From:	CRDGW2::CRDGW2::MRGATE::"SMTP::CRVAX.SRI.COM::RELAY-INFO-VAX" 25-OCT-1989 18:37
To:	MRGATE::"ARISIA::EVERHART"
Subj:	password guesser

Message-Id:  <8910252223.AA05555@crdgw1.ge.com>
Received: From OLY.ACS.WASHINGTON.EDU by CRVAX.SRI.COM with TCP; Wed, 25 OCT 89 14:15:21 PDT
Received: from UWAVM.ACS.WASHINGTON.EDU by UWAVM.ACS.WASHINGTON.EDU (IBM VM SMTP R1.2.1MX) with BSMTP id 9379; Wed, 25 Oct 89 14:17:37 PDT
Received: from FHCRCVAX.BITNET (JOE) by UWAVM.ACS.WASHINGTON.EDU (Mailer R2.04)
 with BSMTP id 4676; Wed, 25 Oct 89 14:17:29 PDT
Date: Wed, 25 Oct 89 14:14 PST
From: Joe Meadows <JOE%FHCRCVAX.BITNET@UWAVM.ACS.WASHINGTON.EDU>
Subject: password guesser
To: info-vax@sri.com
X-Vms-To: INFO-VAX

        Okay, there was a bug in GUESS_PASSWORD.C, which kept it
from correctly checking if password=username, and also a slight
problem with the handling of dictionaries (oops!). The code
has been updated and is available from VMSSERV@FHCRCVAX, however,
since a lot of people have been requesting it, and there has been
a lot of concern lately, I've decided to post the password guesser
directly to INFO-VAX as well.

        So here it is, extract it, then compile all the parts.
Note that this version has most of the comments removed to make it
smaller for mailing it off.

        Cheers,
        Joe Meadows     joe@fhcrcvax.bitnet

---- snip here, call it something like, oh, maybe password.shar? ----
$! ................... Cut between dotted lines and save. ...................
$!...........................................................................
$! VAX/VMS archive file created by VMS_SHARE V06.10 7-FEB-1989.
$!
$! VMS_SHARE was written by James Gray (Gray:OSBUSouth@Xerox.COM) from
$! VMS_SHAR by Michael Bednarek (U3369429@ucsvc.dn.mu.oz.au).
$!
$! To unpack, simply save, concatinate all parts into one file and
$! execute (@) that file.
$!
$! This archive was created by user JOE
$! on 25-OCT-1989 13:48:19.72.
$!
$! It contains the following 6 files:
$!        $PRVDEF.H
$!        CC.OPT
$!        GUESS_PASSWORD.C
$!        HPWD.MAR
$!        UAF.H
$!        WORDLIST.H
$!
$!============================================================================
$ SET SYMBOL/SCOPE=( NOLOCAL, NOGLOBAL )
$ VERSION = F$GETSYI( "VERSION" )
$ IF VERSION .GES "V4.4" THEN GOTO VERSION_OK
$ WRITE SYS$OUTPUT "You are running VMS ''VERSION'; ", -
    "VMS_SHARE V06.10 7-FEB-1989 requires VMS V4.4 or higher."
$ EXIT 44 ! SS$_ABORT
$VERSION_OK:
$ GOTO START
$!
$UNPACK_FILE:
$ WRITE SYS$OUTPUT "Creating ''FILE_IS'"
$ DEFINE/USER_MODE SYS$OUTPUT NL:
$ EDIT/TPU/COMMAND=SYS$INPUT/NODISPLAY/OUTPUT='FILE_IS'/NOSECTION -
    VMS_SHARE_DUMMY.DUMMY
b_part := CREATE_BUFFER( "{Part}", GET_INFO( COMMAND_LINE, "file_name" ) )
; s_file_spec := GET_INFO( COMMAND_LINE, "output_file" ); SET( OUTPUT_FILE
, b_part, s_file_spec ); b_errors := CREATE_BUFFER( "{Errors}" ); i_errors
:= 0; pat_beg_1 := ANCHOR & "-+-+-+ Beginning"; pat_beg_2 := LINE_BEGIN
& "+-+-+-+ Beginning"; pat_end := ANCHOR & "+-+-+-+-+ End"; POSITION
( BEGINNING_OF( b_part ) ); LOOP EXITIF SEARCH( SPAN( ' ' )@r_trail
& LINE_END, FORWARD) = 0; POSITION( r_trail ); ERASE( r_trail ); ENDLOOP
; POSITION( BEGINNING_OF( b_part ) ); i_append_line := 0; LOOP EXITIF MARK
( NONE ) = END_OF( b_part ); s_x := ERASE_CHARACTER( 1 )
; IF s_x = '+' THEN r_skip := SEARCH( pat_beg_1, FORWARD, EXACT ); IF r_skip
<> 0 THEN s_x := ''; MOVE_HORIZONTAL( -CURRENT_OFFSET ); ERASE_LINE; ENDIF
; ENDIF; IF s_x = '-' THEN r_skip := SEARCH( pat_end, FORWARD, EXACT )
; IF r_skip <> 0 THEN s_x := ''; MOVE_HORIZONTAL( -CURRENT_OFFSET ); m_skip
:= MARK( NONE ); r_skip := SEARCH( pat_beg_2, FORWARD, EXACT ); IF r_skip
<> 0 THEN POSITION( END_OF( r_skip ) ); MOVE_HORIZONTAL( -CURRENT_OFFSET )
; MOVE_VERTICAL( 1 ); MOVE_HORIZONTAL( -1 ); ELSE POSITION( END_OF( b_part )
); ENDIF; ERASE( CREATE_RANGE( m_skip, MARK( NONE ), NONE ) ); ENDIF; ENDIF
; IF s_x = 'V' THEN s_x := ''; IF i_append_line <> 0 THEN APPEND_LINE
; MOVE_HORIZONTAL( -CURRENT_OFFSET ); ENDIF; i_append_line := 1
; MOVE_VERTICAL( 1 ); ENDIF; IF s_x = 'X' THEN s_x := ''; IF i_append_line
<> 0 THEN APPEND_LINE; MOVE_HORIZONTAL( -CURRENT_OFFSET ); ENDIF
; i_append_line := 0; MOVE_VERTICAL( 1 ); ENDIF; IF s_x <> '' THEN i_errors
:= i_errors + 1; s_text := CURRENT_LINE; POSITION( b_errors ); COPY_TEXT
( "The following line could not be unpacked properly:" ); SPLIT_LINE
; COPY_TEXT( s_x ); COPY_TEXT( s_text ); POSITION( b_part ); MOVE_VERTICAL
( 1 ); ENDIF; ENDLOOP; POSITION( BEGINNING_OF( b_part ) ); LOOP r_x := SEARCH
( "`", FORWARD, EXACT ); EXITIF r_x = 0; POSITION( r_x ); ERASE_CHARACTER( 1
); COPY_TEXT( ASCII( INT( ERASE_CHARACTER( 3 ) ) ) ); ENDLOOP
; IF i_errors = 0 THEN SET( NO_WRITE, b_errors, ON ); ELSE POSITION
( BEGINNING_OF( b_errors ) ); COPY_TEXT( FAO
( "The following !UL errors were detected while unpacking !AS", i_errors
, s_file_spec ) ); SPLIT_LINE; SET( OUTPUT_FILE, b_errors, "SYS$COMMAND" )
; ENDIF; EXIT;
$ DELETE VMS_SHARE_DUMMY.DUMMY;*
$ CHECKSUM 'FILE_IS
$ WRITE SYS$OUTPUT " CHECKSUM ", -
  F$ELEMENT( CHECKSUM_IS .EQ. CHECKSUM$CHECKSUM, ",", "failed!!,passed." )
$ RETURN
$!
$START:
$ FILE_IS = "$PRVDEF.H"
$ CHECKSUM_IS = 1147825869
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X#ifndef $PRVDEF_H
X#define $PRVDEF_H
X`032
X#define PRV$M_CMKRNL 0x00000001
X#define PRV$M_CMEXEC 0x00000002
X#define PRV$M_SYSNAM 0x00000004
X#define PRV$M_GRPNAM 0x00000008
X#define PRV$M_ALLSPOOL 0x00000010
X#define PRV$M_DETACH 0x00000020
X#define PRV$M_DIAGNOSE 0x00000040
X#define PRV$M_LOG_IO 0x00000080
X#define PRV$M_GROUP 0x00000100
X#define PRV$M_NOACNT 0x00000200
X#define PRV$M_PRMCEB 0x00000400
X#define PRV$M_PRMMBX 0x00000800
X#define PRV$M_PSWAPM 0x00001000
X#define PRV$M_SETPRI 0x00002000
X#define PRV$M_SETPRV 0x00004000
X#define PRV$M_TMPMBX 0x00008000
X#define PRV$M_WORLD 0x00010000
X#define PRV$M_MOUNT 0x00020000
X#define PRV$M_OPER 0x00040000
X#define PRV$M_EXQUOTA 0x00080000
X#define PRV$M_NETMBX 0x00100000
X#define PRV$M_VOLPRO 0x00200000
X#define PRV$M_PHY_IO 0x00400000
X#define PRV$M_BUGCHK 0x00800000
X#define PRV$M_PRMGBL 0x01000000
X#define PRV$M_SYSGBL 0x02000000
X#define PRV$M_PFNMAP 0x04000000
X#define PRV$M_SHMEM 0x08000000
X#define PRV$M_SYSPRV 0x10000000
X#define PRV$M_BYPASS 0x20000000
X#define PRV$M_SYSLCK 0x40000000
X#define PRV$M_SHARE 0x80000000
X#define PRV$M_ACNT 0x00000200
X#define PRV$M_ALTPRI 0x00002000
Xunion prvdef `123
X    long prv$q_privilege[2];
X    struct `123
X        unsigned prv$v_cmkrnl : 1;
X        unsigned prv$v_cmexec : 1;
X        unsigned prv$v_sysnam : 1;
X        unsigned prv$v_grpnam : 1;
X        unsigned prv$v_allspool : 1;
X        unsigned prv$v_detach : 1;
X        unsigned prv$v_diagnose : 1;
X        unsigned prv$v_log_io : 1;
X        unsigned prv$v_group : 1;
X        unsigned prv$v_noacnt : 1;
X        unsigned prv$v_prmceb : 1;
X        unsigned prv$v_prmmbx : 1;
X        unsigned prv$v_pswapm : 1;
X        unsigned prv$v_setpri : 1;
X        unsigned prv$v_setprv : 1;
X        unsigned prv$v_tmpmbx : 1;
X        unsigned prv$v_world : 1;
X        unsigned prv$v_mount : 1;
X        unsigned prv$v_oper : 1;
X        unsigned prv$v_exquota : 1;
X        unsigned prv$v_netmbx : 1;
X        unsigned prv$v_volpro : 1;
X        unsigned prv$v_phy_io : 1;
X        unsigned prv$v_bugchk : 1;
X        unsigned prv$v_prmgbl : 1;
X        unsigned prv$v_sysgbl : 1;
X        unsigned prv$v_pfnmap : 1;
X        unsigned prv$v_shmem : 1;
X        unsigned prv$v_sysprv : 1;
X        unsigned prv$v_bypass : 1;
X        unsigned prv$v_syslck : 1;
X        unsigned prv$v_share : 1;
X        unsigned prv$v_upgrade : 1;
X        unsigned prv$v_downgrade : 1;
X        unsigned prv$v_grpprv : 1;
X        unsigned prv$v_readall : 1;
X        unsigned prvdef$$_fill_3 : 2;
X        unsigned prv$v_security : 1;
X        unsigned prv$v_fill_15 : 1;
X        `125 prv$r_prvdef_bits0;
X    struct `123
X        unsigned prvdef$$_fill_1 : 9;
X        unsigned prv$v_acnt : 1;
X        unsigned prvdef$$_fill_2 : 3;
X        unsigned prv$v_altpri : 1;
X        unsigned prv$v_fill_16 : 2;
X        `125 prv$r_prvdef_bits1;
X`125 ;
X#endif
$ GOSUB UNPACK_FILE

$ FILE_IS = "CC.OPT"
$ CHECKSUM_IS = 1392527948
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
Xsys$share:vaxcrtl.exe/share
$ GOSUB UNPACK_FILE

$ FILE_IS = "GUESS_PASSWORD.C"
$ CHECKSUM_IS = 1283363901
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X/* Guess_Password, written by Joe Meadows, released to the world in '89.
X   This is a public domain utility. No parts of this utility are
X   copyrighted in any way. It may be used in any way, by anyone.
X   There are no restrictions on this code. You may include it
X   in a commercial package if you wish. Feel free to send money,
X   or better yet, make a donation to the FHCRC.
X
X  Joe Meadows Jr.
X  VAX/VMS System Manager / guru in training
X  Fred Hutchinson Cancer Research Center
X  1124 Columbia St.
X  Seattle Wa. 98104
X     bitnet - JOE@FHCRCVAX
X     arpa   - JOE%FHCRCVAX.BITNET@WISCVM.WISC.EDU
X     voice  - (206) 467-4970
X*/
X
X/* Modification History
X   --------------------
X   Oct 23, 1989
X   Peter Scott - PJS@grouch.JPL.NASA.GOV added support for a word dictionary
X`009`009and check for password=(username `124 lastname `124 firstname)
X
X   I have modified it to expect a file called WORDS., which contains up to
V   25,000 words in any case, one per line (I just ftp the file /usr/dict/word
Xs
V   from a Unix system), and eliminated WORDDEF.H.  That part's not very robus
Xt,
X   it expects the file to be in the current directory.  You might change it
X   to use a logical name or some such.  All the words are read into an array
X   at startup.  I have also modified it to check against the username, and
V   their first and last names in the OWNER field.  Also it outputs each usern
Xame
X   whether or not their password is guessed so you have an idea how far it's
X   gotten, since it takes `12610 minutes per user on an 11/785.
X
X
X   (thanks also to Angel Li - angel@miami.miami.edu, who did similar work
X    and had the changes mailed to me.)
X
X   I changed it to use a logical name, and added back the wordlist. Note that
X   there are a few #define's which you may want to modify, and that the first
X   name/last name handling may need to be modified for your site. The version
X   enclosed (by PJS) supports names separated by spaces. I just cribbed some
X   code from STATUS to add support for "last, first" (it rearranges it to
X   "first last" then continues with PJS's code).
X
X  25-Oct-89
X    Fixed "dnm=..." to "dna=...", I screwed up... (I knew I should have
X    checked that..). Also fixed checking for password=username!
X*/
X
X#include <descrip.h>
X#include <rms.h>
X
X#include <stdio.h>
X#include <string.h>
X
X#include "uaf.h"
X
X/* the following should be 0 if reading words from a file */
X/* a value of 1 uses the internally defined wordlist */
X#define USE_WORDLIST 1
X
X#if USE_WORDLIST == 1
X#  include "wordlist.h"
X#else
X/* the following can/should be changed to reflect your sites usage */
X#  define DICT_NAME "DICTIONARY"
X#  define DICT_DFLT "dna=SYS$SYSTEM:.DAT"
X#  define MAXWORDS 25000
X#endif
X
Xmain(int argc, char *argv[])
X`123
X  struct FAB fab;
X  struct RAB rab;
X  struct UAFDEF record;
X  char pswd_bin[8];
V  char owner[UAF$S_OWNER+1], firstname[UAF$S_OWNER+1], lastname[UAF$S_OWNER+1
X];
X  struct dsc$descriptor outpswd = `123sizeof(pswd_bin),0,0,pswd_bin`125;
X  struct dsc$descriptor username = `1230,0,0,0`125;
X  struct dsc$descriptor word = `1230,0,0,0`125;
X  int sts, i, guessed = 0, records = 0;
X#if USE_WORDLIST == 0
X  FILE *fin = fopen (DICT_NAME, "r",DICT_DFLT);
X  char *wordlist[MAXWORDS];
X#endif
X  char **try;
X
X#if USE_WORDLIST == 0
X  if (fin == NULL)
X  `123
X    fprintf (stderr, "Can't open DICTIONARY: quitting\n");
X    exit (1);
X  `125
X  else
X    read_words (fin, wordlist);
X#endif
X
X  fab = cc$rms_fab;
X  rab = cc$rms_rab;
X  fab.fab$b_fns = sizeof("sysuaf");
X  fab.fab$l_fna = "sysuaf";
X  fab.fab$b_dns = sizeof("sys$system:.dat");
X  fab.fab$l_dna = "sys$system:.dat";
X  fab.fab$b_fac = FAB$M_GET;
V  fab.fab$b_shr = FAB$M_SHRGET `124 FAB$M_SHRPUT `124 FAB$M_SHRDEL `124 FAB$M
X_SHRUPD;
X  rab.rab$l_rop = RAB$M_NLK;
X  rab.rab$w_usz = sizeof(record);
X  rab.rab$l_ubf = & record;
X  rab.rab$l_fab = &fab;
X
X  sts = SYS$OPEN(&fab);
X  if (!(sts & 1)) return(sts);
X
X  sts = SYS$CONNECT(&rab);
X  if (!(sts & 1)) return(sts);
X
X  for (i = 1; i < argc; ++i)
X    strupcase(argv[i]);
X
X  while(SYS$GET(&rab) & 1)
X  `123
X    if (record.uaf$b_rtype == 1)
X    `123
X      char *cptr;
X
X      strncpy (owner, record.uaf$t_owner+1, UAF$S_OWNER);
X      *(owner+*(record.uaf$t_owner)) = '\0';
X      fix_personal_name(owner,owner); /* checks for "," and rearranges */
X      strupcase (owner);
X      strcpy (firstname, owner);
X      cptr = strchr (firstname, ' ');
X      if (cptr)
X        *cptr = '\0';
X      cptr = strrchr (owner, ' ');
X      if (cptr)
X        strcpy (lastname, cptr + 1);
X      else
X        strcpy (lastname, owner);
X      username.dsc$w_length = 12;
X      username.dsc$a_pointer = record.uaf$t_username;
X      ++records;
X
X#if USE_WORDLIST == 1
X      try = words;
X#else
X      try = wordlist;
X#endif
X      printf ("\n%.*s - ", 12, record.uaf$t_username);
X      while (*try)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        word.dsc$w_length = strlen(*try);
X        word.dsc$a_pointer = *try;
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          printf("\"%s\"",*try);
X          ++guessed;
X          break;
X        `125
X        ++try;
X      `125
X
X/* Check username as password on first pass, first & last names on previous
X   passes (kludgy as hell, but it works) */
X
X      for (i = -2; i < argc; ++i)
X      `123
X        outpswd.dsc$w_length = sizeof(pswd_bin);
X        if (i > 0)
X        `123
X          word.dsc$w_length = strlen(argv[i]);
X          word.dsc$a_pointer = argv[i];
X        `125
X        else switch (i)
X        `123
X
X          case -2 : word.dsc$w_length = strlen (firstname);
X                    word.dsc$a_pointer = firstname;
X                    break;
X
X          case -1 : word.dsc$w_length = strlen (lastname);
X                    word.dsc$a_pointer = lastname;
X                    break;
X
X          case  0 : word.dsc$w_length = mystrlen (record.uaf$t_username,
X                                                  UAF$S_USERNAME);
X                    word.dsc$a_pointer = record.uaf$t_username;
X                    break;
X
X          default : printf ("This can't happen!!!\n");
X                    break;
X        `125
X        lgi$hpwd(&outpswd,&word,record.uaf$b_encrypt,
X`009`009record.uaf$w_salt,&username);
X        if (cmp_quad(pswd_bin,record.uaf$r_pwd_overlay.uaf$q_pwd))
X        `123
X          printf ("\"%.*s\"",word.dsc$w_length,word.dsc$a_pointer );
X          ++guessed;
X          break;
X        `125
X      `125
X    `125
X  `125
X  printf("\n%d of %d accounts were guessed\n",guessed,records);
X`125
X
Xstrupcase(char *s)
X`123
X  while (*s)
X  `123
X    *s = toupper(*s); ++s;
X  `125
X`125
X
Xcmp_quad(int x1[2], int x2[2])
X`123
X  return( (x1[0] == x2[0]) &&  (x1[1] == x2[1]) );
X`125
X
Xint mystrlen (char *str,int max)
X`123
X  int i;
X
X  i = strlen(str);
X  if (i > max)
X    i = max;
X  while ((i > 0) & (str[i - 1] == ' '))
X    --i;
X  return (i);
X`125
X
Xread_words (FILE *fin, char *wordlist[])
X`123
X  char str[100];
X  int i = 0;
X
X  while (fgets (str, 99, fin))
X  `123
X    *(str+strlen(str)-1) = '\0';                    /* remove /n */
X    wordlist[i] = malloc (strlen (str));
X    strupcase (str);
X    strcpy (wordlist[i++], str);
X  `125
X  wordlist[i] = 0;
X  fclose (fin);
X`125
X
Xfix_personal_name(from,to)
X  char *from, *to;
X`123
X  char *comma, tmp[80];
X  int len;
X
X  while (*from == ' ')
X    ++from; /* kill leading spaces */
X  len = strlen(from) - 1;
X  while (from[len] == ' ')
X    from[len--] = '\0'; /* kill trailing spaces */
X
X  /* look for a comma, if there, rearrange the name */
X  comma = strchr(from,',');
X  if (comma)
X  `123
X    *comma++ = '\0';
X
X    while (*comma == ' ')
X      ++comma; /* kill leading spaces in first name */
X    len = strlen(comma) - 1;
X    while (comma[len] == ' ')
X      comma[len--] = '\0'; /* kill trailing spaces in first name */
X
X    /* copy strings together, first last */
X    sprintf(tmp,"%s %s",comma,from);
X    /* and output it.. */
X    strcpy(to,tmp);
X  `125
X  else
X  `123
X    strcpy(to,from);
X  `125;
X`125
$ GOSUB UNPACK_FILE

$ FILE_IS = "HPWD.MAR"
$ CHECKSUM_IS = 1042909240
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X.TITLE`009HPWD - hash user password
X.IDENT`009'X-2'
X
X
X;****************************************************************************
X;*`009`009`009`009`009`009`009`009`009    *
X;*  COPYRIGHT (c) 1978, 1980, 1982, 1984 BY`009`009`009`009    *
X;*  DIGITAL EQUIPMENT CORPORATION, MAYNARD, MASSACHUSETTS.`009`009    *
X;*  ALL RIGHTS RESERVED.`009`009`009`009`009     `009    *
X;*`009`009`009`009`009`009`009`009`009    *
X;*  THIS SOFTWARE IS FURNISHED UNDER A LICENSE AND MAY BE USED AND COPIED   *
X;*  ONLY IN  ACCORDANCE WITH  THE  TERMS  OF  SUCH  LICENSE  AND WITH THE   *
X;*  INCLUSION OF THE ABOVE COPYRIGHT NOTICE. THIS SOFTWARE OR  ANY  OTHER   *
X;*  COPIES THEREOF MAY NOT BE PROVIDED OR OTHERWISE MADE AVAILABLE TO ANY   *
X;*  OTHER PERSON.  NO TITLE TO AND OWNERSHIP OF  THE  SOFTWARE IS  HEREBY   *
X;*  TRANSFERRED.`009`009`009`009`009`009`009    *
X;*`009`009`009`009`009`009`009`009`009    *
X;*  THE INFORMATION IN THIS SOFTWARE IS  SUBJECT TO CHANGE WITHOUT NOTICE   *
X;*  AND  SHOULD  NOT  BE  CONSTRUED AS  A COMMITMENT BY DIGITAL EQUIPMENT   *
X;*  CORPORATION.`009`009`009`009`009`009`009    *
X;*`009`009`009`009`009`009`009`009`009    *
X;*  DIGITAL ASSUMES NO RESPONSIBILITY FOR THE USE  OR  RELIABILITY OF ITS   *
X;*  SOFTWARE ON EQUIPMENT WHICH IS NOT SUPPLIED BY DIGITAL.`009`009    *
X;*`009`009`009`009`009`009`009`009`009    *
X;*`009`009`009`009`009`009`009`009`009    *
X;****************************************************************************
X
X.SBTTL`009DECLARATIONS
X
X.macro`009pushq`009Src
X`009movq`009Src,-(sp)
X.endm
X.macro`009popq`009Dst
X`009movq`009(sp)+,Dst
X.endm
X
X`009OUTDSC = 4
X`009PWDDSC = OUTDSC + 4
X`009ENCRYPT = PWDDSC + 4
X`009SALT = ENCRYPT + 4
X`009USRDSC = SALT + 4
X
X
X.psect`009_LIB$CODE`009RD,NOWRT,PIC,SHR,BYTE,EXE
X
XAUTODIN:
V`009.LONG`009`094O00000000000,`094O03555610144,`094O07333420310,`094O04666230
X254
V`009.LONG`009`094O16667040620,`094O15332650764,`094O11554460530,`094O12001270
X474
V`009.LONG`009`094O35556101440,`094O36003711504,`094O32665521750,`094O31330331
X614
V`009.LONG`009`094O23331141260,`094O20664751324,`094O24002561170,`094O27557371
X034
X
X
XC:`009.long`009-83,`009-1`009`009; C1
X`009.long`009-179,`009-1`009`009; C2
X`009.long`009-257,`009-1`009`009; C3
X`009.long`009-323,`009-1`009`009; C4
X`009.long`009-363,`009-1`009`009; C5
X
X.SBTTL`009Dispatch - select encryption algorithm
X
X.entry`009LGI$HPWD,`094M<r2,r3,r4,r5,r6>
X
X`009tstb`009ENCRYPT(ap)
X`009beql`00920$
X`009subl2`009#20,sp
X`009movl`009sp,r6
X`009movq`009@USRDSC(ap),(r6)
X`009cmpb`009#1,ENCRYPT(ap)
X`009bneq`00910$
X`009movc5`009(r6),@4(r6),#32,#12,8(r6)
X`009movw`009#12,(r6)
X`009movab`0098(r6),4(r6)
X`009brb`00920$
X
X
X10$:`009movzwl`009(r6),r5
X`009clrw`009(r6)
X`009movl`0094(r6),r0
X15$:`009cmpb`009(r0)+,#32
X`009beql`00920$
X`009incw`009(r6)
X`009cmpw`009#31,(r6)
X`009beql`00920$
X`009cmpw`009r5,(r6)
X`009beql`00920$
X`009brb`00915$
X
X20$:`009movaq   @PWDDSC(ap),r4
X`009tstw`009(r4)
X`009bneq`00925$
X`009movaq`009@OUTDSC(ap),r4
X`009clrw`009(r4)
X`009movc5`009#0,(r4),#0,#8,@4(r4)
X`009brb 40$
X
X25$:`009movaq`009@OUTDSC(ap),r4
X`009movaq`009@4(r4),r4
X`009tstb`009ENCRYPT(ap)
X`009bgtru`00930$
X`009mnegl`009#1,r0
X`009movaq`009@PWDDSC(ap),r1
X`009crc`009AUTODIN,r0,(r1),@4(r1)
X`009clrl`009r1
X`009movq`009r0,(r4)
X`009brb`00940$
X
X30$:`009clrq`009(r4)
X`009movaq`009@PWDDSC(ap),r3
X`009bsbb`009COLLAPSE_R2
X`009addw2`009SALT(ap),3(r4)
X`009movl`009r6,r3
X`009bsbb`009COLLAPSE_R2
X`009pushaq`009(r4)
X`009calls`009#1,Purdy
X
X40$:`009movl`009#1,r0
X`009ret
X
XCOLLAPSE_R2:
X.enabl`009LSB
X`009movzwl`009(r3),r0
X`009beqlu`00920$
X`009moval`009@4(r3),r2
X10$:`009bicl3`009#-8,r0,r1
X`009addb2`009(r2)+,(r4)[r1]
X`009sobgtr`009r0,10$
X20$:`009rsb
X.dsabl`009LSB
X
X.sbttl`009Purdy - evaluate Purdy polynomial
X
Xa=59
X
Xn0=1@24 - 3
Xn1=1@24 - 63
X
X.entry`009Purdy,`094M<r2,r3,r4,r5>
X`009pushq`009@4(ap)
X`009bsbw`009PQMOD_R0
X`009movaq`009(sp),r4
X`009movaq`009C,r5
X`009pushq`009(r4)
X`009pushl`009#n1
X`009bsbb`009PQEXP_R3
X`009pushq`009(r4)
X`009pushl`009#n0-n1
X`009bsbb`009PQEXP_R3
X`009pushq`009(r5)+
X`009bsbw`009PQADD_R0
X`009bsbw`009PQMUL_R2
X`009pushq`009(r5)+
X`009pushq`009(r4)
X`009bsbw`009PQMUL_R2
X`009pushq`009(r5)+
X`009bsbw`009PQADD_R0
X`009pushq`009(r4)
X`009bsbb`009PQMUL_R2
X`009pushq`009(r5)+
X`009bsbw`009PQADD_R0
X`009pushq`009(r4)
X`009bsbb`009PQMUL_R2
X`009pushq`009(r5)+
X`009bsbw`009PQADD_R0
X`009bsbw`009PQADD_R0
X`009popq`009@4(ap)
X`009movl`009#1,r0
X`009ret
X
X
XPQEXP_R3:
X.enabl`009LSB
X`009popr`009#`094M<r3>
X`009pushq`009#1
X`009pushq`0098+4(sp)
X`009tstl`0098+8(sp)
X`009beqlu`00930$
X10$:`009blbc`0098+8(sp),20$
X`009pushq`009(sp)
X`009pushq`0098+8(sp)
X`009bsbb`009PQMUL_R2
X`009popq`0098(sp)
X`009cmpzv`009#1,#31,8+8(sp),#0
X`009beqlu`00930$
X20$:`009pushq`009(sp)
X`009bsbb`009PQMUL_R2
X`009extzv`009#1,#31,8+8(sp),8+8(sp)
X`009brb`00910$
X30$:`009movq`0098(sp),8+8+4(sp)
X`009movaq`0098+8+4(sp),sp
X`009jmp`009(r3)
X.dsabl`009LSB
X
Xu=0
Xv=u+4
Xy=u+8
Xz=y+4
X
XPQMOD_R0:
X.enabl`009LSB
X`009popr`009#`094M<r0>
X`009cmpl`009v(sp),#-1
X`009blssu`00910$
X`009cmpl`009u(sp),#-a
X`009blssu`00910$
X`009addl2`009#a,u(sp)
X`009adwc`009#0,v(sp)
X10$:`009jmp`009(r0)
X.dsabl`009LSB
X
X
XPQMUL_R2:
X`009popr`009#`094M<r1>
X`009movl`009sp,r2
X`009pushl`009z(r2)
X`009pushl`009v(r2)
X`009bsbb`009EMULQ
X`009bsbb`009PQMOD_R0
X`009bsbb`009PQLSH_R0
X`009pushl`009y(r2)
X`009pushl`009v(r2)
X`009bsbb`009EMULQ
X`009bsbb`009PQMOD_R0
X`009pushl`009z(r2)
X`009pushl`009u(r2)
X`009bsbb`009EMULQ
X`009bsbb`009PQMOD_R0
X`009bsbb`009PQADD_R0
X`009bsbb`009PQADD_R0
X`009bsbb`009PQLSH_R0
X`009pushl`009y(r2)
X`009pushl`009u(r2)
X`009bsbb`009EMULQ
X`009bsbb`009PQMOD_R0
X`009bsbb`009PQADD_R0
X`009popq`009Y(r2)
X`009movaq`009Y(r2),sp
X`009jmp`009(r1)
X
X
XEMULQ:
X.enabl`009LSB
X`009emul`0094(sp),8(sp),#0,-(sp)
X`009clrl`009-(sp)
X`009tstl`0094+8+4(sp)
X`009bgeq`00910$
X`009addl`0094+8+8(sp),(sp)
X10$:`009tstl`0094+8+8(sp)
X`009bgeq`00920$
X`009addl`0094+8+4(sp),(sp)
X20$:`009addl`009(sp)+,4(sp)
X`009popq`0094(sp)
X`009rsb
X.dsabl`009LSB
X
X
XPQLSH_R0:
X.enabl`009LSB
X`009popr`009#`094M<r0>
X`009pushl`009v(sp)
X`009pushl`009#a
X`009bsbb`009EMULQ
X`009ashq`009#32,Y(sp),Y(sp)
X`009brb`00910$
X
XPQADD_R0:
X`009popr`009#`094M<r0>
X10$:`009addl2`009u(sp),y(sp)
X`009adwc`009v(sp),z(sp)
X`009bcs`00920$
X`009cmpl`009z(sp),#-1
X`009blssu`00930$
X`009cmpl`009y(sp),#-a
X`009blssu`00930$
X20$:`009addl2`009#a,y(sp)
X`009adwc`009#0,z(sp)
X30$:`009movaq`009Y(sp),sp
X`009jmp`009(r0)
X.dsabl`009LSB
X
X.END
$ GOSUB UNPACK_FILE

$ FILE_IS = "UAF.H"
$ CHECKSUM_IS = 320064677
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
X#include "$prvdef.h"
X
X#define PRV$M_UPGRADE 0x00000001
X#define PRV$M_DOWNGRADE 0x00000002
X#define PRV$M_GRPPRV 0x00000004
X#define PRV$M_READALL 0x00000008
X#define PRV$M_SECURITY 0x00000040
X
X
X#define UAF$C_USER_ID 1
X#define UAF$C_VERSION1 1
X#define UAF$C_KEYED_PART 52
X#define UAF$C_AD_II 0
X#define UAF$C_PURDY 1
X#define UAF$C_PURDY_V 2
X#define UAF$K_FIXED 644
X#define UAF$C_FIXED 644
X#define UAF$K_LENGTH 1412
X#define UAF$C_LENGTH 1412
X#define UAF$S_UAFDEF 1412
X
X#define UAF$S_USERNAME 32
X#define UAF$S_PARENT_ID 8
X#define UAF$S_ACCOUNT 32
X#define UAF$S_OWNER 32
X#define UAF$S_DEFDEV 32
X#define UAF$S_DEFDIR 64
X#define UAF$S_LGICMD 64
X#define UAF$S_DEFCLI 32
X#define UAF$S_CLITABLES 32
X#define UAF$S_PWD 8
X#define UAF$S_PWD2 8
X#define UAF$S_EXPIRATION 8
X#define UAF$S_PWD_LIFETIME 8
X#define UAF$S_PWD_DATE 8
X#define UAF$S_PWD2_DATE 8
X#define UAF$S_LASTLOGIN_I 8
X#define UAF$S_LASTLOGIN_N 8
X#define UAF$S_PRIV 8
X#define UAF$S_DEF_PRIV 8
X#define UAF$S_MIN_CLASS 20
X#define UAF$S_MAX_CLASS 20
X#define UAF$S_NETWORK_ACCESS_P 3
X#define UAF$S_NETWORK_ACCESS_S 3
X#define UAF$S_BATCH_ACCESS_P 3
X#define UAF$S_BATCH_ACCESS_S 3
X#define UAF$S_LOCAL_ACCESS_P 3
X#define UAF$S_LOCAL_ACCESS_S 3
X#define UAF$S_DIALUP_ACCESS_P 3
X#define UAF$S_DIALUP_ACCESS_S 3
X#define UAF$S_REMOTE_ACCESS_P 3
X#define UAF$S_REMOTE_ACCESS_S 3
X
Xstruct uaf$r_flags_bits `123
X  unsigned uaf$v_disctly:1;
X  unsigned uaf$v_defcli:1;
X  unsigned uaf$v_lockpwd:1;
X  unsigned uaf$v_captive:1;
X  unsigned uaf$v_disacnt:1;
X  unsigned uaf$v_diswelcom:1;
X  unsigned uaf$v_dismail:1;
X  unsigned uaf$v_nomail:1;
X  unsigned uaf$v_genpwd:1;
X  unsigned uaf$v_pwd_expired:1;
X  unsigned uaf$v_pwd2_expired:1;
X  unsigned uaf$v_audit:1;
X  unsigned uaf$v_disreport:1;
X  unsigned uaf$v_disreconnect:1;
X  unsigned uaf$v_autologin:1;
X  unsigned uaf$v_disforce_pwd_change:1;
X`125;
X
Xstruct uaf$r_primedays_bits `123
X  unsigned uaf$v_monday:1;
X  unsigned uaf$v_tuesday:1;
X  unsigned uaf$v_wednesday:1;
X  unsigned uaf$v_thursday:1;
X  unsigned uaf$v_friday:1;
X  unsigned uaf$v_saturday:1;
X  unsigned uaf$v_sunday:1;
X`125;
X
Xstruct UAFDEF
X`123
X  char uaf$b_rtype;
X  char uaf$b_version;
X  short int uaf$w_usrdatoff;
X  char uaf$t_username[UAF$S_USERNAME];
X  union `123
X    long int uaf$l_uic;
X    struct `123
X      short int uaf$w_mem;
X      short int uaf$w_grp;
X    `125 uaf$r_uic_fields;
X  `125 uaf$r_uic_overlay;
X  long int uaf$l_sub_id;
X  long int uaf$q_parent_id[2];
X  char uaf$t_account[UAF$S_ACCOUNT];
X  char uaf$t_owner[UAF$S_OWNER];
X  char uaf$t_defdev[UAF$S_DEFDEV];
X  char uaf$t_defdir[UAF$S_DEFDIR];
X  char uaf$t_lgicmd[UAF$S_LGICMD];
X  char uaf$t_defcli[UAF$S_DEFCLI];
X  char uaf$t_clitables[UAF$S_CLITABLES];
X  union `123
X    long int uaf$q_pwd[2];
X    long int uaf$l_pwd;
X  `125 uaf$r_pwd_overlay;
X  long int uaf$q_pwd2[2];
X  short int uaf$w_logfails;
X  short int uaf$w_salt;
X  char uaf$b_encrypt;
X
X  char uaf$b_encrypt2;
X  char uaf$b_pwd_length;
X  char uaf$fill_1;
X  long int uaf$q_expiration[2];
X  long int uaf$q_pwd_lifetime[2];
X  long int uaf$q_pwd_date[2];
X  long int uaf$q_pwd2_date[2];
X  long int uaf$q_lastlogin_i[2];
X  long int uaf$q_lastlogin_n[2];
X  union `123
X    long int uaf$q_priv[2];
X    union prvdef uaf$r_priv;
X  `125 uaf$r_priv_overlay;
X  union `123
X    long int uaf$q_def_priv[2];
X    union prvdef uaf$r_def_priv;
X  `125 uaf$r_def_priv_overlay;
X  char uaf$r_min_class[UAF$S_MIN_CLASS];
X  char uaf$r_max_class[UAF$S_MAX_CLASS];
X  union `123
X    long int uaf$l_flags;
X    struct uaf$r_flags_bits uaf$r_flags_bits;
X  `125 uaf$r_flags_overlay;
X  char uaf$b_network_access_p[UAF$S_NETWORK_ACCESS_P];
X  char uaf$b_network_access_s[UAF$S_NETWORK_ACCESS_S];
X  char uaf$b_batch_access_p[UAF$S_BATCH_ACCESS_P];
X  char uaf$b_batch_access_s[UAF$S_BATCH_ACCESS_S];
X  char uaf$b_local_access_p[UAF$S_LOCAL_ACCESS_P];
X  char uaf$b_local_access_s[UAF$S_LOCAL_ACCESS_S];
X  char uaf$b_dialup_access_p[UAF$S_DIALUP_ACCESS_P];
X  char uaf$b_dialup_access_s[UAF$S_DIALUP_ACCESS_S];
X  char uaf$b_remote_access_p[UAF$S_REMOTE_ACCESS_P];
X  char uaf$b_remote_access_s[UAF$S_REMOTE_ACCESS_S];
X  char uaf$fill_2[514 - 502];
X  union `123
X    char uaf$b_primedays;
X    struct uaf$r_primedays_bits uaf$r_primedays_bits;
X  `125 uaf$r_primedays_overlay;
X  char uaf$fill_3[516 - 515];
X  char uaf$b_pri;
X  char uaf$b_quepri;
X  short int uaf$w_maxjobs;
X
X  short int uaf$w_maxacctjobs;
X
X  short int uaf$w_maxdetach;
X
X  short int uaf$w_prccnt;
X  short int uaf$w_biolm;
X  short int uaf$w_diolm;
X  short int uaf$w_tqcnt;
X  short int uaf$w_astlm;
X  short int uaf$w_enqlm;
X  short int uaf$w_fillm;
X  short int uaf$w_shrfillm;
X  long int uaf$l_wsquota;
X  long int uaf$l_dfwscnt;
X  long int uaf$l_wsextent;
X  long int uaf$l_pgflquota;
X  long int uaf$l_cputim;
X  long int uaf$l_bytlm;
X  long int uaf$l_pbytlm;
X  long int uaf$l_jtquota;
X  short int uaf$w_proxy_lim;
X  short int uaf$w_proxies;
X  short int uaf$w_account_lim;
X  short int uaf$w_accounts;
X  char uaf$fill_4[UAF$K_LENGTH - 580];
X`125;
X
$ GOSUB UNPACK_FILE

$ FILE_IS = "WORDLIST.H"
$ CHECKSUM_IS = 188170084
$ COPY SYS$INPUT VMS_SHARE_DUMMY.DUMMY
Xchar *words[] = `123
X"AAA",
X"ACADEMIA",
X"AEROBICS",
X"AIRPLANE",
X"ALBANY",
X"ALBATROSS",
X"ALBERT",
X"ALEX",
X"ALEXANDER",
X"ALGEBRA",
X"ALIASES",
X"ALPHABET",
X"AMA",
X"AMORPHOUS",
X"ANALOG",
X"ANCHOR",
X"ANDROMACHE",
X"ANIMALS",
X"ANSWER",
X"ANTHROPOGENIC",
X"ANVILS",
X"ANYTHING",
X"ARIA",
X"ARIADNE",
X"ARROW",
X"ARTHUR",
X"ATHENA",
X"ATMOSPHERE",
X"AZTECS",
X"AZURE",
X"BACCHUS",
X"BAILEY",
X"BANANA",
X"BANANAS",
X"BANDIT",
X"BANKS",
X"BARBER",
X"BARITONE",
X"BASS",
X"BASSOON",
X"BATMAN",
X"BEATER",
X"BEAUTY",
X"BEETHOVEN",
X"BELOVED",
X"BENZ",
X"BEOWULF",
X"BERKELEY",
X"BERLINER",
X"BERYL",
X"BEVERLY",
X"BICAMERAL",
X"BOB",
X"BRENDA",
X"BRIAN",
X"BRIDGET",
X"BROADWAY",
X"BUMBLING",
X"BURGESS",
X"CAMPANILE",
X"CANTOR",
X"CARDINAL",
X"CARMEN",
X"CAROLINA",
X"CAROLINE",
X"CASCADES",
X"CASTLE",
X"CAT",
X"CAYUGA",
X"CELTICS",
X"CERULEAN",
X"CHANGE",
X"CHARLES",
X"CHARMING",
X"CHARON",
X"CHESTER",
X"CIGAR",
X"CLASSIC",
X"CLUSTERS",
X"COFFEE",
X"COKE",
X"COLLINS",
X"COMMRADES",
X"COMPUTER",
X"CONDO",
X"COOKIE",
X"COOPER",
X"CORNELIUS",
X"COUSCOUS",
X"CREATION",
X"CREOSOTE",
X"CRETIN",
X"DAEMON",
X"DANCER",
X"DANIEL",
X"DANNY",
X"DAVE",
X"DECEMBER",
X"DEFOE",
X"DELUGE",
X"DESPERATE",
X"DEVELOP",
X"DIETER",
X"DIGITAL",
X"DISCOVERY",
X"DISNEY",
X"DOG",
X"DROUGHT",
X"DUNCAN",
X"EAGER",
X"EASIER",
X"EDGES",
X"EDINBURGH",
X"EDWIN",
X"EDWINA",
X"EGGHEAD",
X"EIDERDOWN",
X"EILEEN",
X"EINSTEIN",
X"ELEPHANT",
X"ELIZABETH",
X"ELLEN",
X"EMERALD",
X"ENGINE",
X"ENGINEER",
X"ENTERPRISE",
X"ENZYME",
X"ERSATZ",
X"ESTABLISH",
X"ESTATE",
X"EUCLID",
X"EVELYN",
X"EXTENSION",
X"FAIRWAY",
X"FELICIA",
X"FENDER",
X"FERMAT",
X"FIDELITY",
X"FINITE",
X"FISHERS",
X"FLAKES",
X"FLOAT",
X"FLOWER",
X"FLOWERS",
X"FOOLPROOF",
X"FOOTBALL",
X"FORESIGHT",
X"FORMAT",
X"FORSYTHE",
X"FOURIER",
X"FRED",
X"FRIEND",
X"FRIGHTEN",
X"FUN",
X"FUNGIBLE",
X"GABRIEL",
X"GARDNER",
X"GARFIELD",
X"GAUSS",
X"GEORGE",
X"GERTRUDE",
X"GINGER",
X"GLACIER",
X"GNU",
X"GOLFER",
X"GORGEOUS",
X"GORGES",
X"GOSLING",
X"GOUGE",
X"GRAHAM",
X"GRYPHON",
X"GUEST",
X"GUITAR",
X"GUMPTION",
X"GUNTIS",
X"HACKER",
X"HAMLET",
X"HANDILY",
X"HAPPENING",
X"HARMONY",
X"HAROLD",
X"HARVEY",
X"HEBRIDES",
X"HEINLEIN",
X"HELLO",
X"HELP",
X"HERBERT",
X"HIAWATHA",
X"HIBERNIA",
X"HONEY",
X"HORSE",
X"HORUS",
X"HUTCHINS",
X"IMBROGLIO",
X"IMPERIAL",
X"INCLUDE",
X"INGRES",
X"INNA",
X"INNOCUOUS",
X"IRISHMAN",
X"ISIS",
X"JAPAN",
X"JESSICA",
X"JESTER",
X"JIXIAN",
X"JOHNNY",
X"JOSEPH",
X"JOSHUA",
X"JUDITH",
X"JUGGLE",
X"JULIA",
X"KATHLEEN",
X"KERMIT",
X"KERNEL",
X"KIRKLAND",
X"KNIGHT",
X"LADLE",
X"LAMBDA",
X"LAMINATION",
X"LARKIN",
X"LARRY",
X"LAZARUS",
X"LEBESGUE",
X"LEE",
X"LELAND",
X"LEROY",
X"LEWIS",
X"LIGHT",
X"LISA",
X"LOUIS",
X"LYNNE",
X"MACINTOSH",
X"MACK",
X"MAGGOT",
X"MAGIC",
X"MALCOLM",
X"MARK",
X"MARKUS",
X"MARTY",
X"MARVIN",
X"MASTER",
X"MAURICE",
X"MELLON",
X"MERLIN",
X"METS",
X"MICHAEL",
X"MICHELLE",
X"MIKE",
X"MINIMUM",
X"MINSKY",
X"MOGULS",
X"MOOSE",
X"MORLEY",
X"MOZART",
X"NANCY",
X"NAPOLEON",
X"NEPENTHE",
X"NESS",
X"NETWORK",
X"NEWTON",
X"NEXT",
X"NOXIOUS",
X"NUTRITION",
X"NYQUIST",
X"OCEANOGRAPHY",
X"OCELOT",
X"OLIVETTI",
X"OLIVIA",
X"ORACLE",
X"ORCA",
X"ORWELL",
X"OSIRIS",
X"OUTLAW",
X"OXFORD",
X"PACIFIC",
X"PAINLESS",
X"PAKISTAN",
X"PAM",
X"PAPERS",
X"PASSWORD",
X"PATRICIA",
X"PENGUIN",
X"PEORIA",
X"PERCOLATE",
X"PERSIMMON",
X"PERSONA",
X"PETE",
X"PETER",
X"PHILIP",
X"PHOENIX",
X"PIERRE",
X"PIZZA",
X"PLOVER",
X"PLYMOUTH",
X"POLYNOMIAL",
X"PONDERING",
X"PORK",
X"POSTER",
X"PRAISE",
X"PRECIOUS",
X"PRELUDE",
X"PRINCE",
X"PRINCETON",
X"PROTECT",
X"PROTOZOA",
X"PUMPKIN",
X"PUNEET",
X"PUPPET",
X"RABBIT",
X"RACHMANINOFF",
X"RAINBOW",
X"RAINDROP",
X"RALEIGH",
X"RANDOM",
X"RASCAL",
X"REALLY",
X"REBECCA",
X"REMOTE",
X"RICK",
X"RIPPLE",
X"ROBOTICS",
X"ROCHESTER",
X"ROLEX",
X"ROMANO",
X"RONALD",
X"ROSEBUD",
X"ROSEMARY",
X"ROSES",
X"RUBEN",
X"RULES",
X"RUTH",
X"SAL",
X"SAXON",
X"SCAMPER",
X"SCHEME",
X"SCOTT",
X"SCOTTY",
X"SECRET",
X"SENSOR",
X"SERENITY",
X"SHARKS",
X"SHARON",
X"SHEFFIELD",
X"SHELDON",
X"SHIVA",
X"SHIVERS",
X"SHUTTLE",
X"SIGNATURE",
X"SIMON",
X"SIMPLE",
X"SINGER",
X"SINGLE",
X"SMILE",
X"SMILES",
X"SMOOCH",
X"SMOTHER",
X"SNATCH",
X"SNOOPY",
X"SOAP",
X"SOCRATES",
X"SOSSINA",
X"SPARROWS",
X"SPIT",
X"SPRING",
X"SPRINGER",
X"SQUIRES",
X"STRANGLE",
X"STRATFORD",
X"STUTTGART",
X"SUBWAY",
X"SUCCESS",
X"SUMMER",
X"SUPER",
X"SUPERSTAGE",
X"SUPPORT",
X"SUPPORTED",
X"SURFER",
X"SUZANNE",
X"SWEARER",
X"SYMMETRY",
X"TANGERINE",
X"TAPE",
X"TARGET",
X"TARRAGON",
X"TAYLOR",
X"TELEPHONE",
X"TEMPTATION",
X"THAILAND",
X"TIGER",
X"TOGGLE",
X"TOMATO",
X"TOPOGRAPHY",
X"TORTOISE",
X"TOYOTA",
X"TRAILS",
X"TRIVIAL",
X"TROMBONE",
X"TUBAS",
X"TUTTLE",
X"UMESH",
X"UNHAPPY",
X"UNICORN",
X"UNKNOWN",
X"URCHIN",
X"UTILITY",
X"VASANT",
X"VERTIGO",
X"VICKY",
X"VILLAGE",
X"VIRGINIA",
X"WARREN",
X"WATER",
X"WEENIE",
X"WHATNOT",
X"WHITING",
X"WHITNEY",
X"WILL",
X"WILLIAM",
X"WILLIAMSBURG",
X"WILLIE",
X"WINSTON",
X"WISCONSIN",
X"WIZARD",
X"WOMBAT",
X"WOODWIND",
X"WORMWOOD",
X"YACOV",
X"YANG",
X"YELLOWSTONE",
X"YOSEMITE",
X"ZAP",
X"ZIMMERMAN",
X0
X`125;
$ GOSUB UNPACK_FILE
$ EXIT

------------ end of post -----------

