X\ \ __text__TEXTH8__data__DATAH$ __const__TEXT`< __cstring__TEXT`< __picsymbolstub2__TEXT=  l__la_sym_ptr2__DATA H __nl_symbol_ptr__DATAH $$__textcoal_nt__TEXTT 0 @$H  P'UVS EC }~,? U; UEɍ;D$0$s uSD$s$: ;0$ fF;@ ;B;@ SD$$ [^]UWVS\EC U<usED$C U$B uGD$D$? U$U E? UEzC 6}E$C U<ED$D$ D$D$$B? 6}䍃D$$? U<us? 6}䍃D$$? U<t?[\]^`{|}~ossec-analysisd%s(1102): Memory error. Exiting.rootcheck%s: RootcheckInit completed./queue/rootcheck%s/%sr+w%s(1103): Unable to open file '%s'.%s: Error handling rootcheck database.%s: Error handling rootcheck database (fgetpos).%s: Error handling rootcheck database (fgetpos2).!%d%s: Error handling rootcheck database (fgetpos3).!%d!%d %s ⍀P⍀P⍀Pxs~⍀~P_Zi⍀iPFAT⍀TP-(?⍀?P*⍀*P⍀P⍀P⍀P⍀P⍀P~y⍀Pe`⍀PLG⍀P3.m⍀mPX⍀XPJ c |  + D ] v $Ë$&H2  `hVF*`Q!`P @` ^V L` 6H (H L L  ` H  {H ueH TH K9 .H H  H   L L tH fVH <,L L   ` H  H H  H  }` o[H AH /L P  C C   ? ?   ; ~; x s m7 e7 _ Z T3 L3 F A ;/ n 3/ n - ( "+ U + U   ' < ' < # # # #         ~ y s k e ` Z R L G A t 9 t 3 . ( [  [    B  B  D@<840,($  dd< `D(D) D+D-"D/-D0?D-QD5YD6D7D8D9D;D>.$(IU)| $DEDF DIDK#DNDDOjDPrDSDWDYD[D^D_Db,DcRDecDfyDiDkDmDnDpDtDu,Dv4D{JD|bDl$ETq((gDD FG l$DDDDDDDDDD D%D5D^DrDDDDDDDDDDD2DJDlD{DDDDDD!D/D9$ H2  H6^LoQ1O;_D$S ) /=bkyz9{$| &` 8 - " %  &  ' () T ~  !dH@7T X H_0Q}pg|L 5.T>mD[&te_rootcheck_dec_RootcheckInit___i686.get_pc_thunk.bx_RK_File_DecodeRootcheck___local_name_Config_ar_flag_ar_commands_active_responses_currently_rule__eflog__aflog__fflog_rk_agent_ips_rk_agent_fps_rk_err___i686.get_pc_thunk.axdyld_stub_binding_helper_fflush_fprintf_fsetpos_strchr_fgets_fgetpos_free_merror_fclose_fopen_snprintf_strdup_fseek_strcmp_debug1_getDecoderfromlist_ErrorExit_calloc/mnt/gmirror/ports/security/ossec-hids-server/work/ossec-hids-1.3/src/analysisd/decoders/rootcheck.cgcc2_compiled._hostname_mapRootcheckInit:F(0,1)=(0,1)void:t(0,1)i:(0,2)=r(0,2);-2147483648;2147483647;int:t(0,2)RK_File:F(0,3)=*(0,4)=(0,5)=xs__sFILE:FILE:t(0,4)__sFILE:T(0,5)=s88_p:(0,6)=*(0,7)=@s8;r(0,7);0;255;,0,32;_r:(0,2),32,32;_w:(0,2),64,32;_flags:(0,8)=@s16;r(0,8);-32768;32767;,96,16;_file:(0,8),112,16;_bf:(0,9)=xs__sbuf:,128,64;_lbfsize:(0,2),192,32;_cookie:(0,10)=*(0,1),224,32;_close:(0,11)=*(0,12)=f(0,2),256,32;_read:(0,13)=*(0,14)=f(0,2),288,32;_seek:(0,15)=*(0,16)=f(0,17)=(0,18)=(0,19)=(0,20)=@s64;r(0,20);01000000000000000000000;0777777777777777777777;,320,32;_write:(0,21)=*(0,22)=f(0,2),352,32;_ub:(0,9),384,64;_extra:(0,23)=*(0,24)=xs__sFILEX:,448,32;_ur:(0,2),480,32;_ubuf:(0,25)=ar(0,26)=r(0,26);0000000000000;0037777777777;;0;2;(0,7),512,24;_nbuf:(0,27)=ar(0,26);0;0;(0,7),536,8;_lb:(0,9),544,64;_blksize:(0,2),608,32;_offset:(0,17),640,64;;unsigned char:t(0,7)short int:t(0,8)__sbuf:T(0,9)=s8_base:(0,6),0,32;_size:(0,2),32,32;;fpos_t:t(0,17)__darwin_off_t:t(0,18)__int64_t:t(0,19)long long int:t(0,20)long unsigned int:t(0,28)=r(0,28);0000000000000;0037777777777;agent:p(0,29)=*(0,30)=r(0,30);0;127;agent_id:p(0,31)=*(0,2)char:t(0,30)i:(0,2)rk_buf:(0,32)=ar(0,26);0;1024;(0,30)DecodeRootcheck:F(0,2)lf:p(0,33)=*(0,34)=(0,35)=xs_Eventinfo:Eventinfo:t(0,34)_Eventinfo:T(0,35)=s128log:(0,29),0,32;full_log:(0,29),32,32;location:(0,29),64,32;hostname:(0,29),96,32;program_name:(0,29),128,32;srcip:(0,29),160,32;dstip:(0,29),192,32;srcport:(0,29),224,32;dstport:(0,29),256,32;protocol:(0,29),288,32;action:(0,29),320,32;user:(0,29),352,32;dstuser:(0,29),384,32;id:(0,29),416,32;status:(0,29),448,32;command:(0,29),480,32;url:(0,29),512,32;data:(0,29),544,32;systemname:(0,29),576,32;generated_rule:(0,36)=*(0,37)=(0,38)=xs_RuleInfo:,608,32;decoder_info:(0,39)=*(0,40)=(0,41)=s48get_next:(0,42)=(0,7),0,8;type:(0,42),8,8;use_own_name:(0,42),16,8;id:(0,43)=(0,44)=@s16;r(0,44);0;65535;,32,16;regex_offset:(0,43),48,16;prematch_offset:(0,43),64,16;fts:(0,2),96,32;parent:(0,29),128,32;name:(0,29),160,32;ftscomment:(0,29),192,32;regex:(0,45)=*(0,46)=(0,47)=xs_OSRegex:,224,32;prematch:(0,45),256,32;program_name:(0,48)=*(0,49)=(0,50)=xs_OSMatch:,288,32;plugindecoder:(0,51)=*(0,52)=f(0,1),320,32;order:(0,53)=*(0,54)=*(0,55)=f(0,1),352,32;;,640,32;sid_node_to_delete:(0,56)=*(0,57)=(0,58)=xs_OSListNode:,672,32;size:(0,2),704,32;p_name_size:(0,2),736,32;matched:(0,8),768,16;time:(0,2),800,32;day:(0,2),832,32;year:(0,2),864,32;hour:(0,59)=ar(0,26);0;8;(0,30),896,72;mon:(0,60)=ar(0,26);0;3;(0,30),968,32;;RuleInfo:t(0,37)_RuleInfo:T(0,38)=s192sigid:(0,2),0,32;level:(0,2),32,32;maxsize:(0,2),64,32;frequency:(0,2),96,32;timeframe:(0,2),128,32;context:(0,42),160,8;firedtimes:(0,2),192,32;time_ignored:(0,2),224,32;ignore_time:(0,2),256,32;ignore:(0,2),288,32;ckignore:(0,2),320,32;group_prev_matched_sz:(0,2),352,32;__frequency:(0,2),384,32;last_events:(0,61)=*(0,29),416,32;alert_opts:(0,43),448,16;context_opts:(0,43),464,16;category:(0,42),480,8;decoded_as:(0,43),496,16;sid_prev_matched:(0,62)=*(0,63)=(0,64)=xs_OSList:,512,32;sid_search:(0,62),544,32;group_prev_matched:(0,65)=*(0,62),576,32;group_search:(0,62),608,32;event_search:(0,66)=*(0,67)=f(0,10),640,32;group:(0,29),672,32;match:(0,48),704,32;regex:(0,45),736,32;day_time:(0,29),768,32;week_day:(0,29),800,32;srcip:(0,68)=*(0,69)=*(0,70)=(0,71)=xs_os_ip:,832,32;dstip:(0,68),864,32;srcport:(0,48),896,32;dstport:(0,48),928,32;user:(0,48),960,32;url:(0,48),992,32;id:(0,48),1024,32;status:(0,48),1056,32;hostname:(0,48),1088,32;program_name:(0,48),1120,32;extra_data:(0,48),1152,32;action:(0,29),1184,32;comment:(0,29),1216,32;info:(0,29),1248,32;cve:(0,29),1280,32;if_sid:(0,29),1312,32;if_level:(0,29),1344,32;if_group:(0,29),1376,32;if_matched_regex:(0,45),1408,32;if_matched_group:(0,48),1440,32;if_matched_sid:(0,2),1472,32;ar:(0,72)=*(0,73)=*(0,74)=(0,75)=xs_ar:,1504,32;;OSDecoderInfo:t(0,40)u_int8_t:t(0,42)u_int16_t:t(0,43)short unsigned int:t(0,44)OSRegex:t(0,46)_OSRegex:T(0,47)=s24error:(0,2),0,32;flags:(0,31),32,32;patterns:(0,61),64,32;sub_strings:(0,61),96,32;prts_closure:(0,76)=*(0,61),128,32;prts_str:(0,76),160,32;;OSMatch:t(0,49)_OSMatch:T(0,50)=s16error:(0,2),0,32;size:(0,31),32,32;patterns:(0,61),64,32;match_fp:(0,77)=*(0,78)=*(0,79)=f(0,2),96,32;;OSListNode:t(0,57)_OSListNode:T(0,58)=s12next:(0,80)=*(0,58),0,32;prev:(0,80),32,32;data:(0,10),64,32;;OSList:t(0,63)_OSList:T(0,64)=s24first_node:(0,56),0,32;last_node:(0,56),32,32;cur_node:(0,56),64,32;currently_size:(0,2),96,32;max_size:(0,2),128,32;free_data_function:(0,51),160,32;;os_ip:t(0,70)_os_ip:T(0,71)=s12ip:(0,29),0,32;ip_address:(0,81)=r(0,81);0000000000000;0037777777777;,32,32;netmask:(0,81),64,32;;active_response:t(0,74)_ar:T(0,75)=s36timeout:(0,2),0,32;location:(0,2),32,32;level:(0,2),64,32;name:(0,29),96,32;command:(0,29),128,32;agent_id:(0,29),160,32;rules_id:(0,29),192,32;rules_group:(0,29),224,32;ar_cmd:(0,82)=*(0,83)=(0,84)=xs_ar_command:,256,32;;unsigned int:t(0,81)ar_command:t(0,83)_ar_command:T(0,84)=s16expect:(0,2),0,32;timeout_allowed:(0,2),32,32;name:(0,29),64,32;executable:(0,29),96,32;;agent_id:(0,2)tmpstr:(0,29)rk_buf:(0,85)=ar(0,26);0;2048;(0,30)fp:(0,3)fp_pos:(0,17)__local_name:G(0,29)hostname_map:S(0,86)=ar(0,26);0;255;(0,87)=k(0,7)Config:G(0,88)=(0,89)=xs__Config:_Config:t(0,88)__Config:T(0,89)=s36logall:(0,42),0,8;stats:(0,42),8,8;integrity:(0,42),16,8;syscheck_auto_ignore:(0,42),24,8;syscheck_alert_new:(0,42),32,8;rootcheck:(0,42),40,8;hostinfo:(0,42),48,8;mailbylevel:(0,42),56,8;logbylevel:(0,42),64,8;keeplogdate:(0,42),72,8;mailnotify:(0,8),80,16;ar:(0,2),96,32;memorysize:(0,2),128,32;syscheck_ignore:(0,61),160,32;white_list:(0,68),192,32;hostname_white_list:(0,90)=*(0,48),224,32;includes:(0,61),256,32;;ar_flag:G(0,2)ar_commands:G(0,62)active_responses:G(0,62)currently_rule:G(0,36)_eflog:G(0,3)_aflog:G(0,3)_fflog:G(0,3)rk_agent_ips:G(0,91)=ar(0,26);0;255;(0,29)rk_agent_fps:G(0,92)=ar(0,26);0;255;(0,3)rk_err:G(0,2)rootcheck_dec:G(0,39)