Habro este hilo con el fin de compartir y aprender mas sobre los codes del Ar2, para la busqueda y comprension de esos codigos que nos resuelven las dificultades en los diferentes games.
Me gustaria saber si hay gente que ya dispone de información o sabe algo respecto a este tema.
A nadie le ha interesado buscarse sus propios cheats?.
Pues con un desdensamblador (idapro o ps2dis) y el conocimiento del sistema de encriptacionde los codes del ar2 esta hecho.
Los codigos que se introducen en el ar2, estan encriptados byte a byte segun unas formulas sencillas, que luego se reflejan al final en una tabla (las formulas tan aplicadas).
De este testo que he encontrado y mi amigo USB me ha traducido del Japo, no entiendo bastante, y agradeceria que alguien que sepa nos orientara un poco mas.
Incluso alguien podia traducirlo, aunque sea esquematicamente para comprender todos los modos en ke opera el ar2.
Esto puede valer incluso para los rips, imaginemos que hemos hecho el rip del jack & daxter y no funciona y nos damos cuenta de ke nos ha faltado un dvd check, pues conociendo esto, podriamos con el ar2 y ese mismo rip que no funciona , meterle el nuevo dvdcheck a traves de codes y asi verificar que era eso lo que nos faltaba; porque sino tendriamos que quemar otro cd, jeje
Bueno os dejo el documento
[ PS2PAR analytical room ]
--------------------------------------------------------------------------------
Recently, the PS2PAR was stocked, is good, but explanation of the cord/code which
is always written on the manual being recorded, viewing. Furthermore what the
cord/code there is no, * * certain feeling well being encoded, the ??
* * With you analyze with the notion that where you say. The material the PS2PAR
Ver1.3, 1.6 (+ trial version), used the 1.6j. Still, when it is opaque, densely it
is, but the place where you understand is written and others and others. On
occasion renewal.
--------------------------------------------------------------------------------
* Encoding arithmetic expression *
--------------------------------------------------------------------------------
One cord/code is formed usually 4 byte x of address section + data division 2,
with, but these are encoded at 1 byte unit.
When the original cord/code the a0a1a2a3 d0d1d2d3, the encoding
cord/code is designated as the A0A1A2A3 D0D1D2D3,
A0 = (the a0 XOR $A6) - $6a
A1 = (the a1 XOR $96) - $FF
A2 = (the a2 XOR $01) - $7e
A3 = (the a3 XOR $82) - $5A
D0 = (the d0 XOR $D9) - $C5
D1 = (the d1 XOR $3b) - $E5
D2 = (the d2 XOR $1b) - $34
D3 = (the d3 XOR $CC) - $27.
It calculates the proper decoding time conversely.
As for list of each numerical value description below.
--------------------------------------------------------------------------------
* PAR cord/code functional chart *
--------------------------------------------------------------------------------
Below at the almost looking disasemble list of the PS2PAR, being something which
it presumes, verification circumstance quite is sweet, is. When there is the
mistake, we ask indication.
Numerical value before being encoded, has recorded those of state. Many of the
place where it becomes with 0 in the meaningless part, are thought really it is
good regardless.
- Simple entry
0aaaaaaa 000000dd
1aaaaaaa 0000dddd
2aaaaaaa dddddddd
The data which in the address which is shown with A shows with the D is written.
It is entry at the respective byte/halfword/word unit from above.
In case of the halfword in case of the subordinate 1 bit and the word of address,
the same 2 bits standing, become 0. This specification the cord/code below is
similar.
- Identical data continual entry to multiaddresses (1)
3000nnnn dddddddd aaaaaaaa× (n-1)
(N-1) Collecting the data which in the address group which shows with A of the
time shows with the D, you write. As for unit word.
* When is just the ? ?, it is good, it is is, but regarding also the D itself
address, because one time in addition to excessively you have written, furthermore
it does not designate the subordinate 2bit as 0, perhaps only multiple value of 4
you can write.
* With the Ver1.3/1.6 as for the following cord/code of this cord/code you
recognize as 4 cords/codes regardless of the first numerical value.
- Value addition and subtraction of designated address
[ * Ver.1.3/1.6 ]
300100nn aaaaaaaa
3002nnnn aaaaaaaa
30030000 aaaaaaaa nnnnnnnn 00000000
Subtraction it continues to be worthy of N in the data inside the address which is
shown with A.
* As for the following cord/code of this cord/code you recognize as 4 cords/codes
regardless of the first numerical value.
[ * After the Ver.1.6j ]
301000nn aaaaaaaa
302000nn aaaaaaaa
3030nnnn aaaaaaaa
3040nnnn aaaaaaaa
30500000 aaaaaaaa nnnnnnnn 00000000
30600000 aaaaaaaa nnnnnnnn 00000000
In the data inside the address which is shown with A the value of N, if 3rd letter
odd number if addition and even number subtraction it continues to do.
As for the unit of addition and subtraction value there are 3 kinds, but the unit
of the object data is word fixing.
- Identical data continual entry to multiaddresses (2)
4aaaaaaa xxxxyyyy Dddddddd 00000000
While from the address which is shown with A, the frequency amount which is shown
with the X, adding the numerical value x 4 which is shown with the Y to address,
you write the data which shows with the D with continuation. As for unit word.
* With the Ver1.3 the cord/code being most numerous the after the this, (frequency
-2) above it is necessary to exist, furthermore it is most numerous from end and
(frequency -2) the cord/code stops doing functioning up to. As for details
description below.
- Byte copy [ * after the ver1.6 ]
5Aaaaaaa nnnnnnnn bbbbbbbb 00000000
The N byte amount data is copied to the address which from the address which is
shown with A is shown with B.
- Simple entry (one time)
Aaaaaaaa dddddddd
The data which in the address which is shown with A shows with the D just 1 time
is written at the word unit.
But almost you can use for only BOOT program rewriting use, the master cord/code
is not needed only this cord/code.
- Time to wait
B0000000 nnnnnnnn
After time of the count amount which is shown with N elapsing, the after cord/code
is executed.
- Master comparison
Caaaaaaa dddddddd
Until it matches the value which the data inside the address which is shown with A
shows with the D after waiting, it executes the after cord/code. As for unit word.
- Conditional comparison (1)
Daaaaaaa 0000dddd
Daaaaaaa 0010dddd
Daaaaaaa 0020dddd
Daaaaaaa 0030dddd
The data of the address which is shown with A and the data which shows with the D
are compared, when it coincides to condition only, the following cord/code is
executed. As for unit halfword.
Condition respectively, =, XXNE, D XXGE (A) and (A) is XXGE D from above.
- Conditional comparison (2)
Eaaaaaaa 0nnndddd
Eaaaaaaa 1nnndddd
Eaaaaaaa 2nnndddd
Eaaaaaaa 3nnndddd
(1) With it is similar, but when it does not agree, below, cord/code groups of a
quantity which is shown with N are skipped at a stroke.
- Master cord/code
Faaaaaaa bbbbbbbb
8aaaaaaa bbbbbbbb cccccccc 00000000 [ * after the ver1.6 ]
It is the cord/code which is necessary in order from inside the game to make the
cheat effective.
When carat has announced the cord/code, if you use that, it is good meaning, but
when it is not, being personally owned, it is necessary to draw up. As for details
description below.
The address which is shown with A is in the hook position in order to make the
cheat effective, but in case of 8 cords/codes, of, the comparison whether or not
correct value has entered in hook position due to the address value subordinate
2bit of A, is done.
Subordinate position 2bit=0.... It compares
If subordinate position 2bit=1... it is the value which the data of the address
which is shown with the.a shows with C, the hook
Subordinate position 2bit=2.... It compares
If subordinate position 2bit=3... it is not the value which the data of the
address which is shown with the.a shows with C, the hook
* As for actual address value as for the subordinate 2bit it becomes 0.
Other things and cord/code first numerical value = concerning 6, 7 and 9 at
present it seems the undefined way.
--------------------------------------------------------------------------------
* Master cord/code details *
--------------------------------------------------------------------------------
Faaaaaaa bbbbbbbb
The PAR after the BOOT program reading, retains the program cord/code of 2 words
from the position of A, subroutine call (the jal) with imbeds the nop cord/code.
If (next the A cord/code exists, it processes here)
With the subroutine which is called from there, it depends (on the value of B such
as setting of the interruption in order to make the cheat really effective, -
description below), and the original cord/code of the position of A it retains is
executed.
When address is decided with own power, it assembles the BOOTFILE conversely,
chases from execution start address for a while, when you aim for the suitable jal
cord/code and the like when it is thought initialization related to interruption
has ended, it is good, probably will be. As an aim at least the first ei (the
$42000038) from the cord/code it is afterwards.
After a certain initializing, if before the part where we would like to make the
cheat be effective it is good expectation with anytime, but you must avoid the
place where 2 times or more it is executed. In addition, in regard to
circumstances of the processing, hook naturally, it does not appoint on the delay
slot, does not have to include branch order.
The numerical value which is shown with B is divided, with pattern of the hook for
the cheat, with the value of the subordinate 2bit when.
Subordinate position 2bit=0.... Type (1), argument ×4 to syscall$20, $22, $2b use
/ b=syscall$20, $2b / only verification
Subordinate position 2bit=1.... Type (2), argument ×4 to syscall$20, $22, $2b use
/ b=syscall$20, $2b
Subordinate position 2bit=2.... Type (3), argument ×4 to syscall$10, $14 use /
b=syscall$10
Subordinate position 2bit=3.... Type (4), hook position for syscall unused /
b=cheat
* When after dividing divergence the subordinate 2bit is handled as 0.
Concerning this B, when you look at the cord/code which presently carat has
published, it seems that divides into 3 patterns below.
1) Type (2) with argument $7f (with ×4 + 1 with $c01fd= encoding $c1456e60a)
2) Type (3) with argument $03 (with ×4 + 2 with $000E= encoding $c1456e79b)
3) Type (4) - when perhaps, type (2) with (3), you can use neither, is, you are
thought
Type (2) with (3) type and the type which utilize the Thread, and the Intc
interruption (4) while programming the jal cord/code is buried in the position
where it is executed periodically and densely it is ? type.
First type (2) and (3) trying trying, when it does not go well, you think type (4)
it becomes the shape which you use. At that time as for the target address which
the hook is done, you can think the pattern which aims for inside the subroutine
which is thought with the jal it is called in the bean, and inside interrupt
routine.
Type (1) concerning (2) with it is the same system, but the flash it points to the
picture in place of cheat processing. When this is used, the verification whether
or not type (2) you can use of, is possible.
When 0 master cord/code compilation practice examples 1 / "
the ?????? " is, it assembles the SCPS_110.12 of the
BOOTFILE conversely, when it chases from the start address $100008,
the ei in the $100094 existence. After that it is flying to the
$100130 address. When you look at the cord/code from the $100130,
because immediately the jal cord/code is two under, the second (the
$100140) aims are acquired. Type (1) with you verify first in trial.
As for the cord/code when the F0100140 000001FC, it encodes, the
EC878268 1456e609. Inputting this, when it starts, the picture
framework in the game the flash. Simply success. When type (2) it
modifies, the master cord/code becomes the EC878268 1456E60A.
When 0 master cord/code compilation practice examples 2 / " three ?
will 7 " is, the same when you chase from the $100008 of the sea
urchin BOOTFILE, existence, after that it is flying the ei to the
$1e2790 in the $100088. When you look at the cord/code from the
$1e2790, because the jal cord/code has been connected under, here you
try acquiring the third (the $1e27bc) aim. First type (1) with you
verify. It inputs the F01E27BC 000001FC = EC89A8E4 1456e609.
Immediately after the starting the flash having done well, address
itself seems like the OK, but when the game is started, the flash
stops. Because with this it is not good, the next type (3) thinks of
the step which is used. Type (1), the flash actualizes writing the
$c00ff0000 and the $c00ffffff on the address $120000E0 alternately.
When it changes this address, because it seems that color of the
background changes, making use of the subtraction cord/code, when
(before the Ver1.6) 30010001 120000E0 -> encoding -> the 2c988329
0656e705 (after the Ver1.6j) 30200001 120000E0 -> encoding -> the
master cord/code which would like to try trying the 2CB78329 0656e705
and it inputs together, type (3) and (4) with it is useful to check.
By the way, because it is the address which exceeds the $10000000,
here it cannot utilize 0, 1 and 2 cords/codes. Type (3) the master
cord/code, inputting the F01E27BC 0000000E = EC89A8E4 1456E79B and the
above-mentioned flash cord/code, it starts. This time in the game the
background blinks. It seems that is said well. With the master
cord/code becomes the EC89A8E4 1456E79B with the notion that where you
say.
Reference / PS2 syscall excerpt syscall $10.. AddIntC$handler
(argument: A1 = it interrupts, processing start address) the syscall
$14.. the _EnableIntc syscall $20.. the CreateThread (argument: 4
(sp) = thread start address) syscall $22.. StartThread syscall $2b..
RotateThreadReadyQueue
--------------------------------------------------------------------------------
* Ver. The difference due to the difference *
--------------------------------------------------------------------------------
Those where this time you investigated are three versions.
A) Ver.1.3 (2001/02/21, VER 1.3)
B) trial version (2001/06/11, VER 1.7) - Ver.1.6 suitable
C) Ver.1.6j (2001/08/10, VER 1.9 (KARAT 1.6))
The inside of the parenthesis respectively is the VER indication which is written
on the date and the CD reverse side inside perimeter of the SLPS_200.06.
With Version A, being not to be defined you cannot use 5 / 8 cords/codes.
In addition, when one data operation is designated as 1 action, there is a harmful
influence that only action equal to amount of the number of lines of the cord/code
does.
As for the number of actions the F cord/code (the master cord/code) the frequency
amount which is written, the other things it counts 0, 4 and 3000 cords/codes as
1. In addition, as for 3003 cords/codes the number of actions becomes with 1
vis-a-vis line several 2.
For example with FFX,
* Consumption from on item 4×8=32 amount in 99 fixing
40311B3C 00080001
63636363 00000000
With encoding the cord/code which is said,
7CA89C64 144EE7A6
5BF6E487 00000000 <- As for end being to be meaningless with 0 good
We assume it inputted.
As for the cord/code which is used for these other things temporarily when just
the master cord/code does, with, the number of actions becomes with 8 the several
of cord/code lines 3 (2 lines of the master cord/code 1 line + 4 cords/codes)
vis-a-vis, 3 actions, the 4×3=12 the effect appears to only amount call by result.
In addition, when the other cord/code exists after this cord/code, functioning of
4 times or more in the change which is done, last maximum of 5 cords/codes stop
doing functioning. This is evaded, lastly 5 lines of the cord/code, the
meaningless cord/code (6, 7 and 9 cords/codes and the like) and the like it is
necessary to input.
As for Version B and C, treatment of 3 cords/codes differs. With C there are 7
types of 3000 - 3060, but before of the B is 4 kinds 3000 - 3003, furthermore as
for the following cord/code of 3 cords/codes there is a harmful influence which
becomes 4 cords/codes regardless of the first numerical value.
--------------------------------------------------------------------------------
* Header format of execute form file *
--------------------------------------------------------------------------------
This the PS2PAR directly there is no relationship, but unless this is known,
because it becomes also that, assembles start address does not understand
conversely even, it records next. However, is only the information which is
necessary for the disasemble.
When +$00 the $7f, " the ELF " (the
Executable and Linkable Format) +$18 execution start address +$38
binary data start offset address +$3c the address which is read +$44
the number of bytes which are read * below and there is the block of
two or more, +$58 binary data start offset address (2) +$5c the
address which is read (2) +$64 the number of bytes which are read (2)
below with +$20 similar
--------------------------------------------------------------------------------
* For analysis reference link *
--------------------------------------------------------------------------------
PS2DEV by the PSX-ANARCHISTS!
The DISR5900 and the source and the other GNU GC$$C/binutils et cetera are put.
The DISR5900 is the basic R5900 disassembler for the DOS.
The PS2 execute form file is assembled conversely with this, above-mentioned
header knowledge is necessary.
Page PS2 Linux related to hanimar
The PS2DIS and other useful information are various.
The PS2DIS is the disassembler & for execute form binary of PS1 2 for the windows.
It does with those as in ps2 corresponding edition of the Psdis, but the various
functions which are convenient to analysis are added. The male be completed.
? ? ax ? obtaining ?
There is a PS2 Disassembler, and the PS2PAR numerical conversion program.
The PS2 Disassembler seems like those which administer the correspondence to ELF
header analysis and vu/cop special order in the DISR5900.
It is the for DOS, but the drug just doing the bootfile being to make the source,
easily is.
KVaks Home Page
Syscalls list and the like. However it is also other ps2 disassembler ?, as for
this the for ATDOS?
Google INST_0.LZH searching result
Dangerously the ? - being to be, the indirect link ^^; PDF manual of ps2linux
attachment. The stripe it does the I in capital letter, the ? -.
Concerning the specification of R5900 and PS2 study is possible.
P S E X E
They are the tools for the PS1, but as for binary for the R3000 because you can
use almost that way even with the R5900,
The EasyAsmR3000 it is convenient to to do little remodelling even with the PS2.
--------------------------------------------------------------------------------
* Encoding numerical list *
--------------------------------------------------------------------------------
----------------------------
## A0 A1 A2 A3 D0 D1 D2 D3
----------------------------
00 3C 97 83 28 14 56 E7 A5
01 3D 98 82 29 13 55 E6 A6
02 3A 95 85 26 16 54 E5 A7
03 3B 96 84 27 15 53 E4 A8
04 38 93 87 2C 18 5A EB A1
05 39 94 86 2D 17 59 EA A2
06 36 91 89 2A 1A 58 E9 A3
07 37 92 88 2B 19 57 E8 A4
08 44 9F 8B 30 0C 4E DF 9D
09 45 A0 8A 31 0B 4D DE 9E
0A 42 9D 8D 2E 0E 4C DD 9F
0B 43 9E 8C 2F 0D 4B DC A0
0C 40 9B 8F 34 10 52 E3 99
0D 41 9C 8E 35 0F 51 E2 9A
0E 3E 99 91 32 12 50 E1 9B
0F 3F 9A 90 33 11 4F E0 9C
10 4C 87 93 38 04 46 D7 B5
11 4D 88 92 39 03 45 D6 B6
12 4A 85 95 36 06 44 D5 B7
13 4B 86 94 37 05 43 D4 B8
14 48 83 97 3C 08 4A DB B1
15 49 84 96 3D 07 49 DA B2
16 46 81 99 3A 0A 48 D9 B3
17 47 82 98 3B 09 47 D8 B4
18 54 8F 9B 40 FC 3E CF AD
19 55 90 9A 41 FB 3D CE AE
1A 52 8D 9D 3E FE 3C CD AF
1B 53 8E 9C 3F FD 3B CC B0
1C 50 8B 9F 44 00 42 D3 A9
1D 51 8C 9E 45 FF 41 D2 AA
1E 4E 89 A1 42 02 40 D1 AB
1F 4F 8A A0 43 01 3F D0 AC
20 1C B7 A3 48 34 36 07 C5
21 1D B8 A2 49 33 35 06 C6
22 1A B5 A5 46 36 34 05 C7
23 1B B6 A4 47 35 33 04 C8
24 18 B3 A7 4C 38 3A 0B C1
25 19 B4 A6 4D 37 39 0A C2
26 16 B1 A9 4A 3A 38 09 C3
27 17 B2 A8 4B 39 37 08 C4
28 24 BF AB 50 2C 2E FF BD
29 25 C0 AA 51 2B 2D FE BE
2A 22 BD AD 4E 2E 2C FD BF
2B 23 BE AC 4F 2D 2B FC C0
2C 20 BB AF 54 30 32 03 B9
2D 21 BC AE 55 2F 31 02 BA
2E 1E B9 B1 52 32 30 01 BB
2F 1F BA B0 53 31 2F 00 BC
30 2C A7 B3 58 24 26 F7 D5
31 2D A8 B2 59 23 25 F6 D6
32 2A A5 B5 56 26 24 F5 D7
33 2B A6 B4 57 25 23 F4 D8
34 28 A3 B7 5C 28 2A FB D1
35 29 A4 B6 5D 27 29 FA D2
36 26 A1 B9 5A 2A 28 F9 D3
37 27 A2 B8 5B 29 27 F8 D4
38 34 AF BB 60 1C 1E EF CD
39 35 B0 BA 61 1B 1D EE CE
3A 32 AD BD 5E 1E 1C ED CF
3B 33 AE BC 5F 1D 1B EC D0
3C 30 AB BF 64 20 22 F3 C9
3D 31 AC BE 65 1F 21 F2 CA
3E 2E A9 C1 62 22 20 F1 CB
3F 2F AA C0 63 21 1F F0 CC
40 7C D7 C3 68 D4 96 27 65
41 7D D8 C2 69 D3 95 26 66
42 7A D5 C5 66 D6 94 25 67
43 7B D6 C4 67 D5 93 24 68
44 78 D3 C7 6C D8 9A 2B 61
45 79 D4 C6 6D D7 99 2A 62
46 76 D1 C9 6A DA 98 29 63
47 77 D2 C8 6B D9 97 28 64
48 84 DF CB 70 CC 8E 1F 5D
49 85 E0 CA 71 CB 8D 1E 5E
4A 82 DD CD 6E CE 8C 1D 5F
4B 83 DE CC 6F CD 8B 1C 60
4C 80 DB CF 74 D0 92 23 59
4D 81 DC CE 75 CF 91 22 5A
4E 7E D9 D1 72 D2 90 21 5B
4F 7F DA D0 73 D1 8F 20 5C
50 8C C7 D3 78 C4 86 17 75
51 8D C8 D2 79 C3 85 16 76
52 8A C5 D5 76 C6 84 15 77
53 8B C6 D4 77 C5 83 14 78
54 88 C3 D7 7C C8 8A 1B 71
55 89 C4 D6 7D C7 89 1A 72
56 86 C1 D9 7A CA 88 19 73
57 87 C2 D8 7B C9 87 18 74
58 94 CF DB 80 BC 7E 0F 6D
59 95 D0 DA 81 BB 7D 0E 6E
5A 92 CD DD 7E BE 7C 0D 6F
5B 93 CE DC 7F BD 7B 0C 70
5C 90 CB DF 84 C0 82 13 69
5D 91 CC DE 85 BF 81 12 6A
5E 8E C9 E1 82 C2 80 11 6B
5F 8F CA E0 83 C1 7F 10 6C
60 5C F7 E3 88 F4 76 47 85
61 5D F8 E2 89 F3 75 46 86
62 5A F5 E5 86 F6 74 45 87
63 5B F6 E4 87 F5 73 44 88
64 58 F3 E7 8C F8 7A 4B 81
65 59 F4 E6 8D F7 79 4A 82
66 56 F1 E9 8A FA 78 49 83
67 57 F2 E8 8B F9 77 48 84
68 64 FF EB 90 EC 6E 3F 7D
69 65 00 EA 91 EB 6D 3E 7E
6A 62 FD ED 8E EE 6C 3D 7F
6B 63 FE EC 8F ED 6B 3C 80
6C 60 FB EF 94 F0 72 43 79
6D 61 FC EE 95 EF 71 42 7A
6E 5E F9 F1 92 F2 70 41 7B
6F 5F FA F0 93 F1 6F 40 7C
70 6C E7 F3 98 E4 66 37 95
71 6D E8 F2 99 E3 65 36 96
72 6A E5 F5 96 E6 64 35 97
73 6B E6 F4 97 E5 63 34 98
74 68 E3 F7 9C E8 6A 3B 91
75 69 E4 F6 9D E7 69 3A 92
76 66 E1 F9 9A EA 68 39 93
77 67 E2 F8 9B E9 67 38 94
78 74 EF FB A0 DC 5E 2F 8D
79 75 F0 FA A1 DB 5D 2E 8E
7A 72 ED FD 9E DE 5C 2D 8F
7B 73 EE FC 9F DD 5B 2C 90
7C 70 EB FF A4 E0 62 33 89
7D 71 EC FE A5 DF 61 32 8A
7E 6E E9 01 A2 E2 60 31 8B
7F 6F EA 00 A3 E1 5F 30 8C
80 BC 17 03 A8 94 D6 67 25
81 BD 18 02 A9 93 D5 66 26
82 BA 15 05 A6 96 D4 65 27
83 BB 16 04 A7 95 D3 64 28
84 B8 13 07 AC 98 DA 6B 21
85 B9 14 06 AD 97 D9 6A 22
86 B6 11 09 AA 9A D8 69 23
87 B7 12 08 AB 99 D7 68 24
88 C4 1F 0B B0 8C CE 5F 1D
89 C5 20 0A B1 8B CD 5E 1E
8A C2 1D 0D AE 8E CC 5D 1F
8B C3 1E 0C AF 8D CB 5C 20
8C C0 1B 0F B4 90 D2 63 19
8D C1 1C 0E B5 8F D1 62 1A
8E BE 19 11 B2 92 D0 61 1B
8F BF 1A 10 B3 91 CF 60 1C
90 CC 07 13 B8 84 C6 57 35
91 CD 08 12 B9 83 C5 56 36
92 CA 05 15 B6 86 C4 55 37
93 CB 06 14 B7 85 C3 54 38
94 C8 03 17 BC 88 CA 5B 31
95 C9 04 16 BD 87 C9 5A 32
96 C6 01 19 BA 8A C8 59 33
97 C7 02 18 BB 89 C7 58 34
98 D4 0F 1B C0 7C BE 4F 2D
99 D5 10 1A C1 7B BD 4E 2E
9A D2 0D 1D BE 7E BC 4D 2F
9B D3 0E 1C BF 7D BB 4C 30
9C D0 0B 1F C4 80 C2 53 29
9D D1 0C 1E C5 7F C1 52 2A
9E CE 09 21 C2 82 C0 51 2B
9F CF 0A 20 C3 81 BF 50 2C
A0 9C 37 23 C8 B4 B6 87 45
A1 9D 38 22 C9 B3 B5 86 46
A2 9A 35 25 C6 B6 B4 85 47
A3 9B 36 24 C7 B5 B3 84 48
A4 98 33 27 CC B8 BA 8B 41
A5 99 34 26 CD B7 B9 8A 42
A6 96 31 29 CA BA B8 89 43
A7 97 32 28 CB B9 B7 88 44
A8 A4 3F 2B D0 AC AE 7F 3D
A9 A5 40 2A D1 AB AD 7E 3E
AA A2 3D 2D CE AE AC 7D 3F
AB A3 3E 2C CF AD AB 7C 40
AC A0 3B 2F D4 B0 B2 83 39
AD A1 3C 2E D5 AF B1 82 3A
AE 9E 39 31 D2 B2 B0 81 3B
AF 9F 3A 30 D3 B1 AF 80 3C
B0 AC 27 33 D8 A4 A6 77 55
B1 AD 28 32 D9 A3 A5 76 56
B2 AA 25 35 D6 A6 A4 75 57
B3 AB 26 34 D7 A5 A3 74 58
B4 A8 23 37 DC A8 AA 7B 51
B5 A9 24 36 DD A7 A9 7A 52
B6 A6 21 39 DA AA A8 79 53
B7 A7 22 38 DB A9 A7 78 54
B8 B4 2F 3B E0 9C 9E 6F 4D
B9 B5 30 3A E1 9B 9D 6E 4E
BA B2 2D 3D DE 9E 9C 6D 4F
BB B3 2E 3C DF 9D 9B 6C 50
BC B0 2B 3F E4 A0 A2 73 49
BD B1 2C 3E E5 9F A1 72 4A
BE AE 29 41 E2 A2 A0 71 4B
BF AF 2A 40 E3 A1 9F 70 4C
C0 FC 57 43 E8 54 16 A7 E5
C1 FD 58 42 E9 53 15 A6 E6
C2 FA 55 45 E6 56 14 A5 E7
C3 FB 56 44 E7 55 13 A4 E8
C4 F8 53 47 EC 58 1A AB E1
C5 F9 54 46 ED 57 19 AA E2
C6 F6 51 49 EA 5A 18 A9 E3
C7 F7 52 48 EB 59 17 A8 E4
C8 04 5F 4B F0 4C 0E 9F DD
C9 05 60 4A F1 4B 0D 9E DE
CA 02 5D 4D EE 4E 0C 9D DF
CB 03 5E 4C EF 4D 0B 9C E0
CC 00 5B 4F F4 50 12 A3 D9
CD 01 5C 4E F5 4F 11 A2 DA
CE FE 59 51 F2 52 10 A1 DB
CF FF 5A 50 F3 51 0F A0 DC
D0 0C 47 53 F8 44 06 97 F5
D1 0D 48 52 F9 43 05 96 F6
D2 0A 45 55 F6 46 04 95 F7
D3 0B 46 54 F7 45 03 94 F8
D4 08 43 57 FC 48 0A 9B F1
D5 09 44 56 FD 47 09 9A F2
D6 06 41 59 FA 4A 08 99 F3
D7 07 42 58 FB 49 07 98 F4
D8 14 4F 5B 00 3C FE 8F ED
D9 15 50 5A 01 3B FD 8E EE
DA 12 4D 5D FE 3E FC 8D EF
DB 13 4E 5C FF 3D FB 8C F0
DC 10 4B 5F 04 40 02 93 E9
DD 11 4C 5E 05 3F 01 92 EA
DE 0E 49 61 02 42 00 91 EB
DF 0F 4A 60 03 41 FF 90 EC
E0 DC 77 63 08 74 F6 C7 05
E1 DD 78 62 09 73 F5 C6 06
E2 DA 75 65 06 76 F4 C5 07
E3 DB 76 64 07 75 F3 C4 08
E4 D8 73 67 0C 78 FA CB 01
E5 D9 74 66 0D 77 F9 CA 02
E6 D6 71 69 0A 7A F8 C9 03
E7 D7 72 68 0B 79 F7 C8 04
E8 E4 7F 6B 10 6C EE BF FD
E9 E5 80 6A 11 6B ED BE FE
EA E2 7D 6D 0E 6E EC BD FF
EB E3 7E 6C 0F 6D EB BC 00
EC E0 7B 6F 14 70 F2 C3 F9
ED E1 7C 6E 15 6F F1 C2 FA
EE DE 79 71 12 72 F0 C1 FB
EF DF 7A 70 13 71 EF C0 FC
F0 EC 67 73 18 64 E6 B7 15
F1 ED 68 72 19 63 E5 B6 16
F2 EA 65 75 16 66 E4 B5 17
F3 EB 66 74 17 65 E3 B4 18
F4 E8 63 77 1C 68 EA BB 11
F5 E9 64 76 1D 67 E9 BA 12
F6 E6 61 79 1A 6A E8 B9 13
F7 E7 62 78 1B 69 E7 B8 14
F8 F4 6F 7B 20 5C DE AF 0D
F9 F5 70 7A 21 5B DD AE 0E
FA F2 6D 7D 1E 5E DC AD 0F
FB F3 6E 7C 1F 5D DB AC 10
FC F0 6B 7F 24 60 E2 B3 09
FD F1 6C 7E 25 5F E1 B2 0A
FE EE 69 81 22 62 E0 B1 0B
FF EF 6A 80 23 61 DF B0 0C
----------------------------
?????????????????????????
--------------------------------------------------------------------------------
???????????????????????????????????
--------------------------------------------------------------------------------
[??]
