Introduction
Software are getting more and more complex to analyze, they are bigger and better protected than years ago. So tools must follow this trend and be adapted to provide features that can deal with binaries as smoothly as possible. This is why I've started the Triton project 7 years ago, it is like a Swiss Army knife with one more feature today: the possibility to lift from the Triton AST to the LLVM IR.
Why LLVM IR?
LLVM is a compiler infrastructure which relies on its own IR [0] and provides so many tools and features for code optimization. Code optimizations are useful for deobfuscate parts of binary code and thus break some software protections [1]. Several tools already exist to lift binary code to LLVM IR [2, 3, 4, 5, 6, 7, 8, 9].
Unlike most of binary analysis tools, Triton is a bit different as it works on a dynamic paradigm, it represents the data flow of an execution on its own structured representation and provides some optimizations on it. These optimizations are possible as we can extract concrete information from the execution. For example, we can extract runtime values to simplify the path predicate built by the symbolic engine (useful when attacking virtual-based protection [1]). Second example, last week we introduced another optimization to synthesize obfuscated expressions and thus break MBA [10]. However, optimizations are always hard to develop and are a real academic fields. So what better than enjoying all things already done by the LLVM community on that part! Thus we can combine our optimizations from a dynamic paradigm plus compiler optimizations!
Another point is that when we simplified obfuscated code, in some scenarios it can be useful to translate back the Triton AST to binary code in order to rebuild an unprotected binary. This is the topic of the today.
All these arguments lead us to provide news features (commit: aa1dbb5).
Lifting engines
News classes are born: LiftingEngine, LiftingToLLVM, LiftingToPython, LiftingToSMT and TritonToLLVM.
Lifting the Triton AST to Python and SMT files already existed, but were refactored into new classes. The new feature is the classes LiftingToLLVM and TritonToLLVM. TritonToLLVM converts a triton::ast::SharedAbstractNode to a llvm::Module and can be used as standalone class. This class does not alter your current analysis state. For example, on C++ you have something like this:
void foo(const triton::ast::SharedAbstractNode& node)
/* The LLVM context */
llvm::LLVMContext context;
/* The lifter Triton -> LLVM */
triton::ast::TritonToLLVM lifter(context);
/* Lift AST to LLVM IR */
std::shared_ptr<llvm::Module> llvmModule = lifter.convert(node);
...
}
Then, once the llvm::Module got, feel free to use the power of the LLVM back-end. The class LiftingToLLVM allows us to stream the llvm::Module into a std::ostream. For example on Python you may have something like below. All your symbolic variables involved in the ecx expression will be passed as an argument to an LLVM-IR function so that ecx = __triton(a, b)
>>> print(ctx.liftToLLVM(ecx))
define i32 @__triton(i32 %a, i32 %b) {
entry:
%0 = xor i32 %b, -1
%1 = mul i32 %a, %b
%2 = and i32 %1, %0
%3 = add i32 %b, 0
%4 = xor i32 %1, -1
[...]
%36 = shl i32 %35, 8
%37 = zext i8 %22 to i32
%38 = or i32 %36, %37
%39 = zext i32 %38 to i64
%40 = trunc i64 %39 to i32
ret i32 %40
}
Concrete example
Let's consider an obfuscated function that takes 2 arguments that the user can control. After a reverse engineering phase, we now that the function wants to hide the computation of those two arguments using MBA. So we:
- Extract the binary code of the function
- Define the
AST_OPTIMIZATIONS mode to perform classical AST optimizations during the runtime
- Emulate the function
- Get the data flow of the computation at the return of the function (assigned by the register
eax)
- Synthesize the data flow
- Lift to the LLVM IR
- Take a beer 🍺
The script is the following:
#!/usr/bin/env python
## -*- coding: utf-8 -*-
import sys
from triton import *
# The function we want to emulate
CODE = b"\x55\x48\x89\xE5\x89\x7D\xEC\x89\x75\xE8\x8B\x45\xE8\x23\x45\xEC"
CODE += b"\x89\xC2\x8B\x45\xE8\x0B\x45\xEC\x89\xD1\x0F\xAF\xC8\x8B\x45\xEC"
CODE += b"\xF7\xD0\x23\x45\xE8\x89\xC2\x8B\x45\xE8\xF7\xD0\x23\x45\xEC\x0F"
CODE += b"\xAF\xC2\x01\xC8\x23\x45\xE8\x89\xC2\x8B\x45\xE8\x23\x45\xEC\x89"
CODE += b"\xC1\x8B\x45\xE8\x0B\x45\xEC\x89\xCE\x0F\xAF\xF0\x8B\x45\xEC\xF7"
CODE += b"\xD0\x23\x45\xE8\x89\xC1\x8B\x45\xE8\xF7\xD0\x23\x45\xEC\x0F\xAF"
CODE += b"\xC1\x01\xF0\x0B\x45\xE8\x89\xD6\x0F\xAF\xF0\x8B\x45\xE8\x23\x45"
CODE += b"\xEC\x89\xC2\x8B\x45\xE8\x0B\x45\xEC\x89\xD1\x0F\xAF\xC8\x8B\x45"
CODE += b"\xEC\xF7\xD0\x23\x45\xE8\x89\xC2\x8B\x45\xE8\xF7\xD0\x23\x45\xEC"
CODE += b"\x0F\xAF\xC2\x8D\x14\x01\x8B\x45\xE8\xF7\xD0\x89\xD1\x21\xC1\x8B"
CODE += b"\x45\xE8\x23\x45\xEC\x89\xC2\x8B\x45\xE8\x0B\x45\xEC\x89\xD7\x0F"
CODE += b"\xAF\xF8\x8B\x45\xEC\xF7\xD0\x23\x45\xE8\x89\xC2\x8B\x45\xE8\xF7"
CODE += b"\xD0\x23\x45\xEC\x0F\xAF\xC2\x01\xF8\xF7\xD0\x23\x45\xE8\x0F\xAF"
CODE += b"\xC1\x8D\x14\x06\x8B\x45\xEC\x01\xD0\x83\xC0\x01\x89\x45\xFC\x8B"
CODE += b"\x45\xFC\x5D\xC3"
def emulate(ctx, pc):
while pc:
opcode = ctx.getConcreteMemoryAreaValue(pc, 16)
instruction = Instruction(pc, opcode)
ctx.processing(instruction)
pc = ctx.getConcreteRegisterValue(ctx.registers.rip)
return
def main():
ctx = TritonContext(ARCH.X86_64)
ast = ctx.getAstContext()
ctx.setMode(MODE.AST_OPTIMIZATIONS, True)
# Arguments of the function we want to symbolize
a = ast.variable(ctx.symbolizeRegister(ctx.registers.edi, "a"))
b = ast.variable(ctx.symbolizeRegister(ctx.registers.esi, "b"))
# Emulate the code
ctx.setConcreteMemoryAreaValue(0x1000, CODE)
emulate(ctx, 0x1000)
# Get the return of the function
eax = ctx.getRegisterAst(ctx.registers.eax)
# Lift the returned expression
deobfu = ctx.synthesize(eax, opaque=False, constant=True, subexpr=True)
print(ctx.liftToLLVM(deobfu))
if __name__ == '__main__':
sys.exit(main())
After synthesizing the data flow we know that the computation is ((a + ((a * b) * b)) + 0x1) and the lifting to LLVM IR is the following:
; ModuleID = 'tritonModule'
source_filename = "tritonModule"
define i32 @__triton(i32 %a, i32 %b) {
entry:
%0 = mul i32 %a, %b
%1 = mul i32 %0, %b
%2 = add i32 %a, %1
%3 = add i32 %2, 1
ret i32 %3
}
Now we are free to compile this function and to inject opcode into IDA to replace the obfuscated function by a clearer version. Note that at the first shot it may looks as a trivial simplification but without our synthesis implementation the obfuscated computation is the following:
(((((((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff) + ((((0x0 + ((((((((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((((0x0 + ((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff) & 0xffffffff) & ((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + 0x1) & 0xffffffff) & 0xffffffff) >> 24) & 0xff)) << 8 | ((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff) + ((((0x0 + ((((((((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((((0x0 + ((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff) & 0xffffffff) & ((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + 0x1) & 0xffffffff) & 0xffffffff) >> 16) & 0xff)) << 8 | ((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff) + ((((0x0 + ((((((((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((((0x0 + ((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff) & 0xffffffff) & ((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + 0x1) & 0xffffffff) & 0xffffffff) >> 8) & 0xff)) << 8 | (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff) + ((((0x0 + ((((((((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + (((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((((0x0 + ((((((((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff) & 0xffffffff) * ((((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff) | (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff)) & 0xffffffff) + ((((((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff))) & 0xffffffff) * (((((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | a) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff) & (((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff))) & 0xffffffff) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff) & 0xffffffff) & ((~(((((((((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 24) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 16) & 0xff)) << 8 | (((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) >> 8) & 0xff)) << 8 | ((((((0x0 >> 32) & 0xffffffff)) << 32 | b) & 0xffffffff) & 0xff)) & 0xffffffff)) & 0xffffffff) & 0xffffffff)) & 0xffffffff)) & 0xffffffff) * 0x1) & 0xffffffffffffffff)) & 0xffffffffffffffff)) & 0xffffffffffffffff) & 0xffffffff) & 0xffffffff)) & 0xffffffff) & 0xffffffff) + 0x1) & 0xffffffff) & 0xffffffff) & 0xff)) & 0xffffffff)
In this case, it is not useful to use LLVM optimizations to improve the output as we fully synthesized it, but at least we can re-inject opcodes into IDA and continue the reverse engineering of the target. However, sometime LLVM optimizations are benefical [01] =).
References
[00] https://llvm.org/docs/LangRef.html
[01] https://github.com/JonathanSalwan/Tigress_protection
[02] https://github.com/lifting-bits/mcsema
[03] https://github.com/avast/retdec
[04] https://github.com/GaloisInc/reopt
[05] https://github.com/revng/revng
[06] https://github.com/cojocar/bin2llvm
[07] https://github.com/zneak/fcd
[08] https://github.com/draperlaboratory/fracture
[09] https://github.com/pgoodman/libbeauty
[10] https://tel.archives-ouvertes.fr/tel-01623849/document
Introduction
Software are getting more and more complex to analyze, they are bigger and better protected than years ago. So tools must follow this trend and be adapted to provide features that can deal with binaries as smoothly as possible. This is why I've started the Triton project 7 years ago, it is like a Swiss Army knife with one more feature today: the possibility to lift from the Triton AST to the LLVM IR.
Why LLVM IR?
LLVM is a compiler infrastructure which relies on its own IR [0] and provides so many tools and features for code optimization. Code optimizations are useful for deobfuscate parts of binary code and thus break some software protections [1]. Several tools already exist to lift binary code to LLVM IR [2, 3, 4, 5, 6, 7, 8, 9].
Unlike most of binary analysis tools, Triton is a bit different as it works on a dynamic paradigm, it represents the data flow of an execution on its own structured representation and provides some optimizations on it. These optimizations are possible as we can extract concrete information from the execution. For example, we can extract runtime values to simplify the path predicate built by the symbolic engine (useful when attacking virtual-based protection [1]). Second example, last week we introduced another optimization to synthesize obfuscated expressions and thus break MBA [10]. However, optimizations are always hard to develop and are a real academic fields. So what better than enjoying all things already done by the LLVM community on that part! Thus we can combine our optimizations from a dynamic paradigm plus compiler optimizations!
Another point is that when we simplified obfuscated code, in some scenarios it can be useful to translate back the Triton AST to binary code in order to rebuild an unprotected binary. This is the topic of the today.
All these arguments lead us to provide news features (commit: aa1dbb5).
Lifting engines
News classes are born:
LiftingEngine,LiftingToLLVM,LiftingToPython,LiftingToSMTandTritonToLLVM.Lifting the Triton AST to Python and SMT files already existed, but were refactored into new classes. The new feature is the classes
LiftingToLLVMandTritonToLLVM.TritonToLLVMconverts atriton::ast::SharedAbstractNodeto allvm::Moduleand can be used as standalone class. This class does not alter your current analysis state. For example, on C++ you have something like this:Then, once the
llvm::Modulegot, feel free to use the power of the LLVM back-end. The classLiftingToLLVMallows us to stream thellvm::Moduleinto astd::ostream. For example on Python you may have something like below. All your symbolic variables involved in theecxexpression will be passed as an argument to an LLVM-IR function so thatecx = __triton(a, b)Concrete example
Let's consider an obfuscated function that takes 2 arguments that the user can control. After a reverse engineering phase, we now that the function wants to hide the computation of those two arguments using MBA. So we:
AST_OPTIMIZATIONSmode to perform classical AST optimizations during the runtimeeax)The script is the following:
After synthesizing the data flow we know that the computation is
((a + ((a * b) * b)) + 0x1)and the lifting to LLVM IR is the following:Now we are free to compile this function and to inject opcode into IDA to replace the obfuscated function by a clearer version. Note that at the first shot it may looks as a trivial simplification but without our synthesis implementation the obfuscated computation is the following:
In this case, it is not useful to use LLVM optimizations to improve the output as we fully synthesized it, but at least we can re-inject opcodes into IDA and continue the reverse engineering of the target. However, sometime LLVM optimizations are benefical [01] =).
References
[00] https://llvm.org/docs/LangRef.html
[01] https://github.com/JonathanSalwan/Tigress_protection
[02] https://github.com/lifting-bits/mcsema
[03] https://github.com/avast/retdec
[04] https://github.com/GaloisInc/reopt
[05] https://github.com/revng/revng
[06] https://github.com/cojocar/bin2llvm
[07] https://github.com/zneak/fcd
[08] https://github.com/draperlaboratory/fracture
[09] https://github.com/pgoodman/libbeauty
[10] https://tel.archives-ouvertes.fr/tel-01623849/document