_ _
.k$$$$$g, ,g$$$$$k.
.k$$$$$$$$$$$a. .a$$$$$$$$$$$k.
.J$$$$$?' `?$?^?, ,?^?$?` `?$$$$$L.
JS$$SI!a, _.JS$ ?, ,? $SL._ ,a$!IS$$SL
k$$$SI!:?$$$$$$$$$xu$$j j$$ux$$$$$$$$$?:!IS$$$k
:I$$SI:J$$?*"$$$$4^?*?: :?*?^4$$$$"*?$$L:iIS$$I:
:IS$$SiJ?` _.'$?`/' ': :' '/'?$'._ `?LiS$$SI:
?ISSik? _ ', ` . ,' _ ?kiSSI?
?i$?` _ k$ . :. $k _ `?$i?
'?I:-?z$$I _._.' ._._ I$$z?-:I?'
'*?- '?$$a louSxuS? ?xuSxuol a$$?' -?*'
i$$$$$$$$$$$S S$$$$$$$$$$$i
?$$$?- -?$$$?
██░ ██ ▄▄▄ ██▓ ▓█████ ██░ ██ ▒█████ █ ██ ███▄ █ ▓█████▄
▓██░ ██▒▒████▄ ▓██▒ ▓█ ▀ ▓██░ ██▒▒██▒ ██▒ ██ ▓██▒ ██ ▀█ █ ▒██▀ ██▌
▒██▀▀██░▒██ ▀█▄ ▒██░ ▒███ ▒██▀▀██░▒██░ ██▒▓██ ▒██░▓██ ▀█ ██▒░██ █▌
░▓█ ░██ ░██▄▄▄▄██ ▒██░ ▒▓█ ▄ ░▓█ ░██ ▒██ ██░▓▓█ ░██░▓██▒ ▐▌██▒░▓█▄ ▌
░▓█▒░██▓ ▓█ ▓██▒░██████▒░▒████▒░▓█▒░██▓░ ████▓▒░▒▒█████▓ ▒██░ ▓██░░▒████▓
▒ ░░▒░▒ ▒▒ ▓▒█░░ ▒░▓ ░░░ ▒░ ░ ▒ ░░▒░▒░ ▒░▒░▒░ ░▒▓▒ ▒ ▒ ░ ▒░ ▒ ▒ ▒▒▓ ▒
▒ ░▒░ ░ ▒ ▒▒ ░░ ░ ▒ ░ ░ ░ ░ ▒ ░▒░ ░ ░ ▒ ▒░ ░░▒░ ░ ░ ░ ░░ ░ ▒░ ░ ▒ ▒
░ ░░ ░ ░ ▒ ░ ░ ░ ░ ░░ ░░ ░ ░ ▒ ░░░ ░ ░ ░ ░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░
HaleHound-CYD v4.0
RFID and NFC landed. That's why this one's a 4.0 - the thing reads and writes cards now, and that's a whole new side of the tool.
(FUGT)
What's New
RFID / NFC
The ST25R3916 is in. New NFC driver, and the module rebuilt into seven screens. It reads MIFARE Classic, NTAG and Ultralight, ISO-DEP and iCLASS. Everything below runs on that.
iCLASS - read, decode, clone. Full card read across AA1 and AA2 with 3DES done on the board. It pulls the PACS bits and decodes 26, 35 and 48-bit formats, Corporate 1000 included. Writes both keys. A clone copies the whole card and gets verified by reading it back afterward, not by assuming. The config block is decoded into plain words instead of eight hex bytes, and the write test covers AA2 as well.
Key Check. When a card won't talk, sweep all 29 published keys and the hit is usable everywhere else in the module. There's a default-safe way into it for cards that can't be locked.
MIFARE Classic - dumps, writes and magic cards. Full card dump with nested authentication, 31 of 32 sectors chaining in a single session. Sector trailer access bits decoded on screen. Keyed write on an ordinary card. Gen1A magic backdoor read and write, keyless, proven against an independent UID. Per-sector key setting, with a trailer guard so a write can't quietly zero a card's keys. Static-nonce detection and a nonce probe, so you know what you're holding before you start.
Dumps go somewhere useful. Saved to the card as a real Flipper .nfc and a Proxmark .eml, and they load back in. The saved-dump browser opens them with no card on the antenna.
NTAG and NDEF. Read what's on a tag and write your own - URL, text, contact, WiFi, Bluetooth, app, geo and SMS records. Records stack up instead of overwriting each other, and a viewer walks every record on the card with a hex toggle. Reads past 62 bytes now, looks in the right place for the message, and tells you what's actually on there.
ISO-DEP. Stopped negotiating 424 kbps, and the whole Type 4 chain started working.
An on-device guide. Card in one hand, phone nowhere. Tap GUIDE.
Readers and access control
HID reader tooling. A BLE module for locating and stress-testing Signo and iCLASS SE readers, detected by advertised service UUID with a passive scan and a connect diagnostic. It captures the reader's reply over notifications, logs captures to the card, and reports an honest end-of-transaction status. The Artemis core sweep is split across connects, two commands at a time, so it completes instead of timing out. Card-emulation leak mode has the reader open the conversation while HaleHound answers as the card.
Network and camera recon
IoT Recon grew up. DVR and GoAhead credential exploits, a repaired RTSP digest exchange that had been making every attempt fail, a fixed HTTP path that was testing an endpoint needing no auth, telnet brute, ONVIF, TBK and Uniview enumeration. On screen you get a device list, a scrollable feed, the access URLs, a running exploit tally and proper operator controls.
Drones
The drone suite grew up. Detector, Deauth with per-target selection, Jam, and RID Spoof that bases its fake swarm on your real GPS and leashes it to a 250 metre radius. Scrollable detail, a swarm launch, and a cinematic kill sequence clipped to the content band. Modern model names in the SSID table, with the prefix decode kept out of IRAM.
KARR
Two more framings. 0xBB Counter and 0x55 encrypted. It names an unsupported framing instead of calling a live unit silent, says why a connect failed, and saves that before a power-off. The raw encounter goes to the card, not just the verdict. Max BLE TX power for weak-signal targets, and the title bar strobes on a fresh detection.
Radios and sensors
Nice Flor-S keyless rolling-code decode. And KeeLoq now requires the decrypted function code to match the plaintext button before it believes a read.
A 24GHz Rd-01 radar module, plus wider KARR recognition and identity reads.
FlockYou picks up Axon and Utility body cameras, and a contaminated OUI table got cleaned out.
Boards
AWOK Dual Touch v3. CC1101 and nRF24 wired onto the panel-shared VSPI bus, the SD card put into service, GPS covering the whole CASIC baud set, and the right touch bus named per board.
AWOK MINI. A native 128x128 joystick interface across the whole board - animated boot splash, a living home screen, an honest WiFi analyzer, a pulsing threat state on the Guardian, and it never idles to sleep.
The 4.0-inch E32R40T is its own board target now.
Under the hood
One NDEF implementation. The decoder, the eight record builders and the URI prefix table existed four times across the firmware. They're one file now, host-tested by a 50-case harness that builds with plain g++ and no ESP32 toolchain. Every label and value on screen is unchanged on purpose - what the modules gain is the best version of each, including more URI prefixes and long-record support.
Faster drawing. Gradient bars batch into fillRects and animation gates went to 30fps.
The SD runs at 20MHz instead of the 4MHz library default.
RAM baselines measured and bumped across all seven board targets, and a pre-ship smoke test checklist that every release runs on hardware before it goes out.
Fixes
Battery gauge was reading about 4% low and a full pack never showed 100%. It maps a loaded cell properly now and updates in every module.
Replay hands the radio back when you leave the profile menu, so it doesn't lock up on the way out.
Both AWOK radios are addressable again - two stale guards were stopping either one being reached - and a CC1101 crash and an Init() SPI deadlock are gone.
GPS shows satellites while it's still searching instead of sitting on zero until it locks.
IoT Recon revives the SD bus before the mount instead of after a failed one.
Boards
E32R35T (3.5"), E32R40T (4.0"), CYD (2.8"), E32R28T (2.8"), NM-RF Hat, AWOK Dual Touch v3, and AWOK MINI.
⣀⡀⣀⢀⡀⢀⡀⣀ ⣀⢀⡀ ⡀⢀ ⣀⢀⡀⢀⡀
⢀⡀⣛⠘⠿⢦⠤⣽⢟⣿⢻⡟⣾⡏⣹⣿⣿⢻⡟⣿⣾⣿⣿⡿⣿⢿⣿⣌⣿⢸⡷⢤⡄⢚⢀⡀
⣀⢀⣀⣀⣀⢀⣀⣈⣁⣉⣀⣀⣀⣀⣉⣈⣁⣀⣀⣀⣀⣉⣀⣁⣀⣁⣉⣉⣀⣈⣀⣀⣀⣉⣈⣉⣀⣀⣀⣀⣈⣈⣁⣀⣀⣀ ⣀
⣤⠐⢶⢻⡟⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡟⢠⡇
⢀⣀⣠⣄⣤⣀⣤⣤⣤⣤⣤⣤⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣭⣍⣭⣭⣭⣭⣥⣭⣭⣭⣭⣥⣭⣭⣭⣬⣭⣭⣥⣤⣤⣤⣤⣤⣤⣄⣤⣀⣄⣀⡀
⣴⠸⠟⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⠿⠿⠉⠉
⢀⡀⣶⣦⣶⣴⣶⣴⣤⣴⣶⣶⣼⣦⣿⣶⣾⣶⣶⣾⣧⣿⣾⣷⣾⣷⣿⣶⣶⣶⣶⣶⣦⣶⣶⣶⣶⣷⣿⣶⣶⣶⣶⣶⣶⣿⣾⣷⣴⣦⣶⣦⣤⣤⣦⣴⣦⣴⢠⣦⣤⡆⣴⣤⣤⣤⣤⣤⣄
⠸⠇⠿⠻⢿⠿⠿⠿⠿⡿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠟⠛⠃
⡤⢰⣶⣶⣶⣾⣷⣿⣶⣿⣾⣷⣿⣶⣿⣶⣷⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣷⣿⣿⣿⣾⣿⣿⣷⣿⣾⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣾⣷⣿⣧⣶⣰⣶⣤⣤⣤⣴⣶⣴⣶⣶⣶⣤⣶⣶
⠛⠘⠛⠛⠛⢿⠿⣿⠿⠿⠿⠿⠿⠿⠿⠿⠿⢿⠿⠿⠿⠿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⢿⣿⣿⡿⣿⠿⠿⠛⠛⠛⠛⠛⠛⠛⠛⠋⠛⠛⠛⠛⠛⠛⠁⠛⠘⠃⠐⠂
⢠⠶⣾⣶⣶⣶⣶⣶⣶⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣿⣾⣿⣿⣷⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣶⣿⣾⣷⣿⣷⣾⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⠶⣶⣶⣦⣤⣀
⠉⠉⠛⠈⠛⠙⠋⠙⠛⠛⠛⠛⣿⠿⢿⣻⣿⢿⡟⢿⠿⠿⠿⠿⢿⡿⣿⠿⠿⢿⡿⣿⠿⣿⢿⡿⢿⡟⠿⠿⣿⣿⡿⣿⠿⣿⢿⡟⠿⠿⠿⠻⡿⢿⡟⠛⠛⠛⠛⠛⠛⠛⠋⠙⠋⠛⠋⠛⠉⠛⠋ ⠘⠁⠉ ⠋⠉⠁⠈⠉⠉
⢰⢿⣷⣾⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⡿⣿⣿⡾⢻⡟⣿⠿⣿ ⡆
⣀⢀⡀⣀⡘⢋⣀ ⣉⣉⣉⣈⣁⣙⡛⣁⣉⣉⣉⣉⣛⢛⣛⣛⣋⣛⣛⣛⣻⣿⣿⡟⣿⣿⣿⣿⡟⣿⣿⣿⣻⣟⣻⣛⣛⢛⣻⣿⣟⣛⣿⣿⣻⡟⣿⣟⣿⢛⣛⢛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣉⡋⣛⡙⣛⠉⡀⠘⠁⠉⡈⠁⣈⡁⢉ ⠁⠈⠃
⠋⠠⠏⠘⠁⡿⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⡿⣿⢻⡿⣹⡇⣿ ⣓ ⡀
⢀⣀⣀⣈⣉⣩⣅⣄⣀⣭⣉⣍⣁⣈⣉⣩⣍⣩⣉⣭⣭⣿⣩⣍⣽⣭⣩⣭⣭⣭⣍⣭⣉⣍⣩⣍⣭⣉⣭⣩⣍⣩⣉⣭⣩⣍⣩⣍⣩⣉⣉⣉⣍⣉⣉⣭⣉⣉⣉⣍⣉⣉⣉⣩⣁⣉⢉⣉⢈⡁⣉⣀⣉⣉⣉⣁⣀⣈⣀⣈⣀⣁⣉⡁⠈ ⠁ ⠁
⠂⠚⠉⠛⠩⠟⠟⠻⣿⢿⣿⢿⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⢿⣿⡿⠿⣿⢿⣿⣿⡿⣿⣿⣿⢹⣿⠿⠏⣿⢩⣿⣿⣿⣿⣿⣿⢿⡟⢹⡟⣤
⣠⣤⣤⣤⣤⣤⣤⣴⣤⣤⣤⣤⣤⣤⣤⣤⣤⣤⣤⣭⣼⣿⣿⣿⣿⣭⣭⣭⣭⣭⣭⣭⣤⣤⣤⣤⣤⣬⣥⣤⣄⣬⣭⣥⣬⣥⣭⣅⣤⣤⣬⣤⣄⣠⣄⣤ ⣤⣠⣤⣤⣴⣮⣤⣤⣤⣤⣤⣤⣤⣤⣤⣄⡀⣠⢀⣄⣤⣤⣤⣠⣤⣤⣀
⠈⠉⠛⠛⠿⠿⠛⠿⠿⠿⠿⠿⢿⠿⣿⠟⠿⠸⠟⢹⡇⢿⠘⠿⠻⠿⠟⠻⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⣿⢿⡿⢿⠿⠿⠿⠿⠿⠿⠿⠿⠿⢻⡟⠛⠃⠛ ⠚⠘⠏⠛⠙⠛⠻⠿⠿⠿⠛⠹⠟⠙⠃⣿⠰⡾⠛⠋⠿⠣⣿⠻⡿⠻⠇⠰
⢴⣤⣶⣶⣶⣶⣦⣶⣤⣤⣴⣤⢤⡄ ⣤⢠⣶⣶⣶⣶⣶⣶⣶⣶⣶⣶⣦⣶⣤⣤⣴⣶⣶⣶⣶⣶⣶⣦⣤⣠⣄ ⣤⠠⡆⠠⣤⣤⢠⣶⣶⡶⣤⡤⢤ ⣠⡄⣀
⠘⠋⠛⠛⠉⠋⠉⠿⠉⠿ ⠁ ⠉⠈⠁⠉⠉⠉⠉⠉⠉⠉⠋⠹⠿⠻⠏⠻⠿⠿⠻⠿⠿⠿⠟⠛⠛⠃ ⠈⠁⠘⠁⠉⠉⠛⠙⠃⠛ ⠋ ⠰⠆⠈ ⠴
⢀⡶⣶⡐⢶ ⠆ ⠠⠤⣦ ⣤⢲⣶⣶⣶⣶⣤⣤⢴⣦⢶⣶⣤⣶⣶ ⡴⢐⡆⢶⣰⣶
⠈⠁⠋ ⠂ ⠛ ⠋⠘⠛⠘⠋⠛⠛⠋⠙⠛⠛⠋⠚⠋⠛⠘⠃ ⠈⠁⠈⠁ ⠚
⢰⣷⣦⣴⣿⣾⣷⣶⣦ ⢰⡆⢲⡆
⠛ ⠉⠁⠉⠉⠋⠙⠋⠁ ⠈⠁⠈⠁ ⠛
⣀ ⣀ ⢀ ⣸⠹⣿⣿⡟⣿⢿⣿⢿⡽⠿⠞⢿⠃ ⣹⡟⣿⠇⣀ ⢀⡀⣀
⣉ ⠉ ⢀ ⡀⢀⣀⢈⡁⣉ ⠉⠈⠁ ⢀ ⡀ ⠉ ⠈ ⡉ ⡀ ⠈⠁⢉
⢘⡃⣿ ⣛⢀⡀ ⠈⣧⢸⡿⢿⣷⣹⡇ ⠘⠈⠃ ⠠⠶⢶⡿⢹⡟⣀ ⢀⡀⢘⡇⣿ ⣟⢀⡀⢀⡀
⣀⣀⣀⣀⣁⢈⠁ ⢠⣄⣀⣀⣉⣈⣀⣈⣁⠉ ⡀ ⡀ ⢀⡀⣈⣀⣄⢀⡀⢀⡀ ⢀⣁⣀⣁⣈⣀⣁ ⡁⠈
⢠⡤⢼⣿⣿⣯⡿⠸⡇⣤⠄⢤ ⣤⢠⡄⢿⠶⠿⢾⡟⣿⡏⣿⢫⣿⠹⡏⣤ ⠐⠃⠠ ⣤⠐⠶⠸⡇⢿⠻⠿⠸⡇⠙⠃⣤⠠⡤ ⢤⡄⣤⠈⠛⢽⠏⢿⠛⠿⠠⡇⢤⠄
⣠⣄⣤⣤⣤⣤⣤⣤⣄ ⣠⡄⣤⣀⣤⢀⣄⣠⣤⣄⢀⣄⡀ ⡀ ⢀ ⣠⡄⢀ ⣤⣀⣤ ⡀⢀ ⡀ ⡀⣠⣤⣤⣤⣤⣤⣤⣀⣤⣤
⠐ ⠒ ⣶⠰⠦⠉⠹⠟⢹⡿⠿⠋⠾⠛⠿⠛⠿⠉⠉⠉⠉⠉⠙⠛⢿⠟⢿⠸⡟⠻⠟⠛⠿⠟⠘⠇ ⠉⠁⠈ ⠈ ⠂ ⠶ ⠆⠘⠏⠉⠉⠉⠰⠆⠰⠆⠴⠈⠇⠘⠇⠿ ⡿⠘⠇⠉⠁⠿⠹⡿⠿⠋⠿⠉⠉⠰⠆⠰⠂
⣶⣴⣶⢶⡄⣀ ⢀⡀ ⢀⡀ ⢤⢠⣦⣤⡴⠲⡦⢤ ⣀ ⢀ ⣤⢀⡄⣠⡄⣠ ⡄ ⠴⠄⣶⣦⡴⢦ ⢠⣦⣶⣦⣴⣄⣀ ⣀⡀
⠉⠛⠛⠿⠆⠿⠰⠇⠰⠟⠛⠛⠛⠰⠆⠶⠆ ⠛⠈⠁⠘⠃⠈ ⠰⠆⠴ ⠦⠰⠆ ⠈ ⠉⠈⠁ ⠉⠰⠷⠰⠇⠶ ⠶ ⠁ ⠾ ⠁⠸⠏ ⠶⠰⠆⠰ ⠶
⠰⢶⣶⣿⣷⣶⣶⢶⣶⣶⣄⣀⡠⠦⠰⠦⠶⠄⠄ ⣀⡀ ⠠⡄⣤ ⠰⠦⠶⢤⣶⣤⡤⠠⡄⢤ ⠠⠶⣺⡷⣶⣶⣶⢶⡶⠶⠄ ⠠⣤⡤
⠉⠉⠙⠛⠛⠚⠛⠉⠈⠛ ⠘⠃⠘⠃⠛⠐⠓⠘⠃⠛ ⠙⠛⠘⠃⠛ ⠛⠘⠃ ⠈ ⠘⠉⠁ ⠁ ⠐⠛ ⠛⠂
⠤⠤⢤⠄ ⢀⠰⣶⠴⠦⣶⡆⣶⢠⡄ ⢀ ⡀ ⣀ ⡀⣶⡆⣶⣦⣤⢰⡦⢶⠆⣠ ⣒⢂⣶⢐⡒⠂
⠘⠁⠉ ⠉ ⠉⠈⠁⠈⠁⠉⠈⠉⠈⠃ ⠙⠈⠃⠈⠃⠉ ⠉⠈⠁ ⠉ ⠉⠈⠛⠈⠃
⢀⡀⢀⡀⣀ ⢀⡀⣿⢈⣿⠸⣇⣴⣴⣦⣴⣦⣹⡇⣶ ⣶⠆⣿⣶⣦⣶⡄⣿⢈⣿⣿⡿⢿⡿⠿ ⢀⡀
⠈⠁⠈⠁⠉ ⣀ ⢀⢀⡀⢈⡁⣈⣈⣁⣈⣁⣀ ⠉ ⢉ ⡀⣉ ⢉ ⢀⣀⠉⢈⣁⣈⡀⣉⠁⣀ ⠈⠁
⢀⡀⢀⡀ ⠉⠃⠉⠘⠋⢻⣿⣿⣿⣿⣻⡟⣿⠰⠶⠶⠶⣶⡶⠿⢻⣄⢀⡟⠿⠿⠿⠾⠷⣿⡟⣿⢻⡿⣿⣿⣿⣟⣿⢀⡄
⠈⠁ ⡀⣠⡄⣠⢀⡀⣀⡅⣈⣩⣭⢀⡀⢀ ⠠⡀ ⠈⠉ ⡅⢠⣤⣤⣠⡄⣈⡀⣀ ⣄⣈⡀⣈⡉⠁ ⡁
⠁⠿⠁⠼⢸⡿⠻⡿⢿⢿⠟⠛⠛⣿⠤⣤ ⠁⠚⠛⠓ ⠁⠛⠹⣿⢩⡗⢤⡜⠋⠻⠟⢽⠇⢼⠟⠻⠺⡇
⣤⣄⢠⡄⣤⢀⡄ ⠄ ⢠⡄ ⢀⡀⣤⣴⣦⣤⣤⣴⣆⢰⡄ ⢀⡀
⠛⠛⠚⠳⣿⠸⡇⠺⠏⠈⠁ ⠰⠆ ⠻⠏⢿⠈⠁⠈⠋⠛⠙⢿⠻⡿⠒⠁⠶⠈⠻⠠⠆ ⠶ ⠰⠆
⢰⡆⣴⡆⠤ ⢰⣦⣴⡶⣶⢶⡦⣄ ⣀
⠈⠁ ⠸⠇⠺⠇⠾ ⠿ ⠉ ⠛⠘⠋⠈⠁⠿ ⠶ ⠶ ⠶
⣀⡀
⡀⢀⡀
⠈⠉⠈⠁
⢀⡀⢀⡀ ⡶⢰⡆
⠈⠁⠈⠁ ⠈⠉⠈⠁
⠠⡤ ⠠⡤⠠⡄⢤
⠰⠆⠰⠆⠶⠐⠶⠰⠆⠶
⣄
⠺⠐⠇⠐⠆⠲ ⠶⠐⠇⠰⠂⠲ ⠇⠐⠇⠲ ⠲⠐⠆⠸⠂⠾ ⠖
⠘⠛⠘⠃⠛ ⠛⠘⠃⠘⠃⠛⠐⠓⠘⠃⠛ ⠛⠘⠃⠘⠃⠛⠐⠛⠐⠃