01 - Ghost in dump - 从浏览器崩溃数据中找到问题所在

  • 作者：leonwxqian
  • 时间：March 26, 2017
  • 分类：技术分享

挖坑，说不定哪天心血来潮不填了呢。

周末看了看书商，现在的新潮书目已经被大数据、机器学习洗了个遍。漏洞挖掘这个东西，在人手不足（满眼辛酸泪）的时候，还是得借助一下大众的力量。但其实我在写的这些并不是大数据，也不是人工智能。纯粹是大量数据，通过分散工作，倒更有点像bittorrent ，或者苏联的马大兄弟最终想达到的境界。

汇聚了大量的崩溃数据之后，怎么解？节点只是无责任地尝试各种可能，将数据汇聚给你这里的时候，数据会有各种杂点。这包括：

  1. 节点机器软件环境的不同
  2. 节点机器的系统位数不一（x86、x64）
  3. 节点机器的补丁化程度不一样、系统不一样（xp、7、8、10？）
  4. 节点机器甚至有可能出现一些随机的问题，例如某个数据就是突然不正确了
  5. 节点机器的硬件配置不同（打印机……）

  6. ……

    软件环境的不同导致的问题：

QQ图片20170326195240.png

为什么不统一节点呢？节点需要多样性，这个更符合马大兄弟的观点不是么。正儿八经说，这样的多样性更符合日常的用户分布。

有一批DUMP之后，首先要做的事就是筛选。丢掉所有的INT3（在Edge中多为fastfail）、丢掉所有空指针（因为我们本来就难以复现，这些空指针的实际情况我们之后再看）、丢掉所有栈中有其他DLL的（如杀毒软件、输入法等），最后将剩余的DUMP统一批量解析。解析后拿出一些可疑的详细分析：

suspecious.gif

  • 流程分析

打出栈后可以粗略分析：

0:010> kvn
  *** Stack trace for last set context - .thread/.cxr resets it
 # ChildEBP RetAddr  Args to Child              
WARNING: Frame IP not in any known module. Following frames may be wrong.
00 06208f48 06fcf46d 0799e3f8 00000000 0620aaf0 0x620aab0
01 0620aab0 06fc8d11 00000000 5f0623b8 0000097f edgehtml!CDoc::ExecHelper+0x6751 (FPO: [6,1749,4])
02 0620aad0 5f146ab5 082c0000 5f0623b8 0000097f edgehtml!CDoc::Exec+0x21 (FPO: [6,0,0])
03 0620add8 5f301a39 01723474 5f0623b8 0000097f ieframe!CDocObjectHost::ExecDown+0x215 (FPO: [6,183,4])
04 0620ae0c 5f301b29 0000097f 01723468 00000000 ieframe!DocObjectHost_ExecDown+0x61 (FPO: [Non-Fpo])
05 0620ae40 5f359947 ffffffff 01723698 0620b27c ieframe!DocObjectHost_UserClickedRecently+0x33 (FPO: [Non-Fpo])
06 0620ae50 5f2abbca 000608a8 00000000 0620ae78 ieframe!CInformationBar::ConfigureUI+0x7b (FPO: [Non-Fpo])
07 0620b27c 5f14db52 000608a8 00000010 00000000 ieframe!`BrowserTelemetry::Instance'::`2'::`dynamic atexit destructor for 'wrapper''+0x6ed8a
08 0620b2d4 5f1487b5 00000010 00000000 06a01a54 ieframe!CDocObjectHost::_HandlePageActionBlocked+0x227 (FPO: [2,13,4])
09 0620b2f8 5f148ca1 00000037 00000010 00000000 ieframe!CDocObjectHost::_HandleDocHostCmds+0x4a (FPO: [Non-Fpo])
0a 0620b324 071f50fd 01723468 06a01a54 00000037 ieframe!CDocObjectHost::Exec+0x4b1 (FPO: [Non-Fpo])
0b 0620b358 07065302 00000037 00000010 00000000 edgehtml!`TextInput::TextInputLogging::Instance'::`2'::`dynamic atexit destructor for 'wrapper''+0x15760d
0c 0620b394 06df8fe0 00000000 00000000 082c8500 edgehtml!CDoc::NotifyPageActionBlockedState+0x69 (FPO: [2,5,4])
0d 0620b3ac 07729dfd 00000010 00000000 00000000 edgehtml!CDoc::OnPageActionBlocked+0x3d (FPO: [Non-Fpo])
0e 0620b3d8 0713644b 00000010 00000000 00000000 edgehtml!NotifyHaveProtectedUserFromUnsafeContent+0xb0 (FPO: [Non-Fpo])
0f 0620d494 06d15c08 00000000 1a69e360 1b0914a0 edgehtml!`TextInput::TextInputLogging::Instance'::`2'::`dynamic atexit destructor for 'wrapper''+0x9895b
10 0620d518 06d13e98 0620d528 06e8a712 00000002 edgehtml!CObjectElement::CreateObject+0x15d (FPO: [0,27,4])
11 0620d520 06e8a712 00000002 8000ffff 1bc0d400 edgehtml!CHtmObject10ParseCtx::Execute+0x18 (FPO: [0,0,4])
12 0620d568 06e9dde2 ffffffff 1bc0d400 00000000 edgehtml!CHtmParseBase::Execute+0x1e2 (FPO: [0,13,4])
13 0620d584 06e9d9ec 00000002 1410bf00 00000000 edgehtml!CHtmPost::Broadcast+0xa2 (FPO: [Non-Fpo])
14 0620d6ac 06e9ac0f ffffffff 00000000 0709baa0 edgehtml!CHtmPost::Exec+0x35c (FPO: [Non-Fpo])
15 0620d6e4 070195f8 0620d7d8 1412f980 1410bf00 edgehtml!CHtmLoad::PerformSyncParse+0x8c (FPO: [0,7,4])
16 0620d710 06e9790b 0620d7d8 1412f980 17c0b9e0 edgehtml!CHtmLoad::Init+0x1a8 (FPO: [Non-Fpo])
17 0620d740 06e977cd 17c0b9e0 00000001 00000000 edgehtml!CDwnInfo::SetLoad+0x11b (FPO: [Non-Fpo])
18 0620d768 06e97728 00000001 0620d7d8 00000000 edgehtml!CDwnCtx::SetLoad+0x3d (FPO: [3,1,4])
19 0620d784 06e8ca12 00000001 0620d7d8 00000000 edgehtml!CHtmCtx::SetLoad+0x18 (FPO: [Non-Fpo])
1a 0620d7b4 06e81492 0620d7d8 0620d944 00000000 edgehtml!CMarkup::Load+0x1c2 (FPO: [1,3,4])
1b 0620d880 06e80f51 09585e10 082c8500 082c8500 edgehtml!CMarkup::Load+0x142 (FPO: [6,45,4])
1c 0620d90c 06e809d8 0620d958 00000001 00000001 edgehtml!CDoc::ParseHtmlStream+0x18f (FPO: [Non-Fpo])
1d 0620da98 06e80793 09585e10 0000026a 00000008 edgehtml!InjectHtmlStream+0x168 (FPO: [8,87,4])
1e 0620dad0 06ea69ed 1afb6f00 00000135 00000008 edgehtml!HandleHTMLInjection+0x6a (FPO: [Non-Fpo])
1f 0620dbbc 07017599 00000000 1afb6f00 00000135 edgehtml!CElement::InjectInternal+0x34d (FPO: [5,49,4])
20 0620dc20 070174c4 081f3ba8 1d01cdb0 0620dc5c edgehtml!CElement::Var_set_innerHTML+0xba (FPO: [2,15,4])
21 0620dc48 07de14d9 0e1e29c0 02000002 0620dcd0 edgehtml!CFastDOM::CHTMLElement::Trampoline_Set_innerHTML+0x34 (FPO: [Non-Fpo])
22 0620dcc0 07d03eb7 0e1e29c0 02000002 1cfd15c0 Chakra!Js::JavascriptExternalFunction::ExternalFunctionThunk+0x189 (FPO: [2,21,0])
23 0620dcec 07d4f4d1 081fe620 0620dd24 0620dd44 Chakra!Js::JavascriptOperators::RootToThisObject+0xc2 (FPO: [Non-Fpo])
24 0620dd00 07dc7569 0e1e29c0 00000000 081fe620 Chakra!ThreadContext::ExecuteImplicitCall<<lambda_ba4868153056010d087fde4938f3dfe7> >+0x41 (FPO: [Non-Fpo])
25 0620dd48 07ceed5b 1d01cdb0 081fe620 00000688 Chakra!Js::JavascriptOperators::CallSetter+0x49 (FPO: [Non-Fpo])
26 0620dd90 07d8a526 00000000 00000688 1d01cdb0 Chakra!Js::JavascriptOperators::SetProperty_Internal<0>+0x7fb (FPO: [Non-Fpo])
27 0620ddbc 07db8729 1d01cdb0 081fe620 0620dde8 Chakra!Js::JavascriptOperators::OP_SetProperty+0x56 (FPO: [Non-Fpo])
28 0620de08 07d8fb69 1d07b950 1cf30878 0000000e Chakra!Js::JavascriptOperators::PatchPutValueNoLocalFastPath<0,Js::InlineCache>+0xa9 (FPO: [7,9,4])
29 0620de48 07d900a7 1acbdf92 1cfd15c0 00000000 Chakra!Js::InterpreterStackFrame::DoSetProperty_NoFastPath<Js::OpLayoutT_ElementCP<Js::LayoutSizePolicy<0> > const >+0x89 (FPO: [Non-Fpo])
2a 0620de70 07d91634 1acbdf92 1cfd15c0 00000000 Chakra!Js::InterpreterStackFrame::DoSetProperty<Js::OpLayoutT_ElementCP<Js::LayoutSizePolicy<0> > const >+0x47 (FPO: [Non-Fpo])
2b 0620de88 07d93ac7 1acbdf92 ffffffff 0620df00 Chakra!Js::InterpreterStackFrame::OP_SetProperty<Js::OpLayoutT_ElementCP<Js::LayoutSizePolicy<0> > const >+0x1a (FPO: [Non-Fpo])
2c 0620debc 07d935aa 25e00e78 081fd090 0620df00 Chakra!Js::InterpreterStackFrame::ProcessUnprofiled+0x447 (FPO: [Non-Fpo])
2d 0620def8 07d970dd 1acbdef0 1acbdf95 00000001 Chakra!Js::InterpreterStackFrame::Process+0x11a (FPO: [0,9,0])
2e 0620e0e0 07d97d78 0620e110 00000000 10000001 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
2f 0620e118 07de16f1 179bd890 10000001 1aea0740 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
30 0620e15c 07d90632 10000001 0620e2cc 1ac79b85 Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
31 0620e184 07d93904 1ac79ba7 0620e2cc ffffffff Chakra!Js::InterpreterStackFrame::OP_CallI<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > > >+0xa2 (FPO: [Non-Fpo])
32 0620e1bc 07d935aa 25e03178 081fd090 0620e200 Chakra!Js::InterpreterStackFrame::ProcessUnprofiled+0x284 (FPO: [Non-Fpo])
33 0620e1f8 07d970dd 1ac79b60 1ac79bb0 00000002 Chakra!Js::InterpreterStackFrame::Process+0x11a (FPO: [0,9,0])
34 0620e388 07d97d78 0620e3b8 00000000 02000002 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
35 0620e3c0 07de16f1 1d01ca50 02000002 0e130240 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
36 0620e40c 07d8fc83 02000002 0620e5b0 179330e6 Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
37 0620e42c 07d91f95 179330e6 1d01ca50 00000000 Chakra!Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > > >+0x43 (FPO: [Non-Fpo])
38 0620e464 07d95557 179330e6 0620e5b0 ffffffff Chakra!Js::InterpreterStackFrame::OP_ProfiledCallI<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > >+0x75 (FPO: [Non-Fpo])
39 0620e49c 07d9353e 25e03418 081fd090 0620e4e0 Chakra!Js::InterpreterStackFrame::ProcessProfiled+0x307 (FPO: [Non-Fpo])
3a 0620e4d8 07d970dd 17933080 179330eb 00000003 Chakra!Js::InterpreterStackFrame::Process+0xae (FPO: [0,9,0])
3b 0620e678 07d97d78 0620e6a8 00000000 10000003 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
3c 0620e6b0 07de16f1 17e02450 10000003 18180960 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
3d 0620e6fc 07d8fcc3 10000003 0620e970 0e4d327b Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
3e 0620e71c 07d91d15 0e4d327b 17e02450 1814c510 Chakra!Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > > >+0x83 (FPO: [Non-Fpo])
3f 0620e744 07d95ccc 0e4d327b 0620e970 ffffffff Chakra!Js::InterpreterStackFrame::OP_ProfiledReturnTypeCallI<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > >+0x35 (FPO: [Non-Fpo])
40 0620e77c 07d9353e 25e03738 00000000 0620e870 Chakra!Js::InterpreterStackFrame::ProcessProfiled+0xa7c (FPO: [Non-Fpo])
41 0620e7bc 07d928e6 25e03748 0e4d3205 0e4d320c Chakra!Js::InterpreterStackFrame::Process+0xae (FPO: [0,9,0])
42 0620e7f8 07d963db 0e4d320c ffffffff 0620e870 Chakra!Js::InterpreterStackFrame::OP_TryCatch+0x46 (FPO: [Non-Fpo])
43 0620e82c 07d9353e 25e03888 081fd090 0620e870 Chakra!Js::InterpreterStackFrame::ProcessProfiled+0x118b (FPO: [Non-Fpo])
44 0620e868 07d970dd 0e4d3200 0e4d3280 00000003 Chakra!Js::InterpreterStackFrame::Process+0xae (FPO: [0,9,0])
45 0620ea48 07d97d78 0620ea78 00000000 02000003 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
46 0620ea80 07de16f1 17e02d80 02000003 18180960 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
47 0620eacc 07d8fc83 02000003 0620ec68 0620eba0 Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
48 0620eaec 07d91dd7 179461cf 17e02d80 00000000 Chakra!Js::InterpreterStackFrame::OP_CallCommon<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > > >+0x43 (FPO: [Non-Fpo])
49 0620eb24 07d953cc 179461cf 0620ec68 ffffffff Chakra!Js::InterpreterStackFrame::OP_ProfiledCallIWithICIndex<Js::OpLayoutT_CallIWithICIndex<Js::LayoutSizePolicy<0> > >+0x77 (FPO: [Non-Fpo])
4a 0620eb5c 07d9353e 25e03bd8 081fd090 0620eba0 Chakra!Js::InterpreterStackFrame::ProcessProfiled+0x17c (FPO: [Non-Fpo])
4b 0620eb98 07d970dd 17946190 179461d8 00000003 Chakra!Js::InterpreterStackFrame::Process+0xae (FPO: [0,9,0])
4c 0620ed38 07d97d78 0620ed68 00000000 10000003 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
4d 0620ed70 07de16f1 17e18e10 10000003 17e0e9e0 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
4e 0620edbc 07d90632 10000003 0620ef2c 1bd7a99e Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
4f 0620ede4 07d93904 1bd7a9a8 0620ef2c ffffffff Chakra!Js::InterpreterStackFrame::OP_CallI<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > > >+0xa2 (FPO: [Non-Fpo])
50 0620ee1c 07d935aa 25e03e98 081fd090 0620ee60 Chakra!Js::InterpreterStackFrame::ProcessUnprofiled+0x284 (FPO: [Non-Fpo])
51 0620ee58 07d970dd 1bd7a900 1bd7a9b1 00000001 Chakra!Js::InterpreterStackFrame::Process+0x11a (FPO: [0,9,0])
52 0620eff8 07d97d78 0620f028 00000000 02000001 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
53 0620f030 07de16f1 179bd8f0 02000001 0e130050 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
54 0620f078 07d8a402 02000001 0620f0a0 179bd8f0 Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
55 0620f0e4 07d8a2a2 1d0104b0 1d0104b0 081fe620 Chakra!Js::JavascriptFunction::CalloutHelper<0>+0x142 (FPO: [Non-Fpo])
56 0620f138 07db86fb 00000eca 011304e0 17e76240 Chakra!Js::JavascriptFunction::EntryApply+0xc2 (FPO: [2,3,4])
57 0620f190 07de16f1 17e7a1e0 10000002 17e75c20 Chakra!Js::JavascriptOperators::PatchPutValueNoLocalFastPath<0,Js::InlineCache>+0x7b (FPO: [7,9,4])
58 0620f1dc 07d90632 10000002 0620f36c 14ae15dd Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
59 0620f204 07d93904 14ae1648 0620f36c ffffffff Chakra!Js::InterpreterStackFrame::OP_CallI<Js::OpLayoutDynamicProfile<Js::OpLayoutT_CallI<Js::LayoutSizePolicy<0> > > >+0xa2 (FPO: [Non-Fpo])
5a 0620f23c 07d935aa 25e022f8 081fd090 0620f280 Chakra!Js::InterpreterStackFrame::ProcessUnprofiled+0x284 (FPO: [Non-Fpo])
5b 0620f278 07d970dd 14ae1550 14ae1651 00000002 Chakra!Js::InterpreterStackFrame::Process+0x11a (FPO: [0,9,0])
5c 0620f430 07d97d78 0620f460 00000000 10000002 Chakra!Js::InterpreterStackFrame::InterpreterHelper+0x2dd (FPO: [Non-Fpo])
5d 0620f498 07de16f1 1d009f80 00000001 0e15c480 Chakra!Js::InterpreterStackFrame::InterpreterThunk+0x38 (FPO: [1,1,4])
5e 0620f4e0 07cee125 00000001 1530b280 25e025ec Chakra!Js::JavascriptFunction::CallFunction<1>+0x91 (FPO: [Non-Fpo])
5f 0620f55c 07ced757 081fe620 00000001 1530b280 Chakra!Js::JavascriptFunction::CallRootFunctionInternal+0xe5 (FPO: [Non-Fpo])
60 0620f570 07c7b162 081fe620 00000001 1530b280 Chakra!Js::JavascriptFunction::CallRootFunction+0x14 (FPO: [3,0,0])
61 0620f5f0 07cf2f25 0620f620 00000001 1530b280 Chakra!ScriptSite::CallRootFunction+0x74 (FPO: [Non-Fpo])
62 0620f634 07cef5f3 1d009f80 0620f660 00000000 Chakra!ScriptSite::Execute+0x105 (FPO: [Non-Fpo])
63 0620f688 0701b8cb 081f3ba8 1d009f80 00000001 Chakra!ScriptEngineBase::Execute+0xa3 (FPO: [6,11,0])
64 0620f6e0 0701a705 000001a7 00000000 1a4ccdc0 edgehtml!CScriptTimers::ExecuteTimer+0x18b (FPO: [Non-Fpo])
65 0620f754 06feb012 000001aa 082ec000 082ea000 edgehtml!CWindow::FireTimeOut+0x1a5 (FPO: [1,21,4])
66 0620f7a8 06fea3a5 00000000 00000000 082ea000 edgehtml!CPaintBeat::ProcessTimers+0x1f2 (FPO: [2,15,4])
67 0620f7d8 07047aec 00000000 07047a00 082ea000 edgehtml!CPaintBeat::OnBeat+0x1d5 (FPO: [1,5,4])
68 0620f7f8 07047a54 00002981 07047a00 0000023e edgehtml!CPaintBeat::OnPaintTimer+0x4c (FPO: [Non-Fpo])
69 0620f814 06ee89df 00002981 0000000f 00000001 edgehtml!CContainedTimerSink<CPaintBeat>::OnTimerMethodCall+0x54 (FPO: [Non-Fpo])
6a 0620f898 06ee7aec 02160785 06ee79c0 00000000 edgehtml!GlobalWndOnPaintPriorityMethodCall+0x2af (FPO: [0,27,4])
6b 0620f8ec 754784f3 00150818 0000000f 00000000 edgehtml!GlobalWndProc+0x12c (FPO: [Non-Fpo])
6c 0620f918 75456c40 06ee79c0 00150818 0000000f user32!_InternalCallWinProc+0x2b
6d 0620f9c0 75456820 06ee79c0 00000000 0000000f user32!UserCallWinProcCheckWow+0x1f0 (FPO: [SEH])
6e 0620fa20 7545d169 01e0fa30 00000000 0000000f user32!DispatchClientMessage+0xf0 (FPO: [Non-Fpo])

问题出在setInnerHTML上，但是这段代码是某个Timer触发的。因此我们可能还需要从其他地方搜索。

首先展开所有线程的栈，找到入口，如果入口的参数也不可读的话，就需要祭出s搜索了。

32:

 s -u 0 L?80000000 "http"

64:

!for_each_module s -[1]a ${@#Base} L?${@#Size}  "http"

让我们自动化一点：

.foreach(place {s -[1]u 0 L?80000000 "http"}){du ${place}}

可以得到类似：

0:010> .foreach(place {s -[1]u 0 L?80000000 "http"}){du ${place}} 
0169bbd8  "https://qzonestyle.gtimg.cn/aoi/"
0169bc18  "sprite/icenter.32.png?max_age=19"
0169bc58  "830212&d=20170316153125"
016e9858  "http://qlogo3.store.qq.com/qzone"
016e9898  "/997427126/997427126/50?14360624"
016e98d8  "72"
016e9a08  "https://qlogo2.store.qq.com/qzon"
016e9a48  "e/840161873/840161873/30?1374381"
016e9a88  "815"
016e9b42  "http://s2.symcb.com"
016e9b6a  "http://s1.symcb.com/pca3-g5.crl"
016e9bb8  "http://qlogo3.store.qq.com/qzone"
016e9bf8  "/997427126/997427126/50?14360624"
016e9c38  "72"
016ea038  "https://qzonestyle.gtimg.cn/qzon"
016ea078  "e/biz/ac/comm/gdtlib.20160810.js"
016ea0b8  ""

这样的输出，我们可以大致知道是在访问QQ空间的时候出的问题。使用和DUMP产生者同样的环境，发现可以复现，但是，很不幸的是，使用纯净Edge环境并没有出现。因此这个DUMP对我们来说没有用，删掉。

大部分的DUMP其实都是这个情况，因此，还需要慢慢尝试。

(作者: blast，CH 1. 完)

标签：none

添加新评论

captcha
请输入验证码