MZ@ !L!This program cannot be run in DOS mode. $&Lb-mb-mb-mʡ"2c-mEc-mʡ"0k-mb-l-mR-mq-m-mʡ"ba-mEc-mEo-mEc-mEc-mRichb-mPELc! 4s!P'd"@p9 0P'85@.text34 `.data|,PB8@.rsrcz@@.relocCD@B2222223"3:3J3Z3p3~3333333334 464P4^4p444444444 5(5F5Z5n5|55555555566&686P6f666666667 767P7\7h7r7~777777778*8<8N8^8n88888888.999T9(+d(+d)+d )+d0)+dE*dg*d$q*d*d*d(+dj*dc 88}uLgI}Drexception during reading PEB Unable to read FullDllName address at %p SizeOfImageDllBaseFullDllNameInMemoryOrderLinksLDR_DATA_TABLE_ENTRY Unable to read InMemoryOrderModuleList address at %p InMemoryOrderModuleListPEB_LDR_DATA Unable to read PEB_LDR_DATA address at %p LdrPEBntdllSystemObjectUIntPtrIntPtrTypedReferenceStringDoubleSingleUInt64Int64UInt32Int32UInt16Int16ByteSByteCharBooleanVoid::__SOS Error: Out of memory PDB symbol for mscorwks.dll not loaded /f mscorwks.dllmscorwks Display of context static variables is not implemented yet GENERICARRAYSZARRAYFNPTRNative RealVALUEARRAYARRAYVARCLASSVALUETYPEBYREFPTR.%S Unknown ModuleDynamic Module%p Module Name SecurityDescriptor: %p ClassLoader: %p UNKNOWNCLOSEDCOLLECTEDCLEAREDHANDLETABLE_NOACCESSFINALIZEDFINALIZINGEXITEDEXITINGUNLOAD_REQUESTEDOPENACTIVEREADYFORMANAGEDCODECREATING] %S [ (Dynamic)Assembly: %p Unable to get array of Assemblies NoneError getting AppDomain friendly name Name: Stage: %s StubHeap: %p HighFrequencyHeap: %p LowFrequencyHeap: %p UNKNOWN%p is not a MethodDesc Invalid module token Not JITTED yet. Not JITTED yet. Use !bpmd -md %p to break on run. JITTED Code Address: %p MethodDesc: MethodDesc: %p Field name: %S Name: %S EEClass: MethodTable: EEClass: EEClass: %p MethodTable: %p Token: 0x%p not supported TYPEDFILTERFINALLYFAULTUnknown MethodDesc (Module %p, mdToken %08x)CodeAddr: %p IsJitted: %s noyesModule: %p mdToken: %08x Class: %p Method Name: %S Failed to request Thread at %p /f mscoree.dll\sos.dllUnknown option: %s Missing value for option %s Invalid option: option specified multiple times: %s Invalid option %s Wrong option: %s Incorrect argument: %s Missing quote in %s *U\ L6"ǘ%s%8s %x%8x%f%8p%I64u%u%8u%I64d%d%8d%pdynamic statics NYI Unable to get AppDomain %lx << %p: %p:FailInit %p:NotInit >> Domain:Value Unable to get array of AppDomains Unable to get AppDomain information error getting thread %p, aborting this field %x: >> Thread:ValueFree<Unloaded Type>Field (mdToken token) of Member (mdToken token) of ----------------------- Error getting string data Unable to display fields %8sinstancestatic %S %8s %8s %8ssharedCLstaticTLstatic%2s 01%20.20s %20.20S %p %8x %8x Invalid parent EEClass Invalid parent MethodTable %8s %8s %8s %20s %2s %8s %8s %s MTFieldOffsetTypeVTAttrValueNameUnable to get AppDomain %p Failed to get appdomain list Unable to get appdomain store StressLog TaskSwitch Marker BAD TIMEHH:mm:ss``ALL`LF_GCLF_GCINFOLF_STUBSLF_JITLF_LOADERLF_METADATALF_SYNCLF_EEMEMLF_GCALLOCLF_CORDBLF_CLASSLOADERLF_CORPROFLF_REMOTINGLF_DBGALLOCLF_EHLF_ENCLF_ASSERTLF_VERIFIERLF_THREADPOOLLF_GCROOTSLF_INTEROPLF_MARSHALERLF_IJWLF_ZAPLF_STARTUPLF_APPDOMAINLF_CODESHARINGLF_STORELF_SECURITYLF_LOCKSLF_BCLLF_ALWAYS(#Could not read address of string#) (Unknown function))+%#x (%s (Unknown VTable) (%s) (BAD MethodTable) Low Bit(s) Set(MethodTable: %p) (%S)UNKNOWN METHODDESC (BAD Method) (MethodDesc: %p)%-20s %4x %13.9f : ----- No thread logs in the image: The stress log was probably not initialized correctly. ----- ---------------------------- %d total entries ------------------------------------ ----- Interrupted by user ----- ------------ Last message from thread %x ----------- Task was switched from %x Could not read address of format string-------------------------------------------------------------------------------------- ID (sec from start) THREAD TIMESTAMP FACILITY MESSAGE Total elapsed time %5.3f sec Last message time %S Start time %S Clock frequency = %5.3f GHz eAcSTRESS LOG: facilitiesToLog = 0x%x levelToLog = %d MaxLogSizePerThread = 0x%x (%d) MaxTotalLogSize = 0x%x (%d) CurrentTotalLogChunk = %d ThreadsWithLogs = %d Invalid stress log chunk: %pReadVirtual failed with code hr = %x. wStress log address = 0x%p Stress log in module 0x%p Writing to file: %s dword ptr ds:[dword ptr [offset 0xEHHandler %d: %s FILTER BEGIN EHHandler %d: %s HANDLER END EHHandler %d: %s HANDLER BEGIN EHHandler %d: %s CLAUSE END CLAUSE BEGIN catch(...)EHHandler %d: %sjmpret>>> %s:%d %4d %s          ! I)"#))))"!a11))i92311999991q9y2rqqyyyyr qyy99yq     ) 9   ) y 9       - 3 33               #         !    "      Extension commands need mscorwks.dll in order to have something to do. Failed to find runtime DLL (mscorwks.dll), 0x%08x path is pointing to mscorwks.dll as well. If you are debugging a minidump, you need to make sure that your executable If that succeeds, the SOS command should work on retry. load of mscordacwks.dll. .cordll -ve -u -l will do a verbose reload. You can also run the debugger command .cordll to control the debugger's machine. For example, an IA64 dump file must be debugged on an IA64 4) you are debugging on the same architecture as the dump file. mscordacwks___.dll is on your symbol path. 3) or, if you are debugging a dump file, verify that the file in the version directory 2) the file mscordacwks.dll that matches your version of mscorwks.dll is Verify that 1) you have a recent build of the debugger (6.2.14 or newer) Failed to load data access DLL, 0x%08x | %02X ...%04X<'d<'d<'d <'d<'d<'d<'d<'dEAXECXEDXEBXESPEBPESIEDI<'d<'d <'d<'d argTabOffset = %x epilog #%2u at %04X epilog at %04X Sync region = [%u,%u] GuardStack cookie = [%s%u] ESP+EBP- varargs = yes profiler callbacks = yes edit & continue = yes localloc = yes exception handlers = yes security check obj = yes var ptr tab count = %2u untracked count = %2u stack frame size = %2u DWORDs arguments size = %2u DWORDs double align = %s fully interruptible= %s ebp frame = %s EBP EBX ESI EDI callee-saved regs = epilog end = %s epilog count = %2u epilog size = %2u prolog size = %2u method size = %04X argMask=%02X %4X argOffs(%d) =EBP%c call %d [ thisptr in %s iptrMask = %02X pop %d push %d push (iargs=%02X)] argMask=%02X]%u%si] ptrArgs=[EBX%cESI%cEDI%c call [ EBX ESI EDI thisptr in Unexpected special code %04X kill args %2d (%d) push ptr %2dptrsargs (%d) pop %2d push non-ptr (%d) (iptr) 'this' reg %s becoming %sdeadlive%s%s pointer byref this [E%s%02XH] a SP+BP-..an untracked %s%s local pinned byref [E%cP+%02XH] [E%cP-%02XH] Wrong option: stack selection wrong TEB information is not available so a stack size of 0xFFFF is assumed _itemsm_tokensm_scopem_codem_resolverFields: (%S) Invalid EEClass address Size: %d(0x%x) bytes MethodTable %p Type Name: %S Type MethodTable: %p m_handleThinLock owner %x (%p), Recursive %x None Object String: Element Type: %S Array: Rank %d, Number of elements %d, Type %s Error when reading RuntimeType field m_runtimeTypeSystem.RuntimeType+RuntimeTypeCacheSystem.RuntimeTypeSize %d(0x%x) bytes Free Object Invalid object [%d]System.ExceptionSystem.Security.SecurityException SP IP Function consistency errors. work properly. !dumpheap and !verifyheap may incorrectly complain of heap displaying, finding or traversing objects as well as gc heap segments may not we are at the initialization or shutdown of the gc heap. Commands related to It is either in the "plan phase," where objects are being moved around, or The garbage collector data structures are not in a valid state for traversal. exception during sorting exception during printing ? %8pSharedError getting System.RuntimeType.m_handle offset Exiting... Object header for %p should have a SyncBlock index of %d SyncBlock %d corrupted, points to invalid object %p Error requesting SyncBlock %d, continuing SyncBlk table validation failed %8p %8p %8p %9s STAMTA%8s %8s %8s Apartment RCWCONTEXTTHREADRuntimeCallableWrappers (RCW) to be cleaned: %p 0x%08x %S SecurityGCAssemblyIOCompletionThreadpoolSyncTask, %s%sMemoryFailed to request Context at %p (nested exceptions) (%p) %S (%p) (Threadpool Completion Port) (Threadpool Worker) (GC) (Finalizer) Ukn NTA MTA STA %5d %p %p:%p Enabled Disabled%4x %4x %p %8x XXXX <<<< ID OSID ThreadOBJ State GC Context Domain Count APT%s Exception PreEmptive GC Alloc Lock Fiber ) (Hosted Runtime: %sDeadThread: %d PendingThread: %d BackgroundThread: %d UnstartedThread: %d ThreadCount: %d Failed to request ThreadStore Failed to switch to original thread Wait ThreadpoolWorker IOCompletion ShutdownHelper ADUnloadHelper Finalizer SuspendEE Shutdown DbgHelper Gate Timer GC %5d %6x Failed to get thread type info not found for thread %d Failed to get CLR Tls data for thread %d Failed to get Tls expansion slots for thread %d Failed to get Teb for Thread %d Failed to switch to thread %d Failed to get thread ID for thread #%d OSID Special thread type Failed to require total thread number Failed to require current Thread ID Failed to retrieve Tls Data index Failed Failed to start stack walk. Current thread is not managed Error: bad threadcount (should be between 2 and 4) Validation was successful Verify that we can list threads: Success Error: unable to find the finalizer thread Error: Failed to request Thread More threads were found than specified by DacpThreadStoreData.threadCount Verify that we can list threads: Verify DumpDomain functionality: Success Error: AppDomain name incorrect unittest.exeFailed to get appdomain, error %lx Unexpected domain count Unable to get shared domain info Unable to get system domain info Verify DumpDomain functionality: Success Failed to complete stackwalking GetFrameContext failed: %lx Get frame data failed with %lx Mainy.LevelMainy.TopMainy.TheMainy.IsMainy.ThisMainy.DebugBreakFailed to start stack walk: %lx Verify StackWalk: Error: caught exception in VerifyDACInternal Setting breakpoint: %s [%S] bp %pFailed to set code notification Filter: [%p] [%x] Handler: [%p, %p] [%x, %x] Clause: [%p, %p] [%x, %x] (duplicate)catch(...) EHHandler %d: %s FAILURE: Stress log not dumped No Stress log in the image, no file written SUCCESS: Stress log dumped Attempting to dump Stress log to file '%s' Unable to find stress log via DAC MSCORWKS!StressLog::theLog-addrStressLog.txtCLR not loaded To try the command anyway, run !MinidumpMode 0 This command is not supported in a minidump without full memory Bad MethodTable for Obj at %p Other Handles: %d Weak Short Handles: %d Weak Long Handles: %d Ref Count Handles: %d Async Pinned Handles: %d Pinned Handles: %d Strong Handles: %d = 0x%p LOCALS: 0x%p %S = PARAMETERS: %p %p %S at Expected newline in documentation resource %cDocumentation for %s not found COMMAND: %s.Error loading documentation resource DOCUMENTATIONTEXTcontents------------------------------------------------------------------------------- Unsafe minidump commands are %s. Mode must be 0 or 1 enabledCurrent mode: %s - unsafe minidump commands are %s. disabledFailed to request MethodData, not in JIT code range %s is not IP (%d) OS Thread Id: 0x%x -EEThread %3d --------------------------------------------- -shortUnable to determine bounds of gc heap wrong option: %s -verifyrunning "!DumpArray %p". in parenthesis. You can also look at the token table yourself, by If a token is unresolved, run "!do " on the addr given This is dynamic IL. Exception info is not reported at this time. Not enough memory to read IL Error gathering dynamic info from object at %p Failed to read memory ilAddr = %p error decoding IL FindIL failed error in import bad import Unable to get module Unable to print IL for DynamicMethodDesc %p Unable to build snapshot of the garbage collector state Must pass a valid expression ContextStaticsSize: %x ContextStaticOffset: %x ThreadStaticsSize: %x ThreadStaticOffset: %x NumStaticFields: %x NumInstanceFields: %x ComImport, Abstract, Interface, Class Attributes: %x Total Method Slots: %x Vtable Slots: %x Method Table: %p Module: %p Parent Class: %p EEClass has an invalid MethodTable address mdToken: %p (%S) Class Name: Missing EEClass address FCALLPreJITEJITNONE %p %8s %s JIT%10s MethodDescEntryMethodDesc Table -------------------------------------- Slots in VTable: %d Number of IFaces in IFaceMap: %x ComponentSize: 0x%x BaseSize: 0x%x (%ws) mdToken: %08x Unable to retrieve EEClass Free MethodTable %p is not a MethodTable Missing MethodTable address -MDInvalid parameter %s -nofieldsNot a managed object Example: DumpVC 907b50 67903084 Usage: DumpVC file %s saved Unable to write heap report Error initializing heap traversal Gathering types... Writing %s format to file %s CLRProfilerXmlUnable to open file usage: HeapTraverse [-xml] filename -xml------------------------------------------------------------------------------ %8s %8s %8s Type Name AddressDomainFree %d ComClassFactory %d RCW %d CCW %d Total %d ----------------------------- Free %S %p %8d none XXX %5x orphaned %9d %11d %p %5d SyncBlock %d is invalid%s , continuing...Index SyncBlock MonitorHeld Recursion Owning Thread Info SyncBlock Owner Error requesting SyncBlk data -allSTA Interfaces to be released: %d MTA Interfaces to be released: %d TypeRef Types referenced in this module %8s %10s %s TypeDef Types defined in this module MetaData start address: %p (%d bytes) AssemblyReferencesMap: %p FileReferencesMap: %p MemberRefToDescMap: %p FieldDefToDescMap: %p MethodDefToDescMap: %p TypeRefToMethodTableMap: %p TypeDefToMethodTableMap: %p LoaderHeap: %p Assembly: %p SupportsUpdateableMethodsReflection PEFile Attributes: Name: %ws Fail to fill Module %p Usage: DumpModule [-mt] -mtFailed to get appdomain %p, error %lx Domain %d: %p System Domain: %p Shared Domain: %p Fail to fill AppDomain Parent Domain: %p Fail to fill Assembly Invalid Assembly %s Special thread information is not available in mini dumps. -live-specialThe current thread is unmanaged b9: %S b8: %S b7: %S b6: %S b5: %S b4: %S b3: %S b2: %S b1: %S Watson Bucket parameters: Can't get Watson Buckets Not supported on mini dumps. Failed to examine a WorkRequest CurrentLimit: %d MaxFree: %d Free: %dTotal: %dCompletion Port Thread:Number of Timers: %d Unknown Function: %p Context: %p AsyncTimerCallbackCompletion TimerInfo@%p AsyncCallbackCompletion AsyncCallback@%p QueueUserWorkItemCallback DelegateInfo@%p Work Request in Queue: %d MinLimit: %d MaxLimit: %d Idle: %d Running: %d Total: %dWorker Thread:CPU utilization %d%% Failed to request ThreadpoolMgr information %p is not a valid object AppDomains. the Thread could have transitioned between multiple the AppDomain of that stack with !threads. Note that !gcroot %p, and if you find a root on a stack, check methods of finding the AppDomain failed. Try running The type is declared in the shared domain and other Error getting AppDomain %p ID: %d ID: (system domain) Name: System Domain ID: (shared domain) Name: Shared Domain AppDomain: %p Error getting AppDomain information Failed to perform EHInfo traverse Unable to get codeHeader information No EH info available %p is not a valid MethodDesc Pointer table: Method info block: Could not read memory %p GC info %p preJIT generated code Normal JIT generated code GCinfo for EJIT not supported unknown Jit entry point %p No GC info available Cold region: Hot region: Failed to gather EHInfo data Begin %p, size %x Begin %p, size %x. Cold region begin %p, size %x EJIT generated code not a valid MethodDesc Not jitted yet Unmanaged code -ehinfo-gcinfo retail buildSOS Version: %u.%u.%u.%uIn plan phase of garbage collection Workstation mode Server mode with %d gc heaps GC Heap not initialized, so GC mode is not determined yet. free retail Checked or debug build%u.%u.%u.%uVirtual Memory %8d %8d Page File %8d %8d Physical Memory %8d %8d %8s %8s TotalAvailMemory Availability (Numbers in MB) %ld percent of memory is in use. PagefileUsage: %8d KB PeakPagefileUsage: %8d KB VirtualSize: %8d KB PeakVirtualSize: %8d KB WorkingSetSize: %8d KB PeakWorkingSetSize: %8d KB Process Memory NtQueryInformationProcessntdll.dllTotal CPU time : %d days %02d:%02d:%02d.%02d User CPU time : %d days %02d:%02d:%02d.%02d Kernel CPU time : %d days %02d:%02d:%02d.%02d Process Started at: %4d %s %2d %d:%d:%d.%02d Process Times GetProcessTimesKernel32.dll%dSEnvironment_RTL_USER_PROCESS_PARAMETERSProcessParametersEnvironment --------------------------------------- -mem-time-env!ProcInfo is not supported on a dump file. JanFebMarAprMayJunJulAugSepOctNovDecModule: %p (%S) * you can pass * for module_name to search all modules Usage: Token2EE module_name mdToken !Name2EE *!System.String Examples: !Name2EE mscorlib.dll System.String.ToString use * for module_name to search all loaded modules or !Name2EE module_name!item_name Usage: !Name2EE module_name item_name more info. Note: Roots found on stacks may be false positives. Run "!help gcroot" for Invalid argument %s -nostacksex: StopOnException -create System.OutOfMemoryException 1 [] usage: StopOnException [-derived] [-create | -create2] Breakpoint set Error setting breakpoint: %s sxe %s "!soe %s %s %s;.if(@$t%d==0) {g} .else {.echo '%s hit'}" clr-c2-cFailed to execute the following command: %s r$t%d=1There is no current managed exception on this thread Error initialized register $t%d to zero r$t%d=0Pseudo-register number must be between 0 and 19 Live debugging session required -create2-create-derived%p is not a valid object. identify a possible trend. positives. If you still suspect a leak, use this function over time to differentiate between garbage and valid structures, so you may have false A leak may still exist because in a general scan of process memory SOS can't . even though you aborted. All handles foundDidn't find %d handles: scan wouldn't be able to find those. the handle in a non-standard way, perhaps with some bits flipped. The memory may be some noise in this output, as an unmanaged application may be storing by the orphaned handle. If the number doesn't grow over time, note that there the GC Heap to grow larger as objects are being kept alive, referenced only lifetime of your application, you may have a GCHandle leak. This will cause Some handles were not found. If the number of not-found handles grows over the Quitting at %p due to user abort only read %x bytes at %p Found %p at location %p Found %p in stress log at location %p, reference not counted Searching %p... Failed to read whole or part of stress log, some references may come from stress log Reference found in stress log will be ignored Searching memory %p Found %d handles: memory scan with Control-C or Control-Break. Strong and Pinned GCHandles are reported at this time. You can safely abort the GCHandleLeaks will report any GCHandles that couldn't be found in memory. the process managed thread. You can run !threads to get a list of managed threads in Unable to walk the managed stack. The current thread is likely not a [Frame: %p] [%S: %p] %08x%08x%-8s %-8s EIP-l-p-a!VMMap requires a full memory dump (.dump /ma) or a live process. !VMStat requires a full memory dump (.dump /ma) or a live process. %p is not a Module or base address Fail to read memory Fail to create file %s Fail to read PE section info File not specified section %d - VA=%x, VASize=%x, FileAddr=%x, FileSize=%x %u sections in file Module does not have base address Invalid arg Usage: SaveModule
+%#x!%p %p (TransitionUM) (TransitionMU) Out of memory Invalid signature Invalid parameters %s %s DumpMethodSig DumpSig %S SecurityException Message: m_debugStringHResult: %lx _HResult StackTraceString: _stackTraceString Unable to decipher generated stack trace StackTrace (generated): _stackTrace %S, use !PrintException %p to see more InnerException: _innerExceptionMessage: _messageException type: Exception type: %S Exception object: %p Not a valid exception object Error retrieving nested exception info %p Nested exception ------------------------------------------------------------- There are nested exceptions on this thread. Run with -nested for details Invalid exception object %s -nested 4)dp4)d4)d6)d4)d4)d4)d 6)d4)d4)d4)dJITTED %S!%S Error processing exception notification Expecting an exception event Error in GetLastEventInformation Unable to get method name for MethodDesc %p Attempted to run: %s Unable to set breakpoint with IDebugControl::Execute: %x ba w4 /1 %p "bp poi(%p); g"This DynamicMethodDesc is not yet JITTED. Placing memory breakpoint at %p sxe -c "!bpmd -notification;g" clrnAdding pending breakpoints... MethodDesc = %p Found %d methods... Error getting MethodDescs There are multiple modules with the same name... See "!help bpmd" for more details. Usage: !bpmd Usage: !bpmd -md -md-notification!bpmd is not supported on a dump file. (System Domain) (Shared Domain) GC Handle Statistics for AppDomain %p GC Handle Statistics: A minidump without full memory may not have this information Unable to display GC handles Error getting per-appdomain handle information -perdomain_remoteStackTraceStringSimple Context information: %p %p %p %8s %8s %8s EbpEspEipContext information: Number of characters requested: %d Error: %lx _EFN_GetManagedExcepStack(NULL, szStr, sizeof(szStr)) returned: _EFN_GetManagedExcepStack(%P, szStr, sizeof(szStr)) returned: Error! -ManagedExcepStackinterrupted by user null Failed to read element at %p Failed to read bounds info from the array Failed to read lower bounds info from the array Integer overflow on array rank Element Methodtable: %p ,Name: %S[-nofields has no effect unless -details is specified Start index out of range For multi-dimension array, length and start index are supported GC Heap Size %#8I32x(%I32u) Heap Size %#8I32x(%I32u) Heap %d (%p) ------------------------------ Failed to get GCHeaps Failed to get GCHeaps: integer overflow Total Size %#8I32x(%I32u) Error requesting details Number of GC Heaps: %d Error requesting GC Heap data ======================================= Total LoaderHeap size: 0x%I32x(%I32u)bytes Module Lookup Table heaps: Module %p: Unable to read module %p Module Thunk heaps: Jit code heap: Domain %d: %x Shared Domain: %x Total size: 0x%I32x(%I32u)bytes Virtual Call Stub Heap: StubHeap: HighFrequencyHeap: LowFrequencyHeap: Loader Heap: -loader-gc%p %6.1fMB %p %S P?A%8s %8s %16s AddrFollowed byFragmented blocks larger than 0.5 MB: total %d objects Heap %d Failed to get GCHeaps: integer overflow Error requesting gc heap details SizeIf you need this functionality, get a full memory dump with ".dump /ma mydump.dmp" In a minidump without full memory, most gc heap structures will not be valid. -verify will only produce output if there are errors in the heap Cannot specify both -short and any of (-stat, -thinlock, -strings, -verify) wrong argument Cannot specify both -mt and -type -thinlock-type-startatlowerbound-strings-stat-max-min-verify ---------------------------------- SyncBlocks to be cleaned up: %d %8p %8p %8p %8p %8s %8s %8s %8s SyncBlockCCWComClassFactorySyncBlocks to be cleaned by the finalizer thread: -detail %8x %8x%3d %4x %p ID TEB APT APTId CallerTID Context Error! integer overflow on numThread 0x%08x Not an array, please use !DumpObj instead -details-length-startSOS failure SOS failure! hQ^nA$$>:Las9V'GOd,kO, OC'rp:ݯDOV?1:HogP&(΄E~gi/^z閏F :ĠI#g6DK~LBOES_GW4։You can create one with .dump /ma sos.dll needs a full memory dump for complete functionality. ------------------------------------------------------------ %p(%S) %p(%S)-> Root:%s:Scan Thread %d OSTHread %x eaxebxecxedxesiediebpHANDLE(Unknwn):HANDLE(AsyncPinned):HANDLE(WeakLn):HANDLE(WeakSh):HANDLE(Strong):HANDLE(RefCnt):HANDLE(Pinned):DOMAIN(%p):Searching for the first %d handles, ignoring the rest Error reading card bits Error getting next card table Error getting card table lowest address object %p: missing card_table entry for %p object %p: bad member %p at %p object %p: fail to read members object %p: bad GCDesc object %p: bad MT object %p: size %d too small t %d 0 %S o 0x%p %d %d ! 1 0x%p %d n %d 1 %d %d 0x%p r stackhandleNot enough memory to trace the heap %s: %p (invalid object) sizeof(%p) = %12I32u (%#12I32x) bytes%s: Error during heap traverse Walking heap... tracing roots... Finalizer queuePlease note that %p is not a valid object. Total %d objects %9s Free%p %8d %12I32u %8d %12I32u "%S" %8s %8s %12s %s Class Name%8s %12s %s CountTotalSizeString ValueStatistics: none (0x%p, 0x%p) ephemeral segment allocation context: generation %d starts at 0x%p Error requesting heap segment %p %p %p %p 0x%p(%d) Large object heap starts at 0x%p segment begin allocated size []Unable to read memory at %p strike: Failed to store segment More than %d heap segments, there must be an error Object %p has no generation :%x) %p(%xWasted: 0x%x(%lu)bytes. Size: 0x%x(%lu)bytes. Total size: 0x%x(%d)bytes Unable to get code heap info Error getting EEJitManager code heaps Unknown Jit encountered, ignored Size: 0x%x(%d)bytes. HostCodeHeap: LoaderCodeHeap: Unable to get array of JIT Managers Unable to get JIT info CacheEntryHeap: DispatchHeap: ResolveHeap: LookupHeap: Wasted: 0x%x(%lu)bytes. IndcellHeap: Ready for finalization %d objects (%p->%p) generation %d has %d finalizable objects curr_object: %p > heap_segment_allocated (seg: %p) ---------------- curr_object : %p object %p: does not have valid MT Last good object: %p curr_object: %p > end_youngest: %p Not enough memory for complete fragmentation report ThinLock owner %x (%p) Recursive %x %p %8d%s Traversing a gc heap failed Failed to get GCHeaps: integer overflow error Failed to retrieve segments for gc heap MARETFLARASTSMORPREVSGPECAMRIIPAMDFDTDTRMOcodelabelendmacillegalreadonly.refanytypesizeofrethrowinitblkcpblkconstrained.initobjtail.volatile.unaligned.endfilterlocallocstlocldlocaldlocstargldargaldargldvirtftnldftnclt.uncltcgt.uncgtceqarglistprefixrefprefix1prefix2prefix3prefix4prefix5prefix6prefix7conv.ustind.ileave.sleaveendfinallysub.ovf.unsub.ovfmul.ovf.unmul.ovfadd.ovf.unadd.ovfconv.ovf.uconv.ovf.iconv.iconv.u1conv.u2ldtokenmkrefanyckfiniterefanyvalconv.ovf.u8conv.ovf.i8conv.ovf.u4conv.ovf.i4conv.ovf.u2conv.ovf.i2conv.ovf.u1conv.ovf.i1unbox.anystelemldelemstelem.refstelem.r8stelem.r4stelem.i8stelem.i4stelem.i2stelem.i1stelem.ildelem.refldelem.r8ldelem.r4ldelem.ildelem.i8ldelem.u4ldelem.i4ldelem.u2ldelem.i2ldelem.u1ldelem.i1ldelemaldlennewarrboxconv.ovf.u.unconv.ovf.i.unconv.ovf.u8.unconv.ovf.u4.unconv.ovf.u2.unconv.ovf.u1.unconv.ovf.i8.unconv.ovf.i4.unconv.ovf.i2.unconv.ovf.i1.unstobjstsfldldsfldaldsfldstfldldfldaldfldthrowunboxconv.r.unisinstcastclassnewobjldstrldobjcpobjcallvirtconv.u8conv.u4conv.r8conv.r4conv.i8conv.i4conv.i2conv.i1notnegshr.unshrshlxororandrem.unremdiv.undivmulsubaddstind.r8stind.r4stind.i8stind.i4stind.i2stind.i1stind.refldind.refldind.r8ldind.r4ldind.ildind.i8ldind.u4ldind.i4ldind.u2ldind.i2ldind.u1ldind.i1switchblt.unble.unbgt.unbge.unbne.unbltblebgtbgebeqbrtruebrfalsebrblt.un.sble.un.sbgt.un.sbge.un.sbne.un.sblt.sble.sbgt.sbge.sbeq.sbrtrue.sbrfalse.sbr.scallicallpopdupunusedldc.r8ldc.r4ldc.i8ldc.i4ldc.i4.sldc.i4.8ldc.i4.7ldc.i4.6ldc.i4.5ldc.i4.4ldc.i4.3ldc.i4.2ldc.i4.1ldc.i4.0ldc.i4.m1ldnullstloc.sldloca.sldloc.sstarg.sldarga.sldarg.sstloc.3stloc.2stloc.1stloc.0ldloc.3ldloc.2ldloc.1ldloc.0ldarg.3ldarg.2ldarg.1ldarg.0breaknop4ƻ4`ד 4`%x (%p)"%x "%x %S%x "%S"Error, unexpected opcode type (%ldIL_%04xVAR OR ARG %d%s %*sIL_%04x: /* UNKNOWN TYPE (0x%X)*/><METHODmethod [BAD: RANK == 0!][ERROR! NIL TOKEN]class valuetype typedrefstringobjectnative floatnative intnative uintfloat64float32uint64int64uint32int32uint16int16uint8int8charboolvoid& pinned[] [ERROR: INVALID TOKEN TYPE 0x%8.8X] .module %s.$%s$%X [ERROR: INVALID TOKEN 0x%8.8X] [*]%S::%S<unknown method def>%S::%S <unknown type token><unknown type spec><unknown member ref><unknown field def><unknown type ref><unknown type def>STRING %x"%S"...%*s} // end .catch %*s} // end .finally %*s.catch %*s{ %*s.finally %*s{ %*s} // end .try %*s.try %*s{ ExWrCpExRdWrExRdExWrCpRdWrRdGNCNA~~~~~~~~~~~~~~~~~~~~~~~~~%-7s %*s %*s %*s %*s %*s TYPEMINIMUMMAXIMUMAVERAGEBLK COUNTTOTAL%-7s %*sK %*sK %*sK %*s %*sK SummaryLargeMediumSmall%s: %08lx|CommitReserveImageMappedPrivate%p-%p %p %-13s %-13s %-8s %-8s %-*s %-*s %-*s %-13s %-13s %-8s %-8s StartStopLengthAllocProtectProtectState[UNMANAGED][PROPERTY][LOCALSIG][FIELD][VARARG][FASTCALL][THISCALL][STDCALL][C][DEFAULT]INTERNALCMOD_OPTCMOD_REQDGENERICArraySZArrayObjectFNPTRRUIVALUEARRAYTypedByRefGENArrayMDArrayCopyCtorClassValueClassByRefPtrStringR8R4UI8I8UI4I4UI2I2UI1I1CharBooleanVoidEndUnsupported token type . mdToken: %08x (%ws)Module in Dynamic Unable to get IMetaDataImport for module %p NoName[InvalidReference]MT ),([hasThis] [explicit] PINNED <ELEMENT_TYPE_SENTINEL> [explicit] [hasThis]alahblbhclchdldhaxbxcxdxsidibpspesp (JitHelp: %s) (MD: %S) (Object: %S)") (" (MT: %S)(%S[])%-8s %p %08x (MethodDesc %#x %S) (stub for %S) [%s:%d]%S)+%#x (MethodDesc %#x %08x %08x ntdll!KiUserExceptionDispatcher exr@%xcxr@%xCode %x ====> Exception , calling ChildEBP RetAddr Caller,Callee Current frame: %p %p ESP/REG Object Name push call mov jmp (%S, mdToken: %08x)lea (gcstress)%08x sticlihlt>>> bad allocationX'd$*dh*d4*d'4*d'4*dcsm 'dF*dCorExitProcessmscoree.dll.mixcrtEncodePointerKERNEL32.DLLDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAlloca,d(b,d 'dh*dh*dUnknown exception  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~=e+000~PAGAIsProcessorFeaturePresentKERNEL32(null)(null)EEE50P( 8PX700WP `h````xpxxxxccs=UTF-8UTF-16LEUNICODEEEE00P('8PW700PP (`h`hhhxppwppruntime error TLOSS error SING error DOMAIN error R6034 An application has made an attempt to load the C runtime library incorrectly. Please contact the application's support team for more information. R6033 - Attempt to use MSIL code from this assembly during native code initialization This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain. R6032 - not enough space for locale information R6031 - Attempt to initialize the CRT more than once. This indicates a bug in your application. R6030 - CRT not initialized R6028 - unable to initialize heap R6027 - not enough space for lowio initialization R6026 - not enough space for stdio initialization R6025 - pure virtual function call R6024 - not enough space for _onexit/atexit table R6019 - unable to open console device R6018 - unexpected heap error R6017 - unexpected multithread lock error R6016 - not enough space for thread data This application has requested the Runtime to terminate it in an unusual way. Please contact the application's support team for more information. R6009 - not enough space for environment R6008 - not enough space for arguments R6002 - floating point support not loaded Microsoft Visual C++ Runtime LibraryRuntime Error! Program: InitializeCriticalSectionAndSpinCountkernel32.dll ((((( H h(((( H H  !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSun Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`EH`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'^=|=&=<<=>>=%=/=-=+=*=||&&^~()>=<=%/->*+---++->operator!===!<<>> delete new__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(L'dD'd8'd,'d 'd'd'd'd'd'd-'dH'd,'d'd'd'd'd'd'd'd'd'd'd'd'd'd'dp'd'd'd'd'dԦ'd'd'd'dإ'd'dԥ'd'dp'd'd'd'd0'd'd|'dx'dt'dp'dl'dh'dd'd`'d\'dX'dT'dH'd<'d4'd('d'd'd'd'd'd'dp'dP'd,'d'd'd'd'd'dx'dt'dl'd\'d8'd0'd$'d'd'd'd'd'd`'d4'd'd'd'd'dx'd\'d-'dGetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLLSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDec1#QNAN1#INF1#IND1#SNANCONOUT$YoJ1EQ-/ԝ ,0B>V<4qG5)6JpYEgJ(;?b*U\ L6"ǘF|pFRPC QЅu} t;ur[_3^M3F]M[_3͸^F]̡+du8:,dh+dPҡ+dU +du8:,dh+dPҋ +dE#]U@EVu W}URj8URE+djEhPЅuMЋUEȉM_^]UMAwj$'d'd]'d]|'d]t'd]p'd]h'd]\'d]P'd]H'd]@'d]0'd] P+du-'d]U'd^'dg'dp'dy'd'd'd'd'd'd'd'd'd'd'd'dUS]P+dt<8t7VuW} PVW9Fh'dVWFSPVWF _^[] SM PEPQE [] U}t  +d+dVuW} xRjHURju}hPЅt _^]U+dMU HRj8URjMh PЅuX\ tUjRQPWVQHTPM MQj8MQE+djh!P҅]M̋EȉM QhMQE+djh$P҅"u}SPPM9 +d+dMQj@MQju} h"P҅9Eu`uPEhh+dS PE+dff;uftfPf;Qufu3t4 +dM9 +du}V3[_^][_^][_^]UEV0Wx uM _f^]+dMQjMQju}h'P҅uD+duu VhURj}h(PЅuf9uE MtVP[_^]U`|+d3ʼnEVuF NWPQh'd:,dF N$Ѓ tQPh'd:,d h'd:,dF,3ɺ QRBVF,WPP +djh)Qхth'd8_^M3@]S39^,$=+d8:,dPB Ѕ=+d4ߋ|WVh'd:,d+d \RhRjh$PЅuGQ\Rft'du'dPh'd:,d;Y,s +dW&BM[_3^?]UE w|$'d'd]'d]'d]'d]'d]x'd]p'd]d'd]X'd]@'d]8'd],'d]$'d]'d]R'd['dd'dm'dv'd'd'd'd'd'd'd'd'dUPS]CKPQh'd:,dSCRPhl'd:,dK$S QRh\'d:,dCD$PPhP'd:,dCK Ѓ tQPh'd:,d hH'd:,dKh+dhMMQE+djhP҅th 'd:,d[]f=+d+du'dVPh'd:,ds<3ɋƺW Q>uh'd_^[]C_^[]_^+d[]UpS] VuWf3t9=+duE+dURjhURju}hPЅtWVh'd _^3[] +dShURju}hPЅtMh'dQS= _^3[] _^[] UE MPfEPEPM +djEhQ] US]VWPu} +‹ЋǍpu+;s _^3[]ÍPu+LljM p$u+ƍt8;r.P>Q>;uM ;M sՋ];r \t:u_^[]UEpRhURE+djEh$P]U@EURj8URE+djEh P]UpEURjhURE+djEhP]UExu +d;Hu+d;P u ]3]UVu 3W}~M 99t ;|;uxE<};ubSRj'dP'd؅u[_+d^]uPQS< Rj'dP'd[_^]UVuj,VA@tM<,SWt0} ?t4Pq<Qf<;uF<,u_[^]_[3^]3^]U$`|+d3ʼnEEM VuRjR+djh'PЅ 4:,dSW8SSjRQO'{Wh'dm_^3[M3']Q6uH>tC=+d/8:,dPB Ѕ=+d NQ^6t?-tq}];EEnMURTRVWuW:,d]EEU ʋItw}5+ǃOKPWEjPP2}E}]=+d88:,dQ P҅=+dPMQ/t;]]rFEE|{ CQ5tSR 5tC=+d8:,dQ P҅z=+dwGP4u?Q4uJ>tC=+d48:,dPB Ѕ=+dNQc4tCURPVWuWM:,dUEEKSPQR^C[twE9E}t~?_^[M3<$]+dgWh'dvj_^3[M3$]Wh'dSj_^3[M3#]Wh'd0j_^3[M3#]MQh|'d j_^3[M3#]URh\'di_^3[M3|#]EPhH'diM_^33[V#]̡+dh+dj(jjhDPҹC,d趞8a+dFEM; uU ;Tu ]E|E;u|M赳5'd;}Et PjP'dU^_[]+dEPjP'd^_33[]ELQRh'dnE M3^_33[]h'dLEM^_33[]h'dh'd#EMM^_33[]UE VuWRjHURE𡰠+djuh3P}}Ѕt _33^]+dU Rj8URjMh!PЅu +dU DRhURjMh$PЅyhd+dQRPMU +dQM߮>E;EԋMSn;Me P+dWjURVHEME PQj[U Rj'dP'dMEM thUP+dRPcuT39u~rEL𡰠+dQRPLcu$9}t4;u|ҍM ڰEU[_^]M ð[_33^]E TMUM 螰EU[_^]EMPQE ‰Uu5t1u)+dSRL#u EMMEEU[_^]UX`|+d3ʼnEM EMQjj+djhP҅3S3V QNVF +dVRRSShPЅt%h'dmAVm^[M3] B3 1Pj'dP'dW3 L+dQRP0 l$3ɺ Qcol40VP+dQRP 39l`L+dQRPx3ɺ Q|x؋SP+dQRP39٢D4 +dPVQ趩SRV3f9t$ fEEuƄtFPRu5PQRuPQntVRPQ蟿; S3;lYV;Vu_^[M3 ] h'dO>h'd@>t V1t S$V_^[M3] V^[M3] ̋A$;A uyAuAËVrW~ljq$8u)+փ s8t_A^Ã8u_A^U EPQ'dUREPj'dMQVh('dURjh'd'dtƋ]3ɋt2VWJttpy ;~ r wI;Nv‹u_^U}u @'d]SVWIb+dLa+dEtQȋuHb+d+OuȃHb+dGuf<'dfmLb+d|_^Hb+d[]UVWwtƋvP+;wuEt W_^]U츘`|+d3ʼnEEMES]Vu$W} $Qh!'dW4U RPh!'dWShh +dDž{<{u G}<}u G{<%<%u)j|Qh'dƄ5|,+ux^_[M3_]+d^_3[M3@]M_33[,]U 8:,dSVuW}W}jW} WjREUPChQЋMj W_^[t] UVuW39[u_^]j h%'dQ u _^]jh%'dP u_^]_^]US]tPu,t t[][]UVuVCtO8]t<9t5=+d8:,dPB Ѕtq=+d9]uċ8]uStWP2uG,tB t=9+d8:,dQ P҅tq=+dur+d^]ItQu ,t u9:t2=+du)8:,dQ P҅t=+du+d[^]UMjEPQHM htHuU ]UES] VWMQEE}?-Eu Ejh%'dW tRpjEPWu htHuutQu ,t u}t >]u8}t=}E tډ}tjjPP_+_^[]] }uw] jh%'dWu uwu< tB +d<+t-8:,dQ P҅t~ +du~F< ulju>+t}}tijh%'dW uw<( +du48:,dQ P҅tq +duF<(uu+du_^3[]uEPu>(nMQVU:)S+_^[]_^+d3[]>(uEPVM9)uy]wjjSPq+_^[]UEh +djdURE+djEh;P% +d]UW39yM S] V}I1u~(E;FuA;^ u<QPWh&'d& >u~8t h&'d&h&'d&U;Vu;^uP賯PWh`&'d& M;Nu;^uR華PWh@&'ds& E;F u;^$uQkPWh &'dO& >u#U;V0u;^4ujCPWh&'d'& ME@;y^[_]UX`|+d3ʼnESVW 萲EڍRjhRR4:,dSWPA(3ɅDžtX4:,dQjjQPҋt+t'3ɺ Q=+d8:,dQ P҅te=+d8:,dRjhRjRRPAhЍQ$_^[M3Z]_^+d[M3=]4:,djQSQPҋ+dDžus8:,dQ P҅tX+duXL#t74:,d:SjjjQPGRЋ +dty+dSQ}Tx>Iuӡ8:,dPB Ѕt+du #Lt tyŃ~Wt#NuAu8:,dPB ЅV+dR;Džd$8:,dQ P҅+dL#t=4:,d:SjjjQPGRЋ +dt;w ;ue;sM\8:,dPB Ѕ=+d9 #Lt t ;r4:,d3WhQWjQWP҅t!PQ tlPh&'db!~TI+d? u t/8:,dPB Ѕh+deƃ;_=+d8:,dPB Ѕ=+dt)Qh&'d RW #LUuRPh&'dG  NjT;sL +d#Tu898:,dQ P҅ +d;r;u)3ۉ3;+dQ8'dS,t$=+d8:,dQ P҅=+d8:,dRjhRjRRPAhЍQ;w.r;w(+ϋ…wr(w;_;R4:,dSjhSSRQ(WP҅}B9~h&'dQ@ufh&'dR(uN9u@$:utP:Quu3;}k+dtV8'dSZ+dtP8'dW<+dtP8'dQtP8'dRsM_^3[]UEPh;'d?hP;'d5h:'d+h:'d!h:'dh(:'d h9'dh9'dhl9'dh'dh 9'dh8'dh8'dh'dhH8'd@h8'd]UM EUjMMjEEMMQEEjUh%Pҋ]UUE MUURjEEUREEjMhFPЋ]UUE MUURjUREEjMhAPЋ]UEQjM QjhCP] UEQjhM QjhP] UEQj`jjhP]UEQhjjh-P]UEQhM Qjh,P] UUERU Rjjh+P] UUE MjjEEUUREEjMh7PЋ]UUE MjjEEUUREEjMh8PЋ]UME jjMMQEEjh6Pҋ] UEQjjjh9P]UEQjjjhPB$]UUERURU RjhP]UUERU hRjhGP]̋3ɉ@HH HHHHH H$H(H,H0H4H8VF4t Pv8t V^̋3ɉHHH HHHHH ̊SVWτyÃx_2^[QSUV$+W&'dfҤq$D$$T(dWtuS\$Ul$VwvFI~$~ uh;'dMQh;'d҃ h;'dЃwh;'dыT$D$^][_L$ T$ _̀y tD$ Ph;'dу̃SUVWT$(ًω|$|$t$$֋#9n D$$D$u T$D$D$|$$F 9nu T$D$L$|$$N9nuT$xT$|$$V9nu(T$[D$ωFKL$|$$Nl$(URhH?'dQh(?'dF Ph?'dVRh>'dЃ F'du'd Ph>'dыh>'d҃ Ft h>'dЃF t h>'dуF@t h>'d҃Ft h>'dЃ h'dуF'du'dPhl>'d҃F'du'dPhL>'dЃF'du'd Ph,>'dVRh>'dЋNQh='dҋF Ph='dыVRh='dЃ(Ft h|='dуFt h\='d҃F t h<='dЃF@t h='dуFt h<'d҃Ft h<'dЃFtF<'du<'dPQ h<'dу FtVRPh<'dЃ N$<w-t NU+Rhl<'dЃ}3D$D$(vnѽɋyу„xL$l$$ȋD$(QPL$ hL<'dVD$4|$0 ;‰D$(r|$tAЃoyEЃxVh0<'d|$,Ѓ3+|$t0+vL$)VRlh'd;rЋD$$+D$_^][ ̃,SUVWL$@3At$8T$tAT$t\$ t\$@t\$I ;ʉL$ T$,D$@X)T$ "ȀS?T$(nD$y$ IET$(ЃʄxD$@tًD$(l$,+PVωl$4sL$@ŃAD$(tыBD$;rB+}UPhB'dURhA'dЊD$4 A'du-'dA'du-'dQPhA'dу |$ T$@B3;ʼnD$ l$Zغ)T$ t$Ny؃x D$(^y D$(у„xt$(L$كɉD$$Vy"T$, T$,уڄxD$+QPŃl$,l$$Uh;'dD$0l$ ҋhA'dЋSh;'dыT$TBA'duA'dL$,QPhA'dҊD$4 A'du-'dA'du-'dQPhA'dЃ |$ 3L$@At$l$D$D$ۉ\$,D$+QӃP& t$t Uh;'d҃@|A'dutA'dP;'dPhXA'dу |$t hPA'd҃|$t hHA'dЃh'dуRD$sӃ@uY@t l+D$D$+QP` t$t Uh;'d҃D$Ph,A'dуHGg(d$f(dD$D$T$,l$,T$΃D$xD$+QPUωt$;\$ShA'dҋD$H@u(D$+Ph A'dD$$ыh'dЃhA'dҋh'dЃD$+QP:Uωt$\$Sh@'dҋD$H@*CPh@'dD$$уT$D$+RPUωt$\D$Ph@'dуfT$kT$T$LSh@'dЃ:^3D$D$,D$ D$$D$(D$$dg(dF^Ѓ ʉL$˃Ń,G^ÃD$ȃL$,D$ nL$ =l$L$T$,nD$ D$$t$(ȃtD$D$+QP4h@'dt$ҊD$th@'dЃ th@'dуv@nh|@'d҃]؃D$l$D$+QP t$t Uh;'d҃hl@'dЃtL$ Ƀ Qhd@'d҃tD$ $ Ph\@'dуtT$ ҃ RhT@'dЃL$@Aut h>'d҃|$$hH@'dЋ\$, ɺkyMكÄx\$(ڃ\$(D@'du-'dPQh<@'dѽ 9l$$v h$'d҃)l$$uh8@'dЋl$h'dуL$Qh(@'dҋD$4t Ph@'dЃh'dуl$$ @ u;D$+RP t$t Uh;'dЃh@'dу멍T$0~D$+RP t$t Uh;'dЃL$0Qh?'d҃^?uT$,.l$,CD$@\$,&D$+QP5 t$t Uh;'d҃D$@Ph?'dу3D$D$D$@t+`6'dʋL$ à g(d$g(dT$$HD$+QPuT$$Rh?'dt$Ѓ;D$+QPJ <'dRh?'dt$Ѓ ȃ^D$$L$ L$D$@OT$(Ή\$ T$\$(,\$ ؋,P6'dL$\$(D$+RP t$t Uh;'dЃSh?'dыD$,D$ D$$tӀ҃ Rhd@'dЃD$ tˀɃ Qh\@'d҃D$ t$ PhT@'dуD$ tۃ Sh?'d҃h8@'dЃ|$@t>\$Sh?'dуv#T$4cT$4Rhx?'dЃu݉t$*D$t Phh?'dуD$$t Ph@'d҃h'dЃD$$"D$+QP1h'd҃_+D$4^][, ^(d](d^(d$^(dZ_(d_(df(dt_(d`(d9`(dw`(d`(d_(d9`(df(d}d(dd(dd(df(db(d̸9D$u L$ +d ̃0SV<:,dT$RPA0Ћt$<~uL$NF 9,djjT$RRPC QЅt[=+d8:,dQ P҅=+dFP8ujjF 9,dT$RRPC QЅu~uv9,dT$ D$ D$RPA<ЋT$ jjL$$QR̝tF;D$$vL$ ;wFt;vN~uhPB'dYFFN;Ns'h$B'd9^[0^+d[0V^[0̃XS\$dU=l$l1+dVt$hWT$ RjHT$ Rj3t$(|$,hPЅL$,T$(jhB'dQRWVuWjL$xQ P+dPfT$p+dWRPL$,uiIL$,T$(jhB'dQRP$Pnu"T$pWjL$Q P+dR茙D$ +dWPQi{,T$,D$(L$pjhB'dRPWQuL$pWjT$|RQ P+d T$t+dWRPL$,hu{L$,T$(jhB'dQRP$Pt~XT$tWjL$tQ P+dR˜|:D$l +dWPQL$,Hhu T$,D$(L$ljhB'dRPWQHt _^]3[XL$ljjT$RQ P+d]D$T$xjP+dPg_^][X]3[X̃x+dV$WT$Rj8T$Rj3t$|$h PЅ6+dh+dhT$Rjt$|$hPЅh+dh'dWVh}E(})Md Y_^[]ËehG'dËehpG'd4M)EMd Y_^[]S\$Vt$W|$?hh+dV8D'd+dff;uftfPf;Qufu3uEjhtC'dPVPS7iG hG'd|+dWRjjjhP;73VSh4'd: VS0 t3;Gu ;W uhG'd';Gu ;Wuh\'dRPhG'd hG'dhl'dG P+djjT$$RPKu9L$PQhG'dT$( hh+dRh+dh'd_^[̃P+dT$RjHT$RjD$h4PЅthH'dDPËD$HV;W"=+d8:,dQ P҅=+d+dT$RjHT$Rjt$h4PЅtVhpH'd|$u~L$jQuT$D$RPVh8H'dTT$jjL$Q P+dRu$D$ tu%3;uT$D$VRPhG'd1;_^P+dhG'd _^PS\$Vt$W|$(?tfu,u&hI'dhI'dhH'dhH'dhH'd øH'dtH'dL$T$PD$SVQL$ RPQhH'd u G_^[G_^[Vt$ hh+dV諘D$ D$L$h+dPQVh8I'd-^S\$3thI'dh-'dhI'd t&I'du-'dhI'dPhI'd t&I'du-'dhI'dPhI'd t&I'du-'dhtI'dPhI'd t&I'du-'dhdI'dPhI'dT  t&I'du-'dhXI'dPhI'd) @t&I'du-'dhTI'dPhI'd [y!I'du-'dhHI'dPhI'd ́ `|+d3ĉ$+dVT$4Rj8jjhPЋt'hL'd{^$3 L$4QhK'dOT$@RhK'd@D$LPhK'd1L$XQhK'd"T$dRhK'd(D$d'du'dPhK'dD$dthK'dD$hPhK'dh'dL$XT$`tK'dL$ xK'dT$|K'd$K'd$ K'd$fK'dD$d$$f$u fDŽ$SUWh(K'd=$PhJ'd+D$dL$h d$=+d8:,dQ P҅=+d39$ $Rjx$Rjh$$+dP$Ћn3Ɂ$ v_tVt$(thJ'dL9,dRHL$(Q$QP҅uD$(Ph&'d5"$$hJ'dhJ'd$$QS#$URPhJ'd$uhJ'dhJ'd$$$Q$RPQhJ'd$$T$0T$8RjT$8RD$@+djhPЋE$$ tQP D$u~8t huV0^4RSWhR'duh'dh_^[QdT$SV0WL$QR+Q+RD0Pð|^j SD1跛UR誢tMjD$PSL$Rt*t%ttvP<'dWhS譔à PIu+j Sa]_^[YVt$F(dN VjQNRVƆ ^D$%<'dVt$t0>u1D$ 3ɉF@ Q蛓u H3^W|$ >t$_^̋D$,UVP13;u)-+dH;t'Vh7'dmh7'dc +^],h\T'd4^3],=IuhLT'd^3],SD$,D$D$PD$DL$@jL$0L$QT$T$ jT$4RP th4V'd̋D$ VPBtg^ T$RjD$PL$ jL$L$(jQ+dD$,D$$[tehV'dD|$uGt$>t1<wRtP!>uԋt$>!uFPhV'dD$t P3^ S\$V;^w ^^3[U-'dWÀSjP'du _]^[t1NQPW謇 RjP'dT$>_]^V^3[FPNQWxT$ >_]^V^3[VW|$ ~w_F F^S'dt PjP'dWjP'd[#_N^S\$V;^w ^^3[U-'dW SjP'du _]^[t1NQPW识 RjP'dT$>_]^V^3[FPNQW{T$ >_]^V^3[V8tP^̋D$ VPu(+d7t&Vh7'dh7'd ^ Q^tVUp^ 5+d]T$RjD$PL$ jL$L$(jQD$,D$$ XuBV3^ |$u?=+dtW'dQ'dPhxW'd ppW'dQ'dPhxW'd UD$t,t'hXW'dtCQV3^ +dW'dupW'dPh4W'dtHV\3^ ̋D$hVPu(+dr6t&Vh7'dQh7'dG ^h\tVը^h5+dl\7t1hT'dh\T'dtQV3^hW|$xW:,dWu,hW'dHVo_3^h:,d+d3QPRL$[2t(hW'dktHV'_^hT$,D$(RPh'd9L$4 jQNtBV_3^h̋D$4VWP3;u)=+d4;t'Vh7'dh7'd _^4L[;tVPk_^45+dZq6t6hT'dsh\T'di;QV!_3^4L$L$D$ D$,L$QL$HPT$T$(T$ RD$(D$0jD$8PQ|$$|$(|$,D$@ X'd|$H|$L|$PTtV9,dT$@|$@RPADЋL$@Qh X'd9,dRL$@QPҋD$@PhX'dL$ Q;tBVK_3^4̋D$ SVP3;u)+d[3;t*Vh7'd:h7'd0 ^[ Y;tV躥^[ U-+dl$ HY4thT'dh\T'dcSSSD$$jT$@D$D$0RL$(P\$0\$4\$8\$,D$H X'd\$P\$T\$XD$\`X'dL$`\$d\$h\$lSu ;t MQU!]^3[ 9,dT$,RPA4 +dQ$D$(,;t-hL'd;t UBU]^[ $W$ 9+d8:,dQ P҅9+d +d39\$(PWVQL$|-;9,dL$QL$t\$RHQP҅h0X'dID$Ph$X'd: 9\$tA9$w8D$tu1<:,dT$`RPA,ЍL$\QL$dT$lRD$4PQ49\$,t$9,dL$RQPҍD$P\$$\$(\$$l$+d9,dT$0RPA;t MQUW_]^3[ WVh 'dlD$ ;tQP$_]^[ ̋D$`SVP3;u)+d.0;t'Vh7'd h7'd ˾^[`V;tV萢諾^[`U-+d%V1thT'd貿h\T'd訿D$D$@D$0D$8D$PD$xL$jL$4L$4QT$|T$@jT$LRP3\$$$\$0D$TX'd\$\\$`\$dOu?D$p;t P-{D$ ;t P{;t MQUѽ]^3[`9\$W<:,dT$(RPA0Ћ|$(9,dT$ \$ \$$RPA<ЋT$ SjL$\QRZt;|$\vD$X;w ;t;v;u;.h$B'dqD$x;t PfzD$;t PUz;EHU_]^3[`L$Q:,d;uVT$RhX'd D$|;t PyD$;t Py;4EHU蟼_]^3[`|$T$tR:,d;D$tPhX'd蔽D$|;t PyD$;t Pxy;MQU)_]^3[`C,d#uhhX'd5X9,dT$\$RPADЋL$Qh X'd 9,dRL$QPҋD$PhX'dL$$QVWcD$t;t PxD$;t Px;t UBUt_]^3[`̋D$VP%u(+d,t#Vh7'ddh7'dZ "^RtV^5+dR.thT'dh\T'dD$ P:,djPPEtQV诺3^̋D$VP_u(+d+t)Vh7'd螻h7'd蔻 \^RtV:^5+dQ>-t4hT'd@h\T'd6tQV3^$WP:,du+hZ'dtQV賹_3^C,du+hZ'd辺tHVz_3^SU3SWC,d]+dSWRL$4#'tSWh'dc 9\$,t.$ $tWWhhZ'd/ zT$dD$` +dRPQ$*$t1hPZ'dPBV贸][_3^$QED$uhDZ'd븋T$RT$RT$pRPЅt1h0Z'd葹QVI][_3^L$T$dD$ PD$djQ +dRPQt h Z'd9l$ U4uh Z'djUhY'dWs 9,djWSřRP@ QЋt-hY'dtQV蠷][_^W|$SW4HWST$RD$,P$QW菷uPWhY'd ~$Q0su hY'dV$$ 9,djRWRPC QЋ؅t3hY'd$W$ttQVڶ][_^hPY'dh Y'dhX'dݷD$jPhX'd̷$L$(QRWvWstHVl][_3^́`|+d3ĉ$$VW$PD$ u(+dN't$Vh7'd-h7'd# ^MtV賙εA5+dLM(t,hT'dٶh\T'd϶HVD$ PjL$PQjjT$WT$`D$dAGuBV|$ uhx\'dgD$ +djPQL$8 t%hC'd8tBVghh\'dL$hh+dQ\]h+dh'dh'dD$$ $RP\T$0$QjRhT\'d赵D$$L$ +dPQRL$\t%h(\'d舵tHVDT$`|$dU33 ]tEWR+dRL$\t%h(\'d7tHVfD$XL$\QPh\'dT$(D$$RPh\'dL$,T$(QRh['dD$DPh['dдL$NQh['dT$`Rh['d豴D$h$`<< u h['d蚴D$,t h['d膴D$,t h['doh'dbL$(Qhp['dRT$2RhX['dBf|$Bt#D$@Ph@['d'L$JQh(['df|$Ft#T$DRh ['dD$NPhZ'dL$&T$$ʅ~jjjD$PctQV舲3$_^3PmČ́\`|+d3ĉ$X$`UVW$p3Pl$;u)-+d^#;t$Vh7'd=h7'd3 nI;tVÕޱQS+d\$ WI$t,hT'dh\T'dڲ;HSL$,QT$ jT$DT$8RD$D$u;tBVD[_3^$L$4Q:,d;u*Sh(^'dO;tBV [_3^$39|$ QP耰;tBVݫ[_^$S\$VPIffu+uNWyd$ffuV+H;_vDPt^3[ɋFuNjSPQA^[VtPj'dP'd^̋D$VPҭu(+d2t&Vh7'dh7'd Ϫ^BtV蕎谪^5+d,Bt1hT'd蹫h\T'd诫tQVk3^WT$ RD$(WD$D$PL$jL$(L$8jQD$<D$ |$,|$4;utBV_3^9|$ t2h^'dhd^'dtQVΩ_3^D$$P*u(hL^'dܪtQV蘩_3^D$L$$jPQ tBVj_^D$h7'd4 ^Ĩ2tV~ښ^ĨU-+dR2 t6hT'dߛh\T'd՛t MQU萚]3^Ĩ$WP:,d +dQL$rt-h'd肛t UBU=_]^ĨS +d3WVQL$|؅t.hPd'd2t UBU[_]^Ĩh]'dL$;uD$;uPQh؅ubh]'dD T$dPQRhd'd֘D$(P;t$ |WTt UBUu[_]3^ĨLSQRhc'd肘WTt EHU7[_]^Ĩ̋D$@VPu(+dBt&Vh7'd!h7'd ߖ^@.tVz^@W=+d;. t2hT'dȗh\T'd辗tQWz_3^@S\$TS:,du*Shd'd胗tHW?[_3^@+dU3SVRL$t*h|d'd?tHW][_^@T$$D$ RPhhd'd hH'd +dh+dhSVQuh+dh'dӖh'dƖT$RtHWx][_3^@̋D$,VWP!3;u)=+d~;t'Vh7'd]h7'dS _^,,;tVx_^,S+du,WWWL$HjD$ L$$L$PPT$ Q|$T|$$D$(d'd|$0|$4|$8D$u h4l'dP~L$jU-+dFthT'dHkh\T'd>kT$T$DT$L$(T$0L$lT$,RL$jD$,L$@L$8QD$dPT$PRS|$0|$<|$@D$Xt'd|$`|$d|$hD$lt'd|$t|$x|$|DŽ$t'd$$$|$(|$,D$LD$T=tEht'drjD$;t Pg&D$;t PV&;UBUD$,Hhu$T$R:,dvht'dj[Vht'd$hdRZ<8:,dW$RjPЋ;}VhTt'diD$$;9|$( jR+dPR$c$WjD$(PQuht'dCi9|$ T$h$\ QjRWW'dL$ WjD$$PQCT$hh+dRG$X +dff;uf;tfPf;Quf;u3;t9|$thL$$X PWQ胔tQVht'd$hdR:8:,dW$RjPЋ;}$Qhs'dAhD$;t P6$D$;t P%$;t UBUfhd'dgD$;t P#D$;t P#;t MQUfS9|$t'du-'d;ǹs'dus'dD$PVt$VPRQhs'd$hdP98:,d$W$RjPЋ;}P$Qhts'dBgD$;t P7#D$;t P&#;t UBUehds'dfD$;t P"D$;t P";t MQUeWh s'dfhr'dfhr'df D$;t P"D$;t P";t EHU:e3]$T_^[3 L̋D$VPgu(+d5t#Vh7'dfh7'd f d^tVHd^5+d5t.hT'deh\T'detQVtd3^D$ WP:,du9jW u'PWhu'dme t&QV)d_3^W茗tHV d_3^Ut2ESVWPfu(+dt(Vh7'ddh7'dd c_^[]qtVuGc_^[]5+dt$Lt'hT'ddh\T'ddVhV'dldhz'dbdhz'dXdhHz'dNdhV'dDdhh ,dr{Vh0z'dt$,!d;r3 ,djPh,z'dd u h'dc;vhz'dc33ۃ|$|$\$,\$(\thT'd3+d=+dT$8RjSSh9PЅt hS'dtcD$8L$<+d9,dRQPL$41thy'dhy'd_^[ĘL$0T$,QRF u h'd WVh'd>D$8 hh+dPth+dhЀ'd> h'dp>T$(L$$+dT$T$lRj8T$RjL$ h!PЋ؅thC'd*>_^[ĘL$0T$,jh'dQRWVA~RjjL$Q P+dPfh'd=D$t jjP h'd=h'd=T$0D$,jhl'dRPWVӲ~}jjL$ Q P+dPhX'dn=D$tD P+djjT$RPD$ hh+dPL$jQh+dh0'd$= h('d=T$0D$,Ujh'dRPWV9,jjL$$Q P+dPZh'd<D$  P+dWjT$,RP 9|$$\$ P+dWjD$(PS|$0D$ u h'dE'dPIujjj+US|$$RL8QD$t;T$RWED$L$jPRUSWh'd;W h'd h('dh'd;D$4L$0jh'dPQ3WV]~H P+dWjT$RPh|'d;D$tjWPbhx'dh('da;D$0L$,jhd'dPQWV膰~) P+djjT$RPD$PhT'd;L$0T$,QRC tbD$0L$,jh8'dPQWV.~F P+djjT$RPS|$ t(h'd:D$jjPhx'd:_^3[Ę̋D$,SVP<3;u)+d{;t*Vh7'dZ:h7'dP: 9^[,;tV8^[,U-+dl$@D$PL$jL$0L$$QT$T$(jT$4RV\$,D$< 'd\$D\$H\$L\$$D$8hu5D$ ;t P;EHU]8]^3[,9\$uit tOjR+dPR$ǥu4$(SjD$PQ\$ ztD$;ulht'd$9chd'd9L$ Q:,d;u?Vh'd8D$ ;t P;t UBU7]^3[,P jR+dPRL$X x$W$ t9\$u&h'dl8D$;t Pa;+dWVPL$H؅unThH'd"8L$@QD$D|$H uD$;t P;t UBU6_]^3[,WVh'd7D$ t Pt UBUi6_]^[,h{'d7D$t PutMQU*6_]^3[,D$t PCt EHU5_]^[,hd'd7D$;t P;t MQU5]^3[,UE MVW;ustj8+uEtS8+u.t<8+ut%+tҸ3Ʌ_^]33Ʌ_^]W|$u W_ S\$Vh'dS-t$uh'dSt7HV^[3_ ̋D$@@̋D$@y@@̸@̸@ ̸V`|+d3ĉ$UV$(PWh+dL$Qh3WVD$ ҅PL$QWV|$ҋD$T$$RT$RD$hPAtЅh+dL$(Qh@'d4D$ PBЋALT$RV|$$|$(ЅuTL$ T$QRSPL$QV|$|$ ҅u,D$T$RPALЅu9|$uh+dL$(QU$$_^]3̋D$P+d3̋D$P+dq3́8:,dVjjjT$ RhT$0RT$(RT$4RT$$D$('dD$,RPxЋth'd3^ĸÃ|$th|'d33^ĸá+dT$RT$ RPЅt hP'dR33^ĸ̸\%`|+d3ĉ$X%$`%SVW$p%P43;u)+d;t$Vh7'd2h7'd2 1Un;t Ur5+dt$(虤t/hT'd2h\T'd2;tHVM13t%h'dc2;tBV13xT$D$T$hD$@T$8RjL$h'd7ShP'dWE` tQPLOXEhh]'dch؊'dYETP3VMXQuXUXUP(th'd*}39uTud~aEX4 +d3WVQhWVth'd h'dUE RPUWEd;]T|udVVh8'd uhh]'dh'dyth'd{u39]T]d~VMX4+d3WVRhpWVth'd@ h'd1EM PQVEd;]T|udVVh8'd uhh]'dEhPPhh'dh<'dMP裃]`E\蜭u+dRM@t%h'dE`[QPN}@t]HSh'dg}@EhuC+dP&th'd렍EhPQ{OEhPPh̉'d UPRSju h'd_EP+dWSP#t h'd:3vwD +dPQRjhh'dD PQVhX'dUdRPEdNEdEhPPh<'db ;rhh'dNEhPPh'd?]`tHS3_^[Ml3p]U4`|+d3ʼnEESVWP3;u)=+dރ;t$Vh7'dh7'd {P?;tVC^3+d]٩dt'hT'dfh\T'd\; SMAU؉UMUȉh؏'dD$ ;t P蟽;tHWU[]_3^ĸVT$R$PC؋D$;t PY;tQW[]_^ĸD:,dV3;Ɖ59,dtQP҉5D:,d8:,d;tQP҉58:,d9,d;tQP҉59,d@:,d;tQP҉5@:,d<:,d;tQP҉5<:,d4:,d;tQP҉54:,d9,d;tQP҉59,d9,d;tQP҉59,d^̃L:,d̃-L:,dV395L:,dv'I8:,dQ8hJ'djP҃ ;5L:,dr^U8:,dU RURjPA<]U8:,dU RURjPA<]UQh,'dhl++dEPE 'dUE=0:,dEPh\'dEURhL'dPЅu0EjjURh8PATЅu M 9,dEPBЋEURh<'dPЅuCEh9,dP҅u 0:,dEURhH:,dPЋEQPҋEQPҋ] u0:,d9,d9,d] UVuWhD:,dh̐'dVыh8:,dh'dVЋh9,dhL'dVҋuwh@:,dh'dVыu`h<:,dh'dVЋuIh4:,dh'dVҋu2h9,dh|'dVхt=9,dh9,dhl'dVЋt __^]_59,d3^]UEM URh\'dEU Rh<'dPЅE :,d0@h:,dP҅ugEPnt+hL'dh 'dhܐ'dhL'dhj)dbE QPҋEQP3]UEVVjHU Rjh.PЅu/M;QuV;QuQV@I ND^]VN V@ND^]UE VMF+WF t3ɋǺ Q跶Fu k_^] QjP _^]UESVW+Hуȃt#_^[]#_^[]UESVW+HуȃOt#_^[]4t _^[] 4_^[]UESVW+HكO4ȃ } tO _^[]G_!^[]UM+SXVWyσ!@4_!^[]UVFtPFN tjF Et Vص^]US] VW7t6+duo8:,dQ P҅tF+duUM9u9^tIv uj8tUSR/uVi_^[]_^+d[]H _^[]UV1Wt6}+du*8:,dQ P҅t$+du;>r;~v'v u_^]_+d^]W_^]UV1Wt6}+du*8:,dQ P҅t$+du;>r;~v'v u_^]_+d^]W_^]UV1tZ+dW}uL8:,dQ P҅t+du2;>r;~vv u_^]_+d^]E PW_^]UV1tV+dW}uH8:,dQ P҅t+du.;>r;~vv u_^]_+d^]W!_^]V1t]=+duT8:,dQ P҅t9=+du:F+tNPjQRv u^+d^UV~Wu*3ɸ F  Q蛱FthVF 9FuN 3ɉF  Qkt9FV NPQRWmFP~NVEF_^]V~t.W39~vF QC,dN;~rVR#_FFF F^U,SVuSC,d]u F^[]u F^[] P+djjEPSEMQURjPSE@}MjjE܃PQ P+dюE܅}؉E4Vj'dP'dEu e^[] 9,dW9jVPEU+ƉURPG QЅNM؋D+E];ÍVU}s؋E 9,d I jSRRP9,dPхM;$quE;EsWU;rHEM;u+ƻ;s؋ 9,d9jSPƙRPQO хj+UtWC,du MWt6;uc}MMV9}M!uj~PC,d,MF=a_^[]Vq]EL;U$[V39}}~GVETUjjMQ P+dVy|fEt"PC,d#uUMRtNUu1;ru;}]EL;_Exu@MW`_^[]ujRUdSVW3uL0T0MU觉L00T043MUEt| =+d8:,dPB Ѕ=+d+dURjHURju}h.PЅuxUM;QuE;Au AI M UEUPE܋EPC,dũ3 SEE/_^[]+d_^[]Wh ` LJh uLJ` 3_Ã` dVuN+dd t?ub8:,dQ P҅tG+duGd ` tt7` dt` ` @D^h _+d^3_ÍH h d ǁ` h ^_U SVWh'dMHE ` =+d8:,dQ P҅=+dd ` Etds @Tҍ ΉUu QUE3vn=+du[8:,dQ P҅t@=+duA3hh+dVmh+djVh'diu;}s +dd ut _^+d[]Ëuhh+dVmh+djVh'd_^[]U `|+d3ʼnEEMS]VWPh'djUjRMSu ;u$=+d8:,dQ P҅t}=+du~ P+djjEPV|fE;C,dt jP螖t&j+QT=RVvEUPMQRӃ;ux_^[M3赧]+dM_^3[蘧]U9,dSVWURPAЍMQU3R}}x9,dURPAl39}ut9=+dy8:,dQ P҅9=+dXE +dMԍQjxMQjhP}E҅9,dUR}RPAHЅ9,dURPAС<:,df+dURVPAС<:,dURURPAЋEjPu;C,du M QVSUr<:,dR0MQPҡ9,dURPA<ЋUjjMQR襈t2MPQh'dLU EM RUPQRhf+d?3u;uu9,dURPAЋE;tPW'dP'd_^[]+dUh`|+d3ʼnEEVu$Ph\'dMjdQ!EwI$|)dhL'd@h<'djdEP9h,'djdMQ,h'dh 'djdEPh'djdMQ h'djdUR٦E Pu+jd+QTERPYNEQURPу=+d^u8:,dPB Ѕu +dM39+d3u] ~)d~)d~)d~)d~)d~)d~)d~)dUQSVًsW3;]{u~jW'dP'd;ljCulZ+d_^[]Pj^;t'M8xxx xCS_^S3[]M3CS_^S[]];tG +d;u8:,dQ P҅x +d;t;sF F;t9u;uExF_^[]jW'dP'd;!Pj;t8xxx x3;sMF _^A3[]MF_^A3[]UEtu8E$HP;sW}<@_x uRhh'd@ =+du8:,dQ P҅u +d39+d] UEU 3QQEMMMQEE+djUh6PE)dҋE]UQES] V WE}t%SVtjVjWh'dE;u]܃]Gu';]MQE[^_]+dMQ[^_]FsMT9;Ed$Fu9EEdFuELMԉE̋M U;r]E 8;us+=E sE U 9,djRPƙRPQK х}jWhT'd E+Utw P+djjEPSM|uMQURPEPS6.ujVjSjWh4'dE}t%SVtjVjWh'dtE=+d8:,dQ P҅w=+dt;uEuԋ]܃;EEEL8;xMOE[^_]UEPju9E sM PjQh'd3]}tU ERP{]]UtU;tsII u3]E tI]UVW}t;tVsFF tujt)8@@@ ;>sF_^]_3^]F _^]UVutFPN QV賜^]UVut&S] W}FWSPNWQRӋv u_[^] UVutW} FWPNv u_^]̋3ɉH HH@VW7t!FP-N Q$V_^UVuE9EMM +dH[^_] VqE\;U]=39}}zI=utELMI P+djjEPVs|EEtjP虂t MQM9Q=u;ru;}];jM G[^_] VWcP3rr2rBr y_d ` ^VWct IFt P覕y_^SVWٿd9` uA+d$d t,uT8:,dQ P҅t9+du:d 9` t9` u8hh ߓt +d_^3[3d t` @<Ƌh ` _^[UW} P+djjEPWrEMQURjPW$u&;=C,dM PWQhD'df_] VX:,duh'dA^_] V>>F"8$=+d,8:,dPB Ѕ=+d FvNFFt;njPC,dX:,d%N^+d_] E tPh'd:X:,dX:,dtH::u?X:,du^_] E tPh'dX:,dX:,d^_] U W}USC,d3WC,d؃3VX:,duh'dj^[_] V>f=+d8:,dQ P҅=+dFvNF< P+djjURPpoMQMURjQPR!z]X:,d}cC,d}tXE tPh'dSSjWh`'dhh+dWSh+dhC'd^^[_] X:,d^[+d_] UQVVhЌ)d/uh'd3^]ËEPQE^]UW}W]VuFtEPW#E} S]WPSMWQS.F [u Vht'dRuFh'dPܟF3ҹ ^u h'd:_]̡C,dS3;Vt8pW;t PO ;t j_ WC,d_5C,d;C,dtVԏ^C,dC,dC,d[UVME t NF uh'dh&'dQ ~ uFh'dh&'dPڞ Vh)dQ~ u2Vh'dh&'dR谞 ~ uFh'dh&'dP蔞 h'd~ uNh'dQp+djjMQjh6PEP)duVh)d~ uFh'dP%~ u2Nh'dh&'dQ ~ uVhؔ'dh&'dR h'd\Vhp)dF,~ uFh'dh&'dP貝 F u)Nh̔'dh&'dQ蕝 F^]uVh'dRlF^]3^]U`|+d3ʼnE+dSVWURjjjh*PЅ9Euƺ3 ʋm+dWVP莶uk3vOd$T +dURhURjMh,PЅu)Q;rujVC,d5C,d_^[M3v]+dRhjjh-PЅuQ!U`|+d3ʼnESVWg+dRhjjh-PЅu;u} =+d8:,dQ P҅^=+dj 9,djjEPƙRPQK хu UWhԕ'dRU;ur1Sg3 ʉ]t hd'd袜+dV Qjjh+Pu҅t h'd3ILM썍QhMQE衰+djh,P҅u;us]=+du|8:,dQ P҅tR=+dub 9,djjEPƙRPQK хuU ERhԕ'dPU;ur];s!uP+d h'd_^[M3]UVuVjVvuPVh'd8 } ^u jh)dBjjUREE+djE)dEh6PEp~)djh)d\M ]UjEjjPM q]Ujjh)djjUREE𡰠+djE)dEh6PEp~)dйC,dM]UEUV2PE @PQjh@R^] UE ]SVWh'd:,d?th'dh'dh'dhx'd:,d"hl'dh'dh'dh`'dhX'd:,dw3ۅ$=+d8:,dQ P҅=+dF؃?tVQRPhD'd:,dlNQPjRh4'd:,dPTt h,'dh$'d3h'dhh+d hh+dQ&sh+dh'd:,dv8Sh'd:,d_^[_^+d[VW~tkFNjH ɋVP FuSߋC tH ɋVP Fu>tPj'dP'dSj'dP'du[~>_^UVuWt,FtPFtPVj'dP'd_^]VW7t,FtPFtPVj'dP'd_^̃=C,dC,du/h@j'dP'dC,duK:3C,ddUV5C,du3^]C,d C,d;Wua='ddQjP'du_^]C,d C,dPQVC,dC,dd RjP'dC,d5C,dMƉQPQPI H C,d_^]USVW3`]{=+d8:,dQ P҅tq=+dGPQVh'd:,d q`;vhԖ'd:,dC K$Ѓ t6S(s, VRQPhĖ'd:,d_^[]_^+d[]h'd:,d_^[]UTSVW_]tE ;sE=+db8:,dQ P҅=+d@URjH3URE+djuh.PЅM;KU}uE;CuKC ME}U]ԋ+ËMQPQMPRWQS3PVh@'d:,dU+UԋE Eu܃,dEQхthH'd:S:z[3^]9uuusuWI=+d8:,dPB ЅP=+dz VN+dU܍URjRjM؋h?PЅE3ɺ QQx}E +dWPQMG39]~wk unFuh4'd:,dVRPE=u8h$'d:,dNQRh'd:,d~+>WWh 'd:,d}};]|uWx]th'd:,dE;EEu7+d+h'd:,d},h'd:,dWpx_SfxuVVh'dQ[^]US]Vu u ^3[]W3h'd=C,d=C,d +dWWURjhBP]u}E )dСC,dPPhl'dȻC,d ;tPPhЙ'd谻 5C,dh'd=C,d=C,d葻M +dWWMMQjhBP]EE )dҡC,dPPhl'dIC,d ;tPPhЙ'd1 5C,dh'd=C,d=C,dE WWURE+djhBP]EE )dСC,dPPhl'dʺC,d ;tPPhЙ'd貺 5C,dh'd=C,d=C,d蓺M +dWWMMQjhBP]EE )dҡC,dPPhl'dKC,d ;tPPhЙ'd3 5C,dh'd=C,d=C,dE WWURE+djhBP]EE )dСC,dPPhl'd̹C,d ;_tPPhЙ'd賹 ^[]U SVW39w}jV'dP'd;ƉGuk)_^+d[]0ppp p97GtK]ÍPffu+x?Pj'dP'dtSWVu}O u1 uO1u_]I=+dP8:,dPB ЅS=+d.? t=ff;uftfPf;Qufu3}t>}C ;vE}Ct}EksC E}ޅuCM K_^[]jj'dP'd3;U9tKEPff;u+XPj'dP'dZMQSWs }}3ۋUE ^^ ^F;F}M_q ^[]Ur_^[]UQAS3;VYtP ;Ӌqp Au39YWUtiqF AF;tP ;Ӌyx AuU;Ӊ^^ uu,~$9xs@@ ;u9zsrr 9YUu;ӉYtP ;Ӌqp Au39Yt>qV QF;tP YX 3;ӉAu;^^ t~9Yuȋ3;ÉY_t;ӋpX XtP;Ћu^Q[]UV1u3^] +dW}Iu*8:,dQ P҅t* +du;ws*vu_3^]vt_+d3^]FM VEN U_ ^]UVW39>uYjW'dP'd;ljux%_+d^]Mxxx xxE BUQMH 6 +dS;8:,dPB ЅtP +d;U;vF;ǻtsfF;tjW'dP'd;u$[_+d^];ߋMU xxMPUHP } [_F^]F[_^]U@S]Vu WSEPM QVC,duTMQj8MQE+djuh P҅t _^3[]M}EQWP VC,dE d}uE t)UjjM Q P+dRE RME }t_^[]_^[]USVW3J]$=+ds8:,dQ P҅T=+dQF+N NQPWh,'d"V FNRPQRh 'd $[J;v+QPh'd̲RPQRh 'd覲 ;} =+d8:,dQ P҅tv=+duw P+djjE PVEK|8U jjMQ P+dRK|}tE jP]MPQp;s_^[]+d_^[]U4`|+d3ʼnEE MS]VW}3\G8;ƉdxLhHth'dPaDžXuX9uW +dtHL0pShHDpp+dSVQR膴t pVPG t(9p3;rFw;r_^]UE P$uSVu+W~؍PuN˅uFWPQw uFM SQPV _^[]U`|+d3ʼnEEPhP'dMjQjEPIuS^+W;RSuFWMQP=VM _3[Q]̊Ѐ?uI@t)A3ҊqQ иRIRè@tQ3aA AUp`|+d3ʼnES]Vu 3W}]DžHDY)d$)dh'dR/͸ئ'dPP빸p'dPP른Ԧ'dPP둉}̦'d}Ħ'd}'d}'d}'d}'d}'dv}'dl}'db}'dX}|'dN}t'dD}l'd:}`'d0}T'd&}D'd}<'d}4'd}('dǍPu+‹؋FEPuFMSWG'd'dE}P$u^+‹;RuFMWQPS} URWMу 'd}uO~GPruF 'd 8'dT8 'dL8 'dT8 f 'dfL8URQVuSVW}f؊]x ] MQ]Eujh'dV0/}aUW jPEMM xЃU]EPd]E39}v2$x ] MQ6]U;}rՊx ] MQ ]3EvWURSUu 7Mу҉Mt uuMU ;}r]~GPuF8[Eu=}u7}u1~OQuFf;'df8 ;'dL83ۅUEUU+ЉMUIUu ;]s K;]sLP~OQ$uF;]f;'df8 ;'dL8sEU DPL;]s~OQuF8,M;]Mg~WRuF8]j!V}<xP}EP9Pj!V}j!VxP}MQPq}~WR uF 'd 8f'dfT8 'dL8~WRuF ܥ'd 8f'dfT8SVW}~EGPuF إ'dU 8x E EP:2t;t^KQKuF,]USVREuNj~GPuF ԥ'd Y}tRPh'dUj@R&cEPd$u^+‹;PuFWMQPN v}WRuW8suEPu^+‹;PBtMWQV(N tPj'dP'dE_^[M3_I] I)d)d)d)d)d)d)d)d)d)d)d)d )d;)dW)dk)d)d)d)d_)d)dE)d)d)d')dc)d1)d0)d")dC)d{)d U`|+d3ʼnES] VuW}ua~GPuFf H'df 8J'dT8~GPuFW8F\SW҅u_Sh$'d|hP`|Pu^+‹ ;QNuFW|RP5L %=pk3;y=t =f=xtu,SWыltPxQSW6lQSW҅} Džl@xxQtRSWЋtt8uBZċˁQ8y+dRh'djPhs_htltt)WPVl%=t=uj/VptPu+Xxt?8t;pPIu+\S!GpQh'dSW^SGtRSWG jWVWHxt8tjPV{j.VtjPVdxRSWDžxЋxX8Oj[Vjh 'dVxjQVj]V_== =#t.Sh'd|hR]j|PV4jjjjxRjjSWDžxЋx8j[VxjQVXj]Vr0jjxPjjjSWDžxыxtA8t^M3A]R8(Qj1MQjPV҅}"3 $IL'dfLfuEPh'dއ^M3zA]jjjjjj0Rj1UR,RPVЅ}3$'dfLfujj0R,j14PA0RVЅ}3It'df4fuMQ4R tQh'd ^M3@]Wjj$Rj14R0RPA|VDž0Ѕܧ'd|40%=u=(Pj2EPjQJ8VхX3L'dfLfu;=uIjj(Pj1EPQJ0Vх3 $It'dfLfu=,RVDž,, R0DžDžDžRPЋ,QRP,j2EPjQPjj'd,PBЍ63'dfLfu3'dfLfuWMQh'd _^M3>]Rxjjjjj(Qj14Q0QPV҅}!3T'df4fujj(Q0j1URP0QV҅}3It'dfLfu썅4PMQhL'dgM 3^>]UE 9,d VW93Vhh D,dRPG QЅ|$h D,dMQh D,dUR_^]_^]U`|+d3ʼnEEWHE P Q39=D,dD,dSV$FPFDžL؋tF3ҊvV иV9LYtPFCK,C@ȉ0S%4<8,F D,d;uh-'dWh-'dWh'd‚V;uh-'dWh'd螂 D,dF ;ui>h-'dWh-'dWu,h'dsLP$ h'dGLP$ V;u">h-'dWuh̨'dh'd LP$ ^D,dPh-'dWh'dP D,dD,d = D,du ƒ D,d f+dP p4HQh'd@_$D)dD,d D,d Rh'dD,d(D,d D,d Rh'dD,dD,d D,d QhP'dD,dҀD,dD,d$h0'dD,d褀 nD,d D,d Qh'dD,dyCD,dD,d СD,d D,dLQRh'dD,d5 D,dD,d D,dHQP:D,d D,d4DQjPTD,dHQVP҅upDPs fDŽETh'dEjP; fTTtf rfrf.f8u⍍TQh'da+Vh'dND,dD,d4D,d3ɋƺ Q9؃3~#=D,dD,d  ;|D,dh'd~3~6$t hI'd~D,dPh'd~;|h 'd~S:PXD,d D,d RhP'dD,db~/D,d D,dٝPمPhd'd1~h'd$~9D,do^[M3_7] )d )dM)dv)d)d)d)d)d)d;)d)d)d)d)d)d)d)d)d)d)d)dUEU ȃ uE0@] VuWuE S} t ,E jj RP00]u E  u};[vM;Mw_^] UEM HP ;HvH;swPH;HvH;Hs#HwP,H(;H$vH$;H sH vP<H8;H4vH4;H0sH0]hة'djh̩'dj hĩ'djh'djh'djh'dh'd:,dh'djhx'dj hp'djhp'djhp'djhh'dh'd:,d`U`|+d3ʼnEESVW} O ɉlu33 G3΍UR jQO PjEPjQPj URj VOPjEP jQPjpRj SPljPh'd:,dM0_^3[4]UEVPh 'd:,du NQh'd V Rh'dF0Ph'dVh'dh'd:,d^]US]Vu WE y+dIMt,#Ȁ>Mth0'dSV5 GPSV5M E  E rt=>th0'dSV5M ƍxuQ++h('dSP}L_^[] U`|+d3ʼnEE=Vu t5= t'=tPh('dEj P,LE,'d <'d4'dMPQV4M 3^'3] U`|+d3ʼnEE=Vu w"tt=uT'd3-'d,L'd%=tPh('dEj PKED'dMPQV04M 3^2] S܃Ukl$VWj@3WP1j@MWQ 01j@WRuuuu1j@@WPx1j@WQ@P`pQ1j@@WR*1@:,dHURWWPAp@P`p}ЅE=ut= t=uVQVURVPE=t"=t=u!V@QVRV@P^}؋U܋M@:,dʋuVQWPBpMЅeQh,'dURh<'dPh4'd@QhT'dRhL'd@PhD'd_^][S܃Ukl$`|+d3ʼnEVWht'dhت'dhЪ'dh'dh'djh'djh'd3jh'dEE:,d,$=+d8:,dQ P҅=+d@:,d`RURURPApЅUjMQRnMPjEPQPEj URPpPj MQR`xP|P3dQWVPRh\'d:,dx|,MU+dM_3^.][U`|+d3ʼnES]Vu @0W}jMQURhWSVЅMEPSVхu{]DAWSPE0]U SWVRruIǍPffu+=s fG+f G+ȋE;vȋEQPSWL3e_^[M3-]UQE@4UREh'dPЋE]UEpRhURE+djEh$PЅuEEURh'dPЋE]3]Ujh++dh!*ddP SVW`|+d1E3PEde}fM%=t'=t =t@Md Y_^[]E=uEPWU RQ=u3E jjjjjjjjuVhh X,duVQP3=E jjjjjuVhh X,duVQPBxЋu|vE=t+}t%]SWM QP4uh'dSW; ]UfU X,dh X,dSW; hl'd#r Ëe@uEƋMd Y_^[]UEpRhURE+djEh$PЅu;EEURh'dPЋEtU RPЅt ]3]Ut3>`|+d3ʼnEVuW}fF4RDžh'dPЋtMUQRWPE Po(QVJfV F$Rj@R+djDžDžh PЃth̭'dhQ{, h'dhR9N$F h+dhQ+djh P҅uh+dhPm9 ft'dM UPQh'dRWqHM_3^m)]Uu 'd]Ujjjhh P,dRPA0Ѕ'd| P,d]Uu 'd]Ujhh P,djRPA8Ѕ'd| P,d]UEt5Ёu P]]u P]$'d] 'd]UEVupRhUREf+djEh$PЅuMUE QRVPpQ^]UQMIuASVWp$ffu]+Íx$ffu+ƍDPU|!MAҋHuPSQRb7 3_^[]U@`|+d3ʼnEESVWUЋًMRPEȉM3#E!EШ@tu'(thd'dZ(jVRjt h'dYP Q,0R$PQWtxjVRP*PQDž+t!RPQRM3]3M3]Ut`|+d3ʼnEVW}Wrtv+dRjhRjDžhPЅu;hh+dVqQh+dh'dT _^M3F]W-tPhL'd< 4:,d1jjhRǙRPFQЅ|tQh !'dCTM_3^ ]U`|+d3ʼnEES]W}hPjQ ;] V=+d8:,dPB Ѕ=+dtN+ u;d$9w)OQoSh'deSWR<'d tϋɋt+jP,;Eu h$'dShPQ&P'Q']3jh 'dR" t8jh'dP" tjh'dQ" +uhRP%+lj+Wh'd:RR&PRQ&h'dRQjh԰'dP! Qd&3z+d$WRPS! t|yz+d gQ&RPPQR$DŽ5T5P Pjh̰'dP! ukQ%RPPQR 3t!9tPPQtTdtzjh'dR P%3z+dOQRS` t|z+d P$QRPPQ-DŽ5T5Pjhİ'dP QuA?$RPPQRtgt^PUP#3z+dWRPS` t |z+d tDŽ5Th'd OM 9s]+d^M_3[]U`|+d3ʼnEVu W}jjEPOQ P+dE 9,djjURRPC QЅE}<jjMQ P+dWE 9,d9jjVRW PQ҅uf P+dPEjVP` 9,d9jjURRPG QЅu,MQRE[_^M3=]EMUuڀPu ڀuc}uTtXMu؀u$<u@E8ut0u1EЃuȀtuu $<t[M_3^]SVD$ uL$D$3؋D$ Aȋ\$T$D$ ud$ȋD$r;T$wr;D$ vN3ҋ^[VD$ u(L$D$ 3؋D$d$ȋd$Gȋ\$T$ D$ ud$ȋD$r;T$ wr;D$v N+D$T$3+D$T$ ؃ʋӋًȋ^̋D$L$ ȋL$ u D$S؋D$d$؋D$[UQE SVW'dWjP'du3V>x'dVju P'dދF~ E FEFEP'dE tMd`,dEjl`,dp`,d t`,d=h`,d@Yse6u ?A`8@t'dx|,d>0`,d9}3 >| ;|j/Yu ,`,d8;3;u59=,`,d ,`,d9=`,du09}u{;2@juYq2hj7;YYV5|+d5`,d1YЅtWV2YYp'dNV6YmuW4Y3@_^[ j h++dB]3@Eu 9,`,de;tu.,'dtWVSЉE}WVSEWVSFEu$u WPSFWjS,'dtWjSЅtu&WVS~u!E}t,'dtWVSЉEEEE PQ"AYYËeE3oAÃ|$uvAt$L$T$ Y D$f@@fufL$HH;tf9uff+f#̃S\$ UVs35`|+dWD$D${t N3 8N F3 8D$(@fk L$0T$D$L$ St^DmLɍ\D$t BD$|DLD$ù|$t$t N3 8[N F3 8KD$_^][D$ƋL$(9csmu*=t|,dt!ht|,dBtT$(jRt|,dL$,AD$,9h th`|+dWՋAD$,L$H t N3 8N V3 :KPA{ Ph`|+dW˺gA̋T$ L$ti3D$ur=H{,dtBWr1كt +шuʃtt uD$_ËD$; `|+duC̋L$WSV|$toqtUL$:tt :t u^[_3Ê:u~at(:uAtf:t3^[_G^[_Ë^[_ËD$fT$f;t@@fuf9t3Vjhp|+dbCD'd^D'dCVD'dCD$tV_Y^Vt$7CD'd^U uDYtuCYtL`,d@`,du L`,dbh*+d !YVMBh++dEPED'd ̋L$S3;VWt|$;wDj^0SSSSSn"1t$;uًъBF:tOu;u{Dj"Y3_^[ËD$S3;VWt|$;wRDj^0SSSSS "=t$;uً8tBOu;t BF:tOu;u Dj"Y3_^[1L$SVW3;t\$;wCj^0WWWWW!8t$;uf9؋fBBFFf;tKu;uf9Cj"Y3_^[ËD$VF uc^-FHlHhN; @+dt \+dHpuLF;`+dtF \+dHpuEFF@puHpF  @F^USVu Mk];sTM胹~EPjSPM Xt}tE`pE胸~1]}EPE%P YYtEjE]EYSB*3Ɉ]EAEjpUjRQMQVpEPO$ouE M3e }tMap^[Ã=e,duD$Hw jt$YYUWVu M};v;r=H{,dtWV;^_u^_]Pur*$)*dǺr $)*d$**d$)*d)*dD)*dh)*d#ъFGFGr$)*dI#ъFGr$)*d#ъr$)*dI)*d)*d)*d)*d)*d)*d)*d)*dDDDDDDDDDDDDDD$)*d**d **d**d,**dE^_ÐE^_ÐFGE^_ÍIFGFGE^_Ðt1|9u$r $+*d$@+*dIǺr +$**d$+*d**d**d**dF#шGr$+*dIF#шGFGr$+*dF#шGFGFGV$+*dID+*dL+*dT+*d\+*dd+*dl+*dt+*d+*dDDDDDDDDD D DDDD$+*d+*d+*d+*d+*dE^_ÐFGE^_ÍIFGFGE^_ÐFGFGFGE^_̍B[Í$d$3D$ST$t :tτtQu WV ؋ ~333ƃu%t%uu^_[3ËB:t6t:t't:tt:tt^_B[ÍB^_[ÍB^_[ÍB^_[ËT$Vt$WHFw  yBw t;t_+^USuM39]u.0=SSSSS8]tE`pW} ;u+<SSSSS8]tE`pUE9Xu Wu@YY4VEMQPEMQPG;t;t+^8]tMap_[UV395e,du09uuc<VVVVV9u t^]Vu u ^]UVWuMEu 3;t0;u,<WWWWW}tE`p39}t }|Ƀ}$ËMS}~~EPjPIM BtGǀ-uM+uGEI@$7u*0t E 4t }w u,9uv'c:E"tME$ƉEEt8Et]}tE`pEEt0}tE`p3[_^U39e,dPuu uuhH+dP]U=e,djuu uuhH+dj]USVu39]Wu;u9] u3_^[];t} ;w}9j^0SSSSS49]uʋU;uу}u @B:tOu @B:tOtMu9]u;u}uE jP\Xx9j"YUu M_E~EPhuF MH%}tMapÃ=e,duD$ 0+dA%jt$YYUu ME~EPjuWF MH}tMapÃ=e,duD$ 0+dAjt$YYUu MhE~EPjuE MH}tMapÃ=e,duD$ 0+dAjt$YYUu ME~EPhudE MH%}tMapÃ=e,duD$ 0+dA%jt$YYUu MqE~EPjuD MH}tMapÃ=e,duD$ 0+dAjt$YYËT$SV3;Wt\$;wz6j_8VVVVV1F|$;uf2؋f91tAAKu;tfAAGGf;tKu;uf2)6j"Y3_^[ø*dP+dT+d{*dX+d{*d\+d{*d`+dY{*dd+dh+do*dl+do{*dp+dz*dt+dhz*dQ|$T`,dtPUu MEMA%}tMapjt$YYhWt$MQYYUSVuW39}u;u9} u3_^[];t] ;w5j^0WWWWW9}uf>ɋU;uf>σ}u f@@BBf;t$Ku f@@BBf;tKtMu9}uf8;z}uE jPf|FXff>4j"Ylj hP,+d,3ۉ]3u;;u Y4SSSSS39] ;tԉuVrQY]F @V\Yt.Vu\Yt"Vi\<`{,dVY\YY|+d@$uEV<\Yt.V0\Yt"V$\<`{,dV\YY|+d@$t3SSSSSBM9]u#V}QEPSu V2REVWQE E+uPYQL$+#ȋ%;r Y$-QL$+ȃ YQL$+ȃ YSVt$ W3;u2WWWWWf BF t7V\V\VZP[}F;t PnY~~ _^[j hp,+d*M3u3;;u.2WWWWW F @t ~ E*VGOY}V/YEEՋuVOYj h,+d&*3ۉ]3};;u1SSSSSi3y3u ;;t38;t_E;u r1ʉ]8u ^1jEPh`|+d* PuVW\EE E)uNYVW|$ 3;u1j_VVVVV8&ht$t$ ;Ɖt30_^̃=H{,dt-U$,$Ã=H{,dt<$XfftU T$|$l$T$D$tHH_^[US39]u*SSSSS[Vu;t9] w *0uuuu Vhu*d;}uw*"SSSSS-^[]UQS39]u L*SSSSS9]VuWu;u9] u3;t} ;w*);}uuuv-8E@PVhu*d*uL)8"ue)8\WVhu*dE\>u}u)8"u/)M#;}"us)"SSSSS)_^[Uujuuu u]UMUS3;VWu;u9] u3_^[];t} ;w)j^0SSSSS;ˋut;u֋8t@Ou;tu@F:t"Ou;v@F:tOtMu9]u;u}uE jP\Xn(j"YuU}u3]ËU MMtft f;uAABB +]UQV39uW}u;u9u u3_^;tM ;w(j_8VVVVV9uUt ;uf7ԋljMf90t@@Mu9ut}u f@@BBf;t-Mu&9uv f@@BBf;t MtMu9uuf09ub}uE jPftGXNf7n'j"YSD$Pjt$t$t$$dUEPjuuu ud]jh,+dv]uu %Yu u SY=L{,d3}jfY}SgYE;;5 k,dwIVSPk t]5VnYE;t'CH;rPSuSfESPf9}uH;u3Fu u VW5a,d'dE;t CH;rPSuhSufE.}u1uFu VSj5a,d|'du ]jdYË}9=He,dt,Vd%Y%9}ul 'dPe%Y_%9}th quFVSj5a,d|'duV9He,dt4V$YtvV$YB% 3/%|u!% 'dP$YQSUVW5h|,d 5d|,dt$ ;YY+ލkrxVo;YsJ;s;rPt$YYuF;rCPt$YYt3P< Yh|,dt$ W Yd|,dD$Y3_^][YVjj %V h|,dd|,dujX^Ã&3^j h,+ds_euYEE E>t$YHU EVWjYX'd}EE _E^t tE@EPuuu'dQ|'d1oYVD$tVnY^D$\`,dU$X(`|+d3ʼnV]|ux}tfff]pfElfehfmdE@jPEjPEEЍE؃ E uE'dj'dEP'du ujt>;tWYh'd'd2Yh'd'd"YE}u(`,djXYu3C}tjXY$jjt$  jjj V VVOjVV9jV)jVhVVghP*dv$|+d^UQQSV3EF3Pu]}Y~BWS'dp<f9^F|0v#Wh'ddYYtFC(;reE_^[V5|+d5'dօt!|+dtP5|+dЅt&h'd'dt#Jth'dVd'dt t$ЉD$D$^jYV5|+d5'dօt!|+dtP5|+dЅt&h'd'dt#thı'dVd'dt t$ЉD$D$^'dV5|+d'du5`,dkYV5|+d'd^á|+dtP5`,dAYЃ |+d|+dtP'd |+dUj h0-+dh'd'dEuF\8}+d3G~t/t&h'dud'dӉhı'duӉ~pƆCƆKC8+dFhP'dj VYeE Flu@+dFlvlYE9j UYVW 'd5|+dЋuNhjBYYt:V5|+d5`,dYЅtjVYYp'dN V5Y3W'd_^VujY^jhP-+dOuF$tPYF,tPYF4tPYF%uN@ uNhF P`YYt7F N@Cg5P{,d'd33@ËeEVW`{,d>t1t G P'd@;r6&Y`|,d|_^S39l|,dVWu50`,d3;u<=tGVaYt:ujGW;YY=`,dtˋ50`,dU@VaE>=Yt/jUZ;YYtJVUP t SSSSS8u50`,dT0`,d`|,d3Y]_^[5`,d/`,dUQMS39EVU t ]EE>"u39E"FE<tBU PFaYt} t M E FۋU Mt2}u t utBe>< t< uFN>}t EE3C3FA>\t>"u&u}t F8"u 339EEtIt\BuU tU}u< tK< tGt=Pt#`Yt M E FM E  `YtFU FVtBU ME^[t U S39l|,dVWuIh`,dVSa,d'dx|,d;É5`,dt8EuuUEPSS}E =?sJMsB;r6P;Yt)UEPWV}E Hx`,d5|`,d3_^[QQa,dSUVW='d33;j]u-׋;t a,d" 'dxu ţa,da,d;u׋;u3f9tf9uf9u= 'dSSS+S@PVSSD$4׋;t2U;YD$t#SSUPt$$VSSׅut$Y\$\$V'dX;t;u'd;p8t @8u@8u+@UZ;Yu V'dDUVW V'd_^][YYVWP'dP'd;NjstЃ;r_^VWX'dX'd;NjstЃ;r_^UQQVE3PuuYt VVVVVEPYt VVVVV}^u }r3@jX39D$jhP'da,du3}L{,du$hIYu5a,d'd%a,d3@U3=L{,duTS'dW39-k,d~1V5k,dhUv'd6U5a,dӃG;=k,d|^5k,dU5a,d_[5a,d'd-a,d]UQQVFV\}+dW}S99tk ;rk ;s99u3t Xۉ]u3u `3@N`MM N`H }+d=}+d;}$k ~\d9=}+d}+dB߃ ;|]=~du Fd^=u FdN=u Fd>=u Fd.=u Fd=u Fd=uFdvdjY~d`QӋEYF`[_^øcsm9D$u t$PYY3h!*dd5D$l$l$+SVW`|+d1E3PeuEEEEdËMd Y__^[]QU`|+deeSWN@;ǻt t Уd|+d`VEP'du3u'd3p'd3'd3EP'dE3E3;uO@ u 5`|+d։5d|+d^_[SVWT$D$L$URPQQhd*dd5`|+d3ĉD$d%D$0XL$,3p t;T$4t;v.4v\ H {uhCF[CX[d_^[ËL$At3D$H3访Uhp pp> ]D$T$UL$)qqq( ]UVWS33333[_^]ËjZ33333USVWjjhd*dQ_^[]Ul$RQt$ ]̋L$f9MZt3ËA<8PEu3fx ̋D$H<ASVq3҅WDv|$H ;r X;r (;r3_^[Ujh-+dh!*ddPSVW`|+d1E3PEdeEh'd<tUE-'dPh'dRt;@$ЃEMd Y_^[]ËE3=‹ËeE3Md Y_^[]U}}M f$ffGfG fG0fG@fGPfG`fGpIuЋ}]U}E3+3+uEd+dD;FG;v}FF>uыuE}urlj{CjC Cl+dZf1Af0A@@JuL@;vFF~4C@IuC.C Ss3{95d,dbM_^3[bjh.+dM}_huE;CWh Y؅Fwh#SuYYEuvh'duFh=8+dtP5Y^hS='dFp\+dj 9YeCe,dC e,dC e,d3E}fLCf Ed,d@3E=} LX+d@3E=}`+d@5`+d'du`+d=8+dtP|Y`+dSE0j U8Y%u 8+dtSFY2eEÃ=l|,dujVYl|,d3SUVt$3;Wto=Ȋ+dth;t^9(uZ;t9(uPbRYY;t9(uPRYYYY;tD9(u@-Pk+PX+PJ?=+dt9uPO7YYj~P[`+dt;t 9(uPY9otG;t 9(uPYKuVY_^][SUVt$W='dV׋tP׋tP׋tP׋tPj^P]{`+dt tP׃{t CtP׃Mu؋P_^][Vt$tSUW='dV׋tP׋tP׋tP׋tPj^P]{`+dt tP׃{t CtP׃Mu؋P_][^Åt7t3V0;t(W8YtVR>Yuh+dtVxY^3j h8.+dF\+dFpt"~lt/pluj &Yj 6YeFl=@+diEEj 5YuËD$t8uPYU`|+d3ʼnESV398e,dWu8SS3GWh'dhS'dt=8e,d 'dxu 8e,d9]~"MEI8t@;uE+H;E}@E8e,d;9] ]u@E 5'd39]$SSuuPu ֋;~Cj3Xr7D?=w;tP;Yt E]9]=Wuuuju օ5'dSSWuu u֋;ˉMfE t)9];MuuWuu u;~Ej3Xr9D =w7;tjP;Yt 3;tAuVWuu u'dt"9]SSuSSuuuVSu  'dEVYuEYY9]]]u@E9] u@E uNNYEu3!;E SSMQuPu jN;ÉEtԋ5'dSSuPu u;ÉEu3~=w8=w!;tP;Yt 3;tuSW uWuuu u;ÉEu3%uEuPWu uMu#uWYuuuuu u'd9]t urYE;t 9EtP_Yƍe_^[M3UuM衮u(Mu$u uuuuu - }tMapUSuM]]C=wE苀Xu]}EPE%PYYtEjE]EY 3Ɉ]EAEjppEPQEPEjP I u8EtE`p3E#E }tMap[U}uu }MfofoNfoV fo^0ffOfW f_0fof@fonPfov`fo~pfg@foPfw`fpIuu}]U}u]] ÙȋE3+ʃ3+ʙ3+3+ uJu΃M;t+VSP' EMtw]U +щU+ى]u}MES;u5كMu }MMMU UE+EPRQL Eu }MʃE]u}]UVu M=uPʭe FPYuP譭xYuFFM  FFu8M^tE`pUVu M̫Eɋut:t@u@t6 et Et@uH80t S:[uH @BɈu}^tE`pD$Az3@3UQQ}uutEPKME MHEP LE M jt$t$t$ÅVtVmA@PVV^jt$zYYjt$YYUSVWuM袪3;u+!j_VVVVV8}tE`p!9uv9u ~E 3 9Ew j"뺀}tU39u 3Ƀ:-ˋ:}?-u-s} ~FE38EE }u+]h'dSV荨 3ۅt SSSSS9]NtEG F80t.GHy-Fd| jd_F | j _Fi,dt90ujAPQ[ }tE`p3_^[U,`|+d3ʼnEESVW} j^VMQMQp02L3ۃ;uSSSSS0RoE;vuu3Ƀ}-+3;+MQNQP3}-3;QNJ;tuESPuVuM_^3[貥Ujuuuu u]U$VWuME3E0<9}}}u ;u+j^WWWWW0i}tE`p9}vЋE 9Ew tj"}EGS#3;Eu ju^PSW t}Map;-u-F0F}je$xFVѺYYL}ɀp@2%3 t-F]0F$xOFۃ3'3 u!0OF uU E1FF9UE uM܋ OMw;UE}~MW#UM#EJf0f=9vËMmEFMf}EM}f}|QW#UM#EJf=v1FftFu0H;E t9u: @}~uj0V荢 uE 8u}4$pWF1J3%#+ESYx ;r+F -F;Ӌ0|$;rSQRP I0F;Uu |drjjdRPH0UF;u | rjj RPH0UF]0F}tE`p3[_^USVWu؋sMNҤu-Sj^03PPPPP}tE`p}v̀}t;u u3;-0@;-u-wC3G n0F} ~DYE[F}&ۀ}u9] |] } (Wj0Vɠ }tE`p3_^[U,`|+d3ʼnEESVW} j^VMQMQp0F3ۃ;uFSSSSS0ZE;vu 3Ƀ}-+uMQMQP3}-P E;tuESVudM_^3[uU0`|+d3ʼnEESVu Wj_WMQMQp0'F3ۃ;uSSSSS8GM;vދEHE3}-<0u +ȍEPuQWXD;tXEH9E|-;E}(:t Gu_uEjuuuEjPuuuM_^3[}UEet_EtZfuu uuu u&]ÃatAtu uuuu u0u uuuu uu uuuu u|]Ujuuuuu u^]VW3P+d6o(Yr_^Vhh3V F t VVVVV^U'd]'d]EuMm]]z3@3h'd'dthȲ'dPd'dtjUf}uebf}sE +dfAf#E E@uM賠EppEPjEPEjPGu!E}tE`pEM #UQf}u3f}sE +dAM #Ã=e,du%5|+dE5l+dPjEPjhH+dXGju u øx+dá@{,dVj^u;}ƣ@{,djP=YY0k,dujV5@{,d$YY0k,dujX^3ҹx+d0k,d  +d|j^3ҹ+dW`{,dt;tu1 B+d|_3^y=`,dtF50k,dYVt$x+d;r"؇+dw+Qo"N Y^à V 'd^ËD$}PG"D$ H YËD$ P 'dËD$x+d;r=؇+dw` +P*!Yà P$'dËL$D$}` Q!Yà P$'dVt$VN PnFYYt{C ;u33@;u_3@^^N _3[@^3^Ã|$t'Vt$ fF tVf f f&fY^U$x`|+d3ʼnSV3W MEЉ}ԉuuuuuĉuuC9uu-VVVVVy}tE`pE@ @PYt6uYt(uu4`{,dYY3|+d@$uuYt6uYt(uu4`{,dsYY3|+d@$";3Ʉ҉ủu؉uUC}], t-tHHt9M0M'MMM *u }ԋ;}M]Ek ʍDЉEu*u}ԋ;}MEk ʍDЉEItFht8ltwxMl;luCM]WMNM E<6u{4uCCM](<3u{2uCCe] 9E~E}~-u]VUYEt E܉uE3EGEEPuu}PuESP5h+dYЋ}t9uuEPS5t+dYYY}gu;uEPS5p+dYYY;-u MC]SrEM!spHHYE'EEEQE0EEf t@}tGG@Gt3҉}@t;|;s؃ځMfEڋu3ۃ}} Ee9E~E u!EčEM t$EؙRPSW-09]~MN̍+FfEE؉utLt΀90tAM܋M0@2If90t@@;u+E;u+dE܋EI8t@;u+E܉E؃}E@t%ftE-tE+t E E]+]+]E uuЍESj uċ}ЍE̍M EYtEuWSj0Ej }EtQ~Mu܉EMPjPEFPF>u9EtuE̍@ }YuM MPE% Y}|EtWSj E }t ueY]Et$M}Ԋ)3PPPPP$}tE`pE̋_^3[e[*dŠ*d݊*d,*df*dn*d*d*dD$V3;uVVVVV:^Ë@^Vt$WV>YtP`{,du u u@Dtj>j>;YYtV>YP,'du  'd3V=`{,dYD0t WY3_^jhX.+dEu 3;|;P{,dr!8 WWWWW=ɋ`{,d L1tP%>Y}D0tuYE, ME Eu~>YVt$F ttvf 3YFF^SVt$ F Ȁ3ۀu?ft9FW>+~,WPVYPE ;uF yF N _Ff^[Vt$u V3Y^VYt^fF @tVPrFYY^3^jhx.+d3}}jY}3u;5@{,d0k,d98t^@ tVPVmYY3BU0k,dH t/9UuPPYtE9}utP5Yu E܉}F3u0k,d4VlYYE}EtEjaYjYUj,dS3Vu E]]]F> t tjVhd'diP udhl'dVNYYu M ;ht'dVNYYu M h'dVNYYuM F> t8t SSSSS¯huEu uPLt3 EHN+I;N~WPu @ EM F yM tt`{,d|+d@ tjSSQM#ƒt%FM3GWEPu ? E9}t N E%_[^Uf9ESu MoMQ3;uEHfw ]f9Es)EPjuB Et9M싉fqMjQjMQPREPP EtE8]tMap[A @tyt$Ix  QPYYu UVMEM >t} ^]G @SVt4u.D$ -L$ C>u8*uϰ?i|$ ^[U$x`|+d3ʼnSV3W MEЉ}ԉuuuuuĉuu9uu-gVVVVV}tE`pE@ @PYt6uYt(u|u4`{,djYY3|+d@$uuEYt6u7Yt(u)u4`{,dYY3|+d@$";҉ủu؉uuUC39Ẻ]ʀ Xw h'dMk 'dj^;ƉEjY;z$*d3MEEEEĉEEVƒ t<t++tHHt8 u0M'MMM *u }ԋ}M]Ek ʍDЉEe*u}ԋ}MEk ʍDЉEItFht8ltwwMk;luCM]VMMM D<6u{4uCCM]'<3u{2uCCe] EYtEuWSj0E }EtQ~Mu܉EMPjPEFPFY+u9EtuE̍}YuM MPEY}|EtWSj E }t u趱eY]Et!}Ԋ 3PPPPP39ut }}tE`pE̋_^3[}ÐƟ*d+*dH*d*dϞ*d؞*d*d *dU S39]u SSSSS迡Vu W};t$;u SSSSS菡?EBuuv E?EuEuuPU;EtU;|BMx EEEPSYYt"MxEEPSYYtE39]f\~HH_^[UV39uuVVVVV̠\W};t9u w 1uuuu Whg*d;}f7u"VVVVVo_^]UQS39]u SSSSSD9]VuWu;u9] u3;t} ;wI9;}uuuv-8E@PVhg*duM 8"ug8^WVhg*dEf\~u}u8"u0M$;}#fu"SSSSSi_^[VW3Pe,d<+du+d8h0YYt F$|3@_^Ã$+d3S'dV+dW>t~t WW:&Y +d|ܾ+d_t ~uPӃ +d|^[UE4+d$'d]j h.+d43G}39a,du#j| hYYu4+d9tnj4Y;u 3Qj YY]9u,hWYYuWjYV ] >WOYE E̸j *YUEV4+d>uP$YujY6 'd^]h@j5a,d'dk,duËL$%f,d%k,d$k,d3 k,d(k,d@Ë k,dk,dkT$+P r ;r3UMAVu W+y iDMIMS1UVUU] utJ?vj?ZK;KuB sL!\D u#M!JL! uM!Y] S[MMZU ZRSMJ?vj?Z]]+u]j?u K^;vMJ;։Mv;t^M q;qu; s!tDLu!M!1K!LuM!qM qINM qINu ]}u;M ыYN^qNqN;Nu`LM Ls%}uʻM DD )}uJM YJꍄ ED0Ef,d ,k,d5'dh@H SQ֋ ,k,df,d Pf,d@ ,k,df,d@HCf,dHyCu `f,dxueSjp ֡f,dpj5a,d'd k,df,dkk,d+ȍLQHQPE k,d;f,dvmk,d$k,dEf,d=,k,d[_^á(k,dV5k,dW3;u4kP5k,dW5a,d|'d;u3x(k,d5k,dk,dk5k,dhAj5a,d'd;ljFtjh hW('d;ljF uvW5a,d'd뛃N>~k,dF_^UQQMASVqW3C}i0Dj?EZ@@Jujhy hW('dup;UwC+ GAH@PǀIuˋUEO HAJ HAdD3GFCENCu x!P_^[U MASVuW} +Q iDMOI;|9M]UE;;MI?Mvj?YM_;_uC sML!\D u&M!ML! uM!YO_YOyM+M}}M O?L1vj?_]][Y]YKYKY;YuWLM Ls}uϻM DD }uOM YO U MD2LU FBD2<38/] )uNK\3uN?] Kvj?^EuN?vj?^O;OuB st!\Du#M!NL! uM!Y] OwqwOquuuN?vj?^M yK{YKYK;KuWLM Ls}uοM 9DD }uNM yN ED3@_^[Uk,dMkk,dMSI VW} M 3U $k,dS;#U# u ;؉]r;uk,dS;#U# u ;ى]r;u[ {u ];r;u1k,d {u ;ى]r;u؅ۉ]u3 S@YKC8t$k,dCUt|D#M# u)eHD9#U# uEUiDMLD3#u#Mj _G}MT +MN?M~j?^;J;Ju\ }&M|8Ӊ]#\D\Du3M]! ,OM|8!]u ]M!K]}JzyJzyM yJzQJQJ;Ju^LM L}#} u ;οM |D)} u N {MN 7Mt LMuэN L2uɍy>u;f,duM; ,k,du%f,dMB_^[jh.+dA3]3;;uѴWWWWW臒S=L{,du8jY}SYE;t s uuE%9}uSW5a,d,'d3]ujWYj h/+d螬jYeuNt/f,df,dEt9u,HJPYvYfE 荬ËjY̋T$L$u<:u. t&:au% t:Au t:au uҋ3Ðt:u ttf:u t:au t눃%k,dQS\$ VW33;0+dtGrwUjDY1jDYu =<`,d?h'dSf,dUm t VVVVVghf,dVjg,d'du&hh'dhVm t3PPPPP#Vq@1uA~WA@PWV言3_^[]UQU BSVW%#ωE Bپ%ۉut;t<($3;u;uEfM XL<] ME ΉHuP Ɂ։PtM _^fH[U0`|+d3ʼnEES]VEWEPEPYYEPjj ufCuЉCE։EԉCEPuV?[$t3PPPPP|M_s ^3[YWVU33D$ }GET$ڃD$T$D$ }GT$ڃD$T$ u(L$D$3؋D$d$ȋd$G؋L$T$D$ ud$ȋD$r;T$wr;D$v N+D$T$3+D$T$My؃ʋӋًȋOu؃]^_̀@s sË3Ҁ33jȂYUEM %#Vt1W}3;t VV0LYY覞j_VVVVV8]|_uPu t LKYY3^]U`|+d3ʼnE}SVW}3i,d58'd33C;u3EPSh'dSօti,d 'dxu jXi,di,d;uuuuu t;u9} }u E@E 9}u E@Eu 9EYttE 'dWWWWuuWuӋ;u6~;w6F=wj;tP8;Yt E}9}VWuhV WWVuuuWuӅF;~D=w=D6 =w j;P蹛;Yt 3;tb9} u E@E }Suu4u fu fN4'df~Etf>uWSu{ eSqYuhEYe_^[M3UUuMXu Euuuuu P}tMapjh/+d\3ۉ]jY]j_};=@{,d}W0k,d9tD@ tPriYtE|(0k,d P'd0k,d4覈Y0k,dGE EjvYËD$u` 3V3;|;P{,drCVVVVV x3^Ëȃ `{,dD@^USVu 3;W}u;v E;t3E;tvӚj^SSSSS0xRuM(WE9XfEf=v6;t;v WSVS 脚*y8]tMap_^[;t.;w(Yj"^SSSSS0x8]tE`puE;t8]0E`p$M QSWVjMQS] p 'd;t9] bM;t 'dzH;k;cWSVR Sjt$t$t$t$ËD$VW|Z;P{,dsR<`{,d<u6=<`,dS\$utHtHuSjSjSj@'d3[- 5 _^ËL$S3;VW|[; P{,dsS<`{,d@t58t0=<`,du+tItIuSjSjSj@'d 3謘 贘_^[ËD$u蝘 肘 V3;|";P{,dsȃ `{,d@u$]0CVVVVV u^Ë^j h/+dv}4`{,dE39^u6j Y]9^uhF PYYu]FE09]t`{,dD8 P 'dE63ۋ}j YËD$ȃ `{,dD P$'djh0+d贏M3}j dYubj Y}}؃@<4`{,du`{,d;Fu\~u9j Y3C]~uhF PYYu]Fe(}u^ S 'dFtS$'d@낋}؋uj YÃ}uF+4`{,du}uyG+j@j /YYEta `{,dP{,d ;s@@ `@E}σ`{,dDWYuME Euj YU$`|+d3ʼn V39$Euuu3;u'處0VVVVV5sSW4`{,dNJX$u]tu3$u&030VVVVVr0@ tjjjiY9D,~@l39HEP4MH'd39MtD'd]E39$EGEE= u3 Eǃx8tP4 `8jPEP^Yt4M+$3@;VjESPk CEjSEPM 3PPjQjMQPuCE 'dvjEPVPE4l'dIEM9uE>}jEPjPEƅ 4l'd}EEa<t<u33f CCEuM<t<u9utCf;EYE}tj XPETCf;EYEE$9EHET4D8k3ɋ@+ۋEM9$EtuMe+ME;$s'UEA u E @E@E}rы؍E+jEPSEP4l'dEE;E+E;$rE9$uMe+ME;$s3UEAAf uEf @@EEf@@}rŋ؍E+jEPSEP4l'd$EE;E+E;$p9$2Me+Mj^;$s,Uuf u f uufƁ}Rr3VVhQ++PPVh 'd;tyjEP+P5PE4l'dt u;  'dE;GE+E;$E60jMQ$u0l'dt EeE  'dE}u]}t'j^9uu 06u Y+uD@t E8u3ڏ E+E_[3^ZIjh(0+dEu裏 舏 3;|;P{,dr!z8` WWWWWmɋ`{,d L1tPY}D0tuu u? E 8ME ExuHYjhH0+dEu贎 3;|;P{,dr蓎 SSSSSIlЋ<`{,dLtP1Y]Dt1uYPL'du  'dE]9]t2M ME E藆ugYU4S3EVW]܉]؈]E ]t ]E E]EPGYt SSSSSCjEP%rYt SSSSS(jMu@u9EtM+útGHt.Ht&U8j^SSSSS0jUtuE@}EjY+t7+t*+t+t@u9}EEE E]E#¹;;t0;t,;t==@E/E&E=t=te;EEEt ``,d#MxE@tMM}uMft } tME롨tM{uʋE=4'dSuuEPuuu ׃EumM#;u+Et%eSuEuPuuu ׃Eu46`{,dD0  'dPXY,u'd;uD6`{,dD0  'dVYu,'d;u܊ 룃uM@ uMu6 Ѓ`{,dYYMLЃ`{,dD$ MeHMGEtqjW6 C ;ljEuS8tM6ʲjEP6]= u}uERP6H; ;tSS6B ;tE@M@uE#u } EE#;tD=t)=@t"=t)=@t"=t=@uEM#;u E]EtOE@]uFE#=@=G;u"E;v `{,dD$2M0 `{,dD$M 8]u!Etȃ `{,dD }#;Eu,'dSuEjPuWu 4'd 'dPvȃ `{,dD 6YjSS6! SSS6 #ƒjEP6: tg}uUEE;jSS6 tySSS6#ƒ_=E%=u6YYj^0=uSj6? E SS6? E3HtHEEEEE+PD=P60 t 9}6WY踆E6 `{,d_^[jhh0+d~3u3};;uoj_8VVVVV&dY39u;t9utE%@t‰uuuu uEP0EEE;t~3}9ut(9ut `{,dD 7BYUjuuuuu ]UVuM BU3;u/艅VVVVV?c}tE`pS] ;u/RVVVVVc}tE`pE9pu$EPSRG }uMapiWf BDUtY:u3ljpMjQjJRWp EP耒$ufEfEfMffEEэ At ff CDtU;u3hjpMjQjKQWp EP$ufEuHfEfMffȋECэ At ff;u,ftYt} ^]G @SVt9u3D$ 2L$ PCC>Yuy8*uj?rY|$ ^[U$ t`|+d3ʼnSV3WMu]܉EEEȉEEЉEE5u/vy3PPPPP*W}tE`pV3;uAyVVVVVf;ΉuԉuuuMj^39Eԉ}QfXw h'dUk 'djZ;‰EV$c*d3MEEEȉEЉEE| t<t++t+tX UVMMMDM8 u0f*u]܉EM] Ek ɍDЉEef*u]܉EMEk ɍDЉEItEht7ltwMf?luM{MrM if=6uf4uMJf=3uf2ue.f=d$f=if=of=uf=xf=XeEQuEYdSt_At+tA+t+ EM؃M@}uuEE<fE0M fE0uM }uE ]܋[]u+dEeuMQP@YYtFFE9}|X?+th7+3FE ủ]܉Et-EEPEEEPEP} ufEEEuL]t-Ht&fEMt+Ee+dEPNYptegjitUntoE쀉UtIM@3]FsE t fEfEԉEM@E fEGڋCSsufguHE?9E~E}~.}]WbYMjEZt E}EڋCECEEPuu]PuEVP5h+d[YЋ]t}uEPV5t+d[YYYf}guuEPV5p+d[YYY>-u MFuVrUE!s<+VE'EEEQfE0fEƉufEE tE@]tCCE@Ct3҉]E@t|s؃ځMfEڋu3ۃ}} Ee9E~E u!EЍEM t$EؙRPSWK&09]~MN̍+FfEEutDt΀90t9MM0@*u+dEEE Of8tƅu+EE}E@t+ftfE-tfE+ t fE E]ȋu++]E uuESj uЋ}EԍMEYtEuWSj0Et }uN~J}uM؍EPEEWPE~uEu }}YM MVE6Y}|EtuESj }t uA^eY}]fEt}t }}tE`pEԋ_^3[*+*d*d*d*d#*d,*dc*dD*dU SVWsX39Dj,dE]]]h<'dh'd;y5d'dh0'dW;cPW$ 'dWDj,dPW$ 'dWHj,dPWLj,dEPTYYt SSSSSL}u,h'dWP[W;YTj,dth'dWPCWYPj,dPj,dM;ty9 Tj,dtqPW5Tj,dW;YYtV;tR;tMQj MQjPׅtEu3EPZTYt SSSSS&L}r M DM;Hj,d;Et1PW;Yt&;ÉEtLj,d;EtPW;YtuЉE5Dj,dV;Ytuu uu3_^[ËL$V3;|~ u8`,d^á8`,d 8`,d^nVVVVVL^U$X(`|+d3ʼn+dVtj NY踽tj躽Y+d]|ux}tfff]pfElfehfmdE@jPEjP*'E EЍEjE@uE'dEP'djFTj jt$ 3 U,EH SفMHMH?WMEu'339\u @|33}૫jXeVu}ԥ5Ћ+dNNс]EyJB|j3Y+@ME҅T|u@|nƙjY#yNFe+3BL1u19ur"9Ut+eLr;ursEHUMyщMM!E@} jY|+3}tC̋+d+ Ћ+d;} 3}૫ ;+Euԋȍ}ख़¥yJBeeE )U׋]\3#ωMM u3uE}u|ӋjMZ+;|1tdJ}5Ћ+dNNсEyJBjY+3B\M҅T|u@|fƙjY#yNFe3+BL1<;r;sE9MtLr3;rs3G1HyދM!E@} jY|+3 ԋ+dA‹yJBeeE )U׋]\3#ωMM u3uE}u|ӋjMZ+;|1tdJ}j3XZ;ȋ+d ԋ+d3}૫M‹yJBeeE )U׋]\3#ωMM u3uE}u|ӋjMZ+;|1tdJ}ȋ+d ܋+d3@܋+de؋‹yJBeeE )U֋M|#ΉMM }|}ME}}|ЋjMZ+;|1tdJ}3^jY+ ԋ+dMɁ ً ؋+d ]@u M UY uM _[U,EH SفMHMH?WMEu'339\u @|33}૫jXeVu}ԥ5+dNNс]EyJB|j3Y+@ME҅T|u@|nƙjY#yNFe+3BL1u19ur"9Ut+eLr;ursEHUMyщMM!E@} jY|+3}tC+d+ +d;} 3}૫ ;+Euԋȍ}ख़¥yJBeeE )U׋]\3#ωMM u3uE}u|ӋjMZ+;|1tdJ}5+dNNсEyJBjY+3B\M҅T|u@|fƙjY#yNFe3+BL1<;r;sE9MtLr3;rs3G1HyދM!E@} jY|+3 +dA‹yJBeeE )U׋]\3#ωMM u3uE}u|ӋjMZ+;|1tdJ}j3XZ;+d +d3}૫M‹yJBeeE )U׋]\3#ωMM u3uE}u|ӋjMZ+;|1tdJ}+d +d3@+de؋‹yJBeeE )U֋M|#ΉMM }|}ME}}|ЋjMZ+;|1tdJ}3^jY+ +dMɁ ً +d ]@u M UY uM _[U|`|+d3ʼnEES3V3EE F39]$WE}]u]]]]]]]ubSSSSS@3UU< t < t< t< uB0B /$ +dȀ1wjYJ݋M$ :ujY+tHHt jYE뢃ejY뙊Ȁ1uvM$ :uj<+t(<-t$:t@M}ED% u$L& t9]t@MED& SMQuP4d'd|M;q;MhMD};t M9 u ]E;؉]EM<< t CAMEH;sA8 u AAM uEmEjEPjEP4d'du  'duE}t?DHt} t ML%;]u} tjjju} t CE9EGD@uC+E}EK xC3@;]rK @+dt+du wI*zA;u@AHt$CQ| T%Cu T&C+ؙjRPu-E+]Pu Sujh'dEu4 'dPIYME;E tP5YEEE3;EL0;tMf9 u ]E;؉]EEff tf CC@@EM;s!Hf9 uEf MEjEPjEP4d'du  'duZ}tTDHt'f} tf MLML%D& );]uf} tjjjuf} tf CCE9Et@uffCC+]] 'dj^;uoG wG0hmX][3_[^Vt$V袮Yu/G ^Wt$jt$PP'du 'd3t PGY`{,dD0 _^US] Vu`{,d 0A%EA$W@;tPtBt&tu=I L1$⁀'I L1$₀a I L1$!}u %_^[]ËD$V3;uFVVVVV#jX^Ë k,d3^UQVu VAnE F YuE N ;@t E"tfNF F feSj[ f F u,a ;t a@;u u کYuVYfF WF>HN++˅N~WPu d EN F ?M tt`{,d|+d@ tSjjQH#ƒt-F]fjEPu ]f] E9}t N %_[^UWVSM tMu} AZ I& t' t#:r:w:r:w:u u3:t rً[^_U`|+d3ʼnEESV39u WEN@0ppFX}𥥥< ыH Ή}e ˋ] ׍<;0PHr;sE39]8tr;rs3CۉptAHHU3;r;s3FXt@MHe ?< PU މxX4;Ur;sE}0tO3;rs3B҉HtCXM E} 3&HP EH9ptջXu00xE04? H ʅˉpHtfMfH M_^3[jh0+d:39H{,dtVE@tH9D+dt@EU.E=t =t33@Ëe%D+deUEeUs:3PPjPjh@h'd4'dL+dáL+dV5,'dttP֡H+dttP^%'d%p'd%t'd%l'd%|'dh)+doYh)+d_Y̹X:,d6gh*+dC,d;Yh`*+d/Yh D,du  D,ddh*+dC,dC,dY̡+dtVPu^+d̡C,dtFVpWtPjO tj=FG WF_C,d^V5C,dt^fVC,dC,dC,dX:,d^,fV5C,dC,dt4Ft PC,dtFt PC,dtVj'dP'd^̡D,dtPD,d@`,dD'd@`,d= _'de'dt(dt(dt(dt(dA(dG(d)d)d|++d++d++df+df+d")d()dP!*da!*d$*d ,+d,+d4,+dt|+d $*d|+d 1h*d 7*d_8*d$9*d<*dXD*dSF*dP*dS*dJU*dVU*dW*dZ*dZ*de*de*di*d+m*dp*d9;=`I!p  c ljk f@Vp$ '@NЦp0_PP?p@@//p`PP@^D^7 c f f@Vp$ '@NЦp0_P?p@//pP`P ^? ???5?J?e?o?|?????????????? @@@,@3@;@E@L@S@a@o@}@@@@@@@@@@@@@AAA*A9ABAMA]AmAuAAAAAAAAAAAAA>>>>AABBBBB$B1B;BFBOBVB^BeBsB~BBBBBBBBBBBBBCCC#C*C/C5CBCJCRCUCdCmC|CCCCCCCCCCCCCC  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~1.dll_EFN_GetManagedExcepStack_EFN_GetManagedObjectFieldInfo_EFN_GetManagedObjectName_EFN_StackTraceCLRStackCOMStateClrStackDebugExtensionInitializeDebugExtensionNotifyDebugExtensionUninitializeDumpArrayDumpAssemblyDumpClassDumpDomainDumpHeapDumpILDumpLogDumpMDDumpMTDumpMethodSigDumpModuleDumpObjDumpRuntimeTypesDumpSigDumpStackDumpStackObjectsDumpVCDumplogDumpruntimetypesEEHeapEEStackEEVersionEHInfoEhinfoFinalizeQueueFindAppDomainFindappdomainGCHandleLeaksGCHandleleaksGCHandlesGCInfoGCRootGchandleleaksHelpIP2MDMinidumpModeMinidumpmodeName2EEObjSizePrintExceptionPrintexceptionProcInfoRCWCleanupListRcwcleanuplistSOSFlushSaveModuleStopOnExceptionStoponexceptionSyncBlkThreadPoolThreadsToken2EETraverseHeapTraverseheapUVMMapVMStatVerifyDACVerifyHeapVerifyStackTraceVerifyheapWatsonBucketsbpmdclrstackcomstatedadodsodumparraydumpassemblydumpclassdumpdomaindumpheapdumpildumplogdumpmddumpmethodsigdumpmoduledumpmtdumpobjdumpruntimetypesdumpsigdumpstackdumpstackobjectsdumpvceeheapeestackeeversionehinfofinalizequeuefindappdomaingchandleleaksgchandlesgcinfogcroothelpip2mdminidumpmodename2eeobjsizepeprintexceptionprocinforcwcleanuplistsavemodulesoesosflushstoponexceptionsyncblkthreadpoolthreadstoken2eetraverseheaptstuverifyheapvmmapvmstatp+d0Q+d'd'd'd'd'd'd'd'd'd'd'd'd'd'd|'dt'dl'dd'd\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'d\'dH'dP'd\'dh'dp'd |'d@'d'd'd'd'd'd'd 'd@'d'd'd 'd 'd 'd, 'd 8 'd@H 'dP 'dX 'dd 'dt 'd 'd 'd 'd@ 'd 'd`p'dp'dp'dp'dp'dp'dp'dp'dp'dp'dp'dp'd|'d.PAD|'d.PAXESPȑ'd̑'dБ'dԑ'dؑ'dܑ'd'd'd'd'd'dؤ'dФ'dȤ'd'd'd 'd 'd 'd 'd 'd 'd|'dt'dl'd`'dX'dP'dD'd8'd,'d 'd'd'd'd'd'dأ'ḍ'd ģ'd !'d!"'d"#'d#$'d$%'d%&'d&'&'d'('d()'d )*&'d*+'d+,x'd,-l'd-.d'd./\'d/0T'd01L'd12D'd238'd34,'d45 'd56'd67'd78'd89'd9:'d:;'d;<'d<='d=>'d>?'d?@آ'd@AТ'dABȢ'dBC'dCD'dDE'd EF'dFG'dGH'dHI'dIJt'dJKh'dKL\'dLMT'dMNH'dNO<'dOP0'dPQ$'dQR'dRS 'dST'dTU'dUV'dVWܡ'dWXء'dXYԡ'dYZС'dZ[̡'d[\ġ'd\]'d]^'d^_'d_`'d`a'dab'dbc'dcd'dde'def'dfg'dgh'dhi|'dijt'djkl'dkld'dlm\'dmnT'dnoH'dop@'dpq8'dqr0'd rs('dst'dtu'duv'dvw'dwx'dxy'dyz'dz{'d{|'d|}'d}~ؠ'd~Р'dȠ'd'd'd'd'd'dp'd`'dP'd@'d0'd 'd'd'd 'd'd'd'd'dԟ'dȟ'd'd'd'd'd'd'dt'dh'd\'dP'dD'd8'd,'d 'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'dԞ'dȞ'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'dx'd p'dh'd`'dT'dH'd@'d4'd,'d 'd'd 'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd'd؝'dН'dȝ'd'd'd'd'd'd'd'd'd'd'dx'dp'dd'd'd \'d T'd L'd D'd <'d 4'd('d'd'd'd'd'd'd'dܜ'dԜ'd'd̜'d'dĜ'd'd'd'd 'd !'d!"'d"#'d$'d%'d'd'd'd-'d'd-'d|'d-'dx'dt'dp'd-'dl'd-'dh'd-'d-'dd'd-'d-'d`'d-'d-'d\'d-'d-'dX'dT'd-'d-'d-'d-'dP'd-'d-'dL'd-'d-'dH'dD'd@'dd'd`'d\'dX'dP'dH'dD'd <'d@4'd,'dd'dX'dH'd<'d4'd,'d$'d'd'd 'd'd'd'd'dܬ'dԬ'dȬ'd'd'd'd'dl'dT'd<'d8'd4'd0'd$'d'd'd'dԫ'd'd'd'd'd|'dd'dL'd8'd('d'd'd'd'd 'd'd'd'd'd 'd$'d('d,'d0'd4'd8'd<'d@'dD'dȑ'd̑'dБ'dԑ'dؑ'dܑ'd'dH'dN@D0'd|'d.?AVbad_alloc@std@@|'d.?AVexception@std@@us0'd|'d.?AVtype_info@@P*d  x 0'd        ! 5A CPR S WY l m pr   )     abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ8+d`y!@~ڣ @ڣ AϢ[@~QQ^ _j21~ܼ'dC`+d`+d`+d`+d`+dȊ+dغ'd`'d'd+dh+dh+d8+d_*d_*d_*d_*d_*d_*d_*d_*d_*d_*d@k,d@k,d'd'd0'd'd'd 'd 'd'dķ'd'dt'd<'d'dܶ'd'd|'d\'d'd 'd!ȴ'd"('dx'dy'dz'd%'d'd غ'dڼ'd'd'd'd'd'd'd'd'd'd'd'd'd'd|'dp'dp'dp'dp'dp'dp'dp'dp'dp'dp'dp'dp'dt'dh'd`'dX'dp'dP'dH'd@'d4'd,'d 'd'd'd 'd'd'd'd +d.Ċ+di,di,di,di,di,di,di,di,di,dȊ+d.pPSTPDT(+dh+d5 @ ;Zx0Nm:Yw/Ml@@@@ @P@$@@ @4@N@ p+ŝi@]%O@qוC)@D@<զIx@oGAkU'9p|Bݎ~QCv)/&D(DJzEeǑF e uuvHMXB䧓9;5SM]=];Z] T7aZ%]g']݀nLɛ R`%u?q= ףp= ף?Zd;On?,eX?#GGŧ?@il7?3=BzՔ?aw̫?/L[Mľ?S;uD?g9Eϔ?$#⼺;1az?aUY~S|_?/D?$?9'*?}d|FU>c{#Tw=:zc%C1 COMMAND: \\ The first command is "contents" which is the general help screen. The rest correspond to SOS command names. This file is embedded as a resource in the SOS binary. Be sure to list any new commands here. ------------------------------------------------------------------------------- COMMAND: contents. SOS is a debugger extension DLL designed to aid in the debugging of managed programs. Functions are listed by category, then roughly in order of importance. Shortcut names for popular functions are listed in parenthesis. Type "!help " for detailed info on that function. Object Inspection Examining code and stacks ----------------------------- ----------------------------- DumpObj (do) Threads DumpArray (da) CLRStack DumpStackObjects (dso) IP2MD DumpHeap U DumpVC DumpStack GCRoot EEStack ObjSize GCInfo FinalizeQueue EHInfo PrintException (pe) COMState TraverseHeap BPMD Examining CLR data structures Diagnostic Utilities ----------------------------- ----------------------------- DumpDomain VerifyHeap EEHeap DumpLog Name2EE FindAppDomain SyncBlk SaveModule DumpMT GCHandles DumpClass GCHandleLeaks DumpMD VMMap Token2EE VMStat EEVersion ProcInfo DumpModule StopOnException (soe) ThreadPool MinidumpMode DumpAssembly DumpMethodSig Other DumpRuntimeTypes ----------------------------- DumpSig FAQ RCWCleanupList DumpIL \\ COMMAND: faq. >> Where can I get the right version of SOS for my build? If you are running version 1.1 or 2.0 of the CLR, SOS.DLL is installed in the same directory as the main CLR dll (MSCORWKS.DLL). Newer versions of the Windows Debugger provide a command to make it easy to load the right copy of SOS.DLL: ".loadby sos mscorwks" That will load the SOS extension DLL from the same place that MSCORWKS.DLL is loaded in the process. You shouldn't attempt to use a version of SOS.DLL that doesn't match the version of MSCORWKS.DLL. You can find the version of MSCORWKS.DLL by running "lm v m mscorwks" in the debugger. If you are using a dump file created on another machine, it is a little bit more complex. You need to make sure the mscordacwks.dll file that came with that install is on your symbol path, and you need to load the corresponding version of sos.dll (typing .load rather than using the .loadby shortcut). Within the Microsoft corpnet, we keep tagged versions of mscordacwks.dll, with names like mscordacwks__.dll that the Windows Debugger can load. If you have the correct symbol path to the binaries for that version of the Runtime, the Windows Debugger will load the correct mscordacwks.dll file. >> I have a chicken and egg problem. I want to use SOS commands, but the CLR isn't loaded yet. What can I do? In the debugger at startup you can type: "sxe clrn" Let the program run, and it will stop with the notice "CLR notification: module 'mscorlib' loaded" At this time you can use SOS commands. To turn off spurious notifications, type: "sxd clrn" >> I got the following error message. Now what? 0:000> .loadby sos mscorwks 0:000> !DumpStackObjects Failed to find runtime DLL (mscorwks.dll), 0x80004005 Extension commands need mscorwks.dll in order to have something to do. 0:000> This means that the CLR is not loaded yet, or has been unloaded. You need to wait until your managed program is running in order to use these commands. If you have just started the program a good way to do this is to type bp mscorwks!EEStartup "g @$ra" in the debugger, and let it run. After the function EEStartup is finished, there will be a minimal managed environment for executing SOS commands. >> I have a partial memory minidump, and !DumpObj doesn't work. Why? In order to run SOS commands, many CLR data structures need to be traversed. When creating a minidump without full memory, special functions are called at dump creation time to bring those structures into the minidump, and allow a minimum set of SOS debugging commands to work. At this time, those commands that can provide full or partial output are: CLRStack Threads Help PrintException EEVersion For a minidump created with this minimal set of functionality in mind, you will get an error message when running any other commands. A full memory dump (obtained with ".dump /ma " in the Windows Debugger) is often the best way to debug a managed program at this level. >> What other tools can I use to find my bug? Turn on Managed Debugging Assistants. These enable additional runtime diagnostics, particularly in the area of PInvoke/Interop. Adam Nathan has written some great information about that: http://blogs.gotdotnet.com/anathan/categoryview.aspx/Debugging \\ COMMAND: stoponexception. !StopOnException [-derived] [-create | -create2] [] !StopOnException helps when you want the Windows Debugger to stop on a particular managed exception, say a System.OutOfMemoryException, but continue running if other exceptions are thrown. The command can be used in two ways: 1) When you just want to stop on one particular CLR exception At the debugger prompt, anytime after loading SOS, type: !StopOnException -create System.OutOfMemoryException 1 The pseudo-register number (1) indicates that SOS can use register $t1 for maintaining the breakpoint. The -create parameter allows SOS to go ahead and set up the breakpoint as a first-chance exception. -create2 would set it up as a 2nd-chance exception. 2) When you need more complex logic for stopping on a CLR exception !StopOnException can be used purely as a predicate in a larger expression. If you type: !StopOnException System.OutOfMemoryException 3 then register $t3 will be set to 1 if the last thrown exception on the current thread is a System.OutOfMemoryException. Otherwise, $t3 will be set to 0. Using the Windows Debugger scripting language, you could chain such calls together to stop on various exception types. You'll have to manually create such predicates, for example: sxe -c "!soe System.OutOfMemoryException 3; !soe -derived System.IOException 4; .if(@$t3==1 || @$t4==1) { .echo 'stop' } .else {g}" The -derived option will cause StopOnException to set the pseudo-register to 1 even if the thrown exception type doesn't exactly match the exception type given, but merely derives from it. So, "-derived System.Exception" would catch every exception in the System.Exception heirarchy. The pseudo-register number is optional. If you don't pass a number, SOS will use pseudo-register $t1. Note that !PrintException with no parameters will print out the last thrown exception on the current thread (if any). You can use !soe as a shortcut for !StopOnException. \\ COMMAND: minidumpmode. !MinidumpMode <0 or 1> Minidumps created with ".dump /m" or ".dump" have a very small set of CLR-specific data, just enough to run a subset of SOS commands correctly. You are able to run other SOS commands, but they may fail with unexpected errors because required areas of memory are not mapped in or only partially mapped in. At this time, SOS cannot reliably detect if a dump file is of this type (for one thing, custom dump commands can map in additional memory, but there is no facility to read meta-information about this memory). You can turn this option on to protect against running unsafe commands against small minidumps. By default, MinidumpMode is 0, so there is no restriction on commands that will run against a minidump. \\ COMMAND: dumpobj. !DumpObj [-nofields] This command allows you to examine the fields of an object, as well as learn important properties of the object such as the EEClass, the MethodTable, and the size. You might find an object pointer by running !DumpStackObjects and choosing from the resultant list. Here is a simple object: 0:000> !DumpObj a79d40 Name: Customer MethodTable: 009038ec EEClass: 03ee1b84 Size: 20(0x14) bytes (C:\pub\unittest.exe) Fields: MT Field Offset Type VT Attr Value Name 009038ec 4000008 4 Customer 0 instance 00a79ce4 name 009038ec 4000009 8 Bank 0 instance 00a79d2c bank Note that fields of type Customer and Bank are themselves objects, and you can run !DumpObj on them too. You could look at the field directly in memory using the offset given. "dd a79d40+8 l1" would allow you to look at the bank field directly. Be careful about using this to set memory breakpoints, since objects can move around in the garbage collected heap. What else can you do with an object? You might run !GCRoot, to determine what roots are keeping it alive. Or you can find all objects of that type with "!DumpHeap -type Customer". The column VT contains the value 1 if the field is a valuetype structure, and 0 if the field contains a pointer to another object. For valuetypes, you can take the MethodTable pointer in the MT column, and the Value and pass them to the command !DumpVC. The abbreviation !do can be used for brevity. The arguments in detail: -nofields: do not print fields of the object, useful for objects like String \\ COMMAND: dumparray. !DumpArray [-start ] [-length ] [-details] [-nofields] This command allows you to examine elements of an array object. The arguments in detail: -start : optional, only supported for single dimension array. Specify from which index the command shows the elements. -length : optional, only supported for single dimension array. Specify how many elements to show. -details: optional. Ask the command to print out details of the element using !DumpObj and !DumpVC format. -nofields: optional, only takes effect when -detail is used. Do not print fields of the elements. Useful for array of objects like String Example output: 0:000> !dumparray -start 2 -length 5 -details 00ad28d0 Name: Value[] MethodTable: 03e41044 EEClass: 03e40fc0 Size: 132(0x84) bytes Array: Rank 1, Number of elements 10, Type VALUETYPE Element Type: Value [2] 00ad28f0 Name: Value MethodTable 03e40f4c EEClass: 03ef1698 Size: 20(0x14) bytes (C:\bugs\225271\arraytest.exe) Fields: MT Field Offset Type Attr Value Name 5b9a628c 4000001 0 System.Int32 instance 2 x 5b9a628c 4000002 4 System.Int32 instance 4 y 5b9a628c 4000003 8 System.Int32 instance 6 z [3] 00ad28fc Name: Value MethodTable 03e40f4c EEClass: 03ef1698 Size: 20(0x14) bytes (C:\bugs\225271\arraytest.exe) Fields: MT Field Offset Type Attr Value Name 5b9a628c 4000001 0 System.Int32 instance 3 x 5b9a628c 4000002 4 System.Int32 instance 6 y 5b9a628c 4000003 8 System.Int32 instance 9 z [4] 00ad2908 Name: Value MethodTable 03e40f4c EEClass: 03ef1698 Size: 20(0x14) bytes (C:\bugs\225271\arraytest.exe) Fields: MT Field Offset Type Attr Value Name 5b9a628c 4000001 0 System.Int32 instance 4 x 5b9a628c 4000002 4 System.Int32 instance 8 y 5b9a628c 4000003 8 System.Int32 instance 12 z [5] 00ad2914 Name: Value MethodTable 03e40f4c EEClass: 03ef1698 Size: 20(0x14) bytes (C:\bugs\225271\arraytest.exe) Fields: MT Field Offset Type Attr Value Name 5b9a628c 4000001 0 System.Int32 instance 5 x 5b9a628c 4000002 4 System.Int32 instance 10 y 5b9a628c 4000003 8 System.Int32 instance 15 z [6] 00ad2920 Name: Value MethodTable 03e40f4c EEClass: 03ef1698 Size: 20(0x14) bytes (C:\bugs\225271\arraytest.exe) Fields: MT Field Offset Type Attr Value Name 5b9a628c 4000001 0 System.Int32 instance 6 x 5b9a628c 4000002 4 System.Int32 instance 12 y 5b9a628c 4000003 8 System.Int32 instance 18 z \\ COMMAND: dumpstackobjects. !DumpStackObjects [-verify] [top stack [bottom stack]] This command will display any managed objects it finds within the bounds of the current stack. Combined with the stack tracing commands like K and !CLRStack, it is a good aid to determining the values of locals and parameters. If you use the -verify option, each non-static CLASS field of an object candidate is validated. This helps to eliminate false positives. It is not on by default because very often in a debugging scenario, you are interested in objects with invalid fields. The abbreviation !dso can be used for brevity. \\ COMMAND: dumpheap. !DumpHeap [-stat] [-strings] [-short] [-min ] [-max ] [-thinlock] [-startAtLowerBound] [-mt ] [-type ] [start [end]] !DumpHeap is a powerful command that traverses the garbage collected heap, collection statistics about objects. With it's various options, it can look for particular types, restrict to a range, or look for ThinLocks (see !SyncBlk documentation). Finally, it will provide a warning if it detects excessive fragmentation in the GC heap. When called without options, the output is first a list of objects in the heap, followed by a report listing all the types found, their size and number: 0:000> !dumpheap Address MT Size 00a71000 0015cde8 12 Free 00a7100c 0015cde8 12 Free 00a71018 0015cde8 12 Free 00a71024 5ba58328 68 00a71068 5ba58380 68 00a710ac 5ba58430 68 00a710f0 5ba5dba4 68 ... total 619 objects Statistics: MT Count TotalSize Class Name 5ba7607c 1 12 System.Security.Permissions.HostProtectionResource 5ba75d54 1 12 System.Security.Permissions.SecurityPermissionFlag 5ba61f18 1 12 System.Collections.CaseInsensitiveComparer ... 0015cde8 6 10260 Free 5ba57bf8 318 18136 System.String ... "Free" objects are simply regions of space the garbage collector can use later. If 30% or more of the heap contains "Free" objects, the process may suffer from heap fragmentation. This is usually caused by pinning objects for a long time combined with a high rate of allocation. Here is example output where !DumpHeap provides a warning about fragmentation: Fragmented blocks larger than 1MB: Addr Size Followed by 00a780c0 1.5MB 00bec800 System.Byte[] 00da4e38 1.2MB 00ed2c00 System.Byte[] 00f16df0 1.2MB 01044338 System.Byte[] The arguments in detail: -stat Restrict the output to the statistical type summary -strings Restrict the output to a statistical string value summary -short Limits output to just the address of each object. This allows you to easily pipe output from the command to another debugger command for automation. -min Ignore objects less than the size given in bytes -max Ignore objects larger than the size given in bytes -thinlock Report on any ThinLocks (an efficient locking scheme, see !SyncBlk documentation for more info) -startAtLowerBound Force heap walk to begin at lower bound of a supplied address range. (During plan phase, the heap is often not walkable because objects are being moved. In this case, DumpHeap may report spurious errors, in particular bad objects. It may be possible to traverse more of the heap after the reported bad object. Even if you specify an address range, !DumpHeap will start its walk from the beginning of the heap by default. If it finds a bad object before the specified range, it will stop before displaying the part of the heap in which you are interested. This switch will force !DumpHeap to begin its walk at the specified lower bound. You must supply the address of a good object as the lower bound for this to work. Display memory at the address of the bad object to manually find the next method table (use !dumpmt to verify). If the GC is currently in a call to memcopy, You may also be able to find the next object's address by adding the size to the start address given as parameters.) -mt List only those objects with the MethodTable given -type List only those objects whose type name is a substring match of the string provided. start Begin listing from this address end Stop listing at this address A special note about -type: Often, you'd like to find not only Strings, but System.Object arrays that are constrained to contain Strings. ("new String[100]" actually creates a System.Object array, but it can only hold System.String object pointers). You can use -type in a special way to find these arrays. Just pass "-type System.String[]" and those Object arrays will be returned. More generally, "-type []". The start/end parameters can be obtained from the output of !EEHeap -gc. For example, if you only want to list objects in the large heap segment: 0:000> !eeheap -gc Number of GC Heaps: 1 generation 0 starts at 0x00c32754 generation 1 starts at 0x00c32748 generation 2 starts at 0x00a71000 segment begin allocated size 00a70000 00a71000 010443a8 005d33a8(6108072) Large object heap starts at 0x01a71000 segment begin allocated size 01a70000 01a71000 01a75000 0x00004000(16384) Total Size 0x5d73a8(6124456) ------------------------------ GC Heap Size 0x5d73a8(6124456) 0:000> !dumpheap 1a71000 1a75000 Address MT Size 01a71000 5ba88bd8 2064 01a71810 0019fe48 2032 Free 01a72000 5ba88bd8 4096 01a73000 0019fe48 4096 Free 01a74000 5ba88bd8 4096 total 5 objects Statistics: MT Count TotalSize Class Name 0019fe48 2 6128 Free 5ba88bd8 3 10256 System.Object[] Total 5 objects Finally, if gc heap corruption is present, you may see an error like this: 0:000> !dumpheap -stat object 00a73d24: does not have valid MT curr_object : 00a73d24 Last good object: 00a73d14 ---------------- That indicates a serious problem. See the help for !VerifyHeap for more information on diagnosing the cause. \\ COMMAND: dumpvc. !DumpVC
!DumpVC allows you to examine the fields of a value class. In C#, this is a struct, and lives on the stack or within an Object on the GC heap. You need to know the MethodTable address to tell SOS how to interpret the fields, as a value class is not a first-class object with it's own MethodTable as the first field. For example: 0:000> !DumpObj a79d98 Name: Mainy MethodTable: 009032d8 EEClass: 03ee1424 Size: 28(0x1c) bytes (C:\pub\unittest.exe) Fields: MT Field Offset Type Attr Value Name 0090320c 4000010 4 VALUETYPE instance 00a79d9c m_valuetype 009032d8 400000f 4 CLASS static 00a79d54 m_sExcep m_valuetype is a value type. The value in the MT column (0090320c) is the MethodTable for it, and the Value column provides the start address: 0:000> !DumpVC 0090320c 00a79d9c Name: Funny MethodTable 0090320c EEClass: 03ee14b8 Size: 28(0x1c) bytes (C:\pub\unittest.exe) Fields: MT Field Offset Type Attr Value Name 0090320c 4000001 0 CLASS instance 00a743d8 signature 0090320c 4000002 8 System.Int32 instance 2345 m1 0090320c 4000003 10 System.Boolean instance 1 b1 0090320c 4000004 c System.Int32 instance 1234 m2 0090320c 4000005 4 CLASS instance 00a79d98 backpointer !DumpVC is quite a specialized function. Some managed programs make heavy use of value classes, while others do not. \\ COMMAND: gcroot. !GCRoot [-nostacks] !GCRoot looks for references (or roots) to an object. These can exist in four places: 1. On the stack 2. Within a GC Handle 3. In an object ready for finalization 4. As a member of an object found in 1, 2 or 3 above. First, all stacks will be searched for roots, then handle tables, and finally the freachable queue of the finalizer. Some caution about the stack roots: !GCRoot doesn't attempt to determine if a stack root it encountered is valid or is old (discarded) data. You would have to use !CLRStack and !U to disassemble the frame that the local or argument value belongs to in order to determine if it is still in use. Because people often want to restrict the search to gc handles and freachable objects, there is a -nostacks option. \\ COMMAND: objsize. !ObjSize [] With no parameters, !ObjSize lists the size of all objects found on managed threads. It also enumerates all GCHandles in the process, and totals the size of any objects pointed to by those handles. In calculating object size, !ObjSize includes the size of all child objects in addition to the parent. For example, !DumpObj lists a size of 20 bytes for this Customer object: 0:000> !do a79d40 Name: Customer MethodTable: 009038ec EEClass: 03ee1b84 Size: 20(0x14) bytes (C:\pub\unittest.exe) Fields: MT Field Offset Type Attr Value Name 009038ec 4000008 4 CLASS instance 00a79ce4 name 009038ec 4000009 8 CLASS instance 00a79d2c bank 009038ec 400000a c System.Boolean instance 1 valid but !ObjSize lists 152 bytes: 0:000> !ObjSize a79d40 sizeof(00a79d40) = 152 ( 0x98) bytes (Customer) This is because a Customer points to a Bank, has a name, and the Bank points to an Address string. You can use !ObjSize to identify any particularly large objects, such as a managed cache in a web server. \\ COMMAND: finalizequeue. !FinalizeQueue [-detail] This command lists the objects registered for finalization. Here is output from a simple program: 0:000> !finalizequeue SyncBlocks to be cleaned up: 0 MTA Interfaces to be released: 0 STA Interfaces to be released: 1 generation 0 has 4 finalizable objects (0015bc90->0015bca0) generation 1 has 0 finalizable objects (0015bc90->0015bc90) generation 2 has 0 finalizable objects (0015bc90->0015bc90) Ready for finalization 0 objects (0015bca0->0015bca0) Statistics: MT Count TotalSize Class Name 5ba6cf78 1 24 Microsoft.Win32.SafeHandles.SafeFileHandle 5ba5db04 1 68 System.Threading.Thread 5ba73e28 2 112 System.IO.StreamWriter Total 4 objects The GC heap is divided into generations, and objects are listed accordingly. We see that only generation 0 (the youngest generation) has any objects registered for finalization. The notation "(0015bc90->0015bca0)" means that if you look at memory in that range, you'll see the object pointers that are registered: 0:000> dd 15bc90 15bca0-4 0015bc90 00a743f4 00a79f00 00a7b3d8 00a7b47c You could run !DumpObj on any of those pointers to learn more. In this example, there are no objects ready for finalization, presumably because they still have roots (You can use !GCRoot to find out). The statistics section provides a higher-level summary of the objects registered for finalization. Note that objects ready for finalization are also included in the statistics (if any). If you pass -detail then you get extra information on any SyncBlocks that need to be cleaned up, and on any RuntimeCallableWrappers (RCWs) that await cleanup. Both of these data structures are cached and cleaned up by the finalizer thread when it gets a chance to run. \\ COMMAND: printexception. !PrintException [-nested] [] This will format fields of any object derived from System.Exception. One of the more useful aspects is that it will format the _stackTrace field, which is a binary array. If _stackTraceString field is not filled in, that can be helpful for debugging. You can of course use !DumpObj on the same exception object to explore more fields. If called with no parameters, PrintException will look for the last outstanding exception on the current thread and print it. This will be the same exception that shows up in a run of !Threads. !PrintException will notify you if there are any nested exceptions on the current managed thread. (A nested exception occurs when you throw another exception within a catch handler already being called for another exception). If there are nested exceptions, you can re-run !PrintException with the "-nested" option to get full details on the nested exception objects. The !Threads command will also tell you which threads have nested exceptions. The abbreviation !pe can be used for brevity. \\ COMMAND: traverseheap. !TraverseHeap [-xml] !TraverseHeap writes out a file in a format understood by the CLR Profiler. You can download the CLR Profiler from this link: http://www.microsoft.com/downloads/details.aspx?FamilyId=86CE6052-D7F4-4AEB- 9B7A-94635BEEBDDA&displaylang=en It creates a graphical display of the GC heap to help you analyze the state of your application. If you pass the "-xml" flag, the file is instead written out in an easy-to-understand xml format: ... ... ... ... You can break into your process, load SOS, take a snapshot of your heap with this function, then continue. \\ COMMAND: threads. !Threads [-live] [-special] !Threads lists all the mananaged threads in the process. -live: optional. Only print threads associated with a live thread. -special: optional. With this switch, the command will display all the special threads created by CLR. Those threads might not be managed threads so they might not be shown in the first part of the command's output. Example of special threads include: GC threads (in concurrent GC and server GC), Debugger helper threads, Finalizer threads, AppDomain Unload threads, and Threadpool timer threads. Each thread has many attributes, many of which can be ignored. The important ones are discussed below: There are three ID columns: 1) The debugger shorthand ID (In fiber mode, if the thread is a fiber which is switched out by the host, this column will be shown as "<<<<") 2) The CLR Thread ID 3) The OS thread ID. If PreEmptiveGC is enabled for a thread, then a garbage collection can occur while that thread is running. For example, if you break in while a managed thread is making a PInvoke call to a Win32 function, that thread will be in PreEmptive GC mode. The Domain column indicates what AppDomain the thread is currently executing in. You can pass this value to !DumpDomain to find out more. The APT column gives the COM apartment mode. Exception will list the last thrown exception (if any) for the thread. More details can be obtained by passing the pointer value to !PrintException. If you get the notation "(nested exceptions)", you can get details on those exceptions by switching to the thread in question, and running "!PrintException -nested". \\ COMMAND: clrstack. !CLRStack [-a] [-l] [-p] CLRStack attempts to provide a true stack trace for managed code only. It is handy for clean, simple traces when debugging straightforward managed programs. The -p parameter will show arguments to the managed function. The -l parameter can be used to show information on local variables in a frame. SOS can't retrieve local names at this time, so the output for locals is in the format = . The -a (all) parameter is a short-cut for -l and -p combined. When you see methods with the name "[Frame:...", that indicates a transition between managed and unmanaged code. You could run !IP2MD on the return addresses in the call stack to get more information on each managed method. On IA64 and x64 platforms, Transition Frames are not displayed at this time. Especially on IA64, there is heavy optimization of parameters and locals. You can request the JIT compiler to not optimize functions in the managed app by creating a file myapp.ini (if your program is myapp.exe) in the same directory. Put the following lines in myapp.ini and re-run: [.NET Framework Debugging Control] GenerateTrackingInfo=1 AllowOptimize=0 \\ COMMAND: ip2md. !IP2MD Given an address in managed JITTED code, IP2MD attempts to find the MethodDesc associated with it. For example, this output from K: 0:000> K ChildEBP RetAddr 00a79c78 03ef02ab image00400000!Mainy.Top()+0xb 00a79c78 03ef01a6 image00400000!Mainy.Level(Int32)+0xb 00a79c78 5d3725a1 image00400000!Mainy.Main()+0xee 0012ea04 5d512f59 mscorwks!CallDescrWorkerInternal+0x30 0012ee34 5d7946aa mscorwks!CallDescrWorker+0x109 0:000> !IP2MD 03ef01a6 MethodDesc: 00902f40 Method Name: Mainy.Main() Class: 03ee1424 MethodTable: 009032d8 mdToken: 0600000d Module: 001caa38 IsJitted: yes CodeAddr: 03ef00b8 We have taken a return address into Mainy.Main, and discovered information about that method. You could run !U, !DumpMT, !DumpClass, !DumpMD, or !DumpModule on the fields listed to learn more. \\ COMMAND: u. !U [-gcinfo] [-ehinfo] | Presents an annotated disassembly of a managed method when given a MethodDesc pointer for the method, or a code address within the method body. Unlike the debugger "U" function, the entire method from start to finish is printed, with annotations that convert metadata tokens to names. ... 03ef015d b901000000 mov ecx,0x1 03ef0162 ff156477a25b call dword ptr [mscorlib_dll+0x3c7764 (5ba27764)] (System.Console.InitializeStdOutError(Boolean), mdToken: 06000713) 03ef0168 a17c20a701 mov eax,[01a7207c] (Object: SyncTextWriter) 03ef016d 89442414 mov [esp+0x14],eax If you pass the -gcinfo flag, you'll get inline display of the GCInfo for the method. You can also obtain this information with the !GCInfo command. If you pass the -ehinfo flag, you'll get inline display of exception info for the method. (Beginning and end of try/finally/catch handlers, etc.). You can also obtain this information with the !EHInfo command. \\ COMMAND: dumpstack. !DumpStack [-EE] [top stack [bottom stack]] [x86 documentation] This command provides a verbose stack trace obtained by "scraping." Therefore the output is very noisy and potentially confusing. The command is good for viewing the complete call stack when "kb" gets confused. For best results, make sure you have valid symbols. -EE will only show managed functions. You can also pass a stack range to limit the output. Use the debugger extension !teb to get the top and bottom stack values. [ia64 and x64 documentation] Rather than scraping, !DumpStack mimics the debugger's "K" command. Stackwalking is done very differently on these platforms, so SOS allows the Windows Debugger to unwind the frames, and supplies managed code information where possible. The [top stack [bottom stack]] arguments are ignored, but -EE functions just the same. \\ COMMAND: eestack. !EEStack [-short] [-EE] This command runs !DumpStack on all threads in the process. The -EE option is passed directly to !DumpStack. The -short option tries to narrow down the output to "interesting" threads only, which is defined by 1) The thread has taken a lock. 2) The thread has been "hijacked" in order to allow a garbage collection. 3) The thread is currently in managed code. See the documentation for !DumpStack for more info. \\ COMMAND: ehinfo. !EHInfo ( | ) !EHInfo shows the exception handling blocks in a jitted method. For each handler, it shows the type, including code addresses and offsets for the clause block and the handler block. For a TYPED handler, this would be the "try" and "catch" blocks respectively. Sample output: 0:000> !ehinfo 33bbd3a MethodDesc: 03310f68 Method Name: MainClass.Main() Class: 03571358 MethodTable: 0331121c mdToken: 0600000b Module: 001e2fd8 IsJitted: yes CodeAddr: 033bbca0 EHHandler 0: TYPED Clause: [033bbd2b, 033bbd3c] [8b, 9c] Handler: [033bbd3c, 033bbd50] [9c, b0] EHHandler 1: FINALLY Clause: [033bbd83, 033bbda3] [e3, 103] Handler: [033bbda3, 033bbdc5] [103, 125] EHHandler 2: TYPED Clause: [033bbd7a, 033bbdc5] [da, 125] Handler: [033bbdc5, 033bbdd6] [125, 136] \\ COMMAND: gcinfo. !GCInfo ( | ) !GCInfo is especially useful for CLR Devs who are trying to determine if there is a bug in the JIT Compiler. It parses the GCEncoding for a method, which is a compressed stream of data indicating when registers or stack locations contain managed objects. It is important to keep track of this information, because if a garbage collection occurs, the collector needs to know where roots are so it can update them with new object pointer values. Here is sample output where you can see the change in register state. Normally you would print this output out and read it alongside a disassembly of the method. For example, the notation "reg EDI becoming live" at offset 0x11 of the method might correspond to a "mov edi,ecx" statement. 0:000> !gcinfo 5b68dbb8 (5b68dbb8 is the start of a JITTED method) entry point 5b68dbb8 preJIT generated code GC info 5b9f2f09 Method info block: method size = 0036 prolog size = 19 epilog size = 8 epilog count = 1 epilog end = yes saved reg. mask = 000B ebp frame = yes fully interruptible=yes double align = no security check = no exception handlers = no local alloc = no edit & continue = no varargs = no argument count = 4 stack frame size = 1 untracked count = 5 var ptr tab count = 0 epilog at 002E 36 D4 8C C7 AA | 93 F3 40 05 | Pointer table: 14 | [EBP+14H] an untracked local 10 | [EBP+10H] an untracked local 0C | [EBP+0CH] an untracked local 08 | [EBP+08H] an untracked local 44 | [EBP-04H] an untracked local F1 79 | 0011 reg EDI becoming live 72 | 0013 reg ESI becoming live 83 | 0016 push ptr 0 8B | 0019 push ptr 1 93 | 001C push ptr 2 9B | 001F push ptr 3 56 | 0025 reg EDX becoming live 4A | 0027 reg ECX becoming live 0E | 002D reg ECX becoming dead 10 | 002D reg EDX becoming dead E0 | 002D pop 4 ptrs F0 31 | 0036 reg ESI becoming dead 38 | 0036 reg EDI becoming dead FF | This function is important for CLR Devs, but very difficult for anyone else to make sense of it. You would usually come to use it if you suspect a gc heap corruption bug caused by invalid GCEncoding for a particular method. \\ COMMAND: comstate. !COMState !COMState lists the com apartment model for each thread, as well as a Context pointer if provided. \\ COMMAND: bpmd. !BPMD !BPMD -md !BPMD provides managed breakpoint support. If it can resolve the method name to a loaded, jitted or ngen'd function it will create a breakpoint with "bp". If not then either the module that contains the method hasn't been loaded yet or the module is loaded, but the function is not jitted yet. In these cases, !bpmd asks the Windows Debugger to receive CLR Notifications, and waits to receive news of module loads and JITs, at which time it will try to resolve the function to a breakpoint. This brings up a good question: "I want to set a breakpoint on the main method of my application, but SOS doesn't work until the runtime is loaded. How can I do this?" 1) Start the debugger and type: sxe -c "" clrn 2) g 3) You'll get the following notification from the debugger: "CLR notification: module 'mscorlib' loaded" 4) Now you can load SOS and use commands. Type .loadby sos mscorwks then !bpmd myapp.exe MyApp.Main 5) g 6) You will stop at the start of MyApp.Main. If you type "bl" you will see the breakpoint listed. !BPMD works equally well with generic types. Adding a breakpoint on a generic type sets breakpoints on all already JIT-ted generic methods and sets a pending breakpoint for any instantiation that will be JIT-ted in the future. Example for generics: Given the following two classes: class G3 { ... public void F(T1 p1, T2 p2, T3 p3) { ... } } public class G1 { // static method static public void G(W w) { ... } } One would issue the following commands to set breapoints on G3.F() and G1.G(): !bpmd myapp.exe G3`3.F !bpmd myapp.exe G1`1.G !BPMD does not accept offsets nor parameters in the method name. If there are overloaded methods, !bpmd will set a breakpoint for all of them. In the case of hosted environments such as SQL, the module name may be complex, like 'price, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'. For this case, just be sure to surround the module name with single quotes, like: !bpmd 'price, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' Price.M2 \\ COMMAND: dumpdomain. !DumpDomain [] When called with no parameters, !DumpDomain will list all the AppDomains in the process. It enumerates each Assembly loaded into those AppDomains as well. In addition to your application domain, and any domains it might create, there are two special domains: the Shared Domain and the System Domain. Any Assembly pointer in the output can be passed to !DumpAssembly. Any Module pointer in the output can be passed to !DumpModule. Any AppDomain pointer can be passed to !DumpDomain to limit output only to that AppDomain. Other functions provide an AppDomain pointer as well, such as !Threads where it lists the current AppDomain for each thread. \\ COMMAND: eeheap. !EEHeap [-gc] [-loader] !EEHeap enumerates process memory consumed by internal CLR data structures. You can limit the output by passing "-gc" or "-loader". All information will be displayed otherwise. The information for the Garbage Collector lists the ranges of each Segment in the managed heap. This can be useful if you believe you have an object pointer. If the pointer falls within a segment range given by "!EEHeap -gc", then you do have an object pointer, and can attempt to run "!DumpObj" on it. Here is output for a simple program: 0:000> !eeheap -gc Number of GC Heaps: 1 generation 0 starts at 0x00a71018 generation 1 starts at 0x00a7100c generation 2 starts at 0x00a71000 segment begin allocated size 00a70000 00a71000 00a7e01c 0000d01c(53276) Large object heap starts at 0x01a71000 segment begin allocated size 01a70000 01a71000 01a76000 0x00005000(20480) Total Size 0x1201c(73756) ------------------------------ GC Heap Size 0x1201c(73756) So the total size of the GC Heap is only 72K. On a large web server, with multiple processors, you can expect to see a GC Heap of 400MB or more. The Garbage Collector attempts to collect and reclaim memory only when required to by memory pressure for better performance. You can also see the notion of "generations," wherein the youngest objects live in generation 0, and long-lived objects eventually get "promoted" to generation 2. The loader output lists various private heaps associated with AppDomains. It also lists heaps associated with the JIT compiler, and heaps associated with Modules. For example: 0:000> !EEHeap -loader Loader Heap: -------------------------------------- System Domain: 5e0662a0 LowFrequencyHeap:008f0000(00002000:00001000) Size: 0x00001000 bytes. HighFrequencyHeap:008f2000(00008000:00001000) Size: 0x00001000 bytes. StubHeap:008fa000(00002000:00001000) Size: 0x00001000 bytes. Total size: 0x3000(12288)bytes -------------------------------------- Shared Domain: 5e066970 LowFrequencyHeap:00920000(00002000:00001000) 03e30000(00010000:00003000) Size: 0x00004000 bytes. Wasted: 0x00001000 bytes. HighFrequencyHeap:00922000(00008000:00001000) Size: 0x00001000 bytes. StubHeap:0092a000(00002000:00001000) Size: 0x00001000 bytes. Total size: 0x6000(24576)bytes -------------------------------------- Domain 1: 14f000 LowFrequencyHeap:00900000(00002000:00001000) 03ee0000(00010000:00003000) Size: 0x00004000 bytes. Wasted: 0x00001000 bytes. HighFrequencyHeap:00902000(00008000:00003000) Size: 0x00003000 bytes. StubHeap:0090a000(00002000:00001000) Size: 0x00001000 bytes. Total size: 0x8000(32768)bytes -------------------------------------- Jit code heap: Normal JIT:03ef0000(00010000:00002000) Size: 0x00002000 bytes. Total size: 0x2000(8192)bytes -------------------------------------- Module Thunk heaps: Module 5ba22410: Size: 0x00000000 bytes. Module 001c1320: Size: 0x00000000 bytes. Module 001c03f0: Size: 0x00000000 bytes. Module 001caa38: Size: 0x00000000 bytes. Total size: 0x0(0)bytes -------------------------------------- Module Lookup Table heaps: Module 5ba22410:Size: 0x00000000 bytes. Module 001c1320:Size: 0x00000000 bytes. Module 001c03f0:Size: 0x00000000 bytes. Module 001caa38:03ec0000(00010000:00002000) Size: 0x00002000 bytes. Total size: 0x2000(8192)bytes -------------------------------------- Total LoaderHeap size: 0x15000(86016)bytes ======================================= By using !EEHeap to keep track of the growth of these private heaps, we are able to rule out or include them as a source of a memory leak. \\ COMMAND: name2ee. !Name2EE !Name2EE ! This function allows you to turn a class name into a MethodTable and EEClass. It turns a method name into a MethodDesc. Here is an example for a method: 0:000> !name2ee unittest.exe MainClass.Main Module: 001caa38 Token: 0x0600000d MethodDesc: 00902f40 Name: MainClass.Main() JITTED Code Address: 03ef00b8 and for a class: 0:000> !name2ee unittest!MainClass Module: 001caa38 Token: 0x02000005 MethodTable: 009032d8 EEClass: 03ee1424 Name: MainClass The module you are "browsing" with Name2EE needs to be loaded in the process. To get a type name exactly right, first browse the module with ILDASM. You can also pass * as the to search all loaded managed modules. can also be the debugger's name for a module, such as mscorlib or image00400000. The Windows Debugger syntax of ! is also supported. You can use an asterisk on the left of the !, but the type on the right side needs to be fully qualified. If you are looking for a way to display a static field of a class (and you don't have an instance of the class, so !dumpobj won't help you), note that once you have the EEClass, you can run !DumpClass, which will display the value of all static fields. There is yet one more way to specify a module name. In the case of modules loaded from an assembly store (such as a SQL db) rather than disk, the module name will look like this: price, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null For this kind of module, simply use price as the module name: 0:044> !name2ee price Price Module: 10f028b0 (price, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null) Token: 0x02000002 MethodTable: 11a47ae0 EEClass: 11a538c8 Name: Price Where are we getting these module names from? Run !DumpDomain to see a list of all loaded modules in all domains. And remember that you can browse all the types in a module with !DumpModule -mt . \\ COMMAND: syncblk. !SyncBlk [-all | ] A SyncBlock is a holder for extra information that doesn't need to be created for every object. It can hold COM Interop data, HashCodes, and locking information for thread-safe operations. When called without arguments, !SyncBlk will print the list of SyncBlocks corresponding to objects that are owned by a thread. For example, a lock(MyObject) { .... } statement will set MyObject to be owned by the current thread. A SyncBlock will be created for MyObject, and the thread ownership information stored there (this is an oversimplification, see NOTE below). If another thread tries to execute the same code, they won't be able to enter the block until the first thread exits. This makes !SyncBlk useful for detecting managed deadlocks. Consider that the following code is executed by Threads A & B: Resource r1 = new Resource(); Resource r2 = new Resource(); ... lock(r1) lock(r2) { { lock(r2) lock(r1) { { ... ... } } } } This is a deadlock situation, as Thread A could take r1, and Thread B r2, leaving both threads with no option but to wait forever in the second lock statement. !SyncBlk will detect this with the following output: 0:003> !syncblk Index SyncBlock MonitorHeld Recursion Owning Thread Info SyncBlock Owner 238 001e40ec 3 1 001e4e60 e04 3 00a7a194 Resource 239 001e4124 3 1 001e5980 ab8 4 00a7a1a4 Resource It means that Thread e04 owns object 00a7a194, and Thread ab8 owns object 00a7a1a4. Combine that information with the call stacks of the deadlock: (threads 3 and 4 have similar output) 0:003> k ChildEBP RetAddr 0404ea04 77f5c524 SharedUserData!SystemCallStub+0x4 0404ea08 77e75ee0 ntdll!NtWaitForMultipleObjects+0xc 0404eaa4 5d9de9d6 KERNEL32!WaitForMultipleObjectsEx+0x12c 0404eb38 5d9def80 mscorwks!Thread::DoAppropriateAptStateWait+0x156 0404ecc4 5d9dd8bb mscorwks!Thread::DoAppropriateWaitWorker+0x360 0404ed20 5da628dd mscorwks!Thread::DoAppropriateWait+0xbb 0404ede4 5da4e2e2 mscorwks!CLREvent::Wait+0x29d 0404ee70 5da4dd41 mscorwks!AwareLock::EnterEpilog+0x132 0404ef34 5da4efa3 mscorwks!AwareLock::Enter+0x2c1 0404f09c 5d767880 mscorwks!AwareLock::Contention+0x483 0404f1c4 03f00229 mscorwks!JITutil_MonContention+0x2c0 0404f1f4 5b6ef077 image00400000!Worker.Work()+0x79 ... By looking at the code corresponding to Worker.Work()+0x79 (run "!u 03f00229"), you can see that thread 3 is attempting to acquire the Resource 00a7a1a4, which is owned by thread 4. NOTE: It is not always the case that a SyncBlock will be created for every object that is locked by a thread. In version 2.0 of the CLR and above, a mechanism called a ThinLock will be used if there is not already a SyncBlock for the object in question. ThinLocks will not be reported by the !SyncBlk command. You can use "!DumpHeap -thinlock" to list objects locked in this way. \\ COMMAND: dumpmt. !DumpMT [-MD] Examine a MethodTable. Each managed object has a MethodTable pointer at the start. If you pass the "-MD" flag, you'll also see a list of all the methods defined on the object. \\ COMMAND: dumpclass. !DumpClass The EEClass is a data structure associated with an object type. !DumpClass will show attributes, as well as list the fields of the type. The output is similar to !DumpObj. Although static field values will be displayed, non-static values won't because you need an instance of an object for that. You can get an EEClass to look at from !DumpMT, !DumpObj, !Name2EE, and !Token2EE among others. \\ COMMAND: dumpmd. !DumpMD This command lists information about a MethodDesc. You can use !IP2MD to turn a code address in a managed function into a MethodDesc: 0:000> !dumpmd 902f40 Method Name: Mainy.Main() Class: 03ee1424 MethodTable: 009032d8 mdToken: 0600000d Module: 001caa78 IsJitted: yes CodeAddr: 03ef00b8 If IsJitted is "yes," you can run !U on the CodeAddr pointer to see a disassembly of the JITTED code. You can also call !DumpClass, !DumpMT, !DumpModule on the Class, MethodTable and Module fields above. \\ COMMAND: token2ee. !Token2EE This function allows you to turn a metadata token into a MethodTable or MethodDesc. Here is an example showing class tokens being resolved: 0:000> !token2ee unittest.exe 02000003 Module: 001caa38 Token: 0x02000003 MethodTable: 0090375c EEClass: 03ee1ae0 Name: Bank 0:000> !token2ee image00400000 02000004 Module: 001caa38 Token: 0x02000004 MethodTable: 009038ec EEClass: 03ee1b84 Name: Customer The module you are "browsing" with Token2EE needs to be loaded in the process. This function doesn't see much use, especially since a tool like ILDASM can show the mapping between metadata tokens and types/methods in a friendlier way. But it could be handy sometimes. You can pass "*" for to find what that token maps to in every loaded managed module. can also be the debugger's name for a module, such as mscorlib or image00400000. \\ COMMAND: eeversion. !EEVersion This prints the Common Language Runtime version. It also tells you if the code is running in "Workstation" or "Server" mode, a distinction which affects the garbage collector. The most apparent difference in the debugger is that in "Server" mode there is one dedicated garbage collector thread per CPU. A handy supplement to this function is to also run "lm v m mscorwks". That will provide more details about the CLR, including where mscorwks.dll is loaded from. \\ COMMAND: dumpmodule. !DumpModule [-mt] You can get a Module address from !DumpDomain, !DumpAssembly and other functions. Here is sample output: 0:000> !dumpmodule 1caa50 Name: C:\pub\unittest.exe Attributes: PEFile Assembly: 001ca248 LoaderHeap: 001cab3c TypeDefToMethodTableMap: 03ec0010 TypeRefToMethodTableMap: 03ec0024 MethodDefToDescMap: 03ec0064 FieldDefToDescMap: 03ec00a4 MemberRefToDescMap: 03ec00e8 FileReferencesMap: 03ec0128 AssemblyReferencesMap: 03ec012c MetaData start address: 00402230 (1888 bytes) The Maps listed map metadata tokens to CLR data structures. Without going into too much detail, you can examine memory at those addresses to find the appropriate structures. For example, the TypeDefToMethodTableMap above can be examined: 0:000> dd 3ec0010 03ec0010 00000000 00000000 0090320c 0090375c 03ec0020 009038ec ... This means TypeDef token 2 maps to a MethodTable with the value 0090320c. You can run !DumpMT to verify that. The MethodDefToDescMap takes a MethodDef token and maps it to a MethodDesc, which can be passed to !DumpMD. There is a new option "-mt", which will display the types defined in a module, and the types referenced by the module. For example: 0:000> !dumpmodule -mt 1aa580 Name: C:\pub\unittest.exe ...... MetaData start address: 0040220c (1696 bytes) Types defined in this module MT TypeDef Name ------------------------------------------------------------------------------ 030d115c 0x02000002 Funny 030d1228 0x02000003 Mainy Types referenced in this module MT TypeRef Name ------------------------------------------------------------------------------ 030b6420 0x01000001 System.ValueType 030b5cb0 0x01000002 System.Object 030fceb4 0x01000003 System.Exception 0334e374 0x0100000c System.Console 03167a50 0x0100000e System.Runtime.InteropServices.GCHandle 0336a048 0x0100000f System.GC \\ COMMAND: threadpool. !ThreadPool This command lists basic information about the ThreadPool, including the number of work requests in the queue, number of completion port threads, and number of timers. \\ COMMAND: dumpassembly. !DumpAssembly Example output: 0:000> !dumpassembly 1ca248 Parent Domain: 0014f000 Name: C:\pub\unittest.exe ClassLoader: 001ca060 Module Name 001caa50 C:\pub\unittest.exe An assembly can consist of multiple modules, and those will be listed. You can get an Assembly address from the output of !DumpDomain. \\ COMMAND: dumpmethodsig. !DumpMethodSig [Not documented yet] \\ COMMAND: dumpruntimetypes. !DumpRuntimeTypes !DumpRuntimeTypes finds all System.RuntimeType objects in the gc heap and prints the type name and MethodTable they refer too. Sample output: Address Domain MT Type Name ------------------------------------------------------------------------------ a515f4 14a740 5baf8d28 System.TypedReference a51608 14a740 5bb05764 System.Globalization.BaseInfoTable a51958 14a740 5bb05b24 System.Globalization.CultureInfo a51a44 14a740 5bb06298 System.Globalization.GlobalizationAssembly a51de0 14a740 5bb069c8 System.Globalization.TextInfo a56b98 14a740 5bb12d28 System.Security.Permissions.HostProtectionResource a56bbc 14a740 5baf7248 System.Int32 a56bd0 14a740 5baf3fdc System.String a56cfc 14a740 5baf36a4 System.ValueType ... \\ COMMAND: dumpsig. !DumpSig [Not documented yet] \\ COMMAND: rcwcleanuplist. !RCWCleanupList [Not documented yet] \\ COMMAND: dumpil. !DumpIL | | !DumpIL prints the IL code associated with a managed method. We added this function specifically to debug DynamicMethod code which was constructed on the fly. Happily it works for non-dynamic code as well. You can use it in three ways: 1) If you have a System.Reflection.Emit.DynamicMethod object, just pass the pointer as the first argument. 2) If you have a DynamicMethodDesc pointer you can use that to print the IL associated with the dynamic method. 3) If you have an ordinary MethodDesc, you can see the IL for that as well, just pass it as the first argument. Note that dynamic IL is constructed a bit differently. Rather than referring to metadata tokens, the IL points to objects in a managed object array. Here is a simple example of the output for a dynamic method: 0:000> !dumpil b741dc This is dynamic IL. Exception info is not reported at this time. If a token is unresolved, run "!do " on the addr given in parenthesis. You can also look at the token table yourself, by running "!DumpArray 00b77388". IL_0000: ldstr 70000002 "Inside invoked method " IL_0005: call 6000003 System.Console.WriteLine(System.String) IL_000a: ldc.i4.1 IL_000b: newarr 2000004 "System.Int32" IL_0010: stloc.0 IL_0011: ldloc.0 IL_0012: ret \\ COMMAND: verifyheap. !VerifyHeap !VerifyHeap is a diagnostic tool that checks the garbage collected heap for signs of corruption. It walks objects one by one in a pattern like this: o = firstobject; while(o != endobject) { o.ValidateAllFields(); o = (Object *) o + o.Size(); } If an error is found, !VerifyHeap will report it. I'll take a perfectly good object and corrupt it: 0:000> !DumpObj a79d40 Name: Customer MethodTable: 009038ec EEClass: 03ee1b84 Size: 20(0x14) bytes (C:\pub\unittest.exe) Fields: MT Field Offset Type Attr Value Name 009038ec 4000008 4 CLASS instance 00a79ce4 name 009038ec 4000009 8 CLASS instance 00a79d2c bank 009038ec 400000a c System.Boolean instance 1 valid 0:000> ed a79d40+4 01 (change the name field to the bogus pointer value 1) 0:000> !VerifyHeap will only produce output if there are errors in the heap: object 00a79d40: bad member 00000001 at 00a79d44 curr_object : 00a79d40 Last good object: 00a79d2c ---------------- If this gc heap corruption exists, there is a serious bug in your own code or in the CLR. In user code, an error in constructing PInvoke calls can cause this problem, and running with Managed Debugging Assistants is advised. If that possibility is eliminated, consider contacting Microsoft Product Support for help. \\ COMMAND: dumplog. !DumpLog [-addr ] [] To aid in diagnosing hard-to-reproduce stress failures, the CLR team added an in-memory log capability. The idea was to avoid using locks or I/O which could disturb a fragile repro environment. The !DumpLog function allows you to write that log out to a file. If no Filename is specified, the file "Stresslog.txt" in the current directory is created. The optional argument addr allows one to specify a stress log other then the default one. 0:000> !DumpLog Attempting to dump Stress log to file 'StressLog.txt' ................. SUCCESS: Stress log dumped To turn on the stress log, set the following registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework: (DWORD) StressLog = 1 (DWORD) LogFacility = 0xffffffbf (this is a bit mask, almost all logging is on. This is also the default value if the key isn't specified) (DWORD) StressLogSize = 65536 (this is the default value if the key isn't specified) (DWORD) LogLevel = 6 (this is the default value if the key isn't specified. The higher the number the more detailed logs are generated. The maximum value is decimal 10) StressLogSize is the size in bytes of the in-memory log allocated for each thread in the process. In the case above, each thread gets a 64K log. You could increase this to get more logging, but more memory will be required for this log in the process. For example, 20 threads with 524288 bytes per thread has a memory demand of 10 Megabytes. The stress log is circular so new entries will replace older ones on threads which have reached their buffer limit. The log facilities are defined as follows: GC 0x00000001 GCINFO 0x00000002 STUBS 0x00000004 JIT 0x00000008 LOADER 0x00000010 METADATA 0x00000020 SYNC 0x00000040 EEMEM 0x00000080 GCALLOC 0x00000100 CORDB 0x00000200 CLASSLOADER 0x00000400 CORPROF 0x00000800 REMOTING 0x00001000 DBGALLOC 0x00002000 EH 0x00004000 ENC 0x00008000 ASSERT 0x00010000 VERIFIER 0x00020000 THREADPOOL 0x00040000 GCROOTS 0x00080000 INTEROP 0x00100000 MARSHALER 0x00200000 IJW 0x00400000 ZAP 0x00800000 STARTUP 0x01000000 APPDOMAIN 0x02000000 CODESHARING 0x04000000 STORE 0x08000000 SECURITY 0x10000000 LOCKS 0x20000000 BCL 0x40000000 Here is some sample output: 3560 9.981137099 : `SYNC` RareEnablePremptiveGC: entering. Thread state = a030 3560 9.981135033 : `GC`GCALLOC`GCROOTS` ========== ENDGC 4194 (gen = 2, collect_classes = 0) ==========={ 3560 9.981125826 : `GC` Segment mem 00C61000 alloc = 00D071F0 used 00D09254 committed 00D17000 3560 9.981125726 : `GC` Generation 0 [00CED07C, 00000000 ] cur = 00000000 3560 9.981125529 : `GC` Generation 1 [00CED070, 00000000 ] cur = 00000000 3560 9.981125103 : `GC` Generation 2 [00C61000, 00000000 ] cur = 00000000 3560 9.981124963 : `GC` GC Heap 00000000 3560 9.980618994 : `GC`GCROOTS` GcScanHandles (Promotion Phase = 0) The first column is the OS thread ID for the thread appending to the log, the second column is the timestamp, the third is the facility category for the log entry, and the fourth contains the log message. The facility field is expressed as `facility1`facility2`facility3`. This facilitates the creation of filters for displaying only specific message categories. To make sense of this log, you would probably want the Shared Source CLI to find out exactly where the log comes from. \\ COMMAND: findappdomain. !FindAppDomain !FindAppDomain will attempt to resolve the AppDomain of an object. For example, using an Object Pointer from the output of !DumpStackObjects: 0:000> !findappdomain 00a79d98 AppDomain: 0014f000 Name: unittest.exe ID: 1 You can find out more about the AppDomain with the !DumpDomain command. Not every object has enough clues about it's origin to determine the AppDomain. Objects with Finalizers are the easiest case, as the CLR needs to be able to call those when an AppDomain shuts down. \\ COMMAND: savemodule. !SaveModule This command allows you to take a image loaded in memory and write it to a file. This is especially useful if you are debugging a full memory dump, and don't have the original DLLs or EXEs. This is most often used to save a managed binary to a file, so you can disassemble the code and browse types with ILDASM. The base address of an image can be found with the "LM" debugger command: 0:000> lm start end module name 00400000 00408000 image00400000 (deferred) 10200000 102ac000 MSVCR80D (deferred) 5a000000 5a0b1000 mscoree (deferred) 5a140000 5a29e000 mscorjit (deferred) 5b660000 5c440000 mscorlib_dll (deferred) 5d1d0000 5e13c000 mscorwks (deferred) ... If I wanted to save a copy of mscorwks.dll, I could run: 0:000> !SaveModule 5d1d0000 c:\pub\out.tmp 4 sections in file section 0 - VA=1000, VASize=e82da9, FileAddr=400, FileSize=e82e00 section 1 - VA=e84000, VASize=24d24, FileAddr=e83200, FileSize=ec00 section 2 - VA=ea9000, VASize=5a8, FileAddr=e91e00, FileSize=600 section 3 - VA=eaa000, VASize=c183c, FileAddr=e92400, FileSize=c1a00 The diagnostic output indicates that the operation was successful. If c:\pub\out.tmp already exists, it will be overwritten. \\ COMMAND: gchandles. !GCHandles [-perdomain] !GCHandles provides statistics about GCHandles in the process. Sometimes the source of a memory leak is a GCHandle leak. For example, code might keep a 50 Megabyte array alive because a strong GCHandle points to it, and the handle was discarded without freeing it. The most common handles are "Strong Handles," which keep the object they point to alive until the handle is explicitly freed. "Pinned Handles" are used to prevent the garbage collector from moving an object during collection. These should be used sparingly, and for short periods of time. If you don't follow that precept, the gc heap can become very fragmented. Here is sample output from a very simple program: 0:000> !gchandles GC Handle Statistics: Strong Handles: 13 Pinned Handles: 3 Async Pinned Handles: 0 Ref Count Handles: 0 Weak Long Handles: 0 Weak Short Handles: 1 Other Handles: 0 Statistics: MT Count TotalSize Class Name 5ba75da8 1 12 System.Security.Permissions.SecurityPermission 5ba5c57c 1 20 System.SharedStatics 5ba76878 2 40 System.Security.PermissionSet 5ba6739c 1 48 System.Reflection.Module 5ba65bb8 2 48 System.Reflection.Assembly 5ba5dba4 1 68 System.Threading.ThreadAbortException 5ba58430 1 68 System.ExecutionEngineException 5ba58380 1 68 System.StackOverflowException 5ba58328 1 68 System.OutOfMemoryException 5ba58c10 1 108 System.AppDomain 5ba5db04 2 136 System.Threading.Thread 5ba88bd8 3 10256 System.Object[] Total 17 objects If you run with the -perdomain option, you will get the same output broken down by AppDomain. \\ COMMAND: gchandleleaks. !GCHandleLeaks This command is an aid in tracking down GCHandle leaks. It searches all of memory for any references to the Strong and Pinned GCHandles in the process, and reports what it found. If a handle is found, you'll see the address of the reference. This might be a stack address or a field within an object, for example. If a handle is not found in memory, you'll get notification of that too. The command has diagnostic output which doesn't need to be repeated here. One thing to keep in mind is that anytime you search all of memory for a value, you can get false positives because even though the value was found, it might be garbage in that no code knows about the address. You can also get false negatives because a user is free to pass that GCHandle to unmanaged code that might store the handle in a strange way (shifting bits, for example). For example, a GCHandle valuetype is stored on the stack with the low bit set if it points to a Pinned handle. So !GCHandleLeaks ignores the low bit in it's searches. That said, if a serious leak is going on, you'll get a ever-growing set of handle addresses that couldn't be found. \\ COMMAND: vmmap. !VMMap !VMMap traverses the virtual address space and lists the type of protection applied to each region. Sample output: 0:000> !VMMap Start Stop Length AllocProtect Protect State Type 00000000-0000ffff 00010000 NA Free 00010000-00011fff 00002000 RdWr RdWr Commit Private 00012000-0001ffff 0000e000 NA Free 00020000-00020fff 00001000 RdWr RdWr Commit Private 00021000-0002ffff 0000f000 NA Free 00030000-00030fff 00001000 RdWr Reserve Private ... \\ COMMAND: vmstat. !VMStat Provides a summary view of the virtual address space, ordered by each type of protection applied to that memory (free, reserved, committed, private, mapped, image). The TOTAL column is (AVERAGE * BLK COUNT). Sample output below: 0:000> !VMStat ~~~~ ~~~~~~~ ~~~~~~~ ~~~~~~~ ~~~~~~~~~ ~~~~~ TYPE MINIMUM MAXIMUM AVERAGE BLK COUNT TOTAL Free: Small 4,096 65,536 48,393 27 1,306,611 Medium 139,264 528,384 337,920 4 1,351,680 Large 6,303,744 974,778,368 169,089,706 12 2,029,076,472 Summary 4,096 974,778,368 47,249,646 43 2,031,734,778 Reserve: Small 4,096 65,536 43,957 41 1,802,237 Medium 249,856 1,019,904 521,557 6 3,129,342 Large 2,461,696 16,703,488 11,956,224 3 35,868,672 Summary 4,096 16,703,488 816,005 50 40,800,250 \\ COMMAND: procinfo. !ProcInfo [-env] [-time] [-mem] !ProcInfo lists the environment variables for the process, kernel CPU time, as well as memory usage statistics. \\  1111111111110 ;;;;;;;; <$<(<,< 222 2$2(2,2024282<2$@1D1H1L1P1T1x1|1222 22DX8\8`8d8h8l8p8t8x8|888888888888888888888888888888888999 99999 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|99999999999999999999999,<0 >">)>.>I>X>^>>>>>>>> ???1?@?S?s????????00%0,010M0V0]0b0~000000000011*1B1O1t1111111#262i2222,3!8(8J8T888 999999A:T:]:h:r:{::::::::::;;;;&;.;6;<;A;J;a;q;;;;;<;V>_>h>q>z>>>>>>>>>>>>>>>>>>>>>>????8????T00001*1a1l111J2a2m222222223>3T3i3o3t333334N4S4\4e4n4w44444444444444444444445#5)565<5I5O5a5g5}555555555555536S6d666666667/757=7C7O7W7777777788E8]88897::::M;T;d;;;*<^<<&>E? A00000011/1N1T1^1d1n1t1y111111111112221272F2R2W2]2s22222223*323[3i3w3333333"4,4G4L4^4p4~444444445<5h5o555556&6D6k66667$71797I7U7b7k77778/8c8899'999E9O9V9999:2;>;T;;;;;;;>>>>> ?E????40-0S0y00000000 1"1*171R1V1a1j1w1111111111122$222222333346666666L7]7c77777777888!8;8A8U8[8s8y888888888 99%9+9C9I9c9i9}9999999999::#:4:8:<:@:D:H:L:P:T:X:\:`:d::::$;M;};;;;;;G>>>>>>!?F???0"0.0D0P000011i11111,272<22223Q3`333 4455{5555:6D666667R77g8n88M9l9p9t9x9|9999999 :%:*:/:4:9:>:C:H:M:S:\::::;M;;;; < ">I>P>V>\>>>>>>>>>>>>>>???W?]?s?~??????????  0L0R0]000001"1'1-1A1G1L1R11111111111:2d2222222 3B3N3d3}333]4|44444 55b555646d6666 777&8889"9e99:`::;;<<<==j=w=}======N>t>>>?????000%050?0L0h0m000000001`1y111112h222222233335 6636677778"838D8U8~8881999::::: ;";;;;;<<3<:w>? ??e?p???????@0?1c1|111111 2i2222W3o3|33334J4445!535?55556616Z6o66677i7777828a888 99b9t9999-:F:\:::::::o;;;^=H=R=\=f=p=z===P+2244444444444444445?5M5Y5t556666666677%777C7Q7X7`7n7u7}777777777788)8;8P8W8`8x889q99::::; ;;<'<3/>J>O>>>>>>>>??U?h????pP0>0T0_0d0o0|000000001C11a222213e3p3u333!4+454?4I4S4f4k4}4445^5i5n55555!626;6J6O6`6666666"7.7D7P7|7778%8.8a8k8p8u8z888889 9-92979P9W9\9b9{9999999999999:::':.:3:9:R:Y:^:d::::::;;$;9;@;F;];t;{;;;;;;;; <2<>'>>>>>>>?#?*?y??????0$0E0f0p000000111X1j11112J22222223$383O3f3}33333344)4H44444444K5o5556(6:6D6N6Y6q66666667737S7X7p7z77777777L8]8u8888889 99K999999::K:U:g:r:::::::=G===>>>>>>>?3?F?S?????0 13111112(2z222 33(3;333333345H5o5w555555555555555666Q666677788[8}88888h9999:7:L:::::::::::::::::;&;V>f>k>p>w>>>>>>>>>>K????N0000F1T1`1111U2f2p22333%343:3@3\33333333+4>4H4v444444Y5j5t5555E6_6z666667K7b7l7777828y8888888 9Q9999:*:4:r::::V;l;;<-<<<<==,=6=P====>%>/>D>>>>>>?5?@?k?y????0#0;000001!121S11112F2P2Z2k222 33K3^3h3333$4:4E4J4T444445/5C5W5g5w555555556 6;6K66667<7S7]7777%8;8W8i888888899)9;9N9a9x99999999999#:4:R:y::::::::;;(;2;H;S;X;;;;!<4<><<<<==>&>0>k>~>>?%?[????,!040>00011@1[1111112n22223.383G3L3Q3V3`33333:4Q4[445'5X555555$636B6\6666666 7707F7Q7V7r77777788i8888 99(9V9`9s9}9999:&:0:g:z:::;;2;z;;;;;;;;;;;<(E>X>b>>>>>?3?R?s?????0$080K0e00021I1a1122 2\2o2y22222,363A3I3_3d3q3333"4R4f44 5-5>5H55555656G6Y6k6}6666666R7c7m77778 99U9h9r999999::,:;:E:W::::*;E;d;s;};;;;;;;;;%> >&>5>F>w>>>>>>>(?9?C????x0000121K1c1h1}111112=2P2Z223 313H3q333333434W4c444 55(5_5r5|555;6W666666 77#757@7E7p777788888899*9996::::::;S;g;s;;;;;;;;<3<:>.>G>N>S>n>s>>>>>>>>>>>?#?3????????000N00000000001)1A1X111M233333334 4454?4\4y4444444445$5D5555555(6;6E6666.7l7777%868@8w888999::Q:::;;;;;;;;Z<<<[>>>>>>>Z?n???*060I0`0000'1O1a1111>22222222=33334#4-4b4u444435D5N55555555566,666H6_6666666667r7~7777778[8s8888 9S9m9w99999999999:$:3:=:Q:X:e:o:y::::;; ;X;;;;<"!>&>?>L>o>>> ??)?1?[?e?o????050r00000111R1u11111232=2223)3@33334X445>555P6e66$797[7777'8|888809_999:: :7:<:q::::::;);:;w;;;7?6?;?M???? %00000 11B1L11111-2222d3k3333p444444455L5_5i5(6f6s6657F7P7777h8889g999%:y::;T;;;;;;;; <2a>h>o>>>>>>>??E?X?u?????0+0g001"171A11112x22(394L444L5V556&6G6s66666 797J7T77777M8a888899::;!;;;;;; <<<<<8=R=]=====?>X>t>?*?4?r????@000:0I0_0}00000041112,2X2r2^344444 5D555 66B6d6v66666~777777788888889r9999':O:`:v::::::::;;F;l;~;;;<<<<=!=8=W===>8>I>S>>>>>>?&?R?h???????P(0%060Q0v0000001B1U1111112-2M2n2x22222 383S3b3333333404@4O4Y4444445=5O5b5z555555J6i6z6666677778 8<8X8x8889;999999999::):6:D::::::::;O;o;;;;;;<< <5>F>P>y>>>>:?Y?j?t?????`$ 0V0`0e0j0o0t000011%131=1P1]1d1l11111111 2 2I2`2k2v223#343>3u333333 474a4q44445 575d555555<6M6W6666V7j7~7778M8Z8t8899,919C9H9Z9_9q9v9999999999:::,:I:t:::::::-;F;_;l;~;;;;;;< <#<(<:&>A>H>W>w>>>>>>>>>>=?F?X?g?|????????????0H0^00051J1R1d1p11122C2v2222239333334D4]4p45545v5555$6t6797a777777p8:: ;$;R;p;;;;;< <*<0C>>>>>d??L000911111122>2T2|2222222 33+3I3V3`33333334>4z444444445)5755556P6W6_6x6~66666667 7!7&747J7X7w77777777788 8%8N88889R9]9{999":.:D:Q:s::::;6;>;P;Y;~;;;;<-<6>,>2>F>K>R>\>p>{>>>>>>??!?(?o?v?????????@0&0,070I0Z0`0q0w000000011141:1^1d1v1111112w2}2222223+3133333&4,4_4r4x44444444 5G5y5555556M677778888898:@:R:::::::::;;$;.;<;I;d;;;;;2<>(>.>8>a>h>o>y>>>>>>>>>>>????%?>?_?f?m?w???????????0000#0<0]0d0k0u000001&1b1n11#2*2a2h24%474b4444 55+5e5l5}55506Z66667.7k7777778H8j88899:::R;== >>>%>M>S>]>c>>>8?_??????????@0010;0A0y000000(1A1G1r1/282>2W2]2s2y2233$3Y33&4/454^4d4v4|44444444,5D5K5|55555566!646p6666677M7g7777777K8w88889 9969=9^::;a;;;<<, >>>.>4>E>J>\>b>m>u>>>>>>>>>>>>???B?H?b?g??????????? 00!0<0@0D0H0L0P0T0X0\0`0d0h0l0112%3,313D3X3l3333333333334 44!4+454?4I44445"5,565A5566k7u7888888r99j:q::::::::::::::::::::::::::::;;; ;j;;;;.=4==>><z111C2Y222-3|3344455s5555 66,6Z666`7i7o7u77777777+838:8c8i8o8888888888 99!9'979<9N9T9`9e9w9}999999999999:::%:<:B:\:::::; ;5;;;R;W;u;;;;;;;;;;<<' >>>>">)>0>7><>B>Z>>>)?/?>?L?Z?e?o?u???0/0W0~0000001 1111G22(363G3X3i3z3333333333344$4044445(6`66666m777788p88899999:+:V:c::::::::;J;S;;g<<<<=E==>l>>>>A?X?t?????Q001\1123k333333T4`4l4449555 6I6]6h6G7R7W7j7777777 88+8E8888 9T9n99999:::D:r:w::::::: ;;%;;;;;;<<<] >/>7>I>d>>>>*?4?S?k?x?????#0E0000001J1c1p1}111111112.2e22222223 363@3E3T3a333E44555u555555*6r6~66667w7777=8[8887999:::;.;U;w;;;;<5>>>?,?>?C?I?O?{??????? .040O000014112222P33344444,525:5G5[5f56667R888889 999=9c99999999999999:f:q::::::::;$;(;,;0;4;8;<;@;;;;;;=0lH0Y0o00112$222 3333)4.44484>4B4H4L4R4V4[4a4e4k4o4u4y44445J6a6667m8899|;)<4<>?@a003P3333J4P4t44444$5<5G5556 6 6z666667777777 89:(:/:7:<:@:D:m:::::::::::;$;(;,;0;;;;;;;;;>S>Y>b>i>>?8?@?L?T?h?s?x?????????Ph0 00#0_0d0o0t001$1T1m11111111122!2-2B2H2\2c2}2222222222222333+343A3b3l3333334 4D444455d5w5}55555555555556 6666%6*626;6G6L6Q6W6[6a6f6l6t66666666666667767R7d7777778;8D8P88888888 9w99999 :K:{::::;%;G;U;d;;;;;<<"<======f>l>>>>>>>>J?\???????`g0n00000000000001111;111112223,383@3H3T3x33334f5k5}5555777%7+71777=7D7K7R7Y7`7g7n7v7~777777777777777 88!8;88888(929S99999:*:K:^::;/;<<<<<===N=V=`=y=====$>7>>> ?n??pd00!030N0V0^0u000000000&171W12B2223Z3333"4j4y444444455X6{667<==s=p2~35f5o555555c6u6~666666666 77"7.7;7_7q77777778%8O888(9991:I::::M=>5?[?z?h1222222222*343L3t333545?5b555777 8q88888929:9Y9i9{99::<:=R====>'>0v1222i46 6 66666!6k78H88888889%9>9P9V9_9r99):I:Y:_:f:s:z::::::<<<=="=+=8=C=U=h=s=y==============>>>>#>0>6>P>a>g>x>>s22223W3*555=5R555556667D7\7g7777777838X8k8888899(9-92979B9r9999:::":):.::::2;<;F;Q;^;n;;;;;;;<#<<<<<<<>>>%???H?j?p0*040L0S0]0e0r0y00B113333 4404B4T4f4545^55566779;;; <X>d>>>>>> ?E0c0000171G1b11112922222231333334@444556673889999::::w;;;< <>>>?!?3?F?X???P01R11111133f48888 9899,:9:A:O:a:m:x::;;Z<<<=Y==;??pv0J1[1|134676W67c9g9k9o9s9w9{99999999999:.:?:F:U:Z:g:u:::;V;];c;;;;c>?\006000011F2<3D334r5x56 6066677r::=============>>>>]??<,9:::: ;;;*;?;F;L;b;};;;s0>P>p>>>>>>?4?8?X?t?x??????00$0@0`00000PT00$0(0,0004080<0@0D0H0L0P0T0X0x00000000000000000011 11`L1T1\1d1l1t1|111111111111111112 222$2,242<2D2P6T6X6\6`6d6h6l6p6t6x6|6666666666666 77,7<7L7\7l7|777777777 88,8<8L8\8l8|888888888 99,9<9L9\9l9|999999999 ::,:<:L:\:l:|::::::::: ;;,;<;L;\;l;|;;;;;;;;; <<,<<>,><>L>\>l>|>>>>>>>>> ??,?3yցd(4EVp.ǡYVPaɝ]rm͙lĿ s3G(cT5&-{~0z0U%0 +7L+0UG2̊"3j}u0PUI0GE0C1)0'U  Microsoft Operations Puerto Rico10U 230012+4705290U#0HndPӂ77"mu0TUM0K0IGEChttp://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a+U0S0Q+0Ehttp://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0 U00  *H  xKLػ^ Q_Ş]<<9sWb5,'cY3%Aa!w'sU\xUb x]#(wd& v0S  ]foE)Awr8]1,uύdm'8̍vlS; Gq8GX'N/~*'fDkނ@%/yW0Tas C[*06^=Z+[Ԃ^%'iFu@ϑo^?tDcuûNui!HRAFBrtK TŅ%;:QͲloUݭDi̚yh?'@yZs"ӥS-TWřC Mv̏15(),kUƍwp+ h/Y6H?z6uabvvZ右XO+80z0b a0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20110 110708205909Z 260708210909Z0~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20110"0  *H 0 r.nM4X!B*kZP8I 7k 8™91BӉ yd~`$lIh^ߛS ,ï٩+z זY`fv2R&/PϳD].uhm:\F8dnd5xc-@ \yI) w=+ZMV(zr:I^C{{>]O/Y;-3Xŷ>2ӳ=8~ҝ,NV!5%9ndS#_R!t%_('(8%9J6|#faj(I_%]!K>RĵW?$z[/#p]QFwἬ_UK9#ID|Erzr$߿FWۃMI0[ݰf{KI)(}gbx_/W\w((m(,@7OD LԥC/tnx X,]`>O3ڰޞNFlֈ 00 +70UHndPӂ77"mu0 +7  SubCA0 U0U00U#0r-:1CN1#40ZUS0Q0OMKIhttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^+R0P0N+0Bhttp://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0U 00 +7.00?+3http://www.microsoft.com/pkiops/docs/primarycps.htm0@+042 Legal_policy_statement. 0  *H  g򆥘Ty.tg" cB}y e_.,>rm? ;Gic"5]e}FPU |K.)=Եw9dD=xz#}t&F*Š hh.*?*kXIc inZF+;н5n%'(M= 2-[I9 ƭQEX82q'',: iYhnot@*(>?Mf Mo}Ev@*e]Rbc6'ͥ]cA[>wuaaA(e/\֡FY KH)ű?Ew5Ңzz"HG#kKux7yKֳ#hu i;0Lumc=ѝVNOW"x2!zA ?̤]WqVNHEBɛv[ HkymmjRs zP10~00~1 0 UUS10U Washington10URedmond10U Microsoft Corporation1(0&UMicrosoft Code Signing PCA 20113̎N0  `He0 *H  1  +70 +7 10  +70/ *H  1" o^ZC[{b%c2ڰf_p0B +7 1402Microsofthttp://www.microsoft.com0  *H lW *B ;RVͫyݶ(qi"T[٤[Ґ8P2~{ Բ\q 7Vw \+!H|mJ iB6 PfCЬޣ@a3 0 +710 *H 010  `He0U *H  D@0< +Y 010  `He d/f¡z+]: f'cs20221215093124.787Z0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:60BC-E383-26351%0#UMicrosoft Time-Stamp Service_003YE9MK0  *H  0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100 220302185121Z 230511185121Z01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:60BC-E383-26351%0#UMicrosoft Time-Stamp Service0"0  *H 0 ٘{R# <&sҲ{ /1vo ;|k;dGU-֟rf-J(>:e }3!0G ZwhfrPy=?=tfqGβjY!n :}%B3@`[B\q7h 5+c ``PJnDjӳ#+gDɴ9[Z+c|6>/XƠFQpf ]r˿>n^,hzEsIG婞dzLC_B9va|f׼w* JIb}NO *+!UPتVm#v"!3<ϩ2#fge'9"w F*;0/}IlI.P6020U:T!;ƖI / 70U#0]^b]eS5r0_UX0V0TRPNhttp://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l+`0^0\+0Phttp://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 U00U% 0 +0  *H  X4k&_H6Nɱ7>e 'aљp[{\MJy0#TZf^Uv7CTZSA/JjUYmGhڑ MR^o"XkU-"rcb~% XPˈ)p)Eq#zi`KJEx1)=I7Z!lGu7aW(\Y*;ሽ:*ƧKw( M"l9.7"tl ?ꂱ tRM dUs5B@>rQL(ӌ[e: B(`L/#?GH1&탿`B9`k!vh0&!0$0q0Y3kI0  *H  01 0 UUS10U Washington10URedmond10U Microsoft Corporation1200U)Microsoft Root Certificate Authority 20100 210930182225Z 300930183225Z0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0  *H 0 Lr! y$yՂҩlNu5WlJ⽹>`3\OfSqZ~JZ6gF# w2`}jRDFkvPDq\Q17 8n&S|9azĪri65&dژ;{3[~Rb%j]SVMݼ㑏9,Qpi 6-p15(㴇$ɏ~TUmh;Fz)7EFn20\O,b͹⍈䖬Jq[g`= s}AFu_4 }~ٞE߶r/}_۪~66L+nQsM7t4G|?Lۯ^s=CN39LBh.QFѽjZasg^(v3rק  co 6d[!]_0tعP a65Gk\RQ]%PzlrRą<7?xE^ڏriƮ{>j.00 +70# +7*RdĚhttp://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0  *H  U}*,g1$[rKo\>NGdx=139q6?dl|u9m1lѡ"fg:SMݘx6.Vi {jo)n?Hum m#TxSu$Wݟ=heV(U'$@]='@8)üTB  jBRu6as.,k{n?, x鑲[It 쑀=J>f;O2ٖtLrou04zP X@1Q{p( 6ںL 4$5g+ 挙"'B=%tt[jў>~13}{8pDѐȫ::bpcSMmqjU3Xpf0;0Ԥ01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U  Microsoft Operations Puerto Rico1&0$U Thales TSS ESN:60BC-E383-26351%0#UMicrosoft Time-Stamp Service# 0+jt3LwUkj|0~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100  *H Eu0"20221215061829Z20221216061829Z0w0= +Y 1/0-0 Eu0 #s0H0 FS06 +Y 1(0&0  +Y  0 00  *H 7{ݎDP;4^ќg'TK'ؿYݘ[A".ǙM}ůfyhW.j? ?%%Qc8լQ%) 0 =G5pSp5,1 0 00|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103YE9MK0  `HeJ0 *H  1  *H  0/ *H  1" fѸ Ϛ\6QߜԌ>^rw-T0 *H  /1000 ?t}k0L*áw0 00~0|1 0 UUS10U Washington10URedmond10U Microsoft Corporation1&0$UMicrosoft Time-Stamp PCA 20103YE9MK0" ;t)z Ы Nf8Rl#a0  *H  .υSR}=݇y;30v@ƲG'|>FKyw6e"]љײM:_R`M62`̌E^@mAQi]ZpEpևRlO؉c\vNZaTuZ;.T%~=íFdI'ݞr{:\SfŋyD$x8Rt/fznF=9qDB֢W9GH0ǢVc(;i\ ß<S >"Ix'z]swڅ\(& ):vA0|2O^uť4v̗&:4tR5q \0V?Z7VDޙXAEf=ZA,(Cyl#zseeXY1:܌yJ S"qOyo\=d)HgÅLDIX