422 lines
17 KiB
C
422 lines
17 KiB
C
/*
|
||
* winmm 侧加载 + V8 编译期源码改写
|
||
*
|
||
* 背景：QQ 9.9.37 的 asar 内 JS 全部逐文件加密，静态解不开；
|
||
* 但解密后的内容最终要交给 V8 编译 —— 在 ScriptCompiler::Compile*
|
||
* 入口拿到 v8::ScriptCompiler::Source*，其首字段就是 Local<String>。
|
||
*
|
||
* 能力：
|
||
* - 抓取：把每个被编译的脚本以明文落到 SC_V8_DIR
|
||
* - 改写：命中 SC_V8_MATCH 的脚本文本，前面插入 SC_V8_PATCH 的内容
|
||
* （用 String::NewFromUtf8 造新串，替换 Source::source_string_）
|
||
*
|
||
* ABI 备注：实测 MaybeLocal<T> 走 sret（rcx 为返回槽），故 Source* 在第三参；
|
||
* NewFromUtf8 同样按 sret 调用，可用 SC_V8_SRET=0 切换回 RAX 变体。
|
||
*/
|
||
#include <windows.h>
|
||
#include <stdio.h>
|
||
#include <stdarg.h>
|
||
#include <string.h>
|
||
#include <stdint.h>
|
||
#include "v8syms.h"
|
||
#include "MinHook.h"
|
||
|
||
extern void winmm_stubs_init(HMODULE real);
|
||
|
||
static HMODULE g_self = NULL;
|
||
|
||
#define MAX_PATCH (1 << 20)
|
||
|
||
/* ───────────── 配置 ───────────── */
|
||
static CRITICAL_SECTION g_lock;
|
||
static wchar_t g_dir[MAX_PATH] = L"D:\\SnowCat.Portable\\v8dump";
|
||
static volatile LONG g_seq = 0;
|
||
static volatile LONG g_calls = 0;
|
||
static int g_on = 0; /* 抓取开关（默认关，SC_V8_DUMP=1 才开） */
|
||
static int g_probe = 0;
|
||
static int g_off = 0; /* Source 内 Local<String> 偏移（实测 0） */
|
||
static int g_arg = 3; /* 哪个入参是 Source*（实测第三参） */
|
||
static int g_sret = 1; /* MaybeLocal 是否走 sret */
|
||
|
||
static char* g_patch = NULL; /* 要插入的 JS */
|
||
static int g_patchLen = 0;
|
||
static char g_match[128] = "internal_index";
|
||
static volatile LONG g_patched = 0;
|
||
|
||
/* ───────────── 日志 ───────────── */
|
||
static void logLine(const char* fmt, ...) {
|
||
char buf[4096];
|
||
va_list ap; va_start(ap, fmt);
|
||
int n = _vsnprintf(buf, sizeof(buf) - 2, fmt, ap);
|
||
va_end(ap);
|
||
if (n < 0) return;
|
||
buf[n++] = '\n'; buf[n] = 0;
|
||
EnterCriticalSection(&g_lock);
|
||
wchar_t path[MAX_PATH];
|
||
_snwprintf(path, MAX_PATH, L"%s\\_index.txt", g_dir);
|
||
HANDLE h = CreateFileW(path, FILE_APPEND_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE,
|
||
NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (h != INVALID_HANDLE_VALUE) {
|
||
DWORD w = 0;
|
||
SetFilePointer(h, 0, NULL, FILE_END);
|
||
WriteFile(h, buf, (DWORD)n, &w, NULL);
|
||
CloseHandle(h);
|
||
}
|
||
LeaveCriticalSection(&g_lock);
|
||
}
|
||
|
||
/* ───────────── V8 符号 ───────────── */
|
||
typedef void* (*pfn_Isolate_GetCurrent)(void);
|
||
typedef void (*pfn_Utf8Value_ctor)(void* self, void* iso, void* localValue);
|
||
typedef const char* (*pfn_Utf8Value_ptr)(void* self);
|
||
typedef size_t (*pfn_Utf8Value_len)(void* self);
|
||
typedef void (*pfn_Utf8Value_dtor)(void* self);
|
||
typedef unsigned char (*pfn_Value_IsString)(void* self);
|
||
typedef void (*pfn_NewFromUtf8_sret)(void* sret, void* iso, const char* data, int type, int len);
|
||
typedef void* (*pfn_NewFromUtf8_rax)(void* iso, const char* data, int type, int len);
|
||
|
||
static pfn_Isolate_GetCurrent v8_GetCurrent;
|
||
static pfn_Utf8Value_ctor v8_Utf8Ctor;
|
||
static pfn_Utf8Value_ptr v8_Utf8Ptr;
|
||
static pfn_Utf8Value_len v8_Utf8Len;
|
||
static pfn_Utf8Value_dtor v8_Utf8Dtor;
|
||
static pfn_Value_IsString v8_IsString;
|
||
static pfn_NewFromUtf8_sret v8_NewFromUtf8;
|
||
|
||
static int readable(const void* p, size_t n) {
|
||
MEMORY_BASIC_INFORMATION mbi;
|
||
if (!p) return 0;
|
||
if (VirtualQuery(p, &mbi, sizeof(mbi)) != sizeof(mbi)) return 0;
|
||
if (mbi.State != MEM_COMMIT) return 0;
|
||
if (mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD)) return 0;
|
||
return ((const BYTE*)p + n) <= ((const BYTE*)mbi.BaseAddress + mbi.RegionSize);
|
||
}
|
||
|
||
static void writeDump(const char* txt, size_t len, const char* tag) {
|
||
LONG idx = InterlockedIncrement(&g_seq);
|
||
wchar_t path[MAX_PATH];
|
||
_snwprintf(path, MAX_PATH, L"%s\\%lu_%05ld.js", g_dir, GetCurrentProcessId(), idx);
|
||
HANDLE h = CreateFileW(path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (h != INVALID_HANDLE_VALUE) {
|
||
DWORD w = 0;
|
||
WriteFile(h, txt, (DWORD)len, &w, NULL);
|
||
CloseHandle(h);
|
||
}
|
||
char head[100];
|
||
size_t i = 0;
|
||
for (; i < sizeof(head) - 1 && i < len; i++) {
|
||
char c = txt[i];
|
||
head[i] = (c >= 32 && c < 127) ? c : '.';
|
||
}
|
||
head[i] = 0;
|
||
logLine("%lu\t%s\tlen=%llu\t%s", GetCurrentProcessId(), tag, (unsigned long long)len, head);
|
||
}
|
||
|
||
/* 造一个 v8::String，返回 Local<String> 的裸指针 */
|
||
static void* makeString(void* iso, const char* data, int len) {
|
||
if (!v8_NewFromUtf8) return NULL;
|
||
unsigned char slot[64];
|
||
memset(slot, 0, sizeof(slot));
|
||
if (g_sret) {
|
||
v8_NewFromUtf8(slot, iso, data, 0, len);
|
||
return *(void**)slot;
|
||
} else {
|
||
pfn_NewFromUtf8_rax fn = (pfn_NewFromUtf8_rax)v8_NewFromUtf8;
|
||
return fn(iso, data, 0, len);
|
||
}
|
||
}
|
||
|
||
/* 命中则把源码替换成 patch + 原文 */
|
||
static int tryPatch(void* src, const char* txt, size_t len) {
|
||
if (!g_patch || g_patchLen <= 0 || !txt || len == 0) return 0;
|
||
if (len > (4u << 20)) return 0;
|
||
if (!strstr(txt, g_match)) return 0;
|
||
|
||
void* iso = v8_GetCurrent ? v8_GetCurrent() : NULL;
|
||
if (!iso) return 0;
|
||
|
||
int total = g_patchLen + 1 + (int)len;
|
||
char* merged = (char*)malloc((size_t)total + 1);
|
||
if (!merged) return 0;
|
||
memcpy(merged, g_patch, (size_t)g_patchLen);
|
||
merged[g_patchLen] = '\n';
|
||
memcpy(merged + g_patchLen + 1, txt, len);
|
||
merged[total] = 0;
|
||
|
||
void* s = makeString(iso, merged, total);
|
||
free(merged);
|
||
if (!s) { logLine("%lu\tPATCHFAIL\tmakeString null", GetCurrentProcessId()); return 0; }
|
||
|
||
*(void**)((char*)src + g_off) = s;
|
||
InterlockedIncrement(&g_patched);
|
||
logLine("%lu\tPATCHED\thit=%s origLen=%llu newLen=%d", GetCurrentProcessId(), g_match,
|
||
(unsigned long long)len, total);
|
||
return 1;
|
||
}
|
||
|
||
static unsigned char* holderPtr(void) {
|
||
static __thread unsigned char holder[128];
|
||
return holder;
|
||
}
|
||
|
||
static void handle(void* a1, void* a2, void* a3, void* a4, void* a5, const char* tag) {
|
||
if (!g_on && !g_patch) return;
|
||
LONG call = InterlockedIncrement(&g_calls);
|
||
|
||
if (g_probe) {
|
||
if (call > 12) return;
|
||
logLine("%lu\tPROBE\t%s\tcall=%ld a1=%p a2=%p a3=%p a4=%p a5=%p",
|
||
GetCurrentProcessId(), tag, call, a1, a2, a3, a4, a5);
|
||
return;
|
||
}
|
||
|
||
void* bases[5] = { a1, a2, a3, a4, a5 };
|
||
if (g_arg < 1 || g_arg > 5) return;
|
||
void* src = bases[g_arg - 1];
|
||
if (!src) return;
|
||
|
||
const char* txt = NULL; size_t len = 0;
|
||
unsigned char* h = holderPtr();
|
||
memset(h, 0, 128);
|
||
|
||
void* iso = v8_GetCurrent ? v8_GetCurrent() : NULL;
|
||
if (iso) {
|
||
void* cand = NULL;
|
||
if (readable(src, (size_t)g_off + 8)) cand = *(void**)((char*)src + g_off);
|
||
if (cand && !((uintptr_t)cand & 7) && readable(cand, 16) && v8_IsString && v8_IsString(cand)) {
|
||
v8_Utf8Ctor(h, iso, cand);
|
||
const char* t = v8_Utf8Ptr(h);
|
||
size_t l = v8_Utf8Len(h);
|
||
if (t && l > 0 && l < (8u << 20)) { txt = t; len = l; }
|
||
}
|
||
}
|
||
|
||
if (txt) {
|
||
if (g_on) writeDump(txt, len, tag);
|
||
tryPatch(src, txt, len);
|
||
}
|
||
if (iso && v8_Utf8Len) v8_Utf8Dtor(h);
|
||
}
|
||
|
||
/* ───────────── Detour（纯 void* 透传） ───────────── */
|
||
typedef uint64_t (*fn5)(void*, void*, void*, void*, void*);
|
||
typedef uint64_t (*fn8)(void*, void*, void*, void*, void*, void*, void*, void*);
|
||
|
||
static fn5 orig_Compile;
|
||
static fn5 orig_CompileUnbound;
|
||
static fn5 orig_CompileModule;
|
||
static fn8 orig_CompileFunction;
|
||
|
||
static uint64_t det_Compile(void* a1, void* a2, void* a3, void* a4, void* a5) {
|
||
handle(a1, a2, a3, a4, a5, "Compile");
|
||
return orig_Compile(a1, a2, a3, a4, a5);
|
||
}
|
||
static uint64_t det_CompileUnbound(void* a1, void* a2, void* a3, void* a4, void* a5) {
|
||
handle(a1, a2, a3, a4, a5, "Unbound");
|
||
return orig_CompileUnbound(a1, a2, a3, a4, a5);
|
||
}
|
||
static uint64_t det_CompileModule(void* a1, void* a2, void* a3, void* a4, void* a5) {
|
||
handle(a1, a2, a3, a4, a5, "Module");
|
||
return orig_CompileModule(a1, a2, a3, a4, a5);
|
||
}
|
||
static uint64_t det_CompileFunction(void* a1, void* a2, void* a3, void* a4,
|
||
void* a5, void* a6, void* a7, void* a8) {
|
||
handle(a1, a2, a3, a4, a5, "Function");
|
||
return orig_CompileFunction(a1, a2, a3, a4, a5, a6, a7, a8);
|
||
}
|
||
|
||
/* ───────────── 初始化 ───────────── */
|
||
static int loadPatchFile(const wchar_t* path) {
|
||
HANDLE h = CreateFileW(path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
|
||
FILE_ATTRIBUTE_NORMAL, NULL);
|
||
if (h == INVALID_HANDLE_VALUE) return 0;
|
||
DWORD sz = GetFileSize(h, NULL);
|
||
if (sz == 0 || sz > MAX_PATCH) { CloseHandle(h); return 0; }
|
||
g_patch = (char*)malloc(sz + 1);
|
||
if (!g_patch) { CloseHandle(h); return 0; }
|
||
DWORD rd = 0;
|
||
ReadFile(h, g_patch, sz, &rd, NULL);
|
||
CloseHandle(h);
|
||
g_patch[rd] = 0;
|
||
g_patchLen = (int)rd;
|
||
return 1;
|
||
}
|
||
|
||
/* ── 进程内 dlopen 自检（排查 wrapper.node 加载失败） ── */
|
||
static DWORD WINAPI probeThread(LPVOID param) {
|
||
wchar_t path[MAX_PATH];
|
||
DWORD delay = 8000;
|
||
if (!GetEnvironmentVariableW(L"SC_TEST_LOAD", path, MAX_PATH)) return 0;
|
||
{
|
||
wchar_t d[32];
|
||
if (GetEnvironmentVariableW(L"SC_TEST_DELAY", d, 32) > 0) delay = (DWORD)wcstoul(d, NULL, 10);
|
||
}
|
||
Sleep(delay);
|
||
|
||
wchar_t appDir[MAX_PATH];
|
||
wcscpy(appDir, path);
|
||
wchar_t* s1 = wcsrchr(appDir, L'\\');
|
||
if (s1) *s1 = 0;
|
||
|
||
/* 时间轴测试：在不同时刻尝试加载，看是否随时间从成功变成 193 */
|
||
if (GetEnvironmentVariableW(L"SC_TEST_SERIES", path, MAX_PATH) > 0) {
|
||
const DWORD marks[] = { 1200, 2500, 4000, 6000, 9000, 13000, 18000 };
|
||
DWORD prev = 0;
|
||
for (int i = 0; i < 7; i++) {
|
||
Sleep(marks[i] - prev); prev = marks[i];
|
||
HMODULE m = LoadLibraryExW(path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
|
||
logLine("%lu\tSERIES\tt=%lu ok=%d err=%lu", GetCurrentProcessId(), marks[i], m != NULL, GetLastError());
|
||
if (m) FreeLibrary(m);
|
||
}
|
||
return 0;
|
||
}
|
||
|
||
HMODULE pre = GetModuleHandleW(L"wrapper.node");
|
||
logLine("%lu\tLOADTEST\talready=%p", GetCurrentProcessId(), (void*)pre);
|
||
|
||
SetDllDirectoryW(appDir);
|
||
HMODULE h = LoadLibraryExW(path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
|
||
logLine("%lu\tLOADTEST\tpath=%ls ok=%d err=%lu", GetCurrentProcessId(), path, h != NULL, GetLastError());
|
||
|
||
if (!h) {
|
||
HMODULE h2 = LoadLibraryW(path);
|
||
logLine("%lu\tLOADTEST2\tplain ok=%d err=%lu", GetCurrentProcessId(), h2 != NULL, GetLastError());
|
||
}
|
||
|
||
/* 依赖扫描：把 app 目录里的 dll/node 逐个加载，暴露 193 的真凶 */
|
||
if (GetEnvironmentVariableW(L"SC_TEST_DEPS", appDir, MAX_PATH) > 0) {
|
||
wchar_t pat[MAX_PATH];
|
||
_snwprintf(pat, MAX_PATH, L"%s\\*.d*", appDir);
|
||
WIN32_FIND_DATAW fd;
|
||
HANDLE ff = FindFirstFileW(pat, &fd);
|
||
int tried = 0, failed = 0;
|
||
if (ff != INVALID_HANDLE_VALUE) {
|
||
do {
|
||
const wchar_t* nm = fd.cFileName;
|
||
size_t L = wcslen(nm);
|
||
if (L < 5) continue;
|
||
if (_wcsicmp(nm, L"wrapper.node") == 0 || _wcsicmp(nm, L"major.node") == 0) continue;
|
||
wchar_t full[MAX_PATH];
|
||
_snwprintf(full, MAX_PATH, L"%s\\%s", appDir, nm);
|
||
HMODULE m = LoadLibraryExW(full, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
|
||
tried++;
|
||
if (!m) {
|
||
DWORD e = GetLastError();
|
||
failed++;
|
||
logLine("%lu\tDEPFAIL\t%ls\terr=%lu", GetCurrentProcessId(), nm, e);
|
||
}
|
||
} while (FindNextFileW(ff, &fd));
|
||
FindClose(ff);
|
||
}
|
||
logLine("%lu\tDEPSUM\ttried=%d failed=%d", GetCurrentProcessId(), tried, failed);
|
||
|
||
/* 依赖预载完，再试一次 wrapper.node */
|
||
HMODULE h3 = LoadLibraryExW(path, NULL, LOAD_WITH_ALTERED_SEARCH_PATH);
|
||
logLine("%lu\tLOADTEST3\tafter-deps ok=%d err=%lu", GetCurrentProcessId(), h3 != NULL, GetLastError());
|
||
}
|
||
return 0;
|
||
}
|
||
|
||
static DWORD WINAPI initThread(LPVOID param) {
|
||
(void)param;
|
||
InitializeCriticalSection(&g_lock);
|
||
|
||
wchar_t patchPath[MAX_PATH] = { 0 };
|
||
wchar_t match[128] = { 0 };
|
||
{
|
||
wchar_t v[32];
|
||
if (GetEnvironmentVariableW(L"SC_V8_DUMP", v, 32) > 0 && v[0] == L'1') g_on = 1;
|
||
if (GetEnvironmentVariableW(L"SC_V8_PROBE", v, 32) > 0 && v[0] == L'1') g_probe = 1;
|
||
if (GetEnvironmentVariableW(L"SC_V8_OFF", v, 32) > 0) g_off = (int)wcstol(v, NULL, 0);
|
||
if (GetEnvironmentVariableW(L"SC_V8_ARG", v, 32) > 0) g_arg = (int)wcstol(v, NULL, 0);
|
||
if (GetEnvironmentVariableW(L"SC_V8_SRET", v, 32) > 0) g_sret = (v[0] != L'0');
|
||
GetEnvironmentVariableW(L"SC_V8_DIR", g_dir, MAX_PATH);
|
||
GetEnvironmentVariableW(L"SC_V8_PATCH", patchPath, MAX_PATH);
|
||
if (GetEnvironmentVariableW(L"SC_V8_MATCH", match, 128) > 0) {
|
||
WideCharToMultiByte(CP_UTF8, 0, match, -1, g_match, sizeof(g_match), NULL, NULL);
|
||
}
|
||
CreateDirectoryW(g_dir, NULL);
|
||
}
|
||
|
||
wchar_t sys[MAX_PATH];
|
||
GetSystemDirectoryW(sys, MAX_PATH);
|
||
wcscat(sys, L"\\winmm.dll");
|
||
HMODULE real = LoadLibraryW(sys);
|
||
if (!real) { logLine("-1\tERR\tload system winmm failed"); return 1; }
|
||
winmm_stubs_init(real);
|
||
|
||
if (!patchPath[0] && g_self) {
|
||
wchar_t dllPath[MAX_PATH];
|
||
if (GetModuleFileNameW(g_self, dllPath, MAX_PATH)) {
|
||
wchar_t* sl = wcsrchr(dllPath, L'\\');
|
||
if (sl) {
|
||
*sl = 0;
|
||
_snwprintf(patchPath, MAX_PATH, L"%s\\snowcat-boot.js", dllPath);
|
||
}
|
||
}
|
||
}
|
||
|
||
int havePatch = 0;
|
||
if (patchPath[0]) {
|
||
havePatch = loadPatchFile(patchPath);
|
||
logLine("%lu\tCFG\tpatch=%d bytes=%d match=%s", GetCurrentProcessId(), havePatch, g_patchLen, g_match);
|
||
}
|
||
|
||
HMODULE qqnt = NULL;
|
||
for (int i = 0; i < 600; i++) {
|
||
qqnt = GetModuleHandleW(L"QQNT.dll");
|
||
if (qqnt) break;
|
||
Sleep(50);
|
||
}
|
||
if (!qqnt) { logLine("-1\tERR\tQQNT.dll never loaded"); return 1; }
|
||
|
||
v8_GetCurrent = (pfn_Isolate_GetCurrent)GetProcAddress(qqnt, SYM_ISOLATE_GET_CURRENT);
|
||
v8_Utf8Ctor = (pfn_Utf8Value_ctor)GetProcAddress(qqnt, SYM_UTF8VALUE_CTOR);
|
||
v8_Utf8Ptr = (pfn_Utf8Value_ptr)GetProcAddress(qqnt, SYM_UTF8VALUE_PTR);
|
||
v8_Utf8Len = (pfn_Utf8Value_len)GetProcAddress(qqnt, SYM_UTF8VALUE_LEN);
|
||
v8_Utf8Dtor = (pfn_Utf8Value_dtor)GetProcAddress(qqnt, SYM_UTF8VALUE_DTOR);
|
||
v8_IsString = (pfn_Value_IsString)GetProcAddress(qqnt, "?IsString@Value@v8@@QEBA_NXZ");
|
||
v8_NewFromUtf8 = (pfn_NewFromUtf8_sret)GetProcAddress(qqnt, SYM_STRING_NEWFROMUTF8);
|
||
|
||
if (!v8_GetCurrent || !v8_Utf8Ctor || !v8_Utf8Ptr || !v8_Utf8Len || !v8_IsString) {
|
||
logLine("-1\tERR\tv8 symbols missing");
|
||
return 1;
|
||
}
|
||
|
||
if (MH_Initialize() != MH_OK) { logLine("-1\tERR\tMH_Initialize failed"); return 1; }
|
||
|
||
struct { const char* name; void* det; void** orig; const char* tag; } hooks[] = {
|
||
{ SYM_COMPILE, (void*)det_Compile, (void**)&orig_Compile, "Compile" },
|
||
{ SYM_COMPILE_UNBOUND, (void*)det_CompileUnbound, (void**)&orig_CompileUnbound, "Unbound" },
|
||
{ SYM_COMPILE_MODULE, (void*)det_CompileModule, (void**)&orig_CompileModule, "Module" },
|
||
{ SYM_COMPILE_FUNCTION, (void*)det_CompileFunction, (void**)&orig_CompileFunction, "Function" },
|
||
};
|
||
|
||
int ok = 0;
|
||
for (int i = 0; i < 4; i++) {
|
||
void* p = (void*)GetProcAddress(qqnt, hooks[i].name);
|
||
if (!p) { logLine("%lu\tMISS\t%s", GetCurrentProcessId(), hooks[i].tag); continue; }
|
||
if (MH_CreateHook(p, hooks[i].det, hooks[i].orig) == MH_OK) ok++;
|
||
else logLine("%lu\tHOOKFAIL\t%s", GetCurrentProcessId(), hooks[i].tag);
|
||
}
|
||
if (!ok) { logLine("-1\tERR\tno hook installed"); return 1; }
|
||
|
||
MH_EnableHook(MH_ALL_HOOKS);
|
||
logLine("%lu\tREADY\thooks=%d dump=%d patch=%d off=%d arg=%d sret=%d",
|
||
GetCurrentProcessId(), ok, g_on, havePatch, g_off, g_arg, g_sret);
|
||
return 0;
|
||
}
|
||
|
||
BOOL WINAPI DllMain(HMODULE module, DWORD reason, LPVOID reserved) {
|
||
(void)reserved;
|
||
if (reason == DLL_PROCESS_ATTACH) {
|
||
g_self = module;
|
||
DisableThreadLibraryCalls(module);
|
||
HANDLE th = CreateThread(NULL, 0, initThread, NULL, 0, NULL);
|
||
if (th) CloseHandle(th);
|
||
HANDLE th2 = CreateThread(NULL, 0, probeThread, NULL, 0, NULL);
|
||
if (th2) CloseHandle(th2);
|
||
}
|
||
return TRUE;
|
||
}
|