bj777的blog

记录学习每一瞬间

0%

s1mp1e1

发表于 更新于

normal1

共有三道逆向，先做第一道：

看着挺简单的，就是异或，然后比较字符串，但一看见sub_A84这个函数，我就觉得不太对劲。

点开后，果真如我所想，不会那么简单。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
_BYTE *__fastcall sub_A84(__int64 a1, _BYTE *a2)
{
  _BYTE *result; // rax
  char v4; // [rsp+19h] [rbp-7h]
  unsigned __int8 v5; // [rsp+1Ah] [rbp-6h]
  unsigned __int8 i; // [rsp+1Bh] [rbp-5h]
  int v7; // [rsp+1Ch] [rbp-4h]

  v4 = 0;
  v5 = 0;
  v7 = 0;
  while ( *(_BYTE *)(v7 + a1) )
  {
      *a2++ = sub_7FA((unsigned __int8)(((int)*(unsigned __int8 *)(v7 + a1) >> (v5 + 2)) | v4));
    v5 = (v5 + 2) & 7;
    v4 = 0;
    for ( i = 0; i < v5; ++i )
      v4 |= ((1 << i) & *(unsigned __int8 *)(v7 + a1)) << (6 - v5);
    if ( v5 <= 5u )
      ++v7;
  }
  result = a2;
  *a2 = 0;
  return result;
}

我在仔细一瞧，还有个sub_7EA这个函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
int64 __fastcall sub_7FA(char a1)
{
  __int64 result; // rax

  switch ( a1 )
  {
    case 0:
      result = 110LL;
      break;
    case 1:
      result = 111LL;
      break;
    case 2:
      result = 112LL;
      break;
    case 3:
      result = 113LL;
      break;
    case 4:
      result = 114LL;
      break;
    case 5:
      result = 115LL;
      break;
    case 6:
      result = 116LL;
      break;
    case 7:
      result = 117LL;
      break;
    case 8:
      result = 118LL;
      break;
    case 9:
      result = 119LL;
      break;
    case 10:
      result = 120LL;
      break;
    case 11:
      result = 121LL;
      break;
    case 12:
      result = 122LL;            //以上可一起表示
      break;
    case 13:
      result = 97LL;
      break;
    case 14:
      result = 98LL;
      break;
    case 15:
      result = 99LL;
      break;
    case 16:
      result = 100LL;
      break;
    case 17:
      result = 101LL;
      break;
    case 18:
      result = 102LL;
      break;
    case 19:
      result = 103LL;
      break;
    case 20:
      result = 104LL;
      break;
    case 21:
      result = 105LL;
      break;
    case 22:
      result = 106LL;
      break;
    case 23:
      result = 107LL;
      break;
    case 24:
      result = 108LL;
      break;
    case 25:
      result = 109LL;           //可一起表示
      break;
    case 26:
      result = 48LL;
      break;
    case 27:
      result = 49LL;
      break;
    case 28:
      result = 50LL;
      break;
    case 29:
      result = 51LL;
      break;
    case 30:
      result = 52LL;
      break;
    case 31:
      result = 53LL;
      break;
    case 32:
      result = 54LL;
      break;
    case 33:
      result = 55LL;
      break;
    case 34:
      result = 56LL;
      break;
    case 35:
      result = 57LL;
      break;
    case 36:
      result = 65LL;
      break;
    case 37:
      result = 66LL;
      break;
    case 38:
      result = 67LL;
      break;
    case 39:
      result = 68LL;
      break;
    case 40:
      result = 69LL;
      break;
    case 41:
      result = 70LL;
      break;
    case 42:
      result = 71LL;
      break;
    case 43:
      result = 72LL;
      break;
    case 44:
      result = 73LL;
      break;
    case 45:
      result = 74LL;
      break;
    case 46:
      result = 75LL;
      break;
    case 47:
      result = 76LL;            //可一起表示
      break;
    case 48:
      result = 43LL;            //单独表示
      break;
    case 49:
      result = 47LL;            //单独表示
      break;
    case 50:
      result = 77LL;
      break;
    case 51:
      result = 78LL;
      break;
    case 52:
      result = 79LL;
      break;
    case 53:
      result = 80LL;
      break;
    case 54:
      result = 81LL;
      break;
    case 55:
      result = 82LL;
      break;
    case 56:
      result = 83LL;
      break;
    case 57:
      result = 84LL;
      break;
    case 58:
      result = 85LL;
      break;
    case 59:
      result = 86LL;
      break;
    case 60:
      result = 87LL;
      break;
    case 61:
      result = 88LL;
      break;
    case 62:
      result = 89LL;
      break;
    case 63:
      result = 90LL;           //一起表示
      break;
    default:
      result = 63LL;           //单独表示
      break;
  }
  return result;
}

很明显是一个转换字符的操作，可用python写脚本。我们返回sub_A84函数，深刻了解一下原理：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
v4 = 0;
  v5 = 0;
  v7 = 0;
while ( *(_BYTE *)(v7 + a1) )
  {
    *a2++ = sub_7FA((unsigned __int8)(((int)*(unsigned __int8 *)(v7 + a1) >> (v5 + 2)) | v4));                //将a1数组右移（v5+2），即舍去（v5+2）项，再进入sub_7EAh
    v5 = (v5 + 2) & 7;     //用动态调试测出值
    v4 = 0;
    for ( i = 0; i < v5; ++i )
      v4 |= ((1 << i) & *(unsigned __int8 *)(v7 + a1)) << (6 - v5);    //左移
    if ( v5 <= 5u )
      ++v7;
  }
  result = a2;
  *a2 = 0;
  return result;

a1是一个数组，对应每个循环过后，如果v5<=5，v7++，那么我们先观察v5，v5进行取余操作，又进行循环，对v4进行进一步操作。这个时候，我们是可以算出v5可以取：0，2，4，6（当v5=6时）就要进行下一轮操作。看第二行的操作是什么，a2是数组，该操作是将a1数组中的值右移（v5+2）个操作数，再与v4进行 “|” 运算。v4的值是什么，我们通过动态调试发现v4的值是与上一轮循环时a1数组的值保持一致的，所以我们要进行三轮这个操作，而这三轮操作是对于四个数组进行的。由于太菜，还是用c++写吧：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
#include<iostream>
#include<cstdio>
#include<cstring>
using namespace std;
int sub_A84(int a1)
{
    if(a1>=110&&a1<=122)
        return a1-110+0;
    if(a1>=97&&a1<=109)
        return a1-97+13;
    if(a1>=48&&a1<=57)
        return a1-48+26;
    if(a1>=65&&a1<=76)
        return a1-65+36;
    if(a1==43)
        return 48;
    if(a1==47)
        return 49;
    if(a1>=77&&a1<=90)
        return a1-77+50;
    if(a1==63)
        return 64;
}
int main()
{
    int j=0,a4=0;
    char s2[]="OBufaa21Td86rWS8Wob8iGhZYocbr5vxZfcCoWv3";
    int len = strlen(s2);
    char data[100];
    for(int i=0;i<len;i=i+4)
    {
        data[j+0]=((sub_A84(s2[i+0])&0xff)<<2)|((sub_A84(s2[i+1])>>4));     
        data[j+1]=((sub_A84(s2[i+1])&0xff)<<4)|((sub_A84(s2[i+2])>>2));
        data[j+2]=((sub_A84(s2[i+2])&0xff)<<6)|((sub_A84(s2[i+3])>>0));
        j+=3;
    }
    for(int i=0;i<30;i++)
    {
        if((i&1)!=0)
            data[i]^=0x60;
        else
            data[i]^=0x91;
        printf("%c",data[i]);
    }
return 0;
}

得到：C1CTF{th1s_Bas364_is_qcjlCwgS}

这是base64？有些疑惑，下一篇好好研究一下base64，有些忘了。。。

我稍微看了一下base64，发现这个代码就是base64源码。。。还是我太不熟悉了：

给出base64脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
import base64
t1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
t2='nopqrstuvwxyzabcdefghijklm0123456789ABCDEFGHIJKL+/MNOPQRSTUVWXYZ'
data='OBufaa21Td86rWS8Wob8iGhZYocbr5vxZfcCoWv3'
result = ''
flag=""
for ch in data:
    result += t1[t2.index(ch)]
result = bytearray(base64.b64decode(result+"=="))
for i in range(len(result)):
    if((i&1)!=0):
      flag +=chr(result[i]^0x60)
    else:
      flag +=chr(result[i]^0x91)

print(flag)

base64诚然不欺我！

normal2

这个题有些难度，找了一下wp参考了一下，原来是aes加密，记得在二面也有一道aes题没做出来，看来要仔细学一下了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned __int8 *v3; // rdi
  __int64 v4; // rsi
  char *v5; // rbx
  __int64 v6; // rdx
  __int64 v7; // r8
  CHAR String1[192]; // [rsp+20h] [rbp-118h] BYREF
  __int64 Buffer[8]; // [rsp+E0h] [rbp-58h] BYREF

  memset(Buffer, 0, sizeof(Buffer));
  sub_7FF619B814F0("Please enter flag:", argv, envp);
  gets_s((char *)Buffer, 0x40ui64);
  sub_7FF619B81000(String1);
  sub_7FF619B812A0((unsigned __int8 *)Buffer, (__int64)String1);
  memset(String1, 0, 0x64ui64);
  v3 = (unsigned __int8 *)Buffer;
  v4 = 32i64;
  v5 = String1;
  do
  {
    sub_7FF619B81550(v5, "%.2x", *v3);
    v5 += 2;
    ++v3;
    --v4;
  }
  while ( v4 );
  if ( lstrcmpA(String1, "934d8706bed74cd6eea683c7be86b2eb32616562363039383965386433333531") )
    exit(0);
  sub_7FF619B814F0("successful!\nplease entry any key exit...", v6, v7);
  fgetchar();
  return 0;
}

这个题有三个比较重要的地方sub_7FF619B81000函数和sub_7FF619B812A0函数和do-while循环中的函数。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
char __fastcall sub_7FF619B81000(_BYTE *a1)
{
  _BYTE *v1; // r9
  char v2; // r11
  unsigned int v3; // er10
  unsigned __int64 v4; // r14
  __int64 v5; // r8
  unsigned __int8 v6; // bl
  unsigned __int8 v7; // di
  unsigned __int8 v8; // si
  unsigned __int8 v9; // bp
  __int64 v10; // rdx
  char v11; // bl
  __int64 v12; // rax
  __int64 v13; // r8
  char result; // al

  v1 = a1 + 18;
  *a1 = byte_7FF619B9DA40;
  v2 = 4;
  a1[1] = byte_7FF619B9DA41;
  v3 = 16;
  v4 = 4i64;
  a1[2] = byte_7FF619B9DA42;
  a1[3] = byte_7FF619B9DA43;
  a1[4] = byte_7FF619B9DA44;
  a1[5] = byte_7FF619B9DA45;
  a1[6] = byte_7FF619B9DA46;
  a1[7] = byte_7FF619B9DA47;
  a1[8] = byte_7FF619B9DA48;
  a1[9] = byte_7FF619B9DA49;
  a1[10] = byte_7FF619B9DA4A;
  a1[11] = byte_7FF619B9DA4B;
  a1[12] = byte_7FF619B9DA4C;
  a1[13] = byte_7FF619B9DA4D;
  a1[14] = byte_7FF619B9DA4E;
  a1[15] = byte_7FF619B9DA4F;
  do
  {
    v5 = v3 - 4;
    v6 = a1[v5];
    v7 = a1[(unsigned int)(v5 + 1)];
    v8 = a1[(unsigned int)(v5 + 2)];
    v9 = a1[(unsigned int)(v5 + 3)];
    if ( (v2 & 3) == 0 )
    {
      v10 = v6;
      v11 = byte_7FF619B9AC50[v7];
      v7 = byte_7FF619B9AC50[v8];
      v12 = v9;
      v9 = byte_7FF619B9AC50[v10];
      v8 = byte_7FF619B9AC50[v12];
      v6 = byte_7FF619B9AC50[(v4 >> 2) + 512] ^ v11;
    }
    v13 = v3 - 16;
    ++v2;
    ++v4;
    *(v1 - 2) = v6 ^ a1[v13];
    v3 += 4;
    *(v1 - 1) = v7 ^ a1[(unsigned int)(v13 + 1)];
    *v1 = v8 ^ a1[(unsigned int)(v13 + 2)];
    result = v9 ^ a1[(unsigned int)(v13 + 3)];
    v1[1] = result;
    v1 += 4;
  }
  while ( v3 < 0xB0 );
  return result;
}

在第一个函数是aes的一部分对密钥进行处理，我们可以找到这16位key{0x1b,0x2e,0x35,0x46,0x58,0x6e,0x72,0x86,0x9b,0xa7,0xb5,0xc8,0xd9,0xef,0xff,0xc}

__

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
int64 __fastcall sub_7FF619B812A0(unsigned __int8 *a1, __int64 a2)
{
  unsigned __int8 *v2; // rbx
  __int64 v3; // rsi
  unsigned __int8 *v4; // r8
  __int64 v5; // r9
  __int64 v6; // rcx
  __int64 v7; // rdi
  __int64 v8; // rbp
  unsigned __int8 *v9; // r8
  __int64 v10; // r9
  unsigned __int8 *v11; // rcx
  __int64 v12; // rdx
  __int64 v13; // rax
  unsigned __int8 v14; // cl
  unsigned __int8 v15; // al
  unsigned __int8 v16; // cl
  unsigned __int8 v17; // al
  unsigned __int8 v18; // cl
  unsigned __int8 v19; // al
  unsigned __int8 v20; // cl
  unsigned __int8 v21; // al
  unsigned __int8 *v22; // rax
  __int64 v23; // r8
  __int64 v24; // rdx
  unsigned __int8 *v25; // r8
  __int64 v26; // r9
  unsigned __int8 *v27; // rcx
  __int64 v28; // rdx
  __int64 v29; // rax
  __int64 v30; // rdx
  unsigned __int8 v31; // cl
  unsigned __int8 v32; // al
  unsigned __int8 v33; // cl
  unsigned __int8 v34; // al
  unsigned __int8 v35; // cl
  unsigned __int8 v36; // al
  unsigned __int8 v37; // cl
  __int64 v38; // rcx
  __int64 result; // rax

  v2 = a1;
  v3 = a2 - (_QWORD)a1;
  v4 = a1;
  v5 = 4i64;
  do
  {
    v6 = 4i64;
    do
    {
      *v4 ^= v4[v3];
      ++v4;
      --v6;
    }
    while ( v6 );
    --v5;
  }
  while ( v5 );
  v7 = v3 + 16;
  v8 = 9i64;
  do
  {
    v9 = v2;
    v10 = 4i64;
    do
    {
      v11 = v9;
      v12 = 4i64;
      do
      {
        v13 = *v11;
        v11 += 4;
        *(v11 - 4) = byte_7FF619B9AC50[v13];
        --v12;
      }
      while ( v12 );
      ++v9;
      --v10;
    }
    while ( v10 );
    v14 = v2[1];
    v2[1] = v2[5];
    v2[5] = v2[9];
    v2[9] = v2[13];
    v15 = v2[10];
    v2[13] = v14;
    v16 = v2[2];
    v2[2] = v15;
    v17 = v2[14];
    v2[10] = v16;
    v18 = v2[6];
    v2[6] = v17;
    v19 = v2[15];
    v2[14] = v18;
    v20 = v2[3];
    v2[3] = v19;
    v2[15] = v2[11];
    v21 = v2[7];
    v2[7] = v20;
    v2[11] = v21;
    sub_7FF619B811B0(v2, 0i64, v9);
    v22 = v2;
    v23 = 4i64;
    do
    {
      v24 = 4i64;
      do
      {
        *v22 ^= v22[v7];
        ++v22;
        --v24;
      }
      while ( v24 );
      --v23;
    }
    while ( v23 );
    v7 += 16i64;
    --v8;
  }
  while ( v8 );
  v25 = v2;
  v26 = 4i64;
  do
  {
    v27 = v25;
    v28 = 4i64;
    do
    {
      v29 = *v27;
      v27 += 4;
      *(v27 - 4) = byte_7FF619B9AC50[v29];
      --v28;
    }
    while ( v28 );
    ++v25;
    --v26;
  }
  while ( v26 );
  v30 = 4i64;
  v31 = v2[1];
  v2[1] = v2[5];
  v2[5] = v2[9];
  v2[9] = v2[13];
  v32 = v2[10];
  v2[13] = v31;
  v33 = v2[2];
  v2[2] = v32;
  v34 = v2[14];
  v2[10] = v33;
  v35 = v2[6];
  v2[6] = v34;
  v36 = v2[15];
  v2[14] = v35;
  v37 = v2[3];
  v2[3] = v36;
  v2[15] = v2[11];
  v2[11] = v2[7];
  v2[7] = v37;
  do
  {
    v38 = 4i64;
    do
    {
      result = v2[v3 + 160];
      *v2++ ^= result;
      --v38;
    }
    while ( v38 );
    --v30;
  }
  while ( v30 );
  return result;
}

第二个函数是对前16位进行了加密，但后16位并没有变化

1
2
3
4
5
6
7
8
9
10
11
12
13
int sub_7FF619B81550(char *Buffer, char *Format, ...)
{
  _QWORD *v4; // rax
  int result; // eax
  va_list va; // [rsp+60h] [rbp+18h] BYREF

  va_start(va, Format);
  v4 = (_QWORD *)sub_7FF619B814E0();
  result = _stdio_common_vsprintf(*v4 | 1i64, Buffer, 0xFFFFFFFFFFFFFFFFui64, Format, 0i64, va);
  if ( result < 0 )
    return -1;
  return result;
}

do-while函数是将每一个字符的16进制拆成了两位，如0x28就变成0x2和0x8，这样的函数第一次见，我觉得下次还会再见到的

那么我们可以直接根据比较数据的后32位 ’32616562363039383965386433333531‘每两位一组写出flag的后16为 ’2aeb60989e8d3351‘

那么前16位就要写脚本了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
L1=[0x1b,0x2e,0x35,0x46,0x58,0x6e,0x72,0x86,0x9b,0xa7,0xb5,0xc8,0xd9,0xef,0xff,0xc]

for i in range(len(L1)):

  L1[i] = chr( L1[i])

key = ''. join( L1)

aes = AES.new(key, AES.MODE_ECB)

L2=[0x93,0x4d,0x87,0x06,0xbe,0xd7,0x4c,0xd6,0xee,0xa6,0x83,0xc7,0xbe,0x86,0xb2,0xeb]

for i in range(len(L2)):

  L2[i] = chr( L2[i])

cipher = ''. join( L2)

plain = aes.decrypt( cipher)

print plain

上面是python2的脚本，近期学业繁忙，待我到暑假，把基础打牢，近些天就把逆向基础看一下，等csapp到了我就两本一起来看，反正无论如何寒假时把写脚本这个打牢！

normal3

这道题实际上就是要找到递归算法：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
__int64 __fastcall main(int a1, char **a2, char **a3)
{
  puts("Input flag:");
  __isoc99_scanf("%64s", &a);
  b = 0;
  fun2(0LL);
  if ( !strcmp(&s1, "bcec8d7dcda25d91ed3e0b720cbb6cf202b09fedbc3e017774273ef5d5581794") )
  {
    memset(&s1, 0, 0x80uLL);
    b = 0;
    fun(0LL);
    if ( !strcmp(&s1, "7d8dcdcaed592e1dcb07e02c36bcb2f0bf9e0bdcb0e13777237e25fd48515974") )
      printf("TQL! TQL! flag: nctf{%s}\n", &a);
    else
      puts("Emmmm.....");
    return 0LL;
  }
  else
  {
    puts("GG!");
    return 0LL;
  }
}

我们跟进fun和fun2函数，发现这就是个算法，二者是很像的，所以想到一个好主意，我们只要随便输一个字符串，然后观察进入这个函数后改字符串位置变化，就可以倒推找到原码。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
int64 __fastcall fun2(int a1)
{
  int v1; // eax
  __int64 result; // rax

  if ( a1 <= 63 )
  {
    v1 = b++;
    *(&s1 + v1) = a[a1];
    fun2((unsigned int)(2 * a1 + 1));
    return fun2((unsigned int)(2 * (a1 + 1)));
  }
  return result;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
int64 __fastcall fun(int a1)
{
  int v1; // eax
  __int64 result; // rax

  if ( a1 <= 63 )
  {
    fun((unsigned int)(2 * a1 + 1));
    v1 = b++;
    *(&s1 + v1) = a[a1];
    return fun((unsigned int)(2 * (a1 + 1)));
  }
  return result;
}


我们动态调试一下，输入下面的信息：

1
2
3
4
abcdefghijklmnop
qrstuvwsyzABCDEF
GHIJKLMNOPQRSTUV
WXYZ0123456789+=

经过fun2函数得到下面的字符串。

1
2
3
4
abdhpF=GqHIirJKs
LMejtNOuPQkvRSwT
UcflsVWyXYmzZ0A1
2gnB34C56oD78E9+

我们的fun2变过后的字符串：

1
2
3
4
bcec8d7dcda25d91
ed3e0b720cbb6cf2
02b09fedbc3e0177
74273ef5d5581794

则我们原来的字符串：

1
2
3
4
bc2e3b4c2eb03258
c5102bf9de77f57d
ddad9edb70c6c20f
ebc01773e5d81947

​ 这样就得到了flag

nctf{bc2e3b4c2eb03258c5102bf9de77f57dddad9edb70c6c20febc01773e5d81947}

其实，想一下，如果是逆算法的话，也不过是把位置顺序逆出来，其实跟我这样是没有差别的。

normal4

本题不是算法题，题目很容易看懂

对了这个题还得upx脱壳一下，比较简单。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // kr00_4
  char Buffer[40]; // [esp+4h] [ebp-2Ch] BYREF

  memset(Buffer, 0, sizeof(Buffer));
  printf("Welcome The System\nPlease Input Key:");
  gets_s(Buffer, 0x28u);
  v3 = strlen(Buffer);
  if ( (unsigned int)(v3 - 35) <= 2 )
  {
    if ( sub_401090((int)Buffer, v3) == 1 )
      printf("Well Done!\n");
    else
      printf("Your Wrong!\n");
  }
  return 0;
}

在这里面能看出我们的flag长度小于37，那么最重要的函数就是sub_401090函数，进入：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
int __fastcall sub_401090(int a1, int a2)
{
  int v4; // edx
  char v5; // al
  int v6; // esi
  int v7; // edi
  char v8; // al
  int v9; // eax
  char v10; // cl
  int v11; // eax
  int v12; // ecx

  if ( a2 != 35 )                               // 长度为35
    return -1;
  v4 = 0;
  while ( 1 )
  {
    v5 = *(_BYTE *)(v4 + a1);
    v6 = (v5 >> 4) % 16;
    v7 = ((16 * v5) >> 4) % 16;
    v8 = byte_402150[2 * v4];
    if ( v8 < 48 || v8 > 57 )
      v9 = v8 - 87;
    else
      v9 = v8 - 48;
    v10 = byte_402151[2 * v4];
    v11 = 16 * v9;
    if ( v10 < 48 || v10 > 57 )
      v12 = v10 - 87;
    else
      v12 = v10 - 48;
    if ( (unsigned __int8)byte_4021A0[16 * v6 + v7] != ((v11 + v12) ^ 0x19) )
      break;
    if ( ++v4 >= 35 )
      return 1;
  }
  return -1;
}

byte_402150数组，byte_402151数组，byte_4021A0数组是我们的重点，这个题我觉得比较好的地方就是进入byte_402150数组时，发现就一个数，那么怎么找到这个数组他的地址时00402150，我们转到16进制去看：

1
2
3
4
5
00402150  32 61 34 39 66 36 39 63  33 38 33 39 35 63 64 65  2a49f69c38395cde
00402160  39 36 64 36 64 65 39 36  64 36 66 34 65 30 32 35  96d6de96d6f4e025
00402170  34 38 34 39 35 34 64 36  31 39 35 34 34 38 64 65  484954d6195448de
00402180  66 36 65 32 64 61 64 36  37 37 38 36 65 32 31 64  f6e2dad67786e21d
00402190  35 61 64 61 65 36 00 00  00 00 00 00 00 00 00 00  5adae6..........

我们发现原来byte_402150数组就是比byte_402151数组多了一个2，我们给出一个爆破脚本，话说好久没写爆破脚本了，上一次是在二面的第三题：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
byte_402150 = '2a49f69c38395cde96d6de96d6f4e025484954d6195448def6e2dad67786e21d5adae6'
byte_402151 = 'a49f69c38395cde96d6de96d6f4e025484954d6195448def6e2dad67786e21d5adae6'
data2=[0x63, 0x7C, 0x77, 0x7B, 0x0F2, 0x6B, 0x6F, 0x0C5, 0x30, 0x1, 0x67, 0x2B, 0x0FE, 
  0x0D7, 0x0AB, 0x76, 0x0CA, 0x82, 0x0C9, 0x7D, 0x0FA, 0x59, 0x47, 0x0F0, 0x0AD, 0x0D4, 0x0A2, 0x0AF, 0x9C, 0x0A4, 0x72, 0x0C0, 0x0B7, 0x0FD, 0x93, 0x26, 0x36, 0x3F, 0x0F7, 0x0CC, 0x34, 0x0A5, 0x0E5, 0x0F1, 0x71, 0x0D8, 0x31, 0x15, 0x4, 0x0C7, 0x23, 0x0C3, 0x18, 0x96, 0x5,0x9A, 0x7, 0x12, 0x80, 0x0E2, 0x0EB, 0x27, 0x0B2, 0x75, 0x9, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0x0A0, 0x52, 0x3B, 0x0D6, 0x0B3, 0x29, 0x0E3, 0x2F, 0x84, 0x53, 0x0D1, 0x0, 0x0ED, 0x20, 0x0FC, 0x0B1, 0x5B, 0x6A, 0x0CB, 0x0BE, 0x39, 0x4A, 0x4C, 0x58, 0x0CF, 0x0D0, 0x0EF, 0x0AA, 0x0FB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0x0F9, 0x2, 0x7F, 0x50, 0x3C, 0x9F, 0x0A8, 0x51, 0x0A3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0x0F5, 0x0BC, 0x0B6, 0x0DA, 0x21, 0x10, 0x0FF, 0x0F3, 0x0D2, 0x0CD, 0x0C, 0x13, 0x0EC, 0x5F, 0x97, 0x44, 0x17, 0x0C4, 0x0A7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 0x60, 0x81, 0x4F, 0x0DC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0x0EE, 0x0B8, 0x14, 0x0DE, 0x5E, 0x0B, 0x0DB, 0x0E0, 0x32, 0x3A, 0x0A, 0x49, 0x6, 0x24, 0x5C, 0x0C2, 0x0D3, 0x0AC, 0x62, 0x91, 0x95, 0x0E4, 0x79, 0x0E7, 0x0C8, 0x37, 0x6D, 0x8D, 0x0D5, 0x4E, 0x0A9, 0x6C, 0x56, 0x0F4, 0x0EA, 0x65, 0x7A, 0x0AE, 0x8, 0x0BA, 0x78, 0x25, 0x2E, 0x1C, 0x0A6, 0x0B4, 0x0C6, 0x0E8, 0x0DD, 0x74, 0x1F, 0x4B, 0x0BD, 0x8B, 0x8A, 0x70, 0x3E, 0x0B5, 0x66, 0x48, 0x3, 0x0F6, 0x0E, 0x61, 0x35, 0x57, 0x0B9, 0x86, 0x0C1, 0x1D, 0x9E, 0x0E1, 0x0F8, 0x98, 0x11, 0x69, 0x0D9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0x0E9, 0x0CE, 0x55, 0x28, 0x0DF, 0x8C, 0x0A1, 0x89, 0x0D, 0x0BF, 0x0E6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0x0B0, 0x54, 0x0BB, 0x16]
flag=""
for i in range(35):                          //i相当于v4
  v8=ord(byte_402150[2*i])
  if v8<48 or v8>57:
    v9=v8-87
  else:
    v9=v8-48
  v10=ord(byte_402151[2*i])
  v11=16*v9
  if v10<48 or v10>57:
    v12=v10-87
  else:
    v12=v10-48
  for j in range(16,127):                   //j相当于v5
    v6=(j>>4)%16
    v7=((16*j)>>4)%16
    if data2[16*v6+v7]==((v11+v12)^0x19):
      flag+=chr(j)
print(flag)

得到flag{Th1s_1s_Simple_Rep1ac3_Enc0d3}

normal5

这是一类叫VM类型的题，第一次见，先写一下vm类型的题是什么意思。

vm逆向
首先这里的虚拟机往往不是商业的vmp之类的保护软件，而是出题人实现的小型虚拟机，题目本身一般也没有实现某些复杂的功能。

基本原理
这里的虚拟机当然并不是指VMWare或者VirtualBox之类的虚拟机，而是指的意思是一种解释执行系统或者模拟器（Emulator）。
逆向中的虚拟机保护是一种基于虚拟机的代码保护技术。它将基于x86汇编系统中的可执行代码转换为字节码指令系统的代码，来达到不被轻易逆向和篡改的目的。简单点说就是将程序的代码转换自定义的操作码(opcode)，然后在程序执行时再通过解释这些操作码，选择对应的函数执行，从而实现程序原有的功能。

总之vm类型的题一般是将指令变为作者想要的形式，找到特征，执行相应特征。

vm包括三个系统

vm_start：

虚拟机的入口函数，对虚拟机环境进行初始化

vm_dispatcher:

调度器，解释opcode，并选择对应的handle函数执行，当handle执行完后会跳回这里，形成一个循环。

opcode :

程序可执行代码转换成的操作码

__

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
int64 __fastcall main(int a1, char **a2, char **a3)
{
  char v4; // [rsp+Bh] [rbp-5h]
  int i; // [rsp+Ch] [rbp-4h]

  puts("[WxyVM 0.0.1]");
  puts("input your flag:");
  scanf("%s", &byte_604B80);
  v4 = 1;
  sub_4005B6();
  if ( strlen(&byte_604B80) != 24 )
    v4 = 0;
  for ( i = 0; i <= 23; ++i )
  {
    if ( *(&byte_604B80 + i) != dword_601060[i] )
      v4 = 0;
  }
  if ( v4 )
    puts("correct");
  else
    puts("wrong");
  return 0LL;
}

从主函数可以判断出该字符长度为24，判断完后又和dword_601060进行了字符串比较

sub_4005B6这个函数内容：

__

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
int64 sub_4005B6()
{
  __int64 result; // rax
  int i; // [rsp+0h] [rbp-10h]
  char v2; // [rsp+8h] [rbp-8h]
  int v3; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 14999; i += 3 )
  {
    v2 = byte_6010C0[i + 2];
    v3 = byte_6010C0[i + 1];
    result = (unsigned int)byte_6010C0[i];
    switch ( byte_6010C0[i] )
    {
      case 1:
        result = byte_6010C0[i + 1];
        *(&byte_604B80 + v3) += v2;
        break;
      case 2:
        result = byte_6010C0[i + 1];
        *(&byte_604B80 + v3) -= v2;
        break;
      case 3:
        result = byte_6010C0[i + 1];
        *(&byte_604B80 + v3) ^= v2;
        break;
      case 4:
        result = byte_6010C0[i + 1];
        *(&byte_604B80 + v3) *= v2;
        break;
      case 5:
        result = byte_6010C0[i + 1];
        *(&byte_604B80 + v3) ^= *(&byte_604B80 + byte_6010C0[i + 2]);
        break;
      default:
        continue;
    }
  }
  return result;
}

这就是一个最基础也是最常见的vm模型，分为三个一组，其中第一个是我们所说的选择的操作方式，无非就五种操作，通过v3来计算值。我看许多wp是用idapython写的，但ida7.6好像改了，好多api都不对。。。哭了，只能用python来搞了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
dword_601060 = [0xC4, 0x34, 0x22, 0xb1, 0xd3, 0x11, 0x97, 0x07, 0xdb, 0x37, 0xc4, 0x06, 0x1d, 0xfc,
                0x5b, 0xed, 0x98, 0xdf, 0x94, 0xd8, 0xb3, 0x84, 0xcc, 0x08]
b = [
  0x01, 0x10, 0x25, 0x03, 0x0D, 0x0A, 0x02, 0x0B, 0x28, 0x02,
  0x14, 0x3F, 0x01, 0x17, 0x3C, 0x01, 0x00, 0x69, 0x01, 0x12,
  0x3F, 0x02, 0x0E, 0x77, 0x03, 0x15, 0x53, 0x02, 0x0E, 0x7D,
  0x03, 0x05, 0x0A, 0x02, 0x04, 0x55, 0x02, 0x15, 0x33, 0x02,
  0x15, 0x05, 0x01, 0x05, 0x2F, 0x03, 0x07, 0x43, 0x01, 0x11,
  0x39, 0x03, 0x0D, 0x27, 0x01, 0x05, 0x1E, 0x03, 0x04, 0x3C,
  0x01, 0x13, 0x1E, 0x03, 0x01, 0x78, 0x01, 0x00, 0x20, 0x02,
  0x0F, 0x53, 0x03, 0x14, 0x2B, 0x03, 0x14, 0x28, 0x03, 0x0A,
  0x19, 0x03, 0x12, 0x60, 0x01, 0x05, 0x7E, 0x03, 0x0F, 0x20,
  0x01, 0x0F, 0x58, 0x02, 0x11, 0x51, 0x01, 0x0B, 0x24, 0x01,
  0x17, 0x79, 0x01, 0x0E, 0x4A, 0x03, 0x10, 0x67, 0x02, 0x16,
  0x5C, 0x03, 0x09, 0x6D, 0x01, 0x17, 0x30, 0x02, 0x0A, 0x2C,
  0x03, 0x07, 0x3F, 0x03, 0x07, 0x43, 0x01, 0x04, 0x04, 0x02,
  0x00, 0x0F, 0x01, 0x00, 0x1F, 0x01, 0x00, 0x59, 0x03, 0x0B,
  0x6B, 0x01, 0x16, 0x11, 0x03, 0x03, 0x38, 0x01, 0x12, 0x41,
  0x01, 0x02, 0x66, 0x02, 0x0F, 0x1A, 0x03, 0x08, 0x14, 0x03,
  0x0A, 0x2A, 0x01, 0x01, 0x15, 0x01, 0x0B, 0x0A, 0x01, 0x01,
  0x36, 0x01, 0x05, 0x66, 0x01, 0x08, 0x14, 0x01, 0x0B, 0x7A,
  0x03, 0x0D, 0x7D, 0x02, 0x13, 0x52, 0x03, 0x0D, 0x0E, 0x03,
  0x10, 0x3E, 0x03, 0x06, 0x30, 0x02, 0x01, 0x6B, 0x02, 0x04,
  0x77, 0x01, 0x01, 0x12, 0x02, 0x09, 0x38, 0x03, 0x07, 0x74,
  0x02, 0x0A, 0x2C, 0x02, 0x05, 0x46, 0x01, 0x12, 0x1E, 0x03,
  0x04, 0x10, 0x02, 0x01, 0x6A, 0x02, 0x03, 0x5C, 0x03, 0x09,
  0x11, 0x03, 0x07, 0x26, 0x02, 0x01, 0x3E, 0x02, 0x0D, 0x42,
  0x02, 0x16, 0x35, 0x02, 0x09, 0x33, 0x01, 0x04, 0x00, 0x03,
  0x07, 0x3C, 0x03, 0x0C, 0x5B, 0x01, 0x0D, 0x0F, 0x02, 0x16,
  0x34, 0x02, 0x01, 0x61, 0x01, 0x08, 0x38, 0x03, 0x05, 0x37,
  0x03, 0x0E, 0x64, 0x03, 0x0F, 0x72, 0x03, 0x0D, 0x08, 0x01,
  0x0F, 0x2B, 0x03, 0x04, 0x79, 0x02, 0x12, 0x62, 0x03, 0x17,
  0x57, 0x01, 0x16, 0x55, 0x02, 0x05, 0x19, 0x03, 0x07, 0x23,
  0x01, 0x06, 0x62, 0x02, 0x0D, 0x54, 0x03, 0x11, 0x4D, 0x01,
  0x10, 0x4E, 0x01, 0x0A, 0x53, 0x01, 0x0C, 0x6A, 0x02, 0x10,
  0x42, 0x03, 0x05, 0x08, 0x02, 0x0D, 0x75, 0x03, 0x01, 0x34,
  0x01, 0x09, 0x1F, 0x01, 0x16, 0x23, 0x01, 0x11, 0x5E, 0x02,
  0x0A, 0x39, 0x03, 0x16, 0x15, 0x01, 0x02, 0x7C, 0x03, 0x04,
  0x51, 0x01, 0x0F, 0x1B, 0x01, 0x17, 0x5C, 0x02, 0x09, 0x3C,
  0x01, 0x12, 0x0B, 0x02, 0x0E, 0x2E, 0x03, 0x06, 0x68, 0x03,
  0x0C, 0x48, 0x01, 0x07, 0x02, 0x03, 0x0A, 0x2E, 0x03, 0x0C,
  0x4D, 0x02, 0x14, 0x6F, 0x03, 0x04, 0x0F, 0x03, 0x07, 0x5A,
  0x01, 0x02, 0x45, 0x01, 0x03, 0x63, 0x02, 0x01, 0x33, 0x03,
  0x01, 0x31, 0x01, 0x10, 0x60, 0x02, 0x08, 0x30, 0x02, 0x07,
  0x2A, 0x03, 0x16, 0x66, 0x01, 0x09, 0x2C, 0x02, 0x16, 0x16,
  0x01, 0x0D, 0x04, 0x01, 0x0E, 0x5F, 0x03, 0x0D, 0x47, 0x03,
  0x0C, 0x39, 0x01, 0x0E, 0x68, 0x03, 0x0B, 0x36, 0x02, 0x16,
  0x10, 0x01, 0x10, 0x07, 0x03, 0x17, 0x0C, 0x02, 0x14, 0x33,
  0x03, 0x0E, 0x0B, 0x02, 0x14, 0x39, 0x02, 0x0D, 0x6E, 0x03,
  0x16, 0x37, 0x03, 0x0C, 0x5D, 0x03, 0x12, 0x6D, 0x02, 0x06,
  0x66, 0x02, 0x0A, 0x40, 0x03, 0x12, 0x05, 0x02, 0x0F, 0x7A,
  0x03, 0x03, 0x2A, 0x01, 0x06, 0x1B, 0x01, 0x04, 0x33, 0x03,
  0x13, 0x4D, 0x01, 0x14, 0x44, 0x02, 0x09, 0x10, 0x02, 0x0A,
  0x12, 0x01, 0x04, 0x0B, 0x01, 0x08, 0x5E, 0x02, 0x17, 0x77,
  0x02, 0x10, 0x3F, 0x01, 0x11, 0x4B, 0x02, 0x0C, 0x47, 0x03,
  0x11, 0x16, 0x02, 0x14, 0x51, 0x01, 0x14, 0x01, 0x03, 0x13,
  0x67, 0x01, 0x0F, 0x73, 0x02, 0x0E, 0x7B, 0x01, 0x01, 0x0D,
  0x01, 0x13, 0x13, 0x02, 0x01, 0x0B, 0x02, 0x15, 0x2A, 0x03,
  0x01, 0x1E, 0x01, 0x0E, 0x6F, 0x02, 0x05, 0x26, 0x03, 0x0C,
  0x38, 0x01, 0x11, 0x7E, 0x02, 0x02, 0x01, 0x03, 0x10, 0x2E,
  0x01, 0x05, 0x05, 0x02, 0x12, 0x66, 0x02, 0x0B, 0x6E, 0x03,
  0x0F, 0x40, 0x02, 0x00, 0x68, 0x01, 0x0B, 0x41, 0x02, 0x04,
  0x74, 0x03, 0x04, 0x5B, 0x03, 0x10, 0x29, 0x01, 0x0F, 0x37,
  0x03, 0x10, 0x61, 0x02, 0x11, 0x7A, 0x01, 0x09, 0x55, 0x02,
  0x11, 0x7E, 0x01, 0x12, 0x12, 0x02, 0x00, 0x2F, 0x02, 0x0A,
  0x0C, 0x02, 0x17, 0x58, 0x02, 0x0C, 0x19, 0x02, 0x0B, 0x2C,
  0x01, 0x09, 0x31, 0x02, 0x07, 0x6E, 0x02, 0x0B, 0x0E, 0x02,
  0x16, 0x37, 0x02, 0x02, 0x20, 0x01, 0x10, 0x2E, 0x02, 0x0F,
  0x70, 0x01, 0x02, 0x45, 0x03, 0x12, 0x11, 0x03, 0x0A, 0x6B,
  0x01, 0x0E, 0x66, 0x01, 0x14, 0x1B, 0x03, 0x00, 0x54, 0x03,
  0x11, 0x41, 0x01, 0x13, 0x4D, 0x01, 0x08, 0x2B, 0x02, 0x04,
  0x09, 0x02, 0x17, 0x46, 0x03, 0x01, 0x0F, 0x02, 0x17, 0x04,
  0x01, 0x15, 0x14, 0x01, 0x17, 0x56, 0x02, 0x15, 0x56, 0x03,
  0x17, 0x31, 0x02, 0x12, 0x76, 0x01, 0x16, 0x47, 0x02, 0x06,
  0x7F, 0x01, 0x0A, 0x2D, 0x01, 0x17, 0x1E, 0x03, 0x15, 0x58,
  0x01, 0x01, 0x69, 0x02, 0x05, 0x28, 0x03, 0x0A, 0x69, 0x01,
  0x17, 0x2F, 0x02, 0x0A, 0x63, 0x02, 0x0D, 0x29, 0x03, 0x16,
  0x4E, 0x01, 0x05, 0x37, 0x03, 0x06, 0x58, 0x03, 0x03, 0x55,
  0x02, 0x0C, 0x15, 0x02, 0x0A, 0x54, 0x01, 0x12, 0x24, 0x01,
  0x0D, 0x75, 0x01, 0x08, 0x45, 0x03, 0x0C, 0x68, 0x02, 0x03,
  0x6C, 0x03, 0x14, 0x12, 0x02, 0x11, 0x35, 0x01, 0x02, 0x0B,
  0x02, 0x00, 0x7A, 0x01, 0x02, 0x74, 0x01, 0x03, 0x62, 0x01,
  0x00, 0x6A, 0x02, 0x0B, 0x41, 0x02, 0x0B, 0x29, 0x03, 0x05,
  0x2D, 0x01, 0x0C, 0x54, 0x03, 0x01, 0x5C, 0x02, 0x0D, 0x1B,
  0x03, 0x05, 0x16, 0x02, 0x0B, 0x74, 0x02, 0x04, 0x19, 0x03,
  0x02, 0x42, 0x03, 0x10, 0x72, 0x01, 0x0F, 0x04, 0x02, 0x06,
  0x63, 0x03, 0x10, 0x0E, 0x03, 0x03, 0x77, 0x02, 0x0B, 0x4C,
  0x02, 0x0E, 0x16, 0x01, 0x0F, 0x20, 0x02, 0x08, 0x06, 0x01,
  0x0F, 0x16, 0x01, 0x0B, 0x36, 0x03, 0x0F, 0x37, 0x03, 0x07,
  0x19, 0x02, 0x09, 0x69, 0x02, 0x00, 0x44, 0x02, 0x07, 0x2C,
  0x02, 0x0D, 0x43, 0x02, 0x08, 0x52, 0x02, 0x11, 0x38, 0x02,
  0x04, 0x2B, 0x01, 0x01, 0x79, 0x01, 0x12, 0x5A, 0x03, 0x03,
  0x31, 0x03, 0x13, 0x4D, 0x02, 0x05, 0x54, 0x01, 0x02, 0x17,
  0x03, 0x03, 0x55, 0x03, 0x10, 0x6E, 0x01, 0x0E, 0x7E, 0x03,
  0x07, 0x1D, 0x01, 0x03, 0x20, 0x03, 0x14, 0x31, 0x01, 0x15,
  0x30, 0x03, 0x11, 0x03, 0x02, 0x11, 0x71, 0x03, 0x0F, 0x73,
  0x03, 0x01, 0x54, 0x02, 0x0E, 0x62, 0x01, 0x01, 0x3C, 0x01,
  0x04, 0x13, 0x02, 0x09, 0x6D, 0x01, 0x0C, 0x2A, 0x03, 0x0B,
  0x2B, 0x02, 0x02, 0x05, 0x03, 0x08, 0x2F, 0x03, 0x10, 0x7F,
  0x01, 0x10, 0x70, 0x01, 0x16, 0x4E, 0x03, 0x16, 0x29, 0x02,
  0x16, 0x31, 0x01, 0x07, 0x2F, 0x01, 0x14, 0x64, 0x02, 0x09,
  0x65, 0x01, 0x02, 0x3C, 0x01, 0x0B, 0x1F, 0x03, 0x0E, 0x32,
  0x03, 0x15, 0x7F, 0x01, 0x0F, 0x3D, 0x03, 0x01, 0x08, 0x02,
  0x08, 0x66, 0x03, 0x06, 0x63, 0x02, 0x03, 0x12, 0x03, 0x17,
  0x03, 0x03, 0x15, 0x75, 0x03, 0x0B, 0x44, 0x01, 0x07, 0x4A,
  0x01, 0x12, 0x5C, 0x01, 0x12, 0x5A, 0x01, 0x06, 0x59, 0x03,
  0x00, 0x21, 0x01, 0x15, 0x6C, 0x03, 0x02, 0x3D, 0x02, 0x0D,
  0x2C, 0x02, 0x08, 0x64, 0x03, 0x03, 0x79, 0x03, 0x17, 0x68,
  0x03, 0x00, 0x60, 0x02, 0x07, 0x6A, 0x03, 0x0E, 0x5A, 0x01,
  0x05, 0x16, 0x02, 0x11, 0x7E, 0x03, 0x04, 0x09, 0x02, 0x10,
  0x36, 0x02, 0x14, 0x46, 0x02, 0x04, 0x04, 0x01, 0x06, 0x6A,
  0x03, 0x00, 0x24, 0x02, 0x10, 0x6F, 0x03, 0x02, 0x2E, 0x01,
  0x08, 0x5F, 0x02, 0x08, 0x38, 0x02, 0x13, 0x16, 0x03, 0x04,
  0x03, 0x02, 0x08, 0x47, 0x01, 0x11, 0x0A, 0x02, 0x00, 0x0A,
  0x01, 0x0D, 0x3D, 0x01, 0x10, 0x6B, 0x03, 0x14, 0x45, 0x03,
  0x07, 0x25, 0x01, 0x0F, 0x11, 0x01, 0x00, 0x2D, 0x03, 0x00,
  0x72, 0x03, 0x00, 0x51, 0x01, 0x07, 0x01, 0x03, 0x05, 0x32,
  0x02, 0x04, 0x39, 0x01, 0x04, 0x3F, 0x02, 0x07, 0x43, 0x03,
  0x10, 0x38, 0x02, 0x07, 0x0B, 0x03, 0x14, 0x2C, 0x03, 0x08,
  0x67, 0x02, 0x02, 0x0A, 0x02, 0x01, 0x79, 0x01, 0x0B, 0x4B,
  0x03, 0x0F, 0x6A, 0x02, 0x09, 0x12, 0x03, 0x08, 0x4A, 0x01,
  0x04, 0x6D, 0x02, 0x05, 0x10, 0x03, 0x0C, 0x6B, 0x01, 0x10,
  0x6D, 0x02, 0x17, 0x24, 0x02, 0x10, 0x7D, 0x01, 0x0B, 0x2C,
  0x03, 0x13, 0x61, 0x03, 0x0A, 0x61, 0x01, 0x14, 0x47, 0x03,
  0x16, 0x71, 0x02, 0x0D, 0x04, 0x01, 0x00, 0x1C, 0x02, 0x00,
  0x16, 0x03, 0x0C, 0x2F, 0x03, 0x0D, 0x2A, 0x03, 0x0B, 0x4B,
  0x01, 0x11, 0x5B, 0x02, 0x11, 0x27, 0x01, 0x05, 0x18, 0x01,
  0x12, 0x78, 0x03, 0x0E, 0x2F, 0x02, 0x12, 0x24, 0x03, 0x10,
  0x7E, 0x03, 0x0E, 0x69, 0x02, 0x08, 0x73, 0x01, 0x12, 0x22,
  0x02, 0x14, 0x65, 0x02, 0x04, 0x59, 0x01, 0x08, 0x46, 0x03,
  0x0E, 0x0F, 0x03, 0x0E, 0x65, 0x01, 0x15, 0x5F, 0x01, 0x13,
  0x1C, 0x02, 0x04, 0x59, 0x01, 0x14, 0x54, 0x01, 0x11, 0x27,
  0x03, 0x03, 0x03, 0x02, 0x15, 0x52, 0x01, 0x0D, 0x00, 0x02,
  0x00, 0x79, 0x01, 0x0B, 0x7F, 0x01, 0x05, 0x2F, 0x01, 0x07,
  0x27, 0x02, 0x0C, 0x53, 0x02, 0x16, 0x2C, 0x02, 0x0C, 0x3C,
  0x01, 0x05, 0x30, 0x02, 0x05, 0x08, 0x01, 0x10, 0x6A, 0x01,
  0x0E, 0x1B, 0x01, 0x07, 0x70, 0x03, 0x10, 0x3D, 0x02, 0x16,
  0x7E, 0x01, 0x0C, 0x15, 0x03, 0x16, 0x72, 0x02, 0x07, 0x75,
  0x02, 0x0D, 0x4A, 0x03, 0x11, 0x50, 0x02, 0x14, 0x6C, 0x01,
  0x11, 0x09, 0x01, 0x12, 0x5A, 0x03, 0x06, 0x37, 0x03, 0x11,
  0x61, 0x01, 0x16, 0x26, 0x02, 0x13, 0x29, 0x01, 0x01, 0x6B,
  0x03, 0x17, 0x61, 0x01, 0x14, 0x54, 0x03, 0x17, 0x53, 0x01,
  0x05, 0x55, 0x03, 0x03, 0x4B, 0x03, 0x15, 0x56, 0x01, 0x06,
  0x2B, 0x01, 0x0F, 0x0E, 0x02, 0x0A, 0x59, 0x03, 0x09, 0x2A,
  0x02, 0x04, 0x66, 0x01, 0x16, 0x47, 0x01, 0x03, 0x36, 0x01,
  0x03, 0x0B, 0x02, 0x15, 0x4A, 0x02, 0x06, 0x1B, 0x01, 0x06,
  0x0D, 0x01, 0x08, 0x04, 0x03, 0x04, 0x74, 0x03, 0x0F, 0x4E,
  0x01, 0x00, 0x20, 0x01, 0x04, 0x2D, 0x02, 0x0B, 0x52, 0x02,
  0x0B, 0x6B, 0x03, 0x0D, 0x0E, 0x02, 0x03, 0x24, 0x02, 0x08,
  0x43, 0x02, 0x16, 0x35, 0x03, 0x16, 0x7F, 0x03, 0x04, 0x5E,
  0x01, 0x09, 0x7E, 0x03, 0x0A, 0x3B, 0x01, 0x12, 0x5B, 0x01,
  0x14, 0x0D, 0x03, 0x14, 0x25, 0x02, 0x02, 0x62, 0x02, 0x13,
  0x0C, 0x03, 0x17, 0x74, 0x01, 0x0F, 0x11, 0x01, 0x10, 0x5D,
  0x02, 0x0B, 0x43, 0x02, 0x0E, 0x3C, 0x01, 0x0F, 0x68, 0x01,
  0x0C, 0x76, 0x02, 0x17, 0x7A, 0x01, 0x02, 0x09, 0x02, 0x03,
  0x78, 0x03, 0x08, 0x12, 0x03, 0x05, 0x76, 0x01, 0x0B, 0x72,
  0x02, 0x08, 0x0E, 0x03, 0x0C, 0x26, 0x02, 0x13, 0x63, 0x03,
  0x15, 0x63, 0x02, 0x03, 0x3C, 0x01, 0x17, 0x0D, 0x03, 0x0B,
  0x01, 0x03, 0x10, 0x0F, 0x02, 0x03, 0x40, 0x03, 0x0D, 0x45,
  0x02, 0x0B, 0x68, 0x03, 0x0E, 0x25, 0x03, 0x0C, 0x7F, 0x02,
  0x09, 0x62, 0x03, 0x01, 0x35, 0x01, 0x10, 0x0D, 0x03, 0x03,
  0x42, 0x03, 0x01, 0x6A, 0x01, 0x14, 0x38, 0x02, 0x0E, 0x26,
  0x03, 0x11, 0x1B, 0x03, 0x15, 0x3F, 0x03, 0x01, 0x34, 0x02,
  0x12, 0x28, 0x03, 0x0E, 0x03, 0x02, 0x11, 0x3A, 0x01, 0x05,
  0x36, 0x03, 0x03, 0x4D, 0x03, 0x0E, 0x3B, 0x01, 0x12, 0x1E,
  0x02, 0x0E, 0x39, 0x01, 0x12, 0x6D, 0x02, 0x16, 0x52, 0x01,
  0x0A, 0x63, 0x02, 0x00, 0x30, 0x02, 0x14, 0x7C, 0x02, 0x17,
  0x06, 0x03, 0x07, 0x36, 0x02, 0x02, 0x47, 0x03, 0x00, 0x5B,
  0x03, 0x11, 0x58, 0x01, 0x05, 0x5A, 0x02, 0x0A, 0x38, 0x03,
  0x04, 0x2A, 0x01, 0x01, 0x56, 0x03, 0x0F, 0x7A, 0x02, 0x15,
  0x63, 0x03, 0x0E, 0x7C, 0x02, 0x09, 0x0E, 0x02, 0x13, 0x25,
  0x03, 0x0D, 0x32, 0x02, 0x00, 0x11, 0x03, 0x00, 0x05, 0x01,
  0x0B, 0x47, 0x02, 0x0F, 0x70, 0x02, 0x09, 0x75, 0x01, 0x02,
  0x69, 0x03, 0x0C, 0x49, 0x03, 0x09, 0x09, 0x01, 0x0A, 0x43,
  0x01, 0x17, 0x1F, 0x01, 0x0A, 0x6A, 0x01, 0x12, 0x28, 0x03,
  0x01, 0x36, 0x01, 0x08, 0x72, 0x02, 0x10, 0x1D, 0x03, 0x0B,
  0x09, 0x01, 0x0D, 0x01, 0x01, 0x0B, 0x72, 0x02, 0x03, 0x5A,
  0x03, 0x08, 0x29, 0x02, 0x0A, 0x50, 0x02, 0x17, 0x2B, 0x02,
  0x11, 0x05, 0x02, 0x08, 0x55, 0x02, 0x0C, 0x40, 0x02, 0x03,
  0x0C, 0x02, 0x02, 0x16, 0x01, 0x0B, 0x0A, 0x03, 0x00, 0x16,
  0x02, 0x15, 0x11, 0x03, 0x03, 0x5F, 0x03, 0x08, 0x5D, 0x03,
  0x13, 0x4E, 0x03, 0x08, 0x4D, 0x03, 0x10, 0x24, 0x01, 0x11,
  0x59, 0x02, 0x0A, 0x66, 0x02, 0x02, 0x25, 0x02, 0x17, 0x7C,
  0x02, 0x09, 0x5B, 0x01, 0x03, 0x54, 0x03, 0x15, 0x0B, 0x02,
  0x13, 0x71, 0x03, 0x0A, 0x72, 0x01, 0x0A, 0x6B, 0x01, 0x0E,
  0x37, 0x01, 0x0B, 0x12, 0x02, 0x15, 0x3F, 0x03, 0x0D, 0x76,
  0x01, 0x13, 0x1B, 0x01, 0x0E, 0x6F, 0x02, 0x0E, 0x14, 0x02,
  0x0C, 0x2B, 0x01, 0x06, 0x28, 0x03, 0x13, 0x4B, 0x03, 0x10,
  0x4B, 0x03, 0x0D, 0x21, 0x02, 0x0D, 0x3B, 0x03, 0x0D, 0x1E,
  0x02, 0x00, 0x42, 0x01, 0x01, 0x67, 0x02, 0x0A, 0x1F, 0x02,
  0x13, 0x54, 0x01, 0x01, 0x0E, 0x03, 0x15, 0x66, 0x03, 0x0B,
  0x24, 0x03, 0x07, 0x38, 0x03, 0x03, 0x64, 0x01, 0x06, 0x78,
  0x03, 0x09, 0x3E, 0x03, 0x05, 0x2E, 0x03, 0x0D, 0x17, 0x03,
  0x04, 0x4D, 0x01, 0x14, 0x5F, 0x02, 0x16, 0x6B, 0x03, 0x10,
  0x25, 0x03, 0x0C, 0x5A, 0x03, 0x15, 0x29, 0x02, 0x0A, 0x13,
  0x03, 0x08, 0x4C, 0x03, 0x05, 0x3C, 0x03, 0x00, 0x5F, 0x03,
  0x09, 0x3A, 0x03, 0x01, 0x32, 0x03, 0x0F, 0x0A, 0x02, 0x06,
  0x6A, 0x03, 0x06, 0x01, 0x03, 0x0A, 0x5B, 0x01, 0x16, 0x06,
  0x03, 0x14, 0x62, 0x02, 0x0F, 0x21, 0x02, 0x03, 0x7E, 0x01,
  0x06, 0x0B, 0x02, 0x17, 0x78, 0x03, 0x01, 0x30, 0x03, 0x08,
  0x6B, 0x02, 0x12, 0x06, 0x02, 0x0B, 0x4C, 0x02, 0x07, 0x77,
  0x02, 0x08, 0x4A, 0x03, 0x13, 0x24, 0x02, 0x09, 0x2A, 0x02,
  0x14, 0x77, 0x01, 0x0B, 0x0F, 0x01, 0x0F, 0x6F, 0x02, 0x0E,
  0x22, 0x03, 0x04, 0x64, 0x02, 0x0A, 0x53, 0x01, 0x15, 0x6D,
  0x01, 0x06, 0x07, 0x01, 0x0F, 0x45, 0x01, 0x0B, 0x33, 0x03,
  0x17, 0x4C, 0x02, 0x0C, 0x49, 0x01, 0x04, 0x74, 0x02, 0x05,
  0x13, 0x03, 0x12, 0x5E, 0x02, 0x08, 0x47, 0x01, 0x16, 0x05,
  0x02, 0x0D, 0x3C, 0x01, 0x01, 0x45, 0x03, 0x17, 0x4B, 0x02,
  0x03, 0x43, 0x03, 0x0D, 0x62, 0x01, 0x0F, 0x65, 0x02, 0x12,
  0x3A, 0x02, 0x16, 0x01, 0x02, 0x16, 0x6F, 0x03, 0x08, 0x48,
  0x01, 0x08, 0x2C, 0x01, 0x08, 0x1B, 0x03, 0x10, 0x30, 0x01,
  0x0E, 0x38, 0x02, 0x0D, 0x08, 0x01, 0x14, 0x2B, 0x02, 0x0A,
  0x27, 0x01, 0x13, 0x06, 0x01, 0x07, 0x24, 0x01, 0x00, 0x68,
  0x03, 0x16, 0x17, 0x03, 0x0A, 0x5A, 0x01, 0x0D, 0x3C, 0x03,
  0x0D, 0x3C, 0x02, 0x01, 0x57, 0x03, 0x0C, 0x2A, 0x01, 0x05,
  0x2F, 0x02, 0x00, 0x0C, 0x01, 0x15, 0x44, 0x01, 0x04, 0x49,
  0x02, 0x0C, 0x01, 0x02, 0x0B, 0x1A, 0x03, 0x13, 0x0B, 0x03,
  0x01, 0x70, 0x01, 0x0C, 0x68, 0x01, 0x0A, 0x7C, 0x02, 0x16,
  0x49, 0x03, 0x0A, 0x5F, 0x01, 0x14, 0x5A, 0x01, 0x00, 0x29,
  0x01, 0x02, 0x0E, 0x02, 0x02, 0x0E, 0x02, 0x04, 0x7C, 0x01,
  0x04, 0x3D, 0x01, 0x12, 0x3B, 0x02, 0x11, 0x65, 0x03, 0x0A,
  0x59, 0x01, 0x08, 0x22, 0x02, 0x09, 0x6B, 0x02, 0x00, 0x59,
  0x01, 0x09, 0x2B, 0x01, 0x10, 0x5D, 0x02, 0x05, 0x43, 0x02,
  0x0E, 0x5B, 0x01, 0x15, 0x58, 0x01, 0x04, 0x52, 0x01, 0x02,
  0x19, 0x01, 0x10, 0x02, 0x02, 0x14, 0x1D, 0x03, 0x10, 0x18,
  0x02, 0x03, 0x23, 0x01, 0x01, 0x0B, 0x02, 0x0A, 0x28, 0x02,
  0x14, 0x7E, 0x03, 0x12, 0x07, 0x02, 0x15, 0x37, 0x01, 0x0F,
  0x47, 0x03, 0x07, 0x58, 0x03, 0x14, 0x59, 0x02, 0x11, 0x14,
  0x01, 0x17, 0x3B, 0x01, 0x07, 0x71, 0x01, 0x06, 0x56, 0x03,
  0x02, 0x4A, 0x01, 0x04, 0x04, 0x03, 0x10, 0x0D, 0x03, 0x15,
  0x4F, 0x03, 0x06, 0x6F, 0x02, 0x06, 0x61, 0x03, 0x07, 0x20,
  0x02, 0x0D, 0x0A, 0x01, 0x02, 0x5E, 0x02, 0x02, 0x14, 0x01,
  0x01, 0x4A, 0x01, 0x05, 0x58, 0x02, 0x10, 0x59, 0x01, 0x0C,
  0x34, 0x03, 0x10, 0x4F, 0x02, 0x15, 0x61, 0x01, 0x11, 0x23,
  0x03, 0x08, 0x39, 0x02, 0x0E, 0x3E, 0x01, 0x11, 0x2F, 0x01,
  0x06, 0x61, 0x01, 0x0B, 0x3A, 0x01, 0x02, 0x27, 0x01, 0x04,
  0x5D, 0x02, 0x17, 0x13, 0x03, 0x05, 0x0C, 0x02, 0x16, 0x2B,
  0x03, 0x02, 0x14, 0x02, 0x12, 0x1F, 0x03, 0x14, 0x18, 0x01,
  0x08, 0x63, 0x01, 0x0D, 0x16, 0x01, 0x03, 0x1F, 0x03, 0x0D,
  0x0A, 0x01, 0x15, 0x03, 0x01, 0x00, 0x0F, 0x02, 0x12, 0x3B,
  0x01, 0x14, 0x18, 0x01, 0x14, 0x65, 0x02, 0x05, 0x13, 0x01,
  0x0D, 0x74, 0x01, 0x00, 0x67, 0x02, 0x11, 0x55, 0x03, 0x05,
  0x68, 0x01, 0x11, 0x05, 0x02, 0x07, 0x2E, 0x01, 0x10, 0x6E,
  0x01, 0x04, 0x45, 0x03, 0x17, 0x01, 0x03, 0x0D, 0x4B, 0x01,
  0x10, 0x6D, 0x03, 0x00, 0x26, 0x01, 0x14, 0x51, 0x03, 0x01,
  0x1D, 0x03, 0x09, 0x5F, 0x01, 0x00, 0x68, 0x01, 0x0E, 0x7D,
  0x01, 0x0E, 0x18, 0x02, 0x13, 0x3D, 0x03, 0x0F, 0x03, 0x02,
  0x13, 0x21, 0x03, 0x16, 0x46, 0x03, 0x04, 0x3D, 0x03, 0x0B,
  0x37, 0x03, 0x06, 0x54, 0x01, 0x09, 0x48, 0x01, 0x10, 0x66,
  0x02, 0x00, 0x5C, 0x03, 0x12, 0x68, 0x01, 0x0F, 0x58, 0x02,
  0x08, 0x2F, 0x02, 0x0C, 0x1D, 0x03, 0x13, 0x54, 0x02, 0x07,
  0x78, 0x03, 0x13, 0x4D, 0x01, 0x0B, 0x14, 0x02, 0x16, 0x2A,
  0x02, 0x0A, 0x27, 0x01, 0x16, 0x42, 0x01, 0x01, 0x28, 0x02,
  0x07, 0x69, 0x02, 0x01, 0x33, 0x03, 0x0F, 0x50, 0x01, 0x17,
  0x19, 0x01, 0x0C, 0x3B, 0x03, 0x12, 0x03, 0x03, 0x13, 0x51,
  0x01, 0x0A, 0x47, 0x03, 0x15, 0x10, 0x03, 0x05, 0x56, 0x01,
  0x0C, 0x7C, 0x01, 0x09, 0x35, 0x02, 0x0E, 0x7A, 0x03, 0x0E,
  0x79, 0x01, 0x11, 0x73, 0x01, 0x0A, 0x43, 0x03, 0x08, 0x41,
  0x03, 0x02, 0x2B, 0x02, 0x09, 0x31, 0x03, 0x0C, 0x36, 0x03,
  0x00, 0x6A, 0x02, 0x12, 0x47, 0x03, 0x00, 0x51, 0x01, 0x04,
  0x36, 0x03, 0x06, 0x71, 0x02, 0x05, 0x2A, 0x03, 0x0D, 0x1A,
  0x01, 0x05, 0x49, 0x03, 0x00, 0x1A, 0x02, 0x04, 0x5C, 0x03,
  0x09, 0x72, 0x01, 0x11, 0x1C, 0x02, 0x0F, 0x37, 0x01, 0x0A,
  0x41, 0x02, 0x06, 0x6E, 0x03, 0x14, 0x77, 0x01, 0x13, 0x35,
  0x03, 0x0C, 0x6C, 0x03, 0x12, 0x21, 0x01, 0x0B, 0x6B, 0x01,
  0x15, 0x4E, 0x02, 0x15, 0x6E, 0x01, 0x14, 0x0A, 0x02, 0x0B,
  0x65, 0x03, 0x16, 0x78, 0x02, 0x0E, 0x2C, 0x02, 0x16, 0x43,
  0x03, 0x14, 0x4B, 0x03, 0x0C, 0x7A, 0x01, 0x16, 0x10, 0x03,
  0x01, 0x45, 0x02, 0x0F, 0x67, 0x03, 0x16, 0x59, 0x01, 0x08,
  0x1E, 0x01, 0x10, 0x76, 0x02, 0x12, 0x00, 0x03, 0x17, 0x6A,
  0x02, 0x10, 0x39, 0x03, 0x0B, 0x51, 0x02, 0x17, 0x2F, 0x03,
  0x04, 0x26, 0x02, 0x17, 0x4B, 0x02, 0x0D, 0x31, 0x01, 0x11,
  0x43, 0x01, 0x05, 0x09, 0x01, 0x14, 0x79, 0x03, 0x0F, 0x01,
  0x02, 0x0C, 0x22, 0x03, 0x0A, 0x0F, 0x02, 0x05, 0x2E, 0x03,
  0x03, 0x72, 0x02, 0x07, 0x20, 0x03, 0x16, 0x18, 0x02, 0x0A,
  0x40, 0x03, 0x04, 0x2C, 0x03, 0x03, 0x7F, 0x03, 0x0F, 0x4E,
  0x03, 0x08, 0x63, 0x02, 0x12, 0x2D, 0x01, 0x02, 0x50, 0x02,
  0x00, 0x59, 0x03, 0x13, 0x0C, 0x02, 0x00, 0x5A, 0x02, 0x0E,
  0x78, 0x03, 0x12, 0x27, 0x01, 0x10, 0x28, 0x03, 0x05, 0x68,
  0x02, 0x12, 0x1D, 0x01, 0x04, 0x2B, 0x01, 0x10, 0x2B, 0x02,
  0x02, 0x7A, 0x03, 0x13, 0x76, 0x03, 0x06, 0x68, 0x03, 0x0C,
  0x35, 0x03, 0x10, 0x6C, 0x03, 0x0A, 0x7F, 0x02, 0x05, 0x47,
  0x01, 0x10, 0x77, 0x02, 0x13, 0x34, 0x01, 0x05, 0x67, 0x01,
  0x15, 0x1E, 0x01, 0x0C, 0x60, 0x03, 0x02, 0x1A, 0x02, 0x01,
  0x15, 0x03, 0x13, 0x64, 0x03, 0x08, 0x28, 0x01, 0x0B, 0x58,
  0x02, 0x08, 0x59, 0x01, 0x13, 0x39, 0x01, 0x0D, 0x27, 0x01,
  0x05, 0x60, 0x01, 0x17, 0x15, 0x01, 0x13, 0x19, 0x02, 0x11,
  0x2C, 0x01, 0x02, 0x3D, 0x03, 0x07, 0x20, 0x03, 0x15, 0x4C,
  0x02, 0x0B, 0x26, 0x02, 0x00, 0x20, 0x03, 0x02, 0x44, 0x03,
  0x0D, 0x18, 0x02, 0x11, 0x51, 0x03, 0x12, 0x34, 0x01, 0x17,
  0x68, 0x03, 0x04, 0x11, 0x03, 0x01, 0x73, 0x03, 0x0D, 0x6A,
  0x01, 0x0C, 0x1E, 0x02, 0x08, 0x0A, 0x01, 0x02, 0x31, 0x01,
  0x13, 0x62, 0x03, 0x0F, 0x0A, 0x02, 0x17, 0x23, 0x02, 0x0C,
  0x25, 0x02, 0x13, 0x32, 0x03, 0x0E, 0x2B, 0x01, 0x17, 0x48,
  0x03, 0x11, 0x73, 0x01, 0x12, 0x04, 0x01, 0x03, 0x31, 0x02,
  0x10, 0x33, 0x01, 0x17, 0x1A, 0x03, 0x0C, 0x11, 0x03, 0x05,
  0x18, 0x02, 0x09, 0x44, 0x02, 0x05, 0x3B, 0x01, 0x04, 0x52,
  0x02, 0x16, 0x48, 0x03, 0x0F, 0x06, 0x02, 0x0A, 0x0C, 0x01,
  0x09, 0x1D, 0x03, 0x06, 0x7F, 0x01, 0x15, 0x0D, 0x02, 0x17,
  0x26, 0x02, 0x10, 0x7B, 0x02, 0x15, 0x11, 0x02, 0x10, 0x5E,
  0x01, 0x08, 0x06, 0x03, 0x03, 0x3F, 0x03, 0x05, 0x4B, 0x03,
  0x0B, 0x7A, 0x01, 0x0D, 0x2C, 0x01, 0x02, 0x49, 0x02, 0x04,
  0x4A, 0x02, 0x15, 0x39, 0x01, 0x06, 0x46, 0x03, 0x00, 0x15,
  0x01, 0x15, 0x57, 0x03, 0x0C, 0x2C, 0x02, 0x07, 0x22, 0x01,
  0x17, 0x55, 0x01, 0x0A, 0x44, 0x01, 0x13, 0x54, 0x03, 0x11,
  0x5B, 0x01, 0x01, 0x1E, 0x01, 0x13, 0x11, 0x01, 0x0C, 0x4B,
  0x01, 0x08, 0x6B, 0x01, 0x10, 0x0F, 0x02, 0x00, 0x79, 0x01,
  0x08, 0x4F, 0x02, 0x15, 0x43, 0x02, 0x13, 0x20, 0x01, 0x15,
  0x7F, 0x02, 0x05, 0x7E, 0x03, 0x11, 0x37, 0x03, 0x13, 0x3C,
  0x03, 0x11, 0x1B, 0x02, 0x14, 0x28, 0x02, 0x17, 0x06, 0x03,
  0x09, 0x77, 0x03, 0x01, 0x19, 0x02, 0x02, 0x10, 0x03, 0x11,
  0x3B, 0x01, 0x15, 0x49, 0x02, 0x10, 0x68, 0x01, 0x17, 0x36,
  0x03, 0x11, 0x08, 0x03, 0x0A, 0x27, 0x03, 0x07, 0x7F, 0x03,
  0x0B, 0x03, 0x02, 0x0D, 0x6B, 0x01, 0x10, 0x44, 0x03, 0x0F,
  0x3E, 0x03, 0x0D, 0x63, 0x01, 0x13, 0x28, 0x02, 0x0C, 0x0D,
  0x02, 0x05, 0x7B, 0x03, 0x0C, 0x67, 0x01, 0x0D, 0x7E, 0x01,
  0x0B, 0x35, 0x02, 0x08, 0x58, 0x01, 0x15, 0x00, 0x01, 0x01,
  0x1C, 0x02, 0x04, 0x57, 0x03, 0x0E, 0x44, 0x03, 0x13, 0x4C,
  0x01, 0x14, 0x30, 0x03, 0x12, 0x36, 0x02, 0x07, 0x3C, 0x01,
  0x0D, 0x51, 0x02, 0x00, 0x32, 0x02, 0x01, 0x4B, 0x01, 0x16,
  0x0F, 0x01, 0x05, 0x5D, 0x01, 0x12, 0x00, 0x02, 0x16, 0x3A,
  0x02, 0x17, 0x6D, 0x01, 0x15, 0x0A, 0x03, 0x03, 0x2B, 0x02,
  0x05, 0x7B, 0x03, 0x09, 0x6D, 0x03, 0x10, 0x7E, 0x03, 0x03,
  0x4B, 0x01, 0x0B, 0x76, 0x03, 0x16, 0x79, 0x02, 0x08, 0x49,
  0x03, 0x12, 0x57, 0x03, 0x0F, 0x05, 0x01, 0x0D, 0x1F, 0x01,
  0x13, 0x10, 0x02, 0x0A, 0x07, 0x02, 0x17, 0x05, 0x02, 0x06,
  0x6B, 0x02, 0x0A, 0x10, 0x02, 0x0D, 0x03, 0x02, 0x14, 0x5A,
  0x02, 0x04, 0x3C, 0x02, 0x14, 0x21, 0x03, 0x09, 0x75, 0x01,
  0x08, 0x03, 0x03, 0x0F, 0x31, 0x02, 0x06, 0x5F, 0x02, 0x10,
  0x63, 0x01, 0x0E, 0x62, 0x02, 0x11, 0x6B, 0x02, 0x08, 0x70,
  0x03, 0x07, 0x02, 0x03, 0x17, 0x52, 0x01, 0x04, 0x31, 0x03,
  0x14, 0x1C, 0x03, 0x00, 0x53, 0x02, 0x05, 0x74, 0x02, 0x00,
  0x6A, 0x02, 0x15, 0x21, 0x03, 0x0A, 0x76, 0x01, 0x00, 0x03,
  0x01, 0x0A, 0x1E, 0x03, 0x10, 0x0F, 0x02, 0x15, 0x11, 0x03,
  0x10, 0x3B, 0x02, 0x06, 0x18, 0x03, 0x0D, 0x21, 0x03, 0x03,
  0x21, 0x03, 0x14, 0x50, 0x03, 0x01, 0x34, 0x02, 0x13, 0x2A,
  0x03, 0x11, 0x06, 0x03, 0x0E, 0x2C, 0x02, 0x0B, 0x2E, 0x01,
  0x09, 0x68, 0x03, 0x0D, 0x63, 0x01, 0x09, 0x59, 0x02, 0x15,
  0x23, 0x03, 0x05, 0x64, 0x02, 0x09, 0x66, 0x02, 0x17, 0x5B,
  0x02, 0x14, 0x65, 0x02, 0x07, 0x07, 0x03, 0x00, 0x57, 0x01,
  0x13, 0x3F, 0x03, 0x0B, 0x01, 0x02, 0x04, 0x79, 0x03, 0x0A,
  0x63, 0x03, 0x03, 0x65, 0x02, 0x03, 0x5D, 0x03, 0x0B, 0x43,
  0x03, 0x0D, 0x06, 0x02, 0x03, 0x6F, 0x03, 0x0A, 0x5A, 0x01,
  0x01, 0x6B, 0x01, 0x10, 0x45, 0x01, 0x0D, 0x1C, 0x02, 0x01,
  0x45, 0x03, 0x04, 0x10, 0x01, 0x03, 0x56, 0x02, 0x01, 0x1D,
  0x02, 0x16, 0x41, 0x01, 0x15, 0x6E, 0x01, 0x0E, 0x1F, 0x03,
  0x10, 0x4D, 0x02, 0x0D, 0x19, 0x01, 0x0D, 0x43, 0x03, 0x0A,
  0x7F, 0x03, 0x14, 0x26, 0x01, 0x0B, 0x5F, 0x01, 0x06, 0x7A,
  0x03, 0x17, 0x27, 0x03, 0x17, 0x62, 0x01, 0x00, 0x3F, 0x02,
  0x00, 0x75, 0x03, 0x10, 0x27, 0x02, 0x10, 0x16, 0x01, 0x0D,
  0x54, 0x01, 0x17, 0x71, 0x02, 0x0C, 0x0E, 0x01, 0x13, 0x09,
  0x01, 0x05, 0x49, 0x03, 0x15, 0x3D, 0x02, 0x0F, 0x51, 0x02,
  0x02, 0x40, 0x02, 0x15, 0x65, 0x01, 0x0F, 0x3D, 0x02, 0x0D,
  0x5B, 0x03, 0x13, 0x31, 0x02, 0x15, 0x1C, 0x02, 0x15, 0x50,
  0x01, 0x04, 0x7E, 0x03, 0x11, 0x05, 0x03, 0x05, 0x1B, 0x01,
  0x06, 0x5C, 0x02, 0x15, 0x5C, 0x02, 0x12, 0x79, 0x01, 0x04,
  0x6D, 0x03, 0x0F, 0x5D, 0x03, 0x08, 0x01, 0x02, 0x05, 0x76,
  0x03, 0x0E, 0x5E, 0x01, 0x0A, 0x74, 0x03, 0x07, 0x42, 0x01,
  0x16, 0x37, 0x02, 0x03, 0x28, 0x03, 0x11, 0x30, 0x01, 0x13,
  0x1F, 0x02, 0x0A, 0x4B, 0x03, 0x0F, 0x56, 0x03, 0x0B, 0x0D,
  0x02, 0x11, 0x6B, 0x03, 0x05, 0x10, 0x03, 0x02, 0x24, 0x02,
  0x10, 0x3B, 0x03, 0x00, 0x39, 0x03, 0x03, 0x70, 0x02, 0x0D,
  0x08, 0x03, 0x15, 0x32, 0x02, 0x17, 0x1B, 0x02, 0x01, 0x47,
  0x01, 0x01, 0x53, 0x02, 0x17, 0x30, 0x02, 0x03, 0x5C, 0x03,
  0x0A, 0x50, 0x01, 0x0B, 0x23, 0x03, 0x0D, 0x44, 0x03, 0x14,
  0x00, 0x01, 0x17, 0x20, 0x03, 0x0B, 0x5C, 0x03, 0x0F, 0x01,
  0x03, 0x03, 0x1C, 0x03, 0x07, 0x47, 0x03, 0x00, 0x5C, 0x02,
  0x0F, 0x76, 0x03, 0x16, 0x2D, 0x02, 0x14, 0x39, 0x03, 0x07,
  0x74, 0x02, 0x15, 0x55, 0x02, 0x0D, 0x03, 0x02, 0x0A, 0x1C,
  0x02, 0x00, 0x27, 0x01, 0x0A, 0x19, 0x02, 0x0C, 0x49, 0x01,
  0x09, 0x06, 0x02, 0x08, 0x2F, 0x03, 0x14, 0x5F, 0x02, 0x11,
  0x59, 0x02, 0x17, 0x1E, 0x02, 0x13, 0x04, 0x02, 0x12, 0x27,
  0x03, 0x16, 0x4D, 0x01, 0x07, 0x07, 0x02, 0x07, 0x4D, 0x01,
  0x08, 0x2D, 0x03, 0x0F, 0x75, 0x01, 0x00, 0x3E, 0x02, 0x07,
  0x70, 0x01, 0x06, 0x1B, 0x02, 0x0A, 0x17, 0x03, 0x15, 0x04,
  0x03, 0x05, 0x5A, 0x03, 0x00, 0x37, 0x02, 0x14, 0x1B, 0x02,
  0x04, 0x1F, 0x01, 0x0C, 0x5A, 0x03, 0x17, 0x4F, 0x02, 0x02,
  0x3C, 0x03, 0x0E, 0x50, 0x01, 0x0B, 0x18, 0x01, 0x0A, 0x3E,
  0x01, 0x0B, 0x62, 0x01, 0x00, 0x37, 0x01, 0x0D, 0x7E, 0x03,
  0x0B, 0x61, 0x03, 0x02, 0x2B, 0x03, 0x03, 0x59, 0x03, 0x01,
  0x61, 0x02, 0x04, 0x44, 0x03, 0x12, 0x17, 0x02, 0x10, 0x1A,
  0x01, 0x02, 0x48, 0x03, 0x08, 0x0D, 0x03, 0x0B, 0x73, 0x02,
  0x00, 0x73, 0x03, 0x05, 0x51, 0x01, 0x10, 0x0D, 0x01, 0x0B,
  0x18, 0x01, 0x00, 0x2B, 0x01, 0x0E, 0x3D, 0x01, 0x14, 0x01,
  0x03, 0x14, 0x3D, 0x03, 0x10, 0x56, 0x02, 0x02, 0x3C, 0x03,
  0x0E, 0x31, 0x01, 0x0E, 0x42, 0x02, 0x08, 0x16, 0x03, 0x13,
  0x2B, 0x03, 0x07, 0x60, 0x01, 0x01, 0x05, 0x02, 0x05, 0x0E,
  0x01, 0x06, 0x48, 0x01, 0x0E, 0x67, 0x02, 0x0F, 0x59, 0x02,
  0x07, 0x12, 0x03, 0x10, 0x68, 0x02, 0x13, 0x69, 0x03, 0x0F,
  0x40, 0x03, 0x16, 0x22, 0x02, 0x17, 0x4D, 0x03, 0x03, 0x0D,
  0x01, 0x0D, 0x6B, 0x03, 0x10, 0x78, 0x01, 0x02, 0x6D, 0x03,
  0x17, 0x4D, 0x02, 0x16, 0x78, 0x02, 0x0D, 0x54, 0x03, 0x05,
  0x1C, 0x03, 0x11, 0x76, 0x02, 0x06, 0x0B, 0x01, 0x0F, 0x6A,
  0x03, 0x04, 0x7E, 0x02, 0x0F, 0x3A, 0x01, 0x00, 0x23, 0x03,
  0x00, 0x64, 0x02, 0x12, 0x78, 0x03, 0x0F, 0x60, 0x03, 0x0F,
  0x1A, 0x03, 0x16, 0x36, 0x01, 0x02, 0x76, 0x02, 0x0F, 0x27,
  0x03, 0x0C, 0x18, 0x01, 0x0D, 0x04, 0x03, 0x17, 0x43, 0x02,
  0x13, 0x2F, 0x01, 0x06, 0x3E, 0x02, 0x00, 0x43, 0x01, 0x0F,
  0x7D, 0x03, 0x0F, 0x45, 0x03, 0x03, 0x11, 0x02, 0x01, 0x5F,
  0x03, 0x01, 0x4F, 0x03, 0x09, 0x67, 0x01, 0x17, 0x08, 0x03,
  0x00, 0x1B, 0x03, 0x02, 0x27, 0x03, 0x17, 0x1B, 0x03, 0x01,
  0x26, 0x03, 0x15, 0x35, 0x02, 0x0D, 0x0E, 0x03, 0x17, 0x4C,
  0x03, 0x04, 0x56, 0x01, 0x04, 0x42, 0x02, 0x11, 0x0C, 0x01,
  0x13, 0x46, 0x03, 0x13, 0x1B, 0x01, 0x08, 0x58, 0x02, 0x10,
  0x3C, 0x02, 0x04, 0x21, 0x02, 0x0C, 0x14, 0x02, 0x10, 0x22,
  0x02, 0x14, 0x1A, 0x01, 0x06, 0x45, 0x02, 0x10, 0x3C, 0x03,
  0x0A, 0x1B, 0x03, 0x04, 0x4B, 0x02, 0x17, 0x59, 0x01, 0x02,
  0x5A, 0x01, 0x09, 0x08, 0x01, 0x01, 0x2A, 0x02, 0x03, 0x03,
  0x02, 0x0E, 0x3D, 0x01, 0x11, 0x41, 0x02, 0x09, 0x39, 0x03,
  0x0F, 0x03, 0x01, 0x16, 0x23, 0x01, 0x0A, 0x28, 0x03, 0x05,
  0x68, 0x03, 0x0F, 0x70, 0x02, 0x03, 0x63, 0x03, 0x08, 0x59,
  0x01, 0x03, 0x1C, 0x01, 0x07, 0x78, 0x03, 0x09, 0x2D, 0x02,
  0x0E, 0x1A, 0x03, 0x03, 0x46, 0x02, 0x0C, 0x21, 0x02, 0x09,
  0x09, 0x03, 0x0E, 0x7B, 0x03, 0x0E, 0x72, 0x03, 0x17, 0x58,
  0x02, 0x11, 0x44, 0x02, 0x13, 0x5F, 0x03, 0x00, 0x7B, 0x03,
  0x0F, 0x3E, 0x02, 0x06, 0x1C, 0x01, 0x0A, 0x2F, 0x01, 0x0A,
  0x13, 0x02, 0x07, 0x5A, 0x02, 0x0B, 0x72, 0x02, 0x11, 0x75,
  0x01, 0x07, 0x76, 0x02, 0x0F, 0x20, 0x03, 0x0E, 0x5F, 0x02,
  0x0F, 0x0F, 0x03, 0x0B, 0x1A, 0x01, 0x08, 0x22, 0x03, 0x05,
  0x4B, 0x02, 0x02, 0x1D, 0x03, 0x09, 0x73, 0x03, 0x09, 0x52,
  0x02, 0x09, 0x16, 0x01, 0x12, 0x3D, 0x01, 0x0B, 0x45, 0x03,
  0x12, 0x03, 0x03, 0x0D, 0x0C, 0x02, 0x09, 0x66, 0x03, 0x0D,
  0x73, 0x02, 0x14, 0x30, 0x02, 0x0C, 0x37, 0x03, 0x01, 0x64,
  0x02, 0x12, 0x52, 0x01, 0x14, 0x6E, 0x01, 0x00, 0x15, 0x03,
  0x13, 0x12, 0x03, 0x12, 0x0E, 0x02, 0x10, 0x79, 0x01, 0x0D,
  0x75, 0x03, 0x09, 0x4B, 0x01, 0x16, 0x4D, 0x02, 0x0A, 0x03,
  0x02, 0x03, 0x2B, 0x02, 0x16, 0x52, 0x01, 0x05, 0x00, 0x03,
  0x09, 0x0C, 0x01, 0x01, 0x4B, 0x03, 0x11, 0x06, 0x01, 0x17,
  0x3E, 0x02, 0x14, 0x3B, 0x01, 0x08, 0x43, 0x02, 0x0F, 0x42,
  0x03, 0x0F, 0x6E, 0x01, 0x0A, 0x4A, 0x02, 0x17, 0x09, 0x03,
  0x12, 0x79, 0x03, 0x12, 0x74, 0x01, 0x12, 0x5D, 0x01, 0x15,
  0x3C, 0x03, 0x15, 0x7F, 0x01, 0x0C, 0x16, 0x03, 0x05, 0x79,
  0x02, 0x0A, 0x29, 0x02, 0x15, 0x38, 0x02, 0x0F, 0x71, 0x02,
  0x0A, 0x63, 0x01, 0x17, 0x1C, 0x01, 0x06, 0x15, 0x02, 0x02,
  0x23, 0x02, 0x04, 0x61, 0x03, 0x00, 0x76, 0x01, 0x10, 0x22,
  0x03, 0x04, 0x43, 0x02, 0x02, 0x6A, 0x01, 0x15, 0x5E, 0x03,
  0x11, 0x20, 0x01, 0x0B, 0x58, 0x03, 0x14, 0x31, 0x01, 0x10,
  0x4C, 0x03, 0x0E, 0x76, 0x02, 0x0F, 0x35, 0x01, 0x13, 0x06,
  0x02, 0x11, 0x32, 0x03, 0x04, 0x74, 0x02, 0x0C, 0x74, 0x01,
  0x08, 0x7C, 0x03, 0x05, 0x6A, 0x01, 0x08, 0x5B, 0x03, 0x05,
  0x4D, 0x03, 0x01, 0x24, 0x01, 0x11, 0x07, 0x02, 0x11, 0x00,
  0x03, 0x01, 0x7B, 0x02, 0x01, 0x2C, 0x01, 0x02, 0x17, 0x01,
  0x13, 0x5E, 0x02, 0x14, 0x5F, 0x02, 0x06, 0x20, 0x01, 0x08,
  0x69, 0x02, 0x09, 0x4C, 0x02, 0x07, 0x20, 0x03, 0x11, 0x73,
  0x02, 0x02, 0x6E, 0x02, 0x17, 0x1C, 0x01, 0x13, 0x7C, 0x01,
  0x01, 0x13, 0x02, 0x10, 0x6F, 0x01, 0x14, 0x0C, 0x01, 0x07,
  0x57, 0x01, 0x01, 0x0C, 0x01, 0x0E, 0x03, 0x02, 0x0A, 0x22,
  0x02, 0x0E, 0x39, 0x01, 0x0E, 0x29, 0x01, 0x06, 0x0A, 0x01,
  0x0B, 0x43, 0x02, 0x0B, 0x65, 0x03, 0x0B, 0x1F, 0x02, 0x0B,
  0x44, 0x02, 0x01, 0x7F, 0x03, 0x0B, 0x60, 0x02, 0x12, 0x22,
  0x01, 0x09, 0x76, 0x03, 0x0B, 0x3C, 0x03, 0x0E, 0x77, 0x01,
  0x05, 0x6E, 0x01, 0x11, 0x2F, 0x01, 0x08, 0x5C, 0x03, 0x00,
  0x1B, 0x02, 0x0B, 0x0E, 0x01, 0x0C, 0x0F, 0x02, 0x0D, 0x56,
  0x02, 0x15, 0x7C, 0x02, 0x0D, 0x13, 0x03, 0x13, 0x54, 0x01,
  0x05, 0x51, 0x03, 0x01, 0x3C, 0x02, 0x16, 0x75, 0x01, 0x16,
  0x6D, 0x01, 0x15, 0x12, 0x03, 0x0F, 0x14, 0x01, 0x0E, 0x69,
  0x03, 0x04, 0x31, 0x03, 0x09, 0x62, 0x01, 0x0B, 0x6D, 0x02,
  0x11, 0x22, 0x02, 0x14, 0x10, 0x02, 0x0D, 0x60, 0x01, 0x12,
  0x1F, 0x03, 0x09, 0x6B, 0x02, 0x10, 0x3C, 0x02, 0x12, 0x1B,
  0x01, 0x06, 0x33, 0x02, 0x03, 0x3A, 0x02, 0x01, 0x2C, 0x02,
  0x15, 0x3C, 0x01, 0x06, 0x6F, 0x03, 0x17, 0x10, 0x01, 0x03,
  0x71, 0x01, 0x04, 0x3B, 0x03, 0x15, 0x74, 0x01, 0x16, 0x62,
  0x03, 0x02, 0x74, 0x01, 0x10, 0x54, 0x01, 0x12, 0x13, 0x02,
  0x0C, 0x3E, 0x01, 0x15, 0x6C, 0x02, 0x0C, 0x10, 0x02, 0x01,
  0x6D, 0x03, 0x05, 0x2C, 0x02, 0x16, 0x66, 0x02, 0x13, 0x7F,
  0x01, 0x0C, 0x5C, 0x01, 0x09, 0x54, 0x01, 0x06, 0x22, 0x03,
  0x13, 0x55, 0x02, 0x09, 0x4A, 0x01, 0x0D, 0x5E, 0x03, 0x12,
  0x59, 0x01, 0x05, 0x00, 0x02, 0x0B, 0x3A, 0x01, 0x0F, 0x3D,
  0x02, 0x10, 0x44, 0x01, 0x0E, 0x65, 0x01, 0x08, 0x73, 0x01,
  0x05, 0x55, 0x01, 0x05, 0x17, 0x01, 0x14, 0x6E, 0x01, 0x08,
  0x17, 0x03, 0x17, 0x3D, 0x01, 0x04, 0x39, 0x02, 0x02, 0x79,
  0x03, 0x10, 0x18, 0x02, 0x0F, 0x1D, 0x01, 0x02, 0x26, 0x03,
  0x14, 0x11, 0x02, 0x0B, 0x31, 0x03, 0x09, 0x34, 0x02, 0x01,
  0x61, 0x03, 0x0F, 0x13, 0x03, 0x08, 0x69, 0x01, 0x0E, 0x45,
  0x01, 0x0F, 0x1E, 0x03, 0x0D, 0x37, 0x03, 0x0D, 0x42, 0x02,
  0x17, 0x1F, 0x01, 0x01, 0x00, 0x01, 0x17, 0x1D, 0x03, 0x0A,
  0x3D, 0x02, 0x06, 0x68, 0x02, 0x13, 0x43, 0x03, 0x13, 0x57,
  0x02, 0x05, 0x7D, 0x03, 0x05, 0x33, 0x01, 0x0C, 0x53, 0x01,
  0x0A, 0x64, 0x03, 0x05, 0x0E, 0x02, 0x03, 0x7E, 0x03, 0x00,
  0x4D, 0x02, 0x06, 0x40, 0x01, 0x13, 0x04, 0x03, 0x11, 0x7A,
  0x02, 0x0D, 0x38, 0x03, 0x0E, 0x38, 0x03, 0x15, 0x63, 0x02,
  0x0B, 0x58, 0x02, 0x08, 0x09, 0x01, 0x02, 0x0A, 0x03, 0x0B,
  0x11, 0x02, 0x07, 0x78, 0x02, 0x05, 0x3B, 0x03, 0x0B, 0x63,
  0x03, 0x11, 0x51, 0x01, 0x15, 0x4F, 0x03, 0x00, 0x3B, 0x01,
  0x0E, 0x4C, 0x01, 0x17, 0x49, 0x01, 0x05, 0x5A, 0x02, 0x05,
  0x27, 0x03, 0x00, 0x08, 0x01, 0x02, 0x0B, 0x03, 0x13, 0x52,
  0x03, 0x11, 0x7D, 0x01, 0x16, 0x0F, 0x03, 0x0C, 0x37, 0x03,
  0x0A, 0x76, 0x02, 0x16, 0x7C, 0x01, 0x0C, 0x30, 0x02, 0x11,
  0x16, 0x02, 0x06, 0x60, 0x01, 0x09, 0x6F, 0x03, 0x11, 0x66,
  0x01, 0x02, 0x0E, 0x01, 0x15, 0x53, 0x03, 0x11, 0x0A, 0x02,
  0x16, 0x53, 0x01, 0x00, 0x49, 0x02, 0x14, 0x28, 0x01, 0x0B,
  0x77, 0x01, 0x0E, 0x37, 0x01, 0x17, 0x2C, 0x03, 0x07, 0x08,
  0x02, 0x0E, 0x0D, 0x03, 0x15, 0x62, 0x02, 0x07, 0x20, 0x02,
  0x0F, 0x59, 0x01, 0x0F, 0x09, 0x01, 0x0D, 0x6E, 0x02, 0x0D,
  0x4D, 0x02, 0x0C, 0x21, 0x02, 0x0C, 0x28, 0x03, 0x14, 0x1D,
  0x01, 0x07, 0x01, 0x01, 0x07, 0x4C, 0x01, 0x07, 0x24, 0x03,
  0x03, 0x61, 0x03, 0x0E, 0x68, 0x03, 0x02, 0x0B, 0x02, 0x01,
  0x2F, 0x03, 0x07, 0x14, 0x02, 0x05, 0x08, 0x03, 0x15, 0x6A,
  0x02, 0x11, 0x20, 0x03, 0x0A, 0x19, 0x01, 0x08, 0x32, 0x02,
  0x0B, 0x37, 0x01, 0x08, 0x4A, 0x03, 0x08, 0x7D, 0x03, 0x02,
  0x41, 0x02, 0x02, 0x09, 0x03, 0x11, 0x4E, 0x02, 0x0D, 0x2C,
  0x01, 0x06, 0x35, 0x03, 0x16, 0x67, 0x02, 0x11, 0x3C, 0x03,
  0x13, 0x71, 0x03, 0x10, 0x5F, 0x02, 0x07, 0x20, 0x01, 0x02,
  0x6A, 0x01, 0x0A, 0x3D, 0x02, 0x16, 0x10, 0x02, 0x0C, 0x30,
  0x02, 0x0E, 0x76, 0x02, 0x14, 0x7A, 0x01, 0x0B, 0x49, 0x02,
  0x09, 0x5E, 0x03, 0x09, 0x4D, 0x02, 0x17, 0x4E, 0x02, 0x02,
  0x64, 0x01, 0x14, 0x53, 0x01, 0x05, 0x29, 0x02, 0x05, 0x0D,
  0x01, 0x07, 0x49, 0x03, 0x03, 0x51, 0x02, 0x00, 0x5D, 0x02,
  0x17, 0x3B, 0x03, 0x17, 0x66, 0x01, 0x03, 0x36, 0x01, 0x14,
  0x1D, 0x03, 0x12, 0x64, 0x01, 0x13, 0x3E, 0x02, 0x09, 0x40,
  0x01, 0x12, 0x3F, 0x02, 0x0A, 0x15, 0x03, 0x12, 0x76, 0x02,
  0x04, 0x6F, 0x03, 0x03, 0x1C, 0x02, 0x0F, 0x06, 0x01, 0x00,
  0x7F, 0x01, 0x0B, 0x34, 0x01, 0x04, 0x5B, 0x01, 0x10, 0x28,
  0x02, 0x12, 0x7F, 0x03, 0x13, 0x79, 0x01, 0x14, 0x2E, 0x03,
  0x03, 0x79, 0x01, 0x07, 0x15, 0x02, 0x05, 0x04, 0x02, 0x0E,
  0x3C, 0x01, 0x0D, 0x71, 0x03, 0x02, 0x07, 0x03, 0x14, 0x53,
  0x02, 0x07, 0x6B, 0x02, 0x11, 0x1A, 0x03, 0x02, 0x43, 0x03,
  0x02, 0x40, 0x03, 0x15, 0x57, 0x02, 0x15, 0x1D, 0x01, 0x09,
  0x0B, 0x02, 0x08, 0x5C, 0x03, 0x0E, 0x6A, 0x03, 0x06, 0x4B,
  0x02, 0x12, 0x66, 0x01, 0x10, 0x22, 0x01, 0x11, 0x0A, 0x02,
  0x0A, 0x4B, 0x03, 0x14, 0x44, 0x02, 0x09, 0x27, 0x01, 0x08,
  0x65, 0x02, 0x13, 0x18, 0x02, 0x06, 0x67, 0x03, 0x0E, 0x4A,
  0x03, 0x01, 0x7F, 0x02, 0x05, 0x56, 0x02, 0x03, 0x5B, 0x01,
  0x02, 0x40, 0x03, 0x03, 0x0E, 0x01, 0x14, 0x78, 0x02, 0x05,
  0x05, 0x02, 0x04, 0x1A, 0x01, 0x0F, 0x44, 0x01, 0x06, 0x3F,
  0x01, 0x0F, 0x79, 0x02, 0x0A, 0x63, 0x01, 0x08, 0x5C, 0x01,
  0x11, 0x60, 0x03, 0x0E, 0x1F, 0x01, 0x0B, 0x06, 0x02, 0x0B,
  0x11, 0x02, 0x09, 0x72, 0x02, 0x0F, 0x53, 0x01, 0x04, 0x52,
  0x01, 0x10, 0x31, 0x03, 0x0A, 0x1B, 0x02, 0x0D, 0x1B, 0x02,
  0x03, 0x79, 0x03, 0x0C, 0x25, 0x03, 0x17, 0x29, 0x03, 0x0D,
  0x61, 0x02, 0x08, 0x2E, 0x02, 0x0A, 0x7F, 0x03, 0x17, 0x5D,
  0x01, 0x03, 0x34, 0x02, 0x02, 0x59, 0x03, 0x0A, 0x5F, 0x01,
  0x00, 0x44, 0x03, 0x02, 0x27, 0x03, 0x09, 0x48, 0x01, 0x00,
  0x2F, 0x03, 0x16, 0x0E, 0x02, 0x03, 0x66, 0x03, 0x0F, 0x0B,
  0x02, 0x17, 0x73, 0x02, 0x10, 0x30, 0x01, 0x0E, 0x4E, 0x01,
  0x13, 0x4C, 0x02, 0x06, 0x2B, 0x03, 0x0A, 0x4F, 0x02, 0x03,
  0x21, 0x03, 0x12, 0x35, 0x02, 0x00, 0x2E, 0x01, 0x03, 0x2C,
  0x01, 0x15, 0x72, 0x02, 0x08, 0x55, 0x02, 0x14, 0x04, 0x01,
  0x16, 0x04, 0x01, 0x07, 0x17, 0x02, 0x10, 0x42, 0x02, 0x0A,
  0x73, 0x02, 0x0D, 0x36, 0x03, 0x12, 0x2A, 0x02, 0x01, 0x49,
  0x01, 0x13, 0x06, 0x03, 0x11, 0x13, 0x03, 0x01, 0x55, 0x03,
  0x09, 0x4A, 0x01, 0x09, 0x2B, 0x02, 0x05, 0x4B, 0x03, 0x0F,
  0x07, 0x03, 0x0F, 0x73, 0x01, 0x09, 0x47, 0x01, 0x00, 0x42,
  0x03, 0x11, 0x11, 0x02, 0x17, 0x51, 0x02, 0x16, 0x24, 0x02,
  0x0B, 0x40, 0x01, 0x14, 0x6B, 0x02, 0x05, 0x3C, 0x01, 0x02,
  0x60, 0x03, 0x01, 0x2D, 0x03, 0x09, 0x3F, 0x03, 0x17, 0x32,
  0x01, 0x07, 0x73, 0x03, 0x0A, 0x12, 0x01, 0x01, 0x41, 0x01,
  0x01, 0x4F, 0x01, 0x0C, 0x3A, 0x03, 0x16, 0x22, 0x02, 0x05,
  0x6C, 0x02, 0x02, 0x6F, 0x03, 0x0A, 0x5F, 0x02, 0x0A, 0x37,
  0x02, 0x03, 0x40, 0x02, 0x0C, 0x1A, 0x02, 0x0D, 0x5B, 0x03,
  0x03, 0x4B, 0x02, 0x01, 0x15, 0x03, 0x17, 0x4D, 0x01, 0x07,
  0x09, 0x01, 0x11, 0x42, 0x03, 0x11, 0x0B, 0x02, 0x15, 0x2D,
  0x01, 0x01, 0x4F, 0x03, 0x03, 0x25, 0x03, 0x05, 0x71, 0x02,
  0x0C, 0x1E, 0x02, 0x0F, 0x4E, 0x02, 0x0C, 0x76, 0x03, 0x02,
  0x24, 0x03, 0x09, 0x41, 0x03, 0x08, 0x34, 0x02, 0x0A, 0x58,
  0x01, 0x11, 0x02, 0x02, 0x0B, 0x6E, 0x01, 0x07, 0x77, 0x01,
  0x01, 0x58, 0x03, 0x15, 0x12, 0x02, 0x12, 0x55, 0x01, 0x0A,
  0x44, 0x01, 0x17, 0x44, 0x03, 0x03, 0x71, 0x01, 0x0C, 0x6F,
  0x03, 0x03, 0x33, 0x01, 0x07, 0x67, 0x02, 0x06, 0x70, 0x02,
  0x05, 0x47, 0x01, 0x12, 0x0F, 0x01, 0x13, 0x12, 0x03, 0x0D,
  0x16, 0x03, 0x0E, 0x7A, 0x01, 0x11, 0x0C, 0x01, 0x02, 0x59,
  0x01, 0x01, 0x39, 0x03, 0x13, 0x61, 0x03, 0x08, 0x07, 0x02,
  0x13, 0x45, 0x03, 0x09, 0x47, 0x02, 0x03, 0x15, 0x03, 0x0D,
  0x19, 0x02, 0x0E, 0x2C, 0x01, 0x03, 0x12, 0x03, 0x09, 0x16,
  0x03, 0x09, 0x6F, 0x02, 0x14, 0x3A, 0x02, 0x10, 0x63, 0x03,
  0x07, 0x51, 0x02, 0x17, 0x7E, 0x03, 0x11, 0x57, 0x02, 0x02,
  0x50, 0x03, 0x02, 0x28, 0x03, 0x10, 0x68, 0x03, 0x03, 0x02,
  0x02, 0x0C, 0x66, 0x03, 0x14, 0x22, 0x01, 0x12, 0x4D, 0x01,
  0x0A, 0x62, 0x01, 0x14, 0x69, 0x03, 0x03, 0x7B, 0x02, 0x02,
  0x23, 0x03, 0x0D, 0x73, 0x02, 0x15, 0x2B, 0x01, 0x0C, 0x3F,
  0x03, 0x14, 0x68, 0x02, 0x14, 0x19, 0x03, 0x12, 0x72, 0x01,
  0x13, 0x15, 0x03, 0x0B, 0x38, 0x02, 0x09, 0x32, 0x01, 0x11,
  0x1C, 0x02, 0x08, 0x2C, 0x03, 0x17, 0x5A, 0x02, 0x09, 0x4E,
  0x03, 0x06, 0x16, 0x02, 0x10, 0x68, 0x03, 0x05, 0x28, 0x03,
  0x0B, 0x74, 0x02, 0x15, 0x4A, 0x01, 0x14, 0x16, 0x02, 0x14,
  0x2F, 0x02, 0x06, 0x61, 0x01, 0x09, 0x45, 0x03, 0x05, 0x2B,
  0x01, 0x02, 0x76, 0x02, 0x11, 0x78, 0x02, 0x0D, 0x08, 0x03,
  0x10, 0x3F, 0x03, 0x02, 0x01, 0x03, 0x0B, 0x2E, 0x01, 0x12,
  0x66, 0x02, 0x01, 0x50, 0x02, 0x08, 0x6B, 0x01, 0x01, 0x1C,
  0x02, 0x15, 0x31, 0x03, 0x09, 0x0A, 0x01, 0x09, 0x22, 0x01,
  0x10, 0x2C, 0x03, 0x14, 0x4A, 0x01, 0x11, 0x5D, 0x02, 0x17,
  0x4F, 0x01, 0x12, 0x05, 0x03, 0x0A, 0x14, 0x03, 0x02, 0x22,
  0x01, 0x16, 0x4E, 0x02, 0x12, 0x65, 0x03, 0x06, 0x48, 0x03,
  0x06, 0x14, 0x01, 0x0F, 0x6D, 0x01, 0x0F, 0x08, 0x01, 0x16,
  0x0E, 0x03, 0x10, 0x07, 0x01, 0x12, 0x75, 0x02, 0x14, 0x03,
  0x01, 0x10, 0x39, 0x02, 0x01, 0x42, 0x02, 0x0A, 0x6F, 0x02,
  0x0B, 0x1E, 0x03, 0x00, 0x3B, 0x01, 0x10, 0x2A, 0x01, 0x15,
  0x1E, 0x03, 0x0F, 0x71, 0x03, 0x15, 0x52, 0x01, 0x14, 0x07,
  0x02, 0x0A, 0x3D, 0x02, 0x06, 0x61, 0x02, 0x06, 0x21, 0x03,
  0x06, 0x79, 0x03, 0x0A, 0x29, 0x01, 0x07, 0x52, 0x02, 0x09,
  0x43, 0x01, 0x11, 0x5E, 0x03, 0x0F, 0x19, 0x03, 0x13, 0x60,
  0x02, 0x03, 0x67, 0x02, 0x00, 0x15, 0x02, 0x06, 0x0B, 0x01,
  0x0E, 0x05, 0x03, 0x15, 0x61, 0x01, 0x01, 0x21, 0x01, 0x13,
  0x23, 0x01, 0x05, 0x18, 0x03, 0x00, 0x3C, 0x03, 0x03, 0x77,
  0x01, 0x0A, 0x35, 0x02, 0x16, 0x6D, 0x03, 0x10, 0x0E, 0x02,
  0x03, 0x32, 0x02, 0x04, 0x62, 0x03, 0x09, 0x1F, 0x03, 0x16,
  0x7D, 0x01, 0x10, 0x74, 0x01, 0x01, 0x5D, 0x03, 0x0D, 0x62,
  0x01, 0x0A, 0x30, 0x02, 0x0C, 0x3C, 0x01, 0x17, 0x7A, 0x02,
  0x02, 0x4F, 0x02, 0x0A, 0x25, 0x01, 0x00, 0x4F, 0x02, 0x09,
  0x27, 0x02, 0x10, 0x5C, 0x02, 0x09, 0x54, 0x03, 0x03, 0x62,
  0x01, 0x15, 0x30, 0x02, 0x0C, 0x74, 0x02, 0x01, 0x11, 0x02,
  0x14, 0x6E, 0x02, 0x06, 0x39, 0x03, 0x08, 0x63, 0x03, 0x03,
  0x41, 0x02, 0x00, 0x78, 0x02, 0x06, 0x0D, 0x03, 0x15, 0x00,
  0x01, 0x0F, 0x0F, 0x01, 0x01, 0x44, 0x03, 0x0E, 0x41, 0x03,
  0x06, 0x1B, 0x02, 0x10, 0x5E, 0x01, 0x14, 0x29, 0x02, 0x14,
  0x2B, 0x02, 0x11, 0x16, 0x03, 0x0D, 0x6E, 0x02, 0x10, 0x0C,
  0x02, 0x0F, 0x0D, 0x01, 0x0E, 0x36, 0x03, 0x15, 0x19, 0x03,
  0x00, 0x28, 0x01, 0x04, 0x02, 0x02, 0x16, 0x35, 0x02, 0x05,
  0x30, 0x02, 0x05, 0x0E, 0x02, 0x04, 0x30, 0x01, 0x04, 0x00,
  0x03, 0x04, 0x5D, 0x01, 0x02, 0x72, 0x02, 0x0A, 0x0C, 0x03,
  0x06, 0x0E, 0x03, 0x06, 0x57, 0x02, 0x03, 0x0A, 0x02, 0x01,
  0x43, 0x02, 0x12, 0x20, 0x02, 0x10, 0x5F, 0x02, 0x10, 0x7F,
  0x02, 0x0A, 0x05, 0x03, 0x07, 0x5A, 0x01, 0x0D, 0x0A, 0x01,
  0x14, 0x73, 0x03, 0x00, 0x24, 0x01, 0x14, 0x11, 0x01, 0x06,
  0x63, 0x02, 0x11, 0x43, 0x02, 0x14, 0x4A, 0x02, 0x0E, 0x5C,
  0x03, 0x16, 0x05, 0x02, 0x0C, 0x06, 0x03, 0x10, 0x0D, 0x03,
  0x17, 0x35, 0x03, 0x10, 0x05, 0x01, 0x08, 0x2B, 0x01, 0x0C,
  0x47, 0x03, 0x06, 0x24, 0x03, 0x05, 0x2E, 0x02, 0x02, 0x6B,
  0x02, 0x0A, 0x2C, 0x01, 0x03, 0x6D, 0x02, 0x10, 0x7B, 0x03,
  0x04, 0x75, 0x01, 0x02, 0x5B, 0x01, 0x14, 0x68, 0x01, 0x0B,
  0x40, 0x01, 0x08, 0x5C, 0x01, 0x14, 0x54, 0x02, 0x0C, 0x03,
  0x02, 0x0E, 0x75, 0x03, 0x02, 0x2D, 0x03, 0x04, 0x11, 0x03,
  0x0F, 0x70, 0x03, 0x0F, 0x02, 0x03, 0x02, 0x16, 0x02, 0x09,
  0x20, 0x03, 0x16, 0x74, 0x01, 0x08, 0x2E, 0x02, 0x0E, 0x55,
  0x03, 0x03, 0x3B, 0x01, 0x04, 0x55, 0x03, 0x06, 0x0C, 0x01,
  0x16, 0x41, 0x03, 0x15, 0x31, 0x01, 0x11, 0x70, 0x01, 0x0D,
  0x47, 0x01, 0x00, 0x0A, 0x02, 0x0F, 0x79, 0x03, 0x16, 0x59,
  0x01, 0x16, 0x76, 0x03, 0x08, 0x5D, 0x03, 0x02, 0x65, 0x03,
  0x03, 0x3E, 0x01, 0x05, 0x52, 0x01, 0x07, 0x08, 0x01, 0x0F,
  0x18, 0x03, 0x0B, 0x65, 0x01, 0x16, 0x2E, 0x01, 0x03, 0x76,
  0x01, 0x0F, 0x10, 0x02, 0x10, 0x59, 0x03, 0x02, 0x77, 0x01,
  0x0C, 0x33, 0x01, 0x0B, 0x70, 0x01, 0x0D, 0x5B, 0x03, 0x12,
  0x6D, 0x02, 0x04, 0x49, 0x03, 0x03, 0x4B, 0x03, 0x0A, 0x0D,
  0x02, 0x01, 0x23, 0x01, 0x17, 0x77, 0x03, 0x0B, 0x1C, 0x02,
  0x01, 0x11, 0x01, 0x0D, 0x46, 0x02, 0x03, 0x4F, 0x03, 0x07,
  0x07, 0x01, 0x09, 0x17, 0x01, 0x14, 0x12, 0x03, 0x04, 0x0F,
  0x02, 0x08, 0x6B, 0x01, 0x12, 0x0F, 0x01, 0x0B, 0x73, 0x03,
  0x06, 0x32, 0x02, 0x0F, 0x04, 0x01, 0x02, 0x39, 0x02, 0x12,
  0x6E, 0x01, 0x0A, 0x5F, 0x02, 0x03, 0x06, 0x02, 0x17, 0x5B,
  0x03, 0x0F, 0x4B, 0x02, 0x08, 0x5D, 0x03, 0x02, 0x5E, 0x02,
  0x0B, 0x15, 0x02, 0x14, 0x60, 0x02, 0x0C, 0x2E, 0x02, 0x09,
  0x28, 0x03, 0x01, 0x0C, 0x01, 0x0D, 0x54, 0x01, 0x00, 0x11,
  0x02, 0x0E, 0x59, 0x03, 0x15, 0x74, 0x03, 0x0E, 0x0F, 0x02,
  0x0B, 0x29, 0x03, 0x05, 0x36, 0x03, 0x14, 0x79, 0x01, 0x01,
  0x24, 0x02, 0x0E, 0x5F, 0x01, 0x11, 0x05, 0x02, 0x0F, 0x21,
  0x03, 0x03, 0x11, 0x01, 0x17, 0x60, 0x01, 0x12, 0x5F, 0x01,
  0x11, 0x4C, 0x03, 0x17, 0x2E, 0x03, 0x01, 0x0F, 0x03, 0x0E,
  0x16, 0x03, 0x06, 0x4A, 0x03, 0x0A, 0x37, 0x02, 0x0C, 0x79,
  0x03, 0x05, 0x5C, 0x02, 0x17, 0x55, 0x03, 0x0C, 0x68, 0x03,
  0x08, 0x37, 0x01, 0x17, 0x37, 0x01, 0x16, 0x30, 0x02, 0x17,
  0x58, 0x02, 0x0B, 0x78, 0x03, 0x0B, 0x2A, 0x02, 0x03, 0x27,
  0x02, 0x0D, 0x38, 0x02, 0x07, 0x50, 0x02, 0x0A, 0x75, 0x02,
  0x11, 0x6E, 0x01, 0x08, 0x4C, 0x03, 0x14, 0x14, 0x03, 0x14,
  0x28, 0x03, 0x03, 0x75, 0x01, 0x17, 0x12, 0x03, 0x09, 0x43,
  0x02, 0x17, 0x2D, 0x01, 0x10, 0x27, 0x02, 0x00, 0x2E, 0x02,
  0x0C, 0x59, 0x02, 0x0D, 0x55, 0x01, 0x04, 0x7F, 0x03, 0x04,
  0x26, 0x03, 0x01, 0x10, 0x02, 0x00, 0x0F, 0x03, 0x0C, 0x4C,
  0x03, 0x00, 0x57, 0x01, 0x0F, 0x1D, 0x01, 0x10, 0x39, 0x03,
  0x05, 0x7D, 0x02, 0x16, 0x0D, 0x02, 0x09, 0x7B, 0x02, 0x08,
  0x55, 0x03, 0x01, 0x0B, 0x02, 0x08, 0x42, 0x03, 0x06, 0x2E,
  0x03, 0x06, 0x6E, 0x03, 0x17, 0x7B, 0x01, 0x10, 0x10, 0x02,
  0x04, 0x03, 0x02, 0x12, 0x0E, 0x03, 0x0A, 0x06, 0x02, 0x15,
  0x16, 0x03, 0x11, 0x2C, 0x02, 0x14, 0x00, 0x02, 0x16, 0x21,
  0x03, 0x12, 0x32, 0x01, 0x03, 0x3E, 0x02, 0x03, 0x50, 0x03,
  0x10, 0x79, 0x01, 0x09, 0x75, 0x03, 0x04, 0x61, 0x03, 0x14,
  0x24, 0x01, 0x0B, 0x3B, 0x01, 0x15, 0x5E, 0x01, 0x02, 0x5B,
  0x01, 0x08, 0x46, 0x01, 0x12, 0x71, 0x01, 0x0E, 0x1A, 0x03,
  0x02, 0x0B, 0x03, 0x12, 0x5E, 0x01, 0x06, 0x5F, 0x01, 0x07,
  0x20, 0x02, 0x0C, 0x2A, 0x01, 0x16, 0x70, 0x03, 0x13, 0x4E,
  0x03, 0x10, 0x4B, 0x03, 0x12, 0x73, 0x01, 0x0F, 0x0D, 0x02,
  0x12, 0x71, 0x03, 0x11, 0x32, 0x01, 0x0C, 0x58, 0x01, 0x05,
  0x78, 0x02, 0x0E, 0x35, 0x01, 0x10, 0x43, 0x03, 0x11, 0x62,
  0x03, 0x08, 0x68, 0x03, 0x17, 0x1A, 0x03, 0x06, 0x6B, 0x01,
  0x11, 0x52, 0x01, 0x03, 0x2E, 0x03, 0x08, 0x6F, 0x02, 0x04,
  0x6C, 0x03, 0x06, 0x4D, 0x01, 0x08, 0x44, 0x01, 0x06, 0x34,
  0x02, 0x0E, 0x6D, 0x02, 0x15, 0x40, 0x02, 0x04, 0x01, 0x02,
  0x03, 0x3A, 0x01, 0x08, 0x3A, 0x02, 0x0C, 0x33, 0x01, 0x02,
  0x43, 0x01, 0x12, 0x0A, 0x02, 0x06, 0x46, 0x03, 0x08, 0x08,
  0x02, 0x17, 0x37, 0x03, 0x0A, 0x71, 0x01, 0x0C, 0x4C, 0x01,
  0x11, 0x38, 0x03, 0x0E, 0x76, 0x01, 0x0D, 0x48, 0x01, 0x13,
  0x17, 0x01, 0x17, 0x21, 0x01, 0x11, 0x42, 0x02, 0x07, 0x78,
  0x02, 0x05, 0x3C, 0x01, 0x0A, 0x5A, 0x01, 0x0B, 0x0A, 0x01,
  0x09, 0x01, 0x03, 0x14, 0x16, 0x02, 0x11, 0x6A, 0x02, 0x0B,
  0x7B, 0x03, 0x14, 0x16, 0x01, 0x01, 0x16, 0x02, 0x12, 0x00,
  0x01, 0x00, 0x45, 0x02, 0x17, 0x58, 0x02, 0x0C, 0x21, 0x02,
  0x11, 0x12, 0x03, 0x01, 0x5A, 0x03, 0x04, 0x54, 0x02, 0x08,
  0x43, 0x02, 0x15, 0x6B, 0x01, 0x0B, 0x1A, 0x03, 0x13, 0x58,
  0x02, 0x10, 0x2E, 0x02, 0x14, 0x07, 0x03, 0x07, 0x61, 0x02,
  0x12, 0x7C, 0x02, 0x00, 0x09, 0x01, 0x11, 0x41, 0x01, 0x17,
  0x5E, 0x03, 0x11, 0x49, 0x01, 0x16, 0x12, 0x03, 0x11, 0x7F,
  0x02, 0x06, 0x23, 0x01, 0x08, 0x08, 0x02, 0x16, 0x58, 0x02,
  0x08, 0x5A, 0x01, 0x09, 0x4D, 0x01, 0x13, 0x44, 0x03, 0x01,
  0x67, 0x01, 0x06, 0x29, 0x03, 0x09, 0x10, 0x01, 0x0B, 0x7B,
  0x01, 0x07, 0x0E, 0x02, 0x14, 0x5E, 0x02, 0x08, 0x36, 0x03,
  0x15, 0x39, 0x02, 0x0D, 0x39, 0x01, 0x0C, 0x7E, 0x01, 0x0F,
  0x1F, 0x03, 0x09, 0x5B, 0x01, 0x11, 0x74, 0x03, 0x01, 0x18,
  0x02, 0x02, 0x01, 0x02, 0x06, 0x02, 0x03, 0x0D, 0x02, 0x03,
  0x11, 0x14, 0x02, 0x03, 0x7D, 0x02, 0x0F, 0x59, 0x01, 0x05,
  0x57, 0x01, 0x0F, 0x05, 0x03, 0x08, 0x30, 0x01, 0x07, 0x2E,
  0x01, 0x00, 0x70, 0x03, 0x14, 0x0C, 0x02, 0x07, 0x38, 0x02,
  0x03, 0x7B, 0x02, 0x03, 0x03, 0x01, 0x05, 0x37, 0x03, 0x0B,
  0x2C, 0x01, 0x16, 0x6B, 0x01, 0x04, 0x30, 0x01, 0x13, 0x77,
  0x03, 0x06, 0x22, 0x02, 0x00, 0x43, 0x02, 0x11, 0x2F, 0x01,
  0x02, 0x64, 0x03, 0x09, 0x30, 0x03, 0x09, 0x43, 0x02, 0x05,
  0x13, 0x01, 0x07, 0x19, 0x02, 0x01, 0x0A, 0x02, 0x16, 0x3D,
  0x02, 0x0E, 0x04, 0x01, 0x0C, 0x34, 0x02, 0x17, 0x67, 0x01,
  0x14, 0x3B, 0x02, 0x04, 0x45, 0x02, 0x0A, 0x48, 0x01, 0x01,
  0x6A, 0x02, 0x0C, 0x1F, 0x02, 0x06, 0x7C, 0x01, 0x0B, 0x00,
  0x01, 0x17, 0x7B, 0x03, 0x07, 0x17, 0x01, 0x11, 0x02, 0x03,
  0x03, 0x23, 0x03, 0x01, 0x2C, 0x01, 0x0F, 0x16, 0x01, 0x05,
  0x6A, 0x03, 0x04, 0x65, 0x03, 0x08, 0x63, 0x03, 0x03, 0x7F,
  0x01, 0x08, 0x76, 0x02, 0x15, 0x04, 0x01, 0x0B, 0x67, 0x01,
  0x0C, 0x47, 0x01, 0x16, 0x4E, 0x01, 0x0F, 0x64, 0x03, 0x17,
  0x4C, 0x03, 0x13, 0x40, 0x01, 0x0D, 0x2E, 0x01, 0x0D, 0x29,
  0x01, 0x05, 0x4D, 0x02, 0x0E, 0x20, 0x02, 0x04, 0x48, 0x02,
  0x17, 0x48, 0x02, 0x09, 0x55, 0x01, 0x09, 0x67, 0x01, 0x08,
  0x0D, 0x02, 0x13, 0x08, 0x03, 0x0E, 0x44, 0x03, 0x17, 0x32,
  0x02, 0x0A, 0x3B, 0x03, 0x02, 0x54, 0x02, 0x0E, 0x7B, 0x02,
  0x02, 0x3E, 0x01, 0x13, 0x04, 0x03, 0x00, 0x68, 0x02, 0x05,
  0x68, 0x01, 0x05, 0x26, 0x03, 0x0F, 0x6D, 0x01, 0x0F, 0x03,
  0x01, 0x07, 0x03, 0x02, 0x15, 0x6D, 0x01, 0x11, 0x75, 0x01,
  0x03, 0x3B, 0x02, 0x09, 0x0A, 0x03, 0x0F, 0x61, 0x02, 0x10,
  0x47, 0x01, 0x04, 0x22, 0x03, 0x0F, 0x01, 0x01, 0x12, 0x55,
  0x03, 0x0F, 0x4D, 0x03, 0x02, 0x59, 0x03, 0x07, 0x2F, 0x02,
  0x16, 0x35, 0x01, 0x0D, 0x13, 0x02, 0x12, 0x65, 0x01, 0x11,
  0x6B, 0x03, 0x06, 0x76, 0x02, 0x05, 0x7C, 0x03, 0x15, 0x0E,
  0x01, 0x0D, 0x4D, 0x03, 0x00, 0x12, 0x02, 0x09, 0x2E, 0x01,
  0x12, 0x7D, 0x02, 0x06, 0x3F, 0x03, 0x15, 0x51, 0x03, 0x05,
  0x0A, 0x03, 0x13, 0x32, 0x03, 0x06, 0x07, 0x01, 0x0B, 0x6D,
  0x01, 0x13, 0x5D, 0x01, 0x02, 0x65, 0x02, 0x0F, 0x3B, 0x02,
  0x0A, 0x14, 0x01, 0x0B, 0x02, 0x01, 0x16, 0x03, 0x03, 0x17,
  0x48, 0x02, 0x0C, 0x40, 0x01, 0x14, 0x5C, 0x02, 0x17, 0x47,
  0x03, 0x08, 0x15, 0x02, 0x0C, 0x3B, 0x03, 0x0C, 0x3D, 0x01,
  0x05, 0x2E, 0x01, 0x15, 0x76, 0x02, 0x11, 0x6B, 0x01, 0x04,
  0x7A, 0x03, 0x08, 0x61, 0x02, 0x14, 0x20, 0x03, 0x10, 0x08,
  0x01, 0x0F, 0x19, 0x02, 0x07, 0x78, 0x02, 0x00, 0x5C, 0x01,
  0x16, 0x07, 0x01, 0x16, 0x7E, 0x03, 0x05, 0x46, 0x02, 0x01,
  0x10, 0x02, 0x01, 0x22, 0x03, 0x05, 0x7D, 0x03, 0x0B, 0x36,
  0x01, 0x11, 0x54, 0x03, 0x12, 0x70, 0x01, 0x06, 0x19, 0x03,
  0x0C, 0x56, 0x01, 0x07, 0x00, 0x01, 0x03, 0x15, 0x02, 0x02,
  0x66, 0x01, 0x07, 0x6D, 0x02, 0x02, 0x62, 0x02, 0x04, 0x13,
  0x02, 0x08, 0x76, 0x01, 0x11, 0x1F, 0x02, 0x06, 0x4A, 0x03,
  0x0C, 0x25, 0x03, 0x16, 0x6A, 0x01, 0x16, 0x7B, 0x01, 0x16,
  0x65, 0x03, 0x01, 0x05, 0x03, 0x03, 0x35, 0x03, 0x06, 0x46,
  0x01, 0x05, 0x25, 0x02, 0x0E, 0x4D, 0x01, 0x0A, 0x6E, 0x02,
  0x0F, 0x69, 0x01, 0x01, 0x20, 0x02, 0x0A, 0x62, 0x01, 0x15,
  0x24, 0x03, 0x15, 0x1F, 0x03, 0x0D, 0x75, 0x01, 0x10, 0x4B,
  0x02, 0x10, 0x1D, 0x02, 0x10, 0x20, 0x02, 0x13, 0x72, 0x01,
  0x09, 0x25, 0x01, 0x05, 0x77, 0x03, 0x00, 0x77, 0x03, 0x08,
  0x57, 0x01, 0x06, 0x39, 0x01, 0x09, 0x4B, 0x03, 0x0E, 0x2F,
  0x02, 0x13, 0x60, 0x02, 0x09, 0x09, 0x03, 0x15, 0x1C, 0x03,
  0x07, 0x03, 0x03, 0x01, 0x7C, 0x03, 0x04, 0x62, 0x03, 0x03,
  0x4C, 0x03, 0x0E, 0x12, 0x03, 0x0C, 0x4B, 0x03, 0x0F, 0x4F,
  0x02, 0x17, 0x4A, 0x01, 0x11, 0x1E, 0x01, 0x00, 0x7C, 0x03,
  0x03, 0x12, 0x03, 0x02, 0x53, 0x03, 0x01, 0x6E, 0x02, 0x00,
  0x1C, 0x03, 0x09, 0x13, 0x02, 0x03, 0x41, 0x01, 0x11, 0x12,
  0x02, 0x0D, 0x55, 0x01, 0x13, 0x28, 0x01, 0x04, 0x20, 0x03,
  0x14, 0x11, 0x02, 0x01, 0x05, 0x03, 0x04, 0x27, 0x03, 0x16,
  0x50, 0x02, 0x14, 0x0C, 0x02, 0x0F, 0x32, 0x02, 0x16, 0x78,
  0x03, 0x14, 0x22, 0x02, 0x0A, 0x50, 0x03, 0x13, 0x64, 0x02,
  0x16, 0x52, 0x02, 0x01, 0x7A, 0x02, 0x04, 0x24, 0x01, 0x06,
  0x71, 0x01, 0x0C, 0x75, 0x02, 0x17, 0x1B, 0x03, 0x0D, 0x5C,
  0x01, 0x10, 0x6E, 0x02, 0x15, 0x36, 0x01, 0x0F, 0x55, 0x03,
  0x13, 0x23, 0x03, 0x17, 0x79, 0x03, 0x13, 0x17, 0x03, 0x0D,
  0x54, 0x01, 0x0A, 0x72, 0x02, 0x15, 0x01, 0x01, 0x15, 0x4C,
  0x02, 0x03, 0x5C, 0x03, 0x0E, 0x30, 0x02, 0x0D, 0x30, 0x03,
  0x0B, 0x47, 0x01, 0x17, 0x0F, 0x02, 0x0D, 0x5D, 0x02, 0x12,
  0x38, 0x02, 0x0A, 0x11, 0x01, 0x00, 0x7A, 0x01, 0x00, 0x5A,
  0x02, 0x06, 0x1E, 0x03, 0x0A, 0x1E, 0x02, 0x00, 0x70, 0x03,
  0x0A, 0x55, 0x01, 0x00, 0x7F, 0x01, 0x0D, 0x70, 0x02, 0x11,
  0x6A, 0x02, 0x12, 0x7C, 0x01, 0x08, 0x46, 0x01, 0x0B, 0x0E,
  0x03, 0x08, 0x4F, 0x02, 0x14, 0x73, 0x03, 0x14, 0x36, 0x01,
  0x0A, 0x7B, 0x02, 0x00, 0x79, 0x03, 0x09, 0x4F, 0x01, 0x11,
  0x21, 0x03, 0x01, 0x34, 0x02, 0x11, 0x78, 0x03, 0x15, 0x01,
  0x03, 0x08, 0x2A, 0x02, 0x07, 0x70, 0x02, 0x02, 0x56, 0x01,
  0x01, 0x3E, 0x02, 0x02, 0x77, 0x01, 0x08, 0x75, 0x01, 0x05,
  0x07, 0x02, 0x07, 0x18, 0x03, 0x09, 0x3B, 0x03, 0x12, 0x34,
  0x01, 0x0B, 0x3D, 0x03, 0x0F, 0x3D, 0x03, 0x17, 0x11, 0x01,
  0x0E, 0x5E, 0x01, 0x0D, 0x68, 0x02, 0x0B, 0x25, 0x03, 0x07,
  0x1B, 0x02, 0x0A, 0x52, 0x03, 0x0F, 0x03, 0x03, 0x08, 0x61,
  0x01, 0x16, 0x2E, 0x03, 0x0E, 0x05, 0x01, 0x08, 0x12, 0x02,
  0x03, 0x59, 0x03, 0x0D, 0x63, 0x02, 0x08, 0x14, 0x02, 0x07,
  0x60, 0x02, 0x06, 0x45, 0x03, 0x05, 0x17, 0x03, 0x0C, 0x63,
  0x03, 0x0B, 0x66, 0x02, 0x06, 0x2F, 0x01, 0x0D, 0x0E, 0x02,
  0x00, 0x08, 0x01, 0x0C, 0x3C, 0x03, 0x07, 0x33, 0x03, 0x11,
  0x14, 0x02, 0x14, 0x51, 0x03, 0x17, 0x26, 0x01, 0x0B, 0x79,
  0x01, 0x03, 0x09, 0x02, 0x00, 0x75, 0x01, 0x11, 0x07, 0x01,
  0x00, 0x6F, 0x02, 0x16, 0x7F, 0x03, 0x17, 0x49, 0x03, 0x11,
  0x42, 0x03, 0x17, 0x57, 0x01, 0x10, 0x60, 0x02, 0x01, 0x66,
  0x01, 0x17, 0x53, 0x03, 0x00, 0x0D, 0x01, 0x0A, 0x17, 0x03,
  0x0D, 0x44, 0x02, 0x0C, 0x24, 0x01, 0x14, 0x4A, 0x02, 0x10,
  0x71, 0x03, 0x00, 0x15, 0x01, 0x0C, 0x46, 0x03, 0x0C, 0x73,
  0x03, 0x12, 0x51, 0x03, 0x06, 0x52, 0x03, 0x12, 0x2A, 0x03,
  0x17, 0x32, 0x01, 0x0E, 0x19, 0x01, 0x0C, 0x56, 0x03, 0x13,
  0x0C, 0x03, 0x0F, 0x5D, 0x01, 0x08, 0x2E, 0x02, 0x00, 0x56,
  0x02, 0x0A, 0x01, 0x02, 0x14, 0x1F, 0x03, 0x05, 0x22, 0x01,
  0x14, 0x08, 0x02, 0x17, 0x24, 0x02, 0x00, 0x0A, 0x01, 0x10,
  0x3B, 0x02, 0x05, 0x0C, 0x02, 0x13, 0x4A, 0x02, 0x17, 0x6E,
  0x01, 0x0B, 0x21, 0x01, 0x16, 0x1F, 0x03, 0x0D, 0x2C, 0x01,
  0x0D, 0x5C, 0x03, 0x11, 0x27, 0x03, 0x12, 0x35, 0x02, 0x01,
  0x60, 0x03, 0x0B, 0x0F, 0x03, 0x15, 0x7D, 0x03, 0x09, 0x5C,
  0x03, 0x01, 0x74, 0x03, 0x06, 0x77, 0x01, 0x08, 0x26, 0x03,
  0x0F, 0x05, 0x02, 0x00, 0x0B, 0x03, 0x12, 0x2B, 0x01, 0x15,
  0x65, 0x01, 0x08, 0x01, 0x01, 0x03, 0x7F, 0x01, 0x04, 0x42,
  0x02, 0x07, 0x56, 0x03, 0x16, 0x3C, 0x03, 0x05, 0x20, 0x02,
  0x15, 0x51, 0x02, 0x05, 0x11, 0x02, 0x0C, 0x07, 0x03, 0x05,
  0x79, 0x03, 0x02, 0x25, 0x02, 0x17, 0x66, 0x03, 0x16, 0x7E,
  0x02, 0x13, 0x0B, 0x01, 0x12, 0x7F, 0x02, 0x13, 0x51, 0x02,
  0x0B, 0x3A, 0x01, 0x12, 0x39, 0x01, 0x0B, 0x56, 0x02, 0x0E,
  0x2A, 0x01, 0x08, 0x09, 0x01, 0x0A, 0x26, 0x01, 0x06, 0x1D,
  0x03, 0x08, 0x5B, 0x02, 0x0E, 0x6A, 0x02, 0x04, 0x20, 0x01,
  0x04, 0x09, 0x02, 0x10, 0x4C, 0x03, 0x11, 0x29, 0x03, 0x07,
  0x6D, 0x01, 0x07, 0x52, 0x01, 0x10, 0x1D, 0x02, 0x02, 0x56,
  0x01, 0x01, 0x1E, 0x03, 0x12, 0x33, 0x02, 0x09, 0x54, 0x02,
  0x01, 0x19, 0x01, 0x03, 0x7B, 0x03, 0x09, 0x43, 0x01, 0x17,
  0x39, 0x03, 0x16, 0x45, 0x02, 0x13, 0x63, 0x01, 0x06, 0x19,
  0x03, 0x06, 0x1D, 0x02, 0x08, 0x56, 0x02, 0x0B, 0x25, 0x01,
  0x05, 0x5C, 0x02, 0x02, 0x7E, 0x01, 0x0F, 0x7D, 0x02, 0x16,
  0x11, 0x03, 0x11, 0x1A, 0x01, 0x05, 0x19, 0x03, 0x0F, 0x6E,
  0x03, 0x15, 0x47, 0x03, 0x15, 0x05, 0x01, 0x08, 0x45, 0x03,
  0x03, 0x69, 0x02, 0x17, 0x41, 0x01, 0x08, 0x4A, 0x01, 0x08,
  0x20, 0x02, 0x12, 0x5F, 0x01, 0x17, 0x79, 0x01, 0x17, 0x65,
  0x03, 0x01, 0x38, 0x01, 0x0B, 0x00, 0x01, 0x15, 0x51, 0x01,
  0x03, 0x27, 0x02, 0x12, 0x62, 0x01, 0x06, 0x04, 0x01, 0x0C,
  0x00, 0x01, 0x04, 0x2A, 0x02, 0x0A, 0x2A, 0x03, 0x0F, 0x7D,
  0x03, 0x0D, 0x00, 0x01, 0x10, 0x10, 0x03, 0x0F, 0x3A, 0x03,
  0x16, 0x65, 0x03, 0x06, 0x17, 0x01, 0x04, 0x7F, 0x01, 0x0A,
  0x6D, 0x01, 0x12, 0x38, 0x01, 0x09, 0x67, 0x03, 0x01, 0x36,
  0x02, 0x10, 0x25, 0x02, 0x0A, 0x25, 0x01, 0x06, 0x69, 0x03,
  0x08, 0x27, 0x01, 0x0B, 0x78, 0x02, 0x05, 0x56, 0x01, 0x03,
  0x13, 0x03, 0x04, 0x2A, 0x02, 0x12, 0x53, 0x02, 0x01, 0x36,
  0x03, 0x09, 0x37, 0x02, 0x08, 0x2F, 0x02, 0x08, 0x15, 0x02,
  0x16, 0x5F, 0x02, 0x07, 0x29, 0x03, 0x14, 0x0F, 0x01, 0x11,
  0x2C, 0x02, 0x0C, 0x60, 0x03, 0x06, 0x3E, 0x01, 0x07, 0x14,
  0x01, 0x07, 0x54, 0x02, 0x07, 0x21, 0x02, 0x08, 0x28, 0x02,
  0x0A, 0x36, 0x02, 0x05, 0x00, 0x02, 0x17, 0x16, 0x02, 0x01,
  0x1E, 0x03, 0x01, 0x2A, 0x01, 0x03, 0x09, 0x03, 0x02, 0x00,
  0x03, 0x15, 0x5B, 0x02, 0x09, 0x40, 0x02, 0x09, 0x6E, 0x01,
  0x01, 0x75, 0x03, 0x03, 0x79, 0x01, 0x00, 0x11, 0x03, 0x0C,
  0x47, 0x03, 0x01, 0x37, 0x01, 0x11, 0x05, 0x02, 0x15, 0x4F,
  0x01, 0x05, 0x3A, 0x01, 0x0D, 0x52, 0x01, 0x0C, 0x36, 0x02,
  0x13, 0x2D, 0x03, 0x11, 0x65, 0x02, 0x0B, 0x11, 0x03, 0x11,
  0x58, 0x03, 0x07, 0x3D, 0x02, 0x12, 0x27, 0x03, 0x06, 0x53,
  0x01, 0x17, 0x5E, 0x01, 0x0D, 0x7D, 0x03, 0x16, 0x1C, 0x03,
  0x11, 0x16, 0x01, 0x08, 0x52, 0x01, 0x15, 0x58, 0x03, 0x0A,
  0x08, 0x01, 0x11, 0x3F, 0x01, 0x0B, 0x26, 0x02, 0x03, 0x6C,
  0x01, 0x04, 0x75, 0x03, 0x13, 0x34, 0x01, 0x16, 0x13, 0x02,
  0x0B, 0x33, 0x01, 0x00, 0x56, 0x03, 0x12, 0x0C, 0x02, 0x14,
  0x55, 0x01, 0x0A, 0x72, 0x01, 0x07, 0x4D, 0x01, 0x16, 0x50,
  0x03, 0x06, 0x76, 0x02, 0x09, 0x28, 0x02, 0x00, 0x07, 0x01,
  0x16, 0x3E, 0x02, 0x0F, 0x4A, 0x01, 0x03, 0x1D, 0x02, 0x0A,
  0x63, 0x03, 0x05, 0x3A, 0x01, 0x04, 0x1A, 0x02, 0x02, 0x03,
  0x03, 0x05, 0x45, 0x02, 0x12, 0x41, 0x01, 0x09, 0x66, 0x03,
  0x01, 0x4C, 0x02, 0x10, 0x65, 0x03, 0x01, 0x6F, 0x01, 0x15,
  0x61, 0x02, 0x03, 0x0F, 0x01, 0x08, 0x66, 0x02, 0x0E, 0x5C,
  0x02, 0x08, 0x45, 0x02, 0x0C, 0x6A, 0x01, 0x03, 0x4F, 0x03,
  0x03, 0x6B, 0x02, 0x04, 0x74, 0x02, 0x05, 0x70, 0x02, 0x11,
  0x68, 0x02, 0x0A, 0x6B, 0x01, 0x0C, 0x32, 0x03, 0x11, 0x13,
  0x01, 0x10, 0x4F, 0x01, 0x0F, 0x55, 0x03, 0x0A, 0x54, 0x01,
  0x11, 0x66, 0x01, 0x17, 0x3F, 0x02, 0x03, 0x71, 0x01, 0x08,
  0x1C, 0x03, 0x11, 0x7D, 0x02, 0x0B, 0x1B, 0x01, 0x06, 0x23,
  0x02, 0x01, 0x35, 0x01, 0x03, 0x3B, 0x03, 0x01, 0x0A, 0x03,
  0x0F, 0x10, 0x01, 0x0D, 0x50, 0x02, 0x15, 0x44, 0x01, 0x07,
  0x42, 0x03, 0x00, 0x26, 0x01, 0x0C, 0x6B, 0x01, 0x05, 0x60,
  0x01, 0x0B, 0x15, 0x02, 0x0F, 0x61, 0x01, 0x17, 0x67, 0x03,
  0x0B, 0x3B, 0x03, 0x11, 0x3E, 0x03, 0x00, 0x10, 0x01, 0x07,
  0x3E, 0x03, 0x07, 0x40, 0x01, 0x04, 0x05, 0x02, 0x11, 0x3B,
  0x01, 0x0E, 0x02, 0x02, 0x15, 0x27, 0x02, 0x0C, 0x68, 0x03,
  0x09, 0x54, 0x01, 0x04, 0x3D, 0x03, 0x09, 0x48, 0x03, 0x03,
  0x50, 0x02, 0x13, 0x27, 0x03, 0x15, 0x6D, 0x02, 0x02, 0x1F,
  0x01, 0x17, 0x62, 0x02, 0x07, 0x5B, 0x01, 0x12, 0x71, 0x03,
  0x15, 0x6B, 0x01, 0x0B, 0x73, 0x03, 0x04, 0x49, 0x01, 0x0A,
  0x1A, 0x02, 0x17, 0x10, 0x02, 0x0E, 0x3C, 0x01, 0x02, 0x24,
  0x01, 0x0C, 0x0C, 0x02, 0x04, 0x19, 0x03, 0x04, 0x20, 0x02,
  0x12, 0x6D, 0x02, 0x0D, 0x36, 0x02, 0x09, 0x36, 0x03, 0x11,
  0x4E, 0x01, 0x03, 0x3C, 0x03, 0x0E, 0x0E, 0x02, 0x01, 0x37,
  0x01, 0x05, 0x72, 0x01, 0x15, 0x6D, 0x01, 0x08, 0x08, 0x01,
  0x14, 0x67, 0x03, 0x02, 0x5C, 0x03, 0x17, 0x7C, 0x02, 0x07,
  0x0A, 0x01, 0x14, 0x15, 0x02, 0x11, 0x5D, 0x02, 0x13, 0x19,
  0x02, 0x0E, 0x09, 0x02, 0x16, 0x4E, 0x03, 0x10, 0x09, 0x03,
  0x12, 0x50, 0x01, 0x0E, 0x67, 0x03, 0x13, 0x56, 0x01, 0x0F,
  0x01, 0x03, 0x15, 0x31, 0x02, 0x0B, 0x64, 0x02, 0x17, 0x0A,
  0x01, 0x01, 0x70, 0x02, 0x10, 0x2C, 0x02, 0x0E, 0x43, 0x03,
  0x01, 0x79, 0x01, 0x13, 0x6B, 0x02, 0x17, 0x43, 0x01, 0x14,
  0x2F, 0x03, 0x0D, 0x30, 0x03, 0x03, 0x57, 0x01, 0x0F, 0x64,
  0x01, 0x0D, 0x0F, 0x03, 0x17, 0x1E, 0x03, 0x15, 0x7F, 0x01,
  0x10, 0x02, 0x02, 0x06, 0x3C, 0x01, 0x09, 0x10, 0x03, 0x06,
  0x42, 0x02, 0x0A, 0x0B, 0x02, 0x0F, 0x66, 0x02, 0x07, 0x44,
  0x03, 0x01, 0x70, 0x02, 0x11, 0x58, 0x01, 0x06, 0x1F, 0x02,
  0x11, 0x31, 0x03, 0x0A, 0x25, 0x02, 0x0C, 0x04, 0x02, 0x04,
  0x23, 0x02, 0x05, 0x1D, 0x02, 0x04, 0x2C, 0x01, 0x0D, 0x5F,
  0x01, 0x03, 0x5F, 0x03, 0x0E, 0x13, 0x03, 0x14, 0x63, 0x03,
  0x0F, 0x07, 0x03, 0x05, 0x43, 0x03, 0x15, 0x35, 0x03, 0x17,
  0x72, 0x03, 0x05, 0x6E, 0x03, 0x02, 0x77, 0x02, 0x16, 0x7D,
  0x01, 0x0E, 0x51, 0x03, 0x08, 0x40, 0x02, 0x17, 0x5E, 0x03,
  0x04, 0x6B, 0x02, 0x0F, 0x7D, 0x03, 0x0A, 0x30, 0x01, 0x03,
  0x76, 0x02, 0x15, 0x51, 0x02, 0x06, 0x77, 0x02, 0x17, 0x19,
  0x02, 0x05, 0x23, 0x02, 0x04, 0x23, 0x02, 0x15, 0x57, 0x03,
  0x03, 0x30, 0x02, 0x03, 0x5E, 0x03, 0x10, 0x2C, 0x01, 0x10,
  0x38, 0x02, 0x11, 0x2D, 0x01, 0x04, 0x77, 0x02, 0x08, 0x57,
  0x03, 0x0D, 0x27, 0x03, 0x00, 0x38, 0x03, 0x06, 0x32, 0x02,
  0x12, 0x0D, 0x02, 0x10, 0x30, 0x02, 0x17, 0x09, 0x01, 0x0D,
  0x23, 0x03, 0x02, 0x59, 0x01, 0x17, 0x73, 0x02, 0x05, 0x27,
  0x03, 0x16, 0x3D, 0x02, 0x02, 0x1F, 0x02, 0x16, 0x3D, 0x03,
  0x16, 0x14, 0x03, 0x14, 0x64, 0x01, 0x11, 0x4E, 0x02, 0x0A,
  0x09, 0x01, 0x07, 0x2E, 0x01, 0x08, 0x25, 0x02, 0x0B, 0x0A,
  0x03, 0x0E, 0x61, 0x02, 0x08, 0x69, 0x03, 0x06, 0x2C, 0x02,
  0x16, 0x69, 0x03, 0x16, 0x1C, 0x01, 0x0A, 0x56, 0x01, 0x16,
  0x72, 0x03, 0x07, 0x6F, 0x03, 0x10, 0x19, 0x01, 0x07, 0x0F,
  0x02, 0x14, 0x29, 0x02, 0x17, 0x48, 0x03, 0x12, 0x54, 0x03,
  0x01, 0x2C, 0x02, 0x17, 0x0F, 0x03, 0x02, 0x44, 0x02, 0x07,
  0x6A, 0x03, 0x15, 0x2B, 0x01, 0x06, 0x3D, 0x03, 0x0B, 0x50,
  0x03, 0x14, 0x60, 0x02, 0x04, 0x57, 0x01, 0x11, 0x77, 0x03,
  0x02, 0x2F, 0x01, 0x01, 0x07, 0x03, 0x13, 0x5B, 0x03, 0x17,
  0x28, 0x01, 0x16, 0x22, 0x01, 0x17, 0x58, 0x01, 0x13, 0x14,
  0x02, 0x14, 0x44, 0x02, 0x17, 0x1D, 0x03, 0x15, 0x05, 0x03,
  0x14, 0x0E, 0x01, 0x17, 0x10, 0x01, 0x00, 0x16, 0x03, 0x07,
  0x7B, 0x01, 0x0F, 0x03, 0x02, 0x0D, 0x6A, 0x03, 0x0A, 0x72,
  0x03, 0x09, 0x3E, 0x03, 0x10, 0x7E, 0x01, 0x15, 0x78, 0x02,
  0x01, 0x36, 0x02, 0x12, 0x17, 0x01, 0x07, 0x38, 0x03, 0x03,
  0x62, 0x02, 0x0C, 0x2A, 0x01, 0x15, 0x4B, 0x02, 0x0B, 0x15,
  0x01, 0x13, 0x4D, 0x02, 0x12, 0x72, 0x03, 0x03, 0x38, 0x03,
  0x08, 0x12, 0x02, 0x0A, 0x3C, 0x02, 0x13, 0x44, 0x01, 0x08,
  0x78, 0x03, 0x05, 0x27, 0x02, 0x03, 0x62, 0x02, 0x07, 0x5D,
  0x02, 0x0B, 0x08, 0x02, 0x0B, 0x16, 0x02, 0x10, 0x03, 0x03,
  0x08, 0x22, 0x03, 0x16, 0x1A, 0x02, 0x05, 0x4A, 0x03, 0x03,
  0x28, 0x03, 0x15, 0x3F, 0x03, 0x01, 0x3B, 0x03, 0x09, 0x6F,
  0x02, 0x0F, 0x1F, 0x01, 0x0B, 0x4B, 0x01, 0x16, 0x48, 0x02,
  0x0A, 0x2B, 0x03, 0x0A, 0x01, 0x03, 0x0E, 0x2C, 0x03, 0x03,
  0x2B, 0x01, 0x13, 0x2D, 0x03, 0x08, 0x30, 0x02, 0x13, 0x26,
  0x01, 0x06, 0x48, 0x03, 0x0C, 0x0B, 0x03, 0x14, 0x13, 0x03,
  0x14, 0x51, 0x03, 0x17, 0x5B, 0x02, 0x11, 0x1C, 0x01, 0x04,
  0x34, 0x02, 0x09, 0x5E, 0x02, 0x0B, 0x0C, 0x03, 0x15, 0x1B,
  0x02, 0x07, 0x32, 0x01, 0x0F, 0x25, 0x01, 0x04, 0x46, 0x03,
  0x15, 0x4C, 0x03, 0x10, 0x70, 0x01, 0x08, 0x34, 0x01, 0x04,
  0x2E, 0x02, 0x06, 0x3B, 0x03, 0x0A, 0x63, 0x01, 0x15, 0x08,
  0x02, 0x05, 0x56, 0x03, 0x04, 0x1A, 0x03, 0x09, 0x69, 0x01,
  0x02, 0x4B, 0x02, 0x16, 0x0F, 0x03, 0x10, 0x57, 0x03, 0x08,
  0x12, 0x02, 0x03, 0x1D, 0x01, 0x0E, 0x7F, 0x02, 0x13, 0x55,
  0x01, 0x11, 0x71, 0x03, 0x0C, 0x55, 0x02, 0x17, 0x7F, 0x01,
  0x0C, 0x22, 0x03, 0x14, 0x5A, 0x01, 0x05, 0x19, 0x01, 0x02,
  0x0F, 0x02, 0x12, 0x0E, 0x03, 0x03, 0x52, 0x02, 0x05, 0x16,
  0x02, 0x11, 0x58, 0x01, 0x0E, 0x28, 0x01, 0x10, 0x16, 0x02,
  0x0F, 0x55, 0x02, 0x0C, 0x0A, 0x03, 0x15, 0x0E, 0x02, 0x16,
  0x64, 0x01, 0x0B, 0x20, 0x01, 0x06, 0x4A, 0x01, 0x04, 0x3C,
  0x02, 0x06, 0x10, 0x03, 0x02, 0x3B, 0x01, 0x0C, 0x77, 0x02,
  0x03, 0x06, 0x03, 0x17, 0x4F, 0x01, 0x02, 0x11, 0x02, 0x0E,
  0x26, 0x01, 0x09, 0x43, 0x01, 0x01, 0x05, 0x01, 0x0A, 0x0C,
  0x01, 0x10, 0x05, 0x03, 0x03, 0x07, 0x03, 0x13, 0x3C, 0x03,
  0x01, 0x24, 0x03, 0x11, 0x0E, 0x02, 0x14, 0x27, 0x01, 0x06,
  0x1B, 0x01, 0x0F, 0x6D, 0x03, 0x07, 0x67, 0x03, 0x07, 0x5C,
  0x03, 0x03, 0x4E, 0x01, 0x0D, 0x11, 0x03, 0x0F, 0x5F, 0x03,
  0x14, 0x4B, 0x02, 0x17, 0x32, 0x03, 0x00, 0x1A, 0x01, 0x02,
  0x53, 0x03, 0x0E, 0x7B, 0x01, 0x15, 0x1C, 0x02, 0x08, 0x42,
  0x01, 0x0B, 0x62, 0x01, 0x15, 0x33, 0x01, 0x16, 0x66, 0x02,
  0x00, 0x54, 0x01, 0x11, 0x5E, 0x02, 0x16, 0x45, 0x03, 0x10,
  0x5B, 0x02, 0x17, 0x33, 0x03, 0x01, 0x0E, 0x01, 0x08, 0x1A,
  0x02, 0x05, 0x1C, 0x01, 0x11, 0x26, 0x03, 0x0F, 0x55, 0x01,
  0x08, 0x04, 0x03, 0x0E, 0x13, 0x03, 0x02, 0x15, 0x01, 0x11,
  0x6D, 0x01, 0x17, 0x27, 0x01, 0x0A, 0x1A, 0x02, 0x0A, 0x4F,
  0x02, 0x02, 0x25, 0x02, 0x0B, 0x3C, 0x02, 0x07, 0x1F, 0x02,
  0x07, 0x7C, 0x02, 0x08, 0x78, 0x03, 0x0E, 0x22, 0x03, 0x11,
  0x07, 0x02, 0x15, 0x29, 0x03, 0x04, 0x05, 0x02, 0x15, 0x40,
  0x01, 0x04, 0x4D, 0x02, 0x0A, 0x00, 0x02, 0x00, 0x07, 0x03,
  0x05, 0x2E, 0x02, 0x08, 0x0E, 0x02, 0x11, 0x4A, 0x03, 0x16,
  0x7E, 0x02, 0x02, 0x62, 0x03, 0x15, 0x55, 0x02, 0x13, 0x10,
  0x02, 0x00, 0x3E, 0x02, 0x02, 0x7A, 0x03, 0x14, 0x66, 0x01,
  0x10, 0x18, 0x01, 0x05, 0x68, 0x01, 0x02, 0x04, 0x02, 0x07,
  0x5D, 0x03, 0x06, 0x6E, 0x03, 0x0C, 0x76, 0x02, 0x14, 0x7B,
  0x02, 0x09, 0x4A, 0x01, 0x11, 0x58, 0x02, 0x03, 0x09, 0x03,
  0x00, 0x5B, 0x02, 0x17, 0x54, 0x01, 0x05, 0x5A, 0x02, 0x09,
  0x19, 0x01, 0x06, 0x57, 0x01, 0x15, 0x76, 0x02, 0x17, 0x52,
  0x03, 0x11, 0x7C, 0x03, 0x06, 0x1E, 0x02, 0x17, 0x42, 0x02,
  0x09, 0x55, 0x01, 0x14, 0x69, 0x01, 0x0E, 0x64, 0x03, 0x13,
  0x1E, 0x03, 0x0C, 0x7B, 0x02, 0x01, 0x70, 0x03, 0x05, 0x20,
  0x02, 0x13, 0x4C, 0x03, 0x01, 0x09, 0x03, 0x05, 0x27, 0x01,
  0x0D, 0x3E, 0x03, 0x02, 0x40, 0x01, 0x02, 0x16, 0x02, 0x08,
  0x7E, 0x02, 0x01, 0x2F, 0x02, 0x12, 0x73, 0x03, 0x08, 0x75,
  0x02, 0x09, 0x4E, 0x03, 0x0C, 0x2A, 0x01, 0x11, 0x22, 0x01,
  0x05, 0x5D, 0x03, 0x0B, 0x1F, 0x01, 0x13, 0x63, 0x01, 0x0E,
  0x5B, 0x01, 0x0C, 0x55, 0x02, 0x03, 0x72, 0x02, 0x0A, 0x27,
  0x02, 0x0E, 0x31, 0x01, 0x08, 0x45, 0x01, 0x13, 0x7C, 0x03,
  0x17, 0x04, 0x01, 0x14, 0x49, 0x02, 0x08, 0x11, 0x03, 0x07,
  0x01, 0x03, 0x01, 0x25, 0x03, 0x11, 0x70, 0x03, 0x08, 0x08,
  0x03, 0x11, 0x6C, 0x01, 0x03, 0x39, 0x01, 0x0A, 0x68, 0x01,
  0x0C, 0x3E, 0x02, 0x0A, 0x47, 0x02, 0x0F, 0x08, 0x02, 0x03,
  0x38, 0x02, 0x07, 0x67, 0x02, 0x15, 0x49, 0x03, 0x11, 0x7B,
  0x02, 0x0A, 0x0A, 0x02, 0x06, 0x4E, 0x01, 0x0B, 0x11, 0x01,
  0x15, 0x04, 0x02, 0x11, 0x6F, 0x01, 0x07, 0x3E, 0x02, 0x12,
  0x18, 0x01, 0x00, 0x6D, 0x02, 0x14, 0x7A, 0x03, 0x09, 0x06,
  0x02, 0x17, 0x70, 0x01, 0x0F, 0x4D, 0x02, 0x02, 0x08, 0x02,
  0x0D, 0x69, 0x02, 0x01, 0x3D, 0x01, 0x0A, 0x0F, 0x01, 0x09,
  0x6F, 0x01, 0x17, 0x23, 0x03, 0x0E, 0x75, 0x03, 0x06, 0x5A,
  0x01, 0x15, 0x09, 0x02, 0x14, 0x40, 0x02, 0x03, 0x4A, 0x03,
  0x11, 0x09, 0x03, 0x03, 0x7A, 0x03, 0x00, 0x02, 0x02, 0x07,
  0x68, 0x03, 0x17, 0x32, 0x01, 0x04, 0x3C, 0x01, 0x0F, 0x35,
  0x03, 0x0E, 0x4D, 0x03, 0x0C, 0x05, 0x03, 0x06, 0x52, 0x03,
  0x08, 0x76, 0x01, 0x10, 0x56, 0x02, 0x0B, 0x22, 0x02, 0x0B,
  0x69, 0x01, 0x0E, 0x00, 0x02, 0x04, 0x4E, 0x01, 0x14, 0x11,
  0x02, 0x03, 0x18, 0x02, 0x0D, 0x40, 0x02, 0x16, 0x53, 0x01,
  0x11, 0x00, 0x02, 0x0E, 0x71, 0x01, 0x17, 0x1D, 0x02, 0x0E,
  0x11, 0x03, 0x01, 0x38, 0x03, 0x07, 0x6F, 0x01, 0x07, 0x1E,
  0x02, 0x10, 0x38, 0x01, 0x11, 0x67, 0x01, 0x13, 0x0C, 0x01,
  0x01, 0x47, 0x02, 0x17, 0x7C, 0x01, 0x0C, 0x2D, 0x01, 0x06,
  0x17, 0x03, 0x00, 0x56, 0x01, 0x0A, 0x60, 0x02, 0x14, 0x64,
  0x03, 0x0C, 0x55, 0x03, 0x0A, 0x0E, 0x02, 0x11, 0x19, 0x03,
  0x08, 0x03, 0x02, 0x17, 0x5F, 0x02, 0x13, 0x12, 0x03, 0x04,
  0x16, 0x02, 0x0C, 0x0C, 0x02, 0x05, 0x52, 0x01, 0x15, 0x78,
  0x01, 0x13, 0x34, 0x03, 0x09, 0x0F, 0x03, 0x0A, 0x72, 0x02,
  0x10, 0x60, 0x01, 0x13, 0x2F, 0x02, 0x02, 0x01, 0x01, 0x04,
  0x15, 0x02, 0x0D, 0x44, 0x03, 0x10, 0x19, 0x03, 0x05, 0x1F,
  0x01, 0x00, 0x4E, 0x02, 0x05, 0x2B, 0x02, 0x09, 0x61, 0x02,
  0x16, 0x07, 0x03, 0x09, 0x0C, 0x01, 0x17, 0x64, 0x01, 0x0E,
  0x35, 0x03, 0x09, 0x63, 0x02, 0x17, 0x48, 0x01, 0x15, 0x7A,
  0x01, 0x0B, 0x7F, 0x01, 0x0B, 0x66, 0x03, 0x0A, 0x0F, 0x02,
  0x0E, 0x46, 0x02, 0x08, 0x31, 0x03, 0x0F, 0x6F, 0x01, 0x14,
  0x1B, 0x03, 0x09, 0x69, 0x01, 0x07, 0x37, 0x02, 0x09, 0x02,
  0x02, 0x04, 0x5E, 0x01, 0x05, 0x3C, 0x02, 0x0D, 0x2D, 0x03,
  0x09, 0x02, 0x02, 0x14, 0x06, 0x03, 0x12, 0x77, 0x02, 0x08,
  0x15, 0x01, 0x09, 0x38, 0x03, 0x12, 0x36, 0x02, 0x09, 0x69,
  0x01, 0x14, 0x55, 0x02, 0x13, 0x68, 0x03, 0x17, 0x2B, 0x01,
  0x0C, 0x23, 0x03, 0x00, 0x12, 0x01, 0x11, 0x1C, 0x03, 0x12,
  0x61, 0x03, 0x11, 0x58, 0x02, 0x11, 0x17, 0x02, 0x06, 0x42,
  0x02, 0x08, 0x48, 0x01, 0x16, 0x2B, 0x01, 0x0D, 0x07, 0x03,
  0x0E, 0x03, 0x03, 0x08, 0x54, 0x03, 0x02, 0x36, 0x03, 0x11,
  0x6C, 0x01, 0x16, 0x37, 0x02, 0x10, 0x02, 0x01, 0x12, 0x78,
  0x02, 0x11, 0x79, 0x01, 0x08, 0x22, 0x01, 0x15, 0x74, 0x02,
  0x0E, 0x78, 0x01, 0x0D, 0x4B, 0x01, 0x08, 0x2D, 0x03, 0x0E,
  0x76, 0x01, 0x14, 0x13, 0x01, 0x0C, 0x05, 0x03, 0x16, 0x3B,
  0x03, 0x0B, 0x40, 0x02, 0x0B, 0x56, 0x01, 0x07, 0x26, 0x01,
  0x0F, 0x5B, 0x03, 0x05, 0x1B, 0x02, 0x0E, 0x7F, 0x01, 0x06,
  0x02, 0x03, 0x0B, 0x00, 0x03, 0x17, 0x73, 0x02, 0x09, 0x52,
  0x03, 0x09, 0x48, 0x02, 0x0A, 0x4A, 0x03, 0x08, 0x35, 0x03,
  0x0E, 0x51, 0x01, 0x15, 0x24, 0x03, 0x08, 0x77, 0x02, 0x07,
  0x4A, 0x01, 0x0F, 0x05, 0x03, 0x05, 0x67, 0x02, 0x0F, 0x44,
  0x01, 0x0A, 0x07, 0x01, 0x00, 0x10, 0x02, 0x00, 0x08, 0x01,
  0x0E, 0x59, 0x01, 0x0E, 0x4E, 0x01, 0x0D, 0x75, 0x03, 0x0D,
  0x07, 0x02, 0x0B, 0x79, 0x03, 0x04, 0x5E, 0x03, 0x05, 0x0A,
  0x02, 0x0F, 0x07, 0x02, 0x0C, 0x0C, 0x02, 0x04, 0x66, 0x02,
  0x03, 0x59, 0x02, 0x15, 0x17, 0x03, 0x02, 0x75, 0x01, 0x05,
  0x74, 0x02, 0x0B, 0x27, 0x01, 0x08, 0x0E, 0x01, 0x00, 0x72,
  0x02, 0x12, 0x0D, 0x02, 0x03, 0x04, 0x01, 0x06, 0x56, 0x01,
  0x0C, 0x30, 0x02, 0x17, 0x36, 0x03, 0x00, 0x6F, 0x03, 0x09,
  0x5E, 0x01, 0x02, 0x3A, 0x03, 0x12, 0x19, 0x02, 0x05, 0x01,
  0x01, 0x14, 0x6F, 0x02, 0x09, 0x57, 0x02, 0x10, 0x4F, 0x03,
  0x07, 0x73, 0x01, 0x14, 0x56, 0x01, 0x0B, 0x5C, 0x03, 0x0A,
  0x65, 0x02, 0x11, 0x2D, 0x03, 0x15, 0x3B, 0x02, 0x11, 0x4E,
  0x03, 0x08, 0x09, 0x03, 0x15, 0x2F, 0x01, 0x09, 0x48, 0x02,
  0x00, 0x01, 0x01, 0x0E, 0x7E, 0x01, 0x04, 0x3A, 0x01, 0x0A,
  0x28, 0x01, 0x17, 0x2C, 0x01, 0x14, 0x4C, 0x03, 0x0E, 0x5C,
  0x03, 0x02, 0x50, 0x03, 0x00, 0x08, 0x01, 0x0B, 0x17, 0x03,
  0x07, 0x44, 0x01, 0x0B, 0x1E, 0x03, 0x13, 0x43, 0x01, 0x10,
  0x26, 0x01, 0x17, 0x30, 0x01, 0x0C, 0x43, 0x02, 0x14, 0x14,
  0x02, 0x04, 0x55, 0x03, 0x15, 0x07, 0x03, 0x03, 0x46, 0x01,
  0x03, 0x50, 0x01, 0x08, 0x3A, 0x02, 0x01, 0x6F, 0x02, 0x01,
  0x10, 0x01, 0x13, 0x6B, 0x02, 0x14, 0x1D, 0x03, 0x14, 0x35,
  0x03, 0x07, 0x27, 0x03, 0x17, 0x3D, 0x01, 0x05, 0x1E, 0x01,
  0x07, 0x06, 0x03, 0x00, 0x60, 0x02, 0x15, 0x24, 0x03, 0x16,
  0x7D, 0x03, 0x16, 0x18, 0x03, 0x0C, 0x0A, 0x02, 0x14, 0x7C,
  0x02, 0x06, 0x45, 0x01, 0x0D, 0x05, 0x02, 0x0D, 0x4B, 0x03,
  0x16, 0x69, 0x03, 0x02, 0x75, 0x03, 0x15, 0x58, 0x01, 0x0F,
  0x5F, 0x01, 0x14, 0x68, 0x01, 0x17, 0x47, 0x03, 0x16, 0x25,
  0x02, 0x11, 0x2A, 0x01, 0x00, 0x53, 0x03, 0x01, 0x4B, 0x02,
  0x05, 0x10, 0x03, 0x01, 0x2C, 0x03, 0x12, 0x1F, 0x02, 0x13,
  0x77, 0x03, 0x10, 0x65, 0x02, 0x00, 0x1B, 0x03, 0x12, 0x43,
  0x03, 0x09, 0x10, 0x03, 0x16, 0x18, 0x02, 0x0F, 0x1A, 0x01,
  0x09, 0x0F, 0x02, 0x13, 0x47, 0x01, 0x0C, 0x69, 0x03, 0x0F,
  0x73, 0x03, 0x14, 0x10, 0x02, 0x0B, 0x6E, 0x03, 0x01, 0x40,
  0x03, 0x10, 0x57, 0x02, 0x08, 0x54, 0x01, 0x0C, 0x11, 0x03,
  0x10, 0x11, 0x01, 0x16, 0x01, 0x03, 0x0D, 0x61, 0x01, 0x03,
  0x7F, 0x01, 0x13, 0x7C, 0x03, 0x02, 0x18, 0x01, 0x08, 0x5C,
  0x02, 0x0A, 0x28, 0x01, 0x11, 0x28, 0x02, 0x01, 0x1C, 0x03,
  0x10, 0x4B, 0x01, 0x0C, 0x04, 0x01, 0x0B, 0x35, 0x01, 0x10,
  0x60, 0x03, 0x03, 0x2B, 0x03, 0x00, 0x1A, 0x01, 0x07, 0x78,
  0x01, 0x10, 0x57, 0x02, 0x0D, 0x02, 0x01, 0x02, 0x7D, 0x03,
  0x13, 0x3C, 0x01, 0x03, 0x51, 0x02, 0x0C, 0x73, 0x03, 0x10,
  0x45, 0x01, 0x02, 0x3B, 0x03, 0x07, 0x32, 0x01, 0x0E, 0x09,
  0x03, 0x07, 0x6F, 0x03, 0x0F, 0x46, 0x01, 0x0F, 0x47, 0x02,
  0x0E, 0x61, 0x03, 0x12, 0x7C, 0x03, 0x0C, 0x0D, 0x03, 0x0D,
  0x42, 0x01, 0x01, 0x5C, 0x03, 0x0A, 0x4D, 0x03, 0x16, 0x01,
  0x01, 0x06, 0x6E, 0x02, 0x0F, 0x1F, 0x02, 0x13, 0x02, 0x02,
  0x0C, 0x47, 0x02, 0x09, 0x33, 0x02, 0x0C, 0x0A, 0x01, 0x11,
  0x2C, 0x01, 0x15, 0x08, 0x02, 0x14, 0x6F, 0x03, 0x09, 0x33,
  0x03, 0x03, 0x1A, 0x03, 0x01, 0x05, 0x02, 0x04, 0x3C, 0x03,
  0x11, 0x0B, 0x03, 0x03, 0x7A, 0x02, 0x12, 0x5E, 0x02, 0x14,
  0x5B, 0x02, 0x13, 0x79, 0x03, 0x00, 0x5C, 0x03, 0x05, 0x67,
  0x01, 0x17, 0x10, 0x01, 0x00, 0x53, 0x03, 0x0C, 0x3A, 0x01,
  0x07, 0x0E, 0x03, 0x11, 0x67, 0x03, 0x03, 0x58, 0x02, 0x11,
  0x32, 0x03, 0x0D, 0x28, 0x01, 0x0F, 0x44, 0x03, 0x0A, 0x26,
  0x02, 0x00, 0x69, 0x02, 0x0E, 0x47, 0x01, 0x14, 0x5B, 0x03,
  0x02, 0x55, 0x03, 0x01, 0x13, 0x01, 0x06, 0x47, 0x03, 0x09,
  0x36, 0x02, 0x15, 0x09, 0x01, 0x06, 0x7E, 0x03, 0x04, 0x46,
  0x03, 0x17, 0x2C, 0x03, 0x0C, 0x3F, 0x01, 0x04, 0x42, 0x03,
  0x03, 0x0F, 0x01, 0x15, 0x1A, 0x03, 0x08, 0x3B, 0x02, 0x03,
  0x34, 0x02, 0x15, 0x32, 0x02, 0x0D, 0x0E, 0x01, 0x00, 0x3F,
  0x02, 0x0C, 0x32, 0x03, 0x14, 0x7E, 0x01, 0x04, 0x7B, 0x02,
  0x12, 0x4C, 0x03, 0x02, 0x5D, 0x02, 0x00, 0x0A, 0x03, 0x0E,
  0x09, 0x02, 0x16, 0x07, 0x01, 0x13, 0x61, 0x03, 0x0D, 0x4E,
  0x03, 0x07, 0x02, 0x01, 0x17, 0x55, 0x03, 0x0D, 0x36, 0x01,
  0x08, 0x5E, 0x01, 0x04, 0x0C, 0x01, 0x0D, 0x2D, 0x01, 0x01,
  0x22, 0x03, 0x04, 0x1C, 0x01, 0x02, 0x3C, 0x01, 0x15, 0x60,
  0x02, 0x0C, 0x5B, 0x01, 0x0C, 0x0B, 0x03, 0x0F, 0x77, 0x01,
  0x11, 0x28, 0x01, 0x06, 0x7F, 0x01, 0x0C, 0x13, 0x03, 0x08,
  0x18, 0x01, 0x0C, 0x4D, 0x02, 0x16, 0x05, 0x03, 0x0E, 0x22,
  0x02, 0x15, 0x7C, 0x03, 0x08, 0x5C, 0x03, 0x0C, 0x4E, 0x03,
  0x10, 0x28, 0x02, 0x11, 0x17, 0x03, 0x05, 0x32, 0x02, 0x0A,
  0x44, 0x01, 0x01, 0x5C, 0x02, 0x14, 0x35, 0x01, 0x0D, 0x0A,
  0x01, 0x0F, 0x29, 0x02, 0x16, 0x43, 0x01, 0x01, 0x2A, 0x01,
  0x09, 0x64, 0x01, 0x0E, 0x41, 0x02, 0x11, 0x67, 0x01, 0x10,
  0x73, 0x02, 0x0C, 0x67, 0x02, 0x16, 0x24, 0x01, 0x0B, 0x0D,
  0x01, 0x10, 0x00, 0x01, 0x0D, 0x29, 0x03, 0x0C, 0x23, 0x02,
  0x0A, 0x36, 0x01, 0x01, 0x7C, 0x02, 0x11, 0x78, 0x02, 0x09,
  0x3C, 0x03, 0x0D, 0x04, 0x02, 0x09, 0x21, 0x02, 0x0E, 0x04,
  0x02, 0x0A, 0x07, 0x03, 0x13, 0x31, 0x01, 0x01, 0x1F, 0x03,
  0x0B, 0x17, 0x01, 0x16, 0x5D, 0x02, 0x00, 0x60, 0x03, 0x0B,
  0x36, 0x02, 0x03, 0x01, 0x03, 0x0F, 0x08, 0x03, 0x16, 0x07,
  0x02, 0x07, 0x0B, 0x02, 0x14, 0x3E, 0x02, 0x02, 0x0A, 0x02,
  0x11, 0x32, 0x03, 0x08, 0x54, 0x03, 0x0A, 0x53, 0x02, 0x14,
  0x44, 0x02, 0x11, 0x5F, 0x03, 0x06, 0x0A, 0x03, 0x13, 0x75,
  0x03, 0x10, 0x11, 0x02, 0x07, 0x7A, 0x01, 0x02, 0x48, 0x01,
  0x02, 0x0C, 0x03, 0x0E, 0x69, 0x02, 0x0C, 0x25, 0x01, 0x05,
  0x5E, 0x03, 0x0D, 0x3D, 0x01, 0x0B, 0x4F, 0x01, 0x0F, 0x5B,
  0x01, 0x0F, 0x06, 0x01, 0x06, 0x45, 0x03, 0x0D, 0x02, 0x03,
  0x0A, 0x67, 0x03, 0x16, 0x2E, 0x01, 0x16, 0x00, 0x03, 0x00,
  0x0D, 0x03, 0x17, 0x4E, 0x03, 0x13, 0x17, 0x03, 0x11, 0x3D,
  0x01, 0x07, 0x61, 0x03, 0x15, 0x1F, 0x02, 0x11, 0x1E, 0x03,
  0x15, 0x32, 0x01, 0x08, 0x1A, 0x03, 0x0A, 0x29, 0x02, 0x0A,
  0x76, 0x03, 0x07, 0x2B, 0x03, 0x13, 0x2F, 0x02, 0x09, 0x2E,
  0x02, 0x0E, 0x33, 0x01, 0x12, 0x13, 0x03, 0x16, 0x1F, 0x03,
  0x05, 0x23, 0x02, 0x13, 0x77, 0x01, 0x17, 0x17, 0x01, 0x13,
  0x12, 0x02, 0x03, 0x51, 0x03, 0x00, 0x0F, 0x03, 0x08, 0x4A,
  0x03, 0x17, 0x06, 0x03, 0x10, 0x18, 0x01, 0x14, 0x4E, 0x02,
  0x08, 0x1F, 0x01, 0x13, 0x23, 0x01, 0x0D, 0x6F, 0x01, 0x14,
  0x45, 0x01, 0x0F, 0x23, 0x02, 0x01, 0x5B, 0x02, 0x05, 0x7E,
  0x03, 0x07, 0x36, 0x01, 0x08, 0x1B, 0x01, 0x06, 0x45, 0x02,
  0x0E, 0x1F, 0x03, 0x03, 0x28, 0x01, 0x0C, 0x7D, 0x02, 0x09,
  0x79, 0x01, 0x0D, 0x5E, 0x03, 0x08, 0x4F, 0x01, 0x02, 0x3E,
  0x01, 0x07, 0x5F, 0x03, 0x03, 0x67, 0x02, 0x06, 0x56, 0x02,
  0x01, 0x17, 0x02, 0x16, 0x60, 0x02, 0x04, 0x44, 0x02, 0x10,
  0x40, 0x02, 0x10, 0x66, 0x02, 0x01, 0x61, 0x03, 0x0D, 0x47,
  0x02, 0x11, 0x75, 0x03, 0x0E, 0x57, 0x03, 0x12, 0x75, 0x03,
  0x17, 0x6E, 0x02, 0x15, 0x2D, 0x03, 0x0A, 0x7A, 0x01, 0x11,
  0x02, 0x01, 0x16, 0x31, 0x02, 0x05, 0x34, 0x02, 0x00, 0x35,
  0x03, 0x17, 0x3B, 0x02, 0x10, 0x73, 0x02, 0x0B, 0x4A, 0x01,
  0x01, 0x2D, 0x03, 0x01, 0x1A, 0x01, 0x11, 0x27, 0x01, 0x13,
  0x5C, 0x03, 0x0A, 0x7F, 0x03, 0x15, 0x21, 0x02, 0x00, 0x4E,
  0x03, 0x01, 0x2D, 0x03, 0x0C, 0x5B, 0x02, 0x16, 0x33, 0x01,
  0x04, 0x4C, 0x03, 0x13, 0x7E, 0x03, 0x15, 0x1B, 0x03, 0x0B,
  0x75, 0x02, 0x12, 0x1D, 0x03, 0x0D, 0x63, 0x03, 0x0F, 0x46,
  0x01, 0x06, 0x61, 0x02, 0x13, 0x2F, 0x03, 0x08, 0x41, 0x01,
  0x13, 0x4D, 0x01, 0x03, 0x5E, 0x03, 0x14, 0x17, 0x02, 0x00,
  0x24, 0x01, 0x09, 0x0F, 0x03, 0x0B, 0x04, 0x01, 0x13, 0x66,
  0x01, 0x0C, 0x00, 0x02, 0x17, 0x2E, 0x02, 0x09, 0x50, 0x02,
  0x09, 0x73, 0x01, 0x0D, 0x57, 0x03, 0x00, 0x20, 0x03, 0x05,
  0x1B, 0x01, 0x11, 0x05, 0x01, 0x16, 0x4D, 0x03, 0x07, 0x53,
  0x03, 0x0C, 0x7E, 0x01, 0x16, 0x1B, 0x03, 0x0E, 0x66, 0x02,
  0x02, 0x18, 0x01, 0x14, 0x66, 0x01, 0x01, 0x16, 0x02, 0x09,
  0x38, 0x02, 0x0E, 0x49, 0x01, 0x04, 0x46, 0x01, 0x0F, 0x11,
  0x02, 0x0E, 0x67, 0x02, 0x08, 0x2A, 0x01, 0x15, 0x5A, 0x02,
  0x03, 0x5B, 0x03, 0x0D, 0x55, 0x02, 0x07, 0x3A, 0x01, 0x07,
  0x04, 0x02, 0x00, 0x16, 0x01, 0x04, 0x60, 0x02, 0x0C, 0x0E,
  0x01, 0x17, 0x41, 0x03, 0x0F, 0x52, 0x01, 0x0E, 0x67, 0x01,
  0x03, 0x0D, 0x03, 0x10, 0x3C, 0x03, 0x00, 0x6B, 0x01, 0x11,
  0x4F, 0x03, 0x12, 0x3D, 0x03, 0x05, 0x05, 0x03, 0x04, 0x21,
  0x01, 0x0C, 0x62, 0x02, 0x08, 0x64, 0x02, 0x16, 0x62, 0x02,
  0x07, 0x42, 0x02, 0x0B, 0x74, 0x01, 0x0B, 0x04, 0x02, 0x13,
  0x0A, 0x03, 0x07, 0x39, 0x03, 0x09, 0x1B, 0x03, 0x16, 0x62,
  0x01, 0x17, 0x46, 0x02, 0x01, 0x6D, 0x02, 0x09, 0x1F, 0x02,
  0x10, 0x65, 0x03, 0x16, 0x21, 0x02, 0x06, 0x6E, 0x02, 0x01,
  0x43, 0x02, 0x0B, 0x65, 0x02, 0x12, 0x09, 0x03, 0x05, 0x6E,
  0x02, 0x0C, 0x01, 0x01, 0x13, 0x17, 0x03, 0x15, 0x2B, 0x01,
  0x0D, 0x18, 0x01, 0x0B, 0x1E, 0x01, 0x16, 0x01, 0x01, 0x0C,
  0x1E, 0x03, 0x04, 0x15, 0x02, 0x07, 0x25, 0x02, 0x06, 0x09,
  0x02, 0x13, 0x23, 0x01, 0x14, 0x4D, 0x02, 0x16, 0x05, 0x03,
  0x0A, 0x38, 0x03, 0x16, 0x14, 0x03, 0x03, 0x78, 0x02, 0x17,
  0x28, 0x02, 0x07, 0x76, 0x01, 0x01, 0x24, 0x02, 0x07, 0x06,
  0x01, 0x01, 0x7B, 0x03, 0x00, 0x00, 0x02, 0x0A, 0x6E, 0x01,
  0x12, 0x66, 0x03, 0x05, 0x53, 0x01, 0x04, 0x2E, 0x02, 0x01,
  0x4C, 0x02, 0x04, 0x7D, 0x03, 0x09, 0x69, 0x01, 0x15, 0x1C,
  0x02, 0x0D, 0x71, 0x03, 0x11, 0x50, 0x03, 0x0E, 0x34, 0x01,
  0x05, 0x7F, 0x02, 0x13, 0x49, 0x01, 0x0D, 0x17, 0x01, 0x12,
  0x2A, 0x03, 0x07, 0x13, 0x01, 0x08, 0x4C, 0x02, 0x05, 0x41,
  0x03, 0x0D, 0x18, 0x01, 0x12, 0x4C, 0x03, 0x0A, 0x3A, 0x02,
  0x06, 0x64, 0x02, 0x0B, 0x6E, 0x01, 0x15, 0x52, 0x03, 0x0A,
  0x5B, 0x01, 0x0B, 0x55, 0x03, 0x04, 0x1A, 0x03, 0x0A, 0x54,
  0x03, 0x11, 0x03, 0x02, 0x11, 0x5B, 0x03, 0x09, 0x56, 0x03,
  0x01, 0x0A, 0x02, 0x10, 0x61, 0x03, 0x00, 0x0D, 0x01, 0x14,
  0x2F, 0x02, 0x0D, 0x74, 0x01, 0x17, 0x6A, 0x01, 0x17, 0x7F,
  0x01, 0x00, 0x5D, 0x03, 0x01, 0x3C, 0x03, 0x12, 0x25, 0x03,
  0x0C, 0x20, 0x02, 0x02, 0x60, 0x03, 0x03, 0x55, 0x01, 0x08,
  0x24, 0x02, 0x08, 0x22, 0x03, 0x16, 0x2D, 0x01, 0x03, 0x67,
  0x01, 0x08, 0x20, 0x01, 0x12, 0x12, 0x01, 0x16, 0x5F, 0x02,
  0x0E, 0x04, 0x01, 0x15, 0x2D, 0x03, 0x09, 0x45, 0x02, 0x03,
  0x7A, 0x01, 0x03, 0x35, 0x03, 0x10, 0x07, 0x01, 0x09, 0x7C,
  0x01, 0x0F, 0x5E, 0x02, 0x12, 0x1B, 0x02, 0x0B, 0x1C, 0x03,
  0x07, 0x60, 0x03, 0x04, 0x6C, 0x03, 0x03, 0x0B, 0x02, 0x09,
  0x3A, 0x02, 0x09, 0x04, 0x03, 0x05, 0x51, 0x03, 0x06, 0x72,
  0x03, 0x0F, 0x01, 0x01, 0x03, 0x2D, 0x02, 0x00, 0x04, 0x03,
  0x00, 0x31, 0x02, 0x06, 0x52, 0x03, 0x01, 0x3D, 0x02, 0x0A,
  0x25, 0x02, 0x09, 0x29, 0x02, 0x13, 0x63, 0x03, 0x0E, 0x69,
  0x02, 0x10, 0x63, 0x03, 0x14, 0x20, 0x02, 0x05, 0x00, 0x02,
  0x16, 0x76, 0x03, 0x0E, 0x75, 0x02, 0x15, 0x01, 0x03, 0x0D,
  0x55, 0x02, 0x09, 0x23, 0x01, 0x02, 0x12, 0x03, 0x02, 0x49,
  0x01, 0x0B, 0x6B, 0x02, 0x17, 0x11, 0x02, 0x12, 0x43, 0x01,
  0x15, 0x24, 0x01, 0x0D, 0x27, 0x01, 0x10, 0x06, 0x01, 0x0E,
  0x31, 0x03, 0x17, 0x60, 0x01, 0x03, 0x50, 0x02, 0x0A, 0x3C,
  0x02, 0x06, 0x33, 0x02, 0x00, 0x7B, 0x03, 0x09, 0x22, 0x03,
  0x04, 0x77, 0x03, 0x0F, 0x57, 0x01, 0x17, 0x5E, 0x02, 0x15,
  0x6E, 0x02, 0x0B, 0x0B, 0x03, 0x08, 0x04, 0x03, 0x05, 0x24,
  0x03, 0x0B, 0x0E, 0x01, 0x04, 0x61, 0x03, 0x0B, 0x01, 0x01,
  0x09, 0x5B, 0x01, 0x0E, 0x40, 0x01, 0x17, 0x15, 0x01, 0x10,
  0x6E, 0x01, 0x08, 0x5E, 0x03, 0x08, 0x2B, 0x03, 0x0A, 0x4E,
  0x03, 0x07, 0x3D, 0x02, 0x0A, 0x51, 0x03, 0x0C, 0x6A, 0x01,
  0x13, 0x5F, 0x02, 0x0B, 0x28, 0x03, 0x12, 0x69, 0x01, 0x14,
  0x7C, 0x02, 0x07, 0x1C, 0x01, 0x00, 0x48, 0x03, 0x05, 0x10,
  0x01, 0x12, 0x55, 0x01, 0x11, 0x4A, 0x01, 0x17, 0x23, 0x01,
  0x02, 0x65, 0x03, 0x10, 0x74, 0x03, 0x0C, 0x42, 0x01, 0x00,
  0x49, 0x02, 0x03, 0x16, 0x02, 0x01, 0x12, 0x01, 0x10, 0x3C,
  0x03, 0x11, 0x1D, 0x01, 0x01, 0x6F, 0x03, 0x11, 0x00, 0x02,
  0x0F, 0x16, 0x03, 0x13, 0x00, 0x03, 0x07, 0x73, 0x01, 0x0A,
  0x40, 0x03, 0x07, 0x7C, 0x02, 0x15, 0x41, 0x03, 0x05, 0x35,
  0x01, 0x07, 0x6B, 0x01, 0x0B, 0x1F, 0x01, 0x15, 0x11, 0x03,
  0x08, 0x4E, 0x01, 0x0F, 0x6F, 0x02, 0x0A, 0x65, 0x03, 0x13,
  0x02, 0x01, 0x07, 0x22, 0x02, 0x08, 0x6C, 0x01, 0x0C, 0x13,
  0x02, 0x08, 0x17, 0x03, 0x07, 0x1F, 0x01, 0x07, 0x33, 0x01,
  0x0D, 0x7A, 0x03, 0x01, 0x12, 0x01, 0x16, 0x61, 0x01, 0x0D,
  0x38, 0x02, 0x13, 0x27, 0x03, 0x0D, 0x13, 0x01, 0x04, 0x07,
  0x01, 0x14, 0x67, 0x03, 0x13, 0x08, 0x03, 0x0D, 0x04, 0x01,
  0x00, 0x4C, 0x02, 0x0C, 0x36, 0x01, 0x16, 0x49, 0x02, 0x12,
  0x51, 0x03, 0x08, 0x6C, 0x01, 0x00, 0x73, 0x03, 0x00, 0x47,
  0x03, 0x15, 0x40, 0x01, 0x01, 0x59, 0x01, 0x11, 0x7B, 0x02,
  0x0E, 0x76, 0x03, 0x04, 0x6A, 0x03, 0x0D, 0x5B, 0x01, 0x0B,
  0x30, 0x01, 0x03, 0x6D, 0x03, 0x13, 0x7B, 0x01, 0x17, 0x71,
  0x02, 0x16, 0x41, 0x03, 0x15, 0x5D, 0x01, 0x08, 0x12, 0x02,
  0x0A, 0x41, 0x01, 0x17, 0x1B, 0x01, 0x0C, 0x41, 0x03, 0x00,
  0x33, 0x02, 0x10, 0x4E, 0x01, 0x01, 0x38, 0x02, 0x17, 0x66,
  0x01, 0x11, 0x5F, 0x03, 0x0E, 0x49, 0x01, 0x10, 0x4B, 0x01,
  0x15, 0x67, 0x02, 0x0B, 0x3A, 0x01, 0x15, 0x01, 0x02, 0x14,
  0x5D, 0x03, 0x05, 0x01, 0x02, 0x0D, 0x44, 0x02, 0x09, 0x03,
  0x01, 0x0D, 0x59, 0x03, 0x10, 0x45, 0x01, 0x07, 0x16, 0x03,
  0x02, 0x4A, 0x03, 0x0A, 0x11, 0x03, 0x11, 0x07, 0x01, 0x06,
  0x5D, 0x02, 0x00, 0x7F, 0x03, 0x03, 0x5D, 0x03, 0x03, 0x33,
  0x02, 0x08, 0x6C, 0x03, 0x09, 0x60, 0x02, 0x0E, 0x6C, 0x01,
  0x14, 0x0B, 0x02, 0x02, 0x0A, 0x01, 0x11, 0x24, 0x02, 0x08,
  0x30, 0x03, 0x01, 0x6F, 0x02, 0x00, 0x0B, 0x01, 0x07, 0x13,
  0x02, 0x03, 0x5D, 0x03, 0x08, 0x46, 0x01, 0x15, 0x3A, 0x01,
  0x13, 0x16, 0x02, 0x00, 0x4B, 0x03, 0x11, 0x7F, 0x01, 0x0D,
  0x3B, 0x02, 0x16, 0x61, 0x03, 0x05, 0x7F, 0x03, 0x00, 0x02,
  0x01, 0x02, 0x2F, 0x01, 0x0C, 0x04, 0x01, 0x09, 0x7F, 0x03,
  0x0C, 0x44, 0x03, 0x10, 0x0C, 0x02, 0x0E, 0x3C, 0x02, 0x17,
  0x49, 0x03, 0x16, 0x59, 0x01, 0x01, 0x2C, 0x02, 0x0F, 0x53,
  0x01, 0x12, 0x5E, 0x03, 0x11, 0x06, 0x02, 0x0F, 0x15, 0x01,
  0x08, 0x76, 0x02, 0x0C, 0x70, 0x01, 0x06, 0x2F, 0x01, 0x05,
  0x3C, 0x03, 0x04, 0x04, 0x03, 0x05, 0x3B, 0x01, 0x0E, 0x3C,
  0x01, 0x07, 0x04, 0x03, 0x01, 0x2E, 0x02, 0x0A, 0x1C, 0x02,
  0x0A, 0x2F, 0x02, 0x03, 0x6B, 0x03, 0x0E, 0x5C, 0x01, 0x17,
  0x01, 0x02, 0x13, 0x71, 0x01, 0x00, 0x69, 0x03, 0x02, 0x59,
  0x02, 0x04, 0x46, 0x01, 0x17, 0x6A, 0x01, 0x02, 0x3B, 0x02,
  0x0F, 0x12, 0x03, 0x06, 0x40, 0x01, 0x03, 0x56, 0x02, 0x01,
  0x3C, 0x02, 0x00, 0x23, 0x02, 0x0B, 0x33, 0x01, 0x12, 0x5F,
  0x01, 0x15, 0x43, 0x02, 0x06, 0x4B, 0x01, 0x16, 0x69, 0x02,
  0x14, 0x12, 0x01, 0x11, 0x05, 0x01, 0x0B, 0x5E, 0x02, 0x17,
  0x4A, 0x02, 0x17, 0x21, 0x02, 0x0C, 0x60, 0x01, 0x05, 0x54,
  0x03, 0x0D, 0x1A, 0x01, 0x0C, 0x19, 0x03, 0x0C, 0x7C, 0x02,
  0x01, 0x61, 0x03, 0x06, 0x41, 0x01, 0x05, 0x7F, 0x03, 0x08,
  0x71, 0x03, 0x0B, 0x27, 0x03, 0x15, 0x55, 0x03, 0x01, 0x33,
  0x02, 0x0E, 0x4D, 0x01, 0x06, 0x3E, 0x02, 0x0B, 0x72, 0x03,
  0x12, 0x35, 0x01, 0x03, 0x69, 0x03, 0x12, 0x07, 0x03, 0x13,
  0x7A, 0x02, 0x08, 0x1E, 0x01, 0x11, 0x12, 0x03, 0x17, 0x63,
  0x03, 0x10, 0x38, 0x03, 0x13, 0x70, 0x02, 0x0A, 0x5E, 0x02,
  0x06, 0x38, 0x01, 0x00, 0x47, 0x01, 0x0A, 0x73, 0x03, 0x01,
  0x21, 0x01, 0x09, 0x0B, 0x01, 0x04, 0x7F, 0x03, 0x14, 0x72,
  0x03, 0x06, 0x73, 0x03, 0x0D, 0x2A, 0x03, 0x16, 0x17, 0x02,
  0x13, 0x2A, 0x01, 0x05, 0x65, 0x03, 0x0D, 0x41, 0x02, 0x05,
  0x64, 0x01, 0x11, 0x52, 0x01, 0x0E, 0x45, 0x01, 0x07, 0x5A,
  0x02, 0x06, 0x78, 0x02, 0x0C, 0x30, 0x03, 0x14, 0x77, 0x02,
  0x14, 0x7F, 0x02, 0x12, 0x16, 0x02, 0x09, 0x1E, 0x01, 0x15,
  0x61, 0x02, 0x09, 0x53, 0x02, 0x15, 0x7C, 0x02, 0x17, 0x1E,
  0x03, 0x0A, 0x63, 0x01, 0x0B, 0x1B, 0x02, 0x07, 0x31, 0x01,
  0x0C, 0x09, 0x03, 0x10, 0x1A, 0x01, 0x04, 0x45, 0x02, 0x11,
  0x7C, 0x01, 0x13, 0x45, 0x02, 0x10, 0x67, 0x01, 0x11, 0x16,
  0x01, 0x14, 0x35, 0x02, 0x0B, 0x4B, 0x01, 0x0D, 0x2C, 0x03,
  0x07, 0x7C, 0x02, 0x0C, 0x58, 0x03, 0x14, 0x09, 0x03, 0x07,
  0x7B, 0x01, 0x0A, 0x12, 0x03, 0x0F, 0x3B, 0x01, 0x11, 0x29,
  0x01, 0x0B, 0x29, 0x02, 0x06, 0x0D, 0x02, 0x0D, 0x7E, 0x02,
  0x0C, 0x60, 0x01, 0x12, 0x52, 0x01, 0x0D, 0x04, 0x01, 0x09,
  0x28, 0x01, 0x14, 0x7D, 0x03, 0x0A, 0x43, 0x01, 0x17, 0x63,
  0x01, 0x11, 0x19, 0x02, 0x12, 0x4D, 0x02, 0x08, 0x59, 0x01,
  0x0E, 0x25, 0x01, 0x03, 0x53, 0x03, 0x05, 0x51, 0x02, 0x02,
  0x1D, 0x01, 0x0C, 0x3E, 0x03, 0x13, 0x24, 0x03, 0x08, 0x28,
  0x02, 0x13, 0x64, 0x02, 0x0A, 0x34, 0x03, 0x0E, 0x13, 0x01,
  0x0C, 0x73, 0x03, 0x0B, 0x10, 0x02, 0x0F, 0x51, 0x02, 0x10,
  0x49, 0x02, 0x03, 0x14, 0x03, 0x16, 0x20, 0x03, 0x15, 0x1B,
  0x02, 0x16, 0x06, 0x02, 0x08, 0x0B, 0x02, 0x05, 0x4D, 0x01,
  0x0D, 0x10, 0x01, 0x0D, 0x54, 0x02, 0x11, 0x18, 0x02, 0x15,
  0x0A, 0x01, 0x11, 0x47, 0x01, 0x02, 0x27, 0x01, 0x0B, 0x48,
  0x02, 0x15, 0x22, 0x01, 0x10, 0x7A, 0x01, 0x0E, 0x0E, 0x01,
  0x0A, 0x10, 0x01, 0x13, 0x2C, 0x02, 0x0A, 0x11, 0x01, 0x0A,
  0x2A, 0x03, 0x01, 0x7E, 0x01, 0x0E, 0x35, 0x02, 0x17, 0x2A,
  0x02, 0x16, 0x08, 0x02, 0x09, 0x1A, 0x02, 0x03, 0x33, 0x02,
  0x05, 0x51, 0x03, 0x0A, 0x06, 0x02, 0x0B, 0x7C, 0x01, 0x0C,
  0x46, 0x02, 0x10, 0x3F, 0x01, 0x06, 0x63, 0x01, 0x02, 0x63,
  0x01, 0x0B, 0x5A, 0x03, 0x0A, 0x11, 0x02, 0x0E, 0x0A, 0x01,
  0x0B, 0x31, 0x03, 0x03, 0x27, 0x03, 0x03, 0x21, 0x02, 0x0E,
  0x3B, 0x03, 0x14, 0x0A, 0x03, 0x08, 0x77, 0x03, 0x17, 0x28,
  0x01, 0x15, 0x7A, 0x03, 0x0B, 0x4E, 0x03, 0x0B, 0x51, 0x02,
  0x14, 0x61, 0x02, 0x0E, 0x39, 0x03, 0x0B, 0x66, 0x03, 0x00,
  0x56, 0x01, 0x15, 0x1B, 0x02, 0x13, 0x41, 0x03, 0x0B, 0x7C,
  0x01, 0x13, 0x3E, 0x02, 0x12, 0x04, 0x03, 0x13, 0x72, 0x02,
  0x02, 0x27, 0x01, 0x04, 0x78, 0x01, 0x0C, 0x54, 0x03, 0x13,
  0x02, 0x01, 0x09, 0x74, 0x01, 0x01, 0x10, 0x03, 0x00, 0x6F,
  0x03, 0x05, 0x26, 0x02, 0x05, 0x02, 0x01, 0x02, 0x10, 0x02,
  0x17, 0x3C, 0x02, 0x12, 0x24, 0x01, 0x10, 0x37, 0x01, 0x02,
  0x03, 0x03, 0x13, 0x11, 0x03, 0x16, 0x1D, 0x01, 0x16, 0x5E,
  0x01, 0x14, 0x0E, 0x02, 0x00, 0x53, 0x01, 0x11, 0x01, 0x01,
  0x00, 0x41, 0x01, 0x06, 0x23, 0x03, 0x03, 0x68, 0x03, 0x05,
  0x21, 0x01, 0x02, 0x28, 0x02, 0x0A, 0x43, 0x01, 0x0A, 0x5E,
  0x01, 0x04, 0x11, 0x01, 0x06, 0x03, 0x01, 0x04, 0x0D, 0x03,
  0x0A, 0x54, 0x02, 0x01, 0x5A, 0x02, 0x07, 0x6F, 0x01, 0x0B,
  0x34, 0x03, 0x12, 0x68, 0x02, 0x13, 0x0C, 0x03, 0x00, 0x6D,
  0x01, 0x12, 0x7E, 0x03, 0x06, 0x44, 0x03, 0x10, 0x25, 0x01,
  0x0A, 0x42, 0x02, 0x09, 0x60, 0x03, 0x01, 0x76, 0x03, 0x05,
  0x53, 0x03, 0x0A, 0x3B, 0x02, 0x03, 0x75, 0x03, 0x01, 0x3B,
  0x01, 0x01, 0x62, 0x02, 0x06, 0x6F, 0x03, 0x07, 0x10, 0x03,
  0x02, 0x04, 0x03, 0x11, 0x5B, 0x01, 0x08, 0x5A, 0x01, 0x16,
  0x5C, 0x02, 0x0B, 0x1C, 0x02, 0x04, 0x2B, 0x02, 0x02, 0x53,
  0x03, 0x11, 0x25, 0x01, 0x11, 0x08, 0x03, 0x05, 0x6F, 0x03,
  0x12, 0x36, 0x03, 0x10, 0x68, 0x02, 0x09, 0x15, 0x03, 0x17,
  0x33, 0x03, 0x16, 0x59, 0x02, 0x08, 0x44, 0x02, 0x12, 0x33,
  0x01, 0x15, 0x26, 0x02, 0x16, 0x68, 0x03, 0x05, 0x3F, 0x03,
  0x05, 0x49, 0x03, 0x02, 0x00, 0x02, 0x11, 0x08, 0x02, 0x11,
  0x5E, 0x03, 0x06, 0x7F, 0x03, 0x12, 0x4D, 0x01, 0x14, 0x77,
  0x03, 0x0B, 0x56, 0x02, 0x14, 0x35, 0x02, 0x0D, 0x39, 0x02,
  0x09, 0x18, 0x03, 0x16, 0x03, 0x01, 0x0B, 0x4D, 0x03, 0x07,
  0x0F, 0x01, 0x09, 0x3F, 0x03, 0x15, 0x5E, 0x03, 0x04, 0x67,
  0x01, 0x06, 0x11, 0x03, 0x01, 0x77, 0x01, 0x04, 0x1B, 0x02,
  0x02, 0x5E, 0x03, 0x14, 0x1C, 0x02, 0x13, 0x1D, 0x03, 0x12,
  0x78, 0x01, 0x03, 0x1A, 0x03, 0x10, 0x03, 0x02, 0x05, 0x6D,
  0x01, 0x16, 0x4E, 0x02, 0x15, 0x31, 0x02, 0x0A, 0x2B, 0x01,
  0x0E, 0x4A, 0x03, 0x11, 0x3D, 0x01, 0x06, 0x2D, 0x02, 0x17,
  0x26, 0x02, 0x06, 0x1E, 0x02, 0x13, 0x5B, 0x02, 0x00, 0x54,
  0x01, 0x00, 0x7C, 0x02, 0x0D, 0x5D, 0x02, 0x05, 0x3F, 0x01,
  0x08, 0x01, 0x03, 0x11, 0x3A, 0x01, 0x13, 0x70, 0x03, 0x12,
  0x78, 0x02, 0x0C, 0x50, 0x01, 0x10, 0x6C, 0x01, 0x07, 0x1E,
  0x01, 0x03, 0x4D, 0x02, 0x15, 0x18, 0x02, 0x0A, 0x4A, 0x02,
  0x15, 0x3F, 0x01, 0x16, 0x20, 0x03, 0x01, 0x41, 0x02, 0x06,
  0x2E, 0x02, 0x12, 0x64, 0x02, 0x0D, 0x64, 0x02, 0x16, 0x18,
  0x02, 0x0B, 0x2C, 0x03, 0x08, 0x4A, 0x02, 0x04, 0x17, 0x03,
  0x10, 0x60, 0x01, 0x14, 0x31, 0x02, 0x0B, 0x3E, 0x01, 0x00,
  0x52, 0x03, 0x0C, 0x2B, 0x01, 0x0D, 0x15, 0x02, 0x01, 0x2B,
  0x02, 0x17, 0x73, 0x01, 0x14, 0x74, 0x03, 0x10, 0x20, 0x03,
  0x15, 0x5F, 0x02, 0x11, 0x59, 0x02, 0x16, 0x01, 0x03, 0x0F,
  0x5B, 0x02, 0x04, 0x3F, 0x01, 0x0B, 0x2B, 0x02, 0x0A, 0x1A,
  0x03, 0x01, 0x23, 0x03, 0x10, 0x64, 0x03, 0x0A, 0x17, 0x03,
  0x17, 0x46, 0x01, 0x03, 0x27, 0x02, 0x12, 0x25, 0x02, 0x11,
  0x3A, 0x03, 0x17, 0x0A, 0x03, 0x14, 0x21, 0x01, 0x17, 0x5F,
  0x03, 0x0D, 0x56, 0x02, 0x10, 0x77, 0x01, 0x15, 0x5B, 0x03,
  0x03, 0x10, 0x01, 0x0B, 0x11, 0x01, 0x0D, 0x2C, 0x02, 0x11,
  0x3A, 0x01, 0x0D, 0x5B, 0x03, 0x10, 0x40, 0x03, 0x16, 0x24,
  0x03, 0x10, 0x28, 0x03, 0x17, 0x05, 0x02, 0x08, 0x46, 0x01,
  0x14, 0x2B, 0x03, 0x0A, 0x0A, 0x01, 0x0E, 0x1A, 0x03, 0x0B,
  0x69, 0x03, 0x15, 0x2D, 0x03, 0x0B, 0x3B, 0x01, 0x08, 0x17,
  0x03, 0x0A, 0x58, 0x01, 0x00, 0x60, 0x01, 0x0F, 0x0E, 0x02,
  0x02, 0x62, 0x02, 0x0E, 0x02, 0x02, 0x0C, 0x09, 0x01, 0x04,
  0x53, 0x03, 0x07, 0x1B, 0x02, 0x10, 0x01, 0x03, 0x03, 0x67,
  0x02, 0x04, 0x26, 0x02, 0x07, 0x75, 0x03, 0x17, 0x02, 0x02,
  0x0F, 0x1D, 0x02, 0x00, 0x18, 0x01, 0x0A, 0x0B, 0x02, 0x0B,
  0x0D, 0x01, 0x17, 0x04, 0x01, 0x0B, 0x1F, 0x02, 0x13, 0x2F,
  0x02, 0x01, 0x42, 0x02, 0x14, 0x4C, 0x03, 0x0A, 0x1A, 0x03,
  0x0D, 0x2B, 0x01, 0x12, 0x0F, 0x01, 0x04, 0x25, 0x02, 0x09,
  0x3C, 0x02, 0x14, 0x1B, 0x02, 0x0F, 0x2C, 0x01, 0x11, 0x05,
  0x02, 0x05, 0x49, 0x01, 0x06, 0x4B, 0x03, 0x0F, 0x0F, 0x01,
  0x02, 0x0C, 0x03, 0x07, 0x7F, 0x03, 0x12, 0x42, 0x01, 0x01,
  0x7F, 0x01, 0x05, 0x53, 0x01, 0x04, 0x5A, 0x03, 0x17, 0x58,
  0x02, 0x04, 0x01, 0x01, 0x16, 0x31, 0x03, 0x0B, 0x53, 0x01,
  0x11, 0x58, 0x02, 0x17, 0x37, 0x02, 0x0D, 0x24, 0x01, 0x00,
  0x31, 0x03, 0x15, 0x49, 0x01, 0x0F, 0x31, 0x02, 0x0F, 0x65,
  0x03, 0x03, 0x72, 0x01, 0x11, 0x5D, 0x03, 0x10, 0x17, 0x02,
  0x05, 0x22, 0x03, 0x03, 0x22, 0x02, 0x05, 0x32, 0x01, 0x09,
  0x72, 0x03, 0x00, 0x7B, 0x03, 0x0E, 0x5F, 0x01, 0x11, 0x46,
  0x01, 0x07, 0x42, 0x03, 0x03, 0x43, 0x03, 0x16, 0x7F, 0x01,
  0x15, 0x45, 0x01, 0x05, 0x3F, 0x01, 0x03, 0x5A, 0x01, 0x0D,
  0x1A, 0x03, 0x11, 0x75, 0x01, 0x00, 0x11, 0x03, 0x16, 0x6E,
  0x02, 0x17, 0x73, 0x01, 0x15, 0x55, 0x03, 0x0E, 0x19, 0x01,
  0x15, 0x2C, 0x02, 0x11, 0x6B, 0x01, 0x01, 0x04, 0x03, 0x04,
  0x78, 0x02, 0x0C, 0x5E, 0x02, 0x07, 0x76, 0x01, 0x13, 0x51,
  0x02, 0x15, 0x33, 0x02, 0x11, 0x53, 0x01, 0x17, 0x7A, 0x01,
  0x12, 0x3D, 0x03, 0x12, 0x61, 0x01, 0x09, 0x4A, 0x03, 0x14,
  0x1C, 0x01, 0x15, 0x04, 0x01, 0x14, 0x11, 0x01, 0x14, 0x7B,
  0x02, 0x14, 0x71, 0x03, 0x16, 0x6A, 0x01, 0x03, 0x42, 0x03,
  0x0C, 0x03, 0x03, 0x10, 0x48, 0x02, 0x0D, 0x68, 0x02, 0x00,
  0x5E, 0x03, 0x15, 0x4D, 0x02, 0x06, 0x7D, 0x01, 0x05, 0x2C,
  0x01, 0x07, 0x4E, 0x02, 0x0D, 0x29, 0x03, 0x17, 0x77, 0x02,
  0x0F, 0x15, 0x03, 0x17, 0x66, 0x02, 0x09, 0x45, 0x02, 0x0E,
  0x68, 0x01, 0x13, 0x56, 0x02, 0x16, 0x73, 0x02, 0x0E, 0x6D,
  0x01, 0x0E, 0x39, 0x01, 0x04, 0x76, 0x02, 0x07, 0x52, 0x03,
  0x12, 0x30, 0x02, 0x0E, 0x50, 0x03, 0x06, 0x12, 0x02, 0x0F,
  0x50, 0x03, 0x10, 0x40, 0x02, 0x10, 0x2F, 0x03, 0x07, 0x74,
  0x02, 0x11, 0x50, 0x01, 0x0D, 0x7F, 0x02, 0x13, 0x1C, 0x01,
  0x0B, 0x26, 0x02, 0x00, 0x11, 0x03, 0x0F, 0x72, 0x03, 0x01,
  0x5A, 0x01, 0x16, 0x36, 0x01, 0x10, 0x37, 0x03, 0x08, 0x22,
  0x03, 0x0C, 0x50, 0x02, 0x04, 0x5D, 0x02, 0x0B, 0x08, 0x01,
  0x0C, 0x50, 0x03, 0x0A, 0x6A, 0x01, 0x17, 0x34, 0x01, 0x0C,
  0x71, 0x02, 0x06, 0x1F, 0x01, 0x08, 0x22, 0x02, 0x05, 0x43,
  0x02, 0x05, 0x68, 0x03, 0x05, 0x26, 0x03, 0x02, 0x57, 0x01,
  0x11, 0x7C, 0x03, 0x0B, 0x64, 0x01, 0x15, 0x2D, 0x01, 0x06,
  0x59, 0x03, 0x13, 0x24, 0x03, 0x02, 0x49, 0x03, 0x04, 0x70,
  0x01, 0x13, 0x2F, 0x01, 0x12, 0x72, 0x01, 0x08, 0x0E, 0x02,
  0x0D, 0x3B, 0x01, 0x03, 0x2F, 0x01, 0x11, 0x69, 0x01, 0x08,
  0x49, 0x02, 0x01, 0x36, 0x02, 0x11, 0x51, 0x03, 0x0B, 0x01,
  0x03, 0x10, 0x49, 0x01, 0x11, 0x5D, 0x02, 0x12, 0x72, 0x03,
  0x10, 0x6C, 0x03, 0x05, 0x00, 0x01, 0x04, 0x4A, 0x01, 0x14,
  0x20, 0x02, 0x05, 0x26, 0x01, 0x01, 0x01, 0x02, 0x09, 0x75,
  0x02, 0x01, 0x0C, 0x01, 0x0F, 0x64, 0x01, 0x17, 0x36, 0x03,
  0x02, 0x2D, 0x03, 0x00, 0x61, 0x03, 0x07, 0x64, 0x02, 0x12,
  0x2E, 0x02, 0x12, 0x29, 0x01, 0x05, 0x7D, 0x01, 0x02, 0x32,
  0x01, 0x10, 0x2C, 0x02, 0x08, 0x4B, 0x03, 0x0C, 0x74, 0x03,
  0x06, 0x33, 0x02, 0x05, 0x1B, 0x01, 0x0C, 0x22, 0x03, 0x16,
  0x6C, 0x03, 0x01, 0x6B, 0x03, 0x02, 0x03, 0x01, 0x02, 0x43,
  0x02, 0x05, 0x5B, 0x03, 0x17, 0x15, 0x02, 0x15, 0x3B, 0x02,
  0x12, 0x0A, 0x01, 0x05, 0x01, 0x02, 0x14, 0x25, 0x02, 0x02,
  0x11, 0x03, 0x05, 0x4C, 0x02, 0x0D, 0x2F, 0x02, 0x0B, 0x3A,
  0x03, 0x12, 0x1E, 0x01, 0x01, 0x5D, 0x01, 0x14, 0x38, 0x03,
  0x09, 0x47, 0x03, 0x0B, 0x6C, 0x03, 0x0A, 0x04, 0x03, 0x0C,
  0x21, 0x01, 0x16, 0x0B, 0x03, 0x0E, 0x23, 0x03, 0x10, 0x0A,
  0x01, 0x0A, 0x24, 0x01, 0x01, 0x42, 0x03, 0x10, 0x33, 0x03,
  0x08, 0x50, 0x03, 0x01, 0x22, 0x02, 0x04, 0x16, 0x02, 0x08,
  0x29, 0x01, 0x03, 0x20, 0x03, 0x04, 0x1A, 0x01, 0x0C, 0x2E,
  0x03, 0x0C, 0x2A, 0x02, 0x15, 0x0D, 0x02, 0x0D, 0x47, 0x01,
  0x0F, 0x49, 0x01, 0x05, 0x5D, 0x03, 0x16, 0x41, 0x02, 0x09,
  0x1F, 0x01, 0x11, 0x00, 0x03, 0x08, 0x51, 0x02, 0x12, 0x14,
  0x02, 0x12, 0x06, 0x03, 0x05, 0x7F, 0x03, 0x0D, 0x5A, 0x03,
  0x0B, 0x61, 0x02, 0x01, 0x78, 0x02, 0x13, 0x1A, 0x02, 0x11,
  0x01, 0x01, 0x0E, 0x11, 0x02, 0x0A, 0x01, 0x01, 0x05, 0x7E,
  0x02, 0x16, 0x1C, 0x02, 0x10, 0x21, 0x02, 0x11, 0x30, 0x03,
  0x08, 0x75, 0x03, 0x0C, 0x15, 0x03, 0x13, 0x1B, 0x03, 0x16,
  0x43, 0x01, 0x08, 0x66, 0x03, 0x17, 0x43, 0x03, 0x0D, 0x46,
  0x01, 0x00, 0x02, 0x01, 0x02, 0x12, 0x01, 0x15, 0x14, 0x03,
  0x0B, 0x63, 0x03, 0x11, 0x08, 0x02, 0x16, 0x40, 0x03, 0x02,
  0x62, 0x02, 0x02, 0x0F, 0x03, 0x0B, 0x13, 0x01, 0x09, 0x69,
  0x01, 0x03, 0x3A, 0x02, 0x0E, 0x43, 0x03, 0x09, 0x29, 0x02,
  0x00, 0x15, 0x02, 0x08, 0x5F, 0x02, 0x00, 0x06, 0x02, 0x03,
  0x69, 0x01, 0x08, 0x13, 0x03, 0x13, 0x75, 0x03, 0x02, 0x58,
  0x03, 0x04, 0x7D, 0x01, 0x07, 0x2E, 0x03, 0x00, 0x3A, 0x01,
  0x16, 0x4C, 0x02, 0x01, 0x42, 0x03, 0x12, 0x65, 0x01, 0x13,
  0x78, 0x02, 0x08, 0x7A, 0x03, 0x0C, 0x7A, 0x01, 0x01, 0x40,
  0x02, 0x0B, 0x41, 0x01, 0x16, 0x10, 0x01, 0x17, 0x1A, 0x01,
  0x08, 0x6D, 0x03, 0x0F, 0x74, 0x03, 0x09, 0x00, 0x01, 0x00,
  0x1F, 0x03, 0x13, 0x30, 0x03, 0x04, 0x6A, 0x01, 0x06, 0x30,
  0x02, 0x10, 0x56, 0x03, 0x0B, 0x76, 0x02, 0x16, 0x1D, 0x02,
  0x0F, 0x28, 0x02, 0x08, 0x25, 0x03, 0x07, 0x40, 0x01, 0x13,
  0x7D, 0x03, 0x10, 0x6B, 0x01, 0x17, 0x34, 0x03, 0x04, 0x02,
  0x01, 0x00, 0x77, 0x03, 0x01, 0x51, 0x01, 0x08, 0x19, 0x03,
  0x0E, 0x38, 0x02, 0x11, 0x31, 0x03, 0x0F, 0x2B, 0x02, 0x11,
  0x1A, 0x01, 0x0E, 0x49, 0x01, 0x10, 0x72, 0x01, 0x0C, 0x70,
  0x01, 0x0D, 0x25, 0x03, 0x12, 0x15, 0x01, 0x02, 0x01, 0x03,
  0x0B, 0x74, 0x03, 0x12, 0x65, 0x02, 0x01, 0x61, 0x03, 0x07,
  0x62, 0x01, 0x13, 0x39, 0x03, 0x16, 0x5D, 0x03, 0x13, 0x50,
  0x03, 0x0B, 0x3D, 0x01, 0x09, 0x07, 0x02, 0x03, 0x31, 0x01,
  0x0B, 0x38, 0x01, 0x0B, 0x3E, 0x03, 0x05, 0x1A, 0x03, 0x03,
  0x40, 0x03, 0x12, 0x28, 0x03, 0x09, 0x1E, 0x03, 0x01, 0x65,
  0x02, 0x04, 0x17, 0x01, 0x10, 0x29, 0x01, 0x0B, 0x77, 0x03,
  0x14, 0x3F, 0x01, 0x01, 0x65, 0x02, 0x13, 0x67, 0x02, 0x04,
  0x30, 0x02, 0x13, 0x00, 0x01, 0x00, 0x1A, 0x03, 0x03, 0x5E,
  0x03, 0x15, 0x56, 0x02, 0x09, 0x0F, 0x02, 0x0B, 0x74, 0x01,
  0x0E, 0x6C, 0x01, 0x03, 0x7C, 0x02, 0x0B, 0x3B, 0x02, 0x0A,
  0x3A, 0x02, 0x12, 0x4B, 0x03, 0x13, 0x72, 0x01, 0x16, 0x26,
  0x02, 0x03, 0x35, 0x03, 0x02, 0x2A, 0x01, 0x01, 0x55, 0x01,
  0x0A, 0x3F, 0x01, 0x14, 0x55, 0x02, 0x12, 0x10, 0x02, 0x06,
  0x15, 0x02, 0x09, 0x40, 0x03, 0x07, 0x61, 0x03, 0x09, 0x3B,
  0x01, 0x0C, 0x38, 0x01, 0x03, 0x37, 0x03, 0x0B, 0x1A, 0x02,
  0x12, 0x09, 0x03, 0x11, 0x4C, 0x03, 0x07, 0x70, 0x01, 0x11,
  0x14, 0x03, 0x07, 0x75, 0x01, 0x02, 0x1A, 0x01, 0x00, 0x5D,
  0x02, 0x09, 0x2A, 0x03, 0x09, 0x74, 0x03, 0x05, 0x69, 0x02,
  0x0A, 0x35, 0x03, 0x05, 0x32, 0x01, 0x17, 0x58, 0x02, 0x00,
  0x6A, 0x03, 0x14, 0x58, 0x01, 0x0D, 0x7C, 0x01, 0x14, 0x34,
  0x03, 0x13, 0x67, 0x03, 0x12, 0x67, 0x03, 0x07, 0x31, 0x02,
  0x15, 0x21, 0x02, 0x0B, 0x49, 0x02, 0x10, 0x25, 0x01, 0x0D,
  0x14, 0x01, 0x13, 0x25, 0x01, 0x06, 0x20, 0x03, 0x10, 0x3C,
  0x02, 0x0B, 0x5A, 0x02, 0x07, 0x52, 0x01, 0x07, 0x06, 0x03,
  0x02, 0x70, 0x01, 0x16, 0x04, 0x03, 0x0B, 0x52, 0x02, 0x01,
  0x2B, 0x01, 0x04, 0x16, 0x01, 0x06, 0x7F, 0x01, 0x00, 0x0B,
  0x02, 0x15, 0x59, 0x02, 0x06, 0x03, 0x02, 0x06, 0x3F, 0x02,
  0x08, 0x34, 0x03, 0x05, 0x56, 0x02, 0x12, 0x04, 0x02, 0x15,
  0x73, 0x01, 0x06, 0x1A, 0x03, 0x0D, 0x7E, 0x03, 0x0D, 0x3B,
  0x02, 0x03, 0x40, 0x01, 0x00, 0x6B, 0x02, 0x15, 0x7F, 0x03,
  0x09, 0x08, 0x01, 0x17, 0x5C, 0x03, 0x09, 0x22, 0x03, 0x13,
  0x05, 0x02, 0x16, 0x0F, 0x01, 0x0B, 0x5C, 0x03, 0x01, 0x76,
  0x01, 0x04, 0x5D, 0x02, 0x05, 0x64, 0x01, 0x01, 0x4A, 0x01,
  0x05, 0x33, 0x01, 0x01, 0x08, 0x02, 0x04, 0x2B, 0x02, 0x0E,
  0x1D, 0x03, 0x07, 0x38, 0x02, 0x10, 0x46, 0x03, 0x09, 0x07,
  0x02, 0x08, 0x4A, 0x02, 0x06, 0x43, 0x03, 0x01, 0x45, 0x02,
  0x07, 0x7A, 0x02, 0x0E, 0x78, 0x02, 0x06, 0x56, 0x01, 0x07,
  0x4F, 0x02, 0x03, 0x57, 0x02, 0x11, 0x49, 0x02, 0x00, 0x18,
  0x03, 0x0A, 0x17, 0x02, 0x08, 0x08, 0x01, 0x17, 0x3D, 0x03,
  0x09, 0x19, 0x01, 0x17, 0x35, 0x01, 0x05, 0x1C, 0x03, 0x0B,
  0x16, 0x03, 0x0F, 0x43, 0x03, 0x08, 0x10, 0x03, 0x11, 0x14,
  0x03, 0x00, 0x2E, 0x01, 0x02, 0x11, 0x02, 0x06, 0x68, 0x01,
  0x0E, 0x2E, 0x01, 0x0A, 0x18, 0x01, 0x09, 0x36, 0x02, 0x16,
  0x60, 0x02, 0x0A, 0x3A, 0x02, 0x10, 0x29, 0x02, 0x12, 0x50,
  0x02, 0x17, 0x5B, 0x02, 0x12, 0x3E, 0x01, 0x0D, 0x58, 0x02,
  0x14, 0x67, 0x03, 0x0F, 0x24, 0x01, 0x14, 0x50, 0x01, 0x12,
  0x70, 0x03, 0x0C, 0x0D, 0x03, 0x14, 0x49, 0x01, 0x09, 0x16]

# print(len(b))

num = 15000
for i in range(5000):
    num -= 3
    v0 = b[num]
    v1 = b[num+1]
    v3 = b[num+2]
    if v0 == 0x01:
        dword_601060[v1] -= v3
    elif v0 == 0x02:
        dword_601060[v1] += v3
    elif v0 == 0x03:
        dword_601060[v1] ^= v3
    elif v0 == 0x04:
        dword_601060[v1] = dword_601060[v1]/v3
    elif v0 == 0x05:
        dword_601060[v1] ^= dword_601060[v3]
    else:
        continue

flag = ''
for i in range(24):
    flag += chr(dword_601060[i] % 128)   #char类型每4位取最低位

print(flag)

得到flag：nctf{Embr4ce_Vm_j0in_R3}

normal6

这是一道安卓题，老样子先进jeb中查看一下

找到重要的so文件，我们将文件解压一下，在lib文件夹中找到so文件拖入ida32，

又回到了熟悉的问题，如何找到关键函数，我们搜索字符串

两处双击进入

很明显，不在这，我们定位到1号字符串

在1号字符串处点X跳转在F5反编译。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
Word16 sub_1233(Word16 x, Word16 y)
{
  int v2; // r2
  int v3; // r5
  int v4; // r4
  char *v5; // r6
  signed int v6; // r4
  unsigned __int8 *v7; // r0
  unsigned __int8 *v8; // r5
  size_t v9; // r0
  signed int v10; // r2
  _BYTE *v11; // r3
  int v12; // t1
  const char *v13; // r2
  int v14; // r3
  int v15; // t1
  int v16; // t1

  v3 = x;
  v4 = v2;
  v5 = (char *)(*(int (__fastcall **)(Word16, int, _DWORD))(*(_DWORD *)x + 736))(x, v2, 0);  //就是输入
  v6 = (*(int (__fastcall **)(int, int))(*(_DWORD *)v3 + 684))(v3, v4);                 //输入的大小
  v7 = (unsigned __int8 *)malloc(v6);
  v8 = v7;
  if ( v6 <= 0 )
  {
    v7[v6] = 0;
    LOBYTE(v7) = 1;
  }
  else
  {
    v9 = strlen(asc_4028) + 47;
    v10 = v6;
    v11 = v8;
    do
    {
      v12 = *v5++;                             //v12就是答案
      --v10;
    *v11++ = asc_4028[v9 - v12] ^ 0x5F;       //1号字符串=二号字符串[v9-v12]^0x5F
    }
    while ( v10 );
    v8[v6] = 0;
    v13 = "vrt~rzey{vvyt{v";
    LOBYTE(v7) = 1;
    do                                     //下面的do-while循环与寻找v13与哪个值有关
    { 
      v15 = *v8++;
      v14 = v15;
      v16 = *(unsigned __int8 *)v13++;
      if ( v16 != v14 )
        LOBYTE(v7) = 0;
      --v6;
    }
    while ( v6 );
  }
  LOWORD(v7) = (unsigned __int8)v7;
  return (__int16)v7;
}

乍一看条理非常不清晰，但仔细分析一下就出来了。asc_4028是存2号字符串的 “!:#”,0x24,”%&()+-“ , vrt~rzey{vvyt{v是一号字符串，我们先跟踪一下v13是什么，是字符串。还是v16，又因为v16与v14对比了，所以还是v14，还是v15，那么就是v8，v8又等于v11。那么v9是什么v9 = strlen(asc_4028) + 47，所以v9=57，v12是什么？v12代表v5这个数组，v5又与x有关，那么我们有理由怀疑v5是我们要找的字符串，那么我们现在的目标是找v12是多少。好了，已经全部清楚了

给出脚本：

1
2
3
4
5
6
7
8
9
data1="vrt~rzey{vvyt{v"
data2="!:#"+chr(0x24)+"%&()+-"
flag=""
for i in range(15):
  for j in range(10):
     if ord(data1[i]) ^ 0x5F == ord(data2[j]):
       flag += chr(57-j)
print(flag)
#201905846224162

normal7

又是一道安卓逆向，用jeb打开，发现jeb过期了，下了个jeb-patch补了一下。

发现字符串，很像是base64变表，又找到：

用base64试一下，

1
2
3
4
5
6
7
8
9
10
import base64
t1="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
t2='αβγδεζηθικλμνξοπρσ89+/さしすせそたちτυφχψω012345てとゐなにぬねの67つっはひふへほゑま;;;'
data="すひ6ねτ3/7しはξ2すつιのν92φτひ/なしひξねたさ+ψιρ;;"
result = ''
flag=""
for ch in data:
  result += t1[t2.index(ch)]
result = bytearray(base64.b64decode(result+"=="))
print(result)

成功了bytearray(b’clover_Sec2019_wel_come!!\x0f<’)

这里有几点要注意，在jeb得反编译中不可copy，只能在strings中来copy。

而且变表是不全的，所以要进行一下补充“ ； ； ；”

normal8

z3求解器的使用

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
int64 __fastcall main(int a1, char **a2, char **a3)
{
  char s[56]; // [rsp+0h] [rbp-40h] BYREF
  unsigned __int64 v5; // [rsp+38h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  memset(s, 0, 0x30uLL);
  puts("You are a good Reverser!");
  puts(off_602250);
  puts("wakalimasu.Give me your starlight!");
  fgets(s, 47, stdin);
  if ( (unsigned __int8)sub_40094C(s) )
    puts("you are top star!");
  else
    puts("non-non dayo~");
  return 0LL;
}

off_602250里是一张图片，我也没看出来是啥东西，好像是个鹿。

我们真正重要的是sub_40094C这个函数，我们进入

__

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
int64 __fastcall sub_40094C(const char *a1)
{
  unsigned __int8 v2; // [rsp+13h] [rbp-2Dh]
  int i; // [rsp+14h] [rbp-2Ch]
  int j; // [rsp+18h] [rbp-28h]
  int v5; // [rsp+1Ch] [rbp-24h]
  _DWORD *ptr; // [rsp+20h] [rbp-20h]
  _DWORD *v7; // [rsp+28h] [rbp-18h]
  _DWORD *v8; // [rsp+30h] [rbp-10h]
  _DWORD *v9; // [rsp+38h] [rbp-8h]

  v2 = 1;
  v5 = strlen(a1);
  if ( v5 > 37 )
    return 0LL;
  ptr = (_DWORD *)sub_400736(36LL);
  v7 = (_DWORD *)sub_400736(36LL);
  for ( i = 0; i < v5; ++i )
  {
    ptr[i] = a1[i] >> 4;
    v7[i] = a1[i] & 0xF;
  }
  v8 = (_DWORD *)sub_40078E((__int64)ptr, (__int64)&data3, 6);
  v9 = (_DWORD *)sub_400892(v7, &data3, 6LL);
  for ( j = 0; j <= 35; ++j )
  {
    if ( v8[j] != data1[j] || v9[j] != data2[j] )    //不满足就返回0
      v2 = 0;
  }
  free(ptr);
  free(v7);
  free(v8);
  free(v9);
  return v2;
}

free这个函数，毫无作用，不用管，sub_400736这个函数是开辟空间的，没有用。我们一定要满足上面的判断式，如果不满足返回0，那么就寄了，我们可以提取出data1和data2的数组，那么变化后的v8和v9就知道了，而且我们知道flag长度36 . 我们再倒推，总共有两个函数，sub_40078E对ptr变化，sub_400892对v7变换，我们再看上面，ptr是由flag右移4位得到，v7是由flag&15得到的。那我们只用逆其中一个算法就行了。

先看sub_40078E函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
_DWORD *__fastcall sub_40078E(__int64 a1, __int64 a2, int a3)
{
  int i; // [rsp+2Ch] [rbp-14h]
  int j; // [rsp+30h] [rbp-10h]
  int k; // [rsp+34h] [rbp-Ch]
  _DWORD *v8; // [rsp+38h] [rbp-8h]

  v8 = sub_400736(a3);
  for ( i = 0; i < a3; ++i )
  {
    for ( j = 0; j < a3; ++j )
    {
      for ( k = 0; k < a3; ++k )
        v8[a3 * i + j] += *(_DWORD *)(4LL * (a3 * i + k) + a1) * *(_DWORD *)(4LL * (a3 * k + j) + a2);
    }
  }
  return v8;
}

再看sub_400892函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
_DWORD *__fastcall sub_400892(__int64 a1, __int64 a2, int a3)
{
  int i; // [rsp+20h] [rbp-10h]
  int j; // [rsp+24h] [rbp-Ch]
  _DWORD *v7; // [rsp+28h] [rbp-8h]

  v7 = sub_400736(a3);
  for ( i = 0; i < a3; ++i )
  {
    for ( j = 0; j < a3; ++j )
      v7[a3 * i + j] = *(_DWORD *)(4LL * (a3 * i + j) + a1) + *(_DWORD *)(4LL * (a3 * i + j) + a2);
  }
  return v7;
}

这两个嵌套了三层循环，实在有些不好逆，那我们只能采用z3库来解决问题了。

介绍一下z3库的大致解题思路：

1
from z3 import*                 #引入z3
1
s=Solver()                      #创建求解器
1
flag=[Int('flag%d'%i) for i in range(64)]                      #int类型
1
flag = [BitVec("flag%d" % i, 8) for i in range(36)]            #按位运算，每一位有8字节大小空间
1
s.add()                        #约束条件
1
2
3
4
5
6
7
8
9
if s.check() == sat:                              #检查机制，如果有解就输出，无解就错误
    m = s.model()
    res = []
    for i in range(36):
        res.append(chr(m[flag[i]].as_long()))
        s=''.join(res)
    print(s)
else:
    print(nope)

给出官方中文翻译版：https://arabelatso.github.io/2018/06/14/Z3%20API%20in%20Python/

给出脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
from z3 import*
data1=[0x0000007A, 0x000000CF, 0x0000008C, 0x00000095, 0x0000008E, 0x000000A8, 0x0000005F, 0x000000C9, 0x0000007A, 0x00000091, 0x00000088, 0x000000A7, 0x00000070, 0x000000C0, 0x0000007F, 0x00000089, 0x00000086, 0x00000093, 0x0000005F, 0x000000CF, 0x0000006E, 0x00000086, 0x00000085, 0x000000AD, 0x00000088, 0x000000D4, 0x000000A0, 0x000000A2, 0x00000098, 0x000000B3, 0x00000079, 0x000000C1, 0x0000007E, 0x0000007E, 0x00000077, 0x00000093]
data2=[0x00000010, 0x00000008, 0x00000008, 0x0000000E, 0x00000006, 0x0000000B, 0x00000005, 0x00000017, 0x00000005, 0x0000000A, 0x0000000C, 0x00000017, 0x0000000E, 0x00000017, 0x00000013, 0x00000007, 0x00000008, 0x0000000A, 0x00000004, 0x0000000D, 0x00000016, 0x00000011, 0x0000000B, 0x00000016, 0x00000006, 0x0000000E, 0x00000002, 0x0000000B, 0x00000012, 0x00000009, 0x00000005, 0x00000008, 0x00000008, 0x0000000A, 0x00000010, 0x0000000D]
data3=[0x00000008, 0x00000001, 0x00000007, 0x00000001, 0x00000001, 0x00000000, 0x00000004, 0x00000008, 0x00000001, 0x00000002, 0x00000003, 0x00000009, 0x00000003, 0x00000008, 0x00000006, 0x00000006, 0x00000004, 0x00000008, 0x00000003, 0x00000005, 0x00000007, 0x00000008, 0x00000008, 0x00000007, 0x00000000, 0x00000009, 0x00000000, 0x00000002, 0x00000003, 0x00000004, 0x00000002, 0x00000003, 0x00000002, 0x00000005, 0x00000004, 0x00000000]
s=Solver()
flag = [BitVec("flag%d" % i, 8) for i in range(36)]
ptr = [(i >> 4) for i in flag]                         #每一位右移4，很精妙的表达
v7 = [(i & 15) for i in flag]
v8 = [0 for i in range(36)]
v9 = [0 for i in range(36)]
for i in range(len(flag)):                               #限制在可见字符内
    s.add(flag[i] < 127)
    s.add(flag[i] > 32)

for i in range(6):
    for j in range(6):
        for k in range(6):
            v8[6*i+j]+=ptr[6*i+k]*data3[6*k+j]                 

for i in range(6):
    for j in range(6):
        v9[6*i+j]=v7[6*i+j]+data3[6*i+j]

for i in range(36):
    s.add(v8[i]==data1[i])                               #两个约束条件
    s.add(v9[i]==data2[i])
if s.check() == sat:
    m = s.model()
    res = []
    for i in range(36):
        res.append(chr(m[flag[i]].as_long()))          
        s=''.join(res)
    print(s)
else:
    print(nope)
    
    
 #hgame{1_think_Matr1x_is_very_usef5l}

normal9

我认为是由于我使用的是ida7.6所以功能更强大，所以反编译看的还是很清楚的，就是两个数组异或。

normal10

先玩一个掷骰子的游戏，动调一下，一直F8就过了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
int __cdecl main(int argc, const char **argv, const char **envp)
{
  __int64 v3; // rax
  __int64 v4; // rdx
  unsigned int v5; // ebx
  __int64 v6; // rdx
  __int64 v7; // rax
  __int64 v8; // rax
  __int64 v9; // rdx
  __int64 v10; // rax
  __int64 v11; // rax
  __int64 v12; // rdx
  __int64 v13; // rax
  __int64 v14; // rdx
  __int64 v15; // rax
  __int64 v16; // rax
  __int64 v17; // rdx
  __int64 v18; // rax
  unsigned int v20; // [rsp+8h] [rbp-48h] BYREF
  unsigned int v21; // [rsp+Ch] [rbp-44h]
  char v22[40]; // [rsp+10h] [rbp-40h] BYREF
  unsigned __int64 v23; // [rsp+38h] [rbp-18h]

  v23 = __readfsqword(0x28u);
  v3 = std::operator<<<std::char_traits<char>>(
         &std::cout,
         "to continue, you have to guess the value of my dice first!",
         envp);
  std::ostream::operator<<(v3, (__int64)&std::endl<char,std::char_traits<char>>);
  v21 = rolling_dice();
  std::operator<<<std::char_traits<char>>(&std::cout, "now the dice have been rolled, guess what it is: ", v4);
  std::istream::operator>>(&std::cin, &v20);
  v5 = v20;
  v7 = std::operator<<<std::char_traits<char>>(&std::cout, "expected: ", v6);
  v8 = std::ostream::operator<<(v7, v21);
  v10 = std::operator<<<std::char_traits<char>>(v8, ", guess: ", v9);
  v11 = std::ostream::operator<<(v10, v5);
  std::ostream::operator<<(v11, (__int64)&std::endl<char,std::char_traits<char>>);
  if ( v20 != v21 )
  {
    v13 = std::operator<<<std::char_traits<char>>(&std::cout, "you are bad at guessing dice", v12);
    std::ostream::operator<<(v13, (__int64)&std::endl<char,std::char_traits<char>>);
    exit(0);
  }
  std::operator<<<std::char_traits<char>>(
    &std::cout,
    "wow, you are good at dice-guessing, now give me your flag: ",
    v12);
  std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(v22);
  std::operator>><char>(&std::cin, v22);
  if ( std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::length(v22) != 32 )
  {
    v15 = std::operator<<<std::char_traits<char>>(&std::cout, "assert len(flag) == 32", v14);
    std::ostream::operator<<(v15, (__int64)&std::endl<char,std::char_traits<char>>);
    exit(0);
  }
  v16 = std::operator<<<std::char_traits<char>>(&std::cout, "now the math part...", v14);
  std::ostream::operator<<(v16, (__int64)&std::endl<char,std::char_traits<char>>);
  if ( (unsigned __int8)math_part(v22) )
    v18 = std::operator<<<std::char_traits<char>>(
            &std::cout,
            "wow, you are good at doing math too, you deserve to have the flag, just submit it!",
            v17);
  else
    v18 = std::operator<<<std::char_traits<char>>(&std::cout, "you are bad at doing math", v17);
  std::ostream::operator<<(v18, (__int64)&std::endl<char,std::char_traits<char>>);
  std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string(v22);
  return 0;
}

我们主要看math_part这个部分

__

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
int64 __fastcall math_part(__int64 a1)
{
  int v1; // et1
  int v2; // edx
  int v3; // ecx
  int v4; // et1
  int v5; // et1
  int v6; // et1
  int v7; // edx
  int v8; // edx
  int v9; // et1
  int v10; // ecx
  int v11; // edx
  int v12; // et1
  int v13; // edx
  int v14; // edx
  int v15; // ecx
  int v16; // edx
  int v17; // et1
  int v18; // edx
  int v19; // et1
  int v20; // ecx
  int v21; // edx
  int v22; // ecx
  int v23; // et1
  int v24; // edx
  int v25; // edx
  int v26; // ecx
  int v27; // ecx
  int v28; // ecx
  int v29; // et1
  int v30; // ecx
  int v31; // ecx
  int v32; // edx
  char *v34; // [rsp+18h] [rbp-8h]

  v34 = (char *)std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::c_str(a1);
  v1 = 76 * v34[21]
     + 31 * v34[9]
     + 87 * v34[28]
     + 54 * v34[2]
     + 74 * v34[5]
     + 99 * v34[26]
     + 94 * v34[3]
     + 84 * v34[19]
     + 32 * v34[15]
     + 90 * v34[27]
     + 16 * v34[14]
     + 19 * v34[8]
     + 33 * v34[20]
     + 35 * v34[31]
     + 65 * v34[29]
     + 47 * v34[12]
     + 3 * v34[1]
     + 57 * v34[7]
     + 5 * v34[17]
     + 70 * v34[13]
     + 28 * v34[24]
     + 79 * v34[11]
     + 63 * v34[23]
     + 66 * v34[30]
     + 28 * v34[10]
     + v34[4];
  if ( 82 * v34[16] + 58 * v34[25] + v1 + 81 * v34[6] + 61 * v34[18] + 31 * v34[22] + 71 * *v34 != 145397 )
    return 0LL;
  v2 = 55 * v34[6]
     + 38 * v34[9]
     + 39 * v34[18]
     + 73 * v34[24]
     + 86 * v34[13]
     + 18 * v34[11]
     + 40 * v34[21]
     + 40 * v34[26]
     + 54 * v34[14]
     + 81 * v34[10]
     + 71 * v34[27]
     + 20 * v34[8]
     + 16 * v34[28]
     + 65 * v34[30]
     + 87 * v34[3]
     + 14 * v34[16]
     + v34[5]
     + 41 * *v34
     + 58 * v34[15]
     + 73 * v34[2]
     + 46 * v34[23]
     + 7 * v34[19]
     + 89 * v34[17]
     + 65 * v34[25]
     + 43 * v34[7]
     + 6 * v34[20];
  if ( v2 + 60 * v34[12] + 40 * v34[31] + 57 * v34[29] + 40 * v34[4] + 30 * v34[1] + 63 * v34[22] != 127517 )
    return 0LL;
  v3 = 53 * v34[10]
     + 82 * v34[14]
     + 70 * v34[5]
     + 84 * v34[2]
     + 57 * v34[19]
     + 92 * v34[27]
     + 57 * v34[11]
     + 77 * v34[4]
     + 49 * v34[8]
     + 62 * v34[29]
     + 97 * v34[22]
     + 47 * v34[1]
     + 30 * v34[16]
     + 45 * v34[30]
     + 94 * v34[28]
     + 6 * v34[9]
     + 83 * v34[20]
     + 18 * v34[23]
     + 97 * v34[15]
     + 11 * v34[12]
     + 35 * v34[7]
     + 81 * v34[26]
     + 67 * v34[13]
     + 11 * v34[31]
     + 84 * v34[24];
  if ( 28 * v34[6] + 17 * v34[21] + 18 * v34[3] + v3 + 63 * v34[25] + 61 * v34[18] != 141411 )
    return 0LL;
  v4 = 14 * v34[24]
     + 46 * v34[6]
     + 56 * v34[7]
     + 13 * v34[2]
     + 82 * v34[11]
     + 49 * v34[30]
     + 97 * v34[18]
     + 50 * v34[14]
     + 83 * v34[27]
     + 38 * v34[13]
     + 49 * v34[29]
     + 9 * v34[4]
     + 91 * v34[20]
     + 33 * v34[25]
     + 4 * v34[22]
     + 5 * v34[17]
     + 61 * v34[15]
     + 65 * v34[3]
     + 68 * v34[28]
     + 6 * v34[16]
     + (v34[8] << 6)
     + 56 * v34[9]
     + 67 * v34[10]
     + 5 * v34[5]
     + v34[21]
     + 10 * v34[19];
  if ( 86 * v34[23] + 52 * v34[1] + v4 + 83 * v34[12] + 37 * v34[26] + 85 * *v34 != 117383 )
    return 0LL;
  v5 = 9 * v34[28]
     + 63 * v34[5]
     + 20 * v34[4]
     + 96 * v34[8]
     + 39 * v34[11]
     + 91 * v34[1]
     + 40 * v34[9]
     + 85 * v34[14]
     + 62 * v34[16]
     + 95 * v34[19]
     + 34 * v34[22]
     + 67 * v34[31]
     + 51 * v34[27]
     + 45 * v34[26]
     + 92 * v34[15]
     + 91 * v34[21]
     + 85 * v34[13]
     + 12 * v34[7]
     + 26 * v34[23]
     + 56 * v34[30]
     + 82 * v34[18]
     + 72 * v34[17]
     + 54 * v34[6]
     + 17 * v34[12]
     + 84 * v34[29]
     + 17 * *v34;
  if ( 53 * v34[3] + 91 * v34[2] + 57 * v34[25] + 66 * v34[20] + v5 + 8 * v34[24] + 63 * v34[10] != 156152 )
    return 0LL;
  v6 = 88 * v34[9]
     + 48 * v34[4]
     + 83 * v34[13]
     + 66 * v34[7]
     + 60 * v34[30]
     + 57 * v34[6]
     + 85 * v34[17]
     + 71 * v34[28]
     + 98 * v34[24]
     + 83 * v34[10]
     + 12 * v34[1]
     + 72 * v34[31]
     + 12 * v34[22]
     + 80 * v34[20]
     + 15 * v34[19]
     + 81 * v34[21]
     + 87 * *v34
     + 37 * v34[16]
     + 4 * v34[15]
     + 41 * v34[3]
     + 84 * v34[26]
     + 56 * v34[25]
     + 84 * v34[14]
     + 41 * v34[27]
     + 98 * v34[18]
     + 18 * v34[2];
  if ( 55 * v34[23] + v6 + 95 * v34[11] + 33 * v34[29] + 66 * v34[8] != 148963 )
    return 0LL;
  v7 = 57 * v34[21]
     + 63 * v34[12]
     + 4 * v34[14]
     + 59 * v34[31]
     + 15 * v34[23]
     + 12 * v34[25]
     + 58 * v34[5]
     + 40 * v34[4]
     + 26 * v34[30]
     + 8 * v34[15]
     + 25 * v34[6]
     + 97 * v34[10]
     + 12 * v34[28]
     + 74 * v34[26]
     + 65 * v34[8]
     + 93 * v34[27]
     + 18 * v34[22]
     + 84 * v34[2]
     + 7 * v34[1]
     + 22 * v34[18]
     + 9 * v34[17]
     + 89 * v34[19]
     + 72 * v34[13]
     + 47 * v34[20]
     + 7 * v34[29];
  if ( 43 * v34[16] + 47 * *v34 + 53 * v34[24] + 75 * v34[11] + v7 + 8 * v34[9] + 24 * v34[7] + 75 * v34[3] != 121517 )
    return 0LL;
  v8 = 86 * v34[17]
     + 74 * *v34
     + 72 * v34[4]
     + 27 * v34[20]
     + 88 * v34[9]
     + (v34[21] << 6)
     + 52 * v34[15]
     + 4 * v34[19]
     + 8 * v34[1]
     + 16 * v34[13]
     + 54 * v34[25]
     + 8 * v34[29]
     + 52 * v34[23]
     + 14 * v34[10]
     + 88 * v34[18]
     + 33 * v34[8]
     + 99 * v34[27]
     + 65 * v34[14]
     + 66 * v34[5]
     + 36 * v34[6]
     + 58 * v34[16]
     + 63 * v34[22]
     + 93 * v34[3]
     + 96 * v34[11]
     + 26 * v34[26]
     + 65 * v34[12];
  if ( 77 * v34[30] + 89 * v34[31] + 55 * v34[7] + v8 + 42 * v34[28] + 14 * v34[2] + 57 * v34[24] != 151446 )
    return 0LL;
  v9 = 51 * v34[7]
     + 42 * v34[4]
     + 78 * v34[8]
     + 45 * v34[25]
     + 63 * v34[30]
     + 85 * v34[26]
     + 30 * v34[29]
     + 83 * v34[14]
     + 62 * v34[31]
     + 71 * v34[22]
     + 45 * v34[17]
     + (v34[6] << 6)
     + 87 * v34[23]
     + 49 * v34[28]
     + 14 * *v34
     + 4 * v34[21]
     + 63 * v34[5]
     + 53 * v34[13]
     + 19 * v34[19]
     + 44 * v34[16]
     + 5 * v34[3]
     + 74 * v34[15]
     + 19 * v34[18]
     + 89 * v34[11]
     + 11 * v34[20]
     + 34 * v34[12];
  if ( 53 * v34[24] + 95 * v34[27] + v9 + 14 * v34[1] + 87 * v34[10] + 63 * v34[9] + 70 * v34[2] != 142830 )
    return 0LL;
  v10 = 13 * v34[29]
      + 11 * v34[22]
      + 41 * v34[5]
      + 38 * v34[13]
      + 90 * v34[31]
      + 68 * v34[7]
      + 56 * v34[14]
      + 4 * v34[23]
      + 66 * v34[28]
      + 28 * v34[1]
      + 6 * v34[12]
      + 91 * v34[16]
      + 59 * v34[3]
      + 81 * v34[17]
      + 44 * v34[2]
      + 33 * v34[24]
      + 34 * v34[19]
      + 17 * v34[18]
      + 77 * v34[25]
      + 25 * v34[8]
      + 8 * v34[6]
      + 10 * v34[30]
      + 66 * v34[20];
  if ( 69 * *v34
     + 67 * v34[9]
     + 57 * v34[15]
     + 77 * v34[10]
     + 67 * v34[26]
     + 94 * v34[11]
     + v10
     + 41 * v34[27]
     + 29 * v34[21] != 122585 )
    return 0LL;
  v11 = 23 * v34[25]
      + 32 * v34[3]
      + 72 * v34[15]
      + 41 * v34[26]
      + 33 * v34[30]
      + 82 * v34[13]
      + 20 * *v34
      + 7 * v34[12]
      + 25 * v34[29]
      + 39 * v34[21]
      + 57 * v34[14]
      + 14 * v34[16]
      + 24 * v34[24]
      + 37 * v34[22]
      + 71 * v34[10]
      + 65 * v34[23]
      + 46 * v34[8]
      + 40 * v34[19]
      + 77 * v34[27]
      + 80 * v34[18]
      + 88 * v34[6]
      + 20 * v34[31]
      + 83 * v34[11]
      + 73 * v34[1]
      + 8 * v34[5]
      + 15 * v34[20];
  if ( 31 * v34[9] + 17 * v34[4] + 6 * v34[28] + v11 + 70 * v34[7] + 24 * v34[17] + 16 * v34[2] != 105293 )
    return 0LL;
  v12 = 41 * v34[24]
      + 45 * v34[30]
      + 82 * v34[20]
      + 86 * v34[19]
      + 99 * v34[9]
      + 96 * v34[22]
      + 85 * v34[28]
      + 70 * v34[5]
      + 77 * v34[23]
      + 80 * v34[11]
      + 40 * v34[31]
      + 66 * v34[12]
      + 12 * v34[2]
      + 77 * v34[15]
      + 72 * v34[4]
      + 42 * v34[26]
      + 81 * v34[27]
      + 90 * v34[13]
      + 37 * v34[16]
      + 29 * v34[17]
      + 20 * v34[29]
      + 85 * v34[6]
      + 6 * v34[7]
      + 2 * *v34
      + 72 * v34[1]
      + 75 * v34[14];
  if ( 25 * v34[21] + 79 * v34[3] + v12 + 40 * v34[25] + 29 * v34[8] + 25 * v34[10] != 151962 )
    return 0LL;
  v13 = 42 * v34[31]
      + 95 * v34[30]
      + 58 * v34[8]
      + 47 * v34[13]
      + 65 * v34[15]
      + 24 * v34[17]
      + 97 * v34[10]
      + 24 * v34[21]
      + 28 * *v34
      + 77 * v34[5]
      + 97 * v34[6]
      + 24 * v34[26]
      + 32 * v34[12]
      + 5 * v34[25]
      + 55 * v34[28]
      + 9 * v34[23]
      + 85 * v34[4]
      + 6 * v34[9]
      + 61 * v34[19]
      + 12 * v34[3]
      + 76 * v34[7]
      + 36 * v34[27]
      + 77 * v34[24]
      + 24 * v34[29]
      + 67 * v34[14]
      + 19 * v34[16];
  if ( 83 * v34[11] + 75 * v34[1] + v13 + 47 * v34[20] + 13 * v34[22] != 125609 )
    return 0LL;
  v14 = v34[1]
      + 88 * v34[3]
      + 90 * *v34
      + 4 * v34[23]
      + 46 * v34[7]
      + 54 * v34[16]
      + 16 * v34[6]
      + 89 * v34[22]
      + 76 * v34[27]
      + 38 * v34[17]
      + 3 * v34[5]
      + 70 * v34[14]
      + 3 * v34[24]
      + 24 * v34[13]
      + 54 * v34[2]
      + 20 * v34[8]
      + 83 * v34[12]
      + 21 * v34[15]
      + 77 * v34[18]
      + 31 * v34[19]
      + 59 * v34[21]
      + 33 * v34[20]
      + 84 * v34[11]
      + 19 * v34[29]
      + 38 * v34[26]
      + 63 * v34[31];
  if ( 30 * v34[25] + 41 * v34[28] + 65 * v34[10] + v14 + 16 * v34[30] + 15 * v34[4] + 39 * v34[9] != 123069 )
    return 0LL;
  v15 = 27 * v34[18]
      + 48 * v34[4]
      + 13 * v34[20]
      + 44 * v34[10]
      + 70 * v34[12]
      + 44 * v34[17]
      + 22 * v34[23]
      + 55 * v34[14]
      + 73 * v34[26]
      + 55 * v34[8]
      + 58 * v34[11]
      + 31 * v34[30]
      + 78 * v34[29]
      + 19 * v34[25]
      + 52 * v34[31]
      + 27 * v34[21]
      + 38 * v34[27]
      + 40 * v34[28]
      + 35 * v34[1]
      + 48 * v34[22]
      + 71 * v34[15]
      + 24 * v34[6]
      + 89 * v34[16]
      + 37 * v34[3]
      + 78 * v34[2];
  if ( 6 * v34[9] + 19 * v34[19] + v15 + 3 * v34[5] + 52 * v34[24] + 40 * v34[7] != 113842 )
    return 0LL;
  v16 = 31 * v34[12]
      + 35 * v34[10]
      + 54 * v34[20]
      + 26 * v34[29]
      + 29 * v34[3]
      + 2 * v34[23]
      + 46 * *v34
      + 30 * v34[26]
      + 56 * v34[27]
      + 100 * v34[11]
      + 43 * v34[1]
      + 15 * v34[4]
      + 79 * v34[17]
      + 12 * v34[5]
      + 38 * v34[9]
      + 3 * v34[30]
      + 16 * v34[21]
      + 19 * v34[13]
      + 67 * v34[19]
      + 37 * v34[28]
      + v34[7]
      + 73 * v34[16]
      + 85 * v34[6]
      + 17 * v34[14]
      + 90 * v34[22]
      + 15 * v34[2];
  if ( 95 * v34[8] + 92 * v34[18] + 84 * v34[31] + v16 + 43 * v34[25] + 96 * v34[24] != 119824 )
    return 0LL;
  v17 = 92 * v34[20]
      + 43 * v34[23]
      + 16 * v34[19]
      + 92 * v34[5]
      + 49 * v34[26]
      + 44 * v34[2]
      + 26 * v34[29]
      + (v34[25] << 6)
      + 45 * v34[24]
      + 99 * v34[11]
      + 43 * v34[4]
      + 75 * v34[21]
      + 53 * v34[31]
      + 18 * v34[18]
      + 11 * v34[13]
      + 52 * *v34
      + 16 * v34[8]
      + 9 * v34[7]
      + 77 * v34[16]
      + 33 * v34[10]
      + 86 * v34[1]
      + 33 * v34[3]
      + 29 * v34[9]
      + 6 * v34[12]
      + 91 * v34[14]
      + 36 * v34[15];
  if ( 36 * v34[22] + 69 * v34[28] + 77 * v34[6] + v17 + 94 * v34[27] + 13 * v34[30] + 89 * v34[17] != 135873 )
    return 0LL;
  v18 = 68 * v34[2]
      + 83 * v34[10]
      + 47 * v34[5]
      + 85 * v34[13]
      + 22 * v34[8]
      + 92 * v34[27]
      + 75 * v34[28]
      + 43 * v34[3]
      + 29 * v34[22]
      + 92 * *v34
      + 54 * v34[16]
      + 17 * v34[30]
      + 78 * v34[18]
      + 7 * v34[23]
      + 69 * v34[21]
      + 63 * v34[31]
      + 71 * v34[4]
      + 10 * v34[6]
      + 66 * v34[14]
      + 25 * v34[26]
      + 32 * v34[1]
      + 48 * v34[19]
      + 86 * v34[11]
      + 20 * v34[25]
      + 78 * v34[20]
      + 25 * v34[17];
  if ( 16 * v34[7] + v34[15] + 82 * v34[9] + 60 * v34[29] + v18 + 76 * v34[12] + 13 * v34[24] != 142509 )
    return 0LL;
  v19 = 77 * v34[9]
      + 56 * v34[30]
      + 79 * v34[2]
      + 71 * v34[29]
      + 95 * v34[28]
      + 87 * v34[24]
      + 62 * v34[16]
      + 85 * v34[26]
      + 43 * v34[20]
      + 67 * v34[15]
      + 97 * v34[8]
      + 80 * *v34
      + 23 * v34[3]
      + 95 * v34[25]
      + 82 * v34[21]
      + 66 * v34[31]
      + 5 * v34[4]
      + 66 * v34[27]
      + 25 * v34[12]
      + 4 * v34[5]
      + 12 * v34[7]
      + 85 * v34[1]
      + 10 * v34[6]
      + 45 * v34[11]
      + 28 * v34[18]
      + 26 * v34[19];
  if ( 88 * v34[22] + 23 * v34[13] + 18 * v34[14] + v19 + 48 * v34[23] + 45 * v34[17] != 148888 )
    return 0LL;
  v20 = 81 * v34[30]
      + 21 * v34[6]
      + 72 * v34[11]
      + 48 * v34[18]
      + 2 * v34[19]
      + 42 * v34[10]
      + 22 * v34[24]
      + 99 * v34[2]
      + 78 * v34[22]
      + 83 * v34[12]
      + 60 * v34[9]
      + 59 * v34[13]
      + 15 * v34[5]
      + 25 * v34[20]
      + 43 * v34[15]
      + 56 * v34[28]
      + 33 * v34[25]
      + 71 * v34[23]
      + 31 * *v34
      + 95 * v34[3]
      + 73 * v34[17]
      + 86 * v34[14]
      + 15 * v34[21]
      + 61 * v34[7]
      + 12 * v34[29]
      + 95 * v34[26];
  if ( 25 * v34[8] + v20 + 13 * v34[1] + 100 * v34[16] + 11 * v34[4] + 79 * v34[27] != 138023 )
    return 0LL;
  v21 = 53 * v34[27]
      + 52 * v34[29]
      + 70 * v34[22]
      + 35 * v34[30]
      + 50 * v34[16]
      + 59 * v34[8]
      + 75 * v34[10]
      + 55 * v34[20]
      + 23 * *v34
      + 52 * v34[17]
      + 47 * v34[3]
      + 91 * v34[13]
      + 46 * v34[7]
      + 42 * v34[14]
      + 79 * v34[26]
      + 87 * v34[21]
      + 30 * v34[6]
      + 26 * v34[1]
      + 57 * v34[31]
      + 33 * v34[12]
      + 51 * v34[9]
      + 56 * v34[24]
      + 59 * v34[11]
      + 36 * v34[23]
      + 88 * v34[4]
      + 28 * v34[2];
  if ( 37 * v34[28] + 62 * v34[25] + 42 * v34[18] + v21 + 44 * v34[15] + 19 * v34[19] + 74 * v34[5] != 142299 )
    return 0LL;
  v22 = 80 * v34[21]
      + 43 * v34[31]
      + 67 * v34[16]
      + 55 * v34[13]
      + 95 * v34[24]
      + 46 * v34[28]
      + 93 * v34[5]
      + 75 * v34[20]
      + 14 * v34[25]
      + 24 * v34[26]
      + 50 * v34[29]
      + 70 * v34[15]
      + 63 * v34[30]
      + 77 * v34[23]
      + 96 * v34[19]
      + 66 * v34[11]
      + 72 * v34[27]
      + 94 * v34[4]
      + 63 * v34[22]
      + 69 * v34[3]
      + 73 * v34[1]
      + 60 * v34[7]
      + 9 * v34[2]
      + 39 * v34[17]
      + 25 * *v34
      + 49 * v34[14];
  if ( v22 + 48 * v34[8] + 86 * v34[9] + 72 * v34[10] + 23 * v34[18] + 21 * v34[6] != 155777 )
    return 0LL;
  v23 = 27 * v34[11]
      + 40 * v34[8]
      + 53 * v34[15]
      + 40 * v34[18]
      + 56 * v34[3]
      + 2 * v34[2]
      + 32 * v34[4]
      + 90 * v34[1]
      + 54 * v34[16]
      + 20 * v34[9]
      + 86 * v34[17]
      + 82 * v34[31]
      + 43 * v34[25]
      + 43 * v34[13]
      + 86 * v34[21]
      + 17 * *v34
      + (v34[14] << 6)
      + 6 * v34[30]
      + 86 * v34[5]
      + 15 * v34[7]
      + 46 * v34[12]
      + 21 * v34[26]
      + 90 * v34[20]
      + 19 * v34[6]
      + 93 * v34[23]
      + 31 * v34[27];
  if ( 25 * v34[24] + 11 * v34[22] + v23 + 62 * v34[29] + 21 * v34[19] + 42 * v34[10] != 117687 )
    return 0LL;
  v24 = v34[27]
      + 66 * v34[18]
      + 40 * v34[17]
      + 17 * *v34
      + 27 * v34[19]
      + 26 * v34[31]
      + 57 * v34[24]
      + 35 * v34[3]
      + 80 * v34[1]
      + 67 * v34[5]
      + 85 * v34[6]
      + 7 * v34[15]
      + 93 * v34[8]
      + 3 * v34[22]
      + 77 * v34[12]
      + 12 * v34[28]
      + 4 * v34[2]
      + 27 * v34[9]
      + 53 * v34[25]
      + 37 * v34[30]
      + 43 * v34[23]
      + 33 * v34[4]
      + 39 * v34[26]
      + 7 * v34[7]
      + 75 * v34[10]
      + 15 * v34[14];
  if ( 89 * v34[21] + 100 * v34[13] + v24 + 45 * v34[20] + 36 * v34[29] + 78 * v34[11] + 31 * v34[16] != 117383 )
    return 0LL;
  v25 = 71 * v34[16]
      + 4 * v34[1]
      + 77 * v34[31]
      + 83 * v34[2]
      + 11 * v34[30]
      + 53 * v34[19]
      + 85 * v34[12]
      + 67 * v34[13]
      + 39 * v34[8]
      + 45 * v34[24]
      + 84 * v34[22]
      + 99 * v34[14]
      + 38 * v34[3]
      + 29 * v34[4]
      + 90 * v34[9]
      + 61 * v34[18]
      + 40 * v34[7]
      + (v34[17] << 6)
      + 9 * v34[25]
      + 86 * v34[29]
      + 80 * v34[21]
      + 4 * v34[15]
      + 96 * v34[23]
      + 99 * v34[10]
      + 40 * v34[27];
  if ( 73 * v34[20] + 16 * v34[26] + 100 * v34[5] + 71 * v34[28] + v25 + 4 * *v34 + 56 * v34[11] != 155741 )
    return 0LL;
  v26 = 87 * v34[2]
      + 86 * v34[24]
      + 76 * v34[14]
      + 38 * v34[23]
      + 85 * v34[3]
      + 71 * v34[22]
      + 42 * v34[29]
      + 85 * v34[30]
      + 14 * v34[10]
      + 17 * v34[13]
      + 42 * v34[25]
      + 11 * v34[19]
      + 44 * v34[15]
      + 21 * v34[4]
      + 60 * v34[16]
      + 28 * v34[6]
      + 46 * v34[20]
      + 25 * v34[9]
      + 77 * v34[31]
      + 21 * v34[8]
      + 85 * v34[7]
      + 36 * v34[1]
      + 91 * v34[27]
      + 21 * v34[28]
      + 38 * v34[17];
  if ( (v34[12] << 6) + 76 * *v34 + 5 * v34[11] + v26 + 3 * v34[26] + 61 * v34[21] + 15 * v34[5] + 32 * v34[18] == 132804
    && (v27 = 36 * v34[1]
            + 60 * v34[3]
            + 84 * v34[11]
            + 19 * v34[26]
            + 76 * v34[27]
            + 86 * v34[16]
            + 92 * v34[8]
            + 96 * v34[14]
            + 60 * v34[21]
            + 23 * v34[4]
            + 60 * v34[12]
            + 50 * v34[23]
            + 78 * v34[22]
            + 45 * v34[9]
            + 42 * v34[18]
            + 10 * v34[2]
            + 60 * v34[20]
            + 24 * v34[24]
            + 77 * v34[7]
            + 41 * v34[6]
            + 29 * v34[13]
            + 33 * v34[5]
            + 2 * v34[15]
            + 33 * v34[29]
            + 39 * v34[31],
        95 * v34[30] + 75 * v34[28] + 3 * v34[10] + v27 + 41 * v34[25] + 100 * v34[19] + 9 * v34[17] + 79 * *v34 == 145568)
    && (v28 = 25 * v34[26]
            + 98 * v34[24]
            + 15 * v34[6]
            + 50 * v34[18]
            + 88 * v34[20]
            + 74 * v34[11]
            + 83 * v34[1]
            + 86 * v34[21]
            + 52 * v34[7]
            + 39 * v34[10]
            + 40 * v34[13]
            + 82 * v34[28]
            + 37 * v34[3]
            + 45 * *v34
            + 18 * v34[25]
            + 2 * v34[29]
            + 6 * v34[12]
            + 78 * v34[31]
            + 37 * v34[2]
            + 57 * v34[23]
            + 3 * v34[4]
            + 59 * v34[8]
            + 73 * v34[15]
            + v34[22]
            + 18 * v34[9]
            + 35 * v34[14],
        68 * v34[5] + 98 * v34[27] + 98 * v34[16] + 10 * v34[19] + v28 + 20 * v34[17] + 54 * v34[30] == 130175)
    && (v29 = 68 * v34[23]
            + 60 * v34[18]
            + 93 * v34[20]
            + 100 * v34[11]
            + 98 * v34[14]
            + 32 * v34[3]
            + 15 * v34[21]
            + 79 * *v34
            + 6 * v34[24]
            + 62 * v34[26]
            + 96 * v34[6]
            + 68 * v34[22]
            + 9 * v34[7]
            + 88 * v34[5]
            + 18 * v34[27]
            + 70 * v34[9]
            + 96 * v34[25]
            + 89 * v34[4]
            + 14 * v34[31]
            + 83 * v34[17]
            + 19 * v34[15]
            + 44 * v34[1]
            + 96 * v34[8]
            + 87 * v34[16]
            + 48 * v34[2]
            + 95 * v34[13],
        60 * v34[10] + 50 * v34[12] + 30 * v34[29] + 90 * v34[19] + v29 + 73 * v34[28] + 92 * v34[30] == 171986)
    && (v30 = 86 * v34[9]
            + 20 * v34[7]
            + 29 * v34[16]
            + 31 * v34[14]
            + 83 * v34[26]
            + 11 * v34[4]
            + 29 * v34[19]
            + 82 * v34[13]
            + 84 * v34[10]
            + 70 * v34[1]
            + 52 * v34[12]
            + 40 * v34[6]
            + 91 * v34[8]
            + 6 * v34[17]
            + 77 * v34[28]
            + 56 * v34[5]
            + 86 * v34[23]
            + 63 * v34[31]
            + 26 * v34[27]
            + 19 * v34[22]
            + 50 * v34[3]
            + 15 * v34[15]
            + 67 * v34[2]
            + 37 * v34[24]
            + 84 * v34[18],
        53 * v34[30] + 87 * v34[25] + 23 * v34[29] + 80 * v34[20] + v30 + 81 * v34[21] + 93 * *v34 == 151676)
    && (v31 = 12 * v34[11]
            + 82 * v34[24]
            + 100 * v34[8]
            + 29 * v34[26]
            + 97 * v34[12]
            + 32 * v34[6]
            + 26 * v34[27]
            + 46 * v34[19]
            + 8 * (v34[25] + 9 * *v34 + 2 * v34[17])
            + 63 * v34[10]
            + 39 * v34[29]
            + 81 * v34[15]
            + 51 * v34[13]
            + 31 * v34[30]
            + 49 * v34[4]
            + 3 * v34[22]
            + 26 * v34[28]
            + 15 * v34[20]
            + 89 * v34[2]
            + 5 * v34[31]
            + 47 * v34[18]
            + 19 * v34[23]
            + 98 * v34[9],
        29 * v34[3] + 93 * v34[5] + 67 * v34[21] + v31 + 15 * v34[16] + 49 * v34[1] == 128223)
    && (v32 = 84 * v34[25]
            + 91 * v34[10]
            + 67 * v34[22]
            + 77 * v34[15]
            + 23 * v34[26]
            + 38 * v34[4]
            + 3 * v34[31]
            + 76 * v34[13]
            + 50 * *v34
            + 74 * v34[11]
            + 45 * v34[28]
            + 58 * v34[29]
            + 39 * v34[5]
            + 95 * v34[9]
            + 26 * v34[16]
            + 23 * v34[8]
            + 28 * v34[24]
            + 89 * v34[1]
            + 88 * v34[18]
            + 3 * v34[3]
            + 59 * v34[20]
            + 80 * v34[23]
            + 49 * v34[17]
            + 56 * v34[21]
            + 32 * v34[27]
            + 24 * v34[2],
        13 * v34[14] + 73 * v34[19] + 99 * v34[7] + 76 * v34[12] + v32 + 77 * v34[30] + 18 * v34[6] == 138403) )
  {
    return 1LL;
  }
  else
  {
    return 0LL;
  }
}

很显然是一个z3约束器的使用。

太简单了这个题

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
from z3 import *
x = Solver()
flag = [Int('flag%d'%i) for i in range(32)]
for i in range(32):
  x.add(flag[i] > 23)
  x.add(flag[i] < 127)
for i in range(6):
  x.add(flag[i] == ord("hgame{"[i]))
x.add(flag[31] == ord("}"))
x.add((82 * flag[16] + 58 * flag[25] + 76 * flag[21] + 31 * flag[9]+ 87 * flag[28]+ 54 * flag[2]+ 74 * flag[5]+ 99 * flag[26]+ 94 * flag[3]+ 84 * flag[19]+ 32 * flag[15]+ 90 * flag[27]+ 16 * flag[14]+ 19 * flag[8]+ 33 * flag[20]+ 35 * flag[31]+ 65 * flag[29]+ 47 * flag[12]+ 3 * flag[1]+ 57 * flag[7]+ 5 * flag[17]+ 70 * flag[13]+ 28 * flag[24]+ 79 * flag[11]+ 63 * flag[23]+ 66 * flag[30]+ 28 * flag[10]+ flag[4] + 81 * flag[6] + 61 * flag[18] + 31 * flag[22] + 71 * flag[0]) == 0x237F5)
x.add((55 * flag[6]+ 38 * flag[9]+ 39 * flag[18]+ 73 * flag[24]+ 86 * flag[13]+ 18 * flag[11]+ 40 * flag[21]+ 40 * flag[26]+ 54 * flag[14]+ 81 * flag[10]+ 71 * flag[27]+ 20 * flag[8]+ 16 * flag[28]+ 65 * flag[30]+ 87 * flag[3]+ 14 * flag[16]+ flag[5]+ 41 * flag[0]+ 58 * flag[15]+ 73 * flag[2]+ 46 * flag[23]+ 7 * flag[19]+ 89 * flag[17]+ 65 * flag[25]+ 43 * flag[7]+ 6 * flag[20] + 60 * flag[12] + 40 * flag[31] + 57 * flag[29] + 40 * flag[4] + 30 * flag[1] + 63 * flag[22]) == 0x1F21D)
x.add((28 * flag[6] + 17 * flag[21] + 18 * flag[3] + 53 * flag[10]+ 82 * flag[14]+ 70 * flag[5]+ 84 * flag[2]+ 57 * flag[19]+ 92 * flag[27]+ 57 * flag[11]+ 77 * flag[4]+ 49 * flag[8]+ 62 * flag[29]+ 97 * flag[22]+ 47 * flag[1]+ 30 * flag[16]+ 45 * flag[30]+ 94 * flag[28]+ 6 * flag[9]+ 83 * flag[20]+ 18 * flag[23]+ 97 * flag[15]+ 11 * flag[12]+ 35 * flag[7]+ 81 * flag[26]+ 67 * flag[13]+ 11 * flag[31]+ 84 * flag[24] + 63 * flag[25] + 61 * flag[18]) == 0x22863)
x.add((86 * flag[23] + 52 * flag[1] + 14 * flag[24]+ 46 * flag[6]+ 56 * flag[7]+ 13 * flag[2]+ 82 * flag[11]+ 49 * flag[30]+ 97 * flag[18]+ 50 * flag[14]+ 83 * flag[27]+ 38 * flag[13]+ 49 * flag[29]+ 9 * flag[4]+ 91 * flag[20]+ 33 * flag[25]+ 4 * flag[22]+ 5 * flag[17]+ 61 * flag[15]+ 65 * flag[3]+ 68 * flag[28]+ 6 * flag[16]+ (flag[8] * 64)+ 56 * flag[9]+ 67 * flag[10]+ 5 * flag[5]+ flag[21]+ 10 * flag[19] + 83 * flag[12] + 37 * flag[26] + 85 * flag[0]) == 0x1CA87)
x.add( 53 * flag[3] + 91 * flag[2] + 57 * flag[25] + 66 * flag[20] + 9 * flag[28]+ 63 * flag[5]+ 20 * flag[4]+ 96 * flag[8]+ 39 * flag[11]+ 91 * flag[1]+ 40 * flag[9]+ 85 * flag[14]+ 62 * flag[16]+ 95 * flag[19]+ 34 * flag[22]+ 67 * flag[31]+ 51 * flag[27]+ 45 * flag[26]+ 92 * flag[15]+ 91 * flag[21]+ 85 * flag[13]+ 12 * flag[7]+ 26 * flag[23]+ 56 * flag[30]+ 82 * flag[18]+ 72 * flag[17]+ 54 * flag[6]+ 17 * flag[12]+ 84 * flag[29]+ 17 * flag[0] + 8 * flag[24] + 63 * flag[10] == 0x261F8 )
x.add( 55 * flag[23] + 88 * flag[9]+ 48 * flag[4]+ 83 * flag[13]+ 66 * flag[7]+ 60 * flag[30]+ 57 * flag[6]+ 85 * flag[17]+ 71 * flag[28]+ 98 * flag[24]+ 83 * flag[10]+ 12 * flag[1]+ 72 * flag[31]+ 12 * flag[22]+ 80 * flag[20]+ 15 * flag[19]+ 81 * flag[21]+ 87 * flag[0]+ 37 * flag[16]+ 4 * flag[15]+ 41 * flag[3]+ 84 * flag[26]+ 56 * flag[25]+ 84 * flag[14]+ 41 * flag[27]+ 98 * flag[18]+ 18 * flag[2] + 95 * flag[11] + 33 * flag[29] + 66 * flag[8] == 0x245E3 )
x.add( 43 * flag[16] + 47 * flag[0] + 53 * flag[24] + 75 * flag[11] + 57 * flag[21]+ 63 * flag[12]+ 4 * flag[14]+ 59 * flag[31]+ 15 * flag[23]+ 12 * flag[25]+ 58 * flag[5]+ 40 * flag[4]+ 26 * flag[30]+ 8 * flag[15]+ 25 * flag[6]+ 97 * flag[10]+ 12 * flag[28]+ 74 * flag[26]+ 65 * flag[8]+ 93 * flag[27]+ 18 * flag[22]+ 84 * flag[2]+ 7 * flag[1]+ 22 * flag[18]+ 9 * flag[17]+ 89 * flag[19]+ 72 * flag[13]+ 47 * flag[20]+ 7 * flag[29] + 8 * flag[9] + 24 * flag[7] + 75 * flag[3] == 121517 )
x.add( 77 * flag[30] + 89 * flag[31] + 55 * flag[7] + 86 * flag[17]+ 74 * flag[0]+ 72 * flag[4]+ 27 * flag[20]+ 88 * flag[9]+ (flag[21] * 64)+ 52 * flag[15]+ 4 * flag[19]+ 8 * flag[1]+ 16 * flag[13]+ 54 * flag[25]+ 8 * flag[29]+ 52 * flag[23]+ 14 * flag[10]+ 88 * flag[18]+ 33 * flag[8]+ 99 * flag[27]+ 65 * flag[14]+ 66 * flag[5]+ 36 * flag[6]+ 58 * flag[16]+ 63 * flag[22]+ 93 * flag[3]+ 96 * flag[11]+ 26 * flag[26]+ 65 * flag[12] + 42 * flag[28] + 14 * flag[2] + 57 * flag[24] == 0x24F96 )
x.add( 53 * flag[24] + 95 * flag[27] + 51 * flag[7]+ 42 * flag[4]+ 78 * flag[8]+ 45 * flag[25]+ 63 * flag[30]+ 85 * flag[26]+ 30 * flag[29]+ 83 * flag[14]+ 62 * flag[31]+ 71 * flag[22]+ 45 * flag[17]+ (flag[6] * 64)+ 87 * flag[23]+ 49 * flag[28]+ 14 * flag[0]+ 4 * flag[21]+ 63 * flag[5]+ 53 * flag[13]+ 19 * flag[19]+ 44 * flag[16]+ 5 * flag[3]+ 74 * flag[15]+ 19 * flag[18]+ 89 * flag[11]+ 11 * flag[20]+ 34 * flag[12] + 14 * flag[1] + 87 * flag[10] + 63 * flag[9] + 70 * flag[2] == 142830 )
x.add( 69 * flag[0]+ 67 * flag[9]+ 57 * flag[15]+ 77 * flag[10]+ 67 * flag[26]+ 94 * flag[11]+ 13 * flag[29]+ 11 * flag[22]+ 41 * flag[5]+ 38 * flag[13]+ 90 * flag[31]+ 68 * flag[7]+ 56 * flag[14]+ 4 * flag[23]+ 66 * flag[28]+ 28 * flag[1]+ 6 * flag[12]+ 91 * flag[16]+ 59 * flag[3]+ 81 * flag[17]+ 44 * flag[2]+ 33 * flag[24]+ 34 * flag[19]+ 17 * flag[18]+ 77 * flag[25]+ 25 * flag[8]+ 8 * flag[6]+ 10 * flag[30]+ 66 * flag[20]+ 41 * flag[27]+ 29 * flag[21] == 0x1DED9 )
x.add( 31 * flag[9] + 17 * flag[4] + 6 * flag[28] + 23 * flag[25]+ 32 * flag[3]+ 72 * flag[15]+ 41 * flag[26]+ 33 * flag[30]+ 82 * flag[13]+ 20 * flag[0]+ 7 * flag[12]+ 25 * flag[29]+ 39 * flag[21]+ 57 * flag[14]+ 14 * flag[16]+ 24 * flag[24]+ 37 * flag[22]+ 71 * flag[10]+ 65 * flag[23]+ 46 * flag[8]+ 40 * flag[19]+ 77 * flag[27]+ 80 * flag[18]+ 88 * flag[6]+ 20 * flag[31]+ 83 * flag[11]+ 73 * flag[1]+ 8 * flag[5]+ 15 * flag[20] + 70 * flag[7] + 24 * flag[17] + 16 * flag[2] == 0x19B4D )
x.add( 25 * flag[21] + 79 * flag[3] + 41 * flag[24]+ 45 * flag[30]+ 82 * flag[20]+ 86 * flag[19]+ 99 * flag[9]+ 96 * flag[22]+ 85 * flag[28]+ 70 * flag[5]+ 77 * flag[23]+ 80 * flag[11]+ 40 * flag[31]+ 66 * flag[12]+ 12 * flag[2]+ 77 * flag[15]+ 72 * flag[4]+ 42 * flag[26]+ 81 * flag[27]+ 90 * flag[13]+ 37 * flag[16]+ 29 * flag[17]+ 20 * flag[29]+ 85 * flag[6]+ 6 * flag[7]+ 2 * flag[0]+ 72 * flag[1]+ 75 * flag[14] + 40 * flag[25] + 29 * flag[8] + 25 * flag[10] == 0x2519A )
x.add( 83 * flag[11] + 75 * flag[1] + 42 * flag[31]+ 95 * flag[30]+ 58 * flag[8]+ 47 * flag[13]+ 65 * flag[15]+ 24 * flag[17]+ 97 * flag[10]+ 24 * flag[21]+ 28 * flag[0]+ 77 * flag[5]+ 97 * flag[6]+ 24 * flag[26]+ 32 * flag[12]+ 5 * flag[25]+ 55 * flag[28]+ 9 * flag[23]+ 85 * flag[4]+ 6 * flag[9]+ 61 * flag[19]+ 12 * flag[3]+ 76 * flag[7]+ 36 * flag[27]+ 77 * flag[24]+ 24 * flag[29]+ 67 * flag[14]+ 19 * flag[16] + 47 * flag[20] + 13 * flag[22] == 125609 )
x.add( 30 * flag[25] + 41 * flag[28] + 65 * flag[10] + flag[1]+ 88 * flag[3]+ 90 * flag[0]+ 4 * flag[23]+ 46 * flag[7]+ 54 * flag[16]+ 16 * flag[6]+ 89 * flag[22]+ 76 * flag[27]+ 38 * flag[17]+ 3 * flag[5]+ 70 * flag[14]+ 3 * flag[24]+ 24 * flag[13]+ 54 * flag[2]+ 20 * flag[8]+ 83 * flag[12]+ 21 * flag[15]+ 77 * flag[18]+ 31 * flag[19]+ 59 * flag[21]+ 33 * flag[20]+ 84 * flag[11]+ 19 * flag[29]+ 38 * flag[26]+ 63 * flag[31] + 16 * flag[30] + 15 * flag[4] + 39 * flag[9] == 123069 )
x.add( 6 * flag[9] + 19 * flag[19] + 27 * flag[18]+ 48 * flag[4]+ 13 * flag[20]+ 44 * flag[10]+ 70 * flag[12]+ 44 * flag[17]+ 22 * flag[23]+ 55 * flag[14]+ 73 * flag[26]+ 55 * flag[8]+ 58 * flag[11]+ 31 * flag[30]+ 78 * flag[29]+ 19 * flag[25]+ 52 * flag[31]+ 27 * flag[21]+ 38 * flag[27]+ 40 * flag[28]+ 35 * flag[1]+ 48 * flag[22]+ 71 * flag[15]+ 24 * flag[6]+ 89 * flag[16]+ 37 * flag[3]+ 78 * flag[2] + 3 * flag[5] + 52 * flag[24] + 40 * flag[7] == 113842 )
x.add( 95 * flag[8] + 92 * flag[18] + 84 * flag[31] + 31 * flag[12]+ 35 * flag[10]+ 54 * flag[20]+ 26 * flag[29]+ 29 * flag[3]+ 2 * flag[23]+ 46 * flag[0]+ 30 * flag[26]+ 56 * flag[27]+ 100 * flag[11]+ 43 * flag[1]+ 15 * flag[4]+ 79 * flag[17]+ 12 * flag[5]+ 38 * flag[9]+ 3 * flag[30]+ 16 * flag[21]+ 19 * flag[13]+ 67 * flag[19]+ 37 * flag[28]+ flag[7]+ 73 * flag[16]+ 85 * flag[6]+ 17 * flag[14]+ 90 * flag[22]+ 15 * flag[2] + 43 * flag[25] + 96 * flag[24] == 119824 )
x.add( 36 * flag[22] + 69 * flag[28] + 77 * flag[6] + 92 * flag[20]+ 43 * flag[23]+ 16 * flag[19]+ 92 * flag[5]+ 49 * flag[26]+ 44 * flag[2]+ 26 * flag[29]+ (flag[25] * 64)+ 45 * flag[24]+ 99 * flag[11]+ 43 * flag[4]+ 75 * flag[21]+ 53 * flag[31]+ 18 * flag[18]+ 11 * flag[13]+ 52 * flag[0]+ 16 * flag[8]+ 9 * flag[7]+ 77 * flag[16]+ 33 * flag[10]+ 86 * flag[1]+ 33 * flag[3]+ 29 * flag[9]+ 6 * flag[12]+ 91 * flag[14]+ 36 * flag[15] + 94 * flag[27] + 13 * flag[30] + 89 * flag[17] == 135873 )
x.add( 16 * flag[7] + flag[15] + 82 * flag[9] + 60 * flag[29] + 68 * flag[2]+ 83 * flag[10]+ 47 * flag[5]+ 85 * flag[13]+ 22 * flag[8]+ 92 * flag[27]+ 75 * flag[28]+ 43 * flag[3]+ 29 * flag[22]+ 92 * flag[0]+ 54 * flag[16]+ 17 * flag[30]+ 78 * flag[18]+ 7 * flag[23]+ 69 * flag[21]+ 63 * flag[31]+ 71 * flag[4]+ 10 * flag[6]+ 66 * flag[14]+ 25 * flag[26]+ 32 * flag[1]+ 48 * flag[19]+ 86 * flag[11]+ 20 * flag[25]+ 78 * flag[20]+ 25 * flag[17] + 76 * flag[12] + 13 * flag[24] == 142509 )
x.add( 88 * flag[22] + 23 * flag[13] + 18 * flag[14] + 77 * flag[9]+ 56 * flag[30]+ 79 * flag[2]+ 71 * flag[29]+ 95 * flag[28]+ 87 * flag[24]+ 62 * flag[16]+ 85 * flag[26]+ 43 * flag[20]+ 67 * flag[15]+ 97 * flag[8]+ 80 * flag[0]+ 23 * flag[3]+ 95 * flag[25]+ 82 * flag[21]+ 66 * flag[31]+ 5 * flag[4]+ 66 * flag[27]+ 25 * flag[12]+ 4 * flag[5]+ 12 * flag[7]+ 85 * flag[1]+ 10 * flag[6]+ 45 * flag[11]+ 28 * flag[18]+ 26 * flag[19] + 48 * flag[23] + 45 * flag[17] == 148888 )
x.add( 25 * flag[8] + 81 * flag[30]+ 21 * flag[6]+ 72 * flag[11]+ 48 * flag[18]+ 2 * flag[19]+ 42 * flag[10]+ 22 * flag[24]+ 99 * flag[2]+ 78 * flag[22]+ 83 * flag[12]+ 60 * flag[9]+ 59 * flag[13]+ 15 * flag[5]+ 25 * flag[20]+ 43 * flag[15]+ 56 * flag[28]+ 33 * flag[25]+ 71 * flag[23]+ 31 * flag[0]+ 95 * flag[3]+ 73 * flag[17]+ 86 * flag[14]+ 15 * flag[21]+ 61 * flag[7]+ 12 * flag[29]+ 95 * flag[26] + 13 * flag[1] + 100 * flag[16] + 11 * flag[4] + 79 * flag[27] == 138023 )
x.add( 37 * flag[28] + 62 * flag[25] + 42 * flag[18] + 53 * flag[27]+ 52 * flag[29]+ 70 * flag[22]+ 35 * flag[30]+ 50 * flag[16]+ 59 * flag[8]+ 75 * flag[10]+ 55 * flag[20]+ 23 * flag[0]+ 52 * flag[17]+ 47 * flag[3]+ 91 * flag[13]+ 46 * flag[7]+ 42 * flag[14]+ 79 * flag[26]+ 87 * flag[21]+ 30 * flag[6]+ 26 * flag[1]+ 57 * flag[31]+ 33 * flag[12]+ 51 * flag[9]+ 56 * flag[24]+ 59 * flag[11]+ 36 * flag[23]+ 88 * flag[4]+ 28 * flag[2] + 44 * flag[15] + 19 * flag[19] + 74 * flag[5] == 142299 )
x.add( 80 * flag[21]+ 43 * flag[31]+ 67 * flag[16]+ 55 * flag[13]+ 95 * flag[24]+ 46 * flag[28]+ 93 * flag[5]+ 75 * flag[20]+ 14 * flag[25]+ 24 * flag[26]+ 50 * flag[29]+ 70 * flag[15]+ 63 * flag[30]+ 77 * flag[23]+ 96 * flag[19]+ 66 * flag[11]+ 72 * flag[27]+ 94 * flag[4]+ 63 * flag[22]+ 69 * flag[3]+ 73 * flag[1]+ 60 * flag[7]+ 9 * flag[2]+ 39 * flag[17]+ 25 * flag[0]+ 49 * flag[14] + 48 * flag[8] + 86 * flag[9] + 72 * flag[10] + 23 * flag[18] + 21 * flag[6] == 155777 )
x.add( 25 * flag[24] + 11 * flag[22] + 27 * flag[11]+ 40 * flag[8]+ 53 * flag[15]+ 40 * flag[18]+ 56 * flag[3]+ 2 * flag[2]+ 32 * flag[4]+ 90 * flag[1]+ 54 * flag[16]+ 20 * flag[9]+ 86 * flag[17]+ 82 * flag[31]+ 43 * flag[25]+ 43 * flag[13]+ 86 * flag[21]+ 17 * flag[0]+ (flag[14] * 64)+ 6 * flag[30]+ 86 * flag[5]+ 15 * flag[7]+ 46 * flag[12]+ 21 * flag[26]+ 90 * flag[20]+ 19 * flag[6]+ 93 * flag[23]+ 31 * flag[27] + 62 * flag[29] + 21 * flag[19] + 42 * flag[10] == 117687 )
x.add( 89 * flag[21] + 100 * flag[13] + flag[27]+ 66 * flag[18]+ 40 * flag[17]+ 17 * flag[0]+ 27 * flag[19]+ 26 * flag[31]+ 57 * flag[24]+ 35 * flag[3]+ 80 * flag[1]+ 67 * flag[5]+ 85 * flag[6]+ 7 * flag[15]+ 93 * flag[8]+ 3 * flag[22]+ 77 * flag[12]+ 12 * flag[28]+ 4 * flag[2]+ 27 * flag[9]+ 53 * flag[25]+ 37 * flag[30]+ 43 * flag[23]+ 33 * flag[4]+ 39 * flag[26]+ 7 * flag[7]+ 75 * flag[10]+ 15 * flag[14] + 45 * flag[20] + 36 * flag[29] + 78 * flag[11] + 31 * flag[16] == 117383 )
x.add( 73 * flag[20] + 16 * flag[26] + 100 * flag[5] + 71 * flag[28] + 71 * flag[16]+ 4 * flag[1]+ 77 * flag[31]+ 83 * flag[2]+ 11 * flag[30]+ 53 * flag[19]+ 85 * flag[12]+ 67 * flag[13]+ 39 * flag[8]+ 45 * flag[24]+ 84 * flag[22]+ 99 * flag[14]+ 38 * flag[3]+ 29 * flag[4]+ 90 * flag[9]+ 61 * flag[18]+ 40 * flag[7]+ (flag[17] * 64)+ 9 * flag[25]+ 86 * flag[29]+ 80 * flag[21]+ 4 * flag[15]+ 96 * flag[23]+ 99 * flag[10]+ 40 * flag[27] + 4 * flag[0] + 56 * flag[11] == 155741)
x.add((flag[12] * 64) + 76 * flag[0] + 5 * flag[11] + 87 * flag[2]+ 86 * flag[24]+ 76 * flag[14]+ 38 * flag[23]+ 85 * flag[3]+ 71 * flag[22]+ 42 * flag[29]+ 85 * flag[30]+ 14 * flag[10]+ 17 * flag[13]+ 42 * flag[25]+ 11 * flag[19]+ 44 * flag[15]+ 21 * flag[4]+ 60 * flag[16]+ 28 * flag[6]+ 46 * flag[20]+ 25 * flag[9]+ 77 * flag[31]+ 21 * flag[8]+ 85 * flag[7]+ 36 * flag[1]+ 91 * flag[27]+ 21 * flag[28]+ 38 * flag[17] + 3 * flag[26] + 61 * flag[21] + 15 * flag[5] + 32 * flag[18] == 132804)
x.add(95 * flag[30] + 75 * flag[28] + 3 * flag[10] + 36 * flag[1]+ 60 * flag[3]+ 84 * flag[11]+ 19 * flag[26]+ 76 * flag[27]+ 86 * flag[16]+ 92 * flag[8]+ 96 * flag[14]+ 60 * flag[21]+ 23 * flag[4]+ 60 * flag[12]+ 50 * flag[23]+ 78 * flag[22]+ 45 * flag[9]+ 42 * flag[18]+ 10 * flag[2]+ 60 * flag[20]+ 24 * flag[24]+ 77 * flag[7]+ 41 * flag[6]+ 29 * flag[13]+ 33 * flag[5]+ 2 * flag[15]+ 33 * flag[29]+ 39 * flag[31] + 41 * flag[25] + 100 * flag[19] + 9 * flag[17] + 79 * flag[0] == 145568)
x.add(68 * flag[5] + 98 * flag[27] + 98 * flag[16] + 10 * flag[19] + 25 * flag[26]+ 98 * flag[24]+ 15 * flag[6]+ 50 * flag[18]+ 88 * flag[20]+ 74 * flag[11]+ 83 * flag[1]+ 86 * flag[21]+ 52 * flag[7]+ 39 * flag[10]+ 40 * flag[13]+ 82 * flag[28]+ 37 * flag[3]+ 45 * flag[0]+ 18 * flag[25]+ 2 * flag[29]+ 6 * flag[12]+ 78 * flag[31]+ 37 * flag[2]+ 57 * flag[23]+ 3 * flag[4]+ 59 * flag[8]+ 73 * flag[15]+ flag[22]+ 18 * flag[9]+ 35 * flag[14] + 20 * flag[17] + 54 * flag[30] == 130175)
x.add(60 * flag[10] + 50 * flag[12] + 30 * flag[29] + 90 * flag[19] + 68 * flag[23]+ 60 * flag[18]+ 93 * flag[20]+ 100 * flag[11]+ 98 * flag[14]+ 32 * flag[3]+ 15 * flag[21]+ 79 * flag[0]+ 6 * flag[24]+ 62 * flag[26]+ 96 * flag[6]+ 68 * flag[22]+ 9 * flag[7]+ 88 * flag[5]+ 18 * flag[27]+ 70 * flag[9]+ 96 * flag[25]+ 89 * flag[4]+ 14 * flag[31]+ 83 * flag[17]+ 19 * flag[15]+ 44 * flag[1]+ 96 * flag[8]+ 87 * flag[16]+ 48 * flag[2]+ 95 * flag[13] + 73 * flag[28] + 92 * flag[30] == 171986)
x.add(53 * flag[30] + 87 * flag[25] + 23 * flag[29] + 80 * flag[20] + 86 * flag[9]+ 20 * flag[7]+ 29 * flag[16]+ 31 * flag[14]+ 83 * flag[26]+ 11 * flag[4]+ 29 * flag[19]+ 82 * flag[13]+ 84 * flag[10]+ 70 * flag[1]+ 52 * flag[12]+ 40 * flag[6]+ 91 * flag[8]+ 6 * flag[17]+ 77 * flag[28]+ 56 * flag[5]+ 86 * flag[23]+ 63 * flag[31]+ 26 * flag[27]+ 19 * flag[22]+ 50 * flag[3]+ 15 * flag[15]+ 67 * flag[2]+ 37 * flag[24]+ 84 * flag[18] + 81 * flag[21] + 93 * flag[0] == 151676)
x.add(29 * flag[3] + 93 * flag[5] + 67 * flag[21] + 12 * flag[11]+ 82 * flag[24]+ 100 * flag[8]+ 29 * flag[26]+ 97 * flag[12]+ 32 * flag[6]+ 26 * flag[27]+ 46 * flag[19]+ 8 * (flag[25] + 9 * flag[0] + 2 * flag[17])+ 63 * flag[10]+ 39 * flag[29]+ 81 * flag[15]+ 51 * flag[13]+ 31 * flag[30]+ 49 * flag[4]+ 3 * flag[22]+ 26 * flag[28]+ 15 * flag[20]+ 89 * flag[2]+ 5 * flag[31]+ 47 * flag[18]+ 19 * flag[23]+ 98 * flag[9] + 15 * flag[16] + 49 * flag[1] == 128223)
x.add(13 * flag[14] + 73 * flag[19] + 99 * flag[7] + 76 * flag[12] + 84 * flag[25]+ 91 * flag[10]+ 67 * flag[22]+ 77 * flag[15]+ 23 * flag[26]+ 38 * flag[4]+ 3 * flag[31]+ 76 * flag[13]+ 50 * flag[0]+ 74 * flag[11]+ 45 * flag[28]+ 58 * flag[29]+ 39 * flag[5]+ 95 * flag[9]+ 26 * flag[16]+ 23 * flag[8]+ 28 * flag[24]+ 89 * flag[1]+ 88 * flag[18]+ 3 * flag[3]+ 59 * flag[20]+ 80 * flag[23]+ 49 * flag[17]+ 56 * flag[21]+ 32 * flag[27]+ 24 * flag[2] + 77 * flag[30] + 18 * flag[6] == 138403) 
if x.check() == sat:                #检查机制，如果有解就输出，无解就错误
  m = x.model()
  res = []
 for i in range(32):
   res.append(chr(m[flag[i]].as_long()))
   x=''.join(res)
  print(x)
else:
  print("nope")

其中有几个很麻烦的点需要改动比如*其实是 * ，而<< 6要改成64，这样就出来flag了，太麻烦了只能说。

1
hgame{H4ppY#n3w@Y3AR%fr0M-oDiDi}

normal11

只能说这题看的我，真不会。去看wp了，竟然不是逆我们通常认知的函数

这竟然只是个障眼法，这个是没法逆向的，我们要找到

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
unsigned __int64 sub_400976()
{
  int v0; // eax
  FILE *stream; // [rsp+0h] [rbp-1080h]
  FILE *v3; // [rsp+8h] [rbp-1078h]
  char modes[16]; // [rsp+10h] [rbp-1070h] BYREF
  char v5[16]; // [rsp+20h] [rbp-1060h] BYREF
  char name[16]; // [rsp+30h] [rbp-1050h] BYREF
  char path[16]; // [rsp+40h] [rbp-1040h] BYREF
  char command[32]; // [rsp+50h] [rbp-1030h] BYREF
  char buf[4104]; // [rsp+70h] [rbp-1010h] BYREF
  unsigned __int64 v10; // [rsp+1078h] [rbp-8h]

  v10 = __readfsqword(0x28u);
  strcpy(modes, "rb");
  strcpy(name, "./.real.so");
  strcpy(v5, "wb+");
  strcpy(command, "LD_PRELOAD=./.real.so ./real");
  strcpy(path, "/proc/self/exe");
  if ( access(name, 0) )
  {
    readlink(path, buf, 0x1000uLL);
    stream = fopen(buf, modes);
    fseek(stream, -12936LL, 2);
    v3 = fopen(name, v5);
    while ( !feof(stream) )
    {
      v0 = fgetc(stream);
      fputc(v0, v3);
    }
    fclose(stream);
    fclose(v3);
    system(command);
    exit(0);
  }
  return __readfsqword(0x28u) ^ v10;
}


这个函数的意思从源码读出倒数12936位来作为文件我们可以算出文件起始位置是291F，那么我们只需要用winhex将其分离出来

分离的方法是选中2920位到最末尾，然后右键编辑-剪贴板数据-粘贴至新文件，就可以了记住文件名为.elf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
unsigned __int64 puts()
{
  int i; // [rsp+Ch] [rbp-1014h]
  char buf[4104]; // [rsp+10h] [rbp-1010h] BYREF
  unsigned __int64 v3; // [rsp+1018h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  if ( aaaaa )
  {
    printf("Please input your flag:");
    putchar(10);
    j_encrypt();
    exit(0);
  }
  memset(buf, 0, 0x1000uLL);
  getcwd(buf, 0x1000uLL);
  strcat(buf, "/.real.so");
  unlink(buf);
  printf("Hello!");
  putchar(10);
  mprotect(0LL, 0x1000uLL, 7);
  for ( i = 0; i <= 309; ++i )                       //这是SMC自解密，是一种反调试
    *((_BYTE *)&encrypt + i + 20) ^= i;
  aaaaa = 1;
  return __readfsqword(0x28u) ^ v3;
}

我们采用idc来编写脚本进行自解密：

1
2
3
4
5
6
7
8
9
10
#include <idc.idc>
static main()
{
    auto addr = 0xAF0;   //这里填入要解密字节串的起始地址
    auto i = 0;
    for(i=0;addr+i<0xB90;i++)   //循环结束的条件为字节串的结束地址
    {
        PatchByte(addr+i+20,Byte(addr+i+20)^i);   //异或的数字根据情况修改
    }
}

接下来就有汇编错误了，我不会了，先等一下其他师傅写的wp吧！

来填坑喽！！！uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu

1
2
for ( i = 0; i <= 309; ++i )                       //这是SMC自解密，是一种反调试
    *((_BYTE *)&encrypt + i + 20) ^= i;

一般的smc加密都是这样的一个循环，我们点进加密函数

image-20220328193253471

发现这个函数开头地址是0xAF0，接下来是一个循环长度为0x135，循环的内容一般都是异或一个数，这个是先家20再异或i

1
2
3
4
5
6
7
8
9
10
#include <idc.idc>
static main()
{
    auto addr = 0xAF0;   //这里填入要解密字节串的起始地址
    auto i = 0;
    for(i=0;addr+i<0xC25;i++)   //循环结束的条件为字节串的结束地址，0xc25 = 0xAF0 + 0X135
    {
        PatchByte(addr+i+20,Byte(addr+i+20)^i);   //异或的数字根据情况修改
    }
}

这个才是标准的smc解码，然后就还原了函数，发现中间有个垃圾插入值，nop掉，再在函数名处点u，再点p，出现函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
unsigned __int64 encrypt()
{
  unsigned int v0; // eax
  unsigned int v1; // eax
  char s1[128]; // [rsp+10h] [rbp-190h] BYREF
  char v4[128]; // [rsp+90h] [rbp-110h] BYREF
  char s2[136]; // [rsp+110h] [rbp-90h] BYREF
  unsigned __int64 v6; // [rsp+198h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  memset(s1, 0, sizeof(s1));
  qmemcpy(s1, "C$", 2);
  s1[2] = -27;
  s1[3] = -95;
  s1[4] = -59;
  s1[5] = 29;
  s1[6] = 114;
  s1[7] = -46;
  s1[8] = 40;
  s1[9] = -17;
  s1[10] = -66;
  s1[11] = -22;
  s1[12] = -91;
  s1[13] = -105;
  s1[14] = 68;
  s1[15] = 96;
  s1[16] = -39;
  s1[17] = 15;
  s1[18] = 44;
  s1[19] = 111;
  s1[20] = 94;
  s1[21] = 38;
  s1[22] = -77;
  s1[23] = 10;
  s1[24] = -4;
  s1[25] = -44;
  s1[26] = -77;
  memset(v4, 0, sizeof(v4));
  memset(s2, 0, 0x80uLL);
  scanf((const char *)0x3DBE, v4, s2);
  v0 = strlen("hgame!@#");
  _sub_whyiaminhere(0, "hgame!@#", v0);
  v1 = strlen(v4);
  _sub_whatthefuckisit(0, v4, v1, s2);
  if ( !strcmp(s1, s2) )
    printf("success!");
  else
    printf("failed");
  putchar(10);
  return __readfsqword(0x28u) ^ v6;
}

经典rc4加密，用脚本直接出，这个负数统统用16进制表示。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
import base64


def rc4_main(key="init_key", message="init_message"):
    print("RC4解密主函数调用成功")
    print('\n')
    s_box = rc4_init_sbox(key)
    crypt = rc4_excrypt(message, s_box)
    return crypt


def rc4_init_sbox(key):
    s_box = list(range(256))
    print("原来的 s 盒：%s" % s_box)
    print('\n')
    j = 0
    for i in range(256):
        j = (j + s_box[i] + ord(key[i % len(key)])) % 256
        s_box[i], s_box[j] = s_box[j], s_box[i]
    print("混乱后的 s 盒：%s" % s_box)
    print('\n')
    return s_box


def rc4_excrypt(plain, box):
    print("调用解密程序成功。")
    print('\n')
    plain = base64.b64decode(plain.encode('utf-8'))
    plain = bytes.decode(plain)
    res = []
    i = j = 0
    for s in plain:
        i = (i + 1) % 256
        j = (j + box[i]) % 256
        box[i], box[j] = box[j], box[i]
        t = (box[i] + box[j]) % 256
        k = box[t]
        res.append((ord(s) ^ k))
    print("res用于解密字符串，解密后是：%res" % res)
    print('\n')
    cipher = "".join(res)
    print("解密后的字符串是：%s" % cipher)
    print('\n')
    return cipher

#a=[0xE0,0xB2,0x5F,0x3D,0x8F,0xFA,0x94,0xB6,0xE7,0x9D,0x6C,0x98,0x66,0xD2,0x0F,0xEA,0x6D,0x6F,0xBE,0xC5,0x71,0x40,0x08,0x1B,0xF6,0xF3,0xBD,0xA8,0x8D,0x09,0x7B,0x7C]
a = [67,36,0XE5,0XA1,0XC5,29,114,0XD2,40,0XEF,0XBE,0XEA,0XA5,0X97,68,96,0XD9,15,44,111,94,38,0XB3,10,0XFC,0XD4,0XB3]
s = ""
for i in a:
    s += chr(i)
s = str(base64.b64encode(s.encode('utf-8')), 'utf-8')
rc4_main("hgame!@#", s)

#hgame{th1s_f4ke_re4l_w0rld}

拿下！

normal12

这个题用了OLLVM。

OLLVM是一款是由瑞士西北科技大学开发的一套开源的针对LLVM的代码混淆工具，旨在加强逆向的难度，整个项目包含数个包含独立功能的LLVM Pass，每个Pass会对应实现一种特定的混淆方式，这些Pass将在后面进行细说，通过这些Pass可以改变源程序的CFG和源程序的结构。后期转向商业项目strong.protect。Github目前已支持OLLVM-4.0.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  char v4; // al
  int v5; // ecx
  char v6; // al
  int v7; // ecx
  char v8; // al
  int v9; // ecx
  char v10; // al
  int v11; // ecx
  char v12; // al
  int v13; // ecx
  int v15; // [rsp+4Ch] [rbp-154h]
  int dest[38]; // [rsp+50h] [rbp-150h] BYREF
  int v17; // [rsp+E8h] [rbp-B8h]
  int v18; // [rsp+ECh] [rbp-B4h]
  char v19[64]; // [rsp+F0h] [rbp-B0h] BYREF
  char s[108]; // [rsp+130h] [rbp-70h] BYREF
  int v21; // [rsp+19Ch] [rbp-4h]

  v21 = 0;
  printf("please input string:\n");
  gets(s, argv);
  v17 = strlen(s);
  v18 = 5;
  v15 = -1046111848;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        while ( v15 == -2012804730 )
        {
          memcpy(dest, "J", 0x90uLL);
          v4 = fun_check1(s);
          v5 = -1855144052;
          if ( (v4 & 1) != 0 )
            v5 = 1890735184;
          v15 = v5;
        }
        if ( v15 != -1855144052 )
          break;
        v15 = -1153978545;
        printf("what a shame !!!\n");
      }
      if ( v15 != -1612797716 )
        break;
      v10 = fun_check4(s);
      v11 = -1855144052;
      if ( (v10 & 1) != 0 )
        v11 = -842747696;
      v15 = v11;
    }
    if ( v15 == -1153978545 )
      break;
    switch ( v15 )
    {
      case -1046111848:
        v3 = -2012804730;
        if ( v18 < v17 - 1 )
          v3 = -370117910;
        v15 = v3;
        break;
      case -842747696:
        v12 = fun_check5(v19, dest);
        v13 = -1855144052;
        if ( (v12 & 1) != 0 )
          v13 = -194644933;
        v15 = v13;
        break;
      case -370117910:
        v19[v18 - 5] = s[v18];
        v15 = 805361575;
        break;
      case -194644933:
        v15 = -1153978545;
        printf("you got it !\n");
        break;
      case 805361575:
        ++v18;
        v15 = -1046111848;
        break;
      case 1222385267:
        v8 = fun_check3(s);
        v9 = -1855144052;
        if ( (v8 & 1) != 0 )
          v9 = -1612797716;
        v15 = v9;
        break;
      default:
        v6 = fun_check2(s);
        v7 = -1855144052;
        if ( (v6 & 1) != 0 )
          v7 = 1222385267;
        v15 = v7;
        break;
    }
  }
  return 0;
}

我们发现有5个fun_check函数：

先看第一个函数fun_check3：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
int64 __fastcall fun_check1(char *a1)
{
  int v1; // eax
  int v2; // eax
  int v4; // [rsp+18h] [rbp-18h]
  int v5; // [rsp+1Ch] [rbp-14h]
  char v6; // [rsp+2Bh] [rbp-5h]

  v5 = strlen(a1);
  v4 = -1212486993;
  while ( 1 )                                   // 进入这里，如果字符串长度大于50，v4=v1=-2141247101
  {
    while ( 1 )                                 // 第一次不进入，退回第二个循环
    {
      while ( v4 == -2141247101 )
      {
        v6 = 0;                                 // 如果大于50，第二次进入
        v4 = -288944633;                        // v4=-288944633，再进入下一个循环，退出
      }
      if ( v4 != -1212486993 )
        break;
      v1 = 304458961;
      if ( v5 >= 50 )
        v1 = -2141247101;
      v4 = v1;
    }
    if ( v4 == -288944633 )
      break;
    if ( v4 == 304458961 )
    {
      v2 = 1722401369;
      if ( v5 <= 0 )
        v2 = -2141247101;
      v4 = v2;
    }
    else
    {
      v6 = 1;
      v4 = -288944633;
    }
  }
  return v6 & 1;                                // 说明该函数判断字符串长度是否小于50
}

这个函数说明了字符串小于等于50.

第二个函数fun_check2：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
int64 __fastcall fun_check2(char *a1)
{
  int v1; // eax
  int v2; // eax
  int v4; // [rsp+2Ch] [rbp-24h]
  int v5; // [rsp+30h] [rbp-20h]
  int v6; // [rsp+34h] [rbp-1Ch]
  char s[6]; // [rsp+3Ah] [rbp-16h] BYREF
  char *v8; // [rsp+40h] [rbp-10h]
  char v9; // [rsp+4Fh] [rbp-1h]

  v8 = a1;
  strcpy(s, "flag{");
  v6 = strlen(s);
  v5 = 0;
  v4 = -1692016886;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( v4 == -1951541847 )
      {
        ++v5;
        v4 = -1692016886;
      }
      if ( v4 != -1692016886 )
        break;
      v1 = 1623142970;
      if ( v5 <= v6 - 912394623 + 912394622 )
        v1 = 1747921827;
      v4 = v1;
    }
    if ( v4 == 373027714 )
      break;
    switch ( v4 )
    {
      case 819155342:
        v4 = -1951541847;
        break;
      case 1603812802:
        v9 = 0;
        v4 = 373027714;
        break;
      case 1623142970:
        v9 = 1;
        v4 = 373027714;
        break;
      default:
        v2 = 819155342;
        if ( s[v5] != v8[v5] )
          v2 = 1603812802;
        v4 = v2;
        break;
    }
  }
  return v9 & 1;
}

这个函数就很明显是判断开头五个是不是flag{

第三个函数fun_check3：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
int64 __fastcall fun_check3(char *a1)
{
  int v1; // eax
  int i; // [rsp+14h] [rbp-14h]
  char v4; // [rsp+23h] [rbp-5h]

  for ( i = 275100227; ; i = 2019489044 )
  {
    while ( 1 )
    {
      while ( i == -389150027 )
      {
        v4 = 0;
        i = 2019489044;
      }
      if ( i != 275100227 )
        break;
      v1 = 735669791;
      if ( a1[41] != '}' )
        v1 = -389150027;
      i = v1;
    }
    if ( i != 735669791 )
      break;
    v4 = 1;
  }
  return v4 & 1;
}

好家伙，更明显了，是判断最后一个是否是}，而且我们还知道这个字符串长度是42

我们再看fun_check4：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
int64 __fastcall fun_check4(char *a1)
{
  int v1; // eax
  int v2; // eax
  int v3; // eax
  int v4; // eax
  int v6; // [rsp+20h] [rbp-14h]
  char v7; // [rsp+2Fh] [rbp-5h]

  v6 = -181591648;
  while ( 1 )
  {
    while ( v6 == -2042693465 )
    {
      v4 = 135449342;
      if ( a1[28] != 45 )
        v4 = 129082224;
      v6 = v4;
    }
    if ( v6 == -261631822 )
      break;
    switch ( v6 )
    {
      case -181591648:
        v1 = 147625658;
        if ( a1[13] != 45 )
          v1 = 129082224;
        v6 = v1;
        break;
      case 129082224:
        v7 = 0;
        v6 = -261631822;
        break;
      case 135449342:
        v7 = 1;
        v6 = -261631822;
        break;
      case 147625658:
        v2 = 1254423680;
        if ( a1[18] != 45 )
          v2 = 129082224;
        v6 = v2;
        break;
      default:
        v3 = -2042693465;
        if ( a1[23] != 45 )
          v3 = 129082224;
        v6 = v3;
        break;
    }
  }
  return v7 & 1;
}

45代表的ascii码是“-”，所以我们要判断字符串数组中第23，18，28位是否是“ - ”

由此我们大致推出了flag的样式：

flag{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

第五个函数fun_check5:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
int64 __fastcall fun_check5(char *a1, int *a2)
{
  int v2; // eax
  int v3; // eax
  int v4; // eax
  int v5; // eax
  int v6; // eax
  int v7; // eax
  int v8; // eax
  int v9; // eax
  int v11; // [rsp+58h] [rbp-E8h]
  int v12; // [rsp+5Ch] [rbp-E4h]
  int v13[50]; // [rsp+60h] [rbp-E0h]
  int *v14; // [rsp+128h] [rbp-18h]
  char *v15; // [rsp+130h] [rbp-10h]
  char v16; // [rsp+13Fh] [rbp-1h]

  v15 = a1;
  v14 = a2;
  v12 = 0;
  v11 = -624695604;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        while ( 1 )
        {
          while ( 1 )
          {
            while ( 1 )
            {
              while ( 1 )
              {
                while ( 1 )
                {
                  while ( 1 )
                  {
                    while ( 1 )
                    {
                      while ( 1 )
                      {
                        while ( 1 )
                        {
                          while ( 1 )
                          {
                            while ( 1 )
                            {
                              while ( 1 )
                              {
                                while ( 1 )
                                {
                                  while ( v11 == -1771681815 )
                                  {
                                    v6 = 1740029224;
                                    if ( v15[v12] >= 97 )    //如果大于a，v6 = -1207418117，之后break
                                      v6 = -1207418117;
                                    v11 = v6;
                                  }
                                  if ( v11 != -1490231676 )
                                    break;
                                  ++v12;
                                  v11 = -768723158;
                                }
                                if ( v11 != -1407902233 )
                                  break;
                                v4 = -1188300396;
                                if ( v15[v12] <= 57 )    //小于等于9
                                  v4 = -478229440;
                                v11 = v4;
                              }
                              if ( v11 != -1207418117 )
                                break;
                              v7 = 1740029224;
                              if ( v15[v12] <= 122 )   //小于等于z
                                v7 = 2096910144;
                              v11 = v7;
                            }
                            if ( v11 != -1188300396 )
                              break;
                            v5 = -1771681815;
                            if ( v15[v12] == 45 )    //等于“ - ”
                              v5 = -1167333891;
                            v11 = v5;
                          }
                          if ( v11 != -1167333891 )
                            break;
                          v13[v12] = v15[v12];
                          v11 = -118846692;
                        }
                        if ( v11 != -995934932 )
                          break;
                        v3 = -1188300396;
                        if ( v15[v12] >= 48 )    //大于等于0
                          v3 = -1407902233;
                        v11 = v3;
                      }
                      if ( v11 != -991718889 )
                        break;
                      v11 = -1490231676;
                    }
                    if ( v11 != -768723158 )
                      break;
                    v8 = 1681851953;
                    if ( v12 < 36 )        
                      v8 = 434013166;
                    v11 = v8;
                  }
                  if ( v11 != -624695604 )
                    break;
                  v2 = 659899916;
                  if ( v12 < 36 )
                    v2 = -995934932;
                  v11 = v2;
                }
                if ( v11 != -478229440 )
                  break;
                v13[v12] = v15[v12] + 17;
                v11 = 1926387427;
              }
              if ( v11 != -451717645 )
                break;
              ++v12;
              v11 = -624695604;
            }
            if ( v11 != -118846692 )
              break;
            v11 = 1926387427;
          }
          if ( v11 != 329160926 )
            break;
          v16 = 0;
          v11 = 1269730414;
        }
        if ( v11 != 434013166 )
          break;
        v9 = -991718889;
        if ( v13[v12] != v14[v12] )      //经一系列变换与dest对比
          v9 = 329160926;
        v11 = v9;
      }
      if ( v11 != 659899916 )
        break;
      v12 = 0;
      v11 = -768723158;
    }
    if ( v11 == 1269730414 )
      break;
    switch ( v11 )
    {
      case 1681851953:
        v16 = 1;
        v11 = 1269730414;
        break;
      case 1740029224:
        v11 = -118846692;
        break;
      case 1926387427:
        v11 = -451717645;
        break;
      default:
        v13[v12] = v15[v12] - 1347911315 + 1347911267;
        v11 = 1740029224;
        break;
    }
  }
  return v16 & 1;
}

我们动态调试一下，设三个断点，快速查看，dest的值可知：J2261C63-3I2I-EGE4-IBCC-IE41A5I5F4HB

我输入flag{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx1}进去后，直接断点到return查看v13发现x变为H再查ascii表发现是减去了48

那么1变为了B是增加了17，那么很明显我们可以把脚本分析出来了

1
2
3
4
5
6
7
8
9
10
11
12
flag=""
data="J2261C63-3I2I-EGE4-IBCC-IE41A5I5F4HB"
for i in range(len(data)):
  if data[i]>='A' and data[i]<='J':
    flag += chr(ord(data[i])-17)
  elif data[i]>='1' and data[i]<='A':
    flag += chr(ord(data[i])+48)
  elif data[i]=='-':
    flag += "-"
print("flag{"+flag+"}")

#flag{9bbfa2fc-c8b8-464d-8122-84da0e8e5d71}

normal13

这个题还是比较难的，主要还是混淆的比较恶心人，这种类型的题叫做ollvm的控制流平坦化。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v3; // eax
  int v4; // eax
  int v5; // ecx
  int v6; // eax
  int v7; // eax
  int v8; // eax
  int v9; // eax
  int v10; // eax
  char v11; // al
  char v12; // al
  char v13; // al
  char v14; // al
  char v15; // al
  int v16; // ecx
  int v17; // eax
  int v18; // eax
  int v19; // eax
  int v20; // eax
  int v21; // eax
  int v22; // ecx
  char v24; // al
  char v25; // al
  char v26; // al
  char v27; // al
  int v28; // [rsp+9Ch] [rbp-94h]
  char v29[8]; // [rsp+A0h] [rbp-90h] BYREF
  char v30[8]; // [rsp+A8h] [rbp-88h] BYREF
  char v31[8]; // [rsp+B0h] [rbp-80h] BYREF
  char v32[8]; // [rsp+B8h] [rbp-78h] BYREF
  char v33[8]; // [rsp+C0h] [rbp-70h] BYREF
  char v34[7]; // [rsp+C8h] [rbp-68h] BYREF
  char v35; // [rsp+CFh] [rbp-61h]
  int v36; // [rsp+D0h] [rbp-60h]
  int v37; // [rsp+D4h] [rbp-5Ch]
  int v38; // [rsp+D8h] [rbp-58h]
  int v39; // [rsp+DCh] [rbp-54h]
  char s; // [rsp+E0h] [rbp-50h] BYREF
  char v41[23]; // [rsp+E1h] [rbp-4Fh] BYREF
  char v42[8]; // [rsp+F8h] [rbp-38h] BYREF
  char v43[8]; // [rsp+100h] [rbp-30h] BYREF
  char v44[8]; // [rsp+108h] [rbp-28h] BYREF
  char v45[4]; // [rsp+110h] [rbp-20h] BYREF
  int v46; // [rsp+114h] [rbp-1Ch]
  const char **v47; // [rsp+118h] [rbp-18h]
  int v48; // [rsp+120h] [rbp-10h]
  int v49; // [rsp+124h] [rbp-Ch]
  int v50; // [rsp+128h] [rbp-8h]
  bool v51; // [rsp+12Eh] [rbp-2h]
  bool v52; // [rsp+12Fh] [rbp-1h]

  v49 = 0;
  v48 = argc;
  v47 = argv;
  v46 = time(0LL);
  puts("func(?)=\"01abfc750a0c942167651c40d088531d\"?");
  s = getchar();
  fgets(v41, 21, stdin);
  v39 = time(0LL);
  v38 = v39 - v46;                              // 0
  v50 = v39 - v46;                              // 0
  v28 = 1883240069;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        while ( 1 )
        {
          while ( 1 )
          {
            while ( 1 )
            {
              while ( 1 )
              {
                while ( 1 )
                {
                  while ( 1 )
                  {
                    while ( 1 )
                    {
                      while ( 1 )
                      {
                        while ( 1 )
                        {
                          while ( 1 )
                          {
                            while ( v28 == -2090540314 )
                            {
                              v35 = v38 ^ v41[v36 - 1];// 因为异或0，所以v35=v41[v36-1]
                              v34[0] = main::$_0::operator()((__int64)v44, v35);// 返回v35，v34=v35=v41[v36-1]
                              v33[0] = main::$_1::operator()((__int64)v42, *(&s + v38 + v36 - 1));// 返回后面参数
                              v11 = main::$_1::operator() const(char)::{lambda(int)#1}::operator()(v33, 7);// 返回a1%7
                              v35 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()((__int64)v34, v11);// 字符串v34+v11后返回
                              v32[0] = main::$_2::operator()((__int64)v45, v35);// 只是单纯的把上一个函数的结果再返回。
                              v31[0] = main::$_2::operator()((__int64)v45, *(&s + v38 + v36 - 1));// 只是单纯的把上一个函数的结果再返回。
                              v12 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v31, 18);// 异或18
                              v30[0] = main::$_3::operator()(v43, (unsigned int)v12);// 只是单纯的把上一个函数的结果再返回。
                              v13 = main::$_3::operator() const(char)::{lambda(char)#1}::operator()(v30, 3LL);// 乘3
                              v29[0] = main::$_0::operator()((__int64)v44, v13);// return v13
                              v14 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()((__int64)v29, 2);// 相加后返回
                              v15 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v32, v14);// 异或
                              v16 = 1299792285;
                              v35 = v15;
                              v52 = enc[v36 - 1] != v15;// 比较处
                              if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
                                v16 = -424557443;
                              v28 = v16;
                            }
                            if ( v28 != -1957245689 )
                              break;
                            v28 = 1587023630;
                          }
                          if ( v28 != -1884297895 )
                            break;
                          v28 = -984930794;
                          puts("You win");
                        }
                        if ( v28 != -1852837876 )
                          break;
                        v18 = 1375414539;
                        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
                          v18 = 1154698238;
                        v28 = v18;
                      }
                      if ( v28 != -1220297252 )
                        break;
                      v21 = -1884297895;
                      if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
                        v21 = -984930794;
                      v28 = v21;
                    }
                    if ( v28 != -984930794 )
                      break;
                    puts("You win");
                    v22 = -1884297895;
                    if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
                      v22 = 456293525;
                    v28 = v22;
                  }
                  if ( v28 != -740226431 )
                    break;
                  v4 = 2137069843;
                  if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
                    v4 = 739060228;
                  v28 = v4;
                }
                if ( v28 == -459161563 )
                  exit(0);
                if ( v28 != -424557443 )
                  break;
                v17 = 1856799435;
                if ( v52 )
                  v17 = -1852837876;
                v28 = v17;
              }
              if ( v28 != -350248402 )
                break;
              v28 = -55540564;
            }
            if ( v28 != -294402024 )
              break;
            v6 = 1721328217;
            if ( v51 )
              v6 = -459161563;
            v28 = v6;
          }
          if ( v28 != -226137905 )
            break;
          v28 = 24093646;
        }
        if ( v28 != -55540564 )
          break;
        v20 = -350248402;
        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
          v20 = -226137905;
        v28 = v20;
      }
      if ( v28 != 24093646 )
        break;
      ++v36;
      v28 = 1587023630;
    }
    if ( v28 == 456293525 )
      break;
    switch ( v28 )
    {
      case 506113758:
        puts("Let the silent second hand take the place of my doubt...");
        exit(0);
      case 623475433:
        v36 = 1;
        v28 = 1132336453;
        break;
      case 739060228:
        v37 = strlen(&s);
        v51 = v37 != 21;
        v5 = 2137069843;
        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
          v5 = -294402024;
        v28 = v5;
        break;
      case 1011555671:
        v10 = 1299792285;
        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
          v10 = -2090540314;
        v28 = v10;
        break;
      case 1132336453:
        v8 = 623475433;
        v36 = 1;
        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
          v8 = -1957245689;
        v28 = v8;
        break;
      case 1154698238:
        exit(0);
      case 1299792285:
        v35 = v38 ^ v41[v36 - 1];
        v34[0] = main::$_0::operator()((__int64)v44, v35);
        v33[0] = main::$_1::operator()((__int64)v42, *(&s + v38 + v36 - 1));
        v24 = main::$_1::operator() const(char)::{lambda(int)#1}::operator()(v33, 7);
        v35 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()((__int64)v34, v24);
        v32[0] = main::$_2::operator()((__int64)v45, v35);
        v31[0] = main::$_2::operator()((__int64)v45, *(&s + v38 + v36 - 1));
        v25 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v31, 18);
        v30[0] = main::$_3::operator()(v43, (unsigned int)v25);
        v26 = main::$_3::operator() const(char)::{lambda(char)#1}::operator()(v30, 3LL);
        v29[0] = main::$_0::operator()((__int64)v44, v26);
        v27 = main::$_0::operator() const(char)::{lambda(char)#1}::operator()((__int64)v29, 2);
        v35 = main::$_2::operator() const(char)::{lambda(char)#1}::operator()(v32, v27);
        v28 = -2090540314;
        break;
      case 1375414539:
        exit(0);
      case 1587023630:
        v9 = -1220297252;
        if ( v36 < 21 )
          v9 = 1011555671;
        v28 = v9;
        break;
      case 1721328217:
        v7 = 623475433;
        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
          v7 = 1132336453;
        v28 = v7;
        break;
      case 1856799435:
        v19 = -350248402;
        if ( y < 10 || ((((_BYTE)x - 1) * (_BYTE)x) & 1) == 0 )
          v19 = -55540564;
        v28 = v19;
        break;
      case 1883240069:
        v3 = -740226431;
        if ( v50 > 0 )
          v3 = 506113758;
        v28 = v3;
        break;
      default:
        v37 = strlen(&s);
        v28 = 739060228;
        break;
    }
  }
  return 0;
}

做这一类题只用看关键的函数，上面的已经批注了。

我们只看几个关键函数

1
main::$_0::operator() const(char)::{lambda(char)#1}::operator()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
int64 __fastcall main::$_0::operator() const(char)::{lambda(char)#1}::operator()(__int64 a1, char a2)
{
  int v2; // eax
  int v3; // eax
  char *v5; // [rsp+0h] [rbp-40h]
  int v6; // [rsp+8h] [rbp-38h]
  int v7; // [rsp+Ch] [rbp-34h]
  int v8; // [rsp+10h] [rbp-30h]
  int v9; // [rsp+14h] [rbp-2Ch]
  char *v10; // [rsp+18h] [rbp-28h]
  char v11; // [rsp+23h] [rbp-1Dh]
  int v12; // [rsp+24h] [rbp-1Ch]
  bool v13; // [rsp+2Ah] [rbp-16h]
  bool v14; // [rsp+2Bh] [rbp-15h]
  unsigned int v15; // [rsp+2Ch] [rbp-14h]

  v13 = ((((_BYTE)x_5 - 1) * (_BYTE)x_5) & 1) == 0;
  v14 = y_6 < 10;
  v12 = 1023500310;
  v11 = a2;
  v10 = (char *)a1;
  do
  {
    while ( 1 )
    {
      while ( 1 )                               // 往下走
      {
        while ( 1 )
        {
          v9 = v12;
          v8 = v12 + 2037067308;
          if ( v12 != -2037067308 )
            break;
          v5 = v10;
          *((_BYTE *)&v5 - 16) = v11;
          v12 = -1418698808;
        }
        v7 = v9 + 1418698808;
        if ( v9 != -1418698808 )
          break;
        v3 = -2037067308;
        v5 = v10;
        *((_BYTE *)&v5 - 16) = v11;
        v15 = *((char *)&v5 - 16) + *v5;        // 重点的地方，是将两个字符串相加，返回v15
        if ( y_6 < 10 || ((((_BYTE)x_5 - 1) * (_BYTE)x_5) & 1) == 0 )
          v3 = 1456142001;
        v12 = v3;
      }
      v6 = v9 - 1023500310;
      if ( v9 != 1023500310 )
        break;
      v2 = -2037067308;
      if ( v14 || v13 )
        v2 = -1418698808;
      v12 = v2;
    }
    HIDWORD(v5) = v9 - 1456142001;
  }
  while ( v9 != 1456142001 );
  return v15;
}

这个函数就是将字符串加起来

1
main::$_2::operator()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
char __fastcall main::$_2::operator()(__int64 a1, char a2)
{
  int v2; // eax
  int v3; // eax
  __int64 v5; // [rsp+0h] [rbp-50h]
  int v6; // [rsp+Ch] [rbp-44h]
  int v7; // [rsp+10h] [rbp-40h]
  int v8; // [rsp+14h] [rbp-3Ch]
  int v9; // [rsp+18h] [rbp-38h]
  int v10; // [rsp+1Ch] [rbp-34h]
  __int64 v11; // [rsp+20h] [rbp-30h]
  char v12; // [rsp+2Fh] [rbp-21h]
  int v13; // [rsp+30h] [rbp-20h]
  bool v14; // [rsp+35h] [rbp-1Bh]
  bool v15; // [rsp+36h] [rbp-1Ah]
  char v16; // [rsp+37h] [rbp-19h]

  v14 = ((((_BYTE)x_11 - 1) * (_BYTE)x_11) & 1) == 0;
  v15 = y_12 < 10;
  v13 = -1990873412;
  v12 = a2;
  v11 = a1;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        v10 = v13;
        v9 = v13 + 1990873412;
        if ( v13 != -1990873412 )
          break;
        v2 = -1373097315;
        if ( v15 || v14 )
          v2 = 1457028246;
        v13 = v2;
      }
      v8 = v10 + 1373097315;
      if ( v10 != -1373097315 )
        break;
      v5 = v11;
      *((_BYTE *)&v5 - 16) = v12;
      LOBYTE(v5) = *((_BYTE *)&v5 - 16);
      v13 = 1457028246;
    }
    v7 = v10 + 961146335;
    if ( v10 == -961146335 )
      break;
    v6 = v10 - 1457028246;
    if ( v10 == 1457028246 )
    {
      v3 = -1373097315;
      v5 = v11;
      *((_BYTE *)&v5 - 16) = v12;
      LOBYTE(v5) = *((_BYTE *)&v5 - 16);
      v16 = v5;
      if ( y_12 < 10 || ((((_BYTE)x_11 - 1) * (_BYTE)x_11) & 1) == 0 )
        v3 = -961146335;
      v13 = v3;
    }
  }
  return v16;
}

这个函数还是比较难看懂的，最后是我写脚本猜出来的，这个函数就是返回上一个函数return出来的值。

看主函数我们可以在对比处提取enc的值，然后我们逆向的时候要先用enc与v14异或得到v32，用v32来求flag，这个地方还有一个坑

1
func(?)=\"01abfc750a0c942167651c40d088531d\"    //指的是#的md5

给出脚本：

1
2
3
4
5
6
enc =[0xF3, 0x2E, 0x18, 0x36, 0xE1, 0x4C, 0x22, 0xD1, 0xF9, 0x8C, 0x40, 0x76, 0xF4, 0x0E, 0x00, 0x05, 0xA3, 0x90, 0x0E, 0xA5]
flag='#'
for i in range(20):
  flag+=chr(((enc[i]^((ord(flag[i])^18)*3+2))-(ord(flag[i])%7))&0xff)
print(flag)
# #flag{mY-CurR1ed_Fns}

注意我不加&0xff的时候，会出现ValueError: chr() arg not in range(0x110000)，加上后是取低8位在256范围内！

normal14

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
int64 __fastcall main(int a1, char **a2, char **a3)
{
  char v4[16]; // [rsp+0h] [rbp-4A0h] BYREF
  char v5[16]; // [rsp+10h] [rbp-490h] BYREF
  char v6[16]; // [rsp+20h] [rbp-480h] BYREF
  char v7[16]; // [rsp+30h] [rbp-470h] BYREF
  char v8[112]; // [rsp+40h] [rbp-460h] BYREF
  char v9[1000]; // [rsp+B0h] [rbp-3F0h] BYREF
  unsigned __int64 v10; // [rsp+498h] [rbp-8h]

  v10 = __readfsqword(0x28u);
  puts("[sign in]");
  printf("[input your flag]: ");
  __isoc99_scanf("%99s", v8);
  sub_96A(v8, (__int64)v9);
  __gmpz_init_set_str((__int64)v7, (__int64)"ad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35", 16LL);
  __gmpz_init_set_str((__int64)v6, (__int64)v9, 16LL);
  __gmpz_init_set_str(
    (__int64)v4,
    (__int64)"103461035900816914121390101299049044413950405173712170434161686539878160984549",
    10LL);
  __gmpz_init_set_str((__int64)v5, (__int64)"65537", 10LL);
  __gmpz_powm((__int64)v6, (__int64)v6, (__int64)v5, (__int64)v4);
  if ( (unsigned int)__gmpz_cmp((__int64)v6, (__int64)v7) )
    puts("GG!");
  else
    puts("TTTTTTTTTTql!");
  return 0LL;
}

这个题我想查看函数发现没东西，那么证明这个函数是c中自带的，但是这个我感觉好熟悉。看到65537，多半是RSA，当时极客大挑战做过几道，就直接给脚本了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
from gmpy2 import*
from libnum import*
from Crypto.Util.number import long_to_bytes
import gmpy2
n=103461035900816914121390101299049044413950405173712170434161686539878160984549
c=0xad939ff59f6e70bcbfad406f2494993757eee98b91bc244184a377520d06fc35
e=65537
p=366669102002966856876605669837014229419
q=282164587459512124844245113950593348271
phi=(p-1)*(q-1)
d=gmpy2.invert(e,phi)
flag=pow(c,int(d),n)
print(n2s(flag))
#b'suctf{Pwn_@_hundred_years}'

我们将n分为两个质因数，则剩下的就是c，由此可以求flag

normal16

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  DWORD v3; // eax
  DWORD v4; // eax
  char Str[260]; // [esp+4Ch] [ebp-310h] BYREF
  int v7; // [esp+150h] [ebp-20Ch]
  char String1[260]; // [esp+154h] [ebp-208h] BYREF
  char Destination[260]; // [esp+258h] [ebp-104h] BYREF

  memset(Destination, 0, sizeof(Destination));
  memset(String1, 0, sizeof(String1));
  v7 = 0;
  printf("pls input the first passwd(1): ");
  scanf("%s", Destination);
  if ( strlen(Destination) != 6 )
  {
    printf("Must be 6 characters!\n");
    ExitProcess(0);
  }
  v7 = atoi(Destination);          //将Destination转成int类型说明Destination只能是数字，如果有字母，return 0
  if ( v7 < 100000 )
    ExitProcess(0);
  strcat(Destination, "@DBApp");       //六位数字后连接字符串
  v3 = strlen(Destination);
  sub_40100A((BYTE *)Destination, v3, String1);   //第一个函数
  if ( !_strcmpi(String1, "6E32D0943418C2C33385BC35A1470250DD8923A9") )
  {
    printf("continue...\n\n");
    printf("pls input the first passwd(2): ");
    memset(Str, 0, sizeof(Str));
    scanf("%s", Str);
    if ( strlen(Str) != 6 )
    {
      printf("Must be 6 characters!\n");
      ExitProcess(0);
    }
    strcat(Str, Destination);              //password2加上password1
    memset(String1, 0, sizeof(String1));
    v4 = strlen(Str);
    sub_401019((BYTE *)Str, v4, String1);
    if ( !_strcmpi("27019e688a4e62a649fd99cadaafdb4e", String1) )
    {
      if ( !(unsigned __int8)sub_40100F(Str) )
      {
        printf("Error!!\n");
        ExitProcess(0);
      }
      printf("bye ~~\n");
    }
  }
  return 0;
}

这道题只看主函数应该是很好理解的 。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
int __cdecl sub_401230(BYTE *pbData, DWORD dwDataLen, LPSTR lpString1)
{
  DWORD i; // [esp+4Ch] [ebp-28h]
  CHAR String2[4]; // [esp+50h] [ebp-24h] BYREF
  BYTE v6[20]; // [esp+54h] [ebp-20h] BYREF
  DWORD pdwDataLen; // [esp+68h] [ebp-Ch] BYREF
  HCRYPTHASH phHash; // [esp+6Ch] [ebp-8h] BYREF
  HCRYPTPROV phProv; // [esp+70h] [ebp-4h] BYREF

  if ( !CryptAcquireContextA(&phProv, 0, 0, 1u, 0xF0000000) )
    return 0;
  if ( CryptCreateHash(phProv, 0x8004u, 0, 0, &phHash) )
  {
    if ( CryptHashData(phHash, pbData, dwDataLen, 0) )
    {
      CryptGetHashParam(phHash, 2u, v6, &pdwDataLen, 0);
      *lpString1 = 0;
      for ( i = 0; i < pdwDataLen; ++i )
      {
        wsprintfA(String2, "%02X", v6[i]);
        lstrcatA(lpString1, String2);
      }
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      return 1;
    }
    else
    {
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      return 0;
    }
  }
  else
  {
    CryptReleaseContext(phProv, 0);
    return 0;
  }
}

这个里面全是api函数，根据参数来确定是哪种hash加密。0x8004u对应sha1加密，我学习了一下脚本的写法：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
import hashlib
password1 = ""
arr = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9']
for i1 in arr:
  for i2 in arr:
    for i3 in arr:
      for i4 in arr:
        for i5 in arr:
          for i6 in arr:
            password1 = i1 + i2 + i3 + i4 + i5 + i6 + "@DBApp"
            if(hashlib.sha1(password1.encode("utf-8")).hexdigest().upper() =="6E32D0943418C2C33385BC35A1470250DD8923A9"):  
              print(password1)
              break
#hash引入hashlib库，用hashlib.sha1(a.encode("utf-8"))来编码，要指名编码的格式，不然会报错，hexdigest函数是转换成16进制，upper是将小写转换成大写。
#password1=123321@DBApp

从参数来看第二个函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
int __cdecl sub_401040(BYTE *pbData, DWORD dwDataLen, LPSTR lpString1)
{
  DWORD i; // [esp+4Ch] [ebp-24h]
  CHAR String2[4]; // [esp+50h] [ebp-20h] BYREF
  BYTE v6[16]; // [esp+54h] [ebp-1Ch] BYREF
  DWORD pdwDataLen; // [esp+64h] [ebp-Ch] BYREF
  HCRYPTHASH phHash; // [esp+68h] [ebp-8h] BYREF
  HCRYPTPROV phProv; // [esp+6Ch] [ebp-4h] BYREF

  if ( !CryptAcquireContextA(&phProv, 0, 0, 1u, 0xF0000000) )
    return 0;
  if ( CryptCreateHash(phProv, 0x8003u, 0, 0, &phHash) )
  {
    if ( CryptHashData(phHash, pbData, dwDataLen, 0) )
    {
      CryptGetHashParam(phHash, 2u, v6, &pdwDataLen, 0);
      *lpString1 = 0;
      for ( i = 0; i < pdwDataLen; ++i )
      {
        wsprintfA(String2, "%02X", v6[i]);
        lstrcatA(lpString1, String2);
      }
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      return 1;
    }
    else
    {
      CryptDestroyHash(phHash);
      CryptReleaseContext(phProv, 0);
      return 0;
    }
  }
  else
  {
    CryptReleaseContext(phProv, 0);
    return 0;
  }
}

参数为：0x8003u是个md5函数，但md5爆破的话是很慢的。所以我们找到最后对比时的函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
char __cdecl sub_4014D0(LPCSTR lpString)
{
  LPCVOID lpBuffer; // [esp+50h] [ebp-1Ch]
  DWORD NumberOfBytesWritten; // [esp+58h] [ebp-14h] BYREF
  DWORD nNumberOfBytesToWrite; // [esp+5Ch] [ebp-10h]
  HGLOBAL hResData; // [esp+60h] [ebp-Ch]
  HRSRC hResInfo; // [esp+64h] [ebp-8h]
  HANDLE hFile; // [esp+68h] [ebp-4h]

  hFile = 0;
  hResData = 0;
  nNumberOfBytesToWrite = 0;
  NumberOfBytesWritten = 0;
  hResInfo = FindResourceA(0, (LPCSTR)0x65, "AAA");
  if ( !hResInfo )
    return 0;
  nNumberOfBytesToWrite = SizeofResource(0, hResInfo);
  hResData = LoadResource(0, hResInfo);
  if ( !hResData )
    return 0;
  lpBuffer = LockResource(hResData);
  sub_401005(lpString, (int)lpBuffer, nNumberOfBytesToWrite);
  hFile = CreateFileA("dbapp.rtf", 0x10000000u, 0, 0, 2u, 0x80u, 0);
  if ( hFile == (HANDLE)-1 )
    return 0;
  if ( !WriteFile(hFile, lpBuffer, nNumberOfBytesToWrite, &NumberOfBytesWritten, 0) )
    return 0;
  CloseHandle(hFile);
  return 1;
}

查阅了一下：FindResourceA：确定指定模块中指定类型和名称的资源的位置。

RTF格式：{\rtf1\ansiHello!\parThis is some {\b bold} text.\par}

我们分析一下，首先用ResourceHacker软件查找名为“AAA”的资源并取出数据，接着进入sub_401005，取出的数据跟

输入的密码2+输入的密码1+“@DBApp”进行了异或，最后生成了.rtf文件，最后的flag应该就在.rtf文件里。

那么如何求密码2呢，我们只需要找到rtf文件将其文件头和AAA前6位异或就行了

1
2
3
4
5
6
7
8
9
rtf="{\\rtf1"
AAA=[0x05,0x7D,0x41,0x15,0x26,0x01]
password2=""
for i in range(6):
   password2 += chr(AAA[i] ^ ord(rtf[i]))
print(password2) 
#~!3a@0


我们运行程序输入密码，回出现一个文件里面存有flag

Flag{N0_M0re_Free_Bugs}

normal17

刚开始没法反编译，

我们找到这里，是栈帧不平衡导致的，将pop处的改为0x0，即可。修改的原则是，只需在出现负数的那个地方的上一行，按alt+k,调整成跟这个数一摸一样的值就可以了。

我们找到main函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  HANDLE Thread; // [esp+D0h] [ebp-14h]
  HANDLE hObject; // [esp+DCh] [ebp-8h]

  sub_4110FF();
  ::hObject = CreateMutexW(0, 0, 0);
  j_strcpy(Destination, &Source);
  hObject = CreateThread(0, 0, StartAddress, 0, 0, 0);
  Thread = CreateThread(0, 0, sub_41119F, 0, 0, 0);
  CloseHandle(hObject);
  CloseHandle(Thread);
  while ( dword_418008 != -1 )
    ;
  sub_411190();
  CloseHandle(::hObject);
  return 0;
}

稍微能看懂一点，hObject一般代表句柄，CreateThread代表着创建线程，看来这个题创建了两个线程.

  1. 进程
    进程是资源（CPU、内存等）分配的基本单位，它是程序执行时的一个实例。程序运行时系统就会创建一个进程，并为它分配资源，然后把该进程放入进程就绪队列，进程调度器选中它的时候就会为它分配CPU时间，程序开始真正运行。

  2. 线程
    线程是一条执行路径，是程序执行时的最小单位，它是进程的一个执行流，是CPU调度和分派的基本单位，一个进程可以由很多个线程组成，线程间共享进程的所有资源，每个线程有自己的堆栈和局部变量。线程由CPU独立调度执行，在多CPU环境下就允许多个线程同时运行。同样多线程也可以实现并发操作，每个请求分配一个线程来处理。

一个正在运行的软件(如迅雷)就是一个进程，一个进程可以同时运行多个任务( 迅雷软件可以同时下载多个文件，每个下载任务就是一个线程), 可以简单的认为进程是线程的集合。

  • 对于单核CPU而言：多线程就是一个CPU在来回的切换，在交替执行。
  • 对于多核CPU而言：多线程就是同时有多条执行路径在同时(并行)执行，每个核执行一个线程，多个核就有可能是一块同时执行的。

第一个线程：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
char *__cdecl sub_411940(int a1, int a2)
{
  char *result; // eax
  char v3; // [esp+D3h] [ebp-5h]

  v3 = *(_BYTE *)(a2 + a1);
  if ( (v3 < 'a' || v3 > 122) && (v3 < 65 || v3 > 90) )
    exit(0);
  if ( v3 < 97 || v3 > 122 )
  {
    result = off_418000[0];
    *(_BYTE *)(a2 + a1) = off_418000[0][*(char *)(a2 + a1) - 38];
  }
  else
  {
    result = off_418000[0];
    *(_BYTE *)(a2 + a1) = off_418000[0][*(char *)(a2 + a1) - 96];
  }
  return result;
}

这个线程的很清楚，就是加加减减。

第二个线程：

1
2
3
4
5
6
7
8
9
10
11
12
13
void __stdcall __noreturn sub_411B10(int a1)
{
  while ( 1 )
  {
    WaitForSingleObject(hObject, 0xFFFFFFFF);
    if ( dword_418008 > -1 )
    {
      Sleep(0x64u);
      --dword_418008;
    }
    ReleaseMutex(hObject);
  }
}

CreateThread API 会创建新线程，这个题是一个典型的双线程问题.CreateMutex 创建一个互斥体，用于防止多线程中出现资源争用，即多个线程同时读写同一个资源的情况，所创建的互斥体的句柄会存到全局变量 hObject 中，WaitForSingleObject 等待互斥体的使用权空闲出来，并获取使用权，然后再访问和其他线程共享的资源，访问完后，用 ReleaseMutex 释放使用权，给其他线程使用的机会。那么这两个线程共享的数据是什么呢，看参数我们就知道是dword_418008。

这两个线程一前一后创建，理论上是 StartAddress 先获得使用权，后来的 sub_41119F 进入等待状态，前者执行一次循环后释放使用权，与此同时后者等待结束、获得使用权，进入循环，循环完后释放使用权，前者又获得使用权，如此循环往复。

所以就相当于我给出的字符串是第一位照抄，第二位进行线程一的变化。经过线程后与Source对比

1
2
3
4
5
6
7
8
9
10
int sub_411880()
{
  int i; // [esp+D0h] [ebp-8h]
  for ( i = 0; i < 29; ++i )
  {
    if ( Source[i] != off_418004[i] )
      exit(0);
  }
  return printf("\nflag{%s}\n\n", Destination);
}

给出脚本：

1
2
3
4
5
6
7
8
9
10
11
12
data1="TOiZiZtOrYaToUwPnToBsOaOapsyS"
data2="QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm"
flag=""
for i in range(len(data1)):
  if i%2==0:
    flag+=data1[i]
  else:
    if ord(data1[i])>ord('a') and ord(data1[i])<ord('z'):
      flag+=chr(data2.find(data1[i])+38)
    else:
      flag+=chr(data2.find(data1[i])+96)
print(flag)

最后这个E是什么都行，因为dword_418008只有29位！

得到ThisisthreadofwindowshahaIsES

normal18

这个题看着很难。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
int __usercall wmain@<eax>(int a1@<ebx>)
{
  FILE *v1; // eax
  FILE *v2; // eax
  char v4; // [esp+3h] [ebp-405h]
  char v5[256]; // [esp+4h] [ebp-404h] BYREF
  char Format[256]; // [esp+104h] [ebp-304h] BYREF
  char v7[256]; // [esp+204h] [ebp-204h] BYREF
  char v8[256]; // [esp+304h] [ebp-104h] BYREF

  printf("Come one! Crack Me~~~\n");
  memset(v8, 0, sizeof(v8));
  memset(v7, 0, sizeof(v7));
  while ( 1 )
  {
    do
    {
      do
      {
        printf("user(6-16 letters or numbers):");
        scanf("%s", v8);
        v1 = (FILE *)sub_4024BE();
        fflush(v1);
      }
      while ( !sub_401000(v8) );
      printf("password(6-16 letters or numbers):");
      scanf("%s", v7);
      v2 = (FILE *)sub_4024BE();
      fflush(v2);
    }
    while ( !sub_401000(v7) );
    sub_401090(v8);
    memset(Format, 0, sizeof(Format));
    memset(v5, 0, sizeof(v5));
    v4 = ((int (__cdecl *)(char *, char *))loc_4011A0)(Format, v5);
    if ( sub_401830(a1, (int)v8, v7) )
    {
      if ( v4 )
        break;
    }
    printf(v5);
  }
  printf(Format);
  return 0;
}

先输入账号，账号已给出welcomebeijing，再输入密码。首先能看出来这个是个死循环，如果想跳出去，只能是让

sub_401830函数为1，我们进入跟踪一下。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
bool __usercall sub_401830@<al>(int a1@<ebx>, int a2, const char *a3)
{
  int v4; // [esp+18h] [ebp-22Ch]
  signed int v5; // [esp+1Ch] [ebp-228h]
  signed int v6; // [esp+28h] [ebp-21Ch]
  unsigned int v7; // [esp+30h] [ebp-214h]
  char v8; // [esp+36h] [ebp-20Eh]
  char v9; // [esp+37h] [ebp-20Dh]
  char v10; // [esp+38h] [ebp-20Ch]
  unsigned __int8 v11; // [esp+39h] [ebp-20Bh]
  unsigned __int8 v12; // [esp+3Ah] [ebp-20Ah]
  char v13; // [esp+3Bh] [ebp-209h]
  unsigned int v14; // [esp+3Ch] [ebp-208h] BYREF
  char v15; // [esp+40h] [ebp-204h] BYREF
  char v16[255]; // [esp+41h] [ebp-203h] BYREF
  char v17[256]; // [esp+140h] [ebp-104h] BYREF

  v5 = 0;
  v6 = 0;
  v12 = 0;
  v11 = 0;
  memset(v17, 0, sizeof(v17));
  v15 = 0;
  memset(v16, 0, sizeof(v16));
  v10 = 0;
  v7 = 0;
  v4 = 0;
  while ( v7 < strlen(a3) )
  {
    if ( isdigit(a3[v7]) )
    {
      v9 = a3[v7] - 48;
    }
    else if ( isxdigit(a3[v7]) )
    {
      if ( *((_DWORD *)NtCurrentPeb()->ProcessHeap + 3) != 2 )// 反调试
        a3[v7] = 34;
      v9 = (a3[v7] | 0x20) - 87;
    }
    else
    {
      v9 = ((a3[v7] | 0x20) - 97) % 6 + 10;
    }
    __rdtsc();
    __rdtsc();
    v10 = v9 + 16 * v10;    //以上的意思是把输入的密码（要求是十六进制字符）从hex_string转换位内存中的bytes，代表v16为密码
    if ( !((int)(v7 + 1) % 2) )
    {
      v16[v4++ - 1] = v10;
      a1 = v4;
      v10 = 0;
    }
    ++v7;
  }
  while ( v6 < 8 )
  {
    v11 += byte_416050[++v12];
    v13 = byte_416050[v12];
    v8 = byte_416050[v11];
    byte_416050[v11] = v13;
    byte_416050[v12] = v8;
    if ( (NtCurrentPeb()->NtGlobalFlag & 0x70) != 0 )// 反调试
      v13 = v11 + v12;
    v17[v6] = byte_416050[(unsigned __int8)(v8 + v13)] ^ v16[v5 - 1];     //只需找到byte_416050，就可推得密码
    if ( (unsigned __int8)*(_DWORD *)&NtCurrentPeb()->BeingDebugged )// 反调试
    {
      v11 = -83;
      v12 = 43;
    }
    sub_401710((int)v17, (const char *)a2, v6++);
    v5 = v6;
    if ( v6 >= (unsigned int)(&v16[strlen(&v15)] - v16) )
      v5 = 0;
  }
  v14 = 0;
  sub_401470(a1, v17, &v14);
  return v14 == 43924;                          // v14必须要等于43924
}

首先我们得让v14=43924，那么我们就要跟踪sub_401470函数，我们跟踪进去

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
unsigned int *__usercall sub_401470@<eax>(int a1@<ebx>, _BYTE *a2, unsigned int *a3)
{
  unsigned int _EAX; // eax
  char v5; // al
  char _AL; // al
  unsigned int *result; // eax

  if ( *a2 != 'd' )
    *a3 ^= 3u;
  else
    *a3 |= 4u;
  if ( a2[1] != 'b' )
  {
    *a3 &= 0x61u;
    _EAX = *a3;
  }
  else
  {
    _EAX = (unsigned int)a3;
    *a3 |= 0x14u;
  }
  __asm { aam }
  if ( a2[2] != 'a' )
    *a3 &= 0xAu;
  else
    *a3 |= 0x84u;
  if ( a2[3] != 'p' )
    *a3 >>= 7;
  else
    *a3 |= 0x114u;
  if ( a2[4] != 'p' )
    *a3 *= 2;
  else
    *a3 |= 0x380u;
  if ( *((_DWORD *)NtCurrentPeb()->ProcessHeap + 3) != 2 )
  {
    if ( a2[5] != 'f' )
      *a3 |= 0x21u;
    else
      *a3 |= 0x2DCu;
  }
  if ( a2[5] != 's' )
  {
    v5 = (char)a3;
    *a3 ^= 0x1ADu;
  }
  else
  {
    *a3 |= 0xA04u;
    v5 = (char)a3;
  }
  _AL = v5 - (~(a1 >> 5) - 1);
  __asm { daa }
  if ( a2[6] != 'e' )
    *a3 |= 0x4Au;
  else
    *a3 |= 0x2310u;
  if ( a2[7] != 'c' )
  {
    *a3 &= 0x3A3u;
    return (unsigned int *)*a3;
  }
  else
  {
    result = a3;
    *a3 |= 0x8A10u;
  }
  return result;
}

这个函数中我们只需要判断a2[5]是等于‘ f ’还是‘ s ’。答案是s，所以我们得到了，a2也就是v17的字符串”dbappsec”，那么再看上个函数，跟v17有关的是个异或: v17[v6] = byte_416050[(unsigned __int8)(v8 + v13)] ^ v16[v5 - 1] ，由上面的分析，我们知道v16就是我们要找的，那么我们需要找到byte_416050，这个sbox里的字符串，我们用od来进行查找。

在异或处下断点，观察ecx的值就是这个字符串，即[0x2a,0xd7,0x92,0xe9,0x53,0xe2,0xc4,0xcd]。

写脚本

1
2
3
4
5
6
code=[]
data1=[0x2a,0xd7,0x92,0xe9,0x53,0xe2,0xc4,0xcd]
data2="dbappsec"
for i in range(len(data2)):
  code.append(hex(ord(data2[i])^data1[i]).replace("0x",""))
print(code)

得到：[‘4e’, ‘b5’, ‘f3’, ‘99’, ‘23’, ‘91’, ‘a1’, ‘ae’]，连起来即可。

还有一个问题啊，我在用od调试的时候并没有遇到wp上说的反调试，我在此补充一下

1
if ( *(_DWORD *)(__readfsdword(0x30u) + 2) & 0xFF )

我们的IsDebuggerPresent最后寻找的东西其实就是BeingDebugged字段。

1
if ( *(_DWORD *)(__readfsdword(0x30u) + 104) & 0x70 )

这个其实从PEB的结构中我们也不难看出也是反调试中经常出现的字段NtGlobalFlag

1
if ( *(_DWORD *)(*(_DWORD *)(__readfsdword(0x30u) + 24) + 12) != 2 )

这个也是经常用在反调试中的字段ProcessHeap。

如果在题目中出现__readfsdword(0x30u)意味着动调的时候参数会不对，最好用od来调试，若用ida调试，方法如下：

动调时手动修改代码，比如汇编下把jz改成jmp/jnz，可以改成jnz，机器码是74改成75。

normal19

太摧毁我的自信心了，太难了，第一次遇见花指令

这么一大坨东西，没加壳就是花指令了。

先用idapython去花

1
2
3
4
arr = [[0x4009A9,0x4009C7],[0x4009E0,0x4009FE],[0x400ACA,0x400AE8],[0x400B1A,0x400B38],[0x400B65,0x400B92],[0x400BEF,0x400C00]]
for i in range(len(arr)):
    for j in range(arr[i][0],arr[i][1]):
        ida_bytes.patch_byte(j,0x90)

去花后反编译就比较简单了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
int __cdecl main(int argc, const char **argv, const char **envp)
{
  char *v3; // rbx
  int v4; // er12
  int v5; // edi
  unsigned int v6; // eax
  int name_by_pid; // ebp
  __pid_t v8; // eax
  __pid_t v9; // er13
  __int64 v10; // rdx
  __int64 v11; // rcx
  __int64 v12; // rbx
  int v14; // ebx
  int v15[2]; // [rsp+0h] [rbp-4D8h] BYREF
  char v16[4]; // [rsp+8h] [rbp-4D0h] BYREF
  char v17[8]; // [rsp+Ch] [rbp-4CCh] BYREF
  char v18[56]; // [rsp+14h] [rbp-4C4h] BYREF
  char v19; // [rsp+4Ch] [rbp-48Ch] BYREF
  int v20[20]; // [rsp+50h] [rbp-488h]
  char v21[1032]; // [rsp+A0h] [rbp-438h] BYREF
  unsigned __int64 v22; // [rsp+4A8h] [rbp-30h]

  v3 = (char *)v15;
  v22 = __readfsqword(0x28u);
  v4 = time(0LL);
  do
  {
    v3 += 4;
    *((_DWORD *)v3 - 1) = _IO_getc(_bss_start);
  }
  while ( v3 != &v19 );
  v20[0] = 83;
  v20[1] = 64;
  v20[2] = 121;
  v20[3] = 82;
  v20[4] = 116;
  v20[5] = 102;
  v20[6] = 84;
  v20[7] = 108;
  v20[8] = 48;
  v20[9] = 43;
  v20[10] = 97;
  v20[11] = 103;
  v20[12] = 45;
  v20[13] = 76;
  v20[14] = 95;
  v20[15] = 51;
  v20[16] = 77;
  v20[17] = 125;
  v20[18] = 123;
  if ( ptrace(PTRACE_TRACEME, 0LL, 1LL, 0LL) < 0 )
  {
    v14 = 10000000;
    do
    {
      sleep(1u);
      --v14;
    }
    while ( v14 );
    exit(-1);
  }
  v5 = time(0LL) - v4;
  if ( v5 > 1 )
    goto LABEL_16;
  func3(v18, 2LL, 7LL, 14LL);
  func3(v16, 4LL, 6LL, 17LL);
  func3(&v18[16], 3LL, 5LL, 10LL);
  v6 = getppid();
  name_by_pid = get_name_by_pid(v6, v21);
  if ( name_by_pid )
    return -1;
  func3(v15, 6LL, 9LL, 15LL);
  func3(&v18[24], 3LL, 6LL, 8LL);
  v5 = time(0LL) - v4;
  if ( v5 > 2 )
LABEL_16:
    exit(v5);
  func3(v18, 1LL, 5LL, 14LL);
  v8 = getpid();
  v9 = getsid(v8);
  if ( v9 != getppid() )
  {
    puts("what are you doing?!");
    v5 = 1;
    goto LABEL_16;
  }
  func3(v15, 0LL, 2LL, 19LL);
  func3(v17, 3LL, 5LL, 16LL);
  func3(&v18[40], 1LL, 3LL, 4LL);
  func3(&v18[12], 3LL, 6LL, 11LL);
  func3(v15, 0LL, 7LL, 19LL);
  func3(v15, 0LL, v10, v11);
  func3(&v18[20], 0LL, 2LL, 9LL);
  v5 = time(0LL) - v4;
  if ( v5 > 3 )
    goto LABEL_16;
  v12 = 0LL;
  func3(&v18[24], 1LL, 3LL, 8LL);
  func3(&v18[44], 0LL, 2LL, 3LL);
  do
  {
    if ( v20[v12] != v15[v12] )
    {
      puts("You failed");
      v5 = v12;
      goto LABEL_16;
    }
    ++v12;
  }
  while ( v12 != 19 );
  puts("win");
  return name_by_pid;
}

fun3很复杂所以可以猜测这个题跟前面的一道题很像，直接输进去数就行，然后观察变化即可。

我们发现很多goto ，会goto到exit，去除！

1
2
3
4
arr = [[0x400972,0x400978], [0x400987,0x40098D],[0x400A2F,0x400A35],[0x400A77,0x400A7D],[0x400AAB,0x400AB1],[0x400BBC,0x400BC2]]
for i in range(len(arr)):
    for j in range(arr[i][0],arr[i][1]):
        ida_bytes.patch_byte(j,0x90)

大致就是将goto的首地址和下一行地址写进arr列表中，然后全部nop掉，找goto的汇编可以看旁边有指引的线。

接下来我们动调，发现不行，里面有很多_sleep等的反调试，我们将其nop掉。

1
2
3
4
5
6
7
8
data1="0123456789abcdefghi"
data2="8f6c90e1dg237abh5i4"
t="S@yRtfTl0+ag-L_3M}{"
flag=""
for i in range(len(t)):
  flag+=t[data2.find(data1[i])]
print(flag)
#flag{My-StL_R0T@+3}

结束！

normal20

又是一道z3题，这个题看起来非常简单，但是逆过来确实不好逆，所以用z3最好解决

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned int v3; // esi
  unsigned int v4; // kr00_4
  char v5; // bl
  unsigned int i; // eax
  char *v7; // edx
  char v8; // cl
  int v9; // eax
  char v11[80]; // [esp+8h] [ebp-A4h] BYREF
  char v12[80]; // [esp+58h] [ebp-54h] BYREF

  sub_401020("Please input your flag: ");
  sub_401050("%40s", v12);
  memset(v11, 0, sizeof(v11));
  v3 = 0;
  v4 = strlen(v12);
  if ( v4 )
  {
    do
    {
      v5 = v12[v3];
      for ( i = 0; i < 32; ++i )
      {
        v7 = &v11[i + v3];
        v8 = v5 ^ byte_41C658[i];
        *v7 += v8;
      }
      ++v3;
    }
    while ( v3 < v4 );
  }
  v9 = strcmp(v11, aR);                         // v9必须是1，也就是说v11就是aR
  if ( v9 )
    v9 = v9 < 0 ? -1 : 1;
  if ( v9 )
    puts("No, it isn't.");
  else
    puts("Yes, it is.");
  return 0;
}

讲一下？的用法：<表达式1>?<表达式2>:<表达式3>
在运算中，首第一个表达式进行检验，如果为真，则返回表达式2的值;如果为假，则返回表达式3的值

直接给出z3脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
from z3 import*
s=Solver()
aR=[0x72, 0xE9, 0x4D, 0xAC, 0xC1, 0xD0, 0x24, 0x6B, 0xB2, 0xF5, 0xFD, 0x45, 0x49, 0x94, 0xDC, 0x10, 0x10, 0x6B, 0xA3, 0xFB, 0x5C, 0x13, 0x17, 0xE4, 0x67, 0xFE, 0x72, 0xA1, 0xC7, 0x04, 0x2B, 0xC2, 0x9D, 0x3F, 0xA7, 0x6C, 0xE7, 0xD0, 0x90, 0x71, 0x36, 0xB3, 0xAB, 0x67, 0xBF, 0x60, 0x30, 0x3E, 0x78, 0xCD, 0x6D, 0x35, 0xC8, 0x55, 0xFF, 0xC0, 0x95, 0x62, 0xE6, 0xBB, 0x57, 0x34, 0x29, 0x0E, 0x03]
data=[0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x3A, 0x3B, 0x3C, 0x3D, 0x3E, 0x3F, 0x40, 0x5B, 0x5C, 0x5D, 0x5E, 0x5F, 0x60, 0x7B, 0x7C, 0x7D, 0x7E]
flag = [BitVec("flag%d" % i,8) for i in range(0x22)]
v5=[0]*0x41
for i in range(len(flag)):
  s.add(flag[i] < 127)
  s.add(flag[i] > 32)
v3=0
for i in range(0x22):
  for j in range(32):
    v5[i+j] += flag[i] ^ data[j]
  v3 += 1
for t in range(len(aR)):
  s.add(aR[t] == v5[t])
if s.check() == sat:
  m = s.model()
  res = []
  for i in range(0x22):
    res.append(chr(m[flag[i]].as_long()))
    s=''.join(res)
  print(s)
else:
  print("nope")  
print(v5)
#SYC{4+mile+b3gin+with+sing1e+step}

看来是极客的题。。。

normal21

这个题终极难，还是感觉自己写脚本能力太差，这个寒假要努力将自己编程能力提升上去。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
int __cdecl main(int argc, const char **argv, const char **envp)
{
  _DWORD *v4; // [esp+1Ch] [ebp-A0h]
  _WORD v5[4]; // [esp+20h] [ebp-9Ch] BYREF
  int v6; // [esp+28h] [ebp-94h]
  int v7; // [esp+2Ch] [ebp-90h]
  char v8[32]; // [esp+30h] [ebp-8Ch] BYREF
  char v9[32]; // [esp+50h] [ebp-6Ch] BYREF
  char v10[76]; // [esp+70h] [ebp-4Ch] BYREF

  sub_402620();
  strcpy((char *)v5, "qweee");
  v5[3] = '\0';
  v6 = 0;
  v7 = 0;
  v4 = malloc(0x408u);
  puts("Plz solve the puzzle:");
  sub_40ED00("%32s", v8);
  if ( (unsigned __int8)sub_401C70(v8)          // flag的区间
    && (sub_401B60(
          (int)v9,
          v8),                                  // 16进制字符转换成byte
        sub_401850(v4, (int)v5, strlen((const char *)v5)),
        sub_4018D0(v4, v9, 8),
        sub_401950(v9)) )
  {
    sub_401BA0(v8, (int)v10);
    sub_40ED20("Congrats!\n%s\n", v10);
  }
  else
  {
    puts("Failed!");
  }
  return 0;
}

这个题主要有5个函数，我们逐一查看

函数一：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
int __cdecl sub_401C70(char *Str)
{
  char *v2; // edx

  if ( strlen(Str) != 16 )
    return 0;
  v2 = Str;
  while ( (unsigned __int8)(*v2 - 58) > 0x26u && (unsigned __int8)(*v2 - 48) <= 0x36u )
  {
    if ( ++v2 == Str + 16 )
      return 1;
  }
  return 0;
}

这个函数限定了str长度为16，那么能取那些字符呢？是用下面的while循环进行的判断。写出脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
for i in range(256):
  a=i
  if (a-58)&0xff > 0x26 and (a-48)&0xff  <= 0x36:
    print(chr(i))
0
1
2
3
4
5
6
7
8
9
a
b
c
d
e
f

我们要注意在c语言中：范围是不同的，所以0-9也ok

int

int8取值范围是-128 - 127
unsigned int8 0-255

Int16 意思是16位整数(16bit integer)，相当于short 占2个字节 -32768 ~ 32767

Int32 意思是32位整数(32bit integer), 相当于 int 占4个字节 -2147483648 ~ 2147483647

Int64 意思是64位整数(64bit interger), 相当于 long long 占8个字节 -9223372036854775808 ~ 9223372036854775807Byte 相当于byte(unsigned char) 0 ~ 255

WORD 等于 unsigned short 0 ~ 65535

接下来看第二个函数。

函数二：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
int __cdecl sub_401B60(int a1, _BYTE *a2)
{
  _BYTE *i; // ebx
  int result; // eax
  _BYTE *v5; // [esp+0h] [ebp-1Ch]
  int v6; // [esp+8h] [ebp-14h]

  for ( i = a2; *i; result = sub_40ED40(v5, "%02X", v6) )// sprintf格式化输出
  {
    v6 = a1;
    v5 = i;
    i += 2;
    ++a1;
  }
  return result;
}

这个函数无法理解，但从动态调试中可以猜测是将输入的16进制字符串转换为byte型数组，并用sprintf格式化输出。

这里补充一下sprintf的用法：

1
sprintf``(s, ``"%8d%8d"``, 123, 4567); ``// 产生："  123  4567"

例如这个，很好的代表了其用法，第二个参数用来规定格式化的形式，第二个参数后面可以加多个参数，后面的参数都要按照第二个参数来规定。

第三个函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
int __cdecl sub_401850(_DWORD *a1, int a2, int a3)
{
  int v3; // eax
  _DWORD *v4; // edi
  int *v5; // ebx
  int v6; // ecx
  int result; // eax
  int v8; // esi
  char v9; // dl
  int *v10; // edx

  v3 = 0;
  v4 = a1 + 2;
  *a1 = 0;
  a1[1] = 0;
  do
  {
    v4[v3] = v3;
    ++v3;
  }
  while ( v3 != 256 );
  v5 = a1 + 2;
  v6 = 0;
  LOBYTE(result) = 0;
  do
  {
    v8 = *v5;
    v9 = *(_BYTE *)(a2 + v6++) + *v5;
    result = (unsigned __int8)(v9 + result);
    v10 = &v4[result];
    *v5 = *v10;
    *v10 = v8;
    if ( v6 >= a3 )
      v6 = 0;
    ++v5;
  }
  while ( v5 != a1 + 258 );
  return result;
}

这个函数应该是凭借密钥的顺序，来改变自身，从而生成一个data盒。我们通过动态调试是能够找到data的。

1
[0x00000071, 0x000000A2, 0x00000062, 0x00000031, 0x0000004D, 0x00000097, 0x00000014, 0x0000000D, 0x000000ED, 0x000000A3, 0x000000D6, 0x000000FC, 0x000000F1, 0x0000003B, 0x0000003C, 0x00000033, 0x000000B5, 0x00000022, 0x00000012, 0x0000001A, 0x00000017, 0x0000001D, 0x00000098, 0x00000091, 0x00000006, 0x0000002A, 0x0000008B, 0x00000023, 0x000000E6, 0x00000055, 0x00000046, 0x0000003A, 0x00000065, 0x00000028, 0x00000030, 0x00000039, 0x000000D4, 0x0000000C, 0x00000001, 0x0000002D, 0x00000025, 0x00000010, 0x00000009, 0x0000008F, 0x0000006A, 0x0000003F, 0x00000044, 0x000000D8, 0x0000006D, 0x000000C5, 0x000000A6, 0x00000072, 0x00000007, 0x00000083, 0x00000040, 0x000000C6, 0x0000008E, 0x0000001F, 0x00000077, 0x00000061, 0x00000096, 0x0000004A, 0x00000008, 0x000000FE, 0x00000053, 0x0000005A, 0x000000A1, 0x000000DF, 0x000000B6, 0x00000067, 0x00000066, 0x0000005C, 0x00000057, 0x000000B8, 0x000000D3, 0x00000011, 0x00000052, 0x00000021, 0x000000CC, 0x00000056, 0x0000002E, 0x000000C2, 0x00000088, 0x000000AA, 0x000000F9, 0x00000020, 0x0000007A, 0x0000006F, 0x0000004E, 0x00000076, 0x000000E8, 0x000000C1, 0x000000D5, 0x000000BD, 0x000000CE, 0x0000009E, 0x00000038, 0x00000095, 0x00000050, 0x000000F2, 0x0000009F, 0x000000B2, 0x0000009A, 0x0000000B, 0x00000047, 0x00000016, 0x00000060, 0x000000BF, 0x000000FD, 0x00000092, 0x00000035, 0x00000089, 0x000000DA, 0x000000FF, 0x0000009B, 0x000000BA, 0x00000013, 0x000000AB, 0x000000F4, 0x00000079, 0x00000087, 0x000000AC, 0x0000008C, 0x00000073, 0x00000084, 0x000000B3, 0x0000000E, 0x000000C8, 0x00000026, 0x000000A5, 0x000000E7, 0x00000015, 0x000000E9, 0x000000C3, 0x00000069, 0x00000070, 0x000000E0, 0x00000068, 0x00000042, 0x00000081, 0x000000CD, 0x000000EB, 0x000000DE, 0x0000007D, 0x000000EF, 0x000000D0, 0x00000024, 0x00000000, 0x000000F0, 0x00000041, 0x000000A0, 0x000000EE, 0x00000005, 0x00000094, 0x00000085, 0x000000BB, 0x00000043, 0x00000002, 0x000000F7, 0x000000C0, 0x000000D1, 0x0000001B, 0x0000007F, 0x0000005B, 0x000000EC, 0x000000F6, 0x0000002B, 0x0000001E, 0x000000E2, 0x00000027, 0x000000FB, 0x00000078, 0x00000054, 0x00000058, 0x000000E4, 0x00000032, 0x000000DB, 0x000000B7, 0x000000C7, 0x00000090, 0x0000007C, 0x000000F8, 0x0000005D, 0x0000005F, 0x00000063, 0x000000BE, 0x0000002C, 0x0000000A, 0x000000DD, 0x0000009C, 0x00000075, 0x00000019, 0x000000C4, 0x000000A8, 0x00000086, 0x00000036, 0x000000BC, 0x0000008D, 0x000000D7, 0x0000007B, 0x000000B4, 0x0000005E, 0x0000003E, 0x000000A7, 0x000000B1, 0x000000E1, 0x00000059, 0x00000082, 0x000000B9, 0x000000AE, 0x000000D9, 0x0000007E, 0x000000AF, 0x000000CF, 0x0000009D, 0x000000F5, 0x000000FA, 0x00000048, 0x0000004F, 0x000000A9, 0x0000006C, 0x00000064, 0x0000006E, 0x00000049, 0x0000004B, 0x0000006B, 0x00000029, 0x00000045, 0x000000E5, 0x00000004, 0x000000A4, 0x0000004C, 0x00000034, 0x00000080, 0x000000D2, 0x0000003D, 0x000000E3, 0x00000099, 0x00000037, 0x000000DC, 0x00000093, 0x000000C9, 0x000000CA, 0x000000CB, 0x000000EA, 0x000000B0, 0x0000000F, 0x00000003, 0x0000008A, 0x000000F3, 0x00000051, 0x0000001C, 0x000000AD, 0x00000074, 0x00000018, 0x0000002F]

这个就是生成的data盒。

第四个函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
DWORD *__cdecl sub_4018D0(_DWORD *a1, _BYTE *a2, int a3)
{
  int v3; // edx
  int v4; // ecx
  _DWORD *v5; // esi
  _BYTE *v6; // ebx
  int v7; // edi
  int *v8; // eax
  int v9; // edx
  int v10; // ebp
  _DWORD *result; // eax
  int *v12; // [esp+0h] [ebp-18h]

  v3 = *a1;
  v4 = a1[1];
  v5 = a1 + 2;
  if ( a3 > 0 )
  {
    v6 = a2;
    v7 = *a1;
    do
    {
      v7 = (unsigned __int8)(v7 + 1);
      v8 = &v5[v7];
      v9 = *v8;
      v4 = (unsigned __int8)(*v8 + v4);
      v12 = &v5[v4];
      v10 = *v12;
      *v8 = *v12;
      *v12 = v9;
      *v6++ ^= v5[(unsigned __int8)(v9 + v10)]; // v6是输入的字符串，v5是生成的data
    }
    while ( v6 != &a2[a3] );
    v3 = v7;
  }
  result = a1;
  *a1 = v3;
  a1[1] = v4;
  return result;
}

这个异或函数是最有用的，我们从中能看出很多东西，比如，v5是data盒，我们是根据v9+v10来从data中选择数据的。我们在这一行设断点，来查看生成的数据。发现分别为[0x7C,0xAB,0x2D,0x91,0x2F,0x98,0xED,0xA9]。也就是说我们输入的字符串和这个固定的字符串异或后产生了新的字符串，那么我们只要找到新的字符串。

第5个函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
bool __cdecl sub_401950(_BYTE *a1)
{
  _BYTE *v1; // ecx
  bool result; // al

  v1 = a1;
  do
  {
    switch ( *v1 )                              // v1是输入的字符串
    {
      case 0:
        dword_40F028 &= dword_40F038;
        dword_40F02C *= dword_40F028;
        break;
      case 1:
        if ( !dword_40F02C )
          return 0;
        dword_40F028 /= dword_40F02C;
        dword_40F024 += dword_40F034;
        break;
      case 2:
        dword_40F030 ^= dword_40F034;
        dword_40F03C += dword_40F020;
        break;
      case 3:
        dword_40F03C -= dword_40F030;
        dword_40F030 &= dword_40F024;
        break;
      case 4:
        dword_40F034 *= dword_40F020;
        dword_40F02C -= dword_40F038;
        break;
      case 5:
        dword_40F020 ^= dword_40F02C;
        dword_40F038 -= dword_40F03C;
        break;
      case 6:
        if ( !dword_40F03C )
          return 0;
        dword_40F034 |= dword_40F024 / dword_40F03C;
        dword_40F024 /= dword_40F03C;
        break;
      case 7:
        dword_40F038 += dword_40F028;
        dword_40F034 |= dword_40F024;
        break;
      case 8:
        dword_40F020 *= dword_40F02C;
        dword_40F030 -= dword_40F03C;
        break;
      case 9:
        dword_40F028 += dword_40F034;
        dword_40F02C ^= dword_40F030;
        break;
      default:
        return 0;
    }
    ++v1;
  }
  while ( v1 != a1 + 8 );
  result = (dword_40F038 == 231)

   + (dword_40F034 == 14456)
     ord_40F030 == 14961)
        + (dword_40F02C == -13264)
          ord_40F028 == 16)
             + (dword_40F024 == 104)
               ord_40F020 == -951) == 7;
                 if ( dword_40F03C != -239 )
                   return 0;
                 return result;
               }


我们惊喜的发现，这个函数所做的操作正是对变换后的字符串的操作，所以我们只需要看这个函数就行，这个函数逆向是不可能的，所以采用爆破是最好的方法，但属实不会写脚本，就照着wp写了一遍。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
#include <stdio.h>
#include <stdbool.h>
#include <string.h>
bool Check(char *str);
int main(){
  int i = 0;
  long a = 99999999;
  while(i <= a){
    char str[10] = {0};
    sprintf(str,"%08d",i);
    if(Check(str)){
      printf("TRUE!!!!!:  %s",str);
      goto label;
      break;
    }
    if(i % 1000 == 0){
      puts(str);      
    }
    i++;
  }
  puts("falied\n");
label:
  getchar();
  getchar();
}
bool Check(char *str){
  int dword_40F000 = 0xA;
  int dword_40F020 = 0x8A;
  int dword_40F024 = 0x1A1;
  int dword_40F028 = 0x12A；
  int dword_40F02C = 0x269;
  int dword_40F030 = 0x209;
  int dword_40F034 = 0x68;
  int dword_40F038 = 0x39F;
  int dword_40F03C = 0x2C8;
  int result = 0;
  for(int i = 0;i < 8;i++){
    switch (str[i] - 48)
    {
    case 0:
      dword_40F028 &= dword_40F038;      
      dword_40F02C *= dword_40F028;
      break;
    case 1:
      if ( !dword_40F02C )
        goto LABEL_6;
      dword_40F028 /= dword_40F02C;
      dword_40F024 += dword_40F034;
      break;
    case 2:
      dword_40F030 ^= dword_40F034;
      dword_40F03C += dword_40F020;
      break;
    case 3:
      dword_40F03C -= dword_40F030;
      dword_40F030 &= dword_40F024;   
      break; 
    case 4:
      dword_40F034 *= dword_40F020;
      dword_40F02C -= dword_40F038;
      break;
    case 5:
      dword_40F020 ^= dword_40F02C;
      dword_40F038 -= dword_40F03C;
      break;
    case 6:
      if ( !dword_40F03C )
        goto LABEL_6;
      dword_40F034 |= dword_40F024 / dword_40F03C;
      dword_40F024 /= dword_40F03C;
      break;
    case 7:
      dword_40F038 += dword_40F028;
      dword_40F034 |= dword_40F024;
      break;
    case 8:
      dword_40F020 *= dword_40F02C;
      dword_40F030 -= dword_40F03C;
      break;
    case 9:
      dword_40F028 += dword_40F034;
      dword_40F02C ^= dword_40F030;
    default:
      break;
    }
  }
    result = (((dword_40F038 == 0xE7)     
    + (dword_40F034 == 0x3878)
    + (dword_40F030 == 0x3A71)
    + (dword_40F02C == 0xFFFFCC30)
    + (dword_40F028 == 0x10)
    + (dword_40F024 == 0x68)
    + (dword_40F020 == 0xFFFFFC49)) == 7);
  if ( dword_40F03C != 0xFFFFFF11 )
    goto LABEL_6;
  if(result == 1){
    return true;
  }
LABEL_6:
  return false;
}
//得到爆破后的字符串61495072

师傅写的很清楚明了，学习了！

我们接下来异或一下得到我们要输入的：

1
2
3
4
5
6
7
a=[0x7C,0xAB,0x2D,0x91,0x2F,0x98,0xED,0xA9]
b=[0x06,0x01,0x04,0x09,0x05,0x00,0x07,0x02]
flag=""
for i in range(8):
  flag+="%x"%(a[i]^b[i])   #转化成16进制
print(flag)
#7aaa29982a98eaab

输入终端，得到flag

flag{5cb92582-66a8-e5b7-d3bf-3b99df8ac7f0}

noraml22

这个题比较简单，但我没看出来提示怎么用，好家伙，提示是23题。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  char v4; // [esp+0h] [ebp-134h]
  char v5; // [esp+0h] [ebp-134h]
  char Buffer[48]; // [esp+D0h] [ebp-64h] BYREF
  size_t i; // [esp+100h] [ebp-34h]
  FILE *Stream; // [esp+10Ch] [ebp-28h]
  char v9; // [esp+118h] [ebp-1Ch] BYREF

  __CheckForDebuggerJustMyCode(&unk_41C008);
  sub_41137A("Input Your Flag:\n", v4);
  sub_41137F("%19s", (char)&v9);
  if ( argc != 2 )
  {
    sub_41137A("Input error!\n", v5);
    exit(1);
  }
  sub_41137A("%s\n", (char)argv[1]);
  for ( i = 0; i < j_strlen(argv[1]); ++i )
    argv[1][i] += i;
  if ( !j_strcmp(Str1, argv[1]) && (Stream = fopen(argv[1], "r")) != 0 )
  {
    fgets(Buffer, 40, Stream);
    if ( j_strlen(Buffer) != 32 || j_strlen(Buffer) % 2 == 1 ) 
      exit(1);
    sub_4113B1(Buffer, (int)&unk_41A4E0);        //*
    if ( sub_4113B6((int)&unk_41A4E0) )          //*
      sub_41137A("flag{%s}", (char)Buffer);
    else
      sub_41137A("Input Error!\n", v5);
    return 0;
  }
  else
  {
    sub_41137A("Input Error!\n", v5);
    return 0;
  }
}

这个主函数没什么用，我们主要来看标星号的函数先看第一个

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
size_t __cdecl sub_414E50(char *Str, int a2)
{
  size_t result; // eax
  char v3; // [esp+0h] [ebp-E4h]
  int v4; // [esp+D0h] [ebp-14h]
  signed int i; // [esp+DCh] [ebp-8h]

  __CheckForDebuggerJustMyCode(&unk_41C008);
  dword_41A078[8] = '\xA7';
  dword_41A078[9] = '\xDE';
  dword_41A078[10] = '\xDA';
  dword_41A078[11] = 'F';
  dword_41A078[12] = '\xAB';
  dword_41A078[13] = 0x2E;
  dword_41A078[14] = '\xFF';
  dword_41A078[15] = '\xDB';
  for ( i = 0; ; i += 2 )
  {
    result = j_strlen(Str);
    if ( i >= result )
      break;
    if ( Str[i] >= 48 && Str[i] <= 57 )
    {
      *(_DWORD *)(a2 + 4 * (i / 2)) = Str[i] - 48;
    }
    else
    {
      if ( Str[i] < 'a' || Str[i] > 'f' )
      {
        sub_41137A("Input Error!\n", v3);
        exit(0);
      }
      *(_DWORD *)(a2 + 4 * (i / 2)) = Str[i] - 87;
    }
    *(_DWORD *)(a2 + 4 * (i / 2)) *= 16;
    if ( Str[i + 1] >= '0' && Str[i + 1] <= '9' )
    {
      v4 = Str[i + 1] - 48;
    }
    else
    {
      if ( Str[i + 1] < 'a' || Str[i + 1] > 'f' )
      {
        sub_41137A("Input Error!\n", v3);
        exit(0);
      }
      v4 = Str[i + 1] - 87;
    }
    *(_DWORD *)(a2 + 4 * (i / 2)) += v4;
  }
  return result;
}

很长没用，只用看 dword_41A078这个数组藏了什么，由于反编译出来的是8-15位，那么这个数组进去的还存在0-7位。

再看第二个函数

1
2
3
4
5
6
7
8
9
10
11
12
int __cdecl sub_411D90(int a1)
{
  int i; // [esp+D0h] [ebp-8h]

  __CheckForDebuggerJustMyCode(&unk_41C008);
  for ( i = 0; i < 16; ++i )
  {
    if ( *(_DWORD *)(a1 + 4 * i) + 1 != dword_41A078[i] )
      return 0;
  }
  return 1;
}

就是对比，好了flag出来了

1
2
3
4
5
6
data=[0x50,0xC6,0xF1,0xE4,0xE3,0xE2,0x9A,0xA1,0XA7,0XDE,0XDA,0XF,0XAB,0X2E,0XFF,0XDB]
flag=""
for i in range(16):
  flag += "%x"%(data[i]-1)
print(flag)
#4fc5f0e3e2e199a0a6ddd9eaa2dfeda

normal23

这道题是c#写的，相比极客的题，这个属实不好看明白，老样子，先找main函数

这个好像是先进行密钥iriszero的加密，用到的是ICEKEY加密方法。

下面的内容就很惊喜了，从字面意思就能看出，一个加密，一个解密，我们只要解密就行了。

我们只需要在解密前对比的时候设断点，然后修改数据，再运行到结束，查看内存就行了。

先在array中修改数据，再在bytes中查看flag，但注意要记得刷新

直到出来true就行了

3561636230363233313732346338633336396261653731313136366462653835，擦复制出来是ascii

flag：5acb06231724c8c369bae711166dbe85

normal24

我已经被这个题折磨死了，太难了有一说一，但还是收获了许多知识，令我不再那么害怕这么多代码。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
int __cdecl main(int argc, const char **argv, const char **envp)
{
  unsigned __int64 v3; // rbx
  __int64 len; // rax
  __int128 *v5; // rax
  __int64 v6; // r11
  __int128 *v7; // r14
  int v8; // edi
  __int128 *v9; // rsi
  char v10; // r10
  int v11; // edx
  __int64 v12; // r8
  unsigned __int64 v13; // rcx
  __int64 v14; // rcx
  unsigned __int64 v15; // rax
  unsigned __int64 i; // rax
  _BYTE *v17; // rax
  size_t v18; // rsi
  _BYTE *v19; // rbx
  _BYTE *v20; // r9
  int v21; // er11
  char *v22; // r8
  __int64 v23; // rcx
  char v24; // al
  __int64 v25; // r9
  __int64 v26; // rdx
  __int64 v27; // rax
  size_t Size; // [rsp+20h] [rbp-48h] BYREF
  __int128 key; // [rsp+28h] [rbp-40h] BYREF
  int v31; // [rsp+38h] [rbp-30h]
  int v32; // [rsp+3Ch] [rbp-2Ch]
  int Code[4]; // [rsp+40h] [rbp-28h] BYREF
  int v34; // [rsp+50h] [rbp-18h]

  *(_OWORD *)Code = 0i64;
  v34 = 0;
  sub_7FF6B91D18C0(std::cin, (__int64)argv, (__int64)Code);
  v3 = -1i64;
  len = -1i64;
  do
    ++len;
  while ( *((_BYTE *)Code + len) );
  if ( len != 19 )
  {
    sub_7FF6B91D1620(std::cout, "error\n");
    _exit((int)Code);
  }
  v5 = (__int128 *)operator new(5ui64);
  v6 = *(_QWORD *)&::Code;
  v7 = v5;
  v8 = 0;
  v9 = v5;
  do
  {
    v10 = *((_BYTE *)v9 + (char *)Code - (char *)v5);
    v11 = 0;
    *(_BYTE *)v9 = v10;
    v12 = 0i64;
    v13 = -1i64;
    do
      ++v13;
    while ( *(_BYTE *)(v6 + v13) );
    if ( v13 )
    {
      do
      {
        if ( v10 == *(_BYTE *)(v6 + v12) )
          break;
        ++v11;
        ++v12;
      }
      while ( v11 < v13 );
    }
    v14 = -1i64;
    do
      ++v14;
    while ( *(_BYTE *)(v6 + v14) );
    if ( v11 == v14 )
      _exit(v6);
    v9 = (__int128 *)((char *)v9 + 1);
  }
  while ( (char *)v9 - (char *)v5 < 4 );
  *((_BYTE *)v5 + 4) = 0;
  do
    ++v3;
  while ( *((_BYTE *)Code + v3) );
  v15 = 0i64;
  key = *v7;
  while ( *((_BYTE *)&key + v15) )
  {
    if ( !*((_BYTE *)&key + v15 + 1) )
    {
      ++v15;
      break;
    }
    if ( !*((_BYTE *)&key + v15 + 2) )
    {
      v15 += 2i64;
      break;
    }
    if ( !*((_BYTE *)&key + v15 + 3) )
    {
      v15 += 3i64;
      break;
    }
    v15 += 4i64;
    if ( v15 >= 0x10 )
      break;
  }
  for ( i = v15 + 1; i < 0x10; ++i )
    *((_BYTE *)&key + i) = 0;
  v17 = xxtea((__int64)Code, v3, (unsigned __int8 *)&key, &Size);      //第一部分
  v18 = Size;
  v19 = v17;
  v20 = operator new(Size);
  v21 = 1;
  *v20 = v19[2];                                // 求v20，求v19，第二部分
  v22 = v20 + 1;
  v20[1] = *v19;
  v20[2] = v19[3];
  v20[3] = v19[1];
  v20[4] = v19[6];
  v20[5] = v19[4];
  v20[6] = v19[7];
  v20[7] = v19[5];
  v20[8] = v19[10];
  v20[9] = v19[8];
  v20[10] = v19[11];
  v20[11] = v19[9];
  v20[12] = v19[14];
  v20[13] = v19[12];
  v20[14] = v19[15];
  v20[15] = v19[13];
  v20[16] = v19[18];
  v20[17] = v19[16];
  v20[18] = v19[19];
  v20[19] = v19[17];
  v20[20] = v19[22];
  v20[21] = v19[20];
  v20[22] = v19[23];
  for ( v20[23] = v19[21]; v21 < v18; ++v22 )              //第三部分
  {
    v23 = 0i64;
    if ( v21 / 3 > 0 )
    {
      v24 = *v22;
      do
      {
        v24 ^= v20[v23++];
        *v22 = v24;
      }
      while ( v23 < v21 / 3 );
    }
    ++v21;
  }
  *(_QWORD *)&key = 0xC0953A7C6B40BCCEui64;
  v25 = v20 - (_BYTE *)&key;
  *((_QWORD *)&key + 1) = 0x3502F79120209BEFi64;
  v26 = 0i64;
  v31 = 0xC8021823;
  v32 = 0xFA5656E7;
  do
  {
    if ( *((_BYTE *)&key + v26) != *((_BYTE *)&key + v26 + v25) )// 我们得到key是要和data对比的
      _exit(v8 * v8);
    ++v8;
    ++v26;
  }
  while ( v26 < 24 );
  v27 = sub_7FF6B91D1620(std::cout, "You win!");
  std::ostream::operator<<(v27, sub_7FF6B91D17F0);
  return 0;
}

这个题分为3个部分，我们跟踪一下flag的路线，首先v17是xxtea加密得到的，v19得到的密文转移到v20，v20又转移到v22，然后进行对比，所以我们从第三部分开始搞，我们选择z3来求解：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
from z3 import*
cmp_data = [206, 188, 64, 107, 124, 58, 149, 192, 239, 155, 32, 32, 145, 247, 2, 53, 35, 24, 2, 200, 231, 86, 86, 250]
s = Solver()
flag = [BitVec(('x%d' % i),8) for i in range(24) ]
for i in range(24):
  a = flag[i]
  for j in range(i // 3):
  a ^= flag[j]
    flag[i] = a
for i in range(24):
  s.add(flag[i] == cmp_data[i])
if s.check() == sat:
  model = s.model()
  print(model)
else:
  print("unsat")
#得到data  =[206,188,64,165,178,244,231,178,157,169,18,18,200,174,91,16,6,61,29,215,248,220,220,112]

然后在进行移位：

1
2
3
4
5
6
7
arr1 = [2,0,3,1,6,4,7,5,10,8,11,9,14,12,15,13,18,16,19,17,22,20,23,21]
data = [206,188,64,165,178,244,231,178,157,169,18,18,200,174,91,16,6,61,29,215,248,220,220,112]
data1 = [0 for i in range(24)]
for i in range(24):
  data1[arr1[i]] = data[i]
  print(data1)
#得到data1 = [188, 165, 206, 64, 244, 178, 178, 231, 169, 18, 157, 18, 174, 16, 200, 91, 61, 215, 6, 29, 220, 112, 248, 220]

那么最后再看第一个函数，就是xxtea加密，我只找到了python2的解密脚本，直接在网站上跑：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
import struct
_DELTA = 0x9E3779B9
def _long2str(v, w):
  n = (len(v) - 1) << 2
  if w:
    m = v[-1]
    if (m < n - 3) or (m > n): return ''
    n = m
  s = struct.pack('<%iL' % len(v), *v)
  return s[0:n] if w else s
def _str2long(s, w):
  n = len(s)
  m = (4 - (n & 3) & 3) + n
  s = s.ljust(m, "\0")
  v = list(struct.unpack('<%iL' % (m >> 2), s))
  if w: v.append(n)
  return v
def decrypt(str, key):
  if str == '': return str
  v = _str2long(str, False)
  k = _str2long(key.ljust(16, "\0"), False)
  n = len(v) - 1
  z = v[n]
  y = v[0]
  q = 6 + 52 // (n + 1)
  sum = (q * _DELTA) & 0xffffffff
  while (sum != 0):
    e = sum >> 2 & 3
    for p in xrange(n, 0, -1):
      z = v[p - 1]
      v[p] = (v[p] - ((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4) ^ (sum ^ y) + (k[p & 3 ^ e] ^ z))) & 0xffffffff
      y = v[p]
    z = v[n]
    v[0] = (v[0] - ((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4) ^ (sum ^ y) + (k[0 & 3 ^ e] ^ z))) & 0xffffffff
    y = v[0]
    sum = (sum - _DELTA) & 0xffffffff
  return _long2str(v, True)
if __name__ == "__main__":
  key = "flag"
  data1 = [188, 165, 206, 64, 244, 178, 178, 231, 169, 18, 157, 18, 174, 16, 200, 91, 61, 215, 6, 29, 220, 112, 248, 220]
  s = "".join(map(chr, data1))
  s = decrypt(s, key)
  print repr(s)

得到flag，之后介绍以下xxtea加密，rc4和tea加密。

normal25

终于碰到一道简单题了，这道题，先查字符串，发现很明显的base64加密。

1
2
3
4
5
6
7
8
9
10
11
12
Vm0wd2VHUXhTWGhpUm1SWVYwZDRWVll3Wkc5WFJsbDNXa1pPVlUxV2NIcFhhMk0xV
mpKS1NHVkdXbFpOYmtKVVZtcEtTMUl5VGtsaVJtUk9ZV3hhZVZadGVHdFRNVTVYVW
01T2FGSnRVbGhhVjNoaFZWWmtWMXBFVWxSTmJFcElWbTAxVDJGV1NuTlhia0pXWWx
ob1dGUnJXbXRXTVZaeVdrWm9hVlpyV1hwV1IzaGhXVmRHVjFOdVVsWmlhMHBZV1ZS
R1lWZEdVbFZTYlhSWFRWWndNRlZ0TVc5VWJGcFZWbXR3VjJKSFVYZFdha1pXWlZaT
2NtRkhhRk5pVjJoWVYxZDBhMVV3TlhOalJscFlZbGhTY1ZsclduZGxiR1J5VmxSR1
ZXSlZjRWhaTUZKaFZqSktWVkZZYUZkV1JWcFlWV3BHYTFkWFRrZFRiV3hvVFVoQ1d
sWXhaRFJpTWtsM1RVaG9hbEpYYUhOVmJUVkRZekZhY1ZKcmRGTk5Wa3A2VjJ0U1Ex
WlhTbFpqUldoYVRVWndkbFpxUmtwbGJVWklZVVprYUdFeGNHOVhXSEJIWkRGS2RGS
nJhR2hTYXpWdlZGVm9RMlJzV25STldHUlZUVlpXTlZadE5VOVdiVXBJVld4c1dtSl
lUWGhXTUZwell6RmFkRkpzVWxOaVNFSktWa1phVTFFeFduUlRhMlJxVWxad1YxWnR
lRXRXTVZaSFVsUnNVVlZVTURrPQ==

解密得到网址，看到三年前的网友在要flag哈哈哈哈哈哈哈哈哈哈哈哈，比较有乐趣。

但实际上并没有flag，我们可以在base64下看到引用的另一个函数，交叉引用进去才是真正解密函数。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
unsigned __int64 sub_400D35()
{
  unsigned __int64 result; // rax
  unsigned int v1; // [rsp+Ch] [rbp-24h]
  int i; // [rsp+10h] [rbp-20h]
  int j; // [rsp+14h] [rbp-1Ch]
  unsigned int v4; // [rsp+24h] [rbp-Ch]
  unsigned __int64 v5; // [rsp+28h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  v1 = sub_43FD20(0LL) - qword_6CEE38;
  for ( i = 0; i <= 1233; ++i )
  {
    sub_40F790(v1);
    sub_40FE60();
    sub_40FE60();
    v1 = sub_40FE60() ^ 0x98765432;
  }
  v4 = v1;
  if ( ((unsigned __int8)v1 ^ byte_6CC0A0[0]) == 'f' && (HIBYTE(v4) ^ (unsigned __int8)byte_6CC0A3) == 'g' )
  {
    for ( j = 0; j <= 24; ++j )
      sub_410E90((unsigned __int8)(byte_6CC0A0[j] ^ *((_BYTE *)&v4 + j % 4)));
  }
  result = __readfsqword(0x28u) ^ v5;
  if ( result )
    sub_444020();
  return result;
}

这个函数最主要的是在if这里，我们看到是和一个已知的数组异或，异或出的结果是flag，所以我们能搞出未知的字符串。

然后用这个未知的字符串再异或出我们要找到flag，给出脚本：

1
2
3
4
5
6
7
8
9
10
11
12
data=[0x40, 0x35, 0x20, 0x56, 0x5D, 0x18, 0x22, 0x45, 0x17, 0x2F, 0x24, 0x6E, 0x62, 0x3C, 0x27, 0x54, 0x48, 0x6C, 0x24, 0x6E, 0x72, 0x3C, 0x32, 0x45, 0x5B]
code=""
s="flag"
flag=""
for i in range(4):
  code += chr(data[i] ^ ord(s[i]))
print(code)
#&YA1
for j in range(25):
  flag += chr(data[j] ^ ord(code[j%4]))
print(flag)
#flag{Act1ve_Defen5e_Test}

normal30

这个题是一个小游戏，不管游戏直接分析

这个题通过汇编看就是一堆数与两个固定的数进行异或，然后打印这个flag，那么我们直接写脚本

1
2
3
4
5
6
a = [0x8E, 0x9D, 0x94, 0x98, 0xBB, 0x89, 0xF3, 0xEF, 0x83, 0xEE, 0xAD, 0x9B, 0x9F, 0xEC, 0x9F, 0x9A, 0xF0, 0xEB, 0x9F, 0x97, 0xF6, 0xBC, 0xF1, 0xE9, 0x9F, 0xE7, 0xA1, 0xB3, 0xF3, 0xA3]
data = [a[0] ^ ord("N"),a[1]^ord("C")]
flag = ""
for i in range(len(a)):
  flag += chr(a[i] ^ data[i % 2])
print(flag)

normal31

很难的一道题：我们进入main函数后发现没有踪迹，我们这时候在输入设断点，动调时发现，少了个hook的dll文件，所以只能参照wp来复现了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
int __stdcall sub_812AB0(int a1, int a2, int a3, int a4)
{
  size_t i; // [esp+D8h] [ebp-8h]

  for ( i = 0; i < j_strlen(Str); ++i )
  {
    if ( Str[i] <= 122 && Str[i] >= 97 )
    {
      Str[i] -= 32;
    }
    else if ( Str[i] <= 'Z' && Str[i] >= 'A' )
    {
      Str[i] += ' ';
    }
  }
  MessageBoxA(0, "hooked", "successed", 0);
  AddVectoredExceptionHandler(0, Handler);
  return 0;
}

这个函数是一个变表函数，即将大写变小写，小写变大写，然后弹出对话框，接下来是一个异常函数，这个异常可以使函数跳跃到另一个函数。

1
2
3
4
5
6
7
8
9
10
11
12
13
int __stdcall Handler_0(_DWORD **a1)
{
  char v2[20]; // [esp+D0h] [ebp-18h] BYREF

  if ( **a1 == -1073741819 )
  {
    qmemcpy(v2, "where_are_u_now?", 16);
    sub_811172((int)&unk_81A218, (int)v2);      // sm4自解密初始化
    SetUnhandledExceptionFilter(TopLevelExceptionFilter);// 触发异常，转到sub_412EA0
  }
  return 0;
}
//SetUnhandledExceptionFilter函数是异常捕获函数，返回设置的回调函数，就是跟异常跳转一样，跳转到另一个函数

我们接着动态调试，发现到了下面的函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
unsigned int __cdecl sub_811F50(int a1, unsigned int *a2)
{
  unsigned int result; // eax
  unsigned int v3; // [esp+D0h] [ebp-B8h]
  unsigned int v4; // [esp+DCh] [ebp-ACh]
  unsigned int v5; // [esp+E0h] [ebp-A8h]
  unsigned int v6; // [esp+E4h] [ebp-A4h]
  int v7[35]; // [esp+E8h] [ebp-A0h]
  unsigned int v8; // [esp+174h] [ebp-14h]
  unsigned int v9; // [esp+178h] [ebp-10h]
  unsigned int v10; // [esp+17Ch] [ebp-Ch]
  unsigned int v11; // [esp+180h] [ebp-8h]

  v3 = 0;
  v8 = _byteswap_ulong(*a2);
  v9 = _byteswap_ulong(a2[1]);
  v10 = _byteswap_ulong(a2[2]);
  v11 = _byteswap_ulong(a2[3]);
  v4 = v8 ^ 0xA3B1BAC6;
  v5 = dword_817A68[1] ^ v9;
  v6 = dword_817A68[2] ^ v10;
  result = 12;
  v7[0] = dword_817A68[3] ^ v11;
  while ( v3 < 0x20 )
  {
    v7[v3 + 1] = *(&v4 + v3) ^ sub_8114E0(dword_817A78[v3] ^ v7[v3] ^ v7[v3 - 1] ^ *(&v5 + v3));
    *(_DWORD *)(a1 + 4 * v3) = v7[v3 + 1];
    result = ++v3;
  }
  return result;
}
1
2
3
4
5
6
7
8
9
10
11
12
unsigned int __cdecl sub_8114E0(int a1)
{
  unsigned int v2; // [esp+D0h] [ebp-2Ch]
  unsigned int v3; // [esp+F4h] [ebp-8h]

  LOBYTE(v2) = sub_8119A0(SHIBYTE(a1));
  BYTE1(v2) = sub_8119A0(SBYTE2(a1));
  BYTE2(v2) = sub_8119A0(SBYTE1(a1));
  HIBYTE(v2) = sub_8119A0(a1);
  v3 = _byteswap_ulong(v2);
  return ((v3 >> 9) | (v3 << 23)) ^ v3 ^ ((v3 >> 19) | (v3 << 13));
}

以上函数都是sm4加密典型特征，其中sub_8119A0和dword_817A78这两个数组是典型代表。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
int __cdecl sub_812C30(_DWORD *a1)
{
  int result; // eax
  char v2; // [esp+D3h] [ebp-11h]
  size_t i; // [esp+DCh] [ebp-8h]

  result = (int)a1;
  if ( *(_DWORD *)*a1 == -1073741819 )
  {
    for ( i = 0; i < j_strlen(Str2); i += 2 )
    {
      v2 = Str2[i];
      Str2[i] = Str2[i + 1];
      Str2[i + 1] = v2;
    }
    Str1 = (char *)sub_81126C(byte_81A180);
    *(_DWORD *)(a1[1] + 176) = *(_DWORD *)(*a1 + 20);
    *(_DWORD *)(a1[1] + 164) = *(_DWORD *)(*a1 + 24);
    *(_DWORD *)(a1[1] + 172) = *(_DWORD *)(*a1 + 28);
    *(_DWORD *)(a1[1] + 168) = *(_DWORD *)(*a1 + 32);
    *(_DWORD *)(a1[1] + 156) = *(_DWORD *)(*a1 + 36);
    *(_DWORD *)(a1[1] + 160) = *(_DWORD *)(*a1 + 40);
    *(_DWORD *)(a1[1] + 184) = sub_811136;      //这个函数与字符串进行对比
    return -1;
  }
  return result;
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
_BYTE *__cdecl sub_813090(char *Str)
{
  int k; // [esp+E4h] [ebp-5Ch]
  int v3; // [esp+F0h] [ebp-50h]
  int j; // [esp+FCh] [ebp-44h]
  int v5; // [esp+108h] [ebp-38h]
  signed int i; // [esp+114h] [ebp-2Ch]
  _BYTE *v7; // [esp+120h] [ebp-20h]
  signed int v8; // [esp+12Ch] [ebp-14h]
  int v9; // [esp+138h] [ebp-8h]

  v5 = 0;
  v8 = j_strlen(Str);
  if ( v8 % 3 )
    v9 = 4 * (v8 / 3) + 4;
  else
    v9 = 4 * (v8 / 3);
  v7 = malloc(__CFADD__(v9, 1) ? -1 : v9 + 1);
  v7[v9] = 0;
  for ( i = 0; i < v8; i += 3 )
  {
    v3 = 0;
    for ( j = 0; j < 3; ++j )         //每3位形成缓冲区
      v3 |= (unsigned __int8)Str[j + i] << (8 * (2 - j));
    for ( k = 0; k < 4; ++k )
    {
      if ( k >= 4 - (i + 3 - v8) && i + 3 > v8 )//不足4位用！补齐
        v7[v5] = 33;
      else
        v7[v5] = ::Str[sub_8110FF((v3 >> (6 * (3 - k))) & 0x3F)];        //注意这点
      ++v5;
    }
  }
  return v7;
}

sub_81126C这个函数就是个base64加密

1
2
3
4
int __cdecl sub_812760(int a1)
{
  return (a1 + 24) % 64;
}

这里+24，相当于变表的值为原表取值右移24位

1
2
3
4
5
6
Str = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/"
Str1 = ''
for i in Str:
  Str1 += Str[(Str.find(i)+24) % len(Str)]
print (Str1)
#yzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/abcdefghijklmnopqrstuvwx

得到变表。

写脚本：

1
2
3
4
5
6
7
8
9
10
11
import base64
base = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
diy_base = 'yzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/abcdefghijklmnopqrstuvwx'
s = 'U1ATIOpkOyWSvGm/YOYFR4!!'
ss = ''
for i in range(len(s)-2):
  ss += base[diy_base.find(s[i])]
ss += '=='
a = base64.b64decode(ss)
print(list(map(hex,a)))
#['0x59', '0xd0', '0x95', '0x29', '0xd', '0xf2', '0x40', '0x6', '0x14', '0xf4', '0x8d', '0x27', '0x69', '0x6', '0x87', '0x4e']

得到sm4加密后的密文，where_are_u_now?是密钥，转换成hex

1
2
3
4
5
from pysm4 import encrypt, decrypt
cipher_num = 0x59d095290df2400614f48d276906874e
mk = 0x77686572655f6172655f755f6e6f773f
clear_num = decrypt(cipher_num, mk) 
print(hex(clear_num)[2:].replace('L',''))

用pysm4来解密,得到16进制，转换一下：

SM4foRExcepioN?!

normal32

终于是最后一道题了，

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
int __thiscall sub_C22810(void *this)
{
  int v1; // eax
  int v2; // ecx
  int v3; // eax
  int v4; // esi
  signed int v5; // edi
  unsigned int v6; // kr00_4
  int *v7; // ecx
  int *input_copy; // ecx
  int *v9; // ecx
  __int128 *v10; // edx
  unsigned int v11; // edi
  int v12; // eax
  int v13; // eax
  bool v14; // cf
  unsigned __int8 v15; // al
  unsigned __int8 v16; // al
  unsigned __int8 v17; // al
  const char *v18; // edx
  int v19; // eax
  int v20; // eax
  int v22; // [esp-14h] [ebp-D8h]
  int v23; // [esp-10h] [ebp-D4h]
  int *input; // [esp+24h] [ebp-A0h]
  int v25; // [esp+34h] [ebp-90h]
  unsigned int v26; // [esp+38h] [ebp-8Ch]
  __int128 v27; // [esp+3Ch] [ebp-88h]
  __int128 v28; // [esp+4Ch] [ebp-78h]
  int v29; // [esp+5Ch] [ebp-68h]
  __int128 v30; // [esp+60h] [ebp-64h]
  __int128 v31; // [esp+70h] [ebp-54h]
  int v32; // [esp+80h] [ebp-44h]
  __int64 v33; // [esp+84h] [ebp-40h]
  int v34; // [esp+8Ch] [ebp-38h]
  __int16 v35; // [esp+90h] [ebp-34h]
  int v36; // [esp+94h] [ebp-30h]
  int v37; // [esp+98h] [ebp-2Ch]
  int v38; // [esp+9Ch] [ebp-28h]
  int v39; // [esp+A0h] [ebp-24h]
  int v40; // [esp+A4h] [ebp-20h]
  int v41; // [esp+A8h] [ebp-1Ch]
  int v42; // [esp+ACh] [ebp-18h]
  int v43; // [esp+B0h] [ebp-14h]
  int v44; // [esp+C0h] [ebp-4h]

  v25 = 0;
  v26 = 15;
  LOBYTE(input) = 0;
  v44 = 0;
  LOBYTE(v44) = 1;
  v1 = printf(this, "Please input your flag: ");
  printf_(v1);
  sub_C237B0(&dword_C50068, &input);            // 获取输入input
  v34 = 'TC_9';                                 // v33~v35:"SWPU_2019_CTF"
  v33 = qword_C4B9A0;
  v35 = 'F';
  if ( v25 == 32 )                              // flag长度为32
  {
    v40 = 0xBA143D17;
    v41 = 0x1D730350;
    v42 = 0x9404607A;
    v43 = 0x290AF070;
    v5 = 0;
    v30 = 0i64;
    v32 = 0;
    v31 = 0i64;
    v6 = strlen((const char *)&v33);
    do                                          // 进行input和"SWPU_2019_CTF"循环异或
    {
      v7 = (int *)&input;
      if ( v26 >= 16 )
        v7 = input;
      *((_BYTE *)v7 + v5) ^= *((_BYTE *)&v33 + v5 % v6);
      ++v5;
    }
    while ( v5 < 32 );
    input_copy = (int *)&input;
    v4 = (int)input;
    if ( v26 >= 0x10 )
      input_copy = input;
    v29 = 0;
    v27 = 0i64;
    v28 = 0i64;
    *(_QWORD *)&v30 = *(_QWORD *)input_copy;
    *((_QWORD *)&v30 + 1) = *((_QWORD *)input_copy + 1);
    *(_QWORD *)&v31 = *((_QWORD *)input_copy + 2);
    *((_QWORD *)&v31 + 1) = *((_QWORD *)input_copy + 3);
    sub_C225C0(v22, v23, 256, (unsigned int)&v30, (unsigned int)&v27);// 对异或后的input进行处理，结果放在v27和v28
    v36 = 0xF80F37B3;
    v37 = 0x5DAEBCBC;
    v9 = &v36;
    v38 = 0x864D5ABA;
    v10 = &v27;
    v39 = 0xD3629744;
    v11 = 28;
    v40 = 0x1624BA4F;
    v41 = 0x1A729F0B;
    v42 = 0x266D6865;
    v43 = 0x67C86BBA;
    while ( 1 )                                 // while循环体是sub_C225C0函数对异或后input的处理结果与v36~v43比较
    {
      v12 = *v9;
      if ( *v9 != *(_DWORD *)v10 )
        break;
      ++v9;
      v10 = (__int128 *)((char *)v10 + 4);
      v14 = v11 < 4;
      v11 -= 4;
      if ( v14 )                                // v14为1，即v11<4时，验证正确
      {
        v13 = 0;
        goto LABEL_19;
      }
    }
    v14 = (unsigned __int8)v12 < *(_BYTE *)v10;
    if ( (_BYTE)v12 != *(_BYTE *)v10
      || (v15 = *((_BYTE *)v9 + 1), v14 = v15 < *((_BYTE *)v10 + 1), v15 != *((_BYTE *)v10 + 1))
      || (v16 = *((_BYTE *)v9 + 2), v14 = v16 < *((_BYTE *)v10 + 2), v16 != *((_BYTE *)v10 + 2))
      || (v17 = *((_BYTE *)v9 + 3), v14 = v17 < *((_BYTE *)v10 + 3), v17 != *((_BYTE *)v10 + 3)) )
    {
      v13 = -v14 | 1;
    }
    else
    {
      v13 = 0;
    }
LABEL_19:
    if ( v13 )                                  // v13为0时，验证正确
      v18 = "Try again!\r\n";
    else
      v18 = "Congratulations! I always knew you could do it.";
    v19 = printf(v9, v18);
    printf_(v19);
    sub_C2ADBE("pause");
  }
  else
  {
    v3 = printf(v2, "Try again!\r\n");
    printf_(v3);
    sub_C2ADBE("pause");
    v4 = (int)input;
  }
  if ( v26 >= 0x10 )
  {
    v20 = v4;
    if ( v26 + 1 >= 0x1000 )
    {
      v4 = *(_DWORD *)(v4 - 4);
      if ( (unsigned int)(v20 - v4 - 4) > 0x1F )
        sub_C2AFF7(v26 + 36);
    }
    sub_C264DE(v4);
  }
  return 0;
}

输入为abcdefghijklmnopqrstuvwxyz123456，经过与”SWPU_2019_CTF”的循环异或及变量赋值后，v30即为input循环异或后的结果可知sub_C225C0函数是对循环异或后的input的结果的再一次异或，但是不知道异或的是哪些值，由于我们输入是“abcdefghijklmnopqrstuvwxyz123456”，与”SWPU_2019_CTF”异或后的结果v30是确定的，可以通过调试得到sub_C225C0函数调用完后，结果v27和v28的值，再用v30异或v27和v28得到sub_C225C0函数中参与异或运算的另一些值

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#a是两次异或后，v27和v28的数据
a=[0xB4, 0x39, 0x0D, 0xFB, 0xA2, 0x83, 0xF9, 0x40, 0xB2, 0x42,
  0x43, 0x9E, 0x41, 0x9C, 0x4F, 0x90, 0x4D, 0xBC, 0x76, 0x41,
  0x3E, 0xB6, 0x53, 0x0B, 0x6E, 0x66, 0x29, 0x75, 0xE5, 0x1C,
  0xBE, 0x2C]
#b是input第一次异或后，v30的数据
b=[0x32, 0x35, 0x33, 0x31, 0x3A, 0x54, 0x57, 0x59, 0x50, 0x35,
  0x28, 0x38, 0x2B, 0x3D, 0x38, 0x20, 0x24, 0x2D, 0x41, 0x44,
  0x44, 0x4F, 0x28, 0x3B, 0x2D, 0x3C, 0x62, 0x65, 0x63, 0x61,
  0x6A, 0x04]
#a^b即可得到sub_C225C0函数中参与异或运算的另一些值
#cipher是最后要比较的数据
cipher=[0xB3, 0x37, 0x0F, 0xF8, 0xBC, 0xBC, 0xAE, 0x5D, 0xBA, 0x5A,
  0x4D, 0x86, 0x44, 0x97, 0x62, 0xD3, 0x4F, 0xBA, 0x24, 0x16,
  0x0B, 0x9F, 0x72, 0x1A, 0x65, 0x68, 0x6D, 0x26, 0xBA, 0x6B,
  0xC8, 0x67]
s="SWPU_2019_CTF"
flag=""
for i in range(len(cipher)):
    flag+=chr(a[i]^b[i]^cipher[i]^ord(s[i%len(s)]))
print(flag)
#flag{Y0uaretheB3st!#@_VirtualCC}