉㣼䚓涸CZUFDPEFQBUUFSO剚䵆㡏EFDPNQJMFS
+FPQBSEZ#JOBSZ3FWFSTF ˙ ⨋♧럊涸겗湡糵 ˙ Ⲉ䎂〵涸OBUJWFCJOBSZ ˙ "3. .*14鿪皿㼭✲✫欽2&.6㽠〳⟃駵 ˙ 尝剤EFDPNQJMFS〳⟃欽22
˙ 㻨♧㣐㛜DPEF搭䖕DPNQJMFSPQUJNJ[F⿶僽$ 㻨涸 ˙ 峤峤漗嫲鯱䘰鿪䚓植➿$5'涮㾝㣖〳䙲22 ˙ ꬌ䌢䏁㾵涸CJOBSZ ˙ #*0430. %SJWFS %04CJOBSZ
+FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ 㷸绢䊨Ⱘ僽䖎ꅾ銴涸䩞腋麕殹♧⦐珖耷涸䊨Ⱘ➃ ˙ 㥪涸䊨Ⱘ䌟⡹♳㣔㛔㡏涸䊨Ⱘ雊⡹䄶惓22 ˙ ⹛䢀ⴕ區䊨Ⱘ%FCVHHFS ˙ 0MMZ%CH YECH
HEC FWBOTEFCVHHFS (6*EFCVHHFSGPS-JOVY ˙ 剤❉겗湡鏤㹁㥪CSFBLQPJOU㺙焺꼛♳㽠ⴀ植㖈⡹✫ ˙ 剤❉겗湡〳⟃CZUFCZCZUF涸凐⸂灶鍑 ˙ 㷸绢䙦랃㻨EFCVHHFSTDSJQU ˙ TUSBDF MUSBDF錚㻌玑䒭涸TZTUFNDBMM MJCSBSZDBMM遤捀
+FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ꬆ䢀ⴕ區䊨Ⱘ ˙ PCKEVNQ〳⟃溏穉ざ铃鎊 ˙ *%"1SPXJUI)FYSBZEFDPNQJMFS ˙ 馄馄馄馄馄秹顜顜顜顜娦➃⺫わEFDPNQJMFS涸䱇奚銴䱺鵜⼧蠝荩䍤 ˙
馄秹䓽㣐䎙⛖僽垦彋ꂂ⪔ ˙ SBEBSF ˙ 䖎䓽㣐涸䊨Ⱘ*%"1SP⛓倴SBEBSF㽠⫹僽7JTVBM4UVEJP⛓倴WJN ˙ 㷸绢刼箁䖎〳䙲剤❉㣼䚓涸CVH22
+FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ꬆ䢀ⴕ區䊨Ⱘ ˙ CJOBSZOJOKB ˙ )PQ%JTBTTFNCMFS ˙ 暶Ꟁ僽0CKFDUJWF$ ˙
3FUBSHFUBCMFEFDPNQJMFS ˙ 箁♳管陼剪♶麕⯝顥涸剤ꣳⵖ
*%"1SP
SBEBSF
+FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ⹛䢀ⴕ區䊨Ⱘ鹎ꥣ ˙ #JOBSZJOTUSVNFOUBUJPO*OUFMQJOUPPMT ˙ 㻨玑䒭⹛䢀涸錚㻌)PPL〥♧⦐玑䒭 ˙ 〳⟃欽⢵⨞TJEFDIBOOFMBUUBDL UJNJOHBUUBDL
˙ 箁䚍嫲㼩㶶⚮涸儘⦬鎙皿䭸⟂侸ꆀ㽠〳⟃濼麥枤㼩✫䎙⦐㶶 ˙ 4.5TPMWFS;CZ.JDSPTPGU ˙ 9 9 9 9 ˙ 牟㣼涸荈⹛凐⸂灶鍑
+FPQBSEZ#JOBSZ3FWFSTF䊱遯眝 ˙ 4ZNCPMJD&YFDVUJPO ˙ BOHS ˙ 㼩CJOBSZ⨞TZNCPMJDFYFDVUJPO荈⹛䌟Ⰵ4.5TPMWFSBOHS欽 ;䪪ⴀ䨾剤哭⟝騥鱲涸哭⟝僽➊랃 ˙ 䖰齡酭㨥饥ⵌ齡酭鼚齡酭
˙ 㥪⡹デ鏰䧮銴怏駈涸哭⟝僽➊랃 ˙ 䢩く鎹䥊넓罜⚂剤❉朜屣♶鋅䖤腋鍑
+FPQBSEZ#JOBSZ3FWFSTF䊱遯眝 ˙ 4ZNCPMJD&YFDVUJPO ˙ LMFF ˙ 㛇倴MMWN卺圓♴⾲㨥焺㾵秹涸TZNCPMJDFYFDVUJPO ˙ $$ PUIFSMBOHVBHF̔DPNQJMFEUPMMWN*3̔LMFF
˙ 㻨♧⦐$玑䒭〭LMFFデ鏰⡹銴怏駈➊랃哭⟝䩞腋鍸涮BTTFSU ˙ 〳⟃䭭IFYSBZEFDPNQJMFSⴀ⢵涸DPEF鹎駵9% ˙ -B[Z,-&&CZ-BZTIUUQTHJUIVCDPN-ZT-B[Z,-&&
1XOBCMF ˙ ⡹㻨麕$铃鎊㌨
1XOBCMF ˙ ⡹㻨麕$铃鎊㌨
1XOBCMF (low address) AAAAAAAA <--- esp 00000000 00000000 <--- buffer
00000000 00000000 00000000 00000000 0083af3c <--- stack canary ffeeddcc <--- ebp, saved ebp 00401234 <--- return address abcdabcd (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; }
1XOBCMF (low address) AAAAAAAA <--- esp 00000000 41414141 <--- buffer
41414141 41414141 41414141 41414141 41414141 <--- stack canary 41414141 <--- ebp, saved ebp 41414141 <--- return address 41414141 (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; }
1XOBCMF (low address) AAAAAAAA <--- esp 00000000 41414141 <--- buffer
41414141 41414141 41414141 41414141 41414141 <--- stack canary 41414141 <--- ebp, saved ebp 41414141 <--- return address 41414141 (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; } *** stack smashing detected ***
1XOBCMF ˙ TUBDLDBOBSZ僽植➿管陼㐼涸⥃隌堥ⵖ姺TUBDLPWFSPX怪峯鄄ⵄ欽 ˙ 鹎ⰅGVODUJPO儘㻨Ⰵ04ꦑ堥欴欰涸TUBDLDBOBSZ ˙ ꨆGVODUJPO僽增叆TUBDLDBOBSZ僽や鄄睕佖 ˙ 鸮糵㻨Ⰵ銼覈FCQ SFUSVOBEESFTT⛓♧㹁剚⯓覈ⵌTUBDLDBOBSZ
˙ #PPPPPPPPPPPN ˙ 䧮⦛⢵溏♧⦐尝剤⥃隌涸⢿㶩
1XOBCMF ˙ OBNF㖈㛜毕♳ ˙ EBUB㖈ꬆ䢀涸⡙㖧 ˙ TDBOG T OBNF
˙ 鸤䧭CVFSPWFSPX ˙ 濼麥TUBDL僽䙦랃麌⡲涸䖎ꅾ銴
1XOBCMF ˙ TDBOG T OBNF ˙ """"""""""""""""""""""""" """"""""""""""""""""""""" """""""""""""""""""""""""
""""""""""""""""""""""""" """"""""""""""""""""""""" """"""""""""""""""""""""" """"""""""""""""""""""""" ababcdcd <- esp 00000000 41414141 <- &name 41414141 41414141 41414141 41414141 41414141 <- ebp 41414141 <- ret addr 41414141 41414141
1XOBCMF ˙ SFU ˙ &*1Y ˙ $SBTI ˙ &*1〳⟃䱾ⵖ ˙
齡䧮⦛〳♶〳⟃〭CBTIⴀ⢵ ˙ %FNP ababcdcd <- esp 00000000 41414141 <- &name 41414141 41414141 41414141 41414141 41414141 <- ebp 41414141 <- ret addr 41414141 41414141
1XOBCMF鎹䥊넓䨞昰涸余娜〷 ˙ #VFSPWFSPX SFUVSOUPTUBDL ˙ %BUB&YFDVUJPO1SFWFOUJPO雊须俲♶〳㛂遤 ˙ 3FUVSO0SJFOUFE1SPHSBNNJOH301鰋논锓CZ-BZT ˙ 4UBDLDBOBSZ增叆剤尝剤PWFSPX
˙ "4-3雊⡹枤♶⚥ ˙ 4IBEPX4UBDL欽〥㢫♧⦐TUBDL㶸SFUVSOBEESFTT ˙ 301JTEFBE ˙ 䒂⠽ꠗ隡+VNQ0SJFOUFE1SPHSBNNJOH
1XOBCMF$5'䌢欽余乹䩛岁 ˙ 3FUVSOUP4UBDL ˙ 䪾TIFMMDPEF㻨㖈TUBDL♳䟝鳵岁SFUVSOⵌTUBDL♳㛂遤 ˙ 䪪ⵌKNQFTQ ˙ 3FUVSOUPMJCD ˙
欽301㛂遤MJCD酭涸GVODUJPO ˙ 3FUVSOUPEMSFTPMWF ˙ ⵄ欽%ZOBNJD-JOLJOH雊➮湬䱺䌟䧮⦛TZTUFN
1XOBCMF$5'䌢欽余乹䩛岁 ˙ GPSNBUTUSJOH怪峯 ˙ QSJOUG EEE
˙ ⡹濼麥O Q㌨ ˙ QSJOUG T EBUB ˙ QSJOUG EBUB 00401234 <- esp, ret addr 2016 <- arg1 1 <- arg2 1 <- arg3 aaaaaaaa <- int a bbbbbbbb <- int b 41414141 <- char data[8] 41414141 00ae5d25 <- stack canary cccccccc <- saved ebp 00405566 <- ret addr
1XOBCMF$5'䌢欽余乹䩛岁 ˙ GPSNBUTUSJOH怪峯 ˙ QSJOUG EEE
˙ ⡹濼麥O Q㌨ ˙ QSJOUG T EBUB ˙ QSJOUG EBUB ˙ QQQQQQQQQQ ˙ %FNP 00401234 <- esp, ret addr 2016 <- arg1 1 <- arg2 1 <- arg3 aaaaaaaa <- arg4 bbbbbbbb <- arg5 41414141 <- arg6 41414141 <- arg7 00ae5d25 <- arg8 cccccccc <- arg9 00405566 <- arg10
1XOBCMF$5'䌢欽余乹䩛岁 ˙ #JOBSZ&YQMPJUBUJPO涸劥颶僽隡《䧴㻨Ⰵ✫♶鑪雊⡹焥ⵌ涸㖒倰 ˙ 銼覈涸㖒倰僽 ˙ SFUVSOBEESFTT ˙ EBUBQPJOUFS ˙
GVODUJPOQPJOUFS ˙ (05FOUSZ ˙ NPSF
$SZQUP ˙ 管焺ꦡ询⸈㺙 ˙ ⸈㺙♧㹁剤♧䪾ꚤ⻑ ˙ 管焺 ˙ ⡹♧㹁聃麕)FY CBTF
VSMFODPEF ˙ 嫲鯱㼱鋅VVFODPEF CBTF CBTF ˙ ꦡ询 ˙ 騈管焺♧垺⡎僽湡涸♶ず ˙ SPU ˙ /VF,:@.
$SZQUP ˙ 〢Ⱙ㺙焺㷸 ˙ %#'5#4%+2*'4'0%4;26+10$BFTBS$JQIFS LFZ" ˙ 7FHFOFSF$JQIFS⳯且⸈㺙鹎ꥣ晝劥
˙ ➿䳖⸈㺙4VCTUJUVUJPO$JQIFS ˙ 䪾嫦⦐㶶嫢♧㼩♧涸鱲䳖ⵌ〥♧穉㶶嫢 ˙ 걽桧ⴕ區余乹ꆚ㼩僈俒涸暶䚍⨞ⴕ區
$SZQUP ˙ 植➿㺙焺㷸 ˙ #MPDL$JQIFS䪾须俲ⴗ䧭♧㝆♧㝆⨞⸈鍑㺙 ˙ %&4 "&4 #MPXTI ˙
㥶卓须俲䖎Ꟁ ˙ #MPDL$JQIFS0QFSBUJPO.PEF ˙ 1,$4 $#$.PEF剤1BEEJOH0SBDMF"UUBDL ˙ 4UFBN$JQIFS ˙ 欽13/(✥侸欴欰㐼呏亙,FZ欴欰鸮糵涸4USFBN,FZ⨞9PS ˙ 0'#.PEF䖎⫹僽4USFBN$JQIFS
$SZQUP ˙ %JF)FMMNBO,FZ&YDIBOHF ˙ 㥶卓鸮箁鄄甦聃銴䙦랃㸞涸鹎遤⸈㺙鸮箁 ˙ )BTI꧹廔 ˙ 窍⡹♧❉须俲欴ⴀ㔿㹁Ꟁ䏞涸侸⧩ ˙
)BTI$PMMJTJPO ˙ -FOHUI&YUFOTJPO"UUBDL ˙ 㺙焺欽涸)BTI怵皿岁 ˙ TDSZQU CDSZQU QCLEG BSHPO
$SZQUP ˙ ꬌ㼩珖㺙焺㷸 ˙ 铭劥♳♧㹁剤涸34"/QR ˙ 34"銴㸞涸QBEEJOH0"&1 ˙ 堬㕩刼箁㺙焺㷸&$$ ˙
&M(BNBM3BCJO ˙ 㛇倴ꨆ侕侸㷸涸⸈㺙禺窡 ˙ 34"禺窡㛇倴顥꼛㼭㹁椚ㄤ'JOJUF'JFME"SJUINFUJD ˙ 澗鍑34"涸麌⡲♶剚阮僈荛㼱〳⟃胝ⴀ欴欰,FZㄤ⸈鍑㺙涸倰䒭
$SZQUP䊨Ⱘ ˙ STBUPPMQZ ˙ YPSUPPM ˙ IUUQGBDUPSECDPN
'PSFOTJD ˙ 侸⡙Ꙥ陏䖰♶剚⹛涸.FNPSZ%VNQ%JTL*NBHF䮕须俲 ˙ .FNPSZ'PSFOTJD ˙ 濼麥LFSOFM酭剤❉➊랃穡圓넓銴㥶⡦㹁⡙䪪ⴀ鸏❉穡圓넓 ˙ ➊랃僽7JSUVBM.FNPSZ5-# ˙
8JOEPXT&130$&44-JOVYUBTL@TUSVDU NN@TUSVDU ˙ 䖰1SPDFTT-JTU㨥 ˙ %VNQ〳毠涸QSPDFTT鼩⾲ⴀFYFDVUBCMFMF鹎遤ⴕ區 ˙ 'JMF$BDIF/FUXPSL$POOFDUJPOT
'PSFOTJD ˙ %JTL'PSFOTJD ˙ 3FHJTUSZ)*7&MF 8JOEPXT ˙ %VNQ-./5-.IBTI8JOEPXT涬Ⰵ㺙焺IBTI ˙
䫌SPPULJU ˙ ⸈㺙ꦡ询煂⼦5SVF$SZQU ˙ &'*SPPULJU
'PSFOTJD5PPM ˙ WPMBUJMJUZ ˙ ♧⦐馄䓽涸.FNPSZGPSFOTJDGSBNFXPSL ˙ ꤑ✫㉂噠鮿넓⛓㢫剓㥪涸'SFFTPGUXBSF鼇乵 ˙ 〳⟃⸈䱦QMVHJO⢵仍⯏⸆腋 ˙
QTMJTU EVNQQSPDFTTNFNPSZ EVNQNPEVMFMF EVNQESJWFSMF EVNQDBDIFEMF EVNQSFHJTUSZ EVNQQBTTXPSEIBTI NJNJLBU[ EVNQ"&4LFZ
.JTD4UFHP ˙ 窍⡹♧❉㣼䚓涸䮋䨞ꦡ询须鎝㖈须俲⚥ ˙ 㕬晚-4# ˙ 㖈㕬晚䖕꣡⸈♧⦐㠺簮墂 ˙ CBTFQBEEJOHCJU〳⟃询须俲 ˙
㡏䱈涸CJOBSZEBUB ˙ ䷒倛ꨶ焺 ˙ 䊨Ⱘ ˙ PQFOTUFHP TUFHPTPMWFS &EJUPS CJOBSZUFNQMBUF
.JTD4UFHP5PPM ˙ &EJUPS ˙ #JOBSZUFNQMBUF馄㥪欽 ˙ PQFOTUFHP ˙ TUFHPTPMWFS ˙
㕬晚겗〳⟃欽鸏⦐溏-4# ˙ TOPX IUUQXXXEBSLTJEFDPNBVTOPX
"UUBDL%FGFOTF ˙ 鎙ⴕ匢♳剚剤 ˙ ぐ⦐剪涸朜䢀 ˙ "MJWF 1XOFE %PXO ˙
鑪㔐ざ涸ⴕ侸隶⹛ꆀ ˙ 籏ⴕ侸
"UUBDL%FGFOTF ˙ 嫦⦐⟿剤荈䊹涸(BNFCPY ˙ 剤♧垺涸겗湡♧垺涸怪峯 ˙ 余乹Ⱖ➮⟿狡荈䊹 ˙ ⟃1XO捀⚺❏崎⩑晋剤8FC ˙
⚺鳵倰剤4FSWJDF$IFDL
"UUBDL%FGFOTF ˙ 瘼殜䖎ꅾ銴 ˙ 崩ꆀⴕ區倴ꅾ佞余乹 ˙ 佞䖕 ˙ 㥶⡦CJOBSZQBUDI ˙
*%"1SP ˙ IUFEJUPS ˙ DIFBUFOHJOF ˙ -%@13&-0"%
%"31"$($ ˙ 堥㐼➃䩧"UUBDL%FGFOTF ˙ 갸濼鑬䞕锞溏♳⼯涸㜥妄9%
2"