Pro Yearly is on sale from $80 to $50! »

CTF From Zero To One

7f110257501127300df3f923119ba043?s=47 Inndy
December 17, 2016

CTF From Zero To One

2016 / TDOH Conf

7f110257501127300df3f923119ba043?s=128

Inndy

December 17, 2016
Tweet

Transcript

  1. 5%0)$POG *OOEZJOOEZUX!HNBJMDPN $5''SPN;FSP5P0OF

  2. XIPBNJ ˙ *OOEZBLB加啄 ˙ 〵猰须䊨㣐♲ ˙ 噠긅4FDVSJUZ3FTFBSDIFS ˙ 噠긅䊨玑䌌BU4IBSFMJLF ˙

    噠긅㷸欰 ˙ $5'꥙⟿GPSY꥙Ꟁ ˙ ꆄ湽ⱟ鮪
  3. 85'JT$5'

  4. ˊ笞㛇涰猰 չ䵻唿麉䨡歋Ⰽ꥙➃꼛✽湱⵹䖃㼩倰涸㛇㖒㤾偫
 խխ䪾侰倰涸偫䖰侰倰涸㛇㖒䌟㔐荈䊹꥙⟿涸㛇㖒պ

  5. 꽺㹐涸䵻唿麉䨡

  6. 捀➊랃䩧$5' ˙ 㖈㢫꬗✥䩧㣖⽭ꦖ➛㣔䭭SPPU僈㣔叆宐ꐹ ˙ ㄤⰦ➮➃ⴗ煔❜崩 ˙ 诔歋$5'㷸须㸞

  7. ➛㣔䧮銴铞涸佦✲僽
 䖰➊랃鿪♶剚ⵌ䌟㕰䭭♴痧♧そ涸麕玑

  8. ➛㣔䧮銴铞涸佦✲僽
 䖰➊랃鿪♶剚ⵌ♧⦐➃䩧$5'涸麕玑

  9. 'SPN;FSP ˙ 䟝銴㻨荈䊹涸麉䨡㢫䱦 ˙ 搭䖕㽠㷸剚✫㻨玑䒭ㄤ鷠ぢ䊨玑 ˙ 荛㼱⯓澗鍑♧⦐걆㚖ꄷ屘㄂䩞♶剚㣖ꅾ#JOBSZ 8FC $SZQUP

  10. 'PSN;FSP ˙ 騈㖈)BDL4UV涸㣐㣐⦛倾鼹䩧ꄷ屘鑑衽鍑)*5$0/8BSHBNF鷠ぢ겗 ˙ 穅倴濼麥➊랃僽*%"1SPՂ䊺濼欽抡 ˙ 㖈鸏⛓⵹鿪僽欽$IFBU&OHJOF /PUFQBE ⨞鷠ぢ ˙

    )*5$0/8BSHBNF鱲㘗䧭)*5$0/$5'Ꟛ㨥隶䧭㕜ꥹ飓✲
  11. 5P0OF ˙ 鸏媯儘꟦Ꟛ㨥㷸鷠ぢ⛓㢫涸匌銯8FC $SZQUP #JOBSZ&YQMPJUBUJPO ˙ 魨鼹尝剤➃♧饱䩧$5'〫㥪♧⦐➃梖 ˙ ♧➃䨞꥙僽汥蕲涸尝剤꥙⿼〫㥪荈䊹㷸ぐ⦐걆㚖涸濼陏 ˙

    ⡎僽ꨈ⟃꧌⚥礶牟溏ꨈ겗剤❉겗湡♶ꨈ⡎僽蔅儘꟦
  12. 5IFO 5P0OF ˙ ⿡䎃⛰剢儘穉✫GPSY䌟䎙⦐ず㷸♧饱梖⡎僽䨞⸂㻜㖈♶㣁9% ˙ 䎃䏁涸儘⦬㣐㣐䌟䧮⦛♧饱䩧9$5'耢飓 ˙ 3$5''JOBMOE QMBDF ˙

    44$5''JOBMTU QMBDF ˙ 9$5''JOBMUI QMBDF ˙ ꆄ湽栁TU QMBDF
  13. ♶ず涸$5'飓ⵖ ˙ +FPQBSEZ瘸겗䮋䨞 ˙ "UUBDL%FGFOTF余꣈畹飓 ˙ %"31"$($堥㐼➃余꣈ ˙ ,JOHPGUIF)JMM⡥걆걆㖒

  14. +FPQBSEZ 겗湡 鎙ⴕ匢

  15. +FPQBSEZ ˙ 鍑겗䭭BH䳖ⴕ侸 ˙ STUCMPPE剤儘⦬剤CPOVT ˙ ♶ず겳㘗涸겗湡剤ぐ珏ꨈ䏞 ˙ ⿮莅Ꟍ壋⡜剤ꨶ舡剤笪騟⽰〳

  16. +FPQBSEZ8FC ˙ 剚♳笪㽠〳⟃Ꟛ㨥䩧㣁矦㋲✫ゅ ˙ 须鎝峾ꪫ ˙ SPCPUTUYUHJUTWOFSSPSNFTTBHFTIBSFEIPTU ˙ 岤Ⰵ余乹 ˙

    42-*OKFDUJPO ˙ PS ˙ 6/*0/4&-&$5 ˙ #MJOE*OKFDUJPO
  17. +FPQBSEZ8FC ˙ 岤Ⰵ余乹糵 ˙ $PNNBOE*OKFDUJPO ˙ ⡹騈-JOVYDPNNBOE剤㢵擿 ˙ 鸒䌢剚銴粕麕厥❉랱そ㋲瑠涯䒸贫ⴕ贫 ˙

    DBUBH ˙ BDBUBH ˙ \HSFQ S ^ ˙ TIQSPDTFMGFOW )551IFBEFS BQBDIF
  18. +FPQBSEZ8FC ˙ 岤Ⰵ余乹糵 ˙ $SPTT4JUF4DSJQUJOH 944  ˙ 剓鵜♶㼱8FC鿪銴⯓944ⱄ䖃䖕䩧 ˙

    9.-&OUJUZ*OKFDUJPO 99&  ˙ ⟃+FPQBSEZ⢵铞♶㢵鋅㔔捀〳⟃%P4 #JMMJPOMBVHIT  ˙ 梖忶鷴涸铞Ⰵ涸儘⦬䖎㻜欽
  19. +FPQBSEZ8FC ˙ 3BDF$POEJUJPO ˙ 须俲䏨䧴Ⱖ➮乽⡲尝剤欽5SBOTBDUJPO-PDL鸤䧭涸朜䢀♶♧荞 欴欰꟦ꥵ〳⟃ⵄ欽 ˙ &Y鱲颹齅鱀 ˙ 隡《긅겙4&-&$5

    䩾妵JO1)1佖隶긅겙61%"5&  ˙ 㥶卓⠿剪㐼MPBEJOH鯱ꅾ4&-&$5莅61%"5&乽⡲剚剤儘꟦䊴〳⟃ ꅾ醳鱲ⴀ ˙ 㖈155涮欰麕䖎㢵鵜劍涸%JSUZ$08怪峯⛳僽3BDF$POEJUJPO
  20. 3BDF$POEJUJPOPO155

  21. +FPQBSEZ8FC ˙ 铃鎊暶䚍#VH1)1 ˙ 㖒邍剓㢵➃欽涸铃鎊8FC剓䢔涸DPEFCBTF ˙ VOTFSJBMJ[FNFNPSZDPSSVQUJPO VTFBGUFSGSFF ˙ QBSTF@VSMQBSTFS齅鱀ꐫ铐

    ˙ TUSDNQ @(&5<TFDSFU> QE.I3772D.XK:3Z,6T4  ˙ BQIQ TFDSFU<>TFDSFU<> ˙ NE  NE 2/,$%;0
  22. +FPQBSEZ8FC ˙ 铃鎊暶䚍#VH3VCZ ˙ 3VCZ欽$㻨JOUFQSFUFS罜⚂䎙⛖尝剤MJCSBSZEFQFOEFODZ[MJC  PQFOTTM MJCVOXJOE ˙ 鸏➿邍䖎㢵匌銯鿪荈䎍♶⣜飅㢫鿈玑䒭䏨⟃玑䒭㸞涸錬䏞⢵溏

    ˙ 嵥럊侸贖椚儘剤0WFSPX ˙ #JH%FDJNBM & UP@T '     UP@G ˙ :".-QBSTFS㼬荞3$&$7& ˙ 湱㼩⢵铞3VCZ爢纈岤ꅾ㸞䖤㢵
  23. +FPQBSEZ8FC ˙ $SZQUP'BJM ˙ ⡹剚꨾銴增叆须俲剤尝剤鄄佖麕⡹剚 ˙ 欽NE ˙ NE TFDSFU

    EBUB  ˙ -FOHUI&YUFOTJPO"UUBDL ˙ ⡹剚꨾銴⸈㺙须俲⛳鏪僽4FTTJPO ˙ "&4$#$ ˙ 1BEEJOH0SBDMF"UUBDL
  24. +FPQBSEZ8FC ˙ 8FC䩧饱⢵⫹僽㖈枤閱 ˙ 锞ꡠ岤须㸞倞耂剓鵜涸ⰗꟚ怪峯 ˙ TUSVDUT ˙ 8FCⴀ겗剚剤崩遤馸⹴ ˙

    ⵹ꤏ㶩剤4FSWFS4JEF5FNQMBUF*OKFDUJPO 1BEEJOH0SBDMF 幋ざ944 ˙ ꡠ岤ⴀ겗㕰꥙涸8FC㼠㹻剓鵜㖈灇瑖➊랃 ˙ ⴀ겗䌢䌢⚥
  25. +FPQBSEZ#JOBSZ3FWFSTF ˙ 窍⡹♧⦐#JOBSZ䟝鳵岁䵆䥢➮㖈⨞➊랃 ˙ Ⱙ㘗涸3FWFSTJOH겗湡剚僽OBUJWFDPEF鸒䌢欽$铃鎊㻨 ˙ ꨾銴隡穉ざ铃鎊涸腋⸂ ˙ 겗湡㣐嚌剤䎙珏Ꟁ湱 ˙

    鱒ⰅBH겗湡剚デ鏰⡹僽♶僽㼩涸 ˙ 鱒Ⰵ㺙焺鍑㺙BH䖕⽫ⴀ⢵ ˙ 窍⡹⸈㺙涸BHㄤ⸈㺙玑䒭剤儘⦬剚剤♧穉䊺濼僈俒涸㺙俒 ˙ 鏽ⱁ堥䍲䭸㹁涸6TFS皿ⴀ➮涸䎸贫
  26. +FPQBSEZ#JOBSZ3FWFSTF ˙ Ⱙ㘗涸겗湡⫹僽鸏垺

  27. +FPQBSEZ#JOBSZ3FWFSTF ˙ 鹎ꥣ♧럊涸겗湡 ˙ ⸈媽幋差麕涸玑䒭ⴕ區⵹銴⯓膨媽%FPCGVTDBUF ˙ 䩛䊨穉ざ涸㛂遤墂䩛㻨BTTFNCMZ♶僽넞ꥣ铃鎊管陼ⴀ⢵涸 ˙ $ 㛂遤墂⸈管陼剓⢕⻋

    ˙ TUSJOH涸贖椚㽠㣁ꨈ溏✫PQUJNJ[FꟚ♴⿡刿䟝娦 ˙ 㣼䚓涸铃鎊管陼ⴀ⢵涸CJOBSZ㥶HPMBOH TXJGU IBTLFMM ˙ 7JSUVBM.BDIJOF⫹僽(#"&NVMBUPS齡겳涸匌銯 ˙ TUBUJDDPNQJMFEBOETUSJQFECJOBSZ85' 
  28. +FPQBSEZ#JOBSZ3FWFSTF ˙ ⨋Ꟍ♧럊涸겗湡 ˙ 厥❉管陼䧭CJOBSZDPEF⡎♶僽OBUJWFDPEF涸CJOBSZ鸒䌢尝剤 EFDPNQJMFS〳⟃欽㽠皿剤⛳剚䟝鳵岁䵆㡏EFDPNQJMFS ˙ 7#1$PEF 4&$$0/SFUSPTQFDUJWF 

    ˙ 4RVJSSFMMBOH #$5'TJG  ˙ ⯕僽䪪ⴀ➮僽➊랃铃鎊㽠蔅✫䧮㥪⛉涸儘꟦22 ˙ 1ZUIPOCZUFDPEF QZD +BWBDMBTT PCGVTDBUFE/&5 ˙ 䩛㻨♧❉㣼䚓涸CZUFDPEFQBUUFSO剚䵆㡏EFDPNQJMFS
  29. +FPQBSEZ#JOBSZ3FWFSTF ˙ ⨋Ꟍ♧럊涸겗湡糵 ˙ ⲈꟌ䎂〵涸OBUJWFCJOBSZ ˙ "3. .*14鿪皿㼭✲✫欽2&.6㽠〳⟃駵 ˙ 尝剤EFDPNQJMFS〳⟃欽22

    ˙ 㻨♧㣐㛜DPEF搭䖕ꟚDPNQJMFSPQUJNJ[F⿶僽$ 㻨涸 ˙ 峤峤漗嫲鯱䘰鿪䚓植➿$5'涮㾝㣖〳䙲22 ˙ ꬌ䌢䏁㾵涸CJOBSZ ˙ #*0430. %SJWFS %04CJOBSZ
  30. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ 㷸绢䊨Ⱘ僽䖎ꅾ銴涸䩞腋麕殹♧⦐珖耷涸䊨Ⱘ➃ ˙ 㥪涸䊨Ⱘ䌟⡹♳㣔㛔㡏涸䊨Ⱘ雊⡹䄶惓22 ˙ ⹛䢀ⴕ區䊨Ⱘ%FCVHHFS ˙ 0MMZ%CH YECH

    HEC FWBOTEFCVHHFS (6*EFCVHHFSGPS-JOVY  ˙ 剤❉겗湡鏤㹁㥪CSFBLQPJOU㺙焺꼛♳㽠ⴀ植㖈⡹꬗⵹✫ ˙ 剤❉겗湡〳⟃CZUFCZCZUF涸凐⸂灶鍑 ˙ 㷸绢䙦랃㻨EFCVHHFSTDSJQU ˙ TUSBDF MUSBDF錚㻌玑䒭涸TZTUFNDBMM MJCSBSZDBMM遤捀
  31. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ꬆ䢀ⴕ區䊨Ⱘ ˙ PCKEVNQ〳⟃溏穉ざ铃鎊 ˙ *%"1SPXJUI)FYSBZEFDPNQJMFS ˙ 馄馄馄馄馄秹顜顜顜顜娦➃⺫わEFDPNQJMFS涸䱇奚銴䱺鵜⼧蠝荩䍤 ˙

    馄秹䓽㣐䎙⛖僽垦彋ꂂ⪔ ˙ SBEBSF ˙ 䖎䓽㣐涸䊨Ⱘ*%"1SP⛓倴SBEBSF㽠⫹僽7JTVBM4UVEJP⛓倴WJN ˙ 㷸绢刼箁䖎〳䙲剤❉㣼䚓涸CVH22
  32. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ꬆ䢀ⴕ區䊨Ⱘ ˙ CJOBSZOJOKB ˙ )PQ%JTBTTFNCMFS ˙ 暶Ꟁ僽0CKFDUJWF$ ˙

    3FUBSHFUBCMFEFDPNQJMFS ˙ 箁♳⿾管陼剪⹡♶麕⯝顥涸剤ꣳⵖ
  33. *%"1SP

  34. SBEBSF

  35. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ⹛䢀ⴕ區䊨Ⱘ鹎ꥣ ˙ #JOBSZJOTUSVNFOUBUJPO*OUFMQJOUPPMT ˙ 㻨玑䒭⹛䢀涸錚㻌)PPL〥♧⦐玑䒭 ˙ 〳⟃欽⢵⨞TJEFDIBOOFMBUUBDL UJNJOHBUUBDL

     ˙ 箁䚍嫲㼩㶶⚮涸儘⦬鎙皿䭸⟂侸ꆀ㽠〳⟃濼麥枤㼩✫䎙⦐㶶 ˙ 4.5TPMWFS;CZ.JDSPTPGU ˙ 9 9  9  9  ˙ 牟㣼涸荈⹛凐⸂灶鍑
  36. +FPQBSEZ#JOBSZ3FWFSTF䊱遯眝 ˙ 4ZNCPMJD&YFDVUJPO ˙ BOHS ˙ 㼩CJOBSZ⨞TZNCPMJDFYFDVUJPO荈⹛䌟Ⰵ4.5TPMWFSBOHS欽 ;䪪ⴀ䨾剤哭⟝騥鱲涸哭⟝僽➊랃 ˙ 䖰齡酭Ꟛ㨥饥ⵌ齡酭鼚Ꟛ齡酭

    ˙ 㥪⡹デ鏰䧮銴怏駈涸哭⟝僽➊랃 ˙ 䢩く鎹䥊넓罜⚂剤❉朜屣♶鋅䖤腋鍑
  37. +FPQBSEZ#JOBSZ3FWFSTF䊱遯眝 ˙ 4ZNCPMJD&YFDVUJPO ˙ LMFF ˙ 㛇倴MMWN卺圓♴⾲㨥焺㾵秹涸TZNCPMJDFYFDVUJPO ˙ $$ PUIFSMBOHVBHF̔DPNQJMFEUPMMWN*3̔LMFF

    ˙ 㻨♧⦐$玑䒭〭LMFFデ鏰⡹銴怏駈➊랃哭⟝䩞腋鍸涮BTTFSU ˙ 〳⟃䭭IFYSBZEFDPNQJMFSⴀ⢵涸DPEF鹎⿡駵9% ˙ -B[Z,-&&CZ-BZTIUUQTHJUIVCDPN-ZT-B[Z,-&&
  38. 1XOBCMF ˙ ⡹㻨麕$铃鎊㌨

  39. 1XOBCMF ˙ ⡹㻨麕$铃鎊㌨

  40. 1XOBCMF (low address) AAAAAAAA <--- esp 00000000 00000000 <--- buffer

    00000000 00000000 00000000 00000000 0083af3c <--- stack canary ffeeddcc <--- ebp, saved ebp 00401234 <--- return address abcdabcd (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; }
  41. 1XOBCMF (low address) AAAAAAAA <--- esp 00000000 41414141 <--- buffer

    41414141 41414141 41414141 41414141 41414141 <--- stack canary 41414141 <--- ebp, saved ebp 41414141 <--- return address 41414141 (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; }
  42. 1XOBCMF (low address) AAAAAAAA <--- esp 00000000 41414141 <--- buffer

    41414141 41414141 41414141 41414141 41414141 <--- stack canary 41414141 <--- ebp, saved ebp 41414141 <--- return address 41414141 (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; } *** stack smashing detected ***
  43. 1XOBCMF ˙ TUBDLDBOBSZ僽植➿管陼㐼涸⥃隌堥ⵖ꣈姺TUBDLPWFSPX怪峯鄄ⵄ欽 ˙ 鹎ⰅGVODUJPO儘㻨Ⰵ04ꦑ堥欴欰涸TUBDLDBOBSZ ˙ ꨆꟚGVODUJPO僽增叆TUBDLDBOBSZ僽や鄄睕佖 ˙ 鸮糵㻨Ⰵ銼覈FCQ SFUSVOBEESFTT⛓⵹♧㹁剚⯓覈ⵌTUBDLDBOBSZ

    ˙ #PPPPPPPPPPPN ˙ 䧮⦛⢵溏♧⦐尝剤⥃隌涸⢿㶩
  44. 1XOBCMF ˙ OBNF㖈㛜毕♳ ˙ EBUB㖈ꬆ䢀涸⡙㖧 ˙ TDBOG T OBNF 

    ˙ 鸤䧭CVFSPWFSPX ˙ 濼麥TUBDL僽䙦랃麌⡲涸䖎ꅾ銴
  45. 1XOBCMF ˙ TDBOG T OBNF  ˙ """"""""""""""""""""""""" """"""""""""""""""""""""" """""""""""""""""""""""""

    """"""""""""""""""""""""" """"""""""""""""""""""""" """"""""""""""""""""""""" """"""""""""""""""""""""" ababcdcd <- esp 00000000 41414141 <- &name 41414141 41414141 41414141 41414141 41414141 <- ebp 41414141 <- ret addr 41414141 41414141
  46. 1XOBCMF ˙ SFU ˙ &*1Y ˙ $SBTI ˙ &*1〳⟃䱾ⵖ ˙

    齡䧮⦛〳♶〳⟃〭CBTIⴀ⢵ ˙ %FNP ababcdcd <- esp 00000000 41414141 <- &name 41414141 41414141 41414141 41414141 41414141 <- ebp 41414141 <- ret addr 41414141 41414141
  47. 1XOBCMF鎹䥊넓䨞昰涸余꣈娜〷 ˙ #VFSPWFSPX SFUVSOUPTUBDL ˙ %BUB&YFDVUJPO1SFWFOUJPO雊须俲♶〳㛂遤 ˙ 3FUVSO0SJFOUFE1SPHSBNNJOH301鰋논锓CZ-BZT ˙ 4UBDLDBOBSZ增叆剤尝剤PWFSPX

    ˙ "4-3雊⡹枤♶⚥ ˙ 4IBEPX4UBDL欽〥㢫♧⦐TUBDL㶸SFUVSOBEESFTT ˙ 301JTEFBE ˙ 䒂⠽ꠗ隡+VNQ0SJFOUFE1SPHSBNNJOH
  48. 1XOBCMF$5'䌢欽余乹䩛岁 ˙ 3FUVSOUP4UBDL ˙ 䪾TIFMMDPEF㻨㖈TUBDL♳䟝鳵岁SFUVSOⵌTUBDL♳㛂遤 ˙ 䪪ⵌKNQFTQ ˙ 3FUVSOUPMJCD ˙

    欽301㛂遤MJCD酭꬗涸GVODUJPO ˙ 3FUVSOUPEMSFTPMWF ˙ ⵄ欽%ZOBNJD-JOLJOH雊➮湬䱺䌟䧮⦛⿡TZTUFN
  49. 1XOBCMF$5'䌢欽余乹䩛岁 ˙ GPSNBUTUSJOH怪峯 ˙ QSJOUG EEE    

    ˙ ⡹濼麥O Q㌨ ˙ QSJOUG T EBUB  ˙ QSJOUG EBUB  00401234 <- esp, ret addr 2016 <- arg1 1 <- arg2 1 <- arg3 aaaaaaaa <- int a bbbbbbbb <- int b 41414141 <- char data[8] 41414141 00ae5d25 <- stack canary cccccccc <- saved ebp 00405566 <- ret addr
  50. 1XOBCMF$5'䌢欽余乹䩛岁 ˙ GPSNBUTUSJOH怪峯 ˙ QSJOUG EEE    

    ˙ ⡹濼麥O Q㌨ ˙ QSJOUG T EBUB  ˙ QSJOUG EBUB  ˙ QQQQQQQQQQ ˙ %FNP 00401234 <- esp, ret addr 2016 <- arg1 1 <- arg2 1 <- arg3 aaaaaaaa <- arg4 bbbbbbbb <- arg5 41414141 <- arg6 41414141 <- arg7 00ae5d25 <- arg8 cccccccc <- arg9 00405566 <- arg10
  51. 1XOBCMF$5'䌢欽余乹䩛岁 ˙ #JOBSZ&YQMPJUBUJPO涸劥颶僽隡《䧴㻨Ⰵ✫♶鑪雊⡹焥ⵌ涸㖒倰 ˙ 銼覈涸㖒倰僽 ˙ SFUVSOBEESFTT ˙ EBUBQPJOUFS ˙

    GVODUJPOQPJOUFS ˙ (05FOUSZ ˙ NPSF
  52. $SZQUP ˙ 管焺ꦡ询⸈㺙 ˙ ⸈㺙♧㹁剤♧䪾ꚤ⻑ ˙ 管焺 ˙ ⡹♧㹁聃麕)FY CBTF

    VSMFODPEF ˙ 嫲鯱㼱鋅VVFODPEF CBTF CBTF ˙ ꦡ询 ˙ 騈管焺♧垺⡎僽湡涸♶ず ˙ SPU ˙ /VF,:@.
  53. $SZQUP ˙ 〢Ⱙ㺙焺㷸 ˙ %#'5#4%+2*'4'0%4;26+10$BFTBS$JQIFS LFZ"   ˙ 7FHFOFSF$JQIFS⳯且⸈㺙鹎ꥣ晝劥

    ˙ ➿䳖⸈㺙4VCTUJUVUJPO$JQIFS ˙ 䪾嫦⦐㶶嫢♧㼩♧涸鱲䳖ⵌ〥♧穉㶶嫢 ˙ 걽桧ⴕ區余乹ꆚ㼩僈俒涸暶䚍⨞ⴕ區
  54. $SZQUP ˙ 植➿㺙焺㷸 ˙ #MPDL$JQIFS䪾须俲ⴗ䧭♧㝆♧㝆⨞⸈鍑㺙 ˙ %&4 "&4 #MPXTI ˙

    㥶卓须俲䖎Ꟁ ˙ #MPDL$JQIFS0QFSBUJPO.PEF ˙ 1,$4 $#$.PEF剤1BEEJOH0SBDMF"UUBDL ˙ 4UFBN$JQIFS ˙ 欽13/(✥侸欴欰㐼呏亙,FZ欴欰鸮糵涸4USFBN,FZ⨞9PS ˙ 0'#.PEF䖎⫹僽4USFBN$JQIFS
  55. $SZQUP ˙ %JF)FMMNBO,FZ&YDIBOHF ˙ 㥶卓鸮箁鄄甦聃銴䙦랃㸞涸鹎遤⸈㺙鸮箁 ˙ )BTI꧹廔 ˙ 窍⡹♧❉须俲欴ⴀ㔿㹁Ꟁ䏞涸侸⧩ ˙

    )BTI$PMMJTJPO ˙ -FOHUI&YUFOTJPO"UUBDL ˙ 㺙焺欽涸)BTI怵皿岁 ˙ TDSZQU CDSZQU QCLEG BSHPO
  56. $SZQUP ˙ ꬌ㼩珖㺙焺㷸 ˙ 铭劥♳♧㹁剤涸34"/QR ˙ 34"꨾銴㸞涸QBEEJOH0"&1 ˙ 堬㕩刼箁㺙焺㷸&$$ ˙

    &M(BNBM3BCJO ˙ 㛇倴ꨆ侕侸㷸涸⸈㺙禺窡 ˙ 34"禺窡㛇倴顥꼛㼭㹁椚ㄤ'JOJUF'JFME"SJUINFUJD ˙ 澗鍑34"涸麌⡲♶剚阮僈荛㼱〳⟃胝ⴀ欴欰,FZㄤ⸈鍑㺙涸倰䒭
  57. $SZQUP䊨Ⱘ ˙ STBUPPMQZ ˙ YPSUPPM ˙ IUUQGBDUPSECDPN

  58. 'PSFOTJD ˙ 侸⡙Ꙥ陏䖰♶剚⹛涸.FNPSZ%VNQ%JTL*NBHF䮕须俲 ˙ .FNPSZ'PSFOTJD ˙ 濼麥LFSOFM酭꬗剤❉➊랃穡圓넓銴㥶⡦㹁⡙䪪ⴀ鸏❉穡圓넓 ˙ ➊랃僽7JSUVBM.FNPSZ5-# ˙

    8JOEPXT&130$&44-JOVYUBTL@TUSVDU NN@TUSVDU ˙ 䖰1SPDFTT-JTUꟚ㨥 ˙ %VNQ〳毠涸QSPDFTT鼩⾲ⴀFYFDVUBCMFMF鹎遤ⴕ區 ˙ 'JMF$BDIF/FUXPSL$POOFDUJPOT
  59. 'PSFOTJD ˙ %JTL'PSFOTJD ˙ 3FHJTUSZ)*7&MF 8JOEPXT  ˙ %VNQ-./5-.IBTI8JOEPXT涬Ⰵ㺙焺IBTI ˙

    䫌SPPULJU ˙ ⸈㺙ꦡ询煂⼦5SVF$SZQU ˙ &'*SPPULJU
  60. 'PSFOTJD5PPM ˙ WPMBUJMJUZ ˙ ♧⦐馄䓽涸.FNPSZGPSFOTJDGSBNFXPSL ˙ ꤑ✫㉂噠鮿넓⛓㢫剓㥪涸'SFFTPGUXBSF鼇乵 ˙ 〳⟃⸈䱦QMVHJO⢵仍⯏⸆腋 ˙

    QTMJTU EVNQQSPDFTTNFNPSZ EVNQNPEVMFMF EVNQESJWFSMF  EVNQDBDIFEMF EVNQSFHJTUSZ EVNQQBTTXPSEIBTI NJNJLBU[  EVNQ"&4LFZ
  61. .JTD4UFHP ˙ 窍⡹♧❉㣼䚓涸䮋䨞ꦡ询须鎝㖈须俲⚥ ˙ 㕬晚-4# ˙ 㖈㕬晚䖕꬗꣡⸈♧⦐㠺簮墂 ˙ CBTFQBEEJOHCJU〳⟃询须俲 ˙

    㡏䱈涸CJOBSZEBUB ˙ ䷒倛ꨶ焺 ˙ 䊨Ⱘ ˙ PQFOTUFHP TUFHPTPMWFS &EJUPS CJOBSZUFNQMBUF
  62. .JTD4UFHP5PPM ˙ &EJUPS ˙ #JOBSZUFNQMBUF馄㥪欽 ˙ PQFOTUFHP ˙ TUFHPTPMWFS ˙

    㕬晚겗〳⟃欽鸏⦐溏-4# ˙ TOPX IUUQXXXEBSLTJEFDPNBVTOPX
  63. "UUBDL%FGFOTF ˙ 鎙ⴕ匢♳剚剤 ˙ ぐ⦐剪⹡涸朜䢀 ˙ "MJWF 1XOFE %PXO ˙

    鑪㔐ざ涸ⴕ侸隶⹛ꆀ ˙ 籏ⴕ侸
  64. "UUBDL%FGFOTF ˙ 嫦⦐꥙⟿剤荈䊹涸(BNFCPY ˙ 剤♧垺涸겗湡♧垺涸怪峯 ˙ 余乹Ⱖ➮꥙⟿꣈狡荈䊹 ˙ ⟃1XO捀⚺❏崎⩑晋剤8FC ˙

    ⚺鳵倰剤4FSWJDF$IFDL
  65. "UUBDL%FGFOTF ˙ 瘼殜䖎ꅾ銴 ˙ 崩ꆀⴕ區倴ꅾ佞余乹 ˙ 佞䖕Ꟍ ˙ 㥶⡦CJOBSZQBUDI ˙

    *%"1SP ˙ IUFEJUPS ˙ DIFBUFOHJOF ˙ -%@13&-0"%
  66. %"31"$($ ˙ 堥㐼➃䩧"UUBDL%FGFOTF ˙ 갸濼鑬䞕锞溏♳⼯涸㜥妄9%

  67. 2"