MMS Exploit Part 3: Constructing the Memory Corruption Primitives

This post is the fourth of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.

/* latin */ @font-face { font-family: 'Consolas'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/l/font?kit=X7nm4bA-A_-9jbjWaza9xMk&skey=3d1eb1871fcc58a1&v=v20) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } @import url('https://themes.googleusercontent.com/fonts/css?kit=lhDjYqiy3mZ0x6ROQEUoUw'); .post-body{ol.lst-kix_m7n4vga7agj0-8.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-8 0}ol.lst-kix_s7qtkfn3qfov-6.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-6 0}.lst-kix_2atftb74ca0r-5>li{counter-increment:lst-ctn-kix_2atftb74ca0r-5}ol.lst-kix_lgfdoxi035fa-6.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-6 0}ol.lst-kix_v82n41p8858f-6.start{counter-reset:lst-ctn-kix_v82n41p8858f-6 0}.lst-kix_8ndrlnfdlj1m-4>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-4}ol.lst-kix_t794825wy5z-4.start{counter-reset:lst-ctn-kix_t794825wy5z-4 0}.lst-kix_t794825wy5z-5>li{counter-increment:lst-ctn-kix_t794825wy5z-5}ol.lst-kix_79xr8vp1jz9w-7.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-7 0}ol.lst-kix_8ndrlnfdlj1m-8{list-style-type:none}.lst-kix_dfignz4kto-6>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-6,decimal) ". "}ol.lst-kix_8ndrlnfdlj1m-7{list-style-type:none}.lst-kix_n34nhxg9gk9-8>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-8}ol.lst-kix_8ndrlnfdlj1m-6{list-style-type:none}.lst-kix_dfignz4kto-5>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-5,lower-roman) ". "}.lst-kix_dfignz4kto-7>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-7,lower-latin) ". "}ol.lst-kix_8ndrlnfdlj1m-5{list-style-type:none}ol.lst-kix_8ndrlnfdlj1m-4{list-style-type:none}ol.lst-kix_8ndrlnfdlj1m-3{list-style-type:none}ol.lst-kix_8ndrlnfdlj1m-2{list-style-type:none}.lst-kix_s7qtkfn3qfov-2>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-2}ol.lst-kix_8ndrlnfdlj1m-1{list-style-type:none}ol.lst-kix_8ndrlnfdlj1m-0{list-style-type:none}.lst-kix_dfignz4kto-8>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-8,lower-roman) ". "}ol.lst-kix_s2bakucqamn4-5{list-style-type:none}.lst-kix_97v7yur38q2r-3>li{counter-increment:lst-ctn-kix_97v7yur38q2r-3}ol.lst-kix_s2bakucqamn4-6{list-style-type:none}ol.lst-kix_s2bakucqamn4-3{list-style-type:none}ol.lst-kix_s2bakucqamn4-4{list-style-type:none}.lst-kix_2atftb74ca0r-3>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-3,decimal) ". "}ol.lst-kix_s2bakucqamn4-1{list-style-type:none}ol.lst-kix_s2bakucqamn4-2{list-style-type:none}ol.lst-kix_dfignz4kto-3.start{counter-reset:lst-ctn-kix_dfignz4kto-3 0}.lst-kix_2atftb74ca0r-2>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-2,lower-roman) ". "}ol.lst-kix_s2bakucqamn4-0{list-style-type:none}.lst-kix_2atftb74ca0r-1>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-1,lower-latin) ". "}.lst-kix_2atftb74ca0r-0>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-0,decimal) ". "}ol.lst-kix_s2bakucqamn4-7{list-style-type:none}.lst-kix_s2bakucqamn4-8>li{counter-increment:lst-ctn-kix_s2bakucqamn4-8}.lst-kix_m7n4vga7agj0-1>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-1}ol.lst-kix_41dur2ixsyfx-3.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-3 0}ol.lst-kix_s2bakucqamn4-8{list-style-type:none}ol.lst-kix_n34nhxg9gk9-6.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-6 0}.lst-kix_s8u2k5vztyaw-4>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-4}ol.lst-kix_8ndrlnfdlj1m-6.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-6 0}.lst-kix_41dur2ixsyfx-6>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-6}ol.lst-kix_v82n41p8858f-1.start{counter-reset:lst-ctn-kix_v82n41p8858f-1 0}.lst-kix_dfignz4kto-1>li{counter-increment:lst-ctn-kix_dfignz4kto-1}.lst-kix_mz7gq3g0njgs-6>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-6}ol.lst-kix_2atftb74ca0r-7.start{counter-reset:lst-ctn-kix_2atftb74ca0r-7 0}ol.lst-kix_s8u2k5vztyaw-3.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-3 0}.lst-kix_s2bakucqamn4-1>li{counter-increment:lst-ctn-kix_s2bakucqamn4-1}ol.lst-kix_s7qtkfn3qfov-1.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-1 0}ol.lst-kix_lgfdoxi035fa-1.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-1 0}.lst-kix_yn1p6euud4dt-1>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-1}ol.lst-kix_mz7gq3g0njgs-4.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-4 0}.lst-kix_vcalqlf3fy1b-5>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-5}ol.lst-kix_m7n4vga7agj0-3.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-3 0}ol.lst-kix_2atftb74ca0r-0.start{counter-reset:lst-ctn-kix_2atftb74ca0r-0 0}.lst-kix_97v7yur38q2r-7>li{counter-increment:lst-ctn-kix_97v7yur38q2r-7}.lst-kix_v82n41p8858f-7>li{counter-increment:lst-ctn-kix_v82n41p8858f-7}.lst-kix_vcalqlf3fy1b-7>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-7,lower-latin) ". "}ol.lst-kix_yn1p6euud4dt-8{list-style-type:none}ol.lst-kix_yn1p6euud4dt-7{list-style-type:none}ol.lst-kix_yn1p6euud4dt-6{list-style-type:none}.lst-kix_lgfdoxi035fa-3>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-3}ol.lst-kix_yn1p6euud4dt-5{list-style-type:none}.lst-kix_vcalqlf3fy1b-8>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-8,lower-roman) ". "}ol.lst-kix_yn1p6euud4dt-4{list-style-type:none}.lst-kix_79xr8vp1jz9w-2>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-2}.lst-kix_lgfdoxi035fa-6>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-6}.lst-kix_8ndrlnfdlj1m-8>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-8}.lst-kix_yn1p6euud4dt-8>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-8}.lst-kix_s8u2k5vztyaw-8>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-8}ol.lst-kix_97v7yur38q2r-1.start{counter-reset:lst-ctn-kix_97v7yur38q2r-1 0}ol.lst-kix_97v7yur38q2r-8.start{counter-reset:lst-ctn-kix_97v7yur38q2r-8 0}ol.lst-kix_vcalqlf3fy1b-4.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-4 0}ol.lst-kix_s8u2k5vztyaw-8.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-8 0}.lst-kix_s2bakucqamn4-4>li{counter-increment:lst-ctn-kix_s2bakucqamn4-4}.lst-kix_t794825wy5z-1>li{counter-increment:lst-ctn-kix_t794825wy5z-1}ol.lst-kix_mz7gq3g0njgs-2.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-2 0}.lst-kix_m7n4vga7agj0-8>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-8}.lst-kix_yn1p6euud4dt-4>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-4}ol.lst-kix_s8u2k5vztyaw-1.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-1 0}.lst-kix_mz7gq3g0njgs-2>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-2}.lst-kix_vcalqlf3fy1b-2>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-2}ol.lst-kix_79xr8vp1jz9w-1{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-0{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-0.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-0 0}ol.lst-kix_dfignz4kto-1.start{counter-reset:lst-ctn-kix_dfignz4kto-1 0}ol.lst-kix_yn1p6euud4dt-6.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-6 0}ol.lst-kix_79xr8vp1jz9w-5{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-4{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-3{list-style-type:none}ol.lst-kix_8ndrlnfdlj1m-4.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-4 0}ol.lst-kix_79xr8vp1jz9w-2{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-8{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-7{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-6{list-style-type:none}.lst-kix_n34nhxg9gk9-1>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-1,lower-latin) ". "}ol.lst-kix_m7n4vga7agj0-1.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-1 0}ol.lst-kix_1xkddpu9nsxr-2.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-2 0}ol.lst-kix_yn1p6euud4dt-3{list-style-type:none}ol.lst-kix_yn1p6euud4dt-2{list-style-type:none}ol.lst-kix_yn1p6euud4dt-1{list-style-type:none}ol.lst-kix_yn1p6euud4dt-0{list-style-type:none}.lst-kix_97v7yur38q2r-0>li{counter-increment:lst-ctn-kix_97v7yur38q2r-0}.lst-kix_s7qtkfn3qfov-6>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-6}ol.lst-kix_lgfdoxi035fa-0{list-style-type:none}.lst-kix_vcalqlf3fy1b-2>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-2,lower-roman) ". "}.lst-kix_vcalqlf3fy1b-6>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-6,decimal) ". "}.lst-kix_n34nhxg9gk9-3>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-3,decimal) ". "}.lst-kix_n34nhxg9gk9-5>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-5,lower-roman) ". "}.lst-kix_vcalqlf3fy1b-4>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-4,lower-latin) ". "}.lst-kix_s8u2k5vztyaw-7>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-7}.lst-kix_n34nhxg9gk9-7>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-7,lower-latin) ". "}.lst-kix_1xkddpu9nsxr-6>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-6}.lst-kix_mz7gq3g0njgs-3>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-3}ol.lst-kix_s2bakucqamn4-6.start{counter-reset:lst-ctn-kix_s2bakucqamn4-6 0}ol.lst-kix_t794825wy5z-2.start{counter-reset:lst-ctn-kix_t794825wy5z-2 0}.lst-kix_vcalqlf3fy1b-0>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-0,decimal) ". "}.lst-kix_t794825wy5z-2>li{counter-increment:lst-ctn-kix_t794825wy5z-2}.lst-kix_t794825wy5z-8>li{counter-increment:lst-ctn-kix_t794825wy5z-8}ol.lst-kix_vcalqlf3fy1b-2.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-2 0}ol.lst-kix_79xr8vp1jz9w-2.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-2 0}.lst-kix_s8u2k5vztyaw-0>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-0}.lst-kix_lgfdoxi035fa-7>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-7}.lst-kix_dfignz4kto-5>li{counter-increment:lst-ctn-kix_dfignz4kto-5}.lst-kix_s7qtkfn3qfov-5>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-5}.lst-kix_2atftb74ca0r-1>li{counter-increment:lst-ctn-kix_2atftb74ca0r-1}.lst-kix_2atftb74ca0r-4>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-4,lower-latin) ". "}ol.lst-kix_s7qtkfn3qfov-4.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-4 0}ol.lst-kix_41dur2ixsyfx-8.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-8 0}.lst-kix_1xkddpu9nsxr-7>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-7}.lst-kix_2atftb74ca0r-6>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-6,decimal) ". "}.lst-kix_8ndrlnfdlj1m-6>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-6,decimal) ". "}ol.lst-kix_1xkddpu9nsxr-0.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-0 0}.lst-kix_dfignz4kto-2>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-2,lower-roman) ". "}ol.lst-kix_8ndrlnfdlj1m-1.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-1 0}.lst-kix_n34nhxg9gk9-1>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-1}ol.lst-kix_n34nhxg9gk9-8.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-8 0}.lst-kix_dfignz4kto-4>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-4,lower-latin) ". "}ol.lst-kix_yn1p6euud4dt-4.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-4 0}.lst-kix_2atftb74ca0r-8>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-8,lower-roman) ". "}.lst-kix_8ndrlnfdlj1m-0>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-0,decimal) ". "}.lst-kix_8ndrlnfdlj1m-8>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-8,lower-roman) ". "}ol.lst-kix_s7qtkfn3qfov-3.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-3 0}ol.lst-kix_s2bakucqamn4-8.start{counter-reset:lst-ctn-kix_s2bakucqamn4-8 0}.lst-kix_v82n41p8858f-0>li{counter-increment:lst-ctn-kix_v82n41p8858f-0}.lst-kix_41dur2ixsyfx-2>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-2}.lst-kix_8ndrlnfdlj1m-2>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-2,lower-roman) ". "}.lst-kix_m7n4vga7agj0-2>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-2}.lst-kix_8ndrlnfdlj1m-4>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-4,lower-latin) ". "}.lst-kix_dfignz4kto-0>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-0,decimal) ". "}ol.lst-kix_vcalqlf3fy1b-1{list-style-type:none}ol.lst-kix_vcalqlf3fy1b-2{list-style-type:none}.lst-kix_m7n4vga7agj0-4>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-4,lower-latin) ". "}ol.lst-kix_vcalqlf3fy1b-0{list-style-type:none}.lst-kix_m7n4vga7agj0-3>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-3,decimal) ". "}ol.lst-kix_79xr8vp1jz9w-4.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-4 0}.lst-kix_m7n4vga7agj0-7>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-7,lower-latin) ". "}ol.lst-kix_41dur2ixsyfx-3{list-style-type:none}.lst-kix_s8u2k5vztyaw-3>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-3}ol.lst-kix_41dur2ixsyfx-2{list-style-type:none}ol.lst-kix_41dur2ixsyfx-5{list-style-type:none}ol.lst-kix_41dur2ixsyfx-4{list-style-type:none}ol.lst-kix_41dur2ixsyfx-7{list-style-type:none}ol.lst-kix_41dur2ixsyfx-6{list-style-type:none}ol.lst-kix_41dur2ixsyfx-8{list-style-type:none}ol.lst-kix_s2bakucqamn4-4.start{counter-reset:lst-ctn-kix_s2bakucqamn4-4 0}.lst-kix_mz7gq3g0njgs-7>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-7}ol.lst-kix_mz7gq3g0njgs-6.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-6 0}ol.lst-kix_41dur2ixsyfx-6.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-6 0}ol.lst-kix_41dur2ixsyfx-1{list-style-type:none}ol.lst-kix_41dur2ixsyfx-0{list-style-type:none}.lst-kix_t794825wy5z-6>li{counter-increment:lst-ctn-kix_t794825wy5z-6}.lst-kix_s7qtkfn3qfov-6>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-6,decimal) ". "}ol.lst-kix_vcalqlf3fy1b-0.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-0 0}.lst-kix_m7n4vga7agj0-0>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-0,decimal) ". "}.lst-kix_lgfdoxi035fa-0>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-0}.lst-kix_97v7yur38q2r-6>li{counter-increment:lst-ctn-kix_97v7yur38q2r-6}ol.lst-kix_n34nhxg9gk9-0{list-style-type:none}.lst-kix_vcalqlf3fy1b-6>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-6}ol.lst-kix_n34nhxg9gk9-2{list-style-type:none}ol.lst-kix_n34nhxg9gk9-1{list-style-type:none}ol.lst-kix_n34nhxg9gk9-4{list-style-type:none}.lst-kix_s7qtkfn3qfov-3>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-3}ol.lst-kix_n34nhxg9gk9-3{list-style-type:none}ol.lst-kix_n34nhxg9gk9-6{list-style-type:none}ol.lst-kix_n34nhxg9gk9-5{list-style-type:none}ol.lst-kix_n34nhxg9gk9-8{list-style-type:none}ol.lst-kix_n34nhxg9gk9-7{list-style-type:none}.lst-kix_s2bakucqamn4-6>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-6,decimal) ". "}.lst-kix_m7n4vga7agj0-4>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-4}.lst-kix_79xr8vp1jz9w-6>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-6,decimal) ". "}.lst-kix_s2bakucqamn4-5>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-5,lower-roman) ". "}.lst-kix_41dur2ixsyfx-3>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-3}ol.lst-kix_n34nhxg9gk9-3.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-3 0}ol.lst-kix_m7n4vga7agj0-5.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-5 0}.lst-kix_s2bakucqamn4-0>li{counter-increment:lst-ctn-kix_s2bakucqamn4-0}.lst-kix_s2bakucqamn4-2>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-2,lower-roman) ". "}ol.lst-kix_s8u2k5vztyaw-0.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-0 0}.lst-kix_79xr8vp1jz9w-1>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-1}.lst-kix_79xr8vp1jz9w-3>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-3,decimal) ". "}.lst-kix_s8u2k5vztyaw-1>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-1}ol.lst-kix_41dur2ixsyfx-0.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-0 0}ol.lst-kix_8ndrlnfdlj1m-3.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-3 0}.lst-kix_79xr8vp1jz9w-2>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-2,lower-roman) ". "}.lst-kix_s2bakucqamn4-1>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-1,lower-latin) ". "}.lst-kix_1xkddpu9nsxr-0>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-0}.lst-kix_n34nhxg9gk9-0>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-0}.lst-kix_97v7yur38q2r-5>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-5,lower-roman) ". "}.lst-kix_41dur2ixsyfx-7>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-7}ol.lst-kix_n34nhxg9gk9-4.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-4 0}.lst-kix_v82n41p8858f-8>li{counter-increment:lst-ctn-kix_v82n41p8858f-8}.lst-kix_lgfdoxi035fa-2>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-2,lower-roman) ". "}.lst-kix_2atftb74ca0r-8>li{counter-increment:lst-ctn-kix_2atftb74ca0r-8}ol.lst-kix_yn1p6euud4dt-8.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-8 0}.lst-kix_97v7yur38q2r-4>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-4,lower-latin) ". "}ol.lst-kix_dfignz4kto-6.start{counter-reset:lst-ctn-kix_dfignz4kto-6 0}.lst-kix_n34nhxg9gk9-5>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-5}.lst-kix_m7n4vga7agj0-6>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-6}ol.lst-kix_m7n4vga7agj0-3{list-style-type:none}ol.lst-kix_m7n4vga7agj0-2{list-style-type:none}.lst-kix_79xr8vp1jz9w-7>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-7,lower-latin) ". "}ol.lst-kix_m7n4vga7agj0-1{list-style-type:none}ol.lst-kix_v82n41p8858f-8.start{counter-reset:lst-ctn-kix_v82n41p8858f-8 0}.lst-kix_t794825wy5z-1>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-1,lower-latin) ". "}ol.lst-kix_m7n4vga7agj0-0{list-style-type:none}ol.lst-kix_lgfdoxi035fa-2{list-style-type:none}ol.lst-kix_lgfdoxi035fa-1{list-style-type:none}ol.lst-kix_lgfdoxi035fa-4{list-style-type:none}.lst-kix_t794825wy5z-0>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-0,decimal) ". "}.lst-kix_dfignz4kto-6>li{counter-increment:lst-ctn-kix_dfignz4kto-6}ol.lst-kix_lgfdoxi035fa-3{list-style-type:none}.lst-kix_97v7yur38q2r-8>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-8,lower-roman) ". "}ol.lst-kix_lgfdoxi035fa-6{list-style-type:none}ol.lst-kix_79xr8vp1jz9w-5.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-5 0}ol.lst-kix_lgfdoxi035fa-5{list-style-type:none}ol.lst-kix_lgfdoxi035fa-8{list-style-type:none}.lst-kix_v82n41p8858f-1>li{counter-increment:lst-ctn-kix_v82n41p8858f-1}ol.lst-kix_lgfdoxi035fa-7{list-style-type:none}.lst-kix_s7qtkfn3qfov-2>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-2,lower-roman) ". "}.lst-kix_79xr8vp1jz9w-8>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-8}.lst-kix_s8u2k5vztyaw-5>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-5}.lst-kix_8ndrlnfdlj1m-5>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-5}.lst-kix_s7qtkfn3qfov-1>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-1,lower-latin) ". "}.lst-kix_s7qtkfn3qfov-5>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-5,lower-roman) ". "}ol.lst-kix_s2bakucqamn4-5.start{counter-reset:lst-ctn-kix_s2bakucqamn4-5 0}ol.lst-kix_dfignz4kto-5.start{counter-reset:lst-ctn-kix_dfignz4kto-5 0}ol.lst-kix_mz7gq3g0njgs-8{list-style-type:none}ol.lst-kix_m7n4vga7agj0-7{list-style-type:none}ol.lst-kix_mz7gq3g0njgs-7{list-style-type:none}ol.lst-kix_m7n4vga7agj0-6{list-style-type:none}ol.lst-kix_m7n4vga7agj0-5{list-style-type:none}ol.lst-kix_m7n4vga7agj0-4{list-style-type:none}ol.lst-kix_m7n4vga7agj0-4.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-4 0}ol.lst-kix_mz7gq3g0njgs-5.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-5 0}ol.lst-kix_m7n4vga7agj0-8{list-style-type:none}ol.lst-kix_mz7gq3g0njgs-0{list-style-type:none}ol.lst-kix_41dur2ixsyfx-5.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-5 0}ol.lst-kix_mz7gq3g0njgs-2{list-style-type:none}ol.lst-kix_mz7gq3g0njgs-1{list-style-type:none}.lst-kix_t794825wy5z-4>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-4,lower-latin) ". "}.lst-kix_lgfdoxi035fa-7>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-7,lower-latin) ". "}ol.lst-kix_mz7gq3g0njgs-4{list-style-type:none}.lst-kix_t794825wy5z-4>li{counter-increment:lst-ctn-kix_t794825wy5z-4}.lst-kix_vcalqlf3fy1b-8>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-8}ol.lst-kix_mz7gq3g0njgs-3{list-style-type:none}ol.lst-kix_mz7gq3g0njgs-6{list-style-type:none}ol.lst-kix_mz7gq3g0njgs-5{list-style-type:none}.lst-kix_t794825wy5z-5>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-5,lower-roman) ". "}.lst-kix_lgfdoxi035fa-6>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-6,decimal) ". "}.lst-kix_s7qtkfn3qfov-1>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-1}.lst-kix_s2bakucqamn4-7>li{counter-increment:lst-ctn-kix_s2bakucqamn4-7}.lst-kix_m7n4vga7agj0-8>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-8,lower-roman) ". "}ol.lst-kix_vcalqlf3fy1b-7{list-style-type:none}.lst-kix_t794825wy5z-8>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-8,lower-roman) ". "}ol.lst-kix_vcalqlf3fy1b-8{list-style-type:none}.lst-kix_lgfdoxi035fa-3>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-3,decimal) ". "}ol.lst-kix_vcalqlf3fy1b-5{list-style-type:none}ol.lst-kix_yn1p6euud4dt-7.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-7 0}.lst-kix_97v7yur38q2r-0>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-0,decimal) ". "}.lst-kix_97v7yur38q2r-1>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-1,lower-latin) ". "}ol.lst-kix_vcalqlf3fy1b-6{list-style-type:none}ol.lst-kix_vcalqlf3fy1b-3{list-style-type:none}ol.lst-kix_vcalqlf3fy1b-4{list-style-type:none}ol.lst-kix_41dur2ixsyfx-2.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-2 0}.lst-kix_n34nhxg9gk9-3>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-3}.lst-kix_41dur2ixsyfx-2>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-2,lower-roman) ". "}.lst-kix_s8u2k5vztyaw-2>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-2,lower-roman) ". "}ol.lst-kix_n34nhxg9gk9-2.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-2 0}.lst-kix_79xr8vp1jz9w-6>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-6}ol.lst-kix_2atftb74ca0r-5.start{counter-reset:lst-ctn-kix_2atftb74ca0r-5 0}.lst-kix_s8u2k5vztyaw-6>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-6,decimal) ". "}.lst-kix_dfignz4kto-8>li{counter-increment:lst-ctn-kix_dfignz4kto-8}.lst-kix_yn1p6euud4dt-1>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-1,lower-latin) ". "}.lst-kix_yn1p6euud4dt-5>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-5,lower-roman) ". "}ol.lst-kix_dfignz4kto-7.start{counter-reset:lst-ctn-kix_dfignz4kto-7 0}ol.lst-kix_s8u2k5vztyaw-4.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-4 0}ol.lst-kix_8ndrlnfdlj1m-7.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-7 0}.lst-kix_1xkddpu9nsxr-5>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-5}.lst-kix_41dur2ixsyfx-6>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-6,decimal) ". "}.lst-kix_vcalqlf3fy1b-3>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-3,decimal) ". "}.lst-kix_s2bakucqamn4-5>li{counter-increment:lst-ctn-kix_s2bakucqamn4-5}.lst-kix_n34nhxg9gk9-2>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-2,lower-roman) ". "}ol.lst-kix_79xr8vp1jz9w-8.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-8 0}ol.lst-kix_s8u2k5vztyaw-7.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-7 0}ol.lst-kix_s2bakucqamn4-0.start{counter-reset:lst-ctn-kix_s2bakucqamn4-0 0}.lst-kix_mz7gq3g0njgs-0>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-0}.lst-kix_41dur2ixsyfx-0>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-0}.lst-kix_8ndrlnfdlj1m-0>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-0}.lst-kix_s7qtkfn3qfov-8>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-8}.lst-kix_1xkddpu9nsxr-3>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-3}.lst-kix_vcalqlf3fy1b-1>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-1}.lst-kix_n34nhxg9gk9-6>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-6,decimal) ". "}ol.lst-kix_s2bakucqamn4-3.start{counter-reset:lst-ctn-kix_s2bakucqamn4-3 0}ol.lst-kix_mz7gq3g0njgs-7.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-7 0}ol.lst-kix_2atftb74ca0r-2.start{counter-reset:lst-ctn-kix_2atftb74ca0r-2 0}.lst-kix_lgfdoxi035fa-5>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-5}ol.lst-kix_s7qtkfn3qfov-8.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-8 0}.lst-kix_8ndrlnfdlj1m-7>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-7}.lst-kix_mz7gq3g0njgs-5>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-5}.lst-kix_mz7gq3g0njgs-1>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-1,lower-latin) ". "}ol.lst-kix_s8u2k5vztyaw-6.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-6 0}ol.lst-kix_n34nhxg9gk9-0.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-0 0}.lst-kix_97v7yur38q2r-8>li{counter-increment:lst-ctn-kix_97v7yur38q2r-8}ol.lst-kix_2atftb74ca0r-3.start{counter-reset:lst-ctn-kix_2atftb74ca0r-3 0}ol.lst-kix_m7n4vga7agj0-6.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-6 0}ol.lst-kix_41dur2ixsyfx-1.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-1 0}ol.lst-kix_s2bakucqamn4-2.start{counter-reset:lst-ctn-kix_s2bakucqamn4-2 0}.lst-kix_mz7gq3g0njgs-5>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-5,lower-roman) ". "}ol.lst-kix_8ndrlnfdlj1m-8.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-8 0}ol.lst-kix_s8u2k5vztyaw-8{list-style-type:none}.lst-kix_8ndrlnfdlj1m-5>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-5,lower-roman) ". "}.lst-kix_2atftb74ca0r-7>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-7,lower-latin) ". "}ol.lst-kix_s8u2k5vztyaw-6{list-style-type:none}ol.lst-kix_m7n4vga7agj0-7.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-7 0}ol.lst-kix_s8u2k5vztyaw-7{list-style-type:none}ol.lst-kix_s8u2k5vztyaw-4{list-style-type:none}ol.lst-kix_mz7gq3g0njgs-8.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-8 0}ol.lst-kix_s8u2k5vztyaw-5{list-style-type:none}ol.lst-kix_s8u2k5vztyaw-2{list-style-type:none}.lst-kix_41dur2ixsyfx-5>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-5}ol.lst-kix_s8u2k5vztyaw-3{list-style-type:none}ol.lst-kix_s8u2k5vztyaw-0{list-style-type:none}.lst-kix_dfignz4kto-3>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-3,decimal) ". "}.lst-kix_8ndrlnfdlj1m-1>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-1,lower-latin) ". "}ol.lst-kix_s8u2k5vztyaw-1{list-style-type:none}.lst-kix_yn1p6euud4dt-6>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-6}ol.lst-kix_2atftb74ca0r-4.start{counter-reset:lst-ctn-kix_2atftb74ca0r-4 0}ol.lst-kix_v82n41p8858f-0{list-style-type:none}ol.lst-kix_s2bakucqamn4-1.start{counter-reset:lst-ctn-kix_s2bakucqamn4-1 0}ol.lst-kix_s8u2k5vztyaw-5.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-5 0}.lst-kix_v82n41p8858f-3>li{counter-increment:lst-ctn-kix_v82n41p8858f-3}ol.lst-kix_v82n41p8858f-5{list-style-type:none}ol.lst-kix_dfignz4kto-8.start{counter-reset:lst-ctn-kix_dfignz4kto-8 0}ol.lst-kix_v82n41p8858f-6{list-style-type:none}ol.lst-kix_v82n41p8858f-7{list-style-type:none}ol.lst-kix_v82n41p8858f-8{list-style-type:none}ol.lst-kix_v82n41p8858f-1{list-style-type:none}ol.lst-kix_n34nhxg9gk9-1.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-1 0}ol.lst-kix_v82n41p8858f-2{list-style-type:none}ol.lst-kix_v82n41p8858f-3{list-style-type:none}ol.lst-kix_v82n41p8858f-4{list-style-type:none}.lst-kix_41dur2ixsyfx-4>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-4}.lst-kix_1xkddpu9nsxr-1>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-1,lower-latin) ". "}.lst-kix_mz7gq3g0njgs-8>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-8}.lst-kix_1xkddpu9nsxr-2>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-2,lower-roman) ". "}.lst-kix_vcalqlf3fy1b-7>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-7}.lst-kix_1xkddpu9nsxr-4>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-4,lower-latin) ". "}.lst-kix_1xkddpu9nsxr-3>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-3,decimal) ". "}.lst-kix_1xkddpu9nsxr-6>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-6,decimal) ". "}ol.lst-kix_s2bakucqamn4-7.start{counter-reset:lst-ctn-kix_s2bakucqamn4-7 0}.lst-kix_97v7yur38q2r-5>li{counter-increment:lst-ctn-kix_97v7yur38q2r-5}.lst-kix_1xkddpu9nsxr-5>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-5,lower-roman) ". "}ol.lst-kix_97v7yur38q2r-2.start{counter-reset:lst-ctn-kix_97v7yur38q2r-2 0}.lst-kix_m7n4vga7agj0-3>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-3}.lst-kix_1xkddpu9nsxr-8>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-8,lower-roman) ". "}.lst-kix_1xkddpu9nsxr-7>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-7,lower-latin) ". "}ol.lst-kix_m7n4vga7agj0-2.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-2 0}ol.lst-kix_mz7gq3g0njgs-3.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-3 0}ol.lst-kix_2atftb74ca0r-6.start{counter-reset:lst-ctn-kix_2atftb74ca0r-6 0}.lst-kix_mz7gq3g0njgs-7>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-7,lower-latin) ". "}.lst-kix_mz7gq3g0njgs-8>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-8,lower-roman) ". "}.lst-kix_s7qtkfn3qfov-0>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-0}ol.lst-kix_vcalqlf3fy1b-3.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-3 0}.lst-kix_2atftb74ca0r-3>li{counter-increment:lst-ctn-kix_2atftb74ca0r-3}ol.lst-kix_8ndrlnfdlj1m-0.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-0 0}ol.lst-kix_79xr8vp1jz9w-1.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-1 0}.lst-kix_1xkddpu9nsxr-0>li:before{content:"" counter(lst-ctn-kix_1xkddpu9nsxr-0,decimal) ". "}.lst-kix_8ndrlnfdlj1m-6>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-6}.lst-kix_lgfdoxi035fa-8>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-8}.lst-kix_v82n41p8858f-2>li{counter-increment:lst-ctn-kix_v82n41p8858f-2}.lst-kix_n34nhxg9gk9-6>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-6}.lst-kix_97v7yur38q2r-1>li{counter-increment:lst-ctn-kix_97v7yur38q2r-1}.lst-kix_mz7gq3g0njgs-4>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-4}ol.lst-kix_t794825wy5z-3.start{counter-reset:lst-ctn-kix_t794825wy5z-3 0}ol.lst-kix_41dur2ixsyfx-4.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-4 0}.lst-kix_v82n41p8858f-1>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-1,lower-latin) ". "}ol.lst-kix_97v7yur38q2r-7.start{counter-reset:lst-ctn-kix_97v7yur38q2r-7 0}.lst-kix_v82n41p8858f-0>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-0,decimal) ". "}.lst-kix_1xkddpu9nsxr-8>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-8}ol.lst-kix_s7qtkfn3qfov-0.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-0 0}ol.lst-kix_s8u2k5vztyaw-2.start{counter-reset:lst-ctn-kix_s8u2k5vztyaw-2 0}.lst-kix_s8u2k5vztyaw-2>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-2}ol.lst-kix_lgfdoxi035fa-7.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-7 0}ol.lst-kix_2atftb74ca0r-1.start{counter-reset:lst-ctn-kix_2atftb74ca0r-1 0}ol.lst-kix_1xkddpu9nsxr-2{list-style-type:none}.lst-kix_dfignz4kto-3>li{counter-increment:lst-ctn-kix_dfignz4kto-3}ol.lst-kix_1xkddpu9nsxr-3{list-style-type:none}ol.lst-kix_1xkddpu9nsxr-0{list-style-type:none}ol.lst-kix_1xkddpu9nsxr-1{list-style-type:none}ol.lst-kix_s7qtkfn3qfov-7.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-7 0}.lst-kix_v82n41p8858f-2>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-2,lower-roman) ". "}ol.lst-kix_1xkddpu9nsxr-6{list-style-type:none}.lst-kix_8ndrlnfdlj1m-2>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-2}ol.lst-kix_1xkddpu9nsxr-7{list-style-type:none}.lst-kix_yn1p6euud4dt-0>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-0,decimal) ". "}ol.lst-kix_1xkddpu9nsxr-4{list-style-type:none}ol.lst-kix_8ndrlnfdlj1m-5.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-5 0}ol.lst-kix_1xkddpu9nsxr-5{list-style-type:none}.lst-kix_v82n41p8858f-3>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-3,decimal) ". "}ol.lst-kix_79xr8vp1jz9w-6.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-6 0}ol.lst-kix_1xkddpu9nsxr-8{list-style-type:none}.lst-kix_v82n41p8858f-4>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-4,lower-latin) ". "}.lst-kix_t794825wy5z-7>li{counter-increment:lst-ctn-kix_t794825wy5z-7}.lst-kix_v82n41p8858f-5>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-5,lower-roman) ". "}.lst-kix_v82n41p8858f-8>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-8,lower-roman) ". "}.lst-kix_v82n41p8858f-6>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-6,decimal) ". "}.lst-kix_s7qtkfn3qfov-4>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-4}.lst-kix_v82n41p8858f-7>li:before{content:"" counter(lst-ctn-kix_v82n41p8858f-7,lower-latin) ". "}ol.lst-kix_lgfdoxi035fa-0.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-0 0}ol.lst-kix_yn1p6euud4dt-3.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-3 0}.lst-kix_v82n41p8858f-5>li{counter-increment:lst-ctn-kix_v82n41p8858f-5}.lst-kix_s7qtkfn3qfov-7>li{counter-increment:lst-ctn-kix_s7qtkfn3qfov-7}.lst-kix_41dur2ixsyfx-1>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-1,lower-latin) ". "}.lst-kix_41dur2ixsyfx-5>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-5,lower-roman) ". "}.lst-kix_s8u2k5vztyaw-1>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-1,lower-latin) ". "}.lst-kix_s8u2k5vztyaw-5>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-5,lower-roman) ". "}.lst-kix_yn1p6euud4dt-6>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-6,decimal) ". "}.lst-kix_yn1p6euud4dt-8>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-8,lower-roman) ". "}.lst-kix_41dur2ixsyfx-3>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-3,decimal) ". "}.lst-kix_s8u2k5vztyaw-7>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-7,lower-latin) ". "}.lst-kix_s2bakucqamn4-3>li{counter-increment:lst-ctn-kix_s2bakucqamn4-3}.lst-kix_yn1p6euud4dt-2>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-2,lower-roman) ". "}ol.lst-kix_2atftb74ca0r-0{list-style-type:none}ol.lst-kix_2atftb74ca0r-1{list-style-type:none}ol.lst-kix_2atftb74ca0r-2{list-style-type:none}.lst-kix_m7n4vga7agj0-7>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-7}ol.lst-kix_2atftb74ca0r-3{list-style-type:none}ol.lst-kix_2atftb74ca0r-4{list-style-type:none}ol.lst-kix_2atftb74ca0r-5{list-style-type:none}ol.lst-kix_2atftb74ca0r-6{list-style-type:none}.lst-kix_mz7gq3g0njgs-1>li{counter-increment:lst-ctn-kix_mz7gq3g0njgs-1}.lst-kix_n34nhxg9gk9-2>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-2}ol.lst-kix_2atftb74ca0r-7{list-style-type:none}ol.lst-kix_2atftb74ca0r-8{list-style-type:none}.lst-kix_yn1p6euud4dt-4>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-4,lower-latin) ". "}ol.lst-kix_n34nhxg9gk9-5.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-5 0}ol.lst-kix_dfignz4kto-4.start{counter-reset:lst-ctn-kix_dfignz4kto-4 0}.lst-kix_41dur2ixsyfx-7>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-7,lower-latin) ". "}ol.lst-kix_s7qtkfn3qfov-5.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-5 0}.lst-kix_s2bakucqamn4-2>li{counter-increment:lst-ctn-kix_s2bakucqamn4-2}ol.lst-kix_2atftb74ca0r-8.start{counter-reset:lst-ctn-kix_2atftb74ca0r-8 0}.lst-kix_2atftb74ca0r-0>li{counter-increment:lst-ctn-kix_2atftb74ca0r-0}ol.lst-kix_v82n41p8858f-7.start{counter-reset:lst-ctn-kix_v82n41p8858f-7 0}ol.lst-kix_s7qtkfn3qfov-2.start{counter-reset:lst-ctn-kix_s7qtkfn3qfov-2 0}.lst-kix_vcalqlf3fy1b-4>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-4}.lst-kix_79xr8vp1jz9w-4>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-4}.lst-kix_s8u2k5vztyaw-3>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-3,decimal) ". "}ol.lst-kix_8ndrlnfdlj1m-2.start{counter-reset:lst-ctn-kix_8ndrlnfdlj1m-2 0}ol.lst-kix_1xkddpu9nsxr-1.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-1 0}ol.lst-kix_dfignz4kto-2.start{counter-reset:lst-ctn-kix_dfignz4kto-2 0}.lst-kix_79xr8vp1jz9w-3>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-3}.lst-kix_mz7gq3g0njgs-0>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-0,decimal) ". "}ol.lst-kix_41dur2ixsyfx-7.start{counter-reset:lst-ctn-kix_41dur2ixsyfx-7 0}.lst-kix_s8u2k5vztyaw-6>li{counter-increment:lst-ctn-kix_s8u2k5vztyaw-6}ol.lst-kix_yn1p6euud4dt-5.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-5 0}ol.lst-kix_n34nhxg9gk9-7.start{counter-reset:lst-ctn-kix_n34nhxg9gk9-7 0}.lst-kix_mz7gq3g0njgs-2>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-2,lower-roman) ". "}.lst-kix_mz7gq3g0njgs-4>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-4,lower-latin) ". "}.lst-kix_t794825wy5z-3>li{counter-increment:lst-ctn-kix_t794825wy5z-3}.lst-kix_mz7gq3g0njgs-6>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-6,decimal) ". "}.lst-kix_2atftb74ca0r-7>li{counter-increment:lst-ctn-kix_2atftb74ca0r-7}ol.lst-kix_79xr8vp1jz9w-3.start{counter-reset:lst-ctn-kix_79xr8vp1jz9w-3 0}.lst-kix_1xkddpu9nsxr-1>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-1}.lst-kix_vcalqlf3fy1b-3>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-3}ol.lst-kix_v82n41p8858f-5.start{counter-reset:lst-ctn-kix_v82n41p8858f-5 0}.lst-kix_41dur2ixsyfx-8>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-8}ol.lst-kix_t794825wy5z-0.start{counter-reset:lst-ctn-kix_t794825wy5z-0 0}.lst-kix_yn1p6euud4dt-3>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-3}ol.lst-kix_m7n4vga7agj0-0.start{counter-reset:lst-ctn-kix_m7n4vga7agj0-0 0}.lst-kix_lgfdoxi035fa-1>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-1}.lst-kix_n34nhxg9gk9-7>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-7}.lst-kix_v82n41p8858f-6>li{counter-increment:lst-ctn-kix_v82n41p8858f-6}ol.lst-kix_vcalqlf3fy1b-1.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-1 0}.lst-kix_m7n4vga7agj0-5>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-5,lower-roman) ". "}ol.lst-kix_dfignz4kto-0{list-style-type:none}ol.lst-kix_97v7yur38q2r-5.start{counter-reset:lst-ctn-kix_97v7yur38q2r-5 0}.lst-kix_dfignz4kto-2>li{counter-increment:lst-ctn-kix_dfignz4kto-2}.lst-kix_m7n4vga7agj0-6>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-6,decimal) ". "}ol.lst-kix_dfignz4kto-7{list-style-type:none}ol.lst-kix_dfignz4kto-8{list-style-type:none}ol.lst-kix_lgfdoxi035fa-3.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-3 0}ol.lst-kix_dfignz4kto-5{list-style-type:none}ol.lst-kix_dfignz4kto-6{list-style-type:none}ol.lst-kix_dfignz4kto-3{list-style-type:none}ol.lst-kix_dfignz4kto-4{list-style-type:none}ol.lst-kix_dfignz4kto-1{list-style-type:none}ol.lst-kix_dfignz4kto-2{list-style-type:none}ol.lst-kix_t794825wy5z-0{list-style-type:none}.lst-kix_2atftb74ca0r-4>li{counter-increment:lst-ctn-kix_2atftb74ca0r-4}ol.lst-kix_t794825wy5z-2{list-style-type:none}ol.lst-kix_t794825wy5z-1{list-style-type:none}.lst-kix_s7qtkfn3qfov-8>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-8,lower-roman) ". "}ol.lst-kix_t794825wy5z-1.start{counter-reset:lst-ctn-kix_t794825wy5z-1 0}ol.lst-kix_t794825wy5z-4{list-style-type:none}.lst-kix_97v7yur38q2r-4>li{counter-increment:lst-ctn-kix_97v7yur38q2r-4}ol.lst-kix_t794825wy5z-3{list-style-type:none}ol.lst-kix_t794825wy5z-6{list-style-type:none}ol.lst-kix_t794825wy5z-5{list-style-type:none}ol.lst-kix_t794825wy5z-8{list-style-type:none}.lst-kix_m7n4vga7agj0-1>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-1,lower-latin) ". "}ol.lst-kix_t794825wy5z-7{list-style-type:none}.lst-kix_m7n4vga7agj0-2>li:before{content:"" counter(lst-ctn-kix_m7n4vga7agj0-2,lower-roman) ". "}.lst-kix_s2bakucqamn4-8>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-8,lower-roman) ". "}.lst-kix_s7qtkfn3qfov-7>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-7,lower-latin) ". "}ol.lst-kix_97v7yur38q2r-0{list-style-type:none}ol.lst-kix_97v7yur38q2r-1{list-style-type:none}.lst-kix_2atftb74ca0r-6>li{counter-increment:lst-ctn-kix_2atftb74ca0r-6}ol.lst-kix_mz7gq3g0njgs-1.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-1 0}ol.lst-kix_s7qtkfn3qfov-8{list-style-type:none}.lst-kix_s2bakucqamn4-7>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-7,lower-latin) ". "}ol.lst-kix_s7qtkfn3qfov-4{list-style-type:none}ol.lst-kix_s7qtkfn3qfov-5{list-style-type:none}.lst-kix_79xr8vp1jz9w-5>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-5,lower-roman) ". "}ol.lst-kix_s7qtkfn3qfov-6{list-style-type:none}ol.lst-kix_s7qtkfn3qfov-7{list-style-type:none}.lst-kix_79xr8vp1jz9w-4>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-4,lower-latin) ". "}.lst-kix_s2bakucqamn4-3>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-3,decimal) ". "}.lst-kix_8ndrlnfdlj1m-3>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-3}.lst-kix_s2bakucqamn4-4>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-4,lower-latin) ". "}ol.lst-kix_dfignz4kto-0.start{counter-reset:lst-ctn-kix_dfignz4kto-0 0}.lst-kix_dfignz4kto-4>li{counter-increment:lst-ctn-kix_dfignz4kto-4}.lst-kix_79xr8vp1jz9w-0>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-0,decimal) ". "}ol.lst-kix_97v7yur38q2r-6{list-style-type:none}ol.lst-kix_97v7yur38q2r-7{list-style-type:none}ol.lst-kix_vcalqlf3fy1b-6.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-6 0}ol.lst-kix_97v7yur38q2r-8{list-style-type:none}.lst-kix_s2bakucqamn4-0>li:before{content:"" counter(lst-ctn-kix_s2bakucqamn4-0,decimal) ". "}ol.lst-kix_97v7yur38q2r-2{list-style-type:none}ol.lst-kix_97v7yur38q2r-3{list-style-type:none}.lst-kix_79xr8vp1jz9w-1>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-1,lower-latin) ". "}ol.lst-kix_97v7yur38q2r-4{list-style-type:none}ol.lst-kix_yn1p6euud4dt-2.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-2 0}ol.lst-kix_97v7yur38q2r-5{list-style-type:none}.lst-kix_yn1p6euud4dt-7>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-7}.lst-kix_97v7yur38q2r-6>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-6,decimal) ". "}.lst-kix_41dur2ixsyfx-1>li{counter-increment:lst-ctn-kix_41dur2ixsyfx-1}ol.lst-kix_1xkddpu9nsxr-8.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-8 0}.lst-kix_97v7yur38q2r-7>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-7,lower-latin) ". "}ol.lst-kix_v82n41p8858f-4.start{counter-reset:lst-ctn-kix_v82n41p8858f-4 0}ol.lst-kix_97v7yur38q2r-0.start{counter-reset:lst-ctn-kix_97v7yur38q2r-0 0}ol.lst-kix_lgfdoxi035fa-8.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-8 0}.lst-kix_lgfdoxi035fa-2>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-2}.lst-kix_97v7yur38q2r-3>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-3,decimal) ". "}.lst-kix_t794825wy5z-2>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-2,lower-roman) ". "}.lst-kix_lgfdoxi035fa-1>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-1,lower-latin) ". "}ol.lst-kix_mz7gq3g0njgs-0.start{counter-reset:lst-ctn-kix_mz7gq3g0njgs-0 0}.lst-kix_t794825wy5z-3>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-3,decimal) ". "}.lst-kix_lgfdoxi035fa-0>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-0,decimal) ". "}.lst-kix_m7n4vga7agj0-0>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-0}ol.lst-kix_s7qtkfn3qfov-0{list-style-type:none}ol.lst-kix_vcalqlf3fy1b-5.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-5 0}ol.lst-kix_s7qtkfn3qfov-1{list-style-type:none}ol.lst-kix_s7qtkfn3qfov-2{list-style-type:none}ol.lst-kix_s7qtkfn3qfov-3{list-style-type:none}.lst-kix_1xkddpu9nsxr-2>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-2}ol.lst-kix_yn1p6euud4dt-1.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-1 0}.lst-kix_79xr8vp1jz9w-8>li:before{content:"" counter(lst-ctn-kix_79xr8vp1jz9w-8,lower-roman) ". "}.lst-kix_yn1p6euud4dt-2>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-2}.lst-kix_n34nhxg9gk9-0>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-0,decimal) ". "}.lst-kix_79xr8vp1jz9w-5>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-5}ol.lst-kix_v82n41p8858f-3.start{counter-reset:lst-ctn-kix_v82n41p8858f-3 0}.lst-kix_dfignz4kto-0>li{counter-increment:lst-ctn-kix_dfignz4kto-0}.lst-kix_s7qtkfn3qfov-4>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-4,lower-latin) ". "}.lst-kix_s7qtkfn3qfov-3>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-3,decimal) ". "}.lst-kix_lgfdoxi035fa-8>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-8,lower-roman) ". "}.lst-kix_t794825wy5z-6>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-6,decimal) ". "}.lst-kix_lgfdoxi035fa-5>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-5,lower-roman) ". "}ol.lst-kix_1xkddpu9nsxr-3.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-3 0}.lst-kix_97v7yur38q2r-2>li:before{content:"" counter(lst-ctn-kix_97v7yur38q2r-2,lower-roman) ". "}.lst-kix_2atftb74ca0r-2>li{counter-increment:lst-ctn-kix_2atftb74ca0r-2}.lst-kix_s7qtkfn3qfov-0>li:before{content:"" counter(lst-ctn-kix_s7qtkfn3qfov-0,decimal) ". "}.lst-kix_t794825wy5z-7>li:before{content:"" counter(lst-ctn-kix_t794825wy5z-7,lower-latin) ". "}.lst-kix_lgfdoxi035fa-4>li:before{content:"" counter(lst-ctn-kix_lgfdoxi035fa-4,lower-latin) ". "}.lst-kix_41dur2ixsyfx-4>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-4,lower-latin) ". "}.lst-kix_s8u2k5vztyaw-0>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-0,decimal) ". "}.lst-kix_yn1p6euud4dt-7>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-7,lower-latin) ". "}ol.lst-kix_vcalqlf3fy1b-7.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-7 0}.lst-kix_lgfdoxi035fa-4>li{counter-increment:lst-ctn-kix_lgfdoxi035fa-4}ol.lst-kix_v82n41p8858f-2.start{counter-reset:lst-ctn-kix_v82n41p8858f-2 0}ol.lst-kix_yn1p6euud4dt-0.start{counter-reset:lst-ctn-kix_yn1p6euud4dt-0 0}.lst-kix_yn1p6euud4dt-3>li:before{content:"" counter(lst-ctn-kix_yn1p6euud4dt-3,decimal) ". "}ol.lst-kix_t794825wy5z-8.start{counter-reset:lst-ctn-kix_t794825wy5z-8 0}.lst-kix_s8u2k5vztyaw-8>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-8,lower-roman) ". "}.lst-kix_v82n41p8858f-4>li{counter-increment:lst-ctn-kix_v82n41p8858f-4}.lst-kix_yn1p6euud4dt-5>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-5}.lst-kix_41dur2ixsyfx-8>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-8,lower-roman) ". "}ol.lst-kix_t794825wy5z-5.start{counter-reset:lst-ctn-kix_t794825wy5z-5 0}ol.lst-kix_1xkddpu9nsxr-7.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-7 0}.lst-kix_vcalqlf3fy1b-5>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-5,lower-roman) ". "}ol.lst-kix_97v7yur38q2r-6.start{counter-reset:lst-ctn-kix_97v7yur38q2r-6 0}.lst-kix_n34nhxg9gk9-4>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-4,lower-latin) ". "}.lst-kix_t794825wy5z-0>li{counter-increment:lst-ctn-kix_t794825wy5z-0}ol.lst-kix_lgfdoxi035fa-2.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-2 0}ol.lst-kix_1xkddpu9nsxr-4.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-4 0}.lst-kix_n34nhxg9gk9-8>li:before{content:"" counter(lst-ctn-kix_n34nhxg9gk9-8,lower-roman) ". "}ol.lst-kix_lgfdoxi035fa-5.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-5 0}.lst-kix_dfignz4kto-7>li{counter-increment:lst-ctn-kix_dfignz4kto-7}.lst-kix_vcalqlf3fy1b-1>li:before{content:"" counter(lst-ctn-kix_vcalqlf3fy1b-1,lower-latin) ". "}.lst-kix_41dur2ixsyfx-0>li:before{content:"" counter(lst-ctn-kix_41dur2ixsyfx-0,decimal) ". "}.lst-kix_s8u2k5vztyaw-4>li:before{content:"" counter(lst-ctn-kix_s8u2k5vztyaw-4,lower-latin) ". "}ol.lst-kix_97v7yur38q2r-3.start{counter-reset:lst-ctn-kix_97v7yur38q2r-3 0}.lst-kix_79xr8vp1jz9w-7>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-7}.lst-kix_8ndrlnfdlj1m-1>li{counter-increment:lst-ctn-kix_8ndrlnfdlj1m-1}.lst-kix_97v7yur38q2r-2>li{counter-increment:lst-ctn-kix_97v7yur38q2r-2}ol.lst-kix_1xkddpu9nsxr-5.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-5 0}ol.lst-kix_lgfdoxi035fa-4.start{counter-reset:lst-ctn-kix_lgfdoxi035fa-4 0}.lst-kix_s2bakucqamn4-6>li{counter-increment:lst-ctn-kix_s2bakucqamn4-6}.lst-kix_mz7gq3g0njgs-3>li:before{content:"" counter(lst-ctn-kix_mz7gq3g0njgs-3,decimal) ". "}ol.lst-kix_v82n41p8858f-0.start{counter-reset:lst-ctn-kix_v82n41p8858f-0 0}ol.lst-kix_97v7yur38q2r-4.start{counter-reset:lst-ctn-kix_97v7yur38q2r-4 0}ol.lst-kix_t794825wy5z-6.start{counter-reset:lst-ctn-kix_t794825wy5z-6 0}.lst-kix_2atftb74ca0r-5>li:before{content:"" counter(lst-ctn-kix_2atftb74ca0r-5,lower-roman) ". "}.lst-kix_8ndrlnfdlj1m-7>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-7,lower-latin) ". "}ol.lst-kix_vcalqlf3fy1b-8.start{counter-reset:lst-ctn-kix_vcalqlf3fy1b-8 0}.lst-kix_vcalqlf3fy1b-0>li{counter-increment:lst-ctn-kix_vcalqlf3fy1b-0}.lst-kix_yn1p6euud4dt-0>li{counter-increment:lst-ctn-kix_yn1p6euud4dt-0}.lst-kix_1xkddpu9nsxr-4>li{counter-increment:lst-ctn-kix_1xkddpu9nsxr-4}ol.lst-kix_t794825wy5z-7.start{counter-reset:lst-ctn-kix_t794825wy5z-7 0}.lst-kix_79xr8vp1jz9w-0>li{counter-increment:lst-ctn-kix_79xr8vp1jz9w-0}ol.lst-kix_1xkddpu9nsxr-6.start{counter-reset:lst-ctn-kix_1xkddpu9nsxr-6 0}.lst-kix_n34nhxg9gk9-4>li{counter-increment:lst-ctn-kix_n34nhxg9gk9-4}.lst-kix_dfignz4kto-1>li:before{content:"" counter(lst-ctn-kix_dfignz4kto-1,lower-latin) ". "}.lst-kix_8ndrlnfdlj1m-3>li:before{content:"" counter(lst-ctn-kix_8ndrlnfdlj1m-3,decimal) ". "}.lst-kix_m7n4vga7agj0-5>li{counter-increment:lst-ctn-kix_m7n4vga7agj0-5}ol{margin:0;padding:0}table td,table th{padding:0}.c19{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#e0e0e0;border-top-width:1pt;border-right-width:1pt;border-left-color:#e0e0e0;vertical-align:top;border-right-color:#e0e0e0;border-left-width:1pt;border-top-style:solid;background-color:#fafafa;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#e0e0e0;border-bottom-style:solid}.c27{margin-left:72pt;padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:center;margin-right:72pt}.c21{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c25{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c33{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:center}.c6{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c4{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-style:normal}.c1{font-size:10pt;font-family:"Consolas";color:#000000;font-weight:400}.c11{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c20{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c2{font-size:10pt;font-family:"Consolas";color:#9c27b0;font-weight:400}.c0{font-size:10pt;font-family:"Consolas";color:#616161;font-weight:400}.c16{font-size:10pt;font-family:"Consolas";color:#c53929;font-weight:400}.c35{font-size:10pt;font-family:"Consolas";color:#0f9d58;font-weight:400}.c23{font-size:10pt;font-family:"Consolas";color:#455a64;font-weight:400}.c30{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt}.c10{border-spacing:0;border-collapse:collapse;margin-right:auto}.c9{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:left}.c18{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c5{text-decoration:none;vertical-align:baseline;font-style:normal}.c32{padding:0;margin:0}.c13{color:#008200;font-size:11pt}.c22{margin-left:36pt;padding-left:0pt}.c26{color:inherit;text-decoration:inherit}.c12{font-weight:700;font-family:"Courier New"}.c17{color:#000000;font-size:20pt}.c28{color:#000000;font-size:16pt}.c36{border:1px solid black;margin:5px}.c3{font-weight:400;font-family:"Courier New"}.c14{color:#000000;font-size:9pt}.c7{font-weight:400;font-family:"Arial"}.c8{height:11pt}.c34{font-size:11pt}.c29{color:#0a0085}.c31{color:#008200}.c15{height:0pt}.c24{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}}Written by Brandon Azad, when working at Project Zero

WebRTC is an open source video conferencing solution used by a variety of software including browsers, messaging clients and streaming services. While Project Zero has reported several vulnerabilities in WebRTC in the past, it was not clear whether these bugs were exploitable, especially outside of browsers. I investigated whether two recent bugs are exploitable in popular Android messaging applications.

This post is the second of a multi-part series capturing my journey from discovering a vulnerable little-known Samsung image codec, to completing a remote zero-click MMS attack that worked on the latest Samsung flagship devices. New posts will be published as they are completed and will be linked here when complete.

I started off by going through WebRTC bugs I had filed in the past to see if any had the potential to break ASLR. Even if a bug was fixed long ago, it is an indicator of where similar bugs could potentially be found. One such bug was CVE-2020-6831, which is an out-of-bounds read in usrsctp.

A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.